From 9fee67d231f71e9388963399e64fca249b53ebfe Mon Sep 17 00:00:00 2001 From: Onek8 Date: Sun, 4 Oct 2026 17:14:28 -0700 Subject: [PATCH] Haxe Lib Datachannel --- lib/datachannel/.gitignore | 8 + lib/datachannel/LICENSE | 21 + lib/datachannel/cpp/libdatachannel/LICENSE | 373 ++ .../cpp/libdatachannel/deps/mbedtls/LICENSE | 553 ++ .../deps/mbedtls/include/.gitignore | 4 + .../deps/mbedtls/include/CMakeLists.txt | 22 + .../deps/mbedtls/include/mbedtls/aes.h | 631 ++ .../deps/mbedtls/include/mbedtls/aria.h | 343 + .../deps/mbedtls/include/mbedtls/asn1.h | 642 ++ .../deps/mbedtls/include/mbedtls/asn1write.h | 390 ++ .../deps/mbedtls/include/mbedtls/base64.h | 82 + .../deps/mbedtls/include/mbedtls/bignum.h | 1088 +++ .../mbedtls/include/mbedtls/block_cipher.h | 76 + .../deps/mbedtls/include/mbedtls/build_info.h | 194 + .../deps/mbedtls/include/mbedtls/camellia.h | 305 + .../deps/mbedtls/include/mbedtls/ccm.h | 526 ++ .../deps/mbedtls/include/mbedtls/chacha20.h | 202 + .../deps/mbedtls/include/mbedtls/chachapoly.h | 342 + .../mbedtls/include/mbedtls/check_config.h | 1149 ++++ .../deps/mbedtls/include/mbedtls/cipher.h | 1250 ++++ .../deps/mbedtls/include/mbedtls/cmac.h | 246 + .../deps/mbedtls/include/mbedtls/compat-2.x.h | 46 + .../mbedtls/config_adjust_legacy_crypto.h | 578 ++ .../mbedtls/config_adjust_legacy_from_psa.h | 873 +++ .../mbedtls/config_adjust_psa_from_legacy.h | 359 + .../config_adjust_psa_superset_legacy.h | 145 + .../include/mbedtls/config_adjust_ssl.h | 91 + .../include/mbedtls/config_adjust_x509.h | 35 + .../deps/mbedtls/include/mbedtls/config_psa.h | 61 + .../mbedtls/include/mbedtls/constant_time.h | 36 + .../deps/mbedtls/include/mbedtls/ctr_drbg.h | 596 ++ .../deps/mbedtls/include/mbedtls/debug.h | 156 + .../deps/mbedtls/include/mbedtls/des.h | 385 ++ .../deps/mbedtls/include/mbedtls/dhm.h | 972 +++ .../deps/mbedtls/include/mbedtls/ecdh.h | 454 ++ .../deps/mbedtls/include/mbedtls/ecdsa.h | 674 ++ .../deps/mbedtls/include/mbedtls/ecjpake.h | 298 + .../deps/mbedtls/include/mbedtls/ecp.h | 1528 +++++ .../deps/mbedtls/include/mbedtls/entropy.h | 274 + .../deps/mbedtls/include/mbedtls/error.h | 201 + .../deps/mbedtls/include/mbedtls/gcm.h | 387 ++ .../deps/mbedtls/include/mbedtls/hkdf.h | 124 + .../deps/mbedtls/include/mbedtls/hmac_drbg.h | 434 ++ .../deps/mbedtls/include/mbedtls/lms.h | 440 ++ .../mbedtls/include/mbedtls/mbedtls_config.h | 4437 +++++++++++++ .../deps/mbedtls/include/mbedtls/md.h | 526 ++ .../deps/mbedtls/include/mbedtls/md5.h | 190 + .../include/mbedtls/memory_buffer_alloc.h | 142 + .../mbedtls/include/mbedtls/net_sockets.h | 299 + .../deps/mbedtls/include/mbedtls/nist_kw.h | 166 + .../deps/mbedtls/include/mbedtls/oid.h | 727 ++ .../deps/mbedtls/include/mbedtls/pem.h | 160 + .../deps/mbedtls/include/mbedtls/pk.h | 1299 ++++ .../deps/mbedtls/include/mbedtls/pkcs12.h | 186 + .../deps/mbedtls/include/mbedtls/pkcs5.h | 198 + .../deps/mbedtls/include/mbedtls/pkcs7.h | 240 + .../deps/mbedtls/include/mbedtls/platform.h | 516 ++ .../mbedtls/include/mbedtls/platform_time.h | 79 + .../mbedtls/include/mbedtls/platform_util.h | 247 + .../deps/mbedtls/include/mbedtls/poly1305.h | 168 + .../mbedtls/include/mbedtls/private_access.h | 20 + .../deps/mbedtls/include/mbedtls/psa_util.h | 207 + .../deps/mbedtls/include/mbedtls/ripemd160.h | 136 + .../deps/mbedtls/include/mbedtls/rsa.h | 1164 ++++ .../deps/mbedtls/include/mbedtls/sha1.h | 219 + .../deps/mbedtls/include/mbedtls/sha256.h | 200 + .../deps/mbedtls/include/mbedtls/sha3.h | 172 + .../deps/mbedtls/include/mbedtls/sha512.h | 208 + .../deps/mbedtls/include/mbedtls/ssl.h | 5882 +++++++++++++++++ .../deps/mbedtls/include/mbedtls/ssl_cache.h | 187 + .../include/mbedtls/ssl_ciphersuites.h | 482 ++ .../deps/mbedtls/include/mbedtls/ssl_cookie.h | 106 + .../deps/mbedtls/include/mbedtls/ssl_ticket.h | 199 + .../deps/mbedtls/include/mbedtls/threading.h | 167 + .../deps/mbedtls/include/mbedtls/timing.h | 94 + .../deps/mbedtls/include/mbedtls/version.h | 78 + .../deps/mbedtls/include/mbedtls/x509.h | 500 ++ .../deps/mbedtls/include/mbedtls/x509_crl.h | 184 + .../deps/mbedtls/include/mbedtls/x509_crt.h | 1208 ++++ .../deps/mbedtls/include/mbedtls/x509_csr.h | 382 ++ .../deps/mbedtls/include/psa/build_info.h | 20 + .../deps/mbedtls/include/psa/crypto.h | 4977 ++++++++++++++ .../include/psa/crypto_adjust_auto_enabled.h | 31 + .../psa/crypto_adjust_config_dependencies.h | 51 + .../psa/crypto_adjust_config_key_pair_types.h | 101 + .../psa/crypto_adjust_config_synonyms.h | 49 + .../include/psa/crypto_builtin_composites.h | 214 + .../psa/crypto_builtin_key_derivation.h | 118 + .../include/psa/crypto_builtin_primitives.h | 114 + .../deps/mbedtls/include/psa/crypto_compat.h | 230 + .../deps/mbedtls/include/psa/crypto_config.h | 145 + .../include/psa/crypto_driver_common.h | 44 + .../psa/crypto_driver_contexts_composites.h | 151 + .../crypto_driver_contexts_key_derivation.h | 52 + .../psa/crypto_driver_contexts_primitives.h | 105 + .../deps/mbedtls/include/psa/crypto_extra.h | 2145 ++++++ .../deps/mbedtls/include/psa/crypto_legacy.h | 88 + .../mbedtls/include/psa/crypto_platform.h | 102 + .../mbedtls/include/psa/crypto_se_driver.h | 1383 ++++ .../deps/mbedtls/include/psa/crypto_sizes.h | 1319 ++++ .../deps/mbedtls/include/psa/crypto_struct.h | 527 ++ .../deps/mbedtls/include/psa/crypto_types.h | 508 ++ .../deps/mbedtls/include/psa/crypto_values.h | 2783 ++++++++ .../include/rtc/av1rtppacketizer.hpp | 57 + .../libdatachannel/include/rtc/candidate.hpp | 77 + .../libdatachannel/include/rtc/channel.hpp | 61 + .../cpp/libdatachannel/include/rtc/common.hpp | 85 + .../include/rtc/configuration.hpp | 130 + .../include/rtc/datachannel.hpp | 80 + .../include/rtc/dependencydescriptor.hpp | 107 + .../include/rtc/description.hpp | 401 ++ .../libdatachannel/include/rtc/frameinfo.hpp | 44 + .../cpp/libdatachannel/include/rtc/global.hpp | 66 + .../include/rtc/h264rtpdepacketizer.hpp | 42 + .../include/rtc/h264rtppacketizer.hpp | 57 + .../include/rtc/h265nalunit.hpp | 194 + .../include/rtc/h265rtpdepacketizer.hpp | 45 + .../include/rtc/h265rtppacketizer.hpp | 55 + .../include/rtc/iceudpmuxlistener.hpp | 47 + .../include/rtc/mediahandler.hpp | 60 + .../libdatachannel/include/rtc/message.hpp | 100 + .../libdatachannel/include/rtc/nalunit.hpp | 197 + .../include/rtc/pacinghandler.hpp | 61 + .../include/rtc/peerconnection.hpp | 142 + .../libdatachannel/include/rtc/plihandler.hpp | 41 + .../include/rtc/reliability.hpp | 43 + .../include/rtc/rembhandler.hpp | 35 + .../cpp/libdatachannel/include/rtc/rtc.h | 581 ++ .../cpp/libdatachannel/include/rtc/rtc.hpp | 53 + .../include/rtc/rtcpapphandler.hpp | 36 + .../include/rtc/rtcpnackresponder.hpp | 89 + .../include/rtc/rtcpreceivingsession.hpp | 95 + .../include/rtc/rtcpsrreporter.hpp | 49 + .../cpp/libdatachannel/include/rtc/rtp.hpp | 407 ++ .../include/rtc/rtpdepacketizer.hpp | 79 + .../include/rtc/rtppacketizationconfig.hpp | 141 + .../include/rtc/rtppacketizer.hpp | 106 + .../cpp/libdatachannel/include/rtc/track.hpp | 70 + .../cpp/libdatachannel/include/rtc/utils.hpp | 174 + .../cpp/libdatachannel/include/rtc/version.h | 9 + .../include/rtc/video_layers_allocation.hpp | 50 + .../include/rtc/vp8rtpdepacketizer.hpp | 34 + .../include/rtc/vp8rtppacketizer.hpp | 42 + .../include/rtc/vp9rtpdepacketizer.hpp | 34 + .../include/rtc/vp9rtppacketizer.hpp | 41 + .../libdatachannel/include/rtc/websocket.hpp | 72 + .../include/rtc/websocketserver.hpp | 48 + lib/datachannel/cpp/src/aegis128x4.c | 249 + lib/datachannel/cpp/src/datachannel.c | 721 ++ lib/datachannel/cpp/src/ssl3.c | 763 +++ lib/datachannel/haxelib.json | 20 + lib/datachannel/kincfile.js | 42 + lib/datachannel/lib/MbedTLS.lib | Bin 0 -> 3020832 bytes lib/datachannel/lib/datachannel-static.lib | Bin 0 -> 13317576 bytes lib/datachannel/lib/juice-static.lib | Bin 0 -> 626580 bytes lib/datachannel/lib/usrsctp.lib | Bin 0 -> 1236726 bytes lib/datachannel/src/datachannel/RTC.hx | 68 + .../src/datachannel/RTCDataChannel.hl.hx | 130 + .../src/datachannel/RTCDataChannel.hx | 69 + .../src/datachannel/RTCDataChannel.js.hx | 124 + .../src/datachannel/RTCException.hx | 5 + .../src/datachannel/RTCPeerConnection.hl.hx | 228 + .../src/datachannel/RTCPeerConnection.hx | 113 + .../src/datachannel/RTCPeerConnection.js.hx | 237 + 164 files changed, 61432 insertions(+) create mode 100644 lib/datachannel/.gitignore create mode 100644 lib/datachannel/LICENSE create mode 100644 lib/datachannel/cpp/libdatachannel/LICENSE create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/LICENSE create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/.gitignore create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/CMakeLists.txt create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aes.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aria.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1write.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/base64.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/bignum.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/block_cipher.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/build_info.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/camellia.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ccm.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chacha20.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chachapoly.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/check_config.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cipher.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cmac.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/compat-2.x.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_crypto.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_from_legacy.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_superset_legacy.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_ssl.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_x509.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_psa.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/constant_time.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ctr_drbg.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/debug.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/des.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/dhm.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdh.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdsa.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecjpake.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecp.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/entropy.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/error.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/gcm.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hkdf.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hmac_drbg.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/lms.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/mbedtls_config.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md5.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/memory_buffer_alloc.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/net_sockets.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/nist_kw.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/oid.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pem.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pk.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs12.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs5.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs7.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_time.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_util.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/poly1305.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/private_access.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/psa_util.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ripemd160.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/rsa.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha1.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha256.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha3.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha512.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cache.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ciphersuites.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cookie.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ticket.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/threading.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/timing.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/version.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crl.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crt.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_csr.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/build_info.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_auto_enabled.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_dependencies.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_key_pair_types.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_synonyms.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_composites.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_key_derivation.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_primitives.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_compat.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_config.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_common.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_composites.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_key_derivation.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_primitives.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_extra.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_legacy.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_platform.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_se_driver.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_sizes.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_struct.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_types.h create mode 100644 lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_values.h create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/av1rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/candidate.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/channel.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/common.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/configuration.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/datachannel.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/dependencydescriptor.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/description.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/frameinfo.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/global.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/h264rtpdepacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/h264rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/h265nalunit.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/h265rtpdepacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/h265rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/iceudpmuxlistener.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/mediahandler.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/message.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/nalunit.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/pacinghandler.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/peerconnection.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/plihandler.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/reliability.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rembhandler.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtc.h create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtc.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtcpapphandler.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtcpnackresponder.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtcpreceivingsession.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtcpsrreporter.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtp.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtpdepacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizationconfig.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/track.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/utils.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/version.h create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/video_layers_allocation.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtpdepacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtpdepacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtppacketizer.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/websocket.hpp create mode 100644 lib/datachannel/cpp/libdatachannel/include/rtc/websocketserver.hpp create mode 100644 lib/datachannel/cpp/src/aegis128x4.c create mode 100644 lib/datachannel/cpp/src/datachannel.c create mode 100644 lib/datachannel/cpp/src/ssl3.c create mode 100644 lib/datachannel/haxelib.json create mode 100644 lib/datachannel/kincfile.js create mode 100644 lib/datachannel/lib/MbedTLS.lib create mode 100644 lib/datachannel/lib/datachannel-static.lib create mode 100644 lib/datachannel/lib/juice-static.lib create mode 100644 lib/datachannel/lib/usrsctp.lib create mode 100644 lib/datachannel/src/datachannel/RTC.hx create mode 100644 lib/datachannel/src/datachannel/RTCDataChannel.hl.hx create mode 100644 lib/datachannel/src/datachannel/RTCDataChannel.hx create mode 100644 lib/datachannel/src/datachannel/RTCDataChannel.js.hx create mode 100644 lib/datachannel/src/datachannel/RTCException.hx create mode 100644 lib/datachannel/src/datachannel/RTCPeerConnection.hl.hx create mode 100644 lib/datachannel/src/datachannel/RTCPeerConnection.hx create mode 100644 lib/datachannel/src/datachannel/RTCPeerConnection.js.hx diff --git a/lib/datachannel/.gitignore b/lib/datachannel/.gitignore new file mode 100644 index 00000000..1fe11627 --- /dev/null +++ b/lib/datachannel/.gitignore @@ -0,0 +1,8 @@ +.vs +cpp/out +cpp/CMakeSettings.json +bin +index2.html +examples/copy-paste/bin +examples/heaps/bin +node_modules \ No newline at end of file diff --git a/lib/datachannel/LICENSE b/lib/datachannel/LICENSE new file mode 100644 index 00000000..3d76a560 --- /dev/null +++ b/lib/datachannel/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024 RandomityGuy + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/lib/datachannel/cpp/libdatachannel/LICENSE b/lib/datachannel/cpp/libdatachannel/LICENSE new file mode 100644 index 00000000..14e2f777 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/LICENSE @@ -0,0 +1,373 @@ +Mozilla Public License Version 2.0 +================================== + +1. Definitions +-------------- + +1.1. "Contributor" + means each individual or legal entity that creates, contributes to + the creation of, or owns Covered Software. + +1.2. "Contributor Version" + means the combination of the Contributions of others (if any) used + by a Contributor and that particular Contributor's Contribution. + +1.3. "Contribution" + means Covered Software of a particular Contributor. + +1.4. "Covered Software" + means Source Code Form to which the initial Contributor has attached + the notice in Exhibit A, the Executable Form of such Source Code + Form, and Modifications of such Source Code Form, in each case + including portions thereof. + +1.5. "Incompatible With Secondary Licenses" + means + + (a) that the initial Contributor has attached the notice described + in Exhibit B to the Covered Software; or + + (b) that the Covered Software was made available under the terms of + version 1.1 or earlier of the License, but not also under the + terms of a Secondary License. + +1.6. "Executable Form" + means any form of the work other than Source Code Form. + +1.7. "Larger Work" + means a work that combines Covered Software with other material, in + a separate file or files, that is not Covered Software. + +1.8. "License" + means this document. + +1.9. "Licensable" + means having the right to grant, to the maximum extent possible, + whether at the time of the initial grant or subsequently, any and + all of the rights conveyed by this License. + +1.10. "Modifications" + means any of the following: + + (a) any file in Source Code Form that results from an addition to, + deletion from, or modification of the contents of Covered + Software; or + + (b) any new file in Source Code Form that contains any Covered + Software. + +1.11. "Patent Claims" of a Contributor + means any patent claim(s), including without limitation, method, + process, and apparatus claims, in any patent Licensable by such + Contributor that would be infringed, but for the grant of the + License, by the making, using, selling, offering for sale, having + made, import, or transfer of either its Contributions or its + Contributor Version. + +1.12. "Secondary License" + means either the GNU General Public License, Version 2.0, the GNU + Lesser General Public License, Version 2.1, the GNU Affero General + Public License, Version 3.0, or any later versions of those + licenses. + +1.13. "Source Code Form" + means the form of the work preferred for making modifications. + +1.14. "You" (or "Your") + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that + controls, is controlled by, or is under common control with You. For + purposes of this definition, "control" means (a) the power, direct + or indirect, to cause the direction or management of such entity, + whether by contract or otherwise, or (b) ownership of more than + fifty percent (50%) of the outstanding shares or beneficial + ownership of such entity. + +2. License Grants and Conditions +-------------------------------- + +2.1. Grants + +Each Contributor hereby grants You a world-wide, royalty-free, +non-exclusive license: + +(a) under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or + as part of a Larger Work; and + +(b) under Patent Claims of such Contributor to make, use, sell, offer + for sale, have made, import, and otherwise transfer either its + Contributions or its Contributor Version. + +2.2. Effective Date + +The licenses granted in Section 2.1 with respect to any Contribution +become effective for each Contribution on the date the Contributor first +distributes such Contribution. + +2.3. Limitations on Grant Scope + +The licenses granted in this Section 2 are the only rights granted under +this License. No additional rights or licenses will be implied from the +distribution or licensing of Covered Software under this License. +Notwithstanding Section 2.1(b) above, no patent license is granted by a +Contributor: + +(a) for any code that a Contributor has removed from Covered Software; + or + +(b) for infringements caused by: (i) Your and any other third party's + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + +(c) under Patent Claims infringed by Covered Software in the absence of + its Contributions. + +This License does not grant any rights in the trademarks, service marks, +or logos of any Contributor (except as may be necessary to comply with +the notice requirements in Section 3.4). + +2.4. Subsequent Licenses + +No Contributor makes additional grants as a result of Your choice to +distribute the Covered Software under a subsequent version of this +License (see Section 10.2) or under the terms of a Secondary License (if +permitted under the terms of Section 3.3). + +2.5. Representation + +Each Contributor represents that the Contributor believes its +Contributions are its original creation(s) or it has sufficient rights +to grant the rights to its Contributions conveyed by this License. + +2.6. Fair Use + +This License is not intended to limit any rights You have under +applicable copyright doctrines of fair use, fair dealing, or other +equivalents. + +2.7. Conditions + +Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted +in Section 2.1. + +3. Responsibilities +------------------- + +3.1. Distribution of Source Form + +All distribution of Covered Software in Source Code Form, including any +Modifications that You create or to which You contribute, must be under +the terms of this License. You must inform recipients that the Source +Code Form of the Covered Software is governed by the terms of this +License, and how they can obtain a copy of this License. You may not +attempt to alter or restrict the recipients' rights in the Source Code +Form. + +3.2. Distribution of Executable Form + +If You distribute Covered Software in Executable Form then: + +(a) such Covered Software must also be made available in Source Code + Form, as described in Section 3.1, and You must inform recipients of + the Executable Form how they can obtain a copy of such Source Code + Form by reasonable means in a timely manner, at a charge no more + than the cost of distribution to the recipient; and + +(b) You may distribute such Executable Form under the terms of this + License, or sublicense it under different terms, provided that the + license for the Executable Form does not attempt to limit or alter + the recipients' rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + +You may create and distribute a Larger Work under terms of Your choice, +provided that You also comply with the requirements of this License for +the Covered Software. If the Larger Work is a combination of Covered +Software with a work governed by one or more Secondary Licenses, and the +Covered Software is not Incompatible With Secondary Licenses, this +License permits You to additionally distribute such Covered Software +under the terms of such Secondary License(s), so that the recipient of +the Larger Work may, at their option, further distribute the Covered +Software under the terms of either this License or such Secondary +License(s). + +3.4. Notices + +You may not remove or alter the substance of any license notices +(including copyright notices, patent notices, disclaimers of warranty, +or limitations of liability) contained within the Source Code Form of +the Covered Software, except that You may alter any license notices to +the extent required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + +You may choose to offer, and to charge a fee for, warranty, support, +indemnity or liability obligations to one or more recipients of Covered +Software. However, You may do so only on Your own behalf, and not on +behalf of any Contributor. You must make it absolutely clear that any +such warranty, support, indemnity, or liability obligation is offered by +You alone, and You hereby agree to indemnify every Contributor for any +liability incurred by such Contributor as a result of warranty, support, +indemnity or liability terms You offer. You may include additional +disclaimers of warranty and limitations of liability specific to any +jurisdiction. + +4. Inability to Comply Due to Statute or Regulation +--------------------------------------------------- + +If it is impossible for You to comply with any of the terms of this +License with respect to some or all of the Covered Software due to +statute, judicial order, or regulation then You must: (a) comply with +the terms of this License to the maximum extent possible; and (b) +describe the limitations and the code they affect. Such description must +be placed in a text file included with all distributions of the Covered +Software under this License. Except to the extent prohibited by statute +or regulation, such description must be sufficiently detailed for a +recipient of ordinary skill to be able to understand it. + +5. Termination +-------------- + +5.1. The rights granted under this License will terminate automatically +if You fail to comply with any of its terms. However, if You become +compliant, then the rights granted under this License from a particular +Contributor are reinstated (a) provisionally, unless and until such +Contributor explicitly and finally terminates Your grants, and (b) on an +ongoing basis, if such Contributor fails to notify You of the +non-compliance by some reasonable means prior to 60 days after You have +come back into compliance. Moreover, Your grants from a particular +Contributor are reinstated on an ongoing basis if such Contributor +notifies You of the non-compliance by some reasonable means, this is the +first time You have received notice of non-compliance with this License +from such Contributor, and You become compliant prior to 30 days after +Your receipt of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent +infringement claim (excluding declaratory judgment actions, +counter-claims, and cross-claims) alleging that a Contributor Version +directly or indirectly infringes any patent, then the rights granted to +You by any and all Contributors for the Covered Software under Section +2.1 of this License shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all +end user license agreements (excluding distributors and resellers) which +have been validly granted by You or Your distributors under this License +prior to termination shall survive termination. + +************************************************************************ +* * +* 6. Disclaimer of Warranty * +* ------------------------- * +* * +* Covered Software is provided under this License on an "as is" * +* basis, without warranty of any kind, either expressed, implied, or * +* statutory, including, without limitation, warranties that the * +* Covered Software is free of defects, merchantable, fit for a * +* particular purpose or non-infringing. The entire risk as to the * +* quality and performance of the Covered Software is with You. * +* Should any Covered Software prove defective in any respect, You * +* (not any Contributor) assume the cost of any necessary servicing, * +* repair, or correction. This disclaimer of warranty constitutes an * +* essential part of this License. No use of any Covered Software is * +* authorized under this License except under this disclaimer. * +* * +************************************************************************ + +************************************************************************ +* * +* 7. Limitation of Liability * +* -------------------------- * +* * +* Under no circumstances and under no legal theory, whether tort * +* (including negligence), contract, or otherwise, shall any * +* Contributor, or anyone who distributes Covered Software as * +* permitted above, be liable to You for any direct, indirect, * +* special, incidental, or consequential damages of any character * +* including, without limitation, damages for lost profits, loss of * +* goodwill, work stoppage, computer failure or malfunction, or any * +* and all other commercial damages or losses, even if such party * +* shall have been informed of the possibility of such damages. This * +* limitation of liability shall not apply to liability for death or * +* personal injury resulting from such party's negligence to the * +* extent applicable law prohibits such limitation. Some * +* jurisdictions do not allow the exclusion or limitation of * +* incidental or consequential damages, so this exclusion and * +* limitation may not apply to You. * +* * +************************************************************************ + +8. Litigation +------------- + +Any litigation relating to this License may be brought only in the +courts of a jurisdiction where the defendant maintains its principal +place of business and such litigation shall be governed by laws of that +jurisdiction, without reference to its conflict-of-law provisions. +Nothing in this Section shall prevent a party's ability to bring +cross-claims or counter-claims. + +9. Miscellaneous +---------------- + +This License represents the complete agreement concerning the subject +matter hereof. If any provision of this License is held to be +unenforceable, such provision shall be reformed only to the extent +necessary to make it enforceable. Any law or regulation which provides +that the language of a contract shall be construed against the drafter +shall not be used to construe this License against a Contributor. + +10. Versions of the License +--------------------------- + +10.1. New Versions + +Mozilla Foundation is the license steward. Except as provided in Section +10.3, no one other than the license steward has the right to modify or +publish new versions of this License. Each version will be given a +distinguishing version number. + +10.2. Effect of New Versions + +You may distribute the Covered Software under the terms of the version +of the License under which You originally received the Covered Software, +or under the terms of any subsequent version published by the license +steward. + +10.3. Modified Versions + +If you create software not governed by this License, and you want to +create a new license for such software, you may create and use a +modified version of this License if you rename the license and remove +any references to the name of the license steward (except to note that +such modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary +Licenses + +If You choose to distribute Source Code Form that is Incompatible With +Secondary Licenses under the terms of this version of the License, the +notice described in Exhibit B of this License must be attached. + +Exhibit A - Source Code Form License Notice +------------------------------------------- + + This Source Code Form is subject to the terms of the Mozilla Public + License, v. 2.0. If a copy of the MPL was not distributed with this + file, You can obtain one at http://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular +file, then You may include the notice in a location (such as a LICENSE +file in a relevant directory) where a recipient would be likely to look +for such a notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - "Incompatible With Secondary Licenses" Notice +--------------------------------------------------------- + + This Source Code Form is "Incompatible With Secondary Licenses", as + defined by the Mozilla Public License, v. 2.0. diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/LICENSE b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/LICENSE new file mode 100644 index 00000000..776ac77e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/LICENSE @@ -0,0 +1,553 @@ +Mbed TLS files are provided under a dual [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) +OR [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) license. +This means that users may choose which of these licenses they take the code +under. + +The full text of each of these licenses is given below. + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +=============================================================================== + + + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/.gitignore b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/.gitignore new file mode 100644 index 00000000..bf67d02e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/.gitignore @@ -0,0 +1,4 @@ +Makefile +*.sln +*.vcxproj +mbedtls/check_config diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/CMakeLists.txt b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/CMakeLists.txt new file mode 100644 index 00000000..2df66611 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/CMakeLists.txt @@ -0,0 +1,22 @@ +option(INSTALL_MBEDTLS_HEADERS "Install Mbed TLS headers." ON) + +if(INSTALL_MBEDTLS_HEADERS) + + file(GLOB headers "mbedtls/*.h") + file(GLOB psa_headers "psa/*.h") + + install(FILES ${headers} + DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + + install(FILES ${psa_headers} + DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/psa + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + +endif(INSTALL_MBEDTLS_HEADERS) + +# Make mbedtls_config.h available in an out-of-source build. ssl-opt.sh requires it. +if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) + link_to_source(mbedtls) + link_to_source(psa) +endif() diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aes.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aes.h new file mode 100644 index 00000000..d5eb1fd5 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aes.h @@ -0,0 +1,631 @@ +/** + * \file aes.h + * + * \brief This file contains AES definitions and functions. + * + * The Advanced Encryption Standard (AES) specifies a FIPS-approved + * cryptographic algorithm that can be used to protect electronic + * data. + * + * The AES algorithm is a symmetric block cipher that can + * encrypt and decrypt information. For more information, see + * FIPS Publication 197: Advanced Encryption Standard and + * ISO/IEC 18033-2:2006: Information technology -- Security + * techniques -- Encryption algorithms -- Part 2: Asymmetric + * ciphers. + * + * The AES-XTS block mode is standardized by NIST SP 800-38E + * + * and described in detail by IEEE P1619 + * . + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_AES_H +#define MBEDTLS_AES_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include +#include + +/* padlock.c and aesni.c rely on these values! */ +#define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */ +#define MBEDTLS_AES_DECRYPT 0 /**< AES decryption. */ + +/* Error codes in range 0x0020-0x0022 */ +/** Invalid key length. */ +#define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH -0x0020 +/** Invalid data input length. */ +#define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH -0x0022 + +/* Error codes in range 0x0021-0x0025 */ +/** Invalid input data. */ +#define MBEDTLS_ERR_AES_BAD_INPUT_DATA -0x0021 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_AES_ALT) +// Regular implementation +// + +/** + * \brief The AES context-type definition. + */ +typedef struct mbedtls_aes_context { + int MBEDTLS_PRIVATE(nr); /*!< The number of rounds. */ + size_t MBEDTLS_PRIVATE(rk_offset); /*!< The offset in array elements to AES + round keys in the buffer. */ +#if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && !defined(MBEDTLS_PADLOCK_C) + uint32_t MBEDTLS_PRIVATE(buf)[44]; /*!< Aligned data buffer to hold + 10 round keys for 128-bit case. */ +#else + uint32_t MBEDTLS_PRIVATE(buf)[68]; /*!< Unaligned data buffer. This buffer can + hold 32 extra Bytes, which can be used for + one of the following purposes: +
  • Alignment if VIA padlock is + used.
    • +
  • Simplifying key expansion in the 256-bit + case by generating an extra round key. +
*/ +#endif /* MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH && !MBEDTLS_PADLOCK_C */ +} +mbedtls_aes_context; + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief The AES XTS context-type definition. + */ +typedef struct mbedtls_aes_xts_context { + mbedtls_aes_context MBEDTLS_PRIVATE(crypt); /*!< The AES context to use for AES block + encryption or decryption. */ + mbedtls_aes_context MBEDTLS_PRIVATE(tweak); /*!< The AES context used for tweak + computation. */ +} mbedtls_aes_xts_context; +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#else /* MBEDTLS_AES_ALT */ +#include "aes_alt.h" +#endif /* MBEDTLS_AES_ALT */ + +/** + * \brief This function initializes the specified AES context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_init(mbedtls_aes_context *ctx); + +/** + * \brief This function releases and clears the specified AES context. + * + * \param ctx The AES context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_free(mbedtls_aes_context *ctx); + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function initializes the specified AES XTS context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES XTS context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_xts_init(mbedtls_aes_xts_context *ctx); + +/** + * \brief This function releases and clears the specified AES XTS context. + * + * \param ctx The AES XTS context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_xts_free(mbedtls_aes_xts_context *ctx); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function sets the encryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_enc(mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits); + +#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +/** + * \brief This function sets the decryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_dec(mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits); +#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function prepares an XTS context for encryption and + * sets the encryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_enc(mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits); + +/** + * \brief This function prepares an XTS context for decryption and + * sets the decryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_dec(mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function performs an AES single-block encryption or + * decryption operation. + * + * It performs the operation defined in the \p mode parameter + * (encrypt or decrypt), on the input data buffer defined in + * the \p input parameter. + * + * mbedtls_aes_init(), and either mbedtls_aes_setkey_enc() or + * mbedtls_aes_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param input The buffer holding the input data. + * It must be readable and at least \c 16 Bytes long. + * \param output The buffer where the output data will be written. + * It must be writeable and at least \c 16 Bytes long. + + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ecb(mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16]); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an AES-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aes_init(), and either + * mbedtls_aes_setkey_enc() or mbedtls_aes_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on full blocks, that is, the input size + * must be a multiple of the AES block size of \c 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (\c 16 Bytes). + * \param iv Initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH + * on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cbc(mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function performs an AES-XTS encryption or decryption + * operation for an entire XTS data unit. + * + * AES-XTS encrypts or decrypts blocks based on their location as + * defined by a data unit number. The data unit number must be + * provided by \p data_unit. + * + * NIST SP 800-38E limits the maximum size of a data unit to 2^20 + * AES blocks. If the data unit is larger than this, this function + * returns #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH. + * + * \param ctx The AES XTS context to use for AES XTS operations. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of a data unit in Bytes. This can be any + * length between 16 bytes and 2^24 bytes inclusive + * (between 1 and 2^20 block cipher blocks). + * \param data_unit The address of the data unit encoded as an array of 16 + * bytes in little-endian format. For disk encryption, this + * is typically the index of the block device sector that + * contains the data. + * \param input The buffer holding the input data (which is an entire + * data unit). This function reads \p length Bytes from \p + * input. + * \param output The buffer holding the output data (which is an entire + * data unit). This function writes \p length Bytes to \p + * output. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH if \p length is + * smaller than an AES block in size (16 Bytes) or if \p + * length is larger than 2^20 blocks (16 MiB). + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_xts(mbedtls_aes_xts_context *ctx, + int mode, + size_t length, + const unsigned char data_unit[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an AES-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aes_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb128(mbedtls_aes_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function performs an AES-CFB8 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined + * in the \p input parameter. + * + * Due to the nature of CFB, you must use the same key schedule for + * both encryption and decryption operations. Therefore, you must + * use the context initialized with mbedtls_aes_setkey_enc() for + * both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT + * \param length The length of the input data. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb8(mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); +#endif /*MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +/** + * \brief This function performs an AES-OFB (Output Feedback Mode) + * encryption or decryption operation. + * + * For OFB, you must set up the context with + * mbedtls_aes_setkey_enc(), regardless of whether you are + * performing an encryption or decryption operation. This is + * because OFB mode uses the same key schedule for encryption and + * decryption. + * + * The OFB operation is identical for encryption or decryption, + * therefore no operation mode needs to be specified. + * + * \note Upon exit, the content of iv, the Initialisation Vector, is + * updated so that you can call the same function again on the next + * block(s) of data and get the same result as if it was encrypted + * in one call. This allows a "streaming" usage, by initialising + * iv_off to 0 before the first call, and preserving its value + * between calls. + * + * For non-streaming use, the iv should be initialised on each call + * to a unique value, and iv_off set to 0 on each call. + * + * If you need to retain the contents of the initialisation vector, + * you must either save it manually or use the cipher module + * instead. + * + * \warning For the OFB mode, the initialisation vector must be unique + * every encryption operation. Reuse of an initialisation vector + * will compromise security. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ofb(mbedtls_aes_context *ctx, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); + +#endif /* MBEDTLS_CIPHER_MODE_OFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an AES-CTR encryption or decryption + * operation. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aes_setkey_enc() + * for both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an AES block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param nc_off The offset in the current \p stream_block, for + * resuming within the current cipher stream. The + * offset pointer should be 0 at the start of a stream. + * It must point to a valid \c size_t. + * \param nonce_counter The 128-bit nonce and counter. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param stream_block The saved stream block for resuming. This is + * overwritten by the function. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ctr(mbedtls_aes_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +/** + * \brief Internal AES block encryption function. This is only + * exposed to allow overriding it using + * \c MBEDTLS_AES_ENCRYPT_ALT. + * + * \param ctx The AES context to use for encryption. + * \param input The plaintext block. + * \param output The output (ciphertext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_encrypt(mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16]); + +#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +/** + * \brief Internal AES block decryption function. This is only + * exposed to allow overriding it using see + * \c MBEDTLS_AES_DECRYPT_ALT. + * + * \param ctx The AES context to use for decryption. + * \param input The ciphertext block. + * \param output The output (plaintext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_decrypt(mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16]); +#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_aes_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aes.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aria.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aria.h new file mode 100644 index 00000000..c685fc31 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/aria.h @@ -0,0 +1,343 @@ +/** + * \file aria.h + * + * \brief ARIA block cipher + * + * The ARIA algorithm is a symmetric block cipher that can encrypt and + * decrypt information. It is defined by the Korean Agency for + * Technology and Standards (KATS) in KS X 1213:2004 (in + * Korean, but see http://210.104.33.10/ARIA/index-e.html in English) + * and also described by the IETF in RFC 5794. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_ARIA_H +#define MBEDTLS_ARIA_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */ +#define MBEDTLS_ARIA_DECRYPT 0 /**< ARIA decryption. */ + +#define MBEDTLS_ARIA_BLOCKSIZE 16 /**< ARIA block size in bytes. */ +#define MBEDTLS_ARIA_MAX_ROUNDS 16 /**< Maximum number of rounds in ARIA. */ +#define MBEDTLS_ARIA_MAX_KEYSIZE 32 /**< Maximum size of an ARIA key in bytes. */ + +/** Bad input data. */ +#define MBEDTLS_ERR_ARIA_BAD_INPUT_DATA -0x005C + +/** Invalid data input length. */ +#define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_ARIA_ALT) +// Regular implementation +// + +/** + * \brief The ARIA context-type definition. + */ +typedef struct mbedtls_aria_context { + unsigned char MBEDTLS_PRIVATE(nr); /*!< The number of rounds (12, 14 or 16) */ + /*! The ARIA round keys. */ + uint32_t MBEDTLS_PRIVATE(rk)[MBEDTLS_ARIA_MAX_ROUNDS + 1][MBEDTLS_ARIA_BLOCKSIZE / 4]; +} +mbedtls_aria_context; + +#else /* MBEDTLS_ARIA_ALT */ +#include "aria_alt.h" +#endif /* MBEDTLS_ARIA_ALT */ + +/** + * \brief This function initializes the specified ARIA context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The ARIA context to initialize. This must not be \c NULL. + */ +void mbedtls_aria_init(mbedtls_aria_context *ctx); + +/** + * \brief This function releases and clears the specified ARIA context. + * + * \param ctx The ARIA context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized ARIA context. + */ +void mbedtls_aria_free(mbedtls_aria_context *ctx); + +/** + * \brief This function sets the encryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The encryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of \p key in Bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_enc(mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits); + +#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +/** + * \brief This function sets the decryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_dec(mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits); +#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ + +/** + * \brief This function performs an ARIA single-block encryption or + * decryption operation. + * + * It performs encryption or decryption (depending on whether + * the key was set for encryption on decryption) on the input + * data buffer defined in the \p input parameter. + * + * mbedtls_aria_init(), and either mbedtls_aria_setkey_enc() or + * mbedtls_aria_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param input The 16-Byte buffer holding the input data. + * \param output The 16-Byte buffer holding the output data. + + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ecb(mbedtls_aria_context *ctx, + const unsigned char input[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char output[MBEDTLS_ARIA_BLOCKSIZE]); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an ARIA-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aria_init(), and either + * mbedtls_aria_setkey_enc() or mbedtls_aria_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on aligned blocks, that is, the input size + * must be a multiple of the ARIA block size of 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (16 Bytes). + * \param iv Initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cbc(mbedtls_aria_context *ctx, + int mode, + size_t length, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an ARIA-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aria_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data \p input in Bytes. + * \param iv_off The offset in IV (updated after use). + * This must not be larger than 15. + * \param iv The initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cfb128(mbedtls_aria_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an ARIA-CTR encryption or decryption + * operation. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aria_setkey_enc() + * for both #MBEDTLS_ARIA_ENCRYPT and #MBEDTLS_ARIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an ARIA block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param length The length of the input data \p input in Bytes. + * \param nc_off The offset in Bytes in the current \p stream_block, + * for resuming within the current cipher stream. The + * offset pointer should be \c 0 at the start of a + * stream. This must not be larger than \c 15 Bytes. + * \param nonce_counter The 128-bit nonce and counter. This must point to + * a read/write buffer of length \c 16 bytes. + * \param stream_block The saved stream block for resuming. This must + * point to a read/write buffer of length \c 16 bytes. + * This is overwritten by the function. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ctr(mbedtls_aria_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char stream_block[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success, or \c 1 on failure. + */ +int mbedtls_aria_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aria.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1.h new file mode 100644 index 00000000..ff019f43 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1.h @@ -0,0 +1,642 @@ +/** + * \file asn1.h + * + * \brief Generic ASN.1 parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_ASN1_H +#define MBEDTLS_ASN1_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include + +#if defined(MBEDTLS_BIGNUM_C) +#include "mbedtls/bignum.h" +#endif + +/** + * \addtogroup asn1_module + * \{ + */ + +/** + * \name ASN1 Error codes + * These error codes are combined with other error codes for + * higher error granularity. + * e.g. X.509 and PKCS #7 error codes + * ASN1 is a standard to specify data structures. + * \{ + */ +/** Out of data when parsing an ASN1 data structure. */ +#define MBEDTLS_ERR_ASN1_OUT_OF_DATA -0x0060 +/** ASN1 tag was of an unexpected value. */ +#define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG -0x0062 +/** Error when trying to determine the length or invalid length. */ +#define MBEDTLS_ERR_ASN1_INVALID_LENGTH -0x0064 +/** Actual length differs from expected length. */ +#define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH -0x0066 +/** Data is invalid. */ +#define MBEDTLS_ERR_ASN1_INVALID_DATA -0x0068 +/** Memory allocation failed */ +#define MBEDTLS_ERR_ASN1_ALLOC_FAILED -0x006A +/** Buffer too small when writing ASN.1 data structure. */ +#define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL -0x006C + +/** \} name ASN1 Error codes */ + +/** + * \name DER constants + * These constants comply with the DER encoded ASN.1 type tags. + * DER encoding uses hexadecimal representation. + * An example DER sequence is:\n + * - 0x02 -- tag indicating INTEGER + * - 0x01 -- length in octets + * - 0x05 -- value + * Such sequences are typically read into \c ::mbedtls_x509_buf. + * \{ + */ +#define MBEDTLS_ASN1_BOOLEAN 0x01 +#define MBEDTLS_ASN1_INTEGER 0x02 +#define MBEDTLS_ASN1_BIT_STRING 0x03 +#define MBEDTLS_ASN1_OCTET_STRING 0x04 +#define MBEDTLS_ASN1_NULL 0x05 +#define MBEDTLS_ASN1_OID 0x06 +#define MBEDTLS_ASN1_ENUMERATED 0x0A +#define MBEDTLS_ASN1_UTF8_STRING 0x0C +#define MBEDTLS_ASN1_SEQUENCE 0x10 +#define MBEDTLS_ASN1_SET 0x11 +#define MBEDTLS_ASN1_PRINTABLE_STRING 0x13 +#define MBEDTLS_ASN1_T61_STRING 0x14 +#define MBEDTLS_ASN1_IA5_STRING 0x16 +#define MBEDTLS_ASN1_UTC_TIME 0x17 +#define MBEDTLS_ASN1_GENERALIZED_TIME 0x18 +#define MBEDTLS_ASN1_UNIVERSAL_STRING 0x1C +#define MBEDTLS_ASN1_BMP_STRING 0x1E +#define MBEDTLS_ASN1_PRIMITIVE 0x00 +#define MBEDTLS_ASN1_CONSTRUCTED 0x20 +#define MBEDTLS_ASN1_CONTEXT_SPECIFIC 0x80 + +/* Slightly smaller way to check if tag is a string tag + * compared to canonical implementation. */ +#define MBEDTLS_ASN1_IS_STRING_TAG(tag) \ + ((unsigned int) (tag) < 32u && ( \ + ((1u << (tag)) & ((1u << MBEDTLS_ASN1_BMP_STRING) | \ + (1u << MBEDTLS_ASN1_UTF8_STRING) | \ + (1u << MBEDTLS_ASN1_T61_STRING) | \ + (1u << MBEDTLS_ASN1_IA5_STRING) | \ + (1u << MBEDTLS_ASN1_UNIVERSAL_STRING) | \ + (1u << MBEDTLS_ASN1_PRINTABLE_STRING))) != 0)) + +/* + * Bit masks for each of the components of an ASN.1 tag as specified in + * ITU X.690 (08/2015), section 8.1 "General rules for encoding", + * paragraph 8.1.2.2: + * + * Bit 8 7 6 5 1 + * +-------+-----+------------+ + * | Class | P/C | Tag number | + * +-------+-----+------------+ + */ +#define MBEDTLS_ASN1_TAG_CLASS_MASK 0xC0 +#define MBEDTLS_ASN1_TAG_PC_MASK 0x20 +#define MBEDTLS_ASN1_TAG_VALUE_MASK 0x1F + +/** \} name DER constants */ + +/** Returns the size of the binary string, without the trailing \\0 */ +#define MBEDTLS_OID_SIZE(x) (sizeof(x) - 1) + +/** + * Compares an mbedtls_asn1_buf structure to a reference OID. + * + * Only works for 'defined' oid_str values (MBEDTLS_OID_HMAC_SHA1), you cannot use a + * 'unsigned char *oid' here! + */ +#define MBEDTLS_OID_CMP(oid_str, oid_buf) \ + ((MBEDTLS_OID_SIZE(oid_str) != (oid_buf)->len) || \ + memcmp((oid_str), (oid_buf)->p, (oid_buf)->len) != 0) + +#define MBEDTLS_OID_CMP_RAW(oid_str, oid_buf, oid_buf_len) \ + ((MBEDTLS_OID_SIZE(oid_str) != (oid_buf_len)) || \ + memcmp((oid_str), (oid_buf), (oid_buf_len)) != 0) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Functions to parse ASN.1 data structures + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef struct mbedtls_asn1_buf { + int tag; /**< ASN1 type, e.g. MBEDTLS_ASN1_UTF8_STRING. */ + size_t len; /**< ASN1 length, in octets. */ + unsigned char *p; /**< ASN1 data, e.g. in ASCII. */ +} +mbedtls_asn1_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef struct mbedtls_asn1_bitstring { + size_t len; /**< ASN1 length, in octets. */ + unsigned char unused_bits; /**< Number of unused bits at the end of the string */ + unsigned char *p; /**< Raw ASN1 data for the bit string */ +} +mbedtls_asn1_bitstring; + +/** + * Container for a sequence of ASN.1 items + */ +typedef struct mbedtls_asn1_sequence { + mbedtls_asn1_buf buf; /**< Buffer containing the given ASN.1 item. */ + + /** The next entry in the sequence. + * + * The details of memory management for sequences are not documented and + * may change in future versions. Set this field to \p NULL when + * initializing a structure, and do not modify it except via Mbed TLS + * library functions. + */ + struct mbedtls_asn1_sequence *next; +} +mbedtls_asn1_sequence; + +/** + * Container for a sequence or list of 'named' ASN.1 data items + */ +typedef struct mbedtls_asn1_named_data { + mbedtls_asn1_buf oid; /**< The object identifier. */ + mbedtls_asn1_buf val; /**< The named value. */ + + /** The next entry in the sequence. + * + * The details of memory management for named data sequences are not + * documented and may change in future versions. Set this field to \p NULL + * when initializing a structure, and do not modify it except via Mbed TLS + * library functions. + */ + struct mbedtls_asn1_named_data *next; + + /** Merge next item into the current one? + * + * This field exists for the sake of Mbed TLS's X.509 certificate parsing + * code and may change in future versions of the library. + */ + unsigned char MBEDTLS_PRIVATE(next_merged); +} +mbedtls_asn1_named_data; + +#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_X509_CREATE_C) || \ + defined(MBEDTLS_PSA_UTIL_HAVE_ECDSA) +/** + * \brief Get the length of an ASN.1 element. + * Updates the pointer to immediately behind the length. + * + * \param p On entry, \c *p points to the first byte of the length, + * i.e. immediately after the tag. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_len(unsigned char **p, + const unsigned char *end, + size_t *len); + +/** + * \brief Get the tag and length of the element. + * Check for the requested tag. + * Updates the pointer to immediately behind the tag and length. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * \param tag The expected tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the data does not start + * with the requested tag. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_tag(unsigned char **p, + const unsigned char *end, + size_t *len, int tag); +#endif /* MBEDTLS_ASN1_PARSE_C || MBEDTLS_X509_CREATE_C || MBEDTLS_PSA_UTIL_HAVE_ECDSA */ + +#if defined(MBEDTLS_ASN1_PARSE_C) +/** + * \brief Retrieve a boolean ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value (\c 0 or \c 1). + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BOOLEAN. + */ +int mbedtls_asn1_get_bool(unsigned char **p, + const unsigned char *end, + int *val); + +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_int(unsigned char **p, + const unsigned char *end, + int *val); + +/** + * \brief Retrieve an enumerated ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 ENUMERATED. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_enum(unsigned char **p, + const unsigned char *end, + int *val); + +/** + * \brief Retrieve a bitstring ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param bs On success, ::mbedtls_asn1_bitstring information about + * the parsed value. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid BIT STRING. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring(unsigned char **p, const unsigned char *end, + mbedtls_asn1_bitstring *bs); + +/** + * \brief Retrieve a bitstring ASN.1 tag without unused bits and its + * value. + * Updates the pointer to the beginning of the bit/octet string. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * of the content of the BIT STRING. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On success, \c *len is the length of the content in bytes. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if the input starts with + * a valid BIT STRING with a nonzero number of unused bits. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring_null(unsigned char **p, + const unsigned char *end, + size_t *len); + +/** + * \brief Parses and splits an ASN.1 "SEQUENCE OF ". + * Updates the pointer to immediately behind the full sequence tag. + * + * This function allocates memory for the sequence elements. You can free + * the allocated memory with mbedtls_asn1_sequence_free(). + * + * \note On error, this function may return a partial list in \p cur. + * You must set `cur->next = NULL` before calling this function! + * Otherwise it is impossible to distinguish a previously non-null + * pointer from a pointer to an object allocated by this function. + * + * \note If the sequence is empty, this function does not modify + * \c *cur. If the sequence is valid and non-empty, this + * function sets `cur->buf.tag` to \p tag. This allows + * callers to distinguish between an empty sequence and + * a one-element sequence. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param cur A ::mbedtls_asn1_sequence which this function fills. + * When this function returns, \c *cur is the head of a linked + * list. Each node in this list is allocated with + * mbedtls_calloc() apart from \p cur itself, and should + * therefore be freed with mbedtls_free(). + * The list describes the content of the sequence. + * The head of the list (i.e. \c *cur itself) describes the + * first element, `*cur->next` describes the second element, etc. + * For each element, `buf.tag == tag`, `buf.len` is the length + * of the content of the content of the element, and `buf.p` + * points to the first byte of the content (i.e. immediately + * past the length of the element). + * Note that list elements may be allocated even on error. + * \param tag Each element of the sequence must have this tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid SEQUENCE OF \p tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts with + * an ASN.1 SEQUENCE in which an element has a tag that + * is different from \p tag. + * \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if a memory allocation failed. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + */ +int mbedtls_asn1_get_sequence_of(unsigned char **p, + const unsigned char *end, + mbedtls_asn1_sequence *cur, + int tag); +/** + * \brief Free a heap-allocated linked list presentation of + * an ASN.1 sequence, including the first element. + * + * There are two common ways to manage the memory used for the representation + * of a parsed ASN.1 sequence: + * - Allocate a head node `mbedtls_asn1_sequence *head` with mbedtls_calloc(). + * Pass this node as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head`. + * - Allocate a head node `mbedtls_asn1_sequence *head` in any manner, + * for example on the stack. Make sure that `head->next == NULL`. + * Pass `head` as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head->cur`, + * then free `head` itself in the appropriate manner. + * + * \param seq The address of the first sequence component. This may + * be \c NULL, in which case this functions returns + * immediately. + */ +void mbedtls_asn1_sequence_free(mbedtls_asn1_sequence *seq); + +/** + * \brief Traverse an ASN.1 SEQUENCE container and + * call a callback for each entry. + * + * This function checks that the input is a SEQUENCE of elements that + * each have a "must" tag, and calls a callback function on the elements + * that have a "may" tag. + * + * For example, to validate that the input is a SEQUENCE of `tag1` and call + * `cb` on each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xff, tag1, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of ANY and call `cb` on + * each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0, 0, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of CHOICE {NULL, OCTET STRING} + * and call `cb` on each element that is an OCTET STRING, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xfe, 0x04, 0xff, 0x04, cb, ctx); + * ``` + * + * The callback is called on the elements with a "may" tag from left to + * right. If the input is not a valid SEQUENCE of elements with a "must" tag, + * the callback is called on the elements up to the leftmost point where + * the input is invalid. + * + * \warning This function is still experimental and may change + * at any time. + * + * \param p The address of the pointer to the beginning of + * the ASN.1 SEQUENCE header. This is updated to + * point to the end of the ASN.1 SEQUENCE container + * on a successful invocation. + * \param end The end of the ASN.1 SEQUENCE container. + * \param tag_must_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_must_val. + * \param tag_must_val The required value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_must_mask. + * Mismatching tags lead to an error. + * For example, a value of \c 0 for both \p tag_must_mask + * and \p tag_must_val means that every tag is allowed, + * while a value of \c 0xFF for \p tag_must_mask means + * that \p tag_must_val is the only allowed tag. + * \param tag_may_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_may_val. + * \param tag_may_val The desired value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_may_mask. + * Mismatching tags will be silently ignored. + * For example, a value of \c 0 for \p tag_may_mask and + * \p tag_may_val means that any tag will be considered, + * while a value of \c 0xFF for \p tag_may_mask means + * that all tags with value different from \p tag_may_val + * will be ignored. + * \param cb The callback to trigger for each component + * in the ASN.1 SEQUENCE that matches \p tag_may_val. + * The callback function is called with the following + * parameters: + * - \p ctx. + * - The tag of the current element. + * - A pointer to the start of the current element's + * content inside the input. + * - The length of the content of the current element. + * If the callback returns a non-zero value, + * the function stops immediately, + * forwarding the callback's return value. + * \param ctx The context to be passed to the callback \p cb. + * + * \return \c 0 if successful the entire ASN.1 SEQUENCE + * was traversed without parsing or callback errors. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input + * contains extra data after a valid SEQUENCE + * of elements with an accepted tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts + * with an ASN.1 SEQUENCE in which an element has a tag + * that is not accepted. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + * \return A non-zero error code forwarded from the callback + * \p cb in case the latter returns a non-zero value. + */ +int mbedtls_asn1_traverse_sequence_of( + unsigned char **p, + const unsigned char *end, + unsigned char tag_must_mask, unsigned char tag_must_val, + unsigned char tag_may_mask, unsigned char tag_may_val, + int (*cb)(void *ctx, int tag, + unsigned char *start, size_t len), + void *ctx); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param X On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + * \return An MPI error code if the parsed value is too large. + */ +int mbedtls_asn1_get_mpi(unsigned char **p, + const unsigned char *end, + mbedtls_mpi *X); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * \param params The buffer to receive the parameters. + * This is zeroized if there are no parameters. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg(unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg, mbedtls_asn1_buf *params); + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence with NULL or no + * params. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg_null(unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg); + +/** + * \brief Find a specific named_data entry in a sequence or list based on + * the OID. + * + * \param list The list to seek through + * \param oid The OID to look for + * \param len Size of the OID + * + * \return NULL if not found, or a pointer to the existing entry. + */ +const mbedtls_asn1_named_data *mbedtls_asn1_find_named_data(const mbedtls_asn1_named_data *list, + const char *oid, size_t len); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief Free a mbedtls_asn1_named_data entry + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * Please use mbedtls_asn1_free_named_data_list() + * or mbedtls_asn1_free_named_data_list_shallow(). + * + * \param entry The named data entry to free. + * This function calls mbedtls_free() on + * `entry->oid.p` and `entry->val.p`. + */ +void MBEDTLS_DEPRECATED mbedtls_asn1_free_named_data(mbedtls_asn1_named_data *entry); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Free all entries in a mbedtls_asn1_named_data list. + * + * \param head Pointer to the head of the list of named data entries to free. + * This function calls mbedtls_free() on + * `entry->oid.p` and `entry->val.p` and then on `entry` + * for each list entry, and sets \c *head to \c NULL. + */ +void mbedtls_asn1_free_named_data_list(mbedtls_asn1_named_data **head); + +/** + * \brief Free all shallow entries in a mbedtls_asn1_named_data list, + * but do not free internal pointer targets. + * + * \param name Head of the list of named data entries to free. + * This function calls mbedtls_free() on each list element. + */ +void mbedtls_asn1_free_named_data_list_shallow(mbedtls_asn1_named_data *name); + +/** \} name Functions to parse ASN.1 data structures */ +/** \} addtogroup asn1_module */ + +#endif /* MBEDTLS_ASN1_PARSE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* asn1.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1write.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1write.h new file mode 100644 index 00000000..9a1062a5 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/asn1write.h @@ -0,0 +1,390 @@ +/** + * \file asn1write.h + * + * \brief ASN.1 buffer writing functionality + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_ASN1_WRITE_H +#define MBEDTLS_ASN1_WRITE_H + +#include "mbedtls/build_info.h" + +#include "mbedtls/asn1.h" + +#define MBEDTLS_ASN1_CHK_ADD(g, f) \ + do \ + { \ + if ((ret = (f)) < 0) \ + return ret; \ + else \ + (g) += ret; \ + } while (0) + +#define MBEDTLS_ASN1_CHK_CLEANUP_ADD(g, f) \ + do \ + { \ + if ((ret = (f)) < 0) \ + goto cleanup; \ + else \ + (g) += ret; \ + } while (0) + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_WRITE_C) || defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_PSA_UTIL_HAVE_ECDSA) +/** + * \brief Write a length field in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param len The length value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_len(unsigned char **p, const unsigned char *start, + size_t len); +/** + * \brief Write an ASN.1 tag in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The tag to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_tag(unsigned char **p, const unsigned char *start, + unsigned char tag); +#endif /* MBEDTLS_ASN1_WRITE_C || MBEDTLS_X509_USE_C || MBEDTLS_PSA_UTIL_HAVE_ECDSA*/ + +#if defined(MBEDTLS_ASN1_WRITE_C) +/** + * \brief Write raw buffer data. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The data buffer to write. + * \param size The length of the data buffer. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_raw_buffer(unsigned char **p, const unsigned char *start, + const unsigned char *buf, size_t size); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Write an arbitrary-precision number (#MBEDTLS_ASN1_INTEGER) + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param X The MPI to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_mpi(unsigned char **p, const unsigned char *start, + const mbedtls_mpi *X); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Write a NULL tag (#MBEDTLS_ASN1_NULL) with zero data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_null(unsigned char **p, const unsigned char *start); + +/** + * \brief Write an OID tag (#MBEDTLS_ASN1_OID) and data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID to write. + * \param oid_len The length of the OID. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_oid(unsigned char **p, const unsigned char *start, + const char *oid, size_t oid_len); + +/** + * \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID of the algorithm to write. + * \param oid_len The length of the algorithm's OID. + * \param par_len The length of the parameters, which must be already written. + * If 0, NULL parameters are added + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_algorithm_identifier(unsigned char **p, + const unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len); + +/** + * \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID of the algorithm to write. + * \param oid_len The length of the algorithm's OID. + * \param par_len The length of the parameters, which must be already written. + * \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + * and \p par_len is 0, NULL parameters are added. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_algorithm_identifier_ext(unsigned char **p, + const unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len, int has_par); + +/** + * \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param boolean The boolean value to write, either \c 0 or \c 1. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_bool(unsigned char **p, const unsigned char *start, + int boolean); + +/** + * \brief Write an int tag (#MBEDTLS_ASN1_INTEGER) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_int(unsigned char **p, const unsigned char *start, int val); + +/** + * \brief Write an enum tag (#MBEDTLS_ASN1_ENUMERATED) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_enum(unsigned char **p, const unsigned char *start, int val); + +/** + * \brief Write a string in ASN.1 format using a specific + * string encoding tag. + + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The string encoding tag to write, e.g. + * #MBEDTLS_ASN1_UTF8_STRING. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_tagged_string(unsigned char **p, const unsigned char *start, + int tag, const char *text, + size_t text_len); + +/** + * \brief Write a string in ASN.1 format using the PrintableString + * string encoding tag (#MBEDTLS_ASN1_PRINTABLE_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_printable_string(unsigned char **p, + const unsigned char *start, + const char *text, size_t text_len); + +/** + * \brief Write a UTF8 string in ASN.1 format using the UTF8String + * string encoding tag (#MBEDTLS_ASN1_UTF8_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_utf8_string(unsigned char **p, const unsigned char *start, + const char *text, size_t text_len); + +/** + * \brief Write a string in ASN.1 format using the IA5String + * string encoding tag (#MBEDTLS_ASN1_IA5_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_ia5_string(unsigned char **p, const unsigned char *start, + const char *text, size_t text_len); + +/** + * \brief Write a bitstring tag (#MBEDTLS_ASN1_BIT_STRING) and + * value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_bitstring(unsigned char **p, const unsigned char *start, + const unsigned char *buf, size_t bits); + +/** + * \brief This function writes a named bitstring tag + * (#MBEDTLS_ASN1_BIT_STRING) and value in ASN.1 format. + * + * As stated in RFC 5280 Appendix B, trailing zeroes are + * omitted when encoding named bitstrings in DER. + * + * \note This function works backwards within the data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer which is used for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_named_bitstring(unsigned char **p, + const unsigned char *start, + const unsigned char *buf, + size_t bits); + +/** + * \brief Write an octet string tag (#MBEDTLS_ASN1_OCTET_STRING) + * and value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The buffer holding the data to write. + * \param size The length of the data buffer \p buf. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_octet_string(unsigned char **p, const unsigned char *start, + const unsigned char *buf, size_t size); + +/** + * \brief Create or find a specific named_data entry for writing in a + * sequence or list based on the OID. If not already in there, + * a new entry is added to the head of the list. + * Warning: Destructive behaviour for the val data! + * + * \param list The pointer to the location of the head of the list to seek + * through (will be updated in case of a new entry). + * \param oid The OID to look for. + * \param oid_len The size of the OID. + * \param val The associated data to store. If this is \c NULL, + * no data is copied to the new or existing buffer. + * \param val_len The minimum length of the data buffer needed. + * If this is 0, do not allocate a buffer for the associated + * data. + * If the OID was already present, enlarge, shrink or free + * the existing buffer to fit \p val_len. + * + * \return A pointer to the new / existing entry on success. + * \return \c NULL if there was a memory allocation error. + */ +mbedtls_asn1_named_data *mbedtls_asn1_store_named_data(mbedtls_asn1_named_data **list, + const char *oid, size_t oid_len, + const unsigned char *val, + size_t val_len); + +#endif /* MBEDTLS_ASN1_WRITE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_ASN1_WRITE_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/base64.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/base64.h new file mode 100644 index 00000000..8f459b74 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/base64.h @@ -0,0 +1,82 @@ +/** + * \file base64.h + * + * \brief RFC 1521 base64 encoding/decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_BASE64_H +#define MBEDTLS_BASE64_H + +#include "mbedtls/build_info.h" + +#include + +/** Output buffer too small. */ +#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A +/** Invalid character in input. */ +#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Encode a buffer into base64 format + * + * \param dst destination buffer + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be encoded + * + * \return 0 if successful, or MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL. + * *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * If that length cannot be represented, then no data is + * written to the buffer and *olen is set to the maximum + * length representable as a size_t. + * + * \note Call this function with dlen = 0 to obtain the + * required buffer size in *olen + */ +int mbedtls_base64_encode(unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen); + +/** + * \brief Decode a base64-formatted buffer + * + * \param dst destination buffer (can be NULL for checking size) + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be decoded + * + * \return 0 if successful, MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL, or + * MBEDTLS_ERR_BASE64_INVALID_CHARACTER if the input data is + * not correct. *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * + * \note Call this function with *dst = NULL or dlen = 0 to obtain + * the required buffer size in *olen + */ +int mbedtls_base64_decode(unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_base64_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* base64.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/bignum.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/bignum.h new file mode 100644 index 00000000..61878567 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/bignum.h @@ -0,0 +1,1088 @@ +/** + * \file bignum.h + * + * \brief Multi-precision integer library + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_BIGNUM_H +#define MBEDTLS_BIGNUM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include +#include + +#if defined(MBEDTLS_FS_IO) +#include +#endif + +/** An error occurred while reading from or writing to a file. */ +#define MBEDTLS_ERR_MPI_FILE_IO_ERROR -0x0002 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MPI_BAD_INPUT_DATA -0x0004 +/** There is an invalid character in the digit string. */ +#define MBEDTLS_ERR_MPI_INVALID_CHARACTER -0x0006 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL -0x0008 +/** The input arguments are negative or result in illegal output. */ +#define MBEDTLS_ERR_MPI_NEGATIVE_VALUE -0x000A +/** The input argument for division is zero, which is not allowed. */ +#define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO -0x000C +/** The input arguments are not acceptable. */ +#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E +/** Memory allocation failed. */ +#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010 + +#define MBEDTLS_MPI_CHK(f) \ + do \ + { \ + if ((ret = (f)) != 0) \ + goto cleanup; \ + } while (0) + +/* + * Maximum size MPIs are allowed to grow to in number of limbs. + */ +#define MBEDTLS_MPI_MAX_LIMBS 10000 + +#if !defined(MBEDTLS_MPI_WINDOW_SIZE) +/* + * Maximum window size used for modular exponentiation. Default: 3 + * Minimum value: 1. Maximum value: 6. + * + * Result is an array of ( 2 ** MBEDTLS_MPI_WINDOW_SIZE ) MPIs used + * for the sliding window calculation. (So 8 by default) + * + * Reduction in size, reduces speed. + */ +#define MBEDTLS_MPI_WINDOW_SIZE 3 /**< Maximum window size used. */ +#endif /* !MBEDTLS_MPI_WINDOW_SIZE */ + +#if !defined(MBEDTLS_MPI_MAX_SIZE) +/* + * Maximum size of MPIs allowed in bits and bytes for user-MPIs. + * ( Default: 512 bytes => 4096 bits, Maximum tested: 2048 bytes => 16384 bits ) + * + * Note: Calculations can temporarily result in larger MPIs. So the number + * of limbs required (MBEDTLS_MPI_MAX_LIMBS) is higher. + */ +#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ +#endif /* !MBEDTLS_MPI_MAX_SIZE */ + +#define MBEDTLS_MPI_MAX_BITS (8 * MBEDTLS_MPI_MAX_SIZE) /**< Maximum number of bits for usable MPIs. */ + +/* + * When reading from files with mbedtls_mpi_read_file() and writing to files with + * mbedtls_mpi_write_file() the buffer should have space + * for a (short) label, the MPI (in the provided radix), the newline + * characters and the '\0'. + * + * By default we assume at least a 10 char label, a minimum radix of 10 + * (decimal) and a maximum of 4096 bit numbers (1234 decimal chars). + * Autosized at compile time for at least a 10 char label, a minimum radix + * of 10 (decimal) for a number of MBEDTLS_MPI_MAX_BITS size. + * + * This used to be statically sized to 1250 for a maximum of 4096 bit + * numbers (1234 decimal chars). + * + * Calculate using the formula: + * MBEDTLS_MPI_RW_BUFFER_SIZE = ceil(MBEDTLS_MPI_MAX_BITS / ln(10) * ln(2)) + + * LabelSize + 6 + */ +#define MBEDTLS_MPI_MAX_BITS_SCALE100 (100 * MBEDTLS_MPI_MAX_BITS) +#define MBEDTLS_LN_2_DIV_LN_10_SCALE100 332 +#define MBEDTLS_MPI_RW_BUFFER_SIZE (((MBEDTLS_MPI_MAX_BITS_SCALE100 + \ + MBEDTLS_LN_2_DIV_LN_10_SCALE100 - 1) / \ + MBEDTLS_LN_2_DIV_LN_10_SCALE100) + 10 + 6) + +/* + * Define the base integer type, architecture-wise. + * + * 32 or 64-bit integer types can be forced regardless of the underlying + * architecture by defining MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64 + * respectively and undefining MBEDTLS_HAVE_ASM. + * + * Double-width integers (e.g. 128-bit in 64-bit architectures) can be + * disabled by defining MBEDTLS_NO_UDBL_DIVISION. + */ +#if !defined(MBEDTLS_HAVE_INT32) + #if defined(_MSC_VER) && defined(_M_AMD64) +/* Always choose 64-bit when using MSC */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ +typedef int64_t mbedtls_mpi_sint; +typedef uint64_t mbedtls_mpi_uint; +#define MBEDTLS_MPI_UINT_MAX UINT64_MAX + #elif defined(__GNUC__) && ( \ + defined(__amd64__) || defined(__x86_64__) || \ + defined(__ppc64__) || defined(__powerpc64__) || \ + defined(__ia64__) || defined(__alpha__) || \ + (defined(__sparc__) && defined(__arch64__)) || \ + defined(__s390x__) || defined(__mips64) || \ + defined(__aarch64__)) + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* MBEDTLS_HAVE_INT64 */ +typedef int64_t mbedtls_mpi_sint; +typedef uint64_t mbedtls_mpi_uint; +#define MBEDTLS_MPI_UINT_MAX UINT64_MAX + #if !defined(MBEDTLS_NO_UDBL_DIVISION) +/* mbedtls_t_udbl defined as 128-bit unsigned int */ +typedef unsigned int mbedtls_t_udbl __attribute__((mode(TI))); + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(__ARMCC_VERSION) && defined(__aarch64__) +/* + * __ARMCC_VERSION is defined for both armcc and armclang and + * __aarch64__ is only defined by armclang when compiling 64-bit code + */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ +typedef int64_t mbedtls_mpi_sint; +typedef uint64_t mbedtls_mpi_uint; +#define MBEDTLS_MPI_UINT_MAX UINT64_MAX + #if !defined(MBEDTLS_NO_UDBL_DIVISION) +/* mbedtls_t_udbl defined as 128-bit unsigned int */ +typedef __uint128_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(MBEDTLS_HAVE_INT64) +/* Force 64-bit integers with unknown compiler */ +typedef int64_t mbedtls_mpi_sint; +typedef uint64_t mbedtls_mpi_uint; +#define MBEDTLS_MPI_UINT_MAX UINT64_MAX + #endif +#endif /* !MBEDTLS_HAVE_INT32 */ + +#if !defined(MBEDTLS_HAVE_INT64) +/* Default to 32-bit compilation */ + #if !defined(MBEDTLS_HAVE_INT32) + #define MBEDTLS_HAVE_INT32 + #endif /* !MBEDTLS_HAVE_INT32 */ +typedef int32_t mbedtls_mpi_sint; +typedef uint32_t mbedtls_mpi_uint; +#define MBEDTLS_MPI_UINT_MAX UINT32_MAX + #if !defined(MBEDTLS_NO_UDBL_DIVISION) +typedef uint64_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ +#endif /* !MBEDTLS_HAVE_INT64 */ + +/* + * Sanity check that exactly one of MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64 is defined, + * so that code elsewhere doesn't have to check. + */ +#if (!(defined(MBEDTLS_HAVE_INT32) || defined(MBEDTLS_HAVE_INT64))) || \ + (defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64)) +#error "Only 32-bit or 64-bit limbs are supported in bignum" +#endif + +/** \typedef mbedtls_mpi_uint + * \brief The type of machine digits in a bignum, called _limbs_. + * + * This is always an unsigned integer type with no padding bits. The size + * is platform-dependent. + */ + +/** \typedef mbedtls_mpi_sint + * \brief The signed type corresponding to #mbedtls_mpi_uint. + * + * This is always an signed integer type with no padding bits. The size + * is platform-dependent. + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief MPI structure + */ +typedef struct mbedtls_mpi { + /** Pointer to limbs. + * + * This may be \c NULL if \c n is 0. + */ + mbedtls_mpi_uint *MBEDTLS_PRIVATE(p); + + /** Sign: -1 if the mpi is negative, 1 otherwise. + * + * The number 0 must be represented with `s = +1`. Although many library + * functions treat all-limbs-zero as equivalent to a valid representation + * of 0 regardless of the sign bit, there are exceptions, so bignum + * functions and external callers must always set \c s to +1 for the + * number zero. + * + * Note that this implies that calloc() or `... = {0}` does not create + * a valid MPI representation. You must call mbedtls_mpi_init(). + */ + signed short MBEDTLS_PRIVATE(s); + + /** Total number of limbs in \c p. */ + unsigned short MBEDTLS_PRIVATE(n); + /* Make sure that MBEDTLS_MPI_MAX_LIMBS fits in n. + * Use the same limit value on all platforms so that we don't have to + * think about different behavior on the rare platforms where + * unsigned short can store values larger than the minimum required by + * the C language, which is 65535. + */ +#if MBEDTLS_MPI_MAX_LIMBS > 65535 +#error "MBEDTLS_MPI_MAX_LIMBS > 65535 is not supported" +#endif +} +mbedtls_mpi; + +/** + * \brief Initialize an MPI context. + * + * This makes the MPI ready to be set or freed, + * but does not define a value for the MPI. + * + * \param X The MPI context to initialize. This must not be \c NULL. + */ +void mbedtls_mpi_init(mbedtls_mpi *X); + +/** + * \brief This function frees the components of an MPI context. + * + * \param X The MPI context to be cleared. This may be \c NULL, + * in which case this function is a no-op. If it is + * not \c NULL, it must point to an initialized MPI. + */ +void mbedtls_mpi_free(mbedtls_mpi *X); + +/** + * \brief Enlarge an MPI to the specified number of limbs. + * + * \note This function does nothing if the MPI is + * already large enough. + * + * \param X The MPI to grow. It must be initialized. + * \param nblimbs The target number of limbs. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_grow(mbedtls_mpi *X, size_t nblimbs); + +/** + * \brief This function resizes an MPI downwards, keeping at least the + * specified number of limbs. + * + * If \c X is smaller than \c nblimbs, it is resized up + * instead. + * + * \param X The MPI to shrink. This must point to an initialized MPI. + * \param nblimbs The minimum number of limbs to keep. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed + * (this can only happen when resizing up). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_shrink(mbedtls_mpi *X, size_t nblimbs); + +/** + * \brief Make a copy of an MPI. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param Y The source MPI. This must point to an initialized MPI. + * + * \note The limb-buffer in the destination MPI is enlarged + * if necessary to hold the value in the source MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_copy(mbedtls_mpi *X, const mbedtls_mpi *Y); + +/** + * \brief Swap the contents of two MPIs. + * + * \param X The first MPI. It must be initialized. + * \param Y The second MPI. It must be initialized. + */ +void mbedtls_mpi_swap(mbedtls_mpi *X, mbedtls_mpi *Y); + +/** + * \brief Perform a safe conditional copy of MPI which doesn't + * reveal whether the condition was true or not. + * + * \param X The MPI to conditionally assign to. This must point + * to an initialized MPI. + * \param Y The MPI to be assigned from. This must point to an + * initialized MPI. + * \param assign The condition deciding whether to perform the + * assignment or not. Must be either 0 or 1: + * * \c 1: Perform the assignment `X = Y`. + * * \c 0: Keep the original value of \p X. + * + * \note This function is equivalent to + * `if( assign ) mbedtls_mpi_copy( X, Y );` + * except that it avoids leaking any information about whether + * the assignment was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \warning If \p assign is neither 0 nor 1, the result of this function + * is indeterminate, and the resulting value in \p X might be + * neither its original value nor the value in \p Y. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X, const mbedtls_mpi *Y, unsigned char assign); + +/** + * \brief Perform a safe conditional swap which doesn't + * reveal whether the condition was true or not. + * + * \param X The first MPI. This must be initialized. + * \param Y The second MPI. This must be initialized. + * \param swap The condition deciding whether to perform + * the swap or not. Must be either 0 or 1: + * * \c 1: Swap the values of \p X and \p Y. + * * \c 0: Keep the original values of \p X and \p Y. + * + * \note This function is equivalent to + * if( swap ) mbedtls_mpi_swap( X, Y ); + * except that it avoids leaking any information about whether + * the swap was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \warning If \p swap is neither 0 nor 1, the result of this function + * is indeterminate, and both \p X and \p Y might end up with + * values different to either of the original ones. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + * + */ +int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char swap); + +/** + * \brief Store integer value in MPI. + * + * \param X The MPI to set. This must be initialized. + * \param z The value to use. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_lset(mbedtls_mpi *X, mbedtls_mpi_sint z); + +/** + * \brief Get a specific bit from an MPI. + * + * \param X The MPI to query. This must be initialized. + * \param pos Zero-based index of the bit to query. + * + * \return \c 0 or \c 1 on success, depending on whether bit \c pos + * of \c X is unset or set. + * \return A negative error code on failure. + */ +int mbedtls_mpi_get_bit(const mbedtls_mpi *X, size_t pos); + +/** + * \brief Modify a specific bit in an MPI. + * + * \note This function will grow the target MPI if necessary to set a + * bit to \c 1 in a not yet existing limb. It will not grow if + * the bit should be set to \c 0. + * + * \param X The MPI to modify. This must be initialized. + * \param pos Zero-based index of the bit to modify. + * \param val The desired value of bit \c pos: \c 0 or \c 1. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_set_bit(mbedtls_mpi *X, size_t pos, unsigned char val); + +/** + * \brief Return the number of bits of value \c 0 before the + * least significant bit of value \c 1. + * + * \note This is the same as the zero-based index of + * the least significant bit of value \c 1. + * + * \param X The MPI to query. + * + * \return The number of bits of value \c 0 before the least significant + * bit of value \c 1 in \p X. + */ +size_t mbedtls_mpi_lsb(const mbedtls_mpi *X); + +/** + * \brief Return the number of bits up to and including the most + * significant bit of value \c 1. + * + * * \note This is same as the one-based index of the most + * significant bit of value \c 1. + * + * \param X The MPI to query. This must point to an initialized MPI. + * + * \return The number of bits up to and including the most + * significant bit of value \c 1. + */ +size_t mbedtls_mpi_bitlen(const mbedtls_mpi *X); + +/** + * \brief Return the total size of an MPI value in bytes. + * + * \param X The MPI to use. This must point to an initialized MPI. + * + * \note The value returned by this function may be less than + * the number of bytes used to store \p X internally. + * This happens if and only if there are trailing bytes + * of value zero. + * + * \return The least number of bytes capable of storing + * the absolute value of \p X. + */ +size_t mbedtls_mpi_size(const mbedtls_mpi *X); + +/** + * \brief Import an MPI from an ASCII string. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the input string. + * \param s Null-terminated string buffer. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_read_string(mbedtls_mpi *X, int radix, const char *s); + +/** + * \brief Export an MPI to an ASCII string. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base of the output string. + * \param buf The buffer to write the string to. This must be writable + * buffer of length \p buflen Bytes. + * \param buflen The available size in Bytes of \p buf. + * \param olen The address at which to store the length of the string + * written, including the final \c NULL byte. This must + * not be \c NULL. + * + * \note You can call this function with `buflen == 0` to obtain the + * minimum required buffer size in `*olen`. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the target buffer \p buf + * is too small to hold the value of \p X in the desired base. + * In this case, `*olen` is nonetheless updated to contain the + * size of \p buf required for a successful call. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_string(const mbedtls_mpi *X, int radix, + char *buf, size_t buflen, size_t *olen); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Read an MPI from a line in an opened file. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the string representation used + * in the source line. + * \param fin The input file handle to use. This must not be \c NULL. + * + * \note On success, this function advances the file stream + * to the end of the current line or to EOF. + * + * The function returns \c 0 on an empty line. + * + * Leading whitespaces are ignored, as is a + * '0x' prefix for radix \c 16. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the file read buffer + * is too small. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_read_file(mbedtls_mpi *X, int radix, FILE *fin); + +/** + * \brief Export an MPI into an opened file. + * + * \param p A string prefix to emit prior to the MPI data. + * For example, this might be a label, or "0x" when + * printing in base \c 16. This may be \c NULL if no prefix + * is needed. + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base to be used in the emitted string. + * \param fout The output file handle. This may be \c NULL, in which case + * the output is written to \c stdout. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_write_file(const char *p, const mbedtls_mpi *X, + int radix, FILE *fout); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Import an MPI from unsigned big endian binary data. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary(mbedtls_mpi *X, const unsigned char *buf, + size_t buflen); + +/** + * \brief Import X from unsigned binary data, little endian + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary_le(mbedtls_mpi *X, + const unsigned char *buf, size_t buflen); + +/** + * \brief Export X into unsigned binary data, big endian. + * Always fills the whole buffer, which will start with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary(const mbedtls_mpi *X, unsigned char *buf, + size_t buflen); + +/** + * \brief Export X into unsigned binary data, little endian. + * Always fills the whole buffer, which will end with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary_le(const mbedtls_mpi *X, + unsigned char *buf, size_t buflen); + +/** + * \brief Perform a left-shift on an MPI: X <<= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * The MPI pointed by \p X may be resized to fit + * the resulting number. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_l(mbedtls_mpi *X, size_t count); + +/** + * \brief Perform a right-shift on an MPI: X >>= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_r(mbedtls_mpi *X, size_t count); + +/** + * \brief Compare the absolute values of two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if `|X|` is greater than `|Y|`. + * \return \c -1 if `|X|` is lesser than `|Y|`. + * \return \c 0 if `|X|` is equal to `|Y|`. + */ +int mbedtls_mpi_cmp_abs(const mbedtls_mpi *X, const mbedtls_mpi *Y); + +/** + * \brief Compare two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if \p X is greater than \p Y. + * \return \c -1 if \p X is lesser than \p Y. + * \return \c 0 if \p X is equal to \p Y. + */ +int mbedtls_mpi_cmp_mpi(const mbedtls_mpi *X, const mbedtls_mpi *Y); + +/** + * \brief Check if an MPI is less than the other in constant time. + * + * \param X The left-hand MPI. This must point to an initialized MPI + * with the same allocated length as Y. + * \param Y The right-hand MPI. This must point to an initialized MPI + * with the same allocated length as X. + * \param ret The result of the comparison: + * \c 1 if \p X is less than \p Y. + * \c 0 if \p X is greater than or equal to \p Y. + * + * \return 0 on success. + * \return MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of + * the two input MPIs is not the same. + */ +int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X, const mbedtls_mpi *Y, + unsigned *ret); + +/** + * \brief Compare an MPI with an integer. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param z The integer value to compare \p X to. + * + * \return \c 1 if \p X is greater than \p z. + * \return \c -1 if \p X is lesser than \p z. + * \return \c 0 if \p X is equal to \p z. + */ +int mbedtls_mpi_cmp_int(const mbedtls_mpi *X, mbedtls_mpi_sint z); + +/** + * \brief Perform an unsigned addition of MPIs: X = |A| + |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_abs(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform an unsigned subtraction of MPIs: X = |A| - |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is greater than \p A. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_sub_abs(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a signed addition of MPIs: X = A + B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a signed subtraction of MPIs: X = A - B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a signed addition of an MPI and an integer: X = A + b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param b The second summand. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_int(mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b); + +/** + * \brief Perform a signed subtraction of an MPI and an integer: + * X = A - b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param b The subtrahend. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_int(mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b); + +/** + * \brief Perform a multiplication of two MPIs: X = A * B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param B The second factor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a multiplication of an MPI with an unsigned integer: + * X = A * b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param b The second factor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_int(mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_uint b); + +/** + * \brief Perform a division with remainder of two MPIs: + * A = Q * B + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. This must not alias A or B. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. This must not alias A or B. + * \param A The dividend. This must point to an initialized MPI. + * \param B The divisor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_mpi(mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a division with remainder of an MPI by an integer: + * A = Q * b + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. This must not alias A. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. This must not alias A. + * \param A The dividend. This must point to an initialized MPi. + * \param b The divisor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_int(mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + mbedtls_mpi_sint b); + +/** + * \brief Perform a modular reduction. R = A mod B + * + * \param R The destination MPI for the residue value. + * This must point to an initialized MPI. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPI. + * \param B The base of the modular reduction. + * This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is negative. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mod_mpi(mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Perform a modular reduction with respect to an integer. + * r = A mod b + * + * \param r The address at which to store the residue. + * This must not be \c NULL. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPi. + * \param b The integer base of the modular reduction. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p b is negative. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_mod_int(mbedtls_mpi_uint *r, const mbedtls_mpi *A, + mbedtls_mpi_sint b); + +/** + * \brief Perform a modular exponentiation: X = A^E mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * This must not alias E or N. + * \param A The base of the exponentiation. + * This must point to an initialized MPI. + * \param E The exponent MPI. This must point to an initialized MPI. + * \param N The base for the modular reduction. This must point to an + * initialized MPI. + * \param prec_RR A helper MPI depending solely on \p N which can be used to + * speed-up multiple modular exponentiations for the same value + * of \p N. This may be \c NULL. If it is not \c NULL, it must + * point to an initialized MPI. If it hasn't been used after + * the call to mbedtls_mpi_init(), this function will compute + * the helper value and store it in \p prec_RR for reuse on + * subsequent calls to this function. Otherwise, the function + * will assume that \p prec_RR holds the helper value set by a + * previous call to mbedtls_mpi_exp_mod(), and reuse it. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \c N is negative or + * even, or if \c E is negative. + * \return Another negative error code on different kinds of failures. + * + */ +int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *E, const mbedtls_mpi *N, + mbedtls_mpi *prec_RR); + +/** + * \brief Fill an MPI with a number of random bytes. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param size The number of random bytes to generate. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on failure. + * + * \note The bytes obtained from the RNG are interpreted + * as a big-endian representation of an MPI; this can + * be relevant in applications like deterministic ECDSA. + */ +int mbedtls_mpi_fill_random(mbedtls_mpi *X, size_t size, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** Generate a random number uniformly in a range. + * + * This function generates a random number between \p min inclusive and + * \p N exclusive. + * + * The procedure complies with RFC 6979 §3.3 (deterministic ECDSA) + * when the RNG is a suitably parametrized instance of HMAC_DRBG + * and \p min is \c 1. + * + * \note There are `N - min` possible outputs. The lower bound + * \p min can be reached, but the upper bound \p N cannot. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param min The minimum value to return. + * It must be nonnegative. + * \param N The upper bound of the range, exclusive. + * In other words, this is one plus the maximum value to return. + * \p N must be strictly larger than \p min. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p min or \p N is invalid + * or if they are incompatible. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if the implementation was + * unable to find a suitable value within a limited number + * of attempts. This has a negligible probability if \p N + * is significantly larger than \p min, which is the case + * for all usual cryptographic applications. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_random(mbedtls_mpi *X, + mbedtls_mpi_sint min, + const mbedtls_mpi *N, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Compute the greatest common divisor: G = gcd(A, B) + * + * \param G The destination MPI. This must point to an initialized MPI. + * This will always be positive or 0. + * \param A The first operand. This must point to an initialized MPI. + * \param B The second operand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_gcd(mbedtls_mpi *G, const mbedtls_mpi *A, + const mbedtls_mpi *B); + +/** + * \brief Compute the modular inverse: X = A^-1 mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * The value returned on success will be between [1, N-1]. + * \param A The MPI to calculate the modular inverse of. This must point + * to an initialized MPI. This value can be negative, in which + * case a positive answer will still be returned in \p X. + * \param N The base of the modular inversion. This must point to an + * initialized MPI and be greater than one. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than + * or equal to one. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + * inverse with respect to \p N. + */ +int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *N); + +/** + * \brief Miller-Rabin primality test. + * + * \warning If \p X is potentially generated by an adversary, for example + * when validating cryptographic parameters that you didn't + * generate yourself and that are supposed to be prime, then + * \p rounds should be at least the half of the security + * strength of the cryptographic algorithm. On the other hand, + * if \p X is chosen uniformly or non-adversarially (as is the + * case when mbedtls_mpi_gen_prime calls this function), then + * \p rounds can be much lower. + * + * \param X The MPI to check for primality. + * This must point to an initialized MPI. + * \param rounds The number of bases to perform the Miller-Rabin primality + * test for. The probability of returning 0 on a composite is + * at most 2-2*\p rounds . + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, i.e. \p X is probably prime. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_is_prime_ext(const mbedtls_mpi *X, int rounds, + mbedtls_f_rng_t *f_rng, + void *p_rng); +/** + * \brief Flags for mbedtls_mpi_gen_prime() + * + * Each of these flags is a constraint on the result X returned by + * mbedtls_mpi_gen_prime(). + */ +typedef enum { + MBEDTLS_MPI_GEN_PRIME_FLAG_DH = 0x0001, /**< (X-1)/2 is prime too */ + MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR = 0x0002, /**< lower error rate from 2-80 to 2-128 */ +} mbedtls_mpi_gen_prime_flag_t; + +/** + * \brief Generate a prime number. + * + * \param X The destination MPI to store the generated prime in. + * This must point to an initialized MPi. + * \param nbits The required size of the destination MPI in bits. + * This must be between \c 3 and #MBEDTLS_MPI_MAX_BITS. + * \param flags A mask of flags of type #mbedtls_mpi_gen_prime_flag_t. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, in which case \p X holds a + * probably prime number. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if `nbits` is not between + * \c 3 and #MBEDTLS_MPI_MAX_BITS. + */ +int mbedtls_mpi_gen_prime(mbedtls_mpi *X, size_t nbits, int flags, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_mpi_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* bignum.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/block_cipher.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/block_cipher.h new file mode 100644 index 00000000..3f60f6f7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/block_cipher.h @@ -0,0 +1,76 @@ +/** + * \file block_cipher.h + * + * \brief Internal abstraction layer. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_BLOCK_CIPHER_H +#define MBEDTLS_BLOCK_CIPHER_H + +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#if defined(MBEDTLS_AES_C) +#include "mbedtls/aes.h" +#endif +#if defined(MBEDTLS_ARIA_C) +#include "mbedtls/aria.h" +#endif +#if defined(MBEDTLS_CAMELLIA_C) +#include "mbedtls/camellia.h" +#endif + +#if defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA) +#include "psa/crypto_types.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum { + MBEDTLS_BLOCK_CIPHER_ID_NONE = 0, /**< Unset. */ + MBEDTLS_BLOCK_CIPHER_ID_AES, /**< The AES cipher. */ + MBEDTLS_BLOCK_CIPHER_ID_CAMELLIA, /**< The Camellia cipher. */ + MBEDTLS_BLOCK_CIPHER_ID_ARIA, /**< The Aria cipher. */ +} mbedtls_block_cipher_id_t; + +/** + * Used internally to indicate whether a context uses legacy or PSA. + * + * Internal use only. + */ +typedef enum { + MBEDTLS_BLOCK_CIPHER_ENGINE_LEGACY = 0, + MBEDTLS_BLOCK_CIPHER_ENGINE_PSA, +} mbedtls_block_cipher_engine_t; + +typedef struct { + mbedtls_block_cipher_id_t MBEDTLS_PRIVATE(id); +#if defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA) + mbedtls_block_cipher_engine_t MBEDTLS_PRIVATE(engine); + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(psa_key_id); +#endif + union { + unsigned dummy; /* Make the union non-empty even with no supported algorithms. */ +#if defined(MBEDTLS_AES_C) + mbedtls_aes_context MBEDTLS_PRIVATE(aes); +#endif +#if defined(MBEDTLS_ARIA_C) + mbedtls_aria_context MBEDTLS_PRIVATE(aria); +#endif +#if defined(MBEDTLS_CAMELLIA_C) + mbedtls_camellia_context MBEDTLS_PRIVATE(camellia); +#endif + } MBEDTLS_PRIVATE(ctx); +} mbedtls_block_cipher_context_t; + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_BLOCK_CIPHER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/build_info.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/build_info.h new file mode 100644 index 00000000..b5e8066b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/build_info.h @@ -0,0 +1,194 @@ +/** + * \file mbedtls/build_info.h + * + * \brief Build-time configuration info + * + * Include this file if you need to depend on the + * configuration options defined in mbedtls_config.h or MBEDTLS_CONFIG_FILE + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_BUILD_INFO_H +#define MBEDTLS_BUILD_INFO_H + +/* + * This set of compile-time defines can be used to determine the version number + * of the Mbed TLS library used. Run-time variables for the same can be found in + * version.h + */ + +/** + * The version number x.y.z is split into three parts. + * Major, Minor, Patchlevel + */ +#define MBEDTLS_VERSION_MAJOR 3 +#define MBEDTLS_VERSION_MINOR 6 +#define MBEDTLS_VERSION_PATCH 6 + +/** + * The single version number has the following structure: + * MMNNPP00 + * Major version | Minor version | Patch version + */ +#define MBEDTLS_VERSION_NUMBER 0x03060600 +#define MBEDTLS_VERSION_STRING "3.6.6" +#define MBEDTLS_VERSION_STRING_FULL "Mbed TLS 3.6.6" + +/* Macros for build-time platform detection */ + +#if !defined(MBEDTLS_ARCH_IS_ARM64) && \ + (defined(__aarch64__) || defined(_M_ARM64) || defined(_M_ARM64EC)) +#define MBEDTLS_ARCH_IS_ARM64 +#endif + +#if !defined(MBEDTLS_ARCH_IS_ARM32) && \ + (defined(__arm__) || defined(_M_ARM) || \ + defined(_M_ARMT) || defined(__thumb__) || defined(__thumb2__)) +#define MBEDTLS_ARCH_IS_ARM32 +#endif + +#if !defined(MBEDTLS_ARCH_IS_X64) && \ + (defined(__amd64__) || defined(__x86_64__) || \ + ((defined(_M_X64) || defined(_M_AMD64)) && !defined(_M_ARM64EC))) +#define MBEDTLS_ARCH_IS_X64 +#endif + +#if !defined(MBEDTLS_ARCH_IS_X86) && \ + (defined(__i386__) || defined(_X86_) || \ + (defined(_M_IX86) && !defined(_M_I86))) +#define MBEDTLS_ARCH_IS_X86 +#endif + +#if !defined(MBEDTLS_PLATFORM_IS_WINDOWS_ON_ARM64) && \ + (defined(_M_ARM64) || defined(_M_ARM64EC)) +#define MBEDTLS_PLATFORM_IS_WINDOWS_ON_ARM64 +#endif + +/* This is defined if the architecture is Armv8-A, or higher */ +#if !defined(MBEDTLS_ARCH_IS_ARMV8_A) +#if defined(__ARM_ARCH) && defined(__ARM_ARCH_PROFILE) +#if (__ARM_ARCH >= 8) && (__ARM_ARCH_PROFILE == 'A') +/* GCC, clang, armclang and IAR */ +#define MBEDTLS_ARCH_IS_ARMV8_A +#endif +#elif defined(__ARM_ARCH_8A) +/* Alternative defined by clang */ +#define MBEDTLS_ARCH_IS_ARMV8_A +#elif defined(_M_ARM64) || defined(_M_ARM64EC) +/* MSVC ARM64 is at least Armv8.0-A */ +#define MBEDTLS_ARCH_IS_ARMV8_A +#endif +#endif + +#if defined(__GNUC__) && !defined(__ARMCC_VERSION) && !defined(__clang__) \ + && !defined(__llvm__) && !defined(__INTEL_COMPILER) +/* Defined if the compiler really is gcc and not clang, etc */ +#define MBEDTLS_COMPILER_IS_GCC +#define MBEDTLS_GCC_VERSION \ + (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) +#endif + +#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) +#define _CRT_SECURE_NO_DEPRECATE 1 +#endif + +/* Define `inline` on some non-C99-compliant compilers. */ +#if (defined(__ARMCC_VERSION) || defined(_MSC_VER)) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +#if defined(MBEDTLS_CONFIG_FILES_READ) +#error "Something went wrong: MBEDTLS_CONFIG_FILES_READ defined before reading the config files!" +#endif +#if defined(MBEDTLS_CONFIG_IS_FINALIZED) +#error "Something went wrong: MBEDTLS_CONFIG_IS_FINALIZED defined before reading the config files!" +#endif + +/* X.509, TLS and non-PSA crypto configuration */ +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/mbedtls_config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_CONFIG_VERSION) && ( \ + MBEDTLS_CONFIG_VERSION < 0x03000000 || \ + MBEDTLS_CONFIG_VERSION > MBEDTLS_VERSION_NUMBER) +#error "Invalid config version, defined value of MBEDTLS_CONFIG_VERSION is unsupported" +#endif + +/* Target and application specific configurations + * + * Allow user to override any previous default. + * + */ +#if defined(MBEDTLS_USER_CONFIG_FILE) +#include MBEDTLS_USER_CONFIG_FILE +#endif + +/* PSA crypto configuration */ +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_CONFIG_FILE +#else +#include "psa/crypto_config.h" +#endif +#if defined(MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE +#endif +#endif /* defined(MBEDTLS_PSA_CRYPTO_CONFIG) */ + +/* Indicate that all configuration files have been read. + * It is now time to adjust the configuration (follow through on dependencies, + * make PSA and legacy crypto consistent, etc.). + */ +#define MBEDTLS_CONFIG_FILES_READ + +/* Auto-enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY if + * MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH and MBEDTLS_CTR_DRBG_C defined + * to ensure a 128-bit key size in CTR_DRBG. + */ +#if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && defined(MBEDTLS_CTR_DRBG_C) +#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY +#endif + +/* Auto-enable MBEDTLS_MD_C if needed by a module that didn't require it + * in a previous release, to ensure backwards compatibility. + */ +#if defined(MBEDTLS_PKCS5_C) +#define MBEDTLS_MD_C +#endif + +/* PSA crypto specific configuration options + * - If config_psa.h reads a configuration option in preprocessor directive, + * this symbol should be set before its inclusion. (e.g. MBEDTLS_MD_C) + * - If config_psa.h writes a configuration option in conditional directive, + * this symbol should be consulted after its inclusion. + * (e.g. MBEDTLS_MD_LIGHT) + */ +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) /* PSA_WANT_xxx influences MBEDTLS_xxx */ || \ + defined(MBEDTLS_PSA_CRYPTO_C) /* MBEDTLS_xxx influences PSA_WANT_xxx */ || \ + defined(MBEDTLS_PSA_CRYPTO_CLIENT) /* The same as the previous, but with separation only */ +#include "mbedtls/config_psa.h" +#endif + +#include "mbedtls/config_adjust_legacy_crypto.h" + +#include "mbedtls/config_adjust_x509.h" + +#include "mbedtls/config_adjust_ssl.h" + +/* Indicate that all configuration symbols are set, + * even the ones that are calculated programmatically. + * It is now safe to query the configuration (to check it, to size buffers, + * etc.). + */ +#define MBEDTLS_CONFIG_IS_FINALIZED + +#include "mbedtls/check_config.h" + +#endif /* MBEDTLS_BUILD_INFO_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/camellia.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/camellia.h new file mode 100644 index 00000000..557f4725 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/camellia.h @@ -0,0 +1,305 @@ +/** + * \file camellia.h + * + * \brief Camellia block cipher + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_CAMELLIA_H +#define MBEDTLS_CAMELLIA_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_CAMELLIA_ENCRYPT 1 +#define MBEDTLS_CAMELLIA_DECRYPT 0 + +/** Bad input data. */ +#define MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA -0x0024 + +/** Invalid data input length. */ +#define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CAMELLIA_ALT) +// Regular implementation +// + +/** + * \brief CAMELLIA context structure + */ +typedef struct mbedtls_camellia_context { + int MBEDTLS_PRIVATE(nr); /*!< number of rounds */ + uint32_t MBEDTLS_PRIVATE(rk)[68]; /*!< CAMELLIA round keys */ +} +mbedtls_camellia_context; + +#else /* MBEDTLS_CAMELLIA_ALT */ +#include "camellia_alt.h" +#endif /* MBEDTLS_CAMELLIA_ALT */ + +/** + * \brief Initialize a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be initialized. + * This must not be \c NULL. + */ +void mbedtls_camellia_init(mbedtls_camellia_context *ctx); + +/** + * \brief Clear a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be cleared. This may be \c NULL, + * in which case this function returns immediately. If it is not + * \c NULL, it must be initialized. + */ +void mbedtls_camellia_free(mbedtls_camellia_context *ctx); + +/** + * \brief Perform a CAMELLIA key schedule operation for encryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The encryption key to use. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_enc(mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits); + +#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +/** + * \brief Perform a CAMELLIA key schedule operation for decryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_dec(mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits); +#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ + +/** + * \brief Perform a CAMELLIA-ECB block encryption/decryption operation. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param input The input block. This must be a readable buffer + * of size \c 16 Bytes. + * \param output The output block. This must be a writable buffer + * of size \c 16 Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ecb(mbedtls_camellia_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16]); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief Perform a CAMELLIA-CBC buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length in Bytes of the input data \p input. + * This must be a multiple of \c 16 Bytes. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated to allow streaming + * use as explained above. + * \param input The buffer holding the input data. This must point to a + * readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must point to a + * writable buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cbc(mbedtls_camellia_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief Perform a CAMELLIA-CFB128 buffer encryption/decryption + * operation. + * + * \note Due to the nature of CFB mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length of the input data \p input. Any value is allowed. + * \param iv_off The current offset in the IV. This must be smaller + * than \c 16 Bytes. It is updated after this call to allow + * the aforementioned streaming usage. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated after this call to + * allow the aforementioned streaming usage. + * \param input The buffer holding the input data. This must be a readable + * buffer of size \p length Bytes. + * \param output The buffer to hold the output data. This must be a writable + * buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cfb128(mbedtls_camellia_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief Perform a CAMELLIA-CTR buffer encryption/decryption operation. + * + * *note Due to the nature of CTR mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether the mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first \c 12 Bytes for the + * per-message nonce, and the last \c 4 Bytes for internal use. + * In that case, before calling this function on a new message you + * need to set the first \c 12 Bytes of \p nonce_counter to your + * chosen nonce value, the last four to \c 0, and \p nc_off to \c 0 + * (which will cause \p stream_block to be ignored). That way, you + * can encrypt at most \c 2**96 messages of up to \c 2**32 blocks + * each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be + * unique. The recommended way to ensure uniqueness is to use a + * message counter. An alternative is to generate random nonces, + * but this limits the number of messages that can be securely + * encrypted: for example, with 96-bit random nonces, you should + * not encrypt more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that a CAMELLIA block is \c 16 Bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param length The length of the input data \p input in Bytes. + * Any value is allowed. + * \param nc_off The offset in the current \p stream_block (for resuming + * within current cipher stream). The offset pointer to + * should be \c 0 at the start of a stream. It is updated + * at the end of this call. + * \param nonce_counter The 128-bit nonce and counter. This must be a read/write + * buffer of length \c 16 Bytes. + * \param stream_block The saved stream-block for resuming. This must be a + * read/write buffer of length \c 16 Bytes. + * \param input The input data stream. This must be a readable buffer of + * size \p length Bytes. + * \param output The output data stream. This must be a writable buffer + * of size \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ctr(mbedtls_camellia_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_camellia_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* camellia.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ccm.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ccm.h new file mode 100644 index 00000000..1da57c92 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ccm.h @@ -0,0 +1,526 @@ +/** + * \file ccm.h + * + * \brief This file provides an API for the CCM authenticated encryption + * mode for block ciphers. + * + * CCM combines Counter mode encryption with CBC-MAC authentication + * for 128-bit block ciphers. + * + * Input to CCM includes the following elements: + *
  • Payload - data that is both authenticated and encrypted.
    • + *
  • Associated data (Adata) - data that is authenticated but not + * encrypted, For example, a header.
    • + *
  • Nonce - A unique value that is assigned to the payload and the + * associated data.
+ * + * Definition of CCM: + * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf + * RFC 3610 "Counter with CBC-MAC (CCM)" + * + * Related: + * RFC 5116 "An Interface and Algorithms for Authenticated Encryption" + * + * Definition of CCM*: + * IEEE 802.15.4 - IEEE Standard for Local and metropolitan area networks + * Integer representation is fixed most-significant-octet-first order and + * the representation of octets is most-significant-bit-first order. This is + * consistent with RFC 3610. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CCM_H +#define MBEDTLS_CCM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_BLOCK_CIPHER_C) +#include "mbedtls/block_cipher.h" +#endif + +#define MBEDTLS_CCM_DECRYPT 0 +#define MBEDTLS_CCM_ENCRYPT 1 +#define MBEDTLS_CCM_STAR_DECRYPT 2 +#define MBEDTLS_CCM_STAR_ENCRYPT 3 + +/** Bad input parameters to the function. */ +#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CCM_ALT) +// Regular implementation +// + +/** + * \brief The CCM context-type definition. The CCM context is passed + * to the APIs called. + */ +typedef struct mbedtls_ccm_context { + unsigned char MBEDTLS_PRIVATE(y)[16]; /*!< The Y working buffer */ + unsigned char MBEDTLS_PRIVATE(ctr)[16]; /*!< The counter buffer */ + size_t MBEDTLS_PRIVATE(plaintext_len); /*!< Total plaintext length */ + size_t MBEDTLS_PRIVATE(add_len); /*!< Total authentication data length */ + size_t MBEDTLS_PRIVATE(tag_len); /*!< Total tag length */ + size_t MBEDTLS_PRIVATE(processed); /*!< Track how many bytes of input data + were processed (chunked input). + Used independently for both auth data + and plaintext/ciphertext. + This variable is set to zero after + auth data input is finished. */ + unsigned int MBEDTLS_PRIVATE(q); /*!< The Q working value */ + unsigned int MBEDTLS_PRIVATE(mode); /*!< The operation to perform: + #MBEDTLS_CCM_ENCRYPT or + #MBEDTLS_CCM_DECRYPT or + #MBEDTLS_CCM_STAR_ENCRYPT or + #MBEDTLS_CCM_STAR_DECRYPT. */ +#if defined(MBEDTLS_BLOCK_CIPHER_C) + mbedtls_block_cipher_context_t MBEDTLS_PRIVATE(block_cipher_ctx); /*!< The cipher context used. */ +#else + mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ +#endif + int MBEDTLS_PRIVATE(state); /*!< Working value holding context's + state. Used for chunked data input */ +} +mbedtls_ccm_context; + +#else /* MBEDTLS_CCM_ALT */ +#include "ccm_alt.h" +#endif /* MBEDTLS_CCM_ALT */ + +/** + * \brief This function initializes the specified CCM context, + * to make references valid, and prepare the context + * for mbedtls_ccm_setkey() or mbedtls_ccm_free(). + * + * \param ctx The CCM context to initialize. This must not be \c NULL. + */ +void mbedtls_ccm_init(mbedtls_ccm_context *ctx); + +/** + * \brief This function initializes the CCM context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The CCM context to initialize. This must be an initialized + * context. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must not be \c NULL. + * \param keybits The key size in bits. This must be acceptable by the cipher. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_setkey(mbedtls_ccm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits); + +/** + * \brief This function releases and clears the specified CCM context + * and underlying cipher sub-context. + * + * \param ctx The CCM context to clear. If this is \c NULL, the function + * has no effect. Otherwise, this must be initialized. + */ +void mbedtls_ccm_free(mbedtls_ccm_context *ctx); + +/** + * \brief This function encrypts a buffer using CCM. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param ad The additional data field. If \p ad_len is greater than + * zero, \p ad must be a readable buffer of at least that + * length. + * \param ad_len The length of additional data in Bytes. + * This must be less than `2^16 - 2^8`. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len); + +/** + * \brief This function encrypts a buffer using CCM*. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \note When using this function in a variable tag length context, + * the tag length has to be encoded into the \p iv passed to + * this function. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * For tag length = 0, input length is ignored. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param ad The additional data field. This must be a readable buffer of + * at least \p ad_len Bytes. + * \param ad_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is no + * longer authenticated. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_star_encrypt_and_tag(mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len); + +/** + * \brief This function performs a CCM authenticated decryption of a + * buffer. + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param ad The additional data field. This must be a readable buffer + * of at least that \p ad_len Bytes.. + * \param ad_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. This indicates that the message is authentic. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_auth_decrypt(mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len); + +/** + * \brief This function performs a CCM* authenticated decryption of a + * buffer. + * + * \note When using this function in a variable tag length context, + * the tag length has to be decoded from \p iv and passed to + * this function as \p tag_len. (\p tag needs to be adjusted + * accordingly.) + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * For tag length = 0, input length is ignored. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param ad The additional data field. This must be a readable buffer of + * at least that \p ad_len Bytes. + * \param ad_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field in Bytes. + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is nos + * longer authenticated. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_star_auth_decrypt(mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len); + +/** + * \brief This function starts a CCM encryption or decryption + * operation. + * + * This function and mbedtls_ccm_set_lengths() must be called + * before calling mbedtls_ccm_update_ad() or + * mbedtls_ccm_update(). This function can be called before + * or after mbedtls_ccm_set_lengths(). + * + * \note This function is not implemented in Mbed TLS yet. + * + * \param ctx The CCM context. This must be initialized. + * \param mode The operation to perform: #MBEDTLS_CCM_ENCRYPT or + * #MBEDTLS_CCM_DECRYPT or #MBEDTLS_CCM_STAR_ENCRYPT or + * #MBEDTLS_CCM_STAR_DECRYPT. + * \param iv The initialization vector. This must be a readable buffer + * of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: + * \p ctx is in an invalid state, + * \p mode is invalid, + * \p iv_len is invalid (lower than \c 7 or greater than + * \c 13). + */ +int mbedtls_ccm_starts(mbedtls_ccm_context *ctx, + int mode, + const unsigned char *iv, + size_t iv_len); + +/** + * \brief This function declares the lengths of the message + * and additional data for a CCM encryption or decryption + * operation. + * + * This function and mbedtls_ccm_starts() must be called + * before calling mbedtls_ccm_update_ad() or + * mbedtls_ccm_update(). This function can be called before + * or after mbedtls_ccm_starts(). + * + * \note This function is not implemented in Mbed TLS yet. + * + * \param ctx The CCM context. This must be initialized. + * \param total_ad_len The total length of additional data in bytes. + * This must be less than `2^16 - 2^8`. + * \param plaintext_len The length in bytes of the plaintext to encrypt or + * result of the decryption (thus not encompassing the + * additional data that are not encrypted). + * \param tag_len The length of the tag to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * For CCM*, zero is also valid. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: + * \p ctx is in an invalid state, + * \p total_ad_len is greater than \c 0xFF00. + */ +int mbedtls_ccm_set_lengths(mbedtls_ccm_context *ctx, + size_t total_ad_len, + size_t plaintext_len, + size_t tag_len); + +/** + * \brief This function feeds an input buffer as associated data + * (authenticated but not encrypted data) in a CCM + * encryption or decryption operation. + * + * You may call this function zero, one or more times + * to pass successive parts of the additional data. The + * lengths \p ad_len of the data parts should eventually add + * up exactly to the total length of additional data + * \c total_ad_len passed to mbedtls_ccm_set_lengths(). You + * may not call this function after calling + * mbedtls_ccm_update(). + * + * \note This function is not implemented in Mbed TLS yet. + * + * \param ctx The CCM context. This must have been started with + * mbedtls_ccm_starts(), the lengths of the message and + * additional data must have been declared with + * mbedtls_ccm_set_lengths() and this must not have yet + * received any input with mbedtls_ccm_update(). + * \param ad The buffer holding the additional data, or \c NULL + * if \p ad_len is \c 0. + * \param ad_len The length of the additional data. If \c 0, + * \p ad may be \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: + * \p ctx is in an invalid state, + * total input length too long. + */ +int mbedtls_ccm_update_ad(mbedtls_ccm_context *ctx, + const unsigned char *ad, + size_t ad_len); + +/** + * \brief This function feeds an input buffer into an ongoing CCM + * encryption or decryption operation. + * + * You may call this function zero, one or more times + * to pass successive parts of the input: the plaintext to + * encrypt, or the ciphertext (not including the tag) to + * decrypt. After the last part of the input, call + * mbedtls_ccm_finish(). The lengths \p input_len of the + * data parts should eventually add up exactly to the + * plaintext length \c plaintext_len passed to + * mbedtls_ccm_set_lengths(). + * + * This function may produce output in one of the following + * ways: + * - Immediate output: the output length is always equal + * to the input length. + * - Buffered output: except for the last part of input data, + * the output consists of a whole number of 16-byte blocks. + * If the total input length so far (not including + * associated data) is 16 \* *B* + *A* with *A* < 16 then + * the total output length is 16 \* *B*. + * For the last part of input data, the output length is + * equal to the input length plus the number of bytes (*A*) + * buffered in the previous call to the function (if any). + * The function uses the plaintext length + * \c plaintext_len passed to mbedtls_ccm_set_lengths() + * to detect the last part of input data. + * + * In particular: + * - It is always correct to call this function with + * \p output_size >= \p input_len + 15. + * - If \p input_len is a multiple of 16 for all the calls + * to this function during an operation (not necessary for + * the last one) then it is correct to use \p output_size + * =\p input_len. + * + * \note This function is not implemented in Mbed TLS yet. + * + * \param ctx The CCM context. This must have been started with + * mbedtls_ccm_starts() and the lengths of the message and + * additional data must have been declared with + * mbedtls_ccm_set_lengths(). + * \param input The buffer holding the input data. If \p input_len + * is greater than zero, this must be a readable buffer + * of at least \p input_len bytes. + * \param input_len The length of the input data in bytes. + * \param output The buffer for the output data. If \p output_size + * is greater than zero, this must be a writable buffer of + * at least \p output_size bytes. + * \param output_size The size of the output buffer in bytes. + * See the function description regarding the output size. + * \param output_len On success, \p *output_len contains the actual + * length of the output written in \p output. + * On failure, the content of \p *output_len is + * unspecified. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: + * \p ctx is in an invalid state, + * total input length too long, + * or \p output_size too small. + */ +int mbedtls_ccm_update(mbedtls_ccm_context *ctx, + const unsigned char *input, size_t input_len, + unsigned char *output, size_t output_size, + size_t *output_len); + +/** + * \brief This function finishes the CCM operation and generates + * the authentication tag. + * + * It wraps up the CCM stream, and generates the + * tag. The tag can have a maximum length of 16 Bytes. + * + * \note This function is not implemented in Mbed TLS yet. + * + * \param ctx The CCM context. This must have been started with + * mbedtls_ccm_starts() and the lengths of the message and + * additional data must have been declared with + * mbedtls_ccm_set_lengths(). + * \param tag The buffer for holding the tag. If \p tag_len is greater + * than zero, this must be a writable buffer of at least \p + * tag_len Bytes. + * \param tag_len The length of the tag. Must match the tag length passed to + * mbedtls_ccm_set_lengths() function. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_BAD_INPUT on failure: + * \p ctx is in an invalid state, + * invalid value of \p tag_len, + * the total amount of additional data passed to + * mbedtls_ccm_update_ad() was lower than the total length of + * additional data \c total_ad_len passed to + * mbedtls_ccm_set_lengths(), + * the total amount of input data passed to + * mbedtls_ccm_update() was lower than the plaintext length + * \c plaintext_len passed to mbedtls_ccm_set_lengths(). + */ +int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, + unsigned char *tag, size_t tag_len); + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_CCM_GCM_CAN_AES) +/** + * \brief The CCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ccm_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CCM_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chacha20.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chacha20.h new file mode 100644 index 00000000..680fe360 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chacha20.h @@ -0,0 +1,202 @@ +/** + * \file chacha20.h + * + * \brief This file contains ChaCha20 definitions and functions. + * + * ChaCha20 is a stream cipher that can encrypt and decrypt + * information. ChaCha was created by Daniel Bernstein as a variant of + * its Salsa cipher https://cr.yp.to/chacha/chacha-20080128.pdf + * ChaCha20 is the variant with 20 rounds, that was also standardized + * in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CHACHA20_H +#define MBEDTLS_CHACHA20_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CHACHA20_ALT) + +typedef struct mbedtls_chacha20_context { + uint32_t MBEDTLS_PRIVATE(state)[16]; /*! The state (before round operations). */ + uint8_t MBEDTLS_PRIVATE(keystream8)[64]; /*! Leftover keystream bytes. */ + size_t MBEDTLS_PRIVATE(keystream_bytes_used); /*! Number of keystream bytes already used. */ +} +mbedtls_chacha20_context; + +#else /* MBEDTLS_CHACHA20_ALT */ +#include "chacha20_alt.h" +#endif /* MBEDTLS_CHACHA20_ALT */ + +/** + * \brief This function initializes the specified ChaCha20 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by calls to + * \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts(), then one or more calls to + * to \c mbedtls_chacha20_update(), and finally to + * \c mbedtls_chacha20_free(). + * + * \param ctx The ChaCha20 context to initialize. + * This must not be \c NULL. + */ +void mbedtls_chacha20_init(mbedtls_chacha20_context *ctx); + +/** + * \brief This function releases and clears the specified + * ChaCha20 context. + * + * \param ctx The ChaCha20 context to clear. This may be \c NULL, + * in which case this function is a no-op. If it is not + * \c NULL, it must point to an initialized context. + * + */ +void mbedtls_chacha20_free(mbedtls_chacha20_context *ctx); + +/** + * \brief This function sets the encryption/decryption key. + * + * \note After using this function, you must also call + * \c mbedtls_chacha20_starts() to set a nonce before you + * start encrypting/decrypting data with + * \c mbedtls_chacha_update(). + * + * \param ctx The ChaCha20 context to which the key should be bound. + * It must be initialized. + * \param key The encryption/decryption key. This must be \c 32 Bytes + * in length. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or key is NULL. + */ +int mbedtls_chacha20_setkey(mbedtls_chacha20_context *ctx, + const unsigned char key[32]); + +/** + * \brief This function sets the nonce and initial counter value. + * + * \note A ChaCha20 context can be re-used with the same key by + * calling this function to change the nonce. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality guarantees for the + * messages encrypted with the same nonce and key. + * + * \param ctx The ChaCha20 context to which the nonce should be bound. + * It must be initialized and bound to a key. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or nonce is + * NULL. + */ +int mbedtls_chacha20_starts(mbedtls_chacha20_context *ctx, + const unsigned char nonce[12], + uint32_t counter); + +/** + * \brief This function encrypts or decrypts data. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \note \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts() must be called at least once + * to setup the context before this function can be called. + * + * \note This function can be called multiple times in a row in + * order to encrypt of decrypt data piecewise with the same + * key and nonce. + * + * \param ctx The ChaCha20 context to use for encryption or decryption. + * It must be initialized and bound to a key and nonce. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx, + size_t size, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function encrypts or decrypts data with ChaCha20 and + * the given key and nonce. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \warning You must never use the same (key, nonce) pair more than + * once. This would void any confidentiality guarantees for + * the messages encrypted with the same nonce and key. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \param key The encryption/decryption key. + * This must be \c 32 Bytes in length. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_crypt(const unsigned char key[32], + const unsigned char nonce[12], + uint32_t counter, + size_t size, + const unsigned char *input, + unsigned char *output); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chacha20_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHA20_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chachapoly.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chachapoly.h new file mode 100644 index 00000000..3dc21e38 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/chachapoly.h @@ -0,0 +1,342 @@ +/** + * \file chachapoly.h + * + * \brief This file contains the AEAD-ChaCha20-Poly1305 definitions and + * functions. + * + * ChaCha20-Poly1305 is an algorithm for Authenticated Encryption + * with Associated Data (AEAD) that can be used to encrypt and + * authenticate data. It is based on ChaCha20 and Poly1305 by Daniel + * Bernstein and was standardized in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CHACHAPOLY_H +#define MBEDTLS_CHACHAPOLY_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +/* for shared error codes */ +#include "mbedtls/poly1305.h" + +/** The requested operation is not permitted in the current state. */ +#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 +/** Authenticated decryption failed: data was not authentic. */ +#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum { + MBEDTLS_CHACHAPOLY_ENCRYPT, /**< The mode value for performing encryption. */ + MBEDTLS_CHACHAPOLY_DECRYPT /**< The mode value for performing decryption. */ +} +mbedtls_chachapoly_mode_t; + +#if !defined(MBEDTLS_CHACHAPOLY_ALT) + +#include "mbedtls/chacha20.h" + +typedef struct mbedtls_chachapoly_context { + mbedtls_chacha20_context MBEDTLS_PRIVATE(chacha20_ctx); /**< The ChaCha20 context. */ + mbedtls_poly1305_context MBEDTLS_PRIVATE(poly1305_ctx); /**< The Poly1305 context. */ + uint64_t MBEDTLS_PRIVATE(aad_len); /**< The length (bytes) of the Additional Authenticated Data. */ + uint64_t MBEDTLS_PRIVATE(ciphertext_len); /**< The length (bytes) of the ciphertext. */ + int MBEDTLS_PRIVATE(state); /**< The current state of the context. */ + mbedtls_chachapoly_mode_t MBEDTLS_PRIVATE(mode); /**< Cipher mode (encrypt or decrypt). */ +} +mbedtls_chachapoly_context; + +#else /* !MBEDTLS_CHACHAPOLY_ALT */ +#include "chachapoly_alt.h" +#endif /* !MBEDTLS_CHACHAPOLY_ALT */ + +/** + * \brief This function initializes the specified ChaCha20-Poly1305 context. + * + * It must be the first API called before using + * the context. It must be followed by a call to + * \c mbedtls_chachapoly_setkey() before any operation can be + * done, and to \c mbedtls_chachapoly_free() once all + * operations with that context have been finished. + * + * In order to encrypt or decrypt full messages at once, for + * each message you should make a single call to + * \c mbedtls_chachapoly_crypt_and_tag() or + * \c mbedtls_chachapoly_auth_decrypt(). + * + * In order to encrypt messages piecewise, for each + * message you should make a call to + * \c mbedtls_chachapoly_starts(), then 0 or more calls to + * \c mbedtls_chachapoly_update_aad(), then 0 or more calls to + * \c mbedtls_chachapoly_update(), then one call to + * \c mbedtls_chachapoly_finish(). + * + * \warning Decryption with the piecewise API is discouraged! Always + * use \c mbedtls_chachapoly_auth_decrypt() when possible! + * + * If however this is not possible because the data is too + * large to fit in memory, you need to: + * + * - call \c mbedtls_chachapoly_starts() and (if needed) + * \c mbedtls_chachapoly_update_aad() as above, + * - call \c mbedtls_chachapoly_update() multiple times and + * ensure its output (the plaintext) is NOT used in any other + * way than placing it in temporary storage at this point, + * - call \c mbedtls_chachapoly_finish() to compute the + * authentication tag and compared it in constant time to the + * tag received with the ciphertext. + * + * If the tags are not equal, you must immediately discard + * all previous outputs of \c mbedtls_chachapoly_update(), + * otherwise you can now safely use the plaintext. + * + * \param ctx The ChachaPoly context to initialize. Must not be \c NULL. + */ +void mbedtls_chachapoly_init(mbedtls_chachapoly_context *ctx); + +/** + * \brief This function releases and clears the specified + * ChaCha20-Poly1305 context. + * + * \param ctx The ChachaPoly context to clear. This may be \c NULL, in which + * case this function is a no-op. + */ +void mbedtls_chachapoly_free(mbedtls_chachapoly_context *ctx); + +/** + * \brief This function sets the ChaCha20-Poly1305 + * symmetric encryption key. + * + * \param ctx The ChaCha20-Poly1305 context to which the key should be + * bound. This must be initialized. + * \param key The \c 256 Bit (\c 32 Bytes) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_setkey(mbedtls_chachapoly_context *ctx, + const unsigned char key[32]); + +/** + * \brief This function starts a ChaCha20-Poly1305 encryption or + * decryption operation. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \note If the context is being used for AAD only (no data to + * encrypt or decrypt) then \p mode can be set to any value. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param nonce The nonce/IV to use for the message. + * This must be a readable buffer of length \c 12 Bytes. + * \param mode The operation to perform: #MBEDTLS_CHACHAPOLY_ENCRYPT or + * #MBEDTLS_CHACHAPOLY_DECRYPT (discouraged, see warning). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_starts(mbedtls_chachapoly_context *ctx, + const unsigned char nonce[12], + mbedtls_chachapoly_mode_t mode); + +/** + * \brief This function feeds additional data to be authenticated + * into an ongoing ChaCha20-Poly1305 operation. + * + * The Additional Authenticated Data (AAD), also called + * Associated Data (AD) is only authenticated but not + * encrypted nor included in the encrypted output. It is + * usually transmitted separately from the ciphertext or + * computed locally by each party. + * + * \note This function is called before data is encrypted/decrypted. + * I.e. call this function to process the AAD before calling + * \c mbedtls_chachapoly_update(). + * + * You may call this function multiple times to process + * an arbitrary amount of AAD. It is permitted to call + * this function 0 times, if no AAD is used. + * + * This function cannot be called any more if data has + * been processed by \c mbedtls_chachapoly_update(), + * or if the context has been finished. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param aad_len The length in Bytes of the AAD. The length has no + * restrictions. + * \param aad Buffer containing the AAD. + * This pointer can be \c NULL if `aad_len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA + * if \p ctx or \p aad are NULL. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operations has not been started or has been + * finished, or if the AAD has been finished. + */ +int mbedtls_chachapoly_update_aad(mbedtls_chachapoly_context *ctx, + const unsigned char *aad, + size_t aad_len); + +/** + * \brief Thus function feeds data to be encrypted or decrypted + * into an on-going ChaCha20-Poly1305 + * operation. + * + * The direction (encryption or decryption) depends on the + * mode that was given when calling + * \c mbedtls_chachapoly_starts(). + * + * You may call this function multiple times to process + * an arbitrary amount of data. It is permitted to call + * this function 0 times, if no data is to be encrypted + * or decrypted. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param len The length (in bytes) of the data to encrypt or decrypt. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `len == 0`. + * \param output The buffer to where the encrypted or decrypted data is + * written. This must be able to hold \p len bytes. + * This pointer can be \c NULL if `len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_update(mbedtls_chachapoly_context *ctx, + size_t len, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function finished the ChaCha20-Poly1305 operation and + * generates the MAC (authentication tag). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param mac The buffer to where the 128-bit (16 bytes) MAC is written. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_finish(mbedtls_chachapoly_context *ctx, + unsigned char mac[16]); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated encryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * This must be initialized. + * \param length The length (in bytes) of the data to encrypt or decrypt. + * \param nonce The 96-bit (12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated + * data (AAD). This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the encrypted or decrypted data + * is written. This pointer can be \c NULL if `ilen == 0`. + * \param tag The buffer to where the computed 128-bit (16 bytes) MAC + * is written. This must not be \c NULL. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_encrypt_and_tag(mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char *input, + unsigned char *output, + unsigned char tag[16]); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated decryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * \param length The length (in Bytes) of the data to decrypt. + * \param nonce The \c 96 Bit (\c 12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated data (AAD). + * This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param tag The buffer holding the authentication tag. + * This must be a readable buffer of length \c 16 Bytes. + * \param input The buffer containing the data to decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the decrypted data is written. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED + * if the data was not authentic. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_auth_decrypt(mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char tag[16], + const unsigned char *input, + unsigned char *output); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20-Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chachapoly_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHAPOLY_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/check_config.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/check_config.h new file mode 100644 index 00000000..aec5050b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/check_config.h @@ -0,0 +1,1149 @@ +/** + * \file check_config.h + * + * \brief Consistency checks for configuration options + * + * This is an internal header. Do not include it directly. + * + * This header is included automatically by all public Mbed TLS headers + * (via mbedtls/build_info.h). Do not include it directly in a configuration + * file such as mbedtls/mbedtls_config.h or #MBEDTLS_USER_CONFIG_FILE! + * It would run at the wrong time due to missing derived symbols. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CHECK_CONFIG_H +#define MBEDTLS_CHECK_CONFIG_H + +/* *INDENT-OFF* */ + +#if !defined(MBEDTLS_CONFIG_IS_FINALIZED) +#warning "Do not include mbedtls/check_config.h manually! " \ + "This may cause spurious errors. " \ + "It is included automatically at the right point since Mbed TLS 3.0." +#endif /* !MBEDTLS_CONFIG_IS_FINALIZED */ + +/* + * We assume CHAR_BIT is 8 in many places. In practice, this is true on our + * target platforms, so not an issue, but let's just be extra sure. + */ +#include +#if CHAR_BIT != 8 +#error "Mbed TLS requires a platform with 8-bit chars" +#endif + +#include + +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900) +#if !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_C is required on Windows" +#endif +/* See auto-enabling SNPRINTF_ALT and VSNPRINTF_ALT + * in * config_adjust_legacy_crypto.h */ +#endif /* _MINGW32__ || (_MSC_VER && (_MSC_VER <= 1900)) */ + +#if defined(TARGET_LIKE_MBED) && defined(MBEDTLS_NET_C) +#error "The NET module is not available for mbed OS - please use the network functions provided by Mbed OS" +#endif + +#if defined(MBEDTLS_DEPRECATED_WARNING) && \ + !defined(__GNUC__) && !defined(__clang__) +#error "MBEDTLS_DEPRECATED_WARNING only works with GCC and Clang" +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_HAVE_TIME) +#error "MBEDTLS_HAVE_TIME_DATE without MBEDTLS_HAVE_TIME does not make sense" +#endif + +/* Limitations on ECC key types acceleration: if we have any of `PUBLIC_KEY`, + * `KEY_PAIR_BASIC`, `KEY_PAIR_IMPORT`, `KEY_PAIR_EXPORT` then we must have + * all 4 of them. + */ +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) || \ + defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ + defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ + defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) || \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +#error "Unsupported partial support for ECC key type acceleration, see docs/driver-only-builds.md" +#endif /* not all of public, basic, import, export */ +#endif /* one of public, basic, import, export */ + +/* Limitations on ECC curves acceleration: partial curve acceleration is only + * supported with crypto excluding PK, X.509 or TLS. + * Note: no need to check X.509 as it depends on PK. */ +#if defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) || \ + defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521) +#if defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) +#if defined(MBEDTLS_PK_C) || \ + defined(MBEDTLS_SSL_TLS_C) +#error "Unsupported partial support for ECC curves acceleration, see docs/driver-only-builds.md" +#endif /* modules beyond what's supported */ +#endif /* not all curves accelerated */ +#endif /* some curve accelerated */ + +#if defined(MBEDTLS_CTR_DRBG_C) && !(defined(MBEDTLS_AES_C) || \ + (defined(MBEDTLS_PSA_CRYPTO_CLIENT) && defined(PSA_WANT_KEY_TYPE_AES) && \ + defined(PSA_WANT_ALG_ECB_NO_PADDING))) +#error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_DHM_C) && !defined(MBEDTLS_BIGNUM_C) +#error "MBEDTLS_DHM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CMAC_C) && \ + ( !defined(MBEDTLS_CIPHER_C ) || ( !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_DES_C) ) ) +#error "MBEDTLS_CMAC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_NIST_KW_C) && \ + ( !defined(MBEDTLS_AES_C) || !defined(MBEDTLS_CIPHER_C) ) +#error "MBEDTLS_NIST_KW_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) && defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and PSA_WANT_ALG_CBC_NO_PADDING cannot be defined simultaneously" +#endif +#if defined(PSA_WANT_ALG_CBC_PKCS7) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and PSA_WANT_ALG_CBC_PKCS7 cannot be defined simultaneously" +#endif +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and PSA_WANT_ALG_ECB_NO_PADDING cannot be defined simultaneously" +#endif +#if defined(PSA_WANT_KEY_TYPE_DES) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and PSA_WANT_KEY_TYPE_DES cannot be defined simultaneously" +#endif +#endif + +#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and MBEDTLS_CIPHER_MODE_CBC cannot be defined simultaneously" +#endif +#if defined(MBEDTLS_CIPHER_MODE_XTS) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and MBEDTLS_CIPHER_MODE_XTS cannot be defined simultaneously" +#endif +#if defined(MBEDTLS_DES_C) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and MBEDTLS_DES_C cannot be defined simultaneously" +#endif +#if defined(MBEDTLS_NIST_KW_C) +#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT and MBEDTLS_NIST_KW_C cannot be defined simultaneously" +#endif +#endif + +#if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C) +#error "MBEDTLS_ECDH_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + ( !defined(MBEDTLS_ECP_C) || \ + !( defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) ) || \ + !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_ASN1_WRITE_C) ) +#error "MBEDTLS_ECDSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_C) && defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN) && !defined(MBEDTLS_ASN1_WRITE_C) +#error "MBEDTLS_PK_C with MBEDTLS_USE_PSA_CRYPTO needs MBEDTLS_ASN1_WRITE_C for ECDSA signature" +#endif +#if defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) && !defined(MBEDTLS_ASN1_PARSE_C) +#error "MBEDTLS_PK_C with MBEDTLS_USE_PSA_CRYPTO needs MBEDTLS_ASN1_PARSE_C for ECDSA verification" +#endif +#endif /* MBEDTLS_PK_C && MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_ECJPAKE_C) && \ + !defined(MBEDTLS_ECP_C) +#error "MBEDTLS_ECJPAKE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + ( defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \ + defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) || \ + defined(MBEDTLS_ECDSA_SIGN_ALT) || \ + defined(MBEDTLS_ECDSA_VERIFY_ALT) || \ + defined(MBEDTLS_ECDSA_GENKEY_ALT) || \ + defined(MBEDTLS_ECP_INTERNAL_ALT) || \ + defined(MBEDTLS_ECP_ALT) ) +#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative ECP implementation" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + !defined(MBEDTLS_ECP_C) +#error "MBEDTLS_ECP_RESTARTABLE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C) +#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_LIGHT) && ( !defined(MBEDTLS_BIGNUM_C) || ( \ + !defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) ) ) +#error "MBEDTLS_ECP_C defined (or a subset enabled), but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_C) && \ + !(defined(MBEDTLS_MD_CAN_SHA512) || defined(MBEDTLS_MD_CAN_SHA256)) +#error "MBEDTLS_ENTROPY_C defined, but not all prerequisites" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 64) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + (defined(MBEDTLS_ENTROPY_FORCE_SHA256) || !defined(MBEDTLS_MD_CAN_SHA512)) \ + && defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 32) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_FORCE_SHA256) && !defined(MBEDTLS_MD_CAN_SHA256) +#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites" +#endif + +#if defined(__has_feature) +#if __has_feature(memory_sanitizer) +#define MBEDTLS_HAS_MEMSAN // #undef at the end of this paragraph +#endif +#endif +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) && !defined(MBEDTLS_HAS_MEMSAN) +#error "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN requires building with MemorySanitizer" +#endif +#if defined(MBEDTLS_HAS_MEMSAN) && defined(MBEDTLS_HAVE_ASM) +#error "MemorySanitizer does not support assembly implementation" +#endif +#undef MBEDTLS_HAS_MEMSAN // temporary macro defined above + +#if defined(MBEDTLS_CCM_C) && \ + !(defined(MBEDTLS_CCM_GCM_CAN_AES) || defined(MBEDTLS_CCM_GCM_CAN_ARIA) || \ + defined(MBEDTLS_CCM_GCM_CAN_CAMELLIA)) +#error "MBEDTLS_CCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_GCM_C) && \ + !(defined(MBEDTLS_CCM_GCM_CAN_AES) || defined(MBEDTLS_CCM_GCM_CAN_ARIA) || \ + defined(MBEDTLS_CCM_GCM_CAN_CAMELLIA)) +#error "MBEDTLS_GCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_CHACHA20_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_POLY1305_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_ADD_MIXED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NO_FALLBACK) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NO_FALLBACK defined, but no alternative implementation enabled" +#endif + +#if defined(MBEDTLS_HKDF_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HKDF_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HMAC_DRBG_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HMAC_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_CAN_ECDH) || \ + !defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ + ( !defined(MBEDTLS_CAN_ECDH) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(MBEDTLS_DHM_C) +#error "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \ + !defined(MBEDTLS_CAN_ECDH) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_DHM_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_CAN_ECDH) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_CAN_ECDH) || \ + !defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ + ( !defined(PSA_WANT_ALG_JPAKE) || \ + !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ + !defined(PSA_WANT_ECC_SECP_R1_256) ) +#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" +#endif +#else /* MBEDTLS_USE_PSA_CRYPTO */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ + ( !defined(MBEDTLS_ECJPAKE_C) || \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ) +#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" +#endif +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/* Use of EC J-PAKE in TLS requires SHA-256. */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ + !defined(MBEDTLS_MD_CAN_SHA256) +#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) && \ + !defined(MBEDTLS_MD_CAN_SHA256) && \ + !defined(MBEDTLS_MD_CAN_SHA512) && \ + !defined(MBEDTLS_MD_CAN_SHA1) +#error "!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE requires SHA-512, SHA-256 or SHA-1". +#endif + +#if defined(MBEDTLS_MD_C) && \ + !defined(MBEDTLS_MD_CAN_MD5) && \ + !defined(MBEDTLS_MD_CAN_RIPEMD160) && \ + !defined(MBEDTLS_MD_CAN_SHA1) && \ + !defined(MBEDTLS_MD_CAN_SHA224) && \ + !defined(MBEDTLS_MD_CAN_SHA256) && \ + !defined(MBEDTLS_MD_CAN_SHA384) && \ + !defined(MBEDTLS_MD_CAN_SHA512) && \ + !defined(MBEDTLS_MD_CAN_SHA3_224) && \ + !defined(MBEDTLS_MD_CAN_SHA3_256) && \ + !defined(MBEDTLS_MD_CAN_SHA3_384) && \ + !defined(MBEDTLS_MD_CAN_SHA3_512) +#error "MBEDTLS_MD_C defined, but no hash algorithm" +#endif + +#if defined(MBEDTLS_LMS_C) && \ + ! ( defined(MBEDTLS_PSA_CRYPTO_CLIENT) && defined(PSA_WANT_ALG_SHA_256) ) +#error "MBEDTLS_LMS_C requires MBEDTLS_PSA_CRYPTO_C and PSA_WANT_ALG_SHA_256" +#endif + +#if defined(MBEDTLS_LMS_PRIVATE) && \ + ( !defined(MBEDTLS_LMS_C) ) +#error "MBEDTLS_LMS_PRIVATE requires MBEDTLS_LMS_C" +#endif + +#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_BACKTRACE) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_BACKTRACE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_DEBUG) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_DEBUG defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_WRITE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_C) && \ + !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_PK_HAVE_ECC_KEYS) +#error "MBEDTLS_PK_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_PARSE_C) && \ + (!defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_OID_C) || \ + !defined(MBEDTLS_PK_C)) +#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_WRITE_C) && \ + (!defined(MBEDTLS_ASN1_WRITE_C) || \ + !defined(MBEDTLS_OID_C) || \ + !defined(MBEDTLS_PK_C)) +#error "MBEDTLS_PK_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_EXIT) ||\ + defined(MBEDTLS_PLATFORM_EXIT_ALT) ) +#error "MBEDTLS_PLATFORM_EXIT_MACRO and MBEDTLS_PLATFORM_STD_EXIT/MBEDTLS_PLATFORM_EXIT_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_SETBUF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SETBUF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SETBUF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SETBUF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SETBUF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_SETBUF) ||\ + defined(MBEDTLS_PLATFORM_SETBUF_ALT) ) +#error "MBEDTLS_PLATFORM_SETBUF_MACRO and MBEDTLS_PLATFORM_STD_SETBUF/MBEDTLS_PLATFORM_SETBUF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_ALT) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_MS_TIME_ALT) && \ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_MS_TIME_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_FPRINTF) ||\ + defined(MBEDTLS_PLATFORM_FPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO and MBEDTLS_PLATFORM_STD_FPRINTF/MBEDTLS_PLATFORM_FPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_FREE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_FREE) +#error "MBEDTLS_PLATFORM_FREE_MACRO and MBEDTLS_PLATFORM_STD_FREE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && !defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO must be defined if MBEDTLS_PLATFORM_FREE_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_CALLOC) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) && !defined(MBEDTLS_PLATFORM_FREE_MACRO) +#error "MBEDTLS_PLATFORM_FREE_MACRO must be defined if MBEDTLS_PLATFORM_CALLOC_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_MEMORY) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_MEMORY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_PRINTF) ||\ + defined(MBEDTLS_PLATFORM_PRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO and MBEDTLS_PLATFORM_STD_PRINTF/MBEDTLS_PLATFORM_PRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_SNPRINTF) ||\ + defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO and MBEDTLS_PLATFORM_STD_SNPRINTF/MBEDTLS_PLATFORM_SNPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_VSNPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_VSNPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_VSNPRINTF) ||\ + defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_VSNPRINTF_MACRO and MBEDTLS_PLATFORM_STD_VSNPRINTF/MBEDTLS_PLATFORM_VSNPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) &&\ + !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#error "MBEDTLS_PLATFORM_STD_MEM_HDR defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FREE) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_FREE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_EXIT) &&\ + !defined(MBEDTLS_PLATFORM_EXIT_ALT) +#error "MBEDTLS_PLATFORM_STD_EXIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_TIME) &&\ + ( !defined(MBEDTLS_PLATFORM_TIME_ALT) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_STD_TIME defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_FPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_PRINTF) &&\ + !defined(MBEDTLS_PLATFORM_PRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_PRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_SNPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_ENTROPY_C) ) +#error "MBEDTLS_ENTROPY_NV_SEED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) &&\ + !defined(MBEDTLS_ENTROPY_NV_SEED) +#error "MBEDTLS_PLATFORM_NV_SEED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_READ defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_WRITE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_READ_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_READ cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_WRITE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_C) && \ + !( ( ( defined(MBEDTLS_CTR_DRBG_C) || defined(MBEDTLS_HMAC_DRBG_C) ) && \ + defined(MBEDTLS_ENTROPY_C) ) || \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) ) +#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_C) && defined(PSA_HAVE_SOFT_BLOCK_MODE) && \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SPM) && !defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) && \ + ! ( defined(MBEDTLS_PSA_CRYPTO_C) && \ + defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) ) +#error "MBEDTLS_PSA_CRYPTO_SE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_PSA_CRYPTO_SE_C is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_PSA_CRYPTO_SE_C is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ + +#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + ! defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) ) +#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG" +#endif + +#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && \ + defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) +#error "MBEDTLS_PSA_KEY_STORE_DYNAMIC and MBEDTLS_PSA_STATIC_KEY_SLOTS cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PSA_ITS_FILE_C) && \ + !defined(MBEDTLS_FS_IO) +#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) ) +#error "MBEDTLS_RSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_PKCS1_V21) && \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_RSA_C defined, but none of the PKCS1 versions enabled" +#endif + +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_PKCS1_V21) ) +#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT) && \ + defined(MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY) +#error "Must only define one of MBEDTLS_SHA512_USE_A64_CRYPTO_*" +#endif + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT) || \ + defined(MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY) +#if !defined(MBEDTLS_SHA512_C) +#error "MBEDTLS_SHA512_USE_A64_CRYPTO_* defined without MBEDTLS_SHA512_C" +#endif +#if defined(MBEDTLS_SHA512_ALT) || defined(MBEDTLS_SHA512_PROCESS_ALT) +#error "MBEDTLS_SHA512_*ALT can't be used with MBEDTLS_SHA512_USE_A64_CRYPTO_*" +#endif + +#endif /* MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT || MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY */ + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY) && !defined(__aarch64__) +#error "MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY defined on non-Aarch64 system" +#endif + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT) && \ + defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) +#error "Must only define one of MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_*" +#endif + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT) || \ + defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) +#if !defined(MBEDTLS_SHA256_C) +#error "MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_* defined without MBEDTLS_SHA256_C" +#endif +#if defined(MBEDTLS_SHA256_ALT) || defined(MBEDTLS_SHA256_PROCESS_ALT) +#error "MBEDTLS_SHA256_*ALT can't be used with MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_*" +#endif + +#endif + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) && !defined(MBEDTLS_ARCH_IS_ARMV8_A) +#error "MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY defined on non-Armv8-A system" +#endif + +/* TLS 1.3 requires separate HKDF parts from PSA, + * and at least one ciphersuite, so at least SHA-256 or SHA-384 + * from PSA to use with HKDF. + * + * Note: for dependencies common with TLS 1.2 (running handshake hash), + * see MBEDTLS_SSL_TLS_C. */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ + !(defined(MBEDTLS_PSA_CRYPTO_CLIENT) && \ + defined(PSA_WANT_ALG_HKDF_EXTRACT) && \ + defined(PSA_WANT_ALG_HKDF_EXPAND) && \ + (defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384))) +#error "MBEDTLS_SSL_PROTO_TLS1_3 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) +#if !( (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \ + defined(MBEDTLS_X509_CRT_PARSE_C) && \ + ( defined(MBEDTLS_PK_CAN_ECDSA_SIGN) || defined(MBEDTLS_PKCS1_V21) ) ) +#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites" +#endif +#endif + +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) +#if !( defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) ) +#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED defined, but not all prerequisites" +#endif +#endif + +/* + * The current implementation of TLS 1.3 requires MBEDTLS_SSL_KEEP_PEER_CERTIFICATE. + */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) +#error "MBEDTLS_SSL_PROTO_TLS1_3 defined without MBEDTLS_SSL_KEEP_PEER_CERTIFICATE" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + !(defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) ) +#error "One or more versions of the TLS protocol are enabled " \ + "but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx" +#endif + +#if defined(MBEDTLS_SSL_EARLY_DATA) && \ + ( !defined(MBEDTLS_SSL_SESSION_TICKETS) || \ + ( !defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) && \ + !defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) ) ) +#error "MBEDTLS_SSL_EARLY_DATA defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SRV_C) && \ + defined(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE) && \ + ((MBEDTLS_SSL_MAX_EARLY_DATA_SIZE < 0) || \ + (MBEDTLS_SSL_MAX_EARLY_DATA_SIZE > UINT32_MAX)) +#error "MBEDTLS_SSL_MAX_EARLY_DATA_SIZE must be in the range(0..UINT32_MAX)" +#endif + +#if defined(MBEDTLS_SSL_PROTO_DTLS) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_PROTO_DTLS defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_CLI_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && !defined(MBEDTLS_X509_CRT_PARSE_C) +#error "MBEDTLS_SSL_ASYNC_PRIVATE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && !(defined(MBEDTLS_CIPHER_C) || \ + defined(MBEDTLS_USE_PSA_CRYPTO)) +#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" +#endif + +/* TLS 1.2 and 1.3 require SHA-256 or SHA-384 (running handshake hash) */ +#if defined(MBEDTLS_SSL_TLS_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if !(defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384)) +#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" +#endif +#else /* MBEDTLS_USE_PSA_CRYPTO */ +#if !defined(MBEDTLS_MD_C) || \ + !(defined(MBEDTLS_MD_CAN_SHA256) || defined(MBEDTLS_MD_CAN_SHA384)) +#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" +#endif +#endif /* MBEDTLS_USE_PSA_CRYPTO */ +#endif /* MBEDTLS_SSL_TLS_C */ + +#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && \ + !( defined(MBEDTLS_SSL_PROTO_TLS1_2) || defined(MBEDTLS_SSL_PROTO_TLS1_3) ) +#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active" +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS) +#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && \ + !defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) +#error "MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_CONNECTION_ID defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_IN_LEN_MAX) && \ + MBEDTLS_SSL_CID_IN_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_IN_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) && \ + MBEDTLS_SSL_CID_OUT_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_OUT_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT) && \ + !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#error "MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT) && MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT != 0 +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT && MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT != 0 */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_ENCRYPT_THEN_MAC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_RENEGOTIATION) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_RENEGOTIATION defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TICKET_C) && ( !defined(MBEDTLS_CIPHER_C) && \ + !defined(MBEDTLS_USE_PSA_CRYPTO) ) +#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TICKET_C) && \ + !( defined(MBEDTLS_SSL_HAVE_CCM) || defined(MBEDTLS_SSL_HAVE_GCM) || \ + defined(MBEDTLS_SSL_HAVE_CHACHAPOLY) ) +#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH) && \ + MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH >= 256 +#error "MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH must be less than 256" +#endif + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ + !defined(MBEDTLS_X509_CRT_PARSE_C) +#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_THREADING_PTHREAD) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_PTHREAD defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL // undef at the end of this paragraph +#endif +#if defined(MBEDTLS_THREADING_ALT) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_ALT defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL // undef at the end of this paragraph +#endif +#if defined(MBEDTLS_THREADING_C) && !defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_C defined, single threading implementation required" +#endif +#undef MBEDTLS_THREADING_IMPL // temporary macro defined above + +#if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_PSA_CRYPTO_CLIENT) +#error "MBEDTLS_USE_PSA_CRYPTO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C) +#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_USE_C) && \ + (!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_PK_PARSE_C) || \ + ( !defined(MBEDTLS_MD_C) && !defined(MBEDTLS_USE_PSA_CRYPTO) ) ) +#error "MBEDTLS_X509_USE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CREATE_C) && \ + (!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \ + !defined(MBEDTLS_PK_PARSE_C) || \ + ( !defined(MBEDTLS_MD_C) && !defined(MBEDTLS_USE_PSA_CRYPTO) ) ) +#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) && \ + ( !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64) +#error "MBEDTLS_HAVE_INT32 and MBEDTLS_HAVE_INT64 cannot be defined simultaneously" +#endif /* MBEDTLS_HAVE_INT32 && MBEDTLS_HAVE_INT64 */ + +#if ( defined(MBEDTLS_HAVE_INT32) || defined(MBEDTLS_HAVE_INT64) ) && \ + defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously" +#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) && ( !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_SRTP defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && ( !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) ) +#error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) && ( !defined(MBEDTLS_SSL_PROTO_TLS1_3) ) +#error "MBEDTLS_SSL_RECORD_SIZE_LIMIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) && \ + !( defined(MBEDTLS_SSL_HAVE_CCM) || defined(MBEDTLS_SSL_HAVE_GCM) || \ + defined(MBEDTLS_SSL_HAVE_CHACHAPOLY) ) +#error "MBEDTLS_SSL_CONTEXT_SERIALIZATION defined, but not all prerequisites" +#endif + +/* Reject attempts to enable options that have been removed and that could + * cause a build to succeed but with features removed. */ + +#if defined(MBEDTLS_HAVEGE_C) //no-check-names +#error "MBEDTLS_HAVEGE_C was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/2599" +#endif + +#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) //no-check-names +#error "MBEDTLS_SSL_HW_RECORD_ACCEL was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031" +#endif + +#if defined(MBEDTLS_SSL_PROTO_SSL3) //no-check-names +#error "MBEDTLS_SSL_PROTO_SSL3 (SSL v3.0 support) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031" +#endif + +#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) //no-check-names +#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO (SSL v2 ClientHello support) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031" +#endif + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT) //no-check-names +#error "MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT (compatibility with the buggy implementation of truncated HMAC in Mbed TLS up to 2.7) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031" +#endif + +#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES) //no-check-names +#error "MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES was removed in Mbed TLS 3.0. See the ChangeLog entry if you really need SHA-1-signed certificates." +#endif + +#if defined(MBEDTLS_ZLIB_SUPPORT) //no-check-names +#error "MBEDTLS_ZLIB_SUPPORT was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031" +#endif + +#if defined(MBEDTLS_CHECK_PARAMS) //no-check-names +#error "MBEDTLS_CHECK_PARAMS was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4313" +#endif + +#if defined(MBEDTLS_SSL_CID_PADDING_GRANULARITY) //no-check-names +#error "MBEDTLS_SSL_CID_PADDING_GRANULARITY was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4335" +#endif + +#if defined(MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY) //no-check-names +#error "MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4335" +#endif + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) //no-check-names +#error "MBEDTLS_SSL_TRUNCATED_HMAC was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4341" +#endif + +#if defined(MBEDTLS_PKCS7_C) && ( ( !defined(MBEDTLS_ASN1_PARSE_C) ) || \ + ( !defined(MBEDTLS_OID_C) ) || ( !defined(MBEDTLS_PK_PARSE_C) ) || \ + ( !defined(MBEDTLS_X509_CRT_PARSE_C) ) || \ + ( !defined(MBEDTLS_X509_CRL_PARSE_C) ) || \ + ( !defined(MBEDTLS_MD_C) ) ) +#error "MBEDTLS_PKCS7_C is defined, but not all prerequisites" +#endif + +/* + * Avoid warning from -pedantic. This is a convenient place for this + * workaround since this is included by every single file before the + * #if defined(MBEDTLS_xxx_C) that results in empty translation units. + */ +typedef int mbedtls_iso_c_forbids_empty_translation_units; + +/* *INDENT-ON* */ +#endif /* MBEDTLS_CHECK_CONFIG_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cipher.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cipher.h new file mode 100644 index 00000000..e5471521 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cipher.h @@ -0,0 +1,1250 @@ +/** + * \file cipher.h + * + * \brief This file contains an abstraction interface for use with the cipher + * primitives provided by the library. It provides a common interface to all of + * the available cipher operations. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CIPHER_H +#define MBEDTLS_CIPHER_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include "mbedtls/platform_util.h" + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +#define MBEDTLS_CIPHER_MODE_AEAD +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_CIPHER_MODE_WITH_PADDING +#endif + +#if defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ + defined(MBEDTLS_CHACHA20_C) +#define MBEDTLS_CIPHER_MODE_STREAM +#endif + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 +/** Bad input parameters. */ +#define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA -0x6100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_CIPHER_ALLOC_FAILED -0x6180 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_CIPHER_INVALID_PADDING -0x6200 +/** Decryption of block requires a full block. */ +#define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 +/** Authentication failed (for AEAD modes). */ +#define MBEDTLS_ERR_CIPHER_AUTH_FAILED -0x6300 +/** The context is invalid. For example, because it was freed. */ +#define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT -0x6380 + +#define MBEDTLS_CIPHER_VARIABLE_IV_LEN 0x01 /**< Cipher accepts IVs of variable length. */ +#define MBEDTLS_CIPHER_VARIABLE_KEY_LEN 0x02 /**< Cipher accepts keys of variable length. */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported cipher types. + * + * \warning DES/3DES are considered weak ciphers and their use + * constitutes a security risk. We recommend considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_ID_NONE = 0, /**< Placeholder to mark the end of cipher ID lists. */ + MBEDTLS_CIPHER_ID_NULL, /**< The identity cipher, treated as a stream cipher. */ + MBEDTLS_CIPHER_ID_AES, /**< The AES cipher. */ + MBEDTLS_CIPHER_ID_DES, /**< The DES cipher. \warning DES is considered weak. */ + MBEDTLS_CIPHER_ID_3DES, /**< The Triple DES cipher. \warning 3DES is considered weak. */ + MBEDTLS_CIPHER_ID_CAMELLIA, /**< The Camellia cipher. */ + MBEDTLS_CIPHER_ID_ARIA, /**< The Aria cipher. */ + MBEDTLS_CIPHER_ID_CHACHA20, /**< The ChaCha20 cipher. */ +} mbedtls_cipher_id_t; + +/** + * \brief Supported {cipher type, cipher mode} pairs. + * + * \warning DES/3DES are considered weak ciphers and their use + * constitutes a security risk. We recommend considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_NONE = 0, /**< Placeholder to mark the end of cipher-pair lists. */ + MBEDTLS_CIPHER_NULL, /**< The identity stream cipher. */ + MBEDTLS_CIPHER_AES_128_ECB, /**< AES cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_AES_192_ECB, /**< AES cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_AES_256_ECB, /**< AES cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_AES_128_CBC, /**< AES cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_AES_192_CBC, /**< AES cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_AES_256_CBC, /**< AES cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_AES_128_CFB128, /**< AES cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_192_CFB128, /**< AES cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_256_CFB128, /**< AES cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_128_CTR, /**< AES cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_AES_192_CTR, /**< AES cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_AES_256_CTR, /**< AES cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_AES_128_GCM, /**< AES cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_AES_192_GCM, /**< AES cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_AES_256_GCM, /**< AES cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_ECB, /**< Camellia cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_ECB, /**< Camellia cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_ECB, /**< Camellia cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CBC, /**< Camellia cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CBC, /**< Camellia cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CBC, /**< Camellia cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CFB128, /**< Camellia cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CFB128, /**< Camellia cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CFB128, /**< Camellia cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CTR, /**< Camellia cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CTR, /**< Camellia cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CTR, /**< Camellia cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_GCM, /**< Camellia cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_GCM, /**< Camellia cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_GCM, /**< Camellia cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_DES_ECB, /**< DES cipher with ECB mode. \warning DES is considered weak. */ + MBEDTLS_CIPHER_DES_CBC, /**< DES cipher with CBC mode. \warning DES is considered weak. */ + MBEDTLS_CIPHER_DES_EDE_ECB, /**< DES cipher with EDE ECB mode. \warning 3DES is considered weak. */ + MBEDTLS_CIPHER_DES_EDE_CBC, /**< DES cipher with EDE CBC mode. \warning 3DES is considered weak. */ + MBEDTLS_CIPHER_DES_EDE3_ECB, /**< DES cipher with EDE3 ECB mode. \warning 3DES is considered weak. */ + MBEDTLS_CIPHER_DES_EDE3_CBC, /**< DES cipher with EDE3 CBC mode. \warning 3DES is considered weak. */ + MBEDTLS_CIPHER_AES_128_CCM, /**< AES cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_AES_192_CCM, /**< AES cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_AES_256_CCM, /**< AES cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_AES_128_CCM_STAR_NO_TAG, /**< AES cipher with 128-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_AES_192_CCM_STAR_NO_TAG, /**< AES cipher with 192-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_AES_256_CCM_STAR_NO_TAG, /**< AES cipher with 256-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CCM, /**< Camellia cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CCM, /**< Camellia cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CCM, /**< Camellia cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CCM_STAR_NO_TAG, /**< Camellia cipher with 128-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CCM_STAR_NO_TAG, /**< Camellia cipher with 192-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CCM_STAR_NO_TAG, /**< Camellia cipher with 256-bit CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_ARIA_128_ECB, /**< Aria cipher with 128-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_192_ECB, /**< Aria cipher with 192-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_256_ECB, /**< Aria cipher with 256-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_128_CBC, /**< Aria cipher with 128-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_192_CBC, /**< Aria cipher with 192-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_256_CBC, /**< Aria cipher with 256-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_128_CFB128, /**< Aria cipher with 128-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_192_CFB128, /**< Aria cipher with 192-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_256_CFB128, /**< Aria cipher with 256-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_128_CTR, /**< Aria cipher with 128-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_192_CTR, /**< Aria cipher with 192-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_256_CTR, /**< Aria cipher with 256-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_128_GCM, /**< Aria cipher with 128-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_192_GCM, /**< Aria cipher with 192-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_256_GCM, /**< Aria cipher with 256-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_128_CCM, /**< Aria cipher with 128-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_192_CCM, /**< Aria cipher with 192-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_256_CCM, /**< Aria cipher with 256-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_128_CCM_STAR_NO_TAG, /**< Aria cipher with 128-bit key and CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_ARIA_192_CCM_STAR_NO_TAG, /**< Aria cipher with 192-bit key and CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_ARIA_256_CCM_STAR_NO_TAG, /**< Aria cipher with 256-bit key and CCM_STAR_NO_TAG mode. */ + MBEDTLS_CIPHER_AES_128_OFB, /**< AES 128-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_192_OFB, /**< AES 192-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_256_OFB, /**< AES 256-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_128_XTS, /**< AES 128-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */ + MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */ + MBEDTLS_CIPHER_AES_128_KW, /**< AES cipher with 128-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_192_KW, /**< AES cipher with 192-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_256_KW, /**< AES cipher with 256-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_128_KWP, /**< AES cipher with 128-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_192_KWP, /**< AES cipher with 192-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_256_KWP, /**< AES cipher with 256-bit NIST KWP mode. */ +} mbedtls_cipher_type_t; + +/** Supported cipher modes. */ +typedef enum { + MBEDTLS_MODE_NONE = 0, /**< None. */ + MBEDTLS_MODE_ECB, /**< The ECB cipher mode. */ + MBEDTLS_MODE_CBC, /**< The CBC cipher mode. */ + MBEDTLS_MODE_CFB, /**< The CFB cipher mode. */ + MBEDTLS_MODE_OFB, /**< The OFB cipher mode. */ + MBEDTLS_MODE_CTR, /**< The CTR cipher mode. */ + MBEDTLS_MODE_GCM, /**< The GCM cipher mode. */ + MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */ + MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */ + MBEDTLS_MODE_CCM_STAR_NO_TAG, /**< The CCM*-no-tag cipher mode. */ + MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */ + MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */ + MBEDTLS_MODE_KW, /**< The SP800-38F KW mode */ + MBEDTLS_MODE_KWP, /**< The SP800-38F KWP mode */ +} mbedtls_cipher_mode_t; + +/** Supported cipher padding types. */ +typedef enum { + MBEDTLS_PADDING_PKCS7 = 0, /**< PKCS7 padding (default). */ + MBEDTLS_PADDING_ONE_AND_ZEROS, /**< ISO/IEC 7816-4 padding. */ + MBEDTLS_PADDING_ZEROS_AND_LEN, /**< ANSI X.923 padding. */ + MBEDTLS_PADDING_ZEROS, /**< Zero padding (not reversible). */ + MBEDTLS_PADDING_NONE, /**< Never pad (full blocks only). */ +} mbedtls_cipher_padding_t; + +/** Type of operation. */ +typedef enum { + MBEDTLS_OPERATION_NONE = -1, + MBEDTLS_DECRYPT = 0, + MBEDTLS_ENCRYPT, +} mbedtls_operation_t; + +enum { + /** Undefined key length. */ + MBEDTLS_KEY_LENGTH_NONE = 0, + /** Key length, in bits (including parity), for DES keys. \warning DES is considered weak. */ + MBEDTLS_KEY_LENGTH_DES = 64, + /** Key length in bits, including parity, for DES in two-key EDE. \warning 3DES is considered weak. */ + MBEDTLS_KEY_LENGTH_DES_EDE = 128, + /** Key length in bits, including parity, for DES in three-key EDE. \warning 3DES is considered weak. */ + MBEDTLS_KEY_LENGTH_DES_EDE3 = 192, +}; + +/** Maximum length of any IV, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_IV_LENGTH defined + * in library/ssl_misc.h. */ +#define MBEDTLS_MAX_IV_LENGTH 16 + +/** Maximum block size of any cipher, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in library/ssl_misc.h. */ +#define MBEDTLS_MAX_BLOCK_LENGTH 16 + +/** Maximum key length, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * For now, only check whether XTS is enabled which uses 64 Byte keys, + * and use 32 Bytes as an upper bound for the maximum key length otherwise. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in library/ssl_misc.h, which however deliberately ignores the case of XTS + * since the latter isn't used in SSL/TLS. */ +#if defined(MBEDTLS_CIPHER_MODE_XTS) +#define MBEDTLS_MAX_KEY_LENGTH 64 +#else +#define MBEDTLS_MAX_KEY_LENGTH 32 +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * Base cipher information (opaque struct). + */ +typedef struct mbedtls_cipher_base_t mbedtls_cipher_base_t; + +/** + * CMAC context (opaque struct). + */ +typedef struct mbedtls_cmac_context_t mbedtls_cmac_context_t; + +/** + * Cipher information. Allows calling cipher functions + * in a generic way. + * + * \note The library does not support custom cipher info structures, + * only built-in structures returned by the functions + * mbedtls_cipher_info_from_string(), + * mbedtls_cipher_info_from_type(), + * mbedtls_cipher_info_from_values(), + * mbedtls_cipher_info_from_psa(). + * + * \note Some fields store a value that has been right-shifted to save + * code-size, so should not be used directly. The accessor + * functions adjust for this and return the "natural" value. + */ +typedef struct mbedtls_cipher_info_t { + /** Name of the cipher. */ + const char *MBEDTLS_PRIVATE(name); + + /** The block size, in bytes. */ + unsigned int MBEDTLS_PRIVATE(block_size) : 5; + + /** IV or nonce size, in bytes (right shifted by #MBEDTLS_IV_SIZE_SHIFT). + * For ciphers that accept variable IV sizes, + * this is the recommended size. + */ + unsigned int MBEDTLS_PRIVATE(iv_size) : 3; + + /** The cipher key length, in bits (right shifted by #MBEDTLS_KEY_BITLEN_SHIFT). + * This is the default length for variable sized ciphers. + * Includes parity bits for ciphers like DES. + */ + unsigned int MBEDTLS_PRIVATE(key_bitlen) : 4; + + /** The cipher mode (as per mbedtls_cipher_mode_t). + * For example, MBEDTLS_MODE_CBC. + */ + unsigned int MBEDTLS_PRIVATE(mode) : 4; + + /** Full cipher identifier (as per mbedtls_cipher_type_t). + * For example, MBEDTLS_CIPHER_AES_256_CBC. + * + * This could be 7 bits, but 8 bits retains byte alignment for the + * next field, which reduces code size to access that field. + */ + unsigned int MBEDTLS_PRIVATE(type) : 8; + + /** Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and + * MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the + * cipher supports variable IV or variable key sizes, respectively. + */ + unsigned int MBEDTLS_PRIVATE(flags) : 2; + + /** Index to LUT for base cipher information and functions. */ + unsigned int MBEDTLS_PRIVATE(base_idx) : 5; + +} mbedtls_cipher_info_t; + +/* For internal use only. + * These are used to more compactly represent the fields above. */ +#define MBEDTLS_KEY_BITLEN_SHIFT 6 +#define MBEDTLS_IV_SIZE_SHIFT 2 +/** + * Generic cipher context. + */ +typedef struct mbedtls_cipher_context_t { + /** Information about the associated cipher. */ + const mbedtls_cipher_info_t *MBEDTLS_PRIVATE(cipher_info); + + /** Key length to use. */ + int MBEDTLS_PRIVATE(key_bitlen); + + /** Operation that the key of the context has been + * initialized for. + */ + mbedtls_operation_t MBEDTLS_PRIVATE(operation); + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) + /** Padding functions to use, if relevant for + * the specific cipher mode. + */ + void(*MBEDTLS_PRIVATE(add_padding))(unsigned char *output, size_t olen, + size_t data_len); + /* Report invalid-padding condition through the output parameter + * invalid_padding. To minimize changes in Mbed TLS 3.6, where this + * declaration is in a public header, use the public type size_t + * rather than the internal type mbedtls_ct_condition_t. */ + int(*MBEDTLS_PRIVATE(get_padding))(unsigned char *input, size_t ilen, + size_t *data_len, + size_t *invalid_padding); +#endif + + /** Buffer for input that has not been processed yet. */ + unsigned char MBEDTLS_PRIVATE(unprocessed_data)[MBEDTLS_MAX_BLOCK_LENGTH]; + + /** Number of Bytes that have not been processed yet. */ + size_t MBEDTLS_PRIVATE(unprocessed_len); + + /** Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + * for XTS-mode. */ + unsigned char MBEDTLS_PRIVATE(iv)[MBEDTLS_MAX_IV_LENGTH]; + + /** IV size in Bytes, for ciphers with variable-length IVs. */ + size_t MBEDTLS_PRIVATE(iv_size); + + /** The cipher-specific context. */ + void *MBEDTLS_PRIVATE(cipher_ctx); + +#if defined(MBEDTLS_CMAC_C) + /** CMAC-specific context. */ + mbedtls_cmac_context_t *MBEDTLS_PRIVATE(cmac_ctx); +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_DEPRECATED_REMOVED) + /** Indicates whether the cipher operations should be performed + * by Mbed TLS' own crypto library or an external implementation + * of the PSA Crypto API. + * This is unset if the cipher context was established through + * mbedtls_cipher_setup(), and set if it was established through + * mbedtls_cipher_setup_psa(). + */ + unsigned char MBEDTLS_PRIVATE(psa_enabled); +#endif /* MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_DEPRECATED_REMOVED */ + +} mbedtls_cipher_context_t; + +/** + * \brief This function retrieves the list of ciphers supported + * by the generic cipher module. + * + * For any cipher identifier in the returned list, you can + * obtain the corresponding generic cipher information structure + * via mbedtls_cipher_info_from_type(), which can then be used + * to prepare a cipher context via mbedtls_cipher_setup(). + * + * + * \return A statically-allocated array of cipher identifiers + * of type cipher_type_t. The last entry is zero. + */ +const int *mbedtls_cipher_list(void); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher name. + * + * \param cipher_name Name of the cipher to search for. This must not be + * \c NULL. + * + * \return The cipher information structure associated with the + * given \p cipher_name. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string(const char *cipher_name); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher type. + * + * \param cipher_type Type of the cipher to search for. + * + * \return The cipher information structure associated with the + * given \p cipher_type. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type(const mbedtls_cipher_type_t cipher_type); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher ID, + * key size and mode. + * + * \param cipher_id The ID of the cipher to search for. For example, + * #MBEDTLS_CIPHER_ID_AES. + * \param key_bitlen The length of the key in bits. + * \param mode The cipher mode. For example, #MBEDTLS_MODE_CBC. + * + * \return The cipher information structure associated with the + * given \p cipher_id. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values(const mbedtls_cipher_id_t cipher_id, + int key_bitlen, + const mbedtls_cipher_mode_t mode); + +/** + * \brief Retrieve the identifier for a cipher info structure. + * + * \param[in] info The cipher info structure to query. + * This may be \c NULL. + * + * \return The full cipher identifier (\c MBEDTLS_CIPHER_xxx). + * \return #MBEDTLS_CIPHER_NONE if \p info is \c NULL. + */ +static inline mbedtls_cipher_type_t mbedtls_cipher_info_get_type( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return MBEDTLS_CIPHER_NONE; + } else { + return (mbedtls_cipher_type_t) info->MBEDTLS_PRIVATE(type); + } +} + +/** + * \brief Retrieve the operation mode for a cipher info structure. + * + * \param[in] info The cipher info structure to query. + * This may be \c NULL. + * + * \return The cipher mode (\c MBEDTLS_MODE_xxx). + * \return #MBEDTLS_MODE_NONE if \p info is \c NULL. + */ +static inline mbedtls_cipher_mode_t mbedtls_cipher_info_get_mode( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return MBEDTLS_MODE_NONE; + } else { + return (mbedtls_cipher_mode_t) info->MBEDTLS_PRIVATE(mode); + } +} + +/** + * \brief Retrieve the key size for a cipher info structure. + * + * \param[in] info The cipher info structure to query. + * This may be \c NULL. + * + * \return The key length in bits. + * For variable-sized ciphers, this is the default length. + * For DES, this includes the parity bits. + * \return \c 0 if \p info is \c NULL. + */ +static inline size_t mbedtls_cipher_info_get_key_bitlen( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return 0; + } else { + return ((size_t) info->MBEDTLS_PRIVATE(key_bitlen)) << MBEDTLS_KEY_BITLEN_SHIFT; + } +} + +/** + * \brief Retrieve the human-readable name for a + * cipher info structure. + * + * \param[in] info The cipher info structure to query. + * This may be \c NULL. + * + * \return The cipher name, which is a human readable string, + * with static storage duration. + * \return \c NULL if \p info is \c NULL. + */ +static inline const char *mbedtls_cipher_info_get_name( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return NULL; + } else { + return info->MBEDTLS_PRIVATE(name); + } +} + +/** + * \brief This function returns the size of the IV or nonce + * for the cipher info structure, in bytes. + * + * \param info The cipher info structure. This may be \c NULL. + * + * \return The recommended IV size. + * \return \c 0 for ciphers not using an IV or a nonce. + * \return \c 0 if \p info is \c NULL. + */ +static inline size_t mbedtls_cipher_info_get_iv_size( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return 0; + } + + return ((size_t) info->MBEDTLS_PRIVATE(iv_size)) << MBEDTLS_IV_SIZE_SHIFT; +} + +/** + * \brief This function returns the block size of the given + * cipher info structure in bytes. + * + * \param info The cipher info structure. This may be \c NULL. + * + * \return The block size of the cipher. + * \return \c 1 if the cipher is a stream cipher. + * \return \c 0 if \p info is \c NULL. + */ +static inline size_t mbedtls_cipher_info_get_block_size( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return 0; + } + + return (size_t) (info->MBEDTLS_PRIVATE(block_size)); +} + +/** + * \brief This function returns a non-zero value if the key length for + * the given cipher is variable. + * + * \param info The cipher info structure. This may be \c NULL. + * + * \return Non-zero if the key length is variable, \c 0 otherwise. + * \return \c 0 if the given pointer is \c NULL. + */ +static inline int mbedtls_cipher_info_has_variable_key_bitlen( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return 0; + } + + return info->MBEDTLS_PRIVATE(flags) & MBEDTLS_CIPHER_VARIABLE_KEY_LEN; +} + +/** + * \brief This function returns a non-zero value if the IV size for + * the given cipher is variable. + * + * \param info The cipher info structure. This may be \c NULL. + * + * \return Non-zero if the IV size is variable, \c 0 otherwise. + * \return \c 0 if the given pointer is \c NULL. + */ +static inline int mbedtls_cipher_info_has_variable_iv_size( + const mbedtls_cipher_info_t *info) +{ + if (info == NULL) { + return 0; + } + + return info->MBEDTLS_PRIVATE(flags) & MBEDTLS_CIPHER_VARIABLE_IV_LEN; +} + +/** + * \brief This function initializes a \p ctx as NONE. + * + * \param ctx The context to be initialized. This must not be \c NULL. + */ +void mbedtls_cipher_init(mbedtls_cipher_context_t *ctx); + +/** + * \brief This function frees and clears the cipher-specific + * context of \p ctx. Freeing \p ctx itself remains the + * responsibility of the caller. + * + * \param ctx The context to be freed. If this is \c NULL, the + * function has no effect, otherwise this must point to an + * initialized context. + */ +void mbedtls_cipher_free(mbedtls_cipher_context_t *ctx); + + +/** + * \brief This function prepares a cipher context for + * use with the given cipher primitive. + * + * \note After calling this function, you should call + * mbedtls_cipher_setkey() and, if the mode uses padding, + * mbedtls_cipher_set_padding_mode(), then for each + * message to encrypt or decrypt with this key, either: + * - mbedtls_cipher_crypt() for one-shot processing with + * non-AEAD modes; + * - mbedtls_cipher_auth_encrypt_ext() or + * mbedtls_cipher_auth_decrypt_ext() for one-shot + * processing with AEAD modes or NIST_KW; + * - for multi-part processing, see the documentation of + * mbedtls_cipher_reset(). + * + * \param ctx The context to prepare. This must be initialized by + * a call to mbedtls_cipher_init() first. + * \param cipher_info The cipher to use. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + */ +int mbedtls_cipher_setup(mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief This function initializes a cipher context for + * PSA-based use with the given cipher primitive. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * Please use psa_aead_xxx() / psa_cipher_xxx() directly + * instead. + * + * \note See #MBEDTLS_USE_PSA_CRYPTO for information on PSA. + * + * \param ctx The context to initialize. May not be \c NULL. + * \param cipher_info The cipher to use. + * \param taglen For AEAD ciphers, the length in bytes of the + * authentication tag to use. Subsequent uses of + * mbedtls_cipher_auth_encrypt_ext() or + * mbedtls_cipher_auth_decrypt_ext() must provide + * the same tag length. + * For non-AEAD ciphers, the value must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + */ +int MBEDTLS_DEPRECATED mbedtls_cipher_setup_psa(mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info, + size_t taglen); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief This function returns the block size of the given cipher + * in bytes. + * + * \param ctx The context of the cipher. + * + * \return The block size of the underlying cipher. + * \return \c 1 if the cipher is a stream cipher. + * \return \c 0 if \p ctx has not been initialized. + */ +static inline unsigned int mbedtls_cipher_get_block_size( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return 0; + } + + return (unsigned int) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(block_size); +} + +/** + * \brief This function returns the mode of operation for + * the cipher. For example, MBEDTLS_MODE_CBC. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The mode of operation. + * \return #MBEDTLS_MODE_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_mode_t mbedtls_cipher_get_cipher_mode( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return MBEDTLS_MODE_NONE; + } + + return (mbedtls_cipher_mode_t) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(mode); +} + +/** + * \brief This function returns the size of the IV or nonce + * of the cipher, in Bytes. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The recommended IV size if no IV has been set. + * \return \c 0 for ciphers not using an IV or a nonce. + * \return The actual size if an IV has been set. + */ +static inline int mbedtls_cipher_get_iv_size( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return 0; + } + + if (ctx->MBEDTLS_PRIVATE(iv_size) != 0) { + return (int) ctx->MBEDTLS_PRIVATE(iv_size); + } + + return (int) (((int) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(iv_size)) << + MBEDTLS_IV_SIZE_SHIFT); +} + +/** + * \brief This function returns the type of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of the cipher. + * \return #MBEDTLS_CIPHER_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_type_t mbedtls_cipher_get_type( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return MBEDTLS_CIPHER_NONE; + } + + return (mbedtls_cipher_type_t) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(type); +} + +/** + * \brief This function returns the name of the given cipher + * as a string. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The name of the cipher. + * \return NULL if \p ctx has not been not initialized. + */ +static inline const char *mbedtls_cipher_get_name( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return 0; + } + + return ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(name); +} + +/** + * \brief This function returns the key length of the cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The key length of the cipher in bits. + * \return #MBEDTLS_KEY_LENGTH_NONE if \p ctx has not been + * initialized. + */ +static inline int mbedtls_cipher_get_key_bitlen( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return MBEDTLS_KEY_LENGTH_NONE; + } + + return (int) ctx->MBEDTLS_PRIVATE(cipher_info)->MBEDTLS_PRIVATE(key_bitlen) << + MBEDTLS_KEY_BITLEN_SHIFT; +} + +/** + * \brief This function returns the operation of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of operation: #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * \return #MBEDTLS_OPERATION_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_operation_t mbedtls_cipher_get_operation( + const mbedtls_cipher_context_t *ctx) +{ + if (ctx->MBEDTLS_PRIVATE(cipher_info) == NULL) { + return MBEDTLS_OPERATION_NONE; + } + + return ctx->MBEDTLS_PRIVATE(operation); +} + +/** + * \brief This function sets the key to use with the given context. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param key The key to use. This must be a readable buffer of at + * least \p key_bitlen Bits. + * \param key_bitlen The key length to use, in Bits. + * \param operation The operation that the key will be used for: + * #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_setkey(mbedtls_cipher_context_t *ctx, + const unsigned char *key, + int key_bitlen, + const mbedtls_operation_t operation); + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) +/** + * \brief This function sets the padding mode, for cipher modes + * that use padding. + * + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param mode The padding mode. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE + * if the selected padding mode is not supported. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA if the cipher mode + * does not support padding. + */ +int mbedtls_cipher_set_padding_mode(mbedtls_cipher_context_t *ctx, + mbedtls_cipher_padding_t mode); +#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ + +/** + * \brief This function sets the initialization vector (IV) + * or nonce. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, this function has no effect. + * + * \note For #MBEDTLS_CIPHER_CHACHA20, the nonce length must + * be 12, and the initial counter value is 0. + * + * \note For #MBEDTLS_CIPHER_CHACHA20_POLY1305, the nonce length + * must be 12. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. This + * must be a readable buffer of at least \p iv_len Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size IV. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_set_iv(mbedtls_cipher_context_t *ctx, + const unsigned char *iv, + size_t iv_len); + +/** + * \brief This function resets the cipher state. + * + * \note With non-AEAD ciphers, the order of calls for each message + * is as follows: + * 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + * 2. mbedtls_cipher_reset(); + * 3. mbedtls_cipher_update() zero, one or more times; + * 4. mbedtls_cipher_finish_padded() (recommended for decryption + * if the mode uses padding) or mbedtls_cipher_finish(). + * . + * This sequence can be repeated to encrypt or decrypt multiple + * messages with the same key. + * + * \note With AEAD ciphers, the order of calls for each message + * is as follows: + * 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + * 2. mbedtls_cipher_reset(); + * 3. mbedtls_cipher_update_ad(); + * 4. mbedtls_cipher_update() zero, one or more times; + * 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); + * 6. mbedtls_cipher_check_tag() (for decryption) or + * mbedtls_cipher_write_tag() (for encryption). + * . + * This sequence can be repeated to encrypt or decrypt multiple + * messages with the same key. + * + * \param ctx The generic cipher context. This must be bound to a key. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_reset(mbedtls_cipher_context_t *ctx); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function adds additional data for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * + * \param ctx The generic cipher context. This must be initialized. + * \param ad The additional data to use. This must be a readable + * buffer of at least \p ad_len Bytes. + * \param ad_len The length of \p ad in Bytes. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_update_ad(mbedtls_cipher_context_t *ctx, + const unsigned char *ad, size_t ad_len); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic cipher update function. It encrypts or + * decrypts using the given cipher context. Writes as + * many block-sized blocks of data as possible to output. + * Any data that cannot be written immediately is either + * added to the next block, or flushed when + * mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + * is called. + * Exception: For MBEDTLS_MODE_ECB, expects a single block + * in size. For example, 16 Bytes for AES. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE on an + * unsupported mode for a cipher. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_update(mbedtls_cipher_context_t *ctx, + const unsigned char *input, + size_t ilen, unsigned char *output, + size_t *olen); + +/** + * \brief The generic cipher finalization function. If data still + * needs to be flushed from an incomplete block, the data + * contained in it is padded to the size of + * the last block, and written to the \p output buffer. + * + * \warning This function reports invalid padding through an error + * code. Adversaries may be able to decrypt encrypted + * data if they can submit chosen ciphertexts and + * detect whether it has valid padding or not, + * either through direct observation or through a side + * channel such as timing. This is known as a + * padding oracle attack. + * Therefore applications that call this function for + * decryption with a cipher that involves padding + * should take care around error handling. Preferably, + * such applications should use + * mbedtls_cipher_finish_padded() instead of this function. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param output The buffer to write data to. This needs to be a writable + * buffer of at least block_size Bytes. + * \param olen The length of the data written to the \p output buffer. + * This may not be \c NULL. + * Note that when decrypting in a mode with padding, + * the actual output length is sensitive and may be + * used to mount a padding oracle attack (see warning + * above), although less efficiently than through + * the invalid-padding condition. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. Note that invalid-padding errors + * should be handled carefully; see the warning above. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_finish(mbedtls_cipher_context_t *ctx, + unsigned char *output, size_t *olen); + +/** + * \brief The generic cipher finalization function. If data still + * needs to be flushed from an incomplete block, the data + * contained in it is padded to the size of + * the last block, and written to the \p output buffer. + * + * \note This function is similar to mbedtls_cipher_finish(). + * The only difference is that it reports invalid padding + * decryption differently, through the \p invalid_padding + * parameter rather than an error code. + * For encryption, and in modes without padding (including + * all authenticated modes), this function is identical + * to mbedtls_cipher_finish(). + * + * \param[in,out] ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param[out] output The buffer to write data to. This needs to be a writable + * buffer of at least block_size Bytes. + * \param[out] olen The length of the data written to the \p output buffer. + * This may not be \c NULL. + * Note that when decrypting in a mode with padding, + * the actual output length is sensitive and may be + * used to mount a padding oracle attack (see warning + * on mbedtls_cipher_finish()). + * \param[out] invalid_padding + * If this function returns \c 0 on decryption, + * \p *invalid_padding is \c 0 if the ciphertext was + * valid, and all-bits-one if the ciphertext had invalid + * padding. + * On encryption, or in a mode without padding (including + * all authenticated modes), \p *invalid_padding is \c 0 + * on success. + * The value in \p *invalid_padding is unspecified if + * this function returns a nonzero status. + * + * \return \c 0 on success. + * Also \c 0 for decryption with invalid padding. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_finish_padded(mbedtls_cipher_context_t *ctx, + unsigned char *output, size_t *olen, + size_t *invalid_padding); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function writes a tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish() + * or mbedtls_cipher_finish_padded(). + * + * \param ctx The generic cipher context. This must be initialized, + * bound to a key, and have just completed a cipher + * operation through mbedtls_cipher_finish() the tag for + * which should be written. + * \param tag The buffer to write the tag to. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to write. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_write_tag(mbedtls_cipher_context_t *ctx, + unsigned char *tag, size_t tag_len); + +/** + * \brief This function checks the tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish() + * or mbedtls_cipher_finish_padded(). + * + * \param ctx The generic cipher context. This must be initialized. + * \param tag The buffer holding the tag. This must be a readable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to check. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_check_tag(mbedtls_cipher_context_t *ctx, + const unsigned char *tag, size_t tag_len); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic all-in-one encryption/decryption function, + * for all ciphers except AEAD constructs. + * + * \param ctx The generic cipher context. This must be initialized. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. + * This must be a readable buffer of at least \p iv_len + * Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size + * IV. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, use \p iv = NULL and \p iv_len = 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_crypt(mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen); + +#if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C) +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note For AEAD modes, the tag will be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * must not be \c NULL. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen + \p tag_len. + * For NIST_KW, this must be at least \p ilen + 8 + * (rounded up to a multiple of 8 if KWP is used); + * \p ilen + 15 is always a safe value. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The desired length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_encrypt_ext(mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len); + +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note If the data is not authentic, then the output buffer + * is zeroed out to prevent the unauthentic plaintext being + * used, making this interface safer. + * + * \note For AEAD modes, the tag must be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. For AEAD ciphers this + * must be at least \p tag_len. For NIST_KW this must be + * at least \c 8. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * may be \c NULL if \p output_len is \c 0. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen - \p tag_len. + * For NIST_KW, this must be at least \p ilen - 8. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The actual length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_decrypt_ext(mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len); +#endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */ +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CIPHER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cmac.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cmac.h new file mode 100644 index 00000000..97b86fc4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/cmac.h @@ -0,0 +1,246 @@ +/** + * \file cmac.h + * + * \brief This file contains CMAC definitions and functions. + * + * The Cipher-based Message Authentication Code (CMAC) Mode for + * Authentication is defined in RFC-4493: The AES-CMAC Algorithm. + * It is supported with AES and DES. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CMAC_H +#define MBEDTLS_CMAC_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +#define MBEDTLS_AES_BLOCK_SIZE 16 +#define MBEDTLS_DES3_BLOCK_SIZE 8 + +/* We don't support Camellia or ARIA in this module */ +#if defined(MBEDTLS_AES_C) +#define MBEDTLS_CMAC_MAX_BLOCK_SIZE 16 /**< The longest block used by CMAC is that of AES. */ +#else +#define MBEDTLS_CMAC_MAX_BLOCK_SIZE 8 /**< The longest block used by CMAC is that of 3DES. */ +#endif + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** The longest block supported by the cipher module. + * + * \deprecated + * For the maximum block size of a cipher supported by the CMAC module, + * use #MBEDTLS_CMAC_MAX_BLOCK_SIZE. + * For the maximum block size of a cipher supported by the cipher module, + * use #MBEDTLS_MAX_BLOCK_LENGTH. + */ +/* Before Mbed TLS 3.5, this was the maximum block size supported by the CMAC + * module, so it didn't take Camellia or ARIA into account. Since the name + * of the macro doesn't even convey "CMAC", this was misleading. Now the size + * is sufficient for any cipher, but the name is defined in cmac.h for + * backward compatibility. */ +#define MBEDTLS_CIPHER_BLKSIZE_MAX MBEDTLS_MAX_BLOCK_LENGTH +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#if !defined(MBEDTLS_CMAC_ALT) + +/** + * The CMAC context structure. + */ +struct mbedtls_cmac_context_t { + /** The internal state of the CMAC algorithm. */ + unsigned char MBEDTLS_PRIVATE(state)[MBEDTLS_CMAC_MAX_BLOCK_SIZE]; + + /** Unprocessed data - either data that was not block aligned and is still + * pending processing, or the final block. */ + unsigned char MBEDTLS_PRIVATE(unprocessed_block)[MBEDTLS_CMAC_MAX_BLOCK_SIZE]; + + /** The length of data pending processing. */ + size_t MBEDTLS_PRIVATE(unprocessed_len); +}; + +#else /* !MBEDTLS_CMAC_ALT */ +#include "cmac_alt.h" +#endif /* !MBEDTLS_CMAC_ALT */ + +/** + * \brief This function starts a new CMAC computation + * by setting the CMAC key, and preparing to authenticate + * the input data. + * It must be called with an initialized cipher context. + * + * Once this function has completed, data can be supplied + * to the CMAC computation by calling + * mbedtls_cipher_cmac_update(). + * + * To start a CMAC computation using the same key as a previous + * CMAC computation, use mbedtls_cipher_cmac_finish(). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param ctx The cipher context used for the CMAC operation, initialized + * as one of the following types: MBEDTLS_CIPHER_AES_128_ECB, + * MBEDTLS_CIPHER_AES_192_ECB, MBEDTLS_CIPHER_AES_256_ECB, + * or MBEDTLS_CIPHER_DES_EDE3_ECB. + * \param key The CMAC key. + * \param keybits The length of the CMAC key in bits. + * Must be supported by the cipher. + * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_cmac_starts(mbedtls_cipher_context_t *ctx, + const unsigned char *key, size_t keybits); + +/** + * \brief This function feeds an input buffer into an ongoing CMAC + * computation. + * + * The CMAC computation must have previously been started + * by calling mbedtls_cipher_cmac_starts() or + * mbedtls_cipher_cmac_reset(). + * + * Call this function as many times as needed to input the + * data to be authenticated. + * Once all of the required data has been input, + * call mbedtls_cipher_cmac_finish() to obtain the result + * of the CMAC operation. + * + * \param ctx The cipher context used for the CMAC operation. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_update(mbedtls_cipher_context_t *ctx, + const unsigned char *input, size_t ilen); + +/** + * \brief This function finishes an ongoing CMAC operation, and + * writes the result to the output buffer. + * + * It should be followed either by + * mbedtls_cipher_cmac_reset(), which starts another CMAC + * operation with the same key, or mbedtls_cipher_free(), + * which clears the cipher context. + * + * \param ctx The cipher context used for the CMAC operation. + * \param output The output buffer for the CMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_finish(mbedtls_cipher_context_t *ctx, + unsigned char *output); + +/** + * \brief This function starts a new CMAC operation with the same + * key as the previous one. + * + * It should be called after finishing the previous CMAC + * operation with mbedtls_cipher_cmac_finish(). + * After calling this function, + * call mbedtls_cipher_cmac_update() to supply the new + * CMAC operation with data. + * + * \param ctx The cipher context used for the CMAC operation. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_reset(mbedtls_cipher_context_t *ctx); + +/** + * \brief This function calculates the full generic CMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The CMAC result is calculated as + * output = generic CMAC(cmac key, input buffer). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param cipher_info The cipher information. + * \param key The CMAC key. + * \param keylen The length of the CMAC key in bits. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The buffer for the generic CMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac(const mbedtls_cipher_info_t *cipher_info, + const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output); + +#if defined(MBEDTLS_AES_C) +/** + * \brief This function implements the AES-CMAC-PRF-128 pseudorandom + * function, as defined in + * RFC-4615: The Advanced Encryption Standard-Cipher-based + * Message Authentication Code-Pseudo-Random Function-128 + * (AES-CMAC-PRF-128) Algorithm for the Internet Key + * Exchange Protocol (IKE). + * + * \param key The key to use. + * \param key_len The key length in Bytes. + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * \param output The buffer holding the generated 16 Bytes of + * pseudorandom output. + * + * \return \c 0 on success. + */ +int mbedtls_aes_cmac_prf_128(const unsigned char *key, size_t key_len, + const unsigned char *input, size_t in_len, + unsigned char output[16]); +#endif /* MBEDTLS_AES_C */ + +#if defined(MBEDTLS_SELF_TEST) && (defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C)) +/** + * \brief The CMAC checkup routine. + * + * \note In case the CMAC routines are provided by an alternative + * implementation (i.e. #MBEDTLS_CMAC_ALT is defined), the + * checkup routine will succeed even if the implementation does + * not support the less widely used AES-192 or 3DES primitives. + * The self-test requires at least AES-128 and AES-256 to be + * supported by the underlying implementation. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_cmac_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST && ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CMAC_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/compat-2.x.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/compat-2.x.h new file mode 100644 index 00000000..096341ba --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/compat-2.x.h @@ -0,0 +1,46 @@ +/** + * \file compat-2.x.h + * + * \brief Compatibility definitions + * + * \deprecated Use the new names directly instead + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Including compat-2.x.h is deprecated" +#endif + +#ifndef MBEDTLS_COMPAT2X_H +#define MBEDTLS_COMPAT2X_H + +/* + * Macros for renamed functions + */ +#define mbedtls_ctr_drbg_update_ret mbedtls_ctr_drbg_update +#define mbedtls_hmac_drbg_update_ret mbedtls_hmac_drbg_update +#define mbedtls_md5_starts_ret mbedtls_md5_starts +#define mbedtls_md5_update_ret mbedtls_md5_update +#define mbedtls_md5_finish_ret mbedtls_md5_finish +#define mbedtls_md5_ret mbedtls_md5 +#define mbedtls_ripemd160_starts_ret mbedtls_ripemd160_starts +#define mbedtls_ripemd160_update_ret mbedtls_ripemd160_update +#define mbedtls_ripemd160_finish_ret mbedtls_ripemd160_finish +#define mbedtls_ripemd160_ret mbedtls_ripemd160 +#define mbedtls_sha1_starts_ret mbedtls_sha1_starts +#define mbedtls_sha1_update_ret mbedtls_sha1_update +#define mbedtls_sha1_finish_ret mbedtls_sha1_finish +#define mbedtls_sha1_ret mbedtls_sha1 +#define mbedtls_sha256_starts_ret mbedtls_sha256_starts +#define mbedtls_sha256_update_ret mbedtls_sha256_update +#define mbedtls_sha256_finish_ret mbedtls_sha256_finish +#define mbedtls_sha256_ret mbedtls_sha256 +#define mbedtls_sha512_starts_ret mbedtls_sha512_starts +#define mbedtls_sha512_update_ret mbedtls_sha512_update +#define mbedtls_sha512_finish_ret mbedtls_sha512_finish +#define mbedtls_sha512_ret mbedtls_sha512 + +#endif /* MBEDTLS_COMPAT2X_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_crypto.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_crypto.h new file mode 100644 index 00000000..db684ad2 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_crypto.h @@ -0,0 +1,578 @@ +/** + * \file mbedtls/config_adjust_legacy_crypto.h + * \brief Adjust legacy configuration configuration + * + * This is an internal header. Do not include it directly. + * + * Automatically enable certain dependencies. Generally, MBEDTLS_xxx + * configurations need to be explicitly enabled by the user: enabling + * MBEDTLS_xxx_A but not MBEDTLS_xxx_B when A requires B results in a + * compilation error. However, we do automatically enable certain options + * in some circumstances. One case is if MBEDTLS_xxx_B is an internal option + * used to identify parts of a module that are used by other module, and we + * don't want to make the symbol MBEDTLS_xxx_B part of the public API. + * Another case is if A didn't depend on B in earlier versions, and we + * want to use B in A but we need to preserve backward compatibility with + * configurations that explicitly activate MBEDTLS_xxx_A but not + * MBEDTLS_xxx_B. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H +#define MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/* Ideally, we'd set those as defaults in mbedtls_config.h, but + * putting an #ifdef _WIN32 in mbedtls_config.h would confuse config.py. + * + * So, adjust it here. + * Not related to crypto, but this is the bottom of the stack. */ +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900) +#if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif +#if !defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +#endif +#endif /* _MINGW32__ || (_MSC_VER && (_MSC_VER <= 1900)) */ + +/* The number of "true" entropy sources (excluding NV seed). + * This must be consistent with mbedtls_entropy_init() in entropy.c. + */ +/* Define auxiliary macros, because in standard C, defined(xxx) is only + * allowed directly on an #if or #elif line, not in recursive expansion. */ +#if defined(MBEDTLS_NO_PLATFORM_ENTROPY) +#define MBEDTLS_PLATFORM_ENTROPY_ENABLED 0 +#else +#define MBEDTLS_PLATFORM_ENTROPY_ENABLED 1 +#endif +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +#define MBEDTLS_ENTROPY_HARDWARE_ALT_DEFINED 1 +#else +#define MBEDTLS_ENTROPY_HARDWARE_ALT_DEFINED 0 +#endif + +#define MBEDTLS_ENTROPY_TRUE_SOURCES ( \ + MBEDTLS_ENTROPY_HARDWARE_ALT_DEFINED + \ + MBEDTLS_PLATFORM_ENTROPY_ENABLED + \ + 0) + +/* Whether there is at least one entropy source for the entropy module. + * + * Note that when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, the entropy + * module is unused and the configuration will typically not include any + * entropy source, so this macro will typically remain undefined. + */ +#if defined(MBEDTLS_ENTROPY_NV_SEED) +#define MBEDTLS_ENTROPY_HAVE_SOURCES (MBEDTLS_ENTROPY_TRUE_SOURCES + 1) +#elif MBEDTLS_ENTROPY_TRUE_SOURCES != 0 +#define MBEDTLS_ENTROPY_HAVE_SOURCES MBEDTLS_ENTROPY_TRUE_SOURCES +#else +#undef MBEDTLS_ENTROPY_HAVE_SOURCES +#endif + +/* Test function dependencies can only check with defined(), + * not other preprocessor expressions. */ +#if MBEDTLS_ENTROPY_TRUE_SOURCES > 0 +#define MBEDTLS_ENTROPY_HAVE_TRUE_SOURCES +#else +#undef MBEDTLS_ENTROPY_HAVE_TRUE_SOURCES +#endif + +/* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT + * is defined as well to include all PSA code. + */ +#if defined(MBEDTLS_PSA_CRYPTO_C) +#define MBEDTLS_PSA_CRYPTO_CLIENT +#endif /* MBEDTLS_PSA_CRYPTO_C */ + +/* Auto-enable CIPHER_C when any of the unauthenticated ciphers is builtin + * in PSA. */ +#if defined(MBEDTLS_PSA_CRYPTO_C) && \ + (defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CTR) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CFB) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_OFB) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)) +#define MBEDTLS_CIPHER_C +#endif + +/* Auto-enable MBEDTLS_MD_LIGHT based on MBEDTLS_MD_C. + * This allows checking for MD_LIGHT rather than MD_LIGHT || MD_C. + */ +#if defined(MBEDTLS_MD_C) +#define MBEDTLS_MD_LIGHT +#endif + +/* Auto-enable MBEDTLS_MD_LIGHT if needed by a module that didn't require it + * in a previous release, to ensure backwards compatibility. + */ +#if defined(MBEDTLS_ECJPAKE_C) || \ + defined(MBEDTLS_PEM_PARSE_C) || \ + defined(MBEDTLS_ENTROPY_C) || \ + defined(MBEDTLS_PK_C) || \ + defined(MBEDTLS_PKCS12_C) || \ + defined(MBEDTLS_RSA_C) || \ + defined(MBEDTLS_SSL_TLS_C) || \ + defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_X509_CREATE_C) +#define MBEDTLS_MD_LIGHT +#endif + +#if defined(MBEDTLS_MD_LIGHT) +/* + * - MBEDTLS_MD_CAN_xxx is defined if the md module can perform xxx. + * - MBEDTLS_MD_xxx_VIA_PSA is defined if the md module may perform xxx via PSA + * (see below). + * - MBEDTLS_MD_SOME_PSA is defined if at least one algorithm may be performed + * via PSA (see below). + * - MBEDTLS_MD_SOME_LEGACY is defined if at least one algorithm may be performed + * via a direct legacy call (see below). + * + * The md module performs an algorithm via PSA if there is a PSA hash + * accelerator and the PSA driver subsytem is initialized at the time the + * operation is started, and makes a direct legacy call otherwise. + */ + +/* PSA accelerated implementations */ +#if defined(MBEDTLS_PSA_CRYPTO_C) + +#if defined(MBEDTLS_PSA_ACCEL_ALG_MD5) +#define MBEDTLS_MD_CAN_MD5 +#define MBEDTLS_MD_MD5_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1) +#define MBEDTLS_MD_CAN_SHA1 +#define MBEDTLS_MD_SHA1_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224) +#define MBEDTLS_MD_CAN_SHA224 +#define MBEDTLS_MD_SHA224_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256) +#define MBEDTLS_MD_CAN_SHA256 +#define MBEDTLS_MD_SHA256_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384) +#define MBEDTLS_MD_CAN_SHA384 +#define MBEDTLS_MD_SHA384_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512) +#define MBEDTLS_MD_CAN_SHA512 +#define MBEDTLS_MD_SHA512_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160) +#define MBEDTLS_MD_CAN_RIPEMD160 +#define MBEDTLS_MD_RIPEMD160_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_224) +#define MBEDTLS_MD_CAN_SHA3_224 +#define MBEDTLS_MD_SHA3_224_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_256) +#define MBEDTLS_MD_CAN_SHA3_256 +#define MBEDTLS_MD_SHA3_256_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_384) +#define MBEDTLS_MD_CAN_SHA3_384 +#define MBEDTLS_MD_SHA3_384_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_512) +#define MBEDTLS_MD_CAN_SHA3_512 +#define MBEDTLS_MD_SHA3_512_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif + +#elif defined(MBEDTLS_PSA_CRYPTO_CLIENT) + +#if defined(PSA_WANT_ALG_MD5) +#define MBEDTLS_MD_CAN_MD5 +#define MBEDTLS_MD_MD5_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA_1) +#define MBEDTLS_MD_CAN_SHA1 +#define MBEDTLS_MD_SHA1_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA_224) +#define MBEDTLS_MD_CAN_SHA224 +#define MBEDTLS_MD_SHA224_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA_256) +#define MBEDTLS_MD_CAN_SHA256 +#define MBEDTLS_MD_SHA256_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA_384) +#define MBEDTLS_MD_CAN_SHA384 +#define MBEDTLS_MD_SHA384_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA_512) +#define MBEDTLS_MD_CAN_SHA512 +#define MBEDTLS_MD_SHA512_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_RIPEMD160) +#define MBEDTLS_MD_CAN_RIPEMD160 +#define MBEDTLS_MD_RIPEMD160_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA3_224) +#define MBEDTLS_MD_CAN_SHA3_224 +#define MBEDTLS_MD_SHA3_224_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA3_256) +#define MBEDTLS_MD_CAN_SHA3_256 +#define MBEDTLS_MD_SHA3_256_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA3_384) +#define MBEDTLS_MD_CAN_SHA3_384 +#define MBEDTLS_MD_SHA3_384_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif +#if defined(PSA_WANT_ALG_SHA3_512) +#define MBEDTLS_MD_CAN_SHA3_512 +#define MBEDTLS_MD_SHA3_512_VIA_PSA +#define MBEDTLS_MD_SOME_PSA +#endif + +#endif /* !MBEDTLS_PSA_CRYPTO_CLIENT && !MBEDTLS_PSA_CRYPTO_C */ + +/* Built-in implementations */ +#if defined(MBEDTLS_MD5_C) +#define MBEDTLS_MD_CAN_MD5 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA1_C) +#define MBEDTLS_MD_CAN_SHA1 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA224_C) +#define MBEDTLS_MD_CAN_SHA224 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_MD_CAN_SHA256 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA384_C) +#define MBEDTLS_MD_CAN_SHA384 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_MD_CAN_SHA512 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_SHA3_C) +#define MBEDTLS_MD_CAN_SHA3_224 +#define MBEDTLS_MD_CAN_SHA3_256 +#define MBEDTLS_MD_CAN_SHA3_384 +#define MBEDTLS_MD_CAN_SHA3_512 +#define MBEDTLS_MD_SOME_LEGACY +#endif +#if defined(MBEDTLS_RIPEMD160_C) +#define MBEDTLS_MD_CAN_RIPEMD160 +#define MBEDTLS_MD_SOME_LEGACY +#endif + +#endif /* MBEDTLS_MD_LIGHT */ + +/* BLOCK_CIPHER module can dispatch to PSA when: + * - PSA is enabled and drivers have been initialized + * - desired key type is supported on the PSA side + * If the above conditions are not met, but the legacy support is enabled, then + * BLOCK_CIPHER will dynamically fallback to it. + * + * In case BLOCK_CIPHER is defined (see below) the following symbols/helpers + * can be used to define its capabilities: + * - MBEDTLS_BLOCK_CIPHER_SOME_PSA: there is at least 1 key type between AES, + * ARIA and Camellia which is supported through a driver; + * - MBEDTLS_BLOCK_CIPHER_xxx_VIA_PSA: xxx key type is supported through a + * driver; + * - MBEDTLS_BLOCK_CIPHER_xxx_VIA_LEGACY: xxx key type is supported through + * a legacy module (i.e. MBEDTLS_xxx_C) + */ +#if defined(MBEDTLS_PSA_CRYPTO_C) +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) +#define MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA +#define MBEDTLS_BLOCK_CIPHER_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA) +#define MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA +#define MBEDTLS_BLOCK_CIPHER_SOME_PSA +#endif +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA) +#define MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA +#define MBEDTLS_BLOCK_CIPHER_SOME_PSA +#endif +#endif /* MBEDTLS_PSA_CRYPTO_C */ + +#if defined(MBEDTLS_AES_C) +#define MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY +#endif +#if defined(MBEDTLS_ARIA_C) +#define MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY +#endif +#if defined(MBEDTLS_CAMELLIA_C) +#define MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY +#endif + +/* Helpers to state that BLOCK_CIPHER module supports AES, ARIA and/or Camellia + * block ciphers via either PSA or legacy. */ +#if defined(MBEDTLS_BLOCK_CIPHER_AES_VIA_PSA) || \ + defined(MBEDTLS_BLOCK_CIPHER_AES_VIA_LEGACY) +#define MBEDTLS_BLOCK_CIPHER_CAN_AES +#endif +#if defined(MBEDTLS_BLOCK_CIPHER_ARIA_VIA_PSA) || \ + defined(MBEDTLS_BLOCK_CIPHER_ARIA_VIA_LEGACY) +#define MBEDTLS_BLOCK_CIPHER_CAN_ARIA +#endif +#if defined(MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_PSA) || \ + defined(MBEDTLS_BLOCK_CIPHER_CAMELLIA_VIA_LEGACY) +#define MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA +#endif + +/* GCM_C and CCM_C can either depend on (in order of preference) BLOCK_CIPHER_C + * or CIPHER_C. The former is auto-enabled when: + * - CIPHER_C is not defined, which is also the legacy solution; + * - BLOCK_CIPHER_SOME_PSA because in this case BLOCK_CIPHER can take advantage + * of the driver's acceleration. + */ +#if (defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)) && \ + (!defined(MBEDTLS_CIPHER_C) || defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA)) +#define MBEDTLS_BLOCK_CIPHER_C +#endif + +/* Helpers for GCM/CCM capabilities */ +#if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_AES_C)) || \ + (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_AES)) +#define MBEDTLS_CCM_GCM_CAN_AES +#endif + +#if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_ARIA_C)) || \ + (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_ARIA)) +#define MBEDTLS_CCM_GCM_CAN_ARIA +#endif + +#if (defined(MBEDTLS_CIPHER_C) && defined(MBEDTLS_CAMELLIA_C)) || \ + (defined(MBEDTLS_BLOCK_CIPHER_C) && defined(MBEDTLS_BLOCK_CIPHER_CAN_CAMELLIA)) +#define MBEDTLS_CCM_GCM_CAN_CAMELLIA +#endif + +/* MBEDTLS_ECP_LIGHT is auto-enabled by the following symbols: + * - MBEDTLS_ECP_C because now it consists of MBEDTLS_ECP_LIGHT plus functions + * for curve arithmetic. As a consequence if MBEDTLS_ECP_C is required for + * some reason, then MBEDTLS_ECP_LIGHT should be enabled as well. + * - MBEDTLS_PK_PARSE_EC_EXTENDED and MBEDTLS_PK_PARSE_EC_COMPRESSED because + * these features are not supported in PSA so the only way to have them is + * to enable the built-in solution. + * Both of them are temporary dependencies: + * - PK_PARSE_EC_EXTENDED will be removed after #7779 and #7789 + * - support for compressed points should also be added to PSA, but in this + * case there is no associated issue to track it yet. + * - PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE because Weierstrass key derivation + * still depends on ECP_LIGHT. + * - PK_C + USE_PSA + PSA_WANT_ALG_ECDSA is a temporary dependency which will + * be fixed by #7453. + */ +#if defined(MBEDTLS_ECP_C) || \ + defined(MBEDTLS_PK_PARSE_EC_EXTENDED) || \ + defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) || \ + defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#define MBEDTLS_ECP_LIGHT +#endif + +/* Backward compatibility: after #8740 the RSA module offers functions to parse + * and write RSA private/public keys without relying on the PK one. Of course + * this needs ASN1 support to do so, so we enable it here. */ +#if defined(MBEDTLS_RSA_C) +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif + +/* MBEDTLS_PK_PARSE_EC_COMPRESSED is introduced in Mbed TLS version 3.5, while + * in previous version compressed points were automatically supported as long + * as PK_PARSE_C and ECP_C were enabled. As a consequence, for backward + * compatibility, we auto-enable PK_PARSE_EC_COMPRESSED when these conditions + * are met. */ +#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_ECP_C) +#define MBEDTLS_PK_PARSE_EC_COMPRESSED +#endif + +/* Helper symbol to state that there is support for ECDH, either through + * library implementation (ECDH_C) or through PSA. */ +#if (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_ECDH)) || \ + (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)) +#define MBEDTLS_CAN_ECDH +#endif + +/* PK module can achieve ECDSA functionalities by means of either software + * implementations (ECDSA_C) or through a PSA driver. The following defines + * are meant to list these capabilities in a general way which abstracts how + * they are implemented under the hood. */ +#if !defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_ECDSA_C) +#define MBEDTLS_PK_CAN_ECDSA_SIGN +#define MBEDTLS_PK_CAN_ECDSA_VERIFY +#endif /* MBEDTLS_ECDSA_C */ +#else /* MBEDTLS_USE_PSA_CRYPTO */ +#if defined(PSA_WANT_ALG_ECDSA) +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#define MBEDTLS_PK_CAN_ECDSA_SIGN +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC */ +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +#define MBEDTLS_PK_CAN_ECDSA_VERIFY +#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ +#endif /* PSA_WANT_ALG_ECDSA */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) || defined(MBEDTLS_PK_CAN_ECDSA_SIGN) +#define MBEDTLS_PK_CAN_ECDSA_SOME +#endif + +/* Helpers to state that each key is supported either on the builtin or PSA side. */ +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_521) +#define MBEDTLS_ECP_HAVE_SECP521R1 +#endif +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#define MBEDTLS_ECP_HAVE_BP512R1 +#endif +#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_448) +#define MBEDTLS_ECP_HAVE_CURVE448 +#endif +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#define MBEDTLS_ECP_HAVE_BP384R1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_384) +#define MBEDTLS_ECP_HAVE_SECP384R1 +#endif +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#define MBEDTLS_ECP_HAVE_BP256R1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_256) +#define MBEDTLS_ECP_HAVE_SECP256K1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_256) +#define MBEDTLS_ECP_HAVE_SECP256R1 +#endif +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || defined(PSA_WANT_ECC_MONTGOMERY_255) +#define MBEDTLS_ECP_HAVE_CURVE25519 +#endif +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_224) +#define MBEDTLS_ECP_HAVE_SECP224K1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_224) +#define MBEDTLS_ECP_HAVE_SECP224R1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || defined(PSA_WANT_ECC_SECP_K1_192) +#define MBEDTLS_ECP_HAVE_SECP192K1 +#endif +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || defined(PSA_WANT_ECC_SECP_R1_192) +#define MBEDTLS_ECP_HAVE_SECP192R1 +#endif + +/* Helper symbol to state that the PK module has support for EC keys. This + * can either be provided through the legacy ECP solution or through the + * PSA friendly MBEDTLS_PK_USE_PSA_EC_DATA (see pk.h for its description). */ +#if defined(MBEDTLS_ECP_C) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)) +#define MBEDTLS_PK_HAVE_ECC_KEYS +#endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_ECP_C */ + +/* Historically pkparse did not check the CBC padding when decrypting + * a key. This was a bug, which is now fixed. As a consequence, pkparse + * now needs PKCS7 padding support, but existing configurations might not + * enable it, so we enable it here. */ +#if defined(MBEDTLS_PK_PARSE_C) && defined(MBEDTLS_PKCS5_C) && defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#endif + +/* Backwards compatibility for some macros which were renamed to reflect that + * they are related to Armv8, not aarch64. */ +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT) && \ + !defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT) +#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +#endif +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY) && !defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) +#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +#endif + +/* psa_util file features some ECDSA conversion functions, to convert between + * legacy's ASN.1 DER format and PSA's raw one. */ +#if (defined(MBEDTLS_PSA_CRYPTO_CLIENT) && \ + (defined(PSA_WANT_ALG_ECDSA) || defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA))) +#define MBEDTLS_PSA_UTIL_HAVE_ECDSA +#endif + +/* Some internal helpers to determine which keys are available. */ +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_AES_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_AES)) +#define MBEDTLS_SSL_HAVE_AES +#endif +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ARIA_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ARIA)) +#define MBEDTLS_SSL_HAVE_ARIA +#endif +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CAMELLIA_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_CAMELLIA)) +#define MBEDTLS_SSL_HAVE_CAMELLIA +#endif + +/* Some internal helpers to determine which operation modes are available. */ +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CIPHER_MODE_CBC)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CBC_NO_PADDING)) +#define MBEDTLS_SSL_HAVE_CBC +#endif + +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_GCM_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_GCM)) +#define MBEDTLS_SSL_HAVE_GCM +#endif + +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CCM_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CCM)) +#define MBEDTLS_SSL_HAVE_CCM +#endif + +#if (!defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_CHACHAPOLY_C)) || \ + (defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_ALG_CHACHA20_POLY1305)) +#define MBEDTLS_SSL_HAVE_CHACHAPOLY +#endif + +#if defined(MBEDTLS_SSL_HAVE_GCM) || defined(MBEDTLS_SSL_HAVE_CCM) || \ + defined(MBEDTLS_SSL_HAVE_CHACHAPOLY) +#define MBEDTLS_SSL_HAVE_AEAD +#endif + +#endif /* MBEDTLS_CONFIG_ADJUST_LEGACY_CRYPTO_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h new file mode 100644 index 00000000..48f1bab1 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h @@ -0,0 +1,873 @@ +/** + * \file mbedtls/config_adjust_legacy_from_psa.h + * \brief Adjust PSA configuration: activate legacy implementations + * + * This is an internal header. Do not include it directly. + * + * When MBEDTLS_PSA_CRYPTO_CONFIG is enabled, activate legacy implementations + * of cryptographic mechanisms as needed to fulfill the needs of the PSA + * configuration. Generally speaking, we activate a legacy mechanism if + * it's needed for a requested PSA mechanism and there is no PSA driver + * for it. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H +#define MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/* Define appropriate ACCEL macros for the p256-m driver. + * In the future, those should be generated from the drivers JSON description. + */ +#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) +#define MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 +#define MBEDTLS_PSA_ACCEL_ALG_ECDSA +#define MBEDTLS_PSA_ACCEL_ALG_ECDH +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE +#endif + +/* + * ECC: support for a feature is controlled by a triplet or a pair: + * (curve, key_type public/basic, alg) or (curve, key_type_). + * + * A triplet/pair is accelerated if all of is components are accelerated; + * otherwise each component needs to be built in. + * + * We proceed in two passes: + * 1. Check if acceleration is complete for curves, key types, algs. + * 2. Then enable built-ins for each thing that's either not accelerated of + * doesn't have complete acceleration of the other triplet/pair components. + * + * Note: this needs psa/crypto_adjust_keypair_types.h to have been included + * already, so that we know the full set of key types that are requested. + */ + +/* ECC: curves: is acceleration complete? */ +#if (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) && \ + !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256)) || \ + (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) && \ + !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384)) || \ + (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) && \ + !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512)) || \ + (defined(PSA_WANT_ECC_SECP_R1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192)) || \ + (defined(PSA_WANT_ECC_SECP_R1_224) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224)) || \ + (defined(PSA_WANT_ECC_SECP_R1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256)) || \ + (defined(PSA_WANT_ECC_SECP_R1_384) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384)) || \ + (defined(PSA_WANT_ECC_SECP_R1_521) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)) || \ + (defined(PSA_WANT_ECC_SECP_K1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192)) || \ + (defined(PSA_WANT_ECC_SECP_K1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256)) +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES +#endif + +#if (defined(PSA_WANT_ECC_MONTGOMERY_255) && !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255)) || \ + (defined(PSA_WANT_ECC_MONTGOMERY_448) && !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448)) +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES +#endif + +/* ECC: algs: is acceleration complete? */ +#if (defined(PSA_WANT_ALG_ECDH) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH)) || \ + (defined(PSA_WANT_ALG_ECDSA) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA)) || \ + (defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA)) || \ + (defined(PSA_WANT_ALG_JPAKE) && !defined(MBEDTLS_PSA_ACCEL_ALG_JPAKE)) +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS +#endif + +/* ECC: key types: is acceleration complete? */ +#if (defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC)) +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC +#endif + +/* Special case: we don't support cooked key derivation in drivers yet */ +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#undef MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE +#endif + +/* Note: the condition about key derivation is always true as DERIVE can't be + * accelerated yet */ +#if (defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE)) || \ + (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE)) +#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES +#endif + +/* ECC: curves: enable built-ins as needed. + * + * We need the curve built-in: + * - if it's not accelerated, or + * - if there's a key type with missing acceleration, or + * - if there's a alg with missing acceleration. + */ +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_MONTGOMERY_255 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_448) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#define MBEDTLS_ECP_DP_CURVE448_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_MONTGOMERY_448 */ + +#if defined(PSA_WANT_ECC_SECP_R1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_R1_192 */ + +#if defined(PSA_WANT_ECC_SECP_R1_224) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_R1_224 */ + +#if defined(PSA_WANT_ECC_SECP_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_R1_256 */ + +#if defined(PSA_WANT_ECC_SECP_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_R1_384 */ + +#if defined(PSA_WANT_ECC_SECP_R1_521) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_R1_521 */ + +#if defined(PSA_WANT_ECC_SECP_K1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_K1_192 */ + +#if defined(PSA_WANT_ECC_SECP_K1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#endif /* missing accel */ +#endif /* PSA_WANT_ECC_SECP_K1_256 */ + +/* ECC: algs: enable built-ins as needed. + * + * We need the alg built-in: + * - if it's not accelerated, or + * - if there's a relevant curve (see below) with missing acceleration, or + * - if there's a key type among (public, basic) with missing acceleration. + * + * Relevant curves are: + * - all curves for ECDH + * - Weierstrass curves for (deterministic) ECDSA + * - secp256r1 for EC J-PAKE + */ +#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define MBEDTLS_ECDSA_DETERMINISTIC +#define MBEDTLS_HMAC_DRBG_C +#define MBEDTLS_MD_C +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* missing accel */ +#endif /* PSA_WANT_ALG_DETERMINISTIC_ECDSA */ + +#if defined(PSA_WANT_ALG_ECDH) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define MBEDTLS_ECDH_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* missing accel */ +#endif /* PSA_WANT_ALG_ECDH */ + +#if defined(PSA_WANT_ALG_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* missing accel */ +#endif /* PSA_WANT_ALG_ECDSA */ + +#if defined(PSA_WANT_ALG_JPAKE) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_JPAKE) || \ + !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) +#define MBEDTLS_PSA_BUILTIN_PAKE 1 +#define MBEDTLS_PSA_BUILTIN_ALG_JPAKE 1 +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ECP_C +#define MBEDTLS_ECJPAKE_C +#endif /* missing accel */ +#endif /* PSA_WANT_ALG_JPAKE */ + +/* ECC: key types: enable built-ins as needed. + * + * We need the key type built-in: + * - if it's not accelerated, or + * - if there's a curve with missing acceleration, or + * - only for public/basic: if there's an alg with missing acceleration. + */ +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#endif /* missing accel */ +#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#endif /* missing accel */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#endif /* missing accel */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#endif /* missing accel */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +#endif /* missing accel */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE */ + +/* Note: the condition is always true as DERIVE can't be accelerated yet */ +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \ + defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 +#endif /* missing accel */ +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE */ + +#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \ + defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ + defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ + defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#define MBEDTLS_ECP_LIGHT +#define MBEDTLS_BIGNUM_C +#endif + +#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ + defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif + +/* End of ECC section */ + +/* + * DH key types follow the same pattern used above for EC keys. They are defined + * by a triplet (group, key_type, alg). A triplet is accelerated if all its + * component are accelerated, otherwise each component needs to be builtin. + */ + +/* DH: groups: is acceleration complete? */ +#if (defined(PSA_WANT_DH_RFC7919_2048) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_2048)) || \ + (defined(PSA_WANT_DH_RFC7919_3072) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_3072)) || \ + (defined(PSA_WANT_DH_RFC7919_4096) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_4096)) || \ + (defined(PSA_WANT_DH_RFC7919_6144) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_6144)) || \ + (defined(PSA_WANT_DH_RFC7919_8192) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_8192)) +#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS +#endif + +/* DH: algs: is acceleration complete? */ +#if defined(PSA_WANT_ALG_FFDH) && !defined(MBEDTLS_PSA_ACCEL_ALG_FFDH) +#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS +#endif + +/* DH: key types: is acceleration complete? */ +#if (defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY)) || \ + (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC)) || \ + (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT)) || \ + (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT)) || \ + (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) && \ + !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE)) +#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES +#endif + +#if defined(PSA_WANT_DH_RFC7919_2048) +#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_2048) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 1 +#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */ +#endif /* PSA_WANT_DH_RFC7919_2048 */ + +#if defined(PSA_WANT_DH_RFC7919_3072) +#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_3072) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 1 +#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */ +#endif /* PSA_WANT_DH_RFC7919_3072 */ + +#if defined(PSA_WANT_DH_RFC7919_4096) +#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_4096) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 1 +#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */ +#endif /* PSA_WANT_DH_RFC7919_4096 */ + +#if defined(PSA_WANT_DH_RFC7919_6144) +#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_6144) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 1 +#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */ +#endif /* PSA_WANT_DH_RFC7919_6144 */ + +#if defined(PSA_WANT_DH_RFC7919_8192) +#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_8192) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 1 +#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */ +#endif /* PSA_WANT_DH_RFC7919_8192 */ + +#if defined(PSA_WANT_ALG_FFDH) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_FFDH) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) +#define MBEDTLS_PSA_BUILTIN_ALG_FFDH 1 +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_FFDH */ +#endif /* PSA_WANT_ALG_FFDH */ + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT */ +#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT */ + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT */ +#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT */ + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE */ +#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */ + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC */ +#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC */ + +#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ + defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY 1 +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY */ + +/* End of DH section */ + +#if defined(PSA_WANT_ALG_HKDF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) +/* + * The PSA implementation has its own implementation of HKDF, separate from + * hkdf.c. No need to enable MBEDTLS_HKDF_C here. + */ +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */ +#endif /* PSA_WANT_ALG_HKDF */ + +#if defined(PSA_WANT_ALG_HKDF_EXTRACT) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT) +/* + * The PSA implementation has its own implementation of HKDF, separate from + * hkdf.c. No need to enable MBEDTLS_HKDF_C here. + */ +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT */ +#endif /* PSA_WANT_ALG_HKDF_EXTRACT */ + +#if defined(PSA_WANT_ALG_HKDF_EXPAND) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND) +/* + * The PSA implementation has its own implementation of HKDF, separate from + * hkdf.c. No need to enable MBEDTLS_HKDF_C here. + */ +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND */ +#endif /* PSA_WANT_ALG_HKDF_EXPAND */ + +#if defined(PSA_WANT_ALG_HMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */ +#endif /* PSA_WANT_ALG_HMAC */ + +#if defined(PSA_WANT_ALG_MD5) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD5) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define MBEDTLS_MD5_C +#endif + +#if defined(PSA_WANT_ALG_RIPEMD160) && !defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define MBEDTLS_RIPEMD160_C +#endif + +#if defined(PSA_WANT_ALG_RSA_OAEP) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP */ +#endif /* PSA_WANT_ALG_RSA_OAEP */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_CRYPT */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */ + +#if defined(PSA_WANT_ALG_RSA_PSS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PSS) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PSS */ +#endif /* PSA_WANT_ALG_RSA_PSS */ + +#if defined(PSA_WANT_ALG_SHA_1) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define MBEDTLS_SHA1_C +#endif + +#if defined(PSA_WANT_ALG_SHA_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define MBEDTLS_SHA224_C +#endif + +#if defined(PSA_WANT_ALG_SHA_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define MBEDTLS_SHA256_C +#endif + +#if defined(PSA_WANT_ALG_SHA_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define MBEDTLS_SHA384_C +#endif + +#if defined(PSA_WANT_ALG_SHA_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define MBEDTLS_SHA512_C +#endif + +#if defined(PSA_WANT_ALG_SHA3_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_224) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 1 +#define MBEDTLS_SHA3_C +#endif + +#if defined(PSA_WANT_ALG_SHA3_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_256) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 1 +#define MBEDTLS_SHA3_C +#endif + +#if defined(PSA_WANT_ALG_SHA3_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 1 +#define MBEDTLS_SHA3_C +#endif + +#if defined(PSA_WANT_ALG_SHA3_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_512) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 1 +#define MBEDTLS_SHA3_C +#endif + +#if defined(PSA_WANT_ALG_PBKDF2_HMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC) +#define MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC 1 +#define PSA_HAVE_SOFT_PBKDF2_HMAC 1 +#endif /* !MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */ +#endif /* PSA_WANT_ALG_PBKDF2_HMAC */ + +#if defined(PSA_WANT_ALG_TLS12_PRF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF */ +#endif /* PSA_WANT_ALG_TLS12_PRF */ + +#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS */ +#endif /* PSA_WANT_ALG_TLS12_PSK_TO_MS */ + +#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS */ +#endif /* PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +#define MBEDTLS_GENPRIME +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY */ + +/* If any of the block modes are requested that don't have an + * associated HW assist, define PSA_HAVE_SOFT_BLOCK_MODE for checking + * in the block cipher key types. */ +#if (defined(PSA_WANT_ALG_CTR) && !defined(MBEDTLS_PSA_ACCEL_ALG_CTR)) || \ + (defined(PSA_WANT_ALG_CFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_CFB)) || \ + (defined(PSA_WANT_ALG_OFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_OFB)) || \ + (defined(PSA_WANT_ALG_ECB_NO_PADDING) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING)) || \ + (defined(PSA_WANT_ALG_CBC_NO_PADDING) && !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING)) || \ + (defined(PSA_WANT_ALG_CBC_PKCS7) && !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7)) || \ + (defined(PSA_WANT_ALG_CMAC) && !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC)) +#define PSA_HAVE_SOFT_BLOCK_MODE 1 +#endif + +#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128) +#define MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 1 +#define PSA_HAVE_SOFT_PBKDF2_CMAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128 */ +#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */ + +#if defined(PSA_WANT_KEY_TYPE_AES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) +#define PSA_HAVE_SOFT_KEY_TYPE_AES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_AES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#define MBEDTLS_AES_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_AES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_AES */ + +#if defined(PSA_WANT_KEY_TYPE_ARIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA) +#define PSA_HAVE_SOFT_KEY_TYPE_ARIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#define MBEDTLS_ARIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_ARIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_ARIA */ + +#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_CAMELLIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_CAMELLIA */ + +#if defined(PSA_WANT_KEY_TYPE_DES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DES) +#define PSA_HAVE_SOFT_KEY_TYPE_DES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#define MBEDTLS_DES_C +#endif /*PSA_HAVE_SOFT_KEY_TYPE_DES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_DES */ + +#if defined(PSA_WANT_ALG_STREAM_CIPHER) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif /* MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER */ +#endif /* PSA_WANT_ALG_STREAM_CIPHER */ + +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_CHACHA20_C +#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 */ +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ + +/* If any of the software block ciphers are selected, define + * PSA_HAVE_SOFT_BLOCK_CIPHER, which can be used in any of these + * situations. */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_BLOCK_CIPHER 1 +#endif + +#if defined(PSA_WANT_ALG_CMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define MBEDTLS_CMAC_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */ +#endif /* PSA_WANT_ALG_CMAC */ + +#if defined(PSA_HAVE_SOFT_PBKDF2_HMAC) || \ + defined(PSA_HAVE_SOFT_PBKDF2_CMAC) +#define PSA_HAVE_SOFT_PBKDF2 1 +#endif /* PSA_HAVE_SOFT_PBKDF2_HMAC || PSA_HAVE_SOFT_PBKDF2_CMAC */ + +#if defined(PSA_WANT_ALG_CTR) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CTR) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define MBEDTLS_CIPHER_MODE_CTR +#endif +#endif /* PSA_WANT_ALG_CTR */ + +#if defined(PSA_WANT_ALG_CFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define MBEDTLS_CIPHER_MODE_CFB +#endif +#endif /* PSA_WANT_ALG_CFB */ + +#if defined(PSA_WANT_ALG_OFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_OFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define MBEDTLS_CIPHER_MODE_OFB +#endif +#endif /* PSA_WANT_ALG_OFB */ + +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#endif +#endif /* PSA_WANT_ALG_CBC_NO_PADDING */ + +#if defined(PSA_WANT_ALG_CBC_PKCS7) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#endif /* PSA_WANT_ALG_CBC_PKCS7 */ + +#if defined(PSA_WANT_ALG_CCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define MBEDTLS_CCM_C +#endif +#endif /* PSA_WANT_ALG_CCM */ + +#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1 +#define MBEDTLS_CCM_C +#endif +#endif /* PSA_WANT_ALG_CCM_STAR_NO_TAG */ + +#if defined(PSA_WANT_ALG_GCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define MBEDTLS_GCM_C +#endif +#endif /* PSA_WANT_ALG_GCM */ + +#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#define MBEDTLS_CHACHAPOLY_C +#define MBEDTLS_CHACHA20_C +#define MBEDTLS_POLY1305_C +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 */ +#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ + +#endif /* MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_from_legacy.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_from_legacy.h new file mode 100644 index 00000000..14ca1469 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_from_legacy.h @@ -0,0 +1,359 @@ +/** + * \file mbedtls/config_adjust_psa_from_legacy.h + * \brief Adjust PSA configuration: construct PSA configuration from legacy + * + * This is an internal header. Do not include it directly. + * + * When MBEDTLS_PSA_CRYPTO_CONFIG is disabled, we automatically enable + * cryptographic mechanisms through the PSA interface when the corresponding + * legacy mechanism is enabled. In many cases, this just enables the PSA + * wrapper code around the legacy implementation, but we also do this for + * some mechanisms where PSA has its own independent implementation so + * that high-level modules that can use either cryptographic API have the + * same feature set in both cases. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H +#define MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/* + * Ensure PSA_WANT_* defines are setup properly if MBEDTLS_PSA_CRYPTO_CONFIG + * is not defined + */ + +#if defined(MBEDTLS_CCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define PSA_WANT_ALG_CCM 1 +#if defined(MBEDTLS_CIPHER_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1 +#define PSA_WANT_ALG_CCM_STAR_NO_TAG 1 +#endif /* MBEDTLS_CIPHER_C */ +#endif /* MBEDTLS_CCM_C */ + +#if defined(MBEDTLS_CMAC_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define PSA_WANT_ALG_CMAC 1 +#endif /* MBEDTLS_CMAC_C */ + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define PSA_WANT_ALG_ECDH 1 +#endif /* MBEDTLS_ECDH_C */ + +#if defined(MBEDTLS_ECDSA_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA_ANY 1 + +// Only add in DETERMINISTIC support if ECDSA is also enabled +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +#endif /* MBEDTLS_ECDSA_C */ + +#if defined(MBEDTLS_ECP_C) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +/* Normally we wouldn't enable this because it's not implemented in ecp.c, + * but since it used to be available any time ECP_C was enabled, let's enable + * it anyway for the sake of backwards compatibility */ +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +/* See comment for PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE above. */ +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_DHM_C) +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 +#define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1 +#define PSA_WANT_ALG_FFDH 1 +#define PSA_WANT_DH_RFC7919_2048 1 +#define PSA_WANT_DH_RFC7919_3072 1 +#define PSA_WANT_DH_RFC7919_4096 1 +#define PSA_WANT_DH_RFC7919_6144 1 +#define PSA_WANT_DH_RFC7919_8192 1 +#define MBEDTLS_PSA_BUILTIN_ALG_FFDH 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY 1 +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 1 +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 1 +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 1 +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 1 +#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 1 +#endif /* MBEDTLS_DHM_C */ + +#if defined(MBEDTLS_GCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define PSA_WANT_ALG_GCM 1 +#endif /* MBEDTLS_GCM_C */ + +/* Enable PSA HKDF algorithm if mbedtls HKDF is supported. + * PSA HKDF EXTRACT and PSA HKDF EXPAND have minimal cost when + * PSA HKDF is enabled, so enable both algorithms together + * with PSA HKDF. */ +#if defined(MBEDTLS_HKDF_C) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#define PSA_WANT_ALG_HKDF 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT 1 +#define PSA_WANT_ALG_HKDF_EXTRACT 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND 1 +#define PSA_WANT_ALG_HKDF_EXPAND 1 +#endif /* MBEDTLS_HKDF_C */ + +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_KEY_TYPE_HMAC 1 + +#if defined(MBEDTLS_MD_C) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#define PSA_WANT_ALG_TLS12_PRF 1 +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 +#endif /* MBEDTLS_MD_C */ + +#if defined(MBEDTLS_MD5_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define PSA_WANT_ALG_MD5 1 +#endif + +#if defined(MBEDTLS_ECJPAKE_C) +#define MBEDTLS_PSA_BUILTIN_PAKE 1 +#define MBEDTLS_PSA_BUILTIN_ALG_JPAKE 1 +#define PSA_WANT_ALG_JPAKE 1 +#endif + +#if defined(MBEDTLS_RIPEMD160_C) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define PSA_WANT_ALG_RIPEMD160 1 +#endif + +#if defined(MBEDTLS_RSA_C) +#if defined(MBEDTLS_PKCS1_V15) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW 1 +#endif /* MBEDTLS_PKCS1_V15 */ +#if defined(MBEDTLS_PKCS1_V21) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define PSA_WANT_ALG_RSA_OAEP 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define PSA_WANT_ALG_RSA_PSS 1 +#endif /* MBEDTLS_PKCS1_V21 */ +#if defined(MBEDTLS_GENPRIME) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +#endif /* MBEDTLS_GENPRIME */ +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_SHA1_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define PSA_WANT_ALG_SHA_1 1 +#endif + +#if defined(MBEDTLS_SHA224_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define PSA_WANT_ALG_SHA_224 1 +#endif + +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_256 1 +#endif + +#if defined(MBEDTLS_SHA384_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define PSA_WANT_ALG_SHA_384 1 +#endif + +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define PSA_WANT_ALG_SHA_512 1 +#endif + +#if defined(MBEDTLS_SHA3_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 1 +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 1 +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 1 +#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 1 +#define PSA_WANT_ALG_SHA3_224 1 +#define PSA_WANT_ALG_SHA3_256 1 +#define PSA_WANT_ALG_SHA3_384 1 +#define PSA_WANT_ALG_SHA3_512 1 +#endif + +#if defined(MBEDTLS_AES_C) +#define PSA_WANT_KEY_TYPE_AES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#endif + +#if defined(MBEDTLS_ARIA_C) +#define PSA_WANT_KEY_TYPE_ARIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#endif + +#if defined(MBEDTLS_CAMELLIA_C) +#define PSA_WANT_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#endif + +#if defined(MBEDTLS_DES_C) +#define PSA_WANT_KEY_TYPE_DES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#endif + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS 1 +#define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 +#endif + +#if defined(MBEDTLS_CHACHA20_C) +#define PSA_WANT_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +/* ALG_STREAM_CIPHER requires CIPHER_C in order to be supported in PSA */ +#if defined(MBEDTLS_CIPHER_C) +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif +#if defined(MBEDTLS_CHACHAPOLY_C) +#define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#define PSA_WANT_ALG_CBC_NO_PADDING 1 +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CBC_PKCS7 1 +#endif +#endif + +#if (defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \ + defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C)) && \ + defined(MBEDTLS_CIPHER_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#define PSA_WANT_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define PSA_WANT_ALG_CFB 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define PSA_WANT_ALG_CTR 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define PSA_WANT_ALG_OFB 1 +#endif + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 +#endif + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 +#endif + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 +#endif + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#define PSA_WANT_ECC_MONTGOMERY_255 1 +#endif + +#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#define PSA_WANT_ECC_MONTGOMERY_448 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#define PSA_WANT_ECC_SECP_R1_192 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#define PSA_WANT_ECC_SECP_R1_224 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#define PSA_WANT_ECC_SECP_R1_256 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#define PSA_WANT_ECC_SECP_R1_384 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#define PSA_WANT_ECC_SECP_R1_521 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#define PSA_WANT_ECC_SECP_K1_192 1 +#endif + +/* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ +#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 +#define PSA_WANT_ECC_SECP_K1_224 1 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#define PSA_WANT_ECC_SECP_K1_256 1 +#endif + +#endif /* MBEDTLS_CONFIG_ADJUST_PSA_FROM_LEGACY_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_superset_legacy.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_superset_legacy.h new file mode 100644 index 00000000..1a232cbb --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_psa_superset_legacy.h @@ -0,0 +1,145 @@ +/** + * \file mbedtls/config_adjust_psa_superset_legacy.h + * \brief Adjust PSA configuration: automatic enablement from legacy + * + * This is an internal header. Do not include it directly. + * + * To simplify some edge cases, we automatically enable certain cryptographic + * mechanisms in the PSA API if they are enabled in the legacy API. The general + * idea is that if legacy module M uses mechanism A internally, and A has + * both a legacy and a PSA implementation, we enable A through PSA whenever + * it's enabled through legacy. This facilitates the transition to PSA + * implementations of A for users of M. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_PSA_SUPERSET_LEGACY_H +#define MBEDTLS_CONFIG_ADJUST_PSA_SUPERSET_LEGACY_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/****************************************************************/ +/* Hashes that are built in are also enabled in PSA. + * This simplifies dependency declarations especially + * for modules that obey MBEDTLS_USE_PSA_CRYPTO. */ +/****************************************************************/ + +#if defined(MBEDTLS_MD5_C) +#define PSA_WANT_ALG_MD5 1 +#endif + +#if defined(MBEDTLS_RIPEMD160_C) +#define PSA_WANT_ALG_RIPEMD160 1 +#endif + +#if defined(MBEDTLS_SHA1_C) +#define PSA_WANT_ALG_SHA_1 1 +#endif + +#if defined(MBEDTLS_SHA224_C) +#define PSA_WANT_ALG_SHA_224 1 +#endif + +#if defined(MBEDTLS_SHA256_C) +#define PSA_WANT_ALG_SHA_256 1 +#endif + +#if defined(MBEDTLS_SHA384_C) +#define PSA_WANT_ALG_SHA_384 1 +#endif + +#if defined(MBEDTLS_SHA512_C) +#define PSA_WANT_ALG_SHA_512 1 +#endif + +#if defined(MBEDTLS_SHA3_C) +#define PSA_WANT_ALG_SHA3_224 1 +#define PSA_WANT_ALG_SHA3_256 1 +#define PSA_WANT_ALG_SHA3_384 1 +#define PSA_WANT_ALG_SHA3_512 1 +#endif + +/* Ensure that the PSA's supported curves (PSA_WANT_ECC_xxx) are always a + * superset of the builtin ones (MBEDTLS_ECP_DP_xxx). */ +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#if !defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */ +#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#if !defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */ +#endif /*MBEDTLS_ECP_DP_BP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#if !defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */ +#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#if !defined(PSA_WANT_ECC_MONTGOMERY_255) +#define PSA_WANT_ECC_MONTGOMERY_255 1 +#endif /* PSA_WANT_ECC_MONTGOMERY_255 */ +#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#if !defined(PSA_WANT_ECC_MONTGOMERY_448) +#define PSA_WANT_ECC_MONTGOMERY_448 1 +#endif /* PSA_WANT_ECC_MONTGOMERY_448 */ +#endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_R1_192) +#define PSA_WANT_ECC_SECP_R1_192 1 +#endif /* PSA_WANT_ECC_SECP_R1_192 */ +#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_R1_224) +#define PSA_WANT_ECC_SECP_R1_224 1 +#endif /* PSA_WANT_ECC_SECP_R1_224 */ +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_R1_256) +#define PSA_WANT_ECC_SECP_R1_256 1 +#endif /* PSA_WANT_ECC_SECP_R1_256 */ +#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_R1_384) +#define PSA_WANT_ECC_SECP_R1_384 1 +#endif /* PSA_WANT_ECC_SECP_R1_384 */ +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_R1_521) +#define PSA_WANT_ECC_SECP_R1_521 1 +#endif /* PSA_WANT_ECC_SECP_R1_521 */ +#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_K1_192) +#define PSA_WANT_ECC_SECP_K1_192 1 +#endif /* PSA_WANT_ECC_SECP_K1_192 */ +#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#if !defined(PSA_WANT_ECC_SECP_K1_256) +#define PSA_WANT_ECC_SECP_K1_256 1 +#endif /* PSA_WANT_ECC_SECP_K1_256 */ +#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */ + +#endif /* MBEDTLS_CONFIG_ADJUST_PSA_SUPERSET_LEGACY_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_ssl.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_ssl.h new file mode 100644 index 00000000..1f82d9c0 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_ssl.h @@ -0,0 +1,91 @@ +/** + * \file mbedtls/config_adjust_ssl.h + * \brief Adjust TLS configuration + * + * This is an internal header. Do not include it directly. + * + * Automatically enable certain dependencies. Generally, MBEDTLS_xxx + * configurations need to be explicitly enabled by the user: enabling + * MBEDTLS_xxx_A but not MBEDTLS_xxx_B when A requires B results in a + * compilation error. However, we do automatically enable certain options + * in some circumstances. One case is if MBEDTLS_xxx_B is an internal option + * used to identify parts of a module that are used by other module, and we + * don't want to make the symbol MBEDTLS_xxx_B part of the public API. + * Another case is if A didn't depend on B in earlier versions, and we + * want to use B in A but we need to preserve backward compatibility with + * configurations that explicitly activate MBEDTLS_xxx_A but not + * MBEDTLS_xxx_B. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_SSL_H +#define MBEDTLS_CONFIG_ADJUST_SSL_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/* The following blocks make it easier to disable all of TLS, + * or of TLS 1.2 or 1.3 or DTLS, without having to manually disable all + * key exchanges, options and extensions related to them. */ + +#if !defined(MBEDTLS_SSL_TLS_C) +#undef MBEDTLS_SSL_CLI_C +#undef MBEDTLS_SSL_SRV_C +#undef MBEDTLS_SSL_PROTO_TLS1_3 +#undef MBEDTLS_SSL_PROTO_TLS1_2 +#undef MBEDTLS_SSL_PROTO_DTLS +#endif + +#if !(defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)) +#undef MBEDTLS_SSL_TICKET_C +#endif + +#if !defined(MBEDTLS_SSL_PROTO_DTLS) +#undef MBEDTLS_SSL_DTLS_ANTI_REPLAY +#undef MBEDTLS_SSL_DTLS_CONNECTION_ID +#undef MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT +#undef MBEDTLS_SSL_DTLS_HELLO_VERIFY +#undef MBEDTLS_SSL_DTLS_SRTP +#undef MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE +#endif + +#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#undef MBEDTLS_SSL_ENCRYPT_THEN_MAC +#undef MBEDTLS_SSL_EXTENDED_MASTER_SECRET +#undef MBEDTLS_SSL_RENEGOTIATION +#undef MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#undef MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED +#endif + +#if !defined(MBEDTLS_SSL_PROTO_TLS1_3) +#undef MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED +#undef MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED +#undef MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED +#undef MBEDTLS_SSL_EARLY_DATA +#undef MBEDTLS_SSL_RECORD_SIZE_LIMIT +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + (defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)) +#define MBEDTLS_SSL_TLS1_2_SOME_ECC +#endif + +#endif /* MBEDTLS_CONFIG_ADJUST_SSL_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_x509.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_x509.h new file mode 100644 index 00000000..cfb2d889 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_adjust_x509.h @@ -0,0 +1,35 @@ +/** + * \file mbedtls/config_adjust_x509.h + * \brief Adjust X.509 configuration + * + * This is an internal header. Do not include it directly. + * + * Automatically enable certain dependencies. Generally, MBEDTLS_xxx + * configurations need to be explicitly enabled by the user: enabling + * MBEDTLS_xxx_A but not MBEDTLS_xxx_B when A requires B results in a + * compilation error. However, we do automatically enable certain options + * in some circumstances. One case is if MBEDTLS_xxx_B is an internal option + * used to identify parts of a module that are used by other module, and we + * don't want to make the symbol MBEDTLS_xxx_B part of the public API. + * Another case is if A didn't depend on B in earlier versions, and we + * want to use B in A but we need to preserve backward compatibility with + * configurations that explicitly activate MBEDTLS_xxx_A but not + * MBEDTLS_xxx_B. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_X509_H +#define MBEDTLS_CONFIG_ADJUST_X509_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +#endif /* MBEDTLS_CONFIG_ADJUST_X509_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_psa.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_psa.h new file mode 100644 index 00000000..5f3d0f3d --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/config_psa.h @@ -0,0 +1,61 @@ +/** + * \file mbedtls/config_psa.h + * \brief PSA crypto configuration options (set of defines) + * + * This set of compile-time options takes settings defined in + * include/mbedtls/mbedtls_config.h and include/psa/crypto_config.h and uses + * those definitions to define symbols used in the library code. + * + * Users and integrators should not edit this file, please edit + * include/mbedtls/mbedtls_config.h for MBEDTLS_XXX settings or + * include/psa/crypto_config.h for PSA_WANT_XXX settings. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_PSA_H +#define MBEDTLS_CONFIG_PSA_H + +#include "psa/crypto_legacy.h" + +#include "psa/crypto_adjust_config_synonyms.h" + +#include "psa/crypto_adjust_config_dependencies.h" + +#include "mbedtls/config_adjust_psa_superset_legacy.h" + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) + +/* Require built-in implementations based on PSA requirements */ + +/* We need this to have a complete list of requirements + * before we deduce what built-ins are required. */ +#include "psa/crypto_adjust_config_key_pair_types.h" + +#if defined(MBEDTLS_PSA_CRYPTO_C) +/* If we are implementing PSA crypto ourselves, then we want to enable the + * required built-ins. Otherwise, PSA features will be provided by the server. */ +#include "mbedtls/config_adjust_legacy_from_psa.h" +#endif + +#else /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +/* Infer PSA requirements from Mbed TLS capabilities */ + +#include "mbedtls/config_adjust_psa_from_legacy.h" + +/* Hopefully the file above will have enabled keypair symbols in a consistent + * way, but including this here fixes them if that wasn't the case. */ +#include "psa/crypto_adjust_config_key_pair_types.h" + +#endif /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +#if defined(PSA_WANT_ALG_JPAKE) +#define PSA_WANT_ALG_SOME_PAKE 1 +#endif + +#include "psa/crypto_adjust_auto_enabled.h" + +#endif /* MBEDTLS_CONFIG_PSA_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/constant_time.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/constant_time.h new file mode 100644 index 00000000..d31bff67 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/constant_time.h @@ -0,0 +1,36 @@ +/** + * Constant-time functions + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONSTANT_TIME_H +#define MBEDTLS_CONSTANT_TIME_H + +#include + +/** Constant-time buffer comparison without branches. + * + * This is equivalent to the standard memcmp function, but is likely to be + * compiled to code using bitwise operations rather than a branch, such that + * the time taken is constant w.r.t. the data pointed to by \p a and \p b, + * and w.r.t. whether \p a and \p b are equal or not. It is not constant-time + * w.r.t. \p n . + * + * This function can be used to write constant-time code by replacing branches + * with bit operations using masks. + * + * \param a Pointer to the first buffer, containing at least \p n bytes. May not be NULL. + * \param b Pointer to the second buffer, containing at least \p n bytes. May not be NULL. + * \param n The number of bytes to compare. + * + * \return Zero if the contents of the two buffers are the same, + * otherwise non-zero. + */ +int mbedtls_ct_memcmp(const void *a, + const void *b, + size_t n); + +#endif /* MBEDTLS_CONSTANT_TIME_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ctr_drbg.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ctr_drbg.h new file mode 100644 index 00000000..c8d64830 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ctr_drbg.h @@ -0,0 +1,596 @@ +/** + * \file ctr_drbg.h + * + * \brief This file contains definitions and functions for the + * CTR_DRBG pseudorandom generator. + * + * CTR_DRBG is a standardized way of building a PRNG from a block-cipher + * in counter mode operation, as defined in NIST SP 800-90A: + * Recommendation for Random Number Generation Using Deterministic Random + * Bit Generators. + * + * The Mbed TLS implementation of CTR_DRBG uses AES-256 (default) or AES-128 + * (if \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled at compile time) + * as the underlying block cipher, with a derivation function. + * + * The security strength as defined in NIST SP 800-90A is + * 128 bits when AES-128 is used (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY enabled) + * and 256 bits otherwise, provided that #MBEDTLS_CTR_DRBG_ENTROPY_LEN is + * kept at its default value (and not overridden in mbedtls_config.h) and that the + * DRBG instance is set up with default parameters. + * See the documentation of mbedtls_ctr_drbg_seed() for more + * information. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CTR_DRBG_H +#define MBEDTLS_CTR_DRBG_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +/* The CTR_DRBG implementation can either directly call the low-level AES + * module (gated by MBEDTLS_AES_C) or call the PSA API to perform AES + * operations. Calling the AES module directly is the default, both for + * maximum backward compatibility and because it's a bit more efficient + * (less glue code). + * + * When MBEDTLS_AES_C is disabled, the CTR_DRBG module calls PSA crypto and + * thus benefits from the PSA AES accelerator driver. + * It is technically possible to enable MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO + * to use PSA even when MBEDTLS_AES_C is enabled, but there is very little + * reason to do so other than testing purposes and this is not officially + * supported. + */ +#if !defined(MBEDTLS_AES_C) +#define MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO +#endif + +#if defined(MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#else +#include "mbedtls/aes.h" +#endif + +#include "entropy.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** The entropy source failed. */ +#define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034 +/** The requested random buffer length is too big. */ +#define MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG -0x0036 +/** The input (entropy + additional data) is too large. */ +#define MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG -0x0038 +/** Read or write error in file. */ +#define MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR -0x003A + +#define MBEDTLS_CTR_DRBG_BLOCKSIZE 16 /**< The block size used by the cipher. */ + +#if defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +#define MBEDTLS_CTR_DRBG_KEYSIZE 16 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 16 bytes (128 bits) + * because #MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled. + */ +#else +#define MBEDTLS_CTR_DRBG_KEYSIZE 32 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 32 bytes (256 bits) + * because \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled. + */ +#endif + +#define MBEDTLS_CTR_DRBG_KEYBITS (MBEDTLS_CTR_DRBG_KEYSIZE * 8) /**< The key size for the DRBG operation, in bits. */ +#define MBEDTLS_CTR_DRBG_SEEDLEN (MBEDTLS_CTR_DRBG_KEYSIZE + MBEDTLS_CTR_DRBG_BLOCKSIZE) /**< The seed length, calculated as (counter + AES key). */ + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them using the compiler command + * line. + * \{ + */ + +/** \def MBEDTLS_CTR_DRBG_ENTROPY_LEN + * + * \brief The amount of entropy used per seed by default, in bytes. + */ +#if !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) +#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR) +/** This is 48 bytes because the entropy module uses SHA-512. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 + +#else /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */ + +/** This is 32 bytes because the entropy module uses SHA-256. + */ +#if !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +/** \warning To achieve a 256-bit security strength, you must pass a nonce + * to mbedtls_ctr_drbg_seed(). + */ +#endif /* !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 32 +#endif /* MBEDTLS_ENTROPY_SHA512_ACCUMULATOR */ +#endif /* !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) */ + +#if !defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL) +#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 +/**< The interval before reseed is performed by default. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 +/**< The maximum number of additional input Bytes. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_REQUEST) +#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 +/**< The maximum number of requested Bytes per call. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 +/**< The maximum size of seed or reseed buffer in bytes. */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_CTR_DRBG_PR_OFF 0 +/**< Prediction resistance is disabled. */ +#define MBEDTLS_CTR_DRBG_PR_ON 1 +/**< Prediction resistance is enabled. */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if MBEDTLS_CTR_DRBG_ENTROPY_LEN >= MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2 +/** The default length of the nonce read from the entropy source. + * + * This is \c 0 because a single read from the entropy source is sufficient + * to include a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN 0 +#else +/** The default length of the nonce read from the entropy source. + * + * This is half of the default entropy length because a single read from + * the entropy source does not provide enough material to form a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN (MBEDTLS_CTR_DRBG_ENTROPY_LEN + 1) / 2 +#endif + +#if defined(MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO) +typedef struct mbedtls_ctr_drbg_psa_context { + mbedtls_svc_key_id_t key_id; + psa_cipher_operation_t operation; +} mbedtls_ctr_drbg_psa_context; +#endif + +/** + * \brief The CTR_DRBG context structure. + */ +typedef struct mbedtls_ctr_drbg_context { + unsigned char MBEDTLS_PRIVATE(counter)[16]; /*!< The counter (V). */ + int MBEDTLS_PRIVATE(reseed_counter); /*!< The reseed counter. + * This is the number of requests that have + * been made since the last (re)seeding. + * Before the initial seeding, this field + * contains the amount of entropy in bytes + * to use as a nonce for the initial seeding, + * or -1 if no nonce length has been explicitly + * set (see mbedtls_ctr_drbg_set_nonce_len()). + */ + int MBEDTLS_PRIVATE(prediction_resistance); /*!< This determines whether prediction + resistance is enabled, that is + whether to systematically reseed before + each random generation. */ + size_t MBEDTLS_PRIVATE(entropy_len); /*!< The amount of entropy grabbed on each + seed or reseed operation, in bytes. */ + int MBEDTLS_PRIVATE(reseed_interval); /*!< The reseed interval. + * This is the maximum number of requests + * that can be made between reseedings. */ + +#if defined(MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO) + mbedtls_ctr_drbg_psa_context MBEDTLS_PRIVATE(psa_ctx); /*!< The PSA context. */ +#else + mbedtls_aes_context MBEDTLS_PRIVATE(aes_ctx); /*!< The AES context. */ +#endif + + /* + * Callbacks (Entropy) + */ + int(*MBEDTLS_PRIVATE(f_entropy))(void *, unsigned char *, size_t); + /*!< The entropy callback function. */ + + void *MBEDTLS_PRIVATE(p_entropy); /*!< The context for the entropy function. */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if f_entropy != NULL. + * This means that the mutex is initialized during the initial seeding + * in mbedtls_ctr_drbg_seed() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); +#endif +} +mbedtls_ctr_drbg_context; + +/** + * \brief This function initializes the CTR_DRBG context, + * and prepares it for mbedtls_ctr_drbg_seed() + * or mbedtls_ctr_drbg_free(). + * + * \note The reseed interval is + * #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + * You can override it by calling + * mbedtls_ctr_drbg_set_reseed_interval(). + * + * \param ctx The CTR_DRBG context to initialize. + */ +void mbedtls_ctr_drbg_init(mbedtls_ctr_drbg_context *ctx); + +/** + * \brief This function seeds and sets up the CTR_DRBG + * entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * The entropy length is #MBEDTLS_CTR_DRBG_ENTROPY_LEN by default. + * You can override it by calling mbedtls_ctr_drbg_set_entropy_len(). + * + * The entropy nonce length is: + * - \c 0 if the entropy length is at least 3/2 times the entropy length, + * which guarantees that the security strength is the maximum permitted + * by the key size and entropy length according to NIST SP 800-90A §10.2.1; + * - Half the entropy length otherwise. + * You can override it by calling mbedtls_ctr_drbg_set_nonce_len(). + * With the default entropy length, the entropy nonce length is + * #MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN. + * + * You can provide a nonce and personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * See SP 800-90A §8.6.7 for more details about nonces. + * + * The _seed_material_ value passed to the derivation function in + * the CTR_DRBG Instantiate Process described in NIST SP 800-90A §10.2.1.3.2 + * is the concatenation of the following strings: + * - A string obtained by calling \p f_entropy function for the entropy + * length. + */ +#if MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN == 0 +/** + * - If mbedtls_ctr_drbg_set_nonce_len() has been called, a string + * obtained by calling \p f_entropy function for the specified length. + */ +#else +/** + * - A string obtained by calling \p f_entropy function for the entropy nonce + * length. If the entropy nonce length is \c 0, this function does not + * make a second call to \p f_entropy. + */ +#endif +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * - The \p custom string. + * + * \note To achieve the nominal security strength permitted + * by CTR_DRBG, the entropy length must be: + * - at least 16 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 32 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * In addition, if you do not pass a nonce in \p custom, + * the sum of the entropy length + * and the entropy nonce length must be: + * - at least 24 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 48 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * \param ctx The CTR_DRBG context to seed. + * It must have been initialized with + * mbedtls_ctr_drbg_init(). + * After a successful call to mbedtls_ctr_drbg_seed(), + * you may not call mbedtls_ctr_drbg_seed() again on + * the same context unless you call + * mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + * again first. + * After a failed call to mbedtls_ctr_drbg_seed(), + * you must call mbedtls_ctr_drbg_free(). + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a buffer size + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_seed(mbedtls_ctr_drbg_context *ctx, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len); + +/** + * \brief This function resets CTR_DRBG context to the state immediately + * after initial call of mbedtls_ctr_drbg_init(). + * + * \param ctx The CTR_DRBG context to clear. + */ +void mbedtls_ctr_drbg_free(mbedtls_ctr_drbg_context *ctx); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_ctr_drbg_random_with_add() + * or mbedtls_ctr_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The CTR_DRBG context. + * \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + */ +void mbedtls_ctr_drbg_set_prediction_resistance(mbedtls_ctr_drbg_context *ctx, + int resistance); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \note The security strength of CTR_DRBG is bounded by the + * entropy length. Thus: + * - When using AES-256 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + * which is the default), + * \p len must be at least 32 (in bytes) + * to achieve a 256-bit strength. + * - When using AES-128 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + * \p len must be at least 16 (in bytes) + * to achieve a 128-bit strength. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + */ +void mbedtls_ctr_drbg_set_entropy_len(mbedtls_ctr_drbg_context *ctx, + size_t len); + +/** + * \brief This function sets the amount of entropy grabbed + * as a nonce for the initial seeding. + * + * Call this function before calling mbedtls_ctr_drbg_seed() to read + * a nonce from the entropy source during the initial seeding. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab for the nonce, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + * more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + * if the initial seeding has already taken place. + */ +int mbedtls_ctr_drbg_set_nonce_len(mbedtls_ctr_drbg_context *ctx, + size_t len); + +/** + * \brief This function sets the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + * or mbedtls_ctr_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + * + * \param ctx The CTR_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_ctr_drbg_set_reseed_interval(mbedtls_ctr_drbg_context *ctx, + int interval); + +/** + * \brief This function reseeds the CTR_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional Additional data to add to the state. Can be \c NULL. + * \param len The length of the additional data. + * This must be less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_reseed(mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, size_t len); + +/** + * \brief This function updates the state of the CTR_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional The data to update the state with. This must not be + * \c NULL unless \p add_len is \c 0. + * \param add_len Length of \p additional in bytes. This must be at + * most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + * \p add_len is more than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return An error from the underlying AES cipher on failure. + */ +int mbedtls_ctr_drbg_update(mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, + size_t add_len); + +/** + * \brief This function updates a CTR_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * \param additional Additional data to update. Can be \c NULL, in which + * case the additional data is empty regardless of + * the value of \p add_len. + * \param add_len The length of the additional data + * if \p additional is not \c NULL. + * This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + * and less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random_with_add(void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, size_t add_len); + +/** + * \brief This function uses CTR_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random(void *p_rng, + unsigned char *output, size_t output_len); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_ctr_drbg_write_seed_file(mbedtls_ctr_drbg_context *ctx, const char *path); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_ctr_drbg_update_seed_file(mbedtls_ctr_drbg_context *ctx, const char *path); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The CTR_DRBG checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ctr_drbg_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ctr_drbg.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/debug.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/debug.h new file mode 100644 index 00000000..45bf390a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/debug.h @@ -0,0 +1,156 @@ +/** + * \file debug.h + * + * \brief Functions for controlling and providing debug output from the library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_DEBUG_H +#define MBEDTLS_DEBUG_H + +#include "mbedtls/build_info.h" + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_DEBUG_C) + +#define MBEDTLS_DEBUG_STRIP_PARENS(...) __VA_ARGS__ + +#define MBEDTLS_SSL_DEBUG_MSG(level, args) \ + mbedtls_debug_print_msg(ssl, level, __FILE__, __LINE__, \ + MBEDTLS_DEBUG_STRIP_PARENS args) + +#define MBEDTLS_SSL_DEBUG_RET(level, text, ret) \ + mbedtls_debug_print_ret(ssl, level, __FILE__, __LINE__, text, ret) + +#define MBEDTLS_SSL_DEBUG_BUF(level, text, buf, len) \ + mbedtls_debug_print_buf(ssl, level, __FILE__, __LINE__, text, buf, len) + +#if defined(MBEDTLS_BIGNUM_C) +#define MBEDTLS_SSL_DEBUG_MPI(level, text, X) \ + mbedtls_debug_print_mpi(ssl, level, __FILE__, __LINE__, text, X) +#endif + +#if defined(MBEDTLS_ECP_C) +#define MBEDTLS_SSL_DEBUG_ECP(level, text, X) \ + mbedtls_debug_print_ecp(ssl, level, __FILE__, __LINE__, text, X) +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if !defined(MBEDTLS_X509_REMOVE_INFO) +#define MBEDTLS_SSL_DEBUG_CRT(level, text, crt) \ + mbedtls_debug_print_crt(ssl, level, __FILE__, __LINE__, text, crt) +#else +#define MBEDTLS_SSL_DEBUG_CRT(level, text, crt) do { } while (0) +#endif /* MBEDTLS_X509_REMOVE_INFO */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_SSL_DEBUG_ECDH(level, ecdh, attr) \ + mbedtls_debug_printf_ecdh(ssl, level, __FILE__, __LINE__, ecdh, attr) +#endif + +#else /* MBEDTLS_DEBUG_C */ + +#define MBEDTLS_SSL_DEBUG_MSG(level, args) do { } while (0) +#define MBEDTLS_SSL_DEBUG_RET(level, text, ret) do { } while (0) +#define MBEDTLS_SSL_DEBUG_BUF(level, text, buf, len) do { } while (0) +#define MBEDTLS_SSL_DEBUG_MPI(level, text, X) do { } while (0) +#define MBEDTLS_SSL_DEBUG_ECP(level, text, X) do { } while (0) +#define MBEDTLS_SSL_DEBUG_CRT(level, text, crt) do { } while (0) +#define MBEDTLS_SSL_DEBUG_ECDH(level, ecdh, attr) do { } while (0) + +#endif /* MBEDTLS_DEBUG_C */ + +/** + * \def MBEDTLS_PRINTF_ATTRIBUTE + * + * Mark a function as having printf attributes, and thus enable checking + * via -wFormat and other flags. This does nothing on builds with compilers + * that do not support the format attribute + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if defined(__has_attribute) +#if __has_attribute(format) +#if defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((__format__(gnu_printf, string_index, first_to_check))) +#else /* defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((format(printf, string_index, first_to_check))) +#endif +#else /* __has_attribute(format) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif /* __has_attribute(format) */ +#else /* defined(__has_attribute) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif + +/** + * \def MBEDTLS_PRINTF_SIZET + * + * MBEDTLS_PRINTF_xxx: Due to issues with older window compilers + * and MinGW we need to define the printf specifier for size_t + * and long long per platform. + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER < 1900) + #include + #define MBEDTLS_PRINTF_SIZET PRIuPTR + #define MBEDTLS_PRINTF_LONGLONG PRId64 +#else \ + /* defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER < 1900) */ + #define MBEDTLS_PRINTF_SIZET "zu" + #define MBEDTLS_PRINTF_LONGLONG "lld" +#endif \ + /* defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER < 1900) */ + +#if !defined(MBEDTLS_PRINTF_MS_TIME) +#include +#if !defined(PRId64) +#define MBEDTLS_PRINTF_MS_TIME MBEDTLS_PRINTF_LONGLONG +#else +#define MBEDTLS_PRINTF_MS_TIME PRId64 +#endif +#endif /* MBEDTLS_PRINTF_MS_TIME */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Set the threshold error level to handle globally all debug output. + * Debug messages that have a level over the threshold value are + * discarded. + * (Default value: 0 = No debug ) + * + * \param threshold threshold level of messages to filter on. Messages at a + * higher level will be discarded. + * - Debug levels + * - 0 No debug + * - 1 Error + * - 2 State change + * - 3 Informational + * - 4 Verbose + */ +void mbedtls_debug_set_threshold(int threshold); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_DEBUG_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/des.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/des.h new file mode 100644 index 00000000..2b097a13 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/des.h @@ -0,0 +1,385 @@ +/** + * \file des.h + * + * \brief DES block cipher + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + * + */ +#ifndef MBEDTLS_DES_H +#define MBEDTLS_DES_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include +#include + +#define MBEDTLS_DES_ENCRYPT 1 +#define MBEDTLS_DES_DECRYPT 0 + +/** The data input has an invalid length. */ +#define MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH -0x0032 + +#define MBEDTLS_DES_KEY_SIZE 8 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DES_ALT) +// Regular implementation +// + +/** + * \brief DES context structure + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +typedef struct mbedtls_des_context { + uint32_t MBEDTLS_PRIVATE(sk)[32]; /*!< DES subkeys */ +} +mbedtls_des_context; + +/** + * \brief Triple-DES context structure + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +typedef struct mbedtls_des3_context { + uint32_t MBEDTLS_PRIVATE(sk)[96]; /*!< 3DES subkeys */ +} +mbedtls_des3_context; + +#else /* MBEDTLS_DES_ALT */ +#include "des_alt.h" +#endif /* MBEDTLS_DES_ALT */ + +/** + * \brief Initialize DES context + * + * \param ctx DES context to be initialized + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_init(mbedtls_des_context *ctx); + +/** + * \brief Clear DES context + * + * \param ctx DES context to be cleared + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_free(mbedtls_des_context *ctx); + +/** + * \brief Initialize Triple-DES context + * + * \param ctx DES3 context to be initialized + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des3_init(mbedtls_des3_context *ctx); + +/** + * \brief Clear Triple-DES context + * + * \param ctx DES3 context to be cleared + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des3_free(mbedtls_des3_context *ctx); + +/** + * \brief Set key parity on the given key to odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_key_set_parity(unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +/** + * \brief Check that key parity on the given key is odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \return 0 is parity was ok, 1 if parity was not correct. + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_key_parity(const unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +/** + * \brief Check that key is not a weak or semi-weak DES key + * + * \param key 8-byte secret key + * + * \return 0 if no weak key was found, 1 if a weak key was identified. + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_weak(const unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +/** + * \brief DES key schedule (56-bit, encryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_enc(mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +/** + * \brief DES key schedule (56-bit, decryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_dec(mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +/** + * \brief Triple-DES key schedule (112-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_enc(mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2]); + +/** + * \brief Triple-DES key schedule (112-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_dec(mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2]); + +/** + * \brief Triple-DES key schedule (168-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_enc(mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3]); + +/** + * \brief Triple-DES key schedule (168-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_dec(mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3]); + +/** + * \brief DES-ECB block encryption/decryption + * + * \param ctx DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_ecb(mbedtls_des_context *ctx, + const unsigned char input[8], + unsigned char output[8]); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_cbc(mbedtls_des_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief 3DES-ECB block encryption/decryption + * + * \param ctx 3DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_ecb(mbedtls_des3_context *ctx, + const unsigned char input[8], + unsigned char output[8]); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief 3DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx 3DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \return 0 if successful, or MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_cbc(mbedtls_des3_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief Internal function for key expansion. + * (Only exposed to allow overriding it, + * see MBEDTLS_DES_SETKEY_ALT) + * + * \param SK Round keys + * \param key Base key + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_setkey(uint32_t SK[32], + const unsigned char key[MBEDTLS_DES_KEY_SIZE]); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_des_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* des.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/dhm.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/dhm.h new file mode 100644 index 00000000..bbfe6ea8 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/dhm.h @@ -0,0 +1,972 @@ +/** + * \file dhm.h + * + * \brief This file contains Diffie-Hellman-Merkle (DHM) key exchange + * definitions and functions. + * + * Diffie-Hellman-Merkle (DHM) key exchange is defined in + * RFC-2631: Diffie-Hellman Key Agreement Method and + * Public-Key Cryptography Standards (PKCS) #3: Diffie + * Hellman Key Agreement Standard. + * + * RFC-3526: More Modular Exponential (MODP) Diffie-Hellman groups for + * Internet Key Exchange (IKE) defines a number of standardized + * Diffie-Hellman groups for IKE. + * + * RFC-5114: Additional Diffie-Hellman Groups for Use with IETF + * Standards defines a number of standardized Diffie-Hellman + * groups that can be used. + * + * \warning The security of the DHM key exchange relies on the proper choice + * of prime modulus - optimally, it should be a safe prime. The usage + * of non-safe primes both decreases the difficulty of the underlying + * discrete logarithm problem and can lead to small subgroup attacks + * leaking private exponent bits when invalid public keys are used + * and not detected. This is especially relevant if the same DHM + * parameters are reused for multiple key exchanges as in static DHM, + * while the criticality of small-subgroup attacks is lower for + * ephemeral DHM. + * + * \warning For performance reasons, the code does neither perform primality + * nor safe primality tests, nor the expensive checks for invalid + * subgroups. Moreover, even if these were performed, non-standardized + * primes cannot be trusted because of the possibility of backdoors + * that can't be effectively checked for. + * + * \warning Diffie-Hellman-Merkle is therefore a security risk when not using + * standardized primes generated using a trustworthy ("nothing up + * my sleeve") method, such as the RFC 3526 / 7919 primes. In the TLS + * protocol, DH parameters need to be negotiated, so using the default + * primes systematically is not always an option. If possible, use + * Elliptic Curve Diffie-Hellman (ECDH), which has better performance, + * and for which the TLS protocol mandates the use of standard + * parameters. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_DHM_H +#define MBEDTLS_DHM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/bignum.h" + +/* + * DHM Error codes + */ +/** Bad input parameters. */ +#define MBEDTLS_ERR_DHM_BAD_INPUT_DATA -0x3080 +/** Reading of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_READ_PARAMS_FAILED -0x3100 +/** Making of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED -0x3180 +/** Reading of the public values failed. */ +#define MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED -0x3200 +/** Making of the public value failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED -0x3280 +/** Calculation of the DHM secret failed. */ +#define MBEDTLS_ERR_DHM_CALC_SECRET_FAILED -0x3300 +/** The ASN.1 data is not formatted correctly. */ +#define MBEDTLS_ERR_DHM_INVALID_FORMAT -0x3380 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_DHM_ALLOC_FAILED -0x3400 +/** Read or write of file failed. */ +#define MBEDTLS_ERR_DHM_FILE_IO_ERROR -0x3480 +/** Setting the modulus and generator failed. */ +#define MBEDTLS_ERR_DHM_SET_GROUP_FAILED -0x3580 + +/** Which parameter to access in mbedtls_dhm_get_value(). */ +typedef enum { + MBEDTLS_DHM_PARAM_P, /*!< The prime modulus. */ + MBEDTLS_DHM_PARAM_G, /*!< The generator. */ + MBEDTLS_DHM_PARAM_X, /*!< Our secret value. */ + MBEDTLS_DHM_PARAM_GX, /*!< Our public key = \c G^X mod \c P. */ + MBEDTLS_DHM_PARAM_GY, /*!< The public key of the peer = \c G^Y mod \c P. */ + MBEDTLS_DHM_PARAM_K, /*!< The shared secret = \c G^(XY) mod \c P. */ +} mbedtls_dhm_parameter; + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DHM_ALT) + +/** + * \brief The DHM context structure. + */ +typedef struct mbedtls_dhm_context { + mbedtls_mpi MBEDTLS_PRIVATE(P); /*!< The prime modulus. */ + mbedtls_mpi MBEDTLS_PRIVATE(G); /*!< The generator. */ + mbedtls_mpi MBEDTLS_PRIVATE(X); /*!< Our secret value. */ + mbedtls_mpi MBEDTLS_PRIVATE(GX); /*!< Our public key = \c G^X mod \c P. */ + mbedtls_mpi MBEDTLS_PRIVATE(GY); /*!< The public key of the peer = \c G^Y mod \c P. */ + mbedtls_mpi MBEDTLS_PRIVATE(K); /*!< The shared secret = \c G^(XY) mod \c P. */ + mbedtls_mpi MBEDTLS_PRIVATE(RP); /*!< The cached value = \c R^2 mod \c P. */ + mbedtls_mpi MBEDTLS_PRIVATE(Vi); /*!< The blinding value. */ + mbedtls_mpi MBEDTLS_PRIVATE(Vf); /*!< The unblinding value. */ + mbedtls_mpi MBEDTLS_PRIVATE(pX); /*!< The previous \c X. */ +} +mbedtls_dhm_context; + +#else /* MBEDTLS_DHM_ALT */ +#include "dhm_alt.h" +#endif /* MBEDTLS_DHM_ALT */ + +/** + * \brief This function initializes the DHM context. + * + * \param ctx The DHM context to initialize. + */ +void mbedtls_dhm_init(mbedtls_dhm_context *ctx); + +/** + * \brief This function parses the DHM parameters in a + * TLS ServerKeyExchange handshake message + * (DHM modulus, generator, and public key). + * + * \note In a TLS handshake, this is the how the client + * sets up its DHM context from the server's public + * DHM key material. + * + * \param ctx The DHM context to use. This must be initialized. + * \param p On input, *p must be the start of the input buffer. + * On output, *p is updated to point to the end of the data + * that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_params(mbedtls_dhm_context *ctx, + unsigned char **p, + const unsigned char *end); + +/** + * \brief This function generates a DHM key pair and exports its + * public part together with the DHM parameters in the format + * used in a TLS ServerKeyExchange handshake message. + * + * \note This function assumes that the DHM parameters \c ctx->P + * and \c ctx->G have already been properly set. For that, use + * mbedtls_dhm_set_group() below in conjunction with + * mbedtls_mpi_read_binary() and mbedtls_mpi_read_string(). + * + * \note In a TLS handshake, this is the how the server generates + * and exports its DHM key material. + * + * \param ctx The DHM context to use. This must be initialized + * and have the DHM parameters set. It may or may not + * already have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param olen The address at which to store the number of Bytes + * written on success. This must not be \c NULL. + * \param output The destination buffer. This must be a writable buffer of + * sufficient size to hold the reduced binary presentation of + * the modulus, the generator and the public key, each wrapped + * with a 2-byte length field. It is the responsibility of the + * caller to ensure that enough space is available. Refer to + * mbedtls_mpi_size() to computing the byte-size of an MPI. + * \param f_rng The RNG function. Must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_params(mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function sets the prime modulus and generator. + * + * \note This function can be used to set \c ctx->P, \c ctx->G + * in preparation for mbedtls_dhm_make_params(). + * + * \param ctx The DHM context to configure. This must be initialized. + * \param P The MPI holding the DHM prime modulus. This must be + * an initialized MPI. + * \param G The MPI holding the DHM generator. This must be an + * initialized MPI. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_set_group(mbedtls_dhm_context *ctx, + const mbedtls_mpi *P, + const mbedtls_mpi *G); + +/** + * \brief This function imports the raw public value of the peer. + * + * \note In a TLS handshake, this is the how the server imports + * the Client's public DHM key. + * + * \param ctx The DHM context to use. This must be initialized and have + * its DHM parameters set, e.g. via mbedtls_dhm_set_group(). + * It may or may not already have generated its own private key. + * \param input The input buffer containing the \c G^Y value of the peer. + * This must be a readable buffer of size \p ilen Bytes. + * \param ilen The size of the input buffer \p input in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_public(mbedtls_dhm_context *ctx, + const unsigned char *input, size_t ilen); + +/** + * \brief This function creates a DHM key pair and exports + * the raw public key in big-endian format. + * + * \note The destination buffer is always fully written + * so as to contain a big-endian representation of G^X mod P. + * If it is larger than \c ctx->len, it is padded accordingly + * with zero-bytes at the beginning. + * + * \param ctx The DHM context to use. This must be initialized and + * have the DHM parameters set. It may or may not already + * have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param output The destination buffer. This must be a writable buffer of + * size \p olen Bytes. + * \param olen The length of the destination buffer. This must be at least + * equal to `ctx->len` (the size of \c P). + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_public(mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function derives and exports the shared secret + * \c (G^Y)^X mod \c P. + * + * \note If \p f_rng is not \c NULL, it is used to blind the input as + * a countermeasure against timing attacks. Blinding is used + * only if our private key \c X is re-used, and not used + * otherwise. We recommend always passing a non-NULL + * \p f_rng argument. + * + * \param ctx The DHM context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param output The buffer to write the generated shared key to. This + * must be a writable buffer of size \p output_size Bytes. + * \param output_size The size of the destination buffer. This must be at + * least the size of \c ctx->len (the size of \c P). + * \param olen On exit, holds the actual number of Bytes written. + * \param f_rng The RNG function. Must not be \c NULL. Used for + * blinding. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_calc_secret(mbedtls_dhm_context *ctx, + unsigned char *output, size_t output_size, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function returns the size of the prime modulus in bits. + * + * \param ctx The DHM context to query. + * + * \return The size of the prime modulus in bits, + * i.e. the number n such that 2^(n-1) <= P < 2^n. + */ +size_t mbedtls_dhm_get_bitlen(const mbedtls_dhm_context *ctx); + +/** + * \brief This function returns the size of the prime modulus in bytes. + * + * \param ctx The DHM context to query. + * + * \return The size of the prime modulus in bytes, + * i.e. the number n such that 2^(8*(n-1)) <= P < 2^(8*n). + */ +size_t mbedtls_dhm_get_len(const mbedtls_dhm_context *ctx); + +/** + * \brief This function copies a parameter of a DHM key. + * + * \param ctx The DHM context to query. + * \param param The parameter to copy. + * \param dest The MPI object to copy the value into. It must be + * initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. + * \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. + */ +int mbedtls_dhm_get_value(const mbedtls_dhm_context *ctx, + mbedtls_dhm_parameter param, + mbedtls_mpi *dest); + +/** + * \brief This function frees and clears the components + * of a DHM context. + * + * \param ctx The DHM context to free and clear. This may be \c NULL, + * in which case this function is a no-op. If it is not \c NULL, + * it must point to an initialized DHM context. + */ +void mbedtls_dhm_free(mbedtls_dhm_context *ctx); + +#if defined(MBEDTLS_ASN1_PARSE_C) +/** + * \brief This function parses DHM parameters in PEM or DER format. + * + * \param dhm The DHM context to import the DHM parameters into. + * This must be initialized. + * \param dhmin The input buffer. This must be a readable buffer of + * length \p dhminlen Bytes. + * \param dhminlen The size of the input buffer \p dhmin, including the + * terminating \c NULL Byte for PEM data. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX error + * code on failure. + */ +int mbedtls_dhm_parse_dhm(mbedtls_dhm_context *dhm, const unsigned char *dhmin, + size_t dhminlen); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function loads and parses DHM parameters from a file. + * + * \param dhm The DHM context to load the parameters to. + * This must be initialized. + * \param path The filename to read the DHM parameters from. + * This must not be \c NULL. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX + * error code on failure. + */ +int mbedtls_dhm_parse_dhmfile(mbedtls_dhm_context *dhm, const char *path); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_ASN1_PARSE_C */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The DMH checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_dhm_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ +#ifdef __cplusplus +} +#endif + +/** + * RFC 3526, RFC 5114 and RFC 7919 standardize a number of + * Diffie-Hellman groups, some of which are included here + * for use within the SSL/TLS module and the user's convenience + * when configuring the Diffie-Hellman parameters by hand + * through \c mbedtls_ssl_conf_dh_param. + * + * The following lists the source of the above groups in the standards: + * - RFC 5114 section 2.2: 2048-bit MODP Group with 224-bit Prime Order Subgroup + * - RFC 3526 section 3: 2048-bit MODP Group + * - RFC 3526 section 4: 3072-bit MODP Group + * - RFC 3526 section 5: 4096-bit MODP Group + * - RFC 7919 section A.1: ffdhe2048 + * - RFC 7919 section A.2: ffdhe3072 + * - RFC 7919 section A.3: ffdhe4096 + * - RFC 7919 section A.4: ffdhe6144 + * - RFC 7919 section A.5: ffdhe8192 + * + * The constants with suffix "_p" denote the chosen prime moduli, while + * the constants with suffix "_g" denote the chosen generator + * of the associated prime field. + * + * The constants further suffixed with "_bin" are provided in binary format, + * while all other constants represent null-terminated strings holding the + * hexadecimal presentation of the respective numbers. + * + * The primes from RFC 3526 and RFC 7919 have been generating by the following + * trust-worthy procedure: + * - Fix N in { 2048, 3072, 4096, 6144, 8192 } and consider the N-bit number + * the first and last 64 bits are all 1, and the remaining N - 128 bits of + * which are 0x7ff...ff. + * - Add the smallest multiple of the first N - 129 bits of the binary expansion + * of pi (for RFC 5236) or e (for RFC 7919) to this intermediate bit-string + * such that the resulting integer is a safe-prime. + * - The result is the respective RFC 3526 / 7919 prime, and the corresponding + * generator is always chosen to be 2 (which is a square for these prime, + * hence the corresponding subgroup has order (p-1)/2 and avoids leaking a + * bit in the private exponent). + * + */ + +/* + * Trustworthy DHM parameters in binary form + */ + +#define MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x3A, 0xD2, 0xCA, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01, \ + 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7, \ + 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26, \ + 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C, \ + 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA, \ + 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8, \ + 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9, \ + 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6, \ + 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D, \ + 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2, \ + 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED, \ + 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF, \ + 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C, \ + 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9, \ + 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1, \ + 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F, \ + 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0xC6, 0x2E, 0x37, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x65, 0x5F, 0x6A, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xD0, 0xE4, 0x0E, 0x65, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xCF, 0xF4, 0x6A, 0xAA, \ + 0x36, 0xAD, 0x00, 0x4C, 0xF6, 0x00, 0xC8, 0x38, \ + 0x1E, 0x42, 0x5A, 0x31, 0xD9, 0x51, 0xAE, 0x64, \ + 0xFD, 0xB2, 0x3F, 0xCE, 0xC9, 0x50, 0x9D, 0x43, \ + 0x68, 0x7F, 0xEB, 0x69, 0xED, 0xD1, 0xCC, 0x5E, \ + 0x0B, 0x8C, 0xC3, 0xBD, 0xF6, 0x4B, 0x10, 0xEF, \ + 0x86, 0xB6, 0x31, 0x42, 0xA3, 0xAB, 0x88, 0x29, \ + 0x55, 0x5B, 0x2F, 0x74, 0x7C, 0x93, 0x26, 0x65, \ + 0xCB, 0x2C, 0x0F, 0x1C, 0xC0, 0x1B, 0xD7, 0x02, \ + 0x29, 0x38, 0x88, 0x39, 0xD2, 0xAF, 0x05, 0xE4, \ + 0x54, 0x50, 0x4A, 0xC7, 0x8B, 0x75, 0x82, 0x82, \ + 0x28, 0x46, 0xC0, 0xBA, 0x35, 0xC3, 0x5F, 0x5C, \ + 0x59, 0x16, 0x0C, 0xC0, 0x46, 0xFD, 0x82, 0x51, \ + 0x54, 0x1F, 0xC6, 0x8C, 0x9C, 0x86, 0xB0, 0x22, \ + 0xBB, 0x70, 0x99, 0x87, 0x6A, 0x46, 0x0E, 0x74, \ + 0x51, 0xA8, 0xA9, 0x31, 0x09, 0x70, 0x3F, 0xEE, \ + 0x1C, 0x21, 0x7E, 0x6C, 0x38, 0x26, 0xE5, 0x2C, \ + 0x51, 0xAA, 0x69, 0x1E, 0x0E, 0x42, 0x3C, 0xFC, \ + 0x99, 0xE9, 0xE3, 0x16, 0x50, 0xC1, 0x21, 0x7B, \ + 0x62, 0x48, 0x16, 0xCD, 0xAD, 0x9A, 0x95, 0xF9, \ + 0xD5, 0xB8, 0x01, 0x94, 0x88, 0xD9, 0xC0, 0xA0, \ + 0xA1, 0xFE, 0x30, 0x75, 0xA5, 0x77, 0xE2, 0x31, \ + 0x83, 0xF8, 0x1D, 0x4A, 0x3F, 0x2F, 0xA4, 0x57, \ + 0x1E, 0xFC, 0x8C, 0xE0, 0xBA, 0x8A, 0x4F, 0xE8, \ + 0xB6, 0x85, 0x5D, 0xFE, 0x72, 0xB0, 0xA6, 0x6E, \ + 0xDE, 0xD2, 0xFB, 0xAB, 0xFB, 0xE5, 0x8A, 0x30, \ + 0xFA, 0xFA, 0xBE, 0x1C, 0x5D, 0x71, 0xA8, 0x7E, \ + 0x2F, 0x74, 0x1E, 0xF8, 0xC1, 0xFE, 0x86, 0xFE, \ + 0xA6, 0xBB, 0xFD, 0xE5, 0x30, 0x67, 0x7F, 0x0D, \ + 0x97, 0xD1, 0x1D, 0x49, 0xF7, 0xA8, 0x44, 0x3D, \ + 0x08, 0x22, 0xE5, 0x06, 0xA9, 0xF4, 0x61, 0x4E, \ + 0x01, 0x1E, 0x2A, 0x94, 0x83, 0x8F, 0xF8, 0x8C, \ + 0xD6, 0x8C, 0x8B, 0xB7, 0xC5, 0xC6, 0x42, 0x4C, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_G_BIN { 0x02 } + +#endif /* dhm.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdh.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdh.h new file mode 100644 index 00000000..e81d5c3a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdh.h @@ -0,0 +1,454 @@ +/** + * \file ecdh.h + * + * \brief This file contains ECDH definitions and functions. + * + * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous + * key agreement protocol allowing two parties to establish a shared + * secret over an insecure channel. Each party must have an + * elliptic-curve public private key pair. + * + * For more information, see NIST SP 800-56A Rev. 2: Recommendation for + * Pair-Wise Key Establishment Schemes Using Discrete Logarithm + * Cryptography. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_ECDH_H +#define MBEDTLS_ECDH_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/ecp.h" + +/* + * Mbed TLS supports two formats for ECDH contexts (#mbedtls_ecdh_context + * defined in `ecdh.h`). For most applications, the choice of format makes + * no difference, since all library functions can work with either format, + * except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE. + + * The new format used when this option is disabled is smaller + * (56 bytes on a 32-bit platform). In future versions of the library, it + * will support alternative implementations of ECDH operations. + * The new format is incompatible with applications that access + * context fields directly and with restartable ECP operations. + */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) +#define MBEDTLS_ECDH_LEGACY_CONTEXT +#else +#undef MBEDTLS_ECDH_LEGACY_CONTEXT +#endif + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) +#undef MBEDTLS_ECDH_LEGACY_CONTEXT +#include "everest/everest.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Defines the source of the imported EC key. + */ +typedef enum { + MBEDTLS_ECDH_OURS, /**< Our key. */ + MBEDTLS_ECDH_THEIRS, /**< The key of the peer. */ +} mbedtls_ecdh_side; + +#if !defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +/** + * Defines the ECDH implementation used. + * + * Later versions of the library may add new variants, therefore users should + * not make any assumptions about them. + */ +typedef enum { + MBEDTLS_ECDH_VARIANT_NONE = 0, /*!< Implementation not defined. */ + MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0,/*!< The default Mbed TLS implementation */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + MBEDTLS_ECDH_VARIANT_EVEREST /*!< Everest implementation */ +#endif +} mbedtls_ecdh_variant; + +/** + * The context used by the default ECDH implementation. + * + * Later versions might change the structure of this context, therefore users + * should not make any assumptions about the structure of + * mbedtls_ecdh_context_mbed. + */ +typedef struct mbedtls_ecdh_context_mbed { + mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /*!< The elliptic curve used. */ + mbedtls_mpi MBEDTLS_PRIVATE(d); /*!< The private key. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Q); /*!< The public key. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Qp); /*!< The value of the public key of the peer. */ + mbedtls_mpi MBEDTLS_PRIVATE(z); /*!< The shared secret. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(rs); /*!< The restart context for EC computations. */ +#endif +} mbedtls_ecdh_context_mbed; +#endif + +/** + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + * \brief The ECDH context structure. + */ +typedef struct mbedtls_ecdh_context { +#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT) + mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /*!< The elliptic curve used. */ + mbedtls_mpi MBEDTLS_PRIVATE(d); /*!< The private key. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Q); /*!< The public key. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Qp); /*!< The value of the public key of the peer. */ + mbedtls_mpi MBEDTLS_PRIVATE(z); /*!< The shared secret. */ + int MBEDTLS_PRIVATE(point_format); /*!< The format of point export in TLS messages. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Vi); /*!< The blinding value. */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Vf); /*!< The unblinding value. */ + mbedtls_mpi MBEDTLS_PRIVATE(_d); /*!< The previous \p d. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + int MBEDTLS_PRIVATE(restart_enabled); /*!< The flag for restartable mode. */ + mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(rs); /*!< The restart context for EC computations. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#else + uint8_t MBEDTLS_PRIVATE(point_format); /*!< The format of point export in TLS messages + as defined in RFC 4492. */ + mbedtls_ecp_group_id MBEDTLS_PRIVATE(grp_id);/*!< The elliptic curve used. */ + mbedtls_ecdh_variant MBEDTLS_PRIVATE(var); /*!< The ECDH implementation/structure used. */ + union { + mbedtls_ecdh_context_mbed MBEDTLS_PRIVATE(mbed_ecdh); +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + mbedtls_ecdh_context_everest MBEDTLS_PRIVATE(everest_ecdh); +#endif + } MBEDTLS_PRIVATE(ctx); /*!< Implementation-specific context. The + context in use is specified by the \c var + field. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + uint8_t MBEDTLS_PRIVATE(restart_enabled); /*!< The flag for restartable mode. Functions of + an alternative implementation not supporting + restartable mode must return + MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED error + if this flag is set. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_ECDH_LEGACY_CONTEXT */ +} +mbedtls_ecdh_context; + +/** + * \brief Return the ECP group for provided context. + * + * \note To access group specific fields, users should use + * `mbedtls_ecp_curve_info_from_grp_id` or + * `mbedtls_ecp_group_load` on the extracted `group_id`. + * + * \param ctx The ECDH context to parse. This must not be \c NULL. + * + * \return The \c mbedtls_ecp_group_id of the context. + */ +mbedtls_ecp_group_id mbedtls_ecdh_get_grp_id(mbedtls_ecdh_context *ctx); + +/** + * \brief Check whether a given group can be used for ECDH. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdh_can_do(mbedtls_ecp_group_id gid); + +/** + * \brief This function generates an ECDH keypair on an elliptic + * curve. + * + * This function performs the first of two core computations + * implemented during the ECDH key exchange. The second core + * computation is performed by mbedtls_ecdh_compute_shared(). + * + * \see ecp.h + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param d The destination MPI (private key). + * This must be initialized. + * \param Q The destination point (public key). + * This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_gen_public(mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function computes the shared secret. + * + * This function performs the second of two core computations + * implemented during the ECDH key exchange. The first core + * computation is performed by mbedtls_ecdh_gen_public(). + * + * \see ecp.h + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param z The destination MPI (shared secret). + * This must be initialized. + * \param Q The public key from another party. + * This must be initialized. + * \param d Our secret exponent (private key). + * This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a + * context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_compute_shared(mbedtls_ecp_group *grp, mbedtls_mpi *z, + const mbedtls_ecp_point *Q, const mbedtls_mpi *d, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function initializes an ECDH context. + * + * \param ctx The ECDH context to initialize. This must not be \c NULL. + */ +void mbedtls_ecdh_init(mbedtls_ecdh_context *ctx); + +/** + * \brief This function sets up the ECDH context with the information + * given. + * + * This function should be called after mbedtls_ecdh_init() but + * before mbedtls_ecdh_make_params(). There is no need to call + * this function before mbedtls_ecdh_read_params(). + * + * This is the first function used by a TLS server for ECDHE + * ciphersuites. + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param grp_id The group id of the group to set up the context for. + * + * \return \c 0 on success. + */ +int mbedtls_ecdh_setup(mbedtls_ecdh_context *ctx, + mbedtls_ecp_group_id grp_id); + +/** + * \brief This function frees a context. + * + * \param ctx The context to free. This may be \c NULL, in which + * case this function does nothing. If it is not \c NULL, + * it must point to an initialized ECDH context. + */ +void mbedtls_ecdh_free(mbedtls_ecdh_context *ctx); + +/** + * \brief This function generates an EC key pair and exports its + * in the format used in a TLS ServerKeyExchange handshake + * message. + * + * This is the second function used by a TLS server for ECDHE + * ciphersuites. (It is called after mbedtls_ecdh_setup().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param olen The address at which to store the number of Bytes written. + * \param buf The destination buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_params(mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function parses the ECDHE parameters in a + * TLS ServerKeyExchange handshake message. + * + * \note In a TLS handshake, this is the how the client + * sets up its ECDHE context from the server's public + * ECDHE key material. + * + * \see ecp.h + * + * \param ctx The ECDHE context to use. This must be initialized. + * \param buf On input, \c *buf must be the start of the input buffer. + * On output, \c *buf is updated to point to the end of the + * data that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_read_params(mbedtls_ecdh_context *ctx, + const unsigned char **buf, + const unsigned char *end); + +/** + * \brief This function sets up an ECDH context from an EC key. + * + * It is used by clients and servers in place of the + * ServerKeyExchange for static ECDH, and imports ECDH + * parameters from the EC key information of a certificate. + * + * \see ecp.h + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param key The EC key to use. This must be initialized. + * \param side Defines the source of the key. Possible values are: + * - #MBEDTLS_ECDH_OURS: The key is ours. + * - #MBEDTLS_ECDH_THEIRS: The key is that of the peer. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_get_params(mbedtls_ecdh_context *ctx, + const mbedtls_ecp_keypair *key, + mbedtls_ecdh_side side); + +/** + * \brief This function generates a public key and exports it + * as a TLS ClientKeyExchange payload. + * + * This is the second function used by a TLS client for ECDH(E) + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, the latter usually by + * mbedtls_ecdh_read_params(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The destination buffer. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The size of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_public(mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function parses and processes the ECDHE payload of a + * TLS ClientKeyExchange message. + * + * This is the third function used by a TLS server for ECDH(E) + * ciphersuites. (It is called after mbedtls_ecdh_setup() and + * mbedtls_ecdh_make_params().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param buf The pointer to the ClientKeyExchange payload. This must + * be a readable buffer of length \p blen Bytes. + * \param blen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_read_public(mbedtls_ecdh_context *ctx, + const unsigned char *buf, size_t blen); + +/** + * \brief This function derives and exports the shared secret. + * + * This is the last function used by both TLS client + * and servers. + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \see ecp.h + + * \param ctx The ECDH context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param olen The address at which to store the total number of + * Bytes written on success. This must not be \c NULL. + * \param buf The buffer to write the generated shared key to. This + * must be a writable buffer of size \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context. This may be \c NULL if \p f_rng + * doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_calc_secret(mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief This function enables restartable EC computations for this + * context. (Default: disabled.) + * + * \see \c mbedtls_ecp_set_max_ops() + * + * \note It is not possible to safely disable restartable + * computations once enabled, except by free-ing the context, + * which cancels possible in-progress operations. + * + * \param ctx The ECDH context to use. This must be initialized. + */ +void mbedtls_ecdh_enable_restart(mbedtls_ecdh_context *ctx); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdh.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdsa.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdsa.h new file mode 100644 index 00000000..c1616615 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecdsa.h @@ -0,0 +1,674 @@ +/** + * \file ecdsa.h + * + * \brief This file contains ECDSA definitions and functions. + * + * The Elliptic Curve Digital Signature Algorithm (ECDSA) is defined in + * Standards for Efficient Cryptography Group (SECG): + * SEC1 Elliptic Curve Cryptography. + * The use of ECDSA for TLS is defined in RFC-4492: Elliptic Curve + * Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_ECDSA_H +#define MBEDTLS_ECDSA_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +/** + * \brief Maximum ECDSA signature size for a given curve bit size + * + * \param bits Curve size in bits + * \return Maximum signature size in bytes + * + * \note This macro returns a compile-time constant if its argument + * is one. It may evaluate its argument multiple times. + */ +/* + * Ecdsa-Sig-Value ::= SEQUENCE { + * r INTEGER, + * s INTEGER + * } + * + * For each of r and s, the value (V) may include an extra initial "0" bit. + */ +#define MBEDTLS_ECDSA_MAX_SIG_LEN(bits) \ + (/*T,L of SEQUENCE*/ ((bits) >= 61 * 8 ? 3 : 2) + \ + /*T,L of r,s*/ 2 * (((bits) >= 127 * 8 ? 3 : 2) + \ + /*V of r,s*/ ((bits) + 8) / 8)) + +/** The maximal size of an ECDSA signature in Bytes. */ +#define MBEDTLS_ECDSA_MAX_LEN MBEDTLS_ECDSA_MAX_SIG_LEN(MBEDTLS_ECP_MAX_BITS) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief The ECDSA context structure. + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + * + * \note pk_wrap module assumes that "ecdsa_context" is identical + * to "ecp_keypair" (see for example structure + * "mbedtls_eckey_info" where ECDSA sign/verify functions + * are used also for EC key) + */ +typedef mbedtls_ecp_keypair mbedtls_ecdsa_context; + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for ecdsa_verify() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_ver mbedtls_ecdsa_restart_ver_ctx; + +/** + * \brief Internal restart context for ecdsa_sign() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_sig mbedtls_ecdsa_restart_sig_ctx; + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +/** + * \brief Internal restart context for ecdsa_sign_det() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_det mbedtls_ecdsa_restart_det_ctx; +#endif + +/** + * \brief General context for resuming ECDSA operations + */ +typedef struct { + mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(ecp); /*!< base context for ECP restart and + shared administrative info */ + mbedtls_ecdsa_restart_ver_ctx *MBEDTLS_PRIVATE(ver); /*!< ecdsa_verify() sub-context */ + mbedtls_ecdsa_restart_sig_ctx *MBEDTLS_PRIVATE(sig); /*!< ecdsa_sign() sub-context */ +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) + mbedtls_ecdsa_restart_det_ctx *MBEDTLS_PRIVATE(det); /*!< ecdsa_sign_det() sub-context */ +#endif +} mbedtls_ecdsa_restart_ctx; + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_ecdsa_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function checks whether a given group can be used + * for ECDSA. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid); + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message. + * + * \note The deterministic version implemented in + * mbedtls_ecdsa_sign_det_ext() is usually preferred. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated + * as defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized. + * \param buf The content to be signed. This is usually the hash of + * the original data to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param f_rng The RNG function, used both to generate the ECDSA nonce + * and for blinding. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX + * or \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdsa_sign(mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s, + const mbedtls_mpi *d, const unsigned char *buf, size_t blen, + mbedtls_f_rng_t *f_rng, void *p_rng); + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, deterministic version. + * + * For more information, see RFC-6979: Deterministic + * Usage of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * \param f_rng_blind The RNG function used for blinding. This must not be + * \c NULL. + * \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + * may be \c NULL if \p f_rng_blind doesn't need a context + * parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det_ext(mbedtls_ecp_group *grp, mbedtls_mpi *r, + mbedtls_mpi *s, const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg, + mbedtls_f_rng_t *f_rng_blind, + void *p_rng_blind); +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +#if !defined(MBEDTLS_ECDSA_SIGN_ALT) +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, in a restartable way. + * + * \note The deterministic version implemented in + * mbedtls_ecdsa_sign_det_restartable() is usually + * preferred. + * + * \note This function is like \c mbedtls_ecdsa_sign() but + * it can return early and restart according to the + * limit set with \c mbedtls_ecp_set_max_ops() to + * reduce blocking. + * + * \note If the bitlength of the message hash is larger + * than the bitlength of the group order, then the + * hash is truncated as defined in Standards for + * Efficient Cryptography Group (SECG): SEC1 Elliptic + * Curve Cryptography, section 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through + * mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param f_rng The RNG function used to generate the ECDSA nonce. + * This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * \param f_rng_blind The RNG function used for blinding. This must not be + * \c NULL. + * \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * \param rs_ctx The restart context to use. This may be \c NULL + * to disable restarting. If it is not \c NULL, it + * must point to an initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c + * mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX, \c + * MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_restartable( + mbedtls_ecp_group *grp, + mbedtls_mpi *r, mbedtls_mpi *s, + const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_f_rng_t *f_rng_blind, + void *p_rng_blind, + mbedtls_ecdsa_restart_ctx *rs_ctx); + +#endif /* !MBEDTLS_ECDSA_SIGN_ALT */ + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, in a restartable way. + * + * \note This function is like \c + * mbedtls_ecdsa_sign_det_ext() but it can return + * early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \note If the bitlength of the message hash is larger + * than the bitlength of the group order, then the + * hash is truncated as defined in Standards for + * Efficient Cryptography Group (SECG): SEC1 Elliptic + * Curve Cryptography, section 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through + * mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * \param f_rng_blind The RNG function used for blinding. This must not be + * \c NULL. + * \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + * \c NULL if \p f_rng_blind doesn't need a context parameter. + * \param rs_ctx The restart context to use. This may be \c NULL + * to disable restarting. If it is not \c NULL, it + * must point to an initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c + * mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX, \c + * MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det_restartable( + mbedtls_ecp_group *grp, + mbedtls_mpi *r, mbedtls_mpi *s, + const mbedtls_mpi *d, const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg, + mbedtls_f_rng_t *f_rng_blind, + void *p_rng_blind, + mbedtls_ecdsa_restart_ctx *rs_ctx); + +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +/** + * \brief This function verifies the ECDSA signature of a + * previously-hashed message. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param buf The hashed content that was signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param Q The public key to use for verification. This must be + * initialized and setup. + * \param r The first integer of the signature. + * This must be initialized. + * \param s The second integer of the signature. + * This must be initialized. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_verify(mbedtls_ecp_group *grp, + const unsigned char *buf, size_t blen, + const mbedtls_ecp_point *Q, const mbedtls_mpi *r, + const mbedtls_mpi *s); + +#if !defined(MBEDTLS_ECDSA_VERIFY_ALT) +/** + * \brief This function verifies the ECDSA signature of a + * previously-hashed message, in a restartable manner + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param buf The hashed content that was signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param Q The public key to use for verification. This must be + * initialized and setup. + * \param r The first integer of the signature. + * This must be initialized. + * \param s The second integer of the signature. + * This must be initialized. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_verify_restartable(mbedtls_ecp_group *grp, + const unsigned char *buf, size_t blen, + const mbedtls_ecp_point *Q, + const mbedtls_mpi *r, + const mbedtls_mpi *s, + mbedtls_ecdsa_restart_ctx *rs_ctx); + +#endif /* !MBEDTLS_ECDSA_VERIFY_ALT */ + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, serialized as defined in RFC-4492: + * Elliptic Curve Cryptography (ECC) Cipher Suites for + * Transport Layer Security (TLS). + * + * \warning It is not thread-safe to use the same context in + * multiple threads. + * + * \note The deterministic version is used if + * #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + * information, see RFC-6979: Deterministic Usage + * of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p hlen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param sig_size The size of the \p sig buffer in bytes. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This is used for blinding. + * If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + * used to generate the ECDSA nonce. + * This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature(mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t sig_size, size_t *slen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, in a restartable way. + * + * \see \c mbedtls_ecdsa_write_signature() + * + * \note This function is like \c mbedtls_ecdsa_write_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p hlen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param sig_size The size of the \p sig buffer in bytes. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This is used for blinding. + * If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + * used to generate the ECDSA nonce. + * This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature_restartable(mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t sig_size, size_t *slen, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_ecdsa_restart_ctx *rs_ctx); + +/** + * \brief This function reads and verifies an ECDSA signature. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p hlen Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature(mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen); + +/** + * \brief This function reads and verifies an ECDSA signature, + * in a restartable way. + * + * \see \c mbedtls_ecdsa_read_signature() + * + * \note This function is like \c mbedtls_ecdsa_read_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p hlen Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature_restartable(mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen, + mbedtls_ecdsa_restart_ctx *rs_ctx); + +/** + * \brief This function generates an ECDSA keypair on the given curve. + * + * \see ecp.h + * + * \param ctx The ECDSA context to store the keypair in. + * This must be initialized. + * \param gid The elliptic curve to use. One of the various + * \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_genkey(mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** + * \brief This function sets up an ECDSA context from an EC key pair. + * + * \see ecp.h + * + * \param ctx The ECDSA context to setup. This must be initialized. + * \param key The EC key to use. This must be initialized and hold + * a private-public key pair or a public key. In the former + * case, the ECDSA context may be used for signature creation + * and verification after this call. In the latter case, it + * may be used for signature verification. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_from_keypair(mbedtls_ecdsa_context *ctx, + const mbedtls_ecp_keypair *key); + +/** + * \brief This function initializes an ECDSA context. + * + * \param ctx The ECDSA context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_init(mbedtls_ecdsa_context *ctx); + +/** + * \brief This function frees an ECDSA context. + * + * \param ctx The ECDSA context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_free(mbedtls_ecdsa_context *ctx); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_restart_init(mbedtls_ecdsa_restart_ctx *ctx); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_restart_free(mbedtls_ecdsa_restart_ctx *ctx); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdsa.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecjpake.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecjpake.h new file mode 100644 index 00000000..7da8cb4e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecjpake.h @@ -0,0 +1,298 @@ +/** + * \file ecjpake.h + * + * \brief Elliptic curve J-PAKE + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_ECJPAKE_H +#define MBEDTLS_ECJPAKE_H +#include "mbedtls/private_access.h" + +/* + * J-PAKE is a password-authenticated key exchange that allows deriving a + * strong shared secret from a (potentially low entropy) pre-shared + * passphrase, with forward secrecy and mutual authentication. + * https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling + * + * This file implements the Elliptic Curve variant of J-PAKE, + * as defined in Chapter 7.4 of the Thread v1.0 Specification, + * available to members of the Thread Group http://threadgroup.org/ + * + * As the J-PAKE algorithm is inherently symmetric, so is our API. + * Each party needs to send its first round message, in any order, to the + * other party, then each sends its second round message, in any order. + * The payloads are serialized in a way suitable for use in TLS, but could + * also be use outside TLS. + */ +#include "mbedtls/build_info.h" + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Roles in the EC J-PAKE exchange + */ +typedef enum { + MBEDTLS_ECJPAKE_CLIENT = 0, /**< Client */ + MBEDTLS_ECJPAKE_SERVER, /**< Server */ + MBEDTLS_ECJPAKE_NONE, /**< Undefined */ +} mbedtls_ecjpake_role; + +#if !defined(MBEDTLS_ECJPAKE_ALT) +/** + * EC J-PAKE context structure. + * + * J-PAKE is a symmetric protocol, except for the identifiers used in + * Zero-Knowledge Proofs, and the serialization of the second message + * (KeyExchange) as defined by the Thread spec. + * + * In order to benefit from this symmetry, we choose a different naming + * convention from the Thread v1.0 spec. Correspondence is indicated in the + * description as a pair C: client name, S: server name + */ +typedef struct mbedtls_ecjpake_context { + mbedtls_md_type_t MBEDTLS_PRIVATE(md_type); /**< Hash to use */ + mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /**< Elliptic curve */ + mbedtls_ecjpake_role MBEDTLS_PRIVATE(role); /**< Are we client or server? */ + int MBEDTLS_PRIVATE(point_format); /**< Format for point export */ + + mbedtls_ecp_point MBEDTLS_PRIVATE(Xm1); /**< My public key 1 C: X1, S: X3 */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Xm2); /**< My public key 2 C: X2, S: X4 */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Xp1); /**< Peer public key 1 C: X3, S: X1 */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Xp2); /**< Peer public key 2 C: X4, S: X2 */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Xp); /**< Peer public key C: Xs, S: Xc */ + + mbedtls_mpi MBEDTLS_PRIVATE(xm1); /**< My private key 1 C: x1, S: x3 */ + mbedtls_mpi MBEDTLS_PRIVATE(xm2); /**< My private key 2 C: x2, S: x4 */ + + mbedtls_mpi MBEDTLS_PRIVATE(s); /**< Pre-shared secret (passphrase) */ +} mbedtls_ecjpake_context; + +#else /* MBEDTLS_ECJPAKE_ALT */ +#include "ecjpake_alt.h" +#endif /* MBEDTLS_ECJPAKE_ALT */ + +/** + * \brief Initialize an ECJPAKE context. + * + * \param ctx The ECJPAKE context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecjpake_init(mbedtls_ecjpake_context *ctx); + +/** + * \brief Set up an ECJPAKE context for use. + * + * \note Currently the only values for hash/curve allowed by the + * standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + * + * \param ctx The ECJPAKE context to set up. This must be initialized. + * \param role The role of the caller. This must be either + * #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + * \param hash The identifier of the hash function to use, + * for example #MBEDTLS_MD_SHA256. + * \param curve The identifier of the elliptic curve to use, + * for example #MBEDTLS_ECP_DP_SECP256R1. + * \param secret The pre-shared secret (passphrase). This must be + * a readable not empty buffer of length \p len Bytes. It need + * only be valid for the duration of this call. + * \param len The length of the pre-shared secret \p secret. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_setup(mbedtls_ecjpake_context *ctx, + mbedtls_ecjpake_role role, + mbedtls_md_type_t hash, + mbedtls_ecp_group_id curve, + const unsigned char *secret, + size_t len); + +/** + * \brief Set the point format for future reads and writes. + * + * \param ctx The ECJPAKE context to configure. + * \param point_format The point format to use: + * #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + * or #MBEDTLS_ECP_PF_COMPRESSED. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + * is invalid. + */ +int mbedtls_ecjpake_set_point_format(mbedtls_ecjpake_context *ctx, + int point_format); + +/** + * \brief Check if an ECJPAKE context is ready for use. + * + * \param ctx The ECJPAKE context to check. This must be + * initialized. + * + * \return \c 0 if the context is ready for use. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + */ +int mbedtls_ecjpake_check(const mbedtls_ecjpake_context *ctx); + +/** + * \brief Generate and write the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be + * initialized and set up. + * \param buf The buffer to write the contents to. This must be a + * writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number + * of Bytes written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_one(mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Read and process the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up. + * \param buf The buffer holding the first round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_one(mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len); + +/** + * \brief Generate and write the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up, and already have performed round one. + * \param buf The buffer to write the round two contents to. + * This must be a writable buffer of length \p len Bytes. + * \param len The size of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_two(mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Read and process the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up and already have performed round one. + * \param buf The buffer holding the second round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_two(mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len); + +/** + * \brief Derive the shared secret + * (TLS: Pre-Master Secret). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up and have performed both round one and two. + * \param buf The buffer to write the derived secret to. This must + * be a writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_derive_secret(mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Write the shared key material to be passed to a Key + * Derivation Function as described in RFC8236. + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up and have performed both round one and two. + * \param buf The buffer to write the derived secret to. This must + * be a writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number of bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_shared_key(mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This clears an ECJPAKE context and frees any + * embedded data structure. + * + * \param ctx The ECJPAKE context to free. This may be \c NULL, + * in which case this function does nothing. If it is not + * \c NULL, it must point to an initialized ECJPAKE context. + */ +void mbedtls_ecjpake_free(mbedtls_ecjpake_context *ctx); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_ecjpake_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* ecjpake.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecp.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecp.h new file mode 100644 index 00000000..5cc02714 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ecp.h @@ -0,0 +1,1528 @@ +/** + * \file ecp.h + * + * \brief This file provides an API for Elliptic Curves over GF(P) (ECP). + * + * The use of ECP in cryptography and TLS is defined in + * Standards for Efficient Cryptography Group (SECG): SEC1 + * Elliptic Curve Cryptography and + * RFC-4492: Elliptic Curve Cryptography (ECC) Cipher Suites + * for Transport Layer Security (TLS). + * + * RFC-2409: The Internet Key Exchange (IKE) defines ECP + * group types. + * + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_ECP_H +#define MBEDTLS_ECP_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include "mbedtls/bignum.h" + +/* + * ECP error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_ECP_BAD_INPUT_DATA -0x4F80 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL -0x4F00 +/** The requested feature is not available, for example, the requested curve is not supported. */ +#define MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE -0x4E80 +/** The signature is not valid. */ +#define MBEDTLS_ERR_ECP_VERIFY_FAILED -0x4E00 +/** Memory allocation failed. */ +#define MBEDTLS_ERR_ECP_ALLOC_FAILED -0x4D80 +/** Generation of random value, such as ephemeral key, failed. */ +#define MBEDTLS_ERR_ECP_RANDOM_FAILED -0x4D00 +/** Invalid private or public key. */ +#define MBEDTLS_ERR_ECP_INVALID_KEY -0x4C80 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH -0x4C00 +/** Operation in progress, call again with the same parameters to continue. */ +#define MBEDTLS_ERR_ECP_IN_PROGRESS -0x4B00 + +/* Flags indicating whether to include code that is specific to certain + * types of curves. These flags are for internal library use only. */ +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED +#endif +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ + defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MONTGOMERY_ENABLED +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Domain-parameter identifiers: curve, subgroup, and generator. + * + * \note Only curves over prime fields are supported. + * + * \warning This library does not support validation of arbitrary domain + * parameters. Therefore, only standardized domain parameters from trusted + * sources should be used. See mbedtls_ecp_group_load(). + */ +/* Note: when adding a new curve: + * - Add it at the end of this enum, otherwise you'll break the ABI by + * changing the numerical value for existing curves. + * - Increment MBEDTLS_ECP_DP_MAX below if needed. + * - Update the calculation of MBEDTLS_ECP_MAX_BITS below. + * - Add the corresponding MBEDTLS_ECP_DP_xxx_ENABLED macro definition to + * mbedtls_config.h. + * - List the curve as a dependency of MBEDTLS_ECP_C and + * MBEDTLS_ECDSA_C if supported in check_config.h. + * - Add the curve to the appropriate curve type macro + * MBEDTLS_ECP_yyy_ENABLED above. + * - Add the necessary definitions to ecp_curves.c. + * - Add the curve to the ecp_supported_curves array in ecp.c. + * - Add the curve to applicable profiles in x509_crt.c. + * - Add the curve to applicable presets in ssl_tls.c. + */ +typedef enum { + MBEDTLS_ECP_DP_NONE = 0, /*!< Curve not defined. */ + MBEDTLS_ECP_DP_SECP192R1, /*!< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP224R1, /*!< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP256R1, /*!< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP384R1, /*!< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP521R1, /*!< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_BP256R1, /*!< Domain parameters for 256-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP384R1, /*!< Domain parameters for 384-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP512R1, /*!< Domain parameters for 512-bit Brainpool curve. */ + MBEDTLS_ECP_DP_CURVE25519, /*!< Domain parameters for Curve25519. */ + MBEDTLS_ECP_DP_SECP192K1, /*!< Domain parameters for 192-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP224K1, /*!< Domain parameters for 224-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP256K1, /*!< Domain parameters for 256-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_CURVE448, /*!< Domain parameters for Curve448. */ +} mbedtls_ecp_group_id; + +/** + * The number of supported curves, plus one for #MBEDTLS_ECP_DP_NONE. + */ +#define MBEDTLS_ECP_DP_MAX 14 + +/* + * Curve types + */ +typedef enum { + MBEDTLS_ECP_TYPE_NONE = 0, + MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */ + MBEDTLS_ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */ +} mbedtls_ecp_curve_type; + +/** + * Curve information, for use by other modules. + * + * The fields of this structure are part of the public API and can be + * accessed directly by applications. Future versions of the library may + * add extra fields or reorder existing fields. + */ +typedef struct mbedtls_ecp_curve_info { + mbedtls_ecp_group_id grp_id; /*!< An internal identifier. */ + uint16_t tls_id; /*!< The TLS NamedCurve identifier. */ + uint16_t bit_size; /*!< The curve size in bits. */ + const char *name; /*!< A human-friendly name. */ +} mbedtls_ecp_curve_info; + +/** + * \brief The ECP point structure, in Jacobian coordinates. + * + * \note All functions expect and return points satisfying + * the following condition: Z == 0 or + * Z == 1. Other values of \p Z are + * used only by internal functions. + * The point is zero, or "at infinity", if Z == 0. + * Otherwise, \p X and \p Y are its standard (affine) + * coordinates. + */ +typedef struct mbedtls_ecp_point { + mbedtls_mpi MBEDTLS_PRIVATE(X); /*!< The X coordinate of the ECP point. */ + mbedtls_mpi MBEDTLS_PRIVATE(Y); /*!< The Y coordinate of the ECP point. */ + mbedtls_mpi MBEDTLS_PRIVATE(Z); /*!< The Z coordinate of the ECP point. */ +} +mbedtls_ecp_point; + +#if !defined(MBEDTLS_ECP_ALT) +/* + * default Mbed TLS elliptic curve arithmetic implementation + * + * (in case MBEDTLS_ECP_ALT is defined then the developer has to provide an + * alternative implementation for the whole module and it will replace this + * one.) + */ + +/** + * \brief The ECP group structure. + * + * We consider two types of curve equations: + *
  • Short Weierstrass: y^2 = x^3 + A x + B mod P + * (SEC1 + RFC-4492)
    • + *
  • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, + * Curve448)
+ * In both cases, the generator (\p G) for a prime-order subgroup is fixed. + * + * For Short Weierstrass, this subgroup is the whole curve, and its + * cardinality is denoted by \p N. Our code requires that \p N is an + * odd prime as mbedtls_ecp_mul() requires an odd number, and + * mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. + * + * The default implementation only initializes \p A without setting it to the + * authentic value for curves with A = -3(SECP256R1, etc), in which + * case you need to load \p A by yourself when using domain parameters directly, + * for example: + * \code + * mbedtls_mpi_init(&A); + * mbedtls_ecp_group_init(&grp); + * CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); + * if (mbedtls_ecp_group_a_is_minus_3(&grp)) { + * CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); + * } else { + * CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); + * } + * + * do_something_with_a(&A); + * + * cleanup: + * mbedtls_mpi_free(&A); + * mbedtls_ecp_group_free(&grp); + * \endcode + * + * For Montgomery curves, we do not store \p A, but (A + 2) / 4, + * which is the quantity used in the formulas. Additionally, \p nbits is + * not the size of \p N but the required size for private keys. + * + * If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. + * Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the + * range of 0..2^(2*pbits)-1, and transforms it in-place to an integer + * which is congruent mod \p P to the given MPI, and is close enough to \p pbits + * in size, so that it may be efficiently brought in the 0..P-1 range by a few + * additions or subtractions. Therefore, it is only an approximate modular + * reduction. It must return 0 on success and non-zero on failure. + * + * \note Alternative implementations of the ECP module must obey the + * following constraints. + * * Group IDs must be distinct: if two group structures have + * the same ID, then they must be identical. + * * The fields \c id, \c P, \c A, \c B, \c G, \c N, + * \c pbits and \c nbits must have the same type and semantics + * as in the built-in implementation. + * They must be available for reading, but direct modification + * of these fields does not need to be supported. + * They do not need to be at the same offset in the structure. + */ +typedef struct mbedtls_ecp_group { + mbedtls_ecp_group_id id; /*!< An internal group identifier. */ + mbedtls_mpi P; /*!< The prime modulus of the base field. */ + mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. Note that + \p A is not set to the authentic value in some cases. + Refer to detailed description of ::mbedtls_ecp_group if + using domain parameters in the structure. + For Montgomery curves: (A + 2) / 4. */ + mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation. + For Montgomery curves: unused. */ + mbedtls_ecp_point G; /*!< The generator of the subgroup used. */ + mbedtls_mpi N; /*!< The order of \p G. */ + size_t pbits; /*!< The number of bits in \p P.*/ + size_t nbits; /*!< For Short Weierstrass: The number of bits in \p P. + For Montgomery curves: the number of bits in the + private keys. */ + /* End of public fields */ + + unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if the constants are static. */ + int(*MBEDTLS_PRIVATE(modp))(mbedtls_mpi *); /*!< The function for fast pseudo-reduction + mod \p P (see above).*/ + int(*MBEDTLS_PRIVATE(t_pre))(mbedtls_ecp_point *, void *); /*!< Unused. */ + int(*MBEDTLS_PRIVATE(t_post))(mbedtls_ecp_point *, void *); /*!< Unused. */ + void *MBEDTLS_PRIVATE(t_data); /*!< Unused. */ + mbedtls_ecp_point *MBEDTLS_PRIVATE(T); /*!< Pre-computed points for ecp_mul_comb(). */ + size_t MBEDTLS_PRIVATE(T_size); /*!< The number of dynamic allocated pre-computed points. */ +} +mbedtls_ecp_group; + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h, or define them using the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_ECP_WINDOW_SIZE) +/* + * Maximum "window" size used for point multiplication. + * Default: a point where higher memory usage yields diminishing performance + * returns. + * Minimum value: 2. Maximum value: 7. + * + * Result is an array of at most ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) ) + * points used for point multiplication. This value is directly tied to EC + * peak memory usage, so decreasing it by one should roughly cut memory usage + * by two (if large curves are in use). + * + * Reduction in size may reduce speed, but larger curves are impacted first. + * Sample performances (in ECDHE handshakes/s, with FIXED_POINT_OPTIM = 1): + * w-size: 6 5 4 3 2 + * 521 145 141 135 120 97 + * 384 214 209 198 177 146 + * 256 320 320 303 262 226 + * 224 475 475 453 398 342 + * 192 640 640 633 587 476 + */ +#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< The maximum window size used. */ +#endif /* MBEDTLS_ECP_WINDOW_SIZE */ + +#if !defined(MBEDTLS_ECP_FIXED_POINT_OPTIM) +/* + * Trade code size for speed on fixed-point multiplication. + * + * This speeds up repeated multiplication of the generator (that is, the + * multiplication in ECDSA signatures, and half of the multiplications in + * ECDSA verification and ECDHE) by a factor roughly 3 to 4. + * + * For each n-bit Short Weierstrass curve that is enabled, this adds 4n bytes + * of code size if n < 384 and 8n otherwise. + * + * Change this value to 0 to reduce code size. + */ +#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up. */ +#endif /* MBEDTLS_ECP_FIXED_POINT_OPTIM */ + +/** \} name SECTION: Module settings */ + +#else /* MBEDTLS_ECP_ALT */ +#include "ecp_alt.h" +#endif /* MBEDTLS_ECP_ALT */ + +/** + * The maximum size of the groups, that is, of \c N and \c P. + */ +#if !defined(MBEDTLS_ECP_LIGHT) +/* Dummy definition to help code that has optional ECP support and + * defines an MBEDTLS_ECP_MAX_BYTES-sized array unconditionally. */ +#define MBEDTLS_ECP_MAX_BITS 1 +/* Note: the curves must be listed in DECREASING size! */ +#elif defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 521 +#elif defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 512 +#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 448 +#elif defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 384 +#elif defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 384 +#elif defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 256 +#elif defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 256 +#elif defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 256 +#elif defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 255 +#elif defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 225 // n is slightly above 2^224 +#elif defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 224 +#elif defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 192 +#elif defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS 192 +#else /* !MBEDTLS_ECP_LIGHT */ +#error "Missing definition of MBEDTLS_ECP_MAX_BITS" +#endif /* !MBEDTLS_ECP_LIGHT */ + +#define MBEDTLS_ECP_MAX_BYTES ((MBEDTLS_ECP_MAX_BITS + 7) / 8) +#define MBEDTLS_ECP_MAX_PT_LEN (2 * MBEDTLS_ECP_MAX_BYTES + 1) + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for multiplication + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_mul mbedtls_ecp_restart_mul_ctx; + +/** + * \brief Internal restart context for ecp_muladd() + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_muladd mbedtls_ecp_restart_muladd_ctx; + +/** + * \brief General context for resuming ECC operations + */ +typedef struct { + unsigned MBEDTLS_PRIVATE(ops_done); /*!< current ops count */ + unsigned MBEDTLS_PRIVATE(depth); /*!< call depth (0 = top-level) */ + mbedtls_ecp_restart_mul_ctx *MBEDTLS_PRIVATE(rsm); /*!< ecp_mul_comb() sub-context */ + mbedtls_ecp_restart_muladd_ctx *MBEDTLS_PRIVATE(ma); /*!< ecp_muladd() sub-context */ +} mbedtls_ecp_restart_ctx; + +/* + * Operation counts for restartable functions + */ +#define MBEDTLS_ECP_OPS_CHK 3 /*!< basic ops count for ecp_check_pubkey() */ +#define MBEDTLS_ECP_OPS_DBL 8 /*!< basic ops count for ecp_double_jac() */ +#define MBEDTLS_ECP_OPS_ADD 11 /*!< basic ops count for see ecp_add_mixed() */ +#define MBEDTLS_ECP_OPS_INV 120 /*!< empirical equivalent for mpi_mod_inv() */ + +/** + * \brief Internal; for restartable functions in other modules. + * Check and update basic ops budget. + * + * \param grp Group structure + * \param rs_ctx Restart context + * \param ops Number of basic ops to do + * + * \return \c 0 if doing \p ops basic ops is still allowed, + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS otherwise. + */ +int mbedtls_ecp_check_budget(const mbedtls_ecp_group *grp, + mbedtls_ecp_restart_ctx *rs_ctx, + unsigned ops); + +/* Utility macro for checking and updating ops budget */ +#define MBEDTLS_ECP_BUDGET(ops) \ + MBEDTLS_MPI_CHK(mbedtls_ecp_check_budget(grp, rs_ctx, \ + (unsigned) (ops))); + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +#define MBEDTLS_ECP_BUDGET(ops) /* no-op; for compatibility */ + +/* We want to declare restartable versions of existing functions anyway */ +typedef void mbedtls_ecp_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief The ECP key-pair structure. + * + * A generic key-pair that may be used for ECDSA and fixed ECDH, for example. + * + * \note Members are deliberately in the same order as in the + * ::mbedtls_ecdsa_context structure. + */ +typedef struct mbedtls_ecp_keypair { + mbedtls_ecp_group MBEDTLS_PRIVATE(grp); /*!< Elliptic curve and base point */ + mbedtls_mpi MBEDTLS_PRIVATE(d); /*!< our secret value */ + mbedtls_ecp_point MBEDTLS_PRIVATE(Q); /*!< our public value */ +} +mbedtls_ecp_keypair; + +/** + * The uncompressed point format for Short Weierstrass curves + * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX). + */ +#define MBEDTLS_ECP_PF_UNCOMPRESSED 0 +/** + * The compressed point format for Short Weierstrass curves + * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX). + * + * \warning While this format is supported for all concerned curves for + * writing, when it comes to parsing, it is not supported for all + * curves. Specifically, parsing compressed points on + * MBEDTLS_ECP_DP_SECP224R1 and MBEDTLS_ECP_DP_SECP224K1 is not + * supported. + */ +#define MBEDTLS_ECP_PF_COMPRESSED 1 + +/* + * Some other constants from RFC 4492 + */ +#define MBEDTLS_ECP_TLS_NAMED_CURVE 3 /**< The named_curve of ECCurveType. */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Set the maximum number of basic operations done in a row. + * + * If more operations are needed to complete a computation, + * #MBEDTLS_ERR_ECP_IN_PROGRESS will be returned by the + * function performing the computation. It is then the + * caller's responsibility to either call again with the same + * parameters until it returns 0 or an error code; or to free + * the restart context if the operation is to be aborted. + * + * It is strictly required that all input parameters and the + * restart context be the same on successive calls for the + * same operation, but output parameters need not be the + * same; they must not be used until the function finally + * returns 0. + * + * This only applies to functions whose documentation + * mentions they may return #MBEDTLS_ERR_ECP_IN_PROGRESS (or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS for functions in the + * SSL module). For functions that accept a "restart context" + * argument, passing NULL disables restart and makes the + * function equivalent to the function with the same name + * with \c _restartable removed. For functions in the ECDH + * module, restart is disabled unless the function accepts + * an "ECDH context" argument and + * mbedtls_ecdh_enable_restart() was previously called on + * that context. For function in the SSL module, restart is + * only enabled for specific sides and key exchanges + * (currently only for clients and ECDHE-ECDSA). + * + * \warning Using the PSA interruptible interfaces with keys in local + * storage and no accelerator driver will also call this + * function to set the values specified via those interfaces, + * overwriting values previously set. Care should be taken if + * mixing these two interfaces. + * + * \param max_ops Maximum number of basic operations done in a row. + * Default: 0 (unlimited). + * Lower (non-zero) values mean ECC functions will block for + * a lesser maximum amount of time. + * + * \note A "basic operation" is defined as a rough equivalent of a + * multiplication in GF(p) for the NIST P-256 curve. + * As an indication, with default settings, a scalar + * multiplication (full run of \c mbedtls_ecp_mul()) is: + * - about 3300 basic operations for P-256 + * - about 9400 basic operations for P-384 + * + * \note Very low values are not always respected: sometimes + * functions need to block for a minimum number of + * operations, and will do so even if max_ops is set to a + * lower value. That minimum depends on the curve size, and + * can be made lower by decreasing the value of + * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, here is the + * lowest effective value for various curves and values of + * that parameter (w for short): + * w=6 w=5 w=4 w=3 w=2 + * P-256 208 208 160 136 124 + * P-384 682 416 320 272 248 + * P-521 1364 832 640 544 496 + * + * \note This setting is currently ignored by Curve25519. + */ +void mbedtls_ecp_set_max_ops(unsigned max_ops); + +/** + * \brief Check if restart is enabled (max_ops != 0) + * + * \return \c 0 if \c max_ops == 0 (restart disabled) + * \return \c 1 otherwise (restart enabled) + */ +int mbedtls_ecp_restart_is_enabled(void); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/* + * Get the type of a curve + */ +mbedtls_ecp_curve_type mbedtls_ecp_get_type(const mbedtls_ecp_group *grp); + +/** + * \brief This function retrieves the information defined in + * mbedtls_ecp_curve_info() for all supported curves. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array. The last entry is 0. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list(void); + +/** + * \brief This function retrieves the list of internal group + * identifiers of all supported curves in the order of + * preference. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array, + * terminated with MBEDTLS_ECP_DP_NONE. + */ +const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list(void); + +/** + * \brief This function retrieves curve information from an internal + * group identifier. + * + * \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id(mbedtls_ecp_group_id grp_id); + +/** + * \brief This function retrieves curve information from a TLS + * NamedCurve value. + * + * \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id(uint16_t tls_id); + +/** + * \brief This function retrieves curve information from a + * human-readable name. + * + * \param name The human-readable name. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name(const char *name); + +/** + * \brief This function initializes a point as zero. + * + * \param pt The point to initialize. + */ +void mbedtls_ecp_point_init(mbedtls_ecp_point *pt); + +/** + * \brief This function initializes an ECP group context + * without loading any domain parameters. + * + * \note After this function is called, domain parameters + * for various ECP groups can be loaded through the + * mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + * functions. + */ +void mbedtls_ecp_group_init(mbedtls_ecp_group *grp); + +/** + * \brief This function initializes a key pair as an invalid one. + * + * \param key The key pair to initialize. + */ +void mbedtls_ecp_keypair_init(mbedtls_ecp_keypair *key); + +/** + * \brief This function frees the components of a point. + * + * \param pt The point to free. + */ +void mbedtls_ecp_point_free(mbedtls_ecp_point *pt); + +/** + * \brief This function frees the components of an ECP group. + * + * \param grp The group to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP group. + */ +void mbedtls_ecp_group_free(mbedtls_ecp_group *grp); + +/** + * \brief This function frees the components of a key pair. + * + * \param key The key pair to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP key pair. + */ +void mbedtls_ecp_keypair_free(mbedtls_ecp_keypair *key); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. This must + * not be \c NULL. + */ +void mbedtls_ecp_restart_init(mbedtls_ecp_restart_ctx *ctx); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized restart context. + */ +void mbedtls_ecp_restart_free(mbedtls_ecp_restart_ctx *ctx); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function copies the contents of point \p Q into + * point \p P. + * + * \param P The destination point. This must be initialized. + * \param Q The source point. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code for other kinds of failure. + */ +int mbedtls_ecp_copy(mbedtls_ecp_point *P, const mbedtls_ecp_point *Q); + +/** + * \brief This function copies the contents of group \p src into + * group \p dst. + * + * \param dst The destination group. This must be initialized. + * \param src The source group. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_copy(mbedtls_ecp_group *dst, + const mbedtls_ecp_group *src); + +/** + * \brief This function sets a point to the point at infinity. + * + * \param pt The point to set. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_set_zero(mbedtls_ecp_point *pt); + +/** + * \brief This function checks if a point is the point at infinity. + * + * \param pt The point to test. This must be initialized. + * + * \return \c 1 if the point is zero. + * \return \c 0 if the point is non-zero. + * \return A negative error code on failure. + */ +int mbedtls_ecp_is_zero(mbedtls_ecp_point *pt); + +/** + * \brief This function compares two points. + * + * \note This assumes that the points are normalized. Otherwise, + * they may compare as "not equal" even if they are. + * + * \param P The first point to compare. This must be initialized. + * \param Q The second point to compare. This must be initialized. + * + * \return \c 0 if the points are equal. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + */ +int mbedtls_ecp_point_cmp(const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q); + +/** + * \brief This function imports a non-zero point from two ASCII + * strings. + * + * \param P The destination point. This must be initialized. + * \param radix The numeric base of the input. + * \param x The first affine coordinate, as a null-terminated string. + * \param y The second affine coordinate, as a null-terminated string. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + */ +int mbedtls_ecp_point_read_string(mbedtls_ecp_point *P, int radix, + const char *x, const char *y); + +/** + * \brief This function exports a point into unsigned binary data. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The point to export. This must be initialized. + * \param format The point format. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * (For groups without these formats, this parameter is + * ignored. But it still has to be either of the above + * values.) + * \param olen The address at which to store the length of + * the output in Bytes. This must not be \c NULL. + * \param buf The output buffer. This must be a writable buffer + * of length \p buflen Bytes. + * \param buflen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + * is too small to hold the point. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + * or the export for the given group is not implemented. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_point_write_binary(const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *P, + int format, size_t *olen, + unsigned char *buf, size_t buflen); + +/** + * \brief This function imports a point from unsigned binary data. + * + * \note This function does not check that the point actually + * belongs to the given group, see mbedtls_ecp_check_pubkey() + * for that. + * + * \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + * limitations. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The destination context to import the point to. + * This must be initialized. + * \param buf The input buffer. This must be a readable buffer + * of length \p ilen Bytes. + * \param ilen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + * given group is not implemented. + */ +int mbedtls_ecp_point_read_binary(const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P, + const unsigned char *buf, size_t ilen); + +/** + * \brief This function imports a point from a TLS ECPoint record. + * + * \note On function return, \p *buf is updated to point immediately + * after the ECPoint record. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The destination point. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + * failure. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + */ +int mbedtls_ecp_tls_read_point(const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt, + const unsigned char **buf, size_t len); + +/** + * \brief This function exports a point as a TLS ECPoint record + * defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to be exported. This must be initialized. + * \param format The point format to use. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * \param olen The address at which to store the length in Bytes + * of the data written. + * \param buf The target buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the target buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + * is too small to hold the exported point. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_point(const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt, + int format, size_t *olen, + unsigned char *buf, size_t blen); + +/** + * \brief This function sets up an ECP group context + * from a standardized set of domain parameters. + * + * \note The index should be a value of the NamedCurve enum, + * as defined in RFC-4492: Elliptic Curve Cryptography + * (ECC) Cipher Suites for Transport Layer Security (TLS), + * usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + * + * \param grp The group context to setup. This must be initialized. + * \param id The identifier of the domain parameter set to load. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + * correspond to a known group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_load(mbedtls_ecp_group *grp, mbedtls_ecp_group_id id); + +/** + * \brief This function sets up an ECP group context from a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The group context to setup. This must be initialized. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group(mbedtls_ecp_group *grp, + const unsigned char **buf, size_t len); + +/** + * \brief This function extracts an elliptic curve group ID from a + * TLS ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The address at which to store the group id. + * This must not be \c NULL. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group_id(mbedtls_ecp_group_id *grp, + const unsigned char **buf, + size_t len); +/** + * \brief This function exports an elliptic curve as a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to be exported. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The buffer to write to. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + * buffer is too small to hold the exported group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_group(const mbedtls_ecp_group *grp, + size_t *olen, + unsigned char *buf, size_t blen); + +/** + * \brief This function performs a scalar multiplication of a point + * by an integer: \p R = \p m * \p P. + * + * It is not thread-safe to use same group in multiple threads. + * + * \note To prevent timing attacks, this function + * executes the exact same sequence of base-field + * operations for any valid \p m. It avoids any if-branch or + * array index depending on the value of \p m. It also uses + * \p f_rng to randomize some intermediate results. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c + * NULL if \p f_rng doesn't need a context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** + * \brief This function performs multiplication of a point by + * an integer: \p R = \p m * \p P in a restartable way. + * + * \see mbedtls_ecp_mul() + * + * \note This function does the same as \c mbedtls_ecp_mul(), but + * it can return early and restart according to the limit set + * with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c + * NULL if \p f_rng doesn't need a context. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul_restartable(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + mbedtls_f_rng_t *f_rng, void *p_rng, + mbedtls_ecp_restart_ctx *rs_ctx); + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) +/** + * \brief This function checks if domain parameter A of the curve is + * \c -3. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * + * \return \c 1 if A = -3. + * \return \c 0 Otherwise. + */ +static inline int mbedtls_ecp_group_a_is_minus_3(const mbedtls_ecp_group *grp) +{ + return grp->A.MBEDTLS_PRIVATE(p) == NULL; +} + +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q + * + * It is not thread-safe to use same group in multiple threads. + * + * \note In contrast to mbedtls_ecp_mul(), this function does not + * guarantee a constant execution flow and timing. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q); + +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q in a + * restartable way. + * + * \see \c mbedtls_ecp_muladd() + * + * \note This function works the same as \c mbedtls_ecp_muladd(), + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd_restartable( + mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q, + mbedtls_ecp_restart_ctx *rs_ctx); +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +/** + * \brief This function checks that a point is a valid public key + * on this curve. + * + * It only checks that the point is non-zero, has + * valid coordinates and lies on the curve. It does not verify + * that it is indeed a multiple of \c G. This additional + * check is computationally more expensive, is not required + * by standards, and should not be necessary if the group + * used has a small cofactor. In particular, it is useless for + * the NIST groups which all have a cofactor of 1. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure, to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the point should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to check. This must be initialized. + * + * \return \c 0 if the point is a valid public key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + * a valid public key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_pubkey(const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt); + +/** + * \brief This function checks that an \c mbedtls_mpi is a + * valid private key for this curve. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the private key should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The integer to check. This must be initialized. + * + * \return \c 0 if the point is a valid private key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + * private key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_privkey(const mbedtls_ecp_group *grp, + const mbedtls_mpi *d); + +/** + * \brief This function generates a private key. + * + * \param grp The ECP group to generate a private key for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_privkey(const mbedtls_ecp_group *grp, + mbedtls_mpi *d, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function generates a keypair with a configurable base + * point. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param G The base point to use. This must be initialized + * and belong to \p grp. It replaces the default base + * point \c grp->G used by mbedtls_ecp_gen_keypair(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair_base(mbedtls_ecp_group *grp, + const mbedtls_ecp_point *G, + mbedtls_mpi *d, mbedtls_ecp_point *Q, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function generates an ECP keypair. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair(mbedtls_ecp_group *grp, mbedtls_mpi *d, + mbedtls_ecp_point *Q, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief This function generates an ECP key. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** \brief Set the public key in a key pair object. + * + * \note This function does not check that the point actually + * belongs to the given group. Call mbedtls_ecp_check_pubkey() + * on \p Q before calling this function to check that. + * + * \note This function does not check that the public key matches + * the private key that is already in \p key, if any. + * To check the consistency of the resulting key pair object, + * call mbedtls_ecp_check_pub_priv() after setting both + * the public key and the private key. + * + * \param grp_id The ECP group identifier. + * \param key The key pair object. It must be initialized. + * If its group has already been set, it must match \p grp_id. + * If its group has not been set, it will be set to \p grp_id. + * If the public key has already been set, it is overwritten. + * \param Q The public key to copy. This must be a point on the + * curve indicated by \p grp_id. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + * match \p grp_id. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_set_public_key(mbedtls_ecp_group_id grp_id, + mbedtls_ecp_keypair *key, + const mbedtls_ecp_point *Q); + +/** + * \brief This function reads an elliptic curve private key. + * + * \note This function does not set the public key in the + * key pair object. Without a public key, the key pair object + * cannot be used with operations that require the public key. + * Call mbedtls_ecp_keypair_calc_public() to set the public + * key from the private key. Alternatively, you can call + * mbedtls_ecp_set_public_key() to set the public key part, + * and then optionally mbedtls_ecp_check_pub_priv() to check + * that the private and public parts are consistent. + * + * \note If a public key has already been set in the key pair + * object, this function does not check that it is consistent + * with the private key. Call mbedtls_ecp_check_pub_priv() + * after setting both the public key and the private key + * to make that check. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. + * \param buf The buffer containing the binary representation of the + * key. (Big endian integer for Weierstrass curves, byte + * string for Montgomery curves.) + * \param buflen The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + * invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_read_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + const unsigned char *buf, size_t buflen); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief This function exports an elliptic curve private key. + * + * \deprecated Note that although this function accepts an output + * buffer that is smaller or larger than the key, most key + * import interfaces require the output to have exactly + * key's nominal length. It is generally simplest to + * pass the key's nominal length as \c buflen, after + * checking that the output buffer is large enough. + * See the description of the \p buflen parameter for + * how to calculate the nominal length. + * To avoid this difficulty, use mbedtls_ecp_write_key_ext() + * instead. + * mbedtls_ecp_write_key() is deprecated and will be + * removed in a future version of the library. + * + * \note If the private key was not set in \p key, + * the output is unspecified. Future versions + * may return an error in that case. + * + * \param key The private key. + * \param buf The output buffer for containing the binary representation + * of the key. + * For Weierstrass curves, this is the big-endian + * representation, padded with null bytes at the beginning + * to reach \p buflen bytes. + * For Montgomery curves, this is the standard byte string + * representation (which is little-endian), padded with + * null bytes at the end to reach \p buflen bytes. + * \param buflen The total length of the buffer in bytes. + * The length of the output is + * (`grp->nbits` + 7) / 8 bytes + * where `grp->nbits` is the private key size in bits. + * For Weierstrass keys, if the output buffer is smaller, + * leading zeros are trimmed to fit if possible. For + * Montgomery keys, the output buffer must always be large + * enough for the nominal length. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + * #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + * representation is larger than the available space in \p buf. + * \return Another negative error code on different kinds of failure. + */ +int MBEDTLS_DEPRECATED mbedtls_ecp_write_key(mbedtls_ecp_keypair *key, + unsigned char *buf, size_t buflen); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function exports an elliptic curve private key. + * + * \param key The private key. + * \param olen On success, the length of the private key. + * This is always (`grp->nbits` + 7) / 8 bytes + * where `grp->nbits` is the private key size in bits. + * \param buf The output buffer for containing the binary representation + * of the key. + * \param buflen The total length of the buffer in bytes. + * #MBEDTLS_ECP_MAX_BYTES is always sufficient. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + * representation is larger than the available space in \p buf. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + * set in \p key. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_write_key_ext(const mbedtls_ecp_keypair *key, + size_t *olen, unsigned char *buf, size_t buflen); + +/** + * \brief This function exports an elliptic curve public key. + * + * \note If the public key was not set in \p key, + * the output is unspecified. Future versions + * may return an error in that case. + * + * \param key The public key. + * \param format The point format. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * (For groups without these formats, this parameter is + * ignored. But it still has to be either of the above + * values.) + * \param olen The address at which to store the length of + * the output in Bytes. This must not be \c NULL. + * \param buf The output buffer. This must be a writable buffer + * of length \p buflen Bytes. + * \param buflen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + * is too small to hold the point. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + * or the export for the given group is not implemented. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_write_public_key(const mbedtls_ecp_keypair *key, + int format, size_t *olen, + unsigned char *buf, size_t buflen); + +/** + * \brief This function checks that the keypair objects + * \p pub and \p prv have the same group and the + * same public point, and that the private key in + * \p prv is consistent with the public key. + * + * \param pub The keypair structure holding the public key. This + * must be initialized. If it contains a private key, that + * part is ignored. + * \param prv The keypair structure holding the full keypair. + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c + * NULL if \p f_rng doesn't need a context. + * + * \return \c 0 on success, meaning that the keys are valid and match. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + * \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + * error code on calculation failure. + */ +int mbedtls_ecp_check_pub_priv( + const mbedtls_ecp_keypair *pub, const mbedtls_ecp_keypair *prv, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** \brief Calculate the public key from a private key in a key pair. + * + * \param key A keypair structure. It must have a private key set. + * If the public key is set, it will be overwritten. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c + * NULL if \p f_rng doesn't need a context. + * + * \return \c 0 on success. The key pair object can be used for + * operations that require the public key. + * \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + * error code on calculation failure. + */ +int mbedtls_ecp_keypair_calc_public( + mbedtls_ecp_keypair *key, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** \brief Query the group that a key pair belongs to. + * + * \param key The key pair to query. + * + * \return The group ID for the group registered in the key pair + * object. + * This is \c MBEDTLS_ECP_DP_NONE if no group has been set + * in the key pair object. + */ +mbedtls_ecp_group_id mbedtls_ecp_keypair_get_group_id( + const mbedtls_ecp_keypair *key); + +/** + * \brief This function exports generic key-pair parameters. + * + * Each of the output parameters can be a null pointer + * if you do not need that parameter. + * + * \note If the private key or the public key was not set in \p key, + * the corresponding output is unspecified. Future versions + * may return an error in that case. + * + * \param key The key pair to export from. + * \param grp Slot for exported ECP group. + * It must either be null or point to an initialized ECP group. + * \param d Slot for the exported secret value. + * It must either be null or point to an initialized mpi. + * \param Q Slot for the exported public value. + * It must either be null or point to an initialized ECP point. + * + * \return \c 0 on success, + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + * correspond to a known group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_export(const mbedtls_ecp_keypair *key, mbedtls_ecp_group *grp, + mbedtls_mpi *d, mbedtls_ecp_point *Q); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The ECP checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ecp_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecp.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/entropy.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/entropy.h new file mode 100644 index 00000000..6c64e3e4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/entropy.h @@ -0,0 +1,274 @@ +/** + * \file entropy.h + * + * \brief Entropy accumulator implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_ENTROPY_H +#define MBEDTLS_ENTROPY_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include + +#include "md.h" + +#if (defined(MBEDTLS_MD_CAN_SHA512) || defined(PSA_WANT_ALG_SHA_512)) && \ + !defined(MBEDTLS_ENTROPY_FORCE_SHA256) +#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR +#define MBEDTLS_ENTROPY_MD MBEDTLS_MD_SHA512 +#define MBEDTLS_ENTROPY_BLOCK_SIZE 64 /**< Block size of entropy accumulator (SHA-512) */ +#else +#if (defined(MBEDTLS_MD_CAN_SHA256) || defined(PSA_WANT_ALG_SHA_256)) +#define MBEDTLS_ENTROPY_SHA256_ACCUMULATOR +#define MBEDTLS_ENTROPY_MD MBEDTLS_MD_SHA256 +#define MBEDTLS_ENTROPY_BLOCK_SIZE 32 /**< Block size of entropy accumulator (SHA-256) */ +#endif +#endif + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + + +/** Critical entropy source failure. */ +#define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C +/** No more sources can be added. */ +#define MBEDTLS_ERR_ENTROPY_MAX_SOURCES -0x003E +/** No sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED -0x0040 +/** No strong sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE -0x003D +/** Read/write error in file. */ +#define MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR -0x003F + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_ENTROPY_MAX_SOURCES) +#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +#endif + +#if !defined(MBEDTLS_ENTROPY_MAX_GATHER) +#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_ENTROPY_MAX_SEED_SIZE 1024 /**< Maximum size of seed we read from seed file */ +#define MBEDTLS_ENTROPY_SOURCE_MANUAL MBEDTLS_ENTROPY_MAX_SOURCES + +#define MBEDTLS_ENTROPY_SOURCE_STRONG 1 /**< Entropy source is strong */ +#define MBEDTLS_ENTROPY_SOURCE_WEAK 0 /**< Entropy source is weak */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Entropy poll callback pointer + * + * \param data Callback-specific data pointer + * \param output Data to fill + * \param len Maximum size to provide + * \param olen The actual amount of bytes put into the buffer (Can be 0) + * + * \return 0 if no critical failures occurred, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise + */ +typedef int (*mbedtls_entropy_f_source_ptr)(void *data, unsigned char *output, size_t len, + size_t *olen); + +/** + * \brief Entropy source state + */ +typedef struct mbedtls_entropy_source_state { + mbedtls_entropy_f_source_ptr MBEDTLS_PRIVATE(f_source); /**< The entropy source callback */ + void *MBEDTLS_PRIVATE(p_source); /**< The callback data pointer */ + size_t MBEDTLS_PRIVATE(size); /**< Amount received in bytes */ + size_t MBEDTLS_PRIVATE(threshold); /**< Minimum bytes required before release */ + int MBEDTLS_PRIVATE(strong); /**< Is the source strong? */ +} +mbedtls_entropy_source_state; + +/** + * \brief Entropy context structure + */ +typedef struct mbedtls_entropy_context { + mbedtls_md_context_t MBEDTLS_PRIVATE(accumulator); + int MBEDTLS_PRIVATE(accumulator_started); /* 0 after init. + * 1 after the first update. + * -1 after free. */ + int MBEDTLS_PRIVATE(source_count); /* Number of entries used in source. */ + mbedtls_entropy_source_state MBEDTLS_PRIVATE(source)[MBEDTLS_ENTROPY_MAX_SOURCES]; +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); /*!< mutex */ +#endif +#if defined(MBEDTLS_ENTROPY_NV_SEED) + int MBEDTLS_PRIVATE(initial_entropy_run); +#endif +} +mbedtls_entropy_context; + +#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY) +/** + * \brief Platform-specific entropy poll callback + */ +int mbedtls_platform_entropy_poll(void *data, + unsigned char *output, size_t len, size_t *olen); +#endif + +/** + * \brief Initialize the context + * + * \param ctx Entropy context to initialize + */ +void mbedtls_entropy_init(mbedtls_entropy_context *ctx); + +/** + * \brief Free the data in the context + * + * \param ctx Entropy context to free + */ +void mbedtls_entropy_free(mbedtls_entropy_context *ctx); + +/** + * \brief Adds an entropy source to poll + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param f_source Entropy function + * \param p_source Function data + * \param threshold Minimum required from source before entropy is released + * ( with mbedtls_entropy_func() ) (in bytes) + * \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + * MBEDTLS_ENTROPY_SOURCE_WEAK. + * At least one strong source needs to be added. + * Weaker sources (such as the cycle counter) can be used as + * a complement. + * + * \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + */ +int mbedtls_entropy_add_source(mbedtls_entropy_context *ctx, + mbedtls_entropy_f_source_ptr f_source, void *p_source, + size_t threshold, int strong); + +/** + * \brief Trigger an extra gather poll for the accumulator + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_gather(mbedtls_entropy_context *ctx); + +/** + * \brief Retrieve entropy from the accumulator + * (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data Entropy context + * \param output Buffer to fill + * \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_func(void *data, unsigned char *output, size_t len); + +/** + * \brief Add data to the accumulator manually + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param data Data to add + * \param len Length of data + * + * \return 0 if successful + */ +int mbedtls_entropy_update_manual(mbedtls_entropy_context *ctx, + const unsigned char *data, size_t len); + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +/** + * \brief Trigger an update of the seed file in NV by using the + * current entropy pool. + * + * \param ctx Entropy context + * + * \return 0 if successful + */ +int mbedtls_entropy_update_nv_seed(mbedtls_entropy_context *ctx); +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Write a seed file + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, or + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_write_seed_file(mbedtls_entropy_context *ctx, const char *path); + +/** + * \brief Read and update a seed file. Seed is added to this + * instance. No more than MBEDTLS_ENTROPY_MAX_SEED_SIZE bytes are + * read from the seed file. The rest is ignored. + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_update_seed_file(mbedtls_entropy_context *ctx, const char *path); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * This module self-test also calls the entropy self-test, + * mbedtls_entropy_source_self_test(); + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_self_test(int verbose); + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +/** + * \brief Checkup routine + * + * Verifies the integrity of the hardware entropy source + * provided by the function 'mbedtls_hardware_poll()'. + * + * Note this is the only hardware entropy source that is known + * at link time, and other entropy sources configured + * dynamically at runtime by the function + * mbedtls_entropy_add_source() will not be tested. + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_source_self_test(int verbose); +#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */ +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* entropy.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/error.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/error.h new file mode 100644 index 00000000..635f7cd8 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/error.h @@ -0,0 +1,201 @@ +/** + * \file error.h + * + * \brief Error to string translation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_ERROR_H +#define MBEDTLS_ERROR_H + +#include "mbedtls/build_info.h" + +#include + +/** + * Error code layout. + * + * Currently we try to keep all error codes within the negative space of 16 + * bits signed integers to support all platforms (-0x0001 - -0x7FFF). In + * addition we'd like to give two layers of information on the error if + * possible. + * + * For that purpose the error codes are segmented in the following manner: + * + * 16 bit error code bit-segmentation + * + * 1 bit - Unused (sign bit) + * 3 bits - High level module ID + * 5 bits - Module-dependent error code + * 7 bits - Low level module errors + * + * For historical reasons, low-level error codes are divided in even and odd, + * even codes were assigned first, and -1 is reserved for other errors. + * + * Low-level module errors (0x0002-0x007E, 0x0001-0x007F) + * + * Module Nr Codes assigned + * ERROR 2 0x006E 0x0001 + * MPI 7 0x0002-0x0010 + * GCM 3 0x0012-0x0016 0x0013-0x0013 + * THREADING 3 0x001A-0x001E + * AES 5 0x0020-0x0022 0x0021-0x0025 + * CAMELLIA 3 0x0024-0x0026 0x0027-0x0027 + * BASE64 2 0x002A-0x002C + * OID 1 0x002E-0x002E 0x000B-0x000B + * PADLOCK 1 0x0030-0x0030 + * DES 2 0x0032-0x0032 0x0033-0x0033 + * CTR_DBRG 4 0x0034-0x003A + * ENTROPY 3 0x003C-0x0040 0x003D-0x003F + * NET 13 0x0042-0x0052 0x0043-0x0049 + * ARIA 4 0x0058-0x005E + * ASN1 7 0x0060-0x006C + * CMAC 1 0x007A-0x007A + * PBKDF2 1 0x007C-0x007C + * HMAC_DRBG 4 0x0003-0x0009 + * CCM 3 0x000D-0x0011 + * MD5 1 0x002F-0x002F + * RIPEMD160 1 0x0031-0x0031 + * SHA1 1 0x0035-0x0035 0x0073-0x0073 + * SHA256 1 0x0037-0x0037 0x0074-0x0074 + * SHA512 1 0x0039-0x0039 0x0075-0x0075 + * SHA-3 1 0x0076-0x0076 + * CHACHA20 3 0x0051-0x0055 + * POLY1305 3 0x0057-0x005B + * CHACHAPOLY 2 0x0054-0x0056 + * PLATFORM 2 0x0070-0x0072 + * LMS 5 0x0011-0x0019 + * + * High-level module nr (3 bits - 0x0...-0x7...) + * Name ID Nr of Errors + * PEM 1 9 + * PKCS#12 1 4 (Started from top) + * X509 2 20 + * PKCS5 2 4 (Started from top) + * DHM 3 11 + * PK 3 15 (Started from top) + * RSA 4 11 + * ECP 4 10 (Started from top) + * MD 5 5 + * HKDF 5 1 (Started from top) + * PKCS7 5 12 (Started from 0x5300) + * SSL 5 3 (Started from 0x5F00) + * CIPHER 6 8 (Started from 0x6080) + * SSL 6 22 (Started from top, plus 0x6000) + * SSL 7 20 (Started from 0x7000, gaps at + * 0x7380, 0x7900-0x7980, 0x7A80-0x7E80) + * + * Module dependent error code (5 bits 0x.00.-0x.F8.) + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** Generic error */ +#define MBEDTLS_ERR_ERROR_GENERIC_ERROR -0x0001 +/** This is a bug in the library */ +#define MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED -0x006E + +/** Hardware accelerator failed */ +#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 +/** The requested feature is not supported by the platform */ +#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 + +/** + * \brief Combines a high-level and low-level error code together. + * + * Wrapper macro for mbedtls_error_add(). See that function for + * more details. + */ +#define MBEDTLS_ERROR_ADD(high, low) \ + mbedtls_error_add(high, low, __FILE__, __LINE__) + +#if defined(MBEDTLS_TEST_HOOKS) +/** + * \brief Testing hook called before adding/combining two error codes together. + * Only used when invasive testing is enabled via MBEDTLS_TEST_HOOKS. + */ +extern void (*mbedtls_test_hook_error_add)(int, int, const char *, int); +#endif + +/** + * \brief Combines a high-level and low-level error code together. + * + * This function can be called directly however it is usually + * called via the #MBEDTLS_ERROR_ADD macro. + * + * While a value of zero is not a negative error code, it is still an + * error code (that denotes success) and can be combined with both a + * negative error code or another value of zero. + * + * \note When invasive testing is enabled via #MBEDTLS_TEST_HOOKS, also try to + * call \link mbedtls_test_hook_error_add \endlink. + * + * \param high high-level error code. See error.h for more details. + * \param low low-level error code. See error.h for more details. + * \param file file where this error code addition occurred. + * \param line line where this error code addition occurred. + */ +static inline int mbedtls_error_add(int high, int low, + const char *file, int line) +{ +#if defined(MBEDTLS_TEST_HOOKS) + if (*mbedtls_test_hook_error_add != NULL) { + (*mbedtls_test_hook_error_add)(high, low, file, line); + } +#endif + (void) file; + (void) line; + + return high + low; +} + +/** + * \brief Translate an Mbed TLS error code into a string representation. + * The result is truncated if necessary and always includes a + * terminating null byte. + * + * \param errnum error code + * \param buffer buffer to place representation in + * \param buflen length of the buffer + */ +void mbedtls_strerror(int errnum, char *buffer, size_t buflen); + +/** + * \brief Translate the high-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char *mbedtls_high_level_strerr(int error_code); + +/** + * \brief Translate the low-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char *mbedtls_low_level_strerr(int error_code); + +#ifdef __cplusplus +} +#endif + +#endif /* error.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/gcm.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/gcm.h new file mode 100644 index 00000000..390ed4c6 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/gcm.h @@ -0,0 +1,387 @@ +/** + * \file gcm.h + * + * \brief This file contains GCM definitions and functions. + * + * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined + * in D. McGrew, J. Viega, The Galois/Counter Mode of Operation + * (GCM), Natl. Inst. Stand. Technol. + * + * For more information on GCM, see NIST SP 800-38D: Recommendation for + * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_GCM_H +#define MBEDTLS_GCM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_BLOCK_CIPHER_C) +#include "mbedtls/block_cipher.h" +#endif + +#include + +#define MBEDTLS_GCM_ENCRYPT 1 +#define MBEDTLS_GCM_DECRYPT 0 + +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 +/** An output buffer is too small. */ +#define MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL -0x0016 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_GCM_ALT) + +#if defined(MBEDTLS_GCM_LARGE_TABLE) +#define MBEDTLS_GCM_HTABLE_SIZE 256 +#else +#define MBEDTLS_GCM_HTABLE_SIZE 16 +#endif + +/** + * \brief The GCM context structure. + */ +typedef struct mbedtls_gcm_context { +#if defined(MBEDTLS_BLOCK_CIPHER_C) + mbedtls_block_cipher_context_t MBEDTLS_PRIVATE(block_cipher_ctx); /*!< The cipher context used. */ +#else + mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ +#endif + uint64_t MBEDTLS_PRIVATE(H)[MBEDTLS_GCM_HTABLE_SIZE][2]; /*!< Precalculated HTable. */ + uint64_t MBEDTLS_PRIVATE(len); /*!< The total length of the encrypted data. */ + uint64_t MBEDTLS_PRIVATE(add_len); /*!< The total length of the additional data. */ + unsigned char MBEDTLS_PRIVATE(base_ectr)[16]; /*!< The first ECTR for tag. */ + unsigned char MBEDTLS_PRIVATE(y)[16]; /*!< The Y working value. */ + unsigned char MBEDTLS_PRIVATE(buf)[16]; /*!< The buf working value. */ + unsigned char MBEDTLS_PRIVATE(mode); /*!< The operation to perform: + #MBEDTLS_GCM_ENCRYPT or + #MBEDTLS_GCM_DECRYPT. */ + unsigned char MBEDTLS_PRIVATE(acceleration); /*!< The acceleration to use. */ +} +mbedtls_gcm_context; + +#else /* !MBEDTLS_GCM_ALT */ +#include "gcm_alt.h" +#endif /* !MBEDTLS_GCM_ALT */ + +/** + * \brief This function initializes the specified GCM context, + * to make references valid, and prepares the context + * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + * + * The function does not bind the GCM context to a particular + * cipher, nor set the key. For this purpose, use + * mbedtls_gcm_setkey(). + * + * \param ctx The GCM context to initialize. This must not be \c NULL. + */ +void mbedtls_gcm_init(mbedtls_gcm_context *ctx); + +/** + * \brief This function associates a GCM context with a + * cipher algorithm and a key. + * + * \param ctx The GCM context. This must be initialized. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must be a readable buffer of at + * least \p keybits bits. + * \param keybits The key size in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_gcm_setkey(mbedtls_gcm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits); + +/** + * \brief This function performs GCM encryption or decryption of a buffer. + * + * \note The output buffer \p output can be the same as the input + * buffer \p input. If \p output is greater than \p input, they + * cannot overlap. + * + * \warning When this function performs a decryption, it outputs the + * authentication tag and does not verify that the data is + * authentic. You should use this function to perform encryption + * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + * + * \param ctx The GCM context to use for encryption or decryption. This + * must be initialized. + * \param mode The operation to perform: + * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + * The ciphertext is written to \p output and the + * authentication tag is written to \p tag. + * - #MBEDTLS_GCM_DECRYPT to perform decryption. + * The plaintext is written to \p output and the + * authentication tag is written to \p tag. + * Note that this mode is not recommended, because it does + * not verify the authenticity of the data. For this reason, + * you should use mbedtls_gcm_auth_decrypt() instead of + * calling this function in decryption mode. + * \param length The length of the input data, which is equal to the length + * of the output data. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param input The buffer holding the input data. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size in Bytes. + * \param output The buffer for holding the output data. If \p length is greater + * than zero, this must be a writable buffer of at least that + * size in Bytes. + * \param tag_len The length of the tag to generate. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * + * \return \c 0 if the encryption or decryption was performed + * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + * this does not indicate that the data is authentic. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the encryption + * or decryption failed. + */ +int mbedtls_gcm_crypt_and_tag(mbedtls_gcm_context *ctx, + int mode, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *input, + unsigned char *output, + size_t tag_len, + unsigned char *tag); + +/** + * \brief This function performs a GCM authenticated decryption of a + * buffer. + * + * \note The output buffer \p output can be the same as the input + * buffer \p input. If \p output is greater than \p input, they + * cannot overlap. Implementations which require + * MBEDTLS_GCM_ALT to be enabled may not provide support for + * overlapping buffers. + * + * \param ctx The GCM context. This must be initialized. + * \param length The length of the ciphertext to decrypt, which is also + * the length of the decrypted plaintext. + * \param iv The initialization vector. This must be a readable buffer + * of at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param tag The buffer holding the tag to verify. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to verify. + * \param input The buffer holding the ciphertext. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size. + * \param output The buffer for holding the decrypted plaintext. If \p length + * is greater than zero, this must be a writable buffer of at + * least that size. + * + * \return \c 0 if successful and authenticated. + * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the decryption + * failed. + */ +int mbedtls_gcm_auth_decrypt(mbedtls_gcm_context *ctx, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *tag, + size_t tag_len, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function starts a GCM encryption or decryption + * operation. + * + * \param ctx The GCM context. This must be initialized. + * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + * #MBEDTLS_GCM_DECRYPT. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * + * \return \c 0 on success. + */ +int mbedtls_gcm_starts(mbedtls_gcm_context *ctx, + int mode, + const unsigned char *iv, + size_t iv_len); + +/** + * \brief This function feeds an input buffer as associated data + * (authenticated but not encrypted data) in a GCM + * encryption or decryption operation. + * + * Call this function after mbedtls_gcm_starts() to pass + * the associated data. If the associated data is empty, + * you do not need to call this function. You may not + * call this function after calling mbedtls_cipher_update(). + * + * \param ctx The GCM context. This must have been started with + * mbedtls_gcm_starts() and must not have yet received + * any input with mbedtls_gcm_update(). + * \param add The buffer holding the additional data, or \c NULL + * if \p add_len is \c 0. + * \param add_len The length of the additional data. If \c 0, + * \p add may be \c NULL. + * + * \return \c 0 on success. + */ +int mbedtls_gcm_update_ad(mbedtls_gcm_context *ctx, + const unsigned char *add, + size_t add_len); + +/** + * \brief This function feeds an input buffer into an ongoing GCM + * encryption or decryption operation. + * + * You may call this function zero, one or more times + * to pass successive parts of the input: the plaintext to + * encrypt, or the ciphertext (not including the tag) to + * decrypt. After the last part of the input, call + * mbedtls_gcm_finish(). + * + * This function may produce output in one of the following + * ways: + * - Immediate output: the output length is always equal + * to the input length. + * - Buffered output: the output consists of a whole number + * of 16-byte blocks. If the total input length so far + * (not including associated data) is 16 \* *B* + *A* + * with *A* < 16 then the total output length is 16 \* *B*. + * + * In particular: + * - It is always correct to call this function with + * \p output_size >= \p input_length + 15. + * - If \p input_length is a multiple of 16 for all the calls + * to this function during an operation, then it is + * correct to use \p output_size = \p input_length. + * + * \note The output buffer \p output can be the same as the input + * buffer \p input. If \p output is greater than \p input, they + * cannot overlap. Implementations which require + * MBEDTLS_GCM_ALT to be enabled may not provide support for + * overlapping buffers. + * + * \param ctx The GCM context. This must be initialized. + * \param input The buffer holding the input data. If \p input_length + * is greater than zero, this must be a readable buffer + * of at least \p input_length bytes. + * \param input_length The length of the input data in bytes. + * \param output The buffer for the output data. If \p output_size + * is greater than zero, this must be a writable buffer of + * of at least \p output_size bytes. + * \param output_size The size of the output buffer in bytes. + * See the function description regarding the output size. + * \param output_length On success, \p *output_length contains the actual + * length of the output written in \p output. + * On failure, the content of \p *output_length is + * unspecified. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + * total input length too long, + * unsupported input/output buffer overlap detected, + * or \p output_size too small. + */ +int mbedtls_gcm_update(mbedtls_gcm_context *ctx, + const unsigned char *input, size_t input_length, + unsigned char *output, size_t output_size, + size_t *output_length); + +/** + * \brief This function finishes the GCM operation and generates + * the authentication tag. + * + * It wraps up the GCM stream, and generates the + * tag. The tag can have a maximum length of 16 Bytes. + * + * \param ctx The GCM context. This must be initialized. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to generate. This must be at least + * four. + * \param output The buffer for the final output. + * If \p output_size is nonzero, this must be a writable + * buffer of at least \p output_size bytes. + * \param output_size The size of the \p output buffer in bytes. + * This must be large enough for the output that + * mbedtls_gcm_update() has not produced. In particular: + * - If mbedtls_gcm_update() produces immediate output, + * or if the total input size is a multiple of \c 16, + * then mbedtls_gcm_finish() never produces any output, + * so \p output_size can be \c 0. + * - \p output_size never needs to be more than \c 15. + * \param output_length On success, \p *output_length contains the actual + * length of the output written in \p output. + * On failure, the content of \p *output_length is + * unspecified. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + * invalid value of \p tag_len, + * or \p output_size too small. + */ +int mbedtls_gcm_finish(mbedtls_gcm_context *ctx, + unsigned char *output, size_t output_size, + size_t *output_length, + unsigned char *tag, size_t tag_len); + +/** + * \brief This function clears a GCM context and the underlying + * cipher sub-context. + * + * \param ctx The GCM context to clear. If this is \c NULL, the call has + * no effect. Otherwise, this must be initialized. + */ +void mbedtls_gcm_free(mbedtls_gcm_context *ctx); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The GCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_gcm_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* gcm.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hkdf.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hkdf.h new file mode 100644 index 00000000..930e93f3 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hkdf.h @@ -0,0 +1,124 @@ +/** + * \file hkdf.h + * + * \brief This file contains the HKDF interface. + * + * The HMAC-based Extract-and-Expand Key Derivation Function (HKDF) is + * specified by RFC 5869. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_HKDF_H +#define MBEDTLS_HKDF_H + +#include "mbedtls/build_info.h" + +#include "mbedtls/md.h" + +/** + * \name HKDF Error codes + * \{ + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA -0x5F80 +/** \} name */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief This is the HMAC-based Extract-and-Expand Key Derivation Function + * (HKDF). + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros of + * md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf(const mbedtls_md_info_t *md, const unsigned char *salt, + size_t salt_len, const unsigned char *ikm, size_t ikm_len, + const unsigned char *info, size_t info_len, + unsigned char *okm, size_t okm_len); + +/** + * \brief Take the input keying material \p ikm and extract from it a + * fixed-length pseudorandom key \p prk. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the + * hash function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros + * of md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param[out] prk A pseudorandom key of at least md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_extract(const mbedtls_md_info_t *md, + const unsigned char *salt, size_t salt_len, + const unsigned char *ikm, size_t ikm_len, + unsigned char *prk); + +/** + * \brief Expand the supplied \p prk into several additional pseudorandom + * keys, which is the output of the HKDF. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param prk A pseudorandom key of at least md.size bytes. \p prk is + * usually the output from the HKDF extract step. + * \param prk_len The length in bytes of \p prk. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_expand(const mbedtls_md_info_t *md, const unsigned char *prk, + size_t prk_len, const unsigned char *info, + size_t info_len, unsigned char *okm, size_t okm_len); + +#ifdef __cplusplus +} +#endif + +#endif /* hkdf.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hmac_drbg.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hmac_drbg.h new file mode 100644 index 00000000..18b1b75a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/hmac_drbg.h @@ -0,0 +1,434 @@ +/** + * \file hmac_drbg.h + * + * \brief The HMAC_DRBG pseudorandom generator. + * + * This module implements the HMAC_DRBG pseudorandom generator described + * in NIST SP 800-90A: Recommendation for Random Number Generation Using + * Deterministic Random Bit Generators. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_HMAC_DRBG_H +#define MBEDTLS_HMAC_DRBG_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * Error codes + */ +/** Too many random requested in single call. */ +#define MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG -0x0003 +/** Input too large (Entropy + additional). */ +#define MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG -0x0005 +/** Read/write error in file. */ +#define MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR -0x0007 +/** The entropy source failed. */ +#define MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED -0x0009 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_HMAC_DRBG_RESEED_INTERVAL) +#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_REQUEST) +#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_HMAC_DRBG_PR_OFF 0 /**< No prediction resistance */ +#define MBEDTLS_HMAC_DRBG_PR_ON 1 /**< Prediction resistance enabled */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * HMAC_DRBG context. + */ +typedef struct mbedtls_hmac_drbg_context { + /* Working state: the key K is not stored explicitly, + * but is implied by the HMAC context */ + mbedtls_md_context_t MBEDTLS_PRIVATE(md_ctx); /*!< HMAC context (inc. K) */ + unsigned char MBEDTLS_PRIVATE(V)[MBEDTLS_MD_MAX_SIZE]; /*!< V in the spec */ + int MBEDTLS_PRIVATE(reseed_counter); /*!< reseed counter */ + + /* Administrative state */ + size_t MBEDTLS_PRIVATE(entropy_len); /*!< entropy bytes grabbed on each (re)seed */ + int MBEDTLS_PRIVATE(prediction_resistance); /*!< enable prediction resistance (Automatic + reseed before every random generation) */ + int MBEDTLS_PRIVATE(reseed_interval); /*!< reseed interval */ + + /* Callbacks */ + int(*MBEDTLS_PRIVATE(f_entropy))(void *, unsigned char *, size_t); /*!< entropy function */ + void *MBEDTLS_PRIVATE(p_entropy); /*!< context for the entropy function */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if + * md_ctx->md_info != NULL. This means that the mutex is initialized + * during the initial seeding in mbedtls_hmac_drbg_seed() or + * mbedtls_hmac_drbg_seed_buf() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); +#endif +} mbedtls_hmac_drbg_context; + +/** + * \brief HMAC_DRBG context initialization. + * + * This function makes the context ready for mbedtls_hmac_drbg_seed(), + * mbedtls_hmac_drbg_seed_buf() or mbedtls_hmac_drbg_free(). + * + * \note The reseed interval is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL + * by default. Override this value by calling + * mbedtls_hmac_drbg_set_reseed_interval(). + * + * \param ctx HMAC_DRBG context to be initialized. + */ +void mbedtls_hmac_drbg_init(mbedtls_hmac_drbg_context *ctx); + +/** + * \brief HMAC_DRBG initial seeding. + * + * Set the initial seed and set up the entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * You can provide a personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * + * \note By default, the security strength as defined by NIST is: + * - 128 bits if \p md_info is SHA-1; + * - 192 bits if \p md_info is SHA-224; + * - 256 bits if \p md_info is SHA-256, SHA-384 or SHA-512. + * Note that SHA-256 is just as efficient as SHA-224. + * The security strength can be reduced if a smaller + * entropy length is set with + * mbedtls_hmac_drbg_set_entropy_len(). + * + * \note The default entropy length is the security strength + * (converted from bits to bytes). You can override + * it by calling mbedtls_hmac_drbg_set_entropy_len(). + * + * \note During the initial seeding, this function calls + * the entropy source to obtain a nonce + * whose length is half the entropy length. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be seeded. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a length that is + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + * where \c entropy_len is the entropy length + * described above. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if the call to \p f_entropy failed. + */ +int mbedtls_hmac_drbg_seed(mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t *md_info, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len); + +/** + * \brief Initialisation of simplified HMAC_DRBG (never reseeds). + * + * This function is meant for use in algorithms that need a pseudorandom + * input such as deterministic ECDSA. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be initialised. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param data Concatenation of the initial entropy string and + * the additional data. + * \param data_len Length of \p data in bytes. + * + * \return \c 0 if successful. or + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + */ +int mbedtls_hmac_drbg_seed_buf(mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t *md_info, + const unsigned char *data, size_t data_len); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_hmac_drbg_random_with_add() + * or mbedtls_hmac_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The HMAC_DRBG context. + * \param resistance #MBEDTLS_HMAC_DRBG_PR_ON or #MBEDTLS_HMAC_DRBG_PR_OFF. + */ +void mbedtls_hmac_drbg_set_prediction_resistance(mbedtls_hmac_drbg_context *ctx, + int resistance); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * See the documentation of mbedtls_hmac_drbg_seed() for the default value. + * + * \param ctx The HMAC_DRBG context. + * \param len The amount of entropy to grab, in bytes. + */ +void mbedtls_hmac_drbg_set_entropy_len(mbedtls_hmac_drbg_context *ctx, + size_t len); + +/** + * \brief Set the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_hmac_drbg_random() + * or mbedtls_hmac_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL. + * + * \param ctx The HMAC_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_hmac_drbg_set_reseed_interval(mbedtls_hmac_drbg_context *ctx, + int interval); + +/** + * \brief This function updates the state of the HMAC_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional The data to update the state with. + * If this is \c NULL, there is no additional data. + * \param add_len Length of \p additional in bytes. + * Unused if \p additional is \c NULL. + * + * \return \c 0 on success, or an error from the underlying + * hash calculation. + */ +int mbedtls_hmac_drbg_update(mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t add_len); + +/** + * \brief This function reseeds the HMAC_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional Additional data to add to the state. + * If this is \c NULL, there is no additional data + * and \p len should be \c 0. + * \param len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * (see mbedtls_hmac_drbg_set_entropy_len()). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy function failed. + */ +int mbedtls_hmac_drbg_reseed(mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t len); + +/** + * \brief This function updates an HMAC_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \param additional Additional data to update with. + * If this is \c NULL, there is no additional data + * and \p add_len should be \c 0. + * \param add_len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p output_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if + * \p add_len > #MBEDTLS_HMAC_DRBG_MAX_INPUT. + */ +int mbedtls_hmac_drbg_random_with_add(void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, + size_t add_len); + +/** + * \brief This function uses HMAC_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param out_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p out_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + */ +int mbedtls_hmac_drbg_random(void *p_rng, unsigned char *output, size_t out_len); + +/** + * \brief This function resets HMAC_DRBG context to the state immediately + * after initial call of mbedtls_hmac_drbg_init(). + * + * \param ctx The HMAC_DRBG context to free. + */ +void mbedtls_hmac_drbg_free(mbedtls_hmac_drbg_context *ctx); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_hmac_drbg_write_seed_file(mbedtls_hmac_drbg_context *ctx, const char *path); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_hmac_drbg_update_seed_file(mbedtls_hmac_drbg_context *ctx, const char *path); +#endif /* MBEDTLS_FS_IO */ + + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The HMAC_DRBG Checkup routine. + * + * \return \c 0 if successful. + * \return \c 1 if the test failed. + */ +int mbedtls_hmac_drbg_self_test(int verbose); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* hmac_drbg.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/lms.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/lms.h new file mode 100644 index 00000000..2f297914 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/lms.h @@ -0,0 +1,440 @@ +/** + * \file lms.h + * + * \brief This file provides an API for the LMS post-quantum-safe stateful-hash + public-key signature scheme as defined in RFC8554 and NIST.SP.200-208. + * This implementation currently only supports a single parameter set + * MBEDTLS_LMS_SHA256_M32_H10 in order to reduce complexity. This is one + * of the signature schemes recommended by the IETF draft SUIT standard + * for IOT firmware upgrades (RFC9019). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_LMS_H +#define MBEDTLS_LMS_H + +#include +#include + +#include "mbedtls/private_access.h" +#include "mbedtls/build_info.h" + +#define MBEDTLS_ERR_LMS_BAD_INPUT_DATA -0x0011 /**< Bad data has been input to an LMS function */ +#define MBEDTLS_ERR_LMS_OUT_OF_PRIVATE_KEYS -0x0013 /**< Specified LMS key has utilised all of its private keys */ +#define MBEDTLS_ERR_LMS_VERIFY_FAILED -0x0015 /**< LMS signature verification failed */ +#define MBEDTLS_ERR_LMS_ALLOC_FAILED -0x0017 /**< LMS failed to allocate space for a private key */ +#define MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL -0x0019 /**< Input/output buffer is too small to contain requited data */ + +/* Currently only defined for SHA256, 32 is the max hash output size */ +#define MBEDTLS_LMOTS_N_HASH_LEN_MAX (32u) +#define MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX (34u) +#define MBEDTLS_LMOTS_N_HASH_LEN(type) ((type) == MBEDTLS_LMOTS_SHA256_N32_W8 ? 32u : 0) +#define MBEDTLS_LMOTS_I_KEY_ID_LEN (16u) +#define MBEDTLS_LMOTS_Q_LEAF_ID_LEN (4u) +#define MBEDTLS_LMOTS_TYPE_LEN (4u) +#define MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(type) ((type) == MBEDTLS_LMOTS_SHA256_N32_W8 ? 34u : 0) +#define MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(type) (MBEDTLS_LMOTS_N_HASH_LEN(type)) + +#define MBEDTLS_LMOTS_SIG_LEN(type) (MBEDTLS_LMOTS_TYPE_LEN + \ + MBEDTLS_LMOTS_C_RANDOM_VALUE_LEN(type) + \ + (MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT(type) * \ + MBEDTLS_LMOTS_N_HASH_LEN(type))) + + +#define MBEDTLS_LMS_TYPE_LEN (4) +#define MBEDTLS_LMS_H_TREE_HEIGHT(type) ((type) == MBEDTLS_LMS_SHA256_M32_H10 ? 10u : 0) + +/* The length of a hash output, Currently only implemented for SHA256. + * Max is 32 bytes. + */ +#define MBEDTLS_LMS_M_NODE_BYTES(type) ((type) == MBEDTLS_LMS_SHA256_M32_H10 ? 32 : 0) +#define MBEDTLS_LMS_M_NODE_BYTES_MAX 32 + +#define MBEDTLS_LMS_SIG_LEN(type, otstype) (MBEDTLS_LMOTS_Q_LEAF_ID_LEN + \ + MBEDTLS_LMOTS_SIG_LEN(otstype) + \ + MBEDTLS_LMS_TYPE_LEN + \ + (MBEDTLS_LMS_H_TREE_HEIGHT(type) * \ + MBEDTLS_LMS_M_NODE_BYTES(type))) + +#define MBEDTLS_LMS_PUBLIC_KEY_LEN(type) (MBEDTLS_LMS_TYPE_LEN + \ + MBEDTLS_LMOTS_TYPE_LEN + \ + MBEDTLS_LMOTS_I_KEY_ID_LEN + \ + MBEDTLS_LMS_M_NODE_BYTES(type)) + + +#ifdef __cplusplus +extern "C" { +#endif + +/** The Identifier of the LMS parameter set, as per + * https://www.iana.org/assignments/leighton-micali-signatures/leighton-micali-signatures.xhtml + * We are only implementing a subset of the types, particularly H10, for the sake of simplicity. + */ +typedef enum { + MBEDTLS_LMS_SHA256_M32_H10 = 0x6, +} mbedtls_lms_algorithm_type_t; + +/** The Identifier of the LMOTS parameter set, as per + * https://www.iana.org/assignments/leighton-micali-signatures/leighton-micali-signatures.xhtml. + * We are only implementing a subset of the types, particularly N32_W8, for the sake of simplicity. + */ +typedef enum { + MBEDTLS_LMOTS_SHA256_N32_W8 = 4 +} mbedtls_lmots_algorithm_type_t; + +/** LMOTS parameters structure. + * + * This contains the metadata associated with an LMOTS key, detailing the + * algorithm type, the key ID, and the leaf identifier should be key be part of + * a LMS key. + */ +typedef struct { + unsigned char MBEDTLS_PRIVATE(I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN]); /*!< The key + identifier. */ + unsigned char MBEDTLS_PRIVATE(q_leaf_identifier[MBEDTLS_LMOTS_Q_LEAF_ID_LEN]); /*!< Which + leaf of the LMS key this is. + 0 if the key is not part of an LMS key. */ + mbedtls_lmots_algorithm_type_t MBEDTLS_PRIVATE(type); /*!< The LM-OTS key type identifier as + per IANA. Only SHA256_N32_W8 is + currently supported. */ +} mbedtls_lmots_parameters_t; + +/** LMOTS public context structure. + * + * A LMOTS public key is a hash output, and the applicable parameter set. + * + * The context must be initialized before it is used. A public key must either + * be imported or generated from a private context. + * + * \dot + * digraph lmots_public_t { + * UNINITIALIZED -> INIT [label="init"]; + * HAVE_PUBLIC_KEY -> INIT [label="free"]; + * INIT -> HAVE_PUBLIC_KEY [label="import_public_key"]; + * INIT -> HAVE_PUBLIC_KEY [label="calculate_public_key from private key"]; + * HAVE_PUBLIC_KEY -> HAVE_PUBLIC_KEY [label="export_public_key"]; + * } + * \enddot + */ +typedef struct { + mbedtls_lmots_parameters_t MBEDTLS_PRIVATE(params); + unsigned char MBEDTLS_PRIVATE(public_key)[MBEDTLS_LMOTS_N_HASH_LEN_MAX]; + unsigned char MBEDTLS_PRIVATE(have_public_key); /*!< Whether the context contains a public key. + Boolean values only. */ +} mbedtls_lmots_public_t; + +#if defined(MBEDTLS_LMS_PRIVATE) +/** LMOTS private context structure. + * + * A LMOTS private key is one hash output for each of digit of the digest + + * checksum, and the applicable parameter set. + * + * The context must be initialized before it is used. A public key must either + * be imported or generated from a private context. + * + * \dot + * digraph lmots_public_t { + * UNINITIALIZED -> INIT [label="init"]; + * HAVE_PRIVATE_KEY -> INIT [label="free"]; + * INIT -> HAVE_PRIVATE_KEY [label="generate_private_key"]; + * HAVE_PRIVATE_KEY -> INIT [label="sign"]; + * } + * \enddot + */ +typedef struct { + mbedtls_lmots_parameters_t MBEDTLS_PRIVATE(params); + unsigned char MBEDTLS_PRIVATE(private_key)[MBEDTLS_LMOTS_P_SIG_DIGIT_COUNT_MAX][ + MBEDTLS_LMOTS_N_HASH_LEN_MAX]; + unsigned char MBEDTLS_PRIVATE(have_private_key); /*!< Whether the context contains a private key. + Boolean values only. */ +} mbedtls_lmots_private_t; +#endif /* defined(MBEDTLS_LMS_PRIVATE) */ + + +/** LMS parameters structure. + * + * This contains the metadata associated with an LMS key, detailing the + * algorithm type, the type of the underlying OTS algorithm, and the key ID. + */ +typedef struct { + unsigned char MBEDTLS_PRIVATE(I_key_identifier[MBEDTLS_LMOTS_I_KEY_ID_LEN]); /*!< The key + identifier. */ + mbedtls_lmots_algorithm_type_t MBEDTLS_PRIVATE(otstype); /*!< The LM-OTS key type identifier as + per IANA. Only SHA256_N32_W8 is + currently supported. */ + mbedtls_lms_algorithm_type_t MBEDTLS_PRIVATE(type); /*!< The LMS key type identifier as per + IANA. Only SHA256_M32_H10 is currently + supported. */ +} mbedtls_lms_parameters_t; + +/** LMS public context structure. + * + * A LMS public key is the hash output that is the root of the Merkle tree, and + * the applicable parameter set + * + * The context must be initialized before it is used. A public key must either + * be imported or generated from a private context. + * + * \dot + * digraph lms_public_t { + * UNINITIALIZED -> INIT [label="init"]; + * HAVE_PUBLIC_KEY -> INIT [label="free"]; + * INIT -> HAVE_PUBLIC_KEY [label="import_public_key"]; + * INIT -> HAVE_PUBLIC_KEY [label="calculate_public_key from private key"]; + * HAVE_PUBLIC_KEY -> HAVE_PUBLIC_KEY [label="export_public_key"]; + * } + * \enddot + */ +typedef struct { + mbedtls_lms_parameters_t MBEDTLS_PRIVATE(params); + unsigned char MBEDTLS_PRIVATE(T_1_pub_key)[MBEDTLS_LMS_M_NODE_BYTES_MAX]; /*!< The public key, in + the form of the Merkle tree root node. */ + unsigned char MBEDTLS_PRIVATE(have_public_key); /*!< Whether the context contains a public key. + Boolean values only. */ +} mbedtls_lms_public_t; + + +#if defined(MBEDTLS_LMS_PRIVATE) +/** LMS private context structure. + * + * A LMS private key is a set of LMOTS private keys, an index to the next usable + * key, and the applicable parameter set. + * + * The context must be initialized before it is used. A public key must either + * be imported or generated from a private context. + * + * \dot + * digraph lms_public_t { + * UNINITIALIZED -> INIT [label="init"]; + * HAVE_PRIVATE_KEY -> INIT [label="free"]; + * INIT -> HAVE_PRIVATE_KEY [label="generate_private_key"]; + * } + * \enddot + */ +typedef struct { + mbedtls_lms_parameters_t MBEDTLS_PRIVATE(params); + uint32_t MBEDTLS_PRIVATE(q_next_usable_key); /*!< The index of the next OTS key that has not + been used. */ + mbedtls_lmots_private_t *MBEDTLS_PRIVATE(ots_private_keys); /*!< The private key material. One OTS key + for each leaf node in the Merkle tree. NULL + when have_private_key is 0 and non-NULL otherwise. + is 2^MBEDTLS_LMS_H_TREE_HEIGHT(type) in length. */ + mbedtls_lmots_public_t *MBEDTLS_PRIVATE(ots_public_keys); /*!< The OTS key public keys, used to + build the Merkle tree. NULL + when have_private_key is 0 and + non-NULL otherwise. + Is 2^MBEDTLS_LMS_H_TREE_HEIGHT(type) + in length. */ + unsigned char MBEDTLS_PRIVATE(have_private_key); /*!< Whether the context contains a private key. + Boolean values only. */ +} mbedtls_lms_private_t; +#endif /* defined(MBEDTLS_LMS_PRIVATE) */ + +/** + * \brief This function initializes an LMS public context + * + * \param ctx The uninitialized LMS context that will then be + * initialized. + */ +void mbedtls_lms_public_init(mbedtls_lms_public_t *ctx); + +/** + * \brief This function uninitializes an LMS public context + * + * \param ctx The initialized LMS context that will then be + * uninitialized. + */ +void mbedtls_lms_public_free(mbedtls_lms_public_t *ctx); + +/** + * \brief This function imports an LMS public key into a + * public LMS context. + * + * \note Before this function is called, the context must + * have been initialized. + * + * \note See IETF RFC8554 for details of the encoding of + * this public key. + * + * \param ctx The initialized LMS context store the key in. + * \param key The buffer from which the key will be read. + * #MBEDTLS_LMS_PUBLIC_KEY_LEN bytes will be read from + * this. + * \param key_size The size of the key being imported. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_import_public_key(mbedtls_lms_public_t *ctx, + const unsigned char *key, size_t key_size); + +/** + * \brief This function exports an LMS public key from a + * LMS public context that already contains a public + * key. + * + * \note Before this function is called, the context must + * have been initialized and the context must contain + * a public key. + * + * \note See IETF RFC8554 for details of the encoding of + * this public key. + * + * \param ctx The initialized LMS public context that contains + * the public key. + * \param key The buffer into which the key will be output. Must + * be at least #MBEDTLS_LMS_PUBLIC_KEY_LEN in size. + * \param key_size The size of the key buffer. + * \param key_len If not NULL, will be written with the size of the + * key. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_export_public_key(const mbedtls_lms_public_t *ctx, + unsigned char *key, size_t key_size, + size_t *key_len); + +/** + * \brief This function verifies a LMS signature, using a + * LMS context that contains a public key. + * + * \note Before this function is called, the context must + * have been initialized and must contain a public key + * (either by import or generation). + * + * \param ctx The initialized LMS public context from which the + * public key will be read. + * \param msg The buffer from which the message will be read. + * \param msg_size The size of the message that will be read. + * \param sig The buf from which the signature will be read. + * #MBEDTLS_LMS_SIG_LEN bytes will be read from + * this. + * \param sig_size The size of the signature to be verified. + * + * \return \c 0 on successful verification. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_verify(const mbedtls_lms_public_t *ctx, + const unsigned char *msg, size_t msg_size, + const unsigned char *sig, size_t sig_size); + +#if defined(MBEDTLS_LMS_PRIVATE) +/** + * \brief This function initializes an LMS private context + * + * \param ctx The uninitialized LMS private context that will + * then be initialized. */ +void mbedtls_lms_private_init(mbedtls_lms_private_t *ctx); + +/** + * \brief This function uninitializes an LMS private context + * + * \param ctx The initialized LMS private context that will then + * be uninitialized. + */ +void mbedtls_lms_private_free(mbedtls_lms_private_t *ctx); + +/** + * \brief This function generates an LMS private key, and + * stores in into an LMS private context. + * + * \warning This function is **not intended for use in + * production**, due to as-yet unsolved problems with + * handling stateful keys. The API for this function + * may change considerably in future versions. + * + * \note The seed must have at least 256 bits of entropy. + * + * \param ctx The initialized LMOTS context to generate the key + * into. + * \param type The LMS parameter set identifier. + * \param otstype The LMOTS parameter set identifier. + * \param f_rng The RNG function to be used to generate the key ID. + * \param p_rng The RNG context to be passed to f_rng + * \param seed The seed used to deterministically generate the + * key. + * \param seed_size The length of the seed. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_generate_private_key(mbedtls_lms_private_t *ctx, + mbedtls_lms_algorithm_type_t type, + mbedtls_lmots_algorithm_type_t otstype, + mbedtls_f_rng_t *f_rng, + void *p_rng, const unsigned char *seed, + size_t seed_size); + +/** + * \brief This function calculates an LMS public key from a + * LMS context that already contains a private key. + * + * \note Before this function is called, the context must + * have been initialized and the context must contain + * a private key. + * + * \param ctx The initialized LMS public context to calculate the key + * from and store it into. + * + * \param priv_ctx The LMS private context to read the private key + * from. This must have been initialized and contain a + * private key. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_calculate_public_key(mbedtls_lms_public_t *ctx, + const mbedtls_lms_private_t *priv_ctx); + +/** + * \brief This function creates a LMS signature, using a + * LMS context that contains unused private keys. + * + * \warning This function is **not intended for use in + * production**, due to as-yet unsolved problems with + * handling stateful keys. The API for this function + * may change considerably in future versions. + * + * \note Before this function is called, the context must + * have been initialized and must contain a private + * key. + * + * \note Each of the LMOTS private keys inside a LMS private + * key can only be used once. If they are reused, then + * attackers may be able to forge signatures with that + * key. This is all handled transparently, but it is + * important to not perform copy operations on LMS + * contexts that contain private key material. + * + * \param ctx The initialized LMS private context from which the + * private key will be read. + * \param f_rng The RNG function to be used for signature + * generation. + * \param p_rng The RNG context to be passed to f_rng + * \param msg The buffer from which the message will be read. + * \param msg_size The size of the message that will be read. + * \param sig The buf into which the signature will be stored. + * Must be at least #MBEDTLS_LMS_SIG_LEN in size. + * \param sig_size The size of the buffer the signature will be + * written into. + * \param sig_len If not NULL, will be written with the size of the + * signature. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_lms_sign(mbedtls_lms_private_t *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, const unsigned char *msg, + unsigned int msg_size, unsigned char *sig, size_t sig_size, + size_t *sig_len); +#endif /* defined(MBEDTLS_LMS_PRIVATE) */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_LMS_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/mbedtls_config.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/mbedtls_config.h new file mode 100644 index 00000000..8fa445a1 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/mbedtls_config.h @@ -0,0 +1,4437 @@ +/** + * \file mbedtls_config.h + * + * \brief Configuration options (set of defines) + * + * This set of compile-time options may be used to enable + * or disable features selectively, and reduce the global + * memory footprint. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +/** + * This is an optional version symbol that enables compatibility handling of + * config files. + * + * It is equal to the #MBEDTLS_VERSION_NUMBER of the Mbed TLS version that + * introduced the config format we want to be compatible with. + */ +//#define MBEDTLS_CONFIG_VERSION 0x03000000 + +/** + * \name SECTION: System support + * + * This section sets system specific settings. + * \{ + */ + +/** + * \def MBEDTLS_HAVE_ASM + * + * The compiler has support for asm(). + * + * Requires support for asm() in compiler. + * + * Used in: + * library/aesni.h + * library/aria.c + * library/bn_mul.h + * library/constant_time.c + * library/padlock.h + * + * Required by: + * MBEDTLS_AESCE_C + * MBEDTLS_AESNI_C (on some platforms) + * MBEDTLS_PADLOCK_C + * + * Comment to disable the use of assembly code. + */ +#define MBEDTLS_HAVE_ASM + +/** + * \def MBEDTLS_NO_UDBL_DIVISION + * + * The platform lacks support for double-width integer division (64-bit + * division on a 32-bit platform, 128-bit division on a 64-bit platform). + * + * Used in: + * include/mbedtls/bignum.h + * library/bignum.c + * + * The bignum code uses double-width division to speed up some operations. + * Double-width division is often implemented in software that needs to + * be linked with the program. The presence of a double-width integer + * type is usually detected automatically through preprocessor macros, + * but the automatic detection cannot know whether the code needs to + * and can be linked with an implementation of division for that type. + * By default division is assumed to be usable if the type is present. + * Uncomment this option to prevent the use of double-width division. + * + * Note that division for the native integer type is always required. + * Furthermore, a 64-bit type is always required even on a 32-bit + * platform, but it need not support multiplication or division. In some + * cases it is also desirable to disable some double-width operations. For + * example, if double-width division is implemented in software, disabling + * it can reduce code size in some embedded targets. + */ +//#define MBEDTLS_NO_UDBL_DIVISION + +/** + * \def MBEDTLS_NO_64BIT_MULTIPLICATION + * + * The platform lacks support for 32x32 -> 64-bit multiplication. + * + * Used in: + * library/poly1305.c + * + * Some parts of the library may use multiplication of two unsigned 32-bit + * operands with a 64-bit result in order to speed up computations. On some + * platforms, this is not available in hardware and has to be implemented in + * software, usually in a library provided by the toolchain. + * + * Sometimes it is not desirable to have to link to that library. This option + * removes the dependency of that library on platforms that lack a hardware + * 64-bit multiplier by embedding a software implementation in Mbed TLS. + * + * Note that depending on the compiler, this may decrease performance compared + * to using the library function provided by the toolchain. + */ +//#define MBEDTLS_NO_64BIT_MULTIPLICATION + +/** + * \def MBEDTLS_HAVE_SSE2 + * + * CPU supports SSE2 instruction set. + * + * Uncomment if the CPU supports SSE2 (IA-32 specific). + */ +//#define MBEDTLS_HAVE_SSE2 + +/** + * \def MBEDTLS_HAVE_TIME + * + * System has time.h and time(). + * The time does not need to be correct, only time differences are used, + * by contrast with MBEDTLS_HAVE_TIME_DATE + * + * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, + * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and + * MBEDTLS_PLATFORM_STD_TIME. + * + * Comment if your system does not support time functions. + * + * \note If MBEDTLS_TIMING_C is set - to enable the semi-portable timing + * interface - timing.c will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + */ +#define MBEDTLS_HAVE_TIME + +/** + * \def MBEDTLS_HAVE_TIME_DATE + * + * System has time.h, time(), and an implementation for + * mbedtls_platform_gmtime_r() (see below). + * The time needs to be correct (not necessarily very accurate, but at least + * the date should be correct). This is used to verify the validity period of + * X.509 certificates. + * + * Comment if your system does not have a correct clock. + * + * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that + * behaves similarly to the gmtime_r() function from the C standard. Refer to + * the documentation for mbedtls_platform_gmtime_r() for more information. + * + * \note It is possible to configure an implementation for + * mbedtls_platform_gmtime_r() at compile-time by using the macro + * MBEDTLS_PLATFORM_GMTIME_R_ALT. + */ +#define MBEDTLS_HAVE_TIME_DATE + +/** + * \def MBEDTLS_PLATFORM_MEMORY + * + * Enable the memory allocation layer. + * + * By default Mbed TLS uses the system-provided calloc() and free(). + * This allows different allocators (self-implemented or provided) to be + * provided to the platform abstraction layer. + * + * Enabling #MBEDTLS_PLATFORM_MEMORY without the + * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide + * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and + * free() function pointer at runtime. + * + * Enabling #MBEDTLS_PLATFORM_MEMORY and specifying + * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the + * alternate function at compile time. + * + * An overview of how the value of mbedtls_calloc is determined: + * + * - if !MBEDTLS_PLATFORM_MEMORY + * - mbedtls_calloc = calloc + * - if MBEDTLS_PLATFORM_MEMORY + * - if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO + * - if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. + * - How is MBEDTLS_PLATFORM_STD_CALLOC handled? + * - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; + * - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; + * - if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - if MBEDTLS_PLATFORM_STD_CALLOC is present: + * - User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; + * - if !MBEDTLS_PLATFORM_STD_CALLOC: + * - MBEDTLS_PLATFORM_STD_CALLOC = calloc + * + * - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. + * - if !MBEDTLS_PLATFORM_STD_CALLOC + * - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc + * + * - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. + * + * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and #MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. + * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. + * #MBEDTLS_PLATFORM_STD_CALLOC and #MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, + * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Enable this layer to allow use of alternative memory allocators. + */ +//#define MBEDTLS_PLATFORM_MEMORY + +/** + * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + * + * Do not assign standard functions in the platform layer (e.g. calloc() to + * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) + * + * This makes sure there are no linking errors on platforms that do not support + * these functions. You will HAVE to provide alternatives, either at runtime + * via the platform_set_xxx() functions or at compile time by setting + * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a + * MBEDTLS_PLATFORM_XXX_MACRO. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Uncomment to prevent default assignment of standard functions in the + * platform layer. + */ +//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +/** + * \def MBEDTLS_PLATFORM_EXIT_ALT + * + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let Mbed TLS support the + * function in the platform abstraction layer. + * + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, Mbed TLS will + * provide a function "mbedtls_platform_set_printf()" that allows you to set an + * alternative printf function pointer. + * + * All these define require MBEDTLS_PLATFORM_C to be defined! + * + * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; + * it will be enabled automatically by check_config.h + * + * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as + * MBEDTLS_PLATFORM_XXX_MACRO! + * + * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME + * + * Uncomment a macro to enable alternate implementation of specific base + * platform function + */ +//#define MBEDTLS_PLATFORM_SETBUF_ALT +//#define MBEDTLS_PLATFORM_EXIT_ALT +//#define MBEDTLS_PLATFORM_TIME_ALT +//#define MBEDTLS_PLATFORM_FPRINTF_ALT +//#define MBEDTLS_PLATFORM_PRINTF_ALT +//#define MBEDTLS_PLATFORM_SNPRINTF_ALT +//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +//#define MBEDTLS_PLATFORM_NV_SEED_ALT +//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +//#define MBEDTLS_PLATFORM_MS_TIME_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(), to wipe sensitive data in memory. This replaces + * the default implementation in platform_util.c. + * + * By default, the library uses a system function such as memset_s() + * (optional feature of C11), explicit_bzero() (BSD and compatible), or + * SecureZeroMemory (Windows). If no such function is detected, the library + * falls back to a plain C implementation. Compilers are technically + * permitted to optimize this implementation out, meaning that the memory is + * not actually wiped. The library tries to prevent that, but the C language + * makes it impossible to guarantee that the memory will always be wiped. + * + * If your platform provides a guaranteed method to wipe memory which + * `platform_util.c` does not detect, define this macro to the name of + * a function that takes two arguments, a `void *` pointer and a length, + * and wipes that many bytes starting at the specified address. For example, + * if your platform has explicit_bzero() but `platform_util.c` does not + * detect its presence, define `MBEDTLS_PLATFORM_ZEROIZE_ALT` to be + * `explicit_bzero` to use that function as mbedtls_platform_zeroize(). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +/** + * \def MBEDTLS_DEPRECATED_WARNING + * + * Mark deprecated functions and features so that they generate a warning if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * This only works with GCC and Clang. With other compilers, you may want to + * use MBEDTLS_DEPRECATED_REMOVED + * + * Uncomment to get warnings on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_WARNING + +/** + * \def MBEDTLS_DEPRECATED_REMOVED + * + * Remove deprecated functions and features so that they generate an error if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * Uncomment to get errors on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_REMOVED + +/** \} name SECTION: System support */ + +/** + * \name SECTION: Mbed TLS feature support + * + * This section sets support for features that are or are not needed + * within the modules that are enabled. + * \{ + */ + +/** + * \def MBEDTLS_TIMING_ALT + * + * Uncomment to provide your own alternate implementation for + * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() + * + * Only works if you have MBEDTLS_TIMING_C enabled. + * + * You will need to provide a header "timing_alt.h" and an implementation at + * compile time. + */ +//#define MBEDTLS_TIMING_ALT + +/** + * \def MBEDTLS_AES_ALT + * + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let Mbed TLS use your + * alternate core implementation of a symmetric crypto, an arithmetic or hash + * module (e.g. platform specific assembly optimized implementations). Keep + * in mind that the function prototypes should remain the same. + * + * This replaces the whole module. If you only want to replace one of the + * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_AES_ALT, Mbed TLS will no longer + * provide the "struct mbedtls_aes_context" definition and omit the base + * function declarations and implementations. "aes_alt.h" will be included from + * "aes.h" to include the new function definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * module. + * + * \warning MD5, DES and SHA-1 are considered weak and their + * use constitutes a security risk. If possible, we recommend + * avoiding dependencies on them, and considering stronger message + * digests and ciphers instead. + * + */ +//#define MBEDTLS_AES_ALT +//#define MBEDTLS_ARIA_ALT +//#define MBEDTLS_CAMELLIA_ALT +//#define MBEDTLS_CCM_ALT +//#define MBEDTLS_CHACHA20_ALT +//#define MBEDTLS_CHACHAPOLY_ALT +//#define MBEDTLS_CMAC_ALT +//#define MBEDTLS_DES_ALT +//#define MBEDTLS_DHM_ALT +//#define MBEDTLS_ECJPAKE_ALT +//#define MBEDTLS_GCM_ALT +//#define MBEDTLS_NIST_KW_ALT +//#define MBEDTLS_MD5_ALT +//#define MBEDTLS_POLY1305_ALT +//#define MBEDTLS_RIPEMD160_ALT +//#define MBEDTLS_RSA_ALT +//#define MBEDTLS_SHA1_ALT +//#define MBEDTLS_SHA256_ALT +//#define MBEDTLS_SHA512_ALT + +/* + * When replacing the elliptic curve module, please consider, that it is + * implemented with two .c files: + * - ecp.c + * - ecp_curves.c + * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT + * macros as described above. The only difference is that you have to make sure + * that you provide functionality for both .c files. + */ +//#define MBEDTLS_ECP_ALT + +/** + * \def MBEDTLS_SHA256_PROCESS_ALT + * + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use you + * alternate core implementation of symmetric crypto or hash function. Keep in + * mind that function prototypes should remain the same. + * + * This replaces only one function. The header file from Mbed TLS is still + * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, Mbed TLS will + * no longer provide the mbedtls_sha1_process() function, but it will still provide + * the other function (using your mbedtls_sha1_process() function) and the definition + * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible + * with this definition. + * + * \note If you use the AES_xxx_ALT macros, then it is recommended to also set + * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES + * tables. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + * + * \warning MD5, DES and SHA-1 are considered weak and their use + * constitutes a security risk. If possible, we recommend avoiding + * dependencies on them, and considering stronger message digests + * and ciphers instead. + * + * \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are + * enabled, then the deterministic ECDH signature functions pass the + * the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore + * alternative implementations should use the RNG only for generating + * the ephemeral key and nothing else. If this is not possible, then + * MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative + * implementation should be provided for mbedtls_ecdsa_sign_det_ext(). + * + */ +//#define MBEDTLS_MD5_PROCESS_ALT +//#define MBEDTLS_RIPEMD160_PROCESS_ALT +//#define MBEDTLS_SHA1_PROCESS_ALT +//#define MBEDTLS_SHA256_PROCESS_ALT +//#define MBEDTLS_SHA512_PROCESS_ALT +//#define MBEDTLS_DES_SETKEY_ALT +//#define MBEDTLS_DES_CRYPT_ECB_ALT +//#define MBEDTLS_DES3_CRYPT_ECB_ALT +//#define MBEDTLS_AES_SETKEY_ENC_ALT +//#define MBEDTLS_AES_SETKEY_DEC_ALT +//#define MBEDTLS_AES_ENCRYPT_ALT +//#define MBEDTLS_AES_DECRYPT_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT +//#define MBEDTLS_ECDSA_VERIFY_ALT +//#define MBEDTLS_ECDSA_SIGN_ALT +//#define MBEDTLS_ECDSA_GENKEY_ALT + +/** + * \def MBEDTLS_ECP_INTERNAL_ALT + * + * Expose a part of the internal interface of the Elliptic Curve Point module. + * + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use your + * alternative core implementation of elliptic curve arithmetic. Keep in mind + * that function prototypes should remain the same. + * + * This partially replaces one function. The header file from Mbed TLS is still + * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation + * is still present and it is used for group structures not supported by the + * alternative. + * + * The original implementation can in addition be removed by setting the + * MBEDTLS_ECP_NO_FALLBACK option, in which case any function for which the + * corresponding MBEDTLS_ECP__FUNCTION_NAME__ALT macro is defined will not be + * able to fallback to curves not supported by the alternative implementation. + * + * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT + * and implementing the following functions: + * unsigned char mbedtls_internal_ecp_grp_capable( + * const mbedtls_ecp_group *grp ) + * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) + * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ) + * The mbedtls_internal_ecp_grp_capable function should return 1 if the + * replacement functions implement arithmetic for the given group and 0 + * otherwise. + * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are + * called before and after each point operation and provide an opportunity to + * implement optimized set up and tear down instructions. + * + * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and + * MBEDTLS_ECP_DOUBLE_JAC_ALT, Mbed TLS will still provide the ecp_double_jac() + * function, but will use your mbedtls_internal_ecp_double_jac() if the group + * for the operation is supported by your implementation (i.e. your + * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the + * group is not supported by your implementation, then the original Mbed TLS + * implementation of ecp_double_jac() is used instead, unless this fallback + * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case + * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE). + * + * The function prototypes and the definition of mbedtls_ecp_group and + * mbedtls_ecp_point will not change based on MBEDTLS_ECP_INTERNAL_ALT, so your + * implementation of mbedtls_internal_ecp__function_name__ must be compatible + * with their definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + */ +/* Required for all the functions in this section */ +//#define MBEDTLS_ECP_INTERNAL_ALT +/* Turn off software fallback for curves not supported in hardware */ +//#define MBEDTLS_ECP_NO_FALLBACK +/* Support for Weierstrass curves with Jacobi representation */ +//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT +//#define MBEDTLS_ECP_ADD_MIXED_ALT +//#define MBEDTLS_ECP_DOUBLE_JAC_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT +/* Support for curves with Montgomery arithmetic */ +//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT + +/** + * \def MBEDTLS_ENTROPY_HARDWARE_ALT + * + * Uncomment this macro to let Mbed TLS use your own implementation of a + * hardware entropy collector. + * + * Your function must be called \c mbedtls_hardware_poll(), have the same + * prototype as declared in library/entropy_poll.h, and accept NULL as first + * argument. + * + * Uncomment to use your own hardware entropy collector. + */ +//#define MBEDTLS_ENTROPY_HARDWARE_ALT + +/** + * \def MBEDTLS_AES_ROM_TABLES + * + * Use precomputed AES tables stored in ROM. + * + * Uncomment this macro to use precomputed AES tables stored in ROM. + * Comment this macro to generate AES tables in RAM at runtime. + * + * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb + * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the + * initialization time before the first AES operation can be performed. + * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c + * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded + * performance if ROM access is slower than RAM access. + * + * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. + */ +//#define MBEDTLS_AES_ROM_TABLES + +/** + * \def MBEDTLS_AES_FEWER_TABLES + * + * Use less ROM/RAM for AES tables. + * + * Uncommenting this macro omits 75% of the AES tables from + * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) + * by computing their values on the fly during operations + * (the tables are entry-wise rotations of one another). + * + * Tradeoff: Uncommenting this reduces the RAM / ROM footprint + * by ~6kb but at the cost of more arithmetic operations during + * runtime. Specifically, one has to compare 4 accesses within + * different tables to 4 accesses with additional arithmetic + * operations within the same table. The performance gain/loss + * depends on the system and memory details. + * + * This option is independent of \c MBEDTLS_AES_ROM_TABLES. + */ +//#define MBEDTLS_AES_FEWER_TABLES + +/** + * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + * + * Use only 128-bit keys in AES operations to save ROM. + * + * Uncomment this macro to remove support for AES operations that use 192- + * or 256-bit keys. + * + * Uncommenting this macro reduces the size of AES code by ~300 bytes + * on v8-M/Thumb2. + * + * Module: library/aes.c + * + * Requires: MBEDTLS_AES_C + */ +//#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + +/* + * Disable plain C implementation for AES. + * + * When the plain C implementation is enabled, and an implementation using a + * special CPU feature (such as MBEDTLS_AESCE_C) is also enabled, runtime + * detection will be used to select between them. + * + * If only one implementation is present, runtime detection will not be used. + * This configuration will crash at runtime if running on a CPU without the + * necessary features. It will not build unless at least one of MBEDTLS_AESCE_C + * and/or MBEDTLS_AESNI_C is enabled & present in the build. + */ +//#define MBEDTLS_AES_USE_HARDWARE_ONLY + +/** + * \def MBEDTLS_CAMELLIA_SMALL_MEMORY + * + * Use less ROM for the Camellia implementation (saves about 768 bytes). + * + * Uncomment this macro to use less memory for Camellia. + */ +//#define MBEDTLS_CAMELLIA_SMALL_MEMORY + +/** + * \def MBEDTLS_CHECK_RETURN_WARNING + * + * If this macro is defined, emit a compile-time warning if application code + * calls a function without checking its return value, but the return value + * should generally be checked in portable applications. + * + * This is only supported on platforms where #MBEDTLS_CHECK_RETURN is + * implemented. Otherwise this option has no effect. + * + * Uncomment to get warnings on using fallible functions without checking + * their return value. + * + * \note This feature is a work in progress. + * Warnings will be added to more functions in the future. + * + * \note A few functions are considered critical, and ignoring the return + * value of these functions will trigger a warning even if this + * macro is not defined. To completely disable return value check + * warnings, define #MBEDTLS_CHECK_RETURN with an empty expansion. + */ +//#define MBEDTLS_CHECK_RETURN_WARNING + +/** + * \def MBEDTLS_CIPHER_MODE_CBC + * + * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CBC + +/** + * \def MBEDTLS_CIPHER_MODE_CFB + * + * Enable Cipher Feedback mode (CFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CFB + +/** + * \def MBEDTLS_CIPHER_MODE_CTR + * + * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CTR + +/** + * \def MBEDTLS_CIPHER_MODE_OFB + * + * Enable Output Feedback mode (OFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_OFB + +/** + * \def MBEDTLS_CIPHER_MODE_XTS + * + * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. + */ +#define MBEDTLS_CIPHER_MODE_XTS + +/** + * \def MBEDTLS_CIPHER_NULL_CIPHER + * + * Enable NULL cipher. + * Warning: Only do so when you know what you are doing. This allows for + * encryption or channels without any security! + * + * To enable the following ciphersuites: + * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA + * + * Uncomment this macro to enable the NULL cipher and ciphersuites + */ +//#define MBEDTLS_CIPHER_NULL_CIPHER + +/** + * \def MBEDTLS_CIPHER_PADDING_PKCS7 + * + * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for + * specific padding modes in the cipher layer with cipher modes that support + * padding (e.g. CBC) + * + * If you disable all padding modes, only full blocks can be used with CBC. + * + * Enable padding modes in the cipher layer. + */ +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS + +/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + * + * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. + * Without this, CTR_DRBG uses a 256-bit key + * unless \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. + */ +//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + * + * The Everest code is provided under the Apache 2.0 license only; therefore enabling this + * option is not compatible with taking the library under the GPL v2.0-or-later license. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +/** + * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED + * + * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve + * module. By default all supported curves are enabled. + * + * Comment macros to disable the curve and functions for it + */ +/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */ +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +/* Montgomery curves (supporting ECP) */ +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_ECP_DP_CURVE448_ENABLED + +/** + * \def MBEDTLS_ECP_NIST_OPTIM + * + * Enable specific 'modulo p' routines for each NIST prime. + * Depending on the prime and architecture, makes operations 4 to 8 times + * faster on the corresponding curve. + * + * Comment this macro to disable NIST curves optimisation. + */ +#define MBEDTLS_ECP_NIST_OPTIM + +/** + * \def MBEDTLS_ECP_RESTARTABLE + * + * Enable "non-blocking" ECC operations that can return early and be resumed. + * + * This allows various functions to pause by returning + * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in + * order to further progress and eventually complete their operation. This is + * controlled through mbedtls_ecp_set_max_ops() which limits the maximum + * number of ECC operations a function may perform before pausing; see + * mbedtls_ecp_set_max_ops() for more information. + * + * This is useful in non-threaded environments if you want to avoid blocking + * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. + * + * This option: + * - Adds xxx_restartable() variants of existing operations in the + * following modules, with corresponding restart context types: + * - ECP (for Short Weierstrass curves only): scalar multiplication (mul), + * linear combination (muladd); + * - ECDSA: signature generation & verification; + * - PK: signature generation & verification; + * - X509: certificate chain verification. + * - Adds mbedtls_ecdh_enable_restart() in the ECDH module. + * - Changes the behaviour of TLS 1.2 clients (not servers) when using the + * ECDHE-ECDSA key exchange (not other key exchanges) to make all ECC + * computations restartable: + * - ECDH operations from the key exchange, only for Short Weierstrass + * curves, only when MBEDTLS_USE_PSA_CRYPTO is not enabled. + * - verification of the server's key exchange signature; + * - verification of the server's certificate chain; + * - generation of the client's signature if client authentication is used, + * with an ECC key/certificate. + * + * \note In the cases above, the usual SSL/TLS functions, such as + * mbedtls_ssl_handshake(), can now return + * MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS. + * + * \note When this option and MBEDTLS_USE_PSA_CRYPTO are both enabled, + * restartable operations in PK, X.509 and TLS (see above) are not + * using PSA. On the other hand, ECDH computations in TLS are using + * PSA, and are not restartable. These are temporary limitations that + * should be lifted in the future. + * + * \note This option only works with the default software implementation of + * elliptic curve functionality. It is incompatible with + * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT, MBEDTLS_ECDSA_XXX_ALT. + * + * Requires: MBEDTLS_ECP_C + * + * Uncomment this macro to enable restartable ECC computations. + */ +//#define MBEDTLS_ECP_RESTARTABLE + +/** + * Uncomment to enable using new bignum code in the ECC modules. + * + * \warning This is currently experimental, incomplete and therefore should not + * be used in production. + */ +//#define MBEDTLS_ECP_WITH_MPI_UINT + +/** + * \def MBEDTLS_ECDSA_DETERMINISTIC + * + * Enable deterministic ECDSA (RFC 6979). + * Standard ECDSA is "fragile" in the sense that lack of entropy when signing + * may result in a compromise of the long-term signing key. This is avoided by + * the deterministic variant. + * + * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C + * + * Comment this macro to disable deterministic ECDSA. + */ +#define MBEDTLS_ECDSA_DETERMINISTIC + +/** + * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + * + * Enable the PSK based ciphersuite modes in SSL / TLS. + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + * + * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_RSA_C + * MBEDTLS_PKCS1_V15 + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + * + * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + * + * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + * + * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_RSA_C + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + * + * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Requires: MBEDTLS_ECJPAKE_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_JPAKE) + * SHA-256 (via MBEDTLS_SHA256_C or a PSA driver) + * MBEDTLS_ECP_DP_SECP256R1_ENABLED + * + * \warning If SHA-256 is provided only by a PSA driver, you must call + * psa_crypto_init() before the first handshake (even if + * MBEDTLS_USE_PSA_CRYPTO is disabled). + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 + */ +//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + +/** + * \def MBEDTLS_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define MBEDTLS_PK_PARSE_EC_EXTENDED + +/** + * \def MBEDTLS_PK_PARSE_EC_COMPRESSED + * + * Enable the support for parsing public keys of type Short Weierstrass + * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the + * compressed point format. This parsing is done through ECP module's functions. + * + * \note As explained in the description of MBEDTLS_ECP_PF_COMPRESSED (in ecp.h) + * the only unsupported curves are MBEDTLS_ECP_DP_SECP224R1 and + * MBEDTLS_ECP_DP_SECP224K1. + */ +#define MBEDTLS_PK_PARSE_EC_COMPRESSED + +/** + * \def MBEDTLS_ERROR_STRERROR_DUMMY + * + * Enable a dummy error function to make use of mbedtls_strerror() in + * third party libraries easier when MBEDTLS_ERROR_C is disabled + * (no effect when MBEDTLS_ERROR_C is enabled). + * + * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're + * not using mbedtls_strerror() or error_strerror() in your application. + * + * Disable if you run into name conflicts and want to really remove the + * mbedtls_strerror() + */ +#define MBEDTLS_ERROR_STRERROR_DUMMY + +/** + * \def MBEDTLS_GENPRIME + * + * Enable the prime-number generation code. + * + * Requires: MBEDTLS_BIGNUM_C + */ +#define MBEDTLS_GENPRIME + +/** + * \def MBEDTLS_FS_IO + * + * Enable functions that use the filesystem. + */ +#define MBEDTLS_FS_IO + +/** + * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + * Do not add default entropy sources in mbedtls_entropy_init(). + * + * This is useful to have more control over the added entropy sources in an + * application. + * + * Uncomment this macro to prevent loading of default entropy functions. + */ +//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + +/** + * \def MBEDTLS_NO_PLATFORM_ENTROPY + * + * Do not use built-in platform entropy functions. + * This is useful if your platform does not support + * standards like the /dev/urandom or Windows CryptoAPI. + * + * If you enable this macro, you will probably need to enable + * #MBEDTLS_ENTROPY_HARDWARE_ALT and provide a function + * mbedtls_hardware_poll(). + * + * \note The default platform entropy function supports the following + * sources: + * - getrandom() on Linux (if syscall() is available at compile time); + * - getrandom() on FreeBSD and DragonFlyBSD (if available at compile + * time); + * - `sysctl(KERN_ARND)` on FreeBSD and NetBSD; + * - #MBEDTLS_PLATFORM_DEV_RANDOM on Unix-like platforms + * (unless one of the above is used); + * - BCryptGenRandom() on Windows. + * + * Uncomment this macro to disable the built-in platform entropy functions. + */ +//#define MBEDTLS_NO_PLATFORM_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_FORCE_SHA256 + * + * Force the entropy accumulator to use a SHA-256 accumulator instead of the + * default SHA-512 based one (if both are available). + * + * Requires: MBEDTLS_SHA256_C + * + * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option + * if you have performance concerns. + * + * This option is only useful if both MBEDTLS_SHA256_C and + * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. + */ +//#define MBEDTLS_ENTROPY_FORCE_SHA256 + +/** + * \def MBEDTLS_ENTROPY_NV_SEED + * + * Enable the non-volatile (NV) seed file-based entropy source. + * (Also enables the NV seed read/write functions in the platform layer) + * + * This is crucial (if not required) on systems that do not have a + * cryptographic entropy source (in hardware or kernel) available. + * + * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C + * + * \note The read/write functions that are used by the entropy source are + * determined in the platform layer, and can be modified at runtime and/or + * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. + * + * \note If you use the default implementation functions that read a seedfile + * with regular fopen(), please make sure you make a seedfile with the + * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at + * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from + * and written to or you will get an entropy source error! The default + * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE + * bytes from the file. + * + * \note The entropy collector will write to the seed file before entropy is + * given to an external source, to update it. + */ +//#define MBEDTLS_ENTROPY_NV_SEED + +/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + * + * Enable key identifiers that encode a key owner identifier. + * + * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t + * which is currently hard-coded to be int32_t. + * + * Note that this option is meant for internal use only and may be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +/** + * \def MBEDTLS_MEMORY_DEBUG + * + * Enable debugging of buffer allocator memory issues. Automatically prints + * (to stderr) all (fatal) messages on memory allocation issues. Enables + * function for 'debug output' of allocated memory. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Uncomment this macro to let the buffer allocator print out error messages. + */ +//#define MBEDTLS_MEMORY_DEBUG + +/** + * \def MBEDTLS_MEMORY_BACKTRACE + * + * Include backtrace information with each allocated block. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * GLIBC-compatible backtrace() and backtrace_symbols() support + * + * Uncomment this macro to include backtrace information + */ +//#define MBEDTLS_MEMORY_BACKTRACE + +/** + * \def MBEDTLS_PK_RSA_ALT_SUPPORT + * + * Support external private RSA keys (eg from a HSM) in the PK layer. + * + * Comment this macro to disable support for external private RSA keys. + */ +#define MBEDTLS_PK_RSA_ALT_SUPPORT + +/** + * \def MBEDTLS_PKCS1_V15 + * + * Enable support for PKCS#1 v1.5 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * This enables support for PKCS#1 v1.5 operations. + */ +#define MBEDTLS_PKCS1_V15 + +/** + * \def MBEDTLS_PKCS1_V21 + * + * Enable support for PKCS#1 v2.1 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS#1 v2.1 operation. + * + * This enables support for RSAES-OAEP and RSASSA-PSS operations. + */ +#define MBEDTLS_PKCS1_V21 + +/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + * + * Enable support for platform built-in keys. If you enable this feature, + * you must implement the function mbedtls_psa_platform_get_builtin_key(). + * See the documentation of that function for more information. + * + * Built-in keys are typically derived from a hardware unique key or + * stored in a secure element. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + +/** \def MBEDTLS_PSA_CRYPTO_CLIENT + * + * Enable support for PSA crypto client. + * + * \note This option allows to include the code necessary for a PSA + * crypto client when the PSA crypto implementation is not included in + * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the + * code to set and get PSA key attributes. + * The development of PSA drivers partially relying on the library to + * fulfill the hardware gaps is another possible usage of this option. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_CLIENT + +/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + * + * Make the PSA Crypto module use an external random generator provided + * by a driver, instead of Mbed TLS's entropy and DRBG modules. + * + * \note This random generator must deliver random numbers with cryptographic + * quality and high performance. It must supply unpredictable numbers + * with a uniform distribution. The implementation of this function + * is responsible for ensuring that the random generator is seeded + * with sufficient entropy. If you have a hardware TRNG which is slow + * or delivers non-uniform output, declare it as an entropy source + * with mbedtls_entropy_add_source() instead of enabling this option. + * + * If you enable this option, you must configure the type + * ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h + * and define a function called mbedtls_psa_external_get_random() + * with the following prototype: + * ``` + * psa_status_t mbedtls_psa_external_get_random( + * mbedtls_psa_external_random_context_t *context, + * uint8_t *output, size_t output_size, size_t *output_length); + * ); + * ``` + * The \c context value is initialized to 0 before the first call. + * The function must fill the \c output buffer with \c output_size bytes + * of random data and set \c *output_length to \c output_size. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning If you enable this option, code that uses the PSA cryptography + * interface will not use any of the entropy sources set up for + * the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED + * enables. + * + * \note This option is experimental and may be removed without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +/** + * \def MBEDTLS_PSA_CRYPTO_SPM + * + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure + * Partition Manager) integration which separates the code into two parts: a + * NSPE (Non-Secure Process Environment) and an SPE (Secure Process + * Environment). + * + * If you enable this option, your build environment must include a header + * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS + * header files, or in another directory on the compiler's include search + * path). Alternatively, your platform may customize the header + * `psa/crypto_platform.h`, in which case it can skip or replace the + * inclusion of `"crypto_spe.h"`. + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SPM + +/** + * \def MBEDTLS_PSA_KEY_STORE_DYNAMIC + * + * Dynamically resize the PSA key store to accommodate any number of + * volatile keys (until the heap memory is exhausted). + * + * If this option is disabled, the key store has a fixed size + * #MBEDTLS_PSA_KEY_SLOT_COUNT for volatile keys and loaded persistent keys + * together. + * + * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + */ +#define MBEDTLS_PSA_KEY_STORE_DYNAMIC + +/** + * Uncomment to enable p256-m. This is an alternative implementation of + * key generation, ECDH and (randomized) ECDSA on the curve SECP256R1. + * Compared to the default implementation: + * + * - p256-m has a much smaller code size and RAM footprint. + * - p256-m is only available via the PSA API. This includes the pk module + * when #MBEDTLS_USE_PSA_CRYPTO is enabled. + * - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols + * over the core arithmetic, or deterministic derivation of keys. + * + * We recommend enabling this option if your application uses the PSA API + * and the only elliptic curve support it needs is ECDH and ECDSA over + * SECP256R1. + * + * If you enable this option, you do not need to enable any ECC-related + * MBEDTLS_xxx option. You do need to separately request support for the + * cryptographic mechanisms through the PSA API: + * - #MBEDTLS_PSA_CRYPTO_C and #MBEDTLS_PSA_CRYPTO_CONFIG for PSA-based + * configuration; + * - #MBEDTLS_USE_PSA_CRYPTO if you want to use p256-m from PK, X.509 or TLS; + * - #PSA_WANT_ECC_SECP_R1_256; + * - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed; + * - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC, + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT, + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed. + * + * \note To benefit from the smaller code size of p256-m, make sure that you + * do not enable any ECC-related option not supported by p256-m: this + * would cause the built-in ECC implementation to be built as well, in + * order to provide the required option. + * Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than + * SECP256R1 are disabled as they are not supported by this driver. + * Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or + * #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of + * the built-in ECC implementation, see docs/driver-only-builds.md. + */ +//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED + +/** + * \def MBEDTLS_PSA_INJECT_ENTROPY + * + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. + * + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED + * + */ +//#define MBEDTLS_PSA_INJECT_ENTROPY + +/** + * \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + * + * Assume all buffers passed to PSA functions are owned exclusively by the + * PSA function and are not stored in shared memory. + * + * This option may be enabled if all buffers passed to any PSA function reside + * in memory that is accessible only to the PSA function during its execution. + * + * This option MUST be disabled whenever buffer arguments are in memory shared + * with an untrusted party, for example where arguments to PSA calls are passed + * across a trust boundary. + * + * \note Enabling this option reduces memory usage and code size. + * + * \note Enabling this option causes overlap of input and output buffers + * not to be supported by PSA functions. + */ +//#define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + +/** + * \def MBEDTLS_RSA_NO_CRT + * + * Do not use the Chinese Remainder Theorem + * for the RSA private operation. + * + * Uncomment this macro to disable the use of CRT in RSA. + * + */ +//#define MBEDTLS_RSA_NO_CRT + +/** + * \def MBEDTLS_SELF_TEST + * + * Enable the checkup functions (*_self_test). + */ +#define MBEDTLS_SELF_TEST + +/** + * \def MBEDTLS_SHA256_SMALLER + * + * Enable an implementation of SHA-256 that has lower ROM footprint but also + * lower performance. + * + * The default implementation is meant to be a reasonable compromise between + * performance and size. This version optimizes more aggressively for size at + * the expense of performance. Eg on Cortex-M4 it reduces the size of + * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about + * 30%. + * + * Uncomment to enable the smaller implementation of SHA256. + */ +//#define MBEDTLS_SHA256_SMALLER + +/** + * \def MBEDTLS_SHA512_SMALLER + * + * Enable an implementation of SHA-512 that has lower ROM footprint but also + * lower performance. + * + * Uncomment to enable the smaller implementation of SHA512. + */ +//#define MBEDTLS_SHA512_SMALLER + +/** + * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES + * + * Enable sending of alert messages in case of encountered errors as per RFC. + * If you choose not to send the alert messages, Mbed TLS can still communicate + * with other servers, only debugging of failures is harder. + * + * The advantage of not sending alert messages, is that no information is given + * about reasons for failures thus preventing adversaries of gaining intel. + * + * Enable sending of all alert messages + */ +#define MBEDTLS_SSL_ALL_ALERT_MESSAGES + +/** + * \def MBEDTLS_SSL_DTLS_CONNECTION_ID + * + * Enable support for the DTLS Connection ID (CID) extension, + * which allows to identify DTLS connections across changes + * in the underlying transport. The CID functionality is described + * in RFC 9146. + * + * Setting this option enables the SSL APIs `mbedtls_ssl_set_cid()`, + * mbedtls_ssl_get_own_cid()`, `mbedtls_ssl_get_peer_cid()` and + * `mbedtls_ssl_conf_cid()`. See the corresponding documentation for + * more information. + * + * The maximum lengths of outgoing and incoming CIDs can be configured + * through the options + * - MBEDTLS_SSL_CID_OUT_LEN_MAX + * - MBEDTLS_SSL_CID_IN_LEN_MAX. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment to enable the Connection ID extension. + */ +#define MBEDTLS_SSL_DTLS_CONNECTION_ID + + +/** + * \def MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT + * + * Defines whether RFC 9146 (default) or the legacy version + * (version draft-ietf-tls-dtls-connection-id-05, + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) + * is used. + * + * Set the value to 0 for the standard version, and + * 1 for the legacy draft version. + * + * \deprecated Support for the legacy version of the DTLS + * Connection ID feature is deprecated. Please + * switch to the standardized version defined + * in RFC 9146 enabled by utilizing + * MBEDTLS_SSL_DTLS_CONNECTION_ID without use + * of MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT. + * + * Requires: MBEDTLS_SSL_DTLS_CONNECTION_ID + */ +#define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 0 + +/** + * \def MBEDTLS_SSL_ASYNC_PRIVATE + * + * Enable asynchronous external private key operations in SSL. This allows + * you to configure an SSL connection to call an external cryptographic + * module to perform private key operations instead of performing the + * operation inside the library. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + */ +//#define MBEDTLS_SSL_ASYNC_PRIVATE + +/** \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * + * In TLS clients, when a client authenticates a server through its + * certificate, the client normally checks three things: + * - the certificate chain must be valid; + * - the chain must start from a trusted CA; + * - the certificate must cover the server name that is expected by the client. + * + * Omitting any of these checks is generally insecure, and can allow a + * malicious server to impersonate a legitimate server. + * + * The third check may be safely skipped in some unusual scenarios, + * such as networks where eavesdropping is a risk but not active attacks, + * or a private PKI where the client equally trusts all servers that are + * accredited by the root CA. + * + * You should call mbedtls_ssl_set_hostname() with the expected server name + * before starting a TLS handshake on a client (unless the client is + * set up to only use PSK-based authentication, which does not rely on the + * host name). This configuration option controls what happens if a TLS client + * is configured with the authentication mode #MBEDTLS_SSL_VERIFY_REQUIRED + * (default), certificate authentication is enabled and the client does not + * call mbedtls_ssl_set_hostname(): + * + * - If this option is unset (default), the connection attempt is aborted + * with the error #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + * - If this option is set, the TLS library does not check the server name + * that the certificate is valid for. This is the historical behavior + * of Mbed TLS, but may be insecure as explained above. + * + * Enable this option for strict backward compatibility if you have + * determined that it is secure in the scenario where you are using + * Mbed TLS. + * + * \deprecated This option exists only for backward compatibility and will + * be removed in the next major version of Mbed TLS. + * + */ +//#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + +/** + * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION + * + * Enable serialization of the TLS context structures, through use of the + * functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load(). + * + * This pair of functions allows one side of a connection to serialize the + * context associated with the connection, then free or re-use that context + * while the serialized state is persisted elsewhere, and finally deserialize + * that state to a live context for resuming read/write operations on the + * connection. From a protocol perspective, the state of the connection is + * unaffected, in particular this is entirely transparent to the peer. + * + * Note: this is distinct from TLS session resumption, which is part of the + * protocol and fully visible by the peer. TLS session resumption enables + * establishing new connections associated to a saved session with shorter, + * lighter handshakes, while context serialization is a local optimization in + * handling a single, potentially long-lived connection. + * + * Enabling these APIs makes some SSL structures larger, as 64 extra bytes are + * saved after the handshake to allow for more efficient serialization, so if + * you don't need this feature you'll save RAM by disabling it. + * + * Requires: MBEDTLS_GCM_C or MBEDTLS_CCM_C or MBEDTLS_CHACHAPOLY_C + * + * Comment to disable the context serialization APIs. + */ +#define MBEDTLS_SSL_CONTEXT_SERIALIZATION + +/** + * \def MBEDTLS_SSL_DEBUG_ALL + * + * Enable the debug messages in SSL module for all issues. + * Debug messages have been disabled in some places to prevent timing + * attacks due to (unbalanced) debugging function calls. + * + * If you need all error reporting you should enable this during debugging, + * but remove this for production servers that should log as well. + * + * Uncomment this macro to report all debug messages on errors introducing + * a timing side-channel. + * + */ +//#define MBEDTLS_SSL_DEBUG_ALL + +/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC + * + * Enable support for Encrypt-then-MAC, RFC 7366. + * + * This allows peers that both support it to use a more robust protection for + * ciphersuites using CBC, providing deep resistance against timing attacks + * on the padding or underlying cipher. + * + * This only affects CBC ciphersuites, and is useless if none is defined. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Encrypt-then-MAC + */ +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC + +/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET + * + * Enable support for RFC 7627: Session Hash and Extended Master Secret + * Extension. + * + * This was introduced as "the proper fix" to the Triple Handshake family of + * attacks, but it is recommended to always use it (even if you disable + * renegotiation), since it actually fixes a more fundamental issue in the + * original SSL/TLS design, and has implications beyond Triple Handshake. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Extended Master Secret. + */ +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +/** + * \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + * + * This option controls the availability of the API mbedtls_ssl_get_peer_cert() + * giving access to the peer's certificate after completion of the handshake. + * + * Unless you need mbedtls_ssl_peer_cert() in your application, it is + * recommended to disable this option for reduced RAM usage. + * + * \note If this option is disabled, mbedtls_ssl_get_peer_cert() is still + * defined, but always returns \c NULL. + * + * \note This option has no influence on the protection against the + * triple handshake attack. Even if it is disabled, Mbed TLS will + * still ensure that certificates do not change during renegotiation, + * for example by keeping a hash of the peer's certificate. + * + * \note This option is required if MBEDTLS_SSL_PROTO_TLS1_3 is set. + * + * Comment this macro to disable storing the peer's certificate + * after the handshake. + */ +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + +/** + * \def MBEDTLS_SSL_KEYING_MATERIAL_EXPORT + * + * When this option is enabled, the client and server can extract additional + * shared symmetric keys after an SSL handshake using the function + * mbedtls_ssl_export_keying_material(). + * + * The process for deriving the keys is specified in RFC 5705 for TLS 1.2 and + * in RFC 8446, Section 7.5, for TLS 1.3. + * + * Comment this macro to disable mbedtls_ssl_export_keying_material(). + */ +#define MBEDTLS_SSL_KEYING_MATERIAL_EXPORT + +/** + * \def MBEDTLS_SSL_RENEGOTIATION + * + * Enable support for TLS renegotiation. + * + * The two main uses of renegotiation are (1) refresh keys on long-lived + * connections and (2) client authentication after the initial handshake. + * If you don't need renegotiation, it's probably better to disable it, since + * it has been associated with security issues in the past and is easy to + * misuse/misunderstand. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * + */ +#define MBEDTLS_SSL_RENEGOTIATION + +/** + * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + * + * Enable support for RFC 6066 max_fragment_length extension in SSL. + * + * Comment this macro to disable support for the max_fragment_length extension + */ +#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + +/** + * \def MBEDTLS_SSL_RECORD_SIZE_LIMIT + * + * Enable support for RFC 8449 record_size_limit extension in SSL (TLS 1.3 only). + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_3 + * + * Uncomment this macro to enable support for the record_size_limit extension + */ +//#define MBEDTLS_SSL_RECORD_SIZE_LIMIT + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_2 + * + * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). + * + * Requires: Without MBEDTLS_USE_PSA_CRYPTO: MBEDTLS_MD_C and + * (MBEDTLS_SHA256_C or MBEDTLS_SHA384_C or + * SHA-256 or SHA-512 provided by a PSA driver) + * With MBEDTLS_USE_PSA_CRYPTO: + * PSA_WANT_ALG_SHA_256 or PSA_WANT_ALG_SHA_384 + * + * \warning If building with MBEDTLS_USE_PSA_CRYPTO, or if the hash(es) used + * are only provided by PSA drivers, you must call psa_crypto_init() before + * doing any TLS operations. + * + * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 + */ +#define MBEDTLS_SSL_PROTO_TLS1_2 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_3 + * + * Enable support for TLS 1.3. + * + * \note See docs/architecture/tls13-support.md for a description of the TLS + * 1.3 support that this option enables. + * + * Requires: MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \note TLS 1.3 uses PSA crypto for cryptographic operations that are + * directly performed by TLS 1.3 code. As a consequence, when TLS 1.3 + * is enabled, a TLS handshake may call psa_crypto_init(), even + * if it ends up negotiating a different TLS version. + * + * \note Cryptographic operations performed indirectly via another module + * (X.509, PK) or by code shared with TLS 1.2 (record protection, + * running handshake hash) only use PSA crypto if + * #MBEDTLS_USE_PSA_CRYPTO is enabled. + * + * \note In multithreaded applications, you must also enable + * #MBEDTLS_THREADING_C, even if individual TLS contexts are not + * shared between threads, unless only one thread ever calls + * TLS functions. + * + * Uncomment this macro to enable the support for TLS 1.3. + */ +#define MBEDTLS_SSL_PROTO_TLS1_3 + +/** + * \def MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE + * + * Enable TLS 1.3 middlebox compatibility mode. + * + * As specified in Section D.4 of RFC 8446, TLS 1.3 offers a compatibility + * mode to make a TLS 1.3 connection more likely to pass through middle boxes + * expecting TLS 1.2 traffic. + * + * Turning on the compatibility mode comes at the cost of a few added bytes + * on the wire, but it doesn't affect compatibility with TLS 1.3 implementations + * that don't use it. Therefore, unless transmission bandwidth is critical and + * you know that middlebox compatibility issues won't occur, it is therefore + * recommended to set this option. + * + * Comment to disable compatibility mode for TLS 1.3. If + * MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any + * effect on the build. + * + */ +#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE + +/** + * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED + * + * Enable TLS 1.3 PSK key exchange mode. + * + * Comment to disable support for the PSK key exchange mode in TLS 1.3. If + * MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any + * effect on the build. + * + */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED + +/** + * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED + * + * Enable TLS 1.3 ephemeral key exchange mode. + * + * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH + * MBEDTLS_X509_CRT_PARSE_C + * and at least one of: + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_PKCS1_V21 + * + * Comment to disable support for the ephemeral key exchange mode in TLS 1.3. + * If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any + * effect on the build. + * + */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED + +/** + * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED + * + * Enable TLS 1.3 PSK ephemeral key exchange mode. + * + * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH + * + * Comment to disable support for the PSK ephemeral key exchange mode in + * TLS 1.3. If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not + * have any effect on the build. + * + */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED + +/** + * \def MBEDTLS_SSL_EARLY_DATA + * + * Enable support for RFC 8446 TLS 1.3 early data. + * + * Requires: MBEDTLS_SSL_SESSION_TICKETS and either + * MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED or + * MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED + * + * Comment this to disable support for early data. If MBEDTLS_SSL_PROTO_TLS1_3 + * is not enabled, this option does not have any effect on the build. + * + * \note The maximum amount of early data can be set with + * MBEDTLS_SSL_MAX_EARLY_DATA_SIZE. + * + */ +//#define MBEDTLS_SSL_EARLY_DATA + +/** + * \def MBEDTLS_SSL_PROTO_DTLS + * + * Enable support for DTLS (all available versions). + * + * Enable this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for DTLS + */ +#define MBEDTLS_SSL_PROTO_DTLS + +/** + * \def MBEDTLS_SSL_ALPN + * + * Enable support for RFC 7301 Application Layer Protocol Negotiation. + * + * Comment this macro to disable support for ALPN. + */ +#define MBEDTLS_SSL_ALPN + +/** + * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY + * + * Enable support for the anti-replay mechanism in DTLS. + * + * Requires: MBEDTLS_SSL_TLS_C + * MBEDTLS_SSL_PROTO_DTLS + * + * \warning Disabling this is often a security risk! + * See mbedtls_ssl_conf_dtls_anti_replay() for details. + * + * Comment this to disable anti-replay in DTLS. + */ +#define MBEDTLS_SSL_DTLS_ANTI_REPLAY + +/** + * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Enable support for HelloVerifyRequest on DTLS servers. + * + * This feature is highly recommended to prevent DTLS servers being used as + * amplifiers in DoS attacks against other hosts. It should always be enabled + * unless you know for sure amplification cannot be a problem in the + * environment in which your server operates. + * + * \warning Disabling this can be a security risk! (see above) + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Comment this to disable support for HelloVerifyRequest. + */ +#define MBEDTLS_SSL_DTLS_HELLO_VERIFY + +/** + * \def MBEDTLS_SSL_DTLS_SRTP + * + * Enable support for negotiation of DTLS-SRTP (RFC 5764) + * through the use_srtp extension. + * + * \note This feature provides the minimum functionality required + * to negotiate the use of DTLS-SRTP and to allow the derivation of + * the associated SRTP packet protection key material. + * In particular, the SRTP packet protection itself, as well as the + * demultiplexing of RTP and DTLS packets at the datagram layer + * (see Section 5 of RFC 5764), are not handled by this feature. + * Instead, after successful completion of a handshake negotiating + * the use of DTLS-SRTP, the extended key exporter API + * mbedtls_ssl_conf_export_keys_cb() should be used to implement + * the key exporter described in Section 4.2 of RFC 5764 and RFC 5705 + * (this is implemented in the SSL example programs). + * The resulting key should then be passed to an SRTP stack. + * + * Setting this option enables the runtime API + * mbedtls_ssl_conf_dtls_srtp_protection_profiles() + * through which the supported DTLS-SRTP protection + * profiles can be configured. You must call this API at + * runtime if you wish to negotiate the use of DTLS-SRTP. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment this to enable support for use_srtp extension. + */ +//#define MBEDTLS_SSL_DTLS_SRTP + +/** + * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + * + * Enable server-side support for clients that reconnect from the same port. + * + * Some clients unexpectedly close the connection and try to reconnect using the + * same source port. This needs special support from the server to handle the + * new connection securely, as described in section 4.2.8 of RFC 6347. This + * flag enables that support. + * + * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Comment this to disable support for clients reusing the source port. + */ +#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/** + * \def MBEDTLS_SSL_SESSION_TICKETS + * + * Enable support for RFC 5077 session tickets in SSL. + * Client-side, provides full support for session tickets (maintenance of a + * session store remains the responsibility of the application, though). + * Server-side, you also need to provide callbacks for writing and parsing + * tickets, including authenticated encryption and key management. Example + * callbacks are provided by MBEDTLS_SSL_TICKET_C. + * + * Comment this macro to disable support for SSL session tickets + */ +#define MBEDTLS_SSL_SESSION_TICKETS + +/** + * \def MBEDTLS_SSL_SERVER_NAME_INDICATION + * + * Enable support for RFC 6066 server name indication (SNI) in SSL. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Comment this macro to disable support for server name indication in SSL + */ +#define MBEDTLS_SSL_SERVER_NAME_INDICATION + +/** + * \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + * + * When this option is enabled, the SSL buffer will be resized automatically + * based on the negotiated maximum fragment length in each direction. + * + * Requires: MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + */ +//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + * + * Enable testing of the constant-flow nature of some sensitive functions with + * clang's MemorySanitizer. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires compiling with clang -fsanitize=memory. The test + * suites can then be run normally. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + * + * Enable testing of the constant-flow nature of some sensitive functions with + * valgrind's memcheck tool. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires valgrind headers for building, and is only useful for + * testing if the tests suites are run with valgrind's memcheck. This can be + * done for an individual test suite with 'valgrind ./test_suite_xxx', or when + * using CMake, this can be done for all test suites with 'make memcheck'. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +/** + * \def MBEDTLS_TEST_HOOKS + * + * Enable features for invasive testing such as introspection functions and + * hooks for fault injection. This enables additional unit tests. + * + * Merely enabling this feature should not change the behavior of the product. + * It only adds new code, and new branching points where the default behavior + * is the same as when this feature is disabled. + * However, this feature increases the attack surface: there is an added + * risk of vulnerabilities, and more gadgets that can make exploits easier. + * Therefore this feature must never be enabled in production. + * + * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more + * information. + * + * Uncomment to enable invasive tests. + */ +//#define MBEDTLS_TEST_HOOKS + +/** + * \def MBEDTLS_THREADING_ALT + * + * Provide your own alternate implementation of threading primitives + * for mutexes. If you enable this option: + * + * - Provide a header file `"threading_alt.h"`, defining the + * type `mbedtls_threading_mutex_t` of mutex objects. + * + * - Call the function mbedtls_threading_set_alt() in your application + * before calling any other library function (in particular before + * calling psa_crypto_init(), performing an asymmetric cryptography + * operation, or starting a TLS connection). + * + * See mbedtls/threading.h for more details, especially the documentation + * of mbedtls_threading_set_alt(). + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to allow your own alternate threading implementation. + */ +//#define MBEDTLS_THREADING_ALT + +/** + * \def MBEDTLS_THREADING_PTHREAD + * + * Enable the pthread wrapper layer for the threading layer. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to enable pthread mutexes. + */ +//#define MBEDTLS_THREADING_PTHREAD + +/** + * \def MBEDTLS_USE_PSA_CRYPTO + * + * Make the X.509 and TLS libraries use PSA for cryptographic operations as + * much as possible, and enable new APIs for using keys handled by PSA Crypto. + * + * \note Development of this option is currently in progress, and parts of Mbed + * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts + * will still continue to work as usual, so enabling this option should not + * break backwards compatibility. + * + * \warning If you enable this option, you need to call `psa_crypto_init()` + * before calling any function from the SSL/TLS, X.509 or PK modules, except + * for the various mbedtls_xxx_init() functions which can be called at any time. + * + * \warning In multithreaded applications, you must also enable + * #MBEDTLS_THREADING_C, unless only one thread ever calls PSA functions + * (`psa_xxx()`), including indirect calls through SSL/TLS, X.509 or PK. + * + * \note An important and desirable effect of this option is that it allows + * PK, X.509 and TLS to take advantage of PSA drivers. For example, enabling + * this option is what allows use of drivers for ECDSA, ECDH and EC J-PAKE in + * those modules. However, note that even with this option disabled, some code + * in PK, X.509, TLS or the crypto library might still use PSA drivers, if it + * can determine it's safe to do so; currently that's the case for hashes. + * + * \note See docs/use-psa-crypto.md for a complete description this option. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * Uncomment this to enable internal use of PSA Crypto and new associated APIs. + */ +//#define MBEDTLS_USE_PSA_CRYPTO + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG + * + * This setting allows support for cryptographic mechanisms through the PSA + * API to be configured separately from support through the mbedtls API. + * + * When this option is disabled, the PSA API exposes the cryptographic + * mechanisms that can be implemented on top of the `mbedtls_xxx` API + * configured with `MBEDTLS_XXX` symbols. + * + * When this option is enabled, the PSA API exposes the cryptographic + * mechanisms requested by the `PSA_WANT_XXX` symbols defined in + * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are + * automatically enabled if required (i.e. if no PSA driver provides the + * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols + * in mbedtls_config.h. + * + * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies + * an alternative header to include instead of include/psa/crypto_config.h. + * + * \warning This option is experimental, in that the set of `PSA_WANT_XXX` + * symbols is not completely finalized yet, and the configuration + * tooling is not ideally adapted to having two separate configuration + * files. + * Future minor releases of Mbed TLS may make minor changes to those + * symbols, but we will endeavor to provide a transition path. + * Nonetheless, this option is considered mature enough to use in + * production, as long as you accept that you may need to make + * minor changes to psa/crypto_config.h when upgrading Mbed TLS. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG + +/** + * \def MBEDTLS_VERSION_FEATURES + * + * Allow run-time checking of compile-time enabled features. Thus allowing users + * to check at run-time if the library is for instance compiled with threading + * support via mbedtls_version_check_feature(). + * + * Requires: MBEDTLS_VERSION_C + * + * Comment this to disable run-time checking and save ROM space + */ +#define MBEDTLS_VERSION_FEATURES + +/** + * \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + * + * If set, this enables the X.509 API `mbedtls_x509_crt_verify_with_ca_cb()` + * and the SSL API `mbedtls_ssl_conf_ca_cb()` which allow users to configure + * the set of trusted certificates through a callback instead of a linked + * list. + * + * This is useful for example in environments where a large number of trusted + * certificates is present and storing them in a linked list isn't efficient + * enough, or when the set of trusted certificates changes frequently. + * + * See the documentation of `mbedtls_x509_crt_verify_with_ca_cb()` and + * `mbedtls_ssl_conf_ca_cb()` for more information. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Uncomment to enable trusted certificate callbacks. + */ +//#define MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + +/** + * \def MBEDTLS_X509_REMOVE_INFO + * + * Disable mbedtls_x509_*_info() and related APIs. + * + * Uncomment to omit mbedtls_x509_*_info(), as well as mbedtls_debug_print_crt() + * and other functions/constants only used by these functions, thus reducing + * the code footprint by several KB. + */ +//#define MBEDTLS_X509_REMOVE_INFO + +/** + * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT + * + * Enable parsing and verification of X.509 certificates, CRLs and CSRS + * signed with RSASSA-PSS (aka PKCS#1 v2.1). + * + * Requires: MBEDTLS_PKCS1_V21 + * + * Comment this macro to disallow using RSASSA-PSS in certificates. + */ +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT +/** \} name SECTION: Mbed TLS feature support */ + +/** + * \name SECTION: Mbed TLS modules + * + * This section enables or disables entire modules in Mbed TLS + * \{ + */ + +/** + * \def MBEDTLS_AESNI_C + * + * Enable AES-NI support on x86-64 or x86-32. + * + * \note AESNI is only supported with certain compilers and target options: + * - Visual Studio: supported + * - GCC, x86-64, target not explicitly supporting AESNI: + * requires MBEDTLS_HAVE_ASM. + * - GCC, x86-32, target not explicitly supporting AESNI: + * not supported. + * - GCC, x86-64 or x86-32, target supporting AESNI: supported. + * For this assembly-less implementation, you must currently compile + * `library/aesni.c` and `library/aes.c` with machine options to enable + * SSE2 and AESNI instructions: `gcc -msse2 -maes -mpclmul` or + * `clang -maes -mpclmul`. + * - Non-x86 targets: this option is silently ignored. + * - Other compilers: this option is silently ignored. + * + * \note + * Above, "GCC" includes compatible compilers such as Clang. + * The limitations on target support are likely to be relaxed in the future. + * + * Module: library/aesni.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM (on some platforms, see note) + * + * This modules adds support for the AES-NI instructions on x86. + */ +#define MBEDTLS_AESNI_C + +/** + * \def MBEDTLS_AESCE_C + * + * Enable AES cryptographic extension support on Armv8. + * + * Module: library/aesce.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_AES_C + * + * \warning Runtime detection only works on Linux. For non-Linux operating + * system, Armv8-A Cryptographic Extensions must be supported by + * the CPU when this option is enabled. + * + * \note Minimum compiler versions for this feature when targeting aarch64 + * are Clang 4.0; armclang 6.6; GCC 6.0; or MSVC 2019 version 16.11.2. + * Minimum compiler versions for this feature when targeting 32-bit + * Arm or Thumb are Clang 11.0; armclang 6.20; or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * This module adds support for the AES Armv8-A Cryptographic Extensions on Armv8 systems. + */ +#define MBEDTLS_AESCE_C + +/** + * \def MBEDTLS_AES_C + * + * Enable the AES block cipher. + * + * Module: library/aes.c + * Caller: library/cipher.c + * library/pem.c + * library/ctr_drbg.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * + * PEM_PARSE uses AES for decrypting encrypted keys. + */ +#define MBEDTLS_AES_C + +/** + * \def MBEDTLS_ASN1_PARSE_C + * + * Enable the generic ASN1 parser. + * + * Module: library/asn1.c + * Caller: library/x509.c + * library/dhm.c + * library/pkcs12.c + * library/pkcs5.c + * library/pkparse.c + */ +#define MBEDTLS_ASN1_PARSE_C + +/** + * \def MBEDTLS_ASN1_WRITE_C + * + * Enable the generic ASN1 writer. + * + * Module: library/asn1write.c + * Caller: library/ecdsa.c + * library/pkwrite.c + * library/x509_create.c + * library/x509write_crt.c + * library/x509write_csr.c + */ +#define MBEDTLS_ASN1_WRITE_C + +/** + * \def MBEDTLS_BASE64_C + * + * Enable the Base64 module. + * + * Module: library/base64.c + * Caller: library/pem.c + * + * This module is required for PEM support (required by X.509). + */ +#define MBEDTLS_BASE64_C + +/** + * \def MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + * + * Remove decryption operation for AES, ARIA and Camellia block cipher. + * + * \note This feature is incompatible with insecure block cipher, + * MBEDTLS_DES_C, and cipher modes which always require decryption + * operation, MBEDTLS_CIPHER_MODE_CBC, MBEDTLS_CIPHER_MODE_XTS and + * MBEDTLS_NIST_KW_C. When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, + * this feature is incompatible with following supported PSA equivalence, + * PSA_WANT_ALG_ECB_NO_PADDING, PSA_WANT_ALG_CBC_NO_PADDING, + * PSA_WANT_ALG_CBC_PKCS7 and PSA_WANT_KEY_TYPE_DES. + * + * Module: library/aes.c + * library/aesce.c + * library/aesni.c + * library/aria.c + * library/camellia.c + * library/cipher.c + */ +//#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + +/** + * \def MBEDTLS_BIGNUM_C + * + * Enable the multi-precision integer library. + * + * Module: library/bignum.c + * library/bignum_core.c + * library/bignum_mod.c + * library/bignum_mod_raw.c + * Caller: library/dhm.c + * library/ecp.c + * library/ecdsa.c + * library/rsa.c + * library/rsa_alt_helpers.c + * library/ssl_tls.c + * + * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. + */ +#define MBEDTLS_BIGNUM_C + +/** + * \def MBEDTLS_CAMELLIA_C + * + * Enable the Camellia block cipher. + * + * Module: library/camellia.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_CAMELLIA_C + +/** + * \def MBEDTLS_ARIA_C + * + * Enable the ARIA block cipher. + * + * Module: library/aria.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * + * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 + */ +#define MBEDTLS_ARIA_C + +/** + * \def MBEDTLS_CCM_C + * + * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. + * + * Module: library/ccm.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or + * MBEDTLS_ARIA_C + * + * This module enables the AES-CCM ciphersuites, if other requisites are + * enabled as well. + */ +#define MBEDTLS_CCM_C + +/** + * \def MBEDTLS_CHACHA20_C + * + * Enable the ChaCha20 stream cipher. + * + * Module: library/chacha20.c + */ +#define MBEDTLS_CHACHA20_C + +/** + * \def MBEDTLS_CHACHAPOLY_C + * + * Enable the ChaCha20-Poly1305 AEAD algorithm. + * + * Module: library/chachapoly.c + * + * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C + */ +#define MBEDTLS_CHACHAPOLY_C + +/** + * \def MBEDTLS_CIPHER_C + * + * Enable the generic cipher layer. + * + * Module: library/cipher.c + * Caller: library/ccm.c + * library/cmac.c + * library/gcm.c + * library/nist_kw.c + * library/pkcs12.c + * library/pkcs5.c + * library/psa_crypto_aead.c + * library/psa_crypto_mac.c + * library/ssl_ciphersuites.c + * library/ssl_msg.c + * library/ssl_ticket.c (unless MBEDTLS_USE_PSA_CRYPTO is enabled) + * Auto-enabled by: MBEDTLS_PSA_CRYPTO_C depending on which ciphers are enabled + * (see the documentation of that option for details). + * + * Uncomment to enable generic cipher wrappers. + */ +#define MBEDTLS_CIPHER_C + +/** + * \def MBEDTLS_CMAC_C + * + * Enable the CMAC (Cipher-based Message Authentication Code) mode for block + * ciphers. + * + * \note When #MBEDTLS_CMAC_ALT is active, meaning that the underlying + * implementation of the CMAC algorithm is provided by an alternate + * implementation, that alternate implementation may opt to not support + * AES-192 or 3DES as underlying block ciphers for the CMAC operation. + * + * Module: library/cmac.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_DES_C + * + */ +#define MBEDTLS_CMAC_C + +/** + * \def MBEDTLS_CTR_DRBG_C + * + * Enable the CTR_DRBG AES-based random generator. + * The CTR_DRBG generator uses AES-256 by default. + * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. + * + * AES support can either be achieved through builtin (MBEDTLS_AES_C) or PSA. + * Builtin is the default option when MBEDTLS_AES_C is defined otherwise PSA + * is used. + * + * \warning When using PSA, the user should call `psa_crypto_init()` before + * using any CTR_DRBG operation (except `mbedtls_ctr_drbg_init()`). + * + * \note AES-128 will be used if \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. + * + * \note To achieve a 256-bit security strength with CTR_DRBG, + * you must use AES-256 *and* use sufficient entropy. + * See ctr_drbg.h for more details. + * + * Module: library/ctr_drbg.c + * Caller: + * + * Requires: MBEDTLS_AES_C or + * (PSA_WANT_KEY_TYPE_AES and PSA_WANT_ALG_ECB_NO_PADDING and + * MBEDTLS_PSA_CRYPTO_C) + * + * This module provides the CTR_DRBG AES random number generator. + */ +#define MBEDTLS_CTR_DRBG_C + +/** + * \def MBEDTLS_DEBUG_C + * + * Enable the debug functions. + * + * Module: library/debug.c + * Caller: library/ssl_msg.c + * library/ssl_tls.c + * library/ssl_tls12_*.c + * library/ssl_tls13_*.c + * + * This module provides debugging functions. + */ +#define MBEDTLS_DEBUG_C + +/** + * \def MBEDTLS_DES_C + * + * Enable the DES block cipher. + * + * Module: library/des.c + * Caller: library/pem.c + * library/cipher.c + * + * PEM_PARSE uses DES/3DES for decrypting encrypted keys. + * + * \warning DES/3DES are considered weak ciphers and their use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +#define MBEDTLS_DES_C + +/** + * \def MBEDTLS_DHM_C + * + * Enable the Diffie-Hellman-Merkle module. + * + * Module: library/dhm.c + * Caller: library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * This module is used by the following key exchanges: + * DHE-RSA, DHE-PSK + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_DHM_C + +/** + * \def MBEDTLS_ECDH_C + * + * Enable the elliptic curve Diffie-Hellman library. + * + * Module: library/ecdh.c + * Caller: library/psa_crypto.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK + * + * Requires: MBEDTLS_ECP_C + */ +#define MBEDTLS_ECDH_C + +/** + * \def MBEDTLS_ECDSA_C + * + * Enable the elliptic curve DSA library. + * + * Module: library/ecdsa.c + * Caller: + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, + * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a + * short Weierstrass curve. + */ +#define MBEDTLS_ECDSA_C + +/** + * \def MBEDTLS_ECJPAKE_C + * + * Enable the elliptic curve J-PAKE library. + * + * \note EC J-PAKE support is based on the Thread v1.0.0 specification. + * It has not been reviewed for compliance with newer standards such as + * Thread v1.1 or RFC 8236. + * + * Module: library/ecjpake.c + * Caller: + * + * This module is used by the following key exchanges: + * ECJPAKE + * + * Requires: MBEDTLS_ECP_C and either MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C + * + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any EC J-PAKE operations. + */ +#define MBEDTLS_ECJPAKE_C + +/** + * \def MBEDTLS_ECP_C + * + * Enable the elliptic curve over GF(p) library. + * + * Module: library/ecp.c + * Caller: library/ecdh.c + * library/ecdsa.c + * library/ecjpake.c + * + * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED + */ +#define MBEDTLS_ECP_C + +/** + * \def MBEDTLS_ENTROPY_C + * + * Enable the platform-specific entropy code. + * + * Module: library/entropy.c + * Caller: + * + * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C + * + * This module provides a generic entropy pool + */ +#define MBEDTLS_ENTROPY_C + +/** + * \def MBEDTLS_ERROR_C + * + * Enable error code to error string conversion. + * + * Module: library/error.c + * Caller: + * + * This module enables mbedtls_strerror(). + */ +#define MBEDTLS_ERROR_C + +/** + * \def MBEDTLS_GCM_C + * + * Enable the Galois/Counter Mode (GCM). + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or + * MBEDTLS_ARIA_C + * + * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other + * requisites are enabled as well. + */ +#define MBEDTLS_GCM_C + +/** + * \def MBEDTLS_GCM_LARGE_TABLE + * + * Enable large pre-computed tables for Galois/Counter Mode (GCM). + * Can significantly increase throughput on systems without GCM hardware + * acceleration (e.g., AESNI, AESCE). + * + * The mbedtls_gcm_context size will increase by 3840 bytes. + * The code size will increase by roughly 344 bytes. + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_GCM_C + */ +//#define MBEDTLS_GCM_LARGE_TABLE + +/** + * \def MBEDTLS_HKDF_C + * + * Enable the HKDF algorithm (RFC 5869). + * + * Module: library/hkdf.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the Hashed Message Authentication Code + * (HMAC)-based key derivation function (HKDF). + */ +#define MBEDTLS_HKDF_C + +/** + * \def MBEDTLS_HMAC_DRBG_C + * + * Enable the HMAC_DRBG random generator. + * + * Module: library/hmac_drbg.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * Uncomment to enable the HMAC_DRBG random number generator. + */ +#define MBEDTLS_HMAC_DRBG_C + +/** + * \def MBEDTLS_LMS_C + * + * Enable the LMS stateful-hash asymmetric signature algorithm. + * + * Module: library/lms.c + * Caller: + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * Uncomment to enable the LMS verification algorithm and public key operations. + */ +#define MBEDTLS_LMS_C + +/** + * \def MBEDTLS_LMS_PRIVATE + * + * Enable LMS private-key operations and signing code. Functions enabled by this + * option are experimental, and should not be used in production. + * + * Requires: MBEDTLS_LMS_C + * + * Uncomment to enable the LMS signature algorithm and private key operations. + */ +//#define MBEDTLS_LMS_PRIVATE + +/** + * \def MBEDTLS_NIST_KW_C + * + * Enable the Key Wrapping mode for 128-bit block ciphers, + * as defined in NIST SP 800-38F. Only KW and KWP modes + * are supported. At the moment, only AES is approved by NIST. + * + * Module: library/nist_kw.c + * + * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C + */ +#define MBEDTLS_NIST_KW_C + +/** + * \def MBEDTLS_MD_C + * + * Enable the generic layer for message digest (hashing) and HMAC. + * + * Requires: one of: MBEDTLS_MD5_C, MBEDTLS_RIPEMD160_C, MBEDTLS_SHA1_C, + * MBEDTLS_SHA224_C, MBEDTLS_SHA256_C, MBEDTLS_SHA384_C, + * MBEDTLS_SHA512_C, or MBEDTLS_PSA_CRYPTO_C with at least + * one hash. + * Module: library/md.c + * Caller: library/constant_time.c + * library/ecdsa.c + * library/ecjpake.c + * library/hkdf.c + * library/hmac_drbg.c + * library/pk.c + * library/pkcs5.c + * library/pkcs12.c + * library/psa_crypto_ecp.c + * library/psa_crypto_rsa.c + * library/rsa.c + * library/ssl_cookie.c + * library/ssl_msg.c + * library/ssl_tls.c + * library/x509.c + * library/x509_crt.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Uncomment to enable generic message digest wrappers. + */ +#define MBEDTLS_MD_C + +/** + * \def MBEDTLS_MD5_C + * + * Enable the MD5 hash algorithm. + * + * Module: library/md5.c + * Caller: library/md.c + * library/pem.c + * library/ssl_tls.c + * + * This module is required for TLS 1.2 depending on the handshake parameters. + * Further, it is used for checking MD5-signed certificates, and for PBKDF1 + * when decrypting PEM-encoded encrypted keys. + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD5_C + +/** + * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Enable the buffer allocator implementation that makes use of a (stack) + * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() + * calls) + * + * Module: library/memory_buffer_alloc.c + * + * Requires: MBEDTLS_PLATFORM_C + * MBEDTLS_PLATFORM_MEMORY (to use it within Mbed TLS) + * + * Enable this module to enable the buffer memory allocator. + */ +//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C + +/** + * \def MBEDTLS_NET_C + * + * Enable the TCP and UDP over IPv6/IPv4 networking routines. + * + * \note This module only works on POSIX/Unix (including Linux, BSD and OS X) + * and Windows. For other platforms, you'll want to disable it, and write your + * own networking callbacks to be passed to \c mbedtls_ssl_set_bio(). + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://mbed-tls.readthedocs.io/en/latest/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/net_sockets.c + * + * This module provides networking routines. + */ +#define MBEDTLS_NET_C + +/** + * \def MBEDTLS_OID_C + * + * Enable the OID database. + * + * Module: library/oid.c + * Caller: library/asn1write.c + * library/pkcs5.c + * library/pkparse.c + * library/pkwrite.c + * library/rsa.c + * library/x509.c + * library/x509_create.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * This modules translates between OIDs and internal values. + */ +#define MBEDTLS_OID_C + +/** + * \def MBEDTLS_PADLOCK_C + * + * Enable VIA Padlock support on x86. + * + * Module: library/padlock.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the VIA PadLock on x86. + */ +#define MBEDTLS_PADLOCK_C + +/** + * \def MBEDTLS_PEM_PARSE_C + * + * Enable PEM decoding / parsing. + * + * Module: library/pem.c + * Caller: library/dhm.c + * library/pkparse.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_BASE64_C + * optionally MBEDTLS_MD5_C, or PSA Crypto with MD5 (see below) + * + * \warning When parsing password-protected files, if MD5 is provided only by + * a PSA driver, you must call psa_crypto_init() before the first file. + * + * This modules adds support for decoding / parsing PEM files. + */ +#define MBEDTLS_PEM_PARSE_C + +/** + * \def MBEDTLS_PEM_WRITE_C + * + * Enable PEM encoding / writing. + * + * Module: library/pem.c + * Caller: library/pkwrite.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for encoding / writing PEM files. + */ +#define MBEDTLS_PEM_WRITE_C + +/** + * \def MBEDTLS_PK_C + * + * Enable the generic public (asymmetric) key layer. + * + * Module: library/pk.c + * Caller: library/psa_crypto_rsa.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * library/x509.c + * + * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C or MBEDTLS_ECP_C + * + * Uncomment to enable generic public key wrappers. + */ +#define MBEDTLS_PK_C + +/** + * \def MBEDTLS_PK_PARSE_C + * + * Enable the generic public (asymmetric) key parser. + * + * Module: library/pkparse.c + * Caller: library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_OID_C, MBEDTLS_PK_C + * + * Uncomment to enable generic public key parse functions. + */ +#define MBEDTLS_PK_PARSE_C + +/** + * \def MBEDTLS_PK_WRITE_C + * + * Enable the generic public (asymmetric) key writer. + * + * Module: library/pkwrite.c + * Caller: library/x509write.c + * + * Requires: MBEDTLS_ASN1_WRITE_C, MBEDTLS_OID_C, MBEDTLS_PK_C + * + * Uncomment to enable generic public key write functions. + */ +#define MBEDTLS_PK_WRITE_C + +/** + * \def MBEDTLS_PKCS5_C + * + * Enable PKCS#5 functions. + * + * Module: library/pkcs5.c + * + * Auto-enables: MBEDTLS_MD_C + * + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS5 operations. + * + * This module adds support for the PKCS#5 functions. + */ +#define MBEDTLS_PKCS5_C + +/** + * \def MBEDTLS_PKCS7_C + * + * Enable PKCS #7 core for using PKCS #7-formatted signatures. + * RFC Link - https://tools.ietf.org/html/rfc2315 + * + * Module: library/pkcs7.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C, + * MBEDTLS_X509_CRT_PARSE_C MBEDTLS_X509_CRL_PARSE_C, + * MBEDTLS_BIGNUM_C, MBEDTLS_MD_C + * + * This module is required for the PKCS #7 parsing modules. + */ +#define MBEDTLS_PKCS7_C + +/** + * \def MBEDTLS_PKCS12_C + * + * Enable PKCS#12 PBE functions. + * Adds algorithms for parsing PKCS#8 encrypted private keys + * + * Module: library/pkcs12.c + * Caller: library/pkparse.c + * + * Requires: MBEDTLS_ASN1_PARSE_C and either MBEDTLS_MD_C or + * MBEDTLS_PSA_CRYPTO_C. + * + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS12 operations. + * + * This module enables PKCS#12 functions. + */ +#define MBEDTLS_PKCS12_C + +/** + * \def MBEDTLS_PLATFORM_C + * + * Enable the platform abstraction layer that allows you to re-assign + * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). + * + * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT + * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned + * above to be specified at runtime or compile time respectively. + * + * \note This abstraction layer must be enabled on Windows (including MSYS2) + * as other modules rely on it for a fixed snprintf implementation. + * + * Module: library/platform.c + * Caller: Most other .c files + * + * This module enables abstraction of common (libc) functions. + */ +#define MBEDTLS_PLATFORM_C + +/** + * \def MBEDTLS_POLY1305_C + * + * Enable the Poly1305 MAC algorithm. + * + * Module: library/poly1305.c + * Caller: library/chachapoly.c + */ +#define MBEDTLS_POLY1305_C + +/** + * \def MBEDTLS_PSA_CRYPTO_C + * + * Enable the Platform Security Architecture (PSA) cryptography API. + * + * \note In multithreaded applications, you must enable #MBEDTLS_THREADING_C, + * unless only one thread ever calls `psa_xxx()` functions. + * That includes indirect calls, such as: + * - performing a TLS handshake if support for TLS 1.3 is enabled; + * - using a TLS 1.3 connection; + * - indirect calls from PK, X.509 or SSL functions when + * #MBEDTLS_USE_PSA_CRYPTO is enabled; + * - indirect calls to calculate a hash when #MBEDTLS_MD_C is disabled; + * - any other call to a function that requires calling psa_crypto_init() + * beforehand. + * + * Module: library/psa_crypto.c + * + * Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. + * Auto-enables: MBEDTLS_CIPHER_C if any unauthenticated (ie, non-AEAD) cipher + * is enabled in PSA (unless it's fully accelerated, see + * docs/driver-only-builds.md about that). + */ +#define MBEDTLS_PSA_CRYPTO_C + +/** + * \def MBEDTLS_PSA_CRYPTO_SE_C + * + * Enable dynamic secure element support in the Platform Security Architecture + * cryptography API. + * + * \deprecated This feature is deprecated. Please switch to the PSA driver + * interface. + * + * \warning This feature is not thread-safe, and should not be used in a + * multi-threaded environment. + * + * Module: library/psa_crypto_se.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SE_C + +/** + * \def MBEDTLS_PSA_CRYPTO_STORAGE_C + * + * Enable the Platform Security Architecture persistent key storage. + * + * Module: library/psa_crypto_storage.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface + */ +#define MBEDTLS_PSA_CRYPTO_STORAGE_C + +/** + * \def MBEDTLS_PSA_ITS_FILE_C + * + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. + * + * Module: library/psa_its_file.c + * + * Requires: MBEDTLS_FS_IO + */ +#define MBEDTLS_PSA_ITS_FILE_C + +/** + * \def MBEDTLS_PSA_STATIC_KEY_SLOTS + * + * Statically preallocate memory to store keys' material in PSA instead + * of allocating it dynamically when required. This allows builds without a + * heap, if none of the enabled cryptographic implementations or other features + * require it. + * This feature affects both volatile and persistent keys which means that + * it's not possible to persistently store a key which is larger than + * #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE. + * + * \note This feature comes with a (potentially) higher RAM usage since: + * - All the key slots are allocated no matter if they are used or not. + * - Each key buffer's length is #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE bytes. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_STATIC_KEY_SLOTS + +/** + * \def MBEDTLS_RIPEMD160_C + * + * Enable the RIPEMD-160 hash algorithm. + * + * Module: library/ripemd160.c + * Caller: library/md.c + * + */ +#define MBEDTLS_RIPEMD160_C + +/** + * \def MBEDTLS_RSA_C + * + * Enable the RSA public-key cryptosystem. + * + * Module: library/rsa.c + * library/rsa_alt_helpers.c + * Caller: library/pk.c + * library/psa_crypto.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * This module is used by the following key exchanges: + * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C + */ +#define MBEDTLS_RSA_C + +/** + * \def MBEDTLS_SHA1_C + * + * Enable the SHA1 cryptographic hash algorithm. + * + * Module: library/sha1.c + * Caller: library/md.c + * library/psa_crypto_hash.c + * + * This module is required for TLS 1.2 depending on the handshake parameters, + * and for SHA1-signed certificates. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_SHA1_C + +/** + * \def MBEDTLS_SHA224_C + * + * Enable the SHA-224 cryptographic hash algorithm. + * + * Module: library/sha256.c + * Caller: library/md.c + * library/ssl_cookie.c + * + * This module adds support for SHA-224. + */ +#define MBEDTLS_SHA224_C + +/** + * \def MBEDTLS_SHA256_C + * + * Enable the SHA-256 cryptographic hash algorithm. + * + * Module: library/sha256.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * This module adds support for SHA-256. + * This module is required for the SSL/TLS 1.2 PRF function. + */ +#define MBEDTLS_SHA256_C + +/** + * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + * + * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms + * with the ARMv8 cryptographic extensions if they are available at runtime. + * If not, the library will fall back to the C implementation. + * + * \note If MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT is defined when building + * for a non-Armv8-A build it will be silently ignored. + * + * \note Minimum compiler versions for this feature are Clang 4.0, + * armclang 6.6 or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT. + * That name is deprecated, but may still be used as an alternative form for this + * option. + * + * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT cannot be defined at the + * same time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. + * + * Requires: MBEDTLS_SHA256_C. + * + * Module: library/sha256.c + * + * Uncomment to have the library check for the Armv8-A SHA-256 crypto extensions + * and use them if available. + */ +//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + +/** + * \def MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + * + * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. + * This name is now deprecated, but may still be used as an alternative form for + * this option. + */ +//#define MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + +/** + * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY + * + * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms + * with the ARMv8 cryptographic extensions, which must be available at runtime + * or else an illegal instruction fault will occur. + * + * \note This allows builds with a smaller code size than with + * MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + * + * \note Minimum compiler versions for this feature are Clang 4.0, + * armclang 6.6 or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY. + * That name is deprecated, but may still be used as an alternative form for this + * option. + * + * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY cannot be defined at the same + * time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. + * + * Requires: MBEDTLS_SHA256_C. + * + * Module: library/sha256.c + * + * Uncomment to have the library use the Armv8-A SHA-256 crypto extensions + * unconditionally. + */ +//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY + +/** + * \def MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + * + * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. + * This name is now deprecated, but may still be used as an alternative form for + * this option. + */ +//#define MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + +/** + * \def MBEDTLS_SHA384_C + * + * Enable the SHA-384 cryptographic hash algorithm. + * + * Module: library/sha512.c + * Caller: library/md.c + * library/psa_crypto_hash.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * Comment to disable SHA-384 + */ +#define MBEDTLS_SHA384_C + +/** + * \def MBEDTLS_SHA512_C + * + * Enable SHA-512 cryptographic hash algorithms. + * + * Module: library/sha512.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_tls.c + * library/ssl_cookie.c + * + * This module adds support for SHA-512. + */ +#define MBEDTLS_SHA512_C + +/** + * \def MBEDTLS_SHA3_C + * + * Enable the SHA3 cryptographic hash algorithm. + * + * Module: library/sha3.c + * + * This module adds support for SHA3. + */ +#define MBEDTLS_SHA3_C + +/** + * \def MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT + * + * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms + * with the ARMv8 cryptographic extensions if they are available at runtime. + * If not, the library will fall back to the C implementation. + * + * \note If MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT is defined when building + * for a non-Aarch64 build it will be silently ignored. + * + * \note Minimum compiler versions for this feature are Clang 7.0, + * armclang 6.9 or GCC 8.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for + * armclang 6.9 + * + * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the + * same time as MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY. + * + * Requires: MBEDTLS_SHA512_C. + * + * Module: library/sha512.c + * + * Uncomment to have the library check for the A64 SHA-512 crypto extensions + * and use them if available. + */ +//#define MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT + +/** + * \def MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY + * + * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms + * with the ARMv8 cryptographic extensions, which must be available at runtime + * or else an illegal instruction fault will occur. + * + * \note This allows builds with a smaller code size than with + * MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT + * + * \note Minimum compiler versions for this feature are Clang 7.0, + * armclang 6.9 or GCC 8.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for + * armclang 6.9 + * + * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY cannot be defined at the same + * time as MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT. + * + * Requires: MBEDTLS_SHA512_C. + * + * Module: library/sha512.c + * + * Uncomment to have the library use the A64 SHA-512 crypto extensions + * unconditionally. + */ +//#define MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY + +/** + * \def MBEDTLS_SSL_CACHE_C + * + * Enable simple SSL cache implementation. + * + * Module: library/ssl_cache.c + * Caller: + * + * Requires: MBEDTLS_SSL_CACHE_C + */ +#define MBEDTLS_SSL_CACHE_C + +/** + * \def MBEDTLS_SSL_COOKIE_C + * + * Enable basic implementation of DTLS cookies for hello verification. + * + * Module: library/ssl_cookie.c + * Caller: + */ +#define MBEDTLS_SSL_COOKIE_C + +/** + * \def MBEDTLS_SSL_TICKET_C + * + * Enable an implementation of TLS server-side callbacks for session tickets. + * + * Module: library/ssl_ticket.c + * Caller: + * + * Requires: (MBEDTLS_CIPHER_C || MBEDTLS_USE_PSA_CRYPTO) && + * (MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C) + */ +#define MBEDTLS_SSL_TICKET_C + +/** + * \def MBEDTLS_SSL_CLI_C + * + * Enable the SSL/TLS client code. + * + * Module: library/ssl*_client.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS client support. + */ +#define MBEDTLS_SSL_CLI_C + +/** + * \def MBEDTLS_SSL_SRV_C + * + * Enable the SSL/TLS server code. + * + * Module: library/ssl*_server.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS server support. + */ +#define MBEDTLS_SSL_SRV_C + +/** + * \def MBEDTLS_SSL_TLS_C + * + * Enable the generic SSL/TLS code. + * + * Module: library/ssl_tls.c + * Caller: library/ssl*_client.c + * library/ssl*_server.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * and at least one of the MBEDTLS_SSL_PROTO_XXX defines + * + * This module is required for SSL/TLS. + */ +#define MBEDTLS_SSL_TLS_C + +/** + * \def MBEDTLS_THREADING_C + * + * Enable the threading abstraction layer. + * + * Traditionally, Mbed TLS assumes it is used in a non-threaded environment or + * that contexts are not shared between threads. If you do intend to use contexts + * between threads, you will need to enable this layer to prevent race + * conditions. + * + * The PSA subsystem has an implicit shared context. Therefore, you must + * enable this option if more than one thread may use any part of + * Mbed TLS that is implemented on top of the PSA subsystem. + * + * You must enable this option in multithreaded applications where more than + * one thread performs any of the following operations: + * + * - Any call to a PSA function (`psa_xxx()`). + * - Any call to a TLS, X.509 or PK function (`mbedtls_ssl_xxx()`, + * `mbedtls_x509_xxx()`, `mbedtls_pkcs7_xxx()`, `mbedtls_pk_xxx()`) + * if `MBEDTLS_USE_PSA_CRYPTO` is enabled (regardless of whether individual + * TLS, X.509 or PK contexts are shared between threads). + * - A TLS 1.3 connection, regardless of the compile-time configuration. + * - Any library feature that calculates a hash, if `MBEDTLS_MD_C` is disabled. + * As an exception, algorithm-specific low-level modules do not require + * threading protection unless the contexts are shared between threads. + * - Any library feature that performs symmetric encryption or decryption, + * if `MBEDTLS_CIPHER_C` is disabled. + * As an exception, algorithm-specific low-level modules do not require + * threading protection unless the contexts are shared between threads. + * - Any use of a cryptographic context if the same context is used in + * multiple threads. + * - Any call to a function where the documentation specifies that + * psa_crypto_init() must be called prior to that function. + * + * See also our Knowledge Base article about threading: + * https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading + * + * Module: library/threading.c + * + * This allows different threading implementations (self-implemented or + * provided). + * + * You will have to enable either MBEDTLS_THREADING_ALT or + * MBEDTLS_THREADING_PTHREAD. + * + * Enable this layer to allow use of mutexes within Mbed TLS + */ +//#define MBEDTLS_THREADING_C + +/** + * \def MBEDTLS_TIMING_C + * + * Enable the semi-portable timing interface. + * + * \note The provided implementation only works on POSIX/Unix (including Linux, + * BSD and OS X) and Windows. On other platforms, you can either disable that + * module and provide your own implementations of the callbacks needed by + * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide + * your own implementation of the whole module by setting + * \c MBEDTLS_TIMING_ALT in the current file. + * + * \note The timing module will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://mbed-tls.readthedocs.io/en/latest/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/timing.c + */ +#define MBEDTLS_TIMING_C + +/** + * \def MBEDTLS_VERSION_C + * + * Enable run-time version information. + * + * Module: library/version.c + * + * This module provides run-time version information. + */ +#define MBEDTLS_VERSION_C + +/** + * \def MBEDTLS_X509_USE_C + * + * Enable X.509 core for using certificates. + * + * Module: library/x509.c + * Caller: library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C, + * (MBEDTLS_MD_C or MBEDTLS_USE_PSA_CRYPTO) + * + * \warning If building with MBEDTLS_USE_PSA_CRYPTO, you must call + * psa_crypto_init() before doing any X.509 operation. + * + * This module is required for the X.509 parsing modules. + */ +#define MBEDTLS_X509_USE_C + +/** + * \def MBEDTLS_X509_CRT_PARSE_C + * + * Enable X.509 certificate parsing. + * + * Module: library/x509_crt.c + * Caller: library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 certificate parsing. + */ +#define MBEDTLS_X509_CRT_PARSE_C + +/** + * \def MBEDTLS_X509_CRL_PARSE_C + * + * Enable X.509 CRL parsing. + * + * Module: library/x509_crl.c + * Caller: library/x509_crt.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 CRL parsing. + */ +#define MBEDTLS_X509_CRL_PARSE_C + +/** + * \def MBEDTLS_X509_CSR_PARSE_C + * + * Enable X.509 Certificate Signing Request (CSR) parsing. + * + * Module: library/x509_csr.c + * Caller: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is used for reading X.509 certificate request. + */ +#define MBEDTLS_X509_CSR_PARSE_C + +/** + * \def MBEDTLS_X509_CREATE_C + * + * Enable X.509 core for creating certificates. + * + * Module: library/x509_create.c + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C, + * (MBEDTLS_MD_C or MBEDTLS_USE_PSA_CRYPTO) + * + * \warning If building with MBEDTLS_USE_PSA_CRYPTO, you must call + * psa_crypto_init() before doing any X.509 create operation. + * + * This module is the basis for creating X.509 certificates and CSRs. + */ +#define MBEDTLS_X509_CREATE_C + +/** + * \def MBEDTLS_X509_CRT_WRITE_C + * + * Enable creating X.509 certificates. + * + * Module: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate creation. + */ +#define MBEDTLS_X509_CRT_WRITE_C + +/** + * \def MBEDTLS_X509_CSR_WRITE_C + * + * Enable creating X.509 Certificate Signing Requests (CSR). + * + * Module: library/x509_csr_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate request writing. + */ +#define MBEDTLS_X509_CSR_WRITE_C + +/** \} name SECTION: Mbed TLS modules */ + +/** + * \name SECTION: General configuration options + * + * This section contains Mbed TLS build settings that are not associated + * with a particular module. + * + * \{ + */ + +/** + * \def MBEDTLS_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"mbedtls/mbedtls_config.h"`. + * This header file specifies the compile-time configuration of Mbed TLS. + * Unlike other configuration options, this one must be defined on the + * compiler command line: a definition in `mbedtls_config.h` would have + * no effect. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h" + +/** + * \def MBEDTLS_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_USER_CONFIG_FILE "/dev/null" + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"psa/crypto_config.h"`. + * This header file specifies which cryptographic mechanisms are available + * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and + * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" + +/** + * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" + +/** + * \def MBEDTLS_PSA_CRYPTO_PLATFORM_FILE + * + * If defined, this is a header which will be included instead of + * `"psa/crypto_platform.h"`. This file should declare the same identifiers + * as the one in Mbed TLS, but with definitions adapted to the platform on + * which the library code will run. + * + * \note The required content of this header can vary from one version of + * Mbed TLS to the next. Integrators who provide an alternative file + * should review the changes in the original file whenever they + * upgrade Mbed TLS. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h" + +/** + * \def MBEDTLS_PSA_CRYPTO_STRUCT_FILE + * + * If defined, this is a header which will be included instead of + * `"psa/crypto_struct.h"`. This file should declare the same identifiers + * as the one in Mbed TLS, but with definitions adapted to the environment + * in which the library code will run. The typical use for this feature + * is to provide alternative type definitions on the client side in + * client-server integrations of PSA crypto, where operation structures + * contain handles instead of cryptographic data. + * + * \note The required content of this header can vary from one version of + * Mbed TLS to the next. Integrators who provide an alternative file + * should review the changes in the original file whenever they + * upgrade Mbed TLS. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h" + +/** \} name SECTION: General configuration options */ + +/** + * \name SECTION: Module configuration options + * + * This section allows for the setting of module specific sizes and + * configuration options. The default values are already present in the + * relevant header files and should suffice for the regular use cases. + * + * Our advice is to enable options and change their values here + * only if you have a good reason and know the consequences. + * \{ + */ +/* The Doxygen documentation here is used when a user comments out a + * setting and runs doxygen themselves. On the other hand, when we typeset + * the full documentation including disabled settings, the documentation + * in specific modules' header files is used if present. When editing this + * file, make sure that each option is documented in exactly one place, + * plus optionally a same-line Doxygen comment here if there is a Doxygen + * comment in the specific module. */ + +/* MPI / BIGNUM options */ +//#define MBEDTLS_MPI_WINDOW_SIZE 2 /**< Maximum window size used. */ +//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ + +/* CTR_DRBG options */ +//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ +//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* HMAC_DRBG options */ +//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* ECP options */ +//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */ +//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ + +/* Entropy options */ +//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */ + +/* Memory buffer allocator options */ +//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ + +/* Platform options */ +//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ + +/** \def MBEDTLS_PLATFORM_STD_CALLOC + * + * Default allocator to use, can be undefined. + * It must initialize the allocated buffer memory to zeroes. + * The size of the buffer is the product of the two parameters. + * The calloc function returns either a null pointer or a pointer to the allocated space. + * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details. + * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. + */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc + +/** \def MBEDTLS_PLATFORM_STD_FREE + * + * Default free to use, can be undefined. + * NULL is a valid parameter, and the function must do nothing. + * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). + */ +//#define MBEDTLS_PLATFORM_STD_FREE free +//#define MBEDTLS_PLATFORM_STD_SETBUF setbuf /**< Default setbuf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ + +/* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */ +/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */ +//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_SETBUF_MACRO setbuf /**< Default setbuf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t //#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t /**< Default milliseconds time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled. It must be signed, and at least 64 bits. If it is changed from the default, MBEDTLS_PRINTF_MS_TIME must be updated to match.*/ +//#define MBEDTLS_PRINTF_MS_TIME PRId64 /**< Default fmt for printf. That's avoid compiler warning if mbedtls_ms_time_t is redefined */ + +/** \def MBEDTLS_PLATFORM_DEV_RANDOM + * + * Path to a special file that returns cryptographic-quality random bytes + * when read. This is used by the default platform entropy source on + * non-Windows platforms unless a dedicated system call is available + * (see #MBEDTLS_NO_PLATFORM_ENTROPY). + * + * The default value is `/dev/random`, which is suitable on most platforms + * other than Linux. On Linux, either `/dev/random` or `/dev/urandom` + * may be the right choice, depending on the circumstances: + * + * - If possible, the library will use the getrandom() system call, + * which is preferable, and #MBEDTLS_PLATFORM_DEV_RANDOM is not used. + * - If there is a dedicated hardware entropy source (e.g. RDRAND on x86 + * processors), then both `/dev/random` and `/dev/urandom` are fine. + * - `/dev/random` is always secure. However, with kernels older than 5.6, + * `/dev/random` often blocks unnecessarily if there is no dedicated + * hardware entropy source. + * - `/dev/urandom` never blocks. However, it may return predictable data + * if it is used early after the kernel boots, especially on embedded + * devices without an interactive user. + * + * Thus you should change the value to `/dev/urandom` if your application + * definitely won't be used on a device running Linux without a dedicated + * entropy source early during or after boot. + * + * This is the default value of ::mbedtls_platform_dev_random, which + * can be changed at run time. + */ +//#define MBEDTLS_PLATFORM_DEV_RANDOM "/dev/random" + +/** \def MBEDTLS_CHECK_RETURN + * + * This macro is used at the beginning of the declaration of a function + * to indicate that its return value should be checked. It should + * instruct the compiler to emit a warning or an error if the function + * is called without checking its return value. + * + * There is a default implementation for popular compilers in platform_util.h. + * You can override the default implementation by defining your own here. + * + * If the implementation here is empty, this will effectively disable the + * checking of functions' return values. + */ +//#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) + +/** \def MBEDTLS_IGNORE_RETURN + * + * This macro requires one argument, which should be a C function call. + * If that function call would cause a #MBEDTLS_CHECK_RETURN warning, this + * warning is suppressed. + */ +//#define MBEDTLS_IGNORE_RETURN( result ) ((void) !(result)) + +/* PSA options */ +/** + * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the + * PSA crypto subsystem. + * + * If this option is unset, the library chooses a hash (currently between + * #MBEDTLS_MD_SHA512 and #MBEDTLS_MD_SHA256) based on availability and + * unspecified heuristics. + * + * \note The PSA crypto subsystem uses the first available mechanism amongst + * the following: + * - #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG if enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus CTR_DRBG with AES + * if #MBEDTLS_CTR_DRBG_C is enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus HMAC_DRBG. + * + * A future version may reevaluate the prioritization of DRBG mechanisms. + */ +//#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 + +/** \def MBEDTLS_PSA_KEY_SLOT_COUNT + * + * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled, + * the maximum amount of PSA keys simultaneously in memory. This counts all + * volatile keys, plus loaded persistent keys. + * + * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is enabled, + * the maximum number of loaded persistent keys. + * + * Currently, persistent keys do not need to be loaded all the time while + * a multipart operation is in progress, only while the operation is being + * set up. This may change in future versions of the library. + * + * Currently, the library traverses of the whole table on each access to a + * persistent key. Therefore large values may cause poor performance. + * + * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. + */ +//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 + +/** + * \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE + * + * Define the size (in bytes) of each static key buffer when + * #MBEDTLS_PSA_STATIC_KEY_SLOTS is set. If not + * explicitly defined then it's automatically guessed from available PSA keys + * enabled in the build through PSA_WANT_xxx symbols. + * If required by the application this parameter can be set to higher values + * in order to store larger objects (ex: raw keys), but please note that this + * will increase RAM usage. + */ +//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256 + +/* RSA OPTIONS */ +//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */ + +/* SSL Cache options */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ + +/* SSL options */ + +/** \def MBEDTLS_SSL_IN_CONTENT_LEN + * + * Maximum length (in bytes) of incoming plaintext fragments. + * + * This determines the size of the incoming TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of the incoming I/O buffer. + */ +//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_CID_IN_LEN_MAX + * + * The maximum length of CIDs used for incoming DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_OUT_LEN_MAX + * + * The maximum length of CIDs used for outgoing DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * in TLS 1.3 and when using the Connection ID extension in DTLS 1.2. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + */ +//#define MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16 + +/** \def MBEDTLS_SSL_OUT_CONTENT_LEN + * + * Maximum length (in bytes) of outgoing plaintext fragments. + * + * This determines the size of the outgoing TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * It is possible to save RAM by setting a smaller outward buffer, while keeping + * the default inward 16384 byte buffer to conform to the TLS specification. + * + * The minimum required outward buffer size is determined by the handshake + * protocol's usage. Handshaking will fail if the outward buffer is too small. + * The specific size requirement depends on the configured ciphers and any + * certificate data which is sent during the handshake. + * + * Uncomment to set the maximum plaintext size of the outgoing I/O buffer. + */ +//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING + * + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + * + * This should be at least 9/8 * MBEDTLS_SSL_IN_CONTENT_LEN + * to account for a reassembled handshake message of maximum size, + * together with its reassembly bitmap. + * + * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) + * should be sufficient for all practical situations as it allows + * to reassembly a large handshake message (such as a certificate) + * while buffering multiple smaller handshake messages. + * + */ +//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 + +//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 or 384 bits) */ +//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ + +/** + * Complete list of ciphersuites to use, in order of preference. + * + * \warning No dependency checking is done on that field! This option can only + * be used to restrict the set of available ciphersuites. It is your + * responsibility to make sure the needed modules are active. + * + * Use this to save a few hundred bytes of ROM (default ordering of all + * available ciphersuites) and a few to a few hundred bytes of RAM. + * + * The value below is only an example, not the default. + */ +//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +/** + * \def MBEDTLS_SSL_MAX_EARLY_DATA_SIZE + * + * The default maximum amount of 0-RTT data. See the documentation of + * \c mbedtls_ssl_conf_max_early_data_size() for more information. + * + * It must be positive and smaller than UINT32_MAX. + * + * If MBEDTLS_SSL_EARLY_DATA is not defined, this default value does not + * have any impact on the build. + */ +//#define MBEDTLS_SSL_MAX_EARLY_DATA_SIZE 1024 + +/** + * \def MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE + * + * Maximum allowed ticket age difference in milliseconds tolerated between + * server and client. Default value is 6000. This is not used in TLS 1.2. + * + * - The client ticket age is the time difference between the time when the + * client proposes to the server to use the ticket and the time the client + * received the ticket from the server. + * - The server ticket age is the time difference between the time when the + * server receives a proposition from the client to use the ticket and the + * time when the ticket was created by the server. + * + * The ages might be different due to the client and server clocks not running + * at the same pace. The typical accuracy of an RTC crystal is ±100 to ±20 parts + * per million (360 to 72 milliseconds per hour). Default tolerance window is + * 6s, thus in the worst case clients and servers must sync up their system time + * every 6000/360/2~=8 hours. + * + * See section 8.3 of the TLS 1.3 specification(RFC 8446) for more information. + */ +//#define MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE 6000 + +/** + * \def MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH + * + * Size in bytes of a ticket nonce. This is not used in TLS 1.2. + * + * This must be less than 256. + */ +//#define MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH 32 + +/** + * \def MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS + * + * Default number of NewSessionTicket messages to be sent by a TLS 1.3 server + * after handshake completion. This is not used in TLS 1.2 and relevant only if + * the MBEDTLS_SSL_SESSION_TICKETS option is enabled. + * + */ +//#define MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS 1 + +/* X509 options */ +//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ +//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ + +/** \} name SECTION: Module configuration options */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md.h new file mode 100644 index 00000000..478e9f76 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md.h @@ -0,0 +1,526 @@ +/** + * \file md.h + * + * \brief This file contains the generic functions for message-digest + * (hashing) and HMAC. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_MD_H +#define MBEDTLS_MD_H +#include "mbedtls/private_access.h" + +#include + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE -0x5080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MD_BAD_INPUT_DATA -0x5100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_MD_ALLOC_FAILED -0x5180 +/** Opening or reading of file failed. */ +#define MBEDTLS_ERR_MD_FILE_IO_ERROR -0x5200 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported message digests. + * + * \warning MD5 and SHA-1 are considered weak message digests and + * their use constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +/* Note: these are aligned with the definitions of PSA_ALG_ macros for hashes, + * in order to enable an efficient implementation of conversion functions. + * This is tested by md_to_from_psa() in test_suite_md. */ +typedef enum { + MBEDTLS_MD_NONE=0, /**< None. */ + MBEDTLS_MD_MD5=0x03, /**< The MD5 message digest. */ + MBEDTLS_MD_RIPEMD160=0x04, /**< The RIPEMD-160 message digest. */ + MBEDTLS_MD_SHA1=0x05, /**< The SHA-1 message digest. */ + MBEDTLS_MD_SHA224=0x08, /**< The SHA-224 message digest. */ + MBEDTLS_MD_SHA256=0x09, /**< The SHA-256 message digest. */ + MBEDTLS_MD_SHA384=0x0a, /**< The SHA-384 message digest. */ + MBEDTLS_MD_SHA512=0x0b, /**< The SHA-512 message digest. */ + MBEDTLS_MD_SHA3_224=0x10, /**< The SHA3-224 message digest. */ + MBEDTLS_MD_SHA3_256=0x11, /**< The SHA3-256 message digest. */ + MBEDTLS_MD_SHA3_384=0x12, /**< The SHA3-384 message digest. */ + MBEDTLS_MD_SHA3_512=0x13, /**< The SHA3-512 message digest. */ +} mbedtls_md_type_t; + +/* Note: this should always be >= PSA_HASH_MAX_SIZE + * in all builds with both CRYPTO_C and MD_LIGHT. + * + * This is to make things easier for modules such as TLS that may define a + * buffer size using MD_MAX_SIZE in a part of the code that's common to PSA + * and legacy, then assume the buffer's size is PSA_HASH_MAX_SIZE in another + * part of the code based on PSA. + */ +#if defined(MBEDTLS_MD_CAN_SHA512) || defined(MBEDTLS_MD_CAN_SHA3_512) +#define MBEDTLS_MD_MAX_SIZE 64 /* longest known is SHA512 */ +#elif defined(MBEDTLS_MD_CAN_SHA384) || defined(MBEDTLS_MD_CAN_SHA3_384) +#define MBEDTLS_MD_MAX_SIZE 48 /* longest known is SHA384 */ +#elif defined(MBEDTLS_MD_CAN_SHA256) || defined(MBEDTLS_MD_CAN_SHA3_256) +#define MBEDTLS_MD_MAX_SIZE 32 /* longest known is SHA256 */ +#elif defined(MBEDTLS_MD_CAN_SHA224) || defined(MBEDTLS_MD_CAN_SHA3_224) +#define MBEDTLS_MD_MAX_SIZE 28 /* longest known is SHA224 */ +#else +#define MBEDTLS_MD_MAX_SIZE 20 /* longest known is SHA1 or RIPE MD-160 + or smaller (MD5 and earlier) */ +#endif + +#if defined(MBEDTLS_MD_CAN_SHA3_224) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 144 /* the longest known is SHA3-224 */ +#elif defined(MBEDTLS_MD_CAN_SHA3_256) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 136 +#elif defined(MBEDTLS_MD_CAN_SHA512) || defined(MBEDTLS_MD_CAN_SHA384) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 128 +#elif defined(MBEDTLS_MD_CAN_SHA3_384) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 104 +#elif defined(MBEDTLS_MD_CAN_SHA3_512) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 72 +#else +#define MBEDTLS_MD_MAX_BLOCK_SIZE 64 +#endif + +/** + * Opaque struct. + * + * Constructed using either #mbedtls_md_info_from_string or + * #mbedtls_md_info_from_type. + * + * Fields can be accessed with #mbedtls_md_get_size, + * #mbedtls_md_get_type and #mbedtls_md_get_name. + */ +/* Defined internally in library/md_wrap.h. */ +typedef struct mbedtls_md_info_t mbedtls_md_info_t; + +/** + * Used internally to indicate whether a context uses legacy or PSA. + * + * Internal use only. + */ +typedef enum { + MBEDTLS_MD_ENGINE_LEGACY = 0, + MBEDTLS_MD_ENGINE_PSA, +} mbedtls_md_engine_t; + +/** + * The generic message-digest context. + */ +typedef struct mbedtls_md_context_t { + /** Information about the associated message digest. */ + const mbedtls_md_info_t *MBEDTLS_PRIVATE(md_info); + +#if defined(MBEDTLS_MD_SOME_PSA) + /** Are hash operations dispatched to PSA or legacy? */ + mbedtls_md_engine_t MBEDTLS_PRIVATE(engine); +#endif + + /** The digest-specific context (legacy) or the PSA operation. */ + void *MBEDTLS_PRIVATE(md_ctx); + +#if defined(MBEDTLS_MD_C) + /** The HMAC part of the context. */ + void *MBEDTLS_PRIVATE(hmac_ctx); +#endif +} mbedtls_md_context_t; + +/** + * \brief This function returns the message-digest information + * associated with the given digest type. + * + * \param md_type The type of digest to search for. + * + * \return The message-digest information associated with \p md_type. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_type(mbedtls_md_type_t md_type); + +/** + * \brief This function initializes a message-digest context without + * binding it to a particular message-digest algorithm. + * + * This function should always be called first. It prepares the + * context for mbedtls_md_setup() for binding it to a + * message-digest algorithm. + */ +void mbedtls_md_init(mbedtls_md_context_t *ctx); + +/** + * \brief This function clears the internal structure of \p ctx and + * frees any embedded internal structure, but does not free + * \p ctx itself. + * + * If you have called mbedtls_md_setup() on \p ctx, you must + * call mbedtls_md_free() when you are no longer using the + * context. + * Calling this function if you have previously + * called mbedtls_md_init() and nothing else is optional. + * You must not call this function if you have not called + * mbedtls_md_init(). + */ +void mbedtls_md_free(mbedtls_md_context_t *ctx); + + +/** + * \brief This function selects the message digest algorithm to use, + * and allocates internal structures. + * + * It should be called after mbedtls_md_init() or + * mbedtls_md_free(). Makes it necessary to call + * mbedtls_md_free() later. + * + * \param ctx The context to set up. + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + * or non-zero: HMAC is used with this context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_setup(mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info, int hmac); + +/** + * \brief This function clones the state of a message-digest + * context. + * + * \note You must call mbedtls_md_setup() on \c dst before calling + * this function. + * + * \note The two contexts must have the same type, + * for example, both are SHA-256. + * + * \warning This function clones the message-digest state, not the + * HMAC state. + * + * \param dst The destination context. + * \param src The context to be cloned. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + * \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + * not using the same engine. This can be avoided by moving + * the call to psa_crypto_init() before the first call to + * mbedtls_md_setup(). + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_clone(mbedtls_md_context_t *dst, + const mbedtls_md_context_t *src); + +/** + * \brief This function extracts the message-digest size from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The size of the message-digest output in Bytes. + */ +unsigned char mbedtls_md_get_size(const mbedtls_md_info_t *md_info); + +/** + * \brief This function gives the message-digest size associated to + * message-digest type. + * + * \param md_type The message-digest type. + * + * \return The size of the message-digest output in Bytes, + * or 0 if the message-digest type is not known. + */ +static inline unsigned char mbedtls_md_get_size_from_type(mbedtls_md_type_t md_type) +{ + return mbedtls_md_get_size(mbedtls_md_info_from_type(md_type)); +} + +/** + * \brief This function extracts the message-digest type from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The type of the message digest. + */ +mbedtls_md_type_t mbedtls_md_get_type(const mbedtls_md_info_t *md_info); + +/** + * \brief This function starts a message-digest computation. + * + * You must call this function after setting up the context + * with mbedtls_md_setup(), and before passing data with + * mbedtls_md_update(). + * + * \param ctx The generic message-digest context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_starts(mbedtls_md_context_t *ctx); + +/** + * \brief This function feeds an input buffer into an ongoing + * message-digest computation. + * + * You must call mbedtls_md_starts() before calling this + * function. You may call this function multiple times. + * Afterwards, call mbedtls_md_finish(). + * + * \param ctx The generic message-digest context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_update(mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen); + +/** + * \brief This function finishes the digest operation, + * and writes the result to the output buffer. + * + * Call this function after a call to mbedtls_md_starts(), + * followed by any number of calls to mbedtls_md_update(). + * Afterwards, you may either clear the context with + * mbedtls_md_free(), or call mbedtls_md_starts() to reuse + * the context for another digest operation with the same + * algorithm. + * + * \param ctx The generic message-digest context. + * \param output The buffer for the generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_finish(mbedtls_md_context_t *ctx, unsigned char *output); + +/** + * \brief This function calculates the message-digest of a buffer, + * with respect to a configurable message-digest algorithm + * in a single call. + * + * The result is calculated as + * Output = message_digest(input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param input The buffer holding the data. + * \param ilen The length of the input data. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md(const mbedtls_md_info_t *md_info, const unsigned char *input, size_t ilen, + unsigned char *output); + +/** + * \brief This function returns the list of digests supported by the + * generic digest module. + * + * \note The list starts with the strongest available hashes. + * + * \return A statically allocated array of digests. Each element + * in the returned list is an integer belonging to the + * message-digest enumeration #mbedtls_md_type_t. + * The last entry is 0. + */ +const int *mbedtls_md_list(void); + +/** + * \brief This function returns the message-digest information + * associated with the given digest name. + * + * \param md_name The name of the digest to search for. + * + * \return The message-digest information associated with \p md_name. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_string(const char *md_name); + +/** + * \brief This function returns the name of the message digest for + * the message-digest information structure given. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The name of the message digest. + */ +const char *mbedtls_md_get_name(const mbedtls_md_info_t *md_info); + +/** + * \brief This function returns the message-digest information + * from the given context. + * + * \param ctx The context from which to extract the information. + * This must be initialized (or \c NULL). + * + * \return The message-digest information associated with \p ctx. + * \return \c NULL if \p ctx is \c NULL. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_ctx( + const mbedtls_md_context_t *ctx); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function calculates the message-digest checksum + * result of the contents of the provided file. + * + * The result is calculated as + * Output = message_digest(file contents). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param path The input file name. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_FILE_IO_ERROR on an I/O error accessing + * the file pointed by \p path. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info was NULL. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_file(const mbedtls_md_info_t *md_info, const char *path, + unsigned char *output); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief This function sets the HMAC key and prepares to + * authenticate a new message. + * + * Call this function after mbedtls_md_setup(), to use + * the MD context for an HMAC calculation, then call + * mbedtls_md_hmac_update() to provide the input data, and + * mbedtls_md_hmac_finish() to get the HMAC value. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC key in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_starts(mbedtls_md_context_t *ctx, const unsigned char *key, + size_t keylen); + +/** + * \brief This function feeds an input buffer into an ongoing HMAC + * computation. + * + * Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + * before calling this function. + * You may call this function multiple times to pass the + * input piecewise. + * Afterwards, call mbedtls_md_hmac_finish(). + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_update(mbedtls_md_context_t *ctx, const unsigned char *input, + size_t ilen); + +/** + * \brief This function finishes the HMAC operation, and writes + * the result to the output buffer. + * + * Call this function after mbedtls_md_hmac_starts() and + * mbedtls_md_hmac_update() to get the HMAC value. Afterwards + * you may either call mbedtls_md_free() to clear the context, + * or call mbedtls_md_hmac_reset() to reuse the context with + * the same HMAC key. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param output The generic HMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_finish(mbedtls_md_context_t *ctx, unsigned char *output); + +/** + * \brief This function prepares to authenticate a new message with + * the same key as the previous HMAC operation. + * + * You may call this function after mbedtls_md_hmac_finish(). + * Afterwards call mbedtls_md_hmac_update() to pass the new + * input. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_reset(mbedtls_md_context_t *ctx); + +/** + * \brief This function calculates the full generic HMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The HMAC result is calculated as + * output = generic HMAC(hmac key, input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC secret key in Bytes. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The generic HMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac(const mbedtls_md_info_t *md_info, const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_MD_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md5.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md5.h new file mode 100644 index 00000000..6bf0754a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/md5.h @@ -0,0 +1,190 @@ +/** + * \file md5.h + * + * \brief MD5 message digest algorithm (hash function) + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_MD5_H +#define MBEDTLS_MD5_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD5_ALT) +// Regular implementation +// + +/** + * \brief MD5 context structure + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md5_context { + uint32_t MBEDTLS_PRIVATE(total)[2]; /*!< number of bytes processed */ + uint32_t MBEDTLS_PRIVATE(state)[4]; /*!< intermediate digest state */ + unsigned char MBEDTLS_PRIVATE(buffer)[64]; /*!< data block being processed */ +} +mbedtls_md5_context; + +#else /* MBEDTLS_MD5_ALT */ +#include "md5_alt.h" +#endif /* MBEDTLS_MD5_ALT */ + +/** + * \brief Initialize MD5 context + * + * \param ctx MD5 context to be initialized + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_init(mbedtls_md5_context *ctx); + +/** + * \brief Clear MD5 context + * + * \param ctx MD5 context to be cleared + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_free(mbedtls_md5_context *ctx); + +/** + * \brief Clone (the state of) an MD5 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_clone(mbedtls_md5_context *dst, + const mbedtls_md5_context *src); + +/** + * \brief MD5 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_starts(mbedtls_md5_context *ctx); + +/** + * \brief MD5 process buffer + * + * \param ctx MD5 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_update(mbedtls_md5_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief MD5 final digest + * + * \param ctx MD5 context + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_finish(mbedtls_md5_context *ctx, + unsigned char output[16]); + +/** + * \brief MD5 process data block (internal use only) + * + * \param ctx MD5 context + * \param data buffer holding one block of data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md5_process(mbedtls_md5_context *ctx, + const unsigned char data[64]); + +/** + * \brief Output = MD5( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5(const unsigned char *input, + size_t ilen, + unsigned char output[16]); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md5.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/memory_buffer_alloc.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/memory_buffer_alloc.h new file mode 100644 index 00000000..b527d9b6 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/memory_buffer_alloc.h @@ -0,0 +1,142 @@ +/** + * \file memory_buffer_alloc.h + * + * \brief Buffer-based memory allocator + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_MEMORY_BUFFER_ALLOC_H +#define MBEDTLS_MEMORY_BUFFER_ALLOC_H + +#include "mbedtls/build_info.h" + +#include + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_MEMORY_ALIGN_MULTIPLE) +#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_MEMORY_VERIFY_NONE 0 +#define MBEDTLS_MEMORY_VERIFY_ALLOC (1 << 0) +#define MBEDTLS_MEMORY_VERIFY_FREE (1 << 1) +#define MBEDTLS_MEMORY_VERIFY_ALWAYS (MBEDTLS_MEMORY_VERIFY_ALLOC | \ + MBEDTLS_MEMORY_VERIFY_FREE) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Initialize use of stack-based memory allocator. + * The stack-based allocator does memory management inside the + * presented buffer and does not call calloc() and free(). + * It sets the global mbedtls_calloc() and mbedtls_free() pointers + * to its own functions. + * (Provided mbedtls_calloc() and mbedtls_free() are thread-safe if + * MBEDTLS_THREADING_C is defined) + * + * \note This code is not optimized and provides a straight-forward + * implementation of a stack-based memory allocator. + * + * \param buf buffer to use as heap + * \param len size of the buffer + */ +void mbedtls_memory_buffer_alloc_init(unsigned char *buf, size_t len); + +/** + * \brief Free the mutex for thread-safety and clear remaining memory + */ +void mbedtls_memory_buffer_alloc_free(void); + +/** + * \brief Determine when the allocator should automatically verify the state + * of the entire chain of headers / meta-data. + * (Default: MBEDTLS_MEMORY_VERIFY_NONE) + * + * \param verify One of MBEDTLS_MEMORY_VERIFY_NONE, MBEDTLS_MEMORY_VERIFY_ALLOC, + * MBEDTLS_MEMORY_VERIFY_FREE or MBEDTLS_MEMORY_VERIFY_ALWAYS + */ +void mbedtls_memory_buffer_set_verify(int verify); + +#if defined(MBEDTLS_MEMORY_DEBUG) +/** + * \brief Print out the status of the allocated memory (primarily for use + * after a program should have de-allocated all memory) + * Prints out a list of 'still allocated' blocks and their stack + * trace if MBEDTLS_MEMORY_BACKTRACE is defined. + */ +void mbedtls_memory_buffer_alloc_status(void); + +/** + * \brief Get the number of alloc/free so far. + * + * \param alloc_count Number of allocations. + * \param free_count Number of frees. + */ +void mbedtls_memory_buffer_alloc_count_get(size_t *alloc_count, size_t *free_count); + +/** + * \brief Get the peak heap usage so far + * + * \param max_used Peak number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param max_blocks Peak number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_max_get(size_t *max_used, size_t *max_blocks); + +/** + * \brief Reset peak statistics + */ +void mbedtls_memory_buffer_alloc_max_reset(void); + +/** + * \brief Get the current heap usage + * + * \param cur_used Current number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param cur_blocks Current number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_cur_get(size_t *cur_used, size_t *cur_blocks); +#endif /* MBEDTLS_MEMORY_DEBUG */ + +/** + * \brief Verifies that all headers in the memory buffer are correct + * and contain sane values. Helps debug buffer-overflow errors. + * + * Prints out first failure if MBEDTLS_MEMORY_DEBUG is defined. + * Prints out full header information if MBEDTLS_MEMORY_DEBUG + * is defined. (Includes stack trace information for each block if + * MBEDTLS_MEMORY_BACKTRACE is defined as well). + * + * \return 0 if verified, 1 otherwise + */ +int mbedtls_memory_buffer_alloc_verify(void); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_memory_buffer_alloc_self_test(int verbose); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* memory_buffer_alloc.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/net_sockets.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/net_sockets.h new file mode 100644 index 00000000..8e69bc0f --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/net_sockets.h @@ -0,0 +1,299 @@ +/** + * \file net_sockets.h + * + * \brief Network sockets abstraction layer to integrate Mbed TLS into a + * BSD-style sockets API. + * + * The network sockets module provides an example integration of the + * Mbed TLS library into a BSD sockets implementation. The module is + * intended to be an example of how Mbed TLS can be integrated into a + * networking stack, as well as to be Mbed TLS's network integration + * for its supported platforms. + * + * The module is intended only to be used with the Mbed TLS library and + * is not intended to be used by third party application software + * directly. + * + * The supported platforms are as follows: + * * Microsoft Windows and Windows CE + * * POSIX/Unix platforms including Linux, OS X + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_NET_SOCKETS_H +#define MBEDTLS_NET_SOCKETS_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/ssl.h" + +#include +#include + +/** Failed to open a socket. */ +#define MBEDTLS_ERR_NET_SOCKET_FAILED -0x0042 +/** The connection to the given server / port failed. */ +#define MBEDTLS_ERR_NET_CONNECT_FAILED -0x0044 +/** Binding of the socket failed. */ +#define MBEDTLS_ERR_NET_BIND_FAILED -0x0046 +/** Could not listen on the socket. */ +#define MBEDTLS_ERR_NET_LISTEN_FAILED -0x0048 +/** Could not accept the incoming connection. */ +#define MBEDTLS_ERR_NET_ACCEPT_FAILED -0x004A +/** Reading information from the socket failed. */ +#define MBEDTLS_ERR_NET_RECV_FAILED -0x004C +/** Sending information through the socket failed. */ +#define MBEDTLS_ERR_NET_SEND_FAILED -0x004E +/** Connection was reset by peer. */ +#define MBEDTLS_ERR_NET_CONN_RESET -0x0050 +/** Failed to get an IP address for the given hostname. */ +#define MBEDTLS_ERR_NET_UNKNOWN_HOST -0x0052 +/** Buffer is too small to hold the data. */ +#define MBEDTLS_ERR_NET_BUFFER_TOO_SMALL -0x0043 +/** The context is invalid, eg because it was free()ed. */ +#define MBEDTLS_ERR_NET_INVALID_CONTEXT -0x0045 +/** Polling the net context failed. */ +#define MBEDTLS_ERR_NET_POLL_FAILED -0x0047 +/** Input invalid. */ +#define MBEDTLS_ERR_NET_BAD_INPUT_DATA -0x0049 + +#define MBEDTLS_NET_LISTEN_BACKLOG 10 /**< The backlog that listen() should use. */ + +#define MBEDTLS_NET_PROTO_TCP 0 /**< The TCP transport protocol */ +#define MBEDTLS_NET_PROTO_UDP 1 /**< The UDP transport protocol */ + +#define MBEDTLS_NET_POLL_READ 1 /**< Used in \c mbedtls_net_poll to check for pending data */ +#define MBEDTLS_NET_POLL_WRITE 2 /**< Used in \c mbedtls_net_poll to check if write possible */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Wrapper type for sockets. + * + * Currently backed by just a file descriptor, but might be more in the future + * (eg two file descriptors for combined IPv4 + IPv6 support, or additional + * structures for hand-made UDP demultiplexing). + */ +typedef struct mbedtls_net_context { + /** The underlying file descriptor. + * + * This field is only guaranteed to be present on POSIX/Unix-like platforms. + * On other platforms, it may have a different type, have a different + * meaning, or be absent altogether. + */ + int fd; +} +mbedtls_net_context; + +/** + * \brief Initialize a context + * Just makes the context ready to be used or freed safely. + * + * \param ctx Context to initialize + */ +void mbedtls_net_init(mbedtls_net_context *ctx); + +/** + * \brief Initiate a connection with host:port in the given protocol + * + * \param ctx Socket to use + * \param host Host to connect to + * \param port Port to connect to + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_CONNECT_FAILED + * + * \note Sets the socket in connected mode even with UDP. + */ +int mbedtls_net_connect(mbedtls_net_context *ctx, const char *host, const char *port, int proto); + +/** + * \brief Create a receiving socket on bind_ip:port in the chosen + * protocol. If bind_ip == NULL, all interfaces are bound. + * + * \param ctx Socket to use + * \param bind_ip IP to bind to, can be NULL + * \param port Port number to use + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_LISTEN_FAILED + * + * \note Regardless of the protocol, opens the sockets and binds it. + * In addition, make the socket listening if protocol is TCP. + */ +int mbedtls_net_bind(mbedtls_net_context *ctx, const char *bind_ip, const char *port, int proto); + +/** + * \brief Accept a connection from a remote client + * + * \param bind_ctx Relevant socket + * \param client_ctx Will contain the connected client socket + * \param client_ip Will contain the client IP address, can be NULL + * \param buf_size Size of the client_ip buffer + * \param cip_len Will receive the size of the client IP written, + * can be NULL if client_ip is null + * + * \return 0 if successful, or + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_ACCEPT_FAILED, or + * MBEDTLS_ERR_NET_BUFFER_TOO_SMALL if buf_size is too small, + * MBEDTLS_ERR_SSL_WANT_READ if bind_fd was set to + * non-blocking and accept() would block. + */ +int mbedtls_net_accept(mbedtls_net_context *bind_ctx, + mbedtls_net_context *client_ctx, + void *client_ip, size_t buf_size, size_t *cip_len); + +/** + * \brief Check and wait for the context to be ready for read/write + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket to check + * \param rw Bitflag composed of MBEDTLS_NET_POLL_READ and + * MBEDTLS_NET_POLL_WRITE specifying the events + * to wait for: + * - If MBEDTLS_NET_POLL_READ is set, the function + * will return as soon as the net context is available + * for reading. + * - If MBEDTLS_NET_POLL_WRITE is set, the function + * will return as soon as the net context is available + * for writing. + * \param timeout Maximal amount of time to wait before returning, + * in milliseconds. If \c timeout is zero, the + * function returns immediately. If \c timeout is + * -1u, the function blocks potentially indefinitely. + * + * \return Bitmask composed of MBEDTLS_NET_POLL_READ/WRITE + * on success or timeout, or a negative return code otherwise. + */ +int mbedtls_net_poll(mbedtls_net_context *ctx, uint32_t rw, uint32_t timeout); + +/** + * \brief Set the socket blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_block(mbedtls_net_context *ctx); + +/** + * \brief Set the socket non-blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_nonblock(mbedtls_net_context *ctx); + +/** + * \brief Portable usleep helper + * + * \param usec Amount of microseconds to sleep + * + * \note Real amount of time slept will not be less than + * select()'s timeout granularity (typically, 10ms). + */ +void mbedtls_net_usleep(unsigned long usec); + +/** + * \brief Read at most 'len' characters. If no error occurs, + * the actual amount read is returned. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * + * \return the number of bytes received, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_READ indicates read() would block. + */ +int mbedtls_net_recv(void *ctx, unsigned char *buf, size_t len); + +/** + * \brief Write at most 'len' characters. If no error occurs, + * the actual amount written is returned. + * + * \param ctx Socket + * \param buf The buffer to read from + * \param len The length of the buffer + * + * \return the number of bytes sent, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_WRITE indicates write() would block. + */ +int mbedtls_net_send(void *ctx, const unsigned char *buf, size_t len); + +/** + * \brief Read at most 'len' characters, blocking for at most + * 'timeout' seconds. If no error occurs, the actual amount + * read is returned. + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * \param timeout Maximum number of milliseconds to wait for data + * 0 means no timeout (wait forever) + * + * \return The number of bytes received if successful. + * MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out. + * MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * Another negative error code (MBEDTLS_ERR_NET_xxx) + * for other failures. + * + * \note This function will block (until data becomes available or + * timeout is reached) even if the socket is set to + * non-blocking. Handling timeouts with non-blocking reads + * requires a different strategy. + */ +int mbedtls_net_recv_timeout(void *ctx, unsigned char *buf, size_t len, + uint32_t timeout); + +/** + * \brief Closes down the connection and free associated data + * + * \param ctx The context to close + * + * \note This function frees and clears data associated with the + * context but does not free the memory pointed to by \p ctx. + * This memory is the responsibility of the caller. + */ +void mbedtls_net_close(mbedtls_net_context *ctx); + +/** + * \brief Gracefully shutdown the connection and free associated data + * + * \param ctx The context to free + * + * \note This function frees and clears data associated with the + * context but does not free the memory pointed to by \p ctx. + * This memory is the responsibility of the caller. + */ +void mbedtls_net_free(mbedtls_net_context *ctx); + +#ifdef __cplusplus +} +#endif + +#endif /* net_sockets.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/nist_kw.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/nist_kw.h new file mode 100644 index 00000000..d353f3d1 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/nist_kw.h @@ -0,0 +1,166 @@ +/** + * \file nist_kw.h + * + * \brief This file provides an API for key wrapping (KW) and key wrapping with + * padding (KWP) as defined in NIST SP 800-38F. + * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf + * + * Key wrapping specifies a deterministic authenticated-encryption mode + * of operation, according to NIST SP 800-38F: Recommendation for + * Block Cipher Modes of Operation: Methods for Key Wrapping. Its + * purpose is to protect cryptographic keys. + * + * Its equivalent is RFC 3394 for KW, and RFC 5649 for KWP. + * https://tools.ietf.org/html/rfc3394 + * https://tools.ietf.org/html/rfc5649 + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_NIST_KW_H +#define MBEDTLS_NIST_KW_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum { + MBEDTLS_KW_MODE_KW = 0, + MBEDTLS_KW_MODE_KWP = 1 +} mbedtls_nist_kw_mode_t; + +#if !defined(MBEDTLS_NIST_KW_ALT) +// Regular implementation +// + +/** + * \brief The key wrapping context-type definition. The key wrapping context is passed + * to the APIs called. + * + * \note The definition of this type may change in future library versions. + * Don't make any assumptions on this context! + */ +typedef struct { + mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher_ctx); /*!< The cipher context used. */ +} mbedtls_nist_kw_context; + +#else /* MBEDTLS_NIST_key wrapping_ALT */ +#include "nist_kw_alt.h" +#endif /* MBEDTLS_NIST_KW_ALT */ + +/** + * \brief This function initializes the specified key wrapping context + * to make references valid and prepare the context + * for mbedtls_nist_kw_setkey() or mbedtls_nist_kw_free(). + * + * \param ctx The key wrapping context to initialize. + * + */ +void mbedtls_nist_kw_init(mbedtls_nist_kw_context *ctx); + +/** + * \brief This function initializes the key wrapping context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The key wrapping context. + * \param cipher The 128-bit block cipher to use. Only AES is supported. + * \param key The Key Encryption Key (KEK). + * \param keybits The KEK size in bits. This must be acceptable by the cipher. + * \param is_wrap Specify whether the operation within the context is wrapping or unwrapping + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for any invalid input. + * \return \c MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE for 128-bit block ciphers + * which are not supported. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_setkey(mbedtls_nist_kw_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits, + const int is_wrap); + +/** + * \brief This function releases and clears the specified key wrapping context + * and underlying cipher sub-context. + * + * \param ctx The key wrapping context to clear. + */ +void mbedtls_nist_kw_free(mbedtls_nist_kw_context *ctx); + +/** + * \brief This function encrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for encryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 16 and 2^57-8 inclusive.
    • + *
  • For KWP mode: any length between 1 and 2^32-1 inclusive.
+ * \param[out] output The buffer holding the output data. + *
  • For KW mode: Must be at least 8 bytes larger than \p in_len.
    • + *
  • For KWP mode: Must be at least 8 bytes larger rounded up to a multiple of + * 8 bytes for KWP (15 bytes at most).
+ * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_wrap(mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t *out_len, size_t out_size); + +/** + * \brief This function decrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for decryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + * The input must be a multiple of semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 24 and 2^57 inclusive.
    • + *
  • For KWP mode: a multiple of 8 bytes between 16 and 2^32 inclusive.
+ * \param[out] output The buffer holding the output data. + * The output buffer's minimal length is 8 bytes shorter than \p in_len. + * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * For KWP mode, the length could be up to 15 bytes shorter than \p in_len, + * depending on how much padding was added to the data. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return \c MBEDTLS_ERR_CIPHER_AUTH_FAILED for verification failure of the ciphertext. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_unwrap(mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t *out_len, size_t out_size); + + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C) +/** + * \brief The key wrapping checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_nist_kw_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_NIST_KW_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/oid.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/oid.h new file mode 100644 index 00000000..fdc25ebf --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/oid.h @@ -0,0 +1,727 @@ +/** + * \file oid.h + * + * \brief Object Identifier (OID) database + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_OID_H +#define MBEDTLS_OID_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#include + +#if defined(MBEDTLS_CIPHER_C) +#include "mbedtls/cipher.h" +#endif + +#include "mbedtls/md.h" + +/** OID is not found. */ +#define MBEDTLS_ERR_OID_NOT_FOUND -0x002E +/** output buffer is too small */ +#define MBEDTLS_ERR_OID_BUF_TOO_SMALL -0x000B + +/* This is for the benefit of X.509, but defined here in order to avoid + * having a "backwards" include of x.509.h here */ +/* + * X.509 extension types (internal, arbitrary values for bitsets) + */ +#define MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) +#define MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) +#define MBEDTLS_OID_X509_EXT_KEY_USAGE (1 << 2) +#define MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES (1 << 3) +#define MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS (1 << 4) +#define MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME (1 << 5) +#define MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME (1 << 6) +#define MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) +#define MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS (1 << 8) +#define MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS (1 << 9) +#define MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS (1 << 10) +#define MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE (1 << 11) +#define MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12) +#define MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13) +#define MBEDTLS_OID_X509_EXT_FRESHEST_CRL (1 << 14) +#define MBEDTLS_OID_X509_EXT_NS_CERT_TYPE (1 << 16) + +/* + * Maximum number of OID components allowed + */ +#define MBEDTLS_OID_MAX_COMPONENTS 128 + +/* + * Top level OID tuples + */ +#define MBEDTLS_OID_ISO_MEMBER_BODIES "\x2a" /* {iso(1) member-body(2)} */ +#define MBEDTLS_OID_ISO_IDENTIFIED_ORG "\x2b" /* {iso(1) identified-organization(3)} */ +#define MBEDTLS_OID_ISO_CCITT_DS "\x55" /* {joint-iso-ccitt(2) ds(5)} */ +#define MBEDTLS_OID_ISO_ITU_COUNTRY "\x60" /* {joint-iso-itu-t(2) country(16)} */ + +/* + * ISO Member bodies OID parts + */ +#define MBEDTLS_OID_COUNTRY_US "\x86\x48" /* {us(840)} */ +#define MBEDTLS_OID_ORG_RSA_DATA_SECURITY "\x86\xf7\x0d" /* {rsadsi(113549)} */ +#define MBEDTLS_OID_RSA_COMPANY MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_RSA_DATA_SECURITY /* {iso(1) member-body(2) us(840) rsadsi(113549)} */ +#define MBEDTLS_OID_ORG_ANSI_X9_62 "\xce\x3d" /* ansi-X9-62(10045) */ +#define MBEDTLS_OID_ANSI_X9_62 MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_ANSI_X9_62 + +/* + * ISO Identified organization OID parts + */ +#define MBEDTLS_OID_ORG_DOD "\x06" /* {dod(6)} */ +#define MBEDTLS_OID_ORG_OIW "\x0e" +#define MBEDTLS_OID_OIW_SECSIG MBEDTLS_OID_ORG_OIW "\x03" +#define MBEDTLS_OID_OIW_SECSIG_ALG MBEDTLS_OID_OIW_SECSIG "\x02" +#define MBEDTLS_OID_OIW_SECSIG_SHA1 MBEDTLS_OID_OIW_SECSIG_ALG "\x1a" +#define MBEDTLS_OID_ORG_THAWTE "\x65" /* thawte(101) */ +#define MBEDTLS_OID_THAWTE MBEDTLS_OID_ISO_IDENTIFIED_ORG \ + MBEDTLS_OID_ORG_THAWTE +#define MBEDTLS_OID_ORG_CERTICOM "\x81\x04" /* certicom(132) */ +#define MBEDTLS_OID_CERTICOM MBEDTLS_OID_ISO_IDENTIFIED_ORG \ + MBEDTLS_OID_ORG_CERTICOM +#define MBEDTLS_OID_ORG_TELETRUST "\x24" /* teletrust(36) */ +#define MBEDTLS_OID_TELETRUST MBEDTLS_OID_ISO_IDENTIFIED_ORG \ + MBEDTLS_OID_ORG_TELETRUST + +/* + * ISO ITU OID parts + */ +#define MBEDTLS_OID_ORGANIZATION "\x01" /* {organization(1)} */ +#define MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ISO_ITU_COUNTRY MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORGANIZATION /* {joint-iso-itu-t(2) country(16) us(840) organization(1)} */ + +#define MBEDTLS_OID_ORG_GOV "\x65" /* {gov(101)} */ +#define MBEDTLS_OID_GOV MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_GOV /* {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)} */ + +#define MBEDTLS_OID_ORG_NETSCAPE "\x86\xF8\x42" /* {netscape(113730)} */ +#define MBEDTLS_OID_NETSCAPE MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_NETSCAPE /* Netscape OID {joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730)} */ + +/* ISO arc for standard certificate and CRL extensions */ +#define MBEDTLS_OID_ID_CE MBEDTLS_OID_ISO_CCITT_DS "\x1D" /**< id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29} */ + +#define MBEDTLS_OID_NIST_ALG MBEDTLS_OID_GOV "\x03\x04" /** { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) */ + +/** + * Private Internet Extensions + * { iso(1) identified-organization(3) dod(6) internet(1) + * security(5) mechanisms(5) pkix(7) } + */ +#define MBEDTLS_OID_INTERNET MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_DOD \ + "\x01" +#define MBEDTLS_OID_PKIX MBEDTLS_OID_INTERNET "\x05\x05\x07" + +/* + * Arc for standard naming attributes + */ +#define MBEDTLS_OID_AT MBEDTLS_OID_ISO_CCITT_DS "\x04" /**< id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4} */ +#define MBEDTLS_OID_AT_CN MBEDTLS_OID_AT "\x03" /**< id-at-commonName AttributeType:= {id-at 3} */ +#define MBEDTLS_OID_AT_SUR_NAME MBEDTLS_OID_AT "\x04" /**< id-at-surName AttributeType:= {id-at 4} */ +#define MBEDTLS_OID_AT_SERIAL_NUMBER MBEDTLS_OID_AT "\x05" /**< id-at-serialNumber AttributeType:= {id-at 5} */ +#define MBEDTLS_OID_AT_COUNTRY MBEDTLS_OID_AT "\x06" /**< id-at-countryName AttributeType:= {id-at 6} */ +#define MBEDTLS_OID_AT_LOCALITY MBEDTLS_OID_AT "\x07" /**< id-at-locality AttributeType:= {id-at 7} */ +#define MBEDTLS_OID_AT_STATE MBEDTLS_OID_AT "\x08" /**< id-at-state AttributeType:= {id-at 8} */ +#define MBEDTLS_OID_AT_ORGANIZATION MBEDTLS_OID_AT "\x0A" /**< id-at-organizationName AttributeType:= {id-at 10} */ +#define MBEDTLS_OID_AT_ORG_UNIT MBEDTLS_OID_AT "\x0B" /**< id-at-organizationalUnitName AttributeType:= {id-at 11} */ +#define MBEDTLS_OID_AT_TITLE MBEDTLS_OID_AT "\x0C" /**< id-at-title AttributeType:= {id-at 12} */ +#define MBEDTLS_OID_AT_POSTAL_ADDRESS MBEDTLS_OID_AT "\x10" /**< id-at-postalAddress AttributeType:= {id-at 16} */ +#define MBEDTLS_OID_AT_POSTAL_CODE MBEDTLS_OID_AT "\x11" /**< id-at-postalCode AttributeType:= {id-at 17} */ +#define MBEDTLS_OID_AT_GIVEN_NAME MBEDTLS_OID_AT "\x2A" /**< id-at-givenName AttributeType:= {id-at 42} */ +#define MBEDTLS_OID_AT_INITIALS MBEDTLS_OID_AT "\x2B" /**< id-at-initials AttributeType:= {id-at 43} */ +#define MBEDTLS_OID_AT_GENERATION_QUALIFIER MBEDTLS_OID_AT "\x2C" /**< id-at-generationQualifier AttributeType:= {id-at 44} */ +#define MBEDTLS_OID_AT_UNIQUE_IDENTIFIER MBEDTLS_OID_AT "\x2D" /**< id-at-uniqueIdentifier AttributeType:= {id-at 45} */ +#define MBEDTLS_OID_AT_DN_QUALIFIER MBEDTLS_OID_AT "\x2E" /**< id-at-dnQualifier AttributeType:= {id-at 46} */ +#define MBEDTLS_OID_AT_PSEUDONYM MBEDTLS_OID_AT "\x41" /**< id-at-pseudonym AttributeType:= {id-at 65} */ + +#define MBEDTLS_OID_UID "\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x01" /** id-domainComponent AttributeType:= {itu-t(0) data(9) pss(2342) ucl(19200300) pilot(100) pilotAttributeType(1) uid(1)} */ +#define MBEDTLS_OID_DOMAIN_COMPONENT "\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x19" /** id-domainComponent AttributeType:= {itu-t(0) data(9) pss(2342) ucl(19200300) pilot(100) pilotAttributeType(1) domainComponent(25)} */ + +/* + * OIDs for standard certificate extensions + */ +#define MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x23" /**< id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } */ +#define MBEDTLS_OID_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x0E" /**< id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } */ +#define MBEDTLS_OID_KEY_USAGE MBEDTLS_OID_ID_CE "\x0F" /**< id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } */ +#define MBEDTLS_OID_CERTIFICATE_POLICIES MBEDTLS_OID_ID_CE "\x20" /**< id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 } */ +#define MBEDTLS_OID_POLICY_MAPPINGS MBEDTLS_OID_ID_CE "\x21" /**< id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 } */ +#define MBEDTLS_OID_SUBJECT_ALT_NAME MBEDTLS_OID_ID_CE "\x11" /**< id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 } */ +#define MBEDTLS_OID_ISSUER_ALT_NAME MBEDTLS_OID_ID_CE "\x12" /**< id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 } */ +#define MBEDTLS_OID_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_ID_CE "\x09" /**< id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 } */ +#define MBEDTLS_OID_BASIC_CONSTRAINTS MBEDTLS_OID_ID_CE "\x13" /**< id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 } */ +#define MBEDTLS_OID_NAME_CONSTRAINTS MBEDTLS_OID_ID_CE "\x1E" /**< id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 } */ +#define MBEDTLS_OID_POLICY_CONSTRAINTS MBEDTLS_OID_ID_CE "\x24" /**< id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 } */ +#define MBEDTLS_OID_EXTENDED_KEY_USAGE MBEDTLS_OID_ID_CE "\x25" /**< id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 } */ +#define MBEDTLS_OID_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_ID_CE "\x1F" /**< id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 } */ +#define MBEDTLS_OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_ID_CE "\x36" /**< id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } */ +#define MBEDTLS_OID_FRESHEST_CRL MBEDTLS_OID_ID_CE "\x2E" /**< id-ce-freshestCRL OBJECT IDENTIFIER ::= { id-ce 46 } */ + +/* + * Certificate policies + */ +#define MBEDTLS_OID_ANY_POLICY MBEDTLS_OID_CERTIFICATE_POLICIES "\x00" /**< anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 } */ + +/* + * Netscape certificate extensions + */ +#define MBEDTLS_OID_NS_CERT MBEDTLS_OID_NETSCAPE "\x01" +#define MBEDTLS_OID_NS_CERT_TYPE MBEDTLS_OID_NS_CERT "\x01" +#define MBEDTLS_OID_NS_BASE_URL MBEDTLS_OID_NS_CERT "\x02" +#define MBEDTLS_OID_NS_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x03" +#define MBEDTLS_OID_NS_CA_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x04" +#define MBEDTLS_OID_NS_RENEWAL_URL MBEDTLS_OID_NS_CERT "\x07" +#define MBEDTLS_OID_NS_CA_POLICY_URL MBEDTLS_OID_NS_CERT "\x08" +#define MBEDTLS_OID_NS_SSL_SERVER_NAME MBEDTLS_OID_NS_CERT "\x0C" +#define MBEDTLS_OID_NS_COMMENT MBEDTLS_OID_NS_CERT "\x0D" +#define MBEDTLS_OID_NS_DATA_TYPE MBEDTLS_OID_NETSCAPE "\x02" +#define MBEDTLS_OID_NS_CERT_SEQUENCE MBEDTLS_OID_NS_DATA_TYPE "\x05" + +/* + * OIDs for CRL extensions + */ +#define MBEDTLS_OID_PRIVATE_KEY_USAGE_PERIOD MBEDTLS_OID_ID_CE "\x10" +#define MBEDTLS_OID_CRL_NUMBER MBEDTLS_OID_ID_CE "\x14" /**< id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 } */ + +/* + * X.509 v3 Extended key usage OIDs + */ +#define MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE MBEDTLS_OID_EXTENDED_KEY_USAGE "\x00" /**< anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } */ + +#define MBEDTLS_OID_KP MBEDTLS_OID_PKIX "\x03" /**< id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } */ +#define MBEDTLS_OID_SERVER_AUTH MBEDTLS_OID_KP "\x01" /**< id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 } */ +#define MBEDTLS_OID_CLIENT_AUTH MBEDTLS_OID_KP "\x02" /**< id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 } */ +#define MBEDTLS_OID_CODE_SIGNING MBEDTLS_OID_KP "\x03" /**< id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 } */ +#define MBEDTLS_OID_EMAIL_PROTECTION MBEDTLS_OID_KP "\x04" /**< id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 } */ +#define MBEDTLS_OID_TIME_STAMPING MBEDTLS_OID_KP "\x08" /**< id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } */ +#define MBEDTLS_OID_OCSP_SIGNING MBEDTLS_OID_KP "\x09" /**< id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } */ + +/** + * Wi-SUN Alliance Field Area Network + * { iso(1) identified-organization(3) dod(6) internet(1) + * private(4) enterprise(1) WiSUN(45605) FieldAreaNetwork(1) } + */ +#define MBEDTLS_OID_WISUN_FAN MBEDTLS_OID_INTERNET "\x04\x01\x82\xe4\x25\x01" + +#define MBEDTLS_OID_ON MBEDTLS_OID_PKIX "\x08" /**< id-on OBJECT IDENTIFIER ::= { id-pkix 8 } */ +#define MBEDTLS_OID_ON_HW_MODULE_NAME MBEDTLS_OID_ON "\x04" /**< id-on-hardwareModuleName OBJECT IDENTIFIER ::= { id-on 4 } */ + +/* + * PKCS definition OIDs + */ + +#define MBEDTLS_OID_PKCS MBEDTLS_OID_RSA_COMPANY "\x01" /**< pkcs OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) 1 } */ +#define MBEDTLS_OID_PKCS1 MBEDTLS_OID_PKCS "\x01" /**< pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 } */ +#define MBEDTLS_OID_PKCS5 MBEDTLS_OID_PKCS "\x05" /**< pkcs-5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 5 } */ +#define MBEDTLS_OID_PKCS7 MBEDTLS_OID_PKCS "\x07" /**< pkcs-7 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 7 } */ +#define MBEDTLS_OID_PKCS9 MBEDTLS_OID_PKCS "\x09" /**< pkcs-9 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 } */ +#define MBEDTLS_OID_PKCS12 MBEDTLS_OID_PKCS "\x0c" /**< pkcs-12 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 12 } */ + +/* + * PKCS#1 OIDs + */ +#define MBEDTLS_OID_PKCS1_RSA MBEDTLS_OID_PKCS1 "\x01" /**< rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } */ +#define MBEDTLS_OID_PKCS1_MD5 MBEDTLS_OID_PKCS1 "\x04" /**< md5WithRSAEncryption ::= { pkcs-1 4 } */ +#define MBEDTLS_OID_PKCS1_SHA1 MBEDTLS_OID_PKCS1 "\x05" /**< sha1WithRSAEncryption ::= { pkcs-1 5 } */ +#define MBEDTLS_OID_PKCS1_SHA224 MBEDTLS_OID_PKCS1 "\x0e" /**< sha224WithRSAEncryption ::= { pkcs-1 14 } */ +#define MBEDTLS_OID_PKCS1_SHA256 MBEDTLS_OID_PKCS1 "\x0b" /**< sha256WithRSAEncryption ::= { pkcs-1 11 } */ +#define MBEDTLS_OID_PKCS1_SHA384 MBEDTLS_OID_PKCS1 "\x0c" /**< sha384WithRSAEncryption ::= { pkcs-1 12 } */ +#define MBEDTLS_OID_PKCS1_SHA512 MBEDTLS_OID_PKCS1 "\x0d" /**< sha512WithRSAEncryption ::= { pkcs-1 13 } */ + +#define MBEDTLS_OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D" + +#define MBEDTLS_OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9 "\x01" /**< emailAddress AttributeType ::= { pkcs-9 1 } */ + +/* RFC 4055 */ +#define MBEDTLS_OID_RSASSA_PSS MBEDTLS_OID_PKCS1 "\x0a" /**< id-RSASSA-PSS ::= { pkcs-1 10 } */ +#define MBEDTLS_OID_MGF1 MBEDTLS_OID_PKCS1 "\x08" /**< id-mgf1 ::= { pkcs-1 8 } */ + +/* + * Digest algorithms + */ +#define MBEDTLS_OID_DIGEST_ALG_MD5 MBEDTLS_OID_RSA_COMPANY "\x02\x05" /**< id-mbedtls_md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA1 MBEDTLS_OID_ISO_IDENTIFIED_ORG \ + MBEDTLS_OID_OIW_SECSIG_SHA1 /**< id-mbedtls_sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 26 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA224 MBEDTLS_OID_NIST_ALG "\x02\x04" /**< id-sha224 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 4 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA256 MBEDTLS_OID_NIST_ALG "\x02\x01" /**< id-mbedtls_sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA384 MBEDTLS_OID_NIST_ALG "\x02\x02" /**< id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA512 MBEDTLS_OID_NIST_ALG "\x02\x03" /**< id-mbedtls_sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 } */ + +#define MBEDTLS_OID_DIGEST_ALG_RIPEMD160 MBEDTLS_OID_TELETRUST "\x03\x02\x01" /**< id-ripemd160 OBJECT IDENTIFIER :: { iso(1) identified-organization(3) teletrust(36) algorithm(3) hashAlgorithm(2) ripemd160(1) } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA3_224 MBEDTLS_OID_NIST_ALG "\x02\x07" /**< id-sha3-224 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) sha3-224(7) } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA3_256 MBEDTLS_OID_NIST_ALG "\x02\x08" /**< id-sha3-256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) sha3-256(8) } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA3_384 MBEDTLS_OID_NIST_ALG "\x02\x09" /**< id-sha3-384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) sha3-384(9) } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA3_512 MBEDTLS_OID_NIST_ALG "\x02\x0a" /**< id-sha3-512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) sha3-512(10) } */ + + +#define MBEDTLS_OID_HMAC_SHA1 MBEDTLS_OID_RSA_COMPANY "\x02\x07" /**< id-hmacWithSHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 7 } */ + +#define MBEDTLS_OID_HMAC_SHA224 MBEDTLS_OID_RSA_COMPANY "\x02\x08" /**< id-hmacWithSHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 8 } */ + +#define MBEDTLS_OID_HMAC_SHA256 MBEDTLS_OID_RSA_COMPANY "\x02\x09" /**< id-hmacWithSHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 9 } */ + +#define MBEDTLS_OID_HMAC_SHA384 MBEDTLS_OID_RSA_COMPANY "\x02\x0A" /**< id-hmacWithSHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 10 } */ + +#define MBEDTLS_OID_HMAC_SHA512 MBEDTLS_OID_RSA_COMPANY "\x02\x0B" /**< id-hmacWithSHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 11 } */ + +#define MBEDTLS_OID_HMAC_SHA3_224 MBEDTLS_OID_NIST_ALG "\x02\x0d" /**< id-hmacWithSHA3-512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) hmacWithSHA3-224(13) } */ + +#define MBEDTLS_OID_HMAC_SHA3_256 MBEDTLS_OID_NIST_ALG "\x02\x0e" /**< id-hmacWithSHA3-512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) hmacWithSHA3-256(14) } */ + +#define MBEDTLS_OID_HMAC_SHA3_384 MBEDTLS_OID_NIST_ALG "\x02\x0f" /**< id-hmacWithSHA3-512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) hmacWithSHA3-384(15) } */ + +#define MBEDTLS_OID_HMAC_SHA3_512 MBEDTLS_OID_NIST_ALG "\x02\x10" /**< id-hmacWithSHA3-512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) hashalgs(2) hmacWithSHA3-512(16) } */ + +#define MBEDTLS_OID_HMAC_RIPEMD160 MBEDTLS_OID_INTERNET "\x05\x05\x08\x01\x04" /**< id-hmacWithSHA1 OBJECT IDENTIFIER ::= {iso(1) iso-identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) ipsec(8) isakmpOakley(1) hmacRIPEMD160(4)} */ + +/* + * Encryption algorithms, + * the following standardized object identifiers are specified at + * https://datatracker.ietf.org/doc/html/rfc8018#appendix-C. + */ +#define MBEDTLS_OID_DES_CBC MBEDTLS_OID_ISO_IDENTIFIED_ORG \ + MBEDTLS_OID_OIW_SECSIG_ALG "\x07" /**< desCBC OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 7 } */ +#define MBEDTLS_OID_DES_EDE3_CBC MBEDTLS_OID_RSA_COMPANY "\x03\x07" /**< des-ede3-cbc OBJECT IDENTIFIER ::= { iso(1) member-body(2) -- us(840) rsadsi(113549) encryptionAlgorithm(3) 7 } */ +#define MBEDTLS_OID_AES MBEDTLS_OID_NIST_ALG "\x01" /** aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 } */ +#define MBEDTLS_OID_AES_128_CBC MBEDTLS_OID_AES "\x02" /** aes128-cbc-pad OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) aes(1) aes128-CBC-PAD(2) } */ +#define MBEDTLS_OID_AES_192_CBC MBEDTLS_OID_AES "\x16" /** aes192-cbc-pad OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) aes(1) aes192-CBC-PAD(22) } */ +#define MBEDTLS_OID_AES_256_CBC MBEDTLS_OID_AES "\x2a" /** aes256-cbc-pad OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithms(4) aes(1) aes256-CBC-PAD(42) } */ + +/* + * Key Wrapping algorithms + */ +/* + * RFC 5649 + */ +#define MBEDTLS_OID_AES128_KW MBEDTLS_OID_AES "\x05" /** id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 } */ +#define MBEDTLS_OID_AES128_KWP MBEDTLS_OID_AES "\x08" /** id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 } */ +#define MBEDTLS_OID_AES192_KW MBEDTLS_OID_AES "\x19" /** id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 } */ +#define MBEDTLS_OID_AES192_KWP MBEDTLS_OID_AES "\x1c" /** id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 } */ +#define MBEDTLS_OID_AES256_KW MBEDTLS_OID_AES "\x2d" /** id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 } */ +#define MBEDTLS_OID_AES256_KWP MBEDTLS_OID_AES "\x30" /** id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 } */ +/* + * PKCS#5 OIDs + */ +#define MBEDTLS_OID_PKCS5_PBKDF2 MBEDTLS_OID_PKCS5 "\x0c" /**< id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} */ +#define MBEDTLS_OID_PKCS5_PBES2 MBEDTLS_OID_PKCS5 "\x0d" /**< id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} */ +#define MBEDTLS_OID_PKCS5_PBMAC1 MBEDTLS_OID_PKCS5 "\x0e" /**< id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} */ + +/* + * PKCS#5 PBES1 algorithms + */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_DES_CBC MBEDTLS_OID_PKCS5 "\x03" /**< pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_RC2_CBC MBEDTLS_OID_PKCS5 "\x06" /**< pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_DES_CBC MBEDTLS_OID_PKCS5 "\x0a" /**< pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_RC2_CBC MBEDTLS_OID_PKCS5 "\x0b" /**< pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} */ + +/* + * PKCS#7 OIDs + */ +#define MBEDTLS_OID_PKCS7_DATA MBEDTLS_OID_PKCS7 "\x01" /**< Content type is Data OBJECT IDENTIFIER ::= {pkcs-7 1} */ +#define MBEDTLS_OID_PKCS7_SIGNED_DATA MBEDTLS_OID_PKCS7 "\x02" /**< Content type is Signed Data OBJECT IDENTIFIER ::= {pkcs-7 2} */ +#define MBEDTLS_OID_PKCS7_ENVELOPED_DATA MBEDTLS_OID_PKCS7 "\x03" /**< Content type is Enveloped Data OBJECT IDENTIFIER ::= {pkcs-7 3} */ +#define MBEDTLS_OID_PKCS7_SIGNED_AND_ENVELOPED_DATA MBEDTLS_OID_PKCS7 "\x04" /**< Content type is Signed and Enveloped Data OBJECT IDENTIFIER ::= {pkcs-7 4} */ +#define MBEDTLS_OID_PKCS7_DIGESTED_DATA MBEDTLS_OID_PKCS7 "\x05" /**< Content type is Digested Data OBJECT IDENTIFIER ::= {pkcs-7 5} */ +#define MBEDTLS_OID_PKCS7_ENCRYPTED_DATA MBEDTLS_OID_PKCS7 "\x06" /**< Content type is Encrypted Data OBJECT IDENTIFIER ::= {pkcs-7 6} */ + +/* + * PKCS#8 OIDs + */ +#define MBEDTLS_OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9 "\x0e" /**< extensionRequest OBJECT IDENTIFIER ::= {pkcs-9 14} */ + +/* + * PKCS#12 PBE OIDs + */ +#define MBEDTLS_OID_PKCS12_PBE MBEDTLS_OID_PKCS12 "\x01" /**< pkcs-12PbeIds OBJECT IDENTIFIER ::= {pkcs-12 1} */ + +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES3_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x03" /**< pbeWithSHAAnd3-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 3} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES2_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x04" /**< pbeWithSHAAnd2-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 4} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE "\x05" /**< pbeWithSHAAnd128BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 5} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE "\x06" /**< pbeWithSHAAnd40BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 6} */ + +/* + * EC key algorithms from RFC 5480 + */ + +/* id-ecPublicKey OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 } */ +#define MBEDTLS_OID_EC_ALG_UNRESTRICTED MBEDTLS_OID_ANSI_X9_62 "\x02\01" + +/* id-ecDH OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) + * schemes(1) ecdh(12) } */ +#define MBEDTLS_OID_EC_ALG_ECDH MBEDTLS_OID_CERTICOM "\x01\x0c" + +/* + * ECParameters namedCurve identifiers, from RFC 5480, RFC 5639, and SEC2 + */ + +/* secp192r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 1 } */ +#define MBEDTLS_OID_EC_GRP_SECP192R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x01" + +/* secp224r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 33 } */ +#define MBEDTLS_OID_EC_GRP_SECP224R1 MBEDTLS_OID_CERTICOM "\x00\x21" + +/* secp256r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 7 } */ +#define MBEDTLS_OID_EC_GRP_SECP256R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x07" + +/* secp384r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 34 } */ +#define MBEDTLS_OID_EC_GRP_SECP384R1 MBEDTLS_OID_CERTICOM "\x00\x22" + +/* secp521r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 35 } */ +#define MBEDTLS_OID_EC_GRP_SECP521R1 MBEDTLS_OID_CERTICOM "\x00\x23" + +/* secp192k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 31 } */ +#define MBEDTLS_OID_EC_GRP_SECP192K1 MBEDTLS_OID_CERTICOM "\x00\x1f" + +/* secp224k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 32 } */ +#define MBEDTLS_OID_EC_GRP_SECP224K1 MBEDTLS_OID_CERTICOM "\x00\x20" + +/* secp256k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 10 } */ +#define MBEDTLS_OID_EC_GRP_SECP256K1 MBEDTLS_OID_CERTICOM "\x00\x0a" + +/* RFC 5639 4.1 + * ecStdCurvesAndGeneration OBJECT IDENTIFIER::= {iso(1) + * identified-organization(3) teletrust(36) algorithm(3) signature- + * algorithm(3) ecSign(2) 8} + * ellipticCurve OBJECT IDENTIFIER ::= {ecStdCurvesAndGeneration 1} + * versionOne OBJECT IDENTIFIER ::= {ellipticCurve 1} */ +#define MBEDTLS_OID_EC_BRAINPOOL_V1 MBEDTLS_OID_TELETRUST "\x03\x03\x02\x08\x01\x01" + +/* brainpoolP256r1 OBJECT IDENTIFIER ::= {versionOne 7} */ +#define MBEDTLS_OID_EC_GRP_BP256R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x07" + +/* brainpoolP384r1 OBJECT IDENTIFIER ::= {versionOne 11} */ +#define MBEDTLS_OID_EC_GRP_BP384R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0B" + +/* brainpoolP512r1 OBJECT IDENTIFIER ::= {versionOne 13} */ +#define MBEDTLS_OID_EC_GRP_BP512R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0D" + +/* + * SEC1 C.1 + * + * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } + * id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)} + */ +#define MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE MBEDTLS_OID_ANSI_X9_62 "\x01" +#define MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE "\x01" + +/* + * ECDSA signature identifiers, from RFC 5480 + */ +#define MBEDTLS_OID_ANSI_X9_62_SIG MBEDTLS_OID_ANSI_X9_62 "\x04" /* signatures(4) */ +#define MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 MBEDTLS_OID_ANSI_X9_62_SIG "\x03" /* ecdsa-with-SHA2(3) */ + +/* ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA1 MBEDTLS_OID_ANSI_X9_62_SIG "\x01" + +/* ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA224 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x01" + +/* ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 2 } */ +#define MBEDTLS_OID_ECDSA_SHA256 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x02" + +/* ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 3 } */ +#define MBEDTLS_OID_ECDSA_SHA384 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x03" + +/* ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 4 } */ +#define MBEDTLS_OID_ECDSA_SHA512 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x04" + +/* + * EC key algorithms from RFC 8410 + */ + +#define MBEDTLS_OID_X25519 MBEDTLS_OID_THAWTE "\x6e" /**< id-X25519 OBJECT IDENTIFIER ::= { 1 3 101 110 } */ +#define MBEDTLS_OID_X448 MBEDTLS_OID_THAWTE "\x6f" /**< id-X448 OBJECT IDENTIFIER ::= { 1 3 101 111 } */ +#define MBEDTLS_OID_ED25519 MBEDTLS_OID_THAWTE "\x70" /**< id-Ed25519 OBJECT IDENTIFIER ::= { 1 3 101 112 } */ +#define MBEDTLS_OID_ED448 MBEDTLS_OID_THAWTE "\x71" /**< id-Ed448 OBJECT IDENTIFIER ::= { 1 3 101 113 } */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Base OID descriptor structure + */ +typedef struct mbedtls_oid_descriptor_t { + const char *MBEDTLS_PRIVATE(asn1); /*!< OID ASN.1 representation */ + size_t MBEDTLS_PRIVATE(asn1_len); /*!< length of asn1 */ +#if !defined(MBEDTLS_X509_REMOVE_INFO) + const char *MBEDTLS_PRIVATE(name); /*!< official name (e.g. from RFC) */ + const char *MBEDTLS_PRIVATE(description); /*!< human friendly description */ +#endif +} mbedtls_oid_descriptor_t; + +/** + * \brief Translate an ASN.1 OID into its numeric representation + * (e.g. "\x2A\x86\x48\x86\xF7\x0D" into "1.2.840.113549") + * + * \param buf buffer to put representation in + * \param size size of the buffer + * \param oid OID to translate + * + * \return Length of the string written (excluding final NULL) or + * MBEDTLS_ERR_OID_BUF_TOO_SMALL in case of error + */ +int mbedtls_oid_get_numeric_string(char *buf, size_t size, const mbedtls_asn1_buf *oid); + +/** + * \brief Translate a string containing a dotted-decimal + * representation of an ASN.1 OID into its encoded form + * (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + * On success, this function allocates oid->buf from the + * heap. It must be freed by the caller using mbedtls_free(). + * + * \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + * \param oid_str string representation of the OID to parse + * \param size length of the OID string, not including any null terminator + * + * \return 0 if successful + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + * represent a valid OID + * \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + * allocate oid->buf + */ +int mbedtls_oid_from_numeric_string(mbedtls_asn1_buf *oid, const char *oid_str, size_t size); + +/** + * \brief Translate an X.509 extension OID into local values + * + * \param oid OID to use + * \param ext_type place to store the extension type + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_x509_ext_type(const mbedtls_asn1_buf *oid, int *ext_type); + +/** + * \brief Translate an X.509 attribute type OID into the short name + * (e.g. the OID for an X520 Common Name into "CN") + * + * \param oid OID to use + * \param short_name place to store the string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_attr_short_name(const mbedtls_asn1_buf *oid, const char **short_name); + +/** + * \brief Translate PublicKeyAlgorithm OID into pk_type + * + * \param oid OID to use + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pk_alg(const mbedtls_asn1_buf *oid, mbedtls_pk_type_t *pk_alg); + +/** + * \brief Translate pk_type into PublicKeyAlgorithm OID + * + * \param pk_alg Public key type to look for + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_pk_alg(mbedtls_pk_type_t pk_alg, + const char **oid, size_t *olen); + +#if defined(MBEDTLS_PK_HAVE_ECC_KEYS) +/** + * \brief Translate NamedCurve OID into an EC group identifier + * + * \param oid OID to use + * \param grp_id place to store group id + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_ec_grp(const mbedtls_asn1_buf *oid, mbedtls_ecp_group_id *grp_id); + +/** + * \brief Translate EC group identifier into NamedCurve OID + * + * \param grp_id EC group identifier + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_ec_grp(mbedtls_ecp_group_id grp_id, + const char **oid, size_t *olen); + +/** + * \brief Translate AlgorithmIdentifier OID into an EC group identifier, + * for curves that are directly encoded at this level + * + * \param oid OID to use + * \param grp_id place to store group id + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_ec_grp_algid(const mbedtls_asn1_buf *oid, mbedtls_ecp_group_id *grp_id); + +/** + * \brief Translate EC group identifier into AlgorithmIdentifier OID, + * for curves that are directly encoded at this level + * + * \param grp_id EC group identifier + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_ec_grp_algid(mbedtls_ecp_group_id grp_id, + const char **oid, size_t *olen); +#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */ + +/** + * \brief Translate SignatureAlgorithm OID into md_type and pk_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg(const mbedtls_asn1_buf *oid, + mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg); + +/** + * \brief Translate SignatureAlgorithm OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg_desc(const mbedtls_asn1_buf *oid, const char **desc); + +/** + * \brief Translate md_type and pk_type into SignatureAlgorithm OID + * + * \param md_alg message digest algorithm + * \param pk_alg public key algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_sig_alg(mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, + const char **oid, size_t *olen); + +/** + * \brief Translate hmac algorithm OID into md_type + * + * \param oid OID to use + * \param md_hmac place to store message hmac algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_hmac(const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_hmac); + +/** + * \brief Translate hash algorithm OID into md_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_alg(const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg); + +#if !defined(MBEDTLS_X509_REMOVE_INFO) +/** + * \brief Translate Extended Key Usage OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_extended_key_usage(const mbedtls_asn1_buf *oid, const char **desc); +#endif + +/** + * \brief Translate certificate policies OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_certificate_policies(const mbedtls_asn1_buf *oid, const char **desc); + +/** + * \brief Translate md_type into hash algorithm OID + * + * \param md_alg message digest algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_md(mbedtls_md_type_t md_alg, const char **oid, size_t *olen); + +#if defined(MBEDTLS_CIPHER_C) +/** + * \brief Translate encryption algorithm OID into cipher_type + * + * \param oid OID to use + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_cipher_alg(const mbedtls_asn1_buf *oid, mbedtls_cipher_type_t *cipher_alg); + +#if defined(MBEDTLS_PKCS12_C) +/** + * \brief Translate PKCS#12 PBE algorithm OID into md_type and + * cipher_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pkcs12_pbe_alg(const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg, + mbedtls_cipher_type_t *cipher_alg); +#endif /* MBEDTLS_PKCS12_C */ +#endif /* MBEDTLS_CIPHER_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* oid.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pem.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pem.h new file mode 100644 index 00000000..3c6a28d9 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pem.h @@ -0,0 +1,160 @@ +/** + * \file pem.h + * + * \brief Privacy Enhanced Mail (PEM) decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PEM_H +#define MBEDTLS_PEM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include + +/** + * \name PEM Error codes + * These error codes are returned in case of errors reading the + * PEM data. + * \{ + */ +/** No PEM header or footer found. */ +#define MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT -0x1080 +/** PEM string is not as expected. */ +#define MBEDTLS_ERR_PEM_INVALID_DATA -0x1100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_PEM_ALLOC_FAILED -0x1180 +/** RSA IV is not in hex-format. */ +#define MBEDTLS_ERR_PEM_INVALID_ENC_IV -0x1200 +/** Unsupported key encryption algorithm. */ +#define MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG -0x1280 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PEM_PASSWORD_REQUIRED -0x1300 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PEM_PASSWORD_MISMATCH -0x1380 +/** Unavailable feature, e.g. hashing/encryption combination. */ +#define MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE -0x1400 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PEM_BAD_INPUT_DATA -0x1480 +/** \} name PEM Error codes */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) +/** + * \brief PEM context structure + */ +typedef struct mbedtls_pem_context { + unsigned char *MBEDTLS_PRIVATE(buf); /*!< buffer for decoded data */ + size_t MBEDTLS_PRIVATE(buflen); /*!< length of the buffer */ + unsigned char *MBEDTLS_PRIVATE(info); /*!< buffer for extra header information */ +} +mbedtls_pem_context; + +/** + * \brief PEM context setup + * + * \param ctx context to be initialized + */ +void mbedtls_pem_init(mbedtls_pem_context *ctx); + +/** + * \brief Read a buffer for PEM information and store the resulting + * data into the specified context buffers. + * + * \param ctx context to use + * \param header header string to seek and expect + * \param footer footer string to seek and expect + * \param data source data to look in (must be nul-terminated) + * \param pwd password for decryption (can be NULL) + * \param pwdlen length of password + * \param use_len destination for total length used from data buffer. It is + * set after header is correctly read, so unless you get + * MBEDTLS_ERR_PEM_BAD_INPUT_DATA or + * MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is + * the length to skip. + * + * \note Attempts to check password correctness by verifying if + * the decrypted text starts with an ASN.1 sequence of + * appropriate length + * + * \note \c mbedtls_pem_free must be called on PEM context before + * the PEM context can be reused in another call to + * \c mbedtls_pem_read_buffer + * + * \return 0 on success, or a specific PEM error code + */ +int mbedtls_pem_read_buffer(mbedtls_pem_context *ctx, const char *header, const char *footer, + const unsigned char *data, + const unsigned char *pwd, + size_t pwdlen, size_t *use_len); + +/** + * \brief Get the pointer to the decoded binary data in a PEM context. + * + * \param ctx PEM context to access. + * \param buflen On success, this will contain the length of the binary data. + * This must be a valid (non-null) pointer. + * + * \return A pointer to the decoded binary data. + * + * \note The returned pointer remains valid only until \p ctx is + modified or freed. + */ +static inline const unsigned char *mbedtls_pem_get_buffer(mbedtls_pem_context *ctx, size_t *buflen) +{ + *buflen = ctx->MBEDTLS_PRIVATE(buflen); + return ctx->MBEDTLS_PRIVATE(buf); +} + + +/** + * \brief PEM context memory freeing + * + * \param ctx context to be freed + */ +void mbedtls_pem_free(mbedtls_pem_context *ctx); +#endif /* MBEDTLS_PEM_PARSE_C */ + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a buffer of PEM information from a DER encoded + * buffer. + * + * \param header The header string to write. + * \param footer The footer string to write. + * \param der_data The DER data to encode. + * \param der_len The length of the DER data \p der_data in Bytes. + * \param buf The buffer to write to. + * \param buf_len The length of the output buffer \p buf in Bytes. + * \param olen The address at which to store the total length written + * or required (if \p buf_len is not enough). + * + * \note You may pass \c NULL for \p buf and \c 0 for \p buf_len + * to request the length of the resulting PEM buffer in + * `*olen`. + * + * \note This function may be called with overlapping \p der_data + * and \p buf buffers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL if \p buf isn't large + * enough to hold the PEM buffer. In this case, `*olen` holds + * the required minimum size of \p buf. + * \return Another PEM or BASE64 error code on other kinds of failure. + */ +int mbedtls_pem_write_buffer(const char *header, const char *footer, + const unsigned char *der_data, size_t der_len, + unsigned char *buf, size_t buf_len, size_t *olen); +#endif /* MBEDTLS_PEM_WRITE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* pem.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pk.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pk.h new file mode 100644 index 00000000..68b0f4be --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pk.h @@ -0,0 +1,1299 @@ +/** + * \file pk.h + * + * \brief Public Key abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_PK_H +#define MBEDTLS_PK_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_ECDSA_C) +#include "mbedtls/ecdsa.h" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) +#include "psa/crypto.h" +#endif + +/** Memory allocation failed. */ +#define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80 +/** Type mismatch, eg attempt to encrypt with an ECDSA key */ +#define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00 +/** Unsupported key version */ +#define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80 +/** Invalid key tag or value. */ +#define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00 +/** Key algorithm is unsupported (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80 +/** The pubkey tag or value is invalid (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80 +/** Elliptic curve is unsupported (only NIST curves are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00 +/** Unavailable feature, e.g. RSA disabled for RSA key. */ +#define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900 +/** The output buffer is too small. */ +#define MBEDTLS_ERR_PK_BUFFER_TOO_SMALL -0x3880 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Public key types + */ +typedef enum { + MBEDTLS_PK_NONE=0, + MBEDTLS_PK_RSA, + MBEDTLS_PK_ECKEY, + MBEDTLS_PK_ECKEY_DH, + MBEDTLS_PK_ECDSA, + MBEDTLS_PK_RSA_ALT, + MBEDTLS_PK_RSASSA_PSS, + MBEDTLS_PK_OPAQUE, +} mbedtls_pk_type_t; + +/** + * \brief Options for RSASSA-PSS signature verification. + * See \c mbedtls_rsa_rsassa_pss_verify_ext() + */ +typedef struct mbedtls_pk_rsassa_pss_options { + /** The digest to use for MGF1 in PSS. + * + * \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + * disabled, this must be equal to the \c md_alg argument passed + * to mbedtls_pk_verify_ext(). In a future version of the library, + * this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + * enabled regardless of the status of #MBEDTLS_RSA_C. + */ + mbedtls_md_type_t mgf1_hash_id; + + /** The expected length of the salt, in bytes. This may be + * #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + * + * \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + * #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + * ignored (allowing any salt length). + */ + int expected_salt_len; + +} mbedtls_pk_rsassa_pss_options; + +/** + * \brief Maximum size of a signature made by mbedtls_pk_sign(). + */ +/* We need to set MBEDTLS_PK_SIGNATURE_MAX_SIZE to the maximum signature + * size among the supported signature types. Do it by starting at 0, + * then incrementally increasing to be large enough for each supported + * signature mechanism. + * + * The resulting value can be 0, for example if MBEDTLS_ECDH_C is enabled + * (which allows the pk module to be included) but neither MBEDTLS_ECDSA_C + * nor MBEDTLS_RSA_C nor any opaque signature mechanism (PSA or RSA_ALT). + */ +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE 0 + +#if (defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PK_RSA_ALT_SUPPORT)) && \ + MBEDTLS_MPI_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For RSA, the signature can be as large as the bignum module allows. + * For RSA_ALT, the signature size is not necessarily tied to what the + * bignum module can do, but in the absence of any specific setting, + * we use that (rsa_alt_sign_wrap in library/pk_wrap.h will check). */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For ECDSA, the ecdsa module exports a constant for the maximum + * signature size. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if PSA_SIGNATURE_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* PSA_SIGNATURE_MAX_SIZE is the maximum size of a signature made + * through the PSA API in the PSA representation. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE PSA_SIGNATURE_MAX_SIZE +#endif + +#if PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* The Mbed TLS representation is different for ECDSA signatures: + * PSA uses the raw concatenation of r and s, + * whereas Mbed TLS uses the ASN.1 representation (SEQUENCE of two INTEGERs). + * Add the overhead of ASN.1: up to (1+2) + 2 * (1+2+1) for the + * types, lengths (represented by up to 2 bytes), and potential leading + * zeros of the INTEGERs and the SEQUENCE. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE (PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11) +#endif +#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */ + +/* Internal helper to define which fields in the pk_context structure below + * should be used for EC keys: legacy ecp_keypair or the raw (PSA friendly) + * format. It should be noted that this only affects how data is stored, not + * which functions are used for various operations. The overall picture looks + * like this: + * - if USE_PSA is not defined and ECP_C is defined then use ecp_keypair data + * structure and legacy functions + * - if USE_PSA is defined and + * - if ECP_C then use ecp_keypair structure, convert data to a PSA friendly + * format and use PSA functions + * - if !ECP_C then use new raw data and PSA functions directly. + * + * The main reason for the "intermediate" (USE_PSA + ECP_C) above is that as long + * as ECP_C is defined mbedtls_pk_ec() gives the user a read/write access to the + * ecp_keypair structure inside the pk_context so they can modify it using + * ECP functions which are not under PK module's control. + */ +#if defined(MBEDTLS_USE_PSA_CRYPTO) && defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ + !defined(MBEDTLS_ECP_C) +#define MBEDTLS_PK_USE_PSA_EC_DATA +#endif + +/** + * \brief Types for interfacing with the debug module + */ +typedef enum { + MBEDTLS_PK_DEBUG_NONE = 0, + MBEDTLS_PK_DEBUG_MPI, + MBEDTLS_PK_DEBUG_ECP, + MBEDTLS_PK_DEBUG_PSA_EC, +} mbedtls_pk_debug_type; + +/** + * \brief Item to send to the debug module + */ +typedef struct mbedtls_pk_debug_item { + mbedtls_pk_debug_type MBEDTLS_PRIVATE(type); + const char *MBEDTLS_PRIVATE(name); + void *MBEDTLS_PRIVATE(value); +} mbedtls_pk_debug_item; + +/** Maximum number of item send for debugging, plus 1 */ +#define MBEDTLS_PK_DEBUG_MAX_ITEMS 3 + +/** + * \brief Public key information and operations + * + * \note The library does not support custom pk info structures, + * only built-in structures returned by + * mbedtls_cipher_info_from_type(). + */ +typedef struct mbedtls_pk_info_t mbedtls_pk_info_t; + +#define MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN \ + PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) +/** + * \brief Public key container + */ +typedef struct mbedtls_pk_context { + /** Method table */ + const mbedtls_pk_info_t *MBEDTLS_PRIVATE(pk_info); + /** Underlying type-specific key context */ + void *MBEDTLS_PRIVATE(pk_ctx); + + /* The following field is used to store the ID of a private key in the + * following cases: + * - opaque key when MBEDTLS_USE_PSA_CRYPTO is defined + * - normal key when MBEDTLS_PK_USE_PSA_EC_DATA is defined. In this case: + * - the pk_ctx above is not not used to store the private key anymore. + * Actually that field not populated at all in this case because also + * the public key will be stored in raw format as explained below + * - this ID is used for all private key operations (ex: sign, check + * key pair, key write, etc) using PSA functions + * + * Note: this private key storing solution only affects EC keys, not the + * other ones. The latters still use the pk_ctx to store their own + * context. */ +#if defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(priv_id); /**< Key ID for opaque keys */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + /* The following fields are meant for storing the public key in raw format + * which is handy for: + * - easily importing it into the PSA context + * - reducing the ECP module dependencies in the PK one. + * + * When MBEDTLS_PK_USE_PSA_EC_DATA is enabled: + * - the pk_ctx above is not used anymore for storing the public key + * inside the ecp_keypair structure + * - the following fields are used for all public key operations: signature + * verify, key pair check and key write. + * - For a key pair, priv_id contains the private key. For a public key, + * priv_id is null. + * Of course, when MBEDTLS_PK_USE_PSA_EC_DATA is not enabled, the legacy + * ecp_keypair structure is used for storing the public key and performing + * all the operations. + * + * Note: This new public key storing solution only works for EC keys, not + * other ones. The latters still use pk_ctx to store their own + * context. + */ +#if defined(MBEDTLS_PK_USE_PSA_EC_DATA) + uint8_t MBEDTLS_PRIVATE(pub_raw)[MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN]; /**< Raw public key */ + size_t MBEDTLS_PRIVATE(pub_raw_len); /**< Valid bytes in "pub_raw" */ + psa_ecc_family_t MBEDTLS_PRIVATE(ec_family); /**< EC family of pk */ + size_t MBEDTLS_PRIVATE(ec_bits); /**< Curve's bits of pk */ +#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ +} mbedtls_pk_context; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Context for resuming operations + */ +typedef struct { + const mbedtls_pk_info_t *MBEDTLS_PRIVATE(pk_info); /**< Public key information */ + void *MBEDTLS_PRIVATE(rs_ctx); /**< Underlying restart context */ +} mbedtls_pk_restart_ctx; +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_pk_restart_ctx; +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Types for RSA-alt abstraction + */ +typedef int (*mbedtls_pk_rsa_alt_decrypt_func)(void *ctx, size_t *olen, + const unsigned char *input, unsigned char *output, + size_t output_max_len); +typedef int (*mbedtls_pk_rsa_alt_sign_func)(void *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_md_type_t md_alg, unsigned int hashlen, + const unsigned char *hash, unsigned char *sig); +typedef size_t (*mbedtls_pk_rsa_alt_key_len_func)(void *ctx); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Return information associated with the given PK type + * + * \param pk_type PK type to search for. + * + * \return The PK info associated with the type or NULL if not found. + */ +const mbedtls_pk_info_t *mbedtls_pk_info_from_type(mbedtls_pk_type_t pk_type); + +/** + * \brief Initialize a #mbedtls_pk_context (as NONE). + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_init(mbedtls_pk_context *ctx); + +/** + * \brief Free the components of a #mbedtls_pk_context. + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + * + * \note For contexts that have been set up with + * mbedtls_pk_setup_opaque(), this does not free the underlying + * PSA key and you still need to call psa_destroy_key() + * independently if you want to destroy that key. + */ +void mbedtls_pk_free(mbedtls_pk_context *ctx); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_restart_init(mbedtls_pk_restart_ctx *ctx); + +/** + * \brief Free the components of a restart context + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + */ +void mbedtls_pk_restart_free(mbedtls_pk_restart_ctx *ctx); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief Initialize a PK context with the information given + * and allocates the type-specific PK subcontext. + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param info Information to use + * + * \return 0 on success, + * MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + * MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + * + * \note For contexts holding an RSA-alt key, use + * \c mbedtls_pk_setup_rsa_alt() instead. + */ +int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Initialize a PK context to wrap a PSA key. + * + * This function creates a PK context which wraps a PSA key. The PSA wrapped + * key must be an EC or RSA key pair (DH is not suported in the PK module). + * + * Under the hood PSA functions will be used to perform the required + * operations and, based on the key type, used algorithms will be: + * * EC: + * * verify, verify_ext, sign, sign_ext: ECDSA. + * * RSA: + * * sign, decrypt: use the primary algorithm in the wrapped PSA key; + * * sign_ext: RSA PSS if the pk_type is #MBEDTLS_PK_RSASSA_PSS, otherwise + * it falls back to the sign() case; + * * verify, verify_ext, encrypt: not supported. + * + * In order for the above operations to succeed, the policy of the wrapped PSA + * key must allow the specified algorithm. + * + * Opaque PK contexts wrapping an EC keys also support \c mbedtls_pk_check_pair(), + * whereas RSA ones do not. + * + * \warning The PSA wrapped key must remain valid as long as the wrapping PK + * context is in use, that is at least between the point this function + * is called and the point mbedtls_pk_free() is called on this context. + * + * \param ctx The context to initialize. It must be empty (type NONE). + * \param key The PSA key to wrap, which must hold an ECC or RSA key pair. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input (context already + * used, invalid key identifier). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the key is not an ECC or + * RSA key pair. + * \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + */ +int mbedtls_pk_setup_opaque(mbedtls_pk_context *ctx, + const mbedtls_svc_key_id_t key); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Initialize an RSA-alt context + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param key RSA key pointer + * \param decrypt_func Decryption function + * \param sign_func Signing function + * \param key_len_func Function returning key length in bytes + * + * \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + * context wasn't already initialized as RSA_ALT. + * + * \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + */ +int mbedtls_pk_setup_rsa_alt(mbedtls_pk_context *ctx, void *key, + mbedtls_pk_rsa_alt_decrypt_func decrypt_func, + mbedtls_pk_rsa_alt_sign_func sign_func, + mbedtls_pk_rsa_alt_key_len_func key_len_func); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Get the size in bits of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key size in bits, or 0 on error + */ +size_t mbedtls_pk_get_bitlen(const mbedtls_pk_context *ctx); + +/** + * \brief Get the length in bytes of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key length in bytes, or 0 on error + */ +static inline size_t mbedtls_pk_get_len(const mbedtls_pk_context *ctx) +{ + return (mbedtls_pk_get_bitlen(ctx) + 7) / 8; +} + +/** + * \brief Tell if a context can do the operation given by type + * + * \param ctx The context to query. It must have been initialized. + * \param type The desired type. + * + * \return 1 if the context can do operations on the given type. + * \return 0 if the context cannot do the operations on the given + * type. This is always the case for a context that has + * been initialized but not set up, or that has been + * cleared with mbedtls_pk_free(). + */ +int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Tell if context can do the operation given by PSA algorithm + * + * \param ctx The context to query. It must have been initialized. + * \param alg PSA algorithm to check against, the following are allowed: + * PSA_ALG_RSA_PKCS1V15_SIGN(hash), + * PSA_ALG_RSA_PSS(hash), + * PSA_ALG_RSA_PKCS1V15_CRYPT, + * PSA_ALG_ECDSA(hash), + * PSA_ALG_ECDH, where hash is a specific hash. + * \param usage PSA usage flag to check against, must be composed of: + * PSA_KEY_USAGE_SIGN_HASH + * PSA_KEY_USAGE_DECRYPT + * PSA_KEY_USAGE_DERIVE. + * Context key must match all passed usage flags. + * + * \warning Since the set of allowed algorithms and usage flags may be + * expanded in the future, the return value \c 0 should not + * be taken in account for non-allowed algorithms and usage + * flags. + * + * \return 1 if the context can do operations on the given type. + * \return 0 if the context cannot do the operations on the given + * type, for non-allowed algorithms and usage flags, or + * for a context that has been initialized but not set up + * or that has been cleared with mbedtls_pk_free(). + */ +int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg, + psa_key_usage_t usage); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) +/** + * \brief Determine valid PSA attributes that can be used to + * import a key into PSA. + * + * The attributes determined by this function are suitable + * for calling mbedtls_pk_import_into_psa() to create + * a PSA key with the same key material. + * + * The typical flow of operations involving this function is + * ``` + * psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + * int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + * if (ret != 0) ...; // error handling omitted + * // Tweak attributes if desired + * psa_key_id_t key_id = 0; + * ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + * if (ret != 0) ...; // error handling omitted + * ``` + * + * \note This function does not support RSA-alt contexts + * (set up with mbedtls_pk_setup_rsa_alt()). + * + * \param[in] pk The PK context to use. It must have been set up. + * It can either contain a key pair or just a public key. + * \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + * - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + * key pair. The output \p attributes will contain a + * key pair type, and the usage policy will allow + * #PSA_KEY_USAGE_ENCRYPT as well as + * #PSA_KEY_USAGE_DECRYPT. + * - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + * key pair. The output \p attributes will contain a + * key pair type. + * - #PSA_KEY_USAGE_ENCRYPT: The output + * \p attributes will contain a public key type. + * - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + * key pair. The output \p attributes will contain a + * key pair type, and the usage policy will allow + * #PSA_KEY_USAGE_VERIFY_HASH as well as + * #PSA_KEY_USAGE_SIGN_HASH. + * - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + * key pair. The output \p attributes will contain a + * key pair type, and the usage policy will allow + * #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + * #PSA_KEY_USAGE_SIGN_MESSAGE. + * - #PSA_KEY_USAGE_VERIFY_HASH: The output + * \p attributes will contain a public key type. + * - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + * \p attributes will contain a public key type. + * \param[out] attributes + * On success, valid attributes to import the key into PSA. + * - The lifetime and key identifier are unchanged. If the + * attribute structure was initialized or reset before + * calling this function, this will result in a volatile + * key. Call psa_set_key_identifier() before or after this + * function if you wish to create a persistent key. Call + * psa_set_key_lifetime() before or after this function if + * you wish to import the key in a secure element. + * - The key type and bit-size are determined by the contents + * of the PK context. If the PK context contains a key + * pair, the key type can be either a key pair type or + * the corresponding public key type, depending on + * \p usage. If the PK context contains a public key, + * the key type is a public key type. + * - The key's policy is determined by the key type and + * the \p usage parameter. The usage always allows + * \p usage, exporting and copying the key, and + * possibly other permissions as documented for the + * \p usage parameter. + * The permitted algorithm policy is determined as follows + * based on the #mbedtls_pk_type_t type of \p pk, + * the chosen \p usage and other factors: + * - #MBEDTLS_PK_RSA whose underlying + * #mbedtls_rsa_context has the padding mode + * #MBEDTLS_RSA_PKCS_V15: + * #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + * if \p usage is SIGN/VERIFY, and + * #PSA_ALG_RSA_PKCS1V15_CRYPT + * if \p usage is ENCRYPT/DECRYPT. + * - #MBEDTLS_PK_RSA whose underlying + * #mbedtls_rsa_context has the padding mode + * #MBEDTLS_RSA_PKCS_V21 and the digest type + * corresponding to the PSA algorithm \c hash: + * #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + * if \p usage is SIGN/VERIFY, and + * #PSA_ALG_RSA_OAEP(\c hash) + * if \p usage is ENCRYPT/DECRYPT. + * - #MBEDTLS_PK_RSA_ALT: not supported. + * - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + * if \p usage is SIGN/VERIFY: + * #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + * if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + * otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + * - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + * if \p usage is DERIVE: + * #PSA_ALG_ECDH. + * - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + * set for the underlying PSA key, except that + * sign/decrypt flags are removed if the type is + * set to a public key type. + * The underlying key must allow \p usage. + * Note that the enrollment algorithm set with + * psa_set_key_enrollment_algorithm() is not copied. + * + * \return 0 on success. + * #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + * a key of the type identified in \p attributes. + * Another error code on other failures. + */ +int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk, + psa_key_usage_t usage, + psa_key_attributes_t *attributes); + +/** + * \brief Import a key into the PSA key store. + * + * This function is equivalent to calling psa_import_key() + * with the key material from \p pk. + * + * The typical way to use this function is: + * -# Call mbedtls_pk_get_psa_attributes() to obtain + * attributes for the given key. + * -# If desired, modify the attributes, for example: + * - To create a persistent key, call + * psa_set_key_identifier() and optionally + * psa_set_key_lifetime(). + * - To import only the public part of a key pair: + * + * psa_set_key_type(&attributes, + * PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + * psa_get_key_type(&attributes))); + * - Restrict the key usage if desired. + * -# Call mbedtls_pk_import_into_psa(). + * + * \note This function does not support RSA-alt contexts + * (set up with mbedtls_pk_setup_rsa_alt()). + * + * \param[in] pk The PK context to use. It must have been set up. + * It can either contain a key pair or just a public key. + * \param[in] attributes + * The attributes to use for the new key. They must be + * compatible with \p pk. In particular, the key type + * must match the content of \p pk. + * If \p pk contains a key pair, the key type in + * attributes can be either the key pair type or the + * corresponding public key type (to import only the + * public part). + * \param[out] key_id + * On success, the identifier of the newly created key. + * On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + * + * \return 0 on success. + * #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + * a key of the type identified in \p attributes. + * Another error code on other failures. + */ +int mbedtls_pk_import_into_psa(const mbedtls_pk_context *pk, + const psa_key_attributes_t *attributes, + mbedtls_svc_key_id_t *key_id); + +/** + * \brief Create a PK context starting from a key stored in PSA. + * This key: + * - must be exportable and + * - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + * + * The resulting PK object will be a transparent type: + * - #MBEDTLS_PK_RSA for RSA keys or + * - #MBEDTLS_PK_ECKEY for EC keys. + * + * Once this functions returns the PK object will be completely + * independent from the original PSA key that it was generated + * from. + * Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + * mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + * PK context will perform the corresponding algorithm for that + * PK context type. + * * For ECDSA, the choice of deterministic vs randomized will + * be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + * * For an RSA key, the output PK context will allow both + * encrypt/decrypt and sign/verify regardless of the original + * key's policy. + * The original key's policy determines the output key's padding + * mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + * otherwise PKCS1 v1.5 is set. + * + * \param key_id The key identifier of the key stored in PSA. + * \param pk The PK context that will be filled. It must be initialized, + * but not set up. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + * parameters are not correct. + */ +int mbedtls_pk_copy_from_psa(mbedtls_svc_key_id_t key_id, mbedtls_pk_context *pk); + +/** + * \brief Create a PK context for the public key of a PSA key. + * + * The key must be an RSA or ECC key. It can be either a + * public key or a key pair, and only the public key is copied. + * The resulting PK object will be a transparent type: + * - #MBEDTLS_PK_RSA for RSA keys or + * - #MBEDTLS_PK_ECKEY for EC keys. + * + * Once this functions returns the PK object will be completely + * independent from the original PSA key that it was generated + * from. + * Calling mbedtls_pk_verify() or + * mbedtls_pk_encrypt() on the resulting + * PK context will perform the corresponding algorithm for that + * PK context type. + * + * For an RSA key, the output PK context will allow both + * encrypt and verify regardless of the original key's policy. + * The original key's policy determines the output key's padding + * mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + * otherwise PKCS1 v1.5 is set. + * + * \param key_id The key identifier of the key stored in PSA. + * \param pk The PK context that will be filled. It must be initialized, + * but not set up. + * + * \return 0 on success. + * \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + * parameters are not correct. + */ +int mbedtls_pk_copy_public_from_psa(mbedtls_svc_key_id_t key_id, mbedtls_pk_context *pk); +#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */ + +/** + * \brief Verify signature (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used. + * This can be #MBEDTLS_MD_NONE if the signature algorithm + * does not rely on a hash algorithm (non-deterministic + * ECDSA, RSA PKCS#1 v1.5). + * For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + * \p hash is the DigestInfo structure used by RFC 8017 + * §9.2 steps 3–6. If \p md_alg is a valid hash + * algorithm then \p hash is the digest itself, and this + * function calculates the DigestInfo encoding internally. + * \param hash Hash of the message to sign + * \param hash_len Hash length + * \param sig Signature to verify + * \param sig_len Signature length + * + * \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + * either PKCS#1 v1.5 or PSS (accepting any salt length), + * depending on the padding mode in the underlying RSA context. + * For a pk object constructed by parsing, this is PKCS#1 v1.5 + * by default. Use mbedtls_pk_verify_ext() to explicitly select + * a different algorithm. + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig but its length is less than \p sig_len, + * or a specific error code. + */ +int mbedtls_pk_verify(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len); + +/** + * \brief Restartable version of \c mbedtls_pk_verify() + * + * \note Performs the same job as \c mbedtls_pk_verify(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_verify(). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_verify(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_verify_restartable(mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len, + mbedtls_pk_restart_ctx *rs_ctx); + +/** + * \brief Verify signature, with options. + * (Includes verification of the padding depending on type.) + * + * \param type Signature type (inc. possible padding type) to verify + * \param options Pointer to type-specific options, or NULL + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + * used for this type of signatures, + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig but its length is less than \p sig_len, + * or a specific error code. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + * + * \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + * to a mbedtls_pk_rsassa_pss_options structure, + * otherwise it must be NULL. Note that if + * #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + * verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + */ +int mbedtls_pk_verify_ext(mbedtls_pk_type_t type, const void *options, + mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len); + +/** + * \brief Make signature, including padding if relevant. + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_size The size of the \p sig buffer in bytes. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * + * \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + * either PKCS#1 v1.5 or PSS (using the largest possible salt + * length up to the hash length), depending on the padding mode + * in the underlying RSA context. For a pk object constructed + * by parsing, this is PKCS#1 v1.5 by default. Use + * mbedtls_pk_sign_ext() to explicitly select a different + * algorithm. + * + * \return 0 on success, or a specific error code. + * + * \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + * For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + */ +int mbedtls_pk_sign(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t sig_size, size_t *sig_len, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** + * \brief Make signature given a signature type. + * + * \param pk_type Signature type. + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_size The size of the \p sig buffer in bytes. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * + * \return 0 on success, or a specific error code. + * + * \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + * see #PSA_ALG_RSA_PSS for a description of PSS options used. + * + * \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + * For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + * + */ +int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type, + mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t sig_size, size_t *sig_len, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Restartable version of \c mbedtls_pk_sign() + * + * \note Performs the same job as \c mbedtls_pk_sign(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_sign(). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + * \param hash Hash of the message to sign + * \param hash_len Hash length + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_size The size of the \p sig buffer in bytes. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_sign(). + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t sig_size, size_t *sig_len, + mbedtls_f_rng_t *f_rng, void *p_rng, + mbedtls_pk_restart_ctx *rs_ctx); + +/** + * \brief Decrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param input Input to decrypt + * \param ilen Input size + * \param output Decrypted output + * \param olen Decrypted message length + * \param osize Size of the output buffer + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * + * \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + * either PKCS#1 v1.5 or OAEP, depending on the padding mode in + * the underlying RSA context. For a pk object constructed by + * parsing, this is PKCS#1 v1.5 by default. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_decrypt(mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** + * \brief Encrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param input Message to encrypt + * \param ilen Message size + * \param output Encrypted output + * \param olen Encrypted output length + * \param osize Size of the output buffer + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * + * \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + * either PKCS#1 v1.5 or OAEP, depending on the padding mode in + * the underlying RSA context. For a pk object constructed by + * parsing, this is PKCS#1 v1.5 by default. + * + * \note \p f_rng is used for padding generation. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_encrypt(mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** + * \brief Check if a public-private pair of keys matches. + * + * \param pub Context holding a public key. + * \param prv Context holding a private (and public) key. + * \param f_rng RNG function, must not be \c NULL. + * \param p_rng RNG parameter + * + * \return \c 0 on success (keys were checked and match each other). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + * be checked - in that case they may or may not match. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + * \return Another non-zero value if the keys do not match. + */ +int mbedtls_pk_check_pair(const mbedtls_pk_context *pub, + const mbedtls_pk_context *prv, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Export debug information + * + * \param ctx The PK context to use. It must have been initialized. + * \param items Place to write debug items + * + * \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + */ +int mbedtls_pk_debug(const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items); + +/** + * \brief Access the type name + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type name on success, or "invalid PK" + */ +const char *mbedtls_pk_get_name(const mbedtls_pk_context *ctx); + +/** + * \brief Get the key type + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type on success. + * \return #MBEDTLS_PK_NONE for a context that has not been set up. + */ +mbedtls_pk_type_t mbedtls_pk_get_type(const mbedtls_pk_context *ctx); + +#if defined(MBEDTLS_RSA_C) +/** + * Quick access to an RSA context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_RSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal RSA context held by the PK context, or NULL. + */ +static inline mbedtls_rsa_context *mbedtls_pk_rsa(const mbedtls_pk_context pk) +{ + switch (mbedtls_pk_get_type(&pk)) { + case MBEDTLS_PK_RSA: + return (mbedtls_rsa_context *) (pk).MBEDTLS_PRIVATE(pk_ctx); + default: + return NULL; + } +} +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_ECP_C) +/** + * Quick access to an EC context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_ECKEY, + * #MBEDTLS_PK_ECKEY_DH, or #MBEDTLS_PK_ECDSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal EC context held by the PK context, or NULL. + */ +static inline mbedtls_ecp_keypair *mbedtls_pk_ec(const mbedtls_pk_context pk) +{ + switch (mbedtls_pk_get_type(&pk)) { + case MBEDTLS_PK_ECKEY: + case MBEDTLS_PK_ECKEY_DH: + case MBEDTLS_PK_ECDSA: + return (mbedtls_ecp_keypair *) (pk).MBEDTLS_PRIVATE(pk_ctx); + default: + return NULL; + } +} +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** \ingroup pk_module */ +/** + * \brief Parse a private key in PEM or DER format + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * \param pwd Optional password for decryption. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a string of \p pwdlen bytes if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * \param pwdlen Size of the password in bytes. + * Ignored if \p pwd is \c NULL. + * \param f_rng RNG function, must not be \c NULL. Used for blinding. + * \param p_rng RNG parameter + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_key(mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen, + const unsigned char *pwd, size_t pwdlen, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** \ingroup pk_module */ +/** + * \brief Parse a public key in PEM or DER format + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + * limitations. + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_key(mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen); + +#if defined(MBEDTLS_FS_IO) +/** \ingroup pk_module */ +/** + * \brief Load and parse a private key + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the private key from + * \param password Optional password to decrypt the file. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a null-terminated string if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * \param f_rng RNG function, must not be \c NULL. Used for blinding. + * \param p_rng RNG parameter + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_keyfile(mbedtls_pk_context *ctx, + const char *path, const char *password, + mbedtls_f_rng_t *f_rng, void *p_rng); + +/** \ingroup pk_module */ +/** + * \brief Load and parse a public key + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the public key from + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If + * you need a specific key type, check the result with + * mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_keyfile(mbedtls_pk_context *ctx, const char *path); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a private key to a PKCS#1 or SEC1 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_key_der(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size); + +/** + * \brief Write a public key to a SubjectPublicKeyInfo DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_pubkey_der(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a public key to a PEM string + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_pubkey_pem(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size); + +/** + * \brief Write a private key to a PKCS#1 or SEC1 PEM string + * + * \param ctx PK context which must contain a valid private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_key_pem(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_PK_WRITE_C */ + +/* + * WARNING: Low-level functions. You probably do not want to use these unless + * you are certain you do ;) + */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** + * \brief Parse a SubjectPublicKeyInfo DER structure + * + * \param p the position in the ASN.1 data + * \param end end of the buffer + * \param pk The PK context to fill. It must have been initialized + * but not set up. + * + * \return 0 if successful, or a specific PK error code + */ +int mbedtls_pk_parse_subpubkey(unsigned char **p, const unsigned char *end, + mbedtls_pk_context *pk); +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a subjectPublicKey to ASN.1 data + * Note: function works backwards in data buffer + * + * \param p reference to current position pointer + * \param start start of the buffer (for bounds-checking) + * \param key PK context which must contain a valid public or private key. + * + * \return the length written or a negative error code + */ +int mbedtls_pk_write_pubkey(unsigned char **p, unsigned char *start, + const mbedtls_pk_context *key); +#endif /* MBEDTLS_PK_WRITE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PK_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs12.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs12.h new file mode 100644 index 00000000..87f7681f --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs12.h @@ -0,0 +1,186 @@ +/** + * \file pkcs12.h + * + * \brief PKCS#12 Personal Information Exchange Syntax + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PKCS12_H +#define MBEDTLS_PKCS12_H + +#include "mbedtls/build_info.h" + +#include "mbedtls/md.h" +#include "mbedtls/cipher.h" +#include "mbedtls/asn1.h" + +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA -0x1F80 +/** Feature not available, e.g. unsupported encryption scheme. */ +#define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE -0x1F00 +/** PBE ASN.1 data not as expected. */ +#define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT -0x1E80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH -0x1E00 + +#define MBEDTLS_PKCS12_DERIVE_KEY 1 /**< encryption/decryption key */ +#define MBEDTLS_PKCS12_DERIVE_IV 2 /**< initialization vector */ +#define MBEDTLS_PKCS12_DERIVE_MAC_KEY 3 /**< integrity / MAC key */ + +#define MBEDTLS_PKCS12_PBE_DECRYPT MBEDTLS_DECRYPT +#define MBEDTLS_PKCS12_PBE_ENCRYPT MBEDTLS_ENCRYPT + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) && defined(MBEDTLS_CIPHER_C) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for cipher-based and mbedtls_md-based PBE's + * + * \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + * be enabled at compile time. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * Please use mbedtls_pkcs12_pbe_ext() instead. + * + * \warning When decrypting: + * - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + * time, this function validates the CBC padding and returns + * #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + * invalid. Note that this can help active adversaries + * attempting to brute-forcing the password. Note also that + * there is no guarantee that an invalid password will be + * detected (the chances of a valid padding with a random + * password are about 1/255). + * - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + * time, this function does not validate the CBC padding. + * + * \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + * \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + * #MBEDTLS_PKCS12_PBE_DECRYPT + * \param cipher_type the cipher used + * \param md_type the mbedtls_md used + * \param pwd Latin1-encoded password used. This may only be \c NULL when + * \p pwdlen is 0. No null terminator should be used. + * \param pwdlen length of the password (may be 0) + * \param data the input data + * \param len data length + * \param output Output buffer. + * On success, it contains the encrypted or decrypted data, + * possibly followed by the CBC padding. + * On failure, the content is indeterminate. + * For decryption, there must be enough room for \p len + * bytes. + * For encryption, there must be enough room for + * \p len + 1 bytes, rounded up to the block size of + * the block cipher identified by \p pbe_params. + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int MBEDTLS_DEPRECATED mbedtls_pkcs12_pbe(mbedtls_asn1_buf *pbe_params, int mode, + mbedtls_cipher_type_t cipher_type, + mbedtls_md_type_t md_type, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t len, + unsigned char *output); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) + +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for cipher-based and mbedtls_md-based PBE's + * + * + * \warning When decrypting: + * - This function validates the CBC padding and returns + * #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + * invalid. Note that this can help active adversaries + * attempting to brute-forcing the password. Note also that + * there is no guarantee that an invalid password will be + * detected (the chances of a valid padding with a random + * password are about 1/255). + * + * \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + * \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + * #MBEDTLS_PKCS12_PBE_DECRYPT + * \param cipher_type the cipher used + * \param md_type the mbedtls_md used + * \param pwd Latin1-encoded password used. This may only be \c NULL when + * \p pwdlen is 0. No null terminator should be used. + * \param pwdlen length of the password (may be 0) + * \param data the input data + * \param len data length + * \param output Output buffer. + * On success, it contains the encrypted or decrypted data, + * possibly followed by the CBC padding. + * On failure, the content is indeterminate. + * For decryption, there must be enough room for \p len + * bytes. + * For encryption, there must be enough room for + * \p len + 1 bytes, rounded up to the block size of + * the block cipher identified by \p pbe_params. + * \param output_size size of output buffer. + * This must be big enough to accommodate for output plus + * padding data. + * \param output_len On success, length of actual data written to the output buffer. + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int mbedtls_pkcs12_pbe_ext(mbedtls_asn1_buf *pbe_params, int mode, + mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t len, + unsigned char *output, size_t output_size, + size_t *output_len); + +#endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */ + +#endif /* MBEDTLS_ASN1_PARSE_C && MBEDTLS_CIPHER_C */ + +/** + * \brief The PKCS#12 derivation function uses a password and a salt + * to produce pseudo-random bits for a particular "purpose". + * + * Depending on the given id, this function can produce an + * encryption/decryption key, an initialization vector or an + * integrity key. + * + * \param data buffer to store the derived data in + * \param datalen length of buffer to fill + * \param pwd The password to use. For compliance with PKCS#12 §B.1, this + * should be a BMPString, i.e. a Unicode string where each + * character is encoded as 2 bytes in big-endian order, with + * no byte order mark and with a null terminator (i.e. the + * last two bytes should be 0x00 0x00). + * \param pwdlen length of the password (may be 0). + * \param salt Salt buffer to use. This may only be \c NULL when + * \p saltlen is 0. + * \param saltlen length of the salt (may be zero) + * \param mbedtls_md mbedtls_md type to use during the derivation + * \param id id that describes the purpose (can be + * #MBEDTLS_PKCS12_DERIVE_KEY, #MBEDTLS_PKCS12_DERIVE_IV or + * #MBEDTLS_PKCS12_DERIVE_MAC_KEY) + * \param iterations number of iterations + * + * \return 0 if successful, or a MD, BIGNUM type error. + */ +int mbedtls_pkcs12_derivation(unsigned char *data, size_t datalen, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *salt, size_t saltlen, + mbedtls_md_type_t mbedtls_md, int id, int iterations); + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs12.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs5.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs5.h new file mode 100644 index 00000000..9ba5689d --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs5.h @@ -0,0 +1,198 @@ +/** + * \file pkcs5.h + * + * \brief PKCS#5 functions + * + * \author Mathias Olsson + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PKCS5_H +#define MBEDTLS_PKCS5_H + +#include "mbedtls/build_info.h" +#include "mbedtls/platform_util.h" + +#include "mbedtls/asn1.h" +#include "mbedtls/md.h" +#include "mbedtls/cipher.h" + +#include +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA -0x2f80 +/** Unexpected ASN.1 data. */ +#define MBEDTLS_ERR_PKCS5_INVALID_FORMAT -0x2f00 +/** Requested encryption or digest alg not available. */ +#define MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE -0x2e80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH -0x2e00 + +#define MBEDTLS_PKCS5_DECRYPT MBEDTLS_DECRYPT +#define MBEDTLS_PKCS5_ENCRYPT MBEDTLS_ENCRYPT + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) && defined(MBEDTLS_CIPHER_C) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief PKCS#5 PBES2 function + * + * \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + * be enabled at compile time. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * Please use mbedtls_pkcs5_pbes2_ext() instead. + * + * \warning When decrypting: + * - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + * time, this function validates the CBC padding and returns + * #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + * invalid. Note that this can help active adversaries + * attempting to brute-forcing the password. Note also that + * there is no guarantee that an invalid password will be + * detected (the chances of a valid padding with a random + * password are about 1/255). + * - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + * time, this function does not validate the CBC padding. + * + * \param pbe_params the ASN.1 algorithm parameters + * \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + * \param pwd password to use when generating key + * \param pwdlen length of password + * \param data data to process + * \param datalen length of data + * \param output Output buffer. + * On success, it contains the encrypted or decrypted data, + * possibly followed by the CBC padding. + * On failure, the content is indeterminate. + * For decryption, there must be enough room for \p datalen + * bytes. + * For encryption, there must be enough room for + * \p datalen + 1 bytes, rounded up to the block size of + * the block cipher identified by \p pbe_params. + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int MBEDTLS_DEPRECATED mbedtls_pkcs5_pbes2(const mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t datalen, + unsigned char *output); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) + +/** + * \brief PKCS#5 PBES2 function + * + * \warning When decrypting: + * - This function validates the CBC padding and returns + * #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + * invalid. Note that this can help active adversaries + * attempting to brute-forcing the password. Note also that + * there is no guarantee that an invalid password will be + * detected (the chances of a valid padding with a random + * password are about 1/255). + * + * \param pbe_params the ASN.1 algorithm parameters + * \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + * \param pwd password to use when generating key + * \param pwdlen length of password + * \param data data to process + * \param datalen length of data + * \param output Output buffer. + * On success, it contains the decrypted data. + * On failure, the content is indetermidate. + * For decryption, there must be enough room for \p datalen + * bytes. + * For encryption, there must be enough room for + * \p datalen + 1 bytes, rounded up to the block size of + * the block cipher identified by \p pbe_params. + * \param output_size size of output buffer. + * This must be big enough to accommodate for output plus + * padding data. + * \param output_len On success, length of actual data written to the output buffer. + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + */ +int mbedtls_pkcs5_pbes2_ext(const mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t datalen, + unsigned char *output, size_t output_size, + size_t *output_len); + +#endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */ + +#endif /* MBEDTLS_ASN1_PARSE_C && MBEDTLS_CIPHER_C*/ + +/** + * \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context + * + * \param md_type Hash algorithm used + * \param password Password to use when generating key + * \param plen Length of password + * \param salt Salt to use when generating key + * \param slen Length of salt + * \param iteration_count Iteration count + * \param key_length Length of generated key in bytes + * \param output Generated key. Must be at least as big as key_length + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int mbedtls_pkcs5_pbkdf2_hmac_ext(mbedtls_md_type_t md_type, + const unsigned char *password, + size_t plen, const unsigned char *salt, size_t slen, + unsigned int iteration_count, + uint32_t key_length, unsigned char *output); + +#if defined(MBEDTLS_MD_C) +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief PKCS#5 PBKDF2 using HMAC + * + * \deprecated Superseded by mbedtls_pkcs5_pbkdf2_hmac_ext(). + * + * \param ctx Generic HMAC context + * \param password Password to use when generating key + * \param plen Length of password + * \param salt Salt to use when generating key + * \param slen Length of salt + * \param iteration_count Iteration count + * \param key_length Length of generated key in bytes + * \param output Generated key. Must be at least as big as key_length + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int MBEDTLS_DEPRECATED mbedtls_pkcs5_pbkdf2_hmac(mbedtls_md_context_t *ctx, + const unsigned char *password, + size_t plen, + const unsigned char *salt, + size_t slen, + unsigned int iteration_count, + uint32_t key_length, + unsigned char *output); +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_MD_C */ +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_pkcs5_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs5.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs7.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs7.h new file mode 100644 index 00000000..e9b48220 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/pkcs7.h @@ -0,0 +1,240 @@ +/** + * \file pkcs7.h + * + * \brief PKCS #7 generic defines and structures + * https://tools.ietf.org/html/rfc2315 + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +/** + * Note: For the time being, this implementation of the PKCS #7 cryptographic + * message syntax is a partial implementation of RFC 2315. + * Differences include: + * - The RFC specifies 6 different content types. The only type currently + * supported in Mbed TLS is the signed-data content type. + * - The only supported PKCS #7 Signed Data syntax version is version 1 + * - The RFC specifies support for BER. This implementation is limited to + * DER only. + * - The RFC specifies that multiple digest algorithms can be specified + * in the Signed Data type. Only one digest algorithm is supported in Mbed TLS. + * - The RFC specifies the Signed Data type can contain multiple X.509 or PKCS #6 extended + * certificates. In Mbed TLS, this list can only contain 0 or 1 certificates + * and they must be in X.509 format. + * - The RFC specifies the Signed Data type can contain + * certificate-revocation lists (CRLs). This implementation has no support + * for CRLs so it is assumed to be an empty list. + * - The RFC allows for SignerInfo structure to optionally contain + * unauthenticatedAttributes and authenticatedAttributes. In Mbed TLS it is + * assumed these fields are empty. + * - The RFC allows for the signed Data type to contain contentInfo. This + * implementation assumes the type is DATA and the content is empty. + */ + +#ifndef MBEDTLS_PKCS7_H +#define MBEDTLS_PKCS7_H + +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/asn1.h" +#include "mbedtls/x509_crt.h" + +/** + * \name PKCS #7 Module Error codes + * \{ + */ +#define MBEDTLS_ERR_PKCS7_INVALID_FORMAT -0x5300 /**< The format is invalid, e.g. different type expected. */ +#define MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE -0x5380 /**< Unavailable feature, e.g. anything other than signed data. */ +#define MBEDTLS_ERR_PKCS7_INVALID_VERSION -0x5400 /**< The PKCS #7 version element is invalid or cannot be parsed. */ +#define MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO -0x5480 /**< The PKCS #7 content info is invalid or cannot be parsed. */ +#define MBEDTLS_ERR_PKCS7_INVALID_ALG -0x5500 /**< The algorithm tag or value is invalid or cannot be parsed. */ +#define MBEDTLS_ERR_PKCS7_INVALID_CERT -0x5580 /**< The certificate tag or value is invalid or cannot be parsed. */ +#define MBEDTLS_ERR_PKCS7_INVALID_SIGNATURE -0x5600 /**< Error parsing the signature */ +#define MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO -0x5680 /**< Error parsing the signer's info */ +#define MBEDTLS_ERR_PKCS7_BAD_INPUT_DATA -0x5700 /**< Input invalid. */ +#define MBEDTLS_ERR_PKCS7_ALLOC_FAILED -0x5780 /**< Allocation of memory failed. */ +#define MBEDTLS_ERR_PKCS7_VERIFY_FAIL -0x5800 /**< Verification Failed */ +#define MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID -0x5880 /**< The PKCS #7 date issued/expired dates are invalid */ +/* \} name */ + +/** + * \name PKCS #7 Supported Version + * \{ + */ +#define MBEDTLS_PKCS7_SUPPORTED_VERSION 0x01 +/* \} name */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Type-length-value structure that allows for ASN.1 using DER. + */ +typedef mbedtls_asn1_buf mbedtls_pkcs7_buf; + +/** + * Container for ASN.1 named information objects. + * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.). + */ +typedef mbedtls_asn1_named_data mbedtls_pkcs7_name; + +/** + * Container for a sequence of ASN.1 items + */ +typedef mbedtls_asn1_sequence mbedtls_pkcs7_sequence; + +/** + * PKCS #7 types + */ +typedef enum { + MBEDTLS_PKCS7_NONE=0, + MBEDTLS_PKCS7_DATA, + MBEDTLS_PKCS7_SIGNED_DATA, + MBEDTLS_PKCS7_ENVELOPED_DATA, + MBEDTLS_PKCS7_SIGNED_AND_ENVELOPED_DATA, + MBEDTLS_PKCS7_DIGESTED_DATA, + MBEDTLS_PKCS7_ENCRYPTED_DATA, +} +mbedtls_pkcs7_type; + +/** + * Structure holding PKCS #7 signer info + */ +typedef struct mbedtls_pkcs7_signer_info { + int MBEDTLS_PRIVATE(version); + mbedtls_x509_buf MBEDTLS_PRIVATE(serial); + mbedtls_x509_name MBEDTLS_PRIVATE(issuer); + mbedtls_x509_buf MBEDTLS_PRIVATE(issuer_raw); + mbedtls_x509_buf MBEDTLS_PRIVATE(alg_identifier); + mbedtls_x509_buf MBEDTLS_PRIVATE(sig_alg_identifier); + mbedtls_x509_buf MBEDTLS_PRIVATE(sig); + struct mbedtls_pkcs7_signer_info *MBEDTLS_PRIVATE(next); +} +mbedtls_pkcs7_signer_info; + +/** + * Structure holding the signed data section + */ +typedef struct mbedtls_pkcs7_signed_data { + int MBEDTLS_PRIVATE(version); + mbedtls_pkcs7_buf MBEDTLS_PRIVATE(digest_alg_identifiers); + int MBEDTLS_PRIVATE(no_of_certs); + mbedtls_x509_crt MBEDTLS_PRIVATE(certs); + int MBEDTLS_PRIVATE(no_of_crls); + mbedtls_x509_crl MBEDTLS_PRIVATE(crl); + int MBEDTLS_PRIVATE(no_of_signers); + mbedtls_pkcs7_signer_info MBEDTLS_PRIVATE(signers); +} +mbedtls_pkcs7_signed_data; + +/** + * Structure holding PKCS #7 structure, only signed data for now + */ +typedef struct mbedtls_pkcs7 { + mbedtls_pkcs7_buf MBEDTLS_PRIVATE(raw); + mbedtls_pkcs7_signed_data MBEDTLS_PRIVATE(signed_data); +} +mbedtls_pkcs7; + +/** + * \brief Initialize mbedtls_pkcs7 structure. + * + * \param pkcs7 mbedtls_pkcs7 structure. + */ +void mbedtls_pkcs7_init(mbedtls_pkcs7 *pkcs7); + +/** + * \brief Parse a single DER formatted PKCS #7 detached signature. + * + * \param pkcs7 The mbedtls_pkcs7 structure to be filled by the parser. + * \param buf The buffer holding only the DER encoded PKCS #7 content. + * \param buflen The size in bytes of \p buf. The size must be exactly the + * length of the DER encoded PKCS #7 content. + * + * \note This function makes an internal copy of the PKCS #7 buffer + * \p buf. In particular, \p buf may be destroyed or reused + * after this call returns. + * \note Signatures with internal data are not supported. + * + * \return The \c mbedtls_pkcs7_type of \p buf, if successful. + * \return A negative error code on failure. + */ +int mbedtls_pkcs7_parse_der(mbedtls_pkcs7 *pkcs7, const unsigned char *buf, + const size_t buflen); + +/** + * \brief Verification of PKCS #7 signature against a caller-supplied + * certificate. + * + * For each signer in the PKCS structure, this function computes + * a signature over the supplied data, using the supplied + * certificate and the same digest algorithm as specified by the + * signer. It then compares this signature against the + * signer's signature; verification succeeds if any comparison + * matches. + * + * This function does not use the certificates held within the + * PKCS #7 structure itself, and does not check that the + * certificate is signed by a trusted certification authority. + * + * \param pkcs7 mbedtls_pkcs7 structure containing signature. + * \param cert Certificate containing key to verify signature. + * \param data Plain data on which signature has to be verified. + * \param datalen Length of the data. + * + * \note This function internally calculates the hash on the supplied + * plain data for signature verification. + * + * \return 0 if the signature verifies, or a negative error code on failure. + */ +int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7, + const mbedtls_x509_crt *cert, + const unsigned char *data, + size_t datalen); + +/** + * \brief Verification of PKCS #7 signature against a caller-supplied + * certificate. + * + * For each signer in the PKCS structure, this function + * validates a signature over the supplied hash, using the + * supplied certificate and the same digest algorithm as + * specified by the signer. Verification succeeds if any + * signature is good. + * + * This function does not use the certificates held within the + * PKCS #7 structure itself, and does not check that the + * certificate is signed by a trusted certification authority. + * + * \param pkcs7 PKCS #7 structure containing signature. + * \param cert Certificate containing key to verify signature. + * \param hash Hash of the plain data on which signature has to be verified. + * \param hashlen Length of the hash. + * + * \note This function is different from mbedtls_pkcs7_signed_data_verify() + * in that it is directly passed the hash of the data. + * + * \return 0 if the signature verifies, or a negative error code on failure. + */ +int mbedtls_pkcs7_signed_hash_verify(mbedtls_pkcs7 *pkcs7, + const mbedtls_x509_crt *cert, + const unsigned char *hash, size_t hashlen); + +/** + * \brief Unallocate all PKCS #7 data and zeroize the memory. + * It doesn't free \p pkcs7 itself. This should be done by the caller. + * + * \param pkcs7 mbedtls_pkcs7 structure to free. + */ +void mbedtls_pkcs7_free(mbedtls_pkcs7 *pkcs7); + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs7.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform.h new file mode 100644 index 00000000..f1ec9975 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform.h @@ -0,0 +1,516 @@ +/** + * \file platform.h + * + * \brief This file contains the definitions and functions of the + * Mbed TLS platform abstraction layer. + * + * The platform abstraction layer removes the need for the library + * to directly link to standard C library functions or operating + * system services, making the library easier to port and embed. + * Application developers and users of the library can provide their own + * implementations of these functions, or implementations specific to + * their platform, which can be statically linked to the library or + * dynamically configured at runtime. + * + * When all compilation options related to platform abstraction are + * disabled, this header just defines `mbedtls_xxx` function names + * as aliases to the standard `xxx` function. + * + * Most modules in the library and example programs are expected to + * include this header. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PLATFORM_H +#define MBEDTLS_PLATFORM_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +/* The older Microsoft Windows common runtime provides non-conforming + * implementations of some standard library functions, including snprintf + * and vsnprintf. This affects MSVC and MinGW builds. + */ +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900) +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF +#endif + +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#include +#include +#if defined(MBEDTLS_HAVE_TIME) +#include +#endif +#if !defined(MBEDTLS_PLATFORM_STD_SNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +#define MBEDTLS_PLATFORM_STD_SNPRINTF mbedtls_platform_win32_snprintf /**< The default \c snprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< The default \c snprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_VSNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#define MBEDTLS_PLATFORM_STD_VSNPRINTF mbedtls_platform_win32_vsnprintf /**< The default \c vsnprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_VSNPRINTF vsnprintf /**< The default \c vsnprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_PRINTF) +#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< The default \c printf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FPRINTF) +#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< The default \c fprintf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_CALLOC) +#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< The default \c calloc function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FREE) +#define MBEDTLS_PLATFORM_STD_FREE free /**< The default \c free function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_SETBUF) +#define MBEDTLS_PLATFORM_STD_SETBUF setbuf /**< The default \c setbuf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT) +#define MBEDTLS_PLATFORM_STD_EXIT exit /**< The default \c exit function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_TIME) +#define MBEDTLS_PLATFORM_STD_TIME time /**< The default \c time function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS /**< The default exit value to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE /**< The default exit value to use. */ +#endif +#if defined(MBEDTLS_FS_IO) +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) +#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_FILE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" +#endif +#endif /* MBEDTLS_FS_IO */ +#else /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) +#include MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ + +/* Enable certain documented defines only when generating doxygen to avoid + * an "unrecognized define" error. */ +#if defined(__DOXYGEN__) && !defined(MBEDTLS_PLATFORM_STD_CALLOC) +#define MBEDTLS_PLATFORM_STD_CALLOC +#endif + +#if defined(__DOXYGEN__) && !defined(MBEDTLS_PLATFORM_STD_FREE) +#define MBEDTLS_PLATFORM_STD_FREE +#endif + +/** \} name SECTION: Module settings */ + +/* + * The function pointers for calloc and free. + * Please see MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE + * in mbedtls_config.h for more information about behaviour and requirements. + */ +#if defined(MBEDTLS_PLATFORM_MEMORY) +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ + defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#undef mbedtls_free +#undef mbedtls_calloc +#define mbedtls_free MBEDTLS_PLATFORM_FREE_MACRO +#define mbedtls_calloc MBEDTLS_PLATFORM_CALLOC_MACRO +#else +/* For size_t */ +#include +extern void *mbedtls_calloc(size_t n, size_t size); +extern void mbedtls_free(void *ptr); + +/** + * \brief This function dynamically sets the memory-management + * functions used by the library, during runtime. + * + * \param calloc_func The \c calloc function implementation. + * \param free_func The \c free function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_calloc_free(void *(*calloc_func)(size_t, size_t), + void (*free_func)(void *)); +#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */ +#else /* !MBEDTLS_PLATFORM_MEMORY */ +#undef mbedtls_free +#undef mbedtls_calloc +#define mbedtls_free free +#define mbedtls_calloc calloc +#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */ + +/* + * The function pointers for fprintf + */ +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +/* We need FILE * */ +#include +extern int (*mbedtls_fprintf)(FILE *stream, const char *format, ...); + +/** + * \brief This function dynamically configures the fprintf + * function that is called when the + * mbedtls_fprintf() function is invoked by the library. + * + * \param fprintf_func The \c fprintf function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_fprintf(int (*fprintf_func)(FILE *stream, const char *, + ...)); +#else +#undef mbedtls_fprintf +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) +#define mbedtls_fprintf MBEDTLS_PLATFORM_FPRINTF_MACRO +#else +#define mbedtls_fprintf fprintf +#endif /* MBEDTLS_PLATFORM_FPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_FPRINTF_ALT */ + +/* + * The function pointers for printf + */ +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) +extern int (*mbedtls_printf)(const char *format, ...); + +/** + * \brief This function dynamically configures the snprintf + * function that is called when the mbedtls_snprintf() + * function is invoked by the library. + * + * \param printf_func The \c printf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_printf(int (*printf_func)(const char *, ...)); +#else /* !MBEDTLS_PLATFORM_PRINTF_ALT */ +#undef mbedtls_printf +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) +#define mbedtls_printf MBEDTLS_PLATFORM_PRINTF_MACRO +#else +#define mbedtls_printf printf +#endif /* MBEDTLS_PLATFORM_PRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_PRINTF_ALT */ + +/* + * The function pointers for snprintf + * + * The snprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +/* For Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_snprintf(char *s, size_t n, const char *fmt, ...); +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +extern int (*mbedtls_snprintf)(char *s, size_t n, const char *format, ...); + +/** + * \brief This function allows configuring a custom + * \c snprintf function pointer. + * + * \param snprintf_func The \c snprintf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_snprintf(int (*snprintf_func)(char *s, size_t n, + const char *format, ...)); +#else /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ +#undef mbedtls_snprintf +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define mbedtls_snprintf MBEDTLS_PLATFORM_SNPRINTF_MACRO +#else +#define mbedtls_snprintf MBEDTLS_PLATFORM_STD_SNPRINTF +#endif /* MBEDTLS_PLATFORM_SNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ + +/* + * The function pointers for vsnprintf + * + * The vsnprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#include +/* For Older Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_vsnprintf(char *s, size_t n, const char *fmt, va_list arg); +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) +#include +extern int (*mbedtls_vsnprintf)(char *s, size_t n, const char *format, va_list arg); + +/** + * \brief Set your own snprintf function pointer + * + * \param vsnprintf_func The \c vsnprintf function implementation + * + * \return \c 0 + */ +int mbedtls_platform_set_vsnprintf(int (*vsnprintf_func)(char *s, size_t n, + const char *format, va_list arg)); +#else /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ +#undef mbedtls_vsnprintf +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define mbedtls_vsnprintf MBEDTLS_PLATFORM_VSNPRINTF_MACRO +#else +#define mbedtls_vsnprintf vsnprintf +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ + +/* + * The function pointers for setbuf + */ +#if defined(MBEDTLS_PLATFORM_SETBUF_ALT) +#include +/** + * \brief Function pointer to call for `setbuf()` functionality + * (changing the internal buffering on stdio calls). + * + * \note The library calls this function to disable + * buffering when reading or writing sensitive data, + * to avoid having extra copies of sensitive data + * remaining in stdio buffers after the file is + * closed. If this is not a concern, for example if + * your platform's stdio doesn't have any buffering, + * you can set mbedtls_setbuf to a function that + * does nothing. + * + * The library always calls this function with + * `buf` equal to `NULL`. + */ +extern void (*mbedtls_setbuf)(FILE *stream, char *buf); + +/** + * \brief Dynamically configure the function that is called + * when the mbedtls_setbuf() function is called by the + * library. + * + * \param setbuf_func The \c setbuf function implementation + * + * \return \c 0 + */ +int mbedtls_platform_set_setbuf(void (*setbuf_func)( + FILE *stream, char *buf)); +#else +#undef mbedtls_setbuf +#if defined(MBEDTLS_PLATFORM_SETBUF_MACRO) +/** + * \brief Macro defining the function for the library to + * call for `setbuf` functionality (changing the + * internal buffering on stdio calls). + * + * \note See extra comments on the mbedtls_setbuf() function + * pointer above. + * + * \return \c 0 on success, negative on error. + */ +#define mbedtls_setbuf MBEDTLS_PLATFORM_SETBUF_MACRO +#else +#define mbedtls_setbuf setbuf +#endif /* MBEDTLS_PLATFORM_SETBUF_MACRO */ +#endif /* MBEDTLS_PLATFORM_SETBUF_ALT */ + +/* + * The function pointers for exit + */ +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) +extern void (*mbedtls_exit)(int status); + +/** + * \brief This function dynamically configures the exit + * function that is called when the mbedtls_exit() + * function is invoked by the library. + * + * \param exit_func The \c exit function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_exit(void (*exit_func)(int status)); +#else +#undef mbedtls_exit +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) +#define mbedtls_exit MBEDTLS_PLATFORM_EXIT_MACRO +#else +#define mbedtls_exit exit +#endif /* MBEDTLS_PLATFORM_EXIT_MACRO */ +#endif /* MBEDTLS_PLATFORM_EXIT_ALT */ + +/* + * The default exit values + */ +#if defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_EXIT_SUCCESS MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +#else +#define MBEDTLS_EXIT_SUCCESS 0 +#endif +#if defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_EXIT_FAILURE MBEDTLS_PLATFORM_STD_EXIT_FAILURE +#else +#define MBEDTLS_EXIT_FAILURE 1 +#endif + +#if defined(MBEDTLS_ENTROPY_C) && \ + !defined(MBEDTLS_NO_PLATFORM_ENTROPY) && \ + !(defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)) +/* Platforms where MBEDTLS_PLATFORM_DEV_RANDOM is used + * unless a dedicated system call is available both at + * compile time and at run time. */ +#define MBEDTLS_PLATFORM_HAVE_DEV_RANDOM +#endif + +#if !defined(MBEDTLS_PLATFORM_DEV_RANDOM) +#define MBEDTLS_PLATFORM_DEV_RANDOM "/dev/random" +#endif + +/* Arrange for mbedtls_platform_dev_random to always be visible to + * Doxygen, because it's linked from the documentation of + * MBEDTLS_PLATFORM_DEV_RANDOM and that documentation can be visible + * even in configurations where it isn't used. */ +#if defined(MBEDTLS_PLATFORM_HAVE_DEV_RANDOM) || defined(__DOXYGEN__) +/** + * Path to a special file that returns cryptographic-quality random bytes + * when read. + * + * This variable is only declared on platforms where it is used. + * It is available when the macro `MBEDTLS_PLATFORM_HAVE_DEV_RANDOM` is defined. + * + * The default value is #MBEDTLS_PLATFORM_DEV_RANDOM. + * See the documentation of this option for guidance. + */ +extern const char *mbedtls_platform_dev_random; +#endif + +/* + * The function pointers for reading from and writing a seed file to + * Non-Volatile storage (NV) in a platform-independent way + * + * Only enabled when the NV seed entropy source is enabled + */ +#if defined(MBEDTLS_ENTROPY_NV_SEED) +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) && defined(MBEDTLS_FS_IO) +/* Internal standard platform definitions */ +int mbedtls_platform_std_nv_seed_read(unsigned char *buf, size_t buf_len); +int mbedtls_platform_std_nv_seed_write(unsigned char *buf, size_t buf_len); +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +extern int (*mbedtls_nv_seed_read)(unsigned char *buf, size_t buf_len); +extern int (*mbedtls_nv_seed_write)(unsigned char *buf, size_t buf_len); + +/** + * \brief This function allows configuring custom seed file writing and + * reading functions. + * + * \param nv_seed_read_func The seed reading function implementation. + * \param nv_seed_write_func The seed writing function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_nv_seed( + int (*nv_seed_read_func)(unsigned char *buf, size_t buf_len), + int (*nv_seed_write_func)(unsigned char *buf, size_t buf_len) + ); +#else +#undef mbedtls_nv_seed_read +#undef mbedtls_nv_seed_write +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) && \ + defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) +#define mbedtls_nv_seed_read MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +#define mbedtls_nv_seed_write MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +#else +#define mbedtls_nv_seed_read mbedtls_platform_std_nv_seed_read +#define mbedtls_nv_seed_write mbedtls_platform_std_nv_seed_write +#endif +#endif /* MBEDTLS_PLATFORM_NV_SEED_ALT */ +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if !defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) + +/** + * \brief The platform context structure. + * + * \note This structure may be used to assist platform-specific + * setup or teardown operations. + */ +typedef struct mbedtls_platform_context { + char MBEDTLS_PRIVATE(dummy); /**< A placeholder member, as empty structs are not portable. */ +} +mbedtls_platform_context; + +#else +#include "platform_alt.h" +#endif /* !MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ + +/** + * \brief This function performs any platform-specific initialization + * operations. + * + * \note This function should be called before any other library functions. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + * \return \c 0 on success. + */ +int mbedtls_platform_setup(mbedtls_platform_context *ctx); +/** + * \brief This function performs any platform teardown operations. + * + * \note This function should be called after every other Mbed TLS module + * has been correctly freed using the appropriate free function. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + */ +void mbedtls_platform_teardown(mbedtls_platform_context *ctx); + +#ifdef __cplusplus +} +#endif + +#endif /* platform.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_time.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_time.h new file mode 100644 index 00000000..97f1963a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_time.h @@ -0,0 +1,79 @@ +/** + * \file platform_time.h + * + * \brief Mbed TLS Platform time abstraction + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PLATFORM_TIME_H +#define MBEDTLS_PLATFORM_TIME_H + +#include "mbedtls/build_info.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * The time_t datatype + */ +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) +typedef MBEDTLS_PLATFORM_TIME_TYPE_MACRO mbedtls_time_t; +#else +/* For time_t */ +#include +typedef time_t mbedtls_time_t; +#endif /* MBEDTLS_PLATFORM_TIME_TYPE_MACRO */ + +#if defined(MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO) +typedef MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO mbedtls_ms_time_t; +#else +#include +#include +typedef int64_t mbedtls_ms_time_t; +#endif /* MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO */ + +/** + * \brief Get time in milliseconds. + * + * \return Monotonically-increasing current time in milliseconds. + * + * \note Define MBEDTLS_PLATFORM_MS_TIME_ALT to be able to provide an + * alternative implementation + * + * \warning This function returns a monotonically-increasing time value from a + * start time that will differ from platform to platform, and possibly + * from run to run of the process. + * + */ +mbedtls_ms_time_t mbedtls_ms_time(void); + +/* + * The function pointers for time + */ +#if defined(MBEDTLS_PLATFORM_TIME_ALT) +extern mbedtls_time_t (*mbedtls_time)(mbedtls_time_t *time); + +/** + * \brief Set your own time function pointer + * + * \param time_func the time function implementation + * + * \return 0 + */ +int mbedtls_platform_set_time(mbedtls_time_t (*time_func)(mbedtls_time_t *time)); +#else +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) +#define mbedtls_time MBEDTLS_PLATFORM_TIME_MACRO +#else +#define mbedtls_time time +#endif /* MBEDTLS_PLATFORM_TIME_MACRO */ +#endif /* MBEDTLS_PLATFORM_TIME_ALT */ + +#ifdef __cplusplus +} +#endif + +#endif /* platform_time.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_util.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_util.h new file mode 100644 index 00000000..adad6bc3 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/platform_util.h @@ -0,0 +1,247 @@ +/** + * \file platform_util.h + * + * \brief Common and shared functions used by multiple modules in the Mbed TLS + * library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_PLATFORM_UTIL_H +#define MBEDTLS_PLATFORM_UTIL_H + +#include "mbedtls/build_info.h" + +#include +#if defined(MBEDTLS_HAVE_TIME_DATE) +#include "mbedtls/platform_time.h" +#include +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +extern "C" { +#endif + +/* Internal helper macros for deprecating API constants. */ +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +MBEDTLS_DEPRECATED typedef char const *mbedtls_deprecated_string_constant_t; +#define MBEDTLS_DEPRECATED_STRING_CONSTANT(VAL) \ + ((mbedtls_deprecated_string_constant_t) (VAL)) +MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT(VAL) \ + ((mbedtls_deprecated_numeric_constant_t) (VAL)) +#else /* MBEDTLS_DEPRECATED_WARNING */ +#define MBEDTLS_DEPRECATED +#define MBEDTLS_DEPRECATED_STRING_CONSTANT(VAL) VAL +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT(VAL) VAL +#endif /* MBEDTLS_DEPRECATED_WARNING */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/* Implementation of the check-return facility. + * See the user documentation in mbedtls_config.h. + * + * Do not use this macro directly to annotate function: instead, + * use one of MBEDTLS_CHECK_RETURN_CRITICAL or MBEDTLS_CHECK_RETURN_TYPICAL + * depending on how important it is to check the return value. + */ +#if !defined(MBEDTLS_CHECK_RETURN) +#if defined(__GNUC__) +#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) +#elif defined(_MSC_VER) && _MSC_VER >= 1700 +#include +#define MBEDTLS_CHECK_RETURN _Check_return_ +#else +#define MBEDTLS_CHECK_RETURN +#endif +#endif + +/** Critical-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be checked in all applications. + * Omitting the check is very likely to indicate a bug in the application + * and will result in a compile-time warning if #MBEDTLS_CHECK_RETURN + * is implemented for the compiler in use. + * + * \note The use of this macro is a work in progress. + * This macro may be added to more functions in the future. + * Such an extension is not considered an API break, provided that + * there are near-unavoidable circumstances under which the function + * can fail. For example, signature/MAC/AEAD verification functions, + * and functions that require a random generator, are considered + * return-check-critical. + */ +#define MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN + +/** Ordinary-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be generally be checked in portable + * applications. Omitting the check will result in a compile-time warning if + * #MBEDTLS_CHECK_RETURN is implemented for the compiler in use and + * #MBEDTLS_CHECK_RETURN_WARNING is enabled in the compile-time configuration. + * + * You can use #MBEDTLS_IGNORE_RETURN to explicitly ignore the return value + * of a function that is annotated with #MBEDTLS_CHECK_RETURN. + * + * \note The use of this macro is a work in progress. + * This macro will be added to more functions in the future. + * Eventually this should appear before most functions returning + * an error code (as \c int in the \c mbedtls_xxx API or + * as ::psa_status_t in the \c psa_xxx API). + */ +#if defined(MBEDTLS_CHECK_RETURN_WARNING) +#define MBEDTLS_CHECK_RETURN_TYPICAL MBEDTLS_CHECK_RETURN +#else +#define MBEDTLS_CHECK_RETURN_TYPICAL +#endif + +/** Benign-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that it is rarely useful to check its return value. + * + * This macro has an empty expansion. It exists for documentation purposes: + * a #MBEDTLS_CHECK_RETURN_OPTIONAL annotation indicates that the function + * has been analyzed for return-check usefulness, whereas the lack of + * an annotation indicates that the function has not been analyzed and its + * return-check usefulness is unknown. + */ +#define MBEDTLS_CHECK_RETURN_OPTIONAL + +/** \def MBEDTLS_IGNORE_RETURN + * + * Call this macro with one argument, a function call, to suppress a warning + * from #MBEDTLS_CHECK_RETURN due to that function call. + */ +#if !defined(MBEDTLS_IGNORE_RETURN) +/* GCC doesn't silence the warning with just (void)(result). + * (void)!(result) is known to work up at least up to GCC 10, as well + * as with Clang and MSVC. + * + * https://gcc.gnu.org/onlinedocs/gcc-3.4.6/gcc/Non_002dbugs.html + * https://stackoverflow.com/questions/40576003/ignoring-warning-wunused-result + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425#c34 + */ +#define MBEDTLS_IGNORE_RETURN(result) ((void) !(result)) +#endif + +/* If the following macro is defined, the library is being built by the test + * framework, and the framework is going to provide a replacement + * mbedtls_platform_zeroize() using a preprocessor macro, so the function + * declaration should be omitted. */ +#if !defined(MBEDTLS_TEST_DEFINES_ZEROIZE) //no-check-names +/** + * \brief Securely zeroize a buffer + * + * The function is meant to wipe the data contained in a buffer so + * that it can no longer be recovered even if the program memory + * is later compromised. Call this function on sensitive data + * stored on the stack before returning from a function, and on + * sensitive data stored on the heap before freeing the heap + * object. + * + * It is extremely difficult to guarantee that calls to + * mbedtls_platform_zeroize() are not removed by aggressive + * compiler optimizations in a portable way. For this reason, Mbed + * TLS provides the configuration option + * MBEDTLS_PLATFORM_ZEROIZE_ALT, which allows users to configure + * mbedtls_platform_zeroize() to use a suitable implementation for + * their platform and needs + * + * \param buf Buffer to be zeroized + * \param len Length of the buffer in bytes + * + */ +void mbedtls_platform_zeroize(void *buf, size_t len); +#endif + +/** \brief The type of custom random generator (RNG) callbacks. + * + * Many Mbed TLS functions take two parameters + * `mbedtls_f_rng_t *f_rng, void *p_rng`. The + * library will call \c f_rng to generate + * random values. + * + * \note This is typically one of the following: + * - mbedtls_ctr_drbg_random() with \c p_rng + * pointing to a #mbedtls_ctr_drbg_context; + * - mbedtls_hmac_drbg_random() with \c p_rng + * pointing to a #mbedtls_hmac_drbg_context; + * - mbedtls_psa_get_random() with + * `prng = MBEDTLS_PSA_RANDOM_STATE`. + * + * \note Generally, given a call + * `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback + * and the context only need to remain valid until + * the call to `mbedtls_foo` returns. However, there + * are a few exceptions where the callback is stored + * in for future use. Check the documentation of + * the calling function. + * + * \warning In a multithreaded environment, calling the + * function should be thread-safe. The standard + * functions provided by the library are thread-safe + * when #MBEDTLS_THREADING_C is enabled. + * + * \warning This function must either provide as many + * bytes as requested of **cryptographic quality** + * random data, or return a negative error code. + * + * \param p_rng The \c p_rng argument that was passed along \c f_rng. + * The library always passes \c p_rng unchanged. + * This is typically a pointer to the random generator + * state, or \c NULL if the custom random generator + * doesn't need a context-specific state. + * \param[out] output On success, this must be filled with \p output_size + * bytes of cryptographic-quality random data. + * \param output_size The number of bytes to output. + * + * \return \c 0 on success, or a negative error code on failure. + * Library functions will generally propagate this + * error code, so \c MBEDTLS_ERR_xxx values are + * recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is + * typically sensible for RNG failures. + */ +typedef int mbedtls_f_rng_t(void *p_rng, + unsigned char *output, size_t output_size); + +#if defined(MBEDTLS_HAVE_TIME_DATE) +/** + * \brief Platform-specific implementation of gmtime_r() + * + * The function is a thread-safe abstraction that behaves + * similarly to the gmtime_r() function from Unix/POSIX. + * + * Mbed TLS will try to identify the underlying platform and + * make use of an appropriate underlying implementation (e.g. + * gmtime_r() for POSIX and gmtime_s() for Windows). If this is + * not possible, then gmtime() will be used. In this case, calls + * from the library to gmtime() will be guarded by the mutex + * mbedtls_threading_gmtime_mutex if MBEDTLS_THREADING_C is + * enabled. It is recommended that calls from outside the library + * are also guarded by this mutex. + * + * If MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, then Mbed TLS will + * unconditionally use the alternative implementation for + * mbedtls_platform_gmtime_r() supplied by the user at compile time. + * + * \param tt Pointer to an object containing time (in seconds) since the + * epoch to be converted + * \param tm_buf Pointer to an object where the results will be stored + * + * \return Pointer to an object of type struct tm on success, otherwise + * NULL + */ +struct tm *mbedtls_platform_gmtime_r(const mbedtls_time_t *tt, + struct tm *tm_buf); +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PLATFORM_UTIL_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/poly1305.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/poly1305.h new file mode 100644 index 00000000..61bcaa6b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/poly1305.h @@ -0,0 +1,168 @@ +/** + * \file poly1305.h + * + * \brief This file contains Poly1305 definitions and functions. + * + * Poly1305 is a one-time message authenticator that can be used to + * authenticate messages. Poly1305-AES was created by Daniel + * Bernstein https://cr.yp.to/mac/poly1305-20050329.pdf The generic + * Poly1305 algorithm (not tied to AES) was also standardized in RFC + * 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_POLY1305_H +#define MBEDTLS_POLY1305_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_POLY1305_ALT) + +typedef struct mbedtls_poly1305_context { + uint32_t MBEDTLS_PRIVATE(r)[4]; /** The value for 'r' (low 128 bits of the key). */ + uint32_t MBEDTLS_PRIVATE(s)[4]; /** The value for 's' (high 128 bits of the key). */ + uint32_t MBEDTLS_PRIVATE(acc)[5]; /** The accumulator number. */ + uint8_t MBEDTLS_PRIVATE(queue)[16]; /** The current partial block of data. */ + size_t MBEDTLS_PRIVATE(queue_len); /** The number of bytes stored in 'queue'. */ +} +mbedtls_poly1305_context; + +#else /* MBEDTLS_POLY1305_ALT */ +#include "poly1305_alt.h" +#endif /* MBEDTLS_POLY1305_ALT */ + +/** + * \brief This function initializes the specified Poly1305 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by a call to + * \c mbedtls_poly1305_starts(), then one or more calls to + * \c mbedtls_poly1305_update(), then one call to + * \c mbedtls_poly1305_finish(), then finally + * \c mbedtls_poly1305_free(). + * + * \param ctx The Poly1305 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_poly1305_init(mbedtls_poly1305_context *ctx); + +/** + * \brief This function releases and clears the specified + * Poly1305 context. + * + * \param ctx The Poly1305 context to clear. This may be \c NULL, in which + * case this function is a no-op. If it is not \c NULL, it must + * point to an initialized Poly1305 context. + */ +void mbedtls_poly1305_free(mbedtls_poly1305_context *ctx); + +/** + * \brief This function sets the one-time authentication key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param ctx The Poly1305 context to which the key should be bound. + * This must be initialized. + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_starts(mbedtls_poly1305_context *ctx, + const unsigned char key[32]); + +/** + * \brief This functions feeds an input buffer into an ongoing + * Poly1305 computation. + * + * It is called between \c mbedtls_cipher_poly1305_starts() and + * \c mbedtls_cipher_poly1305_finish(). + * It can be called repeatedly to process a stream of data. + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_update(mbedtls_poly1305_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief This function generates the Poly1305 Message + * Authentication Code (MAC). + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param mac The buffer to where the MAC is written. This must + * be a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_finish(mbedtls_poly1305_context *ctx, + unsigned char mac[16]); + +/** + * \brief This function calculates the Poly1305 MAC of the input + * buffer with the provided key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * \param mac The buffer to where the MAC is written. This must be + * a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_mac(const unsigned char key[32], + const unsigned char *input, + size_t ilen, + unsigned char mac[16]); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_poly1305_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_POLY1305_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/private_access.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/private_access.h new file mode 100644 index 00000000..580f3eb4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/private_access.h @@ -0,0 +1,20 @@ +/** + * \file private_access.h + * + * \brief Macro wrapper for struct's members. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_PRIVATE_ACCESS_H +#define MBEDTLS_PRIVATE_ACCESS_H + +#ifndef MBEDTLS_ALLOW_PRIVATE_ACCESS +#define MBEDTLS_PRIVATE(member) private_##member +#else +#define MBEDTLS_PRIVATE(member) member +#endif + +#endif /* MBEDTLS_PRIVATE_ACCESS_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/psa_util.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/psa_util.h new file mode 100644 index 00000000..b898f1f8 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/psa_util.h @@ -0,0 +1,207 @@ +/** + * \file psa_util.h + * + * \brief Utility functions for the use of the PSA Crypto library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_PSA_UTIL_H +#define MBEDTLS_PSA_UTIL_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "psa/crypto.h" + +/* ASN1 defines used in the ECDSA conversion functions. + * Note: intentionally not adding MBEDTLS_ASN1_[PARSE|WRITE]_C guards here + * otherwise error codes would be unknown in test_suite_psa_crypto_util.data.*/ +#include + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) + +/** The random generator function for the PSA subsystem. + * + * This function is suitable as the `f_rng` random generator function + * parameter of many `mbedtls_xxx` functions. + * + * The implementation of this function depends on the configuration of the + * library. + * + * \note This function may only be used if the PSA crypto subsystem is active. + * This means that you must call psa_crypto_init() before any call to + * this function, and you must not call this function after calling + * mbedtls_psa_crypto_free(). + * + * \param p_rng This parameter is only kept for backward compatibility + * reasons with legacy `f_rng` functions and it's ignored. + * Set to #MBEDTLS_PSA_RANDOM_STATE or NULL. + * \param output The buffer to fill. It must have room for + * \c output_size bytes. + * \param output_size The number of bytes to write to \p output. + * This function may fail if \p output_size is too + * large. It is guaranteed to accept any output size + * requested by Mbed TLS library functions. The + * maximum request size depends on the library + * configuration. + * + * \return \c 0 on success. + * \return An `MBEDTLS_ERR_ENTROPY_xxx`, + * `MBEDTLS_ERR_PLATFORM_xxx, + * `MBEDTLS_ERR_CTR_DRBG_xxx` or + * `MBEDTLS_ERR_HMAC_DRBG_xxx` on error. + */ +int mbedtls_psa_get_random(void *p_rng, + unsigned char *output, + size_t output_size); + +/** The random generator state for the PSA subsystem. + * + * This macro always expands to NULL because the `p_rng` parameter is unused + * in mbedtls_psa_get_random(), but it's kept for interface's backward + * compatibility. + */ +#define MBEDTLS_PSA_RANDOM_STATE NULL + +/** \defgroup psa_tls_helpers TLS helper functions + * @{ + */ +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +#include + +/** Convert an ECC curve identifier from the Mbed TLS encoding to PSA. + * + * \param grpid An Mbed TLS elliptic curve identifier + * (`MBEDTLS_ECP_DP_xxx`). + * \param[out] bits On success the bit size of the curve; 0 on failure. + * + * \return If the curve is supported in the PSA API, this function + * returns the proper PSA curve identifier + * (`PSA_ECC_FAMILY_xxx`). This holds even if the curve is + * not supported by the ECP module. + * \return \c 0 if the curve is not supported in the PSA API. + */ +psa_ecc_family_t mbedtls_ecc_group_to_psa(mbedtls_ecp_group_id grpid, + size_t *bits); + +/** Convert an ECC curve identifier from the PSA encoding to Mbed TLS. + * + * \param family A PSA elliptic curve family identifier + * (`PSA_ECC_FAMILY_xxx`). + * \param bits The bit-length of a private key on \p curve. + * + * \return If the curve is supported in the PSA API, this function + * returns the corresponding Mbed TLS elliptic curve + * identifier (`MBEDTLS_ECP_DP_xxx`). + * \return #MBEDTLS_ECP_DP_NONE if the combination of \c curve + * and \p bits is not supported. + */ +mbedtls_ecp_group_id mbedtls_ecc_group_from_psa(psa_ecc_family_t family, + size_t bits); +#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ + +/** + * \brief This function returns the PSA algorithm identifier + * associated with the given digest type. + * + * \param md_type The type of digest to search for. Must not be NONE. + * + * \warning If \p md_type is \c MBEDTLS_MD_NONE, this function will + * not return \c PSA_ALG_NONE, but an invalid algorithm. + * + * \warning This function does not check if the algorithm is + * supported, it always returns the corresponding identifier. + * + * \return The PSA algorithm identifier associated with \p md_type, + * regardless of whether it is supported or not. + */ +static inline psa_algorithm_t mbedtls_md_psa_alg_from_type(mbedtls_md_type_t md_type) +{ + return PSA_ALG_CATEGORY_HASH | (psa_algorithm_t) md_type; +} + +/** + * \brief This function returns the given digest type + * associated with the PSA algorithm identifier. + * + * \param psa_alg The PSA algorithm identifier to search for. + * + * \warning This function does not check if the algorithm is + * supported, it always returns the corresponding identifier. + * + * \return The MD type associated with \p psa_alg, + * regardless of whether it is supported or not. + */ +static inline mbedtls_md_type_t mbedtls_md_type_from_psa_alg(psa_algorithm_t psa_alg) +{ + return (mbedtls_md_type_t) (psa_alg & PSA_ALG_HASH_MASK); +} +#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */ + +#if defined(MBEDTLS_PSA_UTIL_HAVE_ECDSA) + +/** Convert an ECDSA signature from raw format to DER ASN.1 format. + * + * \param bits Size of each coordinate in bits. + * \param raw Buffer that contains the signature in raw format. + * \param raw_len Length of \p raw in bytes. This must be + * PSA_BITS_TO_BYTES(bits) bytes. + * \param[out] der Buffer that will be filled with the converted DER + * output. It can overlap with raw buffer. + * \param der_size Size of \p der in bytes. It is enough if \p der_size + * is at least the size of the actual output. (The size + * of the output can vary depending on the presence of + * leading zeros in the data.) You can use + * #MBEDTLS_ECDSA_MAX_SIG_LEN(\p bits) to determine a + * size that is large enough for all signatures for a + * given value of \p bits. + * \param[out] der_len On success it contains the amount of valid data + * (in bytes) written to \p der. It's undefined + * in case of failure. + * + * \note The behavior is undefined if \p der is null, + * even if \p der_size is 0. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if \p der_size + * is too small or if \p bits is larger than the + * largest supported curve. + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if one of the + * numbers in the signature is 0. + */ +int mbedtls_ecdsa_raw_to_der(size_t bits, const unsigned char *raw, size_t raw_len, + unsigned char *der, size_t der_size, size_t *der_len); + +/** Convert an ECDSA signature from DER ASN.1 format to raw format. + * + * \param bits Size of each coordinate in bits. + * \param der Buffer that contains the signature in DER format. + * \param der_len Size of \p der in bytes. + * \param[out] raw Buffer that will be filled with the converted raw + * signature. It can overlap with der buffer. + * \param raw_size Size of \p raw in bytes. Must be at least + * 2 * PSA_BITS_TO_BYTES(bits) bytes. + * \param[out] raw_len On success it is updated with the amount of valid + * data (in bytes) written to \p raw. It's undefined + * in case of failure. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if \p raw_size + * is too small or if \p bits is larger than the + * largest supported curve. + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if the data in + * \p der is inconsistent with \p bits. + * \return An \c MBEDTLS_ERR_ASN1_xxx error code if + * \p der is malformed. + */ +int mbedtls_ecdsa_der_to_raw(size_t bits, const unsigned char *der, size_t der_len, + unsigned char *raw, size_t raw_size, size_t *raw_len); + +#endif /* MBEDTLS_PSA_UTIL_HAVE_ECDSA */ + +/**@}*/ + +#endif /* MBEDTLS_PSA_UTIL_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ripemd160.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ripemd160.h new file mode 100644 index 00000000..279f92b5 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ripemd160.h @@ -0,0 +1,136 @@ +/** + * \file ripemd160.h + * + * \brief RIPE MD-160 message digest + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_RIPEMD160_H +#define MBEDTLS_RIPEMD160_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RIPEMD160_ALT) +// Regular implementation +// + +/** + * \brief RIPEMD-160 context structure + */ +typedef struct mbedtls_ripemd160_context { + uint32_t MBEDTLS_PRIVATE(total)[2]; /*!< number of bytes processed */ + uint32_t MBEDTLS_PRIVATE(state)[5]; /*!< intermediate digest state */ + unsigned char MBEDTLS_PRIVATE(buffer)[64]; /*!< data block being processed */ +} +mbedtls_ripemd160_context; + +#else /* MBEDTLS_RIPEMD160_ALT */ +#include "ripemd160_alt.h" +#endif /* MBEDTLS_RIPEMD160_ALT */ + +/** + * \brief Initialize RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be initialized + */ +void mbedtls_ripemd160_init(mbedtls_ripemd160_context *ctx); + +/** + * \brief Clear RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be cleared + */ +void mbedtls_ripemd160_free(mbedtls_ripemd160_context *ctx); + +/** + * \brief Clone (the state of) a RIPEMD-160 context + * + * \param dst The destination context + * \param src The context to be cloned + */ +void mbedtls_ripemd160_clone(mbedtls_ripemd160_context *dst, + const mbedtls_ripemd160_context *src); + +/** + * \brief RIPEMD-160 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + */ +int mbedtls_ripemd160_starts(mbedtls_ripemd160_context *ctx); + +/** + * \brief RIPEMD-160 process buffer + * + * \param ctx RIPEMD-160 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + */ +int mbedtls_ripemd160_update(mbedtls_ripemd160_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief RIPEMD-160 final digest + * + * \param ctx RIPEMD-160 context + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160_finish(mbedtls_ripemd160_context *ctx, + unsigned char output[20]); + +/** + * \brief RIPEMD-160 process data block (internal use only) + * + * \param ctx RIPEMD-160 context + * \param data buffer holding one block of data + * + * \return 0 if successful + */ +int mbedtls_internal_ripemd160_process(mbedtls_ripemd160_context *ctx, + const unsigned char data[64]); + +/** + * \brief Output = RIPEMD-160( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160(const unsigned char *input, + size_t ilen, + unsigned char output[20]); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_ripemd160_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_ripemd160.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/rsa.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/rsa.h new file mode 100644 index 00000000..3f0881a4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/rsa.h @@ -0,0 +1,1164 @@ +/** + * \file rsa.h + * + * \brief This file provides an API for the RSA public-key cryptosystem. + * + * The RSA public-key cryptosystem is defined in Public-Key + * Cryptography Standards (PKCS) #1 v1.5: RSA Encryption + * and Public-Key Cryptography Standards (PKCS) #1 v2.1: + * RSA Cryptography Specifications. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_RSA_H +#define MBEDTLS_RSA_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/bignum.h" +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * RSA Error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100 +/** Something failed during generation of a key. */ +#define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180 +/** Key failed to pass the validity check of the library. */ +#define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200 +/** The public key operation failed. */ +#define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280 +/** The private key operation failed. */ +#define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300 +/** The PKCS#1 verification failed. */ +#define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380 +/** The output buffer for decryption is not large enough. */ +#define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 +/** The random generator failed to generate non-zeros. */ +#define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480 + +/* + * RSA constants + */ + +#define MBEDTLS_RSA_PKCS_V15 0 /**< Use PKCS#1 v1.5 encoding. */ +#define MBEDTLS_RSA_PKCS_V21 1 /**< Use PKCS#1 v2.1 encoding. */ + +#define MBEDTLS_RSA_SIGN 1 /**< Identifier for RSA signature operations. */ +#define MBEDTLS_RSA_CRYPT 2 /**< Identifier for RSA encryption and decryption operations. */ + +#define MBEDTLS_RSA_SALT_LEN_ANY -1 + +/* + * The above constants may be used even if the RSA module is compile out, + * eg for alternative (PKCS#11) RSA implementations in the PK layers. + */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RSA_ALT) +// Regular implementation +// + +#if !defined(MBEDTLS_RSA_GEN_KEY_MIN_BITS) +#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 +#elif MBEDTLS_RSA_GEN_KEY_MIN_BITS < 128 +#error "MBEDTLS_RSA_GEN_KEY_MIN_BITS must be at least 128 bits" +#endif + +/** + * \brief The RSA context structure. + */ +typedef struct mbedtls_rsa_context { + int MBEDTLS_PRIVATE(ver); /*!< Reserved for internal purposes. + * Do not set this field in application + * code. Its meaning might change without + * notice. */ + size_t MBEDTLS_PRIVATE(len); /*!< The size of \p N in Bytes. */ + + mbedtls_mpi MBEDTLS_PRIVATE(N); /*!< The public modulus. */ + mbedtls_mpi MBEDTLS_PRIVATE(E); /*!< The public exponent. */ + + mbedtls_mpi MBEDTLS_PRIVATE(D); /*!< The private exponent. */ + mbedtls_mpi MBEDTLS_PRIVATE(P); /*!< The first prime factor. */ + mbedtls_mpi MBEDTLS_PRIVATE(Q); /*!< The second prime factor. */ + + mbedtls_mpi MBEDTLS_PRIVATE(DP); /*!< D % (P - 1). */ + mbedtls_mpi MBEDTLS_PRIVATE(DQ); /*!< D % (Q - 1). */ + mbedtls_mpi MBEDTLS_PRIVATE(QP); /*!< 1 / (Q % P). */ + + mbedtls_mpi MBEDTLS_PRIVATE(RN); /*!< cached R^2 mod N. */ + + mbedtls_mpi MBEDTLS_PRIVATE(RP); /*!< cached R^2 mod P. */ + mbedtls_mpi MBEDTLS_PRIVATE(RQ); /*!< cached R^2 mod Q. */ + + mbedtls_mpi MBEDTLS_PRIVATE(Vi); /*!< The cached blinding value. */ + mbedtls_mpi MBEDTLS_PRIVATE(Vf); /*!< The cached un-blinding value. */ + + int MBEDTLS_PRIVATE(padding); /*!< Selects padding mode: + #MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + #MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. */ + int MBEDTLS_PRIVATE(hash_id); /*!< Hash identifier of mbedtls_md_type_t type, + as specified in md.h for use in the MGF + mask generating function used in the + EME-OAEP and EMSA-PSS encodings. */ +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized iff ver != 0. */ + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); /*!< Thread-safety mutex. */ +#endif +} +mbedtls_rsa_context; + +#else /* MBEDTLS_RSA_ALT */ +#include "rsa_alt.h" +#endif /* MBEDTLS_RSA_ALT */ + +/** + * \brief This function initializes an RSA context. + * + * \note This function initializes the padding and the hash + * identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + * #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + * information about those parameters. + * + * \param ctx The RSA context to initialize. This must not be \c NULL. + */ +void mbedtls_rsa_init(mbedtls_rsa_context *ctx); + +/** + * \brief This function sets padding for an already initialized RSA + * context. + * + * \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + * encryption scheme and the RSASSA-PSS signature scheme. + * + * \note The \p hash_id parameter is ignored when using + * #MBEDTLS_RSA_PKCS_V15 padding. + * + * \note The choice of padding mode is strictly enforced for private + * key operations, since there might be security concerns in + * mixing padding modes. For public key operations it is + * a default value, which can be overridden by calling specific + * \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + * functions. + * + * \note The hash selected in \p hash_id is always used for OEAP + * encryption. For PSS signatures, it is always used for + * making signatures, but can be overridden for verifying them. + * If set to #MBEDTLS_MD_NONE, it is always overridden. + * + * \param ctx The initialized RSA context to be configured. + * \param padding The padding mode to use. This must be either + * #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + * \param hash_id The hash identifier for PSS or OAEP, if \p padding is + * #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + * function but may be not suitable for some operations. + * Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + * \p padding or \p hash_id is invalid. + */ +int mbedtls_rsa_set_padding(mbedtls_rsa_context *ctx, int padding, + mbedtls_md_type_t hash_id); + +/** + * \brief This function retrieves padding mode of initialized + * RSA context. + * + * \param ctx The initialized RSA context. + * + * \return RSA padding mode. + * + */ +int mbedtls_rsa_get_padding_mode(const mbedtls_rsa_context *ctx); + +/** + * \brief This function retrieves hash identifier of mbedtls_md_type_t + * type. + * + * \param ctx The initialized RSA context. + * + * \return Hash identifier of mbedtls_md_type_t type. + * + */ +int mbedtls_rsa_get_md_alg(const mbedtls_rsa_context *ctx); + +/** + * \brief This function imports a set of core parameters into an + * RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param D The private exponent. This may be \c NULL. + * \param E The public exponent. This may be \c NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import(mbedtls_rsa_context *ctx, + const mbedtls_mpi *N, + const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, const mbedtls_mpi *E); + +/** + * \brief This function imports core RSA parameters, in raw big-endian + * binary format, into an RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + * \param D The private exponent. This may be \c NULL. + * \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + * \param E The public exponent. This may be \c NULL. + * \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import_raw(mbedtls_rsa_context *ctx, + unsigned char const *N, size_t N_len, + unsigned char const *P, size_t P_len, + unsigned char const *Q, size_t Q_len, + unsigned char const *D, size_t D_len, + unsigned char const *E, size_t E_len); + +/** + * \brief This function completes an RSA context from + * a set of imported core parameters. + * + * To setup an RSA public key, precisely \c N and \c E + * must have been imported. + * + * To setup an RSA private key, sufficient information must + * be present for the other parameters to be derivable. + * + * The default implementation supports the following: + *
  • Derive \c P, \c Q from \c N, \c D, \c E.
    • + *
  • Derive \c N, \c D from \c P, \c Q, \c E.
+ * Alternative implementations need not support these. + * + * If this function runs successfully, it guarantees that + * the RSA context can be used for RSA operations without + * the risk of failure or crash. + * + * \warning This function need not perform consistency checks + * for the imported parameters. In particular, parameters that + * are not needed by the implementation might be silently + * discarded and left unchecked. To check the consistency + * of the key material, see mbedtls_rsa_check_privkey(). + * + * \param ctx The initialized RSA context holding imported parameters. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + * failed. + * + */ +int mbedtls_rsa_complete(mbedtls_rsa_context *ctx); + +/** + * \brief This function exports the core parameters of an RSA key. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * + * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \param ctx The initialized RSA context. + * \param N The MPI to hold the RSA modulus. + * This may be \c NULL if this field need not be exported. + * \param P The MPI to hold the first prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param Q The MPI to hold the second prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param D The MPI to hold the private exponent. + * This may be \c NULL if this field need not be exported. + * \param E The MPI to hold the public exponent. + * This may be \c NULL if this field need not be exported. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + * + */ +int mbedtls_rsa_export(const mbedtls_rsa_context *ctx, + mbedtls_mpi *N, mbedtls_mpi *P, mbedtls_mpi *Q, + mbedtls_mpi *D, mbedtls_mpi *E); + +/** + * \brief This function exports core parameters of an RSA key + * in raw big-endian binary format. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \note The length parameters are ignored if the corresponding + * buffer pointers are NULL. + * + * \param ctx The initialized RSA context. + * \param N The Byte array to store the RSA modulus, + * or \c NULL if this field need not be exported. + * \param N_len The size of the buffer for the modulus. + * \param P The Byte array to hold the first prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param P_len The size of the buffer for the first prime factor. + * \param Q The Byte array to hold the second prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param Q_len The size of the buffer for the second prime factor. + * \param D The Byte array to hold the private exponent, + * or \c NULL if this field need not be exported. + * \param D_len The size of the buffer for the private exponent. + * \param E The Byte array to hold the public exponent, + * or \c NULL if this field need not be exported. + * \param E_len The size of the buffer for the public exponent. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + */ +int mbedtls_rsa_export_raw(const mbedtls_rsa_context *ctx, + unsigned char *N, size_t N_len, + unsigned char *P, size_t P_len, + unsigned char *Q, size_t Q_len, + unsigned char *D, size_t D_len, + unsigned char *E, size_t E_len); + +/** + * \brief This function exports CRT parameters of a private RSA key. + * + * \note Alternative RSA implementations not using CRT-parameters + * internally can implement this function based on + * mbedtls_rsa_deduce_opt(). + * + * \param ctx The initialized RSA context. + * \param DP The MPI to hold \c D modulo `P-1`, + * or \c NULL if it need not be exported. + * \param DQ The MPI to hold \c D modulo `Q-1`, + * or \c NULL if it need not be exported. + * \param QP The MPI to hold modular inverse of \c Q modulo \c P, + * or \c NULL if it need not be exported. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + * + */ +int mbedtls_rsa_export_crt(const mbedtls_rsa_context *ctx, + mbedtls_mpi *DP, mbedtls_mpi *DQ, mbedtls_mpi *QP); + +/** + * \brief This function retrieves the length of the RSA modulus in bits. + * + * \param ctx The initialized RSA context. + * + * \return The length of the RSA modulus in bits. + * + */ +size_t mbedtls_rsa_get_bitlen(const mbedtls_rsa_context *ctx); + +/** + * \brief This function retrieves the length of RSA modulus in Bytes. + * + * \param ctx The initialized RSA context. + * + * \return The length of the RSA modulus in Bytes. + * + */ +size_t mbedtls_rsa_get_len(const mbedtls_rsa_context *ctx); + +/** + * \brief This function generates an RSA keypair. + * + * \note mbedtls_rsa_init() must be called before this function, + * to set up the RSA context. + * + * \param ctx The initialized RSA context used to hold the key. + * \param f_rng The RNG function to be used for key generation. + * This is mandatory and must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't need a context. + * \param nbits The size of the public key in bits. + * \param exponent The public exponent to use. For example, \c 65537. + * This must be odd and greater than \c 1. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_gen_key(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + unsigned int nbits, int exponent); + +/** + * \brief This function checks if a context contains at least an RSA + * public key. + * + * If the function runs successfully, it is guaranteed that + * enough information is present to perform an RSA public key + * operation using mbedtls_rsa_public(). + * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_check_pubkey(const mbedtls_rsa_context *ctx); + +/** + * \brief This function checks if a context contains an RSA private key + * and perform basic consistency checks. + * + * \note The consistency checks performed by this function not only + * ensure that mbedtls_rsa_private() can be called successfully + * on the given context, but that the various parameters are + * mutually consistent with high probability, in the sense that + * mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + * + * \warning This function should catch accidental misconfigurations + * like swapping of parameters, but it cannot establish full + * trust in neither the quality nor the consistency of the key + * material that was used to setup the given RSA context: + *
  • Consistency: Imported parameters that are irrelevant + * for the implementation might be silently dropped. If dropped, + * the current function does not have access to them, + * and therefore cannot check them. See mbedtls_rsa_complete(). + * If you want to check the consistency of the entire + * content of a PKCS1-encoded RSA private key, for example, you + * should use mbedtls_rsa_validate_params() before setting + * up the RSA context. + * Additionally, if the implementation performs empirical checks, + * these checks substantiate but do not guarantee consistency.
    • + *
  • Quality: This function is not expected to perform + * extended quality assessments like checking that the prime + * factors are safe. Additionally, it is the responsibility of the + * user to ensure the trustworthiness of the source of his RSA + * parameters, which goes beyond what is effectively checkable + * by the library.
+ * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_privkey(const mbedtls_rsa_context *ctx); + +/** + * \brief This function checks a public-private RSA key pair. + * + * It checks each of the contexts, and makes sure they match. + * + * \param pub The initialized RSA context holding the public key. + * \param prv The initialized RSA context holding the private key. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_pub_priv(const mbedtls_rsa_context *pub, + const mbedtls_rsa_context *prv); + +/** + * \brief This function performs an RSA public key operation. + * + * \param ctx The initialized RSA context to use. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \note This function does not handle message padding. + * + * \note Make sure to set \p input[0] = 0 or ensure that + * input is smaller than \c N. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_public(mbedtls_rsa_context *ctx, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function performs an RSA private key operation. + * + * \note Blinding is used if and only if a PRNG is provided. + * + * \note If blinding is used, both the base of exponentiation + * and the exponent are blinded, providing protection + * against some side-channel attacks. + * + * \warning It is deprecated and a security risk to not provide + * a PRNG here and thereby prevent the use of blinding. + * Future versions of the library may enforce the presence + * of a PRNG. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function, used for blinding. It is mandatory. + * \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_private(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function adds the message padding, then performs an RSA + * operation. + * + * It is the generic wrapper for performing a PKCS#1 encryption + * operation. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG to use. It is used for padding generation + * and it is mandatory. + * \param p_rng The RNG context to be passed to \p f_rng. May be + * \c NULL if \p f_rng doesn't need a context argument. + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_encrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + size_t ilen, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function performs a PKCS#1 v1.5 encryption operation + * (RSAES-PKCS1-v1_5-ENCRYPT). + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. It is mandatory and used for + * padding generation. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_pkcs1_v15_encrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + size_t ilen, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP encryption + * operation (RSAES-OAEP-ENCRYPT). + * + * \note The output buffer must be as large as the size + * of ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. This is needed for padding + * generation and is mandatory. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param ilen The length of the plaintext buffer \p input in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_encrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + const unsigned char *label, size_t label_len, + size_t ilen, + const unsigned char *input, + unsigned char *output); + +/** + * \brief This function performs an RSA operation, then removes the + * message padding. + * + * It is the generic wrapper for performing a PKCS#1 decryption + * operation. + * + * \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + * mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + * inherently dangerous function (CWE-242). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N (for example, + * 128 Bytes if RSA-1024 is used) to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. This is used for blinding and is + * mandatory; see mbedtls_rsa_private() for more. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context. + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_decrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len); + +/** + * \brief This function performs a PKCS#1 v1.5 decryption + * operation (RSAES-PKCS1-v1_5-DECRYPT). + * + * \warning This is an inherently dangerous function (CWE-242). Unless + * it is used in a side channel free and safe way (eg. + * implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + * the calling code is vulnerable. + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for example, + * 128 Bytes if RSA-1024 is used, to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. This is used for blinding and is + * mandatory; see mbedtls_rsa_private() for more. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context. + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_rsaes_pkcs1_v15_decrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP decryption + * operation (RSAES-OAEP-DECRYPT). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for + * example, 128 Bytes if RSA-1024 is used, to be able to + * hold an arbitrary decrypted message. If it is not + * large enough to hold the decryption of the particular + * ciphertext provided, the function returns + * #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. This is used for blinding and is + * mandatory. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context. + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_decrypt(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + const unsigned char *label, size_t label_len, + size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len); + +/** + * \brief This function performs a private RSA operation to sign + * a message digest using PKCS#1. + * + * It is the generic wrapper for performing a PKCS#1 + * signature. + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_sign() for details on + * \p md_alg and \p hash_id. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. This is mandatory and + * must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_sign(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig); + +/** + * \brief This function performs a PKCS#1 v1.5 signature + * operation (RSASSA-PKCS1-v1_5-SIGN). + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. This is used for blinding and is + * mandatory; see mbedtls_rsa_private() for more. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_sign(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig); + +#if defined(MBEDTLS_PKCS1_V21) +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx by calling + * mbedtls_rsa_set_padding() selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function enforces that the provided salt length complies + * with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + * step 3. The constraint is that the hash length plus the salt + * length plus 2 bytes must be at most the key length. If this + * constraint is not met, this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It is mandatory and must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param saltlen The length of the salt that should be used. + * If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + * the largest possible salt length up to the hash length, + * which is the largest permitted by some standards including + * FIPS 186-4 §5.5. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign_ext(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + int saltlen, + unsigned char *sig); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx by calling + * mbedtls_rsa_set_padding() selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function always uses the maximum possible salt size, + * up to the length of the payload hash. This choice of salt + * size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + * v2.2) §9.1.1 step 3. Furthermore this function enforces a + * minimum salt size which is the hash size minus 2 bytes. If + * this minimum size is too large given the key size (the salt + * size, plus the hash size, plus 2 bytes must be no more than + * the key size in bytes), this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It is mandatory and must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign(mbedtls_rsa_context *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig); +#endif /* MBEDTLS_PKCS1_V21 */ + +/** + * \brief This function performs a public RSA operation and checks + * the message digest. + * + * This is the generic wrapper for performing a PKCS#1 + * verification. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + * \c hash_id. + * + * \param ctx The initialized RSA public key context to use. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_verify(mbedtls_rsa_context *ctx, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig); + +/** + * \brief This function performs a PKCS#1 v1.5 verification + * operation (RSASSA-PKCS1-v1_5-VERIFY). + * + * \param ctx The initialized RSA public key context to use. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_verify(mbedtls_rsa_context *ctx, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \c hash_id set in \p ctx by calling + * mbedtls_rsa_set_padding() selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. If the \c hash_id set in \p ctx by + * mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + * parameter is used. + * + * \param ctx The initialized RSA public key context to use. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify(mbedtls_rsa_context *ctx, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + * ignored. + * + * \param ctx The initialized RSA public key context to use. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest or raw data in Bytes. + * If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + * output length of the corresponding hash algorithm. + * \param hash The buffer holding the message digest or raw data. + * This must be a readable buffer of at least \p hashlen Bytes. + * \param mgf1_hash_id The message digest algorithm used for the + * verification operation and the mask generation + * function (MGF1). For more details on the encoding + * operation and the mask generation function, consult + * RFC-3447: Public-Key Cryptography Standards + * (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * \param expected_salt_len The length of the salt used in padding. Use + * #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify_ext(mbedtls_rsa_context *ctx, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + mbedtls_md_type_t mgf1_hash_id, + int expected_salt_len, + const unsigned char *sig); + +/** + * \brief This function copies the components of an RSA context. + * + * \param dst The destination context. This must be initialized. + * \param src The source context. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + */ +int mbedtls_rsa_copy(mbedtls_rsa_context *dst, const mbedtls_rsa_context *src); + +/** + * \brief This function frees the components of an RSA key. + * + * \param ctx The RSA context to free. May be \c NULL, in which case + * this function is a no-op. If it is not \c NULL, it must + * point to an initialized RSA context. + */ +void mbedtls_rsa_free(mbedtls_rsa_context *ctx); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The RSA checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_rsa_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* rsa.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha1.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha1.h new file mode 100644 index 00000000..592ffd13 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha1.h @@ -0,0 +1,219 @@ +/** + * \file sha1.h + * + * \brief This file contains SHA-1 definitions and functions. + * + * The Secure Hash Algorithm 1 (SHA-1) cryptographic hash function is defined in + * FIPS 180-4: Secure Hash Standard (SHS). + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SHA1_H +#define MBEDTLS_SHA1_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +/** SHA-1 input data was malformed. */ +#define MBEDTLS_ERR_SHA1_BAD_INPUT_DATA -0x0073 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA1_ALT) +// Regular implementation +// + +/** + * \brief The SHA-1 context structure. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_sha1_context { + uint32_t MBEDTLS_PRIVATE(total)[2]; /*!< The number of Bytes processed. */ + uint32_t MBEDTLS_PRIVATE(state)[5]; /*!< The intermediate digest state. */ + unsigned char MBEDTLS_PRIVATE(buffer)[64]; /*!< The data block being processed. */ +} +mbedtls_sha1_context; + +#else /* MBEDTLS_SHA1_ALT */ +#include "sha1_alt.h" +#endif /* MBEDTLS_SHA1_ALT */ + +/** + * \brief This function initializes a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. + * This must not be \c NULL. + * + */ +void mbedtls_sha1_init(mbedtls_sha1_context *ctx); + +/** + * \brief This function clears a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to clear. This may be \c NULL, + * in which case this function does nothing. If it is + * not \c NULL, it must point to an initialized + * SHA-1 context. + * + */ +void mbedtls_sha1_free(mbedtls_sha1_context *ctx); + +/** + * \brief This function clones the state of a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param dst The SHA-1 context to clone to. This must be initialized. + * \param src The SHA-1 context to clone from. This must be initialized. + * + */ +void mbedtls_sha1_clone(mbedtls_sha1_context *dst, + const mbedtls_sha1_context *src); + +/** + * \brief This function starts a SHA-1 checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. This must be initialized. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1_starts(mbedtls_sha1_context *ctx); + +/** + * \brief This function feeds an input buffer into an ongoing SHA-1 + * checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_update(mbedtls_sha1_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief This function finishes the SHA-1 operation, and writes + * the result to the output buffer. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized and + * have a hash operation started. + * \param output The SHA-1 checksum result. This must be a writable + * buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_finish(mbedtls_sha1_context *ctx, + unsigned char output[20]); + +/** + * \brief SHA-1 process data block (internal use only). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized. + * \param data The data block being processed. This must be a + * readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_internal_sha1_process(mbedtls_sha1_context *ctx, + const unsigned char data[64]); + +/** + * \brief This function calculates the SHA-1 checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-1 result is calculated as + * output = SHA-1(input buffer). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * \param output The SHA-1 checksum result. + * This must be a writable buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1(const unsigned char *input, + size_t ilen, + unsigned char output[20]); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The SHA-1 checkup routine. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \return \c 0 on success. + * \return \c 1 on failure. + * + */ +int mbedtls_sha1_self_test(int verbose); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha1.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha256.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha256.h new file mode 100644 index 00000000..ca568e29 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha256.h @@ -0,0 +1,200 @@ +/** + * \file sha256.h + * + * \brief This file contains SHA-224 and SHA-256 definitions and functions. + * + * The Secure Hash Algorithms 224 and 256 (SHA-224 and SHA-256) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SHA256_H +#define MBEDTLS_SHA256_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +/** SHA-256 input data was malformed. */ +#define MBEDTLS_ERR_SHA256_BAD_INPUT_DATA -0x0074 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA256_ALT) +// Regular implementation +// + +/** + * \brief The SHA-256 context structure. + * + * The structure is used both for SHA-256 and for SHA-224 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha256_starts(). + */ +typedef struct mbedtls_sha256_context { + unsigned char MBEDTLS_PRIVATE(buffer)[64]; /*!< The data block being processed. */ + uint32_t MBEDTLS_PRIVATE(total)[2]; /*!< The number of Bytes processed. */ + uint32_t MBEDTLS_PRIVATE(state)[8]; /*!< The intermediate digest state. */ +#if defined(MBEDTLS_SHA224_C) + int MBEDTLS_PRIVATE(is224); /*!< Determines which function to use: + 0: Use SHA-256, or 1: Use SHA-224. */ +#endif +} +mbedtls_sha256_context; + +#else /* MBEDTLS_SHA256_ALT */ +#include "sha256_alt.h" +#endif /* MBEDTLS_SHA256_ALT */ + +/** + * \brief This function initializes a SHA-256 context. + * + * \param ctx The SHA-256 context to initialize. This must not be \c NULL. + */ +void mbedtls_sha256_init(mbedtls_sha256_context *ctx); + +/** + * \brief This function clears a SHA-256 context. + * + * \param ctx The SHA-256 context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized SHA-256 context. + */ +void mbedtls_sha256_free(mbedtls_sha256_context *ctx); + +/** + * \brief This function clones the state of a SHA-256 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha256_clone(mbedtls_sha256_context *dst, + const mbedtls_sha256_context *src); + +/** + * \brief This function starts a SHA-224 or SHA-256 checksum + * calculation. + * + * \param ctx The context to use. This must be initialized. + * \param is224 This determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \note is224 must be defined accordingly to the enabled + * MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + * function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_starts(mbedtls_sha256_context *ctx, int is224); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-256 checksum calculation. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_update(mbedtls_sha256_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief This function finishes the SHA-256 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-224 or SHA-256 checksum result. + * This must be a writable buffer of length \c 32 bytes + * for SHA-256, \c 28 bytes for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_finish(mbedtls_sha256_context *ctx, + unsigned char *output); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-256 computation. This function is for + * internal use only. + * + * \param ctx The SHA-256 context. This must be initialized. + * \param data The buffer holding one block of data. This must + * be a readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha256_process(mbedtls_sha256_context *ctx, + const unsigned char data[64]); + +/** + * \brief This function calculates the SHA-224 or SHA-256 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-256 result is calculated as + * output = SHA-256(input buffer). + * + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-224 or SHA-256 checksum result. + * This must be a writable buffer of length \c 32 bytes + * for SHA-256, \c 28 bytes for SHA-224. + * \param is224 Determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256(const unsigned char *input, + size_t ilen, + unsigned char *output, + int is224); + +#if defined(MBEDTLS_SELF_TEST) + +#if defined(MBEDTLS_SHA224_C) +/** + * \brief The SHA-224 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha224_self_test(int verbose); +#endif /* MBEDTLS_SHA224_C */ + +#if defined(MBEDTLS_SHA256_C) +/** + * \brief The SHA-256 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha256_self_test(int verbose); +#endif /* MBEDTLS_SHA256_C */ + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha256.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha3.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha3.h new file mode 100644 index 00000000..3eeee65e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha3.h @@ -0,0 +1,172 @@ +/** + * \file sha3.h + * + * \brief This file contains SHA-3 definitions and functions. + * + * The Secure Hash Algorithms cryptographic + * hash functions are defined in FIPS 202: SHA-3 Standard: + * Permutation-Based Hash and Extendable-Output Functions . + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_SHA3_H +#define MBEDTLS_SHA3_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/** SHA-3 input data was malformed. */ +#define MBEDTLS_ERR_SHA3_BAD_INPUT_DATA -0x0076 + +/** + * SHA-3 family id. + * + * It identifies the family (SHA3-256, SHA3-512, etc.) + */ + +typedef enum { + MBEDTLS_SHA3_NONE = 0, /*!< Operation not defined. */ + MBEDTLS_SHA3_224, /*!< SHA3-224 */ + MBEDTLS_SHA3_256, /*!< SHA3-256 */ + MBEDTLS_SHA3_384, /*!< SHA3-384 */ + MBEDTLS_SHA3_512, /*!< SHA3-512 */ +} mbedtls_sha3_id; + +/** + * \brief The SHA-3 context structure. + * + * The structure is used SHA-3 checksum calculations. + */ +typedef struct { + uint64_t MBEDTLS_PRIVATE(state[25]); + uint32_t MBEDTLS_PRIVATE(index); + uint16_t MBEDTLS_PRIVATE(olen); + uint16_t MBEDTLS_PRIVATE(max_block_size); +} +mbedtls_sha3_context; + +/** + * \brief This function initializes a SHA-3 context. + * + * \param ctx The SHA-3 context to initialize. This must not be \c NULL. + */ +void mbedtls_sha3_init(mbedtls_sha3_context *ctx); + +/** + * \brief This function clears a SHA-3 context. + * + * \param ctx The SHA-3 context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized SHA-3 context. + */ +void mbedtls_sha3_free(mbedtls_sha3_context *ctx); + +/** + * \brief This function clones the state of a SHA-3 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha3_clone(mbedtls_sha3_context *dst, + const mbedtls_sha3_context *src); + +/** + * \brief This function starts a SHA-3 checksum + * calculation. + * + * \param ctx The context to use. This must be initialized. + * \param id The id of the SHA-3 family. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha3_starts(mbedtls_sha3_context *ctx, mbedtls_sha3_id id); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-3 checksum calculation. + * + * \param ctx The SHA-3 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha3_update(mbedtls_sha3_context *ctx, + const uint8_t *input, + size_t ilen); + +/** + * \brief This function finishes the SHA-3 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-3 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-3 checksum result. + * This must be a writable buffer of length \c olen bytes. + * \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + * SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + * respectively. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha3_finish(mbedtls_sha3_context *ctx, + uint8_t *output, size_t olen); + +/** + * \brief This function calculates the SHA-3 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-3 result is calculated as + * output = SHA-3(id, input buffer, d). + * + * \param id The id of the SHA-3 family. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-3 checksum result. + * This must be a writable buffer of length \c olen bytes. + * \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + * SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + * respectively. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha3(mbedtls_sha3_id id, const uint8_t *input, + size_t ilen, + uint8_t *output, + size_t olen); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine for the algorithms implemented + * by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. + * + * \return 0 if successful, or 1 if the test failed. + */ +int mbedtls_sha3_self_test(int verbose); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha3.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha512.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha512.h new file mode 100644 index 00000000..1c20e4c2 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/sha512.h @@ -0,0 +1,208 @@ +/** + * \file sha512.h + * \brief This file contains SHA-384 and SHA-512 definitions and functions. + * + * The Secure Hash Algorithms 384 and 512 (SHA-384 and SHA-512) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SHA512_H +#define MBEDTLS_SHA512_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include +#include + +/** SHA-512 input data was malformed. */ +#define MBEDTLS_ERR_SHA512_BAD_INPUT_DATA -0x0075 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA512_ALT) +// Regular implementation +// + +/** + * \brief The SHA-512 context structure. + * + * The structure is used both for SHA-384 and for SHA-512 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha512_starts(). + */ +typedef struct mbedtls_sha512_context { + uint64_t MBEDTLS_PRIVATE(total)[2]; /*!< The number of Bytes processed. */ + uint64_t MBEDTLS_PRIVATE(state)[8]; /*!< The intermediate digest state. */ + unsigned char MBEDTLS_PRIVATE(buffer)[128]; /*!< The data block being processed. */ +#if defined(MBEDTLS_SHA384_C) + int MBEDTLS_PRIVATE(is384); /*!< Determines which function to use: + 0: Use SHA-512, or 1: Use SHA-384. */ +#endif +} +mbedtls_sha512_context; + +#else /* MBEDTLS_SHA512_ALT */ +#include "sha512_alt.h" +#endif /* MBEDTLS_SHA512_ALT */ + +/** + * \brief This function initializes a SHA-512 context. + * + * \param ctx The SHA-512 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_sha512_init(mbedtls_sha512_context *ctx); + +/** + * \brief This function clears a SHA-512 context. + * + * \param ctx The SHA-512 context to clear. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must point to an initialized + * SHA-512 context. + */ +void mbedtls_sha512_free(mbedtls_sha512_context *ctx); + +/** + * \brief This function clones the state of a SHA-512 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha512_clone(mbedtls_sha512_context *dst, + const mbedtls_sha512_context *src); + +/** + * \brief This function starts a SHA-384 or SHA-512 checksum + * calculation. + * + * \param ctx The SHA-512 context to use. This must be initialized. + * \param is384 Determines which function to use. This must be + * either \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note is384 must be defined accordingly to the enabled + * MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + * function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_starts(mbedtls_sha512_context *ctx, int is384); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-512 checksum calculation. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_update(mbedtls_sha512_context *ctx, + const unsigned char *input, + size_t ilen); + +/** + * \brief This function finishes the SHA-512 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 bytes + * for SHA-512, \c 48 bytes for SHA-384. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_finish(mbedtls_sha512_context *ctx, + unsigned char *output); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-512 computation. + * This function is for internal use only. + * + * \param ctx The SHA-512 context. This must be initialized. + * \param data The buffer holding one block of data. This + * must be a readable buffer of length \c 128 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha512_process(mbedtls_sha512_context *ctx, + const unsigned char data[128]); + +/** + * \brief This function calculates the SHA-512 or SHA-384 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-512 result is calculated as + * output = SHA-512(input buffer). + * + * \param input The buffer holding the input data. This must be + * a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 bytes + * for SHA-512, \c 48 bytes for SHA-384. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note is384 must be defined accordingly with the supported + * symbols in the config file. If: + * - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + * - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + * then the function will return + * #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512(const unsigned char *input, + size_t ilen, + unsigned char *output, + int is384); + +#if defined(MBEDTLS_SELF_TEST) + +#if defined(MBEDTLS_SHA384_C) +/** + * \brief The SHA-384 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha384_self_test(int verbose); +#endif /* MBEDTLS_SHA384_C */ + +#if defined(MBEDTLS_SHA512_C) +/** + * \brief The SHA-512 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha512_self_test(int verbose); +#endif /* MBEDTLS_SHA512_C */ + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha512.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl.h new file mode 100644 index 00000000..43d81759 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl.h @@ -0,0 +1,5882 @@ +/** + * \file ssl.h + * + * \brief SSL/TLS functions. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SSL_H +#define MBEDTLS_SSL_H +#include "mbedtls/platform_util.h" +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/bignum.h" +#include "mbedtls/ecp.h" + +#include "mbedtls/ssl_ciphersuites.h" + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#include "mbedtls/x509_crt.h" +#include "mbedtls/x509_crl.h" +#endif + +#if defined(MBEDTLS_DHM_C) +#include "mbedtls/dhm.h" +#endif + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) +#include "mbedtls/ecdh.h" +#endif + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +#include "psa/crypto.h" + +/* + * SSL Error codes + */ +/** A cryptographic operation is in progress. Try again later. */ +#define MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS -0x7000 +/** The requested feature is not available. */ +#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 +/** Verification of the message MAC failed. */ +#define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 +/** An invalid SSL record was received. */ +#define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 +/** The connection indicated an EOF. */ +#define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 +/** A message could not be parsed due to a syntactic error. */ +#define MBEDTLS_ERR_SSL_DECODE_ERROR -0x7300 +/* Error space gap */ +/** No RNG was provided to the SSL module. */ +#define MBEDTLS_ERR_SSL_NO_RNG -0x7400 +/** No client certification received from the client, but required by the authentication mode. */ +#define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 +/** Client received an extended server hello containing an unsupported extension */ +#define MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION -0x7500 +/** No ALPN protocols supported that the client advertises */ +#define MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL -0x7580 +/** The own private key or pre-shared key is not set, but needed. */ +#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 +/** No CA Chain is set, but required to operate. */ +#define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 +/** An unexpected message was received from our peer. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 +/** A fatal alert message was received from our peer. */ +#define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 +/** No server could be identified matching the client's SNI. */ +#define MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME -0x7800 +/** The peer notified us that the connection is going to be closed. */ +#define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 +/* Error space gap */ +/* Error space gap */ +/** Processing of the Certificate handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_CERTIFICATE -0x7A00 +/* Error space gap */ +/** A TLS 1.3 NewSessionTicket message has been received. */ +#define MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET -0x7B00 +/** Not possible to read early data */ +#define MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA -0x7B80 +/** + * Early data has been received as part of an on-going handshake. + * This error code can be returned only on server side if and only if early + * data has been enabled by means of the mbedtls_ssl_conf_early_data() API. + * This error code can then be returned by mbedtls_ssl_handshake(), + * mbedtls_ssl_handshake_step(), mbedtls_ssl_read() or mbedtls_ssl_write() if + * early data has been received as part of the handshake sequence they + * triggered. To read the early data, call mbedtls_ssl_read_early_data(). + */ +#define MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA -0x7C00 +/** Not possible to write early data */ +#define MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA -0x7C80 +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/** Cache entry not found */ +#define MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND -0x7E80 +/** Memory allocation failed */ +#define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 +/** Hardware acceleration function returned with error */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 +/** Hardware acceleration function skipped / left alone data */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 +/** Handshake protocol not within min/max boundaries */ +#define MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION -0x6E80 +/** The handshake negotiation failed. */ +#define MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE -0x6E00 +/** Session ticket has expired. */ +#define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 +/** Public key type mismatch (eg, asked for RSA key exchange and presented EC key) */ +#define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 +/** Unknown identity received (eg, PSK identity) */ +#define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 +/** Internal error (eg, unexpected failure in lower-level module) */ +#define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 +/** A counter would wrap (eg, too many messages exchanged). */ +#define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 +/** Unexpected message at ServerHello in renegotiation. */ +#define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 +/** DTLS client must retry for hello verification */ +#define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 +/** A buffer is too small to receive or write a message */ +#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 +/* Error space gap */ +/** No data of requested type currently available on underlying transport. */ +#define MBEDTLS_ERR_SSL_WANT_READ -0x6900 +/** Connection requires a write call. */ +#define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 +/** The operation timed out. */ +#define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 +/** The client initiated a reconnect from the same port. */ +#define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 +/** Record header looks valid but is not expected. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD -0x6700 +/** The alert message received indicates a non-fatal error. */ +#define MBEDTLS_ERR_SSL_NON_FATAL -0x6680 +/** A field in a message was incorrect or inconsistent with other fields. */ +#define MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER -0x6600 +/** Internal-only message signaling that further message-processing should be done */ +#define MBEDTLS_ERR_SSL_CONTINUE_PROCESSING -0x6580 +/** The asynchronous operation is not completed yet. */ +#define MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS -0x6500 +/** Internal-only message signaling that a message arrived early. */ +#define MBEDTLS_ERR_SSL_EARLY_MESSAGE -0x6480 +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/* Error space gap */ +/** An encrypted DTLS-frame with an unexpected CID was received. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_CID -0x6000 +/** An operation failed due to an unexpected version or configuration. */ +#define MBEDTLS_ERR_SSL_VERSION_MISMATCH -0x5F00 +/** Invalid value in SSL config */ +#define MBEDTLS_ERR_SSL_BAD_CONFIG -0x5E80 +/* Error space gap */ +/** Attempt to verify a certificate without an expected hostname. + * This is usually insecure. + * + * In TLS clients, when a client authenticates a server through its + * certificate, the client normally checks three things: + * - the certificate chain must be valid; + * - the chain must start from a trusted CA; + * - the certificate must cover the server name that is expected by the client. + * + * Omitting any of these checks is generally insecure, and can allow a + * malicious server to impersonate a legitimate server. + * + * The third check may be safely skipped in some unusual scenarios, + * such as networks where eavesdropping is a risk but not active attacks, + * or a private PKI where the client equally trusts all servers that are + * accredited by the root CA. + * + * You should call mbedtls_ssl_set_hostname() with the expected server name + * before starting a TLS handshake on a client (unless the client is + * set up to only use PSK-based authentication, which does not rely on the + * host name). If you have determined that server name verification is not + * required for security in your scenario, call mbedtls_ssl_set_hostname() + * with \p NULL as the server name. + * + * This error is raised if all of the following conditions are met: + * + * - A TLS client is configured with the authentication mode + * #MBEDTLS_SSL_VERIFY_REQUIRED (default). + * - Certificate authentication is enabled. + * - The client does not call mbedtls_ssl_set_hostname(). + * - The configuration option + * #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * is not enabled. + */ +#define MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME -0x5D80 + +/* + * Constants from RFC 8446 for TLS 1.3 PSK modes + * + * Those are used in the Pre-Shared Key Exchange Modes extension. + * See Section 4.2.9 in RFC 8446. + */ +#define MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE 0 /* Pure PSK-based exchange */ +#define MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE 1 /* PSK+ECDHE-based exchange */ + +/* + * TLS 1.3 NamedGroup values + * + * From RF 8446 + * enum { + * // Elliptic Curve Groups (ECDHE) + * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), + * x25519(0x001D), x448(0x001E), + * // Finite Field Groups (DHE) + * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), + * ffdhe6144(0x0103), ffdhe8192(0x0104), + * // Reserved Code Points + * ffdhe_private_use(0x01FC..0x01FF), + * ecdhe_private_use(0xFE00..0xFEFF), + * (0xFFFF) + * } NamedGroup; + * + */ + +/* Elliptic Curve Groups (ECDHE) */ +#define MBEDTLS_SSL_IANA_TLS_GROUP_NONE 0 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 0x0012 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 0x0013 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 0x0014 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1 0x0015 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1 0x0016 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 0x0017 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 0x0018 +#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1 0x0019 +#define MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1 0x001A +#define MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1 0x001B +#define MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1 0x001C +#define MBEDTLS_SSL_IANA_TLS_GROUP_X25519 0x001D +#define MBEDTLS_SSL_IANA_TLS_GROUP_X448 0x001E +/* Finite Field Groups (DHE) */ +#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048 0x0100 +#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072 0x0101 +#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096 0x0102 +#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144 0x0103 +#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192 0x0104 + +/* + * TLS 1.3 Key Exchange Modes + * + * Mbed TLS internal identifiers for use with the SSL configuration API + * mbedtls_ssl_conf_tls13_key_exchange_modes(). + */ + +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK (1u << 0) /*!< Pure-PSK TLS 1.3 key exchange, + * encompassing both externally agreed PSKs + * as well as resumption PSKs. */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL (1u << 1) /*!< Pure-Ephemeral TLS 1.3 key exchanges, + * including for example ECDHE and DHE + * key exchanges. */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL (1u << 2) /*!< PSK-Ephemeral TLS 1.3 key exchanges, + * using both a PSK and an ephemeral + * key exchange. */ + +/* Convenience macros for sets of key exchanges. */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL \ + (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK | \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL | \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL) /*!< All TLS 1.3 key exchanges */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL \ + (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK | \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL) /*!< All PSK-based TLS 1.3 key exchanges */ +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL \ + (MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL | \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL) /*!< All ephemeral TLS 1.3 key exchanges */ + +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE (0) + +/* + * Various constants + */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/* These are the high and low bytes of ProtocolVersion as defined by: + * - RFC 5246: ProtocolVersion version = { 3, 3 }; // TLS v1.2 + * - RFC 8446: see section 4.2.1 + */ +#define MBEDTLS_SSL_MAJOR_VERSION_3 3 +#define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */ +#define MBEDTLS_SSL_MINOR_VERSION_4 4 /*!< TLS v1.3 */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#define MBEDTLS_SSL_TRANSPORT_STREAM 0 /*!< TLS */ +#define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */ + +#define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */ +#define MBEDTLS_SSL_MAX_ALPN_NAME_LEN 255 /*!< Maximum size in bytes of a protocol name in alpn ext., RFC 7301 */ + +#define MBEDTLS_SSL_MAX_ALPN_LIST_LEN 65535 /*!< Maximum size in bytes of list in alpn ext., RFC 7301 */ + +/* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c + * NONE must be zero so that memset()ing structure to zero works */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value */ + +#define MBEDTLS_SSL_IS_CLIENT 0 +#define MBEDTLS_SSL_IS_SERVER 1 + +#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0 +#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1 + +#define MBEDTLS_SSL_CID_DISABLED 0 +#define MBEDTLS_SSL_CID_ENABLED 1 + +#define MBEDTLS_SSL_ETM_DISABLED 0 +#define MBEDTLS_SSL_ETM_ENABLED 1 + +#define MBEDTLS_SSL_COMPRESS_NULL 0 + +#define MBEDTLS_SSL_VERIFY_NONE 0 +#define MBEDTLS_SSL_VERIFY_OPTIONAL 1 +#define MBEDTLS_SSL_VERIFY_REQUIRED 2 +#define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */ + +#define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0 +#define MBEDTLS_SSL_SECURE_RENEGOTIATION 1 + +#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0 +#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1 + +#define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0 +#define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1 + +#define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1 +#define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16 + +#define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0 +#define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1 +#define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2 + +#define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0 +#define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1 +#define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */ + +#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0 +#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1 + +#define MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED 0 +#define MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED 1 + +#define MBEDTLS_SSL_PRESET_DEFAULT 0 +#define MBEDTLS_SSL_PRESET_SUITEB 2 + +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED 1 +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED 0 + +#define MBEDTLS_SSL_EARLY_DATA_DISABLED 0 +#define MBEDTLS_SSL_EARLY_DATA_ENABLED 1 + +#define MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED 0 +#define MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED 1 + +#define MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT 1 +#define MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER 0 + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) +#if defined(PSA_WANT_ALG_SHA_384) +#define MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN 48 +#elif defined(PSA_WANT_ALG_SHA_256) +#define MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN 32 +#endif +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */ +/* + * Default range for DTLS retransmission timer value, in milliseconds. + * RFC 6347 4.2.4.1 says from 1 second to 60 seconds. + */ +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000 +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000 + +/* + * Whether early data record should be discarded or not and how. + * + * The client has indicated early data and the server has rejected them. + * The server has then to skip past early data by either: + * - attempting to deprotect received records using the handshake traffic + * key, discarding records which fail deprotection (up to the configured + * max_early_data_size). Once a record is deprotected successfully, + * it is treated as the start of the client's second flight and the + * server proceeds as with an ordinary 1-RTT handshake. + * - skipping all records with an external content type of + * "application_data" (indicating that they are encrypted), up to the + * configured max_early_data_size. This is the expected behavior if the + * server has sent an HelloRetryRequest message. The server ignores + * application data message before 2nd ClientHello. + */ +#define MBEDTLS_SSL_EARLY_DATA_NO_DISCARD 0 +#define MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD 1 +#define MBEDTLS_SSL_EARLY_DATA_DISCARD 2 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +/* + * Maximum fragment length in bytes, + * determines the size of each of the two internal I/O buffers. + * + * Note: the RFC defines the default size of SSL / TLS messages. If you + * change the value here, other clients / servers may not be able to + * communicate with you anymore. Only change this value if you control + * both sides of the connection and have it reduced at both sides, or + * if you're using the Max Fragment Length extension and you know all your + * peers are using it too! + */ +#if !defined(MBEDTLS_SSL_IN_CONTENT_LEN) +#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 +#endif + +#if !defined(MBEDTLS_SSL_OUT_CONTENT_LEN) +#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 +#endif + +/* + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + */ +#if !defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING) +#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 +#endif + +/* + * Maximum length of CIDs for incoming and outgoing messages. + */ +#if !defined(MBEDTLS_SSL_CID_IN_LEN_MAX) +#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) +#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) +#define MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16 +#endif + +#if !defined(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE) +#define MBEDTLS_SSL_MAX_EARLY_DATA_SIZE 1024 +#endif + +#if !defined(MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) +#define MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE 6000 +#endif + +#if !defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH) +#define MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH 32 +#endif + +#if !defined(MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS) +#define MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS 1 +#endif + +/** \} name SECTION: Module settings */ + +/* + * Default to standard CID mode + */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT) +#define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 0 +#endif + +/* + * Length of the verify data for secure renegotiation + */ +#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12 + +/* + * Signaling ciphersuite values (SCSV) + */ +#define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext */ + +/* + * Supported Signature and Hash algorithms (For TLS 1.2) + * RFC 5246 section 7.4.1.4.1 + */ +#define MBEDTLS_SSL_HASH_NONE 0 +#define MBEDTLS_SSL_HASH_MD5 1 +#define MBEDTLS_SSL_HASH_SHA1 2 +#define MBEDTLS_SSL_HASH_SHA224 3 +#define MBEDTLS_SSL_HASH_SHA256 4 +#define MBEDTLS_SSL_HASH_SHA384 5 +#define MBEDTLS_SSL_HASH_SHA512 6 + +#define MBEDTLS_SSL_SIG_ANON 0 +#define MBEDTLS_SSL_SIG_RSA 1 +#define MBEDTLS_SSL_SIG_ECDSA 3 + +/* + * TLS 1.3 signature algorithms + * RFC 8446, Section 4.2.3 + */ + +/* RSASSA-PKCS1-v1_5 algorithms */ +#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 0x0401 +#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 0x0501 +#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 0x0601 + +/* ECDSA algorithms */ +#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256 0x0403 +#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384 0x0503 +#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512 0x0603 + +/* RSASSA-PSS algorithms with public key OID rsaEncryption */ +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 0x0804 +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384 0x0805 +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512 0x0806 + +/* EdDSA algorithms */ +#define MBEDTLS_TLS1_3_SIG_ED25519 0x0807 +#define MBEDTLS_TLS1_3_SIG_ED448 0x0808 + +/* RSASSA-PSS algorithms with public key OID RSASSA-PSS */ +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256 0x0809 +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384 0x080A +#define MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512 0x080B + +/* LEGACY ALGORITHMS */ +#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1 0x0201 +#define MBEDTLS_TLS1_3_SIG_ECDSA_SHA1 0x0203 + +#define MBEDTLS_TLS1_3_SIG_NONE 0x0 + +/* + * Client Certificate Types + * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5 + */ +#define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1 +#define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64 + +/* + * Message, alert and handshake types + */ +#define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20 +#define MBEDTLS_SSL_MSG_ALERT 21 +#define MBEDTLS_SSL_MSG_HANDSHAKE 22 +#define MBEDTLS_SSL_MSG_APPLICATION_DATA 23 +#define MBEDTLS_SSL_MSG_CID 25 + +#define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1 +#define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2 + +#define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */ +#define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */ +#define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */ +#define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */ +#define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */ +#define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */ +#define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */ +#define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */ +#define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */ +#define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */ +#define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */ +#define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */ +#define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */ +#define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */ +#define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */ +#define MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION 109 /* 0x6d -- new in TLS 1.3 */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */ +#define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_REQUIRED 116 /* 0x74 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */ + +#define MBEDTLS_SSL_HS_HELLO_REQUEST 0 +#define MBEDTLS_SSL_HS_CLIENT_HELLO 1 +#define MBEDTLS_SSL_HS_SERVER_HELLO 2 +#define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3 +#define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4 +#define MBEDTLS_SSL_HS_END_OF_EARLY_DATA 5 +#define MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS 8 +#define MBEDTLS_SSL_HS_CERTIFICATE 11 +#define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12 +#define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13 +#define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14 +#define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15 +#define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16 +#define MBEDTLS_SSL_HS_FINISHED 20 +#define MBEDTLS_SSL_HS_MESSAGE_HASH 254 + +/* + * TLS extensions + */ +#define MBEDTLS_TLS_EXT_SERVERNAME 0 +#define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0 + +#define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1 + +#define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4 +#define MBEDTLS_TLS_EXT_STATUS_REQUEST 5 /* RFC 6066 TLS 1.2 and 1.3 */ + +#define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10 +#define MBEDTLS_TLS_EXT_SUPPORTED_GROUPS 10 /* RFC 8422,7919 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11 + +#define MBEDTLS_TLS_EXT_SIG_ALG 13 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_USE_SRTP 14 +#define MBEDTLS_TLS_EXT_HEARTBEAT 15 /* RFC 6520 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_ALPN 16 + +#define MBEDTLS_TLS_EXT_SCT 18 /* RFC 6962 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_CLI_CERT_TYPE 19 /* RFC 7250 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_SERV_CERT_TYPE 20 /* RFC 7250 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_PADDING 21 /* RFC 7685 TLS 1.2 and 1.3 */ +#define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */ +#define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */ + +#define MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT 28 /* RFC 8449 (implemented for TLS 1.3 only) */ + +#define MBEDTLS_TLS_EXT_SESSION_TICKET 35 + +#define MBEDTLS_TLS_EXT_PRE_SHARED_KEY 41 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_EARLY_DATA 42 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS 43 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_COOKIE 44 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES 45 /* RFC 8446 TLS 1.3 */ + +#define MBEDTLS_TLS_EXT_CERT_AUTH 47 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_OID_FILTERS 48 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH 49 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_SIG_ALG_CERT 50 /* RFC 8446 TLS 1.3 */ +#define MBEDTLS_TLS_EXT_KEY_SHARE 51 /* RFC 8446 TLS 1.3 */ + +#if MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT == 0 +#define MBEDTLS_TLS_EXT_CID 54 /* RFC 9146 DTLS 1.2 CID */ +#else +#define MBEDTLS_TLS_EXT_CID 254 /* Pre-RFC 9146 DTLS 1.2 CID */ +#endif + +#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */ + +#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01 + +/* + * Size defines + */ +#if !defined(MBEDTLS_PSK_MAX_LEN) +/* + * If the library supports TLS 1.3 tickets and the cipher suite + * TLS1-3-AES-256-GCM-SHA384, set the PSK maximum length to 48 instead of 32. + * That way, the TLS 1.3 client and server are able to resume sessions where + * the cipher suite is TLS1-3-AES-256-GCM-SHA384 (pre-shared keys are 48 + * bytes long in that case). + */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ + defined(MBEDTLS_SSL_SESSION_TICKETS) && \ + defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM) && \ + defined(MBEDTLS_MD_CAN_SHA384) +#define MBEDTLS_PSK_MAX_LEN 48 /* 384 bits */ +#else +#define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */ +#endif +#endif /* !MBEDTLS_PSK_MAX_LEN */ + +/* Dummy type used only for its size */ +union mbedtls_ssl_premaster_secret { + unsigned char dummy; /* Make the union non-empty even with SSL disabled */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) + unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) + unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) + unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) + unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) + unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE + + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) + unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) + unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES + + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */ +#endif +}; + +#define MBEDTLS_PREMASTER_SIZE sizeof(union mbedtls_ssl_premaster_secret) + +#define MBEDTLS_TLS1_3_MD_MAX_SIZE PSA_HASH_MAX_SIZE + + +/* Length in number of bytes of the TLS sequence number */ +#define MBEDTLS_SSL_SEQUENCE_NUMBER_LEN 8 + +/* Helper to state that client_random and server_random need to be stored + * after the handshake is complete. This is required for context serialization + * and for the keying material exporter in TLS 1.2. */ +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) || \ + (defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT) && defined(MBEDTLS_SSL_PROTO_TLS1_2)) +#define MBEDTLS_SSL_KEEP_RANDBYTES +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * SSL state machine + */ +typedef enum { + MBEDTLS_SSL_HELLO_REQUEST, + MBEDTLS_SSL_CLIENT_HELLO, + MBEDTLS_SSL_SERVER_HELLO, + MBEDTLS_SSL_SERVER_CERTIFICATE, + MBEDTLS_SSL_SERVER_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_REQUEST, + MBEDTLS_SSL_SERVER_HELLO_DONE, + MBEDTLS_SSL_CLIENT_CERTIFICATE, + MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_VERIFY, + MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_CLIENT_FINISHED, + MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_SERVER_FINISHED, + MBEDTLS_SSL_FLUSH_BUFFERS, + MBEDTLS_SSL_HANDSHAKE_WRAPUP, + MBEDTLS_SSL_NEW_SESSION_TICKET, + MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT, + MBEDTLS_SSL_HELLO_RETRY_REQUEST, + MBEDTLS_SSL_ENCRYPTED_EXTENSIONS, + MBEDTLS_SSL_END_OF_EARLY_DATA, + MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY, + MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED, + MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO, + MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO, + MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO, + MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST, + MBEDTLS_SSL_HANDSHAKE_OVER, + MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET, + MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH, +} +mbedtls_ssl_states; + +/* + * Early data status, client side only. + */ + +#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) +typedef enum { +/* + * See documentation of mbedtls_ssl_get_early_data_status(). + */ + MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_INDICATED, + MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED, + MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED, +} mbedtls_ssl_early_data_status; +#endif /* MBEDTLS_SSL_EARLY_DATA && MBEDTLS_SSL_CLI_C */ + +/** + * \brief Callback type: send data on the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the send callback (typically a file descriptor) + * \param buf Buffer holding the data to send + * \param len Length of the data to send + * + * \return The callback must return the number of bytes sent if any, + * or a non-zero error code. + * If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_WRITE + * must be returned when the operation would block. + * + * \note The callback is allowed to send fewer bytes than requested. + * It must always return the number of bytes actually sent. + */ +typedef int mbedtls_ssl_send_t(void *ctx, + const unsigned char *buf, + size_t len); + +/** + * \brief Callback type: receive data from the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the receive callback (typically a file + * descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * + * \returns If data has been received, the positive number of bytes received. + * \returns \c 0 if the connection has been closed. + * \returns If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ + * must be returned when the operation would block. + * \returns Another negative error code on other kinds of failures. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_t(void *ctx, + unsigned char *buf, + size_t len); + +/** + * \brief Callback type: receive data from the network, with timeout + * + * \note That callback must block until data is received, or the + * timeout delay expires, or the operation is interrupted by a + * signal. + * + * \param ctx Context for the receive callback (typically a file descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * \param timeout Maximum number of milliseconds to wait for data + * 0 means no timeout (potentially waiting forever) + * + * \return The callback must return the number of bytes received, + * or a non-zero error code: + * \c MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out, + * \c MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_timeout_t(void *ctx, + unsigned char *buf, + size_t len, + uint32_t timeout); +/** + * \brief Callback type: set a pair of timers/delays to watch + * + * \param ctx Context pointer + * \param int_ms Intermediate delay in milliseconds + * \param fin_ms Final delay in milliseconds + * 0 cancels the current timer. + * + * \note This callback must at least store the necessary information + * for the associated \c mbedtls_ssl_get_timer_t callback to + * return correct information. + * + * \note If using an event-driven style of programming, an event must + * be generated when the final delay is passed. The event must + * cause a call to \c mbedtls_ssl_handshake() with the proper + * SSL context to be scheduled. Care must be taken to ensure + * that at most one such call happens at a time. + * + * \note Only one timer at a time must be running. Calling this + * function while a timer is running must cancel it. Cancelled + * timers must not generate any event. + */ +typedef void mbedtls_ssl_set_timer_t(void *ctx, + uint32_t int_ms, + uint32_t fin_ms); + +/** + * \brief Callback type: get status of timers/delays + * + * \param ctx Context pointer + * + * \return This callback must return: + * -1 if cancelled (fin_ms == 0), + * 0 if none of the delays have passed, + * 1 if only the intermediate delay has passed, + * 2 if the final delay has passed. + */ +typedef int mbedtls_ssl_get_timer_t(void *ctx); + +/* Defined below */ +typedef struct mbedtls_ssl_session mbedtls_ssl_session; +typedef struct mbedtls_ssl_context mbedtls_ssl_context; +typedef struct mbedtls_ssl_config mbedtls_ssl_config; + +/* Defined in library/ssl_misc.h */ +typedef struct mbedtls_ssl_transform mbedtls_ssl_transform; +typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params; +typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t; +#if defined(MBEDTLS_X509_CRT_PARSE_C) +typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert; +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) +typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item; +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) +#define MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK /* 1U << 0 */ +#define MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL /* 1U << 2 */ +#define MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA (1U << 3) + +#define MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK \ + (MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION | \ + MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION | \ + MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA) +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */ + +/** + * \brief Callback type: server-side session cache getter + * + * The session cache is logically a key value store, with + * keys being session IDs and values being instances of + * mbedtls_ssl_session. + * + * This callback retrieves an entry in this key-value store. + * + * \param data The address of the session cache structure to query. + * \param session_id The buffer holding the session ID to query. + * \param session_id_len The length of \p session_id in Bytes. + * \param session The address of the session structure to populate. + * It is initialized with mbdtls_ssl_session_init(), + * and the callback must always leave it in a state + * where it can safely be freed via + * mbedtls_ssl_session_free() independent of the + * return code of this function. + * + * \return \c 0 on success + * \return A non-zero return value on failure. + * + */ +typedef int mbedtls_ssl_cache_get_t(void *data, + unsigned char const *session_id, + size_t session_id_len, + mbedtls_ssl_session *session); +/** + * \brief Callback type: server-side session cache setter + * + * The session cache is logically a key value store, with + * keys being session IDs and values being instances of + * mbedtls_ssl_session. + * + * This callback sets an entry in this key-value store. + * + * \param data The address of the session cache structure to modify. + * \param session_id The buffer holding the session ID to query. + * \param session_id_len The length of \p session_id in Bytes. + * \param session The address of the session to be stored in the + * session cache. + * + * \return \c 0 on success + * \return A non-zero return value on failure. + */ +typedef int mbedtls_ssl_cache_set_t(void *data, + unsigned char const *session_id, + size_t session_id_len, + const mbedtls_ssl_session *session); + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Callback type: start external signature operation. + * + * This callback is called during an SSL handshake to start + * a signature decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p hash if the value + * is needed for later processing, because the \p hash buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \note For RSA signatures, this function must produce output + * that is consistent with PKCS#1 v1.5 in the same way as + * mbedtls_rsa_pkcs1_sign(). Before the private key operation, + * apply the padding steps described in RFC 8017, section 9.2 + * "EMSA-PKCS1-v1_5" as follows. + * - If \p md_alg is #MBEDTLS_MD_NONE, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the DigestInfo to be + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 3, with `T = hash` and `tLen = hash_len`. + * - If `md_alg != MBEDTLS_MD_NONE`, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the hash to be encoded and + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 2, with `digestAlgorithm` obtained by calling + * mbedtls_oid_get_oid_by_md() on \p md_alg. + * + * \note For ECDSA signatures, the output format is the DER encoding + * `Ecdsa-Sig-Value` defined in + * [RFC 4492 section 5.4](https://tools.ietf.org/html/rfc4492#section-5.4). + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param md_alg Hash algorithm. + * \param hash Buffer containing the hash. This buffer is + * no longer valid when the function returns. + * \param hash_len Size of the \c hash buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_sign_t(mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + mbedtls_md_type_t md_alg, + const unsigned char *hash, + size_t hash_len); + +/** + * \brief Callback type: start external decryption operation. + * + * This callback is called during an SSL handshake to start + * an RSA decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p input if the value + * is needed for later processing, because the \p input buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \warning RSA decryption as used in TLS is subject to a potential + * timing side channel attack first discovered by Bleichenbacher + * in 1998. This attack can be remotely exploitable + * in practice. To avoid this attack, you must ensure that + * if the callback performs an RSA decryption, the time it + * takes to execute and return the result does not depend + * on whether the RSA decryption succeeded or reported + * invalid padding. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param input Buffer containing the input ciphertext. This buffer + * is no longer valid when the function returns. + * \param input_len Size of the \p input buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_decrypt_t(mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + const unsigned char *input, + size_t input_len); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Callback type: resume external operation. + * + * This callback is called during an SSL handshake to resume + * an external operation started by the + * ::mbedtls_ssl_async_sign_t or + * ::mbedtls_ssl_async_decrypt_t callback. + * + * This function typically checks the status of a pending + * request or causes the request queue to make progress, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * It may call mbedtls_ssl_set_async_operation_data() to modify + * this context. + * + * Note that when this function returns a status other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, it must free any + * resources associated with the operation. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param output Buffer containing the output (signature or decrypted + * data) on success. + * \param output_len On success, number of bytes written to \p output. + * \param output_size Size of the \p output buffer in bytes. + * + * \return 0 if output of the operation is available in the + * \p output buffer. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * is still in progress. Subsequent requests for progress + * on the SSL connection will call the resume callback + * again. + * \return Any other error means that the operation is aborted. + * The SSL handshake is aborted. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_resume_t(mbedtls_ssl_context *ssl, + unsigned char *output, + size_t *output_len, + size_t output_size); + +/** + * \brief Callback type: cancel external operation. + * + * This callback is called if an SSL connection is closed + * while an asynchronous operation is in progress. Note that + * this callback is not called if the + * ::mbedtls_ssl_async_resume_t callback has run and has + * returned a value other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, since in that case + * the asynchronous operation has already completed. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * + * \param ssl The SSL connection instance. It should not be + * modified. + */ +typedef void mbedtls_ssl_async_cancel_t(mbedtls_ssl_context *ssl); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN 48 +#if defined(MBEDTLS_MD_CAN_SHA256) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA256 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 32 +#elif defined(MBEDTLS_MD_CAN_SHA384) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA384 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 48 +#elif defined(MBEDTLS_MD_CAN_SHA1) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA1 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 20 +#else +/* This is already checked in check_config.h, but be sure. */ +#error "Bad configuration - need SHA-1, SHA-256 or SHA-512 enabled to compute digest of peer CRT." +#endif +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED && + !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + +typedef struct { + unsigned char client_application_traffic_secret_N[MBEDTLS_TLS1_3_MD_MAX_SIZE]; + unsigned char server_application_traffic_secret_N[MBEDTLS_TLS1_3_MD_MAX_SIZE]; + unsigned char exporter_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; + unsigned char resumption_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; +} mbedtls_ssl_tls13_application_secrets; + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + +#define MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH 255 +#define MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH 4 +/* + * For code readability use a typedef for DTLS-SRTP profiles + * + * Use_srtp extension protection profiles values as defined in + * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * + * Reminder: if this list is expanded mbedtls_ssl_check_srtp_profile_value + * must be updated too. + */ +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 ((uint16_t) 0x0001) +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 ((uint16_t) 0x0002) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80 ((uint16_t) 0x0005) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 ((uint16_t) 0x0006) +/* This one is not iana defined, but for code readability. */ +#define MBEDTLS_TLS_SRTP_UNSET ((uint16_t) 0x0000) + +typedef uint16_t mbedtls_ssl_srtp_profile; + +typedef struct mbedtls_dtls_srtp_info_t { + /*! The SRTP profile that was negotiated. */ + mbedtls_ssl_srtp_profile MBEDTLS_PRIVATE(chosen_dtls_srtp_profile); + /*! The length of mki_value. */ + uint16_t MBEDTLS_PRIVATE(mki_len); + /*! The mki_value used, with max size of 256 bytes. */ + unsigned char MBEDTLS_PRIVATE(mki_value)[MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH]; +} +mbedtls_dtls_srtp_info; + +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +/** Human-friendly representation of the (D)TLS protocol version. */ +typedef enum { + MBEDTLS_SSL_VERSION_UNKNOWN, /*!< Context not in use or version not yet negotiated. */ + MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303, /*!< (D)TLS 1.2 */ + MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304, /*!< (D)TLS 1.3 */ +} mbedtls_ssl_protocol_version; + +/* + * This structure is used for storing current session data. + * + * Note: when changing this definition, we need to check and update: + * - in tests/suites/test_suite_ssl.function: + * ssl_populate_session() and ssl_serialize_session_save_load() + * - in library/ssl_tls.c: + * mbedtls_ssl_session_init() and mbedtls_ssl_session_free() + * mbedtls_ssl_session_save() and ssl_session_load() + * ssl_session_copy() + */ +struct mbedtls_ssl_session { +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + unsigned char MBEDTLS_PRIVATE(mfl_code); /*!< MaxFragmentLength negotiated by peer */ +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +/*!< RecordSizeLimit received from the peer */ +#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) + uint16_t MBEDTLS_PRIVATE(record_size_limit); +#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ + + unsigned char MBEDTLS_PRIVATE(exported); + uint8_t MBEDTLS_PRIVATE(endpoint); /*!< 0: client, 1: server */ + + /** TLS version negotiated in the session. Used if and when renegotiating + * or resuming a session instead of the configured minor TLS version. + */ + mbedtls_ssl_protocol_version MBEDTLS_PRIVATE(tls_version); + +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t MBEDTLS_PRIVATE(start); /*!< start time of current session */ +#endif + int MBEDTLS_PRIVATE(ciphersuite); /*!< chosen ciphersuite */ + size_t MBEDTLS_PRIVATE(id_len); /*!< session id length */ + unsigned char MBEDTLS_PRIVATE(id)[32]; /*!< session identifier */ + unsigned char MBEDTLS_PRIVATE(master)[48]; /*!< the master secret */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_x509_crt *MBEDTLS_PRIVATE(peer_cert); /*!< peer X.509 cert chain */ +#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + /*! The digest of the peer's end-CRT. This must be kept to detect CRT + * changes during renegotiation, mitigating the triple handshake attack. */ + unsigned char *MBEDTLS_PRIVATE(peer_cert_digest); + size_t MBEDTLS_PRIVATE(peer_cert_digest_len); + mbedtls_md_type_t MBEDTLS_PRIVATE(peer_cert_digest_type); +#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + uint32_t MBEDTLS_PRIVATE(verify_result); /*!< verification result */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) + unsigned char *MBEDTLS_PRIVATE(ticket); /*!< RFC 5077 session ticket */ + size_t MBEDTLS_PRIVATE(ticket_len); /*!< session ticket length */ + uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< ticket lifetime hint */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) && \ + defined(MBEDTLS_HAVE_TIME) + /*! When a ticket is created by a TLS server as part of an established TLS + * session, the ticket creation time may need to be saved for the ticket + * module to be able to check the ticket age when the ticket is used. + * That's the purpose of this field. + * Before creating a new ticket, an Mbed TLS server set this field with + * its current time in milliseconds. This time may then be saved in the + * session ticket data by the session ticket writing function and + * recovered by the ticket parsing function later when the ticket is used. + * The ticket module may then use this time to compute the ticket age and + * determine if it has expired or not. + * The Mbed TLS implementations of the session ticket writing and parsing + * functions save and retrieve the ticket creation time as part of the + * session ticket data. The session ticket parsing function relies on + * the mbedtls_ssl_session_get_ticket_creation_time() API to get the + * ticket creation time from the session ticket data. + */ + mbedtls_ms_time_t MBEDTLS_PRIVATE(ticket_creation_time); +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) + uint32_t MBEDTLS_PRIVATE(ticket_age_add); /*!< Randomly generated value used to obscure the age of the ticket */ + uint8_t MBEDTLS_PRIVATE(ticket_flags); /*!< Ticket flags */ + uint8_t MBEDTLS_PRIVATE(resumption_key_len); /*!< resumption_key length */ + unsigned char MBEDTLS_PRIVATE(resumption_key)[MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN]; + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C) + char *MBEDTLS_PRIVATE(hostname); /*!< host name binded with tickets */ +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN) && defined(MBEDTLS_SSL_SRV_C) + char *ticket_alpn; /*!< ALPN negotiated in the session + during which the ticket was generated. */ +#endif + +#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_CLI_C) + /*! Time in milliseconds when the last ticket was received. */ + mbedtls_ms_time_t MBEDTLS_PRIVATE(ticket_reception_time); +#endif +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */ + +#if defined(MBEDTLS_SSL_EARLY_DATA) + uint32_t MBEDTLS_PRIVATE(max_early_data_size); /*!< maximum amount of early data in tickets */ +#endif + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + int MBEDTLS_PRIVATE(encrypt_then_mac); /*!< flag for EtM activation */ +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + mbedtls_ssl_tls13_application_secrets MBEDTLS_PRIVATE(app_secrets); +#endif +}; + +/* + * Identifiers for PRFs used in various versions of TLS. + */ +typedef enum { + MBEDTLS_SSL_TLS_PRF_NONE, + MBEDTLS_SSL_TLS_PRF_SHA384, + MBEDTLS_SSL_TLS_PRF_SHA256, + MBEDTLS_SSL_HKDF_EXPAND_SHA384, + MBEDTLS_SSL_HKDF_EXPAND_SHA256 +} +mbedtls_tls_prf_types; + +typedef enum { + MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET = 0, +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET, + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_EARLY_EXPORTER_SECRET, + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET, + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET, + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET, + MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET, +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ +} mbedtls_ssl_key_export_type; + +/** + * \brief Callback type: Export key alongside random values for + * session identification, and PRF for + * implementation of TLS key exporters. + * + * \param p_expkey Context for the callback. + * \param type The type of the key that is being exported. + * \param secret The address of the buffer holding the secret + * that's being exporterd. + * \param secret_len The length of \p secret in bytes. + * \param client_random The client random bytes. + * \param server_random The server random bytes. + * \param tls_prf_type The identifier for the PRF used in the handshake + * to which the key belongs. + */ +typedef void mbedtls_ssl_export_keys_t(void *p_expkey, + mbedtls_ssl_key_export_type type, + const unsigned char *secret, + size_t secret_len, + const unsigned char client_random[32], + const unsigned char server_random[32], + mbedtls_tls_prf_types tls_prf_type); + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Callback type: generic handshake callback + * + * \note Callbacks may use user_data funcs to set/get app user data. + * See \c mbedtls_ssl_get_user_data_p() + * \c mbedtls_ssl_get_user_data_n() + * \c mbedtls_ssl_conf_get_user_data_p() + * \c mbedtls_ssl_conf_get_user_data_n() + * + * \param ssl \c mbedtls_ssl_context on which the callback is run + * + * \return The return value of the callback is 0 if successful, + * or a specific MBEDTLS_ERR_XXX code, which will cause + * the handshake to be aborted. + */ +typedef int (*mbedtls_ssl_hs_cb_t)(mbedtls_ssl_context *ssl); +#endif + +/* A type for storing user data in a library structure. + * + * The representation of type may change in future versions of the library. + * Only the behaviors guaranteed by documented accessor functions are + * guaranteed to remain stable. + */ +typedef union { + uintptr_t n; /* typically a handle to an associated object */ + void *p; /* typically a pointer to extra data */ +} mbedtls_ssl_user_data_t; + +/** + * SSL/TLS configuration to be shared between mbedtls_ssl_context structures. + */ +struct mbedtls_ssl_config { + /* Group items mostly by size. This helps to reduce memory wasted to + * padding. It also helps to keep smaller fields early in the structure, + * so that elements tend to be in the 128-element direct access window + * on Arm Thumb, which reduces the code size. */ + + mbedtls_ssl_protocol_version MBEDTLS_PRIVATE(max_tls_version); /*!< max. TLS version used */ + mbedtls_ssl_protocol_version MBEDTLS_PRIVATE(min_tls_version); /*!< min. TLS version used */ + + /* + * Flags (could be bit-fields to save RAM, but separate bytes make + * the code smaller on architectures with an instruction for direct + * byte access). + */ + + uint8_t MBEDTLS_PRIVATE(endpoint); /*!< 0: client, 1: server */ + uint8_t MBEDTLS_PRIVATE(transport); /*!< 0: stream (TLS), 1: datagram (DTLS) */ + uint8_t MBEDTLS_PRIVATE(authmode); /*!< MBEDTLS_SSL_VERIFY_XXX */ + /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */ + uint8_t MBEDTLS_PRIVATE(allow_legacy_renegotiation); /*!< MBEDTLS_LEGACY_XXX */ +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + uint8_t MBEDTLS_PRIVATE(mfl_code); /*!< desired fragment length indicator + (MBEDTLS_SSL_MAX_FRAG_LEN_XXX) */ +#endif +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + uint8_t MBEDTLS_PRIVATE(encrypt_then_mac); /*!< negotiate encrypt-then-mac? */ +#endif +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + uint8_t MBEDTLS_PRIVATE(extended_ms); /*!< negotiate extended master secret? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint8_t MBEDTLS_PRIVATE(anti_replay); /*!< detect and prevent replay? */ +#endif +#if defined(MBEDTLS_SSL_RENEGOTIATION) + uint8_t MBEDTLS_PRIVATE(disable_renegotiation); /*!< disable renegotiation? */ +#endif +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \ + defined(MBEDTLS_SSL_CLI_C) + /** Encodes two booleans, one stating whether TLS 1.2 session tickets are + * enabled or not, the other one whether the handling of TLS 1.3 + * NewSessionTicket messages is enabled or not. They are respectively set + * by mbedtls_ssl_conf_session_tickets() and + * mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + */ + uint8_t MBEDTLS_PRIVATE(session_tickets); /*!< use session tickets? */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \ + defined(MBEDTLS_SSL_SRV_C) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_3) + uint16_t MBEDTLS_PRIVATE(new_session_tickets_count); /*!< number of NewSessionTicket */ +#endif + +#if defined(MBEDTLS_SSL_SRV_C) + uint8_t MBEDTLS_PRIVATE(cert_req_ca_list); /*!< enable sending CA list in + Certificate Request messages? */ + uint8_t MBEDTLS_PRIVATE(respect_cli_pref); /*!< pick the ciphersuite according to + the client's preferences rather + than ours? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t MBEDTLS_PRIVATE(ignore_unexpected_cid); /*!< Should DTLS record with + * unexpected CID + * lead to failure? */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +#if defined(MBEDTLS_SSL_DTLS_SRTP) + uint8_t MBEDTLS_PRIVATE(dtls_srtp_mki_support); /* support having mki_value + in the use_srtp extension? */ +#endif + + /* + * Pointers + */ + + /** Allowed ciphersuites for (D)TLS 1.2 (0-terminated) */ + const int *MBEDTLS_PRIVATE(ciphersuite_list); + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + /** Allowed TLS 1.3 key exchange modes. */ + int MBEDTLS_PRIVATE(tls13_kex_modes); +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + + /** Callback for printing debug output */ + void(*MBEDTLS_PRIVATE(f_dbg))(void *, int, const char *, int, const char *); + void *MBEDTLS_PRIVATE(p_dbg); /*!< context for the debug function */ + + /** Callback for getting (pseudo-)random numbers */ + int(*MBEDTLS_PRIVATE(f_rng))(void *, unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_rng); /*!< context for the RNG function */ + + /** Callback to retrieve a session from the cache */ + mbedtls_ssl_cache_get_t *MBEDTLS_PRIVATE(f_get_cache); + /** Callback to store a session into the cache */ + mbedtls_ssl_cache_set_t *MBEDTLS_PRIVATE(f_set_cache); + void *MBEDTLS_PRIVATE(p_cache); /*!< context for cache callbacks */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + /** Callback for setting cert according to SNI extension */ + int(*MBEDTLS_PRIVATE(f_sni))(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_sni); /*!< context for SNI callback */ +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int(*MBEDTLS_PRIVATE(f_vrfy))(void *, mbedtls_x509_crt *, int, uint32_t *); + void *MBEDTLS_PRIVATE(p_vrfy); /*!< context for X.509 verify calllback */ +#endif + +#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) +#if defined(MBEDTLS_SSL_SRV_C) + /** Callback to retrieve PSK key from identity */ + int(*MBEDTLS_PRIVATE(f_psk))(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_psk); /*!< context for PSK callback */ +#endif +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a cookie for ClientHello verification */ + int(*MBEDTLS_PRIVATE(f_cookie_write))(void *, unsigned char **, unsigned char *, + const unsigned char *, size_t); + /** Callback to verify validity of a ClientHello cookie */ + int(*MBEDTLS_PRIVATE(f_cookie_check))(void *, const unsigned char *, size_t, + const unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_cookie); /*!< context for the cookie callbacks */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a session ticket */ + int(*MBEDTLS_PRIVATE(f_ticket_write))(void *, const mbedtls_ssl_session *, + unsigned char *, const unsigned char *, size_t *, + uint32_t *); + /** Callback to parse a session ticket into a session structure */ + int(*MBEDTLS_PRIVATE(f_ticket_parse))(void *, mbedtls_ssl_session *, unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_ticket); /*!< context for the ticket callbacks */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + size_t MBEDTLS_PRIVATE(cid_len); /*!< The length of CIDs for incoming DTLS records. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + const mbedtls_x509_crt_profile *MBEDTLS_PRIVATE(cert_profile); /*!< verification profile */ + mbedtls_ssl_key_cert *MBEDTLS_PRIVATE(key_cert); /*!< own certificate/key pair(s) */ + mbedtls_x509_crt *MBEDTLS_PRIVATE(ca_chain); /*!< trusted CAs */ + mbedtls_x509_crl *MBEDTLS_PRIVATE(ca_crl); /*!< trusted CAs CRLs */ +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + mbedtls_x509_crt_ca_cb_t MBEDTLS_PRIVATE(f_ca_cb); + void *MBEDTLS_PRIVATE(p_ca_cb); +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) + mbedtls_ssl_async_sign_t *MBEDTLS_PRIVATE(f_async_sign_start); /*!< start asynchronous signature operation */ + mbedtls_ssl_async_decrypt_t *MBEDTLS_PRIVATE(f_async_decrypt_start); /*!< start asynchronous decryption operation */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + mbedtls_ssl_async_resume_t *MBEDTLS_PRIVATE(f_async_resume); /*!< resume asynchronous operation */ + mbedtls_ssl_async_cancel_t *MBEDTLS_PRIVATE(f_async_cancel); /*!< cancel asynchronous operation */ + void *MBEDTLS_PRIVATE(p_async_config_data); /*!< Configuration data set by mbedtls_ssl_conf_async_private_cb(). */ +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + const int *MBEDTLS_PRIVATE(sig_hashes); /*!< allowed signature hashes */ +#endif + const uint16_t *MBEDTLS_PRIVATE(sig_algs); /*!< allowed signature algorithms */ +#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ + +#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED) + const mbedtls_ecp_group_id *MBEDTLS_PRIVATE(curve_list); /*!< allowed curves */ +#endif + + const uint16_t *MBEDTLS_PRIVATE(group_list); /*!< allowed IANA NamedGroups */ + +#if defined(MBEDTLS_DHM_C) + mbedtls_mpi MBEDTLS_PRIVATE(dhm_P); /*!< prime modulus for DHM */ + mbedtls_mpi MBEDTLS_PRIVATE(dhm_G); /*!< generator for DHM */ +#endif + +#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(psk_opaque); /*!< PSA key slot holding opaque PSK. This field + * should only be set via + * mbedtls_ssl_conf_psk_opaque(). + * If either no PSK or a raw PSK have been + * configured, this has value \c 0. + */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + unsigned char *MBEDTLS_PRIVATE(psk); /*!< The raw pre-shared key. This field should + * only be set via mbedtls_ssl_conf_psk(). + * If either no PSK or an opaque PSK + * have been configured, this has value NULL. */ + size_t MBEDTLS_PRIVATE(psk_len); /*!< The length of the raw pre-shared key. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL. */ + + unsigned char *MBEDTLS_PRIVATE(psk_identity); /*!< The PSK identity for PSK negotiation. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * This is set if and only if either + * \c psk or \c psk_opaque are set. */ + size_t MBEDTLS_PRIVATE(psk_identity_len);/*!< The length of PSK identity. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL or \c psk_opaque + * is not \c 0. */ +#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */ + +#if defined(MBEDTLS_SSL_EARLY_DATA) + int MBEDTLS_PRIVATE(early_data_enabled); /*!< Early data enablement: + * - MBEDTLS_SSL_EARLY_DATA_DISABLED, + * - MBEDTLS_SSL_EARLY_DATA_ENABLED */ + +#if defined(MBEDTLS_SSL_SRV_C) + /* The maximum amount of 0-RTT data. RFC 8446 section 4.6.1 */ + uint32_t MBEDTLS_PRIVATE(max_early_data_size); +#endif /* MBEDTLS_SSL_SRV_C */ + +#endif /* MBEDTLS_SSL_EARLY_DATA */ + +#if defined(MBEDTLS_SSL_ALPN) + const char **MBEDTLS_PRIVATE(alpn_list); /*!< ordered list of protocols */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /*! ordered list of supported srtp profile */ + const mbedtls_ssl_srtp_profile *MBEDTLS_PRIVATE(dtls_srtp_profile_list); + /*! number of supported profiles */ + size_t MBEDTLS_PRIVATE(dtls_srtp_profile_list_len); +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + + /* + * Numerical settings (int) + */ + + uint32_t MBEDTLS_PRIVATE(read_timeout); /*!< timeout for mbedtls_ssl_read (ms) */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint32_t MBEDTLS_PRIVATE(hs_timeout_min); /*!< initial value of the handshake + retransmission timeout (ms) */ + uint32_t MBEDTLS_PRIVATE(hs_timeout_max); /*!< maximum value of the handshake + retransmission timeout (ms) */ +#endif + +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int MBEDTLS_PRIVATE(renego_max_records); /*!< grace period for renegotiation */ + unsigned char MBEDTLS_PRIVATE(renego_period)[8]; /*!< value of the record counters + that triggers renegotiation */ +#endif + + unsigned int MBEDTLS_PRIVATE(badmac_limit); /*!< limit of records with a bad MAC */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) + unsigned int MBEDTLS_PRIVATE(dhm_min_bitlen); /*!< min. bit length of the DHM prime */ +#endif + + /** User data pointer or handle. + * + * The library sets this to \p 0 when creating a context and does not + * access it afterwards. + */ + mbedtls_ssl_user_data_t MBEDTLS_PRIVATE(user_data); + +#if defined(MBEDTLS_SSL_SRV_C) + mbedtls_ssl_hs_cb_t MBEDTLS_PRIVATE(f_cert_cb); /*!< certificate selection callback */ +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) + const mbedtls_x509_crt *MBEDTLS_PRIVATE(dn_hints);/*!< acceptable client cert issuers */ +#endif +}; + +struct mbedtls_ssl_context { + const mbedtls_ssl_config *MBEDTLS_PRIVATE(conf); /*!< configuration information */ + + /* + * Miscellaneous + */ + int MBEDTLS_PRIVATE(state); /*!< SSL handshake: current state */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int MBEDTLS_PRIVATE(renego_status); /*!< Initial, in progress, pending? */ + int MBEDTLS_PRIVATE(renego_records_seen); /*!< Records since renego request, or with DTLS, + number of retransmissions of request if + renego_max_records is < 0 */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + + /** + * Maximum TLS version to be negotiated, then negotiated TLS version. + * + * It is initialized as the configured maximum TLS version to be + * negotiated by mbedtls_ssl_setup(). + * + * When renegotiating or resuming a session, it is overwritten in the + * ClientHello writing preparation stage with the previously negotiated + * TLS version. + * + * On client side, it is updated to the TLS version selected by the server + * for the handshake when the ServerHello is received. + * + * On server side, it is updated to the TLS version the server selects for + * the handshake when the ClientHello is received. + */ + mbedtls_ssl_protocol_version MBEDTLS_PRIVATE(tls_version); + +#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) + /** + * State of the negotiation and transfer of early data. Reset to + * MBEDTLS_SSL_EARLY_DATA_STATE_IDLE when the context is reset. + */ + int MBEDTLS_PRIVATE(early_data_state); +#endif + + /** Multipurpose field. + * + * - DTLS: records with a bad MAC received. + * - TLS: accumulated length of handshake fragments (up to \c in_hslen). + * + * This field is multipurpose in order to preserve the ABI in the + * Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + * and called `badmac_seen`. + */ + unsigned MBEDTLS_PRIVATE(badmac_seen_or_in_hsfraglen); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int(*MBEDTLS_PRIVATE(f_vrfy))(void *, mbedtls_x509_crt *, int, uint32_t *); + void *MBEDTLS_PRIVATE(p_vrfy); /*!< context for X.509 verify callback */ +#endif + + mbedtls_ssl_send_t *MBEDTLS_PRIVATE(f_send); /*!< Callback for network send */ + mbedtls_ssl_recv_t *MBEDTLS_PRIVATE(f_recv); /*!< Callback for network receive */ + mbedtls_ssl_recv_timeout_t *MBEDTLS_PRIVATE(f_recv_timeout); + /*!< Callback for network receive with timeout */ + + void *MBEDTLS_PRIVATE(p_bio); /*!< context for I/O operations */ + + /* + * Session layer + */ + mbedtls_ssl_session *MBEDTLS_PRIVATE(session_in); /*!< current session data (in) */ + mbedtls_ssl_session *MBEDTLS_PRIVATE(session_out); /*!< current session data (out) */ + mbedtls_ssl_session *MBEDTLS_PRIVATE(session); /*!< negotiated session data */ + mbedtls_ssl_session *MBEDTLS_PRIVATE(session_negotiate); /*!< session data in negotiation */ + + mbedtls_ssl_handshake_params *MBEDTLS_PRIVATE(handshake); /*!< params required only during + the handshake process */ + + /* + * Record layer transformations + */ + mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_in); /*!< current transform params (in) + * This is always a reference, + * never an owning pointer. */ + mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_out); /*!< current transform params (out) + * This is always a reference, + * never an owning pointer. */ + mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform); /*!< negotiated transform params + * This pointer owns the transform + * it references. */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) + mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_negotiate); /*!< transform params in negotiation + * This pointer owns the transform + * it references. */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + /*! The application data transform in TLS 1.3. + * This pointer owns the transform it references. */ + mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_application); +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + + /* + * Timers + */ + void *MBEDTLS_PRIVATE(p_timer); /*!< context for the timer callbacks */ + + mbedtls_ssl_set_timer_t *MBEDTLS_PRIVATE(f_set_timer); /*!< set timer callback */ + mbedtls_ssl_get_timer_t *MBEDTLS_PRIVATE(f_get_timer); /*!< get timer callback */ + + /* + * Record layer (incoming data) + */ + unsigned char *MBEDTLS_PRIVATE(in_buf); /*!< input buffer */ + unsigned char *MBEDTLS_PRIVATE(in_ctr); /*!< 64-bit incoming message counter + TLS: maintained by us + DTLS: read from peer */ + unsigned char *MBEDTLS_PRIVATE(in_hdr); /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *MBEDTLS_PRIVATE(in_cid); /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *MBEDTLS_PRIVATE(in_len); /*!< two-bytes message length field */ + unsigned char *MBEDTLS_PRIVATE(in_iv); /*!< ivlen-byte IV */ + unsigned char *MBEDTLS_PRIVATE(in_msg); /*!< message contents (in_iv+ivlen) */ + unsigned char *MBEDTLS_PRIVATE(in_offt); /*!< read offset in application data */ + + int MBEDTLS_PRIVATE(in_msgtype); /*!< record header: message type */ + size_t MBEDTLS_PRIVATE(in_msglen); /*!< record header: message length */ + size_t MBEDTLS_PRIVATE(in_left); /*!< amount of data read so far */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t MBEDTLS_PRIVATE(in_buf_len); /*!< length of input buffer */ +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t MBEDTLS_PRIVATE(in_epoch); /*!< DTLS epoch for incoming records */ + size_t MBEDTLS_PRIVATE(next_record_offset); /*!< offset of the next record in datagram + (equal to in_left if none) */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint64_t MBEDTLS_PRIVATE(in_window_top); /*!< last validated record seq_num */ + uint64_t MBEDTLS_PRIVATE(in_window); /*!< bitmask for replay detection */ +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + + size_t MBEDTLS_PRIVATE(in_hslen); /*!< current handshake message length, + including the handshake header */ + int MBEDTLS_PRIVATE(nb_zero); /*!< # of 0-length encrypted messages */ + + int MBEDTLS_PRIVATE(keep_current_message); /*!< drop or reuse current message + on next call to record layer? */ + + /* The following three variables indicate if and, if yes, + * what kind of alert is pending to be sent. + */ + unsigned char MBEDTLS_PRIVATE(send_alert); /*!< Determines if a fatal alert + should be sent. Values: + - \c 0 , no alert is to be sent. + - \c 1 , alert is to be sent. */ + unsigned char MBEDTLS_PRIVATE(alert_type); /*!< Type of alert if send_alert + != 0 */ + int MBEDTLS_PRIVATE(alert_reason); /*!< The error code to be returned + to the user once the fatal alert + has been sent. */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint8_t MBEDTLS_PRIVATE(disable_datagram_packing); /*!< Disable packing multiple records + * within a single datagram. */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_EARLY_DATA) +#if defined(MBEDTLS_SSL_SRV_C) + /* + * One of: + * MBEDTLS_SSL_EARLY_DATA_NO_DISCARD + * MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD + * MBEDTLS_SSL_EARLY_DATA_DISCARD + */ + uint8_t MBEDTLS_PRIVATE(discard_early_data_record); +#endif + uint32_t MBEDTLS_PRIVATE(total_early_data_size); /*!< Number of received/written early data bytes */ +#endif /* MBEDTLS_SSL_EARLY_DATA */ + + /* + * Record layer (outgoing data) + */ + unsigned char *MBEDTLS_PRIVATE(out_buf); /*!< output buffer */ + unsigned char *MBEDTLS_PRIVATE(out_ctr); /*!< 64-bit outgoing message counter */ + unsigned char *MBEDTLS_PRIVATE(out_hdr); /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *MBEDTLS_PRIVATE(out_cid); /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *MBEDTLS_PRIVATE(out_len); /*!< two-bytes message length field */ + unsigned char *MBEDTLS_PRIVATE(out_iv); /*!< ivlen-byte IV */ + unsigned char *MBEDTLS_PRIVATE(out_msg); /*!< message contents (out_iv+ivlen) */ + + int MBEDTLS_PRIVATE(out_msgtype); /*!< record header: message type */ + size_t MBEDTLS_PRIVATE(out_msglen); /*!< record header: message length */ + size_t MBEDTLS_PRIVATE(out_left); /*!< amount of data not yet written */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t MBEDTLS_PRIVATE(out_buf_len); /*!< length of output buffer */ +#endif + + unsigned char MBEDTLS_PRIVATE(cur_out_ctr)[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN]; /*!< Outgoing record sequence number. */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t MBEDTLS_PRIVATE(mtu); /*!< path mtu, used to fragment outgoing messages */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + + /* + * User settings + */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Expected peer CN for verification. + * + * Also used on clients for SNI, + * and for TLS 1.3 session resumption using tickets. + * + * The value of this field can be: + * - \p NULL in a newly initialized or reset context. + * - A heap-allocated copy of the last value passed to + * mbedtls_ssl_set_hostname(), if the last call had a non-null + * \p hostname argument. + * - A special value to indicate that mbedtls_ssl_set_hostname() + * was called with \p NULL (as opposed to never having been called). + * See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + * + * If this field contains the value \p NULL and the configuration option + * #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * is unset, on a TLS client, attempting to verify a server certificate + * results in the error + * #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + * + * If this field contains the special value described above, or if + * the value is \p NULL and the configuration option + * #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * is set, then the peer name verification is skipped, which may be + * insecure, especially on a client. Furthermore, on a client, the + * server_name extension is not sent, and the server name is ignored + * in TLS 1.3 session resumption using tickets. + */ + char *MBEDTLS_PRIVATE(hostname); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ALPN) + const char *MBEDTLS_PRIVATE(alpn_chosen); /*!< negotiated protocol */ +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /* + * use_srtp extension + */ + mbedtls_dtls_srtp_info MBEDTLS_PRIVATE(dtls_srtp_info); +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + + /* + * Information for DTLS hello verify + */ +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + unsigned char *MBEDTLS_PRIVATE(cli_id); /*!< transport-level ID of the client */ + size_t MBEDTLS_PRIVATE(cli_id_len); /*!< length of cli_id */ +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + + /* + * Secure renegotiation + */ + /* needed to know when to send extension on server */ + int MBEDTLS_PRIVATE(secure_renegotiation); /*!< does peer support legacy or + secure renegotiation */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + size_t MBEDTLS_PRIVATE(verify_data_len); /*!< length of verify data stored */ + char MBEDTLS_PRIVATE(own_verify_data)[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ + char MBEDTLS_PRIVATE(peer_verify_data)[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + /* CID configuration to use in subsequent handshakes. */ + + /*! The next incoming CID, chosen by the user and applying to + * all subsequent handshakes. This may be different from the + * CID currently used in case the user has re-configured the CID + * after an initial handshake. */ + unsigned char MBEDTLS_PRIVATE(own_cid)[MBEDTLS_SSL_CID_IN_LEN_MAX]; + uint8_t MBEDTLS_PRIVATE(own_cid_len); /*!< The length of \c own_cid. */ + uint8_t MBEDTLS_PRIVATE(negotiate_cid); /*!< This indicates whether the CID extension should + * be negotiated in the next handshake or not. + * Possible values are #MBEDTLS_SSL_CID_ENABLED + * and #MBEDTLS_SSL_CID_DISABLED. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + + /** Callback to export key block and master secret */ + mbedtls_ssl_export_keys_t *MBEDTLS_PRIVATE(f_export_keys); + void *MBEDTLS_PRIVATE(p_export_keys); /*!< context for key export callback */ + + /** User data pointer or handle. + * + * The library sets this to \p 0 when creating a context and does not + * access it afterwards. + * + * \warning Serializing and restoring an SSL context with + * mbedtls_ssl_context_save() and mbedtls_ssl_context_load() + * does not currently restore the user data. + */ + mbedtls_ssl_user_data_t MBEDTLS_PRIVATE(user_data); +}; + +/** + * \brief Return the name of the ciphersuite associated with the + * given ID + * + * \param ciphersuite_id SSL ciphersuite ID + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite_name(const int ciphersuite_id); + +/** + * \brief Return the ID of the ciphersuite associated with the + * given name + * + * \param ciphersuite_name SSL ciphersuite name + * + * \return the ID with the ciphersuite or 0 if not found + */ +int mbedtls_ssl_get_ciphersuite_id(const char *ciphersuite_name); + +/** + * \brief Initialize an SSL context + * Just makes the context ready for mbedtls_ssl_setup() or + * mbedtls_ssl_free() + * + * \param ssl SSL context + */ +void mbedtls_ssl_init(mbedtls_ssl_context *ssl); + +/** + * \brief Set up an SSL context for use + * + * \note No copy of the configuration context is made, it can be + * shared by many mbedtls_ssl_context structures. + * + * \warning The conf structure will be accessed during the session. + * It must not be modified or freed as long as the session + * is active. + * + * \warning This function must be called exactly once per context. + * Calling mbedtls_ssl_setup again is not supported, even + * if no session is active. + * + * \warning After setting up a client context, if certificate-based + * authentication is enabled, you should call + * mbedtls_ssl_set_hostname() to specifiy the expected + * name of the server. Without this, in most scenarios, + * the TLS connection is insecure. See + * #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * for more information. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param ssl SSL context + * \param conf SSL configuration to use + * + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if + * memory allocation failed + */ +int mbedtls_ssl_setup(mbedtls_ssl_context *ssl, + const mbedtls_ssl_config *conf); + +/** + * \brief Reset an already initialized SSL context for re-use + * while retaining application-set variables, function + * pointers and data. + * + * \param ssl SSL context + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED or + MBEDTLS_ERR_SSL_HW_ACCEL_FAILED + */ +int mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl); + +/** + * \brief Set the current endpoint type + * + * \param conf SSL configuration + * \param endpoint must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + */ +void mbedtls_ssl_conf_endpoint(mbedtls_ssl_config *conf, int endpoint); + +/** + * \brief Get the current endpoint type + * + * \param conf SSL configuration + * + * \return Endpoint type, either MBEDTLS_SSL_IS_CLIENT + * or MBEDTLS_SSL_IS_SERVER + */ +static inline int mbedtls_ssl_conf_get_endpoint(const mbedtls_ssl_config *conf) +{ + return conf->MBEDTLS_PRIVATE(endpoint); +} + +/** + * \brief Set the transport type (TLS or DTLS). + * Default: TLS + * + * \note For DTLS, you must either provide a recv callback that + * doesn't block, or one that handles timeouts, see + * \c mbedtls_ssl_set_bio(). You also need to provide timer + * callbacks with \c mbedtls_ssl_set_timer_cb(). + * + * \param conf SSL configuration + * \param transport transport type: + * MBEDTLS_SSL_TRANSPORT_STREAM for TLS, + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS. + */ +void mbedtls_ssl_conf_transport(mbedtls_ssl_config *conf, int transport); + +/** + * \brief Set the certificate verification mode + * Default: NONE on server, REQUIRED on client + * + * \param conf SSL configuration + * \param authmode can be: + * + * MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked + * (default on server) + * (insecure on client) + * + * MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the + * handshake continues even if verification failed; + * mbedtls_ssl_get_verify_result() can be called after the + * handshake is complete. + * + * MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, + * handshake is aborted if verification failed. + * (default on client) + * + * \note On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode. + * With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at + * the right time(s), which may not be obvious, while REQUIRED always perform + * the verification as soon as possible. For example, REQUIRED was protecting + * against the "triple handshake" attack even before it was found. + */ +void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *conf, int authmode); + +#if defined(MBEDTLS_SSL_EARLY_DATA) +/** + * \brief Set the early data mode + * Default: disabled on server and client + * + * \param conf The SSL configuration to use. + * \param early_data_enabled can be: + * + * MBEDTLS_SSL_EARLY_DATA_DISABLED: + * Early data functionality is disabled. This is the default on client and + * server. + * + * MBEDTLS_SSL_EARLY_DATA_ENABLED: + * Early data functionality is enabled and may be negotiated in the handshake. + * Application using early data functionality needs to be aware that the + * security properties for early data (also refered to as 0-RTT data) are + * weaker than those for other kinds of TLS data. See the documentation of + * mbedtls_ssl_write_early_data() and mbedtls_ssl_read_early_data() for more + * information. + * When early data functionality is enabled on server and only in that case, + * the call to one of the APIs that trigger or resume an handshake sequence, + * namely mbedtls_ssl_handshake(), mbedtls_ssl_handshake_step(), + * mbedtls_ssl_read() or mbedtls_ssl_write() may return with the error code + * MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA indicating that some early data have + * been received. To read the early data, call mbedtls_ssl_read_early_data() + * before calling the original function again. + */ +void mbedtls_ssl_conf_early_data(mbedtls_ssl_config *conf, + int early_data_enabled); + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the maximum amount of 0-RTT data in bytes + * Default: #MBEDTLS_SSL_MAX_EARLY_DATA_SIZE + * + * This function sets the value of the max_early_data_size + * field of the early data indication extension included in + * the NewSessionTicket messages that the server may send. + * + * The value defines the maximum amount of 0-RTT data + * in bytes that a client will be allowed to send when using + * one of the tickets defined by the NewSessionTicket messages. + * + * \note When resuming a session using a ticket, if the server receives more + * early data than allowed for the ticket, it terminates the connection. + * The maximum amount of 0-RTT data should thus be large enough + * to allow a minimum of early data to be exchanged. + * + * \param[in] conf The SSL configuration to use. + * \param[in] max_early_data_size The maximum amount of 0-RTT data. + * + * \warning This interface DOES NOT influence/limit the amount of early data + * that can be received through previously created and issued tickets, + * which clients may have stored. + */ +void mbedtls_ssl_conf_max_early_data_size( + mbedtls_ssl_config *conf, uint32_t max_early_data_size); +#endif /* MBEDTLS_SSL_SRV_C */ + +#endif /* MBEDTLS_SSL_EARLY_DATA */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the verification callback (Optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note For per context callbacks and contexts, please use + * mbedtls_ssl_set_verify() instead. + * + * \param conf The SSL configuration to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the random number generator callback + * + * \note The callback with its parameter must remain valid as + * long as there is an SSL context that uses the + * SSL configuration. + * + * \param conf SSL configuration + * \param f_rng RNG function (mandatory) + * \param p_rng RNG parameter + */ +void mbedtls_ssl_conf_rng(mbedtls_ssl_config *conf, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Set the debug callback + * + * The callback has the following argument: + * void * opaque context for the callback + * int debug level + * const char * file name + * int line number + * const char * message + * + * \param conf SSL configuration + * \param f_dbg debug function + * \param p_dbg debug parameter + */ +void mbedtls_ssl_conf_dbg(mbedtls_ssl_config *conf, + void (*f_dbg)(void *, int, const char *, int, const char *), + void *p_dbg); + +/** + * \brief Return the SSL configuration structure associated + * with the given SSL context. + * + * \note The pointer returned by this function is guaranteed to + * remain valid until the context is freed. + * + * \param ssl The SSL context to query. + * \return Pointer to the SSL configuration associated with \p ssl. + */ +static inline const mbedtls_ssl_config *mbedtls_ssl_context_get_config( + const mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(conf); +} + +/** + * \brief Set the underlying BIO callbacks for write, read and + * read-with-timeout. + * + * \param ssl SSL context + * \param p_bio parameter (context) shared by BIO callbacks + * \param f_send write callback + * \param f_recv read callback + * \param f_recv_timeout blocking read callback with timeout. + * + * \note One of f_recv or f_recv_timeout can be NULL, in which case + * the other is used. If both are non-NULL, f_recv_timeout is + * used and f_recv is ignored (as if it were NULL). + * + * \note The two most common use cases are: + * - non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL + * - blocking I/O, f_recv == NULL, f_recv_timeout != NULL + * + * \note For DTLS, you need to provide either a non-NULL + * f_recv_timeout callback, or a f_recv that doesn't block. + * + * \note See the documentations of \c mbedtls_ssl_send_t, + * \c mbedtls_ssl_recv_t and \c mbedtls_ssl_recv_timeout_t for + * the conventions those callbacks must follow. + * + * \note On some platforms, net_sockets.c provides + * \c mbedtls_net_send(), \c mbedtls_net_recv() and + * \c mbedtls_net_recv_timeout() that are suitable to be used + * here. + */ +void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl, + void *p_bio, + mbedtls_ssl_send_t *f_send, + mbedtls_ssl_recv_t *f_recv, + mbedtls_ssl_recv_timeout_t *f_recv_timeout); + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + + +/** + * \brief Configure the use of the Connection ID (CID) + * extension in the next handshake. + * + * Reference: RFC 9146 (or draft-ietf-tls-dtls-connection-id-05 + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 + * for legacy version) + * + * The DTLS CID extension allows the reliable association of + * DTLS records to DTLS connections across changes in the + * underlying transport (changed IP and Port metadata) by + * adding explicit connection identifiers (CIDs) to the + * headers of encrypted DTLS records. The desired CIDs are + * configured by the application layer and are exchanged in + * new `ClientHello` / `ServerHello` extensions during the + * handshake, where each side indicates the CID it wants the + * peer to use when writing encrypted messages. The CIDs are + * put to use once records get encrypted: the stack discards + * any incoming records that don't include the configured CID + * in their header, and adds the peer's requested CID to the + * headers of outgoing messages. + * + * This API enables or disables the use of the CID extension + * in the next handshake and sets the value of the CID to + * be used for incoming messages. + * + * \param ssl The SSL context to configure. This must be initialized. + * \param enable This value determines whether the CID extension should + * be used or not. Possible values are: + * - MBEDTLS_SSL_CID_ENABLED to enable the use of the CID. + * - MBEDTLS_SSL_CID_DISABLED (default) to disable the use + * of the CID. + * \param own_cid The address of the readable buffer holding the CID we want + * the peer to use when sending encrypted messages to us. + * This may be \c NULL if \p own_cid_len is \c 0. + * This parameter is unused if \p enable is set to + * MBEDTLS_SSL_CID_DISABLED. + * \param own_cid_len The length of \p own_cid. + * This parameter is unused if \p enable is set to + * MBEDTLS_SSL_CID_DISABLED. + * + * \note The value of \p own_cid_len must match the value of the + * \c len parameter passed to mbedtls_ssl_conf_cid() + * when configuring the ::mbedtls_ssl_config that \p ssl + * is bound to. + * + * \note This CID configuration applies to subsequent handshakes + * performed on the SSL context \p ssl, but does not trigger + * one. You still have to call `mbedtls_ssl_handshake()` + * (for the initial handshake) or `mbedtls_ssl_renegotiate()` + * (for a renegotiation handshake) explicitly after a + * successful call to this function to run the handshake. + * + * \note This call cannot guarantee that the use of the CID + * will be successfully negotiated in the next handshake, + * because the peer might not support it. Specifically: + * - On the Client, enabling the use of the CID through + * this call implies that the `ClientHello` in the next + * handshake will include the CID extension, thereby + * offering the use of the CID to the server. Only if + * the `ServerHello` contains the CID extension, too, + * the CID extension will actually be put to use. + * - On the Server, enabling the use of the CID through + * this call implies that the server will look for + * the CID extension in a `ClientHello` from the client, + * and, if present, reply with a CID extension in its + * `ServerHello`. + * + * \note To check whether the use of the CID was negotiated + * after the subsequent handshake has completed, please + * use the API mbedtls_ssl_get_peer_cid(). + * + * \warning If the use of the CID extension is enabled in this call + * and the subsequent handshake negotiates its use, Mbed TLS + * will silently drop every packet whose CID does not match + * the CID configured in \p own_cid. It is the responsibility + * of the user to adapt the underlying transport to take care + * of CID-based demultiplexing before handing datagrams to + * Mbed TLS. + * + * \return \c 0 on success. In this case, the CID configuration + * applies to the next handshake. + * \return A negative error code on failure. + */ +int mbedtls_ssl_set_cid(mbedtls_ssl_context *ssl, + int enable, + unsigned char const *own_cid, + size_t own_cid_len); + +/** + * \brief Get information about our request for usage of the CID + * extension in the current connection. + * + * \param ssl The SSL context to query. + * \param enabled The address at which to store whether the CID extension + * is requested to be used or not. If the CID is + * requested, `*enabled` is set to + * MBEDTLS_SSL_CID_ENABLED; otherwise, it is set to + * MBEDTLS_SSL_CID_DISABLED. + * \param own_cid The address of the buffer in which to store our own + * CID (if the CID extension is requested). This may be + * \c NULL in case the value of our CID isn't needed. If + * it is not \c NULL, \p own_cid_len must not be \c NULL. + * \param own_cid_len The address at which to store the size of our own CID + * (if the CID extension is requested). This is also the + * number of Bytes in \p own_cid that have been written. + * This may be \c NULL in case the length of our own CID + * isn't needed. If it is \c NULL, \p own_cid must be + * \c NULL, too. + * + *\note If we are requesting an empty CID this function sets + * `*enabled` to #MBEDTLS_SSL_CID_DISABLED (the rationale + * for this is that the resulting outcome is the + * same as if the CID extensions wasn't requested). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_ssl_get_own_cid(mbedtls_ssl_context *ssl, + int *enabled, + unsigned char own_cid[MBEDTLS_SSL_CID_IN_LEN_MAX], + size_t *own_cid_len); + +/** + * \brief Get information about the use of the CID extension + * in the current connection. + * + * \param ssl The SSL context to query. + * \param enabled The address at which to store whether the CID extension + * is currently in use or not. If the CID is in use, + * `*enabled` is set to MBEDTLS_SSL_CID_ENABLED; + * otherwise, it is set to MBEDTLS_SSL_CID_DISABLED. + * \param peer_cid The address of the buffer in which to store the CID + * chosen by the peer (if the CID extension is used). + * This may be \c NULL in case the value of peer CID + * isn't needed. If it is not \c NULL, \p peer_cid_len + * must not be \c NULL. + * \param peer_cid_len The address at which to store the size of the CID + * chosen by the peer (if the CID extension is used). + * This is also the number of Bytes in \p peer_cid that + * have been written. + * This may be \c NULL in case the length of the peer CID + * isn't needed. If it is \c NULL, \p peer_cid must be + * \c NULL, too. + * + * \note This applies to the state of the CID negotiated in + * the last complete handshake. If a handshake is in + * progress, this function will attempt to complete + * the handshake first. + * + * \note If CID extensions have been exchanged but both client + * and server chose to use an empty CID, this function + * sets `*enabled` to #MBEDTLS_SSL_CID_DISABLED + * (the rationale for this is that the resulting + * communication is the same as if the CID extensions + * hadn't been used). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_ssl_get_peer_cid(mbedtls_ssl_context *ssl, + int *enabled, + unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX], + size_t *peer_cid_len); + +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +/** + * \brief Set the Maximum Transport Unit (MTU). + * Special value: 0 means unset (no limit). + * This represents the maximum size of a datagram payload + * handled by the transport layer (usually UDP) as determined + * by the network link and stack. In practice, this controls + * the maximum size datagram the DTLS layer will pass to the + * \c f_send() callback set using \c mbedtls_ssl_set_bio(). + * + * \note The limit on datagram size is converted to a limit on + * record payload by subtracting the current overhead of + * encapsulation and encryption/authentication if any. + * + * \note This can be called at any point during the connection, for + * example when a Path Maximum Transfer Unit (PMTU) + * estimate becomes available from other sources, + * such as lower (or higher) protocol layers. + * + * \note This setting only controls the size of the packets we send, + * and does not restrict the size of the datagrams we're + * willing to receive. Client-side, you can request the + * server to use smaller records with \c + * mbedtls_ssl_conf_max_frag_len(). + * + * \note If both a MTU and a maximum fragment length have been + * configured (or negotiated with the peer), the resulting + * lower limit on record payload (see first note) is used. + * + * \note This can only be used to decrease the maximum size + * of datagrams (hence records, see first note) sent. It + * cannot be used to increase the maximum size of records over + * the limit set by #MBEDTLS_SSL_OUT_CONTENT_LEN. + * + * \note Values lower than the current record layer expansion will + * result in an error when trying to send data. + * + * \param ssl SSL context + * \param mtu Value of the path MTU in bytes + */ +void mbedtls_ssl_set_mtu(mbedtls_ssl_context *ssl, uint16_t mtu); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set a connection-specific verification callback (optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note This call is analogous to mbedtls_ssl_conf_verify() but + * binds the verification callback and context to an SSL context + * as opposed to an SSL configuration. + * If mbedtls_ssl_conf_verify() and mbedtls_ssl_set_verify() + * are both used, mbedtls_ssl_set_verify() takes precedence. + * + * \param ssl The SSL context to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the timeout period for mbedtls_ssl_read() + * (Default: no timeout.) + * + * \param conf SSL configuration context + * \param timeout Timeout value in milliseconds. + * Use 0 for no timeout (default). + * + * \note With blocking I/O, this will only work if a non-NULL + * \c f_recv_timeout was set with \c mbedtls_ssl_set_bio(). + * With non-blocking I/O, this will only work if timer + * callbacks were set with \c mbedtls_ssl_set_timer_cb(). + * + * \note With non-blocking I/O, you may also skip this function + * altogether and handle timeouts at the application layer. + */ +void mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config *conf, uint32_t timeout); + +/** + * \brief Check whether a buffer contains a valid and authentic record + * that has not been seen before. (DTLS only). + * + * This function does not change the user-visible state + * of the SSL context. Its sole purpose is to provide + * an indication of the legitimacy of an incoming record. + * + * This can be useful e.g. in distributed server environments + * using the DTLS Connection ID feature, in which connections + * might need to be passed between service instances on a change + * of peer address, but where such disruptive operations should + * only happen after the validity of incoming records has been + * confirmed. + * + * \param ssl The SSL context to use. + * \param buf The address of the buffer holding the record to be checked. + * This must be a read/write buffer of length \p buflen Bytes. + * \param buflen The length of \p buf in Bytes. + * + * \note This routine only checks whether the provided buffer begins + * with a valid and authentic record that has not been seen + * before, but does not check potential data following the + * initial record. In particular, it is possible to pass DTLS + * datagrams containing multiple records, in which case only + * the first record is checked. + * + * \note This function modifies the input buffer \p buf. If you need + * to preserve the original record, you have to maintain a copy. + * + * \return \c 0 if the record is valid and authentic and has not been + * seen before. + * \return MBEDTLS_ERR_SSL_INVALID_MAC if the check completed + * successfully but the record was found to be not authentic. + * \return MBEDTLS_ERR_SSL_INVALID_RECORD if the check completed + * successfully but the record was found to be invalid for + * a reason different from authenticity checking. + * \return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD if the check completed + * successfully but the record was found to be unexpected + * in the state of the SSL context, including replayed records. + * \return Another negative error code on different kinds of failure. + * In this case, the SSL context becomes unusable and needs + * to be freed or reset before reuse. + */ +int mbedtls_ssl_check_record(mbedtls_ssl_context const *ssl, + unsigned char *buf, + size_t buflen); + +/** + * \brief Set the timer callbacks (Mandatory for DTLS.) + * + * \param ssl SSL context + * \param p_timer parameter (context) shared by timer callbacks + * \param f_set_timer set timer callback + * \param f_get_timer get timer callback. Must return: + * + * \note See the documentation of \c mbedtls_ssl_set_timer_t and + * \c mbedtls_ssl_get_timer_t for the conventions this pair of + * callbacks must follow. + * + * \note On some platforms, timing.c provides + * \c mbedtls_timing_set_delay() and + * \c mbedtls_timing_get_delay() that are suitable for using + * here, except if using an event-driven style. + * + * \note See also the "DTLS tutorial" article in our knowledge base. + * https://mbed-tls.readthedocs.io/en/latest/kb/how-to/dtls-tutorial + */ +void mbedtls_ssl_set_timer_cb(mbedtls_ssl_context *ssl, + void *p_timer, + mbedtls_ssl_set_timer_t *f_set_timer, + mbedtls_ssl_get_timer_t *f_get_timer); + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the certificate selection callback (server-side only). + * + * If set, the callback is always called for each handshake, + * after `ClientHello` processing has finished. + * + * \param conf The SSL configuration to register the callback with. + * \param f_cert_cb The callback for selecting server certificate after + * `ClientHello` processing has finished. + */ +static inline void mbedtls_ssl_conf_cert_cb(mbedtls_ssl_config *conf, + mbedtls_ssl_hs_cb_t f_cert_cb) +{ + conf->MBEDTLS_PRIVATE(f_cert_cb) = f_cert_cb; +} +#endif /* MBEDTLS_SSL_SRV_C */ + +/** + * \brief Callback type: generate and write session ticket + * + * \note This describes what a callback implementation should do. + * This callback should generate an encrypted and + * authenticated ticket for the session and write it to the + * output buffer. Here, ticket means the opaque ticket part + * of the NewSessionTicket structure of RFC 5077. + * + * \param p_ticket Context for the callback + * \param session SSL session to be written in the ticket + * \param start Start of the output buffer + * \param end End of the output buffer + * \param tlen On exit, holds the length written + * \param lifetime On exit, holds the lifetime of the ticket in seconds + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_ticket_write_t(void *p_ticket, + const mbedtls_ssl_session *session, + unsigned char *start, + const unsigned char *end, + size_t *tlen, + uint32_t *lifetime); + +/** + * \brief Callback type: parse and load session ticket + * + * \note This describes what a callback implementation should do. + * This callback should parse a session ticket as generated + * by the corresponding mbedtls_ssl_ticket_write_t function, + * and, if the ticket is authentic and valid, load the + * session. + * + * \note The implementation is allowed to modify the first len + * bytes of the input buffer, eg to use it as a temporary + * area for the decrypted ticket contents. + * + * \param p_ticket Context for the callback + * \param session SSL session to be loaded + * \param buf Start of the buffer containing the ticket + * \param len Length of the ticket. + * + * \return 0 if successful, or + * MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or + * MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or + * any other non-zero code for other failures. + */ +typedef int mbedtls_ssl_ticket_parse_t(void *p_ticket, + mbedtls_ssl_session *session, + unsigned char *buf, + size_t len); + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Configure SSL session ticket callbacks (server only). + * (Default: none.) + * + * \note On server, session tickets are enabled by providing + * non-NULL callbacks. + * + * \note On client, use \c mbedtls_ssl_conf_session_tickets(). + * + * \param conf SSL configuration context + * \param f_ticket_write Callback for writing a ticket + * \param f_ticket_parse Callback for parsing a ticket + * \param p_ticket Context shared by the two callbacks + */ +void mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config *conf, + mbedtls_ssl_ticket_write_t *f_ticket_write, + mbedtls_ssl_ticket_parse_t *f_ticket_parse, + void *p_ticket); + +#if defined(MBEDTLS_HAVE_TIME) +/** + * \brief Get the creation time of a session ticket. + * + * \note See the documentation of \c ticket_creation_time for information about + * the intended usage of this function. + * + * \param session SSL session + * \param ticket_creation_time On exit, holds the ticket creation time in + * milliseconds. + * + * \return 0 on success, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if an input is not valid. + */ +static inline int mbedtls_ssl_session_get_ticket_creation_time( + mbedtls_ssl_session *session, mbedtls_ms_time_t *ticket_creation_time) +{ + if (session == NULL || ticket_creation_time == NULL || + session->MBEDTLS_PRIVATE(endpoint) != MBEDTLS_SSL_IS_SERVER) { + return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; + } + + *ticket_creation_time = session->MBEDTLS_PRIVATE(ticket_creation_time); + + return 0; +} +#endif /* MBEDTLS_HAVE_TIME */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ + +/** + * \brief Get the session-id buffer. + * + * \param session SSL session. + * + * \return The address of the session-id buffer. + */ +static inline unsigned const char (*mbedtls_ssl_session_get_id(const mbedtls_ssl_session * + session))[32] +{ + return &session->MBEDTLS_PRIVATE(id); +} + +/** + * \brief Get the size of the session-id. + * + * \param session SSL session. + * + * \return size_t size of session-id buffer. + */ +static inline size_t mbedtls_ssl_session_get_id_len(const mbedtls_ssl_session *session) +{ + return session->MBEDTLS_PRIVATE(id_len); +} + +/** + * \brief Get the ciphersuite-id. + * + * \param session SSL session. + * + * \return int represetation for ciphersuite. + */ +static inline int mbedtls_ssl_session_get_ciphersuite_id(const mbedtls_ssl_session *session) +{ + return session->MBEDTLS_PRIVATE(ciphersuite); +} + +/** + * \brief Configure a key export callback. + * (Default: none.) + * + * This API can be used for two purposes: + * - Debugging: Use this API to e.g. generate an NSSKeylog + * file and use it to inspect encrypted traffic in tools + * such as Wireshark. + * - Application-specific export: Use this API to implement + * key exporters, e.g. for EAP-TLS or DTLS-SRTP. + * + * + * \param ssl The SSL context to which the export + * callback should be attached. + * \param f_export_keys The callback for the key export. + * \param p_export_keys The opaque context pointer to be passed to the + * callback \p f_export_keys. + */ +void mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context *ssl, + mbedtls_ssl_export_keys_t *f_export_keys, + void *p_export_keys); + +/** \brief Set the user data in an SSL configuration to a pointer. + * + * You can retrieve this value later with mbedtls_ssl_conf_get_user_data_p(). + * + * \note The library stores \c p without accessing it. It is the responsibility + * of the caller to ensure that the pointer remains valid. + * + * \param conf The SSL configuration context to modify. + * \param p The new value of the user data. + */ +static inline void mbedtls_ssl_conf_set_user_data_p( + mbedtls_ssl_config *conf, + void *p) +{ + conf->MBEDTLS_PRIVATE(user_data).p = p; +} + +/** \brief Set the user data in an SSL configuration to an integer. + * + * You can retrieve this value later with mbedtls_ssl_conf_get_user_data_n(). + * + * \param conf The SSL configuration context to modify. + * \param n The new value of the user data. + */ +static inline void mbedtls_ssl_conf_set_user_data_n( + mbedtls_ssl_config *conf, + uintptr_t n) +{ + conf->MBEDTLS_PRIVATE(user_data).n = n; +} + +/** \brief Retrieve the user data in an SSL configuration as a pointer. + * + * This is the value last set with mbedtls_ssl_conf_set_user_data_p(), or + * \c NULL if mbedtls_ssl_conf_set_user_data_p() has not previously been + * called. The value is undefined if mbedtls_ssl_conf_set_user_data_n() has + * been called without a subsequent call to mbedtls_ssl_conf_set_user_data_p(). + * + * \param conf The SSL configuration context to modify. + * \return The current value of the user data. + */ +static inline void *mbedtls_ssl_conf_get_user_data_p( + mbedtls_ssl_config *conf) +{ + return conf->MBEDTLS_PRIVATE(user_data).p; +} + +/** \brief Retrieve the user data in an SSL configuration as an integer. + * + * This is the value last set with mbedtls_ssl_conf_set_user_data_n(), or + * \c 0 if mbedtls_ssl_conf_set_user_data_n() has not previously been + * called. The value is undefined if mbedtls_ssl_conf_set_user_data_p() has + * been called without a subsequent call to mbedtls_ssl_conf_set_user_data_n(). + * + * \param conf The SSL configuration context to modify. + * \return The current value of the user data. + */ +static inline uintptr_t mbedtls_ssl_conf_get_user_data_n( + mbedtls_ssl_config *conf) +{ + return conf->MBEDTLS_PRIVATE(user_data).n; +} + +/** \brief Set the user data in an SSL context to a pointer. + * + * You can retrieve this value later with mbedtls_ssl_get_user_data_p(). + * + * \note The library stores \c p without accessing it. It is the responsibility + * of the caller to ensure that the pointer remains valid. + * + * \param ssl The SSL context to modify. + * \param p The new value of the user data. + */ +static inline void mbedtls_ssl_set_user_data_p( + mbedtls_ssl_context *ssl, + void *p) +{ + ssl->MBEDTLS_PRIVATE(user_data).p = p; +} + +/** \brief Set the user data in an SSL context to an integer. + * + * You can retrieve this value later with mbedtls_ssl_get_user_data_n(). + * + * \param ssl The SSL context to modify. + * \param n The new value of the user data. + */ +static inline void mbedtls_ssl_set_user_data_n( + mbedtls_ssl_context *ssl, + uintptr_t n) +{ + ssl->MBEDTLS_PRIVATE(user_data).n = n; +} + +/** \brief Retrieve the user data in an SSL context as a pointer. + * + * This is the value last set with mbedtls_ssl_set_user_data_p(), or + * \c NULL if mbedtls_ssl_set_user_data_p() has not previously been + * called. The value is undefined if mbedtls_ssl_set_user_data_n() has + * been called without a subsequent call to mbedtls_ssl_set_user_data_p(). + * + * \param ssl The SSL context to modify. + * \return The current value of the user data. + */ +static inline void *mbedtls_ssl_get_user_data_p( + mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(user_data).p; +} + +/** \brief Retrieve the user data in an SSL context as an integer. + * + * This is the value last set with mbedtls_ssl_set_user_data_n(), or + * \c 0 if mbedtls_ssl_set_user_data_n() has not previously been + * called. The value is undefined if mbedtls_ssl_set_user_data_p() has + * been called without a subsequent call to mbedtls_ssl_set_user_data_n(). + * + * \param ssl The SSL context to modify. + * \return The current value of the user data. + */ +static inline uintptr_t mbedtls_ssl_get_user_data_n( + mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(user_data).n; +} + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +/** + * \brief Configure asynchronous private key operation callbacks. + * + * \param conf SSL configuration context + * \param f_async_sign Callback to start a signature operation. See + * the description of ::mbedtls_ssl_async_sign_t + * for more information. This may be \c NULL if the + * external processor does not support any signature + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_decrypt Callback to start a decryption operation. See + * the description of ::mbedtls_ssl_async_decrypt_t + * for more information. This may be \c NULL if the + * external processor does not support any decryption + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_resume Callback to resume an asynchronous operation. See + * the description of ::mbedtls_ssl_async_resume_t + * for more information. This may not be \c NULL unless + * \p f_async_sign and \p f_async_decrypt are both + * \c NULL. + * \param f_async_cancel Callback to cancel an asynchronous operation. See + * the description of ::mbedtls_ssl_async_cancel_t + * for more information. This may be \c NULL if + * no cleanup is needed. + * \param config_data A pointer to configuration data which can be + * retrieved with + * mbedtls_ssl_conf_get_async_config_data(). The + * library stores this value without dereferencing it. + */ +void mbedtls_ssl_conf_async_private_cb(mbedtls_ssl_config *conf, + mbedtls_ssl_async_sign_t *f_async_sign, + mbedtls_ssl_async_decrypt_t *f_async_decrypt, + mbedtls_ssl_async_resume_t *f_async_resume, + mbedtls_ssl_async_cancel_t *f_async_cancel, + void *config_data); + +/** + * \brief Retrieve the configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + * + * \param conf SSL configuration context + * \return The configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + */ +void *mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config *conf); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * + * \return The asynchronous operation user context that was last + * set during the current handshake. If + * mbedtls_ssl_set_async_operation_data() has not yet been + * called during the current handshake, this function returns + * \c NULL. + */ +void *mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context *ssl); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * \param ctx The new value of the asynchronous operation user context. + * Call mbedtls_ssl_get_async_operation_data() later during the + * same handshake to retrieve this value. + */ +void mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context *ssl, + void *ctx); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +/** + * \brief Callback type: generate a cookie + * + * \param ctx Context for the callback + * \param p Buffer to write to, + * must be updated to point right after the cookie + * \param end Pointer to one past the end of the output buffer + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 on success, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_write_t(void *ctx, + unsigned char **p, unsigned char *end, + const unsigned char *info, size_t ilen); + +/** + * \brief Callback type: verify a cookie + * + * \param ctx Context for the callback + * \param cookie Cookie to verify + * \param clen Length of cookie + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 if cookie is valid, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_check_t(void *ctx, + const unsigned char *cookie, size_t clen, + const unsigned char *info, size_t ilen); + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Register callbacks for DTLS cookies + * (Server only. DTLS only.) + * + * Default: dummy callbacks that fail, in order to force you to + * register working callbacks (and initialize their context). + * + * To disable HelloVerifyRequest, register NULL callbacks. + * + * \warning Disabling hello verification allows your server to be used + * for amplification in DoS attacks against other hosts. + * Only disable if you known this can't happen in your + * particular environment. + * + * \note See comments on \c mbedtls_ssl_handshake() about handling + * the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected + * on the first handshake attempt when this is enabled. + * + * \note This is also necessary to handle client reconnection from + * the same port as described in RFC 6347 section 4.2.8 (only + * the variant with cookies is supported currently). See + * comments on \c mbedtls_ssl_read() for details. + * + * \param conf SSL configuration + * \param f_cookie_write Cookie write callback + * \param f_cookie_check Cookie check callback + * \param p_cookie Context for both callbacks + */ +void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf, + mbedtls_ssl_cookie_write_t *f_cookie_write, + mbedtls_ssl_cookie_check_t *f_cookie_check, + void *p_cookie); + +/** + * \brief Set client's transport-level identification info. + * (Server only. DTLS only.) + * + * This is usually the IP address (and port), but could be + * anything identify the client depending on the underlying + * network stack. Used for HelloVerifyRequest with DTLS. + * This is *not* used to route the actual packets. + * + * \param ssl SSL context + * \param info Transport-level info identifying the client (eg IP + port) + * \param ilen Length of info in bytes + * + * \note An internal copy is made, so the info buffer can be reused. + * + * \return 0 on success, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory. + */ +int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl, + const unsigned char *info, + size_t ilen); + +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +/** + * \brief Enable or disable anti-replay protection for DTLS. + * (DTLS only, no effect on TLS.) + * Default: enabled. + * + * \param conf SSL configuration + * \param mode MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED. + * + * \warning Disabling this is a security risk unless the application + * protocol handles duplicated packets in a safe way. You + * should not disable this without careful consideration. + * However, if your application already detects duplicated + * packets and needs information about them to adjust its + * transmission strategy, then you'll want to disable this. + */ +void mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config *conf, char mode); +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + +/** + * \brief Set a limit on the number of records with a bad MAC + * before terminating the connection. + * (DTLS only, no effect on TLS.) + * Default: 0 (disabled). + * + * \param conf SSL configuration + * \param limit Limit, or 0 to disable. + * + * \note If the limit is N, then the connection is terminated when + * the Nth non-authentic record is seen. + * + * \note Records with an invalid header are not counted, only the + * ones going through the authentication-decryption phase. + * + * \note This is a security trade-off related to the fact that it's + * often relatively easy for an active attacker to inject UDP + * datagrams. On one hand, setting a low limit here makes it + * easier for such an attacker to forcibly terminated a + * connection. On the other hand, a high limit or no limit + * might make us waste resources checking authentication on + * many bogus packets. + */ +void mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config *conf, unsigned limit); + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +/** + * \brief Allow or disallow packing of multiple handshake records + * within a single datagram. + * + * \param ssl The SSL context to configure. + * \param allow_packing This determines whether datagram packing may + * be used or not. A value of \c 0 means that every + * record will be sent in a separate datagram; a + * value of \c 1 means that, if space permits, + * multiple handshake messages (including CCS) belonging to + * a single flight may be packed within a single datagram. + * + * \note This is enabled by default and should only be disabled + * for test purposes, or if datagram packing causes + * interoperability issues with peers that don't support it. + * + * \note Allowing datagram packing reduces the network load since + * there's less overhead if multiple messages share the same + * datagram. Also, it increases the handshake efficiency + * since messages belonging to a single datagram will not + * be reordered in transit, and so future message buffering + * or flight retransmission (if no buffering is used) as + * means to deal with reordering are needed less frequently. + * + * \note Application records are not affected by this option and + * are currently always sent in separate datagrams. + * + */ +void mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context *ssl, + unsigned allow_packing); + +/** + * \brief Set retransmit timeout values for the DTLS handshake. + * (DTLS only, no effect on TLS.) + * + * \param conf SSL configuration + * \param min Initial timeout value in milliseconds. + * Default: 1000 (1 second). + * \param max Maximum timeout value in milliseconds. + * Default: 60000 (60 seconds). + * + * \note Default values are from RFC 6347 section 4.2.4.1. + * + * \note The 'min' value should typically be slightly above the + * expected round-trip time to your peer, plus whatever time + * it takes for the peer to process the message. For example, + * if your RTT is about 600ms and you peer needs up to 1s to + * do the cryptographic operations in the handshake, then you + * should set 'min' slightly above 1600. Lower values of 'min' + * might cause spurious resends which waste network resources, + * while larger value of 'min' will increase overall latency + * on unreliable network links. + * + * \note The more unreliable your network connection is, the larger + * your max / min ratio needs to be in order to achieve + * reliable handshakes. + * + * \note Messages are retransmitted up to log2(ceil(max/min)) times. + * For example, if min = 1s and max = 5s, the retransmit plan + * goes: send ... 1s -> resend ... 2s -> resend ... 4s -> + * resend ... 5s -> give up and return a timeout error. + */ +void mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config *conf, uint32_t min, uint32_t max); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the session cache callbacks (server-side only) + * If not set, no session resuming is done (except if session + * tickets are enabled too). + * + * The session cache has the responsibility to check for stale + * entries based on timeout. See RFC 5246 for recommendations. + * + * Warning: session.peer_cert is cleared by the SSL/TLS layer on + * connection shutdown, so do not cache the pointer! Either set + * it to NULL or make a full copy of the certificate. + * + * The get callback is called once during the initial handshake + * to enable session resuming. The get function has the + * following parameters: (void *parameter, mbedtls_ssl_session *session) + * If a valid entry is found, it should fill the master of + * the session object with the cached values and return 0, + * return 1 otherwise. Optionally peer_cert can be set as well + * if it is properly present in cache entry. + * + * The set callback is called once during the initial handshake + * to enable session resuming after the entire handshake has + * been finished. The set function has the following parameters: + * (void *parameter, const mbedtls_ssl_session *session). The function + * should create a cache entry for future retrieval based on + * the data in the session structure and should keep in mind + * that the mbedtls_ssl_session object presented (and all its referenced + * data) is cleared by the SSL/TLS layer when the connection is + * terminated. It is recommended to add metadata to determine if + * an entry is still valid in the future. Return 0 if + * successfully cached, return 1 otherwise. + * + * \param conf SSL configuration + * \param p_cache parameter (context) for both callbacks + * \param f_get_cache session get callback + * \param f_set_cache session set callback + */ +void mbedtls_ssl_conf_session_cache(mbedtls_ssl_config *conf, + void *p_cache, + mbedtls_ssl_cache_get_t *f_get_cache, + mbedtls_ssl_cache_set_t *f_set_cache); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Load a session for session resumption. + * + * Sessions loaded through this call will be considered + * for session resumption in the next handshake. + * + * \note Even if this call succeeds, it is not guaranteed that + * the next handshake will indeed be shortened through the + * use of session resumption: The server is always free + * to reject any attempt for resumption and fall back to + * a full handshake. + * + * \note This function can handle a variety of mechanisms for session + * resumption: For TLS 1.2, both session ID-based resumption + * and ticket-based resumption will be considered. For TLS 1.3, + * sessions equate to tickets, and loading one session by + * calling this function will lead to its corresponding ticket + * being advertised as resumption PSK by the client. This + * depends on session tickets being enabled (see + * #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + * If session tickets are disabled, a call to this function + * with a TLS 1.3 session, will not have any effect on the next + * handshake for the SSL context \p ssl. + * + * \param ssl The SSL context representing the connection which should + * be attempted to be setup using session resumption. This + * must be initialized via mbedtls_ssl_init() and bound to + * an SSL configuration via mbedtls_ssl_setup(), but + * the handshake must not yet have been started. + * \param session The session to be considered for session resumption. + * This must be a session previously exported via + * mbedtls_ssl_get_session(), and potentially serialized and + * deserialized through mbedtls_ssl_session_save() and + * mbedtls_ssl_session_load() in the meantime. + * + * \return \c 0 if successful. + * \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session + * could not be loaded because one session has already been + * loaded. This error is non-fatal, and has no observable + * effect on the SSL context or the session that was attempted + * to be loaded. + * \return Another negative error code on other kinds of failure. + * + * \sa mbedtls_ssl_get_session() + * \sa mbedtls_ssl_session_load() + */ +int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Load serialized session data into a session structure. + * On client, this can be used for loading saved sessions + * before resuming them with mbedtls_ssl_set_session(). + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \warning The serialized data contains highly sensitive material, + * including a resumption key (TLS 1.3) or the master secret + * (TLS 1.2) from which the session's traffic keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_session_save() and + * mbedtls_ssl_session_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * + * \warning If a peer certificate chain is associated with the session, + * the serialized state will only contain the peer's + * end-entity certificate and the result of the chain + * verification (unless verification was disabled), but not + * the rest of the chain. + * + * \see mbedtls_ssl_session_save() + * \see mbedtls_ssl_set_session() + * + * \param session The session structure to be populated. It must have been + * initialised with mbedtls_ssl_session_init() but not + * populated yet. + * \param buf The buffer holding the serialized session data. It must be a + * readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * was generated in a different version or configuration of + * Mbed TLS. + * \return Another negative value for other kinds of errors (for + * example, unsupported features in the embedded certificate). + */ +int mbedtls_ssl_session_load(mbedtls_ssl_session *session, + const unsigned char *buf, + size_t len); + +/** + * \brief Save session structure as serialized data in a buffer. + * On client, this can be used for saving session data, + * potentially in non-volatile storage, for resuming later. + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \see mbedtls_ssl_session_load() + * + * \warning The serialized data contains highly sensitive material, + * including a resumption key (TLS 1.3) or the master secret + * (TLS 1.2) from which the session's traffic keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_session_save() and + * mbedtls_ssl_session_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * See the mbedtls_ssl_session_load() documentation for + * additional information. + * + * \param session The session structure to be saved. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p buf_len bytes, or may be \c + * NULL if \p buf_len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. + * + * \note For TLS 1.3 sessions, this feature is supported only if the + * MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + * as in TLS 1.3 session resumption is possible only with + * tickets. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + * MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + * and the session is a TLS 1.3 session. + */ +int mbedtls_ssl_session_save(const mbedtls_ssl_session *session, + unsigned char *buf, + size_t buf_len, + size_t *olen); + +/** + * \brief Set the list of allowed ciphersuites and the preference + * order. First in the list has the highest preference. + * + * For TLS 1.2, the notion of ciphersuite determines both + * the key exchange mechanism and the suite of symmetric + * algorithms to be used during and after the handshake. + * + * For TLS 1.3 (in development), the notion of ciphersuite + * only determines the suite of symmetric algorithms to be + * used during and after the handshake, while key exchange + * mechanisms are configured separately. + * + * In Mbed TLS, ciphersuites for both TLS 1.2 and TLS 1.3 + * are configured via this function. For users of TLS 1.3, + * there will be separate API for the configuration of key + * exchange mechanisms. + * + * The list of ciphersuites passed to this function may + * contain a mixture of TLS 1.2 and TLS 1.3 ciphersuite + * identifiers. This is useful if negotiation of TLS 1.3 + * should be attempted, but a fallback to TLS 1.2 would + * be tolerated. + * + * \note By default, the server chooses its preferred + * ciphersuite among those that the client supports. If + * mbedtls_ssl_conf_preference_order() is called to prefer + * the client's preferences, the server instead chooses + * the client's preferred ciphersuite among those that + * the server supports. + * + * \warning The ciphersuites array \p ciphersuites is not copied. + * It must remain valid for the lifetime of the SSL + * configuration \p conf. + * + * \param conf The SSL configuration to modify. + * \param ciphersuites A 0-terminated list of IANA identifiers of supported + * ciphersuites, accessible through \c MBEDTLS_TLS_XXX + * and \c MBEDTLS_TLS1_3_XXX macros defined in + * ssl_ciphersuites.h. + */ +void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *conf, + const int *ciphersuites); + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) +/** + * \brief Set the supported key exchange modes for TLS 1.3 connections. + * + * In contrast to TLS 1.2, the ciphersuite concept in TLS 1.3 does not + * include the choice of key exchange mechanism. It is therefore not + * covered by the API mbedtls_ssl_conf_ciphersuites(). See the + * documentation of mbedtls_ssl_conf_ciphersuites() for more + * information on the ciphersuite concept in TLS 1.2 and TLS 1.3. + * + * The present function is specific to TLS 1.3 and allows users to + * configure the set of supported key exchange mechanisms in TLS 1.3. + * + * \param conf The SSL configuration the change should apply to. + * \param kex_modes A bitwise combination of one or more of the following: + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK + * This flag enables pure-PSK key exchanges. + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL + * This flag enables combined PSK-ephemeral key exchanges. + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL + * This flag enables pure-ephemeral key exchanges. + * For convenience, the following pre-defined macros are + * available for combinations of the above: + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL + * Includes all of pure-PSK, PSK-ephemeral and pure-ephemeral. + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL + * Includes both pure-PSK and combined PSK-ephemeral + * key exchanges, but excludes pure-ephemeral key exchanges. + * - MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL + * Includes both pure-ephemeral and combined PSK-ephemeral + * key exchanges. + * + * \note If a PSK-based key exchange mode shall be supported, applications + * must also use the APIs mbedtls_ssl_conf_psk() or + * mbedtls_ssl_conf_psk_cb() or mbedtls_ssl_conf_psk_opaque() + * to configure the PSKs to be used. + * + * \note If a pure-ephemeral key exchange mode shall be supported, + * server-side applications must also provide a certificate via + * mbedtls_ssl_conf_own_cert(). + * + */ + +void mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config *conf, + const int kex_modes); +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0 +#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL 1 +/** + * \brief Specify the length of Connection IDs for incoming + * encrypted DTLS records, as well as the behaviour + * on unexpected CIDs. + * + * By default, the CID length is set to \c 0, + * and unexpected CIDs are silently ignored. + * + * \param conf The SSL configuration to modify. + * \param len The length in Bytes of the CID fields in encrypted + * DTLS records using the CID mechanism. This must + * not be larger than #MBEDTLS_SSL_CID_OUT_LEN_MAX. + * \param ignore_other_cids This determines the stack's behaviour when + * receiving a record with an unexpected CID. + * Possible values are: + * - #MBEDTLS_SSL_UNEXPECTED_CID_IGNORE + * In this case, the record is silently ignored. + * - #MBEDTLS_SSL_UNEXPECTED_CID_FAIL + * In this case, the stack fails with the specific + * error code #MBEDTLS_ERR_SSL_UNEXPECTED_CID. + * + * \note The CID specification allows implementations to either + * use a common length for all incoming connection IDs or + * allow variable-length incoming IDs. Mbed TLS currently + * requires a common length for all connections sharing the + * same SSL configuration; this allows simpler parsing of + * record headers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len + * is too large. + */ +int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len, + int ignore_other_cids); +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the X.509 security profile used for verification + * + * \note The restrictions are enforced for all certificates in the + * chain. However, signatures in the handshake are not covered + * by this setting but by \b mbedtls_ssl_conf_sig_hashes(). + * + * \param conf SSL configuration + * \param profile Profile to use + */ +void mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config *conf, + const mbedtls_x509_crt_profile *profile); + +/** + * \brief Set the data required to verify peer certificate + * + * \note See \c mbedtls_x509_crt_verify() for notes regarding the + * parameters ca_chain (maps to trust_ca for that function) + * and ca_crl. + * + * \param conf SSL configuration + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *conf, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl); + +#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) +/** + * \brief Set DN hints sent to client in CertificateRequest message + * + * \note If not set, subject distinguished names (DNs) are taken + * from \c mbedtls_ssl_conf_ca_chain() + * or \c mbedtls_ssl_set_hs_ca_chain()) + * + * \param conf SSL configuration + * \param crt crt chain whose subject DNs are issuer DNs of client certs + * from which the client should select client peer certificate. + */ +static inline +void mbedtls_ssl_conf_dn_hints(mbedtls_ssl_config *conf, + const mbedtls_x509_crt *crt) +{ + conf->MBEDTLS_PRIVATE(dn_hints) = crt; +} +#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Set the trusted certificate callback. + * + * This API allows to register the set of trusted certificates + * through a callback, instead of a linked list as configured + * by mbedtls_ssl_conf_ca_chain(). + * + * This is useful for example in contexts where a large number + * of CAs are used, and the inefficiency of maintaining them + * in a linked list cannot be tolerated. It is also useful when + * the set of trusted CAs needs to be modified frequently. + * + * See the documentation of `mbedtls_x509_crt_ca_cb_t` for + * more information. + * + * \param conf The SSL configuration to register the callback with. + * \param f_ca_cb The trusted certificate callback to use when verifying + * certificate chains. + * \param p_ca_cb The context to be passed to \p f_ca_cb (for example, + * a reference to a trusted CA database). + * + * \note This API is incompatible with mbedtls_ssl_conf_ca_chain(): + * Any call to this function overwrites the values set through + * earlier calls to mbedtls_ssl_conf_ca_chain() or + * mbedtls_ssl_conf_ca_cb(). + * + * \note This API is incompatible with CA indication in + * CertificateRequest messages: A server-side SSL context which + * is bound to an SSL configuration that uses a CA callback + * configured via mbedtls_ssl_conf_ca_cb(), and which requires + * client authentication, will send an empty CA list in the + * corresponding CertificateRequest message. + * + * \note This API is incompatible with mbedtls_ssl_set_hs_ca_chain(): + * If an SSL context is bound to an SSL configuration which uses + * CA callbacks configured via mbedtls_ssl_conf_ca_cb(), then + * calls to mbedtls_ssl_set_hs_ca_chain() have no effect. + * + * \note The use of this API disables the use of restartable ECC + * during X.509 CRT signature verification (but doesn't affect + * other uses). + * + * \warning This API is incompatible with the use of CRLs. Any call to + * mbedtls_ssl_conf_ca_cb() unsets CRLs configured through + * earlier calls to mbedtls_ssl_conf_ca_chain(). + * + * \warning In multi-threaded environments, the callback \p f_ca_cb + * must be thread-safe, and it is the user's responsibility + * to guarantee this (for example through a mutex + * contained in the callback context pointed to by \p p_ca_cb). + */ +void mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config *conf, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb); +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +/** + * \brief Set own certificate chain and private key + * + * \note own_cert should contain in order from the bottom up your + * certificate chain. The top certificate (self-signed) + * can be omitted. + * + * \note On server, this function can be called multiple times to + * provision more than one cert/key pair (eg one ECDSA, one + * RSA with SHA-256, one RSA with SHA-1). An adequate + * certificate will be selected according to the client's + * advertised capabilities. In case multiple certificates are + * adequate, preference is given to the one set by the first + * call to this function, then second, etc. + * + * \note On client, only the first call has any effect. That is, + * only one client certificate can be provisioned. The + * server's preferences in its CertificateRequest message will + * be ignored and our only cert will be sent regardless of + * whether it matches those preferences - the server can then + * decide what it wants to do with it. + * + * \note The provided \p pk_key needs to match the public key in the + * first certificate in \p own_cert, or all handshakes using + * that certificate will fail. It is your responsibility + * to ensure that; this function will not perform any check. + * You may use mbedtls_pk_check_pair() in order to perform + * this check yourself, but be aware that this function can + * be computationally expensive on some key types. + * + * \param conf SSL configuration + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_conf_own_cert(mbedtls_ssl_config *conf, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) +/** + * \brief Configure pre-shared keys (PSKs) and their + * identities to be used in PSK-based ciphersuites. + * + * Only one PSK can be registered, through either + * mbedtls_ssl_conf_psk() or mbedtls_ssl_conf_psk_opaque(). + * If you attempt to register more than one PSK, this function + * fails, though this may change in future versions, which + * may add support for multiple PSKs. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note A PSK set by \c mbedtls_ssl_set_hs_psk() in the PSK callback + * takes precedence over a PSK configured by this function. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The pointer to the pre-shared key to use. + * \param psk_len The length of the pre-shared key in bytes. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK and its identity are copied internally and + * hence need not be preserved by the caller for the lifetime + * of the SSL configuration. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no more PSKs + * can be configured. In this case, the old PSK(s) remain intact. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ssl_conf_psk(mbedtls_ssl_config *conf, + const unsigned char *psk, size_t psk_len, + const unsigned char *psk_identity, size_t psk_identity_len); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Configure one or more opaque pre-shared keys (PSKs) and + * their identities to be used in PSK-based ciphersuites. + * + * Only one PSK can be registered, through either + * mbedtls_ssl_conf_psk() or mbedtls_ssl_conf_psk_opaque(). + * If you attempt to register more than one PSK, this function + * fails, though this may change in future versions, which + * may add support for multiple PSKs. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note An opaque PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in + * the PSK callback takes precedence over an opaque PSK + * configured by this function. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The identifier of the key slot holding the PSK. + * Until \p conf is destroyed or this function is successfully + * called again, the key slot \p psk must be populated with a + * key of type PSA_ALG_CATEGORY_KEY_DERIVATION whose policy + * allows its use for the key derivation algorithm applied + * in the handshake. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK identity hint is copied internally and hence need + * not be preserved by the caller for the lifetime of the + * SSL configuration. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no more PSKs + * can be configured. In this case, the old PSK(s) remain intact. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config *conf, + mbedtls_svc_key_id_t psk, + const unsigned char *psk_identity, + size_t psk_identity_len); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief Set the pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note A PSK set by this function takes precedence over a PSK + * configured by \c mbedtls_ssl_conf_psk(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The pointer to the pre-shared key. + * \param psk_len The length of the pre-shared key in bytes. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk(mbedtls_ssl_context *ssl, + const unsigned char *psk, size_t psk_len); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Set an opaque pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note An opaque PSK set by this function takes precedence over an + * opaque PSK configured by \c mbedtls_ssl_conf_psk_opaque(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The identifier of the key slot holding the PSK. + * For the duration of the current handshake, the key slot + * must be populated with a key of type + * PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its + * use for the key derivation algorithm + * applied in the handshake. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context *ssl, + mbedtls_svc_key_id_t psk); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the PSK callback (server-side only). + * + * If set, the PSK callback is called for each + * handshake where a PSK-based ciphersuite was negotiated. + * The caller provides the identity received and wants to + * receive the actual PSK data and length. + * + * The callback has the following parameters: + * - \c void*: The opaque pointer \p p_psk. + * - \c mbedtls_ssl_context*: The SSL context to which + * the operation applies. + * - \c const unsigned char*: The PSK identity + * selected by the client. + * - \c size_t: The length of the PSK identity + * selected by the client. + * + * If a valid PSK identity is found, the callback should use + * \c mbedtls_ssl_set_hs_psk() or + * \c mbedtls_ssl_set_hs_psk_opaque() + * on the SSL context to set the correct PSK and return \c 0. + * Any other return value will result in a denied PSK identity. + * + * \note A dynamic PSK (i.e. set by the PSK callback) takes + * precedence over a static PSK (i.e. set by + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * This means that if you set a PSK callback using this + * function, you don't need to set a PSK using + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * + * \param conf The SSL configuration to register the callback with. + * \param f_psk The callback for selecting and setting the PSK based + * in the PSK identity chosen by the client. + * \param p_psk A pointer to an opaque structure to be passed to + * the callback, for example a PSK store. + */ +void mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config *conf, + int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_psk); +#endif /* MBEDTLS_SSL_SRV_C */ +#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the Diffie-Hellman public P and G values + * from big-endian binary presentations. + * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]_BIN) + * + * \param conf SSL configuration + * \param dhm_P Diffie-Hellman-Merkle modulus in big-endian binary form + * \param P_len Length of DHM modulus + * \param dhm_G Diffie-Hellman-Merkle generator in big-endian binary form + * \param G_len Length of DHM generator + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config *conf, + const unsigned char *dhm_P, size_t P_len, + const unsigned char *dhm_G, size_t G_len); + +/** + * \brief Set the Diffie-Hellman public P and G values, + * read from existing context (server-side only) + * + * \param conf SSL configuration + * \param dhm_ctx Diffie-Hellman-Merkle context + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx); +#endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Set the minimum length for Diffie-Hellman parameters. + * (Client-side only.) + * (Default: 1024 bits.) + * + * \param conf SSL configuration + * \param bitlen Minimum bit length of the DHM prime + */ +void mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config *conf, + unsigned int bitlen); +#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_ECP_C) +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief Set the allowed curves in order of preference. + * + * On server: this only affects selection of the ECDHE curve; + * the curves used for ECDH and ECDSA are determined by the + * list of available certificates instead. + * + * On client: this affects the list of curves offered for any + * use. The server can override our preference order. + * + * Both sides: limits the set of curves accepted for use in + * ECDHE and in the peer's end-entity certificate. + * + * \deprecated Superseded by mbedtls_ssl_conf_groups(). + * + * \note This has no influence on which curves are allowed inside the + * certificate chains, see \c mbedtls_ssl_conf_cert_profile() + * for that. For the end-entity certificate however, the key + * will be accepted only if it is allowed both by this list + * and by the cert profile. + * + * \note This list should be ordered by decreasing preference + * (preferred curve first). + * + * \note The default list is the same set of curves that + * #mbedtls_x509_crt_profile_default allows, plus + * ECDHE-only curves selected according to the same criteria. + * The order favors curves with the lowest resource usage. + * + * \note New minor versions of Mbed TLS may extend this list, + * for example if new curves are added to the library. + * New minor versions of Mbed TLS will not remove items + * from this list unless serious security concerns require it. + * New minor versions of Mbed TLS may change the order in + * keeping with the general principle of favoring the lowest + * resource usage. + * + * \param conf SSL configuration + * \param curves Ordered list of allowed curves, + * terminated by MBEDTLS_ECP_DP_NONE. + */ +void MBEDTLS_DEPRECATED mbedtls_ssl_conf_curves(mbedtls_ssl_config *conf, + const mbedtls_ecp_group_id *curves); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_ECP_C */ + +/** + * \brief Set the allowed groups in order of preference. + * + * On server: This only affects the choice of key agreement mechanism + * + * On client: this affects the list of groups offered for any + * use. The server can override our preference order. + * + * Both sides: limits the set of groups accepted for use in + * key sharing. + * + * \note This function replaces the deprecated mbedtls_ssl_conf_curves(), + * which only allows ECP curves to be configured. + * + * \note The most recent invocation of either mbedtls_ssl_conf_curves() + * or mbedtls_ssl_conf_groups() nullifies all previous invocations + * of both. + * + * \note This list should be ordered by decreasing preference + * (preferred group first). + * + * \note When this function is not called, a default list is used, + * consisting of all supported curves at 255 bits and above, + * and all supported finite fields at 2048 bits and above. + * The order favors groups with the lowest resource usage. + * + * \note New minor versions of Mbed TLS will not remove items + * from the default list unless serious security concerns require it. + * New minor versions of Mbed TLS may change the order in + * keeping with the general principle of favoring the lowest + * resource usage. + * + * \param conf SSL configuration + * \param groups List of allowed groups ordered by preference, terminated by 0. + * Must contain valid IANA NamedGroup IDs (provided via either an integer + * or using MBEDTLS_TLS1_3_NAMED_GROUP_XXX macros). + */ +void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf, + const uint16_t *groups); + +#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) +#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2) +/** + * \brief Set the allowed hashes for signatures during the handshake. + * + * \note This only affects which hashes are offered and can be used + * for signatures during the handshake. Hashes for message + * authentication and the TLS PRF are controlled by the + * ciphersuite, see \c mbedtls_ssl_conf_ciphersuites(). Hashes + * used for certificate signature are controlled by the + * verification profile, see \c mbedtls_ssl_conf_cert_profile(). + * + * \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + * + * \note This list should be ordered by decreasing preference + * (preferred hash first). + * + * \note By default, all supported hashes whose length is at least + * 256 bits are allowed. This is the same set as the default + * for certificate verification + * (#mbedtls_x509_crt_profile_default). + * The preference order is currently unspecified and may + * change in future versions. + * + * \note New minor versions of Mbed TLS may extend this list, + * for example if new curves are added to the library. + * New minor versions of Mbed TLS will not remove items + * from this list unless serious security concerns require it. + * + * \param conf SSL configuration + * \param hashes Ordered list of allowed signature hashes, + * terminated by \c MBEDTLS_MD_NONE. + */ +void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf, + const int *hashes); +#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */ + +/** + * \brief Configure allowed signature algorithms for use in TLS + * + * \param conf The SSL configuration to use. + * \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, + * terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + * available throughout the lifetime of the conf object. + * - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + * used. + * - For TLS 1.2, values should be given as + * "(HashAlgorithm << 8) | SignatureAlgorithm". + */ +void mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config *conf, + const uint16_t *sig_algs); +#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set or reset the hostname to check against the received + * peer certificate. On a client, this also sets the + * ServerName TLS extension, if that extension is enabled. + * On a TLS 1.3 client, this also sets the server name in + * the session resumption ticket, if that feature is enabled. + * + * \param ssl SSL context + * \param hostname The server hostname. This may be \c NULL to clear + * the hostname. + * + * \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + * + * \note If the hostname is \c NULL on a client, then the server + * is not authenticated: it only needs to have a valid + * certificate, not a certificate matching its name. + * Therefore you should always call this function on a client, + * unless the connection is set up to only allow + * pre-shared keys, or in scenarios where server + * impersonation is not a concern. See the documentation of + * #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * for more details. + * + * \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + * allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + * too long input hostname. + * + * Hostname set to the one provided on success (cleared + * when NULL). On allocation failure hostname is cleared. + * On too long input failure, old hostname is unchanged. + */ +int mbedtls_ssl_set_hostname(mbedtls_ssl_context *ssl, const char *hostname); + +/** + * \brief Get the hostname that checked against the received + * server certificate. It is used to set the ServerName + * TLS extension, too, if that extension is enabled. + * (client-side only) + * + * \param ssl SSL context + * + * \return const pointer to the hostname value + */ +static inline const char *mbedtls_ssl_get_hostname(mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(hostname); +} +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) +/** + * \brief Retrieve SNI extension value for the current handshake. + * Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + * this is the same value passed to \c f_sni callback of + * \c mbedtls_ssl_conf_sni() and may be used instead of + * \c mbedtls_ssl_conf_sni(). + * + * \param ssl SSL context + * \param name_len pointer into which to store length of returned value. + * 0 if SNI extension is not present or not yet processed. + * + * \return const pointer to SNI extension value. + * - value is valid only when called in \c f_cert_cb + * registered with \c mbedtls_ssl_conf_cert_cb(). + * - value is NULL if SNI extension is not present. + * - value is not '\0'-terminated. Use \c name_len for len. + * - value must not be freed. + */ +const unsigned char *mbedtls_ssl_get_hs_sni(mbedtls_ssl_context *ssl, + size_t *name_len); + +/** + * \brief Set own certificate and key for the current handshake + * + * \note Same as \c mbedtls_ssl_conf_own_cert() but for use within + * the SNI callback or the certificate selection callback. + * + * \note Passing null \c own_cert clears the certificate list for + * the current handshake. + * + * \param ssl SSL context + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context *ssl, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key); + +/** + * \brief Set the data required to verify peer certificate for the + * current handshake + * + * \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within + * the SNI callback or the certificate selection callback. + * + * \param ssl SSL context + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context *ssl, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl); + +#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) +/** + * \brief Set DN hints sent to client in CertificateRequest message + * + * \note Same as \c mbedtls_ssl_conf_dn_hints() but for use within + * the SNI callback or the certificate selection callback. + * + * \param ssl SSL context + * \param crt crt chain whose subject DNs are issuer DNs of client certs + * from which the client should select client peer certificate. + */ +void mbedtls_ssl_set_hs_dn_hints(mbedtls_ssl_context *ssl, + const mbedtls_x509_crt *crt); +#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ + +/** + * \brief Set authmode for the current handshake. + * + * \note Same as \c mbedtls_ssl_conf_authmode() but for use within + * the SNI callback or the certificate selection callback. + * + * \param ssl SSL context + * \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or + * MBEDTLS_SSL_VERIFY_REQUIRED + */ +void mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context *ssl, + int authmode); + +/** + * \brief Set server side ServerName TLS extension callback + * (optional, server-side only). + * + * If set, the ServerName callback is called whenever the + * server receives a ServerName TLS extension from the client + * during a handshake. The ServerName callback has the + * following parameters: (void *parameter, mbedtls_ssl_context *ssl, + * const unsigned char *hostname, size_t len). If a suitable + * certificate is found, the callback must set the + * certificate(s) and key(s) to use with \c + * mbedtls_ssl_set_hs_own_cert() (can be called repeatedly), + * and may optionally adjust the CA and associated CRL with \c + * mbedtls_ssl_set_hs_ca_chain() as well as the client + * authentication mode with \c mbedtls_ssl_set_hs_authmode(), + * then must return 0. If no matching name is found, the + * callback may return non-zero to abort the handshake. + * + * \param conf SSL configuration + * \param f_sni verification function + * \param p_sni verification parameter + */ +void mbedtls_ssl_conf_sni(mbedtls_ssl_config *conf, + int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_sni); +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +/** + * \brief Set the EC J-PAKE password for current handshake. + * + * \note An internal copy is made, and destroyed as soon as the + * handshake is completed, or when the SSL context is reset or + * freed. + * + * \note The SSL context needs to be already set up. The right place + * to call this function is between \c mbedtls_ssl_setup() or + * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake(). + * Password cannot be empty (see RFC 8236). + * + * \param ssl SSL context + * \param pw EC J-PAKE password (pre-shared secret). It cannot be empty + * \param pw_len length of pw in bytes + * + * \return 0 on success, or a negative error code. + */ +int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl, + const unsigned char *pw, + size_t pw_len); + +/** + * \brief Set the EC J-PAKE opaque password for current handshake. + * + * \note The key must remain valid until the handshake is over. + * + * \note The SSL context needs to be already set up. The right place + * to call this function is between \c mbedtls_ssl_setup() or + * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake(). + * + * \param ssl SSL context + * \param pwd EC J-PAKE opaque password + * + * \return 0 on success, or a negative error code. + */ +int mbedtls_ssl_set_hs_ecjpake_password_opaque(mbedtls_ssl_context *ssl, + mbedtls_svc_key_id_t pwd); +#endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ + +#if defined(MBEDTLS_SSL_ALPN) +/** + * \brief Set the supported Application Layer Protocols. + * + * \param conf SSL configuration + * \param protos Pointer to a NULL-terminated list of supported protocols, + * in decreasing preference order. The pointer to the list is + * recorded by the library for later reference as required, so + * the lifetime of the table must be at least as long as the + * lifetime of the SSL configuration structure. + * + * \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA. + */ +int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf, const char **protos); + +/** + * \brief Get the name of the negotiated Application Layer Protocol. + * This function should be called after the handshake is + * completed. + * + * \param ssl SSL context + * + * \return Protocol name, or NULL if no protocol was negotiated. + */ +const char *mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context *ssl); +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) +#if defined(MBEDTLS_DEBUG_C) +static inline const char *mbedtls_ssl_get_srtp_profile_as_string(mbedtls_ssl_srtp_profile profile) +{ + switch (profile) { + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: + return "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80"; + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: + return "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32"; + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: + return "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80"; + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: + return "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32"; + default: break; + } + return ""; +} +#endif /* MBEDTLS_DEBUG_C */ +/** + * \brief Manage support for mki(master key id) value + * in use_srtp extension. + * MKI is an optional part of SRTP used for key management + * and re-keying. See RFC3711 section 3.1 for details. + * The default value is + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED. + * + * \param conf The SSL configuration to manage mki support. + * \param support_mki_value Enable or disable mki usage. Values are + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED + * or #MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED. + */ +void mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config *conf, + int support_mki_value); + +/** + * \brief Set the supported DTLS-SRTP protection profiles. + * + * \param conf SSL configuration + * \param profiles Pointer to a List of MBEDTLS_TLS_SRTP_UNSET terminated + * supported protection profiles + * in decreasing preference order. + * The pointer to the list is recorded by the library + * for later reference as required, so the lifetime + * of the table must be at least as long as the lifetime + * of the SSL configuration structure. + * The list must not hold more than + * MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH elements + * (excluding the terminating MBEDTLS_TLS_SRTP_UNSET). + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA when the list of + * protection profiles is incorrect. + */ +int mbedtls_ssl_conf_dtls_srtp_protection_profiles + (mbedtls_ssl_config *conf, + const mbedtls_ssl_srtp_profile *profiles); + +/** + * \brief Set the mki_value for the current DTLS-SRTP session. + * + * \param ssl SSL context to use. + * \param mki_value The MKI value to set. + * \param mki_len The length of the MKI value. + * + * \note This function is relevant on client side only. + * The server discovers the mki value during handshake. + * A mki value set on server side using this function + * is ignored. + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE + */ +int mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context *ssl, + unsigned char *mki_value, + uint16_t mki_len); +/** + * \brief Get the negotiated DTLS-SRTP information: + * Protection profile and MKI value. + * + * \warning This function must be called after the handshake is + * completed. The value returned by this function must + * not be trusted or acted upon before the handshake completes. + * + * \param ssl The SSL context to query. + * \param dtls_srtp_info The negotiated DTLS-SRTP information: + * - Protection profile in use. + * A direct mapping of the iana defined value for protection + * profile on an uint16_t. + http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * #MBEDTLS_TLS_SRTP_UNSET if the use of SRTP was not negotiated + * or peer's Hello packet was not parsed yet. + * - mki size and value( if size is > 0 ). + */ +void mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context *ssl, + mbedtls_dtls_srtp_info *dtls_srtp_info); +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief Set the maximum supported version sent from the client side + * and/or accepted at the server side. + * + * See also the documentation of mbedtls_ssl_conf_min_version(). + * + * \note This ignores ciphersuites from higher versions. + * + * \note This function is deprecated and has been replaced by + * \c mbedtls_ssl_conf_max_tls_version(). + * + * \param conf SSL configuration + * \param major Major version number (#MBEDTLS_SSL_MAJOR_VERSION_3) + * \param minor Minor version number + * (#MBEDTLS_SSL_MINOR_VERSION_3 for (D)TLS 1.2, + * #MBEDTLS_SSL_MINOR_VERSION_4 for TLS 1.3) + */ +void MBEDTLS_DEPRECATED mbedtls_ssl_conf_max_version(mbedtls_ssl_config *conf, int major, + int minor); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Set the maximum supported version sent from the client side + * and/or accepted at the server side. + * + * \note After the handshake, you can call + * mbedtls_ssl_get_version_number() to see what version was + * negotiated. + * + * \param conf SSL configuration + * \param tls_version TLS protocol version number (\c mbedtls_ssl_protocol_version) + * (#MBEDTLS_SSL_VERSION_UNKNOWN is not valid) + */ +static inline void mbedtls_ssl_conf_max_tls_version(mbedtls_ssl_config *conf, + mbedtls_ssl_protocol_version tls_version) +{ + conf->MBEDTLS_PRIVATE(max_tls_version) = tls_version; +} + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief Set the minimum accepted SSL/TLS protocol version + * + * \note By default, all supported versions are accepted. + * Future versions of the library may disable older + * protocol versions by default if they become deprecated. + * + * \note The following versions are supported (if enabled at + * compile time): + * - (D)TLS 1.2: \p major = #MBEDTLS_SSL_MAJOR_VERSION_3, + * \p minor = #MBEDTLS_SSL_MINOR_VERSION_3 + * - TLS 1.3: \p major = #MBEDTLS_SSL_MAJOR_VERSION_3, + * \p minor = #MBEDTLS_SSL_MINOR_VERSION_4 + * + * Note that the numbers in the constant names are the + * TLS internal protocol numbers, and the minor versions + * differ by one from the human-readable versions! + * + * \note Input outside of the SSL_MAX_XXXXX_VERSION and + * SSL_MIN_XXXXX_VERSION range is ignored. + * + * \note After the handshake, you can call + * mbedtls_ssl_get_version_number() to see what version was + * negotiated. + * + * \note This function is deprecated and has been replaced by + * \c mbedtls_ssl_conf_min_tls_version(). + * + * \param conf SSL configuration + * \param major Major version number (#MBEDTLS_SSL_MAJOR_VERSION_3) + * \param minor Minor version number + * (#MBEDTLS_SSL_MINOR_VERSION_3 for (D)TLS 1.2, + * #MBEDTLS_SSL_MINOR_VERSION_4 for TLS 1.3) + */ +void MBEDTLS_DEPRECATED mbedtls_ssl_conf_min_version(mbedtls_ssl_config *conf, int major, + int minor); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Set the minimum supported version sent from the client side + * and/or accepted at the server side. + * + * \note After the handshake, you can call + * mbedtls_ssl_get_version_number() to see what version was + * negotiated. + * + * \param conf SSL configuration + * \param tls_version TLS protocol version number (\c mbedtls_ssl_protocol_version) + * (#MBEDTLS_SSL_VERSION_UNKNOWN is not valid) + */ +static inline void mbedtls_ssl_conf_min_tls_version(mbedtls_ssl_config *conf, + mbedtls_ssl_protocol_version tls_version) +{ + conf->MBEDTLS_PRIVATE(min_tls_version) = tls_version; +} + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) +/** + * \brief Enable or disable Encrypt-then-MAC + * (Default: MBEDTLS_SSL_ETM_ENABLED) + * + * \note This should always be enabled, it is a security + * improvement, and should not cause any interoperability + * issue (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param etm MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED + */ +void mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config *conf, char etm); +#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) +/** + * \brief Enable or disable Extended Master Secret negotiation. + * (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED) + * + * \note This should always be enabled, it is a security fix to the + * protocol, and should not cause any interoperability issue + * (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED + */ +void mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config *conf, char ems); +#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Whether to send a list of acceptable CAs in + * CertificateRequest messages. + * (Default: do send) + * + * \param conf SSL configuration + * \param cert_req_ca_list MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED or + * MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED + */ +void mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config *conf, + char cert_req_ca_list); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) +/** + * \brief Set the maximum fragment length to emit and/or negotiate. + * (Typical: the smaller of #MBEDTLS_SSL_IN_CONTENT_LEN and + * #MBEDTLS_SSL_OUT_CONTENT_LEN, usually `2^14` bytes) + * (Server: set maximum fragment length to emit, + * usually negotiated by the client during handshake) + * (Client: set maximum fragment length to emit *and* + * negotiate with the server during handshake) + * (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE) + * + * \note On the client side, the maximum fragment length extension + * *will not* be used, unless the maximum fragment length has + * been set via this function to a value different than + * #MBEDTLS_SSL_MAX_FRAG_LEN_NONE. + * + * \note With TLS, this currently only affects ApplicationData (sent + * with \c mbedtls_ssl_read()), not handshake messages. + * With DTLS, this affects both ApplicationData and handshake. + * + * \note Defragmentation of TLS handshake messages is supported + * with some limitations. See the documentation of + * mbedtls_ssl_handshake() for details. + * + * \note This sets the maximum length for a record's payload, + * excluding record overhead that will be added to it, see + * \c mbedtls_ssl_get_record_expansion(). + * + * \note For DTLS, it is also possible to set a limit for the total + * size of datagrams passed to the transport layer, including + * record overhead, see \c mbedtls_ssl_set_mtu(). + * + * \param conf SSL configuration + * \param mfl_code Code for maximum fragment length (allowed values: + * MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024, + * MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096) + * + * \return 0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA + */ +int mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config *conf, unsigned char mfl_code); +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Pick the ciphersuites order according to the second parameter + * in the SSL Server module (MBEDTLS_SSL_SRV_C). + * (Default, if never called: MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER) + * + * \param conf SSL configuration + * \param order Server or client (MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER + * or MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) + */ +void mbedtls_ssl_conf_preference_order(mbedtls_ssl_config *conf, int order); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Enable / Disable TLS 1.2 session tickets (client only, + * TLS 1.2 only). Enabled by default. + * + * \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). + * + * \param conf SSL configuration + * \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + * #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + */ +void mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config *conf, int use_tickets); + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) +/** + * \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + * (client only, TLS 1.3 only). + * + * The handling of TLS 1.3 NewSessionTicket messages is disabled by + * default. + * + * In TLS 1.3, servers may send a NewSessionTicket message at any time, + * and may send multiple NewSessionTicket messages. By default, TLS 1.3 + * clients ignore NewSessionTicket messages. + * + * To support session tickets in TLS 1.3 clients, call this function + * with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + * this is enabled, when a client receives a NewSessionTicket message, + * the next call to a message processing functions (notably + * mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + * #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + * call mbedtls_ssl_get_session() to retrieve the session ticket before + * calling the same message processing function again. + * + * \param conf SSL configuration + * \param signal_new_session_tickets Enable or disable + * (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + * #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + */ +void mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + mbedtls_ssl_config *conf, int signal_new_session_tickets); + +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \ + defined(MBEDTLS_SSL_SRV_C) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_3) +/** + * \brief Number of NewSessionTicket messages for the server to send + * after handshake completion. + * + * \note The default value is + * \c MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS. + * + * \note In case of a session resumption, this setting only partially apply. + * At most one ticket is sent in that case to just renew the pool of + * tickets of the client. The rationale is to avoid the number of + * tickets on the server to become rapidly out of control when the + * server has the same configuration for all its connection instances. + * + * \param conf SSL configuration + * \param num_tickets Number of NewSessionTicket. + * + */ +void mbedtls_ssl_conf_new_session_tickets(mbedtls_ssl_config *conf, + uint16_t num_tickets); +#endif /* MBEDTLS_SSL_SESSION_TICKETS && + MBEDTLS_SSL_SRV_C && + MBEDTLS_SSL_PROTO_TLS1_3*/ + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enable / Disable renegotiation support for connection when + * initiated by peer + * (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED) + * + * \warning It is recommended to always disable renegotiation unless you + * know you need it and you know what you're doing. In the + * past, there have been several issues associated with + * renegotiation or a poor understanding of its properties. + * + * \note Server-side, enabling renegotiation also makes the server + * susceptible to a resource DoS by a malicious client. + * + * \param conf SSL configuration + * \param renegotiation Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or + * MBEDTLS_SSL_RENEGOTIATION_DISABLED) + */ +void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *conf, int renegotiation); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Prevent or allow legacy renegotiation. + * (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) + * + * MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to + * be established even if the peer does not support + * secure renegotiation, but does not allow renegotiation + * to take place if not secure. + * (Interoperable and secure option) + * + * MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations + * with non-upgraded peers. Allowing legacy renegotiation + * makes the connection vulnerable to specific man in the + * middle attacks. (See RFC 5746) + * (Most interoperable and least secure option) + * + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections + * if peer does not support secure renegotiation. Results + * in interoperability issues with non-upgraded peers + * that do not support renegotiation altogether. + * (Most secure option, interoperability issues) + * + * \param conf SSL configuration + * \param allow_legacy Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION, + * SSL_ALLOW_LEGACY_RENEGOTIATION or + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) + */ +void mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config *conf, int allow_legacy); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enforce renegotiation requests. + * (Default: enforced, max_records = 16) + * + * When we request a renegotiation, the peer can comply or + * ignore the request. This function allows us to decide + * whether to enforce our renegotiation requests by closing + * the connection if the peer doesn't comply. + * + * However, records could already be in transit from the peer + * when the request is emitted. In order to increase + * reliability, we can accept a number of records before the + * expected handshake records. + * + * The optimal value is highly dependent on the specific usage + * scenario. + * + * \note With DTLS and server-initiated renegotiation, the + * HelloRequest is retransmitted every time mbedtls_ssl_read() times + * out or receives Application Data, until: + * - max_records records have beens seen, if it is >= 0, or + * - the number of retransmits that would happen during an + * actual handshake has been reached. + * Please remember the request might be lost a few times + * if you consider setting max_records to a really low value. + * + * \warning On client, the grace period can only happen during + * mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate() + * which always behave as if max_record was 0. The reason is, + * if we receive application data from the server, we need a + * place to write it, which only happens during mbedtls_ssl_read(). + * + * \param conf SSL configuration + * \param max_records Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to + * enforce renegotiation, or a non-negative value to enforce + * it but allow for a grace period of max_records records. + */ +void mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config *conf, int max_records); + +/** + * \brief Set record counter threshold for periodic renegotiation. + * (Default: 2^48 - 1) + * + * Renegotiation is automatically triggered when a record + * counter (outgoing or incoming) crosses the defined + * threshold. The default value is meant to prevent the + * connection from being closed when the counter is about to + * reached its maximal value (it is not allowed to wrap). + * + * Lower values can be used to enforce policies such as "keys + * must be refreshed every N packets with cipher X". + * + * The renegotiation period can be disabled by setting + * conf->disable_renegotiation to + * MBEDTLS_SSL_RENEGOTIATION_DISABLED. + * + * \note When the configured transport is + * MBEDTLS_SSL_TRANSPORT_DATAGRAM the maximum renegotiation + * period is 2^48 - 1, and for MBEDTLS_SSL_TRANSPORT_STREAM, + * the maximum renegotiation period is 2^64 - 1. + * + * \param conf SSL configuration + * \param period The threshold value: a big-endian 64-bit number. + */ +void mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config *conf, + const unsigned char period[8]); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Check if there is data already read from the + * underlying transport but not yet processed. + * + * \param ssl SSL context + * + * \return 0 if nothing's pending, 1 otherwise. + * + * \note This is different in purpose and behaviour from + * \c mbedtls_ssl_get_bytes_avail in that it considers + * any kind of unprocessed data, not only unread + * application data. If \c mbedtls_ssl_get_bytes + * returns a non-zero value, this function will + * also signal pending data, but the converse does + * not hold. For example, in DTLS there might be + * further records waiting to be processed from + * the current underlying transport's datagram. + * + * \note If this function returns 1 (data pending), this + * does not imply that a subsequent call to + * \c mbedtls_ssl_read will provide any data; + * e.g., the unprocessed data might turn out + * to be an alert or a handshake message. + * + * \note This function is useful in the following situation: + * If the SSL/TLS module successfully returns from an + * operation - e.g. a handshake or an application record + * read - and you're awaiting incoming data next, you + * must not immediately idle on the underlying transport + * to have data ready, but you need to check the value + * of this function first. The reason is that the desired + * data might already be read but not yet processed. + * If, in contrast, a previous call to the SSL/TLS module + * returned MBEDTLS_ERR_SSL_WANT_READ, it is not necessary + * to call this function, as the latter error code entails + * that all internal data has been processed. + * + */ +int mbedtls_ssl_check_pending(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the number of application data bytes + * remaining to be read from the current record. + * + * \param ssl SSL context + * + * \return How many bytes are available in the application + * data record read buffer. + * + * \note When working over a datagram transport, this is + * useful to detect the current datagram's boundary + * in case \c mbedtls_ssl_read has written the maximal + * amount of data fitting into the input buffer. + * + */ +size_t mbedtls_ssl_get_bytes_avail(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the result of the certificate verification + * + * \param ssl The SSL context to use. + * + * \return \c 0 if the certificate verification was successful. + * \return \c -1u if the result is not available. This may happen + * e.g. if the handshake aborts early, or a verification + * callback returned a fatal error. + * \return A bitwise combination of \c MBEDTLS_X509_BADCERT_XXX + * and \c MBEDTLS_X509_BADCRL_XXX failure flags; see x509.h. + */ +uint32_t mbedtls_ssl_get_verify_result(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the id of the current ciphersuite + * + * \param ssl SSL context + * + * \return a ciphersuite id + */ +int mbedtls_ssl_get_ciphersuite_id_from_ssl(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the name of the current ciphersuite + * + * \param ssl SSL context + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context *ssl); + + +/** + * \brief Return the (D)TLS protocol version negotiated in the + * given connection. + * + * \note If you call this function too early during the initial + * handshake, before the two sides have agreed on a version, + * this function returns #MBEDTLS_SSL_VERSION_UNKNOWN. + * + * \param ssl The SSL context to query. + * \return The negotiated protocol version. + */ +static inline mbedtls_ssl_protocol_version mbedtls_ssl_get_version_number( + const mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(tls_version); +} + +/** + * \brief Return the current TLS version + * + * \param ssl SSL context + * + * \return a string containing the TLS version + */ +const char *mbedtls_ssl_get_version(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the (maximum) number of bytes added by the record + * layer: header + encryption/MAC overhead (inc. padding) + * + * \param ssl SSL context + * + * \return Current maximum record expansion in bytes + */ +int mbedtls_ssl_get_record_expansion(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the current maximum outgoing record payload in bytes. + * + * \note The logic to determine the maximum outgoing record payload is + * version-specific. It takes into account various factors, such as + * the mbedtls_config.h setting \c MBEDTLS_SSL_OUT_CONTENT_LEN, extensions + * such as the max fragment length or record size limit extension if + * used, and for DTLS the path MTU as configured and current + * record expansion. + * + * \note With DTLS, \c mbedtls_ssl_write() will return an error if + * called with a larger length value. + * With TLS, \c mbedtls_ssl_write() will fragment the input if + * necessary and return the number of bytes written; it is up + * to the caller to call \c mbedtls_ssl_write() again in + * order to send the remaining bytes if any. + * + * \sa mbedtls_ssl_get_max_out_record_payload() + * \sa mbedtls_ssl_get_record_expansion() + * + * \param ssl SSL context + * + * \return Current maximum payload for an outgoing record, + * or a negative error code. + */ +int mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context *ssl); + +/** + * \brief Return the current maximum incoming record payload in bytes. + * + * \note The logic to determine the maximum incoming record payload is + * version-specific. It takes into account various factors, such as + * the mbedtls_config.h setting \c MBEDTLS_SSL_IN_CONTENT_LEN, extensions + * such as the max fragment length extension or record size limit + * extension if used, and the current record expansion. + * + * \sa mbedtls_ssl_set_mtu() + * \sa mbedtls_ssl_get_max_in_record_payload() + * \sa mbedtls_ssl_get_record_expansion() + * + * \param ssl SSL context + * + * \return Current maximum payload for an incoming record, + * or a negative error code. + */ +int mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context *ssl); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Return the peer certificate from the current connection. + * + * \param ssl The SSL context to use. This must be initialized and setup. + * + * \return The current peer certificate, if available. + * The returned certificate is owned by the SSL context and + * is valid only until the next call to the SSL API. + * \return \c NULL if no peer certificate is available. This might + * be because the chosen ciphersuite doesn't use CRTs + * (PSK-based ciphersuites, for example), or because + * #MBEDTLS_SSL_KEEP_PEER_CERTIFICATE has been disabled, + * allowing the stack to free the peer's CRT to save memory. + * + * \note For one-time inspection of the peer's certificate during + * the handshake, consider registering an X.509 CRT verification + * callback through mbedtls_ssl_conf_verify() instead of calling + * this function. Using mbedtls_ssl_conf_verify() also comes at + * the benefit of allowing you to influence the verification + * process, for example by masking expected and tolerated + * verification failures. + * + * \warning You must not use the pointer returned by this function + * after any further call to the SSL API, including + * mbedtls_ssl_read() and mbedtls_ssl_write(); this is + * because the pointer might change during renegotiation, + * which happens transparently to the user. + * If you want to use the certificate across API calls, + * you must make a copy. + */ +const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context *ssl); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Export a session in order to resume it later. + * + * \param ssl The SSL context representing the connection for which to + * to export a session structure for later resumption. + * \param session The target structure in which to store the exported session. + * This must have been initialized with mbedtls_ssl_session_init() + * but otherwise be unused. + * + * \note This function can handle a variety of mechanisms for session + * resumption: For TLS 1.2, both session ID-based resumption and + * ticket-based resumption will be considered. For TLS 1.3, + * sessions equate to tickets, and if session tickets are + * enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + * option), this function exports the last received ticket and + * the exported session may be used to resume the TLS 1.3 + * session. If session tickets are disabled, exported sessions + * cannot be used to resume a TLS 1.3 session. + * + * \return \c 0 if successful. In this case, \p session can be used for + * session resumption by passing it to mbedtls_ssl_set_session(), + * and serialized for storage via mbedtls_ssl_session_save(). + * \return Another negative error code on other kinds of failure. + * + * \sa mbedtls_ssl_set_session() + * \sa mbedtls_ssl_session_save() + */ +int mbedtls_ssl_get_session(const mbedtls_ssl_context *ssl, + mbedtls_ssl_session *session); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Perform the SSL handshake + * + * \param ssl SSL context + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use + * and the client did not demonstrate reachability yet - in + * this case you must stop using the context (see below). + * \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + * NewSessionTicket message has been received. See the + * documentation of mbedtls_ssl_read() for more information + * about this error code. + * \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + * defined in RFC 8446 (TLS 1.3 specification), has been + * received as part of the handshake. This is server specific + * and may occur only if the early data feature has been + * enabled on server (see mbedtls_ssl_conf_early_data() + * documentation). You must call mbedtls_ssl_read_early_data() + * to read the early data before resuming the handshake. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note If DTLS is in use, then you may choose to handle + * #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging + * purposes, as it is an expected return value rather than an + * actual error, but you still need to reset/free the context. + * + * \note Remarks regarding event-driven DTLS: + * If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. This is not true for a successful handshake, + * in which case the datagram of the underlying transport that is + * currently being processed might or might not contain further + * DTLS records. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * Otherwise, the handshake may call psa_crypto_init() + * if a negotiation involving TLS 1.3 takes place (this may + * be the case even if TLS 1.3 is offered but eventually + * not selected). + * + * \note In TLS, reception of fragmented handshake messages is + * supported with some limitations (those limitations do + * not apply to DTLS, where defragmentation is fully + * supported): + * - The first fragment of a handshake message must be + * at least 4 bytes long. + * - Non-handshake records must not be interleaved between + * the fragments of a handshake message. (This is permitted + * in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + * even in TLS 1.2.) + */ +int mbedtls_ssl_handshake(mbedtls_ssl_context *ssl); + +/** + * \brief After calling mbedtls_ssl_handshake() to start the SSL + * handshake you can call this function to check whether the + * handshake is over for a given SSL context. This function + * should be also used to determine when to stop calling + * mbedtls_handshake_step() for that context. + * + * \param ssl SSL context + * + * \return \c 1 if handshake is over, \c 0 if it is still ongoing. + */ +static inline int mbedtls_ssl_is_handshake_over(mbedtls_ssl_context *ssl) +{ + return ssl->MBEDTLS_PRIVATE(state) >= MBEDTLS_SSL_HANDSHAKE_OVER; +} + +/** + * \brief Perform a single step of the SSL handshake + * + * \note The state of the context (ssl->state) will be at + * the next state after this function returns \c 0. Do not + * call this function if mbedtls_ssl_is_handshake_over() + * returns \c 1. + * + * \warning Whilst in the past you may have used direct access to the + * context state (ssl->state) in order to ascertain when to + * stop calling this function and although you can still do + * so with something like ssl->MBEDTLS_PRIVATE(state) or by + * defining MBEDTLS_ALLOW_PRIVATE_ACCESS, this is now + * considered deprecated and could be broken in any future + * release. If you still find you have good reason for such + * direct access, then please do contact the team to explain + * this (raise an issue or post to the mailing list), so that + * we can add a solution to your problem that will be + * guaranteed to work in the future. + * + * \param ssl SSL context + * + * \return See mbedtls_ssl_handshake(). + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + */ +int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ssl); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Initiate an SSL renegotiation on the running connection. + * Client: perform the renegotiation right now. + * Server: request renegotiation, which will be performed + * during the next call to mbedtls_ssl_read() if honored by + * client. + * + * \param ssl SSL context + * + * \return 0 if successful, or any mbedtls_ssl_handshake() return + * value except #MBEDTLS_ERR_SSL_CLIENT_RECONNECT that can't + * happen during a renegotiation. + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + * + */ +int mbedtls_ssl_renegotiate(mbedtls_ssl_context *ssl); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Read at most 'len' application data bytes + * + * \param ssl SSL context + * \param buf buffer that will hold the data + * \param len maximum number of bytes to read + * + * \return The (positive) number of bytes read if successful. + * \return \c 0 if the read end of the underlying transport was closed + * without sending a CloseNotify beforehand, which might happen + * because of various reasons (internal error of an underlying + * stack, non-conformant peer not sending a CloseNotify and + * such) - in this case you must stop using the context + * (see below). + * \return #MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY if the underlying + * transport is still functional, but the peer has + * acknowledged to not send anything anymore. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server + * side of a DTLS connection and the client is initiating a + * new connection using the same source port. See below. + * \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + * NewSessionTicket message has been received. + * This error code is only returned on the client side. It is + * only returned if handling of TLS 1.3 NewSessionTicket + * messages has been enabled through + * mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + * This error code indicates that a TLS 1.3 NewSessionTicket + * message has been received and parsed successfully by the + * client. The ticket data can be retrieved from the SSL + * context by calling mbedtls_ssl_get_session(). It remains + * available until the next call to mbedtls_ssl_read(). + * \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + * defined in RFC 8446 (TLS 1.3 specification), has been + * received as part of the handshake. This is server specific + * and may occur only if the early data feature has been + * enabled on server (see mbedtls_ssl_conf_early_data() + * documentation). You must call mbedtls_ssl_read_early_data() + * to read the early data before resuming the handshake. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a positive value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + * #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_CLIENT_RECONNECT + * (which can only happen server-side), it means that a client + * is initiating a new connection using the same source port. + * You can either treat that as a connection close and wait + * for the client to resend a ClientHello, or directly + * continue with \c mbedtls_ssl_handshake() with the same + * context (as it has been reset internally). Either way, you + * must make sure this is seen by the application as a new + * connection: application state, if any, should be reset, and + * most importantly the identity of the client must be checked + * again. WARNING: not validating the identity of the client + * again, or not transmitting the new identity to the + * application layer, would allow authentication bypass! + * + * \note Remarks regarding event-driven DTLS: + * - If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. + * - This function may return MBEDTLS_ERR_SSL_WANT_READ even if data was + * initially available on the underlying transport, as this data may have + * been only e.g. duplicated messages or a renegotiation request. + * Therefore, you must be prepared to receive MBEDTLS_ERR_SSL_WANT_READ even + * when reacting to an incoming-data event from the underlying transport. + * - On success, the datagram of the underlying transport that is currently + * being processed may contain further DTLS records. You should call + * \c mbedtls_ssl_check_pending to check for remaining records. + * + */ +int mbedtls_ssl_read(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len); + +/** + * \brief Try to write exactly 'len' application data bytes + * + * \warning This function will do partial writes in some cases. If the + * return value is non-negative but less than length, the + * function must be called again with updated arguments: + * buf + ret, len - ret (if ret is the return value) until + * it returns a value equal to the last 'len' argument. + * + * \param ssl SSL context + * \param buf buffer holding the data + * \param len how many bytes must be written + * + * \return The (non-negative) number of bytes actually written if + * successful (may be less than \p len). + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + * NewSessionTicket message has been received. See the + * documentation of mbedtls_ssl_read() for more information + * about this error code. + * \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + * defined in RFC 8446 (TLS 1.3 specification), has been + * received as part of the handshake. This is server specific + * and may occur only if the early data feature has been + * enabled on server (see mbedtls_ssl_conf_early_data() + * documentation). You must call mbedtls_ssl_read_early_data() + * to read the early data before resuming the handshake. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a non-negative value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_WANT_WRITE/READ, + * it must be called later with the *same* arguments, + * until it returns a value greater than or equal to 0. When + * the function returns #MBEDTLS_ERR_SSL_WANT_WRITE there may be + * some partial data in the output buffer, however this is not + * yet sent. + * + * \note If the requested length is greater than the maximum + * fragment length (either the built-in limit or the one set + * or negotiated with the peer), then: + * - with TLS, less bytes than requested are written. + * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned. + * \c mbedtls_ssl_get_max_out_record_payload() may be used to + * query the active maximum fragment length. + * + * \note Attempting to write 0 bytes will result in an empty TLS + * application record being sent. + */ +int mbedtls_ssl_write(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len); + +/** + * \brief Send an alert message + * + * \param ssl SSL context + * \param level The alert level of the message + * (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL) + * \param message The alert message (SSL_ALERT_MSG_*) + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_send_alert_message(mbedtls_ssl_context *ssl, + unsigned char level, + unsigned char message); +/** + * \brief Notify the peer that the connection is being closed + * + * \param ssl SSL context + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_close_notify(mbedtls_ssl_context *ssl); + +#if defined(MBEDTLS_SSL_EARLY_DATA) + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Read at most 'len' bytes of early data + * + * \note This API is server specific. + * + * \warning Early data is defined in the TLS 1.3 specification, RFC 8446. + * IMPORTANT NOTE from section 2.3 of the specification: + * + * The security properties for 0-RTT data are weaker than + * those for other kinds of TLS data. Specifically: + * - This data is not forward secret, as it is encrypted + * solely under keys derived using the offered PSK. + * - There are no guarantees of non-replay between connections. + * Protection against replay for ordinary TLS 1.3 1-RTT data + * is provided via the server's Random value, but 0-RTT data + * does not depend on the ServerHello and therefore has + * weaker guarantees. This is especially relevant if the + * data is authenticated either with TLS client + * authentication or inside the application protocol. The + * same warnings apply to any use of the + * early_exporter_master_secret. + * + * \warning Mbed TLS does not implement any of the anti-replay defenses + * defined in section 8 of the TLS 1.3 specification: + * single-use of tickets or ClientHello recording within a + * given time window. + * + * \note This function is used in conjunction with + * mbedtls_ssl_handshake(), mbedtls_ssl_handshake_step(), + * mbedtls_ssl_read() and mbedtls_ssl_write() to read early + * data when these functions return + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA. + * + * \param ssl SSL context, it must have been initialized and set up. + * \param buf buffer that will hold the data + * \param len maximum number of bytes to read + * + * \return The (positive) number of bytes read if successful. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + * \return #MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA if it is not + * possible to read early data for the SSL context \p ssl. Note + * that this function is intended to be called for an SSL + * context \p ssl only after a call to mbedtls_ssl_handshake(), + * mbedtls_ssl_handshake_step(), mbedtls_ssl_read() or + * mbedtls_ssl_write() for \p ssl that has returned + * #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA. + */ +int mbedtls_ssl_read_early_data(mbedtls_ssl_context *ssl, + unsigned char *buf, size_t len); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Try to write exactly 'len' application data bytes while + * performing the handshake (early data). + * + * \warning Early data is defined in the TLS 1.3 specification, RFC 8446. + * IMPORTANT NOTE from section 2.3 of the specification: + * + * The security properties for 0-RTT data are weaker than + * those for other kinds of TLS data. Specifically: + * - This data is not forward secret, as it is encrypted + * solely under keys derived using the offered PSK. + * - There are no guarantees of non-replay between connections. + * Protection against replay for ordinary TLS 1.3 1-RTT data + * is provided via the server's Random value, but 0-RTT data + * does not depend on the ServerHello and therefore has + * weaker guarantees. This is especially relevant if the + * data is authenticated either with TLS client + * authentication or inside the application protocol. The + * same warnings apply to any use of the + * early_exporter_master_secret. + * + * \note This function behaves mainly as mbedtls_ssl_write(). The + * specification of mbedtls_ssl_write() relevant to TLS 1.3 + * (thus not the parts specific to (D)TLS1.2) applies to this + * function and the present documentation is mainly restricted + * to the differences with mbedtls_ssl_write(). One noticeable + * difference though is that mbedtls_ssl_write() aims to + * complete the handshake before to write application data + * while mbedtls_ssl_write_early() aims to drive the handshake + * just past the point where it is not possible to send early + * data anymore. + * + * \param ssl SSL context + * \param buf buffer holding the data + * \param len how many bytes must be written + * + * \return The (non-negative) number of bytes actually written if + * successful (may be less than \p len). + * + * \return One additional specific error code compared to + * mbedtls_ssl_write(): + * #MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA. + * + * #MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA is returned when it + * is not possible to write early data for the SSL context + * \p ssl. + * + * It may have been possible and it is not possible + * anymore because the client received the server Finished + * message, the server rejected early data or the maximum + * number of allowed early data for the PSK in use has been + * reached. + * + * It may never have been possible and will never be possible + * for the SSL context \p ssl because the use of early data + * is disabled for that context or more generally the context + * is not suitably configured to enable early data or the first + * call to the function was done while the handshake was + * already completed. + * + * It is not possible to write early data for the SSL context + * \p ssl and any subsequent call to this API will return this + * error code. But this does not preclude for using it with + * mbedtls_ssl_write(), mbedtls_ssl_read() or + * mbedtls_ssl_handshake() and the handshake can be + * completed by calling one of these APIs. + * + * \note This function may write early data only if the SSL context + * has been configured for the handshake with a PSK for which + * early data is allowed. + * + * \note To maximize the number of early data that can be written in + * the course of the handshake, it is expected that this + * function starts the handshake for the SSL context \p ssl. + * But this is not mandatory. + * + * \note This function does not provide any information on whether + * the server has accepted or will accept early data or not. + * When it returns a positive value, it just means that it + * has written early data to the server. To know whether the + * server has accepted early data or not, you should call + * mbedtls_ssl_get_early_data_status() with the handshake + * completed. + */ +int mbedtls_ssl_write_early_data(mbedtls_ssl_context *ssl, + const unsigned char *buf, size_t len); + +/** + * \brief Get the status of the negotiation of the use of early data. + * + * \param ssl The SSL context to query + * + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if this function is called + * from the server-side. + * + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if this function is called + * prior to completion of the handshake. + * + * \return #MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_INDICATED if the client + * has not indicated the use of early data to the server. + * + * \return #MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED if the client has + * indicated the use of early data and the server has accepted + * it. + * + * \return #MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED if the client has + * indicated the use of early data but the server has rejected + * it. In this situation, the client may want to re-send the + * early data it may have tried to send by calling + * mbedtls_ssl_write_early_data() as ordinary post-handshake + * application data by calling mbedtls_ssl_write(). + * + */ +int mbedtls_ssl_get_early_data_status(mbedtls_ssl_context *ssl); +#endif /* MBEDTLS_SSL_CLI_C */ + +#endif /* MBEDTLS_SSL_EARLY_DATA */ + +/** + * \brief Free referenced items in an SSL context and clear memory + * + * \param ssl SSL context + */ +void mbedtls_ssl_free(mbedtls_ssl_context *ssl); + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) +/** + * \brief Save an active connection as serialized data in a buffer. + * This allows the freeing or re-using of the SSL context + * while still picking up the connection later in a way that + * it entirely transparent to the peer. + * + * \see mbedtls_ssl_context_load() + * + * \warning The serialized data contains highly sensitive material, + * including the master secret from which the session's traffic + * keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_context_save() and + * mbedtls_ssl_context_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * See the mbedtls_ssl_context_load() documentation for + * additional information. + * + * \note The serialized data only contains the data that is + * necessary to resume the connection: negotiated protocol + * options, session identifier, keys, etc. + * Loading a saved SSL context does not restore settings and + * state related to how the application accesses the context, + * such as configured callback functions, user data, pending + * incoming or outgoing data, etc. + * + * \note This feature is currently only available under certain + * conditions, see the documentation of the return value + * #MBEDTLS_ERR_SSL_BAD_INPUT_DATA for details. + * + * \note When this function succeeds, it calls + * mbedtls_ssl_session_reset() on \p ssl which as a result is + * no longer associated with the connection that has been + * serialized. This avoids creating copies of the connection + * state. You're then free to either re-use the context + * structure for a different connection, or call + * mbedtls_ssl_free() on it. See the documentation of + * mbedtls_ssl_session_reset() for more details. + * + * \param ssl The SSL context to save. On success, it is no longer + * associated with the connection that has been serialized. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p buf_len bytes, or may be \c + * NULL if \p buf_len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. However, + * the value of \p olen is only guaranteed to be correct when + * the function returns #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL or + * \c 0. If the return value is different, then the value of + * \p olen is undefined. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed + * while resetting the context. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if a handshake is in + * progress, or there is pending data for reading or sending, + * or the connection does not use DTLS 1.2 with an AEAD + * ciphersuite, or renegotiation is enabled. + */ +int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl, + unsigned char *buf, + size_t buf_len, + size_t *olen); + +/** + * \brief Load serialized connection data to an SSL context. + * + * \see mbedtls_ssl_context_save() + * + * \warning The same serialized data must never be loaded into more + * that one context. In order to ensure that, after + * successfully loading serialized data to an SSL context, you + * should immediately destroy or invalidate all copies of the + * serialized data that was loaded. Loading the same data in + * more than one context would cause severe security failures + * including but not limited to loss of confidentiality. + * + * \warning The serialized data contains highly sensitive material, + * including the master secret from which the session's traffic + * keys are derived. + * + * The serialized data is not cryptographically protected. + * It is the responsibility of the user of the + * mbedtls_ssl_context_save() and + * mbedtls_ssl_context_load() APIs to ensure both its + * confidentiality and integrity while stored or transported. + * + * A breach of confidentiality could result in full compromise + * of the associated TLS session, including loss of + * confidentiality and integrity of past and future + * application data protected under that session. + * + * A breach of integrity may allow modification of the + * serialized data prior to restoration. As it represents + * trusted internal context, tampering could potentially result + * in arbitrary code execution or other severe compromise of + * the hosting process. + * + * \note Before calling this function, the SSL context must be + * prepared in one of the two following ways. The first way is + * to take a context freshly initialised with + * mbedtls_ssl_init() and call mbedtls_ssl_setup() on it with + * the same ::mbedtls_ssl_config structure that was used in + * the original connection. The second way is to + * call mbedtls_ssl_session_reset() on a context that was + * previously prepared as above but used in the meantime. + * Either way, you must not use the context to perform a + * handshake between calling mbedtls_ssl_setup() or + * mbedtls_ssl_session_reset() and calling this function. You + * may however call other setter functions in that time frame + * as indicated in the note below. + * + * \note Before or after calling this function successfully, you + * also need to configure some connection-specific callbacks + * and settings before you can use the connection again + * (unless they were already set before calling + * mbedtls_ssl_session_reset() and the values are suitable for + * the present connection). Specifically, you want to call + * at least mbedtls_ssl_set_bio(), + * mbedtls_ssl_set_timer_cb(), and + * mbedtls_ssl_set_user_data_n() or + * mbedtls_ssl_set_user_data_p() if they were set originally. + * All other SSL setter functions + * are not necessary to call, either because they're only used + * in handshakes, or because the setting is already saved. You + * might choose to call them anyway, for example in order to + * share code between the cases of establishing a new + * connection and the case of loading an already-established + * connection. + * + * \note If you have new information about the path MTU, you want to + * call mbedtls_ssl_set_mtu() after calling this function, as + * otherwise this function would overwrite your + * newly-configured value with the value that was active when + * the context was saved. + * + * \note When this function returns an error code, it calls + * mbedtls_ssl_free() on \p ssl. In this case, you need to + * prepare the context with the usual sequence starting with a + * call to mbedtls_ssl_init() if you want to use it again. + * + * \param ssl The SSL context structure to be populated. It must have + * been prepared as described in the note above. + * \param buf The buffer holding the serialized connection data. It must + * be a readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * comes from a different Mbed TLS version or build. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + */ +int mbedtls_ssl_context_load(mbedtls_ssl_context *ssl, + const unsigned char *buf, + size_t len); +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ + +/** + * \brief Initialize an SSL configuration context + * Just makes the context ready for + * mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free(). + * + * \note You need to call mbedtls_ssl_config_defaults() unless you + * manually set all of the relevant fields yourself. + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_init(mbedtls_ssl_config *conf); + +/** + * \brief Load reasonable default SSL configuration values. + * (You need to call mbedtls_ssl_config_init() first.) + * + * \param conf SSL configuration context + * \param endpoint MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + * \param transport MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS + * \param preset a MBEDTLS_SSL_PRESET_XXX value + * + * \note See \c mbedtls_ssl_conf_transport() for notes on DTLS. + * + * \return 0 if successful, or + * MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error. + */ +int mbedtls_ssl_config_defaults(mbedtls_ssl_config *conf, + int endpoint, int transport, int preset); + +/** + * \brief Free an SSL configuration context + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_free(mbedtls_ssl_config *conf); + +/** + * \brief Initialize SSL session structure + * + * \param session SSL session + */ +void mbedtls_ssl_session_init(mbedtls_ssl_session *session); + +/** + * \brief Free referenced items in an SSL session including the + * peer certificate and clear memory + * + * \note A session object can be freed even if the SSL context + * that was used to retrieve the session is still in use. + * + * \param session SSL session + */ +void mbedtls_ssl_session_free(mbedtls_ssl_session *session); + +/** + * \brief TLS-PRF function for key derivation. + * + * \param prf The tls_prf type function type to be used. + * \param secret Secret for the key derivation function. + * \param slen Length of the secret. + * \param label String label for the key derivation function, + * terminated with null character. + * \param random Random bytes. + * \param rlen Length of the random bytes buffer. + * \param dstbuf The buffer holding the derived key. + * \param dlen Length of the output buffer. + * + * \return 0 on success. An SSL specific error on failure. + */ +int mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf, + const unsigned char *secret, size_t slen, + const char *label, + const unsigned char *random, size_t rlen, + unsigned char *dstbuf, size_t dlen); + +#if defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT) +/* Maximum value for key_len in mbedtls_ssl_export_keying material. Depending on the TLS + * version and the negotiated ciphersuite, larger keys could in principle be exported, + * but for simplicity, we define one limit that works in all cases. TLS 1.3 with SHA256 + * has the strictest limit: 255 blocks of SHA256 output, or 8160 bytes. */ +#define MBEDTLS_SSL_EXPORT_MAX_KEY_LEN 8160 + +/** + * \brief TLS-Exporter to derive shared symmetric keys between server and client. + * + * \param ssl SSL context from which to export keys. Must have finished the handshake. + * \param out Output buffer of length at least key_len bytes. + * \param key_len Length of the key to generate in bytes, must be at most + * MBEDTLS_SSL_EXPORT_MAX_KEY_LEN (8160). + * \param label Label for which to generate the key of length label_len. + * \param label_len Length of label in bytes. Must be at most 249 in TLS 1.3. + * \param context Context of the key. Can be NULL if context_len or use_context is 0. + * \param context_len Length of context. Must be < 2^16 in TLS 1.2. + * \param use_context Indicates if a context should be used in deriving the key. + * + * \note TLS 1.2 makes a distinction between a 0-length context and no context. + * This is why the use_context argument exists. TLS 1.3 does not make + * this distinction. If use_context is 0 and TLS 1.3 is used, context and + * context_len are ignored and a 0-length context is used. + * + * \return 0 on success. + * \return MBEDTLS_ERR_SSL_BAD_INPUT_DATA if the handshake is not yet completed. + * \return An SSL-specific error on failure. + */ +int mbedtls_ssl_export_keying_material(mbedtls_ssl_context *ssl, + uint8_t *out, const size_t key_len, + const char *label, const size_t label_len, + const unsigned char *context, const size_t context_len, + const int use_context); +#endif +#ifdef __cplusplus +} +#endif + +#endif /* ssl.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cache.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cache.h new file mode 100644 index 00000000..a1307b45 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cache.h @@ -0,0 +1,187 @@ +/** + * \file ssl_cache.h + * + * \brief SSL session cache implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SSL_CACHE_H +#define MBEDTLS_SSL_CACHE_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT) +#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /*!< 1 day */ +#endif + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES) +#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /*!< Maximum entries in cache */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct mbedtls_ssl_cache_context mbedtls_ssl_cache_context; +typedef struct mbedtls_ssl_cache_entry mbedtls_ssl_cache_entry; + +/** + * \brief This structure is used for storing cache entries + */ +struct mbedtls_ssl_cache_entry { +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t MBEDTLS_PRIVATE(timestamp); /*!< entry timestamp */ +#endif + + unsigned char MBEDTLS_PRIVATE(session_id)[32]; /*!< session ID */ + size_t MBEDTLS_PRIVATE(session_id_len); + + unsigned char *MBEDTLS_PRIVATE(session); /*!< serialized session */ + size_t MBEDTLS_PRIVATE(session_len); + + mbedtls_ssl_cache_entry *MBEDTLS_PRIVATE(next); /*!< chain pointer */ +}; + +/** + * \brief Cache context + */ +struct mbedtls_ssl_cache_context { + mbedtls_ssl_cache_entry *MBEDTLS_PRIVATE(chain); /*!< start of the chain */ + int MBEDTLS_PRIVATE(timeout); /*!< cache entry timeout */ + int MBEDTLS_PRIVATE(max_entries); /*!< maximum entries */ +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); /*!< mutex */ +#endif +}; + +/** + * \brief Initialize an SSL cache context + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_init(mbedtls_ssl_cache_context *cache); + +/** + * \brief Cache get callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data The SSL cache context to use. + * \param session_id The pointer to the buffer holding the session ID + * for the session to load. + * \param session_id_len The length of \p session_id in bytes. + * \param session The address at which to store the session + * associated with \p session_id, if present. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + * no cache entry with specified session ID found, or + * any other negative error code for other failures. + */ +int mbedtls_ssl_cache_get(void *data, + unsigned char const *session_id, + size_t session_id_len, + mbedtls_ssl_session *session); + +/** + * \brief Cache set callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data The SSL cache context to use. + * \param session_id The pointer to the buffer holding the session ID + * associated to \p session. + * \param session_id_len The length of \p session_id in bytes. + * \param session The session to store. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_ssl_cache_set(void *data, + unsigned char const *session_id, + size_t session_id_len, + const mbedtls_ssl_session *session); + +/** + * \brief Remove the cache entry by the session ID + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data The SSL cache context to use. + * \param session_id The pointer to the buffer holding the session ID + * associated to session. + * \param session_id_len The length of \p session_id in bytes. + * + * \return \c 0 on success. This indicates the cache entry for + * the session with provided ID is removed or does not + * exist. + * \return A negative error code on failure. + */ +int mbedtls_ssl_cache_remove(void *data, + unsigned char const *session_id, + size_t session_id_len); + +#if defined(MBEDTLS_HAVE_TIME) +/** + * \brief Set the cache timeout + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT (1 day)) + * + * A timeout of 0 indicates no timeout. + * + * \param cache SSL cache context + * \param timeout cache entry timeout in seconds + */ +void mbedtls_ssl_cache_set_timeout(mbedtls_ssl_cache_context *cache, int timeout); + +/** + * \brief Get the cache timeout + * + * A timeout of 0 indicates no timeout. + * + * \param cache SSL cache context + * + * \return cache entry timeout in seconds + */ +static inline int mbedtls_ssl_cache_get_timeout(mbedtls_ssl_cache_context *cache) +{ + return cache->MBEDTLS_PRIVATE(timeout); +} +#endif /* MBEDTLS_HAVE_TIME */ + +/** + * \brief Set the maximum number of cache entries + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES (50)) + * + * \param cache SSL cache context + * \param max cache entry maximum + */ +void mbedtls_ssl_cache_set_max_entries(mbedtls_ssl_cache_context *cache, int max); + +/** + * \brief Free referenced items in a cache context and clear memory + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_free(mbedtls_ssl_cache_context *cache); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cache.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ciphersuites.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ciphersuites.h new file mode 100644 index 00000000..12d44620 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ciphersuites.h @@ -0,0 +1,482 @@ +/** + * \file ssl_ciphersuites.h + * + * \brief SSL Ciphersuites for Mbed TLS + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SSL_CIPHERSUITES_H +#define MBEDTLS_SSL_CIPHERSUITES_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/pk.h" +#include "mbedtls/cipher.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Supported ciphersuites (Official IANA names) + */ +#define MBEDTLS_TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ + +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA 0x2C /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA 0x2D /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA 0x2E /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 0x2F + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA 0x35 +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 + +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 + +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA 0x8C +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA 0x8D + +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x90 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x91 + +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA 0x94 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA 0x95 + +#define MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 0xA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 0xA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0xAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0xAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 0xAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 0xAD /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 0xAE +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 0xAF +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA256 0xB0 /**< Weak! */ +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA384 0xB1 /**< Weak! */ + +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 0xB2 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 0xB3 +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 0xB4 /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 0xB5 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 0xB6 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 0xB7 +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 0xB8 /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 0xB9 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A + +#define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F + +#define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B + +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC088 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC089 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC08E /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC08F /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC090 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC091 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC092 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC093 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC094 +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC095 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC096 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B + +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM 0xC0A4 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM 0xC0A5 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM 0xC0A6 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM 0xC0A7 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 0xC0A8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 0xC0A9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 0xC0AA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 0xC0AB /**< TLS 1.2 */ +/* The last two are named with PSK_DHE in the RFC, which looks like a typo */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ + +/* RFC 7905 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */ + +/* RFC 8446, Appendix B.4 */ +#define MBEDTLS_TLS1_3_AES_128_GCM_SHA256 0x1301 /**< TLS 1.3 */ +#define MBEDTLS_TLS1_3_AES_256_GCM_SHA384 0x1302 /**< TLS 1.3 */ +#define MBEDTLS_TLS1_3_CHACHA20_POLY1305_SHA256 0x1303 /**< TLS 1.3 */ +#define MBEDTLS_TLS1_3_AES_128_CCM_SHA256 0x1304 /**< TLS 1.3 */ +#define MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256 0x1305 /**< TLS 1.3 */ + +/* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange. + * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below + */ +typedef enum { + MBEDTLS_KEY_EXCHANGE_NONE = 0, + MBEDTLS_KEY_EXCHANGE_RSA, + MBEDTLS_KEY_EXCHANGE_DHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA, + MBEDTLS_KEY_EXCHANGE_PSK, + MBEDTLS_KEY_EXCHANGE_DHE_PSK, + MBEDTLS_KEY_EXCHANGE_RSA_PSK, + MBEDTLS_KEY_EXCHANGE_ECDHE_PSK, + MBEDTLS_KEY_EXCHANGE_ECDH_RSA, + MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA, + MBEDTLS_KEY_EXCHANGE_ECJPAKE, +} mbedtls_key_exchange_type_t; + +/* Key exchanges using a certificate */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED +#endif + +/* Key exchanges in either TLS 1.2 or 1.3 which are using an ECDSA + * signature */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_ECDSA_ANY_ENABLED +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) +#define MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED +#endif + +/* Key exchanges allowing client certificate requests. + * + * Note: that's almost the same as MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED + * above, except RSA-PSK uses a server certificate but no client cert. + * + * Note: this difference is specific to TLS 1.2, as with TLS 1.3, things are + * more symmetrical: client certs and server certs are either both allowed + * (Ephemeral mode) or both disallowed (PSK and PKS-Ephemeral modes). + */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED +#endif + +/* Helper to state that certificate-based client authentication through ECDSA + * is supported in TLS 1.2 */ +#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) && \ + defined(MBEDTLS_PK_CAN_ECDSA_SIGN) && defined(MBEDTLS_PK_CAN_ECDSA_VERIFY) +#define MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED +#endif + +/* ECDSA required for certificates in either TLS 1.2 or 1.3 */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED +#endif + +/* Key exchanges involving server signature in ServerKeyExchange */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED +#endif + +/* Key exchanges using ECDH */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED +#endif + +/* Key exchanges that don't involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED +#endif + +/* Key exchanges that involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED +#endif + +/* Key exchanges using a PSK */ +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED +#endif + +/* Key exchanges using DHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED +#endif + +/* Key exchanges using ECDHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED +#endif + +/* TLS 1.2 key exchanges using ECDH or ECDHE*/ +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED +#endif + +/* TLS 1.3 PSK key exchanges */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED +#endif + +/* TLS 1.2 or 1.3 key exchanges with PSK */ +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) +#define MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED +#endif + +/* TLS 1.3 ephemeral key exchanges */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED +#endif + +/* TLS 1.3 key exchanges using ECDHE */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) && \ + defined(PSA_WANT_ALG_ECDH) +#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_ECDHE_ENABLED +#endif + +/* TLS 1.2 or 1.3 key exchanges using ECDH or ECDHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_ECDHE_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED +#endif + +/* TLS 1.2 XXDH key exchanges: ECDH or ECDHE or FFDH */ +#if (defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED)) +#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_1_2_ENABLED +#endif + +/* The handshake params structure has a set of fields called xxdh_psa which are used: + * - by TLS 1.2 with `USE_PSA` to do ECDH or ECDHE; + * - by TLS 1.3 to do ECDHE or FFDHE. + * The following macros can be used to guard their declaration and use. + */ +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) && \ + defined(MBEDTLS_USE_PSA_CRYPTO) +#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_1_2_ENABLED +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_1_2_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED +#endif + +typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t; + +#define MBEDTLS_CIPHERSUITE_WEAK 0x01 /**< Weak ciphersuite flag */ +#define MBEDTLS_CIPHERSUITE_SHORT_TAG 0x02 /**< Short authentication tag, + eg for CCM_8 */ +#define MBEDTLS_CIPHERSUITE_NODTLS 0x04 /**< Can't be used with DTLS */ + +/** + * \brief This structure is used for storing ciphersuite information + * + * \note members are defined using integral types instead of enums + * in order to pack structure and reduce memory usage by internal + * \c ciphersuite_definitions[] + */ +struct mbedtls_ssl_ciphersuite_t { + int MBEDTLS_PRIVATE(id); + const char *MBEDTLS_PRIVATE(name); + + uint8_t MBEDTLS_PRIVATE(cipher); /* mbedtls_cipher_type_t */ + uint8_t MBEDTLS_PRIVATE(mac); /* mbedtls_md_type_t */ + uint8_t MBEDTLS_PRIVATE(key_exchange); /* mbedtls_key_exchange_type_t */ + uint8_t MBEDTLS_PRIVATE(flags); + + uint16_t MBEDTLS_PRIVATE(min_tls_version); /* mbedtls_ssl_protocol_version */ + uint16_t MBEDTLS_PRIVATE(max_tls_version); /* mbedtls_ssl_protocol_version */ +}; + +const int *mbedtls_ssl_list_ciphersuites(void); + +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_string(const char *ciphersuite_name); +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id(int ciphersuite_id); + +static inline const char *mbedtls_ssl_ciphersuite_get_name(const mbedtls_ssl_ciphersuite_t *info) +{ + return info->MBEDTLS_PRIVATE(name); +} + +static inline int mbedtls_ssl_ciphersuite_get_id(const mbedtls_ssl_ciphersuite_t *info) +{ + return info->MBEDTLS_PRIVATE(id); +} + +size_t mbedtls_ssl_ciphersuite_get_cipher_key_bitlen(const mbedtls_ssl_ciphersuite_t *info); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ciphersuites.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cookie.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cookie.h new file mode 100644 index 00000000..0f211e63 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_cookie.h @@ -0,0 +1,106 @@ +/** + * \file ssl_cookie.h + * + * \brief DTLS cookie callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SSL_COOKIE_H +#define MBEDTLS_SSL_COOKIE_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/ssl.h" + +#if !defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif +#endif /* !MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in mbedtls_config.h or define them on the compiler command line. + * \{ + */ +#ifndef MBEDTLS_SSL_COOKIE_TIMEOUT +#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Context for the default cookie functions. + */ +typedef struct mbedtls_ssl_cookie_ctx { +#if defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(psa_hmac_key); /*!< key id for the HMAC portion */ + psa_algorithm_t MBEDTLS_PRIVATE(psa_hmac_alg); /*!< key algorithm for the HMAC portion */ +#else + mbedtls_md_context_t MBEDTLS_PRIVATE(hmac_ctx); /*!< context for the HMAC portion */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ +#if !defined(MBEDTLS_HAVE_TIME) + unsigned long MBEDTLS_PRIVATE(serial); /*!< serial number for expiration */ +#endif + unsigned long MBEDTLS_PRIVATE(timeout); /*!< timeout delay, in seconds if HAVE_TIME, + or in number of tickets issued */ + +#if !defined(MBEDTLS_USE_PSA_CRYPTO) +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); +#endif +#endif /* !MBEDTLS_USE_PSA_CRYPTO */ +} mbedtls_ssl_cookie_ctx; + +/** + * \brief Initialize cookie context + */ +void mbedtls_ssl_cookie_init(mbedtls_ssl_cookie_ctx *ctx); + +/** + * \brief Setup cookie context (generate keys) + */ +int mbedtls_ssl_cookie_setup(mbedtls_ssl_cookie_ctx *ctx, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +/** + * \brief Set expiration delay for cookies + * (Default MBEDTLS_SSL_COOKIE_TIMEOUT) + * + * \param ctx Cookie context + * \param delay Delay, in seconds if HAVE_TIME, or in number of cookies + * issued in the meantime. + * 0 to disable expiration (NOT recommended) + */ +void mbedtls_ssl_cookie_set_timeout(mbedtls_ssl_cookie_ctx *ctx, unsigned long delay); + +/** + * \brief Free cookie context + */ +void mbedtls_ssl_cookie_free(mbedtls_ssl_cookie_ctx *ctx); + +/** + * \brief Generate cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_write_t mbedtls_ssl_cookie_write; + +/** + * \brief Verify cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_check_t mbedtls_ssl_cookie_check; + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cookie.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ticket.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ticket.h new file mode 100644 index 00000000..9f7e4402 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/ssl_ticket.h @@ -0,0 +1,199 @@ +/** + * \file ssl_ticket.h + * + * \brief TLS server ticket callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_SSL_TICKET_H +#define MBEDTLS_SSL_TICKET_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +/* + * This implementation of the session ticket callbacks includes key + * management, rotating the keys periodically in order to preserve forward + * secrecy, when MBEDTLS_HAVE_TIME is defined. + */ + +#include "mbedtls/ssl.h" +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#define MBEDTLS_SSL_TICKET_MAX_KEY_BYTES 32 /*!< Max supported key length in bytes */ +#define MBEDTLS_SSL_TICKET_KEY_NAME_BYTES 4 /*!< key name length in bytes */ + +/** + * \brief Information for session ticket protection + */ +typedef struct mbedtls_ssl_ticket_key { + unsigned char MBEDTLS_PRIVATE(name)[MBEDTLS_SSL_TICKET_KEY_NAME_BYTES]; + /*!< random key identifier */ +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t MBEDTLS_PRIVATE(generation_time); /*!< key generation timestamp (seconds) */ +#endif + /*! Lifetime of the key in seconds. This is also the lifetime of the + * tickets created under that key. + */ + uint32_t MBEDTLS_PRIVATE(lifetime); +#if !defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_cipher_context_t MBEDTLS_PRIVATE(ctx); /*!< context for auth enc/decryption */ +#else + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(key); /*!< key used for auth enc/decryption */ + psa_algorithm_t MBEDTLS_PRIVATE(alg); /*!< algorithm of auth enc/decryption */ + psa_key_type_t MBEDTLS_PRIVATE(key_type); /*!< key type */ + size_t MBEDTLS_PRIVATE(key_bits); /*!< key length in bits */ +#endif +} +mbedtls_ssl_ticket_key; + +/** + * \brief Context for session ticket handling functions + */ +typedef struct mbedtls_ssl_ticket_context { + mbedtls_ssl_ticket_key MBEDTLS_PRIVATE(keys)[2]; /*!< ticket protection keys */ + unsigned char MBEDTLS_PRIVATE(active); /*!< index of the currently active key */ + + uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< lifetime of tickets in seconds */ + + /** Callback for getting (pseudo-)random numbers */ + int(*MBEDTLS_PRIVATE(f_rng))(void *, unsigned char *, size_t); + void *MBEDTLS_PRIVATE(p_rng); /*!< context for the RNG function */ + +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); +#endif +} +mbedtls_ssl_ticket_context; + +/** + * \brief Initialize a ticket context. + * (Just make it ready for mbedtls_ssl_ticket_setup() + * or mbedtls_ssl_ticket_free().) + * + * \param ctx Context to be initialized + */ +void mbedtls_ssl_ticket_init(mbedtls_ssl_ticket_context *ctx); + +/** + * \brief Prepare context to be actually used + * + * \param ctx Context to be set up + * \param f_rng RNG callback function (mandatory) + * \param p_rng RNG callback context. + * Note that the RNG callback must remain valid + * until the ticket context is freed. + * \param cipher AEAD cipher to use for ticket protection. + * Recommended value: MBEDTLS_CIPHER_AES_256_GCM. + * \param lifetime Tickets lifetime in seconds + * Recommended value: 86400 (one day). + * + * \note It is highly recommended to select a cipher that is at + * least as strong as the strongest ciphersuite + * supported. Usually that means a 256-bit key. + * + * \note It is recommended to pick a reasonable lifetime so as not + * to negate the benefits of forward secrecy. + * + * \note The TLS 1.3 specification states that ticket lifetime must + * be smaller than seven days. If ticket lifetime has been + * set to a value greater than seven days in this module then + * if the TLS 1.3 is configured to send tickets after the + * handshake it will fail the connection when trying to send + * the first ticket. + * + * \return 0 if successful, + * or a specific MBEDTLS_ERR_XXX error code + */ +int mbedtls_ssl_ticket_setup(mbedtls_ssl_ticket_context *ctx, + mbedtls_f_rng_t *f_rng, void *p_rng, + mbedtls_cipher_type_t cipher, + uint32_t lifetime); + +/** + * \brief Rotate session ticket encryption key to new specified key. + * Provides for external control of session ticket encryption + * key rotation, e.g. for synchronization between different + * machines. If this function is not used, or if not called + * before ticket lifetime expires, then a new session ticket + * encryption key is generated internally in order to avoid + * unbounded session ticket encryption key lifetimes. + * + * \param ctx Context to be set up + * \param name Session ticket encryption key name + * \param nlength Session ticket encryption key name length in bytes + * \param k Session ticket encryption key + * \param klength Session ticket encryption key length in bytes + * \param lifetime Tickets lifetime in seconds + * Recommended value: 86400 (one day). + * + * \note \c name and \c k are recommended to be cryptographically + * random data. + * + * \note \c nlength must match sizeof( ctx->name ) + * + * \note \c klength must be sufficient for use by cipher specified + * to \c mbedtls_ssl_ticket_setup + * + * \note It is recommended to pick a reasonable lifetime so as not + * to negate the benefits of forward secrecy. + * + * \note The TLS 1.3 specification states that ticket lifetime must + * be smaller than seven days. If ticket lifetime has been + * set to a value greater than seven days in this module then + * if the TLS 1.3 is configured to send tickets after the + * handshake it will fail the connection when trying to send + * the first ticket. + * + * \return 0 if successful, + * or a specific MBEDTLS_ERR_XXX error code + */ +int mbedtls_ssl_ticket_rotate(mbedtls_ssl_ticket_context *ctx, + const unsigned char *name, size_t nlength, + const unsigned char *k, size_t klength, + uint32_t lifetime); + +/** + * \brief Implementation of the ticket write callback + * + * \note See \c mbedtls_ssl_ticket_write_t for description + */ +mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write; + +/** + * \brief Implementation of the ticket parse callback + * + * \note See \c mbedtls_ssl_ticket_parse_t for description + */ +mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse; + +/** + * \brief Free a context's content and zeroize it. + * + * \param ctx Context to be cleaned up + */ +void mbedtls_ssl_ticket_free(mbedtls_ssl_ticket_context *ctx); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ticket.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/threading.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/threading.h new file mode 100644 index 00000000..7b55a464 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/threading.h @@ -0,0 +1,167 @@ +/** + * \file threading.h + * + * \brief Threading abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_THREADING_H +#define MBEDTLS_THREADING_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C +/** Locking / unlocking / free failed with error code. */ +#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E + +#if defined(MBEDTLS_THREADING_PTHREAD) +#include +typedef struct mbedtls_threading_mutex_t { + pthread_mutex_t MBEDTLS_PRIVATE(mutex); + + /* WARNING - state should only be accessed when holding the mutex lock in + * framework/tests/src/threading_helpers.c, otherwise corruption can occur. + * state will be 0 after a failed init or a free, and nonzero after a + * successful init. This field is for testing only and thus not considered + * part of the public API of Mbed TLS and may change without notice.*/ + char MBEDTLS_PRIVATE(state); + +} mbedtls_threading_mutex_t; +#endif + +#if defined(MBEDTLS_THREADING_ALT) +/* You should define the mbedtls_threading_mutex_t type in your header */ +#include "threading_alt.h" + +/** + * \brief Set your alternate threading implementation function + * pointers and initialize global mutexes. If used, this + * function must be called once in the main thread before any + * other Mbed TLS function is called, and + * mbedtls_threading_free_alt() must be called once in the main + * thread after all other Mbed TLS functions. + * + * \warning \p mutex_init and \p mutex_free don't return a status code. + * If \p mutex_init fails, it should leave the mutex in + * a state such that \p mutex_lock will reliably return + * #MBEDTLS_ERR_THREADING_MUTEX_ERROR called on this mutex, + * and \p mutex_free will do nothing. + * + * \param mutex_init The init function implementation.
+ * The behavior is undefined if the mutex is already + * initialized and has not been destroyed. + * On platforms where mutex initialization can fail, + * since this function does not return a status code, + * it must leave the mutex object in a safe state where + * subsequent function calls will not cause undefined + * behavior: after a call to \p mutex_init, the + * function \p mutex_lock must either succeed or + * fail with a nonzero status code, and the function + * \p mutex_free must free any resources associated + * with the mutex.. + * \param mutex_free The destroy function implementation.
+ * This function must free any resources associated + * with the mutex object.
+ * This function must work reliably if \p mutex_init + * has been called on the mutex and \p mutex_free + * has not yet been called.
+ * The behavior is undefined if the mutex was not + * initialized, if it has already been destroyed, + * if it is currently locked, or if this function + * is called concurrently from multiple threads. + * \param mutex_lock The lock function implementation.
+ * This function must work reliably on any mutex + * which is not currently locked and on which + * \p mutex_init has already been called but + * \p mutex_free has not been called yet.
+ * The behavior is undefined if the mutex was not + * initialized, if it has already been destroyed, or if + * it is currently locked by the calling thread. + * \param mutex_unlock The unlock function implementation.
+ * The behavior is undefined if the mutex is not + * currently locked by the calling thread. + */ +void mbedtls_threading_set_alt(void (*mutex_init)(mbedtls_threading_mutex_t *), + void (*mutex_free)(mbedtls_threading_mutex_t *), + int (*mutex_lock)(mbedtls_threading_mutex_t *), + int (*mutex_unlock)(mbedtls_threading_mutex_t *)); + +/** + * \brief Free global mutexes. + */ +void mbedtls_threading_free_alt(void); +#endif /* MBEDTLS_THREADING_ALT */ + +#if defined(MBEDTLS_THREADING_C) +/* + * The function pointers for mutex_init, mutex_free, mutex_ and mutex_unlock + * + * All these functions are expected to work or the result will be undefined. + */ +extern void (*mbedtls_mutex_init)(mbedtls_threading_mutex_t *mutex); +extern void (*mbedtls_mutex_free)(mbedtls_threading_mutex_t *mutex); +extern int (*mbedtls_mutex_lock)(mbedtls_threading_mutex_t *mutex); +extern int (*mbedtls_mutex_unlock)(mbedtls_threading_mutex_t *mutex); + +/* + * Global mutexes + */ +#if defined(MBEDTLS_FS_IO) +extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex; +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) +/* This mutex may or may not be used in the default definition of + * mbedtls_platform_gmtime_r(), but in order to determine that, + * we need to check POSIX features, hence modify _POSIX_C_SOURCE. + * With the current approach, this declaration is orphaned, lacking + * an accompanying definition, in case mbedtls_platform_gmtime_r() + * doesn't need it, but that's not a problem. */ +extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex; +#endif /* MBEDTLS_HAVE_TIME_DATE && !MBEDTLS_PLATFORM_GMTIME_R_ALT */ + +#if defined(MBEDTLS_PSA_CRYPTO_C) +/* + * A mutex used to make the PSA subsystem thread safe. + * + * key_slot_mutex protects the registered_readers and + * state variable for all key slots in &global_data.key_slots. + * + * This mutex must be held when any read from or write to a state or + * registered_readers field is performed, i.e. when calling functions: + * psa_key_slot_state_transition(), psa_register_read(), psa_unregister_read(), + * psa_key_slot_has_readers() and psa_wipe_key_slot(). */ +extern mbedtls_threading_mutex_t mbedtls_threading_key_slot_mutex; + +/* + * A mutex used to make the non-rng PSA global_data struct members thread safe. + * + * This mutex must be held when reading or writing to any of the PSA global_data + * structure members, other than the rng_state or rng struct. */ +extern mbedtls_threading_mutex_t mbedtls_threading_psa_globaldata_mutex; + +/* + * A mutex used to make the PSA global_data rng data thread safe. + * + * This mutex must be held when reading or writing to the PSA + * global_data rng_state or rng struct members. */ +extern mbedtls_threading_mutex_t mbedtls_threading_psa_rngdata_mutex; +#endif + +#endif /* MBEDTLS_THREADING_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* threading.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/timing.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/timing.h new file mode 100644 index 00000000..62ae1022 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/timing.h @@ -0,0 +1,94 @@ +/** + * \file timing.h + * + * \brief Portable interface to timeouts and to the CPU cycle counter + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_TIMING_H +#define MBEDTLS_TIMING_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_TIMING_ALT) +// Regular implementation +// + +/** + * \brief timer structure + */ +struct mbedtls_timing_hr_time { + uint64_t MBEDTLS_PRIVATE(opaque)[4]; +}; + +/** + * \brief Context for mbedtls_timing_set/get_delay() + */ +typedef struct mbedtls_timing_delay_context { + struct mbedtls_timing_hr_time MBEDTLS_PRIVATE(timer); + uint32_t MBEDTLS_PRIVATE(int_ms); + uint32_t MBEDTLS_PRIVATE(fin_ms); +} mbedtls_timing_delay_context; + +#else /* MBEDTLS_TIMING_ALT */ +#include "timing_alt.h" +#endif /* MBEDTLS_TIMING_ALT */ + +/* Internal use */ +unsigned long mbedtls_timing_get_timer(struct mbedtls_timing_hr_time *val, int reset); + +/** + * \brief Set a pair of delays to watch + * (See \c mbedtls_timing_get_delay().) + * + * \param data Pointer to timing data. + * Must point to a valid \c mbedtls_timing_delay_context struct. + * \param int_ms First (intermediate) delay in milliseconds. + * The effect if int_ms > fin_ms is unspecified. + * \param fin_ms Second (final) delay in milliseconds. + * Pass 0 to cancel the current delay. + * + * \note To set a single delay, either use \c mbedtls_timing_set_timer + * directly or use this function with int_ms == fin_ms. + */ +void mbedtls_timing_set_delay(void *data, uint32_t int_ms, uint32_t fin_ms); + +/** + * \brief Get the status of delays + * (Memory helper: number of delays passed.) + * + * \param data Pointer to timing data + * Must point to a valid \c mbedtls_timing_delay_context struct. + * + * \return -1 if cancelled (fin_ms = 0), + * 0 if none of the delays are passed, + * 1 if only the intermediate delay is passed, + * 2 if the final delay is passed. + */ +int mbedtls_timing_get_delay(void *data); + +/** + * \brief Get the final timing delay + * + * \param data Pointer to timing data + * Must point to a valid \c mbedtls_timing_delay_context struct. + * + * \return Final timing delay in milliseconds. + */ +uint32_t mbedtls_timing_get_final_delay( + const mbedtls_timing_delay_context *data); + +#ifdef __cplusplus +} +#endif + +#endif /* timing.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/version.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/version.h new file mode 100644 index 00000000..637f9d38 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/version.h @@ -0,0 +1,78 @@ +/** + * \file version.h + * + * \brief Run-time version information + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +/* + * This set of run-time variables can be used to determine the version number of + * the Mbed TLS library used. Compile-time version defines for the same can be + * found in build_info.h + */ +#ifndef MBEDTLS_VERSION_H +#define MBEDTLS_VERSION_H + +#include "mbedtls/build_info.h" + +#if defined(MBEDTLS_VERSION_C) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Get the version number. + * + * \return The constructed version number in the format + * MMNNPP00 (Major, Minor, Patch). + */ +unsigned int mbedtls_version_get_number(void); + +/** + * Get the version string ("x.y.z"). + * + * \param string The string that will receive the value. + * (Should be at least 9 bytes in size) + */ +void mbedtls_version_get_string(char *string); + +/** + * Get the full version string ("Mbed TLS x.y.z"). + * + * \param string The string that will receive the value. The Mbed TLS version + * string will use 18 bytes AT MOST including a terminating + * null byte. + * (So the buffer should be at least 18 bytes to receive this + * version string). + */ +void mbedtls_version_get_string_full(char *string); + +/** + * \brief Check if support for a feature was compiled into this + * Mbed TLS binary. This allows you to see at runtime if the + * library was for instance compiled with or without + * Multi-threading support. + * + * \note only checks against defines in the sections "System + * support", "Mbed TLS modules" and "Mbed TLS feature + * support" in mbedtls_config.h + * + * \param feature The string for the define to check (e.g. "MBEDTLS_AES_C") + * + * \return 0 if the feature is present, + * -1 if the feature is not present and + * -2 if support for feature checking as a whole was not + * compiled in. + */ +int mbedtls_version_check_feature(const char *feature); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_VERSION_C */ + +#endif /* version.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509.h new file mode 100644 index 00000000..6b104613 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509.h @@ -0,0 +1,500 @@ +/** + * \file x509.h + * + * \brief X.509 generic defines and structures + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_X509_H +#define MBEDTLS_X509_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +/** + * \addtogroup x509_module + * \{ + */ + +#if !defined(MBEDTLS_X509_MAX_INTERMEDIATE_CA) +/** + * Maximum number of intermediate CAs in a verification chain. + * That is, maximum length of the chain, excluding the end-entity certificate + * and the trusted root certificate. + * + * Set this to a low value to prevent an adversary from making you waste + * resources verifying an overlong certificate chain. + */ +#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 +#endif + +/** + * \name X509 Error codes + * \{ + */ +/** Unavailable feature, e.g. RSA hashing/encryption combination. */ +#define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080 +/** Requested OID is unknown. */ +#define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100 +/** The CRT/CRL/CSR format is invalid, e.g. different type expected. */ +#define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180 +/** The CRT/CRL/CSR version element is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200 +/** The serial tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_ALG -0x2300 +/** The name tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_NAME -0x2380 +/** The date tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_DATE -0x2400 +/** The signature tag or value invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480 +/** The extension tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500 +/** CRT/CRL/CSR has an unsupported version number. */ +#define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580 +/** Signature algorithm (oid) is unsupported. */ +#define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600 +/** Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */ +#define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680 +/** Certificate verification failed, e.g. CRL, CA or signature check failed. */ +#define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700 +/** Format not recognized as DER or PEM. */ +#define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 +/** Input invalid. */ +#define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 +/** Destination buffer is too small. */ +#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 +/** A fatal error occurred, eg the chain is too long or the vrfy callback failed. */ +#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 +/** \} name X509 Error codes */ + +/** + * \name X509 Verify codes + * \{ + */ +/* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */ +#define MBEDTLS_X509_BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */ +#define MBEDTLS_X509_BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */ +#define MBEDTLS_X509_BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */ +#define MBEDTLS_X509_BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_NOT_TRUSTED 0x10 /**< The CRL is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_EXPIRED 0x20 /**< The CRL is expired. */ +#define MBEDTLS_X509_BADCERT_MISSING 0x40 /**< Certificate was missing. */ +#define MBEDTLS_X509_BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was skipped. */ +#define MBEDTLS_X509_BADCERT_OTHER 0x0100 /**< Other reason (can be used by verify callback) */ +#define MBEDTLS_X509_BADCERT_FUTURE 0x0200 /**< The certificate validity starts in the future. */ +#define MBEDTLS_X509_BADCRL_FUTURE 0x0400 /**< The CRL is from the future */ +#define MBEDTLS_X509_BADCERT_KEY_USAGE 0x0800 /**< Usage does not match the keyUsage extension. */ +#define MBEDTLS_X509_BADCERT_EXT_KEY_USAGE 0x1000 /**< Usage does not match the extendedKeyUsage extension. */ +#define MBEDTLS_X509_BADCERT_NS_CERT_TYPE 0x2000 /**< Usage does not match the nsCertType extension. */ +#define MBEDTLS_X509_BADCERT_BAD_MD 0x4000 /**< The certificate is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCERT_BAD_PK 0x8000 /**< The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCERT_BAD_KEY 0x010000 /**< The certificate is signed with an unacceptable key (eg bad curve, RSA too short). */ +#define MBEDTLS_X509_BADCRL_BAD_MD 0x020000 /**< The CRL is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCRL_BAD_PK 0x040000 /**< The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCRL_BAD_KEY 0x080000 /**< The CRL is signed with an unacceptable key (eg bad curve, RSA too short). */ + +/** \} name X509 Verify codes */ +/** \} addtogroup x509_module */ + +/* + * X.509 v3 Subject Alternative Name types. + * otherName [0] OtherName, + * rfc822Name [1] IA5String, + * dNSName [2] IA5String, + * x400Address [3] ORAddress, + * directoryName [4] Name, + * ediPartyName [5] EDIPartyName, + * uniformResourceIdentifier [6] IA5String, + * iPAddress [7] OCTET STRING, + * registeredID [8] OBJECT IDENTIFIER + */ +#define MBEDTLS_X509_SAN_OTHER_NAME 0 +#define MBEDTLS_X509_SAN_RFC822_NAME 1 +#define MBEDTLS_X509_SAN_DNS_NAME 2 +#define MBEDTLS_X509_SAN_X400_ADDRESS_NAME 3 +#define MBEDTLS_X509_SAN_DIRECTORY_NAME 4 +#define MBEDTLS_X509_SAN_EDI_PARTY_NAME 5 +#define MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER 6 +#define MBEDTLS_X509_SAN_IP_ADDRESS 7 +#define MBEDTLS_X509_SAN_REGISTERED_ID 8 + +/* + * X.509 v3 Key Usage Extension flags + * Reminder: update mbedtls_x509_info_key_usage() when adding new flags. + */ +#define MBEDTLS_X509_KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ +#define MBEDTLS_X509_KU_NON_REPUDIATION (0x40) /* bit 1 */ +#define MBEDTLS_X509_KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ +#define MBEDTLS_X509_KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ +#define MBEDTLS_X509_KU_KEY_AGREEMENT (0x08) /* bit 4 */ +#define MBEDTLS_X509_KU_KEY_CERT_SIGN (0x04) /* bit 5 */ +#define MBEDTLS_X509_KU_CRL_SIGN (0x02) /* bit 6 */ +#define MBEDTLS_X509_KU_ENCIPHER_ONLY (0x01) /* bit 7 */ +#define MBEDTLS_X509_KU_DECIPHER_ONLY (0x8000) /* bit 8 */ + +/* + * Netscape certificate types + * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) + */ + +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ +#define MBEDTLS_X509_NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ + +/* + * X.509 extension types + * + * Comments refer to the status for using certificates. Status can be + * different for writing certificates or reading CRLs or CSRs. + * + * Those are defined in oid.h as oid.c needs them in a data structure. Since + * these were previously defined here, let's have aliases for compatibility. + */ +#define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_KEY_USAGE MBEDTLS_OID_X509_EXT_KEY_USAGE +#define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES +#define MBEDTLS_X509_EXT_POLICY_MAPPINGS MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS +#define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME /* Supported (DNS) */ +#define MBEDTLS_X509_EXT_ISSUER_ALT_NAME MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME +#define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS +#define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS /* Supported */ +#define MBEDTLS_X509_EXT_NAME_CONSTRAINTS MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS +#define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS +#define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE +#define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS +#define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY +#define MBEDTLS_X509_EXT_FRESHEST_CRL MBEDTLS_OID_X509_EXT_FRESHEST_CRL +#define MBEDTLS_X509_EXT_NS_CERT_TYPE MBEDTLS_OID_X509_EXT_NS_CERT_TYPE + +/* + * Storage format identifiers + * Recognized formats: PEM and DER + */ +#define MBEDTLS_X509_FORMAT_DER 1 +#define MBEDTLS_X509_FORMAT_PEM 2 + +#define MBEDTLS_X509_MAX_DN_NAME_SIZE 256 /**< Maximum value size of a DN entry */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures for parsing X.509 certificates, CRLs and CSRs + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef mbedtls_asn1_buf mbedtls_x509_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef mbedtls_asn1_bitstring mbedtls_x509_bitstring; + +/** + * Container for ASN1 named information objects. + * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.). + */ +typedef mbedtls_asn1_named_data mbedtls_x509_name; + +/** + * Container for a sequence of ASN.1 items + */ +typedef mbedtls_asn1_sequence mbedtls_x509_sequence; + +/* + * Container for the fields of the Authority Key Identifier object + */ +typedef struct mbedtls_x509_authority { + mbedtls_x509_buf keyIdentifier; + mbedtls_x509_sequence authorityCertIssuer; + mbedtls_x509_buf authorityCertSerialNumber; + mbedtls_x509_buf raw; +} +mbedtls_x509_authority; + +/** Container for date and time (precision in seconds). */ +typedef struct mbedtls_x509_time { + int year, mon, day; /**< Date. */ + int hour, min, sec; /**< Time. */ +} +mbedtls_x509_time; + +/** + * From RFC 5280 section 4.2.1.6: + * OtherName ::= SEQUENCE { + * type-id OBJECT IDENTIFIER, + * value [0] EXPLICIT ANY DEFINED BY type-id } + * + * Future versions of the library may add new fields to this structure or + * to its embedded union and structure. + */ +typedef struct mbedtls_x509_san_other_name { + /** + * The type_id is an OID as defined in RFC 5280. + * To check the value of the type id, you should use + * \p MBEDTLS_OID_CMP with a known OID mbedtls_x509_buf. + */ + mbedtls_x509_buf type_id; /**< The type id. */ + union { + /** + * From RFC 4108 section 5: + * HardwareModuleName ::= SEQUENCE { + * hwType OBJECT IDENTIFIER, + * hwSerialNum OCTET STRING } + */ + struct { + mbedtls_x509_buf oid; /**< The object identifier. */ + mbedtls_x509_buf val; /**< The named value. */ + } + hardware_module_name; + } + value; +} +mbedtls_x509_san_other_name; + +/** + * A structure for holding the parsed Subject Alternative Name, + * according to type. + * + * Future versions of the library may add new fields to this structure or + * to its embedded union and structure. + */ +typedef struct mbedtls_x509_subject_alternative_name { + int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */ + union { + mbedtls_x509_san_other_name other_name; + mbedtls_x509_name directory_name; + mbedtls_x509_buf unstructured_name; /**< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. */ + } + san; /**< A union of the supported SAN types */ +} +mbedtls_x509_subject_alternative_name; + +typedef struct mbedtls_x509_san_list { + mbedtls_x509_subject_alternative_name node; + struct mbedtls_x509_san_list *next; +} +mbedtls_x509_san_list; + +/** \} name Structures for parsing X.509 certificates, CRLs and CSRs */ +/** \} addtogroup x509_module */ + +/** + * \brief Store the certificate DN in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param dn The X509 name to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_dn_gets(char *buf, size_t size, const mbedtls_x509_name *dn); + +/** + * \brief Convert the certificate DN string \p name into + * a linked list of mbedtls_x509_name (equivalent to + * mbedtls_asn1_named_data). + * + * \note This function allocates a linked list, and places the head + * pointer in \p head. This list must later be freed by a + * call to mbedtls_asn1_free_named_data_list(). + * + * \param[out] head Address in which to store the pointer to the head of the + * allocated list of mbedtls_x509_name. Must point to NULL on + * entry. + * \param[in] name The string representation of a DN to convert + * + * \return 0 on success, or a negative error code. + */ +int mbedtls_x509_string_to_names(mbedtls_asn1_named_data **head, const char *name); + +/** + * \brief Return the next relative DN in an X509 name. + * + * \note Intended use is to compare function result to dn->next + * in order to detect boundaries of multi-valued RDNs. + * + * \param dn Current node in the X509 name + * + * \return Pointer to the first attribute-value pair of the + * next RDN in sequence, or NULL if end is reached. + */ +static inline mbedtls_x509_name *mbedtls_x509_dn_get_next( + mbedtls_x509_name *dn) +{ + while (dn->MBEDTLS_PRIVATE(next_merged) && dn->next != NULL) { + dn = dn->next; + } + return dn->next; +} + +/** + * \brief Store the certificate serial in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param serial The X509 serial to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_serial_gets(char *buf, size_t size, const mbedtls_x509_buf *serial); + +/** + * \brief Compare pair of mbedtls_x509_time. + * + * \param t1 mbedtls_x509_time to compare + * \param t2 mbedtls_x509_time to compare + * + * \return < 0 if t1 is before t2 + * 0 if t1 equals t2 + * > 0 if t1 is after t2 + */ +int mbedtls_x509_time_cmp(const mbedtls_x509_time *t1, const mbedtls_x509_time *t2); + +#if defined(MBEDTLS_HAVE_TIME_DATE) +/** + * \brief Fill mbedtls_x509_time with provided mbedtls_time_t. + * + * \param tt mbedtls_time_t to convert + * \param now mbedtls_x509_time to fill with converted mbedtls_time_t + * + * \return \c 0 on success + * \return A non-zero return value on failure. + */ +int mbedtls_x509_time_gmtime(mbedtls_time_t tt, mbedtls_x509_time *now); +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the past. + * + * \note Intended usage is "if( is_past( valid_to ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param to mbedtls_x509_time to check + * + * \return 1 if the given time is in the past or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_past(const mbedtls_x509_time *to); + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the future. + * + * \note Intended usage is "if( is_future( valid_from ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param from mbedtls_x509_time to check + * + * \return 1 if the given time is in the future or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_future(const mbedtls_x509_time *from); + +/** + * \brief This function parses an item in the SubjectAlternativeNames + * extension. Please note that this function might allocate + * additional memory for a subject alternative name, thus + * mbedtls_x509_free_subject_alt_name has to be called + * to dispose of this additional memory afterwards. + * + * \param san_buf The buffer holding the raw data item of the subject + * alternative name. + * \param san The target structure to populate with the parsed presentation + * of the subject alternative name encoded in \p san_buf. + * + * \note Supported GeneralName types, as defined in RFC 5280: + * "rfc822Name", "dnsName", "directoryName", + * "uniformResourceIdentifier" and "hardware_module_name" + * of type "otherName", as defined in RFC 4108. + * + * \note This function should be called on a single raw data of + * subject alternative name. For example, after successful + * certificate parsing, one must iterate on every item in the + * \c crt->subject_alt_names sequence, and pass it to + * this function. + * + * \warning The target structure contains pointers to the raw data of the + * parsed certificate, and its lifetime is restricted by the + * lifetime of the certificate. + * + * \return \c 0 on success + * \return #MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE for an unsupported + * SAN type. + * \return Another negative value for any other failure. + */ +int mbedtls_x509_parse_subject_alt_name(const mbedtls_x509_buf *san_buf, + mbedtls_x509_subject_alternative_name *san); +/** + * \brief Unallocate all data related to subject alternative name + * + * \param san SAN structure - extra memory owned by this structure will be freed + */ +void mbedtls_x509_free_subject_alt_name(mbedtls_x509_subject_alternative_name *san); + +/** + * \brief This function parses a CN string as an IP address. + * + * \param cn The CN string to parse. CN string MUST be null-terminated. + * \param dst The target buffer to populate with the binary IP address. + * The buffer MUST be 16 bytes to save IPv6, and should be + * 4-byte aligned if the result will be used as struct in_addr. + * e.g. uint32_t dst[4] + * + * \note \p cn is parsed as an IPv6 address if string contains ':', + * else \p cn is parsed as an IPv4 address. + * + * \return Length of binary IP address; num bytes written to target. + * \return \c 0 on failure to parse CN string as an IP address. + */ +size_t mbedtls_x509_crt_parse_cn_inet_pton(const char *cn, void *dst); + +#define MBEDTLS_X509_SAFE_SNPRINTF \ + do { \ + if (ret < 0 || (size_t) ret >= n) \ + return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL; \ + \ + n -= (size_t) ret; \ + p += (size_t) ret; \ + } while (0) + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_X509_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crl.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crl.h new file mode 100644 index 00000000..6625a44f --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crl.h @@ -0,0 +1,184 @@ +/** + * \file x509_crl.h + * + * \brief X.509 certificate revocation list parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_X509_CRL_H +#define MBEDTLS_X509_CRL_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for parsing CRLs + * \{ + */ + +/** + * Certificate revocation list entry. + * Contains the CA-specific serial numbers and revocation dates. + * + * Some fields of this structure are publicly readable. Do not modify + * them except via Mbed TLS library functions: the effect of modifying + * those fields or the data that those fields points to is unspecified. + */ +typedef struct mbedtls_x509_crl_entry { + /** Direct access to the whole entry inside the containing buffer. */ + mbedtls_x509_buf raw; + /** The serial number of the revoked certificate. */ + mbedtls_x509_buf serial; + /** The revocation date of this entry. */ + mbedtls_x509_time revocation_date; + /** Direct access to the list of CRL entry extensions + * (an ASN.1 constructed sequence). + * + * If there are no extensions, `entry_ext.len == 0` and + * `entry_ext.p == NULL`. */ + mbedtls_x509_buf entry_ext; + + /** Next element in the linked list of entries. + * \p NULL indicates the end of the list. + * Do not modify this field directly. */ + struct mbedtls_x509_crl_entry *next; +} +mbedtls_x509_crl_entry; + +/** + * Certificate revocation list structure. + * Every CRL may have multiple entries. + */ +typedef struct mbedtls_x509_crl { + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< CRL version (1=v1, 2=v2) */ + mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + + mbedtls_x509_time this_update; + mbedtls_x509_time next_update; + + mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ + + mbedtls_x509_buf crl_ext; + + mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid2); + mbedtls_x509_buf MBEDTLS_PRIVATE(sig); + mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md); /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk); /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *MBEDTLS_PRIVATE(sig_opts); /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + /** Next element in the linked list of CRL. + * \p NULL indicates the end of the list. + * Do not modify this field directly. */ + struct mbedtls_x509_crl *next; +} +mbedtls_x509_crl; + +/** + * \brief Parse a DER-encoded CRL and append it to the chained list + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_der(mbedtls_x509_crl *chain, + const unsigned char *buf, size_t buflen); +/** + * \brief Parse one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in PEM or DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse(mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain points to the start of the chain + * \param path filename to read the CRLs from (in PEM or DER encoding) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_file(mbedtls_x509_crl *chain, const char *path); +#endif /* MBEDTLS_FS_IO */ + +#if !defined(MBEDTLS_X509_REMOVE_INFO) +/** + * \brief Returns an informational string about the CRL. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crl The X509 CRL to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crl_info(char *buf, size_t size, const char *prefix, + const mbedtls_x509_crl *crl); +#endif /* !MBEDTLS_X509_REMOVE_INFO */ + +/** + * \brief Initialize a CRL (chain) + * + * \param crl CRL chain to initialize + */ +void mbedtls_x509_crl_init(mbedtls_x509_crl *crl); + +/** + * \brief Unallocate all CRL data + * + * \param crl CRL chain to free + */ +void mbedtls_x509_crl_free(mbedtls_x509_crl *crl); + +/** \} name Structures and functions for parsing CRLs */ +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crl.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crt.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crt.h new file mode 100644 index 00000000..6b960395 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_crt.h @@ -0,0 +1,1208 @@ +/** + * \file x509_crt.h + * + * \brief X.509 certificate parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_X509_CRT_H +#define MBEDTLS_X509_CRT_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/x509.h" +#include "mbedtls/x509_crl.h" +#include "mbedtls/bignum.h" + +/** + * \addtogroup x509_module + * \{ + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Structures and functions for parsing and writing X.509 certificates + * \{ + */ + +/** + * Container for an X.509 certificate. The certificate may be chained. + * + * Some fields of this structure are publicly readable. Do not modify + * them except via Mbed TLS library functions: the effect of modifying + * those fields or the data that those fields points to is unspecified. + */ +typedef struct mbedtls_x509_crt { + int MBEDTLS_PRIVATE(own_buffer); /**< Indicates if \c raw is owned + * by the structure or not. */ + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< The X.509 version. (1=v1, 2=v2, 3=v3) */ + mbedtls_x509_buf serial; /**< Unique id for certificate issued by a specific CA. */ + mbedtls_x509_buf sig_oid; /**< Signature algorithm, e.g. sha1RSA */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */ + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_x509_time valid_from; /**< Start time of certificate validity. */ + mbedtls_x509_time valid_to; /**< End time of certificate validity. */ + + mbedtls_x509_buf pk_raw; + mbedtls_pk_context pk; /**< Container for the public key context. */ + + mbedtls_x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */ + mbedtls_x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */ + mbedtls_x509_buf v3_ext; /**< Optional X.509 v3 extensions. */ + mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. */ + mbedtls_x509_buf subject_key_id; /**< Optional X.509 v3 extension subject key identifier. */ + mbedtls_x509_authority authority_key_id; /**< Optional X.509 v3 extension authority key identifier. */ + + mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */ + + int MBEDTLS_PRIVATE(ext_types); /**< Bit string containing detected and parsed extensions */ + int MBEDTLS_PRIVATE(ca_istrue); /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */ + int MBEDTLS_PRIVATE(max_pathlen); /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */ + + unsigned int MBEDTLS_PRIVATE(key_usage); /**< Optional key usage extension value: See the values in x509.h */ + + mbedtls_x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */ + + unsigned char MBEDTLS_PRIVATE(ns_cert_type); /**< Optional Netscape certificate type extension value: See the values in x509.h */ + + mbedtls_x509_buf MBEDTLS_PRIVATE(sig); /**< Signature: hash of the tbs part signed with the private key. */ + mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md); /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk); /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *MBEDTLS_PRIVATE(sig_opts); /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + /** Next certificate in the linked list that constitutes the CA chain. + * \p NULL indicates the end of the list. + * Do not modify this field directly. */ + struct mbedtls_x509_crt *next; +} +mbedtls_x509_crt; + +/** + * Build flag from an algorithm/curve identifier (pk, md, ecp) + * Since 0 is always XXX_NONE, ignore it. + */ +#define MBEDTLS_X509_ID_FLAG(id) (1 << ((id) - 1)) + +/** + * Security profile for certificate verification. + * + * All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG(). + * + * The fields of this structure are part of the public API and can be + * manipulated directly by applications. Future versions of the library may + * add extra fields or reorder existing fields. + * + * You can create custom profiles by starting from a copy of + * an existing profile, such as mbedtls_x509_crt_profile_default or + * mbedtls_x509_ctr_profile_none and then tune it to your needs. + * + * For example to allow SHA-224 in addition to the default: + * + * mbedtls_x509_crt_profile my_profile = mbedtls_x509_crt_profile_default; + * my_profile.allowed_mds |= MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA224 ); + * + * Or to allow only RSA-3072+ with SHA-256: + * + * mbedtls_x509_crt_profile my_profile = mbedtls_x509_crt_profile_none; + * my_profile.allowed_mds = MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA256 ); + * my_profile.allowed_pks = MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_RSA ); + * my_profile.rsa_min_bitlen = 3072; + */ +typedef struct mbedtls_x509_crt_profile { + uint32_t allowed_mds; /**< MDs for signatures */ + uint32_t allowed_pks; /**< PK algs for public keys; + * this applies to all certificates + * in the provided chain. */ + uint32_t allowed_curves; /**< Elliptic curves for ECDSA */ + uint32_t rsa_min_bitlen; /**< Minimum size for RSA keys */ +} +mbedtls_x509_crt_profile; + +#define MBEDTLS_X509_CRT_VERSION_1 0 +#define MBEDTLS_X509_CRT_VERSION_2 1 +#define MBEDTLS_X509_CRT_VERSION_3 2 + +#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 20 +#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15 + +#if !defined(MBEDTLS_X509_MAX_FILE_PATH_LEN) +#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 +#endif + +/* This macro unfolds to the concatenation of macro invocations + * X509_CRT_ERROR_INFO( error code, + * error code as string, + * human readable description ) + * where X509_CRT_ERROR_INFO is defined by the user. + * See x509_crt.c for an example of how to use this. */ +#define MBEDTLS_X509_CRT_ERROR_INFO_LIST \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_EXPIRED, \ + "MBEDTLS_X509_BADCERT_EXPIRED", \ + "The certificate validity has expired") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_REVOKED, \ + "MBEDTLS_X509_BADCERT_REVOKED", \ + "The certificate has been revoked (is on a CRL)") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_CN_MISMATCH, \ + "MBEDTLS_X509_BADCERT_CN_MISMATCH", \ + "The certificate Common Name (CN) does not match with the expected CN") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_NOT_TRUSTED, \ + "MBEDTLS_X509_BADCERT_NOT_TRUSTED", \ + "The certificate is not correctly signed by the trusted CA") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_NOT_TRUSTED, \ + "MBEDTLS_X509_BADCRL_NOT_TRUSTED", \ + "The CRL is not correctly signed by the trusted CA") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_EXPIRED, \ + "MBEDTLS_X509_BADCRL_EXPIRED", \ + "The CRL is expired") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_MISSING, \ + "MBEDTLS_X509_BADCERT_MISSING", \ + "Certificate was missing") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_SKIP_VERIFY, \ + "MBEDTLS_X509_BADCERT_SKIP_VERIFY", \ + "Certificate verification was skipped") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_OTHER, \ + "MBEDTLS_X509_BADCERT_OTHER", \ + "Other reason (can be used by verify callback)") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_FUTURE, \ + "MBEDTLS_X509_BADCERT_FUTURE", \ + "The certificate validity starts in the future") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_FUTURE, \ + "MBEDTLS_X509_BADCRL_FUTURE", \ + "The CRL is from the future") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_KEY_USAGE, \ + "MBEDTLS_X509_BADCERT_KEY_USAGE", \ + "Usage does not match the keyUsage extension") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_EXT_KEY_USAGE, \ + "MBEDTLS_X509_BADCERT_EXT_KEY_USAGE", \ + "Usage does not match the extendedKeyUsage extension") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_NS_CERT_TYPE, \ + "MBEDTLS_X509_BADCERT_NS_CERT_TYPE", \ + "Usage does not match the nsCertType extension") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_BAD_MD, \ + "MBEDTLS_X509_BADCERT_BAD_MD", \ + "The certificate is signed with an unacceptable hash.") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_BAD_PK, \ + "MBEDTLS_X509_BADCERT_BAD_PK", \ + "The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA).") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCERT_BAD_KEY, \ + "MBEDTLS_X509_BADCERT_BAD_KEY", \ + "The certificate is signed with an unacceptable key (eg bad curve, RSA too short).") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_BAD_MD, \ + "MBEDTLS_X509_BADCRL_BAD_MD", \ + "The CRL is signed with an unacceptable hash.") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_BAD_PK, \ + "MBEDTLS_X509_BADCRL_BAD_PK", \ + "The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA).") \ + X509_CRT_ERROR_INFO(MBEDTLS_X509_BADCRL_BAD_KEY, \ + "MBEDTLS_X509_BADCRL_BAD_KEY", \ + "The CRL is signed with an unacceptable key (eg bad curve, RSA too short).") + +/** + * Container for writing a certificate (CRT) + */ +typedef struct mbedtls_x509write_cert { + int MBEDTLS_PRIVATE(version); + unsigned char MBEDTLS_PRIVATE(serial)[MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN]; + size_t MBEDTLS_PRIVATE(serial_len); + mbedtls_pk_context *MBEDTLS_PRIVATE(subject_key); + mbedtls_pk_context *MBEDTLS_PRIVATE(issuer_key); + mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject); + mbedtls_asn1_named_data *MBEDTLS_PRIVATE(issuer); + mbedtls_md_type_t MBEDTLS_PRIVATE(md_alg); + char MBEDTLS_PRIVATE(not_before)[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + char MBEDTLS_PRIVATE(not_after)[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + mbedtls_asn1_named_data *MBEDTLS_PRIVATE(extensions); +} +mbedtls_x509write_cert; + +/** + * \brief Set Subject Alternative Name + * + * \param ctx Certificate context to use + * \param san_list List of SAN values + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + * + * \note "dnsName", "uniformResourceIdentifier", "IP address", + * "otherName", and "DirectoryName", as defined in RFC 5280, + * are supported. + */ +int mbedtls_x509write_crt_set_subject_alternative_name(mbedtls_x509write_cert *ctx, + const mbedtls_x509_san_list *san_list); + +/** + * Item in a verification chain: cert and flags for it + */ +typedef struct { + mbedtls_x509_crt *MBEDTLS_PRIVATE(crt); + uint32_t MBEDTLS_PRIVATE(flags); +} mbedtls_x509_crt_verify_chain_item; + +/** + * Max size of verification chain: end-entity + intermediates + trusted root + */ +#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE (MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2) + +/** + * Verification chain as built by \c mbedtls_crt_verify_chain() + */ +typedef struct { + mbedtls_x509_crt_verify_chain_item MBEDTLS_PRIVATE(items)[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE]; + unsigned MBEDTLS_PRIVATE(len); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + /* This stores the list of potential trusted signers obtained from + * the CA callback used for the CRT verification, if configured. + * We must track it somewhere because the callback passes its + * ownership to the caller. */ + mbedtls_x509_crt *MBEDTLS_PRIVATE(trust_ca_cb_result); +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +} mbedtls_x509_crt_verify_chain; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Context for resuming X.509 verify operations + */ +typedef struct { + /* for check_signature() */ + mbedtls_pk_restart_ctx MBEDTLS_PRIVATE(pk); + + /* for find_parent_in() */ + mbedtls_x509_crt *MBEDTLS_PRIVATE(parent); /* non-null iff parent_in in progress */ + mbedtls_x509_crt *MBEDTLS_PRIVATE(fallback_parent); + int MBEDTLS_PRIVATE(fallback_signature_is_good); + + /* for find_parent() */ + int MBEDTLS_PRIVATE(parent_is_trusted); /* -1 if find_parent is not in progress */ + + /* for verify_chain() */ + enum { + x509_crt_rs_none, + x509_crt_rs_find_parent, + } MBEDTLS_PRIVATE(in_progress); /* none if no operation is in progress */ + int MBEDTLS_PRIVATE(self_cnt); + mbedtls_x509_crt_verify_chain MBEDTLS_PRIVATE(ver_chain); + +} mbedtls_x509_crt_restart_ctx; + +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_x509_crt_restart_ctx; + +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * Default security profile. Should provide a good balance between security + * and compatibility with current deployments. + * + * This profile permits: + * - SHA2 hashes with at least 256 bits: SHA-256, SHA-384, SHA-512. + * - Elliptic curves with 255 bits and above except secp256k1. + * - RSA with 2048 bits and above. + * + * New minor versions of Mbed TLS may extend this profile, for example if + * new algorithms are added to the library. New minor versions of Mbed TLS will + * not reduce this profile unless serious security concerns require it. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default; + +/** + * Expected next default profile. Recommended for new deployments. + * Currently targets a 128-bit security level, except for allowing RSA-2048. + * This profile may change at any time. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next; + +/** + * NSA Suite B profile. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb; + +/** + * Empty profile that allows nothing. Useful as a basis for constructing + * custom profiles. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none; + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * + * \note This function makes an internal copy of the CRT buffer + * \p buf. In particular, \p buf may be destroyed or reused + * after this call returns. To avoid duplicating the CRT + * buffer (at the cost of stricter lifetime constraints), + * use mbedtls_x509_crt_parse_der_nocopy() instead. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der(mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen); + +/** + * \brief The type of certificate extension callbacks. + * + * Callbacks of this type are passed to and used by the + * mbedtls_x509_crt_parse_der_with_ext_cb() routine when + * it encounters either an unsupported extension or a + * "certificate policies" extension containing any + * unsupported certificate policies. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \param p_ctx An opaque context passed to the callback. + * \param crt The certificate being parsed. + * \param oid The OID of the extension. + * \param critical Whether the extension is critical. + * \param p Pointer to the start of the extension value + * (the content of the OCTET STRING). + * \param end End of extension value. + * + * \note The callback must fail and return a negative error code + * if it can not parse or does not support the extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ext_cb_t)(void *p_ctx, + mbedtls_x509_crt const *crt, + mbedtls_x509_buf const *oid, + int critical, + const unsigned char *p, + const unsigned char *end); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * \param make_copy When not zero this function makes an internal copy of the + * CRT buffer \p buf. In particular, \p buf may be destroyed + * or reused after this call returns. + * When zero this function avoids duplicating the CRT buffer + * by taking temporary ownership thereof until the CRT + * is destroyed (like mbedtls_x509_crt_parse_der_nocopy()) + * \param cb A callback invoked for every unsupported certificate + * extension. + * \param p_ctx An opaque context passed to the callback. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), and/or + * mbedtls_x509_crt_parse_der_nocopy() + * but it calls the callback with every unsupported + * certificate extension and additionally the + * "certificate policies" extension if it contains any + * unsupported certificate policies. + * The callback must return a negative error code if it + * does not know how to handle such an extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_with_ext_cb(mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen, + int make_copy, + mbedtls_x509_crt_ext_cb_t cb, + void *p_ctx); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. This is a + * variant of mbedtls_x509_crt_parse_der() which takes + * temporary ownership of the CRT buffer until the CRT + * is destroyed. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The address of the readable buffer holding the DER encoded + * certificate to use. On success, this buffer must be + * retained and not be changed for the lifetime of the + * CRT chain \p chain, that is, until \p chain is destroyed + * through a call to mbedtls_x509_crt_free(). + * \param buflen The size in Bytes of \p buf. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), but it avoids creating a + * copy of the input buffer at the cost of stronger lifetime + * constraints. This is useful in constrained environments + * where duplication of the CRT cannot be tolerated. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_nocopy(mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen); + +/** + * \brief Parse one DER-encoded or one or more concatenated PEM-encoded + * certificates and add them to the chained list. + * + * For CRTs in PEM encoding, the function parses permissively: + * if at least one certificate can be parsed, the function + * returns the number of certificates for which parsing failed + * (hence \c 0 if all certificates were parsed successfully). + * If no certificate could be parsed, the function returns + * the first (negative) error encountered during parsing. + * + * PEM encoded certificates may be interleaved by other data + * such as human readable descriptions of their content, as + * long as the certificates are enclosed in the PEM specific + * '-----{BEGIN/END} CERTIFICATE-----' delimiters. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain The chain to which to add the parsed certificates. + * \param buf The buffer holding the certificate data in PEM or DER format. + * For certificates in PEM encoding, this may be a concatenation + * of multiple certificates; for DER encoding, the buffer must + * comprise exactly one certificate. + * \param buflen The size of \p buf, including the terminating \c NULL byte + * in case of PEM encoded data. + * + * \return \c 0 if all certificates were parsed successfully. + * \return The (positive) number of certificates that couldn't + * be parsed if parsing was partly successful (see above). + * \return A negative X509 or PEM error code otherwise. + * + */ +int mbedtls_x509_crt_parse(mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more certificates and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param chain points to the start of the chain + * \param path filename to read the certificates from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_file(mbedtls_x509_crt *chain, const char *path); + +/** + * \brief Load one or more certificate files from a path and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \param chain points to the start of the chain + * \param path directory / folder to read the certificate files from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path); + +#endif /* MBEDTLS_FS_IO */ + +#if !defined(MBEDTLS_X509_REMOVE_INFO) +/** + * \brief Returns an informational string about the + * certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crt The X509 certificate to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_info(char *buf, size_t size, const char *prefix, + const mbedtls_x509_crt *crt); + +/** + * \brief Returns an informational string about the + * verification status of a certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param flags Verification flags created by mbedtls_x509_crt_verify() + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_verify_info(char *buf, size_t size, const char *prefix, + uint32_t flags); +#endif /* !MBEDTLS_X509_REMOVE_INFO */ + +/** + * \brief Verify a chain of certificates. + * + * The verify callback is a user-supplied callback that + * can clear / modify / add flags for a certificate. If set, + * the verification callback is called for each + * certificate in the chain (from the trust-ca down to the + * presented crt). The parameters for the callback are: + * (void *parameter, mbedtls_x509_crt *crt, int certificate_depth, + * int *flags). With the flags representing current flags for + * that specific certificate and the certificate depth from + * the bottom (Peer cert depth = 0). + * + * All flags left after returning from the callback + * are also returned to the application. The function should + * return 0 for anything (including invalid certificates) + * other than fatal error, as a non-zero return code + * immediately aborts the verification process. For fatal + * errors, a specific error code should be used (different + * from MBEDTLS_ERR_X509_CERT_VERIFY_FAILED which should not + * be returned at this point), or MBEDTLS_ERR_X509_FATAL_ERROR + * can be used if no better code is available. + * + * \note In case verification failed, the results can be displayed + * using \c mbedtls_x509_crt_verify_info() + * + * \note Same as \c mbedtls_x509_crt_verify_with_profile() with the + * default security profile. + * + * \note It is your responsibility to provide up-to-date CRLs for + * all trusted CAs. If no CRL is provided for the CA that was + * used to sign the certificate, CRL verification is skipped + * silently, that is *without* setting any flag. + * + * \note The \c trust_ca list can contain two types of certificates: + * (1) those of trusted root CAs, so that certificates + * chaining up to those CAs will be trusted, and (2) + * self-signed end-entity certificates to be trusted (for + * specific peers you know) - in that case, the self-signed + * certificate doesn't need to have the CA bit set. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param cn The expected Common Name. This will be checked to be + * present in the certificate's subjectAltNames extension or, + * if this extension is absent, as a CN component in its + * Subject name. DNS names and IP addresses are fully + * supported, while the URI subtype is partially supported: + * only exact matching, without any normalization procedures + * described in 7.4 of RFC5280, will result in a positive + * URI verification. + * This may be \c NULL if the CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify(mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy); + +/** + * \brief Verify a chain of certificates with respect to + * a configurable security profile. + * + * \note Same as \c mbedtls_x509_crt_verify(), but with explicit + * security profile. + * + * \note The restrictions on keys (RSA minimum size, allowed curves + * for ECDSA) apply to all certificates: trusted root, + * intermediate CAs if any, and end entity certificate. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify_with_profile(mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy); + +/** + * \brief Restartable version of \c mbedtls_crt_verify_with_profile() + * + * \note Performs the same job as \c mbedtls_crt_verify_with_profile() + * but can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * \param rs_ctx The restart context to use. This may be set to \c NULL + * to disable restartable ECC. + * + * \return See \c mbedtls_crt_verify_with_profile(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_x509_crt_verify_restartable(mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy, + mbedtls_x509_crt_restart_ctx *rs_ctx); + +/** + * \brief The type of trusted certificate callbacks. + * + * Callbacks of this type are passed to and used by the CRT + * verification routine mbedtls_x509_crt_verify_with_ca_cb() + * when looking for trusted signers of a given certificate. + * + * On success, the callback returns a list of trusted + * certificates to be considered as potential signers + * for the input certificate. + * + * \param p_ctx An opaque context passed to the callback. + * \param child The certificate for which to search a potential signer. + * This will point to a readable certificate. + * \param candidate_cas The address at which to store the address of the first + * entry in the generated linked list of candidate signers. + * This will not be \c NULL. + * + * \note The callback must only return a non-zero value on a + * fatal error. If, in contrast, the search for a potential + * signer completes without a single candidate, the + * callback must return \c 0 and set \c *candidate_cas + * to \c NULL. + * + * \return \c 0 on success. In this case, \c *candidate_cas points + * to a heap-allocated linked list of instances of + * ::mbedtls_x509_crt, and ownership of this list is passed + * to the caller. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ca_cb_t)(void *p_ctx, + mbedtls_x509_crt const *child, + mbedtls_x509_crt **candidate_cas); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Version of \c mbedtls_x509_crt_verify_with_profile() which + * uses a callback to acquire the list of trusted CA + * certificates. + * + * \param crt The certificate chain to be verified. + * \param f_ca_cb The callback to be used to query for potential signers + * of a given child certificate. See the documentation of + * ::mbedtls_x509_crt_ca_cb_t for more information. + * \param p_ca_cb The opaque context to be passed to \p f_ca_cb. + * \param profile The security profile for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return See \c mbedtls_crt_verify_with_profile(). + */ +int mbedtls_x509_crt_verify_with_ca_cb(mbedtls_x509_crt *crt, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy); + +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +/** + * \brief Check usage of certificate against keyUsage extension. + * + * \param crt Leaf certificate used. + * \param usage Intended usage(s) (eg MBEDTLS_X509_KU_KEY_ENCIPHERMENT + * before using the certificate to perform an RSA key + * exchange). + * + * \note Except for decipherOnly and encipherOnly, a bit set in the + * usage argument means this bit MUST be set in the + * certificate. For decipherOnly and encipherOnly, it means + * that bit MAY be set. + * + * \return 0 is these uses of the certificate are allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if the keyUsage extension + * is present but does not match the usage argument. + * + * \note You should only call this function on leaf certificates, on + * (intermediate) CAs the keyUsage extension is automatically + * checked by \c mbedtls_x509_crt_verify(). + */ +int mbedtls_x509_crt_check_key_usage(const mbedtls_x509_crt *crt, + unsigned int usage); + +/** + * \brief Check usage of certificate against extendedKeyUsage. + * + * \param crt Leaf certificate used. + * \param usage_oid Intended usage (eg MBEDTLS_OID_SERVER_AUTH or + * MBEDTLS_OID_CLIENT_AUTH). + * \param usage_len Length of usage_oid (eg given by MBEDTLS_OID_SIZE()). + * + * \return 0 if this use of the certificate is allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if not. + * + * \note Usually only makes sense on leaf certificates. + */ +int mbedtls_x509_crt_check_extended_key_usage(const mbedtls_x509_crt *crt, + const char *usage_oid, + size_t usage_len); + +#if defined(MBEDTLS_X509_CRL_PARSE_C) +/** + * \brief Verify the certificate revocation status + * + * \param crt a certificate to be verified + * \param crl the CRL to verify against + * + * \return 1 if the certificate is revoked, 0 otherwise + * + */ +int mbedtls_x509_crt_is_revoked(const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl); +#endif /* MBEDTLS_X509_CRL_PARSE_C */ + +/** + * \brief Initialize a certificate (chain) + * + * \param crt Certificate chain to initialize + */ +void mbedtls_x509_crt_init(mbedtls_x509_crt *crt); + +/** + * \brief Unallocate all certificate data + * + * \param crt Certificate chain to free + */ +void mbedtls_x509_crt_free(mbedtls_x509_crt *crt); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + */ +void mbedtls_x509_crt_restart_init(mbedtls_x509_crt_restart_ctx *ctx); + +/** + * \brief Free the components of a restart context + */ +void mbedtls_x509_crt_restart_free(mbedtls_x509_crt_restart_ctx *ctx); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Query certificate for given extension type + * + * \param[in] ctx Certificate context to be queried, must not be \c NULL + * \param ext_type Extension type being queried for, must be a valid + * extension type. Must be one of the MBEDTLS_X509_EXT_XXX + * values + * + * \return 0 if the given extension type is not present, + * non-zero otherwise + */ +static inline int mbedtls_x509_crt_has_ext_type(const mbedtls_x509_crt *ctx, + int ext_type) +{ + return ctx->MBEDTLS_PRIVATE(ext_types) & ext_type; +} + +/** + * \brief Access the ca_istrue field + * + * \param[in] crt Certificate to be queried, must not be \c NULL + * + * \return \c 1 if this a CA certificate \c 0 otherwise. + * \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + * the Optional Basic Constraint extension. + * + */ +int mbedtls_x509_crt_get_ca_istrue(const mbedtls_x509_crt *crt); + +/** \} name Structures and functions for parsing and writing X.509 certificates */ + +#if defined(MBEDTLS_X509_CRT_WRITE_C) +/** + * \brief Initialize a CRT writing context + * + * \param ctx CRT context to initialize + */ +void mbedtls_x509write_crt_init(mbedtls_x509write_cert *ctx); + +/** + * \brief Set the version for a Certificate + * Default: MBEDTLS_X509_CRT_VERSION_3 + * + * \param ctx CRT context to use + * \param version version to set (MBEDTLS_X509_CRT_VERSION_1, MBEDTLS_X509_CRT_VERSION_2 or + * MBEDTLS_X509_CRT_VERSION_3) + */ +void mbedtls_x509write_crt_set_version(mbedtls_x509write_cert *ctx, int version); + +#if defined(MBEDTLS_BIGNUM_C) && !defined(MBEDTLS_DEPRECATED_REMOVED) +/** + * \brief Set the serial number for a Certificate. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. Please use + * mbedtls_x509write_crt_set_serial_raw() instead. + * + * \note Even though the MBEDTLS_BIGNUM_C guard looks redundant since + * X509 depends on PK and PK depends on BIGNUM, this emphasizes + * a direct dependency between X509 and BIGNUM which is going + * to be deprecated in the future. + * + * \param ctx CRT context to use + * \param serial serial number to set + * + * \return 0 if successful + */ +int MBEDTLS_DEPRECATED mbedtls_x509write_crt_set_serial( + mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial); +#endif // MBEDTLS_BIGNUM_C && !MBEDTLS_DEPRECATED_REMOVED + +/** + * \brief Set the serial number for a Certificate. + * + * \param ctx CRT context to use + * \param serial A raw array of bytes containing the serial number in big + * endian format + * \param serial_len Length of valid bytes (expressed in bytes) in \p serial + * input buffer + * + * \return 0 if successful, or + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if the provided input buffer + * is too big (longer than MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN) + */ +int mbedtls_x509write_crt_set_serial_raw(mbedtls_x509write_cert *ctx, + unsigned char *serial, size_t serial_len); + +/** + * \brief Set the validity period for a Certificate + * Timestamps should be in string format for UTC timezone + * i.e. "YYYYMMDDhhmmss" + * e.g. "20131231235959" for December 31st 2013 + * at 23:59:59 + * + * \param ctx CRT context to use + * \param not_before not_before timestamp + * \param not_after not_after timestamp + * + * \return 0 if timestamp was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char *not_before, + const char *not_after); + +/** + * \brief Set the issuer name for a Certificate + * Issuer names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=Mbed TLS CA" + * + * \param ctx CRT context to use + * \param issuer_name issuer name to set + * + * \return 0 if issuer name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx, + const char *issuer_name); + +/** + * \brief Set the subject name for a Certificate + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" + * + * \param ctx CRT context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_subject_name(mbedtls_x509write_cert *ctx, + const char *subject_name); + +/** + * \brief Set the subject public key for the certificate + * + * \param ctx CRT context to use + * \param key public key to include + */ +void mbedtls_x509write_crt_set_subject_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key); + +/** + * \brief Set the issuer key used for signing the certificate + * + * \param ctx CRT context to use + * \param key private key to sign with + */ +void mbedtls_x509write_crt_set_issuer_key(mbedtls_x509write_cert *ctx, mbedtls_pk_context *key); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CRT context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg); + +/** + * \brief Generic function to add to or replace an extension in the + * CRT + * + * \param ctx CRT context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param critical if the extension is critical (per the RFC's definition) + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx, + const char *oid, size_t oid_len, + int critical, + const unsigned char *val, size_t val_len); + +/** + * \brief Set the basicConstraints extension for a CRT + * + * \param ctx CRT context to use + * \param is_ca is this a CA certificate + * \param max_pathlen maximum length of certificate chains below this + * certificate (only for CA certificates, -1 is + * unlimited) + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_basic_constraints(mbedtls_x509write_cert *ctx, + int is_ca, int max_pathlen); + +#if defined(MBEDTLS_MD_CAN_SHA1) +/** + * \brief Set the subjectKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_subject_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_subject_key_identifier(mbedtls_x509write_cert *ctx); + +/** + * \brief Set the authorityKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_issuer_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_authority_key_identifier(mbedtls_x509write_cert *ctx); +#endif /* MBEDTLS_MD_CAN_SHA1 */ + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CRT context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_key_usage(mbedtls_x509write_cert *ctx, + unsigned int key_usage); + +/** + * \brief Set the Extended Key Usage Extension + * (e.g. MBEDTLS_OID_SERVER_AUTH) + * + * \param ctx CRT context to use + * \param exts extended key usage extensions to set, a sequence of + * MBEDTLS_ASN1_OID objects + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_ext_key_usage(mbedtls_x509write_cert *ctx, + const mbedtls_asn1_sequence *exts); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CRT context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_ns_cert_type(mbedtls_x509write_cert *ctx, + unsigned char ns_cert_type); + +/** + * \brief Free the contents of a CRT write context + * + * \param ctx CRT context to free + */ +void mbedtls_x509write_crt_free(mbedtls_x509write_cert *ctx); + +/** + * \brief Write a built up certificate to a X509 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function. This must not be \c NULL. + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note \p f_rng is used for the signature operation. + */ +int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a built up certificate to a X509 PEM string + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function. This must not be \c NULL. + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note \p f_rng is used for the signature operation. + */ +int mbedtls_x509write_crt_pem(mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + mbedtls_f_rng_t *f_rng, + void *p_rng); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CRT_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crt.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_csr.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_csr.h new file mode 100644 index 00000000..c4bd7f12 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/mbedtls/x509_csr.h @@ -0,0 +1,382 @@ +/** + * \file x509_csr.h + * + * \brief X.509 certificate signing request parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef MBEDTLS_X509_CSR_H +#define MBEDTLS_X509_CSR_H +#include "mbedtls/private_access.h" + +#include "mbedtls/build_info.h" + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for X.509 Certificate Signing Requests (CSR) + * \{ + */ + +/** + * Certificate Signing Request (CSR) structure. + * + * Some fields of this structure are publicly readable. Do not modify + * them except via Mbed TLS library functions: the effect of modifying + * those fields or the data that those fields point to is unspecified. + */ +typedef struct mbedtls_x509_csr { + mbedtls_x509_buf raw; /**< The raw CSR data (DER). */ + mbedtls_x509_buf cri; /**< The raw CertificateRequestInfo body (DER). */ + + int version; /**< CSR version (1=v1). */ + + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_pk_context pk; /**< Container for the public key context. */ + + unsigned int key_usage; /**< Optional key usage extension value: See the values in x509.h */ + unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */ + mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. */ + + int MBEDTLS_PRIVATE(ext_types); /**< Bit string containing detected and parsed extensions */ + + mbedtls_x509_buf sig_oid; + mbedtls_x509_buf MBEDTLS_PRIVATE(sig); + mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md); /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk); /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *MBEDTLS_PRIVATE(sig_opts); /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ +} +mbedtls_x509_csr; + +/** + * Container for writing a CSR + */ +typedef struct mbedtls_x509write_csr { + mbedtls_pk_context *MBEDTLS_PRIVATE(key); + mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject); + mbedtls_md_type_t MBEDTLS_PRIVATE(md_alg); + mbedtls_asn1_named_data *MBEDTLS_PRIVATE(extensions); +} +mbedtls_x509write_csr; + +#if defined(MBEDTLS_X509_CSR_PARSE_C) +/** + * \brief Load a Certificate Signing Request (CSR) in DER format + * + * \note Any unsupported requested extensions are silently + * ignored, unless the critical flag is set, in which case + * the CSR is rejected. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * + * \return 0 if successful, or a specific X509 error code + */ +int mbedtls_x509_csr_parse_der(mbedtls_x509_csr *csr, + const unsigned char *buf, size_t buflen); + +/** + * \brief The type of certificate extension callbacks. + * + * Callbacks of this type are passed to and used by the + * mbedtls_x509_csr_parse_der_with_ext_cb() routine when + * it encounters either an unsupported extension. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \param p_ctx An opaque context passed to the callback. + * \param csr The CSR being parsed. + * \param oid The OID of the extension. + * \param critical Whether the extension is critical. + * \param p Pointer to the start of the extension value + * (the content of the OCTET STRING). + * \param end End of extension value. + * + * \note The callback must fail and return a negative error code + * if it can not parse or does not support the extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_csr_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_csr_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_csr_ext_cb_t)(void *p_ctx, + mbedtls_x509_csr const *csr, + mbedtls_x509_buf const *oid, + int critical, + const unsigned char *p, + const unsigned char *end); + +/** + * \brief Load a Certificate Signing Request (CSR) in DER format + * + * \note Any unsupported requested extensions are silently + * ignored, unless the critical flag is set, in which case + * the result of the callback function decides whether + * CSR is rejected. + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * \param cb A callback invoked for every unsupported certificate + * extension. + * \param p_ctx An opaque context passed to the callback. + * + * \return 0 if successful, or a specific X509 error code + */ +int mbedtls_x509_csr_parse_der_with_ext_cb(mbedtls_x509_csr *csr, + const unsigned char *buf, size_t buflen, + mbedtls_x509_csr_ext_cb_t cb, + void *p_ctx); + +/** + * \brief Load a Certificate Signing Request (CSR), DER or PEM format + * + * \note See notes for \c mbedtls_x509_csr_parse_der() + * + * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + * subsystem must have been initialized by calling + * psa_crypto_init() before calling this function. + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse(mbedtls_x509_csr *csr, const unsigned char *buf, size_t buflen); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load a Certificate Signing Request (CSR) + * + * \note See notes for \c mbedtls_x509_csr_parse() + * + * \param csr CSR context to fill + * \param path filename to read the CSR from + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse_file(mbedtls_x509_csr *csr, const char *path); +#endif /* MBEDTLS_FS_IO */ + +#if !defined(MBEDTLS_X509_REMOVE_INFO) +/** + * \brief Returns an informational string about the + * CSR. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param csr The X509 CSR to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_csr_info(char *buf, size_t size, const char *prefix, + const mbedtls_x509_csr *csr); +#endif /* !MBEDTLS_X509_REMOVE_INFO */ + +/** + * \brief Initialize a CSR + * + * \param csr CSR to initialize + */ +void mbedtls_x509_csr_init(mbedtls_x509_csr *csr); + +/** + * \brief Unallocate all CSR data + * + * \param csr CSR to free + */ +void mbedtls_x509_csr_free(mbedtls_x509_csr *csr); +#endif /* MBEDTLS_X509_CSR_PARSE_C */ + +/** \} name Structures and functions for X.509 Certificate Signing Requests (CSR) */ + +#if defined(MBEDTLS_X509_CSR_WRITE_C) +/** + * \brief Initialize a CSR context + * + * \param ctx CSR context to initialize + */ +void mbedtls_x509write_csr_init(mbedtls_x509write_csr *ctx); + +/** + * \brief Set the subject name for a CSR + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" + * + * \param ctx CSR context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_csr_set_subject_name(mbedtls_x509write_csr *ctx, + const char *subject_name); + +/** + * \brief Set the key for a CSR (public key will be included, + * private key used to sign the CSR when writing it) + * + * \param ctx CSR context to use + * \param key Asymmetric key to include + */ +void mbedtls_x509write_csr_set_key(mbedtls_x509write_csr *ctx, mbedtls_pk_context *key); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CSR context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_csr_set_md_alg(mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg); + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CSR context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + * + * \note The decipherOnly flag from the Key Usage + * extension is represented by bit 8 (i.e. + * 0x8000), which cannot typically be represented + * in an unsigned char. Therefore, the flag + * decipherOnly (i.e. + * #MBEDTLS_X509_KU_DECIPHER_ONLY) cannot be set using this + * function. + */ +int mbedtls_x509write_csr_set_key_usage(mbedtls_x509write_csr *ctx, unsigned char key_usage); + +/** + * \brief Set Subject Alternative Name + * + * \param ctx CSR context to use + * \param san_list List of SAN values + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + * + * \note Only "dnsName", "uniformResourceIdentifier" and "otherName", + * as defined in RFC 5280, are supported. + */ +int mbedtls_x509write_csr_set_subject_alternative_name(mbedtls_x509write_csr *ctx, + const mbedtls_x509_san_list *san_list); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CSR context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_ns_cert_type(mbedtls_x509write_csr *ctx, + unsigned char ns_cert_type); + +/** + * \brief Generic function to add to or replace an extension in the + * CSR + * + * \param ctx CSR context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param critical Set to 1 to mark the extension as critical, 0 otherwise. + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_extension(mbedtls_x509write_csr *ctx, + const char *oid, size_t oid_len, + int critical, + const unsigned char *val, size_t val_len); + +/** + * \brief Free the contents of a CSR context + * + * \param ctx CSR context to free + */ +void mbedtls_x509write_csr_free(mbedtls_x509write_csr *ctx); + +/** + * \brief Write a CSR (Certificate Signing Request) to a + * DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function. This must not be \c NULL. + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note \p f_rng is used for the signature operation. + */ +int mbedtls_x509write_csr_der(mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + mbedtls_f_rng_t *f_rng, + void *p_rng); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a CSR (Certificate Signing Request) to a + * PEM string + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function. This must not be \c NULL. + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note \p f_rng is used for the signature operation. + */ +int mbedtls_x509write_csr_pem(mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + mbedtls_f_rng_t *f_rng, + void *p_rng); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CSR_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_csr.h */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/build_info.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/build_info.h new file mode 100644 index 00000000..3ee6cd7b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/build_info.h @@ -0,0 +1,20 @@ +/** + * \file psa/build_info.h + * + * \brief Build-time PSA configuration info + * + * Include this file if you need to depend on the + * configuration options defined in mbedtls_config.h or MBEDTLS_CONFIG_FILE + * in PSA cryptography core specific files. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_BUILD_INFO_H +#define PSA_CRYPTO_BUILD_INFO_H + +#include "mbedtls/build_info.h" + +#endif /* PSA_CRYPTO_BUILD_INFO_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto.h new file mode 100644 index 00000000..2fe9f35e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto.h @@ -0,0 +1,4977 @@ +/** + * \file psa/crypto.h + * \brief Platform Security Architecture cryptography module + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_H +#define PSA_CRYPTO_H + +#if defined(MBEDTLS_PSA_CRYPTO_PLATFORM_FILE) +#include MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +#else +#include "crypto_platform.h" +#endif + +#include + +#ifdef __DOXYGEN_ONLY__ +/* This __DOXYGEN_ONLY__ block contains mock definitions for things that + * must be defined in the crypto_platform.h header. These mock definitions + * are present in this file as a convenience to generate pretty-printed + * documentation that includes those definitions. */ + +/** \defgroup platform Implementation-specific definitions + * @{ + */ + +/**@}*/ +#endif /* __DOXYGEN_ONLY__ */ + +#ifdef __cplusplus +extern "C" { +#endif + +/* The file "crypto_types.h" declares types that encode errors, + * algorithms, key types, policies, etc. */ +#include "crypto_types.h" + +/** \defgroup version API version + * @{ + */ + +/** + * The major version of this implementation of the PSA Crypto API + */ +#define PSA_CRYPTO_API_VERSION_MAJOR 1 + +/** + * The minor version of this implementation of the PSA Crypto API + */ +#define PSA_CRYPTO_API_VERSION_MINOR 0 + +/**@}*/ + +/* The file "crypto_values.h" declares macros to build and analyze values + * of integral types defined in "crypto_types.h". */ +#include "crypto_values.h" + +/* The file "crypto_sizes.h" contains definitions for size calculation + * macros whose definitions are implementation-specific. */ +#include "crypto_sizes.h" + +/* The file "crypto_struct.h" contains definitions for + * implementation-specific structs that are declared above. */ +#if defined(MBEDTLS_PSA_CRYPTO_STRUCT_FILE) +#include MBEDTLS_PSA_CRYPTO_STRUCT_FILE +#else +#include "crypto_struct.h" +#endif + +/** \defgroup initialization Library initialization + * @{ + */ + +/** + * \brief Library initialization. + * + * Applications must call this function before calling any other + * function in this module. + * + * Applications may call this function more than once. Once a call + * succeeds, subsequent calls are guaranteed to succeed. + * + * If the application calls other functions before calling psa_crypto_init(), + * the behavior is undefined. Implementations are encouraged to either perform + * the operation as if the library had been initialized or to return + * #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + * implementations should not return a success status if the lack of + * initialization may have security implications, for example due to improper + * seeding of the random number generator. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + */ +psa_status_t psa_crypto_init(void); + +/**@}*/ + +/** \addtogroup attributes + * @{ + */ + +/** \def PSA_KEY_ATTRIBUTES_INIT + * + * This macro returns a suitable initializer for a key attribute structure + * of type #psa_key_attributes_t. + */ + +/** Return an initial value for a key attributes structure. + */ +static psa_key_attributes_t psa_key_attributes_init(void); + +/** Declare a key as persistent and set its key identifier. + * + * If the attribute structure currently declares the key as volatile (which + * is the default content of an attribute structure), this function sets + * the lifetime attribute to #PSA_KEY_LIFETIME_PERSISTENT. + * + * This function does not access storage, it merely stores the given + * value in the structure. + * The persistent key will be written to storage when the attribute + * structure is passed to a key creation function such as + * psa_import_key(), psa_generate_key(), psa_generate_key_custom(), + * psa_key_derivation_output_key(), psa_key_derivation_output_key_custom() + * or psa_copy_key(). + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param key The persistent identifier for the key. + * This can be any value in the range from + * #PSA_KEY_ID_USER_MIN to #PSA_KEY_ID_USER_MAX + * inclusive. + */ +static void psa_set_key_id(psa_key_attributes_t *attributes, + mbedtls_svc_key_id_t key); + +#ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +/** Set the owner identifier of a key. + * + * When key identifiers encode key owner identifiers, psa_set_key_id() does + * not allow to define in key attributes the owner of volatile keys as + * psa_set_key_id() enforces the key to be persistent. + * + * This function allows to set in key attributes the owner identifier of a + * key. It is intended to be used for volatile keys. For persistent keys, + * it is recommended to use the PSA Cryptography API psa_set_key_id() to define + * the owner of a key. + * + * \param[out] attributes The attribute structure to write to. + * \param owner The key owner identifier. + */ +static void mbedtls_set_key_owner_id(psa_key_attributes_t *attributes, + mbedtls_key_owner_id_t owner); +#endif + +/** Set the location of a persistent key. + * + * To make a key persistent, you must give it a persistent key identifier + * with psa_set_key_id(). By default, a key that has a persistent identifier + * is stored in the default storage area identifier by + * #PSA_KEY_LIFETIME_PERSISTENT. Call this function to choose a storage + * area, or to explicitly declare the key as volatile. + * + * This function does not access storage, it merely stores the given + * value in the structure. + * The persistent key will be written to storage when the attribute + * structure is passed to a key creation function such as + * psa_import_key(), psa_generate_key(), psa_generate_key_custom(), + * psa_key_derivation_output_key(), psa_key_derivation_output_key_custom() + * or psa_copy_key(). + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param lifetime The lifetime for the key. + * If this is #PSA_KEY_LIFETIME_VOLATILE, the + * key will be volatile, and the key identifier + * attribute is reset to 0. + */ +static void psa_set_key_lifetime(psa_key_attributes_t *attributes, + psa_key_lifetime_t lifetime); + +/** Retrieve the key identifier from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The persistent identifier stored in the attribute structure. + * This value is unspecified if the attribute structure declares + * the key as volatile. + */ +static mbedtls_svc_key_id_t psa_get_key_id( + const psa_key_attributes_t *attributes); + +/** Retrieve the lifetime from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The lifetime value stored in the attribute structure. + */ +static psa_key_lifetime_t psa_get_key_lifetime( + const psa_key_attributes_t *attributes); + +/** Declare usage flags for a key. + * + * Usage flags are part of a key's usage policy. They encode what + * kind of operations are permitted on the key. For more details, + * refer to the documentation of the type #psa_key_usage_t. + * + * This function overwrites any usage flags + * previously set in \p attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param usage_flags The usage flags to write. + */ +static void psa_set_key_usage_flags(psa_key_attributes_t *attributes, + psa_key_usage_t usage_flags); + +/** Retrieve the usage flags from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The usage flags stored in the attribute structure. + */ +static psa_key_usage_t psa_get_key_usage_flags( + const psa_key_attributes_t *attributes); + +/** Declare the permitted algorithm policy for a key. + * + * The permitted algorithm policy of a key encodes which algorithm or + * algorithms are permitted to be used with this key. The following + * algorithm policies are supported: + * - 0 does not allow any cryptographic operation with the key. The key + * may be used for non-cryptographic actions such as exporting (if + * permitted by the usage flags). + * - An algorithm value permits this particular algorithm. + * - An algorithm wildcard built from #PSA_ALG_ANY_HASH allows the specified + * signature scheme with any hash algorithm. + * - An algorithm built from #PSA_ALG_AT_LEAST_THIS_LENGTH_MAC allows + * any MAC algorithm from the same base class (e.g. CMAC) which + * generates/verifies a MAC length greater than or equal to the length + * encoded in the wildcard algorithm. + * - An algorithm built from #PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG + * allows any AEAD algorithm from the same base class (e.g. CCM) which + * generates/verifies a tag length greater than or equal to the length + * encoded in the wildcard algorithm. + * + * This function overwrites any algorithm policy + * previously set in \p attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param alg The permitted algorithm policy to write. + */ +static void psa_set_key_algorithm(psa_key_attributes_t *attributes, + psa_algorithm_t alg); + + +/** Retrieve the algorithm policy from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The algorithm stored in the attribute structure. + */ +static psa_algorithm_t psa_get_key_algorithm( + const psa_key_attributes_t *attributes); + +/** Declare the type of a key. + * + * This function overwrites any key type + * previously set in \p attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param type The key type to write. + * If this is 0, the key type in \p attributes + * becomes unspecified. + */ +static void psa_set_key_type(psa_key_attributes_t *attributes, + psa_key_type_t type); + + +/** Declare the size of a key. + * + * This function overwrites any key size previously set in \p attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate each of its arguments exactly once. + * + * \param[out] attributes The attribute structure to write to. + * \param bits The key size in bits. + * If this is 0, the key size in \p attributes + * becomes unspecified. Keys of size 0 are + * not supported. + */ +static void psa_set_key_bits(psa_key_attributes_t *attributes, + size_t bits); + +/** Retrieve the key type from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The key type stored in the attribute structure. + */ +static psa_key_type_t psa_get_key_type(const psa_key_attributes_t *attributes); + +/** Retrieve the key size from key attributes. + * + * This function may be declared as `static` (i.e. without external + * linkage). This function may be provided as a function-like macro, + * but in this case it must evaluate its argument exactly once. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The key size stored in the attribute structure, in bits. + */ +static size_t psa_get_key_bits(const psa_key_attributes_t *attributes); + +/** Retrieve the attributes of a key. + * + * This function first resets the attribute structure as with + * psa_reset_key_attributes(). It then copies the attributes of + * the given key into the given attribute structure. + * + * \note This function may allocate memory or other resources. + * Once you have called this function on an attribute structure, + * you must call psa_reset_key_attributes() to free these resources. + * + * \param[in] key Identifier of the key to query. + * \param[in,out] attributes On success, the attributes of the key. + * On failure, equivalent to a + * freshly-initialized structure. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key, + psa_key_attributes_t *attributes); + +/** Reset a key attribute structure to a freshly initialized state. + * + * You must initialize the attribute structure as described in the + * documentation of the type #psa_key_attributes_t before calling this + * function. Once the structure has been initialized, you may call this + * function at any time. + * + * This function frees any auxiliary resources that the structure + * may contain. + * + * \param[in,out] attributes The attribute structure to reset. + */ +void psa_reset_key_attributes(psa_key_attributes_t *attributes); + +/**@}*/ + +/** \defgroup key_management Key management + * @{ + */ + +/** Remove non-essential copies of key material from memory. + * + * If the key identifier designates a volatile key, this functions does not do + * anything and returns successfully. + * + * If the key identifier designates a persistent key, then this function will + * free all resources associated with the key in volatile memory. The key + * data in persistent storage is not affected and the key can still be used. + * + * \param key Identifier of the key to purge. + * + * \retval #PSA_SUCCESS + * The key material will have been removed from memory if it is not + * currently required. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not a valid key identifier. + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_purge_key(mbedtls_svc_key_id_t key); + +/** Make a copy of a key. + * + * Copy key material from one location to another. + * + * This function is primarily useful to copy a key from one location + * to another, since it populates a key using the material from + * another key which may have a different lifetime. + * + * This function may be used to share a key with a different party, + * subject to implementation-defined restrictions on key sharing. + * + * The policy on the source key must have the usage flag + * #PSA_KEY_USAGE_COPY set. + * This flag is sufficient to permit the copy if the key has the lifetime + * #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + * Some secure elements do not provide a way to copy a key without + * making it extractable from the secure element. If a key is located + * in such a secure element, then the key must have both usage flags + * #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + * a copy of the key outside the secure element. + * + * The resulting key may only be used in a way that conforms to + * both the policy of the original key and the policy specified in + * the \p attributes parameter: + * - The usage flags on the resulting key are the bitwise-and of the + * usage flags on the source policy and the usage flags in \p attributes. + * - If both allow the same algorithm or wildcard-based + * algorithm policy, the resulting key has the same algorithm policy. + * - If either of the policies allows an algorithm and the other policy + * allows a wildcard-based algorithm policy that includes this algorithm, + * the resulting key allows the same algorithm. + * - If the policies do not allow any algorithm in common, this function + * fails with the status #PSA_ERROR_INVALID_ARGUMENT. + * + * The effect of this function on implementation-defined attributes is + * implementation-defined. + * + * \param source_key The key to copy. It must allow the usage + * #PSA_KEY_USAGE_COPY. If a private or secret key is + * being copied outside of a secure element it must + * also allow #PSA_KEY_USAGE_EXPORT. + * \param[in] attributes The attributes for the new key. + * They are used as follows: + * - The key type and size may be 0. If either is + * nonzero, it must match the corresponding + * attribute of the source key. + * - The key location (the lifetime and, for + * persistent keys, the key identifier) is + * used directly. + * - The policy constraints (usage flags and + * algorithm policy) are combined from + * the source key and \p attributes so that + * both sets of restrictions apply, as + * described in the documentation of this function. + * \param[out] target_key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE + * \p source_key is invalid. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The lifetime or identifier in \p attributes are invalid, or + * the policy constraints on the source and specified in + * \p attributes are incompatible, or + * \p attributes specifies a key type or key size + * which does not match the attributes of the source key. + * \retval #PSA_ERROR_NOT_PERMITTED + * The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + * the source key is not exportable and its lifetime does not + * allow copying it to the target's lifetime. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key, + const psa_key_attributes_t *attributes, + mbedtls_svc_key_id_t *target_key); + + +/** + * \brief Destroy a key. + * + * This function destroys a key from both volatile + * memory and, if applicable, non-volatile storage. Implementations shall + * make a best effort to ensure that the key material cannot be recovered. + * + * This function also erases any metadata such as policies and frees + * resources associated with the key. + * + * If a key is currently in use in a multipart operation, then destroying the + * key will cause the multipart operation to fail. + * + * \warning We can only guarantee that the the key material will + * eventually be wiped from memory. With threading enabled + * and during concurrent execution, copies of the key material may + * still exist until all threads have finished using the key. + * + * \param key Identifier of the key to erase. If this is \c 0, do nothing and + * return #PSA_SUCCESS. + * + * \retval #PSA_SUCCESS + * \p key was a valid identifier and the key material that it + * referred to has been erased. Alternatively, \p key is \c 0. + * \retval #PSA_ERROR_NOT_PERMITTED + * The key cannot be erased because it is + * read-only, either due to a policy or due to physical restrictions. + * \retval #PSA_ERROR_INVALID_HANDLE + * \p key is not a valid identifier nor \c 0. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE + * There was a failure in communication with the cryptoprocessor. + * The key material may still be present in the cryptoprocessor. + * \retval #PSA_ERROR_DATA_INVALID + * This error is typically a result of either storage corruption on a + * cleartext storage backend, or an attempt to read data that was + * written by an incompatible version of the library. + * \retval #PSA_ERROR_STORAGE_FAILURE + * The storage is corrupted. Implementations shall make a best effort + * to erase key material even in this stage, however applications + * should be aware that it may be impossible to guarantee that the + * key material is not recoverable in such cases. + * \retval #PSA_ERROR_CORRUPTION_DETECTED + * An unexpected condition which is not a storage corruption or + * a communication failure occurred. The cryptoprocessor may have + * been compromised. + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key); + +/**@}*/ + +/** \defgroup import_export Key import and export + * @{ + */ + +/** + * \brief Import a key in binary format. + * + * This function supports any output from psa_export_key(). Refer to the + * documentation of psa_export_public_key() for the format of public keys + * and to the documentation of psa_export_key() for the format for + * other key types. + * + * The key data determines the key size. The attributes may optionally + * specify a key size; in this case it must match the size determined + * from the key data. A key size of 0 in \p attributes indicates that + * the key size is solely determined by the key data. + * + * Implementations must reject an attempt to import a key of size 0. + * + * This specification supports a single format for each key type. + * Implementations may support other formats as long as the standard + * format is supported. Implementations that support other formats + * should ensure that the formats are clearly unambiguous so as to + * minimize the risk that an invalid input is accidentally interpreted + * according to a different format. + * + * \param[in] attributes The attributes for the new key. + * The key size is always determined from the + * \p data buffer. + * If the key size in \p attributes is nonzero, + * it must be equal to the size from \p data. + * \param[out] key On success, an identifier to the newly created key. + * For persistent keys, this is the key identifier + * defined in \p attributes. + * \c 0 on failure. + * \param[in] data Buffer containing the key data. The content of this + * buffer is interpreted according to the type declared + * in \p attributes. + * All implementations must support at least the format + * described in the documentation + * of psa_export_key() or psa_export_public_key() for + * the chosen type. Implementations may allow other + * formats, but should be conservative: implementations + * should err on the side of rejecting content if it + * may be erroneous (e.g. wrong type or truncated data). + * \param data_length Size of the \p data buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The key type or key size is not supported, either by the + * implementation in general or in this particular persistent location. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The key attributes, as a whole, are invalid, or + * the key data is not correctly formatted, or + * the size in \p attributes is nonzero and does not match the size + * of the key data. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_import_key(const psa_key_attributes_t *attributes, + const uint8_t *data, + size_t data_length, + mbedtls_svc_key_id_t *key); + + + +/** + * \brief Export a key in binary format. + * + * The output of this function can be passed to psa_import_key() to + * create an equivalent object. + * + * If the implementation of psa_import_key() supports other formats + * beyond the format specified here, the output from psa_export_key() + * must use the representation specified here, not the original + * representation. + * + * For standard key types, the output format is as follows: + * + * - For symmetric keys (including MAC keys), the format is the + * raw bytes of the key. + * - For DES, the key data consists of 8 bytes. The parity bits must be + * correct. + * - For Triple-DES, the format is the concatenation of the + * two or three DES keys. + * - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + * is the non-encrypted DER encoding of the representation defined by + * PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + * ``` + * RSAPrivateKey ::= SEQUENCE { + * version INTEGER, -- must be 0 + * modulus INTEGER, -- n + * publicExponent INTEGER, -- e + * privateExponent INTEGER, -- d + * prime1 INTEGER, -- p + * prime2 INTEGER, -- q + * exponent1 INTEGER, -- d mod (p-1) + * exponent2 INTEGER, -- d mod (q-1) + * coefficient INTEGER, -- (inverse of q) mod p + * } + * ``` + * - For elliptic curve key pairs (key types for which + * #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + * a representation of the private value as a `ceiling(m/8)`-byte string + * where `m` is the bit size associated with the curve, i.e. the bit size + * of the order of the curve's coordinate field. This byte string is + * in little-endian order for Montgomery curves (curve types + * `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + * curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + * and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + * For Weierstrass curves, this is the content of the `privateKey` field of + * the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + * the format is defined by RFC 7748, and output is masked according to §5. + * For twisted Edwards curves, the private key is as defined by RFC 8032 + * (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + * - For Diffie-Hellman key exchange key pairs (key types for which + * #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + * format is the representation of the private key `x` as a big-endian byte + * string. The length of the byte string is the private key size in bytes + * (leading zeroes are not stripped). + * - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + * true), the format is the same as for psa_export_public_key(). + * + * The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + * + * \param key Identifier of the key to export. It must allow the + * usage #PSA_KEY_USAGE_EXPORT, unless it is a public + * key. + * \param[out] data Buffer where the key data is to be written. + * \param data_size Size of the \p data buffer in bytes. + * \param[out] data_length On success, the number of bytes + * that make up the key data. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_EXPORT flag. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p data buffer is too small. You can determine a + * sufficient buffer size by calling + * #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + * where \c type is the key type + * and \c bits is the key size in bits. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_export_key(mbedtls_svc_key_id_t key, + uint8_t *data, + size_t data_size, + size_t *data_length); + +/** + * \brief Export a public key or the public part of a key pair in binary format. + * + * The output of this function can be passed to psa_import_key() to + * create an object that is equivalent to the public key. + * + * This specification supports a single format for each key type. + * Implementations may support other formats as long as the standard + * format is supported. Implementations that support other formats + * should ensure that the formats are clearly unambiguous so as to + * minimize the risk that an invalid input is accidentally interpreted + * according to a different format. + * + * For standard key types, the output format is as follows: + * - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + * the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + * ``` + * RSAPublicKey ::= SEQUENCE { + * modulus INTEGER, -- n + * publicExponent INTEGER } -- e + * ``` + * - For elliptic curve keys on a twisted Edwards curve (key types for which + * #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + * returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + * by RFC 8032 + * (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + * - For other elliptic curve public keys (key types for which + * #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + * representation defined by SEC1 §2.3.3 as the content of an ECPoint. + * Let `m` be the bit size associated with the curve, i.e. the bit size of + * `q` for a curve over `F_q`. The representation consists of: + * - The byte 0x04; + * - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + * - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + * - For Diffie-Hellman key exchange public keys (key types for which + * #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + * the format is the representation of the public key `y = g^x mod p` as a + * big-endian byte string. The length of the byte string is the length of the + * base prime `p` in bytes. + * + * Exporting a public key object or the public part of a key pair is + * always permitted, regardless of the key's usage flags. + * + * \param key Identifier of the key to export. + * \param[out] data Buffer where the key data is to be written. + * \param data_size Size of the \p data buffer in bytes. + * \param[out] data_length On success, the number of bytes + * that make up the key data. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The key is neither a public key nor a key pair. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p data buffer is too small. You can determine a + * sufficient buffer size by calling + * #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + * where \c type is the key type + * and \c bits is the key size in bits. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key, + uint8_t *data, + size_t data_size, + size_t *data_length); + + + +/**@}*/ + +/** \defgroup hash Message digests + * @{ + */ + +/** Calculate the hash (digest) of a message. + * + * \note To verify the hash of a message against an + * expected value, use psa_hash_compare() instead. + * + * \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_HASH(\p alg) is true). + * \param[in] input Buffer containing the message to hash. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] hash Buffer where the hash is to be written. + * \param hash_size Size of the \p hash buffer in bytes. + * \param[out] hash_length On success, the number of bytes + * that make up the hash value. This is always + * #PSA_HASH_LENGTH(\p alg). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a hash algorithm. + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * \p hash_size is too small + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_compute(psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *hash, + size_t hash_size, + size_t *hash_length); + +/** Calculate the hash (digest) of a message and compare it with a + * reference value. + * + * \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_HASH(\p alg) is true). + * \param[in] input Buffer containing the message to hash. + * \param input_length Size of the \p input buffer in bytes. + * \param[in] hash Buffer containing the expected hash value. + * \param hash_length Size of the \p hash buffer in bytes. + * + * \retval #PSA_SUCCESS + * The expected hash is identical to the actual hash of the input. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The hash of the message was calculated successfully, but it + * differs from the expected hash. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a hash algorithm. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p input_length or \p hash_length do not match the hash size for \p alg + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_compare(psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + const uint8_t *hash, + size_t hash_length); + +/** The type of the state data structure for multipart hash operations. + * + * Before calling any function on a hash operation object, the application must + * initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_hash_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_hash_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, + * for example: + * \code + * psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_hash_operation_init() + * to the structure, for example: + * \code + * psa_hash_operation_t operation; + * operation = psa_hash_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_hash_operation_s psa_hash_operation_t; + +/** \def PSA_HASH_OPERATION_INIT + * + * This macro returns a suitable initializer for a hash operation object + * of type #psa_hash_operation_t. + */ + +/** Return an initial value for a hash operation object. + */ +static psa_hash_operation_t psa_hash_operation_init(void); + +/** Set up a multipart hash operation. + * + * The sequence of operations to calculate a hash (message digest) + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + * -# Call psa_hash_setup() to specify the algorithm. + * -# Call psa_hash_update() zero, one or more times, passing a fragment + * of the message each time. The hash that is calculated is the hash + * of the concatenation of these messages in order. + * -# To calculate the hash, call psa_hash_finish(). + * To compare the hash with an expected value, call psa_hash_verify(). + * + * If an error occurs at any step after a call to psa_hash_setup(), the + * operation will need to be reset by a call to psa_hash_abort(). The + * application may call psa_hash_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_hash_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A successful call to psa_hash_finish() or psa_hash_verify(). + * - A call to psa_hash_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_hash_operation_t and not yet in use. + * \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_HASH(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not a supported hash algorithm. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p alg is not a hash algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_setup(psa_hash_operation_t *operation, + psa_algorithm_t alg); + +/** Add a message fragment to a multipart hash operation. + * + * The application must call psa_hash_setup() before calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_hash_abort(). + * + * \param[in,out] operation Active hash operation. + * \param[in] input Buffer containing the message fragment to hash. + * \param input_length Size of the \p input buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_update(psa_hash_operation_t *operation, + const uint8_t *input, + size_t input_length); + +/** Finish the calculation of the hash of a message. + * + * The application must call psa_hash_setup() before calling this function. + * This function calculates the hash of the message formed by concatenating + * the inputs passed to preceding calls to psa_hash_update(). + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_hash_abort(). + * + * \warning Applications should not call this function if they expect + * a specific value for the hash. Call psa_hash_verify() instead. + * Beware that comparing integrity or authenticity data such as + * hash values with a function such as \c memcmp is risky + * because the time taken by the comparison may leak information + * about the hashed data which could allow an attacker to guess + * a valid hash and thereby bypass security controls. + * + * \param[in,out] operation Active hash operation. + * \param[out] hash Buffer where the hash is to be written. + * \param hash_size Size of the \p hash buffer in bytes. + * \param[out] hash_length On success, the number of bytes + * that make up the hash value. This is always + * #PSA_HASH_LENGTH(\c alg) where \c alg is the + * hash algorithm that is calculated. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p hash buffer is too small. You can determine a + * sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + * where \c alg is the hash algorithm that is calculated. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_finish(psa_hash_operation_t *operation, + uint8_t *hash, + size_t hash_size, + size_t *hash_length); + +/** Finish the calculation of the hash of a message and compare it with + * an expected value. + * + * The application must call psa_hash_setup() before calling this function. + * This function calculates the hash of the message formed by concatenating + * the inputs passed to preceding calls to psa_hash_update(). It then + * compares the calculated hash with the expected hash passed as a + * parameter to this function. + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_hash_abort(). + * + * \note Implementations shall make the best effort to ensure that the + * comparison between the actual hash and the expected hash is performed + * in constant time. + * + * \param[in,out] operation Active hash operation. + * \param[in] hash Buffer containing the expected hash value. + * \param hash_length Size of the \p hash buffer in bytes. + * + * \retval #PSA_SUCCESS + * The expected hash is identical to the actual hash of the message. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The hash of the message was calculated successfully, but it + * differs from the expected hash. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_verify(psa_hash_operation_t *operation, + const uint8_t *hash, + size_t hash_length); + +/** Abort a hash operation. + * + * Aborting an operation frees all associated resources except for the + * \p operation structure itself. Once aborted, the operation object + * can be reused for another operation by calling + * psa_hash_setup() again. + * + * You may call this function any time after the operation object has + * been initialized by one of the methods described in #psa_hash_operation_t. + * + * In particular, calling psa_hash_abort() after the operation has been + * terminated by a call to psa_hash_abort(), psa_hash_finish() or + * psa_hash_verify() is safe and has no effect. + * + * \param[in,out] operation Initialized hash operation. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_abort(psa_hash_operation_t *operation); + +/** Clone a hash operation. + * + * This function copies the state of an ongoing hash operation to + * a new operation object. In other words, this function is equivalent + * to calling psa_hash_setup() on \p target_operation with the same + * algorithm that \p source_operation was set up for, then + * psa_hash_update() on \p target_operation with the same input that + * that was passed to \p source_operation. After this function returns, the + * two objects are independent, i.e. subsequent calls involving one of + * the objects do not affect the other object. + * + * \param[in] source_operation The active hash operation to clone. + * \param[in,out] target_operation The operation object to set up. + * It must be initialized but not active. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The \p source_operation state is not valid (it must be active), or + * the \p target_operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation, + psa_hash_operation_t *target_operation); + +/**@}*/ + +/** \defgroup MAC Message authentication codes + * @{ + */ + +/** Calculate the MAC (message authentication code) of a message. + * + * \note To verify the MAC of a message against an + * expected value, use psa_mac_verify() instead. + * Beware that comparing integrity or authenticity data such as + * MAC values with a function such as \c memcmp is risky + * because the time taken by the comparison may leak information + * about the MAC value which could allow an attacker to guess + * a valid MAC and thereby bypass security controls. + * + * \param key Identifier of the key to use for the operation. It + * must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + * \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_MAC(\p alg) is true). + * \param[in] input Buffer containing the input message. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] mac Buffer where the MAC value is to be written. + * \param mac_size Size of the \p mac buffer in bytes. + * \param[out] mac_length On success, the number of bytes + * that make up the MAC value. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a MAC algorithm. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * \p mac_size is too small + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE + * The key could not be retrieved from storage. + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *mac, + size_t mac_size, + size_t *mac_length); + +/** Calculate the MAC of a message and compare it with a reference value. + * + * \param key Identifier of the key to use for the operation. It + * must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + * \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_MAC(\p alg) is true). + * \param[in] input Buffer containing the input message. + * \param input_length Size of the \p input buffer in bytes. + * \param[in] mac Buffer containing the expected MAC value. + * \param mac_length Size of the \p mac buffer in bytes. + * + * \retval #PSA_SUCCESS + * The expected MAC is identical to the actual MAC of the input. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The MAC of the message was calculated successfully, but it + * differs from the expected value. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a MAC algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE + * The key could not be retrieved from storage. + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + const uint8_t *mac, + size_t mac_length); + +/** The type of the state data structure for multipart MAC operations. + * + * Before calling any function on a MAC operation object, the application must + * initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_mac_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_mac_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, + * for example: + * \code + * psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_mac_operation_init() + * to the structure, for example: + * \code + * psa_mac_operation_t operation; + * operation = psa_mac_operation_init(); + * \endcode + * + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_mac_operation_s psa_mac_operation_t; + +/** \def PSA_MAC_OPERATION_INIT + * + * This macro returns a suitable initializer for a MAC operation object of type + * #psa_mac_operation_t. + */ + +/** Return an initial value for a MAC operation object. + */ +static psa_mac_operation_t psa_mac_operation_init(void); + +/** Set up a multipart MAC calculation operation. + * + * This function sets up the calculation of the MAC + * (message authentication code) of a byte string. + * To verify the MAC of a message against an + * expected value, use psa_mac_verify_setup() instead. + * + * The sequence of operations to calculate a MAC is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + * -# Call psa_mac_sign_setup() to specify the algorithm and key. + * -# Call psa_mac_update() zero, one or more times, passing a fragment + * of the message each time. The MAC that is calculated is the MAC + * of the concatenation of these messages in order. + * -# At the end of the message, call psa_mac_sign_finish() to finish + * calculating the MAC value and retrieve it. + * + * If an error occurs at any step after a call to psa_mac_sign_setup(), the + * operation will need to be reset by a call to psa_mac_abort(). The + * application may call psa_mac_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_mac_sign_setup(), the application must + * eventually terminate the operation through one of the following methods: + * - A successful call to psa_mac_sign_finish(). + * - A call to psa_mac_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_mac_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. It + * must remain valid until the operation terminates. + * It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + * \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_MAC(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a MAC algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE + * The key could not be retrieved from storage. + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Set up a multipart MAC verification operation. + * + * This function sets up the verification of the MAC + * (message authentication code) of a byte string against an expected value. + * + * The sequence of operations to verify a MAC is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + * -# Call psa_mac_verify_setup() to specify the algorithm and key. + * -# Call psa_mac_update() zero, one or more times, passing a fragment + * of the message each time. The MAC that is calculated is the MAC + * of the concatenation of these messages in order. + * -# At the end of the message, call psa_mac_verify_finish() to finish + * calculating the actual MAC of the message and verify it against + * the expected value. + * + * If an error occurs at any step after a call to psa_mac_verify_setup(), the + * operation will need to be reset by a call to psa_mac_abort(). The + * application may call psa_mac_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_mac_verify_setup(), the application must + * eventually terminate the operation through one of the following methods: + * - A successful call to psa_mac_verify_finish(). + * - A call to psa_mac_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_mac_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. It + * must remain valid until the operation terminates. + * It must allow the usage + * PSA_KEY_USAGE_VERIFY_MESSAGE. + * \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + * such that #PSA_ALG_IS_MAC(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c key is not compatible with \c alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \c alg is not supported or is not a MAC algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE + * The key could not be retrieved from storage. + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Add a message fragment to a multipart MAC operation. + * + * The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + * before calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_mac_abort(). + * + * \param[in,out] operation Active MAC operation. + * \param[in] input Buffer containing the message fragment to add to + * the MAC calculation. + * \param input_length Size of the \p input buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_update(psa_mac_operation_t *operation, + const uint8_t *input, + size_t input_length); + +/** Finish the calculation of the MAC of a message. + * + * The application must call psa_mac_sign_setup() before calling this function. + * This function calculates the MAC of the message formed by concatenating + * the inputs passed to preceding calls to psa_mac_update(). + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_mac_abort(). + * + * \warning Applications should not call this function if they expect + * a specific value for the MAC. Call psa_mac_verify_finish() instead. + * Beware that comparing integrity or authenticity data such as + * MAC values with a function such as \c memcmp is risky + * because the time taken by the comparison may leak information + * about the MAC value which could allow an attacker to guess + * a valid MAC and thereby bypass security controls. + * + * \param[in,out] operation Active MAC operation. + * \param[out] mac Buffer where the MAC value is to be written. + * \param mac_size Size of the \p mac buffer in bytes. + * \param[out] mac_length On success, the number of bytes + * that make up the MAC value. This is always + * #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + * where \c key_type and \c key_bits are the type and + * bit-size respectively of the key and \c alg is the + * MAC algorithm that is calculated. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p mac buffer is too small. You can determine a + * sufficient buffer size by calling PSA_MAC_LENGTH(). + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active mac sign + * operation), or the library has not been previously initialized + * by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation, + uint8_t *mac, + size_t mac_size, + size_t *mac_length); + +/** Finish the calculation of the MAC of a message and compare it with + * an expected value. + * + * The application must call psa_mac_verify_setup() before calling this function. + * This function calculates the MAC of the message formed by concatenating + * the inputs passed to preceding calls to psa_mac_update(). It then + * compares the calculated MAC with the expected MAC passed as a + * parameter to this function. + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_mac_abort(). + * + * \note Implementations shall make the best effort to ensure that the + * comparison between the actual MAC and the expected MAC is performed + * in constant time. + * + * \param[in,out] operation Active MAC operation. + * \param[in] mac Buffer containing the expected MAC value. + * \param mac_length Size of the \p mac buffer in bytes. + * + * \retval #PSA_SUCCESS + * The expected MAC is identical to the actual MAC of the message. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The MAC of the message was calculated successfully, but it + * differs from the expected MAC. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active mac verify + * operation), or the library has not been previously initialized + * by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation, + const uint8_t *mac, + size_t mac_length); + +/** Abort a MAC operation. + * + * Aborting an operation frees all associated resources except for the + * \p operation structure itself. Once aborted, the operation object + * can be reused for another operation by calling + * psa_mac_sign_setup() or psa_mac_verify_setup() again. + * + * You may call this function any time after the operation object has + * been initialized by one of the methods described in #psa_mac_operation_t. + * + * In particular, calling psa_mac_abort() after the operation has been + * terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + * psa_mac_verify_finish() is safe and has no effect. + * + * \param[in,out] operation Initialized MAC operation. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_mac_abort(psa_mac_operation_t *operation); + +/**@}*/ + +/** \defgroup cipher Symmetric ciphers + * @{ + */ + +/** Encrypt a message using a symmetric cipher. + * + * This function encrypts a message with a random IV (initialization + * vector). Use the multipart operation interface with a + * #psa_cipher_operation_t object to provide other forms of IV. + * + * \param key Identifier of the key to use for the operation. + * It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + * \param alg The cipher algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \param[in] input Buffer containing the message to encrypt. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] output Buffer where the output is to be written. + * The output contains the IV followed by + * the ciphertext proper. + * \param output_size Size of the \p output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a cipher algorithm. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** Decrypt a message using a symmetric cipher. + * + * This function decrypts a message encrypted with a symmetric cipher. + * + * \param key Identifier of the key to use for the operation. + * It must remain valid until the operation + * terminates. It must allow the usage + * #PSA_KEY_USAGE_DECRYPT. + * \param alg The cipher algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \param[in] input Buffer containing the message to decrypt. + * This consists of the IV followed by the + * ciphertext proper. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] output Buffer where the plaintext is to be written. + * \param output_size Size of the \p output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a cipher algorithm. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** The type of the state data structure for multipart cipher operations. + * + * Before calling any function on a cipher operation object, the application + * must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_cipher_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_cipher_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, + * for example: + * \code + * psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_cipher_operation_init() + * to the structure, for example: + * \code + * psa_cipher_operation_t operation; + * operation = psa_cipher_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_cipher_operation_s psa_cipher_operation_t; + +/** \def PSA_CIPHER_OPERATION_INIT + * + * This macro returns a suitable initializer for a cipher operation object of + * type #psa_cipher_operation_t. + */ + +/** Return an initial value for a cipher operation object. + */ +static psa_cipher_operation_t psa_cipher_operation_init(void); + +/** Set the key for a multipart symmetric encryption operation. + * + * The sequence of operations to encrypt a message with a symmetric cipher + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_cipher_operation_t, e.g. + * #PSA_CIPHER_OPERATION_INIT. + * -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + * -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + * generate or set the IV (initialization vector). You should use + * psa_cipher_generate_iv() unless the protocol you are implementing + * requires a specific IV value. + * -# Call psa_cipher_update() zero, one or more times, passing a fragment + * of the message each time. + * -# Call psa_cipher_finish(). + * + * If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + * the operation will need to be reset by a call to psa_cipher_abort(). The + * application may call psa_cipher_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_cipher_encrypt_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A successful call to psa_cipher_finish(). + * - A call to psa_cipher_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_cipher_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. + * It must remain valid until the operation + * terminates. It must allow the usage + * #PSA_KEY_USAGE_ENCRYPT. + * \param alg The cipher algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a cipher algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Set the key for a multipart symmetric decryption operation. + * + * The sequence of operations to decrypt a message with a symmetric cipher + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_cipher_operation_t, e.g. + * #PSA_CIPHER_OPERATION_INIT. + * -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + * -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + * decryption. If the IV is prepended to the ciphertext, you can call + * psa_cipher_update() on a buffer containing the IV followed by the + * beginning of the message. + * -# Call psa_cipher_update() zero, one or more times, passing a fragment + * of the message each time. + * -# Call psa_cipher_finish(). + * + * If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + * the operation will need to be reset by a call to psa_cipher_abort(). The + * application may call psa_cipher_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_cipher_decrypt_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A successful call to psa_cipher_finish(). + * - A call to psa_cipher_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_cipher_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. + * It must remain valid until the operation + * terminates. It must allow the usage + * #PSA_KEY_USAGE_DECRYPT. + * \param alg The cipher algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not a cipher algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Generate an IV for a symmetric encryption operation. + * + * This function generates a random IV (initialization vector), nonce + * or initial counter value for the encryption operation as appropriate + * for the chosen algorithm, key type and key size. + * + * The application must call psa_cipher_encrypt_setup() before + * calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_cipher_abort(). + * + * \param[in,out] operation Active cipher operation. + * \param[out] iv Buffer where the generated IV is to be written. + * \param iv_size Size of the \p iv buffer in bytes. + * \param[out] iv_length On success, the number of bytes of the + * generated IV. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p iv buffer is too small. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, with no IV set), + * or the library has not been previously initialized + * by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation, + uint8_t *iv, + size_t iv_size, + size_t *iv_length); + +/** Set the IV for a symmetric encryption or decryption operation. + * + * This function sets the IV (initialization vector), nonce + * or initial counter value for the encryption or decryption operation. + * + * The application must call psa_cipher_encrypt_setup() before + * calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_cipher_abort(). + * + * \note When encrypting, applications should use psa_cipher_generate_iv() + * instead of this function, unless implementing a protocol that requires + * a non-random IV. + * + * \param[in,out] operation Active cipher operation. + * \param[in] iv Buffer containing the IV to use. + * \param iv_length Size of the IV in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The size of \p iv is not acceptable for the chosen algorithm, + * or the chosen algorithm does not use an IV. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active cipher + * encrypt operation, with no IV set), or the library has not been + * previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation, + const uint8_t *iv, + size_t iv_length); + +/** Encrypt or decrypt a message fragment in an active cipher operation. + * + * Before calling this function, you must: + * 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + * The choice of setup function determines whether this function + * encrypts or decrypts its input. + * 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + * (recommended when encrypting) or psa_cipher_set_iv(). + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_cipher_abort(). + * + * \param[in,out] operation Active cipher operation. + * \param[in] input Buffer containing the message fragment to + * encrypt or decrypt. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] output Buffer where the output is to be written. + * \param output_size Size of the \p output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, with an IV set + * if required for the algorithm), or the library has not been + * previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_update(psa_cipher_operation_t *operation, + const uint8_t *input, + size_t input_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** Finish encrypting or decrypting a message in a cipher operation. + * + * The application must call psa_cipher_encrypt_setup() or + * psa_cipher_decrypt_setup() before calling this function. The choice + * of setup function determines whether this function encrypts or + * decrypts its input. + * + * This function finishes the encryption or decryption of the message + * formed by concatenating the inputs passed to preceding calls to + * psa_cipher_update(). + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_cipher_abort(). + * + * \param[in,out] operation Active cipher operation. + * \param[out] output Buffer where the output is to be written. + * \param output_size Size of the \p output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The total input size passed to this operation is not valid for + * this particular algorithm. For example, the algorithm is a based + * on block cipher and requires a whole number of blocks, but the + * total input size is not a multiple of the block size. + * \retval #PSA_ERROR_INVALID_PADDING + * This is a decryption operation for an algorithm that includes + * padding, and the ciphertext does not contain valid padding. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, with an IV set + * if required for the algorithm), or the library has not been + * previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** Abort a cipher operation. + * + * Aborting an operation frees all associated resources except for the + * \p operation structure itself. Once aborted, the operation object + * can be reused for another operation by calling + * psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. + * + * You may call this function any time after the operation object has + * been initialized as described in #psa_cipher_operation_t. + * + * In particular, calling psa_cipher_abort() after the operation has been + * terminated by a call to psa_cipher_abort() or psa_cipher_finish() + * is safe and has no effect. + * + * \param[in,out] operation Initialized cipher operation. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation); + +/**@}*/ + +/** \defgroup aead Authenticated encryption with associated data (AEAD) + * @{ + */ + +/** Process an authenticated encryption operation. + * + * \param key Identifier of the key to use for the + * operation. It must allow the usage + * #PSA_KEY_USAGE_ENCRYPT. + * \param alg The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * \param[in] nonce Nonce or IV to use. + * \param nonce_length Size of the \p nonce buffer in bytes. + * \param[in] additional_data Additional data that will be authenticated + * but not encrypted. + * \param additional_data_length Size of \p additional_data in bytes. + * \param[in] plaintext Data that will be authenticated and + * encrypted. + * \param plaintext_length Size of \p plaintext in bytes. + * \param[out] ciphertext Output buffer for the authenticated and + * encrypted data. The additional data is not + * part of this output. For algorithms where the + * encrypted data and the authentication tag + * are defined as separate outputs, the + * authentication tag is appended to the + * encrypted data. + * \param ciphertext_size Size of the \p ciphertext buffer in bytes. + * This must be appropriate for the selected + * algorithm and key: + * - A sufficient output size is + * #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + * \p alg, \p plaintext_length) where + * \c key_type is the type of \p key. + * - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + * plaintext_length) evaluates to the maximum + * ciphertext size of any supported AEAD + * encryption. + * \param[out] ciphertext_length On success, the size of the output + * in the \p ciphertext buffer. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not an AEAD algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * \p ciphertext_size is too small. + * #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + * \p plaintext_length) or + * #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + * determine the required buffer size. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *nonce, + size_t nonce_length, + const uint8_t *additional_data, + size_t additional_data_length, + const uint8_t *plaintext, + size_t plaintext_length, + uint8_t *ciphertext, + size_t ciphertext_size, + size_t *ciphertext_length); + +/** Process an authenticated decryption operation. + * + * \param key Identifier of the key to use for the + * operation. It must allow the usage + * #PSA_KEY_USAGE_DECRYPT. + * \param alg The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * \param[in] nonce Nonce or IV to use. + * \param nonce_length Size of the \p nonce buffer in bytes. + * \param[in] additional_data Additional data that has been authenticated + * but not encrypted. + * \param additional_data_length Size of \p additional_data in bytes. + * \param[in] ciphertext Data that has been authenticated and + * encrypted. For algorithms where the + * encrypted data and the authentication tag + * are defined as separate inputs, the buffer + * must contain the encrypted data followed + * by the authentication tag. + * \param ciphertext_length Size of \p ciphertext in bytes. + * \param[out] plaintext Output buffer for the decrypted data. + * \param plaintext_size Size of the \p plaintext buffer in bytes. + * This must be appropriate for the selected + * algorithm and key: + * - A sufficient output size is + * #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + * \p alg, \p ciphertext_length) where + * \c key_type is the type of \p key. + * - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + * ciphertext_length) evaluates to the maximum + * plaintext size of any supported AEAD + * decryption. + * \param[out] plaintext_length On success, the size of the output + * in the \p plaintext buffer. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The ciphertext is not authentic. + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not an AEAD algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * \p plaintext_size is too small. + * #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + * \p ciphertext_length) or + * #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + * to determine the required buffer size. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *nonce, + size_t nonce_length, + const uint8_t *additional_data, + size_t additional_data_length, + const uint8_t *ciphertext, + size_t ciphertext_length, + uint8_t *plaintext, + size_t plaintext_size, + size_t *plaintext_length); + +/** The type of the state data structure for multipart AEAD operations. + * + * Before calling any function on an AEAD operation object, the application + * must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_aead_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_aead_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, + * for example: + * \code + * psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_aead_operation_init() + * to the structure, for example: + * \code + * psa_aead_operation_t operation; + * operation = psa_aead_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_aead_operation_s psa_aead_operation_t; + +/** \def PSA_AEAD_OPERATION_INIT + * + * This macro returns a suitable initializer for an AEAD operation object of + * type #psa_aead_operation_t. + */ + +/** Return an initial value for an AEAD operation object. + */ +static psa_aead_operation_t psa_aead_operation_init(void); + +/** Set the key for a multipart authenticated encryption operation. + * + * The sequence of operations to encrypt a message with authentication + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_aead_operation_t, e.g. + * #PSA_AEAD_OPERATION_INIT. + * -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + * -# If needed, call psa_aead_set_lengths() to specify the length of the + * inputs to the subsequent calls to psa_aead_update_ad() and + * psa_aead_update(). See the documentation of psa_aead_set_lengths() + * for details. + * -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + * generate or set the nonce. You should use + * psa_aead_generate_nonce() unless the protocol you are implementing + * requires a specific nonce value. + * -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + * of the non-encrypted additional authenticated data each time. + * -# Call psa_aead_update() zero, one or more times, passing a fragment + * of the message to encrypt each time. + * -# Call psa_aead_finish(). + * + * If an error occurs at any step after a call to psa_aead_encrypt_setup(), + * the operation will need to be reset by a call to psa_aead_abort(). The + * application may call psa_aead_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_aead_encrypt_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A successful call to psa_aead_finish(). + * - A call to psa_aead_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_aead_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. + * It must remain valid until the operation + * terminates. It must allow the usage + * #PSA_KEY_USAGE_ENCRYPT. + * \param alg The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not an AEAD algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Set the key for a multipart authenticated decryption operation. + * + * The sequence of operations to decrypt a message with authentication + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_aead_operation_t, e.g. + * #PSA_AEAD_OPERATION_INIT. + * -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + * -# If needed, call psa_aead_set_lengths() to specify the length of the + * inputs to the subsequent calls to psa_aead_update_ad() and + * psa_aead_update(). See the documentation of psa_aead_set_lengths() + * for details. + * -# Call psa_aead_set_nonce() with the nonce for the decryption. + * -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + * of the non-encrypted additional authenticated data each time. + * -# Call psa_aead_update() zero, one or more times, passing a fragment + * of the ciphertext to decrypt each time. + * -# Call psa_aead_verify(). + * + * If an error occurs at any step after a call to psa_aead_decrypt_setup(), + * the operation will need to be reset by a call to psa_aead_abort(). The + * application may call psa_aead_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_aead_decrypt_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A successful call to psa_aead_verify(). + * - A call to psa_aead_abort(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized as per the documentation for + * #psa_aead_operation_t and not yet in use. + * \param key Identifier of the key to use for the operation. + * It must remain valid until the operation + * terminates. It must allow the usage + * #PSA_KEY_USAGE_DECRYPT. + * \param alg The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not compatible with \p alg. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not supported or is not an AEAD algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or the + * library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation, + mbedtls_svc_key_id_t key, + psa_algorithm_t alg); + +/** Generate a random nonce for an authenticated encryption operation. + * + * This function generates a random nonce for the authenticated encryption + * operation with an appropriate size for the chosen algorithm, key type + * and key size. + * + * The application must call psa_aead_encrypt_setup() before + * calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \param[in,out] operation Active AEAD operation. + * \param[out] nonce Buffer where the generated nonce is to be + * written. + * \param nonce_size Size of the \p nonce buffer in bytes. + * \param[out] nonce_length On success, the number of bytes of the + * generated nonce. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p nonce buffer is too small. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active aead encrypt + * operation, with no nonce set), or the library has not been + * previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation, + uint8_t *nonce, + size_t nonce_size, + size_t *nonce_length); + +/** Set the nonce for an authenticated encryption or decryption operation. + * + * This function sets the nonce for the authenticated + * encryption or decryption operation. + * + * The application must call psa_aead_encrypt_setup() or + * psa_aead_decrypt_setup() before calling this function. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \note When encrypting, applications should use psa_aead_generate_nonce() + * instead of this function, unless implementing a protocol that requires + * a non-random IV. + * + * \param[in,out] operation Active AEAD operation. + * \param[in] nonce Buffer containing the nonce to use. + * \param nonce_length Size of the nonce in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The size of \p nonce is not acceptable for the chosen algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, with no nonce + * set), or the library has not been previously initialized + * by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation, + const uint8_t *nonce, + size_t nonce_length); + +/** Declare the lengths of the message and additional data for AEAD. + * + * The application must call this function before calling + * psa_aead_update_ad() or psa_aead_update() if the algorithm for + * the operation requires it. If the algorithm does not require it, + * calling this function is optional, but if this function is called + * then the implementation must enforce the lengths. + * + * You may call this function before or after setting the nonce with + * psa_aead_set_nonce() or psa_aead_generate_nonce(). + * + * - For #PSA_ALG_CCM, calling this function is required. + * - For the other AEAD algorithms defined in this specification, calling + * this function is not required. + * - For vendor-defined algorithm, refer to the vendor documentation. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \param[in,out] operation Active AEAD operation. + * \param ad_length Size of the non-encrypted additional + * authenticated data in bytes. + * \param plaintext_length Size of the plaintext to encrypt in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * At least one of the lengths is not acceptable for the chosen + * algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, and + * psa_aead_update_ad() and psa_aead_update() must not have been + * called yet), or the library has not been previously initialized + * by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation, + size_t ad_length, + size_t plaintext_length); + +/** Pass additional data to an active AEAD operation. + * + * Additional data is authenticated, but not encrypted. + * + * You may call this function multiple times to pass successive fragments + * of the additional data. You may not call this function after passing + * data to encrypt or decrypt with psa_aead_update(). + * + * Before calling this function, you must: + * 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + * 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + * there is no guarantee that the input is valid. Therefore, until + * you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + * treat the input as untrusted and prepare to undo any action that + * depends on the input if psa_aead_verify() returns an error status. + * + * \param[in,out] operation Active AEAD operation. + * \param[in] input Buffer containing the fragment of + * additional data. + * \param input_length Size of the \p input buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The total input length overflows the additional data length that + * was previously specified with psa_aead_set_lengths(). + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, have a nonce + * set, have lengths set if required by the algorithm, and + * psa_aead_update() must not have been called yet), or the library + * has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation, + const uint8_t *input, + size_t input_length); + +/** Encrypt or decrypt a message fragment in an active AEAD operation. + * + * Before calling this function, you must: + * 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + * The choice of setup function determines whether this function + * encrypts or decrypts its input. + * 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + * 3. Call psa_aead_update_ad() to pass all the additional data. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + * there is no guarantee that the input is valid. Therefore, until + * you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + * - Do not use the output in any way other than storing it in a + * confidential location. If you take any action that depends + * on the tentative decrypted data, this action will need to be + * undone if the input turns out not to be valid. Furthermore, + * if an adversary can observe that this action took place + * (for example through timing), they may be able to use this + * fact as an oracle to decrypt any message encrypted with the + * same key. + * - In particular, do not copy the output anywhere but to a + * memory or storage space that you have exclusive access to. + * + * This function does not require the input to be aligned to any + * particular block boundary. If the implementation can only process + * a whole block at a time, it must consume all the input provided, but + * it may delay the end of the corresponding output until a subsequent + * call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + * provides sufficient input. The amount of data that can be delayed + * in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + * + * \param[in,out] operation Active AEAD operation. + * \param[in] input Buffer containing the message fragment to + * encrypt or decrypt. + * \param input_length Size of the \p input buffer in bytes. + * \param[out] output Buffer where the output is to be written. + * \param output_size Size of the \p output buffer in bytes. + * This must be appropriate for the selected + * algorithm and key: + * - A sufficient output size is + * #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + * \c alg, \p input_length) where + * \c key_type is the type of key and \c alg is + * the algorithm that were used to set up the + * operation. + * - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + * input_length) evaluates to the maximum + * output size of any supported AEAD + * algorithm. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. + * #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + * #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + * determine the required buffer size. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The total length of input to psa_aead_update_ad() so far is + * less than the additional data length that was previously + * specified with psa_aead_set_lengths(), or + * the total input length overflows the plaintext length that + * was previously specified with psa_aead_set_lengths(). + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, have a nonce + * set, and have lengths set if required by the algorithm), or the + * library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_update(psa_aead_operation_t *operation, + const uint8_t *input, + size_t input_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** Finish encrypting a message in an AEAD operation. + * + * The operation must have been set up with psa_aead_encrypt_setup(). + * + * This function finishes the authentication of the additional data + * formed by concatenating the inputs passed to preceding calls to + * psa_aead_update_ad() with the plaintext formed by concatenating the + * inputs passed to preceding calls to psa_aead_update(). + * + * This function has two output buffers: + * - \p ciphertext contains trailing ciphertext that was buffered from + * preceding calls to psa_aead_update(). + * - \p tag contains the authentication tag. + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \param[in,out] operation Active AEAD operation. + * \param[out] ciphertext Buffer where the last part of the ciphertext + * is to be written. + * \param ciphertext_size Size of the \p ciphertext buffer in bytes. + * This must be appropriate for the selected + * algorithm and key: + * - A sufficient output size is + * #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + * \c alg) where \c key_type is the type of key + * and \c alg is the algorithm that were used to + * set up the operation. + * - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + * the maximum output size of any supported AEAD + * algorithm. + * \param[out] ciphertext_length On success, the number of bytes of + * returned ciphertext. + * \param[out] tag Buffer where the authentication tag is + * to be written. + * \param tag_size Size of the \p tag buffer in bytes. + * This must be appropriate for the selected + * algorithm and key: + * - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + * key_type, \c key_bits, \c alg) where + * \c key_type and \c key_bits are the type and + * bit-size of the key, and \c alg is the + * algorithm that were used in the call to + * psa_aead_encrypt_setup(). + * - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + * maximum tag size of any supported AEAD + * algorithm. + * \param[out] tag_length On success, the number of bytes + * that make up the returned tag. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p ciphertext or \p tag buffer is too small. + * #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + * #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + * required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + * \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + * determine the required \p tag buffer size. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The total length of input to psa_aead_update_ad() so far is + * less than the additional data length that was previously + * specified with psa_aead_set_lengths(), or + * the total length of input to psa_aead_update() so far is + * less than the plaintext length that was previously + * specified with psa_aead_set_lengths(). + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active encryption + * operation with a nonce set), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_finish(psa_aead_operation_t *operation, + uint8_t *ciphertext, + size_t ciphertext_size, + size_t *ciphertext_length, + uint8_t *tag, + size_t tag_size, + size_t *tag_length); + +/** Finish authenticating and decrypting a message in an AEAD operation. + * + * The operation must have been set up with psa_aead_decrypt_setup(). + * + * This function finishes the authenticated decryption of the message + * components: + * + * - The additional data consisting of the concatenation of the inputs + * passed to preceding calls to psa_aead_update_ad(). + * - The ciphertext consisting of the concatenation of the inputs passed to + * preceding calls to psa_aead_update(). + * - The tag passed to this function call. + * + * If the authentication tag is correct, this function outputs any remaining + * plaintext and reports success. If the authentication tag is not correct, + * this function returns #PSA_ERROR_INVALID_SIGNATURE. + * + * When this function returns successfully, the operation becomes inactive. + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_aead_abort(). + * + * \note Implementations shall make the best effort to ensure that the + * comparison between the actual tag and the expected tag is performed + * in constant time. + * + * \param[in,out] operation Active AEAD operation. + * \param[out] plaintext Buffer where the last part of the plaintext + * is to be written. This is the remaining data + * from previous calls to psa_aead_update() + * that could not be processed until the end + * of the input. + * \param plaintext_size Size of the \p plaintext buffer in bytes. + * This must be appropriate for the selected algorithm and key: + * - A sufficient output size is + * #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + * \c alg) where \c key_type is the type of key + * and \c alg is the algorithm that were used to + * set up the operation. + * - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + * the maximum output size of any supported AEAD + * algorithm. + * \param[out] plaintext_length On success, the number of bytes of + * returned plaintext. + * \param[in] tag Buffer containing the authentication tag. + * \param tag_length Size of the \p tag buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The calculations were successful, but the authentication tag is + * not correct. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p plaintext buffer is too small. + * #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + * #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + * required buffer size. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The total length of input to psa_aead_update_ad() so far is + * less than the additional data length that was previously + * specified with psa_aead_set_lengths(), or + * the total length of input to psa_aead_update() so far is + * less than the plaintext length that was previously + * specified with psa_aead_set_lengths(). + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be an active decryption + * operation with a nonce set), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_verify(psa_aead_operation_t *operation, + uint8_t *plaintext, + size_t plaintext_size, + size_t *plaintext_length, + const uint8_t *tag, + size_t tag_length); + +/** Abort an AEAD operation. + * + * Aborting an operation frees all associated resources except for the + * \p operation structure itself. Once aborted, the operation object + * can be reused for another operation by calling + * psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + * + * You may call this function any time after the operation object has + * been initialized as described in #psa_aead_operation_t. + * + * In particular, calling psa_aead_abort() after the operation has been + * terminated by a call to psa_aead_abort(), psa_aead_finish() or + * psa_aead_verify() is safe and has no effect. + * + * \param[in,out] operation Initialized AEAD operation. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_aead_abort(psa_aead_operation_t *operation); + +/**@}*/ + +/** \defgroup asymmetric Asymmetric cryptography + * @{ + */ + +/** + * \brief Sign a message with a private key. For hash-and-sign algorithms, + * this includes the hashing step. + * + * \note To perform a multi-part hash-and-sign signature algorithm, first use + * a multi-part hash operation and then pass the resulting hash to + * psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + * hash algorithm to use. + * + * \param[in] key Identifier of the key to use for the operation. + * It must be an asymmetric key pair. The key must + * allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + * \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + * is true), that is compatible with the type of + * \p key. + * \param[in] input The input message to sign. + * \param[in] input_length Size of the \p input buffer in bytes. + * \param[out] signature Buffer where the signature is to be written. + * \param[in] signature_size Size of the \p signature buffer in bytes. This + * must be appropriate for the selected + * algorithm and key: + * - The required signature size is + * #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + * where \c key_type and \c key_bits are the type and + * bit-size respectively of key. + * - #PSA_SIGNATURE_MAX_SIZE evaluates to the + * maximum signature size of any supported + * signature algorithm. + * \param[out] signature_length On success, the number of bytes that make up + * the returned signature value. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + * or it does not permit the requested algorithm. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p signature buffer is too small. You can + * determine a sufficient buffer size by calling + * #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + * where \c key_type and \c key_bits are the type and bit-size + * respectively of \p key. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_sign_message(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *signature, + size_t signature_size, + size_t *signature_length); + +/** \brief Verify the signature of a message with a public key, using + * a hash-and-sign verification algorithm. + * + * \note To perform a multi-part hash-and-sign signature verification + * algorithm, first use a multi-part hash operation to hash the message + * and then pass the resulting hash to psa_verify_hash(). + * PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + * to use. + * + * \param[in] key Identifier of the key to use for the operation. + * It must be a public key or an asymmetric key + * pair. The key must allow the usage + * #PSA_KEY_USAGE_VERIFY_MESSAGE. + * \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + * is true), that is compatible with the type of + * \p key. + * \param[in] input The message whose signature is to be verified. + * \param[in] input_length Size of the \p input buffer in bytes. + * \param[in] signature Buffer containing the signature to verify. + * \param[in] signature_length Size of the \p signature buffer in bytes. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + * or it does not permit the requested algorithm. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The calculation was performed successfully, but the passed signature + * is not a valid signature. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_verify_message(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + const uint8_t *signature, + size_t signature_length); + +/** + * \brief Sign a hash or short message with a private key. + * + * Note that to perform a hash-and-sign signature algorithm, you must + * first calculate the hash by calling psa_hash_setup(), psa_hash_update() + * and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + * Then pass the resulting hash as the \p hash + * parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + * to determine the hash algorithm to use. + * + * \param key Identifier of the key to use for the operation. + * It must be an asymmetric key pair. The key must + * allow the usage #PSA_KEY_USAGE_SIGN_HASH. + * \param alg A signature algorithm (PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + * is true), that is compatible with + * the type of \p key. + * \param[in] hash The hash or message to sign. + * \param hash_length Size of the \p hash buffer in bytes. + * \param[out] signature Buffer where the signature is to be written. + * \param signature_size Size of the \p signature buffer in bytes. + * \param[out] signature_length On success, the number of bytes + * that make up the returned signature value. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p signature buffer is too small. You can + * determine a sufficient buffer size by calling + * #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + * where \c key_type and \c key_bits are the type and bit-size + * respectively of \p key. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *hash, + size_t hash_length, + uint8_t *signature, + size_t signature_size, + size_t *signature_length); + +/** + * \brief Verify the signature of a hash or short message using a public key. + * + * Note that to perform a hash-and-sign signature algorithm, you must + * first calculate the hash by calling psa_hash_setup(), psa_hash_update() + * and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + * Then pass the resulting hash as the \p hash + * parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + * to determine the hash algorithm to use. + * + * \param key Identifier of the key to use for the operation. It + * must be a public key or an asymmetric key pair. The + * key must allow the usage + * #PSA_KEY_USAGE_VERIFY_HASH. + * \param alg A signature algorithm (PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + * is true), that is compatible with + * the type of \p key. + * \param[in] hash The hash or message whose signature is to be + * verified. + * \param hash_length Size of the \p hash buffer in bytes. + * \param[in] signature Buffer containing the signature to verify. + * \param signature_length Size of the \p signature buffer in bytes. + * + * \retval #PSA_SUCCESS + * The signature is valid. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The calculation was performed successfully, but the passed + * signature is not a valid signature. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *hash, + size_t hash_length, + const uint8_t *signature, + size_t signature_length); + +/** + * \brief Encrypt a short message with a public key. + * + * \param key Identifier of the key to use for the operation. + * It must be a public key or an asymmetric key + * pair. It must allow the usage + * #PSA_KEY_USAGE_ENCRYPT. + * \param alg An asymmetric encryption algorithm that is + * compatible with the type of \p key. + * \param[in] input The message to encrypt. + * \param input_length Size of the \p input buffer in bytes. + * \param[in] salt A salt or label, if supported by the + * encryption algorithm. + * If the algorithm does not support a + * salt, pass \c NULL. + * If the algorithm supports an optional + * salt and you do not want to pass a salt, + * pass \c NULL. + * + * - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + * supported. + * \param salt_length Size of the \p salt buffer in bytes. + * If \p salt is \c NULL, pass 0. + * \param[out] output Buffer where the encrypted message is to + * be written. + * \param output_size Size of the \p output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. You can + * determine a sufficient buffer size by calling + * #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + * where \c key_type and \c key_bits are the type and bit-size + * respectively of \p key. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + const uint8_t *salt, + size_t salt_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** + * \brief Decrypt a short message with a private key. + * + * \param key Identifier of the key to use for the operation. + * It must be an asymmetric key pair. It must + * allow the usage #PSA_KEY_USAGE_DECRYPT. + * \param alg An asymmetric encryption algorithm that is + * compatible with the type of \p key. + * \param[in] input The message to decrypt. + * \param input_length Size of the \p input buffer in bytes. + * \param[in] salt A salt or label, if supported by the + * encryption algorithm. + * If the algorithm does not support a + * salt, pass \c NULL. + * If the algorithm supports an optional + * salt and you do not want to pass a salt, + * pass \c NULL. + * + * - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + * supported. + * \param salt_length Size of the \p salt buffer in bytes. + * If \p salt is \c NULL, pass 0. + * \param[out] output Buffer where the decrypted message is to + * be written. + * \param output_size Size of the \c output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. You can + * determine a sufficient buffer size by calling + * #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + * where \c key_type and \c key_bits are the type and bit-size + * respectively of \p key. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_INVALID_PADDING \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key, + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + const uint8_t *salt, + size_t salt_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/**@}*/ + +/** \defgroup key_derivation Key derivation and pseudorandom generation + * @{ + */ + +/** The type of the state data structure for key derivation operations. + * + * Before calling any function on a key derivation operation object, the + * application must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_key_derivation_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_key_derivation_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, + * for example: + * \code + * psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_key_derivation_operation_init() + * to the structure, for example: + * \code + * psa_key_derivation_operation_t operation; + * operation = psa_key_derivation_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. + */ +typedef struct psa_key_derivation_s psa_key_derivation_operation_t; + +/** \def PSA_KEY_DERIVATION_OPERATION_INIT + * + * This macro returns a suitable initializer for a key derivation operation + * object of type #psa_key_derivation_operation_t. + */ + +/** Return an initial value for a key derivation operation object. + */ +static psa_key_derivation_operation_t psa_key_derivation_operation_init(void); + +/** Set up a key derivation operation. + * + * A key derivation algorithm takes some inputs and uses them to generate + * a byte stream in a deterministic way. + * This byte stream can be used to produce keys and other + * cryptographic material. + * + * To derive a key: + * -# Start with an initialized object of type #psa_key_derivation_operation_t. + * -# Call psa_key_derivation_setup() to select the algorithm. + * -# Provide the inputs for the key derivation by calling + * psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + * as appropriate. Which inputs are needed, in what order, and whether + * they may be keys and if so of what type depends on the algorithm. + * -# Optionally set the operation's maximum capacity with + * psa_key_derivation_set_capacity(). You may do this before, in the middle + * of or after providing inputs. For some algorithms, this step is mandatory + * because the output depends on the maximum capacity. + * -# To derive a key, call psa_key_derivation_output_key() or + * psa_key_derivation_output_key_custom(). + * To derive a byte string for a different purpose, call + * psa_key_derivation_output_bytes(). + * Successive calls to these functions use successive output bytes + * calculated by the key derivation algorithm. + * -# Clean up the key derivation operation object with + * psa_key_derivation_abort(). + * + * If this function returns an error, the key derivation operation object is + * not changed. + * + * If an error occurs at any step after a call to psa_key_derivation_setup(), + * the operation will need to be reset by a call to psa_key_derivation_abort(). + * + * Implementations must reject an attempt to derive a key of size 0. + * + * \param[in,out] operation The key derivation operation object + * to set up. It must + * have been initialized but not set up yet. + * \param alg The key derivation algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c alg is not a key derivation algorithm. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \c alg is not supported or is not a key derivation algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be inactive), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_setup( + psa_key_derivation_operation_t *operation, + psa_algorithm_t alg); + +/** Retrieve the current capacity of a key derivation operation. + * + * The capacity of a key derivation is the maximum number of bytes that it can + * return. When you get *N* bytes of output from a key derivation operation, + * this reduces its capacity by *N*. + * + * \param[in] operation The operation to query. + * \param[out] capacity On success, the capacity of the operation. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_get_capacity( + const psa_key_derivation_operation_t *operation, + size_t *capacity); + +/** Set the maximum capacity of a key derivation operation. + * + * The capacity of a key derivation operation is the maximum number of bytes + * that the key derivation operation can return from this point onwards. + * + * \param[in,out] operation The key derivation operation object to modify. + * \param capacity The new capacity of the operation. + * It must be less or equal to the operation's + * current capacity. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p capacity is larger than the operation's current capacity. + * In this case, the operation object remains valid and its capacity + * remains unchanged. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active), or the + * library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_set_capacity( + psa_key_derivation_operation_t *operation, + size_t capacity); + +/** Use the maximum possible capacity for a key derivation operation. + * + * Use this value as the capacity argument when setting up a key derivation + * to indicate that the operation should have the maximum possible capacity. + * The value of the maximum possible capacity depends on the key derivation + * algorithm. + */ +#define PSA_KEY_DERIVATION_UNLIMITED_CAPACITY ((size_t) (-1)) + +/** Provide an input for key derivation or key agreement. + * + * Which inputs are required and in what order depends on the algorithm. + * Refer to the documentation of each key derivation or key agreement + * algorithm for information. + * + * This function passes direct inputs, which is usually correct for + * non-secret inputs. To pass a secret input, which should be in a key + * object, call psa_key_derivation_input_key() instead of this function. + * Refer to the documentation of individual step types + * (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + * for more information. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to use. + * It must have been set up with + * psa_key_derivation_setup() and must not + * have produced any output yet. + * \param step Which step the input data is for. + * \param[in] data Input data to use. + * \param data_length Size of the \p data buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c step is not compatible with the operation's algorithm, or + * \c step does not allow direct inputs. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid for this input \p step, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_input_bytes( + psa_key_derivation_operation_t *operation, + psa_key_derivation_step_t step, + const uint8_t *data, + size_t data_length); + +/** Provide a numeric input for key derivation or key agreement. + * + * Which inputs are required and in what order depends on the algorithm. + * However, when an algorithm requires a particular order, numeric inputs + * usually come first as they tend to be configuration parameters. + * Refer to the documentation of each key derivation or key agreement + * algorithm for information. + * + * This function is used for inputs which are fixed-size non-negative + * integers. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to use. + * It must have been set up with + * psa_key_derivation_setup() and must not + * have produced any output yet. + * \param step Which step the input data is for. + * \param[in] value The value of the numeric input. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c step is not compatible with the operation's algorithm, or + * \c step does not allow numeric inputs. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid for this input \p step, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_input_integer( + psa_key_derivation_operation_t *operation, + psa_key_derivation_step_t step, + uint64_t value); + +/** Provide an input for key derivation in the form of a key. + * + * Which inputs are required and in what order depends on the algorithm. + * Refer to the documentation of each key derivation or key agreement + * algorithm for information. + * + * This function obtains input from a key object, which is usually correct for + * secret inputs or for non-secret personalization strings kept in the key + * store. To pass a non-secret parameter which is not in the key store, + * call psa_key_derivation_input_bytes() instead of this function. + * Refer to the documentation of individual step types + * (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + * for more information. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to use. + * It must have been set up with + * psa_key_derivation_setup() and must not + * have produced any output yet. + * \param step Which step the input data is for. + * \param key Identifier of the key. It must have an + * appropriate type for step and must allow the + * usage #PSA_KEY_USAGE_DERIVE or + * #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + * and the algorithm used by the operation. + * + * \note Once all inputs steps are completed, the operations will allow: + * - psa_key_derivation_output_bytes() if each input was either a direct input + * or a key with #PSA_KEY_USAGE_DERIVE set; + * - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + * if the input for step + * #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + * was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + * either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + * - psa_key_derivation_verify_bytes() if each input was either a direct input + * or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + * - psa_key_derivation_verify_key() under the same conditions as + * psa_key_derivation_verify_bytes(). + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * The key allows neither #PSA_KEY_USAGE_DERIVE nor + * #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + * algorithm. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c step is not compatible with the operation's algorithm, or + * \c step does not allow key inputs of the given type + * or does not allow key inputs at all. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid for this input \p step, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_input_key( + psa_key_derivation_operation_t *operation, + psa_key_derivation_step_t step, + mbedtls_svc_key_id_t key); + +/** Perform a key agreement and use the shared secret as input to a key + * derivation. + * + * A key agreement algorithm takes two inputs: a private key \p private_key + * a public key \p peer_key. + * The result of this function is passed as input to a key derivation. + * The output of this key derivation can be extracted by reading from the + * resulting operation to produce keys and other cryptographic material. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to use. + * It must have been set up with + * psa_key_derivation_setup() with a + * key agreement and derivation algorithm + * \c alg (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + * and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + * is false). + * The operation must be ready for an + * input of the type given by \p step. + * \param step Which step the input data is for. + * \param private_key Identifier of the private key to use. It must + * allow the usage #PSA_KEY_USAGE_DERIVE. + * \param[in] peer_key Public key of the peer. The peer key must be in the + * same format that psa_import_key() accepts for the + * public key type corresponding to the type of + * private_key. That is, this function performs the + * equivalent of + * #psa_import_key(..., + * `peer_key`, `peer_key_length`) where + * with key attributes indicating the public key + * type corresponding to the type of `private_key`. + * For example, for EC keys, this means that peer_key + * is interpreted as a point on the curve that the + * private key is on. The standard formats for public + * keys are documented in the documentation of + * psa_export_public_key(). + * \param peer_key_length Size of \p peer_key in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \c private_key is not compatible with \c alg, + * or \p peer_key is not valid for \c alg or not compatible with + * \c private_key, or \c step does not allow an input resulting + * from a key agreement. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \c alg is not supported or is not a key derivation algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid for this key agreement \p step, + * or the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_key_agreement( + psa_key_derivation_operation_t *operation, + psa_key_derivation_step_t step, + mbedtls_svc_key_id_t private_key, + const uint8_t *peer_key, + size_t peer_key_length); + +/** Read some data from a key derivation operation. + * + * This function calculates output bytes from a key derivation algorithm and + * return those bytes. + * If you view the key derivation's output as a stream of bytes, this + * function destructively reads the requested number of bytes from the + * stream. + * The operation's capacity decreases by the number of bytes read. + * + * If this function returns an error status other than + * #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to read from. + * \param[out] output Buffer where the output will be written. + * \param output_length Number of bytes to output. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * One of the inputs was a key whose policy didn't allow + * #PSA_KEY_USAGE_DERIVE. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * The operation's capacity was less than + * \p output_length bytes. Note that in this case, + * no output is written to the output buffer. + * The operation's capacity is set to 0, thus + * subsequent calls to this function will not + * succeed, even with a smaller output buffer. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_output_bytes( + psa_key_derivation_operation_t *operation, + uint8_t *output, + size_t output_length); + +/** Derive a key from an ongoing key derivation operation. + * + * This function calculates output bytes from a key derivation algorithm + * and uses those bytes to generate a key deterministically. + * The key's location, usage policy, type and size are taken from + * \p attributes. + * + * If you view the key derivation's output as a stream of bytes, this + * function destructively reads as many bytes as required from the + * stream. + * The operation's capacity decreases by the number of bytes read. + * + * If this function returns an error status other than + * #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + * state and must be aborted by calling psa_key_derivation_abort(). + * + * How much output is produced and consumed from the operation, and how + * the key is derived, depends on the key type and on the key size + * (denoted \c bits below): + * + * - For key types for which the key is an arbitrary sequence of bytes + * of a given size, this function is functionally equivalent to + * calling #psa_key_derivation_output_bytes + * and passing the resulting output to #psa_import_key. + * However, this function has a security benefit: + * if the implementation provides an isolation boundary then + * the key material is not exposed outside the isolation boundary. + * As a consequence, for these key types, this function always consumes + * exactly (\c bits / 8) bytes from the operation. + * The following key types defined in this specification follow this scheme: + * + * - #PSA_KEY_TYPE_AES; + * - #PSA_KEY_TYPE_ARIA; + * - #PSA_KEY_TYPE_CAMELLIA; + * - #PSA_KEY_TYPE_DERIVE; + * - #PSA_KEY_TYPE_HMAC; + * - #PSA_KEY_TYPE_PASSWORD_HASH. + * + * - For ECC keys on a Montgomery elliptic curve + * (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + * Montgomery curve), this function always draws a byte string whose + * length is determined by the curve, and sets the mandatory bits + * accordingly. That is: + * + * - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + * string and process it as specified in RFC 7748 §5. + * - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + * string and process it as specified in RFC 7748 §5. + * + * - For key types for which the key is represented by a single sequence of + * \c bits bits with constraints as to which bit sequences are acceptable, + * this function draws a byte string of length (\c bits / 8) bytes rounded + * up to the nearest whole number of bytes. If the resulting byte string + * is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + * This process is repeated until an acceptable byte string is drawn. + * The byte string drawn from the operation is interpreted as specified + * for the output produced by psa_export_key(). + * The following key types defined in this specification follow this scheme: + * + * - #PSA_KEY_TYPE_DES. + * Force-set the parity bits, but discard forbidden weak keys. + * For 2-key and 3-key triple-DES, the three keys are generated + * successively (for example, for 3-key triple-DES, + * if the first 8 bytes specify a weak key and the next 8 bytes do not, + * discard the first 8 bytes, use the next 8 bytes as the first key, + * and continue reading output from the operation to derive the other + * two keys). + * - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + * where \c group designates any Diffie-Hellman group) and + * ECC keys on a Weierstrass elliptic curve + * (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + * Weierstrass curve). + * For these key types, interpret the byte string as integer + * in big-endian order. Discard it if it is not in the range + * [0, *N* - 2] where *N* is the boundary of the private key domain + * (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + * or the order of the curve's base point for ECC). + * Add 1 to the resulting integer and use this as the private key *x*. + * This method allows compliance to NIST standards, specifically + * the methods titled "key-pair generation by testing candidates" + * in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + * in FIPS 186-4 §B.1.2 for DSA, and + * in NIST SP 800-56A §5.6.1.2.2 or + * FIPS 186-4 §B.4.2 for elliptic curve keys. + * + * - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + * the way in which the operation output is consumed is + * implementation-defined. + * + * In all cases, the data that is read is discarded from the operation. + * The operation's capacity is decreased by the number of bytes read. + * + * For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + * the input to that step must be provided with psa_key_derivation_input_key(). + * Future versions of this specification may include additional restrictions + * on the derived key based on the attributes and strength of the secret key. + * + * \note This function is equivalent to calling + * psa_key_derivation_output_key_custom() + * with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + * and `custom_data_length == 0` (i.e. `custom_data` is empty). + * + * \param[in] attributes The attributes for the new key. + * If the key type to be created is + * #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + * the policy must be the same as in the current + * operation. + * \param[in,out] operation The key derivation operation object to read from. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * There was not enough data to create the desired key. + * Note that in this case, no output is written to the output buffer. + * The operation's capacity is set to 0, thus subsequent calls to + * this function will not succeed, even with a smaller output buffer. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The key type or key size is not supported, either by the + * implementation in general or in this particular location. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The provided key attributes are not valid for the operation. + * \retval #PSA_ERROR_NOT_PERMITTED + * The #PSA_KEY_DERIVATION_INPUT_SECRET or + * #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + * key; or one of the inputs was a key whose policy didn't allow + * #PSA_KEY_USAGE_DERIVE. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_output_key( + const psa_key_attributes_t *attributes, + psa_key_derivation_operation_t *operation, + mbedtls_svc_key_id_t *key); + +/** Derive a key from an ongoing key derivation operation with custom + * production parameters. + * + * See the description of psa_key_derivation_out_key() for the operation of + * this function with the default production parameters. + * Mbed TLS currently does not currently support any non-default production + * parameters. + * + * \note This function is experimental and may change in future minor + * versions of Mbed TLS. + * + * \param[in] attributes The attributes for the new key. + * If the key type to be created is + * #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + * the policy must be the same as in the current + * operation. + * \param[in,out] operation The key derivation operation object to read from. + * \param[in] custom Customization parameters for the key generation. + * When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + * with \p custom_data_length = 0, + * this function is equivalent to + * psa_key_derivation_output_key(). + * \param[in] custom_data Variable-length data associated with \c custom. + * \param custom_data_length + * Length of `custom_data` in bytes. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * There was not enough data to create the desired key. + * Note that in this case, no output is written to the output buffer. + * The operation's capacity is set to 0, thus subsequent calls to + * this function will not succeed, even with a smaller output buffer. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The key type or key size is not supported, either by the + * implementation in general or in this particular location. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The provided key attributes are not valid for the operation. + * \retval #PSA_ERROR_NOT_PERMITTED + * The #PSA_KEY_DERIVATION_INPUT_SECRET or + * #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + * key; or one of the inputs was a key whose policy didn't allow + * #PSA_KEY_USAGE_DERIVE. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_output_key_custom( + const psa_key_attributes_t *attributes, + psa_key_derivation_operation_t *operation, + const psa_custom_key_parameters_t *custom, + const uint8_t *custom_data, + size_t custom_data_length, + mbedtls_svc_key_id_t *key); + +#ifndef __cplusplus +/* Omitted when compiling in C++, because one of the parameters is a + * pointer to a struct with a flexible array member, and that is not + * standard C++. + * https://github.com/Mbed-TLS/mbedtls/issues/9020 + */ +/** Derive a key from an ongoing key derivation operation with custom + * production parameters. + * + * \note + * This is a deprecated variant of psa_key_derivation_output_key_custom(). + * It is equivalent except that the associated variable-length data + * is passed in `params->data` instead of a separate parameter. + * This function will be removed in a future version of Mbed TLS. + * + * \param[in] attributes The attributes for the new key. + * If the key type to be created is + * #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + * the policy must be the same as in the current + * operation. + * \param[in,out] operation The key derivation operation object to read from. + * \param[in] params Customization parameters for the key derivation. + * When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + * with \p params_data_length = 0, + * this function is equivalent to + * psa_key_derivation_output_key(). + * Mbed TLS currently only supports the default + * production parameters, i.e. + * #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + * for all key types. + * \param params_data_length + * Length of `params->data` in bytes. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * There was not enough data to create the desired key. + * Note that in this case, no output is written to the output buffer. + * The operation's capacity is set to 0, thus subsequent calls to + * this function will not succeed, even with a smaller output buffer. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The key type or key size is not supported, either by the + * implementation in general or in this particular location. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The provided key attributes are not valid for the operation. + * \retval #PSA_ERROR_NOT_PERMITTED + * The #PSA_KEY_DERIVATION_INPUT_SECRET or + * #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + * key; or one of the inputs was a key whose policy didn't allow + * #PSA_KEY_USAGE_DERIVE. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_output_key_ext( + const psa_key_attributes_t *attributes, + psa_key_derivation_operation_t *operation, + const psa_key_production_parameters_t *params, + size_t params_data_length, + mbedtls_svc_key_id_t *key); +#endif /* !__cplusplus */ + +/** Compare output data from a key derivation operation to an expected value. + * + * This function calculates output bytes from a key derivation algorithm and + * compares those bytes to an expected value in constant time. + * If you view the key derivation's output as a stream of bytes, this + * function destructively reads the expected number of bytes from the + * stream before comparing them. + * The operation's capacity decreases by the number of bytes read. + * + * This is functionally equivalent to the following code: + * \code + * psa_key_derivation_output_bytes(operation, tmp, output_length); + * if (memcmp(output, tmp, output_length) != 0) + * return PSA_ERROR_INVALID_SIGNATURE; + * \endcode + * except (1) it works even if the key's policy does not allow outputting the + * bytes, and (2) the comparison will be done in constant time. + * + * If this function returns an error status other than + * #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + * the operation enters an error state and must be aborted by calling + * psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to read from. + * \param[in] expected Buffer containing the expected derivation output. + * \param expected_length Length of the expected output; this is also the + * number of bytes that will be read. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The output was read successfully, but it differs from the expected + * output. + * \retval #PSA_ERROR_NOT_PERMITTED + * One of the inputs was a key whose policy didn't allow + * #PSA_KEY_USAGE_VERIFY_DERIVATION. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * The operation's capacity was less than + * \p output_length bytes. Note that in this case, + * the operation's capacity is set to 0, thus + * subsequent calls to this function will not + * succeed, even with a smaller expected output. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_verify_bytes( + psa_key_derivation_operation_t *operation, + const uint8_t *expected, + size_t expected_length); + +/** Compare output data from a key derivation operation to an expected value + * stored in a key object. + * + * This function calculates output bytes from a key derivation algorithm and + * compares those bytes to an expected value, provided as key of type + * #PSA_KEY_TYPE_PASSWORD_HASH. + * If you view the key derivation's output as a stream of bytes, this + * function destructively reads the number of bytes corresponding to the + * length of the expected value from the stream before comparing them. + * The operation's capacity decreases by the number of bytes read. + * + * This is functionally equivalent to exporting the key and calling + * psa_key_derivation_verify_bytes() on the result, except that it + * works even if the key cannot be exported. + * + * If this function returns an error status other than + * #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + * the operation enters an error state and must be aborted by calling + * psa_key_derivation_abort(). + * + * \param[in,out] operation The key derivation operation object to read from. + * \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + * containing the expected output. Its policy must + * include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + * and the permitted algorithm must match the + * operation. The value of this key was likely + * computed by a previous call to + * psa_key_derivation_output_key() or + * psa_key_derivation_output_key_custom(). + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The output was read successfully, but if differs from the expected + * output. + * \retval #PSA_ERROR_INVALID_HANDLE + * The key passed as the expected value does not exist. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The key passed as the expected value has an invalid type. + * \retval #PSA_ERROR_NOT_PERMITTED + * The key passed as the expected value does not allow this usage or + * this algorithm; or one of the inputs was a key whose policy didn't + * allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + * \retval #PSA_ERROR_INSUFFICIENT_DATA + * The operation's capacity was less than + * the length of the expected value. In this case, + * the operation's capacity is set to 0, thus + * subsequent calls to this function will not + * succeed, even with a smaller expected output. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active and completed + * all required input steps), or the library has not been previously + * initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_verify_key( + psa_key_derivation_operation_t *operation, + psa_key_id_t expected); + +/** Abort a key derivation operation. + * + * Aborting an operation frees all associated resources except for the \c + * operation structure itself. Once aborted, the operation object can be reused + * for another operation by calling psa_key_derivation_setup() again. + * + * This function may be called at any time after the operation + * object has been initialized as described in #psa_key_derivation_operation_t. + * + * In particular, it is valid to call psa_key_derivation_abort() twice, or to + * call psa_key_derivation_abort() on an operation that has not been set up. + * + * \param[in,out] operation The operation to abort. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_key_derivation_abort( + psa_key_derivation_operation_t *operation); + +/** Perform a key agreement and return the raw shared secret. + * + * \warning The raw result of a key agreement algorithm such as finite-field + * Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + * not be used directly as key material. It should instead be passed as + * input to a key derivation algorithm. To chain a key agreement with + * a key derivation, use psa_key_derivation_key_agreement() and other + * functions from the key derivation interface. + * + * \param alg The key agreement algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + * is true). + * \param private_key Identifier of the private key to use. It must + * allow the usage #PSA_KEY_USAGE_DERIVE. + * \param[in] peer_key Public key of the peer. It must be + * in the same format that psa_import_key() + * accepts. The standard formats for public + * keys are documented in the documentation + * of psa_export_public_key(). + * \param peer_key_length Size of \p peer_key in bytes. + * \param[out] output Buffer where the decrypted message is to + * be written. + * \param output_size Size of the \c output buffer in bytes. + * \param[out] output_length On success, the number of bytes + * that make up the returned output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p alg is not a key agreement algorithm, or + * \p private_key is not compatible with \p alg, + * or \p peer_key is not valid for \p alg or not compatible with + * \p private_key. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * \p output_size is too small + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p alg is not a supported key agreement algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_raw_key_agreement(psa_algorithm_t alg, + mbedtls_svc_key_id_t private_key, + const uint8_t *peer_key, + size_t peer_key_length, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/**@}*/ + +/** \defgroup random Random generation + * @{ + */ + +/** + * \brief Generate random bytes. + * + * \warning This function **can** fail! Callers MUST check the return status + * and MUST NOT use the content of the output buffer if the return + * status is not #PSA_SUCCESS. + * + * \note To generate a key, use psa_generate_key() instead. + * + * \param[out] output Output buffer for the generated data. + * \param output_size Number of bytes to generate and output. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_generate_random(uint8_t *output, + size_t output_size); + +/** + * \brief Generate a key or key pair. + * + * The key is generated randomly. + * Its location, usage policy, type and size are taken from \p attributes. + * + * Implementations must reject an attempt to generate a key of size 0. + * + * The following type-specific considerations apply: + * - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + * the public exponent is 65537. + * The modulus is a product of two probabilistic primes + * between 2^{n-1} and 2^n where n is the bit size specified in the + * attributes. + * + * \note This function is equivalent to calling psa_generate_key_custom() + * with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + * and `custom_data_length == 0` (i.e. `custom_data` is empty). + * + * \param[in] attributes The attributes for the new key. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_generate_key(const psa_key_attributes_t *attributes, + mbedtls_svc_key_id_t *key); + +/** + * \brief Generate a key or key pair using custom production parameters. + * + * See the description of psa_generate_key() for the operation of this + * function with the default production parameters. In addition, this function + * supports the following production customizations, described in more detail + * in the documentation of ::psa_custom_key_parameters_t: + * + * - RSA keys: generation with a custom public exponent. + * + * \note This function is experimental and may change in future minor + * versions of Mbed TLS. + * + * \param[in] attributes The attributes for the new key. + * \param[in] custom Customization parameters for the key generation. + * When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + * with \p custom_data_length = 0, + * this function is equivalent to + * psa_generate_key(). + * \param[in] custom_data Variable-length data associated with \c custom. + * \param custom_data_length + * Length of `custom_data` in bytes. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_generate_key_custom(const psa_key_attributes_t *attributes, + const psa_custom_key_parameters_t *custom, + const uint8_t *custom_data, + size_t custom_data_length, + mbedtls_svc_key_id_t *key); + +#ifndef __cplusplus +/* Omitted when compiling in C++, because one of the parameters is a + * pointer to a struct with a flexible array member, and that is not + * standard C++. + * https://github.com/Mbed-TLS/mbedtls/issues/9020 + */ +/** + * \brief Generate a key or key pair using custom production parameters. + * + * \note + * This is a deprecated variant of psa_key_derivation_output_key_custom(). + * It is equivalent except that the associated variable-length data + * is passed in `params->data` instead of a separate parameter. + * This function will be removed in a future version of Mbed TLS. + * + * \param[in] attributes The attributes for the new key. + * \param[in] params Customization parameters for the key generation. + * When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + * with \p params_data_length = 0, + * this function is equivalent to + * psa_generate_key(). + * \param params_data_length + * Length of `params->data` in bytes. + * \param[out] key On success, an identifier for the newly created + * key. For persistent keys, this is the key + * identifier defined in \p attributes. + * \c 0 on failure. + * + * \retval #PSA_SUCCESS + * Success. + * If the key is persistent, the key material and the key's metadata + * have been saved to persistent storage. + * \retval #PSA_ERROR_ALREADY_EXISTS + * This is an attempt to create a persistent key, and there is + * already a persistent key with the given identifier. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes, + const psa_key_production_parameters_t *params, + size_t params_data_length, + mbedtls_svc_key_id_t *key); +#endif /* !__cplusplus */ + +/**@}*/ + +/** \defgroup interruptible_hash Interruptible sign/verify hash + * @{ + */ + +/** The type of the state data structure for interruptible hash + * signing operations. + * + * Before calling any function on a sign hash operation object, the + * application must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_sign_hash_interruptible_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_sign_hash_interruptible_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer + * #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: + * \code + * psa_sign_hash_interruptible_operation_t operation = + * PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; + * \endcode + * - Assign the result of the function + * psa_sign_hash_interruptible_operation_init() to the structure, for + * example: + * \code + * psa_sign_hash_interruptible_operation_t operation; + * operation = psa_sign_hash_interruptible_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_sign_hash_interruptible_operation_s psa_sign_hash_interruptible_operation_t; + +/** The type of the state data structure for interruptible hash + * verification operations. + * + * Before calling any function on a sign hash operation object, the + * application must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_verify_hash_interruptible_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_verify_hash_interruptible_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer + * #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: + * \code + * psa_verify_hash_interruptible_operation_t operation = + * PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; + * \endcode + * - Assign the result of the function + * psa_verify_hash_interruptible_operation_init() to the structure, for + * example: + * \code + * psa_verify_hash_interruptible_operation_t operation; + * operation = psa_verify_hash_interruptible_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_verify_hash_interruptible_operation_s psa_verify_hash_interruptible_operation_t; + +/** + * \brief Set the maximum number of ops allowed to be + * executed by an interruptible function in a + * single call. + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note The time taken to execute a single op is + * implementation specific and depends on + * software, hardware, the algorithm, key type and + * curve chosen. Even within a single operation, + * successive ops can take differing amounts of + * time. The only guarantee is that lower values + * for \p max_ops means functions will block for a + * lesser maximum amount of time. The functions + * \c psa_sign_interruptible_get_num_ops() and + * \c psa_verify_interruptible_get_num_ops() are + * provided to help with tuning this value. + * + * \note This value defaults to + * #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + * means the whole operation will be done in one + * go, regardless of the number of ops required. + * + * \note If more ops are needed to complete a + * computation, #PSA_OPERATION_INCOMPLETE will be + * returned by the function performing the + * computation. It is then the caller's + * responsibility to either call again with the + * same operation context until it returns 0 or an + * error code; or to call the relevant abort + * function if the answer is no longer required. + * + * \note The interpretation of \p max_ops is also + * implementation defined. On a hard real time + * system, this can indicate a hard deadline, as a + * real-time system needs a guarantee of not + * spending more than X time, however care must be + * taken in such an implementation to avoid the + * situation whereby calls just return, not being + * able to do any actual work within the allotted + * time. On a non-real-time system, the + * implementation can be more relaxed, but again + * whether this number should be interpreted as as + * hard or soft limit or even whether a less than + * or equals as regards to ops executed in a + * single call is implementation defined. + * + * \note For keys in local storage when no accelerator + * driver applies, please see also the + * documentation for \c mbedtls_ecp_set_max_ops(), + * which is the internal implementation in these + * cases. + * + * \warning With implementations that interpret this number + * as a hard limit, setting this number too small + * may result in an infinite loop, whereby each + * call results in immediate return with no ops + * done (as there is not enough time to execute + * any), and thus no result will ever be achieved. + * + * \note This only applies to functions whose + * documentation mentions they may return + * #PSA_OPERATION_INCOMPLETE. + * + * \param max_ops The maximum number of ops to be executed in a + * single call. This can be a number from 0 to + * #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + * is the least amount of work done per call. + */ +void psa_interruptible_set_max_ops(uint32_t max_ops); + +/** + * \brief Get the maximum number of ops allowed to be + * executed by an interruptible function in a + * single call. This will return the last + * value set by + * \c psa_interruptible_set_max_ops() or + * #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + * that function has never been called. + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \return Maximum number of ops allowed to be + * executed by an interruptible function in a + * single call. + */ +uint32_t psa_interruptible_get_max_ops(void); + +/** + * \brief Get the number of ops that a hash signing + * operation has taken so far. If the operation + * has completed, then this will represent the + * number of ops required for the entire + * operation. After initialization or calling + * \c psa_sign_hash_interruptible_abort() on + * the operation, a value of 0 will be returned. + * + * \note This interface is guaranteed re-entrant and + * thus may be called from driver code. + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * This is a helper provided to help you tune the + * value passed to \c + * psa_interruptible_set_max_ops(). + * + * \param operation The \c psa_sign_hash_interruptible_operation_t + * to use. This must be initialized first. + * + * \return Number of ops that the operation has taken so + * far. + */ +uint32_t psa_sign_hash_get_num_ops( + const psa_sign_hash_interruptible_operation_t *operation); + +/** + * \brief Get the number of ops that a hash verification + * operation has taken so far. If the operation + * has completed, then this will represent the + * number of ops required for the entire + * operation. After initialization or calling \c + * psa_verify_hash_interruptible_abort() on the + * operation, a value of 0 will be returned. + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * This is a helper provided to help you tune the + * value passed to \c + * psa_interruptible_set_max_ops(). + * + * \param operation The \c + * psa_verify_hash_interruptible_operation_t to + * use. This must be initialized first. + * + * \return Number of ops that the operation has taken so + * far. + */ +uint32_t psa_verify_hash_get_num_ops( + const psa_verify_hash_interruptible_operation_t *operation); + +/** + * \brief Start signing a hash or short message with a + * private key, in an interruptible manner. + * + * \see \c psa_sign_hash_complete() + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note This function combined with \c + * psa_sign_hash_complete() is equivalent to + * \c psa_sign_hash() but + * \c psa_sign_hash_complete() can return early and + * resume according to the limit set with \c + * psa_interruptible_set_max_ops() to reduce the + * maximum time spent in a function call. + * + * \note Users should call \c psa_sign_hash_complete() + * repeatedly on the same context after a + * successful call to this function until \c + * psa_sign_hash_complete() either returns 0 or an + * error. \c psa_sign_hash_complete() will return + * #PSA_OPERATION_INCOMPLETE if there is more work + * to do. Alternatively users can call + * \c psa_sign_hash_abort() at any point if they no + * longer want the result. + * + * \note If this function returns an error status, the + * operation enters an error state and must be + * aborted by calling \c psa_sign_hash_abort(). + * + * \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + * to use. This must be initialized first. + * + * \param key Identifier of the key to use for the operation. + * It must be an asymmetric key pair. The key must + * allow the usage #PSA_KEY_USAGE_SIGN_HASH. + * \param alg A signature algorithm (\c PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + * is true), that is compatible with + * the type of \p key. + * \param[in] hash The hash or message to sign. + * \param hash_length Size of the \p hash buffer in bytes. + * + * \retval #PSA_SUCCESS + * The operation started successfully - call \c psa_sign_hash_complete() + * with the same context to complete the operation + * + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + * not permit the requested algorithm. + * \retval #PSA_ERROR_BAD_STATE + * An operation has previously been started on this context, and is + * still in progress. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_sign_hash_start( + psa_sign_hash_interruptible_operation_t *operation, + mbedtls_svc_key_id_t key, psa_algorithm_t alg, + const uint8_t *hash, size_t hash_length); + +/** + * \brief Continue and eventually complete the action of + * signing a hash or short message with a private + * key, in an interruptible manner. + * + * \see \c psa_sign_hash_start() + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note This function combined with \c + * psa_sign_hash_start() is equivalent to + * \c psa_sign_hash() but this function can return + * early and resume according to the limit set with + * \c psa_interruptible_set_max_ops() to reduce the + * maximum time spent in a function call. + * + * \note Users should call this function on the same + * operation object repeatedly until it either + * returns 0 or an error. This function will return + * #PSA_OPERATION_INCOMPLETE if there is more work + * to do. Alternatively users can call + * \c psa_sign_hash_abort() at any point if they no + * longer want the result. + * + * \note When this function returns successfully, the + * operation becomes inactive. If this function + * returns an error status, the operation enters an + * error state and must be aborted by calling + * \c psa_sign_hash_abort(). + * + * \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + * to use. This must be initialized first, and have + * had \c psa_sign_hash_start() called with it + * first. + * + * \param[out] signature Buffer where the signature is to be written. + * \param signature_size Size of the \p signature buffer in bytes. This + * must be appropriate for the selected + * algorithm and key: + * - The required signature size is + * #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + * key_bits, \c alg) where \c key_type and \c + * key_bits are the type and bit-size + * respectively of key. + * - #PSA_SIGNATURE_MAX_SIZE evaluates to the + * maximum signature size of any supported + * signature algorithm. + * \param[out] signature_length On success, the number of bytes that make up + * the returned signature value. + * + * \retval #PSA_SUCCESS + * Operation completed successfully + * + * \retval #PSA_OPERATION_INCOMPLETE + * Operation was interrupted due to the setting of \c + * psa_interruptible_set_max_ops(). There is still work to be done. + * Call this function again with the same operation object. + * + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p signature buffer is too small. You can + * determine a sufficient buffer size by calling + * #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + * where \c key_type and \c key_bits are the type and bit-size + * respectively of \c key. + * + * \retval #PSA_ERROR_BAD_STATE + * An operation was not previously started on this context via + * \c psa_sign_hash_start(). + * + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has either not been previously initialized by + * psa_crypto_init() or you did not previously call + * psa_sign_hash_start() with this operation object. It is + * implementation-dependent whether a failure to initialize results in + * this error code. + */ +psa_status_t psa_sign_hash_complete( + psa_sign_hash_interruptible_operation_t *operation, + uint8_t *signature, size_t signature_size, + size_t *signature_length); + +/** + * \brief Abort a sign hash operation. + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note This function is the only function that clears + * the number of ops completed as part of the + * operation. Please ensure you copy this value via + * \c psa_sign_hash_get_num_ops() if required + * before calling. + * + * \note Aborting an operation frees all associated + * resources except for the \p operation structure + * itself. Once aborted, the operation object can + * be reused for another operation by calling \c + * psa_sign_hash_start() again. + * + * \note You may call this function any time after the + * operation object has been initialized. In + * particular, calling \c psa_sign_hash_abort() + * after the operation has already been terminated + * by a call to \c psa_sign_hash_abort() or + * psa_sign_hash_complete() is safe. + * + * \param[in,out] operation Initialized sign hash operation. + * + * \retval #PSA_SUCCESS + * The operation was aborted successfully. + * + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_sign_hash_abort( + psa_sign_hash_interruptible_operation_t *operation); + +/** + * \brief Start reading and verifying a hash or short + * message, in an interruptible manner. + * + * \see \c psa_verify_hash_complete() + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note This function combined with \c + * psa_verify_hash_complete() is equivalent to + * \c psa_verify_hash() but \c + * psa_verify_hash_complete() can return early and + * resume according to the limit set with \c + * psa_interruptible_set_max_ops() to reduce the + * maximum time spent in a function. + * + * \note Users should call \c psa_verify_hash_complete() + * repeatedly on the same operation object after a + * successful call to this function until \c + * psa_verify_hash_complete() either returns 0 or + * an error. \c psa_verify_hash_complete() will + * return #PSA_OPERATION_INCOMPLETE if there is + * more work to do. Alternatively users can call + * \c psa_verify_hash_abort() at any point if they + * no longer want the result. + * + * \note If this function returns an error status, the + * operation enters an error state and must be + * aborted by calling \c psa_verify_hash_abort(). + * + * \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + * to use. This must be initialized first. + * + * \param key Identifier of the key to use for the operation. + * The key must allow the usage + * #PSA_KEY_USAGE_VERIFY_HASH. + * \param alg A signature algorithm (\c PSA_ALG_XXX + * value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + * is true), that is compatible with + * the type of \p key. + * \param[in] hash The hash whose signature is to be verified. + * \param hash_length Size of the \p hash buffer in bytes. + * \param[in] signature Buffer containing the signature to verify. + * \param signature_length Size of the \p signature buffer in bytes. + * + * \retval #PSA_SUCCESS + * The operation started successfully - please call \c + * psa_verify_hash_complete() with the same context to complete the + * operation. + * + * \retval #PSA_ERROR_BAD_STATE + * Another operation has already been started on this context, and is + * still in progress. + * + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + * not permit the requested algorithm. + * + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_verify_hash_start( + psa_verify_hash_interruptible_operation_t *operation, + mbedtls_svc_key_id_t key, psa_algorithm_t alg, + const uint8_t *hash, size_t hash_length, + const uint8_t *signature, size_t signature_length); + +/** + * \brief Continue and eventually complete the action of + * reading and verifying a hash or short message + * signed with a private key, in an interruptible + * manner. + * + * \see \c psa_verify_hash_start() + * + * \warning This is a beta API, and thus subject to change + * at any point. It is not bound by the usual + * interface stability promises. + * + * \note This function combined with \c + * psa_verify_hash_start() is equivalent to + * \c psa_verify_hash() but this function can + * return early and resume according to the limit + * set with \c psa_interruptible_set_max_ops() to + * reduce the maximum time spent in a function + * call. + * + * \note Users should call this function on the same + * operation object repeatedly until it either + * returns 0 or an error. This function will return + * #PSA_OPERATION_INCOMPLETE if there is more work + * to do. Alternatively users can call + * \c psa_verify_hash_abort() at any point if they + * no longer want the result. + * + * \note When this function returns successfully, the + * operation becomes inactive. If this function + * returns an error status, the operation enters an + * error state and must be aborted by calling + * \c psa_verify_hash_abort(). + * + * \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + * to use. This must be initialized first, and have + * had \c psa_verify_hash_start() called with it + * first. + * + * \retval #PSA_SUCCESS + * Operation completed successfully, and the passed signature is valid. + * + * \retval #PSA_OPERATION_INCOMPLETE + * Operation was interrupted due to the setting of \c + * psa_interruptible_set_max_ops(). There is still work to be done. + * Call this function again with the same operation object. + * + * \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The calculation was performed successfully, but the passed + * signature is not a valid signature. + * \retval #PSA_ERROR_BAD_STATE + * An operation was not previously started on this context via + * \c psa_verify_hash_start(). + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has either not been previously initialized by + * psa_crypto_init() or you did not previously call + * psa_verify_hash_start() on this object. It is + * implementation-dependent whether a failure to initialize results in + * this error code. + */ +psa_status_t psa_verify_hash_complete( + psa_verify_hash_interruptible_operation_t *operation); + +/** + * \brief Abort a verify hash operation. + * + * \warning This is a beta API, and thus subject to change at + * any point. It is not bound by the usual interface + * stability promises. + * + * \note This function is the only function that clears the + * number of ops completed as part of the operation. + * Please ensure you copy this value via + * \c psa_verify_hash_get_num_ops() if required + * before calling. + * + * \note Aborting an operation frees all associated + * resources except for the operation structure + * itself. Once aborted, the operation object can be + * reused for another operation by calling \c + * psa_verify_hash_start() again. + * + * \note You may call this function any time after the + * operation object has been initialized. + * In particular, calling \c psa_verify_hash_abort() + * after the operation has already been terminated by + * a call to \c psa_verify_hash_abort() or + * psa_verify_hash_complete() is safe. + * + * \param[in,out] operation Initialized verify hash operation. + * + * \retval #PSA_SUCCESS + * The operation was aborted successfully. + * + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_verify_hash_abort( + psa_verify_hash_interruptible_operation_t *operation); + + +/**@}*/ + +#ifdef __cplusplus +} +#endif + +/* The file "crypto_extra.h" contains vendor-specific definitions. This + * can include vendor-defined algorithms, extra functions, etc. */ +#include "crypto_extra.h" + +#endif /* PSA_CRYPTO_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_auto_enabled.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_auto_enabled.h new file mode 100644 index 00000000..3a2af151 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_auto_enabled.h @@ -0,0 +1,31 @@ +/** + * \file psa/crypto_adjust_auto_enabled.h + * \brief Adjust PSA configuration: enable always-on features + * + * This is an internal header. Do not include it directly. + * + * Always enable certain features which require a negligible amount of code + * to implement, to avoid some edge cases in the configuration combinatorics. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_ADJUST_AUTO_ENABLED_H +#define PSA_CRYPTO_ADJUST_AUTO_ENABLED_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include psa/crypto_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +#define PSA_WANT_KEY_TYPE_DERIVE 1 +#define PSA_WANT_KEY_TYPE_PASSWORD 1 +#define PSA_WANT_KEY_TYPE_PASSWORD_HASH 1 +#define PSA_WANT_KEY_TYPE_RAW_DATA 1 + +#endif /* PSA_CRYPTO_ADJUST_AUTO_ENABLED_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_dependencies.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_dependencies.h new file mode 100644 index 00000000..92e9c4de --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_dependencies.h @@ -0,0 +1,51 @@ +/** + * \file psa/crypto_adjust_config_dependencies.h + * \brief Adjust PSA configuration by resolving some dependencies. + * + * This is an internal header. Do not include it directly. + * + * See docs/proposed/psa-conditional-inclusion-c.md. + * If the Mbed TLS implementation of a cryptographic mechanism A depends on a + * cryptographic mechanism B then if the cryptographic mechanism A is enabled + * and not accelerated enable B. Note that if A is enabled and accelerated, it + * is not necessary to enable B for A support. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H +#define PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include psa/crypto_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +#if (defined(PSA_WANT_ALG_TLS12_PRF) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF)) || \ + (defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS)) || \ + (defined(PSA_WANT_ALG_HKDF) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF)) || \ + (defined(PSA_WANT_ALG_HKDF_EXTRACT) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT)) || \ + (defined(PSA_WANT_ALG_HKDF_EXPAND) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND)) || \ + (defined(PSA_WANT_ALG_PBKDF2_HMAC) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC)) +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_KEY_TYPE_HMAC 1 +#endif + +#if (defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128)) +#define PSA_WANT_KEY_TYPE_AES 1 +#define PSA_WANT_ALG_CMAC 1 +#endif + +#endif /* PSA_CRYPTO_ADJUST_CONFIG_DEPENDENCIES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_key_pair_types.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_key_pair_types.h new file mode 100644 index 00000000..cec39e01 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_key_pair_types.h @@ -0,0 +1,101 @@ +/** + * \file psa/crypto_adjust_config_key_pair_types.h + * \brief Adjust PSA configuration for key pair types. + * + * This is an internal header. Do not include it directly. + * + * See docs/proposed/psa-conditional-inclusion-c.md. + * - Support non-basic operations in a keypair type implicitly enables basic + * support for that keypair type. + * - Support for a keypair type implicitly enables the corresponding public + * key type. + * - Basic support for a keypair type implicilty enables import/export support + * for that keypair type. Warning: this is implementation-specific (mainly + * for the benefit of testing) and may change in the future! + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_ADJUST_KEYPAIR_TYPES_H +#define PSA_CRYPTO_ADJUST_KEYPAIR_TYPES_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include psa/crypto_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/***************************************************************** + * ANYTHING -> BASIC + ****************************************************************/ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ + defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ + defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) || \ + defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) || \ + defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \ + defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) || \ + defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \ + defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ + defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) || \ + defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE) +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#endif + +/***************************************************************** + * BASIC -> corresponding PUBLIC + ****************************************************************/ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1 +#endif + +/***************************************************************** + * BASIC -> IMPORT+EXPORT + * + * (Implementation-specific, may change in the future.) + ****************************************************************/ + +/* Even though KEY_PAIR symbols' feature several level of support (BASIC, IMPORT, + * EXPORT, GENERATE, DERIVE) we're not planning to have support only for BASIC + * without IMPORT/EXPORT since these last 2 features are strongly used in tests. + * In general it is allowed to include more feature than what is strictly + * requested. + * As a consequence IMPORT and EXPORT features will be automatically enabled + * as soon as the BASIC one is. */ +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#endif + +#endif /* PSA_CRYPTO_ADJUST_KEYPAIR_TYPES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_synonyms.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_synonyms.h new file mode 100644 index 00000000..54b116f4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_adjust_config_synonyms.h @@ -0,0 +1,49 @@ +/** + * \file psa/crypto_adjust_config_synonyms.h + * \brief Adjust PSA configuration: enable quasi-synonyms + * + * This is an internal header. Do not include it directly. + * + * When two features require almost the same code, we automatically enable + * both when either one is requested, to reduce the combinatorics of + * possible configurations. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_ADJUST_CONFIG_SYNONYMS_H +#define PSA_CRYPTO_ADJUST_CONFIG_SYNONYMS_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include psa/crypto_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif /* */ + +/****************************************************************/ +/* De facto synonyms */ +/****************************************************************/ + +#if defined(PSA_WANT_ALG_ECDSA_ANY) && !defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA PSA_WANT_ALG_ECDSA_ANY +#elif !defined(PSA_WANT_ALG_ECDSA_ANY) && defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA_ANY PSA_WANT_ALG_ECDSA +#endif + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW +#elif !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW PSA_WANT_ALG_RSA_PKCS1V15_SIGN +#endif + +#if defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && !defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS PSA_WANT_ALG_RSA_PSS_ANY_SALT +#elif !defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS_ANY_SALT PSA_WANT_ALG_RSA_PSS +#endif + +#endif /* PSA_CRYPTO_ADJUST_CONFIG_SYNONYMS_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_composites.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_composites.h new file mode 100644 index 00000000..c14f5dd1 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_composites.h @@ -0,0 +1,214 @@ +/* + * Context structure declaration of the Mbed TLS software-based PSA drivers + * called through the PSA Crypto driver dispatch layer. + * This file contains the context structures of those algorithms which need to + * rely on other algorithms, i.e. are 'composite' algorithms. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the Mbed TLS software-based PSA drivers. The + * definitions of these objects are then used by crypto_struct.h to define the + * implementation-defined types of PSA multi-part state objects. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_BUILTIN_COMPOSITES_H +#define PSA_CRYPTO_BUILTIN_COMPOSITES_H +#include "mbedtls/private_access.h" + +#include + +#include "mbedtls/cmac.h" +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) +#include "mbedtls/gcm.h" +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) +#include "mbedtls/ccm.h" +#endif +#include "mbedtls/chachapoly.h" + +/* + * MAC multi-part operation definitions. + */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) +#define MBEDTLS_PSA_BUILTIN_MAC +#endif + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST) +typedef struct { + /** The HMAC algorithm in use */ + psa_algorithm_t MBEDTLS_PRIVATE(alg); + /** The hash context. */ + struct psa_hash_operation_s hash_ctx; + /** The HMAC part of the context. */ + uint8_t MBEDTLS_PRIVATE(opad)[PSA_HMAC_MAX_HASH_BLOCK_SIZE]; +} mbedtls_psa_hmac_operation_t; + +#define MBEDTLS_PSA_HMAC_OPERATION_INIT { 0, PSA_HASH_OPERATION_INIT, { 0 } } +#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ + +typedef struct { + psa_algorithm_t MBEDTLS_PRIVATE(alg); + union { + unsigned MBEDTLS_PRIVATE(dummy); /* Make the union non-empty even with no supported algorithms. */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_psa_hmac_operation_t MBEDTLS_PRIVATE(hmac); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_cipher_context_t MBEDTLS_PRIVATE(cmac); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ + } MBEDTLS_PRIVATE(ctx); +} mbedtls_psa_mac_operation_t; + +#define MBEDTLS_PSA_MAC_OPERATION_INIT { 0, { 0 } } + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) +#define MBEDTLS_PSA_BUILTIN_AEAD 1 +#endif + +/* Context structure for the Mbed TLS AEAD implementation. */ +typedef struct { + psa_algorithm_t MBEDTLS_PRIVATE(alg); + psa_key_type_t MBEDTLS_PRIVATE(key_type); + + unsigned int MBEDTLS_PRIVATE(is_encrypt) : 1; + + uint8_t MBEDTLS_PRIVATE(tag_length); + + union { + unsigned dummy; /* Enable easier initializing of the union. */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) + mbedtls_ccm_context MBEDTLS_PRIVATE(ccm); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) + mbedtls_gcm_context MBEDTLS_PRIVATE(gcm); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) + mbedtls_chachapoly_context MBEDTLS_PRIVATE(chachapoly); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ + + } ctx; + +} mbedtls_psa_aead_operation_t; + +#define MBEDTLS_PSA_AEAD_OPERATION_INIT { 0, 0, 0, 0, { 0 } } + +#include "mbedtls/ecdsa.h" + +/* Context structure for the Mbed TLS interruptible sign hash implementation. */ +typedef struct { +#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ + defined(MBEDTLS_ECP_RESTARTABLE) + mbedtls_ecdsa_context *MBEDTLS_PRIVATE(ctx); + mbedtls_ecdsa_restart_ctx MBEDTLS_PRIVATE(restart_ctx); + + uint32_t MBEDTLS_PRIVATE(num_ops); + + size_t MBEDTLS_PRIVATE(coordinate_bytes); + psa_algorithm_t MBEDTLS_PRIVATE(alg); + mbedtls_md_type_t MBEDTLS_PRIVATE(md_alg); + uint8_t MBEDTLS_PRIVATE(hash)[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; + size_t MBEDTLS_PRIVATE(hash_length); + +#else + /* Make the struct non-empty if algs not supported. */ + unsigned MBEDTLS_PRIVATE(dummy); + +#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || + * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && + * defined( MBEDTLS_ECP_RESTARTABLE ) */ +} mbedtls_psa_sign_hash_interruptible_operation_t; + +#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ + defined(MBEDTLS_ECP_RESTARTABLE) +#define MBEDTLS_PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { { 0 }, { 0 }, 0, 0, 0, 0, 0, 0 } +#else +#define MBEDTLS_PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } +#endif + +/* Context structure for the Mbed TLS interruptible verify hash + * implementation.*/ +typedef struct { +#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ + defined(MBEDTLS_ECP_RESTARTABLE) + + mbedtls_ecdsa_context *MBEDTLS_PRIVATE(ctx); + mbedtls_ecdsa_restart_ctx MBEDTLS_PRIVATE(restart_ctx); + + uint32_t MBEDTLS_PRIVATE(num_ops); + + uint8_t MBEDTLS_PRIVATE(hash)[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; + size_t MBEDTLS_PRIVATE(hash_length); + + mbedtls_mpi MBEDTLS_PRIVATE(r); + mbedtls_mpi MBEDTLS_PRIVATE(s); + +#else + /* Make the struct non-empty if algs not supported. */ + unsigned MBEDTLS_PRIVATE(dummy); + +#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || + * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && + * defined( MBEDTLS_ECP_RESTARTABLE ) */ + +} mbedtls_psa_verify_hash_interruptible_operation_t; + +#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ + defined(MBEDTLS_ECP_RESTARTABLE) +#define MBEDTLS_VERIFY_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { { 0 }, { 0 }, 0, 0, 0, 0, { 0 }, \ + { 0 } } +#else +#define MBEDTLS_VERIFY_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } +#endif + + +/* EC-JPAKE operation definitions */ + +#include "mbedtls/ecjpake.h" + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) +#define MBEDTLS_PSA_BUILTIN_PAKE 1 +#endif + +/* Note: the format for mbedtls_ecjpake_read/write function has an extra + * length byte for each step, plus an extra 3 bytes for ECParameters in the + * server's 2nd round. */ +#define MBEDTLS_PSA_JPAKE_BUFFER_SIZE ((3 + 1 + 65 + 1 + 65 + 1 + 32) * 2) + +typedef struct { + psa_algorithm_t MBEDTLS_PRIVATE(alg); + + uint8_t *MBEDTLS_PRIVATE(password); + size_t MBEDTLS_PRIVATE(password_len); +#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) + mbedtls_ecjpake_role MBEDTLS_PRIVATE(role); + uint8_t MBEDTLS_PRIVATE(buffer[MBEDTLS_PSA_JPAKE_BUFFER_SIZE]); + size_t MBEDTLS_PRIVATE(buffer_length); + size_t MBEDTLS_PRIVATE(buffer_offset); +#endif + /* Context structure for the Mbed TLS EC-JPAKE implementation. */ + union { + unsigned int MBEDTLS_PRIVATE(dummy); +#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) + mbedtls_ecjpake_context MBEDTLS_PRIVATE(jpake); +#endif + } MBEDTLS_PRIVATE(ctx); + +} mbedtls_psa_pake_operation_t; + +#define MBEDTLS_PSA_PAKE_OPERATION_INIT { { 0 } } + +#endif /* PSA_CRYPTO_BUILTIN_COMPOSITES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_key_derivation.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_key_derivation.h new file mode 100644 index 00000000..6b91ae73 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_key_derivation.h @@ -0,0 +1,118 @@ +/* + * Context structure declaration of the Mbed TLS software-based PSA drivers + * called through the PSA Crypto driver dispatch layer. + * This file contains the context structures of key derivation algorithms + * which need to rely on other algorithms. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the Mbed TLS software-based PSA drivers. The + * definitions of these objects are then used by crypto_struct.h to define the + * implementation-defined types of PSA multi-part state objects. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_BUILTIN_KEY_DERIVATION_H +#define PSA_CRYPTO_BUILTIN_KEY_DERIVATION_H +#include "mbedtls/private_access.h" + +#include + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) +typedef struct { + uint8_t *MBEDTLS_PRIVATE(info); + size_t MBEDTLS_PRIVATE(info_length); +#if PSA_HASH_MAX_SIZE > 0xff +#error "PSA_HASH_MAX_SIZE does not fit in uint8_t" +#endif + uint8_t MBEDTLS_PRIVATE(offset_in_block); + uint8_t MBEDTLS_PRIVATE(block_number); + unsigned int MBEDTLS_PRIVATE(state) : 2; + unsigned int MBEDTLS_PRIVATE(info_set) : 1; + uint8_t MBEDTLS_PRIVATE(output_block)[PSA_HASH_MAX_SIZE]; + uint8_t MBEDTLS_PRIVATE(prk)[PSA_HASH_MAX_SIZE]; + struct psa_mac_operation_s MBEDTLS_PRIVATE(hmac); +} psa_hkdf_key_derivation_t; +#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF || + MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT || + MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) +typedef struct { + uint8_t MBEDTLS_PRIVATE(data)[PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE]; +} psa_tls12_ecjpake_to_pms_t; +#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) +typedef enum { + PSA_TLS12_PRF_STATE_INIT, /* no input provided */ + PSA_TLS12_PRF_STATE_SEED_SET, /* seed has been set */ + PSA_TLS12_PRF_STATE_OTHER_KEY_SET, /* other key has been set - optional */ + PSA_TLS12_PRF_STATE_KEY_SET, /* key has been set */ + PSA_TLS12_PRF_STATE_LABEL_SET, /* label has been set */ + PSA_TLS12_PRF_STATE_OUTPUT /* output has been started */ +} psa_tls12_prf_key_derivation_state_t; + +typedef struct psa_tls12_prf_key_derivation_s { +#if PSA_HASH_MAX_SIZE > 0xff +#error "PSA_HASH_MAX_SIZE does not fit in uint8_t" +#endif + + /* Indicates how many bytes in the current HMAC block have + * not yet been read by the user. */ + uint8_t MBEDTLS_PRIVATE(left_in_block); + + /* The 1-based number of the block. */ + uint8_t MBEDTLS_PRIVATE(block_number); + + psa_tls12_prf_key_derivation_state_t MBEDTLS_PRIVATE(state); + + uint8_t *MBEDTLS_PRIVATE(secret); + size_t MBEDTLS_PRIVATE(secret_length); + uint8_t *MBEDTLS_PRIVATE(seed); + size_t MBEDTLS_PRIVATE(seed_length); + uint8_t *MBEDTLS_PRIVATE(label); + size_t MBEDTLS_PRIVATE(label_length); +#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) + uint8_t *MBEDTLS_PRIVATE(other_secret); + size_t MBEDTLS_PRIVATE(other_secret_length); +#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ + + uint8_t MBEDTLS_PRIVATE(Ai)[PSA_HASH_MAX_SIZE]; + + /* `HMAC_hash( prk, A( i ) + seed )` in the notation of RFC 5246, Sect. 5. */ + uint8_t MBEDTLS_PRIVATE(output_block)[PSA_HASH_MAX_SIZE]; +} psa_tls12_prf_key_derivation_t; +#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || + * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ +#if defined(PSA_HAVE_SOFT_PBKDF2) +typedef enum { + PSA_PBKDF2_STATE_INIT, /* no input provided */ + PSA_PBKDF2_STATE_INPUT_COST_SET, /* input cost has been set */ + PSA_PBKDF2_STATE_SALT_SET, /* salt has been set */ + PSA_PBKDF2_STATE_PASSWORD_SET, /* password has been set */ + PSA_PBKDF2_STATE_OUTPUT /* output has been started */ +} psa_pbkdf2_key_derivation_state_t; + +typedef struct { + psa_pbkdf2_key_derivation_state_t MBEDTLS_PRIVATE(state); + uint64_t MBEDTLS_PRIVATE(input_cost); + uint8_t *MBEDTLS_PRIVATE(salt); + size_t MBEDTLS_PRIVATE(salt_length); + uint8_t MBEDTLS_PRIVATE(password)[PSA_HMAC_MAX_HASH_BLOCK_SIZE]; + size_t MBEDTLS_PRIVATE(password_length); + uint8_t MBEDTLS_PRIVATE(output_block)[PSA_HASH_MAX_SIZE]; + uint8_t MBEDTLS_PRIVATE(bytes_used); + uint32_t MBEDTLS_PRIVATE(block_number); +} psa_pbkdf2_key_derivation_t; +#endif /* PSA_HAVE_SOFT_PBKDF2 */ + +#endif /* PSA_CRYPTO_BUILTIN_KEY_DERIVATION_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_primitives.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_primitives.h new file mode 100644 index 00000000..98ab4d33 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_builtin_primitives.h @@ -0,0 +1,114 @@ +/* + * Context structure declaration of the Mbed TLS software-based PSA drivers + * called through the PSA Crypto driver dispatch layer. + * This file contains the context structures of those algorithms which do not + * rely on other algorithms, i.e. are 'primitive' algorithms. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the Mbed TLS software-based PSA drivers. The + * definitions of these objects are then used by crypto_struct.h to define the + * implementation-defined types of PSA multi-part state objects. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_BUILTIN_PRIMITIVES_H +#define PSA_CRYPTO_BUILTIN_PRIMITIVES_H +#include "mbedtls/private_access.h" + +#include + +/* + * Hash multi-part operation definitions. + */ + +#include "mbedtls/md5.h" +#include "mbedtls/ripemd160.h" +#include "mbedtls/sha1.h" +#include "mbedtls/sha256.h" +#include "mbedtls/sha512.h" +#include "mbedtls/sha3.h" + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512) +#define MBEDTLS_PSA_BUILTIN_HASH +#endif + +typedef struct { + psa_algorithm_t MBEDTLS_PRIVATE(alg); + union { + unsigned dummy; /* Make the union non-empty even with no supported algorithms. */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) + mbedtls_md5_context md5; +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) + mbedtls_ripemd160_context ripemd160; +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) + mbedtls_sha1_context sha1; +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) + mbedtls_sha256_context sha256; +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) + mbedtls_sha512_context sha512; +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512) + mbedtls_sha3_context sha3; +#endif + } MBEDTLS_PRIVATE(ctx); +} mbedtls_psa_hash_operation_t; + +#define MBEDTLS_PSA_HASH_OPERATION_INIT { 0, { 0 } } + +/* + * Cipher multi-part operation definitions. + */ + +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CTR) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CFB) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_OFB) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG) +#define MBEDTLS_PSA_BUILTIN_CIPHER 1 +#endif + +typedef struct { + /* Context structure for the Mbed TLS cipher implementation. */ + psa_algorithm_t MBEDTLS_PRIVATE(alg); + uint8_t MBEDTLS_PRIVATE(iv_length); + uint8_t MBEDTLS_PRIVATE(block_length); + union { + unsigned int MBEDTLS_PRIVATE(dummy); + mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher); + } MBEDTLS_PRIVATE(ctx); +} mbedtls_psa_cipher_operation_t; + +#define MBEDTLS_PSA_CIPHER_OPERATION_INIT { 0, 0, 0, { 0 } } + +#endif /* PSA_CRYPTO_BUILTIN_PRIMITIVES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_compat.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_compat.h new file mode 100644 index 00000000..2a226c01 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_compat.h @@ -0,0 +1,230 @@ +/** + * \file psa/crypto_compat.h + * + * \brief PSA cryptography module: Backward compatibility aliases + * + * This header declares alternative names for macro and functions. + * New application code should not use these names. + * These names may be removed in a future version of Mbed TLS. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_COMPAT_H +#define PSA_CRYPTO_COMPAT_H + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * To support both openless APIs and psa_open_key() temporarily, define + * psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Do not mark the + * type and its utility macros and functions deprecated yet. This will be done + * in a subsequent phase. + */ +typedef mbedtls_svc_key_id_t psa_key_handle_t; + +#define PSA_KEY_HANDLE_INIT MBEDTLS_SVC_KEY_ID_INIT + +/** Check whether a handle is null. + * + * \param handle Handle + * + * \return Non-zero if the handle is null, zero otherwise. + */ +static inline int psa_key_handle_is_null(psa_key_handle_t handle) +{ + return mbedtls_svc_key_id_is_null(handle); +} + +/** Open a handle to an existing persistent key. + * + * Open a handle to a persistent key. A key is persistent if it was created + * with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + * always has a nonzero key identifier, set with psa_set_key_id() when + * creating the key. Implementations may provide additional pre-provisioned + * keys that can be opened with psa_open_key(). Such keys have an application + * key identifier in the vendor range, as documented in the description of + * #psa_key_id_t. + * + * The application must eventually close the handle with psa_close_key() or + * psa_destroy_key() to release associated resources. If the application dies + * without calling one of these functions, the implementation should perform + * the equivalent of a call to psa_close_key(). + * + * Some implementations permit an application to open the same key multiple + * times. If this is successful, each call to psa_open_key() will return a + * different key handle. + * + * \note This API is not part of the PSA Cryptography API Release 1.0.0 + * specification. It was defined in the 1.0 Beta 3 version of the + * specification but was removed in the 1.0.0 released version. This API is + * kept for the time being to not break applications relying on it. It is not + * deprecated yet but will be in the near future. + * + * \note Applications that rely on opening a key multiple times will not be + * portable to implementations that only permit a single key handle to be + * opened. See also :ref:\`key-handles\`. + * + * + * \param key The persistent identifier of the key. + * \param[out] handle On success, a handle to the key. + * + * \retval #PSA_SUCCESS + * Success. The application can now use the value of `*handle` + * to access the key. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY + * The implementation does not have sufficient resources to open the + * key. This can be due to reaching an implementation limit on the + * number of open keys, the number of open key handles, or available + * memory. + * \retval #PSA_ERROR_DOES_NOT_EXIST + * There is no persistent key with key identifier \p key. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p key is not a valid persistent key identifier. + * \retval #PSA_ERROR_NOT_PERMITTED + * The specified key exists, but the application does not have the + * permission to access it. Note that this specification does not + * define any way to create such a key, but it may be possible + * through implementation-specific means. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_open_key(mbedtls_svc_key_id_t key, + psa_key_handle_t *handle); + +/** Close a key handle. + * + * If the handle designates a volatile key, this will destroy the key material + * and free all associated resources, just like psa_destroy_key(). + * + * If this is the last open handle to a persistent key, then closing the handle + * will free all resources associated with the key in volatile memory. The key + * data in persistent storage is not affected and can be opened again later + * with a call to psa_open_key(). + * + * Closing the key handle makes the handle invalid, and the key handle + * must not be used again by the application. + * + * \note This API is not part of the PSA Cryptography API Release 1.0.0 + * specification. It was defined in the 1.0 Beta 3 version of the + * specification but was removed in the 1.0.0 released version. This API is + * kept for the time being to not break applications relying on it. It is not + * deprecated yet but will be in the near future. + * + * \note If the key handle was used to set up an active + * :ref:\`multipart operation \`, then closing the + * key handle can cause the multipart operation to fail. Applications should + * maintain the key handle until after the multipart operation has finished. + * + * \param handle The key handle to close. + * If this is \c 0, do nothing and return \c PSA_SUCCESS. + * + * \retval #PSA_SUCCESS + * \p handle was a valid handle or \c 0. It is now closed. + * \retval #PSA_ERROR_INVALID_HANDLE + * \p handle is not a valid handle nor \c 0. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_close_key(psa_key_handle_t handle); + +/** \addtogroup attributes + * @{ + */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +/** Custom Diffie-Hellman group. + * + * Mbed TLS does not support custom DH groups. + * + * \deprecated This value is not useful, so this macro will be removed in + * a future version of the library. + */ +#define PSA_DH_FAMILY_CUSTOM \ + ((psa_dh_family_t) MBEDTLS_DEPRECATED_NUMERIC_CONSTANT(0x7e)) + +/** + * \brief Set domain parameters for a key. + * + * \deprecated Mbed TLS no longer supports any domain parameters. + * This function only does the equivalent of + * psa_set_key_type() and will be removed in a future version + * of the library. + * + * \param[in,out] attributes Attribute structure where \p type will be set. + * \param type Key type (a \c PSA_KEY_TYPE_XXX value). + * \param[in] data Ignored. + * \param data_length Must be 0. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + */ +static inline psa_status_t MBEDTLS_DEPRECATED psa_set_key_domain_parameters( + psa_key_attributes_t *attributes, + psa_key_type_t type, const uint8_t *data, size_t data_length) +{ + (void) data; + if (data_length != 0) { + return PSA_ERROR_NOT_SUPPORTED; + } + psa_set_key_type(attributes, type); + return PSA_SUCCESS; +} + +/** + * \brief Get domain parameters for a key. + * + * \deprecated Mbed TLS no longer supports any domain parameters. + * This function alwaya has an empty output and will be + * removed in a future version of the library. + + * \param[in] attributes Ignored. + * \param[out] data Ignored. + * \param data_size Ignored. + * \param[out] data_length Set to 0. + * + * \retval #PSA_SUCCESS \emptydescription + */ +static inline psa_status_t MBEDTLS_DEPRECATED psa_get_key_domain_parameters( + const psa_key_attributes_t *attributes, + uint8_t *data, size_t data_size, size_t *data_length) +{ + (void) attributes; + (void) data; + (void) data_size; + *data_length = 0; + return PSA_SUCCESS; +} + +/** Safe output buffer size for psa_get_key_domain_parameters(). + * + */ +#define PSA_KEY_DOMAIN_PARAMETERS_SIZE(key_type, key_bits) \ + MBEDTLS_DEPRECATED_NUMERIC_CONSTANT(1u) +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/**@}*/ + +#ifdef __cplusplus +} +#endif + +#endif /* PSA_CRYPTO_COMPAT_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_config.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_config.h new file mode 100644 index 00000000..e0a8d606 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_config.h @@ -0,0 +1,145 @@ +/** + * \file psa/crypto_config.h + * \brief PSA crypto configuration options (set of defines) + * + */ +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +/** + * When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled in mbedtls_config.h, + * this file determines which cryptographic mechanisms are enabled + * through the PSA Cryptography API (\c psa_xxx() functions). + * + * To enable a cryptographic mechanism, uncomment the definition of + * the corresponding \c PSA_WANT_xxx preprocessor symbol. + * To disable a cryptographic mechanism, comment out the definition of + * the corresponding \c PSA_WANT_xxx preprocessor symbol. + * The names of cryptographic mechanisms correspond to values + * defined in psa/crypto_values.h, with the prefix \c PSA_WANT_ instead + * of \c PSA_. + * + * Note that many cryptographic mechanisms involve two symbols: one for + * the key type (\c PSA_WANT_KEY_TYPE_xxx) and one for the algorithm + * (\c PSA_WANT_ALG_xxx). Mechanisms with additional parameters may involve + * additional symbols. + */ +#else +/** + * When \c MBEDTLS_PSA_CRYPTO_CONFIG is disabled in mbedtls_config.h, + * this file is not used, and cryptographic mechanisms are supported + * through the PSA API if and only if they are supported through the + * mbedtls_xxx API. + */ +#endif +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_CONFIG_H +#define PSA_CRYPTO_CONFIG_H + +#define PSA_WANT_ALG_CBC_NO_PADDING 1 +#define PSA_WANT_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CCM 1 +#define PSA_WANT_ALG_CCM_STAR_NO_TAG 1 +#define PSA_WANT_ALG_CMAC 1 +#define PSA_WANT_ALG_CFB 1 +#define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define PSA_WANT_ALG_CTR 1 +#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 +#define PSA_WANT_ALG_ECB_NO_PADDING 1 +#define PSA_WANT_ALG_ECDH 1 +#define PSA_WANT_ALG_FFDH 1 +#define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_JPAKE 1 +#define PSA_WANT_ALG_GCM 1 +#define PSA_WANT_ALG_HKDF 1 +#define PSA_WANT_ALG_HKDF_EXTRACT 1 +#define PSA_WANT_ALG_HKDF_EXPAND 1 +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_ALG_MD5 1 +#define PSA_WANT_ALG_OFB 1 +#define PSA_WANT_ALG_PBKDF2_HMAC 1 +#define PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 1 +#define PSA_WANT_ALG_RIPEMD160 1 +#define PSA_WANT_ALG_RSA_OAEP 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PSS 1 +#define PSA_WANT_ALG_SHA_1 1 +#define PSA_WANT_ALG_SHA_224 1 +#define PSA_WANT_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_384 1 +#define PSA_WANT_ALG_SHA_512 1 +#define PSA_WANT_ALG_SHA3_224 1 +#define PSA_WANT_ALG_SHA3_256 1 +#define PSA_WANT_ALG_SHA3_384 1 +#define PSA_WANT_ALG_SHA3_512 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define PSA_WANT_ALG_TLS12_PRF 1 +#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 +#define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 + +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 +#define PSA_WANT_ECC_MONTGOMERY_255 1 +#define PSA_WANT_ECC_MONTGOMERY_448 1 +#define PSA_WANT_ECC_SECP_K1_192 1 +#define PSA_WANT_ECC_SECP_K1_256 1 +#define PSA_WANT_ECC_SECP_R1_192 1 +#define PSA_WANT_ECC_SECP_R1_224 1 +/* For secp256r1, consider enabling #MBEDTLS_PSA_P256M_DRIVER_ENABLED + * (see the description in mbedtls/mbedtls_config.h for details). */ +#define PSA_WANT_ECC_SECP_R1_256 1 +#define PSA_WANT_ECC_SECP_R1_384 1 +#define PSA_WANT_ECC_SECP_R1_521 1 + +#define PSA_WANT_DH_RFC7919_2048 1 +#define PSA_WANT_DH_RFC7919_3072 1 +#define PSA_WANT_DH_RFC7919_4096 1 +#define PSA_WANT_DH_RFC7919_6144 1 +#define PSA_WANT_DH_RFC7919_8192 1 + +#define PSA_WANT_KEY_TYPE_DERIVE 1 +#define PSA_WANT_KEY_TYPE_PASSWORD 1 +#define PSA_WANT_KEY_TYPE_PASSWORD_HASH 1 +#define PSA_WANT_KEY_TYPE_HMAC 1 +#define PSA_WANT_KEY_TYPE_AES 1 +#define PSA_WANT_KEY_TYPE_ARIA 1 +#define PSA_WANT_KEY_TYPE_CAMELLIA 1 +#define PSA_WANT_KEY_TYPE_CHACHA20 1 +#define PSA_WANT_KEY_TYPE_DES 1 +//#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 /* Deprecated */ +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_RAW_DATA 1 +//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 /* Deprecated */ +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 + +/* + * The following symbols extend and deprecate the legacy + * PSA_WANT_KEY_TYPE_xxx_KEY_PAIR ones. They include the usage of that key in + * the name's suffix. "_USE" is the most generic and it can be used to describe + * a generic suport, whereas other ones add more features on top of that and + * they are more specific. + */ +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 + +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE 1 /* Not supported */ + +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 +//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE 1 /* Not supported */ + +#endif /* PSA_CRYPTO_CONFIG_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_common.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_common.h new file mode 100644 index 00000000..cc11d3b9 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_common.h @@ -0,0 +1,44 @@ +/** + * \file psa/crypto_driver_common.h + * \brief Definitions for all PSA crypto drivers + * + * This file contains common definitions shared by all PSA crypto drivers. + * Do not include it directly: instead, include the header file(s) for + * the type(s) of driver that you are implementing. For example, if + * you are writing a dynamically registered driver for a secure element, + * include `psa/crypto_se_driver.h`. + * + * This file is part of the PSA Crypto Driver Model, containing functions for + * driver developers to implement to enable hardware to be called in a + * standardized way by a PSA Cryptographic API implementation. The functions + * comprising the driver model, which driver authors implement, are not + * intended to be called by application developers. + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef PSA_CRYPTO_DRIVER_COMMON_H +#define PSA_CRYPTO_DRIVER_COMMON_H + +#include +#include + +/* Include type definitions (psa_status_t, psa_algorithm_t, + * psa_key_type_t, etc.) and macros to build and analyze values + * of these types. */ +#include "crypto_types.h" +#include "crypto_values.h" +/* Include size definitions which are used to size some arrays in operation + * structures. */ +#include + +/** For encrypt-decrypt functions, whether the operation is an encryption + * or a decryption. */ +typedef enum { + PSA_CRYPTO_DRIVER_DECRYPT, + PSA_CRYPTO_DRIVER_ENCRYPT +} psa_encrypt_or_decrypt_t; + +#endif /* PSA_CRYPTO_DRIVER_COMMON_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_composites.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_composites.h new file mode 100644 index 00000000..d717c519 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_composites.h @@ -0,0 +1,151 @@ +/* + * Declaration of context structures for use with the PSA driver wrapper + * interface. This file contains the context structures for 'composite' + * operations, i.e. those operations which need to make use of other operations + * from the primitives (crypto_driver_contexts_primitives.h) + * + * Warning: This file will be auto-generated in the future. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the PSA drivers included in the cryptographic + * library. The definitions of these objects are then used by crypto_struct.h + * to define the implementation-defined types of PSA multi-part state objects. + */ +/* Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H +#define PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H + +#include "psa/crypto_driver_common.h" + +/* Include the context structure definitions for the Mbed TLS software drivers */ +#include "psa/crypto_builtin_composites.h" + +/* Include the context structure definitions for those drivers that were + * declared during the autogeneration process. */ + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) +#include +#endif + +#if defined(PSA_CRYPTO_DRIVER_TEST) +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ + defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_MAC) +typedef libtestdriver1_mbedtls_psa_mac_operation_t + mbedtls_transparent_test_driver_mac_operation_t; +typedef libtestdriver1_mbedtls_psa_mac_operation_t + mbedtls_opaque_test_driver_mac_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT +#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT + +#else +typedef mbedtls_psa_mac_operation_t + mbedtls_transparent_test_driver_mac_operation_t; +typedef mbedtls_psa_mac_operation_t + mbedtls_opaque_test_driver_mac_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \ + MBEDTLS_PSA_MAC_OPERATION_INIT +#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \ + MBEDTLS_PSA_MAC_OPERATION_INIT + +#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_MAC */ + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ + defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_AEAD) +typedef libtestdriver1_mbedtls_psa_aead_operation_t + mbedtls_transparent_test_driver_aead_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_AEAD_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_AEAD_OPERATION_INIT +#else +typedef mbedtls_psa_aead_operation_t + mbedtls_transparent_test_driver_aead_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_AEAD_OPERATION_INIT \ + MBEDTLS_PSA_AEAD_OPERATION_INIT + +#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_AEAD */ + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ + defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_PAKE) + +typedef libtestdriver1_mbedtls_psa_pake_operation_t + mbedtls_transparent_test_driver_pake_operation_t; +typedef libtestdriver1_mbedtls_psa_pake_operation_t + mbedtls_opaque_test_driver_pake_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_PAKE_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_PAKE_OPERATION_INIT +#define MBEDTLS_OPAQUE_TEST_DRIVER_PAKE_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_PAKE_OPERATION_INIT + +#else +typedef mbedtls_psa_pake_operation_t + mbedtls_transparent_test_driver_pake_operation_t; +typedef mbedtls_psa_pake_operation_t + mbedtls_opaque_test_driver_pake_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_PAKE_OPERATION_INIT \ + MBEDTLS_PSA_PAKE_OPERATION_INIT +#define MBEDTLS_OPAQUE_TEST_DRIVER_PAKE_OPERATION_INIT \ + MBEDTLS_PSA_PAKE_OPERATION_INIT + +#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_PAKE */ + +#endif /* PSA_CRYPTO_DRIVER_TEST */ + +/* Define the context to be used for an operation that is executed through the + * PSA Driver wrapper layer as the union of all possible driver's contexts. + * + * The union members are the driver's context structures, and the member names + * are formatted as `'drivername'_ctx`. This allows for procedural generation + * of both this file and the content of psa_crypto_driver_wrappers.h */ + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_mac_operation_t mbedtls_ctx; +#if defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_transparent_test_driver_mac_operation_t transparent_test_driver_ctx; + mbedtls_opaque_test_driver_mac_operation_t opaque_test_driver_ctx; +#endif +} psa_driver_mac_context_t; + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_aead_operation_t mbedtls_ctx; +#if defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_transparent_test_driver_aead_operation_t transparent_test_driver_ctx; +#endif +} psa_driver_aead_context_t; + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_sign_hash_interruptible_operation_t mbedtls_ctx; +} psa_driver_sign_hash_interruptible_context_t; + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_verify_hash_interruptible_operation_t mbedtls_ctx; +} psa_driver_verify_hash_interruptible_context_t; + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_pake_operation_t mbedtls_ctx; +#if defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_transparent_test_driver_pake_operation_t transparent_test_driver_ctx; + mbedtls_opaque_test_driver_pake_operation_t opaque_test_driver_ctx; +#endif +} psa_driver_pake_context_t; + +#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H */ +/* End of automatically generated file. */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_key_derivation.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_key_derivation.h new file mode 100644 index 00000000..21190515 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_key_derivation.h @@ -0,0 +1,52 @@ +/* + * Declaration of context structures for use with the PSA driver wrapper + * interface. This file contains the context structures for key derivation + * operations. + * + * Warning: This file will be auto-generated in the future. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the PSA drivers included in the cryptographic + * library. The definitions of these objects are then used by crypto_struct.h + * to define the implementation-defined types of PSA multi-part state objects. + */ +/* Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_KEY_DERIVATION_H +#define PSA_CRYPTO_DRIVER_CONTEXTS_KEY_DERIVATION_H + +#include "psa/crypto_driver_common.h" + +/* Include the context structure definitions for the Mbed TLS software drivers */ +#include "psa/crypto_builtin_key_derivation.h" + +/* Include the context structure definitions for those drivers that were + * declared during the autogeneration process. */ + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) + psa_hkdf_key_derivation_t MBEDTLS_PRIVATE(hkdf); +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) + psa_tls12_prf_key_derivation_t MBEDTLS_PRIVATE(tls12_prf); +#endif +#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) + psa_tls12_ecjpake_to_pms_t MBEDTLS_PRIVATE(tls12_ecjpake_to_pms); +#endif +#if defined(PSA_HAVE_SOFT_PBKDF2) + psa_pbkdf2_key_derivation_t MBEDTLS_PRIVATE(pbkdf2); +#endif +} psa_driver_key_derivation_context_t; + +#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_KEY_DERIVATION_H */ +/* End of automatically generated file. */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_primitives.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_primitives.h new file mode 100644 index 00000000..c90a5fbe --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_driver_contexts_primitives.h @@ -0,0 +1,105 @@ +/* + * Declaration of context structures for use with the PSA driver wrapper + * interface. This file contains the context structures for 'primitive' + * operations, i.e. those operations which do not rely on other contexts. + * + * Warning: This file will be auto-generated in the future. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * \note This header and its content are not part of the Mbed TLS API and + * applications must not depend on it. Its main purpose is to define the + * multi-part state objects of the PSA drivers included in the cryptographic + * library. The definitions of these objects are then used by crypto_struct.h + * to define the implementation-defined types of PSA multi-part state objects. + */ +/* Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H +#define PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H + +#include "psa/crypto_driver_common.h" + +/* Include the context structure definitions for the Mbed TLS software drivers */ +#include "psa/crypto_builtin_primitives.h" + +/* Include the context structure definitions for those drivers that were + * declared during the autogeneration process. */ + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) +#include +#endif + +#if defined(PSA_CRYPTO_DRIVER_TEST) + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ + defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER) +typedef libtestdriver1_mbedtls_psa_cipher_operation_t + mbedtls_transparent_test_driver_cipher_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_CIPHER_OPERATION_INIT +#else +typedef mbedtls_psa_cipher_operation_t + mbedtls_transparent_test_driver_cipher_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \ + MBEDTLS_PSA_CIPHER_OPERATION_INIT +#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && + LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER */ + +#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ + defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH) +typedef libtestdriver1_mbedtls_psa_hash_operation_t + mbedtls_transparent_test_driver_hash_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \ + LIBTESTDRIVER1_MBEDTLS_PSA_HASH_OPERATION_INIT +#else +typedef mbedtls_psa_hash_operation_t + mbedtls_transparent_test_driver_hash_operation_t; + +#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \ + MBEDTLS_PSA_HASH_OPERATION_INIT +#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && + LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH */ + +typedef struct { + unsigned int initialised : 1; + mbedtls_transparent_test_driver_cipher_operation_t ctx; +} mbedtls_opaque_test_driver_cipher_operation_t; + +#define MBEDTLS_OPAQUE_TEST_DRIVER_CIPHER_OPERATION_INIT \ + { 0, MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT } + +#endif /* PSA_CRYPTO_DRIVER_TEST */ + +/* Define the context to be used for an operation that is executed through the + * PSA Driver wrapper layer as the union of all possible driver's contexts. + * + * The union members are the driver's context structures, and the member names + * are formatted as `'drivername'_ctx`. This allows for procedural generation + * of both this file and the content of psa_crypto_driver_wrappers.h */ + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_hash_operation_t mbedtls_ctx; +#if defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_transparent_test_driver_hash_operation_t test_driver_ctx; +#endif +} psa_driver_hash_context_t; + +typedef union { + unsigned dummy; /* Make sure this union is always non-empty */ + mbedtls_psa_cipher_operation_t mbedtls_ctx; +#if defined(PSA_CRYPTO_DRIVER_TEST) + mbedtls_transparent_test_driver_cipher_operation_t transparent_test_driver_ctx; + mbedtls_opaque_test_driver_cipher_operation_t opaque_test_driver_ctx; +#endif +} psa_driver_cipher_context_t; + +#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H */ +/* End of automatically generated file. */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_extra.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_extra.h new file mode 100644 index 00000000..03566305 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_extra.h @@ -0,0 +1,2145 @@ +/** + * \file psa/crypto_extra.h + * + * \brief PSA cryptography module: Mbed TLS vendor extensions + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * This file is reserved for vendor-specific definitions. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_EXTRA_H +#define PSA_CRYPTO_EXTRA_H +#include "mbedtls/private_access.h" + +#include "crypto_types.h" +#include "crypto_compat.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* UID for secure storage seed */ +#define PSA_CRYPTO_ITS_RANDOM_SEED_UID 0xFFFFFF52 + +/* See mbedtls_config.h for definition */ +#if !defined(MBEDTLS_PSA_KEY_SLOT_COUNT) +#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 +#endif + +/* If the size of static key slots is not explicitly defined by the user, then + * try to guess it based on some of the most common the key types enabled in the build. + * See mbedtls_config.h for the definition of MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE. */ +#if !defined(MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE) + +#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 1 + +#if PSA_EXPORT_ASYMMETRIC_KEY_MAX_SIZE > MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#undef MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE PSA_EXPORT_ASYMMETRIC_KEY_MAX_SIZE +#endif + +/* This covers ciphers, AEADs and CMAC. */ +#if PSA_CIPHER_MAX_KEY_LENGTH > MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#undef MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE PSA_CIPHER_MAX_KEY_LENGTH +#endif + +/* For HMAC, it's typical but not mandatory to use a key size that is equal to + * the hash size. */ +#if defined(PSA_WANT_ALG_HMAC) +#if PSA_HASH_MAX_SIZE > MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#undef MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE PSA_HASH_MAX_SIZE +#endif +#endif /* PSA_WANT_ALG_HMAC */ + +#endif /* !MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE*/ + +/** \addtogroup attributes + * @{ + */ + +/** \brief Declare the enrollment algorithm for a key. + * + * An operation on a key may indifferently use the algorithm set with + * psa_set_key_algorithm() or with this function. + * + * \param[out] attributes The attribute structure to write to. + * \param alg2 A second algorithm that the key may be used + * for, in addition to the algorithm set with + * psa_set_key_algorithm(). + * + * \warning Setting an enrollment algorithm is not recommended, because + * using the same key with different algorithms can allow some + * attacks based on arithmetic relations between different + * computations made with the same key, or can escalate harmless + * side channels into exploitable ones. Use this function only + * if it is necessary to support a protocol for which it has been + * verified that the usage of the key with multiple algorithms + * is safe. + */ +static inline void psa_set_key_enrollment_algorithm( + psa_key_attributes_t *attributes, + psa_algorithm_t alg2) +{ + attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(alg2) = alg2; +} + +/** Retrieve the enrollment algorithm policy from key attributes. + * + * \param[in] attributes The key attribute structure to query. + * + * \return The enrollment algorithm stored in the attribute structure. + */ +static inline psa_algorithm_t psa_get_key_enrollment_algorithm( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(alg2); +} + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) + +/** Retrieve the slot number where a key is stored. + * + * A slot number is only defined for keys that are stored in a secure + * element. + * + * This information is only useful if the secure element is not entirely + * managed through the PSA Cryptography API. It is up to the secure + * element driver to decide how PSA slot numbers map to any other interface + * that the secure element may have. + * + * \param[in] attributes The key attribute structure to query. + * \param[out] slot_number On success, the slot number containing the key. + * + * \retval #PSA_SUCCESS + * The key is located in a secure element, and \p *slot_number + * indicates the slot number that contains it. + * \retval #PSA_ERROR_NOT_PERMITTED + * The caller is not permitted to query the slot number. + * Mbed TLS currently does not return this error. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The key is not located in a secure element. + */ +psa_status_t psa_get_key_slot_number( + const psa_key_attributes_t *attributes, + psa_key_slot_number_t *slot_number); + +/** Choose the slot number where a key is stored. + * + * This function declares a slot number in the specified attribute + * structure. + * + * A slot number is only meaningful for keys that are stored in a secure + * element. It is up to the secure element driver to decide how PSA slot + * numbers map to any other interface that the secure element may have. + * + * \note Setting a slot number in key attributes for a key creation can + * cause the following errors when creating the key: + * - #PSA_ERROR_NOT_SUPPORTED if the selected secure element does + * not support choosing a specific slot number. + * - #PSA_ERROR_NOT_PERMITTED if the caller is not permitted to + * choose slot numbers in general or to choose this specific slot. + * - #PSA_ERROR_INVALID_ARGUMENT if the chosen slot number is not + * valid in general or not valid for this specific key. + * - #PSA_ERROR_ALREADY_EXISTS if there is already a key in the + * selected slot. + * + * \param[out] attributes The attribute structure to write to. + * \param slot_number The slot number to set. + */ +static inline void psa_set_key_slot_number( + psa_key_attributes_t *attributes, + psa_key_slot_number_t slot_number) +{ + attributes->MBEDTLS_PRIVATE(has_slot_number) = 1; + attributes->MBEDTLS_PRIVATE(slot_number) = slot_number; +} + +/** Remove the slot number attribute from a key attribute structure. + * + * This function undoes the action of psa_set_key_slot_number(). + * + * \param[out] attributes The attribute structure to write to. + */ +static inline void psa_clear_key_slot_number( + psa_key_attributes_t *attributes) +{ + attributes->MBEDTLS_PRIVATE(has_slot_number) = 0; +} + +/** Register a key that is already present in a secure element. + * + * The key must be located in a secure element designated by the + * lifetime field in \p attributes, in the slot set with + * psa_set_key_slot_number() in the attribute structure. + * This function makes the key available through the key identifier + * specified in \p attributes. + * + * \param[in] attributes The attributes of the existing key. + * - The lifetime must be a persistent lifetime + * in a secure element. Volatile lifetimes are + * not currently supported. + * - The key identifier must be in the valid + * range for persistent keys. + * - The key type and size must be specified and + * must be consistent with the key material + * in the secure element. + * + * \retval #PSA_SUCCESS + * The key was successfully registered. + * Note that depending on the design of the driver, this may or may + * not guarantee that a key actually exists in the designated slot + * and is compatible with the specified attributes. + * \retval #PSA_ERROR_ALREADY_EXISTS + * There is already a key with the identifier specified in + * \p attributes. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The secure element driver for the specified lifetime does not + * support registering a key. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The identifier in \p attributes is invalid, namely the identifier is + * not in the user range, or + * \p attributes specifies a lifetime which is not located + * in a secure element, or no slot number is specified in \p attributes, + * or the specified slot number is not valid. + * \retval #PSA_ERROR_NOT_PERMITTED + * The caller is not authorized to register the specified key slot. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t mbedtls_psa_register_se_key( + const psa_key_attributes_t *attributes); + +#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ + +/**@}*/ + +/** + * \brief Library deinitialization. + * + * This function clears all data associated with the PSA layer, + * including the whole key store. + * This function is not thread safe, it wipes every key slot regardless of + * state and reader count. It should only be called when no slot is in use. + * + * This is an Mbed TLS extension. + */ +void mbedtls_psa_crypto_free(void); + +/** \brief Statistics about + * resource consumption related to the PSA keystore. + * + * \note The content of this structure is not part of the stable API and ABI + * of Mbed TLS and may change arbitrarily from version to version. + */ +typedef struct mbedtls_psa_stats_s { + /** Number of slots containing key material for a volatile key. */ + size_t MBEDTLS_PRIVATE(volatile_slots); + /** Number of slots containing key material for a key which is in + * internal persistent storage. */ + size_t MBEDTLS_PRIVATE(persistent_slots); + /** Number of slots containing a reference to a key in a + * secure element. */ + size_t MBEDTLS_PRIVATE(external_slots); + /** Number of slots which are occupied, but do not contain + * key material yet. */ + size_t MBEDTLS_PRIVATE(half_filled_slots); + /** Number of slots that contain cache data. */ + size_t MBEDTLS_PRIVATE(cache_slots); + /** Number of slots that are not used for anything. */ + size_t MBEDTLS_PRIVATE(empty_slots); + /** Number of slots that are locked. */ + size_t MBEDTLS_PRIVATE(locked_slots); + /** Largest key id value among open keys in internal persistent storage. */ + psa_key_id_t MBEDTLS_PRIVATE(max_open_internal_key_id); + /** Largest key id value among open keys in secure elements. */ + psa_key_id_t MBEDTLS_PRIVATE(max_open_external_key_id); +} mbedtls_psa_stats_t; + +/** \brief Get statistics about + * resource consumption related to the PSA keystore. + * + * \note When Mbed TLS is built as part of a service, with isolation + * between the application and the keystore, the service may or + * may not expose this function. + */ +void mbedtls_psa_get_stats(mbedtls_psa_stats_t *stats); + +/** + * \brief Inject an initial entropy seed for the random generator into + * secure storage. + * + * This function injects data to be used as a seed for the random generator + * used by the PSA Crypto implementation. On devices that lack a trusted + * entropy source (preferably a hardware random number generator), + * the Mbed PSA Crypto implementation uses this value to seed its + * random generator. + * + * On devices without a trusted entropy source, this function must be + * called exactly once in the lifetime of the device. On devices with + * a trusted entropy source, calling this function is optional. + * In all cases, this function may only be called before calling any + * other function in the PSA Crypto API, including psa_crypto_init(). + * + * When this function returns successfully, it populates a file in + * persistent storage. Once the file has been created, this function + * can no longer succeed. + * + * If any error occurs, this function does not change the system state. + * You can call this function again after correcting the reason for the + * error if possible. + * + * \warning This function **can** fail! Callers MUST check the return status. + * + * \warning If you use this function, you should use it as part of a + * factory provisioning process. The value of the injected seed + * is critical to the security of the device. It must be + * *secret*, *unpredictable* and (statistically) *unique per device*. + * You should be generate it randomly using a cryptographically + * secure random generator seeded from trusted entropy sources. + * You should transmit it securely to the device and ensure + * that its value is not leaked or stored anywhere beyond the + * needs of transmitting it from the point of generation to + * the call of this function, and erase all copies of the value + * once this function returns. + * + * This is an Mbed TLS extension. + * + * \note This function is only available on the following platforms: + * * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + * Note that you must provide compatible implementations of + * mbedtls_nv_seed_read and mbedtls_nv_seed_write. + * * In a client-server integration of PSA Cryptography, on the client side, + * if the server supports this feature. + * \param[in] seed Buffer containing the seed value to inject. + * \param[in] seed_size Size of the \p seed buffer. + * The size of the seed in bytes must be greater + * or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + * and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + * in `library/entropy_poll.h` in the Mbed TLS source + * code. + * It must be less or equal to + * #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + * + * \retval #PSA_SUCCESS + * The seed value was injected successfully. The random generator + * of the PSA Crypto implementation is now ready for use. + * You may now call psa_crypto_init() and use the PSA Crypto + * implementation. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p seed_size is out of range. + * \retval #PSA_ERROR_STORAGE_FAILURE + * There was a failure reading or writing from storage. + * \retval #PSA_ERROR_NOT_PERMITTED + * The library has already been initialized. It is no longer + * possible to call this function. + */ +psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed, + size_t seed_size); + +/** \addtogroup crypto_types + * @{ + */ + +/** DSA public key. + * + * The import and export format is the + * representation of the public key `y = g^x mod p` as a big-endian byte + * string. The length of the byte string is the length of the base prime `p` + * in bytes. + */ +#define PSA_KEY_TYPE_DSA_PUBLIC_KEY ((psa_key_type_t) 0x4002) + +/** DSA key pair (private and public key). + * + * The import and export format is the + * representation of the private key `x` as a big-endian byte string. The + * length of the byte string is the private key size in bytes (leading zeroes + * are not stripped). + * + * Deterministic DSA key derivation with psa_generate_derived_key follows + * FIPS 186-4 §B.1.2: interpret the byte string as integer + * in big-endian order. Discard it if it is not in the range + * [0, *N* - 2] where *N* is the boundary of the private key domain + * (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + * or the order of the curve's base point for ECC). + * Add 1 to the resulting integer and use this as the private key *x*. + * + */ +#define PSA_KEY_TYPE_DSA_KEY_PAIR ((psa_key_type_t) 0x7002) + +/** Whether a key type is a DSA key (pair or public-only). */ +#define PSA_KEY_TYPE_IS_DSA(type) \ + (PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) == PSA_KEY_TYPE_DSA_PUBLIC_KEY) + +#define PSA_ALG_DSA_BASE ((psa_algorithm_t) 0x06000400) +/** DSA signature with hashing. + * + * This is the signature scheme defined by FIPS 186-4, + * with a random per-message secret number (*k*). + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding DSA signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_DSA(hash_alg) \ + (PSA_ALG_DSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +#define PSA_ALG_DETERMINISTIC_DSA_BASE ((psa_algorithm_t) 0x06000500) +#define PSA_ALG_DSA_DETERMINISTIC_FLAG PSA_ALG_ECDSA_DETERMINISTIC_FLAG +/** Deterministic DSA signature with hashing. + * + * This is the deterministic variant defined by RFC 6979 of + * the signature scheme defined by FIPS 186-4. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding DSA signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_DETERMINISTIC_DSA(hash_alg) \ + (PSA_ALG_DETERMINISTIC_DSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +#define PSA_ALG_IS_DSA(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK & ~PSA_ALG_DSA_DETERMINISTIC_FLAG) == \ + PSA_ALG_DSA_BASE) +#define PSA_ALG_DSA_IS_DETERMINISTIC(alg) \ + (((alg) & PSA_ALG_DSA_DETERMINISTIC_FLAG) != 0) +#define PSA_ALG_IS_DETERMINISTIC_DSA(alg) \ + (PSA_ALG_IS_DSA(alg) && PSA_ALG_DSA_IS_DETERMINISTIC(alg)) +#define PSA_ALG_IS_RANDOMIZED_DSA(alg) \ + (PSA_ALG_IS_DSA(alg) && !PSA_ALG_DSA_IS_DETERMINISTIC(alg)) + + +/* We need to expand the sample definition of this macro from + * the API definition. */ +#undef PSA_ALG_IS_VENDOR_HASH_AND_SIGN +#define PSA_ALG_IS_VENDOR_HASH_AND_SIGN(alg) \ + PSA_ALG_IS_DSA(alg) + +/**@}*/ + +/** \addtogroup attributes + * @{ + */ + +/** PAKE operation stages. */ +#define PSA_PAKE_OPERATION_STAGE_SETUP 0 +#define PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS 1 +#define PSA_PAKE_OPERATION_STAGE_COMPUTATION 2 + +/**@}*/ + + +/** \defgroup psa_rng Random generator + * @{ + */ + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +/** External random generator function, implemented by the platform. + * + * When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + * this function replaces Mbed TLS's entropy and DRBG modules for all + * random generation triggered via PSA crypto interfaces. + * + * \note This random generator must deliver random numbers with cryptographic + * quality and high performance. It must supply unpredictable numbers + * with a uniform distribution. The implementation of this function + * is responsible for ensuring that the random generator is seeded + * with sufficient entropy. If you have a hardware TRNG which is slow + * or delivers non-uniform output, declare it as an entropy source + * with mbedtls_entropy_add_source() instead of enabling this option. + * + * \param[in,out] context Pointer to the random generator context. + * This is all-bits-zero on the first call + * and preserved between successive calls. + * \param[out] output Output buffer. On success, this buffer + * contains random data with a uniform + * distribution. + * \param output_size The size of the \p output buffer in bytes. + * \param[out] output_length On success, set this value to \p output_size. + * + * \retval #PSA_SUCCESS + * Success. The output buffer contains \p output_size bytes of + * cryptographic-quality random data, and \c *output_length is + * set to \p output_size. + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + * The random generator requires extra entropy and there is no + * way to obtain entropy under current environment conditions. + * This error should not happen under normal circumstances since + * this function is responsible for obtaining as much entropy as + * it needs. However implementations of this function may return + * #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + * entropy without blocking indefinitely. + * \retval #PSA_ERROR_HARDWARE_FAILURE + * A failure of the random generator hardware that isn't covered + * by #PSA_ERROR_INSUFFICIENT_ENTROPY. + */ +psa_status_t mbedtls_psa_external_get_random( + mbedtls_psa_external_random_context_t *context, + uint8_t *output, size_t output_size, size_t *output_length); +#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ + +/** Force an immediate reseed of the PSA random generator. + * + * The entropy source(s) are the ones configured at compile time. + * + * The random generator is always seeded automatically before use, and + * it is reseeded as needed based on the configured policy, so most + * applications do not need to call this function. + * + * The main reason to call this function is in scenarios where the process + * state is cloned (i.e. duplicated) while the random generator is active. + * In such scenarios, you must call this function in every clone of + * the original process before performing any cryptographic operation + * that uses randomness. (Note that any operation that uses a private or + * secret key may use randomness internally even if the result is not + * randomized, but hashing and signature verification are ok.) For example: + * + * - If the process is part of a live virtual machine that is cloned, + * call this function after cloning so that the new instance has a + * distinct random generator state. + * - If the process is part of a hibernated image that may be resumed + * multiple times, call this function after resuming so that each + * resumed instance has a distinct random generator state. + * - If the process is cloned through the fork() system call, the + * child process should call this function before using the random + * generator. + * + * An additional consideration applies in configurations where there is no + * actual entropy source, only a nonvolatile seed (i.e. + * #MBEDTLS_ENTROPY_NV_SEED is enabled, #MBEDTLS_NO_PLATFORM_ENTROPY is + * enabled and #MBEDTLS_ENTROPY_HARDWARE_ALT is disabled). + * In such configurations, simply calling psa_random_reseed() in multiple + * cloned processes would result in the same random generator state in + * all the clones. To avoid this, in such configurations, you must pass + * a unique \p perso string in every clone. + * + * \note This function has no effect when the compilation option + * #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled. + * + * \note In client-server builds, this function may not be available + * from clients, since the decision to reseed is generally based + * on the server state. + * + * \note If the entropy source fails, the random generator remains usable: + * subsequent calls to generate random data will succeed until + * the random generator itself decides to reseed. If you want to + * force a reseed, either treat the failure as a fatal error, + * or call psa_random_deplete() instead of this function (or in + * addition). + * + * \param[in] perso A personalization string, i.e. a byte string to + * inject into the random generator state in addition + * to entropy obtained from the normal source(s). + * In most cases, it is fine for \c perso to be + * empty. The main use case for a personalization + * string is when the random generator state is cloned, + * as described above, and there is no actual entropy + * source. + * \param perso_size Length of \c perso in bytes. + * + * \retval #PSA_SUCCESS + * The reseed succeeded. + * \retval #PSA_ERROR_BAD_STATE + * The PSA random generator is not active. + * \retval #PSA_ERROR_NOT_SUPPORTED + * PSA uses an external random generator because the compilation + * option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled. This + * configuration does not support explicit reseeding. + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + * The entropy source failed. + */ +psa_status_t psa_random_reseed(const uint8_t *perso, size_t perso_size); + +/** Force a reseed of the PSA random generator the next time it is used. + * + * The entropy source(s) are the ones configured at compile time. + * + * The random generator is always seeded automatically before use, and + * it is reseeded as needed based on the configured policy, so most + * applications do not need to call this function. + * + * This function has a similar purpose as psa_random_reseed(), + * but the reseed will happen the next time the random generator is used. + * The advantage of this function is that it does not fail unless the + * system is in an unintended state, so it can be used in contexts where + * propagating errors is difficult. + * + * \note This function has no effect when #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + * is enabled. + * + * \note If prediction resistance is enabled (either explicitly, or because + * the reseed interval is set to 1), calling this function is + * unnecessary since the random generator will always reseed anyway. + * + * \retval #PSA_SUCCESS + * The reseed succeeded. + * \retval #PSA_ERROR_BAD_STATE + * The PSA random generator is not active. + * \retval #PSA_ERROR_NOT_SUPPORTED + * PSA uses an external random generator because the compilation + * option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled. This + * configuration does not support explicit reseeding. + */ +psa_status_t psa_random_deplete(void); + +/** Enable or disable prediction resistance in the PSA random generator. + * + * When prediction resistance is enabled, the random generator + * injects extra entropy before each request regardless of its size. + * As a consequence, a temporary compromise of the random generator + * state does not, by itself, compromise future steps. + * Furthermore, duplicating the random generator state (because the + * running application instance is cloned) is safe since it will + * not lead to identical random generator outputs in the clones. + * + * When prediction resistance is disabled, the random generator injects + * extra entropy periodically only as determined by + * #MBEDTLS_CTR_DRBG_RESEED_INTERVAL if #MBEDTLS_CTR_DRBG_C + * is enabled, or #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL otherwise. + * + * Prediction resistance is disabled by default, although setting + * #MBEDTLS_CTR_DRBG_RESEED_INTERVAL or #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL + * to \c 1 satisfies the prediction resistance property even when the + * option is disabled. + * + * \note This function has no effect when #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + * is enabled. + * + * \note Prediction resistance cannot be enabled when the only entropy source + * is a nonvolatile seed, since prediction resistance is effectively + * impossible to achieve without actual entropy. + * + * \param enabled \c 1 to enable prediction resistance. + * \c 0 to disable prediction resistance. + * + * \retval #PSA_SUCCESS + * The PSA random generator is active, and prediction resistance + * has been changed to the desired option. + * \retval #PSA_ERROR_BAD_STATE + * The PSA random generator is not active. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p enabled is not valid. + * \retval #PSA_ERROR_NOT_SUPPORTED + * PSA uses an external random generator because the compilation + * option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled. + * Or, the random generator only has a nonvolatile seed but no entropy + * source, and prediction resistance has been requested. + */ +psa_status_t psa_random_set_prediction_resistance(unsigned enabled); + +/**@}*/ + +/** \defgroup psa_builtin_keys Built-in keys + * @{ + */ + +/** The minimum value for a key identifier that is built into the + * implementation. + * + * The range of key identifiers from #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN + * to #MBEDTLS_PSA_KEY_ID_BUILTIN_MAX within the range from + * #PSA_KEY_ID_VENDOR_MIN and #PSA_KEY_ID_VENDOR_MAX and must not intersect + * with any other set of implementation-chosen key identifiers. + * + * This value is part of the library's API since changing it would invalidate + * the values of built-in key identifiers in applications. + */ +#define MBEDTLS_PSA_KEY_ID_BUILTIN_MIN ((psa_key_id_t) 0x7fff0000) + +/** The maximum value for a key identifier that is built into the + * implementation. + * + * See #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN for more information. + */ +#define MBEDTLS_PSA_KEY_ID_BUILTIN_MAX ((psa_key_id_t) 0x7fffefff) + +/** A slot number identifying a key in a driver. + * + * Values of this type are used to identify built-in keys. + */ +typedef uint64_t psa_drv_slot_number_t; + +#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS) +/** Test whether a key identifier belongs to the builtin key range. + * + * \param key_id Key identifier to test. + * + * \retval 1 + * The key identifier is a builtin key identifier. + * \retval 0 + * The key identifier is not a builtin key identifier. + */ +static inline int psa_key_id_is_builtin(psa_key_id_t key_id) +{ + return (key_id >= MBEDTLS_PSA_KEY_ID_BUILTIN_MIN) && + (key_id <= MBEDTLS_PSA_KEY_ID_BUILTIN_MAX); +} + +/** Platform function to obtain the location and slot number of a built-in key. + * + * An application-specific implementation of this function must be provided if + * #MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS is enabled. This would typically be provided + * as part of a platform's system image. + * + * #MBEDTLS_SVC_KEY_ID_GET_KEY_ID(\p key_id) needs to be in the range from + * #MBEDTLS_PSA_KEY_ID_BUILTIN_MIN to #MBEDTLS_PSA_KEY_ID_BUILTIN_MAX. + * + * In a multi-application configuration + * (\c MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER is defined), + * this function should check that #MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(\p key_id) + * is allowed to use the given key. + * + * \param key_id The key ID for which to retrieve the + * location and slot attributes. + * \param[out] lifetime On success, the lifetime associated with the key + * corresponding to \p key_id. Lifetime is a + * combination of which driver contains the key, + * and with what persistence level the key is + * intended to be used. If the platform + * implementation does not contain specific + * information about the intended key persistence + * level, the persistence level may be reported as + * #PSA_KEY_PERSISTENCE_DEFAULT. + * \param[out] slot_number On success, the slot number known to the driver + * registered at the lifetime location reported + * through \p lifetime which corresponds to the + * requested built-in key. + * + * \retval #PSA_SUCCESS + * The requested key identifier designates a built-in key. + * In a multi-application configuration, the requested owner + * is allowed to access it. + * \retval #PSA_ERROR_DOES_NOT_EXIST + * The requested key identifier is not a built-in key which is known + * to this function. If a key exists in the key storage with this + * identifier, the data from the storage will be used. + * \return (any other error) + * Any other error is propagated to the function that requested the key. + * Common errors include: + * - #PSA_ERROR_NOT_PERMITTED: the key exists but the requested owner + * is not allowed to access it. + */ +psa_status_t mbedtls_psa_platform_get_builtin_key( + mbedtls_svc_key_id_t key_id, + psa_key_lifetime_t *lifetime, + psa_drv_slot_number_t *slot_number); +#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */ + +/** @} */ + +/** \defgroup psa_crypto_client Functions defined by a client provider + * + * The functions in this group are meant to be implemented by providers of + * the PSA Crypto client interface. They are provided by the library when + * #MBEDTLS_PSA_CRYPTO_C is enabled. + * + * \note All functions in this group are experimental, as using + * alternative client interface providers is experimental. + * + * @{ + */ + +/** Check if PSA is capable of handling the specified hash algorithm. + * + * This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + * set and that psa_crypto_init has already been called. + * + * \note When using the built-in version of the PSA core (i.e. + * #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + * the state of the driver subsystem, not the algorithm. + * This might be improved in the future. + * + * \param hash_alg The hash algorithm. + * + * \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + */ +int psa_can_do_hash(psa_algorithm_t hash_alg); + +/** + * Tell if PSA is ready for this cipher. + * + * \note When using the built-in version of the PSA core (i.e. + * #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + * the state of the driver subsystem, not the key type and algorithm. + * This might be improved in the future. + * + * \param key_type The key type. + * \param cipher_alg The cipher algorithm. + * + * \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + */ +int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg); + +/**@}*/ + +/** \addtogroup crypto_types + * @{ + */ + +#define PSA_ALG_CATEGORY_PAKE ((psa_algorithm_t) 0x0a000000) + +/** Whether the specified algorithm is a password-authenticated key exchange. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a password-authenticated key exchange (PAKE) + * algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_PAKE(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_PAKE) + +/** The Password-authenticated key exchange by juggling (J-PAKE) algorithm. + * + * This is J-PAKE as defined by RFC 8236, instantiated with the following + * parameters: + * + * - The group can be either an elliptic curve or defined over a finite field. + * - Schnorr NIZK proof as defined by RFC 8235 and using the same group as the + * J-PAKE algorithm. + * - A cryptographic hash function. + * + * To select these parameters and set up the cipher suite, call these functions + * in any order: + * + * \code + * psa_pake_cs_set_algorithm(cipher_suite, PSA_ALG_JPAKE); + * psa_pake_cs_set_primitive(cipher_suite, + * PSA_PAKE_PRIMITIVE(type, family, bits)); + * psa_pake_cs_set_hash(cipher_suite, hash); + * \endcode + * + * For more information on how to set a specific curve or field, refer to the + * documentation of the individual \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. + * + * After initializing a J-PAKE operation, call + * + * \code + * psa_pake_setup(operation, cipher_suite); + * psa_pake_set_user(operation, ...); + * psa_pake_set_peer(operation, ...); + * psa_pake_set_password_key(operation, ...); + * \endcode + * + * The password is provided as a key. This can be the password text itself, + * in an agreed character encoding, or some value derived from the password + * as required by a higher level protocol. + * + * (The implementation converts the key material to a number as described in + * Section 2.3.8 of _SEC 1: Elliptic Curve Cryptography_ + * (https://www.secg.org/sec1-v2.pdf), before reducing it modulo \c q. Here + * \c q is order of the group defined by the primitive set in the cipher suite. + * The \c psa_pake_set_password_key() function returns an error if the result + * of the reduction is 0.) + * + * The key exchange flow for J-PAKE is as follows: + * -# To get the first round data that needs to be sent to the peer, call + * \code + * // Get g1 + * psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Get the ZKP public key for x1 + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Get the ZKP proof for x1 + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * // Get g2 + * psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Get the ZKP public key for x2 + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Get the ZKP proof for x2 + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * \endcode + * -# To provide the first round data received from the peer to the operation, + * call + * \code + * // Set g3 + * psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Set the ZKP public key for x3 + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Set the ZKP proof for x3 + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * // Set g4 + * psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Set the ZKP public key for x4 + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Set the ZKP proof for x4 + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * \endcode + * -# To get the second round data that needs to be sent to the peer, call + * \code + * // Get A + * psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Get ZKP public key for x2*s + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Get ZKP proof for x2*s + * psa_pake_output(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * \endcode + * -# To provide the second round data received from the peer to the operation, + * call + * \code + * // Set B + * psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...); + * // Set ZKP public key for x4*s + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PUBLIC, ...); + * // Set ZKP proof for x4*s + * psa_pake_input(operation, #PSA_PAKE_STEP_ZK_PROOF, ...); + * \endcode + * -# To access the shared secret call + * \code + * // Get Ka=Kb=K + * psa_pake_get_implicit_key() + * \endcode + * + * For more information consult the documentation of the individual + * \c PSA_PAKE_STEP_XXX constants. + * + * At this point there is a cryptographic guarantee that only the authenticated + * party who used the same password is able to compute the key. But there is no + * guarantee that the peer is the party it claims to be and was able to do so. + * + * That is, the authentication is only implicit (the peer is not authenticated + * at this point, and no action should be taken that assume that they are - like + * for example accessing restricted files). + * + * To make the authentication explicit there are various methods, see Section 5 + * of RFC 8236 for two examples. + * + * \note The JPAKE implementation has the following limitations: + * - The only supported primitive is ECC on the curve secp256r1, i.e. + * `PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, + * PSA_ECC_FAMILY_SECP_R1, 256)`. + * - The only supported hash algorithm is SHA-256, i.e. + * `PSA_ALG_SHA_256`. + * - When using the built-in implementation, the user ID and the peer ID + * must be `"client"` (6-byte string) and `"server"` (6-byte string), + * or the other way round. + * Third-party drivers may or may not have this limitation. + * + */ +#define PSA_ALG_JPAKE ((psa_algorithm_t) 0x0a000100) + +/** @} */ + +/** \defgroup pake Password-authenticated key exchange (PAKE) + * + * This is a proposed PAKE interface for the PSA Crypto API. It is not part of + * the official PSA Crypto API yet. + * + * \note The content of this section is not part of the stable API and ABI + * of Mbed TLS and may change arbitrarily from version to version. + * Same holds for the corresponding macros #PSA_ALG_CATEGORY_PAKE and + * #PSA_ALG_JPAKE. + * @{ + */ + +/** \brief Encoding of the application role of PAKE + * + * Encodes the application's role in the algorithm is being executed. For more + * information see the documentation of individual \c PSA_PAKE_ROLE_XXX + * constants. + */ +typedef uint8_t psa_pake_role_t; + +/** Encoding of input and output indicators for PAKE. + * + * Some PAKE algorithms need to exchange more data than just a single key share. + * This type is for encoding additional input and output data for such + * algorithms. + */ +typedef uint8_t psa_pake_step_t; + +/** Encoding of the type of the PAKE's primitive. + * + * Values defined by this standard will never be in the range 0x80-0xff. + * Vendors who define additional types must use an encoding in this range. + * + * For more information see the documentation of individual + * \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. + */ +typedef uint8_t psa_pake_primitive_type_t; + +/** \brief Encoding of the family of the primitive associated with the PAKE. + * + * For more information see the documentation of individual + * \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. + */ +typedef uint8_t psa_pake_family_t; + +/** \brief Encoding of the primitive associated with the PAKE. + * + * For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. + */ +typedef uint32_t psa_pake_primitive_t; + +/** A value to indicate no role in a PAKE algorithm. + * This value can be used in a call to psa_pake_set_role() for symmetric PAKE + * algorithms which do not assign roles. + */ +#define PSA_PAKE_ROLE_NONE ((psa_pake_role_t) 0x00) + +/** The first peer in a balanced PAKE. + * + * Although balanced PAKE algorithms are symmetric, some of them needs an + * ordering of peers for the transcript calculations. If the algorithm does not + * need this, both #PSA_PAKE_ROLE_FIRST and #PSA_PAKE_ROLE_SECOND are + * accepted. + */ +#define PSA_PAKE_ROLE_FIRST ((psa_pake_role_t) 0x01) + +/** The second peer in a balanced PAKE. + * + * Although balanced PAKE algorithms are symmetric, some of them needs an + * ordering of peers for the transcript calculations. If the algorithm does not + * need this, either #PSA_PAKE_ROLE_FIRST or #PSA_PAKE_ROLE_SECOND are + * accepted. + */ +#define PSA_PAKE_ROLE_SECOND ((psa_pake_role_t) 0x02) + +/** The client in an augmented PAKE. + * + * Augmented PAKE algorithms need to differentiate between client and server. + */ +#define PSA_PAKE_ROLE_CLIENT ((psa_pake_role_t) 0x11) + +/** The server in an augmented PAKE. + * + * Augmented PAKE algorithms need to differentiate between client and server. + */ +#define PSA_PAKE_ROLE_SERVER ((psa_pake_role_t) 0x12) + +/** The PAKE primitive type indicating the use of elliptic curves. + * + * The values of the \c family and \c bits fields of the cipher suite identify a + * specific elliptic curve, using the same mapping that is used for ECC + * (::psa_ecc_family_t) keys. + * + * (Here \c family means the value returned by psa_pake_cs_get_family() and + * \c bits means the value returned by psa_pake_cs_get_bits().) + * + * Input and output during the operation can involve group elements and scalar + * values: + * -# The format for group elements is the same as for public keys on the + * specific curve would be. For more information, consult the documentation of + * psa_export_public_key(). + * -# The format for scalars is the same as for private keys on the specific + * curve would be. For more information, consult the documentation of + * psa_export_key(). + */ +#define PSA_PAKE_PRIMITIVE_TYPE_ECC ((psa_pake_primitive_type_t) 0x01) + +/** The PAKE primitive type indicating the use of Diffie-Hellman groups. + * + * The values of the \c family and \c bits fields of the cipher suite identify + * a specific Diffie-Hellman group, using the same mapping that is used for + * Diffie-Hellman (::psa_dh_family_t) keys. + * + * (Here \c family means the value returned by psa_pake_cs_get_family() and + * \c bits means the value returned by psa_pake_cs_get_bits().) + * + * Input and output during the operation can involve group elements and scalar + * values: + * -# The format for group elements is the same as for public keys on the + * specific group would be. For more information, consult the documentation of + * psa_export_public_key(). + * -# The format for scalars is the same as for private keys on the specific + * group would be. For more information, consult the documentation of + * psa_export_key(). + */ +#define PSA_PAKE_PRIMITIVE_TYPE_DH ((psa_pake_primitive_type_t) 0x02) + +/** Construct a PAKE primitive from type, family and bit-size. + * + * \param pake_type The type of the primitive + * (value of type ::psa_pake_primitive_type_t). + * \param pake_family The family of the primitive + * (the type and interpretation of this parameter depends + * on \p pake_type, for more information consult the + * documentation of individual ::psa_pake_primitive_type_t + * constants). + * \param pake_bits The bit-size of the primitive + * (Value of type \c size_t. The interpretation + * of this parameter depends on \p pake_family, for more + * information consult the documentation of individual + * ::psa_pake_primitive_type_t constants). + * + * \return The constructed primitive value of type ::psa_pake_primitive_t. + * Return 0 if the requested primitive can't be encoded as + * ::psa_pake_primitive_t. + */ +#define PSA_PAKE_PRIMITIVE(pake_type, pake_family, pake_bits) \ + ((pake_bits & 0xFFFF) != pake_bits) ? 0 : \ + ((psa_pake_primitive_t) (((pake_type) << 24 | \ + (pake_family) << 16) | (pake_bits))) + +/** The key share being sent to or received from the peer. + * + * The format for both input and output at this step is the same as for public + * keys on the group determined by the primitive (::psa_pake_primitive_t) would + * be. + * + * For more information on the format, consult the documentation of + * psa_export_public_key(). + * + * For information regarding how the group is determined, consult the + * documentation #PSA_PAKE_PRIMITIVE. + */ +#define PSA_PAKE_STEP_KEY_SHARE ((psa_pake_step_t) 0x01) + +/** A Schnorr NIZKP public key. + * + * This is the ephemeral public key in the Schnorr Non-Interactive + * Zero-Knowledge Proof (the value denoted by the letter 'V' in RFC 8235). + * + * The format for both input and output at this step is the same as for public + * keys on the group determined by the primitive (::psa_pake_primitive_t) would + * be. + * + * For more information on the format, consult the documentation of + * psa_export_public_key(). + * + * For information regarding how the group is determined, consult the + * documentation #PSA_PAKE_PRIMITIVE. + */ +#define PSA_PAKE_STEP_ZK_PUBLIC ((psa_pake_step_t) 0x02) + +/** A Schnorr NIZKP proof. + * + * This is the proof in the Schnorr Non-Interactive Zero-Knowledge Proof (the + * value denoted by the letter 'r' in RFC 8235). + * + * Both for input and output, the value at this step is an integer less than + * the order of the group selected in the cipher suite. The format depends on + * the group as well: + * + * - For Montgomery curves, the encoding is little endian. + * - For everything else the encoding is big endian (see Section 2.3.8 of + * _SEC 1: Elliptic Curve Cryptography_ at https://www.secg.org/sec1-v2.pdf). + * + * In both cases leading zeroes are allowed as long as the length in bytes does + * not exceed the byte length of the group order. + * + * For information regarding how the group is determined, consult the + * documentation #PSA_PAKE_PRIMITIVE. + */ +#define PSA_PAKE_STEP_ZK_PROOF ((psa_pake_step_t) 0x03) + +/**@}*/ + +/** A sufficient output buffer size for psa_pake_output(). + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_pake_output() will not fail due to an insufficient output buffer + * size. The actual size of the output might be smaller in any given call. + * + * See also #PSA_PAKE_OUTPUT_MAX_SIZE + * + * \param alg A PAKE algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_PAKE(\p alg) is true). + * \param primitive A primitive of type ::psa_pake_primitive_t that is + * compatible with algorithm \p alg. + * \param output_step A value of type ::psa_pake_step_t that is valid for the + * algorithm \p alg. + * \return A sufficient output buffer size for the specified + * PAKE algorithm, primitive, and output step. If the + * PAKE algorithm, primitive, or output step is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_PAKE_OUTPUT_SIZE(alg, primitive, output_step) \ + (alg == PSA_ALG_JPAKE && \ + primitive == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ + PSA_ECC_FAMILY_SECP_R1, 256) ? \ + ( \ + output_step == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ + output_step == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ + 32 \ + ) : \ + 0) + +/** A sufficient input buffer size for psa_pake_input(). + * + * The value returned by this macro is guaranteed to be large enough for any + * valid input to psa_pake_input() in an operation with the specified + * parameters. + * + * See also #PSA_PAKE_INPUT_MAX_SIZE + * + * \param alg A PAKE algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_PAKE(\p alg) is true). + * \param primitive A primitive of type ::psa_pake_primitive_t that is + * compatible with algorithm \p alg. + * \param input_step A value of type ::psa_pake_step_t that is valid for the + * algorithm \p alg. + * \return A sufficient input buffer size for the specified + * input, cipher suite and algorithm. If the cipher suite, + * the input type or PAKE algorithm is not recognized, or + * the parameters are incompatible, return 0. + */ +#define PSA_PAKE_INPUT_SIZE(alg, primitive, input_step) \ + (alg == PSA_ALG_JPAKE && \ + primitive == PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, \ + PSA_ECC_FAMILY_SECP_R1, 256) ? \ + ( \ + input_step == PSA_PAKE_STEP_KEY_SHARE ? 65 : \ + input_step == PSA_PAKE_STEP_ZK_PUBLIC ? 65 : \ + 32 \ + ) : \ + 0) + +/** Output buffer size for psa_pake_output() for any of the supported PAKE + * algorithm and primitive suites and output step. + * + * This macro must expand to a compile-time constant integer. + * + * The value of this macro must be at least as large as the largest value + * returned by PSA_PAKE_OUTPUT_SIZE() + * + * See also #PSA_PAKE_OUTPUT_SIZE(\p alg, \p primitive, \p output_step). + */ +#define PSA_PAKE_OUTPUT_MAX_SIZE 65 + +/** Input buffer size for psa_pake_input() for any of the supported PAKE + * algorithm and primitive suites and input step. + * + * This macro must expand to a compile-time constant integer. + * + * The value of this macro must be at least as large as the largest value + * returned by PSA_PAKE_INPUT_SIZE() + * + * See also #PSA_PAKE_INPUT_SIZE(\p alg, \p primitive, \p output_step). + */ +#define PSA_PAKE_INPUT_MAX_SIZE 65 + +/** Returns a suitable initializer for a PAKE cipher suite object of type + * psa_pake_cipher_suite_t. + */ +#define PSA_PAKE_CIPHER_SUITE_INIT { PSA_ALG_NONE, 0, 0, 0, PSA_ALG_NONE } + +/** Returns a suitable initializer for a PAKE operation object of type + * psa_pake_operation_t. + */ +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_PAKE_OPERATION_INIT { 0 } +#else +#define PSA_PAKE_OPERATION_INIT { 0, PSA_ALG_NONE, 0, PSA_PAKE_OPERATION_STAGE_SETUP, \ + { 0 }, { { 0 } } } +#endif + +struct psa_pake_cipher_suite_s { + psa_algorithm_t algorithm; + psa_pake_primitive_type_t type; + psa_pake_family_t family; + uint16_t bits; + psa_algorithm_t hash; +}; + +struct psa_crypto_driver_pake_inputs_s { + uint8_t *MBEDTLS_PRIVATE(password); + size_t MBEDTLS_PRIVATE(password_len); + uint8_t *MBEDTLS_PRIVATE(user); + size_t MBEDTLS_PRIVATE(user_len); + uint8_t *MBEDTLS_PRIVATE(peer); + size_t MBEDTLS_PRIVATE(peer_len); + psa_key_attributes_t MBEDTLS_PRIVATE(attributes); + struct psa_pake_cipher_suite_s MBEDTLS_PRIVATE(cipher_suite); +}; + +typedef enum psa_crypto_driver_pake_step { + PSA_JPAKE_STEP_INVALID = 0, /* Invalid step */ + PSA_JPAKE_X1_STEP_KEY_SHARE = 1, /* Round 1: input/output key share (for ephemeral private key X1).*/ + PSA_JPAKE_X1_STEP_ZK_PUBLIC = 2, /* Round 1: input/output Schnorr NIZKP public key for the X1 key */ + PSA_JPAKE_X1_STEP_ZK_PROOF = 3, /* Round 1: input/output Schnorr NIZKP proof for the X1 key */ + PSA_JPAKE_X2_STEP_KEY_SHARE = 4, /* Round 1: input/output key share (for ephemeral private key X2).*/ + PSA_JPAKE_X2_STEP_ZK_PUBLIC = 5, /* Round 1: input/output Schnorr NIZKP public key for the X2 key */ + PSA_JPAKE_X2_STEP_ZK_PROOF = 6, /* Round 1: input/output Schnorr NIZKP proof for the X2 key */ + PSA_JPAKE_X2S_STEP_KEY_SHARE = 7, /* Round 2: output X2S key (our key) */ + PSA_JPAKE_X2S_STEP_ZK_PUBLIC = 8, /* Round 2: output Schnorr NIZKP public key for the X2S key (our key) */ + PSA_JPAKE_X2S_STEP_ZK_PROOF = 9, /* Round 2: output Schnorr NIZKP proof for the X2S key (our key) */ + PSA_JPAKE_X4S_STEP_KEY_SHARE = 10, /* Round 2: input X4S key (from peer) */ + PSA_JPAKE_X4S_STEP_ZK_PUBLIC = 11, /* Round 2: input Schnorr NIZKP public key for the X4S key (from peer) */ + PSA_JPAKE_X4S_STEP_ZK_PROOF = 12 /* Round 2: input Schnorr NIZKP proof for the X4S key (from peer) */ +} psa_crypto_driver_pake_step_t; + +typedef enum psa_jpake_round { + PSA_JPAKE_FIRST = 0, + PSA_JPAKE_SECOND = 1, + PSA_JPAKE_FINISHED = 2 +} psa_jpake_round_t; + +typedef enum psa_jpake_io_mode { + PSA_JPAKE_INPUT = 0, + PSA_JPAKE_OUTPUT = 1 +} psa_jpake_io_mode_t; + +struct psa_jpake_computation_stage_s { + /* The J-PAKE round we are currently on */ + psa_jpake_round_t MBEDTLS_PRIVATE(round); + /* The 'mode' we are currently in (inputting or outputting) */ + psa_jpake_io_mode_t MBEDTLS_PRIVATE(io_mode); + /* The number of completed inputs so far this round */ + uint8_t MBEDTLS_PRIVATE(inputs); + /* The number of completed outputs so far this round */ + uint8_t MBEDTLS_PRIVATE(outputs); + /* The next expected step (KEY_SHARE, ZK_PUBLIC or ZK_PROOF) */ + psa_pake_step_t MBEDTLS_PRIVATE(step); +}; + +#define PSA_JPAKE_EXPECTED_INPUTS(round) ((round) == PSA_JPAKE_FINISHED ? 0 : \ + ((round) == PSA_JPAKE_FIRST ? 2 : 1)) +#define PSA_JPAKE_EXPECTED_OUTPUTS(round) ((round) == PSA_JPAKE_FINISHED ? 0 : \ + ((round) == PSA_JPAKE_FIRST ? 2 : 1)) + +struct psa_pake_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_crypto_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + /* Algorithm of the PAKE operation */ + psa_algorithm_t MBEDTLS_PRIVATE(alg); + /* A primitive of type compatible with algorithm */ + psa_pake_primitive_t MBEDTLS_PRIVATE(primitive); + /* Stage of the PAKE operation: waiting for the setup, collecting inputs + * or computing. */ + uint8_t MBEDTLS_PRIVATE(stage); + /* Holds computation stage of the PAKE algorithms. */ + union { + uint8_t MBEDTLS_PRIVATE(dummy); +#if defined(PSA_WANT_ALG_JPAKE) + struct psa_jpake_computation_stage_s MBEDTLS_PRIVATE(jpake); +#endif + } MBEDTLS_PRIVATE(computation_stage); + union { + psa_driver_pake_context_t MBEDTLS_PRIVATE(ctx); + struct psa_crypto_driver_pake_inputs_s MBEDTLS_PRIVATE(inputs); + } MBEDTLS_PRIVATE(data); +#endif +}; + +/** \addtogroup pake + * @{ + */ + +/** The type of the data structure for PAKE cipher suites. + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. + */ +typedef struct psa_pake_cipher_suite_s psa_pake_cipher_suite_t; + +/** Return an initial value for a PAKE cipher suite object. + */ +static psa_pake_cipher_suite_t psa_pake_cipher_suite_init(void); + +/** Retrieve the PAKE algorithm from a PAKE cipher suite. + * + * \param[in] cipher_suite The cipher suite structure to query. + * + * \return The PAKE algorithm stored in the cipher suite structure. + */ +static psa_algorithm_t psa_pake_cs_get_algorithm( + const psa_pake_cipher_suite_t *cipher_suite); + +/** Declare the PAKE algorithm for the cipher suite. + * + * This function overwrites any PAKE algorithm + * previously set in \p cipher_suite. + * + * \note For #PSA_ALG_JPAKE, the only supported hash algorithm is SHA-256. + * + * \param[out] cipher_suite The cipher suite structure to write to. + * \param algorithm The PAKE algorithm to write. + * (`PSA_ALG_XXX` values of type ::psa_algorithm_t + * such that #PSA_ALG_IS_PAKE(\c alg) is true.) + * If this is 0, the PAKE algorithm in + * \p cipher_suite becomes unspecified. + */ +static void psa_pake_cs_set_algorithm(psa_pake_cipher_suite_t *cipher_suite, + psa_algorithm_t algorithm); + +/** Retrieve the primitive from a PAKE cipher suite. + * + * \param[in] cipher_suite The cipher suite structure to query. + * + * \return The primitive stored in the cipher suite structure. + */ +static psa_pake_primitive_t psa_pake_cs_get_primitive( + const psa_pake_cipher_suite_t *cipher_suite); + +/** Declare the primitive for a PAKE cipher suite. + * + * This function overwrites any primitive previously set in \p cipher_suite. + * + * \note For #PSA_ALG_JPAKE, the only supported primitive is ECC on the curve + * secp256r1, i.e. `PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, + * PSA_ECC_FAMILY_SECP_R1, 256)`. + * + * \param[out] cipher_suite The cipher suite structure to write to. + * \param primitive The primitive to write. If this is 0, the + * primitive type in \p cipher_suite becomes + * unspecified. + */ +static void psa_pake_cs_set_primitive(psa_pake_cipher_suite_t *cipher_suite, + psa_pake_primitive_t primitive); + +/** Retrieve the PAKE family from a PAKE cipher suite. + * + * \param[in] cipher_suite The cipher suite structure to query. + * + * \return The PAKE family stored in the cipher suite structure. + */ +static psa_pake_family_t psa_pake_cs_get_family( + const psa_pake_cipher_suite_t *cipher_suite); + +/** Retrieve the PAKE primitive bit-size from a PAKE cipher suite. + * + * \param[in] cipher_suite The cipher suite structure to query. + * + * \return The PAKE primitive bit-size stored in the cipher suite structure. + */ +static uint16_t psa_pake_cs_get_bits( + const psa_pake_cipher_suite_t *cipher_suite); + +/** Retrieve the hash algorithm from a PAKE cipher suite. + * + * \param[in] cipher_suite The cipher suite structure to query. + * + * \return The hash algorithm stored in the cipher suite structure. The return + * value is 0 if the PAKE is not parametrised by a hash algorithm or if + * the hash algorithm is not set. + */ +static psa_algorithm_t psa_pake_cs_get_hash( + const psa_pake_cipher_suite_t *cipher_suite); + +/** Declare the hash algorithm for a PAKE cipher suite. + * + * This function overwrites any hash algorithm + * previously set in \p cipher_suite. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * \param[out] cipher_suite The cipher suite structure to write to. + * \param hash The hash involved in the cipher suite. + * (`PSA_ALG_XXX` values of type ::psa_algorithm_t + * such that #PSA_ALG_IS_HASH(\c alg) is true.) + * If this is 0, the hash algorithm in + * \p cipher_suite becomes unspecified. + */ +static void psa_pake_cs_set_hash(psa_pake_cipher_suite_t *cipher_suite, + psa_algorithm_t hash); + +/** The type of the state data structure for PAKE operations. + * + * Before calling any function on a PAKE operation object, the application + * must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_pake_operation_t operation; + * memset(&operation, 0, sizeof(operation)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_pake_operation_t operation = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, + * for example: + * \code + * psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; + * \endcode + * - Assign the result of the function psa_pake_operation_init() + * to the structure, for example: + * \code + * psa_pake_operation_t operation; + * operation = psa_pake_operation_init(); + * \endcode + * + * This is an implementation-defined \c struct. Applications should not + * make any assumptions about the content of this structure. + * Implementation details can change in future versions without notice. */ +typedef struct psa_pake_operation_s psa_pake_operation_t; + +/** The type of input values for PAKE operations. */ +typedef struct psa_crypto_driver_pake_inputs_s psa_crypto_driver_pake_inputs_t; + +/** The type of computation stage for J-PAKE operations. */ +typedef struct psa_jpake_computation_stage_s psa_jpake_computation_stage_t; + +/** Return an initial value for a PAKE operation object. + */ +static psa_pake_operation_t psa_pake_operation_init(void); + +/** Get the length of the password in bytes from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] password_len Password length. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * Password hasn't been set yet. + */ +psa_status_t psa_crypto_driver_pake_get_password_len( + const psa_crypto_driver_pake_inputs_t *inputs, + size_t *password_len); + +/** Get the password from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] buffer Return buffer for password. + * \param buffer_size Size of the return buffer in bytes. + * \param[out] buffer_length Actual size of the password in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * Password hasn't been set yet. + */ +psa_status_t psa_crypto_driver_pake_get_password( + const psa_crypto_driver_pake_inputs_t *inputs, + uint8_t *buffer, size_t buffer_size, size_t *buffer_length); + +/** Get the length of the user id in bytes from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] user_len User id length. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * User id hasn't been set yet. + */ +psa_status_t psa_crypto_driver_pake_get_user_len( + const psa_crypto_driver_pake_inputs_t *inputs, + size_t *user_len); + +/** Get the length of the peer id in bytes from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] peer_len Peer id length. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * Peer id hasn't been set yet. + */ +psa_status_t psa_crypto_driver_pake_get_peer_len( + const psa_crypto_driver_pake_inputs_t *inputs, + size_t *peer_len); + +/** Get the user id from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] user_id User id. + * \param user_id_size Size of \p user_id in bytes. + * \param[out] user_id_len Size of the user id in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * User id hasn't been set yet. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p user_id is too small. + */ +psa_status_t psa_crypto_driver_pake_get_user( + const psa_crypto_driver_pake_inputs_t *inputs, + uint8_t *user_id, size_t user_id_size, size_t *user_id_len); + +/** Get the peer id from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] peer_id Peer id. + * \param peer_id_size Size of \p peer_id in bytes. + * \param[out] peer_id_length Size of the peer id in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * Peer id hasn't been set yet. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p peer_id is too small. + */ +psa_status_t psa_crypto_driver_pake_get_peer( + const psa_crypto_driver_pake_inputs_t *inputs, + uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length); + +/** Get the cipher suite from given inputs. + * + * \param[in] inputs Operation inputs. + * \param[out] cipher_suite Return buffer for role. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BAD_STATE + * Cipher_suite hasn't been set yet. + */ +psa_status_t psa_crypto_driver_pake_get_cipher_suite( + const psa_crypto_driver_pake_inputs_t *inputs, + psa_pake_cipher_suite_t *cipher_suite); + +/** Set the session information for a password-authenticated key exchange. + * + * The sequence of operations to set up a password-authenticated key exchange + * is as follows: + * -# Allocate an operation object which will be passed to all the functions + * listed here. + * -# Initialize the operation object with one of the methods described in the + * documentation for #psa_pake_operation_t, e.g. + * #PSA_PAKE_OPERATION_INIT. + * -# Call psa_pake_setup() to specify the cipher suite. + * -# Call \c psa_pake_set_xxx() functions on the operation to complete the + * setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + * to be called depends on the algorithm in use. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * A typical sequence of calls to perform a password-authenticated key + * exchange: + * -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + * key share that needs to be sent to the peer. + * -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + * the key share that was received from the peer. + * -# Depending on the algorithm additional calls to psa_pake_output() and + * psa_pake_input() might be necessary. + * -# Call psa_pake_get_implicit_key() for accessing the shared secret. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * If an error occurs at any step after a call to psa_pake_setup(), + * the operation will need to be reset by a call to psa_pake_abort(). The + * application may call psa_pake_abort() at any time after the operation + * has been initialized. + * + * After a successful call to psa_pake_setup(), the application must + * eventually terminate the operation. The following events terminate an + * operation: + * - A call to psa_pake_abort(). + * - A successful call to psa_pake_get_implicit_key(). + * + * \param[in,out] operation The operation object to set up. It must have + * been initialized but not set up yet. + * \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + * characterizes a PAKE algorithm and determines + * the algorithm as well.) + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The algorithm in \p cipher_suite is not a PAKE algorithm, or the + * PAKE primitive in \p cipher_suite is not compatible with the + * PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + * or not compatible with the PAKE algorithm and primitive. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The algorithm in \p cipher_suite is not a supported PAKE algorithm, + * or the PAKE primitive in \p cipher_suite is not supported or not + * compatible with the PAKE algorithm, or the hash algorithm in + * \p cipher_suite is not supported or not compatible with the PAKE + * algorithm and primitive. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_setup(psa_pake_operation_t *operation, + const psa_pake_cipher_suite_t *cipher_suite); + +/** Set the password for a password-authenticated key exchange from key ID. + * + * Call this function when the password, or a value derived from the password, + * is already present in the key store. + * + * \param[in,out] operation The operation object to set the password for. It + * must have been set up by psa_pake_setup() and + * not yet in use (neither psa_pake_output() nor + * psa_pake_input() has been called yet). It must + * be on operation for which the password hasn't + * been set yet (psa_pake_set_password_key() + * hasn't been called yet). + * \param password Identifier of the key holding the password or a + * value derived from the password (eg. by a + * memory-hard function). It must remain valid + * until the operation terminates. It must be of + * type #PSA_KEY_TYPE_PASSWORD or + * #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + * the usage #PSA_KEY_USAGE_DERIVE. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_HANDLE + * \p password is not a valid key identifier. + * \retval #PSA_ERROR_NOT_PERMITTED + * The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + * permit the \p operation's algorithm. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + * #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + * the \p operation's cipher suite. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The key type or key size of \p password is not supported with the + * \p operation's cipher suite. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must have been set up.), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_set_password_key(psa_pake_operation_t *operation, + mbedtls_svc_key_id_t password); + +/** Set the user ID for a password-authenticated key exchange. + * + * Call this function to set the user ID. For PAKE algorithms that associate a + * user identifier with each side of the session you need to call + * psa_pake_set_peer() as well. For PAKE algorithms that associate a single + * user identifier with the session, call psa_pake_set_user() only. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + * must be `"client"` (6-byte string) or `"server"` (6-byte string). + * Third-party drivers may or may not have this limitation. + * + * \param[in,out] operation The operation object to set the user ID for. It + * must have been set up by psa_pake_setup() and + * not yet in use (neither psa_pake_output() nor + * psa_pake_input() has been called yet). It must + * be on operation for which the user ID hasn't + * been set (psa_pake_set_user() hasn't been + * called yet). + * \param[in] user_id The user ID to authenticate with. + * \param user_id_len Size of the \p user_id buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p user_id is not valid for the \p operation's algorithm and cipher + * suite. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The value of \p user_id is not supported by the implementation. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_set_user(psa_pake_operation_t *operation, + const uint8_t *user_id, + size_t user_id_len); + +/** Set the peer ID for a password-authenticated key exchange. + * + * Call this function in addition to psa_pake_set_user() for PAKE algorithms + * that associate a user identifier with each side of the session. For PAKE + * algorithms that associate a single user identifier with the session, call + * psa_pake_set_user() only. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + * must be `"client"` (6-byte string) or `"server"` (6-byte string). + * Third-party drivers may or may not have this limitation. + * + * \param[in,out] operation The operation object to set the peer ID for. It + * must have been set up by psa_pake_setup() and + * not yet in use (neither psa_pake_output() nor + * psa_pake_input() has been called yet). It must + * be on operation for which the peer ID hasn't + * been set (psa_pake_set_peer() hasn't been + * called yet). + * \param[in] peer_id The peer's ID to authenticate. + * \param peer_id_len Size of the \p peer_id buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p peer_id is not valid for the \p operation's algorithm and cipher + * suite. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The algorithm doesn't associate a second identity with the session. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * Calling psa_pake_set_peer() is invalid with the \p operation's + * algorithm, the operation state is not valid, or the library has not + * been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_set_peer(psa_pake_operation_t *operation, + const uint8_t *peer_id, + size_t peer_id_len); + +/** Set the application role for a password-authenticated key exchange. + * + * Not all PAKE algorithms need to differentiate the communicating entities. + * It is optional to call this function for PAKEs that don't require a role + * to be specified. For such PAKEs the application role parameter is ignored, + * or #PSA_PAKE_ROLE_NONE can be passed as \c role. + * + * Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + * values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + * for more information. + * + * \param[in,out] operation The operation object to specify the + * application's role for. It must have been set up + * by psa_pake_setup() and not yet in use (neither + * psa_pake_output() nor psa_pake_input() has been + * called yet). It must be on operation for which + * the application's role hasn't been specified + * (psa_pake_set_role() hasn't been called yet). + * \param role A value of type ::psa_pake_role_t indicating the + * application's role in the PAKE the algorithm + * that is being set up. For more information see + * the documentation of \c PSA_PAKE_ROLE_XXX + * constants. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The \p role is not a valid PAKE role in the \p operation’s algorithm. + * \retval #PSA_ERROR_NOT_SUPPORTED + * The \p role for this algorithm is not supported or is not valid. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid, or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_set_role(psa_pake_operation_t *operation, + psa_pake_role_t role); + +/** Get output for a step of a password-authenticated key exchange. + * + * Depending on the algorithm being executed, you might need to call this + * function several times or you might not need to call this at all. + * + * The exact sequence of calls to perform a password-authenticated key + * exchange depends on the algorithm in use. Refer to the documentation of + * individual PAKE algorithm types (`PSA_ALG_XXX` values of type + * ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + * information. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_pake_abort(). + * + * \param[in,out] operation Active PAKE operation. + * \param step The step of the algorithm for which the output is + * requested. + * \param[out] output Buffer where the output is to be written in the + * format appropriate for this \p step. Refer to + * the documentation of the individual + * \c PSA_PAKE_STEP_XXX constants for more + * information. + * \param output_size Size of the \p output buffer in bytes. This must + * be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + * primitive, \p output_step) where \c alg and + * \p primitive are the PAKE algorithm and primitive + * in the operation's cipher suite, and \p step is + * the output step. + * + * \param[out] output_length On success, the number of bytes of the returned + * output. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_BUFFER_TOO_SMALL + * The size of the \p output buffer is too small. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p step is not compatible with the operation's algorithm. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p step is not supported with the operation's algorithm. + * \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, and fully set + * up, and this call must conform to the algorithm's requirements + * for ordering of input and output steps), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_output(psa_pake_operation_t *operation, + psa_pake_step_t step, + uint8_t *output, + size_t output_size, + size_t *output_length); + +/** Provide input for a step of a password-authenticated key exchange. + * + * Depending on the algorithm being executed, you might need to call this + * function several times or you might not need to call this at all. + * + * The exact sequence of calls to perform a password-authenticated key + * exchange depends on the algorithm in use. Refer to the documentation of + * individual PAKE algorithm types (`PSA_ALG_XXX` values of type + * ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + * information. + * + * If this function returns an error status, the operation enters an error + * state and must be aborted by calling psa_pake_abort(). + * + * \param[in,out] operation Active PAKE operation. + * \param step The step for which the input is provided. + * \param[in] input Buffer containing the input in the format + * appropriate for this \p step. Refer to the + * documentation of the individual + * \c PSA_PAKE_STEP_XXX constants for more + * information. + * \param input_length Size of the \p input buffer in bytes. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * \p input_length is not compatible with the \p operation’s algorithm, + * or the \p input is not valid for the \p operation's algorithm, + * cipher suite or \p step. + * \retval #PSA_ERROR_NOT_SUPPORTED + * \p step p is not supported with the \p operation's algorithm, or the + * \p input is not supported for the \p operation's algorithm, cipher + * suite or \p step. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The operation state is not valid (it must be active, and fully set + * up, and this call must conform to the algorithm's requirements + * for ordering of input and output steps), or + * the library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_input(psa_pake_operation_t *operation, + psa_pake_step_t step, + const uint8_t *input, + size_t input_length); + +/** Get implicitly confirmed shared secret from a PAKE. + * + * At this point there is a cryptographic guarantee that only the authenticated + * party who used the same password is able to compute the key. But there is no + * guarantee that the peer is the party it claims to be and was able to do so. + * + * That is, the authentication is only implicit. Since the peer is not + * authenticated yet, no action should be taken yet that assumes that the peer + * is who it claims to be. For example, do not access restricted files on the + * peer's behalf until an explicit authentication has succeeded. + * + * This function can be called after the key exchange phase of the operation + * has completed. It imports the shared secret output of the PAKE into the + * provided derivation operation. The input step + * #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + * material in the key derivation operation. + * + * The exact sequence of calls to perform a password-authenticated key + * exchange depends on the algorithm in use. Refer to the documentation of + * individual PAKE algorithm types (`PSA_ALG_XXX` values of type + * ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + * information. + * + * When this function returns successfully, \p operation becomes inactive. + * If this function returns an error status, both \p operation + * and \c key_derivation operations enter an error state and must be aborted by + * calling psa_pake_abort() and psa_key_derivation_abort() respectively. + * + * \param[in,out] operation Active PAKE operation. + * \param[out] output A key derivation operation that is ready + * for an input step of type + * #PSA_KEY_DERIVATION_INPUT_SECRET. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + * algorithm in the \p output key derivation operation. + * \retval #PSA_ERROR_NOT_SUPPORTED + * Input from a PAKE is not supported by the algorithm in the \p output + * key derivation operation. + * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + * \retval #PSA_ERROR_DATA_INVALID \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The PAKE operation state is not valid (it must be active, but beyond + * that validity is specific to the algorithm), or + * the library has not been previously initialized by psa_crypto_init(), + * or the state of \p output is not valid for + * the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + * step is out of order or the application has done this step already + * and it may not be repeated. + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_get_implicit_key(psa_pake_operation_t *operation, + psa_key_derivation_operation_t *output); + +/** Abort a PAKE operation. + * + * Aborting an operation frees all associated resources except for the \c + * operation structure itself. Once aborted, the operation object can be reused + * for another operation by calling psa_pake_setup() again. + * + * This function may be called at any time after the operation + * object has been initialized as described in #psa_pake_operation_t. + * + * In particular, calling psa_pake_abort() after the operation has been + * terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + * is safe and has no effect. + * + * \param[in,out] operation The operation to abort. + * + * \retval #PSA_SUCCESS + * Success. + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + * \retval #PSA_ERROR_BAD_STATE + * The library has not been previously initialized by psa_crypto_init(). + * It is implementation-dependent whether a failure to initialize + * results in this error code. + */ +psa_status_t psa_pake_abort(psa_pake_operation_t *operation); + +/**@}*/ + +static inline psa_algorithm_t psa_pake_cs_get_algorithm( + const psa_pake_cipher_suite_t *cipher_suite) +{ + return cipher_suite->algorithm; +} + +static inline void psa_pake_cs_set_algorithm( + psa_pake_cipher_suite_t *cipher_suite, + psa_algorithm_t algorithm) +{ + if (!PSA_ALG_IS_PAKE(algorithm)) { + cipher_suite->algorithm = 0; + } else { + cipher_suite->algorithm = algorithm; + } +} + +static inline psa_pake_primitive_t psa_pake_cs_get_primitive( + const psa_pake_cipher_suite_t *cipher_suite) +{ + return PSA_PAKE_PRIMITIVE(cipher_suite->type, cipher_suite->family, + cipher_suite->bits); +} + +static inline void psa_pake_cs_set_primitive( + psa_pake_cipher_suite_t *cipher_suite, + psa_pake_primitive_t primitive) +{ + cipher_suite->type = (psa_pake_primitive_type_t) (primitive >> 24); + cipher_suite->family = (psa_pake_family_t) (0xFF & (primitive >> 16)); + cipher_suite->bits = (uint16_t) (0xFFFF & primitive); +} + +static inline psa_pake_family_t psa_pake_cs_get_family( + const psa_pake_cipher_suite_t *cipher_suite) +{ + return cipher_suite->family; +} + +static inline uint16_t psa_pake_cs_get_bits( + const psa_pake_cipher_suite_t *cipher_suite) +{ + return cipher_suite->bits; +} + +static inline psa_algorithm_t psa_pake_cs_get_hash( + const psa_pake_cipher_suite_t *cipher_suite) +{ + return cipher_suite->hash; +} + +static inline void psa_pake_cs_set_hash(psa_pake_cipher_suite_t *cipher_suite, + psa_algorithm_t hash) +{ + if (!PSA_ALG_IS_HASH(hash)) { + cipher_suite->hash = 0; + } else { + cipher_suite->hash = hash; + } +} + +static inline struct psa_pake_cipher_suite_s psa_pake_cipher_suite_init(void) +{ + const struct psa_pake_cipher_suite_s v = PSA_PAKE_CIPHER_SUITE_INIT; + return v; +} + +static inline struct psa_pake_operation_s psa_pake_operation_init(void) +{ + const struct psa_pake_operation_s v = PSA_PAKE_OPERATION_INIT; + return v; +} + +#ifdef __cplusplus +} +#endif + +#endif /* PSA_CRYPTO_EXTRA_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_legacy.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_legacy.h new file mode 100644 index 00000000..7df3614d --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_legacy.h @@ -0,0 +1,88 @@ +/** + * \file psa/crypto_legacy.h + * + * \brief Add temporary suppport for deprecated symbols before they are + * removed from the library. + * + * PSA_WANT_KEY_TYPE_xxx_KEY_PAIR and MBEDTLS_PSA_ACCEL_KEY_TYPE_xxx_KEY_PAIR + * symbols are deprecated. + * New symols add a suffix to that base name in order to clearly state what is + * the expected use for the key (use, import, export, generate, derive). + * Here we define some backward compatibility support for uses stil using + * the legacy symbols. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_PSA_CRYPTO_LEGACY_H +#define MBEDTLS_PSA_CRYPTO_LEGACY_H + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) //no-check-names +#if !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 +#endif +#endif + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) //no-check-names +#if !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#endif +#if !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +#endif +#endif + +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) //no-check-names +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE +#endif +#endif + +#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR) //no-check-names +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT +#endif +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE) +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE +#endif +#endif + +#endif /* MBEDTLS_PSA_CRYPTO_LEGACY_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_platform.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_platform.h new file mode 100644 index 00000000..a871ee12 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_platform.h @@ -0,0 +1,102 @@ +/** + * \file psa/crypto_platform.h + * + * \brief PSA cryptography module: Mbed TLS platform definitions + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * This file contains platform-dependent type definitions. + * + * In implementations with isolation between the application and the + * cryptography module, implementers should take care to ensure that + * the definitions that are exposed to applications match what the + * module implements. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_PLATFORM_H +#define PSA_CRYPTO_PLATFORM_H +#include "mbedtls/private_access.h" + +/* + * Include the build-time configuration information header. Here, we do not + * include `"mbedtls/build_info.h"` directly but `"psa/build_info.h"`, which + * is basically just an alias to it. This is to ease the maintenance of the + * TF-PSA-Crypto repository which has a different build system and + * configuration. + */ +#include "psa/build_info.h" + +/* PSA requires several types which C99 provides in stdint.h. */ +#include + +#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) + +/* Building for the PSA Crypto service on a PSA platform, a key owner is a PSA + * partition identifier. + * + * The function psa_its_identifier_of_slot() in psa_crypto_storage.c that + * translates a key identifier to a key storage file name assumes that + * mbedtls_key_owner_id_t is a 32-bit integer. This function thus needs + * reworking if mbedtls_key_owner_id_t is not defined as a 32-bit integer + * here anymore. + */ +typedef int32_t mbedtls_key_owner_id_t; + +/** Compare two key owner identifiers. + * + * \param id1 First key owner identifier. + * \param id2 Second key owner identifier. + * + * \return Non-zero if the two key owner identifiers are equal, zero otherwise. + */ +static inline int mbedtls_key_owner_id_equal(mbedtls_key_owner_id_t id1, + mbedtls_key_owner_id_t id2) +{ + return id1 == id2; +} + +#endif /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */ + +/* + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is being built for SPM + * (Secure Partition Manager) integration which separates the code into two + * parts: NSPE (Non-Secure Processing Environment) and SPE (Secure Processing + * Environment). When building for the SPE, an additional header file should be + * included. + */ +#if defined(MBEDTLS_PSA_CRYPTO_SPM) +#define PSA_CRYPTO_SECURE 1 +#include "crypto_spe.h" +#endif // MBEDTLS_PSA_CRYPTO_SPM + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +/** The type of the context passed to mbedtls_psa_external_get_random(). + * + * Mbed TLS initializes the context to all-bits-zero before calling + * mbedtls_psa_external_get_random() for the first time. + * + * The definition of this type in the Mbed TLS source code is for + * demonstration purposes. Implementers of mbedtls_psa_external_get_random() + * are expected to replace it with a custom definition. + */ +typedef struct { + uintptr_t MBEDTLS_PRIVATE(opaque)[2]; +} mbedtls_psa_external_random_context_t; +#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +/** The type of the client handle used in context structures + * + * When a client view of the multipart context structures is required, + * this handle is used to keep a mapping with the service side of the + * context which contains the actual data. + */ +typedef uint32_t mbedtls_psa_client_handle_t; +#endif + +#endif /* PSA_CRYPTO_PLATFORM_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_se_driver.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_se_driver.h new file mode 100644 index 00000000..9ce14bba --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_se_driver.h @@ -0,0 +1,1383 @@ +/** + * \file psa/crypto_se_driver.h + * \brief PSA external cryptoprocessor driver module + * + * This header declares types and function signatures for cryptography + * drivers that access key material via opaque references. + * This is meant for cryptoprocessors that have a separate key storage from the + * space in which the PSA Crypto implementation runs, typically secure + * elements (SEs). + * + * This file is part of the PSA Crypto Driver HAL (hardware abstraction layer), + * containing functions for driver developers to implement to enable hardware + * to be called in a standardized way by a PSA Cryptography API + * implementation. The functions comprising the driver HAL, which driver + * authors implement, are not intended to be called by application developers. + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ +#ifndef PSA_CRYPTO_SE_DRIVER_H +#define PSA_CRYPTO_SE_DRIVER_H +#include "mbedtls/private_access.h" + +#include "crypto_driver_common.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** \defgroup se_init Secure element driver initialization + */ +/**@{*/ + +/** \brief Driver context structure + * + * Driver functions receive a pointer to this structure. + * Each registered driver has one instance of this structure. + * + * Implementations must include the fields specified here and + * may include other fields. + */ +typedef struct { + /** A read-only pointer to the driver's persistent data. + * + * Drivers typically use this persistent data to keep track of + * which slot numbers are available. This is only a guideline: + * drivers may use the persistent data for any purpose, keeping + * in mind the restrictions on when the persistent data is saved + * to storage: the persistent data is only saved after calling + * certain functions that receive a writable pointer to the + * persistent data. + * + * The core allocates a memory buffer for the persistent data. + * The pointer is guaranteed to be suitably aligned for any data type, + * like a pointer returned by `malloc` (but the core can use any + * method to allocate the buffer, not necessarily `malloc`). + * + * The size of this buffer is in the \c persistent_data_size field of + * this structure. + * + * Before the driver is initialized for the first time, the content of + * the persistent data is all-bits-zero. After a driver upgrade, if the + * size of the persistent data has increased, the original data is padded + * on the right with zeros; if the size has decreased, the original data + * is truncated to the new size. + * + * This pointer is to read-only data. Only a few driver functions are + * allowed to modify the persistent data. These functions receive a + * writable pointer. These functions are: + * - psa_drv_se_t::p_init + * - psa_drv_se_key_management_t::p_allocate + * - psa_drv_se_key_management_t::p_destroy + * + * The PSA Cryptography core saves the persistent data from one + * session to the next. It does this before returning from API functions + * that call a driver method that is allowed to modify the persistent + * data, specifically: + * - psa_crypto_init() causes a call to psa_drv_se_t::p_init, and may call + * psa_drv_se_key_management_t::p_destroy to complete an action + * that was interrupted by a power failure. + * - Key creation functions cause a call to + * psa_drv_se_key_management_t::p_allocate, and may cause a call to + * psa_drv_se_key_management_t::p_destroy in case an error occurs. + * - psa_destroy_key() causes a call to + * psa_drv_se_key_management_t::p_destroy. + */ + const void *const MBEDTLS_PRIVATE(persistent_data); + + /** The size of \c persistent_data in bytes. + * + * This is always equal to the value of the `persistent_data_size` field + * of the ::psa_drv_se_t structure when the driver is registered. + */ + const size_t MBEDTLS_PRIVATE(persistent_data_size); + + /** Driver transient data. + * + * The core initializes this value to 0 and does not read or modify it + * afterwards. The driver may store whatever it wants in this field. + */ + uintptr_t MBEDTLS_PRIVATE(transient_data); +} psa_drv_se_context_t; + +/** \brief A driver initialization function. + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] persistent_data A pointer to the persistent data + * that allows writing. + * \param location The location value for which this driver + * is registered. The driver will be invoked + * for all keys whose lifetime is in this + * location. + * + * \retval #PSA_SUCCESS + * The driver is operational. + * The core will update the persistent data in storage. + * \return + * Any other return value prevents the driver from being used in + * this session. + * The core will NOT update the persistent data in storage. + */ +typedef psa_status_t (*psa_drv_se_init_t)(psa_drv_se_context_t *drv_context, + void *persistent_data, + psa_key_location_t location); + +#if defined(__DOXYGEN_ONLY__) || !defined(MBEDTLS_PSA_CRYPTO_SE_C) +/* Mbed TLS with secure element support enabled defines this type in + * crypto_types.h because it is also visible to applications through an + * implementation-specific extension. + * For the PSA Cryptography specification, this type is only visible + * via crypto_se_driver.h. */ +/** An internal designation of a key slot between the core part of the + * PSA Crypto implementation and the driver. The meaning of this value + * is driver-dependent. */ +typedef uint64_t psa_key_slot_number_t; +#endif /* __DOXYGEN_ONLY__ || !MBEDTLS_PSA_CRYPTO_SE_C */ + +/**@}*/ + +/** \defgroup se_mac Secure Element Message Authentication Codes + * Generation and authentication of Message Authentication Codes (MACs) using + * a secure element can be done either as a single function call (via the + * `psa_drv_se_mac_generate_t` or `psa_drv_se_mac_verify_t` functions), or in + * parts using the following sequence: + * - `psa_drv_se_mac_setup_t` + * - `psa_drv_se_mac_update_t` + * - `psa_drv_se_mac_update_t` + * - ... + * - `psa_drv_se_mac_finish_t` or `psa_drv_se_mac_finish_verify_t` + * + * If a previously started secure element MAC operation needs to be terminated, + * it should be done so by the `psa_drv_se_mac_abort_t`. Failure to do so may + * result in allocated resources not being freed or in other undefined + * behavior. + */ +/**@{*/ +/** \brief A function that starts a secure element MAC operation for a PSA + * Crypto Driver implementation + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] op_context A structure that will contain the + * hardware-specific MAC context + * \param[in] key_slot The slot of the key to be used for the + * operation + * \param[in] algorithm The algorithm to be used to underly the MAC + * operation + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_mac_setup_t)(psa_drv_se_context_t *drv_context, + void *op_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t algorithm); + +/** \brief A function that continues a previously started secure element MAC + * operation + * + * \param[in,out] op_context A hardware-specific structure for the + * previously-established MAC operation to be + * updated + * \param[in] p_input A buffer containing the message to be appended + * to the MAC operation + * \param[in] input_length The size in bytes of the input message buffer + */ +typedef psa_status_t (*psa_drv_se_mac_update_t)(void *op_context, + const uint8_t *p_input, + size_t input_length); + +/** \brief a function that completes a previously started secure element MAC + * operation by returning the resulting MAC. + * + * \param[in,out] op_context A hardware-specific structure for the + * previously started MAC operation to be + * finished + * \param[out] p_mac A buffer where the generated MAC will be + * placed + * \param[in] mac_size The size in bytes of the buffer that has been + * allocated for the `output` buffer + * \param[out] p_mac_length After completion, will contain the number of + * bytes placed in the `p_mac` buffer + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_mac_finish_t)(void *op_context, + uint8_t *p_mac, + size_t mac_size, + size_t *p_mac_length); + +/** \brief A function that completes a previously started secure element MAC + * operation by comparing the resulting MAC against a provided value + * + * \param[in,out] op_context A hardware-specific structure for the previously + * started MAC operation to be finished + * \param[in] p_mac The MAC value against which the resulting MAC + * will be compared against + * \param[in] mac_length The size in bytes of the value stored in `p_mac` + * + * \retval #PSA_SUCCESS + * The operation completed successfully and the MACs matched each + * other + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The operation completed successfully, but the calculated MAC did + * not match the provided MAC + */ +typedef psa_status_t (*psa_drv_se_mac_finish_verify_t)(void *op_context, + const uint8_t *p_mac, + size_t mac_length); + +/** \brief A function that aborts a previous started secure element MAC + * operation + * + * \param[in,out] op_context A hardware-specific structure for the previously + * started MAC operation to be aborted + */ +typedef psa_status_t (*psa_drv_se_mac_abort_t)(void *op_context); + +/** \brief A function that performs a secure element MAC operation in one + * command and returns the calculated MAC + * + * \param[in,out] drv_context The driver context structure. + * \param[in] p_input A buffer containing the message to be MACed + * \param[in] input_length The size in bytes of `p_input` + * \param[in] key_slot The slot of the key to be used + * \param[in] alg The algorithm to be used to underlie the MAC + * operation + * \param[out] p_mac A buffer where the generated MAC will be + * placed + * \param[in] mac_size The size in bytes of the `p_mac` buffer + * \param[out] p_mac_length After completion, will contain the number of + * bytes placed in the `output` buffer + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_mac_generate_t)(psa_drv_se_context_t *drv_context, + const uint8_t *p_input, + size_t input_length, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + uint8_t *p_mac, + size_t mac_size, + size_t *p_mac_length); + +/** \brief A function that performs a secure element MAC operation in one + * command and compares the resulting MAC against a provided value + * + * \param[in,out] drv_context The driver context structure. + * \param[in] p_input A buffer containing the message to be MACed + * \param[in] input_length The size in bytes of `input` + * \param[in] key_slot The slot of the key to be used + * \param[in] alg The algorithm to be used to underlie the MAC + * operation + * \param[in] p_mac The MAC value against which the resulting MAC will + * be compared against + * \param[in] mac_length The size in bytes of `mac` + * + * \retval #PSA_SUCCESS + * The operation completed successfully and the MACs matched each + * other + * \retval #PSA_ERROR_INVALID_SIGNATURE + * The operation completed successfully, but the calculated MAC did + * not match the provided MAC + */ +typedef psa_status_t (*psa_drv_se_mac_verify_t)(psa_drv_se_context_t *drv_context, + const uint8_t *p_input, + size_t input_length, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + const uint8_t *p_mac, + size_t mac_length); + +/** \brief A struct containing all of the function pointers needed to + * perform secure element MAC operations + * + * PSA Crypto API implementations should populate the table as appropriate + * upon startup. + * + * If one of the functions is not implemented (such as + * `psa_drv_se_mac_generate_t`), it should be set to NULL. + * + * Driver implementers should ensure that they implement all of the functions + * that make sense for their hardware, and that they provide a full solution + * (for example, if they support `p_setup`, they should also support + * `p_update` and at least one of `p_finish` or `p_finish_verify`). + * + */ +typedef struct { + /**The size in bytes of the hardware-specific secure element MAC context + * structure + */ + size_t MBEDTLS_PRIVATE(context_size); + /** Function that performs a MAC setup operation + */ + psa_drv_se_mac_setup_t MBEDTLS_PRIVATE(p_setup); + /** Function that performs a MAC update operation + */ + psa_drv_se_mac_update_t MBEDTLS_PRIVATE(p_update); + /** Function that completes a MAC operation + */ + psa_drv_se_mac_finish_t MBEDTLS_PRIVATE(p_finish); + /** Function that completes a MAC operation with a verify check + */ + psa_drv_se_mac_finish_verify_t MBEDTLS_PRIVATE(p_finish_verify); + /** Function that aborts a previously started MAC operation + */ + psa_drv_se_mac_abort_t MBEDTLS_PRIVATE(p_abort); + /** Function that performs a MAC operation in one call + */ + psa_drv_se_mac_generate_t MBEDTLS_PRIVATE(p_mac); + /** Function that performs a MAC and verify operation in one call + */ + psa_drv_se_mac_verify_t MBEDTLS_PRIVATE(p_mac_verify); +} psa_drv_se_mac_t; +/**@}*/ + +/** \defgroup se_cipher Secure Element Symmetric Ciphers + * + * Encryption and Decryption using secure element keys in block modes other + * than ECB must be done in multiple parts, using the following flow: + * - `psa_drv_se_cipher_setup_t` + * - `psa_drv_se_cipher_set_iv_t` (optional depending upon block mode) + * - `psa_drv_se_cipher_update_t` + * - `psa_drv_se_cipher_update_t` + * - ... + * - `psa_drv_se_cipher_finish_t` + * + * If a previously started secure element Cipher operation needs to be + * terminated, it should be done so by the `psa_drv_se_cipher_abort_t`. Failure + * to do so may result in allocated resources not being freed or in other + * undefined behavior. + * + * In situations where a PSA Cryptographic API implementation is using a block + * mode not-supported by the underlying hardware or driver, it can construct + * the block mode itself, while calling the `psa_drv_se_cipher_ecb_t` function + * for the cipher operations. + */ +/**@{*/ + +/** \brief A function that provides the cipher setup function for a + * secure element driver + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] op_context A structure that will contain the + * hardware-specific cipher context. + * \param[in] key_slot The slot of the key to be used for the + * operation + * \param[in] algorithm The algorithm to be used in the cipher + * operation + * \param[in] direction Indicates whether the operation is an encrypt + * or decrypt + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + */ +typedef psa_status_t (*psa_drv_se_cipher_setup_t)(psa_drv_se_context_t *drv_context, + void *op_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t algorithm, + psa_encrypt_or_decrypt_t direction); + +/** \brief A function that sets the initialization vector (if + * necessary) for a secure element cipher operation + * + * Rationale: The `psa_se_cipher_*` operation in the PSA Cryptographic API has + * two IV functions: one to set the IV, and one to generate it internally. The + * generate function is not necessary for the drivers to implement as the PSA + * Crypto implementation can do the generation using its RNG features. + * + * \param[in,out] op_context A structure that contains the previously set up + * hardware-specific cipher context + * \param[in] p_iv A buffer containing the initialization vector + * \param[in] iv_length The size (in bytes) of the `p_iv` buffer + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_cipher_set_iv_t)(void *op_context, + const uint8_t *p_iv, + size_t iv_length); + +/** \brief A function that continues a previously started secure element cipher + * operation + * + * \param[in,out] op_context A hardware-specific structure for the + * previously started cipher operation + * \param[in] p_input A buffer containing the data to be + * encrypted/decrypted + * \param[in] input_size The size in bytes of the buffer pointed to + * by `p_input` + * \param[out] p_output The caller-allocated buffer where the + * output will be placed + * \param[in] output_size The allocated size in bytes of the + * `p_output` buffer + * \param[out] p_output_length After completion, will contain the number + * of bytes placed in the `p_output` buffer + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_cipher_update_t)(void *op_context, + const uint8_t *p_input, + size_t input_size, + uint8_t *p_output, + size_t output_size, + size_t *p_output_length); + +/** \brief A function that completes a previously started secure element cipher + * operation + * + * \param[in,out] op_context A hardware-specific structure for the + * previously started cipher operation + * \param[out] p_output The caller-allocated buffer where the output + * will be placed + * \param[in] output_size The allocated size in bytes of the `p_output` + * buffer + * \param[out] p_output_length After completion, will contain the number of + * bytes placed in the `p_output` buffer + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_cipher_finish_t)(void *op_context, + uint8_t *p_output, + size_t output_size, + size_t *p_output_length); + +/** \brief A function that aborts a previously started secure element cipher + * operation + * + * \param[in,out] op_context A hardware-specific structure for the + * previously started cipher operation + */ +typedef psa_status_t (*psa_drv_se_cipher_abort_t)(void *op_context); + +/** \brief A function that performs the ECB block mode for secure element + * cipher operations + * + * Note: this function should only be used with implementations that do not + * provide a needed higher-level operation. + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot The slot of the key to be used for the operation + * \param[in] algorithm The algorithm to be used in the cipher operation + * \param[in] direction Indicates whether the operation is an encrypt or + * decrypt + * \param[in] p_input A buffer containing the data to be + * encrypted/decrypted + * \param[in] input_size The size in bytes of the buffer pointed to by + * `p_input` + * \param[out] p_output The caller-allocated buffer where the output + * will be placed + * \param[in] output_size The allocated size in bytes of the `p_output` + * buffer + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + */ +typedef psa_status_t (*psa_drv_se_cipher_ecb_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t algorithm, + psa_encrypt_or_decrypt_t direction, + const uint8_t *p_input, + size_t input_size, + uint8_t *p_output, + size_t output_size); + +/** + * \brief A struct containing all of the function pointers needed to implement + * cipher operations using secure elements. + * + * PSA Crypto API implementations should populate instances of the table as + * appropriate upon startup or at build time. + * + * If one of the functions is not implemented (such as + * `psa_drv_se_cipher_ecb_t`), it should be set to NULL. + */ +typedef struct { + /** The size in bytes of the hardware-specific secure element cipher + * context structure + */ + size_t MBEDTLS_PRIVATE(context_size); + /** Function that performs a cipher setup operation */ + psa_drv_se_cipher_setup_t MBEDTLS_PRIVATE(p_setup); + /** Function that sets a cipher IV (if necessary) */ + psa_drv_se_cipher_set_iv_t MBEDTLS_PRIVATE(p_set_iv); + /** Function that performs a cipher update operation */ + psa_drv_se_cipher_update_t MBEDTLS_PRIVATE(p_update); + /** Function that completes a cipher operation */ + psa_drv_se_cipher_finish_t MBEDTLS_PRIVATE(p_finish); + /** Function that aborts a cipher operation */ + psa_drv_se_cipher_abort_t MBEDTLS_PRIVATE(p_abort); + /** Function that performs ECB mode for a cipher operation + * (Danger: ECB mode should not be used directly by clients of the PSA + * Crypto Client API) + */ + psa_drv_se_cipher_ecb_t MBEDTLS_PRIVATE(p_ecb); +} psa_drv_se_cipher_t; + +/**@}*/ + +/** \defgroup se_asymmetric Secure Element Asymmetric Cryptography + * + * Since the amount of data that can (or should) be encrypted or signed using + * asymmetric keys is limited by the key size, asymmetric key operations using + * keys in a secure element must be done in single function calls. + */ +/**@{*/ + +/** + * \brief A function that signs a hash or short message with a private key in + * a secure element + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Key slot of an asymmetric key pair + * \param[in] alg A signature algorithm that is compatible + * with the type of `key` + * \param[in] p_hash The hash to sign + * \param[in] hash_length Size of the `p_hash` buffer in bytes + * \param[out] p_signature Buffer where the signature is to be written + * \param[in] signature_size Size of the `p_signature` buffer in bytes + * \param[out] p_signature_length On success, the number of bytes + * that make up the returned signature value + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_asymmetric_sign_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + const uint8_t *p_hash, + size_t hash_length, + uint8_t *p_signature, + size_t signature_size, + size_t *p_signature_length); + +/** + * \brief A function that verifies the signature a hash or short message using + * an asymmetric public key in a secure element + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Key slot of a public key or an asymmetric key + * pair + * \param[in] alg A signature algorithm that is compatible with + * the type of `key` + * \param[in] p_hash The hash whose signature is to be verified + * \param[in] hash_length Size of the `p_hash` buffer in bytes + * \param[in] p_signature Buffer containing the signature to verify + * \param[in] signature_length Size of the `p_signature` buffer in bytes + * + * \retval #PSA_SUCCESS + * The signature is valid. + */ +typedef psa_status_t (*psa_drv_se_asymmetric_verify_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + const uint8_t *p_hash, + size_t hash_length, + const uint8_t *p_signature, + size_t signature_length); + +/** + * \brief A function that encrypts a short message with an asymmetric public + * key in a secure element + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Key slot of a public key or an asymmetric key + * pair + * \param[in] alg An asymmetric encryption algorithm that is + * compatible with the type of `key` + * \param[in] p_input The message to encrypt + * \param[in] input_length Size of the `p_input` buffer in bytes + * \param[in] p_salt A salt or label, if supported by the + * encryption algorithm + * If the algorithm does not support a + * salt, pass `NULL`. + * If the algorithm supports an optional + * salt and you do not want to pass a salt, + * pass `NULL`. + * For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + * supported. + * \param[in] salt_length Size of the `p_salt` buffer in bytes + * If `p_salt` is `NULL`, pass 0. + * \param[out] p_output Buffer where the encrypted message is to + * be written + * \param[in] output_size Size of the `p_output` buffer in bytes + * \param[out] p_output_length On success, the number of bytes that make up + * the returned output + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_asymmetric_encrypt_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + const uint8_t *p_input, + size_t input_length, + const uint8_t *p_salt, + size_t salt_length, + uint8_t *p_output, + size_t output_size, + size_t *p_output_length); + +/** + * \brief A function that decrypts a short message with an asymmetric private + * key in a secure element. + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Key slot of an asymmetric key pair + * \param[in] alg An asymmetric encryption algorithm that is + * compatible with the type of `key` + * \param[in] p_input The message to decrypt + * \param[in] input_length Size of the `p_input` buffer in bytes + * \param[in] p_salt A salt or label, if supported by the + * encryption algorithm + * If the algorithm does not support a + * salt, pass `NULL`. + * If the algorithm supports an optional + * salt and you do not want to pass a salt, + * pass `NULL`. + * For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + * supported. + * \param[in] salt_length Size of the `p_salt` buffer in bytes + * If `p_salt` is `NULL`, pass 0. + * \param[out] p_output Buffer where the decrypted message is to + * be written + * \param[in] output_size Size of the `p_output` buffer in bytes + * \param[out] p_output_length On success, the number of bytes + * that make up the returned output + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_asymmetric_decrypt_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t alg, + const uint8_t *p_input, + size_t input_length, + const uint8_t *p_salt, + size_t salt_length, + uint8_t *p_output, + size_t output_size, + size_t *p_output_length); + +/** + * \brief A struct containing all of the function pointers needed to implement + * asymmetric cryptographic operations using secure elements. + * + * PSA Crypto API implementations should populate instances of the table as + * appropriate upon startup or at build time. + * + * If one of the functions is not implemented, it should be set to NULL. + */ +typedef struct { + /** Function that performs an asymmetric sign operation */ + psa_drv_se_asymmetric_sign_t MBEDTLS_PRIVATE(p_sign); + /** Function that performs an asymmetric verify operation */ + psa_drv_se_asymmetric_verify_t MBEDTLS_PRIVATE(p_verify); + /** Function that performs an asymmetric encrypt operation */ + psa_drv_se_asymmetric_encrypt_t MBEDTLS_PRIVATE(p_encrypt); + /** Function that performs an asymmetric decrypt operation */ + psa_drv_se_asymmetric_decrypt_t MBEDTLS_PRIVATE(p_decrypt); +} psa_drv_se_asymmetric_t; + +/**@}*/ + +/** \defgroup se_aead Secure Element Authenticated Encryption with Additional Data + * Authenticated Encryption with Additional Data (AEAD) operations with secure + * elements must be done in one function call. While this creates a burden for + * implementers as there must be sufficient space in memory for the entire + * message, it prevents decrypted data from being made available before the + * authentication operation is complete and the data is known to be authentic. + */ +/**@{*/ + +/** \brief A function that performs a secure element authenticated encryption + * operation + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Slot containing the key to use. + * \param[in] algorithm The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(`alg`) is true) + * \param[in] p_nonce Nonce or IV to use + * \param[in] nonce_length Size of the `p_nonce` buffer in bytes + * \param[in] p_additional_data Additional data that will be + * authenticated but not encrypted + * \param[in] additional_data_length Size of `p_additional_data` in bytes + * \param[in] p_plaintext Data that will be authenticated and + * encrypted + * \param[in] plaintext_length Size of `p_plaintext` in bytes + * \param[out] p_ciphertext Output buffer for the authenticated and + * encrypted data. The additional data is + * not part of this output. For algorithms + * where the encrypted data and the + * authentication tag are defined as + * separate outputs, the authentication + * tag is appended to the encrypted data. + * \param[in] ciphertext_size Size of the `p_ciphertext` buffer in + * bytes + * \param[out] p_ciphertext_length On success, the size of the output in + * the `p_ciphertext` buffer + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_aead_encrypt_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t algorithm, + const uint8_t *p_nonce, + size_t nonce_length, + const uint8_t *p_additional_data, + size_t additional_data_length, + const uint8_t *p_plaintext, + size_t plaintext_length, + uint8_t *p_ciphertext, + size_t ciphertext_size, + size_t *p_ciphertext_length); + +/** A function that performs a secure element authenticated decryption operation + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key_slot Slot containing the key to use + * \param[in] algorithm The AEAD algorithm to compute + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(`alg`) is true) + * \param[in] p_nonce Nonce or IV to use + * \param[in] nonce_length Size of the `p_nonce` buffer in bytes + * \param[in] p_additional_data Additional data that has been + * authenticated but not encrypted + * \param[in] additional_data_length Size of `p_additional_data` in bytes + * \param[in] p_ciphertext Data that has been authenticated and + * encrypted. + * For algorithms where the encrypted data + * and the authentication tag are defined + * as separate inputs, the buffer must + * contain the encrypted data followed by + * the authentication tag. + * \param[in] ciphertext_length Size of `p_ciphertext` in bytes + * \param[out] p_plaintext Output buffer for the decrypted data + * \param[in] plaintext_size Size of the `p_plaintext` buffer in + * bytes + * \param[out] p_plaintext_length On success, the size of the output in + * the `p_plaintext` buffer + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_aead_decrypt_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + psa_algorithm_t algorithm, + const uint8_t *p_nonce, + size_t nonce_length, + const uint8_t *p_additional_data, + size_t additional_data_length, + const uint8_t *p_ciphertext, + size_t ciphertext_length, + uint8_t *p_plaintext, + size_t plaintext_size, + size_t *p_plaintext_length); + +/** + * \brief A struct containing all of the function pointers needed to implement + * secure element Authenticated Encryption with Additional Data operations + * + * PSA Crypto API implementations should populate instances of the table as + * appropriate upon startup. + * + * If one of the functions is not implemented, it should be set to NULL. + */ +typedef struct { + /** Function that performs the AEAD encrypt operation */ + psa_drv_se_aead_encrypt_t MBEDTLS_PRIVATE(p_encrypt); + /** Function that performs the AEAD decrypt operation */ + psa_drv_se_aead_decrypt_t MBEDTLS_PRIVATE(p_decrypt); +} psa_drv_se_aead_t; +/**@}*/ + +/** \defgroup se_key_management Secure Element Key Management + * Currently, key management is limited to importing keys in the clear, + * destroying keys, and exporting keys in the clear. + * Whether a key may be exported is determined by the key policies in place + * on the key slot. + */ +/**@{*/ + +/** An enumeration indicating how a key is created. + */ +typedef enum { + PSA_KEY_CREATION_IMPORT, /**< During psa_import_key() */ + PSA_KEY_CREATION_GENERATE, /**< During psa_generate_key() */ + PSA_KEY_CREATION_DERIVE, /**< During psa_key_derivation_output_key() */ + PSA_KEY_CREATION_COPY, /**< During psa_copy_key() */ + +#ifndef __DOXYGEN_ONLY__ + /** A key is being registered with mbedtls_psa_register_se_key(). + * + * The core only passes this value to + * psa_drv_se_key_management_t::p_validate_slot_number, not to + * psa_drv_se_key_management_t::p_allocate. The call to + * `p_validate_slot_number` is not followed by any other call to the + * driver: the key is considered successfully registered if the call to + * `p_validate_slot_number` succeeds, or if `p_validate_slot_number` is + * null. + * + * With this creation method, the driver must return #PSA_SUCCESS if + * the given attributes are compatible with the existing key in the slot, + * and #PSA_ERROR_DOES_NOT_EXIST if the driver can determine that there + * is no key with the specified slot number. + * + * This is an Mbed TLS extension. + */ + PSA_KEY_CREATION_REGISTER, +#endif +} psa_key_creation_method_t; + +/** \brief A function that allocates a slot for a key. + * + * To create a key in a specific slot in a secure element, the core + * first calls this function to determine a valid slot number, + * then calls a function to create the key material in that slot. + * In nominal conditions (that is, if no error occurs), + * the effect of a call to a key creation function in the PSA Cryptography + * API with a lifetime that places the key in a secure element is the + * following: + * -# The core calls psa_drv_se_key_management_t::p_allocate + * (or in some implementations + * psa_drv_se_key_management_t::p_validate_slot_number). The driver + * selects (or validates) a suitable slot number given the key attributes + * and the state of the secure element. + * -# The core calls a key creation function in the driver. + * + * The key creation functions in the PSA Cryptography API are: + * - psa_import_key(), which causes + * a call to `p_allocate` with \p method = #PSA_KEY_CREATION_IMPORT + * then a call to psa_drv_se_key_management_t::p_import. + * - psa_generate_key(), which causes + * a call to `p_allocate` with \p method = #PSA_KEY_CREATION_GENERATE + * then a call to psa_drv_se_key_management_t::p_import. + * - psa_key_derivation_output_key(), which causes + * a call to `p_allocate` with \p method = #PSA_KEY_CREATION_DERIVE + * then a call to psa_drv_se_key_derivation_t::p_derive. + * - psa_copy_key(), which causes + * a call to `p_allocate` with \p method = #PSA_KEY_CREATION_COPY + * then a call to psa_drv_se_key_management_t::p_export. + * + * In case of errors, other behaviors are possible. + * - If the PSA Cryptography subsystem dies after the first step, + * for example because the device has lost power abruptly, + * the second step may never happen, or may happen after a reset + * and re-initialization. Alternatively, after a reset and + * re-initialization, the core may call + * psa_drv_se_key_management_t::p_destroy on the slot number that + * was allocated (or validated) instead of calling a key creation function. + * - If an error occurs, the core may call + * psa_drv_se_key_management_t::p_destroy on the slot number that + * was allocated (or validated) instead of calling a key creation function. + * + * Errors and system resets also have an impact on the driver's persistent + * data. If a reset happens before the overall key creation process is + * completed (before or after the second step above), it is unspecified + * whether the persistent data after the reset is identical to what it + * was before or after the call to `p_allocate` (or `p_validate_slot_number`). + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] persistent_data A pointer to the persistent data + * that allows writing. + * \param[in] attributes Attributes of the key. + * \param method The way in which the key is being created. + * \param[out] key_slot Slot where the key will be stored. + * This must be a valid slot for a key of the + * chosen type. It must be unoccupied. + * + * \retval #PSA_SUCCESS + * Success. + * The core will record \c *key_slot as the key slot where the key + * is stored and will update the persistent data in storage. + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + */ +typedef psa_status_t (*psa_drv_se_allocate_key_t)( + psa_drv_se_context_t *drv_context, + void *persistent_data, + const psa_key_attributes_t *attributes, + psa_key_creation_method_t method, + psa_key_slot_number_t *key_slot); + +/** \brief A function that determines whether a slot number is valid + * for a key. + * + * To create a key in a specific slot in a secure element, the core + * first calls this function to validate the choice of slot number, + * then calls a function to create the key material in that slot. + * See the documentation of #psa_drv_se_allocate_key_t for more details. + * + * As of the PSA Cryptography API specification version 1.0, there is no way + * for applications to trigger a call to this function. However some + * implementations offer the capability to create or declare a key in + * a specific slot via implementation-specific means, generally for the + * sake of initial device provisioning or onboarding. Such a mechanism may + * be added to a future version of the PSA Cryptography API specification. + * + * This function may update the driver's persistent data through + * \p persistent_data. The core will save the updated persistent data at the + * end of the key creation process. See the description of + * ::psa_drv_se_allocate_key_t for more information. + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] persistent_data A pointer to the persistent data + * that allows writing. + * \param[in] attributes Attributes of the key. + * \param method The way in which the key is being created. + * \param[in] key_slot Slot where the key is to be stored. + * + * \retval #PSA_SUCCESS + * The given slot number is valid for a key with the given + * attributes. + * \retval #PSA_ERROR_INVALID_ARGUMENT + * The given slot number is not valid for a key with the + * given attributes. This includes the case where the slot + * number is not valid at all. + * \retval #PSA_ERROR_ALREADY_EXISTS + * There is already a key with the specified slot number. + * Drivers may choose to return this error from the key + * creation function instead. + */ +typedef psa_status_t (*psa_drv_se_validate_slot_number_t)( + psa_drv_se_context_t *drv_context, + void *persistent_data, + const psa_key_attributes_t *attributes, + psa_key_creation_method_t method, + psa_key_slot_number_t key_slot); + +/** \brief A function that imports a key into a secure element in binary format + * + * This function can support any output from psa_export_key(). Refer to the + * documentation of psa_export_key() for the format for each key type. + * + * \param[in,out] drv_context The driver context structure. + * \param key_slot Slot where the key will be stored. + * This must be a valid slot for a key of the + * chosen type. It must be unoccupied. + * \param[in] attributes The key attributes, including the lifetime, + * the key type and the usage policy. + * Drivers should not access the key size stored + * in the attributes: it may not match the + * data passed in \p data. + * Drivers can call psa_get_key_lifetime(), + * psa_get_key_type(), + * psa_get_key_usage_flags() and + * psa_get_key_algorithm() to access this + * information. + * \param[in] data Buffer containing the key data. + * \param[in] data_length Size of the \p data buffer in bytes. + * \param[out] bits On success, the key size in bits. The driver + * must determine this value after parsing the + * key according to the key type. + * This value is not used if the function fails. + * + * \retval #PSA_SUCCESS + * Success. + */ +typedef psa_status_t (*psa_drv_se_import_key_t)( + psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + const psa_key_attributes_t *attributes, + const uint8_t *data, + size_t data_length, + size_t *bits); + +/** + * \brief A function that destroys a secure element key and restore the slot to + * its default state + * + * This function destroys the content of the key from a secure element. + * Implementations shall make a best effort to ensure that any previous content + * of the slot is unrecoverable. + * + * This function returns the specified slot to its default state. + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] persistent_data A pointer to the persistent data + * that allows writing. + * \param key_slot The key slot to erase. + * + * \retval #PSA_SUCCESS + * The slot's content, if any, has been erased. + */ +typedef psa_status_t (*psa_drv_se_destroy_key_t)( + psa_drv_se_context_t *drv_context, + void *persistent_data, + psa_key_slot_number_t key_slot); + +/** + * \brief A function that exports a secure element key in binary format + * + * The output of this function can be passed to psa_import_key() to + * create an equivalent object. + * + * If a key is created with `psa_import_key()` and then exported with + * this function, it is not guaranteed that the resulting data is + * identical: the implementation may choose a different representation + * of the same key if the format permits it. + * + * This function should generate output in the same format that + * `psa_export_key()` does. Refer to the + * documentation of `psa_export_key()` for the format for each key type. + * + * \param[in,out] drv_context The driver context structure. + * \param[in] key Slot whose content is to be exported. This must + * be an occupied key slot. + * \param[out] p_data Buffer where the key data is to be written. + * \param[in] data_size Size of the `p_data` buffer in bytes. + * \param[out] p_data_length On success, the number of bytes + * that make up the key data. + * + * \retval #PSA_SUCCESS \emptydescription + * \retval #PSA_ERROR_DOES_NOT_EXIST \emptydescription + * \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + * \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + * \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + */ +typedef psa_status_t (*psa_drv_se_export_key_t)(psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key, + uint8_t *p_data, + size_t data_size, + size_t *p_data_length); + +/** + * \brief A function that generates a symmetric or asymmetric key on a secure + * element + * + * If the key type \c type recorded in \p attributes + * is asymmetric (#PSA_KEY_TYPE_IS_ASYMMETRIC(\c type) = 1), + * the driver may export the public key at the time of generation, + * in the format documented for psa_export_public_key() by writing it + * to the \p pubkey buffer. + * This is optional, intended for secure elements that output the + * public key at generation time and that cannot export the public key + * later. Drivers that do not need this feature should leave + * \p *pubkey_length set to 0 and should + * implement the psa_drv_key_management_t::p_export_public function. + * Some implementations do not support this feature, in which case + * \p pubkey is \c NULL and \p pubkey_size is 0. + * + * \param[in,out] drv_context The driver context structure. + * \param key_slot Slot where the key will be stored. + * This must be a valid slot for a key of the + * chosen type. It must be unoccupied. + * \param[in] attributes The key attributes, including the lifetime, + * the key type and size, and the usage policy. + * Drivers can call psa_get_key_lifetime(), + * psa_get_key_type(), psa_get_key_bits(), + * psa_get_key_usage_flags() and + * psa_get_key_algorithm() to access this + * information. + * \param[out] pubkey A buffer where the driver can write the + * public key, when generating an asymmetric + * key pair. + * This is \c NULL when generating a symmetric + * key or if the core does not support + * exporting the public key at generation time. + * \param pubkey_size The size of the `pubkey` buffer in bytes. + * This is 0 when generating a symmetric + * key or if the core does not support + * exporting the public key at generation time. + * \param[out] pubkey_length On entry, this is always 0. + * On success, the number of bytes written to + * \p pubkey. If this is 0 or unchanged on return, + * the core will not read the \p pubkey buffer, + * and will instead call the driver's + * psa_drv_key_management_t::p_export_public + * function to export the public key when needed. + */ +typedef psa_status_t (*psa_drv_se_generate_key_t)( + psa_drv_se_context_t *drv_context, + psa_key_slot_number_t key_slot, + const psa_key_attributes_t *attributes, + uint8_t *pubkey, size_t pubkey_size, size_t *pubkey_length); + +/** + * \brief A struct containing all of the function pointers needed to for secure + * element key management + * + * PSA Crypto API implementations should populate instances of the table as + * appropriate upon startup or at build time. + * + * If one of the functions is not implemented, it should be set to NULL. + */ +typedef struct { + /** Function that allocates a slot for a key. */ + psa_drv_se_allocate_key_t MBEDTLS_PRIVATE(p_allocate); + /** Function that checks the validity of a slot for a key. */ + psa_drv_se_validate_slot_number_t MBEDTLS_PRIVATE(p_validate_slot_number); + /** Function that performs a key import operation */ + psa_drv_se_import_key_t MBEDTLS_PRIVATE(p_import); + /** Function that performs a generation */ + psa_drv_se_generate_key_t MBEDTLS_PRIVATE(p_generate); + /** Function that performs a key destroy operation */ + psa_drv_se_destroy_key_t MBEDTLS_PRIVATE(p_destroy); + /** Function that performs a key export operation */ + psa_drv_se_export_key_t MBEDTLS_PRIVATE(p_export); + /** Function that performs a public key export operation */ + psa_drv_se_export_key_t MBEDTLS_PRIVATE(p_export_public); +} psa_drv_se_key_management_t; + +/**@}*/ + +/** \defgroup driver_derivation Secure Element Key Derivation and Agreement + * Key derivation is the process of generating new key material using an + * existing key and additional parameters, iterating through a basic + * cryptographic function, such as a hash. + * Key agreement is a part of cryptographic protocols that allows two parties + * to agree on the same key value, but starting from different original key + * material. + * The flows are similar, and the PSA Crypto Driver Model uses the same functions + * for both of the flows. + * + * There are two different final functions for the flows, + * `psa_drv_se_key_derivation_derive` and `psa_drv_se_key_derivation_export`. + * `psa_drv_se_key_derivation_derive` is used when the key material should be + * placed in a slot on the hardware and not exposed to the caller. + * `psa_drv_se_key_derivation_export` is used when the key material should be + * returned to the PSA Cryptographic API implementation. + * + * Different key derivation algorithms require a different number of inputs. + * Instead of having an API that takes as input variable length arrays, which + * can be problematic to manage on embedded platforms, the inputs are passed + * to the driver via a function, `psa_drv_se_key_derivation_collateral`, that + * is called multiple times with different `collateral_id`s. Thus, for a key + * derivation algorithm that required 3 parameter inputs, the flow would look + * something like: + * ~~~~~~~~~~~~~{.c} + * psa_drv_se_key_derivation_setup(kdf_algorithm, source_key, dest_key_size_bytes); + * psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_0, + * p_collateral_0, + * collateral_0_size); + * psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_1, + * p_collateral_1, + * collateral_1_size); + * psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_2, + * p_collateral_2, + * collateral_2_size); + * psa_drv_se_key_derivation_derive(); + * ~~~~~~~~~~~~~ + * + * key agreement example: + * ~~~~~~~~~~~~~{.c} + * psa_drv_se_key_derivation_setup(alg, source_key. dest_key_size_bytes); + * psa_drv_se_key_derivation_collateral(DHE_PUBKEY, p_pubkey, pubkey_size); + * psa_drv_se_key_derivation_export(p_session_key, + * session_key_size, + * &session_key_length); + * ~~~~~~~~~~~~~ + */ +/**@{*/ + +/** \brief A function that Sets up a secure element key derivation operation by + * specifying the algorithm and the source key sot + * + * \param[in,out] drv_context The driver context structure. + * \param[in,out] op_context A hardware-specific structure containing any + * context information for the implementation + * \param[in] kdf_alg The algorithm to be used for the key derivation + * \param[in] source_key The key to be used as the source material for + * the key derivation + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_key_derivation_setup_t)(psa_drv_se_context_t *drv_context, + void *op_context, + psa_algorithm_t kdf_alg, + psa_key_slot_number_t source_key); + +/** \brief A function that provides collateral (parameters) needed for a secure + * element key derivation or key agreement operation + * + * Since many key derivation algorithms require multiple parameters, it is + * expected that this function may be called multiple times for the same + * operation, each with a different algorithm-specific `collateral_id` + * + * \param[in,out] op_context A hardware-specific structure containing any + * context information for the implementation + * \param[in] collateral_id An ID for the collateral being provided + * \param[in] p_collateral A buffer containing the collateral data + * \param[in] collateral_size The size in bytes of the collateral + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_key_derivation_collateral_t)(void *op_context, + uint32_t collateral_id, + const uint8_t *p_collateral, + size_t collateral_size); + +/** \brief A function that performs the final secure element key derivation + * step and place the generated key material in a slot + * + * \param[in,out] op_context A hardware-specific structure containing any + * context information for the implementation + * \param[in] dest_key The slot where the generated key material + * should be placed + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_key_derivation_derive_t)(void *op_context, + psa_key_slot_number_t dest_key); + +/** \brief A function that performs the final step of a secure element key + * agreement and place the generated key material in a buffer + * + * \param[out] p_output Buffer in which to place the generated key + * material + * \param[in] output_size The size in bytes of `p_output` + * \param[out] p_output_length Upon success, contains the number of bytes of + * key material placed in `p_output` + * + * \retval #PSA_SUCCESS \emptydescription + */ +typedef psa_status_t (*psa_drv_se_key_derivation_export_t)(void *op_context, + uint8_t *p_output, + size_t output_size, + size_t *p_output_length); + +/** + * \brief A struct containing all of the function pointers needed to for secure + * element key derivation and agreement + * + * PSA Crypto API implementations should populate instances of the table as + * appropriate upon startup. + * + * If one of the functions is not implemented, it should be set to NULL. + */ +typedef struct { + /** The driver-specific size of the key derivation context */ + size_t MBEDTLS_PRIVATE(context_size); + /** Function that performs a key derivation setup */ + psa_drv_se_key_derivation_setup_t MBEDTLS_PRIVATE(p_setup); + /** Function that sets key derivation collateral */ + psa_drv_se_key_derivation_collateral_t MBEDTLS_PRIVATE(p_collateral); + /** Function that performs a final key derivation step */ + psa_drv_se_key_derivation_derive_t MBEDTLS_PRIVATE(p_derive); + /** Function that performs a final key derivation or agreement and + * exports the key */ + psa_drv_se_key_derivation_export_t MBEDTLS_PRIVATE(p_export); +} psa_drv_se_key_derivation_t; + +/**@}*/ + +/** \defgroup se_registration Secure element driver registration + */ +/**@{*/ + +/** A structure containing pointers to all the entry points of a + * secure element driver. + * + * Future versions of this specification may add extra substructures at + * the end of this structure. + */ +typedef struct { + /** The version of the driver HAL that this driver implements. + * This is a protection against loading driver binaries built against + * a different version of this specification. + * Use #PSA_DRV_SE_HAL_VERSION. + */ + uint32_t MBEDTLS_PRIVATE(hal_version); + + /** The size of the driver's persistent data in bytes. + * + * This can be 0 if the driver does not need persistent data. + * + * See the documentation of psa_drv_se_context_t::persistent_data + * for more information about why and how a driver can use + * persistent data. + */ + size_t MBEDTLS_PRIVATE(persistent_data_size); + + /** The driver initialization function. + * + * This function is called once during the initialization of the + * PSA Cryptography subsystem, before any other function of the + * driver is called. If this function returns a failure status, + * the driver will be unusable, at least until the next system reset. + * + * If this field is \c NULL, it is equivalent to a function that does + * nothing and returns #PSA_SUCCESS. + */ + psa_drv_se_init_t MBEDTLS_PRIVATE(p_init); + + const psa_drv_se_key_management_t *MBEDTLS_PRIVATE(key_management); + const psa_drv_se_mac_t *MBEDTLS_PRIVATE(mac); + const psa_drv_se_cipher_t *MBEDTLS_PRIVATE(cipher); + const psa_drv_se_aead_t *MBEDTLS_PRIVATE(aead); + const psa_drv_se_asymmetric_t *MBEDTLS_PRIVATE(asymmetric); + const psa_drv_se_key_derivation_t *MBEDTLS_PRIVATE(derivation); +} psa_drv_se_t; + +/** The current version of the secure element driver HAL. + */ +/* 0.0.0 patchlevel 5 */ +#define PSA_DRV_SE_HAL_VERSION 0x00000005 + +/** Register an external cryptoprocessor (secure element) driver. + * + * This function is only intended to be used by driver code, not by + * application code. In implementations with separation between the + * PSA cryptography module and applications, this function should + * only be available to callers that run in the same memory space as + * the cryptography module, and should not be exposed to applications + * running in a different memory space. + * + * This function may be called before psa_crypto_init(). It is + * implementation-defined whether this function may be called + * after psa_crypto_init(). + * + * \note Implementations store metadata about keys including the lifetime + * value, which contains the driver's location indicator. Therefore, + * from one instantiation of the PSA Cryptography + * library to the next one, if there is a key in storage with a certain + * lifetime value, you must always register the same driver (or an + * updated version that communicates with the same secure element) + * with the same location value. + * + * \param location The location value through which this driver will + * be exposed to applications. + * This driver will be used for all keys such that + * `location == #PSA_KEY_LIFETIME_GET_LOCATION( lifetime )`. + * The value #PSA_KEY_LOCATION_LOCAL_STORAGE is reserved + * and may not be used for drivers. Implementations + * may reserve other values. + * \param[in] methods The method table of the driver. This structure must + * remain valid for as long as the cryptography + * module keeps running. It is typically a global + * constant. + * + * \return #PSA_SUCCESS + * The driver was successfully registered. Applications can now + * use \p location to access keys through the methods passed to + * this function. + * \return #PSA_ERROR_BAD_STATE + * This function was called after the initialization of the + * cryptography module, and this implementation does not support + * driver registration at this stage. + * \return #PSA_ERROR_ALREADY_EXISTS + * There is already a registered driver for this value of \p location. + * \return #PSA_ERROR_INVALID_ARGUMENT + * \p location is a reserved value. + * \return #PSA_ERROR_NOT_SUPPORTED + * `methods->hal_version` is not supported by this implementation. + * \return #PSA_ERROR_INSUFFICIENT_MEMORY + * \return #PSA_ERROR_NOT_PERMITTED + * \return #PSA_ERROR_STORAGE_FAILURE + * \return #PSA_ERROR_DATA_CORRUPT + */ +psa_status_t psa_register_se_driver( + psa_key_location_t location, + const psa_drv_se_t *methods); + +/**@}*/ + +#ifdef __cplusplus +} +#endif + +#endif /* PSA_CRYPTO_SE_DRIVER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_sizes.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_sizes.h new file mode 100644 index 00000000..1bf84de8 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_sizes.h @@ -0,0 +1,1319 @@ +/** + * \file psa/crypto_sizes.h + * + * \brief PSA cryptography module: Mbed TLS buffer size macros + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * This file contains the definitions of macros that are useful to + * compute buffer sizes. The signatures and semantics of these macros + * are standardized, but the definitions are not, because they depend on + * the available algorithms and, in some cases, on permitted tolerances + * on buffer sizes. + * + * In implementations with isolation between the application and the + * cryptography module, implementers should take care to ensure that + * the definitions that are exposed to applications match what the + * module implements. + * + * Macros that compute sizes whose values do not depend on the + * implementation are in crypto.h. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_SIZES_H +#define PSA_CRYPTO_SIZES_H + +/* + * Include the build-time configuration information header. Here, we do not + * include `"mbedtls/build_info.h"` directly but `"psa/build_info.h"`, which + * is basically just an alias to it. This is to ease the maintenance of the + * TF-PSA-Crypto repository which has a different build system and + * configuration. + */ +#include "psa/build_info.h" + +#define PSA_BITS_TO_BYTES(bits) (((bits) + 7u) / 8u) +#define PSA_BYTES_TO_BITS(bytes) ((bytes) * 8u) +#define PSA_MAX_OF_THREE(a, b, c) ((a) <= (b) ? (b) <= (c) ? \ + (c) : (b) : (a) <= (c) ? (c) : (a)) + +#define PSA_ROUND_UP_TO_MULTIPLE(block_size, length) \ + (((length) + (block_size) - 1) / (block_size) * (block_size)) + +/** The size of the output of psa_hash_finish(), in bytes. + * + * This is also the hash size that psa_hash_verify() expects. + * + * \param alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p alg) is true), or an HMAC algorithm + * (#PSA_ALG_HMAC(\c hash_alg) where \c hash_alg is a + * hash algorithm). + * + * \return The hash size for the specified hash algorithm. + * If the hash algorithm is not recognized, return 0. + */ +#define PSA_HASH_LENGTH(alg) \ + ( \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_MD5 ? 16u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_RIPEMD160 ? 20u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_1 ? 20u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_224 ? 28u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_256 ? 32u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_384 ? 48u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_224 ? 28u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_256 ? 32u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_224 ? 28u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_256 ? 32u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_384 ? 48u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_512 ? 64u : \ + 0u) + +/** The input block size of a hash algorithm, in bytes. + * + * Hash algorithms process their input data in blocks. Hash operations will + * retain any partial blocks until they have enough input to fill the block or + * until the operation is finished. + * This affects the output from psa_hash_suspend(). + * + * \param alg A hash algorithm (\c PSA_ALG_XXX value such that + * PSA_ALG_IS_HASH(\p alg) is true). + * + * \return The block size in bytes for the specified hash algorithm. + * If the hash algorithm is not recognized, return 0. + * An implementation can return either 0 or the correct size for a + * hash algorithm that it recognizes, but does not support. + */ +#define PSA_HASH_BLOCK_LENGTH(alg) \ + ( \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_MD5 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_RIPEMD160 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_1 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_224 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_256 ? 64u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_384 ? 128u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512 ? 128u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_224 ? 128u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_256 ? 128u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_224 ? 144u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_256 ? 136u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_384 ? 104u : \ + PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_512 ? 72u : \ + 0u) + +/** \def PSA_HASH_MAX_SIZE + * + * Maximum size of a hash. + * + * This macro expands to a compile-time constant integer. This value + * is the maximum size of a hash in bytes. + */ +/* Note: for HMAC-SHA-3, the block size is 144 bytes for HMAC-SHA3-224, + * 136 bytes for HMAC-SHA3-256, 104 bytes for SHA3-384, 72 bytes for + * HMAC-SHA3-512. */ +/* Note: PSA_HASH_MAX_SIZE should be kept in sync with MBEDTLS_MD_MAX_SIZE, + * see the note on MBEDTLS_MD_MAX_SIZE for details. */ +#if defined(PSA_WANT_ALG_SHA3_224) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 144u +#elif defined(PSA_WANT_ALG_SHA3_256) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 136u +#elif defined(PSA_WANT_ALG_SHA_512) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 128u +#elif defined(PSA_WANT_ALG_SHA_384) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 128u +#elif defined(PSA_WANT_ALG_SHA3_384) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 104u +#elif defined(PSA_WANT_ALG_SHA3_512) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 72u +#elif defined(PSA_WANT_ALG_SHA_256) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 64u +#elif defined(PSA_WANT_ALG_SHA_224) +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 64u +#else /* SHA-1 or smaller */ +#define PSA_HMAC_MAX_HASH_BLOCK_SIZE 64u +#endif + +#if defined(PSA_WANT_ALG_SHA_512) || defined(PSA_WANT_ALG_SHA3_512) +#define PSA_HASH_MAX_SIZE 64u +#elif defined(PSA_WANT_ALG_SHA_384) || defined(PSA_WANT_ALG_SHA3_384) +#define PSA_HASH_MAX_SIZE 48u +#elif defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA3_256) +#define PSA_HASH_MAX_SIZE 32u +#elif defined(PSA_WANT_ALG_SHA_224) || defined(PSA_WANT_ALG_SHA3_224) +#define PSA_HASH_MAX_SIZE 28u +#else /* SHA-1 or smaller */ +#define PSA_HASH_MAX_SIZE 20u +#endif + +/** \def PSA_MAC_MAX_SIZE + * + * Maximum size of a MAC. + * + * This macro expands to a compile-time constant integer. This value + * is the maximum size of a MAC in bytes. + */ +/* All non-HMAC MACs have a maximum size that's smaller than the + * minimum possible value of PSA_HASH_MAX_SIZE in this implementation. */ +/* Note that the encoding of truncated MAC algorithms limits this value + * to 64 bytes. + */ +#define PSA_MAC_MAX_SIZE PSA_HASH_MAX_SIZE + +/** The length of a tag for an AEAD algorithm, in bytes. + * + * This macro can be used to allocate a buffer of sufficient size to store the + * tag output from psa_aead_finish(). + * + * See also #PSA_AEAD_TAG_MAX_SIZE. + * + * \param key_type The type of the AEAD key. + * \param key_bits The size of the AEAD key in bits. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \return The tag length for the specified algorithm and key. + * If the AEAD algorithm does not have an identified + * tag that can be distinguished from the rest of + * the ciphertext, return 0. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_AEAD_TAG_LENGTH(key_type, key_bits, alg) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 ? \ + PSA_ALG_AEAD_GET_TAG_LENGTH(alg) : \ + ((void) (key_bits), 0u)) + +/** The maximum tag size for all supported AEAD algorithms, in bytes. + * + * See also #PSA_AEAD_TAG_LENGTH(\p key_type, \p key_bits, \p alg). + */ +#define PSA_AEAD_TAG_MAX_SIZE 16u + +/* The maximum size of an RSA key on this implementation, in bits. + * This is a vendor-specific macro. + * + * Mbed TLS does not set a hard limit on the size of RSA keys: any key + * whose parameters fit in a bignum is accepted. However large keys can + * induce a large memory usage and long computation times. Unlike other + * auxiliary macros in this file and in crypto.h, which reflect how the + * library is configured, this macro defines how the library is + * configured. This implementation refuses to import or generate an + * RSA key whose size is larger than the value defined here. + * + * Note that an implementation may set different size limits for different + * operations, and does not need to accept all key sizes up to the limit. */ +#define PSA_VENDOR_RSA_MAX_KEY_BITS 4096u + +/* The minimum size of an RSA key on this implementation, in bits. + * This is a vendor-specific macro. + * + * Limits RSA key generation to a minimum due to avoid accidental misuse. + * This value cannot be less than 128 bits. + */ +#if defined(MBEDTLS_RSA_GEN_KEY_MIN_BITS) +#define PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS MBEDTLS_RSA_GEN_KEY_MIN_BITS +#else +#define PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS 1024 +#endif + +/* The maximum size of an DH key on this implementation, in bits. + * This is a vendor-specific macro.*/ +#if defined(PSA_WANT_DH_RFC7919_8192) +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 8192u +#elif defined(PSA_WANT_DH_RFC7919_6144) +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 6144u +#elif defined(PSA_WANT_DH_RFC7919_4096) +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 4096u +#elif defined(PSA_WANT_DH_RFC7919_3072) +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 3072u +#elif defined(PSA_WANT_DH_RFC7919_2048) +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 2048u +#else +#define PSA_VENDOR_FFDH_MAX_KEY_BITS 0u +#endif + +/* The maximum size of an ECC key on this implementation, in bits. + * This is a vendor-specific macro. */ +#if defined(PSA_WANT_ECC_SECP_R1_521) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 521u +#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 512u +#elif defined(PSA_WANT_ECC_MONTGOMERY_448) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 448u +#elif defined(PSA_WANT_ECC_SECP_R1_384) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 384u +#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 384u +#elif defined(PSA_WANT_ECC_SECP_R1_256) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 256u +#elif defined(PSA_WANT_ECC_SECP_K1_256) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 256u +#elif defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 256u +#elif defined(PSA_WANT_ECC_MONTGOMERY_255) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 255u +#elif defined(PSA_WANT_ECC_SECP_R1_224) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 224u +#elif defined(PSA_WANT_ECC_SECP_K1_224) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 224u +#elif defined(PSA_WANT_ECC_SECP_R1_192) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 192u +#elif defined(PSA_WANT_ECC_SECP_K1_192) +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 192u +#else +#define PSA_VENDOR_ECC_MAX_CURVE_BITS 0u +#endif + +/** This macro returns the maximum supported length of the PSK for the + * TLS-1.2 PSK-to-MS key derivation + * (#PSA_ALG_TLS12_PSK_TO_MS(\c hash_alg)). + * + * The maximum supported length does not depend on the chosen hash algorithm. + * + * Quoting RFC 4279, Sect 5.3: + * TLS implementations supporting these ciphersuites MUST support + * arbitrary PSK identities up to 128 octets in length, and arbitrary + * PSKs up to 64 octets in length. Supporting longer identities and + * keys is RECOMMENDED. + * + * Therefore, no implementation should define a value smaller than 64 + * for #PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE. + */ +#define PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE 128u + +/* The expected size of input passed to psa_tls12_ecjpake_to_pms_input, + * which is expected to work with P-256 curve only. */ +#define PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE 65u + +/* The size of a serialized K.X coordinate to be used in + * psa_tls12_ecjpake_to_pms_input. This function only accepts the P-256 + * curve. */ +#define PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE 32u + +/* The maximum number of iterations for PBKDF2 on this implementation, in bits. + * This is a vendor-specific macro. This can be configured if necessary */ +#define PSA_VENDOR_PBKDF2_MAX_ITERATIONS 0xffffffffU + +/** The maximum size of a block cipher. */ +#define PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE 16u + +/** The size of the output of psa_mac_sign_finish(), in bytes. + * + * This is also the MAC size that psa_mac_verify_finish() expects. + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type The type of the MAC key. + * \param key_bits The size of the MAC key in bits. + * \param alg A MAC algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_MAC(\p alg) is true). + * + * \return The MAC size for the specified algorithm with + * the specified key parameters. + * \return 0 if the MAC algorithm is not recognized. + * \return Either 0 or the correct size for a MAC algorithm that + * the implementation recognizes, but does not support. + * \return Unspecified if the key parameters are not consistent + * with the algorithm. + */ +#define PSA_MAC_LENGTH(key_type, key_bits, alg) \ + ((alg) & PSA_ALG_MAC_TRUNCATION_MASK ? PSA_MAC_TRUNCATED_LENGTH(alg) : \ + PSA_ALG_IS_HMAC(alg) ? PSA_HASH_LENGTH(PSA_ALG_HMAC_GET_HASH(alg)) : \ + PSA_ALG_IS_BLOCK_CIPHER_MAC(alg) ? PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) : \ + ((void) (key_type), (void) (key_bits), 0u)) + +/** The maximum size of the output of psa_aead_encrypt(), in bytes. + * + * If the size of the ciphertext buffer is at least this large, it is + * guaranteed that psa_aead_encrypt() will not fail due to an + * insufficient buffer size. Depending on the algorithm, the actual size of + * the ciphertext may be smaller. + * + * See also #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length). + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is + * compatible with algorithm \p alg. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * \param plaintext_length Size of the plaintext in bytes. + * + * \return The AEAD ciphertext size for the specified + * algorithm. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, plaintext_length) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 ? \ + (plaintext_length) + PSA_ALG_AEAD_GET_TAG_LENGTH(alg) : \ + 0u) + +/** A sufficient output buffer size for psa_aead_encrypt(), for any of the + * supported key types and AEAD algorithms. + * + * If the size of the ciphertext buffer is at least this large, it is guaranteed + * that psa_aead_encrypt() will not fail due to an insufficient buffer size. + * + * \note This macro returns a compile-time constant if its arguments are + * compile-time constants. + * + * See also #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\p key_type, \p alg, + * \p plaintext_length). + * + * \param plaintext_length Size of the plaintext in bytes. + * + * \return A sufficient output buffer size for any of the + * supported key types and AEAD algorithms. + * + */ +#define PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(plaintext_length) \ + ((plaintext_length) + PSA_AEAD_TAG_MAX_SIZE) + + +/** The maximum size of the output of psa_aead_decrypt(), in bytes. + * + * If the size of the plaintext buffer is at least this large, it is + * guaranteed that psa_aead_decrypt() will not fail due to an + * insufficient buffer size. Depending on the algorithm, the actual size of + * the plaintext may be smaller. + * + * See also #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length). + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is + * compatible with algorithm \p alg. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * \param ciphertext_length Size of the plaintext in bytes. + * + * \return The AEAD ciphertext size for the specified + * algorithm. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_AEAD_DECRYPT_OUTPUT_SIZE(key_type, alg, ciphertext_length) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 && \ + (ciphertext_length) > PSA_ALG_AEAD_GET_TAG_LENGTH(alg) ? \ + (ciphertext_length) - PSA_ALG_AEAD_GET_TAG_LENGTH(alg) : \ + 0u) + +/** A sufficient output buffer size for psa_aead_decrypt(), for any of the + * supported key types and AEAD algorithms. + * + * If the size of the plaintext buffer is at least this large, it is guaranteed + * that psa_aead_decrypt() will not fail due to an insufficient buffer size. + * + * \note This macro returns a compile-time constant if its arguments are + * compile-time constants. + * + * See also #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\p key_type, \p alg, + * \p ciphertext_length). + * + * \param ciphertext_length Size of the ciphertext in bytes. + * + * \return A sufficient output buffer size for any of the + * supported key types and AEAD algorithms. + * + */ +#define PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(ciphertext_length) \ + (ciphertext_length) + +/** The default nonce size for an AEAD algorithm, in bytes. + * + * This macro can be used to allocate a buffer of sufficient size to + * store the nonce output from #psa_aead_generate_nonce(). + * + * See also #PSA_AEAD_NONCE_MAX_SIZE. + * + * \note This is not the maximum size of nonce supported as input to + * #psa_aead_set_nonce(), #psa_aead_encrypt() or #psa_aead_decrypt(), + * just the default size that is generated by #psa_aead_generate_nonce(). + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is compatible with + * algorithm \p alg. + * + * \param alg An AEAD algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \return The default nonce size for the specified key type and algorithm. + * If the key type or AEAD algorithm is not recognized, + * or the parameters are incompatible, return 0. + */ +#define PSA_AEAD_NONCE_LENGTH(key_type, alg) \ + (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) == 16 ? \ + MBEDTLS_PSA_ALG_AEAD_EQUAL(alg, PSA_ALG_CCM) ? 13u : \ + MBEDTLS_PSA_ALG_AEAD_EQUAL(alg, PSA_ALG_GCM) ? 12u : \ + 0u : \ + (key_type) == PSA_KEY_TYPE_CHACHA20 && \ + MBEDTLS_PSA_ALG_AEAD_EQUAL(alg, PSA_ALG_CHACHA20_POLY1305) ? 12u : \ + 0u) + +/** The maximum default nonce size among all supported pairs of key types and + * AEAD algorithms, in bytes. + * + * This is equal to or greater than any value that #PSA_AEAD_NONCE_LENGTH() + * may return. + * + * \note This is not the maximum size of nonce supported as input to + * #psa_aead_set_nonce(), #psa_aead_encrypt() or #psa_aead_decrypt(), + * just the largest size that may be generated by + * #psa_aead_generate_nonce(). + */ +#define PSA_AEAD_NONCE_MAX_SIZE 13u + +/** A sufficient output buffer size for psa_aead_update(). + * + * If the size of the output buffer is at least this large, it is + * guaranteed that psa_aead_update() will not fail due to an + * insufficient buffer size. The actual size of the output may be smaller + * in any given call. + * + * See also #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length). + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is + * compatible with algorithm \p alg. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * \param input_length Size of the input in bytes. + * + * \return A sufficient output buffer size for the specified + * algorithm. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +/* For all the AEAD modes defined in this specification, it is possible + * to emit output without delay. However, hardware may not always be + * capable of this. So for modes based on a block cipher, allow the + * implementation to delay the output until it has a full block. */ +#define PSA_AEAD_UPDATE_OUTPUT_SIZE(key_type, alg, input_length) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 ? \ + PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? \ + PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), (input_length)) : \ + (input_length) : \ + 0u) + +/** A sufficient output buffer size for psa_aead_update(), for any of the + * supported key types and AEAD algorithms. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_aead_update() will not fail due to an insufficient buffer size. + * + * See also #PSA_AEAD_UPDATE_OUTPUT_SIZE(\p key_type, \p alg, \p input_length). + * + * \param input_length Size of the input in bytes. + */ +#define PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(input_length) \ + (PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE, (input_length))) + +/** A sufficient ciphertext buffer size for psa_aead_finish(). + * + * If the size of the ciphertext buffer is at least this large, it is + * guaranteed that psa_aead_finish() will not fail due to an + * insufficient ciphertext buffer size. The actual size of the output may + * be smaller in any given call. + * + * See also #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE. + * + * \param key_type A symmetric key type that is + compatible with algorithm \p alg. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \return A sufficient ciphertext buffer size for the + * specified algorithm. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_AEAD_FINISH_OUTPUT_SIZE(key_type, alg) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 && \ + PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? \ + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) : \ + 0u) + +/** A sufficient ciphertext buffer size for psa_aead_finish(), for any of the + * supported key types and AEAD algorithms. + * + * See also #PSA_AEAD_FINISH_OUTPUT_SIZE(\p key_type, \p alg). + */ +#define PSA_AEAD_FINISH_OUTPUT_MAX_SIZE (PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE) + +/** A sufficient plaintext buffer size for psa_aead_verify(). + * + * If the size of the plaintext buffer is at least this large, it is + * guaranteed that psa_aead_verify() will not fail due to an + * insufficient plaintext buffer size. The actual size of the output may + * be smaller in any given call. + * + * See also #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE. + * + * \param key_type A symmetric key type that is + * compatible with algorithm \p alg. + * \param alg An AEAD algorithm + * (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p alg) is true). + * + * \return A sufficient plaintext buffer size for the + * specified algorithm. + * If the key type or AEAD algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_AEAD_VERIFY_OUTPUT_SIZE(key_type, alg) \ + (PSA_AEAD_NONCE_LENGTH(key_type, alg) != 0 && \ + PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? \ + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) : \ + 0u) + +/** A sufficient plaintext buffer size for psa_aead_verify(), for any of the + * supported key types and AEAD algorithms. + * + * See also #PSA_AEAD_VERIFY_OUTPUT_SIZE(\p key_type, \p alg). + */ +#define PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE (PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE) + +#define PSA_RSA_MINIMUM_PADDING_SIZE(alg) \ + (PSA_ALG_IS_RSA_OAEP(alg) ? \ + 2u * PSA_HASH_LENGTH(PSA_ALG_RSA_OAEP_GET_HASH(alg)) + 1u : \ + 11u /*PKCS#1v1.5*/) + +/** + * \brief ECDSA signature size for a given curve bit size + * + * \param curve_bits Curve size in bits. + * \return Signature size in bytes. + * + * \note This macro returns a compile-time constant if its argument is one. + */ +#define PSA_ECDSA_SIGNATURE_SIZE(curve_bits) \ + (PSA_BITS_TO_BYTES(curve_bits) * 2u) + +/** Sufficient signature buffer size for psa_sign_hash(). + * + * This macro returns a sufficient buffer size for a signature using a key + * of the specified type and size, with the specified algorithm. + * Note that the actual size of the signature may be smaller + * (some algorithms produce a variable-size signature). + * + * \warning This function may call its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type An asymmetric key type (this may indifferently be a + * key pair type or a public key type). + * \param key_bits The size of the key in bits. + * \param alg The signature algorithm. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_sign_hash() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that is not supported, + * return either a sensible size or 0. + * If the parameters are not valid, the + * return value is unspecified. + */ +#define PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg) \ + (PSA_KEY_TYPE_IS_RSA(key_type) ? ((void) alg, PSA_BITS_TO_BYTES(key_bits)) : \ + PSA_KEY_TYPE_IS_ECC(key_type) ? PSA_ECDSA_SIGNATURE_SIZE(key_bits) : \ + ((void) alg, 0u)) + +#define PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE \ + PSA_ECDSA_SIGNATURE_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) + +/** \def PSA_SIGNATURE_MAX_SIZE + * + * Maximum size of an asymmetric signature. + * + * This macro expands to a compile-time constant integer. This value + * is the maximum size of a signature in bytes. + */ +#define PSA_SIGNATURE_MAX_SIZE 1 + +#if (defined(PSA_WANT_ALG_ECDSA) || defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA)) && \ + (PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE > PSA_SIGNATURE_MAX_SIZE) +#undef PSA_SIGNATURE_MAX_SIZE +#define PSA_SIGNATURE_MAX_SIZE PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE +#endif +#if (defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) || defined(PSA_WANT_ALG_RSA_PSS)) && \ + (PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS) > PSA_SIGNATURE_MAX_SIZE) +#undef PSA_SIGNATURE_MAX_SIZE +#define PSA_SIGNATURE_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS) +#endif + +/** Sufficient output buffer size for psa_asymmetric_encrypt(). + * + * This macro returns a sufficient buffer size for a ciphertext produced using + * a key of the specified type and size, with the specified algorithm. + * Note that the actual size of the ciphertext may be smaller, depending + * on the algorithm. + * + * \warning This function may call its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type An asymmetric key type (this may indifferently be a + * key pair type or a public key type). + * \param key_bits The size of the key in bits. + * \param alg The asymmetric encryption algorithm. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_asymmetric_encrypt() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that is not supported, + * return either a sensible size or 0. + * If the parameters are not valid, the + * return value is unspecified. + */ +#define PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg) \ + (PSA_KEY_TYPE_IS_RSA(key_type) ? \ + ((void) alg, PSA_BITS_TO_BYTES(key_bits)) : \ + 0u) + +/** A sufficient output buffer size for psa_asymmetric_encrypt(), for any + * supported asymmetric encryption. + * + * See also #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\p key_type, \p key_bits, \p alg). + */ +/* This macro assumes that RSA is the only supported asymmetric encryption. */ +#define PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE \ + (PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS)) + +/** Sufficient output buffer size for psa_asymmetric_decrypt(). + * + * This macro returns a sufficient buffer size for a plaintext produced using + * a key of the specified type and size, with the specified algorithm. + * Note that the actual size of the plaintext may be smaller, depending + * on the algorithm. + * + * \warning This function may call its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type An asymmetric key type (this may indifferently be a + * key pair type or a public key type). + * \param key_bits The size of the key in bits. + * \param alg The asymmetric encryption algorithm. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_asymmetric_decrypt() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that is not supported, + * return either a sensible size or 0. + * If the parameters are not valid, the + * return value is unspecified. + */ +#define PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg) \ + (PSA_KEY_TYPE_IS_RSA(key_type) ? \ + PSA_BITS_TO_BYTES(key_bits) - PSA_RSA_MINIMUM_PADDING_SIZE(alg) : \ + 0u) + +/** A sufficient output buffer size for psa_asymmetric_decrypt(), for any + * supported asymmetric decryption. + * + * This macro assumes that RSA is the only supported asymmetric encryption. + * + * See also #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\p key_type, \p key_bits, \p alg). + */ +#define PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE \ + (PSA_BITS_TO_BYTES(PSA_VENDOR_RSA_MAX_KEY_BITS)) + +/* Maximum size of the ASN.1 encoding of an INTEGER with the specified + * number of bits. + * + * This definition assumes that bits <= 2^19 - 9 so that the length field + * is at most 3 bytes. The length of the encoding is the length of the + * bit string padded to a whole number of bytes plus: + * - 1 type byte; + * - 1 to 3 length bytes; + * - 0 to 1 bytes of leading 0 due to the sign bit. + */ +#define PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(bits) \ + ((bits) / 8u + 5u) + +/* Maximum size of the export encoding of an RSA public key. + * Assumes that the public exponent is less than 2^32. + * + * RSAPublicKey ::= SEQUENCE { + * modulus INTEGER, -- n + * publicExponent INTEGER } -- e + * + * - 4 bytes of SEQUENCE overhead; + * - n : INTEGER; + * - 7 bytes for the public exponent. + */ +#define PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(key_bits) \ + (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) + 11u) + +/* Maximum size of the export encoding of an RSA key pair. + * Assumes that the public exponent is less than 2^32 and that the size + * difference between the two primes is at most 1 bit. + * + * RSAPrivateKey ::= SEQUENCE { + * version Version, -- 0 + * modulus INTEGER, -- N-bit + * publicExponent INTEGER, -- 32-bit + * privateExponent INTEGER, -- N-bit + * prime1 INTEGER, -- N/2-bit + * prime2 INTEGER, -- N/2-bit + * exponent1 INTEGER, -- N/2-bit + * exponent2 INTEGER, -- N/2-bit + * coefficient INTEGER, -- N/2-bit + * } + * + * - 4 bytes of SEQUENCE overhead; + * - 3 bytes of version; + * - 7 half-size INTEGERs plus 2 full-size INTEGERs, + * overapproximated as 9 half-size INTEGERS; + * - 7 bytes for the public exponent. + */ +#define PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(key_bits) \ + (9u * PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE((key_bits) / 2u + 1u) + 14u) + +/* Maximum size of the export encoding of a DSA public key. + * + * SubjectPublicKeyInfo ::= SEQUENCE { + * algorithm AlgorithmIdentifier, + * subjectPublicKey BIT STRING } -- contains DSAPublicKey + * AlgorithmIdentifier ::= SEQUENCE { + * algorithm OBJECT IDENTIFIER, + * parameters Dss-Params } -- SEQUENCE of 3 INTEGERs + * DSAPublicKey ::= INTEGER -- public key, Y + * + * - 3 * 4 bytes of SEQUENCE overhead; + * - 1 + 1 + 7 bytes of algorithm (DSA OID); + * - 4 bytes of BIT STRING overhead; + * - 3 full-size INTEGERs (p, g, y); + * - 1 + 1 + 32 bytes for 1 sub-size INTEGER (q <= 256 bits). + */ +#define PSA_KEY_EXPORT_DSA_PUBLIC_KEY_MAX_SIZE(key_bits) \ + (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) * 3u + 59u) + +/* Maximum size of the export encoding of a DSA key pair. + * + * DSAPrivateKey ::= SEQUENCE { + * version Version, -- 0 + * prime INTEGER, -- p + * subprime INTEGER, -- q + * generator INTEGER, -- g + * public INTEGER, -- y + * private INTEGER, -- x + * } + * + * - 4 bytes of SEQUENCE overhead; + * - 3 bytes of version; + * - 3 full-size INTEGERs (p, g, y); + * - 2 * (1 + 1 + 32) bytes for 2 sub-size INTEGERs (q, x <= 256 bits). + */ +#define PSA_KEY_EXPORT_DSA_KEY_PAIR_MAX_SIZE(key_bits) \ + (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) * 3u + 75u) + +/* Maximum size of the export encoding of an ECC public key. + * + * The representation of an ECC public key is: + * - The byte 0x04; + * - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + * - `y_P` as a `ceiling(m/8)`-byte string, big-endian; + * - where m is the bit size associated with the curve. + * + * - 1 byte + 2 * point size. + */ +#define PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits) \ + (2u * PSA_BITS_TO_BYTES(key_bits) + 1u) + +/* Maximum size of the export encoding of an ECC key pair. + * + * An ECC key pair is represented by the secret value. + */ +#define PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(key_bits) \ + (PSA_BITS_TO_BYTES(key_bits)) + +/* Maximum size of the export encoding of an DH key pair. + * + * An DH key pair is represented by the secret value. + */ +#define PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(key_bits) \ + (PSA_BITS_TO_BYTES(key_bits)) + +/* Maximum size of the export encoding of an DH public key. + */ +#define PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(key_bits) \ + (PSA_BITS_TO_BYTES(key_bits)) + +/** Sufficient output buffer size for psa_export_key() or + * psa_export_public_key(). + * + * This macro returns a compile-time constant if its arguments are + * compile-time constants. + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * The following code illustrates how to allocate enough memory to export + * a key by querying the key type and size at runtime. + * \code{c} + * psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + * psa_status_t status; + * status = psa_get_key_attributes(key, &attributes); + * if (status != PSA_SUCCESS) handle_error(...); + * psa_key_type_t key_type = psa_get_key_type(&attributes); + * size_t key_bits = psa_get_key_bits(&attributes); + * size_t buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(key_type, key_bits); + * psa_reset_key_attributes(&attributes); + * uint8_t *buffer = malloc(buffer_size); + * if (buffer == NULL) handle_error(...); + * size_t buffer_length; + * status = psa_export_key(key, buffer, buffer_size, &buffer_length); + * if (status != PSA_SUCCESS) handle_error(...); + * \endcode + * + * \param key_type A supported key type. + * \param key_bits The size of the key in bits. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_export_key() or psa_export_public_key() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that is not supported, + * return either a sensible size or 0. + * If the parameters are not valid, the return value is unspecified. + */ +#define PSA_EXPORT_KEY_OUTPUT_SIZE(key_type, key_bits) \ + ((key_type) == PSA_KEY_TYPE_RSA_KEY_PAIR ? PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(key_bits) : \ + (key_type) == PSA_KEY_TYPE_RSA_PUBLIC_KEY ? PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(key_bits) : \ + PSA_KEY_TYPE_IS_ECC_KEY_PAIR(key_type) ? PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(key_bits) : \ + PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY(key_type) ? PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits) : \ + PSA_BITS_TO_BYTES(key_bits)) /*unstructured; FFDH public or private*/ + +/** Sufficient output buffer size for psa_export_public_key(). + * + * This macro returns a compile-time constant if its arguments are + * compile-time constants. + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * The following code illustrates how to allocate enough memory to export + * a public key by querying the key type and size at runtime. + * \code{c} + * psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + * psa_status_t status; + * status = psa_get_key_attributes(key, &attributes); + * if (status != PSA_SUCCESS) handle_error(...); + * psa_key_type_t key_type = psa_get_key_type(&attributes); + * size_t key_bits = psa_get_key_bits(&attributes); + * size_t buffer_size = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(key_type, key_bits); + * psa_reset_key_attributes(&attributes); + * uint8_t *buffer = malloc(buffer_size); + * if (buffer == NULL) handle_error(...); + * size_t buffer_length; + * status = psa_export_public_key(key, buffer, buffer_size, &buffer_length); + * if (status != PSA_SUCCESS) handle_error(...); + * \endcode + * + * \param key_type A public key or key pair key type. + * \param key_bits The size of the key in bits. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_export_public_key() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that is not + * supported, return either a sensible size or 0. + * If the parameters are not valid, + * the return value is unspecified. + * + * If the parameters are valid and supported, + * return the same result as + * #PSA_EXPORT_KEY_OUTPUT_SIZE( + * \p #PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\p key_type), + * \p key_bits). + */ +#define PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(key_type, key_bits) \ + (PSA_KEY_TYPE_IS_RSA(key_type) ? PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(key_bits) : \ + PSA_KEY_TYPE_IS_ECC(key_type) ? PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits) : \ + PSA_KEY_TYPE_IS_DH(key_type) ? PSA_BITS_TO_BYTES(key_bits) : \ + 0u) + +/** Sufficient buffer size for exporting any asymmetric key pair. + * + * This macro expands to a compile-time constant integer. This value is + * a sufficient buffer size when calling psa_export_key() to export any + * asymmetric key pair, regardless of the exact key type and key size. + * + * See also #PSA_EXPORT_KEY_OUTPUT_SIZE(\p key_type, \p key_bits). + */ +#define PSA_EXPORT_KEY_PAIR_MAX_SIZE 1 + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \ + (PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \ + PSA_EXPORT_KEY_PAIR_MAX_SIZE) +#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE +#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \ + PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) +#endif +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && \ + (PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) > \ + PSA_EXPORT_KEY_PAIR_MAX_SIZE) +#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE +#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \ + PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) +#endif +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) && \ + (PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) > \ + PSA_EXPORT_KEY_PAIR_MAX_SIZE) +#undef PSA_EXPORT_KEY_PAIR_MAX_SIZE +#define PSA_EXPORT_KEY_PAIR_MAX_SIZE \ + PSA_KEY_EXPORT_FFDH_KEY_PAIR_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) +#endif + +/** Sufficient buffer size for exporting any asymmetric public key. + * + * This macro expands to a compile-time constant integer. This value is + * a sufficient buffer size when calling psa_export_key() or + * psa_export_public_key() to export any asymmetric public key, + * regardless of the exact key type and key size. + * + * See also #PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(\p key_type, \p key_bits). + */ +#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE 1 + +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ + (PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) > \ + PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) +#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE +#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \ + PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) +#endif +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) && \ + (PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) > \ + PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) +#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE +#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \ + PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS) +#endif +#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) && \ + (PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) > \ + PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) +#undef PSA_EXPORT_PUBLIC_KEY_MAX_SIZE +#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE \ + PSA_KEY_EXPORT_FFDH_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_FFDH_MAX_KEY_BITS) +#endif + +/* This is the name that was standardized in PSA Crypto v1.3 */ +#define PSA_EXPORT_ASYMMETRIC_KEY_MAX_SIZE \ + ((PSA_EXPORT_KEY_PAIR_MAX_SIZE > PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) ? \ + PSA_EXPORT_KEY_PAIR_MAX_SIZE : PSA_EXPORT_PUBLIC_KEY_MAX_SIZE) + +/* This is our old custom name from before it was in the spec, + * keep it around in case users were relying on it. */ +#define PSA_EXPORT_KEY_PAIR_OR_PUBLIC_MAX_SIZE \ + PSA_EXPORT_ASYMMETRIC_KEY_MAX_SIZE + +/** Sufficient output buffer size for psa_raw_key_agreement(). + * + * This macro returns a compile-time constant if its arguments are + * compile-time constants. + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * See also #PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE. + * + * \param key_type A supported key type. + * \param key_bits The size of the key in bits. + * + * \return If the parameters are valid and supported, return + * a buffer size in bytes that guarantees that + * psa_raw_key_agreement() will not fail with + * #PSA_ERROR_BUFFER_TOO_SMALL. + * If the parameters are a valid combination that + * is not supported, return either a sensible size or 0. + * If the parameters are not valid, + * the return value is unspecified. + */ +#define PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(key_type, key_bits) \ + ((PSA_KEY_TYPE_IS_ECC_KEY_PAIR(key_type) || \ + PSA_KEY_TYPE_IS_DH_KEY_PAIR(key_type)) ? PSA_BITS_TO_BYTES(key_bits) : 0u) + +/** Maximum size of the output from psa_raw_key_agreement(). + * + * This macro expands to a compile-time constant integer. This value is the + * maximum size of the output any raw key agreement algorithm, in bytes. + * + * See also #PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(\p key_type, \p key_bits). + */ +#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE 1 + +#if defined(PSA_WANT_ALG_ECDH) && \ + (PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) > PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE) +#undef PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE +#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS) +#endif +#if defined(PSA_WANT_ALG_FFDH) && \ + (PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS) > PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE) +#undef PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE +#define PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE PSA_BITS_TO_BYTES(PSA_VENDOR_FFDH_MAX_KEY_BITS) +#endif + +/** Maximum key length for ciphers. + * + * Since there is no additional PSA_WANT_xxx symbol to specifiy the size of + * the key once a cipher is enabled (as it happens for asymmetric keys for + * example), the maximum key length is taken into account for each cipher. + * The resulting value will be the maximum cipher's key length given depending + * on which ciphers are enabled. + * + * Note: max value for AES used below would be doubled if XTS were enabled, but + * this mode is currently not supported in Mbed TLS implementation of PSA + * APIs. + */ +#if (defined(PSA_WANT_KEY_TYPE_AES) || defined(PSA_WANT_KEY_TYPE_ARIA) || \ + defined(PSA_WANT_KEY_TYPE_CAMELLIA) || defined(PSA_WANT_KEY_TYPE_CHACHA20)) +#define PSA_CIPHER_MAX_KEY_LENGTH 32u +#elif defined(PSA_WANT_KEY_TYPE_DES) +#define PSA_CIPHER_MAX_KEY_LENGTH 24u +#else +#define PSA_CIPHER_MAX_KEY_LENGTH 0u +#endif + +/** The default IV size for a cipher algorithm, in bytes. + * + * The IV that is generated as part of a call to #psa_cipher_encrypt() is always + * the default IV length for the algorithm. + * + * This macro can be used to allocate a buffer of sufficient size to + * store the IV output from #psa_cipher_generate_iv() when using + * a multi-part cipher operation. + * + * See also #PSA_CIPHER_IV_MAX_SIZE. + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is compatible with algorithm \p alg. + * + * \param alg A cipher algorithm (\c PSA_ALG_XXX value such that #PSA_ALG_IS_CIPHER(\p alg) is true). + * + * \return The default IV size for the specified key type and algorithm. + * If the algorithm does not use an IV, return 0. + * If the key type or cipher algorithm is not recognized, + * or the parameters are incompatible, return 0. + */ +#define PSA_CIPHER_IV_LENGTH(key_type, alg) \ + (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1 && \ + ((alg) == PSA_ALG_CTR || \ + (alg) == PSA_ALG_CFB || \ + (alg) == PSA_ALG_OFB || \ + (alg) == PSA_ALG_XTS || \ + (alg) == PSA_ALG_CBC_NO_PADDING || \ + (alg) == PSA_ALG_CBC_PKCS7) ? PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) : \ + (key_type) == PSA_KEY_TYPE_CHACHA20 && \ + (alg) == PSA_ALG_STREAM_CIPHER ? 12u : \ + (alg) == PSA_ALG_CCM_STAR_NO_TAG ? 13u : \ + 0u) + +/** The maximum IV size for all supported cipher algorithms, in bytes. + * + * See also #PSA_CIPHER_IV_LENGTH(). + */ +#define PSA_CIPHER_IV_MAX_SIZE 16u + +/** The maximum size of the output of psa_cipher_encrypt(), in bytes. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_encrypt() will not fail due to an insufficient buffer size. + * Depending on the algorithm, the actual size of the output might be smaller. + * + * See also #PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(\p input_length). + * + * \warning This macro may evaluate its arguments multiple times or + * zero times, so you should not pass arguments that contain + * side effects. + * + * \param key_type A symmetric key type that is compatible with algorithm + * alg. + * \param alg A cipher algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \param input_length Size of the input in bytes. + * + * \return A sufficient output size for the specified key type and + * algorithm. If the key type or cipher algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_length) \ + (alg == PSA_ALG_CBC_PKCS7 ? \ + (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) != 0 ? \ + PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), \ + (input_length) + 1u) + \ + PSA_CIPHER_IV_LENGTH((key_type), (alg)) : 0u) : \ + (PSA_ALG_IS_CIPHER(alg) ? \ + (input_length) + PSA_CIPHER_IV_LENGTH((key_type), (alg)) : \ + 0u)) + +/** A sufficient output buffer size for psa_cipher_encrypt(), for any of the + * supported key types and cipher algorithms. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_encrypt() will not fail due to an insufficient buffer size. + * + * See also #PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(\p key_type, \p alg, \p input_length). + * + * \param input_length Size of the input in bytes. + * + */ +#define PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input_length) \ + (PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE, \ + (input_length) + 1u) + \ + PSA_CIPHER_IV_MAX_SIZE) + +/** The maximum size of the output of psa_cipher_decrypt(), in bytes. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_decrypt() will not fail due to an insufficient buffer size. + * Depending on the algorithm, the actual size of the output might be smaller. + * + * See also #PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(\p input_length). + * + * \param key_type A symmetric key type that is compatible with algorithm + * alg. + * \param alg A cipher algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \param input_length Size of the input in bytes. + * + * \return A sufficient output size for the specified key type and + * algorithm. If the key type or cipher algorithm is not + * recognized, or the parameters are incompatible, + * return 0. + */ +#define PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_length) \ + (PSA_ALG_IS_CIPHER(alg) && \ + ((key_type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_SYMMETRIC ? \ + (input_length) : \ + 0u) + +/** A sufficient output buffer size for psa_cipher_decrypt(), for any of the + * supported key types and cipher algorithms. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_decrypt() will not fail due to an insufficient buffer size. + * + * See also #PSA_CIPHER_DECRYPT_OUTPUT_SIZE(\p key_type, \p alg, \p input_length). + * + * \param input_length Size of the input in bytes. + */ +#define PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(input_length) \ + (input_length) + +/** A sufficient output buffer size for psa_cipher_update(). + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_update() will not fail due to an insufficient buffer size. + * The actual size of the output might be smaller in any given call. + * + * See also #PSA_CIPHER_UPDATE_OUTPUT_MAX_SIZE(\p input_length). + * + * \param key_type A symmetric key type that is compatible with algorithm + * alg. + * \param alg A cipher algorithm (PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \param input_length Size of the input in bytes. + * + * \return A sufficient output size for the specified key type and + * algorithm. If the key type or cipher algorithm is not + * recognized, or the parameters are incompatible, return 0. + */ +#define PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input_length) \ + (PSA_ALG_IS_CIPHER(alg) ? \ + (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) != 0 ? \ + (((alg) == PSA_ALG_CBC_PKCS7 || \ + (alg) == PSA_ALG_CBC_NO_PADDING || \ + (alg) == PSA_ALG_ECB_NO_PADDING) ? \ + PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), \ + input_length) : \ + (input_length)) : 0u) : \ + 0u) + +/** A sufficient output buffer size for psa_cipher_update(), for any of the + * supported key types and cipher algorithms. + * + * If the size of the output buffer is at least this large, it is guaranteed + * that psa_cipher_update() will not fail due to an insufficient buffer size. + * + * See also #PSA_CIPHER_UPDATE_OUTPUT_SIZE(\p key_type, \p alg, \p input_length). + * + * \param input_length Size of the input in bytes. + */ +#define PSA_CIPHER_UPDATE_OUTPUT_MAX_SIZE(input_length) \ + (PSA_ROUND_UP_TO_MULTIPLE(PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE, input_length)) + +/** A sufficient ciphertext buffer size for psa_cipher_finish(). + * + * If the size of the ciphertext buffer is at least this large, it is + * guaranteed that psa_cipher_finish() will not fail due to an insufficient + * ciphertext buffer size. The actual size of the output might be smaller in + * any given call. + * + * See also #PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE(). + * + * \param key_type A symmetric key type that is compatible with algorithm + * alg. + * \param alg A cipher algorithm (PSA_ALG_XXX value such that + * #PSA_ALG_IS_CIPHER(\p alg) is true). + * \return A sufficient output size for the specified key type and + * algorithm. If the key type or cipher algorithm is not + * recognized, or the parameters are incompatible, return 0. + */ +#define PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg) \ + (PSA_ALG_IS_CIPHER(alg) ? \ + (alg == PSA_ALG_CBC_PKCS7 ? \ + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) : \ + 0u) : \ + 0u) + +/** A sufficient ciphertext buffer size for psa_cipher_finish(), for any of the + * supported key types and cipher algorithms. + * + * See also #PSA_CIPHER_FINISH_OUTPUT_SIZE(\p key_type, \p alg). + */ +#define PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE \ + (PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE) + +#endif /* PSA_CRYPTO_SIZES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_struct.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_struct.h new file mode 100644 index 00000000..362e921a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_struct.h @@ -0,0 +1,527 @@ +/** + * \file psa/crypto_struct.h + * + * \brief PSA cryptography module: Mbed TLS structured type implementations + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. + * + * This file contains the definitions of some data structures with + * implementation-specific definitions. + * + * In implementations with isolation between the application and the + * cryptography module, it is expected that the front-end and the back-end + * would have different versions of this file. + * + *

Design notes about multipart operation structures

+ * + * For multipart operations without driver delegation support, each multipart + * operation structure contains a `psa_algorithm_t alg` field which indicates + * which specific algorithm the structure is for. When the structure is not in + * use, `alg` is 0. Most of the structure consists of a union which is + * discriminated by `alg`. + * + * For multipart operations with driver delegation support, each multipart + * operation structure contains an `unsigned int id` field indicating which + * driver got assigned to do the operation. When the structure is not in use, + * 'id' is 0. The structure contains also a driver context which is the union + * of the contexts of all drivers able to handle the type of multipart + * operation. + * + * Note that when `alg` or `id` is 0, the content of other fields is undefined. + * In particular, it is not guaranteed that a freshly-initialized structure + * is all-zero: we initialize structures to something like `{0, 0}`, which + * is only guaranteed to initializes the first member of the union; + * GCC and Clang initialize the whole structure to 0 (at the time of writing), + * but MSVC and CompCert don't. + * + * In Mbed TLS, multipart operation structures live independently from + * the key. This allows Mbed TLS to free the key objects when destroying + * a key slot. If a multipart operation needs to remember the key after + * the setup function returns, the operation structure needs to contain a + * copy of the key. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_STRUCT_H +#define PSA_CRYPTO_STRUCT_H +#include "mbedtls/private_access.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Include the build-time configuration information header. Here, we do not + * include `"mbedtls/build_info.h"` directly but `"psa/build_info.h"`, which + * is basically just an alias to it. This is to ease the maintenance of the + * TF-PSA-Crypto repository which has a different build system and + * configuration. + */ +#include "psa/build_info.h" + +/* Include the context definition for the compiled-in drivers for the primitive + * algorithms. */ +#include "psa/crypto_driver_contexts_primitives.h" + +struct psa_hash_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_driver_wrappers.h. + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. the driver context is not active, in use). */ + unsigned int MBEDTLS_PRIVATE(id); + psa_driver_hash_context_t MBEDTLS_PRIVATE(ctx); +#endif +}; +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_HASH_OPERATION_INIT { 0 } +#else +#define PSA_HASH_OPERATION_INIT { 0, { 0 } } +#endif +static inline struct psa_hash_operation_s psa_hash_operation_init(void) +{ + const struct psa_hash_operation_s v = PSA_HASH_OPERATION_INIT; + return v; +} + +struct psa_cipher_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_crypto_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + + unsigned int MBEDTLS_PRIVATE(iv_required) : 1; + unsigned int MBEDTLS_PRIVATE(iv_set) : 1; + + uint8_t MBEDTLS_PRIVATE(default_iv_length); + + psa_driver_cipher_context_t MBEDTLS_PRIVATE(ctx); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_CIPHER_OPERATION_INIT { 0 } +#else +#define PSA_CIPHER_OPERATION_INIT { 0, 0, 0, 0, { 0 } } +#endif +static inline struct psa_cipher_operation_s psa_cipher_operation_init(void) +{ + const struct psa_cipher_operation_s v = PSA_CIPHER_OPERATION_INIT; + return v; +} + +/* Include the context definition for the compiled-in drivers for the composite + * algorithms. */ +#include "psa/crypto_driver_contexts_composites.h" + +struct psa_mac_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + uint8_t MBEDTLS_PRIVATE(mac_size); + unsigned int MBEDTLS_PRIVATE(is_sign) : 1; + psa_driver_mac_context_t MBEDTLS_PRIVATE(ctx); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_MAC_OPERATION_INIT { 0 } +#else +#define PSA_MAC_OPERATION_INIT { 0, 0, 0, { 0 } } +#endif +static inline struct psa_mac_operation_s psa_mac_operation_init(void) +{ + const struct psa_mac_operation_s v = PSA_MAC_OPERATION_INIT; + return v; +} + +struct psa_aead_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_crypto_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + + psa_algorithm_t MBEDTLS_PRIVATE(alg); + psa_key_type_t MBEDTLS_PRIVATE(key_type); + + size_t MBEDTLS_PRIVATE(ad_remaining); + size_t MBEDTLS_PRIVATE(body_remaining); + + unsigned int MBEDTLS_PRIVATE(nonce_set) : 1; + unsigned int MBEDTLS_PRIVATE(lengths_set) : 1; + unsigned int MBEDTLS_PRIVATE(ad_started) : 1; + unsigned int MBEDTLS_PRIVATE(body_started) : 1; + unsigned int MBEDTLS_PRIVATE(is_encrypt) : 1; + + psa_driver_aead_context_t MBEDTLS_PRIVATE(ctx); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_AEAD_OPERATION_INIT { 0 } +#else +#define PSA_AEAD_OPERATION_INIT { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, { 0 } } +#endif +static inline struct psa_aead_operation_s psa_aead_operation_init(void) +{ + const struct psa_aead_operation_s v = PSA_AEAD_OPERATION_INIT; + return v; +} + +/* Include the context definition for the compiled-in drivers for the key + * derivation algorithms. */ +#include "psa/crypto_driver_contexts_key_derivation.h" + +struct psa_key_derivation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + psa_algorithm_t MBEDTLS_PRIVATE(alg); + unsigned int MBEDTLS_PRIVATE(can_output_key) : 1; + size_t MBEDTLS_PRIVATE(capacity); + psa_driver_key_derivation_context_t MBEDTLS_PRIVATE(ctx); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_KEY_DERIVATION_OPERATION_INIT { 0 } +#else +/* This only zeroes out the first byte in the union, the rest is unspecified. */ +#define PSA_KEY_DERIVATION_OPERATION_INIT { 0, 0, 0, { 0 } } +#endif +static inline struct psa_key_derivation_s psa_key_derivation_operation_init( + void) +{ + const struct psa_key_derivation_s v = PSA_KEY_DERIVATION_OPERATION_INIT; + return v; +} + +struct psa_custom_key_parameters_s { + /* Future versions may add other fields in this structure. */ + uint32_t flags; +}; + +/** The default production parameters for key generation or key derivation. + * + * Calling psa_generate_key_custom() or psa_key_derivation_output_key_custom() + * with `custom=PSA_CUSTOM_KEY_PARAMETERS_INIT` and `custom_data_length=0` is + * equivalent to calling psa_generate_key() or psa_key_derivation_output_key() + * respectively. + */ +#define PSA_CUSTOM_KEY_PARAMETERS_INIT { 0 } + +#ifndef __cplusplus +/* Omitted when compiling in C++, because one of the parameters is a + * pointer to a struct with a flexible array member, and that is not + * standard C++. + * https://github.com/Mbed-TLS/mbedtls/issues/9020 + */ +/* This is a deprecated variant of `struct psa_custom_key_parameters_s`. + * It has exactly the same layout, plus an extra field which is a flexible + * array member. Thus a `const struct psa_key_production_parameters_s *` + * can be passed to any function that reads a + * `const struct psa_custom_key_parameters_s *`. + */ +struct psa_key_production_parameters_s { + uint32_t flags; + uint8_t data[]; +}; + +/** The default production parameters for key generation or key derivation. + * + * Calling psa_generate_key_ext() or psa_key_derivation_output_key_ext() + * with `params=PSA_KEY_PRODUCTION_PARAMETERS_INIT` and + * `params_data_length == 0` is equivalent to + * calling psa_generate_key() or psa_key_derivation_output_key() + * respectively. + */ +#define PSA_KEY_PRODUCTION_PARAMETERS_INIT { 0 } +#endif /* !__cplusplus */ + +struct psa_key_policy_s { + psa_key_usage_t MBEDTLS_PRIVATE(usage); + psa_algorithm_t MBEDTLS_PRIVATE(alg); + psa_algorithm_t MBEDTLS_PRIVATE(alg2); +}; +typedef struct psa_key_policy_s psa_key_policy_t; + +#define PSA_KEY_POLICY_INIT { 0, 0, 0 } +static inline struct psa_key_policy_s psa_key_policy_init(void) +{ + const struct psa_key_policy_s v = PSA_KEY_POLICY_INIT; + return v; +} + +/* The type used internally for key sizes. + * Public interfaces use size_t, but internally we use a smaller type. */ +typedef uint16_t psa_key_bits_t; +/* The maximum value of the type used to represent bit-sizes. + * This is used to mark an invalid key size. */ +#define PSA_KEY_BITS_TOO_LARGE ((psa_key_bits_t) -1) +/* The maximum size of a key in bits. + * Currently defined as the maximum that can be represented, rounded down + * to a whole number of bytes. + * This is an uncast value so that it can be used in preprocessor + * conditionals. */ +#define PSA_MAX_KEY_BITS 0xfff8 + +struct psa_key_attributes_s { +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) + psa_key_slot_number_t MBEDTLS_PRIVATE(slot_number); + int MBEDTLS_PRIVATE(has_slot_number); +#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ + psa_key_type_t MBEDTLS_PRIVATE(type); + psa_key_bits_t MBEDTLS_PRIVATE(bits); + psa_key_lifetime_t MBEDTLS_PRIVATE(lifetime); + psa_key_policy_t MBEDTLS_PRIVATE(policy); + /* This type has a different layout in the client view wrt the + * service view of the key id, i.e. in service view usually is + * expected to have MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER defined + * thus adding an owner field to the standard psa_key_id_t. For + * implementations with client/service separation, this means the + * object will be marshalled through a transport channel and + * interpreted differently at each side of the transport. Placing + * it at the end of structures allows to interpret the structure + * at the client without reorganizing the memory layout of the + * struct + */ + mbedtls_svc_key_id_t MBEDTLS_PRIVATE(id); +}; + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) +#define PSA_KEY_ATTRIBUTES_MAYBE_SLOT_NUMBER 0, 0, +#else +#define PSA_KEY_ATTRIBUTES_MAYBE_SLOT_NUMBER +#endif +#define PSA_KEY_ATTRIBUTES_INIT { PSA_KEY_ATTRIBUTES_MAYBE_SLOT_NUMBER \ + PSA_KEY_TYPE_NONE, 0, \ + PSA_KEY_LIFETIME_VOLATILE, \ + PSA_KEY_POLICY_INIT, \ + MBEDTLS_SVC_KEY_ID_INIT } + +static inline struct psa_key_attributes_s psa_key_attributes_init(void) +{ + const struct psa_key_attributes_s v = PSA_KEY_ATTRIBUTES_INIT; + return v; +} + +static inline void psa_set_key_id(psa_key_attributes_t *attributes, + mbedtls_svc_key_id_t key) +{ + psa_key_lifetime_t lifetime = attributes->MBEDTLS_PRIVATE(lifetime); + + attributes->MBEDTLS_PRIVATE(id) = key; + + if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) { + attributes->MBEDTLS_PRIVATE(lifetime) = + PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION( + PSA_KEY_LIFETIME_PERSISTENT, + PSA_KEY_LIFETIME_GET_LOCATION(lifetime)); + } +} + +static inline mbedtls_svc_key_id_t psa_get_key_id( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(id); +} + +#ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +static inline void mbedtls_set_key_owner_id(psa_key_attributes_t *attributes, + mbedtls_key_owner_id_t owner) +{ + attributes->MBEDTLS_PRIVATE(id).MBEDTLS_PRIVATE(owner) = owner; +} +#endif + +static inline void psa_set_key_lifetime(psa_key_attributes_t *attributes, + psa_key_lifetime_t lifetime) +{ + attributes->MBEDTLS_PRIVATE(lifetime) = lifetime; + if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) { +#ifdef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + attributes->MBEDTLS_PRIVATE(id).MBEDTLS_PRIVATE(key_id) = 0; +#else + attributes->MBEDTLS_PRIVATE(id) = 0; +#endif + } +} + +static inline psa_key_lifetime_t psa_get_key_lifetime( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(lifetime); +} + +static inline void psa_extend_key_usage_flags(psa_key_usage_t *usage_flags) +{ + if (*usage_flags & PSA_KEY_USAGE_SIGN_HASH) { + *usage_flags |= PSA_KEY_USAGE_SIGN_MESSAGE; + } + + if (*usage_flags & PSA_KEY_USAGE_VERIFY_HASH) { + *usage_flags |= PSA_KEY_USAGE_VERIFY_MESSAGE; + } +} + +static inline void psa_set_key_usage_flags(psa_key_attributes_t *attributes, + psa_key_usage_t usage_flags) +{ + psa_extend_key_usage_flags(&usage_flags); + attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(usage) = usage_flags; +} + +static inline psa_key_usage_t psa_get_key_usage_flags( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(usage); +} + +static inline void psa_set_key_algorithm(psa_key_attributes_t *attributes, + psa_algorithm_t alg) +{ + attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(alg) = alg; +} + +static inline psa_algorithm_t psa_get_key_algorithm( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(policy).MBEDTLS_PRIVATE(alg); +} + +static inline void psa_set_key_type(psa_key_attributes_t *attributes, + psa_key_type_t type) +{ + attributes->MBEDTLS_PRIVATE(type) = type; +} + +static inline psa_key_type_t psa_get_key_type( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(type); +} + +static inline void psa_set_key_bits(psa_key_attributes_t *attributes, + size_t bits) +{ + if (bits > PSA_MAX_KEY_BITS) { + attributes->MBEDTLS_PRIVATE(bits) = PSA_KEY_BITS_TOO_LARGE; + } else { + attributes->MBEDTLS_PRIVATE(bits) = (psa_key_bits_t) bits; + } +} + +static inline size_t psa_get_key_bits( + const psa_key_attributes_t *attributes) +{ + return attributes->MBEDTLS_PRIVATE(bits); +} + +/** + * \brief The context for PSA interruptible hash signing. + */ +struct psa_sign_hash_interruptible_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_crypto_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + + psa_driver_sign_hash_interruptible_context_t MBEDTLS_PRIVATE(ctx); + + unsigned int MBEDTLS_PRIVATE(error_occurred) : 1; + + uint32_t MBEDTLS_PRIVATE(num_ops); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } +#else +#define PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0, { 0 }, 0, 0 } +#endif + +static inline struct psa_sign_hash_interruptible_operation_s +psa_sign_hash_interruptible_operation_init(void) +{ + const struct psa_sign_hash_interruptible_operation_s v = + PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; + + return v; +} + +/** + * \brief The context for PSA interruptible hash verification. + */ +struct psa_verify_hash_interruptible_operation_s { +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) + mbedtls_psa_client_handle_t handle; +#else + /** Unique ID indicating which driver got assigned to do the + * operation. Since driver contexts are driver-specific, swapping + * drivers halfway through the operation is not supported. + * ID values are auto-generated in psa_crypto_driver_wrappers.h + * ID value zero means the context is not valid or not assigned to + * any driver (i.e. none of the driver contexts are active). */ + unsigned int MBEDTLS_PRIVATE(id); + + psa_driver_verify_hash_interruptible_context_t MBEDTLS_PRIVATE(ctx); + + unsigned int MBEDTLS_PRIVATE(error_occurred) : 1; + + uint32_t MBEDTLS_PRIVATE(num_ops); +#endif +}; + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !defined(MBEDTLS_PSA_CRYPTO_C) +#define PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } +#else +#define PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT { 0, { 0 }, 0, 0 } +#endif + +static inline struct psa_verify_hash_interruptible_operation_s +psa_verify_hash_interruptible_operation_init(void) +{ + const struct psa_verify_hash_interruptible_operation_s v = + PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; + + return v; +} + +#ifdef __cplusplus +} +#endif + +#endif /* PSA_CRYPTO_STRUCT_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_types.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_types.h new file mode 100644 index 00000000..f831486f --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_types.h @@ -0,0 +1,508 @@ +/** + * \file psa/crypto_types.h + * + * \brief PSA cryptography module: type aliases. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. Drivers must include the appropriate driver + * header file. + * + * This file contains portable definitions of integral types for properties + * of cryptographic keys, designations of cryptographic algorithms, and + * error codes returned by the library. + * + * This header file does not declare any function. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_TYPES_H +#define PSA_CRYPTO_TYPES_H + +/* + * Include the build-time configuration information header. Here, we do not + * include `"mbedtls/build_info.h"` directly but `"psa/build_info.h"`, which + * is basically just an alias to it. This is to ease the maintenance of the + * TF-PSA-Crypto repository which has a different build system and + * configuration. + */ +#include "psa/build_info.h" + +/* Define the MBEDTLS_PRIVATE macro. */ +#include "mbedtls/private_access.h" + +#if defined(MBEDTLS_PSA_CRYPTO_PLATFORM_FILE) +#include MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +#else +#include "crypto_platform.h" +#endif + +#include + +/** \defgroup error Error codes + * @{ + */ + +/** + * \brief Function return status. + * + * This is either #PSA_SUCCESS (which is zero), indicating success, + * or a small negative value indicating that an error occurred. Errors are + * encoded as one of the \c PSA_ERROR_xxx values defined here. */ +/* If #PSA_SUCCESS is already defined, it means that #psa_status_t + * is also defined in an external header, so prevent its multiple + * definition. + */ +#ifndef PSA_SUCCESS +typedef int32_t psa_status_t; +#endif + +/**@}*/ + +/** \defgroup crypto_types Key and algorithm types + * @{ + */ + +/** \brief Encoding of a key type. + * + * Values of this type are generally constructed by macros called + * `PSA_KEY_TYPE_xxx`. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint16_t psa_key_type_t; + +/** The type of PSA elliptic curve family identifiers. + * + * Values of this type are generally constructed by macros called + * `PSA_ECC_FAMILY_xxx`. + * + * The curve identifier is required to create an ECC key using the + * PSA_KEY_TYPE_ECC_KEY_PAIR() or PSA_KEY_TYPE_ECC_PUBLIC_KEY() + * macros. + * + * Values defined by this standard will never be in the range 0x80-0xff. + * Vendors who define additional families must use an encoding in this range. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint8_t psa_ecc_family_t; + +/** The type of PSA Diffie-Hellman group family identifiers. + * + * Values of this type are generally constructed by macros called + * `PSA_DH_FAMILY_xxx`. + * + * The group identifier is required to create a Diffie-Hellman key using the + * PSA_KEY_TYPE_DH_KEY_PAIR() or PSA_KEY_TYPE_DH_PUBLIC_KEY() + * macros. + * + * Values defined by this standard will never be in the range 0x80-0xff. + * Vendors who define additional families must use an encoding in this range. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint8_t psa_dh_family_t; + +/** \brief Encoding of a cryptographic algorithm. + * + * Values of this type are generally constructed by macros called + * `PSA_ALG_xxx`. + * + * For algorithms that can be applied to multiple key types, this type + * does not encode the key type. For example, for symmetric ciphers + * based on a block cipher, #psa_algorithm_t encodes the block cipher + * mode and the padding mode while the block cipher itself is encoded + * via #psa_key_type_t. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint32_t psa_algorithm_t; + +/**@}*/ + +/** \defgroup key_lifetimes Key lifetimes + * @{ + */ + +/** Encoding of key lifetimes. + * + * The lifetime of a key indicates where it is stored and what system actions + * may create and destroy it. + * + * Lifetime values have the following structure: + * - Bits 0-7 (#PSA_KEY_LIFETIME_GET_PERSISTENCE(\c lifetime)): + * persistence level. This value indicates what device management + * actions can cause it to be destroyed. In particular, it indicates + * whether the key is _volatile_ or _persistent_. + * See ::psa_key_persistence_t for more information. + * - Bits 8-31 (#PSA_KEY_LIFETIME_GET_LOCATION(\c lifetime)): + * location indicator. This value indicates which part of the system + * has access to the key material and can perform operations using the key. + * See ::psa_key_location_t for more information. + * + * Volatile keys are automatically destroyed when the application instance + * terminates or on a power reset of the device. Persistent keys are + * preserved until the application explicitly destroys them or until an + * integration-specific device management event occurs (for example, + * a factory reset). + * + * Persistent keys have a key identifier of type #mbedtls_svc_key_id_t. + * This identifier remains valid throughout the lifetime of the key, + * even if the application instance that created the key terminates. + * The application can call psa_open_key() to open a persistent key that + * it created previously. + * + * The default lifetime of a key is #PSA_KEY_LIFETIME_VOLATILE. The lifetime + * #PSA_KEY_LIFETIME_PERSISTENT is supported if persistent storage is + * available. Other lifetime values may be supported depending on the + * library configuration. + * + * Values of this type are generally constructed by macros called + * `PSA_KEY_LIFETIME_xxx`. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint32_t psa_key_lifetime_t; + +/** Encoding of key persistence levels. + * + * What distinguishes different persistence levels is what device management + * events may cause keys to be destroyed. _Volatile_ keys are destroyed + * by a power reset. Persistent keys may be destroyed by events such as + * a transfer of ownership or a factory reset. What management events + * actually affect persistent keys at different levels is outside the + * scope of the PSA Cryptography specification. + * + * The PSA Cryptography specification defines the following values of + * persistence levels: + * - \c 0 = #PSA_KEY_PERSISTENCE_VOLATILE: volatile key. + * A volatile key is automatically destroyed by the implementation when + * the application instance terminates. In particular, a volatile key + * is automatically destroyed on a power reset of the device. + * - \c 1 = #PSA_KEY_PERSISTENCE_DEFAULT: + * persistent key with a default lifetime. + * - \c 2-254: currently not supported by Mbed TLS. + * - \c 255 = #PSA_KEY_PERSISTENCE_READ_ONLY: + * read-only or write-once key. + * A key with this persistence level cannot be destroyed. + * Mbed TLS does not currently offer a way to create such keys, but + * integrations of Mbed TLS can use it for built-in keys that the + * application cannot modify (for example, a hardware unique key (HUK)). + * + * \note Key persistence levels are 8-bit values. Key management + * interfaces operate on lifetimes (type ::psa_key_lifetime_t) which + * encode the persistence as the lower 8 bits of a 32-bit value. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint8_t psa_key_persistence_t; + +/** Encoding of key location indicators. + * + * If an integration of Mbed TLS can make calls to external + * cryptoprocessors such as secure elements, the location of a key + * indicates which secure element performs the operations on the key. + * Depending on the design of the secure element, the key + * material may be stored either in the secure element, or + * in wrapped (encrypted) form alongside the key metadata in the + * primary local storage. + * + * The PSA Cryptography API specification defines the following values of + * location indicators: + * - \c 0: primary local storage. + * This location is always available. + * The primary local storage is typically the same storage area that + * contains the key metadata. + * - \c 1: primary secure element. + * Integrations of Mbed TLS should support this value if there is a secure + * element attached to the operating environment. + * As a guideline, secure elements may provide higher resistance against + * side channel and physical attacks than the primary local storage, but may + * have restrictions on supported key types, sizes, policies and operations + * and may have different performance characteristics. + * - \c 2-0x7fffff: other locations defined by a PSA specification. + * The PSA Cryptography API does not currently assign any meaning to these + * locations, but future versions of that specification or other PSA + * specifications may do so. + * - \c 0x800000-0xffffff: vendor-defined locations. + * No PSA specification will assign a meaning to locations in this range. + * + * \note Key location indicators are 24-bit values. Key management + * interfaces operate on lifetimes (type ::psa_key_lifetime_t) which + * encode the location as the upper 24 bits of a 32-bit value. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint32_t psa_key_location_t; + +/** Encoding of identifiers of persistent keys. + * + * - Applications may freely choose key identifiers in the range + * #PSA_KEY_ID_USER_MIN to #PSA_KEY_ID_USER_MAX. + * - The implementation may define additional key identifiers in the range + * #PSA_KEY_ID_VENDOR_MIN to #PSA_KEY_ID_VENDOR_MAX. + * - 0 is reserved as an invalid key identifier. + * - Key identifiers outside these ranges are reserved for future use. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to how values are allocated must require careful + * consideration to allow backward compatibility. + */ +typedef uint32_t psa_key_id_t; + +/** Encoding of key identifiers as seen inside the PSA Crypto implementation. + * + * When PSA Crypto is built as a library inside an application, this type + * is identical to #psa_key_id_t. When PSA Crypto is built as a service + * that can store keys on behalf of multiple clients, this type + * encodes the #psa_key_id_t value seen by each client application as + * well as extra information that identifies the client that owns + * the key. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) +typedef psa_key_id_t mbedtls_svc_key_id_t; + +#else /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */ +/* Implementation-specific: The Mbed TLS library can be built as + * part of a multi-client service that exposes the PSA Cryptography API in each + * client and encodes the client identity in the key identifier argument of + * functions such as psa_open_key(). + */ +typedef struct { + psa_key_id_t MBEDTLS_PRIVATE(key_id); + mbedtls_key_owner_id_t MBEDTLS_PRIVATE(owner); +} mbedtls_svc_key_id_t; + +#endif /* !MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */ + +/**@}*/ + +/** \defgroup policy Key policies + * @{ + */ + +/** \brief Encoding of permitted usage on a key. + * + * Values of this type are generally constructed as bitwise-ors of macros + * called `PSA_KEY_USAGE_xxx`. + * + * \note Values of this type are encoded in the persistent key store. + * Any changes to existing values will require bumping the storage + * format version and providing a translation when reading the old + * format. + */ +typedef uint32_t psa_key_usage_t; + +/**@}*/ + +/** \defgroup attributes Key attributes + * @{ + */ + +/** The type of a structure containing key attributes. + * + * This is an opaque structure that can represent the metadata of a key + * object. Metadata that can be stored in attributes includes: + * - The location of the key in storage, indicated by its key identifier + * and its lifetime. + * - The key's policy, comprising usage flags and a specification of + * the permitted algorithm(s). + * - Information about the key itself: the key type and its size. + * - Additional implementation-defined attributes. + * + * The actual key material is not considered an attribute of a key. + * Key attributes do not contain information that is generally considered + * highly confidential. + * + * An attribute structure works like a simple data structure where each function + * `psa_set_key_xxx` sets a field and the corresponding function + * `psa_get_key_xxx` retrieves the value of the corresponding field. + * However, a future version of the library may report values that are + * equivalent to the original one, but have a different encoding. Invalid + * values may be mapped to different, also invalid values. + * + * An attribute structure may contain references to auxiliary resources, + * for example pointers to allocated memory or indirect references to + * pre-calculated values. In order to free such resources, the application + * must call psa_reset_key_attributes(). As an exception, calling + * psa_reset_key_attributes() on an attribute structure is optional if + * the structure has only been modified by the following functions + * since it was initialized or last reset with psa_reset_key_attributes(): + * - psa_set_key_id() + * - psa_set_key_lifetime() + * - psa_set_key_type() + * - psa_set_key_bits() + * - psa_set_key_usage_flags() + * - psa_set_key_algorithm() + * + * Before calling any function on a key attribute structure, the application + * must initialize it by any of the following means: + * - Set the structure to all-bits-zero, for example: + * \code + * psa_key_attributes_t attributes; + * memset(&attributes, 0, sizeof(attributes)); + * \endcode + * - Initialize the structure to logical zero values, for example: + * \code + * psa_key_attributes_t attributes = {0}; + * \endcode + * - Initialize the structure to the initializer #PSA_KEY_ATTRIBUTES_INIT, + * for example: + * \code + * psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + * \endcode + * - Assign the result of the function psa_key_attributes_init() + * to the structure, for example: + * \code + * psa_key_attributes_t attributes; + * attributes = psa_key_attributes_init(); + * \endcode + * + * A freshly initialized attribute structure contains the following + * values: + * + * - lifetime: #PSA_KEY_LIFETIME_VOLATILE. + * - key identifier: 0 (which is not a valid key identifier). + * - type: \c 0 (meaning that the type is unspecified). + * - key size: \c 0 (meaning that the size is unspecified). + * - usage flags: \c 0 (which allows no usage except exporting a public key). + * - algorithm: \c 0 (which allows no cryptographic usage, but allows + * exporting). + * + * A typical sequence to create a key is as follows: + * -# Create and initialize an attribute structure. + * -# If the key is persistent, call psa_set_key_id(). + * Also call psa_set_key_lifetime() to place the key in a non-default + * location. + * -# Set the key policy with psa_set_key_usage_flags() and + * psa_set_key_algorithm(). + * -# Set the key type with psa_set_key_type(). + * Skip this step if copying an existing key with psa_copy_key(). + * -# When generating a random key with psa_generate_key() or deriving a key + * with psa_key_derivation_output_key(), set the desired key size with + * psa_set_key_bits(). + * -# Call a key creation function: psa_import_key(), psa_generate_key(), + * psa_key_derivation_output_key() or psa_copy_key(). This function reads + * the attribute structure, creates a key with these attributes, and + * outputs a key identifier to the newly created key. + * -# The attribute structure is now no longer necessary. + * You may call psa_reset_key_attributes(), although this is optional + * with the workflow presented here because the attributes currently + * defined in this specification do not require any additional resources + * beyond the structure itself. + * + * A typical sequence to query a key's attributes is as follows: + * -# Call psa_get_key_attributes(). + * -# Call `psa_get_key_xxx` functions to retrieve the attribute(s) that + * you are interested in. + * -# Call psa_reset_key_attributes() to free any resources that may be + * used by the attribute structure. + * + * Once a key has been created, it is impossible to change its attributes. + */ +typedef struct psa_key_attributes_s psa_key_attributes_t; + + +#ifndef __DOXYGEN_ONLY__ +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) +/* Mbed TLS defines this type in crypto_types.h because it is also + * visible to applications through an implementation-specific extension. + * For the PSA Cryptography specification, this type is only visible + * via crypto_se_driver.h. */ +typedef uint64_t psa_key_slot_number_t; +#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ +#endif /* !__DOXYGEN_ONLY__ */ + +/**@}*/ + +/** \defgroup derivation Key derivation + * @{ + */ + +/** \brief Encoding of the step of a key derivation. + * + * Values of this type are generally constructed by macros called + * `PSA_KEY_DERIVATION_INPUT_xxx`. + */ +typedef uint16_t psa_key_derivation_step_t; + +/** \brief Custom parameters for key generation or key derivation. + * + * This is a structure type with at least the following field: + * + * - \c flags: an unsigned integer type. 0 for the default production parameters. + * + * Functions that take such a structure as input also take an associated + * input buffer \c custom_data of length \c custom_data_length. + * + * The interpretation of this structure and the associated \c custom_data + * parameter depend on the type of the created key. + * + * - #PSA_KEY_TYPE_RSA_KEY_PAIR: + * - \c flags: must be 0. + * - \c custom_data: the public exponent, in little-endian order. + * This must be an odd integer and must not be 1. + * Implementations must support 65537, should support 3 and may + * support other values. + * When not using a driver, Mbed TLS supports values up to \c INT_MAX. + * If this is empty, the default value 65537 is used. + * - Other key types: reserved for future use. \c flags must be 0. + */ +typedef struct psa_custom_key_parameters_s psa_custom_key_parameters_t; + +/** \brief Custom parameters for key generation or key derivation. + * + * This is a structure type with at least the following fields: + * + * - \c flags: an unsigned integer type. 0 for the default production parameters. + * - \c data: a flexible array of bytes. + * + * The interpretation of this structure depend on the type of the + * created key. + * + * - #PSA_KEY_TYPE_RSA_KEY_PAIR: + * - \c flags: must be 0. + * - \c data: the public exponent, in little-endian order. + * This must be an odd integer and must not be 1. + * Implementations must support 65537, should support 3 and may + * support other values. + * When not using a driver, Mbed TLS supports values up to \c INT_MAX. + * If this is empty or if the custom production parameters are omitted + * altogether, the default value 65537 is used. + * - Other key types: reserved for future use. \c flags must be 0. + * + */ +typedef struct psa_key_production_parameters_s psa_key_production_parameters_t; + +/**@}*/ + +#endif /* PSA_CRYPTO_TYPES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_values.h b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_values.h new file mode 100644 index 00000000..1d678dbf --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/deps/mbedtls/include/psa/crypto_values.h @@ -0,0 +1,2783 @@ +/** + * \file psa/crypto_values.h + * + * \brief PSA cryptography module: macros to build and analyze integer values. + * + * \note This file may not be included directly. Applications must + * include psa/crypto.h. Drivers must include the appropriate driver + * header file. + * + * This file contains portable definitions of macros to build and analyze + * values of integral types that encode properties of cryptographic keys, + * designations of cryptographic algorithms, and error codes returned by + * the library. + * + * Note that many of the constants defined in this file are embedded in + * the persistent key store, as part of key metadata (including usage + * policies). As a consequence, they must not be changed (unless the storage + * format version changes). + * + * This header file only defines preprocessor macros. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef PSA_CRYPTO_VALUES_H +#define PSA_CRYPTO_VALUES_H +#include "mbedtls/private_access.h" + +/** \defgroup error Error codes + * @{ + */ + +/* PSA error codes */ + +/* Error codes are standardized across PSA domains (framework, crypto, storage, + * etc.). Do not change the values in this section or even the expansions + * of each macro: it must be possible to `#include` both this header + * and some other PSA component's headers in the same C source, + * which will lead to duplicate definitions of the `PSA_SUCCESS` and + * `PSA_ERROR_xxx` macros, which is ok if and only if the macros expand + * to the same sequence of tokens. + * + * If you must add a new + * value, check with the Arm PSA framework group to pick one that other + * domains aren't already using. */ + +/* Tell uncrustify not to touch the constant definitions, otherwise + * it might change the spacing to something that is not PSA-compliant + * (e.g. adding a space after casts). + * + * *INDENT-OFF* + */ + +/** The action was completed successfully. */ +#define PSA_SUCCESS ((psa_status_t)0) + +/** An error occurred that does not correspond to any defined + * failure cause. + * + * Implementations may use this error code if none of the other standard + * error codes are applicable. */ +#define PSA_ERROR_GENERIC_ERROR ((psa_status_t)-132) + +/** The requested operation or a parameter is not supported + * by this implementation. + * + * Implementations should return this error code when an enumeration + * parameter such as a key type, algorithm, etc. is not recognized. + * If a combination of parameters is recognized and identified as + * not valid, return #PSA_ERROR_INVALID_ARGUMENT instead. */ +#define PSA_ERROR_NOT_SUPPORTED ((psa_status_t)-134) + +/** The requested action is denied by a policy. + * + * Implementations should return this error code when the parameters + * are recognized as valid and supported, and a policy explicitly + * denies the requested operation. + * + * If a subset of the parameters of a function call identify a + * forbidden operation, and another subset of the parameters are + * not valid or not supported, it is unspecified whether the function + * returns #PSA_ERROR_NOT_PERMITTED, #PSA_ERROR_NOT_SUPPORTED or + * #PSA_ERROR_INVALID_ARGUMENT. */ +#define PSA_ERROR_NOT_PERMITTED ((psa_status_t)-133) + +/** An output buffer is too small. + * + * Applications can call the \c PSA_xxx_SIZE macro listed in the function + * description to determine a sufficient buffer size. + * + * Implementations should preferably return this error code only + * in cases when performing the operation with a larger output + * buffer would succeed. However implementations may return this + * error if a function has invalid or unsupported parameters in addition + * to the parameters that determine the necessary output buffer size. */ +#define PSA_ERROR_BUFFER_TOO_SMALL ((psa_status_t)-138) + +/** Asking for an item that already exists + * + * Implementations should return this error, when attempting + * to write an item (like a key) that already exists. */ +#define PSA_ERROR_ALREADY_EXISTS ((psa_status_t)-139) + +/** Asking for an item that doesn't exist + * + * Implementations should return this error, if a requested item (like + * a key) does not exist. */ +#define PSA_ERROR_DOES_NOT_EXIST ((psa_status_t)-140) + +/** The requested action cannot be performed in the current state. + * + * Multipart operations return this error when one of the + * functions is called out of sequence. Refer to the function + * descriptions for permitted sequencing of functions. + * + * Implementations shall not return this error code to indicate + * that a key either exists or not, + * but shall instead return #PSA_ERROR_ALREADY_EXISTS or #PSA_ERROR_DOES_NOT_EXIST + * as applicable. + * + * Implementations shall not return this error code to indicate that a + * key identifier is invalid, but shall return #PSA_ERROR_INVALID_HANDLE + * instead. */ +#define PSA_ERROR_BAD_STATE ((psa_status_t)-137) + +/** The parameters passed to the function are invalid. + * + * Implementations may return this error any time a parameter or + * combination of parameters are recognized as invalid. + * + * Implementations shall not return this error code to indicate that a + * key identifier is invalid, but shall return #PSA_ERROR_INVALID_HANDLE + * instead. + */ +#define PSA_ERROR_INVALID_ARGUMENT ((psa_status_t)-135) + +/** There is not enough runtime memory. + * + * If the action is carried out across multiple security realms, this + * error can refer to available memory in any of the security realms. */ +#define PSA_ERROR_INSUFFICIENT_MEMORY ((psa_status_t)-141) + +/** There is not enough persistent storage. + * + * Functions that modify the key storage return this error code if + * there is insufficient storage space on the host media. In addition, + * many functions that do not otherwise access storage may return this + * error code if the implementation requires a mandatory log entry for + * the requested action and the log storage space is full. */ +#define PSA_ERROR_INSUFFICIENT_STORAGE ((psa_status_t)-142) + +/** There was a communication failure inside the implementation. + * + * This can indicate a communication failure between the application + * and an external cryptoprocessor or between the cryptoprocessor and + * an external volatile or persistent memory. A communication failure + * may be transient or permanent depending on the cause. + * + * \warning If a function returns this error, it is undetermined + * whether the requested action has completed or not. Implementations + * should return #PSA_SUCCESS on successful completion whenever + * possible, however functions may return #PSA_ERROR_COMMUNICATION_FAILURE + * if the requested action was completed successfully in an external + * cryptoprocessor but there was a breakdown of communication before + * the cryptoprocessor could report the status to the application. + */ +#define PSA_ERROR_COMMUNICATION_FAILURE ((psa_status_t)-145) + +/** There was a storage failure that may have led to data loss. + * + * This error indicates that some persistent storage is corrupted. + * It should not be used for a corruption of volatile memory + * (use #PSA_ERROR_CORRUPTION_DETECTED), for a communication error + * between the cryptoprocessor and its external storage (use + * #PSA_ERROR_COMMUNICATION_FAILURE), or when the storage is + * in a valid state but is full (use #PSA_ERROR_INSUFFICIENT_STORAGE). + * + * Note that a storage failure does not indicate that any data that was + * previously read is invalid. However this previously read data may no + * longer be readable from storage. + * + * When a storage failure occurs, it is no longer possible to ensure + * the global integrity of the keystore. Depending on the global + * integrity guarantees offered by the implementation, access to other + * data may or may not fail even if the data is still readable but + * its integrity cannot be guaranteed. + * + * Implementations should only use this error code to report a + * permanent storage corruption. However application writers should + * keep in mind that transient errors while reading the storage may be + * reported using this error code. */ +#define PSA_ERROR_STORAGE_FAILURE ((psa_status_t)-146) + +/** A hardware failure was detected. + * + * A hardware failure may be transient or permanent depending on the + * cause. */ +#define PSA_ERROR_HARDWARE_FAILURE ((psa_status_t)-147) + +/** A tampering attempt was detected. + * + * If an application receives this error code, there is no guarantee + * that previously accessed or computed data was correct and remains + * confidential. Applications should not perform any security function + * and should enter a safe failure state. + * + * Implementations may return this error code if they detect an invalid + * state that cannot happen during normal operation and that indicates + * that the implementation's security guarantees no longer hold. Depending + * on the implementation architecture and on its security and safety goals, + * the implementation may forcibly terminate the application. + * + * This error code is intended as a last resort when a security breach + * is detected and it is unsure whether the keystore data is still + * protected. Implementations shall only return this error code + * to report an alarm from a tampering detector, to indicate that + * the confidentiality of stored data can no longer be guaranteed, + * or to indicate that the integrity of previously returned data is now + * considered compromised. Implementations shall not use this error code + * to indicate a hardware failure that merely makes it impossible to + * perform the requested operation (use #PSA_ERROR_COMMUNICATION_FAILURE, + * #PSA_ERROR_STORAGE_FAILURE, #PSA_ERROR_HARDWARE_FAILURE, + * #PSA_ERROR_INSUFFICIENT_ENTROPY or other applicable error code + * instead). + * + * This error indicates an attack against the application. Implementations + * shall not return this error code as a consequence of the behavior of + * the application itself. */ +#define PSA_ERROR_CORRUPTION_DETECTED ((psa_status_t)-151) + +/** There is not enough entropy to generate random data needed + * for the requested action. + * + * This error indicates a failure of a hardware random generator. + * Application writers should note that this error can be returned not + * only by functions whose purpose is to generate random data, such + * as key, IV or nonce generation, but also by functions that execute + * an algorithm with a randomized result, as well as functions that + * use randomization of intermediate computations as a countermeasure + * to certain attacks. + * + * Implementations should avoid returning this error after psa_crypto_init() + * has succeeded. Implementations should generate sufficient + * entropy during initialization and subsequently use a cryptographically + * secure pseudorandom generator (PRNG). However implementations may return + * this error at any time if a policy requires the PRNG to be reseeded + * during normal operation. */ +#define PSA_ERROR_INSUFFICIENT_ENTROPY ((psa_status_t)-148) + +/** The signature, MAC or hash is incorrect. + * + * Verification functions return this error if the verification + * calculations completed successfully, and the value to be verified + * was determined to be incorrect. + * + * If the value to verify has an invalid size, implementations may return + * either #PSA_ERROR_INVALID_ARGUMENT or #PSA_ERROR_INVALID_SIGNATURE. */ +#define PSA_ERROR_INVALID_SIGNATURE ((psa_status_t)-149) + +/** The decrypted padding is incorrect. + * + * \warning In some protocols, when decrypting data, it is essential that + * the behavior of the application does not depend on whether the padding + * is correct, down to precise timing. Applications should prefer + * protocols that use authenticated encryption rather than plain + * encryption. If the application must perform a decryption of + * unauthenticated data, the application writer should take care not + * to reveal whether the padding is invalid. + * + * Implementations should strive to make valid and invalid padding + * as close as possible to indistinguishable to an external observer. + * In particular, the timing of a decryption operation should not + * depend on the validity of the padding. */ +#define PSA_ERROR_INVALID_PADDING ((psa_status_t)-150) + +/** Return this error when there's insufficient data when attempting + * to read from a resource. */ +#define PSA_ERROR_INSUFFICIENT_DATA ((psa_status_t)-143) + +/** This can be returned if a function can no longer operate correctly. + * For example, if an essential initialization operation failed or + * a mutex operation failed. */ +#define PSA_ERROR_SERVICE_FAILURE ((psa_status_t)-144) + +/** The key identifier is not valid. See also :ref:\`key-handles\`. + */ +#define PSA_ERROR_INVALID_HANDLE ((psa_status_t)-136) + +/** Stored data has been corrupted. + * + * This error indicates that some persistent storage has suffered corruption. + * It does not indicate the following situations, which have specific error + * codes: + * + * - A corruption of volatile memory - use #PSA_ERROR_CORRUPTION_DETECTED. + * - A communication error between the cryptoprocessor and its external + * storage - use #PSA_ERROR_COMMUNICATION_FAILURE. + * - When the storage is in a valid state but is full - use + * #PSA_ERROR_INSUFFICIENT_STORAGE. + * - When the storage fails for other reasons - use + * #PSA_ERROR_STORAGE_FAILURE. + * - When the stored data is not valid - use #PSA_ERROR_DATA_INVALID. + * + * \note A storage corruption does not indicate that any data that was + * previously read is invalid. However this previously read data might no + * longer be readable from storage. + * + * When a storage failure occurs, it is no longer possible to ensure the + * global integrity of the keystore. + */ +#define PSA_ERROR_DATA_CORRUPT ((psa_status_t)-152) + +/** Data read from storage is not valid for the implementation. + * + * This error indicates that some data read from storage does not have a valid + * format. It does not indicate the following situations, which have specific + * error codes: + * + * - When the storage or stored data is corrupted - use #PSA_ERROR_DATA_CORRUPT + * - When the storage fails for other reasons - use #PSA_ERROR_STORAGE_FAILURE + * - An invalid argument to the API - use #PSA_ERROR_INVALID_ARGUMENT + * + * This error is typically a result of either storage corruption on a + * cleartext storage backend, or an attempt to read data that was + * written by an incompatible version of the library. + */ +#define PSA_ERROR_DATA_INVALID ((psa_status_t)-153) + +/** The function that returns this status is defined as interruptible and + * still has work to do, thus the user should call the function again with the + * same operation context until it either returns #PSA_SUCCESS or any other + * error. This is not an error per se, more a notification of status. + */ +#define PSA_OPERATION_INCOMPLETE ((psa_status_t)-248) + +/* *INDENT-ON* */ + +/**@}*/ + +/** \defgroup crypto_types Key and algorithm types + * @{ + */ + +/* Note that key type values, including ECC family and DH group values, are + * embedded in the persistent key store, as part of key metadata. As a + * consequence, they must not be changed (unless the storage format version + * changes). + */ + +/** An invalid key type value. + * + * Zero is not the encoding of any key type. + */ +#define PSA_KEY_TYPE_NONE ((psa_key_type_t) 0x0000) + +/** Vendor-defined key type flag. + * + * Key types defined by this standard will never have the + * #PSA_KEY_TYPE_VENDOR_FLAG bit set. Vendors who define additional key types + * must use an encoding with the #PSA_KEY_TYPE_VENDOR_FLAG bit set and should + * respect the bitwise structure used by standard encodings whenever practical. + */ +#define PSA_KEY_TYPE_VENDOR_FLAG ((psa_key_type_t) 0x8000) + +#define PSA_KEY_TYPE_CATEGORY_MASK ((psa_key_type_t) 0x7000) +#define PSA_KEY_TYPE_CATEGORY_RAW ((psa_key_type_t) 0x1000) +#define PSA_KEY_TYPE_CATEGORY_SYMMETRIC ((psa_key_type_t) 0x2000) +#define PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY ((psa_key_type_t) 0x4000) +#define PSA_KEY_TYPE_CATEGORY_KEY_PAIR ((psa_key_type_t) 0x7000) + +#define PSA_KEY_TYPE_CATEGORY_FLAG_PAIR ((psa_key_type_t) 0x3000) + +/** Whether a key type is vendor-defined. + * + * See also #PSA_KEY_TYPE_VENDOR_FLAG. + */ +#define PSA_KEY_TYPE_IS_VENDOR_DEFINED(type) \ + (((type) & PSA_KEY_TYPE_VENDOR_FLAG) != 0) + +/** Whether a key type is an unstructured array of bytes. + * + * This encompasses both symmetric keys and non-key data. + */ +#define PSA_KEY_TYPE_IS_UNSTRUCTURED(type) \ + (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_RAW || \ + ((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_SYMMETRIC) + +/** Whether a key type is asymmetric: either a key pair or a public key. */ +#define PSA_KEY_TYPE_IS_ASYMMETRIC(type) \ + (((type) & PSA_KEY_TYPE_CATEGORY_MASK \ + & ~PSA_KEY_TYPE_CATEGORY_FLAG_PAIR) == \ + PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY) +/** Whether a key type is the public part of a key pair. */ +#define PSA_KEY_TYPE_IS_PUBLIC_KEY(type) \ + (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY) +/** Whether a key type is a key pair containing a private part and a public + * part. */ +#define PSA_KEY_TYPE_IS_KEY_PAIR(type) \ + (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_KEY_PAIR) +/** The key pair type corresponding to a public key type. + * + * You may also pass a key pair type as \p type, it will be left unchanged. + * + * \param type A public key type or key pair type. + * + * \return The corresponding key pair type. + * If \p type is not a public key or a key pair, + * the return value is undefined. + */ +#define PSA_KEY_TYPE_KEY_PAIR_OF_PUBLIC_KEY(type) \ + ((type) | PSA_KEY_TYPE_CATEGORY_FLAG_PAIR) +/** The public key type corresponding to a key pair type. + * + * You may also pass a public key type as \p type, it will be left unchanged. + * + * \param type A public key type or key pair type. + * + * \return The corresponding public key type. + * If \p type is not a public key or a key pair, + * the return value is undefined. + */ +#define PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) \ + ((type) & ~PSA_KEY_TYPE_CATEGORY_FLAG_PAIR) + +/** Raw data. + * + * A "key" of this type cannot be used for any cryptographic operation. + * Applications may use this type to store arbitrary data in the keystore. */ +#define PSA_KEY_TYPE_RAW_DATA ((psa_key_type_t) 0x1001) + +/** HMAC key. + * + * The key policy determines which underlying hash algorithm the key can be + * used for. + * + * HMAC keys should generally have the same size as the underlying hash. + * This size can be calculated with #PSA_HASH_LENGTH(\c alg) where + * \c alg is the HMAC algorithm or the underlying hash algorithm. */ +#define PSA_KEY_TYPE_HMAC ((psa_key_type_t) 0x1100) + +/** A secret for key derivation. + * + * This key type is for high-entropy secrets only. For low-entropy secrets, + * #PSA_KEY_TYPE_PASSWORD should be used instead. + * + * These keys can be used as the #PSA_KEY_DERIVATION_INPUT_SECRET or + * #PSA_KEY_DERIVATION_INPUT_PASSWORD input of key derivation algorithms. + * + * The key policy determines which key derivation algorithm the key + * can be used for. + */ +#define PSA_KEY_TYPE_DERIVE ((psa_key_type_t) 0x1200) + +/** A low-entropy secret for password hashing or key derivation. + * + * This key type is suitable for passwords and passphrases which are typically + * intended to be memorizable by humans, and have a low entropy relative to + * their size. It can be used for randomly generated or derived keys with + * maximum or near-maximum entropy, but #PSA_KEY_TYPE_DERIVE is more suitable + * for such keys. It is not suitable for passwords with extremely low entropy, + * such as numerical PINs. + * + * These keys can be used as the #PSA_KEY_DERIVATION_INPUT_PASSWORD input of + * key derivation algorithms. Algorithms that accept such an input were + * designed to accept low-entropy secret and are known as password hashing or + * key stretching algorithms. + * + * These keys cannot be used as the #PSA_KEY_DERIVATION_INPUT_SECRET input of + * key derivation algorithms, as the algorithms that take such an input expect + * it to be high-entropy. + * + * The key policy determines which key derivation algorithm the key can be + * used for, among the permissible subset defined above. + */ +#define PSA_KEY_TYPE_PASSWORD ((psa_key_type_t) 0x1203) + +/** A secret value that can be used to verify a password hash. + * + * The key policy determines which key derivation algorithm the key + * can be used for, among the same permissible subset as for + * #PSA_KEY_TYPE_PASSWORD. + */ +#define PSA_KEY_TYPE_PASSWORD_HASH ((psa_key_type_t) 0x1205) + +/** A secret value that can be used in when computing a password hash. + * + * The key policy determines which key derivation algorithm the key + * can be used for, among the subset of algorithms that can use pepper. + */ +#define PSA_KEY_TYPE_PEPPER ((psa_key_type_t) 0x1206) + +/** Key for a cipher, AEAD or MAC algorithm based on the AES block cipher. + * + * The size of the key can be 16 bytes (AES-128), 24 bytes (AES-192) or + * 32 bytes (AES-256). + */ +#define PSA_KEY_TYPE_AES ((psa_key_type_t) 0x2400) + +/** Key for a cipher, AEAD or MAC algorithm based on the + * ARIA block cipher. */ +#define PSA_KEY_TYPE_ARIA ((psa_key_type_t) 0x2406) + +/** Key for a cipher or MAC algorithm based on DES or 3DES (Triple-DES). + * + * The size of the key can be 64 bits (single DES), 128 bits (2-key 3DES) or + * 192 bits (3-key 3DES). + * + * Note that single DES and 2-key 3DES are weak and strongly + * deprecated and should only be used to decrypt legacy data. 3-key 3DES + * is weak and deprecated and should only be used in legacy protocols. + */ +#define PSA_KEY_TYPE_DES ((psa_key_type_t) 0x2301) + +/** Key for a cipher, AEAD or MAC algorithm based on the + * Camellia block cipher. */ +#define PSA_KEY_TYPE_CAMELLIA ((psa_key_type_t) 0x2403) + +/** Key for the ChaCha20 stream cipher or the Chacha20-Poly1305 AEAD algorithm. + * + * ChaCha20 and the ChaCha20_Poly1305 construction are defined in RFC 7539. + * + * \note For ChaCha20 and ChaCha20_Poly1305, Mbed TLS only supports + * 12-byte nonces. + * + * \note For ChaCha20, the initial counter value is 0. To encrypt or decrypt + * with the initial counter value 1, you can process and discard a + * 64-byte block before the real data. + */ +#define PSA_KEY_TYPE_CHACHA20 ((psa_key_type_t) 0x2004) + +/** RSA public key. + * + * The size of an RSA key is the bit size of the modulus. + */ +#define PSA_KEY_TYPE_RSA_PUBLIC_KEY ((psa_key_type_t) 0x4001) +/** RSA key pair (private and public key). + * + * The size of an RSA key is the bit size of the modulus. + */ +#define PSA_KEY_TYPE_RSA_KEY_PAIR ((psa_key_type_t) 0x7001) +/** Whether a key type is an RSA key (pair or public-only). */ +#define PSA_KEY_TYPE_IS_RSA(type) \ + (PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) == PSA_KEY_TYPE_RSA_PUBLIC_KEY) + +#define PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE ((psa_key_type_t) 0x4100) +#define PSA_KEY_TYPE_ECC_KEY_PAIR_BASE ((psa_key_type_t) 0x7100) +#define PSA_KEY_TYPE_ECC_CURVE_MASK ((psa_key_type_t) 0x00ff) +/** Elliptic curve key pair. + * + * The size of an elliptic curve key is the bit size associated with the curve, + * i.e. the bit size of *q* for a curve over a field *Fq*. + * See the documentation of `PSA_ECC_FAMILY_xxx` curve families for details. + * + * \param curve A value of type ::psa_ecc_family_t that + * identifies the ECC curve to be used. + */ +#define PSA_KEY_TYPE_ECC_KEY_PAIR(curve) \ + (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve)) +/** Elliptic curve public key. + * + * The size of an elliptic curve public key is the same as the corresponding + * private key (see #PSA_KEY_TYPE_ECC_KEY_PAIR and the documentation of + * `PSA_ECC_FAMILY_xxx` curve families). + * + * \param curve A value of type ::psa_ecc_family_t that + * identifies the ECC curve to be used. + */ +#define PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve) \ + (PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE | (curve)) + +/** Whether a key type is an elliptic curve key (pair or public-only). */ +#define PSA_KEY_TYPE_IS_ECC(type) \ + ((PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) & \ + ~PSA_KEY_TYPE_ECC_CURVE_MASK) == PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE) +/** Whether a key type is an elliptic curve key pair. */ +#define PSA_KEY_TYPE_IS_ECC_KEY_PAIR(type) \ + (((type) & ~PSA_KEY_TYPE_ECC_CURVE_MASK) == \ + PSA_KEY_TYPE_ECC_KEY_PAIR_BASE) +/** Whether a key type is an elliptic curve public key. */ +#define PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY(type) \ + (((type) & ~PSA_KEY_TYPE_ECC_CURVE_MASK) == \ + PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE) + +/** Extract the curve from an elliptic curve key type. */ +#define PSA_KEY_TYPE_ECC_GET_FAMILY(type) \ + ((psa_ecc_family_t) (PSA_KEY_TYPE_IS_ECC(type) ? \ + ((type) & PSA_KEY_TYPE_ECC_CURVE_MASK) : \ + 0)) + +/** Check if the curve of given family is Weierstrass elliptic curve. */ +#define PSA_ECC_FAMILY_IS_WEIERSTRASS(family) ((family & 0xc0) == 0) + +/** SEC Koblitz curves over prime fields. + * + * This family comprises the following curves: + * secp192k1, secp224k1, secp256k1. + * They are defined in _Standards for Efficient Cryptography_, + * _SEC 2: Recommended Elliptic Curve Domain Parameters_. + * https://www.secg.org/sec2-v2.pdf + * + * \note For secp224k1, the bit-size is 225 (size of a private value). + * + * \note Mbed TLS only supports secp192k1 and secp256k1. + */ +#define PSA_ECC_FAMILY_SECP_K1 ((psa_ecc_family_t) 0x17) + +/** SEC random curves over prime fields. + * + * This family comprises the following curves: + * secp192r1, secp224r1, secp256r1, secp384r1, secp521r1. + * They are defined in _Standards for Efficient Cryptography_, + * _SEC 2: Recommended Elliptic Curve Domain Parameters_. + * https://www.secg.org/sec2-v2.pdf + */ +#define PSA_ECC_FAMILY_SECP_R1 ((psa_ecc_family_t) 0x12) +/* SECP160R2 (SEC2 v1, obsolete, not supported in Mbed TLS) */ +#define PSA_ECC_FAMILY_SECP_R2 ((psa_ecc_family_t) 0x1b) + +/** SEC Koblitz curves over binary fields. + * + * This family comprises the following curves: + * sect163k1, sect233k1, sect239k1, sect283k1, sect409k1, sect571k1. + * They are defined in _Standards for Efficient Cryptography_, + * _SEC 2: Recommended Elliptic Curve Domain Parameters_. + * https://www.secg.org/sec2-v2.pdf + * + * \note Mbed TLS does not support any curve in this family. + */ +#define PSA_ECC_FAMILY_SECT_K1 ((psa_ecc_family_t) 0x27) + +/** SEC random curves over binary fields. + * + * This family comprises the following curves: + * sect163r1, sect233r1, sect283r1, sect409r1, sect571r1. + * They are defined in _Standards for Efficient Cryptography_, + * _SEC 2: Recommended Elliptic Curve Domain Parameters_. + * https://www.secg.org/sec2-v2.pdf + * + * \note Mbed TLS does not support any curve in this family. + */ +#define PSA_ECC_FAMILY_SECT_R1 ((psa_ecc_family_t) 0x22) + +/** SEC additional random curves over binary fields. + * + * This family comprises the following curve: + * sect163r2. + * It is defined in _Standards for Efficient Cryptography_, + * _SEC 2: Recommended Elliptic Curve Domain Parameters_. + * https://www.secg.org/sec2-v2.pdf + * + * \note Mbed TLS does not support any curve in this family. + */ +#define PSA_ECC_FAMILY_SECT_R2 ((psa_ecc_family_t) 0x2b) + +/** Brainpool P random curves. + * + * This family comprises the following curves: + * brainpoolP160r1, brainpoolP192r1, brainpoolP224r1, brainpoolP256r1, + * brainpoolP320r1, brainpoolP384r1, brainpoolP512r1. + * It is defined in RFC 5639. + * + * \note Mbed TLS only supports the 256-bit, 384-bit and 512-bit curves + * in this family. + */ +#define PSA_ECC_FAMILY_BRAINPOOL_P_R1 ((psa_ecc_family_t) 0x30) + +/** Curve25519 and Curve448. + * + * This family comprises the following Montgomery curves: + * - 255-bit: Bernstein et al., + * _Curve25519: new Diffie-Hellman speed records_, LNCS 3958, 2006. + * The algorithm #PSA_ALG_ECDH performs X25519 when used with this curve. + * - 448-bit: Hamburg, + * _Ed448-Goldilocks, a new elliptic curve_, NIST ECC Workshop, 2015. + * The algorithm #PSA_ALG_ECDH performs X448 when used with this curve. + */ +#define PSA_ECC_FAMILY_MONTGOMERY ((psa_ecc_family_t) 0x41) + +/** The twisted Edwards curves Ed25519 and Ed448. + * + * These curves are suitable for EdDSA (#PSA_ALG_PURE_EDDSA for both curves, + * #PSA_ALG_ED25519PH for the 255-bit curve, + * #PSA_ALG_ED448PH for the 448-bit curve). + * + * This family comprises the following twisted Edwards curves: + * - 255-bit: Edwards25519, the twisted Edwards curve birationally equivalent + * to Curve25519. + * Bernstein et al., _Twisted Edwards curves_, Africacrypt 2008. + * - 448-bit: Edwards448, the twisted Edwards curve birationally equivalent + * to Curve448. + * Hamburg, _Ed448-Goldilocks, a new elliptic curve_, NIST ECC Workshop, 2015. + * + * \note Mbed TLS does not support Edwards curves yet. + */ +#define PSA_ECC_FAMILY_TWISTED_EDWARDS ((psa_ecc_family_t) 0x42) + +#define PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE ((psa_key_type_t) 0x4200) +#define PSA_KEY_TYPE_DH_KEY_PAIR_BASE ((psa_key_type_t) 0x7200) +#define PSA_KEY_TYPE_DH_GROUP_MASK ((psa_key_type_t) 0x00ff) +/** Diffie-Hellman key pair. + * + * \param group A value of type ::psa_dh_family_t that identifies the + * Diffie-Hellman group to be used. + */ +#define PSA_KEY_TYPE_DH_KEY_PAIR(group) \ + (PSA_KEY_TYPE_DH_KEY_PAIR_BASE | (group)) +/** Diffie-Hellman public key. + * + * \param group A value of type ::psa_dh_family_t that identifies the + * Diffie-Hellman group to be used. + */ +#define PSA_KEY_TYPE_DH_PUBLIC_KEY(group) \ + (PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE | (group)) + +/** Whether a key type is a Diffie-Hellman key (pair or public-only). */ +#define PSA_KEY_TYPE_IS_DH(type) \ + ((PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) & \ + ~PSA_KEY_TYPE_DH_GROUP_MASK) == PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE) +/** Whether a key type is a Diffie-Hellman key pair. */ +#define PSA_KEY_TYPE_IS_DH_KEY_PAIR(type) \ + (((type) & ~PSA_KEY_TYPE_DH_GROUP_MASK) == \ + PSA_KEY_TYPE_DH_KEY_PAIR_BASE) +/** Whether a key type is a Diffie-Hellman public key. */ +#define PSA_KEY_TYPE_IS_DH_PUBLIC_KEY(type) \ + (((type) & ~PSA_KEY_TYPE_DH_GROUP_MASK) == \ + PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE) + +/** Extract the group from a Diffie-Hellman key type. */ +#define PSA_KEY_TYPE_DH_GET_FAMILY(type) \ + ((psa_dh_family_t) (PSA_KEY_TYPE_IS_DH(type) ? \ + ((type) & PSA_KEY_TYPE_DH_GROUP_MASK) : \ + 0)) + +/** Diffie-Hellman groups defined in RFC 7919 Appendix A. + * + * This family includes groups with the following key sizes (in bits): + * 2048, 3072, 4096, 6144, 8192. A given implementation may support + * all of these sizes or only a subset. + */ +#define PSA_DH_FAMILY_RFC7919 ((psa_dh_family_t) 0x03) + +#define PSA_GET_KEY_TYPE_BLOCK_SIZE_EXPONENT(type) \ + (((type) >> 8) & 7) +/** The block size of a block cipher. + * + * \param type A cipher key type (value of type #psa_key_type_t). + * + * \return The block size for a block cipher, or 1 for a stream cipher. + * The return value is undefined if \p type is not a supported + * cipher key type. + * + * \note It is possible to build stream cipher algorithms on top of a block + * cipher, for example CTR mode (#PSA_ALG_CTR). + * This macro only takes the key type into account, so it cannot be + * used to determine the size of the data that #psa_cipher_update() + * might buffer for future processing in general. + * + * \note This macro returns a compile-time constant if its argument is one. + * + * \warning This macro may evaluate its argument multiple times. + */ +#define PSA_BLOCK_CIPHER_BLOCK_LENGTH(type) \ + (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_SYMMETRIC ? \ + 1u << PSA_GET_KEY_TYPE_BLOCK_SIZE_EXPONENT(type) : \ + 0u) + +/* Note that algorithm values are embedded in the persistent key store, + * as part of key metadata. As a consequence, they must not be changed + * (unless the storage format version changes). + */ + +/** Vendor-defined algorithm flag. + * + * Algorithms defined by this standard will never have the #PSA_ALG_VENDOR_FLAG + * bit set. Vendors who define additional algorithms must use an encoding with + * the #PSA_ALG_VENDOR_FLAG bit set and should respect the bitwise structure + * used by standard encodings whenever practical. + */ +#define PSA_ALG_VENDOR_FLAG ((psa_algorithm_t) 0x80000000) + +#define PSA_ALG_CATEGORY_MASK ((psa_algorithm_t) 0x7f000000) +#define PSA_ALG_CATEGORY_HASH ((psa_algorithm_t) 0x02000000) +#define PSA_ALG_CATEGORY_MAC ((psa_algorithm_t) 0x03000000) +#define PSA_ALG_CATEGORY_CIPHER ((psa_algorithm_t) 0x04000000) +#define PSA_ALG_CATEGORY_AEAD ((psa_algorithm_t) 0x05000000) +#define PSA_ALG_CATEGORY_SIGN ((psa_algorithm_t) 0x06000000) +#define PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION ((psa_algorithm_t) 0x07000000) +#define PSA_ALG_CATEGORY_KEY_DERIVATION ((psa_algorithm_t) 0x08000000) +#define PSA_ALG_CATEGORY_KEY_AGREEMENT ((psa_algorithm_t) 0x09000000) + +/** Whether an algorithm is vendor-defined. + * + * See also #PSA_ALG_VENDOR_FLAG. + */ +#define PSA_ALG_IS_VENDOR_DEFINED(alg) \ + (((alg) & PSA_ALG_VENDOR_FLAG) != 0) + +/** Whether the specified algorithm is a hash algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a hash algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_HASH(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_HASH) + +/** Whether the specified algorithm is a MAC algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a MAC algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_MAC(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_MAC) + +/** Whether the specified algorithm is a symmetric cipher algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a symmetric cipher algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_CIPHER(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_CIPHER) + +/** Whether the specified algorithm is an authenticated encryption + * with associated data (AEAD) algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is an AEAD algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_AEAD(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_AEAD) + +/** Whether the specified algorithm is an asymmetric signature algorithm, + * also known as public-key signature algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is an asymmetric signature algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_SIGN(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_SIGN) + +/** Whether the specified algorithm is an asymmetric encryption algorithm, + * also known as public-key encryption algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is an asymmetric encryption algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_ASYMMETRIC_ENCRYPTION(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION) + +/** Whether the specified algorithm is a key agreement algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a key agreement algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_KEY_AGREEMENT(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_KEY_AGREEMENT) + +/** Whether the specified algorithm is a key derivation algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a key derivation algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_KEY_DERIVATION(alg) \ + (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_KEY_DERIVATION) + +/** Whether the specified algorithm is a key stretching / password hashing + * algorithm. + * + * A key stretching / password hashing algorithm is a key derivation algorithm + * that is suitable for use with a low-entropy secret such as a password. + * Equivalently, it's a key derivation algorithm that uses a + * #PSA_KEY_DERIVATION_INPUT_PASSWORD input step. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a key stretching / password hashing algorithm, 0 + * otherwise. This macro may return either 0 or 1 if \p alg is not a + * supported algorithm identifier. + */ +#define PSA_ALG_IS_KEY_DERIVATION_STRETCHING(alg) \ + (PSA_ALG_IS_KEY_DERIVATION(alg) && \ + (alg) & PSA_ALG_KEY_DERIVATION_STRETCHING_FLAG) + +/** An invalid algorithm identifier value. */ +/* *INDENT-OFF* (https://github.com/ARM-software/psa-arch-tests/issues/337) */ +#define PSA_ALG_NONE ((psa_algorithm_t)0) +/* *INDENT-ON* */ + +#define PSA_ALG_HASH_MASK ((psa_algorithm_t) 0x000000ff) +/** MD5 */ +#define PSA_ALG_MD5 ((psa_algorithm_t) 0x02000003) +/** PSA_ALG_RIPEMD160 */ +#define PSA_ALG_RIPEMD160 ((psa_algorithm_t) 0x02000004) +/** SHA1 */ +#define PSA_ALG_SHA_1 ((psa_algorithm_t) 0x02000005) +/** SHA2-224 */ +#define PSA_ALG_SHA_224 ((psa_algorithm_t) 0x02000008) +/** SHA2-256 */ +#define PSA_ALG_SHA_256 ((psa_algorithm_t) 0x02000009) +/** SHA2-384 */ +#define PSA_ALG_SHA_384 ((psa_algorithm_t) 0x0200000a) +/** SHA2-512 */ +#define PSA_ALG_SHA_512 ((psa_algorithm_t) 0x0200000b) +/** SHA2-512/224 */ +#define PSA_ALG_SHA_512_224 ((psa_algorithm_t) 0x0200000c) +/** SHA2-512/256 */ +#define PSA_ALG_SHA_512_256 ((psa_algorithm_t) 0x0200000d) +/** SHA3-224 */ +#define PSA_ALG_SHA3_224 ((psa_algorithm_t) 0x02000010) +/** SHA3-256 */ +#define PSA_ALG_SHA3_256 ((psa_algorithm_t) 0x02000011) +/** SHA3-384 */ +#define PSA_ALG_SHA3_384 ((psa_algorithm_t) 0x02000012) +/** SHA3-512 */ +#define PSA_ALG_SHA3_512 ((psa_algorithm_t) 0x02000013) +/** The first 512 bits (64 bytes) of the SHAKE256 output. + * + * This is the prehashing for Ed448ph (see #PSA_ALG_ED448PH). For other + * scenarios where a hash function based on SHA3/SHAKE is desired, SHA3-512 + * has the same output size and a (theoretically) higher security strength. + */ +#define PSA_ALG_SHAKE256_512 ((psa_algorithm_t) 0x02000015) + +/** In a hash-and-sign algorithm policy, allow any hash algorithm. + * + * This value may be used to form the algorithm usage field of a policy + * for a signature algorithm that is parametrized by a hash. The key + * may then be used to perform operations using the same signature + * algorithm parametrized with any supported hash. + * + * That is, suppose that `PSA_xxx_SIGNATURE` is one of the following macros: + * - #PSA_ALG_RSA_PKCS1V15_SIGN, #PSA_ALG_RSA_PSS, #PSA_ALG_RSA_PSS_ANY_SALT, + * - #PSA_ALG_ECDSA, #PSA_ALG_DETERMINISTIC_ECDSA. + * Then you may create and use a key as follows: + * - Set the key usage field using #PSA_ALG_ANY_HASH, for example: + * ``` + * psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); // or VERIFY + * psa_set_key_algorithm(&attributes, PSA_xxx_SIGNATURE(PSA_ALG_ANY_HASH)); + * ``` + * - Import or generate key material. + * - Call psa_sign_hash() or psa_verify_hash(), passing + * an algorithm built from `PSA_xxx_SIGNATURE` and a specific hash. Each + * call to sign or verify a message may use a different hash. + * ``` + * psa_sign_hash(key, PSA_xxx_SIGNATURE(PSA_ALG_SHA_256), ...); + * psa_sign_hash(key, PSA_xxx_SIGNATURE(PSA_ALG_SHA_512), ...); + * psa_sign_hash(key, PSA_xxx_SIGNATURE(PSA_ALG_SHA3_256), ...); + * ``` + * + * This value may not be used to build other algorithms that are + * parametrized over a hash. For any valid use of this macro to build + * an algorithm \c alg, #PSA_ALG_IS_HASH_AND_SIGN(\c alg) is true. + * + * This value may not be used to build an algorithm specification to + * perform an operation. It is only valid to build policies. + */ +#define PSA_ALG_ANY_HASH ((psa_algorithm_t) 0x020000ff) + +#define PSA_ALG_MAC_SUBCATEGORY_MASK ((psa_algorithm_t) 0x00c00000) +#define PSA_ALG_HMAC_BASE ((psa_algorithm_t) 0x03800000) +/** Macro to build an HMAC algorithm. + * + * For example, #PSA_ALG_HMAC(#PSA_ALG_SHA_256) is HMAC-SHA-256. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding HMAC algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_HMAC(hash_alg) \ + (PSA_ALG_HMAC_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +#define PSA_ALG_HMAC_GET_HASH(hmac_alg) \ + (PSA_ALG_CATEGORY_HASH | ((hmac_alg) & PSA_ALG_HASH_MASK)) + +/** Whether the specified algorithm is an HMAC algorithm. + * + * HMAC is a family of MAC algorithms that are based on a hash function. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is an HMAC algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_HMAC(alg) \ + (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_MAC_SUBCATEGORY_MASK)) == \ + PSA_ALG_HMAC_BASE) + +/* In the encoding of a MAC algorithm, the bits corresponding to + * PSA_ALG_MAC_TRUNCATION_MASK encode the length to which the MAC is + * truncated. As an exception, the value 0 means the untruncated algorithm, + * whatever its length is. The length is encoded in 6 bits, so it can + * reach up to 63; the largest MAC is 64 bytes so its trivial truncation + * to full length is correctly encoded as 0 and any non-trivial truncation + * is correctly encoded as a value between 1 and 63. */ +#define PSA_ALG_MAC_TRUNCATION_MASK ((psa_algorithm_t) 0x003f0000) +#define PSA_MAC_TRUNCATION_OFFSET 16 + +/* In the encoding of a MAC algorithm, the bit corresponding to + * #PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG encodes the fact that the algorithm + * is a wildcard algorithm. A key with such wildcard algorithm as permitted + * algorithm policy can be used with any algorithm corresponding to the + * same base class and having a (potentially truncated) MAC length greater or + * equal than the one encoded in #PSA_ALG_MAC_TRUNCATION_MASK. */ +#define PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ((psa_algorithm_t) 0x00008000) + +/** Macro to build a truncated MAC algorithm. + * + * A truncated MAC algorithm is identical to the corresponding MAC + * algorithm except that the MAC value for the truncated algorithm + * consists of only the first \p mac_length bytes of the MAC value + * for the untruncated algorithm. + * + * \note This macro may allow constructing algorithm identifiers that + * are not valid, either because the specified length is larger + * than the untruncated MAC or because the specified length is + * smaller than permitted by the implementation. + * + * \note It is implementation-defined whether a truncated MAC that + * is truncated to the same length as the MAC of the untruncated + * algorithm is considered identical to the untruncated algorithm + * for policy comparison purposes. + * + * \param mac_alg A MAC algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_MAC(\p mac_alg) + * is true). This may be a truncated or untruncated + * MAC algorithm. + * \param mac_length Desired length of the truncated MAC in bytes. + * This must be at most the full length of the MAC + * and must be at least an implementation-specified + * minimum. The implementation-specified minimum + * shall not be zero. + * + * \return The corresponding MAC algorithm with the specified + * length. + * \return Unspecified if \p mac_alg is not a supported + * MAC algorithm or if \p mac_length is too small or + * too large for the specified MAC algorithm. + */ +#define PSA_ALG_TRUNCATED_MAC(mac_alg, mac_length) \ + (((mac_alg) & ~(PSA_ALG_MAC_TRUNCATION_MASK | \ + PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG)) | \ + ((mac_length) << PSA_MAC_TRUNCATION_OFFSET & PSA_ALG_MAC_TRUNCATION_MASK)) + +/** Macro to build the base MAC algorithm corresponding to a truncated + * MAC algorithm. + * + * \param mac_alg A MAC algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_MAC(\p mac_alg) + * is true). This may be a truncated or untruncated + * MAC algorithm. + * + * \return The corresponding base MAC algorithm. + * \return Unspecified if \p mac_alg is not a supported + * MAC algorithm. + */ +#define PSA_ALG_FULL_LENGTH_MAC(mac_alg) \ + ((mac_alg) & ~(PSA_ALG_MAC_TRUNCATION_MASK | \ + PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG)) + +/** Length to which a MAC algorithm is truncated. + * + * \param mac_alg A MAC algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_MAC(\p mac_alg) + * is true). + * + * \return Length of the truncated MAC in bytes. + * \return 0 if \p mac_alg is a non-truncated MAC algorithm. + * \return Unspecified if \p mac_alg is not a supported + * MAC algorithm. + */ +#define PSA_MAC_TRUNCATED_LENGTH(mac_alg) \ + (((mac_alg) & PSA_ALG_MAC_TRUNCATION_MASK) >> PSA_MAC_TRUNCATION_OFFSET) + +/** Macro to build a MAC minimum-MAC-length wildcard algorithm. + * + * A minimum-MAC-length MAC wildcard algorithm permits all MAC algorithms + * sharing the same base algorithm, and where the (potentially truncated) MAC + * length of the specific algorithm is equal to or larger then the wildcard + * algorithm's minimum MAC length. + * + * \note When setting the minimum required MAC length to less than the + * smallest MAC length allowed by the base algorithm, this effectively + * becomes an 'any-MAC-length-allowed' policy for that base algorithm. + * + * \param mac_alg A MAC algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_MAC(\p mac_alg) + * is true). + * \param min_mac_length Desired minimum length of the message authentication + * code in bytes. This must be at most the untruncated + * length of the MAC and must be at least 1. + * + * \return The corresponding MAC wildcard algorithm with the + * specified minimum length. + * \return Unspecified if \p mac_alg is not a supported MAC + * algorithm or if \p min_mac_length is less than 1 or + * too large for the specified MAC algorithm. + */ +#define PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(mac_alg, min_mac_length) \ + (PSA_ALG_TRUNCATED_MAC(mac_alg, min_mac_length) | \ + PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) + +#define PSA_ALG_CIPHER_MAC_BASE ((psa_algorithm_t) 0x03c00000) +/** The CBC-MAC construction over a block cipher + * + * \warning CBC-MAC is insecure in many cases. + * A more secure mode, such as #PSA_ALG_CMAC, is recommended. + */ +#define PSA_ALG_CBC_MAC ((psa_algorithm_t) 0x03c00100) +/** The CMAC construction over a block cipher */ +#define PSA_ALG_CMAC ((psa_algorithm_t) 0x03c00200) + +/** Whether the specified algorithm is a MAC algorithm based on a block cipher. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a MAC algorithm based on a block cipher, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_BLOCK_CIPHER_MAC(alg) \ + (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_MAC_SUBCATEGORY_MASK)) == \ + PSA_ALG_CIPHER_MAC_BASE) + +#define PSA_ALG_CIPHER_STREAM_FLAG ((psa_algorithm_t) 0x00800000) +#define PSA_ALG_CIPHER_FROM_BLOCK_FLAG ((psa_algorithm_t) 0x00400000) + +/** Whether the specified algorithm is a stream cipher. + * + * A stream cipher is a symmetric cipher that encrypts or decrypts messages + * by applying a bitwise-xor with a stream of bytes that is generated + * from a key. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a stream cipher algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier or if it is not a symmetric cipher algorithm. + */ +#define PSA_ALG_IS_STREAM_CIPHER(alg) \ + (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_CIPHER_STREAM_FLAG)) == \ + (PSA_ALG_CATEGORY_CIPHER | PSA_ALG_CIPHER_STREAM_FLAG)) + +/** The stream cipher mode of a stream cipher algorithm. + * + * The underlying stream cipher is determined by the key type. + * - To use ChaCha20, use a key type of #PSA_KEY_TYPE_CHACHA20. + */ +#define PSA_ALG_STREAM_CIPHER ((psa_algorithm_t) 0x04800100) + +/** The CTR stream cipher mode. + * + * CTR is a stream cipher which is built from a block cipher. + * The underlying block cipher is determined by the key type. + * For example, to use AES-128-CTR, use this algorithm with + * a key of type #PSA_KEY_TYPE_AES and a length of 128 bits (16 bytes). + */ +#define PSA_ALG_CTR ((psa_algorithm_t) 0x04c01000) + +/** The CFB stream cipher mode. + * + * The underlying block cipher is determined by the key type. + */ +#define PSA_ALG_CFB ((psa_algorithm_t) 0x04c01100) + +/** The OFB stream cipher mode. + * + * The underlying block cipher is determined by the key type. + */ +#define PSA_ALG_OFB ((psa_algorithm_t) 0x04c01200) + +/** The XTS cipher mode. + * + * XTS is a cipher mode which is built from a block cipher. It requires at + * least one full block of input, but beyond this minimum the input + * does not need to be a whole number of blocks. + */ +#define PSA_ALG_XTS ((psa_algorithm_t) 0x0440ff00) + +/** The Electronic Code Book (ECB) mode of a block cipher, with no padding. + * + * \warning ECB mode does not protect the confidentiality of the encrypted data + * except in extremely narrow circumstances. It is recommended that applications + * only use ECB if they need to construct an operating mode that the + * implementation does not provide. Implementations are encouraged to provide + * the modes that applications need in preference to supporting direct access + * to ECB. + * + * The underlying block cipher is determined by the key type. + * + * This symmetric cipher mode can only be used with messages whose lengths are a + * multiple of the block size of the chosen block cipher. + * + * ECB mode does not accept an initialization vector (IV). When using a + * multi-part cipher operation with this algorithm, psa_cipher_generate_iv() + * and psa_cipher_set_iv() must not be called. + */ +#define PSA_ALG_ECB_NO_PADDING ((psa_algorithm_t) 0x04404400) + +/** The CBC block cipher chaining mode, with no padding. + * + * The underlying block cipher is determined by the key type. + * + * This symmetric cipher mode can only be used with messages whose lengths + * are whole number of blocks for the chosen block cipher. + */ +#define PSA_ALG_CBC_NO_PADDING ((psa_algorithm_t) 0x04404000) + +/** The CBC block cipher chaining mode with PKCS#7 padding. + * + * The underlying block cipher is determined by the key type. + * + * This is the padding method defined by PKCS#7 (RFC 2315) §10.3. + */ +#define PSA_ALG_CBC_PKCS7 ((psa_algorithm_t) 0x04404100) + +#define PSA_ALG_AEAD_FROM_BLOCK_FLAG ((psa_algorithm_t) 0x00400000) + +/** Whether the specified algorithm is an AEAD mode on a block cipher. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is an AEAD algorithm which is an AEAD mode based on + * a block cipher, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) \ + (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_AEAD_FROM_BLOCK_FLAG)) == \ + (PSA_ALG_CATEGORY_AEAD | PSA_ALG_AEAD_FROM_BLOCK_FLAG)) + +/** The CCM authenticated encryption algorithm. + * + * The underlying block cipher is determined by the key type. + */ +#define PSA_ALG_CCM ((psa_algorithm_t) 0x05500100) + +/** The CCM* cipher mode without authentication. + * + * This is CCM* as specified in IEEE 802.15.4 §7, with a tag length of 0. + * For CCM* with a nonzero tag length, use the AEAD algorithm #PSA_ALG_CCM. + * + * The underlying block cipher is determined by the key type. + * + * Currently only 13-byte long IV's are supported. + */ +#define PSA_ALG_CCM_STAR_NO_TAG ((psa_algorithm_t) 0x04c01300) + +/** The GCM authenticated encryption algorithm. + * + * The underlying block cipher is determined by the key type. + */ +#define PSA_ALG_GCM ((psa_algorithm_t) 0x05500200) + +/** The Chacha20-Poly1305 AEAD algorithm. + * + * The ChaCha20_Poly1305 construction is defined in RFC 7539. + * + * Implementations must support 12-byte nonces, may support 8-byte nonces, + * and should reject other sizes. + * + * Implementations must support 16-byte tags and should reject other sizes. + */ +#define PSA_ALG_CHACHA20_POLY1305 ((psa_algorithm_t) 0x05100500) + +/* In the encoding of an AEAD algorithm, the bits corresponding to + * PSA_ALG_AEAD_TAG_LENGTH_MASK encode the length of the AEAD tag. + * The constants for default lengths follow this encoding. + */ +#define PSA_ALG_AEAD_TAG_LENGTH_MASK ((psa_algorithm_t) 0x003f0000) +#define PSA_AEAD_TAG_LENGTH_OFFSET 16 + +/* In the encoding of an AEAD algorithm, the bit corresponding to + * #PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG encodes the fact that the algorithm + * is a wildcard algorithm. A key with such wildcard algorithm as permitted + * algorithm policy can be used with any algorithm corresponding to the + * same base class and having a tag length greater than or equal to the one + * encoded in #PSA_ALG_AEAD_TAG_LENGTH_MASK. */ +#define PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ((psa_algorithm_t) 0x00008000) + +/** Macro to build a shortened AEAD algorithm. + * + * A shortened AEAD algorithm is similar to the corresponding AEAD + * algorithm, but has an authentication tag that consists of fewer bytes. + * Depending on the algorithm, the tag length may affect the calculation + * of the ciphertext. + * + * \param aead_alg An AEAD algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_AEAD(\p aead_alg) + * is true). + * \param tag_length Desired length of the authentication tag in bytes. + * + * \return The corresponding AEAD algorithm with the specified + * length. + * \return Unspecified if \p aead_alg is not a supported + * AEAD algorithm or if \p tag_length is not valid + * for the specified AEAD algorithm. + */ +#define PSA_ALG_AEAD_WITH_SHORTENED_TAG(aead_alg, tag_length) \ + (((aead_alg) & ~(PSA_ALG_AEAD_TAG_LENGTH_MASK | \ + PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG)) | \ + ((tag_length) << PSA_AEAD_TAG_LENGTH_OFFSET & \ + PSA_ALG_AEAD_TAG_LENGTH_MASK)) + +/** Retrieve the tag length of a specified AEAD algorithm + * + * \param aead_alg An AEAD algorithm identifier (value of type + * #psa_algorithm_t such that #PSA_ALG_IS_AEAD(\p aead_alg) + * is true). + * + * \return The tag length specified by the input algorithm. + * \return Unspecified if \p aead_alg is not a supported + * AEAD algorithm. + */ +#define PSA_ALG_AEAD_GET_TAG_LENGTH(aead_alg) \ + (((aead_alg) & PSA_ALG_AEAD_TAG_LENGTH_MASK) >> \ + PSA_AEAD_TAG_LENGTH_OFFSET) + +/** Calculate the corresponding AEAD algorithm with the default tag length. + * + * \param aead_alg An AEAD algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_AEAD(\p aead_alg) is true). + * + * \return The corresponding AEAD algorithm with the default + * tag length for that algorithm. + */ +#define PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(aead_alg) \ + ( \ + PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG_CASE(aead_alg, PSA_ALG_CCM) \ + PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG_CASE(aead_alg, PSA_ALG_GCM) \ + PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG_CASE(aead_alg, PSA_ALG_CHACHA20_POLY1305) \ + 0) +#define PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG_CASE(aead_alg, ref) \ + PSA_ALG_AEAD_WITH_SHORTENED_TAG(aead_alg, 0) == \ + PSA_ALG_AEAD_WITH_SHORTENED_TAG(ref, 0) ? \ + ref : + +/** Macro to build an AEAD minimum-tag-length wildcard algorithm. + * + * A minimum-tag-length AEAD wildcard algorithm permits all AEAD algorithms + * sharing the same base algorithm, and where the tag length of the specific + * algorithm is equal to or larger then the minimum tag length specified by the + * wildcard algorithm. + * + * \note When setting the minimum required tag length to less than the + * smallest tag length allowed by the base algorithm, this effectively + * becomes an 'any-tag-length-allowed' policy for that base algorithm. + * + * \param aead_alg An AEAD algorithm identifier (value of type + * #psa_algorithm_t such that + * #PSA_ALG_IS_AEAD(\p aead_alg) is true). + * \param min_tag_length Desired minimum length of the authentication tag in + * bytes. This must be at least 1 and at most the largest + * allowed tag length of the algorithm. + * + * \return The corresponding AEAD wildcard algorithm with the + * specified minimum length. + * \return Unspecified if \p aead_alg is not a supported + * AEAD algorithm or if \p min_tag_length is less than 1 + * or too large for the specified AEAD algorithm. + */ +#define PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(aead_alg, min_tag_length) \ + (PSA_ALG_AEAD_WITH_SHORTENED_TAG(aead_alg, min_tag_length) | \ + PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) + +#define PSA_ALG_RSA_PKCS1V15_SIGN_BASE ((psa_algorithm_t) 0x06000200) +/** RSA PKCS#1 v1.5 signature with hashing. + * + * This is the signature scheme defined by RFC 8017 + * (PKCS#1: RSA Cryptography Specifications) under the name + * RSASSA-PKCS1-v1_5. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding RSA PKCS#1 v1.5 signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_RSA_PKCS1V15_SIGN(hash_alg) \ + (PSA_ALG_RSA_PKCS1V15_SIGN_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +/** Raw PKCS#1 v1.5 signature. + * + * The input to this algorithm is the DigestInfo structure used by + * RFC 8017 (PKCS#1: RSA Cryptography Specifications), §9.2 + * steps 3–6. + */ +#define PSA_ALG_RSA_PKCS1V15_SIGN_RAW PSA_ALG_RSA_PKCS1V15_SIGN_BASE +#define PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_PKCS1V15_SIGN_BASE) + +#define PSA_ALG_RSA_PSS_BASE ((psa_algorithm_t) 0x06000300) +#define PSA_ALG_RSA_PSS_ANY_SALT_BASE ((psa_algorithm_t) 0x06001300) +/** RSA PSS signature with hashing. + * + * This is the signature scheme defined by RFC 8017 + * (PKCS#1: RSA Cryptography Specifications) under the name + * RSASSA-PSS, with the message generation function MGF1, and with + * a salt length equal to the length of the hash, or the largest + * possible salt length for the algorithm and key size if that is + * smaller than the hash length. The specified hash algorithm is + * used to hash the input message, to create the salted hash, and + * for the mask generation. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding RSA PSS signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_RSA_PSS(hash_alg) \ + (PSA_ALG_RSA_PSS_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +/** RSA PSS signature with hashing with relaxed verification. + * + * This algorithm has the same behavior as #PSA_ALG_RSA_PSS when signing, + * but allows an arbitrary salt length (including \c 0) when verifying a + * signature. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding RSA PSS signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_RSA_PSS_ANY_SALT(hash_alg) \ + (PSA_ALG_RSA_PSS_ANY_SALT_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +/** Whether the specified algorithm is RSA PSS with standard salt. + * + * \param alg An algorithm value or an algorithm policy wildcard. + * + * \return 1 if \p alg is of the form + * #PSA_ALG_RSA_PSS(\c hash_alg), + * where \c hash_alg is a hash algorithm or + * #PSA_ALG_ANY_HASH. 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not + * a supported algorithm identifier or policy. + */ +#define PSA_ALG_IS_RSA_PSS_STANDARD_SALT(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_PSS_BASE) + +/** Whether the specified algorithm is RSA PSS with any salt. + * + * \param alg An algorithm value or an algorithm policy wildcard. + * + * \return 1 if \p alg is of the form + * #PSA_ALG_RSA_PSS_ANY_SALT_BASE(\c hash_alg), + * where \c hash_alg is a hash algorithm or + * #PSA_ALG_ANY_HASH. 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not + * a supported algorithm identifier or policy. + */ +#define PSA_ALG_IS_RSA_PSS_ANY_SALT(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_PSS_ANY_SALT_BASE) + +/** Whether the specified algorithm is RSA PSS. + * + * This includes any of the RSA PSS algorithm variants, regardless of the + * constraints on salt length. + * + * \param alg An algorithm value or an algorithm policy wildcard. + * + * \return 1 if \p alg is of the form + * #PSA_ALG_RSA_PSS(\c hash_alg) or + * #PSA_ALG_RSA_PSS_ANY_SALT_BASE(\c hash_alg), + * where \c hash_alg is a hash algorithm or + * #PSA_ALG_ANY_HASH. 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not + * a supported algorithm identifier or policy. + */ +#define PSA_ALG_IS_RSA_PSS(alg) \ + (PSA_ALG_IS_RSA_PSS_STANDARD_SALT(alg) || \ + PSA_ALG_IS_RSA_PSS_ANY_SALT(alg)) + +#define PSA_ALG_ECDSA_BASE ((psa_algorithm_t) 0x06000600) +/** ECDSA signature with hashing. + * + * This is the ECDSA signature scheme defined by ANSI X9.62, + * with a random per-message secret number (*k*). + * + * The representation of the signature as a byte string consists of + * the concatenation of the signature values *r* and *s*. Each of + * *r* and *s* is encoded as an *N*-octet string, where *N* is the length + * of the base point of the curve in octets. Each value is represented + * in big-endian order (most significant octet first). + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding ECDSA signature algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_ECDSA(hash_alg) \ + (PSA_ALG_ECDSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +/** ECDSA signature without hashing. + * + * This is the same signature scheme as #PSA_ALG_ECDSA(), but + * without specifying a hash algorithm. This algorithm may only be + * used to sign or verify a sequence of bytes that should be an + * already-calculated hash. Note that the input is padded with + * zeros on the left or truncated on the left as required to fit + * the curve size. + */ +#define PSA_ALG_ECDSA_ANY PSA_ALG_ECDSA_BASE +#define PSA_ALG_DETERMINISTIC_ECDSA_BASE ((psa_algorithm_t) 0x06000700) +/** Deterministic ECDSA signature with hashing. + * + * This is the deterministic ECDSA signature scheme defined by RFC 6979. + * + * The representation of a signature is the same as with #PSA_ALG_ECDSA(). + * + * Note that when this algorithm is used for verification, signatures + * made with randomized ECDSA (#PSA_ALG_ECDSA(\p hash_alg)) with the + * same private key are accepted. In other words, + * #PSA_ALG_DETERMINISTIC_ECDSA(\p hash_alg) differs from + * #PSA_ALG_ECDSA(\p hash_alg) only for signature, not for verification. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * This includes #PSA_ALG_ANY_HASH + * when specifying the algorithm in a usage policy. + * + * \return The corresponding deterministic ECDSA signature + * algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_DETERMINISTIC_ECDSA(hash_alg) \ + (PSA_ALG_DETERMINISTIC_ECDSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +#define PSA_ALG_ECDSA_DETERMINISTIC_FLAG ((psa_algorithm_t) 0x00000100) +#define PSA_ALG_IS_ECDSA(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK & ~PSA_ALG_ECDSA_DETERMINISTIC_FLAG) == \ + PSA_ALG_ECDSA_BASE) +#define PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) \ + (((alg) & PSA_ALG_ECDSA_DETERMINISTIC_FLAG) != 0) +#define PSA_ALG_IS_DETERMINISTIC_ECDSA(alg) \ + (PSA_ALG_IS_ECDSA(alg) && PSA_ALG_ECDSA_IS_DETERMINISTIC(alg)) +#define PSA_ALG_IS_RANDOMIZED_ECDSA(alg) \ + (PSA_ALG_IS_ECDSA(alg) && !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg)) + +/** Edwards-curve digital signature algorithm without prehashing (PureEdDSA), + * using standard parameters. + * + * Contexts are not supported in the current version of this specification + * because there is no suitable signature interface that can take the + * context as a parameter. A future version of this specification may add + * suitable functions and extend this algorithm to support contexts. + * + * PureEdDSA requires an elliptic curve key on a twisted Edwards curve. + * In this specification, the following curves are supported: + * - #PSA_ECC_FAMILY_TWISTED_EDWARDS, 255-bit: Ed25519 as specified + * in RFC 8032. + * The curve is Edwards25519. + * The hash function used internally is SHA-512. + * - #PSA_ECC_FAMILY_TWISTED_EDWARDS, 448-bit: Ed448 as specified + * in RFC 8032. + * The curve is Edwards448. + * The hash function used internally is the first 114 bytes of the + * SHAKE256 output. + * + * This algorithm can be used with psa_sign_message() and + * psa_verify_message(). Since there is no prehashing, it cannot be used + * with psa_sign_hash() or psa_verify_hash(). + * + * The signature format is the concatenation of R and S as defined by + * RFC 8032 §5.1.6 and §5.2.6 (a 64-byte string for Ed25519, a 114-byte + * string for Ed448). + */ +#define PSA_ALG_PURE_EDDSA ((psa_algorithm_t) 0x06000800) + +#define PSA_ALG_HASH_EDDSA_BASE ((psa_algorithm_t) 0x06000900) +#define PSA_ALG_IS_HASH_EDDSA(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HASH_EDDSA_BASE) + +/** Edwards-curve digital signature algorithm with prehashing (HashEdDSA), + * using SHA-512 and the Edwards25519 curve. + * + * See #PSA_ALG_PURE_EDDSA regarding context support and the signature format. + * + * This algorithm is Ed25519 as specified in RFC 8032. + * The curve is Edwards25519. + * The prehash is SHA-512. + * The hash function used internally is SHA-512. + * + * This is a hash-and-sign algorithm: to calculate a signature, + * you can either: + * - call psa_sign_message() on the message; + * - or calculate the SHA-512 hash of the message + * with psa_hash_compute() + * or with a multi-part hash operation started with psa_hash_setup(), + * using the hash algorithm #PSA_ALG_SHA_512, + * then sign the calculated hash with psa_sign_hash(). + * Verifying a signature is similar, using psa_verify_message() or + * psa_verify_hash() instead of the signature function. + */ +#define PSA_ALG_ED25519PH \ + (PSA_ALG_HASH_EDDSA_BASE | (PSA_ALG_SHA_512 & PSA_ALG_HASH_MASK)) + +/** Edwards-curve digital signature algorithm with prehashing (HashEdDSA), + * using SHAKE256 and the Edwards448 curve. + * + * See #PSA_ALG_PURE_EDDSA regarding context support and the signature format. + * + * This algorithm is Ed448 as specified in RFC 8032. + * The curve is Edwards448. + * The prehash is the first 64 bytes of the SHAKE256 output. + * The hash function used internally is the first 114 bytes of the + * SHAKE256 output. + * + * This is a hash-and-sign algorithm: to calculate a signature, + * you can either: + * - call psa_sign_message() on the message; + * - or calculate the first 64 bytes of the SHAKE256 output of the message + * with psa_hash_compute() + * or with a multi-part hash operation started with psa_hash_setup(), + * using the hash algorithm #PSA_ALG_SHAKE256_512, + * then sign the calculated hash with psa_sign_hash(). + * Verifying a signature is similar, using psa_verify_message() or + * psa_verify_hash() instead of the signature function. + */ +#define PSA_ALG_ED448PH \ + (PSA_ALG_HASH_EDDSA_BASE | (PSA_ALG_SHAKE256_512 & PSA_ALG_HASH_MASK)) + +/* Default definition, to be overridden if the library is extended with + * more hash-and-sign algorithms that we want to keep out of this header + * file. */ +#define PSA_ALG_IS_VENDOR_HASH_AND_SIGN(alg) 0 + +/** Whether the specified algorithm is a signature algorithm that can be used + * with psa_sign_hash() and psa_verify_hash(). + * + * This encompasses all strict hash-and-sign algorithms categorized by + * PSA_ALG_IS_HASH_AND_SIGN(), as well as algorithms that follow the + * paradigm more loosely: + * - #PSA_ALG_RSA_PKCS1V15_SIGN_RAW (expects its input to be an encoded hash) + * - #PSA_ALG_ECDSA_ANY (doesn't specify what kind of hash the input is) + * + * \param alg An algorithm identifier (value of type psa_algorithm_t). + * + * \return 1 if alg is a signature algorithm that can be used to sign a + * hash. 0 if alg is a signature algorithm that can only be used + * to sign a message. 0 if alg is not a signature algorithm. + * This macro can return either 0 or 1 if alg is not a + * supported algorithm identifier. + */ +#define PSA_ALG_IS_SIGN_HASH(alg) \ + (PSA_ALG_IS_RSA_PSS(alg) || PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || \ + PSA_ALG_IS_ECDSA(alg) || PSA_ALG_IS_HASH_EDDSA(alg) || \ + PSA_ALG_IS_VENDOR_HASH_AND_SIGN(alg)) + +/** Whether the specified algorithm is a signature algorithm that can be used + * with psa_sign_message() and psa_verify_message(). + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if alg is a signature algorithm that can be used to sign a + * message. 0 if \p alg is a signature algorithm that can only be used + * to sign an already-calculated hash. 0 if \p alg is not a signature + * algorithm. This macro can return either 0 or 1 if \p alg is not a + * supported algorithm identifier. + */ +#define PSA_ALG_IS_SIGN_MESSAGE(alg) \ + (PSA_ALG_IS_SIGN_HASH(alg) || (alg) == PSA_ALG_PURE_EDDSA) + +/** Whether the specified algorithm is a hash-and-sign algorithm. + * + * Hash-and-sign algorithms are asymmetric (public-key) signature algorithms + * structured in two parts: first the calculation of a hash in a way that + * does not depend on the key, then the calculation of a signature from the + * hash value and the key. Hash-and-sign algorithms encode the hash + * used for the hashing step, and you can call #PSA_ALG_SIGN_GET_HASH + * to extract this algorithm. + * + * Thus, for a hash-and-sign algorithm, + * `psa_sign_message(key, alg, input, ...)` is equivalent to + * ``` + * psa_hash_compute(PSA_ALG_SIGN_GET_HASH(alg), input, ..., hash, ...); + * psa_sign_hash(key, alg, hash, ..., signature, ...); + * ``` + * Most usefully, separating the hash from the signature allows the hash + * to be calculated in multiple steps with psa_hash_setup(), psa_hash_update() + * and psa_hash_finish(). Likewise psa_verify_message() is equivalent to + * calculating the hash and then calling psa_verify_hash(). + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a hash-and-sign algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_HASH_AND_SIGN(alg) \ + (PSA_ALG_IS_SIGN_HASH(alg) && \ + ((alg) & PSA_ALG_HASH_MASK) != 0) + +/** Get the hash used by a hash-and-sign signature algorithm. + * + * A hash-and-sign algorithm is a signature algorithm which is + * composed of two phases: first a hashing phase which does not use + * the key and produces a hash of the input message, then a signing + * phase which only uses the hash and the key and not the message + * itself. + * + * \param alg A signature algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_SIGN(\p alg) is true). + * + * \return The underlying hash algorithm if \p alg is a hash-and-sign + * algorithm. + * \return 0 if \p alg is a signature algorithm that does not + * follow the hash-and-sign structure. + * \return Unspecified if \p alg is not a signature algorithm or + * if it is not supported by the implementation. + */ +#define PSA_ALG_SIGN_GET_HASH(alg) \ + (PSA_ALG_IS_HASH_AND_SIGN(alg) ? \ + ((alg) & PSA_ALG_HASH_MASK) | PSA_ALG_CATEGORY_HASH : \ + 0) + +/** RSA PKCS#1 v1.5 encryption. + * + * \warning Calling psa_asymmetric_decrypt() with this algorithm as a + * parameter is considered an inherently dangerous function + * (CWE-242). Unless it is used in a side channel free and safe + * way (eg. implementing the TLS protocol as per 7.4.7.1 of + * RFC 5246), the calling code is vulnerable. + * + */ +#define PSA_ALG_RSA_PKCS1V15_CRYPT ((psa_algorithm_t) 0x07000200) + +#define PSA_ALG_RSA_OAEP_BASE ((psa_algorithm_t) 0x07000300) +/** RSA OAEP encryption. + * + * This is the encryption scheme defined by RFC 8017 + * (PKCS#1: RSA Cryptography Specifications) under the name + * RSAES-OAEP, with the message generation function MGF1. + * + * \param hash_alg The hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true) to use + * for MGF1. + * + * \return The corresponding RSA OAEP encryption algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_RSA_OAEP(hash_alg) \ + (PSA_ALG_RSA_OAEP_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +#define PSA_ALG_IS_RSA_OAEP(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_OAEP_BASE) +#define PSA_ALG_RSA_OAEP_GET_HASH(alg) \ + (PSA_ALG_IS_RSA_OAEP(alg) ? \ + ((alg) & PSA_ALG_HASH_MASK) | PSA_ALG_CATEGORY_HASH : \ + 0) + +#define PSA_ALG_HKDF_BASE ((psa_algorithm_t) 0x08000100) +/** Macro to build an HKDF algorithm. + * + * For example, `PSA_ALG_HKDF(PSA_ALG_SHA_256)` is HKDF using HMAC-SHA-256. + * + * This key derivation algorithm uses the following inputs: + * - #PSA_KEY_DERIVATION_INPUT_SALT is the salt used in the "extract" step. + * It is optional; if omitted, the derivation uses an empty salt. + * - #PSA_KEY_DERIVATION_INPUT_SECRET is the secret key used in the "extract" step. + * - #PSA_KEY_DERIVATION_INPUT_INFO is the info string used in the "expand" step. + * You must pass #PSA_KEY_DERIVATION_INPUT_SALT before #PSA_KEY_DERIVATION_INPUT_SECRET. + * You may pass #PSA_KEY_DERIVATION_INPUT_INFO at any time after steup and before + * starting to generate output. + * + * \warning HKDF processes the salt as follows: first hash it with hash_alg + * if the salt is longer than the block size of the hash algorithm; then + * pad with null bytes up to the block size. As a result, it is possible + * for distinct salt inputs to result in the same outputs. To ensure + * unique outputs, it is recommended to use a fixed length for salt values. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding HKDF algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_HKDF(hash_alg) \ + (PSA_ALG_HKDF_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +/** Whether the specified algorithm is an HKDF algorithm. + * + * HKDF is a family of key derivation algorithms that are based on a hash + * function and the HMAC construction. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is an HKDF algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_HKDF(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_BASE) +#define PSA_ALG_HKDF_GET_HASH(hkdf_alg) \ + (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK)) + +#define PSA_ALG_HKDF_EXTRACT_BASE ((psa_algorithm_t) 0x08000400) +/** Macro to build an HKDF-Extract algorithm. + * + * For example, `PSA_ALG_HKDF_EXTRACT(PSA_ALG_SHA_256)` is + * HKDF-Extract using HMAC-SHA-256. + * + * This key derivation algorithm uses the following inputs: + * - PSA_KEY_DERIVATION_INPUT_SALT is the salt. + * - PSA_KEY_DERIVATION_INPUT_SECRET is the input keying material used in the + * "extract" step. + * The inputs are mandatory and must be passed in the order above. + * Each input may only be passed once. + * + * \warning HKDF-Extract is not meant to be used on its own. PSA_ALG_HKDF + * should be used instead if possible. PSA_ALG_HKDF_EXTRACT is provided + * as a separate algorithm for the sake of protocols that use it as a + * building block. It may also be a slight performance optimization + * in applications that use HKDF with the same salt and key but many + * different info strings. + * + * \warning HKDF processes the salt as follows: first hash it with hash_alg + * if the salt is longer than the block size of the hash algorithm; then + * pad with null bytes up to the block size. As a result, it is possible + * for distinct salt inputs to result in the same outputs. To ensure + * unique outputs, it is recommended to use a fixed length for salt values. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding HKDF-Extract algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_HKDF_EXTRACT(hash_alg) \ + (PSA_ALG_HKDF_EXTRACT_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +/** Whether the specified algorithm is an HKDF-Extract algorithm. + * + * HKDF-Extract is a family of key derivation algorithms that are based + * on a hash function and the HMAC construction. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is an HKDF-Extract algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_HKDF_EXTRACT(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_EXTRACT_BASE) + +#define PSA_ALG_HKDF_EXPAND_BASE ((psa_algorithm_t) 0x08000500) +/** Macro to build an HKDF-Expand algorithm. + * + * For example, `PSA_ALG_HKDF_EXPAND(PSA_ALG_SHA_256)` is + * HKDF-Expand using HMAC-SHA-256. + * + * This key derivation algorithm uses the following inputs: + * - PSA_KEY_DERIVATION_INPUT_SECRET is the pseudorandom key (PRK). + * - PSA_KEY_DERIVATION_INPUT_INFO is the info string. + * + * The inputs are mandatory and must be passed in the order above. + * Each input may only be passed once. + * + * \warning HKDF-Expand is not meant to be used on its own. `PSA_ALG_HKDF` + * should be used instead if possible. `PSA_ALG_HKDF_EXPAND` is provided as + * a separate algorithm for the sake of protocols that use it as a building + * block. It may also be a slight performance optimization in applications + * that use HKDF with the same salt and key but many different info strings. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding HKDF-Expand algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_HKDF_EXPAND(hash_alg) \ + (PSA_ALG_HKDF_EXPAND_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) +/** Whether the specified algorithm is an HKDF-Expand algorithm. + * + * HKDF-Expand is a family of key derivation algorithms that are based + * on a hash function and the HMAC construction. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is an HKDF-Expand algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_HKDF_EXPAND(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_EXPAND_BASE) + +/** Whether the specified algorithm is an HKDF or HKDF-Extract or + * HKDF-Expand algorithm. + * + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is any HKDF type algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_ANY_HKDF(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_BASE || \ + ((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_EXTRACT_BASE || \ + ((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_EXPAND_BASE) + +#define PSA_ALG_TLS12_PRF_BASE ((psa_algorithm_t) 0x08000200) +/** Macro to build a TLS-1.2 PRF algorithm. + * + * TLS 1.2 uses a custom pseudorandom function (PRF) for key schedule, + * specified in Section 5 of RFC 5246. It is based on HMAC and can be + * used with either SHA-256 or SHA-384. + * + * This key derivation algorithm uses the following inputs, which must be + * passed in the order given here: + * - #PSA_KEY_DERIVATION_INPUT_SEED is the seed. + * - #PSA_KEY_DERIVATION_INPUT_SECRET is the secret key. + * - #PSA_KEY_DERIVATION_INPUT_LABEL is the label. + * + * For the application to TLS-1.2 key expansion, the seed is the + * concatenation of ServerHello.Random + ClientHello.Random, + * and the label is "key expansion". + * + * For example, `PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256)` represents the + * TLS 1.2 PRF using HMAC-SHA-256. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding TLS-1.2 PRF algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_TLS12_PRF(hash_alg) \ + (PSA_ALG_TLS12_PRF_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +/** Whether the specified algorithm is a TLS-1.2 PRF algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is a TLS-1.2 PRF algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_TLS12_PRF(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_TLS12_PRF_BASE) +#define PSA_ALG_TLS12_PRF_GET_HASH(hkdf_alg) \ + (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK)) + +#define PSA_ALG_TLS12_PSK_TO_MS_BASE ((psa_algorithm_t) 0x08000300) +/** Macro to build a TLS-1.2 PSK-to-MasterSecret algorithm. + * + * In a pure-PSK handshake in TLS 1.2, the master secret is derived + * from the PreSharedKey (PSK) through the application of padding + * (RFC 4279, Section 2) and the TLS-1.2 PRF (RFC 5246, Section 5). + * The latter is based on HMAC and can be used with either SHA-256 + * or SHA-384. + * + * This key derivation algorithm uses the following inputs, which must be + * passed in the order given here: + * - #PSA_KEY_DERIVATION_INPUT_SEED is the seed. + * - #PSA_KEY_DERIVATION_INPUT_OTHER_SECRET is the other secret for the + * computation of the premaster secret. This input is optional; + * if omitted, it defaults to a string of null bytes with the same length + * as the secret (PSK) input. + * - #PSA_KEY_DERIVATION_INPUT_SECRET is the secret key. + * - #PSA_KEY_DERIVATION_INPUT_LABEL is the label. + * + * For the application to TLS-1.2, the seed (which is + * forwarded to the TLS-1.2 PRF) is the concatenation of the + * ClientHello.Random + ServerHello.Random, + * the label is "master secret" or "extended master secret" and + * the other secret depends on the key exchange specified in the cipher suite: + * - for a plain PSK cipher suite (RFC 4279, Section 2), omit + * PSA_KEY_DERIVATION_INPUT_OTHER_SECRET + * - for a DHE-PSK (RFC 4279, Section 3) or ECDHE-PSK cipher suite + * (RFC 5489, Section 2), the other secret should be the output of the + * PSA_ALG_FFDH or PSA_ALG_ECDH key agreement performed with the peer. + * The recommended way to pass this input is to use a key derivation + * algorithm constructed as + * PSA_ALG_KEY_AGREEMENT(ka_alg, PSA_ALG_TLS12_PSK_TO_MS(hash_alg)) + * and to call psa_key_derivation_key_agreement(). Alternatively, + * this input may be an output of `psa_raw_key_agreement()` passed with + * psa_key_derivation_input_bytes(), or an equivalent input passed with + * psa_key_derivation_input_bytes() or psa_key_derivation_input_key(). + * - for a RSA-PSK cipher suite (RFC 4279, Section 4), the other secret + * should be the 48-byte client challenge (the PreMasterSecret of + * (RFC 5246, Section 7.4.7.1)) concatenation of the TLS version and + * a 46-byte random string chosen by the client. On the server, this is + * typically an output of psa_asymmetric_decrypt() using + * PSA_ALG_RSA_PKCS1V15_CRYPT, passed to the key derivation operation + * with `psa_key_derivation_input_bytes()`. + * + * For example, `PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256)` represents the + * TLS-1.2 PSK to MasterSecret derivation PRF using HMAC-SHA-256. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding TLS-1.2 PSK to MS algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_TLS12_PSK_TO_MS(hash_alg) \ + (PSA_ALG_TLS12_PSK_TO_MS_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +/** Whether the specified algorithm is a TLS-1.2 PSK to MS algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is a TLS-1.2 PSK to MS algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_TLS12_PSK_TO_MS(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_TLS12_PSK_TO_MS_BASE) +#define PSA_ALG_TLS12_PSK_TO_MS_GET_HASH(hkdf_alg) \ + (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK)) + +/* The TLS 1.2 ECJPAKE-to-PMS KDF. It takes the shared secret K (an EC point + * in case of EC J-PAKE) and calculates SHA256(K.X) that the rest of TLS 1.2 + * will use to derive the session secret, as defined by step 2 of + * https://datatracker.ietf.org/doc/html/draft-cragie-tls-ecjpake-01#section-8.7. + * Uses PSA_ALG_SHA_256. + * This function takes a single input: + * #PSA_KEY_DERIVATION_INPUT_SECRET is the shared secret K from EC J-PAKE. + * The only supported curve is secp256r1 (the 256-bit curve in + * #PSA_ECC_FAMILY_SECP_R1), so the input must be exactly 65 bytes. + * The output has to be read as a single chunk of 32 bytes, defined as + * PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE. + */ +#define PSA_ALG_TLS12_ECJPAKE_TO_PMS ((psa_algorithm_t) 0x08000609) + +/* This flag indicates whether the key derivation algorithm is suitable for + * use on low-entropy secrets such as password - these algorithms are also + * known as key stretching or password hashing schemes. These are also the + * algorithms that accepts inputs of type #PSA_KEY_DERIVATION_INPUT_PASSWORD. + * + * Those algorithms cannot be combined with a key agreement algorithm. + */ +#define PSA_ALG_KEY_DERIVATION_STRETCHING_FLAG ((psa_algorithm_t) 0x00800000) + +#define PSA_ALG_PBKDF2_HMAC_BASE ((psa_algorithm_t) 0x08800100) +/** Macro to build a PBKDF2-HMAC password hashing / key stretching algorithm. + * + * PBKDF2 is defined by PKCS#5, republished as RFC 8018 (section 5.2). + * This macro specifies the PBKDF2 algorithm constructed using a PRF based on + * HMAC with the specified hash. + * For example, `PSA_ALG_PBKDF2_HMAC(PSA_ALG_SHA_256)` specifies PBKDF2 + * using the PRF HMAC-SHA-256. + * + * This key derivation algorithm uses the following inputs, which must be + * provided in the following order: + * - #PSA_KEY_DERIVATION_INPUT_COST is the iteration count. + * This input step must be used exactly once. + * - #PSA_KEY_DERIVATION_INPUT_SALT is the salt. + * This input step must be used one or more times; if used several times, the + * inputs will be concatenated. This can be used to build the final salt + * from multiple sources, both public and secret (also known as pepper). + * - #PSA_KEY_DERIVATION_INPUT_PASSWORD is the password to be hashed. + * This input step must be used exactly once. + * + * \param hash_alg A hash algorithm (\c PSA_ALG_XXX value such that + * #PSA_ALG_IS_HASH(\p hash_alg) is true). + * + * \return The corresponding PBKDF2-HMAC-XXX algorithm. + * \return Unspecified if \p hash_alg is not a supported + * hash algorithm. + */ +#define PSA_ALG_PBKDF2_HMAC(hash_alg) \ + (PSA_ALG_PBKDF2_HMAC_BASE | ((hash_alg) & PSA_ALG_HASH_MASK)) + +/** Whether the specified algorithm is a PBKDF2-HMAC algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is a PBKDF2-HMAC algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key derivation algorithm identifier. + */ +#define PSA_ALG_IS_PBKDF2_HMAC(alg) \ + (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_PBKDF2_HMAC_BASE) +#define PSA_ALG_PBKDF2_HMAC_GET_HASH(pbkdf2_alg) \ + (PSA_ALG_CATEGORY_HASH | ((pbkdf2_alg) & PSA_ALG_HASH_MASK)) +/** The PBKDF2-AES-CMAC-PRF-128 password hashing / key stretching algorithm. + * + * PBKDF2 is defined by PKCS#5, republished as RFC 8018 (section 5.2). + * This macro specifies the PBKDF2 algorithm constructed using the + * AES-CMAC-PRF-128 PRF specified by RFC 4615. + * + * This key derivation algorithm uses the same inputs as + * #PSA_ALG_PBKDF2_HMAC() with the same constraints. + */ +#define PSA_ALG_PBKDF2_AES_CMAC_PRF_128 ((psa_algorithm_t) 0x08800200) + +#define PSA_ALG_IS_PBKDF2(kdf_alg) \ + (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg) || \ + ((kdf_alg) == PSA_ALG_PBKDF2_AES_CMAC_PRF_128)) + +#define PSA_ALG_KEY_DERIVATION_MASK ((psa_algorithm_t) 0xfe00ffff) +#define PSA_ALG_KEY_AGREEMENT_MASK ((psa_algorithm_t) 0xffff0000) + +/** Macro to build a combined algorithm that chains a key agreement with + * a key derivation. + * + * \param ka_alg A key agreement algorithm (\c PSA_ALG_XXX value such + * that #PSA_ALG_IS_KEY_AGREEMENT(\p ka_alg) is true). + * \param kdf_alg A key derivation algorithm (\c PSA_ALG_XXX value such + * that #PSA_ALG_IS_KEY_DERIVATION(\p kdf_alg) is true). + * + * \return The corresponding key agreement and derivation + * algorithm. + * \return Unspecified if \p ka_alg is not a supported + * key agreement algorithm or \p kdf_alg is not a + * supported key derivation algorithm. + */ +#define PSA_ALG_KEY_AGREEMENT(ka_alg, kdf_alg) \ + ((ka_alg) | (kdf_alg)) + +#define PSA_ALG_KEY_AGREEMENT_GET_KDF(alg) \ + (((alg) & PSA_ALG_KEY_DERIVATION_MASK) | PSA_ALG_CATEGORY_KEY_DERIVATION) + +#define PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) \ + (((alg) & PSA_ALG_KEY_AGREEMENT_MASK) | PSA_ALG_CATEGORY_KEY_AGREEMENT) + +/** Whether the specified algorithm is a raw key agreement algorithm. + * + * A raw key agreement algorithm is one that does not specify + * a key derivation function. + * Usually, raw key agreement algorithms are constructed directly with + * a \c PSA_ALG_xxx macro while non-raw key agreement algorithms are + * constructed with #PSA_ALG_KEY_AGREEMENT(). + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \p alg is a raw key agreement algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \p alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_RAW_KEY_AGREEMENT(alg) \ + (PSA_ALG_IS_KEY_AGREEMENT(alg) && \ + PSA_ALG_KEY_AGREEMENT_GET_KDF(alg) == PSA_ALG_CATEGORY_KEY_DERIVATION) + +#define PSA_ALG_IS_KEY_DERIVATION_OR_AGREEMENT(alg) \ + ((PSA_ALG_IS_KEY_DERIVATION(alg) || PSA_ALG_IS_KEY_AGREEMENT(alg))) + +/** The finite-field Diffie-Hellman (DH) key agreement algorithm. + * + * The shared secret produced by key agreement is + * `g^{ab}` in big-endian format. + * It is `ceiling(m / 8)` bytes long where `m` is the size of the prime `p` + * in bits. + */ +#define PSA_ALG_FFDH ((psa_algorithm_t) 0x09010000) + +/** Whether the specified algorithm is a finite field Diffie-Hellman algorithm. + * + * This includes the raw finite field Diffie-Hellman algorithm as well as + * finite-field Diffie-Hellman followed by any supporter key derivation + * algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is a finite field Diffie-Hellman algorithm, 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key agreement algorithm identifier. + */ +#define PSA_ALG_IS_FFDH(alg) \ + (PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) == PSA_ALG_FFDH) + +/** The elliptic curve Diffie-Hellman (ECDH) key agreement algorithm. + * + * The shared secret produced by key agreement is the x-coordinate of + * the shared secret point. It is always `ceiling(m / 8)` bytes long where + * `m` is the bit size associated with the curve, i.e. the bit size of the + * order of the curve's coordinate field. When `m` is not a multiple of 8, + * the byte containing the most significant bit of the shared secret + * is padded with zero bits. The byte order is either little-endian + * or big-endian depending on the curve type. + * + * - For Montgomery curves (curve types `PSA_ECC_FAMILY_CURVEXXX`), + * the shared secret is the x-coordinate of `d_A Q_B = d_B Q_A` + * in little-endian byte order. + * The bit size is 448 for Curve448 and 255 for Curve25519. + * - For Weierstrass curves over prime fields (curve types + * `PSA_ECC_FAMILY_SECPXXX` and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`), + * the shared secret is the x-coordinate of `d_A Q_B = d_B Q_A` + * in big-endian byte order. + * The bit size is `m = ceiling(log_2(p))` for the field `F_p`. + * - For Weierstrass curves over binary fields (curve types + * `PSA_ECC_FAMILY_SECTXXX`), + * the shared secret is the x-coordinate of `d_A Q_B = d_B Q_A` + * in big-endian byte order. + * The bit size is `m` for the field `F_{2^m}`. + */ +#define PSA_ALG_ECDH ((psa_algorithm_t) 0x09020000) + +/** Whether the specified algorithm is an elliptic curve Diffie-Hellman + * algorithm. + * + * This includes the raw elliptic curve Diffie-Hellman algorithm as well as + * elliptic curve Diffie-Hellman followed by any supporter key derivation + * algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is an elliptic curve Diffie-Hellman algorithm, + * 0 otherwise. + * This macro may return either 0 or 1 if \c alg is not a supported + * key agreement algorithm identifier. + */ +#define PSA_ALG_IS_ECDH(alg) \ + (PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) == PSA_ALG_ECDH) + +/** Whether the specified algorithm encoding is a wildcard. + * + * Wildcard values may only be used to set the usage algorithm field in + * a policy, not to perform an operation. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return 1 if \c alg is a wildcard algorithm encoding. + * \return 0 if \c alg is a non-wildcard algorithm encoding (suitable for + * an operation). + * \return This macro may return either 0 or 1 if \c alg is not a supported + * algorithm identifier. + */ +#define PSA_ALG_IS_WILDCARD(alg) \ + (PSA_ALG_IS_HASH_AND_SIGN(alg) ? \ + PSA_ALG_SIGN_GET_HASH(alg) == PSA_ALG_ANY_HASH : \ + PSA_ALG_IS_MAC(alg) ? \ + (alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0 : \ + PSA_ALG_IS_AEAD(alg) ? \ + (alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0 : \ + (alg) == PSA_ALG_ANY_HASH) + +/** Get the hash used by a composite algorithm. + * + * \param alg An algorithm identifier (value of type #psa_algorithm_t). + * + * \return The underlying hash algorithm if alg is a composite algorithm that + * uses a hash algorithm. + * + * \return \c 0 if alg is not a composite algorithm that uses a hash. + */ +#define PSA_ALG_GET_HASH(alg) \ + (((alg) & 0x000000ff) == 0 ? ((psa_algorithm_t) 0) : 0x02000000 | ((alg) & 0x000000ff)) + +/**@}*/ + +/** \defgroup key_lifetimes Key lifetimes + * @{ + */ + +/* Note that location and persistence level values are embedded in the + * persistent key store, as part of key metadata. As a consequence, they + * must not be changed (unless the storage format version changes). + */ + +/** The default lifetime for volatile keys. + * + * A volatile key only exists as long as the identifier to it is not destroyed. + * The key material is guaranteed to be erased on a power reset. + * + * A key with this lifetime is typically stored in the RAM area of the + * PSA Crypto subsystem. However this is an implementation choice. + * If an implementation stores data about the key in a non-volatile memory, + * it must release all the resources associated with the key and erase the + * key material if the calling application terminates. + */ +#define PSA_KEY_LIFETIME_VOLATILE ((psa_key_lifetime_t) 0x00000000) + +/** The default lifetime for persistent keys. + * + * A persistent key remains in storage until it is explicitly destroyed or + * until the corresponding storage area is wiped. This specification does + * not define any mechanism to wipe a storage area, but integrations may + * provide their own mechanism (for example to perform a factory reset, + * to prepare for device refurbishment, or to uninstall an application). + * + * This lifetime value is the default storage area for the calling + * application. Integrations of Mbed TLS may support other persistent lifetimes. + * See ::psa_key_lifetime_t for more information. + */ +#define PSA_KEY_LIFETIME_PERSISTENT ((psa_key_lifetime_t) 0x00000001) + +/** The persistence level of volatile keys. + * + * See ::psa_key_persistence_t for more information. + */ +#define PSA_KEY_PERSISTENCE_VOLATILE ((psa_key_persistence_t) 0x00) + +/** The default persistence level for persistent keys. + * + * See ::psa_key_persistence_t for more information. + */ +#define PSA_KEY_PERSISTENCE_DEFAULT ((psa_key_persistence_t) 0x01) + +/** A persistence level indicating that a key is never destroyed. + * + * See ::psa_key_persistence_t for more information. + */ +#define PSA_KEY_PERSISTENCE_READ_ONLY ((psa_key_persistence_t) 0xff) + +#define PSA_KEY_LIFETIME_GET_PERSISTENCE(lifetime) \ + ((psa_key_persistence_t) ((lifetime) & 0x000000ff)) + +#define PSA_KEY_LIFETIME_GET_LOCATION(lifetime) \ + ((psa_key_location_t) ((lifetime) >> 8)) + +/** Whether a key lifetime indicates that the key is volatile. + * + * A volatile key is automatically destroyed by the implementation when + * the application instance terminates. In particular, a volatile key + * is automatically destroyed on a power reset of the device. + * + * A key that is not volatile is persistent. Persistent keys are + * preserved until the application explicitly destroys them or until an + * implementation-specific device management event occurs (for example, + * a factory reset). + * + * \param lifetime The lifetime value to query (value of type + * ::psa_key_lifetime_t). + * + * \return \c 1 if the key is volatile, otherwise \c 0. + */ +#define PSA_KEY_LIFETIME_IS_VOLATILE(lifetime) \ + (PSA_KEY_LIFETIME_GET_PERSISTENCE(lifetime) == \ + PSA_KEY_PERSISTENCE_VOLATILE) + +/** Whether a key lifetime indicates that the key is read-only. + * + * Read-only keys cannot be created or destroyed through the PSA Crypto API. + * They must be created through platform-specific means that bypass the API. + * + * Some platforms may offer ways to destroy read-only keys. For example, + * consider a platform with multiple levels of privilege, where a + * low-privilege application can use a key but is not allowed to destroy + * it, and the platform exposes the key to the application with a read-only + * lifetime. High-privilege code can destroy the key even though the + * application sees the key as read-only. + * + * \param lifetime The lifetime value to query (value of type + * ::psa_key_lifetime_t). + * + * \return \c 1 if the key is read-only, otherwise \c 0. + */ +#define PSA_KEY_LIFETIME_IS_READ_ONLY(lifetime) \ + (PSA_KEY_LIFETIME_GET_PERSISTENCE(lifetime) == \ + PSA_KEY_PERSISTENCE_READ_ONLY) + +/** Construct a lifetime from a persistence level and a location. + * + * \param persistence The persistence level + * (value of type ::psa_key_persistence_t). + * \param location The location indicator + * (value of type ::psa_key_location_t). + * + * \return The constructed lifetime value. + */ +#define PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(persistence, location) \ + ((location) << 8 | (persistence)) + +/** The local storage area for persistent keys. + * + * This storage area is available on all systems that can store persistent + * keys without delegating the storage to a third-party cryptoprocessor. + * + * See ::psa_key_location_t for more information. + */ +#define PSA_KEY_LOCATION_LOCAL_STORAGE ((psa_key_location_t) 0x000000) + +#define PSA_KEY_LOCATION_VENDOR_FLAG ((psa_key_location_t) 0x800000) + +/* Note that key identifier values are embedded in the + * persistent key store, as part of key metadata. As a consequence, they + * must not be changed (unless the storage format version changes). + */ + +/** The null key identifier. + */ +/* *INDENT-OFF* (https://github.com/ARM-software/psa-arch-tests/issues/337) */ +#define PSA_KEY_ID_NULL ((psa_key_id_t)0) +/* *INDENT-ON* */ +/** The minimum value for a key identifier chosen by the application. + */ +#define PSA_KEY_ID_USER_MIN ((psa_key_id_t) 0x00000001) +/** The maximum value for a key identifier chosen by the application. + */ +#define PSA_KEY_ID_USER_MAX ((psa_key_id_t) 0x3fffffff) +/** The minimum value for a key identifier chosen by the implementation. + */ +#define PSA_KEY_ID_VENDOR_MIN ((psa_key_id_t) 0x40000000) +/** The maximum value for a key identifier chosen by the implementation. + */ +#define PSA_KEY_ID_VENDOR_MAX ((psa_key_id_t) 0x7fffffff) + + +#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) + +#define MBEDTLS_SVC_KEY_ID_INIT ((psa_key_id_t) 0) +#define MBEDTLS_SVC_KEY_ID_GET_KEY_ID(id) (id) +#define MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(id) (0) + +/** Utility to initialize a key identifier at runtime. + * + * \param unused Unused parameter. + * \param key_id Identifier of the key. + */ +static inline mbedtls_svc_key_id_t mbedtls_svc_key_id_make( + unsigned int unused, psa_key_id_t key_id) +{ + (void) unused; + + return key_id; +} + +/** Compare two key identifiers. + * + * \param id1 First key identifier. + * \param id2 Second key identifier. + * + * \return Non-zero if the two key identifier are equal, zero otherwise. + */ +static inline int mbedtls_svc_key_id_equal(mbedtls_svc_key_id_t id1, + mbedtls_svc_key_id_t id2) +{ + return id1 == id2; +} + +/** Check whether a key identifier is null. + * + * \param key Key identifier. + * + * \return Non-zero if the key identifier is null, zero otherwise. + */ +static inline int mbedtls_svc_key_id_is_null(mbedtls_svc_key_id_t key) +{ + return key == 0; +} + +#else /* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */ + +#define MBEDTLS_SVC_KEY_ID_INIT ((mbedtls_svc_key_id_t){ 0, 0 }) +#define MBEDTLS_SVC_KEY_ID_GET_KEY_ID(id) ((id).MBEDTLS_PRIVATE(key_id)) +#define MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(id) ((id).MBEDTLS_PRIVATE(owner)) + +/** Utility to initialize a key identifier at runtime. + * + * \param owner_id Identifier of the key owner. + * \param key_id Identifier of the key. + */ +static inline mbedtls_svc_key_id_t mbedtls_svc_key_id_make( + mbedtls_key_owner_id_t owner_id, psa_key_id_t key_id) +{ + return (mbedtls_svc_key_id_t){ .MBEDTLS_PRIVATE(key_id) = key_id, + .MBEDTLS_PRIVATE(owner) = owner_id }; +} + +/** Compare two key identifiers. + * + * \param id1 First key identifier. + * \param id2 Second key identifier. + * + * \return Non-zero if the two key identifier are equal, zero otherwise. + */ +static inline int mbedtls_svc_key_id_equal(mbedtls_svc_key_id_t id1, + mbedtls_svc_key_id_t id2) +{ + return (id1.MBEDTLS_PRIVATE(key_id) == id2.MBEDTLS_PRIVATE(key_id)) && + mbedtls_key_owner_id_equal(id1.MBEDTLS_PRIVATE(owner), id2.MBEDTLS_PRIVATE(owner)); +} + +/** Check whether a key identifier is null. + * + * \param key Key identifier. + * + * \return Non-zero if the key identifier is null, zero otherwise. + */ +static inline int mbedtls_svc_key_id_is_null(mbedtls_svc_key_id_t key) +{ + return key.MBEDTLS_PRIVATE(key_id) == 0; +} + +#endif /* !MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER */ + +/**@}*/ + +/** \defgroup policy Key policies + * @{ + */ + +/* Note that key usage flags are embedded in the + * persistent key store, as part of key metadata. As a consequence, they + * must not be changed (unless the storage format version changes). + */ + +/** Whether the key may be exported. + * + * A public key or the public part of a key pair may always be exported + * regardless of the value of this permission flag. + * + * If a key does not have export permission, implementations shall not + * allow the key to be exported in plain form from the cryptoprocessor, + * whether through psa_export_key() or through a proprietary interface. + * The key may however be exportable in a wrapped form, i.e. in a form + * where it is encrypted by another key. + */ +#define PSA_KEY_USAGE_EXPORT ((psa_key_usage_t) 0x00000001) + +/** Whether the key may be copied. + * + * This flag allows the use of psa_copy_key() to make a copy of the key + * with the same policy or a more restrictive policy. + * + * For lifetimes for which the key is located in a secure element which + * enforce the non-exportability of keys, copying a key outside the secure + * element also requires the usage flag #PSA_KEY_USAGE_EXPORT. + * Copying the key inside the secure element is permitted with just + * #PSA_KEY_USAGE_COPY if the secure element supports it. + * For keys with the lifetime #PSA_KEY_LIFETIME_VOLATILE or + * #PSA_KEY_LIFETIME_PERSISTENT, the usage flag #PSA_KEY_USAGE_COPY + * is sufficient to permit the copy. + */ +#define PSA_KEY_USAGE_COPY ((psa_key_usage_t) 0x00000002) + +/** Whether the key may be used to encrypt a message. + * + * This flag allows the key to be used for a symmetric encryption operation, + * for an AEAD encryption-and-authentication operation, + * or for an asymmetric encryption operation, + * if otherwise permitted by the key's type and policy. + * + * For a key pair, this concerns the public key. + */ +#define PSA_KEY_USAGE_ENCRYPT ((psa_key_usage_t) 0x00000100) + +/** Whether the key may be used to decrypt a message. + * + * This flag allows the key to be used for a symmetric decryption operation, + * for an AEAD decryption-and-verification operation, + * or for an asymmetric decryption operation, + * if otherwise permitted by the key's type and policy. + * + * For a key pair, this concerns the private key. + */ +#define PSA_KEY_USAGE_DECRYPT ((psa_key_usage_t) 0x00000200) + +/** Whether the key may be used to sign a message. + * + * This flag allows the key to be used for a MAC calculation operation or for + * an asymmetric message signature operation, if otherwise permitted by the + * key’s type and policy. + * + * For a key pair, this concerns the private key. + */ +#define PSA_KEY_USAGE_SIGN_MESSAGE ((psa_key_usage_t) 0x00000400) + +/** Whether the key may be used to verify a message. + * + * This flag allows the key to be used for a MAC verification operation or for + * an asymmetric message signature verification operation, if otherwise + * permitted by the key’s type and policy. + * + * For a key pair, this concerns the public key. + */ +#define PSA_KEY_USAGE_VERIFY_MESSAGE ((psa_key_usage_t) 0x00000800) + +/** Whether the key may be used to sign a message. + * + * This flag allows the key to be used for a MAC calculation operation + * or for an asymmetric signature operation, + * if otherwise permitted by the key's type and policy. + * + * For a key pair, this concerns the private key. + */ +#define PSA_KEY_USAGE_SIGN_HASH ((psa_key_usage_t) 0x00001000) + +/** Whether the key may be used to verify a message signature. + * + * This flag allows the key to be used for a MAC verification operation + * or for an asymmetric signature verification operation, + * if otherwise permitted by the key's type and policy. + * + * For a key pair, this concerns the public key. + */ +#define PSA_KEY_USAGE_VERIFY_HASH ((psa_key_usage_t) 0x00002000) + +/** Whether the key may be used to derive other keys or produce a password + * hash. + * + * This flag allows the key to be used for a key derivation operation or for + * a key agreement operation, if otherwise permitted by the key's type and + * policy. + * + * If this flag is present on all keys used in calls to + * psa_key_derivation_input_key() for a key derivation operation, then it + * permits calling psa_key_derivation_output_bytes() or + * psa_key_derivation_output_key() at the end of the operation. + */ +#define PSA_KEY_USAGE_DERIVE ((psa_key_usage_t) 0x00004000) + +/** Whether the key may be used to verify the result of a key derivation, + * including password hashing. + * + * This flag allows the key to be used: + * + * This flag allows the key to be used in a key derivation operation, if + * otherwise permitted by the key's type and policy. + * + * If this flag is present on all keys used in calls to + * psa_key_derivation_input_key() for a key derivation operation, then it + * permits calling psa_key_derivation_verify_bytes() or + * psa_key_derivation_verify_key() at the end of the operation. + */ +#define PSA_KEY_USAGE_VERIFY_DERIVATION ((psa_key_usage_t) 0x00008000) + +/**@}*/ + +/** \defgroup derivation Key derivation + * @{ + */ + +/* Key input steps are not embedded in the persistent storage, so you can + * change them if needed: it's only an ABI change. */ + +/** A secret input for key derivation. + * + * This should be a key of type #PSA_KEY_TYPE_DERIVE + * (passed to psa_key_derivation_input_key()) + * or the shared secret resulting from a key agreement + * (obtained via psa_key_derivation_key_agreement()). + * + * The secret can also be a direct input (passed to + * key_derivation_input_bytes()). In this case, the derivation operation + * may not be used to derive keys: the operation will only allow + * psa_key_derivation_output_bytes(), + * psa_key_derivation_verify_bytes(), or + * psa_key_derivation_verify_key(), but not + * psa_key_derivation_output_key(). + */ +#define PSA_KEY_DERIVATION_INPUT_SECRET ((psa_key_derivation_step_t) 0x0101) + +/** A low-entropy secret input for password hashing / key stretching. + * + * This is usually a key of type #PSA_KEY_TYPE_PASSWORD (passed to + * psa_key_derivation_input_key()) or a direct input (passed to + * psa_key_derivation_input_bytes()) that is a password or passphrase. It can + * also be high-entropy secret such as a key of type #PSA_KEY_TYPE_DERIVE or + * the shared secret resulting from a key agreement. + * + * The secret can also be a direct input (passed to + * key_derivation_input_bytes()). In this case, the derivation operation + * may not be used to derive keys: the operation will only allow + * psa_key_derivation_output_bytes(), + * psa_key_derivation_verify_bytes(), or + * psa_key_derivation_verify_key(), but not + * psa_key_derivation_output_key(). + */ +#define PSA_KEY_DERIVATION_INPUT_PASSWORD ((psa_key_derivation_step_t) 0x0102) + +/** A high-entropy additional secret input for key derivation. + * + * This is typically the shared secret resulting from a key agreement obtained + * via `psa_key_derivation_key_agreement()`. It may alternatively be a key of + * type `PSA_KEY_TYPE_DERIVE` passed to `psa_key_derivation_input_key()`, or + * a direct input passed to `psa_key_derivation_input_bytes()`. + */ +#define PSA_KEY_DERIVATION_INPUT_OTHER_SECRET \ + ((psa_key_derivation_step_t) 0x0103) + +/** A label for key derivation. + * + * This should be a direct input. + * It can also be a key of type #PSA_KEY_TYPE_RAW_DATA. + */ +#define PSA_KEY_DERIVATION_INPUT_LABEL ((psa_key_derivation_step_t) 0x0201) + +/** A salt for key derivation. + * + * This should be a direct input. + * It can also be a key of type #PSA_KEY_TYPE_RAW_DATA or + * #PSA_KEY_TYPE_PEPPER. + */ +#define PSA_KEY_DERIVATION_INPUT_SALT ((psa_key_derivation_step_t) 0x0202) + +/** An information string for key derivation. + * + * This should be a direct input. + * It can also be a key of type #PSA_KEY_TYPE_RAW_DATA. + */ +#define PSA_KEY_DERIVATION_INPUT_INFO ((psa_key_derivation_step_t) 0x0203) + +/** A seed for key derivation. + * + * This should be a direct input. + * It can also be a key of type #PSA_KEY_TYPE_RAW_DATA. + */ +#define PSA_KEY_DERIVATION_INPUT_SEED ((psa_key_derivation_step_t) 0x0204) + +/** A cost parameter for password hashing / key stretching. + * + * This must be a direct input, passed to psa_key_derivation_input_integer(). + */ +#define PSA_KEY_DERIVATION_INPUT_COST ((psa_key_derivation_step_t) 0x0205) + +/**@}*/ + +/** \defgroup helper_macros Helper macros + * @{ + */ + +/* Helper macros */ + +/** Check if two AEAD algorithm identifiers refer to the same AEAD algorithm + * regardless of the tag length they encode. + * + * \param aead_alg_1 An AEAD algorithm identifier. + * \param aead_alg_2 An AEAD algorithm identifier. + * + * \return 1 if both identifiers refer to the same AEAD algorithm, + * 0 otherwise. + * Unspecified if neither \p aead_alg_1 nor \p aead_alg_2 are + * a supported AEAD algorithm. + */ +#define MBEDTLS_PSA_ALG_AEAD_EQUAL(aead_alg_1, aead_alg_2) \ + (!(((aead_alg_1) ^ (aead_alg_2)) & \ + ~(PSA_ALG_AEAD_TAG_LENGTH_MASK | PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG))) + +/**@}*/ + +/**@}*/ + +/** \defgroup interruptible Interruptible operations + * @{ + */ + +/** Maximum value for use with \c psa_interruptible_set_max_ops() to determine + * the maximum number of ops allowed to be executed by an interruptible + * function in a single call. + */ +#define PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED UINT32_MAX + +/**@}*/ + +#endif /* PSA_CRYPTO_VALUES_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/av1rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/av1rtppacketizer.hpp new file mode 100644 index 00000000..c2b2b79c --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/av1rtppacketizer.hpp @@ -0,0 +1,57 @@ +/** + * Copyright (c) 2023 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_AV1_RTP_PACKETIZER_H +#define RTC_AV1_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "nalunit.hpp" +#include "rtppacketizer.hpp" + +namespace rtc { + +// RTP packetization of AV1 payload +class RTC_CPP_EXPORT AV1RtpPacketizer final : public RtpPacketizer { +public: + inline static const uint32_t ClockRate = VideoClockRate; + [[deprecated("Use ClockRate")]] inline static const uint32_t defaultClockRate = ClockRate; + + // Define how OBUs are seperated in a AV1 Sample + enum class Packetization { + Obu = RTC_OBU_PACKETIZED_OBU, + TemporalUnit = RTC_OBU_PACKETIZED_TEMPORAL_UNIT, + }; + + // Constructs AV1 payload packetizer with given RTP configuration. + // @note RTP configuration is used in packetization process which may change some configuration + // properties such as sequence number. + AV1RtpPacketizer(Packetization packetization, shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + +private: + static std::vector extractTemporalUnitObus(const binary &data); + + std::vector fragment(binary data) override; + std::vector fragmentObu(const binary &data); + + const Packetization mPacketization; + const size_t mMaxFragmentSize; + + std::unique_ptr mSequenceHeader; +}; + +// For backward compatibility, do not use +using AV1PacketizationHandler [[deprecated("Add AV1RtpPacketizer directly")]] = PacketizationHandler; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_AV1_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/candidate.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/candidate.hpp new file mode 100644 index 00000000..00ca20d8 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/candidate.hpp @@ -0,0 +1,77 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_CANDIDATE_H +#define RTC_CANDIDATE_H + +#include "common.hpp" + +#include + +namespace rtc { + +class RTC_CPP_EXPORT Candidate { +public: + enum class Family { Unresolved, Ipv4, Ipv6 }; + enum class Type { Unknown, Host, ServerReflexive, PeerReflexive, Relayed }; + enum class TransportType { Unknown, Udp, TcpActive, TcpPassive, TcpSo, TcpUnknown }; + + Candidate(); + Candidate(string candidate); + Candidate(string candidate, string mid); + + void hintMid(string mid); + void changeAddress(string addr); + void changeAddress(string addr, uint16_t port); + void changeAddress(string addr, string service); + + enum class ResolveMode { Simple, Lookup }; + bool resolve(ResolveMode mode = ResolveMode::Simple); + + Type type() const; + TransportType transportType() const; + uint32_t priority() const; + string candidate() const; + string mid() const; + operator string() const; + + bool operator==(const Candidate &other) const; + bool operator!=(const Candidate &other) const; + + bool isResolved() const; + Family family() const; + optional address() const; + optional port() const; + +private: + void parse(string candidate); + + string mFoundation; + uint32_t mComponent, mPriority; + string mTypeString, mTransportString; + Type mType; + TransportType mTransportType; + string mNode, mService; + string mTail; + + optional mMid; + + // Extracted on resolution + Family mFamily; + string mAddress; + uint16_t mPort; +}; + +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, const Candidate &candidate); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, const Candidate::Type &type); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, + const Candidate::TransportType &transportType); + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/channel.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/channel.hpp new file mode 100644 index 00000000..384279d7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/channel.hpp @@ -0,0 +1,61 @@ +/** + * Copyright (c) 2019-2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_CHANNEL_H +#define RTC_CHANNEL_H + +#include "common.hpp" + +#include +#include + +namespace rtc { + +namespace impl { +struct Channel; +} + +class RTC_CPP_EXPORT Channel : private CheshireCat { +public: + virtual ~Channel(); + + virtual void close() = 0; + virtual bool send(message_variant data) = 0; // returns false if buffered + virtual bool send(const byte *data, size_t size) = 0; + + virtual bool isOpen() const = 0; + virtual bool isClosed() const = 0; + virtual size_t maxMessageSize() const; // max message size in a call to send + virtual size_t bufferedAmount() const; // total size buffered to send + + void onOpen(std::function callback); + void onClosed(std::function callback); + void onError(std::function callback); + + void onMessage(std::function callback); + void onMessage(std::function binaryCallback, + std::function stringCallback); + + void onBufferedAmountLow(std::function callback); + void setBufferedAmountLowThreshold(size_t amount); + + void resetCallbacks(); + + // Extended API + optional receive(); // only if onMessage unset + optional peek(); // only if onMessage unset + size_t availableAmount() const; // total size available to receive + void onAvailable(std::function callback); + +protected: + Channel(impl_ptr impl); +}; + +} // namespace rtc + +#endif // RTC_CHANNEL_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/common.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/common.hpp new file mode 100644 index 00000000..371f18f4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/common.hpp @@ -0,0 +1,85 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_COMMON_H +#define RTC_COMMON_H + +#ifdef RTC_STATIC +#define RTC_CPP_EXPORT +#else // dynamic library +#ifdef _WIN32 +#ifdef RTC_EXPORTS +#define RTC_CPP_EXPORT __declspec(dllexport) // building the library +#else +#define RTC_CPP_EXPORT __declspec(dllimport) // using the library +#endif +#else // not WIN32 +#define RTC_CPP_EXPORT +#endif +#endif + +#ifdef _WIN32 +#ifndef _WIN32_WINNT +#define _WIN32_WINNT 0x0602 // Windows 8 +#endif +#ifdef _MSC_VER +#pragma warning(disable : 4251) // disable "X needs to have dll-interface..." +#endif +#endif + +#ifndef RTC_ENABLE_WEBSOCKET +#define RTC_ENABLE_WEBSOCKET 1 +#endif + +#ifndef RTC_ENABLE_MEDIA +#define RTC_ENABLE_MEDIA 1 +#endif + +#include "rtc.h" // for C API defines + +#include "utils.hpp" + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace rtc { + +using std::byte; +using std::nullopt; +using std::optional; +using std::shared_ptr; +using std::string; +using std::string_view; +using std::unique_ptr; +using std::variant; +using std::weak_ptr; + +using binary = std::vector; +using message_variant = variant; + +using std::int16_t; +using std::int32_t; +using std::int64_t; +using std::int8_t; +using std::ptrdiff_t; +using std::size_t; +using std::uint16_t; +using std::uint32_t; +using std::uint64_t; +using std::uint8_t; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/configuration.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/configuration.hpp new file mode 100644 index 00000000..d02fa7ea --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/configuration.hpp @@ -0,0 +1,130 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_ICE_CONFIGURATION_H +#define RTC_ICE_CONFIGURATION_H + +#include "common.hpp" + +#include + +namespace rtc { + +struct RTC_CPP_EXPORT IceServer { + enum class Type { Stun, Turn }; + enum class RelayType { TurnUdp, TurnTcp, TurnTls }; + + // Any type + IceServer(const string &url); + + // STUN + IceServer(string hostname_, uint16_t port_); + IceServer(string hostname_, string service_); + + // TURN + IceServer(string hostname_, uint16_t port, string username_, string password_, + RelayType relayType_ = RelayType::TurnUdp); + IceServer(string hostname_, string service_, string username_, string password_, + RelayType relayType_ = RelayType::TurnUdp); + + string hostname; + uint16_t port; + Type type; + string username; + string password; + RelayType relayType; +}; + +struct RTC_CPP_EXPORT ProxyServer { + enum class Type { Http, Socks5 }; + + ProxyServer(const string &url); + + ProxyServer(Type type_, string hostname_, uint16_t port_); + ProxyServer(Type type_, string hostname_, uint16_t port_, string username_, string password_); + + Type type; + string hostname; + uint16_t port; + optional username; + optional password; +}; + +enum class CertificateType { + Default = RTC_CERTIFICATE_DEFAULT, // ECDSA + Ecdsa = RTC_CERTIFICATE_ECDSA, + Rsa = RTC_CERTIFICATE_RSA +}; + +enum class TransportPolicy { All = RTC_TRANSPORT_POLICY_ALL, Relay = RTC_TRANSPORT_POLICY_RELAY }; + +struct RTC_CPP_EXPORT Configuration { + // ICE settings + std::vector iceServers; + optional proxyServer; // libnice only + optional bindAddress; // libjuice only, default any + + // Options + CertificateType certificateType = CertificateType::Default; + TransportPolicy iceTransportPolicy = TransportPolicy::All; + bool enableIceTcp = false; + bool enableIceUdpMux = false; // libjuice only + bool disableAutoNegotiation = false; + bool disableAutoGathering = false; + bool forceMediaTransport = false; + bool disableFingerprintVerification = false; + + // Port range + uint16_t portRangeBegin = 1024; + uint16_t portRangeEnd = 65535; + + // Network MTU + optional mtu; + + // Local maximum message size for Data Channels + optional maxMessageSize; + + // Certificates and private keys + optional certificatePemFile; + optional keyPemFile; + optional keyPemPass; +}; + +#ifdef RTC_ENABLE_WEBSOCKET + +struct WebSocketConfiguration { + bool disableTlsVerification = false; // if true, don't verify the TLS certificate + optional proxyServer; // only non-authenticated http supported for now + std::vector protocols; + optional tcpConnectionTimeout; // zero to disable + optional connectionTimeout; // zero to disable + optional pingInterval; // zero to disable + optional maxOutstandingPings; + optional caCertificatePemFile; + optional certificatePemFile; + optional keyPemFile; + optional keyPemPass; + optional maxMessageSize; +}; + +struct WebSocketServerConfiguration { + uint16_t port = 8080; + bool enableTls = false; + optional certificatePemFile; + optional keyPemFile; + optional keyPemPass; + optional bindAddress; + optional connectionTimeout; + optional maxMessageSize; +}; + +#endif + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/datachannel.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/datachannel.hpp new file mode 100644 index 00000000..0e83a979 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/datachannel.hpp @@ -0,0 +1,80 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_DATA_CHANNEL_H +#define RTC_DATA_CHANNEL_H + +#include "channel.hpp" +#include "common.hpp" +#include "reliability.hpp" + +#include + +namespace rtc { + +namespace impl { + +struct DataChannel; +struct PeerConnection; + +} // namespace impl + +class RTC_CPP_EXPORT DataChannel final : private CheshireCat, public Channel { +public: + DataChannel(impl_ptr impl); + ~DataChannel() override; + + optional stream() const; + optional id() const; + string label() const; + string protocol() const; + Reliability reliability() const; + + bool isOpen(void) const override; + bool isClosed(void) const override; + size_t maxMessageSize() const override; + + void close(void) override; + bool send(message_variant data) override; + bool send(const byte *data, size_t size) override; + template bool sendBuffer(const Buffer &buf); + template bool sendBuffer(Iterator first, Iterator last); + +private: + using CheshireCat::impl; +}; + +template std::pair to_bytes(const Buffer &buf) { + using T = typename std::remove_pointer::type; + using E = typename std::conditional::value, byte, T>::type; + return std::make_pair(static_cast(static_cast(buf.data())), + buf.size() * sizeof(E)); +} + +template bool DataChannel::sendBuffer(const Buffer &buf) { + auto [bytes, size] = to_bytes(buf); + return send(bytes, size); +} + +template bool DataChannel::sendBuffer(Iterator first, Iterator last) { + size_t size = 0; + for (Iterator it = first; it != last; ++it) + size += it->size(); + + binary buffer(size); + byte *pos = buffer.data(); + for (Iterator it = first; it != last; ++it) { + auto [bytes, len] = to_bytes(*it); + pos = std::copy(bytes, bytes + len, pos); + } + return send(std::move(buffer)); +} + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/dependencydescriptor.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/dependencydescriptor.hpp new file mode 100644 index 00000000..59ddcdfd --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/dependencydescriptor.hpp @@ -0,0 +1,107 @@ +/** + * Copyright (c) 2024 Shigemasa Watanabe (Wandbox) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_DEPENDENCY_DESCRIPTOR_H +#define RTC_DEPENDENCY_DESCRIPTOR_H + +#include "common.hpp" + +#include + +namespace rtc { + +struct BitWriter { + static BitWriter fromSizeBits(byte *buf, size_t offsetBits, size_t sizeBits); + static BitWriter fromNull(); + + size_t getWrittenBits() const; + + bool write(uint64_t v, size_t bits); + // Write non-symmetric unsigned encoded integer + // ref: https://aomediacodec.github.io/av1-rtp-spec/#a82-syntax + bool writeNonSymmetric(uint64_t v, uint64_t n); + +private: + size_t writePartialByte(uint8_t *p, size_t offset, uint64_t v, size_t bits); + +private: + byte *mBuf = nullptr; + size_t mInitialOffset = 0; + size_t mOffset = 0; + size_t mSize = 0; +}; + +enum class DecodeTargetIndication { + NotPresent = 0, + Discardable = 1, + Switch = 2, + Required = 3, +}; + +struct RenderResolution { + int width = 0; + int height = 0; +}; + +struct FrameDependencyTemplate { + int spatialId = 0; + int temporalId = 0; + std::vector decodeTargetIndications; + std::vector frameDiffs; + std::vector chainDiffs; +}; + +struct FrameDependencyStructure { + int templateIdOffset = 0; + int decodeTargetCount = 0; + int chainCount = 0; + std::vector decodeTargetProtectedBy; + std::vector resolutions; + std::vector templates; +}; + +struct DependencyDescriptor { + bool startOfFrame = true; + bool endOfFrame = true; + int frameNumber = 0; + FrameDependencyTemplate dependencyTemplate; + std::optional resolution; + std::optional activeDecodeTargetsBitmask; + bool structureAttached; +}; + +struct DependencyDescriptorContext { + DependencyDescriptor descriptor; + std::bitset<32> activeChains; + FrameDependencyStructure structure; +}; + +// Write dependency descriptor to RTP Header Extension +// Dependency descriptor specification is here: +// https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension +class DependencyDescriptorWriter { +public: + explicit DependencyDescriptorWriter(const DependencyDescriptorContext& context); + size_t getSizeBits() const; + size_t getSize() const; + void writeTo(byte *buf, size_t sizeBytes) const; + +private: + void doWriteTo(BitWriter &writer) const; + void writeBits(BitWriter &writer, uint64_t v, size_t bits) const; + void writeNonSymmetric(BitWriter &writer, uint64_t v, uint64_t n) const; + +private: + const FrameDependencyStructure &mStructure; + std::bitset<32> mActiveChains; + const DependencyDescriptor &mDescriptor; +}; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/description.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/description.hpp new file mode 100644 index 00000000..573190d4 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/description.hpp @@ -0,0 +1,401 @@ +/** + * Copyright (c) 2019-2020 Paul-Louis Ageneau + * Copyright (c) 2020 Staz Modrzynski + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_DESCRIPTION_H +#define RTC_DESCRIPTION_H + +#include "candidate.hpp" +#include "common.hpp" +#include "rtp.hpp" + +#include +#include +#include + +namespace rtc { + +const string DEFAULT_OPUS_AUDIO_PROFILE = + "minptime=10;maxaveragebitrate=96000;stereo=1;sprop-stereo=1;useinbandfec=1"; + +// Use Constrained Baseline profile Level 3.1 (necessary for Firefox) +// https://developer.mozilla.org/en-US/docs/Web/Media/Formats/WebRTC_codecs#Supported_video_codecs +// TODO: Should be 42E0 but 42C0 appears to be more compatible. Investigate this. +const string DEFAULT_H264_VIDEO_PROFILE = + "profile-level-id=42e01f;packetization-mode=1;level-asymmetry-allowed=1"; + +struct CertificateFingerprint { + enum class Algorithm { Sha1, Sha224, Sha256, Sha384, Sha512 }; + static string AlgorithmIdentifier(Algorithm algorithm); + static size_t AlgorithmSize(Algorithm algorithm); + + bool isValid() const; + + Algorithm algorithm; + string value; +}; + +class RTC_CPP_EXPORT Description { +public: + enum class Type { Unspec, Offer, Answer, Pranswer, Rollback }; + enum class Role { ActPass, Passive, Active }; + + enum class Direction { + SendOnly = RTC_DIRECTION_SENDONLY, + RecvOnly = RTC_DIRECTION_RECVONLY, + SendRecv = RTC_DIRECTION_SENDRECV, + Inactive = RTC_DIRECTION_INACTIVE, + Unknown = RTC_DIRECTION_UNKNOWN + }; + + Description(const string &sdp, Type type = Type::Unspec, Role role = Role::ActPass); + Description(const string &sdp, string typeString); + + Type type() const; + string typeString() const; + Role role() const; + string bundleMid() const; + std::vector iceOptions() const; + optional iceUfrag() const; + optional icePwd() const; + optional fingerprint() const; + bool ended() const; + + void hintType(Type type); + void addIceOption(string option); + void removeIceOption(const string &option); + void setIceAttribute(string ufrag, string pwd); + void setFingerprint(CertificateFingerprint f); + + std::vector attributes() const; + void addAttribute(string attr); + void removeAttribute(const string &attr); + + std::vector candidates() const; + std::vector extractCandidates(); + bool hasCandidate(const Candidate &candidate) const; + void addCandidate(Candidate candidate); + void addCandidates(std::vector candidates); + void endCandidates(); + + operator string() const; + string generateSdp(string_view eol = "\r\n") const; + string generateApplicationSdp(string_view eol = "\r\n") const; + + class RTC_CPP_EXPORT RidAttribute { + public: + RidAttribute(string name, string value); + + [[nodiscard]] const string &name() const; + [[nodiscard]] const string &value() const; + + void value(string value); + + private: + string mName; + string mValue; + }; + + class RTC_CPP_EXPORT Rid { + public: + explicit Rid(string rid); + Rid(string rid, std::vector attributes); + + [[nodiscard]] const string &rid() const; + [[nodiscard]] const std::vector &attributes() const; + + private: + string mRid; + std::vector mAttributes; + }; + + class RTC_CPP_EXPORT RidBuilder { + public: + explicit RidBuilder(string rid); + + // https://datatracker.ietf.org/doc/html/rfc8851#name-arid-restrictions + RidBuilder& max_width(uint32_t value); + RidBuilder& max_height(uint32_t value); + RidBuilder& max_fps(uint32_t value); + RidBuilder& max_br(uint32_t value); + + RidBuilder& custom(string key, string value); + + // One time use only + [[nodiscard]] Rid build(); + + private: + string mRid; + std::vector mAttributes; + + RidBuilder& saveAttribute(string key, string value); + }; + + class RTC_CPP_EXPORT Entry { + public: + virtual ~Entry() = default; + + virtual string type() const; + virtual string protocol() const; + virtual string description() const; + virtual string mid() const; + + Direction direction() const; + void setDirection(Direction dir); + + bool isRemoved() const; + void markRemoved(); + + std::vector attributes() const; + void addAttribute(string attr); + void removeAttribute(const string &attr); + void addRid(string rid); // Just the name + void addRid(Rid rid); // With RFC 8851 attributes + + std::vector rids() const; + + struct RTC_CPP_EXPORT ExtMap { + static int parseId(string_view description); + + ExtMap(int id, string uri, Direction direction = Direction::Unknown); + ExtMap(string_view description); + + void setDescription(string_view description); + + int id; + string uri; + string attributes; + Direction direction = Direction::Unknown; + }; + + std::vector extIds(); + ExtMap *extMap(int id); + const ExtMap *extMap(int id) const; + void addExtMap(ExtMap map); + void removeExtMap(int id); + + operator string() const; + string generateSdp(string_view eol = "\r\n", string_view addr = "0.0.0.0", + uint16_t port = 9) const; + + virtual void parseSdpLine(string_view line); + + protected: + Entry(const string &mline, string mid, Direction dir = Direction::Unknown); + + virtual string generateSdpLines(string_view eol) const; + + std::vector mAttributes; + std::map mExtMaps; + + private: + string mType; + string mProtocol; + string mDescription; + string mMid; + std::vector mRids; + Direction mDirection; + bool mIsRemoved; + }; + + struct RTC_CPP_EXPORT Application : public Entry { + public: + Application(string mid = "data"); + Application(const string &mline, string mid); + virtual ~Application() = default; + + Application reciprocate() const; + + void setSctpPort(uint16_t port); + void hintSctpPort(uint16_t port); + void setMaxMessageSize(size_t size); + + optional sctpPort() const; + optional maxMessageSize() const; + + virtual void parseSdpLine(string_view line) override; + + private: + virtual string generateSdpLines(string_view eol) const override; + + optional mSctpPort; + optional mMaxMessageSize; + }; + + // Media (non-data) + class RTC_CPP_EXPORT Media : public Entry { + public: + Media(const string &mline, string mid, Direction dir = Direction::SendOnly); + Media(const string &sdp); + virtual ~Media() = default; + + string description() const override; + Media reciprocate() const; + + void addSSRC(uint32_t ssrc, optional name, optional msid = nullopt, + optional trackId = nullopt); + void removeSSRC(uint32_t ssrc); + void replaceSSRC(uint32_t old, uint32_t ssrc, optional name, + optional msid = nullopt, optional trackID = nullopt); + bool hasSSRC(uint32_t ssrc) const; + void clearSSRCs(); + std::vector getSSRCs() const; + optional getCNameForSsrc(uint32_t ssrc) const; + + void addRtxSSRC(SSRC primarySsrc, SSRC rtxSsrc, optional cname = nullopt); + void removeRtxSSRC(SSRC primarySsrc); + optional getRtxSsrcForSsrc(SSRC primarySsrc) const; + optional getSsrcForRtxSsrc(SSRC rtxSsrc) const; + + int bitrate() const; + void setBitrate(int bitrate); + + struct RTC_CPP_EXPORT RtpMap { + static int parsePayloadType(string_view description); + + explicit RtpMap(int payloadType); + RtpMap(string_view description); + + void setDescription(string_view description); + + void addFeedback(string fb); + void removeFeedback(const string &str); + bool hasFeedback(const string &str) const; + + void addParameter(string p); + void removeParameter(const string &str); + + int payloadType; + string format; + int clockRate; + string encParams; + + std::vector rtcpFbs; + std::vector fmtps; + }; + + bool hasPayloadType(int payloadType) const; + std::vector payloadTypes() const; + RtpMap *rtpMap(int payloadType); + const RtpMap *rtpMap(int payloadType) const; + void addRtpMap(RtpMap map); + void removeRtpMap(int payloadType); + void removeFormat(const string &format); + + void addRtxCodec(int payloadType, int origPayloadType, unsigned int clockRate); + + optional getRtxPayloadType(int primaryPayloadType) const; + + bool isRtxEnabled() const; + void disableRtx(); + + virtual void parseSdpLine(string_view line) override; + + private: + virtual string generateSdpLines(string_view eol) const override; + + int mBas = -1; + + std::vector mOrderedPayloadTypes; + std::map mRtpMaps; + std::vector mSsrcs; + std::map mCNameMap; + std::map mSsrcToRtxSsrc; // primary_ssrc -> rtx_ssrc + }; + + class RTC_CPP_EXPORT Audio : public Media { + public: + Audio(string mid = "audio", Direction dir = Direction::SendOnly); + + void addAudioCodec(int payloadType, string codec, optional profile = std::nullopt); + void addOpusCodec(int payloadType, optional profile = DEFAULT_OPUS_AUDIO_PROFILE); + void addPCMACodec(int payloadType, optional profile = std::nullopt); + void addPCMUCodec(int payloadType, optional profile = std::nullopt); + void addAACCodec(int payloadType, optional profile = std::nullopt); + void addG722Codec(int payloadType, optional profile = std::nullopt); + + [[deprecated("Use addAACCodec")]] inline void + addAacCodec(int payloadType, optional profile = std::nullopt) { + addAACCodec(payloadType, std::move(profile)); + }; + }; + + class RTC_CPP_EXPORT Video : public Media { + public: + Video(string mid = "video", Direction dir = Direction::SendOnly); + + void addVideoCodec(int payloadType, string codec, optional profile = std::nullopt); + + void addH264Codec(int payloadType, optional profile = DEFAULT_H264_VIDEO_PROFILE); + void addH265Codec(int payloadType, optional profile = std::nullopt); + void addVP8Codec(int payloadType, optional profile = std::nullopt); + void addVP9Codec(int payloadType, optional profile = std::nullopt); + void addAV1Codec(int payloadType, optional profile = std::nullopt); + }; + + // Adds RTX payload type mappings for SDP negotiation (codec level only). + // For per-stream RTX, also call Media::addRtxSSRC() once SSRCs are known. + // Set audio=true to also apply RTX to audio media streams. + void addRtx(optional clockRate = nullopt, bool audio = false); + + bool hasApplication() const; + bool hasAudioOrVideo() const; + bool hasMid(string_view mid) const; + + int addMedia(Media media); + int addMedia(Application application); + int addApplication(string mid = "data"); + int addVideo(string mid = "video", Direction dir = Direction::SendOnly); + int addAudio(string mid = "audio", Direction dir = Direction::SendOnly); + void clearMedia(); + + variant media(int index); + variant media(int index) const; + int mediaCount() const; + + const Application *application() const; + Application *application(); + + static Type stringToType(const string &typeString); + static string typeToString(Type type); + + string sessionId() const; + +private: + optional defaultCandidate() const; + shared_ptr createEntry(string mline, string mid, Direction dir); + void removeApplication(); + + Type mType; + + // Session-level attributes + Role mRole; + string mUsername; + string mSessionId; + std::vector mIceOptions; + optional mIceUfrag, mIcePwd; + optional mFingerprint; + std::vector mAttributes; // other attributes + + // Entries + std::vector> mEntries; + shared_ptr mApplication; + + // Candidates + std::vector mCandidates; + bool mEnded = false; +}; + +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, const Description &description); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, Description::Type type); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, Description::Role role); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, const Description::Direction &direction); + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/frameinfo.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/frameinfo.hpp new file mode 100644 index 00000000..2747e9fa --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/frameinfo.hpp @@ -0,0 +1,44 @@ +/** + * Copyright (c) 2019-2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_FRAMEINFO_H +#define RTC_FRAMEINFO_H + +#include "common.hpp" + +#include + +namespace rtc { + +struct RTC_CPP_EXPORT FrameInfo { + FrameInfo(uint32_t timestamp) : timestamp(timestamp) {}; + template> FrameInfo(std::chrono::duration timestamp) : timestampSeconds(timestamp) {} + + [[deprecated]] FrameInfo(uint8_t payloadType, uint32_t timestamp) : timestamp(timestamp), payloadType(payloadType) {}; + + uint32_t timestamp = 0; + uint8_t payloadType = 0; + + optional> timestampSeconds; + + bool isKeyFrame = false; // Set by the application + + /// Absolute capture timestamp in NTP-format (high 32 bits seconds since + /// the NTP epoch 1900-01-01 UTC; low 32 bits fractional seconds). When + /// set alongside an RtpPacketizationConfig with absCaptureTimeId > 0, + /// the RtpPacketizer writes the 8-byte form of the abs-capture-time RTP + /// header extension on every packet of this frame. Receivers use this + /// to recover the source's capture wallclock and compute glass-to-glass + /// latency. + /// https://webrtc.googlesource.com/src/+/refs/heads/main/docs/native-code/rtp-hdrext/abs-capture-time + optional absCaptureTimeNtp; +}; + +} // namespace rtc + +#endif // RTC_FRAMEINFO_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/global.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/global.hpp new file mode 100644 index 00000000..47b61331 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/global.hpp @@ -0,0 +1,66 @@ +/** + * Copyright (c) 2020-2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_GLOBAL_H +#define RTC_GLOBAL_H + +#include "common.hpp" + +#include +#include +#include + +namespace rtc { + +#ifdef None +#undef None +#endif + +enum class LogLevel { // Don't change, it must match plog severity + None = 0, + Fatal = 1, + Error = 2, + Warning = 3, + Info = 4, + Debug = 5, + Verbose = 6 +}; + +typedef std::function LogCallback; + +RTC_CPP_EXPORT void InitLogger(LogLevel level, LogCallback callback = nullptr); + +RTC_CPP_EXPORT void SetThreadPoolSize(unsigned int count); // 0: hardware concurrency + +struct SctpSettings { + // For the following settings, not set means optimized default + optional recvBufferSize; // in bytes + optional sendBufferSize; // in bytes + optional maxChunksOnQueue; // in chunks + optional initialCongestionWindow; // in MTUs + optional maxBurst; // in MTUs + optional congestionControlModule; // 0: RFC2581, 1: HSTCP, 2: H-TCP, 3: RTCC + optional delayedSackTime; + optional minRetransmitTimeout; + optional maxRetransmitTimeout; + optional initialRetransmitTimeout; + optional maxRetransmitAttempts; + optional heartbeatInterval; +}; + +RTC_CPP_EXPORT void SetSctpSettings(SctpSettings s); + +// Optional global preload and cleanup +RTC_CPP_EXPORT bool Preload(); +RTC_CPP_EXPORT std::shared_future Cleanup(); + +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, LogLevel level); + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtpdepacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtpdepacketizer.hpp new file mode 100644 index 00000000..19bbe97e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtpdepacketizer.hpp @@ -0,0 +1,42 @@ +/** + * Copyright (c) 2020 Staz Modrzynski + * Copyright (c) 2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_H264_RTP_DEPACKETIZER_H +#define RTC_H264_RTP_DEPACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "message.hpp" +#include "nalunit.hpp" +#include "rtp.hpp" +#include "rtpdepacketizer.hpp" + +namespace rtc { + +/// RTP depacketization for H264 +class RTC_CPP_EXPORT H264RtpDepacketizer final : public VideoRtpDepacketizer { +public: + using Separator = NalUnit::Separator; + + H264RtpDepacketizer(Separator separator = Separator::StartSequence); + ~H264RtpDepacketizer(); + +private: + message_ptr reassemble(message_buffer &buffer) override; + void addSeparator(binary &frame); + + const NalUnit::Separator mSeparator; +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif /* RTC_H264_RTP_DEPACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtppacketizer.hpp new file mode 100644 index 00000000..ffc5f2e7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/h264rtppacketizer.hpp @@ -0,0 +1,57 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * Copyright (c) 2023 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_H264_RTP_PACKETIZER_H +#define RTC_H264_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "nalunit.hpp" +#include "rtppacketizer.hpp" + +namespace rtc { + +/// RTP packetization for H264 +class RTC_CPP_EXPORT H264RtpPacketizer final : public RtpPacketizer { +public: + using Separator = NalUnit::Separator; + + inline static const uint32_t ClockRate = VideoClockRate; + [[deprecated("Use ClockRate")]] inline static const uint32_t defaultClockRate = ClockRate; + + /// Constructs h264 payload packetizer with given RTP configuration. + /// @note RTP configuration is used in packetization process which may change some configuration + /// properties such as sequence number. + /// @param separator NAL unit separator + /// @param rtpConfig RTP configuration + /// @param maxFragmentSize maximum size of one NALU fragment + H264RtpPacketizer(Separator separator, shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + + // For backward compatibility, do not use + [[deprecated]] H264RtpPacketizer( + shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + +private: + std::vector fragment(binary data) override; + std::vector splitFrame(const binary &frame); + + const Separator mSeparator; + const size_t mMaxFragmentSize; +}; + +// For backward compatibility, do not use +using H264PacketizationHandler [[deprecated("Add H264RtpPacketizer directly")]] = PacketizationHandler; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_H264_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/h265nalunit.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/h265nalunit.hpp new file mode 100644 index 00000000..ad40cf04 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/h265nalunit.hpp @@ -0,0 +1,194 @@ +/** + * Copyright (c) 2023 Zita Liao (Dolby) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_H265_NAL_UNIT_H +#define RTC_H265_NAL_UNIT_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "nalunit.hpp" + +#include +#include + +namespace rtc { + +#pragma pack(push, 1) + +#define H265_FU_HEADER_SIZE 1 +/// Nalu header +struct RTC_CPP_EXPORT H265NalUnitHeader { + /* + * nal_unit_header( ) { + * forbidden_zero_bit f(1) + * nal_unit_type u(6) + * nuh_layer_id u(6) + * nuh_temporal_id_plus1 u(3) + } + */ + uint8_t _first = 0; // high byte of header + uint8_t _second = 0; // low byte of header + + bool forbiddenBit() const { return _first >> 7; } + uint8_t unitType() const { return (_first & 0b0111'1110) >> 1; } + uint8_t nuhLayerId() const { return ((_first & 0x1) << 5) | ((_second & 0b1111'1000) >> 3); } + uint8_t nuhTempIdPlus1() const { return _second & 0b111; } + + void setForbiddenBit(bool isSet) { _first = (_first & 0x7F) | (isSet << 7); } + void setUnitType(uint8_t type) { _first = (_first & 0b1000'0001) | ((type & 0b11'1111) << 1); } + void setNuhLayerId(uint8_t nuhLayerId) { + _first = (_first & 0b1111'1110) | ((nuhLayerId & 0b10'0000) >> 5); + _second = (_second & 0b0000'0111) | ((nuhLayerId & 0b01'1111) << 3); + } + void setNuhTempIdPlus1(uint8_t nuhTempIdPlus1) { + _second = (_second & 0b1111'1000) | (nuhTempIdPlus1 & 0b111); + } +}; + +/// Nalu fragment header +struct RTC_CPP_EXPORT H265NalUnitFragmentHeader { + /* + * +---------------+ + * |0|1|2|3|4|5|6|7| + * +-+-+-+-+-+-+-+-+ + * |S|E| FuType | + * +---------------+ + */ + uint8_t _first = 0; + + bool isStart() const { return _first >> 7; } + bool isEnd() const { return (_first >> 6) & 0x01; } + uint8_t unitType() const { return _first & 0b11'1111; } + + void setStart(bool isSet) { _first = (_first & 0x7F) | (isSet << 7); } + void setEnd(bool isSet) { _first = (_first & 0b1011'1111) | (isSet << 6); } + void setUnitType(uint8_t type) { _first = (_first & 0b1100'0000) | (type & 0b11'1111); } +}; + +#pragma pack(pop) + +struct H265NalUnitFragment; + +/// NAL unit +struct RTC_CPP_EXPORT H265NalUnit : NalUnit { + static std::vector GenerateFragments(const std::vector &nalus, + size_t maxFragmentSize); + + H265NalUnit(const H265NalUnit &unit) = default; + H265NalUnit(size_t size, bool includingHeader = true) + : NalUnit(size, includingHeader, NalUnit::Type::H265) {} + H265NalUnit(binary &&data) : NalUnit(std::move(data)) {} + H265NalUnit() : NalUnit(NalUnit::Type::H265) {} + + template + H265NalUnit(Iterator begin_, Iterator end_) : NalUnit(begin_, end_) {} + + bool forbiddenBit() const { return header()->forbiddenBit(); } + uint8_t unitType() const { return header()->unitType(); } + uint8_t nuhLayerId() const { return header()->nuhLayerId(); } + uint8_t nuhTempIdPlus1() const { return header()->nuhTempIdPlus1(); } + + binary payload() const { + assert(size() >= H265_NAL_HEADER_SIZE); + return {begin() + H265_NAL_HEADER_SIZE, end()}; + } + + void setForbiddenBit(bool isSet) { header()->setForbiddenBit(isSet); } + void setUnitType(uint8_t type) { header()->setUnitType(type); } + void setNuhLayerId(uint8_t nuhLayerId) { header()->setNuhLayerId(nuhLayerId); } + void setNuhTempIdPlus1(uint8_t nuhTempIdPlus1) { header()->setNuhTempIdPlus1(nuhTempIdPlus1); } + + void setPayload(binary payload) { + assert(size() >= H265_NAL_HEADER_SIZE); + erase(begin() + H265_NAL_HEADER_SIZE, end()); + insert(end(), payload.begin(), payload.end()); + } + + std::vector generateFragments(size_t maxFragmentSize) const; + +protected: + const H265NalUnitHeader *header() const { + assert(size() >= H265_NAL_HEADER_SIZE); + return reinterpret_cast(data()); + } + + H265NalUnitHeader *header() { + assert(size() >= H265_NAL_HEADER_SIZE); + return reinterpret_cast(data()); + } +}; + +/// NAL unit fragment +struct RTC_CPP_EXPORT H265NalUnitFragment : H265NalUnit { + [[deprecated]] static std::vector> fragmentsFrom(shared_ptr nalu, + uint16_t maxFragmentSize); + + enum class FragmentType { Start, Middle, End }; + + H265NalUnitFragment(FragmentType type, bool forbiddenBit, uint8_t nuhLayerId, + uint8_t nuhTempIdPlus1, uint8_t unitType, binary data); + + uint8_t unitType() const { return fragmentHeader()->unitType(); } + + binary payload() const { + assert(size() >= H265_NAL_HEADER_SIZE + H265_FU_HEADER_SIZE); + return {begin() + H265_NAL_HEADER_SIZE + H265_FU_HEADER_SIZE, end()}; + } + + FragmentType type() const { + if (fragmentHeader()->isStart()) { + return FragmentType::Start; + } else if (fragmentHeader()->isEnd()) { + return FragmentType::End; + } else { + return FragmentType::Middle; + } + } + + void setUnitType(uint8_t type) { fragmentHeader()->setUnitType(type); } + + void setPayload(binary payload) { + assert(size() >= H265_NAL_HEADER_SIZE + H265_FU_HEADER_SIZE); + erase(begin() + H265_NAL_HEADER_SIZE + H265_FU_HEADER_SIZE, end()); + insert(end(), payload.begin(), payload.end()); + } + + void setFragmentType(FragmentType type); + +protected: + const uint8_t nal_type_fu = 49; + + H265NalUnitHeader *fragmentIndicator() { return reinterpret_cast(data()); } + + const H265NalUnitHeader *fragmentIndicator() const { + return reinterpret_cast(data()); + } + + H265NalUnitFragmentHeader *fragmentHeader() { + return reinterpret_cast(data() + H265_NAL_HEADER_SIZE); + } + + const H265NalUnitFragmentHeader *fragmentHeader() const { + return reinterpret_cast(data() + H265_NAL_HEADER_SIZE); + } +}; + +class [[deprecated]] RTC_CPP_EXPORT H265NalUnits : public std::vector> { +public: + static const uint16_t defaultMaximumFragmentSize = + uint16_t(RTC_DEFAULT_MTU - 12 - 8 - 40); // SRTP/UDP/IPv6 + + std::vector> generateFragments(uint16_t maxFragmentSize); +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_NAL_UNIT_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtpdepacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtpdepacketizer.hpp new file mode 100644 index 00000000..0f48f027 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtpdepacketizer.hpp @@ -0,0 +1,45 @@ +/** + * Copyright (c) 2020 Staz Modrzynski + * Copyright (c) 2020-2024 Paul-Louis Ageneau + * Copyright (c) 2024 Robert Edmonds + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_H265_RTP_DEPACKETIZER_H +#define RTC_H265_RTP_DEPACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "h265nalunit.hpp" +#include "message.hpp" +#include "rtp.hpp" +#include "rtpdepacketizer.hpp" + +#include + +namespace rtc { + +/// RTP depacketization for H265 +class RTC_CPP_EXPORT H265RtpDepacketizer final : public VideoRtpDepacketizer { +public: + using Separator = NalUnit::Separator; + + H265RtpDepacketizer(Separator separator = Separator::StartSequence); + ~H265RtpDepacketizer(); + +private: + message_ptr reassemble(message_buffer &buffer); + void addSeparator(binary &frame); + + const NalUnit::Separator mSeparator; +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_H265_RTP_DEPACKETIZER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtppacketizer.hpp new file mode 100644 index 00000000..e788bac0 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/h265rtppacketizer.hpp @@ -0,0 +1,55 @@ +/** + * Copyright (c) 2023 Zita Liao (Dolby) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_H265_RTP_PACKETIZER_H +#define RTC_H265_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "h265nalunit.hpp" +#include "rtppacketizer.hpp" + +namespace rtc { + +// RTP packetization for H265 +class RTC_CPP_EXPORT H265RtpPacketizer final : public RtpPacketizer { +public: + using Separator = NalUnit::Separator; + + inline static const uint32_t ClockRate = VideoClockRate; + [[deprecated("Use ClockRate")]] inline static const uint32_t defaultClockRate = ClockRate; + + // Constructs h265 payload packetizer with given RTP configuration. + // @note RTP configuration is used in packetization process which may change some configuration + // properties such as sequence number. + // @param separator NAL unit separator + // @param rtpConfig RTP configuration + // @param maxFragmentSize maximum size of one NALU fragment + H265RtpPacketizer(Separator separator, shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + + // For backward compatibility, do not use + [[deprecated]] H265RtpPacketizer(shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + +private: + std::vector fragment(binary data) override; + std::vector splitFrame(const binary &frame); + + const NalUnit::Separator mSeparator; + const size_t mMaxFragmentSize; +}; + +// For backward compatibility, do not use +using H265PacketizationHandler [[deprecated("Add H265RtpPacketizer directly")]] = PacketizationHandler; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_H265_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/iceudpmuxlistener.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/iceudpmuxlistener.hpp new file mode 100644 index 00000000..df72c4df --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/iceudpmuxlistener.hpp @@ -0,0 +1,47 @@ +/** + * Copyright (c) 2025 Alex Potsides + * Copyright (c) 2025 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_ICE_UDP_MUX_LISTENER_H +#define RTC_ICE_UDP_MUX_LISTENER_H + +#include "common.hpp" + +namespace rtc { + +namespace impl { + +struct IceUdpMuxListener; + +} // namespace impl + +struct IceUdpMuxRequest { // TODO change name + string localUfrag; + string remoteUfrag; + string remoteAddress; + uint16_t remotePort; +}; + +class RTC_CPP_EXPORT IceUdpMuxListener final : private CheshireCat { +public: + IceUdpMuxListener(uint16_t port, optional bindAddress = nullopt); + ~IceUdpMuxListener(); + + void stop(); + + uint16_t port() const; + + void OnUnhandledStunRequest(std::function callback); + +private: + using CheshireCat::impl; +}; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/mediahandler.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/mediahandler.hpp new file mode 100644 index 00000000..32b93108 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/mediahandler.hpp @@ -0,0 +1,60 @@ +/** + * Copyright (c) 2020 Staz Modrzynski + * Copyright (c) 2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_MEDIA_HANDLER_H +#define RTC_MEDIA_HANDLER_H + +#include "common.hpp" +#include "description.hpp" +#include "message.hpp" + +#include + +namespace rtc { + +class RTC_CPP_EXPORT MediaHandler : public std::enable_shared_from_this { +public: + MediaHandler(); + virtual ~MediaHandler(); + + /// Called when a media is added or updated + /// @param desc Description of the media + virtual void media([[maybe_unused]] const Description::Media &desc) {} + + /// Called when there is traffic coming from the peer + /// @param messages Incoming messages from the peer, can be modified by the handler + /// @param send Send callback to send messages back to the peer + virtual void incoming([[maybe_unused]] message_vector &messages, [[maybe_unused]] const message_callback &send) {} + + /// Called when there is traffic that needs to be sent to the peer + /// @param messages Outgoing messages to the peer, can be modified by the handler + /// @param send Send callback to send messages back to the peer + virtual void outgoing([[maybe_unused]] message_vector &messages, [[maybe_unused]] const message_callback &send) {} + + virtual bool requestKeyframe(const std::vector& targetSSRCs, bool retransmit, const message_callback &send); + virtual bool requestBitrate(unsigned int bitrate, const message_callback &send); + + void addToChain(shared_ptr handler); + void setNext(shared_ptr handler); + shared_ptr next(); + shared_ptr next() const; + shared_ptr last(); // never null + shared_ptr last() const; // never null + + void mediaChain(const Description::Media &desc); + void incomingChain(message_vector &messages, const message_callback &send); + void outgoingChain(message_vector &messages, const message_callback &send); + +private: + shared_ptr mNext; +}; + +} // namespace rtc + +#endif // RTC_MEDIA_HANDLER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/message.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/message.hpp new file mode 100644 index 00000000..52a7dbe7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/message.hpp @@ -0,0 +1,100 @@ +/** + * Copyright (c) 2019-2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_MESSAGE_H +#define RTC_MESSAGE_H + +#include "common.hpp" +#include "frameinfo.hpp" +#include "reliability.hpp" + +#include + +namespace rtc { + +struct RTC_CPP_EXPORT Message : binary { + enum Type { Binary, String, Control, Reset }; + + Message(const Message &message) = default; + Message(size_t size, Type type_ = Binary) : binary(size), type(type_) {} + + template + Message(Iterator begin_, Iterator end_, Type type_ = Binary) + : binary(begin_, end_), type(type_) {} + + Message(binary &&data, Type type_ = Binary) : binary(std::move(data)), type(type_) {} + + Type type; + unsigned int stream = 0; // Stream id (SCTP stream or SSRC) + unsigned int dscp = 0; // Differentiated Services Code Point + shared_ptr reliability; + shared_ptr frameInfo; +}; + +using message_ptr = shared_ptr; +using message_callback = std::function; +using message_vector = std::vector; + +inline size_t message_size_func(const message_ptr &m) { + return m->type == Message::Binary || m->type == Message::String ? m->size() : 0; +} + +template +message_ptr make_message(Iterator begin, Iterator end, Message::Type type = Message::Binary, + unsigned int stream = 0, shared_ptr reliability = nullptr) { + auto message = std::make_shared(begin, end, type); + message->stream = stream; + message->reliability = reliability; + return message; +} + +template +message_ptr make_message(Iterator begin, Iterator end, shared_ptr frameInfo) { + auto message = std::make_shared(begin, end); + message->frameInfo = frameInfo; + return message; +} + +// For backward compatibiity, do not use +template +[[deprecated]] message_ptr make_message(Iterator begin, Iterator end, Message::Type type, + unsigned int stream, shared_ptr frameInfo) { + auto message = std::make_shared(begin, end, type); + message->stream = stream; + message->frameInfo = frameInfo; + return message; +} + +RTC_CPP_EXPORT message_ptr make_message(size_t size, Message::Type type = Message::Binary, + unsigned int stream = 0, + shared_ptr reliability = nullptr); + +RTC_CPP_EXPORT message_ptr make_message(binary &&data, Message::Type type = Message::Binary, + unsigned int stream = 0, + shared_ptr reliability = nullptr); + +RTC_CPP_EXPORT message_ptr make_message(binary &&data, shared_ptr frameInfo); + +RTC_CPP_EXPORT message_ptr make_message(size_t size, message_ptr orig); + +RTC_CPP_EXPORT message_ptr make_message(message_variant data); + +#if RTC_ENABLE_MEDIA + +// Reconstructs a message_ptr from an opaque rtcMessage pointer that +// was allocated by rtcCreateOpaqueMessage(). +message_ptr make_message_from_opaque_ptr(rtcMessage *&&message); + +#endif + +RTC_CPP_EXPORT message_variant to_variant(Message &&message); +RTC_CPP_EXPORT message_variant to_variant(const Message &message); + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/nalunit.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/nalunit.hpp new file mode 100644 index 00000000..ca8af8c7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/nalunit.hpp @@ -0,0 +1,197 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_NAL_UNIT_H +#define RTC_NAL_UNIT_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" + +#include +#include + +namespace rtc { + +#pragma pack(push, 1) + +/// Nalu header +struct RTC_CPP_EXPORT NalUnitHeader { + uint8_t _first = 0; + + bool forbiddenBit() const { return _first >> 7; } + uint8_t nri() const { return _first >> 5 & 0x03; } + uint8_t idc() const { return _first & 0x60; } + uint8_t unitType() const { return _first & 0x1F; } + + void setForbiddenBit(bool isSet) { _first = (_first & 0x7F) | (isSet << 7); } + void setNRI(uint8_t nri) { _first = (_first & 0x9F) | ((nri & 0x03) << 5); } + void setUnitType(uint8_t type) { _first = (_first & 0xE0) | (type & 0x1F); } +}; + +/// Nalu fragment header +struct RTC_CPP_EXPORT NalUnitFragmentHeader { + uint8_t _first = 0; + + bool isStart() const { return _first >> 7; } + bool reservedBit6() const { return (_first >> 5) & 0x01; } + bool isEnd() const { return (_first >> 6) & 0x01; } + uint8_t unitType() const { return _first & 0x1F; } + + void setStart(bool isSet) { _first = (_first & 0x7F) | (isSet << 7); } + void setEnd(bool isSet) { _first = (_first & 0xBF) | (isSet << 6); } + void setReservedBit6(bool isSet) { _first = (_first & 0xDF) | (isSet << 5); } + void setUnitType(uint8_t type) { _first = (_first & 0xE0) | (type & 0x1F); } +}; + +#pragma pack(pop) + +enum NalUnitStartSequenceMatch { + NUSM_noMatch, + NUSM_firstZero, + NUSM_secondZero, + NUSM_thirdZero, + NUSM_shortMatch, + NUSM_longMatch +}; + +static const size_t H264_NAL_HEADER_SIZE = 1; +static const size_t H265_NAL_HEADER_SIZE = 2; + +struct NalUnitFragmentA; + +/// NAL unit +struct RTC_CPP_EXPORT NalUnit : binary { + static std::vector GenerateFragments(const std::vector &nalus, + size_t maxFragmentSize); + + enum class Separator { + Length = RTC_NAL_SEPARATOR_LENGTH, // first 4 bytes are NAL unit length + LongStartSequence = RTC_NAL_SEPARATOR_LONG_START_SEQUENCE, // 0x00, 0x00, 0x00, 0x01 + ShortStartSequence = RTC_NAL_SEPARATOR_SHORT_START_SEQUENCE, // 0x00, 0x00, 0x01 + StartSequence = RTC_NAL_SEPARATOR_START_SEQUENCE, // LongStartSequence or ShortStartSequence + }; + + static NalUnitStartSequenceMatch StartSequenceMatchSucc(NalUnitStartSequenceMatch match, + std::byte _byte, Separator separator); + + enum class Type { H264, H265 }; + + NalUnit(const NalUnit &unit) = default; + NalUnit(size_t size, bool includingHeader = true, Type type = Type::H264) + : binary(size + (includingHeader ? 0 + : (type == Type::H264 ? H264_NAL_HEADER_SIZE + : H265_NAL_HEADER_SIZE))) {} + NalUnit(binary &&data) : binary(std::move(data)) {} + NalUnit(Type type = Type::H264) + : binary(type == Type::H264 ? H264_NAL_HEADER_SIZE : H265_NAL_HEADER_SIZE) {} + template NalUnit(Iterator begin_, Iterator end_) : binary(begin_, end_) {} + + bool forbiddenBit() const { return header()->forbiddenBit(); } + uint8_t nri() const { return header()->nri(); } + uint8_t unitType() const { return header()->unitType(); } + + binary payload() const { + assert(size() >= 1); + return {begin() + 1, end()}; + } + + void setForbiddenBit(bool isSet) { header()->setForbiddenBit(isSet); } + void setNRI(uint8_t nri) { header()->setNRI(nri); } + void setUnitType(uint8_t type) { header()->setUnitType(type); } + + void setPayload(binary payload) { + assert(size() >= 1); + erase(begin() + 1, end()); + insert(end(), payload.begin(), payload.end()); + } + + std::vector generateFragments(size_t maxFragmentSize) const; + +protected: + const NalUnitHeader *header() const { + assert(size() >= 1); + return reinterpret_cast(data()); + } + + NalUnitHeader *header() { + assert(size() >= 1); + return reinterpret_cast(data()); + } +}; + +/// Nal unit fragment A +struct RTC_CPP_EXPORT NalUnitFragmentA : NalUnit { + // For backward compatibility, do not use + [[deprecated]] static std::vector> + fragmentsFrom(shared_ptr nalu, uint16_t maxFragmentSize); + + enum class FragmentType { Start, Middle, End }; + + NalUnitFragmentA(FragmentType type, bool forbiddenBit, uint8_t nri, uint8_t unitType, + binary data); + + uint8_t unitType() const { return fragmentHeader()->unitType(); } + + binary payload() const { + assert(size() >= 2); + return {begin() + 2, end()}; + } + + FragmentType type() const { + if (fragmentHeader()->isStart()) { + return FragmentType::Start; + } else if (fragmentHeader()->isEnd()) { + return FragmentType::End; + } else { + return FragmentType::Middle; + } + } + + void setUnitType(uint8_t type) { fragmentHeader()->setUnitType(type); } + + void setPayload(binary payload) { + assert(size() >= 2); + erase(begin() + 2, end()); + insert(end(), payload.begin(), payload.end()); + } + + void setFragmentType(FragmentType type); + +protected: + const uint8_t nal_type_fu_A = 28; + + NalUnitHeader *fragmentIndicator() { return reinterpret_cast(data()); } + + const NalUnitHeader *fragmentIndicator() const { + return reinterpret_cast(data()); + } + + NalUnitFragmentHeader *fragmentHeader() { + return reinterpret_cast(fragmentIndicator() + 1); + } + + const NalUnitFragmentHeader *fragmentHeader() const { + return reinterpret_cast(fragmentIndicator() + 1); + } +}; + +// For backward compatibility, do not use +class [[deprecated]] RTC_CPP_EXPORT NalUnits : public std::vector> { +public: + static const uint16_t defaultMaximumFragmentSize = + uint16_t(RTC_DEFAULT_MTU - 12 - 8 - 40); // SRTP/UDP/IPv6 + + std::vector> generateFragments(uint16_t maxFragmentSize); +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_NAL_UNIT_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/pacinghandler.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/pacinghandler.hpp new file mode 100644 index 00000000..60313d7e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/pacinghandler.hpp @@ -0,0 +1,61 @@ +/** + * Copyright (c) 2024 Sean DuBois + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_PACING_HANDLER_H +#define RTC_PACING_HANDLER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "utils.hpp" + +#include +#include + +namespace rtc { + +// Paced sending of RTP packets. It takes a stream of RTP packets that can have an uneven bitrate +// and delivers them in a smoother manner by sending a fixed size of them on an interval +class RTC_CPP_EXPORT PacingHandler : public MediaHandler { +public: + PacingHandler(double bitsPerSecond, std::chrono::milliseconds sendInterval, size_t maxQueueSize=0); + + void setBitrate(double bitsPerSecond); + + void setMaxQueueAmount(size_t maxQueueAmount); + + void onOverflow(std::function callback); + + void outgoing(message_vector &messages, const message_callback &send) override; + +private: + std::atomic mHaveScheduled = false; + + double mBytesPerSecond; + double mBudget; + + std::chrono::milliseconds mSendInterval; + std::chrono::time_point mLastRun; + + size_t mMaxQueueAmount; + + std::mutex mParamsMutex; + std::mutex mMutex; + std::queue mRtpBuffer; + + synchronized_callback<> mOverflowCallback; + + void schedule(const message_callback &send, std::chrono::milliseconds scheduleInterval); + void run(const message_callback &send); +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_PACING_HANDLER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/peerconnection.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/peerconnection.hpp new file mode 100644 index 00000000..f7a76a16 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/peerconnection.hpp @@ -0,0 +1,142 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_PEER_CONNECTION_H +#define RTC_PEER_CONNECTION_H + +#include "candidate.hpp" +#include "common.hpp" +#include "configuration.hpp" +#include "datachannel.hpp" +#include "description.hpp" +#include "reliability.hpp" +#include "track.hpp" + +#include +#include + +namespace rtc { + +namespace impl { + +struct PeerConnection; + +} + +struct RTC_CPP_EXPORT DataChannelInit { + Reliability reliability = {}; + bool negotiated = false; + optional id = nullopt; + string protocol = ""; +}; + +struct RTC_CPP_EXPORT LocalDescriptionInit { + optional iceUfrag; + optional icePwd; +}; + +class RTC_CPP_EXPORT PeerConnection final : CheshireCat { +public: + enum class State : int { + New = RTC_NEW, + Connecting = RTC_CONNECTING, + Connected = RTC_CONNECTED, + Disconnected = RTC_DISCONNECTED, + Failed = RTC_FAILED, + Closed = RTC_CLOSED + }; + + enum class IceState : int { + New = RTC_ICE_NEW, + Checking = RTC_ICE_CHECKING, + Connected = RTC_ICE_CONNECTED, + Completed = RTC_ICE_COMPLETED, + Failed = RTC_ICE_FAILED, + Disconnected = RTC_ICE_DISCONNECTED, + Closed = RTC_ICE_CLOSED + }; + + enum class GatheringState : int { + New = RTC_GATHERING_NEW, + InProgress = RTC_GATHERING_INPROGRESS, + Complete = RTC_GATHERING_COMPLETE + }; + + enum class SignalingState : int { + Stable = RTC_SIGNALING_STABLE, + HaveLocalOffer = RTC_SIGNALING_HAVE_LOCAL_OFFER, + HaveRemoteOffer = RTC_SIGNALING_HAVE_REMOTE_OFFER, + HaveLocalPranswer = RTC_SIGNALING_HAVE_LOCAL_PRANSWER, + HaveRemotePranswer = RTC_SIGNALING_HAVE_REMOTE_PRANSWER, + }; + + PeerConnection(); + PeerConnection(Configuration config); + ~PeerConnection(); + + void close(); + + const Configuration *config() const; + State state() const; + IceState iceState() const; + GatheringState gatheringState() const; + SignalingState signalingState() const; + bool negotiationNeeded() const; + bool hasMedia() const; + optional localDescription() const; + optional remoteDescription() const; + size_t remoteMaxMessageSize() const; + optional localAddress() const; + optional remoteAddress() const; + uint16_t maxDataChannelId() const; + bool getSelectedCandidatePair(Candidate *local, Candidate *remote); + + void setLocalDescription(Description::Type type = Description::Type::Unspec, LocalDescriptionInit init = {}); + void gatherLocalCandidates(std::vector additionalIceServers = {}); + void setRemoteDescription(Description description); + void addRemoteCandidate(Candidate candidate); + + // For specific use cases only + Description createOffer(); + Description createAnswer(); + + void setMediaHandler(shared_ptr handler); + shared_ptr getMediaHandler(); + + [[nodiscard]] shared_ptr createDataChannel(string label, + DataChannelInit init = {}); + void onDataChannel(std::function dataChannel)> callback); + + [[nodiscard]] shared_ptr addTrack(Description::Media description); + void onTrack(std::function track)> callback); + + void onLocalDescription(std::function callback); + void onLocalCandidate(std::function callback); + void onStateChange(std::function callback); + void onIceStateChange(std::function callback); + void onGatheringStateChange(std::function callback); + void onSignalingStateChange(std::function callback); + + void resetCallbacks(); + CertificateFingerprint remoteFingerprint(); + + // Stats + void clearStats(); + size_t bytesSent(); + size_t bytesReceived(); + optional rtt(); +}; + +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, PeerConnection::State state); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, PeerConnection::IceState state); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, PeerConnection::GatheringState state); +RTC_CPP_EXPORT std::ostream &operator<<(std::ostream &out, PeerConnection::SignalingState state); + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/plihandler.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/plihandler.hpp new file mode 100644 index 00000000..91eeaf95 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/plihandler.hpp @@ -0,0 +1,41 @@ +/** + * Copyright (c) 2023 Arda Cinar + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_PLI_RESPONDER_H +#define RTC_PLI_RESPONDER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "utils.hpp" + +#include + +namespace rtc { + +/// Responds to PLI and FIR messages sent by the receiver. The sender should respond to these +/// messages by sending an intra. +class RTC_CPP_EXPORT PliHandler final : public MediaHandler { + rtc::synchronized_callback<> mOnPli; + +public: + /// Constructs the PLIResponder object to notify whenever a new intra frame is requested + /// @param onPli The callback that gets called whenever an intra frame is requested by the receiver + PliHandler(std::function onPli); + + void incoming(message_vector &messages, const message_callback &send) override; + +protected: + std::unordered_map mFirSSRCSeqNumberMap; +}; + +} + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_PLI_RESPONDER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/reliability.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/reliability.hpp new file mode 100644 index 00000000..df63b93b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/reliability.hpp @@ -0,0 +1,43 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RELIABILITY_H +#define RTC_RELIABILITY_H + +#include "common.hpp" + +#include + +namespace rtc { + +struct Reliability { + // It true, the channel does not enforce message ordering and out-of-order delivery is allowed + bool unordered = false; + + // If both maxPacketLifeTime or maxRetransmits are unset, the channel is reliable. + // If either maxPacketLifeTime or maxRetransmits is set, the channel is unreliable. + // (The settings are exclusive so both maxPacketLifetime and maxRetransmits must not be set.) + + // Time window during which transmissions and retransmissions may occur + optional maxPacketLifeTime; + + // Maximum number of retransmissions that are attempted + optional maxRetransmits; + + // For backward compatibility, do not use + enum class Type { Reliable = 0, Rexmit, Timed }; + union { + Type typeDeprecated = Type::Reliable; + [[deprecated("Use maxPacketLifeTime or maxRetransmits")]] Type type; + }; + variant rexmit = 0; +}; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rembhandler.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rembhandler.hpp new file mode 100644 index 00000000..6f98878a --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rembhandler.hpp @@ -0,0 +1,35 @@ +/** + * Copyright (c) 2024 Vladimir Voronin + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_REMB_RESPONDER_H +#define RTC_REMB_RESPONDER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "utils.hpp" + +namespace rtc { + +/// Responds to REMB messages sent by the receiver. +class RTC_CPP_EXPORT RembHandler final : public MediaHandler { + rtc::synchronized_callback mOnRemb; + +public: + /// Constructs the RembResponder object to notify whenever a bitrate + /// @param onRemb The callback that gets called whenever a bitrate by the receiver + RembHandler(std::function onRemb); + + void incoming(message_vector &messages, const message_callback &send) override; +}; + +} + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_REMB_RESPONDER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.h b/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.h new file mode 100644 index 00000000..dddcaa57 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.h @@ -0,0 +1,581 @@ +/** + * Copyright (c) 2019-2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_C_API +#define RTC_C_API + +#include "version.h" + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#include + +#ifdef RTC_STATIC +#define RTC_C_EXPORT +#else // dynamic library +#ifdef _WIN32 +#ifdef RTC_EXPORTS +#define RTC_C_EXPORT __declspec(dllexport) // building the library +#else +#define RTC_C_EXPORT __declspec(dllimport) // using the library +#endif +#else // not WIN32 +#define RTC_C_EXPORT +#endif +#endif + +#ifndef RTC_ENABLE_WEBSOCKET +#define RTC_ENABLE_WEBSOCKET 1 +#endif + +#ifndef RTC_ENABLE_MEDIA +#define RTC_ENABLE_MEDIA 1 +#endif + +#define RTC_DEFAULT_MTU 1280 // IPv6 minimum guaranteed MTU + +#if RTC_ENABLE_MEDIA +#define RTC_DEFAULT_MAX_FRAGMENT_SIZE ((uint16_t)(RTC_DEFAULT_MTU - 12 - 8 - 40)) // SRTP/UDP/IPv6 +#define RTC_DEFAULT_MAX_STORED_PACKET_COUNT 512 +// Deprecated, do not use +#define RTC_DEFAULT_MAXIMUM_FRAGMENT_SIZE RTC_DEFAULT_MAX_FRAGMENT_SIZE +#define RTC_DEFAULT_MAXIMUM_PACKET_COUNT_FOR_NACK_CACHE RTC_DEFAULT_MAX_STORED_PACKET_COUNT +#endif + +#ifdef _WIN32 +#ifdef CAPI_STDCALL +#define RTC_API __stdcall +#else +#define RTC_API +#endif +#else // not WIN32 +#define RTC_API +#endif + +#if defined(__GNUC__) || defined(__clang__) +#define RTC_DEPRECATED __attribute__((deprecated)) +#elif defined(_MSC_VER) +#define RTC_DEPRECATED __declspec(deprecated) +#else +#define DEPRECATED +#endif + +// libdatachannel C API + +typedef enum { + RTC_NEW = 0, + RTC_CONNECTING = 1, + RTC_CONNECTED = 2, + RTC_DISCONNECTED = 3, + RTC_FAILED = 4, + RTC_CLOSED = 5 +} rtcState; + +typedef enum { + RTC_ICE_NEW = 0, + RTC_ICE_CHECKING = 1, + RTC_ICE_CONNECTED = 2, + RTC_ICE_COMPLETED = 3, + RTC_ICE_FAILED = 4, + RTC_ICE_DISCONNECTED = 5, + RTC_ICE_CLOSED = 6 +} rtcIceState; + +typedef enum { + RTC_GATHERING_NEW = 0, + RTC_GATHERING_INPROGRESS = 1, + RTC_GATHERING_COMPLETE = 2 +} rtcGatheringState; + +typedef enum { + RTC_SIGNALING_STABLE = 0, + RTC_SIGNALING_HAVE_LOCAL_OFFER = 1, + RTC_SIGNALING_HAVE_REMOTE_OFFER = 2, + RTC_SIGNALING_HAVE_LOCAL_PRANSWER = 3, + RTC_SIGNALING_HAVE_REMOTE_PRANSWER = 4, +} rtcSignalingState; + +typedef enum { // Don't change, it must match plog severity + RTC_LOG_NONE = 0, + RTC_LOG_FATAL = 1, + RTC_LOG_ERROR = 2, + RTC_LOG_WARNING = 3, + RTC_LOG_INFO = 4, + RTC_LOG_DEBUG = 5, + RTC_LOG_VERBOSE = 6 +} rtcLogLevel; + +typedef enum { + RTC_CERTIFICATE_DEFAULT = 0, // ECDSA + RTC_CERTIFICATE_ECDSA = 1, + RTC_CERTIFICATE_RSA = 2, +} rtcCertificateType; + +typedef enum { + // video + RTC_CODEC_H264 = 0, + RTC_CODEC_VP8 = 1, + RTC_CODEC_VP9 = 2, + RTC_CODEC_H265 = 3, + RTC_CODEC_AV1 = 4, + + // audio + RTC_CODEC_OPUS = 128, + RTC_CODEC_PCMU = 129, + RTC_CODEC_PCMA = 130, + RTC_CODEC_AAC = 131, + RTC_CODEC_G722 = 132, +} rtcCodec; + +typedef enum { + RTC_DIRECTION_UNKNOWN = 0, + RTC_DIRECTION_SENDONLY = 1, + RTC_DIRECTION_RECVONLY = 2, + RTC_DIRECTION_SENDRECV = 3, + RTC_DIRECTION_INACTIVE = 4 +} rtcDirection; + +typedef enum { RTC_TRANSPORT_POLICY_ALL = 0, RTC_TRANSPORT_POLICY_RELAY = 1 } rtcTransportPolicy; + +#define RTC_ERR_SUCCESS 0 +#define RTC_ERR_INVALID -1 // invalid argument +#define RTC_ERR_FAILURE -2 // runtime error +#define RTC_ERR_NOT_AVAIL -3 // element not available +#define RTC_ERR_TOO_SMALL -4 // buffer too small + +typedef void(RTC_API *rtcLogCallbackFunc)(rtcLogLevel level, const char *message); +typedef void(RTC_API *rtcDescriptionCallbackFunc)(int pc, const char *sdp, const char *type, + void *ptr); +typedef void(RTC_API *rtcCandidateCallbackFunc)(int pc, const char *cand, const char *mid, + void *ptr); +typedef void(RTC_API *rtcStateChangeCallbackFunc)(int pc, rtcState state, void *ptr); +typedef void(RTC_API *rtcIceStateChangeCallbackFunc)(int pc, rtcIceState state, void *ptr); +typedef void(RTC_API *rtcGatheringStateCallbackFunc)(int pc, rtcGatheringState state, void *ptr); +typedef void(RTC_API *rtcSignalingStateCallbackFunc)(int pc, rtcSignalingState state, void *ptr); +typedef void(RTC_API *rtcDataChannelCallbackFunc)(int pc, int dc, void *ptr); +typedef void(RTC_API *rtcTrackCallbackFunc)(int pc, int tr, void *ptr); +typedef void(RTC_API *rtcOpenCallbackFunc)(int id, void *ptr); +typedef void(RTC_API *rtcClosedCallbackFunc)(int id, void *ptr); +typedef void(RTC_API *rtcErrorCallbackFunc)(int id, const char *error, void *ptr); +typedef void(RTC_API *rtcMessageCallbackFunc)(int id, const char *message, int size, void *ptr); +typedef void *(RTC_API *rtcInterceptorCallbackFunc)(int pc, const char *message, int size, + void *ptr); +typedef void(RTC_API *rtcBufferedAmountLowCallbackFunc)(int id, void *ptr); +typedef void(RTC_API *rtcAvailableCallbackFunc)(int id, void *ptr); +typedef void(RTC_API *rtcPliHandlerCallbackFunc)(int tr, void *ptr); +typedef void(RTC_API *rtcRembHandlerCallbackFunc)(int tr, unsigned int bitrate, void *ptr); + +typedef struct { + uint32_t timestamp; + uint8_t payloadType; + double timestampSeconds; // negative means not available +} rtcFrameInfo; + +typedef void(RTC_API *rtcFrameCallbackFunc)(int tr, const char *data, int size, + const rtcFrameInfo *info, void *ptr); + +// Log + +// NULL cb on the first call will log to stdout +RTC_C_EXPORT void rtcInitLogger(rtcLogLevel level, rtcLogCallbackFunc cb); + +// User pointer +RTC_C_EXPORT void rtcSetUserPointer(int id, void *ptr); +RTC_C_EXPORT void *rtcGetUserPointer(int i); + +// PeerConnection + +typedef struct { + const char **iceServers; + int iceServersCount; + const char *proxyServer; // libnice only + const char *bindAddress; // libjuice only, NULL means any + rtcCertificateType certificateType; + const char *certificatePemFile; // NULL for autogenerated certificate + const char *keyPemFile; // NULL for autogenerated certificate + const char *keyPemPass; // NULL if no pass + rtcTransportPolicy iceTransportPolicy; + bool enableIceTcp; + bool enableIceUdpMux; // libjuice only + bool disableAutoNegotiation; + bool forceMediaTransport; + uint16_t portRangeBegin; // 0 means automatic + uint16_t portRangeEnd; // 0 means automatic + int mtu; // <= 0 means automatic + int maxMessageSize; // <= 0 means default +} rtcConfiguration; + +RTC_C_EXPORT int rtcCreatePeerConnection(const rtcConfiguration *config); // returns pc id +RTC_C_EXPORT int rtcClosePeerConnection(int pc); +RTC_C_EXPORT int rtcDeletePeerConnection(int pc); + +RTC_C_EXPORT int rtcSetLocalDescriptionCallback(int pc, rtcDescriptionCallbackFunc cb); +RTC_C_EXPORT int rtcSetLocalCandidateCallback(int pc, rtcCandidateCallbackFunc cb); +RTC_C_EXPORT int rtcSetStateChangeCallback(int pc, rtcStateChangeCallbackFunc cb); +RTC_C_EXPORT int rtcSetIceStateChangeCallback(int pc, rtcIceStateChangeCallbackFunc cb); +RTC_C_EXPORT int rtcSetGatheringStateChangeCallback(int pc, rtcGatheringStateCallbackFunc cb); +RTC_C_EXPORT int rtcSetSignalingStateChangeCallback(int pc, rtcSignalingStateCallbackFunc cb); + +RTC_C_EXPORT int rtcSetLocalDescription(int pc, const char *type); // type may be NULL +RTC_C_EXPORT int rtcSetRemoteDescription(int pc, const char *sdp, const char *type); +RTC_C_EXPORT int rtcAddRemoteCandidate(int pc, const char *cand, const char *mid); + +RTC_C_EXPORT int rtcGetLocalDescription(int pc, char *buffer, int size); +RTC_C_EXPORT int rtcGetRemoteDescription(int pc, char *buffer, int size); + +RTC_C_EXPORT int rtcGetLocalDescriptionType(int pc, char *buffer, int size); +RTC_C_EXPORT int rtcGetRemoteDescriptionType(int pc, char *buffer, int size); + +// For specific use cases only +RTC_C_EXPORT int rtcCreateOffer(int pc, char *buffer, int size); +RTC_C_EXPORT int rtcCreateAnswer(int pc, char *buffer, int size); + +RTC_C_EXPORT int rtcGetLocalAddress(int pc, char *buffer, int size); +RTC_C_EXPORT int rtcGetRemoteAddress(int pc, char *buffer, int size); + +RTC_C_EXPORT int rtcGetSelectedCandidatePair(int pc, char *local, int localSize, char *remote, + int remoteSize); + +RTC_C_EXPORT bool rtcIsNegotiationNeeded(int pc); + +RTC_C_EXPORT int rtcGetMaxDataChannelStream(int pc); +RTC_C_EXPORT int rtcGetRemoteMaxMessageSize(int pc); + +// DataChannel, Track, and WebSocket common API + +RTC_C_EXPORT int rtcSetOpenCallback(int id, rtcOpenCallbackFunc cb); +RTC_C_EXPORT int rtcSetClosedCallback(int id, rtcClosedCallbackFunc cb); +RTC_C_EXPORT int rtcSetErrorCallback(int id, rtcErrorCallbackFunc cb); +RTC_C_EXPORT int rtcSetMessageCallback(int id, rtcMessageCallbackFunc cb); +RTC_C_EXPORT int rtcSendMessage(int id, const char *data, int size); +RTC_C_EXPORT int rtcClose(int id); +RTC_C_EXPORT int rtcDelete(int id); +RTC_C_EXPORT bool rtcIsOpen(int id); +RTC_C_EXPORT bool rtcIsClosed(int id); + +RTC_C_EXPORT int rtcMaxMessageSize(int id); +RTC_C_EXPORT int rtcGetBufferedAmount(int id); // total size buffered to send +RTC_C_EXPORT int rtcSetBufferedAmountLowThreshold(int id, int amount); +RTC_C_EXPORT int rtcSetBufferedAmountLowCallback(int id, rtcBufferedAmountLowCallbackFunc cb); + +// DataChannel, Track, and WebSocket common extended API + +RTC_C_EXPORT int rtcGetAvailableAmount(int id); // total size available to receive +RTC_C_EXPORT int rtcSetAvailableCallback(int id, rtcAvailableCallbackFunc cb); +RTC_C_EXPORT int rtcReceiveMessage(int id, char *buffer, int *size); + +// DataChannel + +typedef struct { + bool unordered; + bool unreliable; + unsigned int maxPacketLifeTime; // ignored if reliable + unsigned int maxRetransmits; // ignored if reliable +} rtcReliability; + +typedef struct { + rtcReliability reliability; + const char *protocol; // empty string if NULL + bool negotiated; + bool manualStream; + uint16_t stream; // numeric ID 0-65534, ignored if manualStream is false +} rtcDataChannelInit; + +RTC_C_EXPORT int rtcSetDataChannelCallback(int pc, rtcDataChannelCallbackFunc cb); +RTC_C_EXPORT int rtcCreateDataChannel(int pc, const char *label); // returns dc id +RTC_C_EXPORT int rtcCreateDataChannelEx(int pc, const char *label, + const rtcDataChannelInit *init); // returns dc id +RTC_C_EXPORT int rtcDeleteDataChannel(int dc); + +RTC_C_EXPORT int rtcGetDataChannelStream(int dc); +RTC_C_EXPORT int rtcGetDataChannelLabel(int dc, char *buffer, int size); +RTC_C_EXPORT int rtcGetDataChannelProtocol(int dc, char *buffer, int size); +RTC_C_EXPORT int rtcGetDataChannelReliability(int dc, rtcReliability *reliability); + +// Track + +typedef struct { + rtcDirection direction; + rtcCodec codec; + int payloadType; + uint32_t ssrc; + const char *mid; + const char *name; // optional + const char *msid; // optional + const char *trackId; // optional, track ID used in MSID + const char *profile; // optional, codec profile +} rtcTrackInit; + +RTC_C_EXPORT int rtcSetTrackCallback(int pc, rtcTrackCallbackFunc cb); +RTC_C_EXPORT int rtcAddTrack(int pc, const char *mediaDescriptionSdp); // returns tr id +RTC_C_EXPORT int rtcAddTrackEx(int pc, const rtcTrackInit *init); // returns tr id +RTC_C_EXPORT int rtcDeleteTrack(int tr); + +RTC_C_EXPORT int rtcGetTrackDescription(int tr, char *buffer, int size); +RTC_C_EXPORT int rtcGetTrackMid(int tr, char *buffer, int size); +RTC_C_EXPORT int rtcGetTrackDirection(int tr, rtcDirection *direction); + +RTC_C_EXPORT int rtcRequestKeyframe(int tr); +RTC_C_EXPORT int rtcRequestBitrate(int tr, unsigned int bitrate); + +RTC_C_EXPORT int rtcSetFrameCallback(int tr, rtcFrameCallbackFunc cb); + +#if RTC_ENABLE_MEDIA + +// Media + +// Define how OBUs are packetizied in a AV1 Sample +typedef enum { + RTC_OBU_PACKETIZED_OBU = 0, + RTC_OBU_PACKETIZED_TEMPORAL_UNIT = 1, +} rtcObuPacketization; + +// Define how NAL units are separated in a H264/H265 sample +typedef enum { + RTC_NAL_SEPARATOR_LENGTH = 0, // first 4 bytes are NAL unit length + RTC_NAL_SEPARATOR_LONG_START_SEQUENCE = 1, // 0x00, 0x00, 0x00, 0x01 + RTC_NAL_SEPARATOR_SHORT_START_SEQUENCE = 2, // 0x00, 0x00, 0x01 + RTC_NAL_SEPARATOR_START_SEQUENCE = 3, // long or short start sequence +} rtcNalUnitSeparator; + +typedef struct { + uint32_t ssrc; + const char *cname; + uint8_t payloadType; + uint32_t clockRate; + uint16_t sequenceNumber; + uint32_t timestamp; + + // H264, H265, AV1 + uint16_t maxFragmentSize; // Maximum fragment size, 0 means default + + // H264/H265 only + rtcNalUnitSeparator nalSeparator; // NAL unit separator + + // AV1 only + rtcObuPacketization obuPacketization; // OBU paketization for AV1 samples + + uint8_t playoutDelayId; + uint16_t playoutDelayMin; + uint16_t playoutDelayMax; + + uint8_t colorSpaceId; + uint8_t colorChromaSitingHorz; + uint8_t colorChromaSitingVert; + uint8_t colorRange; + uint8_t colorPrimaries; + uint8_t colorTransfer; + uint8_t colorMatrix; +} rtcPacketizerInit; + +// Deprecated, do not use +typedef rtcPacketizerInit rtcPacketizationHandlerInit; + +typedef struct { + uint32_t ssrc; + const char *name; // optional + const char *msid; // optional + const char *trackId; // optional, track ID used in MSID +} rtcSsrcForTypeInit; + +// Opaque type used (via rtcMessage*) to reference an rtc::Message +typedef void *rtcMessage; + +// Allocate a new opaque message. +// Must be explicitly freed by rtcDeleteOpaqueMessage() unless +// explicitly returned by a media interceptor callback; +RTC_C_EXPORT rtcMessage *rtcCreateOpaqueMessage(void *data, int size); +RTC_C_EXPORT void rtcDeleteOpaqueMessage(rtcMessage *msg); + +// Set MediaInterceptor on peer connection +RTC_C_EXPORT int rtcSetMediaInterceptorCallback(int id, rtcInterceptorCallbackFunc cb); + +// Set a packetizer on track +RTC_C_EXPORT int rtcSetH264Packetizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetH265Packetizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetAV1Packetizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetVP8Packetizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetVP9Packetizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetOpusPacketizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetAACPacketizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetPCMUPacketizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetPCMAPacketizer(int tr, const rtcPacketizerInit *init); +RTC_C_EXPORT int rtcSetG722Packetizer(int tr, const rtcPacketizerInit *init); + +// Set a depacketizer on track +RTC_C_EXPORT int rtcSetH264Depacketizer(int tr, rtcNalUnitSeparator nalSeparator); +RTC_C_EXPORT int rtcSetH265Depacketizer(int tr, rtcNalUnitSeparator nalSeparator); +RTC_C_EXPORT int rtcSetVP8Depacketizer(int tr); +RTC_C_EXPORT int rtcSetVP9Depacketizer(int tr); +RTC_C_EXPORT int rtcSetOpusDepacketizer(int tr); +RTC_C_EXPORT int rtcSetAACDepacketizer(int tr); +RTC_C_EXPORT int rtcSetPCMUDepacketizer(int tr); +RTC_C_EXPORT int rtcSetPCMADepacketizer(int tr); +RTC_C_EXPORT int rtcSetG722Depacketizer(int tr); + +// Deprecated, do not use +RTC_DEPRECATED static inline int +rtcSetH264PacketizationHandler(int tr, const rtcPacketizationHandlerInit *init) { + return rtcSetH264Packetizer(tr, init); +} +RTC_DEPRECATED static inline int +rtcSetH265PacketizationHandler(int tr, const rtcPacketizationHandlerInit *init) { + return rtcSetH265Packetizer(tr, init); +} +RTC_DEPRECATED static inline int +rtcSetAV1PacketizationHandler(int tr, const rtcPacketizationHandlerInit *init) { + return rtcSetAV1Packetizer(tr, init); +} +RTC_DEPRECATED static inline int +rtcSetOpusPacketizationHandler(int tr, const rtcPacketizationHandlerInit *init) { + return rtcSetOpusPacketizer(tr, init); +} +RTC_DEPRECATED static inline int +rtcSetAACPacketizationHandler(int tr, const rtcPacketizationHandlerInit *init) { + return rtcSetAACPacketizer(tr, init); +} + +// Chain RtcpReceivingSession on track +RTC_C_EXPORT int rtcChainRtcpReceivingSession(int tr); + +// Chain RtcpSrReporter on track +RTC_C_EXPORT int rtcChainRtcpSrReporter(int tr); + +// Chain RtcpNackResponder on track +RTC_C_EXPORT int rtcChainRtcpNackResponder(int tr, unsigned int maxStoredPacketsCount); + +// Chain PliHandler on track +RTC_C_EXPORT int rtcChainPliHandler(int tr, rtcPliHandlerCallbackFunc cb); + +// Chain RembHandler on track +RTC_C_EXPORT int rtcChainRembHandler(int tr, rtcRembHandlerCallbackFunc cb); + +// Chain PacingHandler on track +RTC_C_EXPORT int rtcChainPacingHandler(int tr, double bitsPerSecond, int sendIntervalMs); + +// Transform seconds to timestamp using track's clock rate, result is written to timestamp +RTC_C_EXPORT int rtcTransformSecondsToTimestamp(int id, double seconds, uint32_t *timestamp); + +// Transform timestamp to seconds using track's clock rate, result is written to seconds +RTC_C_EXPORT int rtcTransformTimestampToSeconds(int id, uint32_t timestamp, double *seconds); + +// Get current timestamp, result is written to timestamp +RTC_C_EXPORT int rtcGetCurrentTrackTimestamp(int id, uint32_t *timestamp); + +// Set RTP timestamp for track identified by given id +RTC_C_EXPORT int rtcSetTrackRtpTimestamp(int id, uint32_t timestamp); + +// Get timestamp of last RTCP SR, result is written to timestamp +RTC_C_EXPORT int rtcGetLastTrackSenderReportTimestamp(int id, uint32_t *timestamp); + +// Get sync timestamps from receiving RTCP session +RTC_C_EXPORT int rtcGetTrackRtcpSyncTimestamps(int tr, uint64_t *rtpTimestamp, uint64_t *ntpTimestamp); + +// Get all available payload types for given codec and stores them in buffer, does nothing if +// buffer is NULL +RTC_C_EXPORT int rtcGetTrackPayloadTypesForCodec(int tr, const char *ccodec, int *buffer, int size); + +// Get all SSRCs for given track +RTC_C_EXPORT int rtcGetSsrcsForTrack(int tr, uint32_t *buffer, int count); + +// Get CName for SSRC +RTC_C_EXPORT int rtcGetCNameForSsrc(int tr, uint32_t ssrc, char *cname, int cnameSize); + +// Get all SSRCs for given media type in given SDP +RTC_C_EXPORT int rtcGetSsrcsForType(const char *mediaType, const char *sdp, uint32_t *buffer, int bufferSize); + +// Set SSRC for given media type in given SDP +RTC_C_EXPORT int rtcSetSsrcForType(const char *mediaType, const char *sdp, char *buffer, const int bufferSize, + rtcSsrcForTypeInit *init); + +// For backward compatibility, do not use +RTC_C_EXPORT RTC_DEPRECATED int rtcSetNeedsToSendRtcpSr(int id); + +#endif // RTC_ENABLE_MEDIA + +#if RTC_ENABLE_WEBSOCKET + +// WebSocket + +typedef struct { + bool disableTlsVerification; // if true, don't verify the TLS certificate + const char *proxyServer; // only non-authenticated http supported for now + const char **protocols; + int protocolsCount; + int tcpConnectionTimeoutMs; // in milliseconds, 0 means default, < 0 means disabled + int connectionTimeoutMs; // in milliseconds, 0 means default, < 0 means disabled + int pingIntervalMs; // in milliseconds, 0 means default, < 0 means disabled + int maxOutstandingPings; // 0 means default, < 0 means disabled + int maxMessageSize; // <= 0 means default +} rtcWsConfiguration; + +RTC_C_EXPORT int rtcCreateWebSocket(const char *url); // returns ws id +RTC_C_EXPORT int rtcCreateWebSocketEx(const char *url, const rtcWsConfiguration *config); +RTC_C_EXPORT int rtcDeleteWebSocket(int ws); + +RTC_C_EXPORT int rtcGetWebSocketRemoteAddress(int ws, char *buffer, int size); +RTC_C_EXPORT int rtcGetWebSocketPath(int ws, char *buffer, int size); + +// WebSocketServer + +typedef void(RTC_API *rtcWebSocketClientCallbackFunc)(int wsserver, int ws, void *ptr); + +typedef struct { + uint16_t port; // 0 means automatic selection + bool enableTls; // if true, enable TLS (WSS) + const char *certificatePemFile; // NULL for autogenerated certificate + const char *keyPemFile; // NULL for autogenerated certificate + const char *keyPemPass; // NULL if no pass + const char *bindAddress; // NULL for any + int connectionTimeoutMs; // in milliseconds, 0 means default, < 0 means disabled + int maxMessageSize; // <= 0 means default +} rtcWsServerConfiguration; + +RTC_C_EXPORT int rtcCreateWebSocketServer(const rtcWsServerConfiguration *config, + rtcWebSocketClientCallbackFunc cb); // returns wsserver id +RTC_C_EXPORT int rtcDeleteWebSocketServer(int wsserver); + +RTC_C_EXPORT int rtcGetWebSocketServerPort(int wsserver); + +#endif + +// Global settings + +// Note: Applied when threads are spawned +RTC_C_EXPORT int rtcSetThreadPoolSize(unsigned int count); + +typedef struct { + int recvBufferSize; // in bytes, <= 0 means optimized default + int sendBufferSize; // in bytes, <= 0 means optimized default + int maxChunksOnQueue; // in chunks, <= 0 means optimized default + int initialCongestionWindow; // in MTUs, <= 0 means optimized default + int maxBurst; // in MTUs, 0 means optimized default, < 0 means disabled + int congestionControlModule; // 0: RFC2581 (default), 1: HSTCP, 2: H-TCP, 3: RTCC + int delayedSackTimeMs; // in milliseconds, 0 means optimized default, < 0 means disabled + int minRetransmitTimeoutMs; // in milliseconds, <= 0 means optimized default + int maxRetransmitTimeoutMs; // in milliseconds, <= 0 means optimized default + int initialRetransmitTimeoutMs; // in milliseconds, <= 0 means optimized default + int maxRetransmitAttempts; // number of retransmissions, <= 0 means optimized default + int heartbeatIntervalMs; // in milliseconds, <= 0 means optimized default +} rtcSctpSettings; + +// Note: SCTP settings apply to newly-created PeerConnections only +RTC_C_EXPORT int rtcSetSctpSettings(const rtcSctpSettings *settings); + +// Optional global preload and cleanup +RTC_C_EXPORT bool rtcPreload(void); +RTC_C_EXPORT void rtcCleanup(void); + +#ifdef __cplusplus +} // extern "C" +#endif + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.hpp new file mode 100644 index 00000000..2d2a1060 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtc.hpp @@ -0,0 +1,53 @@ +/** + * Copyright (c) 2019 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +// C API +#include "rtc.h" + +// C++ API +#include "common.hpp" +#include "global.hpp" +// +#include "datachannel.hpp" +#include "iceudpmuxlistener.hpp" +#include "peerconnection.hpp" +#include "track.hpp" + +#if RTC_ENABLE_WEBSOCKET + +// WebSocket +#include "websocket.hpp" +#include "websocketserver.hpp" + +#endif // RTC_ENABLE_WEBSOCKET + +#if RTC_ENABLE_MEDIA + +// Media +#include "av1rtppacketizer.hpp" +#include "dependencydescriptor.hpp" +#include "rtppacketizer.hpp" +#include "rtpdepacketizer.hpp" +#include "h264rtppacketizer.hpp" +#include "h264rtpdepacketizer.hpp" +#include "h265rtppacketizer.hpp" +#include "h265rtpdepacketizer.hpp" +#include "vp8rtppacketizer.hpp" +#include "vp8rtpdepacketizer.hpp" +#include "vp9rtppacketizer.hpp" +#include "vp9rtpdepacketizer.hpp" +#include "mediahandler.hpp" +#include "rtcpapphandler.hpp" +#include "plihandler.hpp" +#include "rembhandler.hpp" +#include "pacinghandler.hpp" +#include "rtcpnackresponder.hpp" +#include "rtcpreceivingsession.hpp" +#include "rtcpsrreporter.hpp" + +#endif // RTC_ENABLE_MEDIA diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpapphandler.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpapphandler.hpp new file mode 100644 index 00000000..30dbef60 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpapphandler.hpp @@ -0,0 +1,36 @@ +/** + * Copyright (c) 2026 Apple Inc + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTCP_APP_HANDLER_H +#define RTC_RTCP_APP_HANDLER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "rtp.hpp" +#include "utils.hpp" + +namespace rtc { + +/// Handles RTCP APP packets (payload type 204) as defined in RFC 3550 section 6.7. +class RTC_CPP_EXPORT RtcpAppHandler final : public MediaHandler { + rtc::synchronized_callback mOnApp; + +public: + /// Constructs the RtcpAppHandler to notify when RTCP APP packets are received. + /// @param onApp Callback invoked with (name, subtype, application-dependent data) + RtcpAppHandler(std::function onApp); + + void incoming(message_vector &messages, const message_callback &send) override; +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_RTCP_APP_HANDLER_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpnackresponder.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpnackresponder.hpp new file mode 100644 index 00000000..045d9566 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpnackresponder.hpp @@ -0,0 +1,89 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTCP_NACK_RESPONDER_H +#define RTC_RTCP_NACK_RESPONDER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "description.hpp" +#include "rtp.hpp" + +#include +#include +#include + +namespace rtc { + +class RTC_CPP_EXPORT RtcpNackResponder final : public MediaHandler { +public: + static const size_t DefaultMaxSize = 512; + + RtcpNackResponder(size_t maxSize = DefaultMaxSize); + + void media(const Description::Media &desc) override; + void incoming(message_vector &messages, const message_callback &send) override; + void outgoing(message_vector &messages, const message_callback &send) override; + +private: + message_ptr wrapInRtx(const message_ptr &original); + + // RTX state populated by media() from SDP inspection + optional mRtxSsrc; + std::unordered_map mRtxPayloadTypeMap; // original PT -> RTX PT + uint16_t mRtxSequenceNumber = 0; + bool mRtxEnabled = false; + std::mutex mMutex; + + // Packet storage + class RTC_CPP_EXPORT Storage { + + /// Packet storage element + struct RTC_CPP_EXPORT Element { + Element(message_ptr packet, uint16_t sequenceNumber, shared_ptr next = nullptr); + const message_ptr packet; + const uint16_t sequenceNumber; + /// Pointer to newer element + shared_ptr next = nullptr; + }; + + private: + /// Oldest packet in storage + shared_ptr oldest = nullptr; + /// Newest packet in storage + shared_ptr newest = nullptr; + /// Inner storage + std::unordered_map> storage{}; + std::mutex mutex; + + /// Maximum storage size + const size_t maxSize; + + /// Returns current size + size_t size(); + + public: + Storage(size_t _maxSize); + + /// Returns packet with given sequence number + message_ptr get(uint16_t sequenceNumber); + + /// Stores packet + /// @param packet Packet + void store(message_ptr packet); + }; + + const shared_ptr mStorage; +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_RTCP_NACK_RESPONDER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpreceivingsession.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpreceivingsession.hpp new file mode 100644 index 00000000..e1e25f29 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpreceivingsession.hpp @@ -0,0 +1,95 @@ +/** + * Copyright (c) 2020 Staz Modrzynski + * Copyright (c) 2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTCP_RECEIVING_SESSION_H +#define RTC_RTCP_RECEIVING_SESSION_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "description.hpp" +#include "mediahandler.hpp" +#include "message.hpp" +#include "rtp.hpp" + +#include +#include +#include +#include + +#define RTP_SEQ_MOD (1<<16) + +namespace rtc { + +// An RtcpSession can be plugged into a Track to handle the whole RTCP session +class RTC_CPP_EXPORT RtcpReceivingSession : public MediaHandler { +public: + RtcpReceivingSession() = default; + virtual ~RtcpReceivingSession() = default; + + void media(const Description::Media &desc) override; + void incoming(message_vector &messages, const message_callback &send) override; + bool requestKeyframe(const std::vector& targetSSRCs, bool retransmit, const message_callback &send) override; + bool requestBitrate(unsigned int bitrate, const message_callback &send) override; + + // For backward compatibility + [[deprecated("Use Track::requestKeyframe()")]] inline bool requestKeyframe() { return false; }; + [[deprecated("Use Track::requestBitrate()")]] inline void requestBitrate(unsigned int) {}; + + struct SyncTimestamps { + uint64_t rtpTimestamp; + uint64_t ntpTimestamp; + }; + + SyncTimestamps getSyncTimestamps(); + +protected: + void pushREMB(const message_callback &send, unsigned int bitrate); + void pushRR(const message_callback &send,unsigned int lastSrDelay); + void pushPLI(const message_callback &send); + void pushFIR(const message_callback &send, const std::vector& targetSSRCs, bool retransmit); + + void initSeq(uint16_t seq); + bool updateSeq(uint16_t seq); + + SSRC mSsrc = 0; + uint32_t mGreatestSeqNo = 0; + uint16_t mMaxSeq = 0; // highest seq. number seen + uint32_t mCycles = 0; // shifted count of seq. number cycles + uint32_t mBaseSeq = 0; // base seq number + uint32_t mBadSeq = 0; // last 'bad' seq number + 1 + uint32_t mProbation = 0; // sequ. packets till source is valid + uint32_t mReceived = 0; // packets received + uint32_t mExpectedPrior = 0; // packet expected at last interval + uint32_t mReceivedPrior = 0; // packet received at last interval + uint32_t mTransit = 0; // relative trans time for prev pkt + uint32_t mJitter = 0; + + SyncTimestamps mSyncTimestamps{0,0}; + + std::atomic mRequestedBitrate = 0; + std::mutex mSyncMutex; + std::mutex mMutex; + + message_ptr unwrapRtx(const message_ptr &rtxPacket); + + // RTX state populated by media() from SDP inspection + std::unordered_map mRtxToPrimaryPtMap; // RTX PT -> primary PT + SSRC mRtxPrimarySsrc = 0; + bool mRtxEnabled = false; + + bool mSupportsRfc5104Fir = false; + std::unordered_map mRfc5104FirCmdNums; // SSRC -> seq no mapping +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif // RTC_RTCP_RECEIVING_SESSION_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpsrreporter.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpsrreporter.hpp new file mode 100644 index 00000000..70f05c24 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtcpsrreporter.hpp @@ -0,0 +1,49 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTCP_SR_REPORTER_H +#define RTC_RTCP_SR_REPORTER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "rtp.hpp" +#include "rtppacketizationconfig.hpp" + +#include + +namespace rtc { + +class RTC_CPP_EXPORT RtcpSrReporter final : public MediaHandler { +public: + RtcpSrReporter(shared_ptr rtpConfig); + ~RtcpSrReporter(); + + uint32_t lastReportedTimestamp() const; + [[deprecated]] void setNeedsToReport(); + + void outgoing(message_vector &messages, const message_callback &send) override; + + // TODO: remove this + const shared_ptr rtpConfig; + +private: + void addToReport(RtpHeader *header, size_t size); + message_ptr getSenderReport(uint32_t timestamp); + + uint32_t mPacketCount = 0; + uint32_t mPayloadOctets = 0; + uint32_t mLastReportedTimestamp = 0; + std::chrono::steady_clock::time_point mLastReportTime; +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_RTCP_SR_REPORTER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtp.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtp.hpp new file mode 100644 index 00000000..9e4c3ead --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtp.hpp @@ -0,0 +1,407 @@ +/** + * Copyright (c) 2020 Staz Modrzynski + * Copyright (c) 2020 Paul-Louis Ageneau + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTP_HPP +#define RTC_RTP_HPP + +#include "common.hpp" + +#include +#include + +namespace rtc { + +typedef uint32_t SSRC; + +RTC_CPP_EXPORT bool IsRtcp(const binary &data); + +#pragma pack(push, 1) + +struct RTC_CPP_EXPORT RtpExtensionHeader { + uint16_t _profileSpecificId; + uint16_t _headerLength; + + [[nodiscard]] uint16_t profileSpecificId() const; + [[nodiscard]] uint16_t headerLength() const; + + [[nodiscard]] size_t getSize() const; + [[nodiscard]] const char *getBody() const; + [[nodiscard]] char *getBody(); + + void setProfileSpecificId(uint16_t profileSpecificId); + void setHeaderLength(uint16_t headerLength); + + void clearBody(); + size_t writeCurrentVideoOrientation(bool twoByteHeader, size_t offset, uint8_t id, + uint8_t value); + size_t writeOneByteHeader(size_t offset, uint8_t id, const byte *value, size_t size); + size_t writeTwoByteHeader(size_t offset, uint8_t id, const byte *value, size_t size); + size_t writeHeader(bool twoByteHeader, size_t offset, uint8_t id, const byte *value, + size_t size); +}; + +struct RTC_CPP_EXPORT RtpHeader { + uint8_t _first; + uint8_t _payloadType; + uint16_t _seqNumber; + uint32_t _timestamp; + SSRC _ssrc; + // The following field is SSRC _csrc[] + + [[nodiscard]] uint8_t version() const; + [[nodiscard]] bool padding() const; + [[nodiscard]] bool extension() const; + [[nodiscard]] uint8_t csrcCount() const; + [[nodiscard]] uint8_t marker() const; + [[nodiscard]] uint8_t payloadType() const; + [[nodiscard]] uint16_t seqNumber() const; + [[nodiscard]] uint32_t timestamp() const; + [[nodiscard]] uint32_t ssrc() const; + + [[nodiscard]] size_t getSize() const; + [[nodiscard]] size_t getExtensionHeaderSize() const; + [[nodiscard]] const RtpExtensionHeader *getExtensionHeader() const; + [[nodiscard]] RtpExtensionHeader *getExtensionHeader(); + [[nodiscard]] const char *getBody() const; + [[nodiscard]] char *getBody(); + + void log() const; + + void preparePacket(); + void setSeqNumber(uint16_t newSeqNo); + void setPayloadType(uint8_t newPayloadType); + void setSsrc(uint32_t in_ssrc); + void setMarker(bool marker); + void setTimestamp(uint32_t i); + void setExtension(bool extension); +}; + +struct RTC_CPP_EXPORT RtcpReportBlock { + SSRC _ssrc; + uint32_t _fractionLostAndPacketsLost; // fraction lost is 8-bit, packets lost is 24-bit + uint16_t _seqNoCycles; + uint16_t _highestSeqNo; + uint32_t _jitter; + uint32_t _lastReport; + uint32_t _delaySinceLastReport; + + [[nodiscard]] uint16_t seqNoCycles() const; + [[nodiscard]] uint16_t highestSeqNo() const; + [[nodiscard]] uint32_t extendedHighestSeqNo() const; + [[nodiscard]] uint32_t jitter() const; + [[nodiscard]] uint32_t delaySinceSR() const; + + [[nodiscard]] SSRC getSSRC() const; + [[nodiscard]] uint32_t getNTPOfSR() const; + [[nodiscard]] uint8_t getFractionLost() const; + [[nodiscard]] unsigned int getPacketsLostCount() const; + + void preparePacket(SSRC in_ssrc, uint8_t fraction, unsigned int totalPacketsLost, + uint16_t highestSeqNo, uint16_t seqNoCycles, uint32_t jitter, + uint64_t lastSR_NTP, uint64_t lastSR_DELAY); + void setSSRC(SSRC in_ssrc); + void setPacketsLost(uint8_t fractionLost, unsigned int packetsLostCount); + void setSeqNo(uint16_t highestSeqNo, uint16_t seqNoCycles); + void setJitter(uint32_t jitter); + void setNTPOfSR(uint64_t ntp); + void setDelaySinceSR(uint32_t sr); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpHeader { + uint8_t _first; + uint8_t _payloadType; + uint16_t _length; + + [[nodiscard]] uint8_t version() const; + [[nodiscard]] bool padding() const; + [[nodiscard]] uint8_t reportCount() const; + [[nodiscard]] uint8_t payloadType() const; + [[nodiscard]] uint16_t length() const; + [[nodiscard]] size_t lengthInBytes() const; + + void prepareHeader(uint8_t payloadType, uint8_t reportCount, uint16_t length); + void setPayloadType(uint8_t type); + void setReportCount(uint8_t count); + void setLength(uint16_t length); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpFbHeader { + RtcpHeader header; + + SSRC _packetSender; + SSRC _mediaSource; + + [[nodiscard]] SSRC packetSenderSSRC() const; + [[nodiscard]] SSRC mediaSourceSSRC() const; + + void setPacketSenderSSRC(SSRC ssrc); + void setMediaSourceSSRC(SSRC ssrc); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpSr { + RtcpHeader header; + + SSRC _senderSSRC; + uint64_t _ntpTimestamp; + uint32_t _rtpTimestamp; + uint32_t _packetCount; + uint32_t _octetCount; + + RtcpReportBlock _reportBlocks; + + [[nodiscard]] static unsigned int Size(unsigned int reportCount); + + [[nodiscard]] uint64_t ntpTimestamp() const; + [[nodiscard]] uint32_t rtpTimestamp() const; + [[nodiscard]] uint32_t packetCount() const; + [[nodiscard]] uint32_t octetCount() const; + [[nodiscard]] uint32_t senderSSRC() const; + + [[nodiscard]] const RtcpReportBlock *getReportBlock(int num) const; // nullptr if out-of-bounds + [[nodiscard]] RtcpReportBlock *getReportBlock(int num); // nullptr if out-of-bounds + [[nodiscard]] unsigned int size(unsigned int reportCount); + [[nodiscard]] size_t getSize() const; + + void preparePacket(SSRC senderSSRC, uint8_t reportCount); + void setNtpTimestamp(uint64_t ts); + void setRtpTimestamp(uint32_t ts); + void setOctetCount(uint32_t ts); + void setPacketCount(uint32_t ts); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpSdesItem { + uint8_t type; + + uint8_t _length; + char _text[1]; + + [[nodiscard]] static unsigned int Size(uint8_t textLength); + + [[nodiscard]] string text() const; + [[nodiscard]] uint8_t length() const; + + void setText(string text); +}; + +struct RTC_CPP_EXPORT RtcpSdesChunk { + SSRC _ssrc; + RtcpSdesItem _items; + + [[nodiscard]] static unsigned int Size(const std::vector textLengths); + + [[nodiscard]] SSRC ssrc() const; + + void setSSRC(SSRC ssrc); + + // Get item at given index + // All items with index < num must be valid, otherwise this function has undefined behaviour + // (use safelyCountChunkSize() to check if chunk is valid). + [[nodiscard]] const RtcpSdesItem *getItem(int num) const; + [[nodiscard]] RtcpSdesItem *getItem(int num); + + // Get size of chunk + // All items must be valid, otherwise this function has undefined behaviour (use + // safelyCountChunkSize() to check if chunk is valid) + [[nodiscard]] unsigned int getSize() const; + + long safelyCountChunkSize(size_t maxChunkSize) const; +}; + +struct RTC_CPP_EXPORT RtcpSdes { + RtcpHeader header; + RtcpSdesChunk _chunks; + + [[nodiscard]] static unsigned int Size(const std::vector> lengths); + + bool isValid() const; + + // Returns number of chunks in this packet + // Returns 0 if packet is invalid + unsigned int chunksCount() const; + + // Get chunk at given index + // All chunks (and their items) with index < `num` must be valid, otherwise this function has + // undefined behaviour (use `isValid` to check if chunk is valid). + const RtcpSdesChunk *getChunk(int num) const; + RtcpSdesChunk *getChunk(int num); + + void preparePacket(uint8_t chunkCount); +}; + +struct RTC_CPP_EXPORT RtcpRr { + RtcpHeader header; + + SSRC _senderSSRC; + RtcpReportBlock _reportBlocks; + + [[nodiscard]] static size_t SizeWithReportBlocks(uint8_t reportCount); + + SSRC senderSSRC() const; + bool isSenderReport(); + bool isReceiverReport(); + + [[nodiscard]] RtcpReportBlock *getReportBlock(int num); // nullptr if out-of-bounds + [[nodiscard]] const RtcpReportBlock *getReportBlock(int num) const; // nullptr if out-of-bounds + [[nodiscard]] size_t getSize() const; + + void preparePacket(SSRC senderSSRC, uint8_t reportCount); + void setSenderSSRC(SSRC ssrc); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpRemb { + RtcpFbHeader header; + + char _id[4]; // Unique identifier ('R' 'E' 'M' 'B') + uint32_t _bitrate; // Num SSRC, Br Exp, Br Mantissa (bit mask) + SSRC _ssrcs[1]; + + [[nodiscard]] static size_t SizeWithSSRCs(int count); + + [[nodiscard]] unsigned int getSize() const; + + void preparePacket(SSRC senderSSRC, unsigned int numSSRC, unsigned int in_bitrate); + void setBitrate(unsigned int numSSRC, unsigned int in_bitrate); + SSRC getSSRC(int num) const; + void setSSRC(int num, SSRC newSsrc); + bool hasValidId() const; + int getSSRCCount() const; + unsigned int getBitrate() const; + + // Deprecated + [[deprecated("use setSSRC")]] void setSsrc(int num, SSRC newSssrc); + [[deprecated("use getSSRCCount")]] unsigned int getNumSSRC() const; + [[deprecated("use getSSRCCount")]] unsigned int getNumSSRC(); + unsigned int getBitrate(); +}; + +struct RTC_CPP_EXPORT RtcpPli { + RtcpFbHeader header; + + [[nodiscard]] static unsigned int Size(); + + void preparePacket(SSRC messageSSRC); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpFirFci { + uint32_t _ssrc; + uint8_t _seqNo; + uint8_t _dummy1; + uint16_t _dummy2; + + void preparePacket(SSRC ssrc, uint8_t seqNo); + + [[nodiscard]] SSRC getSSRC() const; + [[nodiscard]] uint8_t getSeqNo() const; +}; + +struct RTC_CPP_EXPORT RtcpFir { + RtcpFbHeader header; + RtcpFirFci _fcis[1]; + + [[nodiscard]] static size_t SizeWithFcis(int count); + + int getFciCount() const; + [[nodiscard]] const RtcpFirFci *getFci(int num) const; // nullptr if out-of-bounds + void preparePacket(SSRC senderSSRC, const std::vector &fcis); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtcpNackPart { + uint16_t _pid; + uint16_t _blp; + + uint16_t pid(); + uint16_t blp(); + + void setPid(uint16_t pid); + void setBlp(uint16_t blp); + + std::vector getSequenceNumbers(); +}; + +struct RTC_CPP_EXPORT RtcpNack { + RtcpFbHeader header; + RtcpNackPart parts[1]; + + [[nodiscard]] static unsigned int Size(unsigned int discreteSeqNoCount); + + [[nodiscard]] unsigned int getSeqNoCount(); + + void preparePacket(SSRC ssrc, unsigned int discreteSeqNoCount); + + /** + * Add a packet to the list of missing packets. + * @param fciCount The number of FCI fields that are present in this packet. + * Let the number start at zero and let this function grow the number. + * @param fciPID The seq no of the active FCI. It will be initialized automatically, and will + * change automatically. + * @param missingPacket The seq no of the missing packet. This will be added to the queue. + * @return true if the packet has grown, false otherwise. + */ + bool addMissingPacket(unsigned int *fciCount, uint16_t *fciPID, uint16_t missingPacket); +}; + +typedef std::array RtcpAppName; + +struct RTC_CPP_EXPORT RtcpApp { + RtcpHeader header; + + SSRC _ssrc; + char _name[4]; + char _data[1]; + + [[nodiscard]] static size_t SizeWithData(size_t dataLength); + + [[nodiscard]] SSRC ssrc() const; + [[nodiscard]] uint8_t subtype() const; + [[nodiscard]] RtcpAppName name() const; + [[nodiscard]] const char *data() const; + [[nodiscard]] size_t dataSize() const; + + void preparePacket(SSRC ssrc, const RtcpAppName &name, uint8_t subtype, size_t dataLength); + void setSSRC(SSRC ssrc); + void setName(const RtcpAppName &name); + + void log() const; +}; + +struct RTC_CPP_EXPORT RtpRtx { + RtpHeader header; + + [[nodiscard]] const char *getBody() const; + [[nodiscard]] char *getBody(); + [[nodiscard]] size_t getBodySize(size_t totalSize) const; + [[nodiscard]] size_t getSize() const; + [[nodiscard]] uint16_t getOriginalSeqNo() const; + + // Returns the new size of the packet + size_t normalizePacket(size_t totalSize, SSRC originalSSRC, uint8_t originalPayloadType); + + size_t copyTo(RtpHeader *dest, size_t totalSize, uint8_t originalPayloadType); +}; + +#pragma pack(pop) + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtpdepacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtpdepacketizer.hpp new file mode 100644 index 00000000..0d568192 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtpdepacketizer.hpp @@ -0,0 +1,79 @@ +/** + * Copyright (c) 2024 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTP_DEPACKETIZER_H +#define RTC_RTP_DEPACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "message.hpp" + +#include + +namespace rtc { + +// Base RTP depacketizer class +class RTC_CPP_EXPORT RtpDepacketizer : public MediaHandler { +public: + RtpDepacketizer(); + RtpDepacketizer(uint32_t clockRate); + virtual ~RtpDepacketizer(); + + virtual void incoming(message_vector &messages, const message_callback &send) override; + +protected: + shared_ptr createFrameInfo(uint32_t timestamp, uint8_t payloadType) const; + +private: + const uint32_t mClockRate; +}; + +// Base class for video RTP depacketizer +class RTC_CPP_EXPORT VideoRtpDepacketizer : public RtpDepacketizer { +public: + inline static const uint32_t ClockRate = 90000; + + VideoRtpDepacketizer(); + virtual ~VideoRtpDepacketizer(); + +protected: + struct sequence_cmp { + bool operator()(message_ptr a, message_ptr b) const; + }; + using message_buffer = std::set; + + virtual message_ptr reassemble(message_buffer &messages) = 0; + +private: + void incoming(message_vector &messages, const message_callback &send) override; + + message_buffer mBuffer; +}; + +// Generic audio RTP depacketizer +template +class RTC_CPP_EXPORT AudioRtpDepacketizer final : public RtpDepacketizer { +public: + inline static const uint32_t DefaultClockRate = DEFAULT_CLOCK_RATE; + + AudioRtpDepacketizer(uint32_t clockRate = DefaultClockRate) : RtpDepacketizer(clockRate) {} +}; + +// Audio RTP depacketizers +using OpusRtpDepacketizer = AudioRtpDepacketizer<48000>; +using AACRtpDepacketizer = AudioRtpDepacketizer<48000>; +using PCMARtpDepacketizer = AudioRtpDepacketizer<8000>; +using PCMURtpDepacketizer = AudioRtpDepacketizer<8000>; +using G722RtpDepacketizer = AudioRtpDepacketizer<8000>; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_RTP_DEPACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizationconfig.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizationconfig.hpp new file mode 100644 index 00000000..238b9195 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizationconfig.hpp @@ -0,0 +1,141 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTP_PACKETIZATION_CONFIG_H +#define RTC_RTP_PACKETIZATION_CONFIG_H + +#if RTC_ENABLE_MEDIA + +#include "dependencydescriptor.hpp" +#include "rtp.hpp" + +namespace rtc { + +struct RTC_CPP_EXPORT VideoLayersAllocation; + +// RTP configuration used in packetization process +class RTC_CPP_EXPORT RtpPacketizationConfig { +public: + SSRC ssrc; + std::string cname; + uint8_t payloadType; + uint32_t clockRate; + uint8_t videoOrientationId; + + // current sequence number + uint16_t sequenceNumber; + + // current timestamp + uint32_t timestamp; + + // start timestamp + uint32_t startTimestamp; + + /// Current video orientation + /// + /// Bit# 7 6 5 4 3 2 1 0 + /// Definition 0 0 0 0 C F R1 R0 + /// + /// C + /// 0 - Front-facing camera (use this if unsure) + /// 1 - Back-facing camera + /// + /// F + /// 0 - No Flip + /// 1 - Horizontal flip + /// + /// R1 R0 - CW rotation that receiver must apply + /// 0 - 0 degrees + /// 1 - 90 degrees + /// 2 - 180 degrees + /// 3 - 270 degrees + uint8_t videoOrientation = 0; + + // MID Extension Header + uint8_t midId = 0; + optional mid; + + // RID Extension Header + uint8_t ridId = 0; + optional rid; + + // Dependency Descriptor Extension Header + uint8_t dependencyDescriptorId = 0; + + optional dependencyDescriptorContext; + // the negotiated ID of the playout delay header extension + // https://webrtc.googlesource.com/src/+/main/docs/native-code/rtp-hdrext/playout-delay/README.md + uint8_t playoutDelayId = 0; + + // Minimum/maxiumum playout delay, in 10ms intervals. A value of 10 would equal a 100ms delay + uint16_t playoutDelayMin = 0; + uint16_t playoutDelayMax = 0; + + // Google Video Layers Allocation for simulcast + // https://webrtc.googlesource.com/src/+/refs/heads/main/docs/native-code/rtp-hdrext/video-layers-allocation00 + // + // The negotiated extension id + uint8_t videoLayersAllocationId = 0; + // Stream index, unique per RID/SSRC + uint8_t videoLayersAllocationStreamIndex = 0; + // Shared data about layers + std::shared_ptr videoLayersAllocationStreams; + + // https://webrtc.googlesource.com/src/+/refs/heads/main/docs/native-code/rtp-hdrext/color-space/ + uint8_t colorSpaceId = 0; // the negotiated ID of color space header extension + uint8_t colorChromaSitingHorz = 0; // unspecified + uint8_t colorChromaSitingVert = 0; // unspecified + uint8_t colorRange = 2; // full range + uint8_t colorPrimaries = 1; // BT.709-6 + uint8_t colorTransfer = 1; // BT.709-6 + uint8_t colorMatrix = 1; // BT.709-6 + + // abs-capture-time RTP header extension. When absCaptureTimeId > 0 and an + // outgoing FrameInfo carries an absCaptureTimeNtp value, the RtpPacketizer + // writes the 8-byte (shortened) form of the abs-capture-time extension into + // every packet for that frame. The receiver can recover the source's + // capture wallclock and compute true glass-to-glass latency. + // https://webrtc.googlesource.com/src/+/refs/heads/main/docs/native-code/rtp-hdrext/abs-capture-time + uint8_t absCaptureTimeId = 0; + + /// Construct RTP configuration used in packetization process + /// @param ssrc SSRC of source + /// @param cname CNAME of source + /// @param payloadType Payload type of source + /// @param clockRate Clock rate of source used in timestamps + /// nullopt) + /// @param videoOrientationId Video orientation (see above) + RtpPacketizationConfig(SSRC ssrc, std::string cname, uint8_t payloadType, uint32_t clockRate, + uint8_t videoOrientationId = 0); + + RtpPacketizationConfig(const RtpPacketizationConfig &) = delete; + + /// Convert timestamp to seconds + /// @param timestamp Timestamp + /// @param clockRate Clock rate for timestamp calculation + static double getSecondsFromTimestamp(uint32_t timestamp, uint32_t clockRate); + + /// Convert timestamp to seconds + /// @param timestamp Timestamp + double timestampToSeconds(uint32_t timestamp); + + /// Convert seconds to timestamp + /// @param seconds Number of seconds + /// @param clockRate Clock rate for timestamp calculation + static uint32_t getTimestampFromSeconds(double seconds, uint32_t clockRate); + + /// Convert seconds to timestamp + /// @param seconds Number of seconds + uint32_t secondsToTimestamp(double seconds); +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_RTP_PACKETIZATION_CONFIG_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizer.hpp new file mode 100644 index 00000000..df3fcc1e --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/rtppacketizer.hpp @@ -0,0 +1,106 @@ +/** + * Copyright (c) 2020 Filip Klembara (in2core) + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_RTP_PACKETIZER_H +#define RTC_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "mediahandler.hpp" +#include "message.hpp" +#include "rtppacketizationconfig.hpp" + +namespace rtc { + +/// RTP packetizer +class RTC_CPP_EXPORT RtpPacketizer : public MediaHandler { +public: + /// Default maximum fragment size (for video packetizers) + inline static const size_t DefaultMaxFragmentSize = RTC_DEFAULT_MAX_FRAGMENT_SIZE; + + /// Clock rate for video in RTP + inline static const uint32_t VideoClockRate = 90 * 1000; + + /// Constructs packetizer with given RTP configuration + /// @note RTP configuration is used in packetization process which may change some configuration + /// properties such as sequence number. + /// @param rtpConfig RTP configuration + RtpPacketizer(shared_ptr rtpConfig); + virtual ~RtpPacketizer(); + + virtual void media(const Description::Media &desc) override; + virtual void outgoing(message_vector &messages, const message_callback &send) override; + + /// RTP packetization config + const shared_ptr rtpConfig; + +protected: + /// Fragment data into payloads + /// Default implementation returns data as a single payload + /// @param data Input data + virtual std::vector fragment(binary data); + + /// Creates an RTP packet for a payload + /// @note This function increases the sequence number. + /// @param payload RTP payload + /// @param mark Set marker flag in RTP packet if true + virtual message_ptr packetize(const binary &payload, bool mark, shared_ptr frameInfo = nullptr); + +private: + static const auto RtpHeaderSize = 12; + static const auto RtpExtHeaderCvoSize = 8; + + uint32_t videoLayersAllocationInitialPacketCount = 0; + + bool shouldEmitVideoLayersAllocation(shared_ptr frameInfo); +}; + +// Generic audio RTP packetizer +template +class RTC_CPP_EXPORT AudioRtpPacketizer final : public RtpPacketizer { +public: + inline static const uint32_t DefaultClockRate = DEFAULT_CLOCK_RATE; + inline static const uint32_t defaultClockRate [[deprecated("Use DefaultClockRate")]] = + DEFAULT_CLOCK_RATE; // for backward compatibility + + AudioRtpPacketizer(shared_ptr rtpConfig) + : RtpPacketizer(std::move(rtpConfig)) {} +}; + +// Audio RTP packetizers +using OpusRtpPacketizer = AudioRtpPacketizer<48000>; +using AACRtpPacketizer = AudioRtpPacketizer<48000>; +using PCMARtpPacketizer = AudioRtpPacketizer<8000>; +using PCMURtpPacketizer = AudioRtpPacketizer<8000>; +using G722RtpPacketizer = AudioRtpPacketizer<8000>; + +// Dummy wrapper for backward compatibility, do not use +class RTC_CPP_EXPORT PacketizationHandler final : public MediaHandler { +public: + PacketizationHandler(shared_ptr packetizer) + : mPacketizer(std::move(packetizer)) {} + + inline void outgoing(message_vector &messages, const message_callback &send) { + return mPacketizer->outgoing(messages, send); + } + +private: + shared_ptr mPacketizer; +}; + +// Audio packetization handlers for backward compatibility, do not use +using OpusPacketizationHandler [[deprecated("Add OpusRtpPacketizer directly")]] = + PacketizationHandler; +using AACPacketizationHandler [[deprecated("Add AACRtpPacketizer directly")]] = + PacketizationHandler; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/track.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/track.hpp new file mode 100644 index 00000000..f06d78f0 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/track.hpp @@ -0,0 +1,70 @@ +/** + * Copyright (c) 2020 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_TRACK_H +#define RTC_TRACK_H + +#include "channel.hpp" +#include "common.hpp" +#include "description.hpp" +#include "mediahandler.hpp" + +#include + +namespace rtc { + +namespace impl { + +class Track; + +} // namespace impl + +class RTC_CPP_EXPORT Track final : private CheshireCat, public Channel { +public: + Track(impl_ptr impl); + ~Track() override; + + string mid() const; + Description::Direction direction() const; + Description::Media description() const; + + void setDescription(Description::Media description); + + void close(void) override; + bool send(message_variant data) override; + bool send(const byte *data, size_t size) override; + + bool isOpen(void) const override; + bool isClosed(void) const override; + size_t maxMessageSize() const override; + + void sendFrame(binary data, FrameInfo info); + void sendFrame(const byte *data, size_t size, FrameInfo info); + void onFrame(std::function callback); + + bool requestKeyframe(SSRC ssrc=0, bool retransmit=false); + bool requestKeyframe(const std::vector& targetSSRCs, bool retransmit=false); + bool requestBitrate(unsigned int bitrate); + bool sendRtcpApp(uint32_t ssrc, const RtcpAppName &name, uint8_t subtype, + const binary &data = binary{}); + + void setMediaHandler(shared_ptr handler); + void chainMediaHandler(shared_ptr handler); + shared_ptr getMediaHandler(); + + // Deprecated, use setMediaHandler() and getMediaHandler() + inline void setRtcpHandler(shared_ptr handler) { setMediaHandler(handler); } + inline shared_ptr getRtcpHandler() { return getMediaHandler(); } + +private: + using CheshireCat::impl; +}; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/utils.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/utils.hpp new file mode 100644 index 00000000..9ec20b1c --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/utils.hpp @@ -0,0 +1,174 @@ +/** + * Copyright (c) 2019-2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_UTILS_H +#define RTC_UTILS_H + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace rtc { + +// overloaded helper +template struct overloaded : Ts... { using Ts::operator()...; }; +template overloaded(Ts...) -> overloaded; + +// weak_ptr bind helper +template auto weak_bind(F &&f, T *t, Args &&..._args) { + return [bound = std::bind(f, t, _args...), weak_this = t->weak_from_this()](auto &&...args) { + if (auto shared_this = weak_this.lock()) + return bound(args...); + else + return static_cast(false); + }; +} + +// scope_guard helper +class scope_guard final { +public: + scope_guard(std::function func) : function(std::move(func)) {} + scope_guard(scope_guard &&other) = delete; + scope_guard(const scope_guard &) = delete; + void operator=(const scope_guard &) = delete; + + ~scope_guard() { + if (function) + function(); + } + +private: + std::function function; +}; + +// callback with built-in synchronization +template class synchronized_callback { +public: + synchronized_callback() = default; + synchronized_callback(synchronized_callback &&cb) { *this = std::move(cb); } + synchronized_callback(const synchronized_callback &cb) { *this = cb; } + synchronized_callback(std::function func) { *this = std::move(func); } + virtual ~synchronized_callback() { *this = nullptr; } + + synchronized_callback &operator=(synchronized_callback &&cb) { + std::scoped_lock lock(mutex, cb.mutex); + set(std::exchange(cb.callback, nullptr)); + return *this; + } + + synchronized_callback &operator=(const synchronized_callback &cb) { + std::scoped_lock lock(mutex, cb.mutex); + set(cb.callback); + return *this; + } + + synchronized_callback &operator=(std::function func) { + std::lock_guard lock(mutex); + set(std::move(func)); + return *this; + } + + bool operator()(Args... args) const { + std::lock_guard lock(mutex); + return call(std::move(args)...); + } + + operator bool() const { + std::lock_guard lock(mutex); + return callback ? true : false; + } + +protected: + virtual void set(std::function func) { callback = std::move(func); } + virtual bool call(Args... args) const { + if (!callback) + return false; + + callback(std::move(args)...); + return true; + } + + std::function callback; + mutable std::recursive_mutex mutex; +}; + +// callback with built-in synchronization and replay of the last missed call +template +class synchronized_stored_callback final : public synchronized_callback { +public: + template + synchronized_stored_callback(CArgs &&...cargs) + : synchronized_callback(std::forward(cargs)...) {} + ~synchronized_stored_callback() {} + +private: + void set(std::function func) { + synchronized_callback::set(func); + if (func && stored) { + std::apply(func, std::move(*stored)); + stored.reset(); + } + } + + bool call(Args... args) const { + if (!synchronized_callback::call(args...)) + stored.emplace(std::move(args)...); + + return true; + } + + mutable std::optional> stored; +}; + +// pimpl base class +template using impl_ptr = std::shared_ptr; +template class CheshireCat { +public: + CheshireCat(impl_ptr impl) : mImpl(std::move(impl)) {} + template + CheshireCat(Args... args) : mImpl(std::make_shared(std::forward(args)...)) {} + CheshireCat(CheshireCat &&cc) { *this = std::move(cc); } + CheshireCat(const CheshireCat &) = delete; + + virtual ~CheshireCat() = default; + + CheshireCat &operator=(CheshireCat &&cc) { + mImpl = std::move(cc.mImpl); + return *this; + }; + CheshireCat &operator=(const CheshireCat &) = delete; + +protected: + impl_ptr impl() { return mImpl; } + impl_ptr impl() const { return mImpl; } + +private: + impl_ptr mImpl; +}; + +// case-insensitive string comparator using std::tolower +class case_insensitive_less : public std::less { +public: + bool operator()(const std::string &lhs, const std::string &rhs) const { + return std::lexicographical_compare(lhs.begin(), lhs.end(), rhs.begin(), rhs.end(), + [](auto a, auto b) { + return std::tolower(static_cast(a)) < + std::tolower(static_cast(b)); + }); + } +}; + +} // namespace rtc + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/version.h b/lib/datachannel/cpp/libdatachannel/include/rtc/version.h new file mode 100644 index 00000000..1c339bfa --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/version.h @@ -0,0 +1,9 @@ +#ifndef RTC_VERSION_H +#define RTC_VERSION_H + +#define RTC_VERSION_MAJOR 0 +#define RTC_VERSION_MINOR 24 +#define RTC_VERSION_PATCH 4 +#define RTC_VERSION "0.24.4" + +#endif diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/video_layers_allocation.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/video_layers_allocation.hpp new file mode 100644 index 00000000..31590bc7 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/video_layers_allocation.hpp @@ -0,0 +1,50 @@ +/** + * Copyright (c) 2026 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_VIDEO_LAYERS_ALLOCATION_H +#define RTC_VIDEO_LAYERS_ALLOCATION_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" + +#include +#include +#include + +namespace rtc { + +// Google Video Layers Allocation for simulcast +// +// https://webrtc.googlesource.com/src/+/refs/heads/main/docs/native-code/rtp-hdrext/video-layers-allocation00 + +struct RTC_CPP_EXPORT VideoLayersAllocation { + struct SpatialLayer { + uint16_t width = 0; + uint16_t height = 0; + uint8_t fps = 0; + std::vector targetBitratesKbps; // per temporal layer, cumulative, cannot be empty + }; + + struct RtpStream { + std::vector spatialLayers; + }; + + std::vector rtpStreams; // up to 4 streams + + /// Generate the wire format for Google Video Layers Allocation RTP header extension + /// @param streamIndex The RTP stream index (0-3) for this packet's stream + /// @return Binary payload for the RTP header extension, empty if allocation is invalid + binary generate(uint8_t streamIndex) const; +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_VIDEO_LAYERS_ALLOCATION_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtpdepacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtpdepacketizer.hpp new file mode 100644 index 00000000..beeea4cd --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtpdepacketizer.hpp @@ -0,0 +1,34 @@ +/** + * Copyright (c) 2026 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_VP8_RTP_DEPACKETIZER_H +#define RTC_VP8_RTP_DEPACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "message.hpp" +#include "rtpdepacketizer.hpp" + +namespace rtc { + +/// RTP depacketization for VP8 +class RTC_CPP_EXPORT VP8RtpDepacketizer final : public VideoRtpDepacketizer { +public: + VP8RtpDepacketizer(); + ~VP8RtpDepacketizer(); + +private: + message_ptr reassemble(message_buffer &buffer) override; +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif /* RTC_VP8_RTP_DEPACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtppacketizer.hpp new file mode 100644 index 00000000..a8f121a1 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/vp8rtppacketizer.hpp @@ -0,0 +1,42 @@ +/** + * Copyright (c) 2026 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_VP8_RTP_PACKETIZER_H +#define RTC_VP8_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "rtppacketizer.hpp" + +namespace rtc { + +/// RTP packetization for VP8 +class RTC_CPP_EXPORT VP8RtpPacketizer final : public RtpPacketizer { +public: + inline static const uint32_t ClockRate = VideoClockRate; + [[deprecated("Use ClockRate")]] inline static const uint32_t defaultClockRate = ClockRate; + + /// Constructs VP8 payload packetizer with given RTP configuration. + /// @note RTP configuration is used in packetization process which may change some configuration + /// properties such as sequence number. + /// @param rtpConfig RTP configuration + /// @param maxFragmentSize maximum size of one packet payload + VP8RtpPacketizer(shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + +private: + std::vector fragment(binary frame) override; + + const size_t mMaxFragmentSize; +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_VP8_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtpdepacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtpdepacketizer.hpp new file mode 100644 index 00000000..853936ad --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtpdepacketizer.hpp @@ -0,0 +1,34 @@ +/** + * Copyright (c) 2026 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_VP9_RTP_DEPACKETIZER_H +#define RTC_VP9_RTP_DEPACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "common.hpp" +#include "message.hpp" +#include "rtpdepacketizer.hpp" + +namespace rtc { + +/// RTP depacketization for VP9 +class RTC_CPP_EXPORT VP9RtpDepacketizer final : public VideoRtpDepacketizer { +public: + VP9RtpDepacketizer(); + ~VP9RtpDepacketizer(); + +private: + message_ptr reassemble(message_buffer &buffer) override; +}; + +} // namespace rtc + +#endif // RTC_ENABLE_MEDIA + +#endif /* RTC_VP9_RTP_DEPACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtppacketizer.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtppacketizer.hpp new file mode 100644 index 00000000..85637f26 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/vp9rtppacketizer.hpp @@ -0,0 +1,41 @@ +/** + * Copyright (c) 2026 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_VP9_RTP_PACKETIZER_H +#define RTC_VP9_RTP_PACKETIZER_H + +#if RTC_ENABLE_MEDIA + +#include "rtppacketizer.hpp" + +namespace rtc { + +/// RTP packetization for VP9 +class RTC_CPP_EXPORT VP9RtpPacketizer final : public RtpPacketizer { +public: + inline static const uint32_t ClockRate = VideoClockRate; + + /// Constructs VP9 payload packetizer with given RTP configuration. + /// @note RTP configuration is used in packetization process which may change some configuration + /// properties such as sequence number. + /// @param rtpConfig RTP configuration + /// @param maxFragmentSize maximum size of one packet payload + VP9RtpPacketizer(shared_ptr rtpConfig, + size_t maxFragmentSize = DefaultMaxFragmentSize); + +private: + std::vector fragment(binary frame) override; + + const size_t mMaxFragmentSize; +}; + +} // namespace rtc + +#endif /* RTC_ENABLE_MEDIA */ + +#endif /* RTC_VP9_RTP_PACKETIZER_H */ diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/websocket.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/websocket.hpp new file mode 100644 index 00000000..cbb72e6b --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/websocket.hpp @@ -0,0 +1,72 @@ +/** + * Copyright (c) 2020-2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_WEBSOCKET_H +#define RTC_WEBSOCKET_H + +#if RTC_ENABLE_WEBSOCKET + +#include "channel.hpp" +#include "common.hpp" +#include "configuration.hpp" + +#include + +namespace rtc { + +namespace impl { + +struct WebSocket; + +} // namespace impl + +class RTC_CPP_EXPORT WebSocket final : private CheshireCat, public Channel { +public: + enum class State : int { + Connecting = 0, + Open = 1, + Closing = 2, + Closed = 3, + }; + + using Configuration = WebSocketConfiguration; + + using Headers = std::map; + + WebSocket(); + WebSocket(Configuration config); + WebSocket(impl_ptr impl); + ~WebSocket() override; + + State readyState() const; + + bool isOpen() const override; + bool isClosed() const override; + size_t maxMessageSize() const override; + + void open(const string &url, const Headers &headers = {}); + void close() override; + void forceClose(); + bool send(const message_variant data) override; + bool send(const byte *data, size_t size) override; + + optional remoteAddress() const; + optional path() const; + std::multimap requestHeaders() const; + +private: + using CheshireCat::impl; +}; + +std::ostream &operator<<(std::ostream &out, WebSocket::State state); + +} // namespace rtc + +#endif + +#endif // RTC_WEBSOCKET_H diff --git a/lib/datachannel/cpp/libdatachannel/include/rtc/websocketserver.hpp b/lib/datachannel/cpp/libdatachannel/include/rtc/websocketserver.hpp new file mode 100644 index 00000000..9bb1c0d2 --- /dev/null +++ b/lib/datachannel/cpp/libdatachannel/include/rtc/websocketserver.hpp @@ -0,0 +1,48 @@ +/** + * Copyright (c) 2021 Paul-Louis Ageneau + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. + */ + +#ifndef RTC_WEBSOCKETSERVER_H +#define RTC_WEBSOCKETSERVER_H + +#if RTC_ENABLE_WEBSOCKET + +#include "common.hpp" +#include "configuration.hpp" +#include "websocket.hpp" + +namespace rtc { + +namespace impl { + +struct WebSocketServer; + +} + +class RTC_CPP_EXPORT WebSocketServer final : private CheshireCat { +public: + using Configuration = WebSocketServerConfiguration; + + WebSocketServer(); + WebSocketServer(Configuration config); + ~WebSocketServer(); + + void stop(); + + uint16_t port() const; + + void onClient(std::function)> callback); + +private: + using CheshireCat::impl; +}; + +} // namespace rtc + +#endif + +#endif // RTC_WEBSOCKET_H diff --git a/lib/datachannel/cpp/src/aegis128x4.c b/lib/datachannel/cpp/src/aegis128x4.c new file mode 100644 index 00000000..b0c5b95b --- /dev/null +++ b/lib/datachannel/cpp/src/aegis128x4.c @@ -0,0 +1,249 @@ +#define HL_NAME(n) datachannel_##n + +#include +#include +#include + +// AEGIS-128X4 (RFC 10032, section 5.4) keystream DRBG. +// VAES-512 path processes all four lanes per instruction; AES-NI path +// runs the lanes sequentially. Non-x86 builds report unavailable and the +// caller falls back to the portable implementation. + +#if defined(__x86_64__) || defined(_M_X64) || defined(__i386__) || defined(_M_IX86) +#define AEGIS_X86 1 +#include +#if defined(_MSC_VER) +#include +#else +#include +#endif +#endif + +#if defined(__GNUC__) || defined(__clang__) +#define TARGET_AVX512 __attribute__((target("avx512f,vaes"))) +#define TARGET_AESNI __attribute__((target("aes"))) +#else +#define TARGET_AVX512 +#define TARGET_AESNI +#endif + +#ifdef AEGIS_X86 + +static void cpuidex(int leaf, int subleaf, int regs[4]) +{ +#if defined(_MSC_VER) + __cpuidex(regs, leaf, subleaf); +#else + __cpuid_count(leaf, subleaf, regs[0], regs[1], regs[2], regs[3]); +#endif +} + +static uint64_t xgetbv0(void) +{ +#if defined(_MSC_VER) + return _xgetbv(0); +#else + uint32_t eax, edx; + __asm__ volatile("xgetbv" : "=a"(eax), "=d"(edx) : "c"(0)); + return ((uint64_t)edx << 32) | eax; +#endif +} + +// 0 = no AES-NI, 1 = AES-NI, 2 = VAES + AVX-512F with OS ZMM support +static int detect(void) +{ + int r[4]; + cpuidex(1, 0, r); + if (!((r[2] >> 25) & 1)) return 0; // AES-NI + int osxsave = (r[2] >> 27) & 1; + int avx = (r[2] >> 28) & 1; + if (!(osxsave && avx)) return 1; + uint64_t xcr0 = xgetbv0(); + if ((xcr0 & 0x6) != 0x6) return 1; // SSE+AVX state + cpuidex(7, 0, r); + int avx512f = (r[1] >> 16) & 1; + int vaes = (r[2] >> 9) & 1; + if (avx512f && vaes && (xcr0 & 0xE0) == 0xE0) return 2; // opmask+ZMM state + return 1; +} + +static int mode = 0; +static uint8_t buf[128]; +static int bufpos = 128; + +// --- VAES-512: lane i of register j holds V[j,i] --- + +static __m512i s4[8]; + +TARGET_AVX512 static void update512(__m512i m0, __m512i m1) +{ + __m512i a0 = s4[0], a1 = s4[1], a2 = s4[2], a3 = s4[3]; + __m512i a4 = s4[4], a5 = s4[5], a6 = s4[6], a7 = s4[7]; + s4[0] = _mm512_aesenc_epi128(a7, _mm512_xor_si512(a0, m0)); + s4[1] = _mm512_aesenc_epi128(a0, a1); + s4[2] = _mm512_aesenc_epi128(a1, a2); + s4[3] = _mm512_aesenc_epi128(a2, a3); + s4[4] = _mm512_aesenc_epi128(a3, _mm512_xor_si512(a4, m1)); + s4[5] = _mm512_aesenc_epi128(a4, a5); + s4[6] = _mm512_aesenc_epi128(a5, a6); + s4[7] = _mm512_aesenc_epi128(a6, a7); +} + +TARGET_AVX512 static void init512(const uint8_t* key, const uint8_t* nonce) +{ + const __m128i c0_128 = _mm_setr_epi8( + 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, + 0x15, 0x22, 0x37, 0x59, (char)0x90, (char)0xe9, 0x79, 0x62); + const __m128i c1_128 = _mm_setr_epi8( + (char)0xdb, 0x3d, 0x18, 0x55, 0x6d, (char)0xc2, 0x2f, (char)0xf1, + 0x20, 0x11, 0x31, 0x42, 0x73, (char)0xb5, 0x28, (char)0xdd); + __m512i kv = _mm512_broadcast_i32x4(_mm_loadu_si128((const __m128i*)key)); + __m512i nv = _mm512_broadcast_i32x4(_mm_loadu_si128((const __m128i*)nonce)); + __m512i c0 = _mm512_broadcast_i32x4(c0_128); + __m512i c1 = _mm512_broadcast_i32x4(c1_128); + __m512i kn = _mm512_xor_si512(kv, nv); + s4[0] = kn; + s4[1] = c1; + s4[2] = c0; + s4[3] = c1; + s4[4] = kn; + s4[5] = _mm512_xor_si512(kv, c0); + s4[6] = _mm512_xor_si512(kv, c1); + s4[7] = _mm512_xor_si512(kv, c0); + // ctx[i] = Byte(i) || Byte(D-1) || zeros, one per 128-bit lane + __m512i ctx = _mm512_set_epi32( + 0, 0, 0, 0x303, 0, 0, 0, 0x302, 0, 0, 0, 0x301, 0, 0, 0, 0x300); + for (int r = 0; r < 10; r++) { + s4[3] = _mm512_xor_si512(s4[3], ctx); + s4[7] = _mm512_xor_si512(s4[7], ctx); + update512(nv, kv); + } +} + +TARGET_AVX512 static void block512(uint8_t* out) +{ + __m512i z0 = _mm512_xor_si512(_mm512_xor_si512(s4[1], s4[6]), + _mm512_and_si512(s4[2], s4[3])); + __m512i z1 = _mm512_xor_si512(_mm512_xor_si512(s4[2], s4[5]), + _mm512_and_si512(s4[6], s4[7])); + _mm512_storeu_si512((void*)out, z0); + _mm512_storeu_si512((void*)(out + 64), z1); + update512(_mm512_setzero_si512(), _mm512_setzero_si512()); +} + +// --- AES-NI: s1[j][i] holds V[j,i] --- + +static __m128i s1[8][4]; + +TARGET_AESNI static void update128(__m128i m0[4], __m128i m1[4]) +{ + for (int i = 0; i < 4; i++) { + __m128i a0 = s1[0][i], a1 = s1[1][i], a2 = s1[2][i], a3 = s1[3][i]; + __m128i a4 = s1[4][i], a5 = s1[5][i], a6 = s1[6][i], a7 = s1[7][i]; + s1[0][i] = _mm_aesenc_si128(a7, _mm_xor_si128(a0, m0[i])); + s1[1][i] = _mm_aesenc_si128(a0, a1); + s1[2][i] = _mm_aesenc_si128(a1, a2); + s1[3][i] = _mm_aesenc_si128(a2, a3); + s1[4][i] = _mm_aesenc_si128(a3, _mm_xor_si128(a4, m1[i])); + s1[5][i] = _mm_aesenc_si128(a4, a5); + s1[6][i] = _mm_aesenc_si128(a5, a6); + s1[7][i] = _mm_aesenc_si128(a6, a7); + } +} + +TARGET_AESNI static void init128(const uint8_t* key, const uint8_t* nonce) +{ + const __m128i c0 = _mm_setr_epi8( + 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, + 0x15, 0x22, 0x37, 0x59, (char)0x90, (char)0xe9, 0x79, 0x62); + const __m128i c1 = _mm_setr_epi8( + (char)0xdb, 0x3d, 0x18, 0x55, 0x6d, (char)0xc2, 0x2f, (char)0xf1, + 0x20, 0x11, 0x31, 0x42, 0x73, (char)0xb5, 0x28, (char)0xdd); + __m128i k = _mm_loadu_si128((const __m128i*)key); + __m128i n = _mm_loadu_si128((const __m128i*)nonce); + __m128i kn = _mm_xor_si128(k, n); + __m128i m0[4], m1[4]; + for (int i = 0; i < 4; i++) { + s1[0][i] = kn; + s1[1][i] = c1; + s1[2][i] = c0; + s1[3][i] = c1; + s1[4][i] = kn; + s1[5][i] = _mm_xor_si128(k, c0); + s1[6][i] = _mm_xor_si128(k, c1); + s1[7][i] = _mm_xor_si128(k, c0); + m0[i] = n; + m1[i] = k; + } + for (int r = 0; r < 10; r++) { + for (int i = 0; i < 4; i++) { + __m128i ctx = _mm_set_epi32(0, 0, 0, 0x300 + i); + s1[3][i] = _mm_xor_si128(s1[3][i], ctx); + s1[7][i] = _mm_xor_si128(s1[7][i], ctx); + } + update128(m0, m1); + } +} + +TARGET_AESNI static void block128(uint8_t* out) +{ + for (int i = 0; i < 4; i++) { + __m128i z0 = _mm_xor_si128(_mm_xor_si128(s1[1][i], s1[6][i]), + _mm_and_si128(s1[2][i], s1[3][i])); + __m128i z1 = _mm_xor_si128(_mm_xor_si128(s1[2][i], s1[5][i]), + _mm_and_si128(s1[6][i], s1[7][i])); + _mm_storeu_si128((__m128i*)(out + i * 16), z0); + _mm_storeu_si128((__m128i*)(out + 64 + i * 16), z1); + } + __m128i zero[4]; + for (int i = 0; i < 4; i++) zero[i] = _mm_setzero_si128(); + update128(zero, zero); +} + +#endif // AEGIS_X86 + +HL_PRIM bool HL_NAME(aegis_available)() +{ +#ifdef AEGIS_X86 + return detect() != 0; +#else + return false; +#endif +} + +HL_PRIM bool HL_NAME(aegis_init)(vbyte* key, vbyte* nonce) +{ +#ifdef AEGIS_X86 + mode = detect(); + if (mode == 2) init512((const uint8_t*)key, (const uint8_t*)nonce); + else if (mode == 1) init128((const uint8_t*)key, (const uint8_t*)nonce); + else return false; + bufpos = 128; + return true; +#else + return false; +#endif +} + +HL_PRIM void HL_NAME(aegis_random)(vbyte* out, int len) +{ +#ifdef AEGIS_X86 + int off = 0; + while (off < len) { + if (bufpos >= 128) { + if (mode == 2) block512(buf); + else block128(buf); + bufpos = 0; + } + int n = len - off; + if (n > 128 - bufpos) n = 128 - bufpos; + memcpy(out + off, buf + bufpos, n); + bufpos += n; + off += n; + } +#endif +} + +DEFINE_PRIM(_BOOL, aegis_available, _NO_ARG); +DEFINE_PRIM(_BOOL, aegis_init, _BYTES _BYTES); +DEFINE_PRIM(_VOID, aegis_random, _BYTES _I32); diff --git a/lib/datachannel/cpp/src/datachannel.c b/lib/datachannel/cpp/src/datachannel.c new file mode 100644 index 00000000..509ac5dd --- /dev/null +++ b/lib/datachannel/cpp/src/datachannel.c @@ -0,0 +1,721 @@ +#define HL_NAME(n) datachannel_##n + +#include +#include + +typedef struct _hl_rtc_peerconnection hl_rtc_peerconnection; +struct _hl_rtc_peerconnection { + void (*finalize)(hl_rtc_peerconnection*); + int pc; + vclosure* descCb; + vclosure* candidateCb; + vclosure* stateCb; + vclosure* gatheringStateCb; + + // For datachannel + vclosure* datachannelCb; +}; + +typedef struct _hl_rtc_datachannel hl_rtc_datachannel; +struct _hl_rtc_datachannel { + void (*finalize)(hl_rtc_datachannel*); + int dc; + vclosure* openCb; + vclosure* closedCb; + vclosure* errCb; + vclosure* msgCb; + vclosure* bufferLowCb; +}; + +typedef struct _callback_result callback_result; +struct _callback_result { + vclosure** closure; + vdynamic arg1; + vdynamic arg2; + int args; + int arg1Size; + int arg2Size; + callback_result* next; + const char* callback_name; +}; + +typedef struct _datachannel_callback datachannel_callback; +struct _datachannel_callback { + int dc; + hl_rtc_peerconnection* pc; + datachannel_callback* next; +}; + +hl_mutex* callback_result_mutex = NULL; +hl_semaphore* callback_result_semaphore = NULL; +hl_semaphore* datachannel_callbacks_semaphore = NULL; +callback_result* callback_results = NULL; +callback_result* callback_results_end = NULL; +datachannel_callback* datachannel_callbacks = NULL; +datachannel_callback* datachannel_callbacks_end = NULL; + +callback_result* callback_result_alloc() +{ + if (callback_results_end == NULL) + { + callback_results_end = callback_results = (callback_result*)malloc(sizeof(callback_result)); + callback_results_end->next = NULL; + } + else + { + callback_results_end->next = (callback_result*)malloc(sizeof(callback_result)); + callback_results_end = callback_results_end->next; + callback_results_end->next = NULL; + } + return callback_results_end; +} + +datachannel_callback* datachannel_callback_alloc() +{ + if (datachannel_callbacks_end == NULL) + { + datachannel_callbacks_end = datachannel_callbacks = (datachannel_callback*)malloc(sizeof(datachannel_callback)); + datachannel_callbacks_end->next = NULL; + } + else + { + datachannel_callbacks_end->next = (datachannel_callback*)malloc(sizeof(datachannel_callback)); + datachannel_callbacks_end = datachannel_callbacks_end->next; + datachannel_callbacks_end->next = NULL; + } + return datachannel_callbacks_end; +} + +void hl_rtc_peerconnection_finalize(hl_rtc_peerconnection* pc) +{ + rtcSetLocalCandidateCallback(pc->pc, NULL); + rtcSetLocalDescriptionCallback(pc->pc, NULL); + rtcSetStateChangeCallback(pc->pc, NULL); + rtcSetGatheringStateChangeCallback(pc->pc, NULL); + rtcSetDataChannelCallback(pc->pc, NULL); + rtcDeletePeerConnection(pc->pc); + hl_remove_root(&pc->candidateCb); + hl_remove_root(&pc->datachannelCb); + hl_remove_root(&pc->descCb); + hl_remove_root(&pc->gatheringStateCb); + hl_remove_root(&pc->stateCb); +} + +void hl_rtc_datachannel_finalize(hl_rtc_datachannel* dc) +{ + rtcSetOpenCallback(dc->dc, NULL); + rtcSetClosedCallback(dc->dc, NULL); + rtcSetErrorCallback(dc->dc, NULL); + rtcSetMessageCallback(dc->dc, NULL); + rtcSetBufferedAmountLowCallback(dc->dc, NULL); + rtcDeleteDataChannel(dc->dc); + hl_remove_root(&dc->bufferLowCb); + hl_remove_root(&dc->closedCb); + hl_remove_root(&dc->errCb); + hl_remove_root(&dc->msgCb); + hl_remove_root(&dc->openCb); +} + +static void RTC_API descriptionCallback(int pc, const char* sdp, const char* type, void* ptr); +static void RTC_API candidateCallback(int pc, const char* cand, const char* mid, void* ptr); +static void RTC_API stateChangeCallback(int pc, rtcState state, void* ptr); +static void RTC_API gatheringStateCallback(int pc, rtcGatheringState state, void* ptr); +static void RTC_API openCallback(int id, void* ptr); +static void RTC_API closedCallback(int id, void* ptr); +static void RTC_API errorCallback(int id, const char*, void* ptr); +static void RTC_API messageCallback(int id, const char* message, int size, void* ptr); +static void RTC_API bufferedAmountLowCallback(int id, void* ptr); +static void RTC_API dataChannelCallback(int pc, int dc, void* ptr); + +hl_rtc_datachannel* hl_rtc_make_datachannel(int dc) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)hl_gc_alloc_finalizer(sizeof(hl_rtc_datachannel)); + hldc->finalize = hl_rtc_datachannel_finalize; + hldc->dc = dc; + hldc->openCb = NULL; + hldc->closedCb = NULL; + hldc->errCb = NULL; + hldc->msgCb = NULL; + hldc->bufferLowCb = NULL; + hl_add_root(&hldc->bufferLowCb); + hl_add_root(&hldc->closedCb); + hl_add_root(&hldc->errCb); + hl_add_root(&hldc->msgCb); + hl_add_root(&hldc->openCb); + rtcSetUserPointer(dc, hldc); // It gets messed up so we need to re-set it + rtcSetOpenCallback(dc, openCallback); + rtcSetClosedCallback(dc, closedCallback); + rtcSetErrorCallback(dc, errorCallback); + rtcSetMessageCallback(dc, messageCallback); + rtcSetBufferedAmountLowCallback(dc, bufferedAmountLowCallback); + return hldc; +} + +#define _TPC _ABSTRACT(hl_rtc_peerconnection) +#define _TDC _ABSTRACT(hl_rtc_datachannel) + +HL_PRIM void HL_NAME(initialize)() +{ + if (callback_result_mutex == NULL) + { + callback_result_mutex = hl_mutex_alloc(false); + hl_add_root(&callback_result_mutex); + } + + if (callback_result_semaphore == NULL) + { + callback_result_semaphore = hl_semaphore_alloc(0); + hl_add_root(&callback_result_semaphore); + } + + if (datachannel_callbacks_semaphore == NULL) + { + datachannel_callbacks_semaphore = hl_semaphore_alloc(0); + hl_add_root(&datachannel_callbacks_semaphore); + } +} + +HL_PRIM void HL_NAME(finalize)() +{ + if (callback_result_mutex != NULL) + { + hl_remove_root(&callback_result_mutex); + hl_mutex_free(callback_result_mutex); + callback_result_mutex = NULL; + } + + if (callback_result_semaphore != NULL) + { + hl_remove_root(&callback_result_semaphore); + hl_semaphore_free(callback_result_semaphore); + callback_result_semaphore = NULL; + } + + if (datachannel_callbacks_semaphore != NULL) + { + hl_remove_root(&datachannel_callbacks_semaphore); + hl_semaphore_free(datachannel_callbacks_semaphore); + datachannel_callbacks_semaphore = NULL; + } +} + +HL_PRIM hl_rtc_peerconnection* HL_NAME(create_peer_connection)(varray* iceServers, vstring* bindAddress, int portBegin, int portEnd, int mtu, int maxMessageSize) +{ + rtcConfiguration conf; + memset(&conf, 0, sizeof(conf)); + const char** iceServersMem = (const char**)hl_gc_alloc_raw(sizeof(char*) * iceServers->size); + for (int i = 0; i < iceServers->size; i++) { + vbyte* iceServer = hl_aptr(iceServers, vbyte*)[i]; + iceServersMem[i] = (char*)iceServer; + } + conf.iceServers = iceServersMem; + conf.iceServersCount = iceServers->size; + conf.bindAddress = hl_to_utf8(bindAddress->bytes); + conf.portRangeBegin = portBegin; + conf.portRangeEnd = portEnd; + conf.mtu = mtu; + conf.maxMessageSize = maxMessageSize; + int pc = rtcCreatePeerConnection(&conf); + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)hl_gc_alloc_finalizer(sizeof(hl_rtc_peerconnection)); + hlpc->finalize = hl_rtc_peerconnection_finalize; + hlpc->pc = pc; + hlpc->candidateCb = NULL; + hlpc->datachannelCb = NULL; + hlpc->descCb = NULL; + hlpc->gatheringStateCb = NULL; + hlpc->stateCb = NULL; + hl_add_root(&hlpc->candidateCb); + hl_add_root(&hlpc->datachannelCb); + hl_add_root(&hlpc->descCb); + hl_add_root(&hlpc->gatheringStateCb); + hl_add_root(&hlpc->stateCb); + rtcSetUserPointer(pc, hlpc); + rtcSetLocalDescriptionCallback(pc, descriptionCallback); + rtcSetLocalCandidateCallback(pc, candidateCallback); + rtcSetStateChangeCallback(pc, stateChangeCallback); + rtcSetGatheringStateChangeCallback(pc, gatheringStateCallback); + return hlpc; +} + +HL_PRIM void HL_NAME(close_peer_connection)(hl_rtc_peerconnection* pc) +{ + rtcClosePeerConnection(pc->pc); +} + +HL_PRIM void HL_NAME(set_peer_connection_callbacks)(hl_rtc_peerconnection* pc, vclosure* descCb, vclosure* candidateCb, vclosure* stateCb, vclosure* gatheringStateCb) +{ + pc->descCb = descCb; + pc->candidateCb = candidateCb; + pc->stateCb = stateCb; + pc->gatheringStateCb = gatheringStateCb; +} + +HL_PRIM void HL_NAME(set_remote_description)(hl_rtc_peerconnection* pc, vbyte* desc, vstring* type) +{ + char* typestr = hl_to_utf8(type->bytes); + if (strcmp(typestr, "offer") == 0) { + rtcSetRemoteDescription(pc->pc, (const char*)desc, "offer"); + } + if (strcmp(typestr, "answer") == 0) { + rtcSetRemoteDescription(pc->pc, (const char*)desc, "answer"); + } +} + +HL_PRIM void HL_NAME(add_remote_candidate)(hl_rtc_peerconnection* pc, vbyte* candidate) +{ + rtcAddRemoteCandidate(pc->pc, (const char*)candidate, NULL); +} + +HL_PRIM hl_rtc_datachannel* HL_NAME(create_datachannel)(hl_rtc_peerconnection* pc, vstring* name) +{ + char* namestr = hl_to_utf8(name->bytes); + int dc = rtcCreateDataChannel(pc->pc, namestr); + return hl_rtc_make_datachannel(dc); +} + +HL_PRIM hl_rtc_datachannel* HL_NAME(create_datachannel_ex)(hl_rtc_peerconnection* pc, vstring* name, bool unordered, int maxRetransmits, int maxLifetime) +{ + char* namestr = hl_to_utf8(name->bytes); + rtcDataChannelInit dcInit; + memset(&dcInit, 0, sizeof(rtcDataChannelInit)); + dcInit.reliability.unreliable = maxLifetime != 0 || maxRetransmits != 0; + dcInit.reliability.unordered = unordered; + dcInit.reliability.maxPacketLifeTime = maxLifetime; + dcInit.reliability.maxRetransmits = maxRetransmits; + int dc = rtcCreateDataChannelEx(pc->pc, namestr, &dcInit); + return hl_rtc_make_datachannel(dc); +} + +HL_PRIM void HL_NAME(set_peerconnection_datachannel_cb)(hl_rtc_peerconnection* pc, vclosure* openCb) +{ + rtcSetDataChannelCallback(pc->pc, dataChannelCallback); + pc->datachannelCb = openCb; +} + +HL_PRIM void HL_NAME(set_datachannel_callbacks)(hl_rtc_datachannel* dc, vclosure* openCb, vclosure* closeCb, vclosure* errorCb, vclosure* msgCb, vclosure* bufferLowCb) +{ + dc->openCb = openCb; + dc->closedCb = closeCb; + dc->errCb = errorCb; + dc->msgCb = msgCb; + dc->bufferLowCb = bufferLowCb; +} + +HL_PRIM void HL_NAME(datachannel_send_message)(hl_rtc_datachannel* dc, vbyte* bytes, int len) +{ + rtcSendMessage(dc->dc, (const char*)bytes, len); +} + +HL_PRIM vdynobj* HL_NAME(get_datachannel_reliability)(hl_rtc_datachannel* dc) +{ + rtcReliability r; + rtcGetDataChannelReliability(dc->dc, &r); + vdynamic* obj = (vdynamic*)hl_alloc_dynobj(); + hl_dyn_seti(obj, hl_hash_utf8("unordered"), &hlt_bool, r.unordered); + hl_dyn_seti(obj, hl_hash_utf8("maxRetransmits"), &hlt_i32, r.maxRetransmits); + hl_dyn_seti(obj, hl_hash_utf8("maxLifetime"), &hlt_i32, r.maxPacketLifeTime); + return (vdynobj*)obj; +} + +HL_PRIM vbyte* HL_NAME(get_local_address)(hl_rtc_peerconnection* pc) +{ + char buf[256]; + int buflen = rtcGetLocalAddress(pc->pc, buf, 256); + if (buflen > 0) + { + vbyte* mem = (vbyte*)hl_gc_alloc_noptr(buflen); + memcpy(mem, buf, buflen); + return mem; + } + else + { + return NULL; + } +} + +HL_PRIM vbyte* HL_NAME(get_remote_address)(hl_rtc_peerconnection* pc) +{ + char buf[256]; + int buflen = rtcGetRemoteAddress(pc->pc, buf, 256); + if (buflen > 0) + { + vbyte* mem = (vbyte*)hl_gc_alloc_noptr(buflen); + memcpy(mem, buf, buflen); + return mem; + } + else + { + return NULL; + } +} + +HL_PRIM vbyte* HL_NAME(get_local_description)(hl_rtc_peerconnection* pc) +{ + char buf[16384]; + int buflen = rtcGetLocalDescription(pc->pc, buf, 16384); + if (buflen > 0) + { + vbyte* mem = (vbyte*)hl_gc_alloc_noptr(buflen); + memcpy(mem, buf, buflen); + return mem; + } + else + { + return NULL; + } +} + +HL_PRIM int HL_NAME(get_buffered_amount)(hl_rtc_datachannel* dc) +{ + return rtcGetBufferedAmount(dc->dc); +} + +HL_PRIM void HL_NAME(set_buffered_amount_low_threshold)(hl_rtc_datachannel* dc, int amt) +{ + rtcSetBufferedAmountLowThreshold(dc->dc, amt); +} + +HL_PRIM void HL_NAME(process_events)() +{ + while (true) + { + datachannel_callback* res = NULL; + hl_mutex_acquire(callback_result_mutex); + if (datachannel_callbacks != NULL) + { + res = datachannel_callbacks; + datachannel_callbacks = datachannel_callbacks->next; + if (datachannel_callbacks == NULL) + datachannel_callbacks_end = NULL; + } + hl_mutex_release(callback_result_mutex); + + if (res == NULL) + break; + + hl_rtc_datachannel* hldc = hl_rtc_make_datachannel(res->dc); + + vdynamic* args[2]; + vdynamic pcarg; + pcarg.t = res->pc->datachannelCb->t->fun->args[0]; // same type as hl_rtc_datachannel + pcarg.v.ptr = hldc; + args[0] = &pcarg; + + char buffer[256]; + if (rtcGetDataChannelLabel(hldc->dc, buffer, 256) >= 0) + { + vdynamic arg; + arg.t = &hlt_bytes; + arg.v.bytes = (vbyte*)hl_gc_alloc_noptr(256); + memcpy(arg.v.bytes, buffer, 256); + + args[1] = &arg; + hl_dyn_call(res->pc->datachannelCb, args, 2); + } + else + { + vdynamic arg; + arg.t = &hlt_bytes; + arg.v.bytes = (vbyte*)hl_gc_alloc_noptr(8); + memcpy(arg.v.bytes, "unnamed", 8); + + args[1] = &arg; + hl_dyn_call(res->pc->datachannelCb, args, 2); + } + + free(res); + } + + // Regular callbacks: one semaphore token per queued item. + while (true) + { + if (!hl_semaphore_try_acquire(callback_result_semaphore, NULL)) + break; + + callback_result* res = NULL; + hl_mutex_acquire(callback_result_mutex); + if (callback_results != NULL) + { + res = callback_results; + callback_results = callback_results->next; + if (callback_results == NULL) + callback_results_end = NULL; + } + hl_mutex_release(callback_result_mutex); + + if (res == NULL) + break; + + vdynamic* args[2]; + vdynamic arg1 = res->arg1; + vdynamic arg2 = res->arg2; + if (res->args >= 1 && res->arg1.t == &hlt_bytes) + { + arg1.v.bytes = (vbyte*)hl_gc_alloc_noptr(res->arg1Size); + memcpy(arg1.v.bytes, res->arg1.v.bytes, res->arg1Size); + free(res->arg1.v.bytes); + } + if (res->args >= 2 && res->arg2.t == &hlt_bytes) + { + arg2.v.bytes = (vbyte*)hl_gc_alloc_noptr(res->arg2Size); + memcpy(arg2.v.bytes, res->arg2.v.bytes, res->arg2Size); + free(res->arg2.v.bytes); + } + + if (res->closure != NULL) + { + switch (res->args) + { + case 0: + hl_dyn_call(*res->closure, NULL, 0); + break; + + case 1: + args[0] = &arg1; + hl_dyn_call(*res->closure, args, 1); + break; + + case 2: + args[0] = &arg1; + args[1] = &arg2; + hl_dyn_call(*res->closure, args, 2); + break; + } + } + + free(res); + } +} + +static void RTC_API descriptionCallback(int pc, const char* sdp, const char* type, void* ptr) +{ + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)ptr; + + int sdpLen = strlen(sdp); + vbyte* b1 = (vbyte*)malloc(sdpLen + 1); // hl_gc_alloc_noptr(sdpLen + 1); + memcpy(b1, sdp, sdpLen); + b1[sdpLen] = '\0'; + + int typeLen = strlen(type); + vbyte* b2 = (vbyte*)malloc(typeLen + 1); // hl_gc_alloc_noptr(typeLen + 1); + memcpy(b2, type, typeLen); + b2[typeLen] = '\0'; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = b1; + res->arg2.t = &hlt_bytes; + res->arg2.v.bytes = b2; + res->closure = &hlpc->descCb; + res->args = 2; + res->arg1Size = sdpLen + 1; + res->arg2Size = typeLen + 1; + res->callback_name = "onDescription"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API candidateCallback(int pc, const char* cand, const char* mid, void* ptr) +{ + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)ptr; + + int sdpLen = strlen(cand); + vbyte* b1 = (vbyte*)malloc(sdpLen + 1); // hl_gc_alloc_noptr(sdpLen + 1); + memcpy(b1, cand, sdpLen); + b1[sdpLen] = '\0'; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = b1; + res->closure = &hlpc->candidateCb; + res->args = 1; + res->arg1Size = sdpLen + 1; + res->callback_name = "onCandidate"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API stateChangeCallback(int pc, rtcState state, void* ptr) +{ + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)ptr; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_i32; + res->arg1.v.i = state; + res->closure = &hlpc->stateCb; + res->args = 1; + res->callback_name = "onStateChange"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API gatheringStateCallback(int pc, rtcGatheringState state, void* ptr) +{ + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)ptr; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_i32; + res->arg1.v.i = state; + res->closure = &hlpc->gatheringStateCb; + res->args = 1; + res->callback_name = "onGatheringStateChange"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API openCallback(int id, void* ptr) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)ptr; + if (hldc->openCb == NULL) return; + char buffer[256]; + if (rtcGetDataChannelLabel(hldc->dc, buffer, 256) >= 0) + { + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = (vbyte*)malloc(256); + memcpy(res->arg1.v.bytes, buffer, 256); + res->arg1Size = 256; + res->closure = &hldc->openCb; + res->args = 1; + res->callback_name = "onOpen"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); + } + else + { + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = (vbyte*)malloc(8); + memcpy(res->arg1.v.bytes, "unnamed", 8); + res->arg1Size = 8; + res->closure = &hldc->openCb; + res->args = 1; + res->callback_name = "onOpen"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); + } +} + +static void RTC_API closedCallback(int id, void* ptr) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)ptr; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->closure = &hldc->closedCb; + res->args = 0; + res->callback_name = "onClose"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API errorCallback(int id, const char* error, void* ptr) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)ptr; + int errorlen = strlen(error); + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = (vbyte*)malloc(errorlen + 1); + memcpy(res->arg1.v.bytes, error, errorlen); + res->arg1.v.bytes[errorlen] = '\0'; + res->arg1Size = errorlen + 1; + res->closure = &hldc->errCb; + res->args = 1; + res->callback_name = "onError"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +static void RTC_API messageCallback(int id, const char* message, int size, void* ptr) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)ptr; + + if (size < 0) // negative size indicates a null-terminated string + { + int len = strlen(message); + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = (vbyte*)malloc(len + 1); + memcpy(res->arg1.v.bytes, message, len); + res->arg1.v.bytes[len] = '\0'; + res->arg1Size = len + 1; + res->arg2.t = &hlt_i32; + res->arg2.v.i = len + 1; + res->closure = &hldc->msgCb; + res->args = 2; + res->callback_name = "onMessage"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); + } + else + { + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->arg1.t = &hlt_bytes; + res->arg1.v.bytes = (vbyte*)malloc(size); + memcpy(res->arg1.v.bytes, message, size); + res->arg1Size = size; + res->arg2.t = &hlt_i32; + res->arg2.v.i = size; + res->closure = &hldc->msgCb; + res->args = 2; + res->callback_name = "onMessage"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); + } +} + +static void RTC_API dataChannelCallback(int pc, int dc, void* ptr) +{ + hl_rtc_peerconnection* hlpc = (hl_rtc_peerconnection*)ptr; + + + hl_mutex_acquire(callback_result_mutex); + datachannel_callback* res = datachannel_callback_alloc(); + res->dc = dc; + res->pc = hlpc; + hl_mutex_release(callback_result_mutex); +} + +static void RTC_API bufferedAmountLowCallback(int dc, void* ptr) +{ + hl_rtc_datachannel* hldc = (hl_rtc_datachannel*)ptr; + + hl_mutex_acquire(callback_result_mutex); + callback_result* res = callback_result_alloc(); + res->closure = &hldc->bufferLowCb; + res->args = 0; + res->callback_name = "onBufferLow"; + hl_mutex_release(callback_result_mutex); + hl_semaphore_release(callback_result_semaphore); +} + +DEFINE_PRIM(_VOID, initialize, _NO_ARG); +DEFINE_PRIM(_VOID, finalize, _NO_ARG); +DEFINE_PRIM(_VOID, process_events, _NO_ARG); +DEFINE_PRIM(_TPC, create_peer_connection, _ARR _STRING _I32 _I32 _I32 _I32); +DEFINE_PRIM(_VOID, close_peer_connection, _TPC); +DEFINE_PRIM(_VOID, set_peer_connection_callbacks, _TPC _FUN(_VOID, _BYTES _BYTES) _FUN(_VOID, _BYTES) _FUN(_VOID, _I32) _FUN(_VOID, _I32)); +DEFINE_PRIM(_VOID, set_remote_description, _TPC _BYTES _STRING); +DEFINE_PRIM(_VOID, add_remote_candidate, _TPC _BYTES); +DEFINE_PRIM(_TDC, create_datachannel, _TPC _STRING); +DEFINE_PRIM(_TDC, create_datachannel_ex, _TPC _STRING _BOOL _I32 _I32); +DEFINE_PRIM(_VOID, set_peerconnection_datachannel_cb, _TPC _FUN(_VOID, _TDC _BYTES)); +DEFINE_PRIM(_VOID, set_datachannel_callbacks, _TDC _FUN(_VOID, _BYTES) _FUN(_VOID, _NO_ARG) _FUN(_VOID, _BYTES) _FUN(_VOID, _BYTES _I32) _FUN(_VOID, _NO_ARG)); +DEFINE_PRIM(_VOID, datachannel_send_message, _TDC _BYTES _I32); +DEFINE_PRIM(_DYN, get_datachannel_reliability, _TDC); +DEFINE_PRIM(_BYTES, get_local_address, _TPC); +DEFINE_PRIM(_BYTES, get_remote_address, _TPC); +DEFINE_PRIM(_BYTES, get_local_description, _TPC); +DEFINE_PRIM(_I32, get_buffered_amount, _TDC); +DEFINE_PRIM(_VOID, set_buffered_amount_low_threshold, _TDC _I32) \ No newline at end of file diff --git a/lib/datachannel/cpp/src/ssl3.c b/lib/datachannel/cpp/src/ssl3.c new file mode 100644 index 00000000..a010120b --- /dev/null +++ b/lib/datachannel/cpp/src/ssl3.c @@ -0,0 +1,763 @@ +#define HL_NAME(n) ssl_##n + +#define _WINSOCKAPI_ +#include +#ifdef HL_WIN +#include +#include +#else +#include +#include +#include +typedef int SOCKET; +#endif + +#include +#include + +#ifdef HL_MAC +#include +#endif + +#define SOCKET_ERROR (-1) +#define NRETRYS 20 + +#include "mbedtls/platform.h" +#include "mbedtls/error.h" +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" +#include "mbedtls/md.h" +#include "mbedtls/pk.h" +#include "mbedtls/oid.h" +#include "mbedtls/x509_crt.h" +#include "mbedtls/ssl.h" + +#ifdef HL_CONSOLE +mbedtls_x509_crt *hl_init_cert_chain(); +#endif + +#if defined(HL_WIN) || defined(HL_MAC) || defined(HL_IOS) || defined(HL_TVOS) +# define MSG_NOSIGNAL 0 +#endif + +// Duplicate from socket.c +typedef struct _hl_socket { + SOCKET sock; +} hl_socket; + +typedef struct _hl_ssl_cert hl_ssl_cert; +struct _hl_ssl_cert { + void(*finalize)(hl_ssl_cert *); + mbedtls_x509_crt *c; +}; + +typedef struct _hl_ssl_pkey hl_ssl_pkey; +struct _hl_ssl_pkey { + void(*finalize)(hl_ssl_pkey *); + mbedtls_pk_context *k; +}; + +#define _SOCK _ABSTRACT(hl_socket) +#define TSSL _ABSTRACT(mbedtls_ssl_context) +#define TCONF _ABSTRACT(mbedtls_ssl_config) +#define TCERT _ABSTRACT(hl_ssl_cert) +#define TPKEY _ABSTRACT(hl_ssl_pkey) + +static bool ssl_init_done = false; +static mbedtls_entropy_context entropy; +static mbedtls_ctr_drbg_context ctr_drbg; + +static bool is_ssl_blocking( int r ) { + return r == MBEDTLS_ERR_SSL_WANT_READ || r == MBEDTLS_ERR_SSL_WANT_WRITE; +} + +static int ssl_block_error( int r ) { + return is_ssl_blocking(r) ? -1 : -2; +} + +static void cert_finalize(hl_ssl_cert *c) { + mbedtls_x509_crt_free(c->c); + free(c->c); + c->c = NULL; +} + +static void pkey_finalize(hl_ssl_pkey *k) { + mbedtls_pk_free(k->k); + free(k->k); + k->k = NULL; +} + +static int ssl_error(int ret) { + char buf[128]; + uchar buf16[128]; + mbedtls_strerror(ret, buf, sizeof(buf)); + hl_from_utf8(buf16, (int)strlen(buf), buf); + hl_error("%s",buf16); + return ret; +} + +HL_PRIM mbedtls_ssl_context *HL_NAME(ssl_new)(mbedtls_ssl_config *config) { + int ret; + mbedtls_ssl_context *ssl; + ssl = (mbedtls_ssl_context *)hl_gc_alloc_noptr(sizeof(mbedtls_ssl_context)); + mbedtls_ssl_init(ssl); + if ((ret = mbedtls_ssl_setup(ssl, config)) != 0) { + mbedtls_ssl_free(ssl); + ssl_error(ret); + return NULL; + } + return ssl; +} + +HL_PRIM void HL_NAME(ssl_close)(mbedtls_ssl_context *ssl) { + mbedtls_ssl_free(ssl); +} + +HL_PRIM int HL_NAME(ssl_handshake)(mbedtls_ssl_context *ssl) { + int r; + r = mbedtls_ssl_handshake(ssl); + if( is_ssl_blocking(r) ) + return -1; + if( r == MBEDTLS_ERR_SSL_CONN_EOF ) + return -2; + if( r != 0 ) + return ssl_error(r); + return 0; +} + + +static bool is_block_error() { +#ifdef HL_WIN + int err = WSAGetLastError(); + if (err == WSAEWOULDBLOCK || err == WSAEALREADY || err == WSAETIMEDOUT) +#else + if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINPROGRESS || errno == EALREADY) +#endif + return true; + return false; +} + +static int net_read(void *fd, unsigned char *buf, size_t len) { + int r = recv((SOCKET)(int_val)fd, (char *)buf, (int)len, MSG_NOSIGNAL); + if( r == SOCKET_ERROR && is_block_error() ) + return MBEDTLS_ERR_SSL_WANT_READ; + return r; +} + +static int net_write(void *fd, const unsigned char *buf, size_t len) { + int r = send((SOCKET)(int_val)fd, (char *)buf, (int)len, MSG_NOSIGNAL); + if( r == SOCKET_ERROR && is_block_error() ) + return MBEDTLS_ERR_SSL_WANT_WRITE; + return r; +} + +HL_PRIM void HL_NAME(ssl_set_socket)(mbedtls_ssl_context *ssl, hl_socket *socket) { + mbedtls_ssl_set_bio(ssl, (void*)(int_val)socket->sock, net_write, net_read, NULL); +} + +static int arr_read( void *arr, unsigned char *buf, size_t len ) { + int r = ((int (*)(vdynamic*,unsigned char*,int))hl_aptr(arr,vclosure*)[1]->fun)( hl_aptr(arr,vdynamic*)[0], buf, (int)len ); + if( r == -2 ) return MBEDTLS_ERR_SSL_WANT_READ; + return r; +} + +static int arr_write( void *arr, const unsigned char *buf, size_t len ) { + int r = ((int (*)(vdynamic*,const unsigned char*,int))hl_aptr(arr,vclosure*)[2]->fun)( hl_aptr(arr,vdynamic*)[0], buf, (int)len ); + if( r == -2 ) return MBEDTLS_ERR_SSL_WANT_WRITE; + return r; +} + +HL_PRIM void HL_NAME(ssl_set_bio)( mbedtls_ssl_context *ssl, varray *ctx ) { + mbedtls_ssl_set_bio(ssl, ctx, arr_write, arr_read, NULL); +} + +HL_PRIM void HL_NAME(ssl_set_hostname)(mbedtls_ssl_context *ssl, vbyte *hostname) { + int ret; + if ((ret = mbedtls_ssl_set_hostname(ssl, (char*)hostname)) != 0) + ssl_error(ret); +} + +HL_PRIM hl_ssl_cert *HL_NAME(ssl_get_peer_certificate)(mbedtls_ssl_context *ssl) { + hl_ssl_cert *cert = (hl_ssl_cert*)hl_gc_alloc_noptr(sizeof(hl_ssl_cert)); + cert->c = (mbedtls_x509_crt*)mbedtls_ssl_get_peer_cert(ssl); + return cert; +} + +DEFINE_PRIM(TSSL, ssl_new, TCONF); +DEFINE_PRIM(_VOID, ssl_close, TSSL); +DEFINE_PRIM(_I32, ssl_handshake, TSSL); +DEFINE_PRIM(_VOID, ssl_set_bio, TSSL _DYN); +DEFINE_PRIM(_VOID, ssl_set_socket, TSSL _SOCK); +DEFINE_PRIM(_VOID, ssl_set_hostname, TSSL _BYTES); +DEFINE_PRIM(TCERT, ssl_get_peer_certificate, TSSL); + +HL_PRIM int HL_NAME(ssl_send_char)(mbedtls_ssl_context *ssl, int c) { + unsigned char cc; + int r; + cc = (unsigned char)c; + r = mbedtls_ssl_write(ssl, &cc, 1); + if( r < 0 ) + return ssl_block_error(r); + return 1; +} + +HL_PRIM int HL_NAME(ssl_send)(mbedtls_ssl_context *ssl, vbyte *buf, int pos, int len) { + int r = mbedtls_ssl_write(ssl, (const unsigned char *)buf + pos, len); + if( r < 0 ) + return ssl_block_error(r); + return r; +} + +HL_PRIM int HL_NAME(ssl_recv_char)(mbedtls_ssl_context *ssl) { + unsigned char c; + int ret = mbedtls_ssl_read(ssl, &c, 1); + if( ret != 1 ) + return ssl_block_error(ret); + return c; +} + +HL_PRIM int HL_NAME(ssl_recv)(mbedtls_ssl_context *ssl, vbyte *buf, int pos, int len) { + int ret = mbedtls_ssl_read(ssl, (unsigned char*)buf+pos, len); + if( ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY ) + return 0; + if( ret < 0 ) + return ssl_block_error(ret); + return ret; +} + +DEFINE_PRIM(_I32, ssl_send_char, TSSL _I32); +DEFINE_PRIM(_I32, ssl_send, TSSL _BYTES _I32 _I32); +DEFINE_PRIM(_I32, ssl_recv_char, TSSL); +DEFINE_PRIM(_I32, ssl_recv, TSSL _BYTES _I32 _I32); + +HL_PRIM mbedtls_ssl_config *HL_NAME(conf_new)(bool server) { + int ret; + mbedtls_ssl_config *conf; + conf = (mbedtls_ssl_config *)hl_gc_alloc_noptr(sizeof(mbedtls_ssl_config)); + mbedtls_ssl_config_init(conf); + if ((ret = mbedtls_ssl_config_defaults(conf, server ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, + MBEDTLS_SSL_TRANSPORT_STREAM, 0)) != 0) { + mbedtls_ssl_config_free(conf); + ssl_error(ret); + return NULL; + } + mbedtls_ssl_conf_rng(conf, mbedtls_ctr_drbg_random, &ctr_drbg); + return conf; +} + +HL_PRIM void HL_NAME(conf_close)(mbedtls_ssl_config *conf) { + mbedtls_ssl_config_free(conf); +} + +HL_PRIM void HL_NAME(conf_set_ca)(mbedtls_ssl_config *conf, hl_ssl_cert *cert) { + mbedtls_ssl_conf_ca_chain(conf, cert->c, NULL); +} + +HL_PRIM void HL_NAME(conf_set_verify)(mbedtls_ssl_config *conf, int mode) { + if (mode == 2) + mbedtls_ssl_conf_authmode(conf, MBEDTLS_SSL_VERIFY_OPTIONAL); + else if (mode == 1) + mbedtls_ssl_conf_authmode(conf, MBEDTLS_SSL_VERIFY_REQUIRED); + else + mbedtls_ssl_conf_authmode(conf, MBEDTLS_SSL_VERIFY_NONE); +} + +HL_PRIM void HL_NAME(conf_set_cert)(mbedtls_ssl_config *conf, hl_ssl_cert *cert, hl_ssl_pkey *key) { + int r; + if ((r = mbedtls_ssl_conf_own_cert(conf, cert->c, key->k)) != 0) + ssl_error(r); +} + +typedef struct { + hl_type *t; + hl_ssl_cert *cert; + hl_ssl_pkey *key; +} sni_callb_ret; + +static int sni_callback(void *arg, mbedtls_ssl_context *ctx, const unsigned char *name, size_t len) { + if (name && arg) { + vclosure *c = (vclosure*)arg; + sni_callb_ret *ret; + if( c->hasValue ) + ret = ((sni_callb_ret*(*)(void*, vbyte*))c->fun)(c->value, (vbyte*)name); + else + ret = ((sni_callb_ret*(*)(vbyte*))c->fun)((vbyte*)name); + if (ret && ret->cert && ret->key) { + return mbedtls_ssl_set_hs_own_cert(ctx, ret->cert->c, ret->key->k); + } + } + return -1; +} + +HL_PRIM void HL_NAME(conf_set_servername_callback)(mbedtls_ssl_config *conf, vclosure *cb) { + mbedtls_ssl_conf_sni(conf, sni_callback, (void *)cb); +} + + +DEFINE_PRIM(TCONF, conf_new, _BOOL); +DEFINE_PRIM(_VOID, conf_close, TCONF); +DEFINE_PRIM(_VOID, conf_set_ca, TCONF TCERT); +DEFINE_PRIM(_VOID, conf_set_verify, TCONF _I32); +DEFINE_PRIM(_VOID, conf_set_cert, TCONF TCERT TPKEY); +DEFINE_PRIM(_VOID, conf_set_servername_callback, TCONF _FUN(_OBJ(TCERT TPKEY), _BYTES)); + +HL_PRIM hl_ssl_cert *HL_NAME(cert_load_file)(vbyte *file) { +#ifdef HL_CONSOLE + return NULL; +#else + int r; + hl_ssl_cert *cert; + mbedtls_x509_crt *x = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(x); + if ((r = mbedtls_x509_crt_parse_file(x, (char*)file)) != 0) { + mbedtls_x509_crt_free(x); + free(x); + ssl_error(r); + return NULL; + } + cert = (hl_ssl_cert*)hl_gc_alloc_finalizer(sizeof(hl_ssl_cert)); + cert->c = x; + cert->finalize = cert_finalize; + return cert; +#endif +} + +HL_PRIM hl_ssl_cert *HL_NAME(cert_load_path)(vbyte *path) { +#ifdef HL_CONSOLE + return NULL; +#else + int r; + hl_ssl_cert *cert; + mbedtls_x509_crt *x = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(x); + if ((r = mbedtls_x509_crt_parse_path(x, (char*)path)) != 0) { + mbedtls_x509_crt_free(x); + free(x); + ssl_error(r); + return NULL; + } + cert = (hl_ssl_cert*)hl_gc_alloc_finalizer(sizeof(hl_ssl_cert)); + cert->c = x; + cert->finalize = cert_finalize; + return cert; +#endif +} + +HL_PRIM hl_ssl_cert *HL_NAME(cert_load_defaults)() { + hl_ssl_cert *v = NULL; + mbedtls_x509_crt *chain = NULL; +#if defined(HL_WIN) + HCERTSTORE store; + PCCERT_CONTEXT cert; + + if (store = CertOpenSystemStore(0, (LPCWSTR)L"Root")) { + cert = NULL; + while (cert = CertEnumCertificatesInStore(store, cert)) { + if (chain == NULL) { + chain = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(chain); + } + mbedtls_x509_crt_parse_der(chain, (unsigned char *)cert->pbCertEncoded, cert->cbCertEncoded); + } + CertCloseStore(store, 0); + } +#elif defined(HL_MAC) + CFMutableDictionaryRef search; + CFArrayRef result; + SecKeychainRef keychain; + SecCertificateRef item; + CFDataRef dat; + // Load keychain + if (SecKeychainOpen("/System/Library/Keychains/SystemRootCertificates.keychain", &keychain) != errSecSuccess) + return NULL; + + // Search for certificates + search = CFDictionaryCreateMutable(NULL, 0, NULL, NULL); + CFDictionarySetValue(search, kSecClass, kSecClassCertificate); + CFDictionarySetValue(search, kSecMatchLimit, kSecMatchLimitAll); + CFDictionarySetValue(search, kSecReturnRef, kCFBooleanTrue); + CFDictionarySetValue(search, kSecMatchSearchList, CFArrayCreate(NULL, (const void **)&keychain, 1, NULL)); + if (SecItemCopyMatching(search, (CFTypeRef *)&result) == errSecSuccess) { + CFIndex n = CFArrayGetCount(result); + for (CFIndex i = 0; i < n; i++) { + item = (SecCertificateRef)CFArrayGetValueAtIndex(result, i); + + // Get certificate in DER format + dat = SecCertificateCopyData(item); + if (dat) { + if (chain == NULL) { + chain = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(chain); + } + mbedtls_x509_crt_parse_der(chain, (unsigned char *)CFDataGetBytePtr(dat), CFDataGetLength(dat)); + CFRelease(dat); + } + } + } + CFRelease(keychain); +#elif defined(HL_CONSOLE) + chain = hl_init_cert_chain(); +#endif + if (chain != NULL) { + v = (hl_ssl_cert*)hl_gc_alloc_finalizer(sizeof(hl_ssl_cert)); + v->c = chain; + v->finalize = cert_finalize; + } + return v; +} + +static vbyte *asn1_buf_to_string(mbedtls_asn1_buf *dat) { + unsigned int i, c; + hl_buffer *buf = hl_alloc_buffer(); + for (i = 0; i < dat->len; i++) { + c = dat->p[i]; + if (c < 32 || c == 127 || (c > 128 && c < 160)) + hl_buffer_char(buf, '?'); + else + hl_buffer_char(buf, c); + } + return (vbyte*)hl_buffer_content(buf,NULL); +} + +HL_PRIM vbyte *HL_NAME(cert_get_subject)(hl_ssl_cert *cert, vbyte *objname) { + mbedtls_x509_name *obj; + int r; + const char *oname, *rname; + obj = &cert->c->subject; + if (obj == NULL) + hl_error("Invalid subject"); + rname = (char*)objname; + while (obj != NULL) { + r = mbedtls_oid_get_attr_short_name(&obj->oid, &oname); + if (r == 0 && strcmp(oname, rname) == 0) + return asn1_buf_to_string(&obj->val); + obj = obj->next; + } + return NULL; +} + +HL_PRIM vbyte *HL_NAME(cert_get_issuer)(hl_ssl_cert *cert, vbyte *objname) { + mbedtls_x509_name *obj; + int r; + const char *oname, *rname; + obj = &cert->c->issuer; + if (obj == NULL) + hl_error("Invalid issuer"); + rname = (char*)objname; + while (obj != NULL) { + r = mbedtls_oid_get_attr_short_name(&obj->oid, &oname); + if (r == 0 && strcmp(oname, rname) == 0) + return asn1_buf_to_string(&obj->val); + obj = obj->next; + } + return NULL; +} + +HL_PRIM varray *HL_NAME(cert_get_altnames)(hl_ssl_cert *cert) { + mbedtls_asn1_sequence *cur; + int count = 0; + int pos = 0; + varray *a = NULL; + vbyte **current = NULL; + mbedtls_x509_crt *crt = cert->c; + if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) { + cur = &crt->subject_alt_names; + while (cur != NULL) { + if (pos == count) { + int ncount = count == 0 ? 16 : count * 2; + varray *narr = hl_alloc_array(&hlt_bytes, ncount); + vbyte **ncur = hl_aptr(narr, vbyte*); + memcpy(ncur, current, count * sizeof(void*)); + current = ncur; + a = narr; + count = ncount; + } + current[pos++] = asn1_buf_to_string(&cur->buf); + cur = cur->next; + } + } + if (a == NULL) a = hl_alloc_array(&hlt_bytes, 0); + a->size = pos; + return a; +} + +static varray *x509_time_to_array(mbedtls_x509_time *t) { + varray *a = NULL; + int *p; + if (!t) + hl_error("Invalid x509 time"); + a = hl_alloc_array(&hlt_i32, 6); + p = hl_aptr(a, int); + p[0] = t->year; + p[1] = t->mon; + p[2] = t->day; + p[3] = t->hour; + p[4] = t->min; + p[5] = t->sec; + return a; +} + +HL_PRIM varray *HL_NAME(cert_get_not_before)(hl_ssl_cert *cert) { + return x509_time_to_array(&cert->c->valid_from); +} + +HL_PRIM varray *HL_NAME(cert_get_notafter)(hl_ssl_cert *cert) { + return x509_time_to_array(&cert->c->valid_to); +} + +HL_PRIM hl_ssl_cert *HL_NAME(cert_get_next)(hl_ssl_cert *cert) { + hl_ssl_cert *ncert; + if (cert->c->next == NULL) + return NULL; + ncert = (hl_ssl_cert*)hl_gc_alloc_noptr(sizeof(hl_ssl_cert)); + ncert->c = cert->c->next; + return ncert; +} + +HL_PRIM hl_ssl_cert *HL_NAME(cert_add_pem)(hl_ssl_cert *cert, vbyte *data) { + mbedtls_x509_crt *crt; + int r, len; + unsigned char *buf; + if (cert != NULL) + crt = cert->c; + else{ + crt = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(crt); + } + len = (int)strlen((char*)data) + 1; + buf = (unsigned char *)malloc(len); + memcpy(buf, (char*)data, len - 1); + buf[len - 1] = '\0'; + r = mbedtls_x509_crt_parse(crt, buf, len); + free(buf); + if (r < 0) { + if (cert == NULL) { + mbedtls_x509_crt_free(crt); + free(crt); + } + ssl_error(r); + return NULL; + } + if (cert == NULL) { + cert = (hl_ssl_cert*)hl_gc_alloc_finalizer(sizeof(hl_ssl_cert)); + cert->c = crt; + cert->finalize = cert_finalize; + } + return cert; +} + +HL_PRIM hl_ssl_cert *HL_NAME(cert_add_der)(hl_ssl_cert *cert, vbyte *data, int len) { + mbedtls_x509_crt *crt; + int r; + if (cert != NULL) + crt = cert->c; + else { + crt = (mbedtls_x509_crt*)malloc(sizeof(mbedtls_x509_crt)); + mbedtls_x509_crt_init(crt); + } + if ((r = mbedtls_x509_crt_parse_der(crt, (const unsigned char*)data, len)) < 0) { + if (cert == NULL) { + mbedtls_x509_crt_free(crt); + free(crt); + } + ssl_error(r); + return NULL; + } + if (cert == NULL) { + cert = (hl_ssl_cert*)hl_gc_alloc_finalizer(sizeof(hl_ssl_cert)); + cert->c = crt; + cert->finalize = cert_finalize; + } + return cert; +} + + +DEFINE_PRIM(TCERT, cert_load_defaults, _NO_ARG); +DEFINE_PRIM(TCERT, cert_load_file, _BYTES); +DEFINE_PRIM(TCERT, cert_load_path, _BYTES); +DEFINE_PRIM(_BYTES, cert_get_subject, TCERT _BYTES); +DEFINE_PRIM(_BYTES, cert_get_issuer, TCERT _BYTES); +DEFINE_PRIM(_ARR, cert_get_altnames, TCERT); +DEFINE_PRIM(_ARR, cert_get_not_before, TCERT); +DEFINE_PRIM(_ARR, cert_get_notafter, TCERT); +DEFINE_PRIM(TCERT, cert_get_next, TCERT); +DEFINE_PRIM(TCERT, cert_add_pem, TCERT _BYTES); +DEFINE_PRIM(TCERT, cert_add_der, TCERT _BYTES _I32); + + +HL_PRIM hl_ssl_pkey *HL_NAME(key_from_der)(vbyte *data, int len, bool pub) { + int r; + hl_ssl_pkey *key; + mbedtls_pk_context *pk = (mbedtls_pk_context *)malloc(sizeof(mbedtls_pk_context)); + mbedtls_pk_init(pk); + if (pub) + r = mbedtls_pk_parse_public_key(pk, (const unsigned char*)data, len); + else + r = mbedtls_pk_parse_key(pk, (const unsigned char*)data, len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg); + if (r != 0) { + mbedtls_pk_free(pk); + free(pk); + ssl_error(r); + return NULL; + } + key = (hl_ssl_pkey*)hl_gc_alloc_finalizer(sizeof(hl_ssl_pkey)); + key->k = pk; + key->finalize = pkey_finalize; + return key; +} + +HL_PRIM hl_ssl_pkey *HL_NAME(key_from_pem)(vbyte *data, bool pub, vbyte *pass) { + int r, len; + hl_ssl_pkey *key; + unsigned char *buf; + mbedtls_pk_context *pk = (mbedtls_pk_context *)malloc(sizeof(mbedtls_pk_context)); + mbedtls_pk_init(pk); + len = (int)strlen((char*)data) + 1; + buf = (unsigned char *)malloc(len); + memcpy(buf, (char*)data, len - 1); + buf[len - 1] = '\0'; + if (pub) + r = mbedtls_pk_parse_public_key(pk, buf, len); + else if (pass == NULL) + r = mbedtls_pk_parse_key(pk, buf, len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg); + else + r = mbedtls_pk_parse_key(pk, buf, len, (const unsigned char*)pass, strlen((char*)pass), mbedtls_ctr_drbg_random, &ctr_drbg); + free(buf); + if (r != 0) { + mbedtls_pk_free(pk); + free(pk); + ssl_error(r); + return NULL; + } + key = (hl_ssl_pkey*)hl_gc_alloc_finalizer(sizeof(hl_ssl_pkey)); + key->k = pk; + key->finalize = pkey_finalize; + return key; +} + +DEFINE_PRIM(TPKEY, key_from_der, _BYTES _I32 _BOOL); +DEFINE_PRIM(TPKEY, key_from_pem, _BYTES _BOOL _BYTES); + +HL_PRIM vbyte *HL_NAME(dgst_make)(vbyte *data, int len, vbyte *alg, int *size) { + const mbedtls_md_info_t *md; + int mdlen, r = -1; + vbyte *out; + + md = mbedtls_md_info_from_string((char*)alg); + if (md == NULL) { + hl_error("Invalid hash algorithm"); + return NULL; + } + + mdlen = mbedtls_md_get_size(md); + *size = mdlen; + out = hl_gc_alloc_noptr(mdlen); + if ((r = mbedtls_md(md, (const unsigned char *)data, len, out)) != 0){ + ssl_error(r); + return NULL; + } + return out; +} + +HL_PRIM vbyte *HL_NAME(dgst_sign)(vbyte *data, int len, hl_ssl_pkey *key, vbyte *alg, int *size) { + const mbedtls_md_info_t *md; + int r = -1; + vbyte *out; + unsigned char hash[MBEDTLS_MD_MAX_SIZE]; + size_t ssize = size ? *size : 0; + + md = mbedtls_md_info_from_string((char*)alg); + if (md == NULL) { + hl_error("Invalid hash algorithm"); + return NULL; + } + + if ((r = mbedtls_md(md, (unsigned char *)data, len, hash)) != 0){ + ssl_error(r); + return NULL; + } + + out = hl_gc_alloc_noptr(MBEDTLS_MPI_MAX_SIZE); + if ((r = mbedtls_pk_sign(key->k, mbedtls_md_get_type(md), hash, 0, out, MBEDTLS_MPI_MAX_SIZE, (size ? &ssize : NULL), mbedtls_ctr_drbg_random, &ctr_drbg)) != 0){ + ssl_error(r); + return NULL; + } + if( size ) *size = (int)ssize; + return out; +} + +HL_PRIM bool HL_NAME(dgst_verify)(vbyte *data, int dlen, vbyte *sign, int slen, hl_ssl_pkey *key, vbyte *alg) { + const mbedtls_md_info_t *md; + int r = -1; + unsigned char hash[MBEDTLS_MD_MAX_SIZE]; + + md = mbedtls_md_info_from_string((char*)alg); + if (md == NULL) { + hl_error("Invalid hash algorithm"); + return false; + } + + if ((r = mbedtls_md(md, (const unsigned char *)data, dlen, hash)) != 0) + return ssl_error(r); + + if ((r = mbedtls_pk_verify(key->k, mbedtls_md_get_type(md), hash, 0, (unsigned char *)sign, slen)) != 0) + return false; + + return true; +} + +DEFINE_PRIM(_BYTES, dgst_make, _BYTES _I32 _BYTES _REF(_I32)); +DEFINE_PRIM(_BYTES, dgst_sign, _BYTES _I32 TPKEY _BYTES _REF(_I32)); +DEFINE_PRIM(_BOOL, dgst_verify, _BYTES _I32 _BYTES _I32 TPKEY _BYTES); + + +#if defined(MBEDTLS_THREADING_C) && defined(_MSC_VER) + +static void threading_mutex_init_alt(mbedtls_threading_mutex_t *mutex) { + if (mutex == NULL) + return; + InitializeCriticalSection(&mutex->cs); + mutex->is_valid = 1; +} + +static void threading_mutex_free_alt(mbedtls_threading_mutex_t *mutex) { + if (mutex == NULL || !mutex->is_valid) + return; + DeleteCriticalSection(&mutex->cs); + mutex->is_valid = 0; +} + +static int threading_mutex_lock_alt(mbedtls_threading_mutex_t *mutex) { + if (mutex == NULL || !mutex->is_valid) + return(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA); + + EnterCriticalSection(&mutex->cs); + return(0); +} + +static int threading_mutex_unlock_alt(mbedtls_threading_mutex_t *mutex) { + if (mutex == NULL || !mutex->is_valid) + return(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA); + + LeaveCriticalSection(&mutex->cs); + return(0); +} + +#endif + +HL_PRIM void HL_NAME(ssl_init)() { + if (ssl_init_done) + return; + ssl_init_done = true; +#if defined(MBEDTLS_THREADING_C) && defined(_MSC_VER) + mbedtls_threading_set_alt(threading_mutex_init_alt, threading_mutex_free_alt, + threading_mutex_lock_alt, threading_mutex_unlock_alt); +#endif + + // Init RNG + mbedtls_entropy_init(&entropy); + mbedtls_ctr_drbg_init(&ctr_drbg); + mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0); +} + +DEFINE_PRIM(_VOID, ssl_init, _NO_ARG); diff --git a/lib/datachannel/haxelib.json b/lib/datachannel/haxelib.json new file mode 100644 index 00000000..836c716a --- /dev/null +++ b/lib/datachannel/haxelib.json @@ -0,0 +1,20 @@ +{ + "name": "datachannel", + "url": "https://github.com/RandomityGuy/hxdatachannel", + "license": "MIT", + "tags": [ + "extern", + "externs", + "cross", + "native", + "js", + "webrtc" + ], + "description": "WebRTC Datachannel bindings for Hashlink. Requires installation of Hashlink Extension", + "version": "1.0.4", + "classPath": "src/", + "releasenote": "Various bug fixes.", + "contributors": [ + "RandomityGuy" + ] +} \ No newline at end of file diff --git a/lib/datachannel/kincfile.js b/lib/datachannel/kincfile.js new file mode 100644 index 00000000..4eb0b012 --- /dev/null +++ b/lib/datachannel/kincfile.js @@ -0,0 +1,42 @@ +const path = require('path'); + +let project = new Project('datachannel', __dirname); + +project.addFile('cpp/src/datachannel.c'); + +project.addFile('cpp/src/ssl3.c'); + +project.addFile('cpp/src/aegis128x4.c'); + +project.addIncludeDir('cpp/libdatachannel/include'); +project.addIncludeDir('cpp/libdatachannel/deps/mbedtls/include'); + +project.addDefine('RTC_STATIC'); + +project.addDefine('MBEDTLS_ALLOW_PRIVATE_ACCESS'); +project.addDefine('MBEDTLS_SSL_DTLS_SRTP'); + +project.addLibFor('x64', path.join(__dirname, 'lib/datachannel-static')); +project.addLibFor('x64', path.join(__dirname, 'lib/juice-static')); +project.addLibFor('x64', path.join(__dirname, 'lib/usrsctp')); +project.addLibFor('x64', path.join(__dirname, 'lib/MbedTLS')); + +if (platform === Platform.Windows) { + project.addLib('ws2_32'); + project.addLib('Crypt32'); + project.addLib('bcrypt'); +} + +if (parentProject) { + for (let sub of parentProject.subProjects) { + if (sub.name === 'Kha') { + sub.addExclude('hl/include/mbedtls/**'); + sub.addExclude('hl/libs/ssl/ssl.c'); + sub.includeDirs = sub.includeDirs.filter( + dir => dir !== 'hl/include/mbedtls/include'); + break; + } + } +} + +resolve(project); diff --git a/lib/datachannel/lib/MbedTLS.lib b/lib/datachannel/lib/MbedTLS.lib new file mode 100644 index 0000000000000000000000000000000000000000..ec317b47567f7ca4c052b5e98e705aa1e63ff4cb GIT binary patch literal 3020832 zcmeFaTa0a6df&B>u$^>_<;b^o(oT26@l_r9?Ap8b*<~Tuyx(uBs(rfKLRqO@wQBFm zshew6?Q>2OB*cT|mqZ986v0d2g*+KvKmwr%0uK>F0Raz)2S74H1PLJ`6d_*V_l+^; z9AmCISMA!}$8ltDw^yG&HRqV){$2my_x<^Q?)diP&2N6~*S|IXzbBu(*xP&l@y9Qo zjQ{?z`PV1UpFH1tCjatRzP4EWM7a2;fB%2}p?*K|<3GFj$M*a5?=5~rey68j{qNuY z_ToqWnE!tCs$2ZPzu((g{OBL0-~axt#gBgYz1JH2*zaB~KKwqc!4G`~{?BajW1GMK z`+r&dnEU(x{+q>*efWJ?gFoOi@Fx%c%HqRsx&~kSssC>A;rE_v@L&Gq;%gs%|HQ7r zpZb4p7ax8f*5Io?1OLqGbn)T$hrb3t@ozm}eE5A>gAZrm!x{K+1|EL~{`B%+S2Urc_# z{IiRn{Uh@Gx%h7{9`*Z|e|Pb7@ALb2{_^7I9`pOp{`1ApJ@osZzPtFjAK>@(ul@Mq zoxlCxSbW|6mH++X>zlvp?=Qao(C^=@7GIzH{TI>V>+bLW`i~Z0f5-3VfBk=548Lb@ z7eD{WUwho|)#>8rAM^X`-&*|qhu_xI&Lzxd|d@2`7{Z$9St z@BhZ)n}0yRZ~fBWUrc_#`HvRg+V=a)Kf3tV5A*wX|GmYx`rqIAHx}ReA%B0~|INjR z--k8$a0dR#Jp+H?$=_Q1h39|galbGB+~P0r`)B{#|M!pO?-z^zWbs4){;R*c_{AUa z_e($7E#CY08-HW*OJBwBU;Jx}U;3(l|L|z>OMk$>U;g%=SbQbF-~ElnFF*AAy^j{Z z{6qYH<)?mf@!|Ist-*i#A1{98EByWHuXl?d__zEUi(h@$?_dAg;#Ysr-#_@9i(h?@ z-><#-_Tmri_rLwE#jkz%sWtfaZ+*0w{QiYv@$Ikb_qV^c`1TL``~6>8eETc<{l%l7 zTugqqe|Pa0|MC6y_m`o!{P<}V_-z*zo%eG8qoCRU$nU&`dA1icRTXq`;q8Bv`uiW{ zX~y$F{>T0o{6qeyAK2H6A_&{83V1y%&Fj4SId92_gZ)qV?{;`UjJz~1%BC(;Z-1}< zPuxWNyJ38AlqY%UAI1B-2k~Ee86O_$7i{aqE8;LJgEVtm2XUG=+uD1J%U7$@yNmVm zi`|d+KEFM`TP;u4x69Mj?UpBJx2x5bN9R}PcUvCatS+}aS+DMvt1s?WSL^fZs|Vis zZ1v^CPnY-WKk$*O_3~tOd$+v%^5&uMtnXj_)z!%zAG=%KULD_^ zzg;b_jxQh6M7`D@vn0!kvaQ4Zm<7?WlTY(J>WVxH`ez)B{s=xT^B}3irtP0O=jUnD zrb*OQS^q3dhIT>a)os+)L6keEV{*2JQ@8)zHf=n{QrCXhI!$K|)~NB!$zpN0oGhMf zJ6Sy1cCvW1Q+AYK!@g~ZO6@gO6K~mA#J}6<|FUA4d%7= z>h}Ej;(;OS7nZljpFi}{d)%qMW7Fi}1?w;Cqqo0r@Qx*Zdwg+z%DH-APH$JYil+7V zJx$`Su4BKyn*n^ny(3Fae&yJ%kFPj^mzPjP)A~sq*M*5s61Pd;%1nBHS7uGSU1@Evf9$1Y)#aHV z4Gqp;U#K|FM#cX)pn zO6v~IHpyX^by(RZY_kjsMqs*;x%B@T%_;YqsLkRk8oCqOzyEB1SIGa+X0B}*dO=VI zdFQ))c0x(Fap~AAv$*ri!fic6Ol|vN!eQ!Vah4@H>pIX{)o~MlXO_p?rny&jewrsm zze?7lCyB?o&5ilkc zUA=pAe7hd=QTyi!=NLa)etv%UMkI;l$*XC1>ch*k^NZDDeWmBo->i?rrfUK}3%y~j zcFH(ys-~{I{g0h{@RVJT{hV9#QPlOnq0zG}YD2$hxS{<;T-%3L>lZ;(M&8}+{c8C0 zZc!Iy6ew}hTweF4?pAQzrb@lDxw*B+8)fJ^yBCCcniuhK_of7B?&1Zx7pB~sI34JnW{3`T=-X|OFlpKN zMVH$yCnT(Ix-r(ai2S&0DlddUAU&KM-?1j2AG02pbPoZvE0=p+9>#^=4wRA;xxYJ0 zmPXx_UR+m6nb(G5_QYsRG-ZS|Q#3qTxAKCpOxVC+W2et< zuP-5mvioQEclWo>>8rdp$?Kq%J=Z5n20JXw&Gp6k$@z-a88eaE3%kN^eBT}84B49* zW#gq`QUyse^r(ci{ar^&)7^#WWcmi!yBGRi8dX8o#Ih-)O_Vczea(ls&w2B9b-b1q{58LOBg0<5xxT-E17F$JH4HS5n=+}rmzo8hUdujQ zU2_C4kMB<2m>uOf@`7#Hcy&=FMOv9z4)=X+?ugJ<*f0aQzdAlSu`OFKY%9NRQDPqK z@oFvW?zT(1tZ3V$^;!-Yl)|0iiS+b}qjxV`vil02{?;DAu=UESL{zAn2RCJXcYJ&2 z9D~lw6F;i+G?{6pcJS2-3d%^{UVmo0i$brdimI%ucH@qybv?Phy+s?mV2paThDjn> zAnv7U%dvfUb(H>VscMvX@Sn8E`u!N4I<@(ueX%_zUK4b6(TZTAuco4ptl|EyIzBy# z)Bk*`4pj2-vs0uA&fCX3?x(sqYSOq3`cG-%&v|;!FO^=AlucA3yiD(q%x1KX!wBMl zJJi;G)tGjVK9zCe1W0V>KW@@AHw5vqOCOhBQ)dXt z-TRI<3B9t5y14SonbFSe_DE?sK^;1IvpV@qTTxC|r&~1ArF~PBq5FxoM7=O0!_mQO zbdr}@e_ozk(GTOex!bT4sn2Qw zZ_~Iiezd&0KDoXbt85!@Y!@PjaVQ~jvIV+-k-}!Cb$cz15Ma-a?=QwCGTpy<;R-^q zz4_Jk)y&%8n6~SCY@G?_8<{QyA3I4Ot@bf+}dTG=ifGpH!rQ0g1jXw2uE6 z+GeS0ka=mr|0TYw04e3^yVyRplshAQ6kZS~ZCHuiKRh;a%R3q-De7rtmGc9|S)j%a zRY3|LRwDAf+z*phnST`@Le^AMIu)7IOvxeFGjuyZ&`rCt3I`S-rwUejqrNd(oS84# zu>@X~<%~bT6s>uQ7CavPp^X!BF*WdU_%CKpp!{`8JTB%5g!%J~e#qAy#jm%dL>M!g z5Uz4CO!i5dWMLQ7sTbP6)dd8dz3{Ak{z)6QWs4r+Rl|EbK~)4zC#HMLM|Og`$g`~L zJcqgLlyz1FU4+tPyVU^ed+wMZMak3q3z~rQ1epFd$=n6 zc>m+!<)>krrdgXu=E*brBo6$h3K21N8`?R~N@UL}SN3DRhttA7OQImiOV-G=3+);_ zP4Xbkqqgjy`PT0IG%Z8FX+e^y5sOXDRnFu9S;L z#woV6-p-a6NcuUdcHgeH&*~Ieq)p@DnKK9M+mTw(*P_VWU9E1_8-M8@)l6*mw!heGN(>rF9eFUQyH$JJ-Cn;vzdBis zKbLvvCbjR^qb`pxUP4?(Z&sKwaQNk-VB(Q0LKZB=U03kGqy5|ck5LT8wHFk_AS$m3 zqpS$)#Jjm>6c^$3sogLXxuD6jJcfAgVx!SYX~jQlel4Gm_$U7!hWl3N7WJ>Hn*jff zw*HO=S$k2_z*XzqJH48&O6@gWki{VmrIYLXtGnATN3C(;;D_|nxbs$Q(S?6{3VXMQ zrNKyD{BF?-+P*dDdyR-@ao8ElqG)N1_{EAh$^EIJY~xgKa?A~%Tugu!yukT zv{wRu918|KD^q{pwRG=!o(uu$sL;9pBHu0W@#)Ei!AlwAq$H2r#~Be5u6sg zJDfl75X_!DxBPOi$f6)gu`Qf;!^t)r1^N~=NrqNvY`f9w)T5)mqk`M5~-gyeubym4!57$c*K!c;foF%pcO{A?7x34<{&vC{J~1baE7YMnIq&@ zeLFgTeGbvplRO?9C}9tPE{ZNP+qJPCqcg#W+pfu>YZ!)QjickcAC}Re z6;(x(*Le9h*Xk5w{K?(5ru4F24*kGM6&6K~p=`3m{h;3*-=2Pce9KB-UZ37y@K2$z z!yyP`4_%}~i5s-Iz9lwOIRFQ%_4WPj$tv&t>b5QJwXQ61Qs@&dQ%b(e0M$Q!@c(T) zD7*;4TWsc=tI`j$|EHa1uY|f^!N?WG9W-I%9QLjIf7-8D|KRYQij!Y9K^zDA5Gj3h zbmc3r$Y4zwcl7q`;VJ4y8LBoxKK&n; zSN9iVpn`fbvAKw`Ym0?U9?2aUTSL@ew_%4=AGhn{_4;^uvtElrdVIMtG5LT#o6`@A zY%^LK_44`a36@E9^zPN!d_&BJ(+=*=Hzz4JzAf-5rNVDpGSzOg({YEg*mClgZ&nvK z8`vD9z(4!}y>_wy8w<wSqer;i?xxV4&POSavf6z=i}*Nf)k_YSx#i@$892hC=^`%3AmEw^!36$=RFhX`>~YZmS>@(PhZz z;EBg-f>Ry2H#({gm(HUS<5R<_m&5a7v=~L1VN%IbwdzlH+`h^h7)Mhxc>ged?zY;C z5G9flN06+>;lZa)v%M&dkd2W5L-}&y*q5V$ap+bVM#Y`lgfn|7bwCwzYLwC+xBra19 z6e8(gs^(rw+9--u}PXI?}m?;=EeCZg9Y4wvzF zkC4-Wt_(v=U{XoiB^_MBuFK(3d%#t4ZeGBPZ4BZ8C0^#D=%3#l+^Dr)9%XT}gzdRqcUe~eOu(<9FG@dapc7-vP@%NT8z<3#b zukmYl!Bek|@;a(2eHPRpfn`?hlH-~u&M0x4WQ>T*J^`4=HER-VTM%Psf5NuzxJ!rQkJed) zDGJ3|hU!=HBYtC9^CFw%9FNSa%Nm}7Syp5%HB<~|bN$0h;VxmTIJ9hdG!q1Zw^;=OQ?gc$ByTilj)yTnF;7gGq$Y^W-yUT>5gt`A{S%HN(vi=$f8zL!? z<91lCLx#P(^JH$oqM~OQm4)=H@yff%9p%hEAgyp%%i3<4dU<{)3NHiZQX$K@U*59A zyqrP)gBDI;hw)@@XMPw(m~=_X0e4>JK+L}k%DM2XvUOkP%kzs-aUo({PjVUJ?}nKV zx<(PK$)PN~CdIlMN2B?%a`PYV5Zp=}BI7T2hvoEKl+ca_5G!6T+3PZnyJZ)Pd}hOo z>^&0Xj^Bm_Cr;kxwjDu^Ac{!ORsLHW^coN%2Q=w0(V4YV=W}Ow_sQOLBp?sVA`D|7 z;(8?C6XIDD-XtGqfyVT^@&Jr=2{vzen-M@AmXMNoiTz%pqDHKv@>0~Ppg@w5*A-FG zjAJREg#f-hbVLn&IewjBZr8F~PjVT}A;Y1!@E~@0N#jL1{vxsVO!jhi)xj^~r9}qZ zq?$N%mwpp%@{ERc$5x(Lxuz$xin*vJ+)TSs7*;ApoW=u+vY0DBa|{} ze4kZ*^u48sfOguQmnBUT`q19dG-Om;W)29jt>X~i%3PDVnFxF|YyBh!mN)5TsdcQ) z^$L*$(dTm1jd$Bv+Z_q0f3zvi~V88^jLo`QY%F%Wo29Y;xf z;HrFBPRp$0BpOD=y&QcR)ibP%1jVVXzW3zm$F4$+)wC_svPng)n#j=Npsf)^@!N+- z2g~RnaP>)^CU7`EN92c!fO&B30W~Ne{O$2(txf zBnup}VD6-9ug-vr;5t?x-&`;JxJV>jj*})6o5RMy(L9qX1kBEITItWqXgqIozpk)l zsLrvr=5FuMqAJId4EgX6nzpkvy$`?PF z9oVCh8i(UF}FEM_lkF{}7^!q2qT`sCHn44VKTz_v{rNbZ$F@k@~073k6ZXYN}? z-PV;v25HQj-stuH2>Bu~M_^Hr_vZNObp7V|GlkOwAhWVxf*Zsbc!4ql(lPxh;0itz zd?gM>F(eEmK)uWQ<=GN*|m-^Ia7R8SNqjd!M}b$oGyk9xp`*df4-(+YD07K2V)m@GY!Nyd+*8oTde zTlX1o;H|DsZoj+{7p?v1+P;~>=zPYC(km`qehpz75*AMn%9%y5$LiwZ+HFEyByuu5 zU%f8yo_99E%v~l8$O_v;Ar*m!DtFjSFYpVPFl77c+C+13k$b6+lll^Bq2E%Xt-_A9{`|T%n+2X#& z(Id-#!c~y~O}x(P5ZpK+FxY;ZxNmn_O~U?y|JSff0B;*<7y)SA-b7 z!67sLZig@s0OIi0pPk?A@Ak8_u}gLV5p#k9`h|&QwCnSS1`dIZ+!rBiw0qm$E*UQh zY-TQmzTzqfLc-N0ME%4aN`(fUMcA-6_tM-?`!3o!0B1Y~V6<*=m8vTtjyY!}?%NRp zXA1biYdBH_1c384gyb6VwLUQ}MJ%A32y4A3kmzSpX$J8`z4*eE{h`SpltNCFrLZ`OlG6lDKYs)XKS* z-~k!w)|O}iST}uuqdfv;2)D*bzyDDpP(uQJK$t*Vd;UqE*vZhaaCN+vATjZ6Gq~5c z*Y`I)d6tlJ1zAz8U0_P-)m>M25bXY{s-vck-Ry}2O5LS(1PsewD~X&Fisme>9UsDZ z5^?5WoTAh1KS@B8Ova}dx1XOoLYx&DYG{qHI;_l6&5mAYm79qES0|_ElLfGzB&apysNpUJ-di0tVD-Zli*4@Z; zx{obeM$@7UI)V~C(zZNdcY6w@B?`6O0?#nJ21aYVB8a8fjsd+J)-b4$bCNbL*Kl|R{N5 ze*2z49XmzrQz_A>m}xnX`uvXWm!dv7To{74(I2_$z!nRoUHSheVYwR^&W z)zLKA4Ndd~+~JB%=$W*LfL%Hg>@vn#T*n7Kz|9$1mNrdWbqPR&EuzE?EGT&`uKzs zD9j0dt@;1uij+H!4A5ew$ymiEn6BbGN6Cuhd5Rr;v{Rf~dwl60B6}{;P3}m$7DRwj zCM6!+ImpfG^Fuw>BdrhZUap-8elh%q72cbor(TZ`rD%lZyJ;f{-7p+jBJUKG9c_T{ z>1&ZQkd>d>L1Mn_aNfe+dM!$u0(v%}QZ6XDP};c!2@?obd(ix@0->Wodq#!SM8LNZ z``tb<;{m)t!F2BF?ez&uvYfxEorl}E!*>eT-niP_LM>&k$1DJ|Bnpu-{#v!-k>kSx zkRhgH+d-i_HHmSbJX7tIt(i+34NlB*_Z2Cl^ix%ceha8PK2w_kAn#Wq@t ze7o%Ft!;;Izrw|opljQ$*EDS_>2zDi#9kyVsNO@xx{N-e;qmjE;QyVG zq3c&?_iM@7aoX#^s2sAhqjnL{7m>!)UVtpOs?dbf*mmO2!2u{3oXwjtCK?uY1bie% ztpxB#tUjIfT9*-;mDZwqJk~IOx3eb52<|6+fxC$qXhhe2b9yV0HR_JpHdu$q`GY|> zbOxxlVTqK4Mx|)Btc%-*uqAFF@H{&y-A1u+!nYAS`0w9#+hFGPfd!OP368uPP(G26 z`WT0`l`T2RurJ(^WF@i&wB3;?tFFwTJt~CX)tx~TjN<_$ZyD0#@7X`qHTB8SiV|j(j zG-)*?YPdif-|P%%M%-4F4}QoDQ7ONZt8*&pNL(sIgkFFxq!uR)89?roNedguV11Z3 zRsu37KsLbjGhKV3iM@?!dFgC4mL=q!2FH!F_J#(InYLZU0%KPU!juK+)hsOtquX)w zHY{-NQ6%vTh<()0!0GM!>}-XVQY=$&Ta~rp)w%7hB#a;cM~m-e^Xlo|Nx`MfI<^hY zrZ@}BfPUN~F9P`TsRCuM=}5vmY#S5=f;FLdktg=uvD&YhoQPO*y^PW?Oyv%8WwHFk zHFsS=NGDK`UXU6ryMt15&o{WRa(JL;5Mk#7NRvK-7M`^2YunG)35CEX2X|?UN|bun zBrE#%#)U=Kx3k9cRF!z{IWrU13_Cc!Aeu;Pi;VV-+Yb7Pl?=DR<_bTREPY~^St{Z+ zZbKY$L1r&3t|a6W0d6-`Mzc&A2X-%3XWS!2@Gp*S%g#%J4uC1?1{w*^k`6A;kHr|V zBX)lG8%)@3$UW+6@)b>&<>bxvT2k9sHafJ!%}B195SS$$Zi>c?`Se`b1y5ylk;2?| zd5(lY9@2jMg|CWvceOfY1uyV45uB@Rf>t?=hy$*%m*9Ny+^O`oK&--~tPwJCiBxZU z1B#v!8!PD(N8KS-uMv6Kx$6t`K8)KUZjag(om{Evfz4C4Mz;-!$%3nkScvF;@`Z;T&l=EP_th#16<+R4jqq zF1EJ>5gWsOjZ^cT+jeca393|(;W!~W%NgYjnvkLuGKl@BS|UAnb`3fWf)v1cJ+q91 zU78)Uk`B5M7J;ZH3C8xG6b(fDwezYujxq83q+g!iHli#nYqf2-Gie-E33hM0@*8t9 zJbY-xLFx+714T*Z9=3MyGT1w^k~1$-E`PG^z-c2?B>)qw^H7rwE{Nh`a&47^OOru+ zM=|YU<^q-|5L$JzkOly`IHKRLr64mTyM&OFscD~WA}?OW{~_kXDs~Y`u9X8$ zDE`nrXaw>p#S+1)*GSuhoaZRcAd0b)jcB>^0zTdlcz^EctE4|OJQw6QA*Tt3K+}Qp za5)~x)=Q$Y${WDkN7rhjuP|AlA93iWCv3Rk5|D)=PSpD9X0Vq7$!ObFe3>_db0N*# z-CnEI!ozr2t~vm|QIYQ<<31qQ;}OP2JN8`wAC3e#S*rNcGi3$jz&6ztK6|v<&L zb&Heb{!)2l^qdhr-qB5iyPyejqKbxY^!F8=;KC8^IolVB z{ZKbr!AADiYp$=+Dj;4F59_0ZJH%A*BIYddvI_XKGeVx~!nzgsT@)^lFCufpoNfu>3zRuxVSS~?E zriq$ zu($aAV}#^6D zV~C5Ei)Y`?%#Lo5ss@&1cLJ8+1H$h@Nh;FAHXhrw0vm!qWKNR1xxNuAtD2#eK2Xl< zE^5OLlHjh05QSlI+Pq?im=c4Lkkv2&|EaDsNfnN7B~9j`;)U8Oj&%D1=^I0@+mi5> zplL7(y`v>k@u($nA3gyg65;5Mb3{}$=d!(lfJSTTkOXJikn)mz4rY?J4M>6}ATo_a zlXlUCF7~Q6QUl7+^4KzGl4a!;NtFo^a<*(b%HGhuat;b+$p$EDMug+EfxZfpA<_nM zkpnVEUq?f=(*jW%`bmoi-&HrGpyaEqH%<7@ke4WMV&+aZ9@BIA-WhQT zeb5Z(_XYlt7<_LId`lyphWml_tR`Jv1TzucNue;WRhmcll`bUh5aEBG%6jdXMC?le z*#QvKiLX!}8rUR*bzcHBm&7F@H#aL$RAxU#Aq=8bFpZOcYkT-zcu!ya!4VVen?yzu z98Wq4-#`*A{<9a%omE7M59>Gzc)QiSfaVetn`%LZX;{AI(&O-;^B_SAcfj+x@@6U9V0L?9pDtZnr)rzle4i?ED!B~aH6M52B==5?{6QpLrm*~iQ#5t{k8NMVRt5h z42hq1`$PJLq#uxk-)c#)R9QPU4dSW>Wu>Z)Y%JY7#wgf)LRVb4!z0ItZ;;$DqnqEi zbgzlNvG#NjB2|!vAs*rUrX*v!oX0ZXBhht9;5kvD`=!+A!7lFoY8Iglg% z2v*o_T!TBw1n=8h>NQ?LSdsDzi#N+ShHWzdk6A&~2zt1c8T9#Zwq4{++XjwTlR-8? z^9$`heX495Pz2i_)@-*GS&k~oW{`BWk9W~j+r%qSspd5mCA4!xj8~lb)@_fSr^>*Q zjHvDiRH#Q|+mLY}j)}y8-yLY#18@bYuemDDB?sbX4(z5@|Q-Z_5Ee_Xp2|9D;twHP; zg-CId zT}orfzs_n=?rqXlrDl2<-8uc1u?RfyaxXV6O@PhJt0QW|!kK8HnK$*~%BGqUPmg(L z`xwpVlt|ON6xI;wtzVr?#@vjjR5~rmKURu4X1J)kS(vtQL--9W#YmHKm92+)uO#+8 zChfe}gBR^>L`kg@Vi79RRrM#o2Zan>;Nrs`#(Q-yxF7NL zBH!cKzi@gC1Uf}tm$oBq_w{Gz$ax$XT`kmh8IsAI)ZCIlOklA>NvM5wcK-SvpR4;? zi@fiHkoOeI6r#ZQl@M zl6jzY6Ld3h-NRmIaMSa|1hzL=0x*>+lZAw-&CZ%+Op@?MV1?Sbt57MTdC|YOLfaua2V5fw_>JzCcI`omjif>za%-t3RW z;Qv6v0vD#9L0?5ojjE@P<1WZgT$6J~fY9Rhh70u}Op}cU>{n1!fUMmUkf64SI)^6{ zqk_PakU14%c`EeVA+vNHIr2i~Jl>4E5)rX6b9I}viQnY~rk0x0I_EbM!6?3c3Fp|f zK;MRBrwt;{xe}R#J}O8Ye{c3)hiT56Aoy*a&nb%7N)lcFDa6c2=kYRLP;Jsj8YVHXc2EAkd^6QapeUa+s+07%Q$c zD7J2A_~3|80H|R3wwc$%oq-~yQVw)Z8BPqxH!TN9wX^5WNpB^Ry`;p<2sU<130fsa zD)K!(yR8RihP;KDyV1io1KOihi4;b*69XF|tH`=LcAdu#4|_z76@%ezp`BB^2Z{MG zBzJ_x_km>F0>Pby=%_5x#^kfX+yX1c(9w$)Cj4S3=Q>A&C8bh>oead2V^=WJ?flsy z;yjSd^k9b%hX}+W9))M#~g1S^P5EG|bXCr@&+LECtk3k0Y0GEM14uoYmV{W@L;}V5v;l2Tj-ypD= zMV-voZP?W0iI&`_&XTH=372wDr)@+1DJm@iad#uTU~8wiQeNL4pRNe`(4od|n>?X5 zNkx!pKR^*f_QZmLV7NI#w;>UIq?|+8+Z-VD3)VUlSVDr4mZWxq#pro6TusCbS4`E! z!S;k$Nu6L)3dJ^eiVJw@Rdoq%7pOUR>)0{5AQ+O}f+Q}}m2~I|>YfwLLM#FqQ@eH= z)iV$jAq$RUMi3HIiNc#bgu>6+6_84#ot+#~V^}xLZ8LKOz|%gwz|jiahJ>7VINZs^ z(q}Y@d$j@VwX(0#osgtaD|DNrA*azGcDie+ai=oG+pAGCmB^^UGc-B={V1JiJ-5FO z;5E6PpbY9}3Dia|OfQ2HpJ75mtbhQfC8o4>*5YVa=1s?z(;GF-LSC&MGZb@zgAj-h zen)4#808r;=S1S-O+bP{T-xCxAA*f0%gR)!+IpxF_$U)cJ~hgeIo3vmHKZ$~w$1x) zdm}dn{yCD;wi~O8aM`b_x`0NFuq{bS(b6HI43o=e$Zap@*)|ycC72nfiPL7*d|}&w z&?kFrNOUexns@ospHs)rcdn{2g zwj~Y5Ra6)1GPIHC1;50oCuqe@&E=t}2NEq&Q92OE-qthiNbt5puzJ{;(SLw^_Q*h` zDzR-QFm=}$rwALc?P8B)@#OCT>FgThi~(%`s<`eaOcXf%iXtQzj%y)xHozd!)K1vG zAS*s$E|h}W7^6d0>{Ybwz(P@RJ`(w6pb!13I!BSOQ1%78!O$|66gW9`GPyeARdIV9 zBoW)Lg>HsKk>tMU?YL9n!Q`Vb(IW#(Re>zg7_VejAhUgk<;N(p8z>+g9%&SSA51ZpnA+V!dR2r0Ro7%0Ar`T>%iiG{R`Y`Z0Y!T)NY7ukaXTEL>f$9z!C7c)MET#HQtE+D5!q^3$ z)RH(OL$tIkY^U@Ka0*l^xVj!z^^=%bJMM^B!D=ylbxt_dCxnsuSWrlOsvnYA&9+RW z?gT`je~3xWc?hbXRCd5#b<5O!NV=V@A^>W5_&wXOQuQyOo_#}G*ljPWDR)a|IFDEl zN&9vAnPq*F&n`}=-A8$~es>HoW%xMn0IMN86izE8BCTNZoHLC-GfO8J9V&R`EvP{w z0-oGs4w|tFqP$mtTtLzdbax!IYkLm4s~G%5f^$X(I~XOiV7c0$OF;ivCI1E(IB3){ zb;B4ZMnMu(7lT!B>`(l@g*qd#Q?dXhmK4S&G8KrDLs#rDMe4(b7oxQe2D6b(&V98m z1K;wqSK@F3pP+~td*j5kh82rcX$ip={Yss_xrEz6@^^ew=-ZM0pY;4MM1AlZuB>o7uUy*zKUj>S4onQQO&H^ z`u6TdKCWt5&zuCTc0RE{;G*nM$fGMw=5{alf-nj*^rB&os}meI0wz|A=;)=qOW;l+ z+3EWA5W&Ep@tET1UA~$iw-2w%(kVFG^t0ei8d8|1qjw#bh+R67Dlvj!938zYo?-T7 z9MqG0Ya< z4vkSs+8HuP-r;Sv#IqA5XB@>2Cy(BmP`@_(&&v9){e14r1+;VvC`qUvPGlv^4yue$)70KFCC2KptJ7e|PM$ap7Lj5A z6t9V`mI#eo9HwH8FjIjeiDclcj?`Bosc8!uW+G(?I0c{Mct|90FUx=gz|P(5H)8&J zlA^6mbMjM=ORgWt?z>0;9v>p?YHIBcJ}gDvhtR1_&=)3S3b^B^b3-4DMAeT^TUY=p zxS3QX*BZf70T`BEFCO{3vixWsdNf`Cym?#)zNqh_jM8zmlV;ONf!0s zz`$=&O(=E)8P#1@N~QvY5Iub(Fdf^Ogu0RnqA?~Z0eDoZ2&6`mjkGc?T43f(|`n`+b-$qG;BHd+?vBb+x}CTSzKt!Ey?-aBc_EbWJf= z)>FHCkd21)rgmM3#H*-POSVs^!;OQxwL`>0Akd@=wkGb!H6=M1@hL=6k?8me2Nb3QEop85Uc~!Fib-5DN-~?b0Q)1X_^&ff_Vf zPnB<}6|OCtD%rpcX(k65m3}b9V`p>tgP6zEtrM|kB8<@p1Qi*`w2gB_Iz$b#DpoH( zi=GByqm27>i{G{8*x>6b%YkwVVoQKD8z8L{fuDlH*pTgLN22l$*uwS<0_sFc*;2dq zfVRkjNV<`D5Tb8ae^q1USPW-L9U}(bb$kSs!RL~R#3?Go|rv5LwBPk_Wv)IL#YZM+y zmo!#X#7Wv`3U&LVVm$fuH{u)BJs)GJY#ZP!lzB^G1|wb|N7_i%2ofqx&TT_!b8zHT zh#FlW?B@3rAzr(}qT4EJsZ%aF^dWi1g=j3nA{@J|_!qUMZforRB*~7vKF{FB(ktF7 zc=ONg!DbIo47rKER9S?lW?!n3G7ctp{ImsFin z1th3%XsZq4pa23)&cT_!21()^1rn8-62jaTw>$PDA?&#FB)Nt*9ym~AeX~IGssI6T zfVgc*YeN|oDjd%U(Q=JUUVKqB-DWE5OF){5o}U{+`ngUV%%%)Uv#q^HvaDgoOetQi zukZI)x1!f**s)99)D?F7qn=YvP|M>NlprFCZIomm><`@KG3f%&ZjWC}&2!tUI&-$G zm~xd}K`_yr<=P1IYH{^8eC%L?@o+>`6hhn@-C$Ftz?$tGW{Zc4EKwO1EwIp9ET8fa z4J;5lHo3DUhTaa7Jo^+bqF|)U1vM`mskTcid(aoHMQLz@SyHm+GOjyH9=X*KZJ(G% z(xfe*lp9nx+3a+3?z!vXxN*srv zp^=j^v_yD)zg9KQ&5Wv#Gjp@IR_Tq-Jw%x=^DxKLHQl_s>pQXWIOo)YQpqX7#sv@< z)LNr~37UB#lduP`B(JSq7Vt>~M^K_@rc3A|x`QT*OQFTK89E^5xH=)Ua)ZvleJWX) z25-8`c<8o6yvTw8aO%8}AS1-?^_h|b-F5(O1LV7z+;f=q?ggY_r48Fo@+Omr5$FSV zwHL_HI#foK(P~~=`#c_A(hpH}DVJE((mf+#zGhAjWj@nAyQK7 z!J8)uLyn!i3yA5Ywdw+Ld_CB1Lm|UbL>+8w_svEQC)u}tc8&}-EG7+e0^&;o9K1`y zMbs9(Y^eN4NzXWf@P+LGwt9i+ylmWNxUtD_4r!Z^q~Xdh)s0`;n->LyXNGB%aWXBL zb%|?3+(>x%DQeffT}{vg86m;%=LG=^2l@y;7KiVzd|M1Ka2U@~^N3X*Plij&`bX6)WnPho(P6qL+`OZ?v(!T*jd zrx6en7pw|g)lO6uXs8mFoS*h{eGbq)CHFI7kZK;o4EDl0&#@$PX(#hX{KXnq#{eso z)l{pKC+DYQG$geR$u3L+P%DPwb~IOg=!hjEdkodU;6f^E{A9s;^NC2rAj(K9IV|cH zTNusbkP;~vG6Df`%LF?|HF&GHTNjs# ziMPW6%0zf6Iqz%%0(n<^fCM3Dr379{{kjD$&28LROdIfFKh5h>Z!&DGo5S%gO};Iu z4YiTjs)XEmRNGnZ<@A97z7g>L_*sH@vKh87%F&O zef~My9Mg=bc)v&GP5e~^VUvnGXh-%RwdgFyyDa;NOq3iYllRsuxP>?fc}MXf7XdBD z2?gHSXgY z9U>-nP_5zW3<_!qbP$5w6sgIJz#Qrzf-zxxm$eze5{FQbAe>lX=n;*8#gZLd17o!j zK;P&Qs?!}J1|y=Y*~QV}9}Lpg{xE7(MSfQTshn*6yNAd*rEV*@oe{4w?c|!yP#r+? z$nbZ=y_m`iwKsL*tzG(*5?L(z*zD>*vOv+Xi6zLw#n zbe;@$){c5VY(4z8f{s;`x9XQ?a~JFaxvfYt%q_&GX%CDxGxx;CwRmlqnMtinB9^uW z9Jbkd`%Si;hg{z(C4SQtl_r|*-J7LjatOUt($yqv$(WoT_M(_WQ{ArcM@UwM8S|Lh zqy8|68w`7s+Y%r{1ma}d6i2sH9SYkRyp<0ORqRte{Tz;8ugExpgWE76R*9gt#QOJK z)PXS+_kFt!Tk1Rkui_R@LT61Yb1+645NQ~bu%M_8UP#yGw2>@T`F)g9Wz|EPW^qdW zS&*paX3lJ)Iem7dpnAcz;cUvrx1^twLa%Wl$=xa_u@mR4BW;m$-S4m(Ztz{%J28z} zpA$xL+b2n&0GwwTg<2(YMd^f&^+1a1Y6p@scf0LcOe~aMjs};XsIM?`(Ot>&F0pv_ zYqlYpYy{}pZzsO6Nw+R{#GEV6!UVP3Wv6{KWv`(N?8Wv4R4pW|n`qvC8u>q`7;~ccmf!-@4i8?DzT1JqoqLPI%3f$I(v4W}Xuk~f0l{&p%|U{lS#!~O=0@{~9f-%=$pkwG{RGc3$@eo>g{z18VxhqpcR z!Afo43CmiC335;f*pc$bfkK){t#A{g^{K+^9%zG#ItR8@L~JQ|=m2BF)_u3s)NMx^ z+PDKfIv9F-7oFs%F{z8SdkRzAs9_f+SSU8kumhF_wxI2C@(tS#$5bY?g|LAM<7ESI zK_6e-BO!h)!DLeV#5To@0Nh!s!A$39lDc4I63Ecrs9HTi94Jmi@KZc;>*Dmsb!j8l zFyaNOu8V-`jIK1$w4Uu+YGnrspp(Eb(gYGTGSbzY+%dyMt&uvS{%jfh;_90e)A zHZ&E}BUT*(uiiiYgZig{@F_^pug=)?NOC|zU~nQ0yw!!;Q->C*BqRdc(VN^C7!QRU zV@X+o?zv0pkU^2dkNZ(r+DqDDr%&^+!kykr2V<;#ZvhdKKak)DV=;D&;YlADH>$$e z*q$~dUB_rg-v3)mW}cykQi%s^-xtrGy%<*cc?ORo(`Mv-v9r7TWY0bz%Lug&QR`P< zfatPQ`b3H`kndrLei@p4l4TG;jObRzKD%96ruqqK!{{i004 zl1XurUXmD^?FFrrXvOx4r|Ra(-p*$h-m#bDIH+=tr#yT5;@Pe9tZWKmmr$#@m^vAP z{iY;g1V$tds*{_Y-REvQEa5n0l{24bJI~zyC>Kk<88UI1cH?JV?q`^p-jIg&?iJ;q zY=4v(gI{@z68k37t?PjIY+DvHV&BJCCq1pE?G4G<*9_bxS=lOQR2d83CRhp2oH~jkU(IC zPh0vUNtbH!gtT0aW}}#uoj?G+C5HfsW^9rc9Sk%2Qi^SkY!8K}l4&Zd!IvAbSA2>w z7~-76>Qg2DJImNVsJ^$1{3GA(E-NtkWQ2uS;wO$PG}%p(zyvakvvoy;SkLuGaaE%c za#1jU!>g<)r)^cXbF3R7aX-Ym3d6#|M80Ao|5R}<_pQ)Rsr7?~XNPF4AJZ{HugFD3 z=8PE&>-^hkSEsN!&2h`sm+==mHrpLRMrwedq!3o9q@68q0YQ|^`>s{k*m&l8&hcPT zWyc1SaJ=+;ZqK;-z#;RNI#Q~#DHnHUz;DOOTYM(>KrkS`|^7 zy(2%G)2ET@?Q5j{WQH}>De%m1fHv-IX*?YFkT`1CvL83s_#5mdJ3$#e?BS{|^HyzUSY_HlW0N ziOg{ll1L6PL`{k~TX)__&~v*X!lA$mzR3NWvnfh$ zG8!(&*my}19(JHJdxPi0?_!oAa~F)h*Xv!&mP-{ts3mX$YB9UskfmG|DdIZH!bO=1 z@)Uxr@r{$%oG6=5Tb-=Uz^VdA9f?XKGR!{mM4AKp%&u!8z9E7+gyHs8C^%-C0ZwlV z*~Q4eK&VOJ9EoipZ`%t%II>?f6>70PN!yI}ZnKh1(j@xB=3omlots>?LiR3*Y<8qI zu#U*Q$c1cBZ(VmT^9Dml6^j}?w^)=63(!2Pk=%&(9^3KYwIva49^(_!r`wQbRqK6c z_K4$u1>y>HQ1a$KifWiWnr;=J0>^?N!_5U8gvzYLFbM2Ael1Efr^eVac2s^GJ8+N_ zLDu3Z|m=CGTMu=zxA@T_u;EECoYMrZOEmw^ZFn5I=$;F#aE?9(Oz1HtH=8A8huiEFMN;K1+-|@dS7nJoLgs~)+OhoO(<3_N z?)cIn&)5g*w#D!-bVxSry_W+fP(>x^u)s5rdFK|!pfz|GUcdR1$(19(2DXATv3_B&~{DEK1a%ZrI zSxJO5+37TU&;@gaNvIR~rT8=k0_(C-T2|PsY9RjxPTXr7a`*=;u8D}`Z#Jz4-U498 zgbAST9D%Omcu0p-+|X_iiM7)fP)Sx}mxTx;%=o@wujiU!x_V7WFV@7(W^IPgnA4)o zWX?&^H#NrSuk>1l;~fnZcWj&x#afVWp_eGNHl(rx80&}P*26eylTqn_pfcC$;@nrA z0$GF>WMa9?BU=Z}DQz#=0Nl)a@6%jT_mhvzqQjIbETS?%BnLceM~wO=_I0uj8EWds zm{Xjx#bOlhkHM%JVsy$(Rr1xj`#?LBht+L{696{Hkr?fTHgF!_QgZ<#vJfWWx^Su1 z{G0m;aQh+tDl#`5y&T*CWV2LYORaJV@24^%Rk~8O#;-LtB7ENk|e&N3U{hUa8E6l8KYAjMC-P zIu8RZSyJp)MDIen+^DfB2SYSIPRmQ;ZC z{S@q4s{0LWYmsqY+zi_mE6vhcxD6cHUD>;B`hmeHTaH7#U^)M5h>?J zBT#XKsUGIG%L^&x|xgOtKxquSso3sDrYx25|d_ zXX&;~a#GxMkmY{UhO6O7d}=e?R%sD-#NpSDMSp0gU^OC~zqu4T`LS(>o+aV_8Kg=m zgxpaUdc`jSh5yZ`R`q=GLFR_rz0ZK7fsu`X~x*2Iqufm63d=5Tti zi{6f*6*&RJA%ZSG+JUKRgt?-08ycAH9ElqI7gqH|N4EB+&OJ%`F8Y_zEY#7p%>eP0 zq;<{6WBMS?=~vjc#Kh3CD}p+Knc`3EweowR=J4~)Kb^lde;K}kDg){hj{_Ef!(M4{ zjslC+UubB8+lKL{#%{A3jRR#i^uBiu$;Xom2~gsyOE(4S?F5G~ zNK#IQ8Cf(Qq68FXp{AJajLc5Zxx6H(dOa>~ugK6KN<%Q+GDGOBBoM5Ln9(@_uO#sESG$EiquJ1~T`)WI5n0>(r%8gg|c}B9yWwpoGN7M`%h}8@g9qi{hURB!$7cKc{SQUskt1@ac zUYnr}T7taaVt}^AYRst`3f5?AA)I_@Mno}YZ8UU5|MyL>M};9GVlfWul8qxF7=@K= zpm`45N}G8zAyz}TWJJLT+{NG*9QnX`45~UNZ4z3P-6Qug1qR7XlzG?0Dx95PNRG4N zF(776FM(KMa4>M$f%!RaC6w}ocM&}TKfI>4kHX?RFGvFDkP=K@J4pJj7m*x*$Rb>4 zI2cZAIepv-p{(2(M|B|s3DG(cu2jbYGB==_N`|P<0nw!*P`1j1u6Cn&mkzv5AO7e z4~Ozgx-z0UYC5-q((vq=M3qGHAQq8jyCW=XEt!ZVWXbs!J_4e3vFAbswcGYoY_!fB zE$ADP2T~=YFF>|@17g{EgSwhUCFXZ~^tUWM=~rXmiq6W92kvqt#H{5T3MZW2E~)2( zF-MipTg<#d5udHEsCLS3vQ*OYsJ(e8SqQiNUFaamSjLYP{8PH5aOC)jL}aNN3B8mx z6O$z-SxMVDZFxfJ(ldbT5f@3O|FvS~W*e!3MA_>Bg}^33NEokfpY&3*ame5Qfi5Flqug;hiXzmbs7xit~_ z@F{C1=5JM|_*gW`M{K-qIQ0Wg2cy&l>3{l2Gxf>enXVC4rxWIxm?h@g0F;>YA(kAK zzI3yJdLUxR=z&RY#I(jetMFV!cSNHZR(8}DnTbgX+eO93A&Fp#ZEEz&WaMIGA2FKI z>+;m0?hieKx#^s12>sLdbWF|i^6q}_*;~p!C?mh*Y@1<}G7P%_j!~8ywMN&Pd=qGu zNgUgcYRgv#4SAC{OPBT`0_T{Pj33M3Cu4BPuUI}*ZPn>Zy?;aTfQ`6n=>*9|#FF_Q zAl@67PnrPsx|eEz8WJ%f%JRzi)|@IOZMicUoqPiVZ7?}E$6pHSYxXUu<~v_QR54lk zY}m{6W5Zj6l0SKe&fYmg#TGV%6`8r{yi(_Nt z_iRpH)bwcEv7Y0U!!a9uYxpaDZqO?GXcDGxAI%h=+@phO zgiz{t^!w6s^!7FBo-S1?_&MQSTj~`JPIJ53!iz~D~U6Y9PM6c!Q30#q%?i{ znM_$v2d+A9DL!yZTON8gW&z51ZUiCiJ0G{5rp6mrOtsR-m{^I~>Ixl6j2xUirP+JZ6B^S$P{Ww*L=TW_k#!iZkvGDrf__&<2 zN}_7Sr{>f|^X&9$DPaNQ6KI~zirnVerqC^a-sJl7H?zKzsfq{=fu2rsMpEND_c!A& zDB%nt;%3aQMY2^1VM+b5NsAOLl5_8f6{BxLyPxdn%fJS&W z{+oyZs0EkskPR78d0~*%whCJ2Fl{4a3fQJ)xJ@FZA3fY~mj3C6W^#(UDdMv+C!I5V za>EU}XEIUqcSV%Pi=#h;KZ#|SdotZ<^DQ;b-a7u2FfA$vlB&=(EIuRpuAvSk9-(U| zuk~(7D1GH)2~@;mutM!(m?zAhylyH%+VJ=1M3eX}dFcf4jIcO7_#}$5hS-CScvYo6 z+9z>9_5zapIA$tQGwlm$B`IeCS;|@=s@o?Na;y9lpT9MQjhm9|E^0GE#By>$;f1kZ zeGvqt`6QytHdV_seEdZck}g=_3rB>8Y&0(NwyOmxV2zp^tx1*;6ohHx-ouBWFfYTW z_eeI>;rmm-G?~$bwEzMl2mo`D@kOJ5Pbo}5iR~r9(?ffCr^P=??r^U+(49blT{|J~ z5at`CK1;qaNO3a?eBAvWnWh>FQKep>g0#ixJAH{tL{*-RlJA^d+^>PJYFX3$Al{9x zqK+?#^uzrZeC~2Zk*K|q2Z1q?y`RLHnAf$jX};eQM=&)nbX0zCE819)7Dxjrx!qH= zb!^o9i3?`3x%bmK<2u1fL7`dlu_#yj`t#!(Jca_=wU%Fy{<)uW9mZK(#%s(wWg*c+ z;<;7cd5$Ux?k~~kovpwV7=<;N>mzRvC2>4)AzUDyyoK31Amd1X0A%;6n{LA#$^4}9 z1dx>5{nY0D3<%~;U@P1nQWXn^`$G8XKx#SEUy+ku6;i~*CIrl#P(&qKu>aWGJ(G9Z_;-5XsoOg!cD(f@kWqtef_@QTygIq_-}rx0Mro1#er8!*a4 z9)rBeNkwFG%80f|8NFWPwO<5*NEL^?C7R4qCfTAbM~`&3pa6(Q1nP9jeUYsX!$Tn{ zYk}mrU&hsx5;0T_(>KUEb*x4&<}pDA4h48%0QjJZGbJOK%Pr)6ozY@B83(`@Vz?R! zq8`t1djoO@H>9ys&Kl!olJhD^1r)QHxe|*^CJM@}xitv-O`kjPG@vkYR4P1q?=)3h zi`~Dt7LWtHYE;NcvPDoJrdIIgjSzwDO=8MBx1*{G4-cy)A5KZOULiktS;6Ls4fy1( z`0RS4{P;o;en4z{*@1v^*7qIDC4Mu);c%@QSwLSorI!of2HrEebp&lEWeT5=%Pi^i z6(VPKc|%F}33DXuf@}!@9(&N*fHgE_rZ>_3nTP)x$0GTuhU#+ewbI1Mf;|EnkhlY> zf(E*7SWhg$DS(WTWa##QQ^`q6gftD=chq7I3&{;xPQyij65K&D2sS-I1lngK_ z0lnIsapT}xG9N@RvYhgx!$ni~XLWb-MqAeGP{?&h8i|}N*Hc=9*$f)W9&+RXcDRj@ z?8q8ZSP4fun3aY|kVl>`pST4A?j+lWD3|va2F&)Pc4dwNXtzLNeU7bDQHs*0+yH6eUuFw$!7$hQ(ZJA z9&(cbh`PqTUEO_teQU#K1JEV7eo0Qk4c>^IRA+Z}j$hxdHaSUrDoC&_K;O0Kr``}4 z@s{tG8KEK_#7DpopyWp6V1`@~^h9a6Z1u$u} zM~PiVgA}@^@GKIsA;{`!XUIl{f}YtiK4xkRkH~s5=a?%YF%0%}OUR&R=I$zz+Q2V6 zggvcy^`q%8o{0|JAdUn?6WJaMe$OucV^*F82pj9fr|NdhteXNer7kgR~0-kx9IuXSd8>1k#?DzcqR zq?e~TpIr@z88=V*o3O1`iW&Gsn2}>rLolsc!kUg`1vwUd6o(@?kTJcZ%pX8-%d%Z% zK`5adn}Iai6#~_kBQ%lx$k}`MS{ePMml)laF&ZzpXp=Q(jwa1465zOqTTIZYqVR@1 z$oSr_PyvllG&CIk;&z;Z=O?nuR&bPSDf|Lkr{I((I|I-Tm76$kmvTRHmMZm~z(I}w zLlM(Uj!}PTLCkVr&(7UYSqe=xq->_lm-lMLd6p0gtLFEo!*CpTYPC;h7l}2@uLkj3 z-y*pg?xwn}D7;HvC}5?N6Ql{f96iq7db2(if%$Dr;yI3uvN95^((`hfXjJ|DB zgf>J@0;L67?&bv?I`3CSh^)vyt`0V*|Y5;k~UyyftT6S>0UHBo4xR4 zD5%?*fcS)xibDoC8M_Xjp`G#|XeC-c;kM(r09q#aU-hLd=IfPkev!}6Zt1j7Hwz7R zTUM!9%0af9+cuPF8tA(W86qswGq)q zR4nzV-g%*9&25LI;t0r~NgYCAiYBmh82AZ+fyxMKazVK5$Yz?>KI&f}+|~r5NjO}8 zD>c;@U#r^;!50BYvBEz5^-#G{fj2_M)v ztZalB4D~hAQR0?y6J-`i`H7nF66YFPc}?h(IvFO|!1hc_QU?2A)>SOk0JN|PpX3(z zT*qw}l0m5>T*uQqOmi=lSGuQ)B2CF5L?&|^k{VMIcj<#8!-d`p21#p#gqfQJDsCHs zAycGU%nptZL61yZ`g$LuFnqTmzJN@URM{)3N}%mQ4quC`H*6`ZJ8FlJNKvvGvx{0s zl=j!x*TPAae(bhH+++9Cu~4D!hvoqn=WjqkSbLL{3CpNRM&?$>e54YN8p5Uiw-^cT zMF6m!rPTPt!56Rz4{y6teGi<4p>RZ(6JbJP8=Z}ZwbZ^vMRX+hV=vSyW7oNL9Fop9 z$Nh#ijaYxKzL=^9^$?SgLU0MD>(qvd(*~P$Nky>?@#oCg;KuqLC)}v&?gS-e3S}&l z5xH>hQ-9dxh}%p%6cbC*Hp(dWKF3^y^plSU&Oyd`+%OmCC+DEr-inZHd(S)~Y;sZs z^9{qm`w0tdO$ejzeQDbe9vGn}V&uT!E`}&sNbb*t3ZsTF>fDj^FTvEznJ>Am$#F{P z6;4;J(~7Xx&rlsaZBx<|-EBvBaYDwdAzN@?UrIipGYJeQWYnx7^-@jxITl0xM-dq- zJ!>7>{(Jw~rNj56aG3b!F!af^U|U01&iw*%g=VD~lT&Mn>S3_GjD&~YA>nx!r#eLJ zjj{>}vEv*W;lK>y`wrPFiK-(t8Knw2Rc5h;NN!kO6ob!2ezsGm0!9VJY)L>beipmR zLa^2<%ZaFxf|*fF&}~Tu;(!{);!@F__FP?#m5Pyfwp_N@ZCo`eiL6u{&gNS6i#y0l z>VU{M@11ZdjLfx^WFfB8o{_l~ry)Kuht8B9dA-wIg2Vge8u+G)MUYjH94MzU0-L&o z9&t?J3e7Oj7ykgBC!e%X_7W$ zgXQ*gqZEXiHub)2refRG9xfW3z*zkI*yp}ywT)+IxIop#Z`7$Um(cwH$#hBPNKOpP zzeASy^(s`t`ytVwN+?=8(gKEyA}MgkcHZF~S#b5YF%%dF#_`+Z^9!AQMa~!3*Y=2* zNuDawq-puQ*NPYMb+kO!3R-|kQSs4bV9bQXbR zJXP`0DtVZd!a1fxVHtHojiYj6yEwbIk4S90yhK+_KxorCrXxkBpTuNPF z$)GbQf%gZ3m1gd4JHh}nu9x7FdiQ}cV;RE)3&b|6dWMdAga2OAhLI1B%EI@Of@0Xc z-fqSw-g7H?aAk?K6pn**L?L-=#i(nHQsQUQrP`%4Do*ad;9iQDWJgM>I#OJrjQL&% z#D#npaz;Ks#>60+g);AH;Zv=(+pt39D^kpFAqK^Jaw|QyAqme)1hL-pCq$09lF&$B zX*orzB9&errye^Z3c!;lPsw=PFTFlq$D#|#CTeENNRT+3gPLL^BqEgPaDB5_zbU~H zvY{@4oh6yLDJp|QMXIxDDfrQY73XwD3S9WEW+Eh=mr4@t?25~vno<|9_jvh8p|mT`zx zqjwRgbCVs;pIoiYgQdcqpuEF0qxa^u}Ov!omge}z&M`gMcnP=t!P zacX|9Gh|qS1eP6Dk=%w(@wVX z>JA1(;mSD^ONbq2!y3?KW#cI+3P2cLbt=Jz0{!vB*>b2mg^L6yAmGU(J~> z9d76piKVVUmbBEa!HhOY;40BtudK43z)O zY{(puvYmp-E!vPI;OI}zVOQi$AcF(55+(lf_%jak&^RFzM&3}&kNnqDmx4W_J;l&! zs=e=$K!Xa!U^}As-XM~#P`RlB3W=aRtM4hl@3r72)X*(~Lx^coyu*T6PBheAhjMmm$&+KT01 zSz(PN9%LNB;Y2cYopTuyzVQP35rTz#4|2r-v|96dH0CMcZI-_^Qnbl&*y7(_s*4g6EARpS>f z&R@T|o37u6KYXK&MZJw4h^?H34AAQ>cqI*R8 z<|qGu*4{40vMjsvx;9;1Rc+TtR=KLH?CS1vJKODU+Bm*$e7Kp8d+)j5pQkgkx~kpn z4o5~rW`-*=A}2m7tC~SVJXjXej1Wkp5%V&`3w|=ZfW!!m!0<3a$ROYW@c>9hh#3hX zEHpw$2!8*)&pCVTbI!ey)=;-HBJSRM?a#IMUVHDg{!8m$DK}}ybKjWRNym0+j*;Az zZ*8=4iH4eWIvQ&f3hbSUyb+EBc6> z#WLSPTNrPR`zbpDf^9g*H@lrSmmKV}C&$)%&<;56{dS*c)`ulWG&>l+v@sn62e;&E zW=A)4_%L9%JdRxs?SLUYpR<6sK7w*#f7iAA)rY;Wzlh&h0$4^c+ z){Ji>;y?pK>A=VB;zp;~fcERZ*!uu0^^F#)dOTmR+7MDi-4q(EWJ z@`L-mdq3*kI~bzqwFpCl7I$xqYj*CvY+?{6d-Dg?#51rgCwO^@603ytUjJZ@0Z7Oh zO#OCmfNleZSEd@Sd|=*vI=u zlswAaOa>g(4N*hW(q(h!`K?R6C%uCOl%X&_|F_Rit2Z7b5 z&qlvLnvd=e!LrMZX-N+*HmdNnNw9kN@o#Ln5)+=ktl2T^4bREvY8MGv&QX*z$+(u|r z%h`q{nfE?s3g7n(JK{>!Odd#t9F9?FL}F@m0Kbg-KQ2avnSg6R4NLv(d~ol_l{qS! zF$MS0rL#55dU?|OF&ziSJ8!GDoFSIcXeP#eW~)|S3n&M(j1FGj;vUHQxxO6iNtv%~ z)^Xi>^W@%-(+9mSReR8ztM@|Pu!`%UQ7kPO+n#(pT}uumO_=s@!IXAJczueemtR5- z>>$~4FdjSG`tCO-c5R3 z&)d4K>^H7{I)MJ8ycyAC?eQB)nXjQipJsyO7SUANWBY)i#LLg3!@Y>Do1y6-NZsol zgjJjeN(}gL7z;wLrK$9_;T;f_aiN2MXI{iCO{w1wHV=}b-*~t~IRtzGZWUJ3gfRtJ zlgnEi6LL4bn#PpFW#)XEBtn2+O%rxu#IzAGtSDl~ytAr3(BOn&&hi?MPn9N=!~TlY zfeL>iP(3*ejwEHbFijE6Cb=+v@T2zhqtG2(GjS%E%CE1J+j3c#EbQ^aLuEN&H9gk= zmv|Y)3z_RU0~-U$vmBk{cjhREl>|A+Mh&fwX(s|`3?=Gr1#A(gdL75OR}W|ETyyJ^ zsTo)Ai9CVyMxsV#>2+AmG|!eqm+)6II(IV5r?@sBT=<~6K6UCM4zAKZ)|pcSt0;Gf za*k-O>0EBS{$y$pPC22N2)y_7XEKK2<~v-k-9|FOT?~%x@$IY88(d!8Jkvv`9xtxk zFCKdI<#YFI97^LMf;pFPLdyIE<-msMI=Ec)Mg$>VnfYZ1SsT;QXw1cY3(R6HIQ2-L zf#7hr$la!H9IWXg6OQN6$z;~I&bU3;r(UV?JEpspP&e5>aI-x?H~Jp8NxG)bp2Hub zN|5`&C>6tDX)?#{ouCS$9(FJPxo)zUAnzdaqys=UzG5a=gV(r?E_6S5qX;%^LH7XS zak3aqyJ@xHTs=srURhg*On7!f8tWYEB;Yd${3HJPp2cx!}>K%-*m=8oFP90ps zx6zWSG?UWu8ahyOwKPz&d!pcq=v+gYsZ|w&!FyI9#ME;-1!D%M0uLO*jngd+9qu1IHX+?Dlt zh0O2>c^)W~>D{AT!K&9qdDL$><%}T9*B5;Cu?wrezVQ|H1`NfD0qi`2Q3^PY(=FP= zUE==U$D;?s{k?V%-{tEYyZd|S928YShX9Cy_GB`pujSpmOo6;!p_p_Qa-!z-m-g=6 zZ{J!5nzaa@Y-_HJGDWovyv}igMl*gYiuL`yP1^wU<#EGaI!iz@?(oROxjQCtx#uL& z!2sn1mQ1iYaDP%Qg>I^rGUX|Dz)_Y*E!UKCcjXB^BmJ%;IT2qCAuRjw|@x{ zhLY1RS3&h9<(*b43CCem&R|Q%rj}^NO-M39RiVAK8{nF9f1@9PsGp(~Twg!ms7~T2 z1HbXk2@C;h(;0`B`@+|-hOFPl-gkl0a&5maB^#hhgaz)B(w0^dAIWGT;)=zU)*bft zD}0{!rEMFiB!eDWn#-y3v9?q^dJl#;zBOda_{x$2E8mkB^c7^)I&w_N``JSntImU-&;8lmQqJ+#-iQF4ARwh zC7)4t(Xmj1Nrpy={J&{MEK|D9$=8!IC89WLp}l%a*TkICu0)iH1FjC~UzF)rXRayue`AfhFQz|U z-(16#th8i6w~#FvCJgm;^=wyP;sOXCJkhUQ3^U58XW3x~xDLaQX0^5OYx}otwbkXy2IWwcn;a=d+FI}URodA-c{t-r1V+nlF!zkGWO~|e zvW4;(gtpEgYpJd3Z7rQ*0W;F}hW@Ieoc;3caIp8BnI{&A9Bs1heQOD9el= z`Y2Qv|A%N&As)vQyv#|V!VxKujXa2EL%NiCeYu8td5qyqJ;5GtWqs=l<;HQiSa?z1 ztwhTOFwOB$U(8|A$DZRc){M;ZKDs}QNI`TPP3Km2E|Z4p#-tn_xiXt&rPeOKOG(F| zp$sx>5HI1BOAUh>mpUAb@o3Ds-f={&aI~z{5yylMfKaz}Q?}RGZsJ~Z(i>qE6nMW} zVOMGm=_KJ0IOY6VuyEZzlh@f6I!QRFp%`tN`oe_*Q`2E5UqR|RxTd~~PHzD&ShjL6 z@8CL8WO`l?ZfR;hvbL!_-GQx$CDZazT~=Rsurr_K{aah#yhMp-p;WByu+vBVHk;=a z4lb|!5$Ui4o*VXeuEJ(mZdpbtbP9CEVpx^x0%gt&)Hf;h8W+Xui{E|tG4Omb|Ce8 zazqOD*$6WPPpZZH1$R{dHUZF^k1^SGrPh-!>0zFMc@fV~nDrH2(!(RHOcq04YHwks zYA^8~je0U>0AXzEd#Q$WI3EF`Xt#_qFPRBv`xhUIEWr7t#0p-jDRhc!JA9k_`kKAC z#QHUq7|KrP;NUIqBR4Qr$}xbo=)72&u(qL9M$+!Kz>T0UbEy=NF@)`+89t(Up|jJ? zG}d$P5@wi9Io3||b9iMnTgCWuE{i(J=(hT11>5=p?ub9edDgr2e7}Sn7FgdnG%YtU z^?bi%WENOSp`?)YQa$OiQhCmF`q{43`U=;U3bJ32Sx;ytk_wdQs$>RaDZ03x~c%ty66ZA#0Fk=U`G z1bnW|TU%79ovp>uy3$gr+6L(*7WT`e^({@&G8!!aMs`g#i+0_elI@}t^HS_5?UCG+ z7#ixkDNqi9pXF$bPT|sqMq?UL;zShh)62Uk8d6J%bH|xm{{hpg!4WZpj}k!iprMecIenr zGjS%5;TL!TD=F)m$qOSk@u27wluJ7ZwzaigaAZq>MOaOlFP?!C%PHPNQFB^BX&V|* z&Zz1{J|uLx?3e3!P%I}{%3goYqcK481tonOlbTDuh;j_vo?JPsrp!3OQjUhGrwKd0 zpez>|+KFCj{t(G~%V;`jgVnr(Z9_X_$~kU&2OVDTi!ztDvqXuKPIroC&uYqSKtpY@ zsAe1Fjcx^DXs2l=ucuwK^Tx}be8L*!`_>lOlQ(PR8((Hwc3eq0;{LslC8=xXa?0|$ z2N*WjY}1qnNk>^0GeVh;a$swV7C!pKz+~J)>HF4Fjs=A?&kvSj_{wmGzKzNpW8j$J z4#bzaoU&Tm8GdUJ>9Z|+`4(91p*f3J7t4X$`nKB6d9Mv{7^*R0RBCsl8p=@{1m66j z?3UU_Jv2`{i@^Zn;!vhprdN&U0$g{w`0$jsa6-iKi*&T;Zp^ad!bHHhX$FQ`jc0erQVA__&eV{9C(_uL5b0Y@Q_`2_Q zR!AdD2|x zh-&3Ss~W|Et`ijHMaki{PmiW?O)kX)Zw-{USrtD&4(fbI;Ya`=Hr?Nwd( z!_u_FV&563fB-y`gR)~2#myeR(0b_T;E4gSMU*}S#*p+;4MhptgLZU%fK?CWjM(i@ z;aW6TIt~*-=&)xON0E~j6_o2f=AN)JQ$EzWFOEQ0E#j}7^&{4SXQ+8ovW>v>uk`f* zRfW6rFJQ-+%kpLw#`LUTBp!>E&-)Kz&~G~OXgxtS~u)! z*Q2^FS+DDmb=&IoYMa+3ZJIywWnjIhM-~yx?Aj70(3Y ze->b#qUv$XXL6qlt_CZi@d2$g!MScJ+adzojKil_`HfE#OOheVeVx|&+S*!>qdILg z)6xmv7Z#n?##X1ly}sMr+TPvS-Nwj$b8T~NceA_E>}_uWC6H$(BCyPOHezz^ZR~CA zG&EC$=PIo7qEm%1Evg;a8{c58#MH3Mu!<+ZpO0)wFTVw1S zfl&vFhBYmn;6dXGFf&}CfBMXL{l z9xhsj%V=rd{+7cZ1)-))Jk;SAM22O=8KO+JV2%WX1m95;PHM^Kc6Y7U+2I9bW4F1n zv6=Kc&33!fZg#ru&0sSv8r1LsD?n`*_UZPU>+PLnXQ$oU?ecqbXDwOp_nXa*5eLMj z9+U?b|BQi-csz@_dB{vY{j5H!LIcFp*@^L_?251s+7+PbQkoM!s4@ey;LF43QTfq| zpd7I>Iw;pg@@GkQ_DSWoARyr6VYu|P?z!{eXWky@;3+$2REN{2l}7lWgK}-7wORRk zyqt1Y#bq66)>3(h_EYwhejbp5yTf+LG67cID^TC z|BA8X>5;^i>zgYPWKxQY7*t43yt-DS%AHP;n|5^kyL$yKD?* zoHX$;_&k90Z;ZPjbX!j~*Znw1dh0Zg0{B4p4`gEwwjtX$1ff zHq`?7YzedV5hkhCRM^t@&>;tG712QlD1NN%%HTEsb=7ihC2RGr{Ts3I(M1uE-3MgV z(2UAuryZ$gg4sRJn}H>`&-9ox@#V!A2hW5pc7+w}wcB-+2iV9@58YS%TU@*EjMfF{ z_9w1LZCNEcm(bVeO8GF2)GWUaf+Bum^ID+T$W>%68#PO08*#fatRG!NHPw;F9E=RhcC&cF9a|aas;=-*ST2 zdvjn{+cFTd+G*h9>_o7ma&q)6uXLFOP1KV1D8)Dzh1B%#Oz!oSTXUV z-cS!badY*U;{dDa^Go^Lxy;*U8le6vC35Gjo6|G!CETbiNum-xd@MZvbHC_%5KUK? zYt~j=OqlzY>?uT>H!Dp^9?K$G>~A=jRH9XfEJ=0!$Rf%ID?^jx%vSj~qpe%y<0uIh z2C2kkUNc!TQb_PQ6-}=!re?+*3Iw&*W{E5OIO(e{}j709E&P!`;Kd6%hWsb42+c`NYvp zf--TN+U3o&YdOGib#pGgp2gI~URl%gAub1MjS3FYnlR@#PZ5chWsY=Kn$uKQr5x7WUCX-9RoMGE9qRoVH z(PoJ;;+>L*ucf&Y?@XFD`Of6XbQr7Mw-l=ZFN9uQPqCgkNzK(zu^gUt1I%lLS%69r zZmJ&Q@aXi~Pxn&1XJQBZRhO@iRx=)F)25c5z&dKBEt*i5AmjC=#b@zLvJbJA=}Hwe ziE<7srO;A&w4#dwTZH4H2FM;0^Y2blFnm=y7UszeYbk}{tnf9zUCn8-JwDXN9I=(A zSefC*aI`LB{E@o&>bu2_i6c}eTv*;5$t&NnYZVV-;n>w{ICm>gXw>2qph;aL6;LK5rE1U3Z$3L{5^e4|!d95)h83&7C@0R5=t#69Me zHEzuS1Sw$N`_ndNVj+X9`Y%+4gm)TniD%evRdZNTiJ;KMlT-0d8NZ0x2;LS8hASwL zEwz6ajFl7k@cPWMIOUhG6}Tg4kFbrF>R#N7wZk8@Nr0xt_#4}NoHUgPYlkjS3WOD? z91vy=WzIHr%pOQ*t==4{U^Kr&nK|VxrQ)Bfja3%*!iM%1b_)fg;Wz2yOcq1fP_m=; z_XN*Ja#1wxkqZf^5qJVcl7!B~F z9IBtuuVnL#$uQ)l@36VShAL#>`#wj2FVFZ;`k*xhi~$c3_)aevEw6noc|nVJ1^|ax z8EYyYO+t5htY=m`pNdDt+Q9nM=EP@arq3zF)zjja&QH*Ma_*rg4Znl%%I=D87#1@6 zvHzTxWc0k8au^{fbeS3+UG4Z+s8GIw;*AwGnjIZ`dFG7X;a#{yF=Qks^?BK&lzo=K zp5F511n6j-!GY`F@$v-rZ~YCFDi9LT8(w!(g1*&hQ%KXLdGPGv$yHFVHer!INFM&_ z@uQ7{Cy{)RDk;f{t~Vt?z0AqGHKfRn(S)zsZPJOfJDKk;oGuKpD5_b)(Bg&=1# zR}4&sRzVcR6IK+cXJ3k}21cpaCMW-ICc_!~*B1PKBnV=0{%c++nR&vM`;a%=M2cN)$rbw`FB_G42i%$|$OM zj;at@C3A``$--HH(*=MjY@S+T%HK;9*&i7>%j#u7Al^28W!=gy1Il@1XDgdazLX8| zV$>h^+5mQe1+>36qM1@`b=cQviGySfTwHKEjLIrh5|F^)<^7M zn6wq`+yuOK2rRZI2;OZsCtUzKrYUaS_V0E$p9G2-rj^M8MW~z8;IMTwO~xZYE0DRi zD7$}Cq~8Km0=R{An&(6f!s5I&oZ#{c)Vg$X!SZ9ql6HCVo({ z0+CV|X-KjN$vEKUOHOl`bf+NgxqZEy%xnf=JM{2i=S*%;M-23%VY|KProJkO1kw`k z@efTiWW1u7(H!?iz+7jwDUvC9fUaO`nFw_CzWiJS;_;$0ohLe+xuz7vDkCUcH^CE~ zPupETTBWKWmt(T}R$&oxg4*jvy#otR`-U<<&9Nun0 zw8Jt0j2lMm_irv`k{Dw8i_Qe!Tnm>S219{uc5uiz8qq7Qk9dsPZ;rxT*@2-DlsU*J z7dM#seG&4T48U*gYj>nYCr4Jsz~ZaD7ywL6A7|nzVrf^Rskku={|-(*a4(1_C%5$2 z=I=~FA{kGdv)ytg&Hy6R1PE2UG%?FvcUY^nof)wE?FBylT$Hs<+nFZ`{?45pT*(ZM zp`A=dUHLb5lXajv^RJ)%lW46u-YcrGn{?*jv;vD<-(t5Sgw%MA>?Yu8twQ^2Y%MJ1 zR}>H?=I#Ixf3VV)9aq#lCiO7EbKVd}9eJfmv{kd!Vs|(kB~x%rO|h1-N`nHr5S|Pt zi9bc{`S% zkC#c?bLA$Ol5xYBf?S!e)Jt-|%LFR=Xa>qmy9b(c82h|{ylJMhXS3lVoj5ny`7A4Q zN^l{z%i`LfIUC$!V#le&Lc7bw0IpLx;!pK@%X3($A~0OsT7YXDsu*VzH3-H50TCOm zWvN5w?!joxT|BAPr*-2RjqM%|K*s1(53|K1UJCXA90e;9X9N?Ocztw*s&dhcy`(<| ztsA#2`*#QIe(n_B?wpXnV?=&yqJZV6td{|8Ph7%+!uGN+o0Z|fUzP%B<^%TSFVVj2=u+&#K&=wEUg}W?WHsrJq zQ6gWD_85#5N67`x8H01;zfM=a}vvQ`GI!wV!Ui4>HB&y@% zh{B1z?Y!fnD$LqR!phUnBduh!H^cuK$b%ZwrL)qknYxt&B{mnI_V=R9<~X{-K$d5q z<(b*#dT+snu7H|v>Fuzq>@B8)3D1(NOE3(uVBN!yw3k=zGS*t9>Q*XS25!GWK2ZNJ z?Gv*Yrrp7Oh_kzujR@&kvG77RcS4lA1l!+xetP}HIVTBHhf?7^Bk6J6(F%Ncy}$RY zG9^ice?~wul0lK`F{;Mra)wt-D^dX*GyplM>u>({o32D5V?-s+K=_>CLWxwFp)xO- z`%OXOgv@xa0+s`JZ>D0n8aq5oFzJkv&4xg{Oxo^_Fq9bYnjJlVO=rW7PAE4I|M27p ze2(@RKjJ2ITFI1C=zw=N_gYXiAl~Q5E}3z}2JEKj5FXQ?UX*&I)8bq_;Qc6R-JGBP z^_!E?G3x85k4{f6Z4>ZQ&I-cK$HmjbQ!KCbF7GVU<3!+Sa%6V}e)?>G&pSeE-&{Y5 zl8y0h*k%aI^|zCi`pBVD=x@3D`kRa@3*@s8<*rK1zhxSwAm z1;#R<(g{YA<8vjyQe*Mq$6FhMW_f`q4aTfH>a?f*Q6<09V9aN{?aKv4J{ZU6KfFQE zj`=-lEfCQFr}JBdcxsW{Piwj*9rErlLe{L*&-M#r#pBbU&q|u}s8k}jBYOHQ>gO)p zH)Zpfb&3kY%&5E0Z@5%6Gg2TL!#k1kfljO&@<|I2M~v zk`@;+AG5SGk$e8)J(_cUK(YqYeu6hj6@GqleTAwU%yUEmx&^m+GBeZpVlrEey$h{1YR99c~5g0tKS}Kp{ZSFMlD=Z zkRH$7WXxP!k@2WC1i)ReQc4Si&C0Y>q_Hv1x|NnSVP#rc#(N&O3Cg#*y&~gObJoo~ea6#pRb2y6)8Ng1)aCe@cFS`yc*EFYa#7i~xuwVTtcCt8#=Blep$ z6LgN(_ffl@X0u*$ot;UCXSy1UyMiZYkqw4kZm(_ zy(~V^#^}M#LLZ<|mG&27;j9R`&lBC39WjF75+W% zz}ZRV(pDNF_(UG+NEcE0!C6K%MlZ3A&K6g$AD<#Lf5anB`|RvgnyCBD{^`jXz2D|_ zi7`02eqOW;KdBuqkke5M$PK0oJooU(#&YT#BB13LfEMg*3f`+;dw2!Ot_STtOf0u( zpi(=L?YR)(iO?HH5q{pyFl$L>lQ1<5Ie=gCeLIm4n{K_*L5N@Wr8`26H%n@{hj^0 zW6tLZNBz;5zq|XF`)i!?OLwj~Bk!U&F&K_rAE*^^A277sSB(aFHLY~S;?nEjJ{ahQ z<<}Z{HG8I->7+ky&v^4QP#;C~tkp?TmJ)<=z9e2puRkEGqN<4unz{s9?&HHWT55QD z0ye?#bUuOY-k$$R$3qle650TiUb8G~ zk{}(^3*9bz!2Pr?0Z*6=F6a_we#DhPz8IlkI<_aOSvS0q0j#>{^>FP{Fi2@ENRTGO z-hfjS4{wM`$0ww)JT_<9oN=h|J79r?QgpUd|8S6=;wZ#a(+(#oKr`f>&?d0M!R|C1 z(HS^=%x7DCl%BUHz|`Z8q*$e>WSqln$RbT|>T#kF-b^KDKpOKxfz$5jb>E}_ag$|| zHvrQNJDtD>OGil?FApI_sW%s`K^GAocZE?B+ZiO`vU)m`Ye7y7414*^z>Cjt3^Xw( zJ@tm4gJ9?bWF}}a*A%@Zf7{aLuw{VN&IkzZ}!bas-kR_xL|KR)Cv39 z#l;z;a~XOrmELYoXq8!us{KzA9{+nd{|=eJC{ZSp@qjf5ZHRnM8Ly}m)esQqJV@2U*kZ#ZA7nlBkUeL)2o98#LY9wY&b23S{`*G zIHhNmY<)1AagPoBa6ywDmz~whjozjz^d-c$oRVP8uuAeRN%3yWflf|O_RU5s8%0Z+#70p_zWw~YHDBE3CyXf=g+MblfydqrwFpX0g zo~0d5SOuVVmj|**!bMGH83P((!J(WWC({8wNK-^3AjT#iOU=uv!xc!cCNyvGjk~Qm-ZI_bm)Fs<3CE|NA1iUHDnon>9VCj(k~QC)Tu{_9(!_Nqpvs4$L#(%8;0nsD+;Rm> zP6?wVK@)|8eb^Aq(#$SVuA&FFsOmD4G_qZA-qHcq|sjLFmFO1xUfir zm~_$hm3^;vpGyW;!I`G#eQ2eFd~n$m@Yt!O`xYNve{QppYPydo2@TXI#FcAa8ovX9 z``cV&U1+kZR1TG*;2~k!GU|a+Viw zgB( z>*X*WGue^z1s9FOF4{>WE*!!w<>nl1p>&L6K|p8tmZ2)T>WVfftMX5R6+` z{4F{tUOE19BAxS;DY#vfk*%4bwI;mIPNY6Xm^oUR0C&4 zzrUvkdKQB-heUT6cB#ilPY-mDUonVLgtLcnme<#Z!Fon9rTx_f*-c3S(d1G5L#4xQpnlEQHI zxl|rb7AZQ&pKwH3ofyr59%>vD)Ut#}zjIsaAv!&69#vb;C#S1N=MYYFAQv9UKGX!e zOddd!1qwR7d-oPvFR4y(d*P4=LTbEfaKkm>#kc70%wFZ6tzvB zw0b;VOmJ-5`Usg>YtrJ}xIo0j|6J~q?3VroI+*@K z1rLRcA(K`eW=8|_O>QWJS`>?%$t!nnW&o@L?jg{`#(i3iZorH|1F; zu*r|OCvi{Zyae((!E=NRT<#F9>YK_8u8-8>T#ydKe9kFytFMepW|R>B>n zOgsuk_ZcH^U+g!9h|4n{Cu2?*CqerfyJ7BtrK*F$L*A|jY84ch?irg5xNW3hjxV7< zxQtBktJ25eZC=Y!Zsg}`$jSi;?_)5^jd>U4juJ%h9+#m7;ml#5)cF;%<;}Vslwwf) zR8O+nY1BSCXWQV+rs~1``&*e)2usJKBKP&!(I9#Zd)Z{VZMYX{3&+`G^nV7SUtl~2 zq<46E#&9E)(VbZ8?l&KvsB<~`gkn?NIxL0>9?FYW-UEklf8A|}bj%~BnZT!;{!YVE zqDUss@zRIkZePuOkq)B5xaOVpv2X=q-H}-a$b2?Yphudq1x~R2z-Ax~Eq#Fkd71;= zgo|~Q%EEei?*#oKFq9dOVokX@|MVO@j-o_S4m-o~oJW}Ig5vu%TO>*g3zWD)oMT-w zHf!CBRhIQM?PKeX#eFvAU#NQ$9z9m0vE*tswWNK#3-++P2}`ucKZ4mZCtM=EzF=x!Jv}_Lq(c-b(UcuTqq3a!EGdfA zLyR%dk89t@)r;q%g~Koo1=kijN4JpYLbEvDM^nhHZ#<{7;$%~W>3Vt@Rs(G6SV8*p zbbxm;;8H%yhGyB2hRP1Tjjd=xmF=}NN1Q>o1R(HKCjiV@5u1OindzH zF%IK8V-$soUDB;#ZdI>a$1LrFaM7p0L4!^J;n?6 z(#aYM?X`M{5c57(!e+Bw-qwf`p#Xxy9#K?Q zj&z(Bo{IJ7d`me;Gr=isxYL4mmo@{ie08z3fV|9yDVOy5mhUBn(gG1yCQF-+dg*A! zb$!uK?hk+QW2UTFS(|#GWl&HYMCsH&H|AFf)V!XZEG2q`(;mj=cHZ1b8O8~^x;fI; zEiugZv!(5#ra4dXm+00N^^|L_#tKP5{-@lHNTw|m4K3=9=@@(pWb9(DqbG6}MwE+T zw?N=YKoYkt7ei7ke6VMY<=J9@<4wm>vZdl>nzKnbH9UBt;m|*%6|fLI2fN1F9jD(y zzZxVNcG%>>J=4Xm$&zqEV9@F$kmIPngI0p326Jyy_yf3j4&B$6x3GseSHz=X=SmjL`-OjtZ8ws07T=!^pN9 zqrxT0CBuktORFukKN#{@ip@x|^v`u%LOJ$IK+f8awG8WA2L_qhln1DDqM|TGPe07M zpli0OOjHj0qbc|3MVW3yvbPFXMeQNdyQNrLTQrgTJg<)naj;(I^|gL;P>=w1H4wRdqS)&sVy@7};~Wh7fF-NP#y=eT@zdGQL*ks;t-WP!!>#~x-+^Yu0s zlmc&xiZ#MrF)k|$4b=t1VlZ5w6KKu{Ze*Tti-pq9r?A8M$>R&2+#{oc1U=w%+)lx# zh_^=V8bClg5x^mdvpk^d+k9xt9F1_5KAUjqkPERdTwQ<&+Zdi@iXZBo7bl%8787jd z3Qk&Zn)G4|TZ|aKkYRMDu@#=;LVDg`Oal8_x#g160^*=woRBCY$|2tAdf3y%>ycaX ztpt)u5i#ikH4GG&(rNoae{nCHWCw8e}LKe$ca1a z8-8JNy2$qIp6$(&11#|vr{Y6wfXW54&fi)v01@Dxpr|&T-S?%sKg>bQ?Bur4DGSn| zH^WKO3kYb2@kg!cVlV@)q8nuA+2Nu;dL^(>_ho*<6(Vix(5vi+hc1N;&WNo1!HO-}qm9M>NE=4-d&4G6PnzS44fw+$0 zK#u+#2ci;3cw?0+PlQsT9rVF*=%K!qUv)TUiWxUMAL$G@Z@BkQFXfwz4<|jzn~KN2slwDQv3@=p0uG=p2S?d;gak5huCoT0oRH zy622&XPp5MAM9CO&kn9w9$K=?&_^fH4U;9EPXzIRJ!>(pN%r#WHjUyY!bM-1MU7Y8 z2>^QYA?MXx{HWecXPzKVqaJ2~NHOZid^f*u*FGNel8Y)I61b`dTc;x{!ob0O=LRp^ zC$th`q4;x&zjiT%a)ymNO)b_m*GDMF$<*h`)AGs``iS@Eb`MJ*oT(Q}u*9=_bDpr> zxZuOjni{bW_dZvV2(!#bU-b>Q6iT3&lD*iAmX|YBa8vl)a|S zTO=ZTev2Q!G8Dt=@UJZ;tk9dw>?m~bs*bXxiwXD@(^+M8;Y@pSp56W#i6AB&Pv)SA z#S>ks_vuz9$o0WD%bJ9rR)i+73(Y2k1KdRho6w)ioA* zbU@GE-hx~SF=ldjTGpP5&l5ggK-qp|zEqV#k zMS{4GuvKN?Y^OQAe2lIyHpVp9)V6~aBIb}XT`J@(w~+eP&^(o7`Gl2}tztIDL|w<# zVsMHjLaIP=eCZntTE1;6*3CTSfz4%ZWW`2Fn}1K7fx0>urJ#MB&f@ip6H91q(!v=i zPn*>pGP(C)e?7T3<;VSd?yAQ#w58Q8&1_=dUE9FmYoGED7hENrK6=Dc9XBRXp{T~s z6F{B9apC?2FOE+fL*>JHd?Q8bh?}}C2{ z--jtegf43Gb*bx2=sX+%M_!z-h|)cwJ_>V=3)MLgkpLE&alMyGz4^uJ*~P`D^sOFG zqC&A>Ncx-~125f2)zWol#7oytE-!-UtvlSLHyr}bSF} zxexS0^AsQ*+Q`x%)@3!fgtN}9JH?pC%+wO=74id)7H)zRzFfNIRj~L z3h#bbhIG*C0P-|UQ?p0&ONwg(d~?vk)LxPHp{C$l1Uj|!*` zgkm{4g6)YcZacol%LU1p*ZQMWU3vgfDi?4WmYlF<=8*T}w9S|nLMhNZ9ImutAyDRVP zysS>Pw6pF47M_{M?wWfczth~9C6G#jn}-pXWrzHTQ9OylNY5QlJU0zRx226W6orNn z9ob82X23NY6%)=K@xZp>QDw??JI4C{)~3vtpJy-25A?2VOPx*uS4g=IEAHSXQckj~ zq3$sR%r{QSuWu9c-s?R?Y+pv?vvDtvcvT3?tK1#dHH$ zrjTqOlI1hgTxc;L>+{xQJJ~_e=!x>VCzVx&7X_%onk~6M8BG@>I;$WD9RuH&{=u?1 zX=LCCmXdQEIuVOloLxE>EaebiC{AOm*y`@1_#>HQ-dvk?90SmC3gA`G zoT?-rwm}}GTe1y+A<9&&Y@su`rWoUpzG$c$*z%5($vuG*Y@}{yz}<-vd)(0`gAB+9 zN8{q9CrdiOqH)|t2B}#UGr?K%S#cA>mjKhnv2%g+gAJ&exi7T9arHMwy=?|Gl{ww7 z+O>*G12x?jpdK1p;UdqeD`qmgSR&uPqT5bUN_+>fC-gCF?A;bVh6A6-UNe_N!g>th zAepn%nTuIBHqpAMg_VBNx*A?sA)Nuji4cQvN-j5f9$YWacTL^vAe8nxphp0l*1^y# z-`QQM`N9}h@O;l@4hCbtxu+Nx)r zJS(+EOF2i2h>_(fFM7Oj-CVf{351-CCVC-Ybc@=KGT-rliJVJiuUH(p__vhU_ziSp z8Esdtsa_Z3;^^q+5|w&w?ndB3_jlAEB`n_qBO+${8(s|HRO9amSa6Pw+9jkIl@EB> z9fj(;CZZ^(RVh>9aBG^=;|TJEXomo7qY3BOA-`Yk=U0AClnrbZmTo9#sOy2osc~5$ zPh{GqjJ0{q6ZIUGpc#)p_VDSd?Pi)Z8O&xEx|r)+T=WPfHng@FoM!fd=N2_~n(}QY zIuzJ3cX~ZEF>-F|p-O@GWR?a-Mz=(koou;-UdqE92ZwTdjkz&XJinx}q?29`%X7Ft z+>5Q4t%jjc{@_^-TUH|yyH0wBQ$lyr$hIvVv96yS8umvG108e@>FkhBnL_W`{({$B z`iK*yqY!F407+p8k`cE|C6P;OpF7{zU)sR*<1u{%ifPfg874~1g!v0lD09f2JLkl5zbArf(3FVzVNQr8}TxX5wO5AinT?{L$NIdA@f-1dS*aT-~_`TsL|+LwY;^V z!sxXFCkd{Ef6U8g`BKtAiTpjnVt>TrW2i1w^e8}5U}JMC)>Cg1v-ciMpFkrrNPRrJ!EeOQvWaVbu_rDHB;eik*2A4uS`;J~#;A z{e-*VqIYxrsQd!VAG6&pc(|96K0g|8h%NZPC=5&xcCvenY#A&z8(LcQZokjFdv^%d zr+Jb{ota>!C#4=W2ZxAMkKf!Qhx!(4@2ZWlj|e)Qj;4Zm38d}(D59$x*F$Wq@RM6l zi~0hB$SMX@3Fut0++p}9zXoxOwG`BsbR54P1V;EL$cS?r^3&Xb4$4~Ht{n^Qx zKq%@VQ^ftEp8~r3;&rmlx@JPF; zH8xlOXUj>4qXD8>(rWhF+x^Ymz4qpAXSb8=uJ?AfcXpbao%LqB-3+S>%V3dLMIhSX^8LXG~`l-CP zyl9W=+{Wp)jc#JAnQX556ukq@7#$uSDTl4*&N>xMdK+8K-Oc_^duMH9GuhZ$-`?8X zTWjvdG$Sy~P$*nI2%$$QXToI+JvwY{t+zKiYwJ7B_3i$4ccZ!0Tko%}ZFG{P)9xB< zE@)<0ZDHs!cwtWDK!w*7Jlc(N7!}vc^fXW=B^Sdd%+<^h8z&Luqi7aqF*gsvXE+T| z7ltTypz0z}AC5DT+-{8g!R|RQ2tAIblq7-;s!MQvhM|5iAr46*ga8Gz&~WUGD#W$A zV1Vkvo>^~nBG1w)`~X1IV4R;vs$;5|m3+Us#5_RJ*X7=EzWHL~^^iJV_T93ozKd}X zl>GGSKwgxiCQ&O_ZJ`ZhC;+wb@#aKkIic_+eDz9QohPVN@9B-%ZODo5vO2Fgms6FA zv-b5NXeq_B3ryD!j-Cb_6cPE*N+W!5rG`FOimbwkIm8cpv5gmbx!4j+MJUN{jy1%N ztjr2Edo<3n#(+C`}F zo}zNHdvdI?}XAjNus}wMrreB`VzM9A3rg%LD!7;HlKNroXJ)7~Rt$wP1IK&Z#VabyRN?H~c?$0i zu~%&0Bew^=d-p?RvBUuq0NI$!01!3`+RRb-a_W46JAMM9h{TQ3BBtO!s<`7=Zzq*zxwKjjh z<>q${!u8Bu0e|UeHMTWWHH-iOiS53lJbX~Ozw%(UJqN;> zcd^5qk3DXd5ptT`uOwgxy9hXEZR7J|b~kZdiGwO0<;5l9t1Gk6G_ik424j5c9ie3f z+i{PW7uN)$tJ58(&Iu$`$XGErOLM`qaDR?}44*9te#~D1y=8lf%cq6>`Y6HL*5}ch zwUgj=MNZ#YV-VSXUKG5;g(e!c-Y<`f`(Y8c%X{*S$7mT;dAc7y3z4AWa(~CIldq7P zn;|`Innv@omW(<*6#Ef3pBPPwCx>83o!gYX7G|gjj~Lb!7CL&R${)lG@)MSr!|sIp zmT~L&#yNYTyLWv>c3scAnS6tu%@tzc1NaHA!X)&jrRA} zKG#=uYAGiWW_q{_NKpXEUORL>zoaUssQHRsx3sR0!s>uIv917+{doU26C#AeGqvHI zQEJ2KmHP0j07K$P;I%RS_8MW_CT8qr9%? z*M$)->!U|Lxca;3$0Kl;t5|qNXtdfDq5iB>&BKQuRDkdTVT^-UgbM<$nq74XGz9fX zcTs}#3yxFV><7Uhie8O_7bS%+1Y-v?bG$Uy<3*wp5Lqdl#Te>HHYieLa&eI$8s=Zcc+FV9XMMd8uC z5#{MSHa5yO+iP|JIO?Y<_ID1$2PYfFD!Vh85i^>Bb|$MRJZOX{-p)Wb$33`uo`7MQ8ST)k7%6^cc=JG?T)e7gFo%YbNg^&GcS>87Yn^=KV2!)oX1!BQaJAN-BB; zR~s1W53!-l;<+tw@%cK72NSNh0JMB|`RIVs!tk9w<5kGT)rFO@`ZDZvmzB8PjCaVW zjFoDM$}>Q93KKYIixF;##vS~8d2b2eC*>ToJI8W8X|w(1KoLb0W8cLSQy+x_53{uA zoVFzWj^!&-fw4Wrmpw|j_eO$yaL!pOsqk~u2jO9qrIM8-zJ}wxcmV25xDChPrNG&c zV~G7dpa4R}^x~KFM?CqIQdxgAz%!u3k5)W?gk-)65ANB_y4X?lXIQg^WUfp^a+?e+ z8t$;#D3|7tcD`!tBvCTFcy)0UZ<6^QiCchq7p{naJP*0Kx|IsWi3JuovS2F;b;(No zF>FuT?KU&6l&sVtxctVq2YOs4nH#OR2_S%UJ1I{6LNY&GaTAniGMq-;tK3R;!(Ai( zHL-CCxmEo4Fh&dfbfRdiNA($Izy&9jI%JWeb~LoWf*D)dx+ORp?Ew@grPdt(WG{!I z2!q9lk3fj88`BbF_RuQBMIS~Df1dNaHsrGSOF!F4T}d|Zq^Cb@Vc0twASbNa!L;?ooyf-c6Ao;fsU zOgtW$Fu(7#Vcx(zb{3GJJDn!IK~{mv@k{lK}61r49jrWIx>Ll;5trAg6I;)O*&tm-KHqw?ABU?>pk@X3SwrVgW7 z3Q#4gVxb@6jzSf^jfQqMA>HCU`Pg<88n-w%#{*;Ts%U>NZUy=d<0-aOrii$s0MVIZ zMvry4I;scss_vUiCGpOVzu~TFMBK_LN@IP_mRSkelrR~f!8byIAa8^?GOi!)x54MgQn>Ci{fXK6xHH8`5{>mjl^e6DEr3j8z(33ds)|^EpDqjv zM>$AlRgO}Ev=6LFkwtmbNHJvl0QWL#Y*bO;d4|{v#QR26QQ^dmhCJn&###nP3j)W_ z+#Z$pl7hXI0{3t_Qsh%$Gv-iI44KJYEG0}Sw$lY&I6<6Z`Un0g383g7q5!UrHC$Rr zGoIq6dI3_2nG4x=nx79c5nXx+s8(Hkiax=$e9V;31h|~hS)a2}cqhgZ}JFHluIjti)TrFC`a9602eAG7JNJ-2%aNK z&-In~$g@Nx*4>R&`YOIJ@h7K9za-12_K2lBD5ElyB~_@JhpE5;KmwJKBi>#K2dbNJ zic+LRj&T_;KYhu0aYn`imORZtK)!VQ95 zh(jk3v6RnImaBF-Wp?kNIlI?07z>zeiP^%Juo`tWFJQV?9VyuL1WRi(>4PL5@6 zEP{*=2=3hF6F31o-*;(ovS(vn`P!L}AsI|(Gwvfw^oYMNNIwRFUm$hm3?AI`$8xuj zYC-caDvY=pWNhfYs0Q zi+x}`yoKnqpI7tZ3Ges-gK?{x6DSmU_1t))E22;?)iz$uFpD_A?(y(Z*yYQF2hT4q z1r>-w=hKH_x)sTIWk7+_p@~$>a2iecJ(gpiARQF6kB^R3H=ZgFE{q?e5RWM0sW+BZ z^9*&%ny!C(c37>B^0NA$ML}6ay#9n(qcU0qE^D$=z<5~GpDw}(!bMJ3Pfj1Po>i;s zBf<;{6gNT9!3OHVsG1GzxqJw2^k9k$NV2I?dV#F2F+PUY6n=FmNICqt#52@ zHMe)r-xsi9zc|dWDt2)iJVPhIElRU=WECU5d^O7W(#cIRa_l)rcxON7dQ`sWZbicfj$y#q9uHyScf&*4*ngH@HdP*x-P>wX?Oe*6eQi zRZb^Dk=West#2X$U^=m}-rQc>>u&6>Z}08x_PT2uYvED|nmMS)&QtgH_WEXjV|#sj zV`F2p+uz#V?d>Jqt=%M9-`q%cigEx01Ll6nX0^a{WwX83Zu8i@)7#nI>L+VE-Q7O- zDcikG?&U1aV4PsOgsIHh+V*yPeQ$StcRN|%P1e^s8~tXlyVq%MZ0t0{Q{4!;uA72Y z4E$+lqqhUv=H|}YPP4PuU)${W_jdP^ous+eTu&mJal4mJxP|9<+gsZpa(k=U@2+=~ z=I(ZHdvASrtKHvfZwAv9U|jkj8O|r2w6(pq(eCW@l6G@%r@h(T?liYm(#Br9*~2iU zXb+aaI5!^8!NJPmJ%lf#z14a8%B4q5Rasyimex^)m1nNP%5$=AJ9+x7k{yq;mFyH& z&MwmPSKY+H<$7dX9jy&@Tgr;vWZ4c8ZT2c3-jB*zu|3G<0VN6Jx!GmFenBV2nOt5x zj{+iTLR8tJQA*?%k^{{5&PkvR?s2@PXH=Dq3o{2-vFL(A#hhKmi#FZ@zn~io!@5)mV#HdGN9YElO9jZ}}}NHZ@R9OgLLaoQtdzA_aqjpmfcla0wVlSoH!- zh^z=ORT0nSRx`?VduZMEdG!Php`a7zvO|*~Y8#L5l{uxba_=gP3}V`{43=%7)y}mM z<=*vimG1SyS^ws{A`pdK4kPIMovp*gn|$RU-%79&B4l9=nvrnz!0R8LaM^|nWnQ+S zoD@yS3TeKC>0WPpOOmy{8OlOknV~PU(CQ!_UY)OVFq6bBE2`rIS!Ea9=wf|S3xp1A zMlk#oP(hG}Zb=u-Ka-aAp~Rs!^5P=MVJ7?pPwI6QJUx_W-pIqep|T8Pf~|s(3AU_c zf_)FIto8ZLS#7N^a1w+2-KF&dX|t|TPWjCF1z%2jdH7svc9@XVKaTa(`9fVAIyso)X z)H2cvFN&(li3+W7ngT0)roal9Dey{I2-01<2zpvYiz|a!q>eUlmmUYHm~C+NU!)<& ze5Jy;npacA*oBjW{cA;WACf7Gva(d=??DSc69QK7s>GhMxCyz1a>1kZkhfNy8Zyd$ zb_bJD()7AA2N>I8&h2k-GD=;Zc)8A9pDdxo$M}p(=+25Vm$Y;2fK$LQHnq)fd{)oYIdXLEf&SiOfmHEmjA+Jx~#o!LcP7Xg^I75 zY>c^PGQswW$pyy@tDGZY(50!_u9PslHlhpT8rNJWp(1yV80TN1j7fqIm(N(_vLO2T zV4&g-vWKrwfXfI$(@iORv*~F}+4&rk647*yuSoCg+P%~9RJ{Dg&k)XV+&Tcw#<78W zZ!hjDZwT{mBKEd0(4z4GI$d_(>Usq3$8`g~%ruFQFkaz}PY;7h>ybSIcPm_i&}z<-NE+b6cz zwvF&ZIt?jPI;cMB~_2$;@=7zrf!B?I(8jb(yFTT`x_m^L4{G%Ve z)HptVsqwvk`=v&D{^iETpMJUV;XnCuN-&oACZ+y@gAAQjH<^SM= z#vlD}A2j~-J6~&jCH-3CpZ?L;8vp3u{95DPzxZ0?FTect#__9PZ=AjIjmBRl-)Q`k z&%V+4=@;K<{MoKivLi<4->OX5;H$e6#U?|2MzU_>afmYW&%M`K?C!=5IFs*6;pi<8S=S zzu9>3m%rI~<$K?5{O%uryK(nVzukEA?cZwrNB_xhHPYYtPUCMKe5di1zx|!Y-}%Si zY5e&ge7Dg(`flSNoP4+Oy(iyo{JsD6yN$cQ_r1pWU;19-D}VC6#&7+__Zn|L`0d7n zXTRO}v&-LZB(FCbFEw6ne2IUrH14>cFY{C1euK{)7yEs_`B0^8x!CV#A+5$Qy0BLo zZ#Mop{+haQrC0cX)W6vHg~mILnWKBT@pj`ALZ(HIt;V~JSNYbWq!zzlA;mlV{VJap zf9dzTjSu--e|?{jPx$*y_f281@$LIA_9geb#osTvGz$NO6s^Wr_$?}>*FUvRW!{JS zZGNiMw+PY4r&FqTh|}*^DE|}wR!EB;(a*blyW>7TacNZ3Un6D9rF=Rf85`?+~gwtF0>IZBoF)g!%R=g|F)yjKQmo53+Bn-*1pwzm>v&)SlOhdcRHT zDe-OhPbos4qEv|b>_;wF)%X=h`%@RA(N$^hGfoIE^k7k7W^zh9$n?+~sO zN~aNcr}4Tg^QXjm{(76g-X!b}@ozW&fWO`#{ZAU3e0zt#-+|*kSl#X$@@pW=|8Wzw2D*NZ^Oa*+jFf_t9}0C!`^gxDJNgXmuT51l;Xq1&8n$J=j;4? z#r4&fN&60A%3C4t@Rvf~bU(jDEoc0#T5G&i=Xc5HHCq0b>&p*VS$t}>MRWJdq*vY4 z{x&`TYlLcsy~od&$wA!tifhjs{Cu5MEokmEo|3=s-=|P0op|F7!hcE~6#FyxT|A(g zzE19Hq0+tK=zX2lBOg${=80lntc=5Kv}lYioQjqaN+T-@~ACTjn#t-;g9QqSzUxMlf*&6o)QiiNEep*Ppo(?hqx92S=p#~UjNT_kZGD%tqSC6Om>rk9TBO;cI^ThIn}6@~P3;q{eyUFI zlBam&J@@Swp&j$ro6xHFwHIoRiZ9=C)PAPF&NtOav>IXYf*-*h{`w>f(WvctB;oMJmOp2i|wN zyx;gmzU>g>_b%V7;;q-{y|*ae_lRikz&)aTmA{qF&uzcLen^-`(vRJY-|7cZX}o;T zw%`)&D&o8uE&PzWiZ9e7p2rpQE@g_}ccAlof^yY-R}Iucao6kgl19vzq;*gE+~KFv zsBKe6rLY-!sh?E$8KbAUs2ug%*G&B6YpZ&zB(1L+D~-DTsmI?YpF8BU&0oq*by8aO zlEz>B@tALF!8R%MQE#g(air4!%yFVPL$N+rwOT0^??+Vpr0bDzdUyzfi)b-Y8( zH0r)p+RYRzj=$qZ^bNk{eW>61rmWu2+&7;(?;laA#j1hlBemD(`X*!J+ooBqyuRed%J;sw zP-FZ)qy7p%^VuLS7e_1PRrgc-kG|y}$%lTleGQe?|Mi}0v%bAg3sn=1gYRk8K!5u( zef{+_|4XZfDBpulD}&OC!k6UZJWs0cUuQ(ss~UwFe|uhkpV3rGKbCpvTCtRyU*i<7 z5%x1iEz#eaGdY)N{Zy`6mDHCn@%wGZLE==6lJ-$?mS(YEF<)~O>Nm|2#cSu6B&Xap z+w_-YH{UC&yYK&d)cMP<{CoU-jZoE9Vd5EusW-%@x$Na@=XY|g3x4Fa-i0}>J;C>% zU$Z1v`Ed}xt9~j)?b2_hQP@3KrsC8djk{)n-#63~T8)&eK5COFJ-xVF-}3l8U!PWW z(_hNjbE4Ab>6K5&%Tq{-)n7h;)m$8*RQX4}pb=7g?zw!`llu6v^66BHKBCnK)O}tf zRK255p5AkezDpkU;l9W9w{L^eij$Par^s`VRHVQ4TRow&{r;pCLF2A7)g$*$EtCYN zGn7uplF4=Ad$sY`_{*O}C3k8+)k#xl5AB5hG@!YtQ;I*szvbwB4*oRw6GD`W|EL7f z>zgEJNsa!*r0)t9AEJ(bRP02UZrklwCYElWqcp_`s!ZBpN`*T-1Bz&Go@rS@wfh|41IJC zdO17S`ZKHgLopfyNx1q;CFs1VS)p>2f*Uq|tIze#pT0a*e*U_{&59^|ymI&F5zY5J z^r<_CwfU*f@A2=)eBR)$km7h-=`9~D-=d`i<^Mv>(FYtMcjP=-^ z4Rk&TpFiM?TK_rVlp8)jLk25KHukO{)w+-J;*XW2(w+2jqurObe4Ydd9L623Uu4=A8;F?&tEg2f3e{|Hq8IMgLIyM%CXy=V*KZK z8~W@OpIz=V{b%0TYBc$5u_oHjdZYUJcH`U3)A+N|*l7HA>GQpY|9rFYt;RoZK1%uB z=<}UM{!!lHqg?Ih*Wo(*`9Aw*{`p2jpZr_=+op?S>b~Xqd>szApRd91@#h2h|AXlB zYlPU3*86uFzZ!iMrcizCiN@~^KDPQ(lIgO~s<=9uuQtL*rRH@BfBU*AMm5Z9S(n$c zu+SQx*IVRb>nX`x@~o%NQ~MhDu>3C1)B6%$Ckb1zA%(u{qxk%{H~`-Vydxp#Z;*+f)#TaHtgkf!0B|7`OW}j18by>w`YV?wuJJL4kNY z9i`pw5dEWIzOX(6&uTgZ7v?Y|#3}c1x&WvpfIhCzdo%pLOQp;@<5tD=MO^|D7J&vr3sh- zZaEzS4|9GIQcZe;`E-tRs>tW&240WHxXA!GEcD05WImmOG%2V_lR+xXA&No|r)#h@ zH>T}zHxZuK{Rbg6u#&xAzYVs~MFG|nXX7jiJpt6aNq~3zn1ig1tvzb<+Dd;okV_8G9O?gyG7^BwB>2avm3`98m;Pmni z!1r=d<=L#=ZI2fjpPIJJafyxx?RE>eypVhuFz)7j0ehtAd1Z}A44cgtI6)qdXDzgW zOjfDf$k8+!0h^nZVRMeJaj>=eS%t$YyopLIAWE~MC8kprb5>)lz>2t0C@aMm8^y5( zZHYl{ikPir&LA zXcOyT-pyOAI3UB!*-|pI<^Gk4WIgC4Ot(+Awt{We7Cs^;Q-;pbtZjS}2;?k~Jqu4{ z!*(zL+nTa?cEQqWeIDh53+nlN1jk)noS7z0@on1yud8)^d1Hdp&LG94UOpmC%bTRc zhaKi9z`>n_>CKb8<%RCv3cS^ z9dIL-27qI1I6W+fnd8>Uv29=zzks+k?srmh(xy}7ij5f=EjaFfO`QF92yQ96=O$omJ>t!N#-H!<)_akrPGwiV!f z^&IXRJcQ1wAxM+K2+k8!jwN7~Y>&tNS?kfk<#}+^*&Geq?M0XF^DP*4=w;w|+ikvw zsnf(WNRoiT)32C$5nUIHTyH+6ZVqU{cHTThq{ax9i%~!`bu?CTf$P)oUoMRj?!uEXL?6J*xf@kv)B4RH& zKvXMuViguSvpMZBpTW|w-8{#*wl~)b8jn)jb~eDI^TiNss?GhaZT=4>{xc(-|9`}t z>2};k(x&HP`T}Ihl*C`GDlCN^_(;lb&!0LJS&}&BHe9^))z1@=2_O=MD$?J~Idk0I zc3a3wAeUI*c;l$8+D7i3ya4R|6FGj=Hf>%CAMVck{cAPq)1$V-fXd5Uj5Ygt-4fyz zEcC_s^|KL@M_pX!4Hak7;W~IeLo%b*7SF-+A6H4aOtA>{Es@#svZJK`7;zYvO|5d< z{M^TQ*{mq@rss0DeE)v5J@>cqSw~e$C)I`*xcuF8ME;n;P7nQ6y!h+=5tPBh7VK^O z^D(1q4{V=0_tCg#AM+Grtc1Udm-_J8yi^W7o)p9^E}_Y~9#8g1tehI7Tz~3={XS^X zD(o!1g<0?i%H4&mfiW%k_lNlGKcc##Rn77L_v9Pv8ouNe+jxC-a%^p&k4;&Z9rTo# zn@^UA?_<-Y%XPzgNxxwG3hf%>wOQ5DL5V89aUuBwsP>C|vHk1%>DlaV7e!POa42N< z+pF=ue(Vy^^C_Z0xQ^{49TdO(mtL>g^600r0Q?h8ztd%kxcvIS+CPr+c|VyyDsZ_L z5B25l_dEJu4{!V_D)1X}%$7J=eOa6NKVgG6Slk`Q=ynU!&^RXMeN$-;sQQ88{qc{I zRTX1^P!*La-wvGz?H|?!oe;&+iDBbJTfwV;F)rVygk~wLf{p-ZG^C`6(hNmZ<5PmsyLm z>_@JHKip5tO^=6ixu$2X>@)RtW^>ZEq`^EJt7r7<#b%-QKLG~PNn%FT+baTIAT zzozp6ymA*e;~VlzIZcEeBN&Yd%qCE_(k6J@i>v0W36>FkT!>0tM6{`*bNcvm2iiS+ zg6m*+oVpxjIGx&5m0yX^zs}(S_RbCE9yZ`e|h zcPTfb6-b||gm*1rWI%UJem=CTKS8(*4{5S;SJaB=PY~qN$PEeUm+Hf~kyV{n%e7E? z45nmwK`T{yM3wrr96gUu7(Ow?b_?hTVR`@gzs8@XhZ0V4K{Q9~$v~FXDa6AiK9*|3 zAlX)qqXaE{wwN4xtIOw16uA_c!b@JaS;Lnet*!%W7KI61z!F`~1ri@42@ z5BV=AM=zZ2@tfM3HZA<1$cHGgr;1}H&BhC7sD^*SM!;BWHY~WBpJ{E>G_jawy>FmJ z=)otFllZHrW4kz&Pmt?a%8{L7=oWhg_ z!g>ba6}3jwXZo|oQL|bdc)@sli?|dje7!`7FZ-d%ipxuUWZ$yEw5ZEymJKS#1Pg#z zE1OMNFYAgHTe{T#Oid>k{g==1@Z!?qXwScnoIv|D76-9I zjh1kU?GCS#jQA+JMym^HM>QS`g24?P26{hi??;T{{&2^nj3`K~LcuBd(Qf<uVX}-`R$Ml$UU#znD zOosuyl6dj-`!#Kutd;ROuaXt3?MMMn^V%Hsg2UXbkr^jPJ39O`s(@vsGP_S#B^mtsDw3SIqb2Zmc6M`x(+5%Rf&mYfa-l0Tu6_3y1K zXFcJUH}5`Uh0vL!EEgz*&C}!a!}zWx7IWOtL4CD6OW-ImSGnwvfoti1q;B_~Q#g`Z zeJ(rV@h;@GM>d-UtX2gvFETieq{JToYE2X_!&W*t@xQQO`l!OeK8v4eF4L+nA;Q`? z6Z`?z9#P!`TW;>MCgwW&mXM87Z6_fkHCPGm#r$&=os4GTXZRCZHd*5&d&J5Z3;$db zynvow7dw4If@499G2G8@>v{H>AW2$R_#@*P4n^5$#2@J7^0{5-$r48YMJ0vLfoN(W zhA(ll_RbJ&3ms56%xDAeT^PZG2+fN;)o|DB@|c4~Otyv5SnWIZ&>DEh5*REcX*K`J zdToQNd%TLEF>i?P`OZrwTzZUWAZOkR0lR?mYhtjB=lFQl;7c&X8H5vafIqFORi_cc zHGZYo>nci6V1LcMTDvO95##7=FCXaB@cSrWk5>elNOJ7k+ttaZ@Wp7zu&jxwElTN$ z^yNv)+57uKqYyluCY6(K-fPP*sKn>*qE|;@a2#bAsWI7`y#wTP>;NH8FL1KdP@dep z$uNA|Ty7sBs{A_sS)9=P3Bjv2&e`cNMqVA$cA6*z5jT~b zn_u3W#fwSzE=xr6Y2GDu{L{yG<~M6}S4|XV@2AOHj0VGTTsPSoO@cU8uBhAJug$OF zisVbwhBH8{Wzv}-hGxR2%9qW|FWp3R=}d302ds=)#BprZ+OSAFGmCHIE(95Dveeh= z3GtN&zMcUlJAaJdBSGfE?e&LupUht8#I)#bCbHqcbsjS_$8;E>ttWTo;D9lBeN5wF zQqr8X?rHmSb$|Ew?Re6PY)JzfU?Ydu-cFyzWJHO>U3bf?D^hc#VmK}`jGRNC!n&X* z2T=ykebh=@seQAHT(onO-sRp5_tUuW$1q0|GHG_4Rq-vEHjhrOm_=MyqX7UKkee+; zlO0(6(HlD^9FfTt+xx~knMpt~B7yc3H+xIFxZCZciPQ0CdC7Xk?p%EQ>E|(8evIRd zvf~{0LfG2g$7NGsun}ew+Gk>kk48b1@fPzI)^iBJE4|dA)dgy6I_kgsX6n zv+_()Et3Xl$#?NF@9xD#fkf%Y#r0kASOYN{ymRtm=~KLQZB0&&+B;)u%g+haCZnm5 z4@%W-%=Qu{=ta9c)8%($ZBLH5C8PbvFU4=_ zO&LqLz9fQkbx)}HF1o*c0Go3+UPJk%2GB=>Auh59%HreQ>mg5Z0Krp+AGaDM5szTm zA!JE_P2vQSwSrlH4BhIpv?t8Tfv=Q5QW{0iJd}}DS`q>{IXZ0!q&+;||ABiQ{t#YQ zj^7);nCWT7WGPl58Da4b`l#-=o0q2_Cr7R!h+Tcc*KG^w-y*-G*$zu`^cC7k(oCZo zl3&DhpzUWm?Bm1l8!`QZUrJLFaM)1Npyo3_bh~|KJB8*neC#dlLsM`URq1l_>65xZ z5zfTP(b;rXx{#Bws)F^foyO$t!N{>9WSJg06c12LcA;U+Gc>Qm)D^BpIrYiizEhvk z#Ezf}3W$p)ly`qVN<;ET`-xdnk)i?Pfrm;!3kl()LcXEQale<^~UTBF(n4Li_ z8ZpUFNmrW{)~l|#Ck2~|wh}L%*k-eE{Z?c#caM4n5Ey`Ly!b)m2JEHZmAejOc(j|C zu1bk8R%om~>A+HjI0<=(Ol>Whe}x8}9I4DYn#wE^9e7+II(RBe5VbFlf9RZg#_T52 zaT$=-id@lfLPO(*IqPfIqJQz z)oAgIfTvwVR~E?I)#ClntMubfpO1e2`1#Z4k7*o#c=zGm=MVAwBciyrdju9sTY~Ds zB3m5O^x)Ic=bw*0y!-ee{`~Gk9Dn40j*?HGKExD#vhRV8G#57! zG~MITX5xst>kgavU(egSC+H-@->Lyt6L9ClfPbpdJwrDxF9$Gc393i4 zyrYB&6OQ^^PT2x6%ic!1g)LgzPzBSr;3r%rFMVpi{;%z&*M&r|CeL-GObN`9kYUeZ zX6Hj5?k|6gF1pOw(&U{mDnJ_lTgw}MFo?y917NvpKc)Eoq+D=LeG^a^L z+V530w^#Jyq+tYxi_@%6FW2sHaB1|21n(Dt`OWBYy1RDaDT!(z#0@{%E5FP8TiU+t zd`C?W=@wJJ+5UM(w1Pc7pU8ANdL)#0lsIn=nzm>EX~hc~l>mA#h21H4ZCt{0{{Ofi zIdUrlCI*P+;o<)A8BX!bFh2JYNRCMffYpv}mb^Ly?8KoYU8<1yJgBM`Qrt-8FRN`M~%e{9;{F z8$#Z*S8TzV3l0E)Dq!SXf2>p2PGIV0tQIr~N24Nt#b57E+w)eUEI)0=fFxHxCr3*` zNHl~%=$n52~Nsy?i*IJ0Nf9q$KT@ z+O%7eKL9^Jsty}k;?>{U_8w$QLdnf^89vxAB%(-|mGscqVjM+9LuQ1@;ODLu0Fk6# zX%Va2DOSpk<0%i-DK&BqO!oW3$+6qc<;$~i40sHnJSmiTNA^uVlU^24m(lN6G!bPG zUJHpZC5jq2Wi+;awq6-O@_;*ihV(4AP3bf@hzy~G#UU?k624zehv=*n?f zv@N;q^UI8Q+BJrQwYZN6jp1I}#cN`E6`>lYKW3qA`eXD#T2U?5>q!YDZ2tP|ui&>* zB9$@eM1fXWrE8;Y@?%A}g6O^-W!8*&fu+_$wTyTGl;#DqwW!=@Jo^9<7P#?|C%fp(rOH#;4wd8GwxdMpeEuaQR{V~_w_Vs zl68BYFV6|j+TWy#wUDg!t~oyYn*ccwz=STFwnxEla_sPDHSL!^HTO6J zr`v}Y+8|E9h}cq$I`l|9a{vSDmTv(%3?6}mz$E4soCtl67NzUaxxaL{+)yK`g9%C; z#WelBKxXh= zG+YGrI^8g!@is~+T2Nm^?I-d-Qpar1DiiNbK$?ScR#hlCXS_IVe`7a82<*wqkLEI= zD5ur!Q#pwMB5nvMY;a(R(ww-hev{_J!DH)oMGR9CZ@sSe&fDB+$@8>MN{Zx0?Rt5A zB|Ue7-{c9&4i0h(d*1z;eToX`1kkZdkEk-hX_4SoV9-a40?2HPJ)v`cySe`UgLW(g zobHT<o6xs0^l0i&#lmpd@>IKqnATR9O~QkcY0d~-%$Z4s|3FxV(4-U=K8N^j!TGs;MJ;* zY6URyJD)H)?=@8oSXkN4y_np`8k1-#NYiONXL29wY`Lc5lEOzW1Ja(L-t7IUGdyOV zwM*xsWp+`T8n=FhUDtarS9kyQLJ;;F9iQxTRE>~wN(uebpZ5NA3o!pwn%6u9=dP_+ zfPTn+ebn%h{13%>pP$4GaP|P9-Ei+(-~j20ux>B)+vu#DIfPwC&0-E1WGY@JCx)~b z=uH&U7%KTi4Q~529p%0i2($y7^Vh(&QhjR5%c z6zPkZtB1Hus1}i&hkf5DC%8dGmT$X%x#3ZT^U<%I3p@GELh#8{=&C{RME^YgOBf_L zz)ao6RB-^}(*UA6eEcXu<$hO); zKGM8kT$!`SgDqhKqF`gvh)!95XkaG@L=y@vqjtFlx7o)}ur+8_-M{F6f{mr%l0u@xc4!%Lapr@UV+ooE!tWc#-GiDB6VpK$R{lG_8sN{kT4r5r*FR zP1@Gx6u0*;;tl|ZOOHV4JH!jJY7hs|cIM)n1{1wSERWGD%f14*v4~)hkUQ9}^ z!Hb~VV1G;M?#aPoPl`V`-hx0pGdpYo!V)luQ*^$613NX{X*w7sfXR>YXGc)Ri>i&= zs9BQg@j}3F!9C`^)+h0@AMEb}z9x^0*Xd671}L7iH0@7zaIgV_<`MU*cT(iwYJ(c1 z=i)`pwFW{{Exul`iO$wOIr2BaPTjO<;FkLLTf$b%>(=o}uEGt8CHrX0p_Mui_nX7> z?iL0Q5?!MuPfg4L(+{&;4${or7)BIsQDZ@kPw&?6Mz!MwZNDe4=}j1;~XK>>?RTe>wZ-0vC~lEJ9CxtC_7 z<&tyg^oQLpY3)avo&o+MVExNg^sv<3i;xu&9iXWY>NgnAVmAnqEO3wz1vo#ffdhu^ z*$)yA-Ky)dg{E-DD3_vaxqq6%u`jF2Ed`)N^%-X6@q3Md@tNhxanqh0Q~47-UT|CZ zuYcT!C-y&%H%}dF*ViBSVuoe=`@u-LWB~}K1iK`c%cq$-Jc>T6J>q3n@@Nhmi*xSR z_xkDSMU3`A&g@8E0nQ z$a4T9(gernbbGl4_R99|kuMlSXhOKZM)~rSF58ZLDa3RFOsav9v*b(>YRp?E=Vx|q z7+_j3x){40$nsa&R?RE*-xFRSin0kckkFK;32*K^Zhx8#697mlRN!H?kmSJgaR;p= z3KDXP%c!zcdrq2gqJf^#k0D%!=NbSDb?x|Tp5p88*QE6v_~YUkr!jb!Ca=>qv=dV? z6&Mk8lW*4~fr@I;V2yZ7`r;3ER=U1gxJ$Bt2q^=b;UQ3ybeq7Y?EHW!BSN-d=_KFT zJ`(HtzzZF+nnNUIp-~l8VO3o zn{yUepBN-hY0`K>TUphS67h}RHhzDU_SmLR?edzpeN?Ee3Lf6EA_ zJ}g5M7z&e7T-lr8QwaGqSpw46wNrgX((`I-@CgmHC@v?4L$V=D^rh~?$gHe3b}Th8 z{SP132|WLQ(VCNBXvK6EnkR<%p7Mx6$GFrgW z@heb8q7DAM2hnXFgmH#*3$#Yb2+qz=-9N-%>UyLYU~?0y%(@uEf!Kx1LL|{9`S&?w z7vS6nWx|7y0${kwDeDbkAFZ6tIxyh>qC;uAs*sqlcDZx#%I!}vt1^=3ly(bXgA;$i z?B?PBZu`?UWNb+eTyc7e#UnO_^eiiZ)10g$wJXSYbO!H4H`hNO)g%*)B7TXD$uOd% z2qf*4M5GU8o}IU+z-|quS$?`&15h9+%SL!net09YR;qyT`X%M6MXk%`Jm;d2Y75Q+ zQA4SM!d$o|k1A3ziq2-wVJ?xomJt2Ki;Ae4ZQmKO&{ec^TwG}I*(vb?6Ba+ z|JzM{(*=PH3elky>A?X%BuFedzX`<>=N4|hH87ZJa3K7SYIf7U5at)++#K(N(vyT2 zE+u)9wM!}^2v3gw_iiLRU9@Qh6advLJ0tOZ@BD*43e6=Rtw>S`oL^3a928?*ilwB*WEtd%)`mushy4>GCBGGM#iU&y~k+}`ry1~ko7xBgD#`R!O z25DsmwqRmnNG;!3f+BBBxfHZCD$>0qIee_(QC#9g!wb_JS?2Z{MGn#&{YhDuqQE_y zk{43Fi>xPQ+;&`#hD5fujUVKiY`jB%ZFZC)QE41r!B&}D(F;P4!Q7cc*uRK9I@iJJ zmTBX4XkAq}BM0o;Q6MTsH10?M#EH}QdNgvu-Rb~2D0AUiUKDOG%IL`tkQ{&eC2AYt;#7+Kaj;UYz<- zY<2e?gFLpD>w1x{sc|A|pqIj}-OzHJlPEv3XYGKLQ1zf(kyDMeZ=+zNqy}F66>gxP ztZy~$C*ut2`%X3rvo@~@wyUS5aTt}?Cr4LXOe^H}&vsiWKFEp!?6#RldZEj59G-_7 z0pPhHal(kxOrUQ~)l3X&k{q7lXuozFvK8?;a%zLLlyfk+Z1xi%JE#GQL}L+!%X4~5 zKK$OSfF~OcXChTM8hmv)KDT}Pzy7mL)RgxJ`n|*>bmo{IvX#V+eT*@zvRD({&*2y( zv?#^~5<(E5z!6+hNge9f@0zm_J@Ox>iqb{4JvcS`r!8)VRdvDeX-sTdnhJ{Z_i1`sZ5v;G&H4 z7i!NLhc*s|R{%4E^A-dg!!0k`4A%!xil{wF_5;ekzL^8XtTCpRBv69l9j_7giftHx zvo%JQU98Cs+Ot?CCFX5G@rXdeNCto_-8{T}#la16VZ0XF7(x;9fIV=`M;jnNzBKU| zo`mTk5{7Bf=vU4kAHD0j&J(!T|Vyo!(;CH6`1sbb5_?46i+k$`&Dt>VX!yJ~<4 z5=E;8?12K20Fkp6nD=MAkD|)8o~CHlKnx%=E2**@FU6qR?ggVnY8NP}ouj5eHU*u~ z|M1n1TQQd1{SF?4a;q+!F!HMTwLNZPLe{lX-A;YKn?0}7Brvf9JTscCf3x{d1`8up zO8Uv+YX!EY{gPG)vm`e&I5yNvRPBbs**rC#&3Xa9n~>8J^?AAx;U2e;0dFt=5T&Jg zLJD?7nFPOHbf9D;`}K8uMVw+YdLZ1k;7Ka3r1;mSsl~h;{edQ73dBD^1rRIsBpn7W>h1}koMhW3pV?)QY*SUNxA5`ePq}*}8F%WX z_-(l0vxXcy$KC7Xsqr)`uQIZ3?Ya~ZKS{d5K4&80AI4Q;NF+*}z-AwT+>goT;S^|I zMN$0YRcPGc+F8H6T?H|`x-)6+pmgM>a=zlTk^DUYB^7BluLsR_o`fK z(V1@PezE}m~LH!VX z?C?&wUqA!b?b~6 z_rDyw@r@W*k(Uzhsh>n%o>C`JA7V5GlSGhxu9jq)LPvMZ!-P*Kw0gn+ULZh;Pz$8U zLidP%+4qQ2Ao+AAl3nML9@uq&lIya_D5U8>b_OETfAQpNL5ski1E*uZOgrGEeFLTX zK+s}dl0;ule@W=cvuilPa87L@9Fs+`q<|YPe?UI~q|bgfJDgIoI6NxO_bnU`Gg}&Q4n2fSRPTRMKWhH>mitf5MUtf1d9)vPZb zRN8M=|M$sm6FG-k2Oe?FkDH7aSAUu!&ndZ$x^)7VunQX;TrG*=rqW1G>-^Ca=$=h? zcD9S&=XW8h$%Qw4P?npAdtjy;K}}!S(gw;GqdJL&`P|+{A*vTxlys1BXAqfM5Qq-nuQI&HbyME{5DI2`FRtJ$$OdrUpk@V$DVUi{yFe9W za0M85S$GuK!G*6xolzIkUyWYOUr`r#`F#KQw^)e$%gL>v-&0z`;NvPkwH8Q{z2;GhbAURpbAj72tKRPGk*f)THpwem91{PqqQ{33%_441F6f6j&dgq%8n&I;-_+1J_LGn=KIQ}jf z7by_CMXd()O8jyKeUQ+Ei&!}Nc<^*~Qp`wBqhA{gWsiKAO7F?SPytLqCE-)2RJ;o~ z#++n-caBH_mX0z47}AD4mi;rL)0#az4S6N?emIFkEC7=E9CP_#l%QC^8bZqh0c=0Z zX1TZHg(vL40<56!`G{=I4gza zVPqactT$%PFlzAp<{Tp)2D96Ai1)!U0$eOXGIJ7x7spD%DVe;#QM-^ zl)MP)rksgK@oWy0ATUtP&vJ$Y|LTg`gkj0$b!-AlMo@!5ry-3o9ZPca_}BbAJ2`e} za1Z6PFE7o{uo<|}h?O_wxz)LP3TGvIk(BiqV$+YBk0fDElJ_f1A~xbu@4R9UU$d_W zOGqHN-^Keh z`_0M(GvqNG5%f%ubybHl?_usL(55vXOd>WBIn0HW>Wc^?s!;BWS{72-)|NumGfkO~ z4uyT6H9SqI6~vV19COjE{YwN&tHQY%E{})~<=5Iw`Pg_D&;`X1rL~iD91N}}4u>7H==#!fo!?O#5u7&?eiaZ8srxDTa3+^8g zE1)Igp9BN(YjNTz{qkKcM5UZ1_&%o_O_|w;i-?wASVs2!Il=SqU%)Y!Q5eD=IXnRe z>>8foM@O-QPS7hD{5~JS&)15g6k|b7B{l~6Oo=3fNXh~$4T@&?E1ZT6kHW6~FVFL# zNwr%lwHG{IkoKl3FDHbi*HOzKd2I5$>@7*k(eZ3_&h@O#`iHzr zLgfmo=TO4?LZ)d`J0T%Rdn1LnW9b?9gVKmG4Y=-Zqa)*@uuR-O%+q2_9a@ z9hxvEx!Nn9eNj@{=HSlKilkUvp`$cdbn;nF;}d@y&LDRF5Kpiv22dN2>{LrG@9agK z)1#o}mV}&KvIQoP?MDoEBG30%I=lLffn~}hpgaJ#2htpKW&ZBcfErR9dZOui-aP&E z!Fv;eT@JH^1tD2#ThSGwqos?Errj?euOIklrM8?LJ_vpQ+mOcXePbgSCJ_{VJj1Y+ zz5+}F%ppfexzytU!3Jv^Oifg#crQS%fL5crq=?)H-5tB%(hMLLhE@JdQ_4OcB9k3) zKy=8Q8_p{d9|0@9!^|WVUGs%Iz}?A~l~gf>H%clwW^NRGIp`azOm|Hb^I_xHltSVF z+54`w?!)VW&&AX6DzBtSeoF;)zvf0y<1otN<$_sKbf$V)PRQ0dt1XM14uX*Ua>K)S6+^8k=l=A9OTsixb(` zf7s872y&x9vA8)j(fR2nK3zc~&93Ji5PO%xfF0nBZU|Gyo}@Zio2nxw+Vpt&qrj1s zq_v$5egqT`F+N9VEm%SEX7*tTm|$JkG?sIEl2Qm8P;xd(4ggIM3$w46!5KmjR$Ufj zKQr%K2_Ms8q_G_&(ZeF_Z;$u4WM{U|f8IZughDB`$qn3R@OVi`QH2FDMezl^RpkvS z;}I~3=CLVdBZ_I943wMg=qT;F!7xcd8@X98pD+WBzp*Q!m;+Ih;7$p;qeou2Z5^{d z`u``v8W~xoCDtwH4)HImCLt9MrDI6{SN~;J5iq)?WqL$N#&@=)PEZP&I9rgO_!r=J z-~B9|s!iUwT+j|M;w-UQ6S~duh3%50*oF#tNb#nOh%E z8RG1)o%Nx+JFyN3@%I}zvU2Z!CP8j(9I6aKQ^CtZW(|zSkbC3M>^oibzJVXGnDI5` z6;bOU&#Y^jM@JZkiXPR?TQi0H0Caz_7dmM$sH?XkAW8toIq_3MkUjeAAW4Bd-@w2E zTZA|^uw`@`+O*KBl8karPom|yv1oW2XikK4>0%*f{as>x*ruLOK@+EzYTQuI?2!`CkS3 z_(VL)sL8o~fdVQLxUQ(R-1(T({1?`1uQ$njgdZ`vc6L`#ziK3KZuj{bj0SB17}n+e z0hOIoY$(1cH2V4foG|L~H09L|#PB=XOV==nX4qRzS2wVG#7>83SMNB^BLT_<4bX|V zQoWOnWzpA9cPF2b!adiDTQ>nv5J2DSEAE-<8v2%Ax+KL)MUKpw-^@_%On*D@4tSlVk( z?~{>1bHSOCJ5E@CMW9h+os^}SgS1=jEzc9Gh$wJzxm+pb_m|)?n12InII8ZY!t_e?ARcAS{5V`ysg5pS`7 z8`4Lh+?}^KIX;4vnlf zhDu}U1EUNj*~w2(q)~(FwCf;-biG+~XX02z%Xs>=gRddwHxr;hP6j>>C}<`ib&S0- zKD|Gi*E#@k5 z?ua$+gq_?bhXx~$L#4@$!@QiPN+|q*5YPwQ>?z;`P$dre`~0zS70z}5TquO*`VKI= z8UdLfJf6ZY8k2AwwVq2>%-WaMHmxWigv~Gk&hIfi<`(N#38XEUi~56Das+yhr(&=V z8&1R^NJfkUGC=V)HTsX(Nq5^n&0%xF(_k8;CIzr=QyiwizaW6VDN3fI4H0!d6ikoX z?znTsBok6XM+jmkfTlKCr!f3jvDdc&l#tKHB1KKj9I9ositdsBapA|y?+%jsdT;G^=}y}Z9i5NNKth4 z6OZ<1I&3^3+FE`JFTZHUYlk6{m^`mTQ)+3C;(Kj) z)rqi}RT$7OLmYx{`Q=XXD6lyHM~;}N7+(P?s@7t)nWWLS2qDbE9qHY`Hjk4Z1BJKa z`OX@*;ax`5r^rp$b-5>&!FD*qc);(APLp%HT1`R3R(f~gfe5B(HjsG!_(HpBvBN`D z6sHa373>j1O6u%2ZQBsDr&7^S%o_7sqAQbXt!mLy{7)4`<6JCRSvKa?LG<-%S8z-3 zr2F>@Xn-wCO7k3%h@q<>!JcbvcgWPti$xU?SjadO>iO;2rS7!Oi=6r0*Ug_7=zG0; z@-OYG)5Q+ALh7eng@3ne116KycnPks zYv0M1G8jSlKtPNyiXu6(&Kt*-BQ6c@f=P-J0ud^VT#-XBa*kYW(h%$khCnvdG_=ec z%}4Ky^rFY-1E&@NRl2k}g>l)ri#;2Mvuxd^<0ASRJ2|kytVB_;-))8LTkMdUlm;v+ ztybgy6LgEdPXKb^r)YRnQW>abhEuJh+m87d+8I0#e3n7AUH>P|$@`dV9&~KRo|sTp$@yQlkWq7FFKT%b_pYU$W}6qL7?F z!G*O{jb2_LyfLvPLaG+l6G%$_g*PSbG_=$e2*b+vhT<959qL-DDrZY6m?zGl2$=CV zf{Vl13yQQEN6Z(#2I2PWYk&QxJE~9wiJ~WX3Ak~Cw-ng#QZoGm_QTuXvobgwO4d-K zCjHW@cdn}muB|L1tQK~P! z(-OQrMuztLE4xO#6P|)O*Jsw2wQmb^b`2q~o)kZ4|CwX7Y}yxV=jj5knR&nIz2vlz=UtJ@Ii}Bggc*f~B8D#aAkcCATVa|BCZlf$ zbwc>Y9-R5Qva0Hmvc*6pcpKt1u~aW{q*NRY+3o^ zBUN*2iH|`?8hha1c%a&{gFcG@B44xLhe|JQ2uI3In>bN5<(NnaT5?HTVG3svD9`a{ zZIK=%s~E-kBE@CZ>l+nw2aW;9#j5mvO%L5|;2%qUBdcFWx>rb`26W?j+W zd@M;umD}y$EpyI1T0OAz8JNcu(_m2VU?gWzT{565av*0MyoCG`EQreMO+ts@<;f9n zDtuo4PLZVD5jyPwGXM|_YjNIogBbd}vX@g(g z5QCUfYV$l@8sOg^q8wTct_Et~IL^t!2w1Khjma%sQ-#`gVBPyFw{73i)uAb;nF%J8 zS}#a8P4A`+yq|a>r{H?Q>+f`NVhqv3RZG8(9Xa#rDuOi@Q)iEu*eed{Zd1`?qTI*p zu?5dh!?BASyJPf1O-a%LqP=q^JX}6^a3;ka#tPx%+KQes%D&qx?OoG-C-~e@fI<7k zKIbMU`aQ+B4_Z91nY}r*s;4BBsIJ}|>0fm`h4uIGar;#SULz`@!`Sf{(E9as*?sAP z0WF9+X;U-3YR=bob(6sWplJyRy#4RhrycDm`t`scBHa`QoBojZAKuG62LoII9M<~j zz?5|dcV@wJs`pBKKr^9w7|N#cO2)5&pfQD{Jm_rbMQjj)n3Dt$6;dOF^581=#@JB& zD<1Dmgc)P6H%h9{3=YSxwIQnG!WIt zP+X3;v{xclN6r`nMN7_}8*Wa(G+{M&0?L@qgk?%`)6;jU<5zDMzQ$&+RtB1rd2AmhDT6q%f6jj#suP^^n& zv8M8z%Qmw{)jBCNVMCEaFac_~W05~yOA{(GBbPIf-G=lN$pdgaqmJ*Veoe<$>t;n% z8~y+viF0v41;@&Izs&neObIeYYWdBP@N>R;=xeMW+VA$cRqURb;3!(qt}bKZG?K2H zQ;{%l+J!O!ZDnd;Sb zX(Jfm8hByk97KH|rsG%pCN&Eo9FB#&sLyWW3HlZ|dtkDRSyRzfVr_|qPO#EgyUO-M z{_*y~epw5Dmf+q3I~QF8g~Uwt0uw+^n$@Jx$5Z)Mu}FtA@(f@$#_u@OKzin|3Ns?S zCEY@L!6(I41x^LcoC<8AgQqsNUAR!n#;FKSKCzjbZ=lm$BSe4e>~bJkdXk|yY6 zinU<*PZzX3#9zO^ld^SpES<-vAGM^(h5eq0sC_PF=6xSN7kQGU#7>o#s1gl)y1)G0 zwnJdHj3^DPDZ66a^O=dR9P;qNa?sd~0&2=wh8UY7?3j#Z_qx~88HwSPBL}ZqOVmsW zeq_o2ae#oAZm2LVY4H(8`Gqx#=^XIR1)lA^aYPSo`0sX)w|8fq2$+d!z+M#9(tCL# z{3M?=Uk%BKDuzxK%g(n>GoLv$Kj;s4u&i|E27M;@_USErbw{*3g&NesRe) zH&qV;qQ*Eh0fKgs5>|r4d!~26>&rqt2()bUmsE@B*X>vImbW;hMqY_x^eotYfXy>m z6XMw?Em$dEJ0msH+ zClnwV9o}UQVJ_1;MJ_t@W%Pu+htLOk7`zoMSC#mbz0>NJjwrt=55Gak1cQK3(*`aY zq5xqLFSadL2l=H@3Of*X`Z|K&!q`IUt?UnUS!<}JrA|lRbiR3yxc294R$PN^gpiK0 z7wW)AVIWqBDAWmI_5y;}^IU_=~e zuxi%}RUo$)cg*2};#lo2(xz7fq>UX`5Ll(5HG=&aHG}^|^8D%rW@R$*DnP{&MzSch zAs85AMRAs~Q#2qzb&Clx` zwTJ=|;^5tAwL_=0#Mefk2FzJxIp%8ScsUwAa$Vqnc17-!+|i&3>`dh{Cg4kzxV>SV z$W5DWlI3aj+a_L~n~-#i{X>3##eo=avD`EFg8D_`h6Hn@X+t4JYpH}hGmntMvC!8~ z6IdzJ0F#86M`QFM$@=RH4!uwZsqqe=(}e_H2`4jkOE){=Hrg9=m^k%xsR3-gx*Wvo_^*bF;m zn~ak9v%v3V*W4L&@=gdN2RwD~O)cmY5GU98Q+7A7jXNj zVc5$52062KL2-H?w2YTN7w6D9CG_8tvUSe`Ev{HG8e= z9H@0h+GEt){##!^Y^*9Jj@0NICrm$ROgXRuqzA4s1h@8G0na1KVdjwZzC(js=JJhj zHZRYE5oH4~2{TAWAjLu1`loWL!SnOqHsqZHeMlOB^dqDIYJiJXBILvp0DW~An~p5D zz#)6ZXk2~oPNTRjF;BZ7(@#*6lDQpM|Mi4FqsgkQ*ANO*ScQf_1lz7|!Z;)mBaV?A z7Yhp%?G)1pMHqNULJws|!In4^(Jm(*AS3{w>0B($owC<(d(72Bp@i+cb69rkcnN`- z2|MWzUr=R1BB;-8^C=_}l8Z;tJI+-IP#XqX)k&`^Aa(4&mDWBnYrs|GlzdvWPGQ`z zK@h+58!__W$G8lwE{0$z(CxTi%f0Mj#`NtZGbV&!E3+y#$-NgM!bsuT16w7*3~|I< zxq+)^RJFkM!Dds9VZRJgW*9`Fu;_rx;q2diyZ-*7?d~LaFjDI4p;s#)7~SR#B*TPV ztbg2VA~|GoxF>y;g=vVMEe)wguVeQvj-87P_gdO|ydjVpApe;z0{}04r*^|LT6#$( zlVpyjaCU}3bdKdM7SJ5RtGSyq-t0R%IAJNz1Dj7V<{K6ZIy0ldwb*Vn#MG}SvLF|J2CVpYg%w81No(E zvw>^Lh8law1{9c=ih+oVfx*T-75nceuL1<5qU|kq3VJ#z=!s!AngQIsCH=s7yf;!Z zpv3P0n2HB%^7|tvi~U5t57Jn!i&*i;v-zSvDnB_)>w?xJ(x$>*Oj&Af9hYFYaUJhR z$1$kTXr~3O#IG(|*k=W2``0oAo+5HMQc%}9iTW0gp@WGQ!s9jM)2Fr$h>(D3mN?B@ z$|!hI>1c2CoBg^2Vkb+{jY~j5K|oK!0(+vOOx87IxhYINzm`~xPbT>Lpm}BoP6ELF z!D5=a1!4L)TdA|5D1C(+;zyx}oy>n`-{qKDc3y@xw79~iUwqwSevV38PIGVmdBCeZ zA~{$JdR@>$)KWjWPn(TaG84f~$`Krss!znzg#!(74I0EqNP$Mx+tLyJqF{l5V1Pcva9cdyP6EHYtZ+V39;a zU1gHQesA>}$py0SNJJVG5^!55qBkVmW zL_;J_q=x4ns^pU9sbO(nll)2%)Y+M|RXWe1H!z+F6G4-xtm*dM%xdp+IwRb@s!D(Y z0*dMh8P(+KbM36TX*nqM6{70oN&kzbV#okKxg0=_c>p#hk+ecEO!^ zfD7>LliUa?K)sNafzKE8HyXqC4l)z{76?Yp69b)}{)Y7!(gVpD?47E{ z+i^nIBy`7c>tOv0@IH7+@Hh|%7C~gZr&**5Xdlg@%uCJyVi*rQ>i2Lej3&`w9VaX= zdC2|X-EnJr1+PhkQ&GmN0SX!#{NKJwTh5t{1G5a_vAy~pR<&PrnY%A9i$}kN1J{Wi zaZfCBY=F?@|JYZK*F=1&@}D26&PLDZHyv4a0E%(PRMgGR*^jh}i?^i#0GTF=$h@CD zT4;Taa5tRIuq37GoldpGo$z64sgZt=r0m^yZT4qBPgra_S`Bk~dp$HG*PTp9n23-c zm66N|PM=gP)JJ{PD(nZmKW@d~lo~rgDic;^CGUg=`-Yx4yJsOS=r9Yns|mGWoD$YU zIvx%|$%HjF3r53qg#>xlHiLsH?m=^JcuD4X)4(XoKl8>g$O{ zDFVo69nAfdhS1dfAj9D=lGOe;dXL(plqJ*+gY%!!122z+A8<7!uik5cn-L2kbJHcU zSc9g}%Q7_y4qdYhn0Q@7GC4a^ulAm6mXVA^$%eMFHQQ#SG_YVS`8`m z1Iul@y<%r*?|yahx2@pi`wE~~v=6n(@qees4pTR)T`728QV;3juT#7CnpH{We+5pRFWq~3oI6Tx^|f` zLW*N7MaVAcHHVY1*Q3tBP|=1{&Z(=`;kxmk_wOi)X{+CU`tXiK&m^SDYtr2hRe*$! z{Pvl1gBiF_XVPUSPgA;f&0dQ`TZlO(?A&9OqgNv;B>V0`Y^43T7S0*S8bexZhdLZy zcVqJbd{|3g?qx>;aP|%L;wlp*OES@qpiCrYxj55w2d0VxP#90zWr;0~GZW&~N#VoZ zc;&1QVZX9NVbQywHVN}Cg^Km2qgX$*qyFiX20DDpWuqbTq!dMo9um*DHua2Pn5QC`@HQZV(GQ|C{84$9e@ML0a;JM0ueO9z5UBh zDm|E~-mE=2g<#h3X2ymINcmp61;gM&f>zzzidKoizjkswInv=ss^!;&n$08*&qa4B zW*fcLU=-p@u#dYpNavee@?c~I00dp{s-JtNLG{xFf&b%{Ij^?tzk#W+mNBg|3$)Nu zeqYnl1N3LtNwo73fg}kORLi^qEwrO)0VENYB1~5)ROaU5kwSNTP4t3x$|kVnQ|kW- zeu7*MeRWJ=p6Cg?IDWbqRT>nP?CWG`N)f@LhouEK$&Zn+;h)ADqT_Q1b1ioKuG{aa z!6cijKsn9pjIV8{Rz{u{EJuC*#m5Pl2h&U7RlQ;a7eLqe>k)OrMx_;vI;o)RJqVxm zlUX5ch%sFEjGUN%cFrtbWBidSw4svynXh0dW;qS% zLOCW}RG9c0*hbn)ro)b*5h+;A)CQ2OfRI$Bl@GyCnz64DdhQ!l#GV|hjGggfqi|%K z#qx+ubt5lBdrat|ClYGQ9npi-ofwI+(odLZv74<4V_6F3~gc< zhiO~U!$2G)Mq*pDKFwHr$Jwk_U}NZ8>E^Y&t*83H*{ot>agxR!?}HsKhs6qa`^FVK zL6y+d`q;q~?=XMwD|#Eo9az&HTkN$9Sd)+iD`io*ub@!u+t$!}NlMq*(xWgQk;Wt3 z&yFJzKt(Ye7dGO~K|lSiJ5OTp0q030!TMm#3PPeVg!|S-ZLnGZ5&;VFtVsXl7&J`> zFp2uA0rqm{3URm)K9#DV7vwm~-o7#9`U0pYG|AvBKV7TNLPPqXp3yni`3DHu^RjWU;`NER|WzQT)$U70Ms!x zd{WVdqu~6t+l#-zieG%cC1N9RMWX$iU`jeZ;5WB>ryOln-d7c&ec=R1dmh6UHk|2w zCBG_-gQ0RXTVg0KXNK`Fi9KsEe{f4Yge&c60PAVfkx(Tw-F)$}f_;&^a3HUn(K~cZ zW_wu1c4Sv2-)zUg3?0F+l+(eZ4R=gjDd16<|Mh8SgI zN3xI28jnw|3+(9DW9=nL8;qn? zJeaWfxfu_0V! zfU77R8!!r{qw58odUiW{5eW2Mtc=vRBTGybia2R5sTl@P3g8g^-85oT=*Vt^H?3n} zazdVV=9TK(-jrr`G2MK31fECs9+o~0reKp*yKoWuC6ADiP~O3CPKhdMl~Ex&tu`*r zp8Ej>X$iYMq&#tP-)^I%awRk`-`i|{nx@h z(Tv8Yh6)6be7=VKchCYbKkT|RJC+S232VYJwjL8s7HcAr06tA?B3W$-3fMP>^MXJ; z0h3XbyGT%oWZl>?v2+N>zTJ@+E~5t4B_}xKBwR3#K5)whOmJ_a@~NA%)AMfAe5tC9 zlI9ZH{3#fdBmOh|wGkfULSxtzw$yyM#$$IXfLcUn0O-xU=>XRfRJk}#nu@m*C*ZZH z?V*~!4>D`LGOPK@SJEasrJjDM-xeY0;OmSPm-yLn!^@@w6Rw3m8Sy`yo#)A+f1$rH@itR!HTn;^phHD^Z>Ml74U+$rOEi(MNp z)<9hd1X}6!G^GT59QKKrgz4DSb{t1F@{=)ELIqZ16FR zvjlTi1wcz+mWTD1I}*k-hk`qTS*inxGLJ&zG>fIw3ne=z1!?r(BpNVPUVvpSw?{CB zj6C(`hY#*(y#zxkrlg;u14TQKW{*E*Tez-2RMX493x>5cZKVU9$&qEEOHPG$&tuVC zNYIYL1tC~YW}y!r%Qv!rn;%b`A6Ji?=X=NUAB@QgG@dW+3Fy;Ctc0YV?HI%qsD1>% ztEuK6R6&Fz0Xs?MLDHO`w%u>e`VML(JfK6wSD-ywh`W|>k}Y;3u7aYFP`)WgvvYQ& z;2~l-d_d>LPFEEj_E}inl`5$x!WFS684IyP)z2CyO@x&Kj}WVFGo&$)<`2nz5RagR^8Pxmj6m)n6( zDi~WN6onG58n6a7mf(a~-}ML^M9S!c;cZvoIEOiJcMi2D&Q_~SzZyl7EMnTvM!?9W ze%0f22bp(C;W8}wR2JR8+@M13Trrq~97-RzvKr5uZpyxujSC7==!tV+=y-&}O@SOm z__pA!7;n@sz5~3;oKc@{-<9TNbR4JP%aF_NH+q7RFp8BO>1&&=7+e@CsU9ybb%o@L z1?vg|g!&YcZDWpB>|AyXAV_ zB2Pw{?4oFUWpc8h_=C-)gtFIHLkwaDFZ<5qr5TDeU$G+-6AfLbeFWtzg>S~Kf@od) zu2AjKe~50kE2;1Iibex1hRs^Ag5i;c!JBjhEH%SMxE4AdE$wfn*VIfdnM^xv24_YJ zsNUS{X?)S^yI|D1fJ_kYO-0FU0DIqoCr}UCg5L7eJ<)Y0HHRXS1YIy4=?{p^9IKA2 zta#JC%y`R;6x$fD6O&YfccMV#Hj8}!c29ps`MaGHpQ2q!Z@vA}QZJ@Yd(0yvBggW=Ld*!34q!M3e`@Ul|ggw zD-cr>#8xCEkB_o6;(x0l;lc$HtF&KA`@x*LgWUr^W84MfVAH4so-!T+=joeIogM;` zk7Z3)+Qrr5{e!Eqdbu-I_oD|M%tTR;P`r&Lf8#}Yy#7O%R6jKA6c2o@t$JrX6JI73P&`)*T3D@S6S zvjKh+b_w>OCbVN0}-P)5qR;|dHR=dj~SdGiTXM!GBRxsTNm==L|_atUJYT@zz58Qapyf`b)KMH1q z{w*RZ<37^}vN0&%pFu#i!ASZFP#CxiI~_+F%OV&__r{v0oNi8YVO}5Ev>DVasWqfM zh2GF{!8d0LCZx$MFc9y(@5r=iYTOQ`CbsVA9yqELr~U>{Q_38+CN|2uB`cbGk_&gG z*{&#CNn?7XnGjKl>5bqI=7JOtAa6sRe9-Yp(i*a@S_$of1&<~J#EejoB*3X{5LjIw zJuPC&NH|crtTdNkC#494HYaf1$UbN$OvQ;IZ&W<%xV*vOEYE4G4uxo6Q9Fdldq{?u zP-@%SaS5a_l)E|8QlvOFU_>aqsR-Bg6P!u>>tGCCe3W5T43TblQEx_*2fiZiwQHXf zScvI@LjyT~`qNAau|poitE(&P%qY9G6F8n-A?zBuAk@muLp zGdkCPXP)L@uAy-q&#f75Hgxw8fgXn$7Ue zylyRYALPySOU*})ud5q6GZOFvK$wzBR-a%$gr~NvOTA`6$icFHy!8MUL0Tpc-62P9)h}D{}^n4%*%SnpP?_aX}1- z_TC4X5ux=y6k0XFkad$+$|NjY21(sP?{=Cr$+|tywHG;U$+0*8$H~biT5R4CC}I%s z&c0B0$JQP-*UXDH*gY`p_8}@0+Z^)B96Pa?f*HHGrLAgso0K-O$3DATWydsev+g1~ zM3~(s0zxvn?;`BF$OmJ`-#eur6b94%M5X-X1!!O4H+D zAn<0m7DC8+&&)&bnsu^KCdOb4DeAgK4axx>otz*5Z)nTyP?E6O5*|?ysM=9MD#piH zrf~zpw~UK+N&B>do`vJnF0siqbbU=ll8|ASNWTHtuVD@c54L1!1lHtUmw%#EK{U0N zoZvVjb@Xxs)kBP>%pJ3D2AJ8ORNOgX-V>+tgg$J+x3+5u6Mdj%K@pPymG#3 zRe>GBK2EV>s-%x?788KQd z74!ppL18`Sm#Y~JT!VdvRAj^7HO zzBPzD0d5K$fGr8;B>K6+-(9$9KRXB40U=uj`AG{p@$MyFeM9E&*5b6+_}E#N25h*R zSLI%D3X{`wyu@gEp7hljc3O}f&`|4P7tcxTmA4&sO6AjZ$)r8Eo8~$LnJkUy-FtsC zao+U;zB(cT1eAvL4GR-Sb)wFkece0*r1>-U$_)f5@KZ}AK;UGX}$G zVT6|}FbTJ`Z$GLPRsKk3TT5zuvLT@0YXpNy5tHz^r2+oQ8U}r+S7P=*>`1goM>S(Y zBSGb}*SIo+!4++hmA$T5MP9Jn~%XxB-A9(!Zbd4XNHkA0( z<85%tx>jsQng^@sp1S_yeQHliOkHy3}iHl*mD?=SCf6ignBq0uJaSoMoat+)pZ z^?Q$?K-K8x+kxkxt7{6{Q@P_VSrqEqRO0REi6Nw9U zbA5UJyt)2EN-=}qfR+xX`ZmO)3i`;U?_4mCC8qmApkOgr>3#)nz%H^81z||fPKk#_ zBNL(m`f^%kKZG4!dU{fwB#U4oQW=o{70uG2L>uOwL$CBI+RmMIlzz5U${rlqyIpo9 zEu_J{!TC1i@85h`^P&Ml1iA3we!qPv=Y#e#Bgt?JP+DyR!2*fzMxj@?FAUj3 zlweTw*Qb|B?5qkUu_l~b6H29`&B($Ndh_g_fpO>90Jz~I1{9?i<=4jBqqQF*KE*H5 zO#IFL-FLwo2w0As{Oz?b<8kpL<03GQGDUbw8Uy%dk2bp@TlbvLkKG^0}&_X9+C(aN#k|-HY~7<1h!~@L-4)Q#RbUov@`wQlRWOb|fzW}sYN`mBn%Xyad6C~+7`G>x#s|eMr7rCob7m6R@&{qk7|1k8fpbA@= z;nCy4n`doOwH*w`)$%-TPknGB8>+%DE-#^Nq-)*1LAhtt7$6I4;%UPd&-mZ|>f(Ug zDQk+>R=5_!HJg~wqXd>T$q;^L&I(q>h9K-TuszZFc1%MhR#8EPKHM)=YGG~F5Z?+$ zrfg}v3g6QjPkY~!gamxGxb5}}cSg>MAnK`d>~)JPbxEGlKG7Ie@Sa_>P9b6(!GUj< zAdvrpQNT1AUUaXl#0;^Mwjjl$24MQZk$wC&7+EdXSQ<-Ht`={l`>-!@?h6>?yg!>P zAq_ieGfrk3PPYD%z4=4Ch6pF@c!4Ysw^o=4h&ABeUfw@m8Sgm<9hDJ%$q#&@Jpkh; zGIC8HIAPE3Em;=Hm1W`_uqK0bvA!!?8pdsctgj?kz+_txYW|J zf2@rAVsd11nWadS|u%=lH@qhq!=E70zxGJJ2BOxh< zq4v9jz~z+*yZV#^wGm{r>4xm}dYx*QDgn-0{;p1X(+3NQxEW=4{GpzoBl z-q!CQZU_q3^$GAGsjpjs7?|Kb-COC!~s<=WFU*RO%XG6ufMXftbSjq33=7 z%R0-(j!YwB7A=)sgQf8Fg4gu)^zG%wb-R7iuDKk`U>Lj>#5L>1*$=74bo>QB2!ioN zALNJ$n=v7o{*If5jPR6Flo}Ct=u~vd`8XINwDYdBgg!R{qMb6$^~zggEKicc2~Ps) zHfmUiy6FD&hPMX*`vpnmd)v^e`*^y3~*pYDexAd3NL~q}cGvEW3j+``3vttTb zS!p7;Uv!N(Zyk&*@Hw*{4nHd{b>!|B!lnb_8=$#GHNXxn8;MwY2?>kroRs<0DV=8~ z)&)o4wf(3Y(7q{krQ?w`ZsvHuc8@G=PH{FUgB?e{aX$d2fMlbO`Z#iS&fT5lWvgb{ z69w#-BfD$cbgOm^R@2Nm`?k9y+qjIR&8{2y%83nRFnB2T1Vr4g*Hm|WX)xb`d0*UJ zawpR3tyE7h2@*+1i041;b}|sPO+8_^eRPE;ov6&O7s`|-N9yD!_@y$W(!DA6h7Y#^ zCxWeDYzql&JOMKkVm=|+{=VH@m}nIN9NotK3$rVlsnul{ zMeaDE)AbdIDmA2S`k(4-Nl^H+!EBTZx?BK;fjesAs`koj>a32d%GfnmMDkHX*F*Jk z!)Sr{m4JTGgTcHJ#aRi217>0Gox3CD^MLmRyBL%t1H3EOq+f)KP27zgZ4lDx+ZT=4 z!8j)PGsJ=qE|47>1Bi^N5)9}A_r^Gakx?YDMleo2)7_3Wtbald?mT7vHod++)++)Y9tGzA*|!K-6|md`{H$rJUOn zdSS1izRjr|6l_I5sc5<048Wzi? z4h~$OARZ1J2>BsuP|}@*JO}RHj>wTBaN&*$LuBDlTF-*P`zJwrQ8CZmTAP)6;3618=$`f8fDbQ##fTf?%M0xw$6Arg=dzC}gorD5hLA zc}W{8dc(~d1p9ZUEonQH2xrvPop?ooz-Cn71)ID? zJHiH7=Y)O?&h(dE%9wxvjMg?Wl}P~b#w86C|A9;&_kw{Pxks4pULS}Avjf52q_9TE zV^yX*2NH$%ce%G#FkF5ZF$u^NbOZPX>{d_TP0ErK;*~54g$lkMkmLBabAoWEofl$Y z62Y6}Its?M(C|Qv?-~{LrJ~1A58F%en{DlZ9hOq2Sb#7KM6&bFy7u&3{k8X-dTGb3 z)2fVt6)gIDtHN>jT01}Aj?A!iJAtPT80@_Qjs-PVPDN+wni?ZyfV5v!oulTXs3~#K z6gjR%SAt|9xMQcyGl0fxV)BA~=uVrpYTupGaZMrx9{?9gR=dEm7*@%Iumv#`_3{#*n4b3(SeD zIpsL=Pz2+WCBlFrMHd^Bc09YEJAbv1JShdEiLnS%0sEmEHRUC??DsoTgBaO1oLeor zdPVzFAXUBRt0Kf4yU>3f-?t{0OePVng?Lr&MLD2;K4!jzTvpEx8^i;4U`(2ANyD7I z_u1-YJ20tBYOAqzMo$ZN*5T9*{qpP>9IX``Jk+>&hF&1WEQ=u@77#ZY=&PXf?MU#3 zoq#n4aW%;ljLOyaWT;78@_`Vtd2gvZIjUhP_fH)9)J|N{fWBN2Et%e^%?C$c?&DE* zOihkJ7*Y+bRm5%nzKt|>d4?IGG(0x5PvKq&$KhtZj%KR(EI z4%$zP7=v+XxrE?7mQ#SB!6)Z$-yiSkuBxvt`R)N{rf5*oW-LYU-jr7WP4hf%y^lYz zE(cbSotqAZbO@&J{2&dci9>UCgMk$#dYFfA8E7sh4GcPvh1dg&UHPVv5^QEQ^a6Zq zLu0R$*gNwL=TA39`-uR}X2k+~z`iP-=CajlSuf^0wy`%~@nl>=+Kz+FlQMarz~O%K ze1BcXx(+*zR5zuaRFe*`sveJIw6w5hFhA64wj&Wf6!pbp&$Lk?aK9u=wIM10Y#=wy zqR2ApFkl{=ihvJ&8$}1zw)1c~5)8 z+TD!@#RbTHj8^fvR4v%aD2mD>8oCCW(Z_;m9aOa&qQZIlTQH`Cww%T#(*tAT&DNj_ zheBLmkb?-qPog{qNcxWpsnK-V;b170hIDgEf;Zg>BHE}m>dL&!}m$5dWW zcqg2*W|?ly@E`t7XniV%!g&loTLQV&6AE0|lt*-5lynO->%55eh!0;VmXWZm7^p|s*= z3+eF{v>^5^OAvPuQNUpEf2eyC@W_tp@V8~jJN69mf^D_|WEik9T1J`~vrM;IEw!YU z)Sku0*wEH!nGvH6EuJx-4dx94o`?YlLg3F52T1;bgn&r`F<=tIfNgdX7DK`oAjHNH z3?X1v|9|IH-CI@n-fqdf_rCYNw$*d{)TvW-YdLl5)H$bwXXzplnNYY$HG1=}r}P}n z58*@HQ(`+QcRT#ec<7 zu?**epvESB=ECnFUlm(auB6IXkR_n=N)#kD%!6+U7vh@cG`?3w-Poz8xrCnMq5~uA z&Ul+n#8kZFv5(_^C&qUP3kI<*(Ls=*aJS^n`|#^Snx`c`jTb>In>JL|BHjhn&+>P=`dH z^Iw@E;n$W^cEbBSk)`32_M^1d z?7X+tAy5Tg)x%{j++hIMx440y#OG|}8H88#^tqdeB(Jxu_7KuyXQ}218W<3a42scm z#S^G!*q4Z4roqHHK~9T>wix#YuTtS(>m`sk~I@?=3ID1QUC77ah=w?KL2QR0LV zVKJD!Ua%6~FK{?ABde)j-~h4Exu_C*K_ud9<>m(CvoA(-R8@AoZCfVb1@h1lKZGO* zH&-E&*DUi$_4<28O3$s9igIJ>&Qfu7XD{;~>1EGIkPV}l-a$F^wns?WODKbP#Vs|w zD$XkyvT@maANLxFY>={IcLwZ1c>`QM%(5NHbM`)z@yW>v=DQx0*_U?`k`y;Ax1$t2 zfpwQVM)vf8A{5R~J5i3T6)q1b3}bUwca5^6t`-hDRCvAp{oE@YwTuyKU}SEqYdr(} z7aZZWiz|Dzit>@K+CZ4;e3$Xu@d|Ts> zt0p6~zyV1g9kI2q;U~z$?Mg$kJ+W4;#sVRV9l|i}YA{#>LKQC0loREwPUQ7G0o%{k zOUT;-yKzF0iUvssxr}HGz!};uy09Fb`T6=v+<(m7Y56VdZyyQ9GE^n5>mEXsv9irg zP48R56;I}6;%v?@s-MsXNNy;t{N+Bjn`H$+AYwB4+YNdUb0-c*P^q!6oFv2z6DkOY z$0AqU#Vw(z2wvg2yNF`gYb=0xN77&usiSD2DLoLjSa z>HtuQ%A7&__Ye86%jECHZq5rt9G{ZNhE7f(3}+5^@>HC=T-ePF`zIa~7jby|3yLC0VG)N=Mvm{j!M4a4PiqB5S26FTT5@5mz($@er>_@J zS%R_9M*;(RsyM~7i7$mEnI@D8>`%%dpY$Rwy7{hBp}Vhh+x9}|ww`T0#cl1St=(I< zc6Ii&cNGd<-onPM30&PZfVSb`O^$fowTVvY5>q<(OY0M`0tJ#A6{9#j4xIQIWkRENa^5 z#4u>t(O!=H`mpA8yiGz(ZAWjq9eX*^Im8DRuEgFvVH-GT=E}N2R3NKf0EZ|euF-17 zchD(e5J-rOEk<=&_in&5bi<~;r*c z?&-nhcrz^8lB_$Q+}Vv^Rh+3&x6_!3CD&VP zqJ=lihP*BU^v-xalObhK_?^5KorL&#x%&o}1q@dLO^dX|i&pSfW^Ih7pm#MguZX`3 zCNUVdBmzqf7!woEfKTM>3@SH*~5kK8YL~JkMG$GL}b4|*XP-RqYT#V{6n(-422D3=% z)k(7F_OoJN!g*GyC*QYX%rjzHMiwK{2hl4!3+KFrsl<+Zq|6Ynq5=`|$uuh4teL%I z;|G?c3yqOF|6&5}mq_4#oXkvwQ9Gq3Ca1<$W|&(3oC@*`A{q{1NUIt{Z_~~6(^Em+ zY1@J0XTXsqTnx--8pR6>O+(ePb2Fg+}1F}F$0 z&`?xab$mfiBDM|>;t<$)eest0Qhu~Vj7FkUIE~P*=sJWz>RH~;*`#0CXk~~C?l}_@ ziC%5~cM;Ri#lPv$4QXr`0J~c7qVLLWSw*?vhpQXYX9UEe79E{`R^S&+{Oj^yA0aW^ z0Z3pFty?fStjp8KI>DB!9G&k3x>B{93C?-^jM$a+aSwYTUtOHUI$w9%2gk6Zl^Uw% z$;8@GUKeB};(m2>B*|!Yi;FvwJ?m!_8wj2iW*qM2fR;OWeHqVJ3khe6l&*eGV$1fU zFzZLN(Ce6!r~{BO(9NGH0s znZq-dAivPzVwD??(S=M&gokT|f5SlZ$W5xvLTV52RhshDU=mdaw?1xiE`}0nV_8^o z5x7-O7T47Fgr#wGI*h4Lysc%Awjw()1~yA+;y;>Bs_$uI{Ff#|9h6uuC0EAOv7w_P zo0{a*kucH{uZ*YwyR15fodZ?bHNCGe!>AO0Y8I!qL#7VSFq}r?j$EQ25OFTv)agSc zo5@BQ_G@niT?+cDs(z*j&31ogEM8$m54!;fh%z#OmOz9(EEl;E zps_(}ES~yVxjKaac*KU&6HIzPmX>KzW8Nc6oSwD&`M5`&Fp{{#OmPAyD!O$~!2Ucj z$q5vL*I(*2vA~(!CmRiwAhyem_kN*B>|B~iB*9e1sC^>tR`c}AoLbb2bjk8y&3;9BKOzdV!E9*8n9(8V=hR4x+gj_sV=Rq( z+F=Ru$E8+P)O30}B?mhN`ppl|>0~R<{E?e;`nWA&Sb~YhhdVmVtqFo|8Dx4h#W(|> zb{5oR#dnVoXIL@0LS-wg?q!Lq(j;=XYoc;~00+mOGKYe3)-q}rxxAMO`(+|E;Q7foNXujKkKKC}EAPUf`?ad8NA$34nLKdf}rcknhB z_s^O7`K6+080{}tF>AGcoO|XxE4Ik+iT0V?v1Q+mE&i5sfSG~`KDVdXEuhDQT+Km0NYScI+-DIi=ySA4T?yNr5j0}1@Vy&dA^D)CTc)n|TMg`#jB%Ye-G++#tK z5m{xZ?9DLW4Lz=|v>8?MtI8DVFZB{8FN_^$`X%1&T46HCSmhv10(nJ?Wrw(Lrj-wV zo)Rjfp&};KC050KvU6J)6NhSV?uGC|E6t5$?nO@_Deln~$I`N4U;$9Ysl^f1`D z(l%~c)1%h%+_;3P4JHmc{-ngGvyV;o5TOT64u2ODANodWM8C)(1d5RXtkfUY;KSLG z+bW6!T#jP6jgFGB3FIDS2eRflt&pdfBO~Gb2(E>(aiq>glbdPsizp*>Ty3#~7%7fm zhKKRkK>x@d8wh+;$J6TsH5kHE#AigrlMq5KVigb1*5!nMxs1l{Z~k&3Du z&gaENS>Ds~JJ~8`EoY)i@z`et!yLSkdT=jSOR!+MuWye~Zi+iP`nIhB`MS3{uUEb2q z+dop`w!J~_(DaUSjJ7E7@bL3+a^2Hgg~>;Y{cd#+k2n3oGuhdVEiX^biiwWPJCg4q z& z_cB%%yrD#1ycyy8LDtw4_Mpjna8d4%gij6d?rnaJx!$%iI>2~{ORgGIX`S)0t+hQQ z^K-IaDG{kZG`^_Izx|xB7*2msH^e(<*;aAxCe5WV6eu1yc{{1TUI0Snz3j%6MoKNj?@SX-=oJy~xRCM()Qh*%xulta}4&J5$~vIy%b*E|6#7WRvNB~s2f5so7JCH!ZKK?lN( z$YSauhc4SM6R*ut&Q-%m73nT?-A-}b)WS^`RqPa^ppAxYv`1_=T7_h3@B-tK6)|I^ zTHq{wy(5M^)j{UcAQ4VvE~pQp%sKDSLKat1BLQ-+M*COsxnPxDw;4-`QyWf0xd16~ zD|_@lPM}57lS2o;xIP9=L5$10ik*%A^YgGL9zn~&0%^jhDT`-j#-X&;A6vq`%G{Mz zM{LyP(c!q|fckTx?f`49gvHc-Ci@n5dT5mN@xh{BkwIcq;-^r~cWrG)5nC*EZ0Xw8 z*|)W@wXLJG*s-O(drRl`wl3$uO<9AZ1HA(Uj6ECMdN>|V9id9plW~?{N{jBKn2DzQS5_B^0y^Qigb68Q{__SU@Zgs+8`H zYT+`my23AXq_?Onfw;t95GqGGkN_vgnonzD@h{ho%4vwOL# z3=zHGQyJJ$xJFCBQiiQ5*!b*^RwhJ+_Fg!yp$d$Q1y|O-!&x#->9=2KE~Y`&4WeIKWOh8R)8-(CWCH z#2n%jnv3VXs|VuFiCS5>xd`>i&=HtY_F+3-!mBwb`9Xedf*Lxzuf*(mAeGc zVkh4>I7p4TgP)aMb$Jj=3-1iG0YmZz6l*$W^@QAH7nFTS#IAt)>ekdV3L&Hd;h?Y_ zMjI3kidczZw-$0ZCCXG+-M&0=Rz`{MWxW-H*DD$$hOQCiDbmix5kD*5<3rfLumMsh zAGztuFhkD*UAVsN1zkSQl?Yiq*n>@fLft`k7)?aB;V}~p+n_1|#Sm$%BD~D0U{!Z_*wDPf`vj|UOh*u6eI05Z9<+{9(u4Iz5=t zEc6cGXC?8vVn)Oc484Y^Z)AcY_Q!SCxDT$_O1^&xBOdYb?tQp}kPUQ^kb(UKdQb8q zeFaZgk+J0$S{)gYa3-wD;;+l}kEF5kF2AnE_RM7*&SPQPgSvqu>qa5_6aIY|01OTF zj}+j1u8Cw@W)%LSZu06XN?2Fq2thPPs=~*d*g4AESh+}=7cCAh$*5de4ac354D*hG zLEJqsuFUs&suz_pmS*Jk2btj_Zs`tD&Rbo%7#VYJG*m&favW(F5`EITl2JcF{vhWF z;_d)<#_zP|8RjAm8=p>(=FOFl80WcsxCr8P$>{YLQLBN&Rf*d9ra5swT+&9-sEGUA z@1<4d1&69=t16WHus8$$a|B``W(by6@xU+I;|(Y03sW-I2(HR(un77wIEuC9!)3j) zIjatEyVuB|*D*5R%xQa43S~^Va=G@Z&|5CZ<&ANTt1ElCa?0MVXAS_I1np;)D<|+g zb2($7tdYcwQT{NF9Q{LFbCDeeUH06I^KuP|jzf1m*N0lJLOjWG3B7h)-$13PBLZO^ z4x>Vht8W!fC;?v4@pg8X+B>%wN;nO4w0Cv4ZSU>a*518+`?gYVTSr@upNHt2SZEU? zvAesyv#+DOy}P5MqqDbf%eHN$?Zw_L+ls~Z&W_^NI1d-uAq`>H%ib>B7J4%}Qhcf4 z>1UNN%a~1gZzo(KTE(4Mrph+Qz%X~~#i+NR*@81xXQ8c7DE0PkEp6SlrLWkwwRc+| z*En>SItlgUO6wu=EJox69U@P6ccFdzw)Sn^#rAE*_O_mmzOGX5_MWbej;&oCaUN`d zd$1RcXGON^V2;nL3j(vA*%%C2y7A~|~pD?QwG^>8y5 z5xLlaRz$=8@QTD5nCo79`p_mk%$%6W6UK9h`)+(Q0Ab6~vJfv{0(9-e6+opTn-wI? zhgl>G{1BHHaRuw|k&}y9dhi8#_&F;>M6@BU+V7DQ6N?fdfgf(p3c59}bQ{7P`C+yY z3tyQ#$IBJ2+fr+-_-H2T6l3Mb(#ctH+$YF)5+%1HD#c=FcW+y%XDc^kcWh&9cNY74 z@Ez(YbP+M9)6EUZ!!;Iz_;2QWI!asdBkA1QwzaEgdtX~;U*Gm^+lyO^U2R?MMK?Dj zPe1-RL<7zjaro=)>uN7-EpFXfC~fQIUkDV50^ilu<3fg#XRuHrl#wutzEWEU1iQC% z_4T&*7Q41}m%6vNZ`)Gn+fwLser@bV`+G~c(y^h%pDYTUs#2%%j10!6ld}o-hpFSh zU@10tOEqASGj2gPJ*eacxlwOya!Fz~Zy(?5PDDu^9vNa8VJO%r51zvjsUsx`r&-AF zpB)>Q5YQc4Jjxsk4PrOJ!8P)Vay8C!BO78Ou`(wL+$|hu_TsIQIzoi5Q5L{Xjq%wT znoUX^*J18ZW$(oy?=A`0Q{CmxP>@nF7%gyjao*g~wqv`0`5?)dJ{JgCiQrtjV&}l_ zQt(>6m0nr|WyX%JJ6Z>e2u}SwS_cMs?%lDtqiteGYoTXHD|STgWqLV6De$_n9xWtD zl>Kr)i+FSh+=W%D%ZxY7Kp)L4mDN57D~mrtKO3P@N#3zt5r(etviFxpIOIp6EnX_z zZcwH*+?XO-YJtO+9`2i_i#5V<*u|)tdq?^>Qn4EcQLK5?so4lBmL3yLQuVze8TuHw zopB&+OuB1(c7=^OFf>d&7YUPK2Z85GU15sQ3kCf5BUuV#bdNL_3HReP+oRpMy(8I; zgZ(2t6>&P{PRg0pW2J%YjA5QaGgv97PqBNw@I zMly3p7)n)~*jM%%eWuf?R5+u>o4F)xPw+Miqkk4EA!R*W~!b(wL|R{1HMRZSI`InWy1^FF5H5b~DmbC}JjQhQ&@S#R%>& z;g=}KyCVeIW{On{I}@VZ;ETqC{woV9SL1(R@>HCqoy24?Z)!6IHZ z1k%Ftw8)vbmwANdCz)YoPkMt6z}|?9#>-q$&4iFq6;2448gA@t-z-<-egU5}2YZNe zaG=64v9JaTA!(F*{S{P$I#+eJ1#^{{@B?MeB;;_P3t=(l|fV<`ghym(*)_eIG zVI%zmRdW$K!RP4~i9zrG<6~F*Ii^HG;(Fd^37~f;s#F@+7Wq9U_%GYrnk~z#B#_80nfq&2IFt&)?X25B-=qpomlH?Kw zbydc$E8k~LAaMS|b$fVFTjx88DC@ldQGd9I3K`CISXcqBCMn?=$Dv5Pl7($V)F47l zvd8un(_RTkZWwpbC5}KisPHD|B5aKJO(S<~W621{Og~E*)+*S!>X@kotKD!Oe@%uZ zQ4{E8IZRfK5n2;|y5*iow}@$2z_UG9?!z|D=Rc$qd2N8Uv~!1<<8cW|#>l4_4}Ga6 zccOUjSsup69ltd>Dn-o*Z!jJg9tt<_U?7TNiEE1I?sg*3Fjs62auF5kCQLIAydp%?cJ zk>j?PdNq2e|E?0-1b4Ei%cKh7s2O72!Xbx^j57}P8e&MUr9;h;CrC?;tI;{x^UEK? z)tIpTMEZ`)569dP2lTRKaqSrP#n1?$Fne(xmWj{esyc5`a(Q*A6u4%rw_5aCDdc77 z`&r4k9l^D8IB+YyLp}J@s{K{12svMh64R4HAN%C0SIe+~VRkuH6a|dyIdehD?15>o zhOnM$4>zBBliQErP6^z1HptnmSHp1T;1z{=Bph0}M^b1e|G=PxitXp3zL{|eNIgB} z6#Mthl_Vd~=9L5AK#YYw0Q?ythRV@2mTqJ07geb|!qBkpnqS*^J9%IfY> zuMJ3-8h^cD-lRdFfa)YG~f?2^fyHm?8BU^8VV}E_@h8DhDtIJ zBH@Td%3mZv=tbz}Mxn^@58i41GqXpmf4x^K_M!3{MlSHG>`x5n;rvx8qqr3j&qNYo zZ|jq&vh%Hq-+XabH4C8^DFHEuFjkSD2WtN@x62)2x5y5iGr7DCp_mZpK_DOlQ66Cd zBC$z;`uKd&t4S|*DymTQHe&u5!H^YZRjDGin$-s~TsY&Dpdb+H2OV?CKMC^YF~N}w z>=orWO^ut4wau_+3t2q|`ZblIJooxgWZp2S3#gw2hT18sNiQkukKuLmkbW<*pFaYE0MWS_~O1h8@YS12Ld3=$2-p97v|hj7#w)o>(iVgU?Yu>)oO zE|GEc{MmbJSQ#^WFjg)xJi^JuDFfmf26=X$CI~@ETuf6yzd%Sr<8+A}7tVVQu5gw@ zAZAY6J6*EoHBL@ABIL!tSOTl2s8nc|K8ax_EKbiZ%!b5!8NAMlMDZIi9HwSg06(3G z1DId;=4Vkx$mz76ym<($zCB2kaJj{OV_ayVM}mGju|Ig%9tM%zH ze?|v$iCZp-YSxeUnH7|1PhV2POwBBcaT%>AnEBvr*y)v5LcnCn=#|*jat^yNHYa*#4}(Uk5Uv@s5Eod3TYddvFmJ}rm+is&MyOzghC4iJ-EfjmFTZUe0}9VH6b+T_CiN$!~O0X0tQ?v(*&LS^_(hNOhS&LC3Z(pYIO3hL$6gL~A9gClGm zB90`k!7_~|JZ^;EXAlie0a;qOfS424f?x~8ispj*A;M_p*`*tutU6J9vV`Icaw4F@ zuw68*E13HG#I*vG@`l8$X{u&4Mm3eMJq)C~LV@c=^6LK~mIH)nf0FAo3wE78EgBZG@@d=VadV>;E0La$B|8w2*|U-TwhT5FNw z_OzI=V5ch*q`zfOmWzTC#h~crtrAkgrOXgu+$)h8N+e>ecik%F0+l&Iu$u2jk%E^; zCBJtOr{RV9`5D;GqGJhQpvz$&t)%QuC33qIUsbPAZu}(jW#0%(=d#=*V@D2mxOzw! zz>f?UP!HMDo21~vur9E1=WHsLn~YC|M+3QX5aVE?$*^l3*uAU9me1dHN@(j|0`Ft< z$@|+%XTLv393{>i2JM_pvrTC6UZX^!b;7hP&T2aEtMEXS^>7qTpVRxK1`U3WTua5h zFkU#M$wSjiZZ&|;DBCp&bsqN#D_qbgTpGo(IL0Hcd+YQG-f-w?2#*n|71Ohitpt_} zuA!zT30o_cclfq?jgG#F^Cu>ji0HB9zsHBgWQM@!TurJYla+KktEPq@^T`ZJXneFb zn7h$0feUpR#>Le}mFe8ErJMhK zLYy`bGpOpdQk{1r>N*D(;vg9h7ju7}at^na6JG!~jG@sg3>;<7$`VndG~SIjaO z*pQdw>1l5-4XBi8&0bsI1 zrRY^QqyBp-vrjVC5kdsQdel6tR^2&@9!N&GM++;tVFEa_x)m-jA@B{CYQ3z0KE`1G z07g?4x>j$mU*Y^N62APm=aPdeH7!Wd188=02c_HQ?+@6m(Op{Z_m|g+{apr9T~YHN#g_pub-2|L$kAMh01QvM(aof zknYSzOU9Y*%0}x>P}`b`HZ>KZO-*H?Z3~gw_#L8kT7>8o+M^5sT2xs2UyIg(VP2#E zBDArNhW}Z#&hEzlS+q4A@}lM)TjOJ?O|9|Cu`iv#tG~vHb8VbS!PuLsA)$l`60Nm{ z4lD~gwYLuX)ZR=g%ZnLQCdc6&uXTB0R@?;D@3%@PvSuMS|&DWZ!u z6Db(;u+~k=T98P|dN=eFw&&7obDtK9<<`p zTs!A%M9h-2(+Rb@aqq8*^xt|DYcq&b4YMnTi2P{E4~Ce8dy;_2nZVlI%FIkUW$*Md zcOJ4AZ;(_kEAn`7WPVv86agjJ}ISHm7Y3%5>37(#nfO>N-m#y0Tju`XUU-K{n? z*%=0$>J9@=b%+6*!QQae=@DnL&Z9LZ(s14Sad4g0LMoofHKYx)E{+|n8U0BXh15tf z^#Qz(iCe!yE6Y>clF56=mL|Km2pi{cA}-8A;SU+mG_M(lW8k2f#R-#1Ava8>dK@v4 zdMk8UugzWF?^bgu!n{gQ1e>JA`t{Y+MwJ!>Ph^ln%yk?=AqG?%b0eMz zfBfIkW>!as9D&0(kD%e}N6?Hma7ofXY4XWxNBGIQD|}%dGt=xYb?J2*$)O}W*h}$c zAJa5iXvX_0yxtqz#Ef?~DT&T<6{!E-QP=r>r;c$!iv;}MIL?{$s9F5=z@`fqVShD$ zU}b^10LOFPWC}1raDr)K6Og4-$Rb}STiBta1z_-JW=f6)FH^EvY*IL_4UjFP^cE)% z-jp***|joI>_H~D7cp6}aQGWC;**24H$PijSQ<-aaES>9ZyVdCivw8w-0IDndV_Er zn(721oGm4@k!knZ^tH(%1uE~3P*#(Z?~L?d=9)suwX%>xjqXrOCS-SCG@?_DZr;6a z6UWP_D@Mj###~&k%}&ma&w3S&AY%Tr%$cPlVNw>Zt4%whZ#)Lh>t*i=?AiHinK<11 z=)+$;xj3Kvjk#J#cCj|GxOZQ;Wf)(!(6EyusIm0$C|hg;uZb-ReBEoyI3p9zAJ`GR z9yGa&jO!&M1(Vaoc^b)=-U0+Y7p$L*5^rL9TxO>*0yZCV;Y<3Zq$nA~$VtfZ*op={ zW#2qGs-hRO<4SX5k(fc=jG#2a#N^(UeMT`Qa$Q_6A3nb5y4#0Oj=N#z!+n7^fG@dy zgb(MmGppPw_RJIe6DiV6-1acJw10la^}M0BG-niSUY4cKj6E>+KM~j$-V_{gKZOKi zQz6u$LsSXA79dDq71h3h=ON0LX5f{gFR0CBJ~P zV9H|yiecB1b(Xl`@}^_6ZXFVm2Clx$0Rd1EB*4gq22)Y!h$1_SzJaIdXS6U>q&xO; z;fb4lljGwCl3qbv(lQEYZ}pbRmD$!dVXijexVnMaQ1Ylo;A!zIYg*7b3LzSIjffq% zIfaIRkyk*J$J*$rS{$|}H73}gJY%n&DA52LQWl%hY{FuLy_S|LD+YEkiPq7DB+0BOSFsaAI0Dbids}itTljgXS{FDG zrGw3Zz<6_g8(rp83xrEg%qf>(77%%vL=QxiQ?=%lC1^K(*I@w*aw6mJDWt{*R5yp2 zcK)7AGTF)KYgZgNRYQZV%mH73vBhu%d#Q;nwj*g~Vn${qnjCIfjATIt3)3U1@hSWz z)s->}lzdVeL8}rZC3`AP)i(?JMv~0CWD_-M>3jyBe9st~SgICm8Ch>@_j`**~VR-y}&2@DVP9>I3Wq0}3`swN?(s@gatPdtJ| zs|k*qFixDE=t8oXAIEtmofv!H)JI__)ZQ=^Bcg`snC_+0XJ+TIG?3+yrD&P`sBUP4 zBg+nCVw$KEP7E-}M#%6m zF(|tRh*Ayew-jYc)Gmf6>b7KkL0uEfAIxS9vu;u`5Mq286yr0#bS{tt*He(s^#l;q zL;z{7r_hka2`Di?W+zfLsMoll2J=RLiw(T@KB0IAhKNvsjB8=yW$fom36kK+#Po4= zqNZ9$(L`kOc1t!h{5d$di@@nNa3=@j%ZL0jT|z=0f|g4QL|{$v?1%Ur$m;wKw@3m= zRWw=0g=x`1*T(ib{(<&WVK5n2Wef8)qk@;vUI_>}GDS{cNpb>9k_&`;B__rgzBuax zef@k4-#g8wVqzLi2P%dA1RDt60so1~%t{N~Y~w^otahW|8 zE{7zFmw!4R3{Q@3>L%1MK^~j(#@(`NZ+t@PhP760-aDO$UrQ#H$=y-6np_l})rPY(?({9DC$#(>PBJ0EmZFx( z%u?@_&CVpFJvG5QaEJ?E+CM#o9yZ;2Cc%kkF2{XOlmO!m zMiUZQ^i10XDO|b~z$+$Zm<(xPHKgo0a>xYP7dB&rksSCa0?_Zw%KQr}GP4wR`b@B3 zP!DE;)Gsj`q!vkzC@@fi_hgW#@qi`qGRD0b^5JG&YU05eVnJz|6t2cmhU7X0To@Eg zDVqVh#1sR}5GsUPMlWa0!K~@Gv>!`0ckCl?8A<{IKna&z<^-1P1%V}7H}wj33Z@&^ zPe`_|NlP`a0jJv6XeLn3ORTA2^v5Yv{ig)`Ruv|sdcJsalBnuRJ2W5IFMOkn~IE>nOrBAI&QML-irY2S!_o|)}va(LZ)uN7{If%W zifu~DG%HGoH}(nBEz;Fy!c|28q0uNfa(FD0I#k7a3I5dcz!cjs#a4LHu^-873{?Fp z1xyVTnT?4(lZ6Ho)519I*10>qcLgUApRUjec8BD!ItbRY@SI$dV)M6DCf_9mOgR|| z_u~MKl|Z6FVqmbK#n`svGBdff?7S?&=?iq|x9^mpo=(@cxWTw^;}hm_B}|njGmj_u<*ZOrBau55MmYL7%=>L!Wph zX$p)b1C)5j@g?+&dkJ(LpjucaF6!xykUt9}lN@nMM!xj&D7m&K*ph-m#-t!?#S%2L z=3#5;QD0Sbgh(tB7gQJwhc#XizMBbg?W-8a9 zQHm%YeD#%>9cw7ugl@{geK9YFhV2v4@O54>YDTL^_zBHXoF$<@QVu0HL1TOUL*f{m zV#zXF1>Yu^N$lDpN=~uTL_)oM$)<|3$r^x3)jr>-Kdz)Cstshi9`#<=!2RPJrM7h4 z?Cc~m7zZ!OwMc5>lC$0~GW|}qq)o^o875`4ibZHpo=vKsH=|80RcScSI$4^)rew66 zuFYuH=I5rS_pOK~D>^ph4qFZ|g2uPV;qnQ2&qhZkZIH*LS*Dzk8ksT#N5fKQIfF*g zQRjdm!az46_sWFci&3IodxO=^Qq~pKu6Qsiw=aqEDguf)(KU0oy%^dC?=>}r%}L|> zDN5Z6YHFPtYMLxk+;BBXOc+n+EASRhYC>kD z;pyTx^VcT5Bo^j&_iYrQl5@r5@{ub7Tw!mnH*ZX3{&^ zl=gJV((LR|Qv=Xp=#m>$%BxUD(SB-X;XXpW;(eU30`ci_T%{P2INNjZ#5na5d{M=L z16jp^({hQI79MH2gv1Pz4rO1UTOaoZ0JDwt1l^`2jrD>gf3#{sveymJvr!WOdXANG zbfq5m_rR)Hc5Eq3L3r0gAC7Z9-Yhs~h6V3tCtb1}3-(QXg+Q>n3P9BF$rqG?li0Bu z)X+vff+ch|5jfLZNfOOu4qn2}?__Od4;$k7TUVhK???kQ15NCz6rH_8drDAqDM^{h zrO2EO%TQ8gE`xAmMQ8&{>jZ zG%o|8)O%7=h>`Ki5zZ2x6v=i(`CTY@~z-(Lx%ixkFWw02^ zXDMS8sbgKxjd)(D)kP7pJk;75YPs+mrLxf+7S|w?VB?(>KevQRWD3tLGPEr(#pow}*_GHZkRkr}Ka0C6HIJ|wYM2$jgrE2FNaMw(94(hxz;6j>jZxile6K)-x`D?oNajI{K=HSPVA|e4=7JJv7QFJC59$%>|@i*MMbvU!784^^(q|_3jg4PN zYwA7R)1lHQu7D^krU=C+s>}2XN-ENg#E#5Jq&Mp(&P^WVrS*0>UI9lZPmvQBj*hw} zqdH9+P1V#SRcA*tzvv%s#CbE{SppAx(bQsOJy^`-r_xeuG*OU@N)eU)xMyqb72>rt z2PKQso@tQ7@}gYDz^J8^`KMbWO0L_G353ixKvI@d-i*N}DWa|L6r`?ZbIw@E0c8$x zl}%0Eg`-GpS#83MYwx7ZOvEH)bxhIMH8e~{VeONL;Fj1>shFNodt4IcmID8=xSk2I zJ%aPPHiBfD9BFAefk6U1z4l{NC@0;b5=wTOCP;|tM8f=m>EvF+R7(>widJ|=(F(6C zCg@#YOhErU(U`uEEibjRg$ehtR&WltTlsPqn`^<8B zcv!fOL*I%@iO#G*GojYhgg}g@S|ZQ{GDT3fsz|Qmgx*9!O{IB@e516a)a9foBL~T4 zT_T)O!-ix6O9FYFBq7Ue8WIs4&Z>ROlbF=XB3zfwUtUR*P&rm=VCpJ^DIxbrZQLmG zxiW*%k0u$FC&x3o6ho;YRbAI*Im{~3C9>*=E3(wcC1*CD8+baB#!)+l3!~5wYjb^d zl{>uC=;%$@Fv)Hxy95M=1Una+Iu&$3k|_uXO2~(ajRsq&yWGf8LZI)l`<6kN;Pijk_iUD#7_L(epiKX_A!RyS2=+-HezG7iNo+}z6*ngGct zv*~uf$n;G%PCSr<%EVBV4bw8WxyZxW^F@SFSrA?zwG6tV|b+v&h1>IzlWWaNisl*GyArl(v zwhxt$WtVT4k3e}VZ!LqaHifMXs-M)jGi!-yF9?KnLKq<+i?_OGXf-r4l4H{e0vz_b zv``o_8I5#ao0=I*2-%UAAlfaZdP}w~R?uSOW44Sz>9T)G0W6C)n*`xD#p$=y(f=aX#D;}HAHmF9D6Db$|_-3u&^afDh#_(vRfZ(@cY_+ z&yQIKiPlYrN5sT}x@oc*LyoP;MH?85WFR(bvS`~C_>`F{n4NEmkwrODtRhNCt(Z}Q zwoIaarjV#b!-*W^Q<(szND0*jV*{>kZL3A z$XK?<7T@vc?8y;g!wXkt_398RB3H#_X7FCHHz}hSBLZcnEMpwBcFSBG6Ewe$5 z^2HHIPHIB{*^$$5kzUQ(phG)jOvN@_Y+3AC_@P4_L-^a(jBKv>dRq}w4To26*OA1_ z*kD)`xl$NWiA%5}fr$aS&x`vfOO?fS;a6%iV|ynAF4 zcGix=ylw`Tymj(mE<}!YAemC2LDh2sYa}Qmhp{hV+A>a;G_Kqx$t=HEIG?a@hq=Q`a^`fWI zt#;VdaZ+j-HhN-D9FU{0m2lWuoO*i;n_PEu5gXdn(>K|rv)<-d+b4J*(_)$XY?IWG z6pL}gjeq}U$KFI^m>j@{dd4oRGaee!BLmV@kNd%e4#Xk23Cn4)N|O5p`n->feW(&+L`O{qWjDoVT&;5&(d_NAI2$_ss}@EM;)g#sQu+P0jEhlQ`%%ABC8mI1%Y&v zI2yU$zG33kmlm^T3eb!~6`C3^K(od~1kUJhKdC`)#%Sr@L|?#gcPo~@uuKaH8}UM{ zQP=?|oaYrq=7@hr<^#h^vEr0ecMFX=lT(s{)1sKloRP}H6M#6?v!kUceZ$lk1*zFT ze06Y7IqL(nUvur&Nn!+RSzLgu7vVsX;i7_P#w%)CohH+?WT7Ex$tmGML`RAxNSJ8m zbYlXh?J`D;tZ>Sag9TRKGFp?VPUw;(W#52kw%&P}rlMg3_)KqpUsU^uJrIr|% zcQYtPTcg=CEfT-#y=x>>m)#$5aoIdjy!3SfFz#T?74ige$2R@$JwRzBUkkRn835f zSuu*;L30)vgRB^+zfp0?iLt%=P%QG7X6Ba-uJcO|UfO~EcQkQb>;bdpw-7xBm$K~H zvujTa@QH^YudQrCP@*whkIc$k`&(SEWi2FbTfEb~8cEZJ5U&w&v#?jwY7U7?Ba^`Y zA^LL_o0xlk16ptO37oxP+Oe0dt&9rkhK^i*#zhwiJQn07!a16bt3xZoQBz>8Qyp5E z#562ROlHKKxB(3e?isMjlOb_qVZLl6z>!{Q~_&GZkgjm=`i>)+(q@PMhko zu5fFsUQ8l82ZShkiL*nLfYI(tYDPpPF2ZuX8vRBDlv}OD>?P`O+e4x;CKZt`85}_A znQn}bL{{IsGCi}5imMKtNYXcMFDip-v$zA`M#!t`c*xaT)5)ksw?%p}UZF(a60 z927mYG8eonQE5b}uVV)a2^+;+SuCZ+Gb?&UAAn_*bcE6k;IijQ<_@bFquXc$F*f3t z(I#rZOmiu?rG-QXFK56U2wxy-W(j*{LnjG2J+pI6Nq-vOsyJ1QFGR&00EoTh03NSV z0*)E!PmiDIZ;u0eZtFtc{Y)?unMv%-WPcKM%aWF_V<8S`ATO!LdIU63dUeAcXsWqG z%R7INdyXaOnoU&^MhoPGUtxssrVRg?ilR4&60KWR^pl3rB&l;8OF{&_Xi~(fdeCLg z7+r5jHZMWmZhQ=b0+Fhuh(x+!EPKW1wtliS*gnh3GV=q>$}PC@D`X*9{!_Pjn_h>! zOZDeVqJkb$GWOy%573aRGUw zUVeIm-u;X`79%nS$y@m6u^*Fe)~e|m>gpCRsmvM|xI##2im?}uf10*)bfl%?^)o0z zQ=%19NeN_ep0KDfHG#w{VuWJ_K%*?sj*%EsYDM8sEUezLnb*R~BBw-AT@24-{F?w0 zQnUp{{NGBf83_^N)Cwna#jA2MK`&(R$`Laql(Qa0n{AUN2ah?B^>|q#*%_H`P_VR$dINyW85fwFlr$ZT4s9*6wcec+F|U$S}JryDpiSUc7qe@VqG2V z(Jz_b`@-BBSc}VRV>QI6jV~>(fv`py2<$U!Q4k}ZhB$Q-=_>W)u!nq0Ya!N6N9)O9 zX8mNYVjYuEgtdu=d5i~fW0bXD&g{*N<8@S74nUs;~6Kg|VUnvH@Ss5PWwH}_UH zS{Euj72P#tp`(N!u8-G3$F)FR?hX{N#wru;NgL^9<)&9 zu_U2)M0jbyo}}|_zplYed`#8lt*1hwlU)a1eH0tYv_3)AhN%tM4-%wkry67@?nZ+_d7ysI$=Uj8V-up2shdtP^15j@`hER$r1K?+ zb5>s$M=nC(v~Ilqq;yv$)F-057DU7;LLG=;IA6b=xc{m?o%-*}7NBl6y`ijbYJ9a^ zeGJT0>n3vlVBIv`ThvdrAzKLtTz^r3TQ8zLuTKPjUK80wq7AGAtr1FtG`%3WK{~fq zH%hI~T)7CnZbp>K4bt|m)R%|GxuaoXac=_zIfW(&i+Y08Eo8jWGGk998ZrfgQ=k5R z1fnsC2fYSLM}4_syukn*M}0ptGhM%H^l}b+##FZo+yW+>cwC1>1-TBiwNT_ztu=7! zC$q)t-cmPtY-z5&@e(2!jTezIjCtx8Fo|b*qtphhlDLGL^BK`r*6wKQ?ReYU+PY=0 z+uqjE*{QhKoHp@_r{(_WmRn!=nX_}bTXN=e$pqG`%S7O?pJ(vzpPv-{vj3j8F?We> z5n6XeDR=Pj#ROhHx3T9EiRsZgI~U>oF%PdhIhT9NDF)KaKbtmIuSw!{055@aa1FfE z!F#>MF%+}ueVxQV1Mm7%4VF|jt6WLGjjxYdyrw#MExhJ`diG(+p0% z_Z522w>SnfyM97%47`6{gPv6F$KX6@@#?+DCE%SvBeqFH$}@ji@A2nUyce8%&s4PB z<08C6>J(*wd_RJ}vp2>+^&!8pEq}>E8gCPL7h7Cu7sX4^ldc_HC%v8Eymu3sm; zmxFinI_SM;o%B8c-pAIUcOLKi?RC<75WJR0Y7^(`wV%*?qQxu8cf)SMN}5_vp@@rIFoN&rI*VTH06~N#-VJt{z`lxLQ=< z6IZXH`?ZSOOLNb9WNvRR_l4Y9xr=jeKAMaF9iARvoL`!sTHdsI=TkS0nrIWKI5!nJ z-a}Kfn9G%qUfp_1`RGjR#`4kS*7M3ouW#K{xV(J$hxzjA4=Sra`B08G{Gd#_fz_`K ztUhorPr35ygXJT4tekw?jrTnC(EVNI)!x>H%IfFKM|)e_Dyw%2&CTW2FAuDKu6$Q- z>n0&#^L>8xtNOHhyu5mKYqh*O)B4=<>T>Hf<<;w3_m>ZUJYRUh@pg)MJbx{@X}etGLKYEHGeQfAFefW@Il~+G)poc%c>8j&0qMxXFA00n! z=IIFv+i=Al8y?xT;gN-n$Llr*75%BaN}e3KbgMjQ3R}HbTIJLaORKCNzkjj3`tsHr zHN$6Z)7)j7<|`RZ^V#yaX`3Vec3lhEJIlu?P@9uxEgw4vO1a8KRPy@P&6Q?IEw^r} ztbV$D>w^p^5$Ev?Q{HvyePb;tP27!(%zp>Q$Nx|G)xJ~$H`RMM}P4Rr)4Z?)-T9 zXz9n5)yabc$67X4Rtx7bTq~=yFD)Odv{r{#e_6h(BrQjVUxE1sX?4>pNAB2g(}lEt z`RH3(zby#kU)}KXFY{1gvP$Oi>OI;Sg7~u&KzO5q3%An$_mrFM;3e@Mmk5|dD8xBG zB-hxc8TeiyMn~R>c~b{F_~f2%CX`1mRIlgI^oFE74!0qg5}$ zz-uVtFIPVo6L~jDrgE|pd|u&{_lEMZvmaks9ez#u*zhYWtEInWh`ti|E%3UwL|tgu zBX__l@4SC+c~!8FmoH)h-BUg~{7OTw`J09eB}60lP`C64#G}^xZ$(}G>XADRJ(>bv z+4(Qhv$jUZS{`@*iMQpx@z6u%)u==5dT83NI);zi@T!`NuEd z=Uez|$?f4=cC;Eo*CHpd3wF3{)X?1^yz%s+TeBbWbk&y zu!R_QGfz*^9I|4!>C@MEx>%on&Xb{X7Gv2^c`8pLS+(Sz%~PvBUB}at_337wF4U)Y z#83ao({mK|6`qRvbRuj+7VVbYlX)_*Z9JLMF5}6Rwx6e7#d|eRJ^IviT1)Po{ovfHHIWS3V{FnxPs!ox;`T+*S~(zv5%a;`>pS9Kks`_dFB89+3x1=|Kht( zzjf<{5#B9tdf!uWS6%y^4?KGFsiO~E^PcUct6M8y{L(jXIql-dzx1asJa1Re-~Zsw zx4&upaUU7{{QDmD^@GXZvsZrWabJAs(rs9~p$lKoWv{T+X_qB(<-u{!9tX}#*=X5;lbALVasaHJX%fEfxJ11{0w*0*5*H3!k z^KQEMs?U9I=Ubn;{Igp>a`@W&p8E5?7yQYlz56>aeagtkuRi&jBZK9aTzLD)^&j}q z#djaS>8H;-H21DgKKXHf`lT;_{Pee-`Hla&e)(TN_VfLxeee9=p8wk~4E*PlSC=pS zhfm!8?&dpQe#-~%_}71W#8dz1lfumPlNYO`OQt8@e6*$Mp@*bb^J1cMNn6{^O-(mi z2$5PYA;6Xl00Z&0oiat5n__~7EZ@GS6BY~39dTOp;A=01dUKQT7kPT!sa?Oy<%G76 zBcrsrNw}EcbX@nCd($`~bTv0wwOnrKx0@bFZju=<`pWm8eA;^r&bV=404ASJxf62g zvtWK&i2R7&#NY_zvGS!K$t54zlbKHhk@YHsOhf=JOMYCNg1jOHd3y@-PbtV(Qji~| zAT84I`iW}z=oI8RDae&6$iWmuB%F})U#1|Rw2%{XQR&~akTYV)>82@jr^FDEgyeHt z3>mbLQ)9@Sg*+mLyv;&Rk0Ezk$jLF}hZfQjLr#_f&8InrJi$UviXqRm5H}K@mx3%= z$eH9ak0Mu@PxS7$1Q2X+^$rw=0|bj(KUZsIWJ~m0#{5Y+Ank1yBy%K$$ox{sR*Rye zSRvgJL@Hr&wOf$zkCSqjc-qPhK$@FmCd%i+&t7@q8LDuQU;kj=LUD4wZeQdMlS@!0 z7Jl#4g0e(b3(Io3-ehwrPEgi4L0JcGJO0>~xU9QvF2xDTIyWdQxBK3^ zT(0|VF2xDTdX(mZx$EbKp7(vWIWFrASxopSPEeNMyZ1W%L!bI2nM$yC~$& z7IBG>;DouJ0;IVq%C&7_-w~IqXmbfpm}|4vApGT!ItkdMc3SCaJl6 ze)EJgMqRG=*<6BSYW*V%5nSkaCo4|_(%d9xE8*uMazue|;w#gW_neD$gK-HFe{FkR zyF}lPv*H?|VLePJd16I*De)u5ZpIPWhluxv|JyjZo68`@-z-iO3w#?IN*oQPCN2zy z*3e}2Z{qR5M8J(nd01)cxR*oUxh?| zj~D{$j7|`@dYxBLc|ZH@lEcqc*$>~q5E4Jkn*6(0;@0RzL2+rI+Wt4Din*`_#q%ff zALdgOkn&^r~L@}{tjct9db!F}#QCC~D>z(S_Ry|W*H};yuU5~Cw z*+X5EY|x`?QVy{j64yR%NYG$3BqF1sAq_=nNJ559LlTN$Ni-NImPR8C4y~u>TH9J1 z;h0g;7{}0QUk9DWIEGHgI_NaUF?2fDL8l?kjvcjPzSh=R=_!m>dk3reJv&-^Ms~Co zs`;Ev+uk!$sq|D!gZUk;{e>N^1N~*vd*orqA^wraLXSfq9PBBMmMcA=7l$l5s0YCk z!aX~-@;w^k7kl&lrNN<*;i3Ngj_uKZC=_>ec^btXT~?)N5M1uQ{9virJJi!(_HwJP zv0nasz)kdutK4bN=-h^3h5M{&HMqU4yF<~%YH(Do1}{Twxxh*mz8*~^jc4#T6Kx#@ zAfGx`gKtjYsnuY@Dn;a+t7P-*eeyZ1$`aOvA~HT7yywfdkB>--KE$4p?02pDeuFDCni& zY?W;tA9?>QynBIv5S+KkMvhOt_mzJ7iN#SwzOv{o0RJEGCS{AqrbW0+bGB9g)oVX#=f{Eblr`|Ao!c!AkNU}~pY&%pc=zNiu5&6oh-{*lp2fQ<6qsm9NT#D!EkpwPNe8A$!Z~4@-8r%ck zn8lTP)UyhG={o7X61>-~K~HwZ?^`FmkAnBvHR#Fv-oH+IzW}d!6B+o_dtagVgiU;T zpL*^0^i8?kcK+m3kDjofD>gBI`IC=~=X&&3Hsx|J<4->I=t=wCvMHB)FMslBMDK%} z;Jy6GryjjcqPt^?;t z5--6IWW2lsoWD!rWzhR)aK4em%b@pba87@czJ_~`40=xmrz?q%?1KC*Et;iTAp7;EBBPh7?{tWhE{m*xS~D zC*sKMS$Lj~5|rGb6LPt)CGh@#X8moWa{S-2{?0Y!_gwDGN#EUi%5SiBd)W^kWPJG+ zrANNNz%H*IsRAE9b}@FPKdl_Cv>vKpPl^HQLV0yybK!QG#D&!_iJ|m!rI9;-E=Gls zb?M3l1FNH8$k5I6IC6QO$G<=cEy%Pi~i}|(~(2jpq@;?>B z_n3UUQW!qgzq{OQ%xnuE+`tF@I&jgQ<--p)-Ozp8jb9Nf zOk4V@84TssV>&RMA*Kx6$Pn`d&p%#%=#x?eL$!Km6SnF6OK+Sv@X#GmjowXh58ZM9 zqXe92(?d6x-&nZyga}HlY$p2sp@$wSt)8q^EgiXId5@GL)MJdxz^F4AyCo?aZgj?< z1+B2*rgKfY45~Y$!ehF>{9T+m-Hl%-v9LOt*LrD|$N>0eH2{vs<&nP?GU~Q*taP)? zJ}iG_ddh6hOTr;}Vmy>?ln2Id=?l`En`H+l5N8j(Pf3ZL@#>wpHP~WHHx3*-ySqY% zK3CphzYdRHY>SNzN!Sp5`>iKAx`Drz1RFrB7mP@e!)PG`+2b&VSR2to}-z2Yw>Y+iqgs9{HE$;lkkuU;2{MZp(f3 zp@;6fg?wDN7-J&+&^}=y#z`WXR1w|Ks7c%PJ3L*(UrX-Ce4Du;-E^M#xNW-p3VhpM_Cql|J&L4KM!{SY z^#_JOto}p>%-Mo3qvu}8cWBUOtUC5?S|+mDKH8hzJ!I{aR_tntqHfAXU6yVkegkN4}(mF_uZ9CQ;F*dI2B!E7Ev}J5^Rm zjF}BLy-IQ(K7KZ1r}?W#ezbg6GAwSJ4{1t)(egD05a? zT{yjQixZbhoyd0m9KRd6>73P%W)L}6`0e2bPdHeRS9s3b%18V0yri$KBeFPlc7BqTw|qA}fLv2MF4OW-B`*WHHVvh$jIwGKKdV$F6MqeVCzA z5YOX{wl(kxe~{L|KRRlVGgm5+{~TMlGgqF&Q0pz+CeyKOck4iQM-bzg*LlaC#huT) zv$*$p#swDdw^tWx{82A{78L9Yb@srGJ8GkLg-SHDn%C^RlgS%F{aO1WPefytW zf7!|(6mC4!)V6Xu|D4b@a4dhq^#y$unAZ*E@q1ybmDNv_W8cL?`$cTJ^*r%3#J|1y z8xgW@T)%pMzmOO>{L$ah`%zL?7M)E>=TRv-r<4&po4+OuT}Bkn+)UbKCch4vF5buXo(<%HGYR$POSY3-WE}zZjAN>|V z-Q+M&lH;(#nl_x2+c0r*ZUb(88#+#x4xQ- znn>*pU7`7rHRy`Qjym%#AE7OudUQ=&2+ePrKv)aA)H0`8%o#A^he}Qd#!O6p0G8Me_pH@QXBImefwR7o&UHK zbB|~`v+2ZdGuNwt_=wafqsWa=;V;ogmP<22&6Ci&Phn3urzLmJ@;ObXY>^$k;YISV zw4A{es^&>r&g2r>Z}Dbr7X2TC<617Njl7SmgL#s&3|*nAJ9r@S$)fu|z?s`@N6wz$ zZ}-W$v*F8UcWhjc9G{mj``ORG=B>?>ytVMa=G>mgp2gpj_&bxo4g6i`Ijd&5s5W#> zwTY2S>VN<8iXC^|zxnFFKkH{Vob_MN`2OH4pECI2^B=RP>*inl<}rWqoykA``q6iv z@$ED3{M;wU9(d;aFaOlPU;2iRoZC75@qd5At^e`y$9(Mi7tX!&4}LpUdGOjzOT|xi zKK+z`omu?nUw-Jf_x|d4PyP2F|N5RQUjFPaEoA($0^ydHk*0Z1d_V>pwuhsjn{p-8m zf6LQv+V{Zb|NhhedD(Q=N5*S6Y#IOj7ru1b(Rb|o*}HCd(Vbs-+u1R`b&*Z}9yt4J zQ^kd6c6{ptXFvKopZ?Elsw)?5uI=4&`{;-7zW(ByrZ@cAZ>ImI@amTPyKngZi9czc zxS*a(?JHh;)~nz7-NoG0yYKFJ^_TyB^b;TX-iGV`=LtJ+p1AH~O(*`Z;^%&`x%>1- zp7ofIzVo{I|LQJQzxd0q^}f0711%??@fY7J{>@!K>pc7?-#hIk<%{P|{qv8#Y3m=q z<>~+XlVAL+-#zbBvlsqsF z_7}^yf9jo&eEVPT_|%8L{(=3G>+Ys&pZ)s$d-iOJTzIE{(bNB>*PPVz)Aycx((Rw! zE87hHk{(*)l_=Y|h|_Tn^-@QLQ8Gx(NT zlwbYQyVE$QDvody!9KRP};j__B(KI_%@{%aa%gW}xFx4hTyUUGTHd&!F6 zoSnCiJ(EnyIzLizge6OV4-Y&(3ujkS<4$VPXoB5U!uKJG~zm>+3 zb;&t9XSd-wiW9Zrx#!C{M6%B3DvtD(q}+buk6)0+d6eRa94~e5zW2l}X&jMmo10$A zw~Vp3p8CX}q;bwy9BCW*oO5#(Q7T!V3rJ~hk`+xx_Ql^@`LMyki)Lxmj&R_~Mo`M`nL2gMw{wf8zJq7tp3L>M*e4-laD=R31JXRWk&)IREMFT4z z=SqCQLe7tIj#c zjB(y;A;fT_ z4NZawEEuFiAb^2TvPl*;unVCHDnbGYf|NwEi>RpJCO{mb*s){B_J}?fz(S}2EL0H- zRa9au*bwxQ{IBbrnVp@@rue-7@BMw>ftlQU&UN4S>1}52!!PeN$5w!k(=XS5vxgL) znfKRy*dGd?MBRtIjqpKFBprKqvk!YM;gc{x!*IkAK7Dj$?D>Vy09_e-LWzmjxY(-; zADxMVwk}8OZdj0J498sar}1szBR|3gAwG?7CM5A!3wCyJ0%Q8bmAhodr@K%6y`!zc zHALeQ7}MvpZ3P!cGrD~Px7(Wsb>(PW0%OwE4p>9iS2x}Zo1S_FxJTm>7?ZB{f{WuL z-SbPw{16-DdSBxb7?Umsu!gR!D=%DWaFuCX0%OwEA;<+H%)CHzW;vX|m~?f7uc6Cq zUcjkw35-eCr9m!Ar743}!F0{nxCF+eD=x^z7DQbJ*JB!&z?gJ(5?mb9Ew~Q7y>^aa zl;8u6OJGd8E)!g0rUdGeD9cj@7eCge6Bv`O&hWKbSYFhXHTn0q?ZI^Q)vAoZm~?SA zV&vh$q5U%quBjTAz?gJ(6pVynt!L~cY{kS5AFa}WksD|Q%g0%OwE6TXHnnrNsS)aBB+1jeL` zGbkeuyN`Ju)&cbPHA~|X7?ZBvf{SgOdD!f^vRuQk!yOuzz?gKg_cC-1{Lk7O4K7%` z5KdrBy7~w%F}DP@bnwBZ2G>U#m%x~G^%Y!tdG&ufVVA*mM&l9~ldc4luI@uV!CtPO z8_n4b!wHN@7dw0-T~GB(PBOR#Xj}qg(#76g)_Jzd&(gE;!lJJ0N{vfkOu9I37`m== zdFLBki#0BRG3nwkVd(ngqKXoO>j{lZU`)C=v>CcSysy&$gKLY%B`_vk9Db}8j)qLv zt-0@G(^gN{*BY0=m~>&u5u)pdnJ+pFt|%_f-~`5`D+#_;rK`KfB`_vkg9VpfH}5#oTcI>q+dB>A7*Q#w9Q&UBd(y z^N{UpN8S~07)B)C(6|J~q$^o)>FN660soH%*Vh`Cz?gJ71(#l4mzAA--Qa3TVQ>Ot z(v<>Vqi$rq*)_!I#|Vu}U`)DF1sD5y=7wc)$4Q2+8#OM0G3iP(>H6!?u!aWLOB$EJ zm~^=W7yAvm<*74%yEvHhM>H;hG3go(tdXuqCN6v0;QC$T5*U*qjuC>(Mn!NP?%YzO zXsbc&;Bp!WM~vAxh8sS{`hEZUf-4NJE*cjxX0CJ-*N~I{T4->kX zH7;VzT%$}}6WSjY2;ATnYh1*bxjgVO42+n~lC0Lah%s|{1s7+VbiTRobSFZ(QjLok zGuLSNSYeh@y3T*TeS^VOr-}3>MoJo{`OqJ7LSEh<10Sn}ukV}PSa9f83V0mzwA=+W zd6110;Ah}~>tI-w#z$ZfU7lU4OQDCf#4vsK{45+?s|WmFVWvc!=rtSZlqO7qk>hvx zRhlme`AB~Ota{M0hh~`rM+owGdEaatvP%mgCV84Y3b0gV=R=dGoz+|zQ5-s(b%IZN?TQSk3RBJ~>!%WY@ zkpeiQo9FMs`~r@stvVz05~hKS+1WUfYxd09Vdid(@@1Z6`F*o;g(;9)vk+LNe$eVWL{#2Oe@??jg->nP6f&H4YudW}{oaY_ffqpEGCgyE{T zx?%!~?yHtUCALPv!7i^xu?Dh6p`o2*jdD%k8b#~fj_6rylx;@WD71K4b!fUW@gceYfbt6Ekw{D~Zr1hQnNS35@ zi1-i}hKC||BSMXo(x*Czlu|83O6gm(lxiVTNMc;A3_~qYMJ~b!BSDR|Ic(&JlPRsLc&pa%PdKEGstUhq9sh(w%j@uwP|J^SZ{6tB zaJPHps4?DD-RM+GTF|ajLV9{y#>n)v6g>=PqI82)38T_ehI>;-kI}1#VXF0On*kE`mHfja3@qqN^%?l-CWI;o-Ol^6<{Gk{6B( zd0mHkxOsG^hT(5IkuM>e6!e>g>z**&|G>h)s}Ohn|LXa2;f=JsRIKTI_|l0hF$$$MDOQ zKlZwl4&QJIUXOPN{`&KV=3X^D1K%gr^%m~(zeTTwGv%iO_@+ZUjpypE>BZ?${QUGo z0DiyWm|Gni1)gZPxtH-pN%kRfKTu~2b+Ia`MvV%S@he@OAH$EYX5p+Ud|>iXy7tuPFaf9&-n9k(z4hGMPXFuH|T zAX#2@o36rOUNl+z{%aNld#vAvgbYnDZZtR@pKEu=*GC?FeMDOaEg@7ff9RF2ek8a& z192LldT#y0&}C0KmmWMJ3K<6}_$DG#%b!6cVeo?&5yE zo$H<{`xW1sZ{jCd<@aymhmGZT{(z|Q>61;Fg-qwJrcGG}ioL2$c>xsnm~9GePDnrQ zTuMI&s2(D804VNc;*&*Ce5PVk7K5@2>H$!a*V4G2(s*3(ydFMVQ;zYbIle|9U(A(M z6n?Yc#p}X#>nL@9qdbFyp%TaVNQ%9_fqvNIDz{yeS)aGR^smJ$XFt$z;Dv40lmpA7@-N%}@{@;U6lgy3 z^b4LXF(6)gG0x@}UpU&z2ZuyFyY#Nr#%Tf1(F;ysOb>@R1u`BEt;-&A%;4H9c;r!* zR?~wh)I@N}8muT8d+zZYT*y4(1jeL`L%gA@&Z<+t8C-E%I};d_F1As5#sJg&X30&X z4X!a7m%x~Gu}2Egb@!I>2G>m*m%x~GvEMOtm0UOM-v$@Y)1ng?lP=a8Ls#bAFSIkb z_G(-LV|u{G7Hm8!d;0s|-q9cF;8OyPix~4m9rmwQ%Pic@t`(}8zBmloBmE!m*@^`d zS7wnn+qK6&+`2OFtZM<}3^9ow$w+n;NV(mhCn;pz7A{gQD$Tna)yk|DR7y4P4OA<& zR!}K*fN49STB)^x>TB2$!(AC(ugj^gDN|CCVNJMCpZI^WHtW;>^8Ru)$F}?|9+~_nm z0aKro3pkF~k#KBR4KcXJ$_YZ1dV3;59f29cAs3G7Bgvzle*^Q8hN~(aSD;J&6quf3 ziU(_%RmfvM-T5NSmT=KkC6A|`4gluGRuab^BvSmYhJQy)LvGqcB$!&Q}D%IgM9N;ocpyi8!`hT|fX#~r{t9FB`1Z#^*E!f|2p zSRN-e4AVhZ)n3SVz@4o@o&)@}*xXNh&movE5#l!vn5p5ou=uh5Ee3`bl+d#ftFXMw51H+JEIdc)+2cB5e=vTAu4+3P`**^Q5SI0Rh55~*B6-4;kXF$<^r=Q92Zs|Oz#80 zJQt3OAa5Hmd&6;IdtDeJl^-<>Na2!Wk}Fx~j6+C_Lx$`3NVv-o*sm72F2G$?3mk`+ z+iQX2oc_UD;$Er+jvp0lss)b2)&5%GSntbfiL-P7IK)NDXO4TVE8%c@LD(K8=kaaA zaQ}ln%6~y^-v8DfSFN8IYfy|C<*w8b9SCw_VlYiPH1r@Q-JkGh9~C`BZNd~3~o4+Z&Bv1Lf6 zN*oK#95iEy^V)0HG}O#TV+@inuopRzrm8f-6rxiNuyllRBQ>Ca6iE(^`}YioaTOJ| zER%NH17GsD1qsBiWUNZlhXE4hv{ z77m?n1*fkxgC+FtwFk2K8w@mtW!+7kX9GK-$ickxO@W-CR3qbi3n512+w(Uf?BG!NG83_-^?UPPqV)jct%$y6$Q22 z7otTb$L8}!Qb7YcdNT5-1VyWXH4!DlevlUTz&p$&#n-V??ks8(`k^=m3BMVjx(kZso+PLhpt=d_UQoLQ^)e{QTL$VQ;rDaUuRE&yFyS{A6l=Uq zxe}D*xEoZm@OuN)0YSYR3@r!c6n=alct}uoP?C2bsC3~+D|PIh%J56&WXVqz75;wz4Qt^S{!3_T*3IV% zuy>a1RzC_AEp&;9E&YpHd>7Ns(xY)JL=@kM6P*BR$ut;{g9yP&bBcU)ARkSX@713$ z2@rEK6_-uP#QjY{&BcAapl-%JO;C^E{*IuY$Nhaly@k6BWf_eSekXBv3F=~$jPyfK zpUCu>tSRHsN1~|35+lcj2^<%ee!m0)U=-*ic3+ z%laThSzbW3&?|&2Ii$Jhmi5NdEeMNu7nb;&uV3;ho@_1MMm5eUqB-#y3rrxZTA{06 z6trtSdYtvn4e@}vi!d%0(ZuE8C}w7{S2ua+Yoia2(!88WESf$nV3m4`UXEjiqGfxE z-iRv!>490qo%9;$T5m7xjmSeq7oilgHKp3KF_n+T3L7FnJ*t1br#LmF5G_16NbK-poMw~yV zy-h7ns*I)w)(J)2!qVarnWAS%svD|HQ{xdWG#4#D7*&5Z1{OvWBkDvEO;H{)6?_PV zY=xwNsH@#m-7+Dta-EtS0=x!5=Y}=RDwG6M8LGqATu(vqa$5B(OXR~!78`O1Hf23l z7(n%|OHcaP9%vvk?v{*A91QL43vj1s7HeA3JeZ(#m3WHg?WIBHqIno6yz4|XnCIUD z<5vA8!0dHf{p%Qrdg9!`ovk2hvp`Kmh<9(PYbV1n=YS+zH0s0y+*o`Gs<*rYl;6`QE9DS zl%V&xTfI33MYWenvfdnpJVkvrs=s;$`mS^ri>ZsJSWam;cK{EkFo@@I%s9xd<(99R zu6MnHNR%ysYJeFUF4$++q3VvZ$-ub>-V*PxpHNaZia#{VgzGP6@ehQL?AJ_nb~MDw zL17vw?i$#HrM8iR`Zw-zg4%>T$5ERSi&#rP7bq_HY)U>T8M-wXN~_lcL}-09svd&s z3`+9$2PHXZD?s{jq?1$>TDzn=2B{QK!-bTEpd|0>pe`4FCqZ#uZBu>>hVqO4MB&#O zl;r3iq{NtrIBH$6NBwdly5T&$BH%4fjdiPK>BZw6dVj~N?gp5KTbF>xjZSI>|Dt0M ztrQh(7HyWUh9}3AOgBvkA0q_)N&&lnH(v$dEC7RPTB2_#x|?U|jlt0^%3iZUUF|UH z4jt>{FxuxI^XX$~hBk(}BaERkN^%VKw~sths)x(#z9a1f-zT#{T`6)vB*z1rhM98k zUBYzYl?h~#mT!S=dDm>^=4^jlHsv@XoSEu10@Gp_P)|@G^q9>)Pn{X%i}E^w>?t)ULod1=-bBk?uf z!c)E>Zq-ULiD_CDa;u-v=z15tFe27k&WeM;Hc1;O(`ql=KsiN8We>=|!GMB7c&vY% zT_=Oo;+?z~2)%_n?S*Ubv*FGn;THK|glTDZ+0jsKJ8bLU^d4&VWK< zA;r?HuF`CJlf1^6jWQa>!wc?e`A6J6xXX7^Bo&3<6NH~I7&={m#FHsWVVWsIStBGx zj;n;9Fzfevy}Y`awhVYEy?E0chajm(Qsl}MejU(*H|*C`v7Ks$-v(DB&=MOHq*{Q= z#DypRxO1aGcah}JL?GWyL0l;tI_StrSG|17cGMt$E~FTy{&cy_85tX?AFrEd%e2PV5p{?+rot@{xM2duyL1edwMtUVi#vp0s1a1H5(}2GK@LfgW0mA+ z5e<`y&6F1R#GHZQ*1gdsQF-+<>rt>Wq7LuU4aXm;Q&N<`J_yDco7PjB{!+grH2y~< zlelw)lAMwv=cB@}Lz{X^o8MY1%}>QDQ3qQIw9XlWUlPyqlN8HOauW4aNbW|`@f0xn zJ6d>#3mwWo(n0yDEM(0^(y&S&e8#N1NOJ#$K&ukTG^Im3 z>R5zHgm^vN5po`K1PtCjcZ_yTssSY>Rg3GCpE`b=L;F@1uQ3dAbjntuJK=-X>DS?7 zWe49op|9|peeL|5Y==L8_WWygzfL{-^vfrcWBP1gesm}+KI7Hd={+L{hlDwNH|9Z} zbW$ollYq#qYlGfGTks{hAHJFB-g%^TNy?_)ryoj5*uUqp!Hai)Hn^_q-sKNEzZ%?q zjPK!xQXYTg?zdlyeXRL+n}ZSEhxu@PEUEAFFdh_h2^R7JB?m)$$qeDA& zK73^ME9Zao^i97u|CcjAy?xCuqvjTUwyt+_&gPHLoqpopPR;VOCXCrRabV8zBirwJ z@Y~amC3I|IPj0es{;E@N_G|F)4_gxZK6UtT)a^HY)8Or^9L`qPrEGU?Ps^V?zuSql zZqCa_6s>Re+h3U}1$Vsm_^O?&AF~y;IDPS-xA*>PLW^5&ig~Fb>)NHMeLUAs{Vwg6 zH`v`;O9+~0?LywoVWat?&@>@^GfOIzFVe!y!ywO?qfGByy}Xl^=6U$ zzi8+3U0rGLZ{?Q}*_7Gi9LQ+xlrLw5V%VOo7IwMyaNWD^%4CTS#ncrTcH~?fZ2tUI zR%Hyi4QrHrN^aR+8B z>_msgnHr=uN{0OF*=?ASg<~2D32x2Svtst)eudfRD$OTK(YgGZk6}%a z7MSS_yMX`Jd<2dB?$%ki=nRU&rfhHe5M<7Ma%Mjo2mC}=6CyOs)pF}=uZ7hIzE0JZ8TPn5x> zTdWiq(@VpgJQ`NY`rNkS@~EILkETmtOuD#GGF}?~s^`r=7+f$tCY->SbYY35aS?F* zs?iM$+e>$ATmoa#)jY_>LZ-DmgKM3}B`_vkoC+IOuR2cpBh}#gSmP2HlP*4|GSc;J z>^%hr*N+;Pz?gJhWYSg8dL#@6vYhFfXoSF+ba4`I==!oGu-f42rEv+2Nf#&fhJ~#a z55F|g;2N!Q35-b>M=e8F!$t43HMr($Tmoa##WB&S8~=Vi;cUZTy6)7t1jeMRjY-$O zIjx5oT)I6`fida2L~uEH$Mv4_{BVQo6HS-Em~?T}GSbzl^y2#ru0J&{fidZ7C%9y- z#x}^((aQ|3_MBG035-b>Hw_J4QNJy@)8Imm%-QQ5AU6G&#i_H z%Z?hCz?gJ(7F>EBel#QYF@tNg#w9Q&U0np1tZ7(=UcaHK!F8j?B`_vkT}`@19BZ`F z;CfEu5*U-NZYEvo>&N~uxDIGs0%OwE-K6WP7VYX8Tw*$iaDg%D>LIxFI^Usa4BmU! z8i>+Ut1<#(($&+XYwymEs|>EIG%kSw4mRE3qj_S+*em2E!(KuT>mJ?yOM1VmXmd(z z-)k(yn7Mkx$7*3MqI+*dJ&d9HROCMz7cpk8c=%W?tPgbCn>sTMu0&4c;fOJF^?{GH zr_S&LBU-*-aOG=U#F)7_s9P-@5$L>+Y(~Y=WB97ZMU0t?^9A_<61g6XPdILHozl37 zF>`TFVQ^jl)%_0}TrIiyfFs7t)gL}q3&%&gJBPMIz0zYiT;n3f%*APs)grf<6y?>| z#;!EDLakbwxh@x6dY@2!>t}ZvT(4@nh%s{|nz%k_x8N#+t6bwE#>~a(lX0TL9jAZ# z)8M*{(=Iq-WLlFnANoR0$m@}V;A6GyW#?>iUU2B&@7$ELAb0jnIn%P{XG_y3dO#&3 zbJM2H&BYoFhS{=b=T4LBqiMN$zS%J01$#!)8>{tsx$~zj%-7aWx-{|S)3x~K$d`3( zPoIif-et+oh5Y1z}VvwT_8=FZN?_f507WHgMh!QPz7 z>=u4g4|bqJzsAyhP3F|#mzT95KZmyFA{nd8o=-_(A6nt%PK_(vq8H!$G=iqx0DD{f zjBDDA>A}1a-&F-+Rd`REIeV_z%$<-td;ZMa${dyK-U)1YhRn^)LPe+~mic7L5fMN7 z!eE$L7d`W5NA|3Y29ll;vX6F9@>w-!<;=|sF;*7TY%=?!SF~U#*(=*=69ukYYQj!q zghVm-LTw6G1>wfzH1129lP}mSE7vWHiTJUsO`NbKW4233j|Dj>is^onr8fGDA`^0g z^~3lGu(~?P7DWq*bN{*dvEYV?X0FBf9l?Z-xq3&kOcsu)R!H>%l!yj$30`btQXWtC!FW!ag*QnJ~MRt<5k9eCKZF>>}W9>#6)ASZcPAAB)e%`781d0_HD z-NI99YH~`-sFd^!r#r+(QYG_B{j~>W!-T1%poOJWSMn&gE5kWzWGHt83rhyS!8;<^ z?Q*+^r;iL*j7Mg}`iDG$8>Vp^tm(;~4CjdS;Uhx!a|d}-h9{3oO&c{TB@KGx zQit;i+_3)IBe-Gx#lHmH5tMB(xsp?yDI21BSxjT zbf#dmFe-<}&4^ig^60cNZkH!5$ipFcSifQYIhKlu$y^BLMJVqGmp9d8sKW@&6rtKx zV(iao2U+{LT;7q+;pw9g(PYkZb7uI3W!V{;jjcZYG@DuS>10hdw)*$&8!tcn=6Bp% z#CP0R-;9G;wUtZwcie7F-Ltu46Y8q?j{D^>ocNAAWT{FKtFRoHg}t0}4k@q&{v<0I zmA;4LRz(T-VM1J_@3go`{kj%77jP{)h6n?h98*~@7cEy-!X;OVAD5o@)&j@n;r3eK zxU@T53mo(1Of7I+^0(yPQizL`f5fHM0>^E|>uZ7IM#sup;JBP#Uke=L_kAsJTxegc z?`MFfiZZCt6UGp0k^sqIBwB=R|!|SzBqwv#lj15k?P+_ginry^I_H=H*dbq z&OMr^fO}EHqFF`!PX7V;zX8lhZP%tMoENwW`pyn$x=7#sAB6vt!1+51h_H+k3CAt( zuQZHAMwa&)HckEm+$(Iza7nl#$!iS%zpzUb#fAr0RXS!PtQjyj*MR!~0t$i2U`2%E zZb&4(Q{n#xFwI!O;H6&DA%wYs zX*Wc`@Hj5AyeaU%3YfPvTvh2E4_pZ_&4)^PRpG8ia9dy&X*eW5Vmewvz)E1A99F%& z>wtR+n3hh7tEwJc4_pE;&!k9PReEC(upXG5X%bge{reFG+{1;wZIr}yz@JF@T#N{1 zdlcp8F%nl*`EEh{W@lgCMAr@*Yl z79<_(ZKQO3jDYunS(!-`@*7tq+!OGhnx!az-aEjQhU3EIF@9eIb3PmwL0+qDd=QF@&WbBi zec@vvCop5faS`O@0&{aXE-Zeme-CLGkiu0}pPvQpwHoC0fP_83{1uLi5Wm(rc!Y?H zuDbN50y91w7eU_jz}ym!3rlYtbUgyhCJl#fMCNk@dAor5qy~8o@c#--^O+#vs*~3i zn64VGs`TQilrloY2!Xg&RUR{d%dJ5k`-9?I%DW%9Cu<>ZQ!V9{0(YPm@_w$Ryz{`- zy;kN*Rr$yMf7u7j*WtJb z_1QWL^DkURrUF9;2x_%o&)^v)KcCT zz~zLEb08 zoCwE-$z%K~fVuQKnc!eLBFJ+B;|<4!$z%NH0CRIVE`q#=fO$3?7eU@u4I^V%b$vMi z+_4(uv3>jvOw&0vr?)pSN#VG#__2S!5*U9tE<$?m1?GuxT$nuO-+RD(6po7^uN;^^ z!f|2p9FW&?F22&lMOR(c<97=%#o@RJ@p}oFx5IH^^4LFrqG1?6x~kgS z55S$TK_1Ju)jX^}aM4wl-gIClhU3EG$Mog{69~seNbi%tyb_KJlgIdd0L-y)Tm*T4 z1Jgj;kqM?FOdjLc8JNq%aS`NA1STsS7bcJ8aT_oXYPjm=FHZvVN)7THOfN9y;kXF# zYmke&ii@tg^d8n{<$kmrDqkAV3>!&R4me*k06 zlUl1vFUzBYhLOms<2MjES1sht0On>5S6%!Hfw{W|c^p4p1?E6FE<$c%i~R8wuj>)$omSIpTcor z&u2JZHqK{C4Hs!2{bB@ntp$$xm0AfGQ|Wn%4Y;&QxcExAy1=<>fn)xAYk_kBmr)5< zdHKLdj9*eMaLs@lUke<|&G-aF zDi`fMtp3$Q&~=sMRjvnZfy=9et6XkPfh(>Bj^*}vEpW`2H*1OesFt{|Yk_M6y?@sN zR|mLQKW-tes(ik<7P#(^ z_nnr|x7Xa+(>t025Sr?p5av0?lQ!Dvb&c=nVE^zlu7BbBUo?=3kAHKgUk9^vgPSVY z1>LJOhoPNEim-pA{q@eCu^=};cc#zLWn5PW-zb?k`zC&AoSKW%kLTjWK{;mNPtdW9 zLLJi<>Y_q_fMy>b>KvgzKqrU&UJ~|O3|gUn|IbArH1eS9V@(XJF#n-9GfV$Xnio2M zR6X&G3x7NM_rbZ1e{;m(J17GYasu%KvZgb$`H zN*7Qmf=UGC64ZoQIS#&qg5!v1WchL&`mv>sSy}mxoJD!F7vy9s;UI=h&&iqZSdgY-4!%6> z@F615hcE9TFLiV!A<#gM8MzA<05kVS2VT47H~G_V6s*1l{(Qmd6r6~MFEnVPuq6#L z)iGs^a^THtN0*#y9plD39SidvuGF;g&aVGh5OPRJnVyyHz{^n!b9xAYzT8|#K91q` zX%e++Rb7;fbkqV|ef(=7pce5CHLW}xy*4b17EOtR4ZOK=um$Ohi-jFy=OkEFbNsP% z348S@9&dIUr^NZjx{DuL1uu8u7rvp+O%vO8g5kkrSX#=Dawq-nhw;KuF&=e0jQ+6; zQegV2y*qHh=7-tk)R?rSL|=?sy*d`${tty!yYe~-C2n;J&4JFP`6^!=j*Z*qplzjT zTPHw587`Z0R>Z@WrtbC)Rf|?40%__N=hEXBZmXzJH#;vaaVC}c+c}q>uq;s&c~2;D zHr(Y*+O?5}&g`x&TZO)@2_;*Foz2~l%T&i)!F0l~BCS@z7}jSqSHZ5|EcAvV0Wd9n z7}|7tFSv9%CIquK1ammVe^H1(-<8mKMLbU+A89BU zM!0-YZvC9K!Y}NFQ!v=jDjQ-uB`%TKHFawjM2ruwrPbWK1eJ{YBZBe-smY)o7Jk`5 zDlbSa4pR4mT7}D|yomcff_fWwDOsx)NT{#Ay0ieXMef4b)mF{esdJ*JK(Neq0!B|) zgU_vUs;;;bw!v_u9Y!R7N@tdPkI{}=(Zo+tw|G=wFU<}+tgN${DK^MdgR-9x z9+Ir%;wQ6X+3~8CZ8S5z6l4OS$535H1Ise^-RiP<{D76dWOZ2&NhPYwILV-eVRc!Y zq`Iif9FlS{?^y=H{2y-Cd3j`=9>x}_}WOp_FJCQAxB2TKY%ImMv~&q_M?W2zjI zIa|fgTGW+?&3tN*Z}{Xi^-h{)2q{H%89Neb1%26Gka|>tNgqZ289QM__ETX6J&C_9 zsGqbTekZ#mv>jPfr4{r)HgayM^A`%!!4fF^m?XWvt88hy74$#MR?rV%V(V6~5lv;Q zJwRg(ZuJ(ZJ?yrkabEN3AIrojAR=(fF?+#t&>DE3%^ns38{>{YqDruu+g+Q3N`*;G z2TtPDkz+z73>+VG74EuqsIy{MP}~8%8)VPW)-0)sAxVohMVu8e zclf3uW|74lqRx;^-@)I=bhL~TCRkW+r(IYyde^5AqbH^CNg|m~$T}^DFr$W9#Hv)y z2~%~orV6%XKZODJW$XBx`lPO)qQnqIGC?-qlq$90+(}b{erGCJi>O6i#<4S!k^_X9 zQxk>v^@_R1Q0xU;aj#P4J%Se%2>F=wfjw}$Cd*U&mY6G8&%3*S#){-szh@VHMq1don z32Xb@m|cxjNV})3kv3t2{(kt|l!drY6@Isal77#C$`XDXgMQzGdLEZeVKHQjQ1N*iR2zSXl1=Kv@_phKIJI_4f_f62RKbrqGp(7jA z(}Kb&k;-;K6@gkKsQW7`AHMz2^XLR*58QoNu(5TSXX*ySN#f}ymx@u3KX`A}ty2>l9_ zDk#3TDW%Y^>&F6@3Tm7P<%D9Qpsocaah#1z7JmN*MVrkw<^5o26y{KSgp}r>q?8_@ zq!iA*v^ay3QmzHXGY)LZf?()FpxA^@O|l;luEPtzIr5 z6721l;1_?uzSP3b@?tTD-7XwVe zBoNNTDKW73%;|=HCW3a_0OD&e;MB(*sIb_@e1^uQ*}%kt2$ph_MeKQ40%y`V5}G|3 z?8BoF@snnXb(sXyLr!0X?eT@;umqk9HF3|k$HC3 z*JJ4g9tYsRf@W)F%sjttNy9z6Obzvm8d{yBW>z9aC*Vgia^%Pik6T*dG*&LG^B>Ae_|21aS)&)GUEJ%11N2Ovkg$ARJ6oR*@z~tl*eq~ z{=ViD15(t-gk3lt-EB|X&2!O3HN6NyD{8iErKFyP6$ z!=ogq!-ypo=yO@KaVQ6CHd|GELWN5`?^Tbx)$h2FRX-ConhinJ=;I&;-k9ivarA&# zS)!>m3M@)QbpLXzhyAAmHzx|?=NZ1~?!Y^QDE`S}Eh-`d_LM~=8pZ!Zp(ATwTaf@8?(2*`Yt{jJg70lKEt@m!&C~KWtC~kGa~F#fP2?dP=ot!s0Sk@J zuOSqNWULT>--uhnzi5r*1xV$v=Tbc!*r5*(yi7P2y^9L_2bZf zNf_@A>6hH}(E25w!Egopr407M6XM)jrS1NPkOY(89;+n7^AsJNTRkVL0m?Kw>2G@h zGqJp{^IgP~{Z57Gchd2f{Z8)?>-w5>T{QchW6p|FCT?N%PbS#;x8bOGeduZysi!scv_} zwmXZEg)_^eqQJNT1GDpbiE1UibQ_c9yk@Hdf8NDq6Px$4TUvwPvisTrYOe@ot&-gr zE1JZe10}n!zQ`O|?}mbsofeHROKM**^m|ZLEI0DxxF_t^a~p5z_azu{+#wqz$yexnB`5~9tcJJ?aL8`~3c3HuXv z$xfAH>`tUhHZLtIGKet^oU8ChuUAmD%bsWMb+1^3?i!KSX5eSB5fS4b&ITqd@XsX$ zWBRBt6{yu+s7Umrx;CGOmhKq`y)6}%+-R%VT3*MBLr+8#|47IB?~~Lf>JOZ2W_KN9 zcdCV}TgzMFhX|B7wG>lwS;VTjg2vVD<$Z?`u;%CsGaC>;Zp*R^|F!#w$0kw zAGqN{b~^6tt}E?Hi$;qPPwq@(0yrcJFjS4U{Nq%A#sKKy;9Z83v3#zXs0zOpCiwbb zav7z~x%9=PI1WM{8dX@bXeL)(rTNp`-OstLrxOy~fvqv=fm>r0|9e=cUJ9n*iYs{5 z6xe!8wk}{x>t5mHF-uc8AkO80$b&@0xfyamoa&r{BLWVgC;GetBHI90U2)JLDVwk; ze;+EHP07OV`-LAniU)-s^HchTE-W$ z4hA!si}fQxmJDu)EpA&wUq^SvW^D2;_;EcuBQbAe)k$R4NtUxlJ|Z}Q4TTDB*CcK6 zf8v4Ybg&if_u=4^ectYyR|O**BO?2{IkHbPvc)cl-<{rl7uD@SgzuS!gvzc&tdfEc zdzeqjc)oKS;p`T1e$|FGps_daQO}Fn1JA_yg25Pt3wUgcY8_bLUdYL{hwW_Oh$wsE zj|8aWW3YgePc}Fq`V5|Geyo}soAjf<4Zse79l@1em(vL6cKGC4V=!7d{7{ zzy!ql zUJvKs);CO+g_quavnV|KTd9eOBNF{iw|X1O?dtflOIQ|IW%lL{Rkw6?T14MNYY)xz^^hcd{(Od+~?cl$19> zhS#mWNFo(SG7l9Bp7pczdv=iKS<@Pk*q7t@a6$AS_r*Ct%C)n*2oqu+(1vq(GI&x^ zva4ty3rlbN2|sYU#fH-dOfy%xIAmZ;Ti^Y(7mA71jC;8!RJi}v);Ljzk50O;jN?-k z_80r?w;x9w)I0YAB5EQIy3!}s9(6d5+4FGZxdPRB54M!Gy?_#5eUTmI+3Ex0sYJ*F zPE6^wz!7+SQv$i3;sBpDU_YK(-0A~|@ke`{fn=eJTDFq`pyS=eX>plcxP&ZP6DkTz zlI{1Evg~XSk8`e6&O6f8PqfCfs5!itbB5QgQ*rQ?zn)ty$4W?l0*bsUJcL7dC+wBVv-Y%H_qEnXD*Zf1cB$GSk*-Oe zqG!a}h#obk)N4JSt{!xE$DaB47<7fB-$#rUt)?PAlW?RV9$}YY_RWQ5*+s}!^a<$k zF+-AzVC+Yi;y}MieD03{%wsJB(1WCwAu_A#p{$WaXR8zdtrqT?h0Z9tR9S% zmMw;sg0BQr?!y!><1v*yX_HybL(o_rJZY1Ye~&6_6&e`DiP~1YjvVD3asDJ8%B3da z{7F%k`mzy4Z%4F%!Pq*tY&x6oK>s9r!DLeE2k$?8q@qH`W=HulJl=tn0J{?$9x7Xa zw*C|wsofDMyB{93X%w9wk4#*X(vx=B3!*XXzyC1aU(g!}j%DmFre)qz&cfQ_Nh*pb za2zRcTlbm8e1MwHK=FK*y^@;AGUzU{k5Fb`kvJ1Hn1lWY$izOZdqALz0+Ycc>yfW+ z;GETel{;yVZ=(Gz3q&uWKu9VIECS`+@Fe3AEJtx9s;`O6RTks`8TCo!=mepqNL@jG zt1844c_&q+W_3`_DxroQST$<)h|=&HYSu_KLJZVkSJCS4hD^SVarda+8+ariGeh6r zWck<&muqs6V0+;+(22%|w?hu1>eV;0ntM+;fIBtQljO4d=c7bg;a#IyT3z;Eqq=?? z==#(@5q-`vK>qNL;aYtXpHRMg0+F2jd3JrX<2Wax#=00Gs)i? zyNew|kK|nP8G5^zP#UJa3LqR zE4lKPYxow(NQvX_p2Tr&F8v+`wMFo*2lc+7{sdJbs7^?n#PP6^_kbxglePG*p65Wb z1{9}!xF!Uj1H05W=`R$eZ~n&Swf^ob8Xc8hd{-g_c#H5_Lm>fLwY;&eGcY>Jf?x;b zGkRLctx?XUqoWiQ7LPd|iN8+uE)FW_mKv$`Dt6i5+Gl@y?*a)+7Qq~S5ZqWDZVL-v z!tlqaIPjOn-yDq~-FTs)fV+s?cU{EBf#f6?r=snwjEjXoCzccFDK^qFu~Nhl&D#4U zY1r`ywrOsTX5wT>djb0aXW%_*v)Bvj;8%L_6UXr@y?7HnLk?KQocJhwJ71Y=dhZ^WR9_HxfLv2TGqwV((i+Ox&FK^bn!AkTST^3!q<_h zru9qz$m^GO!SzcA^uSmMW^gUpsA4;EE2G>-59|p|z)8f>TE0ZxkQ-PWH(BwE^2e@( ztYGQbgp|XHzBcg5@>MLz8PsM@yB9gtsZluRR1_9^RJ|k{ZuP4F5nI%(!&naBn(QnZ z9#wWN`Yln@%dw;y9TmlCu&l{cENi%SoHvfSWGmpPz6O6;3)rqgrpqPxiRtn+*x8B! zDJRNaV1}1I3L4o6-tx zlT`%I%0aPl$PGeA=$b9?eR61D!1amxnHL+y>TWEYMT>lH&b!bdD>t4FG z1Voy8Ax-^;PsF%F8wek4uGj-7+6T(&_*w+B6ZJ_xs3e9ORxK<;P?#HD+c~qQ7_#i(o?u>VtbmuY)UEaUkQq} zK~jy8)3TO0gA}LIlJ_}KvX+FrlFEhFaV)e%C#zyGL5vdkLMj$6?=gM}B_8$76(IOX zPj=zzVUPOkS|TxgOm?gHvmIb+k5+{u5XJJ zUs-`^A*ykvd-HLd+qzdxi4u8=N{=euEUnmCfj0v<03}x(f{-TY0h1flS3f{q+mZmQ zZJ3k!8;g!jW<+@_L^w*L8>;oWDb$H5OaxhW`WnA% z3b)pt5!B_NWLH!O>ZI^%j;@5+X;Z4*He!w89=rlZ93IW8lPq3)PGcUPWL+!VFOGj# z(B8ye^ly;NsmO7%Vj{w9=QKoC#CPM?;I}hyTfAZ~C1)ra4p8x1;*GK4HjeD_CH9bKE7fzSo|_J2$MoLYE!sT z+Xfr8_Cme}rVX;u+^n@Pe*-?If%XG!!`5E-5QFqh+Zfb+CbN*sdgs}KIQH;1UmGW~ zoNqg>tz$1(f}j^HOYmH?&=1n3E?*%;V6)wY%F;xw=PY(tXicH6)4uV?rkH1~1SWhU zB?6l{gS#Bqemg9hlvf?$U?t5+S0{DBLel=$IjyPL3t6GU2X&Wv7vtc?Lr>Y}9u%uC z^<(?SvY5h>balCC$7l-J>|f3VIPGcjQGJ?l(GcX zKm>?wG>7>Wdc}&X_OpK?a_N zxr{fo(p7JUrqYK~v$Z$0yy_-S{k)v8PR5j@9J8H|>y+DYM-QUaVQdqKI*ozhI2EC% zS%bggi0w*qjr9z{7a?M{(F{LiGu;YGjsP4vB=s9K%MH2;P;!H=6)M5wK-iStpkyQF z9_v%WkFW7ENAO-;kopUhlsCz$H}T~0VsjWzkZ`v7Ik}<24mOiZ3-vR+S*B-2j5zok zV_g@~w_J@yFTRW6#w;g-+|i#b-t}-7+oJiRha){{o4v3n;wv`w;y|P)9kd62K&;-M z*w%p^6dD-0G5+z@LoWDVNrz%BF@AnebcV>QSX(JHN9k1~sH zi18HNhRG|{TdX)e-JP^Oze`Ab<=Z`4O#I1ar2ldz|Ms?M#p2v_cj<^&h*dlTFU6tj zr=9Bd@{89$zysBri*HQI8_9Fk>k71ZA%hRiFf=1`nLtNK&R+^aa#eaykYa6;eiuN= zwRZ~gT>7zhc1#?P_a@ZuF;!Rs2>WWhQ#G)uz2I?78q$}RtOeY;0aZgEP3?s~R2e2+ zUn`WYwzQ(0o!I|a?N*4L3WBgkJz-$XzoKXfGIwd!P(UPLA(_;0s@z#^(mk z+w6r`BHUZNoI@dZqqM|{y{LkPkU4}6!rxO*K^&vbBrxtw0^b~A@i|2F?FA{|VQl@4 z@X{n$?FI4h!E2CiXc4d58(J`Z>08DP7cGN}a@IlgI#VY55{p;xW2(Yk_5!}(tZw$8 zYGVf@^sOUyo~-+s*jQZx+Bpp`b0dc9(u?jojdVLpmmkL;6b)--deQPT%w9`F_rL_a zdIhN)9%hqzT5F}jcm(r<9m^|%yCLe!I&9AQKXh)ODjDGrpudx*SP@xDZG2e>Q8=eZ z!P2lCyPA*tr;6U8)E;27lN*_p#SO%!-8$r548>W|b!spC?PQ#O#BQN;!|jpc;cFhu zxWZDv%GgY`s3iuYmMo(dk3aY?@`OEBslBj_JU;M1cZpyPNhInygD1j&>3Icrd%<$B zgO0*-X(0Z>)7MPa?kOquIwNv zY-)tG2o9NBaoLn-ahE;(t|0Y0s0T$TJ0BT34Ae)$k5h@y1$7nTTq-Dj5+HFlG-65h z3{s1O)B~WX$ELg)^lOI3xKsE|1I6LkrWAl;vDg$IaVq8g07}Lx3f=o^5z5ctBo%y9 z8LO=G;vw{I(S2j9z;|unTs`0PK*jk;l^J;uu2JcqrjJ~IrQu7i(GPh0Rt1<*D= zCg)h(MUBEN_hNNKl)hb<-h%!#j){)FNL-r+7HvH&xxn_)^LB@plcwD-Z;btB_l0clq@l4Ab%ld(x|q9p&;Na=T~ zvC?B(6Qz^SuEb`?C@~Y7Dp4qNI$e?jwB(NqQe8kvNkp|nw&^aCPCmb7?nBs4VBgtHY=_Bl_;$(>y>6_VvaW{X_VJ6Q|jYu!Iyyi78m+0 zxIN(0-LD{I9!ZLMG+fH<91VHRmBwcp9&fO>eo5UtTc$O>P6jzw;EKg%$mHP+y88`; zlqo67tlp`p^QU$oM0+{I^Nk6%Fq?c3r^v*R&&Wac2CJ4`Axosyyi9vJ`$Vg2E3odtjY401_|TzQfUN2)jP zS6^w~*PaPa!GA#KuHeDJ%CGhkz_BH zvNebv6V`M?zo9|OrObo6&>+&xb9+esL@CkZ`S0 zLtFP|H&omcqLqdz_4n2-vF6o@mm=N-Qg@slNJ)~Sq&uY~=JYQO&eV^umqGL}-Zb|G z{z@)Mk&C?;+I`PxrRS+e%Ebp8E6vc?G)7+&l`Zo|m%z3p`Pfn=q7n->pIJ8cl9AHsQgEG$=@ef;1@qC=JxZ7vgmnDGl7;|EFo7 zOdbTGyGU|h7IH03>tXA+xf0rssX80}eu+z#prlxWuge&5EZ^2zV08|LN*wc3Qfw=d zgD59>br(rCHx7{69`%$Szco|Zo@%2+9lTfx<)l2x$q`9XtSOR{@=t`6UL+lS#Y^UB zs9e?xi8iM~%B9TTYmmE5lM8;tT|wLx#9ax?BXg{!#!H}E<`H!q2`RZq@!uVcKiEXx z@NZS|mvSkS-_+_ZlH9#QuI#ZJqsMN99=o9uI}SZ|iR`hb=msjH#A7Ol=+e_G>A0woYdqZ3fbzF{!*N5ch zF^G~mASvcRJt3j>Wzk9t#U)eLY49U$?kSlXjQjAqM!QJ{&lySf2N{a!3_YQD(f9*{Olj$`YqkUJuB1vsotB?YjF0gp8-8D06_2Db~rq z^%g*#gP{_~e3KMgy5t~gL`Zxi$sR0a14*aLWyu)&4GmH*Wp)Lh?jp%e5psLdrMO0< zk9LF{p(=b8amU%Nl|yhG>@cNMey4n;heL@@4KX|jlX?F6JoJ2a7EXiD$?gyh+zbGE zIkZDl9dv^nov^&5NFS}=__`dSyAT=m>qcCYWQJ8_OJ(FfgPaMlCxnvAF_3V?F&ty4x=&Aza zjycNAthxC))HFRSfA$Q=jNJM8z6Du04?G{qNp%hp`8O|X5l*G|&6=Ate@Lh7&_v=) zRxP1}=q+=Rr>+`lq(2Sni8EDoZ!NE2*N|ouL&9WCDMz=RnU_0v_Kev%j1O#wvP5~G zIDgLk+#6^sQ<{VH&7vj5S-JkX*}|gbtSs1!oZmHC$$ifKMn#uXg9mjkj$1SI&(SCD zA9Z^t`$X%Ez!iTL-L%j0d+eF1>n@uA1p^*&PiVX7$u{4vo;rF}^WH~dQw#p;@y)YG9{uRE-15QpSu@m~zYe(j zflaS1KluKRI-SzhqmS;HkbiRD&rPPk_rl3#$KLLrvZ?p!hf)&u7p%RiZNHsK3E#Ks zI_75!`laJ}9q#coA6K@$^BvpT58rv?m$Q20ZT@WBw7c#)eKg_E5yi1zsvZ7Z*7c^S z+vaXKd(YGU6Ei1V`BmS){@&Q;r$Yl<+C~k%qf*s(SA!o!zaIPaEEuv(Wg89-njQgUmkpUVj#%?0)v+>-67c-J5Uy>14;T zx6dD!as2H=u_q4y@s9VdiF5S)DY-EDi=W?FdnkGT;p|WE{q4$D@z-3nW8e#MUpKny z_J?=JoVn)Uo~7x8AvM)B}?i zmcCH5>ZT>vJ@kX)=EvWDZ(RRV-rXY)`|6GRzD`Blye;mI<5pi9_%40OglymP$rpWm zyl$h{f7_aV_svJ@&&cq-+3>61dt5yyA$##J4R5~h#(CHM+DH$-{okvsIp?3h=dzL0 zHrw;od-piDoS*xAmxEsv-uUWFF$nf;wNy*l=x5%2e? z*u8UJ)AX;$P9NEBPgL_e^zd07XB>Ma>ZNu2?(Tcy(=R@KXYlvm_4-#?iuKlMd7sQ$ z@af4#D`SuB*xmK&1+y=FJG%Guzo#!8x}bHk{lzDu{~Q>ITU@+s#Cv7M|DIRx#*>-p zk32JROSf(JU9>;#-o<+O)K_+YH+ap1x1DKvQ{AmG1NXkP?8V=1y5i?6fARl5t-I%e z`a_R2|8ekH*CwSKcnUydgY;JUk^8p@k~taHt4yD=SOWh@b#hYzIKI|-RWQa`OLPnkG|Wx z{uhfr>AAXP>j}TKdNwBO%d5XlA9QQp`X#GZZ0nI1`}3wr0p-aT&Rc#+clEjdd8PDp z-!0QVUj5^dQ`z6wd*sdw32RR@YBK!P$(ZhAH!QsBil?7T=zP&; zvp&yAo&odUy=G@WQe?AKRB)b@JToWD*DF4LmBq3|^I4cXx7WOEgyCZ(feAf)o0B1{ z#jOhr{_T~WGu?k}oY?T>#KvlQHyEZ9y+VxYQ@Yi%3gWm1+W+O)hB`{Fx%o?Alu$0t zs;rhy8noz_Avem0u=J2CE6H8Q#Ki@=)gtG8IBMe2PEQzI`ihAdGgm#q<-(orC1o38 zs888eN>7CtGgp21SS^FJ@a@m9eA(bC)qIIDb8!}Gwe;1(r}h3S$>2f}2uF;Ws{wqh z*kzJ#&h)5O23MjsYbD0a#T^7I);`kNZfo+U!8KjuBF4W@2JYWrnt46fE}B5=f*xmYW#mUITftt$BZw81q_<08h)#kOd* zj3WzN%Tr@f5%hGa8W%BUu9onzT6&TNuI$3@GX~c-jf)sF7k8zt7AINYrdp4paqGG+ zXk5gYxlqNyHIgiF-;9~@mcf}Yw*c4`Rs$wlAuqo zkR#67YOEHvLX2g7JRjCU1dxMftkuXt|tdP8X-O%1;&9pbscLqq_DD_ zO9h5|dMGaCL~4^Ql`(Mw!yKR-SA!b@l`)+JhW$S=|9W;CJV=F>#bpA+XQb?{#w_eL zp)#hk!0>tJ|Hs{%fJaemZ{sse*wG1#8c|_@ARvf=5J(7`nM@|>NoJDBA}C7;Nq|U5 zVloj>kU$b4j#1oq<+|?|Hw5uw5CmMV;*R2iSFeb1!5#E!zW1D}?w+2WN#_2(-}61s z|6eejnp5w4PE~bvRdr9-De5o&Hu1E3%$Sjkq3erUwaW81o*EG`hU~W)HOR z@cf*?m^nC7%2)QwZ#H8_Glm9a!W{p2cMQnkdZ^#CS!d%&`583%F`N>Lg_fPJYnzpx z1QGj$KTA;Y;d-ctw^_w6ix?}*KN(`ioW&S=YDgA#l@{M>#w0O@o&r+)Ib~z(f6SP1 zjG?FQFk-3RekTOs`5Dg`diF)=LtP{Y*Dhf1|kj))G#FYA1W!q?hsWap^}9)Wo7Dji-lMezNgEH14)Xob4=Mp zss{=xhF&ZZL6r=Vk^~KNjsa6!SzUt%E9h6~Z3mTgo&iH?OH2}4+$n;}y3r(g$|TW$ zr&C!+O_+XkQaPxY(@m0bCW*@=nQ4-gn$s|p(P)f#WlFOuIm?pVfN>Vh*Gg5MvCV5p#k~GOdDH*Fty3kY( zVZ0_ukP?!LQjC<6Gd0X)DM{8O1yV9WlU$_fQP1*PgJfyh(vqdsWQ77@NK%dabP=Sa zR^N1wBp9mjcs&%8=*y=;lfxJsyICL^N8>t$A^5OF9hfXbO%j^>F(!pZXbKK|STd33 z85B;(hb80F_`BF9OGuI>jb@K5Nv0VCg;DshM6*89BpGdzoS{mRRT|CPSI z+bE&CfNqwtA=_(GPHonB94Wk-`(DKuo>kDdTjjZ6jAd-dW}Eax!e*t0LM?W~_r4xF z>k-LfjKLP&F$fkSmf`h+U`YPR~(jXMHk47SdJR4>sc45}>+(APH9BjAWHH8IE1OwrJ3Qfy zzE+);BUy|w*ves+TCVHv-&L=(7D*Ok47L=5txIPO+^@6NNfu)aw!F-u>&slO2PBIz z23xrXTNh9K<}BUT9?4>i!B(EeLc}t6-HHRJYi;9@WHH8I%crp@hbJ%l;BlSRTXqbL zG1&4mYYZLnY0PWir?bXN7Gn&y@|mTcFYmoKe6F*mNfu)awhEY~*5NOATy>JpS}s|P zG1w|J*gE{Z7yYw3X}?3V7-O(?F0-h&x8k!gVbZH3G}eof#TbLFsRmnT&HJIN&iYca z7-O(Schfej14puz|Kr8Kou=99*%u-N#u#i(hg83opZ)5OPj%J^$zqJb)(mEyN-7c3 z`jl-OrP<1oEXEjY;f658)@`e6T6I>rWHH8IYbLYQ{&46`kNtC`W~)WA7-O(C%V2BU z&$g3v)?<>z7=x|zO}0jBwqBDg#u#i}V6Zj(=Z6mHtYebJ7=x|ZCR=A{wubjZA_8L! zw&p;ppReXGo4e?&b0v#023vEPrS|g$e_iW8S+liLvKV8q#m~XCarxqZe1BMHJuX>{ zG1w~7a)=0z%Y!vrpGp>E47TQLEb0L^Y`gajon`9}5yE_YYzAA!B;gz)V)=E|*sZ5% zwoaEU#u#iZ&{$;a(bRXI(^*-P#TbLF5@xCW{Ij<|d_-pzOBQ1cwn`1QK2LjgiO#B* zEXEjYl`)Ghb;_ahtp=OUx=XScW3aW*VC(n0>K@Wr+a-%J23w0X79y6qMU694wL1J* zvKV8qwOC_O4(Hy#@mHPoAIV~j!B#o595_;_8M-!MqGoF#RV@Nz47M(WRB!Xk-Y!nn zSx(7fjKS6tjYV2Vtw<}Fq}eKyEXEjYRcI_K*PE_y=jg1yOHJM(C_flEoNpAjKS7L%u>rW=bGEU)meW@7Gn&yY7Dj}ymX>fXC<5H5=`>8#f!i!laUYnY{u%g)hnR}a(L;rEio7=x{~23s@-&{?OPghT|!7;H5_YO|{C zFz@+8i*;7EWHH8ItC3l19a`^wXS&X+l`O^>Y&9`Ut;4cDpKQ}v8zqY|23waKY@L5- z=Q5r3Psw78!PYuMxek3ZVT{iDU9uQsu(jS`>(hxZUZt}}$P>aCgRSNc$~9fG7-O(? zg~8U-Km7X<-PRh(VvNC7kXe*$#plzHDzK46SHvhhE?JB**t!y_`dB&T&x$v7*2|K` z7=x`AW;y7HPxbjDe%4u^OBQ1cwyt89+BP=d{cQ-VU9uQsuyr-F)V8tjr1ZtQty4}$ zA_8L!wl+Yjmut24i~c%ml4LQ)VCx!Y$*fqeIq`!{XK8gfO|lqcuyw7$)^oSE?ABQq zNfu)awytBA14lYvEq@-{l%(0ZO0pPZuysAN)H>|qNNm$tk4P3{47P4yR%p4#YPR-B z7Gn&yZZz21^X!~MI_n3?VvNDoO`0t#S7Y6o{l{yz1`dP>fiVVKH$$qQuW!F9&(&F} zlEoNarg>~+dpU>3l@J-2LjKS8O!0L7Q$AmH0>Z~@& zVvNDoUCeUeNayS0o=-O=YqsJ}fe3*y23s2;)ouNi_w$`PYlvhq#$fAj%yQsJwr;y% z$9oerTW3oaV+^+LW|rFKr%k%xMxC`tvKV8qbq}-D@$0yWN8Zp`8zhS{23z+UY;BGY zChDwhlEoNGmC0IAI?36{aL1{V@Sgjy*kjFI&qvt+Zd+-v{*d!6;TWD&;5dWczc_Vl3IIwV6A!2xDYD$}Ad}D4c%V+c;fn z4pStHFh{|XUq zOCFAaNUixPl0_IJ3l$BP+M-;iyn~6J%Bqqq!Wdc4GOHVo6uy3HyhmqUE?I;zvbI2C zv&s`=x$3MVAvwH5vIt{jZDm$p94REMa=)hA`be?}V`M!Ci47|gMfm#@=U%C^dOC!Z zFh-hgtQU}Av#KSz;;Zj}*K;^*h+q-M$ZBPldX`V9df+Xc zl`2_;F|u|rYc!4&%I<9p=|yKs7GXqgZjchfLQl!!CAIQ>q!%H<-LYz(0303wV|hwa zT2V<&pa`ql$``IE!Y|C_m5XYzFs{h$EJ|``JM-L`S&BQ;?VP^2EF&dk(N#vu#aJ6x zS{_)Dk+QhBHY25Mxl`j6I=$JhEWbA=I|7f<3(CqWGg4~GF0NWqrtv)4PH%yyAk$kA z$)3Av>C!5Y^0AyQBPAoz?RDpC)T}&bZgyUNR-QX2g2{5^ud*tD0#w!1l$8W3be`Lp z@5}Y&`F#a~=bq}zNHO72NU>y2BW7kfv)qM+*`7jQ7*Q<9E7g%+XF+b3%afPybGr3a zYZ)oasM?ld(I4tuL!-_Ma(qgj*PmxZ^C>DXDGroVB`~*kiB2nUW)~{C1qIm!&Vs<= zvKp#fTK6Vus-zf^1*o<^(0tf^X>k%DYwq%5op)YXKT@;ftKUQd2rw%<9Uws;W`rB!9>=~-GFC|N9t zSo8;gW-QC&^!q(IIR)8DCq%3mEUVP3ABA%l_*{Opsg4a+*3#M04Q4w%Ir%xciZ4=Q zq!uDt1kOcy0GZZ^o?NHL<;l;<@ycp3Ts0jKv)#_T!mL7%&y^S9G;~13b>PqSW#{Io zS=Ab`F^kj)>MDy%O7y&DqO}$HUA}yI*~HGwbLRUMU!k`!W+qn0mIf+ni?m*+x~6Jj zc|}=KY1zW!x{81$DxebQGs>(7g^^&rhs`5+9ii#^si}=+})o67^ zabRIp&C()?uoM;HP0->Bbc&_rRYl^(%%ZAly8ddBD8yJQgifjG;#&FQrmC&DwsKt2 zqOw3ypm>pHTN5s*s;V$c@#d#lSX*{cU0G#GSy9zOW1^N|Cbp`6#EnnGk+w0cQc#Vz52V!<%IoupO( zQ0R1uN~=O8a+nD{o4}DV%55l;t1dKCz*QI5)Rq-t@pN_F0`v|VoZC}rCF!X(3dO?g z2nqDQZV|nLrDm6PuyoN<`eRI>AyQZ`sYI%y{vkJ<{Xxm)kLEssffCZB2+<9 zNu)NbYAC9#DyhO7VTKH9`G_JeqRS~-8ZFN@r%@X)OXZ2`C^0ID%O@}GsGyoM9!!cC zM9Oc;;N7ZNRr zS5FEWWkppnIucX0o7yyMB584j-XUm0^wXNsP+?@Wxq*^m(b&yuLa#Q~4P&G?!ev1f zNtb=m;BQ6`4-iWNn;glhw3 zr8-Uab|s79)k4;l-pOmqg`Sd16OYF(4JMU^ba2#hpsz0~%9*BM+EGzf{i@NV6SbjFQ}#pdG8FVXb3rjObK} zIts@F>-Z$ zCU|g@)i^OqHVk??0f_=libYc=ppJ{i^PP^1CLqz&@a!j=0+ASv8ajW9ron*eSdrRF zO>J1{(0Yt0>0-*MPRTmSk74?zc16(?hxBrt?L}zN4jvlA{jwp*o_2 zOseF(z{FPNqSzA>Id802O%a1&q!htPiOPwTA~+MHaw4S&&ZMZENGYKe5Mdq^S`U$u zg~=pgG7>=4N(TU;A-OXR9RP#|S@F^H&;dYbkX0I8Lk9q%K~`{d4IKdFi7@qKV$MVp zQ*GiYPfAQsk+BF@adf>gf`#S?S9o;IF@lBWXj2ZJq=(lG@+ z1;hAz>J9u91bf!7e)Sm}4{Z4mbt}EZ=%5`R>ssGr0XGThh z|4ua}BTf6gA~VnFD=c(*3UWfJ@b1|eG0B}@n4jrV+)hnba%N_p$K}m-W+Y}6svj+N zf|6C>cID>hA=#Z>%LgrSd>(!p^5y$|&WxmxUw+&!XHJ$cQ_1&aIWs1@Lx1a|UvCU9 zMWHY=W1^-J1@riQ+4$KH1tWv>cqL;3{Y+O=%fI;Hhdl8wnSavDE)8WX&MaRJeu(oc zf-Rl};zv(*Nvcs(GCM`~2Pzr^MaFBnhpIwPR(=kCFIH7a zSE&E3rcA1bd{=IvS1(QZqDuOqlpUmoR9{#%xSa+5Ojnj0=S&oa@|ckZAF5Pc^o4$G zg(p=l*AsjNuH4M5yeua@NY=zDK38EuzAwkg&Q>*XX1+7Wo$bra#*d!T0y|-)AF?$s ztm53bU1-AjWKuVlndvOd%g$1=veAmsP(z%ws$l(h(o6-v%ogP2W$Kk6p4n!k;Gu2E zc}>={=XK_16(}Abew>xrQ=2V4L^ae~geH{Z@ww;{rKeK=?6G04likXq3KD8A!sugpb$K%g+WqVPH`URVk>(9;0 z%EXVooB?srlie`oEp!*U^3X@nNs-=YjX%qiOIrMn%sy#R!%o8^LGdu~tZ|bjIzqy@ zNvUaR6O)os$At(H9ha0eaUzi8CXP=_=A`+(N-xi_Tyxi^3;#J>I76rRK0@6T()Y9Q z`G($p2@SpCfzw?TQWCv*b4ssJkj3J(#Ak*&L84T8k??)sK9yK2zB}Rz=ZE9&gZwZs zSM^2&f!Zhs=-jzjWJyT!5(9}3azjz+?Vz;x{^a8&e2`i6D2 zSc-sId!oP%iGsTn`d-8PQ8_0I92F;$zS)pJ15Ertfuq-UBH_rrej+ga@WLMjs!zs+ zI5!}9JU$B~hQ3p9#wR&L-5HRq4?Z=(T_&-pPJs*4Hvsb6W7M|^xaVWg_aQLfh2waZ z0b?>y{`%luHubg3j`BAVxLkZFXt)Ua76TIq$Ay)b>hD@$?heOA(ANsgYvH&see{~) z*T8gl!f|2xD1W)YTo8_nkiX@?G=}5C^wIgfTVfF95Ussz2JXce^c@7| z=Wtwv{Pn}@g@fcPhFZOZ<&VlsuUGoQaS`-g2+YOdxG;TG-s^#RFdP>_-)>;u3de=% zqx>Bqi~}D8tsD{b4RXNgKRy&RT$nz(t`!F%^bqZQ6gse(2|g5}=}Sb~B@S%Cj1L73 z7a@PoJFrJ0J`^-uSpKNIUplaq86OH7E`q)R=o}sR7;s_w==wNEVgxdJe{~*k3p&w9 z{YHI^`mO}-=1%lcd)W-kE8(~Z<^2knpTlus<)!-TH`HPoiVua3>dy&`FB})9kMeh+ z#IQmfqP3UHfV(1GUx-^_;$z6NJZRGAbcVkEPdFOZUWfsA0&x3dz)?BAjR7|fIO{MR zLV`2ioIk>ij{!&JAg7F>A(FoS0IZAwmjv9^G2p1YFT{ZB0^Hjs9LDpIS9t-k9JN|3 z?}p*XHzTHeXJvV^T{C>secsH;Lve8Xrw=s>3w&AmF285mPzSA;_yHeULr`t8_QfBI zd-9waxN)qVL%(g!@#Eg7WRBl6HODh2FRyTB{v2QatZ7+!MbitWPW9wZpHor3U=F=r zh9?Y_m1PxkN~){pET}85D4pZSi+Oa1~>#7F=kVY?;#6 zvH+7cOMlB4%WcgT?XSPQq^7F2YGJ@Ja_T4tJ!M#0ehJ=>b>QvaYP|ALgM2D2n44j? zXT#w+eB#88?zbUI+rG!o#P0D9CHMnv;!69sF5I95uik)q`w9qbrF-?w_#@+Ykqc<0 z=|JE_Y`6N{VoskuUnDjisQX$87Q|z}_&`r3IJ1Z3eEQr*A_ZT#ng57=la=&O0@$5h zeram23(}^oFds-v#ip%}qMak5oF;#9mI*l0DU7q6i{mLABhwJPrIjK+rLZz#dHHNv$_P||nW8`e>D^nPr2ycj%y0M&38>bN2m z$0r9+C=NC~k0OAB+$rD%n`m7EzBq$TPm5S;uxXQsB?X%v6|s@QrUymLp;@x%mVTjX zryLn9y#q$5rF}vJEWIXTu(VgiU}=|#!BVS;>6UIJ^*3|bgW;BxmS^?@FKPh=)UsEs zlg<+)s;s78?TtHt-=H*H)&qN4)4CC`)SMgZa*(c~zfj?8$xblW`LC1#k-s)Xvx50a zszRJc+tDEI__@ZNRO8uBRCj7HdkX#}1+!D}XJjyY0{-YF#)=75<1G{oUOb23nGG$z*LuMeF9PMF%fe9bFyCR=Ev z7YaxqT2b&wQ)^w758GVhGXJL%oSx`((N>4JPH#`Fr@yx6`LD1^)|oPvzkAa^v9Bvf zGo$^mpH5s4ysu?W;(Tv#HhQ-usovn{;`}l?xV!Cx?e*WIC1{24H2qrll`puHw@Lpe zquQR?V%d*v(Kly9TM9mLmWy!w2gg?7*vc{LVkdHpMv~Jx_6m;Fe&Tpe`g%=M(qB zP*z$=Qo!#^yN4ikSv(|dr5fkbE6pmkuAe$6ZK;1B`?yyEqc$ofxL2Tqw+TbP2F_Q4 z?}e)ItX5!tmoK>68+=d4dsgF8e_v^K$15%V)k<@157*Wt7*~R;Rx7r@a2{AOs3GP* zf%)$l1WIs^GJ1y(g`s|0N%OpKZ+Zv=y3(9Cl2t>ks#53*9>qx3^fl1F;Hvk1E$$?r z4aR`;2KRV_?<=F-BatDsR|}lnaP-c)ZduJGNo~isY_Y(26Pou7Tv@&r{~-{dB9-Wz zQ=xqlQiJX!?AvZ%hi$Aa?XA9+Aa!ibu-4K*9hlP6z#Uu544gT1qDo6%s#?}DT2)&< zY;X4kW#RC5FBNjlE@~mJd9FG0X3s@i6_qGU+3ZGhf8UUwK)kB2WnDe;-}aaioI%;f zKs9+Gw1=vSz0c#w>ZcFz}eLuYAL2yhyJC`&6qCWHOXzVkqPd!YB(8}Y~9G*UpR z#|nqqo9K#YxHPGYy=km8P4kOJ`r=7`85W#~nQ3B}eyWf-wx<+HRnm9c8=iz6`(P(N zjfkP9xJhL-mn}kz_!JFOs~u_yG;>9B`;^mUOF+AGZS95xE-#_hGs;7#MT!-znVPHK zI=fOMS>)P^>k^ehM)XsF9?g#${Zz4m){Ia3p1J{9X=RJ*hEjId&P9iXNMPa%x8iK8 zrz*JTu8R`hQc?Q*a)txsHuG z1JEL-s=?idry*}j+N#xcqmx??XVVv%wx#|9T(T1k5|rui&``-hx~$_N;r=$Pk>7;! z(VbTuZ-qLVV=v(-MzK${)L#&r%&FA9IyiO)VuC>~^M&jt#D;R}Uc|<7tQRg?>U-iW zCn6>ovk()Eg_^7Zu`?O>C}QI{_OcfH8L?EBjmCwa%(06Rb8zf-E%rQOLs)h|ll4XO z5q5`bu_DAo{#GKECbVd=rx2sbN}Oc}VuJgz79;2KLPjf!MGV8tns4esQGze}Fg`zs zs1NrzEf{LmewiA)2lb*f-=0WajS{?_adhLboNgR2Zwdg8VS90MJB{A+vx4n3qHF}( zPqWoGiAIsV6u|&1ni|g%u7=2&x^fVDhDJ_pWS$Q<5FxV!(jGcXP)HzW318uwI+tb% zgAu7u(gYCLH zV%U5TH}?jm<~hA)*Pg=95khBC+4E@@RiRMb+LZK{>K}Rq1Y_uTslFoBF z(K|=#g(l?L5>_Y1nh^OK0EVa&(rw2GqlQTNUVub>OJ()!M9a6(OFHTIQ#C}=yO{Oz zmdewyDe{DVmH|)l#>mygqVZA<=O7|lfrwE}QR_vnaJL;-+LwVUgHi>K$}VE@hzSOv zKEp>1k#q-;sFzsPOC{Fr>lTDw()pXJR6`m$mq1Q>QR)9xo=I|*KpW0!-Zn+8HPWFR8WjEGU)U&*o|qkCCK|J=ut7&y){u=IG# z3DfP^?zGCn5m5^wMzwG!%dGw5Ed5KnTl$Z; zbE`fPQZ={`5iAiS*1aqn(zT1FE4CM>pfV^`;HV@bMy*;f2t_e9MAH2*67{-L^-^8w z_H_$FFCFhwm1;;MXA|V8tN0$4_zA~Z;>Y(n((9nUvH5paoldiBQDPCJGHqs=wng_W z_#<(^1wqKp-C|d7W5V!SU_y4{rVXnt*h5;py{2xfJsF!p53l82pX=yHyfO#x*xlKF z+T?4%@!t@pvJ;b1N64#0wY=4}cnME#3y$1iC+dsgQGgr>I4D2Jc4wIp{u{9QHT?wQ zpb}YzbzgYGh=DH*{Hr>pqUDdhhtyr5FZ}l_FT6i8{+*$>Uq5Q%puy9>dTUS0k^PHD zov?q{ZOFX`_damT{pW8xw)E1Cqwnk2?amW_{N<#FQx?3m zVda4PPdN0`#aSib)R|jsgrMBapTkdZ+LtCP2Da`+Tks|+IGdLOaAr3 zWtEo<-#GD$fv-0|4*{9#H?t)x> z+nvv?+A{RY%Xi&y+^&9i+^z0{d_hXZc^jTSbG^0Zsh=w1PpF&w*crW_c;Nion=W7Y zUg99n)%)t!eSF4SdtW=}^LwVhcJ8B3-F3yQ+xvW*(XV9F1CKY%J0rd7Slc-VmOij~ z(T2yCT`=aSiT9Vy^q+0Hghpw>MphF1?2o++Le}WJB=aq zRWF)tMBJ4&WPeBM`#Rg-kva*Rl{ydV$Ts|QcB6PDEA%xmnjzS%)Rmrq*z3dIeZ!0) zw#|ARj?|MpYB{;ZjOor88p`Ma`GCfPE6o_{Y;0DVlng=a>AwdYW(=`yRvH|7BercU zoR+iI&^-5I%xoN~rXueJNNk&xx<0b{+MKQPg`Sca_m-o&6T!h&z~GEpLI78Ns1 zN@%){y@En^lIx{mmKZSfrQRgD(Ik1qBze~)`PwA0q5KqjXx8b`4u$TTBt=SkYLauM zq^l-bBqiN6$to#{(cIU==CmZ%#!;q0gqdRjq& zt_#6RN@4+f)?~@}2||DyO2UNhz(f-j;|@%{G>@DQ$#OBq;JK2nblv+W?ZBk7o|7!b z7;GKSEV{9wu<_3P9z8T$uSgbS47TjR>b8EqYtt7x>s!fUjKLO7yL9i>{fnD7>MXmQ z7Ba?Qi*8bMTdk?5U!=2=C5tfzTQp(TZRPYo)?H`Klq|*=Y|$$$x~-S5{C$Pax>T|l zW3WZFr+ZN!^VUUsb=F;y#TbJv>bZ4W`wpCzth4w94Wu*1V2h@o!apD>KEKtutiAuGC^uCt~|7Gn&y za03ooYCC*z&i21`*V^GS$zqJb7KWLSIy_HVd#ld6QL-3guthgbdfQm^^OEm$*3**3 z7=x|T47M&D_4{s}^^RmQ#$am@vqY=LJ2!W~J4|Q&ELn^(*cxoG_0H5gPuE!kXz)j1 zjKP)zQoUSVo*DnP&YB=uj4{|6!Yt9B;CHF{^V)RQbjf0j!PZb_MJ`uBvKV8qHOye^ zr`)&p>$a|!EXEjYB{GZpTMFy1yvpBGYa35X7Gn&yh6Af#U$l#r&e|_oj4{|comoN~ zW+^W%KVN74Az6$u*rJDnx~-jkHXqPg4w{G|FvehOB&7QFMY~w(ERSR{#$am{v()o7 z>iRLGbk>EE#TbLFGnhqJD}|h^ckb+})#25W#TbLF(ZK5Edh4RuFY2tvB#SWyTVpg9 z*&5#HTNkIaPBQSYk{=I7=x|x%u@Tq z>tDL~aBr;+*GLv)47TXUH@#ekrkt6iv(PniU<}8eghainj2=`cupSx_C~VH({e?x& zr|~|G)I%5}D+LmLxA>lakwp_eo5nhGde@-N>Pb^P1i~0u zlOfS-qjLOor_P!xS%fjN(wRkb3<_Jfy6@3hO_D_zBWnsIHY>F~3a@RP+M=`AK`*3) zF|zpKvNq;k^!W|9>a1U-Ey5UC{18=}+#5alj-Y8W0%5=kc>$Ln7Fv&5IXUDo1q{_& z!2g#VOp+^+P8~(^o4fy=dqphEm;MsTC6rn->MOt^DT+9PFFn%6?siOy3?9`q_3R); z#s2@uMc;q#LyoJ2oT$M6KuvjBt>!35dpsbQr|aM4!gjU#v`W>SPN=KtJ3^>S**n7U zx(c&juF!@folcp&S{N`wPsbRMACnJ@2zolk2t5vnQ zs$(=+7?o{uR-&bgLPV>0l^;F5*hCs|eK;wOI&Iw4!z3(M)!+Q9N^12%nU)w=mU*a7iWdAECj7daR0?9JM)x zvLm!6kt|DW?(js-o8WD?h}81-qe`g`cqCi~?TdHP05>Lh{U9XQn5+ z!0jWa6I!x#e9<8>+nMRh%vW-GUaHEX&W#Q5j-|y7)OvF3OjNLVPl)&KWe*P~^_ZDa`Y^wT1Tdvl^E7)9Fwh z1H_;RHI|)&3}t0%E-K{DZHCPV;BG;)otfqI=J-5Ve6M+B2=j(vD6-4xb-A+({COxc z??<3|*yoH!&*FI9pvRe$2S@0NOLIq{x?R`ZM}*om`V;7N)_DBr84@~O;h!>IF8-$# z{@J|3e=MF-d@U!WkyiM}^$wY>QZ&K}|5k{T!*IO9KWydTM%>x{1l)D>Y!rcRHJp}0 z)5<}*0p8h{5PIMhi(&fWki0tv9A)hl6V7R}OSeMrns8W27s2lPG2rMS#Q_s8vfV=_ zTx7e4W55yQTN5s_-M>t@$aXFCv^XS0Iv;e;6lcOkwtJijXSPdsQ+5;1tdH8u$tIjx zAGMcLW5Cgkzr%!!YMIlCrKCTAww{>EZlv{nU+yhVb;x z`0|GgO+{yXdS4(kbXGs%_;CH5@x$vYoFD$ZGkf9sXnGhL!qdagZ+JRgR-qw0UH%NL zLBjJZe;|vR-dX*~pI-jQ{LapQXZpj-8(uzn_p0SD{QQKMFFai%%1CH^k}a!+t^l%P zwK#C38HJS>Dhins-|6>4tECV}>ZGlf`8d+(YK2c0RaTD}jV@Np1{{ZQY$J{|ELts_ za1^pu#73}eAC6~m>>!S3a_k6>LIx7&0{KHMnNuBzP2^Y-V)QGZ)#5~qer-ekG}(N_ zGFV27N;5fDkC=yJ8#LKQ#1xioLQL3bMJ$hH`w+|L*g?e3<=7F#rgMzu0W&!kkJtqq zb09XCV>AfN=a>_*5{?xjwvc1<5i93dHDVPUt4FMgV;eNtM#O4Zwh6I1jtJY-he9MeD zn?-CSmrvWExgqEVK^=ayS;3M5NP1bSY8Dk&mS4gzkh9naad!*vQin}sEK@CKT&`UH z+i}*OR!hMQr1dsXiYsPd10p6)n~u~T7Hr56C@ZKbtf{)V99ztBQrXht@(NdJDZCEX zTEv61e0CxWMpsL96*yY*jJS9yaaWa=0npb{T6u0A_61#7j^F)e#ErECXjeGI`dDh~ zYS_SxxH!wSe9NNpi_0pd;0#MnzJ-3vD=)671$eZjy0)yYw5oE&Qhak+7L`?&)o`&x zm5;HMRw1*M)P;jQrl@QnRiX; zO7WR(kiQ_}liIpI$Ezf_d#x=l2IEiLDJ?Drx40f^v$wbaZgIVQan~&bZTKAv6mFEXHvw z$0#!iw5D^qYX-0D#Ol#{T0V@6ObK#Fr6j|Fh^LxX5M!z7d?omb68zEiLj6ayp7KLB zll(GPmZlOqxt$i7IuWx_M4^bUWlX{r=(B*HL^=w+X~ze8ad{8ZVrp;tFZOj`A+m5o z6IL@)&g#?8wl~d%$QS%cX`vtGExyseDh(X71QLB|%X*N%3cEkJ8_WGU7g#shM`_sO zP#Q8Ub)U3#KjeKWUx+@L4yLj7M{pq`F4tngHM|fLuta&X1CQ;#LiPg5K6Lp2F zy@||<#nx+%qVqu(enc**Ma^fv!7RDD9f-nuCSdJLx9o z5I%7{gg(cy2XLe*O&o8UPO+|*y*S>(vY&8#nq%a4LoiN5>|T~p0})sLW14IaVpQ>Q zmUhJM=NNfK5V-k>-N&*f#5Qy6X~aZNvO`Plk6}vShH0@>Etapv=4i1REw%=+Evz}r zdl@?ffIkCxY4ari>P6cpS2>5#^z4lZ$m|ARu)u-K+84|j>1}@*O&&glxK4pse+(*- zLI7|3UZrGzXyQjmgwrV3rZ~m+0T7{Sts+fX!czyT0ogQTSVSM7qv7Y5Yj?s+eA&yZ4c#LCva1^+M zhzZCEl~(I0#br_@hg84M?nE|197XkQ-`X|7G?s;rI7Sw5Sqew?Z5-KhGEu&O^B zgT5G$LeBL-Q@QK97GfvR!d&Kby^=*LzgCMxbm#6-nW1Ai1B;oAajO!b-=((foGKl(BC zvHjo;eg$_I)CZ-%Zg1ENntiiv${c&s9f)Eifwv{AFMW4yoqc=n7$=A>`}X*j+Vd z6;35!mXb>^daFAt=F=vmSa?Y^yp>wpQz!%(e`_PdmU)TKp?F}c6 zC|J8NfB3#j`@h_j+U*Y4n6@3a4o<&o+_m$%zVO~<*&iQr963JVdUNW>{~q*1_2H%W z)vY_O<HFrPZwGyT@5b5vhTs41)`G!RQ&-g9eVXs_B{|pr_@9Dj zFMoSzWskn^eP6Klt#_)=ykYZzk|L@w~{V%9Nu^CAD%ri zDYf;Z{|q17=lZU%Pc8b_BcDH-^~1Savi|DY^Z8v}GS7T$&_8G1dQ$$A4}CTE+24kL zHfP0q@161BD;2#aPVJTO*e8Wwy_fNilvOJq%)52wpZ8tyu-kgw`0KAZZTgpoH;fy# z^R9=}Zm|`{rJd5H`@ov2A*X*i;+^`trj2>=%D}%j7hS&U3+r(sCoFk4w}0Z|t9qV% z+Su#w9{2UN|N7|fvu393w$T$kf|&UgIe zrHKh$2Ti`?y(=5~TrpwEOw0ZM__J`>DbFP)y}h^eoslp5C+$8mVB6N^soU@Kxwn;9 zRrGoO-*^0SXnUW3Z(KNS!Vl$Vf3$Su$X$yb`t$nNemgd^-%qwa&-s_vOz!=*rR?Jm ze<;48wmNg}GZQC$dsWVNFaEZ6-}c+idiI5iWsg4aM)yAPSz{mh<%YlYS$byOi9<)6 zd+f&XOD9ZR-e=pRr?mX?!3lHSRgWLKEMvpus}5c=tz`d{(z0;VS=Kv z5{ZI97$d72BsObrN<_H#u3am2R)!E_!DBe9J0v#kwesDkPCuZt=1LY}jJD|F)^qsE zk$TM3)Er(US%fjNdNQkzOrLt`*|T*P4e1mJV`TM$M9<+X(>`0KvuM<$Ko}#7>Os%p z?iXm`uA0MEq){M@kwtm43E$F)9Xob5p6jVB>JBLo#>k?fPS0UaETGm|?Lo3V7 zjFClo(-+J<@k7EHI%}Y;7Qz@=C_GryW+;q*Ve&Gal_^<-F|tmEL}yL^ydtExSs+=2 zF|r0SOD$K=dmam^!?lt{7$fTxW>Nd3@cPObSLr#tQ?dwSWFbSyp=#?iPr?&A>jlXo zjFEL3v(%pLy^jjAb=CpNB8-tW$Y5(u!1kcdIwo0!F|r0TOYNg(UGxK{?GkJ`L3ZSX zF|r)YQp+`e-p5CD)&$8SjFB~jS=1*}xV$wOVvC+sP#}zvH53xP4xI^AGj&@FC5tdd z)-YyKpG@KFz}7Ey)>_FTjFFWHiEc}|cJp02i#$wHAdHbU91{KdT0qb6fDmDeWD&;5 zIvo<5Rqbug>$CVWo%O0@5yr?G!7R1rOK*GPdYz>%%qEPHHIi9Uspa)!XQ8R8ImGHh z4umnXMlnn6d!L^-`>@VRkSxL&S-9Xs>TvkO4`ZlPZ6!+a0g3 zi!eskSkqR(xzHoN|=vkprZVT`PC%u>(thiQ8r)mf*~ z1PXyLV1>NdG#(P0btxqx4BhzGzvzcBEN2bDpz8-_1&)+=`}HT5m@yL=Lo-I|soURu z8l-SNDU6{TLTXiaS9&fqV3^QgDV{qDdHu>kvefOF%sf?jpHp+9^ zx=G6grZ!MhvbY8!4i2P3Qdy$;?I1}>jE-Q&$y&8oh(#e=N+xKM5)Qj(%c)=J4lO>&!*OwuGzN{L?fx1?k|FrpQHCMBtw zp%OSu8JA4W7J*tFJ367$&4JpgkWee3K&_4? zlc;S`pua3hrt5(MVU6xl(jc)}6LGZS^Ujbnwoc%?5PY$Wka=c|VQKVar0Pqf`~G>~ zZ92;*S&T6(!%o*&q`huYS2QP^W<4#K&f^wx|wMHCxz6gacy?wz8O|+WKSut{FP(9?4>i;qKVOEOjBmtvj8SLnadG%FsAW&1QZUH<#)1T{Al)^%%J6~H!lU#re zK|MKs=ZuU*mj|CLEs1v1^!f8MeF{CpSX#wz4rr<4aDFY)N>-LH--Sg$ zspU+bQa9e zgvtJ#-0Zx99FLYCJ+GOH)93R0T`s?&jQT4jnwIfCS8kTOAlu`dHeC}YV{cn;VSb*X zsrG7VnI30;9=6cU_GdXGypW>d@||AAm+8v!6gorSQ3**e@E0iAc{t;tudQh5$*9j9 zZ&pE`mWOODt-zV*%FHaxE6i~k-f+}Wbc(kRBFTc>Ky~CrylRbIZ@z#fSD^fB&kj_Ip&2r@y$l~ZH3N04AS$f+ks+RAZ7w057SC#sNpQcPLk4zwsx#jYD_ zwM1qtt0@nZ88{*0K=GnT=$hhXMGNW{E)4P25JIXdFO5Vhu2@tBTZ@+#m6zh>D}Lpx z2#Y);VHZ?YRYZ~_Ka0vri$sBpfLiPJ`I)!$|`AZbYqgJ04-6k9wv&^ zO1x$lF#!uVHEk$2Ry|iOEy5=1Wi{m`YBm>RoAKiE8mj+tymTfUBhctpzMu|Oe{pd| zU73n4D$1Fr6jzpF<2v`^vXUi+4W3C*R3f%{j=1hR{6t4uer>`;TKipVsIG`=jEG1| zOcfhRj~NtQl{gF0waE173g~P_r*o<#cX*PdiViUu8AWbqQ4;1MnfYGD>!H=c*iv0= zx$eVXKRyMx*0b;z-`(zv@sYOk#%kXQDUOiP*=pYjNfT&WZvN8sJ`_5_jd9?8I(#TZ!(D~6X%2XQ$A$82xnLm>{INOq4$g&hN?`xu6?o6tzOf1rSVV0w)e zIJzN^glmI58<=tQcnTrf`LH3u1B@bXrRfeVlD^5nrQ)u=hHlvr=xKQ*+)6yvsK+h) zeiktNx-B#8D{B=KauoxLB0GNm_sgsi&ih+A$eG) z#nRU;a6R!SlD-_smq?62M#fRQe-b!nmOw>2zuS5i@p3-vH!qkHm-)M?W72fIHNQ zKI%`p`c+NhZ?yAq8gQc|Hd_7lfQp$P1God7=%e;`44C8271}x~?`U8qh2z5VNBU*}Qyz|sP~LUGTo;aupzjHZ z5jl)r-j{%TGX{O%$EeRX6~Ff3LqV&Tu>4VfdZxrM5Qk{zBLz5D4El;<)VBz@+D`OQ zd$}e?eRlx&P$&ARf8G;6j>RSTbvKaK; z5Tm}wfZG~_zV~C)_dRfbbfS;i-^tTstG^+@ohh-=>W|KE9x#i-aS^WHCSa}!$Aw)V z1EBBk!0ZgiMbP&dFyDsb!t}*MU+)>Xf5L}?R*nez(tz=Vb5mJsY?-O)CG+1I7hy!0AVK}@A1d$J7{bRL?VFz|sBR`7z)~-|QH0bpKpr!kNoU z7;sdM${28TzgBI+#hcCtwX2IvICK7}oi2|7NA7;sdMA7jL|$AF`H z?lTLAkPxXI^hNrB7;tnxhR1-T{wgU39O+Ao0XG1+tQc{#V!-u-zKR%dbp2iy1CH`{ zO$<01_wS1l_e=~ps=t?Fz>(d3G2#wJ!iBse167uh=n#&C;r=hYSUn7t75}fiSp6@! zuTom5L$vVLP`6|33)z5Nbyl(Fn?fXn`l)D4bVB0CQqAV+a5fSAU0XKl3x1Z2#ZML@ zz_EaH{DH4Xy*K!+FWByH`qtjK0t34=x_uIoHYg3N$h$!Sr(> zS?`*o?SR@F(!g`uH}~niC5gUoesjm+xcYzD8;L5h_2UNhIXQT@@tp5WWzI4B%=CQ*^ zk-6kwasJZg!qjj0woqTazUB{6mZj2`ee;xV&c=3oBV{T0zFeD|75t5B3(Irs&Vb8` zy8c>{CWpre)H|FOq#vmp+W2?@>FM= z4=9_8`VzTw?f5RvS%1jxYWS-cGqzIG7Ug&EaCO;@ighUsJG;P$s9n2zhqKEbs&87u zjg`Xbbq@Pl2dxuc^9Nl%_J-@Bg1mD$Nn^yOwtOjH47CgGo9Dvy3SA6*P08y^2`)`i zaLqN{@*i5hy)rS$HM*Tv@?XiVF82dOUC?4k=j)G@}EYmuS0*TuTzJzMJE!#8m? zzD7SkJJFir*j?78_!h@bpPq(_I7<`0Kg%&HMINWVi(?JP+Hic1Q;#4fQh!J6B2Mj& z6#CUN&O**7L@KTQYGv7EO?DY#bD41mV)zLjjGf5QPR6~87+NP}pCGoIWuI%ZThV*G z%(D9s6E=1uCUXBRVk?+C6w`7y#~RY&>UzTKPwHWOwd|zn*K|(6%6@U#2KQmz*~jhe z$*oOq**!b3Hhv_w!@}KIY%qH6A$ngdkq;!shpdi=_ablb$eK4c0^)6G?U98w{lO1p zXAtP#)p7vmFQRRv*VTEt4c6kv0c_f3BE50bs$fN_nlimM60m% zSJHo{+zLk)0di!a`>+@THS}9T99Oi6X`Ypw$p^4bpKLlv=2$-my%{1&YR2L@W2Ctd zmEkPf**usW%{a)X%_!=FlgK^6t4hN$NA1a(_RVpHBLw zV?KLVf`(zp3_Z}66&31J3EoSP9SlnB@y4}v9AG{SO|qgq$zKTXHy7Zv+XthUs(@b{ z+i3gXMgY<5xz32YTnWC5Y{^pCo32Hw66{T050=A2fdX#}qj7eRTJ2ZT?x^<7R$mJ_ zAbGX9yG!)QnyaL`^KmwmW^z{o7Y)4?8~m4m+uU2w`!T&|{jouTlj@J13inJf^<0nm zS@HIJUa>cPh;PjW3DAyC3ceh0Dm5QW@hzLk=}ptG_NJ==Ydb|48p*yrtTrVr+1~Uh z5`4{zFhJXs^p^sO&p9F3os((}b-a{=E}}KCLJ1x{d<;HKFt!G28E6Jgmz9b-s>Yzm z84^Ph*KFfM;IH|v9_Pp#^ov#y-0g2JLk8x+??%HeM`+)&eGobAd3Sp~JpHu2p4{5@ z!S;b9*}2_8f1cOd-U4J>w7t8u7>y7Ja?F&s=->hkAeTsA~`Jm4!)ELmDb-N1*?f zJ5hdg#za7c%_*9ToOsb6+@4qukrJHMgZ!kRk67-*p;~G7S1IYQ+8ZB0_vYHV5g1>K zXBqkaXz^EZGfw^$rO5XM>y{zqeV?taijv^+ic_0fMaN~&dY#-ytz{z^NBwG#VQ(4_ z)fg7j})Uzt-J?u^IK)kgF4wDsp+l@%Ws_sefdPY@v z_!d}%2dI;j;3~UfJBE5%q@=%5(`(B{N~L|J`P%jThCD24_I$5iy`tE`y{NMbV000Z zzlU=+_^osxeS;Y0mh*TwQ)uMpgwUy2+%Cs6CE$Pz{Cn{-mtLx$!cgmJq$u`X| zy3$y&W(OVZP2WKv>$mQswv)C@{S>GVs6155Ps>!UA-Ts7e*v zsw#hQS4gj4BhJ$vd((0n)O$j6-8>=N8K`n?y(hB9iKsnlHH%0iYt{#n!KhuF`Zw%N z!=bWa)go))q%BmSwjt0?0~5thAQYFITB+vATP=YVQT@Qv8+2gN@-{L@#s6R`k{;X&xTF{iWfdNyx1md?0GA6m2aY|oB z&rL%%U9MUugBroNuJuMdb<-pl;{`?(bmL@*$3B>%xsK@aD31vpD6APgpsVE2ZjT?4(5+Fdls<1sY$P=4EgO6zcHmQ)z@ zx0)LsKAUMUUdx4=g`*f%Xd<|PWz;0;?Ws76bH;h_9ns(L>5k7y_>8b`9*AzMdF~rZb2phEd($V-5#|xB zTm9#)=$%)ibNkfST=#zcANBU8Psx1Cj6=BWg=4AUe$;30v+L12*_$>ZwPDpEo)-HD zvvQ?jb-X1o3V#wnEK0C9-2l*Y4je+xX*1e2`Bw}C?D3vAezeE?KehMm{-eEbLA(;| z=C#46RX5B-YA;0bs8}e+A)aqUC|v?PA_9&As-mK)lFVM<+%uobAhfZ=g(2ALYkG%51LDqgH{Y87j91u}I{uXx+d*7@?CmjmuFrN<9E_+}1e*5NBt{!Xi z%0!1+KTSVDBTs<4;g%Ks@S};F$Og@V=qetGdsLkJUr2^$6Ha>eAjo{Jsb`?R^^)>q(m|a<|YTH^!q$h`XdTZ?HhL2+RbV za}v;FoW6xy#NaL5A`-T6i|Cu&DsGUP-3h+5iMT`ZwcIW)zToVU-r$lXZ?HDi8~mK6 zv_(6MVOpHfI}sBnz7;WX;{T19IPuf96JMd7cQ+2h`piBM$Yr zsZ&m>>%I-c7N%lTP|;T+whecysCSnYy(9Pca1JL=J9YLTb+ypk5?#AGG~iA!2~RV6 zDe3zHcoyaEjR>95?)59<+b@u;E#WNdN!$zDmC#(w=)oh7tnd-5qOShJaY6Y?Tw4Ti;u=5Pq31AjB*#2&mPfu zuMt?3Z$|`PTr}SGI60^%r#Da~aqQ}x-fWNKXE)-xOfgc$vm|;x)R$9NA|_IA(NZ5m zYyhWH-y~As)KWh~>?BV8MoaApn?m!+h|#@FoP``Y3a(2_rQ7_|IF))`k-9=lrJGF$ zr(Un6KBT46xHpVbcWJ3|#v~u|gg1F|4jFTc{{l*7i}-+|VJ#_Yi|^!0iQ3{jxl*FG z_)e~rs4c#eD1jZmWf)?@u2V~; z2goU$I$KL!uBEO=ER|EQ(^5BSsq}m|ol{@cQV(jWM-V%QQ~%IXeeeeE@L}STKtDv` z35hSU$Bb!4KkGg4=!No(!Ndy>qro)Hq%g>`bK_Qwm%f%1l+xmTesni$*RI`r#Q9pz zBmvEjd3rr#1N>EE3c3NGjreTBrxl-l>d5MneW5S-x)_dlejMm7#oFMs9@gZgx{9LQ zNgf_X(UKV(8h-C?U-zC3HweKiZ{!@=UT^;lIwSS8_VwwyvLsCzeoEVj=OCM*1vmB& z`qCZtribt)s+L~}DaMnpDN4OZS2B+7Ta*PG`Wd>BNFz|-IZRtlSk#KJhWh+4z^bIG{BW9`DW2`pzkeo3&? zle@9!F_~yZk(_n>f5N8YMte$mAQK}PXi|H)Rii|Si z>^7Vw)Y|4DHMzC61^AOzYg>#zJ!);YQ4-bs>r9D~>vU^~-r5_2yh&?q{M0gvWVE*B zoqX0+i>IZt>w5?NQrUL?4J+jP+r7-b4bR&b?*NxJ8<=yl|Dx2S<3m}^;7t7gd6J}fwAZOv%jKly5J!Z_iEppOM`jiNb%}2RYwRCu~PQIezzEE-BLXu0ti_S*oj)!y~xCUt=B&vi4 zsYsPdAZ=i}GDz#0RH5psA>Ge(vmrgeB=+JY#Yg*be6H_EPS!a2wRjbQTrwhwy*ZGL?y)s&0CP)hiAsmF zkmAk^8ho>ygZ{*WPI{Pk>NrxZJ`qGDwYLIzpc&E;YCe!-FQ-L-qv(SYHBuPDN4KsHn_3+`rp#=|g4N!E)O(|L9IHl#$=niJ>}SKXVgRMp+&ZEWaGXI(5r z29J{PVgV6IKuq1q^eCzAX}sc)s|kpdRfw)!D!_$Bn&n7s9^S5fsJ_8LS#_kkgRfkm zA3^VeYfU7In@BiS`7dhXDrZoT~d9 z(n6+#n(d%vK>cE^wJa5bY&@FLHZj7E2CmwYgv`V2+2nEBx`-b2|2t(?Lwt2oJ?C`& zS3AO%Ygq-FX&*=!Q(IBA3lG<{04(m>CV0-5+qR~GYuT*i(`M%~8!l>}IR_n7+IwvS z-rcy8%D!mH>@%7#E7!RO%}A(L#yl_y7H=4{ zo6Cem5Ujnvr446LjQFaBo>5?cLZ1ZS@x*NOUGnx2v_Z^ny41akJdbBDmE_y6o1puM z>F5c!+^@Y1=@X`VOVv^CVe2Qhy9!2SpVOCeLHMGE|3r^hgRa`Wwp#gBfm6;UHjsE9 zkH;H%`A2D|o6*-27{;JaR(2gg_cCW2ou3qQy0aAmSaR67a6npV_ zZ??B~hpDy^JI6y;*RsZ$^npW?ZNI739FO}T8bs0kQwn8Ok`3QauwbxHgpzB?a;{y5 zT|jd6M(dj>F7cw>*&&ZEq?K= zR?5;goF8Vm*Hm0>oVB(d?Z{w?H{p*p(Hy_?X#GS}0?z8=EWy-kM@>qtsqxOE4H8Ys z?AWr_-FWA*28r%uc5K;e=Wcc_o9NW-xrO4OVxiha<$-6Qkd(}-Y0GvKqX*nU^>eBD zZ%iDw8=nRYu3v_(YKZ}2?u8voEb$PsmRJ(-CvAzPG5+*kVoAoI9!o4O>4j&6k;{-g zBbr>iL>cGAFP^QBN3WdXStFLEI%0h&bDtbh7H=8^3z4tB2Bkk3;pg7Gi(*=vcwq;& zNZWZVK5>7dCw}Mg`iTXpSv!x_PxK`8db{SzS`WoJjq=LFG7t%1CoL&Ak&Iq@@oCe( zqz9rUWjo4Cx@ZzR06;BCt{ZY<>EWH6#Aj9Mf0)==Vq&ee29{c?EQ$NAi54Zja(%HR zSbOcN>1nM+IpKB*$_Bu&dg4v(%}-lW>hV#gwbxG5&Xb)?wf}nwe^^cKtEx2r&%{}N z=j5HvWv!r-YHz!R{$L1l;TXTM#2#y`X~z6FbI0x}G(7o_Tq4l&rKve2im8EZc=-Tp zlHG7lAJxQ5eaV+eIgscJ!gy&Yq$ikUheR*8;@NxkXPHEI3Qyr@kjAUhL{%z+^ay_P zh44uxmErg(lPYkOxzxeP(rieZnD6yCKE|YZI6lrKx(GhOB=(4iJuJ${7h`z0j~6#* zY3Mndnttt{ax0>DUv!&>*L~=uQ@})p{>)j6fylmk46<+s+ae~(Ngwy+V&|}NyE_Br z!cTr+?Pd}JNbuHvl(enc{9XI!|J5jIeh)NqT)13urujSfo9JuX`K_Q@7Jr9nSxb{? zNppNLxVRBCF1oEBYQ1Jx5x#<}r?YSZ85m~a092xdz0jO)KL4+b?fcQ*P1~u}Ta&yy z?8`dV(=OvCmI&LD_DS1@*Fy~1W!<@Ca4Mo&)fR!645s-z5Y2OqsxD&z3^txN;2T8K zlDYBV#LKCYq4mR{y&3eBY00z%KpW_x4a1;W4EmF4No8X|6ZFu_!l3x(77;jPS~4~n z&_*2E0y&z93`KrcHAFEWh7zTWv=eJTRmpo2B7HC@Bfw^vXp3_4WP@WsoCR{upB;9%S` zXlGSF)6M6Ty5pr*xB36Hnbmpz`9ZTfqNE4S!h3!Uo2dV%Arvl`$*4RDc%=+2f3YTb znD*4eVElsYMaciS0n@`(xdGn?X)~f|kbksD!*ml>U6HCQ zQFUdiRH6D-tGd~$?s`=h*Sx;ed{WbjCKDS66Vng`96cgX95q~dUmaOW!1-3DYu7VT zYLk^MwTZhb>W)YB(3!HIIspt;;kw7OKkRTLjX_H|Z0n;f_cz~>Onr=04|WwtqdeJ)ERmHROxF(Wx50DuSc-zskdGFVe+Ga~n;q6Zg>yN#i#h-8T@9AUaRyyS^D zLxiJtrMP7f1nITKW_)cb&G?q%fX(~-d$&boPmRevNl!j;P?=V!< zW2vR(z7%&mV^Bgra*r#YMACUkEET`aiKv zcJEaT<8L(ExpHb-B}lEXZ(S?2m{zFKtumS&C8EB+UWIcx)v`qC8Y;6VBuEpg6Qw5T z?V99WcC_Kd20>zXu{y%Jsj+m^H_fH$>UL6DR$KIqEvRqY zZY|PM<8175XRwRyrg~9g5mX9SYh?9kSX;9dIRSdA9jcxzCWN^e9%S zv}7x?L{=urR(dx=jk!`vIeW#?j{Dp1Xj{={V(YY4ET3tqK*c=>LAD@EWT8a1KzkE@ zgS`N&u@@l9neR<_mY4=zN*+=z$P!s7zoZ3P)=+U9A;@u%C9*)@M<6fgipG&t4-_{G zg3OR5V$5ZX&UlvFsR*T4V36u($y9}z43vy-sY-2CCZTA=q_}8d%#*`Fl;W!;Nzb4d z$P8+=vP9v@46;jOUd2VTO|KKF)rxkhkCf432(n$W*;SX5(d^#F?V=|@zDURy=|9RB zvQHljC@xwUcc^hEl#<_d#a%8bvN`V(cGobwK5Mp=?=+>;AtNJ;{mIUuKbg7gEIU0z z%5w#6K5KeTnv~KjMe3a*b*&mA4Z$MeLnOAbB->Y#w9-K2Sz5+uNPXde7$&9k=vvh~ z#pkf6_aPx|HUWA9oN`U^oRq54xy4c=oWKpPDX*%jsF+b%U0gI&RZcG~n=+$vx=uBt zx}><$kL8$C1}Z3`mlReO%_^)cPMJQVsHUtqg_Z&q5dx}uPDL>(WH&HHZ;EuPIeBIH z6s+hxskkx)KuUmut|>32*yR;h&8VrITU|l{-r@v zQBh@aRh87WrmylJGyc1d9(d`45`&`B%Hqjb_0$+u(S++1CyqKl#*XMwH(WWLxBVkric?PCIy_rL=i9Rtff;+s|(ARk;3Yl%3@Ib zGs;u)iYsc0N(-xLmF=!o9u%^zd~#_8%51tEBWq!GVYrT9rm2<1#T-NDmf}h|iZElz z^Rj>_THIPnpuB7j&aK6=b@}|thErN~Z~uDxwC4+cOKf$=3G?gyPTphA{Alr%vE%Gt z+In8`d#&k)2U3nF*cJ`iUtoMq`MV%>`=Rp_tImIUPif=ZCvW}ITeR-WbIE;-;BS4VZf3w&!xQGS`1RqH=B7GgmHOn%#5m6SI5Xaq9UFZ>6jpnmhfqEj^y;oY47^ zwiBMeG3V#snl)Lyqw$Mh9yr?Jx$ldwc{F*lIqi?kGxIt<6uo3%gwN z{f;ZL4>l<4F#LGutCrpRuTMuUbF`Uoa-Z+_#vcUR1#dDouDtuTnRj*gbk^f5TTI{4 z!q;`^^hv$jw0+>28=st%+v(_aEpK|i&5bRue`?OBXNEp8yx_J8@6?w4liR1y-?t6k zZtOGY*>1Mt7nSp77hZk!!!tJ?QO+kCKY0KA+07@$)t*f3YCbdXT)UA4uPvFM=$C{4l87 zrUnfTWZ(76V@2P8S3Yms`MI|}+VBa-FRRyWPwKk=mU}LErf*2U?%bL4XNSa1x^m<2 zGq?A8xy6aM9-F_Tw>Ry;uVZihaM#$=1N!dx`q5LFy>EIoYv$=gWd+;vJB**a`pV~i zO*~OyX!_XH@76Y(+w{YF?y+%S{*?2Ea{kkhk&6#L_pbrUdF9)$^zF5>{JPTXU)i=S ze$mHI7z!Rfb>s1FeX?d|`KP{K|EDEGuYE4~M9ZbOG++35&vnJ$_OO0>-AxbY{JQY> z4x{EYn55*Nf7?UrKFLh$cguIfc9r~R&Dud-i@CYZZ69>o!v9zO6B}$ zgTtYBU)_86WA_Z+^TL3V!)ps#KJvHq?hnSUK6qDYV#jrpGT&Uez0b&BJN>KR*E0{E z_@L_gnIC*RZHDte`H+rRw4UZnEuF{$t7>qOq;aa`C>`)=6_Bd`0>#BGcNyh^U^^{;}>u4 zoVV-gggaMunLF}mm(7P?KisX)?IR0*{$bP~FRq++`_>^fH~n^(aY=z=!kV);m{K}@ z`}wZIlcs+Sjh|U;_S$P6uXexKvm#{Zckctulah9YlKKrCwsypCUoE)SdHUuzPW|&o zc~;_m7q-k@Gox|w*xL4AJe%M6?02KzjVrrt*gDG(SAAK1`hi=XZ);n>c;VFYF%NHg zVwUAxUa!p04itO4T91spYxJJEzG*La9P-!i9`~I>***6iSo3{N_1lxiTSmkcChhw8v*#_pG-~t0bNyDex@l|k zzE6L%d+oXz*R=7zUHjUk5BKycC_J}dXxgXC@BMDeng+Qqes%TP;j2cyU$W43`AtV# z-2d@=)$>xnZ9L@u_x?$|d+VWV&d=RF{ktX$x2(;nUY~Yr*3)CVHo7o#Y0D|jS1>nu z-=y(>?)hQaoVGt$UfuiT2M79|X!Bb^-;EPj{GkjrjQ_=beYY!ts(*e^-&~-a@Y_@4_K&FlG>GRjKt9J+z>}MWt5vgr_WmziD||#w2A_iN{6S0eieyn z&M@?tfb#j=_P8iz+Ja%|wu$OS-oxkdL?k?2Eg6Pxj5F~sfR zm^K#%cp@=ZFw9~cDL21$&*~i6mOC-bI2RdJfmfxk`Lrgoa-B zkZYu}=5kF#RkMm~8mOAbxTdkHd6#RNs+wb5lcZ|?;+p2FCK zr)oxVO>0$C%{7Ut<_@m8Ow~|}AeXFaKH!>Ws)jy`C)Y~VDEr^GP&HY+skBrzLACKH zIX@#pb9;p5(Fn~O5t_qXa|ObZqxJ*Wq^O#IN3fbwcf%aTCvvAvXs{2F9)q1WbCh#x zuWZlE^ei+~8XZsovL>54aX3|znJX*URf1tuJJdtUECoY-ov5K6l4-KjAbo@S!TNa# z@nPKv^}(dkEYl1TRns3{(kZ=$1x4Tesu(O1W zXmr8i!$KzwU5!NzU3-}(J&U7g1R-lEbaK=OGff7?kQ|KxWQ}5)uGBJ1$wL}%$QmW1 zX^bPY6wBz=IfinTTxdxPl^tDsxg7*g-y64r#z5tj zLsjEAexzX-mSZ$yNY&(0d=?2BO2rF$O?nzYLs7w0R(cw;gLYn4H5nN^sj4O&PuZAj zfukJ5OkRX7RSiK#h9F(3*RX8Hz(&Kc!l4MLELJ#!^cohnMXyPx zwBzEgu~^N_*K2afD!s5z!C#iEtbNh9Hl$%OWM%QBprOFFsG7dIb(%Yqoj58-a__i5 zE$hU_B6QY`_Yw>v>|fdizS_R5D}MAQXsrI6#W2ENsg!GmxKtbw73uTW-kTS%hUMTa zh7rOdycX8@z~2ou7Ja);j$wqbx_SjRbwVT7=HMuc^_8dg2( zRNxp!26+T|!RIyBcFtlLA*_Ck)s_N+3!dnc*+>oR zYtCXAAuMX0T3DXGO-^a7IO^cx7)A(-`aJnAoBTf<@Fq67=7lR=!C4F=ghl;> zuYIerjGVDn_Pgtj2Un zgku;XEb1u@Y}qXXq=S#!wrH##oW(FgSOXbLY0K*#T(nVR**S}0gs|v(poLZa*Xlns z7QT*Pj$wqb1`A>B+W&Bk#=3>G7)A(-?w#eZ$n33_$-gG4dAOdl7)A(ds1R1+xOcm2 zteu?2FhW?vR2GGG+_q?Nb2Y4EoW(FgSVomaIWHBQ+@rBBa2CS|VVM|<`VC?wPn-0) z#_C7|7C43x!ZJgv)eUR!9}F665N9!r5SE3pl(1eI`0P53HI}m&MhMF)g!T00cRsJN z=5Q9n2w~YS64n~dVi+MTyAamV?T?Pu!g_(T7)A)oagne-4SH!s@=VcPou`7iTey5SCvE>&cx%Dm2zM&SDrL zEIhQ*wdKFgxaKCPdH5M;F^mvaPza008yf3Z&SDrLtl>gf^{+ehUOP3cgs`5p@4Z4}&E_nI5yBcF zgf+RVWkI4E)_t7CFhW=(g|HrctncRENY?}nIT7$L0jjHQINYwv>78tW;}Vi+N;35?ZNHY%N5b>Abc)UZD1 zEQS%nx>^Wp_7i&^(^&PJ$i^5(2rDFnmAhidz!qv){WyzZgs>(GVZGftxt+$!=PZU1 z!YYgitEC#&wVcH;LRgc8uPK7)A(diV)WDK06-KSoNF26OLhou%<$* z_4C;WexI(fuHY<&5yC2AETtYE`LfeL8mm8NF^mvaDPtwm5x-aW+}%lI1v!ghgs`Rw zVeLs7U8}K5Ig4S0u&!Y&B@a8boAtiNx`neCMhL4+2rFRg_Lat3%UKK~gf*S9lyuDr z_CKPrwsIE32w{~AVfEO%zffbn$5{*m9QNpiMyY-Eq`tacn`Xe*5Esu-_{4GQ7q3YC zO#q&8C&_BUh^z|6s?S-sb#1*`V`Xv{VMNwU#%jn}KbP@gh^!jM;umtM)BTRF8tW;} zB81 zS%eW;*F$57Q*xuj7q>sHv99MV!icOJ1lG{as|ISUyEuz5BI`!RQqn)?$Yc6a<}AX9 zteY4MMXPg)ja{5Y7?Cv(8iVp^Lo!rlq9Q1)PdJM(BI{qMn~z@Vg^DHC7pC z5k_P!gvJopiYRaoSsx#&u~u*vVMNv98fyk;5k_P!g+^l~ZGC6G z#(IIX2qUs;8B3`fvtGOPNsaYy&LWJ+x{a|?aU{3p^+%r3SZ#RL5=LY#gGRfX`1+ds z-!)b~XAwqZEoZDm9La6o_cfZeQhTR!7GXrz?a&zFnh*u<&7GMCG*&HV5k_RKfW{D~ z^w^K?v?A$BSTAxGVMNwS#!_l;+3-=1YOGHQPW($_6>%0}MAj9UUuz0d1=lS=#Xso52 zMHrEFpTK&d?Pj0GdV#YDBeL#iEZ%6PTTY$bsIk80EW(Jab&SQUsZ=}U=k*$^No#n* z5k_P^0F9QeMeBa-*j_=v0x&}eVOPBy*Arm<={ zi!dVVLB>+bD{t&4s9Z|j*veUi5m^rjVYM3kNwvoMl(PsUvXIfb819(V0^@2WtbaI* zFtV;&8;IP=nhZhHSGVig!@wEhXx}r@S-}W}DvN27K&Y~?d}{IJlH$qNOu<*}^Z`1) z&@ZYks|r<=6;{({`Jt)P=|i7TB}ip6@L^D>s=BCjMo9i>Cp4piK2ooOr>w>&k<(|C zhpw&SAN45a3aiS~LsN^ZLuJL~Y8a}rx^QZw5+4OcDkqgz<8vkY;6B2#>J=)lDJv8G ztBPmV6qipf4o$)L@uC++s<14IJt(7CA_F0s7f}={!bkX_veK&RP*n+iFf~gxJUcsW zK&Ysk5?m!J<(UvsJXj`Ao?aosnN}`=C?2IKrot*Mmsqfj0-q^0Y(jyOP0X*Nu(GN+ zR8_;KE+Ey_EG434mcTk8tjK0nmR1)>mZYrKmn937GMF+<42EaBn8PYwUm&WovZ}DE zsxVYhMaix#oF107WU;DLD@c_GrBK4E2W3@ctmGn!)ECbV%V};mN?~GJ4x%!*I8;(x zR)JX~LLspHs0vNS)Qk|#po#P)dQDZ~)F@tc7L1yxa6~8~-lgSJW?Z5YFi0ISWPXuR zoKafD8aO8T6jzo`Mt>kQQ^mWmy1EkWg*qRhQYil6g%zd`6%|)aR&z}8oL(dsa1qPU zP&JY#ht6_EuJx?2Lm@}Lv#`9Vthmxby&m;j#gl7LpXY>FHyD~cW5zY5#Zqcb`K;3N zqEz+k#8kG?weFk)grZfNJO@Yji$>IU3(?4ee>4O7jv|@?!M{!eN{3RX1r=~H6TIiS zm=OgM%}gDgR5WvSL8F;fyP;@?G|#%I>eZkwx(2w23F#tiway9EhGG`k@zrG}3bL-) zP*+)(8Rj>+q_DI+H7zwFIyz=uzA`uCqTITCFA`za$}bXW*}pCWtOuxzEqm6PW<57b zqV?=3>C&_7^p?ZUip(=TyH0PJopW(^o!)h28NU|Rm1&B1o!O=Uqf-yDmFA zL|sP02N`wda3nBRlWg2lR}{m|%HU|GqYrkX*{uUvr%`QqRHro^q)s!s+?MOO(BFm) zwv=H>__&70AVRG)s|XLJIYoHLjLg&s51A3gLuO>v#fah|Gji%;MDdUr{p(^xdJGE% zj>0S1q$LjG}$pdQyXdXeg*@K^hJg{nj z>M_9TwpvUcx5KEeBcS?a`h#Y>$>Izchh+~-wRneV5zg?~9Dc9g=QR#X)2TC^c9Sb$ zw!4hL+pC79TK%fEbid6P@YuburdMZLtrnlfVser?$bT9u*XK6bT|oy62s{>#RI3lb z0DfMaTZU=L$?ycN=Ab9&pa@uXG0U)eEFPE3Zo&+(w(#Z?y$chr@zYEGU09OLTWEYxQ=l zX0O}lwR>W>Bab0;^(@P6w|l$}Hx)N4F3rBpXt4)^K_oZaeqHNSsNDVzpDSSVI_*Zj zYK7|KHM*Us!cMQ>s4Zln`udF)D?DA^C`Cx^6D6UG`vAAoYPLHp0i(M1g=)zMOHRMT z6+{h3!fH^-Bmbyqi_7Q_dfaxa6V(7X)>=j*u>VI{4Z!R&dfk4P&*Uu-YxuBO#L*CZDa*p`>=qX~Gv1r9g*#MF zv)O14*qlBT2{Rxs&oL}JUtZ5c#d(chbTSri0QHRmQdap;0l7YZ!0E7|)7BzlF{$2O zqt9ly_{>5qkQ@zRwi*4FfYTkc@*u*Z5)StIU5K|&uDexy2@yHsYz+}LXtTv=^_gvc zx0UxhSXyLQwr*_^4QVyH(21D5X7u2cN)Po<$|@nWo`?pu83RGT3%xfl9a@T{F09Gu zM(7SZFC=DFU7|!YX)@X!e!tgallyHsbPJx3$*EF-Uc}PlH`{DxIhI(_Bn)9T868fy z+2!)eRa#x?WLP#Wb)s4V&g{3NsW^C^D=VNVxKPM79m585VO6p4j7WYu)GwodR*KH0 z_s<F?%`W6*Ws+pRaui)N*U{GG^aivj8HtWB~AvNtuv!fFpa?$AF{w-4g?j>^&C)j^g)047kp~orwXL0$frz9CR*Pd0YYielg&v zKk&tXqxw841{~R&69bN}AIoFFH307J2wYmkb%wqzxIY3H{d)9FjJTI#z|ofwZ^VG3 z7xbUTfTQc>_c7q8JbsT6*Q7hZI#*YHNsR$V{fjvU9MyyIG2l7?H!}ttg?n2JII{Oh z3^*#coiX63pF9u)j=m~79V71V7;w~nnPth)M4gM4&vbq35(AFx<-~xa`Z7EQ z9M!)`G2jw_n;RqUmKbmiU~g#zF0$XH@BLOp;3E57!rdPO?lRyWj}f;e1{{5x^-2u5 zhQRHKz(uB)^5y*)a1`#x5xD62@>LAD%V6*O7;u!1-y(34>7e-i9f6CCAJwadSK**@ z(b@;)OHu?bGF-y7iUCLI=nw;r;@2et7nzPmz+Dvsj^dXUfs0HB*&7&viwu|IXN>_z z;d&!*k>OIlk83^*D`)bE9Z&PD65X#CPX1{~Fco-yF4K4(YZBFmTB@1PiPl+We} zTx2~UoF_(HL5#QwG2kd2QzCGY>81Re9)XKY2bJ%f7;%eYz%_!sJ7dJ%A0zJ37;sb` z&&GhG_`MVZE)lplV!+XO@`D(0M`OhO6a$XN+4XwkpmWjM8^td{C!0R#(?1F>ESI|XN2E10k$!E*&k^(Ez zPxx)aZ?+`QU9k)tKLYP5tH#q8ALD&BRi%^1`)qj*+jx&BILbfX>mQwO^@Iund3iQ} z!T7S$N#p7Jb9@+4US3=_esV>{_(?UTWkutC_<+B_o8K32*v97-mlfj;#(1n;Uxm-~ zLsN>`8=|VdGbT;LMgxPJNs}aLztlqNEv;RGM}7RSuXJ+djH($^s#AL8^-Q4;DW;ds z#W(jUmKoD4O7ZP1;{AW_|8n5}a^U}R;QtRfK;3*CTaJJRfN@y#Rg&mYU>sYhlm?G+ zQVNdr*dVv>3->Oj?1XnMrGKv@vNtj!q_R!qLN|XK?g0 zX*-U?nY07P0w(RnaTJsG<2aT{2XUOhq@y@aWYS3-Co}0Rj#HR)4#!d^A=*+IlW0G; z8B9usM14H+4^j=2QXtJ{QV&SiF)0nwjZDggbTgBTkQOk>3F%fQ1tBeE(r8G_m^2X* zq@?7Sbn7N`XYBgZc;QFq6_C9br-~q+?7nLi&bDPDtM}i53a{j!Cqa z=MPMp2#LxQ`3LD2CRITCok_Gu=bucP2kCDnErxV~Nh=`H!s&6+8c6k-v>s9dlQuz0 zWYRN`X!pH1X*;B5Oxgj7_SuV*_CjjIr2UX+f4n&9Af(HgbQDqwlTJdSUG3wfvyf;% zx;VBMeNQGy26^u|b|xi5x`Royp!Ho$qCw{xCiQ@{mPu)l)-fp; z(gr3OA#G%m6Vjthq9v~%XVPd$PcdmCBx+x%e~@TFTJ(RAwlQfoBwE-Uy{KuVEo92~ z$wGn4XVavR)l^`UEUuu_mKX8`thSKFY!T1xX7RirPdE>R`HwEhSNww}tJURqgn}MR ze*bV~z>i4zt)a2Dyg&qlDVev|<_~Ae44WkwvIax>_?tc;BQHH<^P9|Gn^n?z;8Wl_ zJhF45d*EB(=pNY_>Crt9xTmhb>+s0ViS#fBGor=G9E=(xa}eJqN5;o8B5$NEBRe~N zKzMF2pRBB0LGO3v7lZ;q)CgpnHQyAn+6ruWJ{Rd-7Rh596S9rAI8Ab!_2%wEhp4`J46m^_s-jR>($PdUU(c+07cYMl6?OZn@~2R)&nDKFm!5^}2m-x#9~ z>Xnv&FPLY`&!?)Hmlwzjw!0)$N3S0qy$YrfV4UjKrl5GKBfCQrj=DAE>*H{x# z8PDctF$)zqZT^tYgh(K0C2yd}M=hg)^L_&I~1M%UU z0)Y{hA>@U7aGN7g;L?KinMQ}~c_xPsxe-FY;V5u2Bf-1?atTRH4`qZaGMR$;W%9(i z%=iqrU<~UG^}a$KWL>4c>Qa=rnMj}w-7B6XPy%=-bx}C88&3dyn>*HktnL=RCym?J<1MTHI>gW7GTf)S|e(rB7}k7|rMh6bLm)?||{-|q@pB>c7DQbT{~ znD0;LjfkI&%5xQvzuA;;%gG|af@D{2 z!4}EELU($sb|{?`2Dk3@kyX~kdPYI=S=k|*l(qsK11{3w8tDyKJS5qCY9^4ZeSpGLXg9NXsz#hn>6j45;XQnZjuFueSAk<@^FCZ`wu7doK-Q}fI zb*c-=EJJA84Nl}~HeATgkp*0-WC7PEuAx7uHWri(*<&)kDt9R-a@|sVyi_$n-T?GS5zRDJXR}{`A<5Lqx zIp=?$;+#JO19;phE~78iBxmiPHObrmxp3ivvvz!HnsfdeDWToYg%_&brtJv~M)$rF z-2h4pchqD#Yw3lRJFE-l zDWuFDa#&5kre~-1*+M%c#j~4Ty0waDYc;>ZBrnIsOC^wAV>)?D>IUkT)b#9Eajyd* zZ=fqnl$c#ihws^0&mt+CR91U4-nq4B!Mc#KxjXg1Q$_c@`^%_DSFeBd*q_hNzVhTP zMZ>e7n6__!RbtwmpLAP$`r`{5I=A_=i!bZV+*7al_pN^K`0&j9rJZVa^z1aieRFBk zH}387#@a;#MpwOQx4+qV%HlchsxOCTf78u4e)5P`d+%s8W9egCkSl+c#oTSwdp^4dz4L3O^}a?wH(mtmThA@ypX64UAjd zBiLbR{lxQzyVHAR%v-zcm(R8>oqKpv>9RY=)@1hR_ru!Xp9-eBeLrQr(d$I*vG@Nz zx;_2D@n<_F%)Gqt&CPFZ-_yUD@Od$w9nS|-}lcM{PC{*EuW75==Hu$L-+KUUjLKoU*72=-T(LgJ14zp>u}#t zlch`VG2gxW*|V-D8)tlT^CL5^zVX`Mdc3>V{7$Ph*UN^11&<%?-D1XPzs{-H@b_Iq z(s$L)Tyg5=4?5+3F#Cxk?~HzTOG&#%!I5))FP})i?8$TI#wt{C=Y7^Q1=a9vz!g5_)7*uI=SL6IK@vyyochWBorY9a=g2qh%XM zZ}_B9&5>d0GgrQGXzU$x@45Y-b@yE{EwQ}+hjUi;TU9c9=H-9RoL1cUnB~V-rh31< zvenzDyY*QWgz-Mx(R<=bTTED;e{k2f*LPGe3ub=2_NBp&QF}xCF5LR=gPjjQ zac{SR*?%otv2N?llmA}+Tdlw0(!D*;zaP5e(JPX^YM9ZpjyS9KO?kqT=|+&+O~^ary1}hY22DA8?N`$ezV}&T|LwQlbz$m0!+^Km_J8)&@~;a% zKYMFi@1`+7Ev)yzO{0Fe{Haz?4t%P|saH3(wr72jU$$b_18)u5^RFJ~Zhfg>#w|bh zoA>-jdp88`x!T+Ly-D{ZdK0%^ePx?ZS54~L(DhlHg@G3~J+bMi|4{vg6K~$!<=GAW zs?H5}-!Wj>w-0RH+tYr3$JI6U`kh!={p-Cs2Sij&=IkLI7A_f1v9-p$^c`}DjUUhXyh=TRw(R(0ul?Y7>BeyTZ` zn{l|KZ+!bZzw@3e+B)p;Ph~f5+t74;S+1d?QTIlk%r<{d>-nU^{zk7=YwO?hW}BzF z{qRBS()p_%`{;!m4_05@di%PAhflovNqpBuOS(T+eA$x?eZTY`U>l$6J@E07?GG&a z>&24p&PN)IX*4(3mU>L){+pXezM%xF{?$+Xz@r2#6tx(4?DRZNbIQvi(lCs$%q!qv zQI}8d%j3QJD2r6d8%B|qF!cl$U4OJ?@^-EK*Kv(SA61hhjL4$bfbzDK`|3@N^*v`1Mr6@5a&5`Wcb=-}(pbs3 zw2~u?$fD{hZ{$h-Fa7!W&l+n0XAwqZAWVK~1(v$o0*<;5v)>YKa zz!64dQTb|%!@4*B`I*KV!C8b6S?vYZukJe?8fzYB5k_QnU@X#;OSs~N;~MJ;&LWJ+ z>IjXtyynOb)z@mQL!3nzkwwFJt!JyZbj2MSt3Gv~aD)+A^v+6KLhTV*7cl~0w0mp85%>J(xW%7>h-n8dXlpU zBeJ?MmJ-&QrYqjnSYL4#VMNxIjHUDdEk`^H1HAf4$#gM+BaFyOg+}Yyt~f?-K@`?t z&LWJ+>dIJ3y2jp+fvT#orgIiyL{>M(qV$rBd-D^#?owFmIg2nNt2;D?xD*`8P5r0U z%^K@t&LWJ+>H&=*j!K{0xaYFo(^v^~k%S|R$m$7=*7tVbm-?&58pv6M5m{F;meQ6F zxR)-~Sd%%6Fe0m$5Z24>8=ccw%Q%ZLBC9uJ(KVFZxTP=XTFN%gB8ODSWm{K=-a~5Gl79s=|U2Dkg?Q(a2jpgJl!icO4Xbf@Glao7ga#V@ND(5W1h^$O# zv>4v-z~n6&YYk@+Mr36%mQpvm44&lHSX()ZFd{2kU_G|F$8wGJ6=xAfWaTiHQs=+v znBGleU6ue(IKqf5WEs+>^z+t|%iq*kgE)&YA}g1%=o(6H%?pLPe!i5m2qUrvKx2rb zs|L9#+l@$sQp$I57GXrzKxniWc8jA=eihbE&LWJ+8pK#iST#%9T+moQau#7k)?mg` zYSiJEzSWJsuHem%Fd_@h2{A+`$lQtr(_YfTvT_z-MAlGfv?ZHgsapBG#;V{f!icP4 z0_)%ArB7mMO5OOH zvj`)y{EWq$x|A}d<_(RN)EJ&{gb`T*XtYK4dtR>JBBCc}5k_PM8H-;Or9TdL(8bWg zS%eW;!x^gyj^r{9y@R2#lCE)_MHrEl2aUEgf7&$=NL$YcppNMr2*hSW3=Y-Jcd}ti7B?7?BkcSYtNN>#4Dhau#7k z)cv@v z5m}QNOUaF=ci+@sV>vjBFe0l+2y0iqYmdeXaTZ}jRxx8K>1uX#(w!RXI?f`D$eO}f zN(@i@@Ww%nwTiO{BeJG4mXh;#_;$alv7Y2C!icOA#^Q}uTEBCZ?h5-RXAwqZp~36g z^2zzX>B9Pkvj`)yrZJXMUf*2x&0AUw|K=>hh^%WEt3Hn84t3jr>{RMT+ay^_7?D*5 zjn>6^RE;?w^xhd zhnz(ikyXW5N{@a0*GI0>SSLA)Fe0m3VBKi$_>{(KkPJ^a!icOIXtaLAI;o|upHJm1 z!icPE1=a_TU!J9fHH5PWBeG^OmU4CIes%49jWvq12qUs)GnSGYi%l~h*I1RDMHrDa zM__qx9h<4KR&W+!MAlr!;+?GY$O8lZrLpL30y)Bntm~lBo~11N;3-{=dY`ihBeJe% zEMA&R0Zw6JnHi!dVV zCdN|w!wE+hP1IOH&LWJ+n#Wj5DIZ=|gXXXF041D77?E|ez%t%5zP-kp&sl^KS+@wR zuk82eYSjIlMHrC<5OPC_;fyseBg2#!Vi#2A2qUrT|@`N-F4=o*!D_2MkTh^)no z1t@cs8?ye^SRT$IjL2F7jrNRa_j}GB8fz+N5k_P!6nAtDUHjS zd8Nksg|i4FvThexjz1FGXsos^;0Z?f*(?U(4fx&AYQ4>xvNmWINw0~*0@G-It{Um$1?j|n4aK)2CjvARuOPr#^~L?FyA(1ZOBEFf;P zI`m*+#(^Gea|Uc4U(hUo^)lIk!3l%fdVWJ=o&)Spx2W02XE|=)q1WO5YqX z>7yacV9}?whuOoR+WZO?ft7}_+Ox&v_WJ>em~)}w+{Pe!5|77fF$&+4>%KYH zz*w%?>-5{*W)T}U_d>%5jZVAYZ!y`dB7wes7G`s36u;5xvU;tw@UIXb`YbqVoZLoC z!N=@5c`qt*fG22nm|R#YTb&7``e9E2pVNx9!?DsleRdu> zJ4O$+Ix(FE(IX`L09u$Zqag!EzuV{W`*9VC4(0PqG=>L#f+=8eqlY0z)QL43+HUl@ z+#Z)d;A80U$u=6$Ys5SaJGNW!$Ur_hNt}SA!97N&$B!Kt0$v7>Iw?m(dyQs~+hVa< z?-qBDlW58jzd8rSljEFL!N5h(pF00Gz^atf^)=%=$ zgWMjs$L7Ozi45vMnHmTM=J8wcRlA>o_$(fIrjvd$kjk*Qu~CF6;IY{4dWO(1@(Ds3 zCusCJ%zmE}t(>C5Ly6=d?aFx4iVnf$LWX#-fyu=H2MQUtHXuONVF7FbycnA z+OX=r+3%6Fgr*RwUg%CSOfgw~*vf*~teWel6=^_+F<^E1tX{8No(!m;YNR3q#-Q70 za+vJ8hC{QDQ~=hycbI}cv)dtOzudIgls4UrBn^%WC@i9d$<;J$mXe0^8toW>+TC&y zMW48&p;4RMCb!RTu^7WAGie}~5o_d|><(1JpTJs&9_hjymQ>RM{jfRi8~;Uzk0( zzo2We#oKoDVJ(;5BTE!98QX16&^*u6s;ziZT-pv`K+ zW;qU{JikljAo>;`w*0VQ(63JUQhobd+!nvhg>7i~Brw${+ky#GW*hd+unL8c?ZDO{ zL6gaDWD~_ye2&+GCggUp;ha;KsQ$R_*{!(W;^RCm&I1Bgi_01a(7>8cFH_BBJKa$F zgH|?x)N%Y?tIub{{i8YsP381=dxO~E!^to88Y$cD2)eyiFRt!FY2^5Wc9X-8E4e&x zO||4RVyB`&(1qP9bW_<>@9dxz^RWD0n~_a!Q}qM<9_-EIM*~);yQzLzbQ56-Sg{EQ zrn{-?Y}~cDF_RCyq7_rqG`-pCaiTkL8rdW{O;49zhXXgRY}%ZvA7Hm)BPF{JLn37& zo$BW^qASB78aIl%xpg{k9~zw1ZSgVh@K%$BaYNAIw}Xrccq$8M>WlVn_gXC2no1aCss3~!@Yo$edk|5=_=?XoRwoLo zKn%oD`>~e~Zuf!H<_@X|JPh$-7cN)OtL>bnOGP%eGQqA-9+#0ul3MC=EM~jULe zu-L>!)hoy2GNV|qbqc&Pb>@6VuhnCA1WfW3i_dOUdC1&=%jEN-ebGhK!Y4fH{DU4Z zc2Dx~kpP=tt1~|!V6vI54rCak)2v99I{*(H{C3=rGQWJ9C#m`Q!1B^V8RFrRuk*{b zqnC6CFyd9_QtD{FU?5;|s24uXB6fT6ID@z^;}<+O-%=$ar?Cr?8KW?_d_C07!PJ9L zB(5NKCsRP`yi7gF?+%*LT?aTwo2#jUFibPKosOX2p%{{j*q$8GUg-RO%HL_tIw z1jrt+TCEPZPYX(IsLIBF%4%)$hQxdtPQ>o8b)dvO1fzqLCx&iQ!0dARu*)5vRcVy^ zWu|AR=$x{%P5%KpB}8RsoAk{798WvjBuKYoXPZ`d9@jJ(bc@Nkh&c zDQ{*v$qHZ<%|NcH&oug(h}5XG7%q5GKO1H&XAwqxztoVisG*UIAAb93LddR~|0Rt0 zMulpOA45q$0k@d~9P(odK zYNPed?OYm;X1e3A9{n`PBdCO9BSISn^{2oK&oHai}IyUWfuq zT#Vc8T;@$pyFlGH)~@iT=5n#tiZw8L8Jwj%Xvs9^J1okXiv zjN6^LV~{5$=}xwW#kk#_p{IAe@mTy8OWQH2)|9$i4jw@-{HVIA9D=;;MMU_i_Y#| zy%sF#etXN(9VKs8FFk#$yU(bRxih>iK7OLhpZ$(1=X<|eJ*4l{<7Ak*|K`=E!`0k|_A~EuHjH(i` zJKyL_mL;69YbO1buYM$5P6xOKQVNTkJXeV{+Ep|_r*PU;v|LuOBc%wd0J5Wes3+lz zhyIF!;@p5V>6u(baTmXVpev;I<=;b_4*gnR{RV=14sr}5d;>uREq^&d76*T}<~fb^ z9#P;JM)=->zTFYSGN@twz&P@rx1cwAK3!N3KGyehjYX?el4BU*%Ly7W8sexc z6vr^l4i^1?FC3x!IjSA>Sw6j#m(7FSN0 zQ8~S^d~&g6MooD&f{X5JuPmNfQ(QiIPQ0ofm8kN&yp zzyrdi#va)@%55Z#Jq&E@L5ovT(UXfd_Rv>g28uHFpds$d%u_qCu}9dovn{-7aZSPf z&##?N!_LhA%C)nkvbeD5f8+A0_UTVQQuzJ()%|xWS@GZOlcU^`=n6{ilc}ggNBwZ4 zep%@m|4EI@&B;lVA5u__>l;T;A}sGn($5qMT(lZz?I-)G$0#-K4R}_C;aH6edm=!c zaDR4@R;@`!340QRJ&B;taR&gmjbo{Ejy8&|Mr}O_%=kgFy@%_-(V_|Oo3M|HRmLUN zfy+b$m)o#EoMyn?%LT{-1@qUtzx z=jysU`Ukj1_sBqGXVkkRYUVwFF>)M|CF69Lc(TwKKQ}NVFJX`3R}IYKa9k97j{x&r zI4&%`sLs-UV2+04qS*Tfm`3!Z0Isg|Qv7-VGdLU<#okz8riA07#BTvGtHN^%p} zYvH&k_P*d4mJl53D&OycJ9i0t9l>wC7I*0QkyG;}O8kPrj1R{}iQimcmWJb^*xLlm z)^J>yJ&NB)z?=!kMX}fTK0Lw3kDQv0Fnd&AayW(oai}Z*?7-z+!XCAc3Sbt8I0y$1K=u_}J#E|%UjV2t6oDE6)fW?DEdEPfpk)?$uf0pn0t z{%r*AnM>G90snnq&T!nt`j>OS#IKV>tt-70zb?QG<+zL4a{^Ov347EZR06Xo92X`3 zHUjfZI4&&z$lm+F91q7uu}AwRG{%oyUFjuzR{=9L92dpjcwkDxabfYJ_OS?<)#11( z_O=4EBODjS-VtEVgyW*vYrG!q7e8`!rI)qe^^#=AkDQ8&Vy|dD+9rPFR9sm6sJ<*; zkA?E_Bd6k`*xS1v`-tL4PQ``UqxSprdR%8V5K4!OVy_1d=adsM!8z)T6pMX|R4 zm=)o;Fng4Ln}K;P92dpj7r>kh$3?N%;6X~M=IZJXS_9XGW9!Pl6qqprGcg<&C4M&o zvostR7C*AL37Ea%xG45c0P}M=F3cX~U-Cm3d*Me;O-B@aLxFLJs4i zFw4VnQS3bl%=U0xm_5qBPk}iRj*DV1{!z3|{K%>4h+?lVFhj#}QS6NerX(B}W-k?C zEdu88a9k97dx7~l92aIU1@?XhruilaaB4cD*h>Rua5yf^9_8OyV5WuRqS#vu%&Kr) z6noEc42vKRb+wOOz`cJ7dsJV(kI|m=7{){RkyG;}EPiC~Dqx0&#9Qa9ou5Z3AXkI4&%Hl-{GjoDIiCvDfrTyk*CaoSH9T_Naf(&d zxG;MZziMC>hvTBydjy#0!f|2tD1Q5aIU0_OV(%Yd8f~Uj=+Y5pkIJJ5$1orcb(OCX zIB&SUu;u8fNKI=RSY@w#A=!dK zF-<{0#EH_%EVHu3va-!gM6=v+$u#{`T4`!lBDtGeD*yNMoV(0rFz56Ayk5WmeaZNq z=RC_f&w0*z&%HyppzD5y54Y=H{tNShuR8R^c)`~ge2HH0Q9IA^g6|>lE%Snp{9Nn> z-vi(~;w9f@FZd|#YpunH+f|vLTO+-V7kvKUvwFctejeuqANeoE3qG>D#0$O-;Cs^x zzP8}o=LH}6?~)gMbU&uX=lF2DD)Vy?(p!4L*9?3SUhq->7w-ihjr-4e!AEvK^pbCv z7kq7?@1z%e6!%rv;lu5!%zvGbZuWwY+FOJdd{o{ZFZlX_FX#(=xLuXi$0JC8!V5kcFW>iquP69+dBI2eZhOH;ao==3 zKHRR#%0cDr;RT-=d{278NAb7B3qFd!PrcxyerTVUe5bwOqj}vOFZj&hYgL2~x2rP$ zQJh-5;G_9Vlox!|KhN}nkNo$V7ksV2x4{cOGx&~r!AI@)rWbrPuGZgx54Wo_|4~2Q z(+fU|t4Ut)H3Z)rFZjrROT6HteteA=d=v-YdBIl;d>6dnBme#51s~OKi(-7ZU6uKn z`i)1t;A;%NiC*w^1z)-sd^FE_#|yq1;M?T|Uq|pA^n$Mu_-=c_*BN~EHsZtWs?2}n z7mF8sG|w651s~;affsyL!MDPL59g{XtV1cD-}2z|Tz^nJZ}x)k0q~vjg0C0&ZhOJk z9(=)@@Zok<=4bNXL@)Tv;9KMcAGOO5yx^npa<>L-VI$rtMdAB{)ZUhoBj?UU>*!Pf$O&wIfa2EI={_&oP>s6MWG@Ok#9v_60MYkas}mHDp=(tCNq z*8_ahyx^mDxxx!RGx+v;!AJeZSugnNgU@#hKHRR#%1ix0!!2%1fR*u4I}h}NkLHPe zyx^n!P4R+{`i*oi_$aQP@q&-~(+|Ahqjh|d7kmxCciIcSYT&!!!RI+Yco2N$9(s;u5xBE6>pEpFtefX!gtp$kz{?-C#Kok1W?MSQZ zlIyH%?-_EIYc75%`-tlRe<9{jdtntyfJkpk@larE0Ukr#NOzm8a?+fDc2?K7L^lgL z{Dk(Df@Ek)42ZY7oB^qLNH8*LJ4I+H{)`gM6$PT+u&poAB7s^niU#V9KO<~S3}|94 zm=jwvXjUBJtb z;9NmV7r8K$)pnNR7ty5UGHirlDBkB*h?t>%IX9b|@_Ry+EN5}OxDb4j&2X^%)J7j6 z!peioT_skRux52d+^`0J!*qM$ihwMVa7{4VT(jHRT)$1)4m+Iax`78GODHc&zJx<9 z#Ve6Bp`Vvs10vCGmb#q93g;3!WUdg_a+b zEx6o?Rg{vND5S1HO7skB00i$5j&lu-=Xxp(M_pR+ zDhu~YQ0sCxcu+&(2ZPH|mDKLt*)nF@T@hQ9nxy*HDtRK+EhwnXgBo?P#sh@-YhPLX zrFq6*S*?vUUvga+xmW7)&3|*X>u%}we^BvCwh%_9+}}Z|%;x8nw(!#RIt8WgxqU@Y zqBw(6ttdt`*H)rh#gJcvwc?N9O1MiXhwCV8dA^!sJH z66^9QMJ zybpgL@(5%GxXCV;`T_024=g6SkzZQ-;!XsKZ-p#K5KNs!Vwc zkw&AAwJ`h$b#~n88MaZU+Rn^rZu1aQmodK5-ffW8H8eG=k55LExPn;&Hqyde@ih9P z>DSB4_cj*+|nn#eV6z zYv}jvm>7x(r4XVX#!}o8n&nX8$mU#Z$a=24ymS*}Hb{hufuQaGmy7!S3z*(w_6Zb< zKch4XpFwC+M#%wmoKt54iCL-(=seS20Gf|KgR}~t7W^5d&G^h>^b#x!xfHIhGs+#Hq8p>Lp2Fm8tML3R2LK7paVjkfs2~1}(sTF} zvhM&r!nCjO*_U&=6NvU;jMA?_0~uAt>{gVr6_6-pFQ7r38V(fCXgrX}-xQ!k$Qz{$ zAYm;BNO)rrP#UK$0}>MN1BpCu0GiGE_N%G?0s50A{sI#EZUW6=KEEosx5#J!&=`>y zpjTKT4oKL@1QIqD0f~572J{$9d=4~@(Ow{t(;rpZd6o7L&@kq!jk!nyqt-w|Uss^F z*zN!zVK)Lu*qs72fF))Ftzf=|D&KOI?@gdLIQ3&Sb&HyM2q=QJoCcc4=!(jB3uqO~ z*2BmyeAOCgHPgBPiChf?61jR5XgF(`1|&-E1RBk>msHwYKq6P400}K$0SPVpRK6oX zV_EisN~0fa{*ZIf2uR4b0}`@*fIjBb!D{L_H8lx{-uh&eo>EhvQByw!dYY|$10*80 z9B3}n8e;A`h*1w9QML#bO;%9~&{?*T2PE?MJdp4oEv$v?P9S<4lu`Og) zs*q{jRa$SL=a|+{rG=^}3@DFNtw8yV>}qNx&=RJNR%zo@G!f_-PMxCCVu4&ti&trh zK+iKR6^Ot76r^r7v9Gp<|M zw=r$J&~%eOk}aD<@tIu?cl%~kb8Ro(z+cfZ_-54DKwFKa?=l5VR;7^NvnfD`LZf%- ze5Ro4pk#v?U&_+6%aKp|+J(NxW|!BbuT^ZWon>RQ%Q0D^G!ibeW|w0cs7m(9E=SJP z)DGF@*s)Vnn`M{R6JJ?xt>7)$<@G_ZnZkBjL(Z7;&Z3ys!mxnI2-kjlVQ#=mn9%kW zXzj5d9CmPo(&kg)=m6^(ut=2hIiSkj+AtgQKOs8@Q+rbn=01mF|9^fSgTPXsn)1S zRclnFsx>O~)(ZYvtdD4XKwEPfrGkOcfBz!YUHlQaMEdX*bDg+We*Q-FWm^T=uPk}_=M01*H zOrs#{%MzD>o?x0UK85T9KqB=#P(S7?2O_^2r3PqgS&XbM>_m?9vlhf-S2Y#;m6>L= z=Eu;QbN&joV^@&a?1gRcDcK7`kDwu23nCBNTsN$)%l3jPyDi1zVBS)K@roGHMiFml zyYR?S5i_ne0Soax+;xDqst`J6tLq14vP~ghgj6Vi8nl`(sI7;Y*5|FFuNtGQn)e;C zszPf;H%u{#nL4KCF_4B%ZCdUsDP0T}S&^kUffzW(Idk&Vo>mOX{9fc%Bv7-$rqFa* z$gD4z*t-edQr0!+hEIlXSqJP?SzXy#ut(b%eXXtnDlxX}?5*$@hx z@ha~I{=h}S+Upsst3D*`uK8Vv)Af8i{KtvBO3v+royv;7RQr*Amf{?+>s;C&0_~8O zaR?=&Gy+J3+hiaSZgYU1#GjFu5j_~K!KdIW2AaUK-vfzZ`4-S*rqzNup@o(a(M;{fvWVXYyM(9#Y_*yRoSF-ok5yDrJS8wMx}6tmrR zOZEl!tdU1~he?TQgEeQvryyg;o^ooxzx6sWA)bRIImGNIAFWAgyms_zGf*8tB%~@qL1JO1ZTH=60cmt&TwI z61;_$88_JvAsZI>#Y+5VL5qWy!tB(>(AWP2mO(SC1($PYP`Sz;m8mS#?mC=?R<$4% z%U`DXsr29YzD8uIKDN5{3zvz`#!?)nWr1r(x0#8a>|5G1r#MmGlqm-b4W<2|*(kLI z5&=%ZEt*LpP)Gb3rIq;1W<;43d>4TRvuqVu7fqrbP$%Yl2*}2%G+GG>3M-*`C{SnS zi&In6fb1->NacGEXgJfpRQYzPskeYea;gcR!bVddVdEj7P)_Zvrdrh0M}Y=$>R2^3 zK~0?jB+4-ts2Arn4`>YjjMDS?6xQAW64valUu*@V{6~%DdF&QQ;5I{Q1cteS+<+VW z^%h<+>N<+AC-4>jkppc7gI3~iHPu=ueMH(q4w~{0W0%wB+F}jdX3e?L)-<2q7;1I- zSX~Ef1?fjj>m#dk{TCb1(&9q4Iv-IRTT}G(x?qEkASxQ$S6NGNvukh|4Jv|y`zd2E zskIlp6R;YL_JTD5E9w8j6yJzKM=QI06EWPhKEoUl@~0{Pd>zW!0bAiuf#0&OM3Ah8zll55S~%Fp7E)r$?+&7AeIuCVmO0RuSz8cm`8J;BS`9yN+}km! z8W(|Cf>Jze)X(Y+w|d-VoC-f_(^`eUv@PGF-vh;3NKHU;-CaAl^dx|(=!PO7yd&l~J;^fn>&Ud~ z8V*gAI`0=ED&Bnh{@#4o&yBx1=@!|LD=Sf}O1V$xmQdE$Qv3jz%c@$68*zq4tDV1A z%}Vy==#VvkEfu0wbaP!t6yQEE>$4O;iLBD>PLZK`r_iLt)~?c9*x2B?7*{`bh2sl` zHYl(fd2%&0-n2f{Z=uCk2`-wd?k0%}HxTVmt(dVCFNIyItSi+bbiupBns<0H^}vNcGq=VL6W~U zn$zCsk~CaBzDn%3vij9hX(GoSvm8upf-R67s}o>v2`;#`V5esyIiRwz$FG5K8) z5}48#dSVQp4Ty^1O0WK@3=AdC`k^hYoHAO4PV_=A|b0oDQsL z4vAVvC05q1I~=uix(U4z2D=A=OzVTJ<%pv@zNY-U(9bOA2w=oUfMM$^|2V#4DdZe$ zT3^RnIK#(Uz8~w;W;r*}Hj0s!bHJ#UdlBrG`R5$)Q7H>Rxo3?*ZN~e2>+T#}0l$PU z%nT{Lbeop2awSCmThWwuA^Bp-_97%`mJ$j*&}N4hBTHAg>x%t1U6n=80c5_iP)&fM zN;WvvNZ;si!%d5^&t1$zB%0^DGHc6etIfl=dY2Tv~{e5?@Qp zG0Ju>v*OSWILjJ{p0zX6%eq^NXMkGS0?R!hxyM}FjYn+Vcr81E25d{Q71_CGEW37< z4OZQDg=?`wx9o0EDTr*-{g@agnPQ4-cgd4yd|!z|(5~0ZR2clv3+?P3TkzEq6-B=; zAV(VANuoUJ286O)HT_Sdvr9{9I%9Ehm#l_1#xhIsODHC3P`V|>`RpXh1OW~lTi`Vm z1gn2eqOG@m_gdbs(8U1rm)6CmjS~E3YOOzDcx+=wiM%3(+U8GPc`zC#6G_dRn@9nGB_X%h#YaNb3G50G- z=iEYn_XU71i+_SijR6{v(5b3Duf?=JymvnzXTu!P-Sf?NDb%!d=jtlX$E~;nkOgj8 z+*UBg-%?C3{ii9N%NO$%_{-`VC{I^>#Vn>md~!*1u;b{HQ5~IW6%;}8vAM>OET_44 zmj2=12cD~#VRR*GhSw%>+b@03U1EP_?V>cnon;d>4N~Op3MB_}H&Z&&U1DsdN*lPd zL{`dj$^FDwcZEfn5Ob_l0Y(devGr|A&zxeJ=%138pgb(Off9&ilIz4fe?G6GG`X&I04e2LT+ESojnC}B1k(VPtzcTF< zkdXKrD4R9=AihpQ| zZU4>^J%9w?9H26$(cmPstOOEvgV5d3mcLON3`8C=O2dF&0?i9iafrO3Uf#3jWxvZudu?`eA zY65j-*<_%;jOf^NFGhtxB3Ew!2?=@@fOde4(tb7dS2dMR9aQDira(eA5J<@O0h-Ds z8m6X>0jkatNkAgcvw*058Kng(-^)Nk%ez1mSxb?c`V|nZBaG4yKtju(K=qh*Mdho9 z{m5jI10cCw0*RbX0}?i70}W-q`9Q)$F9Qj_RY1bVr$E$W7^Q7MLf^M4-_Jlo-#MV6 ztgi#cY9Y}NNJu;ibe^@u0|^_?041@+dq9I3ZBkRW0X5{Z{RkxTQl~ba%VI4pfP|K= zKq55?$jMq}s;P5Ee70kvR68?1tFE|4hs zhbrwCpaACkLrwL?-g6k|${(l|r#1%?S~>#>Edzms*G2;guQ`CuaPDUU35i@FA+Zcd zNW2duB$v^~xexC04BQ~qYKQy$`SHc(lyOZB0ff&sFE89m&D zX0*c>dEQ2=3+#}=>+%CTI00jGiTkBxv9M|?`sWN3N?6=#yO}Ih0wHetz7(UJzlxS$`WLNQbyQU8t|}kp zS;PGjohTlHZ$?QwH}gJdqJLNql*p-cK1uW=hk@Q_+22(@Iv*Uxe11p~nrTG(g!u;G zQ^-aF3C(n1LCgrKcNhKA9F?y?<$DE4^iYR@gv4neAwj=`BWQl`iLgOqtVpH4T3G7} zB(&Ipgv4YZA>jZL5>6l?kqaawmOsi|V4Y$^)t6Yz-bnB8_JFKvKA3G@hLoA|Phy5^4LoKI*=NfCp0H~O?&I#FTcep|79C+>$M$@(2*-1*O)TZ# zxsIR*oO+La4@+?mh{>x&agxJ@QyQ{1G%m`e-6aY|$H2&`ZpXmL>+%t>h>*LcoJo{i z*c{O&`g2>zIa3ZDh}KS&*<8EG6*)JmndbLL3W{0HRybA+F(E&g@-Lxw={5_s!N9$? z!cZgMcKiwCa91sVTTV$;9CC~>+^_~>$7ByQwKC1mLn`hA!%hUArM1(o>iwqt-k^fl z8o1R;yZ!C)wVdu{m+!P1&SS42tlX4G1Ch8-OV6dEo8qHLY9~35li_OQv^a{qA-V|; z2>C3SaGb?eDpakbBlY!z2rK#^43K zVtA|3l$Q;rYg>IxxpY#}>Z*oa8hm+|zYIymlR@}KgPtpk_H5cnW?!j4eVFp*gUUUx z9eX?nVcAwVF#sDT6VdOw4j|IaR_p*-EhwQ;1TmgYqk-=t1aUL4E_RmS-T>3aGfjyT z-R%MJ%DY>LAyeL1a9VQu1^8g=E0h{d#$?zM1M2Yjg6x%CEKyRWkhuXgurADAC8yE1 zTv)x1?_oGZQ21g1osF|*Z+#aOkumk~p&UsRS@YLo3yVPB>r^&`Ro+r|FXBJ&d<2~< z!p#*W=H)t~&^P7M`HPC-Zzt+22MDLi$QrzEmh&KQfQk?)?aF7;)Wen1i@4KS$Xh)M zO&y--_=Yal5WL8mP$Y9v?OKYd%j9rWOv0fmCq^22h&Wi0EPYUCu41w{K6}f3KZu(= zHw-!Q-Ns31Wy@S~rR}LEMXIGZLe5o%yIV?M<0eLr+NfeSuf;aGiw*W#EEi&EhGASW zIXBBQ@XNDu^QKw3u0$JXKezNRe$H`7s-^e<7~%>R(yoClq+<`>Qo6Cd?!st zDFKL%U}0MYpF+z*ATc%Rg?ywkUkp$>Bbv=;Gomp}9N0PuBy2o@&O>Mk1QPk9yVQdA zA&}5aV~vpgRz=?f(ZtLs(MFq)xC$gB{sEfDsdW+HBDDpOC~pvum_+pl5}G4a+GHRa z`;Ag6kdU1TB&K2oK*9!{2oZemseB)+d|On$Z&beHD&Oxa-*uJGfTkt%H3SlN9|RJ1 z>1ML9OSjSJ(3?@3pwgZOqM9&Di&WanK=YZl3P|WHQd8+*xA4IcAYu2c%6AD!*fn5= zC+yY-5)uJGLZT;-(A*zLNDK!O5>Y@xA{9tT%m)$@1wcaLRUjepA&`*x5=cnUhM|!7 z9!N<12_z)00|^P95Mx1ar5Ug2*D&$LB$sZIY70h8d@;=xV-tslj{bDy zys-8U2De?DoU(jP^9T71zNsaY&}trYI@qOOO2!6&u)7bZP4;10c!h_WFgg$9*0o|3 zoPq-Ix|a-_m0p!I<+&GtA-=+10PXWCdjX3Gx1@aI0ONM2Nw*dZxSY&>Qbr$T$Dop|PuH>@tIv8|!MJ|pviYYmxd`5(KC?h;Us@E)OW~XyR(=da z9m&R1ZT_D}jca+`w49rDDlxR61_~;&y;44x2e4tD0!q*29sSf~&21#SA(AN)0 zG{{GRgv3N3AwdURghU3Akf6>?NKm+`HFBFX$n@nhg4YD##J{hzv$6v*^ zoRzobE>h;?ZMhwAx6%}8NrM$)qqvZ56*uNyLy~K6_AR3yPQgFmY@dD0fbuw7;eQM# z&ZhVuPAIFHT}r?3>#WXevUmttUB~FuUR<21WiHGT!Qkcw^d)nkh&xAK3o1_!;JoU_ zEU>eOXhB4g1fqO4%(4Myw8TUBf}9U96^SXk=Z4*4%?kHe%2N^bAy&tly^Zp!*vfs2 zZNZNPFVhP~z=EAou?LBYsn8d`4b5^B7Ja z*gcE06fcAXRk~T$p%`Emt7`&|CjM;7dmsH39dG2&G3DK&GyY;YvJ`(r8sxEw1|ROV z6(@7#$(w#6%xK>a8-41&pAwbb;1PO4-6%Z*B-+U^AkjLg5C4KwmjHdm=w+Zyj0VHC za$5un0UZ+^Akv9D%RqETSM0k5Gwn^#rZZXtBxLsh32VOqP3F{pRKBXvAo!X9ZDoBO z@F^sEsHx+Dc5o{73nDKxH59T7fP}>RKqdGyO6%3s-D)Z|Pk$QZo5+u>(zZT2goG)w z-y>Wnc+F*ZomFZM!r0WHdq&FhY^L=~-vLo(Fs?B?f7AL$>zX!}HqE|?VU8Z&^+)zg z>C8+vy$e8nz;_K(&`YTlx-pY|(@#(yB&mf=p`8ikk>6R_H*q79zIH)c*%R3}Yl^R- z^mRh^O=L`ctk<4>6ZhIw+5Xu#kry>JDElT>O=@b(?3?w(SJv#mfiz~{tPh$g?4oNI zyp~hm#gtzS9-$#1)Gi)nq+{8=?S-|GZ-mDxeBxY*%a@%-TcKH?*b6sPi(%){!(Vg~ z48@QN!u`3fl#02CU_c-Y5*4$-tzsxlIU1NByPepN%mU4h9j-{cz^%8w$_WnQY5L^q7Y`>=_{kZ%4kWa+#rIuI z>w!<9r6159rbXaW$kL9yNToi<50A*Br|A-WPIjcFcokM7)Dw-9JxO?q=;W!zD18k* z4>N^Z9X%|LJ3I0*ts6A7QrAk`kVK}VcT@1%F;V@LypZN*u8Xuv$h(T7QTq$+9pA@^ zvwB>|mg29G3DrIgGLQhDuz~%O<#gav`OaTyh>64uvkRuucom=_JJU!973K}g?oI#C zQBG!-x`u7})$D!05(pSA6db`--g~*3B z?~t<>7|RdwDa1;jj7)(st%p;zmN`Vvg?9k0UXAX8zZIfNbCd>)8)%R^k9%tssrx{zK4JWUvHpbP7PO6Y3Ey{P6HBJ zXrUlvR{=fD5}ScUV>$*D2RlZIj*tny8$cbHueRFg0)Q;cM+cnxaB6QLAwi1=VK?+K zeh-EE?D`r$#fxK=TRLpR)4lX8A0AnEowSvNLmOVDf+L#0;eTp-nYf>`m@&`bMdwL( z`*X5D#Vk0C=G#?+_r&ot9Y<^~V*o}o@qo)%k&b1s+Y>IA%0lIq6ppqjKjC6?edG3o zOG`ZA;(Q>S0>Kh;ysQq6&BvP755e$wrfJAd=Qvu`vRDVRRCo;uP6AAmL!T9U(h- z6m?_c)KJ}xF-q5epehim$^+6vQ%&nFzWodt*hetn_DKzTrf?y#pbU{T#E6wq?v{*j zw5oVnm8JMN^vV<7eI=opStKHQ1Z_x?r_}p`%elyK%a;%GjnZi zPUnY7@-C4k9C*&eD;jZIhWPA;T{Ntv+UVxjHz4rI4%%HYnC5>;40wnkbm4#q+^s}I z$LLIbaw;oDtFPv|QTi&l$ji!#!DhI?Bc-Wmr=^%qP2uFjF3xXU&KXidF=P!qA7?4R zX$u@K&f1Mpl*V)#_tCG29)Y@aY+&r?R}?C}5tSpOlX@5!J3($kLPi6{E1bQuDql-4 zxveQmE3Yom-Sc??SBV|ov6720EtV@QXU8}ke21*Gn44Z>AQ2hufkb3XRcUj9USPh3 zYU(l|3;v8!5k3bpqJ4!4jI?q43DA<5Mt2mcks76!fd(<6dxjQ9^c)GDAuvkxEV0PT z5g;W>$MDN5tgaDg1V?qROH{^{K^0vAZCWR*aD`Xo67elN3}Fzz){la0ihCuP@;V|b zRC)0f=b8MVKcb8Sj3$R_fMNUYI+?}&Ybd}Q1GLBz;d-1ig){U@BMaPRDej6)Sq*2z zZB_0V=;$&!g~IT=6j*Txs)~(;qDGx2%U6cR^}qSzUgO1(TH6q{gWBC-lxCrKmIuQu+Xv z;88C$3NKQj0Ho!tQEGwDd=7*_AQ1@tfkYsn%a#^#Dvg99HAYRH2_!;s3lPz9uo0hv zkMF^nrg9GeiBwt|i$I+KBm(tGph2wVSs)7|S`Z7g4ycgz=?|iaoYEu_uU<(E zF!RDx9l>TP3sW0yui1y_#5+w@%2` zU1!h>^7}t6#YXg9a%IZ1JGVQZc(mXY3PE@GaTmE=_RXxm)ukEj)yl62VfWdW*bx%1 zRD7QVw_1vufXB2O-KOa0*$qmW7l3 zur=evX#FBj2W*AIs^k4X>??W@9I@I7>d|`m>CGyHO-0CAdsv{>$ITKQdsvI=WFTjI zO`G93RWDXks9sqSI(BPe18k@nF+UxWTEYVW>!rgT>&ZaiWoyn|^bqgUm%>MVEyZ>! ze9>0aV;o*9KpCLngjZ_rmX)&G3Tk17f(lU0iqhh)GZa^lX=sOE6*+nQ}=c~#F8gFRHiKXTQ{7uI#mfysiZK5V`r$yj5+y-d=Ct8vnNVEYu z%-tD(VvrE2-{SiLmN)?>v^rulcUF&WlJJiz9xZ}JzRS=V6lukDXKlrKSU9c7iI#{PD2+n($%Jb zNR_J}&)8yTg*zLrdQ;t@VmAU&ZMKFS$5~R|3>^}WeMxH|2C&E`*1~~4+`}XzX<>b9 zITndyF-{C@5`k`Fs5NJsSs6zV_}YxG0W8V!Wo=^3*<$ASwi=F-`AVBAXTXm$fcL$S z6VO<0pwvR|Y#c4K`p0eEgYmE?kzC{a<(U#1V;3dDNxP*ufXXRahZ5x4MAMD~HTiF_ zV);-Oo`!u6-@_Mnww0HtTR6l+E2e={Sal6g-3Wi8qdaEWOglH#vnd|!h28Obt0Aemk-bg1bX)+T+h;|$K&W|gw_(mAcM#GG9=X`XtGV3 z(C8|(xINUUg$({#6caals=_Zgf68XCEG)4UPekWK1G$(vz=2SNDy}A<0Yx1tOMkkf z;;MnE##;WdFLz}a1W}SM*%8$F^Y`Q-T^HZ zQ}}LnoEYw9BNWRtmMI}X2Vv0@xvdqg${P?;f2 z%c-0_$H3H%#4W}B{!N5u9Q=bDjOgaKmH~Pe=V27d$ZwGqXccJmZ(2*vQnhO-p5-$M>Ep(rrmNiD{9MA|(y#*vBYT>)!YYsG;Q)vrLq|)xRNSzCm z$XW{2)K`JV;t$gxd2Q?LQV$)1kfqmL z#IdyzK%(BJsHu5C37q{T@h6-O7Ptn6D8=0il`R!z^-7^E5hCgEx7qsgJ3t zJ`Mb&2C;Rd2BT|B4Z7Eo8a(e$JF)zpWBQ*i3;qm{SCAjj+e~YU*HJfgHk2B6Zy+_i zTr(0x-o&Np+&tzW3N3_{Ybk)xB@pR)pJ}c9d?mkF+^fQ+NKmTa!zeE!(k>kIrT zS7o|CL83uwC9^1csVtg(&4SQNI%%1$T$Sl19@2|S{;%>(dM~55P_D{!Z$jdKn`hGL z#NLE*Ri<|<>-DKqRjQL#sH3rJrp%JkC=P^&ei zv{Y+?o60BG{ClKi~AhzH^>iw=pFry+tse+GuClJMf zkRYxi{3%yux~prtPY>fay(<#;(ki}rz)t1{iR=_u#>Kf^gEip0Hi3kl+ybRXRf zg>IO4&k5D7$cf&9&`UZU_t8uJg@{&n@7+tU@CE5ix{uygs$TM#Qh)c-E9#GQy6&U* zVOcNwE{YA*p#)#M+n{(5K53vLif3Vi^wT^+xhkv2PO=T;R5wabT7bXAXVXe#pk%vY8N#~#U z(Mz}DF=AHtm8!3;a)PvXq!0O;f&YbP1tQN<`-W!+){zFH!~_0QUFy4|hSbwpQ|g8> zw*$s?V=T1>O_Lc|$OovX9gxsO_71q^vND@7a_Lcf6Mv~QQZl#}z@1m9kBI~n-CM>z? z`81&sJJqiX$%$Y75lE~tgk&a228krIMcItLh=WGV7%#I^s^BBP2}FJq62$ct{*+6k zlTS3=`9in3s$@Q0U-JJ?1IcekL&;r|^a*}y+X6KK5|X5!*6qqA()Bh9g$V!QT@6Em6I~H*}Fbx|-lmlCIC+D%lpiT+tRJ z6g&D_)hr4-WTOp*fP9H`y&XCmpp8|EUOkVHBj*Ucr1P8m=>3fK`qZi_)xu5lS|j~Z zt4*mINg0{s*4Ad>yJ#^2p|nzwki?HS)tg`EVy%NUwyCK`% z9ItgrK$W0W!AB(#hzcPjNbiXI=-w`LSMimqoc3eAip0Hi3kl*n;Wpo?EZ=*CZaKe- zUaAMJY+CMxUebB(K6($xdZ7t-F(7N`7g^RAtq*h>XbBZ2T`GOCT!CpCUI@ z`>~?&DiV|`_{g6EQDg}T;-c1|T$SlQrz@$VmrAPH*DMIVq?1abT$Sm)!g_ti)|AF# z1RQy~x)gzvTJd@tk`{=Iwf5`0s#lbT92cT%h)HGN{zR7b2cF`d%VqSIzgOixdYN=itN35u77rI?eV zoiXu_SaVE5YCLRbBsd)%&8g|rqudBl39_5N^H^oecD;&wr1m~W@V`XE@_YE=HzDajvD&ENvcbA7w_d(i2jWNd*aX z4GIpDY{@gC6BA<1vi6uXN3@f8oC!$|b35?OH1{{RNlc9GXjamYA*2baxxHc_dYS_n zi*Yz&)6IzqNeKu+p@%XbMX5rT6D!8kdnCgXR(|`))SN^(1MOiB_eAG+K3HS1H-95IfB8A?i; zBML1Pbw|MjcR3x&R3jdtma1dqFw00qXgQ)dLQoDVj-yLyTB-}s+^B&?Pfc`i=m|R_ zXw4L~YK@Ds1-aQyiHmbk-cYo3VJJ#4i9nR}xze(4j&;O9v)PfBmXbydJ|kVVpOPkr zR*)2#hMtK_Z>C&v0VL7d%<+!I#FUQa=-60lO7}7Z?qsJq-I3^sp$bz9&DB-0wWepJ zrlzD3n;iC{wX%QY6tzKcR)VBqj%g{*1d0VErLTEHn=aimCrO&NX=y1LsniDVRd*Fx zx%QygoE%Nj$MVQ=dOOnGUP6)GQ`7`>BF+@E8a{~$=}z~$(z+yesVH3dpfGFa!GpuB zniY%yY-UU{RHaNyPIwA=7)Ci6LIt5fPnLUV@;p@xD^x2cnmP+}j3dpN5SKs=MRLRD zc8IKm;BH5heNT>R%Ad?O% z4>Pe95-5hLh+^1h$3d%FJ#MoBv=2nBxf2beWHr$-Ejnfvce5xhYfo|@&w2}5A=4}N zRq~LR7>yjLO*csHL`U(6PmMxL(^Y|JY@(~8R?JOWbik^sMU!(=Akx(a<(4u`?IF3T zp(jk^#t=O%&EZHwT`C!)F~*|Cx#A86q7I|NR%pJ_}4@l z?+0;=T4_j8LexyNG)Fq7qRHr`QqtT8-}E496gPbyFYghAaZ%K|qhhA&3PnvbDwunz zbeiF2Bw~DbqD4eGqSF#*Ntn^Ghjpz617tEsa$-U>Mze01Bf4d{BhS>j26a>V1c_#D z^qr<`YP1ERnJ0Hbdv%vZGl_F@G-0lSX-jHaN({A@9!FLI&{r#YU?aHKmax`p}55*^7gX|qykQm1zO@BoIqn0TsbOtRE+ ziri5-xfNkZoXWFobQ#fF4k}fsW}(tl)obo^1h?F$Q)r4J+=JuZi5N}XWuj+bfkM-7 z%oa(j-0a=vZ-`HcVEJq z#X_`_#jSKtC#zvtY5qCHl-&m5b*$v$9AYb=O-6h28>T2cwm4B?=3dzDn1%6EF0jJP zMHDoxX(l^n!jEF^CZ};|fXE$*vS)>LQLKBvC=X&$V&W;!ohx>m-0l&H=oIiNI)#cn zYQvm&jzlm zfA#75=R5!LZCDTU6MiSVNYPodVopB$#Q4#<%TCq)=lzxa#}3KPJ6?F`uee~-$uU>T zFXUDKXUv&1b9dOAJb7XE)(0lNv;Wqp-NW~ED!I=TfJ>KlZKYzTiYH6eSw-1!mzw+JAf`N?#`XBrD&wW|( zb+_IecD{3slD*4cU$VSt?aTjq-|FJAt6!D89CEB{4qN8 zXzj6?Rcfuhy4|*9_WB1#%xZQtq52PpKe^Z->9Gwl)qX!+-f3fZCH*=7j^%yQMy;H^ zEp~LvrzT%HJYmPzE7slpJmjU%c82}<)mtBIEB))&qYHg<`@KJ~dC=^rDCx^djr`a5 z@AK*Ku@7zC)VOC+hhOV8@O|Zc%^K@|In%VohlbIsO6Q(xd(wR1HHY)vlXWjIuWr11 zx82v(-yhuWrL)hMEWPpPZ`r;3z0vZ-inD3mzG-{$vU9-3_|&~s2kseYeR5UM#AokZ zC~8*RZFP-Bk6YHX{cca#xP*)!Yu<5oI5ey2u(uDr9dzrx>#GdAyKabXbzttIS{t(4 zE*_fOdh`2FG^@F@{e%+B-v?$bdOvOV+IB|k<&vSRwoUBy%uDlMbG

v-H)cpI=iW zdid?pA&!!FdL@r|zvbtDeZHvoky)SpIB#aoj|-~a>Frv6XM4*fSDx+}bo|W1FLo^G zzxK5sU$t%B`+L}~^M_j;=@xr+rEOQpoa3FUHT!VV!I<}+?pidzpkD5yiu~8*rw1)9 z+&=F@qamBKI&9vW-+B2{(bof~4Qu^e?6yZz$F*o&X1G4-hGW2=V>*^hd&FfJ)qay- zpAHYaYfL-wTEm0&o^SEeyOTm+u2nQ^MEJ$*5$ETee{)HTJ$qko@lBP_errE9r%k{o zd&;hl{=4nRA5C7_sb1OPmC}R#?uPE@ec-vvf1Iyzaom9?pO}$Y@YK2y8-L2${^#){ z6W%?PHN0=k#mn)gy0<#7d^CC5wCS5)czgcuYnPt8Zg@LlNQeI0-g>AoTnb3(*sEwx za`~t=dvCvWx_EbRgIHf%*R034{XV(L1;2y8Cm;X*VB75Q&13R4M}j_fF3 z@cQojfbYI`+?ihO(+#bym-D)sMo7dx^}A07M2U*~eq_Rl=Ec3HEZU)j@PQAo=V{@J!H*}vyI zuNC-yoY<|bNBeHApMLt1GOl=yW4b$66K zniDf`=ubW?BTc8f9=j4z`myihw#9i@UwbX7#S_a1{7YE`)ZozFkp(W~Um z!M8h)?=>@{`n&6jZtuSN`Sp4`Pxg6nPh!{jjkmA7y0-MgU%K=*O>6qh((3JJ9UngI z`u_09Z{O_Q<#=G7sKPG8>%Y0Yc4o)oRtGyyniakC()&N;=dJJS-0|zIl%-3eKfb)Y z|3jlX9ZK7|{*3*tsxAL=Ia~jB%CW0By6eFfDZ{L-Y92mZ@Jh_epWidT`d!R(E0U^P z)%38E?kOO;pXKVKS_G)?$~*EZ*+(~^7yA8jyOI2 zY{}mR(>kvFu+F1(+Wm0uyDn=^kLkK*<@KnYANddL*ki!QV~f|<$^7K?2WoE&?w{}A~-Ml)vZ~NDpo6x#NzVl4qwL=#gU8E|7_@z6&3hbCu?ycm1M_}%G<&Bnj} z^GNIEdmp-W`}Hqk*Q_(0u2OsAwztE+n=z<|WAM6>*>9z6n;v-P*X8FTI^VUNxoki6 zQ2SF&eyg%5wr$6Z)25vxr@!Mnpw?sO=I4wa{$NaL+)>lGeeKT&E&4XTtmTAOV-AmQ zQ*wHK>GS)_>;HB9g%#5$PncG{cJ+^rH@Y_Dcu3;y>}_vmZl53>_`BJXtM5sv3lF}X zQvT(FC)>=*>9scJK*W{e!dmkt8;|#B+&{i>(zj6;PyM-naN#?~Fr)7`HLHJG@5}x_ zw3(UNs`k>l(|T`z#&l=#BTqGGH}zrZ;@RTr=?hwX*7s_X{Xf6H7F;ml%0B_Khh3H) zvhLrqdfCv^*|mqY+fjAuyvDU|k9OAkuFkx!jeq*gI_%e$mya!Za?swj%UU%b{d=1N zsp`@lw}U^sb>NTr|4iIxO+EW?;77w^&b)JX!LHoz>Kv;Zdv?~$m&W{Dl3S9zuvzmn zdz#wzO*oqNY@bQBvX0d<`SzP^y5+Y!qt2&ICvOP)q;1b6)70m(KKN|2so~B$-G^*H zweL`sRY849=S{gWCu{G?m|vZ9x0PLfWOc#x{y&|Wc<$~OCFAqsej9fn_SY{4oQOZ% z{mE&ToX698-58SE{QaLN6?{DDmC|Z^9(MNo`}cYuM&3Miq*nJ1&oBJ>)ZKaY%{Lp@ zztkgp)|sy79$hp4gL5|)?O(U`{Mml977Tv&r_0~RGh$rwlP)nlZR_?mIu^eihPlk}c_tW%J)J{Brk`X`2iBtRB*Tee84FM+D5Bu(W(` z&rQ|Wz3CIs!P)%94|2mwTa{F8cz5TXXM4U-|9MkN$Hd-C{3C3^EzYf2=5LcOFZ|u~ z@{h4y|1tl3&9bTf>HHS9?sfhXfBVE&x1M-rJ*X!97d` z7k(P@-73SSaq%D2_V&b%$4!}c4{)ngQ$3Fyn z^3d@~gAd(qZwl1nNBde&9`c;QhmJFmo+}^QANJ&-g9C^b1P#^7riQCO@Z_N*IR+m( zgh6QkKV@(jzUb<`9`n#~4;(m?%BEKf^yI;jH0Yrl{FLW4Bgezt74=X}8hq%0Oej#* z5lc=89$E*d#DK(?84(MI?s`z@-Sc|u77t3Q z2W7bjWs?Wxm6}dQQz>Q|lyFs3DR!BH!_;ycoFP+cs+3n`N-dT0l}xFj zQjW=#+A8I5nNnS))T7}Jmr142yQ%1Epi)N3lzJ*9Q>N5aDJx`39hI_Grqov{^zJfo zDYbJ;M@e!d#iY{dTfT@Vz&@;N&z_QW8~LV?H4p{g#n1l{r7BT+5#ql=xmvFwmLk!BucZ@m?rYL%=k0t zY_%c^`w&2?y6DiW{;KD#vJ~^^Y(2zMlohJw-PU%GX;MkD6!Yk8wPq>dTfBn#XrCdP z)Dl^Wd33e{bhd)ya+YdRMY0t0=xnuNDaD5YZ_T@)Ngb1=m`7);ti)eq!VPnpAsPig|Rl+Od@4!#~4&ZPTQN%Tmmvv(=uZs9bc7Eqd73 zPpz*ES&DgdwmN`Ui^E@U{T8K3eJV>akIq&gONlm)pUSrG9nt#}%MAGXuSVJDp}e{;>-n$%QTig|Rlg7mhw`%lxPUYDhqM^~=SETzOou>ZP0 zG%4j_Bj(ZB>Y}qXX8VS&np7jXLYPNqi^dHR8vxRp9xE{zDLvarS&DgdwrGUZ>Z>UH z*a}T*fh@&5I$Ja%8GOw6^ub?F)`+Q9Ra?cf6!Yk8(HO4TGQ>_EuSu23Qp}^XMI)Oi z7uhQ7xDmggt(5D*x**|V9-S>3)HPd|)@60pq=v{+%%ihKPcCO zd33gV>ukL>=`Xh&z9vgCkIoj2{F<%5KDzd$W^0cu#XLG&eRZ~Wt=+LkllohhVji8X z5S^{gzB4e?DL!mf4~e*#M`x=asG1M|`g!0nO)5f`Vji8X{wzh+Nj~f_?uCY$)GS$w zd33f0=xo_qwVk9%t&*jfM`!C1ovmR-o2qM4-^o(Uqq7yNvsLw}KUQc`cVsE%(b=-- zY&DF1~Y6m?aT%9f>=M`tTc zXDf01wL6;BN3s<2=xl|vl+yQ>R(WTjCUsPnVji8X!8%(L48OglNmZfA3oho-*%|_> z7V{_P1Y%OC#9>!iig|RltSqIBU(;MiUeKf_$x_Utvt?r`B@XrVRUk_-kIvSkI$MAD zOy8v0`a+gs9-XbBsx1I%O>Ui%T57pY%2Lduvt`%W>N9`cF-@utP04XFkIq&Es0JT1 zed4cQ>^o0uQhjA9=F!<2M*Ql0{+CY=Owgp_Whv&-*&5DLX8Ocm`S-QwX;LrAQp}^X z70FUceKqd=_YqBsp3S9;d33f$fU3>0zmNY7FQ8FkGhWGUv+*_yyoN?ZQ> zwPzb^QZ8AFd33fW>TF#bTEnfr*2z-Lqq8-MrOf!G%Xzx`k9gUV_#z#XrI<%&Yce>r z_I0|}s~>ApcVsE%(bh)!9_Xph;O|Ddy4H zie@S5jJPd-)S;dx<&dSAM`vrQ&Q{Fvht6qIE?J6sbhctxN*TXaEuDmoJjI8f$x_Ut zvlXke<@mJz5KZbwS&Dgdwj3;_lxsyBXQ(E1N0wq9ovk>Xt)G$?Cuvfxn<5bx^XP0% z16Avz3LX!;t4Y~pDdy4Hif1V$=1(p8ptUBIB1*AW{!ZoQ)vJ~^^Y)xmW0Q$t=+HW5|t4W=drI<%&D^X{waAVtQnpCw1kcf+UbheT} zHTan66MxHG4eDxAon$HI(b-BSes%mRIvR3ClNu#UF^|qx3QH;d#;FnG@w?wj9L|!Z zm`7(TRcCAIyPwBuQY&RC=F!=DQndvj6+XBmA20JEh^s`FVji8XG^A?f8gTu~@tV|m zS&Dgdw$fROVxF$-$9sOzK(*DNnV>R{&XyAinytN!{F`c017s=Y(b>viDW!eo?f&8q zO=_Af#XLG&Gjz5>3r@Duq@I_hm`7)8rp{L9#wXp%wON*89-XaBovoW+uWhN>IwMOl zkIvRCmQrG4P0ae2HL3d4b>U(jovo)p)qFVd8yDfRWi z@KgIWsfDr>^XP0ntFv`|QSaKC)OuNpd33g()0J!S4;Mbrq)y9H%%iilSZAwnWu%WL zRnLq>T+E}hwFK1vkG(e!kD}<>#yccHSOc=-Hb4+W!9WNC0-4FoBr}PA%Qjt>!j*xttE-;6WbvU^mrvo#<9dvBu@J%5BdoT{9gxiNF|5 z*T0Y|t`pJuS$A$;+{v>vp6jCeYl5 z!b^|!$TQ>}40srpgA@4yzs)q(9XOGgKqD`O`d_;gD3-sMNF_`&j?R-Q^h2bq&{FL8 znB56XVuF*P2t^qmVW1WqT;Gr^!sz)~f)w2QL==SA%9=f+SVnJ=N*JAW7g7=v`iaxV zvyTN|P^^)XMHroRH?w+3)|0CP`xR@ZWD!PZ-NUR-l9kl4u!UkhBw2*fSxcEEoulz& z;tepdW>Utxl0_JubuY7I2Qd1(pF?I%7QZ|Y=Lw^;?qk+*I8u23_TN5ItdV_0Dq(ci z{YX)^+TW9ZP_d>+7GZSO1I%iNBZUF=H-D>GizVv;oY7eiA|)}wELZjOr|wp)XC;d; zI_n{3W#LGnv}jgW#o8lTgwa_KBPB5*jVK5&d~_7f*{s8UvbzvQXFY-x+n}0`&gyx4#^^n&U%blt#G7JR9gCkVr`Qw!sx8Wk&>9ujVK6j z7Ys(HG0U|_vIwKIAR4UBL_t`4!@pN6R@c5Fl`uMM8B!7xdW+M>jP|Joish0l!sx6g znPs-}UA=EWXEJkmnPd@0XFbKNo;XrinDy@@#aba*gwa_~BPB7xWHoPgJ_dhN*KWxo zjLurlEYkxV7`!Y~vHF~XlL&;-S#U|vB@NCP^}v{aE7sYPMHrp6f>|`4QrMaF1O_xS zhYKW&Fgj}`QdBGd`NmskE7mf}B8<*@mRV+doiy@!KuleqNETsq)^p4SuwJFOJ^!wrIJM$o%JHK%=W5Znl?zW z?v*UU=&V)D>VhMMyY9>Cu2}C&7GZSOOGrsffC3IPPfveEv5rURe^acbl0_Ju^)gaa4zGXb z-!>n$O|l51vru>&E3t6mLrPbhQ*jc3Fggo`2TOK8qh$8MWW_p5vIwKI)-lWM%P%jV zby%?~B#SUQYdy0D;z;4m=e}yISj#1gFgj}kQk2L3qUr*h_5LbZgwa_WnPs-}{%2MK zV)n1TvMUfqXT7Gep8NH}GZd>tvIwKIHZcoB9fxz~b$ea0?vgCR=&a31QU36v+1H@x zW)9zwEW+q4hz9E<94TCxGxjva`ctw9qqE*XN@7AQq9B~{((zX-)?i4WKp3611u2OM z8FUiir)U4QK(UG?i!eItO{63yj3Nrc;^(j4saW?(7GZSOTS!SvK+|%#_m-|M#rjCH z2&1#!MoMDBiGpOL`8J?&%sOm!x=1FB&U%Mg!zAlq%9&p(R+eNDMrXatEK^s`ySF~3 zSeHr`VRY73W|mf63C2Y0trtScmoFgoi)W|^bIUC-@*K(U^Y zEW+rl?HcROzuRXk*1si-FgoiaX31%mv2ECHOvFsvNRfjEVRY8V%yQsJVOiLL0pDc# zC5tdR>l37?URm|k&=(bJp=1$8XYF7XhB^*64Y|$cZPrN^VRRO{6Lg&-NXE8L2R*EG z{VZ98(OI7|%WSWMzx*^tu~MOz0%3I4XGlp*=tUduX7l4Ei!eItbEG6DIB=ve z;pYlK%sN~sS%lG9Fgvh%5(Qz=>b>_X)&|KUjLt&W1*;EH5N5pm_Z-FAFIj}qS^q|g zT8(ag`TKxk4M-zNhCvve^%YW7PkC(SmoOi*Tt$*a7@f6?SzU0XaB6bJFvVITS-WsX zXZ;5$Y7X%EZ7VSDo4Phh7GZSO*UajRBZXHtUyP9LF6ciyE~zepBgbk>i|g0tW-vL+D%%pCR}B2o#XvvwmTF+mD7 zrtNRBQL)aJEW+q4R2f*kainnb*7f@p>judpjLzDFl*EMAL_zrBrD`C}9KIo0gwa_) zBPB6G4j#sk;ma@xo2;)Ti!eIt7iM+EkwR&wwzj_9HC?0tBA! zB8<-3%Ph0z>qkzqS=3y~B8<-3$1Lgij7fu9bs~fa&q)?xbQUTaIW)@^_+#WM#rj#Y z2&1!pWmXFuIcyoYRk2PUDiR5!vwlO0>dRS6u3e~DXG#`fbk^_8GW+s2&1zOFzZYlDNOnI_hS|7OUWXP&iWH6i3z6?1>vp!BLOjM zzGH?+C5+BGh!nMIn@~RU0>uhQ7GZSOA!a#nq%bG+Cpwd`>u+YshB4NZjD20Pu9Lb5qqFLnH2_BnJARJbr&wzxi!eHiZmdK0qpD%J_o&DjLu4C76vU2|L$|y8pXOuvIwKI zT4}5=k3O(dvF?&A!sx8l%<3X_-Tq!AOR+wZEW+rlHq1(wtX02M=P1_Sl0_Ju)s|T& zN!C5TU++?^j1eN4FgmN9#;U(^udQ5_l0_Ju)t*^q9S%r&e2midlw=V`XQeQ!x6I+t zVSN@T)_0Oc7@bA`h*N9WQ$M)6K(YFa6v7CjvpO=Xr_}X%y>FUgO_D6a=&a+I)lIU# zeB+dA#abj;gwa`@m}S=d_g%XDtynKh7GZQ&XJ&b%u3sjP?xk3JC5tdRi(jHu z-1R=i>VK9HMi`w%Z>(4U=xO!zJC7^YM9CtI&g#Z2IW0B{&g?Q-vF1t^VRTk^X31f| zxN7JQNKzSVRTkcW;tXX9@x`jz0x&clt?Cw&f*uw z@qgb4(KS2!YsH!-S%lG9C$KI!Tn?YzdL1UzX1V?)S%lG9Co;?Qz30FB*HOh;)U{i(2&1!3W)>=r!{Kf{-&3qMqeUuVbe4lzX1NxW_j**Z+>%8Y zoz;t3J*2MZUryPkSmlyM7@gIdS!Pce`c6+wJk4_5C0T^gS$&vgj+G@Vdbkv8yJQhY zXQeW0pv>W`-kEPG)^CzU7@gIZS)CSJ}!Kt6%$E%Wghwwjl_;(gn|euU1V>OzW|! zTz~w8N?mt#A(~L3?3F_Nsi;@HY^7m91s>Kq19qbx*=^6be5yC3YESi!1Brg{w;e*Z zQBqVXo~jHR6t;+`gWBzpax0$EX+C$_E&@*_wO;g~SAcw&r+Bb1WwgBTvJ$-#D@*V& z>Z$l^dpRCsjtAvx0_5{+=@G&eXvQcj6lcw6l#1F!A21(`Z_lEDiXt=tsG8)G*@cxg zy2S}u3L+mHjR)$+!-*bjzDhzp{xnWG@wC^X#>_z|Zu-jzVk^L`E88=Rgy zS?Wv5F4WVuwaklF6lP%xqPk|^&CfuO1LrPQSu>@)tcai4E?;G%A^BZG^muohtJeTB z^Zdx)0_#-@vBk4qNnk%E>Lu|yJ>Tm-Owr-db)l4)>$H|NN>Jcpx7Sz97nwN#v>(F7;e00>|1%2wr#y$MZ76UJcvIEWW9wzytl`u#{PC0 zTSkTK2A+X!xm5e>Wt2?mPDGy*Ps*NBQGA(Ax_V#S;aH=Lj}~2{sc0cP)_@w5-Bh%Y9cx65$!;pT zfy$0rmo!k#(Wr(p8jTZG8=J*woRAl5jnOzE@7OpYFV+g<%R4qs$QvB%?&Aw=0x-5Y zv~^%?JLsol>9MaHjg=7xBT5!qFm2%}B^?VTWW{!*c(RU#60&0be>_>oLJ3*1oiLuP zW1)nsSc{G)>sTluE7qFh$vPHF$cnY(c(RU#60+hLaXewigvFYwcuA%Hey><#jf;vA z*3ec*jJyVcqO^9~ZV)QmPm`ds4sB!RF{Ik3d<{Z{RQoKhL8!=Ulb}MXy%!xrYLlQs zs=YrQLu!+tLaM!I9Ybo9pbeN+-2JfzEGs@%WH;7g;-ed~ulQ&oJJxREqlN6Iq8q4? zczb~j)JI%sjMzrD4`bvuhK;S~#?Z0#+!#8xo*P5Q)^lTMA=}ROvT=B3W`WyTkmmL}^Mcu~{9taL)7p~F%-~Jl%=FBR%v5)F zF@O0fT7^R{evZgY_2gS;oraX=b33#Ap0F#JpXGFeK4d(up;l!MDVsU9B6CQnrmCz6 zU*2c7tS)%GBfBh6_Ql815RJSla=es^EWlyX7%};p`bS_ke8G1RC_UE$xZXt zl1pJBbj5Q0Vlmc8}G}_%qW{#SyP>vL63r`AEIij6vyLqdvbH! zzFe;}o8F$AnGqfv$jk_M&(F*V<$Jsendi*Oc6&UzK93Dq;0^n{sCZW}E+_2thrQk` zSB}q#hRqX=E3Rb5-H24$+)i&O%NNM@GXvMl%J61bh4VWDUSF0kE9}#7 zc>Q)}Mqv$J#yS&p3!dl9^18gqjoQt(Fa%nW%K zgUAF6ADlTfJ#(nV^tzql?650408{mgSCD3Am^sHgbNNyrrOYUiR-a*UJuau;AISCR zLVh#fBlvuCJAkkk7%ZqAoj}_OXcqOl`4YLByY;P#fTHxuGCC!>StCCf;BzJqNrKTQ0jNxJsLUayheIdHMM{dAX{K$SPJH$sKUIz1eQB zFE7hh#5gJ7vx79C zrwzRnQH;ZKKts9Eq`7cbVW-NHxac0&(zBg;p1ho}I~+RzM)8%7fHM%tap#A8IZk9Q zGlTDt$jo3ZX06dogQpyvLwBylcIP=g*#Q>}+v7w7MX`Cp63wL%wHot**_IGE9?TNL zZWlFQqqh+#O3>-f_GDwo$#Z($9$)6*>}(vPb4?kDn{U)?D3FK22Q@W*CR|O$w3)aC z5CzD?U7N)@vny&U#jvjoCJPUl??)+R-VL5IBruNaYOU-N5jYUKaX8GWA z^1^T<%ARy>)DGl@Ef&;as+Jqh$&Kwi_I)5l2suM8kI$c-n++SX`j_h285L8-Oh`Ec zPso{*=k-Q8D(F&Q=$JLaKFc>~_;ynHB( z$GD`dx)d{>%nX{5S(;!C`R<%hewNSc6h*fAU(AV$D`sGP$F13_Wifva=7h4m9yHRF zLTVqrL&xN0$lFAfid>9mo_tq0-xsSwzLp*yLQPh&Ci1%jE?*FhsmsQgP+nGrGEg;( zMFlmfr3&?iX?=D$5Dwbyr>wFR6^EAR*$*s;-7c-7guAl%Ss0B1p>S5dM;5KTWLjYn z25OqqVD3egkFmN0HL0?j<#+l#0pu4Wgq~g1N~-oS28XM@p`40*43_Ta`6(Btt2^77o8-O1sOx#akL9a&;`4d6EL1f#>}RQOSqG$ETVU~-I!>=XiefVr;(V*`28r98w0c? z(S4fnN<^beo;%>l&Gp5pZS(F@VaDzad$O|gvjfht zJp9PXx_$ow<3oNB z6^78_nsR09n0)xL_{`4p*>?rF`$qX(r3Qm;RyZ$|=cj%JLnXgeURFr+;~}(ZVXq80 zQ;V48bLRM5?))q)>3AWJL1Kt>M#=-IK@HRP{IEYaFV~xkA!=sk2wvuE;xo!ira~?E z<#Jo|=U}OdWmYiTYg<(}TB;1cC(D(an~gPB!R(pSRHlPyWf#o}F?^d7E^cQOE&kYr zeisacbNu

P>&`h+3Rcx2daH{nT1hn$DRX)%uUACzBpe+-JUj{rlbC-f^H|%^l18cy5Y+X7||U zwl}T)KG^Ze9?xwL=Kb?b`x!&d|NUvN^#vc~+&tKoIlqa0A`Ro@3gv%>Gh886uw|KD zbb24W{G?cZNKB7N6Yju6RrzsY#mk8s|HX5vS?B#gO94idQg%z_bIlkXrGO>g@-_{B z?5QEN23d<|v-ZSfoX5)Ncn)dDv+MG?@$z{Ro#PSd+{W@bpmsbnE}xqqp95;gbI|g+ zN%A?Mc03X-pPMY718Pqkfpc0|k^ zA3Cl`6^;uMp35eA%1bYd!RCNDtZY01|6+IGvL`Tjg*))R6qpw4#lItXLVr}+`94ne zx_ADBr^;V@@YH_i{`#Jj_obcZs!Kb6sqPMZOb|Shmv$cLE2Ug?2R?A8TmV@z6)y1L z(V?mExZ8A*Xx_jFQh8xKg@u6d+>wPttP}2(;~qSKGz~uGHhs=a1pI56;KmfC zBY05!J`s78z$Y@d8u(P&dA7Qga>Si-STgy~xJ^eq0coQLK?M#l?oRj4GvFTar0k^V zVylCvd~kv%6EGik2ll%IhsnI@B4vQb^e3eR$?%jHnkhRd z7Ga}sTrzzH+psH16=t)$?7T5at{dPf9@}vnNh-w>~JP9C8OfK~C54RWw8E*e&hc-=61`C#BL;&aw{G6-oC7 zb|K(aZj)zctYq@+ndc55`um%CDr(pAnBHem1IKIn$x`-SHBULqNNQ%V9{AYZ`Vh>t zqo5E@>%HE<9z=-6)P%};ki`fwLqy$yV-!V1Dw9QOj~FSboRy#)DUTAV+B+#uGbJ9U z6l5uKc^4uVhd3a9QmqfXroUJ$-K~*ztYlf9P*p?*en=sv97G0DTv-OC9K@yqci=OM zW@bg7Sc;QUkIGr?K_0W%!Cvlr2mn2am`M@?G^5O{s9lHR5%`Sk$q`98jEXL27prir zh3%4R9g^?w`rp+WJRv#h(s3q={59Lhij*>$y(UzQ4&T6%iNvO0`a=}a@G{uRk zYwLa9irTeNNm(YrGWr~SHP#)YWJ^|GD2)L6zlMwY`;$_Lccf;H&_8e`;|QWbSIiE5s%xlvW4OhTnYZ0ew8v)G`) zd?v?+>T&CX?$&!Sl2O$TRsxo3hz`|iUqyH9my!E7xlgo|{q2vN-{LCul@BB)N%Ec^ z?C#li7`>m{wAWqkikAZNEX9Nw3(gzU_MbGjX%FNClFe?@ZpcX_OA_NGlkAsF`=C!F zd9Y;K1=&pU2se|ZGt_}nO{_4(n3N*#Eb~-6lSp$ZcVH-nkz%tuaKGdZoR;@BS%%%c z>o&0F!$%n^0lS|`XR#tEOY}{2S&GHNu`In9lsaK$Qq~;^O8qfClXag2r9oH#PGKRB zh182l+vx86CwTTqH;w6NuU!H*k7527kIUNm-<(8RX0rrNxC2+Dz*%g1w3Pj2yeDRB z0K1>g-GxyInVn$SdK>|+b95yVwV({&rB;B zDg~ZNlqhnuc2gX&HEb6>o0PLqg47p2ihXplBa_DC*ojHgaqP^bM{$%hWCbKSL*nAA z#nm;&#b?IH)pf_m#ak2N>RJ+To{aNkoSSiO#fM`3R}(rg~xR)c6<+9 zfKgX~aBbJDt3-L=#CEhW!?{Fn02bwYl-#f6Bu)5uiex$*v{^bqsu+kn6Com{gDf;b zI9**bp}y0#=oHig*iBKhH#T1yINcA9C`Dg7e#3}8Gyn7cdyUNwR z4W!!eQLK8?CW$Dv<*FT%?#7X}oJ7%nXSSIw%J32-D$OXi|M~$Y9mR1rlRm?-CzHOz zQEo=nVOM6fgd{g8J0z@UB9y^F9c?U>8`&aAz1h_lAkAgcYDjX(??IZ!bjKhCnDlw@ z>Q9j526_=v61&;~g)TQ$>Zf8gJDsJn^9ccLzdccQYK9cJ6ga%s9_ycJuP_^>vYmcQ zpi(mJx0GEeoLbMawE$t+JG{qtcAmT4vX$~i)nLb~AF~&^2A!c=dkEL#?yQWfYeUPo zjeswVt6Mgcv~|lC$p2Qz|2E>ECt#Ap$ii%<5;I`jWPD@7Y&NqZY7ed(q__i8d7zRc z+=tLzY}tOC1TB`1#C~G=Mix6~ZSsAr6QjOOzK?Zc2(!ueu}+L$Hu*l*nE+9~k98)c zuRn|sOB+EY-_JTRgxTc#S!Y_x&vM1&sbpKv(KlniF9x>~+^3h(_H!pfkPCcpP#O)X z3w)H})1Z_YEGpXTUXumQ#+6-E5#>TmIV$%oOphUm2b^-0DbS?ZCn>NnQFcDI>~G^e zHQBI&c*J7YDc=EZWV_nYYog@)B+flr+F#mw@2wBkZ}Q=(q0;saSDyH<=(ovz+*>ES zW4XHiL|IGsTP-K{>o9*@^fLFhBeQ>aWk&xxx4XAr?9n`@*B{xdq<4F-et*u~SI2Ib zcElcd`?s+_)EIxxFKvA>`|lmirOhsB`^{e#Cf{Wove3PC^<#gHzNvHVlkT_bHXJ$tM*-Hm%bQ5WU2RWMI9`dV`18e z=HNETyOZ4&gZ%2w{?Zc3bWZBbm;C zM;Y>QlxyDNp!9X{Dy^}gT43+H2cuzQnnWfHz&xhxJnH>lQU&(cYxiv*XKl@aH4%EH zfK6yWmIAR%i_A~X89sDZdjy^eAH}vDcW06d#~w^F-WFrHt;AqxHQHpjrF%6)6b(pl z^axmS{UFF&a%CwN=hUdMk@q^=r|IFa;xZVThFe*p5Ijt0Y!GW`FdBYfjG+NGUNz_@ zZ@#8SyOW`1NvfgY=_7W(#zpen6!C9aq@MMa}O?> z4A#;y_&P`e+YCFBz6O#oW+dKa!WRC71bk1UQ=8EVct^V=p>>86Pd-2J=(?k(xXlYY zZ|HpJo-Ypd__*trOYYn>Z+cGjefw&+z4F=U6)C$eo!<5P>L>0=8rbEt)mek?J8xau z?3SXFqlTTIJo}fH{|R_k zDdm=BIGas*u=y7sn=^|`24+1lbX1 zo4=Sktj8<67RRi(^zDv;*{hme?RnE9(QA69#GM-X&$M2)XL=v(HEF>Mt=eD9f5z$` zZrOS5P;b+7g+(768xh~(_P6f2YtYKcWk>gYThi97l#DqSFOPN3AHA$R%6RP>m56yv z-pG>9$;k_h#+h7mPr<~_lSbnjrn(HH-Drf$i%oyj1&U7ldM#B2lX0sEz?t>|Hid37 z(iS6ft8eMKSC;5VHHRF-Few4YctJxmKbnK87@8!|QlzZWZc?J~_7H5u^4DI zQrIL;5iuF5Z=rfUvhwn+p_{v_GYri%DV*l(Cae#|;074sP@h6lV$aKf5?UJ{YSSj8 z@|^a^Im3}OJ%&0tlaX3g6G)%6IW2`^C?+N&^|ciHy}z&hArwQCA9+J4S;(oAjSW9~ zTa;pxk#6hg%C(XE5wIRZS4~Dr6J2qve(Q87hHW}FDr3((wxtQ7m^c;=jV@FwR}bHh zj#O`pl{EX#8yFv_Z%f~-zlV+d-TT%&H!&key83z|aw zctyz=Ipp|YI025K4f~Xz2E%%RMVhw-O;tAR14CO&xue{mZ^6+$6*;O2@`inRe8N47 zqDi5d3puL2^4Hi>Xj%hDwOH0D;ZS{J8imAq0dbqZyxE+_baIQP_RXjh+{*n4PZ!^8 zuGt7w4_I|8_qR7UzpAn>aTdb}+pFs{R%0>*N3Rsb1#QJq6@_CMVS6>jO|^A6`srU( zRwvG47{OLU#!}Mtur2rZnn7EcoW(GLtww^a39BCHr?SRz7Q+a(Zf2|`94YDDUw`|% z=%B5+oW(GLEy@QqUCv{*7pkmRIE!HfThyPKj5I$XTentkv_gI9;S^|x?_#41q=Nzt1KsHF^piVC1WMh5&n^zHqTXAlQ@fE1X~G= z#d>>4cfIawq_UpkEQS$m-O5UmtX+ta8pGjL2#Ojru*k%kMse0amfKld}jTvf471f_vo5uYaqoFF1=Z zBCDNX>-U#7UsPEaIg2oIxV57pa))pmhVr(=sC!HDatew@=N09Q z&MUz$suUC%ipP!2q3L+esM0ZXg5S!P&x=bZ(K&YKspm>STra+gA!FG#c^xiyV!>q1 zs~j@0xMXAz?hAF$Qfi_hSo*GD@wgxsBVb<9QPg;i<~S@Kjzl;i<|+9W_z`>H>)f(*?)NTgO(k z9Lx)WgOszdAt9ex$*DyXHs~-g`Sp|T>JL=O*&8XmDgfmWQ>z-{je!|C^gAP{w*%1p z@q`p7y1eM!87#(pLVAQAE?BS|I0W28L8@>e@3c&Q=icz_)BNHWTGKojjz*ktxEcr`3z&g4^M#{HdpO*^&@bf}!jTJytBdgJW8Rxcvs*YC z@WbI~N@4}3KgUH%2i>|311A3lxaP>eVqg}~Oc#!($>Ho?18ySbc@t=M2}hHR=634Cl@IlkK;l#<}r&CWn83u8Gy@g0#k$LA#g#Q?tKZW zQtdc~0da`*K1UbedTYXCI9+&D9z&`aUOsT8HwcezeI5s9wH~LLs#CmaLc0f;BYIqz z`27mZH9am&c+D{zYfm#WILg0p>81F&IEHZKBIVyu;Ktq{Ji4Wr3(WHzNA)05cT{(sUaflSZzQDO}5MBcKW2+e6!@xa$gYc+X zyavoMj=Ns|eGSaH8-z#sR|AKxB*0xSyxzdLI4+ofnwt&cQ$LZ%F?3EY-1|h-P0g+% z?&&JvsGh!D1spBWR8|2;-Q%Gu;(n+CE*9baTSZ)Sdw?}AT>jAzcvBT|jjD)iSw&n@ z6>u0n3|&KTc)v??%SK70oiHgn9IcvRit&H*-qtzi*00KKB$HSh=cE zMeQeEDSo5iYdHiABiHs`dAG%9V{YH+8nj~Mr=$LudCmJ>Z};D`kJrqadBv95Yw_Ky zv%hV#DQeiwohE#|;GMZSv6K5f+kdF@-ESRrZ4JBC&Rsop&hYH%#`x)TJ9`r6?zzRk zZrv0Aj9fB&%JyFt_quJ@l(epGGf%p%PB?OE@UaU~=Z)^!^KLIV(AM$X;BWW7Qt{Ut z#UI2~&TsS7=MP-?ZrOL679XE~cF}$N{z$+0^QEMoliIxWT=BsddM(|vfAiQc8sAkq z`RN0*{||d_0v=V7wU2kx%^ENu$j%TDLeyH`4 zb{8M7Xn*sz>xO>5%6(;eLhz?X?>;``o|6}j_;&2E_g3|J&DFJCuhG}6>@~05BU!I> zod0ggn89B^d1l5y$}sEp{O5)a>zn@i$ak+QpH%bSwBr|7=5K%R{yjUZa#~DSS@PYH z&q9k!3ddf0U;5|+Ys;T~=;)7EYkYjwD5&#TV4ZrNYfUmyBt#Z#H>n)Mj33@>mG z?7w{8BkuI4r(S(y!@s_E_s!=vxp-`Dm!35nGXC85o#VGpJet<2$%CUkyVh;nKL4wt zmu5co&$iDT?soAx&0e{;BB9A&m)r08F!zBjKTN#i_I?*{uG&9#OmX{be%RAxao3c3 zgBtg5)$zQ(m-T4brrm|TGPY;GWm3QHU^E%VC_h5$?u5kZO_wnw)v5wJVhAUq2%iFx>4 z6f4vH5O8hx7cE3Hz>bHEw}F}}Zn0f}L#y5@8;jd}kx|hdLIa9mB*b05A}Z5Oy1Arh z%bmT1-YOajw`Pl5w~98z*HKa+NkmSNw4ZdYq;p9x7WA#6MbNOUhm0u(MbnLNX4}Nh zsMM%qu=PM&Rt5@6o&J(j^}NcmyMe)u+wzhlZTaMwZ4l>qx?v{+fw@zI*mwqQb3#|B<0tlTBTritrkFV;qlKN==~=`U!|{)e z*s#DP!~BCe75SR`l~Tk6l6~msCA5Di@}XVr0tK$rTMuMgEI?amtWxAb$+n2^Fm@=$ z_tb#Ogo=sr1w2qMnG=B6eqV|xcOV&dQ=+|LQ4pk_mr<}k2qG#2S`x(fwt$bK z(F96XG}%u>85j1S`zFv-f#u%@jmP(?er&yC>B|Bq-uJt8uj4iptGp@ftYO3*EE+t6VGMFp~r$(M3E@iyg>jACM^Yryp`YtRiS zDut|LplFrUQFKv_dBJ+gTry!NE)qkcCT+-{QKDH?*%b$nAq!eSbqXbygdqEHebBa0 zQ9&{O1~l&5%-3aIiV(M9@nQu|N0~ zG-%0Z38GNcmV~{2SUse*3>2Jfn|SB(Q`q{C9rx?WS?su<>&C8oG*e{9{gf?Dunyb^ zfYZhUlN3-6+W{0(#+?9lhlmq9@Z@fIK7tr`!ygkl9OiD*{oLKS2j97q7kas}YD{b&2@<=*-`mVlMm zUoS>wxy4>gJ#v@*tuKiC+-QGCu^>@PmsqvSb zbcCDkC|bo-*anLMQ9Vx@=SXjm?W@ILdu3|u&feRRus=Rd z+ZPe)7f`arD-)P6 z9a#sk+GX7TNzWRgETb^cruXvSuyCuFqI(*g`@~Xakc(~Pd zo=vHYDf!H)j;_@h6hE);k03ppk^rb~;h(#&qc#9T4;*{^;X6fHWvPnuI-ykOqAY5u zv?9svw{5L&a@+2mqCum_j3si+V9RU9O&mM;ed;w~Wi2F7Y_d6&#qN!W7xp^CFYNHwb9vGp)tS1$- zN%X`~nB=7PAM-08!nP;c3?>|sC#BP_1V&M?o?@ZpU>_O&*(;^;?ee_k#uv|mDqv`4k zc)N=sO6b8kFi4M5DpN_Z99F{APOVdO9YyuUItq*9IF^gDYmbHwy76(^rs8^^pl0AI zJJI!^+#-&{+yjDo0atnVD^P9`*BlKkJ2{(NcI|1P9uarn1SKaeTCz)u`=2Fl5U6tn zZUm?ng5q(a%>^|RRHC33fRf#PDX7Op+-;y_S;C;66mj=N;?_sv9*@Mm0_q`wdp#0Y z0ZNwTLr|sx0uMtsrnHSZXCo)27^8!En)IbAr&KFD*GIu{S7d=6?#5O6mGELAA(g`; zO!^dgl017{D=cMQZ>v37t`l|T6n1i$w}R7;t37#SIOSy+CQF^-M1~hAP`vSY4Atj1 zlZK#c7Op_u)ConH_kV^-Cv*%Gi=1%;KNcql9F{n(y-+Jz;%LR{A5jkPiQbdlE|Aiu+LW2fMzG|RKCg8y0J#-8W5Gfny$@pcf z!D#?OH-tgr>3WHGevacIq)Mnfqcr1J@bYXzdq6B=Fp0YNskp}%bFueI#XSrN7WbY& zEXrpvc61dVSuLUymo3MC>z1!xfMl@A6a}dsg)djd0S>{vObvJ;zVwL$?1X#mRG_}T z0$4~>^b@}l!h0ayAe;S89oF!W|5ta^9 z)Jo3hgOcm0G*FWBP*58LXAZWK^H@-la~3EmtLs2XS=|I`ph&@iRo3_ZNZfOvWJx)& zN?au21!FeNh$AOaN zn-sxKjo`S&Q{KHElw5P(61lqqlpOfoWBHItgVb;Ad6)Cjlb4RLZOlv9#Ag=TSWenf zCZ0k$%v7H*X|W<}EoreRYa(g6E{l2r;3_T?kA$c(4F&x;y7_;0rB3y3&-Vgp+uEDjUXVc*v~A(shW;zbRa z_;0r08!6(10}}OoWGw~NPNv|1D5>V4WD25EARH}N@g9$xy1ksnm(!I*8*`9+$&;IT zv|z<|5^lmmGmd>Fw@7JWus||LNioN1B2L;sreH``QDZ>AfJEZZY7FLV(RQP(7oTqRdU3m$7B~S*zLFx}TST0+aeW>(uFt{7^%>Z> zKB1RzluVyg-z+n3G1CGkBFS4)KznOBNPY{Qz^0UFVCqGv+&P=k&ZNA1l=D;jd?7cQdBWo=;Ed%W1 zboK1rJKZLUK7A#Djn|UEMr%yfnr-K0?r*NYYv+-^S6n;yx5kxUw$N-llTt?ZOlkDI zJ>&KIiGRQ2?wkKIw%#WTo@5- z!M(no18$o8-GINnm({mv<8$t9rc{sW{QUUv&aWG`dEnBdH6Qow`p^T-Rt;Tp&xAfB z#ymaqtHw86|NR4lCu+8zKc46res_Vt?d~b7oZGLzs^eF=?Oq$+=bF;@-_3sNL{3S< z?U#LU|LaGNmYQupKlttAH(y9@m{UIKw#tjYZ8_=Cz^2!J{?(HU4*JL6oIfsWYMX=0 z7d)PRZBeJ6n)dDY>@~$%X)g~AJvQyZ{!6-^f4cAD*3A}ocQrrx%J||7r(beUldOTh zK$B%(I~ii!EwzdRI?SmDnD_p;{2jVO8vW>t$IGxGNb>J zXKu*Z)a9PGH$U1rT+&{%CDruNjUCJXmuyI~#i%wP>$a$!SVV-xNGiT=X3#BIeQJzu zXF5iWX%4W` z=1L6w->E^9hUV%=meA4`)xz?$kIIE@DlA6(xYQW7porZnlgO$6?&?5 zYAS&-#3)DPfaB-hP>Ju@;bD<u_ELu5g!+8ghiYrE{ z{Ex-Y?9ts)4OLSKj3F=L^}HT#p7ENVDoafzFowK13OcZEm3dA7Y3@VKBK68uQwfYA zuRj^`x~lZ|=k-)~tEmLWkXPqODi9`%+Go{N0%OQ4DUym1qebl-YAS&-awSA$cw9{-FowK{ z*Yn!fr%SG$iZ-nb0%ORlD`NHbD%jce$)=IKda0=d#*o(qB9%67>~8bUi+ZZjYAS(Y zrnW_h(MBfOA^wS&B#^9(!?tkt0)fkj#PI7TU`9n^qOD~wWGXwgh~d6f=V8ep`QqdW zHFsi+7Od1shn-^u!`F>x57SdMt}kPWF{Zi*F?y;mn|of+Q(dm6BF31Ct2sGpfv|O% zbLf6O)j~BDF~(HgMJmn_48EaVhU%#vRZ|gTOw|K14m-yshV9L7#?nTUM!A}b7-OoQ zh|yEs_}sf|^;Dpaf5jlGrCOq_sWFI9V}3Nm^orW3&vl2x&aL{!;B0ty z+iGD~E&Oc>YWB26vuU#In!@K~a}=JKO;LPyHbwC%nosdl=1$9-V&rEP4W1U!C>mp zoia16Z)&Qs1e7vcz!)2mow)U%SZzmy6>DFt--yw0nP#mW;|Y%qsNEFSaM7Op zqHoHSQ9kaXZ_1Q$Zdw&pGXa+gwU!j!K)Yp;EXLU(wIjx}A`7N#iIp^>?y9+Hmfx~G z+Bfy4K^0Vf#yE?ziq0r>!Kwri9kMLFQJ1XJ8xeoddV9`-ylGPwPRX4%eeR5GIjC@4 zni6fvJ;EIr5ga*um@iWpX43?FQIt(K4YbAk$3cDg0&)PITe@?#$tV;r<~ZzgudvWs>Zu zBvyv$sxkdpY}_-ve*cgmBSsE(^Zn|eewaZbmCFbX9yW4_cB7Bp9vOkbLq-Ni4arpR zVc^#jjT#vo=??{b>OGA9k$Xmi`YBTa^Kec;=CnmK3@1`(7W8SUY0@GdHfspATF|HW zPQO$jX+hsZSkMo?P;S=Y^lD{6|5Mb|ET-T%7WB!OkfVc@1^s=P|38YsS$n)(geBi! z@nPWXZ)MqCgSQBUz%1jlC;}hrt#D+Mfkjg$J`C~reT;iSV7l>{6oFN@;x`EK*(!!O z1}hwoTY40@>(zBVv$w)=Pr$W!7F@z7I|Qy(t#Hi|{}M2zDlT3d~UJAjYa&2!1O#{;`qoUa8VEVyweJw;VOpT z8RA()PXTUj6hDD8@uQj))sf#Lz&%?FKek6z9r=9(+}E}6IWUf{ zAP~-0-!8!PG~-P5rTm5iGs%pzXpb9!DKz6u7W5p_9#t_cAA^+zIQ8JoI^g(Ft(_V{ zUJO?J>LGrA3_oj+oFB#D+%cBjQ_)bLn{eE$gsJb3Sav^y;{9)Vn|B&H@@lo^!gv1 ze_Q5b*T4Dq@f$9F_Kh#zT)*MO=Q$5PNq+emO6$=VUbkcN>ysZjQ)D0Y!ggQQ%Reja z#*FDI8a?TTA>;3By7Gg~FPD6?cG?}oj}6M4(9ZwTcO$-jb{5mWzPR;UciVS=HU$OAL;dx9v|uLk)9su<&hp9>D`f@9qHAP9v$h;k)9ms#gQHy z>AjJj8|k%?9vkVck)9gqrI8*Q>79|D8R?ag9vSJ4k)9aog^?Z@>3xx&7wL789vA6t zk)9UmWsx2h>0ObY73o!x9u?_Lk)9OkMUfs9={=F26X`XP9uw&;k)9IiC6OKyIjk{c z$bXg|3U9-`=pAgarWLu|KDYE+{>*DItyqGTipQ@UgOR1;33@?zQ&Nh2S&C9< z-C%C1c*c2^gZR>;$d|2nCWsrUu((t_S;_~9PcQQ2z>d``zGM{naurXuSJ{I*1B-ll zO1;E#kQ0_z+3SzO6nIecA z;hGSHZ;6uGga4PoKOz6$u4Jb3|DAAB$p0&p%z^yBnpUg96u0M1j*%;Hx_`Jn2wO=- zf)@r?*0K2il|TO5T-F>2Z_;Fm6b=Rb!8`1G)K>9n8(A zlp+JBL$tSOd>(T2C~u1rAlu~kT)REVJ4D9nPH^U)g-au+N2wIqSBWfL{zp3cD)2MU!(8;ZwGVeD`T(Nx-(l9j@KUkiu@)Zqzy|^Qp|d zkw>XQ=3Yls=0AuynR$K|zIc)=QFCRVTKP;A0OAmp-^I!&Fu$V7If(QmzfD;yTeK3O zl&&3~XYw%u(ddOmCV^l8sAw zxX?ykrOX3ivjrU$%07yDwqEN-%@f}DIZ&W|KF40s*2-?#T+NUr6@^(N+uf0DhlEp5 zT{IEex>C0F)=2FtsUt$>?;tMWeQ3!(6ax~&)mY&iR=AbW8t7W2#y+@0qb5mtvl(|7 zG9QS{ArWL=#mte5R0+h%YF9G5DsyhR%&jf0>V1w~kPRByC)pl!R5k?d(yb+wD3F@*-{qR$McH-;Jn3XZ}DWZU29*9?~4|Ke}$^jx9u&xtKw(-Hgu)#Q;IlD&BfmCX9tsa!4ioEecFF{=vbUtXMahvS9{8;Ey7sWoBBmi4 z_Zvq^#ksEX@Q@!_@V#EgxMdTjlHkLJlt>$3b6Fs}yDYY^Aj1Foqf^#G&() zN^e4W$)Wa)YmiVbhJuoVWP79?97xKM2_jNLIj&G{a-}kU0{&AyG2(FeDJ?nDn)>J% zpGO|eJS7KPdJ~GhI0#@AA`Ui@OiM}**8|f-f5KN^7WK3|p)xr%)z7MX?c=k9^z;FX zch)_j#N#N&P(9A$D8;}X9`X}pQ(&LWcEqDA8HIa+Gc z2slo9i`ppTvsvgrB#hYY&vrKPNUZR&6)y6#S|UU%VCCEz&bEo!ZdpZdoHknIWy z0p#MpwE%MB3BW!+%d5atNj5#iK>kms|D%Aje19L)!+9RLh|&m687BNOF-&!ZvXU!ZAxz6c2C@fa zi>jmEd7`D&fu|XU3`&OskL(-PV?<7r9^@J&kgX)5@8cv4s1Qbrg5r}L0n{NvDUpMM z}ZfhE;t@;hDH~{Q3p$Kw;U&DM`=NhQ3g{{^ivTns7pUk>yD*GOHX)8 zBUJlAP76bd#yKY_<8%MbT4NT-W37=CV>o}&wXy!CsCTNUqSOKObk;ft6;|si>K(7b z*-?!?+gRZ&RQOjmJXWd|EfvghXzB76UKbA8X~Kpmm9rtILQILSO5hvA4n)j-QZG|{ zjs(oytuUF6&*7?9nVje0zkIA*&@2gPYn1XlC?=vsgY&kl1QQ|woDn_B7LNu~l~j{C62hGRl6<~WbC$Lk1T9xvvssGyjwOFnCvut%;P5X&aV zT}+!yr8_QgKJ;}vb$KW2;Qsv>n^&A*rW_uiaxp?E(%R3IO$Hjwd4eB z2kjw0Ek8%0KcryV^c4BTAu*0JP>k&15#%_KsgBauyW!ajcP8L#I;K~USs*h!j_n|) zf*j~^Yyp{lm~Bc!nD7!1(KdK|e3M7C#4#^3o{w_QG^yqJ=4-(XjTr0QX3tfYR9P!;%nftwwiwhuw| z7nGGlRku7oW<3CY!*LiZ5M%VD+GNw6c&=nE^+z1`f@kd6MV{I4 zntBBe8@bXS&Pgf3n*a(bTD-msy>$A9md2Y+-EZn=X1}SvyM=n|e4SyiUGz*!Tf|G7y6#(paId-tMJVzu4~8if zw4HCGS2>P7hs>BO~5Nb%VMaNjz2Uq8QNFD#)qidKf=E7Q)r^?Zj>mWZ)2->sV*=Pxl2rKtHstQhK(19zn z_UaB?`*}7EGQ{xg6!rWg1t%LM7T$^5=)kVx#1;-XZ*7iGlD}whsxsD%<@0cF$>C10 zCdDl2d>2StVnxyL3^0LXR;8+F@Ia}JJR@NUT&UvRTSH}V5dVfc6*z>&|3=E-as1y@ z89agin=6B}_`j7hcq;$5?YC%lK0w+0($V#c)E&bSP1|WHnn5$(DO>uX46{XP4bRfZM!%qtA!^C|1n>9-1v;bp?6a`n4ZN6D^(wb zigLm#&bq;=j__ZK^G|wh;!v`gL(W?qemt8v!gyZeaN~KMV~=Mu2cmxo@2Wk7b5-G2 zRk%v^2*;`(;Z)Tl9IASRGgaX|wdh*-O@+(UQQo470=y1_ z<5bOMDGt4ea)LTj_nBJoyL%xt77kPOmoiv5M!QTM?JxM=?JwAZPmO!gXa0iI?uD1B z&Qg(lQ3*Yzwh;MkM}B_Q|21oSb}y+@P?3T7IE7nCsV5vtB=vUW?tjV3nCtd9UQ)65 zBRLPgFSCtaQeQ&~EnE&lT3Je}5xx%*acA?AdQwY{|Lp#fgQUnIDB`5eGX0Ulc3HJq z=9UUAxIxI2l48m+B2HS54uJJ&e^`(9gY{_d80*m`;FJV3JFNU=gWFED;1RJ{ciJRH z-V;PzyH53O39y%S<~pX<8-*x@75FsAN9RRK3z;BfIVDA2SBbbTI1Hx|>~9&g6uc{O zO(PU}%M?VF;G+dA-r2aR+g59QSr5 zx)o@drfr0x^@mJN6wm$9f>k~@;-)S^jV~prmqk)+BgvOMH9u_RZN>Li#Q)EEb6vFi zu{)kVC#T)I<*VM${5CQv**rKhy24Tmz6)<>zwx<`SPiq7uKvRed*ASTQzU4LnqCeHSfN$9eUM2Hf3kq znWdV=@5et?e%osF+<)zO?eeu%XVQjg-dq>1eE0k}%6^|SefOSsniM@c>*Ho=MZe$N ze)Y@ue)7?*V_#m<T13SCicVvye;Iii3zpDP-Z1J10_CV6Ks|Gx8KRs~mSGJ`)tM@JaZhv)` z+?D5kdh^HqLW715`k{Yb_9u7L8~Ajn<@9I1`+wcrE4SA%v{^UnMM?2WZDiosCC9HM zQ0z~74A+Cjh8QkQlI$8L+Uk}3>SjI5agtl|rfyvFzTC_d%?Hor;KOw#vN@}_SB^JC z2Rhy0iRHuo?yz%CU^sbC=Jl}{Jmmw!Ue^xPv#(z8QY?lgao9O;@QHF!gMhBHNgd2>K;7RJ(f?R;ByjJw#uzNhQ1k# z5iR}ydwZplA?Q}P|M$JUrphA!o8Dgg&=d%PS}bjD`6$KE5TCl)+;V1Q`0KucS9R-I z&EB{L?wrl$_RgKJRp_aHR3*=mz-YtSk}>wSxH9}PZ?83pclFS1Q)~0~%D%wxFBIknX4?RDVr zI|u2h+Nr6y>N4s^Cs9IemU{i~@8TIlyy-)Hnwm;r3^ts95~;)p464V84N>(9sHp_T zU@zJ^k_v>$=60HzN?;6mB}GyZVzjx{tbzr`kXILxN^7r&4|Z6t`)$2h%}Zbmd7W>_ z>zaq#chgfnp{5cTLte=ul`MnJ_S@o$Bt6wmHI={^^5V>;>&DJ$U!KrY{i3E47(-rN zMJlbmZp#m?)Khil?7A)EGpNPn4x)55Z?DhY>@#87VZ= zvATG%g?WtbwHCH!*wLzg*BGhsFhevL_z`P1bYxtNsUss}jU5>qYwjqR8Vw$!y_@p3 zg%?{yN2<-zqE@;=o2eSHH~u@;lBR5NP!OHm>bd_X_K*~VD$!U|xaga)R(QN?v~DyN zRJ&=NR5L{so7SV9t&*>H)08w`1Dc8+7iMB7)zQN65k;`2SeSE)cv;|7Q;{{i!A>&@ z9~-Y0Mze>MY_)HeCADyWYbm`L4N>djGL<JI0%M#WO{DXFuXhS*9 zz?*ioZRK$H|Jz=2(^AvZh0UJ4Xf}SAN<+TLowU@{zJ2?`2C#SE)IK7XHh!IL;fG(i zhPDt3)Ir_K#_wBoB8!asaculLL`@#Vx^2xfqo-KL@u$&!F*s`*ziK?yALo-j0_Pno zTd~!6Za4$XO0HrNII&yd-a`EIz|2=?coxA5$A_Wy+A07vgB8w!0=*C1hw`nfSbSRH zxa4Vy^=n72VG-ihBMJ8|P%*?YSn<0UZ7~G6+#~@JN8ecCxO~X#A~D+43ilpvJ_y{R z^CgN+ZG{_)_y>UbPQ^v!Y_d7x(zR)_J+4|vQzx=7X`$x}Sm^LHbE@m)x zD~1gD&(gMtzf?tRi*o3;1)J!j{T3YrAbKa!GO?Y*t4wUI;gN<|2o(Frjgh3B~f}M&@>8aAJ2RpZ< zT@Uur!LUae-PD7viLf82EUB#LaaCZ)0IZgC z`~5fE`sYMizQCrTp2y*9>nO)gMQk<1?nMPV46B&d;cEr9j`EQ5t~b1vNwCQu`vr+9 z^(0pa{<{;aJc+wJi94{%6aFg3CGJYxiH(T(2_C!Zy+zq6e(-7T4L`*6$OQ%PdSSf* z+YJ_*n;Of>D7g|_0$t_UPg~DX9$q8R$P5-C*kGv^h_*siC~mPYyj*4HfawM8Ca|3m z^#>o9kbi18}fDFZ1a*quPw zVmGG95TzDkFZZa0E~kvl#dZ|4>Nwcj7hWd$IZE&YeK%1b?8rpHWi?Q6>`?DPOBhzf zQSMnd}N_ zRUg?5UT)Pgg4+08yBy^{*G|~e!1ku3qBFOnqEF;Oi?Nk8C#9Ru z^^@0?1MRP*w2=npRoSRpaykEx!go~K=lb4*Mn_e_EqsS68((;p6i&G}{5Mk2M%T~D zU~mF*gwB-g>g)-xkQf-zVB-vUd0pRe_i4$_&S)KU4{W5~>vereo1Gn`ISqR5S{jfD=!6OLMi?YWEakZi%XfLLMGYOnUbhr{>pJL?x%>F~M=pLtGiWI}IEmI_N|XXpaaA)-Hz5_|uBJt)nHWd8 zU~ED|i%}P2LU;{J&9q5O`@PIDg`2uj05-ZPGtAO*Qi4*mxrG`E;0qT@4P#=cR|&OL zDQ3D1h)NU!xiUSf#`N9rEm}%w5M?_=O1l93OF>(BSwd(NwHhLZ3SgW;15r3?o!K<( zRFD)UEDMYrMTvu`u4ofc&z-rjU^0~eia>}NBMHd!{&_3Cia$s}; zjrT0w8qub$Ugayc&F36lG9W835JRil`a1D z*T?Kx7;aGA3e15iOSdpHF>(lPa%@pP!2s|nIzQ(?41MS!pNP&bCTpd_u?6X%59Q&% ziKJ|2&H_@j+l6GIdJqeSP1klxHlYfV?S|8 zPeKK5V7PXC$Z;oWKe)qY4quQf&Qz1@jM-a6Wg5;16 zW<7kauY9gADP*?393r6wKw}LwP}zr^(CHy^>Js}fbO}=f79o2Qs#pvNx(YRf3?*YR z6~O=(T}vI@y{(3=D-H&86tev~>slwwrbDL-TMPx3f+6AK}4;pml6z@+)<4H*^r%r&k5T+D?z-wBwXl`P7SUiy;YFap9H#r9l^`#6$MEfeAvQ4Wx_>|*pQ3?|4^4|1}DJU8NHl6TZpPO zxs1&|3SDux){b1rpk=(umsHaUj{QE@LD*)4?v^0zsiA%fl4YmlByU&tA?dDY89+-! zAKsq4McKtB-Jc8{tb(ri93QI9i6%pT!4gVnHARd*pA6;@lN{PgdWs%{tJh!0;Q-EWGsKB?+;q=%$@L4vcQ)on=0>&cbRi2bXZGHk{>x>KufA zBbv7dl#ZGY4$PSk0_Es0n$}?npuCOt?#9-|Q0+ovNOl5vP-(yd8jn?3MTh$2G9=veBCi8F1I?*G zBwG~ID<(>;|6HX4!%=%X1m|U=o?#oK>$qT?%q1f2#j7N&0-9JxF^c}mg&jJ_9@lBq z0GTVCD%{8)|NJ5Wdq|QCy2y@#5d#0+P#DCffSiqw7bWtzPN0GutID99uo0uUM7_#I zc~4+)5MQ@&xI%gGFAp_<{>p5`ti!ozv11P;aU;h=Sf(t&qpp;Ot5}l;CB&*$2$7)7 zLL}(+S*$NAG#iq^05M9IpQ9-j-H?waozsvE)JkwfQ7A5s7ZvqH0@*#j^1^;*8FI&{ zOC^DgCYI~IaH~W)z{0lev6S0cItA;1?|63tne7jm zRZJ;Bg5Xq)fr^YE2OKG}$LA6w!8i;^91Bnw7alpvW&2=YLh-@nDRNO{>rkigs325| zkGU>9)u2`1McrU5Sd4!Yd|@Yy=rz4XYqD|Bei+o*z*wcB?~J1U;{P~g2xVWL@(ePO zN(L3;u$`+ZNoNOiX|@&=Mx3yByi>e6(oB8mOZ6b` z#Pvzfck4O$IBk>hvj%^aciI+!;+8G>#wzJbo_T|>#`jZ85CbcZGAzvO$-Y^zDFoT0 z=;@u`2bEHgslR{x`h9+7FUa)k#`SIvw{e({jvaa%emSuK^K%HM$>2a_fJU+@a@PpU0SO_MT7}yHlnZjadm8Go{MGad)mUqgQ=D5nr<$>b14X3cElm<=g z46?#}&E8Uni_9v?KMxs<%Y zaA+HS*}+-~Q-`!38iH(G_&9~JfuyqWy_<-8E@a6j=SFvgq>2uZiiwf7{4(C+ZJs(PJQ8)@; ziwd72yhY(u{0nkH0GeB<@NbFyw*vn(Yx%-2^4fU9SK5u%lj0{w*Dqy-698o&@wtBS z7rjFMWrg(Zz|K-8vS42+D}=F%ja{Xza5gA*6;DA;y~M(<_=QK9JW}~bNgGGeh(6cR z#Liv}GH|1gMIB7nHq-I7<2VkQl5V626=#1qYnI{tACM zoP+Q13mtImpeO55g0VlmhS9jo(uyc)(sl)YJP~;Xx*rHQYJ9FQgf&qg;hsCT2KacsmABDd(nP6z;5fIAA3;<^a&U|A+5;IQ?t#p^bD(W)45(nlv)w8J8}+; z!^A_Eu;b*iAce1_yH%&qqEjt%VEO@R*tsXF^!GuKifCXpOGwPC6o*IIw=b*D3NL{t zZb!LrLhtEbT<~kg_07;}GhA;ACe;CaajReAis*b~qAGBq5Moi`I4zQI6)6gln$N!Vdn#?68pnVm%;@({8bLH=MN*5;UC~>ls{;| z4bAiW!vxsqgx6D3M#EOok3@%o>cYD9L-a;s(^an37yJw2u~oNF2XkFX3h?x7GxChV zK+l!%3zSNfPhIx(xIT5cIZe(0=q9!)_&99}u1y5>0IpXHYCW#fYVAo-@~#slmE+iC zP`w2%7gRSv(aWu*4o2?MR8`J0i$KY=OCr=NP%;I5$4Y8EC^_bFq)8B*?*KJJP;|;7 zOZ6(K*&=QaD4F6@P;*7x=Mmgbk-POF7CEP3=Jhn<_~S3KmwB3sQODC<3^|@wV!ZLR z zbB-6Sl${(T$PiGKr?gar8`sE`ghvNI=OxcoTc)9qvhn7Dl48FjLcJ2X`(H9r?1>Dd zkzx-)4aHTOINRGdv9-@@Y-Q8N7ts9+LEoi}%_XdwfH6l!SBF zd!{AvnE#~YuG#&QY?|jw-4~|j-SV1`?_PKD#dmJn{o?v|r4MBOrrEmfX?a`sPgdN& zI<({EW(8{+HcIXLYHIj-N1#>bqdi)^HKTj82UGLr4IR7u??b*B)uOHK(B5_%P8aq( z({1{9m8Yg0oxgeCfX};aef?NF&9-fE)6LIx2>-mleoE0jJv+ViXU#k1rgkr0aqlng zmtRWhP%v>>cFvfUt0tY?de{A>FAw~A_cbrqAD*_b-=14XWR4hi>d!Y#@B8(z9*?J8 zu)oX8X4|#> zW-)Vr`O3wy7^Of%eZ*g4Qqn!W648)Gr&2+UYs@iF>YfONG~XebeM&x;?b zG4y>XIYYo|&|;d{WrS|?b)g!=;Y+5v)DWX?x)sTE-;g5>7~Y&}h@lU~+#6(Gk~3mr zeJJ+Uw2EyZ?6536CSJ<19f6u9t+zOlFi?ACOm9xG2-FRuJr`Th=tD6PF}jV__>Fr@ zbuV;_)mjLQ!7fAe%!u971Gg+J)>ExkQ_0>N?US#C$g35u3`YNd&#S2f#*i0hINb*1 z%BCl~>Hhz!)Kmgvus3NbQgy?Xkb72NzgV}H`bteDFowKXHa)LzFI6V#shUcKi0iMh zt(w=nZydT=_Zpa{raF(D4SBUTpw$cy8Uo)_(&^i)r% zsRV{hZ7(B+<0XT0~Vptd~^I#2D>gIwD55e=*wH zT*6Ech%u&;_GKzllda7#H5D<&RMNgotB=vvW{R4M7|Hi9Y78RCCu$>OXT&({CwapV z_^_(kPQ2qqhT;l~O~|3UrIG^bMVdgYa# zuiyeJ;xp+izMG8hlr&#YLxV#DfuTbOyLFFPQ&8RM`3vXd-2ls#1#{=jur;|PE%j0> z?@IA3FZ%WAn<33Hro!^#Pr~w|BSu|q5oBd~u~l0cYr}wr<;7OqJ8r@W%Zt1ji}O z(pFuWL~z0&iQHviHTwdSX~vn#$JyAe^nfnZS%N<4pY69y!1)Gvh4E_jh2PGviGBSl=DMd~C*9@cR{*23#c} zMCxJUM{%U67y-m3p1x!N=dFbw>w9$_`TYgB+iKy*#m8fHkB!;0`9oeazUEaAj>F61$gi|~C+p|0I@p84UkgQ66Yy#_ z6|ZJ{p^R)5r#N_xqrTIYg)0}VPTMWG%D6R=xEDYri@R^&%3)jnNZl6a-Fn93Wi?J_ z-K+jyUFQ3~o}+%lfbv6`?|4G97A^4>8z-2y>D0L^US^m1PG8jhl0J|k&LbUg+2El# zk2ElH>_nVLI&H?Rxj2t>-nF+B;5^bIWzAZgNBZESPd3Xdi(qkoh@K|fn!;RZq7gdcSZp8~1=fP^>c zcioS#@^D!7$5loyBb+T%CE5*9Mc3*$*=)q|G-82^L>2MKSe#EPBS0Jw9D+(2X&fyX zQG~?8pP(S(q*0u5dH}9FB4{>uV&S{E&8Q&u%#=gSDx;G#@y@=icY6|7Z=JaUY4DR@Xm{ePwqo!twejsA2$k4)+8=_EDrDd z*{o(vmieREjm!nfA273~Ok{>y)Fj?EfTv>`Dv{qxH04ZB&DNPXueWdFt!r_ttZ1g7 zBHJN|gJIc_k*b4`>Y;3@ZWmN`A!pay0cEEu!0PRr*vi~fv4_dzo(j)Zp2<9ec>|(2 z>N{=ZDXEV@anN>(@mt36m86Vo1xohyP7$gHD9%Mr+i*~_ug?U z2$&uCHzZbjzmz&7zec34{?yNR4KW2L?RiZ${m2ejf*VmIEymnb!8>a3kM8sN*XuV@ z^|2Zq`YI0Yh=M|5gOsWO{BcgkGg8k-Ob0!Jbo_*=1VxRE_2SOCu@i-kASKHPrK_(h z7`9e%mYBflVJc<@_mnM{pk`9=-UxL?gqjVCODv~tDXvnflnC_@DA}YNBh+qCN%%O$ zRukFGR884@?Lei7yWD9ZoB5Im6?X>4e1;}IB5D`n4E&=u14nA<$M2vEF|Q^rn-6}v z_%Q>^T@G@1>xY}7<3l>p4U<^d8F!>W(Fmzg;uC{32RPXPQmD|D!mm&fiZhpa&&SEG ziOYUOlp$|@L6BJZCT?2i{V49l&$|$Jjd|zK_hWzEVt?V=iOZJZF4q%(;nA}BK@Mt> zeOoAc{xGdPv8r{6n66^u+eE7xHn5~@w*9N7rn=M8)BK-z-qO=c-opQ8ORM?&W_A6| z{HkZG%T6epT#`WXsB>8T@E~8eVM&sKDoEX$2ufE^+kxl><7lvP zlS4LfQ$o}-_BQMzV%Cwv*M*jTio%OwPCvl-=H{FzffQvzV|L*e(V()FVYRqNwjnXt z=M4*C7m1H0cdNX1sA+HBs*a)BGU(;Dk`!_shSR~!BM)Zk*;ERsw7Q`2c%fuRk zUA321UQHq#ma{P6su^qfB;GX?k#cc$Frd66$|E~;HDsY_`1pg7iprb2qHcyTY()3Q zmv9d&gJW0&n3Ju=Ep`D_Xe1!GwpK!0K`z+R6;-DENpZ@PpQ+sl9ScN_O8FOCmLtDq zR2ewl48}qux=>Qhuv6n4wPQ9|x`iE-J#Dt^b)v)N2C;E#vFLSEJXle zKy|^#X~W`KrTzg*cAjETvO{r!BIonZK*=t{CXiH9w5P;ztcwZ)Y;~HHO zC%#LxF$c+)JbTr`cW{I+h=}y!@s+Y5Pj4-J11eu|qMRX*X#PeC%NlSYBl(jzw~A`P zN**I|Q$OBWYxT32n>_i3RSQ;p#|yr4KT%U#t8odoR_RS_trj-VWh%aR)k1d=QoAI@ z7MLXB}SHhrg7NUl#YE(V_F}?P1`5DsG$e`OAeAEhiM|tp48Nqv^CL|ly{CT zDH}h?r{nv=cE{QrJWuF3SLRyiDN?ZJk|LK`B2Jd08OqTV&{=^+~(TT;ih#93QymC$z8 z=F7vn+OOW>n(Z0_xL?P5j5&ch=>e^RM^rSYoq(v$Oovfl7C)tG3NA8S~b@ z2Zy(twD_r~3YR`N_^Kbr&h1k)wB)Lut0w>HohFwaO>Fu>>fgtu2X`NSb^0s0?KiCc z=fuaypR;kF?TyTm>1S%1Y4`Ikd80c2Ek=MUSfBgH(uf87nV2`9%CqH{}!i!H%T!+ev z;Qn9Sva?moH1a=svkTSKVW+n6w}Oi%U3f5dQwZDKVW&oOBt4oxerha+KWjVe)Z24F z-F zbAc9N(_%PA$)Lpy*CHYq_9q!M%mOVUf+>iJSsN4cbW9Al8p)t>-ls)GIDZ`zb2=s_ z(XK^le7L-oL5p$4!~|nvxBxb$;zHOM^N1RwZ<-PBLIA37)ABl?VjPi}U(^_V>(9CB z=pnc4qy$H#rS+3Ju_eW}m2|E`7^puY#?@PVhZblt{ZiE!>W08v+DDC{Mj1D|a7@uR zyG&@1SLKXsx#+HzM_>#a8st_j&KAt|(WB#L>#0I&DuFRrpEoGM_$HCTydhJkC$<~Z+FOFw=dpUQ{dR@=!do`8781mvf zJN0<81nk|{_>0%ORF>npu~-FNFP*eS!l%P>bx zB`}7(xB}MewR3vg2lZ69tEmLWkeA$M#C1GFqjPVWpdSGJgqlijGm4fW=O{g|Ki#dFxKrP%byQ6yFot?@j?(k`dSK5~J=Hm?SOmtf^@qOfryy4rwQG<(j>yeSI}antAJ zP60M14qHwPaf|Y=j=@dK&PGvVapt&r`8hFZv*%nF6E|-`c1+xi#VFr`Y(rUQO*ej@ zvk3c+=FFQh1$!dQKqj6u|GFs)vQ23a$Nb{O&$w>Jd{l1A!fEqo&4@7N&yLwMvh%0U zkU1`jbLYBgc`Qxtg84I|=jJ|GK&K&&u3AWP~PMc?B8@b0sDW*+7Q9OkV z7MZv6SOCmt+FC%wRFa|}Z)*XOT=WxdEg+K1Ss{{3@5q_7ak-ooBDv@X*2d*>R*2-H zA5t5a%UL0kOP|_nbXLe&o7t#drp;o;Qk$Uh*$U;74W^ANQJmtbUPL!ly|pMy48)=g z5loy?817$^mX`MK?9IB=$1s1jf z6V7UH7FV4E@G4+1J`7wgTkVm$67eBm9#e5#a9QCTV6X|8&D{Y&;F{42w+9R^>S42; z>Lp;}eU}yPpSXSG5}R#Rs>E^9v%+1C_|3p{N;^AlFK+vQX{|2kS$`{jd@nZ>n6h-q zk1I)qK!1Krt>N82a@+|~EPk)(D&K3sVAxP>Kle*qy!LGkoHKx5uZKxoyn2kTXR}=a%#%Thi>FsKB1i~9 z7e-24JbnH<@_iH--{`ZK?^!hP8elRxFd$HEtm@0(G&fCzKL1(3;*JM=t2$*8te~%w zxHfV4-35M&raxiOWO2ut72@L`Bo4?OPKo(ATd8znBD zUKN4C)LSq&ERi@q>ssa85A}F*sm*qEL$;n6$ejE;1gN z_NMYJ#TpeOk@5GYJ_6jcDi+<;axXK>Q&mTP`+z%83qQW2I8#S{&F;p}@%S*rD<9u# zT&iLO5SMs+afbtUWi9+zzWh4!D+F$3E&TWt|9lAh2*;k7!KXHmZ8Dn{lUzkMG7?#WvCv3<7z^NAT}QNGi_G`v^l8n3?O*A9i? zuiXO}v+!YvS6|MngMpc1##!*Y378@?&Qw0GU!GJk%$FgazH9*Qty=hraSfOs%s7kk zC9cD}M|>FK)tCJG0TVLgEcnd@=6W;ERA2I21I$0nI17Gd!0a>QO#G-XKLBHY5ClS` z9v1vM1Jm7%v)~s1W}+Eq!S8xt3d}eYzm6!=Bfz|A##!+D2$-+UI1@kCw?1C-o`(;^ z+3M>8W{??Y;>YLs$tp%L#3i2o%>eG&TKKVj@2(@iM}d334*YfkbI6RdkY5cj2@lI! zMC4+sFUxlkFqfHe7W^gwGs}!K@nd@w0<*@9v*5P@n77P03x1yfbJUEp;Fqu-?|1QG zh*w{hug`iS^boIoee3ZK6(5Fp{MzE)g7tWo!iOP(vnb!=>ut6d@nMMIO!Z}Z>|T#! zy6|C$;4JvrAHj1YJ_ekLAN9Grijm0p`s@O3P%ZqDz+^HoH>o%~zQ>c_a$r`exJW%r z7FPYHH!v4g5O&9cvhT80`4OE8j?9CaJiy)%OM! zBN(2AUlDL?YT?KEazh>Yy#-uVE&Ql|M}RqF##!iJhevU?1U?M$>dXG&17@-rXTk5U zz$`c8EcE4ZU|uofEcopM=71Sz;>Y@)0j9-ctVL8kEcjgl%m6da#E<$s5tunp7Ji(6kJpi3;^SBk;ltp-N91cNANyNB6+;|Dyz+T~ z3)RAp^_^Qseg(kYZRTfsPPrKTo;C5awU2#Hp&q<%!o{mcHE<`)`I_XydYtzJE>R&K zzn;MLQ?c>n%<^3c%v>|hLa&N|S!2eT%11rj0L&IM&Vt_|V2+w`CVtebgeNf`;KOjX zaWV~<%T(Oi>N^RT1!kN@`NF{5Z^oI*NBM08rpk=7;CBR=pUpTEKgzG=Q#geIABIRh zEckhV37K&g{N@7lS2NCn-~GTmZpNATu|2i`b3nzNtv!wa^K&iyM1B7usv5b()8}O1 zE>W=&xtPkw_6XIH-!$On)q$S^%)@4!h5X(GroxP~DBst>oHpYu__g~do|Exmh*w|A zZ!j=p%{U8w*8+2s8D}aV$Cn3G4D)4(*B%>yd#e_HY>!WX`N52{C|}~!m>2M2I9q-D z0TVFeEcnd=W|0|ZsxQm85}3!$I17GTfZ1)vnfS3ijskPWjI-d^;Teo;_%NKUzCINr zk@4GOJaE&@{7l}S?dY(##PEZ+b`x$XGF$SjmZSXdZf=dUKUX`B`QBOwTm!Hwc;3t} z)_ZgtK#F2;?wEQs0&aaBaDM{ssXE}=0k^#lIPyDC2OP_HrVcpPxBd&bL@8S}|Mpo?|0Cx^h3m7ZTi89v z;1W5E1kO=-4oOl#*$>}5I0@h|aekb=aNZ_yG6GIy!eJBe{RSKCq$yj1N)=7ndG1g- zPiu<0cZ4aaS7Cgdwz0VK$04W9J(kBV@$i9yZ*hEwD2d;-mA-x4ew;VMX2F33%ALY3 z56;Tqi70dfgm~QeRTc@yMWIwpM5&JOS5*Db1|LrL=fM$%V@zi1_r-}LS9ms2NqKfj zhUwM-aUcO0;0OSbnMlwzsBBZ&M#Y-l4MnlS@l`?8NOd{^c}?)ZW*z6?OcE}JZWeO) zpbSz#lR_{e`^zdvDr;KT=kgkpb5 z^&o%A;Xxw$1AoE?o7iRj14 zy+^=4kWlU~IWov!QxQZ)N|pb_-hxARzvGmDz_x`i1ZB|!C-!NTbnR9v5hys;2#h?+ ziGZsj)LnAXtElW{+4p|qKk=bIVXwdB8xkME(sC1<$LkZ<-0olP>H8jyjfrR~{Sx$Tua(xyEUy*Xd`$4PB<7ys0=CFJSRRD9V4jp6l}Yn2)e524(PAl$JRl7+f&lYJK6S{B>#;I0F%$=Ju#Be4AF>Px^USaeZ!f?rvte(A;mWhy=W zV5ni&@l5t)@ffLYz>bxpR)iW8p|T>>^a!;%LT!ssJ0cV}-${NvcSTZdB2=FUb=CjJ z*_XgYS#|%<04gdv=5Csz;gX~cJER%I=8#~NnUxhP;*tx5pw^p;A})=Sw(sRzw(pyn znqrz-mYFSDwxC%_R+=qpmi)ixoO_>VE;H2o`#*eUICJj#o^$WH`|>=GMHO2V9V`^Y z3X58AQJ-2=y+t)effoe57U>Pd0&h{Xc=Wibwaj|}R4r2to+ZQ&ibDNjpP~&cRZlY6 zk>z_!^RA}nZDitoY5e@3VR*t6-pQBeABKkkjY#LWsO9-H3$*k=ufM7irtYc>TlDm2`QNHS%PR5KmyDVfLdO=X3G>2~$_$n_8*}#}a&#|5b0p9gWxb zIUb0lBa&u6zOG^b?6&dxFK(j)yMYl6hCFHt2}fC>9)~+3CM9D0o4R6&3AIhMf)l|n zP+7p#h4>cAelm`V&JB@xVGZ6CBWAsWPPnS6W%bUlhX#jh@nZZS=MLBLnmgP0Sw5M6 z>PXJL$`bWnPzh{Vt`S~-KEg%VTXiC=EEaFNL8=uiVfP#4YdkT<`>qeot`7j~rwujl=<%t`Ru3l3^G``v?@+|!;H=kO4J$x$(e^tViG<2&}1a$@qlUclh>mdWuwf_3nyfQXf~1=iA`j z*X0BFu{)o5efoiJ6<$r}`Cg4#i8$rr1$&2EvAAZzPI-SCi+RyzN7K`?=yi1YK6Kn# zPr17ZjoRuep`rQ@mMuSvp4#Wn!RTm@er_M02-J)P4_}2x@Z?m<7|c}dQDZG?xWuk{qqQcs(lCTE}8!hL>ZuW<;V}zX!c6tDt zIvprM8+&m<0Q(Qb4eT*sj|pIZE$mXTO9R;3nSEC!|65M~0s?8$?)BfblK(BIe*uBy zLj+O<^ZJ+5KP#}J0s%A)fQbXzHF;PT&ogu|x9WW$e*-=djtea6GK-pGQ41{UUWM1e`zolnnJJHd|NC+wlJWm98mKQ7``a~qj9v}Ti2N$MR%sxe|sfaw6j*VzNQCJC9F5oap~_1ka*;L zi^{bq+lSP(iyXC-;t@JqEflR)1bB(3gfu*CL$mULc_CUn6h9PUJQ+|uqLO-^djO}W z!Y;vo6v_;0%xqVn9G7r8wt66x<5^sewG*fuUu=7?;%tK8Ieo5b%3UtZG+d{r16IEb zg7EYrNjxyRro3w&C~EuKczwIr|I)Nplc4WsdfZ?4JT-%$m>CbVEAskFP|WMgyOGEW zKrl_weIUK7@OKpWAyg0WWZQ)?D_H<58xnIeL`7eXBrptUM^eV%@r2V-H~|8 zAu?eXyFkk7jo@bcj__zL_rsqcfMWUyo*13&+Y%r~w|>$Ka%n>Sk$2FhnIk8pT^*A;2d(%>fbs>D=g)UT zOSHlC?X5a-to$r`bmMM`i(9nO`-`zYGU%;Y$<#V5p+Gyr=^-M_ab4I455cTk3~3!< z*q749_3TRPr*~;~WS)N{>U?!2DVOPK{utogJVk8~PgGL8yfXLBn!Ox_}-@~5lzgEF$Z&HV_fn;499^U`WmnvL1mRnUj&!1|1k9s zzLznz!=k7LQ$rQuIE8PSXmvxr&;$%G`vmnCQ@Nld^d?ZEg&rwM?uu~GD`aI<`x&Us z%=;eHDyEKul5$QDmlUd-Ma6)6o#m)u=M~x}_$kJ`K2PLk9~OI{)i=ME{)OsC@nrm5 z-ywdnE8fMt8)E>dV)w%JSE#OVSh{{9F_@XED;!p!A6p707KZTNXiE!09)sWlo!CJXhJI~#IftQ)+m7f#VHjlX zF7I!5XtqN-@O&-giU4`US`O%eR8`^=;W*byAC0?&H_oCc<-&W=qSCnsN!aaKQwtt^ z!10FqrB%$}2E8qU_T!@l#27@#GlkJ-qnw;TJwA#x9!7e@PkEPKgMdA#ys4fy+@uw) zjdF*px_LO6$#;9h^YPl~ldkGtQC=b24-iAJ7W}mAerSwD048h!GRZZ+y)`bW=&dTb zdO)z%r}G+00lH~7Ei9rbIchD}V6-vNe-Cx#m=nj5Qi!QFBia-zX0CV=)YfOtLnkGh7Nx{^f~Dv{E~ok?}!Kk8^<>Nxf{ zrwx_O(9!iDb!-JFz(3Ekj$10Z02^vPrVw2`_(9fh1#w;^PTCx|YvJRpC;#ZW`;a@F z`E@J73YbKxl6e*^Nf$#yq^+8R_Mc4C_Ob$usf~LZ>-Q$R%okmhvNaHG{VsX)T2y!K#7Oa(P&lu*zY3$ z;4qpAdC_#``Kc+VRwXaSD@_&W4~>A_NCZuRz25LV2rZ?T)KF{H8hpcL9azQ84iFB1 z3niKcUb0w=sP)xF9CTN28eW^ehDxw2d#^0lq@zXcS9tAas~~GeUqnetZ=pr`K~>@t z!8s%)@M|lSPFP4NO?D&?lR-%yrjNWF@9mi#K?$Xi4E86nk-RXbfH}{`tik_0--o`X zwFtw=B@bIo^ww{zU3jWa(mOF6NOIjvgv7A520^*LcPXvdCBf{Qc1_*c3GdLtaX;FG zj)tTRqz}*YE`1=Tlnmi*H+a@2kT*tp{X>s>FE~m?3)z5NQR-wQ!`)I3iUe7rY{G-| z-zMeJI-`7h*TNGL#yO|oNq{*w86gKNvrxn7)H}@cw~!;ykF`P^WqX;*H!YuF*obdx z6CxZt@%=GVt&O2f%8S1Ui4aX~OwsAx~zG_kkWeMKcQz#NxW8abM zAMWIX0HdV6ChLDg$`Zb~9*gTvlE(I?o=cF_9@2$HdV0%%Oi${zfR*d_wB*F|T8Hm? zB>t#t!DB4Eisw_gvB$ktKZkp^M#Mn+rWhxCw+a$ln}vDnx6$Z2+uA($*6&<59$~H? z3-OJJ@%98t7dxx+LPtgOs>9CmbPR6}VqlYs8k{IfDzVNjhxcgM>wROWO`1d_&r%vrS@WaKG;60Sj$KZC(>hdy;~{+SXX-9nh4(G%xjNkP2_rk5*`)WXj;9Zb{vyV%+eRK@A7;HR9dpJm+w27 zjixOE?QNHQq`SS-&J( zjZ`!eZnTBQt^-?9bUwDhp+kE0jR_U47InOr~2Pv>vW-a^;U*~v}#zLd4;j+*oK=NyQB1-mh zGh#%=XHp)Op%8u;3Pq?p63xc+9)5illzxs+gyVO7?_;VhO3yT=QY>mHsOiib4@#QG z*`TCE`9Xcep|pro$`lQ4graT2{mlCrR4r39w2@HS;TH-=o%sE7IOv1}7arfCEZ;G1 zHL2{>ly~rA4Wf;dLOLFV6AsuAvr1qomB2Pq0_|YhhK#_1b0-3~)rH0mS1pmpw-c>S z_I4_sD-l5|n{JfNepEK;ERe3ssIA&Eb!00bn^3QfxX4HgHd42qwY(ZriT_;Ea(xw) zCA6O^Q`$Vt_mHgdV6uQJV9dN2+l~|mG@_e*pCEQt`K=g2?afMP<-#WAgG&{TT%o;0 z%Vn3e@-x;|u1CYug3BqjRyYNKQXvww$A~orVd_HbMXjlXb~;-|sYB7Sle`j)*YJsO z9LBel5!$U4>MT%Ff@sJgCF3GcQZlB3l6;Jrab)86bM-AQux<=~%r! zc_Yn7aRgZ%)h2K0t1+pFk{yHUn%U~LeQ6|va31^mU#~&L=_P+&h$EBo{2O_P=5BT%7~BL&nQeEs&DQBbL0h{v-% zXJ8=ayei`ac@PZ)UY=9}_Hy*6Yr7%xoG}voHU;~$mt$u7HAEzXCFp4m8af6+4>t%} z{?AHj{-l&10a6N!C><$EX(s$agP`*f1n;gy1oN8d_JN-=9Pn}M3y*>-Odifjk)FBs2 znly=2uP7uSn_uBXwy%H!DA$5w@NV!>eGJdIs^>FTH*)N)>v_tTg*Fuv(R5U7)UXf9 z^%$gQZzQ50zvW9B0Gb|Z*?eC!C7S95jHKK$y`hW~c^zRpdWSn%sj!*o8`=l7DI@2p zR8ose4F&BJN(-SI7FAcE>xj0rToY2>5%hxM=;8sEls6C`Xla)wdN6^ZY*f{$`Ti;z zbhz?q9y)&uHN1RiaP&25Dr)kQ;nz>_!P+IhWqsumi@M69iY#iXMO9c7%~%Dy*rKRe z65hQQ^)#qTd?Fk)UR%Ia3&fC6SeF2`gefX?!Xw`auL#tq9J&M)?N>)QR#|eJEIHZ| zkoAy1KrLdqcBr31#e=$;dGtOAu`vnMLgp>DLLae0>2OswCxnAgi1rcjei57K%MdesjfkjQ#b*zB2BXg258CVEd8ij}MngPZi)lhcXXw=85Jq{oYzbm5d`YvUN|O}L zx~THH4}n1C%;CX++c@QpJ#spKsD+rqD4;FB6_#<>4nq|?d}W?*Ch&`>q~{?ns@cc6 zGPI*&fg7r}`Zba0y%{g>c@_!O+DN6(Jo_-lm`(C-TjA#ZFh!LOFMh>$6;s#Z`zEHY zw|EpHm5+9PEAfeNJc(~9ZdBAHi@yc6kwZ`6TM9rkR2vDE+Z6PHi1|O>1LvEIOqJkN zy-^D+X36_$pdE=!#^xBcdu>3{;Z|vqv4gZQrZchdJJnUa3bn~glYM`VS}t-eUIAW+ z^^z>t>Z7z~LT_^(>OVKxB^1V;!T>q$g zJsT6zr%7}<8RCqVxhE|t)~!GYP08sk8+p{Z@tjiDg9JMr60X&f7%Ft>Ub(3NsiJ9R z!d_8Xv^}5CltT|W@U%Kq?@ic*xkoO}&EqD650B&?|2mIO&u^w15$OJdy}6r?To|zy1Zm2sc ztUDgId#irIEf<^k_5;zqNp73KO%&U(-Co{o9j#m*PRotOTDABsFMMm>poKBfaL!Bw z(=_Q!8YW<$9P2tY*f_;lAvM?cA^TD-GcJp%L~4YS4vL-6KLd`kK!{4ez0gRN!CK;> zJ6bvcDoc)38~yl1aFc&4Q&h{IV2aktr~!*`^h1sdMdua-K{N3?IdlOi`&_-uw;r;1 zPg+z<6mF60U{SQ+ExZDYnqW~hAePWs7WDO*DKD zldLzT;+`bgAa*U}MaIx;o`Vr*8W_=fy=yf#MssNG^TOQlE#5&}T?=Tc>Ge&)^4}rX zf;RX;Qy#4NyiJQeI6y^fKTiUxtDM&-IhT+1PMiht@QUa*PyHTbbT?j{%fo^k6abC+ zZYpw%Zk`y8Tejpp$#DPR^Sr)0c$o~%htFqKTnxss$h-|prQX=B-tf1vRNCw`RvrJ4 zrP7s%h1X9@rD$`uN>QmI@J0T_6mRSiX<9x&2Zd%4w@i(c=7iQjCu8lw$FewOf-OY7 zP->mRBB3k@p&jDYBzc*AT^v|?nZ!;B?PyE6NdzS&jRqn6@riI8z_+X{(o4i^nMbo* zDRb9Y)C^EEv&Uw_DC{Q4-hs3*vYX&WX_tl`?&m#(72tS%&&Eina6@DT`b}%$f0Wlx z<8bT_cu9=>Azq?s4zK>NBtCVr+-Qeh{a1Y`FZYukYpr!z48ZqkWzXVFkGwpGp=cc!h2dwj>Y4^0Gd%)=R)IVUoDtFK(*Me<8ahFBw z(`)gAU&V^%r{Ur>7B}ukuv(nP$}Co7{wPo9vrPZn;`9|L!?ZYE0Dt8*Se!nCHn1>d zZER(lmRJjTe=Nk=Q(3hBf{W7O&o?2KwfIChKESss16Z-6MP!VM(2Zxs%tqxVgC4s5 z;xoN`+#JoRYay)(sbb-(J_kSYe7TXn?NnjMP<5?@R(q)yX}Qen8=)6zaTuNpg_qaN zDw?gKMcTsy0wl`y6cX70aBsc#!IG3XBokVwhSNbqEV-k0^SUi=1K@rW%Oz5Qcs~*A zwzQgN@H*%DGG*OXmQ3LIq&H>Vb_52aYPN+~>*ZmRH`Z-^Z`YL~=ERpx29>JNa7bqa z)MbhDu*&|fR0wiG z4iuB`BGf(5_T*v-wdlqUb}4h7)@QGdDXpq)Mk%}=XTIybt}Gn7tMU4?!@RESFK}oqZ85O1OL!^ z@1VUi+F`t(h4c?{U@xP7GgxK6x>kpS9PC7UjYGaCkjOktuVQypov1Hwk~e63#bEB> zDHi=`B0~igyBc~!1=Y7N_3Jbb)=lW~y@e%y?Gw*49%NU3@_=QJHM#B36)Es;w9JKx^W1zjD_A>8BP+v1elSMr?xH=}1 z#s(N5+=RQvtpS4n*_f4oqEgTQaZFRQ)K=4CNEVhbkcZN{QHjl8AqNP#m}Dm$%=7cu zYHb@B%v)NFtkBZF6P#(ypcT%$0??IG#B0ji__?;ztu8kq9Jj*hKpYUhCs1WWb@>76 zc4>93ZFK_>{!jQ;0r=Vw_@Cf}f5N{{PEyIK34wp^U-13_{EH#*(>OeT1qX=-uL6ti zXN>atTfxZ=4x)@ua94G&KoB|oj8G64En-mYt6#)F&l{cT2Q|-Le+LS1ogt@>{QM6m zE{*{~*-EyKA@oTFh_(zr1&u*b^W~Rrpnd|o?jx}0>8h@R6rHw7XN!J0aRtM8QUe=S zG2(+cG}MMUs*(lt1^he zoo}8uDHA+uV;xO0B3((GHR2rBs{C8tHORMXV9ZhX4y?e-o{cohq#H!2NoH4fMu^vU z%{>7ISQ$0qx1%u_+}>5~!~ZPbwDL6+lkDoBvRqk*8p^v?@1nDFrG%r6C9glKt#{C8 zt_5EDQMDbF(-0E%NsyZ&l4{2*4kl1+I*vXe`j&6tH=#ddtDM`t4}eQPV5E zvFHH3u{*u~S6k7+#;prmJ&%7_EBTbbvlHIYu4w6hk&dX;ZAVIJfPoBPzwxNv8-6qk z1Gj#8zU^z<1J8!(OG>KmC}qtpK>m?ki7rW^hlsHjV{1ge^{SY2@l<;2 zP9nD0L%c_Yp-@(G{Lu$-N_4(R6h5Rd-^hFH!Dk+iNGourDF^Vs{Tve9p8u-PthO*k@`-Dbo(x#DX zjqw^KfK6rjPSjE77!VJgFp6fVDA!$s%0+dFy{-4yy*zy@FTwA?T&Sga!Bsd>#<{Dq z(a1r>01h0?d)MN>fVd%~7mqn`Hbs=}Nif|SN5AzgrgWEj z5Aq;dPrI=Rqz`utaxk5HL6O$|HJoMD)-migaHIx-sL`BSP3+Rdi<(%eiF8f4HPJ>B z4ow_o!iVRE_-UY_S3vUo55&+&B-b|@v-TNS;QUW|uJ0Q?h`L7h4X}n6;qV~(vNLcg zsQvgvIB2cpat(mMYy(xya_@nvU>+^cKg!g1peVKx4myc6 zh2`okIXaUxoq0V#eZg|67H>GHCz&@6)b%Vk5tP`t2b3V*0!58RgyUC>_ZO%qnAZU!o;s%2z315`Oa5sumT7R|IpIE#4;E#7UQ{EU4b)SXOi05u7p2!3RhV1Kpb zPJxn9?%C+f1RD!VcsGLD&swTL$r$(zP?91V-BUG>aHOJ0$+&nJD3QAsl*p|BC8=Bo zN+!e~fttqHUo6Urf+(vMJwOSzA1J|I0P1l@TnO5)#O5}Qgn#DHySyY@woo`W@7L{jFBQ5G$i<)Rrr51IAMJ=!> zpGDnaQICOYIJ2RZzG#o{1U-c27aZnnf^*Cj9jZ<_D|+J)Sx-H+MPu8+ItYq6oppEB z(uZo1I`oJ1WR|5H4&p~ZsJ%W-TfWBq)jlkd{Fn}-w8n~Ci?GU=pwBquw822ghli_V z%N&Zj%iSoZdH(6R(^_{t#9a?A_7MuS{GmgLfP+FFkr3<~h$d-XDTL;idHxBw0bBP3 z#4Tg_yDBLG)}2l@!><*##=iA>g2g20$nCi4qE%jPAW_79f5m4jL zp&rF<0B}%rIQnH(5ilpiy}#-wI+19aVvnIIRSC*jq^0}lfLkn7@B2Q2#5}sW zJl|oh_x~0N)*u%30WjNs#nh0tXOHA);;zY9Hi}9g5IwXAT~yVly{Ley9~QoimQ2Rb zplOn9Px0<0ZhycD1uP-xv{&!D;Tar4*=<+j4lBs#b}NdigRRgXVUy1UxY$) zmuCey*hq0envRel>9}QRKaT%l<6ZJ!@2=2I6#8+ubZ0Hg(!S%9P{E?SE&~PFh7~B* zUtHDYtXj0t`j%@{jq41ohSAp;`YLsuu`s3*O8B<2Y>3l+04u?ulV=lFeF2dd@Mbx-W!fiD{Jt@*rS=%g4boegLcg*#Yq)!Rc(!RZtGW9NjN@vQ3bA1+kbV< zYl$D3ZJ0AgIK${yW;C-(6^njly79Fvs*){lN>?E`J+m42_iitH+&k!l8SPeJ_bRHu zTffOon?zuh{d_tr=4_mMaaDgv_mE@be zFfR-}!}Uy2kF=brKA=KQloIyIGok4$S$jIp!CAT_qB}d{>$0Of4WikQH9_hLjU}v= z9s-H&Bs^z|Z;|1XR3mWS21hOEmKc9|%oXlDAix$Fp+v%=qP#;$owBGA%R0gbVSylzbo*u;{N;>B}4TX69ToG zQzL{gyCC16osN5ec%hVUnIb(LDzlk|D9-tKd=bX5yKvm>D1rqn!NmyHFyW*8;w}!_ z9H1?2ub9BYl>$sq8%UKAx+IRGi<>;GdcxF;Fjd>Y)G;6$Gev8K48u6sKhlnW#fW^h zhEIn!WO_%&Dh5%y`6NdGvk#aB4Vh<%-az=iipgNsV*i;uVmT|on0YUiGG;QBF_THg zpf`X?O`h_VB+GId2(b;KLB`UmZ6#bn`{tvuW;;Wz+0rwf^hR(?S;G`9Z%JwX9F&Bf1XY7igoE-@LTP!nnt4M(QPsw>FsLO=U2pLgfm+DC z2S5qpRV(xzP=ff%;{6Ir5VQa*!v&W`(PUeAJuRxgMH%By{kV2_LJd8T6z65|TuH7G zxUDb?$CR+ASBa=`PGil7|Kk>W+K!uvNYDswHqL5rf6Re2IG{uh`qfo^8UFJj9RKi0 zY-4%npCnzbs=?s>cegE z5Wc)Yf4CNeNq{%@G&=E?t_4&xXjc{|)wcbe=UWv+2GFdpt;hddoc#!!;Mo>|fsmft zZjBh^@P>a)+Z1>_E>2SnqhqcdbL`vtNK^3m@fwUDw`Mxs{+!4#q<2YX*w)N&H=Q?` zy*0B*(};*AnGyVJNoG@Y>&;{@(6@um6hnnCEd0C06Xqj174}%_4q!+xivbf*di-!SZS8H$>vZPk*&FXP2DqRB~wZ*td{X;CXSbYC3nF?R)(o^k8oY+rYo-8+mOY z->fi?RO9drH48X4Q_%<8!O8THlm*lpdwpNij<7fOD-@hT==?KJdtDia4);WvT$05C zhp;^y<_+KK#d9GRbJ+tX_A8nlrK8y7;q2`i=(g8gu)*I3k)SG(Dmht?dj;lTKaOw9 zcY9;sr(zVlGcWuk2CH=QDk;d=nspA&Hmi|Xy&Q)||Io=gLY+>>&uBA=Pfz>qh*=3( zUN{P|Jb*fnjvOsx=VoDmjk5@PMWLn!P!DLfiG$GG>^8@u-+e-w@v zjL@f}D{kZC`HUppD}cd%vKJPYfK0FXK0Lku3EqL_jbogE{pf@zIvd_x7E=icY#9$( z&+s}rLd|8*i2Dc#Ng1S)CuMM%#iIeC@LC}U_TyKCqdTZMOwn@MUZ!a8X%ACWek8OD z8m%Xo=jU*Z5`*S0et$w=5;ZB>GYp6;VM7MMzrWfvxtDj`rj6xvZI^J<#pr+c0{q zhT{LX7FsAmpV_G0_X3dLSxBJ>87;^?EggG)Yw6fMKFZPdt=6?syIRylmNqMB%BjXH zj^IOmeGfunFBEC%BU-veIl4hZx64{Ox+S)7bc^qNv}0}iU2SV56{(QY*C7z1MJUoj zvsU<^dkaVR#3)Di_%n}ouI;$1eNEfaGsd(jAY@s9hB`}wP^2MVG&JJHPf3NkXzC&M zg(5V?Pup+f=w23V|Iz?I9JVwFMH+^Ph7kGxAwu=_BM7lA6d|c)(fJ>R{BMc;Z{cWP zCZ2m*L-GG73oR6(FA_9%Fj}D0w1{uYrDj|J>Sqfj6rt#d5NvjC;pjZRwWIT8tsI@< z_s(VQkG8E9yR^utuOlEN) zVUEayeOZtO@pMtB$VFLH8&HBEsW0%+S18@%M0ckMN2lM;aYT;q!?#^(l&Mwl?V(Ok zB-Npb)~;hhZG%Ws>?VnRP=T>AWki~6iC)rq*1zbTZs`S#b<_XG^ol=7=X3v}mzG+P zQ(Qw^qlUIZ4Mk18)U2VG1eEVzU{~^6C`$E>qNP&{M<>+tPAH|F;@cfPqt>;nRgJWB zfn|=yRiZ&C(oiYsYZB&Yg7Qt5Mo_58k;jB;14(R#^uwtd@z z=p~($Px=a_mlo4WZvO6IIaCEwHHp=wCrgE(t~XK$`|gajOVNtAkA)O+IeT@)||?BeIk~LQ(Az6iIEt zM_-}zuTrT--axOE-vqqALg}ZwJ?)a9<4q+&q$!O;QCcM4r1O@4(fcCn?Sj4I z7S834@G)TpfIAAHnDl&!PdG7nFtcSI)M!ooCOp^J2h zEcsWc_MiksQh(v2FA1l#2}SzXi+&}d^_nswO}0cY>FgMg{!n_~lJuj&Y3aP#5mBl= z;BdI1oMLPHV7RhQ|9;0ud>|CXkWx&=W}EAi1+DBU}a z^lQD8e%ronLG-RfXbnF43Z?gBNq-;o%+A{#t&X;=ZN95nO_S1yG2sO=Lac<5&QM|d zfwr*p^#=&?gHV)G8mWdm<~i?oKIV)JYa7-jEI+I$Y+6`(n6q_LN9#nFqjgz}qmebz zrytO&@SoZN(IymWqX`teO6}{x)-0!xf*>i%KYfML{k!OfNMKB;G>EimLG+T&_y0xjDNApl z_ZrhHz960Caeak~uQQDE(1Dhb@({juz$bL+yrg^+WP6LEQYU#y-?U_|uTVCcu?=VQ z2uJfvn;g}pH&a9K{{%i#x`ZMxwUU@|>5>>}1cizm@r9yT3WB62;-jxny6Nr?RdUN) z@}jUtG^Se+Bqi;KXb+{E=737~_!b-!jc81_AV}&t9clazrJK$yLN`JKV?w1sq)iK= zmvp|2kG?|brOkKI8|b~p^olP?XN^{h|Dp88D!o*?kXP`v13sZk=OyKvAgOc-)ftrJ zWeuna0VOz;4SIi(#2vzx-p1lCdPygZQuP%|FC9a`C^iC%UJFF-axISkw0tThRw(lP z1%i0Jnd9~HwvLvMG^=g0OP6-pE!7HWolDR{5jvC6+((Tkuh<9*6*(&JLXm_ZXtwt) zKKcr!J6Cj5UHYvB@7robW4Z-FQZx?NS18>Vi*ASn#)SMY(xwH`OFI4kqL*%-u=AC4 z)76+>@dfF8)nBebI_?8?Jic&!<6NnLwRFOkX zE|We_qbP4gmhwg@D${}@DeZHRDx6XylB9p4N-_Sa5);qR11ovHfiPfA4>nDq937wv7yo_(q;-oFX_Aze$ZDay-z8< z`1gPE3F$5R7u_#dai$n(UpE$K@ipnZ?qBr2#(JH!rjdAtqf=R%qt^PTDnA!C(P>86 zfi@{WLXoG|iH83~IsWr;l%pfsppJ>H933ykyt}q_O;l;iF@#?l5D!#&r9~*xvPrZA zv<688Q&$rUArv9D3F05tOLsv+Umt^zm36>2{K)y2Gd%37u*TM>$rt+i1ccZTitKzUG3|ym;qjfZ^3=)E?HIhX zi@n1&{(TK6X-k7pq=60$qMhfp!j3Gf5v-pPR4)WUwM`Ht;yPFIwFrYt-*|0%@gHV4At5%@sS4VYEb&x146tg6s3}$ z|D${`z5@$t1cizm#ZV~nfgnhVMuz$drTaHq_rdmj-;qW%rdtpsbvz*VL+SogbVD*Q zCgfj{HZ6!=(s?Fu`U<6&+-8qPv@aUdE50C|Y5$_PDeLXht(l|MBRm=jnBQZw3sExj zEwJ?OMX2PPP?WYP*5?e-!;V6zzCHsXNTCSXR*+qrIl3LE(!2RzbZ7j3 z#F=ykuB?Re1>G5g`9O#olL3F|>kAN)Lqbsw4QFIpd|G@;QfgvSf;%}OE7hHlm6eRI zr0kTGl&qB0)YR;(xU8g%oP?y5)a1A{caA4MCq5xNBh#IlnCi*)WMz5M;xj$TnFP*A zh|f&SigTxBWV>?`lCzRM*(q@e?u@j|?5q?|W>!v8VrEWeN>WmiCo?WFJ3GUZk(S^| zO-qeS$bpH>#GF)ja&lHYRJn6fG80lgsd1j{gt)ZC__Vl`M0Y|?PGVYOa)#TJnvjLR zY8HqV@S#b%T%mlY5DaDcLcDv!3I8RDuN{S~tH4Fa}QrwwwIXOv58Odqc@o{mP z@fm5^Nm&_j*;($4oaDGHcUD?zT3T|v8xDzcXD7xbrzRk338d2#m+f|ECM2YJQqq## zsmR;-tgN(TPa2%zNyiwOifBmPDLK)WMw6|6Wnlcd{TCD zB4VAKoasqSiO&K;kVnvv*9%Sy<|@xZHTaS5r(NJUCYT0%-rc0xjqCm|j- z<5N?Ul2Q|prnn4t9b%A}l#`O3oto*+OioD5NlOEnm4$48`?B2#Nr}%)$%%_kh)ax* zL$OFsj890+^dJM{QF2mJGg9MH5;D?qQd8mg)Z~Qt_(XS#Cnqi^I}7p7j?c)>NKOGD zE-5D=8)YXhDIU&9iA#dJp!}#4JY~av;tT9ewEtPxO@H z8=_~9ojQ5^*z(CG)6b7~Oc*(A(w(4uA3dtcHO1RGx*2vbU7TWN*avC%UoPn;f2S{vF#z`*F4#buKx z+Vpw-J6lH`;y#uc08W%ig4W7bozlezWr$P zNBK>w2yV`=R|~Pu?(h+Oq?f4*TTu+)v)0+s1SF z_S#GS%K72u_kWr2@iosZn10U1m%h|-LD}Y{p0{3D-gHpSk7Fl&dEvYb)qA>ZJ|{7` z_mP`Aw;p!Sv?lj8D__x}+gQ)W`uC?CNb8zX@Zl{Ff3zd+Nk`Vym`m0T`Ra~mCe9j} z_RjH&Ezun=*_Ha;Md!D@W5Cqp_)mXYu)X`ow~vi~_vAyXRx~ZUV^=q4?sZW&CaqjG z@Uu6TOj!2SsR7$s4DGTpV*Q>Iy0Q3)V8boH5>Bo zoRwvZo>=w%H@)12VdwgHMjm=>=L2z5pX(E`c3}Rs-~QR=!C%_H_|l@+=k06x_0?A_ zJ!|y(8<%e=IeXj<)4R8CR+s+WQ+qa+oxZmF%N=hxTv31J(Y3uNq<6bube`wt=Pp{F z{Mes8!`{FCrLGTs)}-jW8qa65-d;4U-84Ltu zd{y>M(FeOeZn5;yiTOkOU+~r=z5MIieYf?gs+x1JKlQ;QBleHFO^2Uc{n*y)=T@{F zHEwLh14U6|n(a7!II+W7Mc=L-|I@8sN1ZGwYLe*~b>GittQ-8&-^<4)eL8OLFU_vL zdX?7KBxdPt1J2rb)z^J`%wDr_!&_U{J=tpcxvN`f{pUQj|F+BjF8l9;i|%{Bbk*Cp ze%-Gz*lxn0IwT5N`ec3TpPIh)vn>;QBy^j;zUZU5=~PueAJ{_4p5WgW-wS+wq|jO;(VjyiJ9s%5uzez5ax_wRo`G4+KX z9-X}N$9slnR*(C!rw+e$Mc(A^Q^Va+VbwQude^x=>7L6MT-3dIQ%X|L0Z$*e`RJH= zi%0%`q%fl9~*;m_q$c}y&-F#8Eb$2~<SFY}q-2B7EO|ES{@80v?-2V5P4-TIF$dKvFA7AzGTPJ3Hd`|A&AG~+pD??nZ zmt1kp%Xi;D^@%?7wx561pt--K+%mmjVXLK!T1Ibpw&k&e3$xbe9UNcw<+b9sc{lq~-5!Tn3-7jJm}q4QG1`u4r6F6O!`o?FxJsS?+pt+(cG ztAD9m{$tw<4i5Qm?_&kG4QP66)^#Pf&O30yhKoCwzI~+Shd2KDLqeyz&l7gee!kay zpZBrJX)imf?!WFA$IqpUHx3)}ZED|nzqz0Ns@w4wd*5{DEnWJK?-aFbPWZF?x_DQg zck<|z-xl|~s?`^N+*_CUX~%8bHkADN?YDQu?pk|&X{_s-rhguK+S~lVMW^q5>AkPw zUK{)O?W)1#@z;mGzwY$%qp@L;FDCr> z<&hPO*8F+jo-aS`TJ-sI*C+Nnbz_gq)|=)lio&VS?3?1@)67F{^6-?RtzXW#YaUCBB=7p>VGKP2w< zn-08rAo&8<{P#9ww43`#pDmB*dKA8U-c>8|d+e({d3o8guebjE{147EK6=yh?YC2B zyGA`!adJXN_qT7o@$!o{MUDOTsqVhyH;UF zM}?m=>ZTp5pE$pH&TpS>zi`6T_gB3Cbjml*5vQKZuATGpfGZ!m?!l+N$#`f=ll%X3 z#RunhZ2r^QYi|3Z{^~Zv2aipfGT`%wRjIq1AHVv^_nvxU`r|!5ZF8h|_ppr{Pj39? z_(yL(vvY3O?)RQo=6U{|_B$iK${pMFr&o0P%Km!WUeC_cV^)!e7w|E*|U*xxfY_8Rg@yBpIVOrGGH zH9PhJhjZvPBOG%&Onk4Gj*rfVXTmRgtZwdsKI5A^3(GdXdC6^GtQ>k*)r0GLcC3#Y z+wJ8iZW(oH@3m#`4LMn~Y3}{D_9-nf@&F}3$ zku^H}?`6Anxoh)^zfF0^RiA#m;`<#3o<4uRE?1BDymj;Ev7a}+bkdWF{r?~Zf-`jj^C3_2aR4|RkGuP4M#?Gy7-s!XZqoTO0 zGP-Qr+UnVHF{4`joYJ97=I=v4*^@ry`iq|#v1)qN?rjIk`=p&FwSG|e!=+_AJ{i;EkzXs)-}$Nb>XHGyGg8`@w~4*vjhR~or(CuE~bmFDS%$Zp-b>Ot|2*W}(a|VttD=sRZ zSxj1J))VeLk4WPhIKFsX#l)Bq#H6`qxO0sWPCo{g7tbz_nKqqh(jM-lX$fiksGy5S zaDg&3!3%ee!Z&FgH}A(zA{{70>yP11T4umzog=T)CF#L3STBbRE%?#$|4&m#{uV6L zjAiIBAzO{R3MUsSW`VXSw&BikO6K!TVOYm#DASx}Xo^bGRgQ};50;@V#c(HWhR~MG z@|vn&f@LT*;m(y%PcmQE?tU#;hNjcuPCA-N8gsf|_GYk5E0&=pI*QNM$>%K$mLUt_ zPC7tJdTL%6(>qwk#WD}!n>0Rn!5_)NGBl|VchW)7wx9}k6sHHvoWU~WCGy<4Z5D;d z3qprG^~&WEnb;L~*|8?8wo)dM+JDQLIw>1hkP9Q`VGM{eOZQLPUx}UPL2zf>Bllj zO6JjN>p(WNbq>p1tYj|ud;_A@P^Lf2(B>z#Ab+-B{dcfTEX&Zw;v`V}7QIs(EORc) zP&irGH~lpf-iEdYuncVzQQ0`ZxCLC^P-Y;@&?XSo>QT+lzAjh>)c`)Ezv0dde3OMfWByYbECaVfW(0lXGhp^FzTkc*o@I2O(&13-o?tx*EJNEIR2%m` zb9iO2Od`wBf*#!H*ppgyC|HJaGu%nbvs6#-IPu2)B2zSW>eP}Vu=t8bDVB*$fZ%1ah549n>@XIf=FQLMA`a}23eeC zL7WGJIL`-hHU@Ea1#$KVaefctL^?G~$FNHfM<1TEJ(e3JGcJfTGl+9@5Qh%S%B8Kp z9K_ig#GyluChF%PPMBmZ#I$C614wfQ1j*1L6I1gwK^!`0Vam)2;@lF%c_fJQY7l2@ z5NB@?=NrZ8WTlI?xad09;?NcmUF|K-If~QH;-o812a7X8aXMO@>lCMj#i2(@(G_KJ z=plA=wYE4R%Se!kI)7Ih~R-85#hn~YlS96O)PjIEHnZ=1$oJfn4uQ)v{ z&KSk%ZgI*Lr>n)eMRCryI4>(sPmA-R;+$!54l7PCi{nD8O;@zV8K^kjEKauK#8{k( ziqqHPELNO87UxmLIm_a#SDfA!r&e*!u{fs{r@zICrU4MHmKG;Yaau5a&=3 zhaL_{S7$4R?WhC8)y3kRt2hHJPKM$Pv^b*`r=P{CRvg>&4+n8p2XWpH;v5X(oC@N! zqDcm>rm!xRFJ5utEl!r=Brs>%#0iDd#?F{RsPinDYn4nBi*udgL|B|zij!n9W>f$>Hvp^ zB7D)vnmKVa@}P@Gal%RC-?+g`a}qR%WsDpSZ&C6lBbO>-;JtT{27qZK>)XilP*p^+M+ERXfp zoKz5eor7Mcx$@ z)!*K~J+;q9{iIMV;|R1xj*^un5RONm{Oq?*maS6?#WIF1O0jJ#e(GH>*{JqZ*m1Fp zVGEOCpr{Pf^~C&(e>&H)b*@6OjA3gKWNllm*R>9}QF#i*GKQ_ejA~DYa4pU(`mKXy zYl=d#jA82n$lA6_-c25AqZTO?%NVwXFe)%z9W7fc6^dmHTQtM7ZOy*4`2ZWWQK4AI zu$9gzsxNd!Hgmnz!m{#4won@8&NNP<+D+LDiq5YwlWx{ZB5&^xMh@O zt0Pq!Tr6YQ$^_T8byH^HQ5zMfP%LBE%3>7NDY`}%Jo{B^%hoW3Vj06$He_vES3Vf# zwNck86w4U4au^j@HdmM9d<7`BEQw(g%-R%4@{P$-r$YYI@Lyftxzmu z*cxrvdiuc?l{V@xg<=`Q*42#CZSQw8-mL0sm5nYmRK&$HhOKMBwado!2imo^QG*nU zWei)_GD?^E!)u=Z{%p(E)e6NjhOI)w7S%5swM3y<#;`SpQMw%Z>o%m?s8`Z=c(? zepV=!F>Fn;(gnitP!n(8o>tlDN>RYYGKQ_m;MzX??X|4MHY!7*SjMn*9iw!+(e{lK z<89O=g<=`Q))d25)}&WIvQaA(ie(I2Qw>|&ubYryqt+-C%NVw%8MY#(_HS*YY88rQ z3|rF~MZwfYbuMf-#70G)0TwQnF>IB9Yx}Tnd8ETexfP0K3|pm)qH^fO=k8-YzCF{* zuPYRaWei)_8@4(HebsB7=Mko}^7`A3JO1B$37PTK`qvk3U%NVw9Fl>#h>M_GcJ)=-8 zW7xWpQQC(I=ciZOsJ#lsGKQ`H7`D#)wIIw!HED-HTr6YQx(VEHXEeUahpSiJUJ`Bj zFkYcp#;`R9vUZt2d0qQ2ZPb+t#WIe8ICoJ#j%uhp{Zqy^^s8h05vv7N2pJsB;A<|v zF((R`WzQpyH5>J;-THGkD~9uwEtWB2Sji}z%iVhYzR5;Cq);ql*qYBMoy%_@PkGr! ztyd_PF>Ea`Y%QyrInqXbp-?Pi*s3yYB~@M8-bVeUP%LBET4>nn`0gFCHmVy%92d(N zwyMFkN0pH`cOGP;1}hZH7`7HMO8fA^W62&Hb+tmVjA3grqjc&0GkWuFHtHsYVj08M z62sO_{f_OjQ4c5-%NVwn8n(tv?)jsQTCY$nW7xXcuoZdUbE|CB7YfBPhAkhXy3sd2 z3);nAVx#_2D3&p7Ei-IwXz|(*8`Z4?0&%g7VapG$)GrEOcXk&yzj~E^I0h>e%NVw9 zL8x6TTfg1*2^%#*p;*SSwVY9u07}=5A8$yqQOgyIWei&@3|o)9_tAqkYOO-CjA83m z!`6Y$qsG{%ZxxDV3|qGuwq|zS(8fl!>4-pFEMwTZ9bCK2yIvZVXrl%x6w4U4?qHNI z^XER%=RF%WL7`a2uyrS+beX^Jm%68H)U67|GKQ_YOk3k`F0)bV6^dmHTX!3_hWA+* zW23%TD3&p7-DB9wtDJGbMz!sPKwKAE9pinGh*m{srk@%+T))%gO zsE^gB)F~9p7`7gQtX;o6f9Bq9qgr)lReVFd*?&FEDAhnXocA25JIk`=Rw$M+Y^^kG z(Q1#4x(WU1^*{ItUie(I2j~cdG-rc*G zje1R?SjMom%COb`*oVVx)EVz0F5-j+n~eK>OF!kcVVp+d2YVe17(1=i(rEFUgY zD3&p7y=d6-?0WO4je1$3SjMpR5~HH=?Zjv9$&G*Yw`}cED3&p7z04?`u5(JN5^R*S zD*|z`jA82)aP4s~?ZULQZ1qns%6 zn%aHLSzRn!Vbq1ZRq^xmfn+1ppIJTn+Nhrtie(I2n;E5j_}v3d&ahFgvk-`jWei(ez_s)1 zrFIwJW252}ie(I2Z!=1#EB)DrpRiFQ6pCdGTU!lV^`CaX!A4am6w4U4wlRwGi>`e; zuljg^RSxe~D3&p7ZHKI#u9?$6X>Fs>+499QhOKuPrCjV7I(@;^ftIb^3dJ&pt#=Ju z*>{HjV55FjD3&p7?O>E{qiD?5&$897J4evLGKQ`93|n2U8SuW1%2p_rF>JlhDD6Yq z<-|i##e`#~La~ftYo}o=Y2t!gZPcR*#WKdK$Onw-ue2web>M741+I#)j1j|KjH1#@ z7wwzJTQU4V*UCI^f}`bEL&kc$iBS84CCH_ za}FPYYuozn(nt5(s2GJ}8N=4cjMB9-eAeNUHY!`8SjMpRiD4^u`;a?r)Fg#s8N=46 zjMBBT#hTx)uu(pRVj08M9>Z4egz^1t)bk3(GKQ_ajG~%Cz24WYAOGV#%ZDE-6w4U4 zJ~M1B{cdTPjXI!EEMwUEoKf0`Q62mCvr)$sie(I2`wUy7wm$Nljf#jyATE|MY<&T) zJ<{vZcj09=s$(=^-#WIGiZ^5-~ef{S*g*IwKG-32>3Ig-%J8-3JPaS?RU?hi+nXW^`vG&b>>ec*Z8`ZlfVdQl*W`5Oy zYujqEXiuGuDo`kvG4ksNM(O(HDf|2n8}%QBVi_Y{hYefXua5Y@Mm?@jEMwUEkx{yh z+IakAo{joYp;*SS^^;*M^2NF5+o-=3ie(I2KQl_V^F@QsottRoSKnR;#Kkg(ts~&t zKBScj8#PR!SjMn*lu_D;ldk+~myMdPP%LBE`o*v{woT`IY}D-v#WIGiV~o;1q#3=9 zTBA@bW7zuDuytr;%~2cmr9!ccVe2;|U0a&By2D0=osB?TEMwUE9bDUovBSpxYNPrp z6w4U4{$Nz-bmb`&%NVwf8@9@pjrp%_>w1M^8N=2I%N7Ve6X>?e#$5`M0WK2{&IN{Dt66}b4LB>Q;io%_0u;_Sbs&k=@aw`GKbyK4qh(Diq0>D7stCwlyq% z8GV%oUk@#Rxz6y8`|Rx44IyW6LL$lugqTj>1CRoHurA;f(U} zlS>Na-nhaNemKw!1dc5#D=(Z}GOln!#q=Wl7BSp=KdoeX;mir@UOKIPTIuA%$j9Ft#4aQWuGayi6VsUxlxCVysdus7?Lu>||U@*#x z$BsuLa0}qXVE(wt)5n&XF_~31xx5&bf&y?mLm?7lC?Ov1Ei`yz$Bz$^n^7??B(EWM zTE)~LxoIWA`if^GE+yj)yAvi)omxn@YLrYf_#s#mi>Fh@PYdwWc%)-O39_zaT4DJO zr42#?{obH_O@nuf%PRtMZ+s!;m6;Kg1!K#~XV@_tUsyrYNW;(s6r~xH0%R<*Y{po# zoDl6D@wafRyHVumzAi)X0tnQ=+~AX757xHM$2C|6G)`$y%C%dqlL z!J?cVUDiF|vX8%D3ivO3;pokeQ zE@ht4NE2g5@ze>0<;64X1QnI*PNQ)01S`hi;#RI{B{PdrGAG#5)X*1|log}OO)sa0 zET~@y47Jo*Fe>T;${sS~BG&N~AcTy@6fT9)`kAEJE{Hf;M7iVaa&A z#iSIEFCJe}R4gr_-7=XWROq>OPcIH==L2LKR%G=&KBygAHg=k+)(Q&*jh!()j_Y~( zSi4EGn1MZn#SH9*C@L^Dqd2Hd5N?PzLAtnx?SXJZh{Hl)nJ%18nJ~V%klP$9A4?`n zyHEee-B5^=Ub^?@Xp8p1rYwLRlyZ>{OlE*|pi87M(w&Cd8aRls(fU+O*S!QeOPb0e zlr*Zm#G&qxddb3BlglTe*rI~XD0WO5J7W?$W9}xY&96W~ARa^h*(an_OIVc}?IiU@ zg@r>$cwua6aakrc+BC!}E~>z&;|42gB~vCBJ7OxP&zd}ae2f}##qgr5^-BfnRFg%n zZ%Qnf9|92Ae}=#r!6D$2rOOO~)FF+6xL0fxD4`+1R@WN>YKMgYs_r=iOoucIYAmX% zAE(iQ&Z$7Bt6-|=jan__&=8iXKvMM#fwY1`z>Gma2&@_2xB@j;Xk3F9Xk3LJRWz={ zk_e$hjXy$wbx0_X8li+j>7b%XV<%6KamNJa6pempWTSA61PU_#pOB3N3NqoJkc|Wi zGVz~~jRb~rk1<#a|*5D4Y61|p%n)j&kFn1!iS zbM0)P_kR=)<-A6t5z38?3ODKsE+`FR8`w*TMpG(;GRYjCHimFzU}z}s1%^wqOos)A zhw@Qicqq37h6_Gaxe1JYt>*SvEO*O;LW-ijBh+#@X1DVAB=B2JVfRpk3&rV zL*!#4f)XV&%Nh|4mAj3Iiq@d6s_~fqPokpL%-%*KAaVVlME@UiUji6Kk@eq04-g1C z0YV6e5=an~!@zI^gEF1Wzzif11OycgS3s1@9DvtK42ZLBL{~p=Kiyr=b=PxOP;^ZQ zkOSmaKwQ9M6~qHiu9f_Mzp6f_CzHUpyWjr5g6UMh{=HXKuU;M9^}1S0byj+lQqKx1 zr8-TaNvUTAl~SDs(xlY0f=a1F9cJ02)U$#%VXWqprY6kPg2WIbn~d>DDTWN^by+&6 zfjJS4cROYpQijuiKPq{G5RyDv2f^xJF5D8fyqf^4613`H%oafD zjXTCdsrN{=LSSoA)l9FUgFqPK;WEyRxE*gNOB&Tj0 zfMQiZ15hm0HvmaVPNg>h8R|Cn%``M?oQ=pICp~Q@6fZ2CKBvGpV!((IO?l+_e8YUh zA{V#l=%auq+n1k?Pty6ujTsfn${IP=cZQGS`AnuzmTy$HKPzWUXr%89-;;Cjj0%h! zInuBB&hQC1i-(yToi}Fm*m2{sd;^>QY@5Y2*q@yp%npsr@`>-9S@f)+Z)8^P=-}ua zzi-6g5rgsdvk`-_L^5Kq{r$5M-VuW>hM}W!MukG7MrHftH_=86u`Xqe^96JA#*7&| zHsF&VEgLa}GWk`r5oy`}0V4(*Pqy*BG+c-jn>E^(lc$A7jU7AAHzIA!m=S3?IU{mL zq-lQqvhmBpPaBbzm)G!@g=^W_UL=;LktLUmW5-7SBJ-K$&&~5gkBwy0cwW^on?pzA z<8q_(MrjtOEj8#HJ$6*q$Wgg@LX#1trr+g=!JH#d9nNx(^Nk!cCNOGjPS6q=r8Dr2 z7=-!|Uwm^g4+sQuM{6TPV|=WI$o0;JVx{xq0RsjNNU_6!q5NDRztLyY7=uX+88QTa z2M-?T6_=*9o^@xcQvT#C*Dt$R?t4PNxX5q5@En(vyPGo>5n3kzXMgvFSKh{NZ4}O@ zBxFT;q!L%5D$0@;jM>4bxW+~96u#pk%G4=Q;CvazKDezifiW>{-6SgLo6KM4)FtbzTsoZBE`bd_xLJct~YRv zl_LeXVgrMy2(jcXMFAfGuFZuK(*=KG;dr_8MG|8kW8wJrPBw6z`bd-;e`4V#fUW`a zfPu609I+1#CD1qiH3P$Q246zDFY>)7(%Rrx2iyk{@&qo1ydQyS)0bS*4jPk}1WXSD z$Na^T*PC=;t~(2Pg~0sk4Dwjs$AS6tS;+e6S2*ap9g zfEf~vi_#zMZz3?WqH!_g-2u!!(YPpi)ZZV0!7Gy@(4HHskNv=Wc?NkbM_hj?%RDwF zFA=yD18eCe!sDI%tdGkY$n*K4`yuu(SDXco{>9fez`>rQ(xtp<4RA;|!WS73B^e64 zE(*s@wb3PC><^68Cgn`b31wZ<1BdL~i9MXeaXJ36T5e!Mj}$gjzQ*w~em5$vw)mrD zUov%45!`R4(i?SZZb{MHnNxEEmyZfe9Wy3x^4O_4W2a2;kIA1n?()k6V<%3XH+RNV zj#`+!Em%-6Z|clNi>A&fnLBUR)Li&QPt2Lnf7aZ>sh1bbE0|tXFtu>*qJsIe1`J8> zzi`I&$|cJ1w%l-V8@}AqS9vVVFSy9RxpQY0E-YF&yEvuySBf^y_)UWrsg}Y0xd7|M*eaRU>adea~xg#|~ce@Xe38N8j`C z##dH;cUAm9u4xheHnij9-wW52zMA@c{>koF<_|g6wO7L9bNhC=V(mvqu709-!Rw34 z-){HRgpARTx4G-H=1Th8TDS4x$4dGK zCSN*c*pK^m4jlgC9q-N@cmv`EEVm4C#CjTp@^&M!0m<{5v3<;@wZBH#7+ zxs_meYFa`tT%4914BwiTGD(}LP13H=CI`#srPT&Yzha9I>VhliT^|ewdg)ooetn={ zzufKDXC&%Z#rgG{+xYeC6ZD(A`t_?a{CX%+zY!EIF6>WB3kQzrSt*F6gah?@RvKb` z!vR&#>W!E$9B8R$^+jw@I1sOArH2E0IN;H<27!c=_IlQEeS88=dWQpDG`-ThE*Q>z z(!0?gE-BMg{yE@REBxV!X+d1oDr-9URW140wj4e8$@q1|P5M+**Q1cb^}6siUugRH zxYBi>>%YsZtW8qa`BCN!(2^@_lKtV^j`+j#AHwfje|eh(f4E?kUWwxmnztf++e+`o z@NK6w@=Q(h^UpOMgZiW=D{I<87m4}@esx=AU6NjTY+L-spkDH%=B?D!D!+bhvQ}Ef z6mgcL@7EV6R@QX%mv>Fq*J)n-uRyMo)IIvTW82jIT6|^YrnZ{5N@M=2)xD(~1*?8s zJ?cHBc~4eu>8O6EAt6nzM~RPZ^OwIR5b;&&3Gc?rt%*>JR=FujJ?Srhl~?@gQBAM& zZq+KcKsn!gH)-m7yk4j2RmZkf)^>^CsPFdftlW~Mc{gfmjfx8LZuhIlHFcM!Zqq8a zwy&&94yY$Ib%%}wl8~l8D{Z(Izftp6Ln^XT>DR0MC`{>knc_jew=$rvLmB)Km*&@N zQOHi3zR|CuWSiR_+ZIqi)#9rI-Wtuj9!VqtHpuU-^Q*Zl4R!g|O(>>c-2+v0^sC7K zrnY`)NI!6Fr(fTp#eWp=Zr8l~ATKH4-6nPHS0|>WXzJhm>TaRd{ZJK3y}fc%7Y)4S ztED#oq3IP+{;}O!Jd|1~ihN3~q25ZX38}1Yuil!L4i#zYY1RcawY5_`&g#9@Y8?xu z9^Q-$bb-hqnjlS_1s;#y& zYAAqerZH_vGWmiuHI%t>Q#&xL2OugPrb}%hx2z-7uex1BSy3|Zs?`Dgc))v7#og<#;>0C!yqcRqGC=`J;IiZ>W{A?W3`!J2JH_St*+dXNR_BRBgx)O5v`>PriIL^ z+v2PBx?|g+5iPZjX1Lz37p#P4kk?ciS?74v&eo*T%13Ux<0|M#Q#Zrp)JiQC)?U*| z-+F9&K&?#Of|3HMSCm$!ZO@&Wx=zi3`KfzZ50#rbYI@BvnD#y`b!$A-B&BJoDCB#7 zwN~G9Y`f4~>K5pY32s4xlmjV))V-QsTe+$IvF+-C)H=UDFU^Mn^D2v%Dw;8qHl(Ij zfeD)3u1T?V$y(~BfV!JvVP!(BrZayTT52VgS({Y3wJn+|5;(1;)=*ZJ%wcLZU_okJ z-^46#ZJ)XcijS{>Bq&1DtI;Qc>#EKmMR#DP2#!rEU$VfA_1O zP|cN_JLpvb^s;zOLi zRj&p^>c;3A&{Ee+J?v#WMbVSXA0!hift3+m69A(@m{rk9Yfu$Xwwk*N`bK@wW?3g4 zStnZR=4kb2M5w=Qr20|c)cpx)zH)1afc~X+?0r^1AoUO|JN^*#jKWc6G?)20YwlZi z29@u1O05p4U&YrTqoQ9)($MaSWaCjk2$a9c6HP|~8(2KpFFL-0@%KFmMW0o9&H8hT|!0~$oLuBGbR!xn_@?WU-IfV>Bf?SSs}jpz^n(qZ{O zLh}*Ek4~4ypBPZ9+4PX)mLwzz!+_v% zY+P&5I$E`b1;c0%>~LV z#kG%C9EID~)+K%&?998-%rJC1u9nAEJ3lEm~QO?K&(Tf3kelRcs(2Xh8YYS53O!^7kWwkSGS z3`j;+)XicX+JdS7F=3=S?ikjg``?(liLJdxua-GNi6F{{E|9&WobA+bxJ7&BsHdqI zEh;!i4#IL+Ob#`2BGZB6`w0{e0}aGi>yyeLr*xetDT(M@nY+4nsp!&oKpf_VwW;g; zI_FI?r}lIKMW~UA7Xy=2S0yzn#uZcfZDT8+`jDEZ*>d2=Jde{V4&IpRQJhr=oI%)C zfQco_6RQe(n^n*`vI@lP6-_#|O5ciEzo==9S{UG<|A799Q3c0#aW(X4n~uN9Clh zhlV-jDc!&V`qg=9=)1qf1f*R+{SsAxi9>lArJx3Mm^^!P);{LB(quPaieT3PCJ&p9 zI@oNOtiSv*isr2yZm2mgKnBsOI2eoez!}9(HUrKThePGUki-nM1~X91&BbKnJ=$4s zP2YxLIvluPOWn=t5)+3CR0eJi<3(3ox=s{2ockQ^2GceDZ^w4xb};or3>cW9v0K61 z3{M6gqyFpS_Z-_^S|w~HwU$#2Oo-5yDlk<=meh}sX5T>houaJzNxxolznBC-F_3u* zPay8+yan~cSwl@?{BcYUN~?uDy+*xl70Q^pMN|I)jia4oKB)eJ!MZM~xs>>W8d!Pk z0}R)xKUCIqK`+9ZM!irusnwW$94*}_g;lD>X=%t9as~57wtSlUQ{|Q}Y+>K~^-0g6 zYK)?*+hzNzYs)GB2gvkeV#YdLlfr0F?1wPF7jr%oAhiZ6gz@3_6Ej;qaKFeOvQwLk zmWhsr!!^21@tC0b*k2~Rpave2a|n!HytfiJp=v-EV?~m_(Y&=oXDfP5bgGiAjAH<9 zc+tCI%E3EOOm%p>3)@A}y71{hrF8>pFs(u#&D&jcX5Mw`X)s~_!)_6ILn$zv@}3Q| zLf(3cbnqNQ+&|)8m(!05-gz?1un}>u+mTE#$M|XtUovMaF@_+oXc|92KY{YKB%{_? zw(`fs2@8uyGyb$7Mp~!@smE`GhP+e_O3w!;;_kn4YqC(uDK)T4ssuJKh8dihDyi1= z{g5@B)8IW?`~hi7?J?{jeJ@O!+DXAv4ymBhDv<|Fnqa6tXh}UFm9i-jO4$!n!VRFI zmSeaLtnD0#{}g)hdq1UxqQ4-&j`lSx&5v1!U;P}4K@xI=-`oX_1O5HyY@{$N=m~XB zo#H8tsZ`vD9yJsr>_;N%m7-Z2&?pdW^AIKipKEM&b<4yXGn2dn;OLjFF zHjj(mW@~#LPi_M0snT__i0`2i4#~EP9_o8cvb;Y*ZQk$D3Xt_`JWZojVSGl?n3LAE zQ}GN7L-luJoYwbx@h}ZDQrt0Me7dF#`oSY6P2H;=huw+0z607Z%xB(9^2dLO_UZQ? z(9{n#sbW9$n-)+%f_(+bS29QJF7yrFs_>-Mcs_y7L6kz>4|_s3*aOtHKejDgvI&Wn zKS&O?I?QT;gL!WUY-`vliZ7Om3rY z(ZZwJl)H!GY9gWuS>^5l;arTUqmqN=xvN1+%r1Aw;XF0~5S}Z9V$&jw+S{52sgq+6H#w_bGlq;HQeb>c>}9cvkel zdZ0cDsK?WeGr{nm)7J2B`CuHCobVshUcq1O9iKS+bK3LxTkht@no2nEoL~Q5hqB8) zACVJ&JMAf6YqNpZ^mUbo&Wo>E!$`HwPQeXZ!XzI>@ z{!5_GX_!#v&LXuwur{#b=i*C4nFk6pV6-U1PIM}{dUa6$Kx8~vK4~XQ7Ey`|pmUTW zq#g_PIS}yv9LoG#;RUnr1xFN+yKjZmpF(~921wBXmVCv&;$%CW9KFg+2NzMkV0p=N zEa2KWum<{kBeLtv>-?O|Q%kP1WgvskA-}ORTXGvEBAdu8avCf<9!2gQQgk` zmW&UUZS)1pj^KC7S9Fkh#T?nxNn~CF?|SRCuscl;RB2ckaO;6;{*BWEoA|el9@xsi z32#khI;Qq=bXjXTx~$n8UDkIH=fVthX%Pv>nk8ro0@-3RU#s+XSXsJ zM;g0ZDaR4(!HD%hEqO)kV#Mgs;Z~+tv0qzPw_34}tgCUbQ^_#|F)3v}VzLSS-ip17 zm~2d*gl3+$E>FVf1W(&gf+ry>#nVMXb0i{sTaR{r2g7HwP0;aE(9UNhpe;7{( zwLTSw{nuz^$7%mTeUo3WkS2U|MMcRFZ4C`9SdRW4*X#@D>Dh7NmU?!Z@F=&Qoe&-s zr)MXk-_o;_(PhbsG4WVo!Bo(y7=3D5UQjPin-VNrpPpaU4)SH?q$4J)WC3EbnpRq| z)rd*8ZbVEfGq|F*xV1>^Flb6uyoEuh#Wf;C?-tmT>djH5oWo_1?m za)YI`ZIBeH<6pEx%V4(uvIIoxBJ1D zkQv9!o1q^+=zv@>7w zo+IOC9~mpxfvw(pOg|1_;L=goffx0_?r`8`J+Lnvc%9Z}c5{aGYaTMSjfG3+wH5Ux z`D4o6Plw9etPJXb=YpB8k`N*<2Q#&}k`eyQ8xu-~L4R!`%@P@n)9N?SjJ2{~;yicz zeyOjI26-!vbbJ@}M#FY+i(c0;(_quVOd}mL4a_!f!E7VuOv4Y@4fwg0i8#_f$t}*= z_T9=N9N8bZ6?#UnUAx7e>atfjfOFYXT#h`+*fhk94j3`nDL-b#wpmw`t&X}UVn%mw z#qPAOzJZwRZz>Rz`P*U9nqgI*P84pXC1NtCy%3|5h+FAv(R_$45ww6sn}C??zc3}z z;@HrGVOO=*hV8ssOAu{bOB8KfOJ*Av-9Ngkd6CQi+7%cHQbPJ3boxR4yIjs(II3YV zkWE(850(9Wgul;E7zos`E3*pI7|p%n>*D@wx)cIQssP zA@ww@-TSp@p63Pi-4Pcr43<^fQ-Dv|C=>Pf*cd4gP(vmsqEpi_Ug1dvJAGe}kCxE$ zr)bw!O-F8xDnm?G#jmZ{U#zP^3|1)p#I%GQjAh9=I8B*wg)tDG2$o|kc@y<3d)c7A zN0cVutrg>C4lQ(NP>+*k(7%!*e$gIX(|%j0RzN^krU z@MDTF0R(!tnt?N0DNDvED@)Ki4LnClE51-ko7G!M8`MilbEPQBN0SaFZfjSOkOv6D zQT$Tyvt`p`*9=1tk+NlsvV(%wsatcUExugYyh2^n%#d|2t|Z`R%Zl_)qUWxZC1aE| zR?xb`K{)hdqSEiP4obIONlL=3j!N91Zn%c8xrw9n8qiE^ejEjg81e(|1!{XN^;2JmO3LM-yg;tMADjYH zxc6O3YR_4hq$twgzBPJ3`Sw6-CAH=34!t_R+j+^b7bZO4>n|_Axaw5@)#|%nXT5vz zp+~a3JLcuwa-uF_!N7BC%WDVU6(2|+@ji6fW`5dx{aZ&nU3>m(NjDuSsbAV=?H{|8|FpMx zTKG5p&U^Q&1^YT`y;g5oy*hu)Bg#*y2VZNMSd@_Z*ViuSH0{@Q*Po|c{`E87gr09b zbLY=@zEt?=ZIhe#+0bljyAf0J_McmNW8t97et+AiZ_K-X;rU;Foqy4W)oaEK@AkzP z1A2UXFll4UPd?ap*W@J|?i|y;_WCh;VgC1Z&uqE=BG-bi{&C&sflT$uMTMK*pO(;P z{F{rfy5jc>%63$LQhb3A>J!1o_qY1bo%LAQ?W)J-!>Zz&T`;}4e|q}8F4r=Hf-ise z$A)mMNJ)wG&}ZkOy4W{3L!@^;%}aH??F8T~(u0-KRab>!EeC%pe$9r{f*Axx#8Pl% zJG3brHS!#k0L~5~X^DyS+NV6Zr!sTDGp~~-ckzwH&{a%zv8N#a=~X|BmR_Tg7<$~R zF1DU?DQEJdo`#r~0>f6t@JP*ln9wuTNIA4<)%78cLSkvl*BfG52@K0j?zHEA`&~l} zM|;(kf+Iuy-sj(Gh~a!eb+J{_Z@*~p*Ko#*&JTMB)x~juA#wDCtqn1pyQ{7baHKZ- zy9TUoh@n$mhf-P|o%Q6_`J&{|1RWcRZ`5|maJWraa$X;GdqC~Yjt8wTYZ zi-OFG5NA;i8Iv1t?tg;oT#M@= z2Zk4)cTliF=S=LdYy_sBmNRysX+zX}3kQYvBPc@$a}YzI^$JP`ds+rsmY@t6U|?to zf?}LYD{kS~Q62`38cfEKVbbdD>&_9fc~)WMSzsJH%8Qoi5>^D zeu<(ju=batx6gR=fjBEIm#hFqU>s?+6I^CmyRQG+LpB#5l`#m6qg?GlwZCuH^YzbP zu)oWZWpD|MBdtWiWv10hn={tt;-d`)fpMhO0aUwO-KuWA-u~jyLk5??IMPZITxMER z%J03@=Heq027z&;)e%(HmBu4}d#}6U5u2;d;1U=|TC89D%LcP|_nT{T{oUXa7)M&2 z1edHwynQmKdb!OdlE-y{airDRk=EwP;k#_EF3dE7z&O%kUuD-i`FpjjiyS$xN&mUjdXLH?c za0v{BDvyG~R?8q2yd9Kf_z{ZlpG3Ud!C9i+2KNo`v&H1WH&zHoAjY|SeF`Y{cLSXJ z>!%n4Dlty3?t;sxa>cpleWt-hjFYQ};4;hO{6;~Z!9|RedxJp%fpQ|=PDvGV_o*#!A!h}t5|P_nEQrDP&h5*2J+FQh#hWicE_H_Hd$;D zVrIZ5&z!e#fxXMIO^@0u-M$dDWx9PKYUgxpky}u>0Gs^Vh((19XX1?uOAXeQhLjjv zLI3Z3Mc{wD7j8op8X7U*vNpbkU=_~XWWK=`t>&vh`G)2i6<}UB-|99}XhOqLqMAZR z3AM6qZbsUmyh@sUPd#E&BC{kWPs~e_D`Ml5Xs(!-8p~dUfkYM7DnTT~5EFAF!)*tq6DP(96dMaC?stH> z$G~xziG@23`oqB7%i9-(#^gN=0bc@h2d6*?9D`%YWBsn-#5E!a+*12XNxVeWeG!Fg z>^;V`q@Znev;! zycdmIZUSz_ zS;+hSS;~7ExV2}H#~JxvV7`mS#VD@_%I-piBUpNgDlhdn446JQe495|5x8LUW84FN{Z*s`!~F1%o5*RzwG6k>Xny^ z>X)$y%HsMj>Tjz577yEGD5_UVfmwA!{jz(2TeYNKd0=t9@}PPBmilGy-h|&${6K$u zUj4GQz`lKbz4ESa(iLK<0}D!rxe|~U(vRlo-v!m}IpzMeDcYOt(}U%>aERita&aA3 z%cpVSVG37wujA@OfC~?Ko;O-9uUI;)Bso}L4F?7nFXs_GrMUUB5lV5lVCLVJbPo3U zK`blo4wkp+FNA7+PM5ngk2GKNaD9C}1w%RoV>Lm$_S$Qz`XJ%%__>v3I1Ugo@wO%x zDN>dV!-ClHp#EXWd9!EFww4U*E13n)@|A!CQv6LwugsZQ73@+0N#Fm|CSA6@j z6CI25mz_v2zG&GA&9mZuTnUz*q$L!$^H#jcaS7)YXg3~zWz`xEJXIjD=PvG!$TCKV zjFU(X*#gO-v1$z;@c{p21^!|svh1X<#Jh&QSk)Rn8MH193zmJEQru4*A@<8<#J7X| zFe9qBqG}DN4^?Y;qgJ(s{YBLpT2j>-WI(B^uPr;####%wJjESr1tRrKBL&Pd5 zPh7=CWne`W|NKt_yB5}oTRgTHjF_rCjU%6rsmk*>@)4Y>{1L|t5qkwkxhU~x#4ZuE zH8^I9*xNV`7qJQ)FBP%%IPz^~RjI*ogotg%F-yd@;ph{wT{vnYhBiJ~yvbbp)j<#< zJujB0Re(a5pbV5hSbkH>VCA=}=nLSKlB*vL!W(KuZAoikyNCCY9d2WL__w_4h~Tit z)6&7{xr4b6mY!OUKc1D(;TTf4u}P$`8|kgRnGVt+{Lq7VR@{xh>;u@0ygLLr2&c#1 z#G+l1OW$gsm(Gv`d5IvkI`}ZI)32bA?v)sJ|zW-ilDT8~PmC28|-=cME-3-ZZ7_4~J$Vo|BV@+(`KH4{?53sxRM#hfsf zU0Exh<*ef%d>wPprLCyuN!h8a#jQo54%2uKT${%G+(^N^e2H;cdxae) z-WoD5bZ3o&VJiUY9+ShY6*&^zohI~QI9kH#>>#owYvbyO+Te3;spVf=F+S$+ho4)t z5*cH?^bj;Q`&1F@gxEk4vug;WO7Eav7t*(h%pTj*rK0TMdi3GFg%4DkfR|SCZmjeK zk4wDh#SFhN&l}5|fu!hn-@!jYwXXhS_J{Yt3ai%qMjY=IM;z*_?jb($58W6)s7JJZ$6+}|1Z`!ClRv7lM!RRs>&Q3CyCfX9Ip^Dc8wE7>|rbRIAW|} zRe8#aJ#EFFw_<;^Vy_@3rTp2Vt+8TnTd@i&wjQy|@sk6hOl`AubsJ)1#noLnP7tv@ zIOdAjM>x_xRplU#<3#K;9LI|ooBx#}_7#p-iP%vbr-;~(I9@Gc$8nr2V*jvc-U|2( z6?d~Hq<+u4iFf3bcfCW)tSgQW)>mK}TKHwC{$tJaZg#UO7rs>M&H^_AA2XO?5F*lb zLB`^6o-b&fy0=t3uC7Yl(G~~Yi_~e&(k0I}{7J-*4-Hg7;$sjqWFsQw$r$Ao2wDSq zd6K6Bf1L8DPBZusk@94W@@^2c?r`6Y8zjqOa`39ewXtFe76(xmM&vb?>>Gix9aK!Y zZcCao1(_4djMPCaxl4pxS8KP@dQeNH^}rU3Ku~t^U<8gKvZOM`lx`C=S1Y&D>hk6X zQ3pb2oDZ0xKO&M##>iDBXx%+-#Z!!B%|X*Z?>OkKyT^_Dq@Qns z`ue`1S+5m+zxk$F>n@%*tLM6pbKWiUY<*+-%ga+UZt?Egy!=;>{N{y(Pm}v}>$zm^ ziL#%M?7rZo3qJCGzApQl5qEuYxe^~y);BOz^cm6pqu1*>j_s|`@{}JK;n#0R9 zBVWHvAG+0u;ty+^LB&tZM-(m))1qujFPx<~D7+K#S(Hcz6UtLvv=B<`H}Rfl8#-$= z7Z|n~rcwIqpYa5O%{fvI?=V%@W*iyx%ZHz8h-rx{s*9bp2fv@j^n&3<%V9fGU2N4v zAFlWc>#5Ng4qOt$*e!o(_J@WTR;%h_FGcQOogR)B94#kaVA#o1PSN5gYa3$Nl2jKT z=ypS_>Xj444Ke2k%*8k|T>Nwql*+Ui#>zi9rWo}#vjOGi29*06P@XX;wo?p;Oa|Kp z=6y+k>xP-uQG;ST&a^Tz7H47jCI^G<-r_STw&Tnd2E}%+G2L6}I76$z+d>A0E-;ev zqCv6C{f{;ZHExj@0^Dh&c83x^lpc8kDTmaZ!qh|!9LjnM^W5CJ_5ioo!; zT{tHbW4pIdm_->%j4zTx!D7N|Vc3|&RK}tVNC)Lw{A>#ETds3ZcsEk$ps)wO)j?sV z?{rX@>3ba%=J(M^%0Q7tP-w-XTmzXp16z~S4^y9ppRjrAX8= z*&1V>EQ-)rW+X-EM~kEkBW4;dIi89>oX4T{LmK-T*$4hkigIw;iqN(Y6C zE{~)PAZ5HoiFAEB7gXC>WBafTp4OJj$u8uVL0}v%C+uHsmy_H2ZSQV#{a|njjKjSp zL2z}&k&xB1Z`s+(N~LairBwaG7Z(Jom;<+d1oU zgG*o>X|;Exbzob^;Wk&1!6h(`v=RlEI3jlFzO@rcmYv`H8{6s3 zbeIwtM_QdMF80!&FP(gc&85kX+jP!~SO)5BaUr67m!2}rZP~_bgG*o>X>t6uZR5Wu zX2siFrt6cyILbws>l=Pa|n z3jf;SHJhv6;F8W+k+#9PfL*RxTSt3st_wJ&LJ$}c%QYxGk(GI+gA(cJlmd+E5)F`W zE6_EH%TN4J`mFqd!or1xMJ8e1{GupIQPI38%Aykx-U&>k(IDQ=yrL7w{Ev?03%+mVWZ%A1^5_u zv0`4eQ;)p*Pdh(FsV&L_C;DoX4-Yo8bt)=~z2Wtk0_-B0ZbzoANCA=8rSFmb0jY)v zu|6E}S>}caDZ~EASwn=B(GMK>&#Hc89-5@?9xV7aFnPBA(JUQIoOSJPbds5cp% zS1hllS-hu=3^BZ#DscV&C|oSBCU&V4c>fs@d@PWCdI;C4SER@+r|VDto%g`>!fq=`^>=boS`vqmLG}Z{VoDW$5`G) zoJyS!3|_z!fqHIC-f&=oXOPFCel{?7MB{|9%QSdo)}8|9kI}do<*fte!)RO#dB=fq zbAFA`Sa~_c>S1665QoOfdkJtO&mfOxGV3hm%>!=f8RW5k9|Y!E1J_i2yaLSIXOPGG z{ScUM&O+XCVBEaZK(O=|;lWNi&Ao?#;W>jZ0bYqwIOe-g16)D_9ILf&16)IS%+Ig} zxQ1U(VE%?Tz{QpqXn<=dk2gcX1~|xz@{&qGfv=3h{R>`FuOZoD#l_VBcfZEKiOSsK zA~;~rEBJSKN?|()F$#!1-KQb<*wbCdM(tDZcJp=EiDD79_*j}Ey`Av(w*FyGx$jW0 z+Q*xBtfJ=~&DFn?alA^M!mV;jZZCKDf$LO#eP&f*Q6?N2mdt;50ZvO#;c)xno^SDw zCVW~VUf&LtR-sCkNzjsg@;cv=w%-2kg=O~~eZyNc)sR6BW^O3)(AQxa_H4k`8!BE~ z4`NrGIFpZ_L_WT6eJeb#@XB|PuYBi8FR3aHGQIF~D+_UCSLjymvtrL9#``C?Qi~(+ z?C6I;?h%La8_rPxPyodLHZskcFWeu_Yu@2qhb5s|J*rzyNC}OCyrA{?ZYh1a8 zLQMtxgjT6usTW(bQWsQfN1;|>hF00j)-S~dNm9wS=I9pDlZ~MvxFxbGmBVV3%IS%i zR8Bf#QaPg#lgb&3m{iUb#H4bl1X<`?5tHV2Ct|$KmX2}qs&B$1*x$pTIu)}N=BFQ$ z-b+i7&%*=I+=6TJCTL1%;smkn)xBhbLV||#hGCte8-ZGBph0YMbr)eUnJLtyP@*4~ zCK_g(gZ;CX0ipes+Ms$h{WO||^q4dyM{HFSgj*HXhHsBFUEzfjj4<7I3n5I_6YY02 zyeyMNuTdpHrW;c*v#O-O*+ZcIE;4!}>?t(G*oVYhUoVV)MTO?^pFU#uClOiVW>72x zyBDLppa}J#87#F-p>#d>)He13=`9t_ZZQQZz^<@6M_jP1wwZvesCW}~Q%~p4vh^A8 z47<9jJ5b5^xyAB!iio+|HCNirICs%G)7s?4)94X6*ET~RMC8)2jK$%c-8lA1=!9ix zS9?XxlZ*OGLFKHqx44Rfa3kbj26jMFj*L-GhM;vH-$EJxS%PwLaa$#BRy)va&IH6I zp7S&rV+kZDpP*k0#hD>i8kgasz0540xr4$dR(3vQtPN;VE@kq*#0;_I`f*WJT%B4g zor>d?PP6cLVk@Q7pg5(|UR{I;CqI5R^p zM5G)UqnxRN*58;O;cbMXp6MA&#ji*yoS~QCf$dysiB=7k_SUQ?cotjeCydo?jlyQqqTg)v8(5fch?9KXHS4S>fIv|DfH|`=yU3 zJ<*~6nw8fas?Ghm&DOjd|EtRfOa5?Q`}q~^b9-Jke@55%^WXmcJD=R1^y>2F^Ge4Z z*gkdaf)m%x-+T1)n#TsG4~c8N`>(zFeUhzyJL=nItwWC;JJoCP*wgnt_(5XV3)haj z`-5ALtQ_5M@)a2iy?t+gXV8sD_TJ-q*{>ZQ{;Qb_Z~Uy)^!7cw{pD?c-^|sQ6yEoK zkGHE&&pr3)+xJZW^?7j%2E{*K|N6}jcbIp}FYS7NG~nCOm-g&=ZsDRFUtOQa`riIi zkH>C(bX*VR+TpIm;>T9rXj#aAa<#q!73U0*w3C%kcXf3U9Vo z_!b*n#wuyVBQNUQPV0qX37F>4UKqHaCxgH^(&_-Jy*~Z>=lA|-Z`$yL!6h(`awQ2a zv%ZvxhpKI^Hw-R;airBza8b8}bpC$upY2uBEe4msIMSjX>~bAC{HITBuD=^x0^>-F zvr^j*&->lg545zjamwHl7)M&1^V(_Ed+zCLb9FGfL4g4d{!^f^wJ|hvZ0x{0M%Bgk z%dl?OW=z2icBR0G5aZ+$mh3VzCpc}cQiF>aCzn_gb+Jt`48I@`m29T%@11?6kHUT*NrJQUsTo*3l&;=(Nlnes4sG zadLGRTx?Se58U`+Pn)ZSA&eL)psy)jP$D12^#BDe*Qr*}E(3?THWq8^iKagO&Q+J< zS#uZWW0S4<3m4=sE;7cR{QSA|7v<+-_!^0)XMv@fSh(cVGfpq_Mtnfw4KG^8#7;mVNffA|7z7 z5%H(U!VVnm&l}|{oM90%vd3z{tn6_)KHQM-qxX2I!ao*Z;Hcc3ky%+|eM@YntSlcs zX+I{IH+GcIymyJnYRtV81`hh4?42+)J-xx+39n;xo{y%;5Nnn3Z1zrA58kucJAvIq zOU{-eLabFr-sQCduE4;uUx~FkcP;2;zR`Wz#KJ3A(lTD?gq$nWA3?-Ge88w1ukmUjmgy-7~&WjTP5S3 z4SzGR)L*PsMou11ou#~%0JkRtLSync1sDKKC>j?rMIt{h&%vQ68W&Yw%DWGk7ou@7 zL3rJHXUN<6`9R3t)~#<6_9`fVq8l&hHT#D=+PDgnd8)iB&%L#8&B1j6@&xLzepSXLur(ygC^laf zBvx=Les1x+IZed+TQs@eFeY#%UZ>q23cEt(p)?KqQUidu5PfbfthLcRtCiV^Bp~8z z#u&bC<-_+!G>XObJ)vcL9EGMVzuPmygN$3aef# z3M2~at(7JDuS!vp-c{^HWUhVOo}b^j#`AD}Zeou93HN`1qNZ^V>*Io*FKyGepD!OT z61zcT>2Vr%WycN=>0AQ5PQZd#%!49ZuPK6-4kwWTa+dNr`ZT16=jig?Ykml%q*oA2 zkJIoXw;vm2bJc{)A?Ed9CggioRDx;6KFHkYuFzF_X+cK%|KbkJMCCb#Y*mVT)o8-DHVuS1o62Td@LpfnUnQ0 z3Na22az$6tR^hydp#5T9<%)>3f%%9T)sHH{sy9BsAhyT|>EDShGS=Zc7TDAQYJ3Om z!8iFNS*kJKv*HgRmE97jcvd`xm_8vTSXKc&wiS9T2TAJDv$7O%=(3fuwtHlVt;(QW zo9!SBfThGs-^J$k7vc*I6KuU^x8cemJ{SSbW+%)JyYQ#o?6B61AG^@-$%|yP4L!Rn z8iuvexg|^pm#xuGp%^)nDtihssT8aZM(pMOC2f1f4$tx|=n6ZRc$N=i1WWZWk;Uh( z;i4OxwZ=sqD$pki7b;(bC1UPoVt$WCT6(fkP-E+LF2)=j%VF?GX}ez`Can{G%f^~uN5mwp4`PPhBPM%M zZk8*rM!p@}9dgXj3z6vM6ZXAWKH@u>1MyC#v4oasvfyuTi%Z7haE=EI;OgGqt+X%3 z^G9q=&tP(~x0G1+_A-`;nB*dAF@9!{*WEaku{gvo!Hy8lZMJEyw3#8^G_GitC-HqvHvGL%pqQGBvBWuo z*1a<}_aAhQ(xDhn?hJ1=lasoXcHZ7b^`~oLy>Dt}`E!uZ<;_GI?`j zhFEf^;37&Lv4F_iH8WgY@ks;EK>1+;-XNKw4hEK z(9EvbT)zwdX2{7AU3Xn=uHP;5?96!ZrLDoFFOGfs*3vnbA3Cz9*Y+Rg-@1CpwcT#I z@9`7!b`>99(($vs8~m4!@B8-fg+rQOoj3W>CqFgcqMe!XUz?77KcxNI3y(j!tM>U< z@BB^sd!GNaP`TiOzdm{BNZ>VX%Ntj(bYF1WdD@s4_8s`-zb`q`?%Fj6$9Eq2L8rg8 z-_bf{^w>LZKUn$GIo*%$+*>*=gnI<6C@E*gak!NG0qvIOia)Wiv1SqWP@U_p)E8h_S)AU;Bp`Z-OFet1YK@o5Ek;uMFPzDX)DFXE!Yn_d}41CwmUOg~ZmiWX2n?Oh01hWUU z*BokQd^FhRGDjDIajb9fu3B;-qI`6G+&+7C&g`89#*r59JMFakjC*d6&GkD&s{-Rl z3s335#SwsQr~L!-Ds8SxgG*o>X>k;>(>ky9@`yJdKQXuj#*tQAM_P|1yjNzYrAm`M z<5uyjYg2!3bEO$vjjglEJSa-_Ge@V}TmggYOzUj7c>fr*xn>(&95+$R5syUVIvdks zxNhQv2klj?l?KW~KG%Yk&Te&2^!{B`^*h zc7ZJCTBZHg-e`kMU>s=)Jy>alKMyyvx#k;OQdg1XlB;TFeLYt??rVGHc9p>;Fpjj& z7dbR_IN`jPezLh%8(ae8SS>`?A5pH0U+%F(_V^$x`wcE)us#;yVx9sDX6#m9h*J?x zfupH)E%VyV1%(Ue-dvE66{UQ!4Z2vED9XQ~;HLaVg#|?g3yQI{Vm|DVFW^mIT#&!0 zps;9eQ86zAD(LeTVwofceHONKE?fw44Oy6C6g^*T4$EB3URXGPx)3jDJa^<{(e%Qi z0+CU&AoqCb(0C|iEu;NU*W1iRv!=BWxjxjWsv<=d#ZXyibv7y0nG$fsO9U|>c@iXG1M=HGzy zfrADLIN$ucSiJf7Jw^s|)*ow4ZXV}Pks-#Lf17dru_&B)^DpX+zPEv!gZWY_=TZpl z%VMojT@QLcU>-7X9F1b(%0Pb+nEss6Av7j$BraqC^DEBA5IALvC65!2hva3CwW=$38ojJU;nKGS)*76(JVxzj1|c)|qd(HJ0vl;JyKF9OrBZjp2sj!c1Tu zH^wvGzQjs*2I8{q+p;n7@zCQr>649X*3Qn%%ja zsYZmx%G(*Z3k+;y<>mC%56qNkoal4yM40YkVD5;`D)<)zPC8x{zmvGQ_Sdy#<=KpYyAmj&F|Gst6k=bfdzTYLRz9$-F;#zpCm5h?2+p=mE^YXj}|=dB9AK#?8R@c_P9hc8pPBnUYr#IX&m)rNG^6 z$g9yW@3ybsTPhWub-uamF|I2H>_y~ATId7cs(Qtgey)xk4 z5&5<9d&lYSo#LaurGQ|uBve-64waouDrxy<3Mfa~g!H<%Sf4vT(d%+DYm268WlIy4 zl5>LfzTTnwO5ih&YzdVu?W!zxgO;u>%TP+12kVt137Q^E04Xjrn6X$52Q#$N3=VOH z=7ogJ;Ba0TZpyhcRKE_1cl6v*fc2CrKKpwJKfJ$+Wn8?5Ii5>28HYf^_Swbl#LCZ` ze5DOrw`29CHx?9g_yu4MYj($7C9O!~7^djslgmyvD{fwPQY~qZHO}I5gY`A|N_&b} zyzX7KX0BYn>0QNv&=<6JJc$Px>e=cJG2zf!Q?{a02Uwp>r3GgCqcuFFO)jl`yxI7f^ z)9E7<`{BfQX?^|a5lcKm>RRy@;d3DKty#P?IMH~=PpoHS<(xzvJ7n8*#z8YbpAghN z{FbwjR(gsK2qjkwsYfR2TAb&tgKdghdfqzJ8q1$JIY*qt;{>@YTbk@DK_2;qZRF8Y zc2jb*k`6|l*B5a|S^aOUS}ZuTR*??gAih|97Fxc*OYP92r9Ll2Ojh`1h^6D_R&K{p zR{g_>aklAJUcs@ih*jd4A!0NIiSx5%?aR@3Xytc-SW$XH=xe;D*97#MVCCUXWgmB= z5fx>K7jm`IkC8Xm&Vw|Rp60uedSV?GWs5t6Zm5J2Z7Xh5b~6gs!k?LySUg3%kXogc z`|2+}U0*+9@wrR`e_O0!b-?tSGm9a86V|H}%a*$FC5F7ON}BsKm0~njv=10&*@=|G z&v+EVG*4DlQL0EIIjCo`(bN~AWmE*iS$KD|Dim&Kn4bp8Qe7*o7~AAq)We%8IEbnY zhD9E1-v`ksH#Vn@x{RjA2bXw;4~?>;mO`mR#+obTno+tWZv{0`N@WXe){pQ!i0#86 z37=o!vc6~qcwrG+!NUN3A_IQC0*$+ew<4@+rN^lkQBc3fU!mz0av>f|)A^#K@P#w^ zZnsz0lFN=aEACQuTrKei%Wg_>@%?kI*%K=I4`E)AoM?9&767t^c3gkpvi<=H_`tkVDKcB^Q(|Vz zXn^=2d|5?`r<)($a^7)lt#A-_JQpq&C2cVTm9z;COJ344W6EbCPhd}Ev)sY&$Mh__ z1r5G!P|uc)v88B?II+F6`X1>fm0T@u_@gr!()U1yQruMUb!wkYn#?5;_{ zFtpC%iq^qfL)jj4jhK8{S+?67p(ELDw;*Pi8X8h>qah{OhU-}lepr{5!a=vS)q0F> zg%7I#J^a|a-dnM}wm5#-iTbzbjN$RGlidWZ4x3&SvnAY$SJJOQQ%v!GZCJGax6rV@ z`->+A^`X-!I0i&e=zen`e}8`u(`?T1*)|a8cMa6%&ENW z`}nP&jTuMQinCC-?|wFsvQr%kpP**bL*;j}>ClKWFeww`5o`s1PeD&xOwN1>_@&^N zj-L;|Jp88Nx5(3W*)nkA&%N@`Q}}b&Ic&_VF74VXKCG5CG8Zwa(ItrS`G;HCZ(WUa zADIrS87@IYF2~DQ9L}=^O>P9iS!j#KrA9nh73Q{g*@+p@YV#%e(;TnO-l{-t~hMI8vBIUw>HBaBY-Pr@F5~O zWsID>0fQE(;m_owMU#V9C5{@FF=|+H5Oo)RX7C{rE&C=x>)yt#w3&!Wew2KtRLRd9 zY$>0zcjIRUA0pB6Ie%jfqRuFrX&{*SZ(2TOkBg{DAI_uYuMo6rMkdHqI zX1-~GKKxYiyiLYf7O5A?0Z@!u_`06zmJo`=J z6Bn=jxc=Ee{octu`kNiKgI>*BeCd)$j_%Wv``qlRd3oEuq2}K))oDMxx~=ZVx!(`I z&2!hQ<8OQP>VBWSIpI6gCFlKL&VRn(-fZ`=(G5d#e=Ts{PT>lQ+EG$!?RBxnfcV{S3h{< zj`$ZJ==Y_`Z@!|xw9VQ-b}9d9ud-yOXJjCF@`q%@!5};UDolIA<5wrW6pV~==B2g zyyLO+22Ggz$xko7w<;&|wGUgrKL5xe<-xf>nKfbl{ZG2|Y&H|M{zf{(aL`g+Z{tWq zY<<}-EI=?8iJ`TrF81Cus?r0$9^DYrTwuy@B=_wrr%!2!VcSz(>>Jr{{OO)$?Hgj) zzo@PQI5Ms2alg)Jh#|M?Vvot(PfnWgTtiGNf#Imf@Y>&>Kh+S!iL&bAIL5SY-u7#B z7SUyo7ntb==DF7wJkb!tmZ!Sd;;4n+jr$q5=+Sb{5tt!3^2*qgcR-!d7~%fmY8oRQ zLRfBw@@{W^+fWXBVAW+l*Bg{`Ejis>lH{={^p9ppuqb>HfWdaJy56AJ-m({)#lo3a0!gVv4o?!?M&74y(@d#Eq~4d(^W}e9BCy9F7_S_ESK$$(ve*Ng1|V^>IkY`uA;a5Xf{_r zgG*o>X(d}+lsa_hfX()6`dJ2-z&O(CWO1=v!*@UYn$0!K;1U=|TAc-#)Dmt%-t4x- z=2~HJ35+AHE{?SR{*Qk=Y;!$ta0!efEp%+4MR2i37$&XWzOJoh z^OqZ3DY)WvAnZqdi1U>s@n5M0zD!>nz0*S4|JG98=*#!;?RVC}TR zn{S(LbD3Ma3ydSJG{I%sM#ATZ-?q7S7&#OeM_N4{X|1~U{N6U#PX?F3IMU*1Ydb3r zYWasvHdiu-83ciGq}2;lyIfsnx4+)z$~3qH#*tQU!6jP|zSulw=O~-&T7yeq9BEzX zNbA9t-~7tvDmAzS#*x-VO{Dd-!6h(`w0Q4rm+RKC3lG|9RU2Fa<4CKo;4<4+!37uX zvAMo9xCF+L7ROaPtrvzJJ;&xchm#Tnfl>NLtf%z{RdvN$QNz=3gG*o>&TkhBF0QXR z!*FoWZE8_T;T+*1CeFAok>#u=wk;B8rY9U3u;~C?$fg&|P5GD1T_pX>im?18M9f^c z=qBND2FJ95!nxDu!8eYtLYmjfPft2HUEd&Z)|I&n<`x4_S3A1aksgrE+j?lqMk& z#ffQ&5lV=CJwkwJ7EX(eV2^b*f;qNbNANcSh*V}HkVs`V0*Q16Yy={uNO!h+I^A^rPUnV?nFCO6a4uflg8P4QAICzMOruU#K zya(?`kIcJXhFIQ%cgsumF^2bG1+K2O5h5nM2P2%HN#wYDOY{hUTNLE~pYg7E9pXy< z)7};ThL`Bg$7f?dThOdS7J6nQ{3jppRG5ice#~` zCaW9Z9XxoDz|-mm39IXa33!zuJC@bqF|#u?Vs$g4aIt(=m%-xbuZlNJMBu$kPN3%P2mhx0|r5<*t2u+o@pMjCc#`UKGmwN_zEbk3x zDGv+C%E~jyWBon@%$w0TF(8{cmizzg2IkXfTvYuse=a=cXv;?(2$o)A$h#Pr%xGK; zc~=@3DY0?=%>}OH4Dwjs`+<2b8W$sf8-Up!jf;`LZ-J?g#>J3#9vyw$+$j>g51_Y*KKK0rfg zs=VC{j6^nG-afz$Jqvl0&QjiV;O0lmi<%uig>goYlJ_s{v-D?_aq)k6c8CxD{mcHg zIXd==DM}V@CVBjtz$++-7v5*zX>Ym~!3@JKX8VV=@~p^$zBIiy6uvqxw|vZ$Q23UF zP&j+aA=WLwJwQJCQ+ie$6_l;=%CO~Wcj4T#;(Z)TPbfCp7uOZ#+NLxi%@zl z9Wa-tJq2e62v6O7{t7SHUTj{jK)`F=vU9~Z-o+F zK2{X@=&(2?2Vc&BpY5$_)3^~-9@q@eA(SmoR`pk)Sw%)wQ&UB)*Dgl+4sS!;sBoc0 zs@$mX9DbX^QOo@5jHTQoH%3;gXGN(`72c-wATu|S+KbO+&?j8~ zAXM&#TNyqYBt9RsMp=ZBKHV<&}0dG@-|}kqF^6CPJ&gKsKIUA8_w zU%0zTLl}t+48hN>T#loxxT%OWthmyzSjos4zHhRYZ*k+Lhhm?1U#RT3d&vO5zKQ4Q zo^C#6_H0kL<&Xg*^1R`0jdv3&KaGp8()Z+M))amPKX`obs--Z?BSriePP$OA-?Mrg zJg&t}7FrA1JN92QFS2nLw~siNd+QzXvbjw`zUUg9&VDoxC(wy!wa3_bV9QVbB92qc7F6G&hJ2_ju7A&}5Z2ope2A%-Av2o@~YUQtmL z3r(;Dg8~WyDhh%MVj%_0 zbYbf--K^F69V4X-8%b1F4^Hlp@@8{Y<;{w!8tQa2{&{BnZvtg2dBgIP=Fb?GzISar zxS26mdzpF9q8+P*sO{SH{rXtHjZN>cz(8-+2c)X*pVa+;U&B`CLCMmGd4Ma0NWQx# zYz4G=5nDJqm5+9Nudpfr8XrrXdC?M!ZuIUo#>fZX-m|VH<$eEIrOlP{KKF1ms~3hr z9J55z(oxK|@$5P?O4%Fo`>IpgsHz_0ao1|lEXy{guw6s#5nOJW!ES2fRME<@3?JPv5R zlAfvDS z^}eZHq-q-RbbIesLvB&HJ|eJTNKvYUSimvZYZ5)b2b(5J39~d*!$<>_gny@Oz@^Ht z829{!>eQabwV6;macw8mDO{B=R|hHI7NFw9w<9Q}r9UWD>a=%J-3U)FvKm_55hG=~ ztCx97!f!10@tom}SFHgPobhUc!xaTA@+mCx@ow)Lna%o?I(kZ1;a`Y@Icd&O4ne--V+=cS`hTmqa#<|dXzhm!$$nN`HSMN{u{%p*me4>C35RDzxZBH_1 zz8oJUZ+dEPVewPMmg&@4$!z$n08@+*j9)b|;?y@WXzN&y<1r?8f zr*_QbT>zyDxF?FFz4&sUK~>b5pj1&$1!WbrT6E*xns7)S6R?yd*}Ibu3l%-Bdop`G zu|4rfQqj{e|EPw1$v+D#qlz9^Pkf}P=!wLw6Ioa($+cl;%95RV;V`jBx-TRZMZ&&* z{*WX9DBYuQXI`|L`Jpt_Ivlm2&FGh18+NEY7rXDlItrCBIu3oSB_yP|J7Y#^J`&nQ z5?h38Q=w#jCo5#IC#?5e!iUx)5O%zEZ8&I*QW)q0Vuebg_XwC78*wdzUdc%n)KJ{1 zk_f96snyD=qSYE!S*z6{N~@I{jVU8c2$9Q%lT#Lq$oL7c(Mo}tCAKqL>=Wd6I{ckf>7Zpic%AW z7gi%etC7`0tI?skRwFD{Q@a4#4=o#DN-K)eQs2&Yu9D>gfZ+y$P~j?y zlCy;;ChN#wIzxiK3RlIXFgWWHM6vE0E|_l4GOR@bhF<2D6}}aMiV1b{HND}2>0Jm< zEDESv5r?H!)2ilHIuemnaXcm1vJJ=XU8Po0Oi#Y>RBEdV(2$_7!ZEdqVrrEHQN})J zAa#GH#L|5$?yS@rdhHl11f`cc`LV%p%HJ--AxYm)GBk1#C!F!JWb~eTu3DN=XsL*|p(<>AxSIR!R-MjI|X9MKLU;mpb{m$#B8+ zJ_=8kD-OZKZl6`}s&s_tI9_x&2)`<|iehS42~QSAc&chn)O|Wbigyaj)GCUpRZ>LF z_K8(6{m%nqrPk2P)LL;+6vI+_sdMoq^u8>5{TB{mGH`F(Y&|F-FHv&=Oqhc;xo8?A3Jw%uFRu6Q+}|7)%5 zt*yFncgu}io6at8bp5nuwSIiG@|%x*G4|XupVYp6{Ml<0X7615#f*0=UY5D?)~_-P zsWUNgLOv2f9=_tygvzgcv^%zBg?n|!`92xzGaqeG(nBU{R`Sgk` zV^Knz_a^3|-(7d*tI5;b zUNxuFh}Xt%sXbE5EIL?uckH;x@ILz=`Q%vi8~xI2E&uF|g!C7q-}S2{b<2zw zjr->v!&a5u{1u-v#3kaSo}9K*vmPvRhF!p9!=WWk%Fgt(jf=Y@ENrpPnKyez+nHJL z!)Fk|_f-45b}md~hPwWn9|Y zKn&}-BaGuZLtT321ZFD!dMXKqGY9sGDU0vI0PK&65)8+ns-T`b^kv^b45b}m?72xj z_wM%R0x`@LM;O~Pb3C=E=f{Bm_F7p4_DhGx6VCT%c(&qCwLxgC6A!j#<4- zOjiS9a-?Di*N~bVfZ>C#at4MyyPflt!7w$y9>CcXz&RGc`8|MBJ<1qF7s&lNmQJKwJoDo)R0H<33XQYuW;?M$j zvIWQIa7=~;4);3r3Eg)Q2V12qwcyJ&acs-Ni8okm({>E|4dJx!EHbKZP#i;wZCN-8 z28ZocVfb`M$6iM`=AsfN&%V&38aV2tJ`mdK%;#}p5o1KROwSF$*o=)`@U@JM_g1*? zM@wp*E+rV7VKe6`R#^4!zG<6fmj9(LB^X;+)oo!Vug(6`lEP-9;sj$0tAaR-)#ugT5T}p~!O&(kIEo*7RR9#9iwy@ZrSz%3E z|KmVQYNakE7+YAiMT*+!Qrxi_)_%pW>r#TTg;fVwD=eN)X-OT`r37OOtFA~HdAQ@P z8Lh1)HWlZiTfZ z=AC_()O1}+Ft)H7h?J^nsO30K)RJ1EO9{pn7GIuPVHMy0;kLM@g7 zq1Dg3_jYSZ)W^D%U~FMsVGHZlvA2dl z1uO@SEL>zsCF)X*m6VTBLlbhsj69saaqlKeDqEKlj4fSFMM~xmpgyg<;AczfHeE_E zwsggc6njp(`#ddwvX)=1)ujYu3#%EhR(aKH8jq%^XPx$mE+rUSSj|OB)oLsVonP-w zOX^QuN-(ytTG+yB_W8r_SW>Z^*ue?L7FJ7etvvj7=cK)sRGKa&7+YAaM9Rp+FEYM& zSW+HcN-(ytt~8}UXq^YwJLfQS;~`y2Ft)H-n^J6*Hx1ogXi1goQi8FCb(KgNd3fz# z7+Y9vMarm$cfR&O4@;`6E+rUSSnX_KeforR zmL-*`O9{pnR-7pXLgPY3Yl%&fE+rUSSR9S5dN?$-UwcdHSzSsnwy^jPR!JFQRW-}& zU0q5rwy+XRDVEol=Z!WfdTtB&c5u}WuV&Qz=tnd-4IWL>Z? zV!~9<3>-pkva%pEX|~!T+H-wQwyzHtRm{b@9FvCyJzS5Gotry5*JK(iG;*;-WA;pw z4dWbpbjZL&EF&i~D{Jbk$u?m2f}Gj8R?G=y;Jz_cJhe>8h&_2Z(cwbiIEZ4I$;5 zk-fm454I9yUNbCNSd^QsZ$qwDC>fbzU~teb@|4Sw%n%JPmE9Nf%E_BBW9r19h{@Tr zvUBzIQ30Bn@{B2&bEgFO=*bK4%ba`t%$eDqT!iLdh>Wg}chIshb~-o1WA>;GqLBvQ z#M5Jb?o_p~%LZ3m9d6_iLYtkHoiQ^jLz;!bmg?kFjWcEfWvXnp^{_+g-VnS6e?LZP^g62KtYn`)4+}P zA0&0bP{E=V3>PeB!Ej1ndt2!R!zq22#$7zIMsIfU#G0r}B-X@TBC#g!5{Wf&mq@IM z(-UiSli>UIo_Zof`T7Zm=wnq>3?0Ei?czJccaqgl>T;>oQVH?KB0a8_a>;6`u6T$r zUQ_zM;O4}OQ_dOY%PoB>7G$;5Hh3AY&UBO(Y_$|0Z!$0wT*BEP9A|jJR`J{h{t94> z75a=qFkCYDS2?l98~=1v8w}SI{1w2w?~n6&fTTQUq-8pW_jIAG_D=zK-bY`sRYBBO z-+0CoZK3rw1+JZrWjaFXOaGhth69&*34MGdTJ$&d-3Q#0{`&l^>=!`aRzH3Jz{-9j z)LsAIwz8Lb{XaIe*VI|YJjpeG>tK}Uaij%SLwzIN#RH>ZBNH>)ec=dS6Y`ZBwvdL& z4UU2}Oags2gT$7ZZtu^u|LpB9UQJa=Z}Ls5-54~rJN762LyrF3o$BiU7i?}NL>Pr& zU&!BKahrG8Fg=0sP8XVKCCc`Wj0;TFb=#iu!^03CzOZv@OK{~&Q<#qr<+hY=FSh7D zDBI_{i=~udDvcdrBelHB?qYsmK{5tP0x#@!7ke33Nog6q_!@|h#ZIy2V#=WxSH8ZK zEwr(XYf?0f@py&_&U%$xqj6^pTZ343>K1a6Fg?D|-=(xA0DO1q6zh2gJpwxRMUx{W09KY%v93>P*i5B?Rw@sV?5{{jX;ne##N+^mF>Yc&G zwoPRBXE^mPjv5q24eE*6_{O}))7{f_eeb6yc1piv^2X0TTl>_4k_NxsvU0>nqkmlY zbfd^UFQ2U1yF90}amM2ZJKfPc=IwgWxF0j*mKH0%$UXM#j_l>vwEd)4#M=13x{ST< zys;tOjQA;=|2+NRD@Kg|o8L~i8G)L=zTY!hF&tqmAr2(x+x5u`{O-q`bA&NRIf%?^ zlr=XH!@BGUOXd~-Ya6YP4aD$On6OUyl2b|0@WxIt|*obk1X?~|1?IDF@0=kzrg znt>S=z?l`mSrWi`Ab?{OmGw33eH~+cv-(=+Sl`Fa>m2o^i(ifS?ud^0Bj0U|Pdkza zb`JALecS0s5jf_G{o4*-wON~ZJ^AdxU#zbgm$L}r1Y>)L#2RnCud1`_(-$nM?z)s< zZ11b^s>m-a>y6rIT}m*vu%c{XwV!b>b}?e=>2B1e1Y-+}U%ISx#V=ac+4^!~eDf5H zEi8FsYHrlDrr(Z6med=1Sn92+?@4s*X06rp+!V@s+xodKB^X;+)kI2ZLtlCSA3jpy zY#4BYvAu_5|LF+hpl)}~Az?fh27O6}qakv+LyqkQox!xd;xU#4ivNgS{L&bo_VDAL|;| zDPBFt@ad$9Je`zddSG;U!JbaCjMiz?&=5~2EB$ctbdoC@ofwkR07kMO^KpqW>SeZzM20bM0dK zSibqd-0zPIqHiNGrT#d-^fH-8fjQ-m3!=}3=YaZr7J$20db{cvg$!N3slW}tgg!RM zxqnmNLf~$_gg(~$Rew|8%fP+iug~wPJQ@x5ke|MP@KnAY(VPEYek#w&oc=$sHxi18 zd+Ft(3eT8|nMeNF#jj$$WCzbxpw?n3RU`bqgx>~O>G3jtJL2~h{8rg?Bi4ba)xM>h zCX+5WdzYs{!PzsO>IG;26xL>9Tq$ptZsPhc{R|0f^@iJfO*9{$y{VDMS?dxmmO40?*nKCf+qv#<4(nw3a7#1jDCn zW36+SQued$L~Scv8w=G1*Epf{R~g2FWECowwx)Y`ct6AXR+k+3RB$dTuMbW~((-z^ zy+x9?;v}p}WWwiNCRwOftl&ijP6lEMCv8ve+Q6Z`o7}Zg9e2U4lySJdw=3CxVQ$A( zB|d*^;xbRy23!$&K~SmQeFm;zYXi4Kt(r>nif5YR-LxX13jU~=m*OtIT{5G1WCO_y zDG7J+)eVfrnA-)5lxl^)dD?Jo7}wR9v6LJu_@hc*4S!AL>x}X;!Ll+kPG3r7rt>N2 z<|DpSdkcYupKBT7xm0_wYlEk519!1I%w6QAKUSQ_ySo>#q~|rB( zpo%kbIMyc)Pa2Ul(p@|wcAq={#4seFcfvMzQA(W@o~DLnduP*%W`2ov^!WMC zT|E3#{C=9^{S`mIr+Clf=K}tJN-mlif#1q{Q+5@uLyrPDB~9LAiuau_Z@J<{`0^Hz z=Nz9)Tr?}cxgH|5i`;`E=~-jO&{P2Y|{mR_>d;QJ+fe^2#tPXP&Et={Bg zJv_gI=Y>@7Cw5OZ0k=2hCqy;cn-WnJ(UYB_tFSTn$z8H5y9(=oT6|NL8m_{spfs#@=vf0GL{>Tp-#DJ0unaMSM{H|aHLPF%d5vIBHJY!KuU5kl zj&-W4uOO5~;`LJXMWsfYNhm3wB#XrTJ*dc3li!=!nN~DA68|!mUEN@N|A4V9R0@)d z+HsYnUdOzuj=8<*b=(Ph4a?uQ3`t4KNE(+kHe=k_QVw%BgL|l{TeL?TAVJWm0ULvEs|etQJCXA#qEgc7wu`5@bIH#Y}Z-hfLm4lb49* z!pA5at_F$^PEPGcP^zup3QF|^_kiLw*{MBjQZJg+29qiUr3Urmpp=$y6mJueZ3?Qr zQ1xOXwc26TwWyPkM=I{cK}F-k2g8Fqe#ndWc>Dqk_l#WCr2~G{swYK7;=a4^8b>>| z=xxzjWCw<6NpWhbu+b*P#}Oq(-St&4pbR9Nfu%nQch(v&BQ|!7LNhF-mpb{dYB=R@ zm+22rW2Isht?Ce2sVI5CQZ*dkO{x?tiYeyfH)6!2gnr>$I#mz&OJ9X!TolE0D+%f~ z-m8Mt{TVAu_fXvFy0fCBei;&>bSnv>e#gJzlt#PmYvHMK(l;h{j1_yOmpY?RTMZXX zZw5T67n+zKh&LU>ptI+Ml4lK2c|zS2E}=ggXccejGxUavx6(_Ue63-)VDX*~Pt*We znHzzXxfRXBq}ZYj$5+^@1}KWjTgKTzm2E+W9{}_tP8KZunx>&D|s26Y|o_ zbDPxZ^?v1j2ktFi+~B7{kwxv_e*Md5hBkY9%h5mkUw+|DW36H5o=^4t{_AS9jPFUt zfk?($JmbJ5WQMr^$KR8DUIMaUhWh~b##2xBkH@yqq&;$nrF_&3+b#X?Fs<7*bbmDxEX42EW4*k+Y8IQa&{ z#5^9rDGA^l3E=QCNjXDvOqf5XV*qDt04G0yvnqhIGk{YTz^R1s+a8~Ionx(QbL$*y zUE6q_W35@6uXC*LcK7QX>ucXjI!Dutw5xMeS&L(&zTxD#0E~SVTi{wVd=c!#*#;eJ zi+t@%;LL)Kbxb&cYsA=Xier5ijLBi0wSObzXycIGCYgoR+w81mt>mi8rUEAz+xIPu zQ;_1=M94iqE_=+9x=NQ4jP1Lf;KMi%BcxT$Q>QJd0lJjZ+1BS(V^!kKu;x!2*}#&r z*6UHH?{_=(1&*@^D!$(NWj#ykHa#r;3!G0_E?Zbn-}G#OCH0&xB^X;+5=t1abhXz+ zOt4m{y{Aj5nE0lvI0( z&6+|>s#up2j4iA>wy?g7ej>t>dQq1Wj4dpwfo46_?qB$dCACMFQnl2#y!c#TmDfiP zYFAiNCv_>o*uvs`-bz>E(&;{H9;>rC!U@KfE{+LSSan{D>2HPAUY8P#EiAE;G3z1M zJX)*#hU!wvlEyb(e3N2@wS8w|UrQ=imlBLEEU}IWV=qK!{|0}DE~PAJe8b`!8Y?XO z;Z~b5(%d(=%yy?#v7w zVR~dwRJ!b+^mQgy2;}7iK-EHn+}SvCCS&$2Yh8_@if7bhg!c9o_spLipx#G3n70z2 zJ0&wWJIl7R!wBB|%r8q~X2arODsxS8kjrs$u)t;h>|7k;gB3*lpnnP6#V~m&l1u8z zzBGnbX?4T;?$fe2xV>_7KWG^%CzbA#gD>oX>j zkuh=h?CDd3FH!MHqizIYGzT+Dsv?_b?S%4|5jxhstie}%FmrQXe}kw0)e4asumSWkMi|xDyostLZ|D$W1$ltAFo^V&_bt; zSm^L1fyeZLD42y#13q*5x*!%hCGa2UhZ74OoKohAojJ=8F9cB;WBeWZIL}#5Fw2(t z7#ueN(~eIHaGd%F!}S3FVPFpGIF6~oa2(T*0dxEkI6mP142+ur!f~Jvrf&uKlYr6R zH_D@XFdV~ejwg`TdjoM5WPg5ly2ZYE~;cXF-{$6^tjp9Mz@_(y>W6S&k%=wtRy{+s&d0=MWA`sn>IE-&l2i=}r9Fxz!psPxkN8(hx%G0FX^j@K31c*zh@<;%#_utSr7MM9Y?qcy<2+Xa2L*FW3 zUh~HV$-hs5Ip&Y^OE1fV&(GEQlniI)OAvkSfa&g!^LYtOdFs1X$MBvmF?w*K?=fcN zO+iLX^~3!G%c^xy`QJWOWM<~Xf4tbqSRQoHTd8oTXDAPtSX6>jI>JjFd39h~p&LAv zY-hQsB|)Y6M>VZv5$vn9#g07Kpm@)~Yx5nr92XE)NeQ83!~`j3G>#`o+O!OrZfrWe zX+CX1U>!8Nl#j)HRCj7uUxNt4#|AsOh3~sBPTK>jT4l!@G54+Xx+# zXoi#5n1{3QJ+edrtH4sdA6veT)S})hT+cvTXtMji3aUJQ3p2I+kgbFoNYS{9m&dk5 z{)k3~poff4_sb>Yd_LDRXXSJK7<{fDUCJK%0sK3)5xAAZ8rM!jHGoo8$SI&yAzuxurTAuo>LQe7c3039rHHNc4`6d-sVwF;$ZE@G*rhn! zML5dB*d4i)VXDx|K*?N1MG`i2Et9>KQc%YelWf^n%U!TlRdO+#YbkE1=i7tG6rV;O0aG$I^^ZaIs3u;prCR&GIbRwg6jt zbH1nwks>OSSe*PU;FRr(Rgo0nUKNCY7P5h`{n6ej|HNY8>`BY&%5s;;P>c?9YOlkHnC zmMGgZ?}usJr5^jU?@Rd2wfXycN#3$l?-|sMeC!?t>#Qa0M)S|HUbvR56`EDTwd6^m zBZaK?|a`(+QjlsawV5|_j(U>-#WLG7!8(jRM|WQUf$2j8*g5wh`Q3L zg5y%Pu!3m9X(UCh+}+R3>*U5M1UPqPyBx$JD_~Q-AIg$gRzAHDS+uS~c7j~a8&`gr zyYPZ1T3S2$X9yez7Iu5D$CAL2J@9ueDJG3RBX{;B7iakN+2bxaS~AHxVCJ-IcCs@O z{_nX)?l|pQl;%tn)?i=OU}25-WsMhBjxQ_6T~Lzf?!Gnmd3X2ib8F%Zn`Cr~9%o`F z_k|L$a!;pW^)hN=Vp{79FwjL!-OTPq;?4xYI2tR1Io`G2YaDyN_l0*|8^StF zTehUSRGjX==YE}9yn-}qykpPiF@`GdezPfYG^cuL8a2_#*q{#4`suw2tLc z56uRWzl~u?vluOl7*xAxkFtn`2j(B3RDHhz6uT&=Rttl3H=#02Y8oijeu_Y;_VWNJ z)k4;Q(p!j(25#S`A*VK+!%;Eb>fX0~=3V_bB(e8QlwMylQVjf1H84M6!`BV{Hb)~i z%uBudH;(myXnEuOuVk8b4yEPDt0p@2X-#E%>t4gf38eUF6z?hfrg(dHCWeV%LOb^~%%q}+K=)eZ+Lo*W} zSA@eI!b==^*TaNcb+@jKwKs(!PLsOt&8zR)*e`ri!I?x))N6|o@TBfr(R<5@IP-C2 zQonGVlkytn^?F!h_+IPwVuib5LRpemUC`v12gK+zwl=mITYNIkmPq%$o#fhFR&RU% zNQ8-ox8GES5<2984rQV4EiJ#yn(->0ZY(Y~=k}xzg)U_*&c=Nu{+-$?Tw{dVjB8_| zw&JRCowYYXc(j9z7pev-s;Zv#Vk_Zfgl<~pldz>LsgUCw?-(2&2M`>)v%2{0jDPgJ zaD3%vIF`DyeNq&Y*++O{V?`2<69>cf0HGulMG3d?{B5l0Z@8Wyl$4?0f+RXA!?6q}HeAnFGE8!njc z>)>fwz!`cmYU$eSAt=4nxx!FtBJDEc!G{H0MI2JnUX@g#k3?_rrG%mw$|T{{i;2*x zg*DP5j@V0iFMMm^-^#TyKBdf>qjF7A)Hg$TjU&Ug$Y0pTHO-Kqufj3c6vbRq5=7BX z)^Nde=fcyFZA|DA{w>EzORd9B|(hPyd&kaRuyjRxT*<$jlMt^SG`FVVudy0Q$6Gor$q!GoqZkRQm)?k`_MOk>C`Xc>hX*B zWvu=2z*oD+taRU4ug8!DX$PvEU;5_v8!9KhUD|${aaO|QH=lT=_ZwAy%vd=o_olVo zRvBj{eEH6Vr4h&PN}W09p ztW(awa9m*q%Lx4{okMF$mG)$vV_98h z=p4&>^G2Ox*=nxTIhJMSTAdTA8JfAWgwA1dj_DjL=YQ2XJe5GrwyLUVq5KUF_vD~c zCk2q|pmVI#1k!YlrFpE46KL}p^fZAEzCFI$^QAolgkxP34yW+qSlboGs4c8(io-F2 zj%l)6fpW&>2#dj$N#8eY*Jf*%lRQ1ng0Wdx*{vmeuKWtMnBmiL#SL93Ye~k6ZeQ1T zT$a5Vm(I~e!!bUEwiM~=u(2Qg>|_|8Fhm@7FqiNUBMv;PB6Bx>Vs?L;hWw=SiofDAzxb3 z3C0#y18^En52#)*xV z)cv}YU~FMsVGC=^*hlZSq|iXc3C0#yj7X^#g!UD&x}ha?NS6|fEv&{OC8HRq$jA1y zv84Xgr37OOtBFW4mssaVUjEf})|m(m^&$|AEv%*@WrQ_;;J6`{R4-jhFt)H_MT&Vy zccec6>C9Th=-m63pL#Mlt6@DWT z%8k>dh_Tz>wgJZxHiZ?;<_aNUTI_`~qty*CZC128PwY_*1%{!f&9GKyPQ*9cjJcl7 zT+duHKwqyse)YD@JAJ(-Azx+tsh6h=TQ zy;Y}l;gH@&u7m^_`4JLeq!@&0KD@b^(*W`X7-<-_!Y2B=bzWmG8? z;O(1TK>@zm6%^o`T|oi9*%b^BXser%v0&!R#Dq>4|I^yVcTDIUW4TN12p%8bwNrw? zY0=wIEP9V&M!QuX+Jag1KBP~-%+W81MejCv8oO;9xI`_wkMAoA@}n_~-j3GR`zkQo{c%!b^#Jh0aK8cOlt0cdz0~JIVKrre!I|j@qAv-U zbbnkBeba$itgye|0+*Sn0hRE3Vw$980;QR)3XGdePx9|FI+fZ zaK<(NV|~|j@A6w9sJR{QT{s%TCi8!mZMWQ-Xy#eCdDB@$^K$eXH4o(lVYE*z7aZ2D$=B?m=x_7BE|GUwhcVzt(1Qj-A?%Y zZl22vcZwarW?D45lHc~RUc{zn*nwZSOz=92B8*Mv#5^K@t5l1#F4wKA5h1f`+=d&Y zYFteI;@baz^rd;GvHcph0%UamiR%qvj?_;10a$`-1nN%70V1mW?ki=sM!nkc+3Ce;I! zl1(%zeuGdvw@Iae$`aYZCN<2YXnv%84WnnZ(OmwCy72L}B3cs5T1m6#W%z|Pk=uLD zdl1{s!7S*igb#5p1xy#&OhC0v_a0^a2mJNe#Z*MwA@4`&MZFZen7N}Vv*#B zGRqN5sLRs5A4uF`C1#mPtJvyIZGfi-&3!Ap!G>0N$d&v#w<%jLxn&wXEe~0!wu9R|$PeY;h;M!EEqquUq?bJ@= z+D@nn$motjv7hWLR5MULgkpVX%XVr!FJ6rmcY|_+=g^)6rA7#Tg^Ll~7Eo%0*bYjK z5TAfjBg7FoJ zKT+LFe`R~9-*vU!wYJ?gwB5OQm*#!PP^2HL!`(VliyE0Wo_2FX*crRI=my6IxvpS* z{;_LL<8IY7Te~u_5Dwi&L8h9=}UDwFRJJg<1-V-w2!<+d4}Wc8{R= z=*NS4h_6U#dT2XA*dBS76R+NT%t|Zv5 z6~%U~D7I@wv0cv-S+;9Mv0W>Q?OIXX12@_*dXM1Y*gSE%&|Sk|;fh@_8m{mna`=dicVn@=D|c zUf$M3ZAPAG<&CU+2k)y{_vjO>2+62k*Sn*rvzic_`z)6Mg;u6p)xICx7j-=UTi_NY zl;r<~-*DN~*>!hG1+J=Lea9BmcTm$mb={#r)$u-{I9fWi!MLJ#K#jc?*V;l&#yy8v?4cP}hO#DO8ThdkEAJ@EqD>poR+d6sTcBJqv2AP;9G; zdI{8U;jIHTLa0rkMhf*hs8K?dfKn3MOlpTo?J}vopqQ_C)&q5&PzOMb7V0plF+y>P zmp9Dlc3rn}l9pC{8LnE2{s5iscrOW0&_Nb_{Wo~VgMZ7?|B;$l2MK!v|4w;f$@&Hx z5?sl5%FIobD(h)O;c>KAJeEpR;boe*IH)PvyFhgm-oqwu4X7#j zcW5u+I#sB3xKgJB`!VD6E}>YT6;%Riy70D{)DBQHgtyD2_JUFpADh$xlR9itM?lTQ zzk1SF6uTuwoiM3-&7-thVNJEFCo3PRwAarz9(9RhRWH$li|vYh-SEPAe5A%D8;;l4K8=Bg_SX#Awge-t71~opp*nrBM?W! z1=D>yJZayHi2qxG}-S_;5x~Z4_h~a|8`$1i|!Wj9%A;QWxD`!-GP$%aDh6|?m zad_$_g#0i{XpE24BtbAFMX?N?QBuw@&B^8icT)YxbvCZ5Och0m7le1QlL2FV>e2#J zgQBS6Ri(ja1wgb(9{_?>;c5CtN#CyS_V|JDmwvCkG3n@6^_G0mc4x1WPK~q!8@VBvCeyp zvkLG0c1Zb=h$j{sw$_{Keh~laUru&a;{Ka9&g_%y&iCUNCo*amH})1S7kz_5WKsEI zSf3nWtY^gB^O1K|AO=rBz_5?$1nQaJN8?46zaI7vjxg4p`k*RZS2{8f6CoJ3gjS%| zFSrAPq`w~47e^RtF=rrizDm7XVQ_=d!f-L{H{fK{6w2T?hD{N7r?Pr@)%|D zVF2da0L~ve$Fjn%#l{C`S!%b|IZn;c+(+j`nw;x&PDPWGt8?(ySFiI$I>*YN2W*_+ z_S6Z8%aJg(a=@YSb-3(%IYruE}BG+8SSuoO$}Tjl;4yWaBV~r)(US zMVKB#RbI@E>NXA|-Pp!qq&crKg4^2)yqu2l#84H+pN$EUr$&s)mrFZ*sBwerg za->GFzcZ!cnTj869ICFOhb5ZZGZl1}6a!<9$ymVn2!vw>IU*&c)6l`bFxxO5UkD9aUahCWz=8KUs-Du-b zbpv0HS*8r#zUrb9abYpIA_3a7r~96^))~A)IGkW?*0@pNTGqHz-s)9qNqwYC3C3pm zTiKMN*3Q50-EFO(IIT+w#ugTzXsoavxp~7BOR5GdDV$(zVO0g!+Bf>l;|a$tsW@Fq zFt)I&iImcYXUey`Y`3Ha>r#TTh2^q^HSE-pHI`J4E+rUSSkbnyeqOigAxr8GT}m*v zu&Q4qte12t!Pvs8VGAp1&jVeou=eUwg0Y2FQ>0WJ@b>iXqx&qWle&~(Y+=>1g|)2L zpT(9`G&^`W!PvsO3|v*p^l!HN+Gf@|o;Y1fFt)I2n^LSkTnS-GU9C$A#uio`kz(IP z$JIa9x{#T=lwfRO)dkk7hXZO&zhFrf>r#TTg;h_a$fx7k&DM#}Yji2W*uvsBD=Vx; zbIWE~QoD31!Pvs$Oy4?_+P-q7T$d7zEiCCN%vDW~cH8xtwQ|L<$2WQtJhiY()18`R z>8}ffXSbT?+apKVaRYAt_Ja%`BdXi8FjRlP1T{7M?6W18}mG zou{cgcWO@d%&hoMarPiBwk=?bZ4ch!`$fX?@QaG&;TIunRUL1Si*Rhw5RN?t!tx7T zcz)q3Wy=2F$Y1ca>_8^0ev(SC_H z`F?RR`O3)rA1yhsEhY(K%Wn7A?XyE9GnBZ>1buIAyNSQ3*ZswC)6cfw*I(IY+xOn~ z^;hzt{gu3Z*Xcm{(Edu^zUOqHd}#krnWtJusLa!SLka6uCX}?{9ZFoUS)s%Y?@;0) zmq19q7}Ya%X6EGVKACf~ZJWNEJ6U(^+&RW_m$ZA2i|Y_CaN51s61(@OF&>W42c}?l z?;Z4MsX2CquzR2AhZDPZpJiv1zXNmI7W%Zw(3hxThf%*BudlYS0m@x@y( z`}0D~*!yGtwTrVUIKqSB`hve0b0^u45i}?I!EkdB?rz|E>9Z9M`oZkk$sfTvi;oLs z@0<(V%{rD@6wIET!9Dah^{oT02=(xj~a5qoSH z0f>9y%&<{UY#H#t+QTDaTJ-F3>cDI76nxO8(><$?c1o(1mGH-|l@EUq`(UrLH?=!9 zablIc1Ha|J68_@0%o{%XveEwi=d&|o6MnrSqvEW+g%h)f_x$1V)9Xjp9JgrX&W``O zx=PNGZ@u%sdb;Sd(?1>0ZFp+bRvx>_6u{numAJ)wr|H&cxT0_f}3g=yz=hp z0nN9*^3%Cx)BAMEY&qsWBi-S2KGneB|F6oAEA|}zqT}f9+4UTwU+?hC7iS*|?~=K0 z_Rdef-5GJi!G_K6{QdVIuU-DqxvfhNHhA%`nw1J`-j%biW|ft%_q{&(m-ER(zWOx% zqpY95YBcB9ffvTSc+2w-J^b4v$7i;Fr%9)7RiA&S@qG_g{rw=v6nz@48`5#~n+5S{HxY57QcjwRvPp`_&QS zqwdU)+ctCig0pj8(7IG=b^ntI?|W~!yy0s-=Ok)9t{n8i>a)dByP|HnbN2^3Z`!kB z=lbgwEqiKu`ubxQ*|a9-?=I~RVQ^>WGiv{zRwPe{vY&~5h%6-WNL=fs=` zuNc#7P(SAtUGn??k#>IF{8h1YeqX(MYV@Yz?b{xjn0Vl^YA5gNSfTo{s5iG>ID71g zS&LqIba~ylrlq59?(&&7|KPfLy#@`u`;{$Q?|wJC(fs$$-u2^iB~7nvS^u|JpXs`_ zNoMU^qK+RL)&J=m-#ojsQvH5yhA#iKwZk**yG7$Bw7M$(vI)=j8$5PLn@z(KZu|Pt zAsu&)zO&BqJ#F^C_rWiY6A#yoez!$y=jiTp&K{n=_>uT9Xy*GaUum1mE{r}%m|M&bd?YT}bXlcJ`JGwOLb6xzw zYhKJc|4Q!(k@U`^%2i9=x^j!U^u$yI*+V zp0oQmh26dEV98^T{}q?FYW`R81!o!#=-uwAk&XUbeq{4)S0CR{IQFmHm!6*W#fN`9 z|Hn7C#hp9%W`nVFp1rx9r_q_Me=Ys%=`H8KiJQEr>V5kfrvCnHa?i*n-&9=vOXi@k zMpxclaQm6%pDg!oeCORhX-2!J?Q=9urR$~@Wnou&*;C$o0w$a}u8m<>Gxr+J$J4!M zCpF!g?mhXMmdGVbU%h!36mX;8Zf@_`#I)|E^K_H@6L=O*)op}RTYoXIxJobV3Z0<# z&vtuL+-XH|2_i93{fuXB(x$~aISO3N#mVgn5>Klnn}EcV7RiV$ zaumS*x=FaZnD5`U@?L)Tu(alf6eLLb!_wMz4@+y`do$8lA8>gR4RVF??*X2V!D924rWNCWgjDb7mZ{#kap~TP zT~fWrxQJ_P=_vSLiGQb9p|%!k8LoT|c4~K;)B`5yw#%gUo75L3)e@P< zZ*xwq9Vou8acW&a@!OzN>kW#p8l0LN6u(X4SQAkE-l(<}=eJR(#$5>ch0-ZU(eT?W zj$r_g-&@rhiAF-L08df0>xdN|?S>TZ6HrZrR}PA=m|*#h>ZQ`*GAXWAP`t(_#kECB zU&u8+gSlEQ5sQ3q3I~pIkOnCAg?x4NfKka0xRxwM@J2;H;K?;A`T@^4qoN=13@|GC z0S`9Ghw`^r+x>K6>vyag9q;zeh@C=Hew=7=W9$Oh@ejtj6}?`UH!+BM1`%x#5jr6O z==Iy#9rL8)rRs;jC?87Nic=Rmc>zf-G&iqll6_MjRI#j2|+(`ZmC2H7Tc zBPgXsEp$iaNb8y$J9utoSpmiM7Nbj3y*pK@;>3$l?&2z+L$T&As_Vx6cz02xaV`*p zQ7u-lg;+qtMP@;V2CQFgrXjB|D5QDMVW4=6Lqbn3333%ip+394c^DYpbrqgR9NpdX z1{*`f&%8%xrq{F}J-F(?TpRm_t169i576@;ccgYN@eDJnbqUUo(fjWb&s9dXF7ebg zsx=ODU||?F@o!a9JytkcDAlN=2XKQP|I+c5Uh)EZNqvRP0dHv;mwqH1QoZ+HvlC{u zf5E88!_jT)c_61K+>Ktm1gyP!YgrH{qtM@p0Rp@SDb|+@`6zW2c1Pj(DZcp`S?QZz zVvZ_u2u5`vF|r)-X^Sa{kMGDLxH1kN-r;UU3^m|g)#AiwkNBjFau>ywr9hh;sACKi zF&HQ?SS+*;7LyQd)#7HG)B=;rH>o|KREs+RO0~G7pj3C~2jiV^Bxpp@+6CiR?2y=qcBKyixT z)V>6zWZ4>&=F8D&nusqKn5s4(7E?uw*>;&0^WYyGSI@Hi&KCE}L&XLOo1FG>0 zgW;|Mp^V`b6^Z-y!V9Y(rPYU)`dPKK`WYsFwP5SNW|TFW-+#gs&y=ao{dZ5kbMU$PEtidHlhU`ZW6JjJ4?H(0Ja$LJ z$qSB8t#@Wfz0oU&o_Ky^@(1@^c2B(#zg+vyrYEnAe0bKu3ope?|M{C{+ut)x_X{4J zc1rs(=T<~c-2Y?KeV^}l9NQgX{DMdKqUW6l6~!xamQFB2v8HG!GmEnTjA$F@6+&#B z6X4u|x?)Mu$ehOL7H2%}XdGs7Xo~2tVLm1X)}$7u8nj|fiq7%<-pIH+!dOGug4c~| z^Q8Jd=!>D{5VmHAJX_R9r^iD#ZfwgIXcgoL>x(OW<|I`@7WiXm;OYotAHd$HxN$pl zp~TQ}$+>cdS@pF69G;kC$1DustPJ3+3E-3ja6S&;91q|aCgqxD#4wr}3}=~?x6?V6 zN%;_+Q^AzV(K(h$`Es43H2=*Fxx28hq+_m%`DmvExmWd3IDux>vQaKSg~i5ah1H`VC(n|quQx)$*ur9OZyADi>Nn?RODaW|5{xaZsT78d6PR=R4RoY&ow+Nnzk#ugUGE-MdLzxd*4%LMmV zT}m*vus9pB!irkF<_$}#zHTBY7+Y9u_jbcV%N#LLmlBLEESM(vgjMaG8qZi#S-O;9 zG~Y8;#WXbRG0588t&r%QHDzYT;EeWh9l9j;j_=*u*P4i*e7Q+xMo#Y3nb{eWvu9=J zW_o7lCMI@G?5ZUD|HqPpGZNxDxBt(={7)qZXLN|`+UY+F^FNgwoY5)1Lx=w?%>Pt! za7LH-uK!`){s)pqotc?4)out#hRp<#j2Wm=ruirtx!IXn855??%FMmq#-E=%)sr2} z13Lz1K+p!Bn>PVr+ZAUo0B&}c4VRlaD{J;llNHjEQ0o5l?CUc!C+B8o&&>8wO^ZMA zhW^>PXdQVIW=x%!0kEmogy?N1JGk%EnWDg7ax$8n9?#ey#$G|97Q|#M7%G&qz=VWS z7zC*-@$8m_A+kr;`uDI(uYEt@i|hS+*ie~ZE2>cGw}V2d@+sF)ihLkZ?czJd|65jf z9lLbw7(+*^yKZ82H#Jr*T4N6%%<2xO(AixOtGf~)hWg>e>dw!at`cT)H8GiJz(F34 zV`4DtH!e1N9hgxZpy4V3P;+F#4HJ8xG_{|2Uz#kVR{~ibC1%F(S_`MIzA%9#D zeP@BGz}HxCW<3a^uc?kv$k64H09@}&=;PDQ*uSYS54ikG=wo;G=-<@$Ja8K?p^sH% zKQO2KaY6ErJAl>a3j?@|%GB9uWa zADFZLxFGuKG{KiF{L_U>FUundm}~rTLG;ZAW}!dM&&qmln5NyYVyoG}yfrq0M3lRhCkYgpRQwpmki#|+7yk&T5I zWB9Z%G57i$Jd9*d%=yQgUZ;5v4;>EsjRi^GgKqEJu8r4(rxy>5bZxAZ@I!jhz<;HC zccghsQj4amo$Rm~cH#TTId{>z*nc6({6ad|jXiAd;0??(9>Z@M3`Fqd_hx+fRW=yM z!4&9tq0)*w^iJ!#PENX?E1z2jZ_!@%`IxL=Wt|X^YxA*4SHTL%drRdDVo%hNik>z- zv2$BRPjj3!jh`#L@8=)Y@Es}tEZ(YB^xy#MO8AMyExxMfMYuMUE;*DJjx86lmu{k4 z|9V`M7TYDQctr_x^N9O2oOX^c*GpnINo0p1U0`Du+YiWmiA>zbND9i6Eg&au@WR2+ zx-vHu>)J#C4*o_K=_;Vj)FQ?j@ow*$*b=HxS-BrJ7!ro~)^r!wYNsD8uW|+7^9d9P zDaFOt#L5g~FBHLM#@yY~u)$CVjHjtj@~V_rYEpy++ZK!+UD_Iw?eMR*XJ+s0l&v5Y zRg8NM>`v`Illl!*7vZ%>L0u(OUr>s-02FmPwR=IalXq$_m=u@mD}ALV^%- zr@KzA3{+d85?M=8K5wTX(XckUCOqK>)Y3F$c8sc|EQ1`$7uHg4HNX$k*v69|`B7gN zLys~_z*p)~LF;Fto~_Q_?ygH>pM`)YYRhzdlq@?0n)O-?E8@6o^JC<27h|;nsLuyr zS0N<_6xZskmz+{-Lo5ZtUA%(jrAOJ*#;ukyGaW6{iU)O(nvzz$w1imhn|!Yc_a67| z7CEUUJJex&q0cM2oxtZPVGrtRcXFy^4>9d%wl%PPVHMyAKmird60p6Wd{sp$@E zgu6*gWJZ5BsrwFB;p32W7vH9G@J2mL@NvJJQA*ppXD7RAhS#mPE~v*$A+CoF(ca%3Ff_<)-{8X@o_Mz z@eX63rCPUlho5&Dqt_k(Dp&h~Qn@+{l*-jSP^v^80M!)#PK_y7JPvBTg?9kgD~0+I zSLLhcC5!>NZz}p6?1_Jn4KvkyR%#KNCHumdgx_2nD`OO4npM?8ZVUx)^93lAT=8z5 z)bzb(+MWv+Hfu@Jt|YzPp)xsk$|P5c>NY1;e$Uud99xTe4@j<=n~X};ME0;gBYQGR zJ43yymp6cFkAJ5e_T5;h<+xh4B9g@b0~Se6{)w0{j6F1I{GKUF_U?6U*pZa~6=RqH z6Nt0eSeOyTw(YJIRl?E|BV@z;@+_ubFVl~F=mSW2=aht{?5e$!5 z6&66bPak&1sQcFM81zxFLYskhfjW>hE@NCNn}DhYw0BX}fGJk#dVTmBjE9=1rdT90hr9G4+2lD(p8ku5-}q8JEDwaAH}0KHfy+{f!AOT z-kM&tXWXdLQJdy+jQkvIvoU^xP~TMz#`}S4EC~0V9yL5Od(`oa=n?1X*dxhRc$dhO zy4$cTa4mVAw*|+;Jk{JiON8?ruI010(7WsrT-?P4G$eDcUWEBx-UxU8AB)2=OsALS z(-Xr}n-UP7dG3NUiJqMDjszgS^Xq#iTE3$YMvP|&FfpFA^6KKj7nPpgU`2R3C>tu> zG|Nnq^udE!q?kRZ3KnA=K`^d#3l*q@x;E@Yl|^#Z7>yi?*m46RUB1S<*VN|IYuqCv zPnvf(PDPlM-2F%%%%tvku9E$UT9t8K5#=r4W77FS_o9nuQF zYzbVc>y&*dV}x3Q9BVApa!{&uyaP)0Dx9dPzT_wIO$f-1j`t=0Vp>>&U+-x? zyU^guUG$Lnr11d<_h~da=P!oexFoMjReR2nTpNzd4d;RfDCt#_sc3ME&!crE{q`Xo4&bl33QjB6dwSX|>g-58py za6ObrJys1#V#J12-DpVfLP^=}K&iI0Q3CgEOY@AjG_#CGEoN(RE%EXe?a8$yA5?j| z(WY9vmgLxxnSwkX<61IO$$;WEjOF#rHs)H=LwQBGmb3vCw5{RXk3zO~!|W0H?YCXN z47WFP2F1cKjU}yyl9x%l^OFoqjkamt<*~=*76P0xAK{JnQ<^TeL|7>MfXOkM?&b3A zMyPIA>h2!lxqQo1G#$>gMI$s*nN>LylKsd$4--b7Gp=v)D+mq_rudDZj02dcjCXj;@msKcOCXkUX;p`9>!znDCp)2{lt z!Jt$>HxiW6ybzS?=Wa214}wzt+!H1*tWK0xXIK@jPKU}`o%S_PRzKp}TeYO}ctl0J zn-|?B;#ZjyDk>89oDAsuOndM~3eJ$AZzBF3vI0R-(YRL4dyf<7T2>&>b6<(ODqUOq~q`5joYOW!b zb0{&H7u_Y{S4k?0DVZp|uo{tC4U|Ow{k>*0Bqb|jtzJg*7DvFY`g(o|Odw8#QUgt0G6pk-&6~z)%64bi~|Aq^uI}e_g z8LSZ#d-zreN-uT(Y$(NVFue;!ugYaJwUWzE_(&!TilHfr>B$#fSe;5*ovfCq^(|2A zn`3!GtQIZu_B5rK8Wcqhw<-;l99pHXDhzhU;TDdMZ-(m!LY0rAD8-jj$cZKuwI*Lz z(;C9)ITA+CbcQ5zR^e-zR9#R?k|^Kp6@rDa5*RDD4ZTdi6%R$RJe6MR?4iehS& zB=r~I-*CagSOrgn!5!|uj*=J|5{!Y8U^*4W@RS5mQrAM$sF_IvLhM3y)LSX@&@X-GX39ied`h z5MJYMQChcO+H38Lc`YG|j!*FHC*+xAoU4eHUh$>xo@trC7*{MMHx+aABJ|J+I0!@ua(=eqt6-9G%# zs(Uj&U-;bV*9SF!A+o{k4UVO)uRiG6ir2>-*|)0CM?ZWx=$Du&PkSPJ$Cvl^Y&-d@$nw;d3sNHgeDp2v$;J0nX}9L5w%ZdvTR1yA z_xvlj%vsxU-n6fGjj3|<$;BNzg$s{JtBL z2haLGqsrD=bt?_|ZLX*0fCKk!dGGzSCvWH*`D5K916Ji%Z8fU)%S$TE$iMo_D$_ro zKdR09PY=AI)v{(QE8QIR>6kb5B7z;<(WF7N)lWR)?G3XbF zLE5W=THYof5%iBwWx=qOa=zSQX5j{fnV30a#_Wk;iKEHA*k&3GjT}10P&tFs&|sJt z&YYDqFue_ii5VHd$qC>T1#pY3%aLL^?shZo_gx;;>>`R^G@Z`&SS*zkaB4ob?GXL1d?T71}Ycx_(Q&O zX&uEZRW9Z+ikp>-`HlU@l#6+=;&tVc8s+o3a)DGU+4!ZIOP6SCU|=$vxr}b+GP#+{ zB8!XT7ygG0Q8~z3AP;CL2T_BCi};#1U0LI#i_w2zeHSihOr>G%mKe0P!mut27x6uR zIx$)j!|^W->xXp7RAj7i)}tS6G0md{%O2QY)lPhgAI_c%l~RGRZ0~2CHjfgdZrJvu zN%fqf5*W)-f)fPQiG1T3d28?ulj8s%^N#-wViRDi%(!lK4Ck7Il} z@xD$b)euD`FqW{WgUztET(qmbNi|nd35+GIPJ+rv*X^JD_EwXM2exPg#u643bWB*i zLNjkPsa{c30%HkFgyLn)X>v}PUfMQVUSBIJ8IyBjHm7s})=bx*A3x_qld3bt4Mt!r zVVwk5d3=WcXPg-N-u&wI2t_3@mUML$R8nRz8XEhTYfY*v6qUeO!eWn9mKVeNW5$6y z&BG}rib`NCVR2T+Ojq}r{ogXF9#T{SV+o7%FXpkJ8=k5UnN+VSDuJ(&$7 zpKDSzC@O)mgvI`~DThC;zcy@AbzrrI5g1EYY{$&7E}eY+{U+4_MI|tnuud0LhHQMg zJo7>G(9IM@B`}t-dRW5xZr_5hOschtN?V6pmEy&g`FSQsKk-!U&8dtUiLukoixxrvBZenyIJ+#uC;Uf=X&3k7wPp z1w%}#8x)nmSi9#vEVV+kumP_eC{xo+nb)69crC^}&T#uC<SqaS^sV=7GpR06R03lO>uf<~ z=-!g|etN*9DpXVgV+pIjC9H{4Z}`rnx>->Pj3q4gCC$40bm5!JO{(V=mB3iSI@c0b z+P)dnO{xzSmB3iS%Cv-a)%xw#CY6^Ra2SEHgf#%JW_b;{WYE1PRfeJx7)w~}97rm1 z-TmB>hfF$Ra!isd1W8^ls94R-pfHZO z6)&0{E?T;5aly5P%a$&@wlM0!gKYRnz4ZWEv$Jpi(NQ<-1?91^;@JzASy{(=Sc0I( z!sQ}v(TLHlcqxv?6*!)!GrgVSM&J3%mPU#T7A>7^9;Bo5;>aRP7;_gC&b^9f;bKp- z3Hrh%JV3g_?k>W!JIXl1wV?1CGcOD0&chbjOJ^@$Zl%S9#ax^}p1TYOMx72qMvKK(bPi|kT%q!m zq4h+fD_C^7Y?mUqf+c6`nM7Bxd-%<`+a4rmE>WT}i zScD6cm|Eq+Bo^UT(6Jb|@{Pr~6>BWUtu$jXEhkE4A~il$CC%BU8n(QIHBw#V8KQHEFTB(lv1wkbCkhF!uynVD3q@ zz$7=PL|R~yoAvq>*@{|Vl3QGuZ-_EwYgzMI{6&5nNE&n|p&=TDDZ-?7iqCvM$y?j!5&`1qm= zZYLv}|IOt>%A(c8E(LNJEvF?Zd*$zKzq|R8nNMKUoR??0-UBoGM91>sTx61$8ANk= z#l;IGhJTS>8emMRyy1QYwk9>yfeOBuGB-{Mcv_SwHY!f&4x zE?Y8tk?^)k4hBc|@05^-4a81372TXjQ4yqWIS02cFrH)#FI*zNX>#s>q5sjhD~1lp zQp$_^$S3sCyU1!z^3gcyqZg!?`F7Apo8kMJi4Zm?eZ=y6ltmk3gr2eKj{y8%u;Km- z{jnbGR{byQkGYE$Vl?~TD+~YBnyeasN3T{HOsg~WK9S$#BI42S= zT<$@uJaq7Ivr!JjZIv^J50v$Qwct!q3wmR127KdLq@Ou!Lm+Ux)_`MIzXLg*ed?}t@tO|F;Lleyx2Y%-QGs2Fu@nifh1LkUl zV?A<{zw3ax$(0{(xl(fbNw0=WIB)a9;xMHG8B@6Cj8BBF?u=+=)QP-p2>K#0mH2m zIIWhV*WwJ^hg_y!o1^c*f#asNHBIaoY0aDFE|fF3#7zVJ?3yd}QyNwlQZ z`1}=rmOMC+Xf^xstzEUQVn^=HogJea*_Onvnj;O#tA4a7Iq_qa2$m*W9G(JBljT==k#gO_ghI^>@s@ z0~|iX??aWjjre&UPaPh4p$)I$@K@XoPW~5j_41l>$x|@EKn?(3_c! z5teFO&t1!M7Sez-kT^HWPd+G_AiRVM0cZc;&&M4`zPzdvTWkFeQbdNy`!8-1CCbyM z{)&r5WuvA~g1-@Q%7|3V?S*XUTN*|aXb1@Y9*Dn95x4=dlf}cfGJwbDc@1w_w4cEy z#o}w&q*!!E2}rTXflZ1<32Xr%(2~Rm104BvBbh+EFtDQYdk*+!hFQ6D(ucjuuAq6N z$A~SE2HYj2>EGx1FFc}^ts3U>cZ3{-Pu9I7h0k}50GP9ALjnB-6}%r<FUd?p7F<4ZFkT@2AeGFG9ick=YsIcPxxA$~ALL=_jV9kCwHk&u@S`yeruI!_+;8_ihk5gygAYK{g=) z(fVGtS>u-{rq?kYvYvDP?hHIWd?w5&#=Bq}EZkW4IUOqNzO+?G-F8Q9Z2zQhYm}_C zT?iXf;qy#^EvgSP{4WN5tXA#hIbDm^$Cp{~x9E$o`zYnBFKhz@BlblCQ!bSs`^eEd z;zJYYa-bgq#aFU6q<;_jF7btNhf?0KterUsDLDk?$hbI>iDTL43@H-WGBfeYS zSzay#Rl5Lz;*%V>?n`_}LbZ7QioS@qreB@HOXa48(1OegRjo?VPyt)(D^kk7=n>NA z;hRHHJ;jKgCvS_75r*vS^_TyX4*FPhwravlH2v4SstEzD-w}M4NgMHr<{y1bOTrh- zwg~CV^RCU*`h5~gI-ECrWoBd)RYEa7yO38kH6Z(PQ2f?Y(X8gH85Xocv6l2zp4XS2 zw`FXm2!F)K%SQWq`e}|6lKq`rR9ba+zP_~n7s4Fk z`c{2Y+5R>=_pQ4yxpCy{7bbhEeE^~JchFx^1tNru4y?bT6!r}qF$eYfb(i`?mNeXg zzt>%wEO>1Rf{(rl9Cz&-v1vs$2-!o;z%M(f0sOLm+6}+#o~GfKozfKiGHL5%gm!%z z!@qGr*3Q^Jdu8pcrUC>B`o{j8?T85cMO+$_Ro6X)kEs~lBz!^RG2o#kX0fkS07b#2 zN2x%E!PWzh&vPZ-)K&6hPIC102mIYrxP6OvFJU_cxrm-Ia6G{-1^RH*hNHL2t#{Nm z6gH_qy*vXu2w)gaY#L?=EJ@&q=|*8o!F#l@dE2$}v|H9%XohKUG0ad{B!#q*LKALY zteyJiNE}mP7^YNGNE<1}3pY0kxj&Jyk~UIIHYpfE7*0eQM(ke{>5w*3T#g54l8aJ2 zML5IXVNeH8hfCV-Ycs3$L{hEfOPLY)l`)hyQqK}@J=^&_?S5?UNyd&%8iR_WD6wf# z+ljEv!jmLW{N{*ZocI?BWKRV#_%h9A9Hfn5&BBx9Ax}=L8pet5B7yAQJ=xRlhSvLh z#YwY_v%buI##Zj2B@a&d8s>ahWFANx^I(~9`-A5J&)+?}JilOBPL!C+|FaEJ{GtI> z)Y3-k>x5hPJ~&73?dC~6h`g^!F80kz%4{V{08`CCbi-rDh?Clexd0X!BWWYgQsMTW z@#Mt2VMYmh=CZVrC&vRxp6)$TJZXcvc+&pX{$RU(DaD4IOoJ~=){G-3tPR6{u8gC! zkstMzc?LKyaQtt-?znVa`;nVwEj@R~_vhdJ^wAglzjV+3tEa3_`Q(n?PoI6)n)Cj( z=b}~_BmA$=yldLSCmk;ukcKa@{C?}P-g7c{>>PgSmpA|EqTlV!zw7NgI!=G_@s2B| zetT?p`9J3O*}diEBVC^QVenbsz2w(6Z+xu7t!Ka3uG0+}y?6X=!VjCa-m>oem#+T# zvHHTBFFt4Y1$TD4F zdVKNE2mWT{aQ57#i;K@$IPacHpSKBZdXgu*sBm`p zoXpJIyxtP!f~nPW7SDqpzp6w`>>?72KgoNp!7%!J&b-1ok@@M9=)fXP@@|g$8J6aY zYLo|}z2y-UIeEuoC|OBfL&HAv#N!Y%J0@9RSbOM`{LEQU_I3)U>1ycl+D?<`_~Zd0DGCBh_Zn%L|%g=#%6%_}umMzIDwp?F5GUg4$?u_Md-g zj-iH3@=_}^e@-tOFrhhy)Jb0IFve`(TMfsXW7x(fd0ESdPI=w8S7Pvo(D3~Acmg66 zIaIK^Py<68?88LV8) z)328*7xNq|yLmLJQL5XO3$962x$&fOG0)Y$rd*Pvn2(ivK6bNkW3`h`Sj)evyV0b2 zPf-bsC9F=Cum-GMH`F}Kc~nsej3unjmaw|_9Lo=)Y_)?nj#)BdTWaPZ!!pn7 zU8JZ4#u8SSW?`9B%N3QtSi(BV64s94uldchF#O6DjlfvK>Izr0ygb*R`mjm$ilP!2 zOIYm3m?v9%=6#`~*T?{1K2}r$V+pG}e9f>b@4o9VCY7P=1jZ89$%0C9^LT!GWM^lS zswXQJjKEmJIt8v~Scl&DTr;V16qUeO!a7w@NlC*s1Isq`FsbG%DuJ{4(>%ZYS4AZ-mauwQ!usZ^&PPnDcNCStc+QDgf(=Be zVDU_TJ7trkDgXvu31I?wTcx)rU7{L*5@nvEJ*dJG7)uO$2`bU{!Pb4{2Tz++9hHy> zj3qaE3#tI#%#Ca7+n;8hdLE#t1jZ6px}Y+`8ur^W9y6&XD=LApgw;n-1@Jb)GEeNT zP*ehA3F{0?SXVu=`T~>c4~j})EMfH(RFoNpHS)T~2_2#}Wuu}J7)w|gmarDo_L^@} zy{o7M1~`xB8|6Z~RA9eYTw=F9oe4~mm&?Rfa{?NG=%#zOvu|_7(k!+h7A?i;9-IPN zF?&%2+oBA@sDI4yIOS$JzNXx;!75U0Cx#<-Cpx&|gFLJd;(y!WDL^ z2zNg;!xrJF(((m@U7>l@O)-)wlBvTsFgr&x>9L;NFQ(`Vmxv1~7&}SBWqXSX zmyO}kKu-aWaz${b->QPS;;i7@rAx0`SlH}jmrIV@&I7oiY=;XJ%vwIqtZWz?qnPwr z%hJZo9p}!_TK4V?Z8&#^N>V7P88?b5Q>742-Jf&LWC%XJS-BcP3GUViF^fvSupMX6{jS9hN7E zV=Jtzs@Uf`EOP)h4H+i7&sCi12C^BoEyI_;IRdmTR5_U@!@d__iVVo2+XGn z$7bIN_j|Y>0;Y;%E*NH|6OM!Zt-!2e-xtO$+}ZGZ5SUgRSHZaPdjJW%0GN+Cl7eA2 zig05FM|5XCkH*-lh~q05=8M~YzhYokD;&$$X`d_k{SladB*3p8n0Mpw)=`K2q20OIAw?`+_PCBW~}1o>S7+?5INTbCfe+km?_0e%}2B#z@`7`O7^(BX825kS1$%Hu5HhQ#5=@|~O@zZt+Sh{KQ7@x}!C{SLT4 z$Kl5;sR8C)JI-OB@b|#{YRB2?FXMMAW);rn%mPd_pB?yJ1k9y&oNfPVHWWZuVI)Vq zp*+yE{7?3;{vFgSJzk-#{<=2BvclLV}KcK*`4^KA4^%Y!mPvAZ%Q??>0s3C6t$! zlzx+mHYRpMKzVvVxZu{f$!|4wQ>v#M-KBw^bssC_@_od+vT#h7H z=pROTXVu{TI{Z1S2(Ni~7OcxjUxeRck-U)p4tKQhJ{_>Yo&ckXpAhaN8paKa z#@5AoY8O|-O~_tZfFonr5U&xBoeSKHWH7|G63LL+g&mLvo5nFBO_4dlk|Sxj=8QW> z8@h0#nu?m@fLI`sA|i}mM!x>0*oh%BHfE!pzv5l&DVBNJ4_i90dqS%m*6=DX3J{l{ zbThN4v7Kq>zP_8K9K`GcC_xV3Y5@w2am5O^18|b=K_Okt1Wnlfgmkat7KA@5H~A=ibxQ*gAZo72m|pS6M&M2h^ZU^PXa z#k3EOytt79pH)L~r~HTUTm$)EU0I%90&<5cP#jwY{1sH0q8hA*_>ZgdWoo$oZV#9v z?ZwO63Gr>{0nj*HY9}Rl97}jszP_2_MM+j-e6t8rtHcf(Y(wH^E^#{=c2weKMFA61 zxX2LZ#}Gj&%$F#R5HH-A$ZdnH7-B07*<>>}N`Pi+v6sqZCwMaotO6OPa5hemwYH)X zR6@$tH9XTqNG89@6!Eth2riKk`;;=ce=H^lS@JQ`9!cYlzXcTc)p<#Xs+UaS1U+VtHihzuTzys5x2wT z^J8vW8*WEPdXmhk(^RpHOXIlhme&RRxeu6>?K(db_fTb6KRg^Om%Fx`vNXOU*hboJ1xcuggOX8B^* zFWXAkWF>2yB9qluxaW=7w5%WZ0Sdf>T=Z1}5E>4-Sl&+VH7&!Y_YlMfLFDN>Rm#K< zgrO^?WC0}tEoD1Mz%V5Mw4H;P_ZDfGfj9s1c`EQ8ENnO99ZeU`R><_6$Z+i0Clle~ z#qx0UGBcg+N-q&8mwjZQ{bA$d6YZFa2>u=<+{}XDRffi0ecAr?qs4B@Of(`T0Osjm zF|%=7EnX~%1=!E)U*8E^GI3vBv>3Qgk~@ppKbes}s}Bz%A*(&f{_=g`g5==<%nD>c zHab8b!DR#Q(%jOT9ZT%iZ0%oPU(|ck22X%nD>wNo9tH&48+n_N2RjdU?JGNy=C8N~ ze_u?GFKRcnOczF`_TOpQC0~vzs=Uybz3%$<+^~-9<9%_(5VdS^ zAz?Pskb}qPc^+?;ug_DDH<#*s;sO|1wkIL8&Jb?>VCySvylYqb&V(&fxGjWjps*E3 zeY>BDi-!hXf~{nlC+#3Ez1iNb#@wU@N~m-$DN(m2;lUsWE{4g2MQ+oQwiNt5MYu`6 z6T$aFN4|k(d^ulcn2Q7tAKubNzSD)9xC-SGx%G~^)-dB>kui}rQp^@^ZWN&?g|v}k zzNGMB!{umLVK}R0n0#1d7}7?H#lp>P``-8{g|v}kc{2*e(=Z$t$uOji6sv?=?556V z4LE)$3SZ`xw2@-1aPxALC9XkgcS-AFIC!@3rOd_nmElMmsi?rzWitb14s)*4Fqgn0 zDWr`Qx^VO2>&P7@pWx}R3|kS4ThD@{*oewsnp`}RQrbw#1|1iLi0!lOVK*u0D{*v} zwlvrz1@rN@kY2+$@n)HsmynQxhB;)0Z-yZGlIH_)_)@W$8xY?Z@OtRRO+9*UdZ(lJ zw{Nbz>igIFtR4Nvzh-@Y>mTnLGW3c!pX&V1pQkUmVe#ujy(h0;^=0rxf66nB)o)G@ zjURCHp3gu2M*HQ2HEZ5pq@PuI)0nSr9Qp1whufUg*ykT}FaPYkth;}i_xP|1-{(Ve zZ+!UIM^|qf->@w?dCA7QJ@1ZqyzA_l@85s#O@BFla9--Gl|Rn;Oix{m>KV5GZEO@g z<-C#`z6(}=Z2WC(95nuZ@A&DD72Y<+XKY~n_vZ(0crE>o(z_mPzqo(oq+T7HUU_B5 zx7UB%c+*Awr(Qa2>445>tg63wbm3nXJ$7~BNkax+_F~r|ZFk(1ykzjmqlfz(IoxU7 z;hy8`7w-Mb!}o7Gvhv+CyB2=gd&}Prl(7tG{%_lONExSQ>$2{r3OOs>eB&W?Qz|fn zFMby3pqRvBlF7kKZA72#bL-x0j^XTel9#%Ze1=`Kv${E^jldXurnmhF>c}1zYe$lo zHJS2!(=8V}#HX#moQ*eC>Q^6p;cw0d6J6lLn!=d%@w9)VIfgM!@;-|r@Y+@@pNwWMqno)DHgl;^F6P$AKPeZV$B6TK zL`xDZWatj1j|! zo4M2}7jrx3&Ssd;EG~}Ml4P-;M#EYqw@(fgf6E#pTnq;f^@i1j8cDcBuP$ND6D}N~ z2tzF)F`3GRby>O?AZh^NGSG+*^^e3DE=-KmcFuITQ+$4Z%C=+X_N8Mg?I*y;df@<+ z6f}v@C$K$G*$%fSFda0fDm5W6mQ7FW8JN1a%e9}sWNrdIUr`B+Wz$nfL1l#1<(nTa zG^u7PDuJ2WZOXp764{S#ph{5*SNZoq;ve_0*#C*O*ifD=LApgvHepb3+`% zGPkzjYx}|oj3q4UPHR{u6~3Dnlo!)wZkBvRQN`QN+2?`a zsU}suqH^2LX@te?x8~;7uN4)?QC6Afn9eM(M|U6EZBn&k)rS!nOCE}?nxdxAKQh03 zs<{>MOhqLymh$QWtQpohzhrgn-rD6Si26Jn>26PUjE^nerjHTLn39Nzf!b(&$N<|mSiw-yIc$Oz-k`!qaF@(Ax9&z6)5~7CQBNc5%w4@UuV^tx-EFxR zb+_)Dwd{a3azSldwC@;>vXE*2A8(J1@-cGXVJD!abewKZh|O)M56oNr9d;wehMIWj(Gn9wrdnbX#kest<>*iM>2-dByQ3;iju7b3?LPafHg1a>A?sBtmb9ad!;DT@F-hA^a_O1?c+`Bqh zY*3B91{ix+2M-!DL~LH=-c_xYj=iflm3ckSsMgzY@2WYqA=__Edsmm? zRKjet+2;^o)C}`)+Oj>F*|D=(ben=_j1A|smoos|-N02VEC+W^xJ7W^4b147u)uKS z<%A>s28AJx#tFx+)+-6(>Jq>)+^q@VxG&_*1aOR>?+UzPj9WU|C4gi6(h|V2$J#jo zTrwCA1@3$$8yr_V#gB96JAnzzfd!@&9w*!fa37>F#L+n6E{1!Dxxzd8a>8v!Kvw|Q zt4P8)7I(sNX7Np6K2SJza-DGG_ZcvcE^L_}`{);6>G90QL*vG84)|RK%v%&}7|yOZ zh1(6d0azl+TPk4Uf@LS%hwy#_m`92wj^*uyyB+Rzz)Zec;#i-Za4*4qH86vhNt_$M zQxU&Oz$^_*oLf5HMn>!c=D`&b$GIb?aJv9^44AZQB(Aj!j>n)wz|7+I2pE>56F;i7 zPk|YE9Z~M(aU=MR1?H_a66dC0J_0WHdVB(=RN^@Pa|)O9UJbzfsBlP@EACfd+TI}f zx#7-*cV}Qm$HD1{UkI4@%OyXz^5A%UL z?nYoH|5oCdPfj>q4E-=LX}^=WPA<4IxNin#?C&KG(QxE(Wja0PeEP+Q`+P+=s}Iez4KJ#e2U!0(#`_;p2uynnzMm_N!;PsWc^ zc~JeFdXL9*8y*_Bd`^eo!@$%loLhRA0JjsE?0d=0y?(IUauG0pQ8>47sh>6|4EfPG zr6ULKTYyWwPe3r+=ZvG;I}@0P;@~DBfwjP#c)#T5R^KMVdm=CoD4biqJO_^_fSLZF zpd$NKD)-qYYd_BmX6jEBZ89l7vW0?hM&lQ=iM_9ncOuvzFGJTz|kTnc_&UhsH+ z_jieN%jXch{{c+97bVV3p0nYd0n7r0b4$nVz%2tNX?@H5t_Opjz}#Ogac=F$eBhGM z*|~Cq#JQz+H@u$(=EjW@=a$}O@O~PYz{?WnR=zC$LBM>XaBlg+;En@R{fgw5j2|aC z;74h`1}6JeiA#0C%|pbW2ByKLPTf|Fk7}roSWR|Al&)&9?z3oCC*L1Fkim} z=39jWnPWPLI|58o9NZA#+HS)u#yI86Ciss^05=Xe?;A19V0Gg6KJqUFT<`4?dy)(8 z8n`zBvvP;TxyeC0WP}dPT{~OG-GXo*2WIH|66cnG{E}c0n8+T9b1Pr!lh+hRBAwIA zPYHbp+=+W7%B_6=2=9r&e64VZu4De?!oAZ+xRU@6jaxdnn`$;NKm1eT-1xEmIOSv9 z*@1_~t$threw{zTXHxbFnD~H^Q~BP7fL;Y=^5+uQ5kF42GvNL!FzH`NoLl*>K)Azz zdHPFj^N(1m?p766cm)eqO2lw`e~ON}SvHZ4nrB`wlmx9g;Y=_+0?+ zTYz~p4sHk->;|U&5y{UjUq%9V2{5-Fl{mL_oC`f!t1uGjoX<1hdGHqlA%C69VZcQ0dp#%Nq2b#pUv#T2Cd;INSvGAg$nXi0<(ah*@tmU2dm>BfvHH7 zIJfeh3S2EP-8xE~TR(#Qh5*yEQ_K7q+)Q8=cWxQi7yKRvX1l_<>F1Ha9RX(WiISgN zdUJrA56qJa=f-ao@_839oj5RraqDLfg5RHj*{N_uJIPfRJU#-(-(B)^t8bitnW8YT z3gg7@a`==3_p!nvx{l#8+r9@TncohEaZ4}V`zwq9;^h?XQLq^R+*zkdes1#24`7x9 zvzv$PVBFG6J$Y)t>$#+7%Q(vY-N4-4TjJcxw*$Pl0rP%(%Q$w`+V+7S!b9VhFK5I1 z7%+YNw#;t>;&&M^ozIduH+i`WVcieRARd5#aVxjS;ioB#0OI9T9zVkUJK#QNL}A?W znR3;yzr+Y2UQYbx!2NRIURGGQ_>BQ>djkBJubp|aIL0`I+aCdS1uiF3V%eTJ;U0na z-+-AqP~zP5)i`+H0nEp&crb4I`CE989_008QV?O>`3Kz{6+u48W^KL0zXRq8JI;Y$JuvUuaW;PK z5x?&h23BF*()%lL?bOC$xAdM04jI7YC>(Rrjo)}+E|0^H<#CO|h{(0TuLQW8^O(~`v{n?>^NKgalG4lIQk`cXrlSzz;6&R*>;?bAM@`Dg%J$#a?8JKfx9sd zziyy^I6;0d16Lo1AM@`EV1Bma9MaqEJg+Am4^1>*Z0TkGjRxitJI;Y$F)*v`I0t@z zR2UI3UT*pK1aL3L;m7=Y7npDCIEVPP8v!}ML(@`v2LY2~$2stu1I!XT&X(Q)!n#>u z7%q)ldY=NWIu1X|-)>;OSGbny?=Qfl@bV`ZxAZdq&H&~DJI*1!Gk{rO$Jx?LdASjo z-`Q~v{9XX2#*TB~_p!n-9W-wF_bqTg$Kl8N(T#(`7~{t8Y~Y3|tXuxEJT6U;-!kB? zkHaqje)j_Nvck1gzOMtbGY&uM=Yt9Zt1xcqJp!DM11cD|^s+tbr7!}Bmm9xxfIBY^ zKbFTdU>4bN4)XFFV18%EImpWkz-+eT9Qb_-%(r%&jUVer`%#I>OFD3w3hS1C0q`3S z%o2rbseG>iraTTm#_!Jx1FJA@<*@;{*Aw9PuLSx10$fUV%kskdafZUE=()<#OBv(!oQQ`e zntu-b1}cmI;^h{X7BFM&I0tzy1m9^@meSiFn4lf!5WfOouCn87@nd=`f%$_S=fH10Fm-mE zjUVgLeqfF&98=?(-V2dlJTz|U4ZyEIF!^?zL;S7+W~CixiyzZ_7ch_5aSr_IfO*G` zv+-kk4=4<*!nmb3d92sd5f6=9dMVH6DvSW)<;HIea1-M2qx>ySkY6Qmcg5ky^gf>; zzc+w;KLLI}CCIM>zDVC44~<*?1>iRnn5hcalKjmEW^o*T>_6)Y1FJA@JPtp~OH!W96B#>qdFcvVZ-sTsKk^F#GsTW`s2|ILS!>7H>IduFeZc(H zj&tDm1~Bj2aW;O;zn>H)UV1xR1bM+j@B|&~$fqO3wKg!Dw3Gzz~c|Be6(75Fv`$K~jMgZ}0OYcbF^5XDgdCX6c-%8-h z;_zesJ(wWBzXJDC9DeEG_dYPk>^KK`>7MWP^ua^pmVZp|7+@yZaSr^h24;;NXOlmc z?>!2`aB1Ai<9Xm-O@QA&f%(afbBJH(@m^04JTz|UW&B10GsTW`;I|x@wRW5>z0AM+ zfcdK(=fLj`VBWXmZ2TzCKPe2X!noz%ap2nWN_rT#^fG>Z6-EH@a^p7?xG{0~u|1j% zOvH|JNbeoM+;7L((#!b00?b=>oCCi`U=G`HHh#>%E)!**z$%PedQSuHOoesJKi1!| z3G$l+TtOUul)p6z^1BPT2NU4;YJ&XU2kx^t{Fr~Ucd?-pQo*>Se~Bfsx}NuFfO7YBa5fjQTXv+-kk^MRRZ z$2su34w#$lI2%9qhaOQFScP#bk6Pf~io=ibYfO;eG2q%vw&ja0ew3F!3L|6ZuAln@ zH#`A;QxoJ@0Nhmx@T*La-|fKN7l$A9>Ba>4Z2@jq0{p&9kl%6O+D>V?JQ%;e3KOq9 zvVa?v0Kb_D@>>X8BmsVRB*^c6;GT@bkMg`VL4F?q_jv;Rk}j2b954Sm1J^@g-P#Y< zkC6%T%LVS@IQ-atEKQK#O~Bm|hadIdbHKc2$2sV$&w%;29cR-AERPOTy`IzX&_wga zf!_#V#@cZQ8>oZjo%Jn{uzfK^Y0ii{%P^k+aH+W zcAPD}%)hC?%(vql@~;Az+wC|9e$OZjSPSEp-dBNpBMv|6mxcuS{REu%GF!gb;zxcx z6h_9*y*&B>H#7l$QxfDi8@R=B_^~|n1o_W{;~eXXD56IG`|02aTIN9|x}O z^p?{r+DnCz+}!zP0XHfRzW|ub1ZIuGF?6^1-2}`XarjaHJqOHN3GjO#n9t(y6XT;9 zGEcx-7`OPf1+I(2y2%U6BP&6EV}P3whacm&I6;09;7a50WBl$^KL04Zs|?;~e;%G8^?5PfO`# zdE^2!#g22}w;Y(YcAPDKY~Suv7!fdDZub5x|VI;~e-c1SVp~Iqy%UEY_5Fba`L!)Xe+>^!OZk_jFan5| zTmFp!ZbBS>l$XW8l-h9)@_auqPug)dd1iXI0`s{Y=fE$i2;*)%G%cmKKQJThI0t^y zfthc|+2TiiRRPRhcANvh=Ye_Ej&tDmPlXW)!ON{Y4ghyF4nLMh*ZDF};_>ST+)#ye z%RiRKlmz)*4cwYI{HPD^Ns!;8z&#&_AM5W9U>X#TDR;}iAAo6!!;k4bZ9!uBHypTJ zg>5PS<^r=;;aZAcB`|lz;m7iQ9+)k5oP+#*4$OCUoP+%N7h)b04^1>34*W&}lV``- z__2KFD~w=>ms@!(2X1W~ek_ms66E(1aIeMT$Nc*&L4JpUOS;mQFShhj{(1s4T;W!t33AwE=ysf z^~e@KruX6m`OOAyaRU7G1o_lf!{`8cG+g&`uBKfqWNM=FXiQ2 zV8+;S4*545n8kLSjUVMj2j(F=&VgSoFmKs$Hhzp>BQQ;NoCCkpim^Wj4~<)TDKBGz znQF&5@QVObYRB2)M}GGM^Nbzm!0#PW8#i(4_!*(`(ID;Q17guB~J!k2hD?R6V z&hO}%gHJwqI^)jVdn)l!2lbo3aPG3D%a;~~0~wc`8JJKUUbuMSwF{Tb4~$v5xOm~B z!exxANB82M+Wuv$eBMawl2vWJjlPmqDPI3?Yc?=t6*a+X791{9ZWr|DZf~kj+EiC| z#2Y!86xIBu#Rh)B!Jo685aFFwQ&%!llzF&y^-5fCT&Gob;OsIkD6Q;5F{|U*sz*Vb z>_H(2o6mDf)W*Aw{V(!+51z+-;gs}a>!iI^xcygjEa}7daU+oST9sfg{5Cv>XuqB; zf{%4K_<6zaSIG}|q-NAH1&oOg*=E?Nna)HMed1PJ8P7A7Z?d>{SW*mw8^4C+6St&F z+_)&0iLi01%je-2dL+f%sBIHI=*O$-<$b_)$TR=?c6x0e58Ot2uEyuvdg`@VJNtOv z;YIgbM|y(D34kO`Vd2L}?p_VAvveQOWz@#of;9`$TN5VtlW zs{Zmlh#*{Erpqs|`^&$8d+E`VXXsKcTs8_9&;3nJYjgbN$;bfs-wXfpCh2n@?Y9U{ zCBnX6y8nspKS_7kBLl0KGY3EoUjA~<^&sr0X@6YUOJEOw2segaeh=KLS1XFYA@o7v ze}MK``mL3;&(S_e(h9p@x&s~ATz!?K^*j%*r-Bl{{_}lked)n z#9w}j#Jq~XMumq0h5QLWTUE+(e|#;l{&Js${Db!IWfEzx7zf|##dy_KU&%L!UnS;k ziK(Ier(c_zz-*La*3c0^;5H+;{^34Vr6u@;k_zVclB^ElBOV?={1sn;y!txH-18cI zA|N@BB=GQ8Y{eT;7IOJ3gbLXyJ9^976T?3s7^1Nlk6jCbdm!3jXnJ8oH$TOqW(5PEJiq_W8)0fB90|rnWl=33^i0{2{Qt zh9}8067ScAZ64m6glz%dZwT8Wy!jRQBu_EkuL@fj?`^_%4c;}vwi@qxVJpGAR@j(* zRC`IDb$D+Twwv+ZB5b$e{id*GPlEOf=w94l553$PIw~+7`g3)9CbVw2&8w@By^X23 z1w2EjJN-!3&S3RE2%o0EAzij;I?$4^ABx~tc=~XOHg>}x1fNH*)pt;VuB8($)P5B| zIeKldbRTt3u=EJx*gBj^OJ`X6($Wf+)2W>x6eIDaxz^z{I=6+T%}DTU9a)4+=(m;c z49^Qzl>l`#YwP1p-=Z$HC9V?y14}<8b?MK7Jl!Ba1rDGOcP>5JgfqAPJ8KU^zx81< z>w^9b4c&td9<>ervi)8YC`GSyKQ9i4sPnq;Ec~{@Z*TnK{<=sPt?cLa;git>mHnLJ zzq2M;gdppJR9Q^}$KdW!UyES~Ly*B@0j7I5xQD9B)7K#)ntpS78vYiZ`Vq$bGvWL~dWM4CtzZHC zt?9dCko=lf4j9lWPv0HXx5jwhtjJ2l?^Edy;J0*@kC9rYs=_oQgF|{SQ`0Zb;I;Cz z=*TE)$cAaWqJAQsH9D^&FZ_|s1Pu#S&P&f^W@Utc3Pi&WpQ<6FyN2}Fvvz9wTf)6D zMbl**H2sD2$G|6qnpUjg3i)gD6edr9KTm&Cz?n_AF)*ZV9e#yl2psm&vEo2@kT(3@ zbmmN?%|>d?#@-CGGx2mq*tq*$vD$4!g1#m2t=Q|&`9yf?b)l+z(x@83+Mm!N{HzHze*@2OVs86R|)?wuY^DSe_jbi+aT&8Cy`V=M9YyDstlzELeQSw zrikWnif9nazL`k9Rt;=!)}c`43rg>ONX42R(vR|23+lh->R$x)Z}ZX8BnS0FjRRC0 zRIilWLD7zF6z$ljU`BQQ0Dpz)-rd4&Hi}-@D8kdiS)yYmoz4!aDCbp8Kua_k{V;tuTNeDW+Gt+(G$wE4 zuvpXo&9*}e>7n#&>UFjjOxakiQvSj0&L$hJVsGTM5Lz9^y18$@J|w^2w|Q0V&&k(c z+t3pjk)tvlrz3umwv3Q)H2RBqx@`K{<_ywwG>FK*a34)ygmw~Tn?XY_2r)BKon2L?Z{KQJmX*+4!QD)NuKe-#?FzHxO-reGWsNJQf@iJB7NCylJeLNbaMqQ zd*&&WkTgnJx2bX%n1{~2{=KFjMP98u6bzgYxmwTjaf~xDIozLP9O$jV8m_MpCZLVj zvD~k{v=3#-B!x!QuIMUN(*;`TuO1AsRw(UtPK?@0)eP+*imr3ngg`5;awTH2v|Hnu zqPT=gl%*8~8>+;}V(N}ztmZSQ_n`VY2ra0)0TKBbDfW4uflcNL2c0rkZ0QzyGI%Ld zpS72xDgA5IL;VNTws3!2d$C89z8JGK_6+G5rJ%IyHT|$qbix4@Q%Vv!L7B-hvWOw^ zt2rh>q@%G7UQss~QIi5N1vXh=b77N3jH;=MPDET36N*P~Td_4%+P? zlC?8@_DB!Mq1{J{VQ5BP*^%~D|D4KYT(%7UA%jJNrAy+@5 ze=o9}k@Q!r2Jf8VL&F_J^iTi|zX5mTjX!b#qbZ15u$q&~fJZAcS&Te5$Y$WVXzjo>YF`f8ceZ8ma(tMSB=qiHMKRi}N2 z6^MuGm(3R$%Gy6nvSkw=N1kP_LF+6^M`ID@P;WIx)n%Krg+PC}c; zKOw-#A3|u+hvn-RW#;RnGtji287#e44OnH7UYMuv+|mZg@h~T%gU&|Gvsi(rIRixi zqMCL^YtbrC-&RyPHbtbVv5WA8llT)u#ELG+iqg-;ya>MSpPd{@3I2n+qp?TnaS!BD z{0$w_=*Qn^3|{girzIorzpMSim$fob_C;Dw2joo9P=Y7~@CVvT=%w(=rm>FuT zZcuo!UE~EE((cfO zfmZ(VN8rTXCYF$B8_!Xlzx-C%IkLmd@bzh!gTqfZk5TQe1!Y=fX-pq!fmW51K9Qpv z)I)TF$7j%CnzjYK&@`}Ouah-YRZQdnI%Al4jGU-C!qbed2y{*IMy^F|5Oh_c^l5@9 zIxIw1#&nJul<+sZTe3?dYASOpzzJRSe9@tS49oGb5NBCijqw`CnnoNbLLszjMn@PG zxSEM5+gu!#CXCFw!cBII&B594;3li@M%bi`X~=dtOe=)#WYM8r1Djm`ybm@hcYlRV z%H1~DB<*{!NeOI-+SokAbczIgv*%fRF{}SrzTSYJXF0i#iGQdU z4uS)SfSjT)<}5#E>M_-?Z&K^INuD-gKTD~dPzwzl0OaV~qKMO<&v-h+YUL4vi z@UKs)=18!pcYV=_`fvxa^uxJ%o}*?6v-rYf{()=_gJr*am3mPj2r-3EWobd=z?afy+&#u7p7EI;P-!%!R4JaR6d zeAI+K2HJF!wb5X!ABi&VVz?PDA`&8ADovBqi_zTW=wC(u#w5Q|WXN(fk%x?V`_tJt zV7`R&^+p8~qYYUeVyeDkZ_uCfPgc8o)Au21TIuEo@Dp3vxVkQTQrlpYRg7I1SxvaY zBHhk|O}bqUo1B)X)N~is?gYGLpXzkjWX0+iwQ(|D(MH|a&6+f2Dh6Gp->{sR=MhDA=<^_EE4IEHii(q#k0e zVJh!g(&#mz%7@cyVBO%!M%iP*s~&$8_4bA;UrsNfb;PD{dQor$I_#p)Bv@wc%-X67 zht>wp1#$3*p8DaCj@hXL;mJav4UMSDRwP}-LA3jd59YOE8R=l8+Lr~Q<$XJ(9~V$T z$uNpT`e7!1nhHRUDpfOehAjZ0iOmo=9%8?TwP`yNC%SWQi>e$G2#SDzh4g=i^e;tn zYQmFLXtKQ%p{PoFhM64BC?X4t@c1X>`0a+jgBuH0a+Qlvn5;4?q3Ugpw8p69HS!qI8}%$bRg2^Rb%o-Heu-6 zI;^Ep0hb_J6;14d)Qbp8nepcwV^yXkRW$i?j-wHbmBj+M%R0qwkgON4z$WX(XRygS z^>fs>HOfZ%_JK{-l^ob4ZaQp|%YrEGH&NW*qPVS5+@2^-Lj~Yv?mo|Cyd@Vlaxye- zDUh~1VUywBA9YjPm&*2e>yi*vPDc5#DMR$mtd5oq1mSLC@)z3$(nPkG&Gr4Vg$%eC z3q8l_b=_fS)$yV7#7;m3#4LYouX93T?PcSia&ta|I;qanoVG&|bIM#9?{ zZYPv^!`)z;qrXipFj2O2A`Y?{xDK9d<|c~S&fo@50AT-m&Vbegb>PI1Rtq_)WoYFxwaDUX(jx zTf|@XX&b=@dlh!=YdlAS#+-P>2)u0X4Ril8yazN zxk?&ENM-;uztL_QQ+K#WZ!+Y{lYqZ+0Mrlp;T2HU7F+@$4i`bZkH9Dhc z3}ZT@(i*Bl$E5-@dshw1)0bmr`V$Ukr(;fBu32+Qpl%+bA#3dzl)9{W+&wL8#Z6JS zFJaq_$LHZ!o)WDY@AlQUg!j%)i;K_B1)W$k^x7<#5xpmLd2h)U@QyyD^B6QLTJry)He?x zW=77V|16L)Cf>}3qsNB(#%gSktW=l7-_R79>!SuQ= z_(P6jpN35;mQv)cR2cWbCL7+bVUx=|R43Awg32XZ+YYeF1)mYHNu{(3HmO+t0GsTJ z4?+9NF|E&Y8Ei6)GT0>Up{VU?*krh`!6rw$K{1XMdI>5_=_PB!+>K%wP+QTkN`e`f ztOHoL)c0exB*e9%4~7pww~8ywjhE{|UwRVeuhiccan7KZ5?f;~FSe~g=k;*D{%hHY z=w8DUwW@Jx`TCo3eMOWI*HYf7rs51$4NB3IP|Hr0{R}__B3O3DaXi1uzJ{i=1@)jo z(X#3_eTR1V18v9G+Tjni)E!#w*Jx0-<@G!fi`)moz1e#7vW%yUXh!G2plXuEHdEHh zY|hSO?kG&bU5)t|^lC)G=Rm@FpNlwG1oxB?}+JDXvX?SvOTvT)kNCX0l5E_XY` z&IVus1cRcgt9>CIb?2y1|0s+c{Yw@KR)&Ro&t$9ca(W2@7(U!z{xW{`)+_~o1zT}! zlw6pSKjO9J?Zi@R!-H_kD?6UHqMcBL4Y%X(P!+0{n3R=M`CR?X5OaqkmGL@i>Hp;6;PFzaO#0>FjwqtiQpvsK06IwN1hV20;1rSjg=R*Z$O8utaJCmChO~8qqYso=JRZVP1f9F zuQAe6olAiS+(IMGwVP;tJ^kAF|&si5aXcXXNG4PHEt?a z`qGTW)(NUWp~U3=MoMi!-=kHn^r46bv4qqRtRrTOQ4~;Wa@&yt?L~__!PiR78dCvv6Jvl zP~Vp8&ylTwTuS6{3p*WxqEAz{|F~XTw*S|%dT(iyCnwv7(+id3eWKUH#7@L;0f$u9 z*XHWA==20@zv2Kw_IhRp^?K_FVjOtL5k!;f_B5$(Pm}8QG^uV+lj!!Gf)T{7NXKB= zJ~@O4`d_T)7$U3297EJ&4AEp6LuA#6{tjHx`N0@s-GwQb&rS1Bt;wqKcl7!@2Gj5a z@MPl2#)E-Xa29eU(m!YTGT$;K6%#^OQVd~9k;-2xVf6jN{YP@GGjew0S+U?=j^Ie^ zEgahlxtNIF%UO+Ro{?)}s`)g^(Fu&2U@kn$iZEDg4GNG*HAJaJ=N&D%T!Nss&4dhH zQO7l9*|2i@_k}8R_k=1V&*G{6 z-rq6*AS@U>N4Doy%7W7LHP1>d!AZ?SV^dm1PC{{$Mr7GW9*Jq-j%5G(){FPP_G z5fF33`jmr)i(a3L>8z7b6rFPM>L9{Fx*DECPE>4-bRC|5Fx+YQgtQp1-@!{C3ym

h(u$y|HU=`(yH=nD$u`~Ql00| zRoiC72=i--iJo8WPs`m0t%Y*RKZr8POT#j8YdyE7GI*k<=T?gn(R^7Ge1~g!mIQf9 z_0+&l*WuiM38w*Iza0VXi>Aw8!FF8J;fx@n&XH?m!mifznc%z<+HYlsR(4&62W+|e zgY0UYhH3WZOFt(tB4YeS%pgw8S1w0wK@U=9XGqW8g8O{DlvbA@u>bm-09Dgbr0e{EVSv&n5FGM2%SmmXeD7zGM-GuRw)iL*pC!)@;Lg0fM1iqCXoLD(Jg-3;;)KWxzIYEXU&U!FK^aelR+IN~b z7Zb{Ztx6B&-3JA-4Vf|OkzEcQl~lo4iI z>Cvju2PP*!=0ku!BS6_z3P5l(>i+*c&Kw&Kdu?(&bb_+^a46iE$ruV-hNzF(Q8z7W zyCiDk;)$I5;DjtsN%}ljMcr^lS%t9@wqe5ehN$mvqQ3V<-PT8KHL%GO)~_qKWY1es z+xyDq^Kh?+JYoH1)c4;}-ydOZlN2UL|w*s731 zeKx(WBhXS;I>dU9i1p7Z*7!+d%m-O#amdOw>e%{_#t^YmKpkT$zN~0`t+A}w8EH>~ zV492{qK!r{k}9WNM3h7Nm^Aj0lSO(oeNvjHk4uRr4$-L`qo_wj^MX<))0tH>93LD& zLU0x{Mw`n09XzACOffENN?XB=I+9hMlaI0?z6>^=N$`0JVLMycti_!joz6WfTfmUMV_6ru z!j6)g$dcojE4u(+3qXnNg{ZQJ#bS;1+`t8P41|k%Z`$BV6AS46a?X)#@C4Lfx8ScL z|Azf1EPq9>E#1%03}83;Xz0Fv7ge=?4Zd<-8YO%$L>_xeZGnhMN{|FWaU}u+6M-o8v0T;3o~A z@7O?Ncu$4Pa*i+=Y*K{C@puxz;G)0A2%H&r2S8+yJI+G5LfF>vhBNKruYGK|Y~O>&-U77E2BUiBI z7%b5VTDE5aoUZWGsiB)j6fmY{Z=+@~P_=t%2KMYOTFs*|--X@Z;nwT{w`M`;C2>9< zno0O2h&ALJPBB|^q^e33p57Veom^CM$c!^9D_d%wOb3}AjsubXBo8RcyS=c#MEHdAfS^vG>T;@XZbHMt~+`&Cm;uf zO#G!JOq=tU$e9M2R(`jrH9NE%Lf=P|{YFHf03N{9bX#IA~G$qe1JZQrw@07gV#X$T-W z*+!?+icXqbM+1DTO@WM$H`zt+2vI?uOcF5I&}HpUF_PnGj!+zG_n=|IKQ+))H6J4R z3wkmy24!Hcg=oA!6V5Id1&xmjm-z|E`dqw*+ldQZ3W!cCKC2nf1@iXifG!k>O-ZLS zpY;YHo!vS3O+$;%IuU;v>>1If@V8c=tMK=Hfo{Uz9}09Q{=O;D!}zN+p1pIPJZpC$ zIKxynpIKPhe5&|ED_;#_si|Vb5YP3XiBQ zd)98G(kQ+`;#g@AtEP`p{9P+sqa{-z)uR=SD8hMJC*EO=$DtgeuQM@iI-bIlaBMHs zmsaFZ0Im2P>8EML4N96nzNX{nc=7aTBuivI9l#gHzGw77uY^IMcxyf4&YF(1fG7MH zM+SB1siPXz+$Q70_Rp9b1(WeWB&;9y&-y9H*C(#5ANFcpHcv{QkD;uF4%5u6R`fJu{z!Qms-m{DWfJCb6@0>}Hx(}Zl2|Xus^eH8 z%N+|8R)3pd)?++FPGR0ckpRzP^17&~%~vDj*I*pS1&!YA%Q1_W*e|4u6#j zm(VZm(neGKQ+D`*bw#M zl0lnK9Zya+`-*GJ$AoYs65Khh) z3j&fxbFlMcn~50#O(oV|*nF|C2sbP&f#k3ltu4o^&}t1q{IHiD9TK6{UUo&gz3lng z(6Du(6=^}VSg35h-Pj0nwPoug*T$cTzanxg-AG5{<+|v|%CdjJ*+NVc_2_;cj7EdP zA44Af2#K{dW#$Rab$iUvyJU$aL z7UmQrE2!b3cFVMEyf-h$*~?B&Z)oEqmBFIfEqPS$TPDRo4xAFRmsTqpXAw76cx+tm z^u=tv@OB9#IE?1HlB$+4(#{)R+8P2A%Hqhpt<~wJ`Qiju_toYBZ^qi$tkMJ>JwXa= z<9H)cu7*U33bxyg^(b9!S$pK_$E8uq%RY-9MC&ki%WH7Rk)n7&+)5nYyt(5}V1(i? zcsC-^ew0Ly(UTa-+9fX2{fWLtxB?#3@VuTb{gs$v90TEF1KNmrAf_XAsWGd)OsS#D zddtgpMsr0l)gCTwjhomWu&?JO+c7ba4U1#J2#t}_wlYrXw*<$*&d62aIHHEAvFS9& z*mQCsj!ZY7hE2q2G&hyd(p2P{n}&uPu64{!cKJ$Lnt`nb58-j;$hi~@zk*Fka*|*5>M1*^Z+0=8Lb7RCZi$fVl^3YsH-A|%I5d+ z9IiNklo`JXNSW~n@P^mrZ4^)+Joi~k0Fg=itfv7TEYJo(RPAP3ue;C(4&<{w0i;eo zIhf4K`iB8h%EtqmAXLr*qzwNVKx&pE>xUgjyb-G4qTMpVr>#Q1Uw{%PxxL8$CHAr+ zi2wGom!Rt)mktfvAdCFe`0KT08|=o%fV12Ra7g19rCevOZ;ndbin^(~1FGQ;2&=^K!}5Lo@4!x%pfC4+hFt@rqiHobF@3hH7g^pbYtU`-!+9fziZJL+Q;_-(ms9x zkoNI=fV7V(B`Wk!2l83nFiNzKivejL%chKrA@)qzJsK52fNI-s#7PfsBhWKPeer)J z_IG{UNomk==r|Ygc&5g`GE88IX#(s<*0>E|Lf1jKln_4H3&8WjdlJlzoMW_CDH1Mx z6`N2ncq@wMyXiS`SvOROJ3ThGMNuZtt^(xVf_lG^dn9K_;pwT#O<;WqLYpx+pzjjW)EY zsm1%S1eCI*9xSsO>Kn#bYORS}+;D;wJ)i4Tq__mpNRb#$j7mj3iNzx@QA8__34L*z zzUFco=`XH~1$23WrN=>3)d`!mL=|1G=^w4FOhpudG;6A2a|$53@2Gu6iyOp=4x>YP zgyr%aXjh@Lw3Bg7FzME|b=OEd^bmXCd!#JPFxyI;Skh+%$ zD5n8S9KE4##2js*6M}-m3bbCbJz5)fqECcd%5gLYwc`p?_7q-QY3o2W=|LR5*U`-m*s5ET75!isgg8d0;s zU^RrM^sDIU5V{Kyc-WQQjYX%LXH_|57lz~i;HgF&ZRAnnc!CBJoNnaQhE!%^5om9) zTM=UjeUT^X1H`N3VlSElIQ4xhEoe4@IIUg9}9r1!zyX0i%=}>z*_)m2mX)y>?=UpmFz(6EOwx#^K_stP0($MKu`68-@ARrs*Th2 zPLIXg=<>QPgTg-EpY}$$Rlz|Au)Zl5`{20(g8NL*5wDvSBcot@L8d`(KArILt z;rEmNLWaqalafDYE9+#yXTvbR53>v+lT0ZOEdogn4&%J>w*niN0AnVrv*WAX1(mjN zv1yznu_st!w;Zp!oLYE|!`Ktq%B%{|X?=8g;>coqo!u_X=3f`z4Id^56Og0wcABr! zr6M<{RK!)3Ys4^wB~i|emgOlJZN1ZIDfhuqJK7b8c4EMcH0&8lu7u1ab;_4>G<3>` ze;1~NBLLzk)4yJ}u)kE(4UuN^gv!MjlpHp6m!@4#N6c(MI!>+thWm>I5@F2<3#+XO>0-150SwDa6?xIw^O(dZHgS_(Lpym zMj8pldSeFHH&OaPbeZ9pL>s0R_&P4dD=mVPt=&jHlVsiWKY(QW8E(1h7bx`9_)2Gk z$UO*;$u-m#>;;{)jzjSyKB=IpWkCU>K!4NlPDUv9A-5SA%R>5zd{8Ja+iN$`=7Atv zO*8NvdOC>5u}+|;N3-MY9nZ*5Z0yrvV&cxd&(%gCH(orSZ6MOW>!M0JuB9kr|*cIsEl=X_h6n7>qJpWNZyW!b;7yJr8_Xz z*-L*4-R`kY$Vdp{wyM%DUlad`4G?>u^_B*&f(wNsdS;`$s#-3Yg`jZ8?Z4x0WDlpN zaUmQpLH|c8s#@-6LqmZLVG!zPPjhp@(NlRn(x6;sMhq4=FOlsa6=#IvpPrb8{N#AW z9nyK|bjeU<7IxdUe2#Kx%U3`-2M&TnZu~GNIs=K&aXbMS!tt`zlX_Y>{>vfS^Z?4I z{iUJ%Vx83~Q-)ACQG zw)_(Tl5|`CiPVZm&!Hb5))UA# zbXURJT9Yb^+=p^2r&iUF)Ku`)+dGWV!fxbB3yB#^+cy=>aM_WtUrs!jhE+A#1CYx?#$Jx`%+HW;+2#ek zROghE00eIVL0z38nV@3pDSw;&h!MGamTpSg>^kVsC2O*3okHct!l7r+M}vagh^}Am!oAVB^P89NXxO947WGC+&Dd+4WdQGy;?JZdmB6Nn#|? z-|%7*K`F1cV$33#NklZKspf}h&%_KI7GvRVEM9_YBC~Ldn$B^~!Z8k@jCKHkHu6%8ZebGR0|VM9dkiRbc_ZMB>GG9dqMU{+C)3PL?Yv2tv1aK zcw*48(uC5v`3rJ`5#%gr!A%M@{7sEl4(E=P+fyvfDaJn~bOQ*P0+SAo(?pN7VS5bL zHiN2DLM|G?%CgrM9EH-cY_35dF9#}=MU#U&nYCqU(XIHU=XJ7b z%R=eV4a5vjjjwY0*n^37Z(J-TyIWca;$P%yc&8fO`l*g?eF_e8T!e!h7j=D*Ve+rP|t_P&Lbvm=Cq4Nwt`gVZ}-3v&y;*Yq` zUUQ)!n1G`nr{jyeWe8&8!)Xn69K@pi94@M8U%N3Id3NPSrs4M#%zzs-V^o+D{HaEBhd;8MoAT0jXOmn3Q8H zp|MOyfGVxpfnz-c0|@*>AaOX?sOf_+^re1vjo58LI*APClY9Vu2owUyBM<~PNdPimI-OKaKPppN8_Ye7MY~y=6k@iRlZnM5ogp59Nc?XL8GO z#0jVLj~-f&^7XF2ve3dUXjc|l(QK9jSf#BiDCEEtUtm|PbZ)T<{(zC;XNFraLH`MN zh1iZdh$h|*R#P=*1O~so45R)tZi&$qsyM@Zkim)ou+-{-jkdHRF@`mSIWo|a7}sN{ zH>sOo%t)eAH-UEn@-93JB8855ZmI32-bhjr?~7y6)H4S|utIlsTKh=Uy4GH?ol0`h zM7Z7!73e$X;PorW7iQ6Y)W_I2ti&(GAmFo&q2=67ghp(L^l11fEz%9$XE*&8uR`%n z?nWYw8;J|?u;n`IpPgSl*a>C6-N;ZDuqCHcgrhnqG-9pY_#$$Tby)Zrxu{`xhB-o6 zNs0}N3V2XYWXaKZ5N<#XEZ#KWamPX2TkvEzPH#TaiLpf#ma4F+Y+h6nS~E!oTXa`9f%?vO9j-Qe?b|Ks!+YMjyNT_6S<-f>6P9!-x z-c!2HBET$AGiE_Hj%LhYGd_uSL!Y2GuENN-n;t|%vuY5*HD7k1Q?-fvH(S_KHCi~k zs9JUDo6H$Rtd6Bf!jMIaybphihs+S`G)F8#R@9&+qFI$0ld2OL;f&UBL#rT(rXR4Gc!Xdl!>CNE1C$qu{gxUvp}il}_=Io-ENxkcuXq5?bsl zCQuz(Twa_uH9n~t3cm<~U(bYKsj76q)s^vSD$P}9%&CTE4^cEet!(?$pTJ>vY?js# zF5OhV7>1bj!Nm*H_+DmYIOFZ|#bu%dFJF978XKyi9aVNnkJy6P%K1x}I+_MZ{1ASv-Lfoybc}RT$ZpyTwgCg}PP^$Jfab5nDyhMMcw@XGwrJRdIyS3#v_93}`k6hR@<%v?_Vr3P@KQN)P(%6ZaVh zu0G=^*L3&0&v>1kKI7cibhiW2XAF6xYLu4%X$d}a-}+G0S-{5yoPbn9xdqT^^6Wl9 z526%4>oGt|g?4*Kq0+Ep7JXT*v~H1u1W50O4J^e=$XB!4;UZ+EcO%$=8e^n37B9iK zoKd{3xE>%!HHM4^LlHjBAKZ-a2V_HVXCCxti%Dw>-4Xb8kd%)OY{LX{jd`#@z$^M- zyto#MY($C~3$UBr^a{Rs90DAiyqizK1t{E^$nW9!bjaLi47VE|#8anUr}H}<_*7e% z!j;F@v3!ukurws^G?SXtGaX(+hM(=$U}a@oWl?S(Yfy=59-`HnPK~c;dZ_>95vxkN zLIOz)J-DFInby%Mq|gCL)99dkF9>MsP(`M#gKZ=>ki+d|2%7V3IlbI2MlV9PaMv9g zlaB&#q%rvrS!!_QASA;SYw|ZgD}Xx+uuy`hqWySb zp*>b`{rJiI3WtN|tgC2T7a77!2KA1?Xzz;BO=T-X_H8S%)}oPyWA`eVpfA~9nbA|F zMCPa6^ec>GqzIL^$~7u*ROSPmtFrBe7(ft29FqJH?kxy4Y#kqJcxQaY32Q_4?VcP+ z8A4dDkV1VO>UcDMf9gl!fxYZCb4wnDgaLR&_lF>|qKF=rsM0iHRm18Z`@phVua!`^ zPX<95u~zEv_h~DDzhAW?XonSnfUy~^(b|@P;rq={!@J`<4#Sj#SDaOkLU7pgH5|yL zrI25G)L$Ndqhl}L#CD?}(-CAy6gM4o)Qs)U^gg1-G`8FCJfdo*W0gGW<~$1U(O=|| z=-fc7gpYnLk3{c=?B43QNq&p!%^y-7&!X6F(Y@h!0B;kQ#CAjGMe&^Xb7H$i`)1xx zi|rQm8-6p3#JJdQ>fdmv0YcPUiKAKP){JPtUbY54J*&aY*F<|GFwGNa4@)oL3BB}g zA_E9)5;Pnd%{0_Xq`}NC8p{^48@J%+SZSP`6{3k;&j->p&Vvg6zs$$V^t3+sEL}f(h}MFZu(f&Lh8Hn zv8sd=nu+7avJJ50*yXPz4s)7du(t_%#$OcOjB^FiwghyAo4Bh5Z^Ss`E(eP>#$X76 zA26h%J=65WS-!k9)!KDQqx5#gqZt}Zce*4KCGJ{J8CN7Wd zm6?VgfkbU=ugo(1C`p_i+bc6H(_Z>nqAIpm=9u7&kL{HyCO9Kwdu4{nn}cI}WrE3@ z!q{G!U-(gy$c^pg^osAqr7H203*7Y%+Hfw=3qwzF$1lb@@SvUXw&IL(Fz_+bV?WL1@hE7B>JFf~E+yebK6BS_(RKL;;bg&im` zfdGT5mtu4zMPEb)59;gv>GduLi<#Ha57P~1+)Oc1&`Sa02qW!dhO1SNF;He93l%(X z2c$agWq?%2{elZID3v~=ZKWQ+_K$(=Iun*K92HJ!Zij4+t^aO1C9HEDI!yeG&D@hY z&V+|^pCMLGa~&1*D=Op1*F%%(9`fV4E%(R-Ya@z6k8a;{woe7?)6hg(ze@m}DU<1H zKswdb(+kWDd<@(S!wt1`IcN$W6ILKw5FA;TE&?0I3_r7d43JdncBR^qcoCdi;|T8l zl2GIMJeNQ2<`F*%xeW1X^bq6FqV}?95z-PsY&UnaS6rn=pU{YPP(i?x`7AMHHUf7! zoB*v_gkg?k)q=-HFZcKv3VVGXi9GC8<0^vpLM0K!hLG;35;(72YSO{Ab$N!N`Do%d zu@3qVL~>l;>7L8eFn=Y>pE1iwi|%Q!2PWuZj~?y)ExND-?h!tI3^#o>p=cgtgpJXx zP<@%tI7^g6Wj`?u+dcSN1Dw(m{(6DLQR=gX9uA_B;n>Svx0D%!Y9*!ZK>Q_$;@T11 z_xX+4opQO0_85wHI%?vx=xRf)uFtw0knWdafRa6jT_s&&A$cQuS~m;_3}38f@Lz(R zBnb6Y(CC|Beuy4Sn`1B(Tj(Q~o?l|(p1G)sqrvO3F{G-SoS7nZG+Xp4HgeNJmKmDPY5f`!%$m|D>n&{Iy24& zq;>oaAe{hzaNh=JN}w@>>cp|giueXp91Z*t@|Hy)6T!3!pJgz0EY$-4HSH|B8$7M+` zsVeJOP!L{&vO%_EX1H6kgQpxSN8lifAHyqEa{K~KmBQNI)dxm;v>T_O$sBc)-9#r7 z1dI)sIQ!2cwVF z&Udi4b6M-Rg7h$EJp|}~A8yes<%kXxCZXk;PW0IU!jDtR5>moGgiaZF$9lLeY7TIp z&(V2adFGzK)!c*guZ#U95j3|h9X6R;H$K7NLSh*)Od@utbODn>r4(CmsCyATE3~9-b;w1V= zcuR57Oe#Df4t)X~#KDwVCnH1xUZT9c5TSU*P-KUGloyC#3U4#m6mFC$j6D$KFA3fw zf+5^@-;CrcCzbRb8!?wJhegO1Hpx2fLuWR{&Bf;F)k! z#;k+GPgM(h)#6$mAfWYaNIADU2+x0y5~`ewE4;<410Lw`^DX_DSGQr+!fqa+d@sft z(|lCzm2sl9Awx^$PT+va0AJQt8t(B9{I$dg%Av!8Kzt_uTy z7zTd)@A~MRG4R{v|2z9W#}Y%2r_@${85u)crUkVPNe}-H&Ng^(u>j3A1Uum}Se%j8!4 z5X=yyJU&t~9PhcZN#=$ikw?0*PL?H7glIASk;h?>t)n=lZ*UR=Wnsk|7%dSrIQa$$ z^PvC+GL(AQL`C}I8+rsB0BSzVpO}eX@D;`3y$jl@g9tZQ_!A*KvIy?7L zkRKjiQ{e}d&crah<;KYSHivIZfR8hAEGTD#HWTlI;HU}5oeSZT_cL%5&cXSM9>7!U z)aiJltnOznv;+`$Z9a(}oh1-$QVLy<-;Ny!GO-3`!4%*Pl)G_5AZ@ptgw6q}czbLc zWlFbSx<#kqB-sEFEB%p?a*nK%o`hDnvBahu<`3Ssl~?) zw}pls#p0fb``_?|xsS#TkEJW!f=u}JaYPemWN7&>&@otjMq5yJOEthOUX4GyX0jhI zpcto>1&bXWbFuHXI-bHG$9mwn>T*-z7!RB$cgYjKVzELUi{*(hjBJrLakGqai|pkx z2rrE7R#ve*h@^=#4XaRh+$zH=6nCs)75erl!z%Rc5W^~za=uVBvKIEKv1ct*X;FQPqVO~-33Y_C(`_TXLgR<>DM{kNZgJSy}y(y@{tRi~Tz0&G-`PXm< zO5?UJfRT(qj5!ijse^4&6|aQD65=rVK0g}VVp`%H)VO41KeUpz*CA|>7xx;=@@h42oex^rsFqHto6fyx=IPJK|-Z-D5E+>skw#bGCdx1G~lnR+igQw{7`K&oveqgSZjg(yq&m(QY~x?;TLzWvgLXgW|_ zhR;+C%28@kprej67vz*xMSL@^sDRBGhvu<|#+b%F2YO5JR&agVj7Q>|2Is@^O{?)i z^s%DRc&ylrd*d;WFXzfBWV`7DR4n9COezUI0F7OmA>lm%-5Za+B<=-?vW<4rFYyfz zE6*|LZ{!#>Oy1rS*iH$ur3BGI*ov*JXxtPj5JMx_Z+aAZJyF}9-3}dshn^m*20d?a z_B)VW2zu=mIFfC<^z6oizzk^r2EQ*k7{yf6x820;kWfoL`UrdkNkgUWj`^FB8K%ac zt%R`w*1igq4AyTrAHzuqroV=5<7uj^2a>&Fn|=8Ns$CD(b*t>zN_%o!xNU2Gs1z*# zD+>@T{AFt1_(EK`AMk!YMo+ z9Vw6AK$Q^7?%LMQgZZayv)x2*EwQpE)qrWt0lT8n%mF&3;0g|M(Idd59@8MEEkE1n@&O7Q&qIge#+5ETkF;nA2BxTt^h)(S9Y8xLgg$_(=+h zxoSZ+Z-1aBWb<~C+K};+#1qGh5g9kHKsC2IaTw|dJNghBktH(eYB8gWU~A0iTWLmb z3w_ltt<@tGf2r-Ge2frrDAaN0w$*B6!J+E5mEHIT9;KMq*YN@7I0Ou}w=d@dzdn#g z`aK^=BRS@EdRwQM*PHl27BOG^)x=dP=JktH%p8bfBcoE92#R9Fynph8rLNKN~_yyKg zD*xd|7IAj$jF9GPHoxalZCXcgTc)eGqJo|$?VYoX$0JMCQOyRVx}s~{XY|6Egr4$Q z?*Xbo`LGehUrooLkNQmZCggOE?Fi8m^hQh^|AEeREs(+Bx5HY3nY9{f9Q=Am{Gj6> z(Y4F2Xr&Z9YdaHi1K5gh-sbR_UL1%fWV?yNgyN5*3VO{P%b~P-8yj5ey`?xM5BdLF_m)z1$o-_kCbQoHMdxZLo;Ep%5kDn-~exVe5137y#t*1?kBAPM0Uujt=HnzjQdG_yEkORV z70DK}LZTMG^O=+LekOjawn*Pk!f)A=WIMi6_^sYj8*#tOtBFIjWf@uQt!OXEhAYq( zj;Gj5;wOc4OP^ibxBeTSeVwbeQ*1YWfZwUxVcOGDx5F#tiMEWc`NSq>*O9X^z#2Yg4zxb*Wq8b5gg&(^I#^6H~XuqjWb+lO31+gPqps&(`P@ zYD@TKP{E}z8?CS&*QLR6tPSl^w)Tob(XfS1c(vS~ycSRQ4;Cr0ei#csL^K zz;4D-zgtFqcOCTzh&2xCO+JLkQR+kmM6BYr$2n1O=qL(jwr6Dtg6tt3!~wpobR7>s zOm1tJR}y#~OwYuoFoC4t`%w}9EEM0)06ox*L)|>42r4}}8bFzYs++~=b$4-dPKC^X z1Ez3E1dIi*!i`SgjSf!%5j{Y+7zCcK!gS~SE5kc#a6fWhO_9ahRQ1@i6*X$H+Xl@9zSnQptUQR4RcJ5pX*2-^#}S3Pq-v=&YD9 zg$1Dd#o;Wu0(W<`udDwJl6labBmf2iOHs5pR(*`!)aRHbZu};0@J5$@?95e-Fr&dM zPJnevVmQ5E+%h~jclMzQ&|__+GAQZ9lM+=4^eM;kp(T4^RY3I9P7LC@RJs4*{Qcy;(H3_}`?(rZS2DEUgWjMZC-4E5mjJrC+Eh^84GuBp(Fq~UGC^^pQ>UI%@ zaSmef&Z#Wh4Aq{5U#kxm6d>$%4>i$MhbO!>h4Q}jt*S%dWD7n z@|bdx`wyMo8o>=yymXfwsSzhOjMfiA!orgGUH@oT$j=Kn$(0i|&=~u|Woz(T`UGa; zPB%1-Hd;6?-Yt&P<`JT=rPEba{6lGBMz4d+)R}<4>J-dvn6{i-d9iG+U+zcK;0o+C zxdMAIS5D|n9lz^xEGLM65nOz^uemf7|4LY;_K!?_T{&TI+{eXJygq3|CYzG*X>z5i zw&zdWUbz=g9@@%hJp+jC=d-o~(pH3^E-VrPwueQ+C&|QmLWAV-e#6&KOpgv|7=xC2 zN}?7($JXY^6Fcpt6Z3Fk_)##Y2aKD!>Y4Eb9u@1{8=s~GlfNhg(WxOh*r7O}Cz%`k z=|~i+mlU|tE%0f8&c?vdh?siCH7%py7pn1@^+(`sd1A-nw1kh zq}INCi@!E(FWM@zl*&##dQ%?Jfy!?D4IZtiVLH!C*G-p=G@6cbn?mJ)lJhtq zw#L|wC3u?Jf4ATXB2>jcufH-6XEAYwHsYO`bFa@K3%v*{$8K7I9}QRLr$^uAcy(@X zEi91X%?wY)-?3F}D2We- zEvCbp7Xa!hEq@On*|%HJF$(^<;J?7U+Hwvkz*Xsqq&LKj$nQ<4i1u z?j{z?keEQf$z0uLu>F*8*%+g+oLMK}+D4N*N;g)Hh%6~OPuQQt_ zQRTH?g36sOUH&&fH3IRd{TzYb0kl&(l}fvOc{Uo*IRep9RENR2F0{~v>H+D15Z)@A zUCdFV;Hx$YPKopL86)Vx0=k{wxc=@Neg~&EBY^d1?C_NCT?ESYi;~?tAHNwF*_p5m zQld9gdF^)mnNa*?cW~HERQ>N)B5qD`5FHUQqL*U=Oe%t9HiYvqizmUIQX*lz zlIRw1LriqEMDA->i);LuCA92tH@ybV;Sea4JDi7|-bhPR>@&yOPIwq{Cj8&RfZPKAwpm zgdDZ-uXuo3c8WSWnkNT5I~O_%3k{L)CScPw-N-d;V_e!5Zk{|`;w(?5?4W^`YdTH= z-l3?5R`eJ^D({{SNF`*hs>+#{1JXv~1WQU@C2SSF<<0fbbed>5P^?Ig(oNDxkl=2@ zZ|uFJxp+kBtaM#s5o8_QMvOg*_oA5Q$rulC7ehK896-96!U~bftZ$qf(c@TavO8Qa zpi88~!o(f(im)`6yC>#RPUvuWK4m|V#)!;FVK%Rla1IKr)xQpq@}@fhX+t~=NJq=_ zF7yf@ZB8{Av2`N7qycn_I_Hp_1qrXnic?-SZi>RGk)!6!c4?-Rw-^^r1{6Crt0^w@ zU+w;i`u}C$NHdu^4fzTB&)1FOGmgfLryq>J;vJ9^T^OI> zcYmfwFQ9nFO#$U)?V5hgr}}Wz5T`0n_O-p^&s}RTo1E45PJZs%<|%&6Hv~8DIdLA& z4K`1#gVzIv@`31K+#=gNv2gXo{%NZxQp%u6C%i(O4dHXhIZ}UhUV5|#c56{y6&sKY z@$A2}jd9Mso`l-!&g2O|x|ewgkdE$m0I3lCsSCmC;$WCt1q#ir0(LxeA)2N+a~}Re zeJ$#$c5qtf(gUdL9SH7p0{N`|E(CR#x%N7Gh#@(sihOrtxTX6nx6#+4t%l2{Q1xN> z)lMz0-mGA|&=8k&F`#3G;~x#^O>lU)i+i#=(qvbRrER`Or(`DWsX5Es9In-p*Ing$ zxSK2U8YQ{Ps1t=RUEATL?v0QNap^I!LGs)VHgXt~_^K|Cckmkri2lLvFciV%xEmBq z)E7@A>KrwU5yE84KSd6*Fa*X1WX)wZh|4o|r0&FC-N^Z((c~YwZt?EoB}~oOZ63=j zskGvGReT?HP_WxS<4y&{BT?_)zav2fG|Svy=-Ota%CE7xlsF(#3g-&o`OekCtfh?f zj$binxM~IMWq$Yk&}CRV@?iRyk8dBgg0_<)nBLHujr)Yeh^m*W*3cTu1^wtal3l!~

l#jvxsFRfomy_Fp(z6y?W4r& ze!gQ0-p&SnU5pk1(v_ObN+;>ZfOO4f6j^=C!;`vbJpf3<;;aLtQ)H71z3o6g>q9_e zWU&4dkW!%qL-U{;uSW(D2FkUb!4#oA!4Ws-ZXe-gFO*~CEJhxsn~e5>s#%)i;Q|ryUV{4n%msq>)Ub5hJ8mO0G^%!1 zJ|OKt3CZqnILE)QIh5B9t)AEiqnTo`iKUO4!A~3F#@b2PVtQsT+;{2o^HjR4Z!sT49XFmg5-8vc*Q0I4OkP zR8{w?>3pvR@po#G!bVJF7WWTn5}e6OE%&{&#?M zh29EC`!xZ`=~wioYqWqGC;Z-+yh8? z`xAh42yF#)uVB0f=yw9i6rAbYGJ{jh+`n^~MHq87cn>d(70*!uZNwwz8nm@h1nPE;rC>W51(~2ARU(+q3__o&*Iq+T@^Y2>8ilr z%J>-HUq|hKSAJ+kN&YMHL)TuEuKXZN(*L(21eMh)LU4R5Pw=A`bg4;tQ5usxuT75a zkh$$SZlx28a#R4gxSowHqXb~=UCs!s+~N3b#S}3fI^k@T;r{qL0XVg|qO@ zX)`=Uf`}C1F%KK`)LYXu5@N?xQdYc!9lSyDHJ)P*wu9yzGO(eLeKFYB8Ofr58m>88 zSA}U<2rA(g`ekzNOSm3UWd+d?GTI-fe833LZ{i904YfSZb;M-j)pi5**@)>4wQrq> zORdpaEe-CO1-t2PV(j5L2)mIpg)?+G@-3&2CwP#v4H*qRr$*C2d1@F$0=(#zBpX72 z;WIq*eww$k(X#)XXy)V8HQ?j{#^(|i&scC$uD#;vtv-0Gw)LHW(qt}Qg^K9BeG!n( zTb>tJyA1p#u{o&b;SXVo?Cl9EUX-bLF-pQlB&CaD4QPmf0ALDPkv`Cw_|b4pOOT^O zCeb5>Ub)g6tMrcBkDeo~^xN<8e!|LFoLIp5ljB@bB~tot$tWt(;w`5faC1A1ZQgVF;Kh4ukyjt zb74Vce4`9ij?NfxogFv|wE*K??nUk+0(hb}J|!9XKa%)rqQv@-Zd=ZikF{earZ32r z8YR#kS3_luLwuk>&nR4)=;RR{id*9C{0zPCc!~+)--+mV*wsoTYVib6ag8D^uLhz{ zgnz<Kvn%MZg}ro4vKQP+NUMT8_D7`{GtkDN^yBw0{b+Qe-8c>j3D!mxXA~&)8ADQ>gXcbRIZ$!)3ioX@AfX9SoP z)GCqw46^<`xQ_pOaGiYae@Bx}`e2g}kJZkf>Pq2H&bj5;ue<9i%d57UfuRXcn%S21b`1}Id>@|t&sxW;O53S+D0P+kab zgSDZK+WmU8H%4r z?Bw<_Er`S7sL6L}_SC|{kcddlScoB{Kah5hCXaqn-06UZ3KZ`NA3k`B<2trtQP&L? zk(2jqWQu$pY6wHk(^kMP!(;nxl4TKClh_~Sq3~IT|4bWV|g7lhv-DtVc zC5{#!E?0y`k2%I}T8km5`mUz{mA3w0QgvNwR9&^M{0K)x=y?q5#wY-DgU*jb;OzE) zOSBYxZa#DrdGQ_17u}KrNzE6=aDgh9Qgh=jrOwfJ>4+Cq7w#y!t+*b2#8)M>R4jBR zN)@~;Xkj1Ud_|tI+c?UwBT|%MJt>E~iirIBZLOT@8JiKn3goI;m@&sg19rSl6-M;y zO8vzGjwXhhie0nR{?)*5S2gCedLPgO0u8`$Pz^){ zAk~b~wMZdq##GzD1w*IYyDn4!3J(gELi~M5pwuOyT6AOxD;D1XMJ&Q;OZ_RHUjQm{ zdd6rj1K3n{mLqto9x`+jl6i{t2=O0EAcd53f5+M)Z8&}kOe=H|$Fs$F#vkax#^QSC z2VP@B2r(f7&DFbj<#c8h@Gl<$PLRR~=JG^6hMR7qy3kzxmc%`!UwigG6<6AT^kdg)Q^RS;sE>%?A3z0E0aXb|yZ?4T+tAiNi$g*g*A;-2 zas3344g{XrrSRPK!W91sYf^dqQ!Yz--ol*RO+98niN&)reWE?&glcrJpN5g)SZ9SY zp4H;d>4`vzjk^$v#GPFBuu~X?w7T$d1GxXf_gnYb zp8#ohQN^m=m4Ob??qUoM?V7^@=^Q=Qg`9{$qNjQQ*!%hE;tBOss*8F(ML%VM#(zaW zH5r7U^2p^15wsg9LDmXfGKNx$L`@L2Uyj3cDe`Ds8po! zqF?g2R@NNuXBF}T`nxKN8w$IX)|ARF;)9GOLcMs|*Uh&zBUelR~V|PI*=|)Nl13)z9j^DQ|1e z27g_4O;$A#=iz?={+}zU_~haY{?*Ssm!3kTw@aRR+xsAs9N!nX7zz>NpYqJx-Ufqj zH67bqA-1<-FjW-)&8I8c=_qZ6HPlIB=&}Wp`6qKwx}v_*N=qAzl+ z1#@$)i)Zw*x!oOT9S%FtXmJIazZ!jgc-TkQKNFK+zHt` z1-}Nb@u6pm`CQ~uP>2*5i3auKSbdMQlNfxf>DYD(vF#Ltbno_zr>u-LFtm_Uk*SwptU|C%Q^xz&Y7OI)3-Ifj(JSvALnziTU&)#pF^}ny?j=$x!tWy zv>87Ji}lpBtfxX8yNbnBpW(mxbVdINrSBv$bXntM85Ck(N>^xlYTOmwkwQ1^tRB`` zUu0Rc-pjVCU-ny5R&}!`&b6)lTl4C2t8-+;P;F>FKXO|@A+`W-%FD2d4$8Lj)B0N7 zc4lu)jyB7>1u0TzD|e3ObBRk&A<`SCHO9?az2_EK{uzBFvB6?3H7#3IA<|bYrlRy= zK3&l-SNcv8LzgX@EQ3PKOX-s4q65%9Nn6y;vh2CpmJNPqkIb!OHh84yS< zOCi>{S}}Y1tzI*7tX`wKS-nQ~*oq#gA<`54<9zB|Y=wwDQ?ZBUSwk@bht9zFs9bC4 z$U!>?Y%SW*ueFbqfjcJixy+@a5UI=-Dn*CnSp7x~u=;(TzY`_ckkgvvyChSH|4F_( z)6*jJU78A!=DAw3ELi%~BWg71inr4X?$5iH?2 zbLq0FaU}W8x0;T9sgR5t!64lj{+mx%v?EH}Nn%RE{!8Yc%t1>+nm;u}-IS>~S7}WL z=2!zq^|A)eFWlL8Yr%$It@(9!O^<3KALnV^s9S4=Sg(4az#c0|8(?+cnY*>yhV0hN zI$upjwYGLEQl<9T@t|Wq3tXBCk>>SUsyR8<9E{;pW@K6Uk#1K0D8H3IGH)v}z2oQ# zmx4m1aHCQv%CU+@b+?K}_SxBcYtIdKYxlamnp~;Zvz~e_bSWrA3b!hS!Fkr;NUk+_ zZjLp0MmK9P$}o6j|DA77x8%H$fbCrvs5HWr&7)8a| zRM+pq%@`y&1~cEq zBxS{9e<>zYwR&pVRUQv%9!SZLq05n$EQdlI|4NrMUpfHYM;yACO(?sCvRmJ)?4*Ai zXqZn|WncOql$|sguFrhBqWd?Ynu&^OG6>jSg$21%&`jR=2?Z14GJM$6izSL*=uWl9dqBtKh9^7 zOF4Y#cebs@O_<2MIlnz zAykI?5#IS_WxfW3Z#5lNpsZ!=zjgZ zYu@12Tp`wN-@mN6ren<&V$Bs}|C)D2o7U3g7Q|cgWd6wEDo5msw-jXAtFM8PAoP0LE4mFlV@z~l*mo%v!HlMEO4ivg+{d27TSVH^H z^;`XCWLy0q7WN<6cPlZyB0`hf0tzu##x#X6RN%J?fL#FW0$>-6RMznZNjRVDU2KJj zJzTK|=2-*5d{hvrXQnhKF-P)pSx z2b3akdv?UrX{H$X<^rKYg+jzaJSo=Y-xS(zbSWrA3ROy>H&h$*?Va7X=5FZLnq8Mw zlUc&7&*UHH)8b+)MC|E;E!=QMPf2Gm_*T<#lq$serWi~$%+pU@(VnHWk&+)n7Y`k3 zsW~WJ(&XuF^XZE29If%cXtPoeg`3=3E5uyqIutmP^D&ZbjN~3EA~W;$M-MziyJ)V6ilsmRw08&KSjFs>>nom`_*qmpe7b7wB8x zi#}<09)SK+4t*_yDK{QErDYwpT&#2sUB+jR+a<3A)qI^DAlO1A`h$QSyuN^c~5)|nrJ!MB=@rB{eOp%_eco@az~ zMf+8yjg?=L|Z&f8|n8 zh!nn13ZA+KJQ%-rF%%-kH;O^k;HaKfulYT8iZP^B4JlW9uz%xXD@1H7liX@(AD`6+ zD`zHFPJRp)M}ns1NKlA#Qn8ro4diYbReIb7zcj+ladbcNAa>fag%3$!V zrejMg#FkVHrpoe^wJX|pr?jM@%a%;$pUgq&lIFMr(7i`nQbu{IK`##4=Ci`BtwOBN z1B$sHx46}y;QI*|OCe(YsY|RgJy?Hpu@oZKV_jm6@?bsbVktzd72jF61`p;_E~Y}n zZ1rG*t7C02oW0!Bp3l3O3K4U4vZOFB8D|hLcYndfQixd336{EIWJ%c!2H$ErjvR$J zaukE9Zoz-^>5BFyrEMWwXx8}o_h^&uYDuqux}v>VYnz*C<<8Bpaz~|GI`a^v%!A4O zyY43yVx9h;Y$tG5I3v^%fv&9Pv%$quh*<9lR#7pG$I!Ej`6|U2Xjw~;su2H^vz8S% zpN%d}g-G)wrFjs{e`$TxwC^!5vK3Ofz$czEZgS}%`m;8On#ZZVC zyA-2~IT-O^zU*QuM9hCGrf0n<_F%l?Vkkt6bPNGVon7R0i3jsl7gHf(`W4fY*K7~Q zYc7UD#OUG4D|Hr~>S@CPE~Y}nEJ)@xUCq4Jp1cOS7zz=ie-dM)I<R1;;Az}ms z!#n2;2H$Er&N+qhT@0pT@EP;ziuNH&+cW3>J=&!E(E(_~e@A3uRLPmo{~m49%>|PA zbXD$={~>MC{lNifk5=0KvaEj4YjlUUKNH%1FDBbqOT`(d5a+UDlK$IV@SIOq~5<^N&3knWHJ&_3xuq)ob`4?w&6Kcr2%GY>#}=6^_= zbk92g?b!}(?GrP;zpEd0CX*&5Z}aJ@AI}xKY1tW8_5|ZBnCeV54x>!hDup;==4ojT z_CxpS!|2Vy=$SFBtZ)~Bw)q6z+A75Q+^CqYiyHJ%9v8J| z4Jy7vF1A9%zE!dJlZU-)A!7YPv5wBNj)q%T4*JH(jPpJDO>{98BId6Zvu`)6 zZzR*|3jkeHX+&7@Z@VahPd)m6frJxWg zJfsxF{#pR5Rd03ldNkGkI@UvFl1oJ)Qh7wF_vG!&+3Ii2s=;G?bQh&?*u_+c zm`erIYb!Jue5>g=J{98lR1Bt?ga78!745$%?ZL2iyo}v-q?hF%l`kbSn53teocjuK z?kgr!aWw2wJaORpR%$2~~oM@=%3XiV?s7KV z<$Azft~=a?;P9jFLaj(7*B0@cpQ$btg-B(qQrT~YJ}&9?&omcHA!2q;$l2-Nnzg}Kmr;{mjU@P- z08I0#cBv>tDxYhKcKEFwqsp!BX^2v{HHp6gW#D*Bmg;a%sZMd}DMWf-3q6@dUz{iz z8w|eHbeu&BvBrwQRNk_7MSGvp7OIGl;gp0UF`0id2c=7z^kOiduITy@G7S5e{ra-p zpx~QhSx2EltV@n!73Eq*Gls)?^H8fOEntbhtkvkt(Bq!=I@P735UJ!VmA-y(+kC6< ze8I2lUXv&NSL-SH3>RA=V)qs7qCwa*rxjaCM^?~9zHHrO&uMSq5k8b=wLS`w)yG?{cI0r&i}78w6@zr=d)lBY+QXGLO5vr; zQK6|*b5OdZdDQ{v9_7*nDWT2p@1m=1L7G2509`E0U5vI`5_di`K|y;*A=cmo#X5kM zfu0}cbDB#sSq)%ocd;3ITLV9qz=5P zMAP5w!92soREU_<1ygp_FLUI&TU7&>faIuO9#Mil3eQrw3mD=8S7+-gMB?^*eTa_Q;~hPyg2Ye_r_E+Aq!b zlr_cw_{)Z8zc_VGak%^JS9+W0=G(kq_1dWIqi$Y5@V+}gzu@*>Tb^6@`Ihxdf?dnj+=U(KmXEaJ8s_a<&l@(`RVQZE~`2G57*qX zCDw1?kG8y@6Tbc0lB>Q9?yNocm4hGNb@_dj-3HcgIynCG(&MJ@{N>)9b1s~-ZP^(! z;+K4I{p1O`6E1wIr}ew+*=L>g;6)p!TsW|2uj>xk_}Gr}M+fa1@uR7k#{_bQ9Q*Z$ zRe#Fq7=7=g(yI2iFa7JUwwyG`eE)vbn~y$x#w|HLM}BtDy>H)_H{qgBevqAa#i>6& zqGsZ?-!vbw@SKm|Kj!_|_TtOu{;_o7v^m#bvHhx-)3% zKmK;|g}x`I5ACtZ5xjlmzkz3HyTTYtK&=pR@9)jILaaSL}G z^s}Pbc}M-ZzU;+8lioNh^XS8Wb;9CTFCLpw{_t%zOV6r1r|#lGxr5gI^p_(a?K5-W zru%+>&P&JS-M_cTeRIwm{Nmn{>u=r`Ubk_^dsTZTocq}mXO;ziUpn=;+rGNthC?UR z2J-99c;cv=zs`AWW5uXzMz!_2=qR$+IIXQvyL4+BJ;RNXY|nQ zpUk?fD*usdDJ$%p6Ip_X! z-urJ3P5aZ9_uGn}`FZiya}N8_lOtNg9|g{z@Xxkjn?0@$u_(F3ouEv8v~P z`P|h*Rt#Ga9dvm64>zxS@W~^-%ngUeFI-yPX&*g%?9kaSOh4hW8;;vEx8#rSkGONs ztTj`rmz?s?J$vWXe-m4I&MT{rmG+CbHR_VoBW%PF1UJM=dt7Ne*eRXx9q5U@X@3CKfU{$50CiU-Yr{J zl-_hszX3lv{+@>}yyd}b9-eYy&pQjxzCYu1|FO@Veca$(rMq_={P*h0q9HHme_eX< zGrySKGW(myvMQF9f7JVwt9nlgpK@gVw*Jq(QoQBZ+wR((U05@%`op%Jhv|xaFH!pWl7W`bSnh zU$J;m&5sxT^R7F-=(y|SkDr@x#4T&?|Ge)Z?^ReicMQIML&+P_QS0VRI5m9N;2!U8 z+jz{yC(pTT#6P-a{pt5d)}CHec;>uo-#w{q$(PG6+V<*%Jq<%w{QaUiTcQt-J9T2w zf^%MqY<=qfN7vl>yK8sH&eD(06YcJh+Th+847adi4_m;D^AHSo1ds*K@ z8=^}?&wP2%$5jvS zd8^;AA6xRXe$$_i|7rL9o%jFhwEM=L`$$3IkQaY?+^TPy!Z(jfKkt}J=a_t7xMNiR z+I4R=59xW^fEzv>`A3s)&6_{}=DLCvb5^`{#tmOi=yze--tiAb-?_Vc#>4-IweJ9n z;(EUxTvSw4>|IyIt_T7uRzT22!HT^gWkHlC#ojw^NYvP3i7nRHjlF@r#c1p`mKb}F zUE_D(cW#-xvmn3!^Ud?H%$|GBdv2S1@6685z9~7`Shc~08`Vafsd#v8oheZ-s=xmE z&10u>Rq8ZxUKr{+*T4O}TvwKtd3)ur!*y3C%r?z2mK_>?|8kk&p?lso^78NH9C+^h zO}CbIlN-+rzfz^mLdOr~!k4)$i|BFr%%a;Y-h4y)jbCPeC}?Qka>D2_VHGoe_&R?@ zn>HhEJU=+$*-!7fZYsZcOqE|(-8}H(ucLQQc&v|}HSx>yI*$%c?y&UJ&Q`6K{9!!s zA!cRu^Qo1uH@I-{rz_K6xD<5E=mW`a$Y)5%>%BlMUJ^snDDe_wBG28A&ZJj#2>%{r5A5KaMF@Iks;8DxD zyOu8>J84QkCBDt3)PO&(jeTFS z&Z#r%l-u7Uz1P$^9V`=OHy=@@gHN#i#>bOe*Xi1&VSFv;?UlBykN7=$#GY+w_LI&} z58ivRqtmf3g>&sMIb(e8ncuslq%LgbQn20CeXZ8KuXcIVtl`rycu)AXgvm6vf=98& z^^Okytwf=UHy?W~*$_MVP``Zl+W$Li<>kp==H)N#xVzR5%)iX5>T3?vxml%rNKn%) z$-m9M9Mj{s#d&g?$5iOhwDkPWn^}H>Po9mdwm2H_|8`WRh!qW*{G8gm?eEuq_o}pK{NV2UmlnG>Z~L3UFFgvKacxm~O? z#_7}cv;04K6gOtur(xgantouzyWHa7+xxm+whF5rQ*xhn4Z(2$=0(=9oxtM zIXleTvaP=RvD3Lu$8DSTzw(>^@I0`?n!VFE6)Rcgabm}?$hsxw)ye01rpv-v?xTKO zuzcgfU#7jUJlRt1dg{v_n;PFA;<$TlnY1@oJ_X+!Q=;ysjNL{4IkI|udhP8YZGKYT zRK9g@Tg21pe>r|w*d^bv5&n}`)Jw{_bXe~d?dthe?saa|U?pyaf6b4_%0931+xp&K zyA2ushfbEy7gz1ewyzm(J-YQR-gMkD|DAic)bGBnMEyKxC+D>8AJ0E2hi?A;WovAD zk)SHgV#9tO+;!B(e=j)pc|7%}jC&0?G`)YS=8_9@f1F!8%>8ZQQVvYts$cM?ioYkG zI{Wp%&nZ8 zN98*4s=?FwjkXz+Kis)~l+Q;>|QlwLdFGU*_-_(6y=)L5SY8^hzt{3Z3 z|M;~-ldiS;Z`)CiaSu)xPwxKRUquoNmtRrtt_yQ#oE;lizx~zqjTe6Xv!`3y z<|p%e-?Z4D`=iE$erqoIxOCm_yCiSxW{q>_c{h0b+2Xx}`^~z#`DL!cyPiL;Hfzo5 z)|>aOI%fW^gUiKcBQq*K+iUP>`rx_qs`5oHZJP9U()z@CBfDPMAHUx;yXEGu=TpLJ zcAbB9*~q)wV*1CIKX~5v-f+K(vzY#_C10%4Qb}gz&oOyGQn{rqZdW+3Eba6AZNG$a zh5k-Ek#K)pT*vmewqGpyVcYT}14pIgV|veyi|;QjIq5{7N~MRNFehxWPx(0c;CaXN z4y)3qtv+3Q&8wMX-6nen<#Bf!wX^b(Gda$j2&|-huDy}zjs6afP10ZX+WcbB;>Zr8 zub=CAX#axW{@c>J`um%;|GRYP^9{F49SW3sydv++zDpi#-|$neZ4L8#ZmBk*$!gzn zF2h5yUqM&TLdTWW}?pi>Ep*U+dNJ@8gXkkJnx^ z^?j{3`JCVNxViH}XXk_G&a(M~&2OxH9i}flH1WjJJ?uR@UfKJA93Cn5lZrHD`pI?Y z4GVo&E9z_f!3TY-yk0uF&VTFjZY}a`?y4UyuUYxmU{?Qo`rnuoGbMi9n}MfukN(g< zu5bMQ<*jD_UOaj8$9zuXK0m8E&2V^#+knDL4FB!9*y*g_tR;@IbyA8~nv~;tonseP zS&BUvaA3)kY91APg`}Sksow1Kr%PRCjLUVX_qv+-Hm&Twpvd+6PiDr}csb6~>5n~2 z?GCa0*?np<=O1P4@2tLA|7YngUU6q8bPcJ&(jV3;a`5?`N*!2v8k9b;s>!YQg}%Iq z$hSZB-!P?C+YO7O$2MB|ZvPKs!iLObur%RS-=otPqIc!ITbtfiwUhfsX+I+e4v7IOF zYh8R+ywj-zjk~8bVf^^SzID)-jHR@!o^4-eqW$!B;9Bh75 z@l){aIzgXy4{!0f_}{;8`l)4tw_UC?&kKG3W0mP2hP%!4Sk$xZc9*n?FYWp|b^m$X z3+It7k6cfl{Arw9s&e?Sv2W5H=cz82cV9dA%(Cs7Q=WbuuGL6Q9}-dG%JX%9d)FH| zGSBXJGl#vNuzkUuj+>KXE==lqD?b|55Dlv)o*go;~VNOdzPoftLq)BPyW^OM0(olmBCA3|T^1)ibiQ3RX4~p##XO#xS0)bodDHlXXEF3qk;;MgG zc~0$YHs|CQx7LkJBf1BcyG6@hw{l$zIkorLoVJCZcWqFi zzE|hdp?~gf@Ob}#bA27E)O6|Td+nI<^0>ejpAKGa(QL^k``_l|?6JF9SZfxajaMf7 zS-HxVvFlf=d})WbGah&NYk10?bInaN0=}+2<$0*axrK*jPn;8ZDf~&!qXnuCuk%x$ zYS&GDqV_dx-*ss2-F3Xa^V`1b(Tg_!{aI!0zfG%8SZ%JI|Jvtz#aw>cIk|6CSldb; zca@p+ecK8n(igktUD@J5jexp) zm)$B7H0$Nu2ao1`-;}K`168tnGKuC%!%MuaAZst`ms*l8}JX_yQ}j^dJR9+K=F zi?`!Jiovck<^Fc_r!8uZv>dqQ#b9TISMqlw=PB}_ddRhwLq3EfoEY*7S3PG&U$N*p z#7Z@Q}mo-$bnjdTsVJxOW4-=fo}neI5jQ}H|aSgkOMUU>etB*qyeqtz}*oBJGc@I zJ)qA1R)6X_rI1sSa3D`@!+#yD=afdyRd^+T2QD=lqUV%B&UEq$N72na^Stz&vdGy9 zujKFHT(2*B4ty)iUPZu8RIW>?2572==Z`ZoQ0X?TCa#*?CF3lrfv#~B$E#$yMW1zjBZRtbi18Yug zcAB}2Wrn?2am#m@{cW+ zwq4I5O-MK~r0g()j2X4}w4URJoblw9*eUkKX8)k))I$#RYS>ziSQ@G4xRVrvT{wA# z66Y-++)>Z*Kn{#Buz4o^KtfvAk0(hn*hP?6NI94C#$V5=j~o^!=gH$O^qdA#oQVz2 z|ETA{Y+@jH`Kw!*2DXUFO}&5#4*C2U^hA6xXC<|M^n z=LfIkuSLZ1%X*GCa)wck&x|Uh%Ub8z2RU#DKO7e)eymCkO30aZOz=exsW?>IHJeK; ztvRF#Nq*p=l`v+;4!YY-?}fRw8$i-QJ={NkB|V397ZT?P3=Smj(Q z^kJkvPAlZRBCn*-irs_x@Jjx)<%D9QI2i>^R%85h8#G8U^`dk+%7#QoTM1+;J$|9WN&%$=!JSt1agLu zS7_5Uuf{IcbIizr`(}W1`)$kndQK#A;68mQ&EbO=N!F~(6@?sl!UMEdoA=Ymfosj_ zha5J4<#KsgOV5c$P9u^TXs_Xa9W?$C1vBWDdQ z*NczuY#ck#lMQxoZ!H;^mEPN4Kheh-iX8YR4dkb7$Nv`VIm3_xs}A5an!CG*o--Ud z@PJn+`|MjgYwJ0rnMr=&`vK4vr~f-j7GDriJLi(AnsC^68MfVZbJTN2A%_$gx3d5I zw?xk&QzMB3-)MmRxSPw9VaD2P4028o7>=FspQ_p5j73g9@(OC(=MLkLbCJA4x!S*W z+OPK-kDLaiEeevoWkWCQ)N>{v2gVkNQ*}@589iqra$wAW{MbGxnuHt+d4)JDZZ3JD zk24uLaBmjOm3g*L>7nOLK@NPU9FEg}eeT+rcT$l9-@S)8FAk5haeR?sg0uy6X2^HD zlIA^nFUYOI?l1BRd2Thh^Bq0sJLEhjuh3pM%5Nb<1Jr`H|D+)YXJ@iE_s<_6=s9G0 zLA+R;Rvl+`&~wOX65+r-+Ti8sFoFzP)?U+)Q;odBc-VGJJ_1;C$WTJ!G$pT4u4j&O zZS;*9$nhhu5U2Y0Ytr>`end`lQilb|-p1YAe$#ViBFBTgLN20T_}OT$S;%oG1UN3t zKRoTJk24!Nb;&DiZsAX>=s9ypiouR_8XTj(q|_du=gdV;5#j~q8hEw`nS`zD=O^Sq zI&3HNUcRU2%p)lVJ9x?q_QT0tyX!ggkpuVsL%FJ#3SO?~EIxr$T>k?p=|!0!%yntEJhC8oego?UMuaS=PW@E z+!GA#UhZJ+j(W~gHbpB zA=OGaS@(?<$O$8_ke{bdTG==TS0aZ@*tq3fcCWeKYZY>`?i)}dgIyhBl#lF%jm|*| zN-9(u6V@OHuG_$|oSr|TpPut8a^T62Fpgd5(SuZhb)2=xfhPh$d#$T~J5tYCha5Pf zq3jb69Q9N=;h`}x@udH&n~|hOCYsIcy`lgD8(U!rqyZ-}PJ0~^szVZW2#mt&#^OMq zkP$K|Ss}kOfambG4tcLb3fifV7gtrFNC%Fu$~nC#;?0p5iuB^haEi3x z$W)57A`HWzW9H5+T963vo?i{&IkuDs0Ns%5Lu~QpT>Btc$ige;g1&R#k zNL`AI=Lq{Y;aHBqH=|&i$PxDKqj4Nbp`0-sfv3*GHi09HC^C#A>nKu#Bk2^W#u0de z1#C4r@`NJQIRc-Bz*d_hWhqjJBQ6xF%Movi)Z$1-id5xDI7NzcB$*;bIWmzVB{;Hx zBE>keg(9Um0*^F@tqezQQlvCTUQ?t3M{?0&sXRxDQ=}wEs#3(rk@^%V#1VgrEZ|5N ziu}rvXo}3@$Y6^6!jZ`osmzg|DN>0eTPc#lk<%3E$B}0gN#aNW80^T_pCffBGJqrS zR4~|LIWmAEaUA)MBJmtqOOXVQoS?`+jy$JGB1a0rAWpU@j?|>cj~wx)NIQ-MQ=|cv_2CG7OBS}DIP!oZt2hGRUxaNQM@mv;E=TH8WHv`y zP-Hbnx>IB&M-nNroFnk<5ZH2YWHCjib7V6`rg7vjMP_j15k;zSlOwk%Qja4JupA`Y4;(2$5erA$DDpi=T2SOW zj&!C-8b`=OV{x0xk--#6<;Wz8OyS64icI3j28t*gIio{f>X3Y}1i_8XjO0PQR!DOl z(oKgX>5%U!vX19xF-0nJWDiAVa^yNi+&J=?B2FAB1j{e7_2x)TiuiNHmm;k=5=xO~ z9GOg!wj5bPk%b)DMUk}}xj>OQ9C=KU6&x{;RWWSKI8u`$5gaj5BsWLmD3X^W(oh zPls&PA-8nMdmU1!m~{?o>W~&Xq^}McPLaO6x6Gu-D2}Y8$WV^_PLW8C+^0x;j^roT zRbcbuNNtKN;z$dMm^jjtB3(I>Op%csSwNA|99ct=5ga*4k)JtogCg@e@|+@TIASQF z=GlcKMJZB*Bd!!F%#i?!l;cP@ij?I@GDQY+WClf|IkJHwLpXAaBF#DSjv@gZsa8_W zb8C(SP$Zcn11U0yBi~b`Cr1`iWGP3sP-HPjj#6X^NA6K1h9kL4srfN;q$)+iIpRYR zdyXVfWHLumDH6t!1r!P8$Oejtku6<9V$HGP2}9NVs2qYMnUl4Mb6{IHH&+$$BL8wJ z1aYT;(t#mv9_}g!Qjk;6O$8KhhPb&kP$Bq4200BqQ~-Z86cNvc6luvg9^eXFXY!}I zd*XZYv}lghqewS~crc_pL+Y`}T^LfIW?6x&(-_%}AsrdQRh<~(!SXzuA@%E%J=n&R zKQ)J}e#SARKFjkMhVVEO7{c9$F~p1IxduZTvN+Wk!Xwvah&!!jr4B=Q4(oD+<**h* zxO-KGG+^a|fdI?Jk)j-7wNZ*8Zmhk^Fod^7X@+>Rdal3_9vQA{s%_y)NhKN5kVQ5! z#ErEwO#GpZZ7YZv57JB$(yKy*uspy~}lfrG7sef5GC@nSjT9Nxp{GF1Z@ zTj1W?)#ShG1+@Wp$Z`a|@(_1Ggx53jjw9TQBW$Q63aa9LY&u6+;b$;}RiOgShF%l!)SeeNXUSrToSPDZb+~8v(6K_*hN_SwdF?|Lv=?mepRKLji`QWURUt?6A~&6A`n>ONcUKG5 zaH>L%-@kb$wD=Rs*odjoj?_3s=PwoVBuUzE_L^k9| zUVji&c=o6i>QKe12)sa-zRqGUZuO}w3uwjk-V-F)L>^Muh0)y{JOku5AIcys*odjT_apk zt~W26c?y*;RUt?6x{fL~FE3kl<=>9nt2j5YhI~JV{E?NO=3MUuAa+nL=o>x<*EFcX zy}XPBA{%lfua^WBUJ(hOp9od35j2W|9LehyK~*mp0SesR{Jl`c83{x-O*j(9DYF+8*SdLowctv&*6CLg&Zk||DlT2 zMz1?p{e)^MRUt?6`YL(tFMY619qyG*RmhRN;II;{T(;7i457M8RmhRN>`=wZwcUKB za$WBAnyQc^dF7D2;(pmNTd3fBxUeBd@-m=`wK9xswYXPRszQ$BWiNS+Xc6*4sJy8P zIZ`X=o6e3DoG zdt04_>H<|ENAhw+6#{_yo#ah3XSkAxH8mA$e6R<@Q;q$~u!kWJ8YRRT5RK4yPZTG*_saQWbI}uTqj% z^xUE3GIUPWLg_2UQx$R~uQHNX{BJey3e`NSLXPBB7FEy> zVVm3{{NK{t>o=-Gj^tHN@;cxD#vGwKOI65`yvn1B9bd86Cg-cby`EAPawM+`lGi7X z+B1a8p^BPseKVMP&J||%C<=lRvEe17^*^! z3OSNjRjz_so;GMGc@R}j*d^NrszQ$BRgJ6QsQl|pi6%mIgsPAuc~wUhYcDvjT)@4q zQx$R~uNsmUoL36f8>&K%i+g|*@K@SRZkQWbKfa@CQ%4AY_(2vr}dLXPC+f+{vfjmTMMlTZz#D&$CBbtSK( zh9x6}YBp6NNAhw-mA1WR@jBd0RmhRN+$67>A)f1m>KIiaNAjwNDmHH1G~XQm3-`J~ zRmhRN+$FD#r7I2>sy9@H9LdWARZxep1^Op_sm#3`tEnh*Bri|NtHj*q{e`L)RUt?6 zs*fro2?~9qTDQ4DLKQ$&$dSAnNM0-Y#(fp4XsSYv=o6MyO)#RddRUF_pOLI8`A>@@g!3B`-XgL#Q556>=o6CR_!1 zg3l{cxL2;~fRSHk0*>U>l&hdN9z0xkN2sb%6>=o6W~gF)9?qotbFWrZg&fJNx#Z=w z%6p$s#ZeVwja$;+RspuKiat*}L? zx>6N#B(IjJf`tXB)(2KvD^#PY3OSNjE6FQ0`pG?^T1{2Rk-SW(VqUPY8@g+^6Dyi4LuxJU#OZ<6>=o6ZoFL34}Xg~Izgyns0ulf zS9i&4{;Rwlg=!vEAxHA+fhui#CGt8vMpej>yn0GrYh#*>6slKLg&fJN7gs@j!Tc4) zy~@;4>kv7TS8uL@+HmjkVx>?up(^A^UVTu-#*KeFURnJk_v%Ge$dSB4B(L}F6Hf}& zFsee1=o6FjQ&Vs}1)$O;yN|yuu}~ zE@6W{2-SV6LXPAWfhu0+ypklZnOj4F2Ska!@h=3L%hx2Os^l2?l4HKJ*YV4?a-RmhRN2Jv!1d$#@i*DI^JS20+yhci1B~D#hCsgmK3OSP3 zD6WE*fw|J1dsTJ=Oi_>{d5z{O7)86SjOZg&?WhVllGhlnf~ertfO`$2D&$CBW4Q{v zeAX`s7OJIGg&fIi99JIUKX9*-^#CJJYXOer zHIb{pYf+<9SB0uBRUt?6n#5HQ74EmOa4&zVLXPA$nXABSV?@)xger=vkRy3bL6s92 zk!wgGr7Gk|UQ=~m-*KIs0ulf*N>7{LC43{g=#)kAxH9>i7GaKr5)}*FO}EfZ&ZaG$!nJ6b?x!iaYA*H zs*odj&E{TYM+qo4(rpU&x=mHck-X+eUN3)64iqYbhuSxgBYDk56>BexAx-1uOjXE{ zynd3re7g=>D7;!x6>=o6d8lITRW7;m8=>k?RmhRN=1X4JT*sFbsx+!Xj^wp~dqK(J ze$h$14mVO2awM;Xk{8@(E>uUU3OSP3&s+swFsH2JUN@);Ig-~Ru7ckC-InFCLiLWS zkRy35<|^h@k$X9L0;VX)k-V006?nmC975$mRmhRNmU0zDg>ud0UR|jQIg-~ht^%*g zy(ilV)o7|hj^yiglJ*6t-NM74e#nv_h zA68ot!MzGLB=%%Oj^wpn@~Sd*>u8~3U-d_hxqb3OSP3E~#9wW^2s7mQfXQB(L3)7hFFSs-ske9LZ~su3SyH*CVPzj^wph@=Dzt zdRVBOywsXUj^wpZSFWbq%af{*BYEwYz5YqfAyhr63OSNjx>PP0dwsaqD5^q^3AxH8$DS6fRy0Th$g;5o9 zB(GChcul7&OJ062S1uD?=~RUr$?G(#VC;q2Ve{1;uZ8M4RUt?6`a|*>b^gdD zp(@`*twZEUUT07R;~{vhD)XYWPz6yHawM;_l2^i`JiUc#Bvm0t^7<21tRKpKV;xl? zNAfx+c^OOxV}#cYszQ$Bbv_HP{7u!`K#t^fLGoI>^Q7kZYD!hek-RQu;T20&$dSA* zNnU-t3`<417E%>*B(KX^c>PXQ$dSCRNM0ST1+5oeU#JQ>lGjyKvA)r+&b!S*Ri~L+ zhscqHk-Y9pUWd+9 zx-L|H-Y8O#BY8dGUci9$p&zfqB&tG=VUdb($9no!N7D&$CBk5C152-~1l1^X}J zUg_QlD#($%9!p+ddqzGMs=ufTIg-~Cu7bF5Zf@dUU#JQ>lGjtNf|^eyYc`=O=L3<* zv-N=^c|AiFTVwn5+WKQx?$v~n*BSd$oG_V()zJWuhwN zNM7$GudVI!7Zs{7szQ$B^&VAh-1scHFr{} z8$y+%h1$xp^b%#eY9; z4euMBs0ulf7ySN!_&yPQLrtjSsR}ugR}NIM@vv&qz*jEZYbsSCNAfaAUgtb3CJ5Cs zszQ$BWsfR$e05zrW=%QnwVSGtBYEYNyn;L}dxYvwszQ$Bm5ZyO4q@yq%e@{@6>=o6 z++1ZKs_%Z^d0eO*{U8$gjTGQWUJj^&@sKpPa%+EO|H0g=E>$5%^2#H5y?F6)p-^?E zD&$CBc~QmcaP=f(?`ZBdjH-|$dF7M57WA1hUZ@sP6>=mmNA3mX8nt!jrXk$xAXOnp z^2#rH)lA7aEmWVW3OSNj0aURu>R{}SG@;UPZVH z`XPKqFI0`G3OSM&JTFiEPBBD{tg_%p0Qc%nRmhRNib-A_s~x*5RMV*nIg%GVqs?H) z#tkQ9p>D0Y*Dj^tHB@+!8Y%vhm%MODa=yx>>D4R-AK+I6{E!({GNrWKS`QII2f zm6E*bwG8`HsM=5!awMRUt?6swR2O+SNBosAf|YawMh1u{kBGc2uHJ zc~TW}B(FM>SLgoW$AzjFRUt?6azPc0QP89OhR(h%RO6`%Ig%Ir`ja@mw(N2-3)LE` zLXPC+DtR?%JK#s5I!jf^k-Xd_ucBQSpAo9}RD~SLs~)P@xDnER=yjp0&_=C!9u^77y+hzp5>+|dDoVYJk z^Qa0rl2=p7tKZ~`JB4Z=RUt?6f?q`wb7k|#4UP)c9jZc(q}Dug zBrk7Nu|7W`c90@eHK__Yl9!L<^>xt5B%x|cRmhRNd?l~SU&cEKRU%a(NAhYRdv!dZ zsg2oGg&fJt4^?a()#Z}s@X5R%?xHH>NM8PuSNFT+p9s}8szMG{=O>E5n;eQuSW=Q& z%Zkzx<7~8N@3sH)wN>9CM{yAkh*esliiz$Tci$Ac5>$m8gxx3tZ-|g=O(n!7yx)MN z`W~2K!pPo*@r~xC9Z^J>BSTYSl0(8%l9JBT~YXqvPY0*f4WMa!gXlFmqyj z^e}TsXk0`H{-PsGNQendj*L%?Wel!}O^6POj*Cu~07(jrM003FNLX}SXyQ$;pY)VJXSxB%~#p$&U@#N(hfn7z#MDBFst2iSgonbZkO=BFZq?JjB-9 zgp{zD=x`pRUuaUlkns4}1mcY<4umFZ0Fs@Q1d*NsPaf7JN0R19>L=0%nG>TU)l6c% z&@hrQksKZqAE&BgL&GI^c&`z|+ob5IxDeql7*?PrPh6(SmqurWip+&aC-gHXhM429 znJ~W;iZJUS%F^UQ=IRro%yH&KQg0#AgS4@ssbxe{6dF^LWr~PgheAi!<{1HPj<(d+(w!Ywqj38ZjP$-O4nyRr%fTK4& zG$AxRI$7=PR_Rb#S*1tEk;5(|Y$!YIt>kJl8GOu9=0q%(O#%UJB?31ziu^=wteFg7 zFxXhB<5QBew5RErgcqrFY|p|1jLk!AWM9}8 z91)EZIB23te%SC39vT-C5g)=2Ir?55uCU$cEHcU_gbpxcRV9QbB@K>Gj0hov zNOpKxaZ-{<f13kwvhqnFF|tahgLF~~S!*BIE_LsHn`_#xgxXC_MoGW$o1MFNJh(M_b8kdA;-KT-*F)Xba!eTGbKHl%ct zvynn41{*2g%BU?L?Z7@bI>C&COj1m|IvnATio={7mJ%6B`UP2>@w7y9Z2TaV59?^M zIwdPu@OIIU%9N6E}MB8ocfYV{(G55BgO^<7qLtq-hCwHaDVP=jM%R8K5o z;={2U!o-eUTkWX&L_Pt~L0J{jNj(!KO_k2HG~VIyagotcq;bg-i=3B`6P2X+l*Djy zN~5hAT-veKsxE;YthxkwwXI9ed>leQ=qKu`Ri}g`wtCeiidAeTN&2GM7`&`jvvmF& zoEVyrKt>$h@r_MpMS?C02M8Ud@SxFV2@g8xE^r#BOCV(=^NtQyPs4Puje!}%+b9|0 z`W_DFTDCI7&&%`~(wv^zPPCCL9?nM2H1RS?)n}Vct5$V|Fr8bqm4&!E$Le6+T&rW~ z?Gs^m6Q}T61tjVFi8Vtz$V;saaz0?`QZxgKlxE|cN$aRdwmxdZ$*P(Bf?}+C#lWg7 zYl;YihgB+XQ++Rh%PAVMHZPErb^YMA7*Yb{wGk!cN?!yzrRI+7yw-thW@MED7uz7;u+C9WdT?1p27N0S zP6`sq0tg0to`j>59!ZHyG)Ixs0WzS$g*RkbVPyU%C)FXbWQZDq>4Vt90CEEp5MCFA zGDs<8kc1NrG6Sd!h3F(T9kUdzS|x>&d~%{#-m*(%R!OW8%;Dkm!X2*dh&6A%@Z?0& zH^ZXv4AJ&k4~xR7`m-pu)FSH^a=j9YM$e^q0-uPj6Rc0jxPtWto>fvvwRuR(lQkf_ z7(wcZ_CA;{)H=f~z%d3@uAZSG1aA}K$*BQZgT+L}lNkMC)wNcVS-o5fc?XtACUqJc zO?!~dP8TwmgrQ;4g?4oaLnks;C``u1keV~nhj?dD$8SBZnUv%uF_e#p)SgcAi-!Z4 z(ryJ;pP@K7*6>p@ctYxaDmzOniCZMR=%U5vGA*3HE9|p2Y?KdDIQXH~YiRAjcTRn2lA4x_P zdhIffTt^8BgTV!(LEj^}!q(CBJx<4bkmWucX%Kv{Ihq{K$%*8&H>96AhV&r}qvHct zszs}ufhV~#6CF#g!DMxb4Qniflo4&Pu;R2>6pt1GNdmRSOh_64CyB91Bzt7Fg$k>@ zVS+yQ^2v>^a3Yx}krg%RP{|?vajBtpPI^f)nOq8me9-BW43Fw$%b9RVNzI}<#;Y;N z=PxnwQ7P&`szT<3XcY%? zBN3Q}$YvJO_KJop!PQPi4D&&R9_!C-4TJqfd>GuWE0 z&ZD}#FxZ-|o=jN>r>HeqJ?*t7Q&g=-bx2Zc3qPx*Y(1`TD=lB!QYx;=jAp^1EvN)r z(OLP`F3Q$047DP&rjW@DwIbsphqZ>Rkdmxqsx_>(;PYQiokA(B60M}VHUo*i$>{2d zT`|&FSf^+Y0qZoiM0DPeu5ByMs!koBZ0l^NsX7mJlCp}a`q@rXb)H%1Y^Q1Jk7kpd zck3&Kr|3m|sYNc!>xELPUJUCbn>v=Dm#_{eIu*@5OVCU7-HA$Af?lHQO;n-pP`Glo z(Vb*mZ6x)0ms8Yo*h*0~>M?IiV=F~d5|r?U6V)Z-x{O&VG#TS5x{UD@)kTvro?@Lb z-Z9kcsG6RG`Lj+|E!6|ZCP8)1f}loF51}j~WI?bl0`yVax!0uF60z&U)`bQcPqP-P z-5c(Ju$F03Y>P5cNDFVQ5_UXTbruF&M`sg-6`jG>blow9p86vSCkS>ghNiGGu8B@3 z1{)IV6m4&}PE$*v_IK+vZI8E3Q*~;ew@%Y!5_1nr0Bvh%Kn;~fu_jBfhOW7CYHJ)4 z_oVPt>1eW%t`>RP%N;&sxh;}%)H?A6UT2guuRh)ELK^RiE0kjqb5sY7KOGI(Po)tq8hP2 zt^u>OR`Zw*;x{Xi*ksXlX!eklolxvHtIQ7*5s`D%QmZ4j?NS4(-qFDFnq9UUTOHN2 z8#}w~Y*h%{UzV-fKw{=0b+fKjY4r22{?0i~K5Qgvy!oB;7*fcs|39S*8a9X7Su<{f~yJqjoTx&$JsZj-wunn z7izMaNl2CU?QnQ+;=~Yt;z7=3i-T2 z++u27bUi^=COt)0Iz2^KPCZ3eVm-yWIJ&7At581y%eR$k%50UOiJ#ehry6ml6it|{ zZc){Q%95rD$3E$@bw{fvT$VIVIPuXFd>TscjMc=kovsNWK1LEBr)u;zleHbnCPCYs zY!cK6>Z-sdL5+|FL0<&%2~t)ivB}Z|lhzshV`5E>WJ1t{z=_)Wrd~}1+v%DBbUw}^ zL}m<45LoB&Gg|3pUrkoBAZbF;iA%kKRXv?n?_bqK%AAvRAnkHOv&ztVsg%sZ(37C7 zGbEF~5h}|p(MY;HS>0qOjyvtZo&`yhCo2|wXoFowH-~?Ns0j(}ob}B|nx@PKSvvw` zgRUJ9vO(954%wh<$BJyw)#&P#xNOkX=-H;L(Z$t-Y}I1uQ@eo-S^(X&lgqq~Xg z0oe+leLjt^j_TR2dbe!zY5Z)rmD;p!+2+&u*={WwKihm7zv2JZyl&a%)A-r$4>bST z=35Oo{O&rqZ4~cgv>Ie=5Y#M+3x+l*YOb=Rs8K|_W*Q|+il#WQkk#GsE8TplDOxtj zY6jHLIsTR%B&H8RrO?_m=(gd?{Z>lDUtyGOz{X9;- zgH@xpnXHlHeJGSny@L zRhOiZ(HkRl4JP9n0e>lxko5zbI8tv69i$e6~FQFG@|tk{eyE?;+Pz zpRH7lm{)!_?ljj#{hwr6*+CoGIs|nFGEo!Ks+Gx+roXdYlk;rR)fN?NWlf7_75{$_ zWYJHvaD{4H4=^FV0gZp5)~64MjlLnkE4SHDz+AX2oHP2PDn^V zEcsrOZ)lQP`tp(bwWGRj4I9)qip{M-LocuTuC5I{1qOR=uCDd#6Jo>qZVlCxzIh`i zRa7jCHumpPjQmsueMFs0L?Zca;~+D8VjcX#c9Wd!9sQrzi9AHl9F`L0+=->^Av*)C zc;1SWuS+5pkI|Gd`qnL*#aY>^HP}n4!0mtG5dtfXqQrfagbe?KSa`XB7_~6B(Dyc#{Zk#y8@@ z<4-qcGu|n}yZnuKkiWNtQ=kahAse(uX5}qOIL?#@^=GTR)d}uPIQ_E`FPU)0d?Oyz z^Ust+c5%xre`^SD+c)AtdCzAv-V?%mZynF-IEP2X7Kazj=I!L|Z9N{qaal7PJUA>G zWrGLDp(z_YczkDj9gp;9%_BSsMR6bv-_eSvkmH$*p>_TITl#bk3=RzNZB&W8vwUzm)3jZGz9iAAU z6d##vtlqJPu^oB-TWs{O=(s3j3v$C!H2KmiWEA?oW}A3%-;l1IW8Fvlb^OowLatSI zhA~q=<=_0J_5QaTd;;E-DLcb^`Qy&#roMKcGRgk!))%e3N@RG~8k1+?iC%k*2`T9< z@WDG#$mnC~?d)$!sqSwXSvxSzCufl5SU|=@W1!(= zfaQa~<+v&1xiP@-pULvvl<}18JvUhnn=&34eGLAt84q&2yX^Yh&y`0;dEHTdAOqOKlzNYbqj6NYgeSCWR^a?o$57u@gfA&fUd98zcrisUs^X_U- z_8*czCwSM-H2$koqO-~J7v{s1@z~yHCp5araxTzv zMCE1NwI6@KplRaQRfgpP%GCl~7UfcbgC9{9%WH@kd7o zj6Y)B2W1`qHAlg5JO2CnRY!JDe_RW|irNT|i>UQ|P7CfJ$HP}*Ta9(2z_bO<(2fC? zo~{9wq=o^O;obq3yX+Y5eXtryR67;?BsCnZ_KG)o4adFKpu#d#+%b&$!=aw0ITrH9FKTFp(ZPl2Sv!}MHR-7*v=%8W-jd<+MC$exekoS)%fV5*~Y(8R9= zC&2ID`H)F>{2@~H#LaR7{yF)Osh14w4uPq`&O-trFOZ??k&y)}OdxrL;jWjnlRtTR z?{5iq{_Jn@bGEk}2{c>|upIQaTvMmbGnT_-u7xUb@UhrC2U$+2lRKG<36;FQ6f-QD zYRRZhCSg*AB*HOM!3{?O3T}8v{;rq|4}vT&0y3VFiR~}}4*D6$r2f&*@SF1#$cy2D z$&%q?xkxm@qze_?a5Ttr!Jl{(+;9;S{hWt@%w#x20zkUSaFy|$Ooq!u4t}_Y>kHiT zb1q3$CQ`g1s_u*ra>??5taE~$t78EV(((eYB=Cst9C0HV$nYGAYt50^+*yg$Agfono+gTYOW zpzcA0K8P8O?diFrkvxJu*;pmTsNj=&jp6YT=0?UU(Rr1~P;zbXQ+`^fyXtQ zBl40dwsP*sV%19TFTH$9(Kp*acRck&|Kk@fU--S9@BX?Ee)4tyGvC8cqrQGz<+kvA zvz||rf~L$a*1G!Bf?K^GJ@F|LvMKRg((EHu-(GFlWMY81M)2&Z``mw>zwY|^ya#5* zRIHbO<3F$Zl;2!@=;M^HUjDtD1J9kmX`k|O^1<_t=|dcMuPu}I=8EIR)LuOs`8(g+ z7V&iYUydJ|6zKlA%i&`OydG3P*T3Y%{f&2?nOCIk`(nG}^RyqlX?OAOe(acTAk1oqt?RvwdVVCHL`Kk7HU&#{Cpm;};hqt-7 zx=ypR8$*#n@i8v35hP7fR78926}q3n4i*6NroHY8&1tZME3fjVy~YC34R&K_Z$41L zGDL9U=ztA5xMw7o)Fib#8VON^;n2!u!EiicIVoc@=<>#MazLR zBZD0rsgV0FaYYxXY%K>)tkfS+gg9$jEqtu!VQ-ItM6$&2XbPtgCiOCI-LCT zk)D$WIdDY6mD#xgGdk!w;9{_YQ4YM^Mt7{F=fINFUbK62mlpO@GwMi2Kqa?g#M)Do*6@~Wxj51n-@|g3aae=r$y?@S}>PF5H}dXVT1Nk5g2!2gLXs2y&=9=dkrED zU@n6VdJ7^~ReF(sM*K`Jo7$GRRNLz@u-I z$S2^T;pE|;(eYs+ktuQE@QFCm$bu`D{3_9)NIJ#vT#$!*lBey1@PB-er>>l|Ug!-w znI_Y_1a#@_$zJLm3z;ToCa1NWnLA6)Ob(5anHJMB6N(1QOs-+jAhZprfW2dhtUs}q zVKi&Jc?f(SMH;;m>E`4P2=C@@&6{V{IlR5SyuHLxfIoRd6fL|%Tz&n$Tlu&4Z4uDA zt#@~hnpw8{{!yw_i5dhX5K15* zn?`nF1Cj0v7+NSwiI4~uG#H}9HTKtnqSy-->;V*mAjJwcu%n`a!54g0ijDvCoIA5q zb~fbw-rx88zW;@poW1us=iGbewz)IsOdEO2V>AY8-nBAV?=<+E_Zd%GMkdB-E^m2M zBl&&bO;YmP%+yr<_Sz%9|SEV|p%eXd3B1Lk=r&gJch9l(6y#5wZE`R)&3n($T# zA*$C!UT0u>J8=$qEbmAiBLZ=XSKjf!&8UOC@;b_^1n#cm$YcGz49r_joJ)E40rQ&^ z=O{1h?*!Z;cH(U!LT&Yz0Zg6~=a9$xyGX}~K%C;$-vZ#Sa>}#J^W?9>vBDwmzj&+Q zd5A0dUwNy*n5#>QXU+caUoF5EWip>7rX1t4T*Lls3U)qw1vh*xJET=Z&%Y+^<2UB? z3Lf4U-0*voplrkr3VL71&V8~xlO-RX^o&$bzCR5{b_64D?WM5PZROQLfA(A4J;t+) z@f+DDcvpibhGqK`g5~cQw+dDaz_Vg*l1ASA<%wWqKoXz{8=0*z*zgSaWa3)O(+(>T z4?p?;nU&cI;=l}-t!?9=hft8q!mV92#&ObtpdW%dxfI=RVBMiRDiEv4j8Zv=J2 zLoJG8InKeMbLeYi-b5Qg-RzJ2W}+b!f8FE;5RXzesHZjPSucfP>lIQrXVju7mSZpuZ*;@-jfcJfgknOj=4Rn zCXadit^r$K?l<$Zk!3?CjOkf$^o%S1+_9$lvmI{!$45D*Uj9X!p7+lGGx*6Fmxul= zDED9Z>qj-$4(T>_OxnB&Bd$K{hA-!Ti%d)S-`wD=)^(bHteb@#+PxmOLM|S9Rp0hq z?4}xP-s|BNA!gF|9kAm-$||S6U=nd=cz##Wo3R+qI$jU^2)RoW(y*Q)CHGPIt3o1f z>=>w(!Q7nVjj9R;rnCOrs~Iu<^cZtuh;PJF8$Et z+Ng60#->YcAF5i?wEb-sy<&2Gr*rAshn8}w?L(CZyr}$h+eb{UhWdP>Zy#Egimh$s zdZ^2vOHHoMI+tK<KTxuq@ zZuZFh=&3?J?ST&mjIDu~Z@?GKn1lB-3;XmcFn4G0$rZ*$nc{vQKANC}6wJqMCS0Br zycAzbnKKGvG8PQRgFRAFx5{yI+ zm?QtuXa_u6Z+Zb^c2SHaaWq}!*(_B&3AG`d<&G!AEO#s-UO}P_z)=HH2~j}f?mhbT z>iZw;JEZmOrK7p;P+#^PenaQx(8J)i@9?=wGS4pi4zD1!i9SdeK(~Dd4w+jVIJbQQ z;`q{)H3-gepOy^3I}Y4`ai8`y#QpEQ{jE33|Na(DORe7cI&Y-agZ+Qh+z}o!uk`bw zTatcxcKe&ZzVz1q{Xeh1ve>A||IKwF8-+bs*K@qYUJuUp}x_PG*-| z6owqe>djo48TS@y9cCTP)!LDb#U6U&r!o3Pdlw#4TEC@f3?IdK|9#rLg>yCZxwMr3 zpwIQ_o0_Wj2HEFA(&rAHscDDxytwtbE4aq7hB$q0l>_J2=Xgss1M}bgoC6WqUEKQI zP{gkS=Fo9)GHGI6G)EsaIOV#@;~T((ure6UwFUy0Qf{~$;C2Gjp6dhzE(+any)gCC z>gEM1M4(tV+zW`m05f_k&fy4La=YQ4hu&epczDl;z(t!Ij!)Vvff>SwaR~9`eTlSd zfSIPZLpC~*XIUzdgSW+`Gq-$M&+H7(U8HsI9!G0&}(#=g1%B1%a91 z#JQCBGGMN8;vDkWULFGG1t-o$-uu9O>BPCn`xBU^i4crXTY1k;)U-Z07@|0bJeGG< zA`xbYH@?hF)U;w847JI-B~c*JQ#^T(0Qa1ZjVF)Ydpj`ubzE)Z-yvY?bp!)KJbAn! zOw=&~#3^3>l7Z`02YDmvDDNM@O+Su2mUk&ID|MWwmi#>d%u6~hUU@lxdoels(Jb7%-i8@ArIK`{K6yOFNM;_bXKY*F*#JTj3>w&q`iF0YsF9GwW6Xzmt zFEGD4aSnMbZ>vtQVV@gb#f9;mf)tB(^Xm>a9oazt^+O+xS~4XI3?WVhI8B#2J2z1 z;lTYD_k>SD?Y#e$XLlDZ#8+zz{|9af`2a1=-@+qifd0-fS=@_4Xk~lr6`xSH*HhfQ z?1-nhQEGJrz)fkehR9Az)@knWvBAhgxHvMJQ${1o@WEuPzG6=(JKCtYY1z?c#SQTw zj$*4gFbQP}4UDE0EDZnF!0_)N(=Dc$Ic;Ex8IBxKdqob{VTv92``)sGj$$U_@m*98qPYm5!?Mnv-BdsdI_;n)+3xn~xm} zNAyM!$!lX6BEpW9%_@U-H=Kxm#o^O(aPBD7_$W0WRI0@Bd5NO#h^9UUs)wYq*(u&e zXbg!G*9lZtp;AF{VDf3BL7gSk<)D&Jx`5t1SRY0d+j9%u^fOo~ciuI9&BS^o|@@VUl7TB<+{yJV|DPYu;ki}ukU&}lFxRKTuxb)x3abK`Xq+=+6Vi${<;QQRR2(53V@DngpF?YvYv)kP5~zpekUOrtG!5oF{b2{X-CO_Cpr@%IhQQMZ%IT{ zc4W7Z$R9hkGV!ep9zML`56r}ot;Ic2zP*?wRKfMB3lVu3iE<8Fv%mo)JoR8rYjB{6 zjaGueQJe#d{zzUhuY6lcTP9{i-nOQXVj`sNrqpbhFegK-IWAzL=&6b(7N$E517*aw zGm4CMX(=)$7F3Zcs9~>Zy(nuq!pI9q(d#75){03(X*%NYX?anq5R|hGa`NacxX*A_ z!}(!Q$r9HZmqkfAElPC-rKX3$pw1E81)%uSflpfmN=+Geg6bx5T(F!i6qhtg$B&?t z4t98p4LB`K(U4&GeRS=a3DH?XUB6&t7iWovGE3A<%cvrPBf(6FM-zm}sWB-WLH+jQ zNHLTC3OIP{GeNk^7TTyLV;~o9%ub16tSc;@86q$|SMPh#j@9YpBT%rBIah=Cd7wJs z@QL~TmqM{6eJ#|DIICgzE>OJp;cI1M#ivS29@YE~Cmwqdj~>F#*F-KW3~>v_W4<^+ zb*LbQzQxUrOROhWX2P&{HpaoqS)O2pHyn9mGizX{k#qJOnm`5b)O!?$V6U2MnRJRI zNweDv7O+b$n55}k_bX{uuJ4#pRNgo)#HJn$dVdqHFsqr1u~GU;3)iSk7%$z;gb0qi ziPl`*4I%6vlb8r0k+(2I=-L-u5uCa=WA#dC)ZO_J~Ky)@=!drWcR*d zBpO|PQ3|>j`xR9fo=DItPG*%zk7JcY(e=EW!{WvTr*T|?}T}ssUdK zDjA1QyqEN z2a~0ZTu{ug1Y;SdceLoDA5*tnE3R{{m&{mJx6Caq!1=V|R~$a+6&-~t!Z}eWE^yQW z^&U`af%-J4ev-;@LOc^Cvit`TXD|P5#HjNB9J7=_Ka)r9Pwl;4$2*b25$s6*~5^i%f_Q7D@Q!p zii2{e9Y^*kQ+9EC$%(-cPqyM9suON|jNq1Ut_anuqSl<)>rL^o)|Fh!>~b8rlcI91 zbrDalstd~OdmOpbqjIg+FP>a={U~$vapca9$^{{9gMZ`6%|x14WEw9&5$#sLyg|k* zvv{%4e@nu_2D^PlM(<#~7-0Yi)e{uO>$*tdRBL5BH`_N;6^_?LQA8*X%C){l;wGCt z*=VgTrL`Iy@nkCwqW-kBRyWy8m28}?IblsIv|WReOPMV!SIA8+S23!kf{6C@cyd); zP$r*v8^KNPO-RHQYMr39hS!bO@Ve0&UN>6LSKc;WFj(<-pdhJHQ7p;r66YD3pbhQS zRBJY>nbvH6qumXQ8cafh#;5m2I2VMv#)=~MJrZ~F=?%3Oz0S~DVDvP3HElOiTjO9$ zSEDDN@*820#4wl#fg%oD9TzZah~A~wBe%~YmG)=E-F$ls#hb$2;2}-oQfi6wZw^;!n7u! zRSf?!RpHp%6vbRsjU%3H#X-5;@-l*(?6;L{oU3sdIbo|% zXuAd_mogtdj@wWf_2nUR=3A~YsrRF0FGVrxm(Wyj}@BUbU{WYwnDHPv{j?EQKx+TT8_ z{cjVOe_DM0=Wpka{PpGECl7mJ+n&Vfcb&el?D?mkKBeQ*?mM@7)7x*m`PaYG z*SB9;Q&F1U;gzk2KU?={VY|V19{Fti7Y|PQ>VmJ^ojK#B724DRkq&#;Jh8w(XII}Z z_q_kMcjpOxue){2jycynvcG0d=bUfe3qCR9^-Ul2+_QARF=lBcH-Lp6HgfUa^ct~4)y)z;e7)~^<4e>vdd9T_~SRfe&_G>_OHA;?fF+OE1Bgzb;UKy-zj?NjhlD8 zTRQ3MH4C=Q4E9`6aj@GhB@2C5Hohpg<+6phG)THQGx3^w2fA(j=&{ISTMMs0@0^d% z?f&4u8nyZN=Oc{Yp1Bv@(P{aQz5(It+xtvk)#3Bg?n`a*+z0Rc^~~R2mJa;k`kBw3 z?0cyHO>^cx-u~;p*OcDyTI68qKbv-cvc)rJeA#0AvvYquA@@h$)Qp9%b?CePucuDG zdgI!E{Lpbt`^j6&zpMA^_Pr-899uK3?a#YY|GeqWsS_Ul^Yr>d$E|BIYt5!@tG%!M zp19ffY5UM^f2}{gWKQEf%U}5`^34rb)-QSggQ~GJzQ5zecc1w6i~P6xA8TKJ>EEwb z9lpEupEobxlN2sW>$rc7(VGJQ-+J4z*uHWu@_IP4u(SU-{8enQaFVsYn8=aB>)~8N zO!uEYZV-#9FBq<%c(+lWxcW?mw#oq;uWYxy0+?+{jw!|M|lYD9lv#y->t4B%)qxH@i_7Vmt68fm{rn7gaD~MjH_#nLp;m z#FXhV^`jWBQW#9XIaMkGo?;BiAL=ot8PHF9Ov5O~n4Qc#xA*9vD29)MR4^nDiHW%+ zCZ;kb=Bb#Nw_;-U#l$pI6^FSj5eGxE9^;F~oU6x}r5GC%W8M`QrMO1NnBITx(qo!L zB|oLd(5sQs{%VZmcWp7T9)jTgrytj93~X6q0@WjhODF{P0*T=*y9Bm*iRqcD$FR*x zOfQ`Yo|qV8_5Q=YXnL+mUHH^a)AZzfJ%@s^8ON~4n1(o8gUMq|u7;|>(yQQ6#qxHD zU%0rY6v&_doMv*JrE>|!ri&{yQ&*Gg*4$-sg>){#*mQAhFpYk$E8W@L$yKRy3C5<2n|P+KXFk7qm&x^v&LtR|E~$s8Ax_|f??#(kJ9I8pSJpb@ z_-g8UGwZ5}b9E`Pq#*yK8q13ZFYY~^Z$Skw6I$$ro6H@W)iT!OLb zYAakaDuUYmRlsL*ov(8V#-{6Jo35!7pB-#+U9NKp#-^*CP1j|W<2svMD|9Zw*mRv@ z)Ahroe(;ijUpKjK*0}^@)5XUFYTN*!JwAEWLDT=&OFEZeY`V_2 z>6*Cfl@TV_r#hElY`VJGbgfu^>j|d$>0dgRU~Ia&+H|!|eXzaBbt)$=1i{#JbwjN3 z^5y|`&utAZX(+QL(dX)1g0bm3N4ShOKX6OqEhg6mI+tKaxHRw%U+pTj6 z#-@ww1+xyn?ECtKrVq8hbS}ZzboH|7I%nD)CzxDq^-2N>;`q<&_4h5~_n5x? z(EKF`#->a5g`#uiB^!UqGr5N8T!OLbl3fcA`xnDE8wb2#`Y4>Ga|y<#i)$tGdiBkH zx9{s} za=oc@3C5;tfKAul>^7rKu5WcN!Ps;S6fR?o>e_c&LzC-Iol7t_UFX_#EvsZ&W78$OpK`spkooMXpDlHGj?SfaNUdLS3IJ=?VcO=8zA|;?>Rf`c`RU6LF0Kt2 zUOeN}ahiUwrD>CNE@JGy^D+@*`jl)w|C=97uH`xxF?Oyj;p&JpLy7P9yG^d0Iu|i^ zu5843J)Ex@9_zWQ#N=wrn^y#4>|8mB@p`zTU^su~ow%g+)DP`^or@Sd*I>kWJzVoJ zH2(XxNha4FIu|i^u3W@;J&8Co{MK&eHk0cEor@SdR}e8?>@%xyxaM$$$#o)cxDkj^ zxgM>@Fcxww?>2`Jm@9h*~!qR?tR5;nbpnqIvN8S|D#97fity zx949P706_jz>oLg6L8U#qKgXnA@t%)i!8?N7g@k?f@lRRDMckyD5$oyqQW_`d}MM> zPy(Y2lNZeGq32k1IqUX(;<`!*!=6=?+!nwt>rq6G>6y`Aj06wIGK zHLX{Vl&DZtuF(QYrcbwAy7~C$CXhVLdocTTp6_?l#D*dl~Ef)$>@7r8MPst?ih?qYZn1n#}l9m zbeufIcwuoFcVlzFdDA*FC&lK$GD64lTN8EG=pbSazdD~=iW`$YK)Z1nNiJ+0!(CV; z+GxMl99Z!9sJhX`kZB7CzJ=~gP_5i0!Dx?hIPh(3rzpjN4;woZl#bX0!{hAGKqzBa zZcZ>17}U@BhbOl1RVz<|2ld9IU?U!X`$QekX66NkgmQ=F56!f)%2V0nGiPN6GKXgl z&dbaQTJ-A7cvuVx>VdFBzo|VxFg!bJcy8u!s{qM(E$r6p4-4dlva<(gg)(Au;I7=t z9S(#BXJ!u0&dIfKt9o<>BaoFpcyKsls5R?)*>keu72P5sb9f+_n~|3_Gz_=G z_N!Jqf2@n&#@&0S^yryrhU5A8?b)M8PkhiBfqp--#qYjvzk?zACARc+#&Bp@>U2wSJ_{Mn%+xn+) zyB&cWC2qJ?h@T8hQ*N*$K)fq%817_x0dqAsM-aH%?Ite|@mC;m8vzKsS9Zf?LEaC* zoXt&X1Qf{?_Z4tY0u#}1HBls2oDYgZiLeIg1OP%j+$E6LBndu<&r~>6xvRVnQGW-3 z*_fu}iJZGcca4^J^$Gwp*I!1sv z#miqhaJk2kmjM34I?9^^+@;5n$L4fL9pya(+`8k)`az->5=JeKz>V19ApT=Lfv4;eb} zK?6d(^0K|812fc#bCEX-m=Y(>QC{ZnRvkmV4DrhQC~(i$LEa8vzH{PS^5@0l5kDW1 zAk>Uk4n^dsQ89Ebl#az;W5Kt`0cvMt@ib9NW=>7+gxg z`c)o4#NXGyV{n0hbx)bNM66%_cHsW+@Rw0EdH#a`8GjkDp;KR{R-ep;X?+M*^vd3S zFDoes3qzW`R%x%(sJ@u?URTi83m+=KU?aZTPFrikk}LK7j4D(rm~<0Lnd#{ zuHKSOOoUzb#0$pr>#VONt;TPd9B&U-OydW8i<63^&cczx{9%>7&dn&j@)+EZTzSl2 zo(q*h*m;LxLoIF$D&=uA8Iz6r6+tkC6&X-_o_QUEk?n^4W&~!n{&IfK&EEoFna`_+ zO?kDjz(y6GRgTrbsC@BOSVObXz$SdVB<{Nd90N=DDK$bTK zSvp9|tL)X+Uw(&_>_5wI#u_$W(H4_m8ZQSUIg`W=G;f^B-RSM&GC<|;FnIO+T@E>V z{$`O>`MVG#GnaZSBkjs#C6isMlizc&R;PU5LByjvPpegb&1Je8FVs*$ag&VoRJ@O^ z??2L&9XSYfa1D?%DKGMlDk_{WsM4ad=Zs^q;T2_?eyw>)ixZ3s%myWSj%?Y-_dfM} zT?8^5nKLO5Us|6NitIESM>w*ZV@zY|efzS26Fc3HLy@=ji;*)9F|?5nMLrC}WEq)w zOY(rsC#7B*v*VvS_$&s#ic#dLBis#syN0VgSr}FWX1UF+VUW?oslm?gpsvkzriYfyQT$( zv8GiTibc;8_!EwxOVhUu`#7zViyZxb1mg2>__Ql<{zRx{IDanG?Klq;>LHv{g?a|( zK0iM+qKq+2)yh0l-aWo685sI50{}SpvPzrZ7s4)_E6R6%o@s-`-LTv!0hTgA1jg>eK z8H%GVC^htU2Bmm=fa)cYIvO%FJ5BDEuGy}fu|2;cdx7+pX=E8gwFEjb*9v|#x$ zbSJikeM?Y{8Ed%Af!~P(=$i%7InW64YA9xfeUkv7kBw@9FGy+YvXlsxEpFHd9!3xeet&Sy+1CWG zIo!-sKbW3Sa`BpGi0>avD4D@5&{+fI2P7NNuRG^SGuAUmOExlLs4n&o)ZRaKY>f;Z z*&Av)0dN&62gA}r_}0QOd6+U4JnH^M)oTzQn|3i{OE#^#txG@Z3AP%2)C8LD8 zGa9!JRF1@XP^ae!bp@z=p;m!X?NN7qfn^-MUgX2uLkJEo;M7GK*^5I3jG9M{t8ihk z{Ie4H#afzF3Q6*@b+eu)Bqi3IZj39m!6ybDiufUS<65AE^k)&EGZm}^;k5+T`pWl< za-N}&zVz5bXGIu!=!Yr4K)&5R1Ok21<;DrM4CgeV{)w~dfB~*&bWb&lZ0i`mTE~=a zS_D5=`VwX(_;4A;t;=Je%~i~>%A|8S*Ito?wn8se$DagunG>!|g8uSbC>~1@8T8>2 zCrv7n)71&oD!-~q*^i2;!LrQ397@MfIwrDt-$($|6tNXc9<_p{MtL2W; z5HqDJRhUxQ$2fywYA?B1N>_6Ee_pbZZt&c*OD^8%-NA~yw4iqfGOHI4xsK=xH}1nr zOoqbZmeB%bphQdbx|dq8OpBa3fB2jC3(-{{Dr}5i_+UjzT5JVieUT=UoVs<8@+TQ> zvFzBr{&IYb9J3nMttDw#21GMUH#fZSoaSr82tr+KDg}NGN zHF?|zN)5zMfl^b(>!8$-ydxUNvZ{fd9h05dr||dO7Uib;#lm{_)YQOg_;0L zX}c2C0Ew#rr8pjlQnXc4aj$|>x!M6r<%KpddJZs=={W$UazKlGCE57+*z5XO0QX6w zFv{xpPPiav(634WbsUT!K`tVx00)q;9)bGCt={;J+`Leoms3eU$$AFPs>`z5v>k0a zm@3MP9Lz~QhH0QGyJB&gntwp8hG!AcgTB#5rXS;~K}!)mMorx4A6w1o=q3mc!uuhI z#BgOEI!9lKs}6cgs_2~SWAw#?=rI14IlB#sT`KP^edE|MI1Mbn4s}HB7B?eMIlaDy z^nLS?h}kI(O{iLU%Z|KX(hf1JqcNzRW?OR7P?uWG%bY9MNgt=FQ`zD)PsxMmu4PB? zc{BhUg!?VtTYU36>fYCqvLpVWH?ImV!-^YME$1Z68^?&zxxj*@E{6;*p3p}yd+0^* zmw!NHP8!FBe7GW^(=FQ#Qi(5&1!XV-S1OysT`<_|-DMY~!Ua;_eXO^#>e*#Snl4OO zQbPv^H5aa9v1=|atNt5uFKH-cshJWPy}B~<@ZkAaQL*9I1dtv(_yAi@8HZn?bGN-P4x}-HPtuh_(t`O#h_H*coWn};rIsBV4*Zz z*`QFTfKok&^N#Y5mJ*I+vo0GL-_w^Y@(uK0a0Fetr~#-$C?s9+ge$XfOSTjJL?lNAZe@Dq z&;*GHR%9&-_FJ6dFQ*Hn_<5ymo@-vY9*l~f0~97QbgZFmF`k=6!1kN$pvHG&Gi)*(ScC3vdR4qO5NySJ`3VMJS+F4>akSpgMMRdg)Q~lLQ#o7&- z9hrtqqw1sgR*MFfKFbB>bD|+9#s5-^(jV)U{_gQ#%V{E7ds5b8)!}qxp6gO(8i{Ek zw1i`?>(x>+k6A->5MqL5Kh`tiu?QYIPWH2mm>g9{Su=xr9ihn>X{~{tDL;Z0Wu;Jt z8@_hZ0&7mFT8_;*-2RoqsT)?F?4n$oC37lF#K#o^Ot;;g#b4N>YVPyrl1 z@%u=uPiu|qp>X}96c;gFB=yp0+%3^KHX_CGLzLovL=WLO2Na(X`ZV6NDJk3^IZNWW zX`-k*Km{c3Ay6tW;=phemWBH54~ID{@ZhCz^m}=cqv%6$TXr<{5LN~iB{Nh*u0YjS z=BWV^{k65~uS+(O7jw-7dMBiV-Cg(%0bgM&U?&;E-jeq)9vU@&e!r5hFp!s`j`vML zhA=^4Lh`5LoO6KVW<}0vWW!XXwl|@xdwtFZ{_>u{N1GrvCpZE`Glc1gvp{oTF!|ud zB=3OeG^QiwUd5>CXa;~<&1z0ZYX0~Tm0Y%XhNt8n-0(!FqhP<1HpSOf$#nD_5Ewmn zdKNUUTFC<3kBCU#4C97RH7Ksv=)6_dYex3`h7ny|><{$C97^9@g3Ox5EIHTAC{WDk59TeP6s0}OAl)s0UJ0#^0q$3SJ^@M)YFRVvGoDREqO zs>yO3YF$m1vq7oJ@_JBevV0hn+M{?Gl$s8|1*N7{`ktgxC;%E$#l-EzV#5N1cyzO(Z`tBxPjMT=`=#_>jD@;@Xs6uHyH<;) zC_{`!W93pJx5DE%&F5pt*p9Z*N6k4K{Yzg&rZU#7R9SP#_Lp@O=28|*hR zrFe11n)^ZX%GfKb1ebH-c8O=*%lai+{{eId6f_S7eKVN;R&hf$OAQHj`4n1kBWHBC z<}%wBw^19JXJcMF6S*pGC>Nln9m*5Pi@eSJaeD<*qLE3?apSnPBKHWG>++3@ZC+=# zbk#a%fl_^DWi;;3D8+eA;dn!)+Wq68RC|6Wn#!9mwIpqYmK_8?Zt$Y5ox3q@;p!c` zbWbKt!or#xb>JxL*Fd~he^PR4u=1bP;L;1P#@#9n6ZgKW0Hn`FHO`4AOk+*L4S9cg z8v)=}2v2UfiW3=f!c)3_DgLGJK`^euZi$PuF-c*6mZ{vl@0W9@zx;OfYZ88~^p`Ia z&e40RKUvr@?Z98j(*04bGmQbEy8O3&A!Vjl+L<`KCX#*GTw&vw=__UZ5^;{vP@xK7E!;ghy- zj!@j4<^H)(oN=f)j>)`<@oCF&P7&%>oO=qj1?R3pai?8THBpM~P{lQeT16#BsT5Gj z!aFcZjRmE2a4X?VNnIADxFS<=_e7~jKy??~E1=Za?K!WhcHW-mT6mLR%PKxeJL%s| z4>sPOFsWfmgM2_Wz9MOa^Fb&VT#8D-@5vJ9$!elyLCU$CPSko9x7M0{)8L?Qk~gKE z$iO-c{lf_V5Dtn}6s63NIB~c)t(oSBQ#SuC$~oC8q!?j52&G?92I8Q-itzg;-+Sp#Lw3f(m%l8`}OxUf;%qI&*m?&sUP!uIxDsi6N1TD8$ z1Fc1Ig4SXhoWb>Mx*G}d@+to^T!2I6SW)D@O5!|u30mGB_)jl}3$+nuUGWu7Bd~ob zZbgy1T;e=!8)|KP_1D^ZdeQmZB$aR63mUBWJ5rF$xuVD&kvMTrSlkb^$-z{GYZ|3m zfKnWk%hkRS++^R3MAP}0krTUqQ-hLAnOwpe!A+BTNr&vL8np zWS^9vowTPhT4ob10j<=jr!`QDyKR(e4@#ARI{0d?5#01VgG4w`g#GKJJ*VJ4uayQz zm(`}DOKd+{uFGga^I9s3<>WdCITgpO%!SFpRE1*=D~k1`I4JigOYT&zOPTKVo_OxnEg2_LRH{b={y8y5s0-~03Ufc z_@i?-uX}#|y)X6%c^{a!YS!fM{Dmtzyp@u5d80|CCzYQ!C42g< zW9~m~cK??SzPPcoXM5v8LvGB!>|c+*bjR?dyowK}H(hmu_Q8xBj~yNPNkQ_0E4R-o zUiPGaVDF|o&yW0caf9y<3>kRF8O`SxdEWTuj4KX}egVBwLg4>r{sFsSIPoKA=MTE( zxmf>q9FDvmE(yDU`f);MJP+ddW3|7jFBlF>4M{D$tWPYafnZkQOo@p<@2rZ&2)Bm| z$CH71=*@P2#bP+@dOe)7Iqtu5#zM@L&iphI43~7xKt;wZ$&AG`77UkO5TO11Q0Gfx zF--)+35J+E9(=NSEQW)>*CSRjpeAg)?aEjTbK&)H(Q^{0%W|)ut1z&V$A3ggNW|h| zYK&JwCb7m;AZGg1+4B|@+G6Gv!TR3_f|*}9d72TSNz8)6!i(%N#f7tH+hXu7=qV+} zDo(hV+`)$7k8@&Tcyp`*buo-oKXEo8;prGg=c3k7@3`$j}m^1hfD zX(SSB$T`(xfQ*>lF)_w6#4H70WKzN4nimsO8WVGy9z*Yhs(!f5z|b%n^M)Q{dS?7m zk4cDP{?=m}MPp7@;vmV8d`?V^d2?f6rp90v#l%#`#BgI?1w+odm>6#T*)fM>Vp>F( zY=#`eKcHEPj2O%`J;oa?>7_B48)IS~i-}ni6Jz+}GqrycgZVusrlsC3O)rq0^_XVJ zp@R3*W12=|hU+m+qA~OJnEDbE>nRdL1f6?WY8AdCqn;wkEM6dcr|Afeq7nmt7bZtyy;*Vx~9XcrvItC^->7N<}HYGi^YS_ zMSHuNTva-kU~JxkxRf?^Ep7T;g6YHSL!C=7HeD@kx(;nvw#wu>qH_txrmK~3Q5wU{ zc{f~b`X)PtlN*9yY`QonnC1HPkFyS&Tmy72!Ps>1HqP|?_26Tl{A&7lo1k+E#-{5; zo2~&n?|jbWTB>si#-@w2jq?5pLQBqn?-kR(+bW$)Fg9InY`V_+urkHudRONXj7=AB z2Tc!jt0q3w)%1gQQ0EeiO&8~RvkqS=+%waL?Yc(bU_wV67XU~IZLXPV_2@c7b`Os-O$ zOE5NFr$%+L?|Hj_a-Yd{ht4G!o37Jrx_$^YeBb0+t#b*+rYljnR1d-zsH2L^;x(qOTXinM*mNZeS0c|iu4~-tMU(3}ol7t_U7dx?DA%gtpZ;NT?a;Xd zW7EaQ_2#(I{K)5ZG(v(5kZ*_&fbu2VSSAPB~$t1Dv7>vi&L4RcJc z9Gy!rHeKC>%P7~bk5ikPTo>zHg0bo1y4Cd7dUB5y2TZONI+tK-}- z_Ul}Nv3c?1a>eu|_xTsuBQ$;WjF_r{a}i_b z;_Auttat6-CvGyi?$x=7v2$@l-Spx&XZeA!$@RI;MU0)Rzi@GeVp!7WVT-Qzyy-+B z#?Ft>yc7(3TM#CSa%yBHef_58}@ zdRONn#?EyvV$3?6b?-6U3mY}xm<rb7F7&})MVpN+4 zp?!YgOIYL@T+O&8fItkmEPfBO5rfui011-N6C8#Y!?=DA=M>E8jWtKe-zpWkw30pAhGSk-~BeQV9H zpKq>3J)@ORMqAcRbWF5DyJg2@nmrF2AVxL7`_Zhq)90aX=FN%m;W*2h86a)y@Eg@v zV!9(lgqtHsG0rW3n=PwO6$#f`vu90pPXojBS+mV*hIA*Bd-{TsDZ0xpqm1I3QL^TA z`N+r^Z;g5*P>vc4=9XY9C`OX?qDIBLd2U3u-J;>>%FUCbigvhgG@L*dT{Lw;kDdiZ zQwnV&p`mcuvQWGls3yKP-(p~2?#+NK8L~S9n zljkhp?`XDBe^Yyi^D$d2C8rgX%q^Tdb^fJA#f8(H9!pID3Tg+sICP6L81B-Hwq@1p z=1xvAqArat6YCEy782`FE~;NHVLTZ|?~7XiGat3eal+!|$LzH6a%4fo3NhPcEW0Jm z^jqiJK6GAO2=`=@-PVjuHhZ*kFqc9HbM^%B=K=SkF$oq&d2SryD9@f?W+{4I&6aFt z%q`K9J-1{_Cf$-1w>aW+OIF-*lNEPg)d%aygER zb*-pc}{NpKutJUiVxXRbOWg!)xR4 zz|djg{LH)|G42Oz@qQT4boQ)_Kz`2f+)!>P&*DGuKk>deERdZM9-fyoc(_FX9;XlL z9p3?ARDEWCVA#;iA$dcxvMk)kb%1E{4-E{-3FiibIo9lpc6Y~(CTCtCXISp=Az4;N zUGZ^PvvLB1bA|?Uvod3gY`mi2bln)$o0S^~hq80BhU5%(DX}Yils9u&AT$)JbHY|f zl~P)Dt=;@|n%wz;+>HF}p+oXqid+}|A@C0x$_wWW&bH)S)phNP!-2v18TmQG2D>PB z^(`9BbI&2!`MH7lQ=$=hflzn|a$vjO`eh4f@L<`iSE3n?=fSc^FZ>fYJy@oR2g`J9 zX5xlff}01+5A~fK9Rlb2Ewpo{6;3Icku=hXs{-NG_c)9=HxHH%c;Gn+xQY7xHE$8! zJU@Pm_^*I@UBC0>2C5s5{C@+}M8DUBcvsw7+-sf)%zJzYgFvxv^0@z*i;bVz-26d^ zCy%&GfVulPxJf>I-4vMmd~ktq5)L=LZIQpPfjP>D4hXCs!8tsiB_e(XA2C=$JkMv> z0(Yy9^#U(Ahdf@|XX_|$4RCMNLEg7@lve}X;X24W(bxdd%N(z~9f0esW8;-K5i)Xt znc>9AY@{o|AGVKjU~YEe9QDV`{|qp%IdLxXz5r&Q6X%e}>S$!M@h zm6!Po)luI0z!e@x9`jcQ%-v3$OL^A-^M(`WC@-G^ehbWDC(cFQiFk0;5eGxO@>1R) zU`9G|F7hr0X0a3J$RF$PZeUh9aW3+<0rQa)=OXVHV7z>sh7c`>i@c7&baUby@)99q zC@>c}aW3*Ifcd8r=a9$b=W%+^iF1+n6EH`eIEOseUmHFIw1jx=`7Gd4b!@a=9P)U5 z&jY5=iF3(c88A0GaW3+n0%n5~=OXVbU}~H=hdh?I(W!Wzi-RFr4i|ZSfyr{>T;xp# z=3*z#Mc$3T-0j3U644tXr^$$0SE83#jc<;?|Vq!Z`xbjimF z7wZ@ih?97TwCo-;z8Vwr>OW!hg2MR=CU7@(LSD&&SyLzE z<&4P9nJ{!{{@7s?!o$Xm%pO`WYWRo|Im1Rxm_2LCglUtDC*uZa?%cxJ6Q&jwO_)+L zYxcAWc~c6fjS7!EXWFd!6GjxyE}Xoea02h=`kpgy%7u9LF`%V31y7~%-d$Ji?h3wt zr~c;6nmT{pf_c-66O%`DP8?oTJZsLZ%kZU{#H@MPteg$^{4ni=Lz^*UVRTrwKTx)2 zJ60Jmf;;MOarI18jChuTiT}_3mhga6aza(<6EvHi0IykPn*tdH1s7}#R$i9|F zwAHi$4@UM9*rBQvz+eOz<;}#FtFl*;N|_^w@h>d{AzJ+}RR`0LDE~*{$QBy=Mc$E= zb<`SMvUwNEUkn4*dsi#wU}Sxj!40<`lV}{30^>ut-g|>pmux!2p)G51(_rMKYA^(0 zg0;pF4&&ZY;+F+};;2-wf#T~7fRuS(3Qf6KimK8_K^YYsg1AH+KC!RqDAWR+y9rf} zGe=IJc0bM>Q+(RfICJ&q)AmKsOi(r0;O<+L9ylgv`L`Yp?z8jDE3sJwj>%C zEZ^o|`UxUOqmjV4a9=PIY9W!YA(CFV;76bmY}L z>$8Qt$g0jsJ%pMnhMTAh^5Jx;_$2>n*+`_fmGQa|c*{5tuDArr$BNUZ>*N#=ZMn1V!6)*r4*W@rf!ufQe z7U8T?*}WC@N|d5U&y^?>D;uAVHf)FkBjJfm`c)d-yujmB7;Z$pOB5T7Jx5@g1b>%f=}PE7C5| z5=;kwapTvPKM5Ut?K$IB-aLueoX9&O&v3pFIU?V5Mh`dBFW-XrK>wKuB@5w}qmigk7Q(b=on+)*)d0H) zJg##1fWBT!4wR0P5|pQjEu`<{AdJv2&8r;T*06MDQDGX2_+&(&385NI7Ko zf`1uFRR?JeN_C_}P^u&G19d8uo-7nai+Dw0bV;KtR(R#p zd&b5sux5r_ee6IMH*&B`!GZqi4o6m8;bF8S+8yg&V9WN;3|97P3D*WGd6-cuN~(2d zOlWMVv#MD8`WE%Ir=-KqM2DRSt5>m7*PR%(sA4xkB^rr&m>|U1+whT5xl9AXpS?As zY_aAkZncI#Bd~0bvXpNtZf1*M=Rr5l31qC{Yb+cSV7|@l1t?oCYhGnx0_yA(v>S<} zg@0aTlhO3iL(ZtLp^5v;=b~m{W}FQ7pTdcxc2!K;#|tS|?7OSjhGi7c%a1W@9CIK# z#Wjag3zhJKw>ZGGc#e7CO{5g!*YM=e*&5j(&Ya-w0pl^f_>~{=EZo=Up^h2Qk0s7As9}}#3W*MNvJ@* zP+Mhe(d&{!S3(B-$K3>hs2-TtT6OC2OcMN&m3{W)zvxOMfYnAg|^*RuNsspn!|3ndyv*oJ3yz zoQhZZW;klZXdR0Kp(SrrV<0guZ`16`)urf4`yN*n6yUs*1kc53Ig!J3X;j7X<-om5 z6}YnfIY(Id0kRG$K`VMY=>3`P*mB*K-`feVNsjuJq!bVFpSBdzHEr!yoGcFR;Oh!i zcpjx7x8X>&Q8*>yoKVGzYH%FGKvV;FBq=59vymwllKF#Q+KPW5BXps+O5Efr&qFm0 z;IS8z9zl6vc0 zM999e$X^v3_rB)HVSmU~qv2(sxC`OaK8VKs8x-!=5!Vb=r`B#mKq(IT8&TB5pwO z;eB&GZeWz+K$O7s33_aCQd?tTgC_EG&={gakt3>8aQ04wS8Zv9k-eOHD^P-9Bo)iw zpqK8JxWF@7dURYY8wAf>G#J6WSx(!1o4Aj`WRcicBsLLUVf3{`9Snyd6~l{UWp9Ni z2z*phVz@FlG3Y(P5XQ{yNA(0FUZf-hyX5M;!HQgU??J?yK!p3H`^z_wsLaJG&dknM z8D5d+>c|DN4ny0Hvht1*O`k=e%axd9Y^4+EiaVcUl9j&!}cv zlPL`k*5B_|0Alt8VzX_f1hau2GDjUaDlZDT*8c9Pv3= z14@UY$T3)PG_R*M@7Y+YQQ!MOyz(ZbIQj~X9ATk4wocGm!(W1bPa~}{d?wU~&jbd8 zn_E_jhxMT-E{7C1QD5LNf=XvuOg&uLnKsmhTsuagn*yoiQs%cfjNm4B91>ASZ5wNC zr#02uj%otm3!q1|KGaga>SFZI4F0nrAFOkU!r8=Y?W)*Z{}XfrOXA# zk$Xi{uC*@W$yIehnahqN_i9}(N{+hFa4j{|x8}H>yml(r>;sBoADAZG)G>xx(SuvP zEJGUm0Pbbu=&-jGQ=8I3`IC;L;|9^;flW@cUVg3F{6+^G7B!f}OkKs39#ZgEwPr=} zn%^dI(%RrHhQZ)qs=~3gDXIl1#X;2FIESFZI4E}$4kNh9 zUWr83s>-jC6T5!J$J{Hql(`Lu5!~cHfVpGkA6oU>x39Mje>v`>+yM>F`n;gQz&|d&D)sTRZ+SAg zTe}&>TfRKF_^NQXf4=t4$6ucJ>;vbtSo%(2OYz>PPFZ#T<`$1_Exi7`b3Q(I!icNS zy5YH=f0BR4i!bdtdEtZG-yN~y`-FO#AKm-$ zw=JIB^6~6{4ot7#XUWQhdS~r>dRvE%Yt}q<%D3w-96RpLja~Ad%jmrP?LV8|bg11u zW9~XXbHbF*=TF*m-kg#lO~&2z^CfF1e0FH|y5(;^e(0N<@9lYI^^_*3Z>{=eLrKf@ z%TLc<|G>mGi$2sb-8JuDzh8dQfur|L`}2b-=k{6g+p;l#{#ntW z;+-Ck{9L4kvp?^e^ZPwHE57P<$KBWbl=2m?Ug#(8NB;4|P=e3hNFCVkKdf(ddw~pMu>gDWr zSC;+x_tAv0H=W(^+3FKd+q-%ECl_|UFmhytk$%?YVI;T4m@=mM zNDSsq47t4?uGQGn(zaw4#bUVj@p`yABlp{hYafoqaNII6Yd5@@7K?#;U^rr*1S&Lb zL^u|Mxds@nQ844cyQ_bl!c2{EFd*+91EWHs1{MU?iwZ^z*RJ*$u667&K_fylxT4J> z8pBy!1p~9hh=^itjfr_GCdM3R4LM)MV1AE@Y2h)V3@$#(VW9c7DtkXYra?63JUzxV z)}OD(Bt$W{>M^E?|08;g7RAW!w`enTeHeqO(PK=ra^52|(CD9S8h5>V3{By^8coLM zpuMR;$+1S{h@lyX1w$k99;qsVtyhe{d6OW4ZPgybmMJm4IEpi{jo1yu+19+CM4TBq zZoDDaG>N9~PzJ%+jKkPtOyjV@pFO_asX&1Y^_12d!qgEXH;W5Qu4i>F!Ps;q+H_sk zXWksf^9&K-Og>^2$*mRvCT!}p6`1-}f$tKrDI+tK2jA_Jd9c#-{6RV9jaTMN#-^*Q za2a)Y`b)i%Os+zmOE5NF-E6vsw0Ze)lj|m(OE5NFTyvS_`fA?&-#eGk6oZmj{thY_B0Xmmp zY~|`HTt*!(UGdQdlWT^~B^aA7E?<-BIA&+u2qWFYkggLbaY zMU35aI1MpgPql|U)=&fv!;&Ow##vlvD^XZ>+U-Nt-K>&8~o@G_WD>S&V9 zA~PBrV}9A!VYGbb;Y=?<{zmt3(H=T4sED6-To zDsZxCt819eqULFVs}!nhfLzU&3+0Sed5u<%;*spnn_pnfWvpGKy&iPKGozN3AZ0$q z+IMGnsV-MJZnzk8Fy==G+A=PqSdu+sZa7zgayeY{q*9bUSE@t2mCHR%@%5^O&pj<_ z3CPkquWi)$&o$AVRc`?9tVW_?wdQD2MzX45S_j$`8_9~BMt-iziaTzyQNy)zr^XX* z)N`%ey=v#~9WPnsJZ`emO{30Q${jaZai`VJ9XHvvF}wC_x9;HzR2i}wJF-}=P$jcY zP$jj8qa)NJwN6kawP)R>)(NVlIy-bNd94#vNp*JjTBOzqs-*U=dkxeDs@sP4%go7y zjbtz)dw;C>DQw_4of@h+zwc5hDO4h}**y{{szGce!lIP$s4 ztA>EKP_~P^Gzi=>aKpU}-1pp*u>?0b-U4o?MV{as@>tB@fN8{nB2aHUd1nEW>cqLoI}eybCr-vdQ6VSZ z&XfUjqZ8+l$NG8-m{*-R7kQrn^Me!TBCkH~&QIhWIznybO$BC<6X%e}a!k}QA`qu| z^*0N+lHf4~;^nUfn8P|QS}%_Bvb~&$y{*pN-$IDu zT&_nhFe9Bf7kL*0Q|`pM$a@f&XPh{PJhqp2fce6SbCLH4Fb(zhVxr}6k#`0#y`4B0 zc_V=-aN->DxIwuXn14EPF7loS<~1kIA&=MN3t)bB;#}nUu}^pk_X-i>m6!7R=@V>9{_Wp4)TryQ$G<52(^{BQz9O3;$Vp4 zT=X#JR|u49pxS&apn=1BQr>QJUFa0)cZJIF4)g*Ae%49dO+8c{T=@60rJ< zV}5pd@Oqd7_kWAUU+@3k;t%^q3l`3sKaEx47XGKw^D{<{96NkOwo@K|Yqe#-EmM}b z1(RnNTYknR|KGrk%m|O7+<1SPnFW)zx@9nK&g}_JCvElLep>U3e|h}Hq-Q3zYS4Xm z-$$&7A7^{=wsf0!{X3_Aa`w9&G7j$gvSO??eJH+5^>Sfw`TD0qpPYHPdxk_hx4S+3?}J6$A7vQx`-P8=4mMixcHf-`d!4a+ql&Hj zncbYh`IplkgX4}P`Ywe}B}aer84iQ-G(-JT%X``F<+x}ZAUSOr2UprmVhC1>gpC|F zx8U%>cJ6c763q-%X6+4a$=XX$s3L1uFtRjhCFw0$+wrFVF~q?FWNFf!D!rQYO^U7( zCK`Ec%tlN<96l{DdMv)?slNCQONC^Jz^4v5`UE4Ag<$HYU`6?AfWwhjQxK2O*Xak!ms4lT5-Uqj7z02Owf{Q?__(BYr4!J9PQW;ZGcy!zV1)=x>wQ2;8~BeiM>{#e<0qID{0}r>#zVg-AjPakcP? zQd3KDYGmt@4J@Y=wq#fsiHlTi9JJL&x~h$PS=q2p9tCTaT}DkcT~i7PC{Za>B|9&# zS*{8>M`suZhJ!kTzq}f;uuN1RP{b!EVFTk|x{8s(gbn)=%D(n*_`1P{eO}r_`cQKL zd=(q1*^vMYkE(+k_Ik^9qgXkmy1f=`bGA}Z{UN?! zOp6jjW0m$kY^Xl-<8m5hiondys001OlaWgHnP93iW5ahS*{5ibkTDS-te&_rqwH^3 zl6()FoKR$I>icD1pGJGn!#`(~?LIBL%j>LX@8)2?a;d?x^}to#hR#`YdllPD%^g*| z=ruR-cHt8oKJ6Bq&lIX9G;tvEX?*SJ457wEsfD1( zLhZv@gC6}$tWFCa40w}Z=O2RAedI^E-a#?gf&spizLOP#$7Rp)N=s>(=zqB380Ic$x`dQ@X?8qP4kzbUF zc_ptIKBQXQoa2h@Oi5*gB1?Gb+@I6p0sT$nO z8V#a$70&u*2? zE@j$^WAurtgb941!8Y}+oXApn1}hF3jOYzt*AIHPN^X#sz9@TBYsrso43%w82=T+S ze>Cu4|0%kS6B5}{bD}d&HJ-@z(khHT8?L-3iPs?nGyhQJqO?$CK_C?QHrj_bo{mJ- z_p(6k!r{~Maeh~*(KvS!Y9h{Cad@>0aehmv`8dBR)MYqt6KW~W$vAxS>bYt`PvN&} zL9c;QIyQr9jKiyajdLR$=y7QNyu8YEPqnYMh*KP$KqqOuL1joBTXS0(C&zM$0EZl(gvyR4%ufxX2Y1;X>T+a# z0)U||2lFD^aZ5iW(zF%q=o3PzjfYe;ZIf3yB4J2n)00B!+b-FY7ugX8OZoj_b&;|FnQM9o`&x zT{P_%|GbQY$Z!BexbZ=pTel2Wh64VvTbWe-i~p*yf3<(?cK+fi+!*JpM)j-K5xWsL zsxi*MZ5P~Cqx`$^G5Yxr(HggHu6!kI!!3^l)3?lrpbZN;=5^Uco=}%v;VxS<{V(}W?&(McG z?UL|9QW}0wH>*92p_$804APKl5y*KXgC@ZkvtTo6PyAMo#@KG@{gPJM2z@WL1nspTXc#2*OWXsHo(wV#Qcfy6cK)GOGf(N^B;v3 zvn1rC{{>_B41d-e*^%nV5rJfPIkuK13wwX4%sf__?Mw8O)GvGeSP8Dc?4)GYTlu#b z+rpTESZ`|sk{`Hz5%%a$RhlrrtqlO@uIuHJ8bchHB}kAZ$psU~Z^Q!xeMI9}(iMkK zjNZBl^$gB@5y_{q9u>uk=4(bi?KhlLgyQ-mOQ^1(6fO&t!tupxg`*)QXHB1WGbqKu zCH`p=_f?cS3Mxb5xQvI1@2Dg!%-|@24KZ=#7`g?*g+3arEKVA?24J2yRTN#=@Lp~pq23@J6aoZ6L0V`b3O6Ky8@Pce z2r6nQNdRdvg`%iHh=A8vvAkCFwTp_4W(!1$m0|-cb`TN72B_qJo-?y|ckkW+@8|!% z-~SKX&Fq=yoHH{!GdsI`=8OpEWG6vlLvZBaj$ySf_I1w1uNS;V6o7;1O(MaAL~QyfIGIhrAw>~oQb6+2w#2fHXcM|H9l2jvc7 z&FBzKHXq2jSb`}+^Tc|L*bRsxWT`)L%)n7yPZcA_Orf>t9A~uj zq!?KDxjS}S%?hmM%_hrAZeTQiPOVdZg$2=pW0h)QDn{M+ z3#~wLupRLxmuSBY|H%tS?47{nRys8-GJt;J4vA?zupvl2h zh2ynSG4=+?N4s3sl|nl;D7lo$ z2W&G$lgn#sjh2+nP@P;=7nI2l_GXACw-Sk1Ta=JJXjuB-o(Y{s22y*RkFy)|-FpgjZ}1oZq@b+~L8=ovMZuoE^9KqCu~9+w-qMNjnxbZ@+9z?I%8a z_1d52ecL7Xiaq;wcHI8U^m!B3kGp5|-vdLj*FN21Xq)Tvo_%@!efd|PcGXvxj&8WD z&clCR+WNVsbN7{0y;bzv*4~$VkUYJjQC5cm(70^B%#EtQ|L~qGTlaad!^*BrXFs@e+sxQb z&A!`l?|0+k9>_U=<5l0KJ>rSqH6ZoCQ(r8f`%~>#y8LqAIZym+#_APw_aB(vtmZQ# zzaM?g=;ww!bXAi*4Sv4u)|dO#d~eSgXN)=YX1#C!T{ZH#z}~*QABd~@&X8O0eR@Lw z!f!@3U0m6A-)))kcTSu9Y>SwO`rkCY$)vW!c3wRw@5q=x)-1VXYiZp6_s;1uqhGz= zcaB~-v~}M42X8G--GBabT^?Uhx8)bLg0oT|n~>l5%OmxVJyY=Mrr2g%e(hIM(7#{G zspIz~+;z&Aokw)8idpSD)N$do;>nZiT>9thj}Cv~jUji%uA5Q1WAj(Vr~6a9_ZJkt z^})FK&gZV3bNUJsh2gtBq7e>L-{T074KBjjc{RyZi9V?3h}Dsel4biyO}!@P-=`D;P?n zoTndty@MOWk-+O=zb5X-aaaA~#?%%J$KFWsP7%q@cw|E-k#^W zB8OuEN6Ps>uR7qCQ%^7>dBpFmIX{OiOY{^_7_60wysM~?AleLLoIbZ!MP8*ThGAlO z?^S`6fZR=V>2vIMqg zwTe{}q@M{T*#xmK3#FflVXqWQ66S^y*aw|!U+aTntpj}U>!v&G%dNFT(|dhU$KqO~xdh|T z)zG2qz|G&kYjOQca|ylBBsjhFx4%Hn!ja|y?{q z_24nxdh|Tb((OQZGJ%F#_KGuCp4E}9J=IPK)7wJ9@*>*i|Z}TrQR3V+eRCQuFXR` zonmqQsJR5=(3RjQSCdaS`z)^dyqzN?;OBLet1T%W)$j23XRSZq;_9lo1mn=vPPoiA z|Mk1i*>X5Sa|yv$QQ?uGe`=v&609CCKW%}!Dl3%k{_4mMUH$ z1N+xKOFL&+D`ppHF2Oi-b#dq_4Q~I`;(9=H3C5x8Ea76mqpl-&Uc1=Z=D0$03C5v| zFKn%H{rY0Mjq790B^ZaUZo*|=ug6|GT5jq3MRN(pp{u(?SKlW}`&e8JIJrg;j6+us zP^~q+RjmiaSX^glF2Oi-@e{UHu4WgVKh5Gw*Ia^e=t>eUvoC+*fB!~{D@St)#-Xd1 zL)YuWIyp(A7Mr(Ey9ta1(5)wPwywNi5l1~_~M1ch@S z1~q-Ffztv+c}L>UFdBlg+(AhIWt)T21C%{sirs9oFXiA}lL`a8`^KA^@RA=~48%CM z*5$;^y2t(c$csN)T-RtWVw_x@yIEYnzjhBEfRHH(cWEwSoLv1u@tQ7JjO+FsIBIdd zsJVzylHSx53RRR39TdCiCZC_Yo}KJ&j<5$Drj21vab8ieEVzOh-n3%dX<=Sb2?*H3 z(nd5_JkFVEEq*PSHoiE2X5sW4y=}0OlQV7R#PQQ|ii&fm%*;{GTRAham%_{$MMxY! zu@L*k&YX~wUovAN&J_$^ou<#6kuxh_KcAVJ{?8T^hZmoQ+5fXu#*THoSo`W&L5p+e zp1skRCFe|@J{~*D7LPA1E(+%dP$8GlRM=X6Ym)P!xM;EqjcZ}sV|n6~g2{U6t=gQm zcy56uDx7ND0$I}>rO-5INi3p$vs;UbMasFk*bgIT`pjIHO4-~soOiBJ)Z5HPqq(-8 zC3b3Veos|D+=13?0;Z&JYD7v=-n4vaqhY#j)iP__Mb`x~S2R0RqeTuG85ln!7rT9= zP0pJ*l}$8nVoBkY;<-5!NywQvbLP}3d9L-x>=Y5pdWEEx%~>lKZMX=cLRza4ZO90s zLRu>fZO90sLRzZ^ZO90sxtLeIATd|(>a!?|Kh3KfQD*aUVSiy)71`3H0aVYbk|V3G z8h)!9U4Y0cbpga?KhdgQ7a+2#T>vG)s&*G3@)EcJN`iGcTmU7(xkyu2zr7xh15gs2 z3o@ffI1Zqi77*^0_KZ~9brmS8D61PsZ56g;v!Ut{CY%Ga_nFmaOHjqo)FO1}AfdAuHA!))#phAEq9!RWwdg!5SG1&oIozWN_tlZbGYiL0%JUEGf%UY< zx&Qk8$^K-cU|QY`+g-iLc{-&yXW|U|RDg2;C&b(jc8EWHNc!-M;c0{X1AAi|Qu&^P zSYlcxzvMdx8Y66K*f-ggfB9 z$s#>{indPpdj0qpo?%t9PWYt=oZpBaWPe#s{&9HpFT&#q-nL1A>Zt2n^FUvV$z^Lk zpCfRF7i~T4Y|Icl0dqg!@F5T$4ae8L&G0@?ZNkOZtQu!~okf1mG>7nAoGnzhu5AQx zV>Ol&dBH`<&NL)mD`QTOt%x#glDDs{M=Cw#%6nUQkvp*6SMP6OJ*KEdjn+VmF zHvwtAfjK`C7e!tXFxN!lBJ#)jyBCRGaZ%)51579q7a=bJ@*W4~4UIcqdEW!(ixbFW^4~Z#QEzD# z2oHh4Ev9N`ag&kTyrtPbNl?3H}u)t=!(;gzsP1$^_ZVP~p1v=e1g?@<(Rq^UTl(FmVm|hJ1k?;6z=}`*pDM zFD1LV?@&K1GfG4aPfPR{4-A&SxDx6zLw{$LeM5P_JLCmYjs-$rWQN}7){DL&pIh>N z33UFmWH&d^V+`Qj@VhskoV7&KHAUr9c*`qJBfK*_GWU@FBd(GflR26riIeaGAnNhb0@Z$pD(tI$qJiW_I zUz_>hH|852G~B8!fzls5C5LdKI~m1i0)sjiqjuk_V3TgXRq2gqrh6;Wz3bDLq&Ml7 zx_(cbFnq~6>!ILkS4H2d>zh0Sxek^^LJD(zB6YAg2HhF$zYDYR(tI3X)!#kzo~kn} zSCREu;WN|nd!1h)52_UKi}f_Fg4kNKYlKwq+gEeV{N3Dkrkn$W&7ztEh_%y;}lVG7?8;MRg4jj81L9IMmxkfw#OLk z#~i_9jPc>v{BUd;Vw}{*7_TA5>0gZTDPo+z#27U&oG85+;n**TVP=X{4~BIWs~?WR z+*Z@F5bG#7wKjE5w6&=f07R}$T|?T^v813-pzYFISky*swBrcKj z7ZQ1g4PfCzJpP8}#D)G?e;}^(d*Ax+Ypp-vm9>)GSStX1cjB*a;SD$jVW&^+f%5Cc zz8@h|KtsAF8%IQ_EOw`VDHZzCb2@53nR-HCGJM{d6FRc=P z!#Yvp)&c<1%VYk=A1o2WV##GnN|;B+mrJ=?(v%{UU=W(e1=GI=NjXys;UKl8uxLN!JV?kHq#T6xGn+OS=in9D|uhXmTwkc)wZQy zR$EHFqMlWKtNLZ%ZO-=@^&A3S1-NXh^3dIO;~%`c|*Xv zF_4V)fMD>I76PRfUWS;X1^C6t!zsVF#~8fTc92*f#Ms-h^AlpHO6)Sk`29M@n1>j@ zNyiv3BF68`F~)AhRPQi==qRalLuefA&@waXr}KWSjE(ON&3Z?2dXNu(PH62G_Y(e z`nn2*L>`tU9!6edoei??$Kp=5s&Sd2chH~vA<5u^L)_QcMUXO?F|&V^oXb1gP)dn| zxIo#C;&UiIiny&5N0rADSA#3xRE@F;^2*qnATJ$v<;415F1E=`?&@3A2ouJ&Eu~WT zz0UD`0e&&Y)i|m)A)1aZNT*n%ndf37ZdY9}w6!tj@~FJVc-@Qs%f5$Yp;*T_n~vPVw~QTA*#t^$&)@KF_>b z^}&gY8Q3pWeW)1gW2(?(1;jUORd60CNA>bg;h0MmV>?$IM6H50GenbpITEdUFy*q4 zmVQfvl1rJqCzv6c+}TK^TwMJBD9@D3d94|u$-YWtw~x(l(y`@hE!R&Nb>x=5*DX1^ zr{#p_SM=yPYx%mSo~1vmY@acC!DWfl4qw@R>QzNm=Y6{8p3Kvqp4>d8>zP;Y$Q@f} z(53&{_S^o0u{~l+jxMfzzg|VXCY?vsKQL?8t<$@I{6>vM7j|ekWzzWX?hR#z(hhV# z|Fm1Cq-V_eF*vKwx91g4^zZ8QZc_Z!Yuj(yR^$F*IStbSvz~vc+w2t`CQKZ-Z0Rp| z&v~yb?fb%quCDjwso(s){lb60)pg8MNxL2${oT9wzkSJ}f!AK+d;F2c^L?kB^J?BT z@6DYRpZ(6xbvMx<>bE#lb`kI6=hNH3yCT5ID2xBI@DDzyD8(fs-F3NK*$}29)CoakX z7X|AjbTISW+(qf?q6~LYCb}qdT$FN6i7`xF%QdBDm}0I)@P;YdHHMbuYSv)&c2mxu z8l$e)N$zXZ%Pcutl+$jT?MEm*dh5$f%}z^hwi?S$Xv6m1zgc_Em{#?IaadMybha$3 zzIeLsofa48=L~{zSaH<`RqbHFf*!e}<^s#^mhaXW1mn=f?@yMlP38T6wzwu~F2Oi- z)fFz@C0XW;pM7%7;wsZzf^q0#KeKdImfyM0;(Azf3C5wTzHptYb?twA-47PmM$IJ{ zhc12xvvjQs!qw7>6!C7g-jx-6m~4&*G}78kRge!S2@f;+ywIOV_1aZoI|f z>Y%v<32(OSX?h^F4d3h*Nb;8%c}LjTRGz_t`9VqU>v%f*6=MV@4wOF`a^S7XAQ6V z0-h4w2y)pfy3G__7K-7FYooeq@)%CF&iv-)Y5WPnVlxV)f}t zzte`z&0l@G;&)oGx%sP4SNwe(+Z(v~t51(&)dqH3tB79zc7V!))08l(jN?L-6jw#t z6;*RB>=2ukovsB*4L4<78mnPOH1$N44P{t&JPF4`C>hGk?szhehcGL(`kboTP-b~i zwb)I7m2nwt%aVG-Fu@Eb+=HT5_wLHLjJ9O~u`ToBUU*R71ESfMjpA(C9-`Qmy^QqI z2%Mj`Wwzz*6tNp~hJm<)wc-30p$mS|_MqT|?<3B5Z6TV?7#|vb0PYu!<&-2E?q8t) z4b1Jlzawy#T^;TTVA43dMW_yUCDO(Kv*QFfJlh-J0dpbey$IFG<3qx9V6M=(>dMg- zxJAG`cLI5wfNcWi%M;-G0rwj)XR*Q&!ugB1ZhYC0sxbn@L2Trr;D($8jq$W z>k*-s?WHsVC+#Id9_x8&1g<)Hw?yEolXqtXE?RrxW6c96fm;sTODBQ547jm;aZW7&S>dPK-$)wQBfTM%3ndEJ0Z(b(h3yYM9CO$To7Nyxk7 zB;`E`-0Bm^V?BRxlJY(SZtqFRi{+EMEmT*3KHyquY<2a={3V~Hyj0+_PD0+)layBk z+%+d5@7|M?_b_nJo`k%uCn@hE;J!YAJho>K2M=4Q?s_x&{M`@ClP4kX4Pd^E#6{`9RlwBc4Gf{W@^boh1~AEyxG3_*05dTX z7csuDJulE0>Sd^|yi0+*EmB^@ILZ7y?~;c-(rm9!L|C>R-X#B6Ku)W^V=<2Y+g8T^~hIzb`g(} zfFs{|d&E|fqozl^5~z3U{cz5Ar5?kNV>^ijaO@zlY#cjD>;fD+OKdWZ=Si#p$NmzV zgJWNb&ByT^i7mm=FR|q~rb+BE90yBmC61XATZ3azVq0*e9*?mNM5*E+-lU4k zH6Rz7l_9U=lfvZi9>A`5HFPa2t%x9AHcbuff64<#90KhecXe=x}(C zfy1x>ZMX)OSyh3QgR`*Nz2RM9FU9meoSIX4CbBnAvdF?N(3!oMnWdX<tv1{;)njKikUWmFo5(vHJ z*hhlKtEi+DSOlUL4PMhW+}U7G5Js@vfdmX}EfLwkrI-ebSJXUHW>$*h;=^nJs*6alAreN&-CV z>x=!CK&7?w;b@_N_>{uYgnI_1#+e%@EFBcLnO2>~=0VN*C$rp-1~w?(N>2bO0i;fq z{1VQG_!zM$>>;tjqVZja8$4zh=Z#E-#c1jJW2HxG_-?O2mxG>=e-3i~V?QynqyvB2 z2WN)1u_CfU8!WTSbBq^Y^T?jzOJ9!y^s8h67mJo~t#QD=R+AzsvrNdkGBFzb=apG% zlTdACE)tMcnNmo#>qVd@N7v0YYTzh!xO8ZoRN4sPfxm*hxn0jSGSbXi^01aN(sI%R zq#TLyE#qmrs>UN8o}%htpPGq!Ol=M~`&HWl>vwxmJDn<{_puA(WPnoJqlA74rfivg zaUhfi-n!tm4Fl)kG8(h}Z0U12UT`?*tA~Skf}xS|){vmbgHTBt`cF^-#_cl9d*!%`VN3ud+20}y8-VO#rhr(5v85)6l-5FT_wO4f< z?J^t;NcGQ(eM#;ivjf;u0C8S}seqyP$?^kiiy~g?gWPQBbzDNMMS{I?LIUJgZ4-O@ zv$I0ipi0#+A4K_54i>iOeo=lICzE!ht|8h)AfGieQ+}US^CcFO8zhC^k+O3W0NJ|+ zMdjjwaW(_x`4Ax6n_LXX_?!g&fM1L_Pggh6e4MKok7{)K7h?MbR}+0vjmRAlTOc$) zVsj;SA!17<#-_e50a4p1$Q{36kM3)Tdc?rQcF(umN`-)Bl&b}r5{EJ9EN-&rX<5f; z`AuD;WikHd);3y>f}i&DnjQquVAjl_Y!=WJv@gFn#IDEBYbY<<_26Z@F1&2lF&Y;t z@7Q+k7J?+Vijn)4<8rft%y23q%IZ_a$bF~Kly2x8RU5kD?fX2Xo3k4;sPFL9tzzW9 z4?pC*Rt=+8Pvv==;UaRE#>F5Sk~(W5n*;#M(oZxLE`*NM|MGcc~WRgB#43av$(T1Nb#+6QBIW8Z*r>UxbsN<4l` z@KaA`V-Yh0XS_<5ic!}4LTg(m#;8-=z^DnI@C+tbJ;W83QdNvEToe~k+30{~h$jDI zBwDt@rd+l=D-SA0T}m!x@-?p+qRHKjM6^}g73*li@wY%ysYS(D((iJ21Cw?|7g3v_NwgP+ubU(02?C9`|Z_l@FHssuY z?^E;czUJ`sZF^QHy)bjo&A&YN`=95Hc(T>J&+5N;#%C|YF7Gs=asAdAG2OoU*Ncxo z@#uTaN4{n1HRWFVedjqZ9{qi(DfhvjR=rkd@+^Urun{KS}N6FrWs~4U= zWrgS3jYDhftv&V0l&hD|{$xn=7jND;wCv|SKbEIAx^4X<6W>Vrbn1JL^m=ap-u;bd z-@0MI<;l_FHxCz4oqm3Le^cbL6>cA)WQ)qvxm0*zr{A!=;0N zj@`C?-{PTXjTzl<=KXcLw7KTcWzEg=XPY$du&?mE36E{byZ+p+9}Z~x?4p{}7L549 zOs@`q){;pFJNx>SJ-pwNYtX}ApbAV~PiroEymsoUBV6@yB(`$ldfdoN zuGchI9T%5a;(B;bq^_^K9l{jCiv+TdvG^|aDlE9PI5U~zq=x#(5hnM3By z>*=StzRAkE*y1{cNP~nj$$ANT(%E^d@NQrh)lmSehnJ31{;HPq@fX68~ExE zE?#Sf7waB-(Bk5zcMPYvxF8x_ob?b=enEfy(O_eojx;hNb@8rST~Fa=dJK(STrs$oFatOjvKd~vXca~)&2^ef zS8Io^1$TBrw>SG&CmkWisY~Yl;no{JLnxMJby13c_>-Ctk;fTk)_Xdz z*1C~%I?ue^x?bxw7cn)AiQ}ii1uLQw5k*(7Z)YdMY+g9vD?SI% zz&dqVT&p#gU>v&mO~~>-PFv$QbF_4Ey^zKAt>zMpL)TdjU2mM$Vy@*! z{BO-A7>6#-SS(#dw|~*j;%dr?A%b8Wy1IdC^__n|w(D2RFSY3fUoZ|`-Gxi$Jc#8M z{Pm;7m7#SB#-WSvsGYj3eHF%PF2Oi-^>paE>a6W;Ew0NomtY*ak{r5vT(hKaqj1}} zR&xo)p{tieSMEh|H(FfFHJ4x6#uaGCv!yVF=) zA80PYICP~77j8}@)4RW59J&TObd8w${4W-l>D^y2 zz!}Cet(|e_EO!Vfs-#T2{!okdM5yqH<{}1MHj|tHC|-}>1ZuotyaNt%9SOeE$;zcL zLB2^vA>~evB<4o4QWpKxbCnT40Om{_KO-ksMY*JD!jxios+E*kSdNoFSFCR2ylBd# z8P-{Dp13Qw2zfIi2+G%Y!T2eK7D(n*)+uLI)>&@egpx_7d)wYah7KB%Jt%X8AGsXZ zYk1hXZSTxsBhu0`GX|@KjBr9ydS+T6b?A_QADi8Jau9#VBSPljlGD9Vii*J zi^FoO5Q=Imh9X!6QRj}L^vy~eo*oEf`6X>&uXDp$?m29DFc=t|n(EI;(>ca9)OprE zf_o278#ZK6W_C6(_~u9$vmOB&I(*RJtRcgP1B5S;ez{=0&bG_TQ(Fy~Ex{_WNpW3T z5frY7uxwi`n5H} zNM?(*({#%#nZV5xW;v2%4NH!0t5H&P*`uVeo}!Rd6LKWTvx1qQyom)|yCyBjQ6_tW zi=&zns7pT^uJrSAn4j^*C56`NI+a?OHy$ey!-@Z~H-6T&y4Ch~%GWYdxlcPDe|RYaB&K!*MeC3NXh`fa7BfJTDmV*&xA#qsWV}o#vGMJdIIE zqgvbPeBcT-7DbA>)`KsmZ#qeN%Yj>Q0(qRczIl@JJ_PQo6UdV(t)7^lsJwB&HP+a0 zd2JI;^3TDqXN0_eU<1Aa;{Hc|qI2>lPW;Cv;8ARxvVHL$_*I0N5sYvWd}qL1XAf&C z>66kuHHzz%?(r1IhW;!)>?x^9hqRr1@fmPv374IOb{8mt^$Cmv42FM1!pmTC^WvT+ z+E27UjIKj;O)d1|#6WTqtSXI4m=o0reP|hhUQAo6X>_^>|GhA#$wx9!HE#I&4A-TUjxXWg%I<%+O(2R8>>Tw{(VJz7(M0-_}s=U}%$MTI^oSD$18I zlfH~yG(Vzc7wlhiD%*$k4@0bxrJt%3Xts}Gv_ss^8iwU3yg>%xzdIpVp4l&0zMulIK>5vK6%f_0 zk}tyexe1PN8^bgww*ky_>cdP2rb4$UGaZh4W{?jZz}iiOgS8 zkBX5)y%aM|D~#n$uTOaTtBTs!p7VC=iF;%3TK3x$=MHP$ZE~xmc?tKl__AT+3m=^J z$-Ca+KXt3K`OUlT3l2HE)2%sYJhSVPAFs&1?7=*9JM-j>ixY$Iz5n^_#|KPl+~vAK zrm4Vtqk1*i(5}vAGe`f+Px8EzIfMPPBF8=>qaJ-l+fYu!G4 zP?j6RVcF~9bt0z0>z7>S#&8(*dU$1cw`x;5W{`^EM6~lS?qVWAEhunO_+rdS$utRJ zt_d#6Y!@Y@DVF=Lhctzs|CxWR2h|jQ+EaGIt;J=2;uVZTSAF4Pc^UYU+WPEaeykOYLl-~oTe^;3^kACB^^MMq-`INEwW zoFOGi||4Yy+Po51SLF%otxd*O5A@aArvXwow|N>mW}rndUeTKjz|D$&ny( z?Zkqq@&drIQy*xU4$w7Ej_3N4xbrdwso ze7=hUU>2%pmsI_n5`|e8p?ZE3a3T@5vZ^PhYL!_?Jkccg`wyOIdUo&GtB2tEL^D#J zX!hcke3ov9(Vl4Pu}RxQlqZ@Oke(8Oi}pmb3B%a|;9leu0HHa4(VkR3M}8j0G{f`& zz`hs_$N9mZoOjtmG~8&UH>Nd+EkwhyZ(jynp~kXWqTx8A%maqI%P>@j<80|>jS(OY z(c~q7UU`x@?m%M?(d5Y|rKb3hj~_#I`D=!>bd3=p4$*N@XN1YVzLIF@$_Ft2G`b$WUK_+DcWl@Lu{4pM$T z3Eb7dWn<#^E+>BoyqiapcL(TS0W+5tE(q1(R-nA)z$9~$i@-a3b@HYHQzL<>>g7>y z(*(nK3O|PG^u7l3iLxgAls^WayV-sgcC+FoFmyofggyiS*Dj6xdKzZn3oP-DFS z%j)Y0dF=l;ous^bfP3r&@;GE{I!SpS1NYqtJ@-lye zfw@TI*ng{&mkUh6NyxhamianBrZz+9t37pBrb})_kr0RiHnfOx$H4u8k{c0u*wldUKe2cMdG5! z8x2f;Brb})MZnw?iHjodX^l}itiHXx3f!9~A#cw~$~z2POvi|NiO3&^$95WXqWld2 zZs-Z*@p?=?NqKXCTXX_>Y|js#q`XzYZ8(8E=5O~&$~y?$Unh{q@w8n)U zdjc~k5*J0@IAEql;v&k+{9OmkBayf$@?HmKTO=+*9t`@vR0W z^%ajFn+Ge%)h6!F6)5lZd!Tev%D&|M)Rc`S zb%a*BDSqD>pvL-EZ&~oALAMfsE;wRbjts=(FEUbsh5Efp*f#^A59I}o6hJRI?jcK# z`7Rx=^i>9f_@;oD{M`M^+~lhC^#ZlSRnFK-t_+5Ei%r;eDfAZdS{y6#_SMw&QrsZ4 zMWUgddpn?|`BqiT^6i4l#7)X&38^& zioIE(x6N#2hTag_`%XJUnC)P{Q-Us;YI;UMJ7xTH^ftIy=6Y)Cji9s&jbH@K{U(4YKBiERK!C3Xt= zq}BOWZCmgr`(=L04<*y`lka~M(u*git{sHGMC0?9bf2x{N)R6Onk9#j%odzLa(6hn z!9IDCsK*RCYd{)Cn9xo|uiX18c-F{>kz9k$71#=%0L{00Pz@Q+0^9clswx8O_h69h zvN44@@a{p+6#)U%4L<9^Jq27V>??r>gg|I)oa|1=yp;FC*SccpG+Qw?uw~ZKkKx!r zeF9`3ngh2I$Qp7S>aRp>n&9r>Rh8I%h$)UI z5o5)~7;ht{dWT%?K*+=Kqc)tZG!MNQsM-y0NB)t)P(yex$-<^}g94!%1oY#V@Q%AGRa4Zt~IDkE$ z71tR7Y85K(NVdoz-%Lhs0EaTJm{1f0f0a~>LTFu;XJ{qLJ6 z*Pp$qK`=B}ZUOFb0~b8iw|XT<2KIK@1~nTe*zGh<`U!G@!W5_JT&3VIN>QAobJrPv z{U|}5b+|*-F8w>Eq`h2I&QH)iIZ46gPrZ~o9+v*?E&ggRMd zoUG+2mAZyghx}Au`j-5&We?6?(<@%2iWi$rbHS@v_@NL zWD?ZSjNA9Vrt9D*xz;{k+5UA^xO1=JZQGZzEwnjx>F9bLSl6Xn>aE{XqwZ$ky504Q zVlXMFizhM(WadayQf5zS4d*+50iZ?41LhzSXtX(uo5%yDb2x zZ}s8)_UqRg$N^@_m|g?J{c|6qRPLS519~}bhRu+asc(jL5!W}v#mF%mwe4oOA0!|% zVH?7{xZ868{S$KiY|Q>pU1`E-WA&wJr5rBtb7m~9Jb{}j^Dfd4+n(w{gLl6hp@Mh6 zeyTq(r~59ECXkw;*dR7I5gV{VQC0{p$0F{qO3A*KYIM~)_uTUNeUP^Si zN`9+VH!b!T)jVQRzZp1-F{U9lU1CcR3rOrn#MI5`dBkQ4?JdOA&4?G{Ode#wiI<57 z8jv|+R`-{mWI8|ycCAJ%QDSEzrsj1$5mWOp+$!LbZD}gTVEUEQRzOE(wBJ$OKTw)% zl=KRO1_jvnT5(REhE`Bf60aYR!ZtvGr74gFLnCbyBvJD|1skC#=3EJsuDof9%c@=G zD0;Sj4$$hb2edU&!6c|Aa*yVW`4@&O3R{TT9Ta9` z{*f8lo5~sP$GkgM_!dn<2{~V>+9s0(nGjw8TIsP`zC{l}5;wV?kH2MAs*IQm@Aob0 zPPWn%!?%c4#Im-ET2|kpT11A+TYN9~^?pp`Ze%a?vz&_(mxF@dO$x37wsq#YbW)t$ zq)%YBro9j%h5pX=J}qosHZ;zaQ3%QrB-DV(R*_UKNdd1uEKH#AW~yzPkTEYKW$(;y>#%3C=#_7sEw#0+=b< z`;3jQ`;0%_X95a-5`BhK#RToj4(>g|5WlwFFS=XbitO| zKb$$D_*NZW1mV9RFRGKVf{GttM`6>4ktbiIU_!hZFJIVe&~DjrHY*0n*)xdajfk)8 z5k!!I2ACaT;+1m5xA<;Qn72i@2tJ~N1ygpLj#jTguSxnHehTG&Z{Ah$9zx}V52x(S z>6kBt2FHXxz)2_EZBs+Fm?^W*;I1Kkxt`UR;XBA zi^=R9Tw=d+kypt=seZ)4!sK~bBE zu@tWh?L?e&!<;HcPCmKAyb(`>Sd*kVn5u9bKU9q4hvFdWr4z_L z3bfUxO}S3}mIfu4GHJhP29@sQ;kzend4FmxqyCQCyJNS(g=K-N@oca$k5>8FD$G!T zh^kK&V+lEBM;_r0v(2ydjQHI8M%<{T!eDYzp2D+cRjhfKlPJEDGlNQJepQS*>M0!> zV#;-56q+@yazvSFCy;xJmRk!K1)Rvc@gL=#@?TcB8Od9;yf@c6ROU}E@03YfRWn4B z+gjvKnK5hpv?;j>*~1KT!Na3yx*^0@?DEIz0c_xSFq-abM|aKe8pu|Ll(9gGwO-l z=bp;Ed-`LeGDiM&;Q8FYZ@g_{{@~9xt$gI~#cMXdZ=AX6tFBk%jDEfE(79a>OgoS< z@98&(y!-y-m#6yMndg5!JMq!xb0_b6=eG0vCY^i11?Ktm3%_XnURD3kO`nwJLX;kj zPM^Ew+(CISHTrJT9_%b6UcmC0{-_rO&0m@40Z{ zzn4Dp<~!fkXteC1_y^7N3CF&9t-?Q}f8E(!IMb^C{DnWKuK7IjywTKO=FA&A_3LGgntLxj&A;WySBv^zI&{!% z6K^iWS(g2Ee)_(LCq$-C-g9B++0Ac#eN2OdT=C1y)NIkYuj0#2`wI7 zylc+-^M9%tI@IIdA6NJTBmTI5*je{2{{EZozn1>-%`G`iZb++Kziv(MXFfapWsk3Z zsk`CeVAE&l)UvaueE3|w?jPnFV^%z0CoL)d>b31RZL6{8SoVAGet2%fLuuC~FNhsh zRJUEXXDWK#v&u|={-PtV$FExQ!HRq4^iJ5^>m9T4`X|nuUeI+)?%hjcJbdBnHT?N` z)`;(q2!Jkcf94s@coe2(*j3^yfQe2cgew!0*rb4 z+HzuHH2 zb9&k0LwCC|KEd!ofLG<2{x5cLW8wwV2uFqs&VFRQ8`BUeUJoaFtj&kN`F5cjbBbX4 z;z(V$O&En4Lu4INi&y;3A!1An-7(6I;VsVV$sqt?g*OIGGEzSbrE!?DLsRH`RB`Rol=@+cMho-a&Q(n}RmSM_Un$k2(`9xFb)l@|fXiD=ir7jyQLY*+BwWib!Q+jAhtuSSX zrqm8oF3^+)Vaha3i4RleYl;!3oQxmFw_IG`xF~Bi#VmVQ7v)?RWs-|B-$l9I zMR~?W*`+C5QmV4{lcspXl)qeD_2sh)uLkpsMW#Kv^8|tS6t&2-hn%ZNFroC*1cPIy z!t~N0-W`O}*Szy_oEJ*ZB+bT=O;JqA9HWGiY;tjAb8>O)6-u9E#27fzI^}R&by9f8 zS6qll;Cqjt-C7c`uttFiFGiY(0qqzj*ST5Q+%!P<7 zO>G=rayv?M3C5wTO_+;U_OdT)U2kzs*Ia^e=t>YS-uoC9r%n8|Nmy5z=1M>c{8`&f zY}=CJkr@SI50-ws*5Z0Za|y+mj}OlCO*5kVOUo~UT_4#ICOOY)zX!^?UjQTm+8|`Fb-X(3zy6v5c_k) zpx-U7(OQ>a9J)F>bWK|}Ypca|h2|2BLsutIm*Y4kjW?Nj}X)eJybai&YxjMX;2+xuPaw_UG?!o;x;S(6 zdN{f=j9D@NiI!nqi!_&D9J=}fYw0?#C?V0}dQfu-#-WS1EvpVE&%9xw<*oHK%_SIz zF5Yb{U93Zk>m$u27>BO@!o_iefvy!SZ>>LRF2Oi-r2uQ`ntkN9u@+Yy-nbA1|ZRG#g(bK1mn;(K)7@PjM@k4wzeD>Ow(L~ap)T8(3N^L z^Hz)NI?W{*hc3TE7k$@S-jE;FT!L}vN_FTmM(x>baaCw8!8mjc5-zqw-cvHZdoJB_ zG_g~23C5u-&7sRzRs5{Q^_%7rj6+wtaGCd%XP?;A+Tv?5zQqShpyqmWtMAVleD82SA1P0 zA_&HzYXqoP+jw!}hCUWoN6jS|hpuelie9b(noBSaUFSM>LHByN z7|a=tfy4B=QLR_hf@$N6^Jf-L&(Vl5$Mjrr=c~MPI6R~vh5k{Crd(lp38iC0x=bk; zpPM^n#-y+m(h1h|oar-jolH!G!12?ZJQI~;SU6g>dsLw`{EG0Wps2`nD4I8?IINHU zPn9QA@a05LfeVvqQzp`Xs!^b`NAURK;=(BtN{aJ}gj|@%@=f6F$0?XlNJk*h*> ztJtRTC?5#`x)uY?J2bFJ>bv zgiGR?)5G%UHAs0hil}2NAzX_T!EzPDH*Zl6@H!7+VMsK+5dHVO7MTTSt1B2^Sd=Gy z$W7Hgg6s+5J{it2g(zwixUG|m^Vk_EF-8t`Sq$AcwfAFPd(LM0A3G>EGmDCpzUTIU zq{wc+N2+VO@tR%@L%8c!!)T?u1w`q(ZYj|~Zc&l_+%3n2P)>EbC)#Svg^{;1iO0v7 z&UsHPr^j)1DLF~U#i;xoAEV^-J_$L;$0#{{PD0M{F-lI~laOaa`W&Qgw!%L$uCm1W~E!nHWJ5iLVudF*?!w z6UCd}8l+trfs5u%k1v&yYT}UvKL$P?NAucMA9UsLfhZNC;cDS!@STu#pMG%a2xv6i zS9s=6gwR?(C5wNe;l2d@9wc7H=S~E^N{WVi2K0A;nb(jg^-3Wc?g8k%7MPBW6pnDg zMR*rU0DU_!KWiLcQB>zG=TBf_^}9RPUo>xA%y$R#{T|{B)yX>xxa1Sa<0Jo=layBk z+%+eV$LhWJB;`E?+}ab!<7=IdfH|OX$E&|1z|`coL4@k+kL7I-%s`Dhp1e$8&X1HA z;q8SV1B*0W(qGw2*;cL`qp*caxO z6`)lHLS+W%TpIJ#L7ZoWjs%v%7e`iTcVKCmUl2!;ZQr6&43pNH(Vem~XR^@V&(sUm zf>;d0r9|g~97w73UCZqhOdly&TNu+kP~I57L7vq4hZ9O-Kr#aGMuM~Yf$|GHi0_=A zQpZ;oFLK`wR8>k93z4V+bpqw7jIIxa%9;1f&YROi$FLeS6E18z zR|ZNCH}zfrH4;+S@Pm7xT$-X;)5v<+CM5b+4Qr|v(fd}dpMRu&NsMn*TC=l}ucwd- zLIBcUOV1c~Rwmxn_?A^*L0_|gcV}2hvw4ZBYj}-Z3Q8Kj+JW@a%4YkzAUmhb8xu%Q zDLF5&rhh_u#>lhM1_hGS;z|bPFSs&3txHM&SKBJ|DPh_1zUzMnEp-it=s@{x0c6Qu zfL)3qKFrX-cl~P8l2d$TPb0G6%DDassTsbq2XF#C^+ulME4xj&SUWc&R!!}c#J-B_ zV(c4GeLBCb?rU9LdLQ|2h{87w=PqGh=hQVE&0R$)IR(IkvfoP@ubICet0Utu)~+#r zLhKkCtZ!A_KzW+Sw`w~tkk_{=e*V!qCGosCz6`7+zQB{2@_8W~h+v`q-gm$d?EH%? zp$>-L5+5K*JCc-Jn$pAXWBK{}6#TIC5H2aF52#ykW_O_^u0^m^lgKMgq(i3J)agTn zi~1=^ca8E=$w?ac;0eIDs0AWfSj&c0@HW&MgC%W^w9;c8d}TMYUa;U7?LMnQ4F;jI z!?@tV@-klctk65MW=@S4xyh;zu?SEuw?Y)SgM1j(~xGGG>8yjyK%CBiezG`-Ld zS^T89vE#zPE71~R=fx^L>M4Q)l&vrElB(QS?wf|eEWKG(FlEE+Zo$x-S)I3FuneZW zS=1MUmoGD=qNI7CYJDK(&B6m*RbnF%Qyfzfn<2EKFfD}Grfz(z!?B%+wG&(wV!b5B9fLTu#u)t(<2)V?qY!H^ zvC)XBTV)Yq2|~LIF~y7TnqpEDV|;|z>5}?2Vr?ac#e$lbhEKhPmW`Oo)y!~gT{!j= zVtoY{=^;S*qr+_(%XM+94dPatfXzv8w+)7V&|}HZ9Ga5$OT(h)6ZHPs#{#8QHD=cc z{g$cM*Jje!gYudLFL1R2<-JUS{bU?<@LGmRolHO6Rox>X(Sm?9Ly*r@-8InY?Iu4VDJuNj*hCG03?Wq zwIgUv^l_)USq5&B-cO1zMO#gW1%q!@ET*m93+v&SJiAtAxqsWfmZ|0b*UqjfXK(DQ zhqL=}HUMdlXNBH``-aTzd*NZD;>(!S-#1|Hvfh`zEwgGvYFy(UfvU~Hl=liBGyRR= zuHTO{e>fST?+=;ya4MjQ952;1_j9t(3tjqSw*4xn!;@v`=PY$~QSET4aa8JdErv{4 z!)U-~6E6V@yG_+P`n9jDxmazzao%nkc$tl}xHOb0xuQGFFllB~vAs zx{8j{s)VALVEK@Pf%4(;0+hU1MNmG%kk5W9lekPl)VSGN;q^o{)v=X$8>Cz6S%~o$ zBW@Kk@aO@$mJHoM*i1ifOXE-X{U*S|bK2jXr!?6s+6vq_A)ZkKt zSXYs<5HZyUZbnS?ffi@gF;4ZIYt%njcX#b=u@$mRwR??hFc|a@#2a28{Mdl-DvWb| z9XJT8MVcxWhx1gS*_{Hg!J6S5L==aLkwe+scuuWnoSGYNoI1*9oZ72_acW`ngH3lg z-gZibTISDJab{4qShzon-vqC`Zp*?M7Bb6H;8-j{#->?4)e>YjI5TkSq4cX5^^X)< zi&nLadbh+Kglm8T?>MzYHGq_O{H)UR#he*9<|tVzMp+jMtwp;yBi_@)sC_VYw|&uX z0k|6jVafXvXJ+6OL&;My%F7X2cHzv4XN{U$kk>zR(X(Gva&pgTX6&GbJ|9kPAm_C!L2A=gt z?_JyC+ujr(H+b>Pq3NG3EO_9uLobhb`Q9Ek_1pbt?U<*lP8spUeBQ?l%iQxhMAK+p@1JdUy3HH&iujest@Qu5I5fJGb|`z0=!{ zc(v6h*StBl`GUixJr?8?3}2P7^QYb3J2Ecs=Y<5M@jm(rK+5Q(G|XDGd>OsMU%i z3R6^Ei2oo-NWlB2iT`-D7T1Mfh(h4_#$c@?8mtJYT@y1#Q>^tj1)9Q#110BL7v&xo z zFI|*FE=r85T&Oe4)zn4lq$zR0sC!M4rf_wXqR=NH16O@1%5ayQ90z53-t>vn!r?y2Cn|G>={>S zU4n7w;y7dJdT~Vk#unFB%_SIzt_H$&DitAop7(jFWe5Ge<`RrU7snw>*JEcaoMdtF zogaf>9J+WnwyeS*T`*#QT-YkSljahPLl?&(OIN~g(~B&w6wM_VhptnEi?bhIufoGu zjJIsAvox1r9J(4gbUpIpO)$@9dtn%-xdh|T#aV$`F+g2;9UlBXHq2G1xdh|T)kL_| zb;N4+4p)q@xUSP&f-&s2rF<~8)=b~I^|c*_9{UXA0nJ4WEJXjFXFaOIME%F5h5r)!@wyffy%O3s5YsGj5-Xhdtepj3muPjFYRSgKOp8wH~mz zay1t*O44nb0s`gOK3KI9IXju)2#iP7j4#UT(<=v-h;{>6O@+y#om#EQZf;(YGhZY)^n;M(f+V>xv@WIPD-?%o zLs&siijt5sv2bodan8gE5pXwod}J0$aAc8$DC$Xei#x87vf~l~=}?1nXtCMUl0Yle zqHu{pDWTnoW!*_3kXkg^D8PlJh24}{5-pf8H8;P9M43_3#`OQ(3NfNVMVbOdCP$hO zAzexvg-_9=FgV&}6h>#d7GSFf&0?q6K)Qx(Ad_MP+3U`Rw3D?R%%FgOaQ2AQK^bZ3 zem*%3Oy;B0z@&k_dkyR!etPm7COp%ho*5i6Xi#8;A5T;RllgUzXndF(n9QfDfysER z8ra?92>3Iy(?+C@$Q`)ym1G^G*!H}P)R!!T z#KgA8Hq?^H;eR&odiH>M5K7Q3J!5d{`N2`a%t8Iz;gFU!s-2TKBA7lrH7jFey95sB zKjZflel!0kwgKaFr_G!=_5Tg~0P|V9!E1y4cRsjgyIB+e%V$+yE@!ac6M2L8dU&av zfwfL+vVLY8V!Jz0i|f-H3t<0~$l-zAR|wRcYf z$IAZLh3oE;$NYVE5;#s$zx;o=dk^@iine`tLjr`}6+s|CKm-XX1QHOly*CI5DiT5x zAP|z6La`A+5R51m6v2X`2#N|eKok&^X5&E+Y={VtC>CspmG8Re%sF#rHyh6T{J!`9 zJ>P$Ru(@{Ty5_!T&a^XUcPEM$?H}DP{A_?n3#dP%cy;^tw*ek4^W#S1MHlM&v=NO+ ztqt(Vzl)-Hb^F)Z0FSO)wjK_{C|2M>o^8QM_ooR4+>m@Ti?WZh%Mi zvObCz?O!|aUXJ2L`$sp=yAAND93L9sk$+!C@uK}}58hW%ylDTZUj8(|qjEGIg%@3@ ztDlp99iw>B{?WL5aTG7wKkC2z4e)3iCEEax{If^#qWz=tx}$i}{?WL5r2!tb`*Bgc zXuITJz5yO>loUnrqWzCoC|FvR*?rppkL-SJ zfJgoJCj&gXPf556FS=0IeE`{QV}N%7c%2OJ$iGwrJhE#wz@u@kaV8?p%YsB?fq8_bCHBvb)Y8 zZ@U2=**#!@M|M9m$os(nkJ^3QSiI;$UG0>{=Vk_Yl-~sgcr^Yc8Q{@6F(ryucmGI_ z;zjolx<49XkmoVLqy9T4idVOPW03cX0Uou39R_$bU%qRQch~@r?0#v0$L^yH^3EFIk=^)l zc+rKr`Y+jSVUX9+0FSP3PXjz^SC>WcqWcH6`wRm-YR`iW@Ti>*i{eGMQ_9Z~#f$cj z>e&~?i_VXDqYUuKzdQpx%5RcE-gO3eWcLOGJhD62Aa9WY9@%}s0FUfGYLK_a0FUgx zXn;rUU~?2Nx*gDX^+psgx*bq|d(Qxm%KMQ49zB2i(g2V0`@taZcLO}K8&BVq(}lXm z7qZ*RAnzgrJhI!<0FUerFv!a`z$3dh13a=DGQgv8@+yP82?lu7uBIB`k=^MAc$D94 z13YT?w;SM*-3JWt$nFXQJhJ6B@W}2l13a?(odF)T zzdsD{D8Gd9c+rKr`Y+w@w;8V^0oKJMyWI@%$nK>Ecw~2w0Up`48{m=MpaCA)y~Y5K z>=ql~k=;rIJhEG3fJg1>P6Is3?*Rimx}SN{0FT<~O9psJ;B7U)>jK{A26$xmF9WHIt|IQ!4TqjH=EXV&EN=l1|O z-HOl88wSo>=iz1J0(=S1#Z#61=)Rz?`Wu9JJ2=;K9(}Gh7Vl1Q-Za2F3{J}u#cqB1 z^#Etgd3ZySO$j(porg!)Z8JEwX^P!g?PWQV^TGMc0Iw5T_shJ6$I5RZ^7{asv1Rq! zCI7Amr$KrBJle`m0_O(K)9NqcS5;escNgaw??^2-1xCz2PDAAQd9TFzk^;w4u7T?gJx2J%~O zFu&))+iW1ej|}Gb9eBSR$nU~RwWP}5Smo^p-eAtv>bZ{k8)Y!RV(_ZZlOOeudkyCI z40s#PlOJ8*g9h{a8oXZ(FMet~zzq>A8#5Wqx zVnMzng7^Q2Upp=&|vDz2K8{tuTjqs?vMtD?SJulXE1C9Oq75)96gjo6MuLb27tNtR#g;>`k z)_8F~Ut?X5NdIEljr1>8ev$sg%1?hS$oE*h$oRTT48BkNt|MB0hPYoQAM!@sfWv3o>*vC7vgf*0wxnjC2-7Vkg3 zE~=gL{f$+Q$oh@+SIsvvK2|v*?Zo0m#z($a?MC*KSUjWsB(fjJ%8$0e^dT0njh+M? zi`Uj5uU!Ps=-bG8S9OusEfy~_KJvYqUu5}W@glEVEMDYwi_BlO``>asVwEGZU8#N> z{To?ds*bK-FZB)n*2n9q;~9Z8XT-7JT&9PCaqP#TsGY`{lJMGrp+0z}Euc7d^h9Td z%y{j}kQ=WwV#b-mcui(#JYFwhXfj^=GE|P&{tV5;Ybrwv@S4HUV!YDhn>f=_yk;}B z03?0R5kfD=!9nR2cypCiDRQ7$~I8!1J zeKQ1gpvBQIv(u;S;!J&j#xs-(RKQRc5T2BO1nmtpDYNt|gs5bYDk znI;3#?o^ycA&Qt?*149ddZf0mP&@BwD0J@c-)j+o~v<~QYhBg8%VrVxI)m)ru zAJDxF9R|9ep`$<#GISc~A%@NZJ<5;?%cI8`N(6e6p^iYS8A<|rh9UZu*yk8Z1zOLL z8R#X3+&~)`3In~$&={cC8JY~VjUoD7^BoM$1lq|^4bUEj76ZM*5S^U^jP%+P6|t_;!gzdJ*TK*ya&3Rp&FnZhPDCO7}^KqWau!EhoPfDeuhp1g%~;uG=d>o43A=n&J-KNP)DF^ z7)k;f$51LzK0{eRg$$X2CNV_Ey-Zf6dKy+9K zMi8Lc3~d9N%g{cc`3xNfTF4OHG%aGNHPB*)Is)CxP#+*Vj0dA0(1Q$_fgWNg4D={N zu8FB-e&`U9%0>v{l8K@CMjsssU=w&|;ug3@rs}%g{a``qgWA07NH&#hFfO z=q%91EG`iXj&2OK)=&~q4;GgS)Qh1k4Y`5(u(&Zm{TLdrp>m)U7FPq5#?S%{Ed?6L z;#LCObsw1S~5pp^`{fmSgz251dK;r87}^H(21EOR-el-7&@P5f0_|n!ED#;1hwF>mT$@kh86&Q&(Kn!9~oK! z^b14lfPQ0W8_*vN?FRarAyZ4_g&7O}0VOch5vVakeSn%Wlm*m+Au~{GhQdJY7#a_B z0Yj64E@EgV(8UZb0P4ojVxS%jtpMu9&^n+#3~dCWW6m(c0;Mo?7$}XQqd)^0It?_K zA^OSlAq*t~4P&SykeQ)AKsJU_ft(DPfjkU_f&2`O0SYlR8HkQoL+t{MVyFga3`5(1 z#xk@ID377TKob}`2~@<;Ss+?z;Oe(Vk78&PsJCSy)jS6FRA926j#kM`89ylM4pNtU&b#j=PIuwkHtMTF0xMmZJQF@mamvo&LIZ2BY#8C;&c{WwW zRV78Hk?d8$qY_ehT4AYB*o!Nxic2R|l9}oQxk@A61z@smSCjnw6xWQC)iRM0|P_(MqgiW>ryXA!<%fWK9buE2}3=DJrP4 zlqj7cS9zO+_evKYKi?fU|EyK1snVjV%7XmzBKTTSRfS*FHU)W1k_|B^aRGX168+Y; zX;haa?hBE5Qn;+7xS+VG(xj(rk)yh_Khe97d@&=Pp-8#VMHR$0jr8XxjV_vygf5M!B#NW!htgq`F>zf3 zt}7@hMxvy%v8Wh2HfX{g_2Jy&Nu_Ao7&QxvlGHamf7YYHV?z;s#k>mFiOloSNEgEe zY^;Q!s(4xvM#^dBl=DcuNz&eNW)tpu$d(&ctrFI|kPtWLcrUeXW)xRem-e5SU)sO0 zXnJu$k!f^s|J+eQw3CwJ{L+G=Bxi9^Nnw%&#~dV~P0T2(n3~kbX$fA++JPy*bQZhH zvrLxKSxFr7!8R_zG_5dmbaB<>5xEveDf<3-yaN3(u_$m2c1unIY^T35 z3klyFmVkMwps+H({|wYie^yfb!o6BgYRSPvo0f@GLYd0TOymZUWRxv}tdy3>@eyPy zl}zU4ByvIonaU%RDMoDwP3fBF=34rPb91%GI8#MszT7O7%4opaW>G=7dIAO&ba`b8 z!g%ShB~8WKezzpVv8kr0!0v`wicFeVR)KW9XB8Tcajmkbpgb)*y&{bSrta)LDhKa5 zrLhu~Ifzqwu=gk>f8Ue6&rDC_@4K=0$a1QZWs;&#AIRS~Ro-U~qW8)1@eLB=;u@PK z(2!qVR#p+`zLZYq&+&AEllx9NX z@1LgTgJWfscxvR7LVvlBO0%J10d1P4;jfy;hIFMfvovbTY8o51m0ruzsO93SDEU*Rk9T><;wgZn+j6X*|@EwbDxl|^NNkuES>yO^m@4tTCMBvg z!#CfE#r1%?DsEf-)HMmVhue~nPP9XB_0Ro?z_Cnj2;>1Zu#TE2Oqqs)otBja8dhv z+~;;I8gbIHsC^jRiUX$-=bdXcuPM^z{?VY-ZGXWT#J8GDn|d`vQ(DcVy+3F&_QcHp zcP0NfKwQ*(A?5Eu{>|OG{GUb|@~><%_xDR$-Sz-w2}heV1GHfa5zaxr$MVL}cuVcJ z-}VjN-RidM5O0a!UHb-#SG)ajt&b2wSPK}C1>qEY{-*8>Fiq7mns*AT%P=b3vluKE-!;~S{>iHljeGPX_B_*>d7 z^6snoy~&KO8Rv#6Wjg`pqJ$bMoB8CT1S=Ko5LMj2=-O#T*+TEm?Wo<2V}Z5&a5gzC zd(Lf}x2O7NPwifJzjr+--<)ie04EuHaOrBkn2qu+@ZutWp!=o*KqM0lto_{)P%L$AT<8{YqOaO^6>Rjx)`v)imBpt>#pQr}j!Tq_^C)Z=a;x zJhj2r3}kHcEF9O`v#>PLvWuNV`}MNF&z)nHp>b+=d3HImO99y~C-zkF)0NdAu?D!2 zH8))=qz7V4(QOjgR+@tLqFuef;%Ia0L566%NkRN%cN`c^O~0esy>OT|eVY%bCI1Ak z-Sf^=4Rp^PMlq(UzV6za6W!Uf606&}S;27XaT8V^oTuK$J$FYRlFS`ys{VN6ew1H1 z=$sw;jQ(Th9fpogKkBZvC3zM$%Gh@5V|wn1O;@`dRfAbI*n=nprlbgFJWJx>Fa- zJ==%gr?K~kPc^b^N(J;QYpR9zWVEgiJhkt!0sB-3d+lzXq>IM%cVln&QuojumEGL^ z4*TOzXKZty+vOQLJF(TA0NjP2?fadoed|=ajkE|j)tt>lry6ct!AecV#85wmMt)uS z>BA*iY(2LN=pkiJ0vgKV=tBldoI2C+bzoJiY1)Ro3lVc7&8gHmdahqosg6c_{^?m4H&{m@5H4yD1p0 z+!Uy*mO$-kf9)UtvxQ6l^DbQc+CnRD2d!Q{VJk{n|@$lNyHNX3U21f7s24<_rIn^}=sJ`pLtO5xAp& zp+7k(chr^CY_mMIr`?N6l4sKFQTsa^mg%0fkH7Xkf9($UE{xd7!{n|#L?hnZJq`F$ zdlQD*bFJKOV1CKU8+YwBJGz6lj5R+y&~k?2+BP(`ozSwp#rWpoW;72VT%-J9uP=fX z4_EPnT?{1xy~R+Rt*OaY)y#B7VN+Affz3@VM>IX1c(hTNWb_#)HN2$dpdiZOZ6$}+ zjZCczo0wV;OfQ`Y?85KljQT(Pn>G`@E z>dN;^mTz2#L{o<<{4Z>5>M*d8sY803qoi7(O7Zs<#w3dhB8y+wt6r#6Z_v~VBJ~gT zs`a)vYH9_M`d7p1O`2Lkr2f;e`c+M>AW~x^3avY?Q&Ur?<4sJRP;;G7bDdCgozgEj z4T5Poz3{ME%RxbuLt`a}81=5Nxz{wcf=Jz>UiAXiF#f)-sTD+ObOQ1|hHbrii>6i( zsV}Nmt@nJZrdANCyBSt*)6@zgb+3BWde7g`)CwYXKSgcus%_VDP!Q#i#&YOYkkYH# zME`p>p4j1%PFp*5==kK#NpqicWjP=8cKW^Du|^MDE<5$cvTh5GJ~;8jfG2;yxlirH zsoysa27B$hq1~Q&S(bl|`0Pa2AIq=3_k$Pb|8?Q_@1Gj^&aT4u7TxUp?5m{HEvufJ z>bmErzd{?jr#PDr`E%>xC5zV{Hvc%cUAM9kvnn6&;vbQB?3pju+JAHm+COLfYmaSu zWyHqPsdp~<_S3(5r8K{<;d_1j->&(t>z7Yl-Qd*Wd&>^>*jw^emqSAvwQO?u$&oiS z9M(Je-Ny#wMV{vYxo%N%{PU{wYaT)%ja7?H*WM54Xpj2 z?fUNMWp9r!`hBuv!pvS@jGgu2hkaK!EWCbI%V#?zTooTUP*vOi(+h(ytT~yo;kP5< zlON{1o_W&`YoA>(ZSF6R@BaCODfQkpEB2N&9W?D*{Ft5zSFzF_gR9dn<(=jpT8hkGs@mS63%yy|cHguOiJ z^9Rn{v!Uh-_FJv+a8$$^?jb1&O|N6o(VS9$;C-1YLsH~uvv;ras&8h5HF>)!j{PiH?EA5O^b zoYU~&*Ee7FkEO#J>($FQ{5E>zzrS9bcIl2sKfGgZ^VbEgT`_Os=T|=T z!m(Zd8Zs@pW5cdP9!}XZaKp~KZuPEw-C6eO$h|GUf7Y?(bN`x`Q{mV=JS-yt%OgZ)8$j=|^I^>(~kG1^l`x~o1 z-afgtdF!oL4P4N2{i!8mQ>NaUG=10-^K+vHCVX*puRrzn7W<2zXt%_1e^&Y67moh; z)u#6*`g2xqYP)P@`-flN|M{Ot!z-^| z=SUtNoV((Rzcy$0PtJ;WpIvTwG9&KsXL9y#{`8f}2Y&NEdqLid@6YLR$=lD3oip&F zqaV0m+q=3=pPPQ&cv1D0?LG@TCx3f+mgn-k-FIfqE?nQq<9+m!M^j#Z;G)ZqU-{4M zWf#o&?)riQ{&nB2xpC4u*OvAjT27deGBWeZwU_4EZr#%1shl5HZ8=o+<96-iMUk&G6 z7dNO`Yv+tv1NxmqfP`4((|30GQ53gAlJo3{Ae@$vSd$~8ftmz9K`@f&i z`?c57-s%7AN68KTerVUq*=_&z?gQI0hOg@T=c0yvj*n}w=;OFCLn?lov;W{1R|m5; z|JLN`l_kF{==jsKzh!P%*<$&RPn{fjPg0iqsoN*L@O8!6y-ychGiddhnqT&8n*K{% zuP#dt-kY;v^q0kZ&W?R)@3Hh5H+7lceMP~_sjZ%Q?YY?xe|-Ov&%S!D=7l!xPj6W< zwYtoW}J6`#y#TI9h^<;}FeTueT_t^SwgO4Xw>==3b1)ucU zvuE=gYrQQh*IjqC;l+={t+{seee?dT{L|O1X26pTn{4>!p=I_by3POL!OW6{*G*_W zp-cX4f3*1FnOlCkGpa(4z?r zpWd-{M(3On?^_0rZ#b#xpCdxgbiVPk7N^qfnHEp+mDeq^Z_XOC*gfr?_{(~CnR`R_ zyRNkfee*sHUjJo>y>ERob;Pi|U(cppKPTyy(y!j@Ir^)-@h{)=zztugygQ=N@f$wh z8o&1Swtvn1HPPa_z2(r&o-SL5HEEje`gdw^!+{sP^r-#B#|vk!`SZoAKG?td&e^HA zzy491`D33wxogkjJHE@g=c_+HeJb2+Yp=h1Jm&qq+qc#wr)~;u+!9#-$|H@JwLP@5 z$$c+Am9~3+!s-RC)Qsou^R`;|V&cJp|IFv##mzchMxAy0sciwxf-GrT{@ma3X zb8GIu>p9ER3A?UMSaR7riNj}q^WjVH-t@~}@6_8CHBM~v@@tbGx?t^sM?da6y?J$u z%e#g*AHQ|^%4NykKib@T;^P;`x)VOmIWVVH#gOo7=X>^n{*has?cM2%J5~jUx#p#{ z`ulV1l&jJg9em~WGrh(fI#>DDy)7>`o&0X~151wWwXK|z_0{yy_=_^yo*8p_$5jj4 z?(DW^-J_<}cP6x&y8K|Ea((w7?>(HCl$&zTv{i4lp8UZ#iw_L??Wtd;o(s%=ZpxW) z-(@vQJ&^w0yuEEMC>U6F?*3lZr*5?zdwa^A-+x`P`MuQz&n@dVHTnK)-~6l1jGn*$ z@#A-|y1IYKt+V&`zGi9p z2m9QfBj)MX&mK3*KfK>x*9`dg&UQJ$xSLD>(4*BdODuezfG0SI6Am_tz`BEzfUr@S`RJuN?H`&A*xEG<(Cgd&|+Z13x@; zvR-&LD4*6evLW6;?PhacRq`Jwp_K9Ig7w>){*l`Z{~dgf(K-!Ok_*SPiJ z4WnAW^l-~5w!o;HuRKvTwZXY#hnwECarUgKZ%y6fdg!w$kA3__)#2mg-#mQrpnd1o zJ=S;H{m0i^8cv<^^xf&^){j57wqN7b4R^1xpSyRD5^AXz%vy9*d?v_IkmPzf*S}d35+=kA~L1|HImhZIORt zrJLUgewH=nt(t3>*rz5Z1Z!jcoi^x9S%;g-d}_XDW^E|%XMJa@`uBl`udW!|wi z`n4zb1kN;nKYZPi&L7Tr`tEkqwzUiNx?o0otuA{d+*KT|7wp+fmjCg$QOW{ki zANb>pnm%ULGcU|p@!;bvPu}ip-t@-dzxNMKX|ihLku7PV7KslIJvr>FclthdaOu5m znvWV<(EXJ`na8`mGxZkJXM0{-HLCKDk=Lv5^L{yU-;lO>tJL?A>9OA5QDytF=H?Ic zxBqqDA2%;p-cr^7PxFi9N4{6>N80PWZoK1@r?1_#>d%Ck55F*c8uWPMJe%g6UV|` z3BT=AtkK&Gl}NUC(LhqshX>;0R0CTI`gam4+9jtz99cy>4e|Jhl@e+{|M0j_sb{MZ zM^<4E0V?vGLfhfJFBYm);>aqp zBFfdoM90&pD*7%R1>(pm+HDf$vVRtjFV(85GOi+ytfCeuTGStprcD*9TCO6FtfK21 zAE)el;rl^9uLug&TCO6FtZK(pYCGJN*ngc+ZRaZD$ST@96Xn{uH4{v=T!*-dII^k( zQ>p!L=BE$h3$Lo`N3J4{th#`y=sHrkGwu4pLe-Vai6g7Xinv~TbHA7&R9A2nab#6T zrc%d^+wM$3gz6!EGm8RoWYtB8iH~C+djM*m*$*98Rh4o;99f0I1uC^2u6yjYTZHN{ zt|E@C>daK?_4>A;>1#suI#&@#R$*{~E$Xclek(Z#CMTQrb3hzfMJ0-lQ)@nb>kwTX zHsCH0M^<%ZDz#VsF!IzOVXFsM5l2>aV=A@go2-0xzEIKkdngb`RwW@OK91Tah2d{_ zb=PYGS0y1uR&_^Ad>r+03RTxX@vE>^%T>gYRXq?RYGdS=C8#j94xi;J;>fC=Or@5q zi=*Rup?a6Ah$E|#nTmQ4g@WgX{v%YhCrg1ivZ@zi;^Wksf9V0Uu0^%wE)Yjn^=2xy zHr~5&)Sbc>eTa?%ab(pch!G>e*sA!|LUkoq5l2?_VJdZoeJ5#El2BD}6>((MrA(#H zu*c)N{v=cnauso8RbQr}xrV}rpN5=5wTY{UBdhu$MwH8a&nvny>JV2EM^;_NRB9c* zIBCV*!q(4RMI2expQ+Rtc4Kx+JjqsD)CIKAKp>8+N+tV%;ne4JYI@ynZ?6t?DZ6>(%$I#cn+ zZF=wb0T{;A+IWJih$E{oq3W(zucx10BvhNYia4@rAXBM5<=k`2{}if&TtysNMb9|J zh~4eer>6?l?_5P3S%u+Gr+RJNHD3!=`$kAaAdajWj2O`lk6nIhyHE|_D&okhET*Da zgTk+e?nVPw>(Ikh#F16mh>4G*nU}&x#|y6&s##n`99cC4G4XNg81+z_l%IuaC07wg zRt;q;wH=x}mW>vwy<9~cS#>#6sUtx9HLoles(*78ab(pnrsBz_b#Gm=MW`BMj;25y zS#3@W37FQ8RR#}-!t-~?b{irL~Gh9U+S!H7?wOompZiKUHi`vUo#F14f z20T>9jRT9PV?a_>Uvd?3WR-)d)K$t6+qZWLRTDl;5=T}!B~?rF`Zt8C7grHSR=Jo; z9izIWT#bQN_0Ymq#F15Qrs4%KO?#~5IibQsLKcW4t2|7_lT9_x&U;I!?&Q(LkyT!% zQfvP4mebL#RS(y26>(&hkEzsh*ZeKPkg;m(C$1untO_ty z8@y8RuMMLMs;W*+lvv`(svu&-{Pl76uC+py!&StQRUxKQYhz`L)1L^{NUkD|tO_&L zg?OdV=JSf%glZaB5l2=HM@)R2+ADvVx#D}FdXTG#BdbO*m0BB%|M(E@sI@`A9zlUP zO56#=gfZFCd>1e6LgZ46ws+C}&g~0Tjmh*A&xbg&^^r`amULxR^XrAGCGS$ikyWFZ zN-gOd4IbSlR71InII`+Wrc$rPjUT*RCR7u+ia4?g13k*s3a=D?uK8`5P~FT`#F15F z5F_qfzPS2jOkZlPKF(FdkyTeQmFnThZbujcF9=(?ia4_BYQ%`^zH@%!Wy01cTtysN zbq!OgeJ6M191Kyahw;245=T~zWh&LfmEZodS*R}KD&oj0Ow905ovCk$w;*HH7X5Yy z1>(r6aflK7S{r7s?ITo`TtysNmB&=P*rsg@-is5eWn4uZSv8)iR1Y^zUW`dV^>7bY z5l2?#GgT+NQh4#7o5l;(FI+_&Sv3JMqNlVuwdN+FN^Xus1mei50>s3}skSb!>2SAD zUBOkvkyV9ErIxGLRSVY$RVh~yM^+Uvm3ozj9eZxNP|@#^P#})1nuwVAxXzS_@J4wi zCLFa6U*am_$f`+*iH}o9fPbI(9*tgAo!~0s$g0UqrFyu3_Q@Kd`irZGBdbagBRu@}_#h0T zYW<|OL?QxlWEF-{s8kP6Z8~_5P!)0&ab#6FQ>h+4e=z$Qp{nI7;>fD&n2Jv)re_cK z_Y2iFt|E@Cs$eR0zNk3U8X2hN`kAYUBdaQzidU9tK+B5{2~}r4ArMDaRWX(7;S^g5 z8iH!;a;_qdtg2?J3-C(eP3P)8LRH39#F16#mZ*8PTS}OkyW#pidV7e#v${pLe&jpECu4os_PLW+TkU` zw!b1&7Oo(%0hHQAK&N3s; zY@8!ho4JZOvI-p@Ds`;;e8z~ALUo#}h$E|JGu5SdrBFKjI#ifiu5P^B5l4v|gP3g% zVFxkt3ay4>@FNULxM<f; z#b|D->KU#gjuN+*Vj9)uGa9tcdec42uTwSH8{_#9N49<|Q>nAwhZp|!hfpQ*20|QJ zHIJ#(mhj7|+!aEV##O|TRr8rjZ3(`!HJEnPlIC(1aby)1^tzU?bJC9!glZmF5l2=n zU@EmY)eijNRiRqXRm7213z%etxz4{D&okh+nK5(UMaj?6W>Fq8u4L(II;>^ zqg?#Ln2t4{)K{p|xr#Wl>JFw-J$&n6{28ITnyZK-s}?bp>fxHCpEn5A9b82mS#>8< zsUDt~*|m#MZR9HA$f~=TO7*aT&ALgbj&c=oWYuD(Qazly@||yls%?8DA`nMb-HjMg zhr_@3KPpsLa20W6)jdq5dT6V-YK2fuz!g6>((M{fH6IbDQsM(O0P2@h(mrS@i%@@gdc8 zdr(J!gJ@NkyQ^dmFi*KZz)+q)$jr&A`nMbJ&YLP;lZ`@ z#t2mgR}n{6JtC=UOAkFMRM&77aby*mIBcmNns;V)7pl2jMI2eRf~oirX38IO=wqQ; z&sD^cRgX!koU`*T5vq^4ia4_Bai&r|ye(W+Dpcx}P8?aaQnK~Z?}Jwf)d0Q_Adakh zLQ;J*wCEb48qHP2kyWT@)S)^8+J@Jhk)&Bo0_^*mP*M`>m6 zA%=coH6AhY>f$Mi(X5AtecN2sU~iu1Lmb)qYNk?Ww6&J(Plc*kM#tjJSio z_0os_EmW6r6>((M(@X{DS=jPwO^Q%ixr#Wl3PS*FwNgZ;4@bWHmr#{(6>((MT1l1g z>uWHp_S3t#ia4_BS*B`)R|=btoZTT*FLD)eWYu$s5hG-1UYE;->SL}Vj;wl~snij2 zUYC)d3DvJ$MI6QJi!Z{jhN2A7*L@w!N9`9K++j?)YDxP*MS(c7_4SAmt>x;(<(N!V z)spb+@O|rJLUkQi5l2?NDA~$x|I%ARwUn!fBdcCwDz#kq{?POjp?Zm{ zh$E|BmTWz4dRSMh$GD0(vg#G4Qp>gC^`-IBERm721o0v)+TV6a+rW;!(a}{x9)vJ=NuD>3{P^VtyTe*rjvI+x` zu5CQIn10SdRXxL1#F166Nw#`?-t14I+Qn7GkyWotwsziO`%tL9sJ*cpik#F1575hL3CwM(bGCsh5pia4@ro1|LfGLIE14_6UKR=vSgYVY0}t~el6 zH*pnlWYu=2QpdW>HtqYDP(8*~#F14Pq;%zaGV#~bLbZddh$E}sWGdCeq`Ni*gz7i0 zB95#=*M%+B!xtxZa0^xEi;;*x99gv!F{0*sKL7kGp&G_j#F16Im`e3<@$e-WB-E>X z9aj-YR_$gg)x-FWgVAwS)e^2EjuN*4G4yNL(c>zH0Qj7MR|=m^8jgxr^V!4mA&zW) zFJj{HgLF!0dHLO+3e_>LB95$jo2gV=4_)c~M5zAcD&okhcbKXnUMcuG9kK~kyDmyB zaTKrnA||z2T_t@N95Et&u&Uo3ss`V@<@pdtwvNuDE9vGVS7Fdn>t{Sy5l2?N&s3Pm zSa{@R`=vrPi>rtutM(yAtWIAZcy6Xp-N#kLkyYqCP_@7-g-_0{eO{=xa}{x9)qcbX zRr_DI3>B*5TtysN^#N0<YOW%VtU4swnsWA_OQ@dYD&okh!;+C% z+BV+gD&okhkC;mJu+R0sP86yyxr#Wl>SM{)sY6qj2vz%TNJJoxtU?FV)nP{a6}UL6 zhv{5J93^fzVv?FeK`QB~E4nxGX@XZ4E^p>jHTY$4o)2+k>z^S;j1t#$-?Uh$Zs#iE z$f_eurH&HbNuRzZR8Mdfab(r!Ow|al6yD$KsuZeMxr#Wl>L_Bwn)Yz-U2h827hFXg zS@i`|skRo}`ukv^`irZGBdd-vm3rN;efOm@q3V!?Lap=FkQI{Tb+AA*qV@pLMO*EnlHFv{tBVmlY~SB;>fC#h!M6vneu(MP#sS~A_8$_)z^p-s#&*eSRqs$ zx+4*RII`*+#0U=$eRn`tu5_*nAeygoC26RMB7 zia4_BG*hV~e>-dUQla{TtB513eq<`O4j*~sLAy|0gsVV-II`*|#E9<&JUH^(YN7IS z6>((M&rGG-`hH4DoKQ{WD&okhUnJG=IdMCLY9Ut?MU1G!zOU@sCRBZTA`yW& zvg&ul2oJAa;Ce}@JX}Q_S@nmc`rznbTvFA;NnAx7S@kDVsdad+`V!sja6eZOM^^nM z*;?RxYPYbpfvbq4*gr@yEm0;?N%P>}EFX0qoHK6NELDRi_BgYRrGxzF;fSuPae~k$SVBAwa(Vh>8T5a zY9?0^M^@oyjiFMqYp(O~7pG^7 zP#xzg;>fCoOr?6bV{sZ9uWGA7FH{}^ab#5^rc$r+`$_k{BUC-Pia4^WF;l5yoq1p9 z%Y`b$Rm721iA<$>IHOU)^+Gj`tB513aQKL>4)1KU;Gj_5#Z|n^>9hMKg~k* zI#&@#RyAWP)x*c%nv1DJt;0{aia4^WIa8_QYWwNab=T`}t|E@CY9ZPBE;(V6u$9uA zT`m)GWK~P1LWgBx-Qz8ES2@I0#F164m`e5VP_Jv22wN3gMI2exnyJ*<_$GW)Sg2NV z6>(%$8>Uh{-0)$QuBW`oRm721bn2cMSMP6czC+mhimQkttJ*P@>fyMZ1NIA5$4itt zB95$T&s3_1@#fwEp~~he;>apG4N!QP*r}66sK#;?ab(p6Or?5Q+wlG8glZ925l2>C z$W*F_AI{yGCRERH6>(%$N2XHy@`&4N#|YKGxQaNk>LSV3%@aRcBUA}}lsY7itm?#6 zt(0Wbdh1f%+|-M!h@K?8lj;!j!R9(30$fmZsv2Hh45l2?hovxUhPCQ#&E^M9SD&=li|GndGOr?7G zuWMf4DO7_lRa_vBY%7VWR1dpOdmkzt|{n1}{>i2+U@#!-E)+n-AfYM{krl5+Q^hLvoOCZUn%Ke#E5TTz3u(5 zWRUiW#csUj8OM}TE>u}e)f`z+e_#BAKT)Vsxr%WlTQoMt$8}T;n}!C)_wA?IGIJH< zNVbMZwvO3;y!AT*Ww&ExTl^?2#iiLUop_7)P?@h_cmFv(+Uk`e@ zzqyKWBwPL{TSC=rfKu~}BiRZtl{#)@Egm)`L$fu2s~AVJ6_ji}wfdV1p$c&o<4Cqb zQRNz_*(&8K#*u7=C0o=sgz8?dVjRiV@F-h-HCr3Fig6@cBP3hYHiYUBS22!cD>us4 zrJAiXT*Ww&t&vf-gsMZTa=jQwvNbBoRv*n)23IkTWa~=F7S*9pjpHiDk!+2QvX!ja zTEJC|BiR}gWlN}D<|@XKY+V&)tCwc$3$9`u$=219ExKMpm4G{U3XCJ!x`wIrZ9ZMI z)tjprN3u0mvPErPr~+KYILvA#ViFlLVI8HvKfRXa(}<@%>)!VyF_iE$&xbg&Y8+G1 z-4BJA|J4(7pQ_r!Rm6d+VDi*TzWmB#sR zJexT$H6!E**c`5ac~nla#ex5Jvxz5Jt!7)m9&`o60dsL-PIi7(PBwn0j32qI(E?_d zB^(I3tbQ}jt3_%~CLIN=rKej1UXR-y4x4R3Ei%JxxBG(@n^&{z($cIpvpp0HI{hw} z&aQThv&I{Yv(LN%r^f=jELBTMb2;6%ur=T^+qAe0m(OMiSzR8@qFYM~n;mXf*yZvB zHG}H8&>ANzoVPKvfr;?zedDwvf|d&K;@cl@SbkLf){=$?Xi%Qmk&X)fRAB z+yT30Ci2*7jT|%w++nN76SkZ6Cs}LhX#sD*?GFWf=8zVb5pa2(zL3kI6;Tx58Z?LP z9t#?Vs8YRgaT2zcU6$A5@Hu=TD|wKUNrz)=Y3cre-{EjtkTyz-%(jL+zOdgNGUp`Q zd^yP;mz!R4W}p=Z@!y&=m|iu0(Cl&htrnLfY}TK%t)+*})=q;@s<;Oy&4) zjS)150wK54hyGD#4jHbn&+c-DL#i8Ai>9?Y%pt2a;6wLSd#!ZBw?+(`eO_0<<@W{5 z%K6^W#SNK#7OOSv3%ks9=aJ!d`8`gDKdd<->KhJNU4EA>mg_Sv`Kuex-6wxkef6 za0KmEuPtQeCzop}>HbjA;R%~_b%U0}XYu*{9<5K?d>S1Wz+(&fT^^elw6t^2HJ0D( z4!G?>C)n&LbX<6OsPucS!LZG4cIm7-?N+PDhrx^w(KgY|!seje?{?ZkZmops!ReaK zEVs=Wu)7^0vwFC?ND5ngLBBJEKFZHs*OD@<0d%(jx{qQtRZFq@%;+RGugmVyjMj1D zy5Kv_A-gvm4Ecg)aa?;&rgmPtU^>ipi^J^ed}4;LE-k*Ux=5S@FSs@gfDVVl z<3MFF5>*Es{64X`s6x=JX16!s3Oj-}b97$H0xvZ?56>&q^;?G1?e_XY0UNnz#f*pw zQPZ$E2)mtjALe{kHw8sG*%R_BiwkUJrIl55D0Ee&AluANOr3U{+itcJDJQcoS_UT9 zP#70UwPy)yS%l4~D8D;^MoTS|%;8+@QI+|V#6X{Ia|A4bAXaEN%@zv)DKR4$ayjjo z?bXb&;?W9YGy5H(fZv5FM9m%bfL!D}s6klVP8U|SX2;B`qSC^m!ko;yjJceSa3G*u zSXOhoSq;M(x-*LD)QnYDPnd#V;fLM^2<@91w|EAw6+%&}gkTX0Ud)Vu-vnh@&W8T#)2hAAlu!O~=r8cSj>Z-|Q6~$GvV%YYY zogr7yd zo#KR>R&zKM^je%)6Ofxz%TYl^71N6<$OAzOncZP$$Qukg%p?7|Ihmu2Cgfyd?Fk}U zB&pg|Oum1?3a2j&?|*dL_jb$#xL@emE(=Lk6cZl70kr=X-5nMb zu`yz7cbv|k-yXuf=y}}HT|}E1L$)K}3Rr|YSX$;5Pbw`gourjCXtue%Zdym-PO=c4 zB9f4WC4B_-|BMud@gb4Q3o#z zi|KI4jXCH%RUmFPG2~gT4&?1rW+G}JRmIbaaA!HKTwezvvnvp=`U4KM5Tv6HA{kk} zu-y@Kxn1>JAFNd?iWLe4EKaLi87awj$d((9tX))p*c-&HC+tr z7kPAXPIm67AdS@}#rdTebuyjBMJ1RkEEPrh7`=qP2T~x+hX%sB0R{+ zhERAB@?imo#mjlT5VvhubfFG{Rwp_Wd67A&UN0~OhTJY}CF!mM>H%J4itV0kpVRKf z9V_c3^|SUC0GWTvIpTNl_C4A|_r8IJSHc9%EErk|pM!b-H<8PpxJrRE5hAFFs=SgbE?cF}1h z7RFJmF1`95t2Y`k!P~G-w|YVzm&F`uSl=Cg;QEbD1mHfzvBclNr=6KPyG zo!iU-i_40;4tKP1UDJbc+;`fYxXq8YuH$9dJpsE7Lt8!8rP&*mXvYqPJ<7Vi$-%lm z?6L-MI~iqN&&zVVJvP5T$mTEJK_bhp8z$K%v>jUst|;sJrUvT)yT@wrJ3Ud>^}Ot` z-4%4(Eo?OvvwMo}jLr0Lz~XZ_Sxe7FTgndS<|?yJ`BZ5Nuv)xWouEt9-{r*A7&3=# z?jY`G9p;M4{5ppI47*b(aW?>Fxc;K2E9I;M`uW_Ky)nK+>31~Y`gh90c9Ve zs32TD0XGO(H*1;UX@JFx{d>%DY*UDCDjl|*OstAEPNpYF+xytuQo6B+ZiM)puiNt( z?85@j2iMpluc!d)BejR4M+QPxi_dGr7Qd2vPUgfiEPBzjKx1q1g7Umc73HcV%j@vD ze0HpZM0KjAWPMXAX*Q-`>}}bxOW|Le=?c_H4FMroxp?t>OH%-G}I2=b{96aoaPC% zyHZ|ORuYykQP>>z;+cTc?hq82ksS(nEO^$V+yd2SS+~@%;I0%)Yrn@QvJJ~uHjHf% zJB=ZJL6I5ReqYdsn_)In)>~#VyQ0iKOVAp^E|bVMj4@HyAi}sw!gX@s*`Zb~oT2NQ zG};vxsvQ(N(;=V3jhT)vV3D|C9fXG}Hp~NI^O*F^%rvnZm*EUs-7dG%5sS*S(P5w) z`}tNIZdS((9GJyd^u^_qiz@WvYbNegU12;L;|)f?n6QXTJP5ZMzHkVIEi9_EVOmiA z9gKZTuh(hunC*_-oNRqkmJ4Hd5YH%d{agP8iyD=%fCV|mZHEhYi7=6qT~t_5#q-;pxJmOWwj6c`7W=+?z;uNPd?ugnhAkt?1@NdkBwkESQ6-hLk%bVaATfDNaA_ zsYcxc*_>W~IEa0mdJT!zo$U{>-mUBp!H|BzIM|QTHV|}J6+`-@Y&%9`?3d6YK1Rc) zdehB{0gKHB$CRBA7}Bo|2L~J|ZwSjVRw8{;CLTFpM;wo6X|Pj=e9BwYRuG$e0c>C(44=Z5CL+UVA1X|0c9Ch~<**2fc z;_>1ZNwcRVOtseBBYJT1RK9XqpJmVn>y#9B1= zAS5ngmd9dsxNN?Vness1Vo>m#U5+63`mjKDquH{XT>YStg-<5feYA3qZAe@_jImfz z;>nLiwWMz{Ws>$P0t?AncK5K*a?+zd{UCH!}Y)oQyEUKvz>*;f1@rK7AZVz^4 zz1mfa=*4)T?99DM_cfPE@*Y$ix zy%iC&H$DR5_Ig7WJZUDg%50#Y3$Pw{_#OTbRv?O59fgLR@~H(_1Ll=aDAF%~&=>qp zJXp0;`RiK$&<#<5<}Cadb0XGNVYkocrj32%NZWoGhb*OqxB%EH7>Svzq$q05jQu;i z$B)N$SQ&?{4s~CeMlgJSsT7;^iX4BT)oL715*=16?ttstCQ*G9H3lDT7JLi{cj&T@ zSbEm$BR2TlPW15@J}Pq6$GklDal^dIs>0&3Jmo7JJbZ)3mBnQbxW_m=!CvsDN#}#1O?uRigPVVZG8A9Q6rGq?X6$;ohnss(id4 zv9!1ypbix!`GOMd~){$GCw1UalOi4~l)|;)9s1(WoQOPmGXpRPm zN{$1K=4gOeMz7-BvU#1N~g^@{mWP;VA0 zCq_nU*N>5hmR!GF8C~kngL7hJqz*MP^3alF%jxlPY&A=bA+BTGijh%W%ov&0Inu?* zwr*~$jKvrjD?1${MkbM?r817_hZ|-3lh;LgA!YK;ttzXakGSQe;X4)eO!8)PwmDl} z9A<{_(PL~mvelHcAZH*JRnBT{C6j?iwpftR2DX|qAUz{3BT0m`!CBeagHlrmXNovN zX{o7$1`WdB%(TISSR^Q5rSJFDKzYg*g0AY8@UQ$?Jvq zj^GUAJo>UsUA)eSAI>>|EY!uD+{k1q0Z%<-!U1Moyr&UAzXN_A^a3TXgc!UdaA*uT zgDz5dkkpyq3DiqsCzI(r{@WC7WAJhj|5#U(=@+9f#ev-Atx4-5Jf)Lgnec zxJ)VZ^{AOW2#H{Bood#9Rhd$#>K23d5a*Iz#*4_0uABPvV}LBg%5OXJdha~>;dhTr z--4t5U>LQ7Sox**G?}ize+seuyBKL>!I{Z<_2oAQoI5!$9y(@sdRa-;gc35r0@ce} z&f!reQ>P^9i)a*&E@s*Y-cio2&+a$ioZ-B9=<2FxvfDlxFS-z`UXsAOjB{hhrH0oEy)RAAOf^88~|*dAhH_lj~HDli>Uk$%|-Lt-))H&fbGMJc3q^I`T7v z(j;0) zO)I`0I~qy!&5h!cq6)aHECujql^U+PY88v;FV)o_54m^zjoY^#es9;)pMNB!5vBjU z-icir{CUm1Gt0Km|MuWb=FhMF8T+{(sCl&Md!V!X%3Zy@OWhx|`fO&#HSx>btM9)o zaPfvapE>yPp#|1<(=N~QUh&PIs~eT=zw0~voL1do$s3)2%^dR2CrkhSaQEJ_Po_QT zt9t3dR-ZbyJ>220;qOg&_}KHkzwFg=s=ss6){7ReD>}6Fix+zoJ{w+LRdvs+O;!Z{ zRd=o!6}nA5^zW{P!_LgR@0PN{y(@n$d*+*7?qC0m#kXHx)}hJV>+Zf{>@EJsR#?BC zJm7|Q(~^e-N~~o&AL#J^5ceJMQB+;~v+Sl&WP^k%Wq|;phlCOg$}VhR7B(0<3KAeB zQUb&jiXs9@#5k;iqN1W=7v)o|L{Lcx5Wqqx3W^FMDhR%!uL7cy|8vfrva^{e->cvI zzrUT?Gv_|%++OC+E$Jtp7&_+e+S3|0+iL&)<(04e-fi<;?H?X;)q>kT`pA8z{lRON zyPThXHoJA$CymEnxBlFFzfi}-WENx`clK|S@$l<2>P}sIwEuRKB_4jc@W4~=^ccFP z-4BhsNF`y1zG(GyW`_r!9IxT-|FomDXYMD@v>*Mi&Ve5j=T2Dt#IyAeKmF3VI)N!K zrnSA{o#}%Py7~roJ)jAg|Fb^$sHmy?!P6g=zkKbG%C60#Z%uh9?SVm=tH$Q9XxR9k z8lzFy;yJT^?7bmje}nT6Avth{OO`nw*jpP-lR@Xfb;^Y54yf9&m$A8}E-s#^Sn>Zh8E zdSx!vf}Y7x4}uKYk=QX*yIh>y6w2fPCqr_= z_avF>Y>>PpS^2|ToE0O3Ug=l9@q?ZWdYxDK5q}$T!3)WiE0c@Pnr5l& zxSc)kQToStN+?dszO}zat&?&{gi1Lq7nM2-pMf6~IdaLDt(W{79>ix#mpd)t?OURFLPd%5g*nCC5WL$+6Xl?s*>ct7Eli7}Jqz%{UkYR8*$g*PUS zQc(_!j&aMyqhn&_z&*mYUYQ&ib5bt$$4n;+mmFBm7WQ(#QkJk^F80P`laqcWl3gJ` zeT3TGuM{RRP+1h?_9s<1i?)KRCbb-ho(DfVAb1i!)CJc9lB~y%M~fg&NDLJK78FBy zthmM)x`C|Az6p~9)MY@7a1`pdCOaf~ea)A=mEf-vfb1q+p94QBeoRr@>S;fXC zCzUyu7lZ9SR}tYXx}5=D;LConQ&hzI11ZPkK=MhyQX%5aOHro!O}S81n%~h=5=q_& zi~*2y1_vL)<0|8n3%fVNpOE&)jA!;{p)BPXKNVFu zi@t*f63$LhBwx~DXVE8M$jWFWAhZb>5~&zRpCWp zkv#=fcIS%De^gbaD1T^ah)mr;KgfzjPNyL1a4AY53;UI6G47P4?ard(>=+kA zWbWIoGWS-3D5yn5WQd~Qr|cWMVvY`KM}wl{4Edwx=-5xzW#1aP`w)SVyAdBjk?|sH zp&X@`b&*|@Pf~VGQQjBf2h*jyCgL#y{`QM1`Z}eMM_By*pvhVEJt?i0u?~S-En{&$ z@Ko)P3rZcnf(lf`$QPc1KkT=SKJ_Z{6;(;@Q!Y?jq{pkONIoezW9ohq4S^OPr{k-+ zv<2QZBFqf023E>tC8epH@IFVCKd?52ngO3OA*d^N3sfej`P~F%z7t|fhyAu>OlMZPusD4aQHWcoD z1xmR411RCH17(rkh#gX6P{Q5YLG@wY1EBDV0NY1EQQ>z;Z-b&S5{GmER18yJ>Qp3Z zNa1b^P!F7$_3lmVrt3@G8+aZtjiKZ6qP_6Wmv zo2ItS~P{IdOKnczHphO(p0!qZe8=xpJIHb)wuN;(ccOR%2wmk}JHB%>a+)p}A z3fFM;K&@k315m<^)}SaiIwU`+RZOLUx|=DrXOu-fqr8}=)ID-}#!~M~`6)#?D=WW> z8cX@mqwMo2r%pl&<(_&gc`05cHPW->cx%s+i&6Ol3NF>kizr!w5_~#QR`#mM0~(3u zuMJmCJG}k;F{wWER+POS=lx|2JRMd-WuK~oI9bVxfrdO(Skxp@kIyryyeAxP&wieO zdk3a6aTh652uh@fd(@b*C7sv&@Zu95wz&0og*0|EV3I3NG55MVmmt`LmnPqHd9s;PPkS2$%Ph zow8ppsEW$>$pLRnBAh30q*C=7?Djk$xeBHRk!=yLhln%YR~#;qsUkcQfj-?{4?@{V zHB2D^p^Yp(CCL1!W9LU0NC{`{eVV$osyN&wnb{ z-6xlQH-M;wZN7Gu^7%>;zy5XxoEv+8-955WpL{F(NL@i0T-ik~%08vcXa7*%chU#7 z=MVepmU-Tyc#z9Z4)Ax`3znR4xV@AvN#_rE+I?F0@cAPgT@)DPe~0q<=@vyt@|z9| z)a#3wQ#)(^;%iSg+Ct^PuY@P;_bDH;5HgqEeT!p`+I>UL;YX!hF9d#MRJC0~?$72% zXkyx=8z;~?Hfjq)ZHlOwp93Xo<_(}k%}fnSw35i9Z z3Yb@jc^Uy+3fP%}0Ib0_s+H-lghoc)&qTI(bRW z6{kKYZz$!St&t!Kjz##pTtMAQ9`ifB7k%~$!+&(FBP^=ky2RB1-bQW!M~ww|h&{vJ zaiR?DEgtL;-U?y^2VmhQ7$J%W zhf@o?GdZDD)K?S@na@SU%qG%_x=%2#m8mj5N!`*Pqq z^uieQ;A-}Tt(Mgs)&e+_uxZQdz z*%>>i61QQcxQ*I~+k|yNU1!u=38)nlY7NBF=$I%!GE!4Ny(o?vOPvZ-Ex*cvyqNJk%pwYza+v?o!=XNaiyBfy zzB(|1N<1!Y(u8tyES{aF-V9w1X$bBKOi|B;#-%VIbqoxxs-XcXyoAb1p{UNjr+y37 zbUx)rvO&#u7*(EJ9P2B%V9%|?$#yCoA(E9^Xno}3x4FwB7i^347eCDj=m&2X+;Db! zJ!T{Sza6s<|EO6DV^)Ij72A+Cc3eP#25&{o67cXk40<$bUbrfnu#`amFEENUK@PM? zz6h)@aQj)*9yaGP>UDS(>aZbe&ZWkI{<(DhS;5TpM>g;5m$gP^GJIi$~U7e)94C{cvJ2PKN| zIZ&bqSAh~m_zGlmQG}@vBC3QrI`s}HQJ9Z_5|xOpc^#>FUTvxQv`DG>=m@EKuW+e( zeB)zKDZM~9)lgQo!%vvq!Biyf$xPWWXjLaZJPr^1MneB&uEixJ1Vs|VnAc2hBK0eY zkP@Dcl)9{`Ep@oFj?`vBU8&{tdQ!7q?WAV5=F*jCqmI?DtXEnmyY}SBREWV$#zk*& zeQ}{)f}xojni&8>xF;xbZv^w2wThIS`|F;qeJr9hEZZ^Jo?452I~lgoxD0(XLqs!f z5JI1zNZ&Z-EwnAOJ!U&#t5vIZt!D98NHKX`rI=}5q?lfvr5Ia`)bwoQW6_mYmPV=m zZi>S1f~4UN&1}((2ZV4(P~^^J=Gm^ofd0rP*^MWQ&51{WtC@iygp{C2ir)Y1QnOYO zlGD~giaZuxX@pghro+}8S_+M3s3$D+35xV(F|Wh+*lwsJQI7`xO4cQTq@%6o?21XT|_ zp_g=4{)OHJK$G4mNkVueghxVnB!ovocqD{JLU^SARd~ovn%|=ttMDvlcU`VwrZ?6j!%?TZ&T`7UD0-T!{~(V|5IxAr*s z(7=TK9}a1G&*FBK^NS}gd+fn=asA%gFgwckN!*LYXQn^-{FEiX-0{?^#jh^>Fz4NI zk)xY!YjAi{t5+K@Je^;4w=JVQE2;7N1@*RUxGM0=Cr8`Ave9o#A2<8@qpc29UH!$x zk;^*X{YB1KH@)~pQo+1$0;Ge^dEIW(x&>=DVnJzZZq@KU25 zw>|r5t@5Rx@9fpK{jiAEU+h>vf5#oe8t$GsOvy?6Y0ons&TQQ3Kr=_@52n9pAN|a! z#m76yW5+dZb-TRrmX{v8CI07IMn2y9*jj8X{r-xFT!lYBcjAeJ#~+*Y+PniDU8|B_ zt4OJ}Vfn|$U)U&b*uJjd=#O{%UOGHFa$4_)t{(X0oPzxo$MZV4bFX-___Nt13y!Qi zzxf*5ps!O$6bzHgS8s^wGUBayH;jEsL@N3VTMq9T*{EdSYb&O7yShiWN8G31>3Hp| z37tAbKl!MCPs=Cn8thp7PUi2!HN2a4KkPnZ+9SmdTNSE!jM`;pOv&pW7q`-8TcUC> z1FAdbol{y1PVk&T$`N)O)e2@4JYSGi6(-gyOx_6 z!)zDsl!XjVH$0)tshnB!X}-Ov5d{XE*||4K(vo0IPDU;s5d;mB&0;G}91=Tg;*eM> z0wtt^XDE_S#i6PcFV+V~Q5mt@+T%{~(rS0pFRLHeL*>P86Lp>>{j1HQ+p1%zY}sv8 z%O`{Sw#Rj7w#n6C|8N}HsEs9`w#I)+{%>^5pYC|Jc}1q^I<%ckBkFy#%$WREs|X$iBoDw8DrY?zdlQGZUp81Es$hLMN+YZ zVT@^BrxRS`$mCfix9GK(3}Z}gajj(2+=|b7;1xq^kSZl=uHZw48bFubM*U|B zMDD8t*VfV9qJB3S#+clq(kYJMrPN>3^YBGOYLP0%7*n_!vQ!J)$*s4itC8xJ6M^cOjJq3>q0Wj4}DJF-yhbPCndO ze|sQ8_u)sXTZ}RJkeU!9HhSIt#biV3yeh>QlUq%7DG<`|clLPd>TWd^g^K6a;Beod zxufXU1-aG!=k-Snsg9}?V@z(LCkQDm=0CgVvz7I9w|c8mj4`=I?Sc`mqZhwQGo-w# z6k|+okt=pv9Nlp(zgv3AkQ%8CEdQiL%}Q5|BpQ4K?;<=z3vP+GVys#1h8OLYRrZqsmgo&4dVA=QZ* zHyFYQ#I-7ixPmj(#0j1Y-5D6WO?8+AU^I7bP^AbXcsXW0L35zH0An0Vw`$e&moyoC z^H-$^V-8nWlhi%0eLu^PdQp`kj9IFiN$SjjhL;Sf{i+mU%u?M=Qa}CpK$0Q#t13kp zvs4e0)UjomzZ+66^nJ+?22w#YuDLd_EuqH3WQIUOThKLiVO~bs+?;9H0%}?Y?bACq zM;h)MH9BqBxHR9Ou|0zy;&rL)tSNceRc?0LEg3m;XWU{ek5-rA(q!s1UY0s)Bz z6g1~ldpDs5;F$jm~t?p&BzpgT^-bKx1;(QFBXUsy)h3 zc5X&iW?EiGuHj;OUYgpE{IivBSl&J*9jnS`%$=H+nLj7J+H&{Ikmc^W+O+H`*nfOV z79@s@lCkn1Q^N;M&q$v|Dl*dZX{YYAbYi5X&z(DKMuwyikGBxRof!$_czEE*B#UJ5L0#i@zu-1g5H_OJr z^!N+heBk;4vr)zA=@GJ8lDu_B#eif}(`r)*FW&X&Zcsjd7?@{6aUtQQEVUh&gP}MJeLn$nDHIo?&jo!gFtpI0h8JKc z-D(Q&U|>e7xIc@(Y+wp6L*L!NJbW4YN`QGk6lW3M?|?ZMiVF!ZrEfF_PGV{B1V#^s zg}%YSj10wD=*tGCFcfE@?@3@@3dM!!qx5|rn9o9S7Wys%6HWyRMh}ODz8GM7h2kvq zjRa;=D9%FPB4Ad8;w<#N0L+`AxDb8x27XY*a6oXYDgS*2+{w$(7fu6FL8c~s^?_@y zVrz;&@?YX*>T?6I*aEt#!A7zuZz`U;F{;d4I3(TIs&`04tsbaJ!tSSD^ z0{8o6=xa_xd_krreQkm3u3~FS4=NviU?!@#KMQXrFgc<6E@ySOgw@?a@95<9N;tGq z)ujgooeo#Xs_6N-@o5S1-LVEaWM%YUESIKn6%0Y~6u8{~%DQK4kd`|)eHKpO`X|;t z(^>%+&C^v^POig5waJLH;E8Ic|3s`#8YYF&%02%)a3krfxTU9wPYQHng;8Q)U{%2dn{)ZCtC8C5} zV6SN0y!s`OsXCon@-F@PFM@hBl;z| z;8Ij>M9DiO*T5NtRRYciWFJ=YCRkW9m8wtoQr5;iPcgf6J7oi!rA~7_sRVt9%fSKC2Y7J7O!k3LlPWokMoH&ge3x|XSDKqW9mlhB7SMcFe- z#tKfXV!;edUj2a;D?VDqa#34LO!?{#2qO!4IrA0#Ve=Qi9hs}vK}xc)H(IM3rWf8EyGe<@co!%oluIX{kQXW%12J`PH^3L!X!OCCF+#Cgm^nu z8=|zPC2=b~%0=g#g{Pn_GgF_q>s1EVQ^rOr!yQ7FvcSSRTPXog{STmOW{Bg=;6)Iz zvXatK%NM$ft>kn&a&MkfR(1)d$bGEpbO!PZoQjf_v97-s;an77^nLy{5Zg>|V7g3~ znw%-&d@?VV0$J1n52tG-h-u+M7VA_ngLMgX`2(28kIBSMeab9U61iA9^Ho}T8`vb{ za!4z2AH>xAxVxFEg@_cHpb4m6%%ktzB0CJ#c{4!uV_W*3EpU`=yv)O{#!c`iP4+0CpkkAi?_}l2lR#qWi?iqm{xJcTmRiOVPt8=AJB&<4 znJbpERVgw`9C8KcVto{ph*3&MkruS#KRzTqS|aaq zr6?i*nNJWRCyUgfuWtibKgG1rT7j8ERaNC~nnb+>r6ag)DvX&-ob;YW=N8r}*#g|D zy6^*hl~niJf15GnGGFS zDVA5KWD}|6=An3P%o?aHIgm0n%5(mhN7*G8Z-`j{R@rx0QGrEnGq#;X|A*G8blEin zD=|>JAUR~G_b6ono<@#T_6LL$)Y!NK!)+oGu8Br_ly^i{gi1>3lDFXY=^l*J)|SvR zlGW@(aNN%OD>#!Xdkc2gLQeJWRZx!!f6{DTiUL|P!*Qf7K3ck+B5_hVy}F7z{Zml= zaXBO#!rhZ8Du{v_1WK)q3(mx%cu^I`QH>;v#e&;i2$`0r7xq+xL(O$Q=B=ZtW|&~V z^*VyIc_VJu3_X8G4OM-PuBf* z>SIWHl-)GXU*-v~>QhR}w#o6Z7Qs4B zH~o_cLyA(s^)?%AH6Cd(0*$JPG!1|fX}S*7KwJ)qqC`aUah-Qgr<(trbY2pY&aeJS zI$y({u}Wvuz{p^=sY;F8yg1Xb1ZfrrwAw&%PNA+yAJ$-rMj))wOR@WeT6#GHD0}3p z_5kywG;##nlq@}S81m*URtk<-K_ulTakr8(j9Pi3(rwAzF)C$*3`!GHRbD{@gAynS zS*QjKwZJ0LC~P0#3ggws9#CQ}$q=T-sJ4+3KBB5c(iR;lMNf;8qDMQW=w9`u=vSk% zVJW%DN!7^s7qg-T6^UokWtW6>Lr7l<=>}5tej!b5tY&;5gtVYYdIIy>U?NlGi6{nY z5@aiIRJ{m_5JG}buLb$cO7|3CjCs?VUes8sHnR&tFX^O_WzAUWy$P0>SKgtv)U;P` zsj022RPSt^W0BbrlfzSm9F6JHd--5S5|2i;H8T{1hzCKDKV~zp*;RI_wr!dm$_lpOjX; z?!)$2hD1%eg#_unS5u6CE8T=qb&tM>eWFR!q+3W3>c_v(T_kkl9_$m!2f`<27ldBY z*&`?)SovAe^#;d9O?pLKkj}n;p?8(87X-&M{nw;dq#x;|T&Ec;|2_yylvIaJa!@S} z6C?ik?#Er^CP7iGJj%S9BvNzMZp)7ruH6njWQCA0hgtNe?3lXg#y zYyQsX>784x*mAz#^+ykm$aw6Xw!h5%>}1dF0ZM zKL+BjzclF515xi}eAN8I!s53w#$J50`GER^s+Jtxca5jTzdh;Gmq+(+o#4J}Vy)*M zJTd0dwZ9yg`TOtZt{qz5c+{N}6W zHRrW^@(&&Dy61nsK9+j_^y@Z_+A;2q-JO4Ha&+L#<8vya?!R^X?D}2KKH6nn&+u;> zFPX7rQ`*_oH;*6r_m>xMexTW-pMGBS)o%~nHg|yM^%0vtT~hw-7qzKeVPn zHfg1Y>T4QGt7C$`yrM&cIa$<7)dRI?;n-uMuMs>Wp2~sUMy(_DGh9Djfo?SwuV4&y zQtUP=LuB*w8$bV19TUzN7XU;JJKOK(>X-<|P|2c(v(&rs&gvK{7j_#V$;hY1{#qSV z8#Y+00k_C!3*NW|RduMJDKvH))jAXl<*R=>TOCuEF;tt7dviz5L(vV@LosLQxv4ba zuIiX87(?|gN$)wka9wpweG{f_mu1bWWALFGZoz`}gau}xF$(n$)r58%)hraxzdZHi zM*@QfZcXUlSVPc=9$~^I7st7nB}g1&?mu<;$=G!a)%;{?>zqk~fmIWlo;;OPU*`l= zj#KBXQ#rC zr)j3T!Mx_90XW8t=Itf@wuZADNzfibWEf+b@qHz@#_aOrGi=zBiRv#h0ac1IrrG5U zVQaY6=}g*-4qfVbRf;htx1w2!>n>1Zv8x`J3Rj4`=I?_Wk7F0xO?%w;VO zJE~HQF}X!Gs@>+ooeDvPy~i_lUCN_MF~;Opb6^d(GH>ZR&5)w~%g8Xs< z#?0I`)L4}=PnBYf$*mSFrKMN1`JcRGNZq4KF~;N;jfxrRwejqknTFJJsuW{PZnZMG zmE369bVI64m12y^t=1;Do_*$nO@`DFRf;htw_GN-YX8rzNru!fsuW{PZnZJFCI3?R zogqc*7058gV8PYO&9dLZM;97?WEaOm022XLOJcSE*8rF}c;z($n5L4!+C{XzK*I=j4`>@8CW9@H)Qp{ z&5-&-m12y^tu8DT>{fl$V~z!;NTU8}ieNF}LKj4`>@t(sfLYPJcg6k|+obvL=S z@&|vUA(f{}F~;Opk7{li>w#9NQj9UV6<5tIL+Tk-iZLd)sO=SN7O9Rp-ue40jkRL$ zs8WnExfO46Yj@6Yw;}a~D#aL+Thyu>YZjk+{*#}L)rXfH^ zrA`D4V@z&Qf5C8z)<+ua?Ru(Gj4`=IO~2vRE;)9rAvIK$VvNbHzAQ!c2F2l`P0wSW z6*V~0R8@*GCby{HVYpSi=Kg05sd=gtW2E3UI@A>jU84gQn_^XpG0b^T<H`N=0EwhUJ*o{BPEc|PJB|R2WETv5xzqFWrp=wN zX*78UAsv;6buIbXsv2)=~?Y0|4e z3qiBJg#uAkT1cuE79y65(@=O#3)47-)!IVU9?Y7L!(^!ONt-rz4pk?{+B&gxht|C$ z_H-HMuhzZv?xU@eq0{H=yzb>5w0|^$NG5dM3-z#8uuag-V%^Kzu-*~`A(Gd9c zchUKw?JWi-5Q6{BsXNpg{t?&9xNiP$Oe3A0otu`IGbKIa?@uCa7m?YhWAm-eU;4Py zA6K-v>1zam%|A6vPDy4q)rZL`xy&YbA~3y&8e4c6IEr=TxL!TAJVg2KuX0?kgnqpU z=W1MturK#s@E#V^-|x2b*F2{ap@sAtCdzXX3|=Hd(!k-trXf0%RazqYtAW? zTH%twcc5d74mcb7v%(z%|7I1#z#4Faz#oDB=4!QY!R` ztX54m`OgJ?y|n5JG?|*hI~usjf1!`YoEBfEzPo^XAXHz_9suMQ8Q1Hf`slpPkeYEF zaKDG(=o1tQ&VN!fZiKp=|5nYIgYIue&fl&Y<$``vemG5?t->@p59Tm?q7q8W-DAe_ zKK8B@b*AaBGB%~JUvh~y`otVnPg>fIAYlFx!H|5 zxq1El%FT(sr1LbV)h#Pu_?$zIVjJtBfqG(7S8V*6Aa}v`$wRP>C?I+D<>LA7l0V?& zX;*T>IX|9gl3Ndd@$Hdv#SqHX68@=u!-Obu6SwiYSF*vT5mkrejO9upq0||B1xe9) zO|fAvrhHLg#xdz}{p5@aa|?FdPjrk^ITe9xaXI+&rJ!gaSx{|siiThWPo1)h^PXg- zUy8C1+vH-dc7BwICj<;Tc*7FglzL+Qimz!3Cgb-`D8(bT%l^dQ<#0-ua(~jc+^iJD z_$1ioMfkc@%EcpGCBIYb8yb*aIOb?q?si|7GHlbI+X9S4LFYx4{ALCZ3pi|Yu^meD z?7reFeE~;<)2$KZt-(C)B*L$3(*P;OwHU9vg>2E3;@;yb|IZ^6VTkn?d*c3sNX6_* z&uC1hi%X_G%zwh{Y2?Q|ySMmCztSe9=mfH+nhoPT6EVpUG2xPx5j-z{ysXT?hRTa# zCi|3&lr0hMHzSi`?tBWer9)O0y6FU_>3%we0$Db{i=1>Q2g$ch?ouHq?Z~;pUpyia zm;2PiNM;11X-O4g_tXYFK?UZJUZh8w)B?%ex+!o6bN9MjJnh7~lN4o-ze^R|_I3He zAL!b{qwK+k?6DqYTT0Rn=e=eAq#vC3me$>sKg!>4P+U&Rut0Qu?BlF$;EzX?oE^SE zy=zax0pxUe9MRw}o|PyU58|Q~UJ*`hr@y!%GE(slohMcG?4a5eSwd2Fi+Oun= z0wPVMn`*?@1ZwgHMGcJ$7iL~z%9Y%W~_8~fTb}5 zPt$95-*CajXwtbImu9T=c7-KoGR>?n&BReF83(VBhU4gy!FlzhYev_VYL5&nwX1W2 zsBfT|79hmD8bML`#3-b#jzg-Ghi^8$1pJsLf`9Q#^;1dDh6#ITRmV_%!QPkf4E0NYIC18Afx!dHuQ0}J z1(`Y{#iXZd0Zt9{L-=CZBo0M*Raa}_qFpM#cbE6{%DXL+p5ikCx zxRxPR0uC9*n8wuWf@^%woSXHa&yYIAGGYft^UinditbkBBkeaBQWsPy;gjI~4QU2} z@%=fY-WOX8sb-?WP|w^7-ephB;?ctOK|$l24XLYDDaM$>V+ikv(9WbYhfmccsJEykGK;&}&p98PIpSzt)f z31VazW7;#9=N;Hkge=VGsuW{Pdt=cXo87jqn#}Kz&_;G?{6X}x%^xFz_&ly;fzQmy zFun%_;W6fwHD$(ZD}DfIS;V;BBgjA63#HX4%Zkt(XEDmM3z#h-xSGcG3e+5~!~gTQ z*SDbK*8j@eYsT!kISbRK=4WPN+qo%O_!RfIUt{5St+TT>eoW@WW3HvTjLm{Hi4phToj3ua7ML25T-^1+y5ipct zt;X&~!TxhxanvxtP-I!*RztyXV2)E$07EUf6|N`vgQ?;VGFG^=u%8dyP1Gd7P>`%} z)XF^s%z719Q#hzE|C)*c$;L`wCgQIWxISv9lLi&6aBacAvZ>Ic-K}sR!?G7}b!f-~ zhLYL}HwyfCV2V_n9?v0ThUDZ^Dh4E*n#TCH09O&Duck50uP;;IufT=TYbXr)&q`k` z`0aohrs60)YVzM0V5alKM_3hP%~q$j;I&)%3+#>RVI|2Yn%9 zvlpPRFa-BE#%9+;-K_sg>o%?TKhc^=l%M}E&6Iyy`IM>Y|E$W{8M(RGY0))p#!a-( z>fbl;;k1m*o2Jj0IV)@SoVnRI=j7()&zrws;Vu86ZqL9$-sHhUWZ%$X{*>X@rH&Xm zYBV;g8Gro^H9Hm8leSIl(>Jl7g`>Kif%;pN;l#m~D?YhLdew1iN$oXfE(}~;uPpzq z(jVV^zGwME$7js%FlD7Jbxr^M*KPdxfdRM0etCP&ud`;{wrJCRfsr@#==s8rQ!2}U zKX7Quy(gsGe)DDRx#`QKeR(gg*+2i2U!IxLqU+m=uDpO;cvc~}la+xn_=`&}zI6p1CEFigE~aAuIV-t%)EYeJDFeIW zFE+V2eI5Q6DFgfCFEP0|_j#{!L$Bh(80zoKN}1w|^wKUyUTn}%2$olo>nW*GiaXj* zUpf-DdD@l1zLyspGtj;ecLL){7!++U3j`KCJ@b%#m$J>1P*%3Pna94nT^Wv^RSwt( zMtcG)$8M@PX|GIC%4r{-t{$Zfs6Em4eV(PIN3vZp?MTdH9~9-amqJC^E@wiS*AC}O ziCvZ)2>k2Acfi@@QA**9vfXu(L6Zw%FFP0gVn@u7U707LRC63;Sm&L~hj{E2_DZr5 z4zf#O4F|_PZ!c%Z-~gP{91FAEKll&(PD_^#uURs~W8Y@w(97q&3Oo^4-KAG1R8@KG z+pU~>_t3;*2*nD=C{PL8v|xGQhrq-4-Mr=xPhid6gBCvP4XkS0VC5{Yz0wmXZWH;s zk3w6vrx}8ojA*1_l|q@zYd?$;dy37n_o9>SpL*Jr;{kC1HmGf7?>Rm8BgEVWc%pq5 zoVCBF>`TBAz6TNxEZsJ>eXDc!(J}o!_WfmhuCnj*D%-qBjCSR?BemSGxl6r}?3HXU zN5nNj#3ke0*n~aacDr%+EG-*x!=w&gyPv}K9s+eG1&LEe_z_vSxDmH>+czJ4*~ZETf#n}Z^rbvw>1<&66(9XvgR`E1 z@_qCThzE-x!%f%HZDFUrT5shh7nY@^7oPgzchzB}2I489R1L2;aQ7#*=H67J!*}21 z?;J2YjC?{7J+R-!Dsr-g9lL8FjuXnlmY%zLxrd7dg4l@Mq0$D6wo@LRt>x6R-BEgq zqWINI{Q3{%E(EQ%o|-6m-tXRh8WR0OTv)&Ni(z2Lh`+buVYCX-dx=0w|So!r6GT`-UuHE~7y?Z!vs=IUB&p(Lz%fg|3Hx?ElSp6+rx^D6F zbCH!oUE=7e<_N`pa$r^TAlp-@-@JjlmMtE2o|=I@4bE34Lq}c8@nKIih#U^6%M-YF z%l<>1gI(Q2;iC!-ISawY8Q0hlh~uTX*S;I^;w@egvl6XUvTbN2qPO=?SHA-^swmwv z$!KP5XshZ{RpdpRxE63=y6RzQ-~nkH8O6RSULCUrfUs2u?l=up9Oa(6_C1@agW$0Z ztq1p3gOmd}RQ@Cgb<>h{#8bBqqT_<8Yk(cTa7gVeH+J~Knd@KiappIACZ?6sJ9QQ= zhtvYEH?&g2!E=0Q%)lYJ$6zZT9ETgoirJ0rRw#7Aos8s;az%0lm=gBWsz}~zYnOae zigLCh`9SfDAN(LIpH?Ivy7bxRH8`xdBKgR?(eY8v2FXWp{eY_qmyEx4FC{|axwov5C`eL4XTZuJ41_Z>C4n?Dr+!W;?sRxVC< zYCcv{;LMn#0mlav=CV^Qi<6ru$?xHmUV5%uMmmaBp>kLEN~_H z5dI>S<=M&1!kq}T#5V{tj8r*WsRtYXuk z1g5^iT~KF12^{TUA*f7HBDM2$Y8fbz?#`%MG%+MWcu&MC&g0FWq$bXwrp^X~VsX*Oe_6pEjHA%Y9pq5T%1*ZQ zlpV8s>z1l%RXivaD!j#mMjL9HD1&fdJ9cfOq!|=NDKjWqPZ-rfnqv~D?4bDpi8QeW znQ*%+t$eT^xs-|`nx}yhk^7=feFREGGi|X}hg10!cv5*?-9`D8a?aTTpY6$EB8f$jxbQo`lSq*8f zK&Ta1hh#@95Qi23Ey1m53G`Or#`2D^6m?1>s5D#--h_-slpWGY+@~@%4)-2RmEbNi zJJryl?rDsa7Db_*PQ`%|IGT4YsHZ@QLh*`Dm4c!o;gF7l%3$hSP{K6_hSa7ruQn*b zy9$)h(jC++woTA&J)lHgmQY&ZiKLcEF1A&8>QT#7;fbPVslpRYZBl6EMFq`;Mi0AF z(u6hIx%5ZOJ#!WY;D%SRdERw{@F*t>z8>K1^2@-0!(MDlD$li7c^pOG=XLibeUZ~i z`5*;pfVxh$e|Qpb)bwLfiwPQa*kGUilCR4b3Ey+U!Cs4pf-F0k%F9<&#-f!EsLdmV zfT}ualQL9KL6sBcGRZvaZ&LXbI4aU*HYgGEcj?p{x-GrwV@}xU7)+D$#x(Wg(M22h zVTKvnZ8?B>gl{1sM4cfkhdDI7J0iAt#pEnmIUp;MB8&yw<7i*IPJmMlVm4*+PCD{#>}?aEb96`Y5BBKFlTEf+8!KdCl5H zNDXaQN)gBS(C;`gJxr38z&09}p^rY^Xogxq5mG^szTwOhM}4=zQQueLsPE=D>O0!- zYpRf6i9Z)ELpOa;(F_%6p<7U-do=U@?5J-VkrPsaBB>jg=W?ZZd%NhkCs(`n)2?<& z+JVt^ByoUE9sToT+Jdl-i=LQyIR6Fv@VCj z^SJxhPH~fWZ@zEZs^@O|HNVk>&DULjK{~j;g)6Gzxc=YX^GfoE;}`z^?|E2L}My2B)|QaS8%7?9;`>q{GviYZA?nW5V; zs$-~q!r9h{m&Tw@--~TVs`;lLW7^_QCQ!8Ssp^<3U}LvYRY$RTp+`H^m!aX}SxXkD zCqqC#8QIv!XBe?zj2(g|3I=vkqM2x9=BONFub-tV$Jj+^waPJeEP77m7<1*es~lq< zT&2n}_6+()Kqy=i{-GUk zsG=o9X~A>u^gVGXM+r_m)tE4pvzXIc`%po-mpO@=9?Bccp%#G+rJ#B4o)a8n(gU4M zZ0xWwTMY$cOmo4wWa@Ll9=ScI)R4MUl@g^lcs^YNc8i)EGRp_0|7^@wds3BRjLEGl zfi>p14UL{vWk|iFN-@SX$E_ht#o|to_7fUyGj<0!q)IWyzJ8K~gP%HFkVB zw{f>bKWIuL5T?Bw2xXop2?mz%VsWiLa}u0f z+6KTlDU_r_&iQ0TP@Own7o0ICFC%Bpl&mze%g&jbj!(wAC3wL!7V?H3*;(xz(|_dT z&i{A^f}k*mPGmGu@KU1LZ(ex##@NEH6}z6#c_xnv#P^_qQAO8u%#-h zox3Tfm8wtw=|Px?BkH_UuB8*I)uSy34s`pIhhmUy$Y4GP5`Fvuy$OdyA!7!4>4eK^ z18^{;e*9$Lp#zf#4ow~6aaTKh(tJpy>VVZrmem)O_lWNuA0ITy@2_V5#rKO-R|C_` zzo|U)Z;(flPN?mN)y%(X)WilGiRl+^ok)9T8gI+2{B zeqL*8ID-t&SPH>WFSK1XoV%Jn>XCG-hO0iqh}@083>@{e`&=gOn#;s_FB3QHGH}#` zA6X4oJzfYm;WBa4E)zG~3Kuf7a~<-*Jm4Cu9WH8jtY#d>05=fblT7Mtz)*{Bg(LoC zbS)NA_X36*FDu-1G;R+9Q$+$W9dTLVO298dlYR{~zA!bpdjfWS(bQf=0e~U6l|H<% zNC{{-CsN}HL&ePsN4@Jz6+<{ORygWC=UxVG48pq@xC3oi755LV^zDcBBW=-sw-Y$Z z-&VMB;J*e;ofv_GdQ04J1h5q_S?vXm%DI(3imwxd=^$`5#S6*TQ85B(tuGY{8UvR} z2@6BPwsN-={Eg_SW>dnz)Rg}yJ=S(+h<>xuN4>=Lz`dekYYN92MA#N!Ms*YFlJIAx zuO1XU(E}^R;smZH|80czCq1!3DPG`e%BP#4uYiV{gABVHGIN*Si>{{ezaUf7Owpmh zja9K!-WV66kBWC5Fn5OHEOrlg7MNEO^eq8qyNavHe;i(5&V}ME z{1@F1;l)Mf&-7gj%*arjg}!WH7KP$M!b|b@FfcEK;w<#-0_I>S&O+Z$z|^{$gJFcj zLZ1tmuA#UPeH4E~ftjS@{wzJF1Cw_d`tAkh*-)H?|F#2D8H%&;-@kyVMGX;*o^BTU zT)=b<#f9jj^cV`v4WT#-eG7mo48>XKdlHyeLva@RDuMYd6c?h8(&Hj9_4`w3ML(>j z^3fES7!{|-i-o>{z>E#WS@L*XS; zQ+R7#gLuJ3rl#<=fL&K$WEJ;k`FSKTlm0>f^M|p>(jlOQ=$mHRpC*p|TiPNU!O~IO5 z?0K3sF+Dqb;?(>ZS<@z_OwE`!+CQrMv>7=QM`8ocDY+RFXHWav3r;ACqTJ$@JsSV? zs!jjYHE4lN(mZHz;Z&Z4ySbq>;YV

kuK5^10+0&D5bj8Q_;=kT~=r19WpL+L< z=cjI}Z9=zr)xMjGNa#iwH=UXphrNwbXsXDknC0axOoXF~t)TRef(ud3<(=^)2O7Z> zlDx*NtXM{r-@eCF^<|1es~0dajW(T`aEdH0kLBSR85UT~%dp`7FX7HNJr3;D!*1|F zikRYYl03)WEZ3~*W%*C6DZ~DWHRWFm>k{c@-a;#GLitJ{{u$9rp%IW$9ElsM^eA>tPuM}8R=7GF;fULmkRha(*Jv&mZM_J z$t!=?41)rZpT>YXipwtDgnJ<_hjc6Mlz$u&<*Iv`dJ6Z4nA(KMQ15(5c@+kvz&AQc_S3P(p%onxH7(2#Qi%P|={i zX4$4X)k3FSI;EznIPqGo(74KiqtdIm9NY$e1_1|uf_;s7G=*FaY=~L+JIXZ_KA z3WF8qsBf2xi`)?BGhw&!PG-C56k1dPr{0Git=hygu<;8#@p9!*hFkEiw%~QJ;9XgrM`6xSLD)Dr9I)zPD(XdB7pjqnjrQtqp~yYm zcnc-QX`EyJF-NN!VRU*p#}Y*it7QvKJ_w5K=d{ENP*MlYX{W3}6WTNXk&3=CBKb=s znu8CdKFZW};Jt*)!P7%GGIba3*-Sl#dmdA}aDSPpBe;v=ZHI<7xa<<0v`cA-g%O|v zObrCJnyIm%9${)Gs3)1C?SR%ZMU|`2yb;v@FmErYc}$%ImBrLqP#c)K2x=}<4bi~9 z!Bh;Ww&2^PSWq;%)-H7gMV}MwQXHsQrf4dIpb|l~XC568B`7zj4$SlFlnhEp_;rdV zehJ=aof;2{8aHf7r&E)4YMM^@mE9-{dDHxgjkar?=+Rn+`6K*V9|%Qa8G?l(v8U=w zAJ&6%EpjV1lIj|KGyE<5)imxB^HiW)YYIgI=LOpU;unmz~5 zi+qZy>A1hZ6y>W+xX^IpUd7ZR+^Kp-!wrI}XS--Nn7WfJnOdP!R4{5WkMf$J)_@YS z>^j@7(|J$p)bpSy58F9k35rU9pkCK0uDVFQIR2d%ZJ?6NyIn@gP+E@Alki%9Kvdjl z*jF!s2$Ha}>i9{bPPY+%&Bb3s@mEj$h4G)P3{$5GE5o8lGinvP^Uc&S*}k6vo0~$B zw$g)UF;Do1Qnv^6iqxfdfgQN)(jeRma531eELYHtdp1+md?5Vyj%NO!*QmJw;z|OP?I!S2Au-QGP{h z@5jESP^32X7m!VPwT7(h!*Z)lSQPb~rvyw13sRortRdR%?ciZy)N`~hd?l%;x2-3c zdD|xJEbA=1pH#i+36qn~&KpH~f~2YU>c^yfaDB?hK^E-O02ZN{@k==XDbM)>`IzK> z+a~9mH#@wfd^5dUqOJ1Eb4e}^F(I82ZUSXcfax>tpT8!{i1II22Yk3OPNfr zp&Z`qCbim{xS}J@BI-rT1-CsXISZc?TuBU;p7 zLA}X5dbtsl3)C#;QTr_@S_mh!j07dLOa+z2xRpAu6qL|Rt+tT(PPYw5yC-Cuf)coR zP@?^&_Vx|dN2}vpw4fwAxIkc21#SOcWMgVUWYoU&ZuKD3KB^?0g;X`^8J^Cv=cGfj zsVmfw5<`OMBvh)L=Ynz~ATh)yX+Vv%f<;~G+Ubkk)bv3=b+Vo+%35BAiV8VIL8Q#}phU%bWbo@{FllvwqG1|p5S4&n`uSHcjF*R%?cP$e%s;>KnqsFap~5t0V{^6?!lb)nd% z5d!VKmok%FaC;Pr*S|n=y@Hfn;7=-@m!cJFQ8T>>d#YQMkIa1PW2(_E>Hq;3WztDi zC6Y6^TA@vuv;E5aDC~JWEYL!12QDiSmemXGg{*w6?T#E$y{MHA_x>9}1Ca1raNR=t z9cQZ*jQ%o&5{V$54pSpFI3q0Gz68NZn{;D&ef*2$9|KCn^=wcgt_wjKNlj7XkUqp+ zQ1s3$3gP!U^$RGWg+?cY7V6xJ;y3`*8$fXDlh=UrNL{&LArhttY)NzkuLLC|k&xW1 zp*WSh)$Aow_a|Vq%Vg^Y!vazQzAV`=^gtQX~+ zr;T+`meyWT*QlLZnL4#bP4?NfcpHNW$u4x1XbUCCpIz=Cksa0}F z>9~uI7NuN6q?_mf*JfKvtU65Hi+f$BsB2Y^sSUVOwc?Pdf}kAc;BJ(YsROu2F?9_0 z224@@p;UKB7jdTnXKYOmH)%w}&SP4Qn4)J|n`oD4grhZ6G{PY$Y95*}k8&I#@S24? z?K+FsEZpe@5U*Ld3yEGjm8etwb;=FuDqMESi#xf4ku}^~GUdm;6;ooMVE!Bo5~!KT zA`5A`=O6n=Z_n8pG4=NirI1K#$`2*D#4h9_tvlgaq;*eFBCY#@5^3!LCDPglN~HA& zP$I3b2PM*a3Mi4*GeC*7z8REAYiedFuZR~a8l@C3R9l$36Zh>*tb?Ws3SxTbWviyO5~m#EO$Mei0X>anC7 z%S}av!23Ey!y45Z>LM(`%%Vl!c`;47%JL{@dFd&&i_XFik!5%Yb_WQQ=i&xX1rbk_ zQcJ6jULedGS*-n53b|^O?K`TD@si=7HJrt$$EcezhXmBh?i2-_8yO2=axn0LKLJv1 z*EF8a-kb%fg}QTK>!_id4_l)ugHbV?>Cr;h3qh!&bI!si@a%kZT-aOae5r$W#i+t* z)b9?4+NrXiPw%4C;qd7%w|(R_%4#*vKKj3UsV!MTgKD+0j$3PA&C7SWjreEA!w}fN zZLWg`QN+iBq9)wVZ@be$Ii%ZhU&hpZxC)=(gQ7f(k!)n2y`bz;G$_h@XgoksSnN^@P@gg7(kU9F+s`~2 zqZ1U3(NV)C#^?k^V{}56#^?k^V|0R|cLqVx7~MgZr7=1|(HNbeXpBx!G)DI^<7kZT z5K}ZpN2Lm%oIrif6phgdYC5P-n3ttf*`PjUUY<@Z03{?A>C_UPD%7bvLD9IWU0R`2 zD|KqMPHCT(UI!LkGp>T32dx!B=kkZiMjIv!ZVlD1dgwF?vl+0LU!-!Vn`{4`UPw|-`d@{yn@U!Gy!G2E&1 zB|cjHizy1j4@?n8NSxIvdKSD3I`um!LLjF|DRoSFlE^c8W3~J; z-~SH`DTj zXH%3)bVG+K^{&J)W27&k&d}m|O;Q3QBXI;)V_(wlc_%QX!Vi(8GG{?5vI6&xd<7RH zoy(|m?F)>k@&)87*?s^Ym*qhJrb7c=@jd$2`L*SwkDLV*OTK`w%4dIXXrNb9)#77k z!53tq93bBmTy#5^Q55);pXjx_X~8!GQj{P4UCznMZy3Caf`6T@-BKpr3@ILwADweO zXW?Nt2!EZkxJP5;)aQ1N+eKET|90N)cW!i!tE4Bo`Rm|*`{;h9D&iP;qwC-fTqWaf zAMHHmOWK+9G`);t%=J=aPCrkN&rORQG@pU=u@3L#4^G!#yc-x(hW`Ns#1*dHJXK1^SD0-1~ z(S}B`Y2~)MVN%^`xOzFHy4f63X@dCUJH4%o%^(C7iD!BnQcpCZ76?X@AX|Z}r&Cd& zgan~B zUUFTFi<A<>MLf9cH;r!dv8CDo6w6GzAs8XW&0;1Ve#D2kuqLLwU5qfD#5 zMamkHSgeD}f{+#zNskuNsD~W`8N?qM1tm$}>Jow?i5r9j#zMnK)?y#714lDgvMt4f zph#k}ArW7T^IJ0wj(?XfAt;i_WL}#vIzKC%v6=+g3LND&K~ZiK5`>zJOEbcrd?P55 z&Jwy+h^E(!5omHj=$#CTY9-BB>CIui&0@kZ4zfaWOt$Nr!MLHE{P;R9>T6(!a=wdO zCzd1k1x0>bAp96vONz`>7^X>(t-z7*1Vy@q1fgEWr5P*T^syQxf^?s_i+!R=)TCQT z5bATtYQ{=;q0kLTuusfkGkh=fl1_L=H&%M-6+o0?f@yJ4lU@-Qq;vXT=v~Qrn>9y0 z_>&{sKDkyZ>7R^?V%JD7YPvPknPtdrK~bzdApFPq)yY6jf@}qjGzyB+OGpsvd0d*Y z(!JKueWJb;EK!qgAwhbZK~^(Xy6NRf#A~o#bJz^u3%#V1CeLWbO7HW!UP5VcQIlQ~ z7o?NwGR;`&eTnrpYlf5MdNq{l><^zzXu6rx%R_9{bYU5CTTm2huQQL!K;D&%(89%w6zO}PdBHKKNsz6; zQOpU7Vopd9s#{QLw9>s_=mwIErk7&QaNlr2=p~)BN>npedg+DVF6B(sH>&z*>%0pK zmVMf`OZZK`@`WAm8P)yX+0X8Xn!fc&hi>Byvf=YxvlMAw+GyB*Qp9&4C* z^^y$>vr5|B+jQ|$tpjDv3(I}wZ612APxm__o?5yj?59t3Ey=!e@O}S}xi^82>1yN0CuR`q1VL@s{dBRkcc2OHjnV*V>}Ag0`sITDy|}_c`a>d*|M{ zLErxV@9%d$pSkng=X{^%Ir}~LoO90^HEs5%!J$VRexBpK{QQwwf0w@2Y}fGR5l3!r ze(;y$PwCEsvLzh%PS)=|_LT=4JH@|LKXYKk9<3&Q=T)!cgur!eQx{sln*Lx?bdR}x z&bB_?|Lq0lqRvfkw>ojqN8Xq#Ftl>#{oBX&TXm|^tmCIvTv#&n*HJCjjLQG&+s*H% zzFcS0-i(_ES`GZZ-N=F}Q4O9OIViZtj_3EjH=ygy28%6?R<`{9{Zb7+Z2s#j%O_-2 zbq<_XRUbLS?0^ZB+;=l4Cc==*uIZBx=K-+OO+-@?1S(r29Bab?Sr zwSSK9_*t&Jao4tT;m?ds_-1(1=|ips{`LON7MlXU{%uOanCXqOp7Re{_s?9&Vm=No35n2=9~WV+>~Eu-s)XYf8Ky2LkiyYiK+00Z=<1wj&1u2 zx&%qR>y@5vf6%`Ejh8$4ms?g^`YQEg&Ft0ZhWt@4?o4X(lKO-9&wV)TsMx;-_R}G=RX~HhfQqLrd*S)om>1I;njBJoFi+t zH4g6=>hojkkd?01SK56sc}!g9z0%uP|6a7N;+Q)LV?TXvm~WHULu2D2b6jhN{N4Zj z^_~7JCNzy}@KgAE8!Prn5B(+~WklDF?IH#QIFB6t`7?9;l8Y~&ZJ0Cn*It3$YUO5M z>e;1~PsXyNzy7_V`ks*s-nWD`i%jS={I@0Xd$wGAB4ohB;Yw;>7qDo>*O-agpHaK{emshsnj2S)R*^$Zc!@4Ghao=PCH47_@ znvpV%^E?Bdni#Ef-!y@=o4pdDjv9~6M-OdRvD5&NV;Dx!1OzoVDyIqVsIgHw&*9Eb z!|8!Le+?%UcYzwtOSlWxaNfXOTMg$U+}Si7dJ&N{oP)TF)o^~pT_1%rGC5&X5>EM; zrEuI+gJNvTUP z>_vQXGa6L;k19ovU~+`fN|gpj4Pjb|xM)?%E~E&fm1243MSODC?}Q>tx`BNZp#zAw`u+6HMtfQlT}6omZu%3n{{ArOIif-ae7LK$Th~qzI#xqB3jt zqA-yAW_8Z9suUZN1eY*csS4nzQY*LI!@G!_8b1hIgwaY>)JU1)KXD7;RUt(ftrT@i zRa@V`ExDyeIboDAkaFAV!iPyMgx04(B@P+0lMUTzFqIf402q3e`e@m@EuI+aVwt_j zpXz5VR~QnWg6eLo3d2x`y%DHhwW_`2iJ`8F*()Dc(zQ4|bdM*7+6J@NFSypm@2$yo z&=BZtRb!aOxRTEYuN4jR#8hV(N`G<8x+oO- zR&CzK#Drc?P579-r~_CUzp-cpki#pL%+BV%yN0HR) zq0vfpL$xLg=v;3-hH{&4GX}!sxcCVQlpgam!_Z4{T~L>w8iy$wJ;tA53UDQj^>-Hi z>4_m}vzMICam#j}_r%m=7-|{F!jae-c27)whN0n(4xk#owdhk%OaQ}_hY||U?NrM% zo)|Qm2+xT}Ld@neD3g@EW z1Sp*Qg400ZRNz5JNtfgGwBYzCoM!~5p2BG_I8Q5_UV>9i;k+O?Pbr)n!KtEfW(!Vj zg|kd>>L{Gef>TrB92cBg3g?R8)KEAN1xL*56+t&oTVO|)gGK(9-JRN zIF~&*O4mtA)vENE(Zs#6hLegt3NupNF*vR^eRR5pGdd01$;pn=5N%yjvdmz%un#M3 zmMEN@&aH*5%1U@*HP#6}%7Zi2gELpd!A7vUZC^7o(+7`CbGMF-V4JrAV951+YS}@h_9DI3=w>CUQ>f@i~MQaf33k>2gTTEy= z?i3C_!p25b8cr+R9dqZfxIfTvDDw5a-1M}iSkPRSVx4XGJKG(DFUK(pui;Q?(3^k~ zp4Oy?20T>`h35+mha$Gxozs#ccEg?1hHR~O=QIx{)o_aD<|I{!UnTt16r;Q#4ofkX z%T!er4l9|jx^q~nqT{DxST29A;gIny?i`91TYI8tX6Z~^g~LL)3!DJ_)DTjij5ult z!`(S7gi-Ds7DB2QiWI9m$r?^`+>O?7sBBEqa3~g3epEeF>i(nQP{cmca45gNcIU9T z7r1j+Oht;pwU2PNfZt%y@TB`EQDj+IV^-T-8rmmEYWZ%-WxR>DjP>N9E!zX8cs{xRTg1p zA#6^8rl|=fgv}|?^xmUzT96)cDu<#$?-}eZiP~Nk<}7fD!!-wknxf%Qm?>T=hQj== zhC{aSYU75XFt65dD9l?m918P64TnPblZHbH{kw)kfxhj|X+dGeT(N3BgshWO!W=@H z1JJHk!9UA)RuU*Rh{NK}^!RHy6!(@I4#l0O!&ND=MI}n*P`qdiNZ~Z6SZs3Vv?9&q z6pYep(fcyb3s%T*M{nYsBTLbHH{-ODV_Ji8+&5ou1P(uN0EFqobDzJ{kd3s_-3rl5 zVHnM3-huE{H}jr#)#%u_ z;PN!2cuoF!`Zuanppar1jV3g_S?eoRs)vwb7>z9| z`>L%|wLbq^l^PZMRlZY@HHP45P6{ z^;NayH>BH1RqCdYVi=7rYEe{MIfE;H>!aAJPzIiG45P6{by~I6_K)`ERVjZV#V{IM z)aI$SLN1n^^0Z>Bg^*$xjV*ens{-hA<#Dm7k6F^tAm zM~$r?#`d$TQtt~XhSAuf=dN16{wP@dqbjvkNHL7Y)^i$LFU>KZRHZHmDTdM5>dd74 za79CGnt%J;vMNd%RwxS=9K&dA*}zrPu;TX0OI4``LW*HDw(LwwZlm@znR;H8>L{cb zMq`V5V5%+uS+lU5KyD9v3Mq!s*b39wO1=HZIaO+ukYX5(t#FMkpRfweRjJp66vJq2 zMKCEJy5hI*rJZ@I)IuS}FdAF*wyDPJ`7`GuRjIW?ieWUiA~m+oHj8*ll{ze>7)E1D z(%AA#xxPo0x+J6+Mq|stq$t0rY~&rBRk5~`@)j|a&M+EVT{X6D?Cn!um8vhK7)E2O zn_`R7@bD#91y#x}q!>nH%c-%|<-<7aqAiz=Bq7Bx8e8=CqSoaP#=aS?O5sEh<`_m} zD_Uc#$GP$ARjEZnieWUiVwjX%HkL`2sjAdwA;mBnTd^8j_hOrEQl-uaDTdM5>aMZn zSJ(QED#cEzfj`4&Z1vFCDtLL&QB|rgbq(McMq?`uT%LwhHV$8Hv#6$$@^&G`FdAF& zOp3fImov7s`Bjxl6jBVMvDK4F$?eAY(ygzkQZEZBhSAvSrLonvY49Xf>U|-_FdAFE znUtJg9|R^2P^C5sDTdM5>Z7qWE%1k6RqAIU#V{IMeHAGXrUv`_HmIef;X@(CFdAF^ z6e&u>)A!CLs8Y2nkS6&&IQM>Ue{j{gq}Qqiw5*}nYA2)^Mq_ILlcJ!Itru2Z>846` z7g7wPiPu0TCFfUS+Etq>HB?A3jK&tdqpIzpRIXB(Dm7V1F^tAm0+W*S>(zv{f2vaN z2q}iq*hp5LvYkdhI|-GNMu-~ z6d`r%YQv_H%84iK!n=lt*}HX(v?<$2Dt;}y#YQ>9q9bFl9i+Xv!Vc+bk8y;Bbqy!B z!fhRHj}DD?fWtSRR6V3_j&4zs#Q3dRt9(b7*lyw7qL>;)O7)2C8rluNNRmLj6pyyy zlGLS3bW9j|gmi9)R8#$;!n($Ekv-hZv~`4aiE+ku2^D_smfFU~IAf$JM}+WW#^f`L zUP?(HJ?y2Fgrrf)+T)GJVTwQoc^oh#dtm7cl`lw+9+{9iKF$3sB=`)=R8#<|J3R@9 z)Xn3ot4Gr=1p&_0}Xo%?< z8sd6}hAH(34Y=;13DGtjNV*V@kc4=KBg7ySAqHW9GLI01DE84zvDr~rM2nV|kz~RT z?a-){^kJ;xW@cq1WR6Y{#hv*g_B!r=eRLW%y1HY<7z;aS4;vK_93a;+H=K^ike zIwnW9Fhc5>92sJS)Ge5(XZg(RP3Edd6PkYmf*Uf1dD~w9xo-c}>hU{stMR z@i#~yjX#&yq?5+qAh|UDTwarE8vkMvPd2NlaPpJEnchW~AjbRp|RA)2c zY(%$(%;fVSeo?^5i{5C6$>{7d8hpH~(`SUE;ek+$3-%CWgT?8iVekR+_#tR=M*8Lh zlZjsiF%v6iXSU!P{7=d95>4HLzI@T;aqKmz!Gv4V4ZC?+U zu&DTYT4szhJlY-=5m%2bN4*ZoPw^Z6zc`C!#K??)eHaTx73FWr6ztWTW3)>ac9_^i z70TuCb?wZ#TWUjF+&Hj_gKLj9d^;tT6gD`#s2Wv z+z*>X_*r-5hFbFdA!+q7TPuZn=S=V|CFRBWgS4e@?C)69;g5l54 zTFLHb_30XDt>g&YVQ=fTl?9cy*v%}vj;8M};%C}QjX^d1EXtl@5cI*%ADe*%=i1wD zb-GUV?Cr?=%Fe*1=S5)od1<~hNl)OZ!YBqQjkO`-P{oMDJ`8yuvq3l zmlB*H?p739IW>ZsL1EGE`i`li=$t@ET)ll=-{ssZl~0fEaMu-U_^u=8?B>(7@m*K= z+w(_Iev3_5Trob#R{NnpTsv-U^~!7tL1*3u3dA~p$lKWjiZy(T-TKA$oV%7NYxp(E z93CJ!&DSmkG4LuCOb;fL27E_=@B9ynh(v`VQ7I!PFkb9Hzpkkg)A!hw!Qv zmB<=R?0f4(L+QS!HkBf(j8Td3v~To>I^@F+_l>Eu>M6wt7!)|l6au*gMInt!k+S`< zb=n;0MladAfCBtW;O}Dp?*<%X{BHw3VfT5n5O`(7VbT z&g-pEFN3PVd|wAetJf^1H$l~9)cc^K8TB!!dW?D=6_bbHHYjel3aT5|++Lx&gQABI z&O13{`ir1v@SNiU=j4-?{HLOe`}hY9g8{iAr0t+yT%k8oj+!lS0o zqvJt3>19WDM)BwhPqVUL!?MJCQlK;~tlsWdj?c)Mys7lv{jPHhYQEmM(Kg5GS1yFD zU$Z80N%@9X3X}i*yIHNHpEfABb=<=TZ?BQ}7x+D){AORjGChvx|MlwJgDHJJh`luC zvt6q`C_kV@l{S^;{FK+`o$xYsKdiWOYx|{RBG+Ggp?#$tp=s2|=DR&HIs@cndE4lYxzp}v-QwlzO9UAG0 zU);st6H}UDs6`?-BW~|-PYesC7nLJ=QLfQsCyF>}BIse-!Wa+ENDoeq2WO6k zgRi1=-#`&3Z9KQmZFznvUhYQ;FG<<2A8n(>AKqyF!X#G`1=; zDcRO*_diHbrPvDw{24|QuPRK+I9^AEEr!w9^3~Y-HaL8?YU`SiVi@4?tfwRsj(a|( z;kd7XsS2Fg>k}ES{0Boq9-tmHJ~Jg@bb4}1dO~taX3F49OtFP0I3w&`62fAlyenrT?V4;x8qUu3c2DdRQTQpP>XcMK*nQ{4qdXJ#Y}P8u;dYeW(fN(2Qu z!5o!549EAT{BNf~DT1C+(2d*|1JaG)6H3I_KwkFYQ+&h!j{D^4GEpBw_ifVddx`w9Fc z;GUzW3mkROjBuU6e@S2nM~>li}BtJ_?@$n1Onn!Fc@yU|!SXbnzwcCAh58;|%m20p_$GXQ1x^Fcs(t4ELz` zRtKiOz!eu?f9S9Slk^1oh66M9G5RR|<^uDn9%m5WoxmK?;|$_^9T+dFXmCnA4D>w> zOpqR@n?EUp4u`;yKIYJmMBDS<%%6M)`H}yd`4c=={}0TdpuA*f;|sdUwzyusaYSEF zc1Ryi;)RF%#K6=58iA8sQv(X{ALS}^x_;*)?yl0T`IYu2+BJ=u;zF}ZWbG~ zR}Z7*BblAxBM*k+Fkc*Y#>2{v#`A}#l-J9LkAvz(OOU8_4F)9R0|HVv@A75w9i*a^9^8MkVOf~UfzX}!& zu?O3kuPmbtV%A{wzGx@XVai?1`RGir41jh@WLT6_cb8b`Q#};k7=@yJY`O1lP){?76QKMV<%=ge z*X#hrd3{0A6B`FDfC^;PNKk_rl?jT5r7WhYpqem>PLxxs6Arkx-DmS{1?W<^SF33Y z(HD_i(*nVda$R(~mb7KmHFh$!({)dBUB}5jS!Hluu60^xd&kTYazx1+iRDf4`SKo=7Mm~G zWU-hgEGtzv(dXVCWjQFVkdBG@HY%Z%>Q2{An#obqvw@Q4k}IB$%i|!LrcpqdWuGv; zvZ_!^UY=Astla zf%pX!ulUq@bBZ>orV$_u+wX<*x+%U%3grUDn~FkE{!HRLs6a;1-YmQ^xDSdq2G63z zKf`=uLGiF8fZ}1HQ**ercNA&`C>q1EnARw~lL|$B9UcPuCdZ%Qs72r*2mm#h@q$3{ z5cCDbo1-UK9bqYUbwrf=>Ij=y9f8FVY;{DXPzx4H8m(g zO>TKVK=^1`1kMl!MUAg@nhTWVnh~&&{?S)SPr*V4zJ8-WtwU%FK57olpW-gqpYGTi z1+1&^mk(7%)AcMRnEWJ{E1{Tdlr(3p;*8b)eA>{6Pc^`RPeZA^N~jA^W`frgKZ|KG zuDpoQ&@`uLNSafV?~a7h%x07Cj-mg$lkbkF|0b;&|*OfTTZhz ze-?3yo26R_^|A{F!DrVv<&FDRj8~&c861?DZz_MSY@zqTQU&UU`zF&uRDOD44Pr=K z*sdq^Pp&zBTqmbUX9vb(8pHQuM&P{;tg{4=j9m?_#TS z-nPo~Uwf*&Bl?wHqt6~b`t?tp_ve)w()@PB7y22)K@T>i6wW@I)abd<&!tcA|E4^1 z7;)^2h->HDRqK7|c!hnHgT5SkC2#4*fo=Qmo%r=)`=SFGpIUC*NcjHUMaOG=a5%W? z-uiESy8iT`WBqDv_Iq*3-}jro`N8Z4l{1p!W5%@D7dNic_`KZblL!2HVR+ADTbB2| znx63W8=c;2c+!4$%8wI1?|A+9PhJ~+Z*jZ7Oqo68nA`pzompJ9tgIYF{8Mg{qvFr2 zfIleWsvK%NsWfqp`>Y|uc~O2>hW~Gc`@Z6X9_|=44;Zzl`bF)&Y37@mo)|u}xDei` z0H$NMB<%waT^rBKu(#A8C)C8NosFsm4o}r`^GJ8>drjVWf zd=aXyK0MSZnJvg5TPB}%-R>3Kw zaO8GKouRxfFzVcAb&3w0I``Q|aMZcaWWgz`XdW*(CWZ612WN%g(2OaS80_WcfjOYz z{P#1R)V7kNTw*hwZRmMLj!GTlwBW5G@5^cDKB-;Q&V80*awJc^NpcLMnct#uUUiOe z#`&mas+3i(RORLDF{Bb44J>s@5EveXQEuk5i<*s7rG^VBhSAuf z^3UT%>Hq$3Ng1k?yr(e3Xlzx|*g9SE85}c4sYp)VQ|My&v1Y%C_u6ieWUiX!ufHe~_@FgQct@B|pCzMiZ~98e97Z`@N@1 z%@MX3Mq`VHIm}-ExKe(3wJnb&QgR5t6jBVMu~i*dwQOv3ovfuw?G{oDqp?M8k(yr@ zUpwYhrOpT`hSAunp|N#r-^E?3)O{hvFdAF5%F8Xkl4g9UN>vpP1BTJqs->|Nlk&?w zRjQegVi@2sgey2i^FrER!*QR}rDuZKtB{}?Hxd%^T&(e&Zfws`rz1>1e;b~FCG>Ij z$OyfMtnB~CiCx{Nq_V{kBWcprc-Gg=M>p?FK98FDC4bL}Q?1R%O!R8OVuF+=5dY~1 zuxwr&J2MQ+Oh`&kPa2Oo$H+Jd6Urk}(!++P3?8nTgd~Ri$&&tKOrBPr@$#6^HIBZq zy2m7gq3*}Y@ab9gt1lk#$4Rj!(Cx$CCzIl~)bGWfOp4q3r&1ns>Xgv(+&NciSZw5! z_b3V?bv^lV3VQm;spRP+r-Y}E99s{cCz%j$)}nRrKba425!|+AYc?TH^Wi<%eE9p# zvEhs8G#Jf?|3XhYcV{pk{w@5gP~XAL8O?|Lz|H{=T&%};bJQI^jb6oh>RG^1@Qmh% z1L1KUm>Se8fTQk|5w1P>J%O1iaP*Wh!ZiVZ1u!QBjvfL=IC?p}EHEIMGr~Q956zeQ zQf~u}UImPB-4Ty|zHrw&n*)A1^dUZ= zegs@`>DLbdKM72$Ivf{`KO=o)$L^1dn=``EQ?-k~8wg}^xUNrtqoLMl;O5umI;qGS z>1zU9rFte)r}`X6#mfk{7P#HOOliPz)KxXY#ewhF5FfkYM@}hMy7^|xhFpPRKwOGj zPw*aapStNYTAx7rb^>!!k7KQgY=OT7+y$m&BhI7n8R?^>H^bLkJE*Z z;@b_F{(78&zVX0J)8lmdDENzkIUsP4ithr2Oi=jSFPeFnHKMz}#48LBqk ze{{bmI@@F`aQ|$Fcr^5}-9w+vrpHlxQ22zn3r~Qf{J8c6IO>0wZ-$GTW9h70e@7qR zRn+1B#r_3fz}$=fi}iPGOPb{LK|}ui8oY(OKkIY-?5`jF{M?3^+t0n*Kl$qMJtbz` zsU$6#`f%81{jP*AiwdotIREJLRo*^ji+XkOgqwZivxas5MNZjwOdlSs`2B*1&HwnS z-Gao)(xLyn*Puejr{?(h%&R=R!JhoT_ce{rsF7CS^U_DT4QkANzS|B{omZk?2)eV_ z>$5H;2bB5v#p&0V+OGU{W-O*epKWg}2$_+2?&5n7Ps{dqEP5gTsDIjMYs=4G`J>;dPmk|uU*)-~?|!^IY{#7s zH`dGP>MUEf=&K4Z&bhvM$$^Y|f7C4ePxR4El^b;_eC@%iZ!XqqIs5zd^X^@CTu7*5 z-Stu5H4;DAYb!MgMfh1vwm4c%)k~WE2U}*wKWmg|zk;a&3(+D-uD*#8uImohH3_Q{ zU3VjuORj{(2<-IGQ19)4e)ACqiick!*)t!Prd`ggMLR=OW9sQE zX7gUj#TP9~=AWTg*f_w9()asW=G@3WlIsYQ;M^UT%IDw4Z2F~=`B*`Q`F*T6pctzw zVJJ!L&nG-Tu>V#XEBC{#1$%h#^J6Wh{h)f|XE7DxYGc$bTrqY4UNxY5GK#Gb>5X*| zSen4z6(!dehwF}%=UYy4?c(WTJ}u=kKY53XoNfLITPr}Gmfl&|>J)B^dU>2jTU0cp z^%c;2f~i@T4NrOf!_Ke~KIrmG(A0lxMR;th<(}_(b5}mH(fHcSCzp2KJsZMu^yzIIod161KN$lE4>?qeZhwFPawXD;Y zB4iOEzeG`eq9tP0JRws7p$x%(2NMJOP=@s4tNIMHB*rsKI_k2dNikWXH?8CeG6v>Z zT;&4A5`=0C&z2dWc(%|p%7&lC^fRtJgRX<(8RUgj;~C@&if0g=tjr~lLKgw0LM*gV zsrRAC`%&cm(MlrgqFmP;u8Vxhu|$hVdCj9GhEpIZxen0YDZ#9eQnjEJTPTD|8PDp+ zR#A5IW9Jbw7&0u; zs}wtp$G~1Z@fm@yP;Z!w*lo zo~VDlB`g?D;~Vr)|46f7I1LFJ?z+2{2JCqL^)7I_E?~c#?41!as4cZt3J>t73tCDn zKBEiT%J2X*mf-zy5=yx%*~S*4_~d@ewzoj7bmo2( zFdZl-0NI4zNr7OFg@lS%hf3+GS;D)k5hXQyB%{{;fZPlur$A zxV1~6GdHF9;!pdzNUllQ(&QrE@0|+<^?RePX}Y};v*@|!ikj!>up`S~?g!@i)*vJ= zWl9(DQe~_Tzec@Y>$EOHKYMESyryOo$>CcN!qfo<&m2)$sV;Jbo|Q02TWqOUz%*(r zA${|oI;*()w-Ua_<(1CoG$^mMHNrnAukoaXBJuC*Um2)+Z2kKM*=!u2J@7Gz&o^NI zgZNAZ{89BUD^<-@UEN|H|FZ6d6kMvsii5|KiGA2YTQ1Q9hqhXx2ax3A&m`J%iS`np z&ji@x%auouN4J+FdVHdHKXBkyswn*3h(;S);AdfH;+BJe#YAH;-5KvoTgD~@cpFb!YFBMcJgc0wSpm$8F4sn!n^Pqi08@l?wN#WgPk#r3TQ#kE`l#kKgL2g9{I1Bz?0gW_8Hg5p}zKyfWO zplI;XVtNY{Py26_KM#th^A%9lS=#@l@cstHwRo4tup0BN z0E$aEK=ouHkaD{xZq4mJ6u%K$F}Olss`Wy*bMhb4;qTtvM28XMDNz^)aN$MzEUTl` zU7{B;Z`-O8_}((hY+L2E1CK>?&sGLxGX-KugMCIx6^b=o*iB7zuK8DAZ^J`8U)cwd zZk|~$+p-^&$nwRTn!|O}T`Vh^8auo{s3x+yiy+m(GO*4@(LnctzamjPlMN2~v1s$t+}amPFZLPIfCP-c_~MSYF-<}7GDA7d zOUh_ayrj^(Ag4Z7sI{PY={W$3*O6Zo-&>0B)5ukx$E`uh`8goKAGt^)WHxZ!b8ssA zoD}0?PJBt|+Alg-EF&dkD~2e_=HEq>FK&Vf`ZjQ70Bb`<8f~Pvc$N~_&e7>Qpmx_8 z#Tx%`*B1CluH#(mw1Uji>uIp+QfFz}$;?)AUcppjnHGnTi( zC4ZDFi&AD#2%*}7AwG;weXnZa9|O)Z781HjjyE1Act~N&P$Cc;I8HKtCisR@h5y5cOV)A^m z^|tp!mh}Ncn`QotvjtTTV{h(RhBrO8EbB)wyt-xMpR#T_`;r!&PRd0IOnPIZnA00u zTlW7gD-I(2t^7adl{9>#h`|HY?7|Hu;4%YqUSXqPkt5ng_L*1{T`<=BlJkI9;I|MR zM~6Qo*G=&8`g4P+W1m{S6h+%eYHNH}iU%i-ZSL3`Ltnf)JIxQJpetF+Jd9;EF2cwt z_4lJ(`&r4e=Tks=1UeD9mP(8@;)LAiUPnwO!az>+8G^x~I?PjydKD~D(5tW!7Wb5B z^f_}Z`=1fuPygyzE9I1ZU;-Pc^aE{SAKKB!gckPs8ZSgIAzgSOngWV91FJysN5>&h zyg~R46mJIZfZ~l287Tu-j(vOr!5Zr zqatyo*E5UBtE#uDYGxTz)p-23EN!aVqEaC|SfuEmTwnb77et)$#(fIo)h$`VR5BTl zEI3LAa^%Z#^sMBR4=64{sMYw%&PX?ne5+p&$$HTd5ZbgBxL(q^PgbfRwK6Y)Z!R{* z^c0s}KM*{|oFa>38P7e&vIO~Z9L1PZ6k{$ysF(4RossTI@Kj?g>!r}E_Eig9FX@~k zD^-wMnH=!({aKH)rXI;Y=zml)mA&R&Sc<;Hi{;;=r2*lGUpzzNVxr|-vg;3mrvs-b zrqq@q6)Ti7RcKM>TIs@)2hE9GmkmC$8vue!a*8BpG9F98ZIn{Ha?n5davbqFMJdQ7 zY@lAiPj*JS=faaxumtwL{3p6e?|NA={*81m;JV9NOl336nM%f&WucL!v?1p5)QjL! zgrcv=WoM*+5j=VByN8BylB2b$!}XF*TDT}XBfU%EiJYof%2cssSyROpEbkLZVkBLJ z8;F0NQ=B4eD;TdXi*Xsmn0Trb#h7C$k2pm!=2E2l3VyOP(*F%S)$%TfhGMLSfm39Q z>m{8J@ROa9-nH;VjLViVm2FWfn2=3mIR2lLfQdRgQngm{A+=>ZNoBfa!!LweLJZSrZ^ z%;e)0Xev`!I;~VJ6EM-!mvUN77wSvNE)fJz7fw+ajxiql(lq&5(7g9W|Kyv9pP8jJ zr+jeFB}ngG{A8C1La+NL#;YqJa!4o*5}A+I0@q7AX(6iY5<%$oo@2ZkE3Bp!zr>oB zZ0l}%C$o=fMsjb{D=mAOs(SS>mAZzKBGM!cO-=wL)HI<5yRu6H!S!>B!bCkvlu~@< zQ>#byv}%b}S>cG2Mesj}At)xCBB`s4SHr(F-U?fr(C(&L66IFhWLk(gX>%sfEtb@6 z;i2FZ>AT5zUR1|hmZJKS28O9UU4)|$aVbub)P2SqJIIti$mH)YMcKm=!h3{9`Ul4L z@bBawpPrS{*uTBMDK!ZvNF|pwr6px#(7z|NOVWr8jxDQf`+L{7>qpa0uC5lgF=e@5 z&Y(J>o0?si9~yFaT+qC6e|N0dd)n<4A9enHOYi4X9=hTuy=C`V+;ZBeHH-Qrj{Hyf zqWOPK8ME|c)AJo`Ee#!hrDy5#W8-R<%)Q!XL9hJ@og4cd=umWO(3O@|M>P55rE}x! zwK~&z`tBR+e%=)EL+grHKf087dC-o+RLOGRmHNHU*;-E>eQR9YOIiQ#RM-giQQ9eGqNxB>{7}nW7+DT#%~Y(?N*23haOa0F>_w`-dTA zwJrVLTNS=?pL1m2(@z~KYX9@ZD~sNIYWJS^@3o%W_+W|giQny(e0Gi5w;<3J{Z3rx z@jqTG^~Nc`>wis8+c9(g-nF@FvjRI->pnB9MMmuQL(^(jJmxiO_}lg0`Q7q$xs63W zZyhYra_Kiq@BJL==y!eh1oQCOQ>xvWdHndUXR2@Yol`FGrE^Z-GJ|IK+84iY?Dki? zRoVSQH&=SXpL>>k_rm@#bNRtv-Tw4Y+1h`G=PobPE@D7{^T^Skn=QUlruv_!demDm z@tv4@rsuDA?bM(_#dKDnsVqR&+J8&oXj1GtzqXM;<;l=G7L2>)ajpn%j;8)cE^y9*^3$y3Yp1X zl;Me?7SilR4`;NVri;$FDxMe$iP`HJT*-Yn#;eE^QwBa}FX|SMM%%4T=R7fG8HPGb zq%mO4=BA#QattHKea`&vFL`36u!R!O6XxsIADrqopmo3}c6H}RC zsM}95{AT6`yjke=AbVho9-I{VBR_@WT}qFk$B)^IIv5oC_5rjrn;uh@VdChDU(<2d zUAzR~h7IV`zscm!N`=~0P&p|a;D*Wa;JoU=dB=nEl?P{+2j{d0haQ>ayp<5rZcpUO zE1dd*Q$gW8CpbO|=LNyBDx4XDQ%T``EjX1G&R)SOr*M7|96Vn|ij|`31gC!1|Fqz! zAMwi{j{7Q7eFUb8!kHjA6&23gfuETEIa6S&Dj_^2Ftj-VYl}>O3Jz^xz&RE9 zAJog5pVn~x`)vkVi6B$05*w-u4z&`D)3UkXP#xqPS&CXMEr!}U#%UvjSewTx zgN)N$22ssroEB|S_sLNWW*l*kFBcfceZ%l-;HaA%eAhH{XnEG^fo*Cd(uZL*AADD5 zQmmZ>mE6yJrYhA-NHL7&<8m5)P(Nf3PV$|sN@WTuhSAufC!6}w{AZ@XG*xPjkYX5( zt(r`VwVa@)f0@u)m0BsJ7)E2Omd4h^&wpI4N*xta45P6{FL~NDte~Xf4I#xa8e4TV zw%(5qEvHIV7mYo`Xly;D*doPyMn8{(_T;BWJ0Zm|8e30mZ1oy4@<&x_ppar1jV*sB zC8uHf#;RYdQj>)g!)R>P)z~_7;j2_tYKf3y7>%uZOp3I5;kWk0uk$M_@!Bn<7)E2O zK9iEmq4oRh!>ZKpLW*HDwgQ+G#fzMC+jC#4TRxN(iODb;TMd9!%i-lM?=@DXXbBNH zhSAt+2(DV@OJBYbqDl=EQVgT9)rd*S@yaPDy{Jk}7g7wPu@$JX_1T6-V^yhdgcQSQ zY&F){niqZ7p-TNMq!>nHi+XE(n;a^KJ(>;oQKib10t=2|G`51kRnu_hn%|04DZHC9 z$1oaOO_-Ei4l_Uc{F*A2Afy;ZV+)->H(Pz**fmd;dR<5{jK|~U zaI1tA!)RnHE0{^~7SCjQW5SMGs?;qZ#V{IM^dwPjt?IYb zUzPHs&M_RrXl%6rSKZj-)r7Tws#5KR6vJq2g)k|(9F9D+XS*sjKu9r+##T!vMSW~? z!}GV+DXpa8%R-7_G`8r;rpBwr*b|?tQtt^VhSAufM;otS)NU-D(bnp#*jg{77)E1@ zo|&qx>idqZP^EqqQVgT9)s{)|8e}ph*8b*CRjQ(hF2iVSwbR(TQ`hecRjQqkVi=7r z_EyEVs-pUJzhSnoDwQmx7)E2OgT~f9>GL2}YNn847>%utOp2aRl!oT@X|t;+X}C^E zF^tAmCylN3Ki|$&rEpdWa}1-g^&FF8ZxEn{bYHVhm9kRD2aaJhwmO5W=GOKs|BzK~)Vjjc$Ht={Rs%uuE5LW*HDwj@OggsH*) zz75o^vz`}H45P8-P^74)tct1Nt4d7~QVc^%O-sNLg%fWs?jtZ=;cNCH9ptW!%|Z)Y zg5Q`<2|a|-N_7KAm8!LBBSUa8Jf@f<45Zw?9(01kM_@R@{pwYY-!Y6Pgi%b2`k&-# zt@XX2hEP6RnlRcBMuVf;y7BR<>#CGf*dmNpDn=u9Yty?x%Be9#ND)RW70aZkw2+nD^ngKn+`dul0gl;=mfC6E?~q6t zm6<*|ZG1vnx(NroXN|ytIq3>>)M%B>Xn7ACkKLeT4;;ciY*gy#gw*uWBNH;mr==*n zQNc&ERTJ*nUFE;C5;gKNHHTbDLpg89m?3^5Ft0?j4jR*(zE#i_A*!b z_)&YJkjldPBo7;$Ic)T(1lSvffR7ri#>ZVvW`dmdBQPdl ztc`-4LP?sLl0GJBgaJyI1gZfpY9Nu04W^JeV~1r9O-M>MiXulCh-xxWHN^%jkedi; zDrP+l1bHYQ3CTzqk(!X1l97o`uSSd>oHQaKBQtr}Xe1~NY$S|Mqco*sd6EX>RHtF1 z2PLFtjT%flWHA^9tVbfv$E1pZ5H)ln4F``-Pcf-n#hjcA(DYw!zU8hIMMk$Tmflz1 zzsV@WRcUpHEMs|fe=5B{`-VQCcz@kaRa$XYupb!#j(Bt=+_e-J5qCYs1=d~9qcO!s zN>qYisDn>ByauZ*$}X1w%CHkeTz*6 zePdj#9uHvg+2sM{31pOA9#F1TJ>*R-1RhYX^@*UxM&IK}Q*8V_kvynI)zA~m!}?@c zuGgr*6{q*fu*D{V@^F)jp=TL$g9tU^!70*9z7w8muDL%>1-2MZ4^hRY^33&6;0fuR z5W^q+aX6DQX-JB#bMwxfAJs*$+1lCKnScqiB?PyKjB<7f4UM*q9b{8@UBhD|ZRuc8 zcOzkRYAQNzvS+B%7Tq;8G@^@S>)fhyD`kBLZUVv_u|4QNJi2o$TIc~zSKNnmZl&mM z6X}d}I3gp%Y_|H`R$x0dUc~Dm zjpC3q+NrU&{{6yWr^bB9cGKb5PK}u<<1zzAj$+Djq3_A)L!a^%&Y__vqaE&)Z+*KJYc>QI2yAkZfBi!!0Zq>dOKz~ojw}R`30Ce zPoS>^(pMfWD^8z3^fdv_i66N~g|8Pdg9J{|r`yqo%t%Sk7(nlh1ER7rh7BGN711LyVnDZUvAv@QIHUW-g?CGc zkLl4PB07G+h+%^U(C$TOQ%8+T88KjRTH1g?S;Iyo4~QC+k{s`hdp3Dk`hXrOBT|ww zQU(kio}BvcH@D$?x8Ng(;|QB|RK zo2&~NXDUn9kjwNrfX#u`|A>7oj_t!%5aIY<17GA$9gkSCaN~O}XNTXcQ-*>u6&{Hc z-D&vxh7HPvyDmGe5zBcRS|fJShbB1YPf3^Cw~#N+ym4MQ9O{l^a#0cNTVJb9I`F+l zAhRHU=7oD~ZzB?rz6z$)!G}eJOcbBDZ-OK~D=D(Rww}d=QDdwNoww%oCr0#X5twBZx>B?CQfe zJCMv*q@tZp*DVVAs}bVsB_92CHf9cSa>Dk9AZ&3B{!*b`ESpNMd zJDw;Q3{x6@G`pqhp(m*9o&v#_#d3=D1TtQYhGp?FZFN(HYvl^d94uYn9=3%*_~EDO zq^Gy+_$)hxjZ>uaS^V(is$V*_YNMK)YIbXPs_})(KOYFX5;Ejo?YDM}e)~VS$8~;p z;i9THeQ!?8y>a78ty5F`3>y7gT8*{cTD`EP|Md=Qf+s#Tw^sY?Dc9}!KaW3~=veSk z&n+kO7q;8}e$#`aT9$ja=$n`3$wByEE_$RYqIK?z-{^5|_M%P@^&7(X^*+iU_3ju- zDzg_QA(im89i7KKG1T^%y(sGly?;&H;T(e-#-V?c$sfbTD&$__K(jJEMEjMIV;Iep4du2v z74?Bn+qJ4xkdR^+&GZme6?Lk2b*bM=sFO0Js;vtfA{wYt1B5Mx(b%Gy z8?%=`t^~<@aQ92~M2m4kieWUiXl6pSmH71PxvJD0A;mD7X&q{S%wED9G&!E@Ces&! zO&HGG;s(@Ce^9$`_8Lm!8g~>D@{94KCp3m-D!~8i(-=xfsBf#e!MPTh=}Cjtuo8j} zyTE||zZl&nGx|Xk#?uc!aBDmW1_Da(JO;kpf@v(rVj$k=gTta@qeJadn9b-#w=CXt z+XSmGy8e%S(+vq}+mhkwO?NbV)BR6BlSwYjMsKQwD#LozK4*~iEnBSgb zFxKcB;b;@3dY#ed3FSEI#Tns#hraKC$&YxnzBP#84T0fEV||4CEK)}Be|%X*wHe59|O6TN=?$UQ2)oq%!ZaXNjJ zA47l{tH&9HZ!R#4^f&{3n}9i>#~J9m49s0UPN$FJTRn^|`G5YAG+Xc*0funY^xbS@i%!bG4qx?82Fd&&LPTwWqZa+pJrC(LNb2Jw3 z9ZI?wAq<_kSer;p;hADEx?I0Jq6fhirsl0+@{2KpKR z(@Kvs&=&_xf*xm}Z<4@p%f;t!9&qy?qmSO`*8p=sk2470Wnk{=ak}ua`Voucf$<~v zsQh&R(^HSr>GOe(3}ABfID_yl0%nCCr_)FA-3!b)fqPW_xD3qQC(u{DJC0VzkKCi; z8wE^XJEbtP+0Ylz15EYX(ebJQGBlgQ>4ck=&OTHQDf>D!4(%@D$kJu!+^LH z*Z%bfZpdTwc|(5M6Y9$YZvJERQFnL^FsB9XQRVp}FgG8gkDfQ!xcE}} ziv*^(9%rC03z*4zoGyH%?*m}I(BlmB?FZ(B9;eesuYtD(1|)OE+tK6=f+>4EbMA6_p_zP)jAb1Xk}=}h6P=7EDgw{^#)VjMF5 zDIM-#%p89TmBarRGsi;)kNiI{ajXuvQ(8QMdsuYwtyfbrYL9$j=A0qHIo|sFCs6T7 z$exGmHs1U0$YW{J(Yc&Ie2^eeI#WcEgv$rha+rAFFGZy{BA9(*^sbQunsK_DrMR)84QB`^Q&L zOdT|B_R8{$&b&KmY$wy^@a+wjC%xylt83>-zq8@4X6FJ4U3cZ=#=Ty*@mm62CR-Ci>9e45({Fy8XdV)Auip8KYubo`QquC@yYH6TIz=T8A5}Vf`;m2jy+?0j z|H$=dy7}7tUXx1Sc%{waXQqZuN^U>n)TUnxc4y7|a6^NhhnCIw@(rnPh4r15e(Cb* zHD!9+?YEv9JbT?sWxw5hYfx@>)fN9no&vgcOw;Ro#!YJRdF18}*XM=r{i5cXsB&+= zaBq9F+s78Hd#~`}swqd>wfyMXT<4b79d>peH)wfS#pKU^nSW#A0ya?JFYjuz^6$r8 zzddkVT*~{;_+R<@>u0|BIl0EdKA**m&K!QjTCjCZ_MhPqO&4FfzWsQUpFgzczU^P} z&a>g4zl_0U>{fmD@9*xt9Gukpl{&pYIv>&Rvr&;poBUB_!_D?XzOLMR!|A92&-~SB zfAYso{_3|O=;M1U`|pnVwng0~C+FO|*zbJhnvtz5A3pznhtkt})jHF4`Go9`&6yy86)lr>DoQZ`!j~`;bYSx-5Nb+w&2QDi5Fi z5Tsa+lj>O*>5h)EBLf< z6{R6LdQEcw(Q6O6;{K_-M6M(MQ?BkhsOwdnqi!-e{XggOtGh0lPu+iVHg;9*%i)m! zg|{Y7q))7$V&|AefnmXtmQ#-0Zr*enRvN93*%`(vp(8KM&(4n0iOTDi@5l}N#E}=5 zFE5?BK>BH|)F^ZZ>5QMmO%z+#f$2GmpcTinP;W$_GE3X0uP3&I(|3ZU+?+!A5#1Iv zVQg)gw{>a_rfqouJsRxms4GmXZHCebPJNtomXZ^2`02%SW>Akq-Tit0T7(d0GR!ZXK_=JNwL;7JKZ6ez#9All6{0-y25hge|-4 zpp@6Olw>|EnRnZ9%$m!xSF-Msa`ER1KQffj_|N(QK@3NX1|N`e?s{3@xJxOLH@=k9 zwOiVJ-r~#)OOwp^oq0(`6yTV=Cf*G1bRCOw{S*~+Fe>PHNWpqC>j*mTa2=FSdvTSo zEaenu=9aH1<@NBE^2%3%4WBXR)=_zpf(}YKcYLflsbn$dp0{;MQ&2H^wY{VA z;;atW9!FknvmTqIg8E1zdtU0t?Maqk@N_kD%3hwvToWDq6&OMuT%Ev^x z_N*rpIcGXcK_{Gfy?h+5OHr=-lIyn9g_Fk)ID)P@f-Xb_U5g63;|SV?IQ(U|jt;$s z5ZnF=wT^aHx<-G#m7?-`*sQ&GG2eo}!mO`2Ykq0%eURNBWXNgA|LCF3pn}BiBr^UPMkv} zIpt%!`p~gdLum~vRR}s}EfJ^g_aM&Q^SapDq(dSz9D2hOW zf#r?Z+?h@c+!_kCJZ99nZi%18^a`#m7&Tj=Rw$H&J*B;IMwR6H1C5wOO-7nCuPOXl z(=?8n52Wl_YCPIfqY;d=1F*a=6h*t|ak~o*Md7uaLTi+Hr(`aOa@F1$<%-|w9fd>l zHlOL}aBYz`U$8jK?Q(3sWI=9k0o0irRcK#JCEspcNt*<;d{>8 zH&$dJ7!WX&+KE)9g~DMrg-%z*aqH^Mk=E7a8wOads}Djk&WbFMHea+zn+rSIbIw?$ za+@8nEagTNMxkl3t_kl+JF0IkgsB2s!4im5?C;UkmmD`y&5H%w%9;Pg;Ji4 z)ofH!uZ2{f!_5oH1J!#M{%r-U{xY7^n^kTgy$h($hx-)}5>DR>`K05JK_#04tduXvC6+^l9o=$I}eW|YO9s}*~J@ceg5=B{v34VNt8cmr4Ld5L?M6nJ}!T{A%A)ze-66m zPg&#-T43vF2lB@u=TBLlKjkQY94vpRX=S(Jl_)D5a{l0s@}~x4D*00b`LokKe^?d4 zlf@%{O44)SS|PLs)XdO>*pZ8>>WV1jB+`AGM91({N2!iRb+DMIc?rQ! zUeitokmUS<7OEteSQ3rXUD-18l>uMUz3U$B*IxiKZpslf7p;~-g+NWG+4 zxS{ph`OIHAuMcaD$5We(FynND@PI(f?1U0=*bfx4)-Z|U)&M7eQ*pI1>MLCBjM|Q?#HgdV@;3W-P&7BlpG)49jy8vDGmdX{ z!g87uZJlxgWL5^HPBzfAuo?$5@)NlboqkR%N2lat=_I-4u%{=T3qa{bXgXk0By?62 z32NwB$mSX=Od+!||RS~rT-(>@Y8hRHN2)zXeT_lxkl1+$7Xo`f8 zEF_Rd3PnYNp@=bx1$$Q%I|^1%K#GVR> zm)w1J=A1J#XU_E5J3?<L|UI; zr{X+MP1OOCSHCC8JJJ{Iz(=Y` z-id>S_Ln@MEtH(bBaa=TD^J#`=9If}|~vv%{MT#OpF=OMv7hZCaB$I~O|d7mFkLHT_G#C^{Yd1JO3QCx@&DBhV= zhJ@1kRVZ%??qa_wcpU2GdIwqws~EY1xYM4T!W34aM?P9VggqA zRhP;?n}sdE4PW_dmlBb$U$~>buq`w1&Mc9uVAZd55Yp6SLi^UT`s1pT*M==Sj?EZ0 zw{DRt8kB2UQgb%1W4iU+rRHpuucPK={P*&gRMGa2d!KCdDL_)U;_<6>43qe9jpgl*Uqw$H36o|>8nC`{UWTy;`g z(n6tM?g9yi@V(h6vsIfS4H#QBs!jiSl8Pc8EEuJ`JvC#Q+c@-rX(=^N5wjPJstJjT zu4x>XQoT%;{@gjAxK$c(D>())$mb#4CMjvA7Jm%|-?nc;5^Gk92q!K~t&#L##)}-J zsdj)9x*sCEHqWc{LwQ8$ z=AvJjW%v6HS#IqXo7Cqp7S@I-Q#@KR_JMnMedG<9*tY6 zRGNoNnsCJ~e~o6dI9!?=z~br&y}!lHIJ?E|tH&&|Mb>Wx)eA;9tDKweRykYtB|qKU zzD7pgJw!|cTMcdw+0t~oLRF|`Qbm;SD~kUwObVqTX*`=rorI+sCiNrm*-h$ggj!5$ z3%;634`5OcP};wkRFzGDD$-*5u__zMRSl6ea8ZlQC(^YlS6}IAP zqMDKe(J#1w#3WQS*D#u@%fm;y!j?Zy%o^lT0uf)DgQ-9~i8(h_f|E&d@dLKSmensx z23o`qpvX~}A%rdGb&jIUBYi9c{Drz6U80dM+`A0=PNc8#uOAqZBWnR$e9}z+4f542w^#D)9fdL51~iP$^R7TDw8zVRys&e+E9g z^}mZyi}i2ASJQw3SpQl|`xon9ZWEwPV;=qdtshgb;7ot8$h28-aHf9}M(4AM572+= z=5E-wUJraGt_&1*KEEKKjZ4?4+xTuVXh<@~1&K8iU525v&bY*43;-1*qJl_wPx#)xJ^)scBHv{$YAA2-A$Zu_z|0CT`R%7#LsrsuczkDa1Q1Z zt1pg7tS-Zh{4&gdzcGGEeaZH|Of=#Rk?ZUd@hwCyv6~`(7vuZIf@T0ENN7Hu<>JQ% z6vJF_+>GaR@w*==ThPNmisMBfHTBpA#4CWE+A$zbbVIcE_^xIyJ%L7uABXWH1#wM; z$NfXJ0w5LdBA|)*cWRY*avU6@(FSQ$PHi=woKQJ6{@#a;wNozgNf$)B&lL0up4?gs z(P;mT1bqOcCgHyTsYy8B^&cgn=|ItfW&^3TlmT&#)v2unQj#A4N)x*0fWjnnpU>}G zAeG-^Kx(E|7cDF+6s`>dQd;W-q_ox>h_@SrXpullyQ6$`(LhS4ZXi`2mjNm5-V3B+ zdjd#l_bni$-LHU@c25AQ9Q^~N^imJKjnZjTAf?kbKuVLHfmD8b0x3O@1yY(!08*OF z22z^59w3uc?^i&oERO=I@;wQp;s`-QqIBBRheiUayd?lBO-=z)n&cb5 zl_oi4QJTCANZIL1phD5k%kCX;|v zjxGdJ+L#Wc^fwDg>1qLx($G~vii5*ZrSV&UR4Lp8q%^)BNNI8#km7h9Na^ZhAf>BA zKuVKs>l+#$1*AAqfD}h2kfNLKqr1h2)&VIFzPUz8=6h#UxgGa~YN1AGV<1&VeSByP zkkVQbkSZg-MMjm;#Xt#S5rsgij1~bYYhMne%IInz-3>shjBW!`W%MSHDkIJpRc!wN zsWR$}DXA)>Awa5(+(0UC6M$41O$AbAlntcHs1!(*Q5BHls0LDHbOVqoquYU089fH1 z%4jo?;&=^6>F+NfRRhjP(iOVIhl+p{$08ub@dS|4_$$6pE^nw3d<#gG;0Hj8;}DQ4 zg}TU?LT!PRUU~wlQWyfHN?`<$DuryIT&Weae13&MDpl72l}PCIzR(we%Ea##pWkjE z728KZDz-yFmZeyI0kb^39T#O?(bc$~_E22)9_#?t#HzV;MefqS*bkIX(}#TfqN`s& z1Y^Mfj0-vCalXM`#VBJTkIOgunjV&Dda2=E9J|F2EdF5zwyfwya7AyV8rxw-Eo(c= zU0KysAeEn7AZ1mT11YPz3Md)>Tx2c?Z#OAgE!aoJ4?UAu6OGlv!`$y%=zbAPYjj;w zsGJR%QMtR9zL)I*0`e6 zZ_#1RwBJA(T^$v=Dj{^&^6L=hINT57l4?TULTVs(8kSdi2!I1S#1XMtw#gH#U-OLl zJuxiiOWDF2isjAd7g1R>PrqHzo~Pg2mQ6z0lujJnxEZ(fvH9HGJ?4%1hd7qTem=M5 z`XXLzRbdD3I7QSX;O#i6XK=*9?R>*i(|Dw(rc;Dx%%bO(4>sn9kyaO6DT|Q zE6K)1)_vGZ8<*1WJrqq!O>8rFzqeP*_KrjC(__!heKbYi#={qE*>N|{v7Wnm`kozk zgB;whm%Tf3=(|GP3smH?neRS;Eg$v$0Qc8#;T~k^5Ny%o`fX1?TrZ79$i@-wejf(h zn8#jTL+s0ME&U2ADC@_K08oqis26jSE$lf*bVLZY*Yqv8MKhsuse1eizX2kd+W^0+2`0e4rtM?(l^^?hAbz zXq1FTWf)Zk8)fKYkqUi}i&VG_rNg^{?LUey3SAUG6de z$c9-Q&nDpLPQpKU%a62mT%>xGB~ueJh36K*F?8SLVjgc)3l z$9k>`ullE1*p-K=2(_t#h5K2ntE+gA7T0}8hV4GHm0S_nhY??F->}W%5=(?W#o~4t zri_yK>O)L^6HvsBe1MHvMJr{xTrD)MUN>j%7$U&fG_2f24u{Et=E+x4^i3VJCRH6^ zvP}a29i6J5aTMk?{O@Y!W=5;Jqtsz9aa2TQ63Z&8kjx!UbvA|5 zu#u8cP++Bd1}DMTsP)yETHBior2<{NT^--?F<0+AvQ6sKk+(UMs6ehUCjnA5>O&w^ zqdFiY1>ZtsoT5Ur;HN@A0#Y^VA0SopTEV;(;=+SMoW&^K93aK}1dx)v6-f2i-vFr| z`?SxGok~0I{<>t}(S_>7>fx^bH3dCd^{2ji^)Oi6FCndTFz-EKRX5QK)`pH&>cdFX zhw^f%3+|e0+2Nr!B#t?m7?yAnFAu}6BkBMeWKpmO=8si7G5-~Ej!&_e8<#5%ASPq0 zk{g%fXBgky)hn1vPd^y`e%OAZ6Wi0TNQ|o_BvA~1D`*n2QnBr)5ck}jM?KD?tI@Xe zvtC6z?N6Wz2hFE8bvUq<>sahUz`)?3ms~Ce|c3QwRCj`Nf5*9ug-bj{43~6i2Hg zEurh#iFzDzW52#-AT{(@x-cdSH=^gKo-f=h&u*p#hp5Ccx+)j@9 zpnq(DLmZ(Xzd|}XIk^^%9x@a?J{E`9H`t}`)}%B;dZo~O<3boov|)3ehDY(WRdbu=!N9_Bbcfay&4;HU zo=Y-Ei50@{0Q@o=;t4to(IhYo#NcrF4_Df&;CHrwz94`1x6m6Q}y)Q%|lh~hd8bZY0tq}V%1?s#g81vG-KhrIOy-4 zwf+B!?f<96=HY>u%?!J-yQVyRiY)R=KjN-d2P5N$zAoJu z2k)58REMfi9Od9!6Z@bx#N$6iF87KP#0m0vL5@aswMM!4kHiZOOW*~^g;K+@5m2u( zRETvwOZ>Xlt)tb=L^}aza4=NSHTI!qK#GG@MmGwmQ-=5uxxM&zY9jlfQ{);PXOpcs zNR@y_#BhPqJr{wHji)sw_V~@zE4h^U*g53R^T}oGhAz$~SLuQ>`D!7<1xoJ%1mYI> zbCeK|*QpXxh?IUPw&JK=LWAv#7C%SRdRo)Wrdrd|hDSpW)SCfMStjBq z-6Z@gPKC(%g!qY-l{W!4IT)(wXk`k~$`r?Npc?!ePK7g<3XyvQ{&g#hY%D1;IL;

3ya>Xlr|{O%lbxA^2TcFLwZn_Q&}%H*!F;R2<1Cj!w9 zG^?jI%Wa@FiwxD84QYIU98rAeZZbYq2`NN9ap;YlHVM(1l;cvwOsu8DMafew_bOVJ zjY6~?#YL*eEGY{lpKD;$B*-A2E=r#2sx-wx9h$Ky*_8YKIb?qXK2=H-8N~-2wW*{r ze`X9yE@kosaE4RicAhT~$QSye&-=Rm(YgnmGwMVrdN)3(3A66pqypqQ1y7}4g&6-g z;@5Rzh&B;5pf2hUox#PND_Tlbi27Arq~hkE;R4C$@&$Cj7UKOzTHPIuMYh3pHu;K+ zR6IpsxIprMQS$M$riS`b)Xbwoj7!O-%umlD_c*A{vNQB?Hn~b4lxbYP4R$?VI}h73 z%0;@M4-NXz*z(lUJ9Vs5-Oh)2B3Z@5IJiY=I7MlX#{u2_*Ys0n<8#QZFLE8NL$%iB z4Yk&p4Yby%&8^d$A7E;@#cMb&(<^IJh$X?bC$s|%>u3#!)DxTSVUXkVA|HoBUK=BP$@qyARm$s*xcS9uu5JWaK*D?{I{m!@R!Rj7vZ0I0H8 zh&hW@(r`GmMP_5IMPwtbMS9Z%jY}HMAlEKFbeDop#jOyz6NTI5N{CHy6&06zN4szp zM$v3nbbLl?;=qQQHG~&lln=-+a^)A66nG19k6<=$#{-oYSK_(IGXQc1^cb4!>fR&Q z)w@SopV2O@Y;Jx@i8r^QrY@jqsO5SCQJ0kzqc%1^FL~jd`FAv|lfCij&0W^Kkp0lRb7#K$`T5%>J?Kt+xBlpf z=eHfVV*ig-XXelPHhuSx%Oh8=uoVKhtK>k%}{K zlpTL(*d-r~D%{#KrN;$@Gb7S>O@HIAX-UU>JP^`rW8?>S*Xwcr;BS{aepy9pPu_&; zj(ffLhBmp|d6}olnl&>vJh@}+_iy&S?}J-!jJmS4#i_e?PW|7Ox2ffKyB?|9+JEQE z2g4Q}@0wnx^x-dx7C%1rhpfiiTD5DC{{Dxfw%+jVw%_(Y*Q(>!Z+t)Fx;F3hxp-}d z4f`@9o4(qu;cJ)OvbpcacTT%Kvt7UD^`0*sJAG!$ybqu0aORIOmxpR!ui6oP!;?3x z-TLbJKmN1sRKXWTzee2G=Jf8bSH0b~;=IM-?=HXj@r`MHM%{AikAC6LciZq}?ptpq z&3U?DTitot+YiSqI9cl6+-&PpLw23_Y1*dtpSio$Y>8;|;=p#^oo#M-?)%mAKRFfG zVdra~zP#hXE7BLo`d(HarKI?8e6**$}qz*e@ z$<0gr_8slej<{jZpM18(-oHLwym@@)<=}W@xY{0e}9;n@lfN-=I-0N zBxA>$-H(h|cIAy%b^PMs>~5D_uuqH3-neD*+`QFy&2x0F?mX^DV(*3Vp?}{q{gaj% z7oKi48oz?<^3cU^-R`>T_Wgq+{`xJh?_Y66Km9Rz+$H03J526y`P4^yuNw7S+0$d3 z_mq^r@xhGP!itBAT{Q!uuKT3%s}Elq(X8KvFV4Sc(gQ_Rdtdvyyl0f&R%lVU+OlL| ze(oKsLL9u9#HmHi@@AJ0jEGq6a8&9(^NR}x7Um)hZz2;K>wBxwvfu^igA9Sb&w;t# znH96crBACPG%xtV3}C$pn9`k&t!%B}e(!v!t3rGlZKKeLw+l~pSEkQEd}CW``ivos zG$vvq`8DNNS^642R=M~qkQ}?MPLG%=Y47IqtzRstu%EJ;&iZUV4mwY?tDs7 zTWL6va5~szle)ox{urfDqLqdd0;hwW0_9vV?t4UAn}#WII{w0wDE0Q@lm0Xfgyw!c zsl&fM{}>*%ob% zp`ZcjTA&MW3c-3oZ5mDloQ`#PQa_jf^H`ogO_#lrwy|QAO9-$Hie1 zT~nV=lJ3*M=fe|2bQt33DO{}kg!z0}|LB_gd>+z$n)!TQ)O|28(dE3U`!w?Te4+a^ z@%j9&`6{-8MR*6rfA%`uAlB1Kzi8}EaI#^E-TLAGv>!2L#h5dq) z*6?vUD4*{BZ=Srpg|r3ywoBKK(AX{lX@gMnB9PU;ctTAsW6~`&wo6Ca3YXMPpr)rT z-e+?Cq{k&Rwz%5a;wp^X-_Yc$ql#bdBXZi}YHy3{m+QZO+vIAia|w+tt`4@icFy~w zqsi4@=MoxQTpfjrIwZ-`FR$8Qa`B`vozU3g;xx_F;d}FXyl-+%(z%4j7T0;gWyE!P z-HuP2Tyu3Up|Qo)*%sI59iM#06bV6f`D;&ON zdC@jZuI@UQ(AeVYAzVgz(Kbx3D4k1aY;pCp#YNjNxh~PUgvJ(EFI!x+4U_9qol9tJ zarL&vMcXjBZqd1f#uir};bM8wt&Gh%*3@Sk8+9(BvBlLFw5AS6{k?9H$@PxTB{a6U z`uVsR*WHzlZVh~K9oD&o#uit99~TYb*8_QnOfKwIi4z)ITmyuQ_0EC+PWy_V4)w*w z-_X$sjV&&Yh|PR;3U%CXa;4~8LSu`IBYCs!-QK(}7AtgOtxyL-V~Z=o7T2kZ?vFLO zuF|=L#ugWQBz3tIwb6Lz!SN>7{W_P>*y57yK8I14e{uF5YI41zbEz%CftL3Rv->gQ zYEkdjY?JF#ol9tJaYfqlb@2BF5hm9kI+xJc@-o1*4Xl!xuT)3&jc3Zc`nOq&z zj*k3hz&-{TCtQYYIC}3{ZF2Fq8FWHpiz^DgW?XyknR=zkHAUwV8e6`ig^Obqwi~m1 zOueg_ue=uMTtZ`uD@M4C@@n+bp2tkC8+0zAvBeeZi;Ly;;z!qCU~)aKa|w+tt~gs< z1tXun)a2T&a|w+tu6SEq_wKvC(B$GTQ|N@o7T0+AnmSzV{N=F8B~xgG3ym$V1mQBu zt8(vm+fA-c95}-XjV&%We9gGtJ#j;b$u&~v5*k}viNa;X^?ll1EljRVol9tJaV6Q} zN}n}+hsjlRdu&i)*5f3qVVKc~5jJUtD+T zTtZ`uYm$$P7S-d}BcGXEkLz4QV~cCDa2Yy$U{L!4^Qy>~bS|N>#Wlqi*Xo@w%r&{* z)wzVm7S~kaGTQlOn|{Sl`3xO?t8)pBEv}1faov5_#}=-?buOW?#dWc8vAn2_WA)nL z9ScTWEgQlMPH1d#O@pu5ZuHC@cF5%Ft8)pBEv`$1%cx(a3$9BtxuSJ0p|Qm^-4@p~ z;Sb=)jz$Wn=v+c$iz~|(*X4tL*=uqY>s&%(i))50t|_M$ziD!<(7A-h7FV`#h2u$= zKB~ub9K=vxw7YaJp|Qm^6BMQnXMDG?xykjS&LuRqxN?NcXg7Mc^88lM7Z>(5#R-iq zu3TGO>r-FfY;t|8a|w;`ABT@&>2Tp@!V;|`7}o}~tAQhpohuJMPDgtN z!Y%sgpDiZWP@Ri3cCLK*;PPX#z+Ktzh2|#Lr8*aB>|Ar;<8(k#;{MojC-P#XaE;DI z8avlq_?Y?n>%yxxnq2F3F4EY!3WTc*o^zn-0bpfEq}h{OLlHs7ru`6YQsXnxVG;;dPv#f4e(vkNM`Wj;nd zd{(K~TiXx!KUb6l@I+o~`&RJc98&<-jPr{u7X;G-;;fwX$|+q0Mc^jhEaciJlOfp^ z<$2Jq5ZD6B%Ck$$&E%6-MV^&yYQyxk@yY1O7llWJ8)>!B)$&x7 zg9B04@>G;V0#VlTRFp#lQP%RTb=fkK>8lw2*)oFyWX}wgE1>LoHvwO96*9SJb(bb z-UnbcLTZ<)WJ=Onq9r&`E-k@|H2nIOz{o>7rww@if_cf@C6PFPzZWg8o=y~kU&iAYy+`~ ze*gxvGY-II3DjBjK3AtTzUhH16tf%EX=-^Y1x19{@>XT<=WP^2Kx7i4AQ4!@O_-^XQ5P{W-J3~{q(d!xn;9yjjahDA|PqoPL1 zSUA5Z*SpX%j>U+$fMXcz5Vpg#|`5#(s4t_4U>bU z7Q%{Rvdg@-5vm%S4jM9i)JT`<29FpyYSi$Eh!I0gKcc}A5yOWMce#cSjvS%rXEe-R zaY9>l&-yuwDm87iK6kU8_2XP_5dI%Grug)rYuHS)p7*2I3;6%67G0FqEXI1ujdYw< z-`ER3=)ymp1OKjOX)|imMPSao7BnAlYY*-={0E|o!9v12BXPcHtdME9pM~xp__vP5 zG5&{Qw)o`6g2=Rz&7Ug#rYG?R+gP`jUx~d@PXeJK@LC3w}Z-StU09~5|JS;9yK45y< zct5%{zx;Lt-6}sif4%er-Gf2U^#$EKLDKyh1YK{)>+Z(G;sWKD=}QiRj{2J)1YI}K zJro2T?O=BhbhN)CLD2OAU57+GEG|%fspse*=w^U!t{{L77cJ{1HV+xxCG8jA~*51#567X%&c<+32?XfO8#L3bYLwgy4Re0&iE9qZ9w zesunN?gP59-2S$>Kzd=9HOr6AUmlyj$Ah4wT^;kI^Dkcxm%2>A!{P$9FBqz6Iev8h z@}fa^haa7PK3Fe5_oMTdN4u9TeSYdLkp9?D_f0b>)Muc4^hQvjADw@^Y|_^F(fQ|t z<-6aH&R-twDwKx|EG|$!Mj^as5OnN1vi#`$)5rR@&X3MNeYEF;esuowsOO$M_F!>= z^c;oo{2=HU?;}Cb(N2#9K}Wk9!~+%<7f8>vgNz{P+JNq|Am|wH^+C{e0^PGg(2WM& zdqL2#eQuPAhs6cTFXashf^G=t3WA^;1G>9|pkq7!Nf30*$C)7LdVsDc54Biap!_m@ z$wAPuU0V?ZT@>hE@uTyv9|J)5j~|_XePe$6@tBRp1z?+{Xy4=2Y)OsP(EfLe1spJzy4_Qw**1Q^!?yR=dWkBSG}g-VR3=lE86`WKRSPT zBS3d&kaYWkpt}I_8uBoc#RbwIr|@n+I)D99FExI2{`p}2*b@XD?WOKTcvxJZ^!%KYg3^*j`GyZz|=?STF2Uw(A{^2UO0+;luFE>J#1&q2^dLe8^6(6Qe- z90VPwDBZIxi31E&&siSDesunN=?uD?gP>#jHU>e*{QevS9rfI81|Aj{NY9*FX3ek= z0S3x1?d8!R=!S#tj31r9Uf7-v%f`dv0>#U5-NGQ~IG=eb2)b^dt25IQDPSPI;FzNp z?nmcu&$RnLX4jVIPv-*3=)Br={(4CO$whv2{_@z*+~-HK1d~iAly56Ac zn~#UZ1=1hs(u1I5`YsKEj_G?a2)bdQdoKvO2+-A=gNMZh$_J;u!~N*|%Y#$UWkJw! zKE2P6&cEDRgYKUo=(>ZhJ$YB7ArdbZplq2SLXn_7#3~{(5N-y1jmM{`qx* z?nn@Hl-H;L4~q+w-!=#j4}y+*865;2`{|2=pz8;^8-k!?`}eXRoxlEA&*dm5KXn%< zzikmVq|l&HpMmIH2ucisj{Q-75Ombv13}PnUb`a*I_l++ADzEm`hu=s5gry7D8C$^ zP7H!>0O(c+LC5vAm;LDc)5mt)S&WCp1?u0}4kh`~`PUEjTbBkw*8y~Q20_R9?{h)W z(VjmGf{x>R^-@j%-32NS()BMfDAZ>lx?}{U`_cL9ne&;uf}mr5zxJc^*E7eR_2=PX zae>lz0m7q#pksS_MG$n<^V%TjX!q|1LC1Jc1wluO0`ArCdZZPNygP`O5(IDssfv)v@JS;9yepw!ILC{5lt|ACJ=Hrnd=-5ua z83Y~MwYm%Nu(&|^puC76=%~N^An00w?%E*e+Jf%>Am}*Gc`*n&)}v2@r1QN73Osay z^uqSO=RyhgJp$1&-n1a-C~tlcbR0+A8w8ybbT9eQMfja-2?5>9f#@v1A_9r_LVZo! zR*R0;{ox4Ppt$()(GxwHp2V2Z-SCJ_$?RtLoZyK|jZTTr=;mT{zvBNf{17Ob2IiYK1-7vTvSG$eI zVR5_N)!Vik={wses9P#=mHdP_zGB@bt`Z*qL0nf~I*|uSXBQ>7lAqReR=WO+;7SM< zaou!r{IrVW>vw`rXC*o^yM{GXNu^;8oj;?hIfF$~hJ7_~r@GDJmM$xoY7Kzgo74XZ{}=r5(n_{mB!td_XSk^e5y>p2{He>xX8fB!EFEbGp@RQasu2vM4@Hkf#7L7*h z;`m8%F}20P<3EV=80oA;9z>&YN^m7VZK}XrGI+t25G?6SsU@Zo9_JDRL&>8?ZLRSo z^s%+ZnYFd9UFgdV+IPv#1eJ_Rep+)=nRf1Em|CxdU=f$D#Az9|#lhoTxw43x= zAc7|4nO0U<5_LEPoObY7|pzDyU)Pn%$n{s+NVfIS@9U4qY6mO*JHJltXN z{v%R|*S^Pph;}`m2L;`R=U0O6!}Ci)kKp-(pf~XRL(l;{e;0HJ&!d9){7KMBJO?=_ zIULWHb%;g*@#VQ8S~Q-01o7?r{RQz_@is!otFpTZx(cX^Aif&6lOVo~xxJu!fqDq~ z5{Q>~hG=}z?La|)0r9Tq5Y35aZ$XXlj1)8g&nQ7Lc#ajsSJ{ph#Opst2)YQ*SV1fB z90{2r8n5adBj^F3L{z6C^WhG<^{c_fstQywCryf5TV35{{$c#xpU zKx+kM0o^ZXHqbqSih&*zbUjdak@67GM)7+R=xITG#rBheUIB6m-48&m1f2nDE2w@5 zj)e#c13FJoTcGBG1_Ol(8V}S+P%2PUL6d;$3c3mCPl@djpuYt@4Rl7(i$HaRZX3`{ zLEius2|5WhR}kMP!)`xB3kC8DY6dh<(D^{`h`bAdE)~D2KnnzA1F6f`^MT$Jx+H_qP2^s|SvY-(_9|)QXMEecVihwQ27=lEO%v1^XsV!| zK$8Rw1mcUFL$m^*WfJdFp!(vs3aFu=>w%gGx(#Th&}{;`Q4n9Lvs%!{KsAC609`GJ zuh+R*P^(ZJTakGC0PzA{-2Df{cdMXw1BD2R20AIB7X$H-Qi#Tvt^Fp5uh}^+s1oQ$ zLGJ<`5cDn3H-dfw`cBYspu>Vr1M%h7AzGIP*t!-J3G}|8^MO7R6bJOFAP>;nf))Z* z3aSBGENBhTZb5u?*BgS?0#ymx0(6a__kmUk`W$G5AYAIAT_>npLma;rGy;h2Q;0SW zXpNu*pc@2D0J>YyJfKGf@dZy03%VBQK|wbI-6!a7peF?F0eVr;exTdcTWya z?$NVX?>@>ACWvVdDLh!k4Zj1d2I3p$>Z=d_vqx9IOfK8bh?cKo1Gxc<>QHqk$e56a(~>AdV8A5tI(}te}g4c$IdDjHosV zngc&BX@_W~K-&ayq_jiOl|Zivx*BMYpc{ZVMh($!2YOe~{XqK!Jqq-ppl5(S5%dz! z=Yn1Z+AnAi5XZM6+Fqb<1$_#1NYK|nM+E%<^s}JffPNKp3h0=iI(VKC#1YFWK`rn+ zEvN&Y{B?AQ%nO`?`ogcCpdmmF1dRsbr6wU-3{aS$B%l_8Xoal>T?Eul&`h9?g605q z7E}tLuuEpuU1`02(0ZPM}yxB1^fipa+4H1g!(=Cx~U6ENDGYe?c38 zJc3xF0|adbN)fabXrLgLW455(K!XHv=`2zZOD{su`#{44eGD{M5X&r8&;g(XK?i}b zUIw+Yq}+mj1WFTh6ev*;%jZHtCxOxh{SDMf5KE=Apb((*1cd?(5yY|>DySJyZ$Yhq z`UqkP%n;NG2y3tq<^sa1FA()UT2ODGF@kud!})?DfG!Xe2^1}8B+xiP=L5wEiUNuf z6bFM3X)P%lA`1H}ni4-_wGBhYw3F978T+6Al zYuK`5fV>vInR``1cst%Hj?3ad<;~#{)rW`fbyvTUSbg#kh_veCC%z1GAFuv->9^dV zD<56`w)nfNKLV9|`PPc&an)~m)Lxo|90~JO@3wj@JzdGwmtxA`*tOgXP9bc)9Hcspf5QcmJr9BA#j1wf5crz$ zn=vT4l=+V#)JJLOfvrKVqeWe<#muH9O=dJsYs6L-juqK(c>pT63Nb&6#V%yBKi%S=oB#FYzEqPZ?F|Mi1FDipTyqGgT7b5Yx zQ0%1Rb&gCzsdtVf%VdsIFU7=LC|$*~Tr&~HTu{xc$S?Jlxw2ieDhdjeugMaPmuccU z%zPw?iA=Vpn_CTx;I<0homD-E_#|u)KjKQNy(l|MFc@vOK3^O z%!2$JmwM6Zzsa-`+Ua7m3vwz7l)5Ylz*{v-z2$aNDl0l8b>Lu^6sT@C&~0IMIqfN@ zxU>{SSg=UXR?9f9@^UJNIz;JJ6jY$>VKI2Y znYT0>Z|gG1<73m#QXsTYzPgkqp(!$EWoE^!S>93>dwFrOOI|WcN|l!KVhbgW4zKh2 zmnzfWMHBN`3=?ZI;r*oZeYH$~1u87aOi5Y(>>^uLlnSB~q)3%As+eijdT@f$gRbOK zsHV738AN|qSw&8s3l{6ei*XB~tpXQbON*pRz18^>joMh6Kc6)i+0c!Judp@KsB6nt zi?bOCYO$I2S;Z*t1yIt=MJOq>E3^__!h{kQ788kEYfDOtXQK+2^>^W=vjwi~*=QDA z3-ZhJq>#(d&RA;-iiDBo7gcz*l(?YVFd+?8J#E$?RA+C;Bp7KglImHCGWFGItEHyJ zvn@z1b`j)(24+RWEXE7i_)$@mt0@{j%gReBPOm;Jo`of<*g_pGP^}|$ucERjoRJOcABSCtxlZ@|FTY$GcqgaZ1m802n zc?(O*7wMD<`SZOjJ7p#|`rKkP$kK(-0;DSFZGlUFu`#0drOnsR7#&c5mv`XofiAot zI1h>$WJxXFF+4LLRl{UIXNjgIqbSZ=XCyRpQ3=|TeAM{zoIFI1E(q-xvP#p?V^{W= zUF3?7jf1{f7lb#s_}Q)v3fQQLklN)lAKj{Ck!d$7BsGk8MbnU^eOK`(!`D}aw1Ems zS@$k3Dp=&AeXxa$k9B3E7Wzz~kCKoUs03@5I1}>!zQ8GkEiD?9+PPuUje$T=$)+4L z<5tC3M5!Fc7Zl{f+H+jKhSy(7sfihxDjeNO04+@{I-8kNy}9{i94KK3h0>vi&ps?2 z%YSYvm2o1U#TDfoa|P(2kipoD!9$?eAPiBb9Ip@aY-2pV&RG>>sdr^~mv*7oj4UlC z-rDnvBx}26B`WMVUh1)Dn(PAoE7PfG$N;S5dpb=;QBp~!OcXQMx-J=GfdQoUsS zU&+V_2%j1`Pm96>UBSsbv_Q1QH=5WwPQh?tkGwXT3dV z3Ua)q<@vKXtoPa)#b8qr&!fJQHEIn?Gsi8yoCc=xmiA&xHLKW1r{*+z0}LK$+rSXSZ99R#bud`HTavmQ>@)QC-EyAwn^pve9w6EVe^ zQH*(?7@Hb5x^nTleJD{MfHNx?xMxcfs5sb1>9pujIjRti%Xkql>UYVD`iXO8%pewT! zy}b;NF+=l~>ikraIlDOPEM7%+&VE9X*-TTP2Nq(Cj zan#7UF`yUY#9T{C(P$K5cuPCM%ZsH7=VE-~ik~pvrw=2hoZ^atTv4~LA%eM~%43Pa zRkjEV2oRLxl7ss?Ge+I%sR9(UJ#9Wk{6S}QjFCxL^jq! zSdBnq>x4-!gF&TgWG~v2mP(r_FU~10C^N@%NK7`m4qs|r*|~_JJip9q7+NO6iWk@i z?Q8~1y#vbf(3IrL>_9hgTw0>?TZH8eUkM`q*l1TQZ^>Xy@Dcfx0$nTnHIxv|3>keH z7KD@yS&c)fxwrx;@%oH98YWhb8EQ6uQ&Ao~8`7t1R@n~h1}1>%;;ejRPe%Agi?7NQ zt$9XjqF!KB5Ys@DQyf@bFx6_Y+%nhfVi8o#J~F4En0=%wqO{WD9OROrdc}#g^j7Ga zbD`|HTpLrW(3>B{9PPrdQe1-v4t1q^7i3UOaZzS|&Rnd$81$GIAx_M_47>7KGnVCw z!GVz|O`elemp8iJ)I1b6q$-!7sU)C|!*G#*R z1s!WkeGW$bZSSr@t^zN9Zk1h7T%<1{8Sxqw$!H5D<%|YxQ(=D5pu+5hu9;kH$u7;e zwSlJMi@dW@)2)lcxQQE*N||Fh{8EsuV@0_oRL?yx41*COIGZJ|q?>~ewF1g}vQ+fxYJ8XUm^ZOgGzad$GAfm(1ok2Gkue6D86=lxsmhg&t`-ds$}TqAM`;JFjzQayA5YpG`xyd2vkz7M76AJUyMipC6HI~7ap`H^ks@b4bmFP9lHE=kE zOk>#`riUGsoO~Lz9yLaFxP1kdfIAhjB#@1+aWx14E{1(Atet1)%!L><3EAlB)c!zPa-uHA)RGIM9w}cb1<1qZ zkIIEU=+;LS7ztrJQ1+3?T#9WJ6c}cNxooj$bC`g7=QHTu6-5PTmn@~NPlQ|*CG3f$VdM5Ndg}o*@w;-g>b4mo zYe+se;(WU#r7Raj!OStqE?QWhfv&_^u0_aU9`ud{2z1XF)Ige;o;CGSosBJSlnV>P zHy>knYFvrPb^#LMp%-?5fn*@PO)GJwPV{&Qdfeaw4rdUB#m~-3W#Ma04b{B!ng&i2*y63U5OmQcwOC7V&d8CW}&sq zniQX&IDTqYdi;eG6Vv14T)lI>v$AntBs4j|Wu1c6lEmbz$p;BDkwLxb@)giIjLXMn zZI{uk%NmC*iLsuIoAkq-IS{%ydtfn3?6C zkdeu^A^19Vl}>HSu!vDe>)98Cxq5bv{WD!gx^GE*0(vOuqC$;9jX0=}*!0XnvFV;c zu^H+AdGT70rnVT^taNAotIyVmVQKjo+MaE9$0GZjOUhQUss*>~r7_>eGO9(Wth)vg zxw+?UC)O8cEfQt1}w^o!oAa!x+bD_EC>4D}UNpv@~a@|NK{H(;uxcX56$W~R1{ z!GEDIL$f3eh%A*1boDMnmpd)THF~tsxGse4;riNgu9#<0xFOA2#cWNI8rJBW9I&JQ zTtZ^Akzuv9pvEOA0?wu|jg>uIHl*`Q zXJK%IhH@r)Ok+tEx1^zJ8{;|7FLCMH?D9O#9w3vMd^t`PFkA)6!cTO1qJ3w;>T5(4 zKwd`bV5DRM#)MFygv-#58$!}a7IBMBKm3D33>7&%J*J5t7PT2fBj-vV_{D&Iov#d2 z4bph&JVZ7ofE0~x)Ysujm!q=CV%MvwPbn&q(TE!jg-)h6(s(ip%eTHb4K*o_I8FvF z)m~5bSr@ECPS$UGq=$>!9L=?0N;8p>2iOms&4@JOXe%Qmi0gythK$^r&ciqRB? zo#?QoAhnppgw%;VRT7Qix#-I8H%?hj#iA#Q=EiTr&!EL*x(1)ux8P!i84-9S>sXp#He6)1-B#B_yCIrSewD{ z2N}YW2|9DpNCAeuC~dV(^KVjQF(Eg9e!euh$OpGwjPVz~%CMD#Z7klNJ25iG&GD9~ ztEYYRXEhnzz8LTE1gd+M5Tnff>tAf_*-jKviPXHY$fhaMXmgl}meR6ir8lgx?r8iC ziGURuv8q-AH5wyM*jsO&g%ql^37)B-V=0=;CFV?3*Bz!JoaS)Ar-rZkS_((fxD?$c z>Kv&Xt+y~}Eu>V8ylAnR=~;2lf%U><{UEEY_Stl5doBo;FV4*+k!do#87R3Mi6nv=^9HDnl~1fzv$E znd2vP@ zWtw8<(;O%U7*|^8lrhknAyXYdFDuDrD*;O}*CHTYXA%_-I(s2e6y~Blr!LK)EJHBw zT55bIR59Ln;vG#R*9gjRCLIfmDwK)@x3Sv|S>^DVjsDEHJ2nXQ4nt|(iWOT77i3ZK z^vSalX(x&G?TbT&SZ_5}4{Xt!MBJI-X-34(MOrK)$V^;Mn4VhN1_OAug(tYV*y!8; z4wQ%tY-HDFFqZWgRUn>NQym-^avKDPjBwPH8^5)6IvZiIsKhijWjr7({7V9 z=GS4a>-JxA==GF88o!fv;I2loR~N6k?&;R;dK@WDpLt2kpOc7V z`nw)neX{$?>YMi`U;R$PTjBH8bo_9^qt~}A+}bjw#|4Emi=O>3>GG9#JTh)^`?r2O zS~YgV{Hq4G+M?}@p3r@`%kAv_dHx?a7TneR^8Hc z(3N4mp1C(;#0zD2T=3e|k>3`iZGNg*Waa8pTbH{R3~!pZdi18ql0FY*)f<}sSkIRy z=Y$=*ukYyZx;^GN{nOUZE?B+ox62>-!7<~5hmXBIWbs$W_6-?bIP8+6%eOsp`K+4%cSuT6gS;Y&NeH|h9;F(a>7+vVqLo_oDb z(vHufKASmZP5RQWw(Rt_TSg0|JAqO`|Gg9s~$T(vQ?vqsTq+A z-`w+f(yu9({V{q<-u^u2-bV^X7nNT&ZTI3`PpnLPlS?Xo_6i=w9EQ_v_9Xxcfub(hK~+Eezc?Z`n0kRx0lZQVD6?L((gWef1Bhb z#jDykUX=HI)x^U+GCI7~@ss4KeTIKC{p#!A9Mq@Z(991fE}dKxl{&Z2sH^9_Sz6d5 zp=ZqOIrUPGZtOm}%c`8z;q&KwG-zIFgC=c;Evx)(&+L2NcQ$-?`t6$smkj)Vf69+r zPbUl;_U)rjmbTawwk+huho<~Ct-9lh*Z=Um^y<+wJ8!>s$7@~wOo*Jgv+sx3eS3Y@ z*qZ0Iee>khKd+cxXG%SHgWPW>#m(@fZaB{oUadu3_-v1>$Hc&R!!Pa~*}GTOxRuXD zB-TxBJ+?U}Qu)#D`SUg{JNEgXubvm5`euBGt`EPEmb7xm%;PU_xxMWVi!T|K^DfO&JW)OB`}YSej_kg&^5wN7 zMm~~q&+q*s4ww8D^~z^uRg-==cH_%0$1aY0FuYZC$Cn#8ijp4Q@J_$J_uSVdx6@CD z9^0OD)jwz6+xY#ot0%vCP2C%x8};tst3A_pbv^dzd*5`4{jIs|W{nUb|LX&TwaN^)Ko$k8mmg_Em%1>8~Y8sMy#pc}3=Ph4;)w;zw#}8f6 zJZAXEO+4*?xcHx87dGEId*4IRE9*ZQe&6s>Ki{%t#Un%Ctr{D%HuLXS(%oxzzSL{} zw|S5Doc`E}+b;cd@Z!7{v!^|MW7uz34!V5upN_r9?(Vx|{5y@$zkA|Cjqh^({^yR? zH$0Sj*9#L59=;@f>P>%j7;x(&&A*uQ_U1izeBU8rdcVY1bB3;O+Hhje4jl(PAK9bp z*T0Q@XZQL$diCh*In;a4eGSfZ-ZS@^AAXEr%z{W+t6!o^FMDqbf{62H~*?0-g(a6?rURR&ZLJ!J1%Ll!tp}?Yj5oE z&xh{ny<$Io@8qrf|)^Z(0=; zT($c0)yo@Ids^K6L4ythqkiq19@qb|slR%D9@y=#r8Oyo)(^~Fe#w!A75fgqUGmMr zU$1R6@A1BiSG_#Ox%Tx-2IzWo1`|#+o)?aVj`d+7NFW68uaqH8~y*uKc zz3!LK_g~cNrJEAEz4OiH8wNBh8UOnJDIH&5JMRI{y&I;F`{JhUf8TKMXy%Qpb2HcN z7(H}(+|H#hU$N%EbJt&XV9D0#2K)QF-#&Q%kJrEXVnUrogGP_LW8(4s%ck7=#@>G> zIQUu$aZ%h-ADEwe$Epy=8T@M6sYP+FH83J#wZl=V`^+yc7+9E#FucM?Xa-^&ms38U zKiJkB_;)(^#sIq;nCrzvFq}V%*XrQk>3G3TfNujibPF%!50^!{)4?CNQsTa}_R)&Z zO2ePeIvo*>)SJ(q+)~m+QCn&13QY`1ZwJ~KI&zmk4Syi)bnxf7P4WN0J-<}?)6^Fl z{t%a`?>zbmWS@wR>7c8pxpY5yn-P3Md_IOo>iT@#!o!>zT%thnrB7KACQe1=v*=M@ zXt3Okk+seyK3Jc_5`)zz+><&aQukoK>S^#9NuM{7V$p{9@U0DZA_G1jddM3M=p$Tw zk$}9v!RIrAK75aZ&xfxQkT(jLnB>uCKQVss&)0!)!iGb6cAa z)6Dl~`pRoK)7;DE!!!@F`7q6V>!put1k*gu=EF26*nF5~zUj&2Vwxx0e3<4en-9}G z+vdYG7u$T8<^?t%rg@3YhiP7E^%==DUuW}SdTz1$Fe-8N@vNr}Tqr9R;=|s}>1ZYx zdB5(mf%PP3^x!KU=!8ZaSYmSFRe<2)%PZIeFCOq-SCi{z_|OTBEv|;}bvjz{iT^%r z-ooo9sYSXc)dz2LK&Uk?bgh=S^4$m9n_RnfE}^l-C25mn@(tK`3i%tsl(O3ctTCCUOJc1 z2>%H9upH>>Xah^lvS8Vnqn-37pCiL4d~tm1C>?3+T+QL*baZAQ9G1r|TpgH*oXN#E+tQK7&Lwu@pe@tIH&{|_ za%JdTq_K0gh7ZPLWPxk+1g~i_Qdpw{(%8A$z{lx`B@0}u@Kz9DaP86oY3y8W;p21| zFJF1`P!D9n;1Ux@IBD!$?S!izo^+ir`tuKyD-xwZM;bd`BGzP@^U z$rmP0Lz4>w>#Lm?fK2Aq3Jn5=0{_I|pD^cen zjh%}*GRrIW)OJh#TBdW6#?IAUxMtuRhC;bA`jl>0lb@#&zhm&E)z^ z=OT@rs|S3X4r+<+hTXTHHo1m#un$KXJ6BKmI2}=V(w(gQb-&5Qw+hpd#?D3UIUP&` z-NGxHq5(8Yd7aKh8ao&5*6D~L3tXpxp-WA!uXQfc*tt-hz?DK4xaa0Hk2AT>W48%M z8ao&3qtj>et8!+%VRB8;xkzK@VjXchm|wb`k6>|7j|nJqxO)Nvn}T*q`S(%88;b~DRsbA#V3 zZPZ{6Sl~!w=VBjZ*2)JCeqiYx=IC6cv2#TVR|1}NyC#gl@Xp8=-?>aj8avl8_&6OX zT5+33)%)4x`cmg2jh$;ae9YG7^4U{Pm|PtiDp{nlb0I!&EGWRayCLB z9BJ%aW8mX-u-Blgd9mbClWVNbMH)L7b7X4cWUEH2O|CMXi!^qwvBG7vHk(~_FE+Uz z*SSbz=ej_+`rt|T=~M0RHo3mjxkzK@qE$E@o1#J@9A8mv2(@3 z$LXNW(4~z1WRc0$sEP6=jh&0JI2}v_UH?8$JZEybbuQA_x#HntwowCzgjnLL(z!@u z=c3Nd7GT)3<mBEvB_1UbCJf*MS7>hu)~HYD&H}=9@V)>W9Ld1uFiPU&G_{Ys)f-GgsBETiR4Vak^@cCHloI2}wm-L9=S!4QnNChA z->~O>lj}O2i!^qw3BpDDq>#Z|Gd4v2&%t$1G*HhSLQ^Ih-v$M?+ZT5Hce*L}}1W6WGJEE{9TF_xOL5F=$ZAuK+H z>BD!NVXWblg%~NTDPi%g@^an39E`P-vJfL>H6tuvIHN22^${!-_ zwIVEUIHP-1zoV!vpQkLuNLj5R#N7?Y8gz}bo)2fTvgYSP5hG=_fen+M$bz*s8E zLX4CJLx@P$&%s|rebg|@LX4Evj<5pYjPCWa1UU2cl}cHNk+RxDh`U>TIHRj!xigBf z-cS}|q^u4Q!bbBGt7nS(sOnI6=nx}ig+d4`jf#^VuV=ENC<`%CRv2O7ngU(c(7G=f zYYAnA!4)a1BZRPgXqt%#7J473Lr}kXLQ#N z^}EGb%_$2pQdVaOad-1W3c48I#*8(AvJfL>ML-BE!}<#vi~5b@l!X{6E0VBySuMUS zNM*7-3c*Eih>^0oKnNQh9v*x$hOrt^7Gk8Vu7p(q&gj~|+?<2422vJcq^u|iVS7Z8 z>Bk^By!LLUEW}7z-3Y51oY8&gHEAwmy`(I}NLk$>#N90n&ggFB7(Jb_s?tsfF;Z3! z2yu67iWG2)1Jm|1Rs>}sM#}05AuL~`ls857wSck^BW3j>EESy5wS9X91}nZau2B|Z zq^xKNad+c;fH$`qPGYP=MKC7rj+c}b1EKD2b;wnjtZ)8v#~7Mdafulpz( zQ<5nQF;Z3^!ory?I{(_q=b5Zyl!X{6t1pDOyJ?UDF3*6JG{$l-%7r3E%8G>$R`M4+ ztrGR3jVKE-QdS&c@%>@?^#evGYXD^-M#}0(SiH_htsYjBu{Ki{Vx+A8goXD=&^4d^ zt};&i(^b+%K{E5 zYbb;;?ag1s2%S2gLIY(XM#>sSSQX)nF2}vTtr;txvJfL>4Tli6V>YV7@K%hqo3aoi zWsM-L=5R*$Alua~jP-%CM!*#*Yb1oY3%lRm({5E|tePd@A~?iIS)(9?t-nU+`FkB> zb)ziANLlfO)ez3;p4z5E!SH3clClsZWsQaqHlLr?_B@QLJnIoD$vg#oPT+SU6AYxutTgpO=l$8h}?rtzOA?|MI>aC15ld=#aWsQXp z*1m#n=Re6<7by!dQdSaSm4Y+6TC=-cVXQw&a-oQkvS2U}0`^}oqST$)OAx6rYNLaPujPB?2SLYb38)YFz%7Q@-WbtFA`@~!;7;6b-Ax6rY zOjt@dqg&Y7D(W|GQ5IsPtSJz}_ELPat%kvt*TbTvF(%j(heOJm3L$K-GE(^p3WjGj zr7XlqSO@|QH13bwZ4OPd>Izd^8k+S|IEFU<*p&;3o%mGBEqu58J*4}e;i{? zrYyurS&JdW-OYv+aMl60YcSSH%0i5kwFE-guKrGC{2Rt{FNZO~6LoM%SxX_r-K`K_ z1m}Bs(2 zl|twpSGm$S&tLNHC>S!K&(OmK%A4k>FLgs@p1vP8XqXJw6hZreq6NI?C z6~T+(@(f<}2V-d|3o%mGW(aY2^MNzEukObZ8LJ; zZ6z$er7V2i84}Bv#y^yW7%6KTVNoTJ-MM$`4rBS!280+XYdc}7;EXQoqsK7d^RhZn z7Gk8VR0v@s(Z2hmpu&09Ov*xxl(mDf>cbgb@2DakjCFys5F=&ngb>!xcOH~8FJt{d z2PniyS-S{J3ukmk?!8T5EInl*M#|a^A#5~ntGx`F;`23%vJfL>?IA3GIHQ~QXx2-{ z+D%!Ak+Swe2%8b5n%6vJtPhlh7%6KXVHJlny6wG&igdn4WiAvkQr3P5ad)E)Nw%m} z?G{W{C(1&Mlm$%}SbSTav}DR~#+pl6h>@}m5*Afc*}^H&tr_bIWg$k&N|UgZ8;U~J z@g<*^P7M$vWgQ|c6P(dmduc>EZ=fv1NLhy=gzcrI`n{^jWR0RM#7J332#YVnT@`b7 zVXU2$g%~O8C}9P|8C_B*eNo1GM_GuGvW`KByIUiqfHNQadjezm(F#F~lyw|J*jU+k zUju;fW!RIl5F=%sAS}L?A3WPB>U&qxV8lpSCkcyYKxVHv20C?K)&t5yjFfeXuxL}4 zmH9Exhp|dlgNxu0BW0b25Y_`++W1g3(`!Xph>^0+5LPWXqnqbgAR39LQWj#Qtg{fp z<~9o}Dn)(oY05&3ly#1<_;EQf?8`kwaL&_@`$deDbsj=kt1S88^99DLO<9PMvH&Ei z<;q*1ifXwJWg$k&f+7Q!63*ym6zmP%6`#V@l!X{6>k@>pdmQP}cYwmP?o$?Gq^!$? z#n zg%Gy06i~TfLB={oS%{Ict`QdB0|ffMgT};{MvfYA5gcNqESOS@$}l*#38)XxQc)IS zq^ui+1sxM{=YOPlG1gGZLX4Dk6GGU2Z`HGl8#C4p%0i5kb&Ien!5Q6?Wm{l4-G&f%H@@UAKhuEv^DI9)7$Qc>f({y3ayX-_d%L=svAR+gVx+9Q5W=2IIlOAy zcg9*mS%{Ic{wAzCa7K6Nl?^6nd&C%T z?>{nDW6DB|l=XnHXc5bv9obomv63kZF;dn;!lIXD@ikU;W~`$$7%@`TBf{eQ!(l6G zL$lyZgP%krM#_TBi%LU&L9>Ce>IJ|>aEOtzo}S3o%kwI$`nkb!Wx4X^d4l5H5m4jFj~ZLb#{* z@p|2^_g*qqXUam1l=YmjiXa8t&nKp6#+pP~h>@~hKnPp4%}Lk@odjPR2Pg|MQWhi# zSQX%mu4eVNTN&#cWg$k&dIcejrF>^;$5=sBWe_7}y(TPv4lvblW;|o{rYyurS#Kn= z@}(C&%vdRug%~O8twh#)c>z&Nc|uu;k+R+qR&h9^`+UEWh*g$$U5Jsg-b0AHn>$j# zHCi{V9!p_6%0i5k^#MZM-8_&2?s~e>o3Uak3o%?BCeskaLOkJJyZ5clWdk}6h$l5W zUJ<)lz~Da<2=5z`j{pe)U8A~m4JBV6hcD~nHQ@?;e@l8HG!(zy(gSdvqoPB(cN;^w z?`igxh0AR1kSOyrCJk(!hmn)5Slh$Z8 z$T?H2AweO*AwlqslaL_ZwrfZb{SZ<}P?Vf!Ds6JR#cDR`)OHCIKJWuD{FX>aknm}+ zz5-39mfOunyHcr<(zuV|gapM#hXnE8-w6qVH&F$q+A7!SH5!w~rj!UYaI)}anUEm* zy`8?81jba$wHBkwq*h5Y$xOnA1Vu-N1QDaKAwhj27*iqF+tfCjQYV!u`qC48=?2P& ze99*zNFZv|a*Nfd)mpTANn%O4(vQbL8c90Ix26TA(k!>@ObU(Grjmo1SFSpKSE#^I z8te+2Rlzv)lRRA3;FB{UK_oh^P6Tl(lU%J*>2-Fsj!`)ivaXr2Vya22Rv2|Qh=WgQ zMyZ?yrjQ`WCZihUW}D7pP}af=JL{b4zLMHh+Eq5C zN}OO)Bk<|PkXkiEf;c6@YJqRGJ|RKmn{ON)zxPJSjBA%`Y&wNq18O1Uwkc=D78(oIDz#$^&88Q` z*o9H`a;x2{(<-zYIapr(l_GJ?E|O7Aa-~kIR#`QAMkNKseF~4$T=;kx^bz=xb>ItJ zokDI>Yt0so#hEL7mkhGVSrO#o5vVGq9NV|muCY3a6~5ucF-YZLvk|CDyIg11S&U|@ zh{}CiQRq)ZEmh!Y6mqTBpjKMcAe%2F@})WQ4J)o%xbLbF4HoI4Ms9@iQLD8o#-!g` zf}W52ayeJSoE|foD!EQ&Fe>#59b-yLm-S-MrHR`O6pT$_wd;%qEu-3adj(K9&=-Nd z17Z+2#2>oDj)GK`S#Gf?b!t7-sYU&pUY;}nM%Bp;I)zrNFc<}@>mG?J5-TOB7n9L$ zv}iS2ftqPo4^4;3)XNPfo6V$9Ga_UZZRc`@+K2n%7;89;s*&rBdZk{k*2v*Izg$+W zpsVB$XZV7PgR`j%>L}*g4H~-vJ`K*egvWiNRHT0$p^)(Nu#BsaTU0i?R%H}%|6OK5 zBg|%{)oQUasqhuKXT!iIp@Ot;wcW zX%wIiG__>BsOf5~0L!r~pH`?BtJ$E2KA&f1R0aC|Z^p98b#}YLsx^ZKQF%g7Mye4$ z#mu!B=#1i+#%ok^v%vr(n+f!Q5>2RV!WYCj?G-*gE{IeaVU}aIDh!|xl=w@{W8;fP zCpQ{3cAHTT8bqnTQax5U8UyH$3Df}QJUo+hyU;(o$R#G7r59#c7NyY&^A0Ijl+(-# zNh8<7q(h@IGTq~i3PZa>bMDeo5`?M^FgV$4I=vmF)2#lwt%&qbqm*kkM!QOBVyf`V zL52;cDvjJ`(OC6%g%g$g;2=zt$#<-|RCBWcACZkQGQ^A0W<}zyr{AS`IFk#AU z)|)jdof4Y2h^gi03S`t5tSp823rv{SYfW06#-uYym|$o)BuF~7Xg6)9oE|HD(I6qX3%eP8Z9uPJAw&^TFq%97zyT>%ovt5*#b{(l&h60 zyA9`Mm{!Vb!dqbw_3|)Oh$gQZqugdzz(n6FA!eG#{!FAruClB27OfU_5DWoxNhO-Z zed?1_1Ny;A><nOGuTabvrdgYu#jdAeyg1yycWMTFXHvT6<30SYP1d;ugdl@?eE+iYgF9Xo7+*+OJQ zHzbIgCJ7w130kyWVKk5tN#KxLz&M2JhXotyJ<+XRy&Mn zf=n`uM$&Bs+!Vp77}bD&qUzVd9L{L7*bF+xCB?)qp2^4t9~kBgeu-Kql#*2e+G@5N zoT-vIpuiOhNu`ymHAof+7NojH-JC82Vy+CnA zgbQ+EJhUrxCRm54oT&T?jao@YB9@)N#ATiy_EZc|IbiLF>%(ArEis)8JtkjF0#OB< zP6n-62?ryRtp0vA3%vkr02wtl4Ws@$Ed;5sHKH)8U;-#4SK453zbck2|Iy4HORrI` z)EiA^t67{;7!3ISIf%rEb^>u$4&Zr4zK*7*T>P&}=kjyI!efTwJVy9cGd~Tv2eAm?6Uu z9@|w&F>E#94AQ8EK1nDhpM;8!rmM%MmpGe@hIYpiP6LxOD;fvFR@xw#;BNN&H$L86sQlJ z#Zn=?uvY*RNS#gr(;Pu6DJlHYH_;>VMR>>n=@L7#LWb(mnha)}0eTmKY8Na(LKElP z4K+9<2!(!0ueO^t2D7NSLg|8mu#ljdA+-WSf}D&h3sjh+Xmxsn#ReUtAk>N*h`dE* zPIYn10u%}?C<|1j4K_%$CZpO4`>z5Q<~A_h*Py9oeoqoUdJpvqhMS3g3Vi6qEh>x2 zfb%4Q?m{$OID%|}isQ0MtA)k5sH-5Rd~q5HwseF|P%vi7Sdd-|%s*8y=@kV2o24{v z9oaw)Eg~LolmRp;oSFXx^@nHUH87=9 zT8u{6Bxb4Q?V5rPaFb8aMFZ?`K(9i23xSQDz8Tg9Dp6K(MCEJ&L)Xpq`DhK8%+^RG zjEyT9yIpV6i<-E2{UeMW9ibUDjbLgEn|eyU9d0@(MEwey@nhXSTHeI`5*?0Y%PyGQ znXM+f3bcu37}A_^IZHRSp|=uJtg*;VCY@CQmU|c(`!nvI0ro4RDFN1&K!rwX)+p^( z7$X@~B^p$b2-*NGyd$|EATVK}2s_0VtywS1EH`HGQx()J_)0(YY;mG)&;(l@N?0qx z=Cq)QgvSq!g4JLmQ>2MdzE-0~VOQ!!LroJpU*I=SiP>PXH66ve2G9tL!33KQO3^Sw zggTECR27A6!dR*{Xw@16+zt|w3l&3*|Kgm3BvMcb7@Kq*r7Pn9T|WB8=oP$e8SUm{tnO{Z}GkMQl)6>{_^Q%9uD3 z3xN798+>F- zk1J%78JO*{<*?QYTYP4NS+9XDP$91h&KfW`s*#C4lrg9-nQyTaYvd-4MsL(WX3-=b zH|zez>Yr5&bSg@f!3KSkMMM?tbASO1NHVAaH8{zH!mQg2H#1V)yYcpvLHnSx|Aq(a$rRf%^cqa&M)S0cYY0OgWRIOxi z#d$l~b7oux?&QN004fo+DQ`j&l($EhXfT=8wI?@Lfn`d8s)5ZqlTK$cLto0oy5fR5 zc9skoaPwAWhPAmu+yLmr6Rb-@1&LS5f<(AgXV==bN_gBsBvDHhmTX}{4@!+%LfY9H z4i-^5jot(|p~UK+*_IA;V^*cosMCt8BJ&*`)>2@eqgU&U78~6EVMX$*TNEsBdfbVG z**$D_FsjH@rt@$tF!7cK+?a!nJ)?+;qXf4Yq4O2qvY})rQVCnN1~rVMP!nJYlk16u z9*}I2a3<6QY1jk7Jw&*DqjABY&k1l(o;Wc+2{b{f;n@YAwgWZL%O3PBcVeEMPRc;B~1Pm_#BN{%v6(Sgj_v! z1Jw=p9jqp!$taTaZ`L(<6BW87l|o#mN_vAt{D=gX)BY@tP>)8H4enCI7|U7l6e@%~ zJ;hH;g-C>Af$d_A$*3{e?OF*_Py)fsCO59LmJ4;Ev*>hqhepoXpyXtdIS4o57aC9y z+6HAZ;UOP|Ql$o?loF;`P1*BaP?Z7`R@Q2(%4&z(ED|P+tbL#h#Ogq$iQ)_%!z_aB z@W9Xra~>^-h3C|W5mPR?WKibI2P4Q>Mvy@RG%BMKCfymRv=s{WLLmjLUSQWjt$>Yj zyG5E)BGidV<`FEX3b{=M4=up3`ahHj;}YC`g*{-MRl>|n0|k+=&tbOeY${kv!Bl`V z8OoKBxMHOJhgNQY$C$8TIZ*`tk#-`2Fz5yJ2AjsNhui32H8i6fi2}e-$dmx~C)75b z(XO+>4JDo`dW?=tTO-JRtkcX2cDR*Fxa9@wJ>CW>Cs;@=trMpw+h9=v6J`S_J1CK0 zmQPG>eWiv z^@75sR#3Sllfhj4d>S2I85MNFZn2mR_yi$8q>?5gQ66DF2F;ssL22Ozf}K2?#@Q_8 zr1EAg2NCB{xUA}++yj45Bb&?Vp#D?yzY6&{^}?%isH z*<%JOHB*XvGk7FfU_N9QB;< zIV0m@e#SU5yV1YYcjwCrwZ6ibWSkVeTJS$V5*g{6t%!i z6lREEJC(~MDPXQqi*})D-@x3W`cjYuzodJ3hFzm?{l2&x97Df|LEZ7g>jF<{Mn15@n2D1ep2@{Bhd6(yBRu(2aBy6)tQo!-M)7i`K}fD$yM|&I&BV!uJhq zJqgcPYmD&dyiVtuire-vuzVoG(K;;4s}dgIfG0ojnNcCHsJG-n29cRqNNk^ISavfe zJbk2rTPZLuF(x$^iyauZaYH5v#9*vIgw9q2nxHqq6WW4E@ir@2qY$gH&>KRNWy$~p zuo9;6b{jl1B2dLu3f5$~S*pPfzi3dFiG}GcJREC>=M5N_UjVS)gl#Ez6_t`vZdRJi z8nacTO1ws(l`^jP=BLK62``chcgdh{QNcSAOfEGsOKSv-%)&UxnW~kHEwG1fw-{i$ zC{je)BT-pG_FyGtQzD3hBZy5}fdI=Itz8WdFTyUnKyclnp!3A% z#~BsW3?{)ag@O@02sC9NZ<j3jVq!Bj5%7zJj4+N6TkVO7iVDr@F}7U%^n zW@rV#g_O(TJt;#^c$rAqv2TQ|MnIi_x<1U+tW!5QxVFE4oj?|bzMB62wQJXg-+&;0 z?n+qB&SSF4k``>}_8r~|D@fn=5}WbEpc-&^xY3LJ4}1kfY|0OV_rnqBgp*E2@yoO^F9I-OD zeDEVv)oa%r_L2Lx!|t!0C9ZE&csq-xiB8iF)|xG??abCzP1UB*X0|3xV4B&kM^vYF zsO_)~08ei8Xcrz6)2>roRFBT>ES(}c!~KQooum4+YXXnVLH)L)(}BGm! z+J1w4_zB!|vI4SdvN=g;xrh6;M1}W>?i(E$>r<&oWgmR;tY_39G-<5@dyeq(N*_q8 zKB=9rr#`8NZ(e;;tZz|$(hy%CMGJlWGatiIQhNr+XM^La-tmtmVSj9W#onLbA|oTc zN{_~@$_({yJKidGU_t5~mla;R4}r(kjwARwtt?^xfQpVIdbjNQs#oLw3f!-EwDa}X zJ9_xm)jMK+<$A{uU%fv5kdLB6TIwN)HvM)hU_l+oJY;TQB%ye04q5Tep0eW2vdfCs z$|frwQ1~ufBr1cy=yJi~4tU<@3BEiejJG!ZbMDor?#GUV>N-2^2 z{+isc{>BQLh#deX?tjzD<$fxY{fL_ds;s*kHVmu*y(~6A=R-8+6dkhH~`jSUWX=m!zV5%A8;Kbj@;l_tP~9 zddJ#9Tz5y#zwI4s2l@vPB=(Lv(mQ_fmC4@I{J82JtD#Pcor~UaH(YP)gmcw9qB<9W zF0C|nYv6?5QDhVq!~Ni>444+b!C{Xa2AHXTAd6Ec(%U-4hxywDm<`yLz+t0wg{uwW z1-%f#oGTo>vn(?LZZySWf8h#u9MU%vFda!p$~9$II8?XifO$i4nUzZqzSaD{6M;iCa_h2n&Khzth;M27nEo?`Gny39t&?|{oug2P~Z1m_~YiWI{kGmozZ z;OhS-K6ndV)*3Kz6o=)PS^9PfXfPr zEQARKCzOke_yPeF;*4{O57XBkFuf`6SNR7KBzZGy!@nQOU11{lT#J2=6>z#2<@nLzF@#;oN-R^VSR*C40wslEWgo! z8|)mP$m}bUF+H)xYU1v%L4K3&wzu~w$m!Q zE&vZY;r@eF^jZ)b{lB=1{y(sQmg$qp3Mvh&{tg@-+?u*2uA%jg6R>_J-(!SD^b@!W z7fbUiVOaWxrorS-rXw_Yb43e9OZ~`a=Md%~vFZa4>61qLZh#Pn!dnyg)9iSyaJ)>| zAD1(AKP;J_-a>5BT;EUdt8m=WCvEY?PC%cu+xHj*nUj|K?uXxm{azD>AY?aOl)>s< z4VdsWbFvwh`>7)!%#164eR4Bcp(p1aVQ{F=_-KMVpOG7qYn?GT%x5YoywuNro^yNx z+4am0;8_xm$CfrHt9|{wwp}zh&XDYp>s9p*HALp7_5YcssNcbR$h3s#aas4JL4tRp zEIo+z=io>64lbp72Ti$y%Z%BDfY2hPJe zagJkHNd9Kn$Z%Zd(tH()pr1auhp+!$IpE@l7nP~U#`^lm;Z!CrP)t6j!OA|%c#S0g z{EzC2VudJDp&dc7G=owTqw{iNS=de#C@Q`*J=8>usBA{Sbw!8J4(;2fVc)?OPHphP zq7{nC0OzX2*H;J|3BHOXY$BX15#M?^S0=tR!FLIKT*2N4A6Kw?#{skBf*rb8)BF3^l_&(a8y+kBK?UQMQzh?{!sxA50W}AHBh-N70pQ7iGMagTDf7G zzy}t`E3@MZ)UCqt%n<)c-Y+NFZF<@VN**`8VjPEm9&U)O#%rPq!$dXUl~5Z(%;7d~ z#ZK_ZERI8<_QOu=ll#L?)?ZvZa^zGv4(aO~J@v^=pqZ!+#t(Yprgoe&CVRLUyfpjG zj{S!Cr*3h7X%a5PPSHaW`i%E#xu36YuYAy0@Z^stIiBo-!gwWY1+jdR_}^ctm{&r) zh~YqGjZ>t`F)V|AwG&4~6dig40V*USt`=l4Sm!+~zgKBF^b{5J$^9z*++SbkJ>-oA z8V1H|prxj8+)U593%BzGUG?EA7xw&O97JKm1ci-1Gyq$&qFty&VVgl}m2h~FFLPEQ zzQ=Ips{SST%9F6qaOM;{JJb%R#Kpi@iChf;AE(4h@Nu{{;Nu#=IPhr+ZVC7}RoV_d zPO+cD6*8ORk^#H^q&vTMR6*2JAAi6n@PZ;$&{DnQBq%D9xXgyDyyHI=9O{RiDIFp7 zN7W}WVW4#ClRo&bt`Gc!Upa`C{Zx5#I*v;iZbYaCJ}#qj@ZmoXnb~pEkkq!QA!)Er zb3^i))Njx1hEsw*o-z#523{c=_1otzE`&kG-&{}irlgW+|$z0%1?1Aio7huRRi^~8z zN(j@_B2fF9u?(t+%OGjUsaBBxQ+CMzsjfbdUigh6`3JbDX9K5biG!kgHz2167lWNibJmS@252=|J zN7P;|60mk6y`o=%KN+j&t=I4blm@?h_T#S_0?tuS@?G%g<9~SenWA?bmDk;!6``@Y z^gs8L&geNbSj;L8!I-*uD6pSuuS(;6LEmKH8SR@FJYJP{`}&aIEx!Kn8(W^`nRM5v z4j9DsURZ$GacdGjm?7d;ltFYf;Re+wy_fnJr!6A=O1L5Snts#)Q-kDJm~uMuo0I4I zqMjQZZK1arT*=_L-#!f+3pdCO0v|@@AsY^7Iq}VaGuM=sfsboSJHf{_rTgGh!r>vy z4cS)_UnB7O5}y@(T#tepSBZp;1RvL<%oltc!N>I;_rX__;HE&bxxQ){__(VF!1sb& zJpsOS;=2ewIq_Ww-)rK-uNrewa^sC~%zLn2D=NwW@x zKx2M|xd%xUDx@o2iTUDCW-Ky@$m}>ua>P+FL|^}CY<7~F^elllAQl=c&*RDw$GP!b z74Y*`nAfhvvKn~^>k4LQY55@&obLL8?;#u>Jb6WQo_&8;`3qJ1ZbKz=EL1RmUk7HB<-#tKh$o#>_rNt;*Z2>+m zRo%hYkl@A$S0{jvld%$fobD1O#nn)ZSU;h*^^PyQCj1mZ37!VzUzxR3=PBFG?yC`$Lq5DhB$>_d|N9$(fjl z_(L(FX*eu$m59?6uK8niaD}M{A6J;Iz{eG4AK@xiB3GDG!N(QmI^pUz@NtEC8hm_V zn(=mRGvB;0ul6kp^J-t8rqBVzKZEJ$XMJ+4Z>t?p^4zGSr%gx`cpT@ssLYT>y~C5s zW&9!k&<<_Wus^ETUxwx6>k(=be9z?<{`^jtAH%$g={g14ub?KwAG;e!Rm}aAm;xFqb1q7%77X(+H4f z;8hNnTkv5Sa12Dv71figxDx@x%7Bj-%Yeye61aFVPP`S!J6G{0!$l~As_=|MY%)CO zFkV*NZLBOeErVB}_|h_{%0~vj7Q)3ea6Zf>b|sKbk1R5e2M+La>mB^Xs~j%3;KMTD z7#ME=9K3TC_bj*wahLRzm7FP;6&kCM{V_l(%i2{%)>J$j)621o3O;Y}aco5G5tWH6 zIST*-a)>UEBdOvUndO0FASxW^E!4S+dl_8g>QS5$X&G`nEF~^pjC1^N;$0)eD=x{* z;^oQ$_0SC<$k-qPlst8&;57u{uUB|Ky$niPpC99GC5(M@>@ z{957QS{UcUvfo3(ij~YJ%kw7t-K;SlVSIlb16NR+)C2)1;UNk1E8yVb;(Qoa8VM^_ zI;-ptx8kyFuRQK%u|p8J4RA=~!l9FQO7L)TaXyUeI0-9L&Qn(IP*GWl*kZB*oqc4U zwMr8b&qmGUIH;MN4>glxBdV}SGhN9!3m8s&z(WRf{KeW}Y2kdRJzTsPr}$AgSMgp3 zG}J~;90juB_!$EM?M^2oJ$U3B?rmg+2wYIfC3k=Eq zW7vvTCqq8jLyngCdZNJlQU{{#bKTp`Sg!AK?@9XAis#?<98yN{v~=U|>#J`0Sa3$S zhjn%?ZE$k?F21Vy`{UBNUG*JGZ7Mu4J?>|EqS3Eqi@MQ4Gh2)@ zmWnvgv-O=)7k}2fU1Q0M97W#TY|`P!q1w-9O(M+F2K&tlz0hyPh@qPcoF4gR ziLBbIN;^x8nP4qFWPjTa?bLJps~;?IzRT;mUzV<@sdY=NKP~)Pcy`mP?x%d#hhEQr zw&wS;D+iYNI&Him>GQL_^}NdqS$=(R4TcjydbI`1F|-RJ_dYJv$4BE?D(!`lMxB zu7wSpzUs>HVr7?qvkgpaSHAs^GRIS<4SG9z``mj?vM*K?X?iSiX8*%uOa+d2GdcQ% zzB#e%Ot&E?vJJRUYHr@tw_`e0XnF7Om63In)-I2G6+bgNX-7nhFJ0zu%UOT<^t}ls z%vlRwRRt#&Y*0E-KCa!!F)`hWPMkMCSkuneeDTulKed}q4z6DMbJ;mVX4}fjI=nPC zEMGoPpP27szHLeHUcR(f{Dq_UVk^k&yDy08bMkUn-l~mv^lQ^%31}B_|C^7-?dF9F zzZoBmL)FK2deL4CdXp^R6JxM3at4|Z)5BJ;Cx;eevJwn7N<>$>(xOvFOg4gf59ge4 z)IG8HU`9-Kg272Mx=Gyz0u-f+WnpSLvwN7*qqB=Q$%x58FgR7jX>0z=r}kyUU@F|* zFy$y=-LgaFGh%WPOb{fUo1=4=@XN#{5Arc*ZMD;@&LI zh{2S)yW#W(<7v8Q*Q1OWFM_!PXH409H;?%lG1$?&yWzltY4#iN+QFNp;A#f~!QsP= z=t`0^p7@YD8A5Q&hjTmzvgj1jl@Ac&8I&Ppe1;H6K6QM|tM~vRo})A*mk@H3hIk4g zxYdI$yAXm~Q0Q_BA?0XD4k4s24f#U|!R0tQFCnBK4ap;f%%CB;g%I4bLgy}ooS`9H zsYZtPh=xbWsl%K`;#)F&0AWS;f!9N%A$=nvx=TZ1BYL1Na*o79K5ZoqfsdfUtHI(B z^xu}G2fnt}E0$vN3Tgg8G1(vlH3y#D;#344M&(0F(hv_JB!Gr6{ZUCmdPejNj~Pg! zgA=A1LLiai5O~NI7v{vFUT4F{ZuvO|nP!uay1Zs$>n0&JYjGr~FB%dML_@GOajZZZ zg6))q@ZAfU5=kHE%?B8FH|$~1Em?W(T`u8)-nKMf1S5H%H$Pz61HJFIsuLM&0A&%3 zO#Bpn0m9;Cbx%!$WdQa@=%!H?!ANA`l#9vQYWt%gV{N1?f|1B7L|8aAbAw~M?9{{@ zf-L^2eS(q5DlCx|pzU;lvHqd52u30cdoRw65^9k>yy8p7%El=c>EYZZvTy>)@-;DG zswZRlQWn8TWECSU(&K^ec1lop#!^xi!AN8km&oe%^2$`k3ZpE7k;p1RSXj1LhD+9d z{KHEq!(o&~FcMi<<}6=}uLKNZtmTwNFcMkVE3-0uoZPr3W1Xfff|1B7C6TpzbHYi+ z`aoF(BawwudUrRz46O|#jxtth9L~WJj6{|XgtC0yNn9|VvGkNhFcMj12#eRlkh=QM zd4w|TO<4pZkyTbAtNiWusf;z7vIs^Zs~ll*Z2_JXJm-0ku?|ue!ANBJN@UG>pWB16 zo>3OTNMym(K~#pvYvpuftirTW6O2Sw1&OSCcfN>Na>^nYiL8o*#h2mQp$$Id7Rs<2 zWf6=-Rwaon*)Z>=j5VIJ2u32SGGXy$xS;;%RgATkvIs^ZtBOR{hpMJ^jCGE(2u32S zDq;EH8IFgewq0hdx0FRN5?R#<3;T9twGR8U0Am%-20`EmMk31(LRtG-`myIY#tNn^ zf|1CoPFTFGT{UanW2|=$nv%-qZsQ6Wf6=-7LKc|-*`67RFbiBWrvI42u32S z7KE~XBWL}=evDO}vIs^Z3rBU1g|S-qoKWNy^3|BK2u30c2YM!}{JT{*7%Pmj2u30c zXBpf}J=o8e+vBdyCdleVSp*}Ig%cPit9o(AcE(DeEP|29!buL3rChtLYgR$l9LgdX ziL81OSuOOVW;50<$|4wvtonrIgJ(E~mGd9RSl20wU?j2{5EifV$sy&YGuBtiA{dFR zhJ?lI{LaOf%Q2QWo$?TjL{=k-tPjWLPh_lyltnNSSs?-oJhJkqTbK6`%CG}v5sXBZ zTwq~oB=+yyiLnM#7Qw((FsTb6G!SO6;-^IwaFv-8eAPb=+6$c;$<9y;Vx%mkgjHhe zUV?xVxO@7I7^^8|A%;VAr6CZ2@ra&<)scAW@)03`xIw_k z@Uq*Wh(6I#gCc|rJv)cuo1&rkYJDhvi&T0gDpvd-)?Je8ur!H_5d-?hcI*?|R~!auL!rS+u-1k~C;Jb8$4-qiakURrE zCmfyu%Vi-HKHd@6u}6lhWKkIk%g@fCXp}9(b;`~h0Jak&Lvh;_UZwt}J<5*ZePTnS zqC16>R65(IjHC-yJ}b1~`M+F-p{`>i`t*Wq@Zp`~diEU1mr`h`uBjg0dxY0>Rb3;( zyQ2}z2(UX76+19A90Nkbqocb=MPzs@l8=qljnm7J(rZrEGx>|8{xTtQ*D@nwjb%n8 z*Emy}%*du7QpC*cD#vBUHeGQuyP8RYo%JP?v}b^2mW>QR@-~9V+$f*s48Y7XmjTGd zm@%IjfSF`DLlej(&lz!6cvl z&&&`9=qzTfQfZa<@5DYTF|nn6~9vwBz#Z}hgt5kCDf{M9k2yz zfG_{42(&(WROiFruVD14kGr9wfQp5#ICm1ou0wt6R4Y#iQ1R5v}_>T_)>`Qoy;=I_K{# z$XsaMZs4l$CWFWkt#f)0Q4cEo6L7k@955X;P%g8}#rH4qN*Jtc;?~2vs~b5S-ivhg zoq}NC2XB(e`fTQKxFB+c!`-wofZ6aHTy-diLx6d+?bq?ug3H;q!-KGJpvz3|2DoMg z%nypgy(U-b+XEN;Q{jEoJs4Z&@nJsPU@=@37sTK)lRE)+9zpdP%=^n6ZV``jdSA96gooVZ zF#I{Q_hp*`E|g+Xoe9n40^Ic9#ODq1Z3fI)XB-)f`4n@HRz3&JXJ?#K z`fx|6$Srsg01k9QK3v470Ze0OoKt+5-)M><5yC06@*51e#NWi{4g6(*IpBj$8EUF4hOnl<+naybj~=Z_^|vU02AkobCJHOfLY*-bBYhkZx6*_`p{)o ze#ZfK`8V-Z0{&aTl(<8p`elBD0i$uoIi(NFFB~xaopCPmI~_2KoN-R^VfpO?%voog zi};=c=Cd=-DL&kED{>c3B9~eDmA(u88XV{ZJ#dQ82d)|J%4AV+pc8N|(wBG_9yNsn zoq%(S5A}KDUFav_Kquf_#Fu_oCi@5nIsxYtAI_=@{S8l*z=2M{xromMn3m2sr}(fw z;sBH2jB^p+62Po?#yQ1@`8^Gor_MMR@nydUpLT--osbWw_%OdU0b_8+xrna|VEQ`a zoZ>@$o(z~}&NvtGr2*!wGtMbKEWhV~`R(C@;5F0=e%`ZR!PO>u7UKQny} z2TU}@x$`)u^kIC-fLY{>bCJG%fH~=mbBYi1`xG#ropCPWD*}_w`>FJPj76CcShU=}&!T%>OwU`{&YT;&%qpPg|o;w$nH@(TyLU*;Duttsx8`2|e$ zZ{j2Q1&u>45wAoA^k7{}}pvIMDq{U+MrxMRA$wANJ23 z0W;JY=c0b+0A__V&PiV|zlQ;H%^Bw+zK?)$e}cKlynSH*g5OT4>5Ov`pA9f=opDa- z!}taQCdnD+BEA)X+3bvST3=#(=P3rf#L4r*`qF9l13Q4fopArbcVsqzpg#Y*yC47Y z&d1ehAr+37ytXdKj7mPI54@F6KfX0=PN|!*ZFjUCx^UC@SApl1kAeex?rOjP+l7Md z8#NeUY$Pu{wb0owz6UB+d}z9Qi5BnlLz7z8bj#Y|RHH@df?MoqdQ080@2)!hfQWp}O36Siox z{nD5b8!K$KbEMk*)0MZqOwOxId0M{W zt^v9l*!ICG<{W5KByD`nR>{*W4cCNS`uV+-mulU-P7~g|^(nD>yJBA3rSB%yzu)`g zfIfR7a^!N`p0i({x*eL;>ruJ+zV>gjG_PBw*{HjUkF96US>fnZzhtl2wLWi49o;yg zPFBa>vL_N(W7mPsf6&T{_ah%h)-WHc)^DUe;6-oG)FwmL-_*4Bz4f)mx$E0cw|JT| z`O%Jtoqdihc<}O0&uSCL&-hR_E#=+V)hn+o>&mZcPSmN=qp+=W>o#YWOxiMg_s5EL zn}?UI*Q;oqEvsjh)g)EhK4kpzhASF9iOHtCx%~c-{GoaNnKY!NYS6rq!%Cjn7?yK? z>Z`2Xjq~PpIdrH3hRQcwVDf?#5Zy#N)!k@<5MQS%6->|)|=8$x4!VB%N0v?L_ z4IHZKvF|_Z96KRkAGYC9>lL;8`35YQcS||) z>(c54x+YGW{BzdA939)oFY33xPP_i4R(gy%v}&MoDvhXedYR;zs@R!hPZhlCxoi3T zLo?rWE1Gs|{?WRV7rMXk=rm~klkZ;(#KfMPnmE&VSC;>OT7OxooNeO|*7_P>sp3-i zp&jPu*-&+j_144ZA9)X(Go^ab-hP9xY+j?CcYF1K2^%d} zqN@LWO@I3<)wdbdqvkI5a}OE#3xdr3$M;D^Y+Kd*V6}hgl%87 zc=VG}kyV;C-sAY6*58D}wO@Ahdr@B#I(A`!{2$A$IPh3Lv^);&%)8`|CMosuox5B6 zQTBTN!$!PXZ76HH_4DW&@1)bd@=;a3ZSJZ0(-8jPMw5_3TZ;93vu^3Oq!QQNyv}$J z`CvDj(9!&JwS$XawB9>?ce(6*g6XfDuw~B$Wc*JP z_OJ0$0U6`tZxQhF{)-ovK*sVCU&Se!bNM;{|1Vx#0vXFoeD%NO`QP&Se^VdYo;o&s zSNBBS{xS`shSqIqZ(=Umpy@Jw&oXJ9H8&3REMz!!epivyT7EsEdVg71$=LAGycX+P ze=R-pY|7*ji7R`x^7mZfIW6E@mj#vQkAC;C*RbYgcG!JC%{^Mn!|mYL{*7)we=St?XK-#5cPidxa9+_K|3y=a?EbDD78{vS=|@+ zkIs9xeB0QwsxMPIOn7=i^{KvLSe*Cc^dg!u2mhWD)iU7j-1D+)c~dQ^@BX;oyvEC2 ztNIN8XKStP`FA`{tMaMjHD&+Yy?Z@#YrUd{`{d*vlV=6`H+oqh@pzlr%_3jNgx#FI zX<%^0!nWQI>RZBcFKND~nEXqzDs3#EN~spvlV2_=Iz;hhNQqXm*1m_HZojy;bG7Zg zdJhfqFaF2N^M13!YdomA-tYL4gX@azzcZrQp_I4xyDuF5=f|4IrrsMeNTG@Aw#%(y zcr#7(_Q9KqEg4f%S!;Bb#G+H06z|=m=*IR%OVs)CF1F*&qU+`U*M~M};+1_vbe$Kj z*ADAmw5s`}>tFpYRM&6MvEb5)TC3VU?yPEme15A1_BCC9_Dme>w=@5~+@I&Q?MBZcQ-Ze_s1w~m)qBN>A|(PI@7OTl z<-+Unvq!)2N?5$Dbf1Xoy)-+_4SsYRU$y_Awad<{(c#+I)uZIK#_TP0E?hBsMWq&V zd)BBiXZhuvVIy}OF05W%NCy}ivB%pEkNQ~DRL%<`qJadlhxkf-)*<98IiRww*+-YluwwPyy`9i{V& zT=6up+?3B#r>)d)wmmhbH1_OMqj+Zd+T`A_fwtoOh^3z1m&>nzD*q96v-P`iLrQ;} zJ!n>$+}8W=&m@GVtR9s&zGc*;es7zGME7s_M}mIks!rMOl-#`8ty$JFAJ!MEGPe5l zwF^Iw{CmKRdb7i??i^UWNUfTK2eoNG)Gz+e{H9_#?rv{BuH_4BuVK&f&5OFZ`TAAQ zz)9O`=xdwX-pE&Q`N^Gyt_|Dp=F;)&JFoD)mK(hECUzPBJI~*KhZo0&>%Zmm-}3pdK8Q=;|CByFI579ouCHgyO)Zwv=J+`8xC0;hjY+DQT&b(U z-90e6lCk}b6wS1j0W#h_ce{`;I{r3HwX>5u1@pBtTo$1~8eQKM6<%(;=Lrr(1 zYwhfC@y~8ImnR;dw|`WQe8c|w82IhM!8(oh5AXE2*|Pdk^VGXX&AK#tb7<9N^Q-MP z$Eb^*e);^M;a2Bi!z@!42Moz^F66IjJ@48gat~_OsPLDs#w`QejQ40?qU!bCvtvt6 zPd9sPc^B7wt?BaY^h4I;8xOa>f4OiKeU(!w=U&*K&5FOc?+-t^Fm~t3FL^4JYt`k;i}@o=R}bAO^x$=#R*$N+KIlHC z_MBUvZoS-;Yh$;n>(i@lJf1ixvVGe-6FX@hj+~QTr`+bs_k22+>)z`}NyXoDIu5=z zr$WV9g{zj$we#)7v?_DH)%{jIzTuDg4N7>nJneVDPEqTEzIG|siD}>ZTT%`@ z-f{Fz)fGkZ4c~ffw&VEg>NywHE5EW$`{#bU!)N|;LQ!jF-ol?7Cf_zW&2ekH`7$MVwGfufHz->LW|pY<^#cm#?zAl6FSg-0IpUMH37D3~CdXVu_o4 zrbf!Q-H)br7nB!HSdV|~_mR*rnao>^E+jpFd(A?Rf zEuwv2H)PYs_9wi@R_+o0^ol-p_vd%HndL zM~7VuNN*g|dBBORlTZ0~nyM}Ev`mFlJsP&VUhVSgRQILDWq%%r_q{L=Wk2oMouh1! zqict5a-F^BkkFw!rVj3U-kyBv+`R#%>;IgPbRq8ryOqC_*{hW`s-8H%F1+HntELleJLp4=hTAtc=K zg~bOi^Ob$f@#cHk0cTh3`)B{NfbbUW>)syvq)UwCsDXblIsZ+3@Ae9zFN>7@q&d zf-WbrTpzglc*R3y1|ID_`sBklh3aJ6x%F~U^UU1c=au!?-EK_yz#851jJsXAOGuW~ z$-`s673{n)@LhMix4L&?>evuXiK+=%538FNS`^Wz$D8nq-J*8)z7zLprX?n3&dtX~ zd;gpYUk1SXh?1?EJL=EGt+%eX_Z)d~V@X}!l;OoXj!_h=u*$4x*Qj~SZ`yaEwhLr! zwv8CH{qC-B9R|!z3Uluo->|y*R->vv&U^R0Up+E#(Zwk5c^B@s*|}|9iD@3|V<)w1 zxuKrsR*k7XzRgM|e;F{ZcbE2tne`3jR-UY1{DY(63hmjrZPliH_jlX&^7E7bR9|j> zxt>~CdHiU$D+?cWAJZ}T#?y;+u09T0mH$|te93nwMztP3ut(_j-5baL9p51Tt`~n+ zIe4gqqW6v>8(!=xnPeaP=9_o(*!0^|LcSlHu<_)^t(L-9v_se5ySeL}_VLwzH7E5; zzxXcp?=Dv(AICH}wm$S-D_`sLcB;*VgU-VZAS~biRG;S7oszBCxy_rZ%&M>?^xlDy zao@hDZL8orasArIhV7kAfA+9WUz`2MHh){8$9~0DdFE}o?)kGHZWqg(w(Yr_AFS)DdG@n}V(k18I$io@@Kg=tC$BVzt z_gMUY=j+b@SzPGL7~g;K;u89A`TXC}hku@SA0It$tZJ8S%%3Y-oUb!)&6gJ|-sf3< zU;c7_&%Xi!?>}!*ux0V&sHM*>^}h6u>mGTypLfB%TTlPp=H%nrC7XD+9@WJ(!MgX} z-s}B8m1|zruU(eg<%9fU8=uRank#tcT94&Eh($(?bT0y43%EtzAc)IoRBiyXPFAsR5JzTBo};V2x^idf#==XQah1Z}57bSNZaho)x~B z6kpZtM?I^b((|F~{W`p_i~853_Nvn(miY~stX^}b_s`sOiu$$+YEvd)YKi5QJ`I|& z&N2G2=NH}a<~fp6s*hg!zR96$t+LKrajf^g%~Q5aIWXl}_g0hs+3GRtT$J%m*@fxf zHHqz)jtuzr6`zZS+6XCZ8eK9Jjc>Ttn z7~9J8*{T(@R`2>P=!-q9Y25QSp$F506T2_SdavwMTk)0K-RJila`If%*plyWa z13R>O7_}v#!n3EnE@hk9wL)Uu#TRmYEE0Am?$feppT;*pT@7H!kScd)2EGqdPvk@Z_d*A1IT3dfD~IGhfd_i?W%f{IR`O zY@>I#iZ3)i(4>XiY-e`;b@B9z1%m1*dSDT&L(DKK)4WH(_ zyEkY*HBaTrvbQn&ng!0vBWwS|r1g8#I^eAPyZXobtjqoKeA{hpD(+waY>X6FO;92!^u)#`ay-}%_mcJ+u%Deo6uKJTW#6}L+^c;cU0XLpsEJ6pOL zOAT0%aNyj6CZnyb9NU8qd6DWj9StsJL|y{X*z zY2-)$?+51OZfosv>dxW&t1kc5rFGtRjho3A*7@3N!+`J!DG{&R)Ok5@?JT!CDYM%) zj`$K+V3l$0k2wLOq9ZZA5i^I3{`;qY|K9fwhBlY)IUN;|7;@;KZ_7OXIl~H__tm$Y zb#2?ajq6L!8S!GVSL}|rmJYAvY0K}Gsx>?MY`zMS2?P7CJXuy9`neTNXu}bvdGdJffh`6-2;`205 zud`jAzMInS%1_1IlNBxwlr{ILHK};cX5I%ixl5EAQ*6!3Z+&mR=<{{z8I0fkkyo7q zd1saCxOQIq5pK(WZ1BokWu8yn^d4a+&$L;%B4Fp)f_L^kjP=`^zxb`zS=t}@6n8Fi z`j``uMgFN=xLe&jimQuj*SNW>!^cZWtqmAoo$^`puk9N?>FBKNV_H6*woztUwy)@_ zm)*XY59N4MBlqg@^*sJb>M?o8&>r<3FL~xWxbUJ1WjyZhkT>mZ8hkM6^x|X3KfT{p zz%ux`X5-Y&iwE9}{c!f~5X2b)HwgL5sDoa__0Ie_qEHow}S@GHYIH z|9K^IPF3lSwEO&hwQQiWb87iUm78q|#PnRtt(+8}t7d4k>g$dj4ZRSvYWG^jf(k7t6u^?w@@SL@Hq#(wjI)tU!1W z7o)78%R|a?@(zOo%$}OPk4OpzveHXb(w-55-y>)BX(Sxca+4Dp6Un8mJXZT9Iwh{w z(zqHAMWkKk)eyygk7eieU7xUOSD0kqZz^;$kpSbuDa@y7<3=v6jA zG2OX?!Q5MT`~b)im%&n*sPF`0#U~V=9}X+;{Grc6IQ3Fp&MRU24f7wJ|D=)1HSGF?O&N zQM6j;KdIpHsZjTioet%C>dmxqciv(I^Wm>a;L502M)k4EOURrsk7%P8Dh@c2ed^?<+0L;-z0_&sWcL=Q(1`DT?GyHem)$+()*8pV zK1y6>uje4-fGyR?Y3K;tA1#$6Hh(B!{WJ41B0dNk0!a9W?`||t~SidZf$~N4LGTq;CE=P0wt&=qm^em z+xTwx=Keeq7akHkN!=-$@A@u%3Nsob;!EFnGC7<%?#j(O-jBI>v3#MU zU9Af(l(i%)LxQ$lkjA}EXp!l25P%)f<@hVG9L%>Lb`T83NuMC=87MmFV;L{5 zKaG<|rh0@ZNV}eeaJ*s>2@~l>)qeny=O9iQNG4(J@q2p95HY0OurLl$AMTBj^UwNF zp*O^@IQpCc`KBJGlB-Y2e!`tu7a(b}1O^d`!1}IFCK@Ut+6sWjz5}s&0(ISkkIi;v zi=?!yr7-EAi{Rkb9)bd0j|L4JmmZfm^U*TTb$#R*6o6^-7(_7;QsGf+$PT|og3{<= zM+!Rv`eO~urT7)j_mOY94A&qC&L?37#fd{tfXPHxgo|W-a^J zpcaZLJwSgXs>`tpO>wx#U9AdCi~JT)Rhy?g?scLJWoEHV&E>`GE<>N8^w0MeHC1xsWB?I2|_V}uBt?MU*q84sAsc?oS)U?T)V)lcIZC;S zj9MOXfDYm{NF)vziN7S`$F<TjiTsuOh_HdmH}b_Y;`S{f1uwQngdOg2!c5}tCC{qFA0Rdl~of?v> zVLr2t9uOlc@%r}@7~7cUd~{hUkSlV_@b;_z@Jg=}jO7RuY;*kh=K1I6Yk0P(VHMO~ zX8=rWnr2e@P4Kml-$lt?iahYuX>O(6TkfAZJDp(ch!!ZJ5_z>1Zn`q3B|ghlF|zh{UtNtp~vSz~o~@wxF;palogjZpYSH@X5MNv$bfw8`DvV@Co;a&=^b zAEN#}v|0=GUUL_8t8>Wt{-*^CIy)kixNe6u$LxWMQNWH83b3*>#dnXDeIObLY*qUX zWphZaEE@Ks-Gjo&M0EFpESOsz)5meCz}>FTv(qG+aBK>Y*~+GaZ(bvx7vJ^4Sl}kJ zL-8=UZISbU1Y&Nrlwgi40>VIZxJ3B- zsdH#2LZ=Dq-a(jnANfvs9v-9mJ6}5CU9I-%^2U(_ z)x#Dl?1>~4{TMj;k+Bkd&mV>6wO$fg??^vYd~EzU!jW5Lry>ahDH=i??2Y)=Vrj#I zX?S{4pMu&3g0Jz^5tn(-nDZvE7M+4_cfmlSe5BWfyq(Sshe-R!$&A0x|M}~D`5Zfa z<`>s4lph)lQ$n%9G%|;DrC{F;KpxGTuHQUUH1 zF`k+OA5dTnH9YXT$SZ|D+{6!&or)1r1$)#Pe@D~kDMkZ=IK@x#x5o;mw? zU(mmT9F~Z7kE-T2BAKVP^O?WGU` z0rvSRSHqw;htzS2UD%-w3KKnXrBY81s9{!3wO^)cUJQjzM?;-qGu;|%Oh$hJ-B&in zB0E<>5rZ-J$1`1#g4Z?*b7%|LcO0}2WvE}w^$T=4N@j#j`4_Z13%z_Clo6FUf(3n~ ze8+|xC#aMCKq||Q9@iOjdwBRI4Y+uCm?y$Cr#e1o3Rmo{lsEsC`@gfl9<>O2-vGZ$ zS&repGrx_x;e1bteuUJDY+D|iaT=}lru^h-bRRcE6&0J28vw5!f9`zbN>6TzOm#)D z?L%2S0WE?yij3%wPunr9v%bY2BJ)S8URp5WKFfcXw{pf*`69YR9-WZpIVZL}Alqli z_;>u7G5~bXe8z-i+(?Rm5k=+qwL{06iKWn`$fc=Dvu7~sxUPa>(G4{md|TRL%Bknw zKb^-l3Sh7&va2eZ9U*hVgGB(ed5yN~C)cyEh0N~+^@x_Ei+Op=L^Z97f~u9ZNaOyp zeE}$l1iNs8@J;+AKol!zJ)B}cfrtR1#L-(9x&q;`nOkq4$|~Gz-ROpYY|~_gi~4KN zZo?NkQjYa+ob62-um_sRfIXmd4YS10Q6fnOeJ7}A&b-N21(H@&u23GG^OE2Sb1w8I z`AsN{g&VfHUz+Y=sJ=4zXRom!B8|JQjP|gl@h<(bB&I+p%0aMD=a%S5S-tCRM`5rM>{-TC>!dVmm}fmtiqfEAuOz0)0S1Elvlzw-Fg{8w99t z?yAzXG`?QRPNemOn~lax=Gi#5JOxvXTTNp+RvJUK~ONjkM>LjLR)6kQmkp>$9M=|sRDYxQ15Fc0iRPf)R(C$zJUPb z3V%On?l{P*LsA`0O0A45d*1Tce~mYrWK5FNgGTb&xrJ<1iX_Oe43f8$xxCTxfAZrJ zEiS~kQ5XbY7{ds0)SxN>B$xD`m=*Dr(Dv?+qWcU`;lf_71HM_mH5kXo^O{nBo>!Yt zUKSjb&VyOov#6dq6ZwIzLM7!M#9t!+#n82f&3~igy!+55H@&o&r|S^*uo!AQRqWsd zN`%vH2u2Vpbth>vz4et}&w`%M=JdWROx;xM+=Qgf2J-1UGQZvDnDIA%m zDTw@{-3j>$6SfJ^kkPRq_ZoDfSPp;t}X@BeB4I|KjC*YCCe@c9ov|KE&<)u!i-Pa*E{QZadQ z3aGV~hgv^UC}eGxs?UiV-5WAfveC^w8q<{+n3}pKUY(v8+#t#Y8GpEV9$+gLp|i}S zlj|Kq)w6PRaY^M``qLB1ekkkhsS?BXp;HuPtueEr?gk*MUboBM!1*ZQw&p^_P->t( zkbs*@IEtj^s4~pFnbew*P9sNI7^tP6fr+u_nC{9pwe0UV>pSp4+474liqQbZ8o^2M z1Z{hM`B7Q{B?v4MZh%tHXFM@FLD{ZjS<6{|`uNYJWRAv#Mow%8#^0P8Rxg$7IlVb* zNPDTn@(7GEpp6G{pQa=UL^u^jNNyfT1mp#(;EHPQM!j-DKxc4+dW+FL1jI@gtFt<7 zG>Wn>Q1Z3R1EkbITO0Z%ZJUU9?M{<{iWW@`w6Aox51+vO_C5<5WNb#jRBnR!q#Yr3 zaApc;+e45#*q1<49MD;60W-R>j!D=)eCEh)b;I$xSI4K^+;S8CXzb&8q?P@dWSK!C zi1*YozurREiSVz_C;!{`KfjjoB)9^UdybkhgFm4Y;H2zBr@i$!cLm*(&j`yMlo6o* zif;8WbgxEY0q+Y);6^b0yWY{c>aWr(d=JDghG!8`^%mORB-7> z@$rLuX@bMGV~=$=+5=xYXam?h=%muYW^>8{71a-}=@4a%QPnGvV@4<2G1@Tmc(iC3 zo@w0oPA>8eyHx>Amf_Rpj?aTRUxKHWO;<=N2YBRx5X|xsbZ2M`+jhI@Jv<&#cuoDg zYJ@+n6~1MYb>X~{tL&dSYKmnwb4r+LSCHQm)O`VE^VU!0t&Jlx9Ogxw1Ve>x6+)_b-*P zs}XhGt6#xI4zXz=MEV`;frG3XQH*k@v9I!uoB^c`Co>#k+k?2fZLw<8E+&Hd_ln< zz;h z&#y-ug?oYO2NgH$SmUH3w;ZN48EAL}ZAJkf)ljJ;WSt>@=yiXc`G6DuNgcylfD&_0 z2_(h3uE6UsCLvs-$t`nGiIgw>OmWHZ7AqMq*eq(J$bic5ThPr#S8z5eo!s6NjZbaC z&Ra9Rb4j-VAL3>qJXeL4|}{%5=FBr*q3duFX^CcZk!mCXw6y0~+EG`0@=8UB~3)^2Gdb}aOAN*y{nX6?#C4oH@ zOM#pO1@qbN<{ZyJQkk?|QYlZylX$>IXv-c6dGQf$G)Q(&F+|9SDwWz+xWf;|nom;% z61v;pMm8B9i621Spq35VGM!1Qg&XT&;uTp#`IJKxXpKB^*4g%_Wc>p zD1M@X;N~3StLW_4BRAETQW2w2sn>0BEWw^3RkG|QzwEgM3#IDrt(tng$?60)r9iwX zI#Z~}%rHxlXJ`lGt9!YdTf`4;pTRmHje{Sn4RYSgCo5%WZX3wSFHd!C&(iya^WXWx zzvjFDbD;fw`(Mcay8hGtuYCT)&+iQUcYOR_`~ScEf5_|AmrHuFG7tF3xu3+pj}_h1P5306Z&0jPo;5tL&`QV0$PTw)ynG zK0RfkD}+c|GRZs2S>oXcBjJH_kYv>W#vi z?X1QNk?jtNtlwX*Y0-OfF?UG3SVwooFD80uuD(LrrQr3n|K`F&_x1KviH`dDE2OG> zJ$Tp~`pSse*yf!&1*%_MhueJ1?|oh{A&hGG2~QkI*S$Hku$ML@CZL4Du7&N;+3qIs z9mAa>_>qR45D-3XiTvPmhF}AnT(G0Ip*11c-Mon-Izb#*Uq+(8q>^#_*B`Ln;uUZ5UYc8WuU1&G=OVxG7hed zugfr&+$P7*-c8iDy-Bv#RMFu5Oe-u#J*?z0+*CdlnqUG#J0OpvF8}R>21&rNdk{wl z8B_2+;iY$}hw0u!J`B3a29vCzfHIqUa;dee4L%1RFY+=^mi!6-y3@MzCZZteJZ~Cu zmGl6at$kR#B4ZA@Xb`{When~=3r&2hQ|DjeDVGi{Bq|6h7t|d+w^Zd>E0;c$#DFb% z1qD^ixLE~>HvDC}PjN6zv$a3tdhf0lkj4!dfHY&ll^Dkopb5Y-ra)0R!3P#M@-APe zF2{u}%;qog^mq2Afe5sZeT};vSyC2Zf(++zIPYY>%%?%#f95QF;+T>Fl(2zB=RKzh z?;1-t712g4s{**oa-px~=?NIc7exy&|BF3e^_GCCW}#mNpSQjXotIzAh~G)W2!m0s zQ!ymMdg$i?pU4h|ZRgnz z_6B~5ahZ%ql+)pIfEb1hv%iMuaqwcHlJZpE>$Ya$n=N4C@M^@g5JLoT-OFb|X`4tH zD)t^9OWh9Dc9DZw5(6#>=Oa|A0H9(xCp2DJOiF6!OX5l_2^9)2&R6SAIB%s{N%I2? zsI;%XzBMXsE8ULZQ?Fv_*|H=N8HLu@gs5pM)tZE8n7m%WIQ%ZM^SH^(bz=FxHT8P| zU4_g)IqhY&Uu+l4YoM~^#YY^1VkIsCu(gSF`Pe}8>u2v@|Bs=S%}Krc7N;`}z0O?KB-nMl*7zzyM{HYiSOB;0mAZ=oN}&HQsec^tXv1?| z_p-{IwuLV~`4JB+o=?~zM5Htj22-IhXGZC(TfQILAX1C=;$xBZn(yl1@!%pCf0VIn zeTKiqojkJ-BK(`r3)I^+Ku{Ln5q^i;Z6sYKY+*S1Lo_0sW}r0|>tV_f`_p*uN_5km zz%*FB54pi+pSjZe4uk(HM$vwj!oV`=ac2?LK4#eAk4*|huaGro&i-PsGfd0LWCGqB zL9%6Ndf8&F8dcHcVZMu8)4WSb!0hzRhwPI=KVcAropG}qAM9pFiOo(B;PsrAzQ4s$ zVStmvIs$s9v#Q&i&*nu@t#>Y*)|1R7uF<$=Dd@2s)d|s)Pt{fpnjtgauOKQ~umM&uLE0C01qp*XNtSwv?OMZZaYEdur)Kg~ta&aWkCrElJ` z^c!%@`_t=x$5T{w~8}Ee#vKo zAEg0!WhmIO#9O+zk^qKuc8A=Z1}0GMX3xR3s`h3v)_pIbG-de{B-C@_rJlrgG9@$7r8r;+AE?Y-vM^DaFfFAQMQSu2PUL% zYpYE5c1N`l&eMRm)!S2!e>!iUJo%+x@PL25N=lV1_89l%(|YV3dZT8CKp_oHVk#I` zky4Yh+~HXEw0#ywu@}*aLC6KBl{np5ry#U-FysQNESn!3Wwy zkYQ#Kl-&S9Mp{ZoCTj#Fzs_gfWTPCoZ?6zM<+?U?fWHZ>%Q!--GXm+RKp+N;C7T|9 zy%n_h3H0b#oRA6)g71~D?L9_<#6=8n)#8&B*C3=i7HPvu3lCt_jl&QD|I|W*cD3`m zfTSP*Z%xf5%M}KmT{j3P0k@4~w09wRWHZl06t}+tzuIo{Y8=+DRlnUt#W^LlfSCh% zqcwgTrDTA@Yi3b*Ro|hQ*7r7ql%jJ1qH#K-xaZWsN~Tln9caTc4@&`yfLwst=|?t~ z*1*Uji;4t07LD7Xy1ZcEdS?k_fkdWjal7%>3 z?Zly7CCbI(XS#Bk?9QE>jKaJ@MRUxWD$R+@;?v-K9(@^#?t`}BgX`rZHvib7Viw}a z!(H$&(@x1s?{-NKv5!w_b@Y8Q?k(#vZ|qrGl|h!$POxNAM_0B4zqG7487$+!UrvH zx5;jBjDbOmX`q{~BwM%&eMEegLDV&bRvG1v$*faVohfGgbR9!P=O z8W1iQZNUS$><skR?4%4oY*C#WD-(C;_d&RGJ7+$fm;9NqqA`h&O=5y0)e7IM*~{rqf(=v@E@%A%vW zf*|-=AvVf1+g_0AlARZVc6!P|gg0>7GxA5K?1d?v5|%T}H?z2_-fMXEKw!3UF$ydUzoL6E9m^UTcITm1SWswy&0)&nzg{9cV3T`Ap&D z_$8R1sUxO~X%w(A?|~Lwc`8gw@8#){vv@-G)|8uiT>z?;azZ4qIG%HoV(U2dA(?vS z~M<*Gs#LecE7;t8YYjljxCMgifxh_}eJLUpjmCX9w= zpc4X2Mn5FC87iZ-wy5~K!-f|+lzJ7}ZrD3@ZAnx-aFiu{v+otF_W!YPdsRUzyBnu; zJ$A}>qU|oox`zLvfAML}H^KC^tD!@14l+ybiR|v)tSVpIX;dQu`8;Cd)OkLfIE!gxPxp3Dzz_ z9W3Rw<3y_8Rl(RkK{{;_?F%++MD_jTqkVAeMFa1kdp0tv*YCW!&s?=e@@YfqzzjMv z|0V4k(BeprL?$-lSq_Kpy=K0$yM?7;2q)Sb+}&v5>LkAUkB(Qgt??gvYxXjOsB5*= ztM@z+^pC2ypGpt6Z#P8ur~D*Gvk8%B5Zz7)8sOyM(SCj34o1b8<`W*yL9Xom=GHc0gm1PbEm?Qa=^g9FdOfC)qS!^<1iQlt60Ha7MHL@K2x+iJ(8`)_+QMLxZ{BbP)l{iXCbERA5q)>I*k5m1a9L_iTbN}ih*T$Bv&FE;$}&2$Nif-mdK7}^wr z#)m0$AC}$cU-}g|o_cG>{}4M}FS?d;tLDp?S!dD{A_>Xke9Hyui9?u$cbcSXXorP5 zRC?H0cy7Jw1)QthciI9nZ$ipFu&|111~F;?`D6Ho=jpST8>AmZT zJN6glxQ?z3iSzf5zkp(-wfAt%DsB#Nl*;}kAHoAm|N0F5PX*&30)&N!r0+%sgCSyKF(1cu+Yw z+L4W`w<;AtnDXPGMOtv3ugQl73Y_6WGLEPGn`{i}^K|6O5eTTj(1U7lOrMXQqyi2* zgqw-1$l-|+V^z6-;wz|UMpXL?0zD@(lFHWuI>6x+>>6qRYbxQcvQF|Agl08D^Rld6 z^+6ndftiCntClWr&tLZcy8iuo=%0rE?C|&PeclPCC6g}-G>DNNh!3AZJ2A}W3HQ(0=NH$=2> z;)!0r{-THXpTpu8-Tw>o`~S1!f9JRV`9I*_Wd8ByAAbJd5f9e-ho$18KS&M_p_BF> zil~WUx~{{)>#NF)ADMR2%NNgSFp<6iZRwG*k_QO7vTuG7*H?jh0P5wDBFgTWJ>&HV zu#)O9TBp6F!qo!!ajO{FWE#BCIbSfG%s`Y06s64TX^Nt68rl+~~qU-A3s`aO^LdoJ%k;|t>V+dty%ulK(rzQ^NV>;HQHA8`M)|1ZA& z;pcY-{yUz2ul*<9{^94Jc=(-x|5NcGcMMLC1RxY>gNYMKQ7~OfgwWuLu~davt0;d0 zX+w*$&a)@&VWj~_Zo!)4gWD8V`=&s|#|BN-ywEY;9Zv& zwraR6@~J^ny2V{Tzh($<)Dh;q7#Il=x)rCpfJK`kkr+HXYR%eUU>n}$kdluPt_~D} z9L=yxi+bmUz&%7YpBY3U1(H=ueamj|&a40(gMzT-fI$i4?Dy$$W%K~>Px7AS*B1g; z&HTzYy0=a!{zP-5Y4# z_|H-0>)1kn$$i)1y>w%Q1S@C5Ed!2-C(s!(lKPtB;w=wqB4J60yrra;rp)h%UCv-m zIgKtI=wy5sVUQWVr18HEmu=`9rFQOzm0JF3FDIqCx&Xy064!a-MmFkyeq+DO`8z&v zD`teYssqo81?QLto~m9Ut#9 z--{iN0^B`ehLeM0^S%#zc^&C?3a36t7~_%)rwdI)MIDgvT{MmXgmyegB8d( zClmoahMkV62`A+xX(79x_Mymekn#Zg@FI9eIT8p8!je-&JxGD3Zt5!^zfwRq=*rHH z$9+4hQqS#v!2gQV9WQh$cF6@?#2FRI%r1Y*A^4h~%_Fd|n zGNK-)`pxu72C8~Q@d=!AM;{+!3@D}e&bIkbKXNz8G@tqWdwT-|kV7DbpwI9HX9`c~`FBkw{rWMrBRmAl&6oXc4F`VJH z?AFCAft(id1uY-moAjtA;(pKL%}EqdbhVDIk5jcG0ew4Rr%?LV zLqI8k*C|@$L*9`t@lyoD_!SJZWyHb3x9(}Tf$%Tto2L4vcJR)Ps>471Tjp$^yw}p* zU8|OF)D^X_f4v~NiUT+6FY5JGRu^wGDU$mtNtJh zYx`&O47J5joOKqV5>Q+223-E1vDf}tN zr6O@V_ZH*W{Z)qhv(VIY&~fip#BeU%RuGM(^ieXBe5~fRCp*X}IQC{6+`S%$&udxF z?)U<6wl12(x#}ZV<8En#A!~8MOTeH0QkjO~m^7@sXjQ2VkA!c?ju%SVQwZ5PtrA&w z`l-^N7ZjU4&dJLCQ8jO(V;Ww8JsCBAvtVE&azC~CoUW-tT#wJMSsg#JJM85>RhkpZMig2acP&*6hYhuZdAu;7~Hs~Ta85vKPk z*?0LZm+~d*3H#*8V$0AGEuMsvwYQpeVfZHBhNE`w@QUf_QCJ^m&Jf9{` zGrWm~flT=9!TfVCQYAE#6P*DE0M90}_p_VHNt-LFUlx;o+KV*Ad8eOZ=^wdmZN@Wy z5&^`|?=^bls?~eR5=% zUd~0ZX6dK?OHPDT$~KS10CZ!fHI-7n<8k;!MBN7a3gf_PAzu6~>i1E1vnM~ixz$kN zNlGcv4pV6krT`+~XEohmVJww_%DoB3_^ydL(_7E4-}Rb<@3t3>2pJDHx~5{KVnVyw zhbek=RBzk(ghBOQe|fyp>l$WuNY#Qpt$Mncpszuvc~{Mob}|Ns+0Ub|dx^fe?So<{ zma;_*V#}84_TJ~cjD)MyVZmKjEYeO=Z!CbEm0r&`SLS#OjzY*N<~taD3PaO-Rh(F~ zDZcGN7V0aYw-xug%~mSVK&WxOr`_aoef(+fK36=U+~#5X22yJl>M)`O(5kd1LQ+-AG(#z(!g?hOc#HtcwB#%9;)+zmh;Xu2-h|_U`Vg1 zGvmUzxkUy#stHG4NKhS04<9?fY|tQmg9l)m$bX+5_>N0@{b1%AxlV`YbEcamE;qE7 zdveadL&E38ahgR&}+cIdK&>bl^jI#)xm zIW8ZHfKIo;^BZ5!);wsZc>@TUxjiYf;UF=lTTQ8ViYC{Ba?UThye1;mYFpdfbUCOW9UC z4L>!K%E+T%x=fRBtI|M?+w&ijuRgMqle9wdHU7(jf4w&Sao+d>!CLH{5JyinpqvIS z8Xr;HkjzJ%13ChOAb0}1(gxsMwA9!-i5IDwRWdNB*rbrgPk*YA zlyse1b8KEM3*d-)ePueplb}fky&g7$KmT(IqqH-xDY#)(n}D3IK{TXz7Fb0O@a;8C z%E1uNVzx=jpjdT&_-3(=146R|VtxCS2UFbU3Q9na>+uTNq+%BG2Nmc!M@jzd`&eEZ zyx;XF0koxyM3cd{f8sGvucbLP933s@8EFBZ8H0e*JIsFLEF|!BQA_cLHw)&6^7Pko zUvtAyHz3uSFV&?Gy_oR+_5a7vVl*N6*dVEHmRr;^!`-fhh?vFGqV;F&CrNQlLvNhC znoWR)#S!Hz=FmSj%zL4u3#hLAPV4#_e>S|_n*O;D3pij^?Iv7MInH_RT|YktbsL?R&~~rTlF;}1SUhdumU(R@TMpe-o47-rN;MZPWADC5+={xU zL|*bd7>aKQBDM4QDO^)@S&ujj08O15yIAL0m@3DS&2#$0c`v0#}2j zB;O6JGJW5RmGVe8;(eBT2@gH$duM4Yy1sf~L-<1l1T{Wa66lhHQKC?G01eouh>@0#vF7vn$24@9f!V+noKK+n!bhS@wlooI`n3v| z)5;}ly`S+mjGXnDiQWzlOu0EAI?&2ZX)ghAVFkDfc8PqOGkD?b+*${cYK)F(jLf!jO==WJJ+G4 zt0{b-BM?4xHP?4M+l>a5+y0h{Brg_{|};(lJuee~vuJ_2J^(x-VeQULYl5XR%L zJ*gZOat8)X?|t5jgCwQ&%eT%WSvWTby@gr?;nt~m90jbat(q2(##Z>q7{ zi$EQY8BOAYG%KCs-nhNyR3j__D_i=ue{MSV2M*P$W0dxfmudIuy17U+SWJLx@~%s{ zTRjow6`glEh4_F^7j0Ss6P{p82*b_!1v~(`SahG9uiwaq-s{`X$XAR&zpq0(_4tcq zw!*=4(PWO#xZE(uylU52CT;1Kf$WP^Xl~29oaCpYL(;$Z`Mvyo{`#k5es=o%_P?Y5 zlOO+YzW(9ocLx5S;)j~9N(DbHk=zj`?H+$6vbierdY>ybJ-d!1yHbAi*+ zIjkA4Y2n;&WESjc`9bWVR><{ir+8ngr1X9bqyx}c{*^}mSmXwlZt1TmOLP5j)kRTU z2Tk5(Bw3_(C@&Y2I&KaTNMOsNZ^#A0(3E!l-6I!DAoVA9WY#|Qn$XRq?Bmxz@{{JO zB48n?HPN;sXkoLiz%g&!QYfHq$$xQWF`xc6#bg9LB!!}}eIOSQeMg*_J&a%s_K{>W zwl61s!^g6DpO2&x-Jn*)4xLF}MXgmgK)kCV09Bfr|E5&eY7d|MARhl&G!CRUHEHko0)~DeyB>HJi`$a*n2(7d`^&hU_W{JQ;=01MIChAmu4Ix+S0V<^5maY2AB z>pJt(5skMyu;V3nuHNom>%9;!_2%Uynpw{ZKA%A`LdB#CE=SSHb(crNy zIYCW=`?2nUh$2#62KJ}?%y6+}4B#7?4i;nX`r$E6dNZX@V^pZ=aBiYU``=PLF<-ZM zx21lRSl~XLYQxkka`b7yJ7bfy@?_YY0X<|h_f7<*Fg&NuXrQs}5mLL70*&BW{{b1lsr(DO#dJa&`)T zf;?$mutE3e@jw{Dhryrr%8=+icMmmP`K6;3ls)dX{_@|u&)(nv9Uo^F2t($oF)&B* zq!qL~bcsw|;{9}Z>L4mL2hU7LdgiG(L(kI8V(~k$L~0dBH1vPR$GhD3q6(YGpthbm zOBT;U9mGVJ#a(OicGMpWF{q$jR;-L1#PN1nJzKCyMpG_7rA>c@(h}{veZlK%DKhoF z!9l>&9ptBd{XzBf_M$}fXNFrX6!}sLhgKfOmYK-0pY3K2O4M#Y2ySo?1H>Jcv3!v7 zp1Ax1VEw%rq(N-zuB4xcJrj~$1t(4XL78Y|9q7cBA`tG8gWKei8#*U(tfEjD=mR#Q zZb}8DuUD~hK|f-3$ktF6olgJ0qMEr(p+^CEjH~Ts|@(%ca<#K<@5m0dLzZtIGkQ5M*xiw^8!q zBvQ$*rQc8S%jREdmMRN_`md@mXdGcYMbRB zWa2jQv`=GD1+y|Trjmf~H{f}8`{TTbOJ|mfm#HQ3PlYCmy16?!yf$_OA!y#&$O;jz zjTLtR#XtSkVX7g^G~ZFKn%y3MeGk-=i!UPoqsC|XtzBdVmuPkSQ;gs zOpJ#VcI{4#{8yrZPixz~r_c{angOW742||Ym#1#cZQk1o=l<8};wx;ydKSG(3&0wL z)}A!7R)b4YY5I?~uerVR_ok12OO3P0)fpkPSRXN=wP19%-qiMHVRgF#<*=f28m=_rwHcn=5aH4S4T_TJK|CJS0qOlaYqzZ_>A7a{DqAQamJ=ELJyI- zolpcWPdfUx1prPEgpc~7A_r>DOBQj*rtZUh0Q}LnaI26HoOQ2)%K2o0Ef57i%B2_l z%$)qEzfQ*+J?^68!#M%NJ`i1QgQ|So_LFsCblA(t5x6FomZrhKYq$ zZSW4{Av#iUYm^&tu0Jv#xpuTmd)Bw|P(f4qaOG-DX6hfBR%?ez5Tz>J^FM85ytU zWoEqPJ~KhtWmIE3+(9cfJB@>^4CUqQVvtw^E=GIx)1PW7zEIv$WuiVX<9X{_9fbKk8Df&)^li*)*=G7pXsBe;lEe z5A>?E9jKGe@pHVWX^}C>Mu;(xf(vgWg*#{(J~m_Q;Y{1nz=faX-;!^btSG7t)p-1V zD;v_In5X$!_U#8KucI#oM5Jv%Z%?BH%KZhZQUC1Mz|shtW8Z(rFJ&N{)_67`1kB)f zOQyg)qgbw}%o1YU%cfQ!ChIP(L{gPZX%H`2|9eGC-iWX$gVOBbyftKER)Ar9^1Xun z9<86mk*8N(Sc;d`G;DV(cRn%lk)*COf%CLs)LX(I!ydQHeIGyj;)@w{08LTXv@w`d z9wdnCIOv&cPz(&F4l*Y1&;ATm-(ySRjuT~vO~<6=W!~{ zS?{<)jG(U+cmo3y3q`6DdT|euN24GSqfu-9Hb4E9HB?yBL6P)r@)ERbTq8<215jky zXI+bZ6D+c9n>Dw$_Ep4tlIz+{z;@&8LnD_J2LPPbn6@o-!^i?KxTWeS89S4-B;Jsg z@{b^eHcL>?!726w;64kDcBYAP9G8rtPqk5J?!s4Jzb^e)4;$RTdWs`6g_{&^$?RpR-7h<7nf&5Jj?`)&^Wz5*Z5OLK;J{n1 z?S~(g{S2RN@SRwkq4V{(FG~%+57O$8#_WE8>2DlP{RyS^qVJpfrSR^{3;A6OH4VyPoa9wg^IPWj9048PX7>GKs zBy3X9cp@I7-hv?28mGo{)j23gL*Y)jJs0mnfN>yJs+D(?M4;Qq0&exvJ%Bp@=T4njn9xHd7 zMj#T!r%Dd&(~=&f=!8TWZ@>88@_U(0R`gVNYss}jw3N8VfynYn)wOp`S0)6-L1A)E z4jNYnb$W^|HKTQgv@<$h$n;t`IDX>2*@tfM7It0S{s~0T`Dle_G=7}ODA02KkP>`j z@@j;mAJMeT*0E4CP!-q22|`(y6=x!&=O67fmb;J2vx)Vij2@ndISg9bx%m8f5HO#o_;hQ|?-u1|W`Lj}Y4eEN;qi4?B z5~0liNYU9t5)4IhPm|4VtFcCOR%el&z?4ZV(qPS zQ`Vfa_WT*MC(qotxX*^J%A^|4xjlybcJq+(x}8fVpRsD)-7$qL2MsLw{;WruKbYg1 z{Kn1)7Pvy4I;D=zT{gAbB@4HnSeQTbkC#JVjaqRy{?5q-Z;kA9f8)L9PAI)%!#5ko zuXy>^J(sxV6!ndd`6}niFLpiN=f^FX(~b7h+b!~X-v0N2TER4fmi4-4@%sPt_WJyP z^<%Ap$o^qH`@eTTa&xCe_Y!287>1* zJ5T-Nxqts9=kcCr+*&;A`lP)}kNtDd@lmTc9KCnzoAW+>Q4`QpjGBRJ7`gCAu`e-l1O0=M4~Tvh1vLq@olyx; zJ)?4GpLkc4|(3y-pK)o1+fX-u71eDIG9Oz<3 zRY3h2)d0aI;)a3f%fcuTP$x#sK=gxtF^a1L`Vb>G5PiuVY2&xI9^>p?K${r3fkaRA z0MR{!7{v$lcSc1(&oL?idVx_D&}K%}KwB7vf&Rs)0VvF<8E7XX#ib~_7`cI7W8?vP zolyv=fl(3A+l^ar1=d2@H2n_+Q1_&;J!a!XZH34;F)C@$I66iTNMc3jniW`VNl0=UH>cuDol**_C=sZT{ zKxvGsf#{DM5Dmz~r~#-Sqb8s%MpXzvAJn17fd(?F0TMki3^a(j1|Tn^W}r(MDQ76k z<&4}wK1Lp(A&f#mLm3qT1sIhB4P#UV6l7EbG=fnWD3?(a&?rXDKp{ph44pBI+(6?P z`G6)c3IR=IR02e|(oy$7lNnV5O<`06MAyqPN(0bTMomC;^90=ul{|xy3+QS_9-!Hb zd_Z#;6#>z&OvET9K=XwTf1g#($Op8NQ3y!XWD(G6=1PEWVN?aQmQghjeI$+^0aVGT z0qAx{%|LfBQZB})=8W7xbi)KQKhSzcA)xyi6#;EvR1WkIqbi_B7}Wr6WE2K^oKX|d z6O5XHo@C@gw|R<@8|WEEKA;*#A)x0Ol>oiSs2pfBqiP`fBMbCDpno!I0NTc=3FzO9 zlnksNj9frF1&3~!A~>Ma8M%S9*%1hx0-k+9Zbn5w=P)V(I+sxu(D{t2fi7Sa2D*q* z15hTTW}pF#Xh>Yb$PIKEBM*?DQ3xoTQ4!E^M&&>w8C3y|W>f=o1*0&~ct%Y?S2Ah_ zx{8qt1FMLU8>pC(4`>#n5YSvkB|r-pl>;qgR1H+hs0L^mqXwWG7&QT{U_`}P#mEJ8 zGb0aB1tTBOZH$V5su-03-NmR1=w3$EK=&~U13k#70jQc$Gti@qXoC1FBRA0B7~zNY zmA^9z0X@s82_8h{QlY6AL#kuQK<3!@NFBcmc9(GyF64lq{^^dX~a zppO{U0DZ!!0q9dkO+cSBqG|9;MlPVQ7F!BL?%cuzGJ4Piy&5WvmeqdA$^dClH zpr08v0R6(K8R$48>aM>ras&Or$OCkeQ3xm|hDKBoP%NWzpmvO^fZ`d|0JUcn2I|15 z3Fs6?%|J(WS7HBe75=I^%FC!n2sL2q}rOXup`52W04P{gX6kt>XG@MZw zXau7spgcy+K%*GB3b0l%as!QHC@lnT(o% zW-+2+Jcp4BXg(tk&;myEqdN;36#*?~R06b=Q5DcKM%6$!FbV@LXVd_66QgFJRg7r) zx|vZ4P%5Kxpz|430g0Nd21;YD1}L3T15h7EO+cB9Xc6qs$OS}y0fvf_OBgi+UB}2ZRZ(taCMB8N`M|?R1UO>Q8m!hjB0?MW7Gij5~C)de=wqD( z5};})x-fDBbz|fM>cJ=kbS9$`pk9p1fzD%84Risc z8Xym&2B3kAnt(22L|eXWMlPU{j66VBF!BNAGb#cqWK;rF%%}?J8b;MX*D?wNl`(1n zTEVCpXbmG;>QzSNOR$GyR0VWDqiP`06KjATWG)Q!Fry}*M;SE(J_ry}_sf=uJk=K>HZc)@DB=H_*F`JV1?%LO>rdDgyeL zQNvoSl8l;weq_`PBx;g2K0h<(0y@gb19Y5`59l{WML>TrDgipls0ye}8=5Vufnphj zf!Z-@07_ug4Ah_x*R1K8Ds0JvLk#GFiiT(+}%DJg; z1#kLh6Gm-NZHs3m*mq~JBJfL4J)WojkhD1`F-L98@zyVj?;HM#3K^^n><(7Em|9KR ziog^8q|Li#rtiqDcr0~2sF|^KxfNSe(I!gL=4L;2A!TG`T+HqOU<@qAZ=RW5apSWy zD;7T&^foW)Fcc@DoLLcgE~v&QO$-OsJ=yS?lm13dT~lmQr@(GJ-V0WCsSj4>5&rTp zd@8x>jHP*N4wasfqwdFvCzxClPFh2w84hl&OWM5nxtadhUvev+PNnT{u6pAN3Y)j) zWN89o<(_>*w_oZW_V)ITfgwz+{(b_ zVCDEHq-Zpg;=~g{^}V3_rjf)>&}4|3K?=K2z?{msGmS#~@#eo%Xew|QxxkAHxSX+z z>m18QrRth=mR6p|;K?1LJdKX!S)61mORlQdooLfsRWx%@)p~%M_e-$vUM_d=rk$Hm zZ2y$P$ye<-4QO60?&$D}buBth9Ir%IGV-B~rZA#C+ayLbQwbf-F+xXUN$9BW3*Bg- z61E6dl%~4TiC2B&-qMcRLH&UfQJbkBbbyyU^-T2735mgqf>ckiVs2_y-*5BOu_@}o zyqL~;YP&qOL$Kn8R9{Zz;J0(sP+CsxTR9b-bG)Inq&s)yd0)#`-^o^A4|YD76Eis> zM?E!19h;D=`craax93$1P0027Q^5L@?%W>qz8zE%B)9WBxv_q?cGjJvb_EkuN5FM` zPQ}QCpm#(Xn7o*=F5%Awe{SK=1%GZhtIP53W5d@q!(4SYY+YoVQ#sO|+xhj}^tzl? z;rP6YktsQKhhu}@H-jq5k()I9m7t1Z=B){ro!==-X_7EQ?S+@gtB?abQI9@K}hi&M@9n$On0 z@e?LeJ8VlJy?R`ISA;!GEzuTEa@Dh_5q!C5vrsPTJU^gzMs=p-sUy>Zbzi%))A!}n zedP{#-|F#!e^BQh;XwLZZ5ji8PX;QyK{d&*ZV$GP$yK{0ZQGHfCI%s0{lT&hzchO5 z13g|%uRoFyTkox>%F9;k0_j8Ce(wl((w*V#-t__R5Ko}ux;S_NfpZ>^el;AdYjO*p z{-kYnesx4bVD+nxE_2i&Zn(`+$9RHuhmk65zjh;X#dVlS$SXW%d$$uv->!LY??+b| zNUrnLDG51sN8IGT<1dZb-o_puWT!VCX`dZSZ>X!O6VQ=Hp(4I==fHJ9-5y9EmKKQJ z5%5k)3sfxc2-m|ZJH}*tU*&+?dpGz|PVe^Qw?#2HSkkub0d-}y$ig*g|1Alw+Fn#+=%N!G=ymHM>ib^_b7^siV`&hN`g*53iV_y ziAR(K&9J;nE;?f9Pl|(4r)V`cOA-+-3A2774&SycXU@wX?%9Y4T*6_;<76SC$jqFt{@vMd@~oL zFdx2`CHrfep!X-eyiZ>j)K_Tu6;8QoM`xT7$0AWir?%{#5@^PGlG?6zppwLx1=Dr z>SWxK_}cQClP8Z{L4&j`SUJHRtnB#*oMPba2v+8%dN?Y-8Rga{6-;2cmD!l{)HgY~ z^B~_sn+TC18nO&Cikh1m(wB(b%7WCQ9CZ=8$n|MC>SvgXs4m1paV3yg0I-MFW~DVi z)3|=_0}|7|f1H0j=9-}YUo;cts-O7PcQ_&@tywhR+>RWm97Qza`=~;)s6sq6_oUI> zU-JgZ~N7K{`83+^~dxd{NANm z=uUp`ah_><*VBLzbIe4KK;GZPtKYl8?cW`b43!+UW2(RWEybU{Gz-0{eGG?B+V*OW z8c*|yn0DUx*7RtPU{g&Q}8J(lkmhPo3z=Qwy^wJ(?YOF2S~GXl1{4>PPPwuGews!<>yBn8zv55-P1S}% zOpbbCDn>`W8o|Km13ixFDZ>A*Y&9<}s4h;+RmYB^A|@aesyU>CsZ`G;h-5^aX$kqvgivQlXuKz= zjz>~ABB4B<=3=*dxBHWS;g`yeZ4lD$ea&ClCDE7M41ZbVFIe|IlK#q_UD>l+K;3~U z-mf;MU*-0D_hE|RSvrh~(fdBEdpBfz18$_)k@C}skA2DS`qSUXXyIi=WSq3^H8nu< zG1py0ssWE5^9C~Yd&5YOazI*2WyfybH?u3dB&m6#w>6+dZb}x7KddsYQ$TIZPCtM)w)wR)0ff-BsB!9)78^;*y3{c4_BJKAfWt<3*Ypb4XBvSdJMxBJzygC zoTyoC1?G{`yCL8mPNSK6-T~TQ7V#VJ&$OFELt%Q$PW~~_Hyo%K-cuVdv;?^^Xz+qu zXp2Le)VS2Z>Z92eKFoEPjFPtP!jea8A@-Y_vr`kXe&u=(FUm?f%ZIt4OKJ`lD|6NJ zAAN;ay=<}S#U%=(oRhBzyM=q@IKxr+Qi5Zxdff8B< z@`Gw$S_!ZLElv&Q(&~__P6%bI?Q+z8*|EdW?Wg36K7GVZt3?*A79RBOHs05UR1WTh zt}W&;ngWJ-%J(UL@2_|c^gWbaaUL2VsCJ`X_-5BW2@xx zs}u5b)UVO45%*i3fhq^5Rd&1t6KQ+D+U!sN(eGUn3RKLDqmKR>{38eI7d*)ETIWyR z@BPD{{GLC3NeHWp*wmt+H1`Zkh%%{pMc zA4eIvYhnl?G;cwX1v({$voHA_fBLUtj?PunxzJ*UM&wg@e%ZHnTxuB#-d@Zx*{NlD zv{I;xv8a6(P{)UI_;I6F^WX4X9H<-|hxP3;B$0_JFVU~o`_uQRU-{GL<@>#P`TpGj z+Wnx(DHWdckel~=Ew3Hg>ucOZN2!Utzb8{3-=k-1Gjy)%<=p^JKf`I778Bw=b3(-C zazQAdPR!3$e-5Y%eAp#m8UD_VYkI$T7u-^%QTYN`=yEV|4zEm252`=X8i)>aUS(W2 z%uQ*-(Sri&@$B^D*|<4Uj=Xu4=BX?4b7&$%V{XqLB+hW=yo2S1=9TQEmr-S0f{*x_ z%H%!4@bm2C?dsj^(4YRE-}@en0kEP5G4$NKeJ+HeI-;v5+QWCwt7_=H~m}tpA%w30S14XBn z^A4@-l7RKfTQ{WgLKp29{N8VnVs>w=yQ@Xo-UgZ|chg@!;Bz1^mZuIxcu&x?-}^Pa z1iXJ_Czqy{`P08KS`URu$2|6iUk#+t?4wQ1hb$v(XP&w^KM#v&o_Zpn27-C&`#I`j zAJw=&cDEmMe))cd=447A`@MLK0_jy5zoYu3rGqYtysx6*JYJGadmDJO<9!DS`g%9>#Nbc#_N1#Ph2QABL40GUA!Xx zF)jY@0q<+RA1oN)#V{|LJ-#xv}*GnQXS?a3o13{ zqExNW=t8($rCy%hyODzil0QVDvy%^IqyHPb3JQ$Qu}8%oA=pNvR46=O$L>LBy20=ouX6t6 zy_o)e$;XjeAbk(+185T(5{N|=XIB(q3yiF{?ZzU%6P?kMw0S5k@j-9HB2TUw8$?B! ztNYRISlj~@#R<5i4OFBiu=wP5p3rb&sqP2uFCqJwA|~3ez3ULi+VEd^`ddKa?(y>E4fRfTfl*CNojds zBGm4gNh<=ow={_}6sQ|+iSLFA!Sc@kG0Bw|4|3p-csHCwuL&<+id(GMomqS@E=Cao zbrm=MCxvzHV%2tB`sb$NMg|z_6I?O>qD>;99pB0I5~=^FiQ4ZjWRZ^QhyL4Vtj;|(v_oa5cT^o*HR zIk>g{OP4z2P!~KI2D#*0J+Bs)6L6ypGiFLKDNq-TiMxa@cicPh2M|gLZmGp#&o5OU z-JJHQxP&^+jjrF4t2pcAo>jkfOuD6O2dXZvmf-Xq>fJZNkrIr3>*S}w%Fzki&@pgY z%vlw;aNpH$ly}nj-F|$y9SfCq1ASte31=B_c+hY&F>Cj5d{!N+>>gesUht_1y$gw# zBJp|I@O+VR<>*<#is5DAO~ozcQbsj+*Ed|TnLEJlTWax^j;}^wX#AH7fQtLC79dU( zfL>4ldO-o`<$t086&SAnpDsXs!hf*2=(|+CAJw zlOdH%>q%lQsW6re>R3+A6Rc=$SEB|g5mPR@+W+tboS+wi=A}O^gmvQ5`&jD>@xMBU z4aJs#TOvU#1kXZROX!mqW-X-6XLz(j``?+z5=3jz3tEF-Fptqo5ltZf7xUP1Y^b&T zw&2H9s3iEDk2fRiRc)lJ6hBnjc4c&e{wX}4p>MlvIf-2XwWGy?zCY!!rH|o)l@rlR zrIYk0RtDv-b&(3Y5Pg$?3EAR_{vr%_t9HR))|THPwVb2BR|B85h4$YT{tm(COR3%< z$RO*2yLq!ie^{vQ_=^7CPG3c67jLZr_)ppLB>oD?;{P1zo$I4L&hSN(Q9e54 z(T1Bon#X=TNLz2Z;P({nz~2`Aca9z~DnieTQ+fdvG8zChmv`?zphe(f`5P9~`RsIX z7a`|3{%%e`M%RP8n9!o1x}puDiC#>IAuQ&jp;b$V;~VD2`wNz_cTy%ps!hXCD7H-#wk|={lwh0K*t!Z z0*d3D*8$NK5U1P+gqaWMF(4760Z7C+XrLoNXR}2QtT}TyMjB9W<}!gY82NxMWHb^8 zU!H>JtAP44ngw(*qeZ0SxQ_yfXf+1f22{ejZ-K7iXukn1X09!k0qR?51t9zhF3_1k zWsE#P%Ncoru46O|NJLu#B%-Y{&>cX#SQiGG%hBEddW|{yz4NyieE~#Q#c|3HKyNUL z#b$3mqf>$CRzaN79Y{pW0TR(B7^oQNG%oo)Kq;c`f!vIq2Rfb6zkqr&st2N(GER9L z=qyGb0f`u=Vh1f^oNk~CfNo{oB%s?F%?8@QXerQLj8+2O!>AIdn$dco`xre6Bx1Y` zBx2CFlm+?@XfT)etOVRBVAKaFkI^8Yv5ZCnO=C0xD4)?(paMp7fkce;K*ICm26_Q# z9p~~s&@675?|{ZJO2BF*kQ+$c(z+DrDn1(m68@$FJ;Yw-08QkxHv^4l^bnBn@`8bO z0gd6a9|O@Cj#KD6%vUfvVdzqD1utwpKq3RWsuvkdGq@WJ?sg!N)gwT{_GJUT0wm(T z2PE?Q8fYVD{}YhNz9XiO0?y@pAYswpKz<-Gd(Q5v)U1d?YPdZmNbomjMsj>zg(=FWDv zQ{1HqO5(V9rENb96db+zS$ z)NFA)`ceXFmP#qU<4UhR@esCd15pWt7m8JcbwWR!;%(7Nj~B$EL(h=15f&6vAgWp6 zoBY1mg72{A8%8*Ezf`lrn;b#-C7=Il!S62i8-uT2w0pjdhkW;3LEO30#OYMYf=ruLqDA2>=SV=Xs2B8Q#&Q~ z5Jvz01kO&kq#6{Kax`H{s=rYMX@^scMiGPN9mG%&!S2`= zGrk!?_$8lDwct0C{l?&uGj5uQukV)V-5jHo0#P}#A}sm|Lw=^~Kv6FOk;P>Z7Sj}Wum{25b*>e>k(|-9XrhAnA4PYP1vb<#7?aQ zXXQ4%6pVh*UqcFC0+Fu}`#Sr)cKBamIw_~`?5rdd)4C*n=-qC*K9aHzd|fsNV>+96|UcpTk@5 zJI(M*(e+x4=2z4O`J`(e{cy^67W<`daafOY;%ACv+>m;Ly&| zlV15p+UJ!^HZMA`s^I(Oc~3nt-aCKa-zTh}_voy^#>R(M{?NJd;~O8D$Gp)e17kY%%jgFjcZepxqa)$PmDcx-Po;D z9)J1C&Ab2o=+!0b#&#+gv-13PA1(as{@=gbSX(#c@|R+6{GobI&#Rxf=-r-~Cyvj# zWb1v8bUZM%x9FoO!O*y|X_(T5o33r6XtRMHr1F_+QkKKDbX;@tBH$#h$ z{rtn}IbW-#Z%lsv=lh2oRF+?tyE=aI)VQp>bIv>KbzhG&Qfk^(_b$p=a@W46o;v4~ zs}kDOEbKe5y1e%1zZ~2)ygE3~w=bu!XWVDiO))24KdZK5%8~aQyt#q++wNIZ+u@Ea zIS-cK@Y{up23>smf`i}hSpD67zf62!LetR~m;Sx$zN3SW^+>*c-kEJXywUFK{7?TF zpT8jOA1AIn=c1Q(?*IG#%+-JE|NZ(8&OD{vU(P)Jy4^2d`QGGFZ4W(saLSl(+MG_8;tY6aU%zif?3f;J)p;zh?Z96{y(~g`wuHSyyu_?-}kM4B^`z^hue%CSo+J$UUKFULQdaU$!gNq_v- zY1PY@y!=czU+R!$Z#=efPf^)_`pu|w{obIAxpv|UcYe0`OJ!I|`-#3S&klV2ihC22 z;~vY}*Z!A+P0y_QI`fCpXM0ZC_4wU|UFq(KIDFF=%q!_LyZC{MxR{eCX_oTMoH4bu zkH=FL6H~4+OBT%SGp`uu=-2#7)2DdhjOnFIW{?k>GGk-tzMg#aDV{NH@ztqgiKU?# z8?#jw;9Z}E#ZybC3Yxsf#sqH@zg*@zloT@MH2Uda4I|nG1tsP}yepHKEWFz!F{AOW zQDP?J9XL-*SoCFTh* z3AhR|{cHx~lNkEmu&;wva{vt8molyBjyl~LGMO0EM1#b10z;c;QxjXPdXsqwOs%AO5=@q)*$gHmF>in=mzWR0te2Q0 zVCp627cfl{Lwjr&E~L$T&IC-87`j)IFEO-hDv_A+V5%i%2AEojSq$c|#H;~BKdeVD z^uQ-D^n#&jGEV@eNX%w1L5bN7rbuGm15+k3UxL{rF~5KbOH4d^WuwG&1C!9zn$P)Q z+!8YoOqRsZ*YIXZ%tSEd5;Gf2SYnoeX_S}>FbUnP(eDG}mYAo&6iLiK!IVkN9x$6E z<^wQci8%tMSz_oD6IY5g`Y9NZA&EHy%q)qy2+VqkxfD!|#N>f#keDJcuI|=Y*Mjj$ z%t|o%5_1=r5{daMm>P-M45mq9>cJe7nD@cB@S!C-1V8Y37#N?#{062-Vot$5jcSQG z6HKkdTny&0#Q4C_5967!=(8Q4#9R#~Ut-F@td*DwFx3)sKbWw@)PSMejApDlFdm87 z2PP;npMfco7`jzeB{2%_TU4E8_1qOqgT$Oq_cq*C&81*`5;F=+iNw$+PW70l%$(_4 zUR9Fj1~6q1m>Rm5(jaN>14B0@OwC`xxFzNVFg}Ud38qA14uGkVm@mLINX#!_=%$Yu zD;^gwZizVqOp(M~1g2bKE(22|F{8jVNK7#p*E!Z$i^2FLW(}AkiMa<%xy1YxOpU~B z1=B1sd%?I;t+5V*@kz|LV2UIr7JI{LiRla`EHSBInkA+m7}vShSR=rMBxW+0a*4SH zOtr*Z4<;-zw}EMvn2lgO=UHPt4<;lr^h+4!67x2gYKi#@Oq0YM2SYzy8H*Qs;J0LP ztI;DdJ-~z{hCcnPk{Caju*6&erb%L^f>F|}u@-{yNX%L=B@(k9OqIm^4NO>K{sE>* zV%`MfzQ7ubelIyBG4#91B@z>ZomZ8_bOX~MF==4v<2AF!27z%)%m^?ciJ1(hL}IQ5 zQzJ1e!8AzBU0~>^b=i0br^mCJ#)5#7qIxEHMkfxGu8BDhK0}n7@E2mzYgpswL(hU>YRmH89N*^9dMF zA8V{{iOH}sC%_a*OwuVRm&BY0ra@vd!8A+EP%!RHtLI5z*2YTC7<3K*ZnyalF6Vm<*=E-^oXsgaoW*abIBOm{FY+^jTv zW^XV)iMa$!k;Gg9rdndAf(c8^LNLt|vl5J}zctoAvH!$TA6OUV_^%Bz!OtZxF0pq#c z8tXDJA&D6QX1&Br0uz>)Yr!Z!tDl>|xFu#Cm{}6@FqkTdc^OQD#OwysEHV4RWcjVJ zJ_l1IF~5VUmY7pIA!mu{4#qXa>c;~nBr$$4B@#0ROqImU2Gbxh*MVu4m|MYQ4YkI4 z08Ej@JP)Q?Vs?NDOU&C~60)s+4uSDV%x_>yB&K6Ba+a8$U>YUnA}~t8>Ny*XPhvvE z1g#qS{roD4Sqi2>Vk*EiOU!-bC&%ii228ocYzI>0+Kfi$qNzAF8 zQ5zC-Hkc}j$pF(NF+niykyg)>!1yGl1Wb{{(69Q}NX%crG)v6i!MJj*p6Qp2JQ8yN zOo_yN4W`y$=9SDYTrhuzk|15@DqYZ~h6b&vbOh5ZF}=XJ@~qMOfbmF708EL*i~+M& zVrGGaArF}=Z*NQ@s$jl@g@(;zWdgK3tSrC_o`*68$IxO|Cu5KM{0ya=X7Vs?V5mzV=! z4ol3}VCaYBWAQ={{Dv-=pv1VkVy2ZCx~o(!F$2MbB_64M06HP#yIC>W2#w8LGcGKuL5rb=Qi0@ENdmx4Jg zF=N3bjI+j?4#q7p%fR>~rUJ}biMbCKBrz+&luOKg zV8RmfB$!5tsRKj*m4n%)Z-EI)%%@^2t zF_XZ|l9+42luOJ?Fx3)sADAYIc@oSqiKzqQo@|Z&Ix$nM%tv78_vpN<2c|?~W`L=cn1x^(C1y34gxOZlcYsNgm`A}B zNz992Hc1TKC9Rj31~7*u<})xUbF8uc1I8yYakwYCR${t=sg;=X!8A(DU@(UzCKpV? zHP%>D!1yF)0hqNCvl7fEiMbO@y~Jz+b4+6Bn?>%q)>yBCnI$prgIOyv--D@@n3G@{ zCFZm_Vr~SJHQyTRE-;cfiz2%n>k$CFXZ92@9>Blg~maB<372 zMH15w%qEEmfT@?5$zYC2%v><;Mb=n1f|(^TcY#?iF^_?%m6(^nG)l}KFs@Ro=MTZ; zOU$=m$|NS%jZ#QV7cdPHb1s;a#a7P)z+_2GE|^&oa}}7i60-> zxxwn$1tusl^x4iVi5UoHy~GR$6PB2KFbOwWJud*0B{3_&a<~uMY5_1wvt;8gqgRvtq=YdIBVf8!!Oq#^xfhm%hDPT59%zQBQ z60;o4VTrj1jJw<#>#tyDNzBV&)=JFlU}`1iAecsp`4-GEiHS=^U%km1>ohQB5_2w? z^%64}OufY9f@zkRtH5Nfw0fQgCSPJ!gIOyvcZ1m^F;9VMl9;Vv(pFhL?*$W-m=D3s zl9>O1sg{_yb5ZjW(*;bzYOCjTFj*2a7)-vzw1E%#xVv!K{^-JHgaS%%fnMB<4jhX=|;X_khWlm=D2}NzAuk)=Ny>`B<$a#zl;3 z^?Wv%l-qQsPw9-Z($sm_A<=gj!NwG|5&u8tr9XZCsQ9})tEMe$=(}o=DSbwLb*lLL zKC7l3YkK3EG_#jK@Oq>so;CEBN2D3@+wNZ@H3_WghiB6Go=ZMGQq!I_HF&1XPW$Du zP^2c2HT1nD^5bqd^`b~k2iE90_xkzqTOu_bSwr9GAV0Y;UGP+-<`mY@U%pe+{f{)> z9;rcN%mO$2j81Vf)=%bp*NVE!4wycxlK7Qy@y!E{Ko$2u#5=^Mcek6@-m zFpD+DrReo@TZHBjjcE%FIx3E5G$!6){;4sE22-yw9S!CkjXBj|KGm4^2J^kfoMJG) zYYe`tszvW`fvAlHgXy6$9Sr6IjY%??AsQ2BFk>_ZV?pa1(bu*(w%X}~O+ zfnBi4q~?yw%o>Dm!=v|cKUBcbP*rm9AO_#C%N^C9n8X+hGk};qR%ReEw_!*bR$0X4 zp~?*gk?_AXVS+N43=f!3Bqjq4eM8aIWP-T`(~-&a1(O?ZWhm)R308)Zepg~B=?~jm zG<`G3H4fpqPnr2w%ALT*#&qGc_&>GI=)TOwXc3q2({nGOb?MtXLz(I*qM*(lZ|a znm#PwwE9G|VvQ85s}$?{N%4O-t$xw0SR=*i##U6f6l>w#pS)#SokEi|4%SGqaG_)= z*MZ?9J~yq-(X3b_#p-TYk=K(G4?m9Yg%ZRuNV8&%6srf$nsxZ}+`%`RR--g4)=06i zfWb0SsGp*?FdgyTD zfo~I7#@E@zaBTo6JMKAoF}~AI5XTpq6>Fqey>QlSugtmkK4)6}rdhE@iggZK(L_xB z@XfQm%T24KbWk{0BgIMuYsUKN9Df_r>Rio=HBzi|*-CG(C-?pPRny9=S+Pcng)N{Z zR?Wbht~9N#(5zS^#iE5aHb!r+k8Z9@Fs-iEtXLz(;(9RpVM4Fc?xxj^nw6+4YkSck zkBz}}%Evh`d~;eyqrL9ZtXLz(q9!rxFnz|@f0|aCG%MCf<)Ra@F>ZRsW6m?z?l-Nr zYF4a~VqHjjqg)xMtetOK?bEDSBgMid5?1Ligk$;>$k_h z*lSvKpl*wUHBu}uSWzx);FSJz$4@-fsEuBl6>FqegW0MhJ>&7vxFH=(tAUyoYou70 zvXwp`Uf^5&tZ6k;vto@D>oO_Uwsqkw(~7S9=wOW$>vFJW9WLB<+ViH>Qq77rQY;@^ z>E#-uCQUG{Dm5$CNU{8EMg5TK@UthEXS6r!@KMc*HBzi0Y^BF~%l~bGX;rIPu||qD zl&$nS{AKE83r(xNniXrLSlLpn2QTZ0pHI^J{HK}~You5Kw$j&>OP|{ExoLGwvto@D zYnT-4$~j7*X>}@1gg96u#TpJ)jAg3BzMtdU}kWGlT6AHHGj1E$q7&5AWr ztXwHp=&rQxrq%756>Fqed2FSx%NZ-y4s2)C;p3VWYou7Cq*!$AU|Ma}tXLz(8XXY} zzm@}zj(wUHYou5qoHgg(TdukVy9nLtE6s{EQmiZ3%33b`mJ9{LaZ^20MiNk*&-H7nLgvBt5L-VgsiVbV3GRi0+W8Y$Lzw$kT~ zC;xKnoj4=bJk5$VQmhG5tfz<7pJ`gH(X3b_#hS=g`rf9rej~m(r`O>I&5AWrtb8ff z!BYp1Gp%0ItXLz(x{|H*@%3Zd75ECA9_tOwiZxQKNm8u-yWUu5T79Wmu||qDnXUBk zm2v1A{CuDuOYz_&4%SGq3c#9u9KrIKm3Ggm8n^=Mv65> zign?H&nBBzBQ-15K!=~`(HO#Q=t(J&80)vE3vpJgaikkvneeu5qbMsiE7G)4`b?j7 z&7uMQNTw9w5lcUTZ9D!3i$yc0m-NrfSeQ{bt}t^@VZJhL;ndmlOBO7c8|s_YPtbh} zuVkGdN}MG9U`eioWSZUWmCiO+w^x@*Mtwcbx%8I;UA@f7aepb_`F6jK$qbPEjw___ z*1GAN;hfI^DHho|x*uqBPu^_qqu5#NXk1~27EWt2r_yKHLS;H9o@Gls(>ZbK5@y4W zE9~p+ZII2I-eocdWnPm}=+tGnfyuLwOqHVO-ASAi-AQ0{lgJ(lU!s~c%`%%a>&f{} z_Ih&&d$aZRA)xm<^So1Qp^sQ2QESPSr*}-<4e29F!@27UYCLQ8>)q5mFGr;2k@fcT z@_W6a^@8gCRQKP{RwBJ3Oug)nN@$j-e?}%|kP@jxdI@w7dUw?$(txsi5S>F;=sB7m z3F09*AM0*5l7aLb-9~*k_);-ug(s{c_Z9dbJ$j~Pg-G>w5;ANTAoG_Bh znxS_w!>!&2jldBKc|s6vBqmA22~7spZiFzlxbi$8oS5UraHP)zMmBnfHWYdfv=EWi zAm&vmBRxgKPVbr)!d3`p&<( z*R!}1S&NfeFVfyDlN*If9GRS6F~UYPtl?dsfy7DCV398LiZWHUn$!oeE}%Z<ov$uB7|5R~Apdk+l_(wcfXMKgJAfM6wSSo|2tB%jGbpREr~< zg31u-NMC#mJNt0Rh{)Nw|Lav^ab!!tK6__6&p5_XW>iu{O8QtcVmWOTFd^vco8iem zSTgPXIU|ZEec97INi!#$h>{xVICpxZjWYWWFy?iOjpN#2^gOl^TNhz3W_p2b+k;HK z<7sD?IW)Y{u0{s>U=c=Qsu$Q?iVd;zz`+V9c8sQ-t!ngcq6?hIF|U-o>~XQpxm}NM z?Dus)&b>QB?>ZJctygM}joz)jckbNqBbS3O;H(MSJGZfW*AsM}?$O`m3bO^`j;6ba zGG6ql+?2^hbe_pGjIOVhT<^uYn<$+)QYNB_Ye=y>*IiIIjGS^Zj9FTXtam)&!rHIL z6-Mc2`V6f{(z}&#q3?4v|50Y=40)7T<_pcsGO6~X%*5~_SGO_Dg%|4;qP`es=(Db# zJ_e)Q4R~}qRGnTBv?r>Y0%l!I4d;_h{XbF?H&Z zoTpe`(Jdp2>)!O?7+b#LMUjo`L*3AMTF8`XVQAf33r6%r)0JZmG=Z4aA`H?0A}Gc_}dpZbKvp$^Txxn6FY$uf&uJvDuR2(Q-4Gy==>s%a=XwlIvWbG@IN=bfrm zuRmQCrJCh2p{F1h&s+ud;yYW}6O%i;QEGku*E4hK$m0t2#YI=?)v2c-FD`oGcHeSG zw4~rvW%>%EhqPCrUMpq_PF|dsuS|XI(VaWDy}rDdDyIzPrejxmHcJvF_ybTfHn*K;uT z?551>-H_?4iY|+?#`A{|w5pg{L~$nTl!`WpL^1w2_|EQiTDnZ$I_)^!7CD zWdBB3eHdDF)^h0$ZETYbozn_~JoN3WnTM@D^AGF1Z2x(y~(c~`Aord=`ne^e8^@9t|#^Oa> zqG%gv*30`3V_%7DP&kv;M`5d79g5S-B3#?t=_|5ur(N!`tyt^K5)1G8rrMC$$||oP zn$0q?h1P7SHKs3KxMW6V|NhtmmrPw)TDV|lp&VNtDZ-CX=$(_VGTBeRepykx$m2$M zG1qWW=E(hoF%EQrJX}mSqU@&1+Cg-c-uH~O^}(W>(R+I>n~S`ul7s2XyTz?jbh&xO zLLM1RpMUgV`oe8E*Q1#Nr(pVYq^tCm(Bj6~OfH(fGU{&R1xT+~y&4VYdeWwuQ!ssM z(N+3XYjGoILvwg!joB;2w(#gl>iZ@=nz5i5;q*E(6x3fLCPD8s$I zL)b1c^~CkG4EOrFZ8&ls6ZW<)RH6(lpZ430>ekLX4Y{ zrp&2h8}}Lw_r~n1rKwMVx*z8OV%%D^_>rrP21w+VCAfaKd2-%F!Bd1z5Jsxb{Uc&dFouy)&CXLk45f(DoR1G=ocb)^@0&Mm zMsexfMTPY1fwSk&E>*0=%!M;%NW|3(7c7;Cx%4$ms|ns0PP4he`?)jbOR|MCrWQjt zf9k?z62EBH?3ty7a~-&a5;wKDxNz#UMG+i|A#sZqPottmaI@#jY0q0cSJKgnjlwQ2 zkt@ZdrK&OMxeKNiOTnfuSU96_-rT8*bq`>^!J=<@(|>^Z1~ZiT2HnPdgUc854X#1V zH@JSh#ww&8g?ScT2ygYqqI_n~E-Rcr_z0|Kkn;)SzImlaMYqHy|x1=q};p`6^paRjZYGo00ST2os(pC#!GJ8f?cnpEt~ z!JKew$=IT_vswyfz80+|U1seG&_rfWfVqeSEJ{lP7Of?eMQdm63DD$ePk_0I1T0ER z0v4?$ltpW2?Fonp+n$2P+Qpa_Fn`;{8XFWulvxP&sI5TTthTA+c24)Q!G{EB-*w^F;Wq3RT1`Ke!2lda&68fUV;+soj zDju$xGvP-?c_B`G1H$?r+Yv+GHR(s+l(Zg+F8l|0=6`NSr)u$-Zqxbj)92Q&Xpk<1 zZ?v6`?@(St--yJKgojTF`Ruwx@G%mUC)yVJJ5dNcU`o0_v>i15%UeLV?%@O*p8xHzH zoRe-pbRXcGZO_to$8gXOE;#8v1>X(d`8rPD`@%uP+)1|!{?5j?yuPGwU*R|%4<{Y{ zaLmv69@U;%EK{gBPP#(WbNjjY`LKCHM_&hY($RlD-2~0AB|>*v6x}xH_Fk(fw=NdC zXyv7P{&5L@VrH4pMXSFGoSu1|qI{1B9n>G4@=HZI&b}UB!o7iI+#j8EZsd0lG%u|X zx@i6HJ)AyLt|;4Y5;}Ar$GE*wjuX(Ntroh@QFJ##_XRZ5ZxOm^?KT9buU(6I9uGQ@ zu4CL@;NODgKbj83chu1rIRAj=3aUsPNW)Rr9sCSvmTS6b{t}>D3r$rEy7kcA4^8H+ z063zx+gt=HhK7C|j*j+tIJKJ!UGLk_Zj~&H+P=%6Yr78Rxc$#{zv1*7(7akDbTl72 z#q9<@=?6=5c3xV8WGvKo~ayPLwC_VLKV#) zZCwhXxlhwYD@PCL9);##E$BXggWb?<{ELWt8eW{*_ZH|%(W!sCPw2Wt(cK5#j{6m* zV8fs5CgXJKgNm{O4?3ca^WHf3AT+yM(47n2=g=fRMBbwNdjR>RL9^pwp`(3@Q+crj zD(6>Y{l$ZhX!$LLzk90j--~QynG&s^{s7$=Xofx}bf@CQDXt40_)Ta&-XwI?-cGvf zz@PIJ>IM%wqV@aBaqbmp;+|$%)N*`{0``KYV~xvZQ^a22mX#Qwh&>fnkE$FCvZ-VB67s*@na?HfJ zOQCtR1>Hr^ZHDHMri+%}V(7kuX8KD2IHI-NS#Y32^W@7y7pWa{a`Fk4}hkk1ziL3djguJTZF%^cya147lR-BPkgl<4?2wgV)-dC;%ObY zSJTjYI(#nd$N9=vyr*ZDNks+0cbr@JIR0Z>7H_(5-BRzv@={+XUTw*7?uBNfU1#%0?Hh)s!LD=g_Z>99+I0^8Qnq33 z!h?=KEAKF9#@KZ>f7D+}Gz~k%Q?&kE2Holw{PDPKrN3vO+tPwR%CE7N{+gisrWO7Y z|E-r)yhbZ;GIVEZTBDwA^+)9$+)95z=*G3+kNV5PR{C2B-MSY1x#92WR{GluU1JOW zdcxn)R{Bd0qyF%qBU=4Y`wkA1!aSn2M|K$VA0Bl4nZNmAmKaab{4IfQrKXMMkLH(Z zXkN7I9LDcHXg;#*Z2g7W_jhPI)&bx!;yU>24b1?%&gPHmZ=9xKhj@xs-U8@mwcwB1 z_hx7|YPy&|@%J<|wVKW-hb=$y_bxO)YPy&|@%KA43ELsS5zQa9$9d3PV%Is;Up_R& zcAYIhYLAuB+-cW2_^W|tt6gXFNBJGlG=O|WYme`s`?VGRQg+}v84o&)dU42a1T+)u zI$M5J-co2*+jS29HbV1^U1#%0^WR=gL;2AWt-OuU9csZJ_2)J_*^TiO&0ivPT{Ug2 z9@my1t>^uq$+hbo$~y;|C3c<7AJyO8&^%_>Ir!TS%^P-|gTHSyjb7kr<^3JHgja;> z&&qoqG?&?R4*3;8Gs~{Cm2;;g{IN2v-zX^jzZIJHvkT!91i|cq4C&t z4*o`I8sRbec$)&AXV zKdQfMXvW!f4*nKGv)rz8@V5b)r|miif3HFFu3cyINA>p;GzqU#DJumn0{+@T4yj|zuuK}75?K+!3s=r^MN!%mKYm~#mUm7(1>^cX3 zW1yL4*E#qrhvqiB&gPHW<4H{;GK@YSybRs;7W`3pn_B6w8M@zF@aKlV9(&Qoc+l}@ z^_LG#v0Y~?FXguqnmg?}hx)65W~*Ii^GE&VfTp4R=!n*ze}wKt3;q&d-}7~LV?0Ik zmkOOn(;D?+%a8WYqgv^24s=Ue@JI92-Oy~Z>m2HD7c~3qI$M6!9?hhA0}mWVIUM|* z2~BUi&gPHmFQ{qQA)cbuUkJK_7W`3u*R|5$tUWLvx{BXRAN*Hv*a|cAZ0e+yKp5yUym1>hG`6ylmGw_}dRnlU?WF?*ufbHnd#c z3!%xf>umn0yc3|AW7j$4w-%ba?K%g4&ubcyVf6mD3%Y%+@Yf7Y+*>V|w-+>h>^fV1 zF1X2srogUqDDQR9+-%p`{B?xC$23h#<*k8kYYYCUJq|$gon7aUU&np8Z;J;VM!&b^ zNB#ytGs3QO@HY#ZQoGLPkLvGEXg1n)4*tT>?6vD0{C%xys2p@eo3DO_uHD;06Ro_I zU#g}N%IN<3LFa3QzbUQsHy^s|TJT5f<@#3otATE73;wvjw9?;q(EZv9e<}MhPvSv` zQO^$TI|7;scAZ1}mO``Iu5<9W5t?W0ItPDyHI2wHdi#C|-QgDeb%B$1?_iIG2OWP_ z-YjUc?K)e2wBMKp&2qcWp}ZTQ*<{z*{84_ppgCaIIruvUP29Uw3QIX`{%Cykf+o|h zbMO~}rogVV`J?=<(=-&9j%ed|9d!4%;E(FBww3<&L)X*_eUSS#H-k_}c)@CcDn&kH*I?Xg<|+f7V~Vf#z5X{;2-C9>8@49(4R! zd4tf5v+Hd6k-vq|+-%o5l=m@cYV10jKWdLRp!vwIbMW^&GzlM2DJUAQV?sors2SNiZ&nI3*E*R{89adTj_5^)!GjK?UL5kv zgl2?Y=TP2R(3IMBHh)xqcS5t#u5<7ghGwr_XYm2;mL$lwmv-zX?`w^Np9|Pbp%HiP84b6pi zorAv-&`h%H9Q>6*v)Zn6@V8OZhzz6m=jWl@)`CB3-w&ZVX4g67*R=_IJ3Qzx>ct^H zUlZ0XJm@fV4*uphVQ+^A9fr>4kJ@*A6DiCiTK{{x341#{=!oWzuBYE^B87QG^Y>{J zu9NYgBbq-q&UO3*{QwU-44p%HM?f>du5&1FDKu;CItPD$h30v?&cR;;G>7au2Y+oo z#eE+qBc6lSHySQieBnOk|3%Df9G?4WzH}3x;tAWohjt21X4!QP-$SGOtbtbO zGN8+ArEYmEb6}t1FTh|I*8|Yq)(Bbca zE&nMNWmDY&_o!_;B@x$tZuiC6fnomfx#MzkhFsDMPeb#@^^(cax!I%qd4aLL+;MRA z10H|F;~FKV6JC^|mlTX&G-KhSg4y$DE-1)bylD3Hg1o?(;empYBSRBM737Y}ADcb0 zaNOuIV*;bb70jJIt$+qEzF#|k{*1W=(@RPUrY)X5x40k=KQ=NhcWj^H*$WHC%$Pd^ zU!*O-&pGs2Fl`S0bI-w@lxg_9K+@niMXV05` z-R${SyN52oPkZ3!DJVxJhM$e6wm{vL_EdX(@W)cvb?EP@oGD7VVHJ<}r(52~;(a%Z zS6bG(THd$A`yQ6}!G?!BP1K#m@E^+S?hwzQ&2~m*o9YTyl%}Rk^pEq8 z_fPOo46gddeUimF>Q_0dmbsNY^;l5-F{r+uwE7|RoWA>VDueFB?l~7XE<`@sPE~HzVhPq7V1tGMba8KxlwOO zEy=4K?GCE%p0H563mrsfCL($u2hs-13sp?`}1Dt|%Yjx&+%0v-ZB zpe8)xl+k!@U{q|NWd_3ZuIXrEIEF`@@|3~t0qThgi&JPp6X>LYPRAL+^#eMCbs+;y z18RacPPx`VHv`f4g5#9C{tt8S0Ut&6{SD8O1wsgH=p6zC2t6brlmKQ!0<(}n=qSB+ zh#^Z+P#_7A->{0JQY@fYz=91a0+J9qqBI4>5)df@8kDY>_j~S{xigzx^ymM1pECLE z?03&S<@R#!oeA#uMCdy}tYwcx`4ashkpnG&(-96tPb1lt&Oj_X7>Hw#CQ-ITuS&kH z5*?MH)Lm4i?jp4R0MSXrsoHh)5UM9BEL8Lm_e9CiZ!ROM_C3Z6V#Xa?dXOlY%iR#C zsAEalqfsn+8&S2F!WJW$LRD4{>Yd}coW%h`GC|9yN=$h!T6O>NrU5;S+%E}^O#!N> zZy0I_qGOf(j3hmYHuPG$xu{!e*0uEHB=maYA-6GX9$1z}ok`BRmEJ_v{u=A3lfboK z>OwVB1MVNoR}1sv1MQt$vEQftpcd{`V{fMIOF|7BA9+U2xNl4Ao9r28V|k}zQ=dYo z=))2nn@T5p2H6rK4>{`%Dnv+bm@T2n5rBh^_YXRA&Xr6EI+nP&&tC{}Mjmk1%XKd9 zUKn&r&A4WBZ!!~XCeEqtPSQjc4h~DDiarZdVYKPw^1dWDL zMzpTss`4}t&E4(Fd$=DJXfN(DqWatgVhQTm=zN4-`Hw_N*$GrF`i6z{>4%EJ<43rv zy&JX^oXH+1dMZ?tqpEh;rCk>Vqn$$6(81;D9|)qLWaZ3i=BP6d0+8qeGDZ{*5xgPZ zytB__ok2f^nwjM35=uP|x^LE80L>4LZI@VeZaZBcRYE;9D<{3aP%lO&DMBV3S=1m% zaLyOn_gS|bStCikwmpm@MPrbtuo$6|s0C2pY$hc^M9&<_W<}wxDvmmtkkr%T>4zRl zAL&Gj$`uireTtHF9=S@YX(03@b0bR7?oe(aYHjDnIO@>IVgw;QVS0K{?M;48&~hjv zsX2$8+7F3Yg^sK&P-qDBB!azPgi9Z^nSDG3BBwwF1ESl{Orax-8m$;T_n>UN1zUOv zhS1P2v&NBCP6*Bk8_&8=CTV-T#S4%}6ovpF)l}t+a+REX6Obl2w8}K5JQep5xGF|-3v`o@6MF)o9qWUU``2!Md zF(X=T5*lr&mWO5=PD9hMp+g4cwM3-P;bT{vxc?x~Al%OiG)2;AJmLoX7EnGuc4a&6 zEK4H>qcX^S*3uk^wb1l}X@h}S3q1|ZT9yE@>}NncYJ4lvZHX!sGeTn|>J4O$E-d>L zXtg0_S3ZzvpOiQ+CH|1KDwv_NYzv8sOjXtFIboqblU2{`5H(|VRh0T=3@qquFeoKy zKRdGMT^BA-3Ob@)mYVqrrnqXx4(g>8cV$!$bUT>u@T^Tcb@@Zk$7VbksLU;oHYaCu zjx0*BstuV1ni_CMXjEhK9E)lTdKM`}P~j2L&?k;<*EMi%W2=UAOk9c>Lko8j;~cd6 zeu#%Lb)40d#}a=6)Y2@hv(KoWCqk$f*<;6lY8Uf&nr&myMBS6=c6ShB#xxuqZ&P$C zLO;zl4Z4VXxgxCGNsWbi^t;sJz;1L>)bXN|>SA_MdJuI|x_b0FCO@~}YEVW})Jc7x zNc}GURXWu7z{Cz66?%7LV#oZKQ6-4v+ya1XHhTki9Os9z5SbNW>4Z7|FyFTD>-lH! z)1Y$s3)EC=ZaK1Mk-@*ICEH{zDQhibcSYYCG9zdkO-(O1AeCB?dXgsUNrX9Q$vWV_ zy2SgfF2*4Gujq>AYq; zoUH9HQnqElOBD+x&wm~#h5)+U6(rhm2c z+6#TLBbHiL!MO+{TUe{1LWWvrB#x}%dZ4jVvI-_3OqbBBFt-w}!VRq^shV5T5k!*O z7qE(Ui=%rkEXRMMo6sX;%FI{LgV>B zb1jz_inynuzpyLafN1e$S7?x=9JMQ1xaSM>67F;+$FA(dJzpT~-RlG0Z$LaC(jxk- z2&G|+X;DCr3LEi2=R{~f89D{%tf0}{m?d5U`ccp}1LX_!IS|Vh0`c%x1NHr)2yG6; zvfY8s3fd4!O9kSzEd%1Ty#vIWKLg^l-IBCY=wZ$YEp>rdb1V>RrdN+KZ4?lvEggvC zvQUP;2*eWaN!o58wtEJM({V?l%E%|CMFR1#-&4{i0r7%#v825&X}cutdr7+|X;mBmm!Q`Fd9j!ma&eU2s_U+Cz3I_j8X)1krx z*)NF&m-E;~{8T-w$($OHtKPn@W@m=2!>`25^XV9tqEsw%gZ1^<<<}8_W$3S;MgZvT zQ`HJoq^7jipbM)+ zNUEd(q0E>-T}5V?NIe4EN;CKo5x00Uj4#IIQN$e9q6*d6DD79(k@ySw1e}SPh3V0- zd>fM@)l;*jnsp|}+#2hBQPBK(gH+nnS$H|_J+#M^B z04KWmjNK{HF*S5Z9{HE`_9{_vlsm1)?Mf3MUe8mn#3)vxCxIH_V^^->PP}%d7Agv_ z*c(dJQX(hNKB2jfq>+n=CB{e;CmV$7c{i+TA^dCeuU>)yRYU8+SJZAbJ1d8fCPv0& z?TD&ZUu;wbT9cC_Ohv`c zr*HUT;*zqrhn>O?y#^+QrARbfqEsCv&ojVM1FR9iu_>YT2g%xQRKp!{q*^-(56zck z+Gxx?RBK2Pm1VUgEh(&RGObW8t2oruDb$w6V>*-+mdZ|IC{PP6v&`&a) zHRBGa+#qpM6DJx&Q9H$9$GuWyfu5BAVbaN?K^d5J#$6A|M=4lLAwdqy&nv}f?A3E$ z^N8Y&`kd|0-%Z7@J5*6`X(#0a^jdZ$6{s=7?8>u1Tt{jAW%Q;*)IyoIRia%IkxP|B zY1$Jm^o8I~lP9|pi90(;X(Z;*SwIa$s0Vkh!Q=vA^r}SUNM+haiFQb|SE3(*>f>Wq ze#5=4Kr};bEs(WEOb$DX=5Pn`v^Iyt+p3oMWD>1K-7`hWso9CkUE1AbEk8;7&8HZX z7wM$r)dtvXfPDtwbsQ$t7ny=up?g*7y`CsLYApp66OXQjEAj`3G=)+H6Ov-SRUg9_ zRzXHpGUi~|4)Ex)0SODrG)N0SrnTBSvIc=nj@<2Gq|#+wI%1KGK#;h0&SvC*$GKNY1*`(z%z)Qr70M<&&)u}jegUE1du zZ$xTQ({qG45}@6Y8Q>6WFa%<=sNW*51h{9bp2W?`+(Shqp@AZ%iK|`u0EReFqvggb z^|=#R7m{VoDR*=KCMu&*JFr0ZTpF~3?8YfYzM6)GYAkiB@NAO`M6(hPc`cWcsTpbsDRZx8x z(KyEKwJi{jjXim}L=#C-?NGei6JclO0bYh03c4xTEPcEqJ!!Un6T zOEmPogJ^s0r8%-_%AjUE-c}L&C}Q^_N!!SNM>xbVg6Q6A{1~o!9#_*JQ8OM=+;xaG zTuhwyB$4OLrJXRQH0bhM3!UjLh&Mf)=1WUqNFSUrNJ9qVEF;849BC;wTw7uLjRL==_ zSyDY5^P~tTT%>uZ?*$a0fg&8M;J~N@!lU5nS0G5-Ep$U}W9m^rp28Ftx;d!izKFvc zAY9G(j8dw&t74TNScK{F7KDs-W;|I{nOi}`h{dUFDj@PwpQ`nkr3M^OV{;vgsQ#+j zLefg%x(o2pvCei~tIlmXcBz-1^xA&RqCDaS`<&xg3?ou{tkGvSA-9W9JRtx#ofjv& z={h5l?9~zZfb5~Hvt&^{FnDJHdO<7GXjl$H%U8#GU)i6rk#& zj;8|g>iu~j(rQ=U$30)59Nc;Jej6wsAG;C^xpM;1Y=?WijzDJxjV9Ghqpf3Jy-x>X z8!Ld=#)m+xZx0aLxFc!Q3+gt2bQ?ft*@mPI1!5cIh2S+dZ5T6p8Hju7_kg$;6kCC4 z)BTKAjd?SAw%?MpyRM8o#imzKweliw(WKjA=`#e4`qL1Yr46=O#xR(q<%3RuaF6~c8ojBAzcAjHthV6hWHuo>8R+;7k8N0BDm#%M3 zb1!hZB*s75=Rk9v6BZ)2eS2v3TbLIWxH57=4PDIr4!B(zJE?VJ!vLL5AWf-sbJ#F2 zUBN{*45mQP;B#p`Wp~k!6l#k|A%gXmGD|puBjx^~)vKId!^bKzsSCS;QKbe)HBK=i*d zfcoEBB&!Xh9_WXZX3ivZ40gy}izMt@Q;H_CLa8%E%buI0xvvJ~F+#DX~|L^he+ zVyncz0QPf{qb4i&!LzYCPSR-K@fLSSB0DbFDN8V0E$FG)k&idf5m9YJCRwtxBV=U; z>9x(WfpK{~YR%Y;CyebWV;jSfRfuJn$Q?{xt=m%<1zoRgU+8%=7Mm~n_LQN)sALvn z$dQi3IOil+9D{WhwgR|*c{A(v%V6XEdOCE*xp1XCW)qgA_C^R6OPFRSUh1Yr7a(iU zIeV#eWHqPg7ioPKmIvp@uW(Nqoxip9odjLBzW)pPF&OrZK`Ie7->ddhH7Ad)OtIf4 zBIYO={+h@=v^`lJt*JgM8fDQYg54)H5$rz2@%aL7g#X*y$HNp$z2G@3MDZ6b`bdiN z-xU3Z2Q`Ho=-T}i{kNd|6#b9tMlZajmx`-e28sMe+Tc z40!KB8Spy-{PhKA1ieUKfUWBPt}nm@%})mCTh;$%f8ZWYV~*3Yc|dt1@xixbpWu$~ zrUl;;p=w5Mh)HikbTK~zo!1C7`nb!}*{w3J!Y?k*y<1o)_F1X=V@@DsY2FsWTj|CS zNu!&Kj#puRfLR1)2s$Sw9Oewqn4vU4hOrMQ9%wHABbrafX<1~`9M4;dlBfYpuHz)c|bfT`xS_1ndIkXYwJ-5WPYCvqQ6A;@N0mL?D1F?;zKx|{1qAfEp}1H|+H*CpBpv`SiJ_|Y z4Ho=K9#|OXLsnxpoQf!?RbyP zcpQ@>aVo<&>`kXK7@Mp18M*_NeALFeRXc>~5goh3n9y0D9vM35I7Sh3V8ocvS)AUX zGmQqTJk#h;0*+TJFCE{R6q;4&uEgCT_i_4$96a$jrzSFDFzugAhUXDInu;}1sB>r@ zJ;TG@Kvy8H2or%QFYU?#-17x`3U|G-N!n>3y|Mx66#?Cf-e`cBMy?yK2pxd9(37-p zUD<=+$})FL=U=7PYxRR?hV2K%F(60H#vV$Nb{5+p*Lg29G3uIAD@@LwwAh6mN9|{) zr$=Gjv5UgpNyYATlw$uxT~&rR?-1B?ZhL4?j3 zp!&&k2DI`aC%>vK35&othLI%4`*6zLqy=M~Sj@Z${j?O@OB<@%ey6tYSU&b;RZj<( zntRcX!@+9SF?SF3=;b6&v55i5>1gi?%sB_5wh$dN@SOpMs#7_uw&mSe$CIFhN3VE6JQwyNUV-<#2bCUoXe zRL7=W#c+BwI8Mzyix?m7mc3;6Ql!gOm=o9jWLm!Jc~1ELjIoeyodSomec_BLOHp#S zo!VctN7}QeCv1i*_dJsLlS{i{46P_(weU;qh(;u9pOdfNWACJTD#9QZJaCw&r~zWn zHq^|MIVvjs9*THkvBHG*g=s5k&EGc8u?b85LfeeG@ViHBMS7K`-Lf;UQhe3ITvy>9 zH6tfNjr}t1GVROxiMhL8TWoL5sHtY`2{q!!^#T;^+WtyIKV`72O@CXjXil(1)Me>F z$KDw2J*o3|Q>C|V<9ct0@g(6f@D!acJR@n;{g4)R4l&v#X=H|JwB5_7heWAByd6dp zTk`AKl@7&>?XVYsn6?p!JL&xr9h2x=i7rb-r!q~aH69j9r-y~+gjMASg@o4@T@jkf zX|$&T7ah3drvT_AEcv;q>-!X16bhH6&WjszOkzP9NwZ=m9`XnM8dq2*-bzj^4#m|IfC_qrH^oAm8A&(t+!gZYW;hw3(0$9=reQ0vFHK<%xo~c z)l=D9-Tc4uRXZQxt8VBdT=f<$5Asx#o5+u+nordFb8Y)|RYw_V_v@-gjrQZJmXX_{d|X(V z@yBnDgj2?<1tZ6Jv8KWF08fNC;b5g10{1;#fUe+US4QB@bA^RK)c)+s8r<^*dJlJ= zE9?T|UgQ677xhOdR<=e<8n))oMcoM1pJyQ*fzFEfrAQh*sKGN6TIO(yRseB|J_KSL z2Y}edZAlB33lut(tJ{zZloUxD3dA;2fodYQb|qV)=YTkesLQiFQb}DU&vwyCUKX7s zo{d5;34gfg@XTH^(dZ?Oho^Y(y$@5g`-~~DmrKEs^&>)x9!$2dT;7CiV*j9+0vo>zu`uJc7)H0)iTwj;qX;q# z&k8rrnHS;4gviRr&cfn|fYB@{^#33;-e z1_^OCn~wCF{!wH5YKcfPryLw+uh1o2?-le|kaNtBRWT~G>k>};S9FR&a{tS7_U;m# zd{Hu@P|(OlV@FG;6@b1CmBP%kRg=O(jkZQ!Wtzbo6%v~~Sat3d zJdWq{L>`MpU*))Z-_dE2P#oL9q>uU0W=Wag5(koLMTXHub9a%5HYZjE zqMB-_cLnHA)=dR6qs}KzX>k;2T}UAjFwYOsMV`UT`zL(vI*(jMa-8$dKa`kxApK#) z&)NQ4L^00s+#aku;%L#498dsBJaEJd4;lm4!XiB#LUdZ1U=<<~LSc&#MvpJe!}niM z_e0wHE10W4hGuD`mvT+tRMYxmuV3V9#xCUEKF!#!LA?)k=3Fb87?qQC4SA0T_`XbV zB<>O!$$5Lq)QAmQ=J9L=z5p{||Ua?u>3L!B6)jaoVTJLnJG~=5X-&vS=i_Zv&&N5?Dg1%g0H|3>2A-9!7G!bImgShdSdjUF2i}~*^l^r&E#apYvJSXg z({ttF`We?R$?q7dPfkod?gS};0ec}fZ~(6@*oSE{D9An>Kh>3qQ|VHfNC)C` z#*J406~#PGkkG@|6ZvW61qkKnydOA*>m2FD^*uF1hyov+b1KdyQYLG8`ujMNJTI|p zRU3o{W+uhCv>)XlpVtl1<~lQ8qJZjxx9MBf1M4vm8XrP^+OHJfDGFC?0Hsg|ZLK7A5XpRe?8@V~pA_f?-17yZlyWoK3PjzhUCfNR(*KIz zJYz12YQwbZK>30%5-3`r4l=YWP-{W!C213Z&I{TTl19^8ZaV9M@a*^4whVyf5LeEpdJ;uRq`yP!)8e4e)=KQr^fFosjv3~JVDsmCRE~JNRuDqj}GGZ0?MXxbkfBY5O6*R(A%VF)|Ky5^h z=y4j`PPM0(rkG$NUoEx4v+ty#x_=ZS*;xQxQyI;gdTFj zP`E4yN{pI}OpM3QO?oWolwrmS5p*>1W%)$1WO!xJ3Ycc}3+`e@N-+g(%L!}<7Vg74 z0dYa}muR9yPe>Hkryn1r$7BKzm}y5{blTLIQ#rC8LMDj=?$nKrS3TQuAWEHLsw1;J zhfy#4r6cP-1W=X?$JUjqeLRo&=s{J>e<(8SN?We=` zSWP09SL!BtI*+GAvzRCx7FvY;j61(=RWKSj68B?T(T1LCY;Ktxh{7VN@FY)nY{%je z%gN*;;T+TUUn#zo1|#Y^Q)#Mb_>~6Z?IcwZ6)v4efqurvu6S_&UZ7WT|4JYlof#dJ zh!*8cD}!8TuM~~RG#|7pD8&Kd#4rt@G=au@rNpseo<tdS{kM=_; z6YucDBgkAmWxx%6A#3S(&TCd_LfDfYPTSYx7W z(M(<1DSoKhkx8q1ULs|WM~BEBucYi*VAw96l67Q#2m@+%Y6#w>qiP?{!!J?Fsa5}< zE#X;L@Xiw|Vfg<=Bp=v76RD7^>l47q^bpS+tj9BUtKwC4mV!>k%Nw9BJc-Krgx+eo zoUiQBayxqVl@~FiTK1r>fpQRU;=Or&yj=p87`dqHyk9FZwLi4$k;}a zRMMxY8QbU}v64OtPs6tpct#Rcun0UDk0Qlt@nd3D18$NDefP+Cwo`6#sD=B)!HQU+ zAr1K}M4?92G?Eu)Kg}UcdI3}MP-PDtB%J3wiE9o9Mx7+;Dp86=4@)#sqE{t)TcVF8 zqN3P`55K2zzd*V>80Q*{xmwh%>{iHQJ(oN^jm++8WOmQCdQSFK4Zu&MA-BgfMYz|p zXU>jVe5^G}!X-!SooTfp|;6 zE;={GXYi=ovyN;ojBI^rqB1`RGOFj9BlLw=2JjS8uv5Bu4ncElr)V<9bCjw_BS9{b z`FSM$_b+pxidYt0xA3vk`;zsF*i<4~5pm_D9A%{0@n^6MRHI}z#LKfgXk3tl#iB7YXxnb zX(S&`@+CxfmnSk@#HX_4(VK{TPcVuO>riZGU#ImdTsf!kMhB5Vn%>G@xv!W2nEISM#*o7l%S9AoIn0M`4yITw8K(^`r+46ew^|VXw{dj% z+*}Lbji=ZvrnxxfXPo2ty&^X$j_wZFv%?-Ge0qkRD~;$G-FYx>KBJpQODR13kD@l) z2g-%?an&QAljVR&Dk@&eusm9CaRrM2%E!m9Pz7V3S%0A8f;Lqma$Ga*d7ylJ?8@u7 zv&2>)s_u4iXLM20{s77sp>&{!CF%n)UyMX9iG~2NL^=>VD>R^^LJPgXfva&25I07w zB=onC&cDiCsp!H~dP7NO*c!;`bI`jq*9?K2n2T-E>4mZ;y>iGi2LL6ieZ z?%l8tkOEmUaT5Jc>J`;ya*>G&MayAY)>8$u^n>mss(ln7wo$z+&HvSUMX{&M_;2bL z-rzlSP+moFa|Ig(#Fc4^L^CCtFOeqE3W?s3Xb%uqu(J}`k)K?_=;RAmFuHTap*;jf zZ6%_`EYs*T3?tguWHd^mOd!j-T7BwC&JIxt(CH2u4v7(R3-S$aKl~^;X7=h!ao+(u_hSDmwMC=phu_zbq~(a00GK_kBkML|Kobv<=gy2yrQEe>X-b1X7LwMM%KE!5vx8khIV6?--9aq=mOEqgO!?vXSf z@tzI2d*Jww!#VG+ou(LeH&TdK!Ci948u9_yiqunbrK!{7{Hud)W^Gt-S94~ZwekD< z<-4n{l#&~BRB7TYCz-G!GvBZ{IFFWKC-Jc>Q*r-Bp!v9SEm#G_>)nrlj*C!QC*Ko@ zb`@yJWmjqdacFl*qsbuA<^Q2DmSC7y(rZ9?Dvg#9O0Qi*7D-<@UI~KtubKJ7?t8J? z6icS6ut}o?-j^m(2Oy3?0wzh=kv9I*ML1sRhcoMVPt#7STh5F-wi)G&rN4MFGu&c% zR6|o}QAoY#Kw1>D_fFItSH@hbd}C1g=r!y#9fpt3k(m#hTn)oq*(Fd~js-MtK~2Q? zY`lw}PX0KuJ`t=?*uHCuP9;tUXQ$3w+x_lUg>gMfO z8uqs#-iu2>QlwnFqwT{6uOcP{;?%MDhYQFn@-&8`{mUHefk<&hqJEer-gadZ?)d`! ziTfFWsHbH_{o@HiQzb19ZeqNcQLHhwpS8Q%QF^JIhWEu@5)q=j{0!VG6$u_3QANRt zUV{p4AUXbr3$L6bQ*5YWvm^;!Mpg?5WfYcjWYH+(%J?%>_d0q$$pHaxY=hqe?p01T z3ivOwL^D?1KcycM6pIb&eoQZwHKe#6LThQmk;2``6;Mc~&?khd4BTR${^b+085Ebc z_li5Cu#7tuk#0->VgauI%Wn~{XGadcoLkz`4|*TA5qp&XlX|o*oz7%4$`)#WGQAVg zHhM4Z6ing>K}S7{g%PZ(k&)>Ykx%4)vkr*iIC`~c{ZW{T(cO#M@&qR5tZESvX zHKk)ya5M(1o-)X0p1bl6l@wz}7Z_1PXa&WGC+7}C9HH7h!tBkGbQ6X}RLpj&_A;$S z1TX&C1}7#q52L_*@v3%e2JVhUY-0bkiP%HG{1wW;92szm0a@2?mYFE*;bWlehyKs< zK%gV*c`~Ubs^XAKQufBMOH`InI}@km2PS!1BOJdExLeRcU3jFDg$6#RgLPOObk5T| z2c*JDQlyVmMAJ;GrS!)LS*-8ENu~Z`xqkD6CQGDfF+p*l#{os3fY)dW6(uMl!lgsG zNnMqMc10wG_g(0 z|CdQQGrK%Am&Nf^OTCk7|2|4!K+g&E1kiGU zXok2-Ali9*Ss#Ie01i6X&Zp@1&!P?KL~Ubh#fwE0@2wLyHXc@ z1Ru#73q;E)Jcr6mw+=?KK> zoesp-=&jf93O-Hp(PKTgMC@MyVjJru`bZ*r-vNix+p!rPmWW<6!?d4)-WN9Ll{6d| zvGftkKdqQ}F6bL{A1U67zQQ=%BMY(~AbS~wTNFipX@VFx1jA4n#IYC|oGIav* zsm#$`U2t&FyO#7^HqNKzkF%H+*wd%Il(_8XeTYcFW*CjRE_7PjC1^W zgb?TWo9i#rkp*e|9|wy`WSe|(06ha`l)2@_0rYg0w*(5>%8TcvaG3v5M8r5So@hPH zpYpE`^ZQtHWYJr^_%OeAJFD7~YeeW}Q2aEQ8DDyvw{Lv$)>E3&`#Z}| zGqAraqYqGZ{61+hSv=-hw45A^`U<-KB%4t}cpD)~s42aW(aiM!t>r_rcv(K-)*_`W z>R2QvQFk&SK=T9d67id#Sd83qPsiSCAU6W-E9VwuBlisA$&&tZz7)a5M{7VQjt!ZP zX5maOQq$^~+2f4emySg^hC@v6xtj75QMy8LI&nB1_7!Wv!8mG##W3wMh$m2oik$`? z9%$o?Q9mFaf<^&dz{jpE#GT@3S6;zAU!V_h=Rt;em_~!vIehF&Ii!^b85%;)3R*`= zBR?D;<(~-jlL%c1lrPXqAl5>A35@mvvA#1vX9eFiNh^uwz%ix&D#S6RSMIPrdZ87^ zbfKiJ1Ue_Q(6gwlndZc-`8!Gb6^LW{7tlE&5rQsDPa6{>^nf_PKkAh|nP)XVWypAzoy0P!46~jYY@HVJ6H9M$7fcuhTb19c6EJQf)s z&aT?QmKKKB>Ux}b#s86+)m)x}nEM+G)#RZmwG3Fh{q<-%wX z{?p;&l4>Cik{IVFyicpdzz!{wq-V|8xn;*HzkG)e*%gS<_U@KvF`Z2>DYhumOR1jq zIS{`Rs@XE`lybxG^;c*b*1dvitm6?8yjkN(tokeAOI6a#!bK;BTwdqvPC0*17-ifk z(Wn@){(Cb2%xy z*w~D%2Z#(4|X~FNSm3*G2!-Lk)!jn#Tcf=uIJoLbCNJggU4?d0&!?E}uX~qo5|67*u z55~lUk3NsT)%TNmzE8d3MKi`z)f6wPqI#5SA?4hwcLw5KoiZ;UA9j6nul}~A?EvD8 zr^OX#{Les~@qb7fIgz+m7gK%mLK-KHxN^|bre@9X^Jrfa<2el92mAiHe$XucJACZo zzf}Ky{eW}Zh};7ziI_~Z`fp1M{Wz5tjx`{ok=tICmd7LVP3DW}b;q6aQ#=YS-Xbji z7msLl*o8%_gbujY;40jTOckYs$u}<#5^kyU4 zb;bRVKq|bu*(o8}YG5C-GG5IdUlk)7PMltfx|WnZ{uGV{z`=|&sW^U}DW1C$FDy>h z?q)ZK21UEi-+WKjIBM*Isg0;6Y5Hb4k1Di>5JCR{8sB)YIwn+Km>oPzQH7vWy#vYh z3i;Q??x-vFPe;anGFS;WMJprjVsIw^k*Ze|{97CCx2PQLa<&K(ab*bSJp(#HvJTQo zn*9z}K6tL(lZ=Sc$g)JdSYAXE=L{&CvN=H54)@JzlL$f z?!|sh;XaD{f{_?zt`y(KX+nf)mtbJV_ON-B5OMOA{wZb(Rh8k!QQ-7O_!m4?;6S#x zelQQs*gbw2PRIHqc7!ti_s)qxsba-V)r*^9A0TS7c4ac|?1{(*ia@OF%0?iT{S=60 zbAVWu#s?0i&VoaKm7xkWux9dVu;z9^teLikS(c`xEK6I%teMt5vqenFd&0f}@OG+5AVL3Sl5x`YxGSt6CV`_fInD3L71h@?ic zREc6riO6EYP6LA--|eLYBa$G8e1Kwelu#U_ODYc7azvIEw$@lAY1f8rF(S#SKDMYA zH!eE#!4ix}f=&~`R!}iYkBD6pgB{DEW>GWGs3<>(he8Cch0I>vdW#MC7{&dp{CP1khjF-hDuZs6AA#@v3-db6{BGj=I zanW+rxcuo~!ur8tjSbZc=Jrkj>m{8x45gCOTjp7*ml%!w@aAC)lm^ZZ(s`5E^~+y; zR|vh<@}%zFxM=%_%aaks{uN!qyH>{=BKVGzQjAFIb(XT!>W3^6PAS2NB;IBT93`>q z%4=C9;-v&5lK6lninKSHjTl#FDaDASHnEhS){|n0;X6S}G9tJ!KshwV0sXaPKsol4fQXB6O ztsPmtplW{Q9Fl&~qNR(}!ico&XD!8S3ilhBlaiQzb(Io~Na72Ypi=40GS)mMR};sS z5lNg7G;7;5Bq)^ms0K2kw#gF2W$iEh>HdawgOe^pFV%6=zG;E=lFp&Tu3!H2=5s2k zCM{sL_69q?T{4x7C><9Bty;Z6CB#-mDOFH1zj&&Bct8s0(Hd}2uMjP`0F*^Q#zoG4 z&NW7)?<(u79|)gI6(y)3Fuz2OJvCtXgY-ROD8qMmsgDuq`%Td51{PBS`&Jgbh6IH& zAC&?lDg~AxE;^!TT>f<5Vcj~5p_fX*v~OBqy`*#HKj{5S=(UXrRK}zSDUQBnFj568 zj{iV zhF)*`rUlkZI_E;pxcuo25qgV`|0fL*d?(A4GNQE5>o+jMTH0hii$o78!H6Vk3W>VZ z@1>VgijO85-dri}ibA=d}vlMYz$2fobqgj6?Jg9L#M6r){C|0Ql>1Qd@eFq=o@~6K&>j#TfFXbq6QyLkO zE!ImqsmC!ce|qVCUuI1<^5a2zIX_4zjqb+fPj44pFEk;)m4B7rq&EJ0kc_!yTz-Sn@4pu0LAltJw(KDw;XZAf`*WqGQ-EJa+`4dwXur+>7}O>1nZ z7BIJW3Ro}cY+%Vve|jfMy%Yh`P1l3;a(<9bIvs3W{`As6NTOPcuYZ--q<7pu=$`RE z)J=M6IDs4V;ND2F6P*j!@kb> zvRF9@ABX5)NP=n=^HN=9M74^gNOuo>jLV1nZb}=`lkrCNqy`*!LB{%))T_yE`S?0%s^m2ZX&dL9vca6|nbaa1=jObTy zSxSs31#hwx{<}iy_>xCZx~audn7x%DhVMR7k`YP1%ju{Vs8qXQS1O*z+-Y=ar8rg_ zbQ#iArYu8iL`LMwWNG4}xvg>ev-6Qxei?cxzs$HWqH5w%pf4Xn5Zm?MOQmHYww*}TqIxo_0r+)d|5ZMdUQDv(7Ei1!eL} z4=1snQkEZD;96Hh)CJ0=V2+va^-)Qi5){gOL}x@bfF(%pQOFt>hf`Ed-R1REGmjAy zZywVE>m{9Z+|0QA>8&dCa?f9q{Gh{$+vq6?*OYag5v8Rz$3~=-HndF%3S~Y@DI-cL zOOW0r_!yTz-C?YoW>D$>MmOoLXlY0ObkjjVvrZbRq+Dcf@7QykNoSpZ&>O+I=%>G# zVk8ycwPa2*B5N@ZlyqApYfDK+B-!D=lBAe(J!M3a@htf_qgN<6j4M=XU_=^J*3cnP z=>QK#2z(zQz2R9J&VA)bLlob2r8Faw?jfYv@5Up(Awi+cN419$)gG20u63vu#^q0U zU)HU&7<#FMP5Y(=)=N6~{)65}IK}0QE9FO)F2D+3PphJ|Gopjn>YDDVvUYGRnbNbr?2CA4}3~iV@AG*aqo;2_NI~ zXJfJ%|MMk8j0}kf#h)dJYYnmJmp|QUtQ#EGm{4gkx3>k>OFF;)2fed|UR%XLr6T;# z72$ub2>)}%-XWaYY6K}YP{K9fm#=|Ru8~%;pnQHv z3K{3xA?RvZ5PXopg}xA5&BshCqfwcK!y8Rdm>g-Z>LNW)94p?siHzOO?m zA6-@{pH{XYIJNX}k}_6fgd0m~MkM{3kQTkjZfZZK1cfpm(HVsRu>|QoijQ&m(@h7w zF;393rcI^lp@T$-0qy57Ntd zK|0s}gWgYt-fB&-R8$q;dQS2 z>@qDHn#z)5M5+0nHB<^zDvd6sRO*ZG=#omM$a47#dU|k=KwKmq<=(nq< zRnCWc#hPc$WvUrbx^A(C$|aS`@uHtiEi*hgrE~Zg?$DlMcmBa;4;(}n+uS>}XY zDX#ZxmvjlrE#{@%Vnl6^rHHE&%@U+{l%>V^(+xMcp1)STAnGyow!nHx=jMOV8!Giem54KaKS(d<1?fET z4|*F4y|ywXlrk8@%cPacG3K>h$bf!D$P!{isc6PAs#8L#lOC*;zk%5&MoPL2Nh%fQ zr?O{M6^JE?>jXZ=<SE>!Ylxi~`j6^>oxJlh-cBt3gjg^^2f?~mZlv|7_oFz!_ZhVZ3 z!@YHWJyn$6zTF z@$aryN*DiEVq{F0$S$2*wTb8w(=IwD#@Qx1A+bwB+s;bsL}yHwsJ88#QElVf#&>Sp zDzQyWn>MYZ;#;+LI$O7nX_wflP20%Cs0e3#Vw;4>)=Kohi&BKr#($I^NL5<@%j;i9 zsb~t6)}5pNSNXJmXtt2V7$#UL!Qb#!8@E)fxt@tr%z zI};LGN5`WCy0q<_*ttzq8)rmfyH=6$(d}ZQ;$z}bl+iJW!T;Lz?~AEO`L$I-LlZlv zg!UN_nm%TFdT9Mtq2Z&ZO`V=TVrqKmwA5jvrn#r4Hwzs(V)~fS)M*ny?Ao|}Xi=d^ zze3Z}$B#*4DN`nS+SK%M)256`o6QD&tr2g(sbglPjv1AXmNh0VZCYBh(6lk>?zE|) zqo$1>6WTGfK}6euL3lu?e#x!G1a#i_Z!#{a;`Qw*cl-}9ke!W+_-96Uw^qN2C_RF0Z`)0=q z15nwQ5#+a@>$NyFVQoFeUEdPeX@~-yFR=PW_?8 zpM9bR?gcq|UU+oXlJ}2K?$|ka&86Y3iWgh( zRF`7&%et1map!(=sWn;8UW<7rJAU6E&t;}QcBNR*lWMhNO0{Iy$BBiXv?#3i<@?VD zJ~!x%)Y4UU6uuRf{Kd7|t6G;Vwmsz6=RI!)^{Tf0*S)9v{*`T8UU_)wspISZJmJcO z(X)?qoH+93``sRC@JI9dr&nHx{=9UC!*7SZ zSFvg8t$C@Ne|@n+qkWZLuT%ExJFB;*4U6de#rmP!x;%RK`>F+p-kSUI(ApnWo_)n# zSor*g_dK1Z?zmd?&qz>(4p?ljm*Nx%J)A_Lad;v>aL3^x~+)j;T8*|Mt|)gTr17%3SrN zq5rWTo*GqQ_oPuqeAktT9ke}T+94x8y{{H444bk`ZN7M1LHO^l+zd?&4DOI~eXzkl zC8t7igHBUM8tGA*_IQ8Ig!%1VFD-eh#TVBu?>_Kdt18cXemgb!k&SCg6(2K2eQy0r z(IJP&UwXLd%&N!d=*7b|IAC_8leD(V1n;TzA zcx7X7sb0bEXE*$8D|dW{^QV~czfZW&c2gooL#t=g({BPiVbk)UdhH?LS=Gx7^JxEnisi z&4+o9^;kH$O6ck)C5qW+x9-+w`0Gbbdd9`IK9%=GqenZnxpHG`%;0r5)B3rSTDuZ#;o4?#-Uo> zE)Fr$J7Cdc>+f9MdUy4k*OGf4b&l=z&XI=I%D4{4kIjC+S*PTwlRt|nUT|ye_a#OT z`m5bnb%Koal--m!EWOg<7mWO0cx&N?v{iElZ0T=6`)1wV>-LXX z(yPVSonGkj(V@p%)VVvO-NTL+ul3qjqy4-E*PUCwf2sDjwo!vSjdSh(!87!Dy_1XH zd1>Q`g$wQnpP#pSbh7 z`ORlt-@eo6)FY!le@Npau*LhI`oInmYg&4tMi0? zGk$J#rl9najGsKqgAYs`JY-91`BwFAkDXF2t4i6~M*c;9_CZ1JC$oMs(l_r)zb++0 zroV0cej%}W?A%Ge#1{Q+vx`@AUt5-NHEq@Rliun2?#l~a-jyEc z=smJY{2AvbX&0uoo|62|Tm53E9(!-tjqjgpUw+t|VXvfrys%8g$L^n8*lhXgl(3&R zjlTBG55afObXob)%;eKA@9KZ#i;Bg&M)%qteDJ%l@OKAZxf2-But|-U-~TeC{M;&c zs~mjt>am5zc17+C|LDSkVe>ysY`iUIN4?mGH&ux#b#zhjar4&CEw_4O{P8z>4_@%y z%n|90Chq>B%x_a$bZFb-!|@NF>G9g2|GZH@=}Pt!H?qEJ*{J=Sudm*9XXc5|q)*qAjM%96f`nSCF z(I4H;xBBDVXI`tnrv1CaE-rkw!c*&hOjACuUw-?PPb2FMdHv#=+TTrT)8*@GpHw&& z6l(8udF#ow9diy|xY+aMW}%x5`Hx-Cj(k7!R6);e`{y)UJi+1odc-T+YE66RvAvPy zyEKe$`^EFO|8sTSj8;u6%+apyZq@qp{w@2>ZT#XsqkWXUIehE2t+`K*zx`rjc&`Dg zYhLUzeP)Bl`_5czbtxzqGwy^I^ZPVmkE0%A)I6kV^LC4({ z?=;+X{KMG3uYLahouuRrpVtkW*{$Z2zb&3rI`!vjLw|TUV)MeK<@bx_D{hxw|LB(| zzMs9e$-RXGUwZA2QLzE5Q_~K8HT;MEwNitY*UJ26#aEF(?HZYLWX6t&b8Ft(^2OFh zTS|P^_|2zZ-4OZBvgq;eAMet$?}oU0?~Giz`}VqkE(x)ZCp$fVR4ti)e9ivwgp4we zpL2y)d^Ne-jD^>y)$4sCvE{w@nqk_d}ZY+B)Nr{%ehR#*LabCAGzb(JyA(ZH0y8b&DH2W<+|6h=`>&+dQ2z zW7^~vQ$`~U5A_S47NgTJ_n$F_w9rC4z}AwW*VSV5n33*rVd4P~a-Rj*ws?ipj}~d8 zN2HHnGHDO6r9hnnD6s4@dLNU1kw1Vg!6Q&8?&K|Cid7Hs2H1E%Tv0wgG3{6E9e_qx zYyJ}cg<@XTiz6h!X80eL_ImzfQ>vFPMLgb8C4`h=tK$y?6HF=N+yU`;OO+H-hON-2 zHz%7?&mfF0;_;Ru-;kNE*OZsPGo?Nu5nROMEmaB>Q)sfw97^p@pwy7ip<>D znUV%~ppl2yNCX%0cuUbU7^bau6*ulNrON648shPmA}^XLwRcHpJREM=qWu86h{s!s ze59t-BY`iLGo_4O590BbD(fZn#?r|!WY`+5+aexsDXNbFHYyRio-N+2f+;mmmm(f- zDN#FZRA=bw*}C!qQ);CyMLcZ(15gU^%dFvfpoHLKQfL<}!i#bZzv3jNMf#Xo>0wi* zl09Sx;!O1c!OHQJYEHIfj1r8zdnkVxUD=$DtKsblS)o&S_t=XQ6BQP z2H0qCgM6$FPWMEji}F+wJhazOyG+SJr+)M0p{JGtY_u~(xoLaz`}Mv&RRj<1*^y^= zX-aByUmgkxu#wL`4Cu;pjXU`AR1-YsaHsxa=g@|J;!|Dl(215BKwBR!MAVC>i$Vfy zbdG{Lx_Xz^U-#vqTnVtzo*C8SBOSj(*HBasJ=qpuqq72(Q)k|b+~LbZJ2(M0I;TMC zns&HZe_tLdNzOycg_%RwZuR8}6+E<8OSSXqx5xGH<*6%p=;Q&_p`FKPeCo?nPw<2y zK4jHC{cN}|Pkq625_jqczZ-`)$@-+7QWIdK)2me5#=hMinOZb|8VDYGx{7jqRrbY5 zU!I17C!X&3yniapPq{Y|JQQ=X@L`pR0ls>W48*4|?l7l3egD~yeR&!S9;!v8XGaCc zT3?>V6kg2C0ov;#(pePTT0pd(g5srRxYqdcv_cs7nIs*v z<C4kb@N~tU$}8c1N6d$c<`1ek;!Jgrt|t8}-}2?5b7cWG ziZkiyvf^hy`O{wT(48!F&K%|R)e|dtsHY;HeXDW~`SPF{z!vStQQz`Q$=uVvJRJqk zBJfae9&@1!sv2pujs=|r4~<>KGj&09mM_mkf@cuj@oC=R-Fdz|aTID3tpjM*>Y=D^ zMQu3+PXoH+GpbHQk1vmC>9!XkN^_BAeOH|K<)IwLtWwuAppJ6imnT8+(DT?-#|C#@ zj)ACXd=do@J3zvPo6dkByokp{@AoJV~pR5LKM2}`~_rC zYUz}6l0r|b@@4RJ^P;4tVJnJ?2v>h8HPVZR!lwIB%#%Te=H)&-=ILdFXO9n0z7OTP z52ZL2hPVtp)qE(;d?@tJKyRsjK9ngwl*K-jSA8fud?@Dg3`Pup^5MDbL&3qPA~CG% zLuu_parsb&_)zEtJA4`Op%*lJQ&##=-t(d4`cO{$P_F8f2w8uOwm82x=6jf42>Xg=!GDD|4Bq>XDN@q!VTc;#Q$^o4cFDVywN|K}$qk#}t4@s%5 zQ_Mc0wNB|Kc~W#rcS)J5Q<5d+KRTtoq^!~@v68Y$r*xE*13IOXq+HS|4J1V@b`j_L zl7d4*;%X@=Q97lCq@?JS=8`gAr!sf!J)KfRQrhX1P)SMFDU~E;uuds2DHC-{ZAqD< zQ))@dQk_y)Qr75{3X-x}r&N)YV>+d>r2L>$YD&s=ol-|q0!nk*D@sabol;d&>gkkf zlJbyF=^!Z&>y&|#GES!qkd&D^#VpgsUX&?grc57`&hcTM>FH^sreJo&7uBDzq#iNG zZ<=qEAWAD*vCtKckDx@0pSU>l8GNg-` z1tl^<{8p5PJ`~lU$oRB2DAE?qlfCtHHYhO$Q-VQhV^HD^ii{7EF`BOmiXkNC z^@0*(q=ME>g3_9Dfi7Al2})avD_srn5tJxHbA5w?14ew&x|^j8N()IbY|(6%d8iEN zYKD)XL>f`-YEW85=wgWmCECzKb8I1HL`UgmP}&%zFoR+w3q6u96=mpYYEW85=@IH8 zC@p50Uj2tb39!-no~|A{4m$gb6)*i-qt{-+qqImhr5-^jOHohN;Kuqhrquhol;BaU zw#2Ga+G=q4;RfN-)(%~YSEg25gS~8ZxIg)*DRn`Y5wqpL zc)VX)^SEQ>uY3 zC3w7SjT2H8>5fnFGuv92Qk``v!Q*9XyqB%*Azzj=rAFyeg2&6&1R+&bw{;`=p52tn z(4_>Am#v9jw$i2^k2Iy$>QaKo%hn_zMfH%r>by4ClscwM2_7$7ay(u6mz;uGLyYbH^=`uT^Xtp>W3;PJ9GOG;7gUHWTMpefZ^ zml8Z)wq^?{Yv0>h+8VA)2_7$7QaKo%huyUDin9RcHGT-CPCVI zN0$;jUbg0d*R<7f**V3OI;Kkr9xq#Sg;Y&4gv<5Op7rt4)*W3+@OasJ0=%ZJ3Tt0J zVM^83GfD7x*?Lk)8TGK#ucd1zNn4$DDZ%4qYo3>_fv0EPGo{ArQi8|J)_gBp8KcT> z?;&k1)};iGm#qa}wx}MOQt#?gg2&5NhLAG)`4L|Y8f!{@sY?kSFI$;jw%Sy!?J}iq z=u(2m%T|_LN_Enu1do@kMMBCbuV>z$ z_)2@3hof{U!Q*9Xv6rn+dX}kZNm#|59gXvqjf34<7I29 zx2^DVc2jDJE+u%pY&|2SC|z^~bbGg91DS^#bt%E)W$Rhu6+Jf9-n=)1+M7~e=~9Bn z%hoa>W#r+^T9Xc&Qa5!e!Q*A?IWJo~Hg4-_N>!WDWfe@f7nvm%F(3+kC&}gUbdQ!>9ft0%Gad?kC&|%g;Z6#<5N56+k>W5 zp)MtOyllPn|B?3|;89iI+vo`i5JCyPDKKIb1c8K*KtN$q1}4cQgpLRdA%z4&5>se` zfDj>$`H3CHf+&K${47`r1_cxm6%@pRph#1|3KqEUT6>?eXU+iM{eSnn_j&H&nPJV^ z@4MdJ&psvRC|XZ7ITT^C9I~S^M$vkRS$dz}a(h@kla(l0j8U{6Rs)aUWfN}o^`p&+Adj) zQMA@5S`YQ8eZpk@B3X=4v>sEm?)COvZ?f9AK_WKBC|ZxhYmVhbBPt6_)?mqEjH0!c zS$ccjPe*T zwaNNivKXUiJ;^M+z2+|bwXMneN3s~BXg#H9-SPhZ9VV-5TO?v*jH2~4yyhIGmdhZUYrd|JNBW3oPzEXF8WFDP2Q4m|L_$@)#Q7^7&t$Sl3R3Op-LnXESLkcf>j ziq=c;ntlG8Tjq^5S@Dv^7)9&9%+mY(rtpsznyhh>#TZ5FWku`X_qJ^{S#u#TZ5F_48{ncX)Os&C^#TZ5FO=jusrPiTWvKXUi zy`^Z)jM}}<)LJB2j8U}SHdrvUN7qzMzSm*7L63zrjiq^aE zn(g&V(Wo0uRv*b?jG|S?EWN!Z?AxQ6ERSR{M$y`=X#H`h$wwxuP_h`KXuYRs(cEjY zZjmg;C|d6;T64a=VWY`yvKXUieZ(xiZ$!QxebQvjlPtz4T00c2_4zA)HCZbqi!qAU z$IOyLLL2kiC+`k7>hM*`VvM4-Q_)KJXZ>80wM()XqiB7?tZ;nO7PD}9{}G1PDam4t zqV*}TW_vB0T|U)hwY`KxX^c^{K4aFUB3au$yrgH8p+)!T(#9A?YZttx*5S8ZSD36x zlEoNBYd5p>eaiiR%!n{q3nhy&iq_|fR%G_I6HV4*lEoNB>kDS-eIsmK%Lh%?7Rh3a zqP0iSTE05MvQ0QMC3M<$}T2 ziFz7ZlO>BWiq=<(R?72v|Cp?~lEoNB>uW{pq30W1H`LI&OR^ZFXnmt-LUgTe(fUErTD~LsPLs7Omg~z$;WgVUap&77O;(g- zF-Flk#w@*Do1Xivz+@#$7Go5xO;(j;F-Fn) zSj}wXjG}eIV8PJ7Z}!r!ql`M-B3X=4v`!i<+MClFz+@eiEXF8Wrla1q?9uiS^9b- ztZn)rlQl-N7^7(Y&MdvXXuV;w$|Q?1iq;>BR_SH)KQdXjOBQ1ktv?Md7(CC9G1}`H z$zqJ6bz0Gy{>snkCTpu?F-Flk6QDKH&^jntj8U}yQnY@1b_wj&vLp6O_4-Q-{=zbsqTq6;FX*8A&r+-b5_N)}@j ztq^AEni;~3{rCjwCtz}&%_b^%8C5thNRw%RdKHnqb{+=f5N6BK0q7|lS zy%Sa2)MVAWOyi9)idKC?ivV3$?MS%9sKZW@#TZ4afuc3mee(k*>l(>ojH1<$S$Z8# zOS<(RlQluI7^7%~D_S2t{rwjvYo25=M$u}-ELx7xEc)_i!%mv42PBIziWWUX(d-*T zyBzFhvfhv^#wc2inWdNO$z5}%nXE4*i!q8;6GdxQ{%lJQ|B@`mC|XUKrT2}e@F*5j zt7BJcLrr6hqSZ{%dNg-^jL8}(S&UJ%BAKO+uWg+=%yk%jV}fKcM$u}nXq|ev!eg># zNfu)itrpCZ%SWx(nzEPM7+QBo7Go5xmWoz*)92clto4$`7)7g4g zF^X1eMa$j!&Dkbvmt-+U(Q3mieLfuhRl&K=hSm|uVvM5IR?!Oo=I&oiR_NuTl^LUG zwPRKkl3{4O4y4s~GPEw0EXF8W?G>$?`rq}H$r>P8j8U{YFiS7jms?xUy3EiTC0UG7 zv^pwU?Wd*hGg&hvi!qAUCCt+M;kwb+ZE0m_-7Hy*QMCAt3C2F<+nw#MFM#*A~qD9ZYHs_6^mOr#IS>H+)V-zj=>nC#^ReWIRr6%i~WHCn3 zawuB8M|i_cRu^h~Y>ZK~E@PHHZ!9|f(o-gDh-5KF(dw#b?H@N}hRO0u7Go5x%N4EI zfzB$EwNSDcqi97bT74orj4)Y`NETxhtt*&C^9Bqp;nDW@wln(1M#*A~qIIRB_3hGg zf19iWlEoNBs~fZQdH!U(zpgP^VOLPSYZ_w|t?r7}(vkgUnyl`U#TZ5FDn;wr{fp8~ zmPfJ}qiFR|v?gCRW0lD&l`O_6T0NPi_l<%LIlD~O-IB!^MeAxsYvpyXtTR~~B#SYM zRxd>>ws?J#$@)sN7^7(QRZfSUad!UQWUZ1c#wc2G%+mYDmbE9dP1dWD#TZ2^UeQ{( zA#SM2`b4rAqiFSKmfl_ql3x6%i&2NiC5thN)&NC|+RJ1$=q6g3F^X0Kv-I}*;^h`s zwKlZ6NETxht$~WxuEB9xCTpN%F-FlEWR#2AD`WV5SDLKRlEoNB>l#ICbMN>QCaYAk z7^7%i%PhUU2JD)8#AMwjS&UJ%1}j=`WZwFt$yzU2j8U|PFiW3%#}0eo|%D@D=Txj5;7$?73lj8U{)%+lMdtWoUuCToafF-FlEs%Sm8t%=8E zjg~CNC|bi5t@W zW^4bNta~MkF^bj*gGD88yrbLFafa4wlEoNBYox)V+UObc=6sX&v1Bnu(Hg}p2N=XE zeRpfV$vPxij8U{kD_X6yCS7H+&Pf(y6ss(&HyhR+?lnM$sCtXf4TeZ8cdrlEoNB>pEuX^TtbC|M8lv`I5yL zMQehh_4VN2zA{<&NETxht?L!7({DtqFj>z@7Go5xiHg>OUei~ZtSyqo7)5K6qP1n; z@%K#De#v5tqBU93Ds9`cgULE0S&ZTKZrM{j&4+&A*^Z zY>k2^Oz}*Tkxk4rc&L?3&wP03EV%IWHvc$Jo5Jc8k+uoLZ>Njfa$64;ZH!T#u$RrO zrXpGUeNRISs(SL*`;tW%^(ksonH4T^e{6iPvB^3mS%gtpIn0WYtSzrjc)?^fxmvgh zqq1@p*2V`n1E}ZFDOrS3S$PU;>pRCMn5+uPB8rj)PQ%qL#UZOS#qp}K_l_-+61;5UI)?}qf7GYG@bcNNl-nzF< z)*Q(qjLMp!u)3_BJl|wJBUyw|Sw#wK_`*M3CTqWB5k_UrR9HVPf6=1Vy0<7UVN_PJ z!s%8Yl~uy5I9Z213JUv~tof2f7?oAZEI@gyT2{8lWW6m}gi%>HFiUm< z?MdxKGm~{zvIwKH%9te&S~S;VhbEh>fqg^{2&1yfnWdNi*25=oF-QM3OR@+fd_L)+ zXo!@Qb%grnE=H^x4v7;qrT3$}6 zx4g2nw4@9#An@i?md(m5*M8_NNbZ0qWaeZUTVw`$fQlc|GF*9lS zP^3;R%PuS~Eh#C=ii_!M!6Xb#P0nv5_`I$y0KrEzzBvp{H4B@$Mu~R`SrK6z812ad9yTMm_fP zcrrXGndzC%IsN(#aB3piJ2gAk%kQA@#ss?ha;w=OsWAiGeU0`nEy}LQFDaYpotIZu zQaCS9^Lp_VqwFGYc|~qviB~*m$XilcQHZx&JXv484_>;;D3iB(xMT)lYl_@?vrNWDv5Afk3Qi`vDpP83ym?FN;ZY8?*2$bO@U$kYZLm^Bn4C5fnkY17K6zKcq-)#fvzae6>B z77|pyb~m*GnHU60BpMWDcqdVISw;3#%WOf#K^n%JKb(eOFh)*6Ud{|}Y2{Qjvci)I zWref+Q>Nt=)BJDi*SiY67)c37B$;UESA5i6kfWl)9HJ;mT!sEl(MmzRUOb;!2_jq7 zUcsmkE~CPe`S)Tsm?JZ2n@;nIZ8Kw@!rDpUl;;)Yd+8NZhL?7Q({eD$mE;x{&+?Y| zwP*QkEXYv%d0w+-h(g`Me-7mN*l%9sdE3t?_ZQ5kZUl|8f^uFt6k`pLU4$K+cY1bC zpvOBiyLhfx7}Aay8P3BxK!@g*ppH!@OBc?`%VmO?h^>)J@pyYY7rzoaJp4aZgv~3$ z;?w+13Fyr9zAJAz8X{XPOR4mnl$~FJC990Y5%eVfVHRiRoOyoP&^* z(L_6_yt3l#z(HDGfX2?LtSHxvM)sCrMPU9C6N}e7Y?K>2s-nEIWEzdMddkE8q_ASH zSMef^nvdCO8vNbiQ0LM2`(NWgwwWfocIZWDml6E=+|{5Aw*yGxr z3bbiYNYY->?+X?XE(9g;q0o?4rf=Jb~u~D8cR6LEOzyzrrTvmMc8FUMTi*c ztgIqLjPoIa7eubLZ5m8!=m47#*2TI_043S3CKP~OMJNEfdQbp%)t~@^6hYrd@Nq?u za;TVKg;7z#N~EGhEWe$mc|e0Ra5&nLxw;Ta#PZvL28necl!z6lOiNUoYVJiDFN6}Y z;x8)Jg-{|^|BH%sA=LRhgkI~)a?7j%`{~P4MLJ)d{}q5Jj5=}^K(Ib7TS3o5(2k+! z;XDA5hoId-k8mD8XxIm-o5rVd-UJnC;bqhVhc>uvXgHE>T2)eMkXO>N< z^MWLbLff{C&J2=xo+i_ow#}vI*0v>dW{^ai>hU|5Vl#F6BW!~33J={`m$z23nPyj4 zW~vw^YGs+JcC}@u3a(mRW~xnw#WFBRjxC8nsg~1EHdQ89ndS*3{m9%}F~ z%pi$2h15^?+7!}AvZ3*bPMi_8p&3awH0w!Y8>*5l>6UZLl412&K;~&$I+bj} z`X%Ung~IqH>Al1zNpCKjB)ze0l7eMVoB|J)N0}-lqoV@iD(v9tg5U1~{NU+=A9n$M z@N~hCzW_gYx~1~?ioNARfu-gGk}NdKwFC>p>a~Em-}03P3)bSaK-J3-7Pw!6h2npm z!a@p2vd}OG8<#RH6vb_U+g$0eubZ*hf?9v54h8x)~-8!V~(gnZo1^B_! z1wZxz{NU-9%EOr=yX!%g3Jiv@R$?%WwIYLItd$uIW3A9&7;B{l!-zPdVuN9jbUSjEhz3j7QhlERA5!*_>dld%q-WmHQ=GYuYc#TETuvmU5UQ-7kB7 z2^NaqH9|{~{8OyC^G~y8&p%D@M4S4j37&nLC6m+^ekC$o)~Ys~)=D;<)&dw#Yt9X) zHOq$6npeXqkY-1-Ow?~OsW_j#UvVhhj zM=FGQ@mQAbJOCNOSmTQuX7q6u;MQ{=kf3KcAVDztMFk`XhE0NC#06v6BnU=)FosQn zVDt~hut^Y%0l^r72}8WY#T|~LaQ|!ev^?jK7~JoAo;x9(&ID(IMk|e+l1f~r%AHF4 zA+o4Zg+()>c^j>~QEUiZ*!Jd@6blV&YYPP5awftL!OcGv0%x`e?kte0;)dKzXI4sT z#;~N+RA+v6VNqW0khmdH$*K4Zt;AQ_ka*+1(*9{luB5cAVTsOC+(ZeanUs>`Ov+42 zbfslvI-}3O8R5W5&rBaaEX6a_In;i0^^G6ecWAPC8!k9m?$lwfq>N-|oGUSYXzYN5 z#Ml8z1Co*l#JKv$_wOGUn-mk5m>3sl)fwu_OwAacnBwer@p(&5%*sj`nmOFr-#%}; z*Q%3|=}O8<8J^*cJO5^ITuDw>mTPF1Cu`_M=M9{pS!qKP(^H2!f0}FKw2g&GdU$~cw(lflB#FH5KkWFq`YUi6Vsey zig5}H>wOw{d1YlKWkaHe#Fgb$RF)MFiKE+>C>JT21~mVXTy5hUKt@ZSMU zEBTjkje_8o!9Nq2-!6cg30x-rX6#M*cVnn_+j2aIa(oQT0{J&YO@iRYpn$&vlXeXN z*dE2lu3qR#0e2@6!rbg|Ymod5aGA*hM}J{whwF{}%>w4}6oCs3f~!RV-v#F8VFE|p z+AiM1@E5r8cE41C3#Lm0uQxD@B`%mQjo(Lr*&%VrhS0UV7m$>wUJpnN{ie;?Jlbh} z$_4od_cL&RNi69y&MzK~-}Y(vvTVWPIe@!bVuQt_ahP_I@g@M5e}Q<^50+kJya$0> ze}Q;ZFYjMuyibAq<^u63fB#%$yw>SxQ+#L(R)4LLHW-+Z{y1K&GnK!n9Hqd__s99Q zFSW-5z&z!Tvx&DAm|gxjzj!n){~|G*5qt&fFU>rf))61tf|b{Sv;n}3mpBa5pz)>x zQ+$DV)E>7<3{2jFNqUSQVv<80#90<+T}XA|#dVE*#Q`NeY}f9;2(Pvb+|`Pw%Lm`sT? z>cu8rk;I6I!N?MG``6h5>W_2L(= z3DS}zhJpABR^CkDCR`vMweK8YR`}y=^7kAtZ}{W<@<-*}1I%H6oK3t2W6wZZkb!>Nbed^|naAE!mv`X8UuyfM@t*WBs!$I<#_>P6t_@N@b_ z;CcXe$3@^s_sxsI(Q!^)01n49mM0znq7|S4-t)t05m;9^9DPz;Lleh%Mtf3|26n|) za>nScs&hF0?mjWYHL9zF4%1HI^DI6kT1X50rzH=ZIHo+Wtb8K7)3e59PV{7sAC;2s9X)*HNLS|QiA9A|CsL!~baZiXUeUyy($a}jD+`NqCuZR3 z3!^=wdgm6FO&p2K#kj9{VqVVl((D;|y-TJ}*9L0Ww9uwvt)aETTX$Af<0xJJpHY}o zR#IM)U*YIJ@+t?NwVqix4}X8|NXB2(;q-4A<&)PE_^+aX?w;eY{HKQ@^+LnyH)t5% zD57zbrp+Row`kd_b(^;B+IQ%9$)%k-ceyNkYEEum{D{``@4dfe>$VR*-2Tyyk9U6Z>1VrkfBwauyg#X5{f_g7 zuf(utJ`QPcqU!cFdppFo8oFr0oL78r?A(y@!yb{E%B; z58d+c>o>RS8ehAq?AGr$mS;EZ_f1Mv@vnPpCv=VfJO7FC*H)xP`<~w6C_CFW|EfEW zTt4v%txt;=vzBe>HemlXcVGYKn)@ex*?DEZ@rhwKJ#p}HcWM78_wW1S&Z#eL?>2b$ z{n7ulcRui5{H5MQgSfl?O@LrTD{pb zG3@bs#(&oPlVkt1Z~Of4ldH!3^YRD7URvF&^Ze&q%so2fyM*hzZpgmZ+4iqD{=E9W zvG?q~HsjCDO8eP8ZfvzNW&cq`-QH_vSNJR;T`R`l3YcXxK(;+g;Ki3k6@ z{#sv1vy{OnMUDRN$ZDh0*I(;6_Qmpv-{;oW)SsE#{cOhG?(-hYI~DU=eB`gU>=|0^ z+x&8yCGW27urTk7Wl0r9E!Q587=E@-w}{G!PPf0()^S%x#j)fcGJcEt_ulBDkaine zb^L4NiYGt2w#CZ5^*i*BYn>R@A);Yva~pV&A=YumAk;)U_vCMLo9nz?{2J z{XBgBbsg@{TmN;M91Y2cHj4| z2Os)8$`ftsXu-S#m0Y=`$Q)0FyE6|@Ua@0H%b^v$erR|k z;c%x;o8J3yrEh#)^KJj`9hq@gS!37eOPBn-Jh4NkbvyPH$F|%RfBB}*2Uo0o;El9% zpZuH{*6^m=Vh%K$@zZNlHpSg_=#e(>RK2^P;G;&{H*9VnAAZODiPt(Gc_!iP*~5Lx z?)E-*!+%d$pwrADXw>m~1`R=MWGaQj2T{^hq;+{DC!1yMsw9q$xX+8D$k&ZWS zAF%JM=cep^Paf@Zmcv4xKJv?!f%mumu*;&qAKG`5)^h!WeG{G>sF@hyK`;fn?J7X zoUk|M---91(C5|(N>RZWj#3elRwqDLNuXzm)A*t5`Xn;t(E zra4EA89OdTdX4zV|&fo~UR- zIo!U_+`f+(TU8rbwT5s$O00R1!M;uI(7lmck&hJ=4k6-5d{ABF&GZB!!_l+Oz2tQL z$lK`gYVIYq|F~*&MfTbd=lU+v4_p z$V!xHs-Z;R$L^k|-JyRAuWu`rKZ}4hcQZidt8x&KI)?vGiF~!zT{Ai=%kA5tgW7s( zTm^35=ep}y{SDfS=gzr(w~1~MyIq7>yqWqH>2{xwCiEb z!zWCmv+HBo`rWYT*?Ypb8P;4*{Sua!tzTeevvt<+HGtF<_O*jWCvwBI9WNVfG<>-1;MBcqkwSgdfoK`N@7%t(qPoL$`3`%0f4O}P+=EV+M{HR1!nt!t zcEj(femRQP7arfo9h{E?{kmu{Zv_hzCF}&A3{>9QE?R!Z!Y>TVl0E#jRu$^ zs;TBSvkA!Uly0<;uw(|_S=-uxy(Y7)=62fY`0^KZi!1Yhk4L-ZOJ0igg#< zXl&Z`x@%Ia7uA{s&k{d zXZUt-qKCqv4wZh%;I3Rux3#jWYAc$&sl9aW+_CyxH~&j@Dyt9eM@{LgbNe2Q3a5ry zytx+TLa*gMTbF|$tWh=u;`#WO#9iePQx0?zIy1z!lGW>-ix6ifEgRZp| zNgm%!Z-(z9wb3H0-a&TUzDQ3^Mv2?^zRS1S-E&i_Z?~Y+jH-8d(N}I~xU0k+(vWlT zCg)%-d22GhkX=1vi*CFo43Rl#a2LXK?ZTYqT8P}roH`gMBw8StFQdP^#`PNIVn7D^ zkIyxYvPS(60~1MKc&dy1dthYM=Uh$~YHrMH$d6DLQE5a#7w$2bCY7YsNXn=gT42Mf zLXxPR*{B@=zCiWJoS^^vRZr!0$mnc}j_Q#mZ|AOtYtS!c1Kd4-ao4y*+=EV)UG2X1 z93sz-T3(OQ=Nh_w?a*+ujcTZD#-TzQVleP*9K3dU4~=NPIuG`z)LBw}*E>^vKRD6AUW_ZQGtEa$~8YcmJ(mQ)OiM zj(B_-3$gm}_zqC5rqx^%PIGx%p35=P32E$|>fF_03P7vR_Ef(WRg2VA-*%60ffpT5 z*7Q3x3)9>_3pv(jd(1@GKhWI1p2|^^@d%?~$i1m$TF4f#QftAgRjER63(xP;X7e4Bo)^4GCXV)m81QOhWdM zmDz4&1>>D3sc2rxxk@Oz(5Ja<8fS!S655gOgaxxBUGE=**s*)eDc^(reJyGrphM6Q z5cBtPSYqy{suV+DyB;#pW??yrR<=6+h=i0*#S zuzrFiI{qJq)e}RY6w$*p+5xm5=U#H$k%|?y@0SeJ=VaP7U=>{yHQ;SJffL!qiO*74 zDBz%f-8F64@_mcdn>%vY*M;@zchme1=z(?hy}uS;Q_UW(G4i=jasS_}i)9|-FfSYq$+9xO2o_QMi;hreNoy+d0xj@UcU zgZstafsfyS2-EI>PwXA&CK@qZUV|kD2@NJ;ElJQS+Ao*>Vr{?w*EJv$wT6l9uch?LLH}ljLd175! zzk7Ti(cJH#049o#oT%8QE?J_&JT()erugcxzUZFnn}Ke_-NjpX1@NL<^f9c#u!i9i zrcE$>C9sCGZ#lk2SD}?Q-Bb~#)f&EUV2Mt16qe`$m!fQ9j-?rRBK%<*J*!@%Qbh=h z*V43z5a&8x08l;Gv6?;4@PUHccgoi&l}>oP%!do9zCAcb3d>cDqf6lYsM7RS-eNs7OCGnJ1Pc{m=gYYST(j;Fv92iG(Tr{EK&72rFI ztsC)O&ej@yi}Ck7EWvmeRyL>Zz_%Ea`(e#ypSx;X#r#pUlXCm^(vc2wv1F6zV(uE> zPW%>Ss_|(^)oohV=r*;LZc~rd?OKaXomBVlH*D;tuCHqk3A$nzrbXdfuRWILd=={ft~Swh+eUw?$6x5kIg^x=#LzD1MKzFAmF zhD9Sp_-KR)D<75^iDibh#IShJO)HEn5B7|hCGMcMNbxPEf_ZB0r&e(Ydsfl#ka4Kd!^eKwuR=GXixQM%p?FiM5SO=F$G1*^43vH(1Yy5 zct1he!4iiK;>Kf|F2Lb#sY4&6PS!o+uFeW~*DUXT?%X-d*J(9Z*OL{k&p$LKoa{@a z<5n?8CHg*R7f+t~m=vj1C~r8H?s7g_Z%L=qm^itox8>>%iD2h}T`-B<*tnY%f@Vc`i&*;&!>%|$qPKbDu$^EG06 zYU<+~`KG0rK9h?$sX17nd3CL+Z1_GiZ4uT~*7qqH9m1lyLyWXP zU{MDR(>g&)_6S&|>{|>=jAkD!F-kqYuf~i@t$BLS8Jvb(e7t=_l+$v$y6PmVDxJPe2{Y1B^^>v%tPPa=f_9BbD z5_U@U+bb-tDfQSj5&!Az6&9P$r|bTc7TXbO`m-$d6pLM|+pelVDw?=!nxYgk7#1nf zsGrvx!Q;kJ?g0GoR6ic&p1Q}^vg-Zynrl>Iaevod06(*!DdYr^#ZaTM%JeyXHtM8aBNbQp~kG|a8Tulth5@L zQ^Hb*Qo}YzSh_$_pl1{33~(Z3N{X+F`jV%nW+!tn^|@>Ap~`gE)KGbNX70(&K!gFl z8me^n%2Z#s8776{RXuAVwv@UI&erxIshys9qeXOYVI&+&o5a zYE5__&ZQga8LN%NKQU^3^0&DVJ?UO@))BevOC-`9UdnJ+>^9n?m1bbqS|cgED@?^X zV-jCP^|E9OuR%-Qn@(U2Dh{_9b-6``x&Xj@A&F@$;KKx~i_zZhdY)O%S5QkqdJ|YF zrCJNksGz3HENd-`Qgu%WET&1|G7NY7-fk{>?fDCPr7DH;Qp;SRyfYfeB6x7_t!ff} zp;D=yWUnzAEeT2Iow*V>IA}UBCRUnam@SuAT$o~i6wMg2A+S^#F8dhfI(?3!L%5nT zrL-F~aowyq3PI;;fV+ohBnuQR`X3Bof7L7$(2TagKiSwjah@kjF&?(a7m;;6o&;*l zod6Sh`4Pm}6&d7#trC#OqhT}=@r)>U40O%e$=A=!84}YtPZy${trO(`%B(n-wOmDk zLSoK<%9!;SHzGdf3pM!p=ZQ-ZJaNN%Ye%q*m$Rt3#0_h$sb*)V-Q(8)sJ)n5iLdKo zl>UEVzzn3;Uot;xiX*bBHl)%RPqD*FH!MV@$Gn!xQ&FPi{o@8mh zhG(Ya?5*=JKj&v>tw7 zF-!k77ymi%AM0J@^z}cUrKtulFl)U+LtZw*ld$~b^Z^C^2~5|B0kT-?x}eBbT0Jn7QOV@+~{Km2H;bq9L%eMf2%)t;IfR zu^oC(M5m!SOUE0t8~mm4AIqc3RXM=Wp{tP@-TvQlaPcPU295E5N=^=!|3ekYHANR_ zG+q~o!xOsOhz?iiMh!ZAp)-(lOjEV5qHVwd4_6Poe8vtS^>B!;0@cvrp<6#wws#_>eqtZ_T68`wHz zSW_`_#A%;{utcg8Q>Cz;g(XtIhE>4azhD)z6;WT$b4yrL*mo5yQIprg5+^WoV5M>D z4X{KhZ-tf3zI$PbQwnvkgvLQwLgNouf^im>&}fb|oY3e7OK4=l5*pdC1Y;g7p>Yc= zq47K{>M3Db9V}6kTVbWJ?_*dua!u|seBZ&sAu||1!4j?Y8>|ZUHAKg4!d5F-B6Scf zaqc_cuol3g=`l>JHgFHZYR10xhHoz{!Ho#lt*)@>Xg^Gw1531r4_0&b?KXTzVYOi2 zudqb@g*U?A2(Yg;EaB@0OVm&wSW`GP5tgXa@vualE`}xQ^iEiU@iZ(^r?0^hb-D)@ zoevGuzK11h_YYViUQ={+5zhr{EaOJN65KLat=M-HEWv#RmQZ^e))Y?t7?y~45SED7 z2+fklsqJ71Ml>vuziVI#jY+UX{t96UjT>Q!c(=n6@ixH{`TGc#;QkCtuSRqU|1=Jl?6*go@iJFhIJz>5qTLb5&15|dc?4v zHmuhSs}7ck{IOx}Gptq^CO7f8Y!6G+cnmB$F&U=C8@^$%#3hibPb(TP`75NNfw=Hk zeaCiGaBMAKffU!p`67Oz?^GgPb=(W=tTy7JrGCwQfVkpbeaBW%^?NjNbO+e;bnB(O zG%sPe&o#Vykbat*uN=`a^>|!w*^gY(ZKC3QE?s=82sdsQr7(2yr~;?AaCO03M|(ce zm#4xKdyJc4rQ#E&-G=WXwr~PAwfg$@#;rKG7mY5b<}9Y{y2ZJ-6yNJqZj>*@ca_`s zS8DYroR~g^dkfyvQbTuod`tPZGk4A6oq%OjCvWi7q&vx7OSHwCYLRugUvT-hfVm$PW7nOZvKD9%GB!Q6{*$f%W)b1Fp@RY(k!>{HW_@0IM~7oZBNZzJGnA$ zV*wJQ^EhsbLwJe}DS6IEUQeSFJ#>En&bo^ee{?y+q3hrtEQ#xhdtmVE!KfDy1$8;a zavN-&13s}oTnS6;-6&ha@<78ums{G88O1lL$~*gx;LP@Z;Bk>UvnER12j=?)clNP5 z7JxtM#yZ`&j}3X%Iz#;8LnE(#DHt+z)gziJqQ-R}?%BCd9u(0Han>urSA#+gL&>1v zmbLTXksF~#3;DM=c*cEnV_|pLoGB0P%pw%s#O8N_e6qNdJ?1_m3g>y4ae3T7rI&GW z9J#N_5XEOsD;a8?#cf2TywQP$8(E+N;fBYBsDO3iPQjWnKT-v7ZE%h$U}V*gsDdRM zx8ggbvWI8Tp|Tz*$uu0_kHamvN{vNUy$O`ZS2@lT`bWl~L*)_T-p94@%8M~j#jTe( z4L9b;)Sk>1wM#d48k)E*D`y!A>gR!c86vx(mE-h_I=--X={gVPJWF=sjA?W-k-PK& zUnIrF*G{1zpnzJgMWj%v;m4o^LpbWjZ3>2=0kQxP@(bySxavTolVR;F_V;Ma9HXnvy2#XlhA49c}$Oc+uZbL1yAO7##xRe-c=u2)?i-IXEV&2WZ zkhT$8+kS1ewlB3j*?fPqolR;ZN*hfHrv}mJ**f}0dr}cWSQOy__Ju@*X%YRJXc2cd zVBMKI1^+K(1eH-(#9Gb15Jw};5pt>4`ee)f&1;*LHl5NWx-qM2+Fl^^Z4nHiD=doe z1p6+-kO<#(1#FW+sf+Ll`1;ao5^QQwVOvny!(>Z`d=-}I0Vzmwhk7`Ne zpJMjDK-|MdTo^{32a7A}oMO^b!t~89zds`}RO@hMgw{GFU2A%>@%~0T8`jn@4Vx00 zCFVnCJ^%hqPoUGcV&+pmgheg&8~Z|{nrcxM9kr<34q8;d_F7a(ORfFMw)a4R_qq{mVN@q~2z)^XH)!bkZYM3R5 zcCqP-fv8b{d9_FXQ^`$zQ$gf}V$$;w_02AB4^i^Y;mCal4g1!e&1##JHl7l}Wu}#s zzLmicB^DNyiH@z1tJYy!>)+aI;ppYG=`1R%z*1R-MRSy35o)9*cOsoiBrJ*_uaue? zw5b?@CM_A)uhe#NuMwqg6|S`!-4gr87Fw&9B2PBmFIGY$SVer%`cjlySd=Te=T?qN z?EPrd8I&q;lpkRcLNExG1+Ko?#da$t*5gu%O?^{A#HE{ zdRFj1ox2t#6&96cw8#yu*hV+h>SMJ?o6e##3M`dTSk%6PMJURtzKL`yiLfX>9nF}% zni#aH7=b1&5tm{v!bjii;!feXIYotecxE%6>4EoI^ZlbeKyo--$!S@M=`II7HN$av zw4*y-o>f_T)j)?Po}3&JfQfN*7f+FQ;9(!R2f_VA^#v?1Kd&sWI44g$tJw*A1@SvggQ$o7|^=-#+lwoVH0D`y9SMDfZL&6^S%z-P@~Pdaq6?XN#~ z_YI!*`I;4uZ?=xOuWm%+gTGak^}BZGJs)nkC%@H>{%6mv9~g6B?)PU8)&5cZX6jw5 zt8a*#pa06eZPTNs9c~=6=9TX~f6hqHT(GE9lL0?1-%!6*_cf;mdbSN&`0Su3E`Q>( zRa+)^eyQ!;W0mLr8Z_K{*L`0so&DY|>8-X+PxqC1fB9hTj_JpirS%#&c0kE*PcFFO z{hg1t&iQ!fu88W#rXBS*+0?pyqml1t5BTlr?3UZ#>URCcqBU1Hy64o&!$%+Z&$Ww= zjTzdYdHGXY5^w(cZ--;d{U3zxtj+H6=c%0UHWqfAk-sg;^}zJ(Uk@F*`=$QhtmyRS zvEnU1bUp3*tU+B%&(pE4`}TBuC$ZhyiLd@Sam$L4r+YT}_SM#x9Qg3ZDYH*}eABwe z+dcW*(U2COy`A{O%d+_Gbj{#9K|Y6kyPJ>lHgh4RJ+^RJ`?vNit?v8oTi>o5b;aq{_a0iDI_Iv{liwN}^H8^eRka(}rZ+BG z+cYF&-MW9gLtc0|@xxo!-160j1LMO+uKMz!C99^N(ta*omfdsnTMoy64#ph2O zIDAdpRmW$1`Ec?RKl~?Z*S^KazuP=6@A;msH~#0?Q{SDqvHOZmKmVBW zIx6>M+lT&qc0=94DHDz*^sYU)?nv`HUVYkG_WSP-TycHL{7WZ&P%nLJ?A%37!aCmn z(4$?aOz`e|ye_`aGQn|n{F(e^x$li1(C7wY-})$J z+JA+Hyk(^6hV}7F6g@PA9;8g@_MOIb(@|ooqhE|+w*%iaHJYAy{GtWD=^2V&0~F6# z{2H%#^6_hq;+chCs}+wAzfSU0DWZ#XCxlF`R|unc=wNI$=4cah0G`8!$NI=;I8k;g z57p*pSsfBZEm$$A7+`2wj_VLw{5dz)&4jjMXvY&8Ld&>FSRh@lfRp&^U#O}Rg}$%z{<{NqG0h7JJe2&LQn8OH-LjTv(} zzG=JTz1JoLVraJ(8bUj7iu39{A3Yn0p;`$Ip~G@geV{6Ndmx6`p&>Wpn{wYuyJmkN zhH5S}WSPVq@XUKJ5JNQ=8bYUJP>ouvW%J(+#I#@xoqC|$ueztrC4rchjG@D~M`1no zcgmfCm{yFTo=w|TA9r>IVrV%L8nOo8)E2iCrtJ*G(6S*kgibzDk4$^6`M5w#TgK2y zmv&@*)#TPd45x(9$qUjd{x0vTKn&$JG-MQg52 zS!F#N;Mo-5*&X1an<~^e{|0#Ih6)vPb$};1z%wDhLnpS?I8_0jRRNwi0zA6|Jf{LY z;neWF={0tFfM-a6XLx{TYJg{9fam@I&$9uZ4bl^->G}CcdRiMEy5)qnR)!~xx;VDR zhNq+Sv@tvbrKh>!xlVf88Xmekl(rUzXQlKsH9W6MPdmf&h4eHtJjbP{rQvBny9I3Z z;St$yB|TW4OV1V3)4=e=OHV_?FHp27E2FKI!i6_CrOkey`CSI z7~z?jH#28uDW%g!81j_P6~Be2yrQfquh{B|@?^&AziDo1puy8m_t1>Zp1#r2Me`wh zVg^VL&3-D2=5Y25&;!xzCop{_i{^0l^o@}o+RLz~zjW|Ssd{KHBjUs)2o%lp4Yb~t zhii6(Cp3ii476pw{Xt@Tw4vBul?G!p>!a$i3y~~p>nnbHa-Ye1PqG-JXkE%I+Naa@ z*!sP{MH*V4Nfu)itxmv-9FkVuZD+4DS#-M`ZH!U0I>Q?pLUl{qy2ZnPYHesWq2&oS z#wc1{;5D^Q?JqcNvU*4sV-zh1v-CY zsKd`Ci!q88U1Tu(VZ_-NI+(0~C5thN*44~%;5!7LTW@U9qp6{Fxg2(kQM7t7ORvLA z!$a1XtW?QjjH1<>S$f~7_s-lG+8J8KlEoNBi;m9Ba@9Q%G0vDWQs1B6)b_KsCR;+tfZL>nq7( zjG~pqEPdW+`hBa34GgW{C5thNR7W0y$Yfn5S&UJ%hBJ$jsn2J9^lFXCN|7waC|X&}(%UPq$v1DBEU#oSM$sCfXnj1Q zXt&9tTcc@XjG{FXUQsSepW@hiBHXCMdnAi7iWZ+CF~;(nzlF9lS#*ge1-Qdp?}z;)i!qAUbG#>FxDMliXKLR)SM5)|cuZDg#L-Jk)@PDM7_clay2xjip0mv{3G3jH+i}Ta4ErJ?#hF>*vF3Ri(nE1` zpxAoUf9Nw)y(?I>5k}2(0X*hWz#khQ#2!H}=~T%gjLIrxRyTapHfZhIUM6dSWD!PX zO@}8mqz6&3J-H}mp~-q%vIwKHX24_S@V6&kIc2i`l`O)jtRiOVCAszRiN8!%d+KP| z2qO@^q=&qSV|m@iOn5>==!F~VHUtd)&BjybR^)k0%5w9{yt#Q5coS(!nI>O#;ib## zUb><_8vxZiC&ur0U%%h6e!u&vzj0;Xi!7YQ{Ke}Jn)2pW_pC>kBjwr}3FED=0n^7uy zj^UXB4;52!u(s7BG5%SQC76L*n53*1FNimYMbl`q88*s|A&7SaC372C-#JYVyso}v zMq!>7Rarc{usAnLPDWAuo-5;*O!UtHPg4?VpB98Dx=|3OObkM`wmQx6L4pLpf`s$y zV?m<%qk;spic*&g5-k9RcSIEyM@2{Z*I@uqw8}*QMZ}nkjd&5jAVs#+%y~-ej|vh@ z9g;z6&kqzNl&Ct(_ze;*5EmpMkM|%!L|PD{F*t*D2MZurN3cMGbpZ<`SmRqDB1&Mh zTOcAzTtFAHKtz=DLPV7K3r9IGL`3O-;V9>Y$Oh7PN<1~o7FB(IKy%vmLt7I3D8{_* z$1we(NYPQcvYDc{aA1ny#02Hor3g;npd7mt!HEsZu}iV303KU z(7RP|gkIp_2)*3F5q|YdYY@L0W|uCdSD*!FHlGD)R+jC0P9wpc=1xmaPaWhftt-(a-A#*qnmNH7e&`HX0re`E2r)H*PIETayiIex84~e5AV>qIcQ=<95 zR9+F`ciNEHA#p}_`lltilG3tr<~Z?`H??wF6rFYEZ3Dg^^TRo{=1JCD`3TqopX(#YGB-!_ ztSSCDf)wFPzXTV8-*&hg;9msXDH$^?2yQt19dJsj03X`ubd6m+I_)+}19dJ6h zBcX!F`xHW6U}EI?NUClwhvgZ=NvJN$8e<)!}dJTM#maW?V3 z2Ih!A&MzM2uVH800)-E4)L(*?w-+!85*MtzRDa`uncM z@fEDRqk!{XARcz%+5%u6mAH`e#CsZ;*CZ}jd8z((OAJijg5~cBaKB$fyjETHNav5& z4Y*i|4VFJ@j}aFcFB`a-7ZJ~Qk?~dmx6VJFNSafKKVCZwy}ZgBJv(Q!K`XqWEK6O$0ch0@S(So>2Leur<&ot zWO$U!VFK|ZnfkhG?ybcSyt9J-GZQ)>VW&u-|BQr+NO#padPtdkjU1lXsXpzD)-Lh* zgz>VLt~w$U_@?{u#EWL_GKPoq;5j`f@i;P8!c)RJduo<&2E>D}@2UmggNO3_!fF+x$!)&Xm1^sIs6A^VcH;A*WeST9l^JTKBD#IpW^K$c)(6Ub9%p!cskHqQLB-N z7YX6zj$1v|Zbxb;GGaU^h@S8x9?q8ddNhEZnx&HP1-+DGC0s_;h&PGQL&wPN4wVld z8}u<=HQSM1S4(X}uXaMd1KE|il$2$gluBT!vbmtn4NoFI8174skJsZ- zr==9`wCMOE3RTYl8HJyP279>#p$?ZuEs{S(9b$-&ucIE9gin~}A5sacK^qSJG_`w*O5~yM%VGF%Vhz5cFW>WFcx{;j0Dwg38OKKa^ z+v;k`zv*x&UYSWRwcdcA^qA!C$ew4=$yDDT?#N*$@mxEO&a-!>+b6@c{+;sZ9<*~- zD|gSGoHG;F4Ue?LyFQRx_Epu+X@e*0!Gl*-n{K=)0&0{AdKBMU3MaEqj}{BXjHL$< z#aIG_r>4meyl$9gMJlIKe$HVwHKv>EA1_CfbxUt_G^-a=UW$0~y_>8#)I3i8UFqCW z+%@&NbktM$)z$oB4p}~`BC0Ay+mcs)mo&AI+lL96{x_d3O`QkN%A557Vfbd$UDbeifZtiv1J`?1N`%5tdSJ-z|$|*`4$}^V9T$h9~;#NwP6K@t$A| z#M2lQMz~50L`iJ@FJQ_*6cxmy0Rs^gZd95Wh{zuD<}}@aVgTNaFjNsF;`Z&fP9c>y z@@vZcNwt+ZsFnhHi8xhC>^3uhY2?BCLGi+F%jnFwX_hFUf=Nksj z)%b{|qZnCL_#MN(+wm>N=lzED2P|3xhG|!!jT6{PffdcxcvvFdU9h^dkH&@=y*pqD zjUQl%(M#`n@58u`uzIl-3u`1>sYdE#SVE&1me8ny70bB$V2Kg^s9|A0DW^QWThnyc z-Ixy@+<@5mx$C+jh}f6Yg5L6!OMZPXy=(guJdpMUpfC~ORoi$tC|<(1A8!K`F={e4 z>c$D(5Iq6NZ`tE(z!L~Pe2OQKNEq%VH_-$V29tJ4)Dw6j!E;pcX6GHuqsfGZF!gPV zubN&Ci$|EwW`cpFXQ-2x(7LlapPjcXqUzco z)wKQr3?6JPd9No6$zv@_j5X=PP{Y$_X{e3aND_K9478sSf}VRzV+YA6EaN7!>Jv(= zah;GnbMQn~y~;@(@?(UwCasbze%ZZVz5Kx1#U|-nv*xK((~Y?e&x8GzpL)xaT#ZY- zz#BQh^dzdB3zz`@Ia!63-DKe~Jf)K{ZA1=qSOwlj{}K&hiGd+%0!FZILHk!~cVFGH z`ur4ZdQClbH1QhQavZtcIDnpW%5NQ}VJU{@Kv-gECL5N=uxQsOQfpv|!SX09G5B6H zeA^A*8Cc!%3Ddfuw}|1|7nWcQgC&M*E-W!L=`Gb_;64B=nz=6Pv{U zSOZe9v&Q0$-aAJ7X%0qRG_q<3=y*#HlkqO|nlX#q)h?FI%CB~XFLy;?Ks4rTMYeD) z!e<3OtMPdOpIUr&;2_*EQqJ)ryq5(n*%_xZhAr4XOdPT)vt_8g+ z*b{;hz!Jc#f?kd2Rf+{0f(8C}t+h{^nLzIM-S7VY^ZegV=A3obe%D(2>~`8-dt+v1 zq=EQ=Syc8UsbR0JLwc7+^6b$^Tk+)Wq(-$&&&Mfc7lq3%TG}Kn&bar)T;$6sV@tME zNm-{Or+3G48=3=3+Q?FadI?k_elqFuB&K>pgHY58sBXBlIiMyowI0+ZOx+DiYAAKr zLj4WY#T@I1bZC*=Kq8PfJzNSxCRr0I3di%A=WsbR*8_s1+g3fy1R)Yak;EeAIj|B& z3wSv5l&-TQC(2Z+GSXd_zRZvoilhse*STXut>gR6wN~3(Xi)|2SzsP-<1e*it=EjtuSiw;Wg^B|u5~Oz@ zetHO}n=r_OHZHBrmqRdFYXYZ6m$GXWc}lxT5o$ipMi1fi-;7AgV`LfhTT@h5+C?|% zHD_MY&yC7PtdKNyZc=_$y>^VCV}KOBq?7u0J%mg1y@)jH1<6sUORwZL>70HRy$?YP zCh(*-bS#Ai>84vEGq3cN*zKDZL@(*2588SN zr}tIXYwd3?*5TOC=2)^K6rIO5=ACmvW39u$ep&}dH!bd1)7qGt=nCsp()66#0Z6m; z?X}e44Awzr@uS=%HxW;P-;dZ^UH91v21LXk9G>QLr&NYgL| zJ!CSHYzsxw?=w#(LT`kL(4(~2$uj*X_4#_p0wH#VBFO{H3pa)O5?u`YY(|kyp-8fp zdHM{Hy)R$8?bm^|Wi1zdczx3@V_s_hMBGKCLk2GyK7My}S;a&1$2wnLJE%=s)}f;x zoww(wg+Lm|xcsq>YpOrHeMH}R2cv$uXV!s+ci?Us9T)wP4--h1@{$M*c&dO0cw&lvsKHGKnJ4jf!OwMUP%KZ=STJa}-yyaDA2 z>H7I?+j+yf;V&)ut>Wu%H@?vS$FA+axoY+6nb$11`Odq}N&Ru!*6Bqrb}9V4RhoXh ztw;0Mzwk|dVE^Uctekko1KDG@Rt>nQ|1CxO443YAn;(twmsO*1Ie7nrGY@XnjT(FF zup}qAPDe8pSMraJ&&d}YD~4*Q(-Dm=HJFNobFT@-G++$XZbD!3=L2})AhcCaL&i|s zq3-9%O;_V)D;N{W7}7>DPd~gp42If?(?M;Ys7s@6#N$V>o<@wJ7EYL$t_3-v7&;@T zgYLaZdQ9TXUqdmC8AEqlgt=g4#m-O+_1;bgU4N+e-gorv>q9Y37;_w$)}V4<@m>*% zY04OS_90tU8#1{ zI8g>BRdHxOHBnHgI5c;gaIROJ1_tM0#fdaH`fPVDgR@&<%-UNU!uchH6GI&t2i$r5;sMjIr4|$7buVl`9@HrQTCgjIr6G=N)s_v+<)= zWSUaHDk;X;Y|)j?%)?%<&zWFKb)ss5z!;k?J|p(9x4!zDlGGpcqrj(m*vJe^L7jIr73ZnJf2{*kt( ztr{i87@MsgHd`xJR$wK2d^H95{!$YRj5+%hLo2?62ifT25o9nkn_El46X_Rv(+KKj!opZ%WaExD*&;v(*<|v)|Y` z``}xq)Bq*L7@MtrET!k+tZgs7Z%SRJq!?qf70*)Y1T^aB&3P)XQ&Nnv+3Ihzm4B$} zI#cRNCB+z7AV%1M`c1jg8G4FuP` zru6vz-EYl#hz2St#@KApwb!)u)bvZQG^H+4QjD?LqKmlQmO0nV)k=ynHd}NfV%j=5 z>KDs=J^IXXjIr5DU@7W1C?vI?Sz^xf^{KMO7@IA6b8Fi2)x3t4!So*BcO}Ibo2?63 zO1DKbx|(y_(L%=*7-O?F3|!Mz)0=*qZAx9Jq!`2UmnjY%*k@N6&U$L8s@TFJNa)^o z^_wXqb1`Nawu-Pbc9{7;*oiXS#31?e7tAe4&$B7PbQ&R(fDjK;d)RRQ&PhegX*+E5 zqYzu40wW}%j_E^me9$ZoxtI>Yl3S!%X7mVQhnr}mj>$i0zLY$;^kw7~WX#Di=iwmj zGNVVG(KNdUW@K1Ov(D&6$cZv%{V@1-Pxz6Yi6PMGnHh`Hv#hgZ5Ho+lyhVlv!4ZpQ z>q*aEZWg5_D*UPF%2={)2v*uzFxPr6Bqz)|GJyb6Gbv#i1%-Lm91IhC20dK!>r!Kn zJcAY#ioHB25j@R`s#QT58dN6*ZJEv|BY#ovP?TY$)9gJT$eonx(W2u*_^= zBrJ?R&slNoz0>XNxVlf4n!e4ns0?!=A;?fCbmL?~u%gvEl}X*$Gh}8Rdc$UD2v+ol z&8!gY88S8mD|!cpE36Q#=&c`C^jhcJs5{R@Z~d@gD}(B)!`62_?hJxwuR~$F{cduG z!L=eBGJO3BhZLRGxlSn8!XZUxeUM>KJoqvdHtRw_^-*>9%nVX%7YJ*@e!UCdy9Q(G zp~!Aoa@5{;*p=GxVGXDYZrJS9Vk zJMyVVAKh*^+>?kL1KdvvOOH+AaM|E@$D_&h>Vc*%+)ChH1!gcksUy&<{c!r|&Fol( zAsmHpxIN&H2d)#n(MBM-a5#z{gUwWhqvxt{xWnMj0%i=o{YIeIq~UN+fu9Xbb9yI^ zP}g}}jkq4bJg9JW>7)Fs1g3|2-mEKq`M|{k^Ps{}Idb}fym9Fz?q~Y5D`*OJdAt4! zoRi+$BT)Jn7o?9~{d86s!cnM8-yq<8XVFJRn_f?SR|2=}Ec)mb&TaM7cMounpG6;? z?+#!-4#shZhDa6YJWc}BfWAB+)Rli!6kUPw1mnW!n*_||!MHHxah1ZbVQlIuj~juz zyB_*p0_L4yT$uD71?JaaTu}Pxd|TnWN_YGy82J)L-zZ=v1mnW!Tc|LivF`J|8o080 z=zFxD`nCYa4olYa2udH-m(S~|?-$^B<(aeS>jb49Qf$SA$-ha!Tpo-IN*|TSRlo#- zabfg54$KR|xFCI0@AoMTrH?{g_3ty_j-Evy^;eDP+n6QPrLQw^eH7NHS3%zD#ppoC z1?l^5c&k5wWaa#ayw&Ib_np--Lj1CBZN+)5^qbt$6;Y0~zz=ZwP7VB4(1slg{1_Cy z31lz%W^_d}xr^IO5euyhUi?fEvf zd~F3GFz6iPy2)h5aYZO?Du29!e?e$AGi|T+2RCBBduH3L7b% zN1N(I1GY|HRFnfWj9lds{OmSR`ip89Zmiu*$;4rB_8c3Kx`~b`*9ork)5;b_Rjz zc34|;x)5F#YJ!SDEjXO%u+-a_&>~=z5!i6luuoH=dK^2mKNQjT6PLCW+ulr-8`MLf zq^@}O`nFC)(l{-Rz)obSS4}J7rFtV1TBHVkENCjWI4?1y0+k~i%`S=amtM7;JEq*& z7thz-ZEk=jY7^^dUw%skcH|pdOnWsUhBO{GInylHPkUM_+7G$7a+A`%e341;#+eO0 zlo$S9Cz3E-0r}vdFyOike;l|Jr=pojy+%GY@dx1E>34#aQr0vTl>mJgY8Pdnst!1X z0%)TzVJF&hUTAgTG;5~8^cPEiwjy_!oz*MJEv8kSy zZdZv|h$PFYPzN9b3=Pwf>!9Z~|SxSr`rfvI$CLGevY^63X0M(aylr(8=lD8lEarulhEG8&p z++7vX^b{y(aw-$Edcs>!DaXG|moHN>f&&547 z9l6+vwkEM+JK{n(I7-ZD3ZuvUgri8S_9ajpi5A!;9?9a4wOg` zYC3*;2&a1(#ie4QXEe2D%LCh7Vy$QNyQEjPYrtcq6a?+Ia{IVeAX~8oTtVfT@3paMo~J2 zB1!6rk;}uPv|$A?S|8N>=*bO_xoXAJY#w6uFcyT^6^f*9Vjkym7T$#+=n@nwILc+A zD3?WoP

{hj6;@K%|+=x?W1XY2UOUdP(O~x>5sam$?UgYCY8EB8?Vgt&QUtK~h4| zxjZORNzqzT0al%#+FWZou%*^?Z}hRK+J>_c$-a}cr;v)D|HWUf+IQ{#i*LO8=!)xKIsd23OUp+^U0Jjz{rT71?!9>2HIYl#S9~}uYfj6Z zdlC=a{`Tj$`(KJ1Svh0ykGJmn>gx&j^me~^-SO+5&il*NGp^tG*+sw99DTcBg7akb z-kEEMCSTSqb>I7+`W`MF{X=9;Wl>SmJA?1+cfWha*rgo~^<8_(<{wV3eeSE&3-7<- zb7$wB=WX%d_r;p0_h@hQY&mnu*l)+K+&yUP-!B+-Pv4=7YF5ukKYvyAC;2}_Pk-~Z zO=F_(yfI<^SC6fG{MGADUpu?v)K@RgS@-L&12)~)`^Yy>-1L_%&y8EX^<&+~-wUqUn>8~!apNx^ojN&d-(#NVXTJYb{8#5A^Ev##=CeYtxucP?b8kE~H`Kp@ z>Y&rnP?D}a(CgNnp_m4Yc@kTqR;_+|NhpRiI2}~S3G>0`5AF}eL^6i1ck~K)dh|2L zLorm3oeoMBg{oplpHNIA#5f&$uqB*7q0e`r7&>F8qY1V+eQj{n_w7S5)SoyVhiQx7 zo=TdUn9x=q5$ao<4r=j~=AXa$47ZrU7_#DYP!CFa`p@b#B^1+?F_b?fo%YF)lu!&^ zMVt=m%_%oKmi`Gip(*G&qG@hU$$!1%SQ;+Xy)n-$0OKG~@_ruWG~ z#Su>zctv2IbV;++1b9X04i6f&Q}IF=q9D|!g+tF&6sWEWhaSKwP@QFt;mttpOE7~7 zfIuyUIi7ev#*0jy(|@qyP>Zu`rnVzeI)>Vr-Q$6-{4)9*gm!h}v+tNIa{jK)oiVl% zh|O4v+c>C;%QuWLrP`Ab1jg7#J2nT`9L0Gudsu7BxJ4z!7@MsYET!A3`tjhOrqnDY z#Tc8dmWC7vt@}HdbT`N9mMAI4*lf|;Tytb){_UT2F{L&tDaP1rwPq>mfhqicveT93 z*v}W06k}|*=ziR^H6Y=drKVJkl46X_7QMtaN6=6G`uF3e)L|vX7@Mtg?6ywrJZeh0 zR2Rt@o2_;%C8e)vpYA>XJyWWal46X_7A_c;^YTne8)r)C{!EOq*`hJ#X5H90tMg3L zuSNHHVvNmJN1Ls(=Q7?jrIxA`GR9`h?p?9qoOc(SQnxFqvw2sPS2S~&Qd^Z&UEURX z9%f%W81v*)uR!5|l5&GSlXu1Fr_b$YO8udvI*XL$qe&OyILH=-3l1c8F#TH2RYnVvNn! z`8HdZU(g`Ol+te!8Dq0`0ZZw1gS?kasjhTcKwyl`RxfbP^Qswp5mr-B3Dc656k}|* zdK*%twfNiy-CB+!q3Zd~VRjlqT$ex75kkE$&{TIiu+ZQjyh*lZ@be2)= z=|Q8fdC;wOX+#=ZEhEN*2JPzOz(d$|j4zj=;AbCQ9&Q-<|K!q>=~(7Q&w4spb1loT zt54bnXIbUK4@}RR&*PZq<-rfYY6tw#(dUH4==Q=nISVo^X(H_6g}H@Tqf}OJv&RJ$ z0MN2rpqV(Zg7O`lg&9|7W3k!146N2_gYsasa1m5D!tq5@m{g0VFcFyKKm9}^>Ya2OiuQ*D>nGmAGHljGJjx!;`ortxXhC2~kd^iP` z>Ksnq8XZpDTI<8f+v3lVkrZYXMBh+QL91*>M*{be=$$U6{G(YWycox2yo@^25bi(226GJqf zWA#yGlttlibbh}A_Xj=mBGi>W!ZpNwY-4rbToBmzB6g~MG5el{>Q3Pxe_e)@o(sL#PWn(y868N-s(y#Pn ziBOlmDTr%~=g3*~EQw&`i{(L&_*9RI6o!r|)HRxI9dNf=^f4|-AEo=bdg^-%xV>l5 zN7;6)p88_kC|CR_(D{Z-AD!=DH#U|~*ZC&8F=87(3U%qD`jO)%gc<76SLD{Tb@)-J zOCROmBW^;Np)P$dyEW}C{3z6=kLvlCZbF!$E`5Kv(O-5JTwVI8KkcC~y2iTn^#$(2 zv*@GzySSeE<^xx77JYQSH`i0&6TrQA7JZby_v@+eOW=;3MIY6_ru6p266(socEI&e z*t*Jt^d;3(-$dXpJBvQ5e=F;$?*`!hQV)Gwfq6R^7iKi?5nzr7Ws9m~@ z|Fs@C>W8+~1J?++UEy#+qp)dZjeSA5|Hdfn$6@x$|HLTltoaN74TG@dJ`8ErLmvu> z$zxK+yOaFxiN49cwB)JDlczAhNpxDu7{71vm_*;$f&GUjB_>apw{X(bm5T>0xj1Lg z+)0_^hfWez9GSvk`Sv!=&ST7KoACDX=cOuV$;^1|Ge@#9x4o}RmOLE(bL z2`T;OjbD(kcT7jI0K*rs5h5-+qr~+}AbH0B%~j z3)4itKg#&ucz@=PDS^YDy%=X{ z4*QK={Tw9L9FJZ11ojwlM*}~-lJs}|!>TbF(Vc%OMxSHIaGF|F2m>km_{&FO5b17z z`4o(J#(?b9@=+4J@I2<>DJJ@A!Ftrz3$xI%}DdQJWoPp-4y|$%bn0?Xc*ewzM(rpoQE32box12~R_nz{XweSzy zk=Gl8MpaS^;u>gFb~wFwHLlVz3^UYQj)~+1OZ*TR9?eNmLrC=z^5$S|49TRi*%*+y z0YF;vuC!7z0Ry8`C07Czr4kXlrmKT$-nd-bIvQ)5FgH*Pq%C6gYH$vJud_*zH4y;| z3sIc8up&&Fet$clC?nz-VB$YX{PNOb>@ciWc5Kc_*!6@U$uO~nxt@xnIa~)&O@r&e z6r&DUZ59sa;i{BA)~FWZK%METDkaxNs+3`DO0z;OL{%)Hs#s)H#eQ@S__?%E*d{V{ z3AS|P(((+d9F)|#2SAPE*q5C?!Bt)-iEHs6o;%Z-PQBf8 z&#a<%Dw2@S26cf!c?^oKC4!?<5sErcp=KD=Y=fF_P=%ld<7Zh$Gs%7^+2hZ|(D6N` zCmJl9m|ETh2+bE*Uqbs7=g!lgqnCw0PW548fQC%j!#6-mBV9>z>4<%oq={2L2sP56s1gW|&R(c2P)qT1^12rEg3!rThdKr)Yt3h> z09*PwwdL4S{y4FOm~ZPQP<(!kKu`u6tFG$Z{|w($pY9al#tJO(C`iQ!{N-4lkXmjo zmv^8>?{@W7$*?Lmd!@Ge-_CTZO= zM@s2i5vk5!Q_81Dm`JRk^cI#!a={xd3P$36>l&swaU)RWTes9R;83h9&KEHEnT)te=A-U5nvwzYfD9CHI_E1ibu}O<=mlc zm&!wxQ7F2$3q`F~+S~00^_oEi^`y!{V?QpW+U*Szb=L^-v4^!jOs$fL_m2dsp9 z6!)NDtoaxVS=Gogw$PE_k4-8(RavpNP=7|pfqCeac5my>m3`@$RnlG7 zM#H@^9nL~nxEAf%0Id1AUW;699wsV+z2ir`hzAz}d>Ufz) z&NUKC!!v!%>jf%PRqmeDOGZE`q7`3xWo4egg{>5=F_!sTi+5w0 z@N@_J8Obre2wlKib2s;)c^nEe9oJ84O3 zHy(kgcQ}rpi#PNnQijP#tubDJYiIvhWG zcJvh!yp}#YP*c86L%;5+ShE+mj;d4&beA?hR(F#IlUlD_b11h)o91U=1+@ws2KHl# zPR2Z(QOg1RqrF$geYpl9c>}*hec+O%a`KjIF z`1&qu^Wq|}-W`?WJ&3iVl51kJXD7e4;nsv_wJ0e*dKENlX4Uyno`9b;kReRbeb7Zr zIoi9l_LJM>ww~Q89t>WKnD!JF;3rN>LPg>DYUYVMBU~D%M#7!3q1JMMxHB$9tRAia zA<{yTbSd*39b&W&aHZ@3SIQ1>DC;nw?XlLiyx3GONz=DmJzNPwvzr@UMX_JRNS8s8^xe!mlM5+*o7V&N z)M8&K(r`cXlshMv(kdN}{W6Xvn?jMqqs()(M9B<<)9GGXNUHHfFtvjgTlBagwuBs|R_!_Y%yVxnSowSR4|_Iw?uxSVQ7gXx z=cRMI+_v}DwohKReC}O2fvP_j=qsP;`@eLLNWc55%PxEWu}QzT^Jm|2{=)k+-Waa^ zn7t(@J+0N6rZ>OvTJ)?T{nkFa;=&~b_ry>5-`(Kw%#Y(* z?0vb%!{>hZ=$f6g&V8=+ilc?6m%Vx2xE4FF7#GM(|8dvD?_Tjri?7~#ytJZs@zH6c z8^+~7@y{2tzP;(Qn3H2SjPJPOrbjyIUZL;q^v6{%efw_ROY?$nHlLH9cVww9@9i_} z*&fN+FX>*UtERa|A9&W&e&HpboxAV!g`Zy5CwbH;=lmUo9bCgtfAI9*U!1VN=se$3 z8Dg05;A@}aBf+jah+bBkhph#>tj!UpvRAW>FYKpz8n!ZEo%9DH{Ey3EAh`> z_R`vW3rFuQdgH?HZ*gbd{K8A0{PxEe^S>WEqI>tIdAW`^4|Xp)KJEFxSLOAa`P29=H}dtaPrZFQ7a8W>F}$%k%hBiD5XwE5w=7nKf4QeZNcej${32Lm;u_~e4&_F#?b8)<(f|6p-&LqldpPR`;?D~IR=ouLti!lV!mPLYG@f4bI&nVXrjI6qrw zk)FAWb1~z&9+*Qzb#(^Ynv3blDUT#DrXV|qZgx!$QFo|gjioTZ{-Of9&LXri()^4t zu+`6^B80OigmW;2^HT^%AIxiNrVm>ZbX)yGIQ|gMWg(p05YFll&YdBgCqp?Ay=xfupHaLk2)6(G3D(@8H3{IZnnBKwHD^6nrbHC!4 z{=zRPP7?#OTX9VP*ZcugQxZ&f^+K?1uxU(5$ zS^ts+H?gF|2PoZ_}6y% z+8ADS|5Rnc7@Jq!IffKLy8rz6$EMWJN{TTy559IRMSVPlwWBhBZeiGppi2k>V{EqC zgKK*5UGc(q<4mb8N{TTyTOC-6wiFhAytc9FbL~@7jIr732&`!lG#CM$DN! zf4_aTq}-JHSV?sjDa(MvF2vF2d*$*nSBv^hNioKDUR_y=?~6bky5rf=rc^t+nL=QU z?Yz2yYo9T|^x++#_5%oo7nzP*RMs z*}8zGsI^jbF*aL$SW2%OPenZUq$#C)88gOatFIvif@fVY=Y^P~Y%#`WtDhl79a5X;b~iGm zRw^mR*lf|2#B9rj^H$F==Y_aQNioJ|i>?x89@^K=dR$2{#%7CpZnJ&)VkW*~&S_Ag zq!?qfMb{|PR<8+64a3&~W3xq zC@IF+Y|*9Gw3U6$z$vCwj*?=G&DMoyIIlHIiZM1@!)&%jJlH?Mv~{nNVvNn!aF){B z@}1YN8f&g-w?#=Y#%61T&DI-trz|q1_9-dG0Hh-o{zW=a^jLLiDyEb5c;hd250%@^4q{5~T zE0u-tvX^7=yv61u1C;W)3v#g19!g^ILYsULi%QWpjQ}yk@7F#-0P(FJ;(Epr9~mi2 z0~(f0E#iJ`MO)pYt$fr6V`=~^pWLy7iiXq^+ge;YZ)rwOp}8s^acwgo5Cd=L^RuY} z+tO=rk#%+j`Pn&h)2Y%Mc*@~A){V=}4$4ttNVO@PJ2%^GMZ~uy%~<9xWZ^nGSE>k< zcvS=EEh=2d$C>l9Gq0qQo|nzXoW0Ui__&b#c(T(mv&15-aW_xXr%h0eNcny1M?qfR zhCwy^Ly(tvNOTx+Yo!SzZi@~hZq}_Z!j{M|qEd}*9`e?DWs43YZmp+bY}=y4h+C_3 z7;#&47;%|1f_<=zrPC<8g&#)1sJ_9gSCNz@@=T&!^TQ<85Enog6=o9&BW{UQqDIA; zgLN!Xk(E#g+XA=Na|_(Yw!pb~R5P%^ZETrWA-)@#wM9s_hlvo0{&h)&i4chabxDMY z5D8CR5@8}NrybJTX6(y<^khV>ZDz+B(k!>;q{R)4zWlSU)vJY{?V>&2`E{lDeh3cy!p$PE1vi(pF3p$f&Y12s z!{Wd{0n9V%xrA=o!{L5M#5=%LtM_kp>6?U`_D_K6LvIQYD)9@ak6xc_!87d+^?tUl z^PtzHdw}`$EV#+Q9RlV;dg4WJ;TO*C1n}no^Xyr0q;Eekz35pO;Y|9b0Q10EaFl<$ zfO(UiK@sZ8zaQ{YXFo8z=&1^U9(cl?2j$q;NAu1*R$Z30_PZo5l{G0s4IPk@W5IE%z|-(n}=Pv^aW4=i&1#LO%WWP^1|Y# zf&b7{jEBXKLS1$#|C|7~AOVEBaAd9{Fu4ln#4)GO@=}%L=}Gejg`r~#b$R{Y4%`D4 zec`;qNnb@h^;HA+{#o?V`Tht@#B@rToNry}ivgys!qNGLOCRYQ49w_y=$i=4W%bav z5}51jq3>2;Hq}Gl>%hEQ4}Bj2^W|CeQTG@z0~<@IEC1R7*F$0J%0D;sB-K-27I3*| z(MRdKp`Q940q(i8=%e)2)KlLv;Qly^K6*ji?qX~#p|1Sv0o(wEttw#+neX~Mv-jG=$s9!6rC+_Nc;3A-JO$aV@b_z=0+7KMlXL&6L z2w#}*4Z_ivS=<`-OG+N?o0d8?H6`)FF4&Apo7%b*bf}<1unmU@Qox@R!zaJbwsGY-cO8(T&(W$mmZPOo` z{(xO4?3#8u)#+4I{9(sL?Wx*RKj05LCLCRp=av2So$uAoAxDm`;}OQw9NiXdiC=6KfHPW)b1w>*F1Kv|BahEEPT)ZXjR(mc1v%(|K!{s z?w=TY*K_Y=Ev1^l!R4Ty2En1ZK)W>j;ImET%@&G8DX8W z6Wc^P+{JOln*3>?0j7~L8h&xbZty{4PZ<0_^PdF+K4Bq?7zs=%U65ye5=U5~SQqPO z3Br;+&CsLl5tjJ)bAtko(gG|(F>NSqv{kZntaP{)jW_@hiWOG)qz9ZhEsFY^hzRP% zaLb2%gnVv^ia-Qt#lW8UU;s-z&`~T4J`0l$(Is&lPk2(x5lj=7bTF1pvTdWc8;Jp#z#ZW>STA~%Bvf$?i zg93Q;E1@4VfWseSIG#3yCoTn%r9vwqnmC|2miBH_7x74sX5j%Y0X$t!*W+Lu^tz!3 zs1iEHo@{7t+Cv}q#mv`f4T0!lY$;&t#umpc=%C!e&!Ht!t};*4yuyp3J@F6^S}=*A zH3YUKCS6rael z6w7H+HaP99mt#1N(t&iLb+}>DO|fxa>_KxcAT$o~bmT=O2*Sn@5Iiuz#}ur8&W^dpw_G8TBYA$HC5sdPy?b)9TO(oVL?j!K8Fi_!#r-Z*3% z6&BQc<6K;9#PbphS?49Qnk$au;y?ofnle@M5`yCBh-6qAdPo=ef@KhIh-YG1FWE$# z=+$+KEcA;VP7BMiyrhw2V2@J{9H&#qfJS=R_#hr8$rS+VGVZ1pUzg zZk0HOj_8kA6hS2IC=dXFAtJ;_3}K9lBvBC(6p6Be2v=lO<0ehxTC{3?PP-1B++Dl( zIRAp){rV3WI3!`%h>N_Vl1HbEO`R}l^3)j@&%AtA#+57#_tBOn4 zTvvAe`WtV$`PMt`y!)Pe?|=ufUmf$gm?jg16&k<0Hm3l_%k@G1BoZFTL&!#Wmu9nsm1a# zUsS-ix~zoE1$^tuO4bnpC8qW_T z#z0FBX-SL&l`Hxv3(9=oKp*8mneSMjgfL~koInXd%6z#{!mOmmIUt#t)HpYg=z^94 z))xh8x#*)}Df9gdeN-xCz7v5G!j$<60wn|~^DT!GW+gQ)0Ljdx#>-Pm4>@AjJpQNQ ztZ#UL(`)R>__=toU!g*(GA391h^z8RRduJJD&J5HG5r`5S@3e>e5}um)azG&`Pw41 z@t4tqXmjTpRonlEzubEwu`IP=aay@ID&UVwEL-1@>w0R#)xI+Si9l-nI_&=ltaIVK z2)R74E=rL_{?a3k!k2n_EFBAwYol+Kq{F@w=QXbRHUwSfX=@&1PjK5cn zzw|^@Z0R(zQuO_)1^Y{85(?MWe+@E~0i@lhi zt-?!GYTIM9YuOfM=8c_E&9N2Ou1byC96O_ik86HP1kyOJNbEH+jVZ%GIM8~d zpn7iX2dU8~QifIJVV0#6QThF7?PtoCUOV(0G%8)}i>}549KLlfRNWK@*Pw3*9{3N+7RdRlztx-yXJyZn3{v;6G;tZQHh`O_d1o@>#NvK z#gx93K!<@TklhdGWTgL*nLcKrtafl~i0PN3?P&FF%T_I`1HzTz+rK7RD5N+7C=RqRl!cp`AXfC|Mca9jG|K|lXwm25j&LIK$E7Vc zsGylY)I2V}8G(q@avDacB?ZP}edm+0)k%RGOe^WDJmPvC(wZ-JXR>Ec;5%Q*!B~W3 z&n{o(L06Ke#uwODc__~3sf^uH9oSR(Imlf;Ai<6BRCf0uBn2vxJeB3HHDtiEEl^!~ zILha#F8Ta4CXPT%<>yhJ>dKv+0+l{bMfWEV0w00$?60iuloY56?DoVa1$JU3`O3p_ zXu6o@s%`1Pk-o}m*dOCc4%|wu8#Bk;dL!+9ft>(GQ6tB{$*l&rZ3u@H+A)xk;+{z&x{z|NMJoDCfT!|g?xbuo=}Ta*TSH1F?CMm zp|-&cQf5O$;cP9uF-jU3KJg^aZXdEPu*Wkdj#6{DEs}-PqI4lqko3%GnH<=t60}iI z5S=F_id75Ok{}C15@cZ*2@>8IkL;5@8&ydh@CEky0#%+dloWdobx=9vQwj1ZVS5hg zTq8j?1|`VGPzlm`qja4rK|as^z&=WjJAiskC1Dg;w=)+Q=gohmuqbo&LJTgjWGb*d zC^OHPp4R+PN#Tmr8`WABm{dD^{-DZoF&g<}V@QEn5JrIsPp`@lQZ)#rB~?0J@~5qj zYZ56!P2v;{^aWN+)$y!W4UHXRLpP@=Fkv{llq4>$ zB+mq_Prt)U4IcTH>Zzn20L>iD0=8InKx!T;fJ&OR574=oUeHLJ;DjTIvvSOn5-utf z>oqIZ0e|VYxD&ekce=Oy&bZtn#YnR!wsNP-Gr^SpLk)*bqqz-`^qwCU3BdAew^9yQRk^o7PwdqHLGcRRIL`kJ2Ei>FK?w-a!X*ByAS1XEpbz zW)E8_UDqUZT^o`Dy92xbWBnEN3OM;F?CS2Xa7X#ScURQ?sRnH}J-v_q|M~99U%twV z%t04b&pWI`b=_fo^MC0M>sXz4SU(4M1@_CZ-tzxlcUXT|@32n%zjk-^9qz7Xp^Mss z4vL-?>9G)ZE}rT=JCi(Bfl8X57*C7x2w72C8|A5_2g?Y4u%xF>++lla%45punaxwp zPpP=0jNMX^9H{nH*2X1ypa@r22)TTooh6^sb1glB?yRf@qawE2SJn`_oxZa1cqG28 zTU(k07!TbA^w3?@jbEHqb%gex@N;P&V*5URPVF;nKVa$?Y(HX(=0e%W6iqAsccy4& z4U%$dLqHv1Y9y%rOwk0dqOSmy=%d##qVH}{qL1dx5PcP(L|-*1(N_aX^!*7+^fkZ( zz36KXO7zie7@}_kDA6|wl<2zzl<3OqHi%M(N_#g^xX#UFo|Vl<3O`CHk%cCHhK1iN4LCMBi3WqVH`` zqVH2slD=c0L|?;5U0+jBqOUb5b>^T%-#AdBFCCQVTLMb-m4Xs|cY%`h-49CiJq}9r zeE>@IeF{qSeGf|X(Fc6d*8-I2>kUfuVZJ-1Z#XE?w*ZvrTLMb-tpO$a?f@nF9tS1* z-T)=~c7T%fy$4G4{Q*k!xf<#E+JX{&7l0Cd!$FC@$)H5vrJzLL98jX~4p5@+K2Var z=Rt|Sw?K)$k3fmO??8#Z%`B@!n=N$R5;>(1}M?D0F>yv z3Y6%(36$u&3zX=)AC#nzmgb0lxfoZu!?=FR+Ob{`E?%p_;G@23moXc2J#PitA3&Ff zooBnhY<0Iy;NVjNR<^LrnoPpxArp#t$ooV0$rB1F`io zH5yyE6e0GEmT4U+*2?GdubJ%v^5~|{u@sC61MjrKVdN&?u7sMst4C< zesINiPWs}xzvK&g%Jo!%tlZrRFXztwG2wR7iVpnCtnlr$??n|K-aSn-utr^Ws)s4od7Le(Q3gzpEE^D2h| zWAKj7_>OSmjNcHH;A&1>@HYfWv3z2aZwM9+H8{Lmv~ctWXK+2Mxy0}dL77qC5H6(` zbm*i!yUiDL_?%F&XXk(91)aQ~Q?KW+st2u(iq~^8Fb3=J(9pP_@N@A4ggj3C1IO|> zK{4_;L8Fc2QG}+y{Q!K-NDoRLMFxSAM~o4m+%dNt2FIjg;jiF1zATfszAA8<->TiqOUv^ zRrDaLRl%@EH60JX5T+xHur8)uN}y$he^|4E=+hOYC*q2Z*+l38)}_V1h>?b^2<+c; z2)5$ZIbvV*IrIY`9Yq*N5jb)hM@}5Mj3XD08W=|naMaK^YKWsq<0!JKA?!(#Qv;u* zl+BDwDa&s=ZH7FXQ*XH>H1_)Bga8iP7~f#ZG|9hV$9 zwda(t^lL}*nr{mRB(FKG3g%@G@Tsv$)#aldNmo`RVD;rByg#H2VdDUQ-ndKd%4TM-OnDT`MMn=Zdz+CFrPVXo^omI5U9}ua`cm49Xg6dZo?H{)KU7V11 zG)kvp*Ek_W6%@-`hSWgcX$%$SYR+{WHL+pr`u1pAbqOSUzDy4MksSEhx97C4^ee9U z-sClC5v)aOzSyA#piKJ8$8bZ~>PFg-(AcCJDF)RJ0wXBVH2gH)ueXUm&?Z))b*E%* z56Equ-}!FcZNeNg`!BYRTT!G&jnNz0;cLLHt94AW#s#$wx;rqmSqi(ptwZYH|F#dR zCdUgGcuvpV;FtEHhDl>Z)SimNi&Ceet;G8RA5irV-*9NP(%3akQ83bUo>5IFCG$PK zksMv+Id1gt{~mkyQiTreK>G^3#?8Bo+iU5mtfG5UGO^(HAg=PmUVV%9g&EY~> z-tH^?qv6$9Qjsr5hgbh0&C-T?xfs%Bf1!FA)$w6{!QrpqytP2p(cvKm&M2yjHQ*bF z)WAdCa3_EhDyQqK{-Qgz918|g6AjEvND1V7QvzSeI=|_cSIs47pMNQI1NvwDT-rix z<)wT9D15>I?<#C-nYta@pO|_Y+b@{fh3!{Ny@%}#rszgYWNGe&`S>}tKe5H<8R(-g z@XFB#l<+1Syjccs5vYqTCO7zVERm-tggZiGSYYkkPfqTrrJrC*&#=QaRN2WdmC7M44C7Nm7fmn`hfJ(I( zlv8U4N^+w;D9Mev1~1p(6&bwsprjP;G zEti85UY5bjHF(PmUa7(R36z)5tv_z)CNMP|)Fh_TLD6lIQ@h`YebR{i2$YmoEvROU z`wo z+6rm`B%Io-psrx50@RgEZ3mUZR5d7SuTJf4P>YzV0hPF6u@;`HfNTC($Fb=!@1xWK~|x*qvK~HRB3%cMMI7cy{f8VI`nD&)N+MBV!w#Nu) zDl}-u=yGVmfpghnmZ` z=a7En#UokeArvSq;7u0P7(jFph-#oCHHW6lm45COQpvapXqb<}M+2qqTId6^FTt`EA*7Qyug}=S_GYZE#-we#|RZoNg^$B zx}~2-SfwbBM2cVzTU4>30I9*uC5Tk1N7^cnG*Ab~hsq;zmW0zBdyW_x5GPS|%IgqC zF?{+sPYX(m@|~`v80ditoCz`pCz4b)%H=Pu!W+($ak1;CD%apB8qgP4MIEqo$8$h^ zjGt3mX;8Nq)MkTv+n^2^)b9pGtGbJp9-uw}->D5SsPP81z@Sze)O`j;3!IBA-AV}M zoq`pI@t#xGHKz52%SRPi+z0~`+1Ge@GgWc}l*OpU>II#UjpLvtm9 zL_oDL!sVc3)mNcVwYjXY8fn7_t>J)(c!H8%J!8fj!)y?uLnzX*o_S~1VNFMdp+hLradSO%Skpmu zT+$&F>9~`5j@FH|)&&i;)>$sC^;D+C z?LenSt5G9TquFNlkPSjK2t^v6VBWu)mbr!|p-2<8c(w9zL4?*|ASww0%}T0=c_75T zP$cyt^UfLCL>s!jSnHg1t=4&9iPqV%QfqOnS#4|$R(+lb2tqaT!i~LI>kdT{U&2!C zM7L0+`&H(hX?5^rhLlhwwN0dA8)~sxky?j^CYF;;?9<(o7U;#CdpdAb z;wURnU%25E(1j9U2A)$`MbAG&$SGwGR2Hed8@(c?`A{IU7rw<2>|-yVFd z%Re7C<%aLhz44zb+nx91Yr_V#zCY%XP7Q8vn{>t2C$D>_;<>t{vNF#`J{6_f0&y^sm(~-1lvE)O~j?+H~XCtyKdq>VHd-e*AIC zH=l2xk^PK*TvvSM_(?-QT=wa6M?UH`?czIzY@55m_t2^_x1GNBZ*Okw^+8F~OD}!< zvS+r`oGRbYWa+I>|1~u@zV*~4_jYXh&zMU(PT7^c`k}3hCcb^?D+eO?Io4~%i>@Ab zXYhi=`U1nfF70z=M)YGb`td&R*!+U27}KYPJi&VJD*r~;Hi5aL?zANrsad-v980-Aq)OMYYexlB@?VFW7r*K}kDa4}2;B;)Y z#0qJhx0|#(9d7z&g3xMCPr6{Kpmz+6VV)b?IQ&cwrC@`Na}kanvvE>!wAsd?YnQY| z(IpRFwKmMvI67qG+=wH(K@{uOWqc{6^;-^@dI-vw*G6=1$jZVj2TXkd*_c25SG;kc zoVMDcF3stnexLLlS@e9*P)rnKsAsPPb?u^Go(;v&7*1J^iY#pUgJ3NGK+TF%z(*oZ575W>qMLU$dM=55ItMoLLW&c-H*k zI^>|Mu#eEMj0uy6bRTQx&llC}pASuQbH;SVmcr-9A4N3_&Yu>DaXLKMQcS~@e|a<% z(~>dgD@^kRV^IZy^|WFPUArh|!Kc|Np_tZ;p{w3JP~-Pqb9X4F4P)r4OJ_KweB;Sb zOk2j#eIMBx@mA!(P|P`up`0X4gE7yc37Ky|e&J&XhGe%f$wb4|unKkB%- zrgL^Hj=7vG-MLf1rAs^MWLmEnV~r67#wptT;5WCbeSpu!>_Yt=mc>a38H>$i0XHEgdW5 zD8*@GaHcDcxgc+j;$=PnyZt)s)X+8LN<6{Z0=RGL^QOmP|-9DPAvQ?tGx zuW-UHT#LFTfoc>l)!Kik;!r)5e1LHw8MJqQj1N(!MY2#1|SJ*g|!rN>dO5w9M z4yAAs`c6ahfI%dNU~mS@u`FC`Us|_4qReIE_6&V9_8bk$IQ*ukjM~yMIV{Ep%gKM|d#IV(0 zNioJ|s|QQzw&=V}smV%;F*aN0u@v<%6egr?bC?VA<|!%0*lgiO!BRK!hn>tYr8X!j z#@KApmEGxZV@u)Ls9TH81(a#L6a~iEY+V4ZSr1E^AHKzu+O4D*W3$zZrS$W<Y7 z&BZPcDJjO-Z1uL;dbV`?VpA$oHBZLaZ1rI&H?|b$yv)U9yDKTi*lhI$)_z{5RFaZn zjLlX*LyBxoTe9FKb8+oCN{TTyTht4hw(fiF+}}*8tCbXEY__PUbULUU(d}w8zkTq1 za}nx0loVrZwx~BXZC$F}e48mnuA>wfW3xqFr$|veEj8ZGsPlW36k}|*s8=>^(Ng24 z)aOcyF*aM&b4&XoTeM8Jxs31kN{TTyThy7Gw(fZM$#JHX3r{f=7-O?V*C@L!bAi{k zN{TTyTL~JA^L%1T^-)rcA)}fP9KCms(556(ncz+Xg+?8d6CBEKaByAGIdZ9T z<51^NJ^_Qap>rq?z(J1a9J!#mVNd5!+JV6}SLaZ=z(In9lj_eGP9vQ&S#f3?90Dwd z)=dV-`gBaUCQgTHwA$~J);+JOJ3ox+Qn^7G`x2`c+N4(P&tL>L2=^%|!q}yTf#Y1$c*!V8R3 zCJQIH5jH{M|1kF^;7wHD-*`d_l(M9(Qc(y{1gt`#Wi3n6rZ6cflug-N=mKS}U07tN zEl^?=5!^t;6?XxVP1HgW3J4Ss6!8m)sI1B+n@Zo$Id>+LnIwhZ`~5$^_kW)!laqTt z=bXFWJCix*Du*=sI)Zje>d0}4<5H(3W{(_&Q#w;pvm*FpPKwL&_&F*k&Er>U@+h2Q zo2-kWr-7<~^vNDSl1C-$7$}Aql+1Y@X{#haqV7ahL}TA5xWp-S z>DklVnn?lGfH?V(sB!^RV;WwFBqq!1$5ftCn2VPC^#S!6;gA;TdiOHGM zGO`oVNS>PISk${`Y=m#H60Jkah4K`DDCIEM^3FQE??Z^WG37cE9SA?Dl#tM~zk~yL z$ERk-&>5|Cj&W*o4z;D+cFB__jZ05;pUCP_?Q+Jsk@N>@s%=G0s2u0&gPE$?KQpJw zCr5fPtL@6tbqA1AKlSVoKD4U<-}-gwesbXMK;8vl0cv`A0?NsOyCeE2f=3_oR_~eU zt=ps5`emg~>O-s2hiM#m^J-GP^(x6M+ef2`A?8Q3+}nI;b*Ff1M3OR)ymRZBD6=Xj z42#SuzvM*CD3Zl#<8(kCVLBkk{a>DHIw>VZo<`-BMLy;?P8rj~WhI^fB+9t9?n>Gxmb4{c9T+>e*3;PsW^gaIxi$2#M=Zwz!ue~yt~Ly|JsmOmtp*j&X-;@aJzx|p`O6e_Rtq@E8^>5 zBU&nNM(M`H7w&1qSHO+#416f~lSdo4O~8CDNFD`$=gn;du2{y>-2>x%$ou&|S*vF-cP}Y0@aJZ{B;G! zA>;hzuMYS}12bKZw*ktF4~25e z3yed?`719yZyXIw?tREB1m>0dkhc+-!+M;r@&fa(9;YiW^}hzlWEf=>!Cej?@*Kbn z)Z=vWERc}}%nLHEy!v|$nD_4?kNV3lV2_a5@NKjT4k1U-yKaMz2k@&Yql zkJFWx>TfzQE^gQRG`@r#f zcAvOM?gK~N=`k;ycm2_G4~G}d`#ew@zrDP0-tuVuPV~Zg%flAJkm7~&mPh-LDffY+ z`kUj0^VUoItNC6y-+G_D4;;yR$rsM!*%2UyU{v($IvoDk#!Fk;BT?`3oYW5?a)QCg zo4T0J!vF*$`uLP#@uN~x1~~h-N=eTg)-QE@>d36rVf>2E ze}7V{=Q&ufAnyV28TM2EfwI4;xfd6sdOVGk^Fot2CNK0XzTwgVZ_&br?VJ;i#7-e5 z-gTC2+dA4^cbu*(FcvrGUBwh6xr`D_+46oPy3?Q*=DeRkMe$zM{2cu^4;$%H*=o^I zFdf#H&d?-SLKl5yfK)Q#x{PnvQ9B*vbCw#;;i@6Q!x+x@ftxYAYhS$U8=LEU$z_92 zQ%87NDURJJTSykuWR?!|>G=FJ=Dgmde{LDQzhurm2q}{5&)i?lIn$*4vh2QmXbtpA zVTZ{!&nlVr%30EAw7XDdsAJ7qoyVaqqKMU!PK`i*v=5PX*8vtMC6`F1W0DKC#ia#U zG209~OgQs~YL(qchMA6SrvGHj8|qXpj6T(6gt^BaschFm=VMk!)Ia8VO<+%8y|K%j z-O{IGx2&>VP)xv_@1?M7LOB(citNtBeHK}AZ4I4+rjcChLl??THI;uqBf5&}S&sUW zFtQsyw3wRyC_chu?scYS;rb3!Z{uoVswP_OJ*Mh`5^+O7(Lf6@q`Ko~gZhNyo^!_? z2DO&sj=SRmkO?7={8I>d{XtQ^a_1lTgl&Mk`M##mGJvx&-AsK^_HNIAiJ< zqe*vJu_Njyhq>oZPFJxeH%Q!>_s}YQ!E)mOXH1tX9E4@WDLofV=*Q*_mGg>nR@iYO z5Q@q5fZ^mQEF6Ojko$lE!U=+v+#Ak;Or1vrR-Ipz-3XN-%1;(q7SBpJw-;;?Wm4g= zP^+`B8GaaYqYUP}_drOlm_XSJf-(*QJP9Erz0P*ofi9bdN6vBkc*rV9Wzm zginCsMO=3?^*OEZOT*(nu#8}1Q?zHRm9X+pqeoCC#aoFnULdenF<0` z%v57g7N+Rssg_Jl2StCa2N=j3a}iTNgAzlP*Ov2$>_6~{Cv8vIo`g#c38~uQ8qP6B zUZK|W@PIcoC+4j8kl?xlyAvLrxsW5}PHkbxo*_o$?Cf~ger3GSD5F_2{48Lg?4jXK z82q=usv``!(Fd^d?B!&?d=8w_CUdmlbIu@!+0;%#vkB)|Z7C`ewN&B=Oqz7BDcWfW zDA7)7pw{CPz*dMBrk3I=>To5fjU4wet`??BaTTejK#AJ4QYEVMUJ_TE=e%d-n2$n> z@D0ZgSddF7XRa%}1HiKHvEq}Fv9jXNBD&L5%zN3Oco7~4LYemxK|5UEN(C!IX$s^T zbh>9M$%O+Ru_}E@Eg;4+BY5q{`f3-$%_7!*r>ifo{kF10QvUIrdTF}=v4oRBuVJS> zG&=m;r=X;=z0$S|ru^gPg+J2IHm)9U^y^3Bxlyvl~THevzU~Attfd%exii*zewb?witNBG!&0T5X+e{Bu&GFk@m!)KMi}hTU zJM97CLFB8bD+$W7Nv^6ao#L_5VGY2Z)am-hb3aPW;A?D;NW{Qq?cb`yyEh6Unqed; zx{b!9ifbdLZs95_FbJ8Wg%X~4X{)^sBu$6qRinIFry9Xjs8nZmqL}^$$7hI)*J4;x_%2I$Bta5je!#V z#tusKoBw5X##$8(wMNy*sGd|Up=vl~TUh7|%3z=Uv4xO;K7adQfaIBgsk z@+b`Kj1B{g(lTl!RA;R;>VlE_I3sXj-wX6jftpd|LQo{DC&x9$y+S~W1X|^wRDq)h z=z=2If@2V<5`2{4OLjaGO+2#_ia01>^DRr$Y7lZsCjD`v1YdIdBhh3Cd8Cq|4$2RM zyrilLL4L}=RS|^mNaiE`f+GEcIW8o$vY{4?L8@M^a;kD^#RSZ49BB2Z14^yWDI$Td z?Qj+KDJYVc$Z?JF###LxeGKO81k`I^Mk}0DhXPNM1x1fm1t+0;(y)<(FCD2!Q|ncc zOXX7YAt-7&A(v#*A9hOcC6@*=>a|%FLv5qeQ0;Qisld`oMFAP6qzVaw&k6~YSG7K7 zD+2M|9v@L3f};9(isKpwRxkuc_5y7%C>)e3aFk0yQQZg*LeZ_P5`4*~lB@Ng$fbHv z^{X0$T#`xaoDzJ=rD+)T@MxeIUzg3N^nFa*C$1~P@ZEuVDG!38Qqq>2`fDKiYlyM> z<*KKulvXaPm=wUZO7|;Td8A(n9YKgX6%@%U;JC)-0Q9d1i~*7LxjYIN)uzBwZ3>Fy z3ob$(@#qJ>H9IGBVrq(| z8O%u^51-mBJaTHwAVW&dgpBlwqb<#wWi^MHX^w?nXv;!^#nLP*$Uvyh7K5c(c-yIn zvXHDnE$KSArD5{O@j0oMNogL;>DgH=E$LaEVZ>}mp9nyDiY1|!C3(_B`p+BkvYKTX zvc^ox8J}XAI4RpQW@JW2>O_jSG;Njww&cw0$GaI~W9(9AOJC(XLnfX!D2A>34_Es) zfe)}sce&+judB1(M(zq}?e(0UlLzSLB zJm6f(XHWJ0D=N8-tG%Ol^Rk-5njO2<^T_bCyW?+EJCLA!KeepE(J3E1UwcAP?f7Qh zCXCYm?svX-ZgA%z6}Inwc43#zPu*F)w9@%0FSXkKS=lIm(W0%BDvgR5c{OI{hYf$pa26Lmacz0Z2aT>Y`t3jePFwPF(=PMp7S1cJ z5%>4i+-be%&ls|B@SZ+xXE%HQ!=YP7Eg#$PR^!H%Yko8gCc!bLF}qHj*|6+|21jFp zju{rLX?rq$=nMTXez?)T|Igei#*7`a546Z@Q2BHF?aw1m&z|tW{+me^9@_LsOnCgC z&%e5HU9Y@N$B#99-gxEr&w~f{pWp3)Z*I=4^;y>I$7-i7YcAbAyY0&n-%gCIx}xl} zr(afj*WIP@JqA4b^2||{7frp^WJ<+56L z=f+d649UG%WBlpOHLLacB529bkhR11ZvW3Kalhy9FPNU&21(lt^OqO#-7(~lk%DSUNl!;aP`GAj zVqm_PoH5N414A=fusKl8vzePahT2Oujsr#gh*WsJrofySb0{;>E@ zXQ0aUj?Bdvjrjwu^;%u3Vb|v}7h^QKYI^BXxxSOR7^BfeGl9uiA6J6p?$3}^;~n}7 zi~?gcx@sd%E+!*iLA{ME z`GU&TPv&BbMpr%N614;V>G&`_S8CjV8##} z@}=~R&t)#gXmo{Wbe%08JXhsXc6E%==z5U39>SFx=jPu{Edg#_iU}lRG`i>!jar8V zFE4vn<*Gx=3j$*_x=4%3$X8JRG#Nce<%*EGM55Uck27pr{VRpq)Nb1_Dvt0{9Sx~9)Q@uAA~ zfV>njMx!f~xs*O%n%*1^0+n)gl(`tA(bY_&>yMcBut8C{2FqNG(dc@Fxs-nR^5R`4 z)!6E3nTs(RUClMR);!o42Nf#1UX{5RqtVquqwAxu;@?z_$TrJdjM3<7snKQ28`weR zIwo^5Mx%=!gNdv@c2l{Q%Up!fa?x%@t-~4n{>Ju4sf~>?7h$wqv^7$7y_Y@%TR?@YROTX#mW!WU zxNGBe(^ns=Tvuc+!f3fVvM!pXDcr6Ywo2uyC07z*v|P03@@Hf>NaiApma8*!(YjCJ z=S7wzRo4WWi!fTQD8!hIa@R3*Gg zV=~g-lERcH1 zn?e|UWu|6K%FIs89651xD%!TSrzv-CiZa2%IY^w4r7G}@$3rlk7=b5COrLTx(tXCKCTIAJ zM>%}Or@?M8Welq8e`svyzB`qTh}7R+rcS8RL^YXr=AqgWsi{7h)r#}7lp@(4$#{t{ zePU?1PP_*|XfFpKB(%AggmM7o6oJ~foFZ^?IqcLG%3+s{aB{hgsPg-1L;{rCh^hoXjYxoUia-OboL1oEa@c7cmc!1;<>lXl-*^5! zB=~M+4+;JO|Ce@vve{pFOz(u=(Kac@YK2iR4N`Tklp)da)}FoM>{1`6&8nF5kzHS0 z_jbzv0c`8nLoxa56h4)3c#*4qVr*9a zr=xqjNojt|j6XhzyL-FzEM#6Sns39$SZkck)~ipSIJ;H;m!x~UgkIg-$^Vmh@JCAa zJ~6hq-Y}e$%`tmqxyul3x5hZ4W1WteK34IkO80j7SEYM9@wbYHn2x>e&Uj~hjHux( zu1GscOwr`FUGJW;F+JmKF;?_nvcRiU>E9V@p}y|4j*=}l-eHf9 zRns!ui5+61r5-kS%F|ZbH@J<=g~?_RY&JXmPi!{ZMzo7mZ8k@;&E_oZc6-YAO1^A1 zyU2Pebsk0eb3_Z>1uFxY`4GC7yN7a->`>~BRVVj5#16U~K1-b$Dg{uffX~2xD&oDeF^^NO*_|?Fika4s>^d*mO ztF8jmOup0ehwBHuoq%yY2nGb&dHa$_4^|HXGg-dhq;0V;9MxYbFh9sRfAtrQgww!; z((@+-e|k3~Z7eWN>4_5pJuUF1cQPuLY+trDVHm%8;|oVOH>sflqg;LAnjvxQec&iR z&)p~Ph5NweL*7fkJwzEm@YfGYP=AAfu{0Mr>W03`u@mwC0JFV?!1-&pjga?HOMy|Y zzU1{s;$b|id4!(4Ah`Rp58E}nj1fqKUt87zz$JOe^JQyGx3aTznZ4|yrTWax3a{E@t8fmx}? z`H;62m=ZlsCy&PEZ!!iX2QG&Xd4B+R=N|HC`l++|+x>qxO9fm=9!JdHGupOwm2$QF%`QbK^eb(Tj=I=qVq9zw%Q49tEbG z9_OPyh5<81kJGg;YVW4|#R)Y|=u{ClUOWm*jN= zrnesFL*95`rs{FJ{BipN^MQ;jw|#*rx`#Yku1)}RN00N7zxv@=xA37*UU{Q|>8Ho} zke30>3_VU)UTWW0fmtWx$}8_yU`p;GkIMTSFcsQRDas$e)qtrl({p~>^|q+XWEOdqxS-{uS6>~-U-o_}`8y|VFQkIGGxbK@EqBd%`m`26ucHQ$}z_iDG!u0}tZ z)-Kug`;d%f=jK}bMLgesR?g9o*BX9Yedp>E;~SkiUq9l#S(Pm37XGp6)Y+(OEqndA zFX@#FXTBbI@mS67PyKpfZ*0!Bqwg*nx4-rA4aYWi$`AOaD0+LFoewV`GWgc4>fer< zo?3HY@P(CK-~RidvGt3xkN@ZQ3Qdz6mv*|ndPl#!D2FvOY|Z!;$BSd$={x6*#a~_f z_|q0QHZD7N<=WAcZ>*bH+GBdPoWJh8(D0=?IqPP8VtVt%0jIB5Njo2r5^g9n2fUMmHkH7->Rjgl*g70?7OW2)176#vRY=2O+iTF|XQ|m;#XIwN;XB-10-KkD z{36g~@KRV<0*WDN=1FxygKgPTeBmem#k!ehjGcK86K)QyW<$sTxCPnwsb?$~+HR$p zCl=xS?%*_YMvXTe9I8AQ4+It#XjCV_Moen~Y6%W27V4F|&~z!uV+SHzO> zqwqCKmBL_HITOF~#jjgx{WuF_6CAD`P7{jJ$WBIL)eKS_XT=05w#XQz^xjDsiQbsO_0=iHekR?*wMHv*rF=+2Pvb2;0pa#M~$kIl{4d z=2`ZN3D<1qS=CU9=o3ekvPW&pJWU18YC;SO9;ez`9ED(sy^O9?)voJov zk-ICHDpbn-Gnh@~&?$rI7(7@m-VJt`W423Sm$^rym8pGKAW6<7JP71Zx(jQ>VDP)p zkMHJxhSX?Sy+5Ah$o(eRk^67B`I%~fC_QIjlBYc$tQuKrP9Mp2!hJ@xv#@Xu#Be5X zeml`BlfXAJ2XnkFcSo?fCTv@agK?g7_>3JFDoU_Pg=M4Ybz}uh9g*y*sq3k7w&=(7 zmT=Y+pTvdTV&Pwfi}58Qf<P@S;7r1=5|Ir9voTC>s&lsICj zFk|nA$_+4#fVd=l0t|C;O=PM7R~x6k49d>b6S#Ka)Cr*IC4vA$e~6cG%6LBQBzG4rbdojs#Vivwo$hy!% zjuX&|n451C86I(izN~4BsWmZIx;u+}tf?~@=VsRFXx@{%-DuupE2z^kClHPn0?JA* z{0G+BaN+<1#a-N`IPY|Bc}@=reKdDxaPHmk8LMrZMF)UgY`hCch+}yWrG!zgMd`kM z#8HjR9cT_lj?6VH%RNV7fDt52s1w}23}EEE3VBB5B*|v-#kKKUbc0+_qA5QH)fpe0 zL`tbloxoKz;3ZIU!{qPIZlfGYDdlbxIodJ^HLe)=?~1VmnjRI>+2p`UjvX?m(79|fZLf{nA^9LEqG?7+-Y?T*>!QyW-L799O6cxiRS>xhZX)N zd^=$fJ(WBhWWbF{_H5hNG&+^}?*FEXpt%#24nmzp?Iax?Q8&qS8Z+Dp$+ZtoL{7S$ zh?p+GJ5A1Wlx&e?r#aj=Ol3WTw^%8|?tbLNv8Nf-H{=pvnt}~2`SMZci8U&k%e9*rZqVl)nhYab#RQn5ib9M5B_A3(-^LcA+Uu*Dmp{gZ`R^Oyr%eywFl` zQLEvnvMVCn0FPFqwpa+1w)LW@^>W(9WAMc|T!+;1Q@xn;f1=FjtIM4K4Wcj9Mw5fZ z-Qe30Nqew4{5=EJg|?oqw6)dn|C4s6X`i!*2A-;GbkW{aOZuj!R?#-~BE$^BC&2Iq zuA*6~uZ!lVt*vPOSWu$*$;*(yk#8Z<{4atM&5znV2X-2FvJ9(mM1rxp1}M)ykr&F# zp=)q`2m3H^x~^i>N^}371E6`qX^7ZFq!d={j4ClNIEV;G*fwWWk$C~NU4&?88-ut3 zCD#Ip7(`n?mjD{WrmU1Y!872HT#5CmJ)8IdN~XiG%_nS5iex$w4_E^!|5A26?oIGo z0N+y%*HNLzg!#Q#sBw=q9)m!84a))yOD=~BExu4~)3=zEE>z^bzvO}|8p^mjDygz$ z_a-%wb1^W-fJ(wAz(6BKw8yWYL<`;mC0ZsJ%%Ww&LCI4%*1%x$=}?~*SWGMx0f)vN zWYKSx&2vh zWG+Qe5;&Vre(tk|6KlSc?%GHHaF^2yKkUcDyL%SmY1B9rf~YG^Bl+jH}zd~ zp)T5^nr9nqLStgUi$09|iBt4bo{^k|D?(`$Ib1_ATTjPsb$Sbj>zCohO#l+3(+VmH zp8!J~u40##2C5C%0u19oJ;|xlaUIIk5?pD69%!I_Xb{K!f~y$ge}SS$yRf(cMvV5y zK#}wSLoYX#1d8@90fzCQMldxC6phLNLm?N`+o<~RjPV=1=M8j+-3Bd}!L#tti|F5P%}-fQ3*J=Su6vYZktaklDiPbIzl&G%hpp+ty54Dg3G|c`P zs7}wKD9$?1lPgZTP2*w4d6sbRfFcHM+KKt<936g$i3wZIRV+f>bo0cEEi~WPc`R@I zo2$X@+D;(X4=nR*k_D;RmA|0pd>2Mx8O@PHV|)FfP~M+6uaxGCBi^yRpKXe8*4LlPIK%rcaITU z2t_L0N<0(Fxp6nricl&l8i}%WA9Oqkh;6*^?1PPV)S8j2@?EM$o-|Sg9lI)>nZ5JHjr6b8nKGLPwdyv^TCWvc8;f)SP>Q5?qHVH@SE4^mZ}- zzDiFD>gWE}Js$h$F!)pZ8xMMekzeg2cRYx-U6!BdI)g6bXPuhv=em<@cw9T%X~q*> zdSYv%i!%t<*#kO>C%Thtrw}(F2v^|nM3)oIryNl`Gv9V%{|x7tcLOs!*>X?gfi7wc zu7?k!LJaX?s4Y7`(ydmLDh$tdjZhp&&vm2mV7KNiDQZ_H1Z~S|93S=r@i@YMz;o?r z^M-(sw#J14A%Ghlx#x^I7bO>}lAgp_XwTjPD*^uG2qbrB!5)sa@USNLVmRI26=sJH zqQzEhB9%#!c2VSS4v#}5*I_vE60=6`j&MA}Wba~qz!Jdbc)gkGiR%+g8LL(_R87Gr zGQdzZ15pS=#TQ>Y<0{(&cX*SaY*(V6U$XN{K*y^gi_uC1}RI_%AO`<}4Ad_>C#it5M3aUl&W z8O$j)4Cct{2J;fps#c^>OVCV$y$!--7Dazh@(OmbCiwIsx9+n;V{lt4E*qRj+FW!lDZjcZjh)Vf~7Q2h+* zHu3>xP&lcb1fFVCQ1w9xPD0V%LJ7Wf>_Vbi2Z~&(12rFlqPz>aB$M8ASAs9O`;dq+ z(5RxJdgP;q>c&S5m3R~w`1De3-`%MQ!uM$ABmIJ+dN|B+Ax$b9f(HyV1RHxB;509z zQWByOX!l2@SI1Q^ju)3P_!9LhD3W)K(K@gk&zihg^E2fJSDZAvm&*A$T3T zUCgMQR7tcS@~9n6^x#AZgF%S)6BL!Lu8?P`Y^Y&uZ>W5VdqaX)r}2IsQnm7;J>(5> z%M%pIqrJ4rU35;LG*qP<^q zPfLr0ewMD50sRKXwzPD%7|5zS6-U=)jLgcSZ!csIo3npxOCWj{9s#{>_iy?tXszlQ|E!>GsF3z3L2k zsqomz4cA(|d9dG$L)#w=Ix^y!iVZ6}s(c-BJ-qUpU%e4M?vH_$t4-7BCVR{nRXYqx)%eYJJoMAzyD2(pElv&>D#OKUAuML%CuPz&m7TkUA<`+a?18*{dJ(- z@FSfR7k}aXc8=Kl+OW94n!Od!e0}7Rm6e*k+2+^TA5G7x>m1X^)!B?2{c`fB*K;H;%mgf^}YItvj!MGx)-SxW}J-qT{576|3&Abbiq3gDVEE`7Yk| z{m*;#oW%bizH>PiIHsfyfZ3mVg z?EP?Z)xJMpy0N6*(4+N>N}inl-2BujbvhjC_r}V&JsqZJhFFt^LE>#W4|5zVWpGpo_yuTVe?yiuUsE{{OHYl+y8p0Y);Gaj4@UnmZTYt~JN&RCy!g%6Hr0CXFWbh?!`^@PseLh~YRPMFzF)mX z!|N%39(b-(?66Sh;qOkge(R4a4_y7JUz6oCUhUJwFyha+uFaa&$mCIlE^T;v(fr-5 z=SNkZn0si~>Fh_WQKr{3GWQ-ydVJlFQyP6ZYqjFCaLc8Xrk&=FEj#Qu)aRwq&$T9A z3RZYO$Y__Rs&4shA!}zwE|<;C+2C&ptwycz8<>2n3g>MI`0oUQQA#GKOYx+NZbfedC&# zhdkv}VvM*~0%=B zdZ1Rn{N6%u45gTiJ8`A9_`CbMSZ~Y&j8X2*JG?Z0kLV?y{g8G_CS!lP;`8{_D=vY- z559k(?*|MPPBj=Z=_dyZ_cw8$u8mnCBMji8K8aHYy<&EF#r!D8RB?0B7^P6d9aG6D zVglVU56LmL+%d|NlVEqu7#UO39kW1=sqK#WNRFxIj@co{)N#kqnOqdAx?}#8V^sH) zbwz>EZc5qP%Q1D`F?8w#1+zOwaTFNfj#(^YL>;CjkDrv4D!AmB)XdCD?#3WpX_MfE zSb?w{9CSZ2MH@2(r=n}*z&#Cl`;dc@=T#c*>=s4F)OY7_lZ>f|80tB=|B+)VyJP4$ z8Vc3jF%<+9eP7|CKeR+pw71g4kVDT28J-w#7oUhhK|C>V`WdPGrtu*handYFf#w$B zh?9TfLbE8xbW&nyoN`RNc5)QWejBU$3!R?8p|BhsiTacS&L)Z z%Mt7zUF!xk1WBrE&NqMg>RdrK1A@XF9$~8~sVvI)D!x~+GKL7iEmFp#$i!mBq4K=#H zdFn<3mFpv!i!mBqjhKt)e^7HzEc{I6+9q=`Mx)E3(RJ{tX5Xn?M`bR?XmmAZE=AXj ziVfDPTo+_6#%Odk(dhcA!6)lfE@ivJ7>%x`%tbwx!dvehyRJI)tV@d}0%J6~u*`V0 z*UACWRaLGCnTs(RUCo$_)(9g$V~4yLSHs;86J##NXmmZI(e=!}&AU~ui82>sG`gBI zmr|~An~EP+oubma!4w#y(bWR6YClXF68N0T^}fu-7>%x$%td{k%C*wGGNX>WTsvhh z#%OfWE<@GzmFsu|mFqW|i!mBqVa%n}VO;yi;;OoJRji0a1jcA|J%(6S*VvycJ)?59 zlDQb8(e*fUDPwu()33Erxt@@@7^BgJZIg$tHP4vVs9bYoF2-nd(QaRLVR@uw=TepH z1DT648eKF~s^wZc<-mVbuJ2?n#%Of4VJ>BS4NDtPMdgBDN)C+C=%P7T)ph-@YoW^3 zqLScZj7AsjlT{b7^Q-o4r*id^xfr9-6{*p+q<@#`D%T8|i!mBqw6+Mht<(<-OBdG& za`%mQWiG~ObkV}0mg~~ixrHj%PMM1_8eO#dscv=);+q7jT))a(jM3<#RZG=X`I#*j zRIW<2eMex7Mi(ukY8@J%I2x&PHJ7;L_;R(L zf!&wfB@F2@7h^QKx-gfrR<7y2d#lQ|MCM|QMpswnqIHehYgptzr|Po<}!h5cK!Y1Dpz&dP9iWy zqpK%kRrlQX89hT)hq(=8F2-ndNzA2`YtXT&cT}zjnTs(RT@L0_`bORC(LGhJIGKwv z8eMT3T@Oo@=BixDG8bbsx_U8}*vo-@&y}Ha&5*emqtWHm=sMW^;>#-6GMS4p8eQ?s zrS!uqZ}#n|a(yCmF-D`Sw?^0I<;};cT)Sj0#%Of)(db$q(K<%uIwf;4Mx!f1qwDD6 zFR-jCv(0Upi!mBqeVI#{H)?g5@|x=Wx>gVp5g4P<)eo`i+*?}lr9V`z2$_p98eM!Z zZ&Y;UhjeSA9tO}~<`Vb&p6=8KXmo|{Kd?{bnjv#BMx$$>n+t@Y*}lQ}KS`;Lw`DHI zXv+13n~TQR=Y6WzQMq=>T#O;1hI5FKhbr!KJ)agniByx3WKg&~B?qfm1@XgRsVWG< zXt@RlHvMx;~V-2&3g1&Rj|kkL_)osdDX< zxd@}>8o^wO^hIa?yrXgj&}4={7=Z|pV<=WDClN8~eeOSJ+U-?%uqT$e2&3gn(r~>a zJyNW4^^>^>11=9A0wbA=ya;H+G;k<>X36nm;-t)!RG93iW~U}+;~`7x#O%yT8PgK8 zCgo%%r_%FeUChKuh~sC?Ou^Z2&iHJ?$rQ&b8m2;`LT8L0nVmK%b3)?NshN|~pH6ir zj7-gfGvRdA6E8*Jd5#u=XCC8HrzNINOx7?aXHLt=hP&QT?pVbGfmWtFHY+t%bxrJ! z)u?mFl0V~&%+!?hWb&U3r^{LCS=l2eCaXEqK$V*E^q;H&Oq>MXM8C<9kIW(8*{PZE zVCh{V0q~B`Atxt3G6nb0DU&87PD#%mlQ=TPN3jLKTOdC=gVRUkCJp~UdIN;U@(@|6 z&nFRNuv_ea?rMV7u9L<1G!OfYdtP8IXz)LOHDE#FB?om;S1i$s;I<^oIKF zx86`8Rh_o(DfPaf{)+FO#+5cvCS|u;4}>g4UR30YQhv#a`lUujc||Lg=aryTl~;n& zsk{=D!RD19I3h#65|p9jl^{6U`Qz}BAQ#(RU2=oES5&$D{?q-njOTuaR$hPo(hH~0 zk-GuiE44mP-iZIsS9{x@@y;I6a49}zl-nCmxLr}p9D9m3T(q9D0_`}P(~r}mM!Qb-C) zncvzl|MfLvzpRHh7UUZm&o^=?ik`lYm!B`n5d3Kwta&Sk;*0QEuESXk!O@=gzl8I3 z_dAC?*m)cxN;rDzW zt5$~xRD3AlX4@x@-WoUr%pWxvhJRyy<7xr-s2Rqe^gs#$KZQJxZt&Z4sN|ZfUq7$`7q8c=lSlnv95A!>I3MMB4Vd@!IGsFd z{$0R)ugCe2_ZKk6+M=}n>V?KbBN-!*xcaCUDu+df^H(pCz*+Trb>$#=BY?@&<9w83 zF)%CiIGsGImo32T(c^r`I}6NpJxhsrU)8#vl>+)fi=mYcM^6o#df_nM ze0UCRro&l-eR~*f=L_fYbdYj26&*TOhx;!)jD7}@IsYpjMsboE9>U?IvGfV4|Gk^h zSh$~r|3cR>a-`J28TMn0c|)D5HuHum@i6y{*kiAH(2;xAm~+6^Z?PwmroyU>8vjVv~mBRMp3%2)% z#jm6Ei%9W3+Zh^cH*ZV{g&)+}bwWXQ33dApj5cqyx49c%I5{xQW}di%N(!f`r5H~= zZkPv@Qsgf3x@sO!!T|FV2jLmDG%dQo-u4Di_8R1gWtR5m#8Jh7@)pK5U!DaVVybYPHQ9D!{X> z(c0vIt;zPFl7-INWjvFdrcQ08?k!QzhKrFIp@YcjA9wL##q?*U=!SPeJ%dkxArMU@ zD7kB5`hlYl?vxlQaCql{qX5@gxD#`_Zabq6Oc_P96J(S7J~0{eE)0Md0sh0%839jJ z+`3Z4H&R3?&t#5>gWPTRV8CMxOE-^6RrfgHY!?GqD%*V)88MKftEiKcKbA8-3>imZ zl92mwcDYzgcS9ocHaFGFP0{G2buqvo+F5e}ZG;#3ur8>oowj;5v3%~EGm z1?WU6!Rf^GiRt#{F~`C4j+;NmWAI_F0!0qdx{(uC*MC%RnC1<^<_!`&2w07Bo?_c> zx7{eUH`#{9-_vA|J!qSKAqHFS1!K-3^9FmjGSnS9!a|~=PMYUEif$x47N7=$J)H?e zxa+I4o1(WpM7`2Kje=U>ruMrjOj7loE^0^{rX-9jcr(r@f}h=60h!HhU(ih=d~9Hu zlU?lE8^ghuH30LB38ONArkRTlR}oy!@ieoA@Z{Kc-V#ve0bJ*~r_9_7$*FVL4;cRB z7a2~cqA{pv2ZTCI+w87~Xz(M`7*-N|nOcJ>FU3&7#9w~Zk|hLG&4h7cG_hD25|gtV=Dx%R1=MI_)| zy2zm+zC|SniYg(FO|Ilbi%~TQ zxg?Vw1}Q)e3a8zVLQIQ1)pmQkQwA;gnE0U~EplqXiGzX`V?m6G-75&WB$FNxD!~FmpYJ&w zXEns4-}Q&Ppecq`hSi3(h7uU@2O4YED?>U3&u^lYk758k_m_7Te>JNjZ}SMh{rs}F zB?I1@@wRQ6^YibTI9|PK zEL!o(`9&osU+mgy^y$DM{XaSWX^oHynH?X!{m;3*7skK0^rsOEgQs_#9`$7Nb4hg{ z88jkrW7*^N7yTZZx4voj%XM3=nBAuMc3SD(=o2NsUH<#*@m;lhhBoR~duhY!FL(O( zwLU-pz9MjK@$4VJ?Q5L3xLvEYN8+|$eccw2`(VrJhNr{&4sW@xNt23QhP~PN;_{NA zX>D4qTAN&N!6?_54_dYQ_2lh|H(Dl^JoMA*!!3>TO0WL=#*%+8)%#=fnLT^&zMZjX z?XGzZU(E=4%Q7XT;ECA4=JRj0+<=_KO27UWFI}?*|nKnPd@i<{Vj)wTQ|M);SURY|9k$xlF;Wqdt|4v z^tbHQCk@a4zce^4q6XCj&&S#(q^Pf2X<*zxDTXk3mB`~EH}zZ-OyxyLJMr~T;^D9- zhQ^S|NIjUQkw-f&TI7wP2hS!W&1j^f`uKsvy)l&;^E$4i^`#275#AUY!+5nDx=7;c zEl(ct##CVpEtoW@qz7$X1ce`L-cR4E@!g~J6Cu!GLD?xp^OZCxG4yI31v2;&m<$nt zR{)h56q;ERXRYxR)wkNF zSFYCTshYa1khvJ6c`30fbJ1K!ZSm&&t$tLwXwOH1F`CD|j5pRn8gZSxT{%YO`kq)2 zgiOzuEoq`rU+j!q*SV6)b%S|?CrOh=7yVnIzEs~kW*Xkv6*IMP;XsUx(Ui-~TuQm7 zzj5|Wm5Xk3DKJK(i)MQD#k|knZ#h^stLZOuF-D_{o~5hhI@tZnEtM-v=3a(yOqF-D_{TgoVM4*!`)-nFS*-^pB}H9gy_ zu144C&7<3>Tz|=2jL|&GtjAo`XDCd*bn-*Nm59fku%zd}7)=fzK)k380!(^$lBB*I zTTcu#7~}$@sSUb?RBNN^A5F%qToE!CV>G%#m`mxsH5yk)Rk`}eT#V7^dQhXQV0HKi zm1}~`#TbpQ2F#_@{O(VS@UA^?D-cC?4XXg^7tOms93qj7C>e z=2GU3&nEo!yUI0D=3pr~PUd2aMptv@5@P{>Z&axBwaRr^=3Zc zqOd9V1}EdaZ~3hj4_$!lw}qVf)vhd%lB za1UP3_tSiEd%iuUN#;N9Lj5LtXIoQY-Wk^>i>zy;YXLsgYXL%n=SzrGrD~JOIVcC< zvk26TJ}Vx=l{6pq?vW~TuBmp9RNnOJ4lIl0Za=-Ig>BOw0`_H(7@Sk}F;lBV1 z!hazYgztiQj1%7_@dWtEh9|^NK0F~pioTC{j#xk4$P?oE4wv#`m+}sm`ul!g^}?H8 zksav8EjirlO|Q1?I&=`PdeNI+Bl%6QKf9|w8-2a$)rEHPp25ePUYn3UPKV<+y>$Pq z)5fK#GQZ0*tp@zF?r{@L(R9mJ6}#-(w9`hQS=!f|SzWM1J`BuY+V3LJM$Z?HJm!tY z?lwbS$LI#o7j7x?_Yp8w5`;iS@`a;q+fiU%qkS6!-F*1MB_O^hc4;rsP7Q$;Gha9t z;y(nYy#)jUt^B@lQ&5fp7K34LV?xmls&Cvf+|O2Sf;UuX7l1GZA7An|Lf%KTqIv{> zxMW%}J%TS>f22Ry1`8-Y6x`+T@dk)X#t0=H=??YfV>T$aAlDs3p z{Hn+KkY|cOKgNfGyBt2`JuYJe(tmq&1GDVNih=oF zkMkk#FJO$3q7>zow-GR{^*A5$;(-~g$LaD%?J)(I1$vwhdG7$TR*%!kqxtWEj1eXA z-yYus_sc!x)qxOWJ4KTC_BY<@0@ql^`l~;hM!N&^q#oy^yg9(k)#G&KrTTjvm{0XM zAM*AAb4-uZ$)o(;1jgK6loivQ-}xm3m}WAryz<5XGgOcBk-urc#D|(!ddf5m}u^y)@FZKJMf%!|1^C7QxNBpOT4+VearFQEIOuQcF zL*6)Grs#3H{E@t6z`Uc!`H)u(%mF=4C$B!_T>_?JClCnbwTBs)1~SfHd8z(70TZvs z`N-cmV5aDCy8Ll@fq6%d^C7Pom;-v8P9Ej&5-`TjRNC^(TNRiGWSqb9(j$p>z>L)6 zeB^I7FfKh#mp>}+`@n40<9x{b9++SBIGsFtY-WtY#UuC|ztw>Yk+J^DOXIf#F#Tm* zdHrQLFzNRpZvilG>2W^FyA7CqdYrDjRDTzM`CE_kAups0=5c%|xXbHfo{W((0*UK` zm?w4jDGwmJrw(TgwpxARM%)LE{*=nO4;;9c*qOCIX+*03`* zfBkz~$b&)s{=D&eXza;8%OChS%r^bE@g1l)vSVeMwypSt&8l0k#V3c}{qSbpg;fsp z>GJm=6^m4AA36O+uK#QH9Rw+Z`2nLr?)&exI>HCZ_TW= zJZE%|%0czkkBhh2Z!Z7OYo&25X3WgDuYC7>NJ-PxUr)`QdFMpm%U^vxE9$i+|2VQA znAX0_-Dk7b-2AadO23leYhiO1Py2P$t@DTaJvMH-ebLZ|Ug+DadAHwUUiWO zoIi8Q+(zvls~j~l@cYMK4t}djos-x19K2*|x$@FStzLa)&iuv+t(U#^W2OFGj}IE& zF2YzXdeyNC1*2{>n0{;JKjQ{A>M{CQZj03wy2rM9Zr+!@t`?7KHT@G{AE;rS3k7(>8=YG z9&7NuthsL5{(h@(&VN7Y+xn|EzIxRbRWzZ)tbM^D=_?Mmn{#_Z{NK#?fhtEx zH8y=M`}a-}54>2^`P}}@wAPO=pSkAn%-ik1NeFMc;>usG(yEMqz1x{3-N&7NC3<=3 z*V6)iH5ejS&R-keiyh&7yk+&3HCr98@<*LU2U3bQw(eR>7RMCp1Uk4`v-_!P}u$2(!CVan|?xPW191&bQwy=j$!i&M;m{B3weHI@bW##@M&Z2GwUOS&1O9_%|0AA-;kHaEN zc0}&2XS1tzr7W5A??S09_g|Aa|2nAr8|J(>@a?JY++sv*p&G*}V?`ndcndm7$}h{V z{cPS4TSUUd z>(SJ9>fU7*%=&y`x&Wwz8eEQP*b<xJz_QS1}z4PQBIX5!B3nP3W|1a z0c=YAD962o-@Q2Q4P0q$4KRFyYd5A2;fm+ch%*8m&K%^PTX2Mcq8&0`Y6oRy>U~g; z;1gh|g}yJS{-6YIET}$=o8zXQ2i2ZAUIZm1zXOVL8({bbl;AxADuQu8x^ZXRxGSI@ z=hPeSRN8k6DfF*-Z~l*{G=7>_*9$fsh%WZi{9GYHw>oh5-x>$3dKY(6t*XqvQ^aNl(s#$PW(wthk9fyw^#q zWUVk__|Rf{mM*%*AW))PybUTAp8&%iH+3A8Xn@KZtL-ket-5tyANR}Tx#(3tnf*)c9;2rLeQot{xWrGDxOBrLbL2(=Ax~VWBIb zsKTBwgW4tCyyOtl^I5m`&9r3S^k7`u)(7#ZkXAcFHz;P2m(L;^^!y-^t zrvBrOyW@_d-YYnIfQn(o?CN@+OrxxDgz zjcM%2Fr&M6a?=2{$vwJVM|mrvod1jsYYj2@9IkIQ&04DY<=N!Q_(!HaFz$1wxAIt| z(|%Wk7NKzN@uk^9P_bcoIt-($m>$50!8Hz)7&Oz|)B-oP7L*mA00S(JYjMnCSzxF&9@3n;;x07?w55ugOecsE6ZOT<0rrq+W})_1a2#c;~*Eai4GWJgM_ z!5Boxv%{pqUcu6?7z@;j4YX&~h%=OFKfJ>-v{gOpsf8_2d`+^nXG0! z`e*iNkG(ybZMftz(M+FU-jEQKd%i-pIrqFV8C3_G*Fk?uro)(%lP@Hr-rj4*7N7UuXBc#GU!IDYjPAYs7tJYrb ztKyVuTD6jBZQ+{`*Y{vl`mo(~i)NYkkX6a`qy@IqVSA)qJuUc+W$T<2220+nv}}zJ z9U~RSl+iXR1IE4bQh)QB6DFTnzHGFGqNNZ^mv5z*@$t`hdpj9vE7j`X*Zd~b}O;lcRn6t~Lw*#biVsdaHR z*f!6hA5`tGW88J9vMqQEK`Ib?TzT`lo>yAh#1?^pHVL$2aRRiMzt@K@A$N40%TyWDe&@y-Lz>n`NC7GV5e*bG2}>z2cHiOnD}@*c3$U9-rU=WUNG7Wu_S zfR2!E;S~2nSb{j)@;2AwEOfcY1VbO)fP>Fr`p&kADuMGQr(edF9y1EyR+wa*%4JIaf+}$Kj>e zoBV4i{7d*pQBk5EGQ8@+A8zDP4{ynO;Mlf$paZA86J0cD;vcpnZsig53OM)4nmsZ= z_7HvMhk7*T9#oXAmc(KAqR^<7w7u%hc>Lr&rs_{rQYfNI5*<=@Il5rttfUGswh&A0 zI^kLzOou07M@I73{_ywy@QHfsr{0djaUB&DxAJ{7jjV}q-4*c^Sgzh8DgwQQDq@y* zMZ}^^wqq|5N%Pp_7IXBL`3SUySh6Axp|`}XIF4IBh~mrRCUl01@aiaUN7zwb#{hB0 zjzZ<)EQ*eDqtLiIO04K833Yaq|7raM5y)OYG{(fOcn{Z4GLnDrhw=Xx@w4iB`$8#5yBcEVT9IZ>)!H@;3UM zS1f;f08wkjX!KPtvd3tCypKXhh~cL(2ibNn-o-VQEkMoK_B!5MGNNlLLh&U~3TwXw z5*NRI2ck>iF?fQu5rdxHo58k0K;jZw4v@HTmJcMfbUPH95@WPVAiBmAqum5VPhpJF z=t_vlAN_Pnc>R z@>c;Q{Lv*oI#Z9)=n@}&01%_m;yr`Cya^=ow;xF4FB&7K*xM9HE||t>uK>|y%^2-nAd#ytfJClN z1JS&P`vzbZ6TCJ+B7g0Hgy%j$B7c4$;W-mXKD93gN~wy?@oizvB`|Jo2kfO2^}h{YQ~uA3(6_QM|WprLPV6 z;wJ8-UDe0qmIdQB#!alD6ukwT;(gh;lxoR12-~=(cn7bBdCSJd9SjV6v-Dwc=a;HK zV@p%~RbMs^P>r1qhTlVlXrbPyt#nO09(PUiR#agCSTP4;;dXXv+=szdC+YeM9BnP@ z7V5p9G=bjxgS~g+T1-rb0a2@CI)ILwpd5~>_?~XigA0*31*V(!^eVu;%cjVCm*J*m z|9`Xnf2Y}kiLvxiZaiH`XdlGsVgf!6#xonk z;=p^jyBJ&P+#Mf^ZKLnu2k?r~=o{)fqb$5D8C7(~6!S4doF9j#xwAJO8_D8c%`U!-wdF8i^nP+Mt zy1pV>NFXZ361LUVLV`yvBoMWbP}u7QM!BC#BADcR8D4d_ke6?vaJG2oFXdh! zigE|rqT*w<_(ITC*7oP72V<)nl{74j;S!f%59Kz*47_QV(3{-oLa(R;fv66iW?Q#-oHCr~pv4Sq z&s;-A`4U|6DiGCyP!a1fF=PQ5`>A}E|L2ji>cH@;as-=V3BTmi_&q(0(wnMznf*pZ z6-U|o3s(Y3u#Lk@lvW@r?Hg?C(7iEEkUDBjY8sa`Dr}e^lLRxi^>|U~ylZbf_6UCh zk-yz+>((MhYjNUiE#_-??FlZ`o5qk}Pp(fMMO$j6>|ysUPk(+p#q03g~;AS%}(wsoU=EpNj_LqU55kLpz* z@+}m^I)az6dHMbkJFOmX_@(k&@vR8LFZrYom5t5I?+NTg`P)Z>*;W%J#}6T4rJP!2 zFEE_o??k*r*#)A~on~9N5iPY5C*rk1U$@fwzTaBw`9>S9b9sBM-K?{<*l}lpBW^H8 ze-rQ$`a~1;0ur7m-ZGrv7@Jp2y3%UZiIGF96DwZ=QCWmv@<~5`G&V24jo5Egrx>l% zn6pdHDr}cTY#L9DZ4!W}0fDFnnzO1yx5iqVsP0W<3-#^x1+z6N5|py8Kl z(8`BE&0!OM$tV4=*4VuKc45DdM#VKqNa$IXkQVZ%C6ranz;ojgdi0!iQ35}>BcW(< z(aZ{Zpj(1?)<#pU?6SEfB}KRco?#GA+Gwg-ZiGG|!Jjc!`0YPnXhQy&OzD`+uxR`@ zWdQ#jFlexroQ@p>5|9G{lNmPEjC-;DGG$hy@1Ff_+6C$&rfMJ!QYVJ80?$DGRFG zgnEu#Fe7Qqo748(J0<&YejzeJQ&iU9jo>>HpmRm%LAo|B!y;z@J+uX1#OurY5UinRa33*>RsV z|MaU3Ki+=UGdCM?wcfc;ub;d8qQHoJU%L$LEW^)?j~;#?XVv6uzh6FS(05m9)!X~N zTYmbx0k?hn(15OY=!<^*<>Qn1lryqdk9U3@c=@ewjybZTX3C@Ot9MSk>Za?8Htd@|bnBI^#$U1h zx|}w<=H-M-3x3}H$UF0L9{kt+t!k^MyuRzk)x)=3e)_$e7W`|=&cRa#?&`An=?A*M zH1yINhNj$|{_$_!?)l{37i9kW=*6u&F24Eh!+~c`JUu@4UHw$ru;>Lh7rl1z-+HY{ zd7*66!m52czAQi2H!S-8lF~gN6rR|a^Lu4{$MO>+FSzf@5B~XDr>nmo5j}q4rBRuG z@6`UT;Xkx#*JJqbib0tri#q=+E8DeqpiS5CDff?z3{CaA$k(H>+qy z#ifZne9~kb9ktoES3vs@XUKbW6x|Adwiz8>TqqE|)5t^{a~LJyoyI}S(ibTjbS;Y? zsY1m<^IC~wnTpgp#ZrM(jbd4j)FH(}=N9oi)`@udITtK+-OP&qJS-)OWjieE6w9Zu z)F_spVL7N+Xtq14SZF-PV#5}z4=lYD%SEvG6iW~m`bLY$Ax2KR5~U}6sF#4I^|`%VcXOIDCrs~n zHNM~?G!m82p66!Fp))JW^VN69Rk=Adb4Ewenqv;ocuSjw3_ z7JXC`9aTSvY9%^KocZAU$BU04`{ZZl^!a#fCjf5=Y{M;~sW{kLXbD_KJlaHBTAG&Y zq(y^;JmH7fE(_fPUu*_vugmg{%R*mXR8{dJ0E~v8bEO3f02$pcEzL~J6lsYyEmufO z6VpQ9>87o*X`zpMXlrCzUX_;SriH%YO`EujB%zKwdL4&?*vI2~vD=_ol3 zVG*#8q9XbT#X>jv!3~|{MxMoOf9w|A)e`F*u~A>;`%@+llosllZ0T>@#FCB+w$Mcq z-smV`%a9~#q2o)a21yI`Yqks+*k72aKeJ`9r0}t*-U~AxyR3U|J^0mAf3+U#JzkcS zIm#W#=yc~eVu zvs5uhiN#UO`)>Yp^SAF4F8toGPz#ai01(_8gN)>aISlyIZ)Hf{E_fo|iC02JO7WEBF)kHQNbCg&;lvva^EY-PE#T+G8BCBYm zqV1s#AD?Jy_Kh^DVvZ84C%9JMxZ$qREiDy&cuX5}lvr3g$o8WB_da#`9nH*GtEGxL zO04r(#dA8)<5|sLuvAY-6?2qWy;voVAlzN`xwpQxRBuZabCg);E3tmlfBf819g`~N zD6uYJmC-jc{ysU*QnjPu92;|#SiNDj>hP=6>x(T_ic~R2iPeWyRIVtz-p|}V%DO}C zRHQDXHoW6^+=n19wemg+&NVvZ7v&PS|Rdqb1IuvBkK z6?2qWNvtyJ@XLmquC`R)NfmRHSTsReu|~iA=d+foB~7i^n4{baa{#Q-QS$K9p3FX{ zk5Jj~g~=Qxhsmt6A1T)Tl?TXJ%u#Yks{<>CZyrB)yrsg;`*~xI5{uRXxX(A2Yq%1tY|xr>E!7CAVvZ7Pgc6H-ucf*~s+gn18mYuu{P~9mEY%fK#T+Hp zC{`IGK+QQLbFDii-zHVeQDXU&SpJ$IbzeyEylvru3GTQ6!7kwA7R2^vHjEy-;taMndKELF}Q5epQzA;Ryn4`qX zU=@{%j;|R{{WPVyshTQP%u!-xDzWB$(dY(CwN$E@qr}Q$l^Bz;`f9zTiKY6hR53@1 zr7N-CT|D$pOZAdeF-M6NV3kpa*EJhG$Wq}p_q;JjiIuIy>U>l8Pc7AHsbY>2E5}rk z+uT=n`{T?y?AVlS;wx9`{mX-}TJ6>I#N!7n)%jAz93>WA9!pf0N~|$TtX<1y;JbN7pMP1Zn4`>kV_9X)dM!qegN9W0S&uoe;bxlf zBM()19iRoB;L5FmMpv=s7cJCk8lYuhMJwBG*)xtTQFPWr+t~07O!y%3)>--?j(Xqd z@vvB`#XrCIoTZv1Rm4$M6Idm?sdjDe&8;leby7tfRW*@SMhQOc}~4Ys!X!%{VEF08~+ zRg+<{o{7=_^P$z2DnqJ>qpGGTs!R4?i)DgQu0p9Ij;flfsNT=V^ zCG)43&n_-qVB87a+%a=*$s9Dx+=a7?3uc!VFDNKqQc~pJJJ)urc%hhGTIAxD6_r<% zIK?nh6B;>@0W0XPXf6jcaWAL>Jjb`Ryv!-!UG=DD&s{jTY>uZ2oukN=fAVLtsef^R zlG54K(aaqpLq+pv7nB#3mE%^|xN<#xKC(D#ZgGLQz*4i)R$f zu2?t|X+gt>Sqq967A%@AFUYb_a%Xn4f`Y8E`t*gf<`N~L7hPNA%0r$_OfN~IdCokFRU+}bH(*0Ix3 zJ@U{IeNr4Gj#~0!)Z;`RPW3o37|wdL2QoO$>ht0_Ytf4%{8*Lg#i^%Iav-RuPzIyE zLK&R;3T1HWE0n>huTTc3o z8#M_364NrvMh&8GsEryV7JqC^rya9KC65~9vq{sl1EI9+P`Z!S5~Bv0Utk+GNPJ;! z)L@f6G?0-O^5>@etkv+C*nr^dZ4H350B$$FokVu{$Th#sTzc@u~I;612AlXW-4cY1)DQf=gd~@oDa7 zozO=bgK&*^CSB*nMkj|}&(`P!`xW5aat0pxdla1a&%h&phro#*0f4QpxOCCxY;ewz zJi3JGl|SO03r_C{c!R*XC<0zOIDrUwW5Jnp23}|6Zw5Ha&cLH`tO4i72zYmbbMF~= z1L5y6a1KabUG+@u@e?>r=^8vXlV`ioMRvMs&_!}6O`F%fsfl+%guKBK@=_z@$}u}aUPXkw6%p{L{%(zscYlPuCnDs%7$I+4guHjXc#dZ-QNKR`-a*N&?>PSs zoS)9XqjBgIIOox)L)gsz?1-CyeZ#<+?Bsd$`(nuov#<u5Ab<~7VpQKZS!gm;&qFVHy}b@T7&@f`i0#dbiBH(obC*ce{8rLoWXPV?SK-%lPg2uH{aMn6`j(*Sr zyayx)kTO1!5cjrZ)b$O4f-f@ zkeA}cbM$*EZzgyXB-iYx9{r%u%by2tL4>?3y?7q^TLs=7l3QQ?9`N$#k-w)RjL zuN~@dXN0^@Bjo+;#dFjPjcbiF@Z(avXfx}@gLe)%=beGq5I*{YGdKdC51fn$czNKA zi-0!`oS6~u7JyS40dFZd%Ol|7&ZXMA2zY-5=l(PBXxx1qoKGdMzH#>$IL+xhX4vZD zk-r3R#+`vjGWzo#$B+#xxDym^f;#JfKN9-YTO79sE12zWGqycQwvEiay< z-_v!+kHL$jZ{=aD>-eB`No#O=pMgj1F$kQwl2=!|QF~ks&Ye!4qdn-WPESe>AaC3r z9_4r*ysss=ipJj zYys!}Gw`~BcL@^ zBII4+#dAE{FBWmDTs-e*K!?G*Lvo|JUcmG4_k4u@UIA}c1pdB_(BDts{T_k84%x`O zZL90qjorZOE4lTRHzz`WW5Fwkz~9vo`dbO!%@O!}IzoRhg10RKe_urC?=X13MBuMY zj;%2O>uQfq;GHMA^|ePvg#JR{T^xbGDpEp-cJ$u zYY~jBJ=%fSO>*mNk5Li&%K~p~1pY3M(BBg9Rz~3Op$Ppw0p5!d`1>G2f1iSPI0Ao- zLy@&d9C)21x4!mBiO`=Pyif%GE{o7#8FW&f3Dxr*-wUr{=} z2%q?CD{|e{T=B6j&!mkO{b&wZIC?yjGv|`+Ylus?pkX%rPvd| z7dg_y9BKJ29n&hmC1R%Kr|f3h@yV>_GxrGKccfDt=`=^$aRrZWgKnqb%7n5dC@GxA zJJN}cG@bt1w;uKca8E~Cu1ZX+oE6Qqa|F*b_Xv>hNRM`;$2ijT8?^s7Z_e@h|5je( z>G7$yExwI9GsL%5XNGm%)tO;k4|Qf(m#EGR>juyXzqPGPR%eEF1J#*fU8*`WtV>g8 zhIQ%c%&=}uGs`*9y0Plaux^}~8PrlLlK*I8-NV_+p}lTH4yXTH@k?g3REE-$nQ>}* zRy?QwYx%kMT+slsmP@M6Q`0MYsp(tJSJSs%pr&u@&1tn4{zscoaTedYmC}LZ+q72G zZQCg6b=}*l=^pLWbmCcRdcfIgI=Q`?9@s%mkLjqU$97WF<8b>7Z2ztLDVfn(nL0~m zc2U!_x^nuzmY-|;w6iy0NmXApy`rC*zU4wSeQT1MzO6r})ltqK;XjMxTMtkM-1s)h zYPu~R7GT@fbswardkj|7i9^)%fT3zSIYmtmyhu%t8K$Pk4p-CTMsWJSRX-&&Mk-6a zl9{8_^ei8z|7-cV*5At399l_Ls+wMrrlxO6SJSsIjzpZ_6Yx39NQ|Pm))b@ ztsAHRYw=rmPgLS}@4;!Mli3OXVI12gF~ROq@6nUf>MF+0_|M|$(}&F2tv9 z|E>8y{`K6U_8N=dmZzrQ$XC<*Myu)f#;ED{$8wq`IXWkc;``Up*;SNA9hc6NqWGC2 zX^eEd(~2^R@2*W(0iyVRopk;Xr7gxgoe4x~tMNXO(Vcjo%xDAN3m9$2`%FeV@qQ_z z{dm8O(ILDSGdhX)N=C8xTyO;=x)=8ijCujBV>A@#Hby$oJ&Yy+t!Fd`=wU{SfhZTq zAJCJG?gZM%XamsOj5Y)9WwaCM14jFSK4x?X=u<`~fxciw_m};K5j}A2FeAFd><^5F z0v%(d1O38i63{6|bAY1Y3H1lmkkM)&`l(Blb|+9PMjL?WfpSsWW}ps?b^>)~v>&J& zqeDPF8Jz^8N61BKbQgq7M!1E&md&Ua5Is~2?F%%9kq$J0(IlWt7|j8i#%M9n3`VPg z=)S1PAJ9BT8-VD^ipU?(B1Subu4J?y=o&_cfardyQQAqM>lwwy;HM&t=pk&kFzN;L z7e+M4{*{pqw2RRspnZ(y03Beo80c+AtARdbbSKc~j5YurWwaUSPewa|;!sOb+J2xm zj1B>v&FCahCq}VYaCK$W9;gSSBp|x3f%*gTvp*luTcV|b?q-w^w37Eu0*Yr;2t<$T z!_fou2cr_8PZ%u*qI<(eX_Y|K2hn4J!t8GyPzBrW1i~)-Uk}uhbF~3z8Jjl)(RHUN zts01~C`D;Iff5+i0QF$BALv|0M}g?d5LyPP4I;nT+y*=*nS~RtQAb9HO)mAi8>hvH?wCv<~PJM(cs5G1>?;gHbimY(_Oe z^B5fjTFB@qP${D%4El7PFiP_QRWQxplcWv0#z|80b0eV8t8gPJ55vr z)RJxcfoMSyr5yyiiP2G@TN%;KckW=65A;_?lT1_yMAsS7=0ImNDgnBmQ6#*FGf00Z$|k*{TR_bj`}m212m9PCD28TRs#)Tv<_$l zqdS3ojMf8XFxm(dU{no6&moG^YJf&FItVnL(NUm_8PO&Csf^-*rZY+aDq@rbG?$SN zXaS>qpvxJp2P$W@!9*K@M2&9-5;a~8w1jyzKvy$52(+A060RJqU^LW3J|I!!I*_RG ze4sVVD+F50s08R{MwLLfGg=397o+t+_cGcHw4PBl(4&lw0zJ*>B+!$LDC@5>!VPb= zt&HM<-eQyhRKsW}&_j%TK#wyj0eYU%VxVUjRRX=iXf@CdM(cn+V6-0SV@8{SguiMa z;qNHW%e?m_5UnNfKhE$M3ncu-1AWGO6M(*CGzW;*7Z@jjzG1Z3M3q2C*tQzzM@H*_ zjx#z4^edx7COQgqift!>{>_LU1Q5k@MLtkdMw5VAFe(I!VKfJ*F{2V7y0D2c8|W-X z>wr2kS`XBP(MF)|jH-d?uH+bt$Kr{92`_Cx=q-5hD1pZm@5hs(%bV%poiu77y$#R! zOPIWk`rUcZ#c17t=$_><(gPmWDXDvydYE)Lg0*Q(qOR7=TG4^fhAe(J1-{!Fs!9Y28Yi{HQZ%}7h7 z$I0~VpEAJ2_=UTPiIbL^W^xQn90M~aGZlXP1s9asHoFyY6EjU8Fp&Gw9o~8bMyL+ z^JkfnoHnU3d1f7_ayT=YrY6(XBt4?qcAWUtBsGaKLcB!Ny0d*E?C~RQerzqIjx?i~ zWcBzoe3u~@4EW7%Zy99YHw{!5bYPeU?vOYNECVFe{Y?W`pWVO`(d|tV9b{<^8w(va zqyMWybbQmmDi~z{!1~|WyG$xMqpoBbkPF2?&TO4caV9#Or4_wNbw=IJWN^;x1}==P z1DZ^(4X+*2h1nGY;hIo*EB8Pw-nDGCQ{|}1pqdP+$$*;FIVp$W{|6m1)8?nn4w=Oy zt3&$7*gB&~$d1Sfss$dM4H^%(oRFQ*q*;5YdE{7YGHq$DSzFrZXlC>@8fi(%Osj+8 zw9VPUghqBQ(*gA((}As1DGuZaW){rQ$R1%i-~r7>GrNQtPZ`F{jN5vZqw`GSMsOG} zVWT<3U92W2tI4rya*UcBuO`Q-$%$%m0w-nnt3(z5FUP}No1Z$nUmlaJ?q`Jk-w(t2 zk%S%X2#ed~aJQzv)NeVRo?+TDfNl0<`;KJZgB5Bo|MHWxOsi)xCR5;DK)r4c*or)|o7_QDLi>YAnujCYmcI329_BtQh@rCg$510t-sM zW`EvpKZ+XPEgm;%KjeJOGnttdJfbo`|=Euj#I6boDmdki|S7Ycz$QRY(EW6;nb z6atZAiAymMR%4?pjY1(1DVDhu_84?UQYZu>#Y&gLUJkknC=>#bA}ka*8E!hDQ4$PV z0=>zNt`-V~K%}5&WvR7mFUL+(ArL97+0|Xv7M!l>c4Ox3<3Dtdo40G_xxS;@A4n;Df7Bf(df&Sz z^Ymwb{{HNu()+fT56&sOZPe3EHhrx1n=<;>!bf*xEz!Px+1GOC6L)l*+`V^``1Dt9 zP2YU|KTkgM0jJ%&6H0Q4qkU)+oW$k?b__^?tk80UbDJqCu4upi~gN6^Ue!jyY|+HA6QdQY|`p|Psmkl=fL|%e6qUd)1$IBUDLHm=E0(0#|$m{amb9|r&Djt?~s(cZ_Um@ zDTf|7*=+j#o8S8Ol22w&&A$A|&`$SHJn+SZOImOGXS2^n`!2e6^M@@uywSnfuU);g z@c7xQPc&>;(|KRwhVP&KGCgzlAE9Lvzsjuak~8EVKP>*Ua(Vltbq@@9>dNcyd+veP z((j%A*viEDXDY9;-&yXGxWCMvc;JVRUVUqKdDREx;EV}@BZ!^Q+jo5w7lQ89FashcA8a zWUH~i{_XQm7k_4y+xTmg?|=LEr)RETaL;>rB}RW(@?G@OYeLJ4jdYvA4O`s3sPL0T z%_~|A?~?!WBcn>5`F73s6P|7v-Q(-wUp_hepWPOXT+^)jlTq(q8&`T!ez?htPxsyO zdh4Ihy=}t6_YXC%I-Fbe-S~I^V)#3eUb(mB^LHLIctgLN^ya4<{`kPy|3}lZ$B%Y7 z|II&E%zblEdHJt~{o?qIeTqv19~Bh$fB&n|x8KueSo?dUsPVK7H&g1VKbN8(m#J~LD*~ZhJ?{C_t>$0EcwKvk6+O_X_ zq;$*-BYmd*fd&IBVydDGw36|fOaK)PO0;^~L3=|o3S-=i&X;(EMG zxwc9I;t2Qz{#1JUp>s&fPr}Od1%?LS$B}-BBj8u~v(D2`N5#)WV;12{KT^(TO4!Zc z?h>|6=z!}z{m>X|)$^atR^zKSh9Bek+QvAHZ=S%03=O_lA^i|X_@SR~9rg5+p!jLK=A4@i4Ze*jr&!|P8CAAh<#c0}_XwFO zRo%1%j4yUo_j***q^i41)q_>WOr7+|!FkpQxk##dxKxR(O29kSKx)6uDVB=9Wl38i zs|eji7EHKQaia1bg{9E6*hffAsJ5E_Flod!R*k(VJrhUNJbgctzNIHT+x?uY_}Me3 zD-L3z!6!`84{_9*KaW*3YeeBS`R?m%^F>o?5Nzj}<>~@Ur5T;}^@io3X|d<07xr2` zYS16WFI)K;E4_<8*L;~0L7axIj8h$Cz_kp*L@+s_4xpI(oI zb{iUu8PX4N)cWboD)0K)DpkGB`uPBscr!Yr+Ly4Dm==5e^kL7&h&^Lo3ryNZxsFTE z#1Xc(INB;b{q$A*{Mq^DI}8nuIH+hNj_{KS%Q{a#bVOL~wQRtJ8HNVmVV8c4qXyq5 zg=M{`p9|R!&7rhCHllWk<>z+khd3fXZ@{wA(@zpO;tA>G=XL+^3PXc$n@c~$5q{#) zcd9-8^jG}6``+J84eA9d+K8jJJ70INV+A`!ss?bo+ef5i_^E4ESuRz{E)^QSPSp)k zHPEHP0;o>aV^TH9r5aq1>NTkv>{1P>M@8QSrfrBzMQ2OaS~TbWN48pH<}s-n>QZ4~ zh02(V)pMd4v@mTctRh6ed#o|roh*q+CE*0bJpx>Wz0py$)}^g?(*{==y$9bYlb(qq zden4Se4c)Wfn)i3@#_2b8yegcPWmB^@N*w5`JR4;D}Dx#NoZ z{ftojEN{6n)6n4hv-Cq8;fKEcT;l0xq~fRZl0M%U8hpza3fhPx{NQ2WTBWC-QQ%nh zbI*iZ(0zmkzip9zh$Cz_!?MoPkB|KrBgt)liN4IxXxiVTAL0l<@58d*(~n>A^T)Su zWArfc^Mmw59AP^ft+3J4PpabQnxtA=yC*?K8*zl6OJJ$?^pggTRX<~Ye!YdELCZ)# z#1Ve(fThOMPrBmg-IddxGBld@cj<>X!q5A#9Q5>qf!>y%+`k=MYG^d=JL!iw>IjKW z29+^0-tz0Wn98DHqpejl@i)^vPA`Dvs2QF14u>Tl-rdJ(7WP{8Q~cSj6Ri9gKg=hN zDAyABDfINCD}IhY9`}o(!EY914v8cDyZ{T;zB@kw#ZT#Vo6a*d_-3{ALmah!vRUO_ zKgXpi+pM4FsJ%)vI;2_`SPq&N`^q7QJsacL(7>^et^5pxiZr1b(ty23L%vAL0lwl4h;N7%lCrP|ZaWW~>v?eybJ!_P0$4{?O;>^RIIo_?k%evaI=?k+=v z-;hB?8*zl699Rx|`k4xjRXp3=MwMBmEFZ9U+TYMZ2T$nz(x& zPGt!3Ca1L`ErHt=S5aXpG@}!z2Q1a5#eSU5#$Kx*HVizw#>&qi>6tj9ToYlTUv#gJP%2H$Fueu$&i&sHx!U2vJpES9?dLMZ&pVHY9x*hy zS_Bns#1Vc1u+T5v+4!MN&nvJbnSNl_cEduyes$-t5__#{rwuPk z>tcApXe2!oM|l1>EcDx1x1Z&TpQlG2>tSf{yHq(W5l8r;droaM{lKgZhlPGm>-Kyt zdq#!x_Uh5*wvj(qdM1wWTmnmir=KcttP#8IiC2di8cn-a`XP=wvaMj%g?Nv`Yx8YS zNrXSz!&0?^`-XjFTZz5m{EJkteYOK-B}Cg6saok$U5C9^?``nq;-Qx69jUs`rCP-* z?<3_4sanMuzAra^lp+w)lHTtL(Q)&%{y7zLr(}*pAQA8vXFLRf?CTYOSjjH?qpR1$Ro-jV{$q ztm=mMD7^ky@xnnX*85U*lS{QuQH?lw-*1-cTd7*dDiF1Q!xC@S4_RW*#)`jW`n_k^-XmF4!MN&ttIA@8I3}xsCla$2)B!dY;A+WaQ@+>4!MN_8BZ2J^kDc zjy2LgFlP1(h6eZ6kba0G{IqM2GX+mSe^LA-T)iKsDMo&JLq!{L8fY`8&!1mBlMQ%F zfMs@RQIU}r7D|abZV@65Z8M}F%d*&IS?98Ba9OHdmi;cv&n`=J2hIfEjQq59SE-%kqxP^0mwIhs)9iV~E&{a-Hw8jB;7VyDXQxENfks4KB+z zm*oqW<=-w#OB$AVGxD6^vJ7=u@?DloU6yNHmOEXRr(Kq6mu0WZ@|DZ-i_6md9A~+D zxGck6mhmpjLYHNg%W|*F@~q3U+hzH}W%=1&+IXuCnGn4|S8nKiw9y4Z6k{)q9A#@tyY|Nh=mJt$So(d@DA zVwJHHrdSQlST9NybCg(rRbpM;cW*aK^_EmIM~QW}D^?>j)x$LbjMWTla@v@q#JUews}8ALmMTH2n4`qHpH=ocj5lKqlq%*ZvDPcGR!v=n zPtc53&Xy|XD6t-J#cE}$3Z#lTN~{N!SX3@cRW4P`QDQyhiq*r6wOXo}qr`exiAC*Y zsUDOn<|wfqQDR-Td0Xd1GuF#e#T+Hpqe`p^GZvk)RPRd_bCg(*DY2-}4>e2Yoij2%4Mlumn!Bcu{OD4U1i4lNUE5l#Ck@FMeSv&zLzTID6yV(#ae2{!cvVl z<|whAW0lc2s9cunY^h?766<+Z*~h4>%~*Y4CmrO{oR25Ri93|EkSFDw0ted5ZIZCXTlvvsYCuUlzr=*HGO01Wa zSTt^2XU5tsRm@Rh{X>aG?PaOHkt*gWv0ib-T4lznl`7^av0hbTQ9ra)9lBvBHs&a? zUW3&dqo}>sn6U;(6?2qW)vPl5A+?vK8ZA}KQDSXXVo@DlZ^kN?D&{D$URPpK9a^dz zq>4F8tZlAXVKdeSsbY>2>kTCq)uE+&L#mjg#Mv z8UGw)sj{VtIZCWOu2}2LShJ*xIZCXzT(K;JMv5;W%v5$6Dc(gtvYA=Bq@=u{Xy%LpdRUicnP$$I=`zipfg27v zt;Mt5+VWB-YjJs*WhyHwzpQ9U!K@-%2x%)?XtP;G;(VciX1*ySlxzBtkTz;mL7J~1 zDdbB{%gspj=cW2^`;Sp6;EYPaEtq^FGve z(J^i+sOsH{jJzy8I~0^1oI5HjX!vwy+psCwCZn3|pg&E|OgB3vWgGWCv$E}0q^1Xh zX&Gk6r)--F?lGz?x#c0Im4x< z`Z97;)BG7(**@bwjP`lX5_?Q`5a;Cu^7QolOuN{e@=P%`iAUu0P`W=eq-WT~+!j2; znqnR=9aA78>;4?S-ycf1iFy3sNy-u<+s?TS;@tG~kgjK9!jks@MVa|GF8!Q8a`5P+=)c?hCOOD%$1oE^Yi7YyXu#a#W0 zm^1GdXXNDjbG&j+Vj6kP=<=vC=K^zw`?zq9*eDnlGI-o=nvzL#ZZKU@BYB8J>8bfS zdQhnzDxnzkjpLI_=pjx`%}EUe(*3sT;kGen3^TgDgfteLJKQC7P6sGqUVdI`hOXz> z;)tF|L%ivVyP;!dfH)(h=cfDBZp>|{h`9~j;_N)Cpe)@MnM=sikrnw&GfcKGPtOYE z=H%Lk5Tgin4d+IA>YN|oHJB63$#S<|J(Gk{(0aUP=cVVQX9V4coNMZtUh1B9Y&LVs zvD<9ZjooZaHEeTEGj^jn#R#=|?q?>&nG)rUI~Ut&aBvRnxxUPdob0rWbez!O{;T%c zL})x_l3ZWDj&)sn4yJdZp{^v(v?wCgt~(Bf;h-ME>6p-P53)2oa5+ZrTwhjpYB0^8 zjTNVrH*sD=aky`|G@+b;o{9O!&~P{B^DQH9&M79>ml{aV#sVGdRE{Hhx2fU0d5p_` zUwR-bJJavSsfI0o#;K5*MNesFW{#egnq`DUS+KsdOSzAFN&~^{OiU_Rp4xJ2mvV+3 zV=+d?w5;shPzFvYY?a>%+cNKr*2JdPEJNZ&ohfml`Pi&MqhAi0;xGUfh??o zt=yYKxhwZHPJ86uIeg=Y$;!;h($lauw^cqb&dthq47@lpGecRa{vggvg@(I`so~0Z zX#zUd8u{r)j}$%G)Nsdurp|E>OT$23o9TA#O!v|K$Sq#lgkBdAfH zdc0+(219vSAzT-++QvP~(-%J-*R^0u_OMBlIYQfLcAIgkZJtt71lfnpfta;04p1&_ zDOMLZ*^|pwJJ)t?k0R5_1P|}*+&Z-|lg3WhAUq_Hmln)U%}Mj&w#{V0v(X+Ob6p@UBRf487f+2Gj7l-?3hmP_yTaB9WrBkMJFkeSriz7J zh0-Vnd2}Tji5AW+D=)wfdq#r3-2BvFRxpSm!@P)_Gts*6;4R9}&kErLKwh!oY041M zxZ*9!2!*op^Yi7UMII^*ku7^AO8(HpQ*-^Pp&a9qF-=3biL@(&PFZ?dMkp(oZd`1o zvD}o|vgnlM`Sa6o?O0w&k$FTk^K%5NH_a_~Te*!~TrqaJ*%kDapCX4{_7#_RwtM(z zyCVX15&E3NbWH|DO9pZM(7__3i)jtMibrY2IIWn;MI8#;E~m_s*Axy$R=WiPaI7q3&@`Ifb1E0SC+ z*&CS_KuS^Ut1Qferdzw+UIezgvu`uovu-!5*|zVoWtk>Br2)vGWEcjTrfh{`i<9Hk z3CWj7w`D!-yqd7rfwIG13C0d%^s6wwY z6`zz#mrsXL`ZTO|pQ=p~X?%3~bQm2}yHA6u$3!_n#UG^{@JB&ipDB_ACj%b&E(`@(cFiO8TdfaXuMhDgI)L;smMa02m zD_L~!RpRk(TW0Lpbnf#Oy0dEPl+0p9>x!e=q=8EsuZLP|+BUpsqp%6_`GrniBJ6KV4)JL7;!TD97 zunykb2Dmv1IG=PByqG$8^t_%1o$yd-DiF51c;_I0H-hsw`6cJN%JFybPJ{DU0=v^1 zR{MVO`iVlgM9=z2PChqxTsV1doO! zj=R|USq$x=@t|`uA#3x+C;99@pP@bUW!ApnrARL2k9i*cCPwJ*Qt-;o;4c<&ZjR93 zUEn=(27gqJZ4vr=7rX;!@JIPO6`?=6TL9g_l(xF+kA~6SlEXy2)zu!Oz{@# z2QS*pa(MX50B5w5=i#pyoGK^J!`}no{N2g(@V5t?&z(FEe}90}WT>MY4u3QroCnSj zC(py*cyOjWc@BTn9?K+0M6SC(-wNLS5%_xroV`w-NB({S=XWR1BYz!IFn8faTYc@D z1I|Pz&%<8@IBT3dkNiCb&a+OQhrhkxeBYYx1Wa(MXb3y$B(^YB*y&Sg%X z!yomRHQ?OkKrsZO3p z{;mQi?Bscr_i=EZck&h$&o7@bUt|XFSh8#HNsejkn4tW)gX~n#zc_exjk^tphxd5CpC(ol^ZU*OGC(on2FN3qk z$@B1c7@S|6JV!mBgZ#A_X_Qp{_2_>z|6b_e)m6{Kz{`?cvz{Gs>AbGU;ZLLXol#b1 z&katGTwA4~8#5*&cifcub7xGUb0}QyTez@j{*;*|B~xZp%$+}LN(euW8W$YfZ`Rz>DPxM} z7vYCaQ^XIY`W4TZr(L8CZ>7z^-4yW*o<7>$Yv@@#;%{i~%+lhr;@Ra1y~doMkXKSZ zcfs5%=PtZ7A+2~p$=vxxrCK0*XP|e@n^Bc|)#<23@qg}4k9*;Dy>@HzzQZVqwyhK1 z7ULD8g~Bx(HE_#2WF+s3>#F@(9a(I*T@)m(L@yXSJ9kdMA#ACBLckz_F z_WlW>@UcJ``8ozg+=_;v=_?P!t@t;Vn*u8$lfmfw~qsR4+nnxIM{5LE_MdC9v%flD7-cB z+ul%*ZJ{0?2aA&qqXua81ee0o7NCbLR2g5bNX8ZK2pQ7T{jH|6hy`oIX)uA9C-NEFY z8Oi%hH{28Syw91L$m6{eqEYwuFFzMzL+r&^=xL|wivk2W2xZuHS@0UTpJz^V!Khz>NX z4y=g|RDBm!ai1KSlB=m6WBF+0Dvgx~AF{rUI*O=)G!soQ(Nq&vnMfX7^Ap=o@K5m5 z7@V(%&lh7|kjLO~Mr?YxCOy30zxBKLp4w5IXlvEzoGTti<&D4;0(ci-FnmMedid4x z7yGr~uw8N2euo_a98M6G+ZiG4R+7Dr)0kT97|09uFG#K6y?7cM*0EsA&~b z_3(;B8YzR}J^C87$BM)aNa<_R6Lm_g01v^N8}M&r7K1-Q70EZc3}mCXYz;;R?sBx7{|;Qe;{}M%G05W zr8u&qF(mk_zB)%=`9nrr`X_;52P!Vst4_sNj5W#_3cq77qi0CUTQ6BWrDT6IqpqSl zq2h99IC7Q1mG{@y9x28&RZ*m;+{3L>F_{omVZ~^p#gNG$ibzetO-p&BrqaXsnsD6h zuTzne{B$sgcHt_ZgwZS_Q%4%go;W3Ou^xUhv65U=y^-%P@K2kzZ9h_lc*SVL(F(H} zJp(k2QC0(S1L7DoGmrM@kTmZm_{Ym`Ss3JQDf(naczkR|_!Ix~FR4HJm!B3r@~`km zi5lvYYmv~yqSNW&dlF&P^tCY^^^_G{6LHsmz>FKXujy<4kyuF#^vRw08(iDGDY+^{ zMO|W)HHZ$E9}2%qdDN-*p$p3Xv7WS4Px_j(MVBn6u9%*ffJMhk2&9QF8HFKHL^?cK z=C%?caL^gm3D*<{oe{G-I=F23Bw~mt9Dp0a*4J&08<6AhwylTahleVzpl+D_1NFkt z${*6>(mxFi+g1_8$|}Ah(};=~6ce$~8-r8`^f-@zviI3y{e{XM)m65Nh}P6C-(}3FG~u9%Z3KRUr|@|Pu=zj_yu^yXvwImB1ZQEO=UC^eQ_Qm zYUhOU6Xd8U7gTRhBn(7Rf$&MJGMTZE1T+h;80`kUPh>=;Ol7nU?^76kjCZm3XCSdR79L1% zKkg??^iRM%?>=_+vsa^hEkh_KM?i5<|=qQ*2slHbUzF!dt?n%bkxISh-!>K zg+1xq@VEW80ey}ho{tH;>J6WNTEVn!)MS(JiqW3I`*cQc;e8IHTD)J%=p5AH6^v-j zmB(l?&}c?z9y3ti>{L3?d$gPl@@V-hEfw9KdTGV~Q*wIu0P zDLCOg6$;DlQr;)IHn3)BU`v~piXOnAqUwt6^CNB^#9w)Jqs zsxKOE{h~p5YcQOaq^~VY(9z>&*7$4pl7l1t_3+rFsxP`i8r~6?u~i@TdU*!~jIU^- zuiO{6;to{Q=1L3=hx^rH@MV3pzE+PV_Y|vPII8Mk*Yt385dAA0BTAy9sBKZIf8PY9{v~?RaWjRzc{$I1sRfm)z^-|U#t;QF>>Mr zxFb509&Y|_dP;|i9^o3C^)^`kWi>)TrpKj!s1JJ&UGq@$s)KRnz z0xI{5<~a!}l2)GW#feD(Cp##&G_^)VQSKfl>H{R&ByM7LT&t+KR{nUr67WjG%ZFF~ zwkpo7Q6m+8aUmlpDo79SMA16iFRH9*68ea@oORJc~=tchaI z%CqLI3UkgPhsvB)ad9|{<|`~S^747k;<-gmcEd4!RSe)=)c@?eFdQ79IV%ry7Fyq! zvkG(!gT`ut4~6-(oGHi38HZ=VwhFir6Uio^>3GFxbn~b=jK0IWm`Lbyn?Rj_#FT>d zK@gW#sEQv4(JFTW4bQYNMbB7*bLaBO^frRty5gE;c_SWzwk7Y92U%c^9v@iaYflX- zdzBat|L^P&y(k0uE5|E_*F8JXGCSCRE)L;@5PMP;e8>a2l2ju5mmu_ zMn0TeeiFo7S9K~XZq}PDPbx`NKJ};l0bhpwp|h%f;;XE@r>j<)^el%yH*ttlWjuhppe4Gsl-S4)4{& z?*+oy=xVw?IZ*or1(Qn}24pt}?2-+H zOGK0aNs!1Da|j435D?Ziinl0U;DLaGHz+D0$SE2?1-wAKKu|dpIYi!HRrk#7>;d`v zzrOeR-hPtVn(ALwb@z1lbk9t6d-sX{x?Fn`gK3jF}u z!fx+Sv~}EpU0G-h^6u#JTDIa29wzSK3udG5JLZK1=^Y2XO$iQJwO)D`8R{-c4en8Ncan~aXix^N$C;69w- z#G~BO*-(`nx2_KH~n zk2ErDZj40jG*ohUM`DhNv5{W1G*!0I&_tH8I!fwDBQGJBn&2{7VlkADbefAv|50cB zoLFZXo=eO{GF;ng;;0-SjPw?^%k=(3xjN>CJZPRP*g?CzH7Iw;QfXHn)KRjwInCSE zv53obEe2O_VMv9EybG5A?-~|70L6)W)48}^C~nUPpX z)HfE%tOL^NjX=GTx2XiwFpO#=X~N^ekWOAJha8MzB14Z-$}&L6^3LEoy$#hmMpo;1 zRElG7Ub=kQ>j-nqJ1m|Gom1>k-Ji#>vYD{@j9yYTw4&nBV5AsLk`H%U>Ta^{(pz^aP-9IN=7)D%EXZyLo(4UnYvOdSDbN|ov* z60q<-2vJkTr6>g{hU2rCT855gIw%@Oi0(e5PpPGlnU8t|f3kf)aP- z2hhO?>Xb%J#Ard_Xxb~N2I%Dkb(2Otqfz=$R`&h}xmT@4Z+~#-Y2b4Y&_~wjOugkk zW1kqFHgK=5fsP^J3LX~BJ)enAiKZ20!+T-YUOGF{glC=V6M>R8d=C7QsXT5p^xB=W+_h;V2%(Q1OcAtC&Bl zFE(+@5-&UU<6`o=%}+qcmzvr;G&}{a4n5o#qJV#M)BOT3-{wSL&P?3qivOM8N$t#x z$26i!Z`R!Wvcuh`QdKNocV$LYy72bRmH4TfUR4U4>N`yFT5U7EyX4nW;^mqvVl%y5 z<2RV}vI?)H@MxP}u;Jwzy;)m$Ry?O$@;~xQ4KIS~H^PfF@q%za-mav^15X$u13b%nC~u zo0V|*U{p_nLIfHZt6??>At@-5r28i%!>cLb-D=<-CE79lQka8(At5M|c#L_baElU- z6hewqxENeD+yO#J35ukiVx9>P?W?gBd{nB!@p~u7Ql11w5-XTzsvoA*&&B_Uno51x ztKTh(?U5UT8t!5wNehakUuIsgvV03MYM2W`q*PEOxt4jRW|2y>+V3 zd5nB8tf1z&8d(H);y()iCHTkP4568i^@Yr(91Dtc?Pi{-ZkSRRn<3Xts;$&5taCWB zAYvRMlvjMD?`9-P3yP#^6pQj|9IiA*sW(QcH%5vYzuw?vy~EL!h~(QX{Zd$je~}kK zkp>#dn3Yyx)s(PeO1UmUu>u#VQG^f@bQ}K-|7r-P`w$|bTd9Vo_#e?tdI$RCJecku z|D|ry`^HstAODxSN$>Wn=sxu?b(7vNucG@esT)5CbcHBTjnS{SenrJ~B%S1ZriNf; zeF>4MW%a_8dLyEgdP!EL-hgZjI>)>2Z8N~`5 z)i6O(JrNS5mr6?wBHpOGme9>L>_4KL^p5l?&0xB%|57*U_3d+l>2B~Zb(3BifvF*w z?xz1zH|hQUD!N-q-NL?l<&D=wq=~MmxQ?Wg+#uBuEY0-V4K=KG4W)K2{*$UJs9gml zk*bQ}mmX$`{!36{IHw5*YFBNGQk(Wz8XH1<*znNLzSRdfuqz4ib_UE5ULGi z)eua#Q|OiuRWFr?ZeO<`^pei*SJ69|^|tFg?v6F@ZrK%V1agy_Ec{Z{5V;l<<%`}T zq7Fsitq0000_7!Y5F9FfByZIu1x1oKu_X6UBSd+r5)>CO?l zfux}7rSj74>lTDw(s>a7Y6zw`pY`@p97+a0Qn(K_XpMpqw@>}yv1YM8rroNl!*3D( zMfnMe@>$3l!|lUwnA@i2#0Kq}eAwizkp-($?= zXqomzN|&!DY`A!~{Mk;6Z$24!=IKA*{w=E3q@iE6?=kP$uxjm&y}CJn*^HluM(3^E zo_Fui&R<+RzkAfD8<(55^yzW-z@Mi+-Lm27-A7)Zw|sVfiuawJ9aew5;p@AWh7D=` z*_Q*{?{@#b=_jjNo@)8iHMb*OCd zlE&@S^ZOsVXUEog?LSq|AFkLpz1x;CPW607tw(#NU*7f6-E(eOJbLGlZUqygoO$bK z^;_E1mj7V-t>38j-u|WcqHo(}SL?L7=K^KgYlR(8{+Q6=-5sa4y|H&ovx<#&f{>Rf@Cp?_ZnmNbY47jhHB4N^g;Pk;pb*=es}ebDy3k;;QXk`_kx3`>(6WZc@|M zeOBg-Yd%liH)hL+%ijFw4OgA(Z(FtWctqc0V_x1hYJbFnzAvXV?>syE_mMqs+2AN| z*mTCcubi80wbkqQ!Gq^tAJFf4NB8d|x`c;ydTY*a&pps$$Ihp3T(t71d!0vW?C4N^ zU58)pa=kh9-7n`>{QT|rt54_GyXnWModtK;UwZ7Reho+5`gHR;KSqu{Sa0~yOZEH2 zn;fgFjchjDr-d?U&%uZFo%3^_^jJ)nFH@7XPs|%%+&Lj(iODoqa^TU>d1@}=6h&}+ z*My*6#LQa{8+H4x2SHt)*|gpWz?ttF52W2}vf)S?yM^DJB`9AEb!ui)ERGb8-S#eC zVG-IFLr)~kChE#5=Dl-G4+mmuFowEW!qget>_i}@CS#i8NTIw#g)h^fUG>TGHFXzTj$mOu=>2R56i`=r$0Q+ae(ASQw_G|Zt=cS)Lk*?Q$%Wk_T5Yvb; zbfi#y(-{c)=RF27W)nR!p&I#H{v%@oF^w7X0ghCYYX5lu@jy%y#$a&Ac^|dEdXQ^D zIWn6T<4CDk+ws?D0`)Xw3_U`jT2eD+-YbC^Y7u7BTXe*K{JA?&Mf~&Cf-y63q-#-p zZM}7Yn3jy8K`hmPcW!UdT3~R(wU>Ss#l{-2GJ`nv;q;K4h8kv&tkP zW*VnNa;zH1D>+dbXQkw{&^YCiQ(NPxllwXv=XZ&T)HqhUUi|x20B3LjCpUmIBY<;H0O!R3&W8bB&Vjv`Au^4x^daSnVL5>r(l+EzQDoySH7I0;=-J%1-_hE_u#I*C4+kY8VWew zk|c-vaOQMPlpN|m1V_bCU&oxpt`b8%By*CwOAhtDLJBt%4%Ej8PC_riq5hCL@*E!k zsGOdvb-KqH^-%A}9L+lQrp)P~+M+wG5kvQG!BJC4cl;U#KVTa;W)oSY@Y1{?zt-hD z5S=xmTM>c{|7OGHcddwH;;{j!Tb^kWr%UyhQj9U!YRyurtvAv;&aSW7nkc0hW3bi6 zV5{QA@IJcKeNu`s23xT#6^0`P+Spg$diX6V#TbLFw!rH7s`L9#TXd;CQi?GKTi0k( zWUKA&(QTV*`8pw`7-O*2PLraRIQ{8w=ju|m=;n>U7=x`iaP>_yYyBS4qKRg!t(0Pn z!B%^gQm@wshZ4WmrBbC7V+^)BuoSfp3X4*6{)o|RjgwN0G1#KHYJ1OHcj;0ar4(ZfwrE@?@?`?`#efadYHPN>mQsu{*y?GpRoNv6pFqmS zs9cg#j4{}vZrN;7>wMPId3)+;QvBUC;u&MGMfVmxU&qe(e@vI^BQHK<47U2PlzP1i z_GjD>soAQZ+~DaIIV^<^o_7xgxsmtJt|QZGm;#u#k%GuVpD zUc6P8`b0`G#$fAOgRLK$I(z6+e@Q9E7;N=7*m^t48>>s%Xrh9^7=tZ4xZ-+IzKph9 zQi?GKTMm{|`@T{gQM>CsT&Q$5sAPUgRKGJiZK9{VP4_pmU;^NODV<}Yz<^7wG7+7pZumS zHAzY_#$e0IQfm8ZW}p0CgjVMtkW!2>*m4KkEM53wORdg-ETtG@ur4^vJ}k@DD2-bw2zR=1_lq3IWWeM!kfU?XE)#NKlN*vR`QQX zTZ}QJa4btv5mOm%cgEpntd1Psky4B?*ve)p^$xo|=R$Q|>VTADjKS78mQrn9?7X@{ zm%1pW7-O(Co~6{1k6nJ(@48frI*3GIjKS6faP_O4H+S|&x|BmoF~(5xIV>e_+scYB z_SF(nz9r8XLkj7V=p|3%`RZC3=1N^F$P$q}*Cpm#S?= zBm!d$wr&Aezc2s!)P0R~sRSv-7=x|JETz_{R~nh)bgAJ|iZO<(JcXs2;Yi_*?{~@+ z`d($m7*aSDSW%-$YUHi?xEZT0?(`6ht#kAdU6o>l=gm`xVe=jI}<*;A+I1|$hm+4;BmOBLqPLqI>PV$-7R@wvex z{J9g6o1#gSS&MF8<==hT2N!i%Th2paFW(JSP z1}%Z{#o6>k6i+*~tgE{|(Pnu*yAEMVHT;R45JJYN1?F2~x?Jczp!`ctmr*lCb=go% zI)pPXGpA*PH(%lG`b$zwND;qG6IRWWe(iLw!JL04AR99Eq0&GbwD_fgS*Wv9@}}Kf zJjtg8X=&3^p>9LNJ2I#jRAtJ|7|=4Z3nu3jscl3Pz8N+Q5rmvRO>`sFVdx?R4IV=> z0!zh?Bx`0!CU}f4Bb%+FV|_W;T3$WP&K@}22@6<$FO?dKl8rqqa!SycW@U?(lQVt# z(u1-6<3AHEigjjWG{C$bt){lI^SJ8{45!E1M!O!ePnRcGA_71 zL}Ir{bqkL`tsEIrlseOpMmaLLsNSxEOZ&uMNkItPvabno{bf@PZdi>BZdJsp-T9R? zXqe!N^sYa+5})|s3iMk!2 zs{#}nyH!KI@m zfx)Ye0eGdVV*m<`!E1y8C^S|9C^QDI5kWLo0Vp&EuMt5sRskq92Cor8G*$s9GzPB` zK{QqY=vQ?DMkaoBCNN$ksjF6-0}N#Mo2XHcuD5u3ILIegxD)U z)Ea*Uh*}_5fT$&M1&GX!K49}72=)|Z<{1B&AO>C=2h_G0c_R8mkdy|6fN(#TsbPr(4UqyTfG2~&Kg zxMGa0Xrf~4P~Xw97#D|QPqw5)n;x#VCtKHU-Fl1d+GtO?`V;0b(OoUMR*p0Z`ff?9VIzt)H@2If(T3uTwy z*gOjied9`j9++`H{MPiR`V!rU5PAr;wti#a+Da_xV_Xn@sa4dM0o(L&#?h+fS z{HS>k2PQ}2u9V-Yz|6XezF6pc44C(-pzkAK_W0}b>&Kfz-|rG5a!c3OZtv`eBS>Tu z6(N3u;cSR%TLm0lhV&}nsGGW}3OMRF3afyl{`mF)9QN?@d8QADLW_XT@xv+j#sGKd zf3t_iI!fOE$Q~NnbJ+j%J{sJ2Al-B4%`aWB@a{#6J@*P-pFh5hsLk+)vz@!Nzi`hD>H*n3~Tx$gW67xTY-u+ZD&)^Ed~t`X6``WG*} zedq4v9uI!={#~7Bc<+7O{Ob2{wVGak;f>fIE__k)@W_R8z0R)tH}?PI+mrWY-2T*$ zx9!cl`;)C1htxW9%biO)@2VVE;{iFs;f3@lWzI5w3C1gCK8ka>)G(HH z*4A#DcVY|AhY>9&*j#d?lzEV@fq%=?QQi|&Sj!s0w`ta2U&l2*9) zo<9nt!V5Rg!IE@h6(6j!Yk$`czSH}uH5w;$$fCnIIuz(KPG{NuiwTGYpY1xkYvQJD zi|7<)6rstp=m6t*`SC@EL3`HH_=$y%HxeLPLx>qz_iy2|5H9_YwUl5Dq6M+%0GIaM zCRXS2e#UT0zjfhs2zc2n79lIPmY%Cte9e1nu-?qEk%&QFM4G6z`$&<$v(xm>VQ@=7 zq!cM7SW)~_UKAFqD1GV!tpg~nP$ly0l5540@#4P6PC?Q)QY^SCQuaCGLg;)KQ6kaE z!h%esmX@om=WDpwb?jlFke`zN-un*|`JJ^m32XhK)NPLSQQ*)rXtuQYa{R=}^i2fa zadBE~XDtV`V7t5wBd};7;;~k*xPIP6q*vF~OOzGe!F2Ix7nU&>0+LCqX5Je+7bxEq zxA{uX+d|b-tX+;3@v!(d^_*+*Z{d$ql9;*|$L>t6z>ylKMImuJQ^zza21Vb6dE}2h zfT>xagzO_)EG^D2aJ#kG)1ZVzGOoRdyC zWj2lurtZPf&eXFwYUO@CW#w^j|014>>1tn=1gUD8@u@v(^fdPMp?oLrm{24=BlHRj7$GlH%$ zwewC)VNqA!9_!$LOcjPyybF^>p}S>ARwdWg(^pVemoS}oA_48zw>>O~wSj|u8N`Co z-b?PXw$On!rT=u7QNk4OsU-`~7T2Njq|y>y9BojLB@=pYEL|o(5jz)TIm?e!cbWG) zJ!@j)(2nRgLH_o_ulEpx={7V5r$f98t|7(Px?_xc^2I_|*}XJK$9d$uOi5>gc9t!O zwX+)BWnERwi*rEeLf1C5OB zn!j=-r+uT8%p{Hz7U?vsBtJx9gvvfj6DwirWqEm{qZmXp=>dwWoP|F~^f_QUQnNfVtF)s?# z(@Zr2C2VvAB|42`h~bf*$iB}qjcEP;cPa<1GJX)lP`-5DbLiM6%Ymnjws)|-Ylk*0 zhfgC-EUAuLFCD}XRF~-~dqTd?>TDYZp4=xP6KJEpot5W}6W|H$Xg4+?grzcRe+hXj zr!{>GP-ASUE!ctO`|OIkkP)>c4wM+P(0y5qJBmPc#=k{biKCsVcW{)QX^?f+#r=lY zTSht1>d-V+jij+^6TbHxFWSbpB$Te`e^5Z5Z96xniMTMi%kqh#75Dgp)oxE5M!GJTG6wtIQIGtbP@S7IlTw?7wf+B z!nd49j6%XhEVjI$@kV>VQ}Hjh@T25gxK*VwWvWq4snJcWR@f69HDrJgE6xZi4CmJ| z&vz9?dW5S6HwYmiD3YK$VOAQqptTweOa8&|_!VvrmJ%S=V z)0oFA9xexoKyhlw0wE*>MH0o#Yuw19gzdEyn8%5-9tW<`@)~f|FcgH)BPh~yJM$WM zt*x}o9jvq*k*Tyyaw{!O0~F($jfz6|c^lAruISOY8is)ox&=kL=Q7XK)S@&U)~KN2 zxCRMeDD)s&4MYnmL6Owm%xhc^D>2R&I1-~6-EyIb;3G8~p+iuFyq9^6+eavklA0=w zOm&s0lUPr&GJKQ1N~1_$Gaz-n^b$l3bdL~v1x0!vWS-5II%z!qx+QeVnm%P#*TjVG zw&J{^Vq4o1ndX!^6CzmpYlWccVk9(T_5pQb4%y9pLt@^GiTnv=beAL z?_2U?<<@Nr>u+A)YyXoEF6(^rho0xgAKQ5J_?nUdSCy1;^C?7 zPYqgM(e2u<56!uu|1AYe{uz9_c!>FY_}(##hHQC#`28!M?t4$^My}t$!xjq-fr*3d){7kXv)jyKk4zps5u+|xpUIKsJ(AYZ`*Rj!LFT` zj$LwLKtY>`OF#B$dLaL&aeutABfD?v*g2oRHtlcEHwi1hiWv37-)EA|&lD8y`g~ke z{Ll@z-EbYvoH^M42Uq3Us2bINeV-1~yv1yy_kk3ixi)@^py+6kBx4k+q}lj*jjFQX zP_zyIarpPaj31xdOXGmx1z1JrBXD@f25zN>Va-#==g_ED=<$6INvRONt(3@pS&bdy z8**Pvb;eKwj0V-~g@G8s5!x41gE7?jN#h!K9}L6&F*O-O-5zP2*<=;&h5i`Mzlpk7 zim9mP84-x7g&4Ex1de3&sYfhZ12Hu0Gn?pkMg2yr(XA&0Vt62GqMIOL?)mzWUji|a zh%uX}J8cE3ywC4X1!8J5hVn#de)WYdZ38iN7_%EkO7m@X9{(#4V`U88*hp8z&=fo+ z@GqYz#-T3v hP^N9DTi(V#(3h zYq?KyqBN;BlB2H;vsH3vZ4aUOu;hek9GVbNpp`rX*+z2om0;|WqnC5wDld~IhE^yM zutje_^?XHa`NC(_hoe%8F$P=oa7@^ue5H^2 zXqE1{RZHF)8Dp^3)L^S~!d;)~Qt?uXF$P;SkksqOt;gEEsQUuCr4(ZfwwfDkIV#^j zsY}g}Qj9U!qM4nZuiG;|-%?Za5>wX=VvNC7OM|V7(?_sq1Kk5C?2xt?W3XjItl324 z11iIUhy{1(Ug;;L6k`mwTCo)0*FfERq+T6es)01h7=x|WniL3S@cTO*`f4$~r4(Zf zw%TY?R1w<#@$y%?lv7GE#$YR!rRYva`I<2#0=>uWYqO`|Zp(dTIHYS-NoQWOXS-#ef066hg-*+lJ*!V~LS zp+i!oMoTHe7^OOZV>a1vq;U9^f`z)&LsE(`MyYsk^tD(nHLbQom-<{v5ymLhk)^1| zqmZ*A(MKwrZUP8|F-mm;M{mn#KU{`elbWx-Qi?D}sm?5=;_f;6JBA(V*(fPR7{T-X z7Eo|zN(>;R+2?zRF07fph%knGAfbLfIbjz3=B5|s!pAT-uQ)HKczU52?@yaPEhkTq z`O`3^6r`A5YSQG!M)O$ld8DdS;~G2=HLjmumd2N^CV^V~+yVJZiEar-oA?YBf8ZKy zYFz1>qw3cA!Cdg5#V;)aPbm#%mH9#JGC!zg5fjWd$EYql|NHKLJ{d2{n=&z*CT#lE z59tQ0c|&GrPnn)GehPf?a`WMK#zVyH=>_6D-R$h~IfZZ{ojxIZV#%}|az0}irpQyL zPs_e-q8w8CBm!UmW@DDA_^=EQNTB22dbDXD;D}2sKRht_FSq#{`_rHFbaBYmo-T3aPBSWKXhu|5Zi8sqzC4-u_tIC}2!H|N>=ckSQ* zO0CXr?``ibI&(B6axL}gv(gIyW+{@wd`Pn8cZ`}fY0y?+1h z)Eyu$Hg!Nr|L%50l^kSGO-V^l8IoZay&nKB{158iou6*@?@o_5`zH#?{Qf;O$yA4Z zV47=y!|6`78}eCY4Jj`BpaE%_sY6mz?eY;Qn{n~u(f-}V4U7|`n@t&DcRDj&g9fEI zg9_o{sh>p8LCD{rtbq=@c%LKzvo+;DdP&M5@C(br2B3dmz~l7u0(IBc{IsaKXI? zvN6TJnWotYGz1Cu^*gPRdn+*S(104jg8yJRda7|qVi*_#NAKg0U@F}WBT5Q1GzzAV zRLultvBZT+UpL?$1ZIoG(TFRUzW#_f08AsAxFXQ(Fc>Zq{H8Qb^$Edn{SiM2xR)e0 zRQe9V?rXp-p@}5|jn{+edj|?$l^6zwz|nKLJPha8%OSm{&+qGeD!(t(VZT%u>TBzt zfIID@k8ytbsCc6=^^B$ICj!|Gr7s1T!Tz`)`lbLg*B{5XGd95onvp#X%qoAJpFYa( zc3=+p$2%^shOoBfyh`zzV+~AM%(??Bmro^ye972`fT;T4lg1%K% z)b~1YA6!KrUEi;(sP80je_ur(HH#)Tv~&DZ(8@VT`DNMg>KFeMG@M`g(e=IEhUe_~ zr=a12=v!%1lsEBDLBsj!qdEIto1&b>KLu*Pp{|G03NK&rPa%}PIK*`TW|+j8a2`tE zjlfKjxKR42-rp@TAUTB6_aJajUqv5XkBwE-_Ze`9tDx^6U>dd-X*1y`RQhbdbd)$P zzdlbJNCVZsK@vmf6oPp{P(2u11suJ_m{tWGwadGzfU5@Fq5xc=cf;c-2#+6*z9Pc- z;oo>S(6FK4f6lw1Tf%?dw?VWer2D@pP|XS!=!*Qm@V{3Aj%l;t95P{Qeo+y8dTqti z*=@v?K4O3kubJ|u<>uwuCd^`H>hx(?QENg8CP3_8QcyBsN`B6Gdd6TI55JWuQ*4MS zz$#4Ss4{+hKXd5;lm7QG1lj-8|#pLHwY@0ehH_tXBzj#tU zQb8Usu!fbPd{vFlDbBwQOXk?}izvD%A5YVeJXmVYrnCeiMXfvAhL_|_(hU?LKRHuM zUN8n|SRlD$A2uc~Rf7c&=<=IpHme_B)<;UT7zaRJh z-p1>nE&H{}${xRe?4412+n0{fbB2y`md%Jg+<*OnK|OCtUH?aenCF^REP6Zt_22UD z{@<%I|5saHaq;9GXD)R4c1X`D%deeZRNxqQ(=$VcjC%jx%N?6%%o=&3!($J7_Z7Bp zu>H)wo`3Bts9xvkN52^OPQ^3V9qzhw?AvW?+fxp=TX^Ecg^Y~1j{Z`aR>$`C(XVP9 znD^4wdRl?VEk)Xg0}`H?qTvTdKcvTjtnBAFRBg(z?L) z>-~k5UrbnC{h9}MPE5(zKDE=iI?uOEU46dizP3+odA;(`oA*q4p!YZX|H_|uEbgc7 zBa>g6a^s?>W_SPW>DPaX54&~unjBB>BV+GrQRn>Uan_YPyLr1e>wDX1&#q7Vt@2L! zxX;>Wde7Ps-_!Q@;;$e1b-{BVR9}|6bi<|PJ$^nKvo0f|Vp)qtlN%@hGcv!V|Khs$ zZn|gHlR0~yn?CpVwj=h(EOWHHK7Z%1kJk5JG5vJI4dwfk2_I~{)aj#*haYI1bm^rh z?mqj|9tZ(i&x=E#$oi ztx>M159tlGH9CErHOhhSV>35_iBDwHD?uN2mSwIxO2(X}zne-(ZzOx{&kf8r8vWU0x$aGmq=CTHons5vK(C!euSH{(AeYNGX@^mRC7ZaQPVD}5b! zsWwn_Iz1zSVk;^3FvV6<#9?pxIpcU)yy+V~10ucYn>+)e zyy;s!1L}Lzw|fS}c+)@j3~1&}uk;MCdDB1h42bonAMgx_^QM388PL(2e%Lc0!JGbr zXF!rS{itU^FK_w@&w#!nXWq<{>i4=%@3PouIk#KjadH!Xt-BiM7R8NYB2(9(%;^<} zMWHXMdoaZxpAPqRrYk)Wljg1E_8v?#yP_Q49gf6|1c!IHE!~@HNjIm~FW(Vm-jn9t zo1Qp4%2B?verj3A@O1C?^u&y$#NFjPV(>NVBnLocmS~4JBi3Qwfv;L;rX^OUdC#XO z&aMxc#%Z4Vv5xXjA)8badc&YMCN1$3h{dFP52q*Q^m3Gc9F+!D1?goSYe7$(!~Ai2 z;-xh2DabWWPb`XYlz&p+QD*6qTGp%vbVNc&v$VwTAqX9nNL^o8ib^kwjD&bchk0ju z;wkTWNHumO&Ta7xlg3B^QtG)iChOIel-vr}up=c}BiD9vlz`*Zd58BLS5J*Oj!(U20*oVnE73SoEufQd z_3_gS7Z5*vy{S?7v3pbN<0s9V8iOCFH?e;UuO zeUy8(wUJB3CY*~8Ihy*3CdU0$N z`N74E)SPL{*2J!ZhYD&y7Dng3HDI9~sdEZfA~a@_gQG%ss8kZafxs+qg)dV&4VCfL)!aXp#nR;$K0`(D8JcbP@fo_Qf<6Hdl{^{LQv6$#K{!6a z6g}XKVCn`O={9XqZo%;>rZD`KzB{F$M0I>nqdIDhffBTeC5C{ahbd+y801`M8ir`u1!DT}7nt&4b z&TS^HISva~97h<}8%HEn8*ep_Bg&g%@i^*xQ^Gus7;j3X$I;B266JB&yeak39eYz^ zaO3c%G(-2FxT!+4>NMOK(4Ufc5{vhOIJXgxqp!2H+|Jbm;}`!X9*0zll4So8_9PiT zl3e7eH-{5%dg595+GKjqxxGhV!MSj6u|3mU>GJN#jNfBzX;-W*7eEKq;)mwaPw54F zQ45FlZA-Z8^44x?P3((J&dcS_%iOoPN>7+d-~o+VQTn&tI=?;Fl@m_So3Sih{%ehl zvZOk0&lEWGc{jP@%bg%??6Bu}KaBKG{%DiieAwyz$XR~4hTDA7?Rh?SF(TaFTsYyz z|L*n_!{MnV(z9Rn?YW$qkXhC&DboulV|V;ExAzlw{HKVg$qV&Wn?vCP8b%-k4DU0&wGABy9Q zmo=lT{gI zJRgrcTHXOJ;0Il$=fesU;YsC+uXM$q`+zE+EB++vJ}TEBZ)9C68dqZYAWvkYOi@`H zx{`O?_Cuz3j~gP%<n4kv2Hpt6pNGx_|C zTF&Ipt)+jFnKIX9mwDHqvLsX+jzDGlmLk0SC^cMps6<@e(^TDKN`LB~={@C+KkM{f z#7!Xz>E*huRc^g9p)Q4=#A$uhaG$D#+F{je5`k!9GNQL$k5G-mX~yEVaxFrn6_sdf z;qz`UQs6B8C#TpdLmDmNhcOP1hk{OTE;>vs{npBXw6n)N_ysZ$5%8OcM#vdRV zSNs8Y{Pq-7pT^xxi!F_*_P9!qnMzJjC5s|YJDU?WI7q~7=4aBi4 zQ(_BxY(t-fZRiWYLKq`{_(-)$xEBeEDvh0azFW|%5)>Z|A-rs)Ntm0l>l zc1Dv!XV5MKYZ+iqp&9^lBS^yO0bI>IZ(p_c{>bON2Oga_`N*LU_MJGmZ^DNeyPwQ@@U@NQPfxtF`5mh3;I5)SKka_g z=e?(Hs+ZaJ+Nl!~hHV|Y>!}+D{n>VfrQMrJpFdrr?eeZa-nC|SNdxz!A>O8Y^PUZ> z{j_rE^)k|L4e~W4Kw6~Tz<~SF` zezp9EXLnwFvHFP}Te7xnTyc0rqv%tqcPY6m8$MFdJo<;SodrMpyB@wfEBamAwJ&sd zbxOD6-P?C-vu)jtm5*i}#sMHOzV3fy zL41}?t>H>;gw$LJJz^<2q7d3w4<+AhQk!SW^%*AvF*O-O-4aoEY|AST#8AT%+X<0{ zMvKS16o{$C7`nYsZ}8k(X+bdIjG=C-38;#V3mXRNp}DTvM4uf|*l?-$r9cdI)n*gj zm?%Bna!eluVtDRqqHdhZ_dxXQgMpYjtVg|x_Izy0PLX=wGNcDSq1^w}RFYF1Sy7bH zd?eQ_8XS!4$Da9Crtr&x?In|rKrb`WxQj9U!YHYCeb<|R&j)cA~)VvNBSebuJBBOY3C89NKA`Kl+n zJcTg^TQ-&wR|KE#HR$KF?Q%CM#TbLFRt8(I^m}KlZfm%dVvNC7YnBqN6^}TktxVCS zilr1|47S=BY#sW^yg-+FL`pHnU@MlT=tzxe%q`nD>5heOODV<}Y_&DmDm*vzj4t)L zlwyp*7Ek9)anja36F&GsqvIkVm>Z(m(&t*QlgJK4|(V|2jl!ctV{DHN=D<)SXtPf8KS zD3t(?*+h3J3hQ6GHCvaOB&7&rl%jjD-bWc-1Rs%7gfU9dIM7Uw{5cq11lLI^b*!i; zA4v{@h0GoU$Ja%WrKGahkRyBuG47RsJX-6>LaYfHBe z$VyGi%yPJl4soH};2icLt|9O#8=PUkir-sGihbaqfhie-vNG5KEiYF%tp)W~`!Dl7 zOYGVeAC9ZxYQAUPx+Zq(&0z998^gY5XK>e{ca;=^`JTDynSgHy;(N9p@w5GK!FCgwkh1#4g}I zrkMl+4Gn_jg9e$0fvH8aIfPI+dVD}TZgh~iP0}VnN}Z~ zHz9=5SBAJWVD?BHjUj{SqjEV9%y^nnA%xOLxXHlmy9#a7)Ga0Op`SE{MLrfHB7j8(Kbs=xYT`SASd(eM5j5B`7=xa)yj86zvU)liIMPfr;k1*)TtfIb=z>TkhzPqZZ zZxL`0T}2<&zt^g$uN=7DSJ6lH<#-kKT?Q_K=Klzx%8zab?SXMf9QBi-u15wiqpqTl z(pLhE#~&A@eY^zB8~!-I_Ce{}1I#ghTo8RV@zkOoJ-I*#m0!9ZU4e1<;3Cw7T z3sruR&@n?|SRoFf(pL)H{a4XP!-7|U*&%UPO5Z+U4qZhb^#_+E=4$Dyj=@MY4M-3| z<(IB+7l~mY4x#efAGnOG=%f0a56nD&T#)+m3^1$xaenoM+S?9bzVXKe(RUG;n)Cz= z;Y#^!3ru%^To8T3fywsA`K6Dp?;XG_^~VL#_YN=>{y0B{3Xh1aUB^oC#J06+-6po} zHSOZscZl!UsdJZvuH6!oy7%aL>jcx7%r$LqB22Kb_qmgYhyId1A*{)a2W$2l-LK`= zAs?>Uts}pG-SqOG?=-pn$!5Qt*!|eg5#w)Lb@2I=dtPv+K6tTw-O`~oC6uZGg-G$E zJ)Mt|=hXdBpy?0=l~2u-g37NUPBnR7|GE}vBNm1BO(JIxd=!o^b2rA$g@ns{D${$E zJ_|1!cpjeu*RU?SgnHx|nuZN2?AEupZLk6rk3EsLc{1$SF3lR98fASu)$T0Ii2i5$ z;?$_4h{v`v#2FIpH1Cp|4?$pSYD@U+!Q&vq#Gq2|N~pl*p8!b zh1VgTK8Ky;EWK3Cy5MGtE4>tDU33#D``M37)`i1Ckt@;?Kwb0xp$$Z=rPqQfv{!?6 zw`a1=?J0_LdL}10x25(1Qt`3a5MVDS#SK4}0@@XBF%W0Vql&{foWZ6I$Edh67oN2) z_?Y=&B`Bcbac9ddCC%K)r)PYbFdUiK>?}VTmS8U3VezoCKj}&iL*BY_`6=d8?zP zlALNUJVx2at|GR?y>hE4Lw%Yc_ralbJK;$c;YQwM@t{g?;|w7V?xW_!O;nqYb%h9D zcyIZ!4m$0drBM*L4*wPMyJY%BB0e0Srxrp@jz`~A$v^&uOurtesZ>O*APl9%N574fF+Znwv_Avjh zi9JeDo}%@cp5g0Up4ls1p44Yayps8;j}yHKbfzbD33fX}^kNcGaLMC%|Gp8_9(PNg zal5lqR1f5KX9cQT966z`gaYThEpzcheyG%MB_it<?<)Os98 zFvX5A=$Q_BJ*3N9UV7Nv*KA$54JT-T3GiGg>EumKD?Mi}ZcMwy)Gyr;wVqn6Xn}OW z#=t?u=|Kf!+Ks9&s*5}Yyvl_;zl5c;h*jS=8Xk8kGRs4Dkx>5&g<@$?DUOH%{miX_yOz8_+3ZBSHv>YKy&>aL2MPxB+~xJuJ3m z-ze+COq{?~XQjC4C@PhvVNC)e9UDl2vy9(YIM&bQ6Nx8GBrxPY+ZGWRL7kD?#mW8o zXm>tq8AcjDTgth-8xIj!>a>o6`%z{Tt_`_7ZF73ku^2*n6c#~=c1ylTL4Fz$uXN!E%OM|PU=)(%c&+4sZo5|d76h_C~%N6j!g+nem<^D6y zIzNjBG3xaf)tC|^6!;0lKeq#X;M6#HN7bgR@UDIaD_sAa-puROUXYy6sTPOy&20xg zqGwD2C59<|HnT4ZhOAA4fn}~(IcBu(jl$UW#X6juWDM=P(3y$;}#iHy26~VkO zag1Xg)vLkG`x(bp;F*=*K+#ObqSVE?XzaAJUu%x-fFow4h#d{e#=MC*wq%NS_7i>P zLQq2DUQi+h4}%gmo(DCOwa|C0B9^{Q6`D_i5}Gf85}F&Jr3uZ{F2x9hzUvmU13?MR zgF%VZ(=&*(Ad!*&u3sEIq;dt&; zZvZ~`0yLPWqHjy1d&K7|FKJGri@Wp%@-~VU2cR z`t88Lb+H4^&gIc;AaMFklWv-SQ{U+oyB>-W8BM?CR)@vtN6~|2^L>93`aqEKTm{p9K5$+?Cc*dxCvS-Md zHw{>6;_W-@wpcMkz`7%tNSKPNV>VGT9aHf{F%{4BZs8(zVoJ~(n3_@!d zq^6NZ&~{O?u!%CB%It=qJje3`W2(DUA=M?=!#+T;jXEuwxI`O6&ULgjm4x$roTf!T zyUqCf9gi!l3m4-Ss68K`fouUSUolA=*NX(xWE>Y!>ngC_uzGisb4PWBnlU~z$WM{| z9{9H?)o{(lh@b8cVpus!qv#GIaC8R|HJ9$9LgE^90iv&VX#Fj9l9<~}iH)IYk$5t8 z5H(XwL7m=T@L0&Y@FZ+=m7|;A+43;!!f!#S4~1;*7s~lw;AqSys3=Wh45)YUuZCc{ryw%4^L;SgLW1=AI^PG=T_|+p=$jIH zS})L)H{F8J>+gIYOz%uhF9?J4eK5VE^!%OggXz7K^@iGUw~UO*a6Nv-RT32CWC8Ph zcMEPW(eyK#V=3=~B8hvLXR2vZYHkLJFiHII@dg})4MCB_66S@Hpi&kRf+C4W10?dm zQNxWOgoL0-Vj1&7*|W+w1>Lx`fb%$X$+=7U4h~T*i{Zh!rzmOIbNx#ax#u_pRDQdYwinI!}nfBl=7*9u49)KFa;$1%nn2)(2; z@hW<^vNY+Xpq5}Ly`nrwCw-o%hH)VL)B7>=Ok7`Tp}vGE)?uQ)m@raN!+1uKH9=7> z_A;+=x7tcK1P~%sf+F2CCO0crT5KUl zlM)n3(I^PZKQybU)LvfeWX;3X3oPTzS)vwVe1urKmU=3-;7koPb`z-(6zThcdAyv* zFrkIU7;4A@AtVGv62CCd6j?)w92QntW0St;_EJ?0zclX>l7b@1lgw*X7f&jFK)pl@ zq@YUCnZQPA6y-%o5h@yGtcGCv&mvOZTmGoSdQ}OsE+mXrgao06`P89cy8jlsar8|I z)fRy^S`d0k=cKFXrO`DlKZ1A3NV9@+QT)oqSQ^4w4D5<>A^pvKYFeh%m&HX_}mlRj5hL$Gw$XT99tCN-cwx1iRzuq=`&z<(6} z^?Lp(v1OpA45ID{imnYk5i=`T79=&Zj}2S+loZ&+`X7SV$&o(X)~0PqADbfB!8R5@ zo!;^58Cg3m^`d@#t=f|M73yjr_dmO5S*LeuhD}=?w)wuN1y$6px0;fzkaCjhSD1kwY<3Y+UBi) zI(_!^{h6IJw%k!~wdMA2H*DK6Y3_yNYZH=x8jx&xDDA!HlKMY6tHWn!)1F-HE?-_! zKFBh&L&aka-MyEWto*C+zk4+ib))jG7Y=$ZemOW#-PpXnX@2GDOV2$RK4f}_xPB!s zW)AGoZ}aljWueYHcerzJ?wIft|M;9wD?bbOtho75+t=2)O*x~EyW(c1hyDG`=At3L z4Q%;hWrOwohh1*GeA)IxkM`?)^O3Oom)>~c%Ldl&brP%FqH}i~jQ#rU`HL>^ykyHB zdiR(2RnHs#+*41q_;uuUU*7XupA8$=9hkE6;jhOoj+#B<&)#DrT_a{6yy?X4S+^|D zYhF0>z7~!1x0nCCe?-i}bz`cn_`c<*=^xDXU(MvRFM4l!@W=Ag{pKug((S|Ty)T{2 zjrh>>$Al&q`mI+wz4~fa!hp;aWybNQ7R%;GvUY{9J^g0QQ@P=5$F&;$!;ppHYc@_k zKJAyJ>jr=Qs5$)ftv}i-`rINj{PM@Ui!IUB6=Ysn@RExy!xc_SCT7 zI_<0b_tuVm+f^GmBfs8Xf7_>(?%j5z_!|5F7gkeQuQpEY*VoIHIs&Y>fHq3OJ?z!x zf}$h!BNQ0JR9zgY_3NCLII|fz9dXvn!0CfC>O6#$?+PAdp=ztCP>&T3^z7BYbrPSQ z`szU+4n5QpRmXqciCsSiVrnvm?y;2F?FYVmAP__SmDxn&X2SeaGy&Z)QNFh54T9OU z1xK>_!qmvlff!1u*)$19lHT=x;ru{M1Y>9%L^rCU&p(Aae_M2iFq>$0L6{3;&r}3r zaNh!kjwGF$QuJ#e2KP5$Xk3KCQ^u4x#^Y#zTUN$6aHJT=x2YclV))vd$`DUi?*2c{ z0q(CS8Zmm_qaLsKPauZsk&c--t65GUrXFKxUO~3nH3)MCV(4yZHqj`QN_@$mZA$_% z4H!djKd21fJU8g>Kukl%TzR#bMvPJKd&bS?ku(ks6&u%b@rFb2Y-|@E&=R8nLn%=d zDn}7i&T}e5!@M29`8a@cL~`^MY0gMal%}VKNwD;FY#K?9zD5nbO`}j(lNup8`U*Ky zB_~?LcqONv#(7$D^fhYUmYfC}h8}TKsIPGjNshku4m~WVKx_Dj5(^VQ;Hey1rRE+#TbLF zW(Hfd@{canSxPa+V5_;o7OniFOQlLF#u#k1U@7$uO)LNCQrAl<#u#kTJzQVGgI500 zrKUk0`BftdUZT zG1zJYte&rkCD(4(rM5{a#u#kHvJ|xr3X|7YG}qVg`A$kP#$c;0u)3`~X7&C_m%1RO z7-O(?4NIxET0i#6ZhcJ{Ox8It#$cX>z@9#V=i23v6fw(4qSI9f_E#$b!a z9(umWmM%44N-@S@t3!aTFwNE~Da9Crt$2g2L$5|Wu1oEbQj9U!>KI@vTC;UrN-@S@ zi^f65eCblr)e(un7=tYg^&myr&51DaIIV_0?>FP|})?nHQnu>pdyO7=x{T23s8>zPUx0`a()E#$fAOmZDyW>fyB4 zU)rp%3wKgVF~(r4zrog>&2Rqj|FHKa@J&_Q+wf@QnHWZ;{Yyp{vGKkExPzLS$ti8{W zbD9AE``-7y-}n2zt!Y-)e%9L4+T%IwrAgJMZ65-|=+d%*%WIzE>1M5lYPsTMDTdLd zWml!B=ILfFO{$A5#W1?Gl9?3E@>H%S+s1#Z-9abHQVgR@t2>iY);615r~lHVM#xeO zqf5)dq?9=&KdtsE?M|~7WhsWyrRCJ6)%l^72Q;ZKWhsWyrPYH;DdS=4fV zQVgR@tEVolJ&U)*Yf`_0N&P8HF^n!PmoBYY)1rRYr0UC+ z#4x(FdNCY7_UK6=o%AQeIh#VRUKr(WSNdqs?PAsV`(H zhS8OEIezn1TV<4VkbZI@RODpsX39s!dqv)@4S`4F0s~?k6>ade@4yHOq z>WnPKFuJt*>(cu60|O++FP zMlba^IKghWbI4MJ(MvtSq?D5AZ?{X8r3k|jIWh+fnUkmE_}^~#B-2d)@Khh(gaj_H zOQqY+Q`3j%3>U^s@cS`5-S5Y<*`xe^!BM8)FXfszy3I_Xt6UkUM5K+$9F5!F#*7;| zK6PZ)_-9im3?G}Dk*x~K@guV`GK@U-2qpj%WiWE(%f{41)1F0&V{$YY7*MB^1WTVP z7#ZW(tzfCc$DuNYkJ8KM49~hHV0doM=+yKK!!>)9GD+StHpj0*cve%DYqp|sn|RE;^Q@*&TEX?zKSsBCACkX^$HKR%BD(e5g5HKS>XKZ#V)st+%#_Q<(VvKj$A&QxJ01?g)AYkkQ z0c5K{0;pj&Uj@i67trn^q^t+(RaNdZ1W;!d0WzhJ50)c6DoA$ppdhNyWdr0Q*sY2v zfYx~f$oWMENKfwJLFI&4eu<)Xr6t*mUMg@Lm-D+@v5H*aI4-AMVp%o4z;RqIL1zN` zdTJ_FH#m&u5jdrqWlV=mk(b7bjlI32vyT` zGLzM1f)x03dCj+vHS&4Us`3@f2#oJgMUP?;f$`QL_>NWhJU>}6)5#FRe0&1oXcN5?iM6J43D zel9RejW{+MB2o^K_}&W40VB?!kJ{rVFp+e!f}ZdKk1 zz)ZUXee+}t<&Q$J{4ED=&29A2LD6Ag{xaeM)L#>v8?~gfBLuZx4CSTz>jBIlBQAix z9ANT{IDdrpUQOxL3n5r}qY>8?n7&3_ z0Da?tdBKP?l$Yvn4loOhxB&Xr0<+bKGw7rIod?F;7X*S@jsW`Z1E!r3XV6Faa|1KP zhzp?a1z=t=;sWTK56n^{E`YwRz#K5*0_eLbV_1RlCz!oN;*_xwoirk-^q7i4%NA2-0Fn>4V0_ZCSX1ft*&=&=L7l8?-vrh!I90Byj0Mo{ZGw7rI z^#W$75f?z;WMF0*aRz;qzb}DVX2b>1w;h;rBQAixzksPt6Ar?y%G(B*L?bSMzCkjE zYYc8LBZ14hjXoMrX9Kgyhzn5O^}y^f;sWIFGBD-=Ja@M$?|s0uGvW;T;-SV3%w!pN ztNG{^VBWlqJ{q5w$QYi(;Ptl(xZ*p|ckB-JT?FngqdvoJh*|?C;CkLX+UNFFD`5w-z4g{2d*C&-S(a(gJ!P&=P}=(TnbD2=FU+C3pbtn zYv0N_69#mk5%GT%s>s*5&*~UB^7%Ve5=?&P`+xsoJN*Fb&ed2(3 z$7F{O4jUw%{Hc3l*Rib^o|}5${!Kk2uI7B+e(C!OA^$w_Zbiy(n}6T=VT~1K6S@`N zwR3Vw{LdG^7(e-~^ba;Rf2p#;&apA)Ccp7Xrz z1}(qY`sKo_^=H=D(x3&C{dBmU?UQ#;JUpdN_FD~G zf7AB0!A(tz=6?MB_(jgeuRj`J+@#0nLyp$@?S}8J#x?t$YfycQt9Pd#&e!^8$-hj+ z?H7J_am%O%twS+b38@@%7o=AHvZNz{_2DBFA7e2A()6Z;=5B&4q zcecFs)Dy3KSmypMIlbb|FZZ`A`nB`6$BPo?blNrjNYpPC&)*!$`i z69zti>EkJ}VG|o(FW=dH$L3}o`oEDj;f{IJ0h z_xkIW_UHF~)h4Imk^aNVMWgVyA2r*wA@|hG2dB?H?3uA8d+xE`aYH`JzR;)bQy*=f zQ?Th^-&fxCm&u&g=JY=wDE#f{jKLjGMt);&e(ssKoOgY3@0r?tQtruk^T$_~FaF!) zQ_VI%62C8X=r0kCzdZEN`d@oK_3-YHCw4qKXsk!7^})y+8<(`rsT&t_{@dyAA9Qb6 zoiJrWwP(Nox_wzg^UmnUx(q*Xcbz63EOQ(5Z*=j#zZ_e>EBe<9Z^VWlUoh$}7{iMy(OV&#&h0ea&=iPmON--+pySe(0uNv#r^qu3Y+P>d%M! zeYmSdap$#3FTXp!cfFs|+MSs6)vQm(t$MxHAJ>*W_~+8cC(a3b`u85st=xY9!sMBs zd9PT%9tU?k@LGr7$$Oi8Jh#jG`(Lc}Txzq5osWDpdDx1dR!I#KJVjaWEPQ?C3;zsV z`j5{R?fRf$e91AZ;biweEZ1lTV@^3{kqrS>2;iU|8cZ-_TMk;e>{5Zn*&NGW*%|n_5JF~ z^KZS9-+JAXC(iyYt^?hN z>|FQAAAcLwtkJl|4<4RTtN;1A87Dvg=Ht_OZJ${X*Xhe&Uh!D}9QoM0U241&HE~z+ z#&a!x8{W8E(zIoJx6e5)g`TR}=AI?vy)$dy^=eAQ*O8OzOug^-#}Dm!xVWx4XF&Xv zr7Z`J?)y{en)Vx7|HHCAv$DgO@DW06*^QNFoG)iTJN=Why^7lTLXO=pzQ5w1FJ9aH z^TFp@Z5mrI{lm163VVP5MM3Jf4KJ_S)?-WOp*`Qee)Gxq{(53jSGTF-rRK|@diu>@ z?{z%7_N9mN_x*kH^Mk70J->cJ(oqgq_pZo19UiKZXM!dS$w5QwKLqdC5M_rnF_`?>Rliuz9Q@csC#=ZW>vOgc6^K_4u_a}dL zz52kjHC>|<=eK;Z#CPQKx{pH;XgpBAImLb=2LFYc=+@>I55(Tz5Ch@em6eTgV`7y+ zw>v90J6ATktFjpe%PJr+NZ-Scbn8lScjJ2K<`^J}rZnhQXrhr+3;HH~U6K+XQgl%o z_T=t18jmSH4%bG5j3&Bny{I}7P-1})E}d?Kp}Gn2D2@UxWMc546HfoznNQ=l8J8Ok zi4CWljG`pFS@b>(reIAr4+ncL zy%H%nB6d+sIK}vm;A^_V#vMK~hsgtIXLlHr%IS=S-?C0<)FcZTpKH|fnM%fD@^s%% zlp_N8A}Fv&_#9TyrM~r1cI!52y{{zPZY^%#+l(9+hg(;-H_@F_;YCy}wO{~dAr918 zd`vpnTmmu1GrJkPf@06ZzLe zCRmp5Lu=sbD;wQd{8W+sN}(mkvV4z@$*%iZi`^q#QW)>?PQ-Q0L+DoA{Vv}*v#Syp zHPPM2h|F}(IEs6$Q3ASDdnQt++j;ZoJMN&RRZeV-MZT8G64eQpOyOcp>sH*^bQ}o5 zT4G;LTOW5E?&;boO6JD6)GJ(UA1ZqLg}c0F-0@WrHQ{%Di&9*fh>PJY`E+}tn14Oo zGHo-7dZQo0#fTQ%Sk=m%RQh}^T;*+XB^6rommn56TUL%+T5VrJ6>ZNi@8*dsc6pPd zM$X1XHMa9e&qg=an9k#GbR*GgvsnfgU$RUUmr#5miz~GZ#R4za?ORGf8~ z%9h=Ri-;(bJI+UUdihtfBl8dabL;bA9=M*lz%oSYu=Ws*#ySRwT z(h}8v;*#7Zc~lQ*6V^6y2kD0KL{d#HQHYwiui#C9tGIXSuMvwxa}w?t{P7`Nq;oi}2k?NTytMKGcp zdE{oK*h0iib%!jWHl*LB97#W>4hS!#rXzMau?LvSFLejn#9AEGfH1V_>a01qk}y2$ zVO^Wj)$WmrVjSvhIIPc* z7=EyUVIv3{03IV-8isqRQz_+%YRAWgVtw6lSLo)fOiMEdz?ECX8GCc<(Y?pgFDqdq z(7KTg0d~u>$WE4Jz7FQNnPFn(+L@7YVr5bO5eu&2&BdqyRi_5B3)Se}`#ea}kQ773 zny9IzS~9Awj$x{U*=nB|=7L(Y)lV%+$B@#;DC5Ii1yA8VR#Z_-c8U9wMamGV{HDz_ zuPGXGbaiH@dyQjUQX`La%_EiLUSo{2R9{(j6)iEi)Qv8Of3gU7cw46DLj~Qr)|b@} zt4F2g*zNzUE~)x>rNyJtaBr(zIzDdlA2iU#?aUKGawEmcVpwA+E*7484mE1-q*SL? z=q02VHi1I3T6GmPiDiY>vNusJoEsP8#&BN=FbJA9B9+qMqWdDdBuI6r3@z=_Xxy!z z9vkJ9hM6h*;coA9(e8q-u}*1Xq}{T`VVx9ZDYn|pcFRVGb$GaClXXlaRl`?!hDei& z%^{s+m#49Ni{+``E^V}1Q_K#j*dh6x*4m=)1kKcMv+3L}75h$L_Q&O&>wSmV?B4}B z$LznGMPafoJbx7!oDYT*>NRyZaP zpjJ4>VZ|VoJl9OFO5qf)S~w;eq;TbS-$oSfuwB~cv>x$o2)ANMOidPR-S3c!q*9b9 zMrpGD=akCrWv}tWFoG8j<3mZf6}|8pGe_$=G$0uyHC-Erv%36v}nv%ce)k0@#(v6~|e)Ejylu3fiqOyMU599E&Xic(8M9 zSlC`dq{>2ASf;|S&gM_ z2#;N)#{LY7YuTz&zk}lXDnW6Hx;Uif`i6qyvALjl>?}3*V^CZl-EYmQHK4e}9#CB3 z6ezCm0j#rl$?47#j_U`C+^!*5+8x$`TGJCmp!NA!qDG1t|=%U`yePT(HRs^qnAphf#PYr2#U+T z4vNc?^MjfzqfzfC(7r+u9U8a8$1IR%1C>wzcErxu^3gyJ-Bb&+WV>4C!^68Mw(w7E zWnVsRLyh=5H<%HH%9pNT5tBf-`e(wGMk5KU9XgEe@aWaG0!yr6b2k zMeejC%(a5G(t5?=?RrL^ zK)RXBZ6u#xVYaWNx9Kd7VrhD<0hFls?OJrF9zZ!#DE>~AlFj&_aXR z%eEydqL&IcJ>7X))u9 ze4M7ULZzNyjB-7&)e18}F>RYvM5bhE`4{X^HbZwBWVn^_IaV~4GEtZ(+1XyC9>~rd zezneQP^~0-&hdZL&hn6e@E@_SQ_=p#P>e@RD{{d@k+-W&^!<)wNep6Wc2foJkcJDr zq>+}XIk7fNROeHXmMANJO{QPnMDGl;Crc~l-vf@t$X}3+?xr3_2V(HI5=CmzgJS3q zK}qZu*7gR}kzvu1k1Oe*W!8&0t)s>_Sk_v5{$H@AJ+P%Ju}&*|bTAumO21=4WG}m! z|2wmwm>G!SMdRLDM08^P2*%`GY5PRjjXb7MPej(aXBRs<)LN<>a)e~_`^CmpW)PmV zr8MpcI1GDI^p&GFS+Da*YiCqiW_-_L>N9|BcGkV3_eZKomvjZUcITwof5Z=Awph8D z4imait@gD`zq0$_wQ8h#?xP&85W9~}&=Pb({P5Q=H7jcX!A2nRb z{n~-GN`fnGja*5{mz+bK#-aHSn?)1%BtVz%Q+83qCur(Jd^{_mF~cKxhHsl+WKqs9 zhIwS(A+%I>^iga_f1CU&^{8f4u~XiCX~geKr@M0NS2de;_WVki&Cx(+LsKWU%Bgz! z7|aB{#mU38V!;>>6D=+ITxn^^r&dw&(qyb$b5BlOXtoaO#HBUTqDw5z%q55&zs&54 z$*YW-g1@w2;0{}^Gm6@R=25e-3V)LrRfNABM<-bH){$AD>#b~zN&v+*_X0(`CNrLj zD9aF92=c{EGolb{61srmxZY~)V`}UKQ2bEH3yPj7n}x4H@f@rLWkNb|BLj-(?^iW; zA1Ge7%b;j3Hw)KP99_^xg9WY+R;l|zaft^(@jB=Nss@uy2F25GfwC~!Tu`+c^%5u> zqvnFLGwM4~yllfUsqv*4EfYC!7N|N5cN7%8>0=gdfa0Z$!LY&0c0VYd?jxXhIl8Mn z52$D+I|>xfJ^pRAocl?jB3bUIfZ|$afa0z2HK=-!H3{E?s>`S%P&|JdKwW0M)1YVo zF$p#h;&dY-}NI z1Pm4FjK?b9iF))-GCQz)z|M9L?IQZRnfEgs#VwD52#(Qb<1-JRCHU~gHO>p#<{`D5 znEd0m97}$MEvF_s1U=CSMo7+=gyrZ6!l~-kE6dS`;MHZFy&w!u6HPcJ$3Q8OQ?%Kv zz3eYn76OqgT9!HIT`8UETma%zBEAOk84-U6@i`F-LChy&5r{8{_y>qDiTDP@S41r4 zz6((}hvb|m4V*7|7C5A*-gZa>=Qt$KT#~%WrM?7RN%a6$FW3#Qz#f{ zc6*)S1s*&U89-}uk5J%@gr2B^r^+1#PaSm>3_R{A@SJAV3@E1K0XXLNdcqk8&*z-w zq`@+nM`e-7v8B%Xg}d-FFteLSH#p*Kug)``yAGgIgTd z^K|ft$K@5LEDq_VMGh%3ZVvx|#lAW*D^Oe^kjt`tRbgX}Z zb6A@3?3|wqAs$^UM6mR~duy&wIk5tr!78R04;mNV$Eg(KQ<2Hkl9Ms;aGYz%VFazd*anHQ_@Xb_Qk zEfpR$j?8PL@Mv_GdGQL5)+RD9LE+IrB=Zs#9<4rPURQ-js{om2Q+TvSka-U9UdCvj z2bSfP-l#)M)IfCOhw+;kW*q`7H(knDLyQ!rzBBB5Z$8d4!c5OSVmfbv?v zwq#0=*8`TwVst}r+c0i1a zqLrH*q3>6;@{uFtj@6KJ&;w=rrpXQvFyxMO7iXB1-;Gs(+_COf8FI&>Ig+c8I~JYf zafaNnnsSD&V>Q!wYR8JvcxuPGSL3N2>pqRAcC6+aPwiMVO(P?euG+Eg*LZ5jYN7Ge zj`e`XqssDcdCYEX@kH|(?3xA^%x&ttmXnM@9upZlL6uodDx@xT%UR4nC1|HnO2~0D zm50$K0bQ9`=|nWuD&l8zcr=@=!QG@jBiN;+#i zrDK%P;fAbF=@=#S{9NWK9iya+##1^*Ns`8+j!|XC!AkH>XB?VH|4+_1ta<;B&p0&A z|F>owT0Z>uW}L1_3?`w>I9j)&29_htud;qcyHlB??^tx0fCzQQDY2;xxntQmL+x0} zDnRa7-BpI%u^cKx?pRKhA$P1EoT2MjJvE-%u|$ohb}X01Q#)2Kji+|3-WpHsSZD*fD?LS&|(u0>NZL;zv_*g z;5!srF#T_NawL1d+88-qiIi8|I?0)c^ zdFif8XpSBtFXnZSxq1jyhB2XedWgK>*J+urhsaw19b|zX5`mw_gcj)`G_DyTOY{&L znv9U8dWgJz(B);h9wP51bdXhgh`hPbK??N{d9R^^tkFZ{t%nX$tcS=u5glYBAb8zQ z^2Do$U((#znb-&75R9GnrP|?O^r<3RRPuwcA)shPFf(6yHbzzAFSU$WcmSfDA}ZVe?Rcf$GrK!|-m3mR7UQsD}+QjwID=?h0pqtPbXcq2ODe@!BdE_sgQ*Wr$XDam% zQ2Z!&Ij9TJViLYUpW-~at)263s=OBHPMoK`oA4!g7n$r*P+ay$mA6sl{i^bgsnk`K z3P&&GS{kWTE0yY^QoU7bh)QLu)O3}aqf(1hs!*l2tJHCox~Wo8=0m zdQPRLsnlC4HD9IvrBWp-wO^$!s1)6*%G13|rP`{LU8M%9)EJe@1I0`97ARgDCsp1B zmDdv{%yB88IBucJ`%dLqFrIN-BTzh7EmYovD$k};ebm^;RNfesdO@XLQ>hPCYLQC) zs8X9%>aa>(QK_03OnI)Fs#FJ+>Y-9ksMI)>nx;};g5ssz1d7*23yi^>*A^7#%~E-9 zsk{o6SE=&g(o&Xv78K9lODgXbl{ZJF7O1h`sytllEz53GsUs>y?)bRoY8dA^)j*{l zP^l!9>Z4L=D)qcdNhdWuUQ_RS$$YoUqm6qBc(?8rqwj9w!qGV3lAJ;E zpym{9Z1C|m3>3s~5a2k3~H6bFTwV*ld#FI$W0cA?71G;rf3Ee^P zI^YzgKa}x8y4MuCU&hnOqai{EyouOq0Ce}OUP_Xq=#Ly6_~sfoMH@7}s$Lfssb zP%GUmRD(-a3W_A>5QsGR`EESGs= ziZqp#%TQT4)dUomrr-JaD1paQ?l?uIo{W#|02O{g{Us=tq}LpZKXTyl zdfn3y$7|GIuO6eN!1a>OhPTl>lk2S(DpWgKo#jH22$p9qL8z-HCC5sc^!a&R&9i?_ z^cXGATrcU2Ac!0S)y3P0)2xdS6oTpH?MFK4ravVF()$4-;Sx9keJQzmX|+OAW@tRe z)2WmadVt^-#wn_&d5p(gJ|Bf;rDOg^P^75MIhNX-Q)F%P@G&t|3MeH6(*GqQWy=~+ zQzt>Ga|wMaT!Qq@!$%2$bT2|AuT9FYk`t;bj@GBZ_0B`=Kk!jPAiduqQqJ>bGs}e{ zq1VV|sb;tYq5e=5<2#V<<>2!?&jY3C4VGuFmvqurN(q7V{)9-bmrzRk1=Bl^p-E?q z->4l(?;3^-sTC&F>HxRVezwI93lU49CqCS=I7Riep7HK&5+*b`S_=->;XnlzKtYkD zn&Wt~DNfM{#w7_=h>sEirBRAVt<;KMDz%mmPLYjqy@jB*;iH5=dUqfa^WJN9gx4l^ z5Yk3lg$Hsng$L5d3lAiW!)A7L6*t~d=>07rMS0+Z3*AR`Qobl2#(ga+-EyTohw|ks!x69tv**&@K z{nqrDmiK43>Jk&cg|Q#DdvbSwtbfdaer?-#NK~{muRgN=1C4)f{J7BWo+pQP+xf2! zYoGb?lLNICx5vjnUEZS6#tE;TyWBQnb!nz}@^5vD!Vk19iIzTH)cN=OzRxde>m9YJ z^s%=aezdAI@#^72LgnF<1uy*l!`u!pv`I15f9i^^F!eO8Mu)V>acb+`*?(eV9JT-38bHkiN9Q{zAy-zZ4$GYxd~FjXxatUDpk>pIUrqdVj@DaPFw74{ka6WX)eoj-KDJ z=B0^>8{qcOOuN+j$i9UO|9H0hcaICcre8cBRy%##J;xW8UFv^m_ZHVLQKpa1COX}p zhW_?mjY+2pmQK!XHl(y7tEl?7m!fa3nDvZz@x0GQU0U{rXa0p(EA8K8c5b@1Xv%}z zVx;>n$G>p*mrLC(c4mjPS-9zM?xgSb)a>^}O43_PkFI?5X#LjNi9cUzS}kI8*vZEZ zd!IY@t$S?thMl{5JU=b#w;@x8e&R^4e_dF<0l*k(cjDG0#ujTI1@F1$`Eb zKi?^H|B`XDYJT`?*puxGe}B7Z;NJINF}gu+FyOh5@2UM;X5ZqxnQ+%Lz+ zc-uN!-*AjOb7gS+jJECW?{}e7F!#f6jja~>hx3QWPiDTeW=x$*>e4LO(#AiV*=|hw zhXv*kTp0oDw~fpgp3^Qqes)Mmp3Iprer&sE(^=o-9RFK^sTY|-_^Mo1%D&pAXN<@l z72BVF&~n5SvWoHj|M=fhMm^sYLiYhv_`S)$@)*JXQ17R}FpP@9U+SG2rwxADbev@T z5|BL&^8^?)YHOTqaPoAV0&vQ8oR7gduj4EuJt&l>XA3y=&xAD2Z=^@ZsRkW1)@hi= z;LKAw{;r0p#CPT%nZ_@wv_rWa=d$AJTo#8hJ+uZwR)iJxP9#^w&|qr{p?V?ASKrp( zR29SOI)ui4z=XHHFZ{A9hH_yFq1Ai>DDS*XOumHnFBi>X+>H#ySTBG7OjQi6qcpe1 z55MuooT?ZyU{eUq6TLz8d2L31RZK00p}kc#Q0C%MJF8-9GYswJ=7aik<)`mf#o%m! z%0++i(Yybpf1Jic468lNQZh$#W;;~o)D#p9bwNwoK!!`=!mX_K@5Z1|@ zFqLyy=8&UWj#0iex4n1E5s@mUlgu%z96HwJLD7?@yifh?SJ z;;oFq-X>=pMKOEJTJO3x3Q+VN{H3O7e4*=c%>muN!Rj9@*i7&Q~^TQa5EOhS8-}k4Y(MO}~_KK$E(c6d^E-E-hMBYHkK2 zKhLVAN%fGW7)F;CJuTJB^~<8|Yc;87WGRNxrPY8*QMsrNFMMC^>sqYG;)gI>mSPxP zTJ&0vme%Bk-*?uemda8Lqf3j`9;-vrUT^UH6`Etcow5|K;dXvEv)-jki`-pmQi_XL zhS8u;aUZmmh#WGRNxrNvSS;g*K|9Na=` zQaJ2kf#<}(T=(eGO5XLSUv12kr5Hw+R#R1q)J|DDQY>_O*FuHOzQ>Caj3O2qp zT$9=&OEHWttr#Z7{(?%mzurMj>VhoAWBto@FOyPies^+Ct|nEVCIbY9(WP}CxZE)s zkSH}g-H)>KZ%Tf%ZOY44J zT3;-bR%%jT$WjcWOREKw;=L7*?_O>;N|P#)r5Hw+)&shTy|$VRUK5 z>C*bgh8MbPQZLC;45Le{jhYq+;c6>srsgE`Q(1~(bZNEKrSQ$M(I~^{(xT;oHdlVV=)`$ViXOaDU>IFm z^p2WVuEU>XT-T&}%Tf%ZODmB{DRr3jQ~mEWsVrHFVRUKH8b?d()kclRXj1RXQVgR@ ztBaZz2;ua=57RZL+=a3f!|2jV(xtViM{!e4>WD1GFuJt5GAU)QjPLE6qDd(ZIT=Qm z7CSLg*HQa3W6o<*t!NpDz)zLh`Q3N^2)J5%*%p2Bl_uqpr5Hw+RyQW4*!;P#JMGe> zo|B~*MprHylcF9(Ynzu{FLcqI!@na-F^n!PJCjn<+F#?({+iTsS&CtFX(g*tAedWY zi#m#8!NLN==+f#AzGfTb)>xA|AxklgE-i;DMQR5=H)e(AK=rCD#W1?GoT`)w)No5| zxh54wTSEkfVN^?SWP`!Brbqt~j2mx8enFXtL&Jp-kEufC&`==6W0X`m)Xjx>^m)$7 z9zA9xT+IpbP|Z1G#-(RWga=J}4T5t>f?S5eocuUXgVP9Q;~4+5iypw6LXa^QZag}3 zsi17cggm)igwZ=J?Fo)1HFfuJhF~g$cV#KU=%qv^Me9ZiG3gsozEJ){SR_jkMla<8 zM{}vFcf@)|mLiN^s+Ugc%FlDLHCNIK2Tg%6da2&vnCPF`vY>aw+FX_*j9$tOjwwVb z*S#|r57N>~l%)uxm-6VOzCHWP8ck}VEJYZen`JTw44Jc9$MJXin!+?^D#aiX7Pdn| z@yt1565Mc(&q{|s*7S^=jI9MDF7w!G}3u*Fg^V~aGM%su}a+q3`3umum z#s%PWU#^CTv=M0m)DU;fgaFV$x(OUucTQFy-QbQJKQ1i;ZpL!Qz9?WBU#(SRomF{X~W0DJ7@Zs@u~bgC3Spe&Y1DzvJp8vEh{H=%=i(hBXdzC z_;q72oXtKveq8E=k@ESAs&{0@nCzU4u>kh$FT%C%*o>_1qchT;AxYIE95EEXa8>+& zD%I;(kw#yOfgs!mV0+EmWFQdRILF=w#5MW(!VIqIHXx((NP{A>gWD91L4v8#OeUBX zKLjsTr>gbihvC(8YYf-Z`405l8guJHk+I*pPz=E{Fe;yUQS+r2t)7 zZhD=r+rqfE0Npu|w%fwEw%{hG%iC>XTw8F%(`macjB5*SemZTpg>h}cjZmlUwy@in z2j;Qc*ajhZmV&pDrsdWct|xfwXnJmq305dS55#=jt+FKWL&!=Luf$wH`6WkInS1&_-Pz`34Ih`CIX)Zv5mjYQ2K>CIVUYzVwugBOvX{2(Kd)sQBm zd2xF@z4~|zS-~q3cajy9rI$0MXYamZ6$JzOb$bXaw15SiJWabp^>hyD-MjDL zlp*ev$ND>Zrw-`Tub(qzz>u+HMhr&!#>*K0P&S`1AkUcBfd~!W~6} zetYf5MM|swzsKqlxW{j@xjV7CjvN@Hjdg$f4~%uIP;YlS);<598|#)J*{uJr)&0jT z?sOx^)OXfBJ@o&E#ZhzV!~bNQOSH;1q_ep8eoT<<J$@W?U2|ZfklzU%@SVy zWXaQ``wGHp*$M*9u9xYx0{;+Xc5O~C68Hr+yBd6D(vjbhDmeJm%*mLT6Z`BqMLYq( z-+;S|9{nTWusEO(^wHptkuij$5Xe{hZ1Br~8!jJ$QgH*}Y~Vkm9F&5l5D3=~{DpUb zvjO)fa1Y-N0wGwsw2J8|V;B&B0;Ssp{0YD+d(NRHU^mUowzny z?*&S?4E)J>bn2l8p$Ng+<0Hfk2j(vs7py%t0vAq?NBu&ebpJ&BcHqjW10V!Tm+byG z8N-116G$IDY3`GxAozD6997$N;FinSVCDD~xYfYC*Olv{$KZkVZ2*5iFbn9>DMB!P zD-ib`FwfA#QUn#}_pFupG%n`K82U{inD6zMfGd!(w0LGXynmcCVl0!RKa}sU4Elt| z*i9MIjRNi)11?y)KLNMin65!zH1r(@=B5$H4hj${he&)k#-rdC^f(wnEr&rL<<9}k z03$AdzARv-7;%PrX$*aHWelauLgN^rodHMfw5$pa^=H75{eB+^XDA2N%L)T7SUqn7 zZnuoRRlQujLw(h4c#97o3c>VI{@UB{WEmd{DlR}hr`ZHyJU$duoT0qbZeE)pe1s1L z6&FC?4>r8Fiw^}AXV6FX@|%qiS_oEu7i^fT@u3h*ALZ|EJA1f0S(AOWB zR3k1x`@SS&c*?=YzXIUixs5)`-#_nAUlDLyjQR}yJOujA81w}iPpRF`8gRkv>N;>? z-Faz))iddfl`$L{yk6pg>v|h~v|M@um}y2_fOeY)%pxPs&~8-E>w(#0#0Ah-0gTzf zOJTwns~3YlveWxy3`YhpZztfA??B%$U~-JO0Qq|pn2(J(L;k3|tAN>P#0AiI5|}GS zoIxLzH`=L`lz#`amzKaK$kJhlZ%hk)1hpIi^d$o0FyaE}8v#s~5f?z;Y+&XZafW^#iaf29F)V}hht>y%bg5si zGT?%>TQP9kjp-Wn(YEd49qOyy6IsHCf?9tDePmaOGKK;1Cs_X6z&&;c`X&JLnh_VE zo)-YK)QB_WkL+M8Fo%t}0Q%@3wMODY;a25s4a_4(TmXGTfEjJX1<2nkz`Se31<uVIYykp?kRt7${0$Qg#dOR zj)*S}xL|hm4R9-s=^E;V^zFJsedWNNHtI8!gZghxIt=j-0rowVZlnPhtQ^t6#mLxT z?Lqn;xkG(Dfa`Y~ef0Dy^A7dR1nzC4K102bzV8hB0*z~A2kQ;EVD)kUxRb_o4ed+% z!h6G>@u8sBUjRGp0!$Ah&Y+L%J{_1GBQAixH-Y)sh%?j+*~=;!L-}JNfZbF5{baxe ztCt}+C^gCy^yzu-m$mrAW-nWW35Y<>>RDf2u}t3A@6$cD#s z*1DCFA+;F0(zuhL{kzK z%d&V?>;gp>V#w7;j7Ne`Cz9I0i;-UxE>`{`CY{athSH$4-QI*h@Fk>3U9E0uuP1Jw z3vM#4B_255j=L#JXPM)_K9aef2af4IaXxEdpNHJ_DlBgndXkdiExXv2UnY3sk}FaQ z91SZ(c;Cz|6D3{^r>c`$x;cwG?Qly)E~}4xCC9j|@EZ$$u}k_@EIT1y-6dY#Ek+c> zD{wbZJioa8*e1fayHc%|8UJLyzU7L~U(?qN7VvOj^VrA!xlVhW-g&t|Q2ToJTCCxPtyg1rial2e` z70lhA;;b+Qb>xz2QZ>1}(YWyvuHI|9lS)zw+zqL^TuE>lUkab)r$TaZf7lRQL554? zqlyep9^Ddqa08#BQVHCVd#tFBVOI>ir6FiPNAOmlDm~h#JCH7 zw&s%1R8PVS>4uc%?xyhn5*doyHWCKj?ts&FU$|&l?<$CLS?63{dx+>O4-?~jMKBp$22T0n8r_oFCsr1EU^nnpe?gRLktP=zmXGWSYG7Cq zinA4u> zyNx>zZNgd!{jw(cyLVa3T+NZUAKd7ArN&E0jOy4Y1f-@HGeGl^GA#pcNsu82ah z0AFNW-xoDk)1-Iy zkw=g6NxLDbipm15~WKn-`Mt52f!IjOBc;39@eKtRh~MhP+~kTCaE{Oe3+INRJysRXM&fMy{mg ziVGtu8C!lupA>JT6B9C=ne<$5&p#9{ZacEl#-Ql4@`PYnypAft<}np}yb0_2c%u_^ zU9q_AB*y9zy8Tsv0lO`Wi}SCCXCI@g-36WtMvAg80f~zR-Iz8KUD5_O25(GKL*UDW zMte6>ql~jAz?klWUsP!m`(@n==Z5Mu(c5cIa7$a{x$Z0_LUQywo_5?}0 z@aDCzsq~)ZVZ`>6X@YqP0}Cmbs?v?3SK|SiI0E zuFQmE$=z`dyl~SJ1`EJJY&eOrUn#6^XQMVvi_#&x<(<`71d6_M=;$Y1rt6}#+wJX2 z&m2+TS3Pm(#iX6t)tBEy1D%?H7O-w*H7&-SbDM66zTZq(fl0r(q%E8+xnqZ6;%@4e z*4it#JEX!Hg}GhHN;|S$f3SMe%SKY#IPnDQZxct<%^O@Dy7u>OmLVPk-_B2KjLX&+|s@REevN? zG&Fc=B*&<2BNi`6KE`NzP${<~h7nXHE;|h{Mq^Z1#byMoZs>~nd8AjWbiw7T$8?j1 zA$V|Y!>SZ!-G=f54}0dR80*&1EDTR?=TMVy%zXM(sP&9H31iP9KE+5^UD8&UrN;%A zv{CdnVT(+x|5z3=)b;X4Hh0INO@O$%qcv&3_4`-<@9GVlL?E`P9=*h!}zsP&MFA(w74EolH+8Rrti7<6Y8cQOdOw8y zlbI7aCAVVNa^JqYZO$uz#5OI*u zTsE;#W@6MOcfiC#VMb(M_zr4cSYv!I<}YGnSBPbXc!RG1@~DI0#%cc*09gZ{7MTxQKIF-N|cpPnwaZ5SiT=zla5k+hpRIi01t}+SQK{ae69f}Qbx&EG6W0j z{53JDMf7&0hZU(c{?fL~%=|+1VHBO|(MR4gvE|KRQMv~#j1;>RLy)k8rI}lxb>H-d zkUKgni4x;3y1iKyeY^>4XS?}u@8+hHVl{ViNnsxEgbKG6BRD286qfCPJ#qXjg(fz} z^Pk^na+BvX>uPs%ERsvzSm|=02b)Zs!a!j!$K;!7mekC?RjJ zs=G?j0XL5wp;8l6>Jyb(qf&HW$0f>DiWW?q*GBD4Sjdv)iDZMruzAHfq|KF7My8O6 z(*=*EJ7{eC+=#$%f7m0PWCvxQxWo4R->SP&df!Q`bZ5opLAz8&$CslCjCEafEL-4= zN7rym1z=ptWQs=*u2V z-M&LHZs~x_cO(Xzuo^DOf^6ahsIdp9T9!A9dU?Cn5tFXD3een`g2nu8f+wknzT9-e zwM}sO&c^yDIq&`__XhhY=8w6veE=g?Om>d)NmIioV1m`+)10+FTZS@ zi*b1q;#elG2F`?k29RaS1F}^$A5pi?2Ts3?`GBFy)j<^#Bp*l;^}(t@S1CLnH>>8O zk$*m@E^yk|K&y{N`h0k#J~376#Le0TD{Qoei?&2(VqB)bSSBblFbk!9U>7^6F>vgS z;gOD?*PvbC zM;e?+HNxtmAT{3Qtx_M<9H9`{br*E;R%zW%QW0}4fgAy%LX>fA+PRDrSaGHfdMO_#5mf9pbF-=I#)By;^U++Ov zQeiL_spZ(=GHsydbtS=9_M0e6G^~uuvy~FX_!HrxOc!)>Ct=PjF5 zzijmC@Y*;ZcMNnB<(!M;NcIb(;SGUoeG0ZdLXilu(y3Q3+-Q%4aj(P2&o;c3; z;e^?he>x=hcg+7H7Gy(;*h4FAr`>DSEu)#+)#dp?0CzO=3NG>O&iKm#Hb~wJhGx z^sV>{e&2iBJl}ibsm< zBBDyL!@?dN&pVR(u;&~Pxx3&w5R5CXPlczzorE7}<%dF4m{WL4(&mbm08*o~Tz2wC zyC@vo70l%)0amQC@o;ZFEe+@y5griHPDXx4go;n(2Pt^`L(5x%=5f9P{t(n~e9Y`N zeNJ^#=VCf5>&s%@QVsiZ8^~T>vj@|skYA3W(5G6hODePDA%bOb=?bi91ujzOWlvV=XUIqkGwaY|=B-j}McXbQdy zM{f32*9mcDU3HhV4o7h~bw6%$o6chjVn;n#db#2-?pI=nfGs*KJrB8(u2`luLN!w9 zGnM@vw&+&$Ykmla4k4NjdX#e^wJI=PVL5}UnZdBs>lD@}u=p*vo+yPB8kR_*d`!i^q+#XH;CKr_xs+2Z}Q>*_vF#378#H~`-$ zChf@Xq@JOhcZ!v(EU+1B?)KYR;l^uG-J_jZMHWD>2!U3LU z3NQf6^m?c?I?Y4dD;CU8v7anjev!^-kFuj$V;sFJ$Jf#=REiz~al0>7Df%}!d^h+Z zC@%4tN`0?V8&vADO5ISYE-+6nI}Q}z!RD$wxwnsvZA7mm#Gp&tulTC7M^ZT1v%KS@ zevW?N!m|+*9!ZvE*I!!=roJ1_G!QA?fNT9A<${`IyO?{2|!LX zYM1IbZnKC7!+;-SiBT7sEq zg*{*vK^|$_ii|d5FTBLy2pNkT)Db=Ww8Dn4T)2QGuI1G)km=kS>^ac~ASr_)J#30A z&1r$k{DlhTmey-|#hEwMhtQL17(+6;ibU`jde13~(FAylvSrp}-lF!Q zMXw?i-kFc6lw2XG{i^R?BnN!=B9gtIqAW!`Nxf(((u>|yp{0l?t{2`$)m}+>*zPLmh2#473SIQ*4=W)&sG@zm-(wkA zD3-c3(eVc~{Lu_}6S?VQg;*4a!lmQGkAT8O30)N}S|2Q|q;@IO16DtLc6MW>DXsU! zmC@S_^iqsEO&AVx*ux<0G{@B(Cn-41QT0TiaZlnjM`6%uFg+7Jfr-JxXA4(l2{sGa z9h9EHG9_B0H{d0VK#x$b?!x;9Se<8WXEo`H@ZIKsr7H@_ht;Q5>P40MT&1**z)tD# z7>5lZ)DPg856@IEq-MC{F2Z0FBke)9>9JNDWkrNc zQ)YFEZbNR9XGT-@aoCcDN6%&1b*S{-NIVik2WAzZ6oZw3y|d(-@F@xrSRV>ei|JdP zweQ69@-!9C%fU2^RErQoj?rZIK&(X&Lm>wr?jDF!;rKm^@gnLsduY_edCZF#u3L{t zFbNTvh(UOef3d&0_{$Y=iWI!Vc=s}2Y?yix6bXvuxJZ?X0>vc=H5xOy5;&3;^_(JU z+81a(o)o=$jFtk|OFHRa3@ag!-cOm{2%)~vOt8UUR4UqjuHX}jh5f>Hp;bs!Oz#jl zpN+xko;iH5=dRHUTBrw;8sH2)4!dM+CZ~c(uM24W0I7MYCW;|9$>8Kw_qK=p(9nUI( z9~yP()BykDMy6BR`x_7ynqjv<`hY9XS|RwlMn_24;zM` z2yOWn`%9x7m*Nyj?O{CLF5JKs35w-7Y8OsXyKo6Yjlo9=fpnK6Qfn7QFV&WozLo;l zOFB2=ql7?uX+J2pOO7@cj8;VOO)E%VQch7>PBR{B7dY9hnXXCBMvM|(0>LFYMUod8 z&%zABFF~3B$I1FEx^uCr(ky zTrcT7d>g&BnBI_j;X=LiNTFUrgix=a<$SGj-W58_>CsmnKD-t>|0Nf zpjeKh{BVlQl1mWEzg>7dm4;I!O>cZ@W~u1aV>p^p;Ce|XwX72IKp6AfjF-4cb)m_K zM&}!pM;F!|R;O=NJeTRGh~oQYRhmR`n7}sf%EGd0miB+IuS@klu%x-mW3WVf{%(2;bB2;jPOls-+%GE(AWmo909a zP19=%O$XEvnkIw`O*=F`->AGnAwbM&H+@sc$A@d-6lrmDEq8?rclE1(zFv8qQcGd2 z%*bI8@gzZuPbEwT!KFDx()5xzESL3)+6<^jP%Ot$J8~*Yl^_(glM({yevIpuA&Ooz zesi=w1)dYq>A%Veq?i0_QEv;yRSN%;Jd@t}5K=-Q-Rb{Eo=NA@+vt7z-^?@V{oyvc z=`BfZ^trQoCY^M@iV_0V#RR7JE}^+FC*+fmr6I*37eXpRI)`S3hL}SH^JiSPm!bmS zGw|US#wlvysZ2{SiC0t!PLae6CK1()$xH(SA%TCfzqF<1sc?#9Uayi$4?l^SssyJ< z;%zR`6umAXN@&`T^|(@uu$gs+MfD}&a=-bgK-Iu0((nP(&@dz^q&&nHnim>nN-{;6 zGtGtO%xWK2WAoITmhxJq5rs7}!-rMx8^(I%d{QlkOnmc_aEi2k&a~c3qxR*x45vs? zEXPrgepj_N z>9!^%(EIhg+?=Ak(fe^GAusgR&^JO$LzPSSmaZH$CwK7Y4=$~D`K5YiA3XN>%7sr~ zYrEpc7k3x_T&?+rw;ylUV&vBMmsbDqX4;!wua6F2d-u7pH$Mxzvg*+FlvSf@jyia= z!Q1&yP8!rMcGBBrcYjs+R{5*nE#LqC=GX3Svh|0yTR(X0blvYWrsTi&+pBxSyI;%R z{Ky399q;i6%_08F7tyb^6;(f682T$h>opfe^b?vwb-z+*XyKve< z=dq6~z8(4S_^Xe9{btz6Nrz9&|DkjHg0nRzP3<%&VL|qhc5{Zjyy@wyUw!(>-!8m& ztW&!9Mo;P7sX4vGGY7YC9C`OQb*6q)zu&QWNec$_5$;PmBD9GZ@>9<~!qS~#-Q^fsd*r}971wG`UiRLinB43dLw;$Mcw>ou_Y+MPUHV__y$N&_)%GvkAq@!$P(elo zBtW>LQ3(VTj7l2PPz~LHKm=q6Qv#7Nn4|#*B#=aC%U0CuRj+!lUdKBq&H)ig2#_FC z0F_B0TvP}RGAIO4$ouVms;axHyF=dkfA4*3ee0{Wy8HAwzrD}A&p!JM)%TXOYb3dU z+o_EgbplP5^Xom;r32>{efQXV zjl1Wz9Q&L1g&*4dWmrhZ zroTS)qu=`}y;in!zuw` z-Zp!w<%f!*duFt{_vL0CowK%fd}+z!e;NGo)<tIH@@nt< zPk%a~QP+>A=0yB9qs@fpCTZ_Sbq%@Yo(=!#>RmYh0nfjBwsGu!^Y+W{*1jG2eT!G` z8284Tr!?H&Vc83I6+RaKZrK+D9y-*vyQfF)vBf8D9Qs1?yRQwox6_}NzSZipa|60R z`|z#Z-<|sMBem}5UD1cyj(*^L_2MSKp8IR7wjUKW&RII*@YuyI+ZA;F^UBkCwIB4i zHF3x6{pzOM{yQi#x2*Y&HoJ0SmUSIg9{EVCHx4d6d1T|*%vFo}4!Q3AykC8>6MZXp zO!=~E$j1}oVq?0D*_>0ke$=5q9R1$N8j|o%*Mic+Ls~xlaemjQR@_-;|KdRDLr^^MZd}ckGY($>~c{zgZNu zr_p0`p6Pk}66cuOo{8fkF8{jv%jY&U-mR?K(YIT~nTUt}wlrnHH%*4Te?zQ$|MBBJ zZf-TU!ph+X`PznPvO;vRB@mP&ivzme~KHuRHg@ z_aEE8@BU><&%7_zCqKCM>FW=*)+EsX%a?Zs+(1ZT(f{_8za&L1)Y2#n4)l*PhWDzH z%#Ms8xlFRNWcxcOFq48S@XkUSz9J)L;hUbw?rX5TV8%3|kcgG|rjXXNZ|NP3iDFDD zzUlepgSSovV<;7o5t>fDRT}$lFs3PEQt?f3JwAB_A~&ZehB2DuYVt1`Sdlej=wL-; z#9b<%A3M%C8H}M3GBSeZSTuCyJhI0TjA_mo(qAZsqU(B`4#tpv85u!i7o~p9^1<1` z7>O|&pW~m;hK0bKW*Vm>BRb=op4(4N-4~2$iIB*Mv-qYo&-$?S`d|!c1d$P>+fWQ+ z4?Xc@Fs2n_NP9uyStcIZb|M%<9U(G;W+>E>-v2o@MB8Y?7_tpgNxd1hIz$<^WsEj+ z_rCQ7D#x7nc8sA}6t&1ZN@9>eGluppMn-Qqh>xG7_$rC#OH%ePs|O*kQF2{f{d3${o{aC6ug;FC&p~UH$5AF zUkRrfLp2Z?aRuKLSN6=CUJb@js}OA!4$Jh%{_$)uCY~{U34rJM>_55$W8eioq$yJ> zs$YB<_9kKp2$+R$7C6#s&H01o8kqp-=j?Pe0nA6w&`BL@ir2BlU z`ZU&kPN+UjbRRm*O;2atr=9B4R`i;L`?RN_3{P|2rh1zs!m3B0$eJAC}_w`<<$%Au}2y1?5KO+y+U#u(m5_$T=K z-+j1f(UswTs@qg5#u)C#yosquUea^@m74|%stnw}GG~VHWsKowtsV#vZ=EDW!s_f< zZS)l0r^dw?Lke$ZD%M`$x;+2>ct6#Am5MQjxNc!8sv~OPE&5D-*iZGeO2rsMT!~Dj z#g+Wq_dESmAE;D}F~oH%Q?Wh+SKGfvyzHmip;9r%5Z7&nxMJ_`ecDg;i%P{9L&@LH zRMf8M>6D(cPf!JxJYx)0q&-H`vI0Ld;z~Nja>)l$F~&eez0hPbG|`dd`(s7?Rv zpvN^rrDBXBF6w&zxbEKj(#L+P`6?A-3~^D%^S@8`ro5jo`l(i`RE#miMbg3_*K_wR zwfd<(R;d_ch>N6-|NX30_w0=IQ(>`+AI2EsB6;SI>#rMZ0r|S1QZdF57fD<}MQpoo zAKyJeFT?gEKJhTd5Z7Js^~d$p_BC7lRClRVj4{NO!c^2#=y`YPh*RD4xF)Dnj4{M@ zH?aP=rcT&)lb=d^Uo~S4aoxjIBmwAoN*a9ZMm?^-sc|vJ5ZArH`r~>fV(tt-)q0hR zF^0IH>IIbH+R@IMPI_E;T{}OFF~pUsQ<02XzA$f^pNf@H_%g;2myM}3$+mpr8@>Eg z@v2B>j3KUpOr=S-C#K%z@KX&`sTgC3YY5R->3VYO2rsMT!VEgmh)>{MEc*SyGf;Dj3KTeOr^EMPwclo>VE_J z5tWKDhPY%yTxUNm=;^15py@sy#u%h1rif@8n(TeH)B2TyDo~0t#*o6HOhxrY50yq| zy+y^VaWTe_!ePMrTW{W%i8epgJt`Gr3~@PiDvGP(i+g`*tH(87rDBXBE|*S4CI4B6 zpZ55v7N}H=F~l{Tsd~^iJ_{zL)cUEOQ>hqZh-(B>X{~qejnCcgr}|K(VvHfKkxZqv z-tlKYe$Y>~L#1MjA+Gxjan(G0@5g?slPVQs3~`NODoxs4KmF^Y*Xv~%(-eVt7-NWQ zG<^N_HRFNkXZ%z*sZ@+H#5IPgGzqZnzQHs7RD)D1#u(yCH^g;u`d_>Fsivw_j4{M@ zKT~OCxZ=Z%JN#5jR4T?8;u>p+Yirc{NBvZ1DW9rDBXB zuJMMr*8UdR&QJBdO2rsMTo34RQ9JB-KIe*`>JOEQF^0G%7~)Ew{`5dU6&8BWJ ziA<%{*X*Vr@9hqZh-)%aY4x?nv;TKLRgp@?7(-kc z#<*TBxB98xQK=YXh--==uCX_c`M^(AsZue<5Z6>gTwjzd`PEN#LZxDiL5faesz&&x zC)@Fxn!-RS${0fmrvoec7g3RJ(^_v)&0@(9)+Kx*4Jn*KJ`tL*%)wmdAh${QE_Rc}b}Q*BeJ7-NVlo2j(c`~8ggZ~at0m5MQjxE?gbwf^2k)qbjG zRJ3>)V~A@ueEoWFVayA!`KfMGsTgC3D~GAH`fAzcQJu?#N(#x|8@oNX%^%nO zDivc462Q$=RA2Pu-+q6IpbC@#j4`Be0kD3n$U`+Zy(8&8WuY1uV+<)=$W&SiyC0gg z+E4X&m5MQjxE2M))m)Ejvr5GnLtGCB#pS0urcyD+P#TXgl_n40>il&@Q;sXJG#Fz@ z;iHBWKD+9{zje`57}WxSco<_y;bZXi%Z=remPh!hZdIumV~A@pQ>hA*g-ZT9J+6@| z6=Mu>J#L8W!L8>``>7VHRE#miwS=kK*3?;vmskFE*51jp!pb9K`#u!q#jH$HN`}xZUmRj``o>b#vj3I@Eh7>NSiMriS z)j~ob9>y5rDuS=yQc>~!(%F8ho+=e%3~?1RmDc7TJ9lZ4pK6p!#TY|ePcW6HZ~QfK zt zZlRa_S~V`l7*hD8A%%CnbRphPbyB5bj3I>zQ)z8}UYoyvBd7vX$Qawd=4lV-XJ*XHospTFF(WfSb9(-~Ts>^g{OpXpS-IJBXB)h7 z$ds?q3ru!aenyVLk6sdrFx_u@euh{U$jHvpJ&BlZf6kbm^GLAgwCwyGyr(%ZCI(N- zo|!p!M)uUX8Ts=vX3fhpCWayI?72u#rXdA-WI6N>=wPdBNlwEL_}bcrYP~3waHZ)#QgMU|o;e*oYTk_OxeGGpp=!0X&(F=AK5x!^H(J!f zY?RW%;M8i+dGqtL=gpm(lk;!}mvw^aW$$_q3G6!L4gtJFkbxJ2mT;nJXq%K91P)KecO4k7A8M}(~p9TB!Z zbVRs}kZ2E=2@b1=ki>sIv>Y6coJNUov>Xd|@-=zXhX_}oA#{^)4I&gY9NR#3CLBKlCLAMG^$EvA3l7^( zHGrt85VfrV!dA8h2wT@0KyV0Aks3g7s0R?XqKzCv)UyT<9Qp(|6%8QLP!B+G2qA=w z9O?mtt4d8jQ`OLLRceM^gI!orpz^VV9cTl!)NqM0V8W%usL_UFWkQ8xX3~GdaWlhI zc3R;DtIH~*dH|y4lM?EIXuYT&h~U!e+Fa^|gex5_;vgMgq%3GW2#42zn6J|;#?mvn zZ?FFG{-@WS{rdO6BPr?5UVcAv^-4;*it{yOZX zRIL!V&%k^oe*rCF@Y56DGkU9kw4WHfLwQE#H22H|TDIh8HNKxW;ZiMe0|WQv6OgPX z!;&qQ(fH64flsJ+bN>_mlYnW`hfrd-b|~Cmz~FXZHue>`aQrSHU-b!o|XWF)%AsT)242()JuMf4c_m1>oLOF>vw|D&C<8x#uqIBf*EB zaPb~M*t05zf%po=?=t*nr&uhRcMB9XgHSjp{Jp^JS8?Iu&FyHh90ewQyx>P`5TW?R z!+$*%HV@O{CZ2Ho5>Np(z%-vKaP9CDieESQ{|ZdoX#y9HADxAb2WG`|fr|>m?_T)t z0H)cD`uQcHz}f;cc$UC*4#O`K2F=H?fOdoyw(wB<36+n3BEKVYES8J&7{>cXL*Z^l z@FTP=6!3(?J&*7=fxCk$0uR`SjF*-m#;6#=(G!Z_uPDE%z>Uchm~iFSxiQX(0<&h3 zz_kg(?;j{X+kttfP~gJxt3vQb6(f+L`Nc)x1a1+|ppuatPq^~?7-1)Xd6mrSc*3P` zHWIWEn4V;&#zXZOs$5=#|3|>cWSGViE*}$-zARuikZ~GMxbzV&+KaK_>H2X~f%_LQ zu`BDxJ%t3_2h0!DVDYrXCsaPVfZy^zLspW&#M1wKQMc! zfbfLlhf4}9(o4Ae=^p|&5I>>fy#oKJw-Mhv0vE2FzeR9YU}{wyx=ToYUEqK7yST^{ zA9|4ekT~Ku2AG@QBUJeOc0$;Fz|2)~;rM-ofJMOE{4Zt~wjId8%>$<7-vSpdza;Oz z1*TfXg^QQk?+FznIEKz|8wAz@*X%z66^RYWL3qbM8}tYZQjxA_%-DpW#&C7J;K7J5;=*;lE+4#nNV*!0F{|dbesb z1ShK)fyD08xTMtES6tCTc3m5Nr;4-ff zFQuo@#4lXDPndAw;{7Xd@0jB?wHK<7jSb}YJ#fd({7mIX`Dn5eUx81E@}qv))PxI{ zkCwo7Qn7lyneqX(-ICHkeq(`~ehq$9ze^j)?*-uAxCTEe=k>tsHRD3`^Yg$&kV1wh zTz*MzbOxrU85e?|3z+d{oT>aMeG7qkM#a&16s|sA2IlPs@GA%AU<3I51kBlM@T2;W zc3CXl@S#U9mk{~20pl{`O!K^yv98@uTuf24;{M7lPkZVCI-{A^0i4ykf?M z;I{^tO=g^lALaL`ilKba6Ry3~0vGw6z=X>$)kha#`kQef(l-{E>1LcMeN=u+fqB-9 z3&C#{Fl)`Y5d8M57?G3k`KvD}0YJ$ku>NS_^;`^>ly>6-`45;HCY zzt@2Irx_Q5UxkVhDGZ?fZKizemy|%1Ev)j#_-ga-(JAnW5$`%N9}n6Ftg3L5c%~0 z^MV;?;z#xIiHf20(GxDe6~OIj0Kc=qG(I4B)tBFH!1OfZOzETix`3Hv#)Zi5qrfaT z<4pWWFL@i7G8I>!-nkW+y$#@Z9+;K~ubtnXz@(UQru0#M#{-jX#)Zi5a$ue}<4pW$ zJpV|=h!lpe-!;H(x&}X%_YLG%3tZ&)rg909zAh@}TIstPxW3omN9h|4%uF*bMEMm1 z^Q;+XN*~q7Dqz-|aUuBq08EV;XW~co5%q(XQ}G+Fze&J#P_cSHGV$vO7X2H@FCDn4 z*WgFxx1@pmo(Jyl*WgFxx2}Qwwgb2S8vNqHuNIhghv2}YmrIEH=nIU^j5C#Ad+^8r zW}z7ug5L|kykW+f_)&h>1GCeN3&HOcFqh0Ylip7280`+@EAY7?-msUSf+*e&CS167 zl?dFODpoH)Q$DC2qyv*}#)Zhoa$ue}<4pW0eIEf+X2yl!cNiF-8E4{0_13f+Uja|J z{C26vdKo_Sgv&3D`@^aU;eW#M8(R&%6CZlQ@uTuvT8;4+A9{3Li2Qz1jW&Z1Jvz>m z-*|-mP>uN!KJ@6g5d1nEfj)_k0cYYz^tUAQ85g}S2%uyfE#fQew4mB4dmwm?uBdc zqx$%yf&9vW+j$Ls)c#HZ6LAy{JbJl=sE^LTB${!i@{0!#2Qb-YTnK*4fqCAHGx4MJ zeFV%VGcE+bqrjXt<4pXh{F?uWc7P8(k@$qG-xOemm~kQaWvUovSPwrpa7(YjkJ`)M zfmv(Dg~;!IV16>=OzETYi~I>=13vWBm*2j?*vvQ+KPtZrVCI=|A=2js=4CT31iuns zD$KYL{C)!FtQlwGNAg+vnR4oX!qsmF;BHc}dbybRQTf?{8E?jgNZ&$W3e7kZKN^qT z0A`ID7lPkjV2+w`CVrH@h+~*1<3o?0j}ZKlff-=NnfOutP6B3*85e?|0?dnMoQWT$ z?=uxc>7yrHeQW{l+XnFa6_}{wf>(X{?G8*YGtQJg%I^qZGR(LT`CSZ*$BYZX?_Cum zQW!qJCBT(mgI_$D904YxMsTYyzny_eG~-O^Bl+S0Cew@yk>5gKo-yN0{HQ&@56mVr zE(E`$z??SYO#E0rpMZSEho1WKn*z)bGtR`1+Fz!MVTSk$*Zv*`uJ{`KD8Fw4v(}6Y zk>CBm{A9+N(ntIvebCAAp{Kt5_6Npp#+mq0`Ar8V&x{L^zGs1X&5Se6D;j~{S`|a- z<0r(tg5>Tx6E0jiZvpOGbG)W}P&@q<80n;lvc7V;4VeCBTnK(+fyp!DLX`_JubFWs zepJqDf!S)th2U2M%y~1;#IG6nwK^s8s(ptmzs|rVs#v{TO#G4 zH4yhe18@o8H?0A<4B(y!!UdNf<>RLyTyQ>!UtJI`G{4Ee0UYpzYFAVri-K^W`RxzF z1*fkQ`2E@dTnpgh&Icq8&QR(56Z~&%0FK7hv>;qk>h05K&Ca`{j~-E64EDgAa2EK* z$H(_fvk$hVJI6R31MljJuR*RcU5%b2oN2>tF8k=N@m4UTR{S4)=2{}C7h4A1H8DLe zGdFKy_S~#_6J74S?CBF-_EAIZ6Ne2OId=F&=kRf((}rb?88K>8&dto3IDP*7iPPNKIWs1@re)3;;~ahajO^TrqcU?cr{-l&#AOw8-E(fAH|;^o zU6#9B()-`4EUhfJT3+!$fT+K&?CH7l^5$jb$M+a@bNmP#)1Q<52<|P2AB2wxjzXS`IL-T)oXFN&4cKY+K^pRr5pN8(MvC(@)ST zy?FP-Gx0`OC$M-s_IB2`)08uKU3hWnqE7r;_HWsC z)xJ*UqP*uPyw*B-cbf9knpCiMDnHzUcYXWf9eZjV>)>Gl8*Egs#QVJEvP%P;-L}x5 zJx86fTj@>IN?Dpx>!|(Jsq9s@JumtKv# z3731eS$760qBb}Ynbbn1l0h-_*7H<3WpiG}7tvg!JJeQiQAR7ifnLL&8j@I6TFJ$` z^Sh)m7iA|(B$7#`lF>1;5-XSeSNzZNaolE&yPASWspyqGk!*a@wJbQ>7_bhb)9<%rztjOb0J8RJOVf!CQM6^_CRyj^_*I_()p$~I})e3YoKF_#TBHM|BM zIpXr-Qbu8G<%}AzJk9n0HognkRgLc>>>>qY8N04SWp85FOt=czwE`}IdkHRqqqkZM zv2{QCda96ErE=}Qb%3B#p3OqP?(LA|Qe`{6868a)edqW9WmA?tveYh>RA$){%WR2T z&|k9X&FQiiAVT&i-XeL*!9*$ym&M%_Z?TV-6F0f>4)E== zcT7Tj*2=(u?FgW%MfEJODp!2Bd9(%N*WOUqZ2=qX=KEukE( zqaP%ojsKy2WTl~wZ;>S#Quo9Fs&F|ga<@$>%}V65ji=VogIa^k?M8@#!j1jPZD98% zXB7Qi%P9ty{CHW3a3QC|ky942{){@*j1EOcx8!$_l}1QAwWKO;Ffk(8HOMF!xuXGc zM+CzL|7eNyLCi`@Ta zHwuATgfGH<76m&bMy@MIRM9jh_sjAOiFT%x=b_}Fg6!nVpi#ly$LZ~Zgs88imzB0IWit>$$Rb7kXawNYaguaxgKGCE*Y4~1eu`Z*NfLh4?2oV? zwI_^>wlAo4iS{%m;T8y*GDlerx2JKCFk5WO1`;q%uM^TiYfHB1lGa=QfoUlV+cwEpU zwm3cZ_eeOTIz5X&Tu-U1KpT#LlEQgMnZ>OB4gI3#SO?;rUWF!AAuF!;WY4FBvpAGm zmW1>*ExFX`c`G3m-Y(^s6Nr9rLTm!^Si%&~;uQ|1j&g(89wYr}aREBk;*~t4iFl!p zBdCuW`NJu4@xlDo$q;K>MJ?{5vHfGrdtAk*^4lUo?>Q8qPbwVrB7%}jYr1f1-N>4g zM4Qkb1!5Kulo6CkfzH#NB$Z5#v3*4aAQzT5LbBW|@CAhh$^Rt{!@?|i>F=x(+_;uh z0yH{gm|E*NINeV=mCS+~8}UYpJF5e#NHmF|t)59MWoU=U{77GF=!$716D{q>agd<+s$XX2%jgUFg(b~KXI0!0|Hxyfs)i2FU8a)@H4fki4Q zr-Iz+^jc}G6cz0B44|A-p4I$G%R3@_l#2v&E~FyT($FjWWZ`Ql*QB0#oARAQ*~Vqo z+ooI~6=Xh_Z(;QSx$xousgT~RDwRBzFl`O#bu{XalM^e^K36Myp)XP!Nm33|W9Y|( zXlASB$V#OGT5b~zi&EhV&|N4Su$q!Dy-+Hb)j*-UJ6c{^M>QiYe-{QLIpuKPWHsfY z>qGBAxk^Qa2z3?L<#&<29a#!El)Wf6XuWE5dyootx|FLdNa%~IH$R~_r;fg+`5IFu zAebhtCM{Qi+}W!#pb`*HZ?pC?M2MDfOt?2SC2589vPl%orO2XZ~FB;S1Pxn{V%aaL(w*AG2( zHPD9ul}hR$OzU>ap2elIcTk<2h{kNkjHebpFFDG7Zi2`@NJ6n{d4I0nyf26o z<;%^z=1f~rfs+gsD618?0ije50Tmdg9Hf%Nl!5uOviK#Z@-sD8)ZnBiWfX|7Dfvnz z@RCaQK+qcs0;z#shwnX3Px|XN7Ku{lB5H9olh}uhp=-34y~Ai8v4iIk>R3eDi9`9? z1?8l@!#k?Z;cfkmdBCO)KA1-JQJAYq%gZ7$OR*Q9l2(+!MS|ik4873Ow-Iw^;ttmK z`nO!zPFl7CDG-AmB0A=42?lxVFc5D-+g`DV$Q1||Oux^Q+*%~pSufg@&9(a^&nR>} z7E4@lUMr?_1(Y9|)h4J_VjxB0H>impio`eDX3m_PvTs3in^NbyhoY_B=PQ<$6%!wn zNDt!eQZ~w9?@SbvMu*Z2V|DbxZMoC*NPMKL+6!pR8OPF@n~V_6RLWfb(~9f3C6erQ zD(SCh*`>78RBJ4VA!DGc;+qt3YNj>Quhy{!436nw4VkZVbyM4iq$XCPb=zuxAf91Z zwFfIffp1cYNy3Y`#3;ZKzJn5_fohgrIgLOJZVu%#%1$bJ7aa1_Kq?;BYTIST2DJtHs>zTlTJd&32|kVvwAm0D7D3Y z)SkNyRb`e8`wt0QZESKPT-n1(LP=Nnd*CKVrakD=CuaA804|Bf2$tQL_+0tvz7K zuW1Dw3nXTSa0~!7Bd)`gg@*n>PdhwCIJ)tLe95WUKg2Xl6Ddw*ajBj3;l-6Uk1{BJMU zHGv5H(AS)29GnqKUR?|7G^wikD>`Erq!V0au+MGmP}2UmNQRzN&g@Vc6iCYSad_-N zS^rRehYK}wFH1*<*N#+Lp}Et%%-;dfmZhR9Y98dMAcuEhgl22G9=u@=P!%8dhiOnD z7S$wEpMkD4TkR&I{fIH0btR32nm`{}(dd3>?%F{AEf08F+rvOFlt!s!GmVw0F69?U z6R0(52}5C+bfD4GD4BeabR1X#(2HQwQVo}!N`FK&zKI5vW!L+JP1Ph+o$k7TtZ}w{ z8Ga>%(xy#Q&?U5Z>`E=`!Yp5gI+fFGaZ0X3lie&PD?loTxp6o=i!FBL7~vN&9@QWf zw`tB})*&%wVbpB)!$q`TN91-fwKmK5H5f!tBkAq+@d0)VR3GdXg*4lw!E2y4crA3H z#s9d7jT8ex6zzh&l5G^5wDzr;Dq7_}t`A&3UmF^@$}oaJE-kLa;Pp&CBq0h2rWZ6I zn{pn_x`6ci&Ll=5&eLNAU%z=nOf$kE1!UHn`wAp;F9g zM1`<^BZjMINZigdh+DNCN!)k@!QCLBh*L>?{Yk4PA-?>oI)&5hQs|BlV0!y;D4Ru7 zgiorkF|*1ld@P~2#oe2Pgj5udl-j<;7tM{-x&$X~7^pooXs*+3*UJ0=D#ZU;=6PCxxiyb6 zzOImL+8>&#kaCFjuFtf&9LJEhiV3$UOfEeqRXz1X%6Dq=LF$e$gK~cqrSoTFzY{8> zsozC$&V4yFilaU+_*F-YiNwJ3A3o**rZjPF&ln~ z6v_T*9TMrsR69JpcO-Qcx*|+isn93MRHt|KGbpn@Qprw|80}RH)^|Y)G0dH@YD-rB z@b%Blqi%N#u|;(gXICPa7of5+(7^NwWwwqLHpIvn{$a4y5ksPU{D^r3)(DO?IA&}#zi~?c@vNe5WdHl^u;l-8en+o zS3_nu*iQTCU3Q~X@;joRMI+7>>fh~1(IVxUg*{Fk zl0=Om^fYN8AT+!FpQ(=2=4lFutioip^O`#322>Ci1nZEjU!ZS<)*nB+fE4OurPh_S z#=H!nB!m9%>W^+r6z3FBrzO*e$VnP>u30paHl+kpl0*ek!}i_iZwvj%1G)VUjRg8* zng?X0G$zRv_G)Um5N_z0ooV$+be010HTM^2jTlI)gSrTY-Qnm&QqiAjmX}hw@IH(q zyB7^ZPmziW$d7u9*Hx`|7oopv{iSU#mNr%Uxvyq~V3M~6y?X;VcXeOhk2Xb&XSn4 zYZ`+z<%=p*l!>o#8fFxWU{N4-OH5dda{JNx!MO-+SO%fl^?{a3 z)1;xSvihu)M%bPpwY5}3YGVeZO6^T)o;fd3{kA6gf&8IAVG)#80U>8LNSzJyf6}M8 zuhUEt5*QW?nPwVg=0+-~oCy@zJ#+JkZ9K7c(qf2p1LiY4?LUw^Ua0=yeQhxfWsaos zNfy=^jlQLUe;oCsEPPGji7nZ$`_(K*!wW01n?P3o;QNC6?=<2yC13_m5?2W1Lnsqo z3xQqBAct?HNl~f;0|L!pF0wQp>Yu@|BC^R(f$5%Hhj|Z-Vo+usb+89w`iTL)lqY)^ zx#%HAG0UoHehzX?oBh9bmd5kiyeT2u#S(-XM7V193uCWDol%<*vww$jfeLFH`Ha)0 zc!TT!U!Y{UK&;JhF+5rcp2AVA0)qMYLuykPKqD87VO1fk6oRV<0rh-4tdR*dGs{+C$5I)~DBmNzQZALC zRi2K>Z@$vezhj*`8Tbu#Wyc~|g-YN|smR0h33m0s)sd&DIcl1DCyGe>=S-}S4QpT& zh>bZgk*o4?@q4hxS4r!KL`&-((b$iYW%IbAeO9#l_t5_L@nnoHnv+VLWF4pG2*s}z zEF!CEr-slxIS}i0(X6Q@A9SW%mWuv?Tm$Rwfr1z!3gQ_q2u#cT(AT8@1k9g3v=36Xu6axf!7E};2{BJkSxVLaal z9$=Dw9QKssSOBQ7W8xWMVM8(FP@}gZ4NIbZs`f}+#`$`PR^*Ep?JQ(FbPTvqhwr}#JWd_}ol*c%!Bz+~+DBY9B6hcz{>z-d={R1g?MRPKha;NeZuhq$l zSjuzamlo_$&+&4yx}dOhBdsdhGHjDFCQK^FLWHFw24$;dGF)%sW3?Q_H`Sok@(aGn z8e+9H1&!FaK`lbK2I{Ui;VNL5DzT?61c%C2m<3fT1zxYn}kpzi91 zQB;Hug-dWrhie(*6u36B>o0H#+V9~K6p>bqq6J)nVjx@_nc{i41jUbV35r-Ou!=a^ z!X+q%!6hg*H_>)Obi~ewcbQ8ST!QuwxCCufv_{(tu1$}R?BE?LKG!l3zwixj@4-Ig-fI_7p@AX_&Zzzw^PR*&~Z(gX(c`Ywj+UC0GCM1 z6L1NB2jM!({O)d{;qu@TxI(xD?kl(iZjT;%2`-VAb}%uDI0nNdXzznd&=$ZYXxG6d zYT+teg5s7qjiN7Hf?_OO8#z^-u($GEc8%9vu`tyN+B@MAu?>Vv(7NFgwXjvk)#^Aa ztnmW(aBD49Rd5M@f50X9MYYjzL*Npr9}AZVb;Bj{@i|Ck=J>`2W@w7HQ69MWDKZE}WK`@wi$+V*_eqyA=UaUp7$+n5S zNs_nk(FWT8Bz%a7XpLMfuB+N(rBgZ1Txka?2B6NX#X^M&hmM0uSpYxEvn(tBN!SN& zV1^9^r?7-qxEOCG?IKdC>J1l>sp9z&NPC>!BDG9QkbT|B@CiGK%rPpA7!CySXez}4 zBDJJdfp4^|2ndY?pv z?Dsdgo@N(iOT2)A+i>k- z7xlk=k>s}vt^@3M6s~3Lib9BRg^(GxHB{}Q_(^O)hN)tMc9%s{KZv6lVS5rB>9+f^ znX2$)(uECCwsk;aO$F1?b2jOP4KD0wEBgi8acO zQb{|#GO~F0F^nEPou0&+HQ*+DAC9S^g5jNz_(P;A-??wVmYnkxooW>qlr>aUw7&w8 zw8ZAWZwbLUaeDJ&4BWL9v?%WOzIhJiDk+e%DjigT!lEJndv#xLJo*64(*A9|kXq;* z{_V%K^%(hrDtiaop4*yS>T8Sq(cT0l7TfZvx5cXsdm>Gh#`|xYl4o<4 z655t&QlOKtTI`AB!bg!8Zj7H$-VHp|CZcRiAAP@VjI5jlvvIO#QM5z3==98rb9&~t z7aPEwo<;kd%BAE|n7#KwU#^0tUj;Eyjo)hJ419&G6?2Nm(fnvntb4f`)&A3TsoM-jR&cS)RoQus^5DXLTxW+QWB6i$8$vx<({zzIUb^Go?TnX59hM z=K#fyx9X6)akS=!l}s^-Knji_1t+ldTul>3H~LT~R0)-vp5T;nsdyXwc#d4{Ot~l( z-HKSa$P$rabz<0_6B&A9So1sD3!s1SaQ3s&qzcurSK+7gA{(K|)3gz=HEuU4K z&on@hPZ$YWv*5<$zLmD*5psfCPx>!{bwK*D1SFDE4gYJVA80-OtC+x5B~p#njn-d@ z-MHev$DT?l&d2#2tX=zS5rsfCMjIhYDbHFXbdr%$ALE^LR0eBJh)pyWGF~U|#>OD* zN%hx;`*vBeSHee5LD@<}sDMR!lzl#0QqP1Wc2~oJeuH++<`G%>GNAxzrC{2UQQ^jMwuzH5;gtar!y8R_g^Nn203WO6M|>Y)*J*q& zV^=R!W&yjh;1Zz^!6iaz2ap)bUVuvsZ~Ngo$`tL;xW#bU2d*RRcRySrlmpOPQ zS+LjH^*db4*cETpTu$YChi5{x!!x_R!;=>uIJVADJ_Vh57OUdLyMg!+J1ac1<7hjl zascc6R)=?VC8=W2+K)KAgW?<*qdbGq3@*8pi)qR!A*8t(lES?kr5DhP;q?q@@>0pd z7M5|LXsOg9D#`{6GU^s# z9)X5)5KHn{XfLA8br6|Skpm7|{uu|M==9PiT__hLaW?6=-&|w5gB_rTVtC3|#G~sfb)cTmONUg6St&PYdWhK#}M3F6AMoR}PFbA#JjpCH- zrCBMvalq+=s3{K|5c-Saq36dcTNj1lY6Xp*~N zeSb_=O4WiJ(v%J8xrwEad`c6Ne2^%WTtGx|6M<sQ*^73MlOrzA?0qgzUX{!9XeD;rr(W1R01c`KBC}wN0vdd^^gYpZyhG(mesIqSbUFw$-gM7C}!fz$N$H{4*%h6@y)>h;}mbyI#{(V zzA^aE>4;hvMgPVP0?XwO*HupVd9^g^<7C zM;dfo7s=jRsrGPk0B7AcI!N*Mj|5WjLGZ=vvph%H3%N|iX(B)V-t8M{-B)b1pdl=3Yq zLpdK9nY%sw8A?Gyy`b3gQwo1S=f1)zpMY!p0k;k%|_Q(gT@*vV-K4VS!dVPPcB zOW_=qP5K;-G=}gfZgf5;x z@PFfUCg!G|WZFVIQC*jzNl^wDViHdn#WDwbCLsp}oQwPLeS}?8@hx(eT*?QxP>&vw z`Z)DSF6!z4|4J2E!@#hQlU9>ye9SFjvlS+bb?z(n?ev5;hBIO68Nc zQpw;LE;_WRZnDw@Lw0@#UW>tuW;g13Z?{L-ZBOEcKP%l+bwUdc3&_L)=c@&B6=eIK_!$aEY7UI3TuJrQ+7k+0&F5IrKGNi{)qD zO4yQ&M!nIc^&Ul-DWY5Hh0E<@)@mlw>gH}_;!S+4Y_8qQt}=X+O~Y!r2?Z{UM@w`U zE%lI%(Q2uHOSB?c+3577wwFC}boywRU2uMF)*Cp!_8xGuXMP-}(%9>|XdfC1CgxZH zyNuQI3VSUWSe(iR><-0Q0NQFZX9;W=SMa~iuKZMCk0Joqs;JN@keFC+#fc)J^kdOZ z!XyTZey-CXI%emcriUx+?WozRZBkl6>su^JU8gm_XQJUJm1M-AjI^e99{nAo1+08h zQ4QR@n?U7-SPpY+h@HwAk!q}pXb4BDPRl73QqhOv4|W3J&zr=B`aYerQ1@&WBTuAT z^-)bZ`iU~P3YY-^SwTJaI;O=bmnE1G{f^(JqyuMRyM_ww3#e2w=@QL#u%UW1v*dKC zR$~c-ipmS~L!mZBgXL12zh!ycm$2#KG-;n-knTX5D|WoA+Rzbjl(rSrp=_WOS7_!U_g?C}ZPl%i+nhL_s>_LUEGN?UI{V)uj)0StI7hjOA}JB; zbJ5AR#9?0EVE8fMo<*%AIF-%D~gJ=skCZm?S9Ea#$Tyq zI9okCK}u@}l*#5|%qmnH(rK`tXiNgm6t}*-G9Y|2iUNW#85a_uCG=DoakeYzyfX`4 zoG)l8_iwbYd2V0Yi%tc2(idr0et{G~!l663XKHo^O0|0$EE8EaDeY<&<}yAU|Dc=) z!&0(p4>JO?Ff^m{_C` z-hk^J_PYSrGIr5Axo|>k$FDOdwK0t0L{T3{5JUq#P? z$rOgZt1ufzp(iiF@3DYJU4;}ukmCHI8yniv+d%|k6Rj%>|7+8fUn=aK4PyOSg0r1g zEb2gAcxEyDOk({(h6zK#WHkm@PHXiTXvc?vbJ3jw7R5sR7V+mM{?iG6z7i7s&;n{k z?w0Dl4|i0}6Q~yw?Y9Mqb~BQ$pdq=A93BIcB{7g`R~OI$rvQG~gLAB=H<0WN8I7aA zE^IIx;}`R)9T!Il++t%q(_BS;K+;Erko4M)`~XRh5x16YxKRdKuN^MK)j8;ZSXWzo zOpGI3+c3pNQ!i9D`Mt62Ew+82eP0UPAHNMLkrgo4NH7=e-rcz}P!lXAO%SpQk~KgPtQ3l%D&mK+h^KWl2s>#xlnoZ~ zeTWM77*)g{)6d=M0-kJb(y}V*Ff8Cp-9NH?m1u#!*8Crp1O*R&8{_YsB~BQ0 zS0drGU5SeV|10rdv)z(aS(mUFyN{7<7V`Mhgi;2U3QI7Wvkqjb`#M5xlOS`Qa0r>Z z7_K+*v09$hU8Lv=KQiDHaA=Y4qPt^`uwNxyLgM|bhu+snlev$VN=EL$P>`CK~@b3jAM!$bi`U~%-G5${UZz#Non)vb+7wCy)&cv}lnk!|`!em#< zfrYmd8yxB%gyH}Z4!Tv*T_o!E>9|~&esBteZnVLjD?Xfw!R}}7ib#1=ScRbCZ1%N+ zEtf+`jZ-#rIL(r$1T4s6dbfzpC6mjKqE3W~BN7=Ah7B|h8yd$Jr?ShYl+jHvt!1U9 zvww_RlIu$8sI4QVH1{-JF(VeVTuK=!dfGW*+{7a*t;gcw`fp}_nJGx;F=WA!|7DwU5)ZF)I zuH}d$4!rTs#h{_AYfKRM*RAn2afW7YrAq z*n;9;6VLKI8lzzGFBwbVxZ_PK;q9qvna5I1AfJ-_tz33$Kvv`_+0!yB@d}7=J&$UB z$)OFUIBz9vFiA*a0X|mCID8*r*DQQ5V^<-*kFqP3?yJHbB?Gao2;1~=Thf-S{ zSk3m8G`U=s*4tou=F*pUU8G`3g_Q{#O~?i!BX}T!G5h0^N3}rC!omdPuG5UGl526s zA%d1+VlTJFYgjY#yZ$eyU$;kxTnxWvj6G7Y@}YkRxs zq9bt=4d|lFAC6g#6FIcUCAu7K1ygWZ(vnJsVi3eRnHBhh`+^YC$So-r#OUxe;wb5| zqK+6GW$(C)C`6p@+!`>mqU{gf2^TR)AP;3Q&Bx2J8865;z`FwVC9W1!(X=B zVkrgJNp(!fviBbry*QSxrE229J$s28{PBUtgMBuL;Z>Vr76fMeTP~ z42nnMaqM#t%Dob6VaKuf1wnm=h8fLBp=Q5^)Nss+c`bF1dQMzywo(v6(u$guMOQ3H zHjUF`W9t=Fu(kq)Ut9>)HjOSGgt8{ix)8to&Axk}iE%rJm8qB3@oj5R3788JSYtwX z$PHTT6~+p%+>1U#tw30G(fmhJ?Prt^MB?7W$7-2^Z!x`~ZArq9#)<>@SS_WxUo~99 z@2u`eEgi#Mj(Qm-4|wP+51_9c$5nx};}2>!U8Cj1tsQjVmj9|PzCjA+iBtJFVRbOy zA$vzh@R3i>E9d3bfQ4)J=)jx0pvK}(J}0&BfaNpF=wmqc8>K2flx>-^J(72UQ?_lB z%kM|p#SlLeuBY*_TByxdu#0pTVMoJoPV=V1le4rDohME4nBHL0gv{}z340gCmX*sD zsa4cUFf+zTUXfbL63{b$HE!aPic1k9ds8c6Qx>-bs#kMKMQ;#ICC1(em^|s4t=8(@ zYchsY|M~B;P#tOG{`d$wUjobg!TiD6rAVrYX)MN+py`YnmVz*GZ;T10YXk%^@6nZV_jXcWQ_OzXl)NbM3B zPU`ZzV)0h?j(`%OUI8aV(^AjR;(#}rEsPew0KOn5Rr>QLQg|U0U~3u9By=F&f8dr5 zZ~?(nB8atnr8Jc8e-a8%Af`(C7+zpX`aUj6)2^>nEsMwwiCQsvqc#cc3}>35r(n1s z5@owSZvvAs3Fu|b5_GlN;kh+|_LUZZ64Qu@2{E)*958|C=b~MgsMU5%2UDIHDbNG4 z)eN!;hDTp39AO(AjjypdXi^0}W3W{ZD@0fv!d_KcAsR^)hac zzK7UKg%q?o&6>pF9VooHyLCYL-}P{4l1Xx86;FL-ET-H~vqN3$l)f4Y9r0_q?rYoX zI?xncN_s4|;8Oo3O}w@$=k!vqZT;Pi7vj$r{_}V7=b!jPCaC5b*M%iuf|)06eGt0_ zb+Pr7D5_*J&cK{bWtlN~LOEx6TMI-gPOYWFC8YN#xSqhrYMG7iAK665)c`J=M;pja-Sf?!VQyN*D8VE(6;^$l|cUEPUVV!+0Z6^ z)vV9DpbjWcKkn~<{7376_~S@9EfwB^43Y5`5+ok>VD3}A&W3x*H;FwEf!m0>)0N*T z7jmDWw(D-E)}jzS5HwA)DuzU>8-8>>EpT&>-m8r^ESfp#hYB)KYRkA+F2%R#y(i!* zV81pf{3Gn@4wt~u=~EFpM-N@BhrR-rkPB&O=>j(ot|QE430#89Yj6o%Q}proIkYoe z|6cg*zWxz(kaEICm1|x{JU61ErQBkEH<>Grr z_uC9t0sEc8x2TRQa0v=kBx3^=sWt8Ow*z3W)kVH1T-h&LD{rkW2Axy2kBM>CnY&jpTBLi6Neg~{yux^oUD;a6snN?er)vXeOXK-{@U1?Ugimcd5KCU$^8grt- zm;jMJ!4VNCMy}mUnl>!Wc`(k#%3ba*gBexz$~{Ha5`8BY84FnDn_QlNe*um{oDlwz~zIO8_s`49I1GNf@S_pO>;Bkk7O4XPYeSdk5v%{k#vz zhun(mA!&oM`*G^D+KvbI!3|ohnK+fLSh|arlhG>2qBzQ^aOyUoe6qUj@fT6KRz!db zLWJRTTXMNd0(|V(C^#xd8_vC9ZbE~K*e1i}L&e0Y^_LKobG0-cfJ>BBj_!I`52XpN zC^fQg)67n&!R&N8z6#F0_}z(Lj8XRW_{ErH7ketiev03s(FR3C zf}htV@+^YC4Gs?6$MHD_WABhR{VCre_%iyyEiK!`;?H#yz8I@3*onK| zUV(jSv+yVHEdG@ECSkW*dI>mH(1y3io06q=#dHWtI3AB7KWW7n{H4_NcX)@xKD(1v zWn76!6PY3S?yuIlv0{;EBQ}9t7r6ONDyHKOL7BwSlG9joMtP-!ouSMoLLr01vRWZu`;?Jmxt{1xaX1BZHuCniXNvX7*M>~{^Fe+ zs(7s!uL6qqJcc8?vLfd+Y`k?Oxpts=d?0k*MW|4hC^GVM8G=^*`|+_=uiR^E(Bi zGc?8jy}m4}MeM4wN1>C9r>eu4;fms((HJ$h$VJuGg#ItWm77>O{T@>}Ds;V9Y}dL( zJ6b5DU8(32HJ<@y=oLk8!Y3&6Hs$-8SyqwC!Z8^3xr;tvY(t!ojsAqJp_;$f+;)nP zF-wEm&jQ2~loHfvD0x2JYYxb?Rn` z_Gn<2qncAC+5}^935oVBiaVgoEyG_bwmXf*wz47pZLnH%?E{5&pxd5|lScQT8ZEqM zGH^{68$H)JrZ4%U@b`$kVX8G-JD5q^F{L6}$fi9%o#-w!ta0#3KJ_$@e`lw#Cwtth zu+0X8#RUx1_BCSfjHV#Sm>U$=JsgSmT9DqvNpX0ZWJT8DfO{ftcD9!&ljb?556Hr< zQ?VUMoxqD_SgGi3^cOPF#^aVaI{Cq`G^j*^cm(6!N5X!tr3NeAzj*BPlzm{nA4hWe z-3Byq)K&{jX`*Y21Jbh>jShoB`YIaR14hZNl#b~`tXRXtf+Ob$y|N|^GitmA2t)b1 zP-9B7B1^N<5-Ul>VH!^(3pbytpnLnE!g$l))$ZE$-=#|z#e*8g6f_JpuCfJf270Y_ z^o}|jFw62zqcs0%&1m!zqnLXYv1@@v!T=PuP9CNV&=$!WeF_9$+Csv<*9ZEZ)_ncj zDRCS@>AaNHvKTI5NutF)AN#$k`@Ij>FYHINMS-KOUNl-*EywVE zmP60$p|NO~zp-B&Tpq@qf$Ors>3%Wj(_$HwZc)0zp*O=N;-J%Ph=8d^HC%#AX%mghCb)#(Hn^^1+%DbkAY7DMtECBa zwE~XgX1I>9s}Eeu*fkceqwIQC$Cc=~4LZ)J<2pp+h3ZVvp{W)}Ke$BR?tx3BYC2qP zI90QBKM!2(+3#uH?=84QTE5U-Rl4h(?rH+NroeU7UA=YJy>NA4&V%6caQbM9+#c`E z6ALm}NrGV#I>b4w!8EZI{yYFi30py3qukc|Q5;&E=Ou{AnBzHOXp=oz0qEQVW}dJ> zY*;wcUW5Up5D^4kxUH_6JS3;=3_7$#rh|O!6*0W}&VTnrsC_nUG=MM zDSd)TS0kM7As_53m-kf5O=({T*%o+jiCDqX)4vocEZ}1J2fjtM)8tSTq1m8|1-E#y zUr4pM@W{ZcW)S;ZV0Gz%?NPibDWx>;AuMj`Z=%8Q&}69hZmhJ5yT{d{nB+uJXt!|e zWOnNLt%er`U7+kq&hiX{O%PnEI*pm^1w8QRXOh@P=Z~eeZ*b?&KD!|8Tc^==Q#NLEUZ7y6+{0ci! zlZB;G*di2(?$V>Y8DOH=sa3_(-O%mR)g=OIS7<=vVqEHe6dY#3eiVlS1vm756shDv z6yy&J+KF9G$OSFN;?0zNr3$^B@(Qn1wo{MqnZtQw7piF_Spmn%cs1xWwLsNv22^R;-#S2B!f+j(9O_mv5=)o;eZ6ivZudVQoVsJ9`_zVsl;pF zC==qvl670~)?D+OB}w!9|J17`xt3tk_%ClYXux|VZ$&A;!=)@XoUuH?SggHQGOm#n z*Hmg5A+?M_7st8mN)q5`9S~)VZ3*lKQBC23%Q#rP26*Yo_8329VYpP+VrfOu=1skd z_XFE#J@&G!)bM&N88L9=0A~#8Ezx30mX=CVMPsCWO13q$;!1mbQ`v|?o8`o4z{@DJ zvHeW;-UB`sS+ZZz!k7t+?#w5vBF&oG9Q|v4BQnot@~*#4;&p;5FLZPFVE8i~PJ3}6 z6Jwv$8cZeYB+Qktg;%6hR-Q`WC1?MtDdn24o8x6;-?t*gbY{kHGxV)vMZs4pA-Q5v z)diR67&&mgjE~jw7`_ihl4}KAKe8Wf(G;%La4l!Q-MXt5u4?wX9@Tw>X>Wwf!+v}L zAWK#31&YHJPU6Lfe2depn1D9Iuc=@XmsgKM9K}lghISmqgd8 zZ*f%8WqRA;>qsBA%+l)26iCjW)9{`}%#(2nsmk2~7ea4tbQ?}a;=+grA_^C$V(B)z z5haW+>%i-x23e_LaPb<}%poVG&z)76ij~nRLDV^2b9?!+yNd%?36T1B+-fVVmIg|n zTccM*4&t9dc&jqr;|J0bXVq2d^D?Cp-ApI`-HoaKackib2@F(1`f0jCC&VVJDr|qP z=@CTyN5hHZgNUzOn^=vweGu){2Ghm`(bhGXHd>=awOnvFrgge&78WIW>5)3rKQ`?V zl_O=hyR(8FPFy`G=MaVLNZc(I--zB=Lvt{3AWdjnSVVwXrq~H@w4?NWcuDK!I(IX= zRuA_<@5=JH_Q5|BZTu=kvrC=+*^1oqNV^I7=&;&+*O=X$e%F6+Xt^I*?iHzc#N&CF7JYi zFsq17(6rYdw_VWcQ!M#9YR|$bB&{mLdjWCT1;3kI3sAlJC`1XFGakk)0OkOCRd^z{ zMqc!x`{9L)u1c7EE9ojI%;&3NqN%E|AE!-jwB1F$h)OM_UnmE4J69*+7jLMFS#u{G z(x9@`M&O5c7OsfGQ6?@eDk@yRhL;qsMsdNc^CQ`=htt89BLUkjVUjt^B@IhTDP4_k z-1!QPgRC`Mu+R#-Exl4MeP7KAGVQ?_c$&dS*C?{CB|6?G>?TL^QOR3s zXf06oF20CW1Ml5f!^MOHIwVxjC1|YZpjEt)zw87W@YiTvv6bXodybp%2E3G%oA8l% zJpfIZyhRfR7MHdBFV@}!E~@JNAHTx@0;1yvuIZ>~7O67~!{U+*GXsNyqT-UNfPjj! z#iHmZb5{(>r9E5JR&%Q?GnWMSE!51k(lmE6Q_I{c{XNff&b@aIT(s~1^*=f@hv&TC z&--lm+;h*}M*2*lg(^5t3P}~0;W!l3pj}P4)mxw$9Pn75>3@HSnViuJ+5(SIQ=reo z40I^gy9stJ5%{iom>9rJJqfP8bh{)UA1&Jndq3T-MZ2)sB7F=*Vg3nt>gb6Atiu`}%lpVtdJC?>fm5mU@|rwIy$`FfevZAQHu!w@qaUs5N&jpVKoPp+I{7R%!;v?e6 zvFBv1X^hPX9@K=5bUQ7K53t5=n1#0j;M_iiE?%z>S42nlsKh-btajco!1c;w<;&Ic z@t6x1FMgcRhy>_KTJTbjs%bDe6puDxTd#&04jB1@Z^M`SFF#V-1?%v(q%RL(B}CCh z-_Wh#HVFA>hsq6a{)Mp*E(C=~Nh(7GuaglADQgz!DQ_)>lF_?W8^lMx{}KFQm~$9T zKpQ$0!EIMj%B@$lZ~`?12RCIntBNn3jjNK%0w%Q1vq8h~o}u)hL>!-{fD_2%Ex4cz zt_X%ocTn8|t}tjED9L%75{GyrRt23x+3L zhJmXF+eY6m-F<)e%-gLE3mSn6zW)|aFT_Fi@KoV-b{bGU;>Trhe0)<13`jUQ!40;F z_=JEzsxPF&_?iVrZqP0PFa|>zu!O9Ns{ZDKa4rmD+y=#*cMgZ)d4r(OQYM-!nQ*^k z9y1UJGeH>gt4o5IVfNdogMxT@kSzE-6Py6&@t}Lb*}HkzXk%e)zw%rI4#K`!k_tfi zM9>vONe+zw)UN1!Ry6v7vySkvgSayOma8asn!9^L!`#jQ&ks~~1Q%ubxz*tmY;Sz`J;JYEonpv6u1*?kDaLHAuliVpyp!F zGBH6M-jTTwfN&T!9Nzd?`X^jm3R@4fPj76lJFc?}UekaU!;mki)$t#d%n1ROw zO0}G=!j&7S1ztUdxtHN)Vr&aT$uAHipT{u*ZLB^`V}o*Ss^WYT)T>r~F99;E?>Di* zu)cdj#be{=U-q+=Zf6hQ*$&lMa-u%WO7NkU`>1B+Cx7n*Ghd<-?5n{(8t*wTgEFuu z9>5zU@9~GP+LUu-x1kjBqyHX-C2jekt9W_<^uD7Lck=3@^3YXh={haxV%Gop&fHe z>wI!iZ^Ik{p6jwyegh*FQ$B^6uvET3jb8O!1UKc3@Wa6oZ_desnI5E5|EG+NHcW+= zp5nt^VIuhnX|Wy5OP~R)PevPd?(#A`26V&sMN9GaCdl3~^feUsKY07}Wun2|Z%^RR z4m)btTSE$2AsGfJatZsKVL*2j`c{R5a~R$rajM@}xZ4`t{f=A1)S7Tv@u@@Kus%$AV3tX36>dVy< zKA}N>Hrk=c{1NK$`1~jsD_|)TvhRYm6n4cBoFxN18(84&HHePDM;Dp^)erA2!MR%} zoZKYhU2`C9guz{|BkEKD0uwS}3a%-z zU2t4k3=D4Y&RY4_ZMrq^x~uzsc- zEw1~40$(g>RSfJwV8NgstLV$VG#Pc2W|zQ&PheopFv2Y8JY)|>cb?~&QGl zC#g3ob38l^&M%B`enJyHe5sWKE`guD0CpERYlEW>pf$rQ6(EY{VrzEJ=wg zJ%S4W&Ew&j1pQ!RSQtmI+>L|h5Wu6C=&}WPxdg3TO{;^Id&n?nKjag(N03Sa9Nn`Itgli7#+;2N+J)m`x-%gFvINaqMKuho9luxMr3&u#gKN0%^|K8t74}z8@aZi~8TZ3E z8oF$bE_=es9A3(j|376Scagg6f9k4mz`(OlM+@-GXnD#>hv&3$&%OXV4?r1a{Q;5q z?#B&t`r{s#P1&oCf)Q())i2bypIFnm&@OSM_wl)9t??bi*iYrlc+^)=!(e$0Hul-D zNPF65cxea1+tFA6Px63ww27~*j>C60<14G<%0he57zIQAFYq=+!(4m`CKUZgd@A1< zek{s%n(}C80|a_5#(Hfp&I9BfEFQTP%d;Z50|*|OH3L?^N}wyjfgW@cRz}?E7UP%& zKe)uGD;P?Wai#Km=GpLAiTh&cCLQr0z=e;_fsR(p-QpbB(G zcxD2f%;Rfecvco}{iNenxCi(!P6LecLK!|cz7A~#m+MmN7`A=`@0o)`+NIc|V9HgD zOAG2=6iOx@+;)LHLq+apC53I|I33|)r9p3JhoS6+mi!V=7+Rp*FkYxY zJmYcD3WE(|VjA}S;t}W+W@Lko%Og$v&O@WwWqsWnPBiDYQ~LI0IME3$G2#;JEnHR2 z@YoEtqc7nu=Tfx?`tlwK6PNPB%DDURUizYv`0hog3o4+PgNRQzX*8(`f4o-Us6<9KDwTO4)>HutJt$Ha@Bz z3mJz))!aq!7Z%)5GMDUo3(d%s3-9>m5^dkg_&NwsFuo#I8DGD~)hh>_Eq37y5nibZ z3q5p*iCsIz(CKsjI=an4#iUV=*KWZJa$u>M-&zLioC`5eV8{8coBhq8X~2=!IBPug zKLrx;IelXZ#9pH(JcSQDFU2QK;WP&qL-XJlmFS-FJa;YF?N8r<3umz8hBv^oLw~sV z6V`THKmj2l?bGTKwX{`XKqFg)3C8nlz7>@S|IzQ2eB12!oPy&dKK zMG?25%e81MbvD2!^vr{w?z2Ave}z8-bYgdKGlHvK~+9@fZmin zqbeI>YAQ7jH4_cW)J#=R5d>Q8Yv^;V5m`bMB#^DD9mH@&tqc6Fg}khUk0;&mj%WTn zrLItC(Hywj5&HDfSP<*b|(CV4P;l%}*+^)-V*lOSob@dZSK#bkO@}jT& zxW!#cY&e{#okqBs5MydDK#Zwvf!Iz;HPn@H-66(seIUkg+m+a9CAP^RGcH1mF>XMN zF}lFo5YrtBF_xMEF_u~iF;=@DL2M7@;0K6(LNR=;9>bkgViK(HGFt~F)=!DyfhAmR z1m}C{#4nu!##^P~Nl19!2_B^}l=c>vz(4FA*)l8LC;&Iz()ufm5k4#x?jFRu;vNI! zY|0KUmd~PCEPR(xOb18hEeABs3rqu|_(y>ENPEzYuR? zz*>kBEh|$)|L-Hzwo&`Z>U@F7mr9>Iok?uyo7~iy<3Nmg}Xq z93uM_F{%Q~3HroyI&#qR8^lU!@RkhebtFS5{D#!cL&l3T4Sp}ehn1GaFh`Hq$~@}E zyreK$44JT6i8Z^>Pg;1cjx-!K(|sjFl8>T|hxT%)f(X-QG4v3|JOubi0fq2^oCkoH zfRKi#k@XFJ@$f7BGB%4Ly9cpDB6U$dQWS7Qfm;{+)D5X~8j|T5A^3~oGJF`H#gOkL ze$a%qx+XqSlXUnb)sdQjlO`bzsOmN&lZW5nmpNcDbbwFng$n5JC-pD%m0VEp`k{VO z{Sd!vKBv7?koYft@o)uxnFkg_4@u9ne%!!QYH-e9^4S3|*MuOmaO+^$21*POjD@HoFZkj?%Req_ zsN0F`7q=5N4=jdS%rE+!`w+iH##7}ml6n6K8}lE2Qb^UCu~(I;|mFu04pB4tPL`zL%@eXxy(0*$bPXbs=lhg{G!h~ln+MJ@>|CJdcYaY|4W|H zFOFAo(DMBv_suZ>EzjsP_#u8@C%?MZ{!;70x>DDtt zkWUm4`LhDNPLVQoxN%2lZ^kV$t0rwD$$zsUdMNGE;#lKYs{>5;(EwC7F3ygt& z_rpgHTD}i3-wsd7aRWBeLeanImGN=hV*b&07vRf5%m24(-go#?Ze&Jnd1nknop^}v zj;Om3ap{Ia@0pZHu5IcU|zIr6Iu^pOHX>q&tj zjZQZ>RKMImuP*h15}69Wf5V6M0v5xP{K|6W=PCK!s4IEFmWn}UVM{SAwm*wuOEDIr za2u6_mVdl6N8Q87ezDYQ9#{;um|ygXTag^J{9>)ZR*f^UB!8HR)s+nSbyJY>j!c8! zf8fJP%wj%hV>zOECo8SYpj2XDUKj(*%@~LZbjy{NZx0xx)zZp-v9xab@Rwd91*-L2BtMv~`$_==8lDC>QX+owa36kIEwC8Y0=};edLXqo{;e|bFNVYXuo$*CW1!!c z;Ufnv-w{HI<(y!NRee=~`9+_f$xaod$iW2-z0|xN92V#vmwc{4o9F3G9$df(y#>dd zQ}AI`_pF;g2~t@duo#xo!SeaIxAgeAN2NA9IzbP>qg{zE#l~MOH^ZZ67Hb9(#zg-^ zu!G1!L!-A)7jllUTxvd83~QVDMW6W(@ta6~-Dd#taxT!dk`org(&9@op})}l#t#mz zeBs~<4zdQYt!eTLG;hS_|e?+4NT;l~n zW?(AAVO_Bp))iwQsw;ftpyhij^WDxzY6qj9{|#?As;?t?e&<6PG8=mwV`DF8G3@1x zji@PZyd#ZLZntX|M3-jgl|t^6J)zdB=G z$rx&sjJiOn$u;GuAjL0{arsoA{-~?89E)Lz@FmL7WAMm#6l1h!KlJUdFjx#3CmDmr z%%-qn76>b5O{7-eiYsOrfRaN!#S4p}m$S@EBQID}ZX(q=q>g$p!YHA>!elXIRuPl> zS~|8htV+{2+b$Un`x=X3UtFu{j~ujo2Xo(^k{8TWq-y>}uZ)lV zfcZz?TV&_(tL5LU<~_-Waw9Wp%R6Hr3dbZlX!*vMow1{R_ncrWF|??_{G!jc5Almf ziO@Nu^ct^ zk(%D{gmKwls`nkNW9@*x1VLtFpJ5yvJ6H_2SjI+_(XCCibe`rVhZ+SP33MdT!60j3 zO){pa#x&4Bo(YqKmPRVq0ROTEz-9l~W{f2&G5_d$@}3WWU&Y%rDj_i=h_t zi#}g@h~I4Ts|&0n1)hOe_os?R91;Af*Y_YkTs}zJ7)uR;w(ACH{crhK^%Q z1d|z<%5azu7Q-553`9K+A313GUd4Pr<}W=qwu#j4MzGZ4+!HV(>MR*{bb&c$SION= zD{#fU7?oHM#F!VE5YB9g)Gx;HY_i?{4DnYwfZwm?9T?!TZni2dnr648NNzp{TVk{aDT6KkQ ziq%Vpd`#vLOQF3RGe)Zwc`reS@?Smj6Pai+TGrB+g>FMq7(a0O{9_$M={1NW$;SV4`_y;^6 z`0rWY&z~fiPw?9WoB`h(@&Ml9fn#telM0^zC@PLX=};`}oOM6_rnC2vMB1A>W1OZC zvppm%)EeV3JM7koFlSh#IU>{+6Kb=Voepb^)#8k_L|bE^GGc6@=CBA;L|AyV&1^QA zE#}D3&=_ZUq&37DVl{_bEaBl1CVRBW5glQ2hM8?PXShAW;jo9VQgnzj+!^Drgqy;x(UCDGOH52;M5I03ZZ%mUUnWbaBgAG2u|$|npkNLO zcZNsDM1+M{ZJ{xtkv40L#TgPF6Y8)A-2c} zizzxRGSVF8v|6n8h!|67xYZnCi-2AcYOz@(L!-l@osN)j8&r+MVs?butRXRw3R$#8 z#8{;;Q;01(+-V1BxXt1Si?)Vg8ABlRPRNNh(ive5ciJMYHj~9_hKh`aTC;#&M1%v{ z#b&dHg;}DZBFv8HNXWk<#2#w5#)O8LW1LXP&LQQR_GZf=n}S&(9m$3)$Ejv#)QN;V_`-?p|QQ$*eSax zD>*wa^RaG5X>@94RtBt~GDP0)^!w#ZN^ zEX-_)2?;ZYL33FgF`*F=&Pcl>G{SB-TSDyNHj~XBX|abxiLunC$Pj0!6Z=iL1-4LV z??|W9YI2yutl{?X@EA*Ys58=Ju{)sS+QULagv^E*JEdn%kTYuubDALwPMg&lVz!2v zA{`+SW@z>Zr^6INl@%Fgx4=+fiV1_BZgxb5Le`?8qek0op^ivPh}97i>Ik!0?9lJb zrWmuyW{QllnIde_5#fTc#n>sMI4?OnHyvxqWU@f1Y)*#*x^_fpjNKIOh=_@F+QXcd z=op99ZgE80!eRRivxHe}X4v>5p>muydx*mk5$d$ttV=y?dmeY;?6a^~!nk`RSJ~wf|k3 z;X5)(zk2=J6T!Vc*bsVk{cZdIDke1iYsd7r4)?FKW#@^Y_|20y{q<6ovGwZqJr|ZO z9l3GG4{z+~_T-91pRYQ*K6>Nrr&=ug!|$ibh2Q4+pEtzr-F>6v>VQc%yG{JH!q}-z z)~N+wWCk0r2F>eS>9wwP)f!We9`=mQj><;@eS1p!6XE7LkuSIS{<-aaM#POj@$CB7 zY^fQ#7~3ZYK0Tg&eNw}vn||2&bNxT@>iFt~x%ZX_z5V|9@QIJSn$)c9Schd*M-~NdE7gCyYklG|V}nyy zjD>|ucMn}F|2C>Oalq8)JDn_&LVojJnN`2pUl(GmJ&t#1{r14S&5oQIT=%JwPdFUW z(~90c==dkC!Rx-Ki?2Q!+o|587vFiOe?Yr82bbR2w6u82zTv~ij~&TZ_|0N zJvCMz|J9W@TMeJ*+R(yv{IhcBikYo)dgdNZ-rN1a$kv|)PP$xlf8x$LeH!l_*QYc; z`Hy|?SB}em>Qw6^_q+XUn3Zt&NO>2>{&8!bSrvQn_<)eUmv-MdT-@Q*ZJ+)T-@Y22 z(m%WI=qGlk9X#}%-@JFnOdZ?j^yUxWe_#GPGBDMvxI<>#M+Z6wzfrL~^36WGuUCYo z{ANAZ=D_&r(#d7eul`zf>t$=>VIOC0i&#|O=gUcJV&|mExW`ZV?pQx@&9j>tU)Z%` zX89AA)IaP~R<=HCyY&3ux|n@AyJz)GZ~Wxz{%7~UynWRN5eqw)jJek7&$s_FI(__m zlwThnSNDrGEiZ;!94pOd>lb{QG2z1oPfuG?{?sqWZ*59gFlhXc(Nn@N9S`}ral>6# zr~UNK`-6+$b^O|}hq-Roc8%Y68qVHZ5?B=cPw3R6*3rJJ-kv?BefofLH@^05(xP(K zyst6_-#xXsUA?DM4_WtE+dZ}G&Wqp7ZPKHSCF=R%x$_cV+t+K-Ki#F3<$v^>UHne# zQ?tjNF+D1$hxY%o^<&LmEkB+$?DM6*UKvkcKiN`u>GIg>f6L{T>rpOWTExryZ~YP0 zxXFdXX7lw9TVLO&KUALj_^p2vs=Oa}#n$;~PsaTIUA}*E-GmuuM|7TlVO+h{%RYO| zX6wJ`tsS%XE#Lfo@5vv%k?`J=VEGh#j+6pljny2z1=tQcdPT2vu|Z? zoAvhCV{Ohq_rioeuMBDBS~0Ke-}uH~M~^=8{11M*rrkb2yeKPZ*gMM}OMBAlGx5LT zKaE@W_Pba19>3ImWT4~HQcJ_A&nK6?KL7j3%pU7pc|$J^tec)wV*GP;Os~v&m0nwJ zz1O_5;Nr1>_PO)(tJ=H1-zf$6UAr`Mdbd+YcDq6sZ+>;xOFuP;OdI~&qb(PC|1_ts z_u9hPvl*=xJhAEE8t;9b^UPmjAQ+#ys`S&INeh@ zU%cL>Z{sdWmvYX??O~45&F%hD+7AgUKOEFO=iAjAnpK+D-SZs0;`JW8zl$VL)2b_l&W%~GzJ$Yluj-X~`&(^sV7c(dI zgu$_Py`87-(A+Na7$ET+cQHyT0Lif>$kt`J809b+&w1mjK-d=r!Tqr zWM=P%fw#WU)xG%Vr$>8l`{Ny(r)R&f^PfCi)#b}mD^?7h6q2^Q?Qcu=JU!Zcwz17G zB&P2te@1&c?zDgJ#n=yTg|s|1BDZQ+{=gC6*tSp4v~EdDo)S8yjVWr~&d)yIURvDi z``-$Vp1;%Q^GMq>vrc#2?^`~1Y2n{5-EGh;_?B;Y?&dKkURyoxqrdV86~$ZQB5#`# zKKb|J95m% zx___OJt?wh$l0zh{B!2hbv#78_tYbJ%8Hhbrp{+XmzCf!J%dIHh9@x zXW!}fo&}Js_xOG z7dEz7IqvSu@s~fy`K0%XtOK(vehkwmgf%gpIQQJ4)%U%63>xrH`(Z`PQm5a(Ub$*? zrET}f?G>pFYYt8GCvbKXSO$RG(jZ6-WNQ*mQj4roVe!Xq05S zY58he@rwVo%U?3ip48R*raZ1+p8Tur&aM16qXzuBe`CO1SNY!F!KKsNClyVq(!G=A zxj%Eo)rF3P`bBT0eLm>wh^5Omw4O8a{pE{C$o-<5ZrBTX-}TyaCUDbV=5LIDdeJ6^zULCG?+ys|^S28uHrtOHcNl75&qvIWxcAeWtKuRCoP5dHMT~ zrab@Wy+v=C!|n!Vg?;wiC$|<(-g0uwv2EY|Z`((`tY>faSZHl_dGcGw{fFH9aNE#q z3c?@c`Xb=d9|Q_XMR_;A#jurcGF|901N1O1wuUpQvl?jdU%1o!`H!mz>b%7@oc zX}Q^XT{6>`%=6UUhwGm7Qq<^-)WR+%(?XqY8n;Zy&FYe!4ry?a6k)og=fhlcLI!%l zl`6eXK2ePp7P_Qoj4B!vG!XxSgIvIDU}e4@71cV zg(`YoZ}`TPjBEcwA*y3gMX$q?6Brs+HZ<16)Poeg?k;>|9sV%u(w8+cu$Tjwc=$$z z-#;IkUlRja1PopZ_6)?%ubL0Np?ZFB2~n>z!Z)Ujd2W3u;p}J&Mv5l!F46Q?nz9C&*JVkQ)^;yHAb() zi*MRM?DE`qp;8g;-tM@(uh-#40N5%&&iYuRA7W{suR^)7#*6!T*=zd2MM=HxG5E%? z+p0s)@E6|AEBD6`)N%Wych?!eB0u*Ej2M%yL#PH{D#jP z)8;|;tNSrxs%|rUV_$7OaH~c?Y)cq+vJ&pfeD91#e{M&ZL-36uc4WZWnp*84MX$q4 z4Y7XK-=BNACMJk5pTRfgr(#vK2BrgH@B&$EkGBG!UR={pN5Z^{-|#Ws3I4by=25~7 z=lO|!LjknfDfaB_zV8XNo zGmf5q=Q_mJ#5_TmZ{Qp2=YxUWx7WmUCJc^0=;zs!Qn#8IT>RGSU|BKgWU{f6vLKyUe<$5mh zsD>X4VQ}j}_Noa*uve?@CzLRFTLAX4u)jWoy=irfl`t+aW8b(mX~eyn7(8jM?swXE zYWh@7OgLe%4`O(1#iJVa69FlDxZH)Yho`?}ujwc9KVYBz_|zKY|;T548SZW{ZWSw`n)WXOLr3;u8e)Grq*y|^B|@bK3Vwu7%u(-?Xa1pooDVF!S#b2@D#gQ1=Dwc!XQdhCyg@qWr70WGd2~{k0vC~8F zQ7m}L6oxRxV&RrLiY1m?tcnFM7s1d$vE*_~kYbt1Ee6H%D!0^EEGxOCy<*wQE$tM` z5pHRqST1r)W5sfxTRJKhd_fR~0L9XdTUsiXFm7qBSo(2GQ^k_OEnO7L|F}gR0T$M< zd{o1-wT9(H4a=<>mIk zJa?#JiLPN8R>LyAhGkg|%f=d(BQ-34)UX(E7c1njOASk3ZfT^ndnUI8DwbK?@`z%2 zlUrITman-b7%Z%l9^)2I#d4NgycEkVZfU4k@VO!wdMFkPxAasj4sKC<<{-h6ospfE zH;MUS7_emLvV(OnV;=)cK}MlFrl2rCD?`~`AtorkFHSQk;QrJbEoPiiVZgaRv*4Tt zLv#3$B}Cpc;;e}*7K~xQ*$A`X>;wbO7@0*D!}%feBYQT=77NbRFyP#eFfvKP*%w*h z)E^?)1uM*toN1hakR=q=ah8E|V`jlw4hF>%B9|0r86xJ<8kSD7B?R+<0olY-a){X? zi&8&rWs6)HGJtT~GRy-E=mbw(DrxvCnLXvvH zhppt`Uwyaivpq@275G;+-v$XIb;(m%QIN`5I5Kp&vEnC{^(`p|X5^ArS&$1g%)G zGA&I1aC*Nh&6PTA&sl^Kv|PlJwHmE6EK^xMIEyfXR$L9O5Jd~_>!CmxK?_&&)V@(% z{BK{CmCIR#5w!Xcs~K}D{XISAemzACUq*<5FoIS*SXHeVJ}Yxn)^g4wjG&c3EbJQ? z<{M%zKA~vgs|_&_M$qaDR#of5fOmgUS*JLQFj5y-TP_@xMSl7bi%(~zNhgXvW2|Jr z!1A+-5ptMFEIEgfmu{AHR&uC^6$A`~5pvictZELiHdIze&LWJE!vVy?o{Pcyf=gm7 z_Z$*N$l*Z1vh535bM0w2j7kn&T#GP54wHx__rpuupPH_+QaOt-g4Q5n$$g{yBTX-L zRkS8?7GVUf!GhKjT~4~ndYQ8bBhtZAi<#HV7l+a450(rY;?h+-a~V zIsAlc5k|=2Q$h~!27P@|W$ooG!U$T!h=n6Lh6@E-W6bHq&tpm*R&f?#1g$hdYthQEjVh}SZa@$SBWU4(qSwh<-yJ{O zuA8D2#94$9v@(b#Z({`EW!v{V+5_`)^0;o z)^yGyjG#4^SaN%9Tz<5@%38)*gb}nd1+6~sfAO-)s^Bcb2wLNaC6{Y*eq2kH^$TYa zM$j5BXbtH&vveOROuV3oJANxD_79!dF9@FDr-7t5k}C;tD)6N(OSw`gb}o!siCE^wsRI? z1g(5x$zv4miA;*tdCnq?pj9Af;VeaE>FPrw1i}bfg{@AU{HRMy9w zMHoTrf5gHO0K?s(eVTeJTKMh~41^K1o&~F_HGkdv*(&Q7&LWJUHHBF62+%Y->Nl13 z4`&fZ(0WeLIuqOJLzUGW4?`gkM$noHRyJbewtR4CuUAx77-tbi(3(apxs@yHY#Fbz z267f*1g+`BlFJnrGx0B#mB(3x5wvCqS`}OS>{eN2oJANxYbLSe5xd=$U*U1Ja^Luv zvj`(-%@VZkPrLR%m9?9*2qS3C7PL~H`r|v5b&j(LBWTSLv_8!pbVp^;!5pL$M$no| zEUZHeo%gI+8mg45HSeB;5wuDGtM(=M3!cadWr2qS2{BxqqBs;q^aMHoTrWn#J4p~_mxS%eX^UJoq~kV)6$nLT1>Hm6cY-@st=Puvuw)ZsqPB8;H56tL=e zxa-f3gH+Z9&LWJUwTxJDKOEt){X3PVYYd4H2qS1M2dk>}`stQWtE|?XMHoTrU1G^~ z_;~YYep6Z9Ig2oY)_a21_d#n@RMt?=B8;H*KCxQCw+=ot2YI(OD0NuGS%eX^J`l7{ z&AR`$%38!(gb}npRJ5=kzWS6C9y%nC^Q$wj_lRvAhy_`iDL2CuEd#j;k|ou4)wgF5k}BjNh}}u#(;Ct`U=a)S%eX^RsmM+8_SP{ zJg2gHa28<%t<}Wh$t_|1g*8ilFQZb^W>@R z6s;FHi!g%LCxTXwf3ps&tdBX1FoM>nO1ZFabSPeSNM-HhEW!v{p9xw6UuqDqvd(Z8 zVFayp#FG2Qp{Cu(s;v8*MHoTrb3vpQ)^WIg2oY z)*fQXHGk2w=%~tS(G(IP5Ju423s$v9S$CAU)kZjH5k}D3M=b177#7FAJHEA2he@18 z7(r`4U{x)T!UIpJtRl`LjG%QuVWHOTucj|(s%X8;S%eX^zEN0M^Jgc$__)ei$616C zv?_@ux7XwqJ5Q^uL!3nzLF=HP_0P%iPpYh|oJANx>kzSw_zj=Ak9H_mS@n6<5=PKE zOf0z{4*IcKmdfhPS%eX^z9p92HyVWZn5(klIg2oY))7IgZIV}t${NpEgb}p96SNF3 z?s!pUJ=mpX!o5Ldv#G*dpL_Qg4QuX%W(bh zHI;RNvj`(-9VeDNOTj&CBSlN!91z?aV-P+4m@ zi!g%LU8P(Qk$!l*`#?{nZye$*!U$S_3tD%FEw`&I*ild*jG*-ovE(`oSQM#OS+_Wg zFoM>4FoM=SV##$F_{m>)RaRThB8;GQU(gzIZghgm3gaxo2wJ#M zrXHu9_~^sYUP>MI;Vi-kS~_CM`>%fE*Zrxo#&8y41TA_bzs`vHgwGpOQn#zD8Jxu) z+wXpbBs~mY*;l^&^hXwz^$uqdM$q!49OCAOTF2^mtyEc?Ig2ntxx9pOd2RoqwaWT| zvj`(-(c|ptS`pNmGrjUzm35P|*dy=V%S8`$SITwZ^%Z}ptj2A?5d^{rT0Tm9q1L<8 z&-GSWCe9*^P%e7JxuW%|G(JjYC2$sd47&Rjt$w71eICR8fqPCiRQkp^&LWJURadCP z@W_ontE^Wzi!egD=n>mW9e!8-d4|fW;4JnSZudIGN6o6^;nC~2-d0(^a~5F)EqWBR zqBW#{N_Umj(ny8nkBfHKG6-6E_m2IbvRs@+7(ol~7*)??{dDBY7?oATS%eYlu%Vze zFfG8UvX*leVT6^6M#S=91(4>C-oJ>k+*c|HBjm8LqJ_jWg9g9SLuuuMT#GP54x1<} z?1y;8oyxk(S%eX^0*EDVmB}re=c}yxZNU))!U$S{g4PG$gbqu*OYgPa9 z0F{-%R9TBTi!g##3qdR4sgzSHYaM41 zM$l@hu&}l+3`)4uQ)#d7IEyfXRx5>t?S)5(D(ebo5k}B@gjn)kui1NNPO2=gcBl{6 z#v?}1qF0kDqs=Q5o7YiUZ8(cCf>s;S>I5D!hgox;D^OXHoJANx%SbGFPZW3OmtvJQ zkh2IQXtgDlk!xMsG;*HG%H}M>2wLp~t%Q(~omJLc&LWJU)n3p#vf^vE_FBeSgb}oY z1g#LyBePVkO`Js-L8}9?6ug+LfVtCOJh=5NoMRaOvZ5k}B@j95>AN9-Fv{`%E+mDP*02qS1cE@<@| zbn0c5HH@b)LMkmrWP zgFB5go?D6t7B+JhVnkMFV!@YNkXgTQ7GgwJ7h=h4TM@cmy;ZFnoP`*X)sy5{;N zT4mklEX0VcUc`dxrqG~e;14RR8{`%PVnkLHvA9#o`R)a`R!-$C#E2{#vE-ij{H3dR zRjs!;3o#7w8Mj~#z)#xP@da@G8-{4|)4-4ZaQoT;jO66}jJ(|Z!sPtaoG}?`V>8mm z8&Z9Ug0&oSBnZ zsN@3;f<79?XXh(JH*7T&oVL4(6)ky_oGe;LDX9-ziwtT^smYtWJI;x z$YCjhwICyFbTU4>TCk?&=EKI9HMyoyW2+!Aw0ZURCLgtIz)S!WYiz)jL|wdE-&PYw ziJK24unw+8;ay*YquI$Z+ge)$sXzy-StroLY8tb%QZppLm=+x{M_sZB*O-RkM_pxBDY#g$;H(u#{*b=3#;Kxwr5O$ttvBz z?W%=_$S{;W}oD3uvWP>$%bZS~* zZa$30V9$mzBqJYk0Ruej#bXD$U_1ef9r3tZ&qynR2O&-34$^XS$7g0pK}9(eGjq~| z_+CDU?x|P);)(A2KibuESWSD{*woCNAX8Ay6y{hfg>lTaaZSgl0w>RA$#8$g?C3j*_HB!&#CR zhwK^z8tnNjN`ogPYtV(smIhx;*XnU1g7sFh=ZOgBBSh%6B7*sN5JICMR8X1)YLvn) zQG?3VYva17YHg+N=~~;WdwT8l=dP|*dn~>7x^w4i)to!uqEYwm{MyqsDvzp`&zWnh zc{%yPbevf~*aIOnoX9f{4Yrb0D=lA3RG!?(qrCgDtj^Fi^xP6P6y<5W22n}Upy3`6 zXZjj6B}uDmDv4VCQb}Y?vC)-8#;hfgF++v!RE=3nB4b(~#H=NeF~c6jtR+#SVsTng zOT{WlOi}^RjgM$BC4eiP!baqrwY}0wIpg4vKmt?q>`wS zRV-sISyhs>vZ^F%byp=(E2~OkZS6tX(a5TNEUQtgN)i(kyQ7lG1ZzoTOtCvwW7d*b zOIB;CRrFbF2T&5VYE?6ER(l)rg9X0JQpm0AL=(ULXLp z`hft@>Inki0o5q3pFN;Ls{vW2#J#JmSq;jv_n)B5t2m%O(CdGKGOyZgq?ym9UVh(L!Q6%a%C4iwM>p4?<`)gO(4m_CcHLAg^C6O`JdemUnlE|3qZb*Y!OJcR^!DV!LCsKXsy;^lW5Xv$nPEsG@_dkM} zXSMDhn2qWU^*}K5thUVq!OZi21k06N%ef1=Vrxrg8H2IAHUP`a0{}|V9_#^%QyYMJ zfbLftfaT!<0JlmIPSm)SUbHhw7$QMZOkrADDU1Vsy%vsE3gd*=%F#+;oQPUES}BYZ zSt~~?g>lSUMP-$snZ#MJMb%ObW{sp?$^F;`F$3X*TI!gLs9xq?y&iPoOjJ~4RHSmY zFRhSHW=g=ZM>{u8*D3ACsC_AmJP}FEtZR{BgZF(6c!c`#2I@Q4e{UxuOM}SVv-FZ(Bm| zsE53NT;aq5r?)*WA>P?1>LITTS2%qWqhef6SKmI-iBS)E3%J6G?i1BF&K2J$COST< zm$jD_UasBCidQJWA3=79nSSDM?FQNyEWLYKdRY~Acx-%ZTwH9dJ&L`)xmTE))H~W4 z-8(VX7RBDj?UrPBMkT~Y$Hm6G5~3dRl5WLaOkz~uKCV77edBvaJ>;d`3J1#;Z;y|5 zB_wE-ErgYguLRX78z=%fu}>dx^N_c7yDK_k6A}{o_3f>t2vr9%aeN0=LlN5C5#PrZ z8=ue*+Wdj9>2_Cy0`^PPY`svX$0yY_^rHJl#m74Pxa@Y#+(K`_+_Kkn_p-vKP{TvN zs63OB1ZjG1vO3NsobLPM-9 zCB-j&PFrd2JD-d*21rsKzb?@IU65$%3ZEWcJW>AfYaqG54-(BA;4{7&E=p<;?S7Rp z;$DYOdvA=XAxcV&a(^Emrr_1Ln*q0jW8o4;$=Dz<0AnVkEI|}};17;WAq5z>Oe6;-a1Kg^5lJqyf6cpWR;qWTlWCJ{J3NO5eP#bO_ zr2P$;zWj1?J^W4n+}>D#d~}l~Uy_an2vH48QSNs>p$)VDEZ|Dq{1L92KfJf+1Hf#n zj-&k^dSU_nod(Qr)p6DQVgCFYNm2{=V8C+JmcIzVII82S`NMl7MsW=K!%&;Q$$*>l z5PzM3{~llta2zyGt^U3T%$bMyqi)g|bESsb^5+k@W*n>3i$;0F{-eLXfE!lbpW74o zF-O?nimUmPTEO`>&(f?$QquOmp6P=QD#>9@C3L}J1Kr( zm-Nj1;R7<@8nA+l;iKRyEVN7RsB!ROy&esvQId2>YAih=Etw}NzX_RX`MCwTqYI6l z20UiOd1-d$WVk%fXouGb!*#=Os^66}c#G{% zw)?&DzIAoHChWay&hiPpU$!kPLb6vSy}CBB&tcofm(9cKzS`S4wrDV1BR3>Jq-#uM zc4l#OTB>bWQsKDb&;bRJX}ulsqw<`w5t-p*6Z;fQOp8e`$O%grGBK`iVsPJy*%L!y zu9-KucgBQ4&Itqhk9uZs!rKYvyl8SLx=UX@Ij_i7)*%q4c_|^suA!eCc0~(tk@&x@O-u%z7D8 zOOM*7^=NG@s^_}D9rrAftNW?^-{7k-&sDnH6};Uw^R`F6A$nR5OT8kW=xNVdbbf_# z(T4T@mT7nV3VY4|wy5E>J5wk6PrK8zsO|k-Gw*p!cyz;e_wV0#l@1RY>zcX4XiK(@ zw2iP0PaZj9`|O)VXD)$?G^@P$hq(K@K^3$NGm3x^U+M?~(WIahn_>O#(#ojEcLnKt z=n6lz-Q2A&S{YYy)uT_D=Tuj4Mch28(91RZ+d{AS?w1PcZ1^77mlu@&2=%8e>{ttmsUUp zRa|ONQm3?{;*w8EtgfV=him3;ecb(Bu9=s0MQZ@3FKSY{tKxT$ic5Yab)rfp>Hy$z z*#IdXMZOikdq$OnyP#ZH3@Xru#aI`?cjF=>49-iXJFCv!yMG_&4sGG%DdF8GEaujb zLzGrD#h0!Mng&Rx((#vrDx&} z{}y+D2Q*r`Yu>D&X^=X4^k_qySrCEehZ@%Rg3m-0qRKCLlvjC2c~q9zbxOjt^Sw&!9>DvCfF*XlYvy*(xS7A{ zie7S+K8sz8<-t{&6_gU!eP_W4Pz{eSOVK5CKVRVG6%x^Qoc(s$=ik6YOZ-r zYt}#Bwr+%K@|5s~O%}u3hghtS5-U?;?LsSqyLLN*j7W+v1N6peL$9w0p;o}MK*<)`8 z@sw;3!^a80UID&wU+*bRf^Q?m7AmoimDnaFc3g>7DX{>^8qTCVCA^~<6+I=q8#9w) zc;6vY!~5VEZV1Hijxwk#19D$8?Uzxq!u>KP7$nkQ2z7%iSUS{9uFs#2V_i;vyx7>CS@erhKE3^{OVJd zcbG#$j#vEd6Xkb(LnJ_L!R59x*CD_}-TWSQEm7_M#9^SB-=3R?Hw;5SyZyG{3V=hR ztt@UUApQ1im`v1dHxEa(`vzHl*KK9J-@&wsuYw`%=Aqz&wsyPGa5&0u*UfKj?Y{Th zc5e@ka4_`H@ce8L4K&+Z0zL&ko>GVs!>ln|f)YzoVtGnzq7sAqCpqIaC59a-1wL#- zQe(6k>?-XHsZyEE2Gw~Ot2EB?t6Zz4yuz=Q*zl_yVhu?BNl)BD0koWEm@@7d4`lY=X;c`6|l zE8GY`Xuk>sRN%e{o1$6pVdxq+54GEV6LJl6wkSWCAUqq?iJHqcayz^^&f&pVS)i+&ZMiwPvRS z4>c)ol-Dq&0hNBETh2NX8dX^gOOJg~FEzK+liC)xmD;8orM5|Jq_&~0rM9{j68S3! z2!wL@7~#_nK6>~_(or|xaFZ)o(Km~sZ#&s^Ej^`{1DfUqrUaP4APvMX9y-Ar z;>e~8^pye&y`;c&Pbn}-F9pI&r2|hx5(HfBk%JK;%ma&|hkj%W3=VPidn&u|xp}%~ zep0hSZ>bryZL=g#sadFAYIcoz!xbhuv?U&vfyK}l?uh~2HLQ34?81_lHyDl4bj)YW z$bof4Jc`40>~2Phtxfw$Y$4iD!KG)2IG*k&wXZWe;L#RaTNFHIZW%kP*|dA7Zp<$0 zblnlXwdpEOa5rV< zy%gU$BU^tKIO%fH{TrKx&&Yf-CH|8xffJV>Ka_j&M9c1-cXy2avE;4q{_c8d_28+4 zKZ|{DO2Ee9<)N+CZl2lw)6;(*z5>~+Zy5E#)Z_)N54CPmlpFWc#fsyxF7cg zR4j!kxHUPiOJ@3#d7ira_p!F4MrWiJb}^Y2>U7h%1=d@-!0QaL-!Y5(3Mw|CUWdC! zF}Sau;)bNxZ4d$Qm-`9`de`e-=a{7hn;a?}dj$r08`=C6%o>jI1q=E zwo=~;RA0w8*Cry{G%U4-(oJANx z3zynet*vD!%9aFDmOSXAwrwYD}z7@Qsi^s;U~RZ_klCKVbwd z92-=v0|n1tQdw>JCPNrO3y(1v3nKKcWIyE@RyNKejGz^$u(0OwUCAmdk+TRRXyItV z-U|j1sb9i2ov)%blCuaSXkneJ<$Bhhd`)Fd=Pbeq&kn+=re25J0)|mdC;iS??#~V) zjF3Y-u2XaP>W|~<`zSelmunG5$RQqbs5$)Wr+tG})^5%sjF3axMwA@3S(UqnvD|Yg zZ%2~!EBL`N6$5kGmJK@G;=WJ8xvE}=rNdBnWYlh%18))GEX0VO5xy~$p6ybpYE9)V#E2{-SoF~PEVOFh4F*$QQPM`vLJYGV;}%4NAGdY< zwqSug^DPO}S*QXATPLT75+uWnL--peQp$A~97l62^`>}krI}O>t9q63gD&rYbGrYx z=c2$BAZljd9&5PcTfW;)O@bUHPe{!w%J{$Epe;L7Mc}Nod>vseiR?-k^|Dt@Zmr3T ztzK)U$*wh7zTk;Jt%j3%lgL*+X(wt^)ppZnyQOmn|LLA~wQ-;mv39HGUkgz!iz-BI z;aa_@kpG`AI_e$OH`-@tk}zYBrG$new283AE1Iyj2nr5#~-sjwjqroyhF4&89#%>GfUquZIJQb60|%&tPM9dOTF_SA2Ck#%nrPhR zX>~yn=$`_!fBpT@6%8W&KvGag#7@_SU%0bT2@c;Xc+ktFy9IsHLad- zV?f^mOfwpm!Fj_`5B3BwJ6(r1gOE2Yb8-d|S@AhjCoV5b- z5-TWgG;rw^khidc@|FVkX*u#JKk_Rm?2WU{x>@civ2kETp8Ao%aB`uQ3n zpZia&`WcZvF@l|+@;_eq!`3x;czeZ`(p+;$m+Vp%EWvO}|6C-4;T4H}cCK;uEciEB z@TGZsf}o6HcIl`+dy2nHKz6i=Lb~96ibFbLmkNcbX`%7<>=&_!q9gWJkBaC#0ygz0;JCjOJR| zQZYql14MJYJv$v}ipJj=wJ0t|3S#emei6E{nqg=tUKouJjilFI7Sd{Gi+rBRZv`Wm z@$uE!@J$0mU)?i`FB3jHqb*QqAHf&SXe$-p&x-Fdd|b-E3XKls=2F~V4~r#F<3r;e z(%m=-uR#B?OUIFtOq*RY;5Am*HmqdQ8|Tl5EMsE})~N&{V4lAnuj;UPCG)CX0wK>H zhNV7t^wY-JbF3v>sMoe<8+Pg{QD~RFX@dl$OF>$kJ#3#nJCN)Y$nx_5v(fC5DUr^k z0_$2oJLNFXEPK+O*|}3foH@QvSl7aQN@8Ri=G%sE?(<{_^9hG^jadONTJLrm8agPWpB>AqP(X4syW1tbFvm1=$^v^y6%ghH z+w+QGh!bQ85MYQM%n;Sd5SzInD#H*(0X)V@Q~@NTz01#OeFVJA&b03Ku)X$dqkZ-* zGRjVeB#d%vN`y0MCo{?~c4;58ls%~!MyUs*n3++OfTGGjGHdMgXpQAaIk(1o#RfF0 z^=^$gX+MfXT#mIeii9KYq9Hb?^$u|89ATH7QWa;H-DyK;y;RN=W*6kGGY%Ca%u!Of zsf1u9yPVmu$RiN*}EJ`8*GO>w5MJ2(|X&(4moKp+|O9-##ms# zZYfzW`Rg;WQpFglf2p2mS}BTHvt=!zwV~N)a!~es7%!?7Z#l}UQ%#Vq5v;`Z$9G%i zqaH_X9k@|{!P2tH1H3@TL9CaLpnsrV0>}Yt=JF~_KWu!9|_3UcsgQ)MwSNe_< zQ<^!G@~vyJEa<3R+ACVp45W#Y!a#urr1n(eNb>1+AxYK_9De`Q^*c7D2AZB41fwT8Zgi^VVJ=04)4-Vlp_jD9-fsLDDcIE`%s z87ECt$&TW{Ik}HGsbqrFi{2uc6~9h~^i_Ps{Vbz-<1R+1?Bd|zy19?IDT3a0yT-hi z!p(ieJ(+W32GDmTyl^zxCcED7aDCiI9Mc$0?}Z~?;ov^vc%@8^J_-l-5yw2v;l-X` zB2;#L;o&jlKH`3j(ezXNbyG$m5BvKgFOi=jFKMzbI?P8i6{Ci|zpoO}e>{BrIn%eI*|(nd49z6w8k4 z5ZB3l#PJ!U$xEMl8;@@M+4ud=&%OTD{<+OMeK6dfzR(vt9qx%?nfCc_MIl;->W}oqA9EdSIU)lSduw)a37~SNk3LGjR9UR}QZK z>y4Q4b;eXa^!Rf%FZWCSIc;Y8#mox}-t4+0E&H$M>n|BH@vB*TerUF8&Yqi%F^{pGv4=AS#i$jWVf^^d<_*%A8Y%%pw$4+ms_JbGvwTXeKxOo1F;|6bRP zx;9^ZCI8<#QX1LtT*rO#e;L1`FnNBT$B#UY1LeNBb`miJ%g-}36Wul{wy+;i9d ziH-?9rmufvP5(dIUkF;|9-k>en^!l;xp{m?qrdhYxsWz^_4W3xu6=K`uP!QHojPM& zfShCh$)#97$V!!8*QHN1MP|@b`3r>a`5`Cq2u&r-6+>mwpr_V~(4S3QHm@|M62nlN zM3^^UZ;r;-T@EenG3cq5(kLS5ix`M>$5dvR4)~^!w-@>~E{&n`ZP1SqnA10>LZrK# zDhxwy7KQk~I0Ub|+%c3Ls+`fCiqX=!W5_B7J-vV-7jWq2_|h2ap$vMtM$W6V?xoV0 zstmJ+zVT^wcHNNDm}(3|?GV`~ZE(@T(ikJdB;cD|#^_C(OJht3G3cp)#eH-I z6*+ZrpS;9OU8Xl&U}#YuPw5mvsjX0!3Q7%yLOYAd)ln$F2?{Ou<8tH$*y{4bx;#Kv zO~G^)6q7<3EGPzrGDT2=Kryf-fw2Kb0}I+^?-nq1wbK5uF5v$}^)x zMhXh$Hm7tH6l$ZiT$KNe(oR5hROYo5Ds@^4wJltZ93N`g7{%NcK5|r-IYy2l)k;Qb zE60ag0_~#3x}d1bkv?8={6Db^BUF^17B#R_IztQCT9^U2#8Di@pO1eIYl%f9L{ zE~=a4=0+#osH*5XD|9i8Mi*Z!ChPkA$gLwPm!1*?Cl-sjyp-gN#mEBWKA+k9Z}mda z#)3;M7IWFCPc4tS#O%qe)J&D@DZ#}snshzFxLnhvUPL@pa50P~U18h>dS5winF^oo6Q;jaN zp~}@$a50QV*Q1P!`dM-j)8}=pq3B8%TnwYp6$-4HU!y{6g{fR02rh=v=%Ri>E%T(S zj-qR~;9?k!uI8n5sa)3t7sF_DJyuGWx~#G;H4ktMqtVp@RBgIcuC9WMVKlm0GA`G$ zp)R={DYzI$qpOuh*RX%=5h~YQ!No8dU11tsYuY~;SxvDaZk}e2VKlm0YjpLh)U~O~ zbwqG6j7C=*#^qXzD!?^Ruu2DF}}a^(pw zhS4nHG&8QZ_4v`a3*eB~B+@Bdr7lh5w@HW#6=Wp6CQVGiZ8V7!M@&c_mB_CA)C6)i z*DKi=4<~1gP%mI}A*YRaK5=AbN(zom@E{AZ^F*GQIbOY`$wkx|9;Pg_~YLZYw}tP*kM6%V442nW=zzXJ(<^nLQP+GNgHi|JTH`((66K zo>Xua?`pIq*1K#soOgkxO1O8KrJ>%%x>gGB5;Z9A!d$A5cUi6=@1oSo!T&c?MNmyx+Cs9hbqP7(Ld`S--209-F^@O=YggCa17A1$2 zyMDQSctc7da315bMUgPsD+rgCsJ z1Uv?efo755yy>Oeg{uM+D@J)Vp7x|S8MriHj?&XNoHtw{!b*TCsKH=f^)5j00boYZ z6F;1{_z`X#F!#&BkvS@11YT2&!oA5O+#|q*m4jOXTzi3mmpM;%nTwF0fa@pbm*{EQ z6Rrp7qk;LV99%eX+kp8;;Jl@S^7jESkI|e3oHyJ_1VjL1q*(!1oXaCS(W$uC6BznW z&fB`nX23-VER|DF>ylAabiFGmFA=zL<;bJ>Wmiz%Tflu-jyxLtZ>^xb0^kl+K;E?q z%DW3(C7N%6^JYIPdXECr(H-Y9X+r#DmjS?xaL2jjFXhK{U|x5}d64%dFyFi5JjgpL zFcc4R-pb1b;I5Y=F9iJ6F`E=YGfHrZT|C6EH!wroaUS9~6_{*yoCkTI1M{sr&P^WK z`GCN%2;$3IdVdG*QaSP{e=B1itO3o1!IhQXPQcjQac=RW{7nKT-5uv4y$gYP&mHGM z-e!Se5yY3b^zH%fXgTsIy*GiWLbG^qWu^BqV9f3~5Ao{*%m{a!hxASdMsmlw$)osv zAuue0`0|$CEx_$6M;_(Jg$l~M4V;1IDd7~mxW$j!t0n@&fcWwjzm~wYFGn7g=YAEG zmk8Xra^z9`vMVTWA#m@NBaiZ9GcfzyaUSybZ(#1ajTZN@byCI+ zdTW>54AaK5c73fJX-0=Q|;R5?9NUYUoz7V;wgT^Y@AoTt6hi~gB4u_eL87g>vh zWMB!}kZ@YLev+*KWJfM4O8`l93>S~3ovqm#I@%Z@IppmWV)Mf$3sA~>eYRqb9z`B! zywpi?UkmtXI$1|z>-}j*huYBltMXIQRo{$ z!uQLlevk;MyT4s;K=JI<#c0cOvPuXOsws$vU|u+PD89?^@e)v(o{{iR)Kr%fHp$o) zD)zM4)tG>qkE-S%Ys2{WV0mNp7|JPBV_^e&9;7S~Hh9s+?ARJ4S6bujGr+l+U2yLK zRaiS-HnxkMD>FM6HFq&`eT|XHT5@#?hM8VQ(-4w%r&7ik)ay|j-==o#SyIcaR?}`6 zh$XbH#>c6fAxuEg4rctA&=yE?2xVbT6j~o_gp$*c*@SkYw1DAZ_Kd|FDL0C$a@y@< z4RW(izfI+M5LM>kRDS3XVGB;l8;L}^XNDiLfM-T?O=f6T_$p=o4z-dY709qDxUngQ*mgmiDY^q2Yw5 zeG{Zz#?yYTNPpv7dDv)FB4R4S`YSPGn^9=_)+Kz{;ZITc_0=&t&9=DFX(JGAz1i&u z+hxbTj%m|zW@HuHtX)&;VQoJhIqfL%!9ELn*nUSB6BX0t`PQs6)2&!6ops0Xd@Qzp z*t-3;R8!!8-^A82{O;Pisc(sSV_a$YaH7v zvi`2zb{D&k0ca;4E4ni}`6vcfh}^*Y!~meO+?t|x)}{6I=pZ6l=3>!33$yDRb91vD zeoU@v*Hok}93M1#S(gW)ZKHFm?N(!ToU9uYYKg(QlISO5ATo!&A7)J-f-R<*nFk{ht4SUHpm;u|j z>f+p2Yv-ND*_1fDI3yg1QK3`tJw7zm*w})7j?d)!g8Hm3ZEZJk+nA6VePyk)1UB|&RLNt0(^YH8-$`Nyi@Zr=h8{rV`ziRa4NQgoba(xkjSNBP{#|0KEPKO zfc4w~ZT+Yi>lVNA|5?#^S?M%YCHnWkzd4y8#aS>Wtf~>H_*>^+mft&@u7AzI8g9G~hfmlH@*` zgW=qSI)wTsJ5PG3o~bF91||)l{w#8>I0`@yl@(5ALHp<{X5YhL7w#$)@%|O{pwbt6$Z?<&w;~ zvQYeblKU=`tFP*(tJ*F=SG8@G)0I>Gh7;3#`V!8GU!KR@N9p;9(O7D4RAD%ogF-nj zNbyl>IR~MhaIrr}QcAdwxL4q#rj|I!X)zof1Ui>XGU@f0?0C4A=PLvvUu*m8YG+i{ z)gBe3tBo>QJFWU@;-Z&kvWtU)tMTl6wr&MD29xRsLXF_*WD|P#$m}rSv4D z>C4#bLobtMM?)iSUG5_Z=NV1jxs!Y`c;@WA<9n~#G{VQ8y5r5gEwA){*l)-2;m^fS z{5_{?153Xy$DX@gC$u>09dFb#-IlSg?7cMWF(DK>~r(R2{xqVzx zn|Y&)TU>wtX1}bSLkG4^y!*v#>3x4(p^G}u;f*SbE=)hz_WiU6_T$Z7tbg#!?Wn@Gv0Z0(6TE-t}nk7F=v02?Oua~tHVAyQT4<3 zd$01d+k;A)&iQqH`mSb=ojB8NM%4jh?i4q1zWC0sOHMzN^vN5iUpapDo9VY=_qD3| zVExuVKaOAe$lzY9LT~5S9u__6s|zo8lhgk}e9`1ph3h|<@bsxhhe|r1G`F6@F?ZHEz+dTRI<-(TOC`%3RH zqPj(xb>U}=OJgb_#Gt1(kTCbcQkIv-_%Tdd`o`yG*v^)vG1O-o^nCP(W23?byyv{&sa~OaQ}Bi%*z`d>AN)lbu9>_3-_@tZe^tX*o1&YS7b|jN}Ze_QwhC`|s}_dIWN~lXu6o7ys3rFEs8Wr|t|& zzG9;(&saekcyY52TEGV>thAfPu`UFMY(Q`*o)SXH-De-XXKA`r3 zqV7V96%=*XPokixJB+3Zin=dpv7o3sgT56Mb*IuVf}-wADiIXg@kDhNmg0%QKcaX% zEIgteLt>EjWw*;Zp<`!)SETS`Jm$D?_8d zP`R=N7sF_D)mOMkSF@j=Zlf*{HfGT`Jch!No8dT@4u*we94dyY$#+ z>i(2_f{S4^x~P_`x^Cp2rh=v=n7$6tPO%x` zjElAZ@D*GO{!HcCFSr;+qw7(Pu3(+1pUQPZa50QVSE!;39^I55Ui?DcyA(_vDjdUT zbTtE2wc)k*Gn^_{l;C0*jV^j3Fz7?*8=tMOzrR=I8Yj3IMx*O7!n0aQT%Dhg4yjy= z1sB6;bhThyvJD@}c=V>ql_$6uMxzTu85dpM6P$@E*JZ)QFdAL06fSslXKizEd8S+r z zxEMyG>v6^<+ptyK(lC{4zTjdQjjks&x;9vToT75A6kH6W(G{-ff=3s;eDXGR|5u^l zVi=9C2#v0{7A*2rx&9Db45QISeFEQ6NF^#i_3l8GOHW+~9K&dIQNN+)*Aq`)KBsau z7F-OY(M261zaoQlO?@GMi^|nia50QV7maaLU44!$s;P1f5nK$T(ba)*QQ08p@2gKx zFHe{%xEMyGi#knJ*SJroJ*9HJBe)nwql@}p_397mztsJebO|>(hSBJvK3vuH(Z4$% zQMt|tE{4(Q>dd(0c7EK({72ONdX=bShhrFxt}dXex^(?77N}gU1Q)|-bUmqXkyPp{ z)ypn=2`+}w=<2F)Q7%9E@Av~M*A&6UFdAJ?F)le>)PJehJA5d(7)GP3n?@J)Un5F^qbOCyD+CqI{o3j&f8C#7g3rUbAvC^T`-NE=X*kDE(q0n5CoR~Dy^NvDF6U$Ri zJCf8uPdkxVsFIsr`Bg-@Lbzqil_X%^#JMEfQINgez8?T2bx$t@m zEhEBZ*JH>oqXxS-rJmAW3gam*ZtbQ=BbLHcKoD=DJw{90&h9Q~YR&8_oxlBUa4oMTan$j>fH??ANn<=|5Apmh_NA@mdumx7Ncy+1-x0-k7V(~~Bg zH@){@zsA7SvoIK@sy)l=2l@bDR^UU99$%PVw_P&yptsYa)BTDMInwKGm&|#KPFIW% zIg-b4Zt_}yUd^i0b-;(5f@AfJ)99O~I{O1N+#Tm8kK*?-FmJfyJjh!E%n$B3H+hu5 zzXJ1@JI;eV|0ukSz=xcY4mWvJkJ<_h1LDh@{W=5Jy&QRz-ci6zamRUx-(p}sa>u#F zkEYObf%(lH=Rw{*VEm$aD!iqa>=z15J9nH1d3}L-#vSJtKaw{MnECEF5As$5v%wwb zCXbq_!ve!o;yphu19zt!c~nm8P-EfZyyb6G;2sxP1Mr^eM+oRnV8*-SJf!zkU>3XM z+|o8!$)QaUSH|AdDR!I3*o!@+f|dfO*^<=Ruwmm_hD15Ar4hGshk0LEb08 ztZ~PAkhfQ0SVHjSt$jHO++XF$qxRn4fi@Z+a*AC%#4ie%UhX&#@f#1!GAeMvPb{UvB^_?^sC^C*7zV_bH+ijri!4VT*>7M4<)s1l zas}kQTS0jnf!ppb&ux59%L>kxl4r5F-o8wB@WdF_o4_di{IK2>$B{ z=Yya|rEuY;;z#mAO5r@~?NC9Svx2yh6~s-cAnvsa;HVw?q!bR%Wp4RPxOJXzZo9`% z!_eE^aQ}nd<13+dyiQL~ZMx{rLkFZ|YJBL}i7AtY#$~3DO&S_!>)XRNv}e!wgkD3P zy$1D*>6zHSci+CYUj2uTA3Jg=J%eHvVB*B&@k5hRQ-_Ys96Ns0&^X+T+~3*n@lj*b zhW1S!pNy+~hmJ@aJK}%7ahyM=P-KNmn)dvQ|BRcoBV0c^?BUT>lXt(e>!o{7_bC4I z@JC<2`$<~vcmKZGyhFF!KehYxk895zi>U2e@MwPU;!4XZ*O+m(=&^4yt7NsV-(ce4 z<$b#x`L^Y`Cua3Kp!+-I!P+6u?)kA(taH%5{a07skB&3Xw%zra9{=PAEBbtFdHs#| zB5(e%;nyanlIsV54yt)MaY;BDFC{;g@N1@pRJ*;wo3Gl3^gx9uF@ z@CzNf?a=Cx3*S0F^+I9C2|2&?`eOXR8-FFg@Rk3jDa{^l_}RLh7k|%a+;fZcYU)$# zQ|yLY)kd^W_i=NTw%DIWR(-bnlX234XYP&Kvu??cVLv?oxZzN}r}G~1vyK~3ymahe?*@OBbn3!p zU3$v>#m?F1J6Ex-G+r?kwV8gS zwtFo)X8XxYd-}h)sO@Ll9_@O?`Bq@mz5HJOkAIlb;&|vclZSldm>?Z!mUidXs5xWa zu5E{1%DB$+_L6tUsYxCRRy3y;q zyBU4*zTRTc*L-zc=Y`d+y+{A{*OGts?JZvSXZqsR8BH&I*?#ufyB#k!%se%*$F=&; zJ<@VV_N4DdR$CeTV}l0+pX#~u;M9<1CvqQ7`FZe-#=oyH&#PPzv9^Zk>BnYVP8{B6 z`WN-q$5w6g#|t04x$E7l%TITS`>NH=HHAf+pUmpFbVS`S-#8?3#|%h$e%{iRn}7QKO3BgS`$txda;CrcMPipfZFQ$Kk9jw^(uoTz zn|(57Z}ZOYPrVy6z z6mD$P=E1>!@OS_iELqUo@ZD?%t^nzKQ5_X;k8-OuclX zcI0|(@>%4x6#y z(K)}=x|Dw*?dg+m{9fIsWR?H;MtwWKI^)?tn_L_4@4=iO+MQYT;yY2%t&V+j_4|pB zuI&~u5fy9pF9G{~cHGkc_=lrgb*W>>A6-5_QaiGp-fjz(+eVKtlS zK6_=he%gq2?Fzozy?FMgrsw7~itA~8?smPf8;<^q4yKQ2Im$RRZtfQ!)l6|NviF!a z@u!fQPvmsXZ5JG=AYcNgK}c0SJ5qQ|Bv*2*ZC25QZF|O zJmDXfa?jG{_%@#(!-H&f4=i3A=RC7|*h?2HE#KNOp|F2^{aeNlYb`nZv8~?84+p-# z@Q?LBef7lktsib(l4yJGhID4(i1yv{{YMU6@o?a~^)|h5eR9CW1AA{ASlaxlrSF}r z<=TRd?agfbcK>Vh-aHlVGrsNOlv;J0)RmUzet7Mh;<1)y-ChjO zKKpUC70-TL`1;e9;=xC+SdZ51u{mwTIr}xS2VF7OU*Rn5ELBJqwD z7gF&EE)o&X7co5RB5^-pkZ7HGx5%Q zKa_S`&De>H;|GkpfX{w1)MkF(7Z7%ahs|7UH5M|t|CkGH*p=>UHTU+nns-^T;~SCd z5fo$IW;5s8u=hKNcHUZtS%t-x8s7oTHv`{QnQsBU>7mKMcHD8? z5BSeI@;R;q#iJ}%DzAICkT;N~j0RSJ%sv7laZX2($_A=dw2 zQ&`pe|25@5T~l}|rkcV_@eHN3Q%&KeeFc0RM>U1xsHX7JPBn$&sHSin)fA4Sn!<5Z zQ#g)l3dd1R;W(-(97i>U<17QL{c-j~B(B6pr-8dhCs*D02_4aa`wFc?hvi#u^g>ns9cDY4U|l^cZUoJAmUoOvbEAq$KN}zwwoQ#G6yAlRd{~bmsWBbavVQd{ui+ z52FJIAY`p2rmTCGv`nY8&H6pbux6d^78h2C6DUkLm+HE4lBF05E$}!E#rUojY|pV+ zj0uI;jnnOGC_I;i?KdXu2PvNZS@4I2gEGl-nuVVhq|=TryV6$RyaxZYaNICz-AGDt zf`dKBw^Pc3>&BN6p*(;51{t8pA6zNMBlbIvE`@1lDRJqoIg1^Ma^kR|#<&mI^&}GC zn&D&`Jv*KYQ7?djcH&cHGFH#jIkK+kjk6a&EGaRzfY~n%ZcI{BQ)ll_!K#;gHKo-~9H zc@b{U>5V)Iigb3#qde(_JlSQ;dPsSa6GtH}v?1q3ZW&)$LN-IE#x&rh7Ub9gXHE|s z9(K|xJ#-on#U9p&P_W*mP&sDMkh9yUACZdS1Ycl4s5Hp&hzyLv)-Qdmp=0{!KEW| zg)y4^c!pEPQ>NQQrbi&t=@_hVs(m<3gDNG)Bk@l7#^6XGQNwc(%MSSX>V8C><~~cm z1nMr)Ftmu1F5&Pt-ZmKLUINe|Awl<%!N1`TYYeu*!zw+s2&nX#gGmP}{JPK?EC@Hb zJHu|#C?kQ{i%ZGp`JrW+=WBM6NQ@!OE)?D2j_hGN zW|kH-+DXJEtD+&4|ED1>+&>ko)ANR4--cnb>+=SuE6*GJ`GE1# zLy6nt0jJ+lpAMK%8a&f=;q386s1Z*^;`xR1T~wZl*aHkAB}XzBM$eOkn;I6gorgI70(uUUVy6k3~n|58iN5no;|EMeJVyem3P4u zW4=xH5^8TD+@8bMf=KyRX_wWU%N{#or2Xtk!J7A%Kgs1K~=|RDK&1&Awo;;W&{`kQXN>67b0go%vZkyRwiyk{-%sc1-?KC~H zNV!&XTtl*PjQP0L2+V+x81q4->jx3l?h0) zIgjx{)&cxOJ~0kZjT`oG0!stIcH>rZ#A`Jp(Bt4GJa`{K5mUG>F)EX#p&B>r<}fbn z5`@R00YTNYciCf{^OG;CkaUh}?HEVaj>rX4u~bM8h=0;^CC{h4KmEUTs6;1LkWL`)u95$n18iO`%rKwM}KA|;20i7|1g<%K=K)raZil- z1k1<$F_gEqVjDekqEuca7Axb(x0(xVQZc3JjLC|~AT}`=;IXIc5{SRxk4VOt3u4UI zBr>fv?}|UN1*H~o2AGNz3J*&_3BrK}1&^;NmX}#QKv5lbhpK`N5r$}U+zm6Lc2YWE zlk$0`cIMQkJVa4@mxf+A3yYTrdJd<0Q=N!0cpw*zg*zRM1r<}qOL3r5PUTTF80$oU zXx3n6MJOJ#JS>ww7otoa*;^0WulfHIz?7ilubp-0>2#1LwX z`M4u1-$yi9PO5c0rzqzmxOwixlXif55RpK+l z@m`vhc<+dhep81_1fX%dIu{wIt4mlQ!SJM zdb-l(6Ax88U!D1&b)!PB0#XbkQ#T(>L-GMQ<}zn>sD&nHW?s&P1iJ*I;K#h(o;`aF zaY&a6VnW*?2+s@7(0EzoMS@wk&cL@b`;$2VV0nJ0IV(r!^bSdaNcL zvgc6D`C*?iXiIpv%A_)BbR;Pb3T2(GO0_59*>)>2+Vf8P+6_2>lVDvc8)sXPMfA^N z@6yBHI2$)#>PQt%GgcK1>$?PD~t7};}X&miuN)GE_~sx6#3ajAH0 zPh}~vN=H(RR4ovJ>I_M3V+i~UIB7Y4crud;gpiyd3pJPGjgdWvGG1pl;1yEN4Dv}w z7z5_*X46RVzhPu;-0AqxQt@W#af>=V;(Cg@9B&pqhjdtpUKR)QzXiK;z!B~a|z{vTLQFZ7f0#aOZL+2MGa>T<=Ft9 zZ!8Ju^L#tDjd>(>9(`tYW!5h#ke|VCWo~yQZI=^Y@l30W_LmaXz%@k`PoOhrJw;?I zOXZ1jQz_3mcu1ddLp99H&=d`&&-q9ypH`96SCYA19xJla;GpR+md8p4JJCs%%06q! zc57CF#X7Tu*SjvB^SH$N1Ephu$lt@R*04$2OXqJwu9+oQAj6XvJJ}6%#Gf z<%u~=R8F6vXEQFlFoPR_Gqdy=J@Z_(@-=l9aoxdl+Z8WtIk5{lrNsPP4LxZwDa(_ z!N*r;fFV0FS_AmFwx;ma0?nXn2VXP`wZq5b7Y84Y-$3{%Rld3*3N0Bvu6GiAJmr(& z<9a`UFPw4w2p`u==Rt8D7vSSMF2l!lR6$e9Q(g@|P78*Qr#uY4#!Ozg651I)9)lS8 zc*=Xi$73)YKA!T$@bUbhbCGz;kHSaeA%pG`e9jOOi%ctn9m|ESh=S3TOWZ7XPH-{MFo*@7_pDGVRi{OZ8$KhwV4k(@QTN2*eON` zQv3r44tJOA5Af2dINSaJZ}v>q?D!x@$u21#vqE-Lw!IhxlN5gg|7vC1Z{S}oDISma z_TX&$9sCQ9>vCY)`YlkbvqU~_oD&Qm4gGPi0`6g<7Y24`&g6z{#3McPpk#+l>W(EI zcWhEGNWo$ezqp*qCg~WaP1sBeX8G{Q&nInYnuTUkq&=ATz=WA}0F!Tcm}YasCO+SW z$th)$_<*zri%u|MOY?eIwu1F1R?G?*LE0uAz-$kcm=75D#h8y;&D*Sa%E<11S=!B~ zTa?KbnpvaiJ@X+<=3v7OfaNT?=G~Y&%oL<37aW(H&4-ACGKx ztvQw%1-94wOw0SO!1m^2O#>F;!hizXl7}@{T`aJ@b8p$i(*?E2$X31Qu|`Wsf_SZ964J1;u5j z@6WcKi_3no5Z(9%h{#3k(}JWZQ?~7b6jdwRRsE&3Jb{6T_ob|0=S1txx3cczejVHE03S6*;~{9k1zd5J z6L*`yEM2qD(3Xn5&G)dgqvOLK9((2uYI z{`aV5&$bmfb4K^K=gd6}5sC&>Hm(L9wk|)4HQ9A8<#V% z*l8&I#t?`3GU=gJdO8TRfzk=82Pj}wQR93cZkury_qU)12F*0?q6y!c*1-H2={OZO z%Y*1_-xl_)tNKjL=1tgYU1Ok0r;s@5SI8qV%G+1#!`!%>A->ibrwwezPO3FC$G3rT zx3pXOHSbd6z(ONtoO?o^v!R6v+-sApzTfCkF_^TI4(S02l-~wpM)DC7SUP?NYhZ4S zlt=N4eh`&CtMLr7L{^bLbB|5Zw>=1nc-Ia7#&J1)OYtALsIo^9d)-{HJBa-!r<4p! z#~pP@1>YE8M|zV;gL^k+t5nL_KWd-z#_MoEY|`SjKfeL z@gsZn)z~Xq7z}S36pO`@#cFX0Ke<@!2$HC^KeJcq^yXc3u~!tN#k6|BQVaX*+vXz4 z`w$^+GdKHl`{jnBc;Ky6t!&E71DC9USn0Qoa#O^ON!#zpD)4b+?F_MJO_+;i6chd} zDT$F#m|;$*^h4-=7`g318eSfQ&xwmWPP5-nLa9Q~xRTmzM8hTjYsTd`l>C#NvoG-S zSyjzID`lXO>b4z=H!^V($GXsBk_WAuEby?}hO4nE@psEoTwP@-J99fVbBV+9X_UZ6 zuMHrG&fxOZ#lUA_zOf4JC@LiH{Vv1Ddq4hODZ9UT1MI|WrjULE>E0T&vv=(|c!BJ4 zL7sGs#m8pe#h&)rYMw)OiC;m5Ioa^UXNKgrgxV*WYEp*H<%muXe0OEOdW|sb&^Ojq zO7)EgL6?gU&7oQGG2nwes_dJ8+3>>;QRhB?{O`?ZP1*$M+T5tGYkt0guHoT^x*FRb z(fN;Rr1Nd}C}WkSG{is78>09^;p0*WwSd|w;XLUZfH1mB0L>fZlapmrY&Zv{fct2$ z&t;R`Q{~7W0E|+A|zJ1wwit`8r;(&WUADv%YpW%e0gH~nN9Ug8~ z?jtRu8I2v|-ydTmIGKY&IgV1veUwVhL8ztp$j+1O2?#_gjea`g`6{}A3>>i5&X38L zIY}PptflyZ;p3cyT8m;VJ5M^&5y&m+8Y40jM{85T<&w;e<;b0?$R+KvO}xqFHX)g8 zwvbrhJjItDC6Pmo0(6aVfkdMk^^1c~*V$hyw?=C9;U-oy=!^;3^USW(4UT85O9jhHE=2ooCZ$tlknUQ77 z8{e)m@fK$;mt@{4M=nh@a9faSvIjYDa(VudOnM-dou~MIjX;!7es$0OO1ZeYC!FKW zG8=v!3`L^2&mX?^jMjv%zB!Mhn^D5Z$y}7@9831&J}PaTi%`Ark)0>`n-M5-seb^I zD|3)`&Y{)9ISBQRELcHm@@Egleq>cN?PNx{HNkczf!y8p~HO}J@@=^2v$VVCUOJ$1VsZ4PnwP2i+ zDLW4Dw&}adURB@E4M()RDqVM-8GursBYN)eLcw)RDm7f=4g|itCO$(Dc!&JW{vfs3Y?~fYL zV&3=d_BEaGsei)tMRni%VSnW9vuAWAXM3%9Vdb~Ye))XP_7R^i85z>&xoyvFs{BH$ z`;qIX9($(IH+7~KWtKFK+q?0tZNc5o9J{?a?)3rVHotpq%g}?nJA@8OZaeD!@I`Bl zOaDFk&3m&S-*NL|<5#2B4xI9F%wN@?jPTEOzFBMksCVAD(5}tBcmD3u@6=D-Uab0k zv0qlBk$tx8yz$-(gLi)V(YGVty?)a^`TjH8YP5R$6N7DM=kv4wJ~X^Wp#O+jN3Kpg z7WVCy1=hm-&1zQr(AlQW-x29cH${H)$gCY-2Yk`6^1Ny@pJ^3f?0$LZ>dUn+S1PF1 z{KYm)7v?O^fA7TJ)5A>PHkjArorPWU{MR^3UbV0JBlqLxH)|El&p2Sbb9-6-q@q4= zzC3f`--CW1Sk!fEiw?0@Hox1Y@ae6M=X}>>#l`U#w`H!GRe59WKQ}d)^IEUQ({itb zzP$76C1ZZ>bG~+~^vJE(8&wM2>-X27vpLWGxz;&8eb3Qj-JgFY?T?`^Kl4G%sM_~* z#aH{?kNNE66H%Ef{&`{Pb>9W=Pfh(Y?fFM1f3!Dv*IRqXwL5U}XwP?^DsbK~^ggoU z{x`!Dp8VVJ{{B6)zG#2-?GufvHfpnDPnY*9%{@AQ#IjoPuiNIlQS-GG=hAd%FE+5v z>wUB8s=w0f20!$DuKSUC>uVki2>I>Sunn_&Y#;RgM{T~EpkFzy&FIBVqQ?%J_xz4I zJ!|fIwx^Vq_|NW7_deUFD%`r8x-3D&u0IY`pb`7BSR;z-MZ2;J+(0Chg#9g54^Cd4XQA6|H-R~ zHp)tsU)R$QXxL=X&+y}cvlbPsQDAIzME@8@M`s8mrjLv;xl`KGG_wn4Y zIp!PRd5}ZByFp)7V7e|`_;zVI6l%~@?@amC3fBFfEdhyQ$L8+o}%@UNV3gsO^@l`15leny_P+)Wn zlbVK8r^(Q8CWY&?z|hr1WEq?VBq)^>${j)BatKp}3K?^xtMo-gprj{Ll~XXG&R!Ab z4*Wmm7rWHQ+@2HI3tL8M7cMAN4jCmPLXfBya7;Uap)$`XrLP@o+fi^)8Dkisn~!m| z7YI@9-vTdrPGxvYYVVKj%)*JNBR=o_EC zUC;lfat#+;45QIiOQWmNcWnl#Tr&k1!)SEXW?Y<(HsQveTPoK_f{S4^y6R|jbzPfr zTjk0ZTnwYpRhMzGS_a>;gpKhk*LlIkFdAL-Y@yolwVSnlRjx|BIO-TiqpKd{qTDB! zaQB-Jsww%^TyQarMi%w5j7zqmY2dzZRIX&f#V{IOG}oi* z>ap_l5tVC>;9?k!u16Rbr|WcQ<_ub zXmqi5M!AIP*541zDpzG1p1|?8=y8{m+**RFUbHi;`1=tm*JFZH4AfuH!1# z=Yor2G`b$w=vuLT^G%hjKyWdPM%NRXbQND4jrjoq)?E-DhSBH>*XX*@vo01;%UqRd za0ACM8eI{fs+Sd=T-|=0%JrDwVi=9Cwv0>8ui3v>!SZfdR}aC(FdAJn9#=0Ay4_Nm zr(X9mT5vIpMprwHuJ`*#1*%-xf{S4^x@dG@(DU{mGeqxJ8mDrt6kH6W(M27-T9?Dx zEl*UreimE|qtVroamnp`R<|qPsa(Z^i(xdnA~m`kKW$v4a@C{(3mn5}baet%&98!! zxBpbRItVU?(dg>Txa9l_`}L1eDi^KMC&w@vU0py`>vHqhw3#Z`G{MC%8eKFGuG;Xx zeamu{>jS~XFdAK58JAp_3&OwoUFF&)xEMyG>nV+{!Y%V(Q@Q>STnwYp#b(g-vaYlr zYk#A1`HP_epJjX8$WB3s*7m6fv45QIyV_dQg z3qCC#p>pjJTnwYp)m@`2=<8E>Cn>iZMS_cAG`e~)t`_*#2zg!0B|~f+8{zPj;>|LcN(B8u^nuV$T0sC!T3>4z7?x7%f*kD14rT zxNdy5{+h}a8bCD6GT@`->H~_(b!+Rpfht!w!9^G?S6{{@$MD0#^dyyQu;3z$ma8A* z^1(N`S1(?@r*bV4T!hhb^#{eEmvtRIwftw5>kGj}7%kTT4cGEenjw=lpA%e!(Q*yc za5=JS=U0rMHnsD(;BX3 zt*_lux%LPy!f;8Is1p;8Q>tqyuBC1;aO!yD-kcV9WGOn`qk@Yt+V~97aIFsv2~)XZ z1s7q!<#LkiP{wsyPA>j&_Z&Fn`=Ulp&A`QGX`_oV{K+ z$Ko`0;#d{RD0K6S!pta`%t5MfRa}xsI^N!B=}Bo*Q*pCg(nwEaq`)INWn@I#NRJ^I zX2(_(@44#wVs{j2b&Bkxy|YPD;%fJ85D%0!JjJ;nurJBNJ0H5%oj? zOPVxc!la3blT*Z$7*F)1#3^!KrX(|eVq%Ye_7M|DjZaRC9+R9jjszqpWu}eIn3|YG zgv6vtlg5orE`4Pin-W)T=6+R>doaJUr@eZ&mOFqAVM5CQa0wmClTZeLOXyghgfal` zHz>Izf(l3(Mqt4_0xnlzdFC$zz$LicX69K!82~Q9<>oTa63PH@37&Jx#R_ErJeg6g zPoAvk66&3qYMpmx7V6P{T(}FjoB3SAJzCEtoR?xZ_3R%Uy6(fJGEEGRlN-DQ!I_L?fk4 z2$$lyxM-x53E@&a7aEO}G9g@wTdnhCmogz-isu5PiA$M~GO`&RT^V^yp*#wn?XGfr z59j=zEw1u=5BC&#wLA6{d6!VZEV^9*mj8)B*UnfVG$aj-_tP2}Cv{8g%?APfFhCnI zI@!`KqFcAJ1`8HTCrc+CFwvI8@TeY^ct=!sd#|`yOSksj+S9U{Zk@2Mrdy|Oq0!w( zffgF=z-S0RvE9tw+FNAKjy;?`9F876qAh&cO}7qeP;8VfDmK1{)xuZexCB98jIC#P zM-ON3GW4PQD5WpLW{Zopc6ao&XvM|$wD*XOigUP#!xElyqmPJm?-AFdM^9&b8JwOX zLY%#AadGzUJzP1vmv1s~#zx1-#l%HNmBHynXOCX7_SjfkFIUd~eJhgAo>9^E9?>x{ zoRY!OZk!sOiHVL0C`eJbHbFBEUdSlXB4z(}wWQQ9LjHKWT-`FigI1SK=f*OW;!R{ zLdZBz_v)_}Kodi6+arK++d{_6=h96^4V5KEy+ zF*uqD@r0w9#SH>OIC7qFG^2GBxF@SK2zz(Ka4v6KD1`J378s7ydA&DhByba5VlAxA}w#c%SY@fjn> zGa7wSQLzY&LacAn%yto-vNpyI$K-j?8xP!2cfD@uAUnTML3ytL_gXpfD1NIeC~qTh z+uh}jOizah#RV%q)iXn9$#tEjppZg*&bsNPV{_03JP~8-ZXMw4?{q|UZi=tyxc*JG z#NN)BUe-8UzosFS4cG8lh0lcl$bB=(=@ZBP&o7)YngUXcoloWIaazNH6l3b?5@W)d z6l3~5Ut{$u#)PvV|BAo&eT@m{)Zfmhw)+5FSc2f+1o1D4fmRs z8Ki}=A<+yaSW>;RG*Gl?Sr*PfG4smRLE#cwMBElGaN)`qVR^=ce8hX^a)jm6(Yr>I z51o~bBYpM%7)`OJe~i@~CY&RD2Iosxp?utqvXXw6GV?eTT^wLcXlYEiB*YcTzsBlg zgAsg_ipbB#gd2h<{Q)teND$#3{GCtjL{XaFF4QjhhT5~OEx>dPGJiKF95*JAbx{-( zel=Eq8bu(rh{WwNCR~xlJrv@Iz{TwVWqNB_9Oct#h&zX3&5APMyE%H%bVM!ccKItNgtkERkg-8 zVOKP{@J>1mThBZV!BpOId65tZG)s!*UAc&(7##UlqX|2`tvHHVZ!IY_CdACdG3+=W zKgV|_4nl8jo1L4{z;z3HiZSves!OiPnw49Uc@2M0VTX8iy*W3ZutpGm(}w>phg$~N zrOUJn+qfahh;t-xG{pXSHaeo!g1@_r)#Fajvz zEdB<~vmK(p_&tZef%9yK*_8}L!=Lk@1XTxUt4Ho?ViNF5yY)9!Y zelOr}<$1Pa^cTMu@%MkV_Z{$26OLmjpunW6@Kqx8% z2mwM#VhTl2f+3pqvWSYENALkVVtF)Tc{HI&0HrEjKtvz}B^2qB?|)`)*}K^Q-}ijw zeSg1iAbZa}bIQz_cIMuhJHbVEeBim*f@?W$gNp12=@!>BxHS~n@!8;F3$7Ko)fd?h z(=D!Naa*g%{tMmW`Uh@xMfM|fi|e1JVjz#Au*On`QAU}2itOib!SI>sK87C*c)e}p zKJ~Wk3d4u}fua)IkLJ|dR^EVjC$FUjXhZL_=)OUpmvsO{S3>nXF9ejQ69CJW&D;c2mCy zg4El3MOMvyXpt3a)%dzaR=w|iNRbu&nHpcG$QtB(Z!EF~``*_svLdlhloVMhBP<1) z_@E*yToYBEp~xEId#^9D*7d!wRb&nIz1J04>(PCYwLUJD?9hrLtBJlNFqWJmBmcl9 zK9x~elGn?DPuR01;^r-;e|qjE*WV$wjP$T&2cCK~Gx9X1`HY9nlljUvTC2gOSPM&N z%o9v6mOz1V15M%w;g8mz<7fj0byT2O1?sLqeF3@fXJDUBAYLQ8=Qw97J`#P*0C$Z} zEh(u)r=fG`*W~q>3m4djd2#7 zw&b?NF(Q`SkafrKbs09~o<^K>Xu*b>;7E|rT3G{IWk+jm4Qx*^t+_A=I)hFyNN zG^z$Jmt>BYh2k1WE|nT~Irg>;)TJ1N6zn^%GmP(xr{^bfhycL%LUM@m!&j>@`y}8N zfu4NGp$!1e!6D*^XEH4{?kL-68l$OD;S_Z=+3Sf{q*RN4NJ4OigU(Kdm_#HWUCg& zuxsBp2)=y0c>d%cM!xrI-_2k2ntI6ix}(|sKOcYT#`+Qedh>euwiV*Djuuz5x=efY z)whQHnjGHq!ju>C&o^1|+RDtW5!>Egel=z8{*t9TQxBzYy|gm-+^SARQ!1k_zVX*% zN0+2F+&DdT;@2-1m{qT7Bgz7ZZndo)&^p3*##Sgt$orZc2y^fyTQFycV^2{y3Chnr{aAGxdW5LgQC*`@HFDh0>NFvU(d($bk`>Bt z)Iwt?T@)zK6x6*r)H_h1{W3h8)WcCwcl1ziNI~7dGle63_5tNf80^|*dIbTdVu5;8 z-rU}oFnlKtcF@SGSdQ7QmTpq#0`1a17kRr3`--x5pG#fPsH>_Pe3r66UH$l-q>IsL z){jvyrLG_Qyi0?RRjywpE=HqydPjqZy6$w%XNNygxoYV+8>7+as;|*iyx>@8l}p}B z#b`9TOpJ^AP_o;YLrHa1E{CLx(P(rrdSz{V$Exq}Ichc-LdJB7i_47hd3s5`tzIYB zi`T;bEa6-!pqV)dkqC@NlR|n_$8AXQ-E|l6{XAJ09r{Iq(P&bL2lzgg*Edi2Tjlyt z;$k!!UG(f%E#+OkHks7D4BI3wMx)WySflIGw$b;gT=I@EMx)WyMBxG;^v)djPlJ-L zP^lMSG#Xt^6)q~T+%5NQQn@-vT#QDD@p(Q<&qn!bZ~%V6E^#p$7MB4Gm6D2C1`PES z9OL^$wHdH_T^Zx^{rNXIPZW4F39ATh2aJNqYC3%3f06iHeSax5RgikG}&U-XZpg{hxV<*sXgP{t7XI-XZGQ zJ46xvh5Q;W&^yG%zRiW;8r~s(?MKJnA^NPmq-biFIa2?mkYjNEZ}3hdHSIrtry)DF z`R(57^Gecu#RC72okX8PqRu){2Ta{8)i!g$+SXO7RMMqOY;5=L-6JC6x_0ehW;m*C zvxTA+A5Y7ija_t74G2`*{NJ?IRND^uy%}S*Eql_0+zE4`7GDpO zqG-fu-CPjv#~%esUZ6LqD@+tz+J&g1%2hElCx2M~O=nnVeCyLXNw;o6y<)bfXCU@X; zHR)}N488)Ik2-NW8fyc|BTwtS7(w_Fe-tQNf#}F*+yI)Lcc5EWAM+T{Jl~I`3BoG; z1(Np@>|B|MH?v8MOrY!pqO-#g;~bDPnA4HR8;H&fd<$%Y7))Cs5FkDvU1#7Yg66q9 z(4k2PZ-J)ePyh%u$s@X0(7ba8y8g(=*PyvJl8IwqWeb##zM$JO2CF8jQY2@FU=w6y6Q}Amby5Wd&PsYjx{82!)<$C?z8(j#N6>Wlr}Il6dDtUBGu59iz{-WEK=Zsmou53)@5i7i@uv$Q?+9ql z_|pZDXPk;r7k?CPm*4K7N${r&AaA@x!zI>izbw$rzk@uo-)o>*>rWRTzdwLxzdxN{ z`bgeo(1fJ()ZH$>QJ{(Qr}L9XW$a^0&U-{DokhdQ+C;aLB zj>a|q~~NVJMw0?3QIOL=`k=eUDBDv!x`Dep1RJ#`0py*T^aS}4(9DtOXnd=wJe~y2k~_$w z^sSL-0J2b%yl+5Pb{Fza-le?DpsO{5>s0LGmtQL12#JPM)|}rs&{^(6-Z;=?`_ly| zkENhl?oa2JKC<6epxNqA7eL-=&|LDT^OHyQ@1B`*PWiQ_^5_VzxTyJ03Li z{pkY8dkr*i`_uW!qx5YA%}@Sx0pwi(%`Jbr0Py*Tl)ffe`0)uf<+nTN5+vH1^2^Hi zF6GS!UC|xnMIc>o-=)0oLAU!3@**Lx5;Tn-`6YP{(9F0Cd9y(C zB2`0fp+7@FR_B*~H~EnyamKOIfq_uK_td(i!H7j&4`3Jr5) zjr_{&=l7g}=$hUI9X(rbQH`#8KI(uj_Acni|Lb)ZbTpr|R-=opW7#LQ z^j*-AysW#VE4)j(*Y1Lj?DA0{I-dt!AQ9G~qJQB>_aCgVeh(t2|6f{R{hvRJL}ID^ zBG|0c*6;eO?`X6BxhJNVR~&Qv*6NLRQ^GGi-=WL$X6GMX9kh7I-(PR**{OBr$kAh; z8F*xaE9ilegWeo_^IIwUZ#yiwcsZ}*>3szadRAIT26y?SkvR9yA6{7b=h&*)&(5?- zow@q@)*i<`E*qY6G%F+L%9f9w8hd%pFHOH1oLAg*>h~X>n?KKC_;um4Cp+XdTXlNz zs4j+v&jj5ZSLdNii=Hv=iP|%DNxyjqCjZ=ff9cnSyFa{sdfq37TYZP8_3v!|JoCq* zPk-<{Tgh`F2+>b8ZW6V2_uC&_XYJvQetSH|vf`!keor*Wd7){?wVj?B)k?o+`5RwkuCaf#P*fhYUM+c}1lC=#bZ&ei&_?cXCFLus-nzV!r6~VT3u(dG&PP8w1PUw)a^1ulM4A z{O!jNSG4?HY@gS9%BpRjSU$;LeE#XxmyVVU3hFk0Y|Hv*Hh!PE;>v}SKbFW@Z!qCP3>+MsW0m)|Y(j)pai zZ2bG6=iltV^WFB39lw^hsxY_tm)oyKbeY&M`I8fm{&%Zv3{8re3(!FcP`P=*EdeQ4jEtp^DbW@=; z%%JnW_S%_}%VRQ=m(O&6H0G@fGgm|yM{S+afBBkWgAT0O($U}ELn;nWvFxtfyX@I% z`#TQ#*!$=Q16DqDI^&Ov|7iK}S1)fg>e@HDcgn?ir-wiLka)^+V$s^E!>-;FHsyyw zSKgYHJp1AsPecaKX?p$GzQn!TTX!A)TKX&-VAQ?O!k4f^{js`Ik=~&BBs^Nq=Tc%Zk~)i`keJ!@?JEdbcf^J6`lV+up?<$ z`ME>c`|Ot0(MM*^>HhO;kDOV1F>H9dPiuG9Fx=s$fnR9r7piXkee=fkYgeya{_E1k z3+F5Sq60WXT7|a%Fg!Q^@*Dr2`svx%SCp?h^UK@M|CqS@uNPnWqi}Jp^=X~Idp>64 zi12aKn!J$F%WUbn=3IezBRsPzH~+(pQ7=4scJH2Ll^+$Fr;mB;X7ifCA=7t%O zVRVjCI34mAVI5%|i8HWeX@b2a!`pj+2eAo|F!` z-ptO-rZ^n%w3&V6hP;ijA}qs>8-ZCdQ}J)Cq6oSohm^bbO~tv9^>MUw@r=lNIKMGBvMzq-N7k9VG|5!F=zd0O zDlWm2;xd@3Rtc;`!b`1U84fwzMW+;+cPhW;ok*p`dr?0ORH4<9H>_oR=UL~-^(P9s?E-VGdL)1B@XR%h^U%WZKY#&UEbx9RE?eD z!x2t#dX!VliFJzedOF45aOCbd>mwVef~-Pn4Xo;912VG1g$ObT&m)#j;WP-Z0OGN4 zDbPm>^rZrAP@o?bh+YM9-d`1{0ua_~Vv)}UK=h&NARz(2gwqQH@k=YI0~!s8sHR6E!J{* zvnjXHx+4MTahm8*m$-?J(40fP&S(dY)y%RNUe0@PsVOYjC2n(x-{Wvoafhh^j&nSX zgb7%8ooD@$nm*&iQE%HA-W2voWQ3z&16DeJk1cCsv9S4ESl*WvNz$39oCjyo%M6f? z!|oy5CGxe)klX?=@pC!g-$MH8t!DUFxDEt|OHTZQi=obb06A+KJ z;1D}&GVQE$lQk3OC|P$B|~aqffC@#BuQFQ@~M0tR64 zqDw1kQKkkN#nX;H<+=BXdMpe#RFz=GxC;x%y^TbNcTkwa8~Pp-;_ys2sv_wWM{yf% z7;%f+=^$o)Dqw{XXRb>+O@*g`PBayV_C<%5(AChxT2$LvwK<_Evdlj^dtPtQv%J{ElN#cUYLm&IiOfo>6db0^%IhF>nsc zC~5F6IO}kV*WA>2kGsV4)OZ`n>2dI$4=oohG0Wju6PXWn4$o(iMYy_94K1wRou@k- zFG)Qg9V@vMR~ph{UC|X%^D>3iX65Cq(zMmw#!hj2po-@d2OH4@P;8MnDcHB>IlYaR zIK6|Z=J9fKdS+?LZ8Jnt&2x!6wB@!>E;kHLwe5u`@=T`UXiL{k2}OozN7aUkrd{{H);40^((J84xcUm&Zm977n;f9%)Us(qYdShGNkxIK(q3BS*n4)2uML zka}Wp8jAzrsf@;xTNcYttEFDSfev8NA@tdH^NH`MPoyTbXf0}iBl?yLBVayosOc_o z8Oww_dZSA!KWCq-E>qHGmwvlj|C3vP*j$3m9mecp(14c)mYqRS(`ut)l*u-cCA|8=(*owj;j+hG8P;LsY zTTD+DnX4u|>?UiK| zRf63uu3jHw?-Sk8kE%>! z9Wx96@VrwzEnep%^sErp6w7IxX9Y#0a;((X+-6`Jj!l^um@cq^iH6dG^#&S@e1_N; zm=ynk3DTv()g|JD<4q#(*eaU98^Y)WFRM1=s|aEjvO!O>I{GR)mAqhMM9PL87Eimx3v~W&!3~o-f<#c~ zlrr{V^iH{o&oUoHLLJk0kVwN}7LAT`;GRfhg|lkAqwtWa@JYmLYraF=5ooY*h(n~o z;y$sq?^ppZHaPB2as{AO~KXOhfD z_p!(VG9(S_$RycU&NaQ%;8rF(aw~6AaEAeLE1v`;**1CjNaj>~XG9*r%$kN$-N&(@;OwWEe)JoK)Dm4{@)tDjE_w-Rb&2kC;59MlXM@CTA4mp;;i_BaEIr-Vnt#lQDg|qmN!DV% zzu_Ji+#iqq6!V7Wu<3O2cdStlfa=1_4)5ce9k7*Kyy-C6ue!Y%m59x~&mnGgiPtBq zkAcwFCskUDg5BO(=;+IJd4IaZtz=$U8E18~G)n~pq&s?t+iQq->UW@sJF`fX!0cTA zUSb2XQwxX5=hm@)Lz5X>^f4D^GIsHjTbc-%UR(-ouH{nh z0mN}pfVh+%fOz-c9}t)K2p}$n4wB4c~FUufsivCo{V`8#wt9f z^sb3qdJ_*N7M`Vp>wG)aLJJh*iv>7I-eMEW&1m1Q$e~=isX-y0lwgiuNV#R@Vn>J5 z$>FUBbsV8qKM9LR1+{$%OdURp98XI5V^vd!Zz6|M4!!M2hTUA{(<1ER6)XPl`m^Aq z&gy-lR_Uo=QrM#KvWs(z`y|mWldXg$$l-mFrEwIdGRwpqS7%gfI%H_(Mgg zM9b3cEInxu_q+7x3$8B73tw1Of^?V)n;=dSUQUmlXcVpmoViNPB6@DP^e&9y0iPGR zB1gmXg%cVD=WM9MI|78>M$a&(hOw~@B$WH17)6EO3!tm78wAh8g*&#A<&OX7W!f3?ez6|1=eUgl(!sbAbT|<4# z$%+A<8`)Y=6>M6Zg`TY%5k^Jd*^X7bgnnh$pH`HYT3q+xDU~EjDK;uEUu}NHW*Sw+ zOYUPNQYt`t)>YrP+_a@=6aN(VJ4=5zxb)>zkZt9HbfB5|sI)T0s zD(Yckk0*0XcZJa*dB4083=Ki65;r>vHp89%Gt5*-k6_p{x(+Ne<)u{5!+QKzO7n8` zUGiYf5{WFywxx`~Z~2@Gf@dh6GE}wMDp&M=Z19yTx*ctpPTNpwx*avW2N10MtJP#H z9$OXML_P1xW@&zn0rlMF?FW0YNuD}86Az=x@2a5cK2PqQ+TOXgo5F%fmbk~^^-^!; zC_Ns8`tH>4gQKBGeWyIy#EYz45h1k>R`3ib?x!k#uUy5a8L957op3qL-l!vZ5E1C! zf|cgS-c*{a-1=MAZ!JgyrS)^F^XTv}uAq9<#@~=Isfq(05Mk=z-3bc9$I4ddPDB8*J%41$CN=bAtDJlXQxq#MQ&c_b7$nmG8Nu$DaS#{F<9zG_j~uhN|MK>D zAeijIO%WSxDkd`&@mn8j#8P8hXF(=WX{p9IrQU{2x*rCr)}*AmqO`2-@Hnaw`L-;< z`d_3yHAi+d?dfII0?MZj5!KrhS`)^mj(6L5DmvbMg)$$K+8ADp@-`>6SKfU8dsMJ( z+(TF50ovkw-UC9#!zxlA}EW}E$fYdqn_QT+u4LRBZ(ZG z`WbbP0;bpt=(9sEFS~VkUnQ(df7PMiFSRnfJtEK5A?{(KD(cG3&L!S(a32xxksNqT zj=tGT$&j#wigI~vl-j~rhKD~)*a)9Q#UfGkf~tCx4nj;do8w&+`GTJX@&#$C;LhSR z1*U-zUV0DbgTrts9+7-~@fOPBl#Z80l{7@vSQe}c#+Zoa7X5t$y$GDYzzow&giCC&9juZ3!$&-wzIcVc}3-j?U!h0Z*SytZJh^^vg~Izl6#;?oqE z&t+-D)NCZh!0spE&LGUiZyJO0@%tEy6#+fYprwE~-3mbY47U~#{9^EuYhS={CjmXh zpmTsYM+4lCV00}24QEhWK$tCnHxZBre+J})_hAGG#~=WVxwD+k2$b`cQI5q+zjbIbT=E|ZuD(&0+!7F%JOR)QrY#Q; zuT75u;`zW~o06?w1H>)4LWzA3&^?ToPFv)b+zp6Z@+hEJm?cjD;_~Qx#fFTd0VY!1 zlI;L-OU47@mb3xl9FG9vOM!4`r9i{1UU(i*BPQi_1^TA~eXKy=D$qqh+%9zb9=FS2 zKpd9|h+F(|K-?}RfVf?L0>tfd01!{rF+e=$*8p+5+)`riLnG(bpoat88r=ZB&aBZJ z5SL;FB;^edJ(ko9*?^ibr~nYR%QA(I&JoOo6us~Ppm0X_DWGNy+75`@biV?Hqw$VK ztU-ta#B<~T#B<~Z#M3ef5YI=tf_n@Q?>m<$5S>=glF9oB5YJ^XAfC%oKyR>Ieh-LC z{t*z*`A3l-cdK=-oPU4X_g=np_M81y$F zp0`?P2L zfyW}rWmFFtqLy7;^a9-gyI8^M?B+$HKejqjrm}hTB)qmpa&SP&K{Ag3Qj;{He6l|&SM8n5htQ=2UQi}(U}R2DlF{jndrIzq z@Cq8w8L^g3TH8{d7lb9#=Yk5Wa@#t*Bg5o5wAb(tN=4NM(GcaSg#}H9K1Z|9U||}~ zjIk7Re&pzat0AUECU}JfS3^yUZh^YsYJF2-I0WJqXN=1`IL0Q9#Dt1xHVdmlDnQF#Qd!0tepBc|d;SYlXKdfaF;ueX*SGg6EVYw6KukMeu0#Wt7P z%{%Sp;Ww?~db{Vr<5sivd#lHK64$M`p22myjlBsE$FlL#@-S2JF1yEyPgWbEn9R_Q zW?E1VxU?K9c40{-VMsHnY}5hD&DPzJbphACxL(HfAg1iw%AKAoI+&7A?;17)w*CP|8_8MjU6to&Tn6DBRpo*}X z7u+=85RY0tPc*lh_wy9AvZD}K0@~WmTe<%BcJm%qA|pGR*DD%hOvQ0N8lmod=}99r zLkH7Xi8tZnfpU8ngvrWzgw;H|(tO1x!r-%Z+suco;vr;cuaby^N+OOR5mvDjMmX-H z`sCeY_7u`W`Q^DsW-pm<*~ERw?HS|;w*1q^E*GfId0=2OY(4V2&Ac0zTh`Juc&&aG z^`Ikq`|=hjZ*iPl{HPJ*T1j;ti>O=i>cHMXQSl?X5iFw=zs*b^iQiyF?WYQWm?}a^ zw*c+tQCBH3;(D8BWG$OH38h_TLmjZ02cxu0ZKwlEVWSd2K}(2PPtxSVwwVtgvsPBE zsA=t&P40uTn^SJu%?It`9vkWp<(p}20&}B#gTm&rkv$_@1<=7%NE(=e-+XPn--?nn zx3-DfJmaLwgM_2<>_iP{gq(GBcxMeoMN*X<`44hZiHc(vHy|g+d38bhPx9&lwP#c% z=pL$B>y9}|xrE%<#6zBOs2}^G1oh(pE~p;|aY6m4km^SW>IW^H8coY+(TCC^HH)%7 zjSUDcbQU=n)PmUbCLMPM=HL>}D5y)T-b4%^@;?JKmC@Y`8rnx;5IW$OhCqWr>l-+( zH6V^_fS!uu=k&8>tGyoH&=5-b7}!C9EKG#r zO>3nnXksr151X2C7bY5a9HLPVd#PL?`68f!~fdZD~_)e@}DzlmA z<3J1?hT(bqC&HQMpvfhpSKmPh@usd$Tv zzsE!|K@!~W=a31!potEqUK45CBap}^t}n^}-YY&R6{_l!Me7ne)S%Na8`espm^ z!){*gC3zMmgu^6bv;jiUrJy(4!M%ghb72F-#f3x+{;hWN;uj^xeKyb76S!xBOvUci zNGyw!aW=C9E{_E zJnpl0^EZ;ZZ=@u^HXO8yTWsbzVKVDhN&*$BRpcyIiH_O~Mid%cwgJb)$#HhE6g8k~ zJKji#Gh=w%8|i8sATDBQ@VLLB`*4r@W2BA?qH7rSY>v{3aO8?fRfsaSa}hj8rWVvWlxH3FdEr*SPZ&ODlC!&^LK?^tJ<+E8A}ccPM?#g3BY z9jH`TWuU^xfKM~!j)a7l!8~tP?ffFhJ~ARE*!L@VGfHb4SbPvvB3cYy(XbjU+RIQ)Z61hl7;GMk z(K8g!3!s;cakNRzT`4~%plzJ_i1K;Og8fZ=3nzQc(hiaQp}}52{1LzjKzt&677(B6 zUID}>!g`FRe5%_95RWCVg2&PW0xqR5ATGrLh;yU^;vBR)lXDa*vCk>ER{?R}e<{#+ zfH?0qKwRD>1xJ&7F3$*v^EL#;>F6~JkL{zx(uAJN8>P_AQDW(p3Xj$9`{eSDB9`a! zqC$5A5Z9r{w3nygK0ut~H9(x>pGxfefH+4nAg*maAkJ|Z5a&3h#L|jTF8Kx^&RZLv z8s}&ah~r`aaXKp?F4?W%k^ym!DS$XfjzYIUiG39i-%Gnzfi^49AqDzNf$9dy9QP?u z4+R>gK+_fIDFvd}HeB1g3RI#%yA zJ@9dX4=Ws|ZVG*y>?E<_i993TC!RB+Cq7GEl&>=+J3Tb=$b*TDV~!AHaxbV-9=#w! z@q7TQ9ubCUI6{&>=32lbqP)ZHxg@(lvipO+n7ju+XGrycFgU}TqcI+o+>1(7yr{=9 z<$?%%eh?lkok@-AT+dXbP&D+AIO3oQM6X@ALwu_%hru~eG zQN}@-%n7F!!=ixSBEypRBf8hv#NF`3;QYWLgWtn_ATkoh?$2yR$?w8h+UrT) z2oyY`6Ta@y4DJqn3uAmB_A885EZ}yxn;1+zl^?_Q+x6U$lgyWdBI2 zwu&3XMn~=v!5^X;32#VtqC9!0eF)|1EY~HfvNFu-tLzDp37IE!*54CiK2qs9@^kjd zZV%uZT%jL4V|^>`7Dbs)C6?TG)fc*SM_)*FC$v5i@>AUvg7c`jLi_L16_OltaxNtQ zYYW-R-xVS+PVs~eqwxoHhD!hRb>!4$MXrvIhElRQP&5fpyc#^4CB@|a0Jn^0_Vh&# zCEkn~lKmJklyx606^WJ(zR-TE&!T-NRnXh{LRbG6e4%|v7$1Af0rBrdoCicNGjJdn zerGT!48P>l=mmPlz&WA-@z_`e>IsNTu>s;zh6Ccfxe6{{!O;s)PPYsY=lwu|Xn6_e z-2jMdD_5ZNfH*IGn}ze%#&E(p9stB+X~_wXwE*H$Tne42#J-@!t_8$-ixs;4fOyW2 zDRh+zU0wJoTt`ztJO$4J;vD1^alPafamj0x*slR`-pznG?*TxZ;{+hiL0%D;cLfmV z(8DL;9Blz{x{iQ2Z+}3XZlD4U1H?HdDRi_#iSy1^VqXSCPsa4Z8U@;@K>HQwf&v-g zv2czE1&ULk2Nft?foL%c=Xh0tK2)GD6=;V7{i;B96tAeM#w(IG?9v0qgS1Do;F>Yp zj2)^@>_3mb`mGVw+ZkQy7P0wQ7$}C`1E4GPVa-*x9+HN==V7FTO54fx*%;&|JhVP^9a7LeH-?zhf5KA zO$A3NLfk{CVY}C9<(3m4P{HHAaO_`qi|1X@mmRdukG8O1WjmymMd!3Ly%Gtw(C+jQ zwuQZc{}y(WW(#{rfGzAH+AZuRY+?UCdo_Kg0*|w>kG+?bZDfbVuDirNFo@u$t=cxe zg}nh8%y$cW0`{;s!0yJ)*$`Bk)5aaWpLm?n`(4px=-mv>y6TDywAEgR*T%ZMv$QE0 z@7}O7fgVdn@$XFh|6=p~^1y$SVsp`RYJ9MQeY(PheRL7{m<=AG<9YKnhZi5l`4UZq z&(|H|el~B%2fNsgdU^$mO(CL@Vex1>mOhC>&m<<|&meTc?*s-7z;7ypbeMP5orJ$Q zgHSgMD1?Xkh5gd21AdMrhp4R=FkBlf@eLY*-WoyXpjb{9sz9`IjdKvySNM}dAlWnn z!ReqR8@;qIM@_Oh2g#)kvvLR|n^rIIlSh5!qOXA^+Z$I7B$J` zwjh}_6w4t{dS7R9?^Hr=Mn&2Xl*6uDhJdR zj({8j$=`)YweAxK1ce7Kc}X2*J19XE93B%OT=E$8fwSk7&A#YM$VQO56P=7?I zP=8oRrSVuW%XLSToE*sVyqq{h`O+aC<=z%{(%mB%D}#?2#_MBwT^EG$pwO246ky~q z2LPAHA(B^{$!pUlSZMQ;Noct-Ofcp)U<@)RS&q|_WDbQZoJ6%zj~^-Uc(N3SNJl-c zL!yx7YH2t%l^0JD$vk=oxeX<`D1D?|K-z`>skD>)FiM6L0;Rp#|3cbHCY_8Xhd^>$ zGr78uAR#0nc&8ytKc4rGIG;^s!*wqHc!_a{tl5sIh+54hgJ3!lDuirA&ozSgTrxM6 z73T?8AX=HsxrypJXrEoz=3g+nBTR$HP?4y-2(ggxyWg9J-%u+Rq!!W&HtJ63;Z==i!rL54u5?8#w1 z0G=KWk)%W>sab5O&^EW3&~{Q&p>13fq3wn6$|lDe?YyTXjLD(eKqaB}&2$=@93BV2 z<#LGRI`2v@8BHsfPJ@%f69Bke4w2j;TL|g!^+}67HY$qHurQGU0yR z5<#1Cj4LSqC~&H2r<3^PumAwp!6DL-%&ptPAha0PG^@$@#<4^_oPMN`k1OZm5OF=s zQ)aFww8?b}Z6-N{HX{ZIZQ_!IHo63%d1d&qCM6)FfZ7&;i<%-jt5FW=0Jv-pk?aXf zc0`2LK0G2LGdHa_L4%zUshN|~BC@j6a?&z#BcjqXaxI2v{yIl&C2lRF*{Gs+LBj$&YbTXth;B}w#xQK?w-1MeVya6Em!USbXU@<2gI19xt}a}uJgIe|N1#^hquXd{p_kR}m^BckK{@LaC z1#9NzHFixMBDUC_w$fPd4gEY?WyX0q*YMe?ZIb8AD{Ts+P+8frhO>PPBkUj9oMhC zbRf3g+WVGtn{2&&bjr53N-sv7c;?k9M+ZbjW>&Q*NM6}B`bFK!N8UZsEObHI<@XMy z?%4TLh-cN5_gkNDee##T=lb7I-frDIZbRt=S>MMGIrojx-Pi1sUv^IY01^tiK+d@$Rz2`_1P&d+M$0|HqsVeR9m8M;exW_J8XGyQX4e|GcyjMA#J&Zq}VGA~uSKYAgt#{+$AJ<^7keSJOkC2#!ssix6W z3;T9o-FWtDkMi^? z&iSN|ennRHwx7p`ML+oEtcOOfihOcy*YGJR!u*@jo$@P^?qBlAvWDY6z4gOOj}Ffn zZF^i_bi_F3m&v`K%P82r`FL)7i>%+0nmIEoCVkTD9)k`aVMF(4nVdEuHzqcAsZN(K zVQ`#%49>Hso|0pH59CGvh?9Uj%L0{a%%rr5c~c@;-%Vq@Ubjw(lL6m@c}TimM@R8e z2*13*XC@(gM~sHWN8p#bXBE>0cRe+j1lU??%KXfTs-w^M_m0hitvsFFosXo{p_ z-T;Q)5U7|>hz8kIG3$X@sln_9hQ4s2(i{hdp3tk93q*rk6{ClqV;T%?2O+0XrHKJ% zr3TXfCR%vMXUaG;+&{nCz&s~)2X!!N}=y7wa}_opHMNUtMGiup}&RaB?JLILqWEJj0Os(y@Uxdx* zYIt>i9G7iIdBjG=yBD~EbxhUwBpQbzqe!mW%oghUpe7WsG`JhLKgV?bN|SjL+eh zG>++Y)R$8D=WlCY3uj{h-6cxp#b|^WpQANtTCHcB1*xo;o^u&hu2B*fqtWQPmvOOv z5>Wl?5ARXArb%3kMx(2hM%T=^qai96tskVoXf(Q71FP4`y3Rd!YP-sXqfJ;~G#XtI zjEjwQfHpmPxrNI0p2WpyG`iX_F0vt6W8smaf2myGN?eRaqpL0Bl6CERwB1iC*B*(B z(P(ttr_nV(sKqBL*J+81(P(ru-sR(P(tFQ*;4fb)%V5H|`-v0fEtI zbhQUoTQ^j$7>SF~Xms7rxa9Jpx}kD8B`!vz(G{i9MRh~vnk;cK8jUXU7qoRl!0(M~yD38!FdIiHp%_bVV~R-@2i4{afNL*Mi+HVYTdY=H8Miw z8Z2=!8jUWR_o%w2uiJ3%J&LYr5*MS<=%OxI)%C`Rgt{u%(-Ie>(dZ&Skk<_WLg&oI zGaD$nR!LlpMx!fEqibOQ70Xqw^%57O(deSiU9V$)8lcG2*OFDPV-gpm(deSiT+LVF zXv3o_7aLv>&uBEdXk_F4JoQm;|5Vma<%*y|34zgQbkUfp>YDy~$UQ2TMdD&K8eKF- z>2=iq>+tvB@>6}o6dR70xEPH_S8t839qDC_RjvgR7o*YW>chCGeNlL4;gCNXE4uz6 zaWNW=uD+mE^W}Nv#kWXf(Pkz^eJ8I^a^L&tiUWgGu89&CqtWO} z(CGTf-gTeKMIQp9z-TnO5`k6gVfMF;KUKL_N?eRaqszv)rQqQRjv^d7o*YW8pyb08}8e? z{RNdPN8(~M8eM}J7u9*vH8^o@s>($lR-(XYG`d{Cs`*O1@nWRP^@+sAXf(RqjEihY zy1MsDnXGc{l(-m;M%Q4CuGI(n$E#fDBrZmy(KUo|1>=U&LbH^$^vxl7_=G#Xta z8JAoSzu0r)l*)Bc;$k!!U85LR1b!*hZ_zN*sOV~3mtz@?M%QRWsQKFb#UrOwt~iN{ z(P(syVO&%XDJ-4ZaxY#d^BZB9#KmYdx*h_Bs*Cy!l`Bi)Vl*0E4>PU^NqXB{OMV?i zmsjFqG#XuxXmr*4YjrP`i$3*5fzfDmjRjV(BR`+UHjTZ{i(@ZQ)BgqIv0~=;fnvhG?4Iv$WdL0tR z!l~JF)~j6fi8=~Iqve_gj9%BCA`z0_`4|h(t{EDx1qUeMvaZ_oxiF&9a?NC1jd`??`^cr|Rjzv_E~3$LWiT#jNEV)qUWam) zb&Zj@h(^nm$++Y?digv0sG-c2D{&ExmMe>K$#l=0K6hQ^dRF2h8ZFnOj7!c}-p4Oj zs$8ojE~3$LWiu|>&s;S)>1CDcn8ZaiS}tm6dY!DxG-Nac%js=xLL>swXt{EMQMvZz zCmm3^9+tR>M$46_;reZS(ihxa?wL1_YgM0w`Kv`M)$a#AMF%}q(<4w7Y%bGDEcXDR-%#_E{vNO{kOH(4K zAkuv$5n^(7nwEl+QH_d_)hO}QA0@>~P}WTnB{bCqUo?rRfx{=tpDQ(cZWgOs8d)5R z>JtD9VF9qItQG~1=otWwx)1=1QdO{cb(5BzF=0jugc6#pIlvF~Xm1Is&PZJ{ZGG?b|Op25RQw5G>uP(Hx)TtBF zGa_TPNKWU6~{NuY>WZr~9mVt=_T($v; zgR1kg1^%*#xcKf0SKSz8B`g zw=*4?-Rc^gG-#k&oqA!b#2p!X3~&u_ItL6$wD6r2WW$sc=S%?=iLM8UUlGA2VQmHRR{hK>A=6+`(NI?{&|(bs}8*C zz^e|t>cFcGyz0QK4!r8Xs}8*Cz^e|t>cFcGyz0QK4!r8Xs}8*Cz^e|t>cFq81ONEH z{NLaF$UoJm#hceZuQHJ7z}-Lm*Kc0(&wuo9e0=lzCn*E#AN`weUjMwxK&1nt|K|MW zSNSvkv&NgB{b%xL|K6LQ^=J0~{_{7lfAnSWr+-*`bJ3sw^M8Evr`JDMlfnJ}HGA{7 z_0RAB-T(bY_s@U)x%TEq{P|D*(|`Wv_0OveUUlGA2VQmH@0Jd1|KfjpbFDx7fBzr7 z`J49V_^lV+yDIL_0OveUUlH*b>N@< z_y6F{>z`K{yz0Q;d>#0&{)hkYjn1F{`d@i(UjO{_7kF&42Oc_0Ove zUUlGA2VQmHRR>;m;K%5|zx;RppEp)TdV{B>wo?~y?Om( zB!gD#rq!@N+_!Gr&(6_4AD!*_WZ56A)7i7Eht`d=+Z|lzd^nOH%NG0nw|2YV#>cgD z+Pe1PbUymdBN|B1SS5?JFOz?DA}~O0_n+iYY2p2f|LaBS$ngu?)QAMGjQEy7?wI{RmUeYd~*E=CS0wx9OC zR}AUt1Yp}eJnzrw-_hBB@-5PhaP)&=)RraVzjecSBPzzUs1Tlnj$DSy!Z=gjpsMYU zm-Mh~#X};K-rKEb_5722+&-PRhdomzs8J{t;rC>3g-uu&QXLVt)Z(#y#w1-opZz>$ z6%8|7E85D~SAfL*I3FHijU3NA`lplaoGhY~cANeDgx@g*>;+HaH%!QG4+Ac27+RYU zg(>D9Fn6>tAN?(6*YWA-W4?p$kjvlN1O@)aOhosv$1Hhv&#)1tRln1N!dx(UsG`Fv z^&$~Q1nlkJe%d*%Z?C`Go`3W=!JOyJ-2EJ4c3=&t8DwI`v>`L69L}ZR+8;rMO(r=g zT^>TvNa`^&d$Ml)33!Ey9DFNRs>BXoeFE8274dR3G*92drNDlF^nGI3?Dvn(Q)stG z_x*3@x$|W8_vhpH?0kZv>>yBU#3Y%RHTd@AY>(E>O}CSWC(!Q(B3nFApUw z-+GJ|fqZFe`gdt-G)9-@ zR)P)<8j*IKfeC(5L6(T|qF^OUNZ#I)7Q)WiQ&I02fUtiOfU~pRQ6fzIOnSul!mf?% zX@#4Sp$P2|CLzNBW}E{S7`^EQa!BTO-G_a?X zO1z3N?uucgqfa&;sgcZwvHR1EBbb%@Dy!Bp~gCqxs>S&9h#q3(X7Hxa6g=?YQMpmu4HrEMJY52QRsG@v_R$Ra-9H}U`~xkbp-O3y%!na61KsXD z{~LEcR7Dsf`Ozjvvd9A|TOE?0LXS(BGROl!+*5 zR-2fs*3AZUhbB|p+_W2QdTy(fC>wy^gK18T2smK-$o!Nh3QTD;O^o)R$b?!yZ{%rB z(2?LkKS2$tP*`!4X;kQp&}>sK=;9S&3>Gi5q#TNeKOjz{GhR@FvB44(NH=F#X?r#m z!b58CpaYa*`>S)@I(w>)K|;WX+WI@vSm>}N1j&DhRzkFh29zYJX$vx3O2s`1lM{+! z&vIXwQKtL}cGEJX$zxaCf5#>9QC8R#k|a9N7ED4A8dc|XB45~_KYZs4O$5AO`Th}UEPF_jBzeU~E6~F% ztq`~U?)&NNKQf1wwI=x+)R6UgX7VG&*lGN z@BICz^XGzX*)R}_t^;L=4Q)a{1>a-915K)PcDCcXB&SA#!~f>`Ed5T>V1q;Z=c8|J z4<{Q^4$KGF`*64v4N0CB;hY<|5Ndb$goHKvLB^uE3C;bYI(S4{=JwH7Baty}>~uYOJxE68=2&<+Su!c03j z9k~V*i9pK>l7V3^W}!Hq;A4H{g&-0|d}heSkL^#-&Qbet)F58UG515F$SgWRl>aLI zETn(oX@K65(&%1?2tTUSRz#|Og?>s^+^i=dnwRDEMdpcNN3X$yTuK9M&}?_-U`76T zbMqjY#C(%$Fq2d%4!iF5kk0cYmiJrldu&&JS)X1cUNP&!v}#D7bFPI=_>nfErby?{ zkX5wJrH}j(njB-F5DpA)=kWcywx0m*O|oe8)|;T4@UcY7cu^m9EOdJ9HSVJhkr(S@ zXuB`$MTq9*_=H%m?j{)y)m3r`loCn?me;sRcX%dO+>*!q*ARthu4q!vwROqmKp(57 zDNCaN%{lI^;CiFr3u0?otH2ZqyH-UQl0w~+m_q1rF(}Qwp9J!PFs1+_i-@Yjsj_|) z4}m7-5#T8n`xK#4b_c2-ue#jPTtYa>2>YBLLw`@s-RvNIwmBXi?epjDNp>fd#*{)P zlkxM97tX>UuAWfYEQP!{pB|Q<9`3a?`23jPM%O77VZvF;m(VLc`tI}bwEc>Ma@^hg z7MSF$oxt@pE6)dki*((4X##u2_)z-^`h2MI1j1;DyeY!Rg^OUw<``k_#AL>Y=nmh7 zG=eS&9l|j5sS&pq48&h)p1+}Io{z>FR1!kKU-D)=dL`^w07ul^dIS$HN}UDd1Eq2)uSP1KWwPX6?POLD_TW|SC?;EtGJh6HgGVj5!)D7>AU zUAlhRu!~3r=o4pPL>K21z0Pkg8UG@4A;GWq(WMwFQ`;mn&Z?u=vg~Gj?BHe(Ow%*> zt?wQX@PER=nPqYIE^VW^4rFE*2WG#cCu3}Sh89?Ji^P$j=cmHsQI1yfNHg^zT-Osv znp_*YC*Z9}EVN`&BpVVAGIa{dePJm*L6Q!gg4|w1eB{YNCl5`z4?IFnMwz2d4n%N* z$$h=x^pfp;vd5M&_F6dVg*TMsgcRv4{P8uAN>}-xZpGP}NJb{$9QG)?bNl&h2D>1d zi~)fLD?-kCBOVOB#YY4yu}HD>D#5_RsU;`&4bP|7`k8@Z^-&<-IQDWu1SLAp|E+a1 zJAC>C_myTPGFpTsTK^+3kwF58-9*fq9*mIm6x;_75tzkhx=~LxaZ8w;t4S(BZU* zQzhPDNT{7qqfNLg)NFsvA0dTNeJ9_Q}HEGY(nwL4DC9YL-o& z3qMguj8xiVZcyT9p?}7=i1X3-Uxl7o*dXneg}E|t2A)uPiLbuGG(ke@2E`FuF+wkKAr z+NwuCH+zB?f8n8P(0EXK=On_M~~Wiy4XI#z!%oQ@aWIVsddDp}B$Y??*5 zx>kR=?6qh8nRUPavOoN>Z`EUUW=B?(p?k5OSUxG#$#(WSal)U4q4quJK`vj zf3v~If6$?iS(#Y9{umvc^`#K4o6#~gE;Fk;7!DxCl@w~bcTwYzQ;crM>UO7{&ZM`* zV7kupr_Yc}G@4LM3~m^1Y*ix`yF;rxU9INx$-?S~S+J~iNTXGMBqiTkb#eXGMTYja;-YbFNO6lL2L`H@eV#F(*A%x zM1Z}XHJG(mo&L&NJU_1eBa~|sG53Tps(%I$*#nXe#BhD9GoSXC^Wlu2rQY^LPRKxv zngl`$GJV?OCmwV$>P(l@-bhK)J06~pRuaKssto%W`o(l*Jsl4lAZ^|4{ICA5b%*ZV z^cFQ-*DG)EUo*z|Hin&9`(d@h8Stdk3NAY;{rr)_UL?bzWPVpc7%Q&alMgz zx{H99nE0JJj8)I-!V0BkeUG=?_!gM6LMNIZ>4w?v^C*>NNhf(qZb?Y2DEU2SYm)7x7~mTIt^uuIWUFGr@%6SWIaH-v7elz07*ffGCC!;+ z^|DMB~BFmXm?RxfZUS` z&i80ojQgIJW&Ft`D91sC5k3Ume2XOZIxPR3_@W&r6+mhFEfUBJTowUFZEr;k3uX#ADhX^!A0_e0Fn2BiEA~{PsH;ZX zYb=3!WPbkKrLk8{X0PYV$O%f_7=4f{51+(&;rNmGEnJI)%fkK6;tt$p7;EQlyvu;T6vD|E-5=p;JZYA<73LD7itI!7t+qA8!6af%N`025snNtyvkYoAz z)`@x+NF=tgFS3J~kWL1R+8xR?&xUl;O;V1L@Uzf6619w7B+*x)pOkKx4nw5Bi=3%U zo1{mT{+xBIvMogC-sx6J2P^$G<7K5A2wbgnldQiLwP4ci+~fq%Yf=KQiGdj;IF2*D5a!U)x@^MzjxeXaM-omOP@$=^)=OQT?y|!nRCYIw6vRI@;&nR0X1GrCaF?yqz$99y@pGYd8gSzEH#%)$^H$pKdWK&`;^)sp zZk<*#dhK;OO)O`f&TD?f;gYS>RpmNeRj$)j!8*+{L%DjdfkrCU>8fO%u4=8*Rp~li z6|U3lSH(I_8>H81`lDi;$>`F^uNIBZRwP>B->JUVKE5MVB8AS8@U3KIAMVxh=0@opgx& zBFl*utJhmlWaOkviY~xahb_CTL~KYFmgu`=X^Flk7MJMP^foa1kXc0HFYssSH5Tz3 zIdQveoI3iJT1t|?3m20_lXy8v{488hq88~TCHjzBIilaQYX|p96ibdiC)bbY=gbNc zeG#l7(YNd>LO;&CEw9g$e8e$~3(lq{D}q zK-)d~c+KOjzd^lm6kF#?EYJ(pvWjRr^z?hsToa87b(+p~`(fC)JJl;j91SwS!)5fdmTV9CHSB zdD?u7`mX7!$5v-`!ksYMb+TOw-atsID9dB32voFBWdGL36-t}FRuy(7U7nj%h(xh& zP{ku>w1kBMs<2AXF=fn}68!m&F=gJE?W;J+GSctP&Ux!vt#S*mk=ZZ&a$*?^npH#D zGB`JQBhLT!bi~Vy@nel-Rm*>*5e0Ifk?)=3C#WQSLM&9tAGRuX=o68Iw!I~_;n+g` z9(DWh9wT`HN9g0Ch6{B9;&!p48+}8`_-LXtds!%zooX4Q#xTBM6-KICbWPz2=2zK~ zfha1w$v`f%CxDLqzROTW_0|-e=G>`CbCc6NpQ5l#b&`s(Ns!yD9A5HprJ`DOhKi!C z4mrL^V*)q-K_U@cq6$WttcArq5`iofXpJ`-vC`b{5!AfM-T8+SDJ%31fH$gej;-( zp?=23Ac;E+G&o;TdxR9GXfq+CBYb4b#rj98d4P$Wxb>X0Ul4gH+g~^X=m{eubs;7V zMt{DepX~0>=SN3qSJ`HyI({Kewv80&r8KNhBA9Y@PJ>;ji?p|l;)R&V0PTF|7*!-< zR+etz5d$G#Q8S8_r{PYE>31@B6Ru6{%LYZ1X*2v|#9}^@#z6_?u<=;g_`?2D4|qp(ReRebraXDUHoYuibwniaL#-FJK;f~lsFM{y zA8b58k`A7dRRduu`vd()331c`n4hY)Aa{?N;B#Zm5obO>>B zoxPIT0pm6xK%1jlm5>qIGTHuo*d6{rQC5X4Fz^&GprC?)iiGkwAD-d$m?4%!aESld zdUU&yj4B3W2g!AMWaJ_~^3WbHAZDA61A6aKbS?W8I(1LVv8`D^ zaQnE%!zZC4u|subFpsSgq@E2ezZ|4BF|7=%?PauxuA&-C9aLa@B1PX&hb}uVq1UuM zEwL+7G+Bi~O=&20O%#Ir@M#a>4I3z%VNHnS3cUF~iQN@4=z)a{lU+0(PGVDrsK^tcn;vem%uxN~QU3frX{6Ur2Xf~9 z<7I{7qs8g!+>*qAz#aDSy4v5kF*!kz4x3G}sYR7-^Mn$b_x5~^#o~;#4Dwi)JsD9C zO@RH9Ij2RBuv2I$mSTUX21cKBCx!k+y2BA9JBi%D9^42R`3;;tx+S~0X*Wo)o|y|` zm`Pb=86H3;!k0Z9+q$2fqkTR)+w&=WXcW!ja05xl3a|%(AR!AEqSo)g&o^>8V)*$C z8VK{kU>+3(sReCW)WglHCVmMHjrr5Ogog1SB4x|Gp`h+mItUou2BO(+S+;U!Od1^! zTs(0koLq=HDHcBdl6D!`o#s!WI-L?`FU#uH+w+>V7ehGF-?+*{o zaqA$SA{uPE$o+I{1pVd$1F6^V>U7(OF6~cGha3G>l7|wfDhyzC1X)Xa9}eeIHcZeGpuavu<0h zlHhk@B;&W*Y9$^`>H-8sk@_tOUa4ikg*jv~CgJBiq;bMoged+g4_K&95gy@J70Q&} zQADZVRN&$peiV!N6Nik1)RF_1xw}CTWq##w07Y`p1eZK062b2(G}-$g6ifE!Bofx0 zb_JH4C|W$KM6aTsg@Y8e$aFXQBIpDCRt?CB6CP=kI+}uJWtvrm&1xxZwT50Z2erp< zS|nK8qb~w-J`~m^!y7wPLkX%9yFtY76oW?vZ(0o!uS~|$2^=|0VQ*oQ#2Vt*fv?6x z7q4w^Jwz1PPC^BjX-jd~?K57+ac#%*jyPGcof96mM*?y1^AmnYfE)(`By3@=eE*1C z<$Z9f$@VZbauvp@SN$G2OEN@JqRvcAmg8n3LN#>GpK*Gz|D?}WcLEU>#bwIh*!8c# znHq~JPw$X~sh8Vbs)3bLi-dSAv=jKpxGU@eIYN7&JzKUXD0E<2>`G1WOG6mEQvrGi;no z2vg8Twg_>BX~s-=1%pt*fu8-e!_6Rj{T<27J}d zpj@fef^Z*uomLG677~D|zKXe!M`IW+detZxNSv9{aDXV}S%RY;kbfvgQzH_zlsLZ~ z?Kx*Bdx4v+11fGba9n{s$&2cmjAfx^EIoa{ zQV?rKD54VFJ0&@dfuyP!A`FA!zlEBY3~xyEsYGTU{-5ZnK1107G+-qQoXdnw-==1q zDojP}C6O*E8WJZDZXanx?TS6E2*!e^Dj)wOQDM6hP1j}wiJ-N}>5hMfz6Ri>3}uIq zj=zePEQp*51dGWlp*Es#xb+K>#;!d6qR~H&n~5LRwvo}(BCdvZcNk>ch9>@nptR@=6kp)a~-p6%M;&vSNzU`2D3Apg2 zrw|NLbX;TrR9JmNV-6Lhds8jNEnDnDbS2#F+WCE!iA~a5NpnR%B@oeZny`miAbH>5 zGLnb0$^My5Sk69V@npyH4+LgydP`lbvFX0$wNLbn%~J(PnHn36mA9AtozG}4MZ*zP@h=bX-D%3gBdiLJ=UK`IW=*!QS^5hfU1h8EC~ z^s_owVbnf@E|Lx(pPVCI)Gp`-0xbmFrNXFKK!gNlXJ?-emm|Z7LlE&=4dhSG_6V!g zB^7-x=x?5UgSDlCEo?i?38C6PrWXN7T#Agky$RLGMl|kuccxoUe4K4hc=?dzgZ^lq zVIV#R+!Gs6Tu$ZSb_#kk*d4II;TQ}1>l1E3csAlN?)F4(N-V;qcZBq)z~@!9Uy9oA zzm^@FU1+qCHjlL9Vc5)`(gIF26O*u#Z5mws`3?65X;b#zGMW;GzgF20wr=*%kE9C- zK49>Jw0NA`+gpT{ob%x*k4gmMq~i~X2HA*FLbMKsvh@&{aE*s*6tj)(r`*nsa&b8n`^(i zuGE|5b@NWDA{u}ODx!gnYHCtNG@#5UjRw+q(nKnv0reu{VE$;RB05|ct4On4tJEuZ z%|@xdu5HR*xw&>5HD|q9H~i9FRc=Kz01afKflZ(y8c^mcqJdPPA{tOHB95er=x|}K zB6X+gx$8BSn%m8tU#-@wn@yv!cKoW}xVx=Mtw=K;&_pKr*hDIl4^==#@{x*EBp>QU z#F0`F4KB=8#9eRdPNQD;YHq`;*PLp#=GXAAb+hi?`c1itBp;hdMe?Bvs7O9i zk&5I)y@)tcDx$%Kv5LTU+*YbEB6sd>+1WHu*8bKluU*G;>rLPDr7EHUXdn{}YyuV0 zfHGGR4Wt4U(SUjpaU@klhYMpBSz|F-mv5^ZukJh5M#EXx%1*7ZE;pT~2UmBVZ4PLk^l%| zDZ+*&T9N@F9|et}zej$gn|iZAKts|nrm;Wy$Fq&9^+6do(npP>pfIfWygwXC5|w9@ zTHd5?q2e5Z0wLh`nH(LA5v|96N6~-scYuqd_d1A!-t#AyEs_yRj{r!phKBi~@NM)9 z0?33B_W4AL>Z1BQYTe>KFL!=mzyXsD_fG_DX>46buu=SPjQqt6&%yZFC}Q zf1)*tzgtlNr(Skz?)t7-xw~uLt-U+!VEu+yUT-#aw^?12WrLgxTqy~WbPXY0dum3% z!YT(rDc_+=n)}&i7e#SP&!dM~J#wNInLBbSKnz}~6q&sDNMNDw7m(74ap!eHi&SrM zI6}(}g#jlWKqh+$WjJmKAyvJ`t+OtzZ#U(J*R0mcrBcHwH~snsVh?R&lClnch^m8N^QUN@VYb=6;&n$=3B>Unq7wVbjBpptT>S#vfU#Nyp`75%-%)&_w)-*0X< zC1>s4N-66ADk)bR8?RD@i0hu?`{jD0QeRix(w*luHlwZo|E+IwgNyk@mT&0hmMiw%#BCZf{fdp;~3nFR$<1da3DbYUPSt!>a3i zKqY0JXsmEn=>RGz*YD8BbqPBouT*K?R_{EgQuRHA`YTNjsxFnb4xo}UPMT_^63!BC zOHi)*t?xP;ue5ec?gm;`A?FF=`K$w|rhHqjyNzlE%G6w!tL07kwsBi+G%J-2Y|Nd! z&kYSgHD$kv^R(usv1wGCddYR~5M*6%ymD>hcy-s2_gMo_Nm(bDE7UL@Ks9BJ7@?T5 z2B4a<1C6RU?xs{OxwX6UW?hE?ahs*ay0*T%t4pQb)Bwz(yzxCORd@BfTC;vv#}SB2 z&PCSEYWeoomFqSvO)j9CvPQT~ENu-yCFR@3#;qd6;=+L5HX-EOTgR*3-qt<0*1%t- z($)b~Q_hbDiY+?6ny@2a;5AGr0~O35Pwz45Vl_%JChIq(uw)&W%Z+3`vZ z7x68(TEa2~%k8@rA2}Rev*NqA3LB;asHD8Ut(IsHU7B(i2NtKYAn?XSdPZzy*Tm*=Up-PQ84G6VAqM!{3zaSj0SOpLGD0efBDK z9FyUwtX^+og}7_nc~~%*!b*+Uk} zonP^4Rdn3Le{JNJLg|_gM!}NEsWn z4l?>sVfNm>$ICcJ7aKHcpjWr6Jzf@A)7ClGip?97155=r(>}UAy0J_o$(aE2P+EB25%GpHNEcv+sUEpU@cpuei_> zG)P>MGXmmo!-TN}4VDnakyQL*)cMdw@QVn7zW@|plQH9iOZ%3k7cVA)1|j?_px;;=bIMk-9g-dpNxn}0rIIqpijFk z9-g-3@(Facpg=#=aH@mDOdJ;ypI0Jbjt`mWWNgUVCpvG;g;b_8HlzRseBcTUu4G6R zRYqD0KuC8oTFt1)#3mymYp z2qUM~R@zIBzDz)J@-m1b)TNS>lb3=h=_6BtT%jlThlXrB#(4$GO*cvkiSOMG;ju+2 zD@qh-Xy236mFN!b5D6kQmnFz1!e66wmLb`EDKc90=`t?}xYBn^;ke>%VVI;s*t;mh z#h4>Hx&e3ezr#Ei{jmwNUBZD4J41NU9$Lo7>j3AaFkNYYY2sd?fs&0j2D?};6CL@a zs$_Q{VVq5B0xl*W*$)wMU{9Hi%jiM!)aG1<1?B{ZB5QRqGL@;j3^|~c^8Hcf@rU$6 zY*G_5?qWVTyDHMx;K3;<2U~38?W=q@6Q6MWmVNL{>gdqUA}n&BDm#jVIT9?XRB;Ku z8tme;%*Y%VB`-3d%UF>*GfG~hP)5w`|LWOC{R5mgC2P0Fq{*QZktbGE)Yt!fJnY#C z4lL;w=EVhgv8hOC)qtZ8P|+b6aa)jwPQq?!rt!3a zF}LusVs2sUe`ks1Ml3UK2;cCs2xkv)oiVz+;OTHY`O3NU>EYCRwwY+SM>~=sVN=~Or{-PYPxtDu#QnoSDFSNYOubF zYOrKnq87jEh(ruZ$0BO+tB!(B?O!q$sdm5Wh@{w*j!UZDFFQK&vdVN&=;vQ{Eac2r zq9XG@Px2oPJ(+?w{bLaqBPryS-ezFbyC78nnLvjf>N)vbi z;azfN^aaIMkgXpeFzCi*abTT5VJ5`(f};N69ZC-p-lSv4Mo)M?%Cf@r#~Jr_eRvgo zyZ?Il!b%vM_y$y*>_H3@r-fN80ZpAnUqn*}js|oDG<8;U5ltO9DNT)KT1Zm^PDWE_ z{T0#Ffs@hHSy)9hb>L()byiFfO&vH&6Bp7^yIp#-ovimf{&d6Wa{Ht61%)EMx&9L= zV8M!jGiRMucHj?JX=FXw7H8#&)?q>xMav?#mgGnqmMJopc>&$RR;+G4H0svtZWO$tqKF38q<~jgEXmwBtRhY2$$+ak+C7 z5oeMa9;BxO;iZx6Nega!sQ59KqybYx&09X7KOL?jo*$%vYKD#F7wYZHYhvac&qVjw zW7QTP-IveO45fln$v(EtO|qwFB-x;*^%Jdp+`}ogpWMN)pTaE+`&+Vdi~N-)-lnqu z#zFWeykvm7-j?EC0ZzC>(?wqUwqKGhED)MZg%j_Dn_Av8U+Y67uw%L}MYqq}N8f(J ztUg=!r!%gsez#q^8q$Ns1CtQidCw@4PKq+wKWeGM!KHlyEQ({#^LrrcyoRIxi+5h5 z2eQs<>==IW&TI5Q)_IMs%P-z}jUKShpO4#5pRiVQX&=mYNFDvfc`4)|#4H6SlT<>^ zz$3!Et8_8xEHXi=1y4S6+@I?Ar5x$uC+B&oEQ(T?GZPAmJI}v5kI^x^5HsN}Y9Zh& zbr>wfk^0d7pS(oJXlFQxJ`0i2u=yHg zit>`ghon*kS+L3dIz(;k)n^j3VdVIq$`*pq)QKTMXnREiotb2A>W`FYLN~>XB?ibT zi)!SxAoW_CacBX*dd^XH$-%qL%*|rcMbt0DPUuh(_pwNa;=>M=KM{=A11TkCG9c)S zE`hL1ESg<4?@OGWk5Hdz9M}jMu^;0kGd*OH*U><2nct|ZNv!nnMW$TXL$lGj3KwFT z1fy39L#!I%7P5J!5B3E%HGmEa{qPg{9^9!! zFBGNdu68vDC%W;}gI4P&)K+L_8jgb>nt-FSq`hKhC4Bbsg}RZAv49W$$Cv2}^9X~t zW33)W4;62Y;fv2f{dP_k7-48}O`-=B})6Nk_-Hr6nRE|yY)jTMW^^*+gW2=vx>QMAZnX>hb5Bmz%Vy0k_)n6J)p>+H|A&y_y!1WAc+L; zPr*%TP@~HVNUB*QQtF31D+GpOj|qSICGIb9Y;$Hg8l)FzUVrlNBcJ{6 zgngnVnqE}q7{18AeyORJ?Iiz8vcr*~w1Wy4_TdTVzr4o%SbKUAL;6agV~#Fj8dYQf?HARN#vW^;2%DC|&=(qj`eSL=8 zd|3Y_stl=OJIRG04Vjb9Of8@qLry|(J_ZQ)$#K6Rn(WzU=kx^`itPre;m^-#B@YkW zIA@kaH6$-NPAzhPl(lr#u*wa)8dSYySHoiCjq4O?S3w6xDwX$JB&L3PcCh8c5aN&~ zIwIlL&E)(_g0Kho_-GfU1!SBnklJSRIw6`F_lYbDQhVp{jLjupUDU;z;F!LFN?>{C zOCH3yK{f~Nd;$qu47Z1q%;{t>iNT12O^8qxf-4%N60pI7U8*=)c9!!VfC4fxEODeP z!9;laNQumOKiS`tw-@bTa5l%oqkaCo#iOFq_yrU7m`9RIYDo_EJ#Qe=)5i)-RARK1 z=pJ}<+{`L~Nj#$qBQj+sJuh`ckzLy~pfV|Nsj+2@YaxoV)rzCgNov#LMGI1?nhgk=1d!~$~&b{584i3spAu?l3sW9GaP z^+J_(N+f7xb6$lYYu2-^=>y@!CS1UB_{jKWbA)3c+u1OZmsrt5x*ViZ+Bh;42msE> z7JJg92$VY)0Txz>GKoXU3z~Z5ZeNOS9t`Jz8w?qwClsKF>#Xdl%q0BETgy0=KoACn zJf4tojSXndt#iSU1X{t)c2Z(C9bR6;+E3)A5q7~(XNK{xyqB4FS`(_x1EriIZ8*F^ z?_oo1KYbzb7d&Wx4&MNjk_th-)k}A_d&~t;%27r|=4;E_E4TGhFy)S33Z>r6OTn1e z&pGR=mXgPQWFWygQ1Y|z2tH|mWP)aKwtIfBB|d;pq0979A5nT&LItJ6L3W1eg6i#0 z^s%WoDf)PHb}9zgaxx_3GN#XH;IT^>YFY}JT#?JtJwHE@i`B`+CdVQnG)w@*8YRd?FDv=i@Q_msSF4!UM+doUmrb_ znRo?FvaGW?3Yi@PA^tn6lu!OHWmX5VKARwOnLDZ6a)lkdj7my67bBC3_A<h?F5_B9fe@J_h)*vp9?^Cyj~9CrZ%4UwF4j1t*>eLi!Jq|pZ3ygLddQjT5CH{Z9w-HrIdo{h(B9la(`Y2V`hy|s%5?)yZ@}TQ{ zDt8my;+G?0}BHp)g) zRvJ(^Lb;l(H12PRWu*aVAS(@Q0$FK5T~k(G&ADs%rFyMgE!Evx*=^LEQoZUq&8oX@ z-j$?!r2%LlD-CP{S!qC}WHrMrl>H{C=EN&poT35G)MuP?7Fw1HooW&-5!658KFZRZ znVF7Lln=)YX>krRhnoh`f>1u)<8l2ue@6W;kKv4euBH5M`vZJt{su>QAv3YI;zvG+ zM~dj-+CcJ}3owhfhS3I;a1nq4d+OXaNEso1$4I#r#^km~jY2*{Ok7^zDzuuE=lLyxlL zdQE?G=iH)5oPT@km8*{DY?^nQTes@El`@uMA~u$<9zj(b8?RDrc+I-!_)myjOtlc?orQwvEQn^xFH`ji3U8y(ASog(H&2p_$uiP~orTV(I zDSPGSn)nOr%^EJmT~)$i(_L@sPNQD;YHq`;*PLp#=GXAAb+hi?`b{w{4WCgU4GoVV zhO(R3pvZ2fHaZrDSKK7EZiqK&Oy$@=Ib^C0k%k7uj;kila?`=cRK3Qnvo5V~H)W_w zwN@^b8cw2!)>#DylHLI0M)${JEMCXigYE<oY*IfNP&GmX2UVE~MA z*6;lCdR=mA4X;#b-d68Cr&9GjSei=HgO)%v#yM0ba?&WSY22qqe$7gAoTvy`b(@>U zrcrU~CD*-!VO?*$a&6;yb=N5}eKbt7F`pV?7IU1AgZ0XBH>GmPt=*M3>pEtQ+blKK zwe{Uyo%Ed)RWTX&rjvWa@fwvUj9AKF^NdAz+t|3(vQu-hYTq^?vD;h6tKQz$J-61t zUyG=X#wu&f=UoZ9eOJ9jJi)EsR!SZm1b5^6SoLok2wD~4)A33TcU^`jR4RKujEnD9 zeC%w!X2o}J?rEJ{yT+XdyXBPOr^1)KtrZzr4Uf&3PmPMJ#yB^d z#$Byh@;qp=<9h2R9OgS8?oNGEsa8rxeTUoGLD?!&mfgNbIO^#7L5v2qrj7@4Cm(^J zI2QMU>JLAv2f)gWW z0O4j{Rvt!3g#Z=3e3NEC^X82J3>=tWyNU56?%c#bUnc=OfiHP$EdC@8-X`}m>VT^u zu56H#s!}eN^m3~Ql?^^>!RZAJHBqTUews*hLUp>R#|@=W+8dzun{5g(-lUvJaFM5X;{vhYv> zsHpu3aCI%aRPIbB{pqaRwpuscE{#CZpJ#(^XW8%0tyV4ivC`?ZM~hj9wjDfizxVJK z$)q#2cF*yT-PvfkSgoekjQg?QUUp~GHd=ad%h7ncTFsYe$^AI*P3M#TaA^7cxaD$5 zs^Baq*3&Bbu{K+_C!OB3XPuA8fG06D(u4Y}y;?42Lu=#gaK0A)+?X#1!&Q6Gv4T|Y z@I$lLopl!T*~0q7lqCYW?RFRQ`M7WG53M?LazY@8V$him+SC5ZYSqv9&M(zbtFF~u zj7Q_)5dZPn!3}jUK*V4oN}aAX7|+_n$+T-BOo)o+7-7;BXKIhFI^S+SS&e$_Mc*2; z%0jLB{QZ5ajw(Z(3{WtrJD;sagO%0Y9ZnS4`RK5O;ZuyRXAOqq_OLS^TF`QWg;r~7 z)q`?PQAc{#usJpA#%*WUocE__hRM%Sge_$m1$HUpDP2Df3$yk4c_-}fP zq|C?GsJ$BZ7lQ>y<6ZatNA>oe_nj!?vd&Jd$#S~v&VicEG3e2boC;%5 zk3PI66bp+dI;_TUIqtS+Gg7kbd^~(tBA;55MX%joP1@EIyKBQ?KY_E;W}C#m94;2^ zLAw)6o}|vU>g#9six17E6&7M~POar+z8p^b18aObJyT|oMC9zy(%E}k4@*p|%1_3b zH5jc{%gG9M5#r`7K&!qzwdx-07SGj;^m#a2O&3-opSD##5thzm7VHkFUli%Y429Ju zv;MNXw8o#1HB3y%BdgBasvq_uBQdwS5YwXFo>;BB@c%mf;ds%icl&SOj|UL@`+oSP zbr(~cTeI$B+U@r{@hl_e2veCEBq9WA?-DSuApOxO2KnTiKV#ihfGpeX-n73MXJieb zxyLQNmzR|G%IYj;{Xu)&wcZAr&bNiw4qqU2T5c_34$IqoG@C8Q%c1q|%l7Gs@|3Uy z6oB2s35DM6ShL{@$~jt*Z5Q~ck}Wd%cT)GsFL=8vHd9zh$DL_sIfH>79x$TMd;i;$ z@1h*3XxL&tyVhzjTy$28j+M}(a0wuml;{-Ikk8u~5GK4moh^sZ^ITTRqarb6-x@4d zv)*_Go{1riObjR?g>Q>7|7$82*l>pjn@`96e!DZakmEw8M`9Q-$69r=U_ScZ*5Rg0 z7baxTo6KgI!6}<2AQ;mF*l@L4VD?)nGnE52nXg9ONoOQhmn5G&xhd9y8LS?4jL5_$ zh832J*izzY&{b>1a9zV6Kvr zB2Y2OiPgp2Zx8zuHXm^d5JQnLpwSxj%(;tQwD0z2v))oZ7)&q7c<}V5o!)A>oQ^ z$J3nkr;F|!?qKeCK;8d{A!pX4Gh6lG`sD&94eQLB4!X4E*3D=MhGVL8t2YL} z%TXssVNi{8*g{8eVPv!-QjrH&hIBNwmhrw@R!T+c##i@2P?Vx zys&!R&Z4)%)`>1XurHxY7&|caKep%3sF}kX=7lwG52l^@pqo!J$?O6e1baScYv{oq zwlMDI!h#hTEwH69rMa|b?f!7t>G$#>Q4o<^Dpyt?3N%LR=dANCh*&9x=!Od0negu-E9SIo4Y9LpcZn0hamwI4 zUjaAmEeDG>c2{rxzl7sS*Z;s-!A@|zCtfMuxPIF1NPlC~3|7esH0}?vqL43JjJHD2giIq9Q0T1QT_}$!k>!A z1fJ-0upIYi8Z^m5!b6U_s~)yH^TcRA@4xI1f50Dk`@S2g9n>)f99rYmxIO6)2Kme; zC*{zZb^2In5ukccTvd4G&Jn(=w>^=fS{VA2Ht<9jAd2wO3_9d)iQwVF5`d1zm^hh0D&drEHE z>cK-pgs0!dh|--gA2Hf zt>m#2Oewa)#?)ZV;esM0+BX4%HJ$gzv)QzVbqgqovDzQ@5CPdgtPf{|GF+}saA@QP z5NL0P^=g`N>)z8G{ng<>x3bZz#~kEfIq%KK*s7%#k9^4SWDKJ-o)mzbE<2L}A|l2# zC;ioY)`hcW3_0x&+Y_j&Ipl0G#++Idpt%^$C+&7OvqWBsxIw>Ui zXtYvEG|;F9LIa!^Da>bB(?1(D%oc2bdRBAbP*KL7_u3UEw^xN1pU?J&zuB4veC@k<)6>!hv-@g`GPvP~{e zWy$td3n$ZKP92FmV_DkRgsCms(7pJihS4>nZjkDt%aYd9QToWVQ(p{F=A^)+F)34F z(v34FJ>5XP4yIeHm%DUpnNd!+<8(ItNtx1HTYTnRfQ-0Do z#Hl~2R&PtK_Pug&ty|({l6Fxs3XMx!0w|4ZSt6+Xi&p|DjjL4xD2>ZgBB=c9Q9`KO zdV}0X^fp!86DT9czr4P4>m^+6sFf=uyCw;UU zPF5kb`CeENv>I+&5wse9Tp_gij-K{Cc>NJIx(ct4R>PAlA|nk~^J*qQGP5-N)*?MK zx)!fL4vl=zw+Ocyu5lr>`Mz@@wE50;d_`Vgwm66N*JS0svO&@S7w>OE6O&U@i5*BTZ(iqfXVhs$~VCCPfSN31|eux^9mmGhP zq7qupC3`hNgPmVW(hsr_yN-;-N1kd{xlp};gyunKf`q{trv$F(@umQs=E<3483?YNKP zBfFqMncVIqNn1!jlh$x#>aT8^3M8uXcbK^qAm!qcQN4O~Gih*D4HiXM)yvvVWDRi} z1!fI#8%1YLabGb+YfL)#KtJB&8R9ky)*9k|v52i9A4XwYQ{4GU35CbTD1d9ow^0<= z6t_tz*A%x&Jl7a^Zc4?^T1hm@eiv3VqwubwNR3LO8satz^cv!RfoQKG2N#8WO=;z4 zv=r7Zqu{S0-$oH&Q`{zDU_;zSv0y{oMgd_>+*gkZ3+O6C!-DqlW;(y*ss^}DkXQqa zPNX;=jaIl=1C46`tpP3xhv`5n@6Tu;Fx|_hv>_*stigadn5+%R#o4nknqg%bpjJs& z6>!l2vka$Zlvx2@DAb(AmxwoKKVK*4EX13PJZGC|#fv5LjYVDy;*`XowXq2U(b~|G zXtXYTCd4HVN$aE3h)e4u(+*A>pv;L-r!gt7Sfm>(W7?UQw<-9{?ALG#GAQ)o+DR}$?75%}1elEFaOIFg)Ya?7tn*M7 z2vz5zG>=f{p)3%X&O=!s9-WKw>S5@7ipJ6BJd_23&Uq+bIM$p;zCegM7o~Y*ITxi# zMsR8kl9-DEapXKMjb6&q59N!+ zfAa`mA?%w=!aUlWhq6GBHxFfj*lsRL^N?;H$^wzxJd_0jxH6P46t^YhG{Uu{S-dIK zjnays^n1(GfuPuCr^K3*tt*Gq+)<^;sk3zDzbq!qiYXoM^)8j;G1ogbjAa7$1+E?H5B zBk5;R6tW@@W!?i1-zhfdG@S9IhNYjJhfb1{BD5%|lrrc9@IOJa(9e zvOw%G4`qSaVJ^z6#}4x;8pjUvP!@IX@dtOBvaJT6}>c9=)_3bDgn z66UePJd_1uhj}Oq#13;&n#T_FP!@`>l5lZT0> zMzO=Fy+Q0S0draGFhXS%JLI7*h#dlrAa;mfuNgaJ=tQwYe7RQaP#2Xlb|^=ph#ks- zl(9o8SSGNM7dup7(vBS}a2Uo8RhYD5hgFT(VO1k`Sk;IfR=Fi89XqV5V~6y!D0Wzt z#SW{g*kKLJp)7XT=+KvB-U{0!qj4J1Lmr#TZ#D|`=pr==_GlwD3HRtCH46CXA~g#6 zXd}I1&_|!9LD)wZsZroZ7wL0cj&O2?A*&H3qFdqtK8x zQj_42E>ffLkSq zL>P(t{W^i9B*J7UiTieWFv%2|B%G9wMi@}a2a|-9asds3N*cH{!b%!gv;#{zxN<^E z5ej8+DQcw*FU74?$!Sq5Sr{qNAQ?!CK4n8m(I;^*iGH@*YiI8r_NrQs(Idbl>a_i| zw?7>Ze-MC?bNXz5#e?BkuHrW>@fUlxJ)Q06z5CgBzxbZLJ^M%Jd^nPZ>>Hkox9-Eg zoXBykZ=b(E`6u%0le0ZqH#gnR5bdMxD%bL$UN5VnDfuVuhdqsW_{scLEb<=m50~kf zm#H#`OfA#vOS2$nKS_=dBU}Ell436w zowH9&i_+nb4N~{Bv;XAV&hhAc2N-NoU}a99og)m-)A?vA?FM?Buw1%uRyag$@V@HCN~U>EwL!gPP{d@EYo((c@WS zrbtr0AyuP8kgHLBu~QNuhl0d+r9n59q0y0xkVBf(WH@q0k9=K^s>z|v)uRgYi z$+6G%sG6J$iK&tcHHO;sBi|nrGJTDkC8m8gIhYbMU1Z)Gom^dys>#vT)u~k%Sdj8HoBP#iMd%E%l7!d<|LHD@^Gz_=9#b}sqZVS;c+{zZB zVYqQEM&qj6)PgJ+WY+abpvqkB4ELCYXuRN#vJgLpd%|KgOtSI{j-AnyAq8m|?(Pc7 z%BTih(SDfi+=}(%2UdwIDh9J{RUt7LZla3OFxxT}qG7l}Dn#Q&wnK$Dxo}%kjHXE@ zVL^>I+@cifhv9~#7!9-SMLSCD%9G=M!7++wpPkbeq;Iqv?T;US=MSv4k*Ts5wUJ0t8TH|nd5zj=lu3@- zSkxJh+Gxb-kA~n}E+h|$Jct85Do!gcKM>>unLlXLLSU-(Qcg@YUWUk6+ogzfHC>8; z7p~#Jqk8JJ>rL4odraSMUv?^QHaU!* zq~$ydJ;|9zj7${F=n(>A-p!*#CcM8;d`MtKv!~-`8ghC3NK}~CVEP%JfE(Ho^DvUh zFq;REjIbMrj!dwd2aQayn}>^Zu)j>8D5ShUoVOdgRhE@;p;m@vNk8wmfA#F!yMz11 zdU$+3``?0)3UaiAL*#?4z?e*S)hPO6M0;>Jx(N9k{m-}yM7B!gP7uB3bN}c(+2^CP zJ)bQ7dpzLQz9+bB_we|H9DZwv3qch5ko6mX_5bSG+1clVH6)4cmE`rKi|!9qtea9h zart6Qk4@P+uh&_fYb@Drj>B$_v)vr$bW?|7q%@az5X`^e&6libE~6L9^)f6N0bcPg zMyAr*%a8*)x-utRv%{n|l_CuN^OfTs zUp3@mO4}%t#SFP&FvAS_3&t|c7%>b_7$P^zRxw0wel0=Yk{HG&%s4kpOff`m7MUGD^8S)p2Bbc#pVSvDpm|13t8FIr|fEjYb zP=FzFvq*p$a>GD?8FIrofFAM}2m>Su+a66aKU%`#viIz&G`;>oieuQ@{pMh?vJr5i zZ4}XXrnlu~VT5~ZUU5Nv6a)&?FxWV7H`p}-1p#(FxF}iyCR~T?E)r#c-nH#1;vLu{ zJZu~nyAQ-WoSlzt68WhXgc>8*>y!#ICz>oLqzR8|DTsxj#~uO~zIFee?2!ex%VTu&+ZBXUpyhVYRWI|4YlDruSJm^s26i0U0 zM$x3n>cSP^BfIy_<3Iu-q>V5a=I+Knk}4CCjA1WiQ;|49_JT$L^2x;;C%)SyIDlY(pyCp)fhOU0~Je>kEc=1RM&EU6sqJ>Bt$z zhy)y_FU{-7&^Wc_D*9ra@^TfbhT*0wN!TzBbuFr90V)yIRIv*kZTit!G#RzHEUl)H z#Wl{Z$uM1H-WrC=MB`h);u>e;T&1su!L=*(^+lp?0^S7cihQ#Jd9osGIw{OAP24hQ2SSXBPCnn4V#{`(k>Af$q!cT{Xmg1$GQm4T;UTKz$A4 z)))8h1tZoM^JW--zMP(E+Tw*{Z5VUDxPOMx=F91sUB$edo>_$X3iN(#R^)~1W*8Q} zSUiRS;mhfnrc+)hPs1Sa#r=Dc@bAT3T^Q26oW5D`_F{U5VcU!883t@Gr)L(by_lY1 zkoIDFhT+-5^sp_ueidS&#rljiKIC9|*e)Np&i-sWu8TKH!W|*YRYC$`&?>s_MK^T6 z1-VS@JO3(NB|`9_7XR*I(@J9v4B+$~Ti-{vIp*49vm7_vdgStIlw(!sJ;*q*>^(!r zk|UF03}x~In#ReJ25`xIKDHZ`vmiMqQxKOx$jJ&{t$OJ1&&ThUB(A3-uLR8JA{C5G zQc8Vf3c~(L^H8ZY@Ao)3xF8Gf1MUo~qD*nVp0s6B9W)XrW1Js%K6wrCMRIk!!Q4#H z0IyL3>19c}GW1*y>C4V24F)8$BdKP|v{!L?uSk=5qMy#>61s3g{kWbhn0V<~ttpEi zI|$MGWHbbNP+D3Lq0;PkUV9CqDMOi5@6<=$ibex?bm*I`@95)_ByLWhOMORz(BVs| z$;9e+%(ggBPyXIZEzh$2=LB25s9PimPfiAK8fH&>#5us38XkVV8rDDcJ3+!WL(Cn| zovfAb9}$7y<1I&WZy~-NLC*%r3bV$o31|28*$EvK!fccgju<@tT47#IP{Hr=*PiDz ze;)$ljH&ck5j>g@&K@Gtf`men*|xdF((1+|kH4{#Pc_?FZ-mFif7QUIcihMk$OF)# zsXmHKP?I&)qN8&_nV_Zy(4#3oyiAf3wF@ZF2UUm8`Lj=6wIwH6zIsO5i_Ex`t8_UJ`qy_^-kmaRP`=zPtnt>KL)J>&!o2Kz0S0`f*ab%-R52;qJnyWMs_$@&fYy z;oXTwYI}Ne&hFGKaL7A(Z0RmErQ2A7xA#dUxZO7Nh;^&z8XB`IVKC)%3tXpFba-PtM*u z*{3i;JDI?qSYpnH-Qf>xC4_c4&~HT>W|!O4HbH<4rB|wF$YaX!6 zf=SANTbfZ>2$gwFd(RC{ZTyCQ!$N3Zj|K>-opYd;>I;T$SE`H|d|C9E>g93Pds z<$6A9gz$7CY1C>a^iU#^xR-c4Nr5zQ!nk3}d6kBE${>JP5yZ`63o51s_!FS%sTQE8 z@*Tmb?qJx=*iV4cup85~0CV!W8#B~NSP|=668XQ*4V}tEiQfMrHJFgp9%4=|E$K!m zwnFwU(GEqY{K}k^Um;Pmh#XP$Ey~wuYf;voYG@ImkkAFiUQ9DLy6QdZ~D`4ZiBIe0!B z%-@I$5?p~HKbEZzH7?2L(fP)y0!|?@lhqO!k}fA6phH_c8U0eLIo+&(&QamDGdU--V~=ja(LA+|?g1!-E2_uWRA z9l16xlEL-|HnQ)SaL?OEKL|VBOWR^nde5*SlK;jdO<5O{q7VOy|>fR1Uua zhYo*87Y{gN=F}r^>W3g&6PGr|!N&&slp;&Xh-wF}gk~^cRw`ve)2kq0)xZTbO)nwr6=d9!S0=#TD&aRMrm;%tPETi-aekV2GgM zn8Eo%vj@{~f#Z3y@+Y*ziU zRJ1|WWMwL+Bq#%lN#P9nKn`_nlmg8y2KpjNh_LdXu$;qzQbV~Z$5H+Q}TCHdarPP59$;Jkkt%JD1j^s9i#D{wT%aU`V@x>(`JDyApK zGtDrMPToVm@nhyNp15Pj14C_MfMM@Qhfco#<*?ZlSyrhVxp_LAtb2RDK9Tf}GYTZ* zNN>VcTmkOF>#Y_s!b<`FK#H3bJf$8D=}8Lt^?SlmBd3+uNSh;zTE_Gz9Tj;V9n(3Y zU(jA%hNzp#KQhh!o5mS(S;+!(8&D+^@rujr2K}duXu7d3k*s-AlF2sLB$UbNO4-o- zF6v>>W(VOGVKSNyBWhS}7E+mI1tg+_L7yE_GMkP#6mm=wPlPg4-Br6m2}s5hb=8BJ zOtxVKj3lY_hn!?`=EBYpPoGI?_5F902QlB0*%P|>oTb|qBgZobm&`FtiIHOYzAx0D z5dl6QP_K(*ZicJ%1%Z~bH74T)bR_wZ^TN~)2Ql|iN|9QIG4^7oF9B--uy%MM0Ar>; zSFfYK$i@)8crF~RAcKYwV>Vi$9a)fKDC{0kO?rOv;7w5(y*nM9LRWOpOkgBdIg7d4E=FA6?}u{YWzz6p6avPr{Z z`F6r#Q{v)-?zq^K*iL;rA*rP>7TlE}854H*J&N+ZEn!B>`fuH~S|!;>vXR5ph|WWa zT#cyI(g>4siclqgRw2nsk|N3eoJ3M9@tkb;R9|e=BYJ*BHgMnpl8%W#C6TdiwJQoC z5o%F`Wbf#wDqyobN1w!8(9bnMX7A6wvEPr?{KVhW?7Sb#xM5#p%)B4Vcu^E}d}HGs zSDYo(Dy523s&6VK_P_A=`X>7Ox5q~-_!|Bz_!$1RR0fzvGgsKGoWfRK3!7C_&8ko( z0ntn|F>je>m?9KgbCdjE`tNT}L3Pa28>lI~&3o@@{`_sWMcjRlFiUcgr?2700SC@= zAr0@(4b={Z{?Hw`$cNpTD*0G33ZchX5fKJUe_ zG2qPVwtJ)bs)r~bqr$qEB(!6bA_iMnlm22loOOoQeMCbF8Ns1r^G>@nZO^+}vKhya z9c#E4_a=*3PYbejGg?yMVIhqnGYp=vthU)-BPbx8=6g!W-3n{Hw@>XGkg+ zz*aASg>ewal(O@b+sV>NcfZGVG91Nw@6ONr!1jdkOe-@TIGc+rwQ%_E|MGe3qGsgt zH+zljGAI}pJ7x~ahLTl0mzRB&@kf2iY_(S$LXl&_0)3^)nu{zscD;+_tVDZV+<29z z|Fe~Wa)$0t%`PK8RW)G67-V6@IeQ%8&?e`Ss!T7n3m~8^-mN5 zrS*S_vrYc6e*Z?M9Q}K#MAr~f)HB)oLv8&XcN^&dqVb0ssr^g;MuCIRC88YoR)V`D zKxCiEd2pI8S-HR{Zk|2Bw&@x&gjIU#rX><@%BE8He7{j~ow9Rx3-_~8@kK3s`)gZMkNW_2aeL^)GJo$L+w4O*czN5 zStX0yR^vzGt-sqk>+OzQBV{v`8IslwB1O-*lT>aHy?8!vcPGwf{?-oiO`~@77$Vzj zOwT6xR$~FOFa|LItSRL@qkqvR>0TN@U?YRJk=292*Y~Y!R{5Tn zTp+X3c<&w_f$4huMSXdYru)_CW$IRG`F#F_TVz)xeqG^^xI?(DNmQ(g_XgOba1Wgx z)_++^+Y35NxJ`)wfFBs9(pex}AAo7IgPE{79v*Q`VvAEk@yIcCA&X_O7s{JNlwzV^ z8UvXI67#}!Uaf9iL$zwe4T<~3nQDn7NxyId|RrIiq;Ylh7jT*4!^3$H*BRI+@KZRkoK+N zaMbU&Cw+^gS-@7b>O2S0PIO=m2c6ks*IJfE~xi8u*bq3aW0QY&hT3X{h zN~M#%|*)T+~R0AAd7WG$zo&R{s~CpN*v$6Bm9AAkAzPwVC&>xE2lTt`BRu1%g9~dp?{vC@@gT{`X9sQf*a)Aa%L5V2 z(poL1%l@dhN^c7}rpPv%b|s>PO?qcAT8vh+xr7$B`Uo1g>a^Ak57+CC`rY|FH3&rh z*p;(PTEZz_@O5~wReP`)^d_q$xir`Ty*xd}a06@58Ffa3-aMy!WWURL90O0S)&WJ**BEYQ^?TjnV$>bv5Dil9BFJ9X8cloCWe+B~b2xv7K%8$Y zq^|hq*>>ZC!S3>ylVemi%C9y!n=<|@A4s(89suek0xEHq! zq7S5j+H7$R1tRBY#|=%)JO_34#V8lI38O~qQIfL8lB5QZ=tKgjkc$*zFj?^f7(Q-w zWhWvV7!whAvB49N*BC(!D9JEpAq$OV8jX0~r(3Bff4a5W0tBslt8pCCyr3%xYKq3) zL|0SZDPvHA_l5O|P}No=QDdd{0N@fyt8}HJqaqa@%|N92MFv!Y_k{}h%PlXsm04^3oBEB@>j`DnctHse6Bp1|Ja>KJB)^6gRdDx$;t{-OoUbvN6(Ii!!ixl4_?;1h^G)4e z)4r3{haA^t-m;4x5)q!>gzt%vHwzM#?fFwtEXQ==ad57R!{+!%8p#Cga3v^g&gy-? zqY+U)l*q+}NKEP@y|dVEO^9>|P09Dc}I@C#F%g;fR2-R-y1&Gy-azVtw(XB)bMCWwf>L*+S zl%OHJQ5^~AF-dF)o)Dt{Nz)z@(-RGH=51k>3nxCC{zUhJ7=QjILm=c-T1lh}0-VO0 zVSw9MITX0h2lw#O)BVVfGX91t%#ll8ky|R9Nbnvtf4Q34XG!Oy1%VyUNn53Fh!10h zZr!v>H#hI$rzaBqPFMty4Mh^H$YpCJSUoVaNl4;v_!oh~jKHR%eMUx!YdfBY8`>w^ zK}sK~!xH}fgb!F@kfOs>p8k_0sCDfL&gg|LNzTq#=Yfixf*2>(zB3#RMn0lyVhjh?=4o-e3HZ# z#(+rc=(eZ5#d4Vs*@hb)Lr$#OY(DLF#tJ~Lpk@p>wR+v|VmO&*asjfvB&9I{$>I4F zxUDBEXr10MkeQq+a*=IG)Q|20XiG8*-Ox%a8V7?$gUq`2v#hb z-2B)6@xWy`kJ-|PeJC1_g9YWr9%HdYCiHrHKG_5Umz9IXk){d%|Lnc_b{o5nFMJ-x z4NpL!CySS_&IUMfW76oL>l6dC&;MWS> z|Gv9LEdqb_xTd|X{IC<}QpPBn+a*3+fLd1Qp9VQ8{uAgK>vwkMI$6pwk&Q0KBE?9j z4-;4JxwL{6G%8+h(=tM&#lubrxq5SK@;cpnm-)Sip%Vj>AsQDMzfxeIxt`C~`a5Bg>CspPB9JVW%8( zFodF68k9l19G4uEa)lF-4jV=Un%S*jHrY<~rj+iNm{5U<_DW_T643dZ~G^@T+>r%q2*z=g9J&^Y61Id;(AsNu@(K zaHNBiv*FvA%(u%8C!#gJQxG>q8pBM~!j@%*pb?2G zp_x8kuRQ(H%sC=DBB@6L&qVi}WZ#L##-vCm*Utb35Pp*|ZU4F7QpWgn8)1P*=4s=D zB*@Y40P7VmdlIx*%s1B0h!14st+U)y{_->uVZh3}Y&4Aiek3(C+e+x(QY)gsw^*H( zcLAZx3ulH(aK4IqMfqHV;>4n1z!#SISxekPP^&AaDJg}*)b;ypTSR2SE`O0TlQ9&1 z@%Ufdmu7d!J3{UdxBL0V-fT>AlSlyrh_yutvDx32chiNbWCyH^Sshr)Fp*B#>Qj<|n9)S;Uu76=rDAU5cKHlh z+@4MEs4?;c^9&av5G=~fE%y0g@u_krv>?OwTk`P}V5*p%DJuu(G=sGF>1n`J6RUP6 z9Tqx-G;M=1wIuU7ONantWf==5PmU$Wgks1rK|F(m`Tf&*N8?%Nw>KrGfoCy>4Yqz6 zkn){XficVB*R+CzDTcC zg|rcDm?9o8m_f1dj`udE0q5W58(fTWuzcX|*NoG@`7x^z27IJmzzd_i$hs8H#}8Aq zlTJ23`CdESFnQ^2CG@l%vxFUa*_44Y=T@KMy!5tJJyXq0s1%BQ>5g2x({l&bD*CCP zz^*&qVAva={OxYfsaMG0NzJeQ;b1a#x)Y0U$Z?qTH3DGW{uH65RColA0IJ6a*YDar zXWX-1S3gh=CVox)=ue?O_X68Ou8IvgitA1vha=nWO}emFow@E!>!!W=xwtv=0{Um% zYT_eyy65y!RVJGMfDqN6KKcD|Fzoal4Lio@)1WsQPwd_R-|*Tw-y7IEjy3hWsv$#FLn{!L{t_0V0*8QUY68$g`)5^=vfb%an*Gj6FS*seA0 z4#(3`x0k{*3wLNaz3!mf11k1{(oV%_&Jn-NnNbl`9w%UPhE`w)!@k=CH6jYPm-Ix9 z9$=OeN{_s92(k7NAaC78dy$4tk;1U6Bu2rTvpWeOi@bi^Nh}Jo@Mv2M@d){gYC54` zXKK5XK1hF)Xqij2xSwZrCg|uRkAS&kIYVN=xLen9yY_TyPhCr^E+E0vZ2vu?G{=a= zRw3wk*i);C=x@*OAQzq8u>!=w8`>5ExHW zP=LJtHSXF+_JdI{2)sc|(fKPJ4-op#+4g38Jl{UN?xP)%HSXvG*|Fz(zJA5m(Al^} zW8%Ig^5@3;6gmDn_Gs93r(^3D)fbo=bg*Mvi&~a3t6@pw@dj46JLuWoK)?NG$HQe= z9@KHap*3;?l;!ry`w2X~xZlX?dDEWjk4MEc6$?s3>VBSs9ERiRcod8(S!Nl_KV%N* z23U!Hzmw>ew}ZKXAF`rmb;{2 zMKXYS>YC=dg=QEI$G^0)4D_N?Wal$eL<0Y&4@oaQX4P(MKL(!X% zF!{1X2^cfaD5+76$*~@shLCE`NG9849*t66j1i39sn?(?eMk(M_bgOAnlYb?R4W6K z)H_c-MDiYdQbQQiHV{b(YjJH7lS{q#R3W0@ahk8O?wUfGslp$t-f~hM({ru$s#6=r zWcT>1`5j6GN71zveWgJ-eR-^XvxFKVUV*|)kjcR?RlJElH}e=!1!Lzt&Y7J|(yMDZ ztlV_w*3PVbl}HoE)=P(GmcOGii3v>BO5) zem~{jyDWPuP}A2|7CCXg*Wkj(+FTKQ79XbP`C$fcJ^+QdA@cCh<_4=dyxGOrMg$TM z)y5|CGc{@@<2g1L0j3*OX-Qk%T!hE1&04aBi%9Qm*{5m44q2y)*m~7dH%De^ak=rDNPnEWF`Kzg{t1lR26| zHv8qkPTCF+Ay5)R4Kf|P?!_`NxenzjLp2*`A9al75VzRhBUr@P=8EQXLONn9aoP(e zV39?VMZh$RW9Gx8W51}JrZ{Q@q;WF7H6NIY7fyu>2_bNeP!f$aZT-sFCEMi zCA(wc9ot>B4KA0bc_+*4&*q9Cp>BG=8VU@cCp?)7XAD_uO4dXtV+H9H1@gklBxrJ`NO{ikf4a@x?68D(6GWe0MSb}Tw z%Ef4EyGtrc$SO5OJ&i+v6EQbjLiKQ! zW6#LWGHr2CowF@@KJs(gAen7#z}18_tc7{$O-q3=m!(XOy=;%XvGOdF*`8^H4g2Cj zgf#kR2V*p4i$W7+wp$v?Q%c({vyJm-l4rUs?Q39^E$UQez$}HzGm+bpbK^A^zPfjIpcwjOl~a;m(~5Q=KL8-?B=b?Z*j33boXc-fqQCucbLaIMksS6raOL|no@cNs)&rQf?2Dpo=r4a^^02MbJM zC}4S^%Ec<4f|fogNlIz;E@4Lc6IfC(mZ3?eOkITIA(3x6a8tIdgCXY`yZ)(CDM5IH z^;q}M;i$CUUyomnQ4~z(`It2`mju-=&CTk9puRI4`D5A?rrM-o(6EN4-c#)~PR2*N z$0v+_s&N{q)*@Ad7_)Rn)kF(YvZTWa(l15GVJGvhCR)WRQYw78pw)Vn&6~ss(Ng5R zhUwEANA7x+%%U_}|I}HJ>cenFmevG*wFXb7St=V4JNUS>Sqsy(PQYIW-#W~FiGQ4sy~yG3^_d`YmQD53qn z2x#_6#-OUQ?WH7TUxl({@_TAjneKW0!XZP+~Tp?&$)_jZchWN4hbp3si^An z`-&&#<5U)x6z?c0s;+#;lBo(#>EbgBD+qZzMSlB~_wCF>BRQSJFQoUZ!o$|tnqN@PP^Rzg>s*kJLC=Lm_=2Q1Cg!} zyqq#!;Rj@q8rk#49S6aD+q%7w7TNC%oX*H5iziKh)HC{TVpenZ{)HN*r{*Gv)9+85 z!PqJ7sW9>5o&#i59t{zO8!+TD@cu@>9)W|Ja{tieI?gH*X%#4N+W zaNMp>TONwwRkLCmk|wbcK$vPHUnJjO3lcAkA`z!BKoVobb<-fZ-W{oWqQ`iYEn2D? zVwYt{4N%pqZUD(!@SJzze-^!yZ_(sMb=-cd3$L2;X-IkG7i}n@vrEpJ{}d+IXrF@C zn0-E&x+JC?rx{IMph#|B|3JzD?R=8d6&-r^`C#f&Ha>=pGeW?Ia{tewtkky1I-gIJ zy0onXR83tCB9C+VV_8+!Klkv{t@Mq^mRg<;6Ea#s+2leJ% zY*ipr7Rt7kl->M;XIQUp=byaKl#x@&V7#S7Tt1?By)ygkHiGFrWaFL^<#8E`DmV;{ z{11e8#}|a`Fgp|jEftDI;Hpc1{>f{UTgH>F&POY$xMtTbL|8gt>8kK0L=08XPOQ4V zo{JRG8C8t=L_s(we`rV!WlW%)!kHf9N=v$6XTXuhi##Y~x666Bu5r#AcDwb8pMU7J z5CO;yhEWsF>!O^;h!9Bc__U_H2YC&N5Opg~vh61i2-CmLtSQV>*n3oM#$2SBuHx-Z zV$wi^Gqrqmo{S0vmd8sAd# zJB(L{f*ML8Y8%(K-g@Jl=xlM+AZ2yL?|t$63q56h#;-8ZEF$s^+)$ziuH|!-%LSh- zyxGaa#(X0qw?rQCFC<6R!|&({4Fr)3Z}%o>m?-c@NWVmBRNjLU=Sca@#USRGGbAfs?Etye-Lf zn>Re3D0mEd)pb0`Ca>kuK}Qirp-tWbArj;vl>2qQ4>$WQt$Si6LJIj6g5+Qf8H0?- z;9qIi#@?;95PFB*C6>kbGl?c+u#a9gnl4F_{b?9d&A;_LyR^R@&ll{rC4|h8LhDbE zE@GR-e8MS;k;1p<+8)vuPb^IH<{WAbB~ZnS)brZNXgRThVKDCWeBXM;c1t!1eTdAh z+=G9{Is1MB5~(@Vlo4F@e&dS0e?guu_m}cM4NtiBPgb{Za;={B-^~gPsI*CXUib|+ zDAI=RIDcBG^r1Ub6-rbWK~M&DT<-e&{YK?Ipw{AKL`mrUIy#%#b{A2feuQY6?anX? z|C`D`-JJbjx4XnCNjv0NfngqU#~o|rEG9gP^n#3*E9kq4B^+j|2MJB}Pn`=Gxc9t% znBkQdsn|iG+~O1RcTt<&r z`cFs%+J3lr{B&{sxVUPAGaf%(UAMp*UJR)ZvH)5ygr|DP;6qTe37UvZQaA4X@)8; z2&|s}NM!dyyW)gkqrq@I#Kl3(gR?qt#OfNNxN=slo3sC@pk#`62&Du%Niu~)aT+Cm z#ZfMC(*K3%Xic~4IqteBKOUb7tSU+e`qpRUp!HCYBCjD%iuj7u6mwE7_^#KD^G{Ww zp1qhYD5jK-fr8oMOMC+=Zl)cpV>LPBgnwdfSxE!X8yXVk4V{m43^E>h~Yr!cwBni(0aiRCr0N+XfxuUWFdF3R;b0 ztBR|cHKZd#k%O-quEtpvYg;v8)}Uk-W*+~l@yeK2wxJq6sHzj#?r7X~Gyb3YAR`Y{ zeGoyKg}uCiQ_hmTG6ZP%kU5Ggrrw0?SgEL6V=)acKGmznn&kAVL3N{-(ti1UxfVm^ zbf)vi@Z41R*O>K*N321ynB(eCqy|ZI!RE1)F=`n%$!2EqIl~d47TJUsR~Et>uU5lh z8!cHw*p1dL4Lfh~(rwCCP_)&KpY=Cbs^hyXmqxQ-v;$VD3giKcb5Xn|7u8FlJw=-? zh3;5DoKwj;vG7%+9k3KtAP-oI%i^WDtX_&D*V0p;98xLZyo-ESDOkZqG_4D?5mhzN zJi6+SWt8PcuA zZ#ZhB)vh&a4L8}-FAqFXly@r%d+gz7@qM{FF~tuWqal5bG0MGk--3k23@smhym~k_ zr+;5Q53s>c{XIf)d8BPL48#VQ13{mQa$Uglx?T-8 zxREhZ&8oAD^Ti8qcTK8hZkxl;4gSujb~WK z3k=bCcr^PRN*Mzjij7FY2_(ZOdaZ;C@W;yJ_~Gw7r1G)bzeA9bZUqgfX#jz{J765z zogN<>j4RDgiB5+up@j9Z5dt3^PSKL+bSMH67QGWXU8`>g!=XR0t-EM1yj;wxX!I_~ z4SQC<*YWWGToi|g3btI_w4vuMZ`!l%)9VY>1J-Rv));wp#=V}4y<;}HX(JE}e>@^{ z42PQOE`j9_I`Gx?C+P>v*ZuN&M{kv{+vji*%_;Oob#u|p?o9f<(b)18RtVXc1D%^s z$kvUoPXnZkr^r*_lk;TR0GagD+9@#7FKLbO0LRCD4qYJqo)d$rR(C_Z@mBoM6>x2XQzb&y2YVP%>x9M&^EeBV?Z_C_Rhy3v5z|BFtrY`VyP0 z=(>T>$!N>Q^CK3K(GXSzL`sFL*-K>6s}`QN$gMdCmv6`Lx43qbxo{Qz+RshWS1cR% zBy9UMcSGaLrPfhPN)tqeVu;t!{cNAZk2`ha`&anc&-)pkpf~*j<4QkNd}Zh3ZT@T+?sbkF(`7 zcE7s81eOzw1A9EiCULv}raxZj4_q?bZlC@b(;s)}fS3V@v6qKvv457~-4w*uKgmu- z-tQNp7w}CF!4VEe2p@r8A~@l1geSZ-3{DvMgPxxsnm}BMc&c#ogVucynUgyQGvALS zquE97RT4Y|>{q+>DV!r;MT+7~jyzDhg8>LH8MRXQ_XQs+X;GM`zYhbWkO4VxbCU6A z;1*=uH{iMmKHK0FLPa=chwxK*Uwhg-OD=h4PR_M`a`l$XI9+eT?-8$>vP`n(zQ}2g;;RxQOSr2#x7}Rt^=uVdW6^2l9pa(zc@Wl zf+UORafVz6unUr>7V+EZhtW)tn4G$pntLKav3yZrz^GcHa{K+KJ0sej$XUYB`{mvXoKCc^xo@*GG-SNIvs zpAp`dFC1tp>`)+%u3TC}2^IGY-UYdk#|(~saAkOcrVfS*fLlLR5(Bil@YFhmLw3i- z1}bg}DTWDjH?RBfF9?6CaC>vMdVLA;i{)XaYyE^Ct8fKY5R+E8{R#2er2n}^UN=Nx z*apQj@ww$urY%e*kSyDu!L+xHHe?}NA#ET%)z_m2aH>HI>FvV@2;GPH!4dmD14$ULJxmiI$y@ar;pc**~i7z#mDGs_SpI`zs7&ATTwJ`eR{Y)N7f4386Fn# zDD#FcoP=}+%3HS9*cbAYh&8>OSv+3OuCHeg*RxjpL+iuGkB^t}4=I5>U>|^wC@ge%~a9x-}q)tb{ zRs|!Ux2`YR?T_uN`KS5f;ZytS)8fNy);^D-Hd2@@=7l5I=~z1QMfBn0!>8->>#Gk} zv-6K19zH$b-yi1}j~^e}vjs7r+APV0EpFqKotS`TSuvyJ|0@!jbEAEFF2V zxOn`~er!K}c=))OKVG&TqE9sU>+^?4{I_`IIvq<#er(NKSM96W6_~nx)&9_4w5}Ex z4|4!s%)#GD2|A?jzmpO&U%wzpS-CET)uOhg5XH)& zB}_AXSeLg}hRMW2lxje2q1YK31E>P^3`25eSeg>&CC$-C_;;m^@IMlUy3%ot0mU4l z#Bs`z(nVp;SLvCiAB(hHanlFthEcv)&lRZTg)a~(5cY`wq{qUQM+_ovO^rsXKMA_F zzWpp{lw+r%wVWEKMeXESUN;G&%tH^N zO*`@q%^9=?1F55yjR6YTI{kRem)Va97Lwg=hN266D8}{?m83ND+Nes}i{g1a>A35K z)%tq%8G&_{YSyyIJH?QU_qWmWa`v!%h80o_LYGp;M+bK`p?mE;r1m$^NxTK`-zHI= zT8%oaQ!x7)3t4;iQi8nm@>k3EC{dB#>1q<(s z1SggMG6^|V|C&V)iVI!kbR@fZ{ufm^Cf80*U3kI=RBtG|_~2Xe@quw?;?c8V{bCXM z6$O&71cENcpQ&+>Cw0Dr2Lv2UxyX(>kd2TssDf-&Cu1$vAikR8AL3&8TUA$cGbAU+ z_fe`v6UrNZxZW^h#Z$l?*QmL1?5f>HkHRY|TtEC5kFlU6!(&;vTuo0jOu$uU33^b~ysqC+63~v5$V>n#L#BOK(#v6dERu=F z>V{ut8@%)X4?jw!Lo-b?S7N&6hn!jJFc$TK1M*O0o3d5Ovmya9j?o}$(ai{cu;PY| zzp%)=R<9rOfv(7%SFDc#rkCG6{F=fm{F>$giHCSQ%8XwhfKaH801ys%4my8rjkkuF z>vXRg*7~>?XT7zHWN{p4TAJUh2A**?&YCc5ymqLhPR6O9dp7fSsyS>8;)MZSvzh>{ zap`MJpBnEIjbYZfpEZVA<4qwK=2V?uLOVzuV8&`5bo9mjPavriz!ImX`cfpL<#&o` zKJPg_I~YwpsNhh=*uCxC?>l|JH=I~E#*ZV%^Trcrfale25VxHUdv@QQjPSEN&_7>~ zN8WTW@Tb<}^XzGNbLPceKDu_`4!V;mLa6a(K+3rq`D3Ry^+s;DYw1#%>eHuQXWSVN zg8)b&+Iqgn+du;Br=d3*4ZDNDdfjbz@C8A%bX!AqY|9xByH0>%@7&K*gl$uFbbE(u zWdaNuc1OO~@A!BTmvIU-BH|=g>vYS>)ay9iKBC4MB$ef)ws7oAwsbAmnFJko;L4VZ z3rriKhKmCcG|IJx{oFNnZss`RD=yiIw)kiSZGomYg!l5q89UP5= z-e?kd9gQXziV~hICXGC6JRObwelSS3jQ%28VPY{kJ8(n^CeCC$R2i9W+KbtKMy;|m z?VwOqkK#KNrI53LSAfFjGb_-sMnlIA#$HdN0sqElYXALpzd#v-7>lmujrv`GI6$nu zupr*FmpfJ93L*J%ki65gy8dY5I|D~T1p}b65zr=Fc#1LLzUB5Olj+n^+#**iFL(w1 zYrSE2G8y&9CfW92Y~aj^QcTMAt$u$z?z^Ktat*8&+)9MQ5bbi=?=5d%Bj>=><6IYIN*AznUFAWY!vb5Gqy3GE12~$F4i>I^&MziUWXGezvEAk05K3 z!{dIQg#{VegK707`M5B9_D6v~n)ZFUmaFJ#4TCC99wnYAu?WNn9ma9Lj@21Cc5e)+ zRy9YGq_=TTNafDN?T>Mux$DfN=WO%(U+Th74mjVC>? zDYg*Ow%;AP(`wq{q`Wi6^et!9nf9S2SodrQp~DXANR=N~*v_9GsMZm0^B0P$*Za%2 zJRI&Lzf(O;-f(8msXzAIU^uOurWZZD#@Zb8L1=89aktlanmCvGPS2nAm3);Cgz4j* z#TWU?>v;~WVaJ|KC*6J}w$QC6G}pNE(CT&^zvGMspe}MUuztqu8w*U*?ogf4P>o%< z!*_yVe*)dpWIkjqQ{2v)VOvO1Lm8l+!(i(99Y4{Nms9Q&?5&&Jp1#-Xy56K$)U$X@ zAG$=Zi{iZn*wTK^8*^eg69o186T6bOsjV^r_YLh)&x2xRY)_$w3Q5owDL6r~Nf@ul z1R0SggAtC0=?p|~k3Zi-hav45vBXen@K-ViE{GBCT;0!u7Vp~AVAQK-10-mBika4P zEXVJ=o(qvujjH=O9@0U+C&wOi`&#VfPY+jx@U~<2gC_3{pqe%u5OQ`3c^M3n%p*yn zSnqK=drBmxf}raS2VH1ND39}sxL)YMl#5F68yRq;J#=WWPlPhsu{wdZ3j*Kv`?%~S zDD(QTn{Ss7P+Uk9iOWJ_F^1M~+?ft0Lp#}#_Jo-h3eQHcLT4lS+$s?wz2xq zOoy&Nbw}OgfR&gAxGPO<2N}K^cf>^mxxw5?vSZa0QKG2pkB7a!n>q60$R5&yv|ECb zbm%!8b?vV0WHhFVo+GQ@8FdF^EGXSTum`|`^?L+CI&h>1!hF$Y4Um); zjS2}E+Y7MeWfP^48!dd#ow^SAL;!i+kPe%I0v;XM0q*JQUM*T_C{u{~{-isE9mJQ` ziyZn*t-jX{y3?V$^2m#Yv74sWz@2tIw>QL5^J9fu*-d*o^}Pf>Q)|-ccWoa=325Hx zB1fSfI*nTkZAOmU2|B_uvW;HWFa#v;EXYw77Ft_V>BFdPxfLv@!$H=tESwWq#psEG z9vo%$EzBnG5yNPasLxfyq--QhQ{FW-jK(>=YS?^pdet!M=Jcvzw$15P!!VoEtA^>- z=vBs<$!1))1tBW%`i@QEIZX;myVO|P*dkmXY>l;V^k7hbq`kD4jfG^`L$)FfAB5y;l?wf8F5k`2Xb8 zRoolHP>>HzO}D*d|MGi&Yp6FL`(C_>SrmHkjorh)l5<~;-hJxP3WuEzd31;N17%uY z;j&XK0LdqtQv_0z_vzbiIJ#1DtGO5yV5C0dY+4H2?@ zf5-ICua9AdLtu`8j)*y`1!;cJaT16r;Ba>Nk%B8l>5Mw{vKyUowJKNF8THhMU@l^H zP4Gr3+BJ4o{}V{>K0aT^`Axx=#Yy5Xpe&f=4e+UT%8*{F?9^ID@esN&vmBVx-V zijf3qaouLj&YE#N=3_sG9o?8>HItv z(mI^u)Feo3jy;8C#=x^4^tae;)n}SiNxXVEHs6XO#c)^?e)C;O(cyKWH{X9vpf}%n zO`td5a|${ftCx>dO|4kLXI`ai&CQuiMNb~W)|VF~(fcK1QdOO(u=5K69LTr;fE;YE zGM({15}D5Oqmns1F^-YNuxM8+Auvaei`%;xGwZCIko57QW<=-ytr_sxBlkIj+>;^Ap&|?(A>~sRthaA`d3_)(7i8el|73)6 zPZhLM`C~4q(!f2EM)7sWr>yKJSvHvMn&)T7kp)aBjf2k5enI)!ZRBTX{6^a~=a>OA z9(!!DnWzD|B!wu)IIZ#t1vtCc(xJ#O`582AOsF&J=_Pv(V$~|LP*@B@NFCgpo(g%G zrOiHd#%*|BeWMAYQG#v-G zrlMgJr%eTn+i3IKrK=L9w-oabzL?@{{yf|5EKc6UyO{M>k=2K)v(Vk~_O}b*+t*d& zqZ&34I#f#UYdk$XGKF!u)-sickB_*tD_0}am%h)GC;`d7DPyXV>!-1jIMB14F9aB+ z@E+F|Czc8ujCcA|;%Jnb3jd=AY$)}Q9!8C`C6w@0l0 zOW`Xy!{h)f8P`_WlHVg~^hG3JE=k11kC>!K{?=F9l)>s7ruN%$;*_{Vvo(@VzyejY zW-)Oot;Jt;+TkpkFJDkqVY5bxUU9l7RDv-sLLM*J8ku9C5eZIJ(zE`Q)b5Cq$QOJP zEY{?0@VbFh#TyQBvP+_#bCV)o`Ikh_xQFTgiMa9I^$*33pE>_f+$N-x{h_##&GipP zPh_C{Lun_BIe#j0YDet9uU~g?_u7R!b!{sY?ECHOo62=rt)}MbC0o}!!Z`B3@T6nS zh|Qe1(A?pf%U&$DlxL~12c4m){6ijhGqgoEV>GrnsVip~iiGE0X@Az6L~C}`D{V|J zdZz1^a@K=2^dy$di!Uv0a)#TY0-NB4bQ_h1u}IP2Cq$@4RT)nq|M+b&;Xqjgl-7zh z2$ALU^q7snSKVaJ0!!7%5h- z%@5i~u=n+9I{W*1JzMw-c5kJ5$e{yzPnN0S%2B|H@_7eG*N~r}RTo)o6B#OyQUnZr z5Q0p3A$7O=@@r6rfg04{FnEa=16ia{YJwEe|9Fj1QntpDk&%QlAyNHf^}a&6lL{$E zFHd!ufdH}9s}LHq0*fjntKAk8ibiD_wcD?Y9j|q(xH>9R=%~`D=N9`fbBd*CTXW}$ zc?kyK^k=JuD&$inOsGp;!b*^0mCFGVU%YOR*EDK|x=5%E>%bl<_2%#>z-24iqDJpN zob8a>Oc-AOjZ`xoS^c^-T0bGF5;ZddSZF7}(f1BHm8f32EVfNHHI=R$*>s3$3rY|t zgh8AI9X}WDla|2El9doq0Ub2p5)COotb1V0k}4N-0fl%?z8|j_|Ite zgN>GTMvZ%Ra&e>YU>GEUzYy$s!|BKmn4b)JpbUf`g2~vnT_mg%sY5A0nUSC9(-^5H z$CD}YBqLcLw2Z|rkubSSxql}?zaL~WXU21&JW%L0;{W5nd*f%=X^fOmeadniOor(M zZ6zt8DB;fmbEmb%8LSfRa2lP%Am!zLH~^tIuKM84pza~0h~vx-7@2t}?YVmZ9K$D3 zWaY(4cF1HjoSUL2S! zrDLgDQ=u=)jp`LbxNdiZEUlZ_Pg0+aBM-@u zgJ2vCM##z6dtN^vUq6xz%f#HAd|JbCd~4$R$PnJkh=aB zByawDXX6cI3jvVIpS<2CQV}|o77`dCA$IzBj7L%NiE5xOGLZINR5|Epvizz}COHXJ zJ*~0jdV@}XYIm*M&n|Li%h*Q+duky|rPJ;Ct|pM#B=2B0$I6$$HP7X0Ky{AgYAD60 za^1dphjQJ%6#Jb%ORM`b_bVetn#y;qJ5pFEDW_EjclBWUyagy|^K16zZjN&dCgT-A z4}>VOI$NPI*A^PDK7GH%M^VBfKrtcjxLCH6I5R7;CPgVxW3g7-C)JgX1-^pHZCvyj zS0pk_q-jng3-?8MfzXu=a}=StDL~ZlTV4Pz`o${n9T_L`dh(klnkKv|at@U&;Ycx{ zj&PWV?I8ES*d92CI9!B{AcR{GDY7v$&!h37LHafE|jY$<_yc9N4fO?nNI|_Pz`&pkBjFK;FPkX&@r$a904|krHeZ? zJCzsE;cgNJ~^x>?8j{A%(-7E+Z=xvaO1AW z)#6StIp*>rrxW_SnNWkFUg86&jMMFHQTtNJaC)1I|aY~ z*=Du1Ejb0F1V^4J@33sy)&@f}r4z7ZEF_zn{_Ax)k3wk2aEY>}*DMn6$;70jq_%0K zR>^=^uu`!-<0`cZ)Hna?pFL}9AF@>^Ydj%-425~10B^$paE?p%)bskN{1;zsFQ%?P zKxKvwbX_~Rxz=~y4{itbX}pnVF;#INj+69%@B?pv+i=&ytHu0>S@Wx7^-)f)-$$Lm zdr{)-^Zji=wsO*8*rXoUcW_W4&T-vIFzu_>cc1SITX(JQ*q(Z0AN6RcW)7Pve7AGc zzW1g#?U&bI8hgCPbOYZ*Nwf}>bZAyfltY+2 z47~FjJ*UG#Z(@(TDPrR$#n(I7b6}vQS|liH5clg@SpAOMon*>yncPe>6#q{247z<3 zc%^bhD zzD7526D#t>*EhZRjQSiRKJM5@)f}(anLrt@7?NrrF&c5_5o!YZy}pA|n-!gfL^FG$ z+>_h$L0i-k+rY+$(mYtbHELU{x-T}7>sGpaEV7hv z8an$vsYW0#oq93SMlpjcjrEk->9keGTd$(Sh7=D}Y}qPU4mp;P#8s2}dL^dxynYIw z;e+r@Dd|vr7HX{!a)*(HBc%B$O>Ahm&OIG8VTIq0qiiXfn4t&Hh zedu}1^>g&n7cDtyZ()#BTm=kK#8WS3sfmrT$f&VoTP7L{8;teO+Bo!N{5wrW@Oc#H z1??z zo)m3pdI#6dtxG(QgEZR5vp|;6(@S0FGdw2DVVaM}D1gb5fyB#EoJrWr5w$>~)1`}1I2(k}dNLi$rtD>5|R!0-8%+9Vl=h9j%wKTggiO{tJOe4Q#-Ptw`y@(6A} zfMUlN&H|Wp1|2E7n7=We*sSKll#NMzX|@%6K7MGzFqcAY z>>U}(sC7j~KJ9q}FWf80cKi8h4G+}sFP71(3quNdwNfM@!raoPK{4GU<(EJwWiPBS zQ;L`XavLqoU0*~~K`6>3pnZyxW1nVHS#zZHUQ4XzJ!-Qqu=wGxcI#6(hljUhrQ|~D zW}6=rzJjc7)DRgE(xVhj+OSb3$G?r9m$QfEGr1nKJ`;n)j)ng$lHWM=AKs?yYScwG zBBVdwJR>e3WZkFHR;in?g{LO3mLH1dW!Nws2T8oWVb4W*Uym=@Tu2y_PuSqJWdIFf zRm4TzMU_-s$+5Y9;6^XXvd67@)+88A;YtLTA_hm{KLu@ltJ8H+LVK9gbh%pYz8iJ| zNSkg4wX26z>J;Ak6dHTe7DH%@L5#-0a)x+eoxq|h+RWoUElOptUXl7z8QkDBH5xeG zNf&i-A-~Dlq#QnI(8VQZ(nZ-*o+kKf1)Yj(*5eKMWx2wuLTq?~4bka)QxrGPSY#55 zlxKV#joo2)I6@)U%t-8yLdF&jPEQPnim$zHfQh9{RoUSv_CXN>57yo8Xo!%YOx4|- zjucy=dpfXoI)U4tWbA;Mo(l@gj(d8R=XisWgQB`s$S%o#7WeE~p5L2#9e*sv&#!WHN?RL3-HO?}yoLj{Wv(JUyW2U@$=SVT5I* z)}^8+Y1Wzt~d6^8mxwn(nw-UbEFvgz{A;qQAD4N)e|b@dmc=J zzGf}U1Lv9sR5W4Pu3mk+A|T>$7oeyZ*!xqgtcF-Etcx0nNs%Mz`%em^9<}0 z*Y}*1RH|;TiqPT)#w|fxvWq$lZ7y2^(~H(*V}+MK@eNGb(2Jl*!*=Hvy}S&gzhPpL z*6E@iLw@J~_Vr4s*}L6y_#^ro&YuKBAQFQW>W{ zN^)y1)IE%he2)!ECY*i>u-~Z44fS%gzXb}_M3dR{z~U5B_MXy4tg_4(T_;86TM&qh z!fM{4?Bh^aW(~_rZb-kuW({)Qoqh_rDa;lT9AA|0X3<_BH!xfBb>}au2o$GhBxA3c z@1wFY--K{UEd)y#k`c6OEikaQ;}?zEWVRb5fzk$oa_oeK8~zzZ<2Eu5bEtnAq&U>S zs#UGXf<;h&&XJTktsNjC2KY?y+5p9)ZCP`bi9F>>gepi{j(0b4$qI zcqH)xSUwyEh@bW1uzEJg(qiAV4E@Krx8+!Db5tHNnG{Pa9VKDoiw&LWASd+Rz+nL{ zjf-$U+xg$Sd}E990A+o?rTWw->-rvklBzHaeQO%^TP>xdPT zpgt=4BUO5ht^C2!?JJtY_)NBvgW*@9lZJl;DGs01Nd~PsQ%YuWHS7$Xpxd!6h_WCV zMBA}oQG|yeqIylA)XfaxK{svOpR`R5{;^)a>rKc0*jg%QTCr)#NA5v58ko(;wlnJV za2dH@{aCGk!UHd1(B=%qwAzHD1M^#lqKjc`&OyZJ7>|Hh-l01h_1(Vtj&;+P4z+C7 zPMi8CRxq@^t^*%jjn!lP@&$K2{Whjin_9hKf{11}>FFE$?dD+zqx57vop!s!4o0F^ zM)5Wg_qx5anZh^i4S6!C;amq!%l+wS*v%Mg4FONa&n~=aamt!KCj+NvBeuCG!i4xe zz`#zKl-W3G_M3M5lVCK+_=u)PlwjkYp5?pVWMm`sD`jm>^(0*Ha7gJ{`j*@2d7Ys@ zDIibB^@u>zn@<<*Yr_hQr<{>97&~3Jm*A9`u!#xl5k1=)*g@dBf#tuDNgzuc;hqfR zu`wLF4LyG{>>xC~Nk15(yQ9f)93bR8MVbmjG+t-iPB0peZ0mXXfIyEKIiaoKuSdl5 zlqfwyiqL_`dgV>nQQ+!H^0O-u_BS0{Hs0XOlrb985r~z5r||ic9oeLKu%U$Y(l949 z|Kvw^cE~12cv0^oXq^J7GXAhV0H~!?rj@EfXJ=o8ie{MePq|)6uy3tpB}QwqN;w^m zSRe__e0UJnnuAv-{Qz;wCCY*Q*6WlVvdLl<^*&<7BuM0Mxk1t)(zoR0s!CboyOrpz z-)fFrWrA}uc^RYjK5Gi(n=hsAbo2`9r==s;fZ&{X4G84>tN})9z6QF}(Q802VJD-V zytdxvB#=4zL2r!JgnpTBM^KPq$=g9>-i-|F6?AL+3&kb~b?EBzHoj!wQI;#@}3OO2-W)-o&}6pyEg1VGs$FNdvHLAIsv z^KwB+pQ_E7+C4w~_Ke`5{r6hE5S>OQ(D0kE%hwr5c0uUx0x|JR)B!2jqQb8q>Z|q&uIa#FY`mV|y|C?>Qx@IGJu_BeY@M7gmjD|VD5J$<>Co=g}V@}8l z81cHw1Dg|#11#mhM~Fb&Tyq{8YPoeocGY?&igKG}o{28&HLD5jF&ElJ>TT-cL%n7* zSWC{>nIU|MUbxmAg*$?H`k{*cPQSJIN3bS3bl~kgL;eUnP~rUwm1OxMe8g(SyE+{* z25yVb)AUDqpXQqZNeWtY!~>XFpdiujae%Az@rU6k-M#T%xBBaR7E*$!)j}pd)0wTq zA-ffb*Aq0|MiD&1SK)WcsG6JxNXR9iG6i7!sm(>%rd?^+f`LqV!;5)iwuwZjbYz?q zEc|guP9#>~)MMa1l2%Q5)SrlM(+F-!+Hsp~i>D%8eaJ^qul_J^LqJ5|Ao%-)bgKk- z6uBy)XQ)Jl?jgUBeGxHi2&SfT(#BSX!ml>+XGC>8?AFgngc9!I@1~N*p$pQswJ2>e z3n1~QNRTD&3w1Nj>!7dCTe#v0*-BTAKA8-$;RsifAmRPXY!f0VVu|W^?Ec0-ey6E$ z_6ej$rtF9GgPIKf8U6Pw%Af7m_(_Gxr1vyGuAH5@j&Rfy^SQwEY#CD{CPxk}?6|<~ zY2Ox$gIGGne}m@%2hb?e-XnjmOi6-QdwKk1M0gU}lzdOpo={3PpaTF|@9FrW|7HYQ zs=1E9Q|o{!@@%mfpXFeG(vr}PC0-KZ2R;H4iP-oTl{1n5u_IMWCr*?zOs~Je)nekj zd@3PXOcZrGW+(=1%sXD`VOGrN^`Owq@0;xe4&XDC3zH1>29^Af-6*GCl}6~)S+|-1 z>n?58aaDVDivhju0vC__yVkf8qXU+?1ZLfpE;wmxFL0*++pcS7xZky$MTi`*idj%< z@z})>2OZIrQI9%W4K!9yjhk6&(kv;XeoT%3Ma;|iyx0rHG;h0%E!CP-h zl!Gz*4P+}3Hou>8jgb2d#LMpS-%qnTIHgIoT!q3^v|KG%&&g!>6=P56lTc3Ep6Z8o|WX?9>r=O?l3%Ntv5kcDCaO9{-$f6cbYP=aWF zo;+PNDM1UVd@{c?4Dvs$FJ=i@k+h_K1;lf!22xVzM7&BE04<~n{tK^WY{Wqoj@|NU zWs!AgBD1zpo))~Ezs~m|Z16|F7l@TV^pRX?twcRCv}yA*W~1`}fue`K7BFt{^3VV} zV+=w`LYv-940>=}N=+kse0s!xGtV!c5r=;qJ5m!N{LZ*k39@%ar$8#y!GbKiAzs0g z??WK{yIkLj8RzZsYQkP7p4q=AS^nKIuVTh5!sai(8TkU%H8IToJ&7~h8R#KXye z3M};oLWyHt9fDb?P57XA+$K=;yIX>tD={mko7f_?k*fl9AbtfbQX8#;{`uI5_ogOP zPY^q|dlg-(Arwp@(b0SZ%W>u?Y+H<7qKj1fS&Ot^7kHI66P5B4J~q`NdYrvJ@52Q$ z1e3c?LCZqfYmPD|&&yh)6tt{0%9rILsyCN{mIb50tx}2-x=ua4&bCOzt6UM&ug6JV zPQMkWHGP&jdG%+%6tAW9X{PwjwlnPxMx)Ni`itjIp=|v7Fz{`Ah+KFxUSIV)GB*wp z%jir{-SvKj96p@;84;v7jpHnQNU-QlouTg!yB4!6YMOXA?ZuiZRIJuW2O0e$$*ZA` zE!3qACLL6_yE*IGGdMB*{jz@D-F#ZjP$_K#&##-06kAE9^5SmD?B=?|kvB%Z$=GeF zYOty0IxdRsARd!?-L&Nnspy9QP~Q%`0IBG#ByDp$YAn%j(4D%0kNlA)$tY`JwFa9>Bf?(%=kev@&()AbNgS=Dbbi;3yF2>$dP&ztrbPs~rdCFNln57@URPA};9 zT?&nj*ESE){nn_x;#*U!0!r+nP*6obR344T8(Rok4h9pux?f_vz#4X@6L79qV>~0n zBl2b<)y>GYr;Yk~9+eg8O@=o3&0w<@Dv6NK64F|(;;#26!?%1+daS-|=euf@o629rSt(dguXrP6?@{W-#>A2<_iHu^f1R_CotQ%*1>=j$&R)1a%q#m`F88XC@abIjA?P zwv4z83(pWMbF@jW1l2njEm8kW6$w5F;bwEKe^V+CbUn#d6^v65O513^HiA^JX)9qI zw8aF=zYXmC?OQQc?jEk_Q?QZCdo|e2Re)-2=_(MX-`7HgqwezT3(+x)v<8e}t6K=RHU~|9J*l^_lN;h1#>(LwTL?FvHTzZI-4VP|O zy5Uld8*jKw|JoZa)AOx1TxOt#8!p?w)`p{QO*dR#l7V7l4%JVC4P~Y8LaoNw}iFzdb=4 z;rEBowBTSYBBJ>H?MYb&ElI&tmiGDrHqPpR^N zB7_Lb!kSpt6A~oC|C}f?&L4i%G>fUFKSQEwu zf4sw}7nV?u-eKOD&Cyrjx1h|yc>O-wRS7G(wKEokcOYLQ)P5fY3q;m$BwQVg6utgD z?T$Dr&fZmlU%eei((li?N**)8%+kK?)H1^rp7e=Hg`ADfdU#Bx!uuB-N9@JoHhNj_ zBmI^jf90XfzjuDozof^N_$#W{>c1qV1OJS;y?tb_cJL#M|82bM~IRuCb1DTDBL6Qn4l23f47#~^(~vF>R3 zS0tw;e);cLSPh-!eha=fenEZFNAgaipYD+T(CCBYv6{71El|-c#ayHH&#LcK_G9;b z{miofU@_BFFJrw^UpiDtI`tbn)un#x&Gz4;t@89Dm*Xc02T?s$qOP9zaz8TX>NQXG zW-Ci7T)ueg{Nm z-V{P6vm$lF%{9)4*>*eo+w#s@mr{B!qCKRKwRv7YS=PT*VoBl6N16W#Yf&XD{EBde z`S;mYWx5N$3K#@d+-@kE`m6TF6v_6C5ii-;LYNf75)egNT;)`#3J?@`YH|8FHrmuHS(<5J$&scOz7|Qf4Qwu(GJ8TU`BJ)7j!(Ffv8D) zLDr?z2)a*V2-&Bn`)u%<+V60tKdej8?=YwqoRq`$qbzL5nmC=diCE^MHk2)vfgl7~ zdK~l;YbOyBQ(>?wSW7lXYx%d5N_Pp6wR&idF~-c!Gmc5SuFn~oLS)ZGGE;t=Kn=Yt zcq889+#LAIYq2h)y(3KlF!-+Sc(Z>kqh*7xe41=K4=>T^7Tk=cKvqycW ziy~i6@`FDGI^!WiMo^8)1lI0(&S*Rwcksn^lb`&-pxg0L!wH=}CqE6wquykK5=y(> zcAhB5)}Aw$v~kjiO(OMf#Xf4 z1KpS(e@Ga8`U z6@mV*<(^_pOxT~i@nq~yQCf@|z~a8YyG=IebPy?FO9&zpda}X5olL+IQ|tD#I|cr? zNeqTle=?o~>NCKbYxF7T1^#rz#qVy~!RKk1nmnqtAcAPzMHCBR2u*;Mmk~r}0u8k5 zIOEBrYZE0nLqFnZ)~|R-Obm#2L#Na4JHD9m_vO=fs2z9Fe+TO{z@g*Yt~2h-nb}k3 zuMArt7|Qc|Lm%76f{udWE^qhq&E1y%MyHNiNQ#*{&>J7P?Y-Nfqm{a`W%ax}^s*NMGL7qkSFi8UJg9dA4w$$da+#ZwGB zv8EHSO>b;lkYAGS?Jo&#p|Go7f9wc+1^4eV`xxc*y57(ZP{xvQ63mxHYHAHoym9RI zyWDI?+t>XY_VHZ;_o;<)l9M4yAWAyY;^jdbdZSU#M*yK9_utR!*@Et2DQE~&>pIx# z+)PMI+=6F+>t?;|v6~m|lx>xXvdA`(e$Yi9E{i@~Wk0YgAh`h|i}Yg3<>SQ4j2V5D z(09xaTCE|ai*$9Y{(KW)i_jjotUDX!Ma@ss=cWEanwRc#w}^K7ON>SQx3^Kp637t_ z?)TSKjC`%(Gcf#p^rGj&N^LyNt^S}1^L4rZPWMWt9VD`9L0SD3Y--b;FL&Igi*lrr zyy1`&S`&O~V#qMj^wwypF`Pj{6bjq>ok(T%3F?OsfS8uo~}=CqbO-tF8h z<}s?I;&T&vP;=JEe+9AC`L&N$q+bd76+`2aE^}O=KCh|W?fzH%EgS-!doA>^BSMsv zrO}~1skW@T1fg+iz@1azD$tnwlVRHwn^mK zl_Cu;*(4WAV$E|fGQMZ}%T+Y_h89umZeS{84oOavLxt0a`c<^KKq7rX`TRaSG?-C9 zO7}_gcV=bPkeQuu!I@HkY9$DTL2VFiwdrTMnOKrOO zCefuYc@{=FeS;|81iV2pI?M7TLAP|W5s!lIT69L-&+lquDW$(V*dO`3*Id`V-T_^59&nQo?Z(kzzf8%x8~h$j0QJu)=pZ!fd$k7$d@XFf9l+5C0K z#xE^ovZUbEB5P!ph`h&*cMUc&6C178TUa`SdXVGBBSw-V9<7BZ)o>t$4O(EON*p>t=e}?8UM6HT|c z#Z8GIvxozYf}9f$-}5D-Bv??)u_ow=wwN=eVjeRv6|yo(goc`hv4~2Ft4|riCmW<7tB>N* zjOUkt&Bqo!sOC=HLEXdS=1vDSCFE1uaXxzTxu0=J?gM#IiW_7A@C<%#mvB9O-EL86 zlv9<$=A&zlVgu>pBMF_=_yBfn-tG)UHmK1D_G|Nrh@S%(#AFrGg{~eXWOhu#VU3I7 zeEzvU5>DuTM$W=p$_$u&8nZs$+!Xm2(V4;Zf-kQA1t9iiE`)!DpZ%gQ!d3Y4anUmW zhmzUw$bGi1%pdW0yl|g!t#T3nVckntJ#n4IqYHVC+h4EfrP4Y_q#tYd$=d0Zoj2JJ zg+^0d6JY7gxPb$e5p$BCHH8#GkwP0eHEOlSutYyi#(&-L?641Zv!_VRsuFviqpGSc z?#=sT!jbU`=ccnQLV(e<);ueoSOxqFc(^?Ls12IF6gq_6G@uV zkrx5|4wL`95XT^olqV>yejJ2@DZXEeQaGR---9K`{!VJfdqQt@Q6=Y3#T6nTh3Q*5 z&1%2UH+0O!81M`x*_m~>#Y@o_9|{I5fYK8gztPWz)Rw;#H!OG1%^O4=2nC>Fza%$a ziHCN~4LhO|I3G%Ih=M;p$!xUD%p$fJkpS4)Y$7h&E-Vi<%d9E<19L-6TU@~EM33u~{{~}-W7X2ZQ z7b)-Ptm9(38BLfX9)g;XHT^5|V>slUVG`2d{RaipN zX5mwZIzWgSEFlZzQZ)j1{fwv>)L&a8_DjjXFQ0$ykvr#QM&8I$8p{7j7j^D=K&KH$ zDxsREZDjzy-x8`xq&ZIg4lFe-nCkKa6+GUZ*#LBWvgOc5lnz|}4?E=I(GYQNx}j@Z z2p;hJ9>AAZqoB|t0;Rg1Uv?Zf@O)HkxH+@!n@i&Z{Hn?4R(v>v-@Byv`DK6NBVm64 zUtH>=V_HozZ51K8`F9(xu58m|>*i{T_1iLic$NQqkb^KxMj{10?lc0?7 zjq`SAG?@h5Aw1I=1n{M=!Q!GQMz2UQ+vl~C#=KTaf zdhE0yNPo`=gj55vRNQA8CDO?^rGKh(ZPF+DWvQO{jAx7|l>C9Zf)gdDt#Q~U`n}&m z8N;U6$oPaJqZB{KrBAaspMSW)al>1x!GvY1ZqYZe3Wkua$a!53(R7{jAk<#$Z0GDM zX4^EUf-%4MTl+NPX$DAt&+NZ+gIa4?vDC;Qeb@?f$A$}wK1J(^PmPxmecpTZF7g-c zqF}8qN|y-9gb$-VcWg*|^eLh}J~gI2`n)&oFY{@CSwQ>CQrhE+)s*&9X};yIwW)9P z%F^HX_(*!9E+mEmN*KK5d6Zd&~Yl_o2D3hgWJUFKV`rWRY zxwzb+)D9l2{*H}fhN($ddZ)79l$@||$-2W!sF8g@&+b0)tFVQlZ8EcfZq1LK$W#k+ z43`mylKVb6D8(}d*#NOf*`S%D?H@9?n8H*7!zRFWc@KLmU@HUB2boJ@ zGr&Ad`+*NrrFr4M%XynEOsfF4kL{B%v#A#}dZ2<=?HctN#nQ;3DKDvfp-CGs-e%nA z=y5N0u`pvU*E>5MQre zkb7+VcL+HKTvKE2_G{<}c>v^C-{|zgp@Doju>Et9-<-L(tjuf}a;@n!86tl+tt?8h z;XdiaaCYW8h0`@UWg!xK3P*?VL-woG(|Xx2)DJ`y&Rx>sgr2O(k`O9gZM%L6_umoP zTZo%sipY*3KN?nu#_-b@*#l5agUI43THua&AbJ-?AaV6M5aeYM$gAuJUSvcle_kUt zdbzT)Er^5Cr3$mHgsh;=kH}p}6&yv`Mp7IaaaPHFs9(+v@sm(xs+%WNos9BdqyK+e zS1iNSG)l=L9+jkzNj31_H5W?gkh2`LvUOxT%T2m%6~d9afFV*#g%ZJf;fm*lJR&7p zq9nRdS-E4ysucG|{pOR9q7cpjq=2v96EYM2(|3%TM#b9vBX<9mB1U!6#+Zq?dtsL?9MsJwv#lS~wO z^RZ%@Y9C1AKfFGMa2iJrR=mp>b!~x)*pgW9k6${g{TBH)quqSF+^};JYbEz^almzk zv%{LM$!a*`3@ie{>rHn!qiq6gX3%(XKNX=a*-oKx*sP17r?@TVay6W}%ZjL*0>Ugy zj(U>fpNhzpAdTTxsKz#^SOnr2iuVgBo|;ZfldM^!9t0+cG@R1DGp^G&zX=IrdEOTT z8aP1#WO{vhS+8*WMjGY$KKzMXPvPqIB}6s_i`-EJ2Uba1-X)N-$`uWN<&YxwZ7m*v zoJS5GU?3P=zu|R5;s}6 z+q?`Xu?g^xBS7iHTP@F_&=MwOENn3W4at!ZGFkbXC7RKKw`PCb5p#I)COa6i1nS$|=}~z}#dKHV6FE zSxbd*)tOj^xhPytM<&?F$EoCW$&HT$CXNgrw;o(b(TP=9y_=IDQyg34Iu_%Q>RVsY z%iZKhFnmHZV(JGYc1{V;=(#a_qLx#peBm7OP?ZO4AIQa5b$QMUVJR1`4;=c?b~t~Q zu~8BWmwEH4tyD7cS($={snNpCY=goYE z9PB-;Bo7F4sX>^MwgnU_>2WGj)#saXdBpTFXmjY|2|Ak+>$oLL@7#l-X-S>OoaMAB zWk_9eM!tE+?3MZg%wsYBCG|0nfl^Hb$H={<HN)UEbcoCf(wWQDc-uv)gnZJ zrWYzigN)~5-bk`d@%sO!U+Ce-lQtcM`Hjxl=<_v<6idD_P8>K1PSbq4cG-%;YGh^}%|g1I=HPkeoNg|c#=l*e!?CG z(b;b)?Ks`kgevYp8fq`v<1V$wi!Vsl#3IgU%4q94P$b?wS5V>$6o+9j{;D2YLVtzwcHn=i zx|V?DpfT(DZ@o=1*?Xa${jcc#zgqOd8;I8W?b(VnK8J2*Qui3I|4Q=qk%ExL7tS>; zlMaWcWudm(BegVk{o_VFRFFmIITG&NH)rbE!fPm07*T<)OXpvRL}~Q?5hAH729t*$ zE6UyhG7FbjI`wsFZxb4z~MSOWv} z8F)dm7Rl{z@?{y(7&%R4O-CW(b<;bfAWcYfyZmGb2RTQ>J>th@G&tN{i2zbR`UjeS zSYuJ5=LBjHD=+s@URqco`mf-%tde_zvBd7xCwBg_U>wtIT;PKs_zG=fM4NOZWj-PF z>I|v%JR()>t8yR)Rb)8D4OghQxsd2CevUi1mnUKCbwIxyA`Y+dX?CWG9#3< z6$@l8Q#tHfGb$TTugHH!+qEoGij~gl;o>xoL?$KLF!bhtsU2ZOhG`@Gyp7TXG2}vJFR54&aYyjy~>QAj24 zcJ!;(-A{w2p+X46kxH2#KaN^Nr7K9LDDqJ#x6%pJV)NTkD-YrtoB1eET3XVA9>eN~ zKQblgn%WZo&lB}Lmr6+Lw0TWj zZ2osMhreGcr8n~{*+6DCJWQLNOzX!16fU;XoS`=J&s~w=iHDAr-P&@7 zb>^12bER>acA<#C#8;9AzOVMXG?o|ccV&%8=qLQ>z?r<^#SW0d9$}UEpfCnR&up&} zm!oVi(=9&pLZ+J^rHOq}?~twP!9cbnE)HV7?AOI|ot5A`nd9Jpz4DgZNTfU^qdEDG zwBCwp>aF>$29R0{_~+}@E%ISnnv)957Zk;Q)aw|ZBE${3bVTxhI)4iW=hdVAa0Gjp z!)of*7&bL(9o3yVqrfflG`mVL-+I_@}aI0M3&f})q z8;@&?ya{1U5u#6kil2n(34$hdPyS*7Yh~q$%WZ>+or1aRXM?vK zG^FGBbR>3;%hR=*M);DbM+?oTq@!pc}znc(4??S@ti2eKWi$o5mF{YJfv#k87 z^XyyRtKimA>Hma*MCm+wynJfFV})jz8lCh#fn<7Sd(NK{~KFyx*K4?n7W zi>fv7fka0C4H87iQcVUQm9vl0u=si;wqNDdKsKvZ?nT1_W!jh_js$t$qZUl~^ols? z*z5ft&pM^E%jcDY*(p`HuEyC+j6u&KFy4q4HD$%QR;H4wTp?OiNHD^;_u%fL&h5>y z^;^iaY2Iw5rS}A2%`4m+j3A9^ZvvU?D&|18Phy0|`cq;gvHp%Z3};Y*SEoojc7z3v zC5lsM;ycj*on}to=?%b0QnjG8s#`}_mf06`dY3E8alaENPYPJU;iNtnNOt*|%m4W9 zpkt$y4&=EPm&-X1I^)T(JEBT2UR=B9!u2}dc#1Nuv()c{AegwFiM3AsKI{&>9tzvM zB!0hi0o!)Q9NGmlLP)4wc1F|5#0`4Zm+41UL8f)tb$WK!@f_;~QI@)G*PV0&Z_r0u zU7rSRJ*4OuqU;a6$c(lFXXv1AjkPr)^gL%cm<~MaFG8&qHy`$T{-`${TDPCS8NZGO zUVr5GfbuW%*P)L}NrAN^AVvkH%OJ4(zK^;^{`5L-Kbd;YWQf!{{!~}bXCpWxt7k9#4mMe=>5c*=C<0?A4_2+s+{9T05#!tjI;hmAWI( zcCD`O#g%?qZD)#lNz(vNTHj|kpJJM|JyhPA22)p|6qgigwR>35VB(`PPaDLzF?#j< z{x}H6BkN_iT$o)3Hj4Rl?TN+cwr<)nz1suCag1>ru;w%sKQQqFli(+y7wuo;`L{>@ z*z+f2R4!^Gej{d!_P95gOnUafdfKkd4uLoA_kA!pk;O!8G9Gn<5o%nmA0LfUOxNCM zG#(Kry{>i}SUeOZue+$2H2y#Az5k12$(AQ3=zecZ_q>PwyxzC?y?On*yB;jBe^@Cc z!`YQC}Xc(bC7h0POta`o}-VpyU>8+!V%r>tG(&rhOM*q2~_x&CWC&J zi|$#gb8%90hSUCyr(@~$PFv0M)1KqKUFua1a1&UiR%u^2xBbOJ$A3`oo}4zT5H+jR z-d>>R2PeG>DL?QGZ;s1j9CBAA9Gup0cA-&Yi*S2_PyP8@;}$Av&s4_YT@-Rf!UjMzs_&}yAEF3z}1Q#N-O4GHOSG&U^y`Dp>1nUq>b9K8&^tc5eG{nU!NqyIa^9`fA>b%`55QgYiiYfd zWvn+Vh8$Kqm6Ox6UXM&97;+12sU+`9?1^r(B@sGruFXHK_QsvIA6Do?vU2Z0aWw29CN6B`(-m7*Ss>>ahr?VwG3l{VOr9!bz1w%s*23mAxW3hG%=AbPN zkG%K#_-KK%e*t+lrwaMDYp3WAWP{mA9pYRx(6)oZOfE)4Xw53^kl)86AU zHBJZHtks)!+&||)r;d+iNEJuk+v75l z#NyW&LpmK*44}7hGh*+&)^1%muO}mKc3eI>E??Gr$AzbzC&z`yPx0wVbY}qTEA%Y;5=yTr4*pNTX|f*ozVeOTsr3q@xnPdt2KJ36}H~T z#p9wj*NS`%YW19E?X=l}!xs?8hfqVNLg>0)tAz_ZaaZM8P)oBc$&IR2os;uwt%;uO zRQu>Z6xJ@pFENGL6}NW6Q`4cVj#B5I@}!2YQhwtFV@AiRSDWqH zMFoC5nO)^OXngD7p1;#-`xGX0c#Cs{*n6gufh9r#*kX*e@FB>x6;|7)tmB-bdZl$r z^A_?W<{``9an9gFw(FSZF$JQ`co3rCtbKmo@dxs_JJNBw&3d)fZTG}@{nDFUy$puc zj&lLadfI^B$vEV&(g|icU8mXVbZU*pxfs*MWg4gh{LJmsT z>2xZsP95HyriDHaU?{5fHY5s@8i+@K-GfQ&V1CF3U)Xy3?H4(Bx+fR4Y8%(Y27+SG zLu1rAG_Ka}HX5*cJc#-phE}NO)XvVjXH6KB0FrEPs95Ww-m28Pm`M;Uty!T`?XzYF zhQEd}OD_^0hhgbEb*NcGs+kl(_42&lIpH?qGSqceLTG`Q_S?jIlA8b}eMKZ*e+w%k zw5_BQWmqAJ;x??5M2gY9s95@4hgsU48gT&Wdu@D{ zjYn42#OrT?KT)6tCPj-GI3lTbNbV|<)jGr|oiumhPI2R!?ueR&fjM_n{d$;J-KUfZtcHuV%Pu@#Rfx1os6S zrC1nC+cHhM*e=_lqvs_bCuf33q?-TW3C(=d(Yx&g0B!|d>lHRX=d(AM#ES$+-``lM z7jBydIu3;TfKK0ukbM_7olw4={(Rnl2Vtqm0JUM7^#%vtKLR^KF>f1elKJrq*pO4_ z1J?t$hjdh&snFbH>tK>-1Fb72HOHp%O5zdduyG`Z&*DU2ihFgW&RZgKjjlzDn_Qc1 z!4ncCZ7jO!u+q)94h32|Bkhe209mOq!Lg;}WR5&pL`PyKfK_2phz{Y5S*uS;rpL#K zxEyC+~vx>E!P!!mDS zO8x}S4)ht(63@f|etA%S56R=I&q{JIkZDKxjD>QCY{#Um_H$)7v>Rh&C-uEI`2Kk0 ze~ld%$pBS|Wsef#UKY2&p{&->fUKGlWEWTRKvl}x%22&6w_`I~tPcy~ z^J*q+17l_mZVhP?`#ba5lA?R=!wgYA&#hPtX(ZOA-KO8^+Ch4;igp{AQu1_A+g*=# z)tjXkY#r1Tbj1U5o%PAOB3JQ2NxAyl+&FJTBhse*Bj zKVXGjmv$TF%BB)_b6Z_u)}vjiUN-7fEgk<81We;VJ1&`Z-(Qkwc2d?!61^8n5>58Y zDSeHwc_?(OVechpv}hSt>oD46F$!pyo-;bsvKQCh^a{bD{t`coKOef>Y(%^7V~jPq za{L0ZcW8?~Ewjjoq1Q&_p3jR7d9Z`+4oPW$G^$i;HJtw*I);r!9uO%RP;f9f%$Ka` zPK0NIagmTeD+uIv&hQxT_3x3UZ zP?=MHZOAbFw4hA*Li{6qb}FiO*NkepMFlT&dLB?7+-{YqUN5v0_QK26>mbXX7M1Sn zB*{>1q6YB!HQs33qLG*Spe%JJeRY9#QysKdIfp>tsppO8hGr+-QQ4kqHxBmp?8Ltd z3)S4)FTFn#1?=VbhrKoQE;t*6Srs?vaZ(En`4QOuhW1wji;z}DZlwl=FK+J^?@xVt zwQl9TV!wQk*!y#wVZ$cby_pIMEZF(@w-N~zkU835FD=ZZN{6gj*~d8AYPA2pokOJg za^yHjP%m5!)Dq%O=^-z04ksx7Gz17&J86i)=qpkX0TmzH_)psDvI>oR?Q5sSP>nYXq`+y)R547tF%{? zSWit65}iJosX=*t8+AdjO7jsn0!7gd+@ZPUK?{rq_ycQ4Vw4&s=Ad*bffJ5mDKoq< zzthX=E;{jaFj>xNx!!2ZtCc2~qvWIxV5ep&#c>I05e6nvhfeQw@gPx8`E11oJ(5ri z)oEfIrH;&2!fcDYjPhxC?e*uhIGq?3w^p|B=oT^$h1@8@WfX{vJ7j`rd|Q}hr;6eN z`=w{-G89k8lCTNk(jzkx>I1dV2Np(VP<7WUt| zipSZu0iGdr16R^io=s*8j(&tMfUk6+W`lL*L6gYSpNGxGvxm<`VH6&;pt}#Bi#&6G z*t&S}@VUr)$7Jdsv^u&UK(Cf#{ln%XcN*l7@x6=08HV(*QO+~Wa@=$B54^X_)@WfK zv84|#r{A~e-0qisiN-dfN$Y?JHb$g@i@w|bp2;&zRo)x-mbLT#jfcY>PmqAeJduh`Q#Ued z!esEI0`oG=;ClUc*R%eJ69^kPc(LFr28O!N`_42Ds-m>;#2Gzy(lP$1@Nv zvGlt^ucKZLq{f9;_dJtz6KhNYrls1s=d5EOB7Fyrn#*eR5;2NTkU^&heV@^iWgZC+k&Z~ z&IpW`oNx0!agz79g+-^mXLN{M!Ucwpy=}L$&^;gMrr0<7=_8= z8C?~Ynqnk?ebb-6T1kkUQy|A=*IO+5S03juSWFo7A)2Iutg(juWVxPnU zW78)r{vgHR^7|xpFUzyQn_eUY?j6-BnHd1E${{}awG7*kD9VcsrnMG z;hoLXZb)Y3!C{@*aCW`x4uRa(liT@>?)XU;E_I7zN*f}!y!CnphKd@zmq{%`T4{_+ zsn#8aS)3SL*bEh0=e3XF{{vmnpft==wIFkwQvTeEMl zU2LlYWVgtDoP)wZU>QugMZD=IIx2OV8Lo^d40PDG?Cmv<9j-3C^-x6-F*wH{j{!KT zOK)l11%{Lb=&%*u$}L!I-RK^2!}LL3tb_>~mt1*$8To2bQ~X8k`HEU%Q9D|T4w?q8 z4%luCY9iCC{Nl~#avXU=*AUoDaiui;g_}m;%r7t}K=yGsPzJVcMka{@mp4>bg@wV! zu^~oToem589ih+C6N=!muo&y(Ssh@3)<@zi$lid)(;zK+l6+9lv@;;qiU0!kKG02_ zx53gzq-hx!D1;_@*h9)P!361ICj=yBU8xZX7@y9PS8FH%Xs}qbm0@Lx{Ps!wr+yWn zB3`-lK zjKm^@7aYk&;E}0o342VgJZ?DnHs`u;Z*CmAeo6aptbL}BMZ04AcEt`8ixnbB3rC5? z_9Dghyl}CiBz;f*Ey%z5P_cbkY+n}Jm&Nw;xEkZp@lnb)_BZ}Icj}gR-eF@!z+i8^ zAHl5f`$-d4R#Dp;H0#+|oIr@)6k#r1jBQ(RqfdR{p@#ibAZ2^K4Htq1O2c|$;t z%ZTd^ZdAZ6H!WOgLU$@S=O}~O%Mh#QxRZnK?!Lw(m+tV;Zyc(fIGrA@bZMP;lb}y$ zQ(P+a?go>EIj*TGzxMA=xWLsI=eQ&a7X$fMu3Y!u@#Scv8MpW;9S%w71{gu}*vcjR z5XmJmK91+JoAbNtYbSWY>>~q5xjV@eQW;t@MUjQ69DK>=rNKMQ?s?%z=7pu*C(0MS ziahG~Zkuq)8jLDaEo#-$nD&yLd2|5*OVc5q2 zqT8F$Xa9J|{oxE5u=_*ns8w|mCMQ0+4=xvE^bbT=ySa6TFNKh|DoUKSqFnU?!R(q$ zDe1}__oKa486K4esH05Zz*cRGh`jTxfH8*1DA>{=Z(hDHt}Na^L(C-HFE8M-Ahq`U z){k^5cFz%t%d^$h9rl@g-j;}aW{Fu_?}r;^{P)XO z?6BE9h`?2gBh5R{ON)2YC1L`^k|g^!xN??8IrfLJ&Az}~O*&V#UGRgFD1p);G^QquYb zylaixFtK_e2{i>Mv}18MaCvr1sm4jv8yz4#X>2Tr$)}BN40AGBv3?Bk7_-CA~i!~gXawKxQ70bTfG~rWeDC&r-5F9 zhC;l$!{iuq*X^22IqTicWS7M9#QVcLtfykNE^s_#Yw%|B+DY)9Lb~RjpMVoFP=-NY z@>XIHO9_4(5ydP)310i2P?uI(!)mib{nnaCa%bdNM&N+%PAB#zRA`q;6%x*6?uCQI+-gm23$dYzPK+;yE#*0+n zH>Jqajtw{@&T8;<$ZU0J5+!=X__}{(nn7t=hK+W3HdQj=RtUKF%N14_c&jO!+)*N> zUSMcJXO-id=d^%VZqB6~+F^Wr+>*n_xqCz*UAoU`zu28jCrfxLS8~Mk!QYD;#oP&X zu=_(BUjJrp#dwk;iC9@-=Y9U6Req$9uZ;^CaDee`__9BbEJlYIQTNZ8NH0eBa<&cJ z#}#N!tbLpDVyAP!5aaM=r^vGK>RLK-*ZswU!}+D@ki!+Se9?BO^jK(X?34=RmAw&b zIc%S3an?pk| zJfpa(@l|IEXiSWMjEo?NDp7FG_ADv=(#pED^sfwMf}8@zXm@; z;brK+>)Bz^ODJ|Gp9Fd{xQH&qVE_+tVjN`ZvuOvIgv_@OxN&by;Ir??`QCi?_T8>T zoD5t>PD4DKiMt`8XA^$;eG}k3I@b&QtxlkjYA)qf^2rwC;UE)V1R5gdgor< z_2(lVuhjXQ)kC!K_t_>YV1d)YMyg9bfO;nuT)rPmkb#S$S|=uLQO8kh{@rwfMRJ$# z(sR!dJ?&z4=pn@h!@@jICR}w#-ZjqsInUyS{5fcd=W=0)+^JwgB;*n%6~7GaKQRp< z0159?(WCMQxbTt08MI`lD+wVs?;2UE%y>yT&>5^hupY$vwa`R3D>6iz&Y_ELUAiBS zjaCFO)R7OY91>vOs=kpXB%o=cf$QxXN)y4y2SKz*26^lr03i4NA*~LXm#De=ewBmy z{W@4kRFl2nRmA417jg3ue#3VQ(2B|E$z# zb=w`Bws`XN@;rFjs+@M(=RN1;a(Np(Jv;4H8nv$T^zyM*_N>vqxM;V#PO)@ws1@!t zPTH;Zxl=Bdj)KSSO6%;R-o9`O`NO>SxY_BPx07LYkr>%C=X+C}03rcrS z8>bg1rzZ}iG}RurJB^dGHtkT~1&_;CkWU%cFCombD>^)5pRSXXXU zPTI{@<=p9C-@fbz%%UewPoTBqHPGn!mYwDK3=e5X^XI*VHzMfc(F;}CPR zaeCTz-i9meSF5%2?#V^Vd2&%}KPd+_T9sCuMTxC}o6)63)X<>StA@mRyr zcDhjTO1suF)VM{GuW*%)b9UNloL0bd|I`rDZ@hh%f`(2Swd<|()`@dDeKnoEnI4xz zgaH8O3JIaARh*Mrz1e93m0vA_D!F3Sfm*cdm0mz%7#+2$JOLHV5uby#y3^{k8qJH! zMNl(}QLF1$Y@9i#XN}WVwReH7xYLW{N41vtciQ3a#bXReClzw~>pi@w&9LJFA{uM9SPD&8gI}Lb295t#?}82AWx^_%^XnY_xk=TJALYxoW4({62FNF!^G>DLsRU%qsm6qUabcZ|vw8&w^V*{E zBfs30|4A?0?sQLjU6_7)8_>)^xv9Q61R0%1<)n6YMoaUuZ8Q4xhJJbU%eRG8xZCQs zB+1MwK`0laU%q{$vc1Md{q#amv7ooiYo>?m`o;@|yY=?@S*O!xD!5h53@*&od<%=h zz0Ub*?Yvdv!rUM(!oMOUUpN<))9zWldCrC35*cRpHL|!sd6#fkub zoEM>W)*h{MNR}p4O_OBkZA6ILySV&fF9Yv3;gynF>{Uo$v9}RfCBF9=neuLPC+J|wN=A`y|9 z3;B#T7Ev-vE|C7#3_T)C0UVA&Rtfr5VuHh)M0xF*#3WxtrQ<&i3q?LokcE7cC<5(W zgg3#PFiYk0#D_5uiCl#fmX)i1l^9p?CXuT}6IbPnC|CW*VXn%@30#$L61l3qi?Aek z6K0@%p7<~ZB9W`K0%UFd<%+^%zmmpR?OlYk{+l>&Bd-GP#$G7?MqY$C9C;Vval%`l zMe%ovrI9y=#|eNU+-5j#Wi-P5OT$-lZ|u!E;u`F?U$Lh}F5yWDNQkn}UY}OHxjF?V ztx=znv;+X$<;?BR=lyrtAaTT69MWL2yuo!GnHpsPB}UIokeIz1QM|&J9YVlhIth@y zKJDD(#d;&lX*A;;3K`YJr^2I%@k~@ON8t`*aofr^>^Y|*_KnH)Hq%OR;2;ydEVn4v zC~$A&uB!!lgZO~LUN#mARSI;83`F)eHJch=VQWQ@NG3QeOJ5h>3^+ASCJ5XV0pS|a zSyQA6!s$zZu-+Uc8bpe3w}SgAPZqG+*&)1O8miuv>%G0rXt=QR018N@g+lXQ2#z9< zC0h?7g?-940l;J`cLU`*dS(X4NRxsWu;nPXHQ+oMr-p-WvGBh+!Ad#+i9vF6c*GH0 zTPQ_@1V3|m8Wo`5M?jdS#I^qQ@Qxz)Tto`rx(mutGZ{{n@5ExmH=LJ6*EGa`1p+2h zAVRg=8b_1Q+_g`x(;`e<0=Bflnsj1GQf#h&1`^JF9?k4Iq%Qv1ja)jxIi0kVr5sbX0y3MoNRW1 zfRa+E_Ge=s`dHUn_JzJkYXpGfadypc&xIo;s=v*wSz3KDG(7}Kf|7tMNCLPeZN=!4 zCk8!)CelcUdjo~phw!8m{E$fF#LMon(;ErKi^p7BSw>ND`uD zHXq>}HZC}G5EpU`Cb@6$NKFKh7sL71DScga&#PE!zy(LI*3bx=dd4~fJy7%GF8Y^? zn|b@|EH`qmVotgk2S_gOhpn_m6l*0LefA@HU6@$>l+H|MR39vxzhF7kNep!9C?EjX z@uLmS`jT8P-P*NFON|S7It<&pq9c857P6d`6LY?E@6ERK1O7Mf>+pO{n&NZHd=1jF znN3!Zi{Vnu9y3Fb>twwJ?h2vGrwGYgav*(dND&=pFJVYIA?|*ChwONh@dP1&>or5< zWHnMBKxaPYaY`l^u;{G+4s$4B!LeW-B z94-;JHdg2Uc>lgdZe#%n+v-7zP(!y3oR&N|ATO;s-^0^8vbm!mC6IpD>;AM@FrUpe ze%%XRHGddkB~|9Kjg9(U%=VhRfh)3{qAc#aCfg91aZK{Ub!;$}ik8THG-}2g{tM+9Q{g2us?Ok&zPX(8~@KQ_SD)nPlL9 zA?X#zEZ0>+?V^u|-&1HO@`nzBrS`3ATLM=fXumL0x{K~07hgFT%*7t}OKZ1BCGX9)S3^r+d`30_94-+>=SA9=Z3V|0#WX$7-K| z8P3KJ?$&1BYywyPJ{$M4cA(@*1VnUuJVBf`Z9OO#&NuHt_Im%F%0|e(9*6#^>*?-! z9FS}j29SRTslyS1i21!w^M}_SAw?wm-2q^>$cb=i z`H#|LxRq-xD~gzt`5o5rzx?P&*5hJ8wak3vt$U5 z!sVdxO^}B@V!q!t7{y>QW?p04X1iPhF!d0OkaizsGm-Fg@4OZ{Y^8kYWO1i}`_RJ-OQ>mXMq66Ic; zJ3-N+_O{u$IPcVJLgI+hp>z<6(5`b@Yayj!2bo==4|gJ)sQ$X!>eYHk6icsfaYjzm zb}RUF#n}knsGZI4zn_c9rw`b5hZlkMo)1rQ;qid2zsXD2pVN5yzyxO35-F$C*?fql z`nksuUq3_-_#WY3kmv!o&E55$)F44M$<+N2yx3n%hVEJ+r}8o%-wP2Tq0&Sp#VoSD zBB9H1J{m0Nhx=~z00DWhzT;p-xxoS&BX~)vRgg}P{FgWqwA`QRti@~IJV7+@PLYsk zc8!CtxH6nO_<(&6ZP}2=W&HYpTjQURNIoC(kXn{t*L5c;{`nz_$F31dD&zjmw4&L36qzk!R#x%$Xeu zrv*qpOk_HGAqLCnl9d!YuU5nm2?gPE9HN}-zP-6|a7Cm3-&p^G&wDwmVkNs`<=iKK z?bqS|3I~TrNBjGQQaSuQFTa+Ghou6)`x~FsbGh9A@bCX5_w?`nB==AL-cNG>sQxeI z{@1_r*K+5##oV9&m7`qq&woGnXSu(gd-2g<&wcz?o!s(2ZszuX-OBytU!Udv(X^BM zc+tt7|F@mo-~WF*xj*|Kd%0i#b6@BF^`Cs5`=5UHb*}VRzRvxZ|I638fBL_Do%{X& z{p;L+^?!Vw>-?XWxqtc(zRi_h{wuk^|F8Y4x&QeOCb_@*FHduS>Cfl6KmPyT=6?Fw zALstY@Q-uXXMd9Wuh0J^_kTbBliVL&{z>k?`{qw_f9XH}d$~XRH@?fg_&2}H{gZ#| zyWHqczRUez|Mqve+rRx??w|cT-{qG7?svKW=imD-_s4$+fB!E2{s-UXe*7PPm-}1a zeV6;>Klv{AxBt`ca)0?xzsr6155CL&_P;>=fBYZi{`tNCEcdr_f13Me|H41a{psC5 z%>6fi>%Y(a<9{)i`<>iRb06nE&HXZ0$$gH0pW)vx@%v-^{WSL#{(hA^#?MFiPCxXw z%Ktvf{T@I0J+AW+-qi3<{roETC4RmD4Ep&v_p{uu@a<#y^E2T69hCht_v^^hUja(+ zQ_0nVgT8;{*QHMi3sLh~?#H0Vf5y}cs6;=t{I}pQX^rB!s!MNw!%sz9 z6&wLs{B}@=ev~A`W+f+4UvT@FwVC?TFVO5Acnie8m0j3rHYd>lbJ>K_`0X_mAZd$%}pjwfb-3R5F!R zTJ#)MBB&=QCb?04@gp$&mhn_T2T6wBeuO8aU%!VR(t481Z_yIce^pofC2V9n#9x7f zI95lUkJtkJIQJ9S6)H_7zr;WBN#Lg6U*vw2`(3p9bJ&w#OGplLkSxqEm^x}1)enA1 zFMoy7pRg{eo~izl9x4h&s}$vg|0BR9nUHPyJ^4+&7qxy0s(%-yK4I;rcgY<8IrB$g z{W)VKxhX0>0t~|SDLC;{z!El7{8o|>`jrel`6=;&ern9iPk`fN@QqshDRc2R_(V0u z4@pjy7xshNPCN*Hehx@KM{V_-EI56pQlu4uUZ{HF4N>wDr0@&I{w4E*beLLAZv__}9Xw#2SlEwz2Q9Y&6iJs8&-{DVR^4l-K zBS8(df=W=W8hA?@_z`Lmjv7Bxe5_e49jUHn$xsZFXheX4Pt zAMvNp0qYMy#h3W@yWo-HpwJJ3sW>Qf@C(5D73z}(qV|%N{0jdB_BubM9z=bLxJZA= zx1cva%!bdF;nn$z?2JVB+wGV zMXiYb5LEF)T#9}c`u>|p8|XX9fP7MtF16tcP(ZC9_+Q}({U+HHR51$BC#oSN^97y? z*^9TqZ>1$9Rf0q~2r7LO-lXtEe}iWNAL%`56aA~>sqh6wd4gNxr-CvnOC^auDob!_ zM5Ve!Dg71H(>noAlnv;m=R~{kimBD~nR*-j6)jV(u1kp267g1G__fq_dj1*y5ohSH zfI-l{k`O<~(@&xO#0OQHu+wMyOI)TtL(r)N^?1Q$(f7r(ucW2H>`AdBM6#s+{ zQXRnqlF+A;DtaRN;%D+1VIX~@IR(j=JP{g2>Rg}deFYDKe5zmK-$(qMcq8~NG@WXR zna-Dh@MFeBFg|7vM)-O(n;_i31?5zVe#r9Gxg}&_>Rf}c*FXz#URVigE6I@NJA!s< z+2{Q2OVq03-H(9(XTVG)eghn$B*CN_Tgq zq0v!%rZJM<3hD$lqES#tP=y{)J)u!lPjL1NaQkDFReV-$B@T%3mnbK_quOL&sI>S- zpNKj^HBm%TBYeNbC#pmL1V3ohrf&j1^(lfOYKl7ahB!hkB$)I=K0H~zU!#2jKY3{4 zop_=~pc+3VO`u+*`d}T9>ik{wtWPlpQjaA)ps|hkLFEY+wU~Z>51)u;qJp?Z|GtET zKVt3t3g3u!nw!!ms!bX~&xvE=+2{P6U=tLwVPx0Dc⪻{Fp3R(vR>HKFCkd~XbUc_dt54Lol!r|;5qE@+i?(fpPU@?I zk3^Nw#cg^+WK$i$C3{Wu(!Y<;|I>VTl1K#_tNTO3dk*_T>6$>Egpj?EFyR$HVO>z3 z)<>*uCb|6}v(+*qOGrK{`LbW)ljy~Yztq=~su`RGvPOKN|g^RbhfgBQ|-ear+#9LS>crLZhr$2a1;y z68nm0jHIdbFOFeXIzwJS4gbgo+>J*?EwcBbvXv%o?uzcHq)3Kgxrn(Al_Ot~ev%|k zdbS(R)&Q5VE6QlB4|=M2PS5DQqFsE`X{Ob7(g3j^8?>5gs&{>(o*66SkFg&>-4E^DNl;# zeTIKu;y10g5ghs#=9v0MZ%9hSCxMw}uKJH^r}|4}sg^3Q{t8U$8~yzSa1ve`@rW9# zDMlUIH5C+4i^Xa#l_g!EUPka~UxQW_jwOF-^{t9$BBDakPk*B$B0&_K4Bm(t2(^%& z5fqXj;iA|GQBM5*LVgo6R1k1@{|S1H`a~2GJo-y|LqA`!|3D=i{2b#u{d~&r zNDIYx{r5-UI${0|_M6lX!J|4Ax#K~2gEkTU1YKdJ@tNolS|}(XTR{A!opCBlPYLT! z0f+W@X{R^X=cOkh~lK(dUUP zqUNvAW60n6U1;RzOp(qD^_luNtyK~Q)Q9PZK9g<`ZwZ5dNBei=AJJ-`z(thMZXK<0 z)4r*wNxV@11g*r~=+9SZ;V1m>6TnlENwn@;1I?-i(M2^$MxUWQ{n5H#I6+mrq8OaB)9ZYi}*;`NP2`PkTg9dob>Kf{;c|xfKGCc{sg^9yrKO8y$pT( z9IgMHTXM|5sh|E5?G)w6mXMbG%$F*yj{mNFdMqVG8Yg-*^)Axv&+(mhF(~rtGyEeP zBi8Rp%4#K<+NXF&f5j?1t=I~lll4&2Cr*eNFRnB}&nNoGN~zz1dV-?=h}sGY!K2pE zZ}moe5-l*l5j~3P(7Ghmse?x0%hNbS9Q+dfn*LFnXud%|^jXj(ev1~X`M~@83u}M; z=s5rA(NmloT)abK*7yC5co*|#Np_% zy1n$#qsl&C8YCjkGl5PACGp{`Zk-b#suS63om1eZ5GYQUr{@Hz%S(o-ZI`v#bUeAb zo8#_o+{`MDyy48}OK>!S9V`zEIvuyl;vM98(d1bIs0A|BgIAPT>+oPP zanxY|Ds?y)C8m=C;}|@5k#Ny;T)sk->qu#_I+;GoGtO{of>qi5^GHZgq12F~pRIS2 zNTvaJbiDuQQT3ZVPD<0s>LK0Tc6&X$a*+Mj=L7I?iARrWRleL0eQMv(!lVYR%C+D( zD3gi=EijM*Xc6^EV74`FaSb+goCsdT)(50EQGBKrd8Fy?a{(j7e>{W$ zSnxuE8pfhbu6n$$rS}kngSji{sX#2i*4fO|pbliR>YxvbpYUQclMEO{h!NJk1mq0ilFJ5qb7T^FNWkwwZ=RRxa3x0G z)BgO*Tefh8kJMo{m>~|N7foePde!V$0>;*!;T9syn1V@wbRe}(6e}WVrDJlKkHp^6 zkv$CUO+%LoQL8Kc2Kkio(t(Ais8s(wp(hLEr!s$EJkWaK{jx!}{=MNR#9}J*zGOfY zgmge8NTzGO9_6bQ=hCfv<328ua;3wLIr6+eSuVo;AN>jmXvCoDLvU~UQ(U}t{f^Ql z(F7bR*{`O!nPx4ZA`8=Sb~jy8t{BRHz?WOOjX7>Oqs&ZCua-z(0n+gmz1DrgK56uR zaqUgwq|K3eY~22W*B;!8czlcJFnG8`QZppq zzzwOv>hi^Wv4UzvLV?H%xlZ;R^KVr@ARz^EGhQL$0QXMn%|yUWe^#O}Y7{5H4K1!R zD*!iv6|GI-8tBam_j#$&U%vEcdE*HUE>3Ic`8Q!|erQy}2K3h8vPmljHnM0g)W1I%ieB4Zw)S6>tkSTRK%9VL|9qrOYf(V-fpBU9ZFW3Y3vfnH_X30TzYwt(oN|LeN!RVO5FpVT=q=*W8YMWHn|_AJgx}bvzUEI zwPFIKbsb(Vv&NigO<0x&w22i~;7qp@A#CYISKzVf^&xCF6;|Oicj+)Hb2%#viQO~- zLt?o!4DOlgz28*0WBGHZ+I9ctmKJk7+|E9^@!XpQR%@`pL(4ZK6%)etfa623B$a=Z zuXoPc-8SN6q)FhgnpxOB9Am}82wh!`uJ&KDV)E@v?dH}6c3z4C#oJqOqJ2N|c^JX$ z`kJO4Krr{NytiuoO|4S}dr!O|y%i$z4lN4jiHw3R9rw(Y#rtQ7nS}f01-5XI@Be-4 zM>-X|=LlT~Vymk=>@)eiEfM$360^464>!#C@0StjdU`LsNGBm+$L!{2Hg&zXOKf>A z-8YlvOLuyA<6`61X<)-ctc0(MN#h}$7G?2|Lg(;@GcVKdl7gVM2?FKHrXe`n1i_iy zY61eJer4mgm4T0$MZ;d)n(k0Dc$|e-A4i&Zo|h0gyzIZlwQCe>;&MJ$;Rp<8Q*3ul zu@|SS%=Y;~mNib=4*8LnA;S@WCp$C1AG+j~{6^xjuW?!TR{TEng7!-T|CI!wAwV3J z>Xi~hmXM|p68Cu=i#wUR;tIaOJ9p&Gy)kcqKJ71FIZt0A@@~|d&91d2Y3#z#-d$m@ zSn>muC~S`&nrn#yK}F%)BLG{pHJJ+Nhao^+5D~g&TwqA7!tr6Mil)}9kZa)|m-YU# zUqgcYsi!kTOb`_4Kzk)aK#c{AZIIW+y#Re|UTaJ8wp4|yZh@FsFia*c#cQu3X-Xk) zh+j_L9F*^%uMRqr47Exw3ULJy#K}eU86h-|0u<7a7yKdR_8klcrk5BYpUyooxIDe- zBg#NTJ~S^+-Y&cSTgMa|c>L&^?tYLfHX%~s9Qrr=t%4&PurH`#^B^9zs5LZRs0-m} zC|^zW8txm(%C8nMZ4he^kR87* z)z^RxaY$BMH`t}aMsND_k$dC8wZ!FUFg#8ACm_*otoWXnVQH*aiPfH$2Jf&cAsr^% zHlPJF0*ZW{Ck%Lp#e@(<4SyXafRJiqddQ%SQlfxxu8+U z?j<-(v57i~@64hV_kx_+49qEJ?9%PbX16Xv3Ks}J)Tj*;s~3_`Q-D%mx*H&layfiS zQ?TvLaeWGP$6R)n9bx3=rdp3}jVaZHF{N6^6c7WAn$6t4(+0t+J!TXYOXFf#OMvH2 zjl-(jPBNULLgILmR^eVWUsL4w+3nK!U@to%G6O6=+{P-xZ5F-=P4_Wf!IXb5Nz$rL z$Rm+;PFBAoUr|e#%NV=#EHKtYKe91H7_N?b>0{n7Tt$ev2)vh(7vg)XB#_ zB=#C2LYd+c^5IKw_{tlV$Ynr_Hdt_Q+idni4*l8?eP1mySWa@okg29PH0&Qe_s!1=LtyMXM^B;J(})5 zpJU;ixe;cITCLT_9(^h*Vwu(hCZm_sR10T_mh;&=d1Npo8+@^F<1`YLh35lKR+VW4 z&{Dz#dXWXUzY%8Nmar>m*Mx8#Tgt<=1g7i+n-0uN1E)0rsYjrRVfGnoTQWV zOfqy#-Lf6AYPJoCRg6+TS=`bx5-tNqx5V22oN_YZY#JCDSsum{x%Z|!H+UK-ul~Y6 z!svV}8kq=j1J4F<;nk=F1+V+_34$Jo?zN~yz4d5Oo)v-#XlwA9pu-(W#$ss|jHPJs zD{oGj!tT83(8GL$_YyVzeNuVBXTCpRF{t!g?^6~kqnCSv%x(Rl=gy{{+h6i#)kgWZ zgs6P&T3cTj4r&LzW;0NJKcmfT{979u$ACS9Q!AIW%nZ~AM?K+9{8(l$T| zb;SgR*whux4-ekyjmyTVXNC=SIRfa4WkYVF8d+D|9*>O8O6AVlN*Y(F^{jRx`!)cT zz|i%esU(K!{Sf@qWStt?q=n4bS4!!8>B!V*7#Jf9I@f8lQSag!qEYbBOpY2cbrMZ> zVpWIIVHn&#laWa-o}vWt1zo}RRPo0vnFWuq#p~-Cl2CaxXj9a&^y+A?91NYI=_2VI zrT{I>tXf=2Z0f0TEDRE0^bVSy+%&FJdR_apk~_6JV)nBhVFjL!!sdW)nK% zgk*G^Bfvt9i@ptYmZSpu{8Q4BR1DUNYJQ=GG>GmYW`-R z67*=}u2xO(wnP1ALpD-uBgNnOiio)-FL!UoieN!5#NTZLk8*sA@VT4Q`aN+dJP_Dx zSOMDr#x4M;Zgs+uRhRDNbUd36v8cjbzIT`yl~2LDFTSN-RxFj(Ay!{<&z2m?@2{i; zLtyAllxOOtZ`YK=u^Dk`rf+S2GIKOtr6bwi94k`(8c)#Z%gDy)dO#x$PYzoTb+zOo2~0>X2v)$9mmVxH!bXeQkdksM#+a0{1`egv*cPkOO@*#E zKX{^~ooZ$fHqPn1Sz(nlXYMj-b0V;{;dydG*|5&7EFQDUX*D9II=&8|c?h7xcV^S) z<$B}nszlppS1X~ZD=TJdajlQ!#3Py)ii1)?!y<3O^haJM8G=X=(etH^Om%mYjchQI zCBF~TmzWhXiOR%+VJpSw`lM$vM-Bk@CC&hbw^`v!@gb&o6hvs(T#QU=d=fQOc2qh8 z8ST@iQLn&y1hZVX$1aivKFdxna zE%RY$w1|)rMN2F=C0u0#K4ge;Szr2gNH*Z09RhpyW`MU5@2z8NHsQSul8tz8gCGm< zt>JCJdu5O`x*n2U16h_fc@rLB%+Xy<`?;>Bj+-)Y8#HX7y<3U3(s;1KZf_6W26Eqw z<-u}~*6elq&bG+dK>FJvLF2><1=uRa1RZeU54*GZEfO2px_B7|JFVYm^pot6Y#>TI z1onc;0B>7jupaj|5rYkqjl^JsAd48R;cZ6@-)F~Q4dbxA0c(Aw-3kpG==4_b+pGNc z(D^;$baH)72U!=$2?j#+xXe&W1`3(=&!ou1C~}3HLHv<7pJ{OXLxWTgrv?3@7=yfP z?}qLLtakjP&6HV%E~4yU6$KYjs#CV7*cSt=r;PE22F ziCZ=tqO~=+_?|UK{kxYhffqSU{j6jgGy~HFf<}Y=22ik02SA8M?IXwPY;$0M2ZBNi zG5*1t%_v1}e+4m#zp|evWjm=>knmMX-5rzGks7HyuTWun*+Hhf_%hgi&RfRa68NM5<-opi`&_J`Sjhb=S0?A!Sx^d$_Bl91$!T2SFs}bFJ@2qp@UEWATDNy zncmW10&Pp+>I3Z;MoRzUc8AyrgC9nW%{&#^A!2-ez+J*X>&`lbe;R-D!}!5cD(8_| zTXg<8eA@U$N)rzB^AA_@{OS&gz2@!!*Cz1R?*>kVTKFRe-_;Xdu1!9#3=l7#QHpwG zj$L@u#bh~o?YW$5Ql07B$#lX`NQfy5o!QftDO$J+Sj-rBbDL)jb8mrbPWik)HJ>)U zW1F*^GeS_YMHSX(<|1-_@<#|jl=Ew zMLI4n$`K(ErzzzxgdD=_frx6gU|WS z930;_T!=03ir=tD=tvps7aR)vq5}w%*#hS^ad}0-LCQADtnJ^Jbec@7``m!cm}%RZ zTr-43g5Bp)iiOFT8lrHLmmlcFfEKUzOwV1dC5RS{(9DJ~X2w;GHNoO&GKnR!zGGN9 zSrdoMsS>0vKHUc25^s&tEdKhevxmG9_w3Q^hJoT_*cMf8CBTi?wG#SvxP-2-fkTDb z7AuTl7$B0iR_9a@0}gu)X7d6 zQYsz}4-QI4{o&qzKi|(6_DX|;fma;tl@AJogCnDgSX9iQA{NkCQ^P7^QA@h-8C1jq zXwYeV6|tzb6Ly4E#D zIxHEj$ieE0S$MJVPP=rkA~#~Z{!)R2*#yV6|?YUHMArZSzT)l6lgR;`-4)UU)moO4*CcE(ZH-C78Nt_!~$A^ zidfXjt|Asd6I8^a)=t*|Tv@24%cou1CW3`{6Iq2; z%B?zzSZ?wy-14ozT~0B3ECFA`<)#34up4_c(;72j~Zh z1N5g@e-6SS^cSIw3olU2edY}jH3uZP9XHsv)!wKh{7>}L`yrUx7MWO7mv0M5Tr6#p zYzh$d7mLXiU*Sq=_kc&=xfDAxgh;>H7Hzzn&gOJmF>am2?W1%CB4tyA=|RtaNs;fA zOCO*8;PsWc^;ZFw%B3eS1fk1hK;Uzc<}B#@XJ3cE@o4px;~3?-*b2U&G@h7<4>+)Pf%>=QYCT6n$U%^`^uo zh`pfFh?ow|=cL0V5gG&j(oq_#g^;?>H3u5=r#YX$^haoaZphJ->)Ersqvn(?x^*Oi z!JkuZgh9VL#SuR{U z9F56{R73Y%o1=GT!&kU}o0-O_t2>ggu}2tp-R43R{# z*$i|#n_^Nv@aBjMjlA(BncEP zUK~G)RPx~246Nym$KxaT<806^|7BawPsv_(NG3g_h9e z1M#NJZt2tle$B2ucYt+ZBs71^ovls=I8fB^GNX8@1`F{mygat*7IA$rNx5ARLH#_+HooJS%LRAQb@CGfIp->Mz*injk|bxHy&SmZ~@R9x!fCC zo|Mm&2twm^G%>o)Yw?+&K87POhI{7T&8Jsr3Mj?6N65YD)dY8{y}=EhIATa7+<54` zQ#@O~f!g8Np(x_C9_4G~%hj6nyV^oxmwdH{UuS2PR;O}KACVg--;@90<33)V*Se>T z7FD4F7rkx+7n?DJ8ooEWm1gU#aVpcsw4A%;#;-u|dC7>~=tgW`a;R_UOc`y6Zep#jA> z5rU=!<0|SYIf0>kaUIV7xNUz1VTFGWV8mGTIHf6lY!2u9rQ*0)C?6aZOXFg>giz`J zpg0=sdHFrjlwCE%7W?XUU<-YJ)IS`R_71&Lf1E#{?e6h@-t&g}qrpDK?~+LBQHf+* z_)Qjv74AKCkTgvi<6@s;IS`~?KFA*+oCi|L7e|A`;^E=`xI}^K;^+is$`RGtMnkO8 z@A;ZV(+KuAg~8p%bcTJCP=~;m-Ma33Ns}Voy{4%QsMyLh5O(tW=ckJ^3rZ(>mYBp- z;dkbp=Or;o8DICW+$F86j1JaKX z(Le{-d3Rb^>J_AO1IP>@XaalJ&r6GU2#I*>&Tc6zBDpEP{|j^!IRLjzUEpSad)o^> zPOTP~;*c(Jy)F)5!w;P--DUqux-R}50GDoKe(Nq_Hr%IISa?Ak2b_}a&JKMSDHzM{ z53Pf1w*u)fw_-d=kwmPlP*tCQ=>0;*eO?d>4eQx#ZvvOL4LsyO2+fJLZ!=!()EF?lXCQZf>@+rp1C^0i)Sj)5U-~mB4MzkaNQr!vcjXveueuEvHfMAb4Fm{E%88Zp~cOvilC$H}(h zX#cQ3$PW(3h5gY%u~f+C_xptduRJzmwy3xQv)At*9E^(n{$OxeIPym2qk}`>_V)69 z9L-F@yt-mK=28AAe^5BuI~X1f1_uY@LD3uJ4~lzxnD87GQ!rapOvSv1S=AUGHja=L z!RbQ;^5Z0<=N*i3{$nsaG`88MVmfB;09#D^h5ZspC>$POy9wV9hkN70LAgJoxlyui z?^#q##a!GUkM@dCtMaJtd4)1GeXxfK*=U4AFQtN++cp)`F&{#ahhE7W zxB~NGd7n->kH$q0ovASL3WK9zIe*X}mkN94{#+cau9%M58{+`eQGYaoe8)$75PPYN z^G)NU5)Rbvr(m|In2OovFfe;^JW639SM9>uR7}UbUmErY#o_?}?Ulwy`NBcLD~t=} za{dq(T9%D+#*XjGis_h#hsE+32MoQv{XzjtP@@4>arTF>+NJz{X=KK1Q85*B`3M>{ zzMskNzK9A%3hhn(&hW+s3> zC><5XgEGwZ@F2fGC=HH|%>5bO+RBP6Fps?v+_0naQR$$3R7Tc;A*CW1925(OheNY& z!>+Han2y=vgljUlEh?sBwmCSNh}ouMI_CZHu!zHQLkyIM2N3V!VSj}6)$(Xq+Q(O8 zufhuK%8KcjElvU^x7ng%D(0g+%*avk5C_4AWgI&mk&2ByI0+t%+0g6(+Eh%%+#lul zhd8M?Eau^kV9fA_dmipw93AX=!^0HoX;U#3GZxJ;5cf+5@bXKeQho$qaE#+`@V1LM zl5d_@*;Gu&y!vov@>pem4$v@*MHm?dr7}jRgTt{`9_&Nbdxc?PIOz9FWj;ARcuK8a1mRLrBjGO}?XBS*P>fKl;i|7e6k zvR^eH8wyBtodG!fP17?eg>6k}wKFZ_r_+W528jg$kfp6j0OP$YOm#nP}aLV~X& zZ*Np8Lf9jG8k_AloS~H!Q!$V8!+Z(JJb-LiM*GX7d}*{d7{c!y4Y59CjnqNTZP3E>^P72Xf|ucY*8^0Gqwke;iA3yY>2a^$T}aKS)-kh7vEw- zgtoMbrLxq!u=Z^Z)Zdnm7``;fI9?~N(}<9py0VFl_it5GD6kL+dM^=Lk@uI0?VGlJ z0s=N54c=feyGFFEyPVv3DhdUgP(-Z1Cas7)uDCr4V>*5`y2D95I>9UBR$?^}lsTKu zg4ofgt5DT1S`n#RVACqa5YFGZ2oApP4?W7>-K6Aw5Cfg<i;7fdm1hB!*nIM4kW?d{PG&RVezU z9*d3?j5s3eM^2*_hsCOWzso7@?@jmw@(9t$IDkB*h5xPGqb*_}6K~Nb6b0P$?Y3o% zPr$fj)PepakQ_=I56~%5V0cRffV<=mY4VvlP)@Iez*rxE+M2N-3A!-`ncP!&Qv_Dd z7bE~iB1h>-QVkC0tU zFKVDJ6xfw5;$jh-ERrvl*3f(6&9P}KbT&*(6ZUmLQOtN~rOIB8ZDMFXA8P%p+P3xqaYu>i9U z3&KX1A*8iDp?GS8!{xKKGhBO(<~=)^F6Zx@`1#6J4Nb3@)?{PNjEy(KS%(dnkqlpH z(;;ETQUo0z@dR2GpRA6}Xj&PslC{OjRIW6UiH>WyZHYxVTMslQ4h`iZAdJMye((} zj|_8;C@G00bzgKNBDBtYnKm>gP-RhdCuAm!5G$w)*VqM7aYM+qGo7w@r9{%crOT(q zVO!{)b`4eK1iku1O)$g7{1f!3(nPUla(CHZz2w&F9VuLX4UBQ6T8T7XWi{TANe;vpx9LJw zNEmiQ$?V<^Us5_Q=UIJuy+~R!RdV4I^BQB!6}ZokTF^fOHq5{>Av2Y?!DYN&b9}*!~?c6o)r(A_J?moTbk90wVI%=rFO))Ou6-P~$UGVdSZa3}b~1 zbl^rkTr#;`K~!T}EwGr_W@?|QJT=dRqf2>3n>g)yt=375y)&U`8e}84P2?LZn6YR& zxdV};Yb41?!*61~skNr^eq%FXPmqlXaYE7ca2n-h!fdQyiGP9PViv;+rN0di_U8VY zFrr8-Ci%$5B_J`?FylxNg&BN8VKZbStIhC@RZLhkDU{8>Y8F514b#NM`WyWl*l8S%yZrUfe?skSeAINurYmAr9WeqOg)VtP}o4+epPk$k`n$e#l!WbSr+ z^#dpxv}A|F@%qMy+N`4^i}rXkC;-P-gcKk{n(53GnPiKX(iIMGD0G{v{Or~aIcUqtf;ZNv$JFqQnas-cq(3_L{o*rA#$o~Djg?n zvhJKebWvraS$akry`?THl1fS2pGi>B{;H&n@Uy4VPKCNCGV`l0`aXit;zK0!cU=pq zN4zC>l@Mo{DMpTk`$zf(?dHfnJ18g>8M;=+{-q3EnJ#Fza$Gi(iX9Jhr$qnE4oX;V zmH=%TQm~WL$jF1qkzgxM+ z(7i8lnh04#ig8dT;eodsOv@4_r%kCtJw3sSwMv7^^t1TZU@Wohb4Px8@1E=7VN67?rddP0QTBwbA^ z*Gv%p0x*?*^h`|g*@}%=llX+lzX=K4`VtUnC8kJaeTP#EhY^z!7zL3Ek!{qwDIevc z42_&ojQh~D=)FO(Lct?4M`*Za-lE1Uz$Ds3maGIAWmHW%kVq$T4VoCuv>kl6!qo0== z{Uz>oz&#*OD0`+8=@X(QMdUV(lq;+)09f1Sr83puzN*K_Ol;0xyg9`!NJlh`A#JG} zJTJi)Ss@p{#6y*cPoPm2eu;-Fg(tZ06vtCn_K`@rhboZ>nMS!p$~{==q#G{Le;%wX z%*2zK62!kh&cDd$$*gJ9U##PTM7<5uT#5XnXgiGCk8-78)zB2iC7rOuR;;*(~PA96F&ED#t-vq+|BO&az~c(NI0n*{~~Z5F8qt!Yb?s09KOX{&P+Zb;f{ z1P0O$Rwwe?j5G@b2GT6@b8SYN1p)(U$VId&Bh+T3Ss*ZwW|4nsGtw*&L`X9pv|Epm zBydPq!o$^gf*T}h(E=OQyiw>UKS{bwl1rE)CJ2sc)RUtzTd+&Fh1g3R$e3fnZQ%vU zi-N2XNI_345$~HSWB{O8PXCxr3cJ>gZP+}t#DZ(@g}8fQUTR>-4*6ojdml{>FG#M4 zUlGgG+V5R5Wo^pd1KSd(${L?^dnG>KBj+*^_a2xR-|IJU?jCt&L(@I5ilVtwHn0tR z+PQ|UN!C3u4E)mf>rC54C}!A(OyM?`f(;Dcp<>>9gC4w)o|pWnf~RzuTCimmkJ!@W z^+6JN-za|I%A3+Ol+zxz zorQvEJ&9?8Njk(Yp*VBn0QSO)ZS)2%m#<{f$O>;2G7;W-;qEEX<4Ac7@} zCsUWR2FttH{Updms7d%8F21C<1*b~8&*694X+%TCiWAgacyk3SJrxLbrNve>{}$^w5eypX|o?8anc=$0fTHR znvmM;G$b|Drk)X}#TG&$PK$aboHly{NjPolnQ+=H`X}MEsb|7zvzniT)25yYr_C~b z5>A_XjPrVinB8Y{Z+JIfOmJcJ4Kgael`a9cooQ`fhaW8n=SYlv*R$EHyIXg7-Crz_ z%z(TXz98Ct?9p}S%Xxo-3#z5FL2k?`-vteG#$?>|UwOziG4#Zh(6_ig^_l-wT4G5D z_H6w(E)_&-1^)rQm;s87Ue}w?aUBCgQ*BFv87dtDdn40y!x0Om?_yUt9%P+#4{T5s z`HnGjBWF~lEXzBzE~3XuKK8CB{lVmVvV13VgR59b=378db$xnN)h*IPgXA;5fZPo& z^~+~!%jOA1A>c{|@L++El)*drzM6DGpEIy{tJt@|6(LZ^kW>KF`b$Qu!g*14J;%E2 zJliijm%2J3Ofu+KVXZTyu~bgJ9l=5A^+<-p$#aSj(PGXS7!JkS)^v#Uc+;z7%CoST ze1H%)%v*@+JbyyRPp8M9F4=N215qJ+rP!kk46_fw=+0_bFg8B0^+rVq)dSU$s^Qmh zsa)JGuaMYg3sSi!#ZM&(O&UaX@WkshkFlq zu3%^XcJ{_;p77)si#zAd6XD$4Vg<^5>0vUA_PBLqneoCStazjbSn(~KM#7xJSrDuL z#;o}Y0d$Cta8gn~`v;~lSKKvOa62uDQhJC3grnJw>rJm{5e)R*c=Lsa{95kv4VJZ# zbW6T!J<8WASkI_6>36ktPQQEjb#_*1bt>odv4ej-`5!*+o#y| zj3LzUz0s{STW5_^X=7W?-Ewlh&^jj#9&S&p)XmvrzUeQAFKLy;X0Z(F9ZLEf&qJTQB2=@44|7Eig8I_3GV2 zZ~W>Om>O@fjQGGCZ_xr%<1N-RA9&*}T3~9t#lq?XZ@fhdOpUi#;eFtZw`f7M@kv4B z?0Y=WrY6y=g4~g>k^{G;pG`9Wc>C@tV&7+jzlo)Ce;Zttbe{|FDOwcI^A3LT(#zr{ zZbK!HaE-;+=!JZ7-yal)W>W5(dH?nn6GNbTSTiccDxQmGU4>3%1SX$iN%F(th0u&^ z&%1TU*!zfHW2{{)ynH!XxJy1S=W|d@=ghu+aF?-k>D7+&f-&ArG1=YXyunQ3E~hDe zo8DmAC8{61LL=AFX`?*)UT%^tXYL&`d>8heq!oaMys$VZg=>%E3k3~4WqHbSIK10T zDAtl!B?qOFaJIrY0n0s00*0p%oQbrxeA*~s6IAWSy`4{P`nX3B%Y=2xe)ia~AIL{B z*IP2+R84io;{?pE|)~9Ijh1(1e(DH$r^le z?qc`alaa;$DU0;7K(?#l(NhVkxRovhfxEtu4wx6i-HZZ=9!f8tB-IFAqNZx970@)~ z`Zi1QmauSf6wF`=+o#3?#8$`)?*g$WVM$fE<~E3lZ=PkKCtf)NNht?ecbD4!!#(#K z*8LRbg`AHS$E7jD;~PZQx|M>AY|#V2=*&Qpj2GQd|Iv zsI5MB2mR%f5Fk2&VE`jv*#c2pl|mdoF${&bD~Y-^TBdh5E}d?sNJDw-cyKokqFfEf znB(GCxHkj1y4?i-_D&EiGsbUD@cIDl33i`@#Yq&q&m+;NVWH}*)|pH+uMN|R>|3OR z1EUQDsJ9tFg&U?dM!+&D>>HeEOWaS*3(_v#r`}?T7*@nf($-gHv6u}f=&Cr;&nvx6 zikZgB)@ZVv%%<+^{v5}=&^y_Z(f)`yjC%YC6HAKm7Kin;BYHSfy<&4#lA?kw3yuX* zYO9kEBn>9h(W<))cuSJjhlv^rV(7g@(6dCXKPoslEyJ@^5%A3W=&?Hocu_yk_YN>* ztb_tM%QGFg3azjv9Gb7KNhF5uf1A**jE%6tlHA618WbEOOI!1HM7y4qvbV(+fohUC z^-#>-mcRo;v~ZFf#E73opS0~s8UhuGx{j(I!+RUHnzUKWyJ$yJ3$saQD^w)&#Frip z@kWM)m?5TfMq-Y;I$;O}`>RBjc@+X~5fDk%k!_#!Wc<1o@r1Fu$B(||D_cOfVZ%y0 zs=>A0cC0L&rX!Eb1mRmbUXfnqHH^9eO6{@Xy-p{E1Z$8sG=(>qgsQGbN)jXs3gYV= z8xUav7NH|)tY)k%ed;0@mFioXFCbXv;2oFWKj=#7NzlSewX zUzvj;aF#c)k1!MViS+k4wJr_8t6e@Zi zNRwHY&W(wH%Q*4W^2q_YVR5a2*U?wi)b05!UOLsaOdFXE~OXkE6 zRPAdVJBRCy;F#Bw{fm!h|$u^X)7icYsS47JRw z#<5FX>w0~hYur@nNM#F_%=N9s)2n;$W5F>#>4Y##_!uSZmz@t1^gx((T_#@t1~Yi0 zyHjvv@{$lH9JE|4G2^>2)dL2d>ZmMr0szY%N&zE~bS*@?S6y4Ty>=^1D;5mY(5W|3 z^4MH6&Sk>35tqa25e8=@BqTO02!!MohRAlye7;lXd$pdillewxg>o{I7Wv3w+63?H zwJIPsGP?PMWKz-q98v&@40L|)S)a7a&_G8<8ae!7u!sGnyX;@_B1wgY=0doKtdG%c zClkM(`nYWFhdqypV%bKCb(?OjkT#1p+T!+zHm5D=0}g7D*5R(5$lQ_e0gzk zFlEx3Zm5`kU4?9ABFdHcP+50Ub#hnKjj|{)W?KvJO$`6wxsE|h27oE|6Q)4pwbUs) z`>#0#RVcGm$eM>zPAR*-wstE3$&Hk>P^e7M2W6&8O)nz6mbECvA*iJ~YoLb7wbpJ4 z0}i3w3{}J#J`WMj}io7P|f24wP!8c!f*+-U~=*4-`tyC{rF6?ebK&t}L(NDHrA}8se1rpfp(sUy3w7_-!*bzt z_)e{Z&F0VN6c(+q1j>AwRInxmrq(kQhy;cP<9>3XP=7HOS(l4qIKdvFYV~3`pYZZZ zxS4BELq)Jt4`(QF^3xoM)+?TUfx)lDi}N56bz@GR{SoKvCuT zY6i)^ym7QzrlebICAD&i${H^u+zErAURPq(r0&N7V`+DNNG0nZ@)Qbl^Iwa@K zUq=l<1e^&HiUp2J-FJXQw@U)O8Qgpx32c#4wEylYg%A1tZ3mck)r7{qHKE}*A*s_T z<-UYf*9OJ}qku!^Rc-%=M;~-q<+5k%=-7dY8l4xh^QI<~_$`HWD6PF5-FENZ(g`EF z#3JgQ(4~UDMchp3BE2PoHyDg}g)%kKtQt|WcqV>XbD~-0kwx-)Vh3HV@^vVR!>ND^nLGj)F0eWoa&M|W0&hn7 zVXI1RWc%%i*$4$q-x9|_ZdenUE3ZRCftUuQXQ^FB2iF@RP2RE58)wpDCQk4SiXeQIN~oJ4PcI_1GKE<|AniSc007 zpsm?z-E9}}=Y`ycdOR7$eMY5~>uDN~ZjziGL5E1xN)#GUSz@bcfEy9wEkVJ+$$FMv zRt{Fmey11S0*mCz1n^X42!b{yXp^nY^iK*R_3|EWj2d=)&pG|VAFiX6Xf^amBdmRF z(;B;KQ*n{T;|BYVQ%!}tLtQPgtIoSW3XOT6By zy8qGPCOf;*shnK8%J=ENAHW3x5FkNG>FSv?J#$^QhzJCLKp+qsa6W-JMHRy@1hdY- z$!}g|KpqKu%{A_G5CaL9( z{{Raf4~@A-W6KX$O;3DE8Sdhm7Y6Z>OTu(R7#ci32S1OG$)Cpul-Yj$eqr16P-i_x z0WA0YJkWQjd>4TE{o@!!5uS0W!eMSI&}D8W3v9-g0$H(zDh8%$lOhmL;25BF4HQuR zoQ?tf6x=_&J;UOBen~^1)OPtMu4u@#1jamsQwylKS74`1U0zt}MIO=pZ(Z>rDxxs) z@)*24;LYc6Z$A>4)&zjWzcuYHRqXRURDqt&MtX?i@y7e8dhF&V*HWm*EQmY5y&lh} zBjn~cl9`gmUgx7Uv=K<2SrI_g5GO*byuMY9t{tTbw;&O(0Wdpf-ccUZR2l7_jR7I- zIUgIa7z0BjwxoDULcTm-FZwogdu0pM&Liuc&>0NfZYPS`j@yajZofC^2T?B?IzcN5 zJOAZ*ydN$Y3aEY%oZ?Opom%Zy)E%}@p^L^*zts!7;c)1hpiW8b#J!qSQF4xDN8Au&lHd2!m6n1_~xL#ZV>G zs8s7Q_o!TStpUqQQ<=!7$qy-W+#rRa5|JjpM^!tk;L8K&2Y?C1afGtF5ef6PPQl__VPc~Dt1L!v(sN1jA3X#Z8S{%S_sS_z zD*tDUz*xTGKYi+X8HGfNZ+N#kzmC~&HkY5DlO#>dkq#?Z+HbpE^!+TqRQuz95fRm< z&0j)99>x963(I8v6*BghOvQC1iu^XKsVoo|=fso6+!H1A96bwVShtt2oS4)hi@m}hB@ z`Z?)K?cVR~;T$ffWag$#*kcx{-QpvAX%vQca=S5u-C_)t*s0vCyb4-lG2EIe;s5qT zle*=@I%Fgu zyRFN7s+mpr8s%39E~B9$S*n_Vy6Po%&}2(m7^aMqnG-|N>CAzRi7MabISL(vEQ6Qt zOkX*EK@ug@8PxjX&(L0>^VVF-d1v3zEv%3~o&xyV@XHn5LBC?yuEYX)07MY{D1z{M zz8+Z`;x1$ly)0fg-kRx67a84)$C`fKx@$}s|8KdkUT)2-{_U$=I(`1%I^SfSOY_=b zrH@d6nB)>thb;T4(wk} zkl_%1cRK73)^{i6I$3IWSpJ6(!s-D0&mV*FQ2RfFbi+YqL;T-XPPXtT9}Fc}zYt$J zEump_PMHv0w@r1o2V+l$g^*9gW))nEdHR@~V8cM1{qY?B3r5?@Qcx+?a*%+Efcn%( zyfHt+t0A=>o@$W7$H?>nrFei1v8&3Ad>af%hi4=9@ZWM;ybS`4hoXAS)fwD2T`H%3 zvsFUP4m>w<|G?7x$)>5M`SbaYj9ygdD%%8w_r*!OI`shYzFP z=#JIhrG^u-wM$_zzvrde>lsns+wWInIPROEs2WV=WSi_qH9&?sM>eZtD)M15)#a>C zTb}x=aIrOxX-WT- zPaGK;Ub4#HP$F!1!|!-_>-Z9#pK#b{(|K+geTc$LsuzUDW3=fcW2M`VF%K8Kauhk5_oMSlxxzQWwS&9`4fQjG zx&=>ZjsW^2fUcJ@nqpEPIy_^+2Olxg!E9msP~E^`67JU)A?#DtLqP$(SK#nQ^LFuBLw*Q{PT#4 zkEo%|;wmzIg@%zz`-Xlf)S!#kN`F%PBX~xA?UZ_XviX->GnGCCtSku|0KI$SW?-lg z^P$zz;7?UTl*KUB<4j?sOPheHDGZ>8daZh3#@rp2t>R&tO1MiOT+z^PRal_{uKA3~ zPrMikI!FvFs-_wU5%XarM?y$mjL~3B7pCg5A%4bJLK^8Xu50?ph>2?@^2K~e`$xJB z83~Xuk%=&(s+b4~m!L{NGgu^ssxe_kY}FgchBomWH(${mtuPVsr`<9UrumYKFzHjw zQZl?RpP4O9Te?f4s-j)WCh4Ej%A`F2jZ(=hH-SkVn41-HUqYTdvImcknfyKB>6hc{ z_xl&`OO^3iylaHI97YU^RY^7VSRtu-{KXDOwVBEehu&Nz!79tciX5r>NM<>eRzLwu z%gk}+tZHV;39{$`EF#H`X7V^Ma$H3mdLRdSB`aNkPGjb8j>Tl!y#SM*H7-U(%$t@t z{{9RoJFdG(OSPSYOWqhNWkT7E7^-|UBg+79NsWEbpm7oH zQCQN1p03c70c{a#Zye39==_(=gH-_HJ57UC-@j@Wj3JEgH+W;0zjDlmkh}LCwV_kP zxX;lac__yZJT~x``P3yX@k-*`^UFP+tFMM(PXOamk0X}90lY|&8;8&C|LL)yHM28p zb%k^CuCixMja}8@$>_j)Fq|Ms=}hUUb}!r0QH`gLj%y!S&SQGmn6C6A=0jeA(~R?e zWgpe-@fv+UJ|{144{5ao>1A#?x%Lx(#{HOwOMGGmI@FDV(10f;>m=pGvL=ABy}X6T z9|5{!1HD~0m7~L`?%67#$7_ye_Amqr)F;RLN0f_x!F#mW#e8>i{l~a)*LPbrI)r^4 zza_8y;d)#kn5ziZbFpRyI~`pq$uiCGJ-wy)GM~>)@Ew1{Jm?S_?fg|FN|A0V{pm-o z-93LC0M(<#bF4OD=mp?)tC@~Tl8F?v>H1xkq!fx=WvZ>F_Gon1Y-?!K)!G_?REF6& zS%1F)vuZ%9!LO>VLGO@9j+fn7^mf9_@hOY~ro75b3ivX{D`X|CD9}T=Sd<3w6x=@} zc6@TB`NT>?f2WR(+VMN~XTu+SYMD9b3TeP`*y(rW(JsH(=wli;ob(Fid4z%$@p?Z|Fm|d3KGZ=E2oOm)Br|UWE(6ClaBUOYYt-*vHGS)8a2%u zk!CpQ4b+)in+P;O7-@V?z9oOMT*i{MjvD!|*mS0QN2pfe` z17DbEv`MNo!fKwGsT@?LkTLe6&Al|XhBwvxBuzDS7WtCKZZ+b<*!Dt}_+m(JH1_i& zOk$+Y9iRSSrNCf@d-ZgdC&EBqa*)5=*6v;p=w&O1}sZHThLNem2$jsJl5-5S9IE* zs+-0{*>`JG^tu5yb6{9gB#^pgSz3eS<@NmBP-dziHy3@cZ}6%p*NnOsnps2;?j>5; zUWzH^b3%T_E9d3&?B-M$HlP&gXiterk5f*FyqTmSYH#0fkM}Se9Mfx8^?gffnjIom z5bVzM_gqDx)|e*v`kdr`@r{TmD_EJpZPxE1WtXY*?i1C(T&2(g@4 z=D?@K);jbng1z`|wkH#Fa)tH{=n7K!p#B3NB{1^A`%XsHqWtZ8yL4yF6mwQuMr;@< zN<-ItCN-aB!!4@^8Fsem1okXaDFxDDUrNohXd`oTw*3V5RUI+xgj=D8TEY*PDIgxr*~kCAS`;uFpbkYP5gspsf2g_`}rE z7QGtUSNErw-DKp-$GQ{stF}gpj8faA7V+zMgg|C@VHqF&QaMsu_e4TLKU88k?j^W9 z3L_<6I!cQrsbn7mNK;>)=u9zRRyu48s0N-O0n@2nf1PtSio>P9pZ3#_%}5(cQM>r4nzENCa6toI|`+`I!94ZtKT6d+M0UE>s=NEBgJf2V^$H z!LjcKP8@~dFc=I@!^Cl1=XC1z!XR;y-f+UQ-(W z>5=6*UNu*Pt{VwA0fP%y1 zc5^j24LT0kY8VaL!Kvq*f{qacpleiA3hiK|hE?^ITZ~Hkd05Y?`^UfV$;e#ob`oOImKX?X=ve+m3qOpyfJo z(08J+KWrKK$^x*#Tv=e#%#{U{GFQ+P?%5;Zs<}9ID#2Qoq@U<{@G;3OyijMel-eSp z<<{m=>0)+kN)u7G)+o9-q9xcxqQ`H3f!ei+70 zrH+{8E-od%;Jp%DFu%4^WgP$U{`vpi-J$0z&Ji|(4C#jt_y@y&TeR$wb#tWujb~Z3 zWEvM)5_w9|T+;;Pa*N%3ubAU>2a}mrrX+LOWf@GwYHFg3`uHkMs->PwYfMoYGhOst zM?oucLu>|753Wv`HkPu8sV8%dr8A^D=KQ0N%dCvKuf%VH%t8pOySuoa48n8e(aAS0qnh)S)1oP>1C3JYh|LX!E>^dr0`fa)@16g&}Abq4# z=-c73B#BuUYBDcsh^fY4NyhC{SZb)gX@{1Bv`(0*q1^_LElJm{eFf_@B0%S9ve=0z z&dll8f>#lsrtavpIYkZ3#9vL|s$PA~U~8gSb+C$5BaES_*9QNt0O)WRREve5@~fQr z)rkz|3)(u!9mPM>zjC-cR@rDm`Mx#{6SBWuU@V!^Xi&>y9-8 z;4jW!VIxfu)A=lB?>4B7VT2TyrG7PSCKd0Dvz#K#PN%ntvLc_3CRiu=h4@msx4KN$?-wiCp` zsXsgoA}5MEZA3&cYEo(iRGfrEC+PK}_R#5uA%ei#EjJh>17PciJv~$>=?}tTuifkR zyFq)<4~HTCJ%~D|LFfjtp)aR*iaSm(?z?f2ByG3Xal=m38pbi=r@HM>-&fZeME!nu z7(|_3&|IAO=_w-M^0hw8Vx9k(;=_gZe)J+il zCOdv1n2!5$lgxW&M2a~jR$Ft895}cjZY^3f#rYq1A0RotVMaf+Mji;ZMDISE52GO7{;#wcUpb|s(^b1Xz+6;wHc zhA$Wy&iUc|j6nStC^$tv>etVIz0S|iD1gowGYzHA{zD-z04lGHKzJM>WIDP>bV7W5 z;Z~C@>$a+i%oLR+&{BC{g)C2iA#F4vz9@vDd8kRtz5h%b78$kGh>H+li<5^3!SPrN zTb%XhQe&L$7ET;@;C7>76o*5%JB<55;I@;*b$d}9L3Y~CRFk0~d=m$b6ZZx|*a`=y zHcmjN+itabLA#&0Cv@9bb_)Hg$|}>fS_O;`AO10A*ecx1{dM1*H4an zcAzv_M+^0(@!*{S7$Hi!N!%JZaoFp15OCjVb%(71G!CwCya!7s@KR9*Uor`vXlbjHA zKMdj+isWh7fqvO_5tDx!cA@w67|wk5OmPHFhG3zIHf8{5a8VFCPKf_?x~E~Q-ESxD zQ`>c015_V!FX8@fG;rJ#6xgKGYqy8}VH_ezx)(v*bX&b{dh~)}f2uF`w9Y~sC z9CVx{hHBpF#}EW$s;Q1-&^Y+4H`;u-)O1@d+yDlt5Kp4u6t}{t6`gQ@=&)NrV5?u}T{;*!{SIV`S_&2jclk%I)12ts$z$0`g4 zLF^0$ZX9)c_~#|8h~zN)bRNqk9=5PwhRy(a9FdEJs+g_uDZwF;U_VCes@{0)LEP#^ z$fb##77iK+tR(6r$Y78Aog^CYt(~6?L|m1xAI$|-IB+1jgKi({Q8(_kVw~+KUM1a(DA^!SADa;IDk(btVq)9;7AXK1NYSF zb&^(x&8LQ|uU6e~q+zvira9fH9mAwJOgeGb!Mw-#+vy@fa%x4bE(~ly6S)|c8@IY~ zCyX#{aRl4rC7T`zt2iWDF$`o0^vtjiLm_TP@emWllDNsi!ZsJe*UU>~(SpE4+x5{N*6+7rMaIvv!;j6a0d3H_l z+*J^Usw%YaV?x7o~#y5VNz}nuLUxd%BTgz&`^?u80%|xLZ&fmsY*S{NTjRI z#}tbs0BT~WG$8zm&W0VO?|L=|5}{0nXF#!GMHu(AIB-?6ts?$RKns_S1ui2Y z(kzgyEptG5z9>B(Eom-6)JQ_c$Sw7{WnSav(7!c%c{ z>Vd&el!r|lMq)d`z^dof*auO-wU{g*JZj*Ozi>f+T#%dhDb#YbMCjUmcK;HgW?6JBy%0_dbjg`CrgI2ArnnGjJ zhd~Ca?Qc2LmG|)M*SkqhW;|2gV3)Tm=e50TM&&Ku|7O@hkniw&fx6)mw zif@`ai1|0E2x9)D>6(>)uPR4av{7zc^6y&CDZ43hhDfh(25!;q@4Pod>B0PSsqUco z@b-#wDQUTlqEt&qR=kgkzEX+lt!!UI#h$J^gv2M3jf02=aVk2YKbhleH1*g z0VuR^RCw&*`0e@p_GJ3_oR~h{pL8(#U&~lNp3ko+(HN^#eJYhU$;ZOW{5+tBjNGlc z`VR#ZrGMzJdHoEjs1I$REBZsf%N2j}FKW4;{CB08PyTbcR*(3iE7VhbC2T3riM~Wn z4kwrW$$x!NtMKF>$|ZR6FPi#0`KNM)n(WIU*X}`ug*~H>ynxJPQqw#W4;SOFBd3JF zh915@`)Q1-AS%62SA!aEHY%<pqisOYYm(My@@ zCY|PMVX%dG8OIHEXWEA`0@Ft$rbJD=W2-gU`}^@|iBR+Wr}lWgo^7^h29<0gex7VM zlihkV@$Ovl<7~a(j^;DZ7e6h=i_w1TPra7-Z8cfXMw96ZD5qQU^K!ggEj9=5jvN7}VJNQ#3s+7wg4(4LU!} z$w2+h0&{%W;^)a)wD!0Dc)y#iyj}5IXN=X@Z;_;crt>HA`*gZpug4qj;Z6KFna-v= ze>U?1iL}mSz26@uvx9e5e&5X3(*>6Hhw}S&x!C*u#@iC)v(W)-K0=RTemcw5#`iHD z-j@8hnJxC){SL!x5$5P@ce@2TV=GC2-c2{V^=z^5l9?FE;lL7E4{Ps9uu{jLtk(1W zbcVSY?eBU;YiEMx7>#%QPMY(rGXc-e7MNdF(z*C`w)GE($$sH|^#|nFgTJ2cM`Q2x zrCZN!t%u}U(iST;Uid5TnPON>$D1`e z^#0AJUGTcISu9rD1?K(ZXTfjIX1ks)x2pw)_m@Du*=|;&>2~kEFeGFjI9uOeuV&jR z=Pqfko&A2aT&>n)Z{?HeJNVP_VS~Kkl`po4gB2KUme`+PreY1c;~6^j7dvmYpC1Zp zx|79xJ@@BR@A3SYke~PC&0%_ALSiRT(w(k0BQ}p-$jBdk5-_vPem|SduxH%gWthcu zv|WzpYi~YQKCE^dFr4@4^B1upyQ|TByFqTv_t#gks9h#aW_$enb@nkmRhi(!&)BKE z4fdJq%gEPbOy&+;_uJ?r!H(gM7LY2RzevAAd>uBMo#%A>g1@?uld~~s^iDr0Eo*-< z+pIQw&vm+jm%5wLYJHeO4z^nZ!5!VrY%|`^XCM(`TH3JP&2qcluatv55A=x_9Ae=}Mhwqp;M z0-2coYKm<-o_V|qZ@zE3hvjNCUhg4tU!Eg@{;*kqizi!ef7lBF(8bU5?Q}Hp=Bp`@ z7Tp8bX}jKyyze;n3M}pzs5ghj*b5(m$3MvL{(QaN&bHpa@8jf5e_wCs{vJt#--ElM z*s<<(0|~MBCplk|Q^%c;c9Z!5yXOR_{ewV;{k+|6c92W%WFj$-yO`scn=TI?QZ(Ma z5fBK%{b20(#k5ds#g14cx=9{C*fOmh&~vExaE< zCUJAv&KI-k$eSX(Xd$}Av4u$h8zy+~mj3J?_S*#*?E%%Q3+&s~Zn`?`_E-ue7>YB= z-HoTS#dfmsW*-{VtqI)aO9?U^8(R+>Mxfo$ac0DDUD2`#jTbzd$v^D&71^y%Y7VvOEo z3K0!1^FB}fnVG*G6+#CARl3GzVi3GIg&HE zx`iX2%w%uAUo8FAY=^yZ{)4P-4?56vyk3HJ9$)CL>8(bq2~-|11D-m0A>&y=B^a$& zJMTyE*WEA_%hFqI)(3x#xr`ppFL-~sAdRUJYaA_@0!5DWwwoEK#!=0whH68p-c6^I z5hSwr!mO-hth*^R5FhG(fEpYBrXRLbf4#;|I6Va4xGo~7*d68zA1aiWmHaHo+e1^` z>~I#`AZGZygfWrVP)&YCs{(%nluwE`e16QV3k8ckTl2Y9} z?AEI-^nb{X;73Bo>f;bx?&rRj{Pjw^>QA73K=GM+{E=*l+xt*-Mwp?4_k_?sIuZTJ zYCc+wcMI^(ACGufr69dOoou1kLsi3T+sw8{zU*f6=O>;VBeQ*e6hW4v@Uj6LeXzPW`#R-Avbut@mf}{D?cafWa9x zS>vck8G>mjWS07i-EueIfke)Hrzdgp^jD+JemYt}Q-g@-vkQqX@UF(t6gOL3yxIe- z@m*V-a{bk8y&KP0YsOA&CJEGfaaeP`mYvMV`68d7c7vVfP-pI=KL~gBH{;RH->)|w zUR(;X69mk5x*N?Q0MiL}h1T2O&gcGawOe`jQF1qY`cv$l{{FBVf!h|?Jz%EQ8Cc0N z)jupZ%h3c9sdd-Q{=ew(u-}aKyAiZ+SLL`q7!JqcBGWot z29+Jh2~Wx`sF^_F9q(sjHlHte5<#YAw(zIh3DyB7y>DmAOM}^RvREx92OPW6zt4{k z;^ZC7{PlLZS}#0US}`}QhI-K-*cJwX?GmigO?ib(%@WfxAAz&jnJ431?U%dBc*Imq zMJ^2>n^&X79(u-^NixKG6uqriQ-1-i0msAazxM}egAX>_(P)9IJi9$j*kXV)*znmu z1&Zw!gWPVntoC_oek`zWK@l#`DY;_?v%kMVuX!fNu#7%pbJ*$x*v zjvY(%7C<~x?2FBGF~xkR;^oi#7&Z3`Xr>BpX3KH0hGLHnS9?gGH8_oL-?!6qAVk^_ zzaLc~+tx zf8PI3qBfkY4~xxm20e^9_3qsJ7YGGeivc>^nhy|}Y_I-E;`;!&&Tr2U*mUMtJ6J;w z`{^bXF6jdS>6uh44qDB}oB3$NO$)COdem#2FClBS#f@#YViG*nHQ1P;|3gkv)@3aZ zD=1S37;<55jk46hDb7|v2_uc6guJX+SIC21XEvUr=1960OcwD?p2+fiJoctAyW&XRv(p7r>wJXz z@adWT4elH2*ubCS1bl1+hEKT;<+l<#J1qH()1ULAK zk;aYfOao}zy zu)?JW6}vzV`StS7k!>~Oi3iI&&OA(V%7O7c9@9`IDr*MY)e83_j|FWY%LQx3^bwV- z@ZH}meOL(Sm=PLLV$_K@gP~}|3_o8|Z5%tecmkzhD>U<`lNA&%p&!Bak)Xm1*ZjnR z4XFuiqiMO0gm(z{E^uTs(n(v0ixhRf%;Dd6%8{>3?Y3P5y zG4Z(jj6V*BS>LU3B^kj&Rw#0O@8Jm*V%Y;$Xl94`3>N2fv2h5TF_G$OquqQz8ZBX% z%5}KA56fLie`E+(v)K~XpLDhFf4n^~)$PtP>cAe~IhV1X7%D_t*RhM>6iI zH-lww=TDYmB<$wwKHNWI!6hvV7HL)rX)%WFn=6f(8~x7B-q$G>a_Yg5x?IAXDzLJX z8P+xa;tOfW?iP#LV#GJs1G@b4`5rR_p$pwc7VuMVy#V> z*K$il%HjM2Zn1Hv-X3@2@fx-uDtWSnA`NHW)ZZVlCpTV}LKPIuUJ zW|;z6$$T>pqHnpGZ*o-xaTR>FLI{UHWJ!s(6R6QUm|W9Mj0bO0nW`sau~_2uP+VjR zHqaikGjF-sEcR>A%btwA$5TN6!hNt&$5mMz@%cxBCOEC}cBaTEh7$5w;>UU5@sf z&1#M9mb`xEPs!8Z;bLFRz119Mpo4$F2Fi{s$Z{;nsU-F09@E9(_FAWMl)rL@?vp>c z)MM|Q5xo2L6i#pK;ExGPhy9!DMfuH6=7zb4Th?JW#!V^@24Y8Xaz0_M7+;F35eA04 z38dtFp&U)+t%;_~&hUR8xAnU4X5z2Qgjh(?4#2)6+-E>_D4JVta%*!@H|C-A>-M=;q6g^F{gR;yZg%kk{s!;GDU zd$ApdF}lUWYz1$iDV!Mie-o+gy}m8%PKZ0e4KFn`Gk4bTCBZ0P?{UfaZHM~P*O$3UgNmX8WEUd!EoCxKhLVlz9^01oD z54hyuxXt2-QwgJ9P?z3h2?vyqVvebd&D2|FGRrQHVt7k-pzo&#NJKi*Z`!F|dbl-C zVe}&!4PQeP?t8uu@gh3mj->~8$KkMD!UfJn{d0o7_nJx1XO#S=8VFiL1KN-FOYhTb z@SHZ|xC@1i5{>W$EaGVCea0Jk?27c58wE8ZTrPL;F2a!a2?_}Bzw!#b^k4;^jrLH- zcK1-LnYhnKfXgbDAMdypi@x+=ds!|H%+t?@89ZQYadxIbJCaT{v}XF#WJ@$sC8C*N zK5P(Kuz>zZ@2h0}DHRA6zy%yZFXTj-hlVp{Gk~d#3`;IWdY%|V~*=RJ63Xi7F0u{gc`&gO|VbM3jPYG9WEGq z#A}J+rfaJm?sB$VPoTJZ6D)knxTYmtd4~z?0B}I%%fvidOv*ETll?b7v%k^V@o_TD z_KUF!@tF?-AbkHz5ZL_d35=r|D@ex)b|E`IMf)|(XsGsjfayG)$SA?~JKeKqJ5vF} z{8zO7bcWekZ<#xc8)ot`6cpjwcHsYzpqBF~^KA%@%MDa7Z((X)q0MJIcyJexVLV}g z?YcPm%Y2BgJ=}zGgyP68E~7$SgmHvb7p3^&fE&TKy(xqf+uD_KVePFCn*%E0?ladR zPMCbJKPM1?I7*2D23F0{cspCbkzQQ)rKy!%VTcgiQsvGarix^n+1c73 zVM}d)8h!QWVqW3wpDu8+VH8wZMcpR&=*bm{LM#re$p~HxD&$NXXydJy^98~$7v685 zMtpm|Jt^yUmYoR*M_j`r2v5%lQ6%Rd_v{K&EZhrr?91t%E*#L8FYdE}_nVb&7D3>FQmbXe>Z8-OJFIuGn9rd1zr4J0VVqj> z;7ZHfE-DlHJEqAaqJhqoQM$s+fd3%?VV><%rn~Zf_)&th>gAq>Kj3~lLBtrYgCz-D zNT;$v2|)WLLPo$UvX*IJ6Fq9O%_B%eGa!6S*X0CDrB?;qeV<_2|glBa?; zPR-Jk8Mhv`#{w>ExNjcM&oBg_-cF^t85UYx7ja7Zxjav;n_T^ar|k#alGJ$wsz4M1 z9AITlFIRki#R777^A8xIWkVDc*Tce}t;Tx~{s3GQUZd|E60i3@u{?HcOW7p7g>_?v zPz6ZDLS|t{{>5}9lhoS6+P&OOcQCJt;}uDxN&;Ja<6cIo$!xh(kZUEyZ-2`qh7!QBYlYHy>GaQ-+cn4SC zu$1fyn_Jsmrka;6cstmZ*CW_O;W-%Q{|^o~X1$rrK7L-!Avr(K@-HOb7KZg1JELJr zk_2&P!6E06*v&Xe4(t742H(uxhs7vB)a=h6=eL);Aq%760aJGaHWPm$N{xbTCwq7r zW@B-&D;r8=SIo}a!hj0jk^uP@ynaU<3bCz}K(;%?6yUO%N{d1gR36$pZ+F-(7C18) zKhSH9nIU%Ge!F2jNBER%2OMTlqOicS+PDKpz#TM0{H7`lv9ELYkt_}Y16vqk%%HyH zmr6bbMuCWJuo(G=5j=s4+<|-(%zA$ONS*xHqhMBe6($R@_2T?(BDPU+JSY)IfPur2 zIYAI0Nc?3Ln-36+J)9;`C1EE@RpDI6FwOyNtq2`D-~yj5Y<^5JR=^amvJ-{xL&=#4 zNMwQRchFCixp;fMe|TZ6`u6;Ag!hc4;uRud@2xj`giLKV($?T{P+V+f9eyGq=9rAb zd412_OiMfF2I5fZo}0q_Ue3Ose^cQQ9C;rwI4R?W4J2 zRMBx%w=ZmXlgS2gMT&i(`s#InX>qdf=cD4V#6lBJb;v&jjetTFD-PvDwqOXA;&t@- z2@`Q|S;?++V1Di?*l8xTVM$-bLGXG;1r&LMKvr%h+bv>)JyKcf&dnA}YtlG)8!#06 zpUM_sU1^sv5kkkcLtw3s;{)g5H~vTl-;24v00jy~fkIpzDGVa3rWo2r3`;WO1P|ZN z@a23LG0o$H=kF2ixdeMDY)jb$%&T1Nd~XbxJpwXIa5RmavAsMn0PeSlRs!J1)b&Ok z+Bm2X3<{Qn+m0lJ;N~?MPvCl8PC5JH#KFowCNK{@qBMTg4>8`r7EA4 z)*H4EIyh*vGpMFe{L_qh&d1Q0(`!B3H86g#`=_MRA?IoaKQRL0$dy%5(6rl>0WPK( zAymlpSZp@_2x0BY z?BslkeEVdtX-0L;VdYdp&8T$Zr>@wYOD1)_RxxCZ35_FhX`Z@ zK4O3@t~~YoiKFr3rxEx6u|O6Q{X2o~H`$EgKt2F43f{hb$C4Mp4a|B&IY6u;;E;_r z#Q{`oC;3$19$*H|?HLl_0k@pdlv#B%RU9)_Hen3IUi2eAP_J{;67FOmhSg?I& zBqqmMs_5>*B!*>8f`ii)IWY+3$UPCvWX)NwbjV3?yX6e}J{zG3B-71lOst|9p$|j< zp2RZc(pcfRY#5?P>?Y*bLiJY{qa;$}^PFS{GON z+8h&!RVUtV0)z7yX?&DQ_D7JYTBVcU+l+7o0qR1xru@E5L7-MOZWX=03w27 zzGPAdF_PLlOOAmhnus7w#Gp)Irr7w%CsF36bY0|%AMJ5Ep02mZ%~K&u8UR5Yr0MOmQMnFy>f>X3LH$u{kt{2Q(xK2J7nRE;kpwFnub$q0k;#($;o_o4c|a%06Z%$0yYG zE=~@lTf?@#WI-XtfvjqPuDeIeEI?^RP~l<=H*t}_!>nQ~ zhza&AmIj}m|5&L!=>Q5Q-IjBl11v%a(Gl5Hm4yzQrQ%oGxxYe0HVgINXVQaPO&$}x z(}rc{npMm~I9;4v65IwUC!-zaE5GSxsySD;!NDg;kIbnq;1-C*p3IQQQaaGpg-QP{ zLGI^EBs#F@5*mG}Zf|ZBybmelgjM`tPJ&q;P@O7C!giBwOB}cq4mk$MM?j*e++%6O zu`YK~kJJ5P0d==@Z!L)}^cWM}96?hM1v4bFNgFMMe;YbXmZ5`$l6RCdOJ=L$qL;G-v&mDy!+Z_b2x0`ajLrlQ_e1k-Cg7GH zB3+Tgg#2QK)Y2f8r9|x1euL5o(ChJDdm3!X%!9Zb=Uz&pRnQ)hDLY-QaFQrJrm_+u zj~fE~6pP4-f)#Xzz+6-rQUOc4(nrJ~O=y=Z6xBgqx=uesuflV{#0Xy_3JmE1HEUDa z(uKU?saH(1W7;o;gt>AKqiRXSm*y4`+@A;=AW#Yxn(+n!8r8Cvr&vloA{T?F-B!bK z4iZK)Of9M;?3YVuBvdWb-I>5Zv_l`;5_<$u_PHS~|GXSkA86Grg#^uXeFxPZ?M83JzQAsz*3Jcz2K)*VFUvC|%k50A9x zwnFCarGOLI_mE)7RA!x72xdcO81nCi9k)jZiC{34hd{ZJ!iHI98EndQsR+LU4q>@C z3hE^f=Ojui4!aE^%67(0$qrv;<;5XO;ZRoz1wED}Exok2_zx5k{v>1CR9AsIl~b z2LWfnXo}RljM(zDfbF>+KP3wS3Ma^xg%#6ygfQko#u~00Vs79JKov4rKT6V760L8! z&6q+Wzjm=gF_BDLFDw@#)s5v2aC<#2vJ?`zS|}TavtX2kb7d+HJLt%{!}As;I227o zxL@fEDXk+r3fPYlFlx4~@f=k?uV%Ibr%O|WN+z30`N$(mH#ziZmxz~v)m7va=3SO{ z7r!UKz$t(?-ULAgbExdn1}hc<*Ap(Ivn@se;ZNNov#zwK3B8$jVGLgfg`6YTb2f&R zP}*PA`NFcgkl#Qm3L@fsF~!CNT>Z?-XY9t?@MQV&HLA?>>=#NZA~(Q9VE3wBk_zXk z1P8bKL}St}_Xv$r6uQGGQHcVVKIDARJD%A8{0hYqs#*O4(IW!1VCmoS2qofmp=*cO z&F;4RZY=CBmg6G%9GBqKG2 zgJeck4csSKDGR6^+*$N|eqdqVf5PD{qOAoKjEXZvBqGX4y8C=%3P@^UU_n+a+>m(> z>3Ii8l%#|EWn7~U%1&&S>Wyl9Fi;@kotQPa%9GhNpk(WNL~I12jSvJ>cnPG*Al?Ex z!W9B-V0=RgkiI|j2vI2kffYEi(hX;_FL9=Sle$Ez0-}3hgC$*(No9sJ{SbEx1j4M4 z=upc!%%n#9L?HJb1yAdh2uWE+G}ant)~b9BDf23;DI$7A023;hU{5YmB?2-cSL4_< zkXQIf8IPw~Q9x8;LY*pMCc(j( zg?QhR%3G#XHr*lQ6UCWuTPi7oWk`992XBlhsuiLr)a59tABsr5G$#&O?fR!kce#tU}-z5`+vbBQ0Xvzc*0;| zW*NP_%!}mq=Z;vC)>HuEHaA)0cti+BJ+YE52T0VJo1zx3g?=qLnb-{y?1u7;^=ds= zTPd{&G2TPl^;SPvj3r-x`K04^UX=DACo(!jI3JR(;qq+=hl{{;gbmVsa(1Ywx?zPN z%aUA<2WOTjVK4!$s3rxs4{~O?s~Cqzc0tme9pci<09iQA{>A=80a=5*@9<1;&{P@W)-G}+#tk~Gs5 zx(@&SBOTplimKJv8qgg7g`z=x2Sa!>OEhy_q@Fye>8wU2lq3qeTQApJR-ui=6JP&AER`aJ7fj_q&uAi$chc3z!u$7nXM!($Al{jbYu*J^7j<+{4jOw zZS**qPiL&)7_#&cfR_%6M+g;aMtMyHv2Y4O#X*tHlD1m6IS>T{vkof@!>wBS+XIFe zCM-IF_K3Ft7Mm?9M=DZP)8qL`Ts+XzVz)q9A6x=zA;DBctg?bA+rxMS8wr*>WIW4m zjR+Xc+|HO!Xxc0&mN`NxvB>4vu=3f`hSV7^!T%I)zeLe@Wc5`t0oP`dSir#tj~sTC zTDO=ScJri=u&bbi9j=d5R%J|(Uw2u7z#lZg7@oGpW<5t#!%Ctw)!qtj#U(O9omYv{ zny zmVa^KllI1C6_>Fv2+$t4*o{-RBl-5g(g$qijT?l5qBzb70Wn*My6B#5yDXSa(tMfg z<3U6kVAbL8heXCrZj^>jF*(Q`f-H;)t%>Xqy@6R!t`klgn4jo*lcp<&%m@svAT6gv zZw^pWXUO|NNJJ(b6^r-3@6X7OOQkdmG#5R>{*0Os@TOpgupBYoCKFXJsD8~uZ>UHY zpvb(PjeQ>2df?&YpGmrHKE)Xh$~Yhqu`o+KGO%ZY9ASoUyw|dV6q5Tm4h+@cdmr-ZhRCcYwtnf;loKJb_K=7gHagTh9{dCI8NN1UxfJM0pZeU=GkY}GVDHRYO zKdM5Zh!cvaOw9MMR#!Kp%@=_B2Pp~B^dTTwx6;= zco+gy3JSTvYZsdtN^N7~bJ=GJiNYdCEn6|a6~x5}DiEp-V$VL@4b$Qe-A>YKpAd<& zO{Jp{;waRIa|)>x2q{3;EObQF8bQQPyTw{VIYa3}2=D~OZV=PUKMf0#p*HyQ156}P zs};e@B9d5A1m+F*6mZg({~!PRboUSl6AfxOOh>4^0Uwx(B(1{av%)_Be1Wwrek0YV z0XdtZnlwD<%^~Ng#<4(Mp9>(j2UbG8a46)yntE#I2V`8X%GzB$#2oa$m#)H zu%6rb3MV|GEE~_z9#uv)*3)`oQFj}O+^|YD>=Fh-C{N({^6eQ`Z??TYpZ`c6{ov=r z8TIAx?_!rDtr(7G3>DGDcuwoUj)nC9=GfHuw{zFM`!E~bwIMQme3`O$!1#7YnPhxr zf2Lnntj%)Ux@&dtU)CnW#Qs}g11{0|4qmGH`hem_>X2)6cX-sHWujmZB8!#Ds)5`h zTIv8Zb()l-Rye>RJzj1m2Urw&eXaYfianVzG=aApK5zD-8Z%|2&TEL(Vq9?B;e7^V zlcBKq6RR49s~Ho!v;ophP@Eh^>qV(o`k5tIj-e&8E>K>kl%?5hq4KHi0uFq6kA^(ksRP$ zG5|a?H-?b+)1trM6O?uq8aiqlpjhM_bv;rFvO>BfGX=E_5OFyN8}J#13e9y@(t*!> znNv6jaTS2#aen@Tc%D($00Bia=($LyM!E9m^EZ}JUx4E~O8qSnQJ#YH6iHG@171DY zbPsqnEnQ$<>>h>3StTd(q#ZQB#d3*UraXe0``#R)S0Dx)Iwewi@Wc*QBD*aSI#37N zpCDbAe^y`D*zwd;U##Zu$@64mr)uqYeqVxtzrdWz64 zJjw)_!(SI*_MR*{nGk~NeJjMIFv|D(eX+1c8QyagP;)$C#BJ)jU!G zbsGg$P}7x>G5-hq11|th<_MBTf-n1H$Nuxps%CW7P8Ir z;%{jh0cEj0bmhZ@2p9fStF_k5%fqpk@`1~CSE zDGL1)G|WYYH!0u;$O%@_|KOo`Fy1|3k4rJb zAeQfyYtGUZ!|^?xKvv_nn9knY6H7LhrVqY6JO}{?A`A!o&i5TRHm-k*DL$ZHG9CaN zZN|k$5Y}+8p16!6JPc(gcxf*dbHeNZJm!j=5oof51jb89^6=hbv9}K%uFtSAqK42C zcTi?_O-U!y=tC4A7LYJ_ekCjB=YExj#+;1{ByOaKU1lQMs;?m64!d4MdBiP59RwlZ&8d<1a397<3t$c^Wc?Q;p~Y-@fP9@3bnon z;cFCkKs*pB)!_R`_@mp*_tr>%-c1n8$yEpT*1_Z_&L4id5L}3+M=?0|03BCiShT)w zcraNY)DrjIymqL1l=(1C;oTNIq>^FcI_76JH6P8^$RcJ>Mj`J4bFQ!RjB0sXm`T{1 zgM6~GlY9JSKSjB|Tri^5evNlTH|YZ`>H8{E_9UIOuV5UQEm1WBuSMXlEh^o?UPDmf zwMB3YG7HjmP9tm8S}kn{=_`1w3lCA@nbc9?foMB0l>U@COp zXWM}V7|(#Rhk1ajIO^IC0@q=zVeh)&cOg65&I+X~@#F-?!9Ems^tQ8RZ-K3l3B*5i zMHe_UVN5~TAp209)@_I9s=*|f0u&E7wVfU6iy}QN>w;(@ZFjak9QN!96y6C`eu+32 zHC=u9QCYG+KJeRt)BtXs-2yMVp_V*v@&{`NW5Z~KI(MVdWART^03MAvdR!oY0v8WV z5Br0EDYkHX=OI=EuV=vr!@fSTKi=3M92cHI9F2+NADKna*=-x8j7k@Db^Yl&WtKpC{X}+&#c*a|L$9(E_ zJQUfAJ@3C~qtWlb|C7m^0v~&l>izIFera7t;%z9L6*HK>!eyAebgn*hS%pLV555W9 zdyyJ8`hDf`xf7VGSD_iAOBcb0(3_1oM`T=A`!Qd`c(!8}b7~}5+A7E2ioIgf#TATM zg`PUSaQpPU-w>X!uwbgz8@?`}72`>$?iguM<&0n$9Rc z8|;xD@me7}O*91T5qo=#pt!zxQ}m65spPLCu95694E7{0psHc9qw;A3(+M$El*L}W$B`vQK;lLA>C$Gp5>wm(fX ztYR_jQCsl&GfIfASmFFsEZD+T?r&=(***2jF<=)l42ZAE-FGGC*6@-#k-PMPwTAPc ziE+B5bF;Lwoy(8O!+j9mKis1>O0%V;J`|V^5D`M;re*iog3Q3d_vUNx@`rc%)--N7 zWx@1a7CZJjG-4xL29N2UX5uaZXw+M4LDQFpEAKdEzRWtdxz|(y3%%RW zKXxxn!7NG)alPV#YQmXcI}F&W=OPEba4N64r&Ntc%#o2WX_m;{#Dq3oHe~5t#%}`L zNKy4n0|7==(Z4jH`ehgRj08y-?WRafyn&r0oK;k!EHW#opKGkU(se3g4(__opqk5^ zGB}(cONAocbKCiln^Y0{1J4<<=vzQ_);jnAK4?Uh<{Fn zKmXGf38p8Nu_lS(Bmm7gRR+g(^WhAjHjEYc-+$0bciyk)RDCy$88CX#w4J&`FbBG z7Q5g$52EDth+{Q7g;hMq`P=K;b8_Tqo{$cBq4@m#vy&d#rN+F-HSX1NYeVBzri?1B zO}M!M8|G^m$_)s43$8$F4F$*SyK$(gi9C2>1Fq@M@q9W$py07}Z3n2J#*%odnB}F8oj$hiMm0{A z0gHU#?ec?J$YM`?)E`EqLG`Ic8kP<$@~!%aAq|g{XKXZVfjD_c@{0`lt}>hW^!0xs zX$jGS$5s^glhZI5^g8`yFo@eu5C^CJ@HB{=DC)HT3x2s``~oUY!l4uNdQp4mbi>ez zqjt*;2FU=}`e9EG)o%4Vt~+qM(J+d`q1zqC{UC7LN#eS_D2@zJ{b1;{owzp$!d5sq zwR>^j>9$*~UeN9*?#Tp|1VO(aJ3$bJgZ40q-C=(KxTMnx!hUFgid(~0zdh{qqhT2K z`=`)J!dBnubeuRIItHjtzZ;xRn7Al(K-~akn!C;*N&2S~`ichnzB);N5Dt6oUKil) zK|dUZ`1c^{oCYDv-Wq1!>7C+^gDG(1AW7OTW;E$kT{)Ici0;A-6-knDRe?-fK}>5QQL7laop|q2K^xFMOgY)5_U{b1Gm>522p%+ z5=?kIPTJuxa$Ei2)NOYR>*XY;DCi84TY~YNh8+yE>pBDcwcBgCJp&Y`IqLUWXPsWq z3R>+>7i*h1VaM&a!~RfDVYk=0m=;^D#8%*W^fuN zj^jF~Q?D0-87=0&*PAxETci29KF4!;Xw|ZeW91acZ1$Ikfh>f8;?DpNE z3)&(^aM*X+gF$4N!+sQ=+@R;WaTiPNb_2)hCSCj|#6}sIcFLgZhQm|Pb9!J|OkoI) zZ3TUBbkYujo?(9tdZ)-~2M~urH0WbEgFz5GgMk}I-5&m_pAF31pyOZ)htZ%NoO;eF z7)0$bg7|U!5IuURVGBzd55Vv|!*v47V!Zrr~CQ&Cr z9DdyIB+GguJi@E8A z?S9Y?;?OWIY<4iW3oh>uPKg`#Ft$!RYDZxZbdlw)pN**3KS6ZjMCm~Q;|LmpjeCP$ z0wI8nXV}Ye#|6`Zab35MoiXeUV{DY5jS~|x$i%&IHyC11xZO6yMbvGxZPIcv9epQ) zh-&F6#4bPe-IIIjhl4meIjt}mGFjDYhbR2kFs`KQf`K7vP92Or>2)BTg5khDb$ZB| z?ij`e0f0e60yy2M9pmsHCY`wJU~n=1b~5ncsTH-l*dS;ax#-u8Tiv)5MxZ>7paYd}L} znoMNFpfm;8I+#s@gQlv4qDh}W!Bz|9^Zdx{>YBFfVb?rVPAHOhAIc$VS@fEOz1#}D z5Z8r8;93p7JZ4R9Hpb%)h`;-C{DKH56p)P5+lfEW+D>@vG@iCYB=A?K>t>N`mKb#= zQy61@mj|l&Xy8)#XWkoXJHy*|^uHrquvK^~Z7p)bUtbIYH%w~ZeK@iB3cO5`#%wA9lqTt% z1K&o7>aaByq#7h;Z7W@e%GEgTYtOqQUbtmb_a5gH6WTDVXNGaVH`0ttQ4`YP{4;IX zF5(c%n@h$m?0ogs!Ac##gtp#%cnMky`=afXnfSmkAly;wY?K!bs9$Tue6Io38$vG` zkcFl6BDD3U)at!!SXK*T>m}q`SYzL5SuHHO)%T8SDQTL}xuYhlsOr~PUjz_1P$=J88LW??_S2yMNA{Svem7Wj+M)|==r zLR)Xc|GnzwZ{P$ABmb{c$qKc}!ijLn99no8E<#)HhPViAy`SO|v=)wxOVC<)Iy6$P z={3T@#TE{e-g|_ zUM?Hnlq`Hrmkh|l8FdlbdT&(|w6N0O!m)6xE_Ifn8+ab7ZxDJT1cEU`PwN0mqarN| z2gn8~4u(vcJUvMMs!Qp=s9ZojT46SmtS&kVNN%yzR>^O!31!o4NEJb)Q=_tLHMhi~ zvr1>G4ZKAy0C^eI;lk$2MqE_}pc;YB;#fINH4%IkqgD*Q>_pG9Uo3zPDgV`jtk3qZ zgon}dwu$~1^d|ON{Uqt>C0oz}MO9{hHTiT08r>cWAJ^pbS9jRJW21I!NS)C65L8fw zi>*g$%4o3Z)8OH(+OHaqCT*S?^AYN7%E{D_C1C3ETeUq|r07fQopqOH0yif!O*yTG z#)i=)=4;5v5-S>$k;65gF$Q^Q^0r|B0-cc@X+}tfxdvl8wH5jAMivr~MmnlsF^q~{ zr4fjHcKrY{R7Nr+WVO>F=C@g{y+oUmW-ouE8TOhlc~-deDS2cMiykw>6zy+LgPX-ycuE6WmS@m*JuKt(APBhY`; za-6=RKv9A~!lZ9oS$)6)9{cthcXfKG(=DJU6WvgMfKI2r43#l3>OyoWi&I^t0iwS@ z(5VTrx2rE;!)I!gk~O8}cqLmrD#(pRpCR|3a73P6sLoIMJ}8E5EaN7c7&7=t$7=FE{bZ=}CeW8n zI4b?7JEFj$QC-Bx{rPcne)`FDFHavZuDwYL1iG+nGDInTp8Rgqhy>=Uq8p|xul-&mtn0q!x$dQJ#t&L_!TEV98(s3d(nQXCCm(gy80hD}qJ%%@UAoGYlidlJKF^&tAX}h>TA$rc zpykAN^5H?vX(!*x>FngACX=0fEhn+(ADaYvW-#sk9STSDr!5+!=cK}iz#gerru5Z# zMbt=oZc9}#Xp`5aHh5!6e=g*$MxMh5sUs9mROEADRq;H-X#%4MG%?0=sa^wGK0O;E zP|m()(B%*X6U_~i%QU05uXtVthDNNUnU&i#XJ)dTC6|6 zu^25E%`uhq&kF~pafR3s^YiB z9m>l@v<6dIh2pbhArwf~N%f4}Ds9Zv3)2~Ik~?PCK@kaUQC_NEACZX{xSM2=HKhC2 zsbo#NZ<0^e824?H%9?iHB(tm`?ndclO>sBMF>8ptQKDH>-1W7;G&0W|>)W*Z`XXYg zs@_;|8w7;YB=4;0ux^xm*09?~8E8#$*Ox`RSXOtNep*Ai8zreV#oZ)Rttsv%>1vH}*A}L`S+MYl^!`zFSk=O_JUk z;=Xm}Ths3AOD$f^N{w>h8q#f1wy`nYH_wK%98*=lI-A%pONrCaukpZAcZYRyoCdX; zA*X4gOH#WiP0kW`k-uZvUS#WN07NK;^{cuTSgP!l7U0_aISaT-AF|12tIj}8ae7-c zFr2els7j}^7?I|ZZvkbKSZ9GoaXb)@y6q$wQtT}HuFtcpM*{EZZIkUT?XuXhMq{|b zgnG)wMz+RNm3wC~8oH0G{Z8rtjNzD;tn;<02Tdiw6l-bQzry^@MsJLmwC!E*sJ2+K z6tI$7k#uLsDKc@F05oPd)q+~2?3G8Eb({uQRwv9=0biO-Wx|J`SQ(Kp3P4SSpB2=a(cigcM5idm8jb z<3%*rhimW|Bk{PtaT$%8P`akr{{Eo4#uQ%?URNr2-mF(O7_J#~IV`Rbyj@URLzLCw zZ4Hs#G|;VK-!>s{O;MVI-!8(WGx=GG5;d97RtBqZ?;%AipDb3znIUaaZItRryiHijRX8HP}BE3 zuTuYA$`jQ$QIbW?jfxacW0O2PRNtWbs~Nkn_(8qSvPerkD5<2S@8x__wTY5cs{O3Z zEY-CX>7}}_+8k3|LtUb&uAQ81sAah&G8$|=glOylDm=Rd;fzK=336Ny=k;c|(z@ zP%|0~8-~ME5m6?OtXy46MkTP(z-c>%@~&z|eFo3BVmjpNf&cxc&&rv(DAl)S#5XaW zR#2_lNh_L`jiTnpB@3uUfP=!TB@~L>CtOoVR=VA+UWGJ3-qbu=HA^8`+A$DP8q2U!{;o3G+otUn$eC7q!)#pxUXe)K z!^I6l-$~0n`h$IqkNA9+}d87=iSz!ydd4S7Ucz5wskl!NUp6# z`7SxNwY}avmA1ae1}`_-Ne1VpiL-SBxFBD)7G?7^*;Yf(0NebG+D4w`4I z)=_yuqG}z=cgs($>-Yv~skL1+&ql39**pog4&?>8r*$YVNI9)V**w#<7G?7U(>j#z zlUG{XYx8u{I+Pb=k=CMY@`_@$h^xxo)YSlIxtqWLb2Jw2jP&S+v*uCrC$ z=`1S0I8~HQd^tmu{n{`wv;aXMZ~kJUScn^^fwInYD2rUO>Yhcem}n;gCK~2?GFnvN zDtnc=%ZkiST_=?eF~z2(5@?^tsp}c`PBy~&^i3VG#sX)alIn0V)fldhQZWG&PjAii zRHkO?24$O(sey$9={*uLt$Ql=OwDZS=@eV34!l0wQb#h~Nm>)WvgTF^GP;f|Jq~Jj zhWN?4$xt}cYGgJ60=kio1TasG+BwouX3Unel|rbS;PfZK-)@IQ}17^ zGY+eIwv>Fvo@*rF&C&`nhMQ#*5?r@PB23X~atG;$5+~^s|CB5hV9>X-NDwr_V$T)g z0lUg1)upW|_Bf5>tm=X|cD11~{9G;shJKVFfuJ!4$y|UcWm}>f*beLO4}7s4?L{Fl zRjGdF#a1I%tSBtUu-Jgvg`(JDf?8VlT3`)-zQ;>}wO!f-s@P4y)uT@l=u9nD+eyu^ ztC4wX^BamUi#)teW%^yG9O;~`U;crv1if&HJ3|IQKT1HA8Fih?M7oYXf39P=kY$vV zjUSYrYV$^h0#*!NZd}K3rOTkoT1@t#GUC2dZOF(_=x&AiCu5ddN0Z#vF=ll*K@H@$MQC}s@2s+lMpmmtdv*IOfYkw@E5OxfxSyFyj=cr8!>l{tlU>$7| zSo&*4?iX*MrhM@qD>A+KcXNUl|E$aF>gdzCI_4~{PNGZR>X>r2@WGs_)j1Kal`gYY ziCG<8c24I(pN7>jWnXoSNmm_Hu9ed$vqNo7&j@jV(6d&BD9ds?I7M7q0hQx7$+^J@ zyC}1R12)X;01QqbZDt2PHO}k+OigBowuN$gsWQ@1#?|7IGdoz5TV!^~cvQEW^0g+j zLusvKb|_!3)ZvJWp^TW^7%QzZ>YR%SRr5nMZWU`_Yg zhxGV*H;M3D*XF`pMd*d&tGFB+d&|=*EHXP}!IuMGFZ^_v8VNuRg2pnel-Z$-_O_WF z1#+h5+%U7lfLEkpG|%j)McF*FqYmZ!WOmf{+B~zP9_4#vcGULTJhP(? zI#GcQ-Yvygrb1O@cIY~(bcoe-RUP`Enn_hcVee!ktk3Mwk*%@7nOC7YAfk>=#RN=T ze>Kxnnc1Nmlx=2*1{UVx_sHz9?y1-_HM6OwQ*5O=@G7UFkpWCTrwRZ=kWn3ZmL3OX zE2QDdUahY~1yeXv>zq(wOwl@ZBU58^?Aq%{5}6u?z;y++Xm1s?50)(;tTQ_VP#UUZ ziUHP>2AJ!j@r&*oWOkHbn$6DjnH>@VV*Exju=Oi4I|^*+0$65tXrPS!Yu7Gax{BT; zszuayAv#iC6KIUxONdID9dsaKE)5$*LZzWeo7sULG?^X6uW~#-el}$|RK^e#(_(_Q z%Iv7LOnn}(;@b!ii*Vu{IIjI;>?ovEd2PpYXJH8M|aenatP zk=fx?W_CDv0*AQ&W`}+Lflj2}bddqjj}nmK(v^W#W_CFG%nrwJA~O3yJDk)88oazDcxQ>4jP#iuS^NK=y)S{2 zBq{6dS&n5FkVQ^82N-Tx`kL8YK&E=8dwP0~o~F;)bug)}%I>b6>Z;nR>X~T-K@qth zmx!<^Dj=W_<&Z;>Lwz8K%C$TYkkbS4zy*1Du=4(2L}W%pW<+L0W%kUh@8xf+x2EzR z-}l8A_ZMG$fq9E|R6_i0IN2fI7*BR6?-Iu{de>2@zj;5m+PrBQ7`9HSE^p_r_Mx6 zc0hIJTcQi9J5LWMRA-_kxuLr9^KwLWChFsg>P*zf8P%2Oj=7_{3gG3C>P*zfCDoaz zk5j5EQ7^YtXQDoism?@wTvOeNoI;kChFs)>PpnhP1Tj? z4mhg1vM%JR>deH)S=E`SkGrZXQ7?y8SE61ntIkAyoK~HQ`navS5-r#8eJ zFXvTfqCW1cc|_rFSgr$W5r!t~?|E}!RRwo;S4|~?2T0_ws=h1DWi^jz?0}aCl)iQ< zQd)AI9apoGTa0(i`kj@|=)9VhAk*TP%PxC|ha2m&xWm{+In8om%}Q=?7RZ8U@BZXV zYqxRcD$3%@nk8+%Giyd_m>kP>XZ7Y4x2Iganq`&EET2G@Q)`ysYAa)g=X_S#mxyOE zv+Shiv$X7l<|jcXrH9i$)=xJ*A6cN(3i|S8FO?Jr!|!H3}hJHLap(no#^cQ}nn(Gh9(Eg)h@t zWw5721~NEmvS*YcuMtGZDuPBTM-5V|eh#pTN)s-y>YM&{Cp1jexN~geyr?87!Lc(z zt+UmyOhO@|@_h)Z9BwuM9de zI}yh2P6`z>GSkU3H#JnrJ2YMoZ93GdpsdZQEoHNaNbTh4=_0K{DBIQ3mlz+ylmW>- za~Fxbr%R5@2~ftgl+VuS@|mB^;`EuD(8KN1ffgoh8PU4jG_Vsvy&Xh%cK&psmE->D zOu}TS$ZldupU&JqF`1y$&MngoG}eN}5j1`ud3;JQnba%2YN-nqLn8IHNSJUQQW26s zWuzi}ht&6iLL{WbSlmlv*)0yH@%yBUseDljO%+3Zzf|uW-#T}!(d&mT92(cvlWm5G z$)sFO<2RNimi}IIH;rFq8x>-hX)PvS8r(|bmzrZ~{Htx176Y=JOC^Z;k;)2@cwwwd zX`ijQhA5-wz5}WHlUc+TC)HS>lq;(8Cc_z3qOt;wOB4>_XM`G;xKyz5#48zYJoO@S zOHI7c98(kT60WI+x3Onw`d#FSns{UR*+3}ah$`u%gN(=T63(dl??!i24I&*81xNOe?BBnC4}8t*?ad%;tv6a>1q1A6*zJX_Rv7fpQV-pYUd`+o zJ~&aqpTqR`z|1WDox`6aMN&YG9x15TYX+yo?I2_{0%j|r0+8>$IufnRyp>BKgP@}2U5T#zTsyQ+`R-wr0g_i8Y!&Gv_Zh;-WSF5Cn zVL@)hY`WUt2}p@+U=%R-%aFu6`RI~ne0N=-a^<%e?L~4nt*7%6P>UX?N6$!D>XC0EL5%7 zvW)lIQAT_7{aS~QPuETaB3Si6RvfB~D3Q4CTIw4b;L123L{LaUlf_kM0|^m0(OPP4 zU=Gj>>kIv@)_i!wR@m!TK+CjDd$RCENYpx;$x^94bKS7nuGVG7snq9DZn5~bCMAb1 zbi5=oR#9i-RQ62MSeF_*gQNJFjh-lCstfpEpKR=rU?-QfU$GtnN5V!pTLnUsMPII` z<}Cn87vn0*W(`qeW`i!hcI<;_{60CuQ_<{$s?uz=b~>8wBwo!m8}S=bH{(rd7V4qM z@WR9l>aD1L^4k=?$~~(o)#9$baY|9a#EI>yGgU@%lMDwpwpvnnH)6?r%=E*}IG0m8 z3t?P9CS#qgVE#yLnCT8CpeSi@lvgg&5n&G18a;+N)QG7BM-NBz2{Iqj+~Pp9T|3R8 z^9nMSgpdmh^9Kba++39`IXN=O(F%Kgps_S++vsI6kWv@Ss<)|CtBoenx@A|!Cr_f~ zY;K(kRuS6|EhOlQu0gWs)KEuaqPB)1CICIC3B4*y&GNm1fkWmvxAoJsi?pvNvomGm z^>A=>ij_n#u}TY_Rt3IZ6Ftb%fVS!ZSK47-Jz3{Q?IaV7TB>yO4ky6e$VNxO6m-2F z(DI-gu7%x@Mo{uo+iEl^(ju(`XxpqCu7~H0`(um{tM{Q>e3OA$7)&FWQ6SmB`4L0xnTa5-8zgsL9Zim+I%M32-s<0mgGx1`ou)lGB; zgVq8yLolbThob|CG%4#6+3mc_faU4%VMVX7eB$_M-LuPJWf|9nv#af`R($|TIE5x` zN3CkVafS&oSA|u{rQ0GI$X|@Qjb5*@-U`;c?Xx7s;c9Oqz)Xc!J#ubB^^Ud@f~{6< zBg7Dca%^K7FTDt2#F=Wd0*?X?@6m_{BNrBvJsOjiZ6k>~_gM-s+hD#4=$U)ru$kFj`)Gl@Ur7p+Ws>-IB^zY?Yt-}Kgcadn*w6mF3ob8vLSE!eK z7l}@ljZ~ZB(!cM#DqY07KpG^AL_C6|x2PSuL9Wp9l{lbe7f6p#V*yvd>_R}69Lk~m z5;*U9x>c6l%6ROc!FEgHEk|y8x-}M^f0k~oB}dy^|2+!KEho3;a!Px)-U@p~G%YGA zm%Kz})o*W3_2A~@zqV%%1i^uDown6IO^VoGfo*^m>ruEsIA95p2BV05{K(n>0*zL{ zLlctC0d5f9Mwpan!X(3K3%9V+h;!pEr(Kr7%<#fV!mF&f0!SlcaS`>&pJ=n%uWbGLg`Y)>k-*o#d|#pAL?WFcUA|)k;#JS+t}uW1=vVO`-5CP_i#Z zDmDN{Ss$3(XeBqxirpjAuBNFM|8Pxb%8Wx=KgpLZp5?q2WQd-fFh_Q4Vo%}us#$K9 z=1Xl(ktc2{Rj!=#je2?n*VSo+m|EYm5t&^-SH@Sj(fP5iQ)8>XNM&2R)N;qR2?ySY zV%uRDb?_hA`WI-^n)XiF88_NhK%WFpc??7cqb)nHy$L>l(TNN=6$)m>^dP1-Fd;rf zP=+QjHRD5&$A-)PiIwqSuG_;Ne;;Kesd0hWewLS(tOVz2e~fK0deIYFZ*O+UrIL-X zj@hH(j7`g=>wA>Jc86_5mm6?(3NuRL2N@Y*+9yKS&fPrK-ZXM3Q?1scv2R6i&@SCz zL0gT2oungJzFd8xx|YVZ?69v!!FH&eMtnlY8U-7qoJOuHH@2)%u$|JFPkdUVV1sDP zD}ZfzT)iUP8rcT31GHnW7`R5ZgXnmyzhn5o4dkll;}x~oDB&RWWuH%2+n_8 z^A~&BD0Fo2rN9QYcbI~#=_q}_T2e=d)!Pju+=xcY>TE{&^KeCg7-?mz%)qilxJ z%;pl~IqxYH$J!_>9e`R+Ze9CIe>D<;Ts@v-{&Y8~I!_C2Xm zVZ$I>Y8eF^WR&!Z5ndiwpCICexxyk`Zj|vIl_+)~Q_fV2!@ugnO1EOuMn4(9$Hw-4jQzXtZVy9Qz-=d8r zY%)yp(}{s2TkqJQ2F@&UC|Cz8G4EPqv)Y_&tRq^c|E5hayE4wNZ=_Q(6@Ijk9j2+a za4c-J!j5eshcz5YtOPPlI@{x59RlsP@Vy#=O2^h&iZ)~pRcm3NouffC2e#!j88$<> zWArz0^fuZ*q1AdRH{nf@Xkx=HpV6RuEQ9gz+ff;aNBR3FgNfm{6*3@?vNt{k6T@#0 zV;~-$I~IfS@Z6smh>7QB#9%y1-+CBKj8b|g4w(`Mv_*upWA`sT8K4K_;b(3hh=-?fc_1D;VoDxJl7c4T!Fc)^d=jAReBk z+rfDF8EOaP;b)c|h)4NG*uli`v!@Qk!_#^?7!N;NsTYqOu#A?*{{q`Vt@)7FH|I+V znFY*bXiL({@|JNXV!Xc4IdwYzWYTTNom8vV-lSl)i26qdl3Jk}CzSh)ITJ&?O`?-^ z%b_zZ-F7ZER8Zh9MU;J2foG-?VKoNUwB=?*XNBZnljuqc7W#7UOf1G2MJjv~y-L}f z3wcz}ub4AK6*}inZAHq_1^4upz{#F@v4nl~q++=%#FI**`3$0!?BHY0%1s>`^Q&$= zxkY}2lxwr|GRe^*^B$eFDy?+Xnw8ZBSqbEhIM$SYqm7-6=SX8EEw(s)^xt3 ziw-_E^gMXzsn2n5 zcLg8WchpfKDn7O1TGpg~<>~Lv;G+}IgMpsqxzF2$!AEv~=LIk7-fjzC)V&=RSkE}k z{zeYFZnKQ@ds>g;@AGgagB{NEYaCa3J3ROllE15i7jDb-#?D&*yTy=JQ%PYtoMISwU_;AkgEf$g$qY^HR zi?6!!Gq55`;PJ3uf?0my734wkbKcoi((^#Y7eh%x5~-C|yOoOg z?4=^%2-3#!H(Ykk_Fi!%mhtLBX7}e|2e(=cguFydV_XZmyt&m6&+!csNG9#$85DKX zP3ESSvhz|7ZwM%NtUX8~81pdIpo^gnP+(|P)#5g{i%B$oj&rKn3xh#|eA6woYFzBm z3cG?lm}=Ei8#tc#Ri-GjK8pws7~niDYfQ0IrEuh|=kk-137HBfI@P5}pQwb3-7sV^ z%@=V!Wpp*?;iai_{o}Z<(h~j{N2Qw~?w}M`k)jdG5Y_7KYI$@-Ti=I6*Avicf;cK7n@%~3aN&`y z2zf7IM%~C}b6!-EQzNn^jO)QkR07mpUa>MSK4eud3hK}Pq20)+*GCubqQKesVY;U= zuASXByLQ5FD0Z1zO`Yq6HFo`~FKumB<;JQ{L9C-H6}Tyq0);XCsDJ6merDmvsaQqd zf%1(RsA6Rm;kiLF@7AlSBIIhujpR4$? zkHeG?Ru}BkK~~_rzLX**I4S#|Hh;YV@{v&K72cy z#}vB~v*vOiXF7K?QJWJzt=i^ha{3MzjwNOg!Vk6y8+98Q_o(ujoZhV#;}_|*7!{O& zS|WvsWeo+zh$D5TelMDekaKw^@{t%`i|OV6wR(`F-ixUk7_Q{}|D|87wu|dClW}j$ zo0OFzUg~zw|6lAoqt~LXy@#NPux}uOBV7h%J@1h&zASXqBWGc_;OfwuiQa2ko8+WO z8l}}`)HJRh!#Gs-i4D4q>j2+LvvU~qG=?W}zrz@Q#LGX6;mO}Gu%j>WvLiZr^7lJJ z;YZx_1cfJY&jS>G)IE<+coHu?T%#xdQsXrG^7abQ=t;b^GY@`zJHTnctxRPvU;j5dDaI9trRx?s+1> zlepi308iq6=K=hPmwz0h{KAp6BoVYTQRa2V;k;5y7}vx z3syI)%;nqN@e-%3CT5uXKFl~lo!u1DHD5xq#IImyw~^6JCPAaM)~?`c8XU@^#N?Ju zrlt$ylB;H;Ur-Hj``ThYr#8QEx@-lWpNEC#H|5@*1|~&y?>{TpkFXVT>Tc;`pXh8M zA{THWc`z$QuT{xHSZg<%)qYr+tdwV(kP3LZDoDa_@58taeXRH{#xhJ(+h*y6-&i)4J`m@Qebv zI^3AT%F<%Bce=8;fof8pYq!;arBJQn)?~-2DkbOd$X#hV!3y-!0V^W+0m;b@i@lU` zxF~(gk|nN!k*#aGLF6z5$kX(Tf2iyY@Bz4{k1Xfq+mgb_8?JU39@lV@7d-Idl0`kW zjS+O&nuwa?o>o_k(ru2QrIxPbe4yhm;E||KO8EDDC6vL@TZ5%BEm!@; z#9F3PdR!poZ*B>c#niVDO68kT4rGZqgOgiWg$1)BiSRn=M&eh8P@%{TZaRjuw9##VV9Ri8=!}WG| zdz1@81`ZZ|c(9f@Mi;qO#-Ds(@&GI%Go3Y304F6@rrE1esxa}oe1?{oY?c!gTx^ns zhvmw&a>zQ5< z_G%~(pQ*8$`s`|Zt5qig7s@&oO|W~x*><-c^sB2)%+g2pqo(qocpJDDRd9+|<6xHR z@v%nh^Z;{TTC}1d^vN&%5X~DgNvCCg+|;y{@o+N=e^s_sQCY0x4ti zP4j%$Nwk=u~ z(c|qitd*ASzsh?jNX7`G7sBiyHw1Y!*?9u%?ITz`MvVCeV^0e;NZl&UVcAgaqCO|y zD%rDVVjr3C#T3eOJo9vNHV8CGJMa$bUP`%m2YWAt>kj%$8%iUp9%@6%+P(Ch|9CoG z8zda0zIX?XFQw$XgUOe|)zg2wBn@BX=h$5qS3i$$6Ia?v^X&7^cYOL(wI~*_exTKo zcij4v(1WyFPv3J>`3^AtUhU_UUKUqBZ}pP6db+Wf#C1pf+YPcAMl-u_32LnS%&?$) zyg^pxznMH$@7XhX2iGs9m3jx=FNLe8=esd#e@R@+_wF|c zX6P6a(fmkWkpLN#CJ@h3w-*(lrul$$ZQpR^K2Uu@rm2* z(_0-LL%)UJ$?veS0KQgE;tP`V!G*|c*x8?K8j zzCm_bX2Y{(ZF?fTKXU;JmaR;U zpnkMr?Cs=F&IOZ<|6H#sHj}Egu+Q$6PMv$;ZGF^m?qQ1Rl$nHj_+fAYk*EA16iPS- zF(})D?kPps7V|n8kh69wq7V(o0)O&W6`s{=4U9?X3sOTP|iHWYg} zHCpSokrFWJ*Eos!3-4F>Utfl*N!@g^hD}Qg5Vb`wE-bAunJBs*jO3YWw}CE`yhVlo z>B{)(HoU!9&NW@DFJiS1TxiA0Z6H~f4s|i*ouT6{ir)N6H)#wSpn{~rAP!J+E92AE z{zizI=lTM3&a;Pc_R8PNIGS_G6pyvnkA-K#CRh5v6^3bgAXP0i*5N`{zN$*r6DMa{ zre@{3@ig-J+N}0#8whsa+iD_cBXk@r^r>Fhs|00R( zZ}E@b)@s1mmCHu3jJgH3mYLxr)* z6JOaV!Z5u=z9tXzO6+6C8m)|Ab+ydwb0N)ArF(QL zV=&uYsGJRyF{s0mGfV*+ajDI0ZsICkOn9Ca2Akn#t+O38Hpz6k3(#ZZu35XfHdd>R zjy$PSk+u{H06}e|2tU7r28H>Rf5f1;NWL+;3#z>QGXup{;CB?DFh9>j0LA%vy8jnu z=;`-goZk*a1ut05%XQ>0t|31k{o?#e^Ug0Uil_5^aelr*#|zdpPlx-$`P)HP`@*t$ zI?fm8=NrJhU|D-Q%NNd{r<;6netr(}#rgTU#+ShF{KiKwSlvAR*$b=3)04e8KR+M# z;{5!)*9-IW^jj~?Z$~`V3rkhd3%xjh-?;4sTdk+3dExwd`j{8y=jmNuoS&axd2xPz z9_5AkmG4VlTqNJ%@dcZVr*nAW{CT>C56q8t97=Ww-w|0%d+g+#u5TnI4j<570yYPk z<2uTpjNo${*bNzuePMFbGo!54j<|uS$cVaH531d6bvtOmsk#}q*83Zg#hAx*MMP$S zt5xA`#b{nD;=Rgu+#4A_%GDbA;oD%s{U-+%-!N=owx(<;h}dwDW@TLdUaO37*E23% zZyOs2n9FkT9#g@UvRMqZr@VfPGns+p^tMj`pqMeLHxC#CVy5)H) zaXEBR&l}sym~ce3sT6Xlt=zN6&~jCbRBlBEdBx!*F$}UEJ1I>L+>_(-RIA_Ju2}pe zGk9kw%$FkJ+^KU)ymYDb%kzjCp2~(!)(CMWKGDYjw7NxCks#(~x4}Ja(k+$*$-ug> zQ@ww+9H=iWDuxr4=zqvpu|O-(+g1iy@9|TiOt%!##A1NcBTKE?Mp!!yS1nwrf-rfY zVmv@{A&ym04l#eFdFwHF)bIm)_*Wdio(aXPf^dQ(IAV~(6(%_5v5nK`N0Df zEN$S74IEWB;Qp(Md?Np$MsNO+`UT^fSr#qf-7T9}m5GRRGVmXhr zJ951e?oVOsNsR|IWCz;)v=Z)W0`7AGp#9NT6A`7u(hVi zSle3DWGrs2Y0xn)&rG0Mv)~n-W_!J&Pby3RryNAH5oEr=G*@1dp((L!;>L=n6?}4~ zuZxqg5x6Pnye-IeSfY9K{;8SMt85_iguIslxv z0ZVIB(4#7ZVH5&F8=Q0CzWL6!l4LN?PUtNLpS8;HK)nCR;%`pj#&{=BEv97NNoG#j zjdyIkW@T=v`~4Rz(XGR*4lH@eFy%%dy5-y-qGm06CSg+7kbS7!1j+oTvV_koO?<88QV)5dY#shrA#J<(*;MB4bEtKuZDF%qR zCLRy#jjFko9A1J|C+^&3Uy_w%nZH!Pjb0CSv^iAvu#f6q>&(U*1ysG+bzUl@EQb?yh+*Hn2w=^Gaw)>&%Wi7RrR}}ISmC(2bCux}W zzIaC}6UQS3ISgd=-KESca+wf74h{~=UlJH)NSW`$?ansX#htqFSEA6hY@|dgUf(hr z^~uABS?nN8BLH7mm_Jy_LeG#9Ic8W;fqXxi%bL%*Y{qa$<*XOm2REvX7SH$LYOCIi ze7T|_S}`l}K2SqxQwDB$u~k!cW3Eb#!_}SDwD#lrygYX`FV73H7FeFU<^nReFMf7p zM$HuLmfZs5dx3zzOs^vQLRPaVsx`l>nax#jM`#%hmo`zWo4A0OTos?Z6>cGH zO0L0HnYEBq!BIwq?Jt2!0bNp4#XN}igFsk>BBlLkc0Y1CgoC4#tjka)PR33d6Q1Pk zN@O#ha2e7afX~qZV>(Q-*2yANPA(Mn7ztY)6HvO+*seHK>#C1}u2vawW#gb%N%V@+ zp3VAMrXrRIhA-UPTv5_0)rR>S@abe^HZU#(MU{_Mf`zoF<-B0qL2u5+J(gXW1M58H zR+bN%?HDUJP4Hq1VUCxju5Xacun>vSSL*akwb7(&$R~K;gt5KVib85CeNF;qt88%} zmB1%ASeD}646QWWHy(to8jOaOt$w4~Q>yQ^yeBTulr=@FhGb1^>I<@I@&RJC(eKjj z1?fpfJWw2_in-eC#LGE2cZx{G)J&(@>vp?YZFV-QT=^7MYGS$3?%_-hTsaZ83jZAC zM_F)0V=Y8PK2vEZI@@YA>lGAq6o$=Eg(gUIVlvHy*rJ)*aa(<316~0&GZqN%+nWz- zVdD($>qvB8LStCvvO$bO0ZZ&ct=~ZvNiEe$g$jNl#OUcjm*Mhh;-&?<|GT#h=h|+& zg|KFI!~ttInKg>83t}=Kr>Z(j`OCzULBSNRTA`7K@VROx-Gcq6!oDD-JOzNfGF3M@ z_pADJK>IPYIRe|6T2pv3PAy6@Sf;TK%r1N=ZM_yC)U2ixI6Z$#*W4QiFm>y5 zP!lVr%uW{+7+`5Bl{rwXjJt#**M!SX;G{X%;xXbpIGAP!YJEoTSw%_U>>PUN9gO2W z9iz67_sL`h2US)aoMS;sta`NSjXF(OWkKE}Xh37L>V>wFd4H4`wo zDyfl$k-(sR(HyeBS@%#cUlNm;Lnh9(EJDd?_Cg2%K zTmoU)i(orxsg6D}#2YCkX79RDBbZGS<9i#NmaUIZQ;CryYWnQ{E=?tY*J+u?B?Act zGo(y(RIC}Wv-VL>Ce?_8f0fPEu-?bgnBlHP2gPDG7c$fEDh1+)uqhdK*==*l)m1V> zd^KI5vBXRlaC1ku(WgiY7$Yfi`JUm4N`?E(Gs6QaLktrA_{LW2G&V%Zh&qq$(}g>#&N1b|=nHjk6H_47IHng;!HgfIXv*+M}=q3V8cbTsFh7$Xm;Dvx1VYNO7 zyG25W>?{zMCpKV60*6`Yk|GbZ5kmtTb8z4Wy)ZzooNHjZ9`5e+O4(5dQ#hQH$mG52r>`I7L0r3 z8a9gH^O#(>Vfd`|t*T{%9S3%{7u!_3X`eYRo!}^KWZ+j()p5_n(J9s-Sbt?{QU@lO z1+j+q)(^@rmxzVG%Tf3U|GraNt2q0WrO#I=syPQ;KwUV3Q5)ji+-EQ zXtCLoUe&Id-9=)-78Y>W;1bAne}W9JS-LZ-z7C6Iql$6ad`L8&c=xw(6;g7;PmJlo zxxK^J1T~nA#a@R#w_S>0ozryb67EJIAQT(h@N2zpEgBS~+80;%DOO3gx?M=BT$;iX zGwZs3I|^M7fVQxObhC*HZODOXFu5+A?o1OpRZX_<=Rtj5qFp!*Dk~M6 zvee(tgW_ByI)C~iKhwCMx1Drkvn^Fk>h~Q`*?>ZwKdnJ&gROL!CbLx@P0&>xtKWA( z-{(C$x0aGx8IKJJi`$*l_J~?6>F*a^LHXzAR#Z;^EsDo26SuNbQSBd!wJ6KTkyzKqH&+31bM1~H|W?D#xhE-t4rqik@dF(EpQAJK}Or|aQb z759_N9p_XbW8aD!8RcOdiB@Ve8NURz=wi?|_Pm*ySijtq7bE#(!gwiO#n4eilw_2e z)$N5w3tlYq%ycy$(pkgB0RTokfp5<7kIh^4I5kCQv(EQWb|QSmt* z<9!1=WMH&A$2M0>6gRF08Ti#=jup8tG>b~IvTO(K1S>v;SNAhmVWuS*V@A=sa-vL` z{R z?4u!cVW--!ZE##-DJk{Jc1|2?ZTp~k1DDZYT4^6@ZXt@R%^s)#*$zZvBUpJ2PvtWe zTT_d}-q+g<=fG|S+u0#Dh9*N6|E*Qqj!LE7W$#4DbLxxeF88GajlTGuZVH7$rIm{2@0gD(LxPG}AblSLY8r$ftt<4Svl2ns$>v;w?>Qb4P z^9omRu!bFtuvOipASEWMY`bRAVJnM=DovV+&rusum)ikdC0@#<;-n!ali#i3%ZPJ4 zjMA14|D)vaPdAV=e;X9!MJyuQu)VlNJi(ZWDn?**s6qQXE$F{^L0$0VH3|1UaN@i5LovmoTL*FPUa~t8CaX=VH3+1M}Mf0jL zC!X*4q{k@-%y$ygoyn*%UyQOvWAnu*TQuTbjIu>T-Nh&ynnpCnU5w(zgWE+Z+{N4= z;^9o!T(Dy4=Bz75=Z?-!!PwOWE9SoLVv^8Yz!#H*=6>&DlF;1yT}%>M`@oAyNJ~$6 zQHgl*H;=8BV_8T<21hGa zo#+OU!Li?Nw#oB75=5I|i#d1(2DxHWVEVrWt+HiGz*JnU1sqafqbXVn^s$cWQTSDwbRyO6AM*O>AYA6ZY?*U zp)N1aB5)doj^fS1R12*LUa(M#vc}WFs=O*1zw=e59WEAxA$+2%wNQ1%v~If49x2m` zx>u;Cl>0M$G6cO0X42oAKK8*6T?%pe?vdmY)jF-S@*Ck`0_(!0DQb%|RfTrDL;^j{u@v3HJb}r0kq;ls0lj z;QNIa-&LU0=>$iSTju_dBOmIJ(l^7=mn%8{zH(hEj zx5UMROt8Evjf=4A1}j~hP-a$KI^ZMCx!NV+Xb4oiNSinlf?mahFYYaUO7{-ph*I%%%ZC1$2BumWFoAJ8jH^SWXCkOmEa6{=A{*q~ftUaTc6t z(}BS#6&oE7H`X`8UVkCHVU|wS);e}CDTv39lLMDJ=_tn2bA4RDDt*B$Bf6@SWHb^@ zMah?{<%l%4R^4ngx6Kh(R>lwUw+OS!u#Mv3RVl(E)f$lG8&GR$q7IkQu<6fHaUzmP zs8hqtY0ZAR>6zW_3_U3wc;@LcEK!+f8gqF7yExuN*16dw<)s>vAN6hHdV_1|b%aaE*A)p%p=+ zN&&i@l2?-ozeAj27STWD+F%KpV-r~;o{up(Xa;f;2}{)~StAzD^$)S{nDNeF&4amV z92#VSuWGcVidDH2EVJ_J2BGx>+hlEziV0{SwQ$iWB03syGPVx=<4ft9m zLcFAxw9d=(IFI}H5M|*Zw$$6k5@Itz`~?J*VIeQuy!Js&^(YuZa0Jbp1xA3@hp}eB ziU2DH4rGz}MauC=ac8St1R~YqmS%P!C#OZn)$UT#9Opr*>?adFP2?x5v|U<4qYyd4 zUayJ^wz7qAB-w3m&Tb)0sPxriOsO_3MGYPpI-Cwj&xXUOsRkSjj*c*aiSpplz*!ft zUhQv$-Q>d560j*!rq+7=sulDmrV`2(DoiJMBWD)Lm!kggxVmPU6XnHdMgkXL8GA%? zuIMR^vFHRl^6^Utq2j~$df1{f>!ETL%tF1BK2ab%f}=qM+wbIf;jL!1kg`W~-V`J8 zE>@W`{hv{J)co$Gw)R$r*)&Aa*D;u2dKINy(}hYw`igeRiA-h}s%R>r&Y@7bkQOb* z-Wummi`0XqbZBuIzhK(yqgSRjD;5@;t5I-~2_7#DzPC1nh$u#gyl7Tr^QGBiK32vw zQLxG2SO#)B#7ISpMr0tNyicVU!By0VMzql212rT)I16uZOofdls~Hck163ZXHJI`bHN+_fQUG=_ znC|f-y_br|zoLLdwT_mAMY|$;4a7qdQ*a*hk52f|wun&EAzH=5!hZ~FFwuAoXQxD`cjkEF(4zLMmxhRZKdf66dv;;iN9@ z$z%aglSm|^(IPENT%K&g7{x@jJ{p@%2-xBBOQk9eXHzc5&{+ zTJEVv0&Z=x%gW}NVb3)F+7NR5J+XQ{MdmXJ#B38_bE4b8o>{dSSrPS-j9tS46u)}0 zM}3OypX}yFq~JH|UC4%_ipP`~cfhjSP%*OSP=D1^%AP~T*i$YH%u}Y!<=Hqdj z9&;gVqP2!{Q+=+ANrSa}rz6dn#3^?6u?pMMA@vwZC1e&wlcs}%cYKYa>@6gVGnzoK zenXaoelcrYTG+A0MMWWctW|8xv%#E@`kgD@z-Q=OmjUYv?byor+POsL?{7} zqvE45hzfW z>MfFmIQ15G>?N}Bu2$Io5?Tx$D8~B2WQ&xQ0#<(91+~;+_et2=G`2Lj<)5S3N##rh zQOr8s$T`L0-{QEwv%l9vOm@MoTeCV-*93CMgC+ z+*9yll(x=-S9}W6gYX^)mgBNyjoCuVx^;AXD7jPFi?Alt zrQn{>O_nc&1W&swMEixxqQw~dN~4q!ZOL)xIhHDI_hAkcXl#nYVn^3L2@qL0LO<$(*b-s4w=5>u)t>go|yW zE(v$AWOqg^j1jG_qZIL3aBDjFm9g`84Z1-mN=A%wx~dFT_LM3!efK0WRhG5}qj^+M zE5XWK1lhsBFKdz?11+hIzTRy780cw@9C`=o8X3%|EL~qT>u#8UY(7JKEZj{p#-y94 z1(G6gxQ`o9$RdIb8YwT`O$9@-z7S+Rckcw^VmSz(f~7b!M3&$RAe9)4Xu6=d%PpUL z>7tl7BlVEsm##6k?6=EBYXjF9_u5UurWP7fl`sxWwJ5GyJ~l$2`et&A%e zW(nlBKE^mY<%e@jtdRNjT!=hH8xHt!1bz>|)bNESRL*G{ZHi^AB~uSir1Dr`cz|N# z`^x0CW-H?p&Gj~RCN?&0^A$x6n;8Gdf1A}DUF~!?oM}D3XAc?_3PTt!)X67)l^byC z3tBa^tIL!UOx^#^9ZZ;}&#PF%5*#_Yk5p)1R~2+VY&NQ^jV9fo$~(4VqLT8e-9{D1 zSO?G}tFA~lSj}Mt5!dJe^c);TXDHjmKokmSyn8x#u^_h6Hmlv!Y#x~E&)Dd{Sv{xB z+_0~b80zA_l+7k|w77mVkwUg@n*2q{M73husX03rN$V&)LRn!`pA7+2N|7~=Ny%24 zM-3^`H`?O z+{(*U6|8kIqw`I)5n{g!u1~({5KDr#+`N*7^+wg47dDfO`Ue_3ExUu%{i_vSFT= z4n1tfmY$cf?f$6$3Jz`cx4L0;5dr2S7(};6xkd{H#23C^F{^1hXV9o6cMHPOe3sZ}g|((RvE6?Vy>QHk?{HB4JIG36lEYjwLaxo3Dx4s{Hk z+a4qLb&k$!QaU=nRcLszxyXvUp#J$Lcnh5it}-T<``Iw0pf#CO32rvbO%%^qBK+Av zxyIOZ;#HmG8gD+1Yj`U>E3Zy=B_$UnO5q}`Kp6(7mW__+G?c968k|~mAi0U&i@Pji zxKKTsDauN4bcVTCwGfyX=X$I4ZNtf4acWsR1#H7&{%$=5JbCQM(c?!EDu`>1odd?; z&RSBxL(XY1dTe&ssHQIAxpQ6{?x2dpwF+PZUb{7MrrLm65v~u~ERyC?v{#t0G$R60 z+)KAxiL=M{`J0gzJB(~6cMRI~7fEc?_$O3n$BFhQnvyXSP?1u(Y@u{i19-bNMTP~Z zybZjt6NRK|7sqQVxFr;AK$01? ztux@=s!0&1QW5*6yro9uc0Vbqul%!%mWVY_#(iso`?>28@7B3ib3-hLB zHPa}D{QSHEA-ny2cxkS3v3_m!d?20h1}y78HCu1Rnz|OBnf17lxVh59um%%oh;_<9g z1#R+S5j8inB8Zul8eZLSMq z3X;RunU0Gfk!4ObWO(p5C3j$J^E!9uY@?81-sv{Tmu@@2(F+_;Tw1L5PFIXx;h0?1 z>3~KKMlPT;Xo+%UvS5a}r9CUfK4CXy#wXUvwL1X~1*oVyBA3c&i*8S6R&mt| zov@9mWy3FJUsloFr;PmdlWUN8%Qg1jRgR6a1Td8>)jP+x&K;wRJK$WwC;OC8wAWsr z0#>2spT9!kURv3!uM|viL`P0-CTaAJgA>)lj zZ4Vr<8NN(NZi7$pV1Vh=N_;n&T3G1S@Nld->Wdu`Q;o=?Rx+{!8<|n4IYx^WH{S$J z1N8_lCuf)&RvM-_F_Z9SrfT36LfMEJ{GJIuH8VXu6C7p1Xwni$S7?ScOQ6R*JjphG z)1>6as+Ck?ehM6~JiJRWRdcpO+u_Gjv*$pvW-xBSsCUkWb$V3!|4t8q_XvA{0Xek!aW&Zyvv$)iws6HZPjGvx!u4fSS;)Y z)qsegnA&B8wqxlq3*ghubkd9kLS&rBrD4Y>sO&CafsY#aV>& zQEOTTH!-J)trgmmL7ACLkunG?#e|CIK~oJ-ks&M@k8Rg=MHPs&mO)O4m_xye8cKZ31z5#JVD5aS(;$9Yk{OW0I68CAYgMyeq@*O0OShFhy>L$5QKty|8;m z3nfXOQGQo~v3kyp@I((+oHm=Zn_{}Qkzx5jVnoIz#mv76av8&4JjcS)%8jn*K2lzxMY_1GD4JK=6i!WNWn2XNI?e)e@YBQH zu)oo5pAEuuwUGD3tl?e@yI=fMK%pym+>S17{wu;Qsg;US$BdL!#XU@;dI&28Bz z3OWO+EHgy(1uUzKX&a}vjCrC!_Ve^MT4&IAi;trl!JR8!f{#IX&PZoi+L_QcI52=c(8-z{Y0x zr!1GrYO7`5g=VdbmB3c(1a?x4Th#>O8=2j$R*O1E#hD>*ZL4-9QOLbsbuDaevjLM` zTM*xZV7SQO2=7&URdpVWc43Y0K=X9IaApx?3QUOE;NGikg!L^niaA5{w|GrJ+cR?x z!N!woJ!NN_nZfpt?B7pUyteA?%>WV0=%OgJ_f6br5w==k&_Bzp0MVs z!}RyS%q;z#!=EEZCT5OJ%+l9m_{@n1U-#kV?7`!Q=;Bzsz~{u=@oA`xQ8ErA~?ZYQubNJXLj-)8Bk*PW9NFmQ*yzkz6ASEDAD$ zJ+cv;8L>#5c@cC(DKtL$vH4wTOH%a^1hOC}>FNu4rh*uT-T0)A^feN(tP<~~15y0` zhS~PP?HW$2Fy~W)hm-JU!xkF97K?ldlGX|4@z%qM7nrHwZJ^HU6vX=4LzHx4cOfqPh@O+t z3ooFDG7AnYOci;}w&>`^nYd<3I7){<(xs6cp%wwyHIc!hsE?TSN*SBthaXPO6NYRWdSF&&Js z^H?ysvCf~WgNluZv^1GSE0+e?Dt{i#5k2c(tC1AL&U|9sL|4#tBM0d zY&)YC^GHvqoC|h~ttx5{H^)%jw5pN=(v>^X^&)j6L?L4B%!c|Q;0ETs^hv%PFFm@SqJ}{42}pbn@L$WEamR2Bo?eh)DV^p5eydF zxO0On{kYC}y;8Xr9ykXkvBHHNf?f-MDXdk_ZdO~{wLx+c9ATQsAmNY$K|~8lYVqD7 z=L_UOhYG(Zx{LsMh+}jpa~9*FICbU}`JMMD$hfyAsL~#0is)3&X1VF`wP)1imCiNV z4~kx;Iz%0iXj{?CeifkN;sKg9;!r1F*8h5K-M^` zky{$K(nW`IV1*bU=!y_tPpZ}hb)#O^0kIz-e_%ZkE7XJ-DlOAdAU_hebCfnJ4#kVC zV-}JKk71*iM#{NHoO_4L0;V~2r5krJbkvZ>=05uHP0z)sIJl+sx?X#k{8$P&TZFN8 zR~Sm=Zm{CJW0uEAibRs0#;x6kIW=qU%1|Tb$E-$maV$Y(c(J`)<@XAjOf8Ja z1ur2Kv67Kk0jw5P_Oh5T{m6-lmS8lHAc~bfV!6g?jw!L8EwNP^%`?D&`%E#An4X|V zTwf2n>AO;-AZ+HtjXnacoBv~zzef_=*vj3SG-io=PZCUc)nIv0r#Ok}nM}l&TKo5$ z4XdZw`H3YpnZ)sCMt!)*vwpRS1TyUm+@4uuR=Cia7Mnhmtj?jrU3kMNHGu02gVZuGp*P-YvIK&Z|B#K8X%22#`S3V-oSwt z%Q0P^l*X4y7HSAr?j{mio3Bh7tnjq3cam-JV7uAw9&ERII3fw_8{5FDEH9qx^Oyp3 z^q$*F#sAohhHB#_{y%k#NI?_DsrDl?n~jGMTkDdHtLw{0^pD)aXLZDF^lW1wl@(-0T=F8q_ARY zkW`k2F02C_z&xHSgz8xazP?~Q7tgj!k)0dYJX#rxu|%yb>J@}F#M-`X!!uRIbG`MjFFP2Ja@~~) zj>rueD;29uyw9Nt0;3b{#hmMPwgwmHfY=|hQgIaLfDk8`ICE}vWi#BIYSC?=^%X4r zmT8-7C^)#de}6DPjF~{Nu#J$)IJ?Sju;k0KtM~68HvCQ_H!}|olQm;}SS3S)6PuZF z%~Xg);x|3{=y)nQT@@VAMYK&Eq{W5nQW!?b_&Sd$u8Qd=2+5!F5*tU`IBUkYc_dB4 za!k?mGLN7>e8;5ppRs?c4euVUn#_BfYqx}dN#r2 zN&l=+NfBwZ*t9gLcGtHyF)%42nP2I|^qPsy)aWL6g-+_%EE2c_ENHIfy z&sjuplAmnLsdj4kJ&R1w+}hJW>qK}dO^l$!NYo8##S^3Wo!Y2uTH4RXmZBj{HD3eh z^*Mf(Du?)uK`-pxm=Kk@X{CCb7?Q4W@hfv3ieIOTmAx7V-?Wz5tG#$-ZYx8<;*3$} zi!&yb%U>-TmjJWE<@=<*`5S|}`3s}A7iaR6%@HPD^EWnC^S35VFV5H$y*QJl=b%Y< z{$gjQ-e?DiW!vhniN#iLCci?2{XVY#i0|?5qr;=s;k|34;(he{-ZlP1 z^zYR*@q@&j+uW>(e?|YhD*6)rAIS|cofNQcun{-ds2gm|4Tc$jOBVLJ!S=bqu6Bb} z-C(P3u$mjJ?gqpB&7ilDMA46!i#`Q27gh>(jT=+5LQ>Qmv#@4lI-1Do=v8hobD5^7 znPnSGFdZ|iHw81dtQ5@LvQjW}VWnW^mNlNp!nnD~q+kiXjfoy8>eoh$J<>h_+b3ZA z1Z-cVx2x9lC;9IoEa4HKmRlC%9SiX*Gm)y_r_Ry84mQJTYpcV*BD`$;Mc=()Kci3Y zhZC*d*|01Bt!ykAe-vz3+7omXNTSj#aO?;19SOm|C5ZDMZOP&sPKW(?lae1hB8vD` zw=aty6&}Z`t6?+!Gkl-fJV z-l&UzE+IDI9IncS!H#~Rt^Q-o-pBsc<9oXN`)s(5>p_^+Y!-3TLq=kzM?0YeNJ~A( zuPvgNuuz7$_*85p@?Ti=L|DMOsMpFbQ9MQZN!fhl|CCiL3MeRk*DDtey5+r(55fro zJg13NN_i*VuwCZFZ!FeG;?`&?J zqlL5M9#trE*zd* z;B-7-tr6A{`^zhxAJ~_84Iy4VGJyjzq91YSLpE?vIgWXp+xB8Xsa*8gK~ze*P+ro~aWBVca0J#y#{IcUG*7#szQ8GWV2H-OQ4~%y3zMxAC9BU?dX#@yD z0!JjiP0N;@E=@s^j-|l_c&)MSma>LhRcW1y?n1;XbV;{~L94p%)Yq*y+pATl5oR;2 zH>w`JP+hv2y2y;Kg4~PXP7@_`8+N%ix3FY~$;5?G4c$8PxMSeQMN2TT60@z;V0+uQ zZ{P0Sd#|}lAhA;W`P&RlyytD#|IV(Vq05H&b7h@^rkn}IKZhQNFE5Jz5&i%2D~7JD zhpSubdlsUfzJxFDi~b@0Um3dMz?HR))4hG;@tb?&+pEA&doCXuf>4i}oH{hIbZqh1 z%z?*07=I2PUwp9s*cMMa8KuYvRbLR_AhS;_&Fm)gx3HsU|+;QmTm` zzv4DS!M(TuYEzi@tNA4z+Ev{xiW#9 z2JWQ}IHL5q6z+=3m8-oTUd0bJ+vM}CD~3OmPZW_4j1ePf8zGCjFN!)S#UI*swIXKGi`veAG*<+%28gD)b+@l`M z^FrxNIO01G%xR(WcjeK$hHCiGlO^9KFxw8e zX9M#R2i&WHd7}|0^FihGI|9Q5#2=|Y9rsR0+^F^V1C5`_hw*z*8%qdVE)trcM~vQb-;ZKnEzwM z$#Q!GDeZB)hTeb=J$in1+;0OjKb(&{MVOI%+~vUhb`EYBGQAg=Z#v+<1I&X*v-uLe z#{hFG2R91b8Zf`)fcte|Zpy(u3iQ4V%pJzEwZ6zBa@2LH)XI4R%# z&_3P@%*T##dU`w8>D>&>EdpobOLAX&eAm#u@X3;o)_D&CW;_Q+ACm7Q@aB;Y zxTgX4WCz>_f%`acFIY0kC-p+*`(|K%SKtUO<E zUi=O)hp**0z1~ZDb0~lgFdsU_arexS@3l|aHS}hD=%K%+d{DiA2QVLYzF>F~ye0=neBS`f+j4M3@ArZEa|hh#fccgK?q7kqbTvD_ z#P_bi>~X+d3Cx5MC(Gkb=r@i6vr^}Le+2Yxp91D34!BnX^VS^PkAd%dfcc~Y?hC+tHwQ6vgJcEsK6fV(s3-M@|f8GPum$w#oJ@umK61DMz3(0c-KZvf^iIrIqkU0|-f zfy-y(`w-v`022zFtvm?V2Il2CII4fI1?F7>XXE=Y;64V-w{z(I6mb6zOux(XVe5C7 zfqOYH-xN3-U$Ue80GM69>~bUA9f7$b2e$#-eSrB{fwT3KR35(x%-`hTb^~|kK9>z& z*<)*$k9EXd>xg@fBkt{vxW971(YSos7TOU$^w3{ZerdnrzQ9ZgoUMEbcP%i_cEG&~ zm_N+Hodmtl3Jkuo$0Xmw@#e8-(9ZFp$0i@yGd6%ZD{!{_l3&5k2n^Aq$HbR#f98n0 z*I6zbBW9s@J3v-}TR+FK`n*YwtAu+GFn_R}jidSQou0O9=vsW}vFU~AZ35H%scd?r zzdr)zQvye5lU@k-MPR;_gQNMuzX}Y#vd2X4zIbzor|%ki2tM>!^MQ9)0rNzGv&l#O z%OPNnI^dRoxy}Js2d3eG>j85v2e%vY{j9*?D|<|O*^M{9?tuFQaDN2c%bvmYr`zvk zy*dNj_kcP5(;R23e{TTpeZU0I%*L_t9GGtkoUMPpBL(B@O+^(TfeCVOSCLFCRo(Rn0930V`2PSmDwSoCr2i%K*d7T69Ex`PN1MVZh{ACV~ z^7{>7zU_efcVKS!oNWEQ1+VV{%zJ;H%YnPU zz}oUbd`EzJqQKesQhpBsb8QYin*VJA^Yb}4n(w|wVDObawtV~&BK}T6fdEv`Aj=Z>~ ze3I|4;Pu{@?;85dD>zQ??`1w{9dOkz>>7FsKJ?IE6TL(DeO+J(M~?~D$M0_i?m@5Q z^k|$l;YiO5zyt!v`3|T26A9MQTzsTjYjYqUzSO@0U z1_66n1On9t_WTLkXAz)Zg;yF4f#ZD3w6a5lb#dk--G zkb}DpxE}&@?TwtTP0x=8?uEd-Ti|Sb9|YW=0`m_7M^sJq{s4ae9xzwEmh-jM7s4$8 z^C}12yMXz=1MVKb40}61^knhf0_HtAIMT~!2}2zX9-Ce$A9n|4S>SAZiC!O=*E!I8 zCotd3p-26}-ChSjMttb8@g?~>z`Vl&_eo%W^jGug4Fl6P;_3}14E+I_mjd(BU*q)j z`IYRSssFp*ukRXq1U@2}Qm-Vv%kg>?m?yrT<7oXQ>z_{V)4+UL;0P^ok{;Q8z6nh2 z4V)gyVZu@W_eEf?d!q@rUB_$o%;N8-f!X~V9H;ZuagPG#Tn>)bDL)I$zX_Z^o=bX! zd(xY*FOCmAI!=z4r2qc_<_>Q*$tQ6%Z~9SSCLM6Iz&tAlM|@uZ%r80MejS*%<=~zS zdcP0M9pA$9VQZJ<=k`Eg`Z>4>;GQQi_{ttx52RkGzJ1IQ_j%y{PGCt&6TPGO{bpdE z_?y|~LAXP}yetPt^4$o`Z#v+97nncJ!O=YK&jkiw*<;GbgCYKBfcxHW@qFn0klrru z_CMhdhYvmUSJKmQj|66~5hu%o`0fX$`qq5D&jjX$0++@2mB9R(5hwZXgWSIb%+~}? z&#%N$z5k)W;46D%ekG2^WI6SBkq2VxCc4lzKkq947l6Ajps$5 zx6AU~jZFSFFn=L%S>^G0VE#G>M}8>(49tHy;O_ADT|@WAhaMYWqW556MjdcZ1m>6n zZW)+02V4i3XBly_9()LbzW|sc@8tQoBjmN!tM>{F<(D24j_U9G9dJ~iKLp%g2&}F@ zDc=Zip9ki$-{taU;qC^^WDbt_&H{7F0k;NBKL_`A(EDj%9``OTpFUp7dint1wgd)W z*<;e*^?36NN8Bxrxb=5)*#ui-xe?z_IpD~?`GoiE8ajv%J+|^7+;L!*9B=_J>khaZ zfZ2AyJsX%8=HPZizE=YCE`hW4yM+4;FyGC=-3;7a-@9w*lHcQcvCShMfYS>cW(ry`F@VG z*#+JR+%Eug%?Gk^8^Be8`Ix}j@_Pete+A6!2eb3r1#T6Xn{sfJzi$c*zOu*EF7Jvr z{{Y+%a_AB63UsOu!iOGPJ_xrLm_rV@>wr1!fO{q|FLl7Z0ho6=;64V-7aVZ^49pL6 za8E^k@Aii{CxQ<>w)(P#*Ea%l#UFDV#f&hO$9?hodSIUOzc|ijC#)g;9|E)I!yISh z`yk+s2@Jln$HezeAhQYF_D489eZNQc_q6`|7%-m|I6_N$I_@jL{DToE$HAMC{(Hdu z?VsfH-S^R5LkIAoCyVbfU``rwlJ5gRU=^5WeT>u7?LK-w-T}-91TKs3M}fJ?h?9KD zzVT&&VHv?6sXvMPG#Fj>r||pwIG0bKzv%MK{29h0eCWxNF97DW18xhLpE2U3d^dpC z3xWB8!0Gb?iF*+`q62@9`Oqi1e7liO=2y?hk08_cp^W3n%EumHh8=K^2j-9iZVs4J zMx4wCt&`V)d7r@9`ai;b0+>CY;rX!P$liH1FfVez{VFj3>VUh$O~?m6^w{`58Sgs4 z{9z7`>f2`phUn2F%T4Nq?5AG^?(v`HeD!fvFW-~E)CEp2UrFx>=(T`(uLHgR4b0bb z=#js`KLT^<|K{@9_&yl8y8<(ogIfmf$ANi;!0Gvw`FJaEZwKZlKWEa5#D%~;U10E) zJtjR9?rRP>(%+%aW4y$N9$S9N4)Pjc-jahOdhZ10mK+?>yYw%24c!wTdTe}Ojd#0& z`Mn(6G2s3fn7e!-n;z|R{+PhvD|<}(BRlY@18xHBZUF8bU*vo*M>@%t;5_Dln}a+*gs!b42fNcz($~AW{zgfZGJY z{{U|NU$|bV|CjlYdZBjozMFRq{Ruww=z5X3N8#P4fcZ~>)5}BRh~8bk1OFy`=&{iw z+(UsGalkzRm}v*xlYx1P18yCdo&)X~z&zgp_X=QMmxFsc6!8{d9{R6bFShne>!uG2 z4C#*^S#GkOQ$6?#2OOc0wg18C-5=?s{`7kKf&aw$P<-go`Rcfv zfca_;j@rk!fVuk*IK8a=J_49=fy?6iBw&s>;1+>-ssrwNV9q$;o(0T{j5t|eXx;vc z0z>+vN9tMPzJv_E7Pxc&#r0wvkBHu{3JfD=p%>uy-*CYF64>4Dhr5P;nXMG;c8e+C zJ`Bv|mr#k}>@z+xA9_7F1kAj^QEqIwQ^0H(aZ)c&1A#6u|9G2xzK^)=B}3!*(4+H} z^l1C~Nx*#lb{v;w-x$69B|}fbCrwY!?_ppTjX24d^!Jm%y#CVse0&9%e-Jo5A3ERf z0ki84Cix^^nit+(y68h6aj z2jP0aeAxl_O<)%2Kq($we=@&B?3r{V_e+Kzh7Ubi@(ly?LZe0kh_S>j3j~BTmXkiG*Ca8Cv9 z#lZcOz}m*GHgNa2*Cj(ghYvk8kGJuCx4%^SV>}N6rsPB7s(5*42ON!O zE#S@wtS!IfPyH-lUXgT{t4VUJ$@|d?^Oar^ysNvFgm#W6ST412>aHkK|i- zq}K-Sr*i0#{$A}!?~TB{J%=92_X$UOp9Ah24)k_Ckn0$v*<;h+Wx(A-V6)0&%#q%H z;Ev|dqx?1;>D>U_GjixrdEDqo?@hqHGf5A@)%&YWt|ol#kCO za5g=E5xBog@=egYJLuhRw_CaW7;q02SX;S~d@mUov!meCUbmfq~u=fSFF>67;CPgaX3|;*YI9ZvwaNK<`zK z^j-(tZ{^UtALRL%BfY-??&chNl;68N#I3#E3%G{}Y^>*m{-}H>9O+#PT$n?Tb*zE02c)HzKgM@*w@4aHO{aT+M;r z&p6V1K5(zhp-1_Brz5=&0{8J8dX(S4ccgbSaJS^p+XH&{edr}a`|+WN{@VJ31z-Y! zvy}&}JD&l}&ujE>Z$Y9Rk-z9`fO&Hcj`a5j0)wyYsa%n!N4SrsaOU~*O~8FsU~Tyz zdjI7}@A8LTGIURT=*gltE-(y;KQ=vAfIH?u?|MgiXMp?J9C|d){Hi0pw*mJDIrONW ze!-F6*Ma+I2YPpUxLdz*ci?slY*u+Z$&ua>;FfdfQGWZ5^qvmf^K$4>{re3^dhY=4 z13C0azArh_`)lC-#ev?BJi@I!?g`w31vV~^#C)9A?Ue*Q+kAW?fwQ%v8Q_+Zd=vc; z%};y4JU59m%&*=E%-fT=1U+g;p8)17Nt}V+Ex=s%$V9)9&-WgCo2C#{~vo*<&g<((|WNICHsu0l2>vSesr*&$oRv*B$3-ucuc4cRzu( z(IY)S9++i;%hL1pz?{jUNA>;}fO)mRW!3xF3yjQ1x;$7vp2C^+_YUAbAh5RlQh)U& zVE#qmvhsV|$6PXW1wQoH=uy485}2z5j?+u$gX+~$U{2=Xh+b1*@RdEbdbO3pnf3Av z;GQqAwtSGD-{eT|oxpuChaT1YzjCDaH^AMTLyzRU%VT+2Fs0y+t$)5Ra1R$)TYh&V z{S+{vz-85gZD5|0LyyYs^}zg3jb6GQQ2qN5FgI!R(m3+p{f@xkD|<}!U^m{}0^I%o zFMDSK9z~Vz{SE{OsMCpS5S3P=1fv)XDj3iN5~zj_gdGJ9B|jF+^y~9>Eo7 zTyPt4bOdKqa3vu~Kybqi#!+z`6(-IIE(mV<{{M4MSGrGERkt&DzI*TU+M<6~q!@Ye>7yPCz}yrgFP@_wzgG-`;;_?$`TKMn zmuowJUk~opn0Ucy?JxTgO<;adoSR*|=eF{6!iR^GU0AR60&}tA-0C$$F+w2zv(uOL z?jUeiD%LH1i@+>XoKyOkZx4fcB1T?(ey|?e1m^Vw9NV`~6oa5R?DSy1{XLGe&$ol% zTIIUine#(FFg+FLW|sh%F$v_+F7v=Fj*(|?ms`QCPQY<}@hQb1C=MsPY>4CR?Xnr% z8;W(xU)HDpOj6!KaILy0VP`Ns73XSaFk=$P6Lto(I7VK)ow;s$E10_!=T?p$RE)H; zeL14P{0`hpignXtCzuZv=VWK<@gtZv=SllXdG>mA1k+h@ZhCZ8jGG?J-?QU5dw=Nx zu0XL)dQjdKNy?iHZf+9tRwOBJ6}X3VdD^&)_S&S$6XR7IuECDe>U-+DS>v4g2Rp#+ zQmmW(4kjt@XK)?zq`$by%T^4MDh{Xg<$~*-Kpy8EF9UO(;@tfH7BKfFkVn6N0nE!W z^5XqI7u;?z?R!Xld7oYV$98|BVh|LE9mjl|8OPcC{XB5jE7r}oV{Sa(K)T0vtM`g1(*-Rhlgbs8+ip_0y?M3qrO)uMhL`zPUUhQxa$+hqrR)b zJf(9s>DvkBL!HyoM}2<;bL54I^*syB1v;n6V|g2)7zD-Pr0+OzQxeFd{ccE7-Ywwn zO(2i`;upZ|(m5OZ9R$;=r)C#TU)s+HCRgWdy#h#(_Uaobk3%Jo(5*V z&e@d9+rd1nb2joCz`U+=nmqc;KNN$YIGpO|Z^5NpEN$bYFYVV^F-n|ceV+sF!UXb| zzL81FyByrq1oGG(Ed%qQ;@s+u^3?qbC{-seM~{((&P8*;%t6#}(ZaBS8G;WWWC4h9!{4^vzCE-U4t- zlaTj7lJb5J?wKUyy`7}Izku7DguJ%>lB*AX1@1(}y5&dDB;}QY8<#*H^W*9y~Db^`{Y-jp{8KrYJ?LrXD5}niPHMTSNf_XycY~<|#vrFf+^#y8rP%#L~ zgZslYj^nUHNpgqnI86`E-+vG8lmXJ#{NKr+&jWL@;+*VEe;x;>B1T@k|M9)&3&A|5 zINoRH&-AM{hVBQDr`d(;p&1(IInfvQ91!(A4qPwAy6Ia2=2FEu>C67^d@xI6xOjc@ zz&!xw9mP56OTRzYkMRONJeHp0`suq=-+nvb~Mhvsu%>tVP_YX zqmMMsu6$&JYXW!7AZZ&neY=3kQ=F5&EFVL`ToJ>?>stu!8Za*^j{ak(FZ1`*Kr2sI ze0Vtd3;jM1Okc%GJ>ug%9^5F!P#zDbc&Ep4xwhpa2yTgDo$Mmo4=_(C&dtu7z`T|~ z9_{r7n1eC$;`OEfbtpmp;={wqezfz+iV-0Gv-2yqt7mAOQ+ewZ$HhOVN&mYD+yuqC z*<~J>>lNo@XX?8e%%d^#;_cE4+>2liD$c2XJ^@_mU}-x9#o^>HSH^Mn{xS>PBE?#I zX!RA#`CXbkyYkC^-DBVy6zgWc_rQFjI4fSQe?U8=48gtve0WHC@%CeTbPAZW6L6gO zDNqdM@v!qN`ttydbJBMxxT!Jm+S~bBFd@ac>H7$nbusen_1z3+X9AA;ex?}e%EL+D ze`uVYzO2W;(>SO8TII1Yv+I&uQ)e*tl=?vIgY?^jQQ zsaKqno$1dXf!P-$FWxRJZ$E))JIq~Q+9h2v2#UkbuUIZKHO{GiJ~NJsub)}JbOCpX zV%_{@IG8fUIoXB!UJK@i79aU@&m5FJ*F50#bIX`rhA>nIqm!UqaCN! zlPs5i(m1Dbxe?rU#X8xA?dm=-Kk1y!__EV*>@&xQhm$<|b1|5aI%gxV63k+q)7m5U zNAFP#;}wU^^Gx)Y`@ub{ST}!p70hnMIq5-v`Hsv8sjrl0?=Q!K>7+O(e_=dlC`Raj z|Lp1m=0`TT-ime8qZG_I#kuKmHJF+hdG>nT3FcnKx#_V+F>ZQ@{sFiK#k%S79+*!Q z=cY%>Nc0cz;o+7ar+_&_ac+8?s~9&uIF3IL+$hDm>2Vd9d5Uw><2Eq&#K?=!k24YP zlVILc9M{S1{DtN1m{HOu2#Uk59^(C{Yn)xXPkCK6&Z&Os1+G}JmcCl~rTr&r^6bXH zwDTlz%N6Tp=exnIQJfX8R!_40ZUOUpjJ$X|^ZinvfH@c=FP>vNcVvxO&C9>G2Mj zj}_;n2iw(VFsWmtt=-c1E5*pv*_RKtml<(fuI+gGWN=*->y$p$&jY}WRh*l?v%oA$ zAdh}}7nlcP5#c{u^ca=u$J2#Uil-^4sk9A|HrCUD;=*2ylEcig2i&s4Oi zuk7WW3ho@mTJmh_jX|0`r+Om*Znk3G@?$BO6^gUswW&9r0JA!wFH3*$KZ{H+DI zQn60yqra?8Qr`368k3OsX_E2|fcq&4d7Z}U`DU+g7jSusb<&shh+V^$^SNN{w@>{~iYSq+*@) zrM%a{e4=wUYOHz>1zVhtaCQ7$=M0%pC= z*~ohb%*Q&X$)mo_V2&x*^stfF9ZVmc)8sLIV-8o2qoJgpotRkv&M?CKZ# z{hb=;6z_fD9@FF1^q{W@+y_a>`yokrt;b`&7#|)^enmT<1E!DSNIU5}6wKub zG33(=VIi= zr;qvZ8kn~g=awHIDuz1nu+xM2@iDlc6zir(#zZ_HfDaEhJ@Ua6Db6WB*uNSBW?}-4 z`7vKHjF*R<9xT5#aa^wLxYh)Br(&J-V0n8Q%*%>%v&(KUpC*vUerM}Rtvu=Y@Nn`! zp6{j@0pdR=eY=C}rC29Fpk4Zb8I*vdUyW3ZTfCya2RBWzZgyD=##Ee>o!M`C6wIGu z|7qn`nfeV@41(gYv!4%F zhJu@;ST{Xt!K_rAWk1cYsK;6`8)D?e`wPqO4lsX-kr&U=ufA6dg5t2#gIudCrHvJa z`pVu9I)FP~u}*qWUXLW@^#*4oA#ZY$@@9g&Ith8Jl9aa^+~W!4F+W~OQr@4zeU?C; z5Asr{U|%jiJS;ogl*_(g2J4*WS4`h@FxTjujlAE0`JK+$$lI(KkwEYbc{-RSI%i|Qd%^r(=d|?E|F(kJrE@m&4uWYl z&0Sy0^C<>FaX9Il3$AwpdF-EFmZZGN;N~WfNBgY+^N`Nj=(`EbYdU9Rzc0Z2sB<>* zPMnV4d%}l@o4*t(Mu7Ow$$sO&O-Ue+_PZfTdAESOHwk$!Bq?tzxVIC?qrZFwrqv8- z7yj?0@9|(xQ=F6i*iILK@yE!EZ-3d}xE#zx#kuu2W+(=?h{LX(<~VOQxSJH~rpIb9 zk1Nhik5|CF6(i4HkI%vULvc=eP~YzqBekHN-tr{ntpIm-67rr)Qr;$TuO*O2zyE^F9BFIIem3ppDPYdhIZa>sl>ugq z&e_PD2j+U6)AEg}TCEraMYn4ewLBO)&z*e@^vU*Er6;9_kLRk7Awlpk2m-nWb|!`4I+lm(FQ+Vg9ZM z)2MSc@;(J~K<8}o*IOxV7qN?7xuhN$;LcF2TmJR}Q>-{AyD)zzf|(v8&pv;bfLW$E zxBOkHn1~)u`MWBPv(Mkv;2u}3lOD9oD_}mYRBcN&;(I%net z0maZR;&6EGcyN;35IfFBk5X{uigl|uf?$>?&MDuxuj*bf4=T>7KH&X-P>fX8zP_g) ztOK`Mv2N+x1?F#xb4nlUwN~@dkHv?FlxJVBbp~^$;+*uLzPXAK0`Z?+y+;2#A6&6w z-SoH=Ooigy^r!)IQ;fWLJvgpd4d!=>bJBzHtWykv;;_@hhbw;q_m*Pa^!Oai*NSt} zgXp?&04W={!$9iohn0bnG(wBa)1WYIa$LIZSRSbgSu(J!}eK?M@ zZ@2yc?peiJcG2nsru#ijo?W{@zuKj7PVK^8aNp?hYV`r<1&&@Q^8!I}ILYe!!c%S~WbC6LE_dj`zL7&&e_O&6wK2)r^#cvd`mG1io?mD-v{@( zF3+Z1wz($OU+l^y?a~(9iHddemu_G#Qk;{W=`UlzjE|8Q?=P%RtH4~Jfa5;ZI~0SU zIE24w`m)^oM&s=CrT?wgI43(l4sL^DEq%3k>F4ii@yt6DHCbxxDV^sNQ6QRi&reE?>k&S~;k|Fv73oW5RgofPY&FY}{U zlJbhd4NV}A`p!yH-ePcO0(qPleH2W+&e_=SBQQ-mr`eC`YrmwGrz1W*EW6mqyAVu2 zozvtoKgKIY2*iI*{x=m|RRVd;k6V+JcOSUNl90D8NqO&p`#6C-+OIiDdERRHA3i)R zJ8Sl1{`LYhROf8+V-}c2I;Y8F`tAbrsLt8QYXtL_&S~ z{5@SUN}Qv=oC_{L33-<$DX#+DoCNZGNYu?>)+&zLIO*E}=Jf>f*slHq%)uCW@$Kqq z;5yXcJtz3^;5gi_zsr54S15)Y4?B+Io~d!1eZROC+)Bkd`6=^lZIbey2iKTD9^08u z!5r2(8$Uf^DSmeyA0AHWqu&>T8LD$O@@9cqq;p#TfU(`B7{)6On{^1r`&*53@|VZJ zt=Hq#${X|T9WV!U&PES!E$SD1c(~c67Z|_J*~q&ROr_3g>0^Dh63nAIXCto>%v(CA z$rJU9VuT|2&&hs=!L_-;U0)yWKOIaz#gTTBHyX^u1oBvZtHInDBQL)Ea-4E6n8y-u z9RF@q41(gYE5ANm*#hpf7=H*7oWeZ|2BYmIRQt1 z*{v7^#bM_MY!{m1ID5N%4X#3 zWj|sqn2kDTBkuz+`*co|N55}(Q*!zq1Fo}To%E%=K1s^+gBzJZ9_?2N##Ee}pWX-N zu>|r&y8vcqj68ck{S3_42{=9{(k`sqFJ2z)k`c$*`{~Kxx+>Pq&I6K^Hym790(tcN zYm<~$3vOisdBRVVl(!Mw_5||i2m8RJ{94-DvWt!1cLtNAbDG~XeSR>P>YRg>j@t>2v4}x2pKpw|=uY&nl=WNo~4CaUxiS_LYrkBpy$Quo2qR!dqTdkNx`mO|b zPXc+Y51vm_UL&}-l8|>GNqIkkYrj&n-`q*#gX1Hb;hl{Lb^&uq3|COlP2<>3U#^(Q z-396K9Ocadw=97?au0)fF#&fRxc3zk6ED@snj1Og;riu%aL3*v^_A<01$DCjm$e`Q zk~;-VU&WCYdI&#g;W%Cx1!is%+zntJP@F86u#1+yb0Mz|%$JIDOW$EIC*Ladu+pc= zqaNMCj8vSPyfQE~x;!m^nICt8S*tip4~=8H`l@0O6o-@j-UauSVl6#1JF`A$dmGjf z@!?@{n!cywS~oC573Ze!STKuqd72(<7j9Jy5KXQKrvoi_qdoU;7CDZ37uP>MhNpLrU`F#Se6zSUu=Ct3) zc-h}~(&Gj&zf+u3`dGibrWgdp;Uw=va6c!I$9m$--^#QpaY!G=A2#{X1>69|I;C$3 zgv=Md2J?>MNZZL{d%jOG2#UjwV|n{I36AoPy+^kT z+Fz}FupD&-SFBhoeHwQ*xJ$v*Do)N5#<%A=;MRlrtK!`1@h`xn-z(E-#XF(05+bal z+zPb>mUz&A(ek$dm$M*il9I>qoSps1Jq6~Q1e_0C(S4AI4-Y4QVfnZT%wH7eR6c|s zt;Rk^e0W&;YI=~H1SXh(qkhX3LwP*x+N~uxzXDwP{W4yWj`aBcDYfz< z_9)It52o)M#ULmSyY#XB`7sG@47k=0V!jw39-Jo?`K$R0GAzt`u#S@`c%oY z^w9jC?Z;s-M?ECtwK%Q)I1}8dUwSU5{7esP89WzSB7^eeAa%@vyWBg5t1CAM44BlHmBBlVM44{QZFPBsk{Bq9i!_ z^ZiM1J-|Jg1jqj0r%7<9f;;keHuj@m;acQi`pyB@N3oV)Y5CC;+yF3(73b8iBlj|x zpOWDEJ%aULe0aFYs|Ry93GR|Lc<&oNG4ix>RDg>wg84~tQs2@#ecVW{-J>XP`0#M! zhJsm{1ovAo?FN!F)ScF(QHZ?-$iqnmo=kTw*6ra4iG=EO0}?RVg;M zU(&*{oZkxO5ydILQvIeDj`K86f_X6k$9NmTG%1eOX{ird9mHM=*Vo;D&;!QkstJUdenh=JC=*{Q*s}I`ATtadbE84&+FpD!;QNb%mkg&^k9C>1M?fjx#{r`m<_R9 zoE|K1o4~x5fMdM7!2GBrfmOsjP=UTGK9 z<63>id^-}1FNTZsPh0$e<@_u#{S{}$tI4BXCV^S5I5&Oo22-cY)AF}J&e7= zbOX~jhKtvO`5OQ;CILr1CV;s?ac+A22Fy!}v+SbjQ3QE^0pt5)Vm;0Rb8!q8uLsj- zfSIniRQ&B!-`@sigW}xu*a2pL5?tz^Fi(RI4<~&&Ug!_zUd6fj-x@G4#BlNY(oeU5 z`Lp8O^!O*3qo0!LbK}kgGf;6(dW=K7Q^0IioSPo6f%$6;7q17$@n3++d|IZ@8pqp| zqk&*%D$Y%h>%sg^ah4vMJlbzFm|cof^<-TANA9m+4l2$q-VV>S@^r(8ha1-y%w)y6 zrEe*iRf=;<-veNtQJh=6uYmcd&S~YcE7QIn>$UjsQ1RN|#^*9bpFU48u z)9lRg`DifLDbCH#%fZ|o%f;E5JOXCB;w(FB{!DHkn4?~D&yNM*a=<*OIH`wyfASMV0cAELI9n43H zbIXsf!JM#Bv$KsJIbeq9oR%MR5bs1VZ!6ACj}O6o6~o2r!Tk6UOj?~xpUU63e50L@ z26KVp-11`tm<2kg>9HR2?f_F#A04lKevAe)Erzq#qY6xQ0*-o^VAd+m$~P^2e*o72 zX7;AU>AM=tuVXm-^sNH(Py&wWdjiZ(#aZdI@t4oQbZC(2v+_gJgY&G}UsST0Tv_H#yp znWH!>UK=~#4CYUYbJL>{Oq0%O`EeHFZ3ffz<-~gAff*3X#p%KP7z*a{1RV3@N-(D4 z-1N8)OoQSqyJ&ix0eK&TX}cw{9_e7RV!1dyn7(dchAA!;e>;s=uLg6k;@tH3Bbav; z=cdOuU^+G?*5hzr_Mft#o zhf_Vy^j!#MqT<}rcRQG873Y?|SHT=moRvP!Ul^}<8|GQ@;o(+(i@{tP%f;E5em@b+ ztOOkWY9W|=6z8VLlVILaoSPnBgX#QAVm-Qo=@ZMv>A`#(0A{S>+|oA-%&kdqkAT^( zI43<=e)oa-)%L`CWP&+6mW$Ja_2~s*hAGa9SMyWm$80dSDb7vbHDGq=oaR@Y|JwuR z%pK8s*!LrH!4$=C_U-gwFqb9ZsK+EQ%N6IQ$K7D+6ld8*(_<0jeF)~#R}9Md-r%o4>}>9g^x z+rVs4oRghTgS>aa98#QHJ=E%TJU50952yN+^^gzD*$Fu6aRHdi6ldw7*?ADSnP8rc zk!SDE4Pf4j;q2}FF_?cO;F!Mez;t>;>T9LX#?I%08Ll`dJ1>R2Ibgn3oV1_49?f8m zdDGp_tS3(f(_L|H=_>{^H3{xoF!w9YNsqrG-i_pTMyJnSkH^4ljN#(*gL-TO^MT^r z^f&V+rD&2Bt}IZu#*onD%c+>uayaF<`nV&MkfUV9Ju26O&9(do0#k4wM|kKyd~xE#zJ#kuKG3+B-zxEH~EtT-no*~9s{#cac+9N1?D?j4vA6+_eUJ@o=jWhTtRxNYWE{&JRWkLlH_udi*E{-WZt;ibj>{QdpK!-k8f$4?Jd%$+$tSTS?_jEalO z3g<02Z}g0c8O1ZlPncdYsgHhQbjA2-qsC9Ks)$!_{LGoNkjjd(%HZ6oGq1E&%wpzM zObpJNYs-|CmIg)?4j)ujIQ-JV{mKGE1`O~I9?++|jefIdPY;f-oK{vjeqP0-vdMFy zLfOo!851hzR`!9EG9hMo;i%%W{=*7Oip%;9898`_W<8j&Ux|KlNT6siZWw-=kB)Hw zp9XwtJt^GZ=jnIRxRI5JW8Bo4lV^=9sj8ehaa>99umQ#61`R45J$PJT@R;F6gUXQ8 z!-@xw7>E2B$7X-x6sTV@ecZ&^v&T)SnmT<_^x1PNMGkkHG+r>iV0H@MX;hzuM2W>bMq_V z5*4%hbkDDxJ$Ke@q)h!;Rar50=7jMxCrz%H*r&S(7bipLInyiVRZKr;>ZCqB&a24n zJ~@9j5?c|RdNn+D*35He%$kJA@+CCBa^Z{_6~Va+&lx{``mFhIuE|FutS(AM; zDke=G@00ge`YJ1C27Oa!;@`aS)2B}I!8Gt1$gFg{WfIamy86mkX1jpdH+^1f!#sK)Gn8*r_!dLsR9yTbn}FAd07lKiOmDy}6nOhU zeqFHrd38NfjGE2a4JEa8RqfZMoL49Q+DlQjb>7<|m$@j=7CZGI)=X)D=$=OHwyJh{ z#CtXv)rVP~&OOTr7j`l7>*t+im|KMmd>gfOL7!1m*TtyWv&RS-hvY4|Pb64iJBstR z8I46*KE_*|SC_XlZ=1ZpS-^65E+V!Uc>xzz&v1>-3`;9ZsfdX z)E{mW$glU_up2V`FEq=eT}l3C@3NKX&KTyK#+!flo12ZCO-BCKd2LF}ADfN{gnMTM z@_!0=`~GCq9t`&Jo7bfo`QHUI4D&USexqiK4=1X=^qa?*nElfOIh*|ThuZkn<-9t7 zsI5QLKMkMslKdaN%Q_=2fBokmUY7#QLlGo=WIKOoFcd-_@W1Q;RLeDL{}JrG!Z6=5 zB6rj@;_@|FaI6O8=|57c{^}21m$vVBR1E10n9YHlpZ)dCZT$IP&by4sJz3r#m1Nwi zbgBBAKj%wfKOt1a89XI%d`-Oq=1xCS9)hx~sjlnM*ydJrK)6sngI z%4th?{0^bz;_8Jkt0_WPA|%hPLa2-29!E$@`2Zp5OP?SVkcBjSqYr{aNk~JWx46f! zKO5_Jqv3NSmDlAOW=A+4%XYy0Dv;CQfAI|eEm{2MH(w5zhyCB}HR``lHOx&${oYHA z)^8a3fA`+-Gh+0=Ah}yo{rO*bmvuwO$uM7`Grqac$f-B--%W^bCm=1^zvvg>Itv(B$76?!(@bpSkjK)OHw8}G8~ z02tFg>=}s}*GtUTiQqQ6NBGFr{t%*9WrJ7td4<$M_zRM@)yUb7lm*Pc`s;s8rTVZ_ zp!FUYW!`ju{;puD5w7(4!`JyHdppxJsQkN;_~_`z8|DcpngJ7$ijvq?7^4J#!vlMw zwD$DlW7IVEguJSHf6f<3BN7*#sHSTJ(?0DPX#EL`-hikmi=be5^qwRlj6}wWL=kOd zF8R&B1oA%*p6HTEp)2D`N6qG3Q7|qq99PzmSBF{}m9wZMT54!nSmgf?!z>pI$L1=O zbo(|i^LSA_x*#MA&j5tZ5UzeFLbCAu5urZf++VD#Y4ApQ^>l>f)qx1fIEEo42&ues+lJ@uc1_yslhMOOT%u~E}m zwfG7nJltm`Y6TpnAX2Fp2#Jl)24&*eWQg6#jeI8Zo8YL}8n2=S|P@rs3 z^`5BUgKSiSs!<7^$FNL~Y!y^`21_F$JzJ0-;P7OXo~E&e`K?j^SzDv^cPtraCW>FE z@n_M@m>;rq+B!Zm0kxAqg#1FYu)r`M&sqYdTiS!ND`HxNT3nP47q&u=Bh*JY+-nF) z_dXKYCEI}$tR>tg(N^eU%e{*bx^Bdg1v1P7f&7=f%c>DCs&Mc8 z69S>abfd8_ll@asS8PeW(9<;7FdGe&&RnBrtJlbXdA|2qK89$Z50zh!mS&$3E=du1 zfFS(;T_bc|I(wC&nVE*UONq+IEtGcjZd!Myduq?bBa;_LtD{CF9#1F_bz*$ zf%;F{M%oY6fEukE*oFq!h4q`4_|2JUC{AHzkjwvi@&XFU2f-fR&M*TzehI4)G&(4@ z`5#oF{YCG<(tr&hi*+emL4UYEn%2$U+AJvO4^^Q6-kr6MiLBXNZZ$bqTrP{>3X#n# z3UOU#+cw&z)t3Za_%31~(yO6_VAs$tn(KM!H-^^x6DK(V@vL*1qVB zh)BqdX05`P9eq|wU{{XA1z*5S!EgbiH^V$^n8VV9rUCSqLItRJ+Zkp*3^mZxF-y~y zT;0)AHNr4EELn&^Cw9548lF<#M6p=1pra>vz#l>pL1$zj%vzYvb5%#N%$Nn@kKorv zXdnnt?l$|%P__{)384_RGeQOFEH`Bhd>*c+)a-vrYR~^)mD;@jRjKWvr4~+$s@}-i z4ZjPR@F3MO38&^qIo8SWp)@&dVENF0$DK@S_@vvB8u++NdOO>s_usi!>B^$1#-g$I zIl(5r{}1=HwBa#>NWZx&VE&yI5nH}=)R@L|s{L7P)ih{LmVQDz)-2{^(&vUbAM;58 zvrE9N%=G6UoZrPToBTCDdpReS!_j%D663D74f9n|w{1!7=GnK30`kA|F8dn;=0A;^ zSJC|ceO?>G{Cm@>=m&G4D#o9I{QdIm5&m%MuZ;Y?=oRdZ>J?bxL(|Y7*cvboiCFq> zNxc{?C{l5bVdBdg zh+!k@8yy+Ol)$wy?C%Q=z!;zm z-3CmEnEkUut&Q-gTnrCo6NEnbs8aluEp9XW&kprNC*@otG%I~_!q9VISIs;=GMF(!n4!dpQP$ua?HL-M#wPg3%d9J=(5ka(%>|L3cUePU zq*zYDO+!ew>kF;WQwYhnX^R!oJG6aejipVc43%fi8_RK{QB$8L+IFsmx3tX3nfYZ3 zh&A&Xoce`kHv5-``enn|V_@uDaWhT70DqN6{<>oYqY4k2qE7rbXTxHoMrH^{L4Gmv zxYr83jgV}JKeIx5))d-iO=+U6u`(@J&ot{wsdZ(b91*eEX{qk$pT0s4Sqjj5N4XKb zE>Ui(Dz(haM)HNhG0ZT`{wEose)!}Vp=l@q{X_|A&fEohxL8?s* zp?buLQSkc6nSKa2SS6s8C14Co04kMhP#`!Vc|}73QXtE~5`<)b;T9{T8}$-fqYjp5 z-Ocbl#%osf!FfH+6b4RNrV!P~0AHvds*lm|TvbKbm}Wrca+)SG`WFK|VF}KYNqNdN zqhXH7nWRj^(VR3*8A8$~stTUFfsNvRZ+*YCnnNj7KEp&!w!JysI(;Nhw^yf2(ZV#QbGB!r>=+@JF+>vG zZka1B5q6AtG0bIIktM`e$bkd;1Zb1dyi|>*Y2>g_+CwJCn!Ys59}M$r zBnC4}vg$%W)@aYM{fQ)7BooB}!%KQR>^qL*_374lovA!kq_PAdIo~qM3Qa^vraVD< zrzfA@n_0n1hYSx{5DAQl1e6kM0L3WrL;@vF7D|-jwn3sYy3`6yKu9Xa)=h?JqZY+b zX+`{^B_CK$tIk{@4ga21WK4TMh{^wk9Eg{BPy4n+BpW+1i_;Pj>cxFk14U~dJ4*dWr#WIkB7e&qmvET?Z`vU_C8o7u){bCFWxv1bT_b|9&Crz z_2$yF6@K$q#>B$ZzBSk6rh9_zx3C|7UR_g*xm?p zipA4(JpOE@{xGE18s4H^&mn^`atLI}CQK}bzQw-_L^6ypU*;zOd142}+dd)g;12$?#U0$EdXc#LK0+ySDo7iW zeIrP{r}mXR8yb<7K2j_(aAxB6)l4pC=wYr6^l2?p<`DnTgJzL6MF%L&;z>Bh#Nk<~aBW1Q+Y_xW?M z$6&XSzsY-jYgjZ8nv`XfgtIWleVa4nr2%tcrcv`sJ0t(S`N%0O>NZAZFAmM`f{6?4 z!TBD`1DLxwWQcB}kR2Y9g6$sOWltj|O&yG9MU;%R^)^;9Dvv^oGKYjyF9?JtqVu;O zMcyCojj4_1cJs~;n5QENGApqvc7%6*5l0ZOPX79_ylsfK+vL!Z{YyCd-X7taPQwho z?H%Ovw($-ll!ws?J7)!SZ6kmtyp-LvF*IG_6=iB#UhR{(3(1#r8FdKBxeUgzLioa0 z*0~-qot(?K2qC#NyN(M=w0_L$N~x$y{~Ewh14|G^NCw8)C>ofRIs|cn@El)p-alHF z7DPAMnxR4=XMZkkounjmZXh%hJ6mSv>gyyXc(G3M6ay~nBrjyGqUe~V5}z3O(GhaR zQi*{|V>RU@Tq?d5VD{-uIER7BG%S;>q3oK?rB+>FEt8bviX02I zpEWslX-XImy$Y9S#vP^G6gn^v;2oCRtCy#A7+5)+}Nl*OO zl20x(uT}XTz zs|*!@I7KQ6W=UEg+~X%9Eq`HVB`TQ0bia8Lm;I_HHMPonf62luPw*INo%{uvl~@2O zu!z3gQHIIZ51Y^{$L^RwR=Ff=4mAh+u&9^Q7%22=+S)wAFo$9_X?ycdBP5!f78O}n z$a>+5%g3q(JFenZi1L35La&Mz;4FmB5FvK_<19yO*4YC>5-pJ~ z@)tY&s=s&xgdsD^$lGj$mS)xAjF?V3%y|=3FhyCp#d*y|oNU5Eav-!2YrmIbl{G&Q zT9k$lf{QR~y2$rzI&Kw~4}=zA$k*Bk;rwD$dW#FZqwDhOycq)we8%821@op00-=o? zaLe*#jMJO3Y>)ifFTeP#4+y3ZU%T+txQx^IY*@tG2tsSO;$%^1gAyGX@qafS^}gQo!q6O>tlrP7H3|>9iAo(?qL%cfVHv_=6?ubwvuD`@cJdZl>c>b zxS?cY;^Q^%?I?Zd*7^dW>)>vKM5Nt~{Owg)jM01-JzgW!-@0@>E?M_9r5d5Zu*agF z1qWYl6+FG>)1M48fEbbR<7EQSgto+h?R)@Jf@tPs51im}MtEtKOj`@PBBFnWU!)N$ zv4uz^HVGmnXfkgS`D*0JR*n^K8cbkRZ>D)!_m-jFrJomJ6(`j*9w9j+MT>6`o}7X{ zPaE0iF>lNTV0qSE(zDDPvvC%~=X7y})6jRuT&b>K61j~#C)91>8?CcxIJ-*R5-|Vb z4~#~;OC3sQ~N zKhUSSXiyYdd@NQFXd9z(fDeN&IO}3Wz8H}&?umL)&2P074)%L6=sD_1xfcY^lGfDP zZ+>Tl=0oIsBy@4Fzej;%VQVCg^5XIAo2 zHKUVrw`kE(fr)Jg%+obd{pw@axb>=ivgmS)q3Bi1UUpQkTAtW(E_56xJc3g|qeN&4 zLYIors|cMZvhY2Gqz`?D&~f4%x1!xELgygVLxf5ZlKt?pJSU_~KuGq(s}Pd?@LGgq zKb+eiWIy~4gk-n3AkwckYu6yUnmriN1y87Xn1B3inBf)prfUi%S;Jr6&=sfd5lLXB zh&dXJfn&RF$c5c`2hrF~sofczZn;H@5qeU{3q8p`MCi%Y6drn#ap7y7{9@IHzv|@I zR(?g?uX?#W`G)*r-8MP&&O}H$-3){#h^sA5QanX^$gwpQQ{WyY@e3&U%?;`HF4Icrs<*swiTn##(C|H z#(Iujo6dT+18=}`uh>X;IBIkm9)MwI{ru6`k9I98VU>a09`uF*w}a-PD`1hAvC}S7 z?5@Ygr0puU%jk3kVjzN@TyoYPCXxfg_$~BLL%cLrDm+RK`8psZjm5!x2znQyW67x_ zJg5TO@vr(os8t};Hw}A^d0w2uHPlb3`_=_h$HUW*AJ|SL{tJT7EQSVN_}kLvPuSjaMlp z$N_xPN7* zGp$JgWZJIzRTy!iGal(`AHqgQHgVi9h|Uj$W9VRQ%`0M`5;J=|E5@5AM~ySNTR|>E za_a*2;C+Hjgt;(owAR^cxVC6*Yz!=83kKG4$Yrq)PD{n zvS1pq2sWs}BG{3Lu{`<UU8$kBRi$c|RBZvZ?w!Hd&gg~+(#8;jCl8s&U9{goAR`17` z6kg4W3K%=2_{x-D*&^cVL%0?QRdX!RSltuN#2)#z7hf>setb2s z^PDEy>2!pS6`^kt`jrUfB25`0B!;k}l47;t6aBWx4k8o?%&Z=;l8xs9H=)?nN4inr zE6{Eo421H~aY6aUWF7y@j@na%jicDD%AKQ=8w)a1*sdDkk-kWchW#ufbB*v|*%{_v z7*z}|6^$+bnvK6^NB+8f1(I)sf6cGRxnHltAE-1UwM8IY%QGcm)Wl|nKPTPT5P90k z`0nqq4;Kj;X6;t+p&R(W_nF!q_*#Ag|F@KGYu3IY5dI$sJ;VMbzV^s33Ng%k_?MA$ z53ivnZ{^>}oWgMl>-33!?z84IUf5~Kt^w{)HG1d5BHlp=jg=jAGjf3>80{h*&AK>F zyGW0)E?%KsWNum)C&XNg-leCub;&fMmhy>vjzqL2+C4U##7cqTo|a8wYFgToHrtXG zd!@R5MYLkpe7G-iHVuK(gh}NC7 zc9`f1gq}Tw48@lRgGEs@pr(a^pns^H6qt&=M4Oas^@m#c;EmFA;E637S z%v16|*lC>*d$R!}8Q~FGa?cNE1Vvvm1Dm_%99i>oN);C5Gn$8`t%&Sic99x1adEB}LN|(YT&XD*pSG95GmRS{QaCcbQeHQ-`A4oR@L7I2|5#m5Z?Q_>^yrJ0pdUn(Ew`lMZ|j!p zqi;bau{!#q9vO4py3^usX_{DOxOI_p@X$e(7R=1oL4vpIQ!;a7X6RQ_ zHg|jOX4fY-?;n1Qb+PJEAe>Kaiq7?>Utsi_k{&#+a06;hIL2}KANR>k7L&cRwoLX` z?n;|%c(1EB%#_K6-s|>T6XvDqC}Fo{E#VzCa+%O;cn8Qc0duKXlZ>?M@Tc3_AU-&&Gx3Z z^Jefw`Vb6CaDtn)F~uszwOiUjA6ztQFhkCSF&sV$sf7jcZ1?aqArHfFEM8#eNKY&U zM79lBC8)JwqO4$E!aJ{MVTNT6naqjU3>T+hLV4k)8S0b<|Cb-gNA+<){`5M46nYDr-oGSgA-? zgrp+52+2gt1yL3RJYga8AM%<1!VQcxZ$>LE$Hep!S4-L8OUY+glFvry7GaM6gyh?W z5La4w{k?ACTel6t}ekTZ&&erII4Hn4_IPlUB!naMQ0}$ z^SrsL^1~vjto%wbAu8Nf-{Q1lvUf2i%GgUNU`vnDt{hsS3dU=+V(PMjM0MHuu_c45 zaxtD-Oh)FC+SU5WNY1jQ;C0H)}okPr&h;D9-Al>k4>OVr5MfSY3Lv% zxE@tu9Y()#E7TRX!E38(Z^R$fVv_@gD~p3uw=Ao}88oOvdP@6+Z?G`_;%qS!SqV=o>nFpHn%$VEi9<5|{Z zGRPvoS`_MD2t6V~Ed2M2&|HM>5LtE$LbAyJ4xvZIRrXqBC}Nuq;=u|Lv1pv-9W7Va z;11`j*{)X&+p8&DgGuLmhU9*rtx`OTu-qxn>~loqKJ)_hcugpg@n(l zm~+y^qc7+F;>TWun8@QU;t2z}%X|>h7BP%V+6E!NQaw?XrC+%N6cYPUus6hV2hoiF zr&z;mkAmT?MY=r=Y4~rDaEZ9ngY8etcjH77cPR?l`@yULDhzDVHn*3U1#)5+OC|EL z9O@!+QFabaMuhU|8}3?=hD%BqolS_)gvqC1T7+Sz8q!q9g-j$!IS`A|cS4_};-Yif z#U-C9iHa+#lE5Y`vm-Wn+PoO7r4To82qB-xiS7|u_u9TjM!w`KN=PRNk=bzizaXwa zyp={1C)3m-E@CG1l8fbdB@bQ^ zi2jMEo9L~15jtOaU*UdZVrk3%pP~-?k-_3zQMm8^qEJzXFB*;jFZa4cQc}$=7;My| z?_JtKo|PAIr6_zo&lH80b_kNMsb3=1G;0JIz42&iM|rb#g&UA=>nQJIulEEbLhgO& zi_nWA`6J>Ib}2^15#3pGE=0Q^+NqOJvo)7urLv9=gz68^nzs`B>kFITP))&h-6uJ| zmb)wh2+6`EiU%4Ayc(Cqn5Z0jE%G6$g zP;}9+S?EI>XxYWw&0SRf$bN~)6QB{GwJ<{imCqLb!abnU6T4WUZU~(qu14A`r=CE> zXW;7pZFTa0Dh(*T!U2%?st+Jz3ZT{DTO;s@kYjz#jFUC>nFvK^m;K$b6*TXbRdaH8 z$5y$#TUNF$ceCPHvJl-?f22(pZ4X{>bWN6TBg${H*=RjA+ld`rJ~fLoi;k>mj(K1f zi}L94vq5LQW7%Gn{Uc;)i>m5`3Ax`zcAi*EN^>k(nC1zh-j_yhAo6f@F*9ZJD3X}_ zOOwddpCOXOU~$jr{#p?ZkzqR?Y9?`EV(m6Mn0B zGa4&AE5;#x)W%&r2!U*J>468rcW14}?RXX{6VF0n>&+)+4UIKSsB>>S6Ia{7RZ~42 zS;~I*l?ZJWKEMI?ZV_5yg~ABkFV1mhQ1-UDY^D0$axnLQMm@sDsGnO#{hMV}8FDwO zC_m+zcSd=daE)d6b|FGs zVb|$0kyh)^^4LG+c*(lDC-$lom8jE^@H$5p9I}d+MZkTrwe&8zoQUX9&4pTH#~ZF= zZ?CKuWnCHN#@LtE@|**9p<-?GW^N-g!skl~-BtB^GZ*`fP~=Y~f0+SG;Fdl3TC&jR zi3|b4H}gW|)-@t6kz0o#$=%tq&gSL@tmJGiFB5j+k08l%lZTKjH|zw;%|(+D+9h(J z$_ibBklbc;J3=z2?nmeo!L75n?N%syK*bpwGLdAiXbBIIdx0?JBDV-3kSj2}S=WbG zj^H!I7u78q;uGUoB?%g;j)PBXb{r(jk@Bes$#kA&g{ZAO*V_sWMM(Cm_-+x|k>JdX z8iq#=DXE3rKk}wZ;WDuj9KKV2-OR73q>8`AI}###vu%mox*u^E;XCEm&HReKm483C z2LDBF-DQROz^UvkDV%D0cLV<7}$j6R?YqAR1b7_k|n&}N5tS5{U zTiW^Yc_&d9_D}t--~a` zT0&;|Q{sX*18cuJu$m_*g;&^>lARjKQwXE0LFEDe_Q}`G(5;lNFOS57V zj2M>77+O}ZX@sZ+6no+AZH3cZTcjCb_K|3*?3}@H*-%4yQRknyk#DmZ(?AaxEzVoT06QK zol4o4jovFFUfw`UucI;4(l)!Ub@&@y*KBlMbJb(~Wewup58A@^j*iGHxhTZCN$wV* zBhL}VXf#5yKwX8N$B6K@K*9-0;giaNqMuY}p?ju#`FhGR38UJo^$B_ut z3hsD>wu^HoBP3(vj}yo`<1U2cz5le%9Yjb<&VYl-f_x%EvxOACNSKOZdDY?)|)GuiWSo>0V7Pm0F#6`|hS^HAd z#nsUlt$iu#qW!)Ub@gUYwQCnKmx2}z9Vema5nOmgIuu}7bJZPH5%VO zj2f+#_og`rS(Q+6L1QtuKS%1b;&Db}ak;pwv3N=r0;)DE(JHgrn7XXC96}pwS&{J& zm07JQ#*MWsl01yYT9$O$a*Md8Fi~$c)~;^BSmhuevCVsOs8(DKmqcncvjj8yEF65s zBy6Q>WPxFdN>dfDNF`g0_YTxj9^M_@Zr(A5dApPs=9gfREVrm}J5$Y9Pm9}U;}0Vo z=2zr)X9cYU#=bKm7w?QnhkmkXunQpzVm?B$AdW*w7Q~4N$%4oxRu;tf5t4=OD}-cG z`w1Z_kNfEUEL?=o$4JTD5Ly9;P4&z`C?rC+BBa{Ph_zD0{s%Re#>rdGtBY4;VCgW! zV9mx=HB4U0d0fklu+v+;{}3flEx|IQr;C{WQ&?1LH%0k$vWbbhJ=qlgq6uwbK)Lkj zlUC!D?{S8iCd!nUTHDHbDSz`Gel;YU3M;!@tsa?8+AaK)?}@=ejVc}{N`hm)VkU~y zTUUv^B`oxwWWg1HR|TJpUE%(%q05^+cXwUKB9r#J%ygE1$>{PmR55 znD2>%i#NXhmUmlkiO27Vc$YoIQ|4<%%{Dyn^XmN0;`cOO#xLREXK?V^*ZIG~8%gjI z#eJA3vU}+(#N!c4?0&*T{2>w1FMR1M-VD1{+=mDAx#4?^*p?>Vdcclh?8a~BUnm*_ zHRP`AH3-R_*!2j>M*|NdB%4q+tII_0T!4^j=wNpKD8(qX^Ch~+%blw7#ja=_X5$3{ z27AfyN%>R(C+pbqS1$^1rY=~?t+pm!BESwU&cn2rd~4alhpjJoC2RA0=r~CM2*~IE zkCV^n!?O#;8fX8Wyd5tek`LNPZO~gsvDKTG;7dG0*4QuLJo$DEDA|#@5Fs|aatq$K zBD4VK?iZm)5Rx5$9SF&Zw)dSM1AzyG2XBO+fO(N& zUWIn37k-&S{9aB@qf!4;EBta&D}Vl8?+woYGDNQuX1&D7|EG7^M>vHyS@FR!^-khC zzLWUFCcIeqB=o#LfO~$x#cVj^dy)6v#{7tfk^iB08Q1jn$0+doOW1wtS5NzipJ2iZ ze&E^Rll}l4$(7F?;31HFL1Ca*AhL$dZXpB%Sg?Qdg5>(jAv%i#G@MV=Wh)j<2Tbeqo95#Ok}(f zp6O$?QVoMEv+)xUsEgsqc;921#6n{suV1e4 z9UeG6qT*LXA}4wvQGES!iBDt;iR;A|ZXXgbFW@Vxih3^USe1>}gf2j0e1NG2AyZVjE36P} z6nSo)6{0Em#73%zI$SD3B?z62fl;c5zl$axR=OIYGI8}jgyhWBvk1vYl$sEd?%(puCnTAV$|R z|6{vf|1{-cc!5=90)sC}VfLe`DRq@+1z(QXquQ);OwK^*6K&-X5mL{V}2t% z;0W0NEa4wr5&Bk~n_}fVpK_7i0?s|i?o!mtD01b?D2}SB$o&}uHf0jDg_k#+gcw%J zZh~x+)Fi!6>@t(@{La5LGk5}QglROqPg#si#Uxr;W)&WWjonISb;$w7>{m&}oRT*kqyH%d0UBoUtxvSb5n#d#^Y)AOw z%H`8V=mef;m{^3spgWlzLozXVc_%GCMWjYOG>pC-$|^c_k(qt*t|_@aXQY)R-lFR& z@>JxcRFYk7dnMCxMf%ohHgaM&{onloEIUMCp zs}ZZc-H*Z*xn9WfDRba#g!D8<%8Xb?f?HMBQ~Bs6Of^DP{#1vnkwI&0iC~Ps5>{cG zBNvs--{0_r>){K>Bs^(9>2!Zh2C`ZtugtK;qj&) zMVI$x80k3a6Tt$XcYPbyRg*)7xmya)^AvK}i#Y>~L!aaFi+UJWM1X+Q zG;TXxCQUxltCESg23upen$1(3pG0hj1jxY~*R|xt-$e+Opc|a(8GsPCC8T=TwU!}H z7Rb<*R_F$Vt`m)qiO~CEsPQsFvZdf;%-_VhHxZg325285BnNpvAf)ER!?CYQRgXyj z|IH!qGi}a8ik26ix1})ee@9-GT6x79Qs$KmF|TBZc_l;K&?G}E5Lzs9?RJD@uDy@#UlmaxMGWQsBZNBjp9<2Suh0%ZPfxwKp44$g-2&Qg*Ui z%1-uCEITMsxn`RJgz&C4l&2zuP@amm6!wplAB^6z#Tb~2VbYP0MrgP&&dCT35UOTb zp&W#c#3$8rz7;C4LW8W(NGrr$Ve$@co9r!&Gan&o9PWbuFIM?0)FK6l;45!N0o67T zhT6uK!hs3Y9%ZTB-%?wKs5V<+skRIiSm&s=JU7}3aZOvEqwicK)Lw*;R68RMbS8&WfHO84E zp1ehPFz3j6HaPwaWIMzl9T3@}LY%OaWvv(?xuK@Sx;k8i+IZ$5q{`ZVTiT`XFzqtr zly-TQX=f-V?UBK9D?BeQ*7D`6vLpSHP%FMTlkWlTn{M5(tlX^|N@FJH|g{brLtTpIn0qDGvP;D!8nM+`R#^xOwCcpP1# z2QJF&4_5 ze2z6IwZEn?t$73Fc?@q+eZ$h77&x+C7dnd#2~xMH4xG8$`wZri{CJcOZ)V@Xc(H{} z?z+QbDCc4emNsKLOq5ME6%aKI)*IsggF+ouaJ;aA9XY(E2CEaCJ1OOc3BJ!3Jv;eE zTdXP2sc{Nk%nqM;qXjycqT}eplhm-q&R}P}{uWzJGUc!9g^iT`-X{m9d6(8gd~IFT zKWT$(E>8IHBd^PFawBag_dd2fSkfxq{Y7xRh ze>rp#j>9(OH9_hN{ePA0|Jk}gnfE_$>zXg{2!oZM-j@s?<_l7=*P-SxrUthLJIIvO zY#yVwDlo*}7k5midQL}3&OUJ-D)R6JYJa?&HwTqEes(2Xh}S*X{fBH8uLZ~yj}VR& zTf@WCvz}G&`jRhN#;SFpiD!hby;3aW&4Wi7y?S|Txo7U#a;5_xjM;V>p<*D|Rk;;^ zi`UViw4t6}kd3_?RYw`&1-VUlH=bBPIf(mwK5H?&OHb*@zR^Iga_@NE?XPq?UL^B;Is% zZu?=lh#_OfAfI*~ZzdDx3(ylR@Sz*nuhcBa4)q(uUqSfD2%REkN*7yE;qC0G7a|XZ zGgUbAWz3l`apt3#Gaup1>oI5WSV76gm@^x3W^K%wwN|7n#7on}W@lmF$Y$q7_(d%7 zyJdKjSJdcqhXJZw6moW+s>L@%<9Yen)$ zKvavQ{j{0&vob#1!D%*8y>akxq)4->-f$(;@roSI@SdZzdt}eT?uy|kZH#sWzg#4{ zH2a>1zHnH7x?i-(sMx*8X)L3oHER&d)|=+GHEMoHt31|^U%bd^F!CF`*NdICt>15Y z-+Fs@XD*MR5v;xc9fbj4f6H zb3cAv4X;MuJwMH8{XV|u9fISbvM5eBa(1Cx)XNC>ep%2t-y5wDr%|X@R1i{BbD_tQuq}nKA6B?Nh{|H{}`5yZiYEB-KhU->!^NPq3R%_ zL%1(Z{N((ps5@nfQ!Y;zJGla(Du|Qsob8EUQgZAvirdtdEtVKL%-w;I+@AG`6*`2F z{2{D#WP`kVmKEZng}izlLehiRA|(5UPa|}j@Hl#g-0sD9tT${zCPiv6trs8tdUWvu zf4syW%Eflz(V-563i00e!gTQhYuSnamu~&n`tV{*iTr|Ni{<;8YdWNRstOMlb;xWL zya+oxIvAoKIt9OmRdp7h8^MbvHlQl-pjqfOq9e-0rXz|vT0b_}G5z$Sj>lG^aPSe- z|N5Vg*-?S0yNgO`HbV0EURY^fD9+vZ|JZvI_^PU_ZT#fs5<&>vgfS?>MNxyG#t<}s z)f>he2^tiXI*~vUgEGYAMo?P;LxgyVrA}>MYm3%aJHAv~saiD*GB_gEq1IX)-d4o6 zXf3tY%J)2LoxRVwLqfFe_x}IC-*EIy{{k8#Np=^IzVGFS zK;|`vvwiPUltw%5vB%2SA^KbBf0xtN&XP&XX;?bhJdU1vZPU?j){WYu8Jco7 zjyGW)ZNt3hj!C5wi$B;b5a6y!j&}dQnC!_yemAA}o)$gnI`5G5cMGG0JdzUfSW3v| zl#p#2(()b_F;$qBySEcfoAOVyO}9)Qh@8j28%tDz&XGWF?&=2jb(Z_#WNtL|khfCS zpC2r1z&5w58(3J|7e--^~UYuf+Ca- zzBHpe%!kTCzAQJ6Gd>UPjArfx$|E|42wLUh8;gI@t^3R`r;ne5_WVAa*?&&B`CE9Q zRzY<9vh3JmyzCxM{>^nK)OiPSNnD4XLUgZCCGF|!GpzMDE8d94FM#{8_T_MoJ|uwq z=xf6RzHJ$}WPM_ca~|7@=E;)}4FoJm^-g?!`a$clKUy@zKCPrqhs#i>%Xvsx-+Ue# z3(rSe-u%QQJaR*7!s8$kRfb*k%xD|CxRdj!$3=Mij7d3kdhOY>Pjjh}rrl*W?f$pp zXZ4-Ox2?bjL-;xeUFryA_})&3Aer;>+D3Z*PDM|5%1|OXGY0@tH4-3dS~=+`x4($5xrth zsWlGo*_P_5VsuA2j(x@^w&BZ;!MUc`f*^&B-p6ZjQ107M3!vz@rKXeIItCi+VPqvh znhv)Dskvy(`D!0I%)m1jFDg2$sW`0+rbgrFNVE9UGm@1$tUc*UT|!p+48{~%6F48F z#&9}9joARCRcUf@M5|77k$blGzpE5;^^XCV^2!wiRIk71>RGrqfu-0KhQ zn9LDW?7W<;CwFJEiH6#!)BeCjtHh#CmFRgD&V9h^!rjf_U1>7hS0h4)p40_ZVjXJ7 zu4=`I)nc*Lf?WmKeb)y;+GT#4@^(vuBNwP%ngnTywo4n~FhoywN7DZYC+_lk)f%SO#;58^q%!$3FVjpU)L zGSMTzo+u3C>q^G$!LiQ1{g54fgk#mXRzPLQh)&!dx?c8Cpv{NTfSQr@=d_Q^Vz*tk z13ty=fG^WLcRS!mvK??Rog&)-G444-PsXcgyA1Ka6K$JUFf+a#c^6{`S)vV|B*@D; z`ix$CdHhAl7sr&hUyxC@Jy_zOTAA#&315k}>_->Y61@4=-OiXONu{)% zEN_hAI6ysXZsJ+ zF2d~&olJ$^>hzxjsnhoWsaxLz(#_W#I#Fj10@8sHUvIhnq1|XgB$n1vQ(EzIzB}^d z_PXK@Fz9rh&4cJGbYQ*F-ALypA20QB^or;dH4 zbE7R+N1SG;smG^-KjA?0mTe6>6nyw<57_5gHZ=uUh09((sO8}_0NV?k86V~VgIKlb6@$;SU5WT-27 z;?ND{W6bsQs`plc8m_L0?^0KzGWYWPH%D&Z?N!@W;)}DK=jM$)gxA65$_G%1Dur8^x*KIqBnpv z%ky{`^|;r+hL^t%0_*!H_30A7aebOlIYVJHhAzbJJ_)ta_LbiNM+Wqjii*j^J$=MLVYmUK9HBhCiKb^LZwBVu&@tmXfZg_XWbIfmWbC7wGA$=-J30S`<&+fA z0Mdvw%_D0u@68uWAZsAyX42fy>JO=?)_pjgiLV7RQ{zbG3$*SlVu#7=5e(Hg=Oom9 zp*5>SkV$Ij?R%HcXQ@On5@v*WW^T`Pm}l0hmwlW3I~eP#ZA=c`>?Z>;3HfKe)M81Q zYQ3b((_C$*HS9Q`wUSLLfV3j0w&-1pjzxCUjK>CyB2Ln2t$RO^*0nntvBDs}64Qy$62a!7bf;5j@fwX{&8c z-(g;6nhSDAKnESnKM_a=^ZA6=!Tjk!I+%X}kPhbaS+9fn^+4`$YaH)InTw3uP%!6$ zve`N{e%~u-n4u^+0c71#4Ld`lmjA+Eq~sl!Xzy{#{4w~@mN(9dcOXDdPkRukqWxIh z*U36OOqZh#V@?~IGV)89QeKH8ht^I-Xc=};w$IemxAQ_%ms{An5=2wl9%X6PBZio@ zuojg0gU6-)d;`9xtbLThq5Rg361r5T;c@rT4*mu|!&#K-C7+>G4MYG!Ow>sSr4`EN zPHBNuao)n7k>LJqExcz6!qh`-KVjH zt~y;-8n)AD-_q{%5!{d(fqHFwEBQSqOu1nb-Z*v39mC+{bWQ_N{P8<%>jaVE|)bpWk2GaAP_-y&Aj9jqoqiY|w0qN?`H-Yr9 zwNHTb%qTvSZxxO{Kze!+tTLPD1Hf%G`9l)Gc%i$KFviqYs;T#}0MPLx(!TZ<$ zuf&7#qW^q6h+{_kfPYgi-~(Ho#%O2Jf72=02 zNp3lyHts|QrctdHVQ5k4*CI|Wq?+cym+HU~AdaVCG;7}0qiyWmW;<0%*?52KVf;vn zy*$2oW_))AdSC737{=)+kMAjuKP5ziLETe?$ap=rNWF@89_E#WHfejcu61kZwhly% z6A{?1%<^dAQ~Y4{E$@fJOW_`T1rf-L-om!~&nHQt7!-PN_Q*mWF+KH#(1RFuU^C4$ zdg0iMw)TQBt;9J#+CySu+G=GLIZsaM;v9EkywUhCtW@?w4sO|H=Jh!YyV8lhy(4oodJUQMf#gHB_&JHeq1* z{h1Rt#|jf>eX~NFUYruzgeU5=I3P^Uq=Qm?OU+vxV?)nJ@(9|!oc%#+p%bkI;9rOY zZy4!LBr=Qw{XcR&e>}S;Xy#m*SGPX2iN||L^2_9f>b#F?LRZnbRMkBm-pQ6E4{gG0 zF=yo=2TBg@ZEw(`e_v$1I*UwiFuNgLDkWVGxTY=V`iKV2QD{2J3C73|Wse`ia>&qw znLJIVs7zL)ujS!!7<*gJMi#uWZsbZBA}>RSQ=b0zC61*d&>AgbLPg3t;HSsmJOsD8jG(? zK`o0I!-p#I@S7p@d>dK$_*vP_edE2ygHwhVFlQ#?q4;L%VK_*}-YT>*gjrZDpeMS- zV_5RldeA)tDE>Un2#d<=SE9CdVs&E=wf)i^kigRl<)D5_e8%E(OPoQIFV+GkXi4p}2`PM4H zy`W)kDB#?y@kQ`dACa6q zmrGlYD>C$y$-e?=pEd)nN$t~S18JZ3NFeRga;`%Aw8cQ$r{xiHZl5-3_3Ve5(KuMj zMXGQD>ZjXQA}-e*vL+9UL@LHl$&aG4?C3ou->%Bb&ug8MKOmN42Y(ZfbLE=1sSuUY zon~)ZC%;y`w-Iew(~+JM8Wp+EU;E?0YTT}fW4)@JO1?bw;Hm>?)UIER-t-S3+E6lN}bT^B}ne__B&~X z>CVw1c~Cn(xxzIfSB!X+Mi?SlQ-2(p!p;v5K2XP>IB5)=%g4>k+T#buL1No8%=L@#RQOj4Q1Z zZ;4qrz75{uUH>7b<)O!>g>^CmV+Cm@Gxq02+ zsm~tDv%zNHlveiHT2Ml(OFrQ)xr>?Mu^8w${4yMqDJaz1UkEZ~AjICHuu$tq{~)j2 zs?6T^E`Ir53@XK+#n^jq=z8z=p`C4$E4p=u`7~v?-!I6mWx6Bm>8D3C3!{}Dbn1aN zK)s;DmgHT6HrlY?+OWR>eO2o1-bhYuadPj4@_q|Qc|WpYYmjd>Y$uR*s@?`tj(nuI z-aQ9snMhs&n*y&q90iFbBnfF#8*UV2k&hg z_BV^TA4MhSTZCR%72F^V$ZUZ3L~DeyI<%p7gBzDY*ibw6G1pJ)&bGAQxYi%)o_ZU< zvC<#v&VQw+HP2GCr0^_-UMQHT6IOGS9fQA_p>_8Gd1JTKZAWVXKH*C<0IWlcJ6gjC z=7q!9dFmtg_qpfJw-*6xscqLt+FA>crk>z1et`|2ymVZ+h!i_oBW@sI6flJQ+go|h zC971jDvzul5EHn1^t{|gwQ4j#@7f(H_GuMw-wAq|n8G7#ceLGiul+V!o&IF{R^Gzt z@{G|QPVdIZFSU6`YgfvFop#y7>5K4#3i#MNcY$Bi#0E`g=hK(LP#u5daRuL(yx0u% z9T`n*0n+hDKBaW5@gtz`$z6^*J|!GXYehVjUPm3r0=+7CCj#kc=X@ZRv7p1T#x_Au z0=dUdnURPv-j<{(fE@tlG29$AhgqM9Lj#d7@s8N>(~BB=L^fsY&x{nK_B02iVGubI zdeA+qPuD%^S=5pM>DN6?hFMybECA9%D=rZwqw!U=QF;o}&#N-!W2}rY%#Fss!E%7< z6Xwo&(wmW&()wf~$70G(;zU6vH%SXY+rlE0aTOm^NnW zE|dpR4@+49z{DitvlZ=M(UCShY?Z#v9AvDW zTEup-3{_xE>nI4&5w%Nz+;KE^_Ss#Ow66LGV`#0kYybt8*Hwfj zb?~g_=Rev%;o#4iRCd@ zR*D1v5?TtqqN}!6GEd5Cgo&>(W6GkOo>z_YCco^;obcx$|@0RKaEfAbc2%nn5O`}Zfbz?_$HaJM8S)qOCyy9T#g)P#@ac|!>2en@sz^XGguf( zP5PF{zryzo=>a3Vjad!0(PFxM>!i!aH7OfmD{OZMc-jrY>XEPD2K#y&@XhXak?&mQ zb#j-bcwp3!_+Ev&et#|VdL;?Wf-L+--)mRwbnR)eT#FZMF)z|X-Eqn;DCL$>zlfu8 z5vYL-W+u<~v6&|Mhr1;r*%Ii5u<);N-*yEEA9q<-+% zhO9wQ8%9tYBHzn?`!X4x@w+yukZW@Ctb(gyF$Zl*%O`#s!*gSv=<^ve2Al`h<|o`7 zB10B0WA7E5vcoL!bdMWfftnr-H@Bwe5=8Nd&8GX_!Xg$polZ*b$*wQkv4)8XiWU2N zm+iQL8H+!>?ySG<=hgcQk-PLE&*}K7(r8@?q>uYMf%LekyMbPlyIdHjU9>*{>FVH< z5u1ih0lHM49u+_;`Aa}5j|*sYYw{;R3q>BA05=H7SwOn$s21oJxw{I;jSWaUx5H2u z-6b670<9OiOM&$6jrQ(sK)(_?tm$$kXW+L!$vDu~11<|XR|BcM>w)wbEUs%-dj~?k za`0#`ed1jLr0rx*=qpNIgsEEFXJdsvMYOt>nj6nYx5}31W3KgU7)X7Hu5l55*iP{8 z5L*!S=8aK*=oKck!5_NVgs%06{>g-H@Q41^gzoi+x?S$}#Ff1Jl(w@D^VvvP?JzSd z*hfSwCGTiu4+?2vJIq|if$l6HJG=ndJ>@D8(_!W!b1et9!^}#|6YL;gfDNC#PPn?DY9ye---xAjIAQ z((_r_FO;|P0Gu4($gIVlM3_$uIb<*LIBM@h-9FAqMzpbMFtYmKFC1iYoMu32Egjp? zfGxTdeK6Dg;_l;*%P@A?d?E7NLt%*-r&u+jYt&evDTtkjJErGxfQ745hm#}^LaCz@ zm!llpuypppK5&JzHaZ}(wgInF!`2Km&lugjtz~Q_qBADq5Di+5=-2A5;8(a(S8liy zROVSBy|)B0qaa@^>B&F``m+Mz^u40N8^>1^S~6hznMat*BkBn$mf4DmV*-dfK^BX?n?C-a2A<1iIFC_do( zuG;22Zt^FlqgwZ&$W`dd57Xc&kKZ7zW7EQ#8UG$z&J}I7I2GkFZ8(4VIYYgEX6xI{ zcv$z9O zt{6<6Ih>tWJ(<5NL4i?M;(x%-CAT6@( zK%Yqc@gsZpAs}s1Znbp31JWkt+d$gHV#;W9=|muHl-&gMIx<4gx!vCVA&@qVUIEhM zaWYWQE*H9qK-zqa0cn%17aAMdWa|g?N1+=I^o(eF0+1fER}6HgJe4K_{g>RG1Qe67 z89+K6J_|^tTmqz0>VfQ0eXK@pb4_hRb8V$RRGVvEHw?AB=)g%Q4Z|wGOxrN5^oK4M zdz0r^Sc6F;a)Y1NHUUfhq1xEPe4PvcFLIZPcq24ee1MZk0$2p~CRRw5JtQk`T6x?K zIx2N#6Q6JHg+*&m>|2Kr3}i;I^<^%`^`Z;%XSSDAVt6mKx(&BxPTbyfZ2P1`e5VGs zW#K)o?UV34#g^Gf088ADjke)%dC zibH2M4Vlq?`lvFW&ilcaeqa{#J@G33_+V^SE^3Xqw%e~QFYE<#m|iY z6)`*>rrMcO+AsvEbvQR(vU;qPJ)kd|kv@(%RANOfMpiGzR635|YCj7moLyg@`4Nl? zN1s1b;hKlWP<-0lw$g*s8iKJw<#-KH8=Nz(RKF^xv=#2hUQPUtpI?t*O%Oy!KNEfa z?=IQQ_T1>q(a)DZ|8WJ+SD6NeJc!D`k$vrF$7HMTi*DhaHn-*MhKxg?@_Ut@q*wPH zgwurbX^uZ@D}mn9jh;USx=BjH%Rsul)6EGuOGeY$9ixpRZ3`+UI#->^G>`ScXXU4{ zEM|>nY|1LDJjB$;nlk58A;5D=PNS)7%g6Rvu+)X7?8XYStxOx8Y2ccy0-3bMOF;Qz zv-a=rluYz%>_Nlg!1xE8&=u`Du))*RR()A^f`?Y0iXUvPHAKf>TNImtA>jgPK;itr zL%X8K%qXmg2YJ#qR(aw~3Dm^yC^_B($Z?`V?qe%_1jPi;N!&(a7h(9YG-E%`+?5?} zSp5@O`=ybUkD!_Bl&!rkFH(ASUJS#KWmso14gZ6pZR4YDS7(=PpO%;L7_#1>gIfc! zFSNY%&qyiwVq-ZT5am-t#}f2`j-hV%sloA%>1L;Z`_$l@4oa~urPPVx$O3n_K=+46 zbhk3|d;?cTRp}5hHh*6cE{|UeN4!;b=~kUFnwoy6{1_O!K{CW#I9PkkYk{=?%NH=a zJz+eYyh(zU;9`3bFCd4vI69@38&?isz1Ql$;XYDFlY^s65vB*$%y8Di4%Rb8Bq7)a z0n$|#EYvt=6@!8;*AxVrdrEfLZwCimAC2;L0ldu^-YKxYEfCPI(mY1DPs1AE&|@6W zwyT$|f+D5E)KS32wuA_ll-I~NtvOPV50 zNDi!3I~oBuOHF+(&~9=2^+3-F+6tue`)>hh2aFrXbXFfVenKto&a)@&Npzo1npo+o zc6b7t;D60=KDY3pOcqXAyNIK#vWB~2{1rvb*=wig?bBjw%N|Q( zG(KQwG#>v2G)9XowE9^B*_s_4g>#1DDa3d?ZAE-OM!!#}XuCWc5k&E%NTT9dPdIvp zi&)B}$d$>kp)O=Wy6Zxg15-kqugWcJ`81;$>F%y#iMCu(l+m13(RM}Q{$TXbzu2a|I#C3q| z&;}i@{?mfRBGxKl3xKp>HCu!fE(E)6X>+6p3%*YdOVX6)F^OMmL=M_fdR}@AwuRu0?B6<@BU?FJSMq|g$XvTkxgTqnZ~V;-Ht4d>0pOl-us-I>U!viFV%}-h^BfI z(Dx+W9tOHi$~yaIRT5T$M9`eT$v4dj?Le9n_>xe!vQ64(Z`+(-mS~NT|bc;5R&SwKaPM_IRfp?6dX^?}~RxlR)X~zCQ z@h-MDdY2uX+z^NbH!`GyO{u)qyF#t(VsYf-SbPgbd3-XOnocY@cF%saMkhzyV+1h` zbzXf_u)OWOdW2#+c}9ISUK$AhU4*Kp)wqI9cq1<3dT3@KPSGmWpC!` znW5Dzveat`TKOn7=a3Ta0c;!Jwdu~z1 z#9hm-nTZ$&P+kwni(NqjdvK_*`mFYna~M99;e%<6Xgc~?s2Od8k9aa6$%{#TB7Wm+ z#5{b#PE-w(!xinpS<$xAiqU8bO^#rdfO5^9(&o%;%h}(v+)W0w*z%AlaC||zn2~NDy zb>gnrWy~D~IMDZOda{6?#7nVpvg7ENc|>FzTnaDdxnA7WxfhEnMq`l7^&+|GMYeSd z5?u*1@gDd@FS?r%bU#)*&gMg#FU(~w6F-jOiGV{tsXfOOC-QBP7*;f|io|TCsmk#f z@X_}_^1um2m7w#pN&BK}%=8y2Iq zHHCSY#Y#yA+(ByS`mqKkar}K$GkeS1CvPZkoBZ{$yUN>UyiyULRLY!)Q?)Sl942QaEy7s|0caeC?cS3?2++~9IFM$&KLhD#SMucH zE={objbV`3r}z#Dbv>$wgKWh8Xx#IsyRt$W?rpib(mnz!cB#xbn6RLP(_t{dMuma#&?+vYOOR&R+5t!gYhevcY5S4E4aVm zd1$)w5jOepV;ev7TE5ONJwYjcpI{!M)b>N-=#CZ|CzEzUh`yr?KchG9rZTFHvwstaWtOS+R>{A(&5dY z0%-=?1*DC{*MW4%6Pb#}+U)a=$y7!D(BG#GbXqiJ_B7(j|D`!5KQVr4ec4F4xSbT+$N;AleLWUz|uhq4eM^?lm z__bVrVddZESg`mv`=vn~^#Dg)H}c1_K#SPCaA!jRC#veJ`_g}eoI>DQjz2n!@7 zus~6YkqkssLFY=?dh5uw@Rgj(Wkfa{RwP$Gh{)Agk;WsjWXFb>?54S`j7+7}nlR%O zjsM)N)q)f6)F~&f%QXEJc5*BE%&vr6xiv{?3{Z?W@nb+@T#1cW2PUFE~1*9 ze=q?k4Y8EckT&pXuRfiG6w;Fz76VO@r_T3)vSe`wBhtch07y@J;Hqp5I~S-%IJnyC z9w`d!Z|m#^hqQEdgEJ2r)&Zou%UR^~?yEpt2oiMO0n(Efj)DD(#sX;}odtB0%qUz0 zbgRTRA84(FEdtV61}=KhB7D0=D9lk9U<p}f!e>jC$AQn zI>_#M$GplscRcyuaPq3F2iCo>+Po7Qvsm-xU(;7TZq`u7j*GURQ@VXk2kz(zsL}SX zke1Eri+3?LninFpjJFPB?nd?hPHxI$O^ z6X>3EhdL$|;!mX=pS}t?>tJk*SLftxW_H&V$3-|{H13q_8H9=k=$ zlYn%57_~)0`88v`7!|~1O4L{JhQq%!xajdSId`12WhH&SSs+B#wSGqnTe;ADy@*8k)4FeB$P-P+67L zmygawAGoYdde6}~j+k)V2;7whvY_OkE-1lvd9(hYbr0WXvX#rhzG7FKK8qG2(Hk`3p)^r3o-z z!kY(cTmDc-8)`w&ecgQ#EXBE$u7viIf0Ckn;&la0Aq;LJm*IS2?1iquxXEwIR$e#K ziS<|66PFh>p)-TVluJ?;ZT%yLPvXDbe;O;kFr_b7TI|}7;Xp=iazXL0GF75|=ttX_ z3($@;=HU*`7%MM|dPckqT?z^vn zur1-S5L+wxcp}gzf1~dqs4LW;) zjui9}P=+9`J=A#n0V(f=K&wS7JXOOWwe{)%;YohhDi=bl{Iu^2El#h%9(oRNAgiE% zi`kX;XU6xUlN-9}E|7C&Z&lf&oJ41S!pPK>Xyq+JD;7hq z0&i6;YwKCjepO}k&{L11wc%7`{u8-q#Vs7Qnag={Omssnu7VC%jDD*e=j*j>D@2>_ zVjO#M1sHU;7z15;*q${GtF4T28$ia&aW2junJep;)k>B{P%Gcy= zB62k;moJ{v4LQF1SPn(xxcad1^tD`y$hD%&ctVy#5jk298&96)Qbew}a$%ojkmV3p zSU&ZmpXE?Qj;|_5Cm!f;ITVrOYs%4urw3RrMdZ3uxjNBokmXQBj_;(6rwn(@HP~_~ zBG>nYYrruXjLA*@e8Yh6A(lrGdG6Pk24*`0WB9M>=?p|38d#jamy8|!aIYgRw<2=? zLb(~=d?n*TEpr`ZITVrOG36-8aSCd3or2lDoq`hJa|aygw>MAnExStQ8g3;hqJ(WK zAwS#6FX`*#pWEj^@4dZt_iV_jA{VP=bB(avipc$>aF1XLZtLUpn9W9q$HiYtn`aSf zdzXu{%Y53UlfPT#gOZoghUL}MK@sCpZ7B2n!^nNfl?zGG+xbj-Q})us$bao~=uMfN zAU0Pzf4nJjr8YZPYqKj2IlhmvDWnL*&O6G{NuD~^awsClpOj-*t}`sw+Zk4q;|!bK z%NbUZ?F=hE;y}UPK^-7+LOxB8w^9^Q%7-cO&LNw7jj|ky$nmjqNM1%BMw|tRv!K|^ z%baF6*Jvw25hd^~?x?w01G(O5H01a`(Q+svM^*~QbRWk_mO~Laay<_BdE&3Yzv%3Us>gks>$1PrXjH zF(_gTrwV1EAz?l_Q-aWJb0!H2O5Ic?PyY-aDdXIT(x2&&T~W@LoQlBN!Se&B1XCXW zGeKpp)2srDC}FC^(N&|N)N&~z*Nn7W7nq3fJ>GIDBG;_6T$6lU6D*e^a$TTY%d(th zC{{T&y_}qLwQ2L9k8`5sR7B28l+*WMAK~LT-Et@*$AT0NeWf%#~R`2 z=WnTod@NHeiz2eD7nTt{0#1(@7c%N(3%_|+>6q&k@foZflsgsw=1M2~c9rdt7)|)( z_2TzpP`Q-JffjS6llx7Pd*q2j&~WTmQ{eO~8SM1S7~u47FkFtqHbOw`Wqt5N;o#jK zzWRTf^@k!_{9U1}A}J|=on#j$SF&$4mnMk>16#^@a@2*j^7QVjX-?Qu+b`F zw0lHyaxKWC3CvYtxfGG>72)cBhIm`(Dbb%H&bE>jQS$3TSw&L1;1BZiFd5<;D@PIK zysH`xM8jf_HoGWtKK^-E6Nm-vpw%qbmq4?uL`CE|Ae4nba*_J)62t`hM35%XMoFNm zbkD2oMVNxv<_rq@>kNMdc&?3D5hFe%vXhg@Ujd$HxfGGBM-FpDXYtIo9E!-%TRFNY z5pyh;B68&m*AO&c^Gk+0`5A+poQ7Ui*_F8EUU%c0WkH?J`r#jr#c|dtExr(A-?C-YbM*54yRi)Wmem5KinNWDl@A(;1p#I zL6bdHQh?S?zm(R^jbKgGdyGWL820$|{-V`e5%oS!C=>KPS%Ro{u^`nu!_`~zOoNwa zsJCj%irm$^KJe2(*7pO>>a674FdIbXy3p#Qi296^D2K2?aKBd^ct>k(`mjuBD8=7& zy2wgXM4pL4Sw&L%VT$|=Omc<{&vNog203{j^xA9sqa?Zp|B3bDOdHp0Byg`wY+Q;M z*L0yQG$f3#QiABo^8{(J+biuvsTU90dXdMHp{K%JKUp>nB>S`ni@U!>;` z$Z`hMgq#8BY!A3uyXe%02C4IyN#+YJ!{6tJdsSJfiYWDBp-eESR)T0yy&!)@-@!b= zbJVn=R}{z(1e3GCEq{Vjq5eR-FLFOZZB%nfu;i*;6u=P1FwYOEHD zsKpJbT71Q7adUbtY65=m`Jb${HU>qE;WiQC=QzeFgzq}bp@s4=g6p`o08jEj;ObQO}@LFg&6p`bB6uta$Ty8lOk>erZ$Pf2+!m;5_xMr9W zE;-5xqYEiR1HOj?JB?b3!az^B_Mjc$t6&$|7!)yv$Az*GNG?+ElpyA!rv&wrTyz5O zM^5D@=jzga{Fqry@>>HM<(UrRlc|VI2O~|+lM>bs=p{iogVK3Z5S8CAXavw-1RV$T zksv*!~fDyUq_l(nm_;B<12 z7P&*%H)&LBi$G1QGR0D|p3e{WYPR+(B4we<7}CSZxjt*J=Qj-9;Vy0WWHH2CS6Nw# zDC;D(Ge79$!uM`m5hYI(%0ffJXVN(m#AnjEf&wVgXz%cOqiy=E`<&vyeJO*N{sF~nY*dOE)f|zQ zZ2BY$cdu(Lmm+dqq+CNXogpQ;PH>Bo`sX9QY`GMXt6I2*_!{$Z09!l)nP!KE|KiWtN7BE(tvBp}dh<4oX^Np7;{b{h)aw#I$FT8l%RP(37jg~_ZIUW;^{C?R^KRm+vmGp7? zHTK<`+t9lTH|1hAq~(AQuqTC{Hy-DQd#$sQ6;bjwp)52cEC5b}<*TToCcqztp%p!`IMU;aH zUWtEmrIY<@mF<%FvxpbJ7lX>B%x@Z@_)aJHcOutc4fwOjdTXU3+VMZi;p=^!;EUs{ zmO~La_A5tHf%8|Iw^%MkAVaFe<>ZksfgZG4pRC1Oqh_mjHkpzg74ccmm+fYO3QVRkLzoe zOA)z3%H^A6pX1~BhUHL1j)BV2#bmdCX~Z2?f+9*dQYA3AxHC+Pd~x1sITVp&gr{Yi zO6%K}LlHTS_u?qlwxvHuZm=AR$Z?_xCGO6#kLejn?^*A(gFl~hb#xacpf;gseP!Pv7J{3fx+60XNiVHd(C?f5R z6M;5J7@ru!1eF5)R1nwGZWqKfI#N&+Xpf+oKm~$EUhYf_M1n)JhGq}VDa>8l_mjL= z`b`_KZqO?Q(~g)nblR{fgL3mSCgnJjFz?+T%USwkX-WU$(1AXCb^MX%PMPaR*4K*Y z>nd?)a`V_&N&kSYna&YFFG$#MpuL*sfc6O*1@yik#&Jkc&ZC*RH|HJE z@A5#E^M=!sF{H4UGpObaXHdx(oIx4bOKGznSa3Z6gA!fyZLx{>diyGZ2drxp(KX)? z%HP!eZqm~bIj;$Z=jHrn^BTA+_ zBQhdR{{#7ZLmhn@a;>5|?>7>nv`8>}@3QKy^QHUGZMrL>x?6>kJaSQ6Zu!V`sO@ut zRN0QxNwAVNth0VTKRcMJsy-!gdr_vtT*1vlnKDbM<)ZJ@fO9bLCFi%9!Bv5*ld^Ag z28o$>1_ovxpE+bqZ|8`bInEI!vz;R{D%8T=eLB2J9h5Ib#k`;vhJk)#E#%>L=6c9l zsEB&KD3p92*o#)aZmoPn5Oek)1P#I`dLm-!#yVoj##KC>#i>#U6iEW=?B0mL1m0N{ z;5pOy&ZJ+s{Y7(|dV_v>Sn?gRp~GYPFy3JiYXtQlb2lx@lxl~kG-o971{MaKB{}}l zf3cJTaH+b?-HPbUcO|N>%gRBap#&cIZ7$V-(iBnJ0ihgaNTjU%UBY0k^NAq0tgOoP z6_!^6Ukn5<5A@5pIO97Rw+DU@D9IciJSF(w!L31u*=bnK@mOejoHHzAnA7h--rl|) z=(zd{%$ty&n4Nl~9@3Js*jHd4vDrxxb?zaQg+^yu*jIw6a=svah8&QblA)QSVF?+; zyB%8ywR5{cXv$0mO3XN#A^42dEW|$L(~^#SlxP+TTa=h_xOdW@aR#7vnVWTf@MdRA z_JrIY_4{rxI4Lk8x3i?zXqZ@vX!roJ?Np~4LykQ&wr8vl+!NRl_-!D+9|kRJ24IY! zztisnuhiy&M=MZf)MJDjz?tgH6u-0%R>XLY63PSzA16U{@F+n#KF}adr!rZC$&<~r zxM{)5n&jLcJR&d^!@&1Cfs6qe-P3YhS}h;7S}LNJC#PyzYPFpBd9_S#94?PNkl^?bE$J=$tBK_8RzTN=57`MBL^dq$Y=Dg)}~{C zW{MnA45pXeYpab>5o4S#lqt1or391rJV8?D2+EV1QnPzmpcG}=aW+b}9}$T0hn9g6 zf!mn-u}q9#$;rvQ^rY0NgMf7X1h=2*!h>UM*k~ZPehlWa%9Z-@d{M-$A4f>}zB0rw zZ4yw|i=1Qb)Ia;8uB4QGCW^9?a|$JTrJ9rbc8LNH0u}Vw&{a&X$2J zv)cJbcemNpRYdKs6iVg|xoFEZR=F<=3P=iW@T#g{Mc@c$@|={xxJz6i{CdL1rHFCe zAmaRkafX9;m5y;KVh&IaQgI^2TjNRMJdiJA zc36k)uEAz3bedMYblOI%!dblOUOTJ`im1X5QdM}ss_>vsg@{juiv!*B#N$?t3ylu= z-f7iPL^U2tRbz`);|ZS{eor(8wBI-d{l?SN_8Yl4F0pg;tX1g_8suJ2T9p)0rJboN zJ#SU|m7rWH7VD*AYmm>qH&deG4fBchQKfBSisc~<+G4&@>NY+n^`XxPyryv&$ZbXc z5@Qp$Wd>i%DapOxX$&@H{5_+0AVczDFXY2)Cv>jnL#bB5$LlF;jv~hUs%U)rkmGwf z180xN*0NG(U`DZ%IJ}SPq!f?s6Gn>V(I)14+D4&>QM@ITg@%OG?@17|^PdIjQo~B| zRh9ThI*953%J3S_>VT|MGJ_{&eI4r>u5xa44q;hmey$T_4TRDm-Cr=pj`vuW1L)*;PE=#N)hFZ;r`I7VnD^U?84id^jAh}3AT!NUSM+?#= zg6^tU&F%Ws<|9^75O4P0?LI5K`K!xCq<;L$#;u5PA1mUMTSwCVb2(qMT#CpwTDaU1 zr4gTDL}`LBQu0tHxO=^1qfo>su>262Bf%+OkRUoGA}CvG2HzNo^a6D2&^M$8prAXY z0fJ2DY!uWF=<9Mft0OQgkd3`Who6itw|YMac5}UA^;X2_CJSX1Ntloo@{>)lWFIdj ziF>_j1u3GSbA&UQtI4q7`!&m@h+K2ha#i`bUbkF|$aT?Sx%OHvMdYd$uKdB-&R`6l z561I)@VWi><~QWo=veRS1CtMk#X=9@+~X?|Z(7NUDETs>EF>u}Qa4Bt6TeB2mWYi~ z$;o5W8yD!1IzRi$KyX$daCdM}pgiNEjQpXw&d{3v&d}NYoS`N8&d{3+4h-5mV0XU` zuW`qotEw9YT4B|_#;5MvR$WC@_v%!2uea*93i35ERK4ISfxy&E=k)^_vKKiY4~#rK zFhb72`}6lgX2O8+?`@=t7-?MO>a0AVkAruWjs-*!8!XB(73f-@LFr_FRb_*c7dd#b z#pcED#h`L2^XrF^`!$i<>>O}{87F6yW%yTA%$7Lx;~i_SB3iUTcsrY}eb;g*BFFcX zqbF8)&d;ng>)_Ax#q*x!QbevFsqHfPDm^U6aPY3u(XWc=SLGm8E&k1wPWJsOduX;Z z^usJ?@Y|UC-jWXhaz(PPnR6;TMk9!*e@JiuLAp<&@gJVjDYw9D@_rly)TsYyv>W={8)l| z0R2-?$|iuJf&9E|>@Vr#zUNYz5Z%- zRYYAwLYd&T0;}thf>OLz9LOJ(jd`s8&Y=5cfVQDel{cf2=(Ukn6Mvcio7F@SH5n$9 zg+^KW_;{%3R!yt(4M?0Tm(m>8ugTLLj-Q&3dcNErPPVGItV*m;#sC zg7+;!d?0IDWL+5ud>9;-<)4~3k!1cOJZ=^nTFI!v>6gpV`JTCRwecla#N70dhL&AmNpuxt;P;il!vL(3J> za+e#(Z+W_SwkKF_&_CTFVvD z@;%DwYcAFMII=B=B67T<9N3LKxTcSGZi{7kfSo-5*e4;!N>D@zud5f>iNKmNUWS8r zm5%l+Vuh_7q`DvjAMTY-_S-7kr7&{oVK06!29-;huN_A2yJ|I7q))`_{jy517`RF! zxz)$n+ghuL_8d^ov6vUF2{=nQOTek?Wx6qnI|{3u0s_uhBJgR!3?|$3uH9oEJ2{WQad?;|XyB68NIXgJ2l zairx?M2;(zuAfNh#WTvM`tTlm5#};2*fT2v| zj%0VIll?1|4IW;8cYE=BF{mcV?oKE7RgpWa$UlHRQzMbjV_}%)UPZL?E#dKV=wPd| z9cMWdkz=1~FYQh|FmM?T-c>q!MiGcz4pQ+kX0CLy|Ln<*;b8(&!_k>+_l zn1V;!IIiJM_bRk;C}JE#g|g6)FrH&2h{dx|W29_7QRxFMd2?};PS;JyQ>+4~li9sS zSp^hPfzd))Z%C*BrsCiWDsY-A(3f{v8@nS&HGv^Rb1-!`2-9{0ouPYDr|p=*yb+d& z)n+fHxYvnR8%5Lxi~A6DsUhJvHJWTSnkIoDLlJlYSsf=_yPRqdZ5% zIy(7~*fYKox6O5ub$}wW&K1@SnHlYinbAIQF=k26O?2^hd~PhVQWR0jr6NW4QQ*}h^-fW>T~(yYzbo{ewv`8?cKgBonHnUv)1Me&HaUw zo0TtT?}o4(x-ZV&?Sm!JIE%N@J9`&=(ihNN8OE=xt-*YOjk&P22ncZ87Pd@Y!{`dE>QDDqCBEHosf{+E>`F$CXFPUw^-p#sbvFK27{B&TXD++Pb4q+@VA=tZ0w2{`+rLW!@6P7W}&1C zevA5BnTja$5ur@5XqyDlq8)<%O%~xm7q%0?J3BR7%8i$Ud5=G8*4A9_EL=TB;_Z#dN7k3Zd7sfc!bs2oZCc)wS_ zV7U~L>tp3YPR+x1&OB6bdBwSVsaKdE?sbOcR76g;x^Y+$FcM@=5UGU44h9f`xFiOr_7g@;0C_#R5rt#n0{9u>+$lJX+; zED2&2jwNs?VA`5Bdwrx)TkSTRq`|aG_Wx)*i6U=Ais%MhZ6~qCr0pcOnDlPWV}Zut zP1xqWF?hIU<(GXHlv@iFF}e#x$qaUXYP{|b0_}B{7qWxa-M1>*@}F; z71mxww5U;as?T!j(ca7dFvsb!jm=w+GY?qlSt=DVS1BjukM*TQx;U06*ljeT4W1r~ z=vkFZnd1*5_c~WDBtdT{NpH$hsfiY-e9AuaF!EQ6d}$rdhcH}M=$Cw+ZM~_8-n>yb z@?|`@55|LYF&>OPv?UlHZXC4NFejGD+l7bs9yJ8`KF3N|MCt2=vd~ab`)^1P%j7o& z>Ha&nhspN++0sBF_nCsSt_!RTVpQNWsrX&1;`0z>u1c$-B1ZDDD*iCNisx7r zBZ_VaTRmn|O$%h5G zJ$2~~oW!`~<9;G(e^*+aw+iC&@ZEyI?z}FDo8`*{^}RlDX|NE-R~#Lv$~iS9{~uR@WYyW3^F4QLjjZU3uty%cY21 zuczhmPl{e(xfGG>?X+CQxMQxlmP--2-W9I=K{?JKtkWKZnY2NTb^~;k;Y`fY2Ze|C z%2|}%>q0AC5v3mx%0ffJ)cCsuF*QCB-UWjbF93=OVyE)N_R z92%JI_-j7@Q1iuB14Wc^NFs6Dt_=u~^9K0M>k`YMh#WooODnx^(CLfka}RgSKt}Iy zm$kRjvi4TQ=Z|ucY99X0l}>(dmG6=mxqRw)Iw)dXDwi^AT@HSwlbbJcyUJ^qT5A>2 z+QDhLq*ig`n`gNck?Sbo%I}@!^e*nXw?{*;%3Fu7)89HmM9+*8S_;eeJ=dzOR7I3} zj8GPmlozSTNDy<&$$~Vu=EhNavY|=QfoOCk#mZ0j$kXklm4U9GG{8H z|CK8Y!wd~QL#x#>U{&6iVHgU^>BHD9} zaxzDQ%e?Wj2zSi2&~hmv*UGe9{?^LnmP--2ZV)abH{JIO$UGS`(RC%9k|E1@mI|7) zu(Nji2L_Mw&2oFvDRqyfLPT-PRX&9ANrS2s3RUmadjyDYq@ zcFAS2`V;{tomqCiRWH&MtBFK}=G!paSMMV15H8;0L*0KNR`+}Z-dT*Fx_Zq|z5r-xc?E#X#?q8F79)e-f3qomJ!t*;jVZpMx+&(TPQmo&3W9)#U`n_v!Gtv~>tt5c1Z11qPuN1YKVvP%zTo#TkT^e4rbjf9YF)6qiXVqxg`#O02 zzDObU1+21M-#QEzQ@62sNo?Wb+Ih8&jY}Ipx0TOXE59jL`qW8*->~}KpQPV}a0;iRDxx10g@K-z zyDTny1hKfhAgB}w8!X_t2+)gyqChVR0yykdY;8XzJj@%(I`9FA$8hzc+VGO<#s02u z=iLaADAleoZ)H%2B&O9p!@1^)x1o>qCC*TsR=Lwza8Aimzaa2{o$edGo8AY9~xUCYir57H+DIvF>&Q>#7$nN)4@DT4w^&#bLsbADt5s zi&n#5kct*RyM2*=vaO!qkcyLyvp)!;oqGgF|aO=xbcjToc4RdX|W{TEeT`a#^?Aa^x5mcTB8c{{?zWuIYWTf2-XNAg0xi1%-irB8Yk8zXdU`ZWP44`cpv>p!)?y zfgTW43G_2TbAf&?s0!#oLG?hJ1T_HtLeO%chXeuquU{8f|2!c&b>^SPi>n7-vCL0`` zcM}#Zy=>uv&(LqAt^SMpTw@}(*EL_~MXu^cqjnxaTm@wfw`F5t%qGPr6 zY7Pl#fL~HFrsUhKrSUE;{j%KkES*_fv#>f`Q`@wlaiR3V!iyKyglm@8HiefgjfEFi z#}?FwW7Lf|oK%GuELz%B>rBR{r)(P2kwT2{IzUhtlkyU)ZEapv@td+jjDBvnw#n? zYnRkOk(uaaR$o@z;nWbb}mcR*ar&wS7JZS#(tv6V(cdgV(cdi3Ii1hV(i6&X!|LG01_^a zHJ!ewdhz_4>Um>JYQ~MN8(%WEXzZ!u#ue3!tE(PAwz{^iw63^xe#yAfGa?b;O&#cF zuwPPX(J3XT)YXkItvRK%w7PC=T}e?X3Pjz4y4v~kYl}|%43fr`R+ki&oHGB^+S5*} zKBc&1?6~5Zy3$kYYEP@JKCSdKNE$zX+_-Vor`6VuFFp0Ny3=awYECO1d&+6!Pc2)Jq zvHIii)A=#u)>!~*`=-Q)4~H`^p0*y++5Z1Yxa*ha$L|OgpIZ9`WdnH@nP+rY7J2g% zsu`sltGeRzW*q*Mps9(Ia%lPc33nOlzf^1LuUea!{WQs#QZ;t^Q)5RY4(GqHmphp} z&2LK3Sp!P=SokP`Gb3I)BwO;&gu5wX(MZ(w^Pc~WE?xQ2o4rsy3{Q%DUjX&blK7~9 zFG19wV-}wNhJkg_Vf*yS#^$CKWkiPLE|aaFr8A0mWvnXA;-g9%dCaz5@ePz%$X8(F zGrat!iD!9CYE4X=M#d3H_{^`QxFFBKS|fy7B~RJL60Cgg>t2 zILvR_dV*NR>~f+YW*7Fe(`T16M`EZ8O>|_N$h-^YoH=qqeRbnJv|Sg*7@!{R)X#pI zjJqgpJh+i?jTI`|t+|VN!pmJIe|D7?Y9n)r+Spy+jF*_{o6`l+H|)dv?LZJN&1dQx zovxYRT=zLVXBXp+N-U(DA&AybN`j>8^X9V) zMLT->5<&Dd$3l#*UNlMh44tel^BL+sbh0pSfwmQkXK|#{vgx;v9;-?lztLoY+@&A9 zylC=nSDsZ%=~=auJZtgqPka1KxTwuSiH{yyB#0j3=u6igVqS!cv_N*ABR_+e{2f&4 zwKS~`xY6a+C|tBzb1n0#=32_sTuWQMTx4UXVYIWL3>?#;vO(=-zJ% zAB!H>k$CR)kT##bop9I4O8&lEsF<(4%Ez*@GwCFx-5f`|4 zc9`Nuo#}%gCfsFcSJzLhWojcWQyVGEv(d!Ym5tsi7}d4AHvUX>ppBaZG1a&>#l(r9 z?!|1$2C^(V(Xm&XL5n-hp(cGOgjPMAR<;|3^QhdVSG_!IEa}R6wSsw8tuQ=BZn|%3 zqf10+{Z?x|7sq(kC+ojG;cl|rT~>cD^^7iE>F-;rA`%QwvV8w<>i?WjQ~y1Jn0ikO z@>3Ec_2x{*pze~|MG+2iM=&lNi3nBV0F*y!M)6`=aj&F=c4eNb$>dQr{c(s2X+9YD z>k5_%l)Yi;vLR$u3X7o5Ra^(4)8l9ZVZ>NpK zMD_={%Ut@dr86dV_3cgt#{GiA};e@QD{ZS>Rn z zi@7QR_6P`khIqh0~gMOiE~1`Agl#{H1OKNVwEl z^QJW~Ss;s>B6I1N|8*C2wznYJMPpK&LF-OV3GK>7#|brEG)j;^js#!%elU5)2{m(M zsUYS^t~*ShBj-)4UQioTA9vTfiD{*skrLXKb*d$;Q!Tq|-4uz1)=d{g>$v(cy>)do zE~2X`)3z@et)G<+JS(j@+(@`)3KeT)HJmN)O3P_l16{d5O`!|a6eFIJy5c)eVjtkm3VPV=x5QdyGc7=VqwzO3S!c7J*q!_ z#00T$LG0>=+RpPWBW2>4iwRqwR+ynk{=Pz}DMOQ*$)ZV3Szb~b^}2G2n#Lqk)4J=D zD@6yoBqoS1;nG(VCw{t@R+!=xj=rTU%8WF5P-$6OVMb_Y-`5BiU87E-Yt%_}jXH@+ zdrmS*(Up_bSUO3K?XHt_sVC!GX`RG%ww{xct!_!U3&w6;H(0B+*G;Rn*G;Rn*G(Hr^qz(8g~GqK#bin%+iP`_wHPP3=tgFzxP2E0cG5-6MCImY&tdg08Gq z?P;}YZ+IxPvy0mNK;om-KNdu*xdb-7)v~s#^Zqy^^)oVpjcJA9M#A-gP|@rM1u?sO zeRku*t{k9-&;e?Q5&sbs>Wc3niI050OslEZb+t>lbZlM|W(CnluWMYocwVf2VN>M% zWRIk+45^DhLFkvq)5f+XCG@lC?vI0Urn?yTPKkwy{*)jlI@eqK(@uHS`h;-`+g1O( zorgKo8nM-+d`aC>trxmoJ3O0K#phE(yK9Ku`*ZfODpNUl+dm$Qw?dEYRFjqS4#4*tM>0on!l!~%BVj| z3GK>&KMOSt_&|`~Nq$5A4|DGwm(%}0{$H1((y%i!l0s6nOR`BrM0P4Fq(UU4geXD- zSrL+qvWk)&l4P%pkP(Fx*&}|>^>}t&*9pDe-_IYvbGvoUb?)c>d_3oQo^!6Qt0Z6J z#`{HV+%;nKDL*+8?i&0#&+5Adee{Dot>Sk^-KI`+Bfkvo#XrhdgAcp?zYc4dl5st7 z`Q=He@m_U{0y&DO_o{&oE%Ue5q^*KmleP+^sV)y-xHPIHKir!2d28a&t^QA~Y4Pt5 zA^!jS4FlP}YE*4YK>MkaqqwiC-a>$O|65%vu2(-%IT9UR1Zb{lAkOtybx5X`~NAklh zX+U1#mc*Y}{-0X11|J9hzidgvYRd^VH6cg;drQ(5!7WK!q^2#|jpT=0(we-&Er~yU z{Xey24L&gZe?1%bs7@FTLt2we*q-5z`t}cVzejQ8q4etVEcpF z)=p-h?f!LRNxlJr9~aR79YZ(SxX+%GSGb(`KZ}S($CuV`K7Eebxy>uPQS0x zq(`**tyc=&Y*!`~K64eV&hzgxIp~hlNQ0Q$JKwZvFz=4SraAfv%HgN;mZ=T8(do9W zZoA2WuT%Nf|Kl=?JGY8QY0WbJ8T{%haE~q%&RA@peMffx(wRtC>xuh&!`45mm-Fmb z2i0{p^$bu@TikSD{ORI4yBn%Tv{KqSYRaiRr+SV{ljWa#YB#bn*{j&+$5*w&|1=A3WGTOE;Vov}ELK*oW<&$db&Muj(y}*KHfI zcoi=k8v!bi+3T?c~R+JMRA1@jj=!lx*x{eDkN7 z`USDim=eebwm(jcJac{NE}z{2F>*O&yZoLm-+NW}z|Ths&wJkPci6PQo~Yn+l(*GF ztrI<5#+0{N^Zu#B+_4oUZjgR?;{(x)oi}+yyT>iI+WGrl@Tg6{m*zCjKQac!102_F zva8GG{qxi#cZ?s^%jRqQrN7$etdleTJl;&J;n=5Hs;R5&U*0(H(jm`fN_@M_;*1jo zN>88no4KN13-!xxbw|34^E5EX{@ChNx8Ft%) z+uFV5IkScRt;g!8_MC4#{)a*3_+^RT8{7PFw>B!iRvZ*vG1S~obnN!Q>2*tP{_gmE za6`HK4Q`)W?(Sq;kp=bIe|1EQteee0oSnNvwPJeZPrYb2`w_*uhgMmYzbdHMbfm}9 zHyY{+X~o&%CT}B$ht~G7-Rc^0ukx0)+%&tZwNI_>{iEOh(0j9EYM4GKUsdo zc=hAeGniDD>6?+S3*C{nK_{NU}!agPdfqoew5#k8YI$ z?WF&tuh%HI*$d%3QE+*-W$7GC{UPPuojkgBu12$Ks@ihBQVAy_Z zsb_b;x8p6Z_nq#=zcMLVF9Xo4WM5C+Cn{HdvLR+eRf`ao@T(Em+x9= z==fZ-&y8_?+Ou?&YMb+N(evZfzZFHLd1!@S>Ci>JOQj=>qX)x{I)zSYIpC4oE=Avk z{@)ia4>lSZdU|_8a`G5Q&C6<+gU;){8`SU-j8oV?_}IC7gjvtdC+`nf;FIJMwB6$H zx37CV21h%BfId$H^myo^hwrSA`h1i*3Nun+xjU$T;&~fsU zHr-yAt#AL*veg;&QzZ|7M~G*9y|vSLZk|tNM z`-SYtX4g+Rsyw;lrLZ&O^op7KpQhF~?0r0=?%S(LZ$EYpTH30st5!qpU+-LQ&Rth4 zYMhFw&E(djiDhkZyt_U3^VS3G+q!*STc z@eAtt56lAAr^0>4kK_i{%aUxeVL!ol;FQBAyE7W6eZ4VJ{-~#DU-;VC4O`1#>pf5F z`Pw_)S7F<>l}`FtmDHkZCzpE95PgV;EpXTx4T|$!bmhIz)tU1iZy!A^vdxFgDSg}I zMNYMFT(sYN>uLLi^6~O2whLOtPM;8cYSwSq0*9^sp*D_6qvsBoP*lF;N#Bo!Wt+99 zPo7iH7p@A3%2+pYDzua7ZZ6QgF}@~XpA zV?)R%t((%gn1+4!$KSkR+(a|kG44#iTdVe0x*oN;J}310&ygehD_D&;-#K#at#>1r z9d=N&9_GI4v3PN4M*Gn4rlFcnaK1qMSd9JB#9L+23fKaN?S@_xHqKLSd+F$&O**b7 zNi!`Hi<_-=ZIJ$_E!_Y7YpY|s?%jQlp3bmsJfMFQjeBGJoS*6$cl6iXJ_U-cMr$l+ zW(M2qqdo+7{`6*W?M=6*M*h6E&7*SE&cgHU*Nuvf2%YUbZ`H<5fk7>lO$xfyb+uO* zl;3L0Pow6&7pnA!`c51dl&T@#`(Mb1{snqiXE!{dBf+XD0H&opM13>=c*L-G6O!)-5~7#W!2vj17s zgSM&`cGH%|Kgu>AS&%nAZb{_yO?^x}52qSE8z#Fi?{eQc*uW;B&qK{$uT+fYc6PZ^ zdsStn!Rs~+%PVb3ZH$<>P;Wf zE~1@&@llIs$xZwHx>ixHexY=D=cu`_gBl##ryS(GUhZB*WW9x(8=9x=dg>u64oXeq9^OR2&pW*(#BG;mP@cY>htseYnms0FpBEEzshQmuVjwp*3A78%v z^3Bl=Bd+hVIAZ2*_5P>*NWIf#F;TTrPFO>~!g=fQUUQpLyU-aI5>k)Z-fl4r?pMR7 z%<1$p>1;Z*FFa3Zvv!7Z!E?-wmHl>)jVrm+`n6*4{YKh1VE=Od?pEQ?U+!NXezoA5 zXWfx!nt4Aijd&Uf>EJv#>E{;H(ezFWDBm#i=@BoMIS++?g#Q0i`mm#)^gj;`x!v%@ zLz~j`y(YnaT6|}PHJNvH{D%BkVQSV@>rdNbFMl20x3O#(^v^L1^(!q$47lqNRCH%w z?<^-cZ{fUz?X&~-ui}&6J9lY#-!doelp53v`Vsb_-Jl)oB?t7*^D;UG&lhli1mgjo z@9ZyVe@MNa_i^in2S+qI?Je|Z+$Y4{y;T%&@7If(Hq!b&6UMinr*71co||4myLrsK z)&8gaNCW7PiM2GY9d#a*3jIIT@!N0>yIRlgCx2*C@Ni89v@?{S_rJ!#{w=ppd%WaW zdO<>K*F|rZ+UbuRVKL3P^MaEm{%`JE_IJ^CxOMyS?mAXuPb{8x367W6zM$4VNPpvh zJ$~Q!$hPbDpKh8C-B!H4S$N*R;>r4u-|Rg-yc>63-p9DZ{T;ifewwJiY|^`qAGUl_ z+%&Lxhda;KnHIIV?6XMp==6$r3)iZ2*}FT}Yo(JxevkRr#ks5fd!I2|v`w*AhgbWX zd{AEBAS}$X9S!ZFjDXrF@Ut18;8W_F-Bx?V^S2vik(uZckYLSwG~8 zc@xE-ru))QnVg(5;_bVPzRGqx@{_&>!12W3mHU=nc&b|Y&Qtkx#K#GmR~x=j85of( zoBuuEF^9J))%JR*Y8de=q(v+o-#X+?U`lTK*3hX#hdeow-^^THKYMiBjkh6QMslI= zo^MypV1Hg=lt-g%ACG^vUQF~|3Hg6C1pP|>u>xiSI-Fg$Dz^f6s>Pvp1?kgAJ|Wkb542{@~l1V!|{wY3*s)7 zw{G|}W^9q=ob3mpULF=}FMX*nYXtlM8h^oM39DLP%-aI-@7j9@-dG&03F+ZDw96oy zPS$6)YeiOUoZIrzt^A4LJ^DB@Tf13gu=3K~8KF9M8@6SJdez$8zQexoORcvYaUA~S zK;xCS-e$L4pZnP>C+As)`ZyHb zJySQ}gIaQ@(u2)s&UhUN;}+@%<+ZJ4GD|+Zk#(<~S6{4O@iDpF>&xdjy?G(f?%I#r zeOvV4`-AfheyaGGL_0&AjI#Pllbs55A&&E<8&i!k$B+20<@#iuEef0Bv3mUZlhI{Y z7U@F1wnw_>8z`(lV_^S8dtK&0e*QvxLcV`$Z#WM16U{i$@Mpxc2ga`1qkfK=RuA$y z^UL7;!Ie!DeTwI;chfGsYgpO;e8u5k2^ytAOHO%&c!M{(w7X?!--G+NX&h{(XB<=s z@w=D4HrW5Fk6g0-=U>z34%haBxK&#m+u*jl7heE8#cZrP#XqM*y12XAR;oUao(|d@;NI4{ z@eU}@pW35UlkejTpEvdhHLZW`#CCCZ*pGnmL$7uopyIZE>$=75oK`H-D4%j!Ydd&( zmmCu3^;ImB_0G8@?@Eac)`xKm;{f&pyl+hn^t0jf1nk56w)ZXGv#p| zSH7A$cVNp3rKtz(zd<`(^inaJ(#>=Eoe=-R`*m$*Y`FPq_FSg}X|nTv`07ScyPwYx zLEKGpS&w$C`&RFGqn9~*7H4%f=oE6(b8Ou{vish_Co&@C!*ADLm66hG#-~p?<_2Gl z98>QOj3`LBo!Yv4i;eLKTJB@q9IliXg}F4X_^&?9$A$yMORZu(?g#kV^-4IibVAdv z66#TjQ&~AC~;lF-~gi)-Avb&Xr7F_x!`!tn~p0Q^c$(B zY57(or2Qqc*d`@$V;oyWFKFHW=riTJF+)-ux9>9Fvbb}u(?shw-`iOm|Hy29_v^|{ zMIVkhPKR;xO0Utm@@HC3x;uYY?6z-rJo7{Ng!Ut!oriX=%*a#q_U`?p^Ouc#FZ$dF zgLHqIU$crrhMVdyxCqy!GnY(9x3=@Y`Q3f-Sv^m^R5(9s&t9fp((&n+E5G_iCBDAa z53U2U z+QdK~Rn@J6{wpFqjx# zs5T&NWH+PsP>$an(kq|uc9oYc2aM|}Rw~!tSl7D@^@8@EvG0Ii|6KWpSwU-R$EQwx z+AHi{Nn7>U>=bL81pO|vy=3D-yqjr!jF&MZM6XO}SR-Z(}23m^6mZf_q5;e+ICz&^$(q2^orZDD9g_q=4TkEP~OeWLa((SoEho1 z;E``rg*P1y-|h|x*GayluJ&wpui?6W>zl=oE`4#=0?NDhONYH5baW%EcUq4LzZmiq z%KLP*!n`F>*|nD|W$6ZYon;}LUw2Vu)O+jpm3}+7oHA(nFgUzcxqj}Q-76q{?$X}7 z?uyk%Z@p8?XJMdTlddY`L&64xe*&QEEn7`1h9>Xz{F>jPFm zdj$_2cIaW#e3yj>96x>SXuVl8WWV_7-G#-iQakl9O!F{<_PJGfDeDa(F; zyca(w5!z?K4PF1^xsTsM`#6`F^|)Mj{9c#`p?>e@+&ZY&bx~}_owi%d4=wgsIxcXe zwsv@DNC)%Ksny@o23YUt{l;baZPis;p++y$cZVq2-5zvj>96-+)aD!PYdK}&`@FFq z?28UIUHZVS(}!`rx4JaH;g{8DkWLT336P)BkA1JQrsM~;)fuwc_mS%MCl@chYrI6M z*`dJD=i~HOz69_1KA+7;>@G*$Ym^xBA#Ix_#A}$9>-)QxWgd7CFF;R6@xIOPE1x6t z7iFr>SM+^0ZtSXz$vwc^{5JQ}uz5;8^}Y;QGAdz@#hlXD3ah)dE4)9hbl#9D+r7j; zy03pJT6E>X$!@;`w<^3jv~59yA{Ub#gG`(Q3muvtfjHj=4PU!Paec1?ejk!^GloTm zPIq!}T3L~l=%mp=xit9@+>e4k)ztfzD89$m)k9KT%!Aex{nz{9FQ?D`)>zr5&K83v zmG&kk0T5SyVY{?9`rmW8%E5~jMw?1rd=wckD^NaRx@^=Sn-k@&lSbE3 z^9*g}6r6C_=U&Sp6K#HE9FZ@(mvSZA!7A-R-6(~fhwksZy=zO)kG|o`UxVPf1NQ^6 z*Qtp)!(KTgJB6>9;Z~8Cbal$QiiJ(mqq{Wfv~H+wyE{`pZ8Ir(vv=R!UI%*T^p82G z>@X>*$+s33xw;-kLnn3d@+kh{qkDI4jOu;2uNNE}G>P>2Hr^sZ)BniPm_ZBj9K&yT zJWyC2-Se)4X8n2>CiUIxbqU5N^#7GtFP6tSwlRb2koAzEE{@x~^n-mEf3o|s_gk{} zQ&G+Loqcie`~Jk6*V@dQeSB^+wd?u*Z9+1joxiv3Q}9uLTMN6HmNp9_ZTrCZ_}BfJ zb+;x~neDP#_zjHRv)QEn6^IuRJJP3d{d11bE88?J$_u&z^K$Fj%2(^W9`y{KpZr<| zCB?VAc@nO7mA>B}>qXW2lHS~4hMGp~fL#N7ZT+UQv1McXsW(*=>@InFrZyhXX^B&8 zvo(kM`51Jrw`k~!(!lI7u3@|Dc62|~8s;_Fu1TE!IXC0El{vdlfqB^Kjs0BT$gf@2 z_1Zo-HoRS{S3?}UR((pjROla3Jho?uNyjCM2N&c7$-(>v@t|E`o|kRsf?n#En{ErV zS`_xP=T*~{E3S7N-*eC-t!!wQi}{nXd{5r;YBqW5u6n&EeS&sbHz4g&kU^Vo(62C$ z!#>>a!#?y&Z?hZUE-1`@2hTs3Ee8!Nwex>!>K5@>r;ls5rrG@}R4szT5}YIKH*eKj z)}ycbhEVMhN8x<|twocS+;`M^_r=xZ$i0(UH!_+&IXEY+&xZcP(^vf1suk^V?fUJy z5s8!F{u}a#_cd09H>{O2B6!1Q`wQ>Sn7EhTcT{#gH)XG~Wno@mrd48P=?=}D=#|&K z?`l8FxHGDsMyqrSmw}h(?|74Ao;2}wMSgpgW(VI{kC-|AZkMFas*fHAIopq$daP6K zv^}bFMShxg=X;KeFtjc?9BXDX&~^4+5xl39m^^)kRwcLz$b)laj-QG~8*4-UP+sURYSwDQ~XZ_Oi(`Ot?cW6A!9NM+T)g=)} zy+(Y8dcgG%`l0a!75xbHzf)*tf&K0dRxx9 zDAyw8X!p^1_nelh7~YIG80>m%y<`2WXO=IL-*~I_kvh-oD`=~Xe0uGnfhNRX*v84a z#irqDvhiI%XS|GUTG;x3jSuYr@87_FgI$$4cJo?hp4 zek|Np`~|Mdu!VX0`3hw}(Ew2ZTz3~OXzuk=JS9j=^I7v}&SRg2e-7V2BX0gksP~bT z8+uG=Fra(UrHkf{CEuRHxQ6#DWydwVZ&Rdqqv*B&;^p_%Uil^34w?w_UvAN+kGIRh z;?BD@>7Kv5&cdI8u04Z|E@+E`XBkG%o!{_J^B;^uc+R&~PT#LlY;GJp(O&D(f$OL2 z4vads=H%$akKwvAMpTGRq5S@JuNDTF-g#EM&E(~&S@kTN8vMREf7q3)<6<{=PMx}z z-|xYFq4o9eU7sG(@jS8HVy-8hQeqOoAcF_|3Iv0*QdybsE=ogf$ z*!@oY2iJim;Xb1W-zW`lr?PU<=gMjE)8PCQPxV>fF7CDbx}l@p%->#L`F|Y`+7q6u zAzygzRyo_$tFY{dnqLdwOftL2YYa-K(5@;Cug> zr*&Uv!}%aPk3hUR_2aFQ+kHI**NfGop3SU`KD_34@`%+7F1Bp|*Nfw2VFz_1M{fOB zJSZ=`kN2neTed6qcVF2u2;yhP&+R(Ltgp_0jsJ4FjaLW7lx|=2ZtnhG$94_$|? z`;PuFiYmFE?rc_ZIu6FAPQ~yTarn&6JqIb5U3a~GALgOuLww9^4*T3r?{>CuRbiGT z%tNYAcKjOsb>xMJX|wDrKi;;!8F=R1vi6so!TW1F%MQAXn3t>fcGrrqF}4e>;Qh64 zQ&yNLy(q8${q?on{Lh_dIE{3_6dHLp6z(_SefbMPzvi4i*XPjW)aLR#y2bcG`N#M* za%!Vs*nZ|y%^oGeZvNou?s>X;MCFVGSuZ8yL7(j>SBH179DGAzb%i7Rz6ZPp^%WaL zM@+0RPi*m_rDvK6^bmt;yC7SzcJ>KM+(HL9~kj!@wPV_dV2PD#s_*8K)OH0 zf#Y!fg?$(w{RTarvcdVTb_coGqi%k#HjvNJ={I7F!a|3HF7%&b(9SU&+70ICU0+T| zFPtzZc6HYa;}SB$PiIbd_+Yi6)OY%&fgc=0rS#2u5=ttg}Hn16#W8c17UBgav-mtr0yEmrGoW?>r+4?|S z7{73S{@3yUC;w097T4J`wX401#%dPugf#YKjPCKm< z(XoC}-t#+qZPN!qysyhII3^A0(;w1ba4oNBmi_!fT(HX0FVA(}Li(6tm%T%sR^Nkk zu-(=C&dE_-!)Jj9T(rUbqs#CWD`DRyeAbh?=`Zs4_g~jo+^YY9>jlUA4DWNNAMD>= zG%v|Euw!wgdcm1oXOnVoL+8(t9gfU}^ycQtDj}NtM#z?PVpp>#S2wJD0QpaxJa6CE z2`6X&YddyYder#uHlx7{8u!9`NBqU51~n-}Fg(pgO_4PWgykSD~EOW}S_z9P*=uVcw~81F!Fjf%?Mt7Ct3a_PH@d zvny;NKPaC$%Lldt`*jbG?oc@n$^%r((b#pF^LrqxLm)iBJ6SbJbTCw z$_4$rZF8W<(>0Ofp#2ity;-T7< z)YiP->JOZQLPB>3N&QfI;U_RpgpzMPq=-L3hfh}B*v61H2& zKmSxwl-Ts@n$f3qYSD>D>`p3mTkg;8Lr-(PpjEZiP#GKR?{0H0WKr zg3;j~XRh@%Jt*G-jxTNJKPbwydvB=sjdd@#zLZbV)N;L2erUW}uFjY-_qDGk-+pX! zF)bwXmI%_pR`xiggX4`aKkblQkUIEJ-mvse(Rz-PoD;n#Eh`K?@$paP&1(`}tIXQ> ziF*Gf)0@{>_Z;FEf8BVyXk{JaKh*=g__fm%Bivhr{waP;pL$^jj^7I^9HpPEf2ud6e{HqDxow+oGyd0dLY%OX1z&cE4(<9^dB4mVd1d~oVO#!`AB^WN z$4*{v+@+C&Y&^&hwsw7d`!4yp^})a5nT3@tol|h`-M`}9YQ9Y6`HQFrvL2Kx?Q^5= zy{rvS{OLH9D|Sic@E#Yk+WyOXIs37hcH-_`3)a^&ndf{qUiQ3&^Qoi4`&^4YjpzR> z-a7xA`)2!G@w%N+KfOEpAfxPfhw}BQzi3hYC2>PiCykl)^G=HWpT_UM#`iX5ah!i< zZ2y0i>s0E#x9a0&X8ft2pj_RaEbi#E-rM<4?V)bbJtT1ZMLCs2>FJ?o3Xc6N-#4u{ z`{;G+_To=oYEjCXpSBJze>x83+OX=L-6ZihPElh5xfG+S?~ z`>%Ge%UN@E<8+0}e|e2<#~f>|v)=h%-r*k}Jxmvc+5gLP>iS{uFZJ9OfAW@F`|TPr zIqT|m({aDvxb1qNck=zlI`-TMORux(Zn-U@;-(~S)!k)mr3m)}aQ*Iu z{|Ag7beCVGtzFzDJfMl4>)NZ>SI13ypl%~whcJZGT)X%py$qu}q; z%86eIzE*4C=`~^2B<*3?!QYvd6JN(Kr51x3p5p_?Q-r@)D<_5<3!Bm@aaDhq9)C|2 zFW9Lil1zn<$cb(6LA3Prd_JNoRc{K(pXHKHg}xGsQb`vXzSljUrNRzMHKFRiNuz(C zgi=9Ss0OKyuvFNQ&I^AtR!$7xd(|2{?q*d9Z?II@kxqrb%_=80VaMmRxLQ<|N{JO5 zJJP9?NGi9K1@OJVLkHq$Y{N&(*Pa$vqRgbA#oB>SL0mOJ0-uA z%!@j>_2k61$id$}UN<74QqrM$;ct*j=haA19`r|JC7g*X%LfP@^d~_i99%D)xgms4*qKbIIkgzzwQd_-nj;jK5=l4 zI8Iup$%eu>1~qWH)WE^DmJ`oM8R4r!$K20oB9ZMcls$6F(HdWGJWeL&OFDEs<62A4 z8-{}MjIS^Ma`4qePK@U#TzA!8$q|xq=om94PCX>x^UF-T<4R$9%!mW$7asGbg7TQx zz_B2XWO;;fETx<)=NFF`I^Cq4^?9?sB^_EXE8?8QYxHx;v;2#&Ufqc!SuZO=y{!N0 z(7bvO2VdLqTsN?GGfiP$`0rsz_g4==UcLV6(7bvR#~-cnqB`%{G|9ZE(+3@q6JrP0 zy>i&%YUb6x#94;cxXcDm&!b68cC7XzPCQ!U@qBmb?8QQ-KXHbmHBRk&Hgmnu896@)JlIyS`ldwB*D=kMjQCC=Z=V@I67m&cwsifE0`om)eiqlTAl9|z(*K^R}d zl4Fi;kaXy|Ozvu=?nxX3{q9KONRC6HGnhDI(HfVhq#!^`(xLr6gg8Bsfcxv3;@z#1 z<)Mxfad1E2Wvolb$3kZ)I)d)ZQ5-x+ImW+37xSvR(|Qdf4wSiDas5j}1@&^4aw1jl z2MZnCQ&s0hzSrR{LI+)DBpf{d2%V8qj@y-zp^^@*`zYezSsJ%t_1CY_#KBht?1+vV zqJddecN%95aqt}lc2+Iheo^S)o~pVxuKr%jg*bmN&p6^VKpEkA^F_Ctnv!|ZzHlWD z^u?BmGuMw3^o5(06P}&YS<<2PawkqpR9!qL+-qHdI;X1cG_UbeamGi_-{3CDYXWg_ zd2#z#hbAl%Iv&KqchT4>TQKW@(D5V=)a!KEUJFTwmf4Fqn^2H?=v72V`z^vUPb3b$ zV&c5EXN|q)B~fM?XA*HXAOWBAk?S*&E?f7>#KCtIIL`V3tr|~~h(p`Qn>bMSA6Z={ zN;)*JDa6UbYxHAuJ^>B7s=TO!pP1yt__~ap#eI4=6FR=cX@}N$IpO~`P3ZWcBXZ)7 z#6bT&WAKs1LT4&*<}t_k%pr8amn{#v%%C`@@f!U!PHTx0RXMco(}@H9=mZdF2r95TdbN1!-eZyu zE%PkmK$*|0wayL@lsS+%Fjn&qF3%G>v!xurn8Xi42j^Jz-0eN=_a31`u1fsbTy&`T zl+eLFRdrvdweMDx&Ed0yx&s(}+)0|%W3s15&=7ae2hHU&93=p4jeheW$~^vsuhKOsyi zj+y?u{!0YoCtS+GbEeQ)N*rjPtmccR2%Tk8aqu&v(20K>u9 zLdwZWRjVy@R!TW$Lk&biCsNAkaeMt?Nr$#`6meA0xvYj>8I(n!4Le!)=0kZ70s(+c1$hnrMxeaQ7}1 zl6ld3?LbH5#F}W0m+GA)bVN>^fz}G>=Ujx=LSdYp#A%GyxL*C$9ni^LRWF*?E-6Q4 z>5SHRc^#NY!s|t9Q^PRlJ;AJdHFMp)8pOFzoWHlvgBmym#KG5GyeLNaR&#zmL`USr8fcBnT(*5& zPhs635$Esc`{NooXsShd{XNc;8aPjD;5;LaCR*dA`Z)nj$EZA-XpNWZog#EZPK-x> zUG(!SYE>6u`@A4dAX?+`qpqtIC3IdAX9sh1yp>xDonqoxqBWlDu8dwAA#_TJqbw&9 zwLq_;%5R|oh0h|%=M*&TP?^!ij~r=`nf|*(;{I?B;^;rJqMxc~Pkaw4blwmL;;fz# z?jdwarJRXFzjqfpZ>5~3^}EFgoiZt>_(O}eLZ@8HDW8?tR_LH1E>SOh&o6Y|*TAVD z&K}gXYUov<(UDn_ap?W(2jVEBHSU44SMH#P0NHutBXP9R8ZVdTteP!!@KX%!FP!># z?epz~&gU99UuxidCC=Z={Eawhh>^vhkKSrwdA<_|kBvW<`3G_Sp4ZPB#Hl1sbCy^2 z_dmagV}#at={Zo#QCQ~R=*Yj?8F%Hs9Q+|3`kagF-fToxqA;&oHHafe94oZ0gW@cH zmw~1b+3_P!96U=apr405R-+r4Du2?VBpo`Q6^MgB zvxCdC=0{$C$-JneSOW)tRtVi2qhdBdai-)ctP#ekOPnoejpx;Kb8lozI<#KO#A%O? zqZgv%JC`1ih_e74$LDJ0^Ty~DkEY-hK(>AKq~cWHhMjBR=u0`W@C^8`qx)_u3Trp}Lx=E?37j;Z);Fu8yT_DMI za7)WJQgalIWByl%&hr+;!EKCQh?1OtS2M3#5(nQ)V8{1!$KjG?rg6H}z`<8`Iq~1~ z>RtoKnmA6VEV$)dGG%ut>1_2S!xwpo((qK+eR@L0u5xNco^*{nKGsWX^3`1*#I zO^aPF3!Nb~aGYx346T7PtOkxVaUP>Jy7-H`W+5PiI8<>D-8 z=Mlt#e#h-BbVd@VK8xdA`;ofP871XhQ&4UqbVf@#6GZ+Egw7Z#=Uc5^4Ta8FDaWE- zSaYG{BIP8i4r?Ll(0(6BoGi4)&vN0Xenm>QA$44d17lXc7HCxAG< zEY8NsWtl=}Rt=m$;%r87aJ?=*_$+lFMaRZ$;^2EW?5zHIa=kFGImEeuj^k&djs};v z3Z1#cNn+01^YyEFzL-ax$;iR&bHMC-HTOtC#PMg&q(~i9EZOlKOdNDGM~>)ERGlw$ z<`W0k2`|;p8zIDLfR5uF!WJZ*6UJFk17~3koJBQoLTlhGu7R_p22NNFoN(f}qqf2Q z9uxN(y(uf(7fXqQN23yQ(lt|_3Y}%d!B5usUaH}?kZSG|B8cO`@^Zd-@j9KU>HAT1 ztS%=`TjbzH_wY9zVO}eUqk`6W4%&BDcd?{H=hcFXUsxr`YmJnHKie$n(7a-agP*(cqV{tY>NeSaUrU^uXpOJ$1LVsqBpup@>!kAf zIk@@twSw}jmvV4B3!M#8&RqSZc9IS)^G4#}c>`ZhyKP)i&HF8J#94_Z1x@6n9omUb zeT1Zb53-3kaLT*s(aNb=oWx z#@Qnk2j8pj7Q{&=js}W@UWj^|ELi9|alDX&ms%z7M+%(-Qcm9QX&Z#jLE_-{K`%s|lQZpwPAYNW`F%t5 zgKEl?R)aW)Y7plzaW=B@eB7RsDlAVraU7VlY}$2Qp_4%z{5v4L#O%AYQ|KHa4t`G$ zFWwgSeS}UXaqv4B=s{3)c~w$@q(kSrqr`!6h{sQ+#Q34kG2)CxG0+RqrU6}MN;-6` z9w$yyG|9I?PGalxs86vi`FoiY#DTo<+;Uuy*GVbo>IL6ep>s;gnHn~1wa_^&<=|_j z(8-c=c6A6?EOgFDIr#JHLg%cMQ+=Fs#Cd|&_?dZ5%bg~YacCQ66K5tmj_+GO*4kUm z_3J!w@O2w61A^8*mh4j+Cxl5m|%##=! zG|pw>KzZKIm~vP$4t1^&2e%(ywmb^FBy_GyIdRQe91uFVwDj{EI8OEN|6C^yo(u6( z{k{4P;`pILtQt!DC+N+>>(f_r!(HeJMvn{+g%Ic_8KB?^_9-0^;B& zEPQ^MjsLz=(xGGHA#w2iK3)`B>9>;X3+g-~4)p17ba`5-;gwAUz2VYZ!&KoHQk5!>lD&^qsU`jf) zo!=4%P26Oec5dwxVV{-}2aiTPPwl@qWrNTuuR)x5#BrlpiDur)spfYj?}>w-L~vea z3i;^m2idV&L7e_*jmv#t_nB(us1L+}e#dpM5cK;;DF;8JNjkKBJ`o4Mqk{9geBBxS zTDz(|bo_jlii5}VCyBghoG-+|ckFmfPZ|@kRT$^1R2+N{@I@jH&Fh<#gYSPN9h%p7 z;{3gRen`c^?ekrb*H0-2w~wSl^Qt5c-1|KqF{_&X`b8Z4w2PPFubtv0>rUhRu0b5! z@N!~(7AH`v-g{vjF>%n%C7B79T)h57=+vr#BUb}Qz6MTh;wa+Up)zd>d5^juA*ng4 z4sl?t;_GScTKKL(avoEVa_V0>X(H*+HdG`Io;mS-%gfv6JcW5FNyWkMT__6jsw?H- z_X>oL@?RZV9{i0hIq@d6ZidR!$1J)?I6tdO#o1d{=a!0~JZe%79;-s9o|J>{0fbI{ zDX0244Wt}A_X^`QlydMKF6q#^HzJM$>I;1Rc4$2rJ!0a4E7_-wrQ+c4>opS8y@`~A zKQk$G)TJDJA0_F~@-!t5o>TEs{rAnA5eM!iBHJ7*mmEJdPIKb8qZl~WdG#mNJjb;l z&NOr!kK#6;6|9AEG-{9+{-(K{I0(f+FGN{;%#I4%uoZFO+`-Q~EhXBJmbo=?I-?l4 z%)Pc3o)^YxBNYeFy{!dtG>Ov_#lXu^heqgj03p_=G_SVA`TO-$i#X#+6!dwdQ{&LB znQWYP#QFREk2Y}{p*VPCMQ*-@?zLp&=n%&Z3HUzKGX9dQq(iSM?TG_zh_5L+5_P9e z2Pp@iUqYv&l!NboBpup5y2QE3%KYK+;R%xEp-v~_++t3pXyXFvARrort4bD4Qdg14 zUqFHc1izzQm1;ctTW9Di$Pxs+Bxy}e}u|;T4Oba8iE@O^APgNIBh-88CbYi5Z z7|0Mt7I5Ot$P`|lOh&A^(}hhrXSg$)5jpN$W@ITRI`~EbEkR<)J(!UloTM<~!y|uZ zqz88b@kE7|v)nnu$TBfRZp|KKgE^VQNIXxqfsx;w9A;!QCwCdq<8i(+Li=KUwSCdN zE-D^cw(>YujEKZg!qJRu;Z6u6ow<_$sgUC>j;}VaYzc>+SXTw)fq;|?h*%jFm@H7j zW&+Y#K+FWBzkoOi$TUX2@w!Jbk|c)Q?=f_qIl$wjI83M zxhjr=K65OFINceceVSTrJG(Kb7Ecw-$aWri8zcJMIm-x*oKbD$A_<4~U@iQy7qmPV zLkW!-dBVw7Ml?CO$_UNtM74QUGRK~m*$cn@kCywK#4ysX7UX`6kuThN%*c99l<*}V zEjnUIWyAd5Rek^Zx46 zgyywe3?+19M4giuMriL8RNFgem{XfauCGob$MQHfjI`in0V6c>lWHR$VNO1;MeC+C zaxI=$AtNhzRE`$a)rlP&&W3JWHa)ZJ0BQP&M5m|O};=_mv&wV!|7rFC|kw)CH?Mvgd=41^c z_e4+&`F_-q=gxgbR`JMd`cr2LCu##IY0k+KM(BtNuXaRzXU;R8dsiD8$DNZjMv^$G zV59{vq3J-HDx2p%myzb&Imt*kcjRnosxO>OX5o6k+Ir+{=9w+?<(NuU{i@bD|B5o4{y#2h)*jx*JI-5Bsd7OQW z=d_YBb7X_6h?k?g1?`C`L3mSBaJxG8IGgi z1^4o?YTJ1tbI$QLJj_U$7$VmlL4t_haWb9}Enc1@jQrwGhmkauh&vk?nZcdcj5OxN zdK61V%A8$onPZsKkf$n^N_C;yR6R!1$f`WmDn{yZ@)-zkjXh&%s%zZ2!N?U(#AB&* zm6O(tT;`-VBe|ToGm^(i7$Z5H>}2FTCl?qg<|Qm-bR^uZwtcLb zqry{pOQfPRlHxcT8ONcdDYV zCel<5Iq5!$l2)9&Vx%4?9lWX2oRdY2G~=XzkrtdNO`)kYIGMsocQLeB zdmrj}a`KE3M^3_hsWXj}=6;k6<76Wv{W;N`N*yasHcX?$gOmFHlnmkof2Ig8Q^ioi zi8Bch4dtX?044o6(Vay}H%=ZgGJ%s-fz+|%#Ar4pew>_P#EBE@In?RPNfslPoCM6J z&Uj8b&ZESJlZ%Y_axyB2Izu?Q%}5_kMg~)-Kkvb@^C`*TL@tDq_MFUTWB@0#7E70}>qQl9SFzR&Xz$H*>DvKiUKNrMwK)lp7789Bj80wXs$ z`N+sKPTWq4$nt`dLyUajWcDfQeCDK*k*}QipQg?aPAsx0sZ$Huc^xB4ocNugjw&Zd z8EMQ(v$ND`#mRR@+Hf-L9Cg}rvW1bRyx#+}sT0D5s#C|NEUaVGO~q}`WHlGIm3w~BlUTlO}W%*!^y~t zlo)g3n@5Q`CyOpoV$DhS%aruuB;^Vv&YbvNrNoVsbBs*j#Q7R^yg5l{#Ge!Y>(mM4 zB$<(LPMX}H&L&RAF!Gv{C5+S&L!TDiq^XoS8Fh=2ft)Dbro^6;Oh!&}@`;g`oY>x> zslIV?k`XmN4wdq$6Us~2myxqP)gnd~bLTiCnw-qOOXGNOqIi#z*_`xdWGN?m8F|A= zJ|ng~_wf5PjsquV4=5SINhl+0II%CF&U#MjKBVLlCp{Rs#mOp06nOiTGg6n6oJTZH zJx&@vrlbic{)}|sZM&l zQ=Q^uJR|v>9A@MdCyF0vss_Bw&WyCjD>*sE$U9C-7#YhWn|!5l?s2k|kvE(aFcQq; zH2y|Yz2~F{BQ8AEaz-|AV*8z@y3fgGMwEHW&-_81hMb&cM4jig?k9ETb8?N5NKU#{ zQYVJz74nM`5prsgm#YM1hk&FDNS+k&^YZiXn=Tm{lj(D1h~Kn8FNSdL$eD@$S(yZx z88E}wYpNvCc5pO<{SD|v9T6giMhtZjGhzwOYVMdbqy>(l2_tL3F@iYlz%j;(CiVqHZEeQW+YfK($edJ5_|W4<{y2Q~XU*nhGkm9P$DnQU_w#m30RG zz9&g#jL!nR#BvAf)q)c!Pd@Tk30ZkK;pM^KS|yGpZZQ=UV+F*qgvgxmRy_cbd8tYToT8~3^nw7lqw2R8JV%robbAPa|i043%Q%XXlVwHA(=SP zaeVtrTOPe2OB?P$s^f^$_5pGN2vkDU5mIr2FNe~R+k<0>PnE}L&zTeGR8F8#McEJs z27)MsrvhoefE?fi`r@E~qyd4+MwAYOpUa1VKvtr?Kn$U(`#6C>O@NSI{)B1}2esgH zFDFJ&v5nyHxmOqBkn4p%I=+z;IF~tr%tiPXhxQkYgiesk7`H|s`Y{&}Gaw`{XXGSu z0(o&_isK}qpSj?eLIZI^GH-yKFmRxvRRlhiBEk<;w9Ht-xhFs>-WQyh|P2)XXy?@8mwc;Xo2WcdFkQG&4O8JZeZ z(Y8W_pHI=E~cV#y&RRk`m-?;;%0*DblzdX=S1Q2`+Ko(BOT=x*=bsQX1 zoVz+IGbLCb&dPjF3}wdk!b?>uxU<6FqbKc*Zx6{*2$A8EB6~z9^8-b)kwL*Uf5B=b8=o11bTovK>Z1<2y^D<_6 zal-Ek@L%L0jv1clTcey;LGJv1l@oqfFa;bwo|^+Pg37x??qrB%pglaZle{e9iq8q@ zWjxE`zl1;>-pibjr-_-!$%edmc{m|M-W@skuP)Fy(5IYmC!EIthZ95m__qTc{{oI7 zTw*yfvP2y=4;}vmj&WDgKavDr&Nrar@3{jPW={B(aXUDCuH%FZLwwZ>0f*%zK@9O_ zFAE(X2acf`>z^uuXGq-3Gr0p}j1w3vqU$I>(uUBbqJx~kd65Ui&=9@C%SrS@Qjx2$ z8_EaICX~Q%;e?+%^`Sh**x7{kydaJVt%3jM1C0aoMkC0bm**TrCeQc}(eW~H@TGt(obapFFL20v z1w?|p$h`3$p&8(q;=aHOC%mSO!QrGK5MDx6AckF0H*Z0Eb*l)gSQRlrk*=ZRdE6my z)1cg|2tIl6`vf`Mf#F+4;HDP8QBK?<|Q>3Ij+*2yU&eK==%)45`eZzpep+ z;UoG8grAk$IDrC*Au{Pf{KW6T9b?q2PdGtX)D9I7-;)d$v2)PSgbjM03Z_+2A07wy zaw3Y;@c-lPJ;0Fh@*85fKnkk&Ga)yW}WHMulP7U0`988we^WqJR-Giva}@ z42U8KNH7N!6;V+PpqM~K3>Y!|>pXR;svl-{LD1{>eqUeL%RA28cRy99tE+o@dS?AI zc%y6nD?D?iS&tl-j`xf^lL^l>ZD7ui40D8MnrdJDGdS)nF|Sv4j6c)!&tS#X&3ZbU z|6#lPXF9lNT(^?i`SrLu*K*G^c7<;5o@wZq#c|J^?4I#wAZ^_<-dYs*OilNU8{jxs zK%1Mm^fr$1>sc80Obz#pU(c!Tnfmg!q>Jfy&+v@y-~O3qqKz|*^v~`o?%dBm)5!Hb z)iL;zRmhLr1+GOFyF-E175ap!esIi{)WMl1J>-FM7?$-ap7xB;G2 z*FEE;q*L58{z|E|i>=e$Gv2E0p7G~(OWiX#lQI91BqI;&X&^hQ{C>^R;Tf%}e+C<{ zn|b|k$M|Eee@1p4EDt-zy$MJ<-#z17IKVyANIEaau7Um;w;ultj?3odq$eHYuL<{e z&-fai>z?tWu7i8VkLQl=8NXk2cF*{|sgrxgx4Djc#%G;@XX=j0NGnP+56yC_sbiUa z4z&M~G;8kq?YH4~wd9FeGGUqpOj6zaV4Vi*Q1hC3BVjHUY?Eoy$9UUt!tY*~3yDlGF4mXq&ab&a)RhRMmW&w`;Awua?qwl|x-aKt6Pg>5wp47IQg zwQy1Wa*qZpQ!Ox*)fUz<+QMs&X#eF1KccQs3k+qoqpYSK?!Pct=8yDZZD1&?J@u>p zB~zNV^!;kEpS8eHRtL)J|Kl~c2kSAlz))64SQWHiPgQ#E^zbX-XY6mYz)+SPo9!=n z%T}JzcFp);U85El%IXZu)$r~aNmoqv{o1S+7|QBGS>+eJdQh-B$;DT*fT66ezF*S9 zdmgJ7u^vzh3}tnrtd-3tRSa2&$YoTsfT66jVI65+ldK*6?|d{^IckBStnQTc;5(yY z!Foe2FqGAU`qkn5UaNvtUoNbg1q@}KLs?UAFIo|-8`T0sSv^bX*H3DJp{!n%_1luE z>qAyQc{^qnFqG9BmfM#nrXRliB0o0FpN577hO+ul*5T8B9~`U-hgb^?W%Z>j*}v}d zS)ymYX-a|8+yRDL(5~wZKr;K+0NG z>;B2X`a>-+lr@O@C1c}apEdY!+d?pu6{D=Jw-kRHtY_5%Ls^64vhMQR>m<2R#4KPa zD~+st9 z@?jlhUX!e4)lO*^tgF=mL)HbbX>u{c;`rl)mTcu|z8YKA0z=g(@|JAn7VqA+AXt^;(yv*-P*$U+EijZd##@rL@%K+-!Fow8FqAdcTQ2K#->)Ck0z+9Bddu}I zSXJb953_)wtczgD*_SM%exA4SW1rPdEijaIF=bWTc>9sTdQvSglr;{PJ4=z-rkc;H zD>rkQ1q@}4r>vKUeAqZxnQDQdtV`muZVlT@EijaIDP_sb7OdCR0z+97yd^!5aahy$ zE2+Hg7Z}RA%v)}I1*^VVU?^*1T)!Ui{Yp~{3}szTSrtdGe+ofVmkHK7wZPDO^Q&Rm_9rEEykO~%Ip|mPy*U_a;WgAk*;Cf~YMdk= zkDCPyweVVM;loE&TOX``YJs7w>tM!tiUdT_9|s|AL#rcu^;RhxbotWzr4YJj22-vG<}gJs*TTfVVYwDMr6g*U>I zcN}8YIpFed-tmd z3oO}IvJ9-S?8;#6PzwxMxB3=}HU7n}mG;438Ib>~U)k0W4E5_aZ%N+PjGp)B;1+y|50DhM1-7+lTfJ*0J&-wpqZCH4|2JE8pZR zpQ{!as>Uo>Zcj-XU**1F%~J~uW!>j3X^U*-N$roGe z&kNS%nl=jzS&zYTdx{**=lc=Wyq2}VP&F37a(jxL+XU+#wZKr;(`6EUq7n_hO(ZZEa_LU2G_PN1VdSiz2*8<-uG*j zT3{$^iMOO*GS3IAeB(0z=jcSaSD{EO`rlEC|+bYJnkZ zC9G=3Fb|SG8F5-U`*+FBe;f<+feGQv8wiX!b*DKVo zUg-p~T z&1r5eFl4>%`z1A$<8m2)T;8{ZwZKp{-td-GU(U>f)vu+sz);p2Sn|1pd5|>q)Ds@N z&R71SR@MSTS#MI-+s8c9Fj$-ACM&{%vAqLmL;jZ|xaA?qzzuJQwB{XHUB>8-5= zhOD4slFG}mGFbPwvlbZ2 zdKXso9N=ZYFK4v378uHUkFw-g8LVSESPKkgt%v2da`l4K237F=dQL4cl=VJk)x2ua zCBYik(Pn|6tPfzht-SoCWnTuXNhfQ8A?rg}`sXAoy zj9@L48!F8LhO7;+qSg4!S3bXswZKp{Ho|hpuRHooniZ^@)dE9VAH#}PBUnq-0z=j( zu%gun*2ijrA!`#XSB+09SNv4SClVtbuBQ zp{&p2vX=SEU!fKl%KCz`7G?f6I#_em0z+9}#$_${Sud*vhO#!tWd-YNwZPDor7f^* zg)!*N-z$+LXY|Sv7_z>Kvr^(LFx0QFql5_29Qtaf>o>*7_zp*s%OTKnCmC( z-#=K()dEA-Pq5q>?99wRz6jPq-E9lOko7YxHv{ZgHF9aNdZ-14s__dfHv`CBaKXAy zEijbzD`m-6e%_C$U(^CaS-(-%som$i7pzJ>Y`?%z*6(py5BaU!LMYY2w24;#Q40)Z?c*&u8g)-TuTik(s0D_y_J!r%wN)-%k~QlWgQ4BTEk!^s|AL#4x%inVX!V#3k+o) z3@cj0U@cM$3}wmpio?B*Qo~?Iuw?hqvRg5MZSio_O{gkLs^GW*35Ssj1N{n zwZKr;;og$%wd(Wl=P&eGm#GDYvgGgahJHPK=G#vO%S@=UD*VmfGL&^BEP3Z^9wc4e z>+)g2+NKs5$|^@$+c(}cJ6I?8u~}d!>nK=md!?+MSSDC8wZKr;(Ueu==w?fUb*oxn zDC-!XC9PRh*rnCOzJ_n81%|SYrL5H7JKY$pKh*+5S;xVW^Lfd7@Ux!f=lQHUeQhpiu=P*x>aZhK8z zI=w}(j_zms1%|RJQ`TcM52_Qav(*AaSyjAcx`lVX$NCyxsTLT@I^J96LDH39T)A(s z9#abpWmSdcuJ&}S+3CLN{v6;vwZKr;36xd0($$NDbzFa24KS2d4OaB*D_FhM0z=k` zu;jXptT*qmm9Yg zP*!bkNtWD!9IPE`fuXEZV9B0hPI8jUo^jZ{fBG6$JJ;3_3}w}!tfV^I(}R_&78uGp z6;|}RXt2`M0z=kmu*^SL8eaM1=fS#MEih!A4oi;a(y!UaebT0mui+fEz)-*H!g6Qk za@S(8UQ-JUWt{=b?J08ICRjhH1%|A8u%cHgf>r4}TX`^K)rV#N!P4-P-;;vXQ7tfJ zHGt*L0p#6iLtl-2wZKp{8p3kbXfZLrI9RjP0z+AiC`-;an)R878ek}^31vyY8u+Z{YJs7wrj+&Kwavc|R*qU=DC)8B%K&zIW$XpY^#~U?{7lx6A{a zV+ZT}LAHfpD617LcaD9>IUjx>thH)^p{!)e+NWUchG2D$*(@-Wl>*D11IYW7U_GlA z7|Keetl}##X%npGgKZWV%4!WOx_@2aYq&ryFqGAXvgG?;!K#yHv%pYRTW`tslB3?| ze#X96EijbT&Rga|l8nP(y{Z-%%4!eG^-IS5y}n=D)dE9V9Vko2VX*EQV*3S#vO2;eB}%M)}HbR0|AM<7{u42iPlv zHEo#90z+BdVY$8X?blZ>3Rdgk)&fIWJt(VA)?Lp8>nF9qP}VuHqI+eq=4RO}FqGAk zvKH*<-8NX~jj$FN%IXEnjb1rAT;^+d_(*Gkp{(ANC3|JCo>2=7W%Z#fxjMJnkKV#; zn+1ll`cl^2|Y%e5^8Ls{oiR>y&5zYW$iYJs7w^I*BL@y*k--VfHvc{U3SWt~r1HI~-w z8LVs70z+8?VMWKr<-UeLss)C!22qxbjbIJPw=D!iSut-(;bq3I;`ofRH$`{xcf}yM--jb|QTMnojtafUFp{#URu7+}SnBn`Cs}>l_ z%AhRymS3=DsRf3zGGWP;3R&b^eh2uhchv$zSwku7rBx|yf>pV|Rs#%W4WoX^J?%w4 zYmi!CC~G)nZC})OaTL^}-aw$v3MzHQy3k+rD!HSNJ1AW$7 zwZKqTK4r<+2-b1MwuN9Q>jLVRjE!QSH9##elvO}kGB$#BlUiUXtB|r}Y)tT3ud4-y zvWh56#zwFX9%cIlhO&w&OUB0Qer&W;3k+qAqAVF3!8&rZ%>qMNqhVDu`?0(?AG;)} zN0HBZUo9|{HHNaz+wyuwunrw#v%pZ+SXj|ByswjteVD8`J_rSyxb& zeD5Y$tJMNS_c=_0C3}f1^1T~tMemLPL)K(iw%6u2VNYN3*YIq$ickf)Ak47A1t!U-JP}Wpf zu7=kwdF9>BzJ~javn>QeHN4)p&^$BCFqAb7mb`}*Ys>s!J`PrAwZM>d z11$MDM5%sK=T_~4m8TXMvTlSWGl2Brm4Sz~2-bA9z>swlEcXrT^G+Hc>DLOiz>sw_ zESarkdGe#n_X}B{sRf3tTVTn)Ec@8mjcz(HSO<-_l?OwWzZI4ny+{92d~~o{ss)C! zZi98OX8pDN&yRwYuND}xZinS+_`%1Mb_DBwwZM=y-CHIuY0zPfz6{nTwZPEmy@RZu zjyQU{wW6aJ3|V)=vbB;l`K9Zf@8AMMExZd>Jwr?7^K+Vwp6-uC6)v%B14EU+8%%buX-=j3LXW2e;oC ztQBg3p&HKg{Sxc#Z^|EUt!U-JP}VG1wT&S)ymp_m`EU9fexX@lsD}6XEb}1gwdw0B z2CKoPw(?*oYc?!5Z?tZ8;lN;xQwt1P_rppxIWq2FT{B_dV7;mq7_#QT@?-w*9fN{( z!UWqwFl5bzB{P6jW7Jz0)(X~0wZM?|0IcJTAYn@tP$a)l(Y-L$SesD-mu+F;Nwh#>MDUZRDGd)@Q zk9oeowW50p7_t_?vg@?w2iQ}h78q*bLc7%fXQK1T6VYP%#&`sPbg6E>jB(S&Lznw}nXh@U7411?ye4 zz>u{BmfK!3=7Uvhl5HUvs>V`St{O7tgLRo&U}$?i3Cqo*Mg7Xpv{rO`fuR;IgC*~z zWCmzG`HwBX`|b6SW`Us=E~gf@eCgnqf_2wq+b=MbwE|Xjdj;$KDb@l*)=F6J+~)Ex zK7Bh_Rj;%b7_y#%e6Z%K1%|BGVYzdFjTI03C|DcR0z=jtu;h2eW%=Uw zQ+^3nh3jpu{DR`j?WtR8BCp~}Ar%k3%e)SXi^ShuPLhO*YeiXNAP^^sa&$a)Kw z>|fG{`5zzAC|I?o*?xf`>up$Wo|oftu!_|JLwm|Quw<{4<%;(kWLYb^r+^`A9W2`t zYd(k38@0et3*Uw1=BU-*9r#5R|1H0j+Cnf?`S)PC%FA6J!Mgnh+XgU{wH{Vfg$SySn}RUmhbYuzBO14Z?+Z~s^N#QWbc<{#nL`c zTPs>aFl2oM%dXR!AI4Q447G3rEH|^sr_vk!Y;)u-c5Ps&@*BNn9we3j;-uGum8upP z%K8|VyQX(d`4_tf>jJgFP}V1u_1)$V$^>hcT3{$^6D--6rG+~VEgBuHchmwyS)Wo? zmr09X3)TU*+G>EI%6|sST_ZZ{Ic}Cfx#Mjo2>>IvbMl7|6p0(KKtNc ztyK#QSzp1Du_5DrewpHSbA2_=yxnGjp=x{$%gq2aHw;`7tnq4rp{#FUMXM34=hOm2 z)>c@q8XF7WO9|E?(`^gEko7Gr^ADCvb1vTztO06)A!{3~=-9a5SL0r_z)&^5gXOAm z__i;e57uXDfuXGLVMVJEtXg;2et{wD2UxBeGB$!WQY|oK{RqqagQdwM6Tb`A6Ka7W zYdb7=HFas34{tcsA02k61%|5e6D(Ja>y{RO9;}o*ZNI=!*3Yn_)d<$*YJnl^7g)7S zujKB}U&pOa4c4n_fg$TxSTaY+(lWKyNx`acmu(>!nr(iAB{{NG|LD>V){4$HU?}T% z%4%Erya}uPh>B?z7^>k8SgwX6W>l&jtR-rJp%(rD%eLQqx^!{g8Pq;Q+d?p89SF*WF12Nl3%L})@N#gA?r}zLaB!QCPrDmm1DDP78vT+VcwED%5P!> ztHpiR0z+Ac!*a*v&Jzo!O!M^q*1X#7-w4+GYJs7wBVk2HRIu*2-)4a! zs~jx%4srSum7fV#Y>u_SkaZL+H;XQRZ~p7SI%Tf4z>syc@0V0wt^Q7^=oG z-jd48Z(;;1{{fo?hO&vwlzu3}qeXEy*;no7%bVgp z@c~0EtN^Qq$&qumq6I&980`12t(pafT38X5+rPRszIu7EMn7cR0EV(E!HSNJVBt?X zn-+i}t1>J(k1`LEu5Hxv#b90Yu+0KPRu!LRq@=H2NSPC?s`IP`hOFaZxjjX`pEBE5 z<3Y8+P&KN;a@COE3J%r}YJs7w6JSMWn_xA2#I_I&S=C^ff3O_2=F9Y8O;igEStt4y ziY8;elAmo}Qwt3BtGc&j9LitT2v&vpwuN9Q>m+ZvtmplhAEFi*%BtZl>|eKRtRAdK z)B;0UHNEAsD*Ar?rWP2=s^u-oT6WLZYl7A8QQI#tly$PVT-GGtuj|zULs_-G<+6gc zK`k(pbqXwZ)a!rZurq)0S*Jc`TL^}->QL6RoARdw>o&E(P}ZriqI+eq$}X^3V8}WR zmb>eI!qmC%2dhvmFl3z$%l)3ipqpkr5UkB=fuWhLE-dp8mMd4?vdUV~^C&Qsbq1^& z#*vxroqMl5;3r?hevjLJfuS1KgXQ++Zzg?tN3hnZ1%|Tf!;020SiKk8EHGp>faT7k zqMNong7Xa#hv8h6HPlT3{%v3uRq;@yY#yRqJV+1%|S^!g6EdyTfl> z7OdH7fuXE!l=WiuNfU!r;~AR;hO*A~{W2v?lIu2we$3BO3k+p-r!0B@6|5@H+AJ_M z+w_3t=K0j0PpW6F=xhUqT6hjDH`~Zv!E5|^?@gKohFaK@TG)N$<39$g>2tP)U?{6s zT-KvLYrR@vD62PR$@Pt3o&3Db0z+AS;<8@xSw(7rp{%}fS;2ZyEijbT50<-bBj4Fy z;j_xWU|R@=vieh&eE%z0ebfR&Sp#6X^9}iKd$4X$3k+H3!jkvP(i-_q!eFgc3k+H3 z!IHgSmJ>Grc}TD-ylDFchOF~pxii?M2Txp4)1R65R|^bPV<0Sd=CI+b3+e>xPPM>L z)*x7}8uGo-U~Nai#*bDGR?U}ezrc_+*tbxsvGkhH?he)kYJnju4OaAh z<&k~{SgaNps>TqXCDoVTJqXtCYJs7wbXcw$GB$$M;$_<}Fl1%GijIw7O;8IAS(&ih z*pS~n2-a$~z>qZ*mKz%*k9~7err%S_t+FiyL)91t%Z-hrXWjL7uqLYohO&mka@CNr z5v)Jd0z+07EP0bn+#Dspx18z6Vc}|<1%|S6DXZDK^D6~wsajwt zD-V{tFGcQY57u95fgvj&mK#xzHW;=xSnXf4Ed)c>1+b)sLLA@w^D~2WlUiWNDj=&@ z(}8`1^}bqQ$SQ>8t~#Dst^NbSs`0vQAsDiXV7bbVnwio+SlMcUp~@G-a$~;YN%gaW z^{iT8C~FifcVEh+LBEU(R{1w<3&D^z8kReAc=W5SErOM&78tU|z_RN!r8i5kUQ-JU zou!P8vxZ_EM$b~fP}YU8+$XBnPU`UL5cvx=q&M5aoPO!{P)~G5NvMwR3*@i~P z2J1n!z>sw*Ecb47)+PNu3D)mwfgx*x&yvP8Tz^52V0Bz;TL^|Ke;F)SdAZLaShLjv zLt|qiEW1v0J?Y7~u>po!csZ=-5w@Hk8~eOv*9L}Kcm=gk?(Pd#N43CE)+AW&m?B5m zU|pvc7_uhAiXLHu^{!fA$eIGn&4;aOoO@=lYQ1gy1%|9EVO2Bbll}RZZENQa^GDb` zwZKp{u7c&Z*LU|Fb#Aa$sRf3zu7>5RAxGF?Re#5}5DZz@z;f^PZhdR=v|x=_3k+G; z!g9yTMK|`F60DEa0z=kyWXTaWSS{As7J{K_OoipDF?n?1kYLSL3k+plPg(L#>M39O z!``)7U?^)EWyxJ|!5XF(7|OaKF6(KZ^|V@GDCtS({P}zb zwZKr;&6Fi)u)&(D78uI91(u8rS=P0fKH?OgwN5QClyxg*$?x|D>*V#eUtlQfHdxh6 zj_hL>)qQ7Futuu|hO%y_taI*c`AD!o2vyP}YO6+%YA0(;x2!Yv4xPLNJu|5M|w0cJBCKEmsQ+ zWj*Y(q=x(a)PCq+zJ`@Qwpm~(YaV4i_1KETf_0->U?}SmZ%NicBMupr`+M2)Yn_y*qYO}yl)xzh{$_WD#UFqE~3vgGf= z1gqs|HVX`8J>f0cGV*ErF+S@SwZKr;VsFXzlDj^F^}SkPC~JwgT-H%OtIOxMgxI{EV&;* zmU_=$GA>w8ss)CuS7AjfAFM5EfuU-wh83-Ruxfr|s{w|xUV|k^2O(~1zoW*BzVd_B z0z+A^Q`W-bk^2VgO0~dH)*I9>IV1YgpAkK#78uG}Ls@-0UN${gZ>j}`vflKTR9

cOTLEps0D_y)=`#x))uU9)dE9V@4|9N*glKje73-6o%OA)1{lhEkFx5X zot_`86Si3k3|%8y56ixqlvHivlC9Q?UOxmwEqouAtA_ka*l1t*eZRA714AwRfLbW; z&4YEZT3{&aL&}nSDkl1@pVR_FSsziB+*1*({O@fG!BEx)%95@8wy*qGYJs7wjg%$7 z=@hIJf3R6#DC=Wb?)*@G(|aUPzyhYCDjmf#2-IysOz_K(;saM!B7jo zpcXDXWc2;P%2x{vWqk=NdL#CoT%sr)q&AYm2v}#+{1~*)Lc% zw%dMzA?qtxZvT>T*vMBSrWP2g#@Ddik*IHzyITe8HnqS|);F-+IP7-A$3?+fqZSy- z+DchxJ$PQFU>*FE?H3rz`WBWOhfjXEYI3mJss)C!wo%rb<;ENwtnq4rp>g;fEH@4d zkGSmzYemN)7;547u%hFzp0E58%>qL${DE3{arwnfgSA;LFqHKptmrrlR{5W84Z)DL z9aeN42CI`=V95H(TQUwWTa^EPuqLPlhOD1qMaN-dUyaAr0z=jK1y*z%2J2I`z);q& zu%hEISV#S0s{w|xexocIhrw#278uI<9aeN42CGOdFqE}}vSb_vYqnZoXdM0lD>@FX z6&;6QsD*#Ra+Q~(-XZ=-v`(|YPz(Q}7Pc^d&o@~8ezi3OLs@^vWxe6E-c<_>WeF1g zs?p0;o}L!0xs(?4u~!H{(XEO%9;a=Y8E3f2_0z>sw$EO#Wzxpvuzdwjpv zs|AMoRSuTxSO06TZyBsp{_`iXMrAHAXEkWE~C59f=NpblbdOy`mNvvW|ge z{=rhW!@Va2tNLHIgZ;Pe|&-fuXGOuv|6d zidnGs``fk<3|SRmMXyu@tA|=($f^j-jSczByurFxEihzNf>q5_P{#b=?zQK4^<(23 zwZKp{D#LQs=-8r1u3kaavPH_xYE^x)WF4co`gCt%2` z3QLZ9QswtwXg;(*;8bZ zt0Jxa*qBn*wh#=puqL%o{<>DMhVN%BFqBmbmRz}&<%_}<6OZy)9rm{t7|J@Cvf6(? z@bO^%s1_K?stv1}$&vLIK9o26c%OCm0X7Q^Wt~Dh!CI*n7_v@-CEwVU<*g0R)C$%`2iq(#WStJHhB1T~ zwcxr+NBC+qIK*0Ds2X))xp6qSaqFLhHRe!jfuXE3U`4ADtQCh@3k+HHV7a4%{6a{u z_B+B_V92WPTPW3-wra+Q!RmFSwZM?o0G7-)vNWwT_tnb28h4bl78t5VL!Tw{Z~q^! zxjk5AkFpjR%4+1Z#A-TeKwh7jRW32^- zX13v1*<47IQYwQxpmjpKuLOL=R7 zp{$m$qGLW-ttwax3|XyU$+1$12V+k+3Dy?1z>t*;%e)E0^8Kr4-5IRu6>Sz6s$mK& znQ3JC>(T40S}R&ZFqD-FOJ)FB;Q40*UunjD? zmD5`u@w>I6Ed)bWTe4(qG(!uc78vSRJ6O@N(ZToY+{(6JV5nd1sb4ZSf>ox9wZKqT z2UyXu5v+&Q0z+0uSkbW&tiH$FEHGqsf)yPb!8)L-wZKpfJHv{O4QoYf2!^t{z>1EI z*1m=dGz$#Xu&cM+*a%k36Ko5?Pz$@kijECyMOz4lT6i|B=($ZhKhM9USzxGz-KmB0 zS671dRyEr~FqGB9TW(LO<+C=NXe}_5b&j{B8uFKhf;G6hwZKqTPwLk%Jzv<=-e-NH z78uIvMOl+ix?^_4s$sLhP*!hP?#%qo$)9fv*2lH11%|TvP}cFQYCjgNPik8W3}yB8 z{gP^oT(!DNur}4P78uIvM_JWB{A~YVeR`U;z))6ySnl{G*UT6D8h%#ST3{$^0A)wI5~z);qC-g09jSoIoM3k+qQ56g}Duiif6uC_j_c0+4{ zp{#+FCHHU!>)}S$0z+AYV96(s(!vp)yPq4ZGn!Zn3}wYAE2qosD#2RV)LLLDYq0N^ zWXV08!D`mbT3{$Ejj~cFc6>8fE1O#j3}p?06&)Lkd=1;Quof7~N~bIt8^JoGrM19N zR))9S*r@5VDz&l}7|P1@mKz(vdQUAdlr_{_F6%U(b#t=K0z+BDyd_yly*IxUtk=~7 zLs`RNMaN+qpS6FA%>qMNS(GK?Fj!ZmS_=$ijer#$hrv3mjkUl~)=0{_pv`?NgLOk& zYk{GxY~L?84ue&`y|utlRt{wy^Yfu=f^}yHYk{GxTv*X@xX{<|#7@=%Ls@y0CF3wy zhjq3V7|P1`mKz&2eAcgOfuXDmyyeDWu%75*v%pYRfwx@NsXnW)tF^#TR-w1tI1JXq zYJs7wB3RW-kgT_SqlYqj`mE2?0z+BFly$^Am#z)gjBd7tU?^)8tmv6uum+rMEihz_ zhE?6P&OAsOmQ`kau#W3)Eihz_f#rVDrF+WI`-8P!Eihz_g%!O5Q_ol9mL4_>3{~So zSnfK&PgAQ;3)VU3SPKkgUF0p(t)$!!%8yF*S%>tr78uI9*juud1{1AlywO#_byvLl@8W-YJs7wODXI3BOh%W ztOxtpEHHH5I{}t`)m%SZ{@7vGik|m^p%z}|TPT&kYDdl?J$&Ue`r5UDp%zZ07LM!n z+7-cS)X!RADC=@qGNNRA-Msw5S-~pP-&$ZO>k7)Mn^k3Lu-;Y+3}sF7{gSL{OQ*L8 z*6aZ`3k+pVrmS^iR^J`0QRi9<3}sD$<&G(@@7QrdusWP)EijaIC1usS{iX%Ms&Kxw zz);pzu-rT^zd3W5-(FkP0z+9>Ql#?qO#OstJ>=?UXZfs))dE9V z*HYG~=YH%Kta^iN78uI94pwwN4A!S=fgx)uEced$og0>{2-fW}n+1lf>tV_DLs`aN zQPd?^eFj?#3|Z4)RWpXGMk`;9L(;4ThN^J`EH@usHfr%J!73bLEijaIBdlmOg7tp7 zwZM>d6Rc=8g4H(DT42b!*=I>L7S+kF5v+wntp$dxTVT0r9PxCs`Hg)wst&gn7^=pt zuv|4NRP1+2uujXe78uI9&9_hpxn>@$W+SWxhOFCR$!udDB<h8h3h2<|z3KFTr|9EijaIm$!_B>ujg^ ztS{68Ls@rwOR{9f4px<1+d?puH3L>PV+bKzxxUXjM=davbq{5|*7Un`gB8oOSzsvZ zURcpFAFS+rYk?taCM@}^P5QOq$wU7R*2NcC3k+GaV7W7*zR$fpIaoIoSPKkU_xXOA zC{+G*UyYfC)&fJ-nC&gMm4mfGEijaIzqedgZJ$-K$Yz0|tU2CtTRB+W)dE9VbG_xV zminyA)dE9V4|q$mqN#qp;lP%QrnVBq>-ojvlbZ2S`5pb&u{qkqlZJ*HnqS|))LB^Ir6i0!Mbm}%>qMNOTA?VFJ_zb zeGLa(Vl6O~^`y7l3=phu)dE9V%e>{X2KcPYF11-;C~LX5Br7BTk8gr?!USu9p{y0K zWP1tGqkg4r1AW#qwZKr;O3K=&`OxEnb?{|23k+pF1uME&2CKhXV90tJmfI^UzC7dR zU_GD~7_y#$<$kr}wzD| zxvc&^tLo*pg3k+qw0?W-daveKZIagW>3}wAaS#td_Sbtt+ zEija|+V@K;FW0eyb?r6Q0z+A^QI=dk4A$}2Sqlthz3#JQY{+K;9eoYwO|=#n%6fyc zq=vz2G0j?FC~FO@Xbpq)$_>^6Ls@T9mV6cvtaER&78uG}>-*(u7_6^uwiX!5dW*8; zvw&b-c&oL*P}bW%OKK>ewRQG2Jot8NfuXE-C`-nCu#UaMT3{$^9V~Yh>rV4oTd+>J z%UWP4>s`u{&)R}@>I`dvp{)0OzodrpSzEB0-fJx|l(n9+P5wV7otFqHMa&ypI- zJ!YMJ4ZF{_78uIqBozmfW#W$7fwU$68=0>mzTu`7l^z=2{C3 zWo_`5%R0knU8xor%G&5H$&z=7!8-B*n*}DRZb3#`QJSnfDd}TaZvV2+xlinGF_z5A z!t6`dC$QXELrL=vKgIm< zVOs<9SEe7dkAyLn6r)A~$j@QP{cLhizz=Jd|*85rac5{L?UM*pa z6&cT4VI>~VD~u)MSs1pyg(c^Hvb=O-PT!FAmSzdVE!+kx@%GxLmN0C62TNvS>DP?A z&-x~0?f0;)p)kgZjLh$0on#ED;pR8L{wi2i)DniXet?yDdo@-|7-L0h_#-TLj&x7# z&PgGwKrLa|+72sm{VR9+aiek#R!Of6xI6{*J0uxe{H2EWqptXJ zft9!#U#TSwxA0e3iThQ5p6!<~Z2bmH_DESiYda<~Cv-KIEW)t$dnsAznk9^}BGuRd zOYZoUv2lF4j+=zA%Q(#v##oVR`~k~Vqtk2enm=&utm$eA!&!gAa+SX{GwIA=ZB$Db z&ibpAtUuKf##oVY_%|#QfWK*L`{RyHZ6C3f7ltjl?YYc8ZeRW?>86>Xg(HoH#V~B` z1Izt|`t(1(jLbHZ)DniRePJaY8;8xeEfj{WGO%O@kmZ7>pYIx4Sl3vx2xF|s_9_c2 z@odvyEn(Q&&u7VcdA1p=mN3SOjHvx#)is8UsH2v@Ffz384z+~gtOH=V5yeM`r_>V0 zSdp!KAgpR8r>yy(UCdKhj(XJAP#CrjD#bcWEn(O?xD;!oTEeh(NGaAEY6-*Ep`}>O zAG7@uhONV3^)S76R|o8U{8En3)DniR!%NBfOD$p8Is%rP=dT~|O@ATmQhtGbB#eF3 zQlF96c|Av#l0Lv#GV=?=RykNQzQW?t3pGm^wvH+#Ym#OOW7l+diETa_>$%iKyZ(nd zKdtK#hSQIMm3V)DPc32CIu@4Xxc-H#pVbnEt>a+1GuV@Vp3o`yhdyrCBn(^SVYzwi zrWS?fgA12>rdqtV|JXh zIb_XOOBiECW~9onPBn&%m~wwCGKF#ddR;AHII9XQHzV;eZkt-d7;8vjp;5=*Hgi@?(Y6-(u zHCWZmy5ncjWVM80>qJ;)V<(tx=BXtNTh(DD9?vhRB@A09m16y>mN0D9faU5pqhH0y z$UNf-I|77Zt0t^VO~0g-b}>(38EPz9pD=9ID#e zu7#F%EnKcy!Wb(uC!7W=@tknj66*`Y*6FYkzbC4#mN3SO%n5a2)iOCmNi zeZrXbME3Xku*#{GJMqGcg4J3rVYn9!U?r~eaJ7VCt0An!b)KM>FxX{NlPSSGVk+9<2SJv^5llt){RlTPbN) z`o~WPtF~IguyrP^T57#H_qT4r8mN{qY&C=B=9N#6p4mKDH>)KKTg_oL(ySU)@=ZBy zZ_HgPY6-*ES+L}toh&a+%xx8{pVbnEtroCOv{F*n535Js%hX$DQ-v{>>`ltGgeCow zy(#1Hk2{8};c5xPS*>85X$&_jg>#z|m)p4o42}8ZQmot50z+0xDOS!3n+1lf)KaXE z)dE9S>r$*irX0#p~teI*F!(*c(EVrk0`t9||{`H<( z!Wb)Z-01`>@p0!bwS?iU&am7S>7VMn7rB~|^0cj?FwU|YtP3nT7RZ&FlQU~h5W+6G zY6-(uS6DKO%ARs}(u1pmHAyXD*y;xBP_=A^%eqr7Vc0qwmOEN?7_~k!+bmE^7`D25 zE52WEswE6tJz%+heR{yu>x8h&cD00I>l|2eByv}~f_3aO))$7Yp0HfMIzGAS(_l4G zOBl9#ku~_}Kb8e+uv)^f)f<-U*SG^}whq=MY6-(uA8)xD1nXwCgkh^Mti&VgA+>~I zt6wSBb7~30R)1KD`}MwB!mu^KTk-wcrj{^loeRrtFRpyqXYHDVVe33^#gD`4Y6)X3 zdtQh4VCTa+$&4u3ztXbvItXExW@-t;Sp#7uu0~I_gkfutw_HNV8m5*oY{g(DuExb` z3B%T4vVOW}-^e^aT`ggZ6{$v=x1<{P{_??#p@mD-5{9#ez;e~#Iclw1!myPNEAbq) zSuJ7M%7Epn!E@AKY6-(uCRvN_T=|d?b~*kz`$!nJhLTn7jFiQ}YOa*ggVhqoSdnVvz-q76$gA@HI3esZT`gfaD;Jil29LvaY6-(u9<0RU z@bDLGsxWNj!*bQ&aoAohVc5FBTT+cHE?c`u2)j&HOBiECs!;%|t-)k$%$u9hE?7^g zB@Aa3!gAI4{qWA02kSSrgkh@)mh`KvZI=1hweXA=?IU5>D)yETc^h9E60A(MgkftG zSx=O$JT+MNsU-|sqrDYBqBf`{jIkm$90N+QH>)KKTT@^q?$>;^gfUiR99{|Q6f-Df z9DZJ9OysDyRxM#T>nd2TUp&u$ua+=uT@5SoJb&n`wy(mlbqy@nFP`U5R!bPRuJu;@ z_UfXRFl=21%k_(o=EKwyhOMcv5+BVcs3iXs`8p`wJ>bm>8<#FwNOhKw(f$JxL@b1B@A14dn>+QSEwb7u_9Y} z2CS2HD?gEZ)LbF#a*tZVaMnGrTs3%(TA`LOY~2eh@f@{IEn(Q23CmT3=csLJ3B%Sb zZ^c)m-0QZ7!Wb)3jr(Ako9Zy;%dI?mvJiG@t(GvHH5-F zV;>2_S@U7JYVg=tu9h%tJ?br&5VC5$X`d5@t;b*`9vj!IB@9~&$l|e4X06Q<##oVR zJPzvut;V9hZ+{S4n5UL7oV5^^s|Jsab!rL2)*@Jm$40ZaYzu{9>j_wi$Htv%3B%Un zQmlR6wpqd$D^iUmu*?M%>?s>=TON7G@vvILaMn^-iK{W-9h)T#TTjADT#bF#SxXqU zmcepkgSYZSY6-*rS`KTT_UqQ}pA8biE(71SkA&f@6|fTbE9pIJ3B%S(Sc&^JLoH$0 zdJ0zJezjU}vxH&mX>Y~P8(*j;jIknH`59QXv>Fo^jd?-{UEa5kgyF1bVI{6c6}5z6 z>p577tIeR^n=ORZAGQUhr0YHFDGv##oVRya>ykIgCmF^9CX8GDR(6IO`=? zt{T^LsS~;TXtr9yu=O&m#P0%DswE6tt6;fm@VkI_)e?rSSIFXP%fG25jIkoscokM1 z(|tKx9yoCJc|zFb_z&zOVK{3wELRPl4_m4w3|p_kN<20Os3i&R(v(?R!bPR-iPJ- z#n;(Zs3i*YO|Ott^bOB3pR_ENP+40IMH; z{wE>q(o!v9IBO#;R}G#4VrmJ)*2l0C&j91p5{9i$V7Y4W3~+~9!mzc;Tk+L+RxM$S z6{*Ijuv|4>>_7T?A?&hAEnzt8Ggz(~e70P6gY|`B>vM0pgpgHTEn(RD0+y==zmrN) zOBlAk^j3T|hN&ftu_D#j49m>`U)|f`kVS`NEM2)k@iOBiECs<9PTdxOcI^8Tu;%LePTjn)^2v%ZDp zs=<58aJ7VCYa6V@d&)g(3B%TRuv|5GPkB!*Vc7cKTk&I~;>WgM!Wb)3jUQlLq}6z) zVREDzQ`8cMvwnn?xEjByB@A2JVI{7{&`)d&g<+_K`50^$V=T{kl#qVc7Z=R^ooWp_VXg{RS&>zmELWwon+he)m@VRz6oPVT={o z$~$0H*J?BvvG_qD?2@mRFr4)Vti;urqLwgh{Rt~^HSSbP7`Fa`mAD#@swE8f>u*?H zv|poJd>=XLy{48hoF%t7+P@kmGXU?)hkvGZF$`P#z)IY&E@}zG*1oV3_iKt;!mw4w zTk%`@b+y3IRxS(ca;?UVcm23Y)@zscpW8=Z^bSdT@7#W{+*anJ-qUJ{0zqDCks2T^s+N9NZX!`Nya*<`t%)i+_0z+8` z`+mvT;A*T_3k+F@c*`Y(ta)4Pb706i)b~pWuEvC~tObUw!@Lz=jX_^q3k+4`a9EdW zHCC^$V!l{u*`%bkYJs7wBYeN&tI_cr>w_WdNN>4>koBZmV8|-x`z01v46 z%3JZ(n4=aLs>acJQmG@SBHNI0z7&F^Mjt&)Ixp||?!^i#}sxkaK+d^S@j;aVN@w~A~En(QI z^#9&ICk$JaVYyk9tMR&8!dSoC57Bi;zoStF>v4B7S3Kwi^W{v(#?%tVrJK^5 z<#@8>FER&fl3K#BRh6uBPV8eY&$z64Y6-*E31mI}XiKwMob|R^!mw41tXTJ+*9L2c zTEeh(B3ZZInICCk^&f4jFve=rvv-aDZTd(xs>7;g9+j2DH!Zt3 z)3v8<+m!ZQQ+u>-*CXZZ;+!Fw1<8%`h9)=8$;`+~OKxmiP?+4fFf+F(xp7vm??>Bq zDQ9E3DEMQ(pPHq?k0b`~Pv7*cZvn@=ylT3w1 z<&DgYjZP~n%*!=+y;#@0^pRObwqED7OHEDbi1pNuf1$rwf2@CYX6~?};jzqug1iE2 zp@ps6iWci%P@F5##J$+s6tZ<&c|AGSA@0>wl(`dD z9BWtV%k_q&WyH+p$xAPxVX+Q75z;c*if;9#zHC=tP>?n@mYX>`X17Qr2|cKfRV0Lb z8IpIkrf4y>%_XieuKBwrW4(tL6HdJ*_Z0PD3xl3p@2JynvA%-Imo0(paIW#5KGjpgJ-ezYpy)VoR8_!a* zmziC+AS-tm>B(jqHGEdOd$FyV;nIhv6~xSRnpISo($?aAlWSo3r4^Z-v~5ZQoey`e zf@zInnX#dH1*W-XQp+kDo3d9aZBqNEwo8p`f(dUM>tgrIy;?tdfvw+Yuh%0DHM2!z zWTcrXIX7ePDj+SCHP>&Da*ml%Y_DUzvoglUGJM7NF2bzd?i;kiu+d}vB4f(5C)Q7E zzw-!+_1kF(Ig>V^d6EWEtc!U@Cj8wTLH{@Y1=JWuWd zsF&b;V5cS~AR>)S@M?l)CZKk1=q`|0x1upIbHE;%gh$1>_HnNqeOk^~vWp9|MwyeS z@MNKxdNVWh8SBJ>`m{saO%ke8MrM-lsI@Z8farDMs=W4mk`pML)%yhf~3PEKAyQCfD^g_$w)elk6OY%D8B zy4QCXD{^&|;aDddbT-Ar}VE;qwh|= zHRsZWnMJXjyiu9v2%Z?0DZr?vy>e1!kB!MS+sA%+-y3k&zTzSQJ?o>U$=!ohkS+XT>Zb=RQv$cg zCAU+Lj0M}A)KO_!*>WkZq!!t?AWF9`9y&DBoIR!H$lKu3m7(U;Yj_XyzRbKK*1=y` zk|Be$KxTwC=H1W`bD1y^DH9heDZ6;#*xYn;AtKjI-x+wzE|!@S`i81w1~%(7yYepR zZn9=m(h}wtnR;+lU^iAIXIIi2bNt#Rz4Ouhp9u+iR%m9ugym?rXB{kMeI@s^L}?e@ z-A%8=ZNHbh1SUjj;x32HzY$czh}+9m>#=Z`<8?1%P^xb2WC-l#nq)^Y8{Sl=F;#BWJfxQT8$@?gXdgnPo4N{4Nl^EL_s0^si^_#(ef~WR@@$?&Yd?vFGhP zx9w#bHdMQRYX^)QPya=0|Ka5SZxo0lOFM4-pPvBlbkdS+E|MocWifU6A8D*iv2xwi zybUpp+Ud;cf1;U@eKNt^A}4e>XZ)XNs~%Dlo`(KUG%!-kQcs2dCmPEqDF636j5*CI z{Y2#dzKJ+(+TGKc|NG|tvy-C#`}Y3RQ>*{U7T1fv7~xN}lk1oAVyD8MMd|tOnp5m- zdnJF5t~J@qfU)-G)}iRf@cxaPTsKbiV)T@@bU-Wd?*pUUnaG0)Wl^fbI(ap zdePW?^9hrAGx3 z<>aTB!p6>)V#x*@mYp}me*SLyT&ja>I`y%ABX@s9hh3uAqTMO=b&Ml(f0Ma0L`GAJ z+e*DsV_nQj%uwh{<-q9Z+bCQXXU!KnBQKU!7`ImY-o3rO9iU{yq{jN;pL(VZ?WJf2 zE=*6$Eor5I+gl}y=jO$CO&XDaFUrI2lDN(Ne3MJVuvXJzZM-(5C=Ywzu2)<#mUzXZ zvog$;-<`J{YTOSW>6@aJ%$RkymH$bJeeZJ9%*Ef)3D?;+=2uz@r7bnvubx?Zs=c#7 z-sr`T6Z5jag{}10>kT#6ip^b&DOq`ik(~g$o^(N`^~lG+Zg3{H!md-=YVD^Zx+a-4 z5;Z_p745}tQ0dv3X$1-T;XbVA9{RS%QZq8-Oo?9(Q#R%m^NA{|W9Mr|%`GyfrT+7* zSOiSZbfPow~<*^z7cgQ`dIxSZlAB$71bwAN6bP*q}+H zSl>=<+wFR-yFg30->GlUtc=tm^U=Z(^QmY`+swlBf-HN3DNdK{K}bedfAh~S;K==2 zX1CE(i(NS8y-K+GY8R|+jQ!Vt#^>&={m&E4u(1cAcDY67-jTRc`2mW9M~M*b8`;wj z=J5_eT48SUF3L;K%TD=^bIeV{en9-kQ8`%||9Nk+%BIzn7aL%^t;ilT1rj|WjmpPTRH^-U}?%kBLr|WX{iOfiQ zwJN@^!5&BbO%(szjg?7er<*W#8aV%ObJHl;yH)wJmUa->s}1*GG}a$Kl55DFU>*Ck z8&lNHJSbr*GItke%dJNp?S4WnGOy*QWfho@+S|0=)p~T2X%fAaJ<-NB=K=A@G)k4D zb3CH!$F5V__DCrI!}Yro#yXT#w4KgEcMGfEO}>~E-!p$ej~)a|WcPkz#&JD*oGCHu z-#gBf5Fwvy{qG!SbQf@Ep&fO?H=icy9NLk_k>cU_VlQ`?&vSMU*H2U;)AddhVJUH? z>;a`%Zd{ul*{PvtQNBzKC2XDDpBhSEPf1fl35WYmp`!9;pi|st=tP@A@gVKI8Fqp1 zax;|Tm$Dg3v3A-FLPpP&{^0@7ZKY1;a7BfQ&fa^Op;jLRi^!ev@t?u&%0D-y5l#v7ii?Kj{r{vdxH%AC z@xXnzcKgw$-Fdv4nJ*LHCXQ*nh8E=I#EOQS3#Wa17szde;ciar;>!tg$ds_r<}1iH zDlr_{F?I&86@7YSnma`E%q^t$t>VtXC631A`U%%9ZA_ONPE!)SjB5&R9497r zV-T7MH+~YX12>87awN+ApXr(At2%M(kX;++1MY5inbH35KOe)ShtsCa%#r_}Yjm2s z?N{&Q-FbNQF(+ZMF4Db(xADf~`bkld>@Rw^Z|}UmdSm&{xQu&j(*N_#SnBw;7a+0< zac6gYAKWdlS%rE}cgcwP5d|$uFLT3k+-Q+YKepO(Au7>o_V$EWwq%CCu#`98 zh0$JxioOv^>?fFDNEGJ?Y=58d*2Oq{dLHW{Z!UJdrpUmS z>0wV>fQhdtFW-DpwTG*~$>Pvr^V=AExC(c;ER-YQp05KZC298iM|-)JeDejRJ#C4- z3>G;?Bpe6k@Q}YZMUOl0-Blo;mF{7E5}a@Ec5VsRZ+2s(`>P1}w70Z9!+q?6k6+CO z%rM_s-<{pkG=e@|*;S|9r479{6YF5^$&hPg|9v8^A@N7r|8*z*WhZlwY?>DRuF&pIqJC)E3shz;do>xm_QcFL#`9y{%S`3v%g^-vV;?ec9^_{zT2)KD65= z-ci^ah44+p-4=JgkmfE!?q+MlZ8-inYxMU8cGXuDRql;(iS}m+h7_A0UMjIl_4Qsp z8MC&FyP4)I8|z*;bd1@f|B)?iwZ}vGj_aP-a&^<(i71EV$oBaMjSq#6wfl#y=S@u8 z$y@`pWiPqrG>Mwwns6r#)!d6U`fU`p?(U2U?Cjo^+dfD7E%c9kY~ffR{Hn}etik-m zLBUXSPvbvdg}iC%&_Ui~=F2x#o%mY$lQxll#*h0tXSuc_@NeAyS(i7^W7fB(%}-<-nXIt)QY(ZAjR9G zwabK!Th)C{<$G&;wyut{ZL`dVl(z?V2Kh%lHNRljy06~EZQoEwrq;pD#sz5?D?W|D_bUJztJ^$u*Ljlz2M5^ZaAJ;e_Mn0DRFm+7ffTExCXx z^~{I%=CC0D7x#;8yB+@j*gFrv$f~N34{Vm+i+~gT!P*WzrZnb)*xe%NIn6`R63D$>f*poVZ#JeAd2`8 z10EcTf$!?YC6dk!cjVc-nKi#*ZhU4#eN#=m7WX&TH_dIRo8Qzt%UAl`OS*9~ zDAxdWV)MZw`zt;8{X_nIz4a1n!+Q zhbXR|Y**8YUV(d%+uv2S->6uE_MPfqnCjozS8Z~1sx7fKtlJ%6Vf-bIMzSUKy zUI&I5xK}r(7upl?s*=)ZX-CK8s`k>VszgV5N3^606Ehuc9m&?#WJ%@TF6y`ZzPHCewpO-QM0PkFSxqP$~rw7jHzQbk2cdqqcLa(N=zQPoja z)f%m+3fLoZ1YJiNIIzuT%xG1ET|(TR>`vl9UN#eKVVE&-YxHEUay{uo^U&ZQ7VVz@4(Yv>eQyHL=9q$}Wpo_a8 zoopLS)4kPkO%X4SH>B|zg7^}wEKtiXmbTFAiO)|blkwgZE=~??`Q;mWk7i)NCQ!#pkFy@=v?jdQa*d({H2GsONH zT+2(vL3)nE*BncK54c7lf;qwY*JbM=UWUdOZCOsMy>yC*O0laJ`4hKl zSZ=zZ+ci)@qIVLX>A#_R*lc(1Gbq^hdR#Drx_J0qk7X94r&)s?pPxu$s={ewhTl$S z4ru|kZ+OWT_DDMONOTp;NSNZzE8+Dl)cs-y5ZvrLj5%)+zaGb?)K*ngC88zK($-1I z%F0A(S+u;Oti7XZQb)2fnW(Iy9x=_5jQE&})y>j6VRYD+V~sP`{4S}_MxEa+Ys<0c zdj1ZDku8R~SNCJh(Rnu}V=tolG*x3QmKe?E(h!=bhHRD#obI!-nKI39<=TjZYO|t> z&%tKf3OHo5z3NeIY95tWs7B^rwS;U&UIjl?8*(d_7Bi%yu2_a^^RN}mu+1KlVi~TH zc^AvD&B&)%hHHaYEHPkZ)6#gUoO324&&gmmnFeXjME1x|OJg#KX4@>L)Wt$LqiJp) z7pA80#&C8;Kw;DLG$WM1Kis)d-x?KW{xCJim!%xhw2}~?k5ex0+liZ+5O?P`C_d>A zAdsfsZBX8-KpB(hn-6vNqG86-d(&B7xdfUEm}X{k0M5jo&oY|n$;G8%*x;Wjro_l) z*(418J|C3QOs6Juho&y9k`bCgzB~Y#Bb5j8ER%(KK@{j=xE;u;Tzt+Br7CD_vAJE! zm(Q62xuvt6k^%~|odRDh45c*(c_9_Y95ni}K#t|jP67K+)0=5&g9{d!kqw&Y!{SK`jO@ST)7dtfd|Fhy`x|{3Fu!7?ziiT9fY{$Twuw2% z!dQ%K40gN{S~0TLSV%FlQBq(r(yOp9MtV8i$UKWtBa)66WTzN8|1FA9ORv~Bi&u+M zDRfGoe18Y(GSM5BBmNBTD3oKc3P-8Ru}EE#xs661fbWl|%|p&+SaaU8S-E` zS}ckrJFQB)1;{0FEaopswjG#kk2-sE3hJ9XFS&4T#dq>I^HRPNOB{P}{J>39wS)3i z;aC}TWI>|5jdj`H#?46s>C|$*3o28mdd|{UQ81y{@=IAPu>CM&hh+)vUt|Y22=rxa zT_~o>+te~Q$-^b%owzU|-nu;I?ea*JmsFG_qU9asr4^Nv%cC9T717GdXri^ey}c}1 zQs(UPz@g#{XDT=01&s6^MyBmQREY3$I^4bD?lG~|PPL z-H~4GaPd>u0DnKb>tbpZyp2Qik#x=u4CnpIo*AWB8&6bLwwEUot*uq1lauWgld;() zTAC~?NwikB!U?W8w!_x7-zFgKS#bvSh=FdujfE`p9u8j~lP+4=O2~2HB7EB=v!r?0 zZn=Ol6y}?)&3z3cd^_`=FdYh0@|iRZ-wyx8DQj4^hu7Pg{_E@0Bm?J*9^MaHs0nchW(MUK_-)MUi+_V1_|xoVwcve4)ScMR+tj)khg z5SX@^qSJy4!OQq&XQveLFv?Lg&H}Pl-nPt{2AOU~HO~+fFtjoF*+#M^w`KY{Fh=5j z#{KsyKTC&I+|Sel500zoLK9pYjBUWdvkUSu3(F(yUz#0YLy;V$7E}qzwd>C*=-z7; z7@%puK<}0uqhb9vQt#L4>+6Gf{ZzN78^`T1gXrEakFx-mB!-gUCQVy*_{%){S zGQ{z;u8j+cr;QSMJn4L>cRrlWb5U!F|3@A&Oe=5>N8_1nXTHW1(wST!2s1PEvP=Fa zZ-;}e1J?TolbCz+&RB`rCa0%l(&e}m^_%m*mevWA+=_7!r|Z~TSK*T2i!)uxw5IL* zja_-c?;zqcB002D`ubXtju{PW8_mvnb8|zTq{3;aPkD;EU8{YP>6AFUXO(2GTe(O#r_{t2M` zJ1O3_FrNtOeCJS_ToF0=(r>%xj?Ae6$Q!cG4rG&f>g;&;T(C6-U%$q=ilM-vkmJ_i zXvP`P<*5b^DPX=%(MX1Cqh0Oo%Pbi=Ps|<^;HaD%TB#9yA~kdB#VTVmUt9KW`TPyf zlKxp7w~yV`8}I8*v?Z}%7snm1$qr{3Ro4Y`Vg!kfP%##uf^CX`bHj=o)YnnQjcm)s z6oGFYTQl{69E(W{TB}RpViWs5H1nS*IpVHQ%X^rMqqEsFGgcErjfVIvYI3@wK~V)< zI;d2E*tRVxE{Ro_;C{yf?y!zU8*A{6Fh?5dDiY_s@yT0)we$tKkyc!tORfDv%bC!^ zUo#dE8g(pHzV*z{Mk__EX5$q-NDY25Uw_uydgzWvT<#YL&NPj{y)ev*cI0ZF&gkQM zH#Lm%Ye(d^)4mb&l98!q9kWyIg*in(0I+w8UJmar%ePjcg42zkZ6s428CdNq#3`Yj zP0&Ux(EDV4c(xE)km-f>v)ttVCasIg+&%1T#a)Vd zzG{m0Y-L`yYTn?&`q$q3vZMyFkxdR=8r}!?MnuLJ4X`(o7?c;#A>`dvsRFmVT+j$E z*qbg$l((zVG1@!+C9ysG<&WM=n0+sRmIRc&Zjojh3w@)mL{$Md3-XR}jCU;kT{_i! zd$SF|JLKuz3QN+dUc5mKD>fMP&?-7bcjPbF@zRUpifxx!1$cDa_oAsDa=SY>JAHiN z)i>T|1*6-hF#5u9E4aWk4_9cRSAtDy3)m7AUsR&4lC=w>w3{zW7QgIEnM=G{4E0a0 zcl|l(JCoj1I}1r$h@{-@9woWki~Y#klZOw(dzq&2LxD1_GjTu0z!^1OAvw^=%d}y6 zDDtxIZR=SjHt&}zXG<#J<<42c!kPi{HFUYWMm)=&uqKau_6*&NwzI6qHn+|cRk^ax ziru@Rvt;&-y_e2s$6+MijGAr5(7yyWODFDkPU3dwtPDZZk6EvL9r@PA8CkirqP{XD zd3|_hOTS;|jx=n|vwqJ1g{{6+;OjA%_SfBru2~twsKT8S&@YR@b9pVHVX$Yr(^wL( zlAMSA+#}((sHLTBi6;+p%AAm)c27$A(pDbUu#jz*J~< zcwcQ`6_AAqb@rQy9IAyyYw6)6(Qqv+deI7_Bj7ZvL$O`_9Zs-v z_KlitH#<|mfH+E58og+J`S5)Lt4B z8SV@UlNn0SfbXDK(YDQa(Hes*;y&AL4*{?EZI0)ZFW6Syji28EH~G$>3~p6h!o zaHy>j6B%x6#AJq31+s0`WAm;aZhP+iIXB=i^yj!Li&DVIa7qD_Wm>1oZ~KaGUB_FU zDnych&Vkt-Y5`;-!!3aB@qkgYBJLWL^NP3|a2QGgS7lKW7#U7UV6sBZQA}jGIf@

0f(XPWvWd5fe}9vo4MzOpW#K3$!kkZ-bKx~Lzm8Z$Lp3Yn~$4}4sKZ1 zmUIq6N8gZLYSzp8(8j0#pwhgAc2A0R27m{K-cIv>cB)(_2 znpP`s2`w%WP~laVUs^7sC4aa=ZgTa@arC1h5hoCEaam0H8cnwNMLXO1O;wBb@k>Jm zGwiFP(2qBi9Ng90UR+&Wl613)u$12mh84C*abJ64AYs9I0?}p%CDP3cbTuVi-|LCf zQ=YJr)b>v|0K*p(-fcLCmPxK;Wt2jI7#Jrbbp6Yj30Ir?R^XP{& zb`Bml5(PM1sjjhj6EMFl0j~$5<3EYML>rnPufFAusK>sTwk3&le1N?uxSqKNZK$|w zq2AlAT9^Go1o{zCt9RZ<1Y_J`8&%u5l^NfN4pzugU1M$Ax18f3X<(fgX1jSLO>o_i=t!NG9tEj!%`) ziV|odJ)tH2Sv&MI4e*RLqn_CK)NEK`ssVIG_9XlJ6P?LeyotYCf>oL{1MO59Wune- zuFA}B1YH(u^i?dws?&{VHPYD>N9jyzE}=YS&XiorSszGr#}jRBaI@$j%VrSlLwHKq zM4eQNB2&;5q?z{=& zEc|K>dQ-P(lJX1eswOKt5FMwfD=w~?8@ABP72UZi8`Kr+^b--6yw;_peZqo; zxu#Jx)ECPtV{RLS4a!T<9^|Yi$3RRICVFz$lw+WP>!fcj@ot8uLYA3n0vjM`k=1$8 zNp=ul&w+ersmRv?=Mc(`l4M6hwuLjP>|r#mC@8+d7?wEKJnfRS=Rvm5%vV%%4d$vt zgJ9)&$>LgW;ar6he`W5F@nUJbblj_{LY6A>WypdvyR9LM7bPQP!EWlwvY96NXozLV zq!yuF<=J^v8CcQsXJlEs;GTMAWs~=|3a9O1dpzu`(NMLCobI$K(i%8ag(8a%lR`K7 zBqhSD_rr*xqRA*ww09$(uBsbb@o*DFR+oevlQ3QpgjQQ{?9+!ZB8Zq*>`K@3e{8uEVeXf|6E^|9vg%pyJ3>=#9MtXb|BQS%g3fh}wf zeU+goV}V|h7irzZ*C;t6mDBXuXtP<=NZL8E(Pp+N&ST1KFI$hlvLnn_c6jq-bi_cu zl!v-;l;mL==F+}OoMV7d*(2$ZH`6!N@>LJxt_?TKX7;GY^KL9$2m9KH@w^+ZYu$EC zG7P5fwL6V9@>QABr&TYHjl6-rx|Z)p9QSFSrv%*-C*oCJ;vBea&^Ib`DxV%11sT)p zRE_)2@-VK*fRSR+aT<4D9`4KR9F03M4=0Ka(75~ZaG%@B(Xa51d`;~v`{lV#JZi0X zoiASm9(l8KTC*N~=6decu6&QY-8sxjQyn+T1|ESaZP6php2;8Wwr4iSV=o4xEgXBc zdxf>MZb_oIH`yKQ>gnrddv~)p&1e{37SxH#N^KqNbF2>Y;($|NQxa`BfP_6R{C$jp zV!}tkNF_bz38bxLixcVI7{4SZ+aoFp2$+atn7G6fAs>#r?w3&?@OBfti@b$1zc6?4I~SaA@XiPVlwk~LBd4d zFG!5*W9M3X_BQ1Lp*5PsO|Xam+3gqxp|1 zkSk6CT97`W{cVX}m1JDH5MMaO`L`sfAeT^?%6d}+(s&rO*#`5e8%TAh4#qn%WL|T$ zp{j{5bp8rPFUNr1sY19u$Dpi^!`Z^zgL)?na}Ub2;+$dbK?Cj`#6@3uxi_bPLHFhq zH0a)(f(G52Q_!G$a|-Hnuls&BNr_+RzY7IvXhf~Vq9D}Mr^G21!4jd?kR6J74)=p; zEz1ta+?IPdrVn>{<)tt8a6V`D;(E-~!O{w*KAxFM7OBMa!y z=Q#%T=kpwc`twMRLH*ez$DpozogqzTxsvugvzrbd=7}rmNOW}%rjxO*RKKtPIERi~ zQ$F|KT+^PUtG+~YU7c58(Ywnpd}g;UKPjR=mtS}*2eRu@?0x3vJq0w_kR_2~C}jb= zqT9NYiL@l)7x^y`(L=7N>e68T$=)cZ_}!NqR3dyyr9wP2;#0HrNJeEE$Y+pNSXMUF z(!MxoIT4X~Lw&=PnwA;!YJM5v*$KXX`0c%<^zJa=T^t9L->?T$yteQ z2%i!!CXHp2qVWYy^$pfBF@*3b@$51LVRdjd++`cWRie08ae?9O3EqJuoxs2td%w27`BW^Y=>X3*GU?Y z_+p?o%zC}dOt*>CCHCHBK|_?YaAT;}UcFSaD8&yzY8j5mh>NJgBgO&ZQ(Q7grB1pPwqt|3*FK_gk%)Bh= zAdX&>z3L*nlQ-&&Hg-!#tHrL9Y3;Em(HCoMX;?OZ+m~aiert7cH{JN!$hww++86KE z=}UB_W5vaFwI(@yj5;YMx~Rc^^XM?gbx&rKg;|K~&VRreH2%p(c(k2a3R5d16_BqE zWy27v7G+%?supGS8>$v%jTx#IFN0-Qa$)E()=MEOaifAo6IJCQ-?d{yd%{ZD={w4|1;tX_`F9M?UHtluPZ zB4zz1o2)Mn<0|rH{iZhhd4qhpmY>)R1 zU~SF`%U_YrmX1Z`mYJ(_3g>m>tmuB}4Vj zcwgxnIu-u%ICNUFOYqR?@|XFc)8Zw6sZ@t=^-uW{dH*S44V2|OwMH!Vu~$;55u6}t z?@p#on9qr7S*{PT+~2mOxI7xeG8PK2!Xbf;>A3_ESu~eWnQqG^tcZOsp*(kVr*O1I z<^}(vaGRd;MOqJL#Z!;_qNWGk*mU)_rFy!0JLM5VU&~j=x6I^kvvO9Md4Eal4Gcq+ z@JkrdGMyKOOt%n*AF~}^N zV>KS4IvA@laEo$ZGI`)wEyrWhc2S7Or1_a8cuYn@6yGsvzFT$^OL5LA(b}D?=}FZYNxXu+x08=w`z3m?zUotxTOd&&atoK46LSmg4n%Vc z}jG4%lD`4a@OUeouMNxWJz{t5ZN>5@LuTSQ6 z9g;nAp3{)gR9o}jlA?78Zz<6_gtvrf9l~2Wv<~4p3VSZ+Q}r9T$g7rBv;}N}@byo6 zhERp5jD}K6X00%kxYAKfeWuge!EL?mHhaxxRC zFlizg3X|hGI@#Zr?&{OHnl1AOHb4ixoWBI0i}M$f<=^~8`J9`-5ZAM~q~4!1vnw-< zmZZM*ozE;thVX7dVlw?(kTBulg2cE!?o18@HtEQm>~zh23$V&7bh)mo(%xV`2~}($>x3#30xE6^(7j!22=t01ANDAV^c!~7ZZe}f#XS}3*O`UqaLo&H zLQ#_YOKw6@>ty0#jGLQqR2+vb<=hv>6zH+Q4(72N0a0U&-8f`6N@F)Bq7oguac~Q@ z;VmEq7C+y9$$a1BF_ad#PB7e^ABqWH*F$ne-|#etfzuXV)NzH$oWbN^lJ@)fMqJYV zZ^r%n@#zQ?eA8!qIvsE^OUiCK>8hZSHAGahBX3J)WjXQ|iArzeZSgWMj^gB-XM8gU z)DKJr-l6e_L9YbH*g(1o{tDly4 z^7K{48c-ObT(c5vi%2+zg(J*0tq)sF^7R-^rCKx;-f6L6(ItxVu&B$d=7&Y8sAPsk zotIY%sfe<+CY!n{nHz`uMn=0YKaGq5SvhQE%<$#8kuku_g|ull&#F|iLq6whI6~^Z ztp?7n$q|b`4ndEU0p3Q4kut#BS20osxJ5v5?TAHV9K7CJ*LYjsS!-2*Xt$no!?%q} zH=54v#3<_R$%Cv$w}`)3POxx>dtZj+&XD2L>P2=cUU1Tb8+L|1zRuk&fjep9Bcj}^ z(ndzTw-sw-)U((}apm}kIG@FS#MHCcSBz}zM@&77edWl;e#F$X*jJ5g>_<#Ji~Z!0 zjs1wJ_nN!;UG2+`TIl6+XT`*O*! z>UA@g?={}TncRVMwIgbS>xg)Bf5$TPXLHW*{sr2?goqMQn4HWUU6?fYtao8j{Aa%l zlO#$^VRGDrXNR8IWnG0x3}oqWg^G+3uH4Lw60UTSP~pmT6V5rupHGRU8+J>}{3D4l zM2SQSLt19igdx){$zjOym*+6#iOdp)G&hT|j91DEcj1C1MLcBLuHn8eqh*KB(3{Rj zipbFgnvCA96izgv68w72*P7p`H;6OK`TyHp5QCbXD#mTr&ncx>E;xJp^kxbg*Zt zZ_2q)F|Ikw`f)(EH$Qvg(=eEiFN{y~jn6}q$5u4Ti>pJE$fk3`l*nwva%adkhAB}b zbl+eh30<3&&>_k5C3Hvm;-Guh_KdfsPLq{z?Ii5k@Bt7Jy zsnE{%sd_Q$b|MU+uBoY|$#iD@oUg@BjXl*@H4cq%mNl`1ZfL}_d^%*}ne})f$xvE9 zWa8ay(~s?&sg4eRD_TgdadtI#^kF%zB|fv&=>ZSKV(8Gvr!_YEGSqOZ^+%Vib0;PX zD1lT+l+j&KUWQkiiWe$Se1}!9mpg}DGb?t;xWlfQ#kp(*G_yF5gl0EmyZbo2)v0_- zv2&``*IN%?uxoO#wa?dHbNe5PWQoxsjPktIR+fSM>$PD@7sl7S6<>kk=g|ITUoNSR zhc4MSH50z@tht%+Rrn@n!WZtP=%n`K04`pR^>wE@W3k0Gi)c1Jq(q+GP+RY7!>Wfv zmoL?aLtR!r7!IYroG~2g+`Qtd9*LlEq^>z((CAx8FJst1v z>L0MV!K2i9vulngoq{R00!PtJMzl~na z1cuz-T(cW#THNv#(gpJ~F0WQs899XV=I!#*CV6eJ!Afr~BQJfDR|XsOdCrW-8|s={ zX3cMy8=u)w-&7N?t*MXKH_dIRo8Qzt%XcR@`rW=}t~%FnqDPT)(9GUN&H_YFBj=z# zKTXNgPq~E?8805sEhMXrDC^}KQe?hdLo%I|{c;WIbF7yE=d?7mG{mR0%$Q-7?{v64 zyXivca+xliJag$n_@eHmu#V@=jNipNT$+P)0i+p67eJa{bOEHItwQE~O;`iwIx z^{j#qv}5%#ba$Lh0gG|d5WCIHKTR036M{`SCHOxvr(Hc#`aK7rvGc#&(bt4YFMCs- zddgpj$WI~I!du2dt>Fz`{$fOqEGSaUH<%QsX1h>p3Kqkx!4`@ztSMNG$ii`4;EkQ6 zag<29sw?OH^8S6d)uo|G^R*A*2=p}r;Ry8HSJLlzFE7XOearqDEhKS12Zkgus{sy4 zt}kUmlISH(X#q*&?@Sje$Cns|ipolbLIwKVU#KY0@5S+^-u`5IAkNmd)#uZ2;|cE- zWUd+L55$#V#sxe6OJX?9iJeu`{RL=5l>1V6MD%B6ixIKHJ&sU4BHH~27)HhdUs)Ov z54Z)89g>K$b(RsZBrvN#I*f5$gN)ITMn5OMB$;TZ$z5?h6~-~~`RQab-kWMq#_(T# zi7rgK7uVG`HL+@nCh*x`{9iZ3(nL1}V8Q$8M(1RFV0m8>dyphz{37PiDmJV9^0Xv4 zk-UON&zF2P{rz2?z411B#V_7xf|t->Sq&+(U@l%`=YP=@yC+>tfJ%Q4Tr-@>T zhLoyVq*RvK5RH0MeQvEw^`f;NY#WI8(sBm!rQ93*x6-omm~V19G~YVchbWbo1{?aZ zV{@Q?Fm}wAbSuV=@qyNO?3nE7tI0%_Sdg4x)me}zZyDCBU-K1* z3okN81LIC~hhf&)#C2kz)*AO?-hPx+qvPJp+na%UecX?E`_b3Xc&#J$7?n7CF7vH_ zofgKa#W6KgpIH|Vtsb!wQXC&zO>B9B7E6X&6N?kArwp|w7N_CRWo{LuQL?l}=8`oiB>Gw&=WIA_AT7yEj1e-x=Yl*+M&4sipGyi|l@7y(LYB0{(C_m>DJ=$T3Up}d zGBexUr9U)g6#B44qow>1GW=ryfU(^Qp2u{SV^EW z=lLwTU}4%D#+c;r?(3vb*Bwnthu!!L*T;L3Jw14Z08aj)?rWkC z^TT4?PRjl}K0SEtjx#E?59d>uPluvm*#M1h8t9giAsgM;C@E-kW23-ndsvHXtVXTn z`P;I5yA#&R3h7SRC>hI1Q0VB!#y`Fs#F8S{=F3LOSWbk(rt2G9Z2U8x2yN-Ez5#W| zy3o5tLVU4Pn ztahUteSGW(2zog@UBVvS=#>t;@fofUj#3(tEBGMM8QnPlZ85shh4U$F=@l2qx8shQ zzU6FCCBI80Fie#r{+^a&upC3I@B;L5Tz*iJd6|$r0IpH>oeo4FajaP`PHT)o<1^21 zjKL^~6CGpFcwdR7<@I=P9PbWUl59IL*&cQ7lFIieuruU}PiMu^yYiU+Ghc}%jy<^Q zP+m!mAC|$5c~`I+47@!+eTg!w7;)=8bFTW>8eJ0U+!dKsF`6}HR+3}O zZZ^nbw-k&m%h?!xEL!fL;u(uRXRE$r%W_}EGB?TR{gd&|bn4)E>vD08M54T;q9hS5 z?x|QWyz8<9Dt2ak1xcYjKDPz@rCHYB3aY!IVK=ZH6N(9 z@TEK4q1#WWuE7bV_;l|Q3tR2t$_BKnD@1hsb3H3Wgjnsw=1o?J2(c8R8|7D!EXPu4 z1&R<$A-wQ@#Y&+SC_=tQsHVF+gpZy_W--r2;aL6iEpXQ8QL$( zye_LiK|Yh%Cet$V!qVLl;t2kNZ1!f9Kb{jC(qFPv_Ajj*88c+IG!kp|YH_ zQ7aAcZ2L4ORc^~Pq}yVL#u<4vFDtM=3TOmYV6Ws=Rj@H>-Tu z#%{Wydk!{u$ETMC_X0T8PcA_fY8{QJ9W+DL|o!pAx*uru;(GW4z=!eZgz!Y6b?AYT#?H@t#EQ zAPVvFI4dKl;qlhcWP2FPvEj+~45yY!oQ#bpdfVfvbRXVm9Pb=Vq({q(YP0U}8Y3pN z-4nF6ZOr+3j2SKVdW|_x(|)coWVBax6c1*dIiXH8{vYkWdRw&9ZQ)$0yLHi-7czx( zHdGUYP3d@9oTCYU2Bwfkkxjx;8GV1;xiy%?86EGv$Knuxv!HD9gX2N;<(&Vu^qg>4 zW+yN>bQle`3C9iMed!&EwxsiJwKjUOdCc7e>&Bk0vZJ6oX$^iqZDs$izk4Q6%Y2;T^%kRhM_ILXuEMJ6*UZFDNfJCifi z^_eJ@u#Ad5)og+KEW^{I#5|w-_DQBw{5TDdjj{4~i>?J9sPco38D_=4C`&t^!D$>! z-YT{rnx?^-bKsgq>@WVWE6?`6M*XZ|K(tc|sbu7IWu}b+Uo3{>QW@XqWjr+$w_va; zH|*39;~d3kay&hTH9h*;69b9j%!@R~%ZKenUPDtpGA}$CPmhsG4^}?L)1xaLD=x09 z&ACq!cKHaeb2WY+x$J5nYp?k4XA0ifmse$Ft=Bga9KV{J-pt^1ompyx*tr@{kI+g- zD4nbE^avq6#MFPmgOBm_2q8T}>|BkfM+oT=R_7{|^LoB1A=c*SHnA0o4gT4$9Ou14 z(eLwtp(7ohx==fI;hB|xzb_OUzPUMpHJa?Aqk`tMLrDi;i5RaHV*FUKTQg?gVt@tD zz)eBy&jlX%+6<80+oI3w%?6P97ZZ zPWE;VEC~>f{3)^NO|$Ci8)i+5K~8l=fd)5PDg8tct|z<|}`! zt}e+4K;1@XFCuQ^jO|kvb*!gdit(=Aj#Mm0mdEEel|z*iC#mtIv&Mk9HmRk=0=DZo zL___vEJlv2oFH`kf!D^_>ij>tI>dJ}!A^>{CHe=lQn9LG_Ouy|P1B~bG;|p9WEuCQ z2;_KA^0nV%g3k7m|2J;6_)2E9lgVmg)27U7YMxO;8+6lMy`9w+1E~};SgNB5TCBRfx`IWeUlqVHIQ!S2y|Uk7ZuZwfYojGzDV10pR3QbRL-M^$NoBk#g;Y!? zxKrYEy<%r7y}T@ta^#+>88fEVHP4taBi6-(z(pCsW7W~>>YikOf1(pRnf0Pu8ft5h zrSl!?m&Y1o`^2JiYU^vgiZkWZyNT|2qOA=^WJRI2AvR-XbMy3un)+BRRgi7~RFy1* zzo5B42BZbboSg6%KPeGRL8@I87%!C4UxTU1>tAe5U5@+q)2ZIBLy~w+23iu@yNpc` z3)qWT-S#8{>>o&_bKyO~c_$xhbexyNTG}*(s{GMenn-sgdYujV{1E8EXzOyEdUY&@ z5#j)={|E1~vAoT6kBS5nst!lhdXwF;uAaW`;4kqhbZ{V!i85{*_am>Q8)i&zYMxa; zowXwDzyP`eiJqiWY>_z-$*%SoKT6=luB5TXDNF1~g8vtv?2@`!vuD-TG}gsf73myJ z$TS0jeTNnt;bjX-xWuv;Q5YPb1ms))0TvD^M3TjT5x_SIvCGV4bCKucEX263BV zyI@s02CHNP7f&1OCbSNA)iw1Fc6Z}{r?CohZn7RZl^`k4feV#vftcVC#%06tZ*bh zqpr#N)>qB&0byNp%dGhgbK^4`>YHlfwKete`lh)Jb@S0K`3ge$0z|qlg`oi=jsufu z8{B|%S{hm!;!|3v&*`;)5}w!T(_-}vO&I*LT8yf53Pu0x6h8W+y122Kl|-*4sEswu zno8s5nRKxQy*7p{CaSK$mD}#c8Pyd% zUFd+er;`0>l~ZV*MBCI9n>}TA9jvOQibNWZw(b;~eK!uxh(hg5bj|Byb@;(=zuVr; zh}BJ*It88I*-DvRy=|!;g!RPMO^ww}pFMl#%xSY?4eqQ)bww9uEnF7Sph~v70^JlZ z9PVbXo7OyadSk=181sBZ7h>ty-0o5J4YAsp(;J#+PMzVW+PnG_t=&oZ#wkhU8JN}A zg|EDzb&aux+Nt$TO|?zR*mQIc_Ai;8>}^MkW{QxtvAVkHwYAggn=u8`mKf|@0tMdG z28*2A5>%HXTzuX@VxX%nh9k_hVYCS^^iB`p&Vxge^!~dxoTlsQq0!C)!*GXH;fwJC zlUfa0ikkppQ94~!N5^NA%lgugFH}0kKoj0+ezCslcCg}8aMlkJ`ns{vhEFVcZ%&!q zT2WDvs7xj&S52zys7!XWS5}pmR!*K&)z)6t+MaOU+rrMD8jd?>woh8MRTWipIJM-p)uB;JZLakU0gqNKK^MA>cgaQ z)T<=}rG0LB#`i33%B0_x*2JpOwP~n{Nq>$yGp*8@VqOgA(r7O3%xh=Ogmc9vK-iEY zDJFE8CT2?Jw`Gph%x_uD#J6sAobSb?tNXPhT72z`S>~6)*kt}1l@6Aj;uidc=hyP! zw_LC6OQBc#Yb8%+YB5v&t(dEGG9wd6%MTepxcW1`<_1W=6&9#|u8EZ+r^)SOzez(z z-GLH9s>c|?LcpTL1}PT7M0Bl#c&^AXgx^g$2K5}l##`DEoZ21MfisupTH{~`ScS@m~)hvT%y2vtEhJ$hnmF=EfgQKWTLA}qn^jVY+X0GQ}BnSHN+T4fg zL`=(O&mRO_U4Xbu_ZJ{4BS{LDl$}fki}VtJ5*#Ujf3Z%at`T!dgaSooCPabaG7=*c zY1s)9ir8q@e1q3#$ohpxOYyxhPys|Gb4H#r$!}bp@)w~{i8vb*Xx-Rbhh*)Fo8Hcv za>j35t@!n^?CBJc{%3p*|B@)eE2KF>&|HKuleh~UpMAR@p;p(O&FraQ~ z7%NkyQ>4y^y0mUVf%Xcxw{+g1mUO>Ve|V@ToLxjeB1&g^0x_CUFp{gGIN=APA+*G@aLTfFu;3)B{ylxwXF3q8y z8da`kwH;gYK^vPKO>0sjn~qNVyv#Y8&GR>%quI`=YNMaiW6S!{%^O)i@I+C3FT9}u zqJcFe|I(;qNA|C-A=$rhOH@AyQ;>U?MZB*;rk$&cp7|3e|GJX{^&YM zEmv5l5fGJbiex7*S~7og4a)qU+amv3m?8fi{SW5{OxMY#=7Ybv7G#Fu7RbLA7RY}` zhS6-}oa=10%--e6Rm#J%ABAEa71eJJbTX|1aowT#nVYEnRoJM-qWUe0j*$w)HB#|2 zH&XknFj9*}*;XjA1Iz7xQWKf^n`>6)_uL-&*TN9R@Ab2r+=b)n;$$yv5Q_7C4ISxJ zPkdlWSAQ(qmaH|$9D}-%$x|nW896G<%;0$n&<#HF+SIPy+Un#|&4?;QjUqwhGdCE9 zhNz9_+2M&=cG3@D6tnue@##5i`x1%b>qg}y!E;pP8LJHQj$`X~ z)IXv!G=ml!ovqc{7Pk;%YFQXU*Jz(rLsxCeNERF3ty46Ij1;C?%ZwDJO1q2{zDDbe z6uxRxMzT0zkkeQwhs+eVYRe22wpzPPH8fhSGgkQOa4F(LOkHt2yDW59c0km7IzV2BZN}mR2{kI2vmXw8kDd)VHZn>S+r_$6yNN>M*9gDZL;^R*B@}v#cM>?o)K}L-P_YRAip%p z{woqWWaUWY&Fd$)|H=M$jrAhCwt;ORhdPp_-xW&H6caKFBV`G)M+dcE2E zXL4KN`zOG>$2qb?#$AE$zW{UjtxVo30d5)oi#==Me_jCdCg)W0HU#$(nALA%@>JY` z;5Gzv1m{%omu)GDiSzz|D;M&3TS#XDdIl+QE z9nAR_+^@jgDCI=`SAsa+0p?8$?jtZe+$r-*P+kd`{Vliyz?^HrT@L063+{O^>)fTc zZx_UOQ!up_+zc>FEx4n=TxG%C1m<}Q?lmwQ+-;7>7GS0rxOWiW*GJ)FV9qjd)c#%o<{Bv{^2@qVbSs$q?_u`o%H>*roDkU*A9{55Z3||114s5% zfoZhh=7MRp;JU#aCgntYe-FJUfT_Ee#e@D;)k6s|J)G0U_h2x`N;#qTG3faTm>=H9 z^aktuU_Lkj%$c0i={+CJ6;e*9@_pdeeV)Z*1B4Uy1?!DJf_a2< z!T1KbXTZE{!My|Ka|>?bza~W1$A_MvUXf4J_-%7AKjEAzeLKNj0%o-rm^>BN3T_K9 zM;JJgcP5xm4IIf^`^5>76h8E*^pd<|!MtwZNZwaq_W!qDUOl)0Ft>4zXjS??3FhCN zQ~7xc!oLZo>?Ni*C{LsZ#bY*@TREqSFU8|QFuVQ79FH0>$8#>IH<HK!iOH6 z-bG;A4cxwv(F^9!Qcl=+Jh;DsS@aImOaBV{1UDbwF9q`#&Z*kzW5B%!X5fEJUeM1% z-V@-i2XoxJj0^fjaQlIK4NU!ej8p0Dhr_zT{Of(jQT~y|qZ-^EA54h!eyF#P`e#>x zxsG$e^bq!ul-oIjKb=RWm$*ADxw|a6dn~#8EV&0Pxd$z|hb_6sEV(Bvxu-0-e^_$= zwB%l}OVM87a|jbL7~;64U(=9hYT zbD{TFU_Pm^o&t0FN@nhIFh5vX&n<<#gTTCM!F>+qpb2Jq$AkIYz-@~Nu3J^d`X^B;|zO2@r57m?PF^@`Cv)sP{}T7jjOem+J8=z&y!0 zDkUP_f_gsy^YJ=ny=$&p6xjqHdUSfX0n^MmmEM&gpa)FvdQ2YuE9?u#_vc_P<(y9M zufhC-b1J=;!m*!#Id?;*cm04~;g^fR)o)Z3dFfkv?iLvIlTC^ub(=A6b%i|QE&wxc zb2E1hn6@p=-0#8ke@D;#0(u_;)4q+Kqxq{l!4z%FxM2Phej#pCFh8{5(qL}0;Qk6` zgYC?EcL39E!5szWehcm&V74yS>pc$fjdBKmI*-Vw!Y{<#X36cfJ=4j>`SQJxNA=F# z;2z*?Fy9OAWpIy!xpfC7Gq_F?EJyzZ^C9O{^8N{VUxRsWN3*zsuwW=U;;UyC2NsoYTpB4$N!2 zn&lPmRun10N9VsbDEc0l3wAfh_YpA9a!zF*rN_%){<4Qz-WOn2E799W^HLjtd4+ST zd8s+zrj-^&&clbEU_KT3`7Id!5SZVVGcH(Iv@d|E_#Ts|%6}y9ATVcePALyRoCoHA zdop?Suc)tr{@Zk~qDU1!^r+sJHKZ*z*~fw-zxjSdK)x(f-Lfi!olnhn`@%1-VWz{TAHeU{12&&H{6h zf%_*6x)RI@`!f4zzlq3y!p{`n9ri1VZ1w|ld=Ce666bXBJqyf57TlF!Znog=0`s7O zqxk+E%#Cq{)7f_!nClE2*>^jbbcfl#4LUI%#D^Z8|K0-gDd%+dO;}PCSr;FAR20*urI+$S8<>=VBm0(vDeKYONAr`9gIT#(7GF^=iCYWI zUKZRGFiS1CqrhBm;I@X|-*N_jI*+X0*c!k5!;<^Vf?FT{`*x}*^4&g}|AO`DgJ7QG zoG#s71oM`Z6MiPWAA?yfZPt4Qn437K(|aeFzeu^D-Y3Ak+;7%<`~dnJ_|T)%dmfno zlX5}5H-Nck(5$z0Ddq+6G3i|f<~S)Q^v-~gQ#s=Z#6PlpRgdrgVZpV7+v;Fun@Qd= zmfZao+yPLw#xjg&@S!KzFBb9r34S{h%y*VEE|_jXZf7vJ7`PK5?`|+t57F!00{x*R zn4=G49Q`Z&94tpyg1MP~ z@t6%}KhEjm(E(Fv7!0@eg`#qnmn zyPSajGd}d_^mc;jmvX{?XG6f@U^e~{lc$<5-VM5vV9w;6N-yR6^TGUD$_4e_0%q39 zX1y1Jd608Dy?+PuvXm2g?}mNvfVu9+Os}dQqW$d;fqCu}JxBTDGtS^o=MnXW&`aE^ zKVh;sCe6>pZDhf12W}e+ZYOZ{7Tm>%Z#THLPGdH%gK#1qBHvT`o(<*-&Z*La^8Jlq z?v!%EFQoSYFiXxb>-_*s(V2|X>0JlRx22rWdl&302J;f7{mITQC(CTs4@v7TkVdQU;FvvK-9uQcn1}4her6XDA-@$kO9M zq}$`?vbZuz&OHt8f(wcwgBLTF>=5!qzM}Ma3(S|CQ~8g$RWHH16+ZOnxNX3cT5x-U znQq`H-CDpbvEb5Rj?}U=Fe1jsx>k3+_TN z*IID5fqB5dQT}@z%*zIj(&HU4pG!I6KRVVk@s~xBhpu3LQMGR*Z}FAb2Y?SfD*usv zDKN)aaHoK|$b!2P%pDfo{a~Ika1@W1z`SF@eF|pcRr>gnymi5BF6D%u4_O!U=wL3o zoyluMI9dHi@(%w!=0)+LN9AYY&H{6hfunlzN-(z@I7+uaf_c({djZV*7TlL$*1J<5 z57PT>FuPfBm0+e>aPz@*T5tz}InIJR70e|T+|^+2wBQ~9^Q;B;GMG;+xRvk1I0YYi zRQZMc{2ef57TjK7nk~4+V7e{1rC?67;LZZ`D+}&=Fn_e*9s=`%1@}6bFD4&<}CxaGxUB8 zX6rxb{Y>00VCGqHKLB%rfus1I4(5Cd?pI)LwBYUl^MHY)`uTA%|F+=X1oMRjx5_<5 zk#FHckE%W(y<3ARvEaT3W|{>zA56P}qxJY+Fh4eMlpa3=bBTeYcw7zUcNW}zVE%64 zNbkSEydmX8dwxH-55fHIkIc{XuV~K&w-&}dFM)aIKE~<#SBKtT6gd$edQ|B~_MHLd z0x2i-&II>=U_Rhna2zkVy})hoC(JkDLywN@26Kgh+Xgc32lFcD5Phj%Nbl!hDj(46 zC3!7imU2!f?_@Cd8{};adH(_PDd&QI4*F%npNk^Z_|T*B3(5Ndm^9~9^2)#+2IgAM zsp7FUxO>3-+aPZtxHrMn{e{^_|H|^;hxqGFMgjg}9@^RQ_GhZ3OOcFlTU1l@EwJ z56pEI-0ffCiob57MR90u-6Fxx-H z>{D@@fvW?vALmr@Ag%+v?^-q<;G@VD{sjN?rxH4lw5#xIMxB63h#nQ^l9K55Vm4FTH)+fvW@4!8w(E z#PxwW%fM{|?gB7(a!zF*wI7dzdBcMH8qB6I=;N^i*zTobrQ!EE*)CQmhfqkK9Y%n6)R>D?OKwVc79&Lgvr`VkLXa-Ugp zJG{)|z|~6qLVD*~az|KlS6OmTT5>DDVi%9yExCOxxf3k88!fr#Ex2Ql9&5Z>6gdSS zdQ|lgaTkNx_BB06_1`2giwzu&i+jKfa!yq)i8~U^i3V;LaA$z|9p_Z>Anp+`pIUHh z{}0YzvrwfzSF_|$wJ-_!ENwHQKSzadUWy*;fw>~A6Y!;JlK8UzWp|n zr#h#!BMEs2<5hge(;fjO0Ps__i9-@gWP z1Lsu!Bkp%#?ly3bg8K`Yb3bSCQ1uV!`@e#DjB_fzG~Rj^%z`hNJY75nz%1vSPTsL# zzB0(W5qh`yvMBN}KJ=*4m$-j}`RP}Bj^cX-m}@wvvTti}w{ix5I*%&9JY~s!Y{_l% zHH(8zFU6x0++Lhj#iJA46foCtj{3i{c-)KczXbCK=OzGkzv)zP4}w{|5?K(5sN~Up z&MU#($T^jLbU*bSV1B$ZlSkoX_ASNtFN4{4f?n_C;I0PKT%_mj#evm}z_hK&IGR_I z>80;4SbHMw?O`0HjEtlH^H*S2Ux#t3_|kr^4Z-YS!Igliv*2ce+24XY0LEJHotg4(7cPp5`Sa8pSdDnuQxZcFbrufjK z(o5;PE0{{osnVDHQo|XNM~}=e6pwmv3puOOOI95SrjK(fy=31ZV2(F%r1vy1mvT;} zm$+NN{Mmy0Cz$^kIGT4XT7P0>OMK{2>819vlrs*9e^mZ!1Gm&5kK%DMm%z8ftGhq|P z>GZA*W-}=l)Vm#+uQ{jlbHk<+BXjVfN2hmRFr88^sP`Z+GdDBG_bf0MaZacAN-#G| zxuD*=z?}DOv)&iMyu~@4-jBgd*j(n9px(8?{Fie&Kku={#K@lbnEc!TW{#8#>fIMi z<(B679uDRt>TN7MP2qTu|?oV22%UlETj5szKKOf5FY<7O~_;G8ZV z4}y8hf_o9nTLzBe@iCaW+w0>&>9HS}Lv}RB<25iJa84JGufVLalT2?geK!KLwSl8} z>;mR^DJRn7LKt)!nB8_^dR6x*(fZ&SU~c7HFdjl)6}Ufu`IK|PacD3en|ya-WIKH5 z3Ca^3?W@`i%uAeG3;!+heNgYdyH1Rpg%3SCy*GgQJ?C_K{{-gn-IzR;-u)rqLoh9S z=>13GZwGT9=Tv%$dj!n0QZ5+Zm%(gVVvg^gV5V|TrI-9X2h6Ia`uI}%9tq}F&guO8 zcQ7w2@BN|C7oSey03#1DMXe z_31|W1YM>Sre0|nn$Aaoi=S^aMehU|A5(Ue`a5>J{9GXxEe4=8MroZ z7lK(Sq0cYG?F{A=14r|4H-UMFbE@S5~i4d7BO9P|m6B zqk7{sFmG{ArI%W|ojcHf#)lr2|A@N_Ol7B;YXS3+1@{J+wk2kHM}zs)g4?7E^A`A+ z;&Ba_?GG?>bzpvH!94?J&VgomDKM`ZILcQOyC+5_<3o=seTkb1=4cDif;{=LC)#?auS%|8#pRQkAeBZz-!s1I;-k|`^7_D>$2pz6>%hEgkVksg z?MFGsN2iy#6qp+f9JRlXfLUk2EN@pZy%yXlU>>&M-UPGzpiFOjmlHYs^Bz7k!0f%0 zadd7(l*{1w=x#87~grCTLSJ};}7t9@;3)&at?gz8ckxZVB+X_s#1-BH;y#{V6?0XnY{ZUMBaJ@&^ zN8HK89Bt;NfVo4;iT>^-h~Ub{VE@6fOx^~NFVZ8JpBEm7ehEJG1pN}^dcZ8V;En}z znv@gvJp^6nfay4%=~a#2h&vU`z9*QuW5LWmQO`9%-ZC)1=UlL!6!EPD_ZXPfe#GPj zIT4TRz-*h-=IoQ0JQYXz{uVG>ovhbO=e)|mbaF13Zo)pQcMk${J?B(< zN#4U?Cj6M`Rmr1zY;7=`8@PGkwg&OTz?^QuoeSm)1J?j~H-h=tz|py)l}?!$ znT8KNs`!$;`C!g5aFlMBfm!n>Or9#gd=K1rz%1sRN-z1P4a`9Xj{JNmn1?O6r@?&p zRDFCYA5?%jz=9h9bESbJzx)Qw=BMfXLVn%@%mC+t`BaokYFEw#b0Ozc{v$tM0p{NZ zZZ^0#!R&Rq-Y=A2rhqxkz)^h90khH>`uKhe+{R$O%Q;m%ob&*5fPo|b4S>0wb2|S$ z1?DA#Jo4XLV0JuH?-#PK6ikPKqx{?l<_H5ve*O`d#|#|B_gOGopT+Fc#dmKo(>SN{ zGu4yx!JH+PC+gEAxEsKH>!*6ZkpH#@vyXuz|FwfT$G}m1F9Y)$=XCL12Yyl=^;K;t^V6HWATY=eX4r01zZD|a}8V#xNA9sKb=SP zb40q)KK*wrxWmAG1@4ev=>13Bam1Xh=g5C+fT`x3D!wFd9+*cA@+cn9fO*Zpk-Yc7 z^q!-)kK`=_bD{-z2AGQt9O=CZ%ns-3^-c#@0_IQyNAivbv(kBbdBm*==0pQWdd~p! zoPi_1yaMJ!14nwl26O27X8Vo@v(g1-ZcQ*JT5xB8S^Gk>yiLHIW#A~EUI6BC&Z+V# z`R^4lr5EY-61OLq6D+vX!8~i=$j>i>NnEVgOX+qXm_rO4$vcjiOZ4)b@(ZS#b2`7w z19PE49_hUTO!1|9y%dk#!F=Dqk)Nl6In%&VJkAI680S>+Ans)_-@c65r{em^J}?(@ zPSwtkeOG{a-@uVyz67)Ua=l;3zGK1M#yORJB=4_a8h@#mN8DU64;wg2kEg-BYT#&` z{Vr$lr}N0#BjP6firL07-}qd#Tf}W_$?a&#O}6BwTXH|Js_e4(16d7u5SanAfG8&`a_@0Mm7q zIUfCBj+Amj9{KqsFlQRLXThD%8T{!yBA*81aq!jHH-Zm6s&pg0KLPV|3+`etR~opR zAn!L|I)5$G8?^5rFo#Py;TKxBK9Mu{(|JUE1?R*A+|Ld2h`Sifl?IOT^KZa>#yM5_ zAa2uZCPw1;(4*o=@8Muh;G8Z!P6u<2fg?X(24>;4WqmsAB_1J%k4?QY*C*RXFqatQQMz3XCVr#YzAi9>QZ8uUkznrUoXS2bNB`jr{&XIZ z9zxz9@XPDquKtbLzMH}PLCOhvlx`1#dBTEw9?Yu-?kUK7morWz@Q;W`Fnu4m33~CN zN0qO3!w=7cS@Rag1^3AWspQ>)ABz5n ze#yN|9^Ee}+CgF8*7$y(`_M1Ohn}E3!BPB<19Q58BR%JWxypjO3Cz6~+{0j=x8Pm_ z^N9tw^8Hvx#D^YLd?_AVfZ0{biFA7&0w#gk=m92geS}l_`A#s;b55m~{QMf24-6dH z_Z66R{%nrNreJom;L5<%T5vPK>}SDsfLUt69R=oeDJT3)=abI`Q}rN=FU?!4{QNMO zw>hWt^Cw`6{%ZE$I$*Z4;C2F2Wx>^gnQOuA2d3MCTMFg`3+{9<7fU(e=gZ-+tH8{9 znE6FlZ@dj=ok#Tk+ZE}wDVTZ#NBMphn0*W!+0zbYz=Ash%&8XK*!}fk4}uNg%3T!{4CP#Zv5~qFi$?lI2!kf@)6|fA4k4_!px#tdN058hlKa4dD}|?XO5zIRl+^1kxeMKMN8pvB8%v=N42yQ^9SQ_kQ| z=aJx`{yQGrod&(+mj}RX@?U*CC?9MCrpv&Qef^xlpUxwT2kq}% z3hoqxJo59;!Tia1BR<0!>HGQH%NC%~=!x<0<7cM~v;29EOITrm3^IP%{CU~V*U z6puSNgFl@|77ya?vfvWn?g6*m8~XT?Uv>l2Vc^IwePAvzaAe=roWY;YBZ~*+ziYvL zX^=;HSA7%xVtnXPl{eaFSqo-=19tIxnej|Q4 z5?txqOdiEw#{ClCH*>}jrr_wD@CTOM58q)rP4XVFu{|FGoh z-!to_bh_4(yTO8c2l8$LciH<)H?6~nd?4}_^~b*iv-$^&3+Cq_w;`DCSa3UosgQCa zpWX_+)nGp29BEhCx6_9cBT;1=kAZ01Iva%wZPX31CjO z;LZkfu?2S(m>Vs)JHXs)!95J-Nek`;Ft1r~?}7Quf-Cw6<3W5(>H94(TUl^Bfhn=z zz6Yk(f|~(mz6JL~FdY_LADCqp+%aHIw%~pW=6nn8S75HS;BEtRw*~hXFppbs&w=@m z1@|_Xk1V*z$2jkYk14-w0Os2kTrrqkEx1Ww_O{>}!OXVc_5sss!F7Wfu;7jWbAknT zI+(L9xJ$uYWx?G9<_-()elQPPa8HAI!Ge1o%zGBx7hsA$(dU<~k(t&3vpeTh{U+jO zfax}Hdw@F`%xQ#!>x(hz^sO+Qua|@VLIj1_W`wF;Qz?}aXlc(Ar z@h-UQ!CdmWp4$oy^UYxX_J!U);@$;&!#*t_QaVxPNh$QbouM_9xe$xJqP8eCSd2 z>wbgZb_DYe>Z>waO}yP4UsmTOU7e3#OcND*q8T70e}sg1a5eUo5!i!MtO^O;~M} z$VT{>{IV06$rjv9Fh8{5(qN7?aDylizW}q=8qB`n_)V0{!@zZb`S+T7?mOW2S_|p6 zHsk1DQ7(nN%}Fnq8`sfue?~!k8_ca6F>d>SykI%s`CF?*D)6BP;(dC9Ts4^K7F-LM zgavmXn1e02qrv<{$_c;F`qM8sL-C+T=D%(5{iPP%c5uWW!M(DH*)RVC^MwVs%BHJC zHo%9Tpr1uNNbeS4syCBy!SrYX(_+EJ!5k>%gx)J)(;%2Fzs>Zj=DBD-q76)nbHR87 z?OP7!cqtdudm5O^&CPlb2XhkVbb8MMbCHx2dUruQuH+2}^+xT#gStI{#e@=C>Byy?K{9+<y?0_HN1hYZCo}+qv3otubaAjcjw%{7U%(viv z2<89_ZUD?tQcn1f+NqN{Lw=!0_)l;&E;|F<$_>mf!S+pXx1a;w2_<0u~1* z&7WU{yaxO@4cuv*Rr!y&%fP&5;5G;M1(;11%JQGkyDhkFz|iq1j44d%Q>EFLQEOK`V?xn(iqRP#;5JrCyDee~RINPr3Z zt`hm(4;V-JLc}*%&UgMH#(DVA6D;S#&v!sxHJH!$H_PivtP&Z-Mlq7<_Ln>l?oH0B?4$i9AA#AsOCOJE;2Oc4Y2elc zcRrY_4IJ5bGnhXbII`~{FdH9Ww(mP&x(poI*AM0x1J?lV6flo*4%tVVZj>)y=FI;y zb}!&MRa+mxx5(boO)2SStAtMpavdmL=Z^^$a*VR{6( zJ}{4DxRcS>aG2Q{j?Xy@VSdSQjQ2atv3L0MV7!xInrApZ7q^AEF~D_)xi7#Cgc)YK zqJ3ilHmK)duD&O$dyI7h9DnY258TuJ;(lHGUqiT8VYb{Ky8{yaCijiz z{qcD=4z^?-MXnvbb|cJtrYp+#L%5G%o_rvV=X$=Pdjsa40e;8#gHOZcKj|0 z5_Se<6!fxm*Zfn2DsB<>Ib+cFs%bz2biv=E4q%Z#@O$I`Ba>1A1Z+R zQ4I5CE4q$~;#ET-w!$6tOk9`b`+y?Hey@RfN1Ur)e*bbY?32yvm;3vw0Cy+cmvEOp z8;{S`@3qL|I+*uIS$P!g8z&=P!E+_^s^efwu7jd{IleQ+L=Z1l9<0kbaL8V`@lPaZf<~kzf@k{dvFg-i0gMA;uqDWsLtGXkDORC?*trd$vP+9 zDKKXSxbt8x4RBY&+z{Yyg}FDtJqR;2z>R`=Il#RE^KO7!4D(rl`x@rw3|ELb_zmW; zN&flR0e39SL9fP+`)1Mn7F{3wbGlPtE_@?)j9=uE^E+r-$-Ln>*nI0?G|Z#`Hv?vV zfLjW)D!{FS*%IJ(!xWpIokwYyasjR)%&8f!5H+g<()`3(QOJ&Z4JgX#HB z?0oN|?s~UmUVj{HzIhuAGcv%9g_#oI-iBEi;FiIx4R9M^wgtGoF#FHV&i4?QV**?y zn3@5u9?XRqj`Q0BrvAKme6H*A9Na+G!5q6VcKm$DbzM$}nJ3OSzaPSU9^k%(*&N_@ z(R`3y=L2Al3~+@or)0Q~kl?>)7RUYa^R}Y86zyw;`0`^gukk-@jmFQZid=GETfPjx z*N216SHB-%wgtO6m|6kuY?zAzTuYd10^Ch7cLun=Fpp-qWhm@Z zFdaXM>*AWXW?1)IVa{3=JKwth1mK36zmG5d74C01eCz&Xe6b?Tg{CXI-bTW;fcaS*pKD#$ z+tFW_%sUwen{VD~z?^NmqJGOD#sx5K0$fL!J2KoD#On=n%s27)lApgM_l>$Rjm0JN zC>q~Oh}Rruhd9^!vX*dlzQw%ZU`zH}6z?s3?G>2z>tg4M$M=onU?z)mjgM|7%-jIC z1ZG8s>xm!Ct%bR4OFX_di0@hlZ~cn*c{tdT<4e~0-!NYUxbIpK4$ZVb$QyRCea;~OVN()gdcB;BL{$9-sOfa?HP?Du$VzJBjT9@oNs zxhJ-KEvj?!IzRFce9nM_%{6a~cM8nQd$Z$x5A&-ySGag*cB&NXE4v>@3XB`v*r>zNISW=N*9~%T<7>7T{{bGz@S}VcG<^ zjxgNqF1g3e7INv@<+Eu@rwe$1N!I4#$3t?IXxb`qz0$dN6egW^dI=Q$E0*2y58t)EqGw5 z3RAXj9MAXrlMlc=F3$Iy^9;;*(-rm0zkB&QOv`$4zkI*x+7DiWd0m{Z-&rspm@e7x za+o{L$?o@knC0Sp{eA)SgXxO;-HH5ug;{@Y+;8%IN|EFLU#fm=a2mCux)ixbF`$Fs zMmC5oUoFS?q2IuiY#2M&`zU@+b2Q8}alX%KHo$BX=c~(JnElU-`%Su{JT{}>Ltyrb zOXiV$ey-mrKd&hcHdnl_@wL`4HP4To?|nr#m|o&s@oM1<17K!0j^nxBmwkkOSHg_G zAa=?1T$C?Ax7-Tzm$+oV$$U#*n4fnT4z{E#iuWuAbS%uwi(^+2wrCwBh5<$^Dy^% zfaAYUUJ~H=-%t7evh04lV(^Ew%+I?Q2OGZ4tRLNjFxvv$UYHwNWyiY}W^I7m0CVZ( z+3~J~Ss37!!JOGTJKlLPQv%%EFehB$k5_=go&s}5o7g3<^W^o>66P9l$@xgSn_%uV zUD3M#4D;3(=CUi}eqH-B?+Z7G!D-a2>xk~A0LT1p33S~996ukq18%+8D|t9$@v`x^RhVKI(P%- zUDFly`wJ$1G0gO9;(n7q2TS&QZioE5i*c~|`n??H+5mSm%-tD|KPSB(W^{(*^XV%v zGXmUPn57x+J0!T0@jAx&x_&PHCFc#tKSNkuL9hUFgr3F>$eZ) zs7~4Qb^=WG0Cy(L`5BJ&yOi;6^4E{+emTt6F0u3Nf2D86=VmzAeD$jcbE@fz)_ons zs3Rr{h!^WR=kIaf8sPZ6Hzm-`2yp!Uzu5tP0(ZfVgCxi|V%>6Ey^;&uwu$-|zd}cL(18;$U;d<8$jUm}djrIGD*9?r_AL3G-ow zI}7eJm;-yn<8!?~ngMqP%tmppJa}K-0kiNU zA|@+d6}U4p;<4YBf$^?^yE!8s$McUdV{Y_53c(zr}IgyYl@G=9i3k z_;uyH1A67>9gc%7j(2E->T2EdtCeA@i{rl0;Lx<=b#tZ|oJP%ZtaH7Tv#-lWaLvWK zu1l_iZh`T7!41ra$MKB|j5itX?SOcz0^@xHw<#cA{=M;>MMcJoYaJW{cZ^tH{ptqB zYYf*SBOdG5JuqHRxB&t2#sy! z7s9pD@$T+^%bnNVf>Fhd*Y)ixUf$7%=IQI4b?Kp;YhCq&8?5_P`v&VWDKOqNxVZuG zz6y-D0d8AHJpTLUgL;R}TSd52#k%H=`8ExV*9xvfMm&zMPhh-ZaHBKg9ff#vU{-2p zJP+-F`CB_Rzq}tE(+59a#le=VixIC0Ol$2_JdUpi%wX+|c#~jeYNz6Hd@Er#XlKML z);B-zARKJDJXAc+M>R1K#Ea|ts1MgPBOdeZ0@GhRV|-&^CTpk0$9$KQ(_j5h%8iHvy6cS>NqnQ#jN;;jpew-Ihu*q^F92*u=zL!uCiFy zd@x?)zLqYj2E@BNFx~@jk7vZ=I(;oL-kWgm zWyIrrd>a^VGu-bP@i@M+gTnTWW8tcZbtVKL#ABUHKZf5M#=+*QGk+dm1*W<<-+DPyOcW3=R-L(? z>%lb@>&v49OjmKPIx~+)V4h6GORpE^@iNS7;(U3$B?jLTH7gIU``K`-#QO5s1hZS5 zFOS2AV4g_CORoc7ALC%&$Z#C}2V!srf1cEc5W zQms=}Kd!$DVzTDrG`M;h@i@M=f$=)Rb<2py@eK})_Z-|S8Syy2MS<~_!L7}R$NgXr zOzGiqoqhXc1(<5$TtsHEW;beZM!{Q(}F2 zOoVw;oG*{hV7^Mkv-8*n^Sd}#9-Ozlr}Vy&j>r2}0o+MqeR-S-bG|rV9@oKiO~gz0 z%aQeic}Scq56;I>F*uEyYd%K6O%dzMV*$)EalSmZ!0bxIOXtDg7cCfp-}k}67RO6F zK9AQG6G6OKc@*ORuMgKjtS^rqF#W{&@)!;Caw1-Oe7r8-fmxo2mv+qK7cn@Enw1Cd zGry%=4fFRv{{wfx)BjsPIJNIGUKKHMukQQc8E_3U;_>>pCNN$nxH~f9v3^5g#*6dK z+boz5GU9RFe-E=!oa_4FyzdZ$)2LbV!F+e6oIM|Z!4-`3&j;h3EGF*NJs;KK&eHMJ z=R?fzN)<2qe8_NZEvMEC$9I)-uIIYz;BFP`x{es{vA}pw!Mzv|Z(d-$#c-cx#N*Gc zw!@TtCZ0Fn`l|wShB#Ngysx%|X_ttX-VbWPb%z-vj^AgkKmI%Iy<%`0HOsNiC7z9Q z5axUyKM?LHv93HA?_YuO&V{=;BOdpmn*!tA33q=+JnkDWz)aW9ct7(A%-7nfbQ|*GEj8g}qO5zj`?3>^z3TJulXk2jjgH81H?! zUk?gjsP;eK$un4-Ga`PPCvHz3~Cf$?sG>zxsg*W0MTcrU|E&xpr-KY{r{ zJ7d4vZw#(C9Bi)n<^FdH%-Px*@vegDq@CJNneT&Q*e{!F{~HSTd`3Lx`wq-D#G(gUxq8ZvbjI9I-0S9@qC#5Ht1C-U>AvM@)B zbLGJ(CyBvn)U0*I`%yKx`eJ=~w1Vj%&X-3Yn1>Sa()D8=qhMYX=gNcqyecM20xwn` zyl+iOIs5vU3AaG3D-YIX9n4PcjD4-l%lP+nIM`hAxSs35G}X?C*9GP-?bPQ!oTuSp z*l*N~e^1ALN5D-G>zm)%FpI>w^58n%0P{;Co;|;Lui)>N;b8O4@1bHMh!<;qIUk3^ zRTk^ZqaMtK;(U4B2y<&9o}I@7Fb|9KR!IN0KTZFh>82;#+>4_u{%(@&3S18t3mos1* zh;!AMpC4QUb5kN-x-RUew;12}SckrrQ~MQNKjp07cPxavAMQo5zI@+=c~6`xU#^31 zVYVb(I^Uz=O1+Bb5*%#&`z5Y*&=jVXIM+JhKG`0oQ-lXCX;HV|%@ z*j!zV`IxHWx#r^yxKG6T=HmyL?c#F%s^@#=d+=oZd=Lj)?Ckld3)4!RZ$9pW86eI# zA46cC&Tt&xi(;Yy;>9%|Q&P^JkC|`_#OCT^%*Q$v&ov+4(Y+Se&o>`sVG70N`Zea` zT$rW_XU|6$m;vH^^D!A_hB)7R%!OH;;W!_kh{>9dZ&J>lk00T7h|Sf-n2$rI#5MkJ zzt(*4eZZk`RmA${<7}9V#O3-m=A#o#kAzFl2mgK4Fqkpo;(pVP_oEpwbHuskgKiPb zvJA)j#~Lv>jhgHFSf6tCd~AZ-EjCvdV?GXlJ$pX*oLCmFidgS_z+5CQ*RPrn?&F&*N40GLO_x$4Y*hKs>z)U5gy;ww+Xy(QL{$44-$#rg8s1@m_zUOEpxZkl_1Al~G_cr)PU2gLg( zFy4=FJ2K*NJ`Q;!x$a$`hgE>9Cf2nM3K6dfOc(8p_o0JehHIzhgX5b9vp_o|-a42q z+8OamO$*DnJX|HQzI+?OT(6xmzWy*nv@^yx8D@@lM!dB!KWb;hD?U9e-^1Z5h;`-5 z>*Jijc#Yv&WW?kBt$Sd+L2$z};&FeT2D3;zqkbD;wrOY7@1Pm@`~?SFt}aHrdN3Di zXT-ZvOcW3=uIueCxc(XOqR(vu<4uNpJ0l+Jw+d#Hc1FJWZ{qK&;b6KHGs`i+H~k`a&f`#3P(8n_Js@run1yWS3hD=*epzdA4%iu2v4 z+rf0sh{xxRfiRCJ;-&AueBO8oW}-OX^Tu>B_?DtLFgqCD()v*8wH#N$4+Au!%HxP2M%xUS023fqUO!qpb* zsvq-h6&SA_T<45<%y(d5ykT&oGvaZ6=fJGc&bZHPh1si}y3Z6MUb)%$?^obp%hkn* z*BYjyb}Amn*AHg6c1FBuFmtt2@pzqo1+!B-BVL(z@ce>KC*j)J*;%leEG!y6BCp*G)%ZSH) zaxlzOiFk*m-e2pJor=ft?Kc;Hj{*lnD>t!%DJxJ```xYevLdPz|7XpsLL9d4ce)AtaGvX_`47|*nD+44W^!UsxI75 z+KPz+^2MkNueWx}x$4pxu17|{e6AU$;zj+c@zFhLIaL>qZ@6-<@r{9-EH+m^Bi_=$ zc&p&nXT;;W`X?}6{(E@8ii6EHK3=~yVVa2Z-51)!bjgUv`@$fYp^13u`$9Fi@h~gI zF)wSs=YO}p!h$#loJP%Z{Qep#XWtjjggalXt1gUpU0}SM;qDHI_f%lK=iw#>#9JH~ zZ#mqT8S%L8{|Jm%;{E)*LvgUV>c@SzI?Q?68T-|>Ft=!@t|RVOkHU=7&WJY)<^%0i zJkIa;VsIKY*LA)b?)Qv%tY6uMdY#(quMqAOv99`Yd>04CYYBHvMm&zMcVN7S;hxHf z$N8NOvsgQ0K7N4NuAQ0>&hNn=;NQ>SV9V9Th<7&3McS!&tY0TFQ9!)7=J!^(do$wk z^PFd3-W2ECCqIPwJR=_W$=_i1CE}&`$x3jCEW*E|!okK@Yyaaud9N5cHp_7x3{E+F zosNVXCpI@9s?LnJATZuCxU~WC_5{W&z8LR&aIm??$8~V3mxwm8>(aNW0pxjGRqz3xwi zyA5WvIL@QBp80!5TgBisYL??V&HpgYL6~zL91d4OtSb+W=bXTJjp14Z#OodyuP5Aq zfOumA<4uB_nGuis{YsdP+8O)v{!8(`0tcI`e%$X*gQ>5b5wAT=7wy#ZJ=f(RG3+;L zj`tsrDCgP_M!=2L{i^+sb(s&dQadA$9WZ}ur{b|L$9#mJJL6!>)z6661g5oiDjwHq z4>3_dytwkc4{lIEya|Evrohe4h{yV^f!U&+k#DJwu@B*3%hg5Y%Xp{5T&SH9??#y0 zwNvppA5XxH(awlB7iOt;M!bzMd$cp+9r17c-Utr1T)xJ-uP-Kod@r*@zVSFC2+G~N-T@>;O|*k`!o0Pp<-|vwaBS_`FnD&DwlV3 zVd}qo!*&0g9Bi(5TvunqT%w&3?`D|0wNrKB zd_EjZ%o*Al@mj)Mqn%Ng z-eTgS;MJ%L=cBK3uDU!9H!7oF{(NU)Jvl-o6`+^KNw#roFE?J#}Bx#}FfUw|2(h?ib3 z(Q^~bJaO^wEu~#~jPFA+IE|Y1et|#VTCbdy?!#YD;C#mblK`E}*2eCgg&&b2?!gZoIVD__39{28XiS8@Gv&e;D> zfT^yX+ON2uUIKHqc1FB=VII;>#pC$K!@Q@R5${`=&DyE!=rF`9_&WPK;`%!pu9jHe zb#wttOL4jSsXTZc-3HSu5zk&%LtsW_IQ|`n*Tvv8YSzBXJZ8XsoQP*%AM0SYi1X!9 z>YMz$!*H;!!eHw#V{V5l?T_sC2%(-;@NrhhIv?=FOQdDrY7R0=Yv@; zg!xFEYhPm?pNqk1)T}(J;45q4ihcXP^|SLh0;ZxkS01c$eV9uUE}chbxSL@<73caq zhx<$Wb-4fHU~}cme!Ii;7Ux2|&x!TbWh%@Zajv>>9jt}pgif>5P&w77(65^GBt0LA{m$P9m66dNj*Fh(k z9toGO%XM(WV0Mc0?SK7#z|T`~u(|5Teuu%lAkMY^PJo*(hVj^}^~d${Io!{Qc=r1H z3#Q=5czmw9aJ`%iQ$w61&j8t(SXKF1=szbD#T^ zb3N}4f*US2R~KWSoTlPg>y-UYSI*V%Jh+bn`u$nObM?DPIaj~C;fnpF)`5|41u@a2 z@x}Pu=M4Pcg>aXPjn|94{%(S~Q(Ugj#`ErzFwZ68rLRl=KH*fDFU2t%>-s3<_%_D5 z;xua3`irh><*fHnyxuN_yH2bx-@9QR5a-MHMVLv6c4;`n=NR=#!d|39`R9ve=h z7CE&K)xuX6DQ8`mtlu8xT>IZYaHW5V`*!8aby^kX9PNzH58A&NFP zYu)p6l?TP(G-{UPdVW6T?CW!&Vu>c<12tGE7mu@ zT7mJ-g1bP+Q`g7I7}O0ap0#iA`gl}1R~|3Gy_(T4*V~6Gp0!Td??=kH`u!Geb4I_s zz6!P{=fmok>#r1CMX|o?qc%)Kajtpee$WBtrbN8-^}&(#h8ZBvw;v1wwRHQ(@+cbJdyuy{u2g;52Ghzr6qc0Jkd<&#_q5DTUYd>I}_uCcEZ5+*g-#P&9NU^Sb8Sjk1 zcxS_1lo786;&p;~TAXh_UWIupBOd4DbC_=u@zV3r0B#3N&E0WrT+c7OuZ|Fd)2Lb3 z8|yMB0bFxjL)$%zn43c&`2L@Za(K8#vf}^=l5(PF${E_1w<=uNTZi374)P z_rLKl%f$Kizfybf{t^e9Yu$7II|inzIM@Ed{qGzxjK^lp2ltK3;I2)?v*+VZnES=K z>caK$0?fojymVc-{@#UIB+ivD*UJhqIE|WhoimR$%DMKxjVYJj|M)re&v0e`$X+j1 zV9pTdsteakOPCG`m#z!nFZ6+VM;z;9%^T}db}#-r95~oq^*aP#I~k_7IM;gN^F|Xf zjK^m6%Q|<2yFC%lUM~Y-hKY04h3jQ1%cTv#!_*PyTF)Kfn!>y$j{BxHzVq?_ zpZQnZCr+bgtrym%w{oug%!6>RiS_0C9?ZYR`SRTivojGdJ#U2=U;f|tJQfF=>wU#> z_*z>r5yXot-@BEw^5t_$U%1!B`tp4rX1O?DzQ4fiPQ**+%lliY|6u>a!4}6$JH9_U zOH2gu;>!1OU%oHGye7_@vjLt>Rhr<9^V%SV3Ml9BjV&^@kZEF4wQh zm;1qFm^Tyg()BwX?n9V;;@G=Y7p|A4`^96!Y1FLs!uLlvDre z=gW5u%y)@+>3sR~#$7bU|F_O*$FG(ZgVU&4b)h>p3lDMTMJX6L|hlw?~VKmZipD1M$J{1g(+v(Sy5jmfX#Y5ecywIPcE1(jP8I9wm-maNDxUQ|na_WhDd+0`sMS*qbi=& zFMkhUFx)F*ed}co%o1_Ae2snMN0?s|@zU#s&+Yq_EXX?q2V2~4+VOqeiDDv%7i-^O zovSM6%C|b)#fg6H`Mn0_W^ulJABGv0h?mZT`A&eDp5d79Vlg<4nk(ObD`(|f1ra`l z+neau&iA1Fg1quL*j)KCk2)~tCtNz;s&LoA3>N2mf4&4}g*ex9G2d^kh51>WYrPx+ z_m>!)M$NUqlqm?i&dbA966>l9uir*6t;G4Rqs}lrGUD<5+c22t67kY?=KeetW|lZt z{g~XRg2cFqb4; zx-MLQH^U4U=Uaa(VAhCp)sO3MJpgzD>FG`eVQA zlyluzH^S`{>#8%K56YCret?55=ZxPgXav(-J9WQgylyc4wKL+4ftjqGipO=Z6lSe< zM!Y>R#Sc_@81X8?)YQ(1*Bqvuc52_?-xug52B&c|evg8q>Z6=%-Uh-A)BUPESm&uQ z3$-)ySP!#RJ0o7{gYdkIgUz=N&Vgy7or=eK>kQLVJ7at!V8&`^#G4PZLOUbgR+zoo z8S_@|;5gSPVZIpi#@`1y2ClwX-#*j|rh~X#{Zt;@U;4m2l!%w!hxk5p6wESl9I18R zuZaKuxI>b8SdQY{l(YBe3*cIc&E=u$$M=o5sd(1=57w_Y+>2s;^?MWMJ#o2yjrx5H zvoR6RuHQbG>W9X)an-K^#@AO2PNU|k-{_RH>o);zn%G<(s(!p5tx)l-`W3>hh1)CE zSHFYG;CUAZTdrTDesy3Ph>PQ;>&LoW4%0)N>vKZxLleZXUp80$W~ZE8zXfp1#OCra z>bFJ3bJcG*+!2Sxb@A1&Doky0xqglMwSu`i5znsQZ7@%W^VM&Gn7DfG`mIViyMEum zZ4#Ty!>C{W;c-p=+pkqW?&D>YbKSQp!ksEM*RQG{-=8;y=`7ASANRow%81APbOOxl ziFoPx;HRPQ!z>l&damOABXR*FK{(>ne>%T79@5wOL#JR@Dy4DsG z4Gu5X_*myN;Vu{J8{bVZcZze(8|(Ze%yWr&={ocM%v6|nGaTpR6EQfAnw1CdGiy@L zUiTZ|wuyD+!OzVOIs(tTIM{r3sSDFsoGTvday`r~iFkHh?uQwY;rKi`Rt(3-7S%;v zzkL5UK{@OBh4q`Poa_318*ZUkSH7&;`oMUb;C5%k<9r-`B-T9+Hs5^IhiNL#H9pQq z7nnN|@zV3b`aJ~mm^k0{_Ouv|kIh=A+z+0Gn&frc*|ja73Z6`{f;WgI~WI>D<11|3QTQralCY0__(UqQQL(N(nB~O4cyGYHn-P!K`Ij)iiSyODWch-;!*H;<#>YC>fT=6aRcBu3 z&0t!I^Ib>n#jsyCtIoX6uZ6o!tS^rTVTOux<-zOxb(k6AeB+xdhGS#1#>eaYJ-DyM z`o^~%<}Y!s@v+WFA6<}lA`UiJoukjuVb0HRT+dgEi2~xq%7fQ=hm^C|b62>YVqJL@ zBHjp?nc{qPSqif%BOdFr6Xvf(Jo`F7^q7LY<8iRL>c_g&5)(nZxav|jp@j4$1Gh3Xm&dXrdX2fHi_s|^cuOF}TvM@)B^Ib;46pS2G;*ohJsTQM2;ke)R#|=ZSdsdifb< zmpE4*+^-Hht{|@*4mMw%D~gFAUaax4&L_b&5bLY+_tpl#-@^H1q`toQ3(^{Ns-k3)ZnBIwa={z{ULt&oJaLo4&F*uEyl?V5Yx8N2h z;@Ru@OPHU;x$@w?QKGOQuM`e8U!4yZ6G6OK<71tVgsUaiSLX|0T8eXxk9EEcrdJ|f zy3X7;hQN%br zwQp2~t1Z?yzE*+p+QD_sh{t_nAk1iSzI8ASW^P72u7j^&en`YiuLE93f57}loNqlB zoS^HMj>qe*G~6*_eR-S)Q%{_$&b;2*!dxTHH@=(1;9H_*ty5laUEv0a^^Na2m{-KP z#>YA@f?1x3m#z!1x9?%LWjJ1M#ZSzxGuQJ0DQ91AN5Y*T)|Cf)Y!DdlBDl*l;&FU; z1jg$N_h?2uj&EXMyf@(9&4?GhkB9k9oNpbJJPGgPaj?1S$8}Hxrmna+UV0tydTR#L zN}O*!w->{H*{t;(y^n{xO{_1E2VsVabLA1ekB6Bd&NsffV&c)+ z^Orc+_*mzoE8%@S4mMYvqxbPJ=Vv%xZ&!+m0^-H0GuLy6l(Vn5u5dlYy7J)YM+C+j z4L2zx9>=#NFy2bIbs6zEzP|(G?SFDXUKt#0u6%jDod$EEINv&G2h%wt9@oJ@n8y?G z?Cb3%n2F+i>v_5u=D}vI172@4;TDPY<*^p#M{%yY@Omp=89!IU!R8y^VPYbP7i)aH z-j0B)Db_c>#xO0!xyHvjcZazr5ieb5UT=@VJe%Qoy-g8=)2LZ_a6P}7a`yH19^Ajh zy7J)q+YGZ`mAKBnx*Q2}f;d+^)};YVlSDkbF707%&T#yBSzj?YjapO}y)FvJLT+k+86Fov93J$dnglO-qp_d{je`#e$r0;o&xu)68~3_ zR~83bu3sZwEtqq)Q|ph{&DCO}fP682-;DdvHE{Qe^<8g|!;BJ_8=uO9^E(S>K_Xsy ze!0J_g85pUYkui|5`)vIS=SrCf2(p!3HxW7-+8dxmr0_UA~3etov1Yur39s6yzO?gDtmS zj6BYQxj;J=k9D~L=1%R5cu&H-pq){dcf~{l#`lD#HrbJ zIRU1+b}An0atX}U+8K4Z7v>@DjJk{$!;(bJs0;7=FDvJ&%XGMTx?hzC>+&_scI}Kj z4z7-$yWn8Utt%CebvYB}BJGTLonY?JPSu6`%TO`wH)@W$3{%ckm(g&ObiXQ(=>0-q zyp?e4GUD-m{x{4Kr>XiGbvYfTzIJMSoVWHcw`*s_djjS;?NmI@+iaMn+8OaS!tB&e z#pC_0Obz^=AP%jHC^cB+1ykKr)mv@_x@fLW%Uv5#*N^WS`3_x)d# zbIsc>x-D{oEit4>pJ56)({gxytv|>4R=vSJYJWbVD8n<$oCnT@!F|;8Sj0V)!G^HcG1-F z=gav$9;Ui>M!ZX4uGCJAkMZt?c}P1W-guZdv{Ugo`sHG98a3B^tcLqOAYR^?aZR$~ z6~L7h>sv3i0^^+vcX38M&hJeyy|pvyHwxxu?Nt3ZA0NPcuALF@H<;pGt2<(jCf;Vrf8?)aeN=ce5IWcZ!gUL^;8}z9>02`7@S7U zHNVy1>SV;@dTAXPuOnQyjCh>i!7yXAGxD7avs62kFXL^5*{7Wmul(8gcPBX5a_d0F z<9sxNX{DVJ?{=6z+8OblgPE+I5pOBXD(zG}j((>Y=E3Hg-+gfT=lJvGS1XB$f_dVd z3RgEH9@k5oz$`5gi?Ry(79^I<;LPSua|y9s8mc1FB%=i=wJIM{OQ#n^Wn ziisd!jL$(BJ7tHO#t1y!7YP-0ye7 zl&&Awg+KqXe!jqXr;EX9)GWvOJsa*avA#TRfVoXvZa!39_;bm}VTOxyeU8p?j}{XR z4lmaDxSq$Roc(i>DR8sJy2i)*#~PTO;(Yn$Hz>$E90!{#9_w5a<}7h>y!5>B=bV?q zw99b(J6qkw;52GcUDUc~{q9xH`uD3`r+wjGO7v^j?=6`3#rg964rWs#UOHd?oaAqq z5)I?}xz+*Q!D4V4H7j4%^$6u$*LgYRT-SL8xN2fu`Eva=35?eou46_#UT^(ihHGc+ zf74**YNxKZLd5$DW}kLOyz=Ma{)>anl`qHF2&Rp8M!dUV`fI1g$Ng#y%-h--@m9gC z*G|Rb{o@~)LmH_(jCiNQ)YVSKW4>)*x@u>{djw{Lb}AmnH$x0gqvl$F3*lDic};0xc-{KbrkE%<1U!~;#}7+ z@4sVU#*1_9yBzoHVsIKYYkb`Qrl*{J|Ck5&kyzLGc>nzwro;tt{e1Zz1#^-(S3K7F zJea15cjZa4Mm%0` zLt(~iXYBXy!z|ZM?URLw_Y2H{7sYkXCIxwgIM{soo(prab}An8y$PnbcE(U(NdhLw$+#hC$c4{4PJx_+2qn#0NEzFPF8SAmZev*&jM%w}=E`Q0UkDX_WbcVEic^IQBB8i1p2H>E`&o8ysw|x^RAL!<;KFj%UwrOPIFe zeDiy~n5bjCxaRlfl(Xme4!FKzU3qYRpNDxvJ7YeU!+fcoF~5Jn6kMk2XT&=hrj~Zb z{9Y#Jzjd*$U-s5gIoET}RdAhjzbX&LdoVEGV{p%8#4AL+w_sL_^R2(lFu!NS-?QTpO;T*xdS4{c_wLR6J{b`9Aqt zxZYxY^&1NFytrJyYJOS2cVOm=bJdUEzf=rPqh{5Q{~qGs%DL+InR2fBeG9i)Y%UL@ zeg!S#H6X(??{5^Plymi42JSeqzJBYec+tEW<2yUhontvQZ(M)pD(A}MVz?{By7FMW zJ5{`B-i$o%Pr3Bpww@Z=FtqnJX?gK9w&&r}+xz=Y&h&XLvs<*$Ve_9Bi)j z%&(S*shHvTIY>2_S{aVl(b-~f8a3B_t6|F7_pK&yt;Oc*qUMAB_E7O$>+c@RsXDVR zy_9pUtNw69#OB7Q;&EL~4vhCU+(I2s<;(e8ui{zzB=h)QIaeN=;eHS3x9sKdnnLKf z@%hRa-w}cCNXx1E6{4qdaCOA`uA`;D(FM)kUpS_B&0*bL|^%Sx&7}R`+e?T-V!t zxR1rU#>e_^Qt@2l+iW>wd|Q-rjc+I1KVp63JMN0G{owdOSHW^B5ALUh%DM751@26- zt~~fY^a>Tvx-L(G>jd|xSl@N|0?e!8a{a12c)fiH^JyYp`nu%v!^4eJV)SQ%jKc2BhJUEVj{?wqYLw@t9-ey)rD&<)>pqSFn5W|^{e7> zUmFhdV#1~C$2!l0St8C=KW6zU%-RgceQg8G<_yREWtSM7M$I)JdsEJyk78Hi@44Y% z%hg5A2m7riCW3r%+^1_;PSu(Bt(wZYuD8Z;EyTLU$9eCr;#tox?Dux%T>TD&8y3*- zR29$F?=$^UVfT<`hS7$YETnF`G&KKue_x%1# z#o#n*);i^Uw1B%&tZ#h1U8sTBrs~W*s>0L~7ss>nxB%u7alSmR5R=G5UFYnlt#a17;^^Bc=UUI# z!*v(ynm4Y4AuwaLGd|aw5A(5hs(xJen_%{8XT&Sl4!`$`gDp2cqb?1_M367W=fJ!l zHG=CP*0&CN!1NQB>sRH$bub#{c{(ev8&@6$Gzg!xS!J(6J~+9T)xJ7SqJlTB3^pE@Hyu%m{RTIIf?sCJN|crjuV5^s732V z%`d;dvU1k^GT*9j%@Y0E>#8G6H*vmv2g5v-h?mZT`~5_i*TuQ654u@ma2hq&^)WBy z>^v63eI_=ShpHdzyj{g})$dQZqitsyuk# zI^tTaQygrr{e}BbEtvWlj@L&kF^tFN+K1XJ=UN9Hlyj|v&Tu`%y7Fa~!vfrJTJFErVMtHdhyQy>XrHQSq$x7d;PM7d9UU!Ic-A z>sMWGTrYKCnrdh48(m=T(oV(WJ~SL=oOVXM1u)CBQ+46`*dhj}adYfLTj9!FAJ@jW zt}4OQ6z8f7*Hv?vD--e3>x%o(Eik<@9Ork4m^cadJ~UD}YaKAlXO(kZmt*0kh;`-5 zcpnGGTM4%=BVKfW3yfFh2K-zX2b*tv^~6LFFRpwW!8Ol_cM8708_cufeCuTj%2zDvYQua{%scEKESW1Me^D37!|5&wT3F*uEywGT0mtKc3I>&s&l%**0jb!HwP zz${C|OOLN2+mYL{h>8J=5dA?oJP&M|8n1Gqnx$w`Ml8?Zm?KizGGk}i*x16 z>vt*4>V!+@%lGHIU=HoOqd4ZT=yCNceO5txl&x5N4j6`8@GtTY1FJbvwnBO zJ(P%7!~E}>kAitwoU1PE_XC*aiFoPpalL#GvqhXMU)E)}7@S7US_l08zm>Dz|5kzf z58TN&#q;4?2WP=tAkLL9*Y6E5UBtQa;Pu)=3{InF<-z*(RL)w@+$a0PjS%b0V-n0v zajrZ#A1h(LPQ**k8=rHw!|V~~%9pNKm$=3_jheOocwH92og&tkM+2Bk#JTd|b$K&P z&xA|o!RvAa%rtSX{gfH3g;_7ol`pT$Eiik<`L4@@ZqBX?ugh|9mBsq%QV-@rajv>> zUEK)NJrOTm7p{W=Fpr6I<;x777K78MS?ihK|AKO^>v9a-60yE~zk=B)&Xq5(%l*3+ zF5?^*c(r=(<$To$Tj?luQ3!6+gc}5w4zCU%t&@+KF@J%X#Ys z^FShAdVYC*JPk80!!h35VsIKYt1hhWd&*h+72Su*xt_y5f%{r)E?=Y0f2w%ax?;ck zlymi4{1!Z4;b6=4tKO$@-#rzkp?1dmlnyXmwKL*90yA1WBi8YKXH?H#$V%TrgjQ3?6)kx)B^EL)7boamp)?RqTtn0mww8*>M{s!xbD}e%QTop+8KFl zfZ3*<5$~Yx__;0)w%och;?;*~s-23*_16Wamv%%xAE!yPWxcOR?_bGkTJU3lMW0drL%Uiv=BpS#=&bEi1h^8x$mD+Z@gvz}w4 z=W)0ZVtsi`f|)7Km&Zz&uM_d?JhsF9F3y)n-W|#Lu=3z@adEf`Vtsj>4pU#8FOT*x zof7fVdGPbedtn|5aHGV;vtfUJz)W9Gxf^ZNzNFXDW4$?JiCzlwv+ z6_4xm|6ooR7spH2h3oV}m}cU9^V>!Y`(?A{w-EpTRdDx;_2uz6%qVfbJZ8ZxNW@F$ z!Rve#%#Vq9X~(J+zcYKCQj|_Pdwvgxt02~u2jiU+7_Tv0i-36D1LO6C8xRn0Y+$@e za5FRFaXwZC#@hh5Eh8S^&m43Yem?>STdvN={i6{~bM1`#Q8$=A+8OblgLy?eBi`fj^%?TmQaVD@Qe z#4CSKT$8MPtHRY5o4bxwJl-!`1;*-PxEXzh%A=fEt{PK}TC`w?chc1FCz zdtraZ!RE@B>*X9V5yXq@`fUx@F(V%9*Do;MV7QS1@n#0bTL8B#BOdFw1!kW(-+lU! zd-2~@#lhyPAD=hs!kj10_q=fh%+=z2&l{b@L>=SB^}Nvq?h&!RJVwJz66eZ;pIH#jiuJ97 z{N8v!h=a|QFF)U{3G**;t~{d8^~FR1@nYq{=j`*9vp&Zxgu58-X0g6J`ocUa&Xot( z)kK(?374KXuIH67>&5xj^KO{G#kuOje)Id_?-b!+bH(F&t|BIacyX=gns5yh@$B{7 z8m6N-S6#TC`@uYth?lMlM?V^7f;d;cbW_FPG-}p5;P=0+oNGPLg8N*oZyo#$vrC*S zU#{oF`r>&K2b(JouIGwkB8V3&53c7*%DL8aHMpi?eR*_%=_<~Z2iMgjFi$63dfvF6 z--LNzoNN8D8mnQx73Zo8`~4YacSby}=TiOR8sju-uJwEv+zDcRb@>;}dE#7k;d;In z=H^7abX_>IzAz7obLC4nR7{ivUaWP%?|())*Lr>yZl+jYzDr?NiF4)4^}G}24{@$M zxSsdB-24PjC4m>$dhVs1Ydzl!_q14FzOTZ(CC-&E*YoEvYsI5nj*#ktlg^V=l`r%|)^4c2cDT$HU6G@^}VryzbY?STw=6kM+XXVSEFEoI=QmpU!;1-yB#O3-`>z?9F+UHLNJ-oSXp9>u zaa`x8DCf%K47dimUo~$W)ir_fI>Fr$5N~K;yl3FXXT;+=eLpbXmvBF2#N&OY#Nc=? za2hpN{SJjYR;+K{&QkHLd1JrzlymiaAzUlnubMaBr*DTDsGae?Y#hu~?NmJOL(5>k z(awms4<`RH|9a+rQb`O><7TX9_FGvwS6%ABHPZbWd2|encRO4k9nZKfpHuOy`DGr@ zE9c7NHMm*2UzG>f%j&>*-^2Zy5s&NTz#+JQ;9$$GXJdZPg}GQeH9qEh6U;r@8S$Qm zc}Y7}XRep`#Bh93bF7#5m2=hkGq`VczeXN^1;#t@@q)agaIod-r}E%F{x2~R(@hH{_Cuq^|@&Deo#5r{PuzyDAqN<{CWI1nEBcn z`_(rvo3vB)<8w*=F#H}54z^ssM!a)inrNruas73M>8YI&Zv@O(?NmIDZ$8W#?TmQ4 zVTwJe@=)=3|EK_Sx^_mq7BKC#Q}H+-_rZ+R&WJY?W`TAp9@on{F*uEyYrSlN+mjKG z<2zzFe!hT%%{RZzVcKb@#>e^S1v5-LBj2eobF@?OxL(%6Y|_q%m;V%gzXS(cE)Nxt zaR= zVP4eEh&K=BBkhdq=w~s^BWlKV#C|s`=h|QXge&>1zb=J{cM{C`;(Y7*N|+lm;_t`fC&zuMOPw z0rC37jL^$EfC{S8yL7Wm9y3h_q9cEYsLEV*b1{(oGTCR_vK!|=YKfZ;&|!(p3g65z|<4x%9nL% zEQayetb941inPTj?_Dtc#rg6b12ZuZ&(8N!jv52-zPc0C&8R5&NsgeVJ;Hq%eSSNI9q#u*-vZbtbF-A)J8ei ze$W}NhgjGA@;P=G%p~oM`^*xUmD;K6obh(RlzLIs*@#ye=5*~;Jm%X1rlWR7ynZl) zwNvppzDY0(v@_zZgV~~;ipTMl8jJUhIM{M^HsaNRX{4Qs$MJQ9>7|_!ZzRk(?Nq!% z#9IKfUOOY+KQN_VQhBKRCGY1|#o#n<#@|QhK6ENvL$SW=vNcRcak=`bJa}F9gLya+ z&)$cghZ!f%cU?{qBUzaHF30_ba@KXp`{i`F)na}5Zie|?oGV}67s`&qy28Qc%7gQ9 zqL>Kc#kHSSR?fO#GLNco&BXfh=m^tIoG*{TFhj-p@)#v1D~}hHv+`ioUR2JtPfmn; zQ*15|weC6Y&s02X9dJKb3AaJ4uYP-AijP;}Mzk5MpV#JTd|dY&XEN&+ud9(=zrMLBC7Fpn8@%i|fC(c*l0ydowm zkIBlp@|Xsz^yb-(JmWV{i9@kYZ<%81APZ%JUhHEGd#a_YZ#W>h< z^)sGd>cL#7oywQbB{#zK($0uC5@wusDjvtT0OlL*jClKC@+Yc1R6N$N5=?FFjCieJ zI%ucX6|b*8VsIKa<9Ut!_EXNauAYEkFI%sFa>jU$Mb}Al6^@^Cd$lUMk&ts>;&B=(z`B)nmZxh_^jCg!sarmqF{S6#! zzU!z7Ol$2_z8qfcBMD&d9eLOfT(JJdST9%q!X%@fN{+s-23*(Qgxj)2O-Xw+F8HYyN!sxno5! z63#gvr^3|@h}R}C-t}g^JEMN{VLsMQ)sOSB31+W$M!a%U@b6r4u;tc^ zvF|n%6G6T>KHqJmoNL~i!?n}>sytYiUNA$nGxC@W^R{*>9_z9S=11*}c*S4G-@(Pf z=Bvx8Vj{>Fqb`hcnsTnX)PZZH`&D^FpR2(1($2_ZB+NMNR6N#Y0nDe`8S%Ek?9)!I z7e2R^pBmQ=r*Sjt!t3&A_+8LpPt+#7T%>l(mZt(}p_y)X}HXVhgp%$wR7@jiq3 zRy!4s>-jI3veVS{X2h!nbFOwqysKgE6z6+i_Aty-8S(ge-E^2aiFoPH>-c+-D`39P zaQwZ(pi#{+YVIA2}vhj}a`9`kz@W=0}jx-R_p`%7R} zWjNMllNg*v&8iF6{Vuoz-;8S*zu$M%1?B{CuDUQ@1DGoV;#~)GYe2lmV8#c;dmZMT zfOucPY!8U{Crrtiaa~;bRzbce!CWHFw+^m_xg{eW*TJJO!xQn+>wrHGeFf%qajws4 z=w^w*Y1FKBz&z%|Z4~RvV;@ZZTmHH*k4iAr#l`XLJkEn@BF>jbD=~2v_I|+icNN?n ziFo#U?hW&>IN$uf46|IEuP)!i{F)Jubvf{D{CDxCUm6IN!SZ2d4CFRTq^n@B39@{*`d) z>y1$^hq+pu>w2T>1aoVKM=p!D-Z7`M#%|l`rEhP|kH-E`?hq)|D^ow-cuH zoOs@H&e%7q!qnDItrxDpRxq8lGvW<|8K#|z$9-)o%zW*Pc;CQm($0vN|1N$X69=0w z-`X$@wNvYq>#c*BC?H>q_sOhFN4UGh`qt?qFeAj}#;5Y&el-K;y@X4zQ)c-s%unK6 z*CpL{m_ITc*ZqET3-S)e!RFhqP7o78ytwwON^o@(@$CJo8BAMouDWo)>Iu_75zns6 z2$<30Ty=?_6U8L*Q0su-|GIM4I^g@ksc7ASLI+%6ql=u8Xx!ZhA@{VoV{P&0&}N0*E-;+`ocVv;dmVlg?V0_YyENDZ-~KZ z)Li@c47eqUcy?XBg4rm}RTu8#`!B%f_c+*G)Q`*hv_5El`r>$=U~Ps;-%LC*UK!JMH!BDSt|yoQFG1Pdbr(*c=o)N zdLQq*aj^OFI34C}ajtped|U?8Mx1NjxLR}4<0=9;$;;J!%2 zv*+y>m_Nk%@;Gu4{_X+}HrKl1e4Gw*mN?hEao;#!4CAp`d2l^9NjW=@)^Hugy7FMW zeu41@!;Q>{$LnJz%u;c__3{nOri^%82l&o%xFLyn_PmXSnIg_LZ`?ONhFO(}XV+yD%nos`x^SKD z6B8wY7uUYA-;#JP{_CuLgP+qBhdV~BZylTlQ%{^LU+x=iVXjNWOXtgZyBp?#495(f z7K78Mx$=EMIV)er8>5`-eZVVlGsL>`W&J*d*`%HEIa2ch1X z>szOtVS0$m^{evWel-l{g@jA5Q;z;!m=DCcu1mV*Fsm~h*Zp@ezlihgS9u@BwZpeW z&9z?@hbt%6SC?uqb;P;q!u_f>Oov1~yDmLo?i1-_ymV&W{^`_*I0S?hq;+Yq=3 zVtx6}hFK)el`r?J4KTkX;-&NDyybn2pU2~1bIlvSS|}!hcyaAlRg|;xWxT4&x%R7? zaOa41<;(iDgXy82as3X18LgeVj<{dVfmxxQ5pOHZUhPyo?pNjhU65B92U{)=BVJ>e z7TOu{y2JF-&WJY}W|DTsezinQG(f&M_N%3E--z|C(;YB>i_7J!^5A}T%rgA_H5_cQ zORrOY^#Yhn#ksCax+`I>&2U`zH^ba5&b972o=3&tG-|H>Y6#reM7$d2-=Uugvp}4y zF5Iuy!E8#zv+MFV%>K*c`nl@D{pt`gaTf0D_ekZeb-?Sb9NcMQee0kROmlIre7RqB zgSk5qFP$&v?NOMgGaRe&su-L`&9z@mSI)|p@n$IJ+OOuoEfMR=m-YJ*=5Otc>-U%y z*f(&nx#DrZY7Em>J0o6Cm;u_U>yrD`SeR+r8Sz%Ye5IWcZ!b)#PgEX8yvi`AYiI0N zEyS=cQFH89t>8L~^{vzUU!r9cl5gNxUw9Vga82nK~xquK-4P+mBj`0VBX(TRnwWSsa`yPeb2e~ z+8;X9^nClNda9nUIO!`%qhyNj|D?|uuD;1k(QrIoK?Dg3GSfm zucSv3Ycc)RFv(Nvp@Ug0 zI6FOF1M`+iUUYiUeu%ALz7rgc_o~82=hr1|<8cBfyHs2fzPSk80KwYX)mSi71!t#6 z2+Z9kdC_{%??OET<_(j)XpYvSec@+Acf`OA=R^|O3aNjz}BYjWU ziSbF?bQ$rY2w!h7ewmZPNBUk3W`@iu{RlVD0pH4$N}F8TKc|3+b^9%r29>=yIIu z-^0XwVy`dtKTZ)0oa|ERk%Vu~26w4Rp1OP<2xgSv?DV)EOqEGqv>w^;_g*lc2#(5i zRrpBX!Jl$n;bfPJBcdpZQ|mDiT!mn*^dNbEcPa0Fa8J6Bx5lNsP2hGq$m@vk{S2o4 zXOVWG*0&p&Y{6OSOZHa;<{Fc{=yap@>5X8j1ZUM>rSpt#7Yv;2Ql%TE`(06-T8~G- zJug@*JxJaLm-4oQ+v`GJ%r4pf)Zsf3Tx-GFg|C}SdD-9wILM=rO?D}-0^B?Yc~ssn z0rR5Z?8>!TFq<9ZkzIWY<|mW9XuBeNIevG%CjmEIR(3`4dWK*ah(FA(r2Zwnf0o2q zjSHMDaaQ&3dEmMT)+&7|^!YC34F@;QK_1mJH-WiN<`nhsaxkl9PO4`peLn|tNahss z687L6D%^Bg=}Y;or(hU}KUVRV3vQqbd8IDpT@P-d3wcktl=m{Yw;beAdVB)r2f^9p zkND5gF2PNgRs2!@=mI7~a8~UXss{&vDRAJZ-Y*ploa|DSyVOpc4emCRJaxJDUtnGk zoShyU!F*_v7oE?k{@4fRfZ(k1IrYbX5e!oTf2{Oq0C)0U9?y2^aXy%I!P)6?1(>T$ z^3-}v0aGD3J3ZzI#!e5)m-E5hDOfu_o&xi#;H>l@d)W$Rmx+tkgWf+T7`yPX*!?2j z6OWrND}CwPR$$I>;K&Y=1w-=aQl&4+OO4{xcA5_EGQk@0qNo=}O7c|o0;R_&iL)x# zrhuC*`zw{ZR8HRGQr=_Wmb#Glu1k3zf&0pZytprU+9IgzveGvJTpPg}@vP9dr%QRc z;08L#qjI+t%tFC&`%~M&9bg`EA@2<^AIO}d9y|o*H<^?4C3|V}6@EV%H(f@&DCAuZ zW~j_5?6h1kOd$PHjE~beW(Byv3D&OMcpS`2f-}M==|T0;W-vQU@}kQP%D?-;92T5a zc|hg(F~PveE>(Mt`r}Rh+iZU-eJLL`l{hOqZ3XUZ!5aE1;<=Y3kNK9GjRy(W3;^mrc3tAevi5Ax?N!NAEbtMsUmIIHwnBXL&g z@gBHO1#9T5i05A=c~0EHUs$l^&FCS4o^zdW@Dh ztMn)VH&d{7>2bFt&ni6@t2inCsJyxd+;f7pOOI+W8wF>CPm)LJ@eP>6CVA@gX!Z^E z&)}xZEN{`(VXO$lN z!5tB-p|2u6PODe6BNW`}Do%<&N{>Wv9R+Kb9+_YQf-}M=$)ohR227bro;p1ifVoX@ zR_Q_h+#?t`*`-PkO1JwZ&MG~YNSsxAJPU4_U=4j0@%*7A&nkaxQ*l!KQF?3#S1(w* z^k@Kc!hRR^2beB`5MoFAidRzl;x?t_n<4#GQ zReIc|;-vJT*u7igtityYxMu`wgij%FolALJz;k?*#zcGnN!4H z?Dsfd05@G$;Ujyw5KNZLDdZJ`nIv!F!#!wLf$ekwKAuWw+GBYnN!H~9>D%V z+;kcGN_If@(nBx|q(2t+lA+?H@R4u5B+klSa=_&a)(D?M-V~Serh~i5K_1!5!(f)n zoFe|Vf%#nKr0|iwcn)IT05@HR9twF~z+5VGl034P0x%^qr;v9Gn7d_8A@5Z%t7T3h z?{hHU$(+JoS{&lKGKJ}ng}t1l;-v7AB(KC-*~{tR+6&f*XN9~hm-77JhB(M0dnp5> z%bX(qo(A)p%t_%RdwCzsf6JUg-f@THJuPw5Wu-6K%SB)=lR1UFkzgjuoD@Eiw*bsy znN!Gn4NQ&9DePsJU`P*kS=h@S6(@y{V&ij(v$B_O!2KjxtN0^%r~JU{otdu#0yd7Y^kU2>nrEilT(Z0e>m!XG3 zUK*HQGN+Jt6_{&eP9bk0m^)=oVJ|NWh6RxRSlG*}DozR?Y5AJOS*7or;MNP)h!=&t z|8^8SV3x_8B#-RnLoi>; zoI+mg&uCxarpwSnA@4#ky=6`zZv>dDWlmu)Rf1t2(;o|aS)k&i@KNX&N}QFwECTm{ zV6F5ec`IGYTLtc22YF;K`@zH=k>Xhqf9=3@k~v9VvX=mu(K4rycO#fvWKNPt_VN^% z%izTr;ztFnAc=ZA@6-Kdu2``FXmV5%fd~Uksb)R9+FI*-5Zo~bc~lOa`5X2_;HJy414a1q zz+5SFitx<|c~+&O|Z;zbG{ z$-B&@ynf(@Imn~@QQ=Zv6}Z1S$fI>KFM`=1bBgrX2j)kalk_EfIoZ?Pb3SgmjCfJV z^MScS<|KKf?^G~zWKJRPK`>9toI+k5nC&vBkoO~)m>5Y9NgkDdZNYStIfc9-V2Wf; zl1KJ3M=)@*%gUa0aEo2Yd(EZ18gQFj$g6iL?`LqaP3+^3^gTx~LS4)Jdm*?U4)Q4H z4s$855ZojOc@(~&OL=#Jd&Gsjw_VEH0B*Yrc|W?87Zcmub0TiKjC?8CAH`p)U>Jx$ zR`!<;?lK2?lz&IMls6gNEC+d%9*bSddlcM@F63=;DQ_pZFI~usjpK3b6n|cDXA0IT zJxJdkF6H^aUExCBRG0Fu1Gm6I9@)#|F6BKBZiRz9(s#Q{d3(WqFUynq6*T{L;&JBm zQ1vTFkCPGaEgSkoOqce1Ol{tmHtzbTrIY}Pn z%YTAt(NroA6!I>4cjuzK%jY?%fAWf5BPV6-g-pQ(=;)UY8LBvq*4O z>oRCP(tU!V@X^KA$tdDwNff8n<5_Ua1Z$-S#q)r;t|xrb^}% z@*V~AqRdI@M)_-#U|0a@k43s|mN=_)+YWB8?60H;*+I++JWj&?TFGk;?o`1V@h9m) z_LnZnv(lrh#98^<3!EnVE9pV@Hy+H5GN(w72f#cfbCNu=zqMdKk~xLEBVgiMNOmR3 zBl~Lyri;ueLwd}8? z2iafK6W!V0N#M>9teyRJm*iR5Uk{11(jyC8p6sur2ie~wFqJZ=NRLOrJTG&SJhHzH zV0OuzLf$bj%};W+zw^O#lR1UFAz+GRP6{8{^Bgd@%bY^q^I%rUoWlOL3kIV3Wnq6i zCC)0{_JI3V_E*w_?C%7xJNr8sTwB4~*~9O0FJw+3uSr64&q=uHGU7#&NA}VYOfQ*J$h!*6c$rhkn-AtrnN!Gn z8O&QUr?9_I1j7`eKNj})nZ#M8+gIQY$^J@uPsoa<6ve{fgH z@}zj7`h2D&&njMKNt{)@%mWv4;qSAOJS%^nlQ=7XUj9H8xvx2qL<83e-1ZStmJ}`$&^3-}XJsIP+xaqRf<8;9=5Pz5+W6H|HpXqHbx(bu6K|}+eS+2bIOxF5l^J~h%_)biSc=_@!ZJxJdXU}m`BbTCf} z&af9r--{q`4VWJUXQ%IPVA`F=^)SLG$s>I)0dtk$?BtCDvrv|&u=@wVyec?D4~e5t zZ50fh?6R_#kHP&cSVIpfeaT)P7ObI%O5a52i<>Tklk`0w-=%}ON^o}ijsvq$mM7^;?Yaj9 zL;libRc<^7Zna>o;)UYxb1=WS;1XLm_oU&b%aAAOn}YB9gPATkJALPZc}#Fd{7L#! z_?Cm&A~?feiKFM=2?kDfvG#$)k-UT8nx7%*A*C;s8|Q<`7Mu}2iKF~G49sk|bO7TMoDqK#N9Es@U?$6)B(kk__r{V`ys z3C_w6sC|F4U`QTaDu1b5yWa&z@?KJLQaMEVXf3$U1#5&);yQx+2~4|Wt}mq{3!juf zQt^B+m^p&8%Wpw2&kN4*R}p_TVBT}VeF^4A2af8a=I3%9;AEF7AI-%#Ey4XwuvT_J zT<7zedtSm#mla3PuQ(t14L4m@`cn8R1j9i5QH77ngBx6M!@WQXGdehP*MND(flGqCU%;Gk0hec2Zu9{& z#szl^m}gvYTfrQ1!JU!X+|v^`U3TFc1Lh_d+%sU_alst|)2gGrzZW1(Jq5!8h(D@y zqw;T@ij&F>DqpS#caLBVyH{|}fmtUwqdZlVFJFOac_G)su6#KY%w>Wz{FTa=9E5L> zVBlm|Ww-%Lx6lPg<4DiB;K)vQsyK!H9RzpcMLcc{dyzP5x1R&%Vwscd zipG8Xf`OA=s(9{!Z)UpS&IR|93y$Jtn+uNOB{t334${D#>4LiyTt64wW#ED?IMR2W z3y$)~w=Ou!zloil_3a8S)dffWib5A0<&T?Pa7o}^cEOSTZFRws{eBh2MYqSPJ^6JM z7hSHM1nxH%9MvB!x;V#k2XL3T;JSk=biuU)x7Y=DCb$(Yxer`$jZ9;3y$ieTU~I}K7GgqN9EcJF1QqMpSs{K0e4(i=XfD|$#B6@_{O>5C|~~F z1xNY(Z5JHL`^p7JVG z3y%D)jN+pGB|G>&ii<9m!9CRaKTZ#Q+L5p{5|f1W9>B;To=eY=z^npoc2AO^(A>}E;wpmjd97{ z?t&xxd&31so&k@@1L}j`|DZU2tT73tVti&nyF1Cs?DMEw!JC`xs2U z14rWu4T6D_U8?btx%j482KM*hri+*Tqej6-Uqe_QpD7+;my#LE)Pu z7zW~xDtuJlmql^WxJ_qpJx9rm0Hj@ldBTySaN_PgMyTx)Zwv;C30?k+fzH$lbG zxB$KjUz8s6!QClXV_ZPNJp|?j7u<3%>ts$E52N&zuepl#CDb0;3R%AhdB@?i%KnJ! zcv*ALVBB=saW{i`!3DP)Onj!Zyq;jjxZv&t^M(uVJ20nZIs2=DDRto5BQE|+Ff3y5 z$148Tfcw@#9>sIpK3ETen=Y$(rvAq)FfR$N89uB0CGKZ17iDvKc3cIR=Us4z!KCIm z%exlL(+(WvkM9KoC%aU7Q2(ew#r=zRKN|AR@HO|$#!VNs%T)eS{2c;wL9V^N!@-pb z22OUV#_LGlI^y~|%gYsv5Qp$Zw>wGRL*TYK$Rn1M$bo-$URo z@H@*Z6^xU-b;MonEH76uPVycCx6OsTHvPDtPV&mZJttVZ_&elM-sJ&|qvNK_PTo4f zIE61M5Bpqk+sR}00%n^Fu1$Z~3vQDz`s{}*((xoa7X#D?^C@y;Zinv`axzAm4U%KSJR&j3AO^O!{ zdelQ+dOlAN`m2f;s<%R5UK5;Ey+!fz--3aYU8;5`ao@P$sD1mbigT;4!v4O8yo;`I zw!a==X1U-h!PL6oHi0>DptHZHgBj+6D+2R~3+`Dk^)9#{!CXAZIeeFand5>Bf?4l^ zdmqfngC&0@JEd~%EHFa^XOyQ>`WAq@AI#4#3+@=0i-$VP zyAI4NF1Vv$IuCP}Hv`OzF1R1TTsYiWUKyBYU2q4%bhy%4-c&G8y5PPAbM95n@+N_K z)CIQ>%sC^RTyP7()Vbi^1JiPpv%hD88R3E}2J^TJ?nN-)yWoz3=~3t$zHBg+F1Qew zO)j|YU``+H?C&{Xid=A$z&z`MdkxHwF1Q9TmlZjO&krUjbCR7V!v6j)7&zIbYDZ8x z{w%n?g0(AmJB&fR;HJxtdlJkp7u>mHn|ns$c9Qofn2%j>=ZtIaxe~XNyd_|^yWq|$ zM*W7{Bu|mg?+5d-;Oz4Gmtf8v&*j;17lE1Tf|~_qg$u40OzhRp{+v{-%Q&COEtBO#*Yf14r@qD41n} zvkD(^HDEq;kVoO$2j;|Uob^ZrGr)l(ePCpf$C>0p)!&MsbF0kho&R}aQJ$zBg; ze_*l%XBWPHUZ7ED43*F%I)>~CzeXVT*g zFrCbtSm$Qux`PP_&Q6cfVCK8v?g8_L%t?BXU2OsLgW&A+_zg^}$tHcH^q}&f4VV-M zj{NNcW~kuo^t}emZGy8(4_XKH9GGteXQ#&xVB)9P>p|s4D=?h|XZWiqPXk~|1!t$n zd@xVR@}%_0fxm0P96vQOd>BWP{3W|O1x$*GQ@#N(5)8$6PRv3C@TY zNsm5|w+c*Lsk0s@foW&rqV=Hgbp(?yxHx=P)my~P1oMF4?DSX)<^vbp*I-&)%k{96 zmjouq1vebb^@6jCzah}$J}}=4j@z@^4vvC3aav?NN5>!8%jsZJ1!t$nWnjj-;AVii zUvO4>TnT?yfN51089uchZNQ|NxM)2(LS9cW;{|6PhifcP$qw!T^M>H;^xXpH2f03C>QBZ@`>1-CmCz$mBPR{FQ@QC^)w3SV3rEbPLI`KzIKpDcGdI-?6<;A zmsR+PO9sG2j^eK#jQ2)o`)d!T zui)&`w;0SU!CA#0rEeveB@Xf^d~br;BRIQw{t-;;InMUi4NO15S%r`M9Rg;S;NtMv zs@{48%o@Sjg>NUAV}di{PqG7Aw|VAVj9=lV%gzplfth6HqU?a|v;s^}aCYH)5KN5= z?n5v~1!tv4SNMDSJj63@y6p5A0%oF_Q|eI$W`W@B^td0)+cGD`Gu3bJgJ}?)UHF>c zg!viV5qd<0kJ@YJgGqPb$gX;WDH5EW9u;8j6`WN(_lCS>V15vsogTk|X;o>j2iZ#- zFlmCb3ttYH2`;$n!8|N;QhLz(-B-bUBRD%fegG3c-(C+&k5*vLcHk&IQosZRXT-DA zE+Ot3Ft<5y6o1cwsTQ2jBg$T={Cfw?R}S*X-?%EYhj7znmma;qj24`shZN6LzT60A zso?D5c_o;4&0Lfor0)(e`vqqgKF`fqpM#q&JFYvJ0>N47LF;X2gLy`9c6z)DW}TUf z(u3?}E11t5I7*MN!L(T5tVa@<9Kl)XLF?ehfLSOwJ3a0I^MsjG>ai5e8x9=lu@=lX zg0oAH-@vq6$n~|-<9x`=1ar0E?DV)6OqH37(u4BH?O>i2oZ+t`U#EnRhzVle z3O8K_C*=?72lN0lR&aKDOa?R0%th%zcBO+^?7&faJOXBo;EeDo^xX;OnBa_fk@Pqh z^3J>k{bby9+39gPm{DdfN)HO(1TeP>E)Jiq+C#5`*&#SPJ@$i1(CzJt{Ots0py2HE zC;(Gx=A!iI2zj%?JRvx{e(er0{}h~^9tpSNoG09L*`>!oFf#;ar^h@ncbPe*9!tP% z5S*PJ$H1HulI&h#R~Li1QgDVI5=Z6z3^2OjgdWQ9-36vbaCYH44CeIPoWqw2W`N*~ z@JV(*65*Q+<{iQD@Ttc^J^=HziHja*Ap1K6=Cs>+`0VWdQZQo#XJ;?d!Q3Y}D?Qr5 z-{oLF5}cjAd;#W&nTtvfDu<%7A)Bu^dBOTfHh z;-cf3!uKYa^$r|`?|m>o3(hKh{lJ~@H;k9yrpwL_MuRCgaq95h2<8?Cj>2~*nB{`A z3Llk28^Ihg%d1w+M>V+v_J^A;t8}CIO9Io;furzU0_G~g8R3)iIdN0K+#xtCJ0(4q zg84*nc6Ry|m|x7C(oW<4j(Pz%T~_*1_|5=xso?DN7zk#%;H>nZcJZBH)(Xx}k1b%n zFmq9QP&xS>m?n2}J?z4F8kn9gxc*?K3C>CnN{>Zg-VmIf9&5pTWagB5d;#W&;Oz8h zaTofHxal%Dsoa=^?{dJrC^#NIb-A$u%qA13&X?Q4>~-MCUcLp>@^1U^^#XS;m?FX1 z#or__bIe>+{87FPg1O6qqwp;OQ!6;D_`3q!b}%W6BlCwk{%~y>yZs+n2A&CQ3PhP14nwy0CT_K?DTjM%=?0~ z(u3;3gJ3SX*IAEDFoR8;T8~j+u5sWrnuv)WoUvm<{G;2afbu1m;!2+3B$k%znYy>2dr+Xy4G3d_)q=CrV+WXj3eHN8L6CRG5|op;>9W&f1{mGMsr9%E%p(pQ>G3R>&4RPj zV=tIy5A*O@>2Ve0oeO4;;Oz7Wf_c!ysr7gg%qtEY>G39*J%TgzklHz9_dkNkd&D`O zhk==7;?&`*05i{lqwwiqUKE^F_^5oT1#{|uIft(;m~<1T4qtCDeg}@iHwerO!C8fG zFzEqimr0(wowE}ea8`OyK7RqsA;H<{@lP-b&p7LG2AEEQv(uvwnDH*S*O6F>T0 zacVuj0rQ*S?DS~$62^0I(`Cn94rYqr?DV)5%&9Lsr$<{b=_XFCM{h7!2+l5i#bAOi zxCg=12+m56O2ox3Fk@bE)}sW>Tob3(;}$Rv3C>QBm%(gv!F>bfq*v|j>IUf15zNzq zv$LyLz|@&IwI1(*`BHFpdK?9F)@#mo)fvnX!C9pTos(Jy<|)C6_C~d8{^(^eYt5Xp zyxIch3&GjxaRf}8*PZo912b4~R(cdck7;1u7o1&sd1*QD>2U>^V!_$zF$>ItF1VM#d?+|OJr08zywX{ZQDCN-IJF+vgIOdvJ3Sr) zv(5$g2{HfR;j`1@Y%p^KXJ=PIFb|qIwH{A``G?@_^w~$c)Ou_M^OfN2^!NqL*>Cdj*>PRK3>BQ69_3&@6r7zNyTBYaacVt|fob`c zbNJ2$<9ET01T#-?c6ux!=56k;ogT-7Iorgk^+*BJOK^7aoDZhl1-B5)bAq$e;~g-m z)y{fc490Kb)Orj8bG6{?^tcYp5*OSnV73d+N{ymO>CqlcUl-g6FmnWF zl^%31-GgA(2#)Ka?w@Z4v)9Z;)#o&B`z@H3tGOO=_-wU)vIm%vg0s{2S}=DB&Pop& zFL?z_gW&Aaqxl-NPjS;F^o`Pk#u?5BlOZ^}@C^V{=7L)Q=2^j6>2WRmT@R+`+Q{&! z+a)<*hMPFGU5x=VU2t}K+ydqW7u+f^UkT1ikJ->8t`7SVanog&9t*)dVB*wzJOO5< z;Oz8x7tA3ST+?;fzlxhKD?M(;cN&;?1!t$n4lw&ooLY~cz#PAx`)jAi*7lO0WgY2rw28>VQrpqop zZU%FoiBs$G7?|aPv(sZEm;)}jxQ$r1gqtoaJ?7%OTrg_|XQ#&&FkhHBwI1JrX|l=L zu1*8f(*@Tb%rwDS=}`nd7J)e^I6FOl1>=1;GTqdAv<7pb;Ox>P3rw*KZWfpa1!tuP z+0{S5T)a6leCl%dGBATooLY~OV6GLMogP(So_4{#31*Mrtn{GtXaF;Mi?bfrfVt7c zsr6V0<^jRk>9G{d2QIj;!L)dfhtE!r3&7}tv$Lzaz&vf@)Ox%ErcQ8ndVCC~!3B5n zR*duGrpr!`Az)q?oSh!kU_LN$YCS#!b4YM@dNh3>^&4)w?6^z8j1ioj9&^F$5uBYK z^z`=3c-{K&Q6a7V4iisy$xos;Oz8>*$(@|O_yDI zlz^FQ;?#QF0_GvX+3E2zm~Ae&Z@`?igNM&fkB(qMg0s_OF_>pfoLZ09z^oUXogSZp ziP_1+XUClirib9{^cV(ax!~;dSOsRAiBs#b8_W-avkPDRN7&ban=U&p6U;cl+39f; zn7x9t)8kt(F&{_TpIVO-z_b;dUHH<$40FLv0&~0I?DTjZ%t@a_hELrtNd(i;#HsbT z1kB}vv(sY~n44U1cY|3eI6FOdfa&q6vmV)ChM73E9z|d(1ZSs55X|!~xEe5D3eHZC z*w0{pxaqR9t0`b^GI44>ZUytO;Oz8x70eD7+JywI+VdB(!d=BO(!P$lH_&pdW#7&nS z*9Xja!P)6CAIz76v(w{yFtMLU+MimF6TzG#IJ@v&4CYED$5dl~;_-K~V8Txu$MwQb z`0t`uL~+r-|3SZNG%JdW{{0@}f-bpxU2;#m6%6 z?-fxzw^ni40|zG$&!*!f*+u7%cK}x;Saz%F7y@t@UhIm^Uc9aHwx!@6J8a(%LD$_Yd|B%o;pkU}280&yc=_ z0pCzxptp(~STUu1;^gAM#4*!~rp@Y|H@I+6c~SYqu>*@sii^sMAv?#Hn>8dbIN@3-=w-=M5&Ghy$zv+U7fwXX6d{!OV#sC5VHTj$7Nj3qz#I}#n4oJiB`JPKvx!vTSu{?K4hyCj;4IEZ^A z?%O;uEy+}~dln2SgVF^Pr;MLkkXKPQacn`JZ(v_vLBD?a!}=El`VSwJ)2|SwH_+FA zZ~+Xafc8H?r72U2OA5x8mKKbum{>9{^67ejN*j+){w6O&fCzqBKlol6H z8#@&*k1d}#bxJ1)=rncAHJ+ZHUM*wB;3Q?w$)1j$`-2|i|GbG~r%f%JI=(z9WnhP- z0i`hSiL+rPN!e2;mrg7xp5~c6aSA;x?%g>pV{*|M3k2o_wI2?T3T90 z8B(NpYVXb&Wu?=mmLi1WV?|l<#3^Hnri>e3Jhpdd5561^nHQE6PcJUHaN@Y$UAq*g zbsnElS~PZ2arwmA$VyYETsV2^ICz%9p`x-`lP4FKPn&gNQAx?v8L<4$p8m{|lBSMN zDxZeLLomiA4IG@G#Kn{)O+^s#p{zWqtQe6oF5-nj#EmN+J8c$pnmQ$^c-pk7)12QZ zp7J~1sF*To%G4QC5TxvIn3Bq8l@=?!xsa|tKIEgMY~R4a$o|<`gMI9&$Fq=ro1R@{ zT9_sXmLw-=!SdupEqHx$Qr1wda(_~KwRc#xUq2Ag4{7>QZ_5}hm<1>+(VwxU!mHI~ zC3^Ad!kB&Y@t;5SC+*D!e$CM`e)KM&X-2K`H}8xy0{U7lcx^)Xjj!>AXKmc2p8Eb8 zeN&K}rd6)56w`su{37Wo63rytH2FHg?YDpx0EjjCnX#wiee9OTD&9)v5Y6}eUz&vwIgDSmQ3 z&XYNawAb`jn!Z!3tVv^UYkDmS8&OM{Z#Wbe+-Oawb2IP*>Z`S2PIA7cucFsNgDE)c z*sF`Q%9)AY>9Lyb(L(+3c#C+f4@NL6fALQ5q&48J0KHP9&HIIZ0e0G{TIH(qHQj$i zORdo=zmC@`kF=d}rV$p<`C9r${<(7X=n=JAT~2Zm1;v-X-j`mTzBPS4`<9Kq@4{gV zah_y+yO@PN11_#b1zg|YCyV1eRd6+&O0GxY`i?!*Lbs&h!#>=ec-(zh3~80K6PpF} zJ_)2$EA}Os!brqT9MXJ$cdcrDMYHs3#8~%QZQfC)&;?p3>wKi^^b5ifL+MymU7n;> zR-dm`?%u5hwIlo$yvL++1)xxbauJ%*$xQorI1N`GT<5Y-j)zNVK|vC}pCkExdX(=D zo{|A@PcJgO(i*+eYif~-%G>*TOsyXAPnqi)bCF*^!m{4MK*k#Hf_d=5UwOnkGX_;O{}?S}-HiD9+nFSu z0XJR_oX5y?xOj}*Wjxyj7mtxI;o`=r=}j~pk<${EV(Y5f>YaZbx>OXIi9?1C%Nm?D zBx`8aFl4jQdHS9_Dxddh%kN0`)4w<^V~ck|fcQxtL9Y!gl+eT<^m%Z{YoQjg{$O50 zAoyJJ!w5~Do}8SgUqWS<#tN_i(rb8L#t+{4-{5P1<=Q0eZ4m>p=^tysSCgNj=b@py zHT_*CeNiBEW0F7ERtt_w!JX#UN5%V7&(>;wZK_p$?47?5yq2-cyWk(>sM*^z94vpZ znLpS!UW-Ng^hJnJ^Z514{Q8u5zkW7LO#0KEzR1)vJ}vL+ZHs8QJ~>6x-`Dib+;c57 zC`k(qND`ka>oVC(T4gQ0Q?c0}oD<)ufmXS;I~ij>6zlE}Sj2tE!uLFZm%x?DN}3(Uvo?r%{_Fz7bu(NmS*d#~ zT+cHX%GHPQl2NW6$7&-y)gqtX#-Hl9JQev=l)<4}k|Lk>LzRxgS1PXu@~8SODUqy@ z0E>zzJ4({@k5JfXsXI0OJ<4_>ZnY3)5>`F0PAaTD3nH4b`jc$&uQw4L?qf)QFKqSF zJEvR6>i^MqBC3pGqNK~rgL&$QP*-Srhq<#`d%RVTQ}hP|$w|~SAnW$5n2A4MlMCfM zm1QYN{2#}O9jcJ_1u(TtQH!YhGtki0~g^_K0c+ePkL@?FdL=dMQB|njIZmP zh;?!(J-n~yCNAuo7@#_g{y-QijsUeYPxFg1Pz$0xga< zrj#m~nJ8W|sdy=@?SsJbwgerz!wZgChU-NlTEm45o`erZ!SPbK;4nS)g|q!= zuxP`^Grk2rG-iEw(Y%HPn4|eAJo=r{tmozjvr`b+!>I*qMEy*B$`60Kdl7jR>Ni0= z_%|oR9E64^NC>VMSvmiZ;rakBokjguhD%PGrOKqqaY`EfmeCMN9S=FtjBoOdZBJJO^a+z9FxG z;URJWYKqg0$|4xc9t?%m^Qsx5;I1`tKtAPw;gkbLQ`2h#%Lb!rGZ6xw2j;>RWRZ4< z;gTcu1!bi6;gM<|4Zmm+#YZK4kfK7vBO@wU@zFOan2q9N7%W#55sIkko4Amo289Ft zVI>WZn$yD#BuzxkFhmD$GP#TzYH0JQDTIq#`P%n$>7b7uIV3`#r4O&nu9P$013Qd6snfEOQX*IJCi#06ST4&krNH zE?&zxTHY1C_yFn^Y9gbL5NxLDeUQuh#s`8;0zo+SY&7RJl;iyn`>WGXpLoOuL zf=%=AP}2wDK0(X)r2+#%U)N(8Antg-z8?*5&71wTKjZ5eqv{t2^bL7be{L5UklxwM z9Ex(HLg$#WQg=!I~p+TI!*Qtf3$EXHE;h7slIyZtp^Am41HtWiqYg12aBn5y!t1A$-*3^^cQ1e(SNLLHm>Lqihsdi0Mk zKiRK0W!-QcSp{A30}Yui0y<^xX8w#F6<5K!S&%lt6ZCWg!Q%tL%aOweqC`NBy8M8q zYxF-vqX>YrvN{1TRBYRKKjmp;tAPF`Mo|Oa?A>`8yS)o8MttqdN8gsRRz_`kH*eca z4@&v@z@bMFSyYS93uTgge^6uc@qeUzyjHPI(+8kH+9|zn3SX=i?1T4FAO-v2{SyML zOsYkVu#?_zOEpS~rq6(!&&n?n6%C55s`cfkhHI28R-<5aAf|z;6MFfxik%dzx>wUt zd8WRnRepXTJV2U=WX5nI21!wxRqn$ZN88Tm7arXU1TX6sYSD|zg9(0p4V4h3TFsYn z{@CxS=tx5o9}!Op9vqN>0;4-h&ru`9NHH%rkb=ocDC-b{#=%tDoXm@n<6${`;4~Mm ze^z06dDc^KIlfu|SVMEunF3EWozFnfE9D;}Uy7%!0U2)bvCaui zFdSngG-e(|5GNZh3J%)LCE-EgthqB=dyMhmieVH|WKj(M2^(X<`OxTF>%UUTuAhm4 zKi+?YgBQXpX%HYBY!*y3i6DpC3CMm0G|pRMjPp_`V_9Q453XF+avN&6#=^xT*CD(m z?!$ZgA_!%vh#=1lJBEiHLW!pUnUr|JL5UcqL_S`7i77#6w{q7QxVU08#K2t?M~#Xh z&xU&gjp;z0rHbMmF@e5{F^k1~tiD>eS zLk|)CMm8uwXO2x>6^=xCHyJ}4n7Q-orRbMoE<8`4nW$A>m*T}_ z37@k?N$Rg`z@#+w*)qzKDq3n)Kb4=3X?B*~Fe{55+o$E20v{1yznVJv=zazZD7R0 z_-nDkN&nTd$}w_kEmV?xRGYWI8XiSX@B7e@J{kz-EeQmDw`;*6Pv&@+Ra}iUnX2g( zGbjR2_P!q5E44hX*M$}FS#MB4>tlWCUj%~1i?j5s#B(Vsdefis=2{3-?f4%3Vdn6M z0?AFZjCW_W?lZSn`?QKyeY~&dw2$dH{Ha|5Z_XYP5$^la*mm0TPI!BK(6@jk7+Ua{ zU0�poNAkFgX2)U+7fo%bSp4IT2ls)q72!(XA!XH)WM zPkN{g>1jxy&ORCfp}e=*8<_0Ndt0l#VSBTHw{PCtfl%Dpe%*&?df%^aYRDh1>3K`g z%C++pBaKd;lEHRx7K0E-k-V} z;~(Bin$p%%j|Oz#=0HZB_a+ZUcc30B!y12THP&OqOuNJ%%EYo5-)0_&qs>?tv{0Lw zfz-PGp*SBJU^J$U%=$iyzVSK1jQaNYOS71?V1pt#pl?Pjv-mdRSqtUH%rmFhJHVx~7 z=m_`Aq@HxB4~C#(5b`cr-eqg+Pec;Hffgc?C~de-8<)K_NmU*>SEc5a%xF12} z<%M@DjVXH$d*}GRU+de2Tr*@lWHp=KMGKuWgcUD33gkwC%5`HGF=4cDM$c<7mW^Sx z11lWnt*(X_kqaIomRp(Dk}YC#7Fm70u`T5ArDoK{n2za$IL|z|W--@ua2-T5AkOnP zT-#Ykg(lMYv!CF4jdf#EkZJww+evWU&z@ZkRr%tBMR4_E?Wo0QI`C%v61cuZM>Edz zh4Jh#Tzom(d00cl$6`9dr7_7q;~6GTCctafYmJBFTlPJkk_yJtK=`Sey(g08bFATI zgczu=!?#r6ok4assIjw%Vh$bCbemDIP`?Bg&AU<)Qu)cmY>_c-TW^eIJ7~l+FIVuztR{~Kz}jU`+8h+e}foN zSQW^4XWIT+bicKg;g`Ix`(w29Rhsdd=6!J$Mjq%t8l{M79Hofx3DfY{bMbms3|@B{ zvf!mnE$zvCH=Al(QU0(e>!O});7^cfsOiIdJtEfnV-l3Z#Fn z8G|YT?~D7gysu|sWaaCyyGevQR=6=5pta9S)37RA_n}Quunr~U5ERE7I=2gmR2O?JOTb15Nl;f#G1ZhdwUP^J5YhecJ7`LjdaqdeCeswoYil>!^i7jesQU zc9TDNcGlY5c+b8yFie^%SU#R#O|>4r1n>NJ>2Yvya#DH&ThFv21@Rb}Ia9Lq7RfkfNIz2m)T zgZJhq5juR}vyx?;P|=iqZlU!UToYe$9E#5xOhdAijPcV_53J#&*_#P8 znNy02oMz1UBJEnysAXxmu`QC9ubZlYs|g#2+yK{Stc!3S^nWdZ^2}#&HDg8UUbuc? zT@!gN)zNT4n}o-D3-TazhuumB)1R*UPW z7j#C0`ePct*+IiMJ7|sE&OH4qw#Kxd9_Xx*ZDYX?O@%L_G1{?NaeXSUPfNhaA;wu! zJYA~myI!v6q~%loXzxe5U{GuwQ{RMRh;4Gx>N?JHM{+@gg=@ zgHJGsi1DK1>s$JD4+d-A^Xuy{R)oQtb>n>*n=1y3a9~RTMGh_QN5;Pvk!0mnvEkJS z8W&P{HCSudurC)QWkSm3EH3pJ3~c-L4;%6|STOUp{O|g2!efD^Z@oM?xN}Ntz_--`i;Z znLn+KqcP>P5DriMY53Sgdo9Ao)o09>8ev%kZ2K_ALT55sjKb3F-H8gs3LYdY&RzXR9F?2Y%}N@w4G4A-x0 zubG_R3Y7WnDv{p?CnpTSLW(489Mbf=9!B_RX&j{joJB2a_$x;wiLB4}1H3 zs7=D_7yJ$HEZ?+owSGy_3kF2770z(=Uh;eHMcs=x3CG`uG(6$Er6&_ z^6Ogzp`2u2;~+hH2La5Vq;ms6c=GA=)9^sbB)En%?XQE24`>*@1eR_*@sM@8qQk?7 z3s6JGTi1>&yHmy&dxO|6Jq#Wk59w`~Kh&3>%2JN3>0Xv{8eEMtrs2IGm?YlGe6Omm z7&Y&@0CL2f^6c=WEFLDzo5LPfoKx2~fPG(c!oIS%mSS+3W{z2pj5)htSe?3OD=>EB zsmo@sFm&UJ{Rn^|A z+dv5=yz^=ImP(PLup)?WRBL=dhJ`DF?km(T_lF4<7d(P0&K8Q%5IjWi6&6gyzR8He zh&YK*T6kOEOuWouh{wk%2r7?{&T#Sg7zh`Sk701}_@Fh!oGUjtQj>G{8QiOI@p#*8 zxLCYVO&9KXA7p-u5@jY5GQ3b^2USStk!~lk9TAuz;MEdU+Gr)g+Kn{l;YYjP6VK}C zWVjBqQsy$a_=Y+P|55ggFQh{5M=r!};+$pMhX(!duktO0Chb0`+{fhC0w3YsMCAJ3bPz=PxvX_WOAk z>_;%_k2h^Mq{@0UQy~z%E@42ZS28tD1Ns5Bl69Rw)T^0Rd92y=p=?WCKu<*t#Bt>J z(mYh~CwQ0TB+vBg>&G8{wqGc&g+KL&exXw?@`qaFVq&cVWh6KGfW8LrhHZ(~vJJ2A z5uQ>CsH8DT5Ewe8ZL~Br&GcGYf;3vJnWd$)m8(-CS0C}Dxf>zi3ys#m#S`Qw!xe{k zzMN&Sli}ju<`}LCaPeJ_Q{dvO;>e7W!n51~ITii-K7V5>#^NnnmaOH4l96~HP(osT z?<~w@i&VsHrjd$)j3YD7_lM%VwyF3U!Y-vE8MUbYka`0`ahC*wV=;bn0CtNc#16=Y zX45YY=;qxdz+AO>FeQbC(JwMvUJ}N=ISwt#3%jaH;7MPPj65wnQ{bz zK+Oh?X3}A`1z5F>au7=r#oj})hWTD2IjW6BpfK@7IAlDdg|a;ADJ$@(XH8dp@*H8A zX=zODpYabh9a~5it{k<7^-+~$4r)hVll4AcJ?1Qo;nm{@=q>T7crnKIzj;q0ufb`> z8+J!rrloE`)5Wy>30p=meyHhjt!W@r&uL9PPE6y+wGIU711*mY;meFw74PSvn@Kxj z!?Oe8qyj2Ak8jmD694D>)|~kkQOAbbe274xBE>9vZTeQ8f6Ti|&&2o5Sn2;iPRVYQHtk!MHLA`XN?|3)yPz7B7p^y{dbj{30}1SJ;Me$$?CEF#wru~Z45 z*M)WId16a;5c{uh99;}3Br@>T2wZeb^}pg-H$33 zMcV|#i`egYA>yV7t1+mV)|0vZ3hJL6tF-W(ws+Hx2;OYN>_h-ta;S_!eTfZ4Y~el? zHyGb)N?Uofx@JfqPk5yl&$wb|*zY!kOtDW#gCV39*0wf`V1UX9{tE8z%Vut4mul5C zY8{C_n^s4I$4KJrc=kUHYNF|mN#0Cu2*})QoRb#=qUDY;A4)^&gYk@<30Fi${>vAt zr$v52%Z?VD|KEu*F&2vcM0iu<8MJ(GHcA+5Gi^c}aItZb#}29(s#(I-469wJp6L)# z#bB(NS26sVwBcuN#>^Y*Guk@)|5kO0!KudLu8Y}5{t5|(f2BCFo?yg|Vm85e6cda|krRx& zO%sfJ#02AROfc?2cUo&d3=@f4u?>-CqTa)<%Bk3~R)Kk~wdERSqu#^hLi~7|kHR5x ztIE63d=!1GIEd4q*gT-)>=C;A5mSVHF-4fmh962WGGd%Bl7h4s=ERnoq9t7CkJ8V5hZ}}AA`sisyObiakB;Y8_`!$=M(>U}t0CQ{` z*_7Qdil}#tNJ^q9JMXf735}7I)fh>}tX@0qpRSBXJ7 z)70Ev#37%Wqq+Mh*fd-s2Ds5M_1)nAwf9H9MHQm&{J9%S@!0!2e0~zrS)0<_Av^)6+CfjRfV>)PI`!VICtq z@;e|+6Ent!`SIvF$7Fs9izt)2wLeYF8i(yKF8O!a-%Q#5zCb*2`H#t zM_`%1XjpcVv3}Zq>=~frR`@xS;W_&p46vgKf092Km+V_uk{rJ;6$)YRL%cDf9jo=o zjrY#Kgq~yM69*cVB&Rg44aLTFc5)I{F?d^MV)xJl5ED|o39lj5C@GXzj6sCQravHJ>rbL_st*xt#M zg!Lzp$K*Ip!^xp(IDeC^wD1Q{&qF&WFW5a0oDJ{8A>u17T41HcNfqeR_o}IHg_TOe z*#h&Vw8jF1>NR+^S8^8C2gGAW9ecen$4o`mObzqeb4hhEe8Wz|GcUBL#Mk$;GPn*d zp0ECfe8rbs+z%IDa`6*fFS4?pcF6OMVF%#irT&j_sZ0F_m8Jdzk)=MSq}Wbr42vcw z8s~-iX*tCK*4sVkOUG&eEL;wEZv8s8>|iwnd&pOe4yI4yG($S9gs;2szP{id1bh+Z z=ez3*7Lv2_$Z^Q0)Yims8J%{Ji!s>@%>N+b!wXbQBVNczSi2A3D61Ntg#AF!FAbmv zLdW{$DKGH7s^AX3o>M zVw+KlXvu7Wos=?nx}5Z)%2~OWtw}t=)P1(=f0WxqhT72?d;=#@^8u_=OI<)gPaW zN7}p^+Umk0h87@Pif38#-YUnl2CS9v&Oe>KhcQ{-TAAZKXELM;^94W|&rUm z2K0IB0Oz5AJ{60vaP$tX6idijdoziTsmDIW7`Dk7E| z+7dbphp$|^11`R{0zFiM$36AAMZ(dX(=Abc_{VtI)SN93gga0)xBVse62X%wKa4OVsMpIG(_R%PN78U^FMbC`{~ z$VlYvpPrG-y98*l6*4|$B=TKr%t)ju*H)R4NW0&iks@O7K^9AYL`EVziOfi3NPlQX zI&5Sl?rMR|z%x>7xOhfNgX;jxNVmYnGt!-K@!b?J!^L+~&@y$Nk(wgd2bttPhKr8z z;TdTZTs$M)4j0cz_Zcpck?4#Sevky#itY@bBEL`0A+zA;yf+&wo5A=@ONaIO$xD&Q zIGkL^iJll(9S~3Fe&cv=91MxxVj3-k?2h(iCbgn9YIo;T3w$^;NNVM8S zla5yJ(^w~+{lzwGoNa{VBDlEm{TY(EmVbt1UZMUOl6lemXGrG#^FKo}@38zCl6gZG z#R}E~ZN;Q{Dt>JSXC|*|reWulKjR&op0$PcTVI9~ZkkN%LGAv^nj`qhqWALfn@h*} zGuD-1j|KKwRDS*&#sF{vj#ys&j#jfT_OSMBAod+i@0FZ~Mb(MM^clqXu~`tmf`R81 z2Vu1FSgQM17+5^;U$0}k#;@ul)`~};e8;P9yP_}H9E8WosH)S()# z)y-$W6on!|^!HG%@QDW6?>3xzd^oz8aO|(S3yZ0-*Oe`{7|ve7>`D$h^>t7p?e}ij zg3+;CnM8W?T!y2I+W4py2`h~h#@?X5Y`5jVRJm z;o?PFH@J9_HU=(Uq|t8}-N%Z#!*Cge8+j@fZc^-eFwSU>-2)U*s)mgiO^I-){h_g| zF~5|to5{Wk$L`nk$sD`kM=W-i()V)gGEE|4mvsG?WA{*W?2@Neu{$Xd_M1fZTa5%U z$1tnBOfhU->-vM)i_*XK2PZM}P4Y*YFRN{t`I>86jE!O$bRBHA4py8-XRA&Xhhl0v zRwS&)Vk`X01lGJ&d{0MylD&q%$M18|h7kH41&r7Kt3MaCJhBS^*J^dj4it4f!5TYP zwP)ZVujQ#@!m~sMTs%t@!^N`%ji(wJ;Xk{U|Ie?$Sid1+S#)@q|F0eP&O7Y+=6c#O z@e$72rJ^;M70>GtQO45JGqK)MJfSo0g0Z5aqVw&Lm07o(tiL5|rJe)VcUjc9r@an| ze2N#YOV~5oYVTpsDCrVtz648|+0U5;=u8`0MmujmHS+TGgY5T7aP-E}^q*ENN3k#b z-Ju2NCm#TUMONPVpTL1BP8|PQml=<|h5u;s!edkp7$usYoPbB(ghX$`Xsj!okaWnK zke`<2O=#+EiCHB$`eUgf`U&{y-UNSLE?aAuweS*r(Ts=*a13C?Oh0}S+>c*tM6v71 zTG$OM;5<~9qyF(BYS_pV)`|x!;=LUnU~^I44v!^24A|S@IX2aG$lLNxR)X-w0;qv0 zuy`|x#-TJit^@N!m`h^X)+6+vX(9YR20s#=seBu~p)W)fv&yGw<*ay5#r0G$Vm}pa ztV2nOb^$&gkIy*B>Hsa~3obpvrnmWf!A11?TUh$hKowXkeJwUtntv3BO^niG{-bP> zn_bFURQ_h(fmufdBc&S(MlmZ@)?KV2D6H*@FZhJySh)6PlXm6epr zSeHPF%M%;MHIlV98qWhkR5YG}#Ft&?8_TYvEQNY$Sn4s!-bDDSIr=3UiVPefgsFSh zO2ZT)&LM3<=j%}7`mt-39GU*$C9oAt;`K|Q6hl)ayujmsPKwcd)y#->m-%$UPho8b zBdxB0Yd1@)C2;*snO0&sAC&?l*+G}4g!(IY|KH2qUm3akHl@Y5&fSfR-Aa;oqgJ5F zc=jXYVv7ax`T-o>(^xC`=zKE1nZ`c58+C(k2TGf{FmBd;@a@)U>2A>XHU392<2#@Q zuf=Da{}KWj^x=P__c0txS&@5KpKdhHQH;mQXA|&$bNoM%zfWZkeu#kz43JqEs-opQ z*W$soXj#*+RnWJ{5b3*z7RT~{Jj?|8o)Y0$%EkDW3n|r&Qt(#Lx5cNoNM>bNCM%&D z7ay}?i$6ptG+yVBE>valAh6Pl#GneILq$-MWjfY9TaXr1RJyKv*3k?4LiS#85&icE z*F9t%sC!UEH=b5TYuBh-%B!9+aDB>*vjncU*f`wdaQ%b1j=;5?xpYXnK{8!3G?+?0 zzOt*BSb2wr3|kU2Z+|HZlh}p^b4|lO_eOISoo^)8PzQ6x1|hT!_yR&&HG?T5)Uou- zm#Cj2t0D{lAo)@plkY#T>A<5Z+;m_ITG&rJ@uVAy#M#G^ZaiE&S>oIdSCa%bifptW zD1wnpi|mpqafoPT&V>Mt4@qn3tI7V6`#R7fJUS}~2k&6j{bc;6ieLX8=e}VF1RhqG zV?RVZJ==`gD}U-|TIH`zytmRCMoqsW0l(1Epf%vf9r+=BTKg>;j`4end4!S$iI{@z zNn7X`xyn_nC4ucN*NcOlkU4Q4*ANskvk(L{Cn4y)hRZ{7-L&?rup6uz+w9Ov)KBtf z)Z7rjxjrXpm22bKcP)_aS7LKOb2{%d8KbkYg2$cGc-SlLcB1O( zN%*1cs`!J=RwO_V=DUX9!-cht$M%Wvk!In#2R)9uD%RD3q!pR?!{3NFX+MC84tCxO z85}n61&1fn!Lk(JY51HH2$rV#(tpx|Ob&j}1w%Pgu?8ByLXSU5h%KyRqhAwh@P`T$ z^6+Cro!EjqESk&m*5tC4)NRlx#y%FD$bv^V@*`QqBRb_jmMQx#LO1uicu)C>bC)lN z+vBbJ2YZCyhpBo3uC>_-F|>n>ZwX?@L7;h`Y1E2TX(2_ijE*+Z!}RcRe)3$rsfF^A z8Y?Rr*eN2U zzNL9~{>DGy;=gsU9!9c>eR~+LDXcU+6Co^N@3x1F&%)EbJDw>{(tPf z4SbwcmH0nt0}Tasro3o)vjap4f*L7E*n-To34I185?%^LgvLc{5p;tjv{+selC+sV z3`7*fU4;Jqxx3wk#kvZ#us}kv3DSjvD->OquDV(*XmJ$_iur%fInQ(FnaN92((wylCMUm@=i@r7$q1$@C0 zp5V(l!|;U*vZ%eUClfcP5O#pU9^wuGKoFQc05C(CwTlVKaJ}t{M5_CmO8%0Yc}w~a zp8vY|tv#hOw)T`{Y%`04`sJ@+Sr}?L`a#)B``=@`JV()k?K0*8o>YTHf4x`7>$+W5 zpT-K=PD;~cz|(El6ro3-`3Zj9Dd5^uh9ijB`3R{27$LR+8)a8qj3AlqK@cJb2okxl zvBQz1OD09hHG%@3oJ4yKPr89@*8d}r;fY|3`3(XYo;(R;c(M^_9}ulP_Rkd2r`Yi< zkYUFVkYUH3%tgbF_W&7oh`m|E4pDwK=sY09j=y%$xUpl`(z0u5F}Yr7XBXb)ZN9YF z`!2Gytbc2lmR-oR3whpY$a93QJc2yW>=filoh3V(aO0YqEc}!(pC}u#aqSE)?meg1 zZ@BY0j3xU6H7jDtxU+rP-H1nB_Z5}=CE4P< z;^i-7Z*ALzppj#5Qm#pco0LP*$)D z*3Aj~XHi27HYbkvlG<$yo1Q6R#4v7oy$-Y6t+YQX^T2i~^Dn&M{PAp3M&iHrXXI>) zT?=IV*XMxj*5&mMx&_GiFS!M6JlUhp?-?ND$;5(1>E2}szk?J<<{=>C*nS3N9NQKb?@vI+yT#$jjCT{8BgV1GZpWasu0P7!!jm-j2hd6lIsJLHLY?LBAusXbt+cW?^d(eH3DlsKGi6 z(tUe~K@#%jVNg?{9y=O?!ew+@QnI&X0doC60{Ya*kcE3179bf?eHCeEEI@xs$aY@P z$DoO#&;D)!vi!vQ+3Q-ySAZT>^mzct79gSBwgA24;=KxF3(#IHEVckuyJcsFgT%Im z2@lS8&@SNt(zac4Y2?>Y*6)9bT)N8be}157v@_(=h>g(`3suCnfLO)r&qjRoKyq0rC_?*xp(fsijbD)D-_4QTFWD+bz z>pAgLm1;}W<1Bb>W?Fw&i}M1bUc#wMWkNzJno&|+PN$QcP8YPI3IxEIYLwelM{b48DtIl@$o1mtg) zCVT$gQY~!(>1{`!)85GXT~b`8W9yVF_T}}lpg3`?!2?}m)r{oQD3ZrD`3gRy0+HmS zw?A6b;g6TGV#Yo`OP1#M1D&f-8t8pGO+F9w5rtZTUYsrQI)FA4r98F;=m-tn3UsrE z%ELbM)b9`n9R*}%)Bt@}Lu-MowD~~x3eD|6X+75(kWh^$$X!e;5=^Ra7Mi?7rdfej zw2^kgv_fX7jf}qyS|P|Ept>l+}a&la4Vpr6&jq+3-!_(L}*2!RwcBe5RkuF znmh`vkRXsEy`+N#h!Z9+AvKZqOTJfEl0g)=r3i2v2E*>; z_m9Z~6hw2P#bztN;I*yy7X#Va-VJ1HyJ*Q61ZLLo;jk^h%zW`Gz6~4{RXAI(#elI} zq3UY}>b(f|)n~nd`bJ7)=GV`QAYDU~%^-(yUNoDoM!p8R=J6~44C9(4#(=JY;t9AI zADeL!7DQ{aXfplfAJGK69L8yIzQI)H3g{Nr$8UiBbL(>Go1a@VGM3e2M@sW|C}#QR z#R+j_tg4V)TH%)CCO*I%al+)yz(Gq&8q6NSx^aAKv0OT`wfGZ2wiaImWNWbuj;+N% z2C}vIXF#?VzX)V&@g%Ba(B43{7ViUOYw>|VwibUB$kyVkfov`Qe-c`{7Vp9@%m6?= zxX)q>j_|{~@QVrO<#yrMEa8rK;a6XSuB)C7(qs~i$C1O9||M+ z&gKt;``iDUU*MI8cMn{!AZjJbU zb!;7KIY}<2Hi;OoG2Bb*6BcJ6MSXneX)kw(7VDZQk3}MG5F5B?!C0%`MU>wlTrH1@ z!MLYp3nb#o1C`N|Es}-u8Tg$Fw6BJq>7esn=%<0UXnvPEKe=N68x=l23iLaLM9Th* zLcamBa$g0qw0p5JI$A^7oy$hv?anP6U)e=F-}9zPy>|`nn1lPAo;bL@NS?~WSjd>TV(*ahe4N~8X|8(G+2x{u(&P$N3ti4=-Iw6~r`=sg0tW+^~ zMm5z;%-q5{Bv*$_%)(Ml+@(_j>bRObBbo)XO+Z0!wHE2u_eSgm3MIC7cHB!;eeMl|NnEd0bIx3pt>c1f(#uWD=B}hM z=Yik)QXAK<0hfSBOOk8cG|c7}b3~2mBmUPyAFfSt_%Q<`Msqy==JB_XDY-bCdst4? zx|d0r@oCF8nzO~67=uEL^?c!Mz!_MUz)vnBJ~)Zb+_wh#t;;>UAHLWN(97CKXStCs zxpDyFq1fLBIK-6gG|&8P>hmBeVw(?&j7mx_)uv=j7JGTUfOwxI^=AH0%UNEKH@4fJ zaMo3MYK~E`o9G|r8hR`D(!q;oL>oc}$bxvlP;RK}aZGY^xtIGG{jsDr^~(1qwH)5@ z->-|(*kZXpt`_A|QEPf~CwMUt%UTYTvo>uM5!LdZ)vaLbwI^)(o_c9?4x%>WAyjTfp7vz@p zs{bSEGvMX!5L#(Vt*)jA^11sg!CP7G&9+_f0+zJpp62OtFTx!E*-b}80wl1oV37~j&)kic@J0>PYE_ZFDFbdtWu(ADWpwe*-Oy-t z3YKs4T&kXKF}E;R8H;nH#&MM~%_3*MRSb-tX7+D7UToqq;Z0cg$CfwuvFforS`U5B zxK*Vri!~(vl6ASuSV%9c;ScJ6S&BbywO`igVhX=}**yN5>bfsmm>!s&r1tc4nRk&_ z?qZc6AR6`ffWJNtk?>DS_NZ}K0VA;a7vGG5dOdyw+{W}TYV9@p_PWYJiGqCmDP z84O_pi!Z5vVUP#YL+k6}_hMh*m6qx9;x2K|kUJ5EoO^Dy?|bM|X}U#jz^7MOoCsMv$hN*-})LK!45muEI_R+bYfuM)1!`>lkX z41`_A5yk5^1gei=J+or-mzR1m>|yn`*Qg2}>uTtz|4#*AAD6kKP#e(g3VjpkU}b^+ z4X8|^qv_j&6q2ESzaoLW!0`cv{tBo@p;n+PRGifXw6CVP9%zP!-U4KAxH|iOC{a*I z$Hp@H?%f@KCm(0~XrO@92*^GMv=pNmle~`IiGfwU_*^IjY$Y$K9 zfNaJs0CRvwtU zs5X;3mIp8{Pw|IY(n}iC_~$M^o6mXtH5GOQzjSBS3yo6k*YW9vkg0|y4Bg0}SR<889nNP!ru^kid=xSFM;HNn>nF~F+^&f; z;>0;aDUwVaqf#<)j#eTd6X#-ckg(f)AO z32z{6hKtqmaoOgN%G*jEgK=->z@qpXIWzMxQZ}>Ci_b!&cDkW+Hh&7GVe#%6kU0UH z;~~y491u=Az)Pe#S0Nq%E7BL*8Qi)K@=Gdtmu}sS?8{>h0DV+3E?{3Twbyu|tcXv7 z$E_i%^)r5+j^DS5wt5d^FG&7ftD?S_X?r&JN!Y?f z?C13@I+sU*uAW4spw)wNn*(|UMap4PfHE*#m8C1$%lMB6rF}dQJ1O_vCIH+6!BGjTDpn9=J>RBiH#hr zk-vEZ?XnC?mky*o(JHOWtr3%62>m?dWS$H>OO6^74=-fJyF?W((5{Ym%G(hkULw!PPL4%_^HNf~_T*1FTdHAC7r{vali+M67MZ zV3W9OZoQr6*5x~GZZ%JMZe6yGxy5>Use6_>C99&d}bYM-=i?ExtTy@{^WB zWIG-{o6s=;SA7+s9sRt8@{`t|u~I-@K>bf(<)1Y{xRR6zmxIM13oh6)kON97;tC4? zi$b7N6CVzpcGuOlbidN0zN`htDX<){TC(sbCb4$L6Q?HBKZ7S0Z3kv4M^M*2$)AAa$Y)pr60qugG8~JM%{Q} zuIt7LGLz+|M+4hen6pv>6W57n5JpZCW;qE&PU4W0Mh2|w4il`>@b+GF264ztJjqO* z#BvFXPs@ozPU4W0#snlMiB{L$zD1nc>%?g}TMKVr4@_$}nzIRq%*B(;)k!RuFftd1 z%*7#djR{ER5^b&KUFKi6l@D^xwJR{KUFbRaC(NnDA%F2Ce{~YeC5-$n%5~z9zs9uu zHQIgGB?(xNYZpg&j$rre9_lbnv)5ofrE0MrjNj&FC;d59x!F}-{#^Evr7JHm+ zUrfeYIB|bMW8qWgFOyEmb;vIfrCnq$jz)>!x6InuVQtjiWhy)-;O}-q%Au8Yp;DoMC&P z^ya96(xWc$&ajfTp>GAiKdEolKQ)1x0b)`}8rZ&qpn)Tple zjD>ZzXD)1+p%|5h?wkREIisnF?o7+zcV>j>oawDiFD#=r(l69ToEFcrfc|``jc=T8 zoKpHTEg(KONgQxR;{eumpV_=tX;0bOc4?ht-zx#NH;EJC{0d;QmOjT>jRQ`KCpf82 zV!4EYlNRMBaVSS)0@iikB+=F?Ndo5w`N*})uYcV-h2=MXuTq9?BO~`-_Y{8J?ea^= z)A}L5eEdK^`NSKzfqiNO2+uwVqfCW1Ag(n%^YR*0y{6N*T=(?)OoQKw&YBz%-@FoP{_PBc2qaPGY%)QH({oNgRsN zm{yELTif2uZ&|-T2?PRL{73v*uHgMVXlW+1g#>Qvv|*pyzYOL`f3 ztrV}?9&uVeZh7fC-;h(%fU|-ivTEyAcbbOs-F>Tl=frKu^@x)hXj_3}#q?-`we6C% zlq9p0lEi6QnD*NQk)*&}yFk>leKjrx4w|!GeG_fs8-_}`63lnbqVBJL9 zJV|a&PGjc2WKk5YXj7#nPl#h2K*n!V&s=*DmeeRcHR^O%1Wt7If_5HD& zeMP+U28kH%Es(Nph%fsGN!0hVa<{+8Ew${HYIc+1wA2h{gKr-G4HBI3Z&7FF`j(Hl zClOEZMAb-E-%-Rk9I4UaiOkIPtvudvLr`BCTdHkyVyQSTea2sEq3ZCZp*eN3`G=Cy z#N5f5+_i}7uSL!92AvW|-5>$p>cj77?Ktwc=N<3;;RUbnH3TM)czv5r_9m~7cP`bA zxayg`|9v3;nW#zVD#_a`EJW5Zl+CJSl{h0hzwuzX5H5 zwv@+y0Q90lu#3$kFA}OaJ}w9ufn^Lr3M}I)t!E*(Cgtsf&2+q-rm?e);f!ApxQYZW z@P(opn)!bhSX^LxpG;gA_^XnXGTmI@OJU&RFi8b~F`G1C9KM?@hkS9|^zNP`Z!~XdeF3L2}3~lV5OAc-QV_@*C*g zdLkAN9@E9ONyR(7p2yY3{^(ycXeQra=DNHJZ_IJ>c4w9q3 z$EWFx@Rz4ZRD@z~_68wIot=U%tHaqDgw(hYhn7J|Wf zR@;>T2_*9qLnyj2#*D(LFh^HV|LgKaZ%UZ-W}y%NAU?zUP$SyfZ+&R_7?do&vIXVu#e?odjg@J_EE|OoQ2-~BA_GHOSkYv${GU6uF;$(bDD7oOPS;0ke@VRU}-JCcD8zVCtxAJZoWt} zh(msx%n@T@d{xjLgl(`W8*#|563>C9V(%-+?_lY)a4A`uv@}gP`*3TI&HLVkn%z6)5$Z#7@kL0%>%hsttws?DjzA*{lj1P=LmI0H*z2EzQZfQ9@T z`65jZ4*9Jzr`MeI7Pi8il{n@=7ZwR8(KIs zp0+@I*YBZ$m3vaO2&R_S3PdNFGY?04&YT(?N?(XGur$dp6AX{LFBSjpyH~+r4J=*F zuljf2y%CVSVtcETFeiyamRktJ*@{D!HFypz-4rIx-F>XZsx>ENj%QAzIrGeEGH0PV z&E_n|VGU{%2U6nI<&HvO4SC!piO8!LA$Ko&bQe`N<5H*Dey- zqaMi+rGXtjsn=~@%k9VgGueEs4ob~2xkcQ`P-zZLL`%|up@BH@D#w6>}ur^lj zyf&V>1ICzb;<(4RiS{wf3(XO&4Zaqu^SSjPben+r`ddS!&gMRs!uwWMV!SItZ_gf< z%;w)q*SG}~)tb)#k8jKa?jFDXt3a}7a&B{}9ENA*=H4-QW^L)XAKJmR3SJA(^0;N* zs|hUT29y2}Vvze1rt*@?miH7kyePIIW&NSt8`Fusq_Xu_+1#husuoO70?V3eSpk!k z!Yt=)4+-%1Z(Z)rbvO%h9qZNaX@1E?I5ByB_9rrL7p~E^#rP|d8rcS0ft z>vhLTm3+ms@j0v?B1MEyH25!OI#4H!Us2xRA6=E5Ik;#+1Gh2`IW>P`HA1xTflPGd zS{gD(eNRnt)bRlJChMX6EwvQHP;S!pqaTs+|DDfU^|L1{w`ZALd1aGJZKr*1DmD^WRJSr-uF@rO!LDz48(( zd!EOK8moKSc+of}>X-DV4n|Mtf^S8*2F#598W!rdeZ=}y-LpoM>n=0Zg49x+Xyzg;WOv&tFIpDAjH zHEI7zUK2gNqT|)F*26vj#^R!%rD!^9N>DTpjiRL3kozEVMr7QlRCLoLG5}K94@LTb zoYq)QLoJeC_v@tIEG-HeAHQ#@v|s_)bhvzTdBE4}^ ziZ;cs6WsPr`VYn{*kfJsMJ1=A%4s%ag^V8|E|2qi4KN827041nbgaxeW7I zcNl$VFBY5wbT`aJdF(!*&(0D^gtDJg=v<&?h2${I6b(fvX6meSCdFb`YUo#iu2Sfi zK-VgC9366)N(${;RfmX68md8HH)C@u$^q)YhG_;}R1hh<{72>D$yBlb^`h5pzp8DM{ zq3ZWrppR*<{Tb*Kg{D@7rgT3HWcAAc{eHHz=n^2inHpm=)~UHnanN4`&~CAJJHI-h ztzZgiflNsLMF-`9ey6os<^1}9{u|^hkG%x+dkvk8#=O<#LqPwob?F7N{Qd}J3dud} z?o4g?AAnxfw2uLqnc$~@Eaw+p=u-A^&uj1Ifviuz1@xMxT}sWZul^ax`u<@c>*s%y zP>uI2&^NR0oO0A%^i0kZtg0J8i(4rKX#7Rd5z zk$9Tll|Yu?av&SaTYzjVzX4=sk?#WfXa34#5Aka@12zKPp}G7DXs(97%x_-({s?4O z+a}Y7uc_bOKo)O5AdB}NAd7b-kUfWYERZn&<*_*qI@5(p3vbi>#6q~`cL|W?*9v6$ zaRAo?GQYr|$_TCg_;yEq->qX8_=@CA<1>Ikd&7|SK9O{3ASJ{ai;{5^IVlo&UP)jQ ze0M4Tsw7YZN-pryl0cCTxxgz*0!7s00@EouA&d+BQc0l5R9s*cjpZcL zIt>Y^tobhRwvv=0Z*hUmB`JG^9ME&Bl5%@V$_;yr5!ei}jheETp>l!lfLMl@+SYBmtlB;N}qHE2wAi9Dy|$LQ$bzA%x=Z!akL}38{1;|5OrENON~dNFmL?l!O%0e77W| zkVec!mB(Bk-rpn@@q;aibv3#Jv0pL4blS}0!;Pdvaq%spfPV;4I0#9)hHVWyt|+H3 zE6tXTKHE)aLBp74ww}5jl_!5Wy^tk@(()gJv%au8cgn%RuAmP7KX*#fMvpCMBT>j~ zX_BE}3y4osZfP|iay>#-f)KijxP&+VfQef^PxYQv}l5Bv*qtt?9)xe&lznR^diZZ91z~ zsE=5ckS%-7jF*ZY?+JGPHSxqpyb~5CTJ}$`W&+bW)<=POo1Nv_1@X%_R4nk~*YvUV zS&)uj!#3-g8ITk(r~@i`Wn<#FU5e8OXFnE9`06z(C$uQ<*d!kW?b zRc#uh&uf28NaYs}K!M~4&(Cc2j_UI|HX+N}Iz7H@GTo<3O1TF~dsj%N5&KD7`Hoiy zTkhs?y;H8P&v<&qW13&jNS^BsBt_u`w3K4Q1^E4ATJY}EK(p2F+Yb6Y zkYS}fOYsqnCyzx5pI07R0Q7bB`v#E3`$wR^SHFHBQF%OZZ6*>t`QWmw?ERD(mc+3**jOsLxzdDz@>R6(kQJwl|b##`9m=Ph9^@s)U zjDoKlyI>0*f5BtTFUy6+Mo70_XtvoIrjccJ-@>x@29U^Rl0zgfr+76^boxt*ubQQ+ zx~xO83bo-CKe7e#8&Mn(YHM~UW&J^Ayhg{Xt|}Fh??z7ev}vmEr}lYL`rWf2el0fz zvuaFFg}#9<6pM&RP-O)Psc~vs)c82-y%2k(sUq`hijv`#(tv7dK>MT8nECx421JrT zfdLUmh1bafX#}?(s6y3G<^nyXiWQ#+TBKtmSsMA2h1)vp5g;RT0R(^94# zYW|iZD{kOjlq%2o*#xJUkF`Jx9LlBu)Nvw zE+Zk4Sn;p)Zl1KNtQ$pqAtz#(0e)eA|C!8yV_+I|%OexR;q}Lz;?)~rdu)J+Mf6=kp>2Uatun6*TehgtLA>Tc8H2vQ^zaO4CLb(gf^E#nG z1wPqWx=Zjg#9ahrQ|E3VBipNitk<5Dc+mawnDEX&(>Mxc#^_xZ4yDq1 z2*`C?)Z*bKy`d)dGs0A|J_Iihv(-sTns*hak$EZ6*)n9Xp*Kdj(C)~-7ZpAKyjoGC z{ebGyaZDNSo2`eG2g@Xv!#8}E>?H?%oMovG2#__lSj0FOf)?H~yd(^6=swkLQiVjD zVc-jaeyLl4ZB}#J&74>_Y%Bk8iGvip`haL`Q)5n=A8Xmi?{_1`WgL6$kW+4gq@&K; ztK*Mltu8=%LeYGi4UQIwP;ij0(&@~JTi0?v+SS}J6}h(M;I+QkcQe!1U1Ixt5G4_0}U4zur zDzq+QE=5=yJCis8=n`dPgvqhfi7x>4lXrRSCLqI+zXvj@x$G|uQdvyEl)n1EsO?XT zr|o`5X~5L`tLYEzblpN)Z!v4e6`C3|?cy;*SB@DvcCEY-(i)v>Thm7vGc928*l<19 zvQNhvF%=tY-2(|;a+5_kjnx7gr%jiMxV!EY-VgM7oli1j_faU!`6)|SlJh$8)trOV zYgCG?2><*_A#fj2n@FWp?x0~*4r`(Tl@rTSiofT}G!9M&3pJa8pVdsLuZVWD+!peD zVSxv2D3#~48&P9LIbNfr0vtF&^c2nztYCrV`2eJpwVr=jMcWdtR(z=N+)>t_O=-`B z@-k?(P9o1gNZT#ZTYg+hjb~En6SO#?%i%N|qx!X0w}MC{6A%^}q&CKf8k3H&=xSA1 z>HHlZmo9-t-a}{`cGk{Hct<_ub^LT|C=X<*PX~;_px5yN>*uS}7cs_z+9e{7<-V3! zK&0!~Xq=DbuE5}<>`@AvwvW2b`3z8G1^>TZJ_{oKZ)E8`0J;qCU(AiT< zWVQOfZXd^0mN!aSLz+dQ;!%W>JMss3GoKf0-NB8;4zb4deCuxtOk}?tHrR9@G3|aX zZM)qqC;5vd$-idf65)?s(Fcm!aM1m(4z*H;Uqmtyi$gYwhmT#G5wqiIjN#c?lM2~| zy&SGgyIG~=ib60Y^r+6}>2^hC=UqK~ucg`dFxRU4<&@BNSMLT2c2^`SV0TI6Bb2|Q zQ)7o%&u&*_KfT4fsIg!hzHaIkW}y1jT;b^TO@u*Ut2I6Iy7d~h<)b)me_@eG5fC^VCiI!E#3D| zN}8xi>|~w#av|Cp@)lRjZ01VEPSrt^iWT?Rc}=d5Vdj3^a(pOVU>naSl?|#I)`wvn z%=(k`AR7bx!KUx=QnDq&4>RjrSl_}f*zqNq9pFMq$~(*AXn5v6P4z3NN3f*nk%x_X zxX3}9&u^M|AIOqy#;b*kuh$77w8Z*FWEn-|{7tEk*+iE5H0nH%`dIIcSsy>0?CQOS zB_dO)UA1}7E7|1)A54_$(hgKUUOM0qMN3hEG2(SJ&}LnNk8^%v!DEjI`gXwXL?$B} zzi|{MGwx8$KH7-g;%@H*CN7NDV0$zZS_4|o&*d3hrE`zBTJ{~`zs zP694eD)(`UGOBWogWjIC3h|77GGmoICVYQNddltd1f};>c2(#{C~DY48;VwFASHx9 zFY&Rgv&a|3h{SVa@Yq5Kjk|uID`BkED~VO8pQJW+dVHz9VX2KlE~G9{J>6$TiDDR} z>lL&q++{ijb_^oitedz>iZ^O_sDlc-pAX|_=r>$V5ZDVS5~vmL(sS zSsghO*p{>mbg(^gH7Bb(C*RTb&EbSZUWHNZd*M_5Wj_$1)s~3t$$FhjQXKM;K17YCpnFni&w)yz)IM? z)7%Arh*#I&7oS!iC*^cYc?41UYZ$VqxeKPp6ZLW89B+Ca4fhdvp9Y3kF7tDz7yQVG zk0UI#Kb^secfLoOcC9w;fkA7{o_JB9Tyh(rM9DO)+~qaA#`5gi`seALCo~^9X8CW@ zwO^x_>*Jk2b*ExQ?RRnZeU&^puLbpVp0-sbmPdm*z9H@x(kF0>BCbh$$;Ykk= zhE}_q2~${`Xmij=VezfGf!O<);z@CMWK!(qCWSWyDYiKQ*soZR#KxA|ere0a+O1*Z zBSgPudx?H;khC@bR5ffZcqS0@`*?0d~n+3Rtvr3a}g7Qb2C!6kr#|rGU@voB~P_ zExO72ni@aZ!TT(^)KWM+3gtRq(~DL+p(s1O9f8p@=52%ku^?2?Th@cn6WB~R$$*|e zk0MyI4vR31wv@;TskIrly&!TC36@coZz|ik2Lg z?oyef2F(gL?-+&FcfCuV<_>^eM#FARN|jHtNA+g7jE3oz>5JgcdohQi1&aR36!hKE zKbb?8*g<31&~_h12}OkMCMl4;w?QX4=<7h%D~|)2ii+zHJNwq|r!x?StHw+N8Z%f! zHj9}E>9l{=*{XD%FV&Rpwy`=4EJ z|LxFp}^g2hDU465}9L(9hzXFE&(&UAe+nquMphrZ?7<+H1a%!hwE+_Za!ssB#I$zxJB5Er3 zk%21qSwUVApSA~X#Ulom^P*PNf5}3T`+06uofto|Bp2#+Bzag33nNq*mruLU76)DJ zpyfbf*#s@Fj=q%6I#CcSZ7?*c7TxKjn|l5OmB6A(ieQ<$aSy2|e=SE;b5xi}4|8h( z6IJ*u+NQA0~-KiLdj~yXqdk`3<2&2j`S0K)KvUg zy7CsW9q%HwVYdhzZEa`mO|%wM8`aWgat$V=*2e& z%?*tA<5QzPS)O9!Wi|dzPeu-;PEV@VSD1*73snSlp!TPH(0uT(HxQmHC(0xp8u*jH;NOfs(#<^kylXL8y%U-`pdT9 z&vS0(+$c^oseIqRGLlqgfMw%jZ?&k+l?0jY*++ovglrCwwdE`zW7aMMveUQgT<8rz z#@Vd^3hiY->gDF41>KBohQ-ObYLq{}as#&#IN?Z4Ldbt)^M?45iwC1Ol)5&O0W2U7 z>4x5N0wUMZ&34%uAa|z0J}wE_r(2zqY9{nUF_@m<&bpm@ipb@k#9D*PPowGXZrm-M~3 zaxrRgP?*diJi@|#%?{cOTXA7!%aJ|G#&P;`c2%?5@qNb{m0vNQ0(#4b6;RY` zgu$|qO zzeDUxIqaP*?;b4_EUJlY2AvQQWP3b*GX_XdrNdC|65hzXLyT8VB)wS1nn-#vyET#Y za%*oQ>BV5!MAC~jvWcYMB8y*0eYb!73RmEC`!gBx9WGS5*Fv|tP-(x}+B+ENGA*MT$ZT>Q3uLCdQb3|wS{};+nNVmRkO_r8 z1!N+gML;Ivk;!1CeFeyjj;#PPA=F(!CWQJblg>D$yMRpQ*5{yS9Q0ElGw#*|nwW^Z z705*7D}YR*dJm9ER5t>docQ-ZCMQmU;wIWX4#-5iO+Y3rZ3Qx6=?Wl|lHUVlQu2)w zI!pTC_dq7tPC|0*Jm5GWI}bP?$gKW#0@ND)Kab2cJH3Kz1LOjm#tLj6D{%2h zff3#|Jc>VUo=7fj=PYjoE}4h4#Vh#XXfq0}MRBU}VNV+7L@KU{nbgLm zg491=!pXuV#D2z4c}xVFrg~N5Aci*ZJKI4E9JJU$Hvoy1%<|YH5ED_hmx~&cJW)>f zv(vOSMsl!nEE@fV5pj2kn9PCt1t=G&H@wBsBC|!>71CjDt_McvMyj(;CB{CyHtAAD zavNt>J2={QU4qa-H0e`P7Yo&{-{12qbf=)2i-R(jnW2q4VMq&7jzGoP?%N?89Q(wR zOAaonQjgAF+4JwIF#8A|yc=~|l6ETN_PS1F*`|L`iT`*?G7z)9qU8v z&zhgxoWpy`hV`yB)}AvsAnC98tG3gGS*-a|Rn$ z%%}6zVU}~I92+w)e;%5{@|loTq z%9dvQCx)J7luVfz;A2Ym_V;E!0cXmbOY244Q)(r7M$81VhYXn)&o`y8z*-RsVHfrf z%pRut#X@E4$~rknGLGeVAXCfwG|<mcmA33H=pUjgtp zn!5DK$VU)rBHj8w*qdi7kMu@+bFQY|)tfSVWNzL(q29b@S8vjX1x#Nsq2Bz=uHG!_ z%?l>fn-}it&7$7ym{4za?&{5=-u&W(dUMIH-Yn|P>nGHk`CYwP)SJx{>dnix(VJ`q zvQ-tZ@Mr6(5^tGOcwPLypRx(zN$0fx=epc?tJdSGCb8M;1=av7BHMPc2DqnpQM$b2 zs!Fa=?IBj~VweP+;rVryjdJh$FmGmm3$p(~IL@AGW5$0nJ@oYb zNXBBkL)93I*T0tgSM8b2@200@f6+^rZ+;q2v;;)RfssUB9E;aKv*+0dB=&r^h?933Ui8)K9&ci*`?i9H7K3K3qCmdg3l+|$h`7MIX7$ahu|06 zy#FhYV2M!SaB~{3+Yp@KWvd#4j_c)>DcN8(>33+w+AI1(nDC6X*j9{WnmJLLxc6Liaoslep%hTjn^>3=KU1D0l@VUu*~a6SgDD zFHcdp+daJ$?w)F*zM+}Ov#SzwP4(?pobvS&CD_idmOhKwWjy_G_8yEFblFtBJ1vWJ7#G|GIiUf@-ow8xdu){{K~s;jOq`7$dV~o#?I@ z#ykXM7}Lf4H;nlbkYS9xvTYdi6ClHwp92}j=!;c4&&5i-Va#7RjH&!zgE4jSd;hPZ zOk-X5E|gJ}*|o^9NR70}$V>CAWlhBrRSth%p79b7U7(t#YBOHf(;kdS!2se0xqB<` zq-LvXbzw)GD(7P?g;{xq_OW>9UGjyQcrIka$4pT}#I|m?fUMe$fXsNmi=kbqr0(#^(TK z@+W4fdCMO0`@V-g`vw1V=YrX}qtl!BUm$OIWc}~!1>&#;BKs}W6*$ZDGH`=-Z5g)c zYzh=H`3xr`r>&fUIc1&^UmQ8i_#UFpi^_cmkLY=s zS^Er7MyYoW=)KDC=rwHRpN?cCE>O-!p0_b+dMl90kG}>KoOuc#ll1&w`SmsSGSl82 zpRVC$rUn~SD#)`;aweBGj;Q^`4J3|Emd>hPe6)>p(e?V}+S&f7MDJfG2O8EEF;jM~ z*6}DHs}FM3Mm`+(6+EqkI6rZgRFE-H7+M8;=qJme zz|+a7{bxePN*H5__tVPX_<2ijcnjPnF;|Vz) ziv3pJPpa{Es{n=|*0QBM5sDhVgQOIRYb~h$9TPl%R1+aaBWo7kLtZwI^Gg!J&h<(4 z0E3#%1OtW2?G>S%`}?yh*jE1q&#rBWfBV#mmQQ!}w(@Y5TBH|S8yxj>uxXYSdPFho z=&7=iHSR8WSVx3jE>B)J91=v(L6`%yg7+c9TO4eR}Q{zisvlyD4q{SxsI+a;3jW} zaO|J;56!@5KtDx5AVf07Gxw%R*poqC*KvQ35Z8Fu-?69l{Obn!@=mx;)QjU?UlPCk z&7zb|)8<-FJ&$|0goa8qX|x?F02Ig_IkM zo2$P|RI9FDg|_?ZU(u>SR@TrPP-Lb0Uao5;NkWlYu4@%vxd%m7WXkTnKn1<p*->`iXra<#QFhO75jXeXMjY6cTeTz@7vs6}uIRHxCAZLC^rIG6#;@S=5#0ip z@8XrFo69PsWd#}gbK8nmq=nmDk@DriiiG)~ma4^!-$F)`D*^t^Tcy&%adTPMDbQ<6 z3Ox77%Una4DIKM~N>_A6yTWPb$FDfn^yYh|ux;i0dqz!LN`Bh$Yr7z98AvVQq3kkxN0i-PsbK0v3=mbx4SWc_k9koC)K=XWZQ^~+h#@8dvL ztA~NCH}+$VG3a0*EA3L}*9m03aVwDZ#vMS`8~s4m8|#7W4Snfmx92mQ`LvE9Sa z_W%Vp?}4laGlA?5V;zv$9y<%j_B3+!&h|84chJ8$Xuv_pWNMj$Zf{c&o|DBGM(5kB zBSzewXxu=4lV83t>g)DQ6U||VaPeQ*#lcRhj+`?AoW zW!68Xq9NZccRWK8UNYljU7+jfc;_D_u88sCox&VBQQjUR%6mbMhQ*epD4}3f2XPz1 zbGKvBtJb2Ml7uG{BA@Z?#dA4+smA0%yz_W6(0BV@*c~Xi*BKbv?9qU>tD9rIvgHJq zNE&BLJa#r8t5EJP%&p}w_02ysoAANVY=Zge72X4#;e^fc`&o(TqaceOEoEwW)Bj7VVNWmU z*K>{WjBd-JCZIhq+}VUJiFY2swS7kT*V@7BV7y|dCWO|14d@_+z6M>^g3Q7)TDsr!*{s@)tyvi=^dAB|G{Q6&dN7X;?^=+MmzE`~SMM}3RU;kvrKUp-P z@^k54**ItY^;tiako|Kg%}C66EVJglhacAY^V@#=cmtB{>dXV*A&VG)3kvVO#qTYj znw>G&5dYTW-cVm==HM4zYLLf>=VCYb#*N53f>}Ec4Eu2_#oZw{+1Wl$SK-HpRie;< zzdITnSxg}uxMme@^u&bnyVurFVMo7`celpfF%k!^(KI^ysGBfkfEysnk z(4Ug4AIM-?xxFvRG|1)~p3LUeHuN8?=Q;+;NzjVvW~t%PJfDY^N1&~)xl^r91(5|MZayM%(wPOSKx?#o1VjRaG2y99j>A? z2Fz289I#GqeA;I3SfD2raUKEsTVz?^plA$9^V2G;^ME@j^S~`ilS8` zSV?s8IEmB&p*#lAO*C6PrsFl*;$f=>t4T^|eX4ZfXgONfhH+9#xi%J9aFd!V=?_LV zFmN|UD_WKquCy%ZarNI_5M}dUjaK;=K8g(=Es5Quq3Boz92g*@%Rk=v-$mrNhFpv^ zE(0?1D~q`i&X-*1D?l|ml67?LF$$dvWNF2Od_Y!r$R=p^E{0ASy2ExbLnlf#oMHq9 zbndEJWd|9J%%%8|->pjFMpwG78gL!O&aD5!j90{fl*lG`TMU{DGnPUk?t#pv(u}C< zYEZ7cN|34vxz{M`Tw#?%fkhU&_ZJqr`1BM<1JgU1YgFjo@@XS2b)xJt=2~~Q9M(q8 zo|__Mc;wZt1@=^tHaxvhnQ1faYobZ@G0)bzmZp#z(Gj-TooM*Q`cj}k?-C3a9if`E z*rcZeud1rq%wt@vVRRd5XV(gV0g;k8`-+t=#O{=veu%Co>7T`zM5Epd1(@gM$fLPJ zSK#z3YbUiFpYHg@>q3MUZlCcJ5|_20o~}pbV%u%p7HaZ0Z=q%l!eL)b9nlKcuImXW zj*#}F2(V+PLxDnF?A!%ySW`k;XuLN|fktKZBtFP%V$br*F`6iwCb1c#wRNI|6g@rPGk>N@s zgBT%?25!iSQy4EiaSFcu`cmh6GPW^Vt0N|ZV11YI zFA&kXbUA))+A`^DclP8li$YO)Pqb&FlWsDRY|_cu$M`1Qr1E$6q|5Js$s|u`?C{C7 zSD5LJo=o3il4xy1gx}uD6rDaO1`P!)zHRM!DN#2a1&fHV_`x;=3K!nG@%+3jjZv;$ zr2g^hU=3}5RF+h|opJ%^IcgKAWuyb05j@36+pwdbaeJ;4ojzmy&j+$oo*w`i<1fcn z#@bf{8RLIGEt! k}d{?F8X!AUoH%0m#lZy26<>y6I?Sq+u}S#R73WW6D4p!LQ-0$FeLI==y+^JYtL$hnKf`!SH!MQjRL z%jJy4+IzW!mH=6~>zv=ufvn|Qfvn||r-Us}0EtR3))#>6ROVbD+xFc6WZS;~=b+UN z`Zovt)In?tQ%pCvDRk#EjZxoVQK8p<`8N@)`(4> z=R_`5(07%sy;Uh@LE~C>u&&b8^+WydL-tA^wOJBr!h8V@y=7pH`u$L z4CwZLws$=mFWLUd=2ZB^Bs)|QfVzEaK?({JuBB~0u6Rp0=B`vFoSMu@H=ius@;(%y zgC-oj%X|tsdqYi#a@g`x-AE6}S0R!Pt;S;7Mq+`q_BBR7wY<-mYm_4*+k&vO;+Raf1Aj{=*&TonH6CSv1h-ct%YGRbUAm%bfEoTe+TBY`@qU<&hm$ z^l{~K)*tn84;|M{{gX)1f&sLfk|Cp9j>&uVk(Z6nKHyKDS>tuAbD5?R8&eqb*_T$^ zYsWKy?6u=GkiB;NNuVQU30=4t$li&5t7>UaA4@GyRZ1nboTYUesg_)v{gZc;J%e6B z%p>iDxWxBZqj@F1r;ZqRuEmv+R{OziYx>9+43$aEUbsw67PaitvF2aJ1B*%>eMuXj z@GXbbD+6UMd*8oa;sRwW}f8#R>jSv?5^{H3B$JU=>Y1Brk zNu*IayFjPd?{yUuoo8#$$w1bgzXh_jOC;`5{K>DeKEhi5>9rsdB2}JB3o1I1%7nI=CFcE5WQzR>+_clW+OQ5LPKSPwVDPr(?_{lOT>vv*eKzXGy4 zw*pz613U`*=%FjhOs5<4rDa3J$OQkH(vP<)o34KRe#!TVSk)m;RISCa-~e8lL=x z@g^U+>wa63ToFylm;WPKo*ePgl6zk17X)cy6bg6g25gy9`h-L_SP$f;l&uFJ0E%Go zo056{$}MmrVuK-QK_*vM5qj0)uC!tes~7jnK}W zR~1{_## zNcjW<2(y!uGdw???CQM+?lx1YmE64Nm1qzIAMA#L)6J01Ob%F}8f`^5a%y)mSbjN9 zjvb=?@?Ib_wt5WEW&+A%Go2q%f_JXx0Y!#XTibDEvcMMwoY{El)kI!VE=D`<*&6_C|SNS{G+zG|;-p9*BP8I?hhfzr+r#=|iPmb|dW7D#o7Gtg_eOc2~X8h&~* z$mjHuex72J#kzT<$s*ls&xuQk)`%k7rx2lwuTV%h6)(((38qwxNb!FTxl=GN-7Ix(bHX3P2Q zQ7f}{EwwUh*KdznnSE@jmD$IBd(_G-bW5$wLigLFR%VA>YSjkOD3858YGsztrB-GM z{q0dJv*RwcGCS^Xk6M|9c&U|Hh<_7mwSvMXMny+t7-XdxnUj?D>~58g90nAj#v|r4 z`kEy9?5Xp7Jo&8OLG_U3!J)XsQ? z@Fgqb5SmA=_1^Taop&4xWDf_(Jhq!3vMn)o-vip#m~UijJbE8rGisZ3ld9F;7C$3% zCtfmlMrFV%h-{rP76TR}_n$Mdj+9WGNThW|tlkceIywg!ihiwEs;S4wy(?q*k#s1# ziK#rX#?^Yf`B(1BKa}zX9C&g6zg_!h)cHSrDvN}2{2P!R)BHE7dOI6Cc6R;~pIu{! z`n)34ej}p3(q(7I%#F7TX?nwh+wtPUP%X)xfoN1MHFW*r=RStQ7D^;*Qgr?%{#21t ztn9#vsFfW~bOR$h@oB7Ta!$@&d@q4#Qo&SmZK@`gmbVL0Unf($l93mBZ&~(;K`=AF z^T83!?~JI4ez;X8l8Y$26fEF$Ji4%dR9$nV*MZ83D4!%%cUOc5FRRHL&JSX&@@!!~ z<{&vNCwCt86bmXfUX;JfS!9>50I}2 zloJFx_ML%1e{cvS3$%@oK{7rDEpSjLP=}6B4#*HlsF@+q_kn(_UTqFbN_AmLsdh^WzBR;Vp~0$K3MiLO#qZlq zNcVzVx^8Xy6h!K}!XUJ+egW^;RQ`|L4mt{GFaFA7$2lnFAd&^4 za~(9_L7xY@LwAUafUI*cySSs9EN1Oe6o6T~lr-A|rrF-w^r_ou_Uo?M7r15{B+VAi z+L~=p%K1sN&F@?XUF4uI0DWDXy#y%I>?EHhBfY+Kq|HJf%!9N_rhv365x;M5nU@Q4 z9!7w4AX&KN(6f8ifoo?SBnCf68rEOC_I0}U86@pHh(9y^X%JBYzXqV6PFS)kB>*QRK*gpGwBq$u97zeTA^Rjq z6WljYX3$;y1Y~rs9>~;K1uCk$sKLq+TI9O_Kf24$&w2SPlNgBm<=Xn+IC&EneY!GiL)x#^2khdV zqCB~(th@dHetx_(I?x*4A^e zH$NAzhTvjuVD340^@rls_0M9SYz`@>Sjsq2`D-{{XD{`f5>M36AWQ)Hnh(7&>H~q z_iRo7?KBtq2_Sp>?^>V-HQsU{d;9M;2cZitY=!a*6#!q>nD{P^`mQ!#fBCAY?*Zn^ zwB)hvIv!axgU~N$#3u3{S*$B$xOW8U>f1WmoB2q*qm9(wYV=^_-*ilG$Cq`9mn8R{*Wl^>H=OSK*+_ zV}n5N{omf`dtIZy{C}s>t6ZaR9@c2y9y*Je%_KtMH7ADDL>=nArVhpBeh(jcxkZ%r zz3^zShn2YI{C=HPJ?lg-dQc~h=+}NAm_or@FiA|5LzR*mH!zLwH>50S(K|2LQ(s5* zVh3pkhXOt3W+Suz(qMUzgFUHj29*?lkBq-X3ZTjfQq@$7P{V>1UF>use&QW-&Zz z)!-v5%=P$WCjsKAfsg15&jWRuT*g7qh*3pd(?qs9BgNo-{#@>Y%1THXJkXt+9E3zQ z#r7rCY9#Y?f3496fZ9~4F-)G@-nxC?>gJl}`BvvY>S|lawzO@2x-vJ5zD?7&vy$2& zbmJ`gHcj95O5bXSh$nrErv_T)A0DO9KMyO^;+GAJU)<4JJY3u?P@f7#iWg5;%dlu^nVHWn$y|FwX3h9Wz@rmO{){Gn zYv#idHXmfO|;V4&)g7qPR z+gd`Jw{!mgzw}G-BU8u+u8QMlH_5RW`_Ascp3V~5xQA) zo+gZ|@70W@n^%m8s~@s%E@E+H@8=5Meir9oEwaGk=#F4F@{D=8Ng*C*A;A1qX2)2P zY}F=KHGeh4tkK1*h%*TnFEqDeV#IBtbmvO+m8w3H$v2ioHe=o}@o!vgxo{4SpjU-9qY8VE zWop>oO6~?kMYoTfn%}Q}l1$9Pu5SVb)w+Tj3k5mMdRSyVausD@OS~^#A*KXjaLb0o ze8-Z#I)=))ipzy)5!JB~`Gg%A%aO^L0gB$+*(yH3{ zy=-iQ!-r~$)f345{~K1)P~GG@J_v*fw>y{~bUR4qb;{Z;-dxTq#P zd9IpUeHE$BA?A){8s7VIbLYg-hh%3ot$JHc8`i-)V`8MXRf`cim@E5ZcW_cO9ixNC zKdE*`o41J!Z%WT^e=Xh;GCZs=-X68s8S`Sha3NTd?82!oNwWJc)_~XDwJb^BQ0~02 zB<&QW8X?n(lfs>n>99HVmW<~3iO^dz<)b}6e6q7!AHFxq)Lj4g;} zI($TiUt)6TfBP8dA7m6^ZRhFg8NDyr%bP`Bc7M{H8;C6hY4mP^SPm^8zGk=`j7k%#vVQv@*@ar>u^3~4D(V>a5%C^N7v6emB)~u#=vDW=)gDHR(^pV!BDJMvKXPrnM zS8IlHvBNZe&>#z-qH;g{CYBotf{@!xm3NuxM>&e-p%{@dPU1w0t?ImT>!y;<3oL?0 zXK=O6BG}zK=#~r5rWNk-J%*4bW2~IKQ(L)C~yWm!P6}VoAu27 z8Vo}|h0elktoe4}Xg|H9fh zV#`;v%Ez#a6QN>F0X2zu*$a87A-x%d?M*2p(zwfpx7S`bb2Q`~Hr~GI-N+EyHwg@MAoWo$*hte53dpXqS;$h_4?v zeBJ!jQIJ)rsM`zBj^QNgpnyd2B2r4xP^nYPMWszx0F^+gHACg&_ihiTq#;|lVH+OuTsrWZGFGpNM zi&js2N2$o`7&nVTrmD|1AJ(BpSck)nbvU^2?p(p@_H~p`Py9Mce2>fcUb4Z5a-BaZtg7Re z-ffLeEO2jSwOmd^5$s$Q4tcz@jn;eq6&2}@O=T?$({kY4?B#Dy?uj?0K(_4sMefG@ z1997z1b1V)C1L)C9`*@sYf{4JwCo-*SwRwgI&3oryt!u}E%W?q;F~CW^L4gM4=yIq zZ$r_!HQZ`*>1&QMRGukO>#8s?yYzBNsxrn^r!({H!6F`>f0tR{a0$y$yU^Rki;; zZBiPbaHfDz5NxDD3gsmbfj~fK+6+Ad6A4P83WX?8%M~<2rmaG0N)p@QbR=Hku_{Qt zSEYK@)|ZlkK+^`26p9qMLY2Q#UX;dw6!n$@LZ0th>zp%Zl9aXxUhlo|p_$*=XP^DD z_S@QPueG+jXOBd~4nRz95(8`8N1t=^AHnE!zYlA7cXQXW!H$ zk_*}6?U|{0AUh_V+cTXzv#f6($)~wdu-54~J3h0vraqoMHsi%JH4itvAC|K$og14G z9x@jfR?^LZCYNP$X8>W#NTL5jnVR0F_sndECxK7voS7nxrn3mlzL4?GCeA(??+ku~ zY2k;DUH*NPf06(aqx;>ON1e9QRA)u%$+(1LgiZm=hFWMHMcPqm`hV^l@hVBz3wQE; z9hBdrJwuj5HzkB5GAKEg-s8Q-yH7ilTr8!qQ!7?<`35E(8`kWRWBnp?OnlO?UHCR z+}(_KAA^cT4AHFoLHHq;n~j`FV_B zF1LNzt$E#PEhPsT_m%FdVBE^}braKf1_L_doi#C&pBi_)6Eof%Ec-GQbJH!aII~ML z-c;ncb?{9Uk^63w&h2BEGS|9QYtqj0wdtD2u6*7;nvklj^Y*K7*KA_6Z^-0stZ1f` z>64GlGS*J%6Jy1+_lYvM zrDA6X3A3q9W!T`%C5`M|K{l>;URefhvBr$&lRSriY^KN@Oaa;Cs$FIwH+L@orb;FI zugHiJ+VEdxawANnQ=MiS3cl(;g-Mv_YoSTqn*Vaz zD!7Y9?m3(&(-{-H^dsGdQlI*aM|WaFIz2h#{H~&zOPGzHXy^Vo?Ny3-QEBX_A(CsR z{0eZNUYVF*9 z2Mz8YJq-W(`ooD}eCqk2_b4MIc7Fe&NEj;%+W<1&_0OP#^zEylgB6Lzv+=G6gy>L^ zop2lnvM){s*%yO(T;Ha7J8j9{WVp8Mq5xrAuHhltmc2YXZFln*QX5&NEyXKVcZl{k&$Ll;kbH&^Jwgh@?Ag6Eay2X+nBJVVAq>O*qWw!#3f! zDXcZ&&p_6M!VX&#iVVgY3!T=Fkf?j|$xfSGMSn*n(Uj7%B;Z4UQw67WDS>J4 zbUk8#jh@Tl(?E7FH$S(sAFl(a@ixZ!WxlRMziiLs=B@5d^{|f4d#F40xcolJ1)TGq z1H35UWx#;k#LlnNojL%6VXk6*j$~X<{2ch{D5qYV!~1$*&d7kT8?TvgTIh_Of=@a8 z%8fmM+yxRWkB3`I{?*=14;(roF4+Gp^>`<{7zAaYpe9;u6cOsKiB(xj?uM z^rG^Yjj+VsJ1!bxxFi0LHHVMoktNTVZ0u2n0x{0&A-FW>IW zh`CMaC?jThcdA3iLpX9|pgb;}FC04Esh1^&jvO5^jub>kjGxZ%BgVXf3>qXsLctmPEduU|N_q;1~bk!81I6h_tn zIs96C+zC+G#@G~)jhJa6`gDlC5F#%`w}j{iAR7<=39>QvYtY~^)=|wx}l`OUU@5knw~#MImo>g$kYctP+(MS$%}I zZ|@k{OXV{EMY=W~N@yD!5AO-l;UN-+)85KX*3gU){R_y(!;K&t4_^lj9uLy=jE5Ec z{BIf$)6P9Fd2aGNH-CA>I=C}wt6|5%8IVNBK@u>SJDa22+0A^rGvlBq90v~tTv;$4 zr28vV77hsE%7XErYmG=1Y#jLM=s19hEN0LUgZ1EQ3SZ22iqJk}Y}n`T;7AzCtL5wb zGV9oIy_+j~r8W!h6|xIQCf8dR?dlV}FrG~I_r{Zb5oA2sT9EN%kAdtWB4I4PrQ&&! zbldol_1XIU`$JR}BH_2~?Rg=(EJVU&*!cJc$i~O5puyv#l6)B-8~7P^e1zPar(5Zk zO(PK9#9O}G$p>$+vX)1_I+UxBkkiTku3iH`~MikP}jC5du+ zkzV!XXR77@66RgkN#V4pOPp}kti5tKx8=36tM)@M?oR4*Yr354R5!ciiT)=-$>eyE zHP*WxR+=>%orS^(2A|-`U$34hW}GxEtDt@#)EK{?z+4_M}(cl2=58=>@}PT3M##IYQi;zsxzT z&JX6W;>`S*!!wh*s~$sUlwm;+S@u4_p>Qf zDbN|{Ksyh4#ed7qe>8(){3Gm++M zy1YAe+c7h9GnTu#868DMO{(@Fd$ZfZ;yN9v z7slIz9&Pc?3(?{b{Q_jy96SYjMN9Bph+YU0g6?_>5pGU01@}s_od_JU{km$aoBMo% ze`UGP@7I$YH-Z%0o@BXnT0$rCkK?${SNj}#R4%rSe$_PoCnJ=Qa=MPU(S)k!2=^^# z*J$S8l5|MeX{3FivNltth+2npL4Q(;$q8?n2rDA9&P)DrQqin4fHp!VSGPQqOWo$? zrgfmBH1Bh4ljgYIy!kRG?CadV+o_Y9N>4pHTb8^F0>}DsMEz_gcj>KY$&Wisyf&W} zD`T#ikmj6jBscBOIdF3GsUN7!?lalBz4ikmj+(yg$&6F`lzf6(I5nA0EoXc!^pC?_ zQg?$AK*!k=O@WIWuI2W6g+QG1##9w?Ag-Qd<+N$Fe$g(|kJ~cu@zEJ)Dicw@^rW=t zx<1BMX`p^O-JARx$uCQOzQ$`IKRGQ!Jt9z#9WFmTuAatGlJ9go`y{!&?6}U@(0h&OzQbazSLYE<x=gE%y%$uiYbE z^ZM*j=}E8mkE|N-65|f*B)xkE5VW^!OE|5+`QXOmh0A60Fdq^~{J$Rs3ZuCBrMjDH95Ef7)DEKK!r=zETFK7vX z7Lb12%$n|OX?N;|5pK(iBeKhJ#ePH8Kqj9J8$Y{RvUX3NcdPTI2edphzLs)2b}M9k za&^<8Vb0@*&3R-$UI-=E4VEjd*onrTpLM#Wdt|!h`4QRM`Yt7h;@s&Lx5j2)A{Cz5 z9%MWvtn=HH^Y^6UT2ZKbp-~s{ZlRKID}DQ}lde-la*F6P3L=)>A_*+GcLhHpmK6p;MYA&b5QZ1=bxc0t zg&pmhPJ84skD}M>$McCX5~7K*Ql+!M2c>mso50BXriN_;ne^!WRN+)zocCbOHJQ;q zAiMYDyfADg$QJ&ugG{1yE6CN9g~{|C$_=_c;00S$^Vc^}i~>6lgjPmF!??}S(8(Hi zZ7jzBXkZn2QN$l2n!4)3mW2upVBgChy40e;%fEORMT?mO>$m##o4c4UDv+9OM+#Ex zZZL4+NUVtzcOt)VH{x?zipvfpS*gW+Ywo4rv>;?Xj(_E3iG@OuOKGy@RkB>OHrLX_ zCWTIK)Vs8#CKV#Za#EC({Ypt?c$J)}DVk^LVN>K2l<9m2m^)E8^C~^K8A(MOpTflX zH!et(U%#qSAYLWMX@TC{xAU78^sP0g`E`B=5;mXCMF~TIof;A5&-pEVYQCIlg}=8U z%(rn-8G^R-`x-w{_r_Fir@GuP^w{>z5)S&t&ZcOdjj3>`nFZ5m-HySlPV&vca8af^ z+Zg6t`0pjBdHH=y1$c80zePy~)qab!fjRhn3!Ntz!sM^h4YXy#RDb<%I+vO=++nN0 z=Q}lFm@nL-BzCrC%@6MOT9&%#{P)(T74t^>mWs7&o@mwmN`qPhk8m%pFKxMIk9aJb z+*-TGxRFh#ph&z2tRzk&XSHk_$Q~*CxQpFVJ$Xh+^5k<4 zqH+S?pZwYEwqJpfWIy)tYK#=;j{b}59J#ii>)O_~JUzmFc(c3bS_#4t#&rH&XhMs> za91$7#j4gh$F8|@|GzjFtN~oLSD05bn|MAus?#l5b4M95-I_IU@V%U%UUjg$;I-Ju zSnR5}n=jSlPT7*zthowymlIw@k?cjq!b{{J%6NU41V*Z)NaP;BQ+d;mLAS-NwwH5Z z6FM5E`*=-71ADnX?urpD4Y>5nrNRiarn9_UQ{g68%RW}P_C&Z*s|dG<2MygKIvw}T z%pKW}rg@3e@hg94nyl%`mUQoCJJX-a*(*JXY@9d(2dog%UU$+ND;=d=bQV-J99}`< z%0<~{RLc?V>2A&a*%Ro5C~Sz^;M`PBz|YiIlOz;VwVT$WGw=3HsiwxU0%b_@tZKJs z^3dSOWhd|E^e*+@?R$UMcv`FbH$M)c(zTgErs3or`yU!!U70&aJX| zIb|EC^L{1Gq4WLrZJM&5^lf08E>`=O>J}k$Hj(sp%ZV9L3DoT_SSd{ul1_{jnH$Lj z?;Dz3gJKcp?a2$bN75lzDjr8}M$#K7OdAsNl_4P?9TIZZkdO}#$?NqYah47VsT}gv?n6S_ zhJ5wqAt8%~guFB)psyXRp z2|1uhu?k{=rcOVnOm{DiyCo0z?+v$IFW8$>?Uu+7@~$$uw9yx6m$RuHqMY~%IStHz zCgJ9 zY7s)KD@XsBc6|%=HCgggAYU?U3(gK}ewpPQ7pFEHWF@IN_Hg^1(Z3H5R`n#@y@Z_| zss6(#jz02FMT9ShM0kEM5&RSIO86d5z`b<2H1lP0+UHFj=MMC`CA}bw=zHA>f@qB~ z{C=G7@I=$GfxASwP&cBDldQ96B^Pj>1oi2A)*$%Z~DU{ipk{w*e9KH%yef4J} z%CH=>meX^>(~b4Q{aCkoAw;6VP}G6mrQKVgor-YiZb$}pmxle2UNOq7(em`)ftiHK=F&i zIJ#6A--PRZfqS8!Y~u9V*Y#@YDkmWOqU$l)o=eY_SW2o*Z%V4L&kLz`!&wfbI$b-y zEA+Z>d-M|RpVM{0xGbccY;&yF52jq5c-DIhclN%8hLnYRZ#^%p3kxROG)7o^)w()Z&AQ8mDv(8dN`q8Eg zBo0f&hn7w^+v%#4DDKx)0Qi-#hO6JahKmQ+@SxB#Kdfp?SGCmh4_eQ|(*If^{|~Ka zX{4T?d89h*TyJwFkD|ms)Jh5)Vm<9fkj=Dg%p>!wDrOZLwCS@&jX7*p6IxZ*b8K;t zw%5VZ8P;dGd8KHu>_Ur8467hV$5xpu!^$iL6%QNy>N4rIyz0z8N~S)%(ga;;xKh18 znC%c0A{C{(_DmTE>0;d_F`M&b?kyb7N7k+yVi`p*2Mu3{(X)?}LIjEfZ&niQB*Pv} z8AeN4n0RM02fx|en+QvBMOcc0=tV`RwC;92mSnFTyt|j~u>%Jr2Rm}cvK`MO+u8o> zpzIm4yN~#^6IBM==>H4I+)K2AY|FnCWE*{v*Bjc-Mqk)Yf0~kdbKpLlcaM1_6V&}v zzGUMO!gk=WNPFs zSk6a@iZtAsZs$7Hoy5r()`yo=%sMMyv749)wybkF@0l|`jh_e%9UuN9Hh-C#ZFBZc z=SvTexv!?zbtZ3Q)wWZ(OzzXqj87AAA&Kis7;cH?%Jtm@QJ`3e>_Tg-9&a zZQ&9t&<`m~I&5}67COtXvqvl%NU1?PsWB+%wRVmur z)T)t`-kw&ir`^n+^XFl!{w8coA*H=Nh}N=Jtq9xlc#ysQJjhyg4ye$oXdVN&m zmr;t-8-_?-O}E&yzLIWvL&xOFsNge3%&4Zj^rTqdcgfu42w4A{@7BERELu4XXxX1s0MSD@rcF)hc@ zuD548e{S?L+@af5m^@>fGPxQ#POjH+rHYs09ZQCkoFi+}>$f|o3bj> zFuwyCxyA6^2r5lrM3w==#&58g3x4D-zvb0(k>0FlF) zE^r8oo2WB63-6uN*uRH+ho#7bTCz^_lL?SHlaid65%VP}2{Nb6k-}(k*%TkZNDjJ# zD|461b})dtT+Z*sT3in7RXk{vw!f?tK3P|SjI6?A8CjnPouPA%*ftwk_Xizj^N@G1 zo10FbZRGrLZuzu=dB(CO5C;Q|#7I#oZtQiAn7b-!sL>|L;axM6|H(#HD6v#;gnC*e z7`?gH0n=XFbl!@|L@9S^V=sP7y*$&J4VYXsr@fW>p08(N60t}>Z`VEV=uu+qV~yr? zY@8{g@3eP!C!dR!#K1th=I&k|oYp^<#9}j@&z(R`<@YrC^{@H}jx(#($K#t^1#+(V zw^r|r>V>wh?b+

IJir#FN~1oOITx>vE^T{#79(0U@IOL|*cwv9|UH+4H5-81nNuPRyzEwZ55FVPo47VExr7u&784q8$dIi z`71Z^yXY2qB5;cZ-W?Wm|z13$b{{cVvnm0I0OJ0XnK-5)L1r_x?&1%zR3 z9;mOMNsn~J9qXtq$$``9pqGeyg{F$>8E%Slp+bAWX8~lQN4$5Gba`iu3CZE(m}U`@ z`++JV-@^~AFKd^yj}FF&I{s(r8ai_DT5O^9W!m$wNu*h9bhn-SH|d4U4|VyKGSe^z z$gpQ7k*Pprj8!Nl>50z1R*d4y23xw~B6oa(sYpIZ=i20Rv9g+E(d|Zp_xaXX@h!E^ znrp`-<;HYs0?&-uR#|&6wYgqiCcePfK&%pFhKyPzCY^~_Fg0X_=wwAAhC4;kzk`mA%Z}nfkeMU= z3iR}u67~hE_J+!|DyY;aCQI0dK<6ns3-kef`&rP5in5@CrbxUNkl9oAfDYHU4}lKR zw;MszHSAeXrJ{aNxxW2t`1UoB<$GjFkZ%*nID_60ZIZW|N<}Fw8KqbL&({vZ4$Hfx#J8un_LLqd5_U7$#cL_Et`AY$p15P}t?93gK*EG3kiq zL>U}fM44u#LzFU&8WK=umOQ<^l+g?#l#wFrkTNeRJ%loU2`OV?LK#Ebp^Q`^q=Cg8 zOc_6Pm}w9d$Vy)aF*+aq6U1EO&xN9U5h+@Cv#4Q?h)&$1!kPbJMclSuTUZYR9$dyk z+a~BEo84bi*XpXRaBG#`+Jy_+39eb2t&oX2FL446Ma&_~Su8P!l(a<8GSvLHZAiO# zehu~{L0-b||A6@L`=!p}rBVuW(Cp^sHTJYEqSUOr+O^@^+ZKb}+{$+O>1kWSk1V`? zM){>Y+rSL?=(a^t#PCTJX0a}c1=80AEeCnnRN}_se0@fD=MWnre&3oxuYKY(~aJmibGEwDHjB!mSsG> z`4-!Q)FM~zN=a?VIFtD^X>I>;Ti29kv8PTg^;L@y6Qr7n#m}nD#WCV!O4ju6k@1AB z#+N*^(jzEu=IiQ%!cJpzKW~;;@q_Y(GQ)&7x}FlkkLpdErF#V5>Xw4;!0Prm8c)9+ zQg3NXwjCRVaI&9CM)osG%^f8zF3*aRCJUXN*x$58o5j0nm1W}0KGpU%(wI9e`uRiC zpC9cE#guB}vXO56ULamlY9kkc?jhmgg|z>9*}TyH zd?`8^x(%}V7L0Q~bfhH|Co||W%Qh(?^9?V&4Oqk~ErjE6Wvg_wiYX%7rGta*5}eA_ zWBeV4ZlIL4sYND&iBC8zYR5FV^cW4ye`PMa@!UCME|9T0%g^Xdzc_n~MfZ!J+Dw1j ztRJ?o7}58u*VtAudkoo+Sd3v`9mE*1<*y!O%i5KoNxHPp2fatx-7kTRiC+q`&4b8V zZS(M3kZm5G1>L2r_Mbtvc^FG8*tXq%l&f>- z^Y->2kdIv->kii<(^?d@UMJz-ck$V#w3GpK#>K9GHJGRU?dOF(BU4c3A_ zs%Urm;t!_CEIA4EVGXMReM`g6106nD-d+MaL`&5S^0z9W6SN-R48zzKG(e#?Ff`mk)JH?j*1O=rGgaBLsT6@vyyeo$*BC<**?JTL#u;65Mr@xHb`sOXgo$OT z{&kfKuArX5QlZO|tPsO2ON&XFW$6fAmUI<~uo998tOQcMtEy$IeBnhqzcxv8+1m6& zkna>KlUrFyhCOXAf1zBsJY{%hd6IgvJP9{>d1QHN;MuAlE=VqkhU2iUo~PW(>HM|j zsR0yBrp$EtMxMLdBvh8C=0R`UJw`6d%;$x3@@L+B+eQhdiCJ6ng7pPU zRNEgQ^n$zPIEuvpM?YUt!neuC!o+DRy32`tM?dpd0FB2mSR~2kmCp#Xb)eRo$OewWm!Q2=;yc9pWUzTGemcVHVu>;g;H{0aQ7O*s6Oj$X4BX zAX{~>2kob;?pHvz(n+_nRd+4OR^5J(t-7+--ma@qjB?tlJ04`K+G!wL^JJQ|Rag4% z9s0%PAX`_j0ofO$==`?omV@l=F(4~T706cI&w*?WoddFO9}L5O6^8v5WF5H*MKw!3y$Qq`SWyGfxPf`@TuYkde! z(3oN9TCLGrUFYB0##6lR|5I%|J;?s<#`E2cr^y5UF&j@A>P3rVB3vBb-FW^(HlF+I zgt#jk&$UxzaoClO=Y9IcKikIhV>;=}#`7FS?`}LX`0^HrfU&)0+bE~?5!Q8FS+?HK z?-u7LcgUOU?{-!Q`uA=$KM`4uB6|QrWy)xKccb|a-e{IFP?Q;eM>d+PVd#odf15X& z7Y$AS%{H2=sBFu?s9oP^jv=4uMze!4<9h$y8_m-xg}>3P0TypGk02xz-~MmkX!eiX zX^Gl9w;jELDa**GdZ9?UmBirQ3 zWo@9?p{;rxVe8yv-D>Pmm%TS%J z)N?=|QFIT;Hldq9wh5K(sBJ>Wuvpk8^gxhpLXQQRDBygMZAU)|vhC<>kZnh0H)QDl z3*){0+tJIlW^eCyRK+5QozJoR&3;(XSx`tV5zlEj z5CJy2pLWzQ60~n3k_o-uh|kr!{5_pSOjb`VZz|8!3^d`{>T$Pa{y0_9MkSZ441Aq| z{y49Khh+EE@)61AdsgsqtZAystJ3)|H|`loeD0w~#^iXmc`lw>J|GbqqY>_*N5s5X z^5ieAB8lv%)bRuTCCQEviLKouoAzt@!|ToSmWb0Fj(hwgP2P-X8jJnYEb;t8xT{M| zs&$~LEOGom-&M3QCHg(-#+=qY$UmTy9B&Dyi^P04XR&-0-bs+{>`84DIhFJ#3Y_|X zxJBQD?&fB>3&H1->b7W3q0r7Glz|AZZ4)2X=DsU&Oh7JUI#^#tKrVu&Zq;%W0ePIK z=-YC6=6ea}jH*}jLTu?Py@i=i>ns*B=dzv1Jmo9DbgG2uWB;o}$B4f38A(3nwV5pa zOnz>emNvDN8n58rsVd{}EG%c5|tv@-=r@t;*o+T#ae0 zzPPwwVNJVtp=l+ss5?TQr5qHml7nJU&78R1w=C+6=$4xyi1c$C6m$p*A+0|SDp~8x z)zCZ9`s;}H&(!+Ci2Sh7BOmsOx2unA5vs^!>C@}CMz4|1;zx(ji=|=cXnF8|D80h& zG;QfFlGVFuqL5~=BD9X;9UaJ=#Fsh@qx^BvJP@i`JF|UlXqi-YcoHL4BtsI8Og~{A znJ{rWzDiXojy4D8OCzZd>u)@xDa&jT4FB%bQp#k@3+nnku9w%57dhoj&|Ns?OmNB> zURZJgC!L~gJ^1iFD)#Rg?DwqQpSOnjZhZySwlji{fs76LD#%!(rJ#hKCwGFrqo>VJ zg=inz!Ysb!&O1YLU}~(>Opvj0V&`ORoXC8Qjr%6(1!Zu)4>C4RW)5SMo&y;Z6@v)I z#+8A#=oe!_#;6?(vfRXPx-n|UgFd2V76oK0)l`tNT@4_shnyRj&C3>$*}RNmX|*qE zK&8yYrLi+Wmd7O^t5FtYHTqYO)#&RWtI=&Bt5FZgYV>=M)#we7)o3>shQCafJRFeK z=&%qS1=^}_PYA;jAS+7>Wc584WcB?N$V&eikk$8#Ap7D*3Dfkx3$oI$1zG9Wfvoh8 zgRJx~gRJ!LVScmH9|N+|p9p$I)B7;UN_S%@=eL^Hw{buKM zG|1w?nieTw->5yS_@spEKbrPJBSLO7P3Tw?d#f2;2QyOobj*;7450A5CDgV^L_@>4 zOQWH_LdEt{=#0j-bZgEobH0UZ?3U+ewLE=5?(F!4v-iu6qD-??!@FVY+K7wa_iSCe zb3T4WZz-_84Oy(fFQcd~HN2mqn490DK}T!ri;D|$^E(w}Zhp@LnVa7WK~)-W7RdL= zHOR8e%`Yp1m%^eReladtL0(#I?lSj}sm+G|kq$0Rx+w6>_$z#$0x; zF|o~j!18ngKm5*D<;KLKl@bgSyObZ^su>Y)?_MF#xs?(u{M&S!tV0Ud1zDaWs)bQ~ zJ}EcK4XflsSxeIqB|J@SM{B9v1gyCg3OjtU(4eqPLgj{LdEQa_j}mE6`bLcIHu;|F z`js=HdJE@LJ+UWKi$B-vXq0E#fsNR$`i?3meEPt*Vr64ygZ((y3beDu(rC3X-x2jW z6#Z3ME*`4SMZIz5JEbgnZloS*~aX{f>SwlT$c$YH?7=E|))oL`BJZgv?mX#Ie_=NS5WG<97Yy5w*d` zC)&q@=9h@&>U7glYi5NW)^fF;s$xozs(K+htH?d%Hmk^$zM)20Hqn!s9+^{87i4l* zG{FDO5@V@gLTR*`1`~>^n1ys{YanKA?nkruv8kmIR2Z%ES2jz8ML&{Yrj~Yl8%`}t z<(cm#oWW+h{>c8=&)iHJ)%~29G#(z>GA4XmMptba3;EhC!Co}M{Ig6FA3XnPjyswk z>X@0e`h!!JX|bs67^7M);RGZ#-r)rFJPgdB42)#mZSuX)#7JSUFvEaG1yp2ZxEm*x)c#b{>?TohtZuV^(EY4 z7YuWzxuiO+POf535-O9LZ*?oGoD6^z8KY1xKce}TDob%m98MH+S4%&U4YXz_A{)_E zUT{wnK`eVH_ige!5i%~>K3TDHD_3anO%lW#VU_evZS_6n;Ovza4;LwLAqjoRCGUF}ir7m@>-&|l%u^+|>+(5khOOpDC{!gF}sFPkH zXew>cdB=1ILx03b<_^P;)#iP{v*=di!2~go1!{L=+w^LV<_}L zfz4pS3K^S0;|n6gGirqFt-n*6Cn+Nf5(EuomVu--F_PAss_54ZPARShr%-uaQzFcV zEIu$F=r!9_rA5p~a3|S}uAVPRdk@kTl%ervl7Zu>hA}BF$k>KYfs9GH3S>-5JII(6 z@q75xWLZGJ3o<6*3EH&y zg>P>S-^z?=Z?}bS<)p^gl|w*h>au<$=nO@&?VqXJw0{MeUGMimXX{(Jz4sG}ehIo* zk?0WH8Ov6Xsr>ChJ2dNCQQXfdIv(_|icSIuAFDUvLXtpAeJ|C)R7HEQ^D?!&N5~=dlif#t|fr+s+CW;Cs!ud1kZ(340 z12S|F=rj7o;h@t@L;`wDPm*o|+1;zRf)1{g^zH`Px4#5krQiMr^tz_}hYOeU(>ki$Fm&&l=x-I;fps}W^+k6$FYCDxBUFBeMxYv((1jS{T0EyvL#uYUa&22 zHg(3fbW7*qkvj|L;2n8Q8Vzl)mvpMN_}lewQ$@%hign@-t35YsRi# z^7p>7EG2wLWfyfFMoD*90jBh>4LZh)5{~~J3EQRDlJLWtaN1i_=WWP%zscm&oF;Xq zy+_jC1KQ~iAkvdMYK%-y$8X&H*>Ns2G8SoOTbFZFr`3KR;{HzKI=8P4$(oUShc;pg z=?_qUU`k|@+G@hooLPv0A`&4OIj+ut_e!g&U3ustRCt?-nvQe(ITaJd`A+IlGBcLO zUxq16;{2}NNz4{YSvG&G#ggW?sVwm^|86FDy`p?w@2-k=qT#$N<=p-f#^>pp4cz6L z`(Z^h!EXMtN^!}RfSnWW(iz`MD7&|geZ?rSJmWnmugeD&)XmQyL1B|l>M@+lj9hfy zfOvVmUtDTYaX)GC5G6voLN#3Ru62GF6S7~GnINl*2qFqq8RkOm){3P>k(;sUa^419 zGu0oKX0r5NYI(Z6X%x?APilKa%6YcfG=4Pgq}DAfYuc@Q!~}O>4IhlSe8JOlr#3G6 zSdFr!D?Zo%9&j0_-lZ!p>EFF`Q_0p173E{5a}*k@^%hrbBR?TR{i5WEI}Cvwa;lb7Yec1}hFi7zEeNEy4~RY*hm zeA0X$^s+8pqHOYBx>srJPoV!sB4z)l5owx?3SaNy@`^rs)lw+v9Px7<648;88c2ID z)p?t^%`D@+qQZ^T<1CQe;Qm~46`Te;rqqkIi|QWtPUmX&%2@2rPCPsRG(p+D-JTw{ zIs?Cuj@|!7e0!ARnB>}0@1g$vvknfqM*o5ZKi1z+wXT1Z+S0fe|N698IiJ=!6T6*r zbi~edL>C5b3vW!*ItbT!!K>?d`PYtH*KygpuVrJgRk@Yh_ItT+&8vHPYu9WZU$WL+ z;+AaWmh%@gUfpwU{$t0dYaX6+02j{lka`>k*mA<2dc3k9efKA~cE*F@ zHM3{LF-Io74U8}d!kf~j!x&pq!_pO}_n!_HLY1ya_Mfs!B=5;pDgO3P2qVqxe}5S1 zll|{m^=XZCDSru$^MO;_xhOfZJBg=d%8%~Ai>f>D_@AAzO%>&}-b0yu>SazspR;NC z;$EqL5H0mMgBpiXN2Gcdi6V`TRvDd6M{16EWMiWHB?`CcR;@MRH15k`vzBKkz zz!R`zrLj)XpLJq5m|j(@3xODF#dLLj8D!JODeN7-uG7YqAmbMnfNTQ!87LH!Ht@Bs zj!cHW#cbl;vGb1{J1i}kf57-D>1Jp5?)VvY{EX1?^IAB5WZ!P%XLdM#+QRYEv7_n-y~z^}=Or;+qWDcp8`S zn9pSdGBGBh#kR}^{FhBY#azbWq;a8cuG1i!IIad6zwu?zJIZgcZlq5%wu}+*L8kg0 zvt~lB2y0g2vu4t-|3R$T@{m+dg{1oHKLe=-Gid+pq;kD`{bk17f#+xagfX)bQgYt4 zjC1uR(Xo?yybd?5EZvDZZ=1LvMCkDw@eGF>fx3mYPRFHlI9)<#wrXqg<>a_n0*>Pt z8EP#19o##Zn(umJGu}ttS{X4K7568p4zvi81CR8{>3rHtvVWP5fP2PjUl=PMP4aae zHV*N}g`9P~>+Q=9c;KVlkJKqQ!*Jn>36qg}BnLJa`*;J#NWu`}I%WrOtL)yzuoSAm61EJ#<2@ zJ$UG?yAa_}w!ZiFHuCdskb(`& zbguecnV|nlx4b?&?My`pjRx_FE$%WuD@94(CB>v^MoXclgoQdZEY!GR3pKJIs!D+n zSV@6Mp>t-c=H8%GJtNanvhPXBct@K{_K7My!OWc~rxhJ`D(-Zww-y#pHgf54-9l~1 zb}9AjAZnh+_*g1J`eVlc^I*b!}}rVo64m<4KfLImNFfzVLt*H=XMv!reg6i8FFsT zd=zqSFDNgF)Ny(=G-IJ6#EJNwMrK&f5`-kf>G&g?=sJAqPAt0VYd7v;hPIqY;5f9r zwKKcBZ1u$j=`-TVnZd{Y9{0L>IgbcT@TK^7XTn|IJIVx^)InV$BSCEA^=jq!puSIp z)znLBsN6PR*m0Qj1vclOkI!s(ZpSa~W7-E6mAC_4Qk{OO0oBmzR9j7CUEF?(heuQF z2vgMCSByk`+eveimeT3a(j#-y;_pdj{)-{i`hRbGwYHz)Td&qr+pCtnC=&GHVDoL0 zAQt3ubmX+RZirNlont7K(<_CM-O=f{_+5j8+sjd_QXyDVg`29{s=_ewG|Z^Jy+kBQ zl}T0OT7>GA96QdHLuGo?;)-U{mha28I|)aoA^G_u+d5|^9rq#n*Ua2mZ-{8@XDS*K zm)y)lk|n*Z<=%Q>#>BhrZ>*I?#-2}BE|Mip&uwLADr`+c_KNjHL?8uIXeIKqjfKG(%f9?$>2!2JM|pe|7VE>LaI7j-Q?ExDYUX%dL7;cbd)^sY&-!eKC>RUOk()H5=oeB-BFWcHx)^tkCGcWsJ zFPE?F$aj#p=E&C(Z_Qh~N}DFMJoB1;UU#d|V_%JGzM)5}SDUi-tz9D}o7eqp9@^z> zMo2bq*yl8ss)HNh2~Nn>HH1NbST#7+u)3>3$(*Hz|3%4+`p5L7GjDV={s#- z<$0JR^7$6l-$ZJiq()b?PN>;%X-l2=ODV#8>b%kl;T!3Y_`}1E|CkJ?RNmR#M0a+) zY41#KWQOw-w=rTs}qt*|uvQy6idZ*3g9`X*Z)70A$9<+xctVq6$V57Hw{ z7xV}d>4F}it6ySvD+XdIB%v@sS6KZRc6lrm=`6%v+bArxFVP(NL6 z9cbF2Du6Mt;)u9zwPl?Sw1v}Xqu-Sex66ZvF3kCp}eWn;8%=GR+J%cG%fT7$u%{%JWKEH}Lz zKRr=pN3)7-r0v=Ktzz@H%#9pnwaHn09rrMafc`1j^`SCVThZt*O{^db=F&_uvKzv+ z2`y^8BCAxL3BYN+k2Fw?EO8c#Kt5xRVA1;7(39FsztOHCri0I;nzaSh$Za1cG*FH7 zsbMl3H`gY_2{owHCa@OaJb}9XYm1RXL6LC&N;&hdU9?hyQH?COx1nmJEQ@T$R!TUH zwNWY0#xpPr^D`f$8hNz2{|pr*H|#(`a^42lyQx~T7_1Gy@}Cw~|vRV+9EAQ_1AGjAnKjd_{uvc@KXUzLOK+ zL|oj`wahgu*m(Mm!zLWs`s~eret>%rL^bU2^e=uUU-EAz#B2r9KDU?dk*VsfbCy5A z(P6r#_sSRQI9nHvEDhhci8V&appt^NC$ij5a&yIILOC&L*As)|)esAV*Bw?_9C!sZ z)s8BB&my^a##A`dHI_7;S4!qDZI!s?sTPM5A5b>}P2=V4HY|VOPrzwi$v2!o{YjQE zzTxOY*0H+a5(qYRNjTA}CxnjPYQt%W|H;~EOyH<=T*u>NUImf${rHj z9wR~5ng`{y$4z#>9QY`Av``ya%#5(Xd?t3;US8(8fHM;Z|FT}9pNZ1KFqgH6lXR)) z5c$(i2euCza}s^hSh`C<#?lE-U`mzZ$uGPT?j@g>$upDdY7Z$W%CA0GS%* zo>b3-U~;5sDx61wj?gbo0GSHssUXX(;5GRw!tC3-K_)hn72i@8yJma)K1gP7KLE0~ za@b=koTr0UD)aIw&`%ZJ3;L$Ap<`hP?ArrD_H7$zlrn>2H~DM*;vi6&hFt;L%f4lP z-%Z0l1#&cO1IW_b3&lf29|860+w(!6R_61opvx5f5Hwm-Sq)mRxjhhu{U_+>8n!8X z`#gx_f7se1Mh8sv@gV!Q7Gx~(Jdg<%|20Inh3Kvj!SXiJU?C%H>A>nWL_@=CWHv-Y z%_1 zK+ch_FDi3bzu`hznoQm(w-)BVUXCnJmMa!pTg_N~C;NUnuw=>K&|VgcRWFcH+_YOT zaXz3cv#{nDDN%=5Os|hze0&H6Hl^ARfqtNEeKyDxUOxpgmDVdlG?;p3Gb;DpWIVSl zb8@;YTULAW$ZW}q5nac3nw}fwN3654*4Q5Ix*3PWUgOIgoj&>Ovh3d8o+tCAUinaY zK3`G+ehV^S_}N;$>-AiO%_R71WCokv1#5J(?7dpGRqOA1UtPr9?A{UZVTGIGIJ0>W zKFqnjw&If+XZbp?>$NN)wmwbpRsict)}7&HdfCI@-}K%yywcv8HJ9n#aJ_OjT$;P# zF4Mc=*i^F&yH4%>67!6VmlT~3;Q^0JdWkZAk1${Q^&^;+e^Ou8#03pm?rAwGlRK-d zdun_{f4N-JnDNr((ZD@YS!0#2(O6=237Y)!d!9lJt$X4OFMu8Kwa*2GS; zYQ3I2nRhrK8mM(@*Vc0NjJ)qZplU$F&Vljd zo*Tqm7c}9V1NY0Gu35q{BJK_gV7FUygOYsgWyVs_bxkIek}GPuGI=hmWqCpx@83VO zE5^Q+nkD+1a&#k7P<;+JMM1#&6R64gI-r+Wc>z$Os(q48;QmZCSK-qcJKxljsntP=Xm zU1=xRj&)I#?A)_U1=#e<)3b6s30Zr<{+r+GW`g>k7Yi5_v@#@VjCEA*uW$tOYH*ryy=sO>+#bFsJ z=OOIDZ)oV-s4TAYSdmbN+kec2bqg#~Ac(0#_|vutj*4>zSu}Ig=DIDX#Ih%Zy)eZo z2>)`aM!4{5?ThVc2*Cyjsc@bpRy`W^T>$cX>cZ)a`jFwrR$Hz0V0|0#6W>g=Gu~>6 zlF8k@h$l-k_;zmbx3@ORGYvJJ^N(d2uS4D=5n5qi>0I2%k)xL8(*W6m(w4IhX2rXr zoj;eOPwjN*E_7CC3LflTah@_%CXPJX7m9PvQ`op_J*(D<)u%Z8sz##Vv_44%0%D3( z>pMJ~RO=fcmJrTP3AVTGLX>=a)utAqSx*+TpWMjCERtUk&IYjuCzldG5PMA5i7d6ssQb?ne&p z+_=U|wZkjctZ`be8$^I>_`(QqC5R~*0-#MF_9v#fmBHwE}h*j&E?0**AE$JYK!m9Ojo?TDNB=Q2a*v;RhDWN89&6l6X zz|z}qRd!HFkY>tjS!gJ^rb0i9UQ^+Ebz7tr<4T3dn__Bow_QeonB3qo)A<bicA79lutEdI(_-mxLpPnJj4+ zc0X}H)9fMswkDddCfGL(il)63*(4YX+6*X~GbmhS@Rih$^wd3`_G?)jA?yG{Csk?p zO7Y0)RoTD>=<4e~Mk?2Qw-Tvozhv{>-d4Vi4i&n%4`R zpi%0&vkP0=+pog=C>Gb&_u7p+`5{TrkA!8>;qBdE6kcdlU+b21;vr{ECSQuN}baJ?;?F5q&^wGYxnyifBzXC@u_%l*_Nu$M+DeZ;${*{44oe~vK;*DQ zM9i|9Gdb90#Yloji)=YAL375myuoeVeh{lU*PAOj`b2o8-Rdpn=ois)8+O{?S9_VTVEv6F^S^y}_T-*mRKjA3_FP4W_zQvKwna6 z!RJ6GSpHX#iKo8<8kj73h)11IXgu+|G zdkkddllHPyeh;$pi4T{7xYY6^pp#VCyf^Jwt6_(Ll$-^6RKF14%@(f%bcufZyD;7}pigO-xYx6I4%~#rI~HW=eGp{v7KLFq zhNu%{<@+t@TbkZ+Fl%;9Q4cCn+0Dm6rcok-Z+m-iSy1yMLv(70T#!-iGa#e=Jdn}; z%koxRYYC`KY5#4I(f-FEqx~w0H(BU+H^^vzAISQ~Mv(Q5XF;aFvPIr%%B8!bjiTrW zAUiI&9c1X*@kNx^LwLMD4P!@C>N@Ej2Ca|swksG3!A>z!lRSn%P?H1cfG6-VJ*H9q$|0(Eo;j34aAK3Z@lXp zhK(D`iF7w(jz zz}YzG!RO+*07C_Knt^hF$d?f=S0iz=ToH>_y9;_M<-3|~P3O7ZdE@j{oJu*O*kKl_ zSHkcmecu=do?L1PEvQ$_hTq@RL7h+d16Q5j6EyfKT2fh2)c(?04KmLO zF33D5hydB973l?rh!&OT;@;AsA*6%cap*T%!J&QV@oVwY$%?wcC+=foK z;Q3~Piu+w7=Qo_nT%)&4N{5Ty)s1LtCa=WFXC+e)(hE9=msy>8h?t-p*>G5nmNx&V^fB1|^kEq3B<*DdgG)xsM@q-2d~6N>+!S)(V#& z_%&@mgt)C083HmCy`Eo}2-Ep}h6uhsCK^KoXn{i?mp`v?g&KJ|5aipRSBSqsss40+ zWdRu5TG0SRf04?nz;JPe==yeBI76|uqIqzHb_tMF2ZYE)}v*m#Vw+I6H4!KrD2((nF z=1YQ-V%rwe+eJntZy(XWN9uSC4K-?V>%AkJ4rsosqL&ykoE}nuWgsnPs&#AAv4a!y zV!4HK56O1E@$@CKh;WY6q~JVsK`M;pTWzVjxndL9F-Y_^jVRIelXjKtJWDGuq-4*5 z{KRSf8_&+|U+d+$^^vB%n(yc(e#~jJc-TSswhmYo2>We17a@EnbYo-Dsg zDmlLTuzsX{mb{(TV|lhSo5M7^yyw2c*%gDZjPZAP_cNb){EJYDz2}V?_^;LEqdlj^)nch@n<%MWawo zh?xcSBt)r!pE2?iR=EU!FGQUsQS&C1~CRxUTJmrh{BhmTF>2h;#y% zUrv2eW29{M>0(Qfl!Y$~b8A)CN0G;ElqKk!F^Ng0Qcn2q)`~cwuIT z-BoyYa;&W&OFvCND<^)#7SiOX2jzbehK-W*D6C*wbre}RRZ`F(<}?g6d%r38uE9A1 zg7ajqJZS{769FX>{~$M{l@zL;!19bV53xlw-zfZ1gEm4{XFto_MomM8{`Hce_mvHj z7Mj_+wS2KGmYpk0W?bxa_{VYD8Z6%WOEPRZatnGTrhSmfEeO8b-;1Bn z?&{K;pTYr&oTb32&kEYOnJhDT-EWB@VS}FR>Y<=7x(-Hh6PNcyMlh*L{2IVheILZ zH0+De%x+7qXv`*C21a0zY^Ha@Xux6NR7-}W&tr;m>q#_88EelVh>cm^dpnQBDKMbWaz6j5A&eGJRPo%-#Bhh$~H~b1%qpTL&_+jri#` zzWGp)r6M<)TiAS%<#7wh1UTYb-NbT#0DVV=I^vGh1U*$C3;Spob_vLYc9(&S1~-F@ z28TkeiE*jhzkv=`)C2mRrYu55EAtkRQD}G838PRo$S5TDeHev40x}9Uf~@rIAgkMt zK}Mn5LF*<}`&W<&wnnhDTYdKi8C}FRwK*$If_^haQl17{ zSu1Ec=%9^m(ljq3v|HFx?k|P??9q(0>a;H$_9g6@(67-eE$+o!*_YP;zA4NP0F>b&rRC zAHQ$QW-0zL(c6P_{i8*Zb@Ucu*pt^Qj(P1t*q0U_WWUZ2n-LZV1;H||3MNO8TW}C5 z-*TKKh4j6M32q8?i;Vp>zevWW+hp`5NygP@kqEgtAnYfo!m> z1X*|L2AS{U2SMw#GyWQMzIMS)pvRIjFrEkbDvm5t<5UGUy4jVjMzDpfLTjv5S-(JS zOsuPHlRMzkY%mXRN?_it!n<1(R+X`7jK9+&zDj%d_Wg#LMbFh_eLW&_;8k#y-z~e{ zU^U)}jjd1^Zi1ZyEyBKa8$XQu0w?=70y6MHa&j#jTe(SUDG@?GHco)wx=cHg7^z6) zpue?N#2`(r@KXG;xC^5i2NrE?g&k*OE8)7amEKqsAt3>hioB8aelsQ0jHByaq%;BV z4?V+(enn+tD_i)X8(U3$M|;ote5yGYZETARNDdP%hr-5ID!0Rp?V-aa9wm=dzEDry zec@LN1}W`58Qm&1sO^z(-*;6sLj&QG7wPZKDq;!vEM?{j$;_(rUXCU+%XVB_BpDgX zlFU+mW&gK~U*(P`(ipZ8)S|f21bpLl&d9?KvV!jdPFr?;l6I&5F4o<%^tcT?-?1#{ zT^X!t=~=>S!`?ZqE@0SQL^_v>_PuH;7^x++fXZSbzR^H7XZ!|KP|Cnj+Xw!BrBLFz zemc#5I_IF`$CpDH4u=El22m({D0t>m<)l>%19l(r# zvF(;4JaGeqVLLqWFf!N(6Put~#=u<+G6wEvAY+jqRC17PbSNp zFRP@jH5rhxXjg!YMOzFq7VSpR&-IIMgN#L!rnlULv9(oaH+r)%tb2njm5al$&wwnC z9LSh8xk~S}xRmAdAY!^NqkOIg^7}84pRu@E`iWt=i-BPN=D%zCQ1tFk2PVU%6SZ#s8H~T$v;e#>CCYy_v80Q znW!)wpNXoQYq3IhX;qlf(4bx7psc4~K~>%=2i3*5#zEZ=>X&)-EddqV5InRF5^bPpaWBJ2U?z7KK@hQ-PDxxr^YOdip*= za_z|DT(jTNFHGn8}E z#COCwy~;GDRW9P3iVG;bndMO6oTPF)}o$VUx2EfhXl zN+Nu8kpGdqE__rvB&qy46}5rekY6m?H^yeV*GFX;y$25rQjl?atsvtUg>!sFzxX=H_{C))%k4)X;}_om8NVo;qor~_$ijqkv^>O9 zy77x&0$Dxo09idA1(~?=MbLA~2g+9bkhqk&0%T#QglH=0K8^R8Fid7N3)=*mq~FTr z%10>rchFWv$I{|2E4mtFBEqkR=n0TcW;cbSj!NQBfXh|uN$$x(%qAl5B&q86Z5f2Ct+ALn@ zeXpH2B1K5Jo>*8;TH~(SR+_2V4xQPi-iaXu(_@f_obUUfQmTv}XIdV8dEoNGC*86p&K+BEVrL(h zQ^?A++-7K&<6>1=saBO=rb^=IsXATrMiXqvMS5s>td=a)*eMSjD2BmWb{UM zwIxhx6YeA~(s+7{++5?UKKj}z^S8MLFUiirtWw_=S1AY{+AgQ8EzfPKD|uaZ^63qW94$5T5g`M4s^y#)5QWKcNB|w z5+7I6F6;+UtP|ei5N$Zz6<}U>4&iwk%^y`7W1uM{jG0A17#tU1h!GHGYCsqbmNUlp zrfa?>C3V^^q@{z-Vf_Jb{z7^&;A{|Ww&~E&X}yQC`BtH`gbS0pH~J1EA2NC38homFnHK{MnrG5W$oek-JoX_ z^j5#9p9M`?se{e0bQ7KJA?K#G)DADx>D-)ZVSQ9I9uZo}xE@w$r3ts|JTS<|cKh~U zMTAU4V)t+0opn?c4H$O)+#Wt;$7r7FugEadjZa*%!T2aqkx zvNs%~UmOCm1zMa_9<9eA)nOPa?#&b;T)1}EZ&=PMqoI2Qp|hf)WkIML4c$Fh4AO(ngzWvHZOIqwdq;f{rdYay6e&wLgSnVXp zSnbb(jMdJ9CQK1lu?1wT_7;$_)q7A9W2VP}jF~RZ9!45uxb+Y{-0o496^dE0n| zKnTDdDUxXB;!VRd3nx&5LCk`fQSBPDP?tNdZV0pByUg23W+6xQ#YcU$`}Z;nB=A<4 z1##3HXc4|SpFkJ5yuwX-w0nfYOiEuCmr?1v0>@DZz)ql6Fb}o3%45}^Ui1OZk{VdL zXGsIFd`=JATO3e)Oan_qUa?sr+RNpcopB&~fZm!IIt*Pu$YJQ*bUwccmcb?i@hgbG zP|PoH*{mE7VnG%WB!30DoaG;`r^D+3f19r~Nsh>Vt|!d&V)-(buF<5O)@B}puImQw zLJu@1YM%o4^Z?O}d%6I|spXmqHzpnl2C+=?4gp5UG8wl~K0LPp`|2N)56}#eCac-v zEdJyh!pR_i_9-H~v>0$mPh@<#!tczYOF6CLDA4DfXe;BL8ZzRJYfhQ)PO$NKNey|Y zMbut+rzx-(a@NP4)iUkW_x=CueG7P0)z$XNB!mzGlOUHw5e7t!;3WcT6x4(eJOdLN z5tMo(Rm4=SMNE`>BN(Dg$I)oTV(SH4wb<5{+KQ+}!lhgk6|Jq<+DhxCVzi=FL|e`O zzH6Pm&zZ?2Xxs1W_y7NQ9>{rTpS{*z`?mJpYu^s``%W`W->HtV`4{_6a*`>9h3qan zPt;C+_iBvSd7AkJI!~E1dkYdmQp;o~PBDchg2hSHlvWr5^d_Zag;ouHE0pCL zuVY2cYHUheAx9l-I#zOoWHj-r-LV_kue-JLk~k4*D@92^UefD&W&D)MaqEGIp{|sh z1*9v?ZU=f_T8{^SbPd@KAnmRF73g*OIvT02{k9gMUea$HjOwAiuv#GXcLC89wsSP? zyehP}1LUH;qg=;rR7Bgk4V2N8yZ@<3;@zTUmn^Q4Xp}DDQL!5^UN(k+WUI~ zNY`y`v*@=#`v~WDAng&p2c$j1T$oeTZ9j|9H)Qd$eZxZ2-($X8S8GBk3%V8=zx6@a z%sobXvLbujmapwG&JS|1epC3`wPPug-C4+#mvvW}dY5-2ZrZzC0_1lBDaEFiQv5|; z*xu!#_>I0_8D4w<%K;a|i|Jif;J1`dpOq{fF(&U8E=mCzx#H2@Wd(kLSFPs=I1>;B z1-(mt^Ssrmx4FJIcK>bfQa-f^69}V{4<#C%ge9;c(5mjAvF#90CwS&o}{Mx~c z0BHxa6i7Rm+@Y@>%o~BUgZT)*N=44x!PKNhy+WMF$oet1wqL*+#GYPeYY;bF*NnQK zhZaZI{sU(pW-<&_LcX-V-UUeb&)e4<(DdE{Qnl~Q1g0NGE~Nvv(WZ`9`n#@mP|b~4BZIr;&fvka#5bz2lBLk&pHHq(tnk8 z=rly3d+X3qUI*v@3+oVbN_!atkO|uE{}@QyeID7NCqP#NX`kWSK-yDa!=w~zfRti4 zkoFI_$U*x8hXHB3KL$wq0^Gi&Zt2z`+XML5+xnE2+P3vBqHKErUR(cPX&s_!H0^gA z!q)c5HipZoOzp1~`1QZmq3%p!|32%`p;cWq-v37H5Y7$7PI{KaG*ghcyf3SkV1FL- z4yP0X2W`V#>>Ge)p;TA{&{zptr(GcgS!bpI=Gt)bdU7h z76ZL0!!oWGRpm%)j3RF1*FoFGKspHImM2x6R0*maX#&zg)~_u3o&5?EdO3oz%1nnS zcBNyY8V3VpVXY1i2KdbFd{vTnguLCOAj25%bO5ZUdoNHNk-w%mHlFSkMO^5Wyp89+ zFTTD4GL>J;zueHPGi4ja)tVnU%LemQEzJrjJ3RTM)7U$B9z3nPnyAx(bi{lvkS5mk zK$l=#K>OkbUA+;TYTS5{D@V(%rPa>aEDFI>#;Kp4(ofu8L356r$pQn< zOK*Y<#jklj&0a`qxtGIDJT6Oe(20q-iSNocP?m~ktO@Jj3GSLmi9PK-)^s3n8g34i zb%%k?8r_{v7Jfw16B$G6lB6e=cX=y1Du8rF$5fzZ9ZMv?8Nm;mJl>js)F|;L-py{} zljfaS4LJKH3%Bp#&!Np9XEhAL7l{FM3#R6A-V2V0FXV)M{PN;<9Hg;7xI6771{4~A z%Yo&S(BYVx5axcNUFH=Fw;1+}@&;Q?4;B$b2~o4LIs#mq(M8U2VnDA~63qbmv!Jtq zUJ-OY(943Z2GRpy5%hrBKFqxJ@I$K8h2EQeN4oKhR>g zf5qatI6X0#NQ@L>SdkVj$)N4bpzfmMr}ZJ=uiZhEcjswIO{Th{Q!Sbgq-ys}Q84Bf+)(Yqi`AvqluQyK+$7c+VE-^+O&EF+%dd+1BMizKeyh! zKo^g9VD_aBta-be*0t7}#C33!gRwMX;w3P%6=VP3R zjs}(~u$9G{3e3nq2BAFJ8qRQ&OWN>TV&2;POcoRzQV(Z8dDn|U<>5{OoMMa2p$Qtj zjf!Ag8cJ}og>R#VUc3@EYJ}H*BhJ03*u62UVPf+exCUj(b_64B{#fZZBpGa=)z54v zem&2V4F_X{TP7h-s6xH-T6B>E&THuj71B|tTdOlJadxj zyT-jd;7v)HXJ}%Hr^d7;HuGYSVp&;(+uVw9a|mv8OP!oqQi~MoetPDg%ZCICtcZ=C z*TdV8bC{gQUw>-mD*WhFD)-e=xsScRA-w2p2xx2hFWiSrcU^e{{7DWus|C%!esz7zQIt7qg}c5(w^e;@D4<2Q_CLwrOILV z463;0ANb2NJMMJoc~eUsUhiT=YleA+_$?v%13S*9`@d+fi{Hr&l1MKs0H8(BPV*sk zBlx}ePP*b_nSP{#fu{vxyPOlhlg=0nF&qi2)gIa-XG(kFOKFgL?|Cwn8qwbd@_?vI zc7Ro?$u_a1o}sXp?$y{@{@&Z#{TLEUf@4Xk1I5M`(m{1ff+AQ7?@5>}3}TaV>?Va5 z-H%URmDa0rm%zc)b)J~8Ku$~uw_I)AcU~-TN*R?FN|(82?{>B!UcU15_YSs7W%;|qhH{XaR z+2(XWCzza0EO9A2PlYpvA}zx+nhh@7duDsxu%Bm{K2g5k zeuP)z43^|vmaM?aJ@!R0!Ca0bSSq54D{&JN?kNmRGSke^dEaTu@z7Nxg?XkdC!e;0e?yRXYWTPcNN1dv5s86>y=fi%T02huQZ0aEF|0~8nO?*~%pe*vVSJqn~U_r#b^Wex)=7askrZkGY6qzizw zl-vrWYZ~qcQp4L0AT_+T1F3!KQ;P=nHeW|sG{GVs0Xr=p(5yN*DmZp)vD==l(Gc67FBFW5w zavI%=V*O?a6j98~p)D90%b_+Xwq0D2l1OH8g=e{m`1ZCvZ-N>lsm<=fj;7m|I*kLO z7p|S{@~CAfYhF`{=;8R)g&oe(7iTq|7k%t+H?-c`^B*5P6iuv)ezX&RYmzxd(Y1Su zqhPXj=ZQQ>_N$xeJ2q-d^s8H(C%-e!{b;9~{hYh@lVTV5MXr7GL^pd|^s8<1DSI1( zieqi8AKLBiN9ba1cE7q#ym(B+HG6F*;ZQD|@lrSj0*%vR0!1&j#knS~W;}(+ryCiY z)yRl8zxCj3^+@=gwNsXz8}Hi9l+EWXrNgYVj37dYJ)=O9Ve`(Nc5d zIxIqG(ChKnoPSO0J4`}Yk9At*sg<-(M|M}v4Nb)1u!)x%8=F7rXw1Q(b(i1}jWGW?8sx+Z&T z^{D5pXSi0?PK+0VO;#)cX<)5SPH9kaL=bqG**s-#RtLNWQwvFi#M+sU}W!8pUz5{9;4C`!9n8t8UQWW6%$y8i)B12XKB*pjHng9F8?}pL$!nOG zu~8pJpZhG@{8?n)snLb#a3MQOrX-R+r+K*j>?+aq%KALv~7_DX2 z)-h{wR`dqR+DbWP&#=&#)8x2WPj)> zdLH!&G96KvS|82cgGfc(=Q?6u^f3RBm^3q9zIzg~95-n9jKz^SlaS?nAs0*AkC5Mq zQ|oa^Haxhao_3%6*z;DCEO2W^Jr{lMlNj&NAweNnWiiL6Hq`LW?caDgK51t2RL${V zsxl>+sylZh(ZuIg9+<8<&(zYK=ML19B+dnbM)%PNawpPF&2H+l20@Ls@MZgoIdlb&N$Ryok#xV9_nhiXD4lS!3SflL~hVC2uq8 z*y0{Ar4&^T1-1WXH<4IHo-~C$BQ-&e)jb5)A9eN|OB@$VoP&dPN5+)TIRyi_8hmPsuXHM_ekNw zU@RRwF%~~x?hZEb#%u)d#I4mK(S;ZiU5f2rfhD(6f>MS*)oH_@t=w3x;}0&GyGV)> zSHbG|VIGho#9IN>73Wi(2l-&V7npblU~EPnMWd}+gbvm1T_M{qZ<%?d9H zLp0u&zu*d`Ea)G!{m{i<(Sv5+jr-6RHPF2gM&F$%JiRMo8;tCu29 zn}t^M7c{)+Xs|&FEVF6XX-aCY znUb3CpN>%>b23JD+_b(cmZ)AO>x9QfJKEet4H!NbUAV_7bewr5(dM>;byp`ge7=R$ z`vg~={IM7NYnp*F=ky~Mu;h$w0Z||`+}Jg_0fkL%eAfcm4!2z3iKW)ae)=_22WR4U zEPh`dUYIzj$EyVKG!qAN@mmtrXEQT}DUIn9kX%v$T4|Ej=kZ(P8*Ty@ zopMUzNU;GjL-(?+Xn3BNtg-lcD{%MbDyGrK>SbxUg$YU~P$z4(q}1NR_%+g1vJSb? zRca@eFoQ&PZ#sp!v{&(InlY@?GJ2!Te={EgnSp|e749ZqG0$VF1G0DtZFcy~m-0-s z@Lj_@N|Q?n@s%(6`j|_Hgztcl+ssES!fyliND1+kFC|@0hlKBdk93lcz)e1`sq-9b zDh!Aip#D*bcWF2?cA*gMlCO`=mk_*PaNaJ?u-)SV1?eo>?oPz(+Spz2dO~5a$HU_R zRD-ot{GIEZwI|Ox+6ZcJP4Yg@{&Nsli~iP39HL+jBs8=C{ZnWEaicY=_L$uh6Q5N+ z#xZ^rBOiGdxXIPOLe5tvo}Cl+rjy-{XIDMFb?erT{xmVMu5#_0xXpNFTicG%gk*mw z^!&&to7R>s4r7@|HB{xVrS4ZRb8&e${;$HNtz?IR3@*)~n^(jqF0Nj-^EOGOq3jDm z7h{hZM$$8P-u?-u!;%jR*{F}A^`C@Y%qc@PzlH$*EbIbv#W}MZ~qst2{Pdo3Sxx3=#%+ z055Z!uU-{)!za-vmh-uZYQzZp-_kX@zqc;Da{Cuo>5~yRqtX}Q=HJSWO*_xWz^0N> zGc(0HBWf#7>tpORprl$Cu34;0b@1DPF~|XJ2Mz(Um$fu*+f@B#parOY8>zbsIkboC zqCLf5qov%}`bTZbbDb;_+C=+CITIS$v(=-~GuAf0?$3#5bJ zKLF`87nh#sWEpRs=`UL#Cj$)-Gy_Qe(IThQ8yqArlQ5P5=_K8!Kssr4BvM)@=`ID* z=@NEQdZK%r;MajPr?0baNub>m=?O2{U@Yw1VhRUuZc)}8V{&P3WCm|&;Pg^*`F3;+v1!La{J7jWe8~J& zDdr_I;?;yaaTpt6U|#BK-7yyy*o`}{;z#-Q+fcZ}i*^DxuX!1aU|iV>ZETi=Ht)#^ zFM1pfCPbPTj;C+AV~{)OVoB+5@!+vKtQeUO?O@Cc6GvQyA#M|Tmy6GUPt&_>eG^{% z{$%xh+sSBY!Uq@w7UQLT%T}P^Qp9ESu=qYYqw}#szls1@jw=5?K3CQ)N2-{VMZ?Ilx1c3Ov_O`5Mw8E#W!zZbiSaT7ke+2@o;P)` zQz=c#E<54kCa;g65O8c-hKeGa&oDtHrp@r8kH9xEA&+(SZ9qGyH|Nnbs!X-RWMNx{ela9x1o-!80hp@aQXXTGNU6CI=TcNw>Ik% zc-TBHFW__z=DEZL7nxbZrHLx~*xMkD>0|TA6so(FBU7-X?aCcy66efWXW>xZ&b?;O z1`_CaciPqEYXjT{?IotC9*hHyTgkxsP)Ml#i9z23ixINKXR39Z30MBOr^B?XhUc=*QFsU2Sin zF6e6e8<|{TSWBOna$x53dJv{DkclalMf4nE+H=4)1@D;8)DH#7Lv1TUKz6loW7DSU zrGZAi`VN^3+El&#I3%EH<5ze!3-P6zYFWycZo9&-W%xBQ{@`-Fw3%N4gw`^pHJG^g zK{}(Y*p~Kn2Y-W}?r7^4OIUurt}%f_TNw@0$#|rGpo*r$%t!P6Xla0XZtdRM_v2CU zGKrhUUh(c0=n!HlLCYq;~RTz2P%7k!HoODkh`V50HC;dz@I4uoljdnnLQVOo(pz+#EILMm!E7B7v( z>#_O(JH+9ArX*8k)0$$4gk#pC$(y#Lm#eNDuNPO?kTW=EHLah)D5_rb{USv0n(wWE zsjW7*%C*1E^)(DAYEEpkb&HF9xH!$W+GwzGi2`C9XtmFT-55Ix4qHR}e_&l5T5YTa zda9!kt+uYK3+yQ{`H#kW7lbg4H4S35$Y&VD*k%U}Vx8JvuX$!dWw3X3cHC-v?j~D1 zIRrOp4~JOVLRSK5YjOsVwqh3nX)6{7(pIb$XqM=0w%^){JptsknLyg=dkU9cJFQ=Z54k3q%GSPi=G2IuZlAN9!OioKLcs2$d*@I#gBlL zA6ms)B(QB2HDt7kO+i=N{*?t?ZChC$bp5Nu5gbxlThErjwo+`O{&4%pBO=;b?m!lq z=1^M8ZD7k~96a89Mw6%$H*wuev{{&V*RA%k#L8OyW(BNu6HmxDjEhwxp@F)~tm8=0 zlI%8FE%^d|lwZfI+{25w0Rh*Tg%`0q#cEvVCU4|Xt6t!CCN;`=Bmc{yHXOcc)_Aac zzTk0I^!8c~E>sl>g*Qr+i6)=g*HWHeAqLNjKxC8vH^eoRCe}kybnfuaDro+DN{8Qs z3e~|>G^&IBd?vH$=LdWD5=DrTIe`=RGi}9>m)IXg6aS#b#cGY+4Tp$eX;&Jnn>lXW zTUsW`TZY65pY}Y)dPrj4vRo7{h0fI9dO)A$QY2!F^%g@D7cB5rJU{PCsEd$Ul1l1@a174cDd6K z<$PutB7~Dy*ko3SkeJHlU{ajR5Vi24K`=e}$rf(uNmGIj1Or058OBQ^DR0MJsQJqD;l5NA2GAAc3yFsjUP?gUb))&i+i zyb0yILNNzO@5ZC0M%`8c{Y`W)=Qdhp%t5W7oO?q@e?{D)K&myV)fJs@(Kjqw2-H+X zSrS01g>L~;EzE18RSVw>)Lcb>KLJvI4+E(`9;&7Oprf0RNLEK@9=R+lBq!+I%sRR* z$YDQ;E&R3yUH3PxDI9K=xWjKn(C_=|SM8@M%kq|&V)XgyTt)^s&D z+!w)%n`jKIPupSErfsZ#6YJElxqb%pe^)!}qmP;m|L8ViwRywv=o376$H9MWvd`B| z_Rp9Tka?*fur6I)v9Y?$-&&tVSv<4T zTyyI20n%s1VyRB{rtqRiA-^uFyNatST z^StyczYSe7>7ZDu6V14$n;r0qh6+d7=&o%&PkE^6KjW`M!eEe*|9Bs4ErU|pRsP6-{=ek4ccfH)MKk%1@bV%Mewzd$V<>aHzD&%=XSUn-k z(XaTU^eg^0W_NqenB9rbV#&)f#ARoay-4Y+Fj;Yx3v{b=J9AO$oW^gkH&(c-mmh zk0q;XLBArX(OQue^O;fJSu0wban_0sS-TRVrdARc)L&Eqo}TCBI;7x|VmEPeo;&X3 z!iFKHO8H!vr zPFvj#w+8CR8H;(^>PS_n2XxY>4Y|;z@3-fNOBMC1~WcldUj$c##_{vk8k$|Vo5>c$p13l+-;M-2^V13b2IC<-f z2=SFKp)pHLtph$bnU5glG9{0c5MS-WrN@?2gJE;N@s5u(1Gp@J3j=tU(P!|#Er3@T zj9`}md%+UICtoV@d^#k22Yg&?K4NuYFF#!{T=8nRj*U>ep(UO%2NikuWZNFT4D!C1 zI>4G;bX6e%Um_la-wx~vPl&I4sqn4}ZyoTl&3pvu3ZIk^U-?qfNlSJN6WW;X_mnD(zIf20C} zG)$o8G@YR_&!hccN(<`nSR#UYw=|ZROFg^HO+W|78<)Fryr8b*wT1AyLL%9fAyh1$ zhP7u3<;f4#;8MK||Ce%2JGid`=eD36(7zfh;SaS?pQaY-e6=8-pcceyt0bdII&M|D z+Z1kanIGhW3qN!d@>x5u3q(G}uYOaxK*Kd2M%7Yk)(AH52{rCVrD*cNP1KZAr{x-o zFLtaKa)Tz;of{yY<`T4gG%Nk89|~_G;&A!mFF;RoLiNm@;PL^o6?cw99zC1XXnCC8(m~ zaXHu6<8s6e6Vj%1QF*gt6*yUi<3`x0YUMP!JsB5aG0&xpfjzin?=@W=<1yUH5sIK)Ocok3d=?J^<4E&CWA!1wfis+?u3oPb+|Q z?di!tD#2OwC*fWRq-#%auwS`mQ`er}3-qX@!3rRa$1g3~Y|#rAy$_^o9kY9x(855v z)^R_e9Esb_Kq}u)fmFUWAeC<`kjnQKkjnRW`;~{XsC@eXseD6$RK8Ib9b-|IMPC6@ z`Q`y>Xx9L#dvKx#*P1xVNAzHPq_!pwnw9SL-~c3`nh;*8-{KaWRn21aY&ox-AFNIU%k#wd)=tP&+%Jz+_#h zo#EL52kRPAdtTZxHFjNSQ;>sQ0m_PLIrwu#LBDnlDf^h#?_M}G1tqh0BG(38tz_)u zTfR25+MsJ+6SrMK4%`4L_R^GCSjjTScy5q`o&Q=IbhYzeDWTcBp?3uR>Y*q0xSq#o z_CS-k8Ghcxf2>^C5IJi-_l{`|fF-yUKWu!nOdL|=^3q1<+AbOqITh!o;M5c}@ic;= zvBe%~&U46V1~kLM*6x0ON&wF7cZ0S_i$c#U_S!2P1K=Y~TJLy&ow!sdXJ8@MBN%sV^Zp$vgz5NP$}CeXx- zxZupq!bu3pDd;-kDm3imJ+>-xdA_WE(WFY?KHZKd-C?Jcx`_)*-Ruj?+{CZk1J=co zV}C`_c+Nt!d3>(Z*zeH_{Pw7(6i4GZeeDqoPt#j0F?REqccSr&kw$vy*jPx~crawa z2m+Hjm`bvrN*IY-*EPKlIeFJ>drmYy6_ZF`$5|GT)JsSc?*{CV^6!NeUpP6i+;o80 z`e2qHmO{{#kfs^v5d+`#IU z#4=eu{gRt}R7)MsD)LI5+LKx8q6lx{0Ppc_+*^c zf=d@d(ZnRA4X?!Riz1V!#l^FzM-$gz7z5j&%mvGopxOs<5|i2oF%hiOzAylK#zB^z zT0OO;Mm)GBSF{yEgz{m=l{O)@$|o`eAuSEyYc~xNyCU@9{z;_UKw#Qf5_7uUUHAE zEKF+#3bh$1Ml(>1W&nQK47kbhrWwF75952X8E{b`y^1~sH8BTwSFnva6>}6*3UPQB z59mRIz=L#9U$bzw27G;^TuC~rBD4#DJ+3uRR7G&s1kTCfL2sDpr=G%+IhS+&XbUhK zrA;no6-qfct?+`CInRr*Y7LW$SQWXUcGmjCAk^1HNuSI5g5Dr@Ndet1YW8

twGG zrW4m!c(-+YEbJ23FGeM7ZQj!(yr>R{%hO>Oq57@mNS- z_Ka>_uRa`ZvR<850*QdcxI$L0>+&|nsx)9P@#9r03)E@mJ|u9X#r~e*qfp(<+7L5= zp#ldaq~*zz@K!);zft?fLO4PB{ZrymvV#MX1y8uURMyW2CRV(8PU=@z&w7(n-=Jh? zY5TktLk?$OsSt6XF@m_ZQhV~HNXcWxjRzX3+l4>}idzei_T*8#>jSCj6)=V37exmc43~(br-idnJ;loly_UX(OCEi6YW*rnV&)7OsFLI$>^Z&++Tx_IS73xyE zxHF}Ti`8S(SxD{W+NFLP=rMGjy_XAmZfnEftb9VG;qb(Ds{o}kvl43!!^VtwI9!O{ zbGYcFyl^3^c(~|G#qImiCfgI0jm~cTq+;CT5kVz(7UQRv;&NjLmpfZymsqIJh~Tg+ z*hpX9%Y`_o^j;_LSRie%F950#z3>AdZJZwg(rz4eg*MKwTZC>}DSp_-*&D+k6`^76 zp=U@+sId2%9;LBM&PsZ~0c!8Dn%Za$mqrBAGf<|&E!Tp;r04nG8oBa?6`*c7Qp+y} z4F`LgQ)i8EgLSFXu#dZG6Bo_#qz9;{EpE8_V|U!UZg>Ljo6<5XDVTod;@&P2LM`!9 zs~+eL(X3YhZ4~rbR_q*(i>95?&MrGQwIfDYsK z*tm5KP*Pbqv2K1LQfu6HUL$ly-kfn)7B;@u9>RqLP-!>?Gb=W3ePgkUKfPSuVsvs| zI~FIN0*Qfo(;Ze=G*1|>^maRLY-MO{_u?q2d{yF&qvT+hA7BnqNtv>Kj0MPK$@dwW7&Z~YQyo4X}b#BDBQ%`T8%L{n9+tN zc;Q;k5@GITkEUlbq3gJ>#_Ek3ZN@E?Wp1^M<;!B%UXWP9F!i(*=DA=v+bP0)0);aVn2I*)kZ46f8xpsMl&MGb>T=;ebR+x-?T6ZDLSmM339Vxs`PFLAH%v>;+ zB*=~wB$4PDNbT=P;oXt{+K!Z?z!odM7ChXBcc&dGx(*B*Pj}GQ-gl&=?H9oaKI3K) ztT6M!)s<$lC?&9YB)B7W8$#aeQm%HSgXCE{XT&U3_P{0*Z%68i&l3QL?P&pMl6Bfd zlDy086sf}yy581Y4zj-tE_Sl>K>VN&9H_dI`!~w3qt*^DdJ6KG={1)-31&u&VwfA=V2Zci)%`QTSv+y4ozL`0--I* zV;0y2f=!a>(DDzYnT?&2=ucxSh%Da?1mE-oWsP{nKYa=+!vqwzFT%{0b|6S_pTv;}NDVYDkj`(M1Eg~;9CjZhtx+qG?vwa7&|fC7 zwY?8W=TLqHr1Mg*0_koBo(H1)Bxp~2ODOsP>1;}WAPwz!Af>GaQreqa9Kx$+E1(4dE0*{j#-DPTWj;=^&1uN_Syp>!^cJ}#GapAR zhZ=HL(4}qBmT=1uq#+mWvDM=@G_~c}VAYT_=6POyTvfs28nFZ^-#zw}`b%@%_$l>p zg(b2ICs-ENj9OQX_W0~d-o_WM#IcSzH2|VV6K(BN5}TTLWRK6*OT9#%foQxNd(~hT zyybpIFtIi|YF+zqN)}$kaTG%GzF#Nb*YSI3Oj|5jP*yW;^W~S;AhdzPs|Py*=Srji zpKq8sB{{Z8z7+Ed4nSu_rqqvm#*L%uSJlSz#PcY6J_rsoW9LGGs)|@PUy+HUHpa02 zfiV{UGbhHKnt1Q_p3zO&+WkXfBP%c$ptchqQJ$lna5N|Iqr&7wRB|GUoPaCNiJyWT zDR)Obi$j)~8RrBugIz`>bNiPP>%GiiWu;stSW%3Q7;ZCac?eF(F?ZA^_qjdoBOqjW z5qCjJZio-of1Wk3KD-QxjoWhh70i(S`u(=848(PO8eHbrr)IwFTWWUWFeMG9|>p`16S zChHt8S+_KtDK&j^a(rK=ZGWb17#zw+y@;d&sKsg85E6xaOT$6<%|ebB3prjW7K7aH+;N{Y zl$yDl{umPJqzh(eFfK1gtdJX6*zEOF5>sRqlKOipykwpDtMdHOq%MY@6G5g%xc}xr zrx&sx@ZTKhlK(`YbN&;7p7oyywD~^~=oSBoKyUa@1Ugp&jU`@=#?Qb6@1+sm!rmnH zp5s;g*;VbVoMR-d*P= zF*gUJY$*<0ZNMcAIz`++Wn$N;84QS^h>W7)sol_pxPwHfH$&GzIZ@qsI%r_i6Sq^o zhCbq6xbZsqX+9$i>L-t8lTlGPz%)3FX#xWbV6lD0YBRDq@0Lc`O%KGZ)Jy9uES}_ z$%4YrmWd^y`z??sA+KJQALBS16aKD@M@Wf~T_$!%3F_EQ zO(+RsU-7=%og|)iX|*+JWS~CS-8$-Kb`yCMZmlk>Bm(966W@?~onRa0wq+LDI#v^$ z#H@7%QM}?UE7ypQT?I5rReYKrX%UkK2J8`dvD(F34S;m;REWLjTdkA9^08Xce5W+3XF#>3pi4HBX$GTbhoY7+|FXrl9g@n4KsjOej*U+2buIieLmjInHHaGlY1 zHXXGLzp9HJY}tmcj0->Yua-^usb_HnB zh$e`EGh&!V{D4|#X8pn~JQ>Xz{bKmR-BA@NaG19apSA@6`_rR|>&5WSAdz0gSc8S~ zqI>`t9AZ;u<_L6m*f2A}Yn{`JTsxGzrjwh{#G8n#s8FS_-?Jw1uGtGyEPG)rcU}Af z?z;HJaMzo@11FtHPKFn~EVuo#2=gk5XYk8Vh?wD)$Hjv#(6^r`YPe;Y|EV@_=Pmf< zuPonMxv7PPjG8;+w);+t)3*$|5UX%z)cnUH-Xxu{(KKe)zI5OI`Q8Z>HcmN zyZ_^W^2J{RkaFR&bLB$Qn>Geq2(IWi7QJB+YGcaUoFQguBnxqR9Zi07S^Y~RjWzYm=3O2sDpuq=m~fNF!T>(rGKXfx0_Kt;Y~>OX4rqK6PaOg~^p z>vAAFG2XHaJT|pZ^S~}BX@*INmR|znIP^BW_yBIk>rnLfycvn$UN7wh##>gUFmA&y zkl`;M)JL9$MIW1FgAyG9--HWv8_sLuH_w~YmQ5`Vl9~^^T(V5Qq08j6FtOk#Y@%X_xay?mWw6RE@j~QFbEtda zK+br9JS^nf@Ph&b$aetq>6`>XNn2fJj67N>wxZN}R_KvHYV)oHQk(b1Kx*@D1iD2E zdoxfwyyQ5$fYiRd2WW|WrKMZ#+YyTn2U1J-7$Ds@z$&AmodYykdQ$fQRSJ5NU$u$) z*Bhg{+(2XGA{)>c{TOcA7)@ZlB<`FE2Q)_3uW5{yLJGF*|Bp9DjCZHTi1QM*F**)E zx@e4K_SI{Qi2q%U5oX4qx4!>3PWi zgr?_S{7P+lSfu{FP0v%PoH@?-P`5HQJ?~3>V?F9C{xUT^-$UWn24|H;>n(c0qV%RG zVp@d72;8<4b}`_xpzFWX^b9ir)dpGqH#9vw%kqDl9wa&%jPBaS{~=A!(*ID?BU6i! z|9JyW(=6$bBXD%Ve`>&~`|jAg(0zC5hAX=pCK9aZs!_!Ffc_;GJ-yUXTh_d%1FN9W zXFUUko~l~8?iN-db2)H$Wk^4!k;&DybH=T0?8WP0Gm_&v*R1d(9=T|K?=It5;$+Nj z^y4ht!ahaC~QKTJ8s=&1KfCJ zedVZ7B^PeV1*YMZS>BzfvBa0lYZARVSMw!=1K#~`zxBzO%DuD)ZZ*vk?%urS;ldpT zm&$su#qzp!(Q#`pD<=2osBBFARK{gK%}qGrN1QG$Vn%1Z!dqOKe1P}9a5)^3R}FKr zRRinMyn=$84QsRrg?#lg+;^~ibGB`4?Qz6r zcqF5$r1`ZBoF>LsFULzqcq@Qn@zrg3p{3ePcl@8Ycr`zGry=9}4*cTK2QLomu=;HE zHac~49`cN)l+%+aKSpNc@Xwt|{6kQZn&R%jE0Z{Z1!dSLhq;0zqY+rKHo$FOhlOy_ zJ?<#zus5;3aL>@oPcdxUl{_eG*V|0!JJt1L^68JWJrHD!QEur2Z}dQh!_xrv9!1DzBoy>wwf>5=i}h z8%X`}7O8Pn^!EUe`da~{{vHETf9rrwsG`5EKcSx?zorSM7tZV*$HhPOZ-YS20xGb!y)KSU>5Y; zU%6RXwC{?MwzeF-tcF3Ai*f$q<+X0dQ>(KeQ7rpI*gY29!EK5aw4uAPQGcg3xi*TH z23;ziXFY5EY4EByT~(ZNDy9f1d8tUw4J|c^9gsYH<2_^uq3bGFcXSY9UM1#51hGL2 z$ctpTS63o)9QR#HWXdEme@A3K#!GK4q-FCFhSZYPB)^spGLOk=UqLqlpcOS}CG-=GkYg=ggDF zt=o(V-*`1Vn#`FgnS-rYNHm$U(VQu4d7e3gS#0LaTiBj#A`-}%3NL3c8N{5ym3#v` zYKxgW{gExmoteR``R-n_W~LP%E0y%lB%3!_LT>VAnI}As)44>J>_#+`7!S#tx>js} zHL*EP${AyWtU+v;HJ`}YzJAt7jF2_a#8kw{W({%-1rpudL5P%O4`UTgUN&=ede+oQ z*2v5a^CvZH&aON&C2zdS$9g?Rs!pqua*z0w#f z$a>ctBFwGHUJt3IO)h~AyBt20<2ai$)(=AfAHuAg<5U3c7L?VmhtuzzzH|H371Z`F zgEJmh3G?J*N@;(Ri5~#z zc=64rzvZTgH2aB98z$B22ytQ;_h3OGa&+og0k}6L+X?jx1&c;7%LdpW6fuaA!X>Ml zq#S6e6p^Y-sbHYbxfVb19HB4yTWl#5k>co16p;YMzLr7}DaI>BAiIKb+0RlaBE^Kg z#$~XjQba1ZTgir43Pq%t+O1?mErlXdOy8?y5lf|rRHt_<*>Fpth!k}h!+}z>&jFT7 z5vk?~RsRFhOTl(ag>q-<6p`-hzIy@G?&nX()*D0FT zXIJkXy|(q7n_EZ1uk(-h9B!!W^_(#5_|9`g#lh&6A1uvneq) zd{e{sLr}it$(w4-lZo$dJich2zmUx2J9IC+f3K;@_Hmka11~Y6;62u+pdzNxpOk{F zwx@lA+VE&gp@bIkCE{XRGNLpbzC?ba*`$<$R@CSQB6D@@zQVddxZhCdqmP!$+_V>f_N>os?NtQwpDGu-{GDvokrBFnQ zL-s0}YpE2G>Igra43b4Hg(6ZM5wIBlKa*j@V4zckjy`yQpn0a+5ELC$w_i_B=J+mw~MWp$m_^hK3R=S_d&(O#eTg{>T>OFOqha&P=DMaaYhf@yb z`HH1dM5roI(lUezac+E6P%KvxlSQ^T7~cT+F=HZ^mGOOGbL1wbNKMC4eMq6 zGS3_vmLi6=Q+$>hFAVQ}aiSXkP>`ze9iql7LU87u9@XMp_mu7A{yFCYXL3l3Q@&LJ zv`m}ld>gbP2E9kPX9X&BP~Fs93Pq&&OejjixlS0bA9u&i25@>QW3G&gL z(c0=b^X0Gp`Kslrh+K2TXT9;oBeCoqgUfuxY@4VQNt*wUXp9X5Mq5l|&IG z87@9cjTibJWhFUWkQRk)W9cWYC~!*`io$ntUJIS=1T%G%VTkudHdsXr_DJFU`7-r* z@k@rmO#PbWs)$^V5uf$+%7>Au5GQ78m7olnszumu#b7kH&)01ziWtfyVIuV}N3= zjin;SYNk*W$&k7)hSYtWe)IexHHlf_wCb@tIa~bGeGUJ3&pgXn5jmeNK1+=k=F<7% z#9X>SP>u}4+kEYl+m8i})UASYZ*#7|P&1Hqb@=84I|mImXhkIcnsC>KhQECZ{!)L; zIz`Mnr6Av0{5MY~-j^zG&x?_SS?7oEhoF4P^A5w*`b?$yhVTtmF6dwTTxMgbi1ApU z6l|Ehk;6sSKPr)>P(+HBZo|03QYa!tLMhTl#j^w9TxqEkk?Q6El|Nk+)RtFSDn+FF zc19|%KPVwyZK)KI>P|mS-xE*HaDB<&1(re)DZZ~1($e%oOM|Ncr)f*$F%ZfoOR0#I z4=81zlQc~H>Ys&{LJ=u`8VIW=!b0mdTEluQKzXgDR7A>$JB2kqK+$X|6p`X_p(skr zD-yA+YZYc$-z5I%zJh64XQ}bRD*U84u?jyeC?r)_+6$hg1Do4jp=C~y zByIsBi~;JruA1@RT0yv2#XQ$rK@?GtZJh;q$qMpvWXuU- z%DpyJG`N>DxS_-uJiFK#Ja&*XIIF)?XysMgf=Y}~oNTNx(HW5wWMw$p$bt8bRuo0#QXrvea4 zY6nf4H(4r0r0S zq9@l9OQDDq6FSKi4C6LSp@{~q4ep9fj}9R3*!{gW+g zM0d&11Am+vbSbhO^nRSH1PucEmLLlMV?o1!)(he~!`}-!6i5d!c{e(}LWS4$yE#mA1Rl(z0kZ?5h;ckiq7ls7sPT^X?KV{uk>XsXkaF$UA4p@L?^r5Dr248*X}?;n z0EU8J)gM)sA}U6ups(Zb-#nRke_eTdUJPHx(+}SdLHUxWYnWP}sWgpyjp=u7OcgOM zS9Tjy^~abhVoa4HJ*Js>FYGd=e)xU}$~QfxnfP9>F%4)pIN0Y78%sruC0AUht|l64 z{iAzkDHM_7TS}3p4=)H%-DRm1k?MA#D(ao<^d8-FM~}HVb=kGPJ%*|0H=y^4UotET z)a+%Jt0Ho}TYQ$%D5i3KN6&)log`4ma*DuWhM2O#YU2MUMO@;&e2X;NOjOq z=%69cLC{4o%y+MYeqkm3V?fgHSxFT!teuaQl!T;6Ysxu8B;%eKLq8Q9@9*GKh~JChjWf5NK9Yy_W>JA zMT}*KQsm`0dAH=u&8|}|29Ngnp`}tpsvbjFDTfWrbq0Qr=k$H87nTP}pTjYfOb_*s zI_)9aY?P9|Zp44{WD29VhT(ZJd|4WNITSG$lrMSS?osfSiEokcmD!qk8rw4XWUTzz zno~*aJwHOwx_m4ttOzB2AUFS?lL$Cj5O^4eeHS(M`xAuaQG zZXO;(#ki?ox+`LeDiwWw3;)fNiT?p9>1g;e9eo)TF)Zavo(~$P)@LfsA;MQjEWTmo z%mCGcHnxfw+aomPhUGf_>U%nU#tv}$ysvYkBxIpwJpCDlapIrfKI9+o`Kjfsh@6iS zpQXkNTd)(viLGa)AT`gSFuF>Ixf_A_g^4xTQyZ0=}5%XO>D4 zsU|B`Nw!lmw!q0*r+zOnBzXVaQYj);tx%N&1}!Au7wuv&)6Nt>bT{T(;$K*9ib!*+ z_^jh+CeSST85-;vNm8vs^u)~YyE64Qoa^|}dmgsoC}KG0h|f~vg<)MNPRxvpHB?a; z%nKbV z2#Od&lQ2>1t_~m!1;464=8z($rc%&XHU66?6YuMkx97$1WhL~(_d`&==M0+O&lxnf$Qks|K0Au$7S@58JXEn-?%8NPY9+aoWypIT zw~{ELBtI9QrN#?=|I$jbMo^BFdmWs!^uK}ghjifm4!&eN`8S6`({jo}cR2T(qF76Q zWBA8=l!n==h(WIt?%hupJ|lj}A zcg-jar8|IqJbL_AM4CT{ z&#xLkbD7?6h#N)RDJTSwB_+L}bW5C)tbR_vU4=XPwwZ;RO3F;u@CO5ZD0KWXMB+n) z-n~sFMGXI4@mVh4y+0ITj}_tXf|yEK7>Q!bL_WRMiS0m*icNL(KcO2#I$eiwKxYbK zNzp=qu+5ZkZZ1QXME*>;dx?BV52o@ON#%kYozp|N=Dv~lLBXn=EGG6eP3$vB>OJa} zg-8+E=7^MEFunFsB9I5uYm-ecMP%Pce0EB&f#S?8D-p!>8Y<}Dn_h#3XG(gl{`~2s zUYTBs7@^_9@e8KckxB&e{R8FeDVtu3$bOXg?37+uW{0xG^g2cm)9ZLa|K9XEPI!9h zb)b~5Cp5io_#EX+y)wNNF+vr>(JASVQSR)0Fxu_s^nYGQyZD;c-T0DvhI?=;!Lv4< z6p?LIe0EBwY2wUunjwhkbcUcjsfQJ1bj-jA^+#aC#-I;Q@}$fE!{Tey9Wj?UNABS_B0fAeg!@mIw7pD#Y^jTh>m zx#GmQUn;0m6MRLes3ad+v9D7ydcZC;f7`-ssS`oPAojK5RaTm%HP3d*Hw3z(%@58jkCc|i}SU_#z544T`F!E{)F^0zkTiWu{s z24Y?yG4J~VVm`aK&>3pRTxl3{MU1&e4HS%drf?okiMip+nESFQV$78HeSl)SrBFnQO-eB+-x)N!4|=x+&Y;oz>?+z3 z-qxp0r@lW4aQL0&pokov77j9^!Gt*=K#g?+$s-kmLPF8*4?3*GI}BZK`B!fa(=XrHE9YW~2(5 z(sx)YMWo7(u!kdqnb9U!(uWCQ@dM9J1OIr>pDZ^;vdhv3VRIs8jQ} zEmX2!u2X;xO2I>^`x#CL5%bhHQVkInaB}Vne1~NhT=!T21lmCz!6=&iL#rDmyqXNRdX@ylpKCbWy_8X3ct9f=>3Pq%t8j<8q zs~0RK=6TCfDI(SMNLQIO$&lgQZYdR!@^qyPSZ^>`w9h-1LJ=wIA`(_lm>JITCn`^| zG#JQQDn+E4BUC!oBi&`kQ1GkzW7;ZWkx&ZyIuHNNlZp355lS>{aGo>xgIs6OYgp>J zp#V$qdrKIG8s*>P&Nf~7uuWHL`kEfd%}n9Ui%2-^;UkQoWL?EUd6VyV_riO=#~ZpC zydCVh<73h&HDy#b#z)hLynnG5{?|lQc5?OkvL#S%sWDK#opReTGwilVdDZH~}LbER>H2YwPSK#!&MTdBQ^Q7Wymo0IM720rhfMWh&fjw+}$Ol(E0f=ZoU1@(JsIFD#JT~tA(NR5N?POpNQc(3+& zBg8JMpi(hq6tVDV8l_jkO#Ih-{6U1rRPEIGDIH^=eABC7CcaxD-Bm%KqasSLywj^- zCf?5q?|#7+%*-8tkMof&W{OzMwhKvDvl!}+5mZERlp=i=BNOjGDsRy6F_JI|{qX$| zly5b@24^uc@qI1AB;4pKzB_3hgo-N%+r5$Qe_y6&hxu~dpk z)uB{@5#0H3HP7EIg(6b)7)JSu#6Z>y+7rt{yyYOIV%n=oh6TAu{L($BS^r_VDk9h3 z;AUp< znk0y8bs7XwW!xwTVL3k(+Jk|9AZ~?Yow1?8Ib(B6^Gfq$eJ2$LHR}R+GtV6;KROq$ zh*8^Dq!)^F)Zb;sJKlF%3Pq%d_!JY=YtS@wm!(idii3QL3}M`DDHM_7P^FMgp})@u zvGpIMj>g3iM5@t3rTU(~Q#XsKKglMcU|~=S^8GTsny$Fp{t$`r-Q_C|~lt z&!do62EHfwY2&44usa&E6p9$DiGj57R}KVoE!$ElBGqK23RI<$0m*VKg(6ba2Ey_4 zpd>(*YpE2G>Qtc$=7FK$SM|p{P{ce?3i_Il|K`cW`%LBSc`_1FfP;<}pz>R5E=< zc|Zim6+|U-nIMGXvx;X$E+lfy%i&C}mU%q7POy;3Mco+ZEF^iB8L*_grz7^-l!m~ znS%w11@ZuZ%f*fId=zn`c5yL5y~s@b}suWZ!GzE z&j1@!MU-WwL`HgYUU>*MRD&#qB2xTPDY_^RC6+=FDc1R6c;x{}VV`|1g(6aH7K*NV zi|UUGQV|uTQjl*o{+lNg?`M>^=fy}uW#@LxwYq%r*}dF`fg(XQ}a& z1u#^cs7Hqj8Y~U9-#Q;k&$~pIW`@33L84%HjV4tErFqA;=Z}h-WfAEk>XSuOhXs(- zIZ52uo~s*#aT>*qgN8Su7qXqhfNl~u@?S3K7@#$R#smFUP$ke&67ESrCkiS)-5HDl zM@8PWf{P0e?{{ziBXf#d2j5U!(7!3GEvu`c^KhGpikOI{l1^PIL-og4Dq=-Yigaa| ziTB~k8#H`^%Fqwr4?+2+E5l5D#|mF4!$5^M+!@jVHlB(Y&*Qs|r}|?&6)~Plksi-X zysNs5rysr_g7Qs|XC}T;6VD7YAweZN!p2t-<2y}gN1b@qB{$vERXQDL=@gOfjBe9O z{V|;sF`bkmJ)JV~{z{kWiFUNAt>MU)XBv6r=KHrM%uV4Vq8~sn>wQ`g(6Zs(QWFeKcwA{^Z!4At05>vT*6=w%@X zaIRo1yyq~RIEt7!zZIXQ#tXY2uZU9*pg#*bn~CF8hS-=p!$K$UmDa=fulspThS1X7 z(ti3~p0z#BA+;W0)H){vr$gzs!Z)@)&)==mQ(6%Me6TP3IP6FcLb=Em!*8MVXYj|F zENEY#`GST5-7IJX&;x=F0csOOxn2@92I#MX%7N;n4|Y7zMS>;(T_%VRxP#w@Mg3bfFP0$5Ee-rd|pbrH#0KFg*d;{n=f|!iEicAm+^pf?fnVL&A6&XoPV2GtgP$_7|YD1-%XQ5Bd5&kWL*= zc&=dJ$l}BI&B{6Sv9e@n>|^EohmL#fgp)%P4xf1cq=Vf0NtHR1_r&&{JaX#Mldq^f zblQiZ)3dVAUY#@P_8hlv(yjP^jdR7MX=hG5d*CEbN7sV8!;ChMiq3I|B3885hcmKW zQD_uNp@BZ6Qx z9*j}32ms)$4Dqi%N7{HOVm$hZPsUvyaB}vu@fadVw~a63?71_S?6d-q`d+C3`QHdR zZ-fqaN^)`{PNkC*njAV)cb`lP%_Y@={Np`itPqOGW`u+@OnTbAapoy^gyxHXLy2%4 z^^YpzA)3^blD@8?=-!hljFB3K=fm)2vGV0m#CAjZlINnm@GbNBqP%cXDdmRzd`uYK z%TE5h@Xb7#WItNM=<8Hr7I`@|&+C}7n~*gaB}+}pELrDT;i#?6bF39k5rsRevv6~)a9nr+et@fwRp}%`_*v8@2 z!t#K3W46A}W9`E4^F+>jaz2#zLM&r3I)s%xDNP+sIDe4>#Kc!Oc1&Iuw}XIQ6GX$! z_0mj^23jU=$68crQPd)KJ^l}KUjimYb$wr5-P1I~Fw6|w46+QXBLWVK2KNEM6%`Q_ zR|Xsq6aj~ES0W_tOK^!vT#=|TMvdYUF)rYixJBZ=2lr^AL1UuP7=QQNQ+4ZAPj%0X z$@l&L@B60v%&U9Oz3;vIUR76BSJUnwL$d{O74yA5edQnhrp77S34W(4R4muv5$b`W z%A={f_54ry9vOdIKQqpMC0kxuQnA4ATNnGTT`lNAVW^NI!mun?H#J?-UY8Y}re^Cy zTi$HQ43u_x7pNV!eiE5@i~)*7P&`X5w+OB93-;bhtwWDrq9_xNZCa|>_Uz04kj&x! zRPP+`D({#6CVzDL<;>@q@{%AkuaV5WS~Byp#LWD;#DK2jUZ+;jYIP*Qdx$F_ptrMS zCJ_R@QY~9$=Ji^Qm~T`Bm0J~6Gy3&qnwcw`WrMdotrM!)kvPWY}Su>_7dFa--7~dsf|*?lG-6D=8u(2S?lvQ;v^ zU@duB5t8vuMZq$es?cN%*2ndwnt01g^lcSZC;9NH|6CiSCKGkzYHZpl5B$d4dwhE| zt^ZxGDUqtce^G`q->^b5-_TGZtdLwQhYI@KGW743p`TiY@>s1w?1+$|MEe+;Vdzjn zVg5!dyhQo?8_nN7TLk&LJd+)t+o|**zwDcI)o8!(?Y@6gc3SDQT-#~* zfw~g$*y=}pq#+T;?=7{Ar{PChhu-{HQILji&jx9@r?=euv3Hq&W%|YRmYLsVUdnut zX(*Xq@{5wSCBd^DqKDI?SHiN3r4kWB`KLOo=c%(~+9ab9f%a|Nw8=&z0xdTLJEr=Y zoh!XjCvM{npZ`5?Sj$P?u%;8eVdGBlhNYHx)th>4?6IM0o%_JUX=%BRAau?ZENHz| zNPzdXGgo#qmqc(`sg_`C!H%YnR-vo=DJs_^_f&~a4nAyZgU$wC%9)Va3DnE*g4}14 zVRA7Uug+`@W8cQY`MvWN8s5qe{A>)se) zy|I-d9{Dw*rNNQk$^PyhhpbkHY@iI;-ZErUWXSfCA)AyqWS>b#$A@gZ1u5U}u(Fp0 zNrWKBv<`B63vwq#d`@M`*CAV{gQdsz(b(`T1jgnQJzOgd`aD&VJyyPvKc zk%dp6n`!4aNt754D+n1o70)KtmV@+V$DP_vdA<^Vg=c z6a8hmz5TM0neq$Eu1}Z0UUosoyCLVEHo+lmSm-b#{}LgHsoD&lH$7XSi9b>h*P3Gl`MS0KR{xE3?)B1xbNi*`<*2gBe(v^?>OD&O59@n( z?fZlNmB|e&os_#U`^$9hp3;+ZuatOu_UYAYn?7fH4|!u!<>|xH$EGhz{~`TBI+H2y zbW!J*IzL(Zr_!%VyLH*J%T8Suc3Ix#sxE7~JlEyDEhBIeL^6 zVvRls{Xi|H$~zV>LD|pxfe8I@np(!v`%JAuqMf6N3vvTej!7jylQ3cbn$6`N##BEZ zTW;vIPM^wHFCUG9@~phak1v00L7kont>i9$3yKIq{YWiiLH$Y!cldPow=ZNGRK znAVw;;=$sz`PVJhz-Hsycs+e68sVLe*S9psv5Z#gOo1L3F6>2_yI3=3svQ=y6^gJb z{Y=r8g0h<9qXltBVIFa>+~Zom^z8D-OLC`H49|`9t3K;-V(wCZe!&%ve$X*Q=!dJd zsqUI+$855d@qj@D#&xY2?kdW-!5{+TrdABs2YU$&A~0@K##!D|^3#wU!&VSjjPVb#QFa28j%XDcbRV_b>7Jd13W7U$%Mv;&cvUp{gZW%xXA8Xae z9S^7Uj#>FMGhObS9hb$k6PAEA#^KK}J`wm2DgSSL7E{WW+A z$^j-z1lcFmvMw}15YKBB67wZR&TL^K_?P>Gk35OTFN5UxWw0E->?g-BQ|0(&Upao+ zJ@NRZN^%r_qC?JiEXv2>EhsZBN+Lx0M(Zfww?cG{G*}RO%+Hmo7=r(g2H^Lu66|flOHEho=lSsvZCJw-Xpj2Y^(DFOvY+~8 zx1_yE*=@@7nNGoDhCqZdQyS`}+8)$D;mj0@!7&jy8MU-IzY^wMwXQ@^g`(iI-~=DB zu@%`@{T+RIy3|&wT~nXQ;omp3r!H(AgwA9G*nUR>Gqkw`O4LLJLW?qTHEB`!_5m3ylkmLg&4DpK?KHVWz=lj z&8s_cs5fN(FnQwdLGr}keRv$dp=@30lFp5}sq~N6iIT=L)thK&>F2N5Kw;JI)b;%5?^e6NE)Jt&i=dUhNxx_N&~P z*`B%5>#~#mvaS8>^zzFpZck_LtE%oXtg5OK>d&=k8;IzZwoE@RMJ{j%CvftgPOI9A;%S*gXG%9Sg4%;;cAN zW8!liQvrj`-46Pd2~cn7dxC=9PI-myWiTRVYoI|Y4AhliMt4LIotC^ubD_sXZ(=+oc2Z1L@KH9fMDYD{Rj-k6$_#GV z%^Tdbt2cPuByVu4q19avIF}SZ2Klve;bjw|3d%zBLIf|rRLi>11pTo_t4ajjrHH#Q zex?uFx6IqIlbl=Pxs4ynxs8(xp4)gr0*D9qfU3gdlbVV^@;xyNjtIfsqn5GY)@xOX zY4M0>T~%ak z_XqFN%mMQ2LEggLBc=1pZY_PJyq{k&tV&*fnJFJsx;B%0E7N05uRD7TuU?++GqLXt zeU8mkpV;G3U+&fFV#xjb;P!*`Lktv9+HWna&=Z*)}ULk7xYJzIVDjd!jxwC38gPq0I9c9`((X zqdqy}8~1=5_1#(UsIOTfiMQ@^4NKg459tXEAo;eZwT=j_`$R2ct@}c&MAQ39(J1a| zc$>lU;98lsHI-cr-Bg9n!}S@S_egb_$l8t(!X2bVWm!$g1^R)NMe49y^j49c(WLC*3B@dMRrNqmgnq8CKkbNgRvD1N_ zPUv(^r@GENc0Q={qRw}B`FEEC%8o8uRdz>N_pV!YUDoxIt{c1lqibdP;BsD~m@LzG zl1$$n5-(9;`o?!YWpdEYUE(8r)4-3n1Sdk&S+%Uw?eZc@UN@~mf>$Zx_ez7Mi}SZ} z4hZWs%Y)QB{U}uN<4vP4kkcDE7oE4@NMcRfOpl$8L3-SuctPphWh*Z@A#XiYX;(pgVpk@ z>{YFPm3@V%<7^X`x@tlFt*`!s)(7Q8>nkGkRdwsW8fbkrL=kT@p~NB$u?SrgxFS5FFhJzCT!GU->8{zy1p*&gjpFR2cN8g z1;7iA#V2%a#($|!@$TUv2UcSqa$t;j*w9B1SDt}Zx49s$G9v|Dt7{OP(+>Alaph?+ zG@_rMS(jVjmp4@mOqZ2p%SV)5nSHZ7-RULD9^G|Q$v+d%iQCmW;yq{`xBGC6y`VRWYgZUY`g|M64juJha3T*T= zPg!9$9Hs=+4{&C~X(mks=>yfW4yGuuZqzCy$`Oi!Uo_UVXux>$^gP%+AD8LrXO{S* zcX|Acui78t;=~Y_S%^e%vY>T{%@*Qu$suz01U3`Q36W@LlW zuf@wP+`pm=g0jNGC4$3K)Uwrw+#g!VXDPyxdVwNdJm!JbK!3a*%Z!7AaIxkA#d1AU z+Fw`KsPAzM@N=CxSdRzjRz&`gqQQbVoBT|4ru1BO8+>G)tsmIq95bf0HA z<_J;BBEISC**2m?@cf!;4=nM$lHex$kb$kV!^a3Bj0hR9S|NX7Nz#5R(r(FWBq5`a zHW{$GClr?VB<&BVEnD44(5tkLd!Q~fACkYYBV2nuq%M?_3)lBDCP&Q4c1J4(%{HL>L`1+&+=YL~UOVRpi+V82NOs`L-E^~h7>P*Kwcze|lG4BkggDJ82bo6BPXq zJNT=F4nDpe9o*+8`L&K?5;}N%(e9-?bT1JaJW1QMvo}05K67Q})=W)ZC;9!PCa-tu z@K&EM-_Lin$3T#|C2r=v2;o9m zdPzbjG9xRl_NMwXf^Iq>^G&XFQtYgU?JY%}Drf`|Vm?&E+SZ$uUYdSMuKjhaZ;n>B z$i({QV(S|s_?fGgvA$WPRp^^z6@ACPx%7Y1H&j925FzFk4J+!KRF(VyU`vHO<5!;Z zyQYh-ce>z+Ey^X< zC_gr3A}IerEn_`;zE+_}f24@lM5ZFEcp@Y7tbaKlP`{?o1L}Wj0pL_%ST3^wh!DWV zYS{=AEYerdrCe_rko79Y_3|n{>%7tZw#3O|6mRTx=IeE+1m&mZiwM51R?Appf1y=q z>`jXJVU=ex^uy{5U1h-LGM;@qbCkDd@H{iQ?{6CK`#U;ti?^SdYa)gs@{thAEJBVL`)6wF(XEs)!A{wqysG z=+um^XAotd%1rXc$&bEeqn9$;m&SwC7BRbN z{0mbhf@)v2oDWkJ^ubWALLbyA>Tnv5RvP5oG``Wi6Xj(4mTK7uQ+OUne;rBV9nF`U z#y6QSBKZ2ATFMIx{55D5TDps(R%v`>$J6*%=9(xc>bt5s(|EL`alNGRh*%mQEaAk{ zc$#t$>y3B`$}Of&1obIuDK9K&*bJ>g!)7XC!zMUs99<$IYDXI1YQBkbB7ca=7fRz_ z8-oap*~(~N8Xu#!LW-sFZKg^D)g#q%K1@;22TQaHeXvwfLK;_g&w1VDYEAdg$~Kj5 zj6ZA#qY<5(K2;^8%3B5PpscY-h;mYYyjsc&3#`AdRfuGTBIg%L8?krzNY7Vw62$LQ zWJZ@{&TL~>ah@s(B{s+Iuz-kivi%ITY=kL-xlsT0J2J<9V!qrtc9;1gg0G9zQeIf# z?{cj|K0^fw3o5|wU z*?Ne(#~*8rK?KGcWwbBjA5dGUx(oNcrb-0Wd(?71Oi|F)>$M79{fMIfD&wD42}rvc zf1gD{l#}hhQ%iYaK_nZr3XwdgC_m#r{0xjFX+6pO_@sF4)5mY;?<$Rc;psTC23SHe( zQ9{NSKjQ9h-rb~n)VveHd$n3N3R2Gl>8~Tp=y3DpCe`oE7ZH37QOi2`LP1MMY86^q zuc%d0{jlRn^?P$o1lMC#y--p;ZVVzYwk4xTQaxcTBCvKQt3XmcX$>CM%IL&o1n*a>WuqYVd_DbjB&lvSUv5&pWWI>t>qfP#gD(`c^meU6OYc%#glUom~t&n0Tw_Y_>BB+QY?YrFjXR`zNVJ*VTyubeOIf{3m+&-NMJW^T%Zce zo92NC9zIf$@ZuyaLk70e4i`R&Bx3>wtR~A}Sdz3iQ9CdRb#a0`@*jC%B+%R|6gA5@ z=bx%8U%%F$+moN#lONjXAzvTp(HuQTF8;BxL_UM?T-0wJ?TywSL}>B1s$Caap~rJd zMvr$<p_-nk~{jP=j{VnrD1V5E3RjA)-hkhqQzmt*Q?@8LdsVy87x8EcG zkq7GL_j{6VKh-V#{Pef2okVEou%hjx9ok8Rc9N0b&Lr&-1=|_AcF?Fj|j8TpSqP&dDwNxHj*?bO}7K3Aqu0@ELN!8^*k z)>b04b!w}&;#M&fY^5FAN`$tO0W0@XNs{&fv9^Y~nE#Rg$OCnuxkCQJlB9d6>Q2Z% zJ-jC5$oqTNR3bEHuF{m%B)^_AhSz)au7QC0fw73dI+~5B&Un@D=Hz~#tlEYwbPa9M zHAGmh$b!`=@)wpQ{bQ+*J4&W^@>~YIlM(kq26X3RNefDn_6gJ$3s)BdKO%9h zHgr!5bfqt(Pdtg+%j=hTZ_pd=0AasC|L1M^_<_Za28R7zD0b>X^R_m0&rw}HZk_{W zIkC$(ef`iffCxSGBQm;Wt$zNEKw6BP?-|eKjA)}Bs8L+w}6qffS?Q5wmTir;|@3fA4pe{6jEq`H2(*1?$ z!Yb^GLb~h=Xg(c^%6pRTEvl=#>)`jL7CMZNZDfcL{T&e___e57hw+Iqh`?A&hAyr8 zyGxBA;6B^1Y%&%RSP!zrngRGfV&Fg8Ap?kz0c1dTp8SO+N&8W12PR=8=*`G~W+3lR?1ycRz9<45}_f_vvZseh~Y{P+TV>q1jegm$OACTR_8W^Pads@ zc~JggEF!QrvdLTKye%K;BwsJZul_|(Xb#y}e96IbL)6#Uu)0|O!jk0YefsGkx7UAO z;+4Fc^;{MPjI0Vn@JSZ5FZ1OkC`tN%rM_6Wx)=spqpd{nMO|pFX+!rj(-oR(K0lszp#-aLiGP3qsW5!FJlpbmDv)<_3lyhL^MDOw$ctgLWJHY16JYk zCotHKc1PN!k#@p@nWRld{(?!%xON4##h)8V+$Qos-TVbJNw=5jqE%sE6w+m1> zx_wo*(1Q83jSLa`eo({+7R+#WjL80N3?eY<$S86w`i-%Oz#7FCJG;zqCBatOAp?kz z0c7MKizaE0qqcBRLS6J`D z&@FycNoDi~5te!O3-s5t;o}gCU1+hR%B0w-3(W`H(4DQig%-(_1j(OCCPEJ#Nk)-H zGHom(u#RE;&J+n325hAr#+3-!Lx#IFNoBAdV-{&IjkFUM$s}zu@)t>3#~US2&|v5#RZNkX@?9TLI#kLe^i;IeHFEZgW?`lM*brY)XhJtOw#?i>J~hzEVX75 zp_w-;rDkYnxtV03*FDw8YkfNjznCIq=ZgjRC=cQH_3_Hm#XJzf!y2`$3r#S=f2&nE zJNSU296HkdIe9s-ku$eGlpm9>T|GAn!M zyxwxswfDGEulKa>8!MMoG=?m!veErIuULrJIjdo%DHB2YIkk*+?dw{FuKklDp77^) z9UIV}{01r5e8_L^SU((8M%eN%dgaJ1k! zpW)UD`iq5ovJ-B13zrBE-)kN2Cl>Cfikw@g8D3_z?@vy9Z*D5|QK_dnB7&nYR4XN4 zvFtP_JvF@LdVkpxmfpr90_z)P>49-msTzh1Y^5ENi3rI=2CU}FUs#f~(<6|v1N-K@ zzMp5k-tTtxsvaqm?>2RjpLmJb$OEz^ya1uI$%c>VP8TQn=}bSKjI{W0wF|X@+R(kC z4ef4$wygT1?dA1Ryk{62+QUAA_ML6$_YCxfBqi*7>|>}FZvl0od2buKn?-$+7js;Z zUZQb@?z%R#2dZ|`SIpgqgw|NL5y9`~%G`6ddjVu~G(0GMj6(!YJ-s=n0HngoX2u`_ zW1FIkzQ!N|V+Un)e21{R@(_%>L+EE7h~QzOTGqi71wFi%R$r`BE-F)S~d#Om=D%}+u9)vG$A4g9j46o?+_MPi0%$y zuqhKk`3SX)b?ri}Lf0-<)M|&ouQP-FKiVOjV&S?wgrOEL5gZ=ZI^1Oz?s7#P-yv*n zj)>ssEY&KuL)gMtL||Q@tU@~k+LehN5f%cdKLvIOWW?J*?fe}=lJ+%$cHtcYS?C!e>=4*T`8$Lp{p$mLAxUv}2(-o+ z5upXt&EFv;>HaFvm7Qe54k1z`ipDj6hmfRwyK1+!L)g-?jR-CIjWP@G5Jnh>2%L5F zR$zxP(ilWwJXVx3${0joJf)19?$N^urP7-wf7r_Ju9OLSS?vVKBa@@@yspQ{Ng{Bb zRm-~22s?n+vJPXLHeKwW6=6N;K;ob$2j_OEZdyZ^10ko(rr ze9`)W2rd1mTGoYD=`xSFT z1UFl#Qlajq9lDzc-AzV*cPD9YMQ!1rxZNH3k33K}zq^xkw^rTuboV5+g!lj8B`B|2 zKM0Ho^i6*9rQsKO^hCp5l3! z=x4X4!6+!(m=qDDPE+p48odLqyW9a+C3nD8dOe;kbO+q|7UfUiJ1FB#nh4To#-scZ zqx?vIQ+l-gbU?8{w>32)sQs9MraGs*&V%T6Qs5kK+Zlxjl&h7}zr38j^y2vv82{dh z{CyieA`ov;;)&jwUf0xs)Rn0_Qsp)Ma`KdsuJV+TGOu5A&8FTPd#V)VZ~zybsd`Y! zs82g?cCz@0;AX8_j)!Sjz<5ZjF;gE^)LGDziumx;P4(lEAAAy`@B7$U>ZR7-tC62N z9TjQ$`)zl;XYR}VUcPDWg>k%6u3+u7^evbCI?8z(2`#(I6_%f#-_yb0Ht zVE<8?RC)8A3HFI401+H~sg`vxMZu_~q}S3OMkS-jSwH!d!R!j}B;SA0JJLH&z70Ao zbxP`-)XS-lQWO0B{q|>1g^I(en>~}Q6NnIFsalSQX;=_vcZ;)^B4kfrMX~JRGf&;@ zsZk>*d+u#Jdjb=2L4>#ls7{bQ1!n86)*d48wp3pKayJpCNPSp#GY%0r-wQacX82E? zsrL^XU?LEARpJcq2=5N>QF-{v;M9q!AEYV=%cH}aM#y8sx0L(Jhj_g=_1xHfot%`` zX~RI`=XqzS4z{>!_CL)d5j^gzmUR?iO3lOqb-WrmnRg$Xe|P4wg6mdbA})v!*Qu(r_3UF_{i~P4H-Tln?k?+f_vUV!x^Cn{ z27V%TVVPoWBZ9`+s&U9M?cwijd?N5K>HvQq;}d~@dBCs1bMGgHk@90D_c1u2`lVW7 z>%hpw+t>7np!ajNY=jj?^=AFo9}!#>ijEUt0A>1+{PpfKA4g$hQ2uSHO#~mmR?GRJ z3H;onRmg?k(qlQcV$}_voH5_$R~+zkU3nhOnCKA@@XaW&UwuUB0=%Vo3CcGX1refn zKrLfY{7$P7#S@C62^K_guRmy>{#8JGx}2tGbnnHKLk z?;Wo^H8l0T;LuSX&r!v@sGGzpEYmDXA}D;L3WLV;$RxTDx?f0=_x+7W1YUM4?DG3< z!^?l=a`~^T9A(I*z-et={_Cks$PaRkG-j9&BKYX0mUS>iK@V1I6?$+pMH#*B*03G6 zH$d(zdv@H}in8aV{TY5nuEO?8Rn~U#YMTanwbN_mVfF*$VfKBz_|d8y4u}S4SgoMV zE!K~n(LTUpB|@wNTgN)wVjZa{8tvyf+Vi}%>DX|?Wmp0m`IiVz>Q(1})V$P1@;h|* zeuoC_tP1eqHt0ZW5D|QBtCq3OpQu&n{K<-<2EEvh1_d_4CW4dQRVQjtq4j2_1xN($ ze#$Mh-p~%~4H4EGGP()E+7Ol`?E|SDn1F$TwIlK$d7v&d-Ss9(_b}C!^`?KB*T1E! z*S|^Lr+4xC%QgP~)B0?x-q>rM$Y_aY;zDI&!w6^A9BlnUgnpT)ma&0btW_AeW<_n! znhVnYaen4!zC4}U9g`6VASj2JZzA|UQRS5p-1F_;4|kX`h`?AzhJM5@m5G}$@2=o8F}Vt0 z6fRSa0B?q~3d}KeBB-xa%Q~2%!1`xeg}%R1Q8Z~@)=86{?j7&X3qMOv1+5k@L7@>c zj|g6_QK5%r)&GyzGqriJ=0{&G>J^gZ{RoSa2>ctB@6Mc%fvvQ|%ptF`H&=0gQq?H|GQFt?)C_I82i_$T7R71x6`OjHFcf6UQG+UUgPG;vD6$d z`rIh0Qqs~1k~YpQf8`oIw*4J1L20(!B0?wR)N*`if_IF1rBG`~U znBAzWb*{$GHF>*cN6Cl8=%gX+VZ&VpLK>`ksDA?u2?{lk?17q~ermZzXrhnIAEtF^ z_ZEu6ABD@}#3h55UnG@B<~K=>j_D$k@i>``OJy=HO#I=R{e_3IXMWZS+S=l~2Hh2u z78@EOv}r4~Y=i|`GG71nM`pZ+)Jv(qq^kYleoar`%dQFUnoGLWJIUPL2%(@HZ|;cT zZYQ;@3r*m1H?2Z%>`CW39U2iglR3MqH_E@%V}j0=1f3%ZdU&e@eMcDL(Miz#Ei5-d zPqwg#5Z2ymIbM(zgm!?1c90?@=qyD{&}&OtC+K>)Lpc1^9<+pyq^l5AEI|)d)nWuaDn*a_g6{-}3~Z$x`h%## z7_bsKD@oeFh_qXzryWKiZ8D&{k12<~(bOpJTc|B{u5R2Wik`aA+`kRoJ4_dbVP6!| zW$!_AW*fR|Rd>iX?&l`i8(I0jjSUfc=pm>7cyJUlu$6Wg8=?whz-qGmg(XS*_px?{ zx@c$QKk~pxpy_^=P15~?>dJ#EoMXta7ZK0t)=na{uZ4j&#`<`8k-R`#04s zoP*14Y>3dtFP;8torAQ)*br41BR>a|wEq)pr<;S3|HuO)$?&JRtn7wDx`Sl4S5`8crluulrkllS%8{u0R`i(qH4gYpB5 zfCv%vZ5_c-i=Zw!f-ydC4X%>!id1^N*Tm0e#IL}Qwn*H&_s_6Mh!Dw^YFQTsi@q3V zk$g{)^Q6lL^vHX92!anhA4@OE@%IJ3KP^))&$7QEcAj%=C~6!`C9>gqJ5_JHTX$7E zh#i5Kpqy!qA%bFqTFwtm(3m~63IjVuQLBMH*{`fAm0#U1mt*Xno1{}Wbi?ntHg=gB z%7~-jm>);iGb|eS3hP-G4H2T*S1s#88ALPFqB%rSR?}=0O!Nia`+;@uT{5WhC4H%5 z5@wI}{m(P~v%x+`1C-13R>(vr6CsGh)sMTEa?jPBZDA9E(bS4@fO(K#L@)*s7)P~Y ze9vK=YYZYVmXJ}N^~&X(X!)4ZO}ULcW*guz&od?wn8zz~V0p$XpDxdXk?;JXge>$G zZLx9@VP=p8tE=TNEJ^yOQa>;Wb@yjlJqZ(wK&v8i=!Bb;ETGe1l=WnVM)@xlr7dLrpB*vem|ti z`vulwBDDB&GM(F(=R1rGjX?y)Dl)1|<@#P1uX?(?%d=vt$3)loo^}*|WC}!3xPiTZ z?{z+c|Dz|L;6K`-{Y2<%GN3yLQ#&Y0+BZ`>um~eT4@dqZ57dR`rETc0VXM)@EwT*D zX@Zh*q+IAQS6XX{(4Kq99GmvW3M>3fzbc3jZx{?(9?3JPwwsK>EDKlFl|J_@ze<{f^&Obbn73U zCLnjL_pXBVRJ_~^N_1-P2HmgbR%PnFo&2`W?3Jk+RMt8PMhPTkASNiQmhlrO-Lww9 zT%{;DaiVPqPVC+7Pw+D{<-}f9&a0ZE4bF@JMs(4)7{-O9Z!@t7WSJuGeaG##ludzHJqC zY=E~>PLTn=t|J3HQPm`r*Z@-k100A6+CeSj13X#l(5BrL{Z9sXx`pHp@M`O6BJ}h= zYS}1A2lzn!_qz`85$4t%;2X>>5!@c8maPVOo>rqX7AV31FILpC0bZz_A_M&MjtuaL zswSbt2AC2U;6O}Jvs%Un_!O-}o0cj1pA7K17Lq%_H(E~odF&uN3Y}hdex~Oi4Wem zSa_o9T;zDhTtAKvkwKYJiJc;Pg9xr4SIfH41pAU_wF;f_f+C*PUMW~UszL4!{h$wa z@U`H1USsB$S^sr!lKevZ;?#=NZK)pqFhA8Z=k;vq?DcGtcX=*l&oPx7g%o>U((TqA zL{NQA-MVM3!%wN$N;@1`65+^_3|KuTe_=_|ev8_HNvMlHiTp<%s0+>aLQ%7fb3Rbr z;^(CPt~L-F;;5~$9w0&+KUT{|SYbr|ssH-hc$NBuBKiE}+#iab;Bf(Z;#>1^viuj8 zJIn_WeEdr->p~Ow@y8-TF!Cjed}w=mCF5Y`&P@4{zTyX@<;n!ly`FKW1we!Va%wpr zrYH!Y(gNtg0Q8IqaxOUW*5udpEtRh~^pYDvdU}1IZG9t%IC9R<^s{I-Iuqd@i-ri% z^j6F9f~+8-T8n6~BCK{>DB>0R;5Nki@ykGi5B3x!57j=ys07hxGJ28~nKMi^{L0e> zdnGv>oUZMT-YPEaibE zR@Pd>i9p#}DaF2}a<8$7z}j9}Bl#WXTF>(3~BLnq{2xnd%Px9;a9QeCrP!?lab2 zBDCmh|LvX>H0qPs)$yfKNu+)|ls4$TWj zB?47`lU7Ex&?54pF^Is}t|;RrV-SJS;54l8!NkkPBm#5Sb}?TuCJ~rZ+Qod;m_%Ss zYZvo1V-kTmQ<)wA{)~K`SH=M4&(2}&8|Hxs9u8N_I<=J-?1+xkD(r}kQq<~x<}Y=J z2KK)cWlzfZ{W6(<_}+cqE8f1TROgJ>d0NTF^b%ehI7}?V@+XUd2r5g|&A_d)-d6Jb zx>~vZQXNC_Yiv` zWE`397)xca9itujSVbR2GLE+B)5sH9*Giq6aoir)zk&K<=|&T`ArBcx-TaJ8(!Dv* z6{P|hM^;kY`5Bj_zb4R6&bTPz$V<@Yk_m3cC28LiXcx~oGJ9CRN8_5GaY;TNP#^C8 ztwEH+^0s9g5wh(OM&&&BxgjveR@z~Vh|sTOGzdCg{=$-^{Y21W+B5{F$b!g!rLU-EU1)-t{kB$NU-Ome{LPfrxwWP$$@0$t01p? z+lBWi)r*W?%)~p&2j+(ee!fttfmIo=szq)$nXYGZjD;bmEry(^hp~XB$X{5J^uM7# z6050`>V^z>CnN5K3|OrQh0PL4Lk`&Kt#Jr3P>>r*+$QosU1(k`e_=_AxwGlQ3fd@z zblHQ@yix7=lBC;Bb!Q%x^g-lUhx=z6CnB`9TDg_|O6Bo1y}W*F^b5Zm^vM;C-KK_Q zAv$LYhbRZzE^@N%BU2}WdVjU7gDDEEH`gkp{cuHPx?5cC>z&{$WmM&WhX3$uD~(z; z71N@m3gd#)iWe&CCTOCbVDBYpukP5|SI{&?gKTU0>E3;r=Iq&}ear6g%EG(AG>r#{ zQCR+B4In}TMrw?Dc3$q7>M3_l^&A(SonI1C<^5x06M;Qe+3ts~kb$kVLy{6z7z0+< z$zNEKw6~>pU=r#gnIiv@2Sx(Tk3vzijB|F5TAXk_Vn2udH)}Bw+B7+8ac~E7$iP{h|Hkfi67?ev$1G zQ9y!4Ulck_xp2^e3=PVs)-yzC`+;iN2n$SuM*Y|C=X(=V(^J<5Us8=8FyQX|J~KHY z$jwv!t}}TaAer}f;}LNN2gZrOxZJNzOrSC|Qzej2;LsX5Lt7 zoY0*MY-cGG+YWNN=*3FRRty9Yd@NVXMnT#|=jy-mcmnV26!*oYUTJgm4He{3bT#KP zbMspW1mzWTLj*S~)v_)$!D#$UtFS0tNvF{EZbQ7CB}paFIsV1oq32!I_A$YY7RPbW z2+E%<4kE;{S}kL7{7S13$E}KZRcU1uhkvL)`M|b=xL4WmeH>nb@}31jgdpxz%UBTi zYZZc6rzkmyRB4G?Fy8RkQqsB}xA&>f^ZW^Q?T*Em!T3RY;#KSbZCc%X^akv(%TZZZt?@TBD6b z@I_r{y7$^8>AoE3iju_bbtrCVPj)6&lKz_(w*+JTT_|q$H#GNZL-*Y%ZW&LnL*ohU z{o2s~DA1RF4f@4P@Piy-tFiD9VU=b(;A37Jem1F}+r0;Zb*9)c|F>!@^0BG)SDRWy z$b^5XWgSdWWSl&?E-i}*rdEj}XKL~O0G;1lV;2@&WAS~}_!?WOYVdNX)6{?26eL1W zUDUD>rU0h8dG0g4Aisja@culIpOO7=;LwGnL{xaT!@-5P@+%8D&|oY+7zp zc3rf`-6eD+?>S=*@%W*?cN_6v7x-WlVeHs9 zGNO1Z7&|ogZ$tMc)x9;9^r3tPo#|_58#f~OyF%H#h)ly>;fw`8g zan84e3~Z$xMuP~wM+U4G$X{5Jv>%N1RH%!diu^|&s0+=LLQ%7fa~@@Do!c?Cbr@Z& zl|*RAlVnt6y^86bAw%A2i=H9E zydbMq(E0KgmL&a`VtrH_n4-N=3`7_O>O%9Xz!Gmsx^EQiqpsFcBDD0KcJ)!YF^RzZ zu+2WAE&7NEeMDBRpcCXTEJ^x*E7(U-3`FQ7>O%AEP*mQNbpKJbkGfe)iO|xo$;i7o z;(5nUrLl;>O39b>07j|v_o5o&{i_?+nS_3 zs9;+o|B(mk=C?ITw=Qg}vkpnqtn{#U5}}==8B5-360*=j+MnzYN7mvB}xB# zv9^Y~7^5f#BKV>%G@CmEmCL5}e!%Qw>{bhd_wXXfpDL zHA#C)tf`?c!jAk$9;ll?tVz1lR98~CYgX=^>Jqzms$SH?(%afggccpbnC54_`Eut~ z<>zv7{t=vgmM2Z>EAN4$JqDHthfid}3g^SZlH_A{tlgn5+8xC~gr21?G`DR-_sBq3 zlq7C1FK%d2wZafuKz(TM+=l)!s$bb9>vb8^X=DC*K&VFd2A-t0Qsq@Tsx{W*MCkFQ zYFP(U6j-0CRrtvKeMP(_gFnEy3ddlZhfp z2b%Vl2b#(+6yV{tQ-u~3oG4(VwSvyJNUwGx-OM5-LZmBNM|z$`dZD5!Ib@Zq9C&Gv z9Zm2}^-&4v7Cn~4%Rm_g`ISXMY?idm+qWm`FeR2L>MiKUiV*y*iUtaLRM9X&Zzvie zh<8)xF7!J46$eyZRP(m1^%EXM6{n7b19hKrQQFih}n2POC7!PblK$?{yI3HNDI+8UG^r z3EJ-z+H)4#eNJdYEi@v8_H^seUbN6&DID6h5}IaNk64zi6v=p&xrg?{EC3<|@Vfe_ z8Qw*{r_o=2hN4%&%TKGtIz9q_R<2Zg_w$nspjT&Jh~VXIwTz9xU$hD%@QEURYnYGZ z!WXhUuW=4uQ$D(ovkg+5ZCKn`haCrptm<*!Z}KK)w#znU4#@3Snc2hlnsd7AmAjvU z+m;)}JofDQEi7Cj`1n*K(x+9(jn5_W3D0F=_eEQDH4&l+Sb{E)zpy0fe?k4g1gj?s zmcJ+lBKV>%G_RMxuq5ezqq^?d9rvd2;nq?jv?@IwYnS^2K}UxUy+BwY#)|Mg{@qE5p_?sgMk1mTbUveINj9JwbChCt<^}7%@kp&9jGXi(<8K1X{ian zQSRwPLl^c}8^4pFk(UE(N(?SDupd~bF;ou z0IrD8h9PRXMQF7FYs^TkLj&p+1>aS4!p=V7_s<+I-zMKoZY)Sud*PKV$gGh+M8h6M zrtM(SydnRErQUj!2+?e#mUW>Cg4x-EnaE(|uuOi!W+%L&>wdzWn4sXHH9PwLu*|{U z$RL{B1`Pi$c2W3uvAi zipqPEZlmgMxntWiaj{xLPJorsGCz1~oCtleKrLM>or%p_jYK|95oY2kii*#~6V;~h zOuVW6Gx3Kih2Y(pNCEUE5!$d!E#ousEUiNW&Q(-oCT<~zAx-_{x83{7{TQ3cAxX6t z{n`X)Wwq#VR$_N}nJNm1-6J{1dY1^1tyIf8n4(}-{!FV7*p-TSm|0|2zT*3j$gF(f zulaXg>qn40+2`@nzXNv?8 zG;deSSU23ORp^HM6*)H}R>@i+&j*pCfB|DqSh+gseD;#io4jvr4vFCKVbvVEQ=w-e zHdw=nzaA6XtB)d1jYdSY zl@3^Dh&&gk*u37+91+1$Kh?@-Xqc(+8{Fm)d@gJ*{_>HAF1(4!IXv2@x zGM?f;)jBlb3PnXyyj`DeeqqtPCz@f|qb5utB1ChoTGoXoNbQ@n3c=i>sLkW3!}#fD z`$C^?_B6jl@Oy_!7yEQWTRCF!h_HVm%l%9tmBDuOa-_eO`UO7S&<=Z+$O{?ypKiE4 zuKggjh3!TXw~0JZH~-U3lJ29XE7Gw~H?&5-MY`;ZCaH5j-6ZKgsk-g?bn~iO!n-@i z_O1!@h6r&yua>Tr?rh%BYUIvFMVN{2D=Iz{-%*>wGx6s3&&0o}l=zL!L<(Sxh|q=) z)iOR4Khrui;2(FGJvzN&Hzl`_zOzN`z>>R)2MBD=(Od86_ha{0fSEz-;S0 zLt8U(U-L@@zg<h!Dpp zwREjCcfP09$eryJVJ70SJ(5L5&-m@AHic*6t?i$Qd#IH7jm<;~V2p^+hF#P$J`<;C z9U8E&qW^X#9%9kFCz@f|-+Gh?(accGy3hnO@o)=fHiP+ZXX148O9a11s&uiLNL$QA zBFsdx-29iyU^{v_(m#g!1!f}cFcTv$WaQ68ZjWm(rM9r$Na8k;2kPd}#3bF5Ojo31 zGm+Nlw@85Oia@KzUsDTCSItP@b1pB18w|>5XaeS>00Sbyhy8&$d@X@OuSrC z@tOD&wJAIkZ)yKb{JBbr-`Gr~0LF+2ZMaG;<1_IFtwRHTsp!9*iFa8v?o6C%JxYXV zeyx^ug0x^J-ebZ1mcjhDGw~qvO9a2`Rl3+rq%CG55oRJ;ZvIPUupPY|>Hm)U1!f}c zFcTv$WaQ68ZjWm}O>JSjk;H8x57f<{iAlQ8nXX93W+JW8Z;>whqDku9nV6*eit28; zW1;hdC)@c!BKUb*IhB1%y*~2WqJ8AIMf=E8t^16V|C@Vl6ay{Q^2+N^eFc4@9BjBB zFF`rPMxO}ke^$%7&;(icsa9bMe6EN`V!>nZaQG15 zM-d9kp%x+$oP5zbL{Bat@(U?xMXf^I#X|hGhL}6kKiJz9LF$vi<@cbcm&+43yL#2l z(UZXuM7$r%R2}u*&@(|f%z`9BkXf~i^IN~5ue zz#5*&a(&G<77Dxo*m7(`%9 zRK`Ft&$Q4iWMC`pu&NSa?Ir_OI!N-4lBB&mwP|3HU{#I$M;@pP%^wB~yd~-GQ?!-y ztd&G)$MmADq#asGgjSM~-^wKIgA2AY@*jDiZhkA1bQ_Dd@hkuVTDkp4u6Aycr`c~PU6)(ZsWCfMf(**N@{WBH zuea0+TBck9-k#3Ss4lRcAwtibsFrmwMZp@pT&u8m`k^A;{*-?Q6) z`_Bt$x&3ESW}@8w(tA(-#wxiSX114M31(n5TPk&wQkBvYsw{xxEH%k8?nkq zdt?_-;2zOxJTSUO9vEGf_`vA+ZtO~n@;YZXc8o-$Tof2o>v|$EZdXRln6BQCmVw@ordn^vxB=b}nOXJ-0&vwR)`V5PxW)TlG#f7esLJPgMyROW;Xo zFo2Ykj6np(zm=i4G0Ink!rQSz7IsCntuQ2$FJQrHmi&b!N#EZAb00GqCDg?Pieeyw zFGd5+x$+m5B;B0q<{uso4=M6~vbB~7tu1epb&9cw!0M66TH*LQ%~(WW^-)&)_ASHI z7J}}+<@=^e1l3x#tb-{El4uL9LK2No)RBFQezC0BjR{*@WRu`8D5qOwM2Kvw){%|3 z$hKFMbk%kTzwNstCM5>3+=3uN5IeOFVmAw7&-@_l?uZ@aCm`jy?9-y#JR!yp*~rWN zEdX~JJi`JY0%vcvY<05i01M(EML1bDOHn3QA#1oU!`6bwe-mZ&scDz5{ zE0a|@dVIXx$ZLg05FkP*b5u&c1}HxwhOYt2H=@F?0-kR~xwdSrAOiJhrRL8r-M0nI zvy4Rq*0G7KQI4;(jYS0335hJ%*Ez-_0_(Iymh0!KXE>nm@|r7cv6U_lnF_QBi@ zN|OGMs2^B_x)|ap1|noAb)k8C8@fMM-3gUdoxG~1diiy#t>l>+BVxY=rc1mYZsFka zIwc^E^>_)&`PL;w=#s0|vMw}1AivNmEKWBm;u4^z4S3sLW{uz1+kEWOGxD=-uTVzb zFED3BaCV#O^&i9Kqu7I&9#Tul-HDf=Jf&wS(4R!myiYA-4R}@vs9+1JitD9;J$3mdwBguwMP9&XLz4AT_Whds+O@PyrWfU z!uyJXQ)v3(<8-V%90{;5l|8gvN}KJ=Y)DwwyLd1^8ZJz zh35SOFG2Z{4K@*Uzf{Xut5Q26RJ1CisP(|y=nok?_k;&F6l=svb4CPbrK;DS%<8L_ zh}+GqKUv2RL9>@y#u_j{tI&W!idr|I?aX@HToJ)lovO(g=+3>^4Y}K?rBJ-r@Dh}Z ztV@WXIZiEO;qRzb2){v5>+maaL+(+R-cYRnFE(dHaJH-J_1~Qhh(1gpK0Qj*r3vfm zOtnP)EqDpaC8kLP&1q^GYrr8|g$5k1sC5JGl=v5%QY`#S%@q+`HK|&A(&u=!MAUBj z{N2Ws2%1aOG8XIDk zi7|-4xKtU%E=AE6qfCUI5?SsAAgK(tV?Fy;*g)+_B)0di>lE1v{00kCF-v zY1$Y>7}5tAevxnX&=x~Vgdru%?MSH%wxj8h{v*^cFr>7@kVam}$RAQ}k83|cZDG5S z#BCxE)Xg8#B;5_BE7Gwcr8W93(q&)d4{4I_i>g~>NH4cJM+8T2E2+?sUSSL(F#gQ& ziwr4kF{DHoQnK8Rl*(W`x-`=Ng!%=Bly(@>$O{?yL(1)O?a!$#Y&Vj)P2_>P`9qqd z`<3a6bZkgzjed)C*%$dknxu=fhH0&dg@`se$9Q~Khcrod zy6P4g(x2M^5y4TTk_rv!b;ck9V;;jVGNiP{kP=}?$#OeVDueCl(nx^7>gEq=lJ08L73tWJ(i;61>9Q~Khcrp|M%67cq`$NQB7&nkl~ia*Z!!iE z822*#B11}B3@H(Ylq|O+r83x#E{*ipQNO^D(hfr!c_AZzNVz?({TQ`{?M4!}i9Ap@ ze@K&bpE6yMjtwcT(QlD1`yzixlXRa|UAdnw?^$^Da1)eY*%%SQ*K5iPMpcc`J7Kxm z7(`&aMMe=nw-}2EtPhI%xz!j%V0=tQ8_$URwK0jn{JSy-BEkaCh@>s@jtF^2R;{2D z(5Mh346TCEk*Bzin5GZ?hH?p~WRT^7 z>gFGSC+WUwx*{Dr0H-zjEz)IQG)bL%6(LD?qw2Ok0GDbjhuLKTBKZ1HdHIX1yYS61 z77 zQ=T+OL~xW*t^5Y>DqF(xl(C4wDs4anZ8x}=+Cj-}@YAM91jP!qtb-{E8eG!=CuneA zMNWgSXkUZ>V2+63Xn<-JYw$D1A_8kDSv~6@%QsuKW&b7SRf)VWDJlxcY)ycxOM}z#nO!= zZWDQ+ZvFz1q`Rx>igav&pf&m}(q&&XNu9euB`=b1Vl&zvfQqh%3wPNA<{ppp;!{o4oMJs zAtOHtxIM1DgxbP(BZ=EY9;ln21WCHbo32R5l7QCew@8YJ47;PV8b<1PTncY-7ySaJxNwtgSo>04R?xG`G<`+}) z=9$zWlj^SsQpeA3UNC!6OYQ6aZeshr9jM3AWT~fO#e!+}Ut_XDtZ7{nn--4O z?1c*#AJNJS=0;eG4bxHPrBkApPy_GHmbSyi)}4Py+aqQ#ZE>wzVf5$b*8eA|x0o6+R~Qh1&fZXZCSjycH!bh?oP5*d%OdzPxiMy;ds12>rnHJy4dGT#m z+uGWxx!8!O=Mf#FRuH*#ng)dxX^jSoy0!{z?y=l@KoJyvt_X`p;ni*FNlRPi9@Bw7 zt;>rB&hJu3*exte>{E>1to{ENo_=edPE7Qa7hKVQueL!t%LeI(iqMiX6x9l9R)lu9 zD5@8Rw-&*MNZ0_&W)yXz3JT0rVf(nP_g2n&nr6Eh4v=Q?r3i^r+M+w za~IVvXe~-27Q*BvW$0=W^6qTm;xFdn14Zhh-J$MiI-mVlI$>Pj^?i!P@om94YDN4D z-HL(vry>l@zZ8uZ^rfN(L0>D{UC>vGrV9E-(M&=ARwUs6c{#+|UD+)>uFoIGT8Xkm zx1!w{MQC?c5!&5JQG=k)iqP(yBDA}UBDA|yQKO))islO{Q?x`-H$^83Dpw?+U^&X- z?ya^JVp;h3bD4d58KBm(3!F7)_R_iAZ70)U&VrWOrE^=bUkobe&0esub?w~6^TNu4 zVaW!pTRp@JcTU?(1S%;;$lC_~4$8_2;sG0$bRMvwo!q72Y-QmCHZ(zYYz<+f+I1j| z;dKi_*;YfT7SvN4La=4ipV1s2fED{I72uw(a`Rn2OTJ zndX8%Jt-=vPcM4Rj^ygr$Ay;jCFOckWVk-<*mxJSeQhGK*D53`D9D_E|G6!J9hbam z@F3M7il8eErieq34@DrAFGV1glp^R#GK%a7l2hbJkRL^^1Su&Z;Gef$Y_$8SO^9|Q zMG);KiZ}#qrU;_lLJ>r}gCdA_Cq)GO^LCt#=M=SRNIb{ccuxFh@#L`a+|(J*S(;l= zpG#~!m-UXP9BF9gDYqA)&OBx7LlLxxJ4O14T!*#e%i0;p+VR%gPD|EK0Bc9V+EMCl zN66ZVVC{skc0%>GDMjw- zdoaOq!a~C%IpNX}KP7vpmxm|$Stf|w7Xcy@Me=}@W1^!qMr+94RY@MSgvMxT5FJM3 zL80V!%%1#jSiOLdfXE(lr3c{<0c1?vBc((N(iwW#J8&Y|!v*#@P%D76&Ir1Tm9dmrzbrh(Z}2 zM1?I#M@71UMi@Q(LPF`&?O>%MK+1`T3ZqTkDkL^A2pgN48!SOjAmT|&RvS)NX{6NN zUrMe>L7adHkQzojGK8pS{INvDB1PawCjS6Gf0NFU;*(B!^zb}t+dV_OE?Be>9{Np zG$H+79vDI18&Gl-0TEIej6HuJiF9<@Kfy3|^@zF;J-PoBXLi)j501Yyf?QAOC4+RY zaE>Zm>Ic_s6WwLQh{(f2!xcJ;(Gy4gY|&Ac8HvgHtkh9RO6EY(N@mp7#r)41t7I4y z7&DlWPHk``BSt7`A6iA1&9Kn0C~|fwHHRS^n+`$JV3|VdBUCB{LMdOa1aBEx$tbCb>rI$)^}x}--I8o%0bf&&z`O^GV<0P;Hp zjP9fptJew$DY}-9e)M-jDl3&hE)ywLBDs(&;EKdtrBcXK@kC@tp%Tlq6JlCY7Zoxx zhLd(6zr5JOD2W)JM{`<{ivk(W)dv=HW12;09U>zcTQytKq(?+V6o^}>4aiTsw6M1G zMy=z*$SwU-TTW)8aMe(tgYJ?qauKYea1a4D^giI^`eVps#VNWbYga$<`!|4T0 ziiX)3SpoleR6BS7R-@o$LHMX6MfiHa1%tKg89RB6!%+ zjv@|0Rur`&$eJQ6g18jH!!I61b_DS$B6sp80*YJ-5>nKUAQ45r1c@o~CrCn37(q4^ z4JW8QMFjk>Zek1emh&a$x>97gKKI#p7qWeA zBC)6A6oRwXPf2ct$glY@fAu4$bOh}E?H-@0NN%(X)`h{vfco8~@Z^GwjRmdv;bB8; zxs!=Axf9W}1@mcoSj`sEgl_83cMg$X+L<3^AgdHpfc}5HKu&%cl1XmZ3+$`a(hd(g zLXEN{(}y-PbSYno;FOb5#34vb9ts#{`8;dcpS2voS`PdN%Xe7IVXWn$tmTM*u>6X( zJdCwGoV7gSA1wc1EyuH#$FY_Z{=ssE9@v7DSj&@H%Txcsay`~^GHZDTYdPf~ESs~I zQ(4P%Sj%%YEbAC9{#+VK2i1QQv(8tt&R4O{*JwD`->!*Cch>TH*763{@}_^VtQo~v zwmThUJ?&vV?PWdfqo@_BzMmqv5@b@OY0;4VzAVqH)D{dH*C>KP<2pqgf^JX*-fvL^ z-fvPwfYFjXfpRFQ)Kp);wbVI zmOQjoDtv;aVeOcQ>3Y0vOziz9TQvK7UZZL-jsYQUZ@bi^xj?8cML?(yMPh<#Q)EX_ zEs7ios!5S6K{Y7qM^JT&2rzn^$u>Y!Y763RMiDfC8ATj|no|VvwxkH+Z9$RRXy)M$ z?>M@KhLT^9BFJM-1$hRT|D=K^R4KSTp+Y23NR>)!0lB-EaphJLg+i#Z;#+Ip*b@gv zZ<|#W zG)7?6jUr&xogxlFjuZhaCyIbo4~q0=B^Im1T%JrKmB_``QWbfoB^Ar9Wpb%PE)bD> z{r`~FOO{n{8Y8fBr3hHLQN$sr4@JPrgCbz%PLbZMtmF#vtWF{o3%MetSgf$-NflC+ zNTL$Ud2%^d^Z6rjVD$E#W!0a?2&@KB1gr*9#39I=B49O`B49O$BE4Dhd1ARpL>{Ti zxk9Ox)XJL6mx*Lbo{TFHS(7gKAGTF_C!FufXpF#0P7$zDP{bifNfEH}qX<~3DAJpi zNG?+e$Wvm0f-e^;1biuv$5--6LLL{(#Y)kC$f_>ODv-tqtb!;4R>2f;2nwMHScOpp ztU@W$pOrPAJQ|jWgjNC>UuCVZ7Rg}1kf~&343Y5u%O2Q@Wfe(d1XfWL0jp?=I0Ox& z2w25X1gwTrM1awoi1i*zZGrbu6oL2A6mbX|LlJl%OA&aFqlf^bw{EQWanu%gA5Rf@ zPoRiH&;*LW`$USsdm=>y6xiS$e*77O$CFqIu6_3>lXeqQ8=t_iK|ekL{f4^mRJjk%G0#e(Bvxc{Lt+vstrS9;Qmo<$1y+0!PhchDDOD6>@b7WESK=MY2Je2&=nMw07lb%r~JryQFQ6@nOD#(BJpC{YA%V}dl^J<&8E@GQ^ zG26Tu6p2ZVB^22aw3H$O^xhO~1gmLXh+qvx(81PG#36`zbfa`I33FwZ!zRb_H}$R{ zRggX><5>$8Vlu5Emr|utq*7T)Wpc6pF^L3H9184VEDLeR+I=9aESFuKnVmi<4$v1Um*D zWjP*W$Dk~B3_4B`T;xtt1Q)pz6lq#CWIvwueu~YzI1f8V_yu%7` z#Z18aIf@7{dYi#|zd&t)_lp#PcUTjS@qU>i@D3}rG2XK>Jq%xR~{RmD&RD*C+z- z*D2x7!Q;NX*Gm5}_E=2?wy`5#fzo53j`%8+z`zwk#1ihvRyuYOgyuYD{ z0He2CtoL`+7I@F22)w_ih(pi^ioiQ8F2?k_j}(zZMsF`z?_a1b@cxw|@cxY=4nf~3 z0`EU50`5O3BEabF8|(cSwFTaPQv}{&^(>~>6{85e!|F{8_u}j?kWkc^tsGes^Unuw zs4ehbnj-LCh9V9@WhnyhN9upG8}mjMP|t=Ay+D}lFKFJW>BV5 zSo2jtdwuiEZJINC9x7& zOSmGrL?$D*G%_B!-xcw=Tyj4y;mP!8N9NV!sS8gbB=ck|nOH^c14LwEYGoyqT8or| zzsyJrw4L0Fue9a~V=U?RZOKz<{JCT^&YKbLWc$P~#71x?CmWavQm*hrJMD7v|xxpyJEiXrF`UI z{tAp)hVIDOany^BiZG7$qX@>){uFTt8bA?@quvz3I69Cb0*v0mS?};^Zsups!4!da zABs2x`BDVl;bYv)%tcBOIb`%Umi4Znwt%~mBJi%Fh(nMcMc_SvBH->%5dlVT$*lJv zY74vvQv}{aDB=(lN)dP;N)dPuqlf^bw?(Y?NNNkbM^OacqbcGLG>jtf9zzj$A5IYg zMsFKf@3GVtcppU(cpps>hoCVOf%mZ#f%iCy2rzov&w3wEZGra$iop8>iZ}!%QUu>s_SCT#Ed_t+Ie?xeM)@DjWFmtq$Vyke z{Lf$xDiA691UtaPw?Hl&Ro|GXA$}%m^sHV+6N6R8JLt)Hht`LW)RHgdYZlkC4;GlO zt%8LBS`RG1S7!6uL6b>Pfm}_qp)@z23FKoex^&F{>MIim*3q=Dz7O#;pW=l0quBVv z3q+_H|L_92>h=JSG&27DPl7UW=o|l7>JQ={PZ8)39~{cpAEJT{t|))~Ade>5M6IS6 zgXGJ9G#46cDq9W%*VR}|&~RyFf<}9A+Ucs7Ouaz86xJWsg%l`~9}RkhM#$_Oi+uQx z5kd{<0;yVU%`J4)kjT`1fFEre_+CW4K=Uo32$~Q6v_*UKbuuI0jUwN*Bh6^n)w7cs z`9pwkAM%$y0g+^%;aenYb&KG6xmGVEqrkR`mVy>$+8SCYzpb&i=u(DZ2yMnN)K{4e z)H5ivnIcdI{%A&>2RTGGrqvl`n7^f!MX3zdM?EgkXPZ`EI}07v#hu{*+!+qw0~mpx zMQz}FKlK774^jl&;g6YgbN};+O@o=MM+4rEX!S%gv~F3nG}t&v5%iEV6oIYttSyXP zmtG8S(2L5tl6i@qX8X#nv8k$Tio!6yks2U7X7=Yx|k5qO|8x`j5{;48i9XDkUsUJUU!qcK5kgSU zwFaP8NGp6rYXM>A{D8B9IX}QAbAABP{PP3F(IqS+5D3c%gpENC6uE)F_cR*t_lY79 z7CxJ&TUfZt_;_htW_-L1yv}^p>PIu&AG8!`VC;2<;RxC=9QDcb;=afO2#o3Z_@8I2g) zqySh)VjdXMov!yhJSOd{*iDSnhQGQ_eJcxy80r+6qIF{LLGgE ze=hY03JE9zh1zM2P<_T%aQOc(R4PUM;s$+GtThHKQB>NV)&ljIUJHGd>9t_f*ed{| z5opV3gzZ5N6uE&vX0-*-wlk|OtSph=`_%hB)aY6uSJQZRmRv z6@UI(9!wnSHUUGAr;8x?kT2#x4;RYI{70AV$qSE;+GlnBDV>p7X{7!}bbhTRkVkS(i`f|*mF#yM96hW)O5+mr7 z?Ecy4K-`^KJA_$B;qU!Z^MqQd)iQcmLvumX{2q%uba7`mK#yfOU>&rpEd_-)QGdXF zD@DK^7B(q@J9&smS1i#W&n@!o)MURyt8I*KH_bJiJ;MUnGc3>^rp(mHr(0BroVj}T zGc)U3WX$T?fkub5#(b>MQC;n`kCuiA4^X7;1EbVT!S`ue8rtU^MbJL5R*Uxb>0}lW z6C(Ey4-E+zLH?jSf;{>l34UbA4oK5?!l|c%FMn$`)J3gMXhrg0HqC{Gy2_SAO1flV z=zt6i9kd6ju6j497pQle^`~B!Y2X6n^uD&NA~q%(Ij-6ajZw zbVfUO@=Fc*2xh39eCCXv!6Y%@SDW%$?N%&wRM)x2#0xx`c=hF3oqB;bu0;{>gk^8E z^YrOPzP%Y~*u6|$t=1Y8I;x8u6D6=?qSTjNQ|blSHKz#J!HPTD*{Oh>9sQP|QtNdF z+^ScFfuogHb0nj{WoI>N^1`fJuHHIZL(;l=m*kGC(nuTdcmPp!7lW>INBS__n6Gy-K9jX)Vj zBZxU)BWwv>8Zlf!BZjNK8V#n=fIlfkpb@Oyq+28Wselw#U&B|MND8gSXhj|W`O#Yc zwMYzE5Q!nHuSm>VMIcfzD-tXel`oQJ*9a?+tAl8PtO%Ahb4LkXgSn%GuEE?_|!VQw;Xhy@DRov|5@`=%}vogNYEBF%g0v^^Iv_^_x#G zKK;6+9r={;is*Av4mcY_N^|TY{?&GYt#9Or5++OIYt_at$ z5pJYNT?L3x+Xg*zFD(uIK9eHo_pmmU_I~dW5=kDBs(nJe$oqVC|KR74R+~o)9o5B= zi50pL6RWxpa!~6AzE4pv!0{|az!BD)(#p}ZbN;#)dNIYRFt`VA7qnW2T-YwtTo~)} zxg!r<+!+qQo#B9Wz-Cb!M01_`1Masd0`56lBZQN%7c7xt6zjWMZDM2(Xs+R`ndpHv z6Fu6)w9vrero3mH7v7t+YfDF(ilqW5Y0LM!Fhg^ucK*2lCo5X>!94@edw*bn%z z-+)&i5UC~wAGWD?66g${wfgv0=%}uU-?0&YC{#~-#9sV@Upux_U!};HOHv6(ZRc+3 zLPvGc_{q{Rq4m_IqDpG{4`JS>JLiUXN3hXZ++Fi;I7`H zdJnGEv<6VK&{182FvOrIGQ{*1q(1cmf;6HC1c6293>2i$HAQdoO|&{QD|A#Bd4>d# zXGrKvzBTm%%_836^hLi1T4XJ*2#ez&ha9m@Z}n1Q$b zsfFT(K;{-Ys*6oBEe&i^3e^K^`mpKCbWx*uEYa$Dd7-1acr0LfEGkq_E02B!`{gW&~wFue5D<1O_Edc3Cy^ng`&^wy)m z%Du+u@ky&U5(eGA(pvM$LYYquz*<52>fzZVge;a!o~G%# z6i{Zmdr2wkofg#cUs;-KxGD@gP=#TquPT+OKTxGAs|u`hq_-;ns74K~zEGIjG}mx7 z7*?PL!%AN@8d86t28SXzXJBn6z18R)73mlH?|r11R-dR!3z}=VDhxYNg<+?!Ds8Ag zP^BG3pbD%jrLQVQOgShW-RBBds~1|4{3oEfhU>ua0Ua1V`s&c0`U4$0QUp4{5?6Zb zpnk5|E{nP^^WJ8N}A{L`%~%{5#Ih7btB5Ykr&C+ZJ`=tU6-0V{IpEkvQ4R!T#6 zUvSmxfL0{`xzk+3C19w41Pm2@CFoE6fdt+ZfdsHvSCJCXSEAt_$R{M!hyJ~^9lOMU z9v|WVPwq!FdzFvYfC&@2$!IP}ntz9a^5~k+GSYygj5Jt>v8w%ln9urCe;{cfMIb4x zKxUMrdaRJ}KO$*})_{@pP?~GFq>MBmDI<-(k`AN(K++Kufuyjkno*MKv3$k6!&^^tfqq5y2XdsMi#|gG=rc614%*e00{yMjAJE@H5zvQq_KKvh z>sqYGsuc$Hl-*hbK`Q%buHij}p$t+nl=YSBF!cvg9is@Og2nrcl1h)ILJX4Xgw{Y% zs?#*raH$x|AQeMdU#Tuqe;`#hMIaTdG-#Yue_x-)AgQiu4FsjSL30h4ilGcrF_iU{ z>K^q6Qaz*yq=MxOjgm@_MR5$0>WS7sP^xD%*KnyA${-a(SzoE%P=6p*9z`G(tchrp zRC=sLWRO%JwFZJxeWAIAOT|zIsTj)oO7)BS1F4FU)hL(;cCgT*QBvu#{F6aam82n| zG@5A{nrpaJ3}ujtp{%b|6{$avstPL=tlnspRC=trWsp?WwFZKc)uOqEOT|zIsTj)o zO4We+1F0HQ1ScRY32Bs6dMtEikW@{z27*#Gr@4kp#ZU&R7|QxeWkLOcRBb5&sbHN+ zqomSfbvc8ivep_1O2wzShD*gz2B{dz`buR({ee`r6oFK*D5g9M5WfA-RV=8cV= z)}T>VdzuTf=D$XO66u=RGxC6}j67He?P^P5X5WMQ16g}g1hT?vpGL{5$C`^;Wc}A0 z?%rC%MZ$e(E(n_cJ_CxQOHf7_5R?%H>!4k2DG1t+`U61+QUrp+`kF-vO8#CdjC{)h z{$NV$%^~=O=y3xdgSFbj5}K)$mIfRD{-;k2J5YsTr>`o0GzL&*2t}X@tod1#Dr%pI zV%{t0WEO^Z)REGNK#dz}t;!J>1wQx&$^~on2_<0*qq(4zVec0(>_8QUoxZ9>Q-7dJ z3`L*{tU_3%D!Oi~^;nj~pcnf!$E{ecfsu&mHiqVcbosCPqYS!EGe!cCj*$TCFjlqy z4-J_>{eg57DFW$W2}Pr%(_?Lze)tx#L4W9`so`X;5hBZJG#50?|I;_rLzjk(7N8-c z1=c~k+EUPP7WD@j&Y=i2goPlD(om0;dWeP^FW&y^`!VyhMvHvYX)fqlntclawb7*~ zqYLQC=z?|7uC^5PTuS|co+~Hgmhm)7X+74x`ftwuU0NeVj(cgY;b%Xi1!%}< zp|6IAs6Wu~C`F(lEJkXShI*_*rtve2L4R+n*&B~*jT4nTMRP&P{J+3ORdn@6MiEew zQ3UItU2Q4!#tYORD0!J8P!bkaHA+d*-&cm~r|S=YHKoeY8VFLkPIE!3{67Uo+Pb7- zD1%fCWvqjCwWT1{UFr{{dO#6K1*^asC)MAVDNw9r?> z*VG?q_>Lmb5Z1CaN<%#sM>Oc6!3V8@pj4k}E=XnA&vp!Dkcy$KuT(#&Kak3VEa1gF z;Dm*Djgm_E_Z2A(lBxs^31ZW>m8Q9dOT|zIsTj)oN@Ys@fmD@QsbH00qomSf8Bl|y zs-`s%l&vPsHC!r&GDyWx)>o?f)E`LIh$1)vVM$}-r26~Xs|HEcL~9@@l^M-7Tq=e# zNX1arSE|<3A4p|M5l98=FB>J59t++YB$bucKu{_k%{5#qhB8RSP}Wx}3H1k3b)X2O zg2keZl1h(Nh7FRclh!~`sxCCwaH$x|AQeMdU#T3aKak3qB9IDJwl+#CJ(hMhNGcbt zfuK}wG}myc7|I|OLs?&`yr@5rY5+wb6)eMTlvH}Gr)`i_gR};MQu)$c!=+*kW@ih13{@mX|CZ?F_b|nhO)j=MNxks)o_YHDp(fS zD5>;VLDL|qMrsWNr5a6h4VQ|c3{o+a^_6No^#@WVQUp@L8pcLRrN^?R21zwZYal4q zRGMqJR19U1ilMBpR4LRSNR>(vNCgWn8zq$fuK}-Xs+Q>F_b|nhO)j=9i;w1sv{JERIu*0QBvu#6tzK8WoZorr8-G- z4VQ|c3{o+a^_A*8^#@X2q6nmdMZ%4f>hJ4+8zj{gt%0Ca*J!TcQZbZ4Duyxv9G}I- zyO7ieZI?mtC$0P^MOkqlo&~~&`}LV!lg58it3PR{KdH6GK3`*>de5fSwMm=W>S{aT}Tmhf^70%F%!@xhawI^*C=X5&<%>L2)ad4#cQ8m zKE4^0`BZhh#`>||)g-;v9vr`SsDI~@!(Ucf)+W8vVuyL1k51j*dd90ORSr)q-~9du z_pQI1UK#i0UHX8t>rzim6b4Ue_~{NYNVgDvg$2L2j!2t%XiP#fXSC;mwVsg`YE)Tw z`_Zp2@q+a;MZ0UqHayT@dU(w2z|YHhxu!KcP8VH%R>rGsa`uWBjjN8hQfB^e%Zv)A z4^16xtJ=`n&~)fQJC9+{Hr1+o$)s+t9$OuXN}JE`6j`RyxY`$a^_R6eXgS6){lL@G ztEyEjDotuwZc)D>nWx+;yCkkD`A}h2y*+g{2ZR@G{q8!q-Pv%?#s^uc!P;UmX;J;!}aS5M8| zmHeev1I={L#w)qOQCFL5rmGuXeIIAl?lq@HV+@^75N|fG=C~vDvul>wi6T-#K(zoA|Iz8$1>*FW!#d!7~^4-`(#S zGcYgLXU&cThi?;K_j<=kKNlD9UKD+`M>8k$m~(&IH|rvO6yV?DD)x)ij@+AOEw_m^ z>scLhj6WB4=^K{oxMK9BOAF4-n&Ug%X8i1mCGfaYvzRwuzFNLkO>X4!Jls1FkB2Ur z_Tcfj%nCjSBYtuB@%mmW8x-Gl!!Q1Y34=`&&rR#weW42jt>Drr-B@9lDUXGO)zLvq@vO%w2JDO-7H1F~M?+=^rKAU#C{{yeRo) z{^jA-m%Vm>-F^1e)5h`f_G`p$^;bnEm&kg(GC23ewU!s(2glx@wCC@Ky1}5S~9dIAhxE)pM_D-CTbv$G9o*vot+*OlaEFLs({J^4) zH{ZAKY-Z_i*EP#KzKh=}yCoaDBlF(*$B#sntq)}`NNSmMyQtLe%!hQ7aF1ebrp7HT zaox1Pq3M)MvdrG6V>~p|faxbyot?^xnw&Ck5}#GY%p!hz=Y8_u>ug??OMKpN+85l{ z%-7uSQ|d@>`5<|jBUkN)$1F1OOG-TDrtDP1{L?MJ>9x9VX| zy6?G$4F>NK*E-vvZ?~&=d##$896Wo-vr$ob5BFr3x_YsB-1U@svL}LIVaYSj(jxI!i>%ZVyifnt@q0m=b9+mp{OYgu z_s-&NDbKUc`zFLc`ttGhlj9SjN@6>9bG|gu-2C2g&EsjCCLX!j?r`@zdu#hX@L4dd z*UKY|Iy5*U6#BHE6sg$1UGsRHgY7`e&7DT^q~F{AlulfF#>CX4ReWlB&GcK1?%#cF zxlhkO9XUO(k0^Mld-<@fp@XhDnfAOnalYq6>}N$C|J~|g?`kEkSIy3xslw{LA&Yh!ER=jk1{=Is!hvLhE$)h{U$9GvWu)br- z(z{OXnq9eeTy6QxhqXc!E|rspzD!4>yUo@W31EMz`K&#BWFD66aMoz)=%$nbBfK> zFOnJU-#ojSH-Bfx#258zmD%$2XtA2Frh3Mg3hc3H@aStlFWZ&~bvjonb2iq~Ojlbk z-1(zV$udp%b@U$arg6%^-KTi<-i$~s`!IM)-{d9Bo-A}-;WkCkyz#mKmtwze`23pR zU>JXWU0$5~l~FI+mFwDb_l~i@!?QA7JN8&M@q6SmEAul}?yrXaEO}{BBS{lg+<+u* zr9P(1Z#@Z`_QPuTgA(h0@aK@G-~nfdjcMgXPK)#+lk%n zk1R+?=u|4$VJh}_953D;@O0XDrGNdz%{P@b!*=w;R9MpVgrfKR21V_sgx+oWZAgvJ zn2-C;FI{U)c5Jm`-I|0aS-CmV8IN9V>mPKeTaWYAa_pzdT-$$Zb=YJX?-KfruW+K; zi&hQapq;5l&CPqJJB$9dUwMsp*Y6(oD&&KHBr8%=ufOov)Tze?#jhdH7Ic~3C8fWA zg$uq->jrks-gIzk`mIv_^Oa|DAM-KQJU;dIh9|PD=5_IS^Z7@wkNmOT8&mK1$1;+S zwjP7&rL;%Q#-;8oDNy=-CAQpD>f?lH%~Y|Nd+zxOIHe?6t}KA(tDi@=d+Ev|+#1Kc|(m@HX8)$+k>OH_`s<-Npni_a6CQr)#6O ze+U{@HOZ#(i1_cT&$<cV~F9>D&7EJm!}ZnOuKX*#!?fxRt$fhzQO&lKabC_+NlwB87l#@E1om_s|tZvh8&-3>`ai{I3fH#NJo;Jsn(_u*W1ou(? z*$KyImNu_n2h;Nv%}Q+O^rRf7EiFcLJ=-wU0@H*ovz(Ha-Q9vI-gja8wSk4x_0BGr zF@4+T&zuoq?essjZ@a18lCx1Gu3~y<%P^b%Ar`J* zPD~dyU(lj7reCcGM(3u+zpQ1vI^Rq*y{y4u_bAQ~=o4uVaTwF25eC(G+rC2WJ&P7kRO&c#ZICR$Q)&T!4 zHoX+ZtZTWo3$FcCQ7n8y>bfmlE8B$crkuztPu|w6-#qZV^NHla_d89!m9wox#_HWK z`&Ddwti<$D*sq$3*OU`izsbGp6*cL4`Gy1fPjA(C(`1(}XEvX05%c0+&wUddj*Xts z)O*M2moMLK8XdVryzT3k)$-m`@4xOmXWG$mMWtvT>tQ+Mf%$k`GsW@1xqP*Q`)9tY zs+qrR>@mfx^npvGkIbI=uxb1Q%>P)?u2k2++~MVZ{wN+Vs@$*{c^%eS z3)25qZcvHA)fJWv?c)cP^qZfZdNgWndgj4NzCL(gHho}s(Yb|zuZlX(-?}m{#Ut}J z`oXlQ@KSe}&-GYv zy=^!j#QUY9j&HGQ*#F|@+;mIlCz6JTYGvl$`khoP{L5ubSMXv=S6|mJr>JyBH^DC9 zwnp_Qrtf!KUZ>{ybsdja@bB2>VDqNOy-Hiww$@C$4Gn5Gr)BX5_uCJc9+=wgdzFLr zZkT<@HhIo@HR#lVmLGC=%U4!=`us?vlh3y$S`7Noz3a#a?YF#CV!2)NCs!v0oG`(3 zeL82wjG4veW7<7TP&4wt5`Rp`SbKL_*r4BbO!uVqbvqE!bvLFy^U`vTSX-geK9gpbLG@86BDD(G1IZz=M|a=4FnFva|Vmo`p5 ztFT*x`#{0A*a;N6^alc8!=GzCFZhrK!g_~dXK5I7MKBj9rT)KIGPQ&y_es$IU z9@VXIAMMV(vncoAb@3J~k9IIcKbT@Yn7hGAKK~o{_XmbFCHGytdIE^58650Yn^*;*+m<${AtnRMc=PY4gIn<L8f5%Cj}@JI9qwFKOCi%+KT&Z%+=5n2P(D zp4j7GcI4qZqM^YVWgh-$`^Cp8rCZXZ)j!a#cgJtlpQfa2!}4ecQ}lx=*4rQ1zh14z zmf2Vz?PH4N&@R?bj;)xUu|0kx*2Cji4(pHKDJb*X)5;~tbl<*a)p|*P&X(`Z6b)Xg zSubvcXUfE77td(MYh}{DWxP}W6CdA-^44!nbpEeXVZ>UmZrQE+o*iAK^NW;wZkQJH zKVD~U>&4@6AJgTt-hR6fxXBe$Jg%9(onCXms|_7CRk~p_d{l`~D>e6z4V{_&)?u0n zKDWVq&EuN;SS~kqZr3#>+pflWA0EfF?TMqcA9-H&#C*%Gja|z1kLiZ_m|}dG;&Dth z?X+|n+4$q!KJ4?^N*g?aEZf*dqaUnS&8u4F?b)%Z_?$@7zNTHw$2f2MMfA6Q9a3D= zF4`Xx-D&28VI6y5e%#gXyu}ulO5Df!2HM4XnBwsoS6z?ntlQ{CLb*jvX3W}_xHWop zxk@#qKi8gdY;<1!#bMN-7W3_rcU1S^xbDWSdh4ox$G6y&8Uw#`hM$9XcfT+^{=yG0FNZSirJ@yHvoF8(nz*fJrA1W&E({Q)Bv)$d z{jBAEp0%-dfMBB{B9Ba9%#G@pn9%Xxnu*UMF#Wj{7)o$NOMRv3)~>1^_+w4{Ca^|nE&v~L5_(g-6mh&vjF?O=6fmscVGMaIz{QyyhrNW>+((>nC?&T zDckyBgVDGj`u@&r{y@7&2Valex_f5u=2-_?Ry*Liv|NpD4mImv8`$Moh+^LEUomWY zvuwlu^~cl^VtS$9`{*_wU-ZW3bsrALrzq?v+?4<9x8m-x7ODNFC&dr*7%`(=`N7U* zdgU}+_=8)wbDXII_6JNaG;&LkWz{H)?e1Ove!m$@7SF|f)u53%L1C4u|8J+_gh%T; zSr3kSIXy1&q0NWy4@b;g+v1r;!=Ce&RX5M9Xja8>;q`Ro;LrFz1&&|%97FRx!4|&z zuPkmnIVfxPfO{pXAG|Pnd56kEx0GQxUt8DWnNM)rP)Sk8BNtUGpL6Qm;3{`VyyG42 zvmM`Gs5?UF@hOY98Q+J%;|}jiSe>7LwpCGS(`7+v{Rgh_c)qRNh3AsRCviN+-|+(N zc1_~Xje7Y0M)@;>19qo|zn0}Z-2KH2%aymX|IKgJB^Jx!dlfiO!g`yk25`&n@-xMH zMcE%ad;j7u?VmfX1^Mroa~ldjkM+|J>9MVm<&54Hy$$24c+ zk_l6u`z+q*cSCw-Q-#nR-Z@V8voa^~`h|A)XC)=Kv34JTY3PfCGdE1@FihW9<%u2Tdd}Z248>p(c|dxF;3OCYNk6<0vmg; zDYtgVuGyQSGtX6M{Gf`N^+I02EXx_o>hTj#`~0{Yb5-_vh2w-S_H{DkYortJ@8B=* zC_lEP$xTt%gZf@I*YZWHkKA4N>O-4uo=e(CypEza-Q+|0~nOf2etAncZT-EptHaer*c0FYJriZOvOOLI% zbY$n+y!tm!N#~898aBTRU$Jd7_ksK0@*N_!%t^Pn*&X@qKmYDg+ZDNAOL|}Th;7?F zvdb;buV<#*7>mhOgz3))Pp`N9btmC%lR(QAqX$+Vy5VkJiSGrgMlr{*f4ttfKDtNQ zz^rB0xBZyc#Uc5?fmeq^V&lu>`HcMr(=F4c1%2wBdyaiR{^xy+oO>T)9~{n%%Nf!n z*2VJU4ZO}_iv0lJBgN;PY`s7AU9C;0SKE2IGS+M3eYVt$pFi6^Z(OzH;nA;4R`dB) ztjUte9hUaJ{dr${+j%%%j{9}H-P75{W=4D3FFf36#VAZmI#=j3HLANMmcxG3OR}x~ z=F^QEExGdQ)cpwC*`AS;D*de9cP8qC{kL(dfIpzi+~JsF+}PeLYc{I%;MTgm+`VrX zHgErOH6F+Em~z6_`j!mZT4}S*FaQ3pm05WG$LG(e3yy={2`4?`Rs{L|gy2Wx6~{dGR?O|9cEJ=?rG5~c9Uc)ro3S^ZG!-Kjg` z7E}{$w|EdV_2NqNcY>^j%LBPJ%I@eLATE_qIyblfl?ubVx3}q=)d}yn@VbQQ@Gsp@ zwrcu)QDV%D8Lbn;mmzQOt(!$_KjwYHcEj-m$34_>=(8WQFV-zL6zgLue#O~P>OcdkH2qx zDLg&tuzB1)c`&chu;5Tj{)q1`$G;5gf$cK=%w^wM<5R*nx1KR-s-;s29N(}Vu>FxA zo(E`0@NU(m$IG*07h3oYD1B+?@z?gQwc0&M=3{@weuH|UU2NADeP)+xu&(W~+9z9A z{hmCmY1_8L&&-;fT^!35W#?Pj7GbH`57*#(L#&@azhAUVURnR@$m0?RxyWo7w?=bA zGV$=?{Bw`mK|`J>@0CFmEL(}eIFbLkk8HvCgb)_T6G3f z!Qoqzog2>Wi|1Rsv#ak1ag9y2Q(p|ot@C7s(6{}&AI@GDMa|z@IvjK8Rj#HT>W==f zopC%you*G|6L3K^`7P#Wm35fZ;_Xoz%*W%a;sv!Hj!ij+?akUB?cdGg6>rGJn(boD zEgGG{xbZx2w=1`K>*DOy7pHVxHE>?;m55aDHwQR_Ga5ZF8+*OF*+tF#&OcXXr{4@RyZE3H#7sEBcUDC7t?E9{N5d}_-G2gM~3GS>WlpZuY0+DUMxRm z*Y`a3KeUVG(Ju1D;~3wGzSsIy{^*pqy+iDn>P_87;&_AYh2smJk8j3h_`Ip~{aU-Z zW9F}m**6D|W1Q$8%i%mNvv^=HiLF~ImPfnj2ge&MhjDbi@0gi(Db)$zhr{x7;zn;R zuDaL;-(SLh$1|5W|>^xRyNG~xO4fq=HWRQ z?@H;%6OE!n-B35So&NlNPr~kxmY@2J&c-yQ=leBhF5WvA$9Xp8VRje(q~`yr0H-{)n^BrevP-ABehPiq8cw zmDlJp+Sj+?G)(b0rug?9n-a&ZR6IYq9sOXt?d>`ppBYb`!mywEJ>)F!xkir%27X&a9Jf zNzOaXl}B7|@uQ?yTg`E4Yss0ndncw{RTZy)ez!-j&A-m}{bBktF&25f+f^)b>dN3D z*#4U1bBN1V&-zZqAM~`DGx65V)xDbadwX%}v))OG^&K4=ED61Hzf8`9vrT?Pjo-8V zW=5mIW3m3Sqmw3yPN=>Non1d?*qRyD*Ou^D{%rJv7B3Q=EWP@QLwRk+?B@@Cab4oz zZPxR0_MKIw+Yj6~F7!0!zbtjUQj3w6bB)ax^jZ9LNu3F&(B9Yp!G5{VDE`F9VQJ=L zV+P*-;C0lj&eYfv3dPF0(&aWgr=)e1RqfW{aL&>2MfJzk!+J%GyB-jV+J53|rkXphlZXU3e|8FIyGzQH95Qmh~tz>zA~q%loZ{9tr=y95%f`h4V{HVF8lMRqYjXR*>`*nQOwXB4M;c2?b}Z$1X`#*g&^l(1;!=-xiSDr^W6~$f(Pu?9%l;6o z-=4|eKcw%gw>#`BI4#Rr{v{Igm&Q(6pLqO!MYLBUvfTKNyEnFNTmD1WyxZ;O_s?#W z7=77yXz5dVqF3{6cD&hssdRMU2h&sTqp}C}`88q1^Q{$rFI-a<^Bu1?x^(&|r}&E= zt%f_4{jn(cVD(x<~MC$=w|onabm8C9!k@z~($?b?p%86VQe_1?~$I-**ZNBcLKn~nZbJ>1ZJ$r4_ukG&PKAzX@@B5r{I&N;i!1?&QLww(tn2+NE?qm5W z%R1e&do^Hqy>sJ}b}RdSLtSr8l zD_&WAL5r5_C!B7yaHossy^S@dTz+-5!JHGHlv!C1cC2y!^eZf;+rplIbj3JsRlK~Z z_K_*Uj*U#3Ki&2r<(Bok(UWaH*2MNX8q@l|r^Gk2*UDdI+q68p@zK>oLDYsljTRnG5QQtW8L_eg1S<-+d_@GiHj%T>D-=N`|Q{9(--<>ycHEJlpRxXkV}`#Sc~WY;WAh^P>8#r!Qv(o4=c1;^6INsb4E! zAM|pB>yRbN=RT%~YSby$2YF(<%FkcOE}yj2Z|L{)OWf~!&BT1XF5NqM`fZKz!^rxJF88@a%W@fUCS+VV(fy-cWmPVYOO(? zPF9UOI#9^%8xXs1$JCM&vhg~Gys@91{bfIG>GShl-Dad8O*pk=AD&mQQx?Up8C5d@ z%SQ%W4v7x#&W_8tkALTnDV9h3*v>f5(aaY|Pq96n7T+V|`oN8r?t5n-uains?hqTr zq^R`k#jcOv8=7|M*{~S5jaxM533&rwK7M#H_B`^${+T6e`-SVW`ReiXyVJrv+>)?= zmVIh<{7SXF97D@v+#H9prX3Ex^Tz!bRT?(8>|mCTy5qQ~YVg=E?D)aPd7mw(UI}%q zgS^(SFK(5vuT9#juFYNuCb|t2Rv6T3%CnFd#|C-jLN+>o#d661%IKkYub1y0UKD>E zmoXkZANE#%lC^r=!8UDMkG`ZBSiXzqeo_1#lWt~YZ*J59_3C-{&7%bG+IfbS$N7MD zw_=IyXUVTe207Vf97>ecwi+}bOS0N**>!hL?^;VMw%hJMC%ONR%G{-?8NDO9lWhd4 zxt#s;E{)ln^`h0}s$IP*aU`$mk8W{VIICvvya6r^r;lmmu=_!UtI4iwU6!mAEgaY8 zgqzB?@waBSyzjf}Ui~s<{-gIhUBa+Eo>^2s^5#KPH}e(0^Hw=G+q>)i1X&BO2ggw7 zpF2)f3<&6aug&MV>rMtZ8N&qn^`CqF=n8jQ1MT>)s_-A3P6nzM*+N@qJqS*N5&^CSp4q zdi~UlQ`7#my6X==-t=vQzH!9fJj-h^Pjvasg`Is%@BFSnUZcPL-f(}YbK(VGPG-sY ztrpmC8l5Khr_wjtkeLNpJ z3om{>US`x=9RJTqdbz)J8hT&glXRzfm%%o*k9N(gD2`3Y@JMoAu*hO!NBdf7@n(H@ zKmJe^Y-g56$T#}vaW*U?y2Zq?U(+1xr~!FeaeM^t7f-%Tw`lB_~w3#c>M9f1IZm z``%&B6O*xLHQUSQ`kQ`!arG^>1f5@-Ilwn7sBd>gg2yX%K8oW}_OsnF zsLAX7CHS_e&*1CT-Q9lHut`5~&u#kLx!o<79$Ws|{^46}ceJxCZ_AJ68y3&dw39o> zGx3w<%VS~TTetVD;Vwd*@%{#RRXcbh=(nBZ6#A`k+|*LmfPA4x<33)M<^HVa8n+3P z!+r8jEk8FTH7~B__UY}aw@&S2-t5YdkBj-aFV?NUYPYd-mP7K93O)Un*Zf*fe8ODL z?c>)@DS!Gs(ERG`PZ8ieXJE@*&X@Cvj%W|>TaX9(Lmorgo1TARTloyy$Ll}de;pi| zQYw9O$bG#3T5H=q!?N8lrKbJUicxo8)!BScxp}MO)ayGsq7MB^e(u<4!lP$%s*n75 z$NJ4=j05#AYJd691>L)k8hY<<_gk7gH206mufLd=6?v!)$3AUD^sojPSL2MuA9H68 z66UPA$vbl(!c{X4^o#AG$rt??+W(5uIr-6&+#5A&JV2dYUe}!7I&x;GqWrp#bN24b z_4%rLAZx^te0_IOIJ4ZWr(-Uyzj2A%PUK>iI&}EGqqQYJnj{Y$m^*(0H(*?>{l>?G z>T?%{|8TtCeB=)Q=9~#BX`5T5KMmX6<<)Fi_^8g&<2ud?&ZsP!GkjqZ>NISi)vd{^ z9?8m_+}31DkKjE2<$LN5I<@4rvHXp#hvTPh?8JK911BU0r&Rm)Xii49vG$CuhvS5? z^)>t1|F#|E^ZxOG=$*+21Mj|lJStOCuRON@5+SeWtT`_~*YG{P+ zFaPqwa!8yxFJ`xRZuypvo^S7o@in*kTu*UyZ;#eXW+Wu!<;6!9U+~mo9Bt64K{v!_W9Z7Njp5h z4?b}1R0p4zKLswQey@rjziU@SQe@z-q`-|C8|&M|#lP#k>kj(;a;4?8=4UIVKbcj+ zivQ*G5q-<~Nk+Vn|2nXS=JP$ge_J4UTH>Hnoa?9u~>9GH| zvcZi{p3HpgefR40H*dbD|2ltblXJgJj}vz76>~a0-%_FZJiJff^eo--na!Z-4@`p& z_1u1-JNiG_=kDG+wVXchs5{c>|FHKa@Kn6-|Nl8jNQx+>g-EGHB!w&yq9_qbL{TZq zl1RytgltI^iINJfk|@%ug+vQUk~S)-D2kTm{Qg0ZRqQqC=RN7;@gLSt4ZMHoZIt0QtiP}N)~JPg z(lS_o-f%J18Jfbg->#26vM1z81J-{&H*9QXywy^ie#to#wogBQSGw-P`qEn8r~^Hv z*VIC525)@0;z%Q`hv)6^b@sBR_bY$jT0i6O{yzD{fIR|!b}=FA4-^~E zbMeOIWt5MrgT}XkN?)H2H@7%A;_T)7d<&VfdP&j6_LK8k+kfNx2bkY*;;_5i>MvpK zd-q&62vjRij2z$j?!fNw;;oz23w_cTV@~Jt+vx>;gNJ?E?dP;a>>PjY^s6zuW&cOz^xQw(`arJnw*Y@O&bkmwqM|XnxvH zH+IT#c_k}TOFNabKI`03oR zx#{x*=Tt7MvK{r=&h>!8ke_o^R5mD-Uwb(tKfbN}?$2`u3nO!{dd_b)lsr;yV&YY$ z8={^cyJ?~FQTZeR$=6$>HqMQ=!v5j(m^l=w#*Y`hBhYvt`0kxcQxA9!HBod=UMgJF zxF9NUAM1syw5Z<-S^$-TDeu>$#ofm5mLTm&YW?Xe(s6Mb%W8%Of=7K$cbO( zU+W^y_g=2L(`JYI@u>@fPFA|OJQWmvdwg)Y-i+D=Tn}`a{C%2utFKk2ix}OF)0lz% z!|D0{HL*r%(h_S;alL`^rRSzDR*`Hv-G84bjx*=JxyUn@2UqyK=e5qQdN)!t2HOiP zzqQhJZtJ?kYCb}j1J^C&%s;;~%D1*UH+{kBH;^}+wj+K1;GWXoGBP-Ca_*h`t4)_G z>o32%gl_uNRW_d-m610Br(gI*NYSeq{r2^XkKSIec56P?8}~`bI8L}vl9SAWHnIIO zey22lNa*}l>Krd<731=x;x9e>vWye8uWp9oc=L^5SPB&A1;owW<>-EU#I4yIPMGKT z8H~buobkFp{auLN_gB@9s{CKSxry$^@mh3$RUR+zMse|6zF3{7%(R_bGD3H5xZAif zX7EzOtT}(($E$m`BUIsv^LU*#>3;A09t@c5lTx>T`%e4)wkfB_Zj&!MykVc`jaw0X z*shSZ>yA?zU-mwTJ+9XvRHUzdr+&<@v;C3_l%73W?%F6>`DXg`>`A`wF)uIWGP&;N zF%d84dF}~Y%~sBz@MYFWwNmAd;9G$m>t()3E?amb=#lkbev4&BF8Cs)WAod4=aq0R zeG{C|xPMBPlZ#%tXT%3*Ui;L7iMxJU2uu!5>~FjR>zz6?UMxlDV1kqXV&kWu%=6tk zo)xyrcMRREse1F*vhAin?_W-PG@a>*ZbN**qPpHTBb~KAz&sKFK}bg!O_(=e#=fWwTse z#o4** z?NOs^mAtEtS(@CqRC9P%^WDGl0gub@yySzriVw@ajktZuXpc|1VSL2rnOUjEVOw7g z9r(gqXVC;#^}Y^qF_zai}E2yn254Ku1!Lv5)f~x69gYx{AYqoa6D`S#3j}R;FFZA-9o=91;ooJKKTYA`TgJ@CH*|9y zHFqn^i*K9H>e$SA z{<>=mGNXd-Ui@dzUo+GpK6GPo`Yf=L1YvdDR+y7rrhnnw;3crD=^ElJtKW|=UdX(M1e|0+Ci*7Ynf63wJx$nOu z#ze9P$4xBr*-_I^8C$3B`1v*_aBaoEE8p-u51x)5-wVI?+mI=7M0Na{1%;un7hH4@ z!{ac#9@F}$tDE(XN=LkYsv=9KWINy!(EuK)nU?Uk^Ju*rmFD zzvQH8BN>wEx;5)Uww~cDm3cosIB0ihddQm-h5T=><9U9(o(ty#zCP(`y_o-*5iQzV z0|fAW7v-syr{B`PfWYDV9QiIR0!s|pDw7=@k4w_Q? z--;8?_kXlJ(Jepmtu~pH^BK0d{0!??vFgaxJ9}~Ysf=Iv!Q^P!U|fDw)_SGR5g+C7 z--^q>y8KLd{V}_0eAv zc3ewUWB#>{{_n;I*JHen2)CR&3`t#h=k@{ZkDK+EZLN|Q8=Lp~0Seg{S(0bYQ59JZ~{wDs5@4p)sB+A8%*?IE&X~EP{ zXQF=M<2t(-tHpN4IphsLV;SG3lY{58Mi1!NXSPZE1YUoZImJ-sL(`Kx;=H^M40c%F z#Ou#e`pZlDx2zfVNw|HBtJnBNc%BNE8@%rCpG`-il%ZM2V+)h&C5bVnejS#a`Q2=_ zWK!gc=0IoJ&Pu+WtLOf^(#0+A_&8oa%Pn8<`nz2##BLgy#AlgRjlXZXSW5$!E1XWe zK1+&kx3ls_8H3N9v;1Y zG@ftbyiYE^a2$9fb)Wl#RSCbI?KvnrD}9^6XTI_)oSeRamzl0&*g=u{ieFJ`%C~TN z{JYmfDhEm`swt56yw8&N86Q0)Y-1bdP`hI%_RAh z#`#K}i)}nu()a!N^}bVr&N!9o@O=(gs;xHY{HAQ?0Yz)f<{l?cL>AOeU{+yYx>2z`QtP5e%%Q@q8 zcGfGipZ%n=a6aNVt(gC2>)IJ_F5>Y%UI+hrz>=WE+i&_P3|aPM%9g#gcpd!jW7GGy zZmoHM%iY%tV;dH)HIz9P7VtXPSaYaHeK7! z-Ys5_@4;GppQS7@B5n)QK>*)p$@Nmw+U1oMY#7yYenaJuYTVA~9pLwP%KYJGmT$7? zj&YklZXZ6bicJyyNIe$Ra8WmP`o z+-uo~5mR{rL^k1mx8dxm>uUzrZ{b{rdv-_RkFByB6UH#EWQ@wt87TI0+b@ylF<)@` z$Im^fW;A@hZ4>kxmva%F9N)-&5tY&cH!C9h%J156JbfDPIHAY<<8{4_TJ)p+Q|0b1 zU&yPnDRhLCHY2;}olVHvlh4=hGSGGoE8{I}FS-0K^G7Xn{QQLAV1u6@YA%-Ib_72^fv;2l+w1a&o(bl4 z37lUy(?X^)R=%haKL_<>*oVBxq3y;qypt!l91+_iWHN@g?6_cNbyWY$0wHZ%F^}hS z92}%?dk85VQB(ivIBtimGoC*?wpB2{{mR@4c>N+?|BK5L9#7x8d+E2CWxD1;@c&wV zJ>I^@=m{@$}g?DGq9rFU%mE@K*NUE^4h=y+r8bEgk>rYF;bF~)~FKQ zV2an}>sOu9|J0y1)WIeFn`l<{CaKh6f)m543rCa`yY9Q(X5+cD<;C&SmxtqZ`3Cm~ zRkf~+Yr*|5=epd#yDp#Kdgif9-`sWZdKla;W=PG=KJF4GuVnG;lg@$ta?2}D2&i4U z{h2@UvG9h%?e@4`JR*_KzgDVV5x0xV`;w>Ve=j}~$~(OJiQ)$}+%BHpeXB`A=BOEd z-VV1f?it05VGnOyP!h{n;QMA=*#G=tJ&*W*B|e?iD?6U97hIp8IbW9-w|_5p3c4~37#nb00{w?OyW{dNt)WQ+ z-)wH!vtZ@WzJK@k!9T_r+>5hK`jX-2UR-`qj5B}oU&lqA7C0ClIrXbl+V!$;oc`f` z>s)bFfr=fxczl6>$MNU3@6mW}S@0;M#ychR(tP#!n{hjf^HtzSJpW{st95uhjr(QW z7ij~}KM+~|Sa#R&nv|d_{9J(Mf;(g8hJ4apbM5oZVWIDnalf)dG11qdebOqtuhdZ; z*7?NL>0)!?jsv59J9CzY|Fj;rIC1*-clYsiqQu)G{>h;MW_TQeuPb)yA73D~mbv!B z?TEIbL7z@pyF6Yup>*W5OR?Xx4KxqWdUB}$`A{p{VO~qFgh^)c>xudcsN8xNVN>Cl zGi33&{?`v|35boT8g$)gtiv3$Zv#$S`uUh^G=36Izq)jKM0`-PLwfR*57iF@#vO7$ zVG`yMbJP2cutvGn=Ej=$Kh(Ddxc#T~aJ(mtJuiLsq~l$+P2!4%J6pZAHr7Ol$uC

2qF=F2$UJgpD$X7T@M(qju7xa1o+i9@pg0coA9F=?2h zn#LXPX2zR_lGITXL^rG%3p6+=HKAyQjEcMwKV)EJPb{0@1VBTiEZf`1U}^DYxBZ^1 zWlvnGp~(Cgwc=t*0DXYB38?MS?R*Gc+Xa(sU}Pdxts_e2Gtdw`sPyHQKhTVNWU89a zH;zch<3#78+KdxJ#5~RmE!_luZ$&dMTF#4fT?P$!6Tj^jQ4&o_7bz+Mqvfaym|F=$ zQ$@+)kUwq@@gCM_NRpLXGE*6-`yx^?;ON|}1v4pmfZYA1GK@T z|Hbnt8RISVkkWEy6gXD5%xow+m7I+zLVh;T9#z%M-6)x zumZBFzUFfjza?vc4pI8{wfq)5OMWJW=*^hX-pZ!bE_kSkQ z`)B$H=7-JZLFs_V2&#WV)cFmbuZEt_^E(Heoa?U;TtUp<9a~^fNTzt&-`0U=F&*@# zX)=Ts7L#E%>}A6|TSDK2WiJ`P4F%d&q_8NxG!Fwvy&~~8AdXjH(BK`na2b39n=)u9 zt(0cgGeLLrFJX7E%7}BNjZWAc8EasSpL+^tsTi?Umk?Q6|#b* zHDgA$$z*v{y|rYbaS2Lmx=o5rS`rmyC8$n?!^v<8eH|D5yuX+x<9@Onro-W20Uc&W zGidz-)v{mtqX_V7$a=rs><$$NW;P2aoT7>E$a9x9RvU^>lc8YwL|RNZRv|uwz|F~? zry+&nt+7RgW1xv?g`)0fV;Qt-9QUC1KbtL<>2fhj;BsCB-8e?Q9Qx3aenDVkuam>~ zdfxBVq;eX6D)9URpsFb zbwgnH^ghQOv%xO~9y8Ko9eddAMhV+dPw#fz@iq2)$7ZvMM?5Z%!dIg97gK1i8;u9i zGLM$SMKT=0LtOpQa@HFUdr6v(&SifQicf?8aPOZKZ;12^;aKJI3yV07;ijimhvKcV zy@q3;i6w@jE^N#mj|>)r>1;IYr)dOjVY6&F8BZrkI!qbQ#=xF@;B_Tx>biGg?$5f*?7J15g@IhoG- zr19-?yzEEA>1+yp)S(9iY~J(fxrCje_%x}sGjFU|7*^Kcv?G@7@J#6AmKFY zcMxj$!p7`j=d71bmb1YW8sDd*X}_0|JlHbNp~u{G3|*zIs|*GZyUHMNfsTcGiH|4p zJgJ&Y((kps#)Q3_KzRS3OUv;Z)C?u(#@YQfRDt-gKI%o+lBZdUk&sO%iAd2Svv@{zrp6$TLNZxOgUPE&(%0kaLh1de22^@q!v0F{N1?gW`_gHo z^nOGTN}rKqk$k$GjYgAfl+MPpY`9n^5xji>&DN*nO;2!t=(`k|orqfZD4#)6M ztEa~RVwE0&s{^I?q#91?y$O3Oy(fjnO7BgliPC!#K`1>uTneu@O&}Q$MdqVk3JtU) zh;OoJxJ)42Nvukb0mLdj0#^r0?@2YB(t8v3R(ekgjg{V;P7|f~BqEhQieEn^JLu9t zF8sp9ea{Q4*t@fI%X|7OywTj3hyN(=wY8KL;(n~OV3kh@;U2iV(Gr3cPF*?U3qhdX)FO#(56`lj!1cYaLbYO z-;`nrI11K*nM@9}gr;4h=YU;wdd4wKr6S(WFgBLKPs7K<_8nY^en+|w%&+r(x?64O zZENMKZ0l*j5NS0H7y`;DYNr8>FU&ODg1%{ux2{1e((lQRHw!PWzH4fE4YgIO(3J5p zr^D5Z-)E;fr(b7RbT0@GDnG11Nu4ZJ z2rdp+JB%gi3`kl!=&em)?C}3;lb+%ymlstCZGGgBqHTd5SK!)&RB6x|;5Cj)Z;|HR5(qX!oP5QIhWCqtsM}uWP&Z5O~IZ7vk1-VHI zofzLjZ@rRh@af4%`G@5Unl4`5_n^b$ThTKJMZXW^VM7i>QQI>4M2LK1xT{ixSQ9I9 zNQl6A2v*C4EtaBk;0WEU*ifhw?B5~1+`NIAHvLl#sdTNiMZ;C?s~cYxLLCk+)~(`D z2BA!A^*hZ{sXmeL^osQIP+IqF4-lQ=!Y=+G2F$1)9+m{!mP{wBa#$X5jp#ZSltV_&B1R&i{D+o zB#sZo3w%fMN>@VyAp|t(sYbq|&|)#e$;IZmYNcZX3?w5Pdde3cYmKCAIO^pk7ptmc zvT#uFWDYtw!(v&oZ?!+Jva7>kw^}?w=b_5hO7nH(84t&|YBX0in=1WEbKf$^Mf@)L z0p1syrpcySFtBS#wZi|dt|8lY7r*@d07(NVRiF`oHJo#_wqmlni~571D0nD-X77i^ zRwD*fw0|owut-E-BN36EgTZoW=lE0|iwN)>hH23@HWiAOs(#nT?5fx-IxhWD6~tsz zM9Xx^yI!P0szm-2RS>sh><{=*4Z+C4qRxWCPJzj75>UWO4UR(Srtgc)0X}i zgE8Db8$fmHC` z^Cs+lzUN7y@%f%NohIjdo>MXj;-6 zK{L(C0Q7H0QbF9$v(_&BHW3C8>u(XbI`FriRKqE~H(_t3_oUER>AmSRQF>1zs?vKj zK=+~|GMNY{ZaxqN!M4lUQx<`Z+CdL;*AUBjaltk)7B4WJk{iy888j1|M#*wKSSD}@ zbCD)lI-2AesYBqy(7gZ#5bFgHxH|9xo>aqm0dKKvB+}3ecu^7d zhk)YdgYW_fY(_7DfGaka7BA3Cvq`?3CDU<#l24~u1UFHW(Ucj5Mw-@lF(AW!j(`n)bJc%^)0$x;v7eGLHcmV`9qZdHHxxK(}FioMa zK3pp3kCR@~i~4YxW|0pT{m~?XErB%_zyM;s00LJBUci%TI4|H$*xL(uQfTZ2yy-OY z0-i(~dI2vg!V4gvJiGt`o6!p(;M`tdk}j5`WDFg~hv_&Q4U+-1W`V~w28+oko#qp( z7r+2wy#NAN2VTIFYB(?8P1xHDcv5KW1-$7r@dBPi8hQaQD#8mOpgg<)0-MnbAmD1e zKs4-+NPF_$Xfa$ySu|OY1mR-2fSe&T6tQ~&1R&ZA)Z^;H3;0nD=mmTU`+EUD3eCNM zFP%nSz>i2%FW^H(dVzWus(g?~tGI6jmmPpqOszM%P1 zyr5?+dUD`Y50*J2MR9=xN>n*%r5zrrVz_Zy=M|+xQZJ7o0QoQwc_IY1LLYp20M87W zY9EQzM~fDT)C2lRq#m0|BK1&(eRxO&5rCT|f&lc82m+fyA_ypdi69aaW{DsGJtTs_ zW{?O1%3mUggsoX32tW^sAg~!Ef`Iau2=)MsRzIj-4FTvO5d=1aL=aF^A}y~jBLsg= zTBBcGMle5DuP(Qg6=F)vvO)lMpijE2Fg&QTif{OBoedP%=E>vSa+8m7elh&O{_oxV zYR+E%{CZ0jR7V6)$+^*K#l-SrAQnGi)OxR|DXUh58nbZ2h}V8wxlNNp`u(CezwBLJ z#=q>Be~LR%T*_8jjCoRM3R|@K@Xgi#TrzA>^H0z%AK*>kCg{kGDtOwugmg%eUS2@e z_qT8G?r-HSzz=!8gJ63Nx3S6nH+IRk^h469fc=K@&BDUTX5x-O3@>+o(NdrqdrUwfwAm5TL}Uho)9g_0?Vk6>Y3=Qn^1dZ^26y8E~Wiu)+@$%tu~% zhloXq?Uvm`2@9f>5P=0z3yZ*l*l!@PAojx;EcLrV1QtY`gTR7_0IXQzm*A)2@$yH~ zTmkL?!G`_=cx`wyDU0{i1oivR1W{?3>i4P6tl$xOz;K-$l9%5TSUw*1HTn;WZ0TkP z{6x7DXS-2F!+Ka6_9Tx}Py>~2l}&?Aa5xYIKc$DQeCy4Rq7GX_a;$3M$NX_~ zAWs?}dH#8X65p=(`R)KFMBZ4o2d?sV7YWwNfw?_or1zi5rBKM1#$U)~FEwyvN_csZ zLzD)WL#6oduMZD<`AdoZo!m5-z8N`+9NFMT>y;lbsi@y$XbEt(v`5JaB>>R zcs&)E`>qVSPZe9Z%Ztl#B^>;ir<+|i-#%=<&B5@5TuFwh+&!U?w1yIH_V9b#Ytq#Y zP>@Tt)qA(a@8DAE92R8W7R&f4_>7`~2kD$;{G?bXsWyNnTz#cYxU9q@J_BXmp&Q(K zljZyQMemC6MH@tsehBgB$7IXf0M%Wzhps^n@F?T_4P#5=-@nh)e9X9^gJT$PVTi;f z6%4lQU_~(XBhq1wnNCxoxVtssh2q9jOm!onU@(I;zRp>vo%TYxz2(C$dh=Lyfj85D zGz`@}pV{WHVOa-OTQtLx5m87q3Ma9i)eV5PM;B z5*`7_bdt6-0M&9{u0mil9O@vT%qxh8fDrv$%>qIIdI$)C%^)BIRBHht@*rjbApkuD zgurGH5CY09pkk-F*~Q6z4_RhnxVLOKspL{@S&Ykzr!@q%&^joKA&Q%mRp*a9`4Q7z zS9AkCm%%lY0<2Qs6F8E%h1CWAp8xkLd58}i`fmW2@o0HDt3%Ati^CQYtX`5pj;@Ks zaR0s9ALMc%e!{y)(qB8fM4I^06UCa63u~@YLDAwm(O2wRVrEptJ?IM=z$|X!qXLMRSq86 zUNM-0d2?h{GyL3Gl#S0b9~)s!@dnOmD#Z13z6*b2btr-6n_kjxG*QUOhq-UDSP=CDJUFqnG?L6Kt%Qqxt=KG{5_pKdh3)>S1;GYYus3I_Sr~-` zDC;Gncnb%^^6O>`Pj4PEqg0t@H9e-#T9fqc8lp@6)K%HR_(;4GAm3ZnWMmhpn;&n% zdN4(rvl=!cnzVj-I(*v%k=Bv))6KBAIJs6IT~DpLRGnb`k|fYy zF-e!bsFx0B(Q+|@Pf~a-a4}rWW+Uy}X||k9XMNHd2;N)kN5koCn&!hve=-@t6SKpQb8Wq$}&1Fun>Hx zC3kJBO11huh75R7Db#TD9BOrqVpOVSOB2~vrgfNYmAV!-OZBnAnZ@9D*Xi0Ax0lnF z2H{~kP%mspYpl}MxO>{?@e&G<4kT%q()S9BSAux>Ne-Fhuh^jzbp1{qa_}|A=*55& z>hqP2-EUCtB9X%Hys?Hkht!AI8fTMHY{?roaENIVkJ^D9fxCBk@#|Cml#`iMcDT0f z0-FzA)5y~<<%&;QisFN^RQ0KmP)LxtO&c{BiHe-% zP_v_=Ar9Im7#W$#(Yn4@qbD51&HAwWt6FrYaAuCedX_l09?-b}&r3TO3-NtU+2*sr zorzWDHF2{C%M3ew|4FXX=9*&?qa&y;2=t+%;n;>!~9V z1>ljLgHw)*0ef>-MbU__l6fHJNZISK0W_jpF*6M1Do_*JxJ^&}gy8Tr;}BBY7{6^b zq`GCL8CRIi21afeJPkRtZ!b`c*})zBj2k%7V&+5%y&8D7z$Yu{Lm@PVf{iZ)s$2;q zzIOtRNZ?9fGR=B}Q8XF$vvijA`or;XFkYnDcm~ZxA#F$(R#W&VIPtw#XynBATA>li zIL}ApWC(fB8MH&3Eg;1@&L_|XaWNVVXJgU=4X*0Y(EjdfyM0)}6>pNOHMvN7pUgQAQqJcsuAg9-d2TTT@wuY8z{o<8} zQ=Li$_S47DAL8qqmmh!o@HxKu`0oDMR>W0RW#p&_cD%~9>mS&u9K)fQKp2@UXzhv# zMCESxOdyP~9TV3Z+OdM@(<{iD!Hwwc16&=7Y1%*@j3JJQzUteOyLWKg39eIXdmFmL zxgq+=vIN?Ws03l$55`D-hm+wHo<&>q^ZsI*jQh!Qm=1@71*}RVc+Z)1>Hf--yt2GQ z=Iz*SM{?@?wz>(#vN@?g7ds0!>yJghzUEhYrO;l}Nj8RhXaOb5JR3k{G@1?JRCNTs zRa4S%buk%4(`icPk-fOWL)%6PA359YkhN0T=`w=Fdk`)2XgORY!_j1z^he8CZ#;x$ zJ|$<*=b#IV>7X}FN!S8i@Uvkr8|K*(9>iMqk^wZpP6?YNZ&lu~OVc;~wz&zVR~ z?oX4&cpQzBQ8a^QyyNLO2XPL2y^Qcfk~)&UA*#ZvV+LD*aSuYQYzB%5)d2}~0FU5V zASe?6+T=Mfn4{Op;d@T*zq75ev;0e13mVQKtJgW)CrcjSn8Fbk+=1VP?c5t<);xBj z(0%*;OSt2|T9Q~kS3;H|MMNcC5W~Us&6#|{6Oe#0X=iAkuHv_F?hQB8?%5$*ad6g$ z^Me=nL$eW&cDPy}Zc$OS=0QL1YJ~0Qc8H2|qZPGwp%!ffG zP8CX8G)ecc?;yJnzehq;U8fHp)l{~fgX*`ww95;qN=yFE=Iw!_Mkcux|=-f%%D$>&TPSmC}tN|na%!VjW zf4qWNA>VBwWH`)gBuRp&cCoHO4<9yg>)T1#76|-Dgd#6H5Q)CNTW6ObS1PWdnEEye`yvza( zK)v|36xbM&qGrPD3<9*|K`aan%rR8IRmGt%H@iQQUH0N>xgEPNz1*ri&@iS>m%yw_^%13Tj0HnwYXpDAg3an&&>h{2 zr*-y_zk^0mj@d3;ev1+vLvTvTtAS8G0~@-9NFMaEW*S(rQ5wiRCVwhkgi#HK}*uX zi!Y1ERZx>K)5Vbu1J!CXFHaAUGNGOttzP8C7Ohs^xBzT-n-mi6`Xb;m9N0Z7Il5Y$ zNOlQU^-~vK=HJAM6^2=cRAs?oP&jT`7jmK6C07UY%)FR%Z!B3*af;&0s=wQoXef1J zYT%*hrj;lf)Qbz7s#gcC(6<3qDeq|8Qsk`hC||e<70&H(86EU?3!1PfnNAgKAlgSO zYbL|~F8Q;FQa(XLc$Zc~;^M8rP3-ambd&!>NlZ}%gX8Q{0?JroyW6n-^FB_-oJrcl z{e@D7W)Gbr)gJevT9T%*t8sus<%^3(s#CAARP_q33MO^X8c!6&n)fAEW?9FD3Xlww zTwr055q{u!lX}`_u+&iepZ2@-Ws-h(C?l*fEYGXjQptHoJ=Wd$vghQtrmi>Y6C&fhd)8{$s3 zu?2}E_6$}iYKNRo|4DQY52b;#Z zaYpG;RJbDViys2gNxW`_D9Cr`#2A5R>%=tnkLtu29Me4%6xr)+Y#E`ka^2xpHH+E&G&5pMbTKPIGFJ>q7wi>} zM7B%MF(j-iEO5bDq~b1>d^sH&sXHruU#{#baCafrAelynqzm@g(suD2AADjPI4A*r zx%v6v6FkLCPdpk3#r>QTbeTrJg5}0job;UJ!6$E_oX>+#{;b2=*P^zDPd9ln12D;6 zM7-_$#l_1Pf8Ph6gt(vUgHL<_#h&%&^BMFcp4A0$6$ZU-_dZLY=M(9TjIxLd;NroeoR@9VTC?|j~YSnbc} zGm`x(>Uag`zf6-pX0Pz#&-}gBW_f{y3TTp!3XVny1j( zy|+kv>2j83ebPC=$N~lq%fd7orQ<;#n#@lY5!~#LrsL^gJn8qBlVmotN@0wEL$ZKq z=VFus1`f#rqK}G^1q>XLg>*Op&FW91!JIn?hIYd8+T53;Nv8MeT)y)6AZF&VN4Gd4O$B62u0ERU>? zwH0?&6pi>Q83U%_cNwG+-AX|ahH@3C3GGUBUNRmwE%oYx!_$mIchHXE&5fZMSD5G= z!y5)qLk{inIEpblxPzauy4;cw#=6i-ms&U>z14W(>000`b^Z!~P;U*x5oY-TR*U)e zVe@T1FY;Qd6j}rw(AVzTw6usD5{;UQ7mN!ep&Lpw{LMNR7qG}~uh9}xX0t_}Kp*YA zHyY-PULV?2!Xu2mYys~)LUN_t6GUASWoW>Zk^LzE6R2nGY_RGMZ<8chdTmM;5)C|dTjd=x?cGcwJAZD&Md z6Pxs_K&|9H$$Qy&kx!R{@u&w`LdZ}L^5qhGs*h6WIZOKl82xC4?LAqcXT2BAK43F3LF(qjVW3KMjA#` zDkTdCM zt#xu$FA~O=7fCs&%pLT_2`pmO+ovj09Occb9%`G231hxo9e{|0bb zeZWhM`CX|x#05`~7o}kn3^*3%#J6n3mdx!N5(od!i_@fR)2%V3V!vr7_$QcaNMdcWQ5 zYM#Wa%z*|f^_J~GE#uRBUphn33OyYbLy)y3Qx<@>EyN%5v z|523yaf-a=sA|AZnbe7)L67x_On|ha%f#94&;_1pCViw;^;U=Bi=eh}hFXb|FL zV-Vt)Vi2Ou;~>N_MIqOp{qfW-PXnR2``SU8{@M4(6GC~eheBci#i01fU0!co) zcmIvvqr)d3$tCKmdw9p=R}y-cQiYs}Qy+L#_)z^c+iAPKHM<{d&a!J~8w{EIz@y*> z{ayk8zQVM9jcl6v=A^tc-yF~>#=2mj;5z>F*Zz<{#`IPy)5=>o|C_7VR3mb>3Fm;~ zwm95OvRyHU&*VYmHM!whI+rV$?>GU?sKg;MxMoz%GPq@2r^w(McxaQsEzmu$3~s@6 z*xMouX}h#A!x5~sNJZDGvWO!(<-Lo72XgO1qlQEsNElcw~Hf?$3{&4vQgp26@9m(kFdXLF3`* zc|%6MUEYx4=q7Ji;0}62ql#0Fr=4o=PS&VNppcg-7{g&I=1sUzT4(SXzb6l?44&on z9V-dgRgstSufq^2xgi^9yS!e3q|4Q1$ZD56B~iSK(#dOnLza!}lz;ZZN2es%hVxlg zEf>Y_KB>&Vf7Xr*<<$A63LmQ9J9@sU;0B#<;@?-8w&t5Sgm{fs)pA0(e;M%65zRmOFSe3pTSHu)@uu3Z*~;Yh!qGF!rUc&^C~ z#y#0FYrAZx2dX4IG*IV$S(4K?*?#nNSOmd#n?lBPH=Du&clg&#N5$5#lSp~Q*zPin z9TjhPf@WSH9`>-WYgBWl!#Y)E)P4A0R4+Ws*j(Wq`wZXTKQ`y(D6#^~UFXBU$48+Y z!aEA(fKJz16HFF3L`)Yt+G6;FL|bN5&7!R`u2V!?1|Hf(TMXT4Bc+0e=I2Tb!E+6@ zH163Mk<&ISVHSfauVMA)N{n!)i#5$T9W9Dv13Ka{PeJeuj(IdrSh5ZcbF3n6E2j%wG)nUu@wlv$tVhGpJhDDi-57A8~+|3 zx^W1nm#>My3LGK=>*gA9nM&w5kKqpz=b2G8i}T93P7&uBcxV&nF?6Sm^B50Z#v6|r{z0=Yv@sti*j;nMRdfWg~M+W_ws|*2#n3 z427Kr(b8*!7~8GgOg7!D-34xSp_I#mLm1G%NvLEv3``J8l+j0eK_lY{*R4 zFF9N447-zB9KxY@Q0VS%5L4jjIL;|k2_5G!{6XRzGpc5BP8ruJ;v54HZQ>k;?zC}E z!9(+W7DG_vvsiY=X+xC=hQUae!0wgQXM`BxE+aHX;fN8MB&eN6`pHuREsIr)WF$E~ z%JQS9!(s@YK?6M!j7a%W!BNWZQ?D2BhjT?o>`^s5xbr+m)bB zL)>=eIMi{u!xIkSeS*dTz3aF*pi|y80a1aYDMLaiO9XE#{o@em2fQ)vPNs-khctk`OmiW~_*;T};95Qv|^w zmfFx+0mfsq=Qayialal`!ZxcAL-$<0y~h19_sfiMm-}T#;fN&-j9|Mx48zgQVo~4@ zpL1r2bzkh!@lW^2hBd;+ug5R{{PXko-R6&*KhvC^r2J1ze)ejYJmznbb@q_&hVY}; zpNfCHB&F_^AH+9r$XEM3ecG)Kf5kK{1~1=leyno%d72#3?-!TxFZ<=6bKYHK1HE&Q z9k{=K{m(^D;<+3*z)?IQ4etyD!v)V#2V?84j%)eAUgBbnSUf~U+XnULy1Gh2kRT*?02$yN;fu-NDbl7T8s?j=C+RMNM%D!7?n+$}HS?#5gZ{aHKXi!qr%?Ms% zdE7oEYX8}L&8!q1l7Ib;ol`4^e^wxRUJXsL?n;Ub@0pQSS@7r+`Je77OiWqp3Y=V7 zp+d1`H8>|*R;Xrd70P5P7br?BimL7r7s8&P?d0%va`>L_pix>!d}8nuZcE=ed3N`R zZ!cR6eyRYgZ&11;WM|+xK6;}?O%uhId@x>S{lPe!jIt!pqtUoOTJ+Q2EX&5r-Y{DH z-#N5ugd&5|iXq^m*>X4@^u|kg;%6~g4tk5>cri=I!|7t#PbR}U_-vTW#(8fvj0U|? zI*b4^>5T?iG8q8AS+5R$I$citgT*YFrPC-`jt9$RnnsH>$UYbqvf7N*)SbvqhT@_4D%uUXE7P2(|l439}WAX{%kVtjTXaYltq&T5#eIF0IALf7XIUx z(Bd#&JwE2y3VO4^-X;D3Pc$Xp;4!y7edXZd;%a;a`xAEXO&1EP0`ThFAFFkCvEPDg zI4tA+|6FXLy-TA0p!nqSvX}GSmqbH5G17-jIb{8J0wJ8I=os%nH(>$$dOQD*MCblW zAnPrXET*j1et}rM}=GXo$M+|%NUA{iV0)(NaajEzjMH7Mh66)a##>wsS14$@U$$h;q zQ&W`D6Dr+q|D@)0=?O@!_Kw=-yJUOe3%=U+DF$yqE}cuNufHd|RRU9zq-nn2*Gx4r z0}Oy5!F1IG;?UIE&pG;-=8Iw*SHBT&D3l2Iu>o~rG#o2(=jR+flYN@(4+x3dKNIMf zoaKiO=~_PGs1z~DFRg>Ee8SPN0g6XJ=>~~LCF12jF)^4=1zI*x9j{}sjt@CXWx)E^ z)q1k7ht*>qZ#S^e&+n|?LPjRzj}ylKf^P2gp~Cq^uXoYA{`bG$zIzMdBSSkUyL|Yc zVo0ZEgNq~n3M(wcK4ingm@Uni?e`o(mKR;4Ni?N4kQUnd6;$?`v^*Ee>IK6I!6On4 z`&bK3j4@bHten~ST8JfvQy$2eZ<7=<=^|TRNcFTkZ;Y9Xtt?$qtLXDpj|| zvO#fT@mFYz2VNuoM0bRcr+S#f7A5{f4o~y=@Ygoq!|PbZww8+HlP-+L2sjIseO~;f zv`OOhwT%$`kZ+TSNapcd_=((d2FA*n#qPAc$6(m%(GgZ>`jjkiF~en~P`dF0M4kGc=*Q7S_dlCWV_z7>e$ z*M_exGN}8KBhCN&v;v(Vx zI6IfU<1~R64)b^fJCZT!0Wu|*y=A99q%IbZc_I5qk*1Sgd0 z!a#q|2|U92Ih5nfp_XM0Rd_`VVDNjis=e7Ru0MaHIL9MWIRwzd#_ zG*|1tI>5}Ch77>%8X}Kf@(@ch*SAapMMZowW9(^T=$?=mQnXJu+dTgEl+3_k|h}atEY7el?kv_oPWKzxVPz8?Ux)Wlu+#RL;Se;ot8Tq(UW(h zff%f7_ponOd}A|UPWm#c^axf9E7fuc%%>_^<@UwhyJE>;WzO=jUz;ojy#6CbQGJ?#n50EChzt*(mW%a*M^qN9K5h|E}K+@%&83Bn8$}?kr(Y*?y z8U@G>Nk}ykJd_v`WQJ-ek$A1hEkVk#)U}#xq@wjCn-vPBB9eeuD?5jPxRvP$h?P$l z_##Lz*GTsr@kgks3WbidN9+N^AK7;+{>2xJlY_9ORv4Cm-49MtLtl~=UGqhtD3mX# zkP~smsyo>qHoIo-s~%F3l|R{vwER&h^704f5;GWvb>uf~%&iSpDe1uMmS-U_dO1UZ z5%bwI`4fkr5#9&^&52i?k`)-|n{eP#8JaRsp7o}9mz{*>Yoe#KzEvLw&~_b)4X=5^domA1<9leH{6~P&x!+jPHb1a-g9DJakbBhZElnF ztR40XXKRL&b^ee;6E}7* z_>Eq5K(-ytkqA~`^KQjrIwq?PQBDZW52FF(E(TAeyoJC+%J>}*BZL4w zXi0%NJf>7532@YJNTWwlV*`~C-k^$L8bDV>)BuMftOn3RY@aY=|CQu)>5* z;Wa~0kzX@3iU^w_(4;8(m$(#=O0v}Iq(9fyk?_(QSxLsN@fk(l8f$3=TH_NFa2VZz_?6k`q{Zg7*`J0kL%q5Fbx*Azx$FkJV4lP!(7{vf52B5d?G`U-{NnmfAdKRFL+r6$ z79Bx|%IW10mfuVDy0oE?+F<=evH{chTe4g8ju2HoY#&rn@cUAB9F;Ew5(vY;27jFg!Ul;6+iRS3$!#7tV@C%5M zGfC>GwAm->t(&~<1CAowKvm?!<_|dAt9<%`sL?fO6Z}uRz2pZZ(xHA}TY9GlQj&gP zA}#0##;8GUnje@Z#wTbV<1I!skS<0vm@Y;%m@Y;%m@Y;%m?FkMR#{FWsghoEU3_uf zBMPZ(s9?hIFbbhHG-`u}S}sad_jOV}P@EWzg-YWwE<+Vwl&=J`i>G}aGv5yRK@BaB zb4a>M{;EfNM-^*RDZ&YWORfZ$Ay_Lf2|pBLP>o+6#{)KO;p_ui&3Di-h=6LApKY`u|@sXC4tYFIFZTseBFP=nM!}A2xmtQ?%LeVrw zGBu$3GTeZwIijhds)<)$#A_hg`p<$WFF;+qUZAcBr-of!ybY*w@p^$O;?*M;mD~7> zGsrP~ib4y9K%;pQMF9@Yqu80LLNUof2b@ayrE*q>}Uv1ZiJ6$?bocj{nS z2{_CPG-R`MNMkanS_iKm_W@RB86@pbyfXWZuqay52wn(~tXN)yfLO2m+)7gniYS}2 zQIThJREkiWBN38?;u|Jdk7q9Fdw3j|oiiFM5Bwq?DJ&jS}kn|F7`Nm@H3(gNDyDQk2)Y=_-n^bw$TSiZAok^^9p z7SoO+KJo0`<>ElK#pBDGN{2-%6(cO(vZ92=E+;B1UOsVcU$_=l+a8gep!T@RlhPg| zx8U}eR4Z}pPM459-C%m*j!(BgPf@*)H`&8p7Gupdd5AJnRdy2XXv@w?DPD`X1P>X z^)^~V-yK+Pp?u^nez%|z@L>+m)X(F8y-_Q&j!jk_F5!-cfGy0L7>RYb_XGVs5HjAQ z(iPfybjr-^Kyi;wnT;7Ln2%1GjrkOmxnlFaWo&2DLai&MhDGPAaELj}`fA_Q>(sCR zK`0|A205-PG{Y7Zl>wcrO*Of9 zWYT=tm%Wd9x`F4In28Y2HUBdFl*4{$b@&T9b*fKw3ISKu2~SW?7HE+-r{*U4UhCp@f5#DC zMkQ3`s~_fH3-I`LAR=PKI`1 zg-uWfkGSUZyU)q~$NV#We(u9&^DrmxvYQ?huz$zSYuKNLPNW@^62p28eIp)|ZCB)I zZ&!BE&mw*ZVUI>pWJ``nlZ_HmC`Y8p#tG@gBhqB!JT6T(&d~|Rd0d)ooRbrb^SCtG zIHxBV=W%JWan4RK&g0VLi^`UjMQwMh4G9=ySTSqY%ud!-xQ_P?UWkSM#I6;4K30k+ zShH5g`mSv6{`TW6P3W(59$~L+d%ICaL1fQ>dpfWXVp!ZV{_g~RdB4yJ5xKwU1U;Wy zJ+QS;u69;u|4dXOxnf#7cta{;Fy-Jf93?~~+X*qYc$fmpPRQBg*G|Z>(V4=?PRQA# z)=tQ=(V2qBPROy*9gQ3tohfAOaCAo_$3|xg6gwQ<(a5pUnZm;kM|U)Gd^sp}ak&4y zOV<1CW(UneM83vSHw$GfO5X_#Boiq(>c&)?!7{pVdfb?9Ggu+y`1Pmsurp{@1yhaI+Bc08&WZuG7tiZT?pugAoKHaUhhZVdUK_6CyB?R7Y-@x4$czEjG z{jHh?ry;g7uScdT9QcvxvS}d^zW!udjpSNOSu7k!rpv|)i_Veh3T3W564#NW4O?LS z4L`SOG@amrEFbP=bhCzwcU3d3R@v5lC{dF4M7HxccQ=0?ph3sn26%b#kni{N;@vQ9 zK#-f;CM!6!yLkDc4o~4E)I6QOR-OktTs#K7u1a4M22sH3C!W5sil8YCmnRHI#pU>a8z7AEgTi0U`7wtnhwTag(AX-a@n)^j$cVYthUBvB8Ioju>fjZi-oBMxL8Ov z(#66EA;hmOAePMy=4%D{)pq-^f^dvPXq9NqLIMvX2u1JmY?YWP=>EFyLyofKN#AG= ztyoo7gaYJSjUlTyc>^= zow9hytGsGu_58Zjbn}{F(p2SI97}L^Z{a7}Cu%&>l14EU>z(XkqFYiqshv=83)4Ar^*lW@a@Q%VNkIhS*$FVtq0^h+BQVh7O%35)ouS#htyi1@!f zC)GT;7bkpb$|hY(#7e$15hWBaRIzuRuH-l1r^IGi~ewvrvqx zLu<-)t#4|Hn6rEtRrV8AH)8)pXjnZS>IUjCQ46(yB&N_sj`0LH6I~xMOf?@dOwfa( z9#hRnLfk#`;7q4JwO^_cR_({t(5eTJbty zYX$6ptrf8YRtouLzB{azB-sLw>xd$QU#q9P?(ZZ*ZMyHx=uz<-4%RkvIB474;h=4^ zhl94w9}e0kaJpA}!&;HE(@mVPYvHVdu7$J;xfaqY;95wlaBCqgg1s{rbD)HagS815 z2W=BF4%#MY9JEc?IA|g8__ZoydNO|pe#mgk&i$Q0s4vZ=CMx}*I62hZ)j`>2tq#sM zUv+S{nW}@c%~2hk5N7t z8i8%r&O=}YNVxCXFl)ZPHR8pk(4qDJ-&z`5+` zRp`Np-LLnTWA$!yTU#)w~A^R&-zal z`$HhEm>U8{u`a~de3Km zIFRr017pjKHyEP^IiV)hyulbXxP#M#nl~7qG*Tb>pr(Z!s{4YqjoZ)~)8t`(ufov) ziUl}|DR+fl+Cx_q%J$P09cgb}QQ%X}^h%wxuyfrRemU8lktol0XN2T*cSb^=?{~?c zMN^+otN(SbOfRnDw~Fa9{`|qqv*nM$JQ@CY%Ch#yz(u)&myK`JTwbnmSWeMgQ>_os zK+D@fMdV$RkyFz(rScSZO^-im(ls6Rxs$GGN%ifT5?6E9Xl+P$58cwNZW^QGk>$f> zufh!2-s_0tJvv=!_eUpPb_7RfKw8n!Npn3Ts&x&gr%jg+9kyou&_DKDr*v2oA*o5- z52~y>-BVOo5nUFc6yI^*&#>QWDRcisFbByoM6~xJ2?RhQo&9@oNF9(ZPrpa4x24< z1ujSQ8yS zAbRj7Hj8`D(?l;o#l4VoJ1^LZcksrb7`Hbp7goN`{!PxXL?yk4yc)quku?G@ORW(S zDY!=9Tz0$7!@~lq$EX022SfVvDJ?KaIkrGjmSzi7Ql>4CaLK0M^Yq6n=wOxap#Sdr z;I`rTJ-Ip1>O!s35BDUrSm9z>Zgzhp zyNthZ;#j;{&txTpyW>Dgk%MAz9blH`)B*Ccv2;K}nnDN2D>F*kU34*@q42WO9=NI` zgb@le3r)Mg%y@=NQXTQ!1?G}sym(qJ^Ie`@J#L=rmf)|iwdYZaK{vrrG2JFeEGF6n zRmBvWAmNhD;VxB@=ITuar{U3eMpaL$LYDVHjU%AZT)mTV3rW%WK<&Nx%(#{s^voD9 zYwa^*Us}pDW1L$j4Yycc^jVFd8Z$oIL1b}|L4HxqU zkWzUX0GH>u0SY-44S>1CXibR660XFMO+YzWb_tN)>25~6IRef?u~CH56lil(vrEy# z6iXABd)h2X>yK{A79WA2)Xd`zvaHa@qb%*{ZRWqZVPp`I^o{T;hKoL{WQP=IA z>cW4EUD*TwV^Nj%bmZZdjq1qcOF{jy#BB)Vk40Mgk|T?n+mk7(I?muVzjA6eq{W?@ zld=h(njfj5r{;vKY+)%MX`7zo=<5Gm@cTn-pMPB1QaMjD^s+{tgo)D9aNG$nED*OUb>v?b`_4hpZ5ei*g*GPZV?Ip^22-Lbm zfHeCxsjhZ6RcHS=6Pw1&NU~Ek(%eDF}l)R_^wN}#u5NwWmW>< zv`kF^%$4~GfRj%W&AX0SHEE&nt+8v-baw>!5Hz+MYi+R)4};92UyYe_>Q-Z{7QJeW zk59-0xo-U8X`Maf@8G>~hsP{#o40r;RSBPuO;%3wu_>3;;n?)0;vAbYS25~UB6@}M zxGYqC+v&LA!dU0uHis2`xZ!=CXL*gu#qSlPX#^`ZzY%y@eH$T>I@k!D%Z@4%D;sZs zr>YGtQE|5R`9XWJ$l*gPmvPzg{hR7rP)fmJXZZO5pce>s0EU($8mMxoSW(>W2=E~s zcB^mDo#dbCBXn{fY&1uU8>5$VLhwO#Z90!vI z>3Y)~2jc_YF>8T?@zD+k;{#qeYt2VH93~}2TDaJxs6#-*8Wj@_&8DEFl4xk7GNPf4 zYKVq5Dj*u#sCsB7KUcVvrr1ZT>TS}kQ&UEQ}i{_NR zYKYaWMPYE4H7X2NK3!D1BG$wu+|*Syts@eA7=^op))-JFiPpML`u8TSD}7R{AEoat zT37n2Ay%{2g~46cx-eMzbXB!31pXSW3rB(vW0%AE+RKFX4)@3fdBaJ9 zyO;Uyuv)HQH>`mT=E@PQ&Ac6f7Q zj!Gv=>!P$jWb^qgvEPdeSmf@bzSKiW z_4QUM|GMk|wY1bOu$PUn3mVeCy1*``)gE@M_qAA{P5<-=vFk7>lhm9IMNZ9;2yxis z6w6@TA#oMREBvj3($?E4-eL5OFK0x>S zUuBu<@Vgrt`l-Lw*4(g2rP_zZTh{Ba*rnoz#mgto71yW}!@Pg<7zvGwGiHj1sz?ge z$HYGMz=E_R7^z|rE22+KgFzz|*0uU$FqKubEk3D~Z7~Uv+t+P*4Ug%dkas!QwWJQ+ z@QRR|vY<$#DGDJ5`{HCAhC2!Fm8Rd_wx^om-d|>Xyugomf)gro(zw?MKB#`2BEC{7)hhws=yWucP;Ig>xd!BIK+zP6G7A?k&5YBrR(vOm9ZT*setY92toI3 zIVoOPSE?RRESiRmEZYaiS!y~eC{kr2g5s@AOi=8~L9nWhk| zDe?<}PKeDKQ`8UD8NNBetINMVbaW!3))#~iWx7r+l8PaonjuB^PR$C}TUWSPuQ8S| z)d^VD*^~0X1>ualoCBh^!=g~jclZ$3fxiWL1 z2`Cd78nu{5MAg)^KKAabeYjaG0@DJLPed8^9-ob7NB01s~FU*v=3R zL%Br=*8)9f-x$JS@cM*sP4Ec@U9kiPF`ZxU5Uv?!WmO2zcEziQC!u)d@W{oCTBDcJ zon_j8Fkq{bI(*9Pg{dAkM!`U*^<`@YQ{A*`R|JBPEd38cp{R?sTq9Q@6wk^`rXmy zoNCF{%?ta3#=-DOYYv98Y{$pd~!U}1)BXoIOW0~hAh44fG{m`pQpo7k@p5BuhFM?zZ#kAxRat~_=myjAo_ zc&qG@@HXLpN)OxS!bd_|g^z@{3Lgn?6+RN)DtsioD*T7l{xHA0yx1nI-TdO><%`!4 zjv?OxrGYbi4oxND&FsSl-VJSmXbvfHit$&2YddE)HFY{?Mm4=XXGS#xIcG*SOFU;r zxyi#m`Fpbe9xpe$7@q#Vh~L1!NK5GW?lIZMhh4Hd?B{qNKp`o{bo01{@MHcOd;s~u z{57*?_-Fp#r{p0%Y~V*=<9$Ldn9I26T@`MFk)y3Zl`ioAoB@j|ezn=95C-n(O#f}? zIDV^ieu)1`V;0`=A2n*>YX4EAW^)bC`Te6t&F1=_HflE4@P^$#aIXJpqh@nG`bW<7 zKW)@(uE+n#x&Eh(ng`)oUhHtly9RQzL$*u*hKx%L4;_5Z(;pC~uMYW+=1#=#eor1q zB87dpUp;Og^7!!AHs7~Puh85I+a#%f{z^`R;15Cm#H{t_T4euIka_Zhru6UBcbSM* zXoq#x+2w-dDj8qx_wX`c{B5`SgYOFC-}6-8j-QJfRK`Q~G=6(7{Au;OKSdkTIWf_) zRTIvZehN3daM=dyr*H!=tE%S0x#UmH?Mich3b#YeC3%;hu|mLTTa6Wd3b#YeC0V4O zn%j}){uFK}n#;Fmq>zW6#y+z>S-A-9*^WV-h^O^tm*u3G4o<~Aj>F~Icb_C{w1aQh zxynQk{IYSyjk8eZnQ^WP9dZ$*h6v<@t3T2NiiUDZ?^G;^%`Wi*r(!~E3Qx%dlSEO} zd0I)FmRG9^0{dSi`&An654+X++x!|l zEa=jXmo#0ooVVsPu7xj9y~jP&pQb<5f@_H1X*yB^Rz3JJhznjxBDB2d{uIamTyXV3 zo}PC*XMjDv)9T{d(F1LxMRo14fDQp75tXz?2KWGnIjU)g9H2!IU^hshZ>;~*PLO`; z!(5*w>Gu9v`oKa9e5FaZ8VuNfdWg=KY>bEasS(xa=AZ2&@D)lweFRxsT9`2yDEvR* zIPWOpr$+qr5m#SXT*=}Hd}UiZ0|97fBn-d*8Ar5mKy~shYUL0+jh`Cv(?{q&Vgl!p zxSL5oeZ)T_j`*n&KYaxE5j`Dx7S>xQQLTD(L7VrfyZWK5BPC>*bF=Cbe$v_=R0ZAMW3G3fYeN6y@eWCy_Pg zk@;MZh%=v{`jF!9svZ8E#4y+Qj;@$&5}75QqI~}71OEHEQx=B)oW#F@C7$9sz)wpI zye9sf#J_hMR5^U$loJbssY$0Uy1DuO&e;c?YF zdd**ZVKS|xA`M!(*N`){?&tXRcMX|Vbn`65$yU2llu`Xn1yT zBi4}Zb2oXWp{J zkJ36cMIe7{!d#`@yb@y50VnC5Hq|l9UQvFZFfY8DqwsJ`t!fdu=C5GoteKe9r>x$3Xo(n&Urk)E+72Q1-#uRNn z7nZnw(-<4vY?lAmFWdwrme)6YG@9=u4e|CV`49qm4KK!$cW_Q2lPgl3q4#q?6L!SD zJ3bSJ#D4r-7-A9{LQ(BmN$89iViF=nerF}2Gh&EIh_p>SD+!$uLrg-`bCb{+F~lS^ zJ2wfP5kq3B|GdinI^8<2MD_9MIpIPfNf8JIy@SD{29P|4q=`;Nj?a^MRrK*I$k@i| zL$cpP2G=uPOE-%qnFPeDG8-nlY+^VtX2G;2KWxe8E6<`)CUGfs8!~({-G-r2hTn!v zVMp%eZ3%Q6lCC%^Z{^R0FS(OH7mkE#ThheHnJYO_Q`Xf3lcG@V*-~WQ9vK&xBV&yl zCo=u*fsC`}$ao^L>FF37kUZ2oB1NegM!FAM?fVOCeBlT>75N%uVNoNbD_O!*o-6@{%^u3eI zowC5v6yzey$>nfjCYU7Z^R%5#$Ceh*oR|qFiTZr(5hQV9CYU7Z^R7pb#EF?;lBmzG z9zhZ(W`aqgK970?Nt~Dov4lF(rX5K^*(bY_wjEOEgSX{6?W9d9TKm_w(|rpBYr7>c zA(!thm~zS%R1jkwpH)??HR)0d+xD>s!KX4(y%iWU~m?D!`4P=6cVT%Mr zw7?!7iba3EP>dG2ncz>$7fKPJP^wQKKYxg?Z(e@UF&M#Y+6?XX4kqJK)cq}0NS;#2GFi`HGqmph1T7@fBXKIFYn_I zS1;e*e2zc=_TdKQ>`-uKy+eVz6c2^Kta&I9R|LcbDB7Z>oK3bm*|XJqKFJ!z@Z`AZ*_w{DTdYx^06mvVE_SlEb2%5f*THcV4kr-9OyFOxD>7j#2XY0NmMK z)E~^Deh*q!#2>!TFM7SgE$j~Id`|d^KbRc>Mcbp!K*32|FURBlbUDa-{oyE?i6Aecb|PPNa=h;_O998 zReh_f_c`an2OyYV1Rs{b2G5U;k--=ndu$7vYcPz#HsTM-SP1ws2!6mIA(_XDd`09t zA}Z_EU48F9dv{f=N36AC#flXXE6~&Pqf1-teVvgIm2+5DWQkaJg&9MVVfO3agPq_% zxfyV4ILdk9Z4pyx(Xl-mT+F_UZ~1QzOP|0mJ)+sRv6Y()x5ctjp8(4o|I>kP!zs^0 zs5!J9?Ah8`Kf9p5#T=$WJUlowAiN*i?~y;91@`mf^Z`5Xejkpa+=KUn=@DG{Fz5N$ zK?s>#=rLS8&beZbT7X5>&==$qXiognB{H zGc~;znx?Cno^Hynss@@S$)2j3lF=AO@c>g1f)Mf2WG;k-noWe@GXYjO``R(v7!B4! zbrKHNVqY~+l)AS`R3$6gCgz%g!i_1iEiBv^W7JUICMBjGqAl>+kleU}!;SKo3NooW z$&_2km%+P&w5t1n;>aXPt5hXi_=1;@g`8_8l}>{bCW;k_q&4?TKw+o2h)D(K(cDL8 z#bleaGZE%$EmR;Ej2b^~7yp?8ve3p?0?$R7XZB1tK$hYoHINVv>~w^Xsy9Y=Jir<0 zgD3Yha^g*$`W+y=u*;3r`&w6%X$y8-!tuk)%#8|Fs`lM2>?+M|oIkx!lY*+J_AFgf zd|y^|B?vUrfS&t?Z>g??JO%ojwKZKg3>4Q7C0X({OAb99n)nd&dYWfhST>|>F9^+^ zrG!024UJHdwVu`Uk!C8UsavQAZDapZk?yPA1;YtiW--Ls+`J5;6<3rTPGnI*N`sP~ zu$0bv!XTkM0E3tc01UFCv(S5kDGY@QEk>HQ-?qWfD~i3%>}{siA%l}CFZcGAv$q@; z%b{17dz;zY42#XAL2$5`&JLtxQ)q8Id*f+0o?KdHZ$JC>6j`yEEbFP*eo_ZiwG~~v zs%YE^sDis(GT<66Ia{jj>e@SGS0{rrn8+Nvv&mVq=Wa@#7XLG4&8_yAvCd zTW%WMY93QTW~b26w{V1F0=o_Mr`RK($(JF-2mj#Md)?9ZwGeISYID}MqN}w4_*@HP zS8H+9$+s4uM6{u+bw@qxh}N|)(JY=AB08-@u{6o7n{fNXoz2|u3U5u|E8I1=HVz~u z&UEARS;foyOXH&EOCg~IwG^IG#IY1MO5RK1$pkI)3Yx0BaVP{#304TcBv2tNlpuxRi2#%L z&+}{W#s}h@>-qs6y`{bkE^;*zUp#Zivx4Ul;SAR!=mHzLLfHkj*sUk;F)rQHOrg2` z)w|Kehx>Muhao&`H-PYCf*z?`WT2?%{A2VcVBt~$Sz*Q6E^kHFhJdgWUo!)>@Bm)g-8rGvAA=NnF&dwHH*Api*yMo9JzEq;Ji! z=h6aup{4Kq)@K^9pD(6_S+7Fi(}pB$sE#b+03bQKcdv1t&Ep`Dp5Tk)237Q&9tXwf zG~(L3lzIfRXz>j*)ZvP&>lub@xVmgfx@YtZ6w10LN!ik}a>c^~oRLmXQRDkor=@tX zF*1kOahx+39%2PSJ9qFbUV4@2lv(l-bV8j*-wJ`Tt`%nrOA6RrcCz&=c#|wF7VXE z5Az!!H!q8aX(#)%!b6iU$ZKYpdn0%K!CrF*w$P(AGrUz2uMPg1`>+>!b9JpI@6vXa z@oq1ANcIUk$7a#j28Vm0uTJRcOj;i-?xnvf=`#k8dj+gk0qGFPPB-FRO{!jgO-8Gj zH7%afj;3KMJqzsM&QSij-D1_w>QsB;7nvX2T?#AB>=$^wDn7-?x}t!^2RUrXvl4-$n%RlF z;$mczY^36F@YSgY7@6X87L>p*UUgUxxQuwvLR4P$ghWy+9dwc z~|Er$g>1R%;T_brXA>1N<^$N{=hzR7Zai02nX;w%pjNw8_6j#1sda8v*D||VxpMlk3}DopRb6jgntY=%0rvf1T`n+a zl<$79^1S;9*2p$k=~Ztr6~6Roqb45XN}Xf|LQk_-`J?7bCLV;x*xC1?{~vEVVR%yOIW7Y&_SAQA!)pX z%@R&+2L;N@;5bweJtDx0k7lrP54HvoNTBXmKn+A=LU`Sz({3~Eq1SY12@zCp{Fmtn zZTXkcM5eS(b~Ev|Y^rz9D&MC5%IK#8ILsbpH4xGbSA*w6E!WU34_+!Ykm;Gar|X(! z$WhVoqdqQ(f7gG0ejLM!ZakgjHttKC=&Qj_E#+53ptSZ_4H+s}S`C4+mP0Ajea}Rp z=^Ki!m^}p{Lk(3EehI>!M``(<;gCeec1L)tG}{sCdYyJeph}w^q0aPpu$YY>9uSoI zqtDC4!>+at4;EYuv70957Ax#0+OLPI7jdDTR z$Y#Y+vZ&3nLtaAKsCx2mA8nKsYD8{UHR##6i)7l$+odYM)ZAD_HY~`46wxdi?J}1bmla!pcWthQd5toQPcek# ziBIgch@5!4y~x)ja^l7hjr)N+3C3_!9wq92kNoK@u%92N5Ah3QxLmswRR=G%rI!=S zqoN1j^4N;A{Ncg!IB8p59ve|Z7DE=5Q9HS|F9(aLz;lw13bV_G=+g?{5DR51*$^WY z3qPW+rE>#CR29Zhv*as6uGS*y0k$DUq@%Jf_Fktzm=<{JXNZj3?GaLOAa4(6#HP20 zr_{*13Au_E2n#Us(bg^E2y0nAOd^8n^7l?RX(X^lnJ97L+WLA?~7oY0rTl+(gem~v`a z3R6x`OJRz6Y99MMn(G2n%v1At=i#XfOtgX110${`!{IIJ0dgkGLnE2_*g$ed$Oe+L zHZ~AiT=5b1@pNtv;R*@RpQVqe4(U6%cNM_~FDMl^!f9k)=u*@ufP;z|1)wvrIj3Cg z!_M=^5q-W&6rK{GD2kF4MG;Y=6h)EAQ%c1-oiAp{eQGwv?_*PpkGo~}F967U32WhG z8}5)(J5p;SNNH?sG)pR88)eES)SVR z`ZBDP%y$`NltnIsCX;c_vfyQ(=B>RSKT5` zwO2btmsBL1ALxWg+7(Aj;IV347-_9SDmpt zn7hu<5w$+Qh^zIesMao!QEKf19i`ST&{1mb0v)B+F3_cFrJ^bh-_sCRiD1c?$-F*b z0jJ;KNNYlmM$ft&#+1qF7c?t+TOrJm`#qza-3lF(8LT_!%8P>3g^hP#o%1u=eAY^n?kHxB3O%~-=)J1g z#h$K@Xl9F8!0RKMO-Jh`n@wBmC7Vre>m{3-vGZXZe7Cd_k07A_NCng#V@;XO&)Gu5 zttC0K%=DYZ1{LfsyX?wv$L4ZKNuo2wx-FuOJTwf5Bl-}5LO;f{CC3Lh4(%z@3}qbrpc&l}MycKWqcbLSxazQDkGxuOhc zyTnzpzwKhLd~0DV)LDI(VJldp2K;uZGW8e9A$6^Ay?qOWmrKEJJDbF#Y&)k#7qjjB zk`c7+oTfvnlXKFI15nMTSy}kL1>E!eTGKIn_c!MonI|yM-N<$duoy)hQqg^Le+%N}T6s5Pu99Tcime&Tdikqcx@{AWv_sua zYfRluZG^l%;$&OZZ5zMDA?=Kaiymrc7$?JRXIM_hUq=B~v-RV(N7iCn*MAvD z^X6u%EnfvT_hhe(_(lm`(r&dY!o5CNDkIkFgLv1yvx+MzQ{Hp~&WcPOB(ywr7oQM5 z47Q^6A`5=(q6_Wn*N%mTm0~P>$hGca!C%iX3Et>c8Vkg;L*`)w9E+sbwOdqCXb4y&Q)A9uJbWFYTwC(@DKQBcV;ity5_&~95- z!v!`AVFg(e7us$4%DBL7Wv}*1njk-VbBP4J>s~SM^@NW>c0QPh-`+dD^7}+3-(2Y) zDi&>>>xoQFBuxHl{4jAJSGU4u!H@f1Xji|&E;OtZX5mBPaH8|rEoXWe1X9m12`TAy z>UQ&7j39T1^Qsm0cFVeMg}vQe(++-DTu18cYL^n*EONFL_V)LHxWgS*L(xC(a97Ac z-r-K9BfFzulVud)#ap4>wyv-XY!*TxvcfL3>pa-(_yjUTRJK>r=2zGStE#lVy`H%B zMEv&N=~b<;Sw1lptL&JdpZ!p+G=gInJ8eG&u8s>v|5Q{_#QdF64m(0e z39uuKB{$s>UP?0^Va!w`FQJ;8O)rUuQpU0@m9(%dLQ4G0qRQlc;EX17G+Q`vg_wFD z;#|bOH^*inA1J)x&51bOguHJaH{F6P)U8$=vv@}n2@g6#Y3Ju$DR8=B?%L8u~C zljQ)(p5^P3>4uuDgz%c%!NI-#;SVVNJ$Harg2rom&MBr*&nG>Bs>Iilgrj} zNQ78zQ*a4{%cSbsFJ)16NTWj26?R?MzL|+k6u8)ZX_VIC%xZ4K;=BA%$r5NXcG6)s zUrfOq?;9EULH}cN`~cpfL4kvBu+&0GHXh;&IMpakT)=+Kv~` zuyn4r`&z7ZHdhPK%tj`TN~5bq%4u~Rcru1k!6dfOjH1%+YC&2JuNE?qeua_Of)HX^ z*D7UQI~j7yngdV9P(jwsC@N)L3qrbIwD?4^wUG6)t_2~)N?k+WLXK?mfL0c-L<>9S zm}SH4u!yJDq7%iG!ns-i?1GjSPc8Npu)`vrmU*xwox1j&2&WEtoowpbw=nVXlz!?ZKg;>OmSBCbeC0S2*oi z+;IU>K`*M`Qn(+Yxj!2}M;AonK@t5o_qk@rGOv>Eb}&Q^RDtns2TO6>m%P)y9W0T< zSX(9~d{k>|SjvVQycg>nL97J(dw0&=B%IEC6eQlKS3BnL%QKuKPPcQzO^2-qJYdOA zMZ*YJq7;?^C`^EhTwyd!qw-t#QvQhJ>**0uQkw1Yte)n{Jv9t;{HR$oBA~$k@p0y=Ob249J$-YGojh+rlbswK5=B3x}BySK$H%?j#ro_#gs3yOB@V zI=2zBjLfWdUgKtGwR0LbJFA_~xY>!Nv#Pm_o1JV}t;p*a8Go2$nM+1_GGF1|b@NLXs52?Ma5B>pkSVVIX3mc>(+@G?o@31A%5CG9Xw^hztZ; zglP0+-8WPPd5Y=DsvOEaqo*3CqJ*YvS<4?BWgyTjL`8imRM^$RzXQ1Y_&9|_*{~x( z?@F;Cjx!5@CH@C=BHmGoHqHTaym>TUpjm`I`{axJh-t-N&v9lFIg9U}5j?9-?YeVt z5X*-8uX7C%&(ay)3XI(A4O3lB~&c~W(U0u9N&A-vk$C_tdjl4?DztPUenrB_Tyh_c# z(avW}IyhMG^yl-bKZb+w0hAHN=iv)`K20_I;zJ*IxRiFTj%&AQV?#}DOm)xi3J}K} zCnvtU=XeE(QC4cD8{R%5b)Uosy+(15=b~ZUZ~1Eyty0yP3A|ZSfIhn=8RhW`pP= zz)CpBQ^G2+$GqcA*ebA-JliU;$God6<$YDyW8QHdY88@+<-RKH*+7NEE;D%R!ubS6 zgGk5b=YI)Oq`FFw>w!$+w>fcNjmfnBN%k$fjBDt?tG-RY=on%~c<-T)1_2w~9kz?H%1$v)Vw#;|I~$X*VxRldXIQMmjSV;eIz#@; zY(D;ioTrxs`ZgXq(OWl}%PTI;h2S#=C`*NUV(>^6JPZP3K3A5j_AR5_;0HMR+Q`Ss zH%78yu{vV$R2#j2MMmN3$i;K-+Q`Md!{Ol?HMcf$4Q4qkS|wjC#AxCHlN=Tc#}zHI zTRKg~*e#_dJM5NHlL>Z9DehCX^>s^$7~b6fgn}1bd@H@N55h`w$Z<_Gdqxmm**E(7m%t=;wv1i zC9qm@BA=rNxuEL}%YY8z-mne_b8(C|aw0sGtraema2Zy`kvg zf^{>|DvGxH_-VB?Qts@&7Gw!w)Z(mHNi9eN8?EA~eIuftk6MrhKH@2oJmXTdjar=D zvO&aA_7)8F`FU^buX+At=t0Z;$$;T?$e?-td^2KboXkojUZatFIW#{Ld6&pTq}5bEVv9&%+@MUt)|Pf~iSWTBoE zc)q1>?}*(Z&iO~|7BMe6Vz;OZ{3CXYnCBg_N&v;tTvakGS$9!SM`|FOG89U)ELVn6 zyS*cJi#X>Wv0KEv=!o5-F7S`oEn+?$u@DTWB~suW=D21Xf{pp;83!s&5*OzzKKDTF z%s0NI5yil{ojUlX;pL5}eQql+E_2@iBHQ1O>%TDYUOID;)WLac5}`CF`S(+=LY3}QPl z_wm8O+m=CW2l>0rZ_^*VZ5gD=1J=C-Rkb9;4_qJKObY@(R8(0Gl>q576#18{67+S2 z>KixH%0NQfXdC91KdrZ6hDB3(8)ln7eYatT(@}?y>le?5uHb#WHJ@)`=t0Z*76uGk ze!hjF2UrHgL%eBIAOrYKi=oLatl-(QHM<3d9<;ax1`J#778rWa?iLu3ybdumyM;F+ zhRiL%^}d(M_(v~r(_<06*N{9Ao?Xl^Lbn%4sxF(F68KgiDVm|FhUW*cJ+I)$AmiH| zaP=cVq5JZG7GXdk5PQFY(M^%nQ#c?3P9h$`_SWG9c zeh>Pi=(;+oaRPfYtEEGS6)Pr1kI@yAB5Eo}%?z(5Zn;ln=t0Z$$bjK>$bdHQH*5;@ z(0jvTXmSe-?|^RkkYMORi(6p8@H%AB>=xdP7@FO}n-N2kTVQzEcFTtZLl0Wq0t1HE zA%kYO@Mgr&>=xdP7@FJy!&}W;J|q}=(Bc*tFuV>KG`od2BZg+T@Mgr2xdmMG`f>~p zzD}kAa!~rL>T~%ebkZzeqLAf0e6;ypDq1a^sEZ230r0H7UFfkW=k-Xd)A}MU>x&amOV=8AZj-3g}#Rou^R>)t8JKL5hN7 zBt+K^jD1EcV0P`O<^5^unA~gbczi-I|H|1L>3V!|;7xWt)_U!oiPvoKE!Ra}bJt_7 z*WQqL&0UYR{wBK~YrXb9#Ov4ko9sFr%0&h07f@;cmDJydNRP2%f9c-%TNlN0W&yq; zSL2(nnsR(736%FSDLxx7!XOjF^QJ==Jka!UB8KNdh%V?;GLUgXrNNpzBiF%D=!}q0gH>xoYG+H*==AcZ?(VXEl8$ z+z~GekzH27vJo$fd?*VNi+EXx?6MM;jd)q)vsc23Bi_9dqN^CWI~Hem%u=Ce1o4QM zncRL(z>f=8ul=&nX!(d&L?7H?APbSzN4zXt6rJ!|yPB!>AbN26eun&)*?jy3IZrPO z^ldDmds%^3r0?Tj;3ZppC#TpDZtUc)+;oGEu;&cXd@-AT=gi#6L*d99NQ~hg5;eLj zU*j!3t&&|z>E;g7j&>jp2II2@JKBXfl-lVo&>{IwYa!mE-q9|IxTD4kQuG3)$|=;isn)d%Bci9_Z9om~Mf-%L+a*2PE~C-%01 zo3E;mqHhCh$x&sAUTNdp>t4s47Pm7xrd{q{%db_-^c=L;@@v&{JeK3k=w8dORm<^M z-fKBpwD3lPJ2Nj+0XFlZ;lA;xL0fX67MgL@S_>bqE``$zEqJN5YgNjm7P`w`31t{+ zIiq@1pJJ$m?y_G(Nrqa^wx?fo(EIvE7jI5=`@II`4Bw;V)(UbSX47vR?>qZGeKW&V zC0%kgHB@EYv{Wrrbhq zDArJ1tm_qN=oNK{OhPYn*i3_D3-NT^^_YoBfVD2RMbcN@g>_G83R(Sqv7p;gcF};%=NJp`A ziWa`RfLO4b0sK|pxquC)TNrk+Ye)v40;PYB?llMD+;ZB7$|F^R;tL4d7t=IVHn=2be87haF&BX*yG-7lo zMC$B}nZ}&%hER9LP@Ube)SU@fB1U&4UWs_!scx}SbKvy{o$l`aH!+`wcFb-gn?9Xm6OT5=^ z@LTj?yTLW_V!Od_HsIc)=j|A8kR+tnG0xU87Vj~`@u2NvEp|v-$y#>0Wm}~NM}fDG zwRCvG4o6p$;T0Ua!gsnxRBW&+^cnjHPX7^anXARYDXJE%Mmx-X9lCp(9hoEoE! zH%4!pe$06TxJ0!iqKu{Y>3KKR2m?hm0#grMgk;@NbWiamD+r8G(qs?LyM4b{=2!@r z%)p02@WmNX3=5P|gL-NQhhos5+)40=W=mioGo%;?sRF^6{7(mRwEri9DYt>w4KkwO zZtxWq-VIiwfNt=m3OPI&Prgh)qiEMJ8(dybH#E!jgHT1PCd&bmJ9LdeJmC!2>a*O;AtG4rY=^v_Q_{(|8UMtaI`*@trZeQVzGN z@!}eYkqB@N#NtR8$8>8T7WWK}(XNA7 z+_N#>bK2X;xx*n<1Wcog>EK zl)y3}uqY|gt*HZ7FCJT!YM3EpZF;U}7_#B&vL)%B(K8Tu7fq6|Z=sb6UHV9AZn#P! z#5p)CrBieRtEEN;{A%eCLttOx`P{}Jyu=eFm39mK%5Xe?#(6Bo{s`BbreDzPaq0#L z3V@}vkfm6ViUhMZEiaIK*Y)(!fP1+?AbYZ=&BV4nrz6Dp{u%L znY!Ea@gy4+A_kZC#hs1a$s)Q}QS+J@Y|7sCpPwJc5Fg+g#)_KcY7Qhgc7Nd9$0(d2 z=>(eL;$-8=0zIIaGemWFP5Fn$bVdZzB_x@H+NJ>)_u)M2%VLeqzR1I6qq2pMp7-h^L* zu!lDfDu!JDzIMpv9DZ7mpf5hHsrF^eW1CP zfh1j%p~8f($&gxcC0z|%Q-vX9;i;^Cqm2icL|r7i!vkN8ro^z66D&MDR3}(?Fpwxs zjQ>=D)!6}dP8bp_yvT@xyJ4=V@NTdY1$2WiRY>J3+p~I_C->Aa(2=VehU;mv3kgiw zbWJz#5T1ytvK%aMWVN&j(nQ&tpk6eMP4GYrX%o~_vt!C}Fqjj)7VkE}(m8QrdYkEd z(fBsQ1u?(P(9aBzBhAHW3d^LqL`kLHf|c~?Fhvf zJZrYm8L&lzT!IH~Afn^qf}U&kav^g!$R#tFETZo9!k(gfmTUPv*$rXg30WT5^WDJL zO%&iszdoYo0Va-+#F9MlMMoxvr5sW7@K7C5^I#y3P>lanfz{z4J0}bgH7_!v;BJ^J zD!d!4L;>C4OBGTXRzb>C4SWwq7YNfrs;aADXc(T0RAfN3T^CWaz|mf=;?x`qimG6q z1rA6PWpAS6Mbp>>55$l*K|M7)rf`Zur>l#oJ10&|Z!?`Q8sBEPAm+Cj`k4W8MAV$7 zuuMcPN-FIZUqsDCEsJFtpg1CG25glPH3J-VN?|V-dhV`_s3kvu%^aBW4aG#gULdP( z;D)9Z_Ix<8q~N`u`iPnbm^eZbOY*=M9hn%GazxF;Lv=*WgMm0gG5*sLUmXszbHWf& z^CBY(?uNOd!n?sr6wnR6R3VjNl>$}7!w^Q4@2Rp8^k9XmsXc_uFqB-+@6|=rEO0Fm zH4BQWh?)hiJ)&m8vIO;_X>3CH#E>>YJvBR?W9ke_p#$q>0vb_LLYF~Ai9HAI!ad-; z3?fQQ=rV{XvAAcPmqA2{30(#eB^LLL^D>AiF`>&KqQv5!ab5-yC6>Am5`@6KOu_^);w9goC5L&qD93?3(A9Au4+d)X5aK^o zV093~&Iv;t$cv09xEtn*3hxFhQ9w8NQiW6o1F*J&bJ;MkdJ-I((|gEw!$9(U$q(UN ztAYntx^~W83TA<8i33?sR7GMeaP4s*3zj9Q7foXm!Y78b3F@iY@x*})O6e*N6eT4T z2Z|CCiUUQ73B`e;#DwBNQDQ=IpeQk+I8cqOehW%C6>Am5{j9=7wT{dTn{wg z2z1R=RSjwI7aRxod&q2z19^Z+m>@>HP6Gogz$+WZGw7gc06$)gHpPR14T&*#et&4gyKL^VnT7C zC^4ZpP?VTZ94JamC=L`QCKLyX5)+C8MTw>Eg9^oD4Q}*VrU6&WwNMUZ)5F)7ywHOi zO_ticFKluElQ2Pyc**yZIEsUdia3x1x+V_fz(CC&Lj0!+tO;V6Ibn$dIgt?scf(v! z;oV>*3g`x3s*uWH!05@kZ>S3L6w{McIh1=wPc=+M2~F3sYKsK2z_rAIEGViXF&4P? zIFJR)64Z;Pu?gW5L)rxO)a-cTKnA6B6$grv5{d&wi3!DlqQr#aKv7~saiAzMp*T>K zm{1%jN=zsY6eT7U2Z|C)-3J_;Y%lmBxk@0xMFBHVeA%~5--SvoNHcxi_o3D;p2f1$ zqi{t>mRw&lp%j{=8&+s3W?<;D;X%1U!>TD8aa3P6Vl$OmR?_8i^#QJa^OucSNiT9` zBe*&cP53J=8?lluccM6I$l-!+P{cPtb0``Q6@*|EewZN?U6K6oSo47-5!< z*I~sd9m0@|KPF=t-jJ>x$ji})DG7OjE(mwyLYCv?ZHigU?d>HEp({NU$!Lv7QiVY; z+mpbFKikT6<%i`BIJjuLf@JF|7m@CG4 zydFQ~h$7oa?XWO}rk7VNk0mC7S1c7FSN)3RA>>exzg=L5dOU%xN_&Xr{%rglRVj`N z9JBk7W<1L{R2Iw~In-uSJ1h)Ahx%&ev6Mr7wNepusIOKYMTh!?o}Qq#JkD93;Xkog zi=Nkveur}I_knZe|Jo?`(3Z>LM}Lhr#|a$J&& za}j&VvAB>bn}ga9dz))@zIn;THn*1?zs;?5Vui_Yi9N{XSvieI);cAxy+c)Iz8d$i z_O3;Xj1`7YYwu8ASE~&m*50{SuC3JuEqiUjqKs@;gE$(NTa}KzYHY1)y5DQ7TWzg2 zINNKhTWzg0AUvgq{@oBt-3{QH+5|na1g@)|f|g<~@1SCnUrnI46q`FF!_@{*Z$*l$ z4Q$?u6k}UlRlxC9q`2BZ;H^lJOwi8BGwkerQPYbVlb0t4KCzvzVVa%7xo_k?c`qT^ z7jeFZZ4a>J>=3x~bvb_LNb zyN`96=tqH_>7#oMQW)eY$FgXMW|qZNRK~LSi2Rqul!`on-TMQ{K9mj*mqVE=8PYM< z9JBIDnC%X0%IqN=dMTOlRmBmX`bH@#X9VYqszwFAy$Pj)kM8lIlJO**!riXi%r5{* zSwBD7lEL$%plqBUIF(p1bslEZmuGwruTl+3#3i;_rq~~ew^;`%s#~G^I7bur39*8e!7<}Zep8PWr%|A?o; z1soo8CoiDR@0>5l2d@qX5XTP_6xerA1txS~9`TXHq-k=4JjzYQ;ZStm@1t`;v#|=? zDdWHsESIL=ffYONQRw*7m&wAJdcPXoetm`mVeSJQFk86u&v1pkZ}dNY{2?8<9b?Z& zjl$0GQSPrR7E4aCE5wwm>@G#NN8|)&F+`Z)F6M`wb*iO&3=Ku*oU zC--4;jl)Y)?2F-%R#H$9FJgb?5whoj>o5RPK`Sg`oG#di70$y0SpxzKd%=+B;XyF; zSlP=4 zGXQcpV+L#y8+m8U0F{r^IGiy9?wuEms55>GvRTdo75RQ16Wu=ApC@a zG2~)#0_ir*VMZ2KNMhpjP%eEb3QvZ%Fbl;IAdDz|JwX@&{eXfn5@N2xC{nG`ZvY4) z%WaExhA(9>&eAqoT75c}9V{bv@RBQa;6tTad@~&W538^_9CLz{eZ!URq$zc?oefyB zVZ2}>aK&0mkrYp6Y#V1pXoUh1kW_v_u;DR*4UiXq;Y`Sd`l!Ax?kI~iVY4PmU_@It z3_wz7*B4swG#4qC+dJBN6FyWn2rlV)V9;KTQlh|5wK}ih~1(` z1V{B2pT_gm+iw0O@NoU4Nw?XCt7d9FU$Q&}DPGSt6gSj-O;bHj*L6!*Ej(Pm*1lTc zfeJ=GV<9zbjZbhh(U*57Q2L6m}Jz z^FRc_<}(7>3JnQfkP9p?^g~Z~bv=+>%hx4jxVjYkj8k{<3E@|HV&^gP5u5*DgyZ)m z+rl=#kJ%Q^MSah<@Xzm)wuN&tMA?1Sig*|HTPx*<2#C#xnQn*zH83pQ(oBeS;C*!; zKf3Ojs@&`OIPSqGGVw)Ku?tJoK}Q@NEr%?B*OD=`-o-BR`^H`DrKlg>#lG_U++FM? zaX;+-dENc|DD1g6#3>Ofn@{hBGQ4Z7${~_N&2u%~)LcamEy>U%*Z1`euVvTG9=|VL zH;1BraNT_J`>=I$NQMf#|LKrNVb9Vz4@3}bK121?o~3Jw@5`#L1c7E6J=66K-%?!( zc?$L!`J*9sSMdHb+?1vB)>QU7eVUp&np1!f3g$M(C%+fj7^|Z0WMd5T`<0EcO2!qt zgXx@EVK=iPPKZ$0oQ>(aVW7BvD9MtqSu&)~z{mKeWO$lqSy6y;nx2j!IrY=Xr{vC$ zvF?I(K#|`8bU;*eD0e`be^7Qnlvon`@Zu*cJbpw;k!~>#kX{g)Jxd9DiW(ZBB5OUX z=OfKjOi0q8-i9N1bIt4t481jTC_GNr%%{MhUNeVesBn0I?syb;4PEm<1i|JrEXg-R zOYKQIEb)7a6yQ{Dh>)tGp3(DV>@yAy?x_$xSHotNL`YZIb;{ozVbzI}%8o$7Nn7T# z6{5tlGlT0OmL0NN2eG(ka4Kyb#NwW*>me5RY)!=Co@wjs*_wzE_rd0*3}4catQx+l z$ucZ6BpsjYQ59EHG}R4^PCTI)5z-ZQkHJq#*b|D967qzi#DqMdC@~>VC`wGo6N(ZO z@`R$qggl`rF(FSVN-XXfrzaF8M%)LRCxj9UmMX*ce$VwJ50cDAV5*udNro$%NDn*l zgknTUSJ*uvKP6#LC`wAm6N(ZO@`R$qggl`rF(FSVN=(QTiV_p@grdZRJfSEtAx|hu zjJOX*PZ&s+WXhIe`j!V*GD1&9o@A`6ICln+`+y|Q{4DeAP)C(%VDp4MBlJ}$ z%IaIL-!tJHRVC`ydD4>nI|Ak$ajAdL}14G3NGean<#c^t@E=)!8* z?Zgv`5g}b+_k{eEggv1sDIrfNN=(QTiV_p@grdZRJfSEtAx|huOvn?85)<--qQrze zp(wG`eL&r+e92W@N|)4uO)Issl!0X{7kUr%F8t4QtsJ`G=J!c?-FzYaEoPDuOegpxCfO;gGF$>)pKiwv=Q=D_qmnSSP+%Xp6XDn#;WS5by6=k?QpKXFCGSzh+9P1xJ zyAyme{pdL`xYx$!wUGtVdwp!t=!mNP?#IU#c<VwjUo`G(Mtg#QX8F1>>W;;OhP2 z83$Ka_(h_X1y?LYmI|&|2=D|~%=kJEu9)dkrP?^3AwRogA+pQb=rFiq5fx=uu~yPW zK>Bn?^Rw`;Umx+Jw3Fa!uMc=ZxwN!omP+icIt;FuDewJNRly8{fG;uz4sjOLdY>E5PPI!2`mJm;x5`K?oZws^) zM*rr_hIe9%oAwHOTUZ3PO?!m+-*3wnI$LaZJtpEY%C{Enga_Ip-j*$Nw$SZF50ro0 z+k$PcIdbf55iyF#)3Vx3&@3}J%bc{yl!oXwpr$d?(Fmu%+Y+e|V`+N7I((V<(Yc3% zgTB%K`0%Tz4OwBW5PT@8^D z$X*!gzNvcnnJec4{`WO(8sy%HalVGLCJ@WaoW;x?FXlEhiDZ{M-vS?|4@AS!mp(rJ zBFTV}kG=wE$WvG#-q+G2ICJD5_->PaO(+slY9yI;1P%D-)PpTE%#9(P#RyaNNiIN&MPxH2Rg24N#Ln9UwM}4un*PzS=g$ z`Kl2ZF`}~BFXt=RJpXE_W}U?j_`^8(&UtuoX94!)lb5GwoG8pPI1R3w4>BWq;9R+% zAE*9&F|&u1X$^0|V8DM4;Su6HXYgh51^KW;n9KF>LK332Y00|}?)VV zNL^oz=lMHXQMF{JGWCNEK(SwlfutM;x+mMg4iOK3lCnVr#f)h~Q(8bv=S>^vEX5Kf zrUutuGgc`Jht9$fE4N$5SC+9=yT)?68md`mIij=ovU_Mkr}=MOAI#@-m{N;`|g` z6j)!s)S`P*i~46%P`Wr-5*uiwimpvX@KdH1Xt?8Vu9y*6ZO%qdm*D z{GRNFh8nu?_^ao;fv=k=Kr3~`ofGGD#GTU@a>Si;!Rd%Qr=J-hha=`>Vi`v)N-FIZ zpCjg?mbpL%C=N%=fGvu)ijJ58j*6!Da-p0iw-9TFuL_lz?;BuXrGAAC~^7qx7vWq{(CY8kLqPPGhh!c#2+Zjx--O}V57 z!?fnn)Shp`<8`jD7_Q_>vH~wTc}VpX-IO8ww9++C=ftzFb41&mOe{0iijoqVYDI|& zO|_!Lgr-_iVnS1`C^4a_R+N~~R4YnMXsQ(@CN$NG5=-3&-&D&*Et^sppg5*l25gm6 zEd!kJRLg+7Vyb0;+8(*22E#Pfn!Xq6uA%FJ<{N>oxvHum4gT^>-R~iDrBiL^#Ivq* zOtqX$EHl-Lk`kI~MTrSbwW7p?rdm;ALQ}0MF`=nel$g*|D@sggsud+BG}Vd{OWgoR99zIp! zg&rKVu+-Hikm1$4Zi#1I=b38xm{@A66(l7#)d~_5n`#A#iA}YF#KfjrL1JQ4tspV6 zsaBAf*iOl+zZB$m1l&Z(A%8kuU_p?Id0c5KyCZ9AO!RNIcbYN~CA+8()327?c; zrT5+GOP~#B>ZyLf5z~f-Jt znhZ}eD5tJ=Kxz=Q9ZO_b0wf-mmj_{!Y40ELue?k}H~FF~ryCWFn8`3?Myn;m0LWo7 z4A?46h5<@=N@l>l^MVmG8Lr)KdN45na+nMQwhEJBfD$$t2He#q!vMG~f)O(rhI5Y9 zl3@VkkPHL13X@@g5;hqI+&eEAa%P-wvG^8bQ#{YUmk@n10uL*4)_yOWqHM&RF~c3C zYM;XZ$l;6`uvIu?1}I@?%z%661taQ=--2wGbH;B$LZZ(24anxuxp~Hg`{!RRrZe{e z*-$s}&~f0JJzOY-6v24vJkQ3HMd(c9cD8NVnsd>A2hB|Mt&gIQV+U#++4$pu?MO!h z`}pQ&*uOl!wC^ULC(~~xhdOB%s8&`rHP9L*2y?hdO{9>IqCnHBCtFXI~8C#R$S>Cxyk#+9@Oq%pud z=fg-j?B8R~s&Kt?1|Ry34L~aIr3MUk594TWb$BS%G4Xv|028lUq3pf=Lq)^Ak7yF9 z$Hkj+q)J}`g~Df5h|R@!&&U~1!l`Xzy@7z#q ze_hq1Og(Xpi3(9gY()hqk}p#ll2@iVdzmc8PpASgGOLQO^IfZK0DY_YysC4i^VN6r1$wHW zkNd4$UR|A@4*KWzp?avt9i3MKz%bTe7?;0{^jGs$s=qQ+zLQnoLm$f@=ewv$nJ260 zW}ZZ41E5jyc@+`UIYkpROD(|h-35A>&b})R0CPCFJi5NRytW@=fLN%`XbN_P+(Z!> zyi!8YySzLd++1E>+T#QSFciS;L+$YJ2_`H&Ef>BkqP{ym>Vx76FQ*I(52qvrF`-%V zObb}~5I>uu+Gq9;ZSDI}JUSLu+Oid9_a0P-%e0b?dR@dJP*fI``%!1 zeRVZDwkO~+qM$q0dQ7Tj>`8;`+v}tL*}%>w$#VOs|9En&_$nP;<*)LlU-dm$e);1n z!;idF$@k?6RD2EiOP}V^$6<&GB}uS4Vi^@}mx>yVtDBS4+y2Q>qQ6+ckU{Cs=Tmz}rUn zo3vW3at|_v0f%5*#wZI7B778F`WjL_VA>+(B!mLipbhML$`UgxKaJ#gV&9&fU0hwA z3^P!eP*ey3yzv5t1av$bil_F;)y2u#U=(?{hzxFvNtYX+*f%$4H&;hDCppAu8j`l) zJ#;)mDtV6vP{Y^RAgYAU+j%vGD59+Xin4fcr9X`4D>HS)AWkTETyVsxM)F3Sf}}G7 z8(5DM%#0Ul8H4eR<-LTwY{nr}BVcZ(fljASKBSgNvku`{%t}2UE$DKRSOQ%lA#C%; z&H35s2mt;fM)iA)VC7=`(*)T>$L3Q)PX(wJxb$VtLvpHete49&S84Uapg0BM5b$pV6?A)5QMahxv51rhz{=f^R` zT9AgQZ*+x%v0MLjArQ$T77!3sxBY$yFsLaRH&gFncn+qphJzsr zZ&kv;OM$+6|KZjd9uMCC;P!)a{QmvTdk(ncYi_u^>x=7~udkik{@~*HgY)4Bx5v!{ zZ_(2cdKgazXto%Kcod-z?n4e{Sr-up*MkfD;^t~_dp^9vQp1xumLUE+Z=vZYBo-Li zXUAvfgR_ehdjQe+0`z~V=Yg`|xO$zP1;{mDr}KOD*ZKLqt_=jU)n8HbdzM(kbHnkm zeRVv#yu29R+Q(x&Mj)h|P9U(H!oR%f;?tq-6SWX|4DHk7i?g%a(_?!Srxjo=Go3*Q zHFGDh*2{vZfqiv;dp7J}Qw^^^+#TxCGoM+zEBoSXcy)7pbYw^0LLi0{8_7~1vpTr6 zFHZ1!6T-1pCI@+hs7#5z{PC(U8Mq(McClTzC68!_Gh>4r2I#S zj%sQ9bFhufSG6NwD__SMzV#c}_%B#;ufknYX| za$^rh7o(%W?QK1gL;V|Y4Dgf{0lS5@&T0Sp794vmZ)Gqn!_(W_Ye-nwg^o1J@X|g% zy1X48owkcGKNg4f;Og@B?1UPM+3+Ak7L4Ka>h$FJwtv=6U^abx%;YdQvxnCgr=zp8 zq5U4dh(;mKF@Y;Y5G~kB)9fkbJW5aRwL$It>CAKgb%(N9X6q z7neXO_c2KS7P5u6r`MOn;n!oiv9E4N7ybUlQH17D!W(DL5dI+`o$8iqi_tj)B#4l>iQ%bzd2|d83^zq&me zoFARFz(sRBfdfX*2Ny>dS8a^CuwMO=!3|*oyEwTSK_<3crkK?X^61t+y1s-&$Y@Z_ z>Em?z8Kj!;-|3ZoIy^bQxq{4ls}7&1&y*@4nukdFg+^UuIydur+dcFucy1LCA3dk@6)h-KyH*ba*r!jUX<- z({|=qGYmL7I6ptVxIAIdd9G{2p?%Ybp?l2|Kx08?G>@(TvOl~yz8=}5`TQl4e^C@L zyQ$QC0a5Ac$aqhit&?eH&h~dz2aC>=sbkdLKG>C;0T7H`H$znP9iU7h& zZFF{YG`wN4PP%`vhjBW(zB;?;L$nI>_PEeTimpcmKd^?oIlsC&y*NH8iG_gBLILH$ zlJB&CbHT7=%&TBzpF-aM3ie0sYkV9BTNn0(v7x|(`~>e;= z1_s`41m5oa_~fMBzrxOIe7+*eMI6}!m_Uxsf#Ti7cV8YpfgNXOj=-d$vuV!tP$d*$ z^$3n@bPj2bR*#-h%(gl3K1@w^ym=Rf1t_=k0Q>*VlJaSz>gwi#W#J0>{LD(=+~MGQbT)$XE;df| zKj0xV$BA?>UzioMhOl-z9o|Bg6;=za<^%(cA_2bO`tq`WHM}GwqIj-~4$KjQ^Q(*F z5iE2$>A*w{XA+Ok&Ip-@G#6jpDIj)vc{S`GL2iqNa17Bhkz1OsFH&l(`NrnjxZ_9@i5fxR_Y zGR^=uAs1!wYoX)402ycW*;yVn9^%O{UE7qA?OJ#t#+wdV_y{5RqTDfum>&gR<%KPM>d1rw=>@!k1MlR#N1@~6Z5e0k{i?oJOU=!>^mf0n{KCN)W#p7HE@GF1uECP5pnn2zZ+$WU=;OJ=MYu5Ghxx0B;JWPeD z-a}7e@2y6z(S#4jtNRz1kZt0exJ#O(#U^tr5pH^> z&O}mRc&HbuhAwHQs!OJd!q5y<-M4frsw=d)zpMLivKR zuw4SXEO2)1$$dVQlkGVI5gq1&x6z$v*eGzm26ZGe5X5#4&M&z@r2bS)%whcBszYGi zV5S^Mm92xjJ{se_B>N6t`-U}&582gdbl&!EVF3%rSfLNZOTcA?j~{>7KaQScR5d*r z%H*P2LJ!OG1g8(L&ij2>s28Fd^0GSKcAi7RKX`$obLk9H#p$m+x=&u4uuDgt-#5d2Wt}m#~F)QQ8P!f*T+Fg4a`eGE|$l0#$M0ahE`H zLs?fm$u*;~f=}NT9bQupeZvglE#02$8HQ}Qx@+V9=#4!b?M79`FW2PlA`2^&axwFpxZ7@MQoWZgGZm_!uQlT|sCdqz(+ zOhtjI&ax`K299N$#;Ir04SAdh-NHjk76T&IAe2(XPz_CJ)f(Z%g8q+aYxa#un*8bb2z9CEXdRLkT3&EWC^ z5|xj*Wg5mj!;8&0j%kcY@{JNFQnlziJa~rn1tb#!sJS=CS5W!}4jp3bx%m*wM!6bZ zT%8|7z7`#m{@>hyp}_4C`}sEeP`*4F9Nip)=RDNl!&+m_bIN6R3o~P@&rK?dalAe@i%DFTV3*e1&Ly`@MEWFSUJ>7)| zDr9&9SC&s61J&&R!VuHy(` ziR1n`XW15%^k9)78xY_iIn+E?(;-Av^bl6nngrM4b*$XZ1h0B(&(bx;_hnUwc~>)y zp6U7qBq&@7LM=?J5dB;w7b7W?;_9F2LQt!?ekjS3uURr^8z}jvWO$lqSyBH^9ehzZ zpszbN26AQ(;?tg`;HQ&ABUEIqXZ3ufK^zBKMNt^vnanK7H$zM9Njhkwr$_-dnh?QK z7C}hr=j*yt6KsAt!Rn+k)^0N-Sl>aFc`$BRhe{rp zl@XY*+?FK6l})4zMa*&_S&}JRis@S(c%RTyA+cquiUP?VOZBk56j!!wdJ?!dPFPaHfR-Q+2Jy5XcqTk3XCYuwhlG?ORjxAIaQ2MQ zS7GJsL+YYug1z>7ZlLyhdf;mY{3_CS1L6P`%*hDB!|IanTac&o!a&wS7i8gy+0 zoGPFg47&=deTY>+F%0$!C5nfAk+#d2K81zF&J6} z6obiEKrsxy3Md9QkU(kK39wwq{a!769_Q(l%1>o{-oFnwr|rtGVHtx9_%u`&dyk75 z)HF#5w>2Oq+&`jE5%Qh2y5}vxM$?kWU#)EKCh}+mNtlpR5hS_TmN;wul4OB zHb}v#9C7k7MY8x|o>1{y4bJwJ3t2=SApcEbYHI$|gl^S`gl^@xW@2rSbs0_PURsnS zMu^M36~0L67d}oHsQi?0Q2Di%UhW0{>W=Q^$5YH!oJD8_A`CMEWL@EEPj`|FFzbGN zc(LIuWW5j=L5reb1S<%H3#u#@F7Qk^X+4peW1{tS_v00q^-8LI{h1!vK4S~tn=#-l?NS5Z}>cnaEE4oz91%i+tJ zz35rwbc&+ACAKqBd_~DGgR3C@2aR#uWOc_85qGN_AONbdX z69iZf+zh}DKtLSKz(t`j0~SQX30D>nCxT2&*!1uX3IQQ8f)+)@2v!gf7gSk1yx`?& zt3^ODyO~%)s>$?I3zwUK%Eh{J!*dCAMe#3zs-TjkF_qP{G|Ef?Sm9*$=tK!iqAV(6 zNpuBebb_s{kWSD>>(PA8;B>-|7R33ll8)hpchwh!$GR3ch@eiULkx%Fm^;-#<(CQB zhVKaFhDKVc6in9D(l-gon$HQjng&{R{iKXu_16i}rY{NQrdC=-_1KJd#dite+HVNe z+9p`DQL*T(rfFWWRo^9K>%Ss&>)U7*6^*mLR(zKbt^J13tZkx|3pHmH%U>k~>%JiL z>RM=ZH^S)5aWp42Hq3@tQ)TB=I_+%;-;Gpbgj!3{=2U!qc|4v?DC7 zsIIUyk5@wR@rTHRk(7JN94vsNt(L;q2~&;V5@s5k!EBln6Fr0ITGcjHC-+@tnO=FyP}%P?NZa%LaH!yJ`tssze>2M`+~@} zu7w5$+FFP@b}CH`Q?WH-OPFP7L-=NB46<#jhMh#}warrY8!%=1u0;~JAgs3{1KC&C z=uYHa_%da(1eM9P08nJ81`tlPP}faMlS%p8l#%i`2`6=55ZTnWNH-9i!E6ydnGzr< z8Jt9iF?txsca>kKd{us#3aK71;jRIJR#~(>J|}-y{4Qmv_<6!h^~Z#b>hHnaqc76( z=&9p~-CORflzsssAz%3^p&h+^zOCc2&`fKt8XrXsHBC|`YramHZ2Xom+1N~Dsa=m*y=!ck zGThiGVVj{1VVtFza^|THY-_VXV)RpKIB|QXV|O8L&wO8 z1XtOGk^<^)_Ebu=zIm01+FIB2xect`3BKDr)ji|GQQ2J)6m>EX!3A+%b*3OcZ!kTd z5jl)5@DXV*&s!$-u29j^?+RzV7MdR(X_j~mY^!u@;MyeF2*x0_M)-OO74H~E*TV9v zjv6&pLbgh$5~@u$4L}T%X@IVkOB!hxUfYN-%`wZU9ZQ?M+A*}qjuk<>99c0n$dvtA zoyMWb^gd6!WEr?=6)rOl7WpzGYY=halI^ng%Z#pF+{~z2h0ckIMf98~8x+9%R8xzk zGox!)05hsq1#n_wQ2-~(S_KpWuTmYm_$ocq1P8I$Cl^;Ai|R1eU}_UP8$T@)=Rwjg zY#wYN=kiWQ0ReNpzr@r#KuDzC0kTZ^o#CQ&&>7OwBCMje5JPPvN^~SeD29p%t{Y4_ zv2}xzMQDu$nOMcuh=fs43^>?D#DJ_MoMNpAx^5^bL6{uXiM9YM#lw%LNh^ZN{ zUQ8@-jbdU!P$4FsO5ioZVnR_bGA8g^!Er!0iH`$Kl@Obz{rt+QI2km@pK-U<@*L6# zRxhk3K4YjxA+>{735TQVd!2=`plGl#7VvtZu|qcsj~z{g5NjfhX4|R(suxrZK&@yR z+cycL5wNQJwB=EC*joBu1Jxja8i;xcGy*h=pb@f42BmyTOYckV8~R;pTi@fFrj32A zfx*3uR;_rcbcbS>GwPpj!N)T-rQq!gsKcKVbS)=ryfbwi|cR*{p7bq?xU5g*>!b9YYQ9m0I0O=rdZ~N@%lL-3m!FTiptIXtTQ2JYJKA z@l6iCW6F${)-hE!8(RrcX6srB^*XzPfNmv^^E6ph=QLYvsdIYGRRS~Inj54Qzj&ZkX zOXPX1ChwG50T*6IZE@jb)0O~AW^D=JZq=5+!(&X^;=#+REgqbV+Tusat}TAtZQ5dZ zD@Di?a^Ypv78g!7Z3&=c)|LS7Hf=Gyha;pdF1(D|;=;+MEdi9w+7iIsrY(jykA$?v zg_luVTsYaZC4iDyTLQS-w8ikQm5{c$@G@$P3n!bl1W+<-O8|G9wiwK*_8v0o-lcVt9j4?5r)vN_u5HFj~RN z=(AbOipeuu*NXXQvqXkBG%GBz<|sqH!W4ZZwq~z;1=Ja>Zv~Xu>~3X*nJsQ*9DuDs zZI}Fmu6c)4`kH8~^i?L#ns4a-)-=J!Up%18@!)NmGZ8^SIwr(H*7+r%X#p*Prp<#e zynt0-I3RBxjpt&PqC=^pDYd#34WhFZlgKG{#kAVA&+uv*Lt!BfGw6mOqdjy(jLk5* zq{VC@T@r0G6^3W|z*GuXY#Xl&aF|W^#2HPfd%|qyv?{vHrnM>t+RTjM&B)G51aTPP zI@w}0&2_TGX0+?)h}oRi&sv+IGd!u1K}O^3h8UaKbxDiapt>a5W-1JC_7=}s zwmkr!E{>Yw&o0R_noXA^*^H-qip(a|J?S<>GTWbw{+Jb-huBK?J8yHnjwX;mvTzDC^#f6hi zTLLJVwIzVNO19=xpD;=#$NEq;{j+TzFErmaBHLx^NT zOV`an_btN;G%s{zH*ihO>S?0d;=;?QEiRmF+7dv?tStfDZQ2S$!_rJC2ttHhKk!V= zGc5$eN)HuPk%YCyg_luVTsYaZC4iDyTLQS-wAC|0UzJ_Ww_Lwx!dk4?a|5;4(*s{K z;8)SH#f6tqTU0bZl|qWz-fIPBv``pk&sT0PZ$z z1)6IaNYXV~m2_W|K~Juvs}K>Ypgl_x)fN|CMs0E7WYd-aN@i^d;BM1auZPoK*_8v0o-lclKj9#q2>1A#sTW}0vXax zZfIIz4}uS0kwvw|g_luVTsYaZC4iDyTLQS-w56#%--LCr>nnyUxst5Fg3Cjyr|6~( zu2584TzDC^#f6hiTLLJVwIzVNOJX803$Q0EU7hXnf zap7dsmH?RE37RZysX;d!O5sCew6Im z;=}DY@Ur`(ttpZMabBoM@z1;Db3M#{pCkWeHeP(^_|xgfvD_NHd71D)N0;J&8m4THPb4IY6YU2!Pd-8nweq#r}+E3 z!{PBs|L*dGb8~z5mD9f)j&7XW_cte_%j1LbWV{%=kK-Ss*+Kkvhk9%DKYsk-ai74Q zDTe0UkA}yLaD$t>>kr58ovY*FsPBAue|J6Te>fiIiILrMied`+)%y>(&hU8f{s*@o zoa6WJZ{G6)A76_B-(6o^-+X=T-1Y|-#~+*zKe#Ojsgmzo^mK$C#uMtTjt}lbJJ0_l zY&-s5>PLoC2bN*L4kh&={1fka8Soi6PDR%7cYpBbf?xaFKh^tL<2mfaJTk`kM{o=dt1;~4OIQT04=I_8i{=gqee~bUN z-~Hmz_q_R>{`9BmUy^_S3%@A+(w!bsi?%Vi7_%Ak(=Rfi8-9Hb1@K0VJ`F6hsZT@wJc7Fug{0WA3e+Jt8 zmCAO+UVavM`s>ij52KTZABppD(q z?wQKY}*@(tjAY`^8+lyj*_YpLzH0d+-PUG|8n0ZHATYNIx*$YiQ&A z*%)6F-Tx2T{QQ3uw`-#Nk3gGWs%)31`v;)Sul%`ox_<}S{N1Eo6W#wE+Wfzj?Filf z1Q7h}pMUr6H-96h`wzljL~lgS{{(#gOMd}m1Ap*O9bGK1kI?2*WjjLm7XZNw+Wd=u zF+x}C|NcH0+#iKDfB3J&?PU0?iof3upZ_aAdH3#LgFpDEiN8PmlXvg_B>cfYb?q>| zKlhV&@BS+M!9Pvy{>D$&wEHReoyd>0`xW^7Uxqe6VQBZ?L!00I zp928=)ZzOj_^tGzkR-QR*X|3?eHe-7IH zKhWmezXAV%pE`Zq!*_oO+WfCcyE?i*gOU7Ah?n3G{;BIPZubk&<{xfp_X*nl9%%Dx zNxM3I{8P~GPeGgixuxCDLc8Dbx4oH=J^to8l=|L=Rx?>Cc`bDp#IT5I3eUV9Jawd2Ow`F{K#P!{mv<&^IEc-CKG1Q1_NdQ1auNd|sw?|%-= zwhTDx@mF9DWx(};Av(O{a`oFKrEBjX->-0g2{7GvOPrIw#~|Y_0;Y7Y#GRVNFS-A? z>`yM&5PWzg=SMPb6fhIAz)b~aeipc8z(lja-383AGT=Dxc?y`kcZC`jJ>vb*gHZ59 zVAlRw;yU0@yd1>!Wk1vTJ(L-IcqQ8<&aWFXpd6Tq?@OE$zvJ+@8JM>fE}36EUE4zEBvMa-tq_TnG>Q{ROtchnG`3&UD`crbXeTe8nk#5aPZ9Cg-o@7PCt# z?lL^<2+UxGLvc*7b6mcOxIY<~Eee;eAN&HC-haajxZ2I`-$xk03Df70yXt%4Y!cW)}QffH~!3nQl6MX9F`$;hf4J>&MN& zY|enAd>;bSt3{^k#E-Z^z(g|Ox+6m$17`Cll3#oLiI>0Rc1Ziw43y^O2WnE^WgrO2VE{dKD?6Ui{sc{4FzUQ z2AmtXNx+1&z%2o0RTj8=fO#Sd+_S(mW`TPXn0K?leF)59TU^}E><4o`gAe9&S`Tv; zeB${Lx1R_1FZ=@YP<(i$v-5ahre?so!6OVzT^6`iz&w-%?g?OC%mUX4%-dPu-Ua5< zEO3W`Y5%1#i^VQ+JO3I6>jcbmUr8MGce3-SL$D1#yqxTO4xTLm=C>JeEced=vpxfk z@@xTSZx*-@fcYv5Tq`izVKBz!qzBXO3QVsoa3#Q$Wr3>zW?Tjw?Q$J3b8T_)d}BYl zNMS&VE1qw0+~;WUehOUZYl%4-f8w}!Jz}~8|A~GdA706JiSv6E1A?)@bZtWf<~H~^ z@w*S0#}qD^Uvj$70P|`VxMpD9&I0!?F#BzBaXr{ieW5VagI8RSIPMwTKLp%kZKb|W z{n3ws`&41bi^4!G-ae{B{x4{)c#dC{K^3|vnAuLsYnfLV|MhbGtc z3t(2Xll+|e%h|x)2h4Hp)8pm<=K<#S3^>aDsKS60m!17O;mH%gy_A6;ac=?hUIttk z;(r0m=T=;y#Z zq;N#X<&-XQ<-kNT;7$YX0bpKGxMcgqx!fn)Wi&7o6^`h*e95@!z}#Sqi`#D!-mg^{km8E-OU8Ya z1&;Qr=pl7b>=NXQ^BatZ!-2bBVUzWU<2bH<6qx5S;K*+sFvk|iwA1lB37GB~aIC-Q z05e>s1^*syx&VZ1EC@3y|+v&k{hbatkyzFpnC$7j6 zcU2ZRrh9c3IQ9b*v%pP-f;GVHI7jNsad%vgxLtTZaBhxk6h6G1?80%*cwlB_z&#J# zjldN5mi(N`0n61qU=}N!Q@R}2tW+3~;)?4LFE4)rgIj^SzF4N~)Q*$i?FysVCDLoE}2 z#&K+SUHxU6>2NGBmt}#Q0GvMy+)2Pa3fzkdo2+kKzMa4|0&{1nl+g+IHgFFCGv|`@ zIM%m?z%0*z8x7p8z%K^gcl-AP&Un+@Ee4E!kHeOdDR6>v{y;79r1%#z<8;6BK} zkMgzsiL^0DaXHzqBXC_5)+s+I--TK7^8r_pfgk0YnkB!vz%9vw-ve3ldjz;=GVr6m z+p^@h7q|~I@T0!RFc>u9a>|e6f$OTUPWeH87iY=uGT??};Fk}6Q?lf@47g|pex1SZ zw^{OA2i%qn{3zdkU~;^ccEhH9=>|-Z6=!K**j@#IxzdWW;Wr z4ZmH${MCxH@S}V=802^2Kp&S`4s7`K0jAW7v+!enT&XaEA-K-UZCl zR-BD|ZvwN&inGW^eGdcEen4h@&jjW?E6&1?@(l&%IxEgbzB*uTv*IlLDBsh-th3^5 z_`M6vek;zxkM*~GS$6G#2Ha^1YnB5We*LoK=L4=H3w~3x$2q64BXpU@cS%Fen){j#&4v zcJ7~ovmdt)1a7#(I+c6!o0TQMg}|-Mg5RTA^7|cduVumSPg(N&2)HjZ@MFJl;-Ku> zjqbqpR#+$dv7838MZyz&XV8HfV({dzhcO@7MOhsm#*A@NsOMpp0nKl7?_?4 z=Tx3g1g;dAiX?ui<(ast3IkGHcIBRWECTK+g-xf&dSKpEIH!E0zpe$Cg9=Bj?b4-R zs0JtwX|y-A3P4+MuknM?`~lJrf^RBGC$f3#&{ARUQT-O z{Z0xafcUb@4-f8l2JQldO(&lY%t(cEl8^Z@2bi0Z_@(B@3Baua=79`2@_R;MK#I#w z54O)QrQqz_`zGLaDy)+p%(sKU95+PTIh|cRz?`FSPW-6HU|>ch@w2zfb-;u(;K(nc zFd)U{WS84haQ1e25V+qctdkzJ^QJ8M{T{e|8TfI$@hvdjgPHAo5ikQ3&PhJnr5czi zN&Hgn%>HN*Fm(#&RFCKvU8OJ}#bsw_^1CwyXK&{RfO|q=o%G3eH~N65uXVSSNjHzj0aen*`i!D?gj|d6k8q zXrFCxtL<=>cAWCvX2Cg)i|+yM5rs{sZ)2AHwg9&)3w~c^$?qHBj=fx#11I@dFM9$r zMB&nvzwy9K&A?BzSHRq!#4oj8a(wV8Fz+ZF-?J-!jGHJPDs=!UE;}6atuzH^Urx(_ z8>+BQb|Js%S@H`5w=4^O4`s>kG2oufz>n?5jx70o0NiI;@Y5=-cDA=)58(PJtdsrN ze^g}2?@Hh%W#C7BYk|4TinH-wJqOHsE6!5S-Qf2gFbAwS8-B+RgFhP|Ug`9`SYZSZ zUry~t8E`{0@T0!dfmvq7*~s@0Fu%3pZ1mj>%pNPwhTmae+73^zFYCt{3X@6SUcg^jr~3a<{K-{hTmx;FdxK+ms5FR`SSxa zO5uohDlg-KnVNwg{dEyw9?pW_Z-J@Lg5Mv2`P7QD(YNDB_;c{#l}_Iaf$>{$HvA?6 zGt-K*vLTbU)lJAhl01;5v_B`kY zU{)%elYA^!j{@^_62H{)!ud=iFq;)FogQy1j8Fn!c6!jx?*R9Ag-xf&*TA$JE%PIt z9tFUht8h;BgL?RY8KiLO^cbcv>Gbg6;Yi>@3Y$)kmB8GgaOw2;9WXB^@k`AQ)}w8} z?9G7Vc=v$9fE1Tqez0794crM;($4Ah=nhP8g-fSL5SUR({8IH`eoO&oroyGmj~f(5 zYT;b276NyR!lu(>4KPnCoRc2(>%9TYt|VNl9(?~Rg-ItL$2mucyHeWONnheR0CQpn z9PM|y!lX-=^{qQ_=PPVFy9@+oxWYNvh4HnsfVnY=U#eZ0&aDcQPCnXUwH?l8-hG<| zXXiilfZy%F{Z3)i>DvU%PK9&Qm*wCfFyAEMQuQqa?zF3NTxIz1V*c3GH|FmWU{)xc zQ#oM!d>b(LX27xj{#s!`ipwe87gBJ=wsC0;(S^9zM@$`9h!0P}bT9P7vL z6b7WYobuz96r6p2Yy@t*!kTum$&Y_n_}S$L%gX`a+K$a4KY;0>aAvxe{9rlt0W&y> zU#gv1AFc-GT7`46Gt-%&Fd)TcXFm^~%m(f@g-utk9s%YVg-fT$Hehxq@k`Z%@!p>R z^Gy=JR2<98Y2&1gL5j;x58`^H;Oxsm5pWkPtdkz(H!4eh>PmeOd5( zF-v~yfqOFpKlX1eS@QcQaP6;_dE#V05BQx4jNgj0n_mJm(~7gy56Tw><^e0thTqG; zG+S{t{60_^uojooeDy2fa>i%Yw;M2*S#dVtVfgjuFC@>FOaW?i_2h0{L z&c=TGfjMf$+3@Q!0qs3Lyqxr9dG;xc0OHH3{0#$cTn2ue&)k$HzZJm!JOe-4?-^iT zx8iK{{VOmBtT-F{9e+)Z>qq$TGVNl+uN0U;R-A<&%gZE%5e)I=WWPngMKbWC{T|Db z-?PB2%Yxs#S@PQt+*cX+vAmo#5#D;O?AjM^eqhIef;GR<0bb71@=1ql5r$-AgUncRh*CX#*%+K-R<)jDo z%~u!!#Fw2OZ2x|og0pY`&I0ayg>}+{<+&1=$qJXwE(?KKnSr11O9AtA568b$iR>F{N*h9Z2@jq7W}>f=9n63zjWoQD==p&oRj_Nk1Yd6 zS2(Bg!uN+O3`lX=)g$KbDBz|jY&!WC0TWR;C;3?J9|LA>62H`PPe1=gV74fnlOELf z4+;ZPTy}ae-~I^P#|oQHk8gqLaGlJLbb1s5bDqLUeyMt}z48MyMB$wDU^=4|Mks+V zJ3TzOUj^I(g-xf&Ex_EZa87#A&+t4jjY+svJy;Ij2j;5`IM&~jCS(5sKD?atWjQz# znBEz1jPLBLFyzO}&Mr)Ma0<@89U2bY)e39c#m3LD(8ABj&#=gXb84?{1MUH9x|V*Q zc77R{ZC0GkIP6nkj#_aRek}K0reJ*)A6}-uHvIg+471`a{3zc{g%J$#<)m*daI3Q5 z_Y^SetvDO`-UFt^inGW^eUH5!@dx24E)$`96v3`bqYSboZ4NsYi9#6lu{OsG8C@}XZ zoLT-XcA*~iz%(TBOKo?Hf%`o$xznY-e9ulku7h2zFd)TchhsZAB?V`%$86vhDXfzo z=YZdRz%(mdy8PV>%!e8HQNLqmU><-EFQ@#a-@7|7#Tjt4OS!_3A1^z*u-p#??mC5K z>W=jsm_-WbWEb+g5141O;P)ypo3r5eAuz33@H=)U_S@sbE1i5Lzzk8ibo!10W#Om`D;od-)y!=GO|BPLKamm~?uu{5=QUn@Rla>-jEV{;F_J zdeAO8vvIx;KD^S|a+!qR)PLKAX9M?(s@Jgr0dBF5nILR+n4~|PN2WCtL9LFUy z6^7~ZveUzZ`!@i0PZB@-^86GqFDhI*J$3=JFNt5O9%V@POJFVzOS{m|VkaNGPNTJPIR}z?V}!Dg^F=4E#858V<~2 zg-cidZU^SU4E$J+UIFIyBz~#+#{O~-F#8maTHECZ{T3f93`lX=;h66SQ*ieA_AlV_ z=BKwa`JJUOGF4|gpAXzmvfwv1OMa7q3uVFY_AL252;6Tn@MF2!lqJ9I!2Kx$KelUM z19Rd6Y3Fq1>MUT+S2(A7#Bx;$%#}&}Qp*+V`E+1z%z$INcB{gG6qjAOqFwGz!P%Fq zHNZWouugigUwtD>et!h+?-}@U9-n(dj?04&FEd@6e)=cC47TDd{UH4+lYv=i#o6$? z7nnz_I14}OyAhb*TX8o0J_qJoE6#@B={I6OCqBH=={p#hE37yRKbF%FFt=E7HuC)j znCGoH3qO{Z-zyB|s2VSs1+{71g7Xvd!;beOSJw*P-ajb7MfibecJp|0l3Mcae z{4DbI0lz)Kp(J%E4M-HYuE`hXu#>`R@t? zQe2`O*x2s?a2*#*eN8 zBfmR=d&|2e_db_$>u)J}`$B zj{4i_%W`^GE#egL;pJ5B`Tm>0ysL0d^@#n)X9`1pyzJ6tIcT>$b9o`Z)9rAUc8&eV zdB9aDtSO%b$9dTVV4@1gd=&Co>QNEyuLI^|g`=dv+4gT=0+U}SburVmg)Y3#7R0$|-;M;e#x2EHAEzlua6n zaOVPd`pq_WvFLF&Z~;3U>m{DWE|$N!z||@&IYZxu-v4GfsK)zI@cLBoqklr!@89Id z_H&Y9)i<^OAZ~J&xT#sf1AJUI@qD}U7Ylv}d1OV=!LtT(6I z;j+~uTb!kwvcLRsO1iOeNqmCD`NBoOU8S(pKW>*ej`e&2Ft;e2D$i=X5y!Dy{sNd^ zX23DsCxO|naAx}=^oa8#?r*^4MP;6(lkY5G`YW81d~DasfvL{GkLfN3=9dbWPQK@X z`C|qg?e`C0+T1GjaFUO>H8HhU2n^*@43JX%K|qEn25qT<*%1|0P~^3NxM|q=I>{~9CN#rPuVZUF0AJoFhvSy zrfbu_1b~^YaOv!_446l({4Du95a~7obL`I(<+Io0Bw%_b;ZoaY=I?pHT$%yL{2c_$ zRE0~Y#}Z(ErEsQQEP9lK-+Ew#n_?gn5UP`Gq@ zJOj)hvcT;J=J-3M9!~ml++GAst-{H2WuI?RU>;7wrRvM}<+s4BQ@C_`yba9ZEN~rv zf%BX2;pL>qSUjr$<_U#Mr^mCvG$-Lw^*9Iob^!B@!kP0>n|jpeE}Wl;53h9kUI&b! zaHbv>eze~cz`Uw(Qjb*mh-(IBufnBE_W&>_-EEQ2Qto?!Ur%5v6;7pV+YVg?%#37Q zN;|~*y8xKw8E`E3w*vD!g-fSL6EGhuTsr&Z-Gg~DKD?al$9D28Ux!2CnuoaAG=M}Rr~Ua3be{ O%7K}zaOvb*2+SIVGxfEUgA0(( zYruT2a7sSga_}!;-1kZOob;f+rvlSk;nK-B0GOIAa5n<;pu#!nF&OE-0!+L66XmmS z*WADqB;iu)8_RQVVESjkG2hC8nXGW>^j!$d8ijMx<1Fxd4Vb?vT)O=D2QY0ONYvL} zkK=&J&w!&I-GLdXaOw283Yf(T=cEVy==THDsBr1@coUfSlW{5S3+rzSFzp|d`kLul z+EeOrCNKeoOQ**;V3t{Nmij?I$eqBfQ@C_`YzF4tWL%0KELR@_^F;<6_4o#uGai!q zrqkm>V6Id+(=HZ0&IG^tz}&BJ>GXIMn3s}qDSA-8jlg`QaJl&3sl9TqL3|EAywd5R z12awG(&=$CFi$I7Iz3(l=FMbWiXQCucLCG(VJTm_e*Z#Xu2i^mdQ1oAHia|wu#{7_ zlTQQFsBlUTTlwAu=BUD@ldtHPSckxeS33D70<%KlO!+M3WgK`s0!*7&XbP@U$(M|KK1*Da9d6>}sdF#l z=tf@K@k8$KSa2=`M|nJ+J_CJ$U|?WHU_^y)WSQQ-`}m3xW#g~#55M%he#OPzZJq~4 z`iJ{Q4jn$e+&^H{pz%Tf75?C*cF5u38KEiDCk3ZmGiSn_8!oLFIetWFLTJjw;ghCK znlN_~c$fPJ`bGsu1_J~7cb_)pnu)WfhwM@;8;(~;mIsE84~!T(esrMRKYm1|zbr5? z;2%ChBt2nTXwsY+6GD?_Oqf2Y|9IcL1?P{RK54pt#)NC8O}h3{>y6QqCQQ9z!nE+D zRP`pzm@yMlP8vTqG-t|;>ueP>G4m!(49%P)FjHnsoEE-zQvb`QT-8pnpMOR1 zw3!npOq=9A-|O@ANl9W>c*aDgA>Xl}6Kx9vmsO0k7<_23{BmD~e?)f=i~nc%Y{Ta^ zR}N3(ah3HSJ8JHvIdjKOnNc%yY(;qPl!;?2{KE(N#|{}%Ir{Rk!ON>gln)t?axmO~ z`N*-zy|HXWq0)>QlctTGIBV9}Yr<2eU7L9K+_@tEdtWg%bOuAg_dZfyF9@8GXq*AVjPwGBP>+I{=< zh<-%Ag7*Yh0o&>?*{nC07kK!NzoemLXUS&yfJ57!Xg`psNmYOvBJS0II$J)aNGkO+ zEU9-%Nj*cN%t@IjBamcLOkO2rtZ&qw&uP>n(+b>rBvg>EM-~=%d{@9M9{tr;c`XST zM}o%Zy75`C^mT2;GQ1wBJ)+I;5{&rVdb2N|<`i-?$>p~?5S%5_UqA#903m!*e+naqem9IY2V0Ln*9M>0+DuL6o|}&iko!fh%Wa{}M+GyC}AWipz znSwUpGd+5Fj$XQHeqPHeX$$$yd7!k&JW$dicbfO!10^l;0Vr7-mVNEQ;&Zs&3k<1k zL|s_i7NsJbSJF_oQ@f*~@r8E0pB;+Xo;T`>(Y}$sQNAmDqxI;tf}{GfPa42NH#l~4 z=_MQWh`+VMI2w#pJQR%hSLu;akCkin;p=o`+)UjF&)4e?g-+6*Z+l5mDEE?c!+E|} z*q67o^_ToD7@2gJ&+z4+NtrL@SLj$h%AgEa3#zOj0?}YW8@=?c`CSJry`)ER_{0I) z^W{Bq&Z&C*y`Wb9K3V9-7GW+uQeIH}LT|iX6Y;N*w~Rd0h?V{odUVtZ6K5O=7=ye) zV?kapvZy{_v=12DS}XHbqbNTuUJDu@Rn)bHPK!Mf#Tm^-2iuMs$Em*o}iA!6)9pVG5YvnAa(eQha z`mhF2_&x3Uc9$&Cmj4$JS~st2d4qQAFNxM(LlJKd6m3Ki)oNKK^`fIe!@n(9+N}N5 zg^~dEcIn3YKoQ#ABRO*}3Pim*C>YzM5J%e!8T9Ds3xY+>mq&B`sK+inI;0KkBg|J* z9w}|hWfN?UgY>QT^`zD+m$u<(LHy{>g} zhd}8!^NtA=ebdsWq}A}|pV?INI_S3WaRH zT2$Ve)q36D&;Z>i^Xj#IU7@pdV@Q>eQ`fNg^wv$09Q^0ijZS)WKpQ=h1If?#Y4uGl z$0G|sydyFuzoxV)d`uIV=jgQua>DK2D_i!`XZP&!CM(-GrQ%s!tI@#BBaU=`2cI zCzSof%8A-@S1@{so>&}%Mf*dOen^o%%?ZnF5KU9FuaH@8X31EQbiDNaM{5AOhR3u{ zXuL)p)@#4k=AEavZh#bM*VgOkn%o$%b=7M(^wf>O5xr==Ui(oVnw4(aiu)j^`z+c2EpM=)c@Z&bAEC0o_M_ZNu9 zVcEt8q~{y&yV^I-H+KBh<1lbAhk~0EM}w=yi>sX;Z|w#?Phqm1>skQnEQFWkx|V_J zC8#GsoePn3UF$&IDX8C@_YQ&TFUCTJsI+6n)2X1&75A>g|GyB_YEYL5>Mr#0g#z~w zsAomGe>3lW0qS;vI}2kVIdVJ))EM!G-@K^sy9bOD^ohRQ0ksQ@-56+~ zSuS*)-_UZwV57Xal9PcRfzl@Sp>l?h1jo>6CGain`Bu)_oaGJS<6h%5%lLNxXk><9 zYy^w*m%Y!f#?e*478W_xY}*G zkynJIEpIZFp-4rr3L5`iu!a_uPlLv_1)h?fF#&29o~OGs|K}YK59k;=&t3cXE(0R? zJD^ACyv|`=R6pd&u>nKYVPtl00riLEXC#yYHy$(vqhkwDu*UQa7<0V=QQ@uhAHExaH*m^sd?Ga_a4BveP zH5A{w1od-#KZAKeu4@gb{}$9^py~zn5~!K@0VH`in@$?=|M7P zy*$zOu3O%Xj4W`E5|cvXW8JuO4PMlZHZ<1@EYoP&g8j-n=|0Wh(6PLeyLR76wVQGy zpz6vybq;kfC&8jX|AF{n1@=poLb&^UAAhy=!~iQ-8}D?ME)e&;BRF|M@`buF z+pVvQ%@8q|tuWr#i<;0}=%pL9pY~@J#)Ps`H>TtVIcY|Bd`iGTm+}TCguCWLj5j$E z-m#zkQRzqXd+O2LUb^wMUb-EV;3EmMx#&>NvlFE3aSFgDkG@!KKM z+~Wd8Uk-_O?h}X}HxN^fFtnEaW6*dV?_w0FUI)9DezC!J(2kqn1cuSh-BP(lN{|gf zOk}G$rL7ENhU-Cw6tY(wqcTOLwDlK|K+aQN2PHFvJ(#3&VdrroYfb_s@0FX>WKeQG zI|G#RZlD->Mvay}jG#3a1IGS9JQv&ItzhKZ0=*(yfXw?nGZM1ikZ5%me;!8I34P9h~aGXp6r8nfyMb7x#0ps*`=+MH~ zVk)4N;Zm~DAY!~l94j?s-jx1hHEfzrylhM{9?=u+CKnj;NZOSub- zj=C`{k5i?cdgMnUSyM&f45Due!#-8QSDyk%ktn@zzq`&CW0$i*JtErTQuFBm^WI=k z_lc*&O=^t!bP}j@1ixwKy?a6ZR@~bNYOSFD1nLe!9RMZMJqk*`dmJ)sxOj>_pbEFm zK0rRl-O9wfnrJxxH*?cw?g?h*<_Rh}bLBm!%#}}*GgsbA&fL>PMkHshO!t2?_Xn-H zeay`D*krD}=ajkfX>#Vud&!yG+a_~my5Bc**@nUKjfqmCYnC2V?XXqICeDO$n8o$B<@6q9gK|Z`Y-jL-gXO}rqL03q5(%IB0x5;-L?Re0`X={ zh%)pHbKQZ+MZxGz`GLsAdStE#pF%x4wOEgY;oOva`~qM)Ncfik+eI-Q*UfYZ}=zI?t`N;)VX%j zZC~olI zV>bGcHo75kVEsp|D`}l_f{_VseDX1N)>gbK*ni!Aeh)n|Oe`^R@kK{5MF)J;cwIN% zz^Di=)PgHo;DA)CFwOIh)tlFI$lh|cS~r1{n@dhd69(1MK^SeXpO3YP;}${aSO&vi zys(~oM@?gelaxmr&q6jCk3 zTFX+s*}u|*|J6LMLVCXR$hZZ;$a72apgi&ji<*$NZZ)VHZKhyfqb+%E4FM}3;ccx` z-CFtdQv3mG$*T?gi}!h-!?($zykb>GNPr~(nOIN`J_E+p?m+3)`Jr=#vs~wBE=P}! zEU1RFN3U(n(&-qLFq=WFvYD>0NxUJIG;75Oe*HT4o2a>MiGLCtIDSp&OL~)oAxF8x#-D` zRVrt<6{pf@<&zxUTWxO^A$95A9trAJ(HpG+^}e83ss1dedQg88)N7y~7Svu)+aPVO zivy!~1@$B3h;&<*f?6va*rPyg7f;85`cS;f)7V?Zz3HH2YK%0N@BSK;eD?q-=@36` zK5aFhR)T|kS_MkJI}6meg7bWQOU{cyN$KlAN$ELNlhSVnC8hrql;qM8O|6vROi)sK zy6ry}(q9BhN?!(QH{Qy14F)AsTL(%?)eK5<$;ZG#-t&NxY4impB^?K9mEdv>C^jOw zt`Mjz1@$vf((V5{P+tfMUIBHDc-jc+Q*rN2P|}0<7f^C};IK(yu+SITBnAq3Abu*| z#@%B4gCRtoIfPgtpG0r2PQ)JzUAP2bch@^gxa(q(27AzPvgpM6E)i+aMXU#Wjo=Q9 zzM9c5ihjob7`momu^$v^6FewdP#d&f4M`CD5{O=rCrsZ4F(1uM{%z=aE1IQ=WOD@& zgw%wP=gRfH!wEv#F30t=Fn}4``?O92^Wn6|Ft$sqh0~X9WXTYIdwL+pHQF{yg4=4_ zN2lU-*qeV&XiNYhPiJ)XHWCZ5f0@nztpTNBV>N;^R z7ynCKM^LlGy|X~cS{MW+YZsk2atz7EJb4c_suD??^(?k@mRxVtT@KTgll_n8s1X@L z-_}u?ONh0Qvo7;FR>hh%cUiu0u4|nJ!AVL7yBn!Wm3o1aDiwp0;(JF(U;ZB5*q}#6 zM-Tp-(&>?odQ{KTI<-m6Lp_2OIgIBwdd4)eu1U^knw-x8RV)niLvSt;oMRd{`=}dc zxxT#EEk<#y7YmUW2`C+W@}(a_oZ;DvGs+Z4zLdQ<>8vf{x&DoUA}h36SoDY}J6RT) z{;=t9rRFH7p3!L4m*SSzD^xHmv1u>o+5%>eau$S|Uo1*)d4X3Oy&22=a28{pC<>Q# z#ceePY$42?q5yLOP#jxZLNhs%(>a6~^cGDJ20NMBpbL}BFICmCUQ%tgJ;wb7k5hp{ zDzI!Ll^O3C7_gO%zHDgxpyZ;}C{X#LBb)(>LycS)S<1%ZX;9K&8$ij%;vgv1FhpY}w9oakN;dbh=5MZBj9gXu*%Ay^fK5IL74Qhz<3L{~lN@ zv&M>-94)N|!@@>7d;UwP!!Fkay)nJSmUO9<& z=`DrMS{?p%HPU@{rIZYPpA2zg2e=0JS%_nb=jhGL3+~2EUMQ_Ho&|oKI?j`qy?h70 zIg8Pj-$MY}HDgvDgUzb&FANNymuP^KG{9Z77+dtxgW>k#K}(xf#48Vx%yr`yks^yI zf>_!6B52`GgyEsIdgwkw0p?zcP-nEL@dwRieVHbG3~TTgJ_ZcV=X&5>7~j}jOF`lC zT=F6{7m03tk-0C)d{ELkz)oPYFwAwJ3_-Ckj0kF}Nku`)tmX9OdhwK@d6H6182v)h zebwq|lx|pt)5xJnFi{MB(+;*#*J z@|EFgxYL$`5AK`p(bfFFTzXlV-F;PdbBKXLV5SvYO&{;pOULJjE@UWoO{yEMSh-0F zvU8J)O$>LkRHnE|m-1$&2`6J2g@ke49CR^8Ef8b03*|JiI)SzAG*SA6<7}155>23d zW6{gytOp~8=o$*GLOfY~Sr$-y3sHQF1IA5#Q(R@7RU(ei>H#|!eB_AE2TD3?#(E8Jilynk(3F@eL<6BVDNpuY4m8o3< zO1{h38Tl>`M3OBpj>}L_xtUo${k!?}ALi2>)F$aTIu_K=MBO?O-_mi@9h4kTG zh4J_BRw3@>C*8rMT6X^CTWC$Uh?zFKxbZ?ATInHS_4qiA?V{}P2AI@Hld3VP1txVX zC>7@+!rVA!);Yd0f}Ik^%A%3>8s0YH_g(B{RtO;g<4>_l zp@cC`N|O^9R-$&RP*8duc6}$iC$GyQMhknhYCkFFkb(i7v03t5l*5CFX-2T3@y|f* zw{VK;Mk!Z8BXcnjMR=eL!Q?)_{r5qNM1SdFZ3SB^u_CbJ`NyI?LoTLdUAV5xxc;)^$A5#*7oC`z2hnN%dSpwxdA|mvQkP-Xy z^xC7{<^!}zSTh*GraFW$(wBs}TP4?PtC3N~^Z>?!LLGN%c83~r;?2Rd43_8OsPy_h z2TFSV*!;>Sv=bU2>5)4dlx+OW1_WltVlCoE-w0vL$gq6TJD$g}NNn9nZDFw0sXV5W z-dra3AR;0nQs%CSw1uw|dm=RVP`B1;2nH~Nuu?uqKx*i45t@6c^!Ub-2H7cb!y96x zV_Q<=bA<?-~ z3Z1WF=scoA%kxF(e0ROHG4vx-w*<6|oUam*^Hm~pUan4(9U7^8?1-Cgg@~$Xdj99{e zF%YqYm*gT6IeeXO>0&d~FqjZ(C?D$;2pYRk_4GpFcaM=>JBJ5~Y>uFGTLqjC>fvkf%)_k^B#v{GKBMACdHwceB(q=vit37-t&Uu zx?rwr8Ymg%$Mb7t2q#Z|lIe2wK)yQ-Xt^z50VvrQJPAsMb-oBnZV-4Kl-wY&6_nf{ z@E)j{_~g0{;9G7GI0Q;=5a5Y(<_3XEC?JL&c_2>2lhl>CCj=*J$f)v#Ma3$g$wA5v zEDN}KSB97Bu`LG0qDQ)OA0YpMEe6FYTMY6MaD%?DIyQ6TDk0{@n9G%XiYOLraFz9} zZl|vK(QccY4j77t7$I{Wg-IR9oscq!Frd24+VUs)A1V!8g^01{7FN(`Bnw5eTW)N@ zZUr{JGN3}d7o6A-L^RTm7{r5_p5vgK`B(604m)`B*=)D z60@g*u6;Ajwz|to1!z@l`osoeHLX*-v07}4qd3-i5{Hv=p2R`=UNM`w2$bxK1EAzy zwg{-VM6v4#`*#(^k|7!LLlJL&K(1#1BleLL2c?+`wIJ$fbDSZ+R1A>(w(Y(?tJZVF0&4A1k^ zu^kOz=v?ycgaro8JqSH`c|m2#r+Q?j=)`FX@5(;t+ujg#z!TwjZE!cA`XOcH8-Wr9Ga9h=&_yxQ|v4!%WZSi+`Fc2?+D8t{juvbijn?2B5> zEk4$Ax;nu@MbEb^vX_984ywO{k}jz3$ZJ^?8Eqn|XHDuIP_lS_4eEMP+%$a4f_f?_ zc@OIhkAtPzUM>?zw4%j{cTbV6vmEHh_fX*g3!dD85%-n(p)SZ{_`WbE=k`Y7vZE^p z697?SxpxZ1e|)1kO93#+Z=Q?e48$GNUtZqfUz`}K8t)XItD<_N#!856GYiA)hKmr= zX0U>?2UAO}-egi?A2BIS9pTmGni&>sor zePXqN6kwL408Ca|f(@b+|Y z%r0?D-VGQJ#-{2lS9`b#?|j`DDyGWWtXxQ8uuqZ}pDd(_ZLUe#yT^I1TqYQ0io{o} zx{5rdW-h5DogMZ{y75Got?r<#e3BO*#H20#@`LwKbG+ch)DZJ7;e{IC*a@k~l?l4D zq@#ufM^YDnl1l)CK}l(BoLz@D!4#zu@r4$?C+~5gRw@>sVa6r1X4l<7+o#9uQr<;S z*6gxsnB)^&mEaQ`Dkn^;lA*D+PmS71ci|bJq`Q!rCEbOrc*t0wc$|NklfAFNvbXUzLQB;NNgU83&C zim+O7UM-8Ro>a8{o$fcrH`e6+XKed}S3R7wwLD+6O56}4S0VN2W8~363a4qGOqOTqC;}Im#{rB^R>h zfVx7A?UtC-Ehcps)JpM`J8$GD8zbh`xNVLX)i|1`?HL;eM?1?SrsA$x9`A=K24>sp zG#Li@BIcHUe|g}aqXW4w(vj_IC8)E7AO~xGd95$tUmQhMz8<@bV(a_j$UXD8v=@=< z4FJgl_xvTTJ_BJXi>?z6hIuR{{rYKjoKL)14VcQl-Fn0i2o|9?;U@f&7>{AUnmXMo ze7qiAP~6g9xi;trjfDl{IJ2jl{Pl2_E?U>*Z|2`^STbI;3&eXQJ_LdDat`xJYm>h{ zc45I?sZkIdc3|>Zha1?*a}zRGjSq3|ScN7F6wb@)REFuU?uMhyqxQ z!=0y-?mTTKx>`hJa}l^f*f+iii~>rRB=<*f{2()As}8EC$oBc5I8=xK( zPxpe7 zx5^$+7mGB^J%DQZ6Wxd8WvLRb5RSps5W#X_i0RGq0Aj8V9*2J(7MxMv)RTNs=j@&o znooXdc}LbTzGHo&o9|fDsj@yvQ^(j8*w(R&U>Z@!&IOUU1vFmAR^r`k>ewz}N5qpa zdaudusW6CV*2EE{$sLisC zG`m=fw)PxeJdi!dOi;4txDk}>IW~ZjJ;yts#I*Ph=OG>!_> z;7nPVNjl7U=4dB>s~js;XtA-9znh^KMk;!iGz75xkBv zss%=Zu|;CZS)Og6Ex!n2)0-!c)OtJSNe@KkyVZ7Y1|Im=t!oFNjoks`5Y9V|`Vj>s zmWpwLE#u^QzU|XOdK`OtJdW;Zdr)s})QgUU-^O2_O$LQyp0b0Y72!@O?4A?c>ltr+ zNj&y2fq%VEoJ1@_N~GjSLDTOJA_W{%s@JyUgtzfL<@OL6gG`2ZAwMz8>2S!?xTnQ_!DQ8uCLHIZ9y7(&>itjG_#%Vy@zOcp^`%o=5QFQl((3cTVkl`u z0tot4F?2|nku@M;^yPi!$#*yDsxRmHmg?ZB)grs)DSBJuQ?>qh@lH_{27;0U+GU_* zleP+!T-RFzs*k`i{!<3laDaT57^ofrb+>rh6(*3lt3b(ni$L8gaF3h!Hk-H(cu(R+ zo762P^)e_qF?=7?1^DE;J~SzA$(8pojID$aW`lI8XljL1AnE9aX$7C5My~}lsYc_Z z>-{+C`f2QX#756i^*Fg<(M)m5wXtXk>l;qGZfAee^+WQcYlQt>>OxZ(?x9Y$-X>1A zK1-c!eOBVh)(;`b!>b!rh!z=l7lSEy+B1T2q7|!DlY%n57kggRBQy(}I8(&Bj*LK7 z$5gYobvmZ{VxF*QydxrSs!(*09%9QQVWfxqA{@s|57mxmY#}}Q$R<6Cl5j$`-SN^a z4m?_VgD|dCibq(h1D%)uMm_%}pQk^1np>1n#CKsP|9y_0E)hphhrZ9z(@$r4^fXU+ zjvYPym^gYGCr~ecpQ@tt;MCo5cc~LR2biZWpM`MJbSF>uN03i*?Br?K0)<4JJe}L* zUnLKoej4tZRXle(Y@RzE#<|ltt-ar(hqRw-(oFB;k zIAL1YA4xu~H+u_V9BByT#g$C=2gwF7#=dqmEC0tHE`5--Jz)#`f9!DSXTew=75xDy z8D7%^HBTNDeFT(@emw)-p*$+O1BQRnA9Nxp>5Cn0-m3wnLT*4w$0v`JmPbW%04MKR zqZiC5vTBH7cC{)5#}esaVwWaj<<55W5Mn8$T0}OBP=(rs9o(+4?@)P%{5GNf2)gQk z5{>wW$%wlQpUvI}F_L0>2ES;(kzEn>wV`8qSMv;81S^&!Sg{>Lm&P#X8sl?zBhxsZ@!~8D1lHn5R^(~atZeAq z)vp;8nC1o*)7MxoLW6kk!6SCD{T(9ZE7bwl;82(QCJ?y;QS16C@jus zz*!A6tT;7O%$8#Nd5?-Uj=^F-*+4{2hc9I0iGgD-Fw__XkGZqvw;A`KsjX%S zfg5^cXkWc~0R8dkuNdWm#IX6g_7k0fd}<0BJ7^o z&f@K$`F54{ZHA&SKM-V%AKWox@elcC;RJ>oX0hZ(r+67E&Xpbn_wEeg)KXuSJ`v9K z&VySJ>FcZ1d48-9cHq5X$fSId2ol`!wcd7TEJ(@&j9SHr2gzT>F<*45SC8H_OAHG6 zcFATLA|J`ae|>fFr&4@-#6J{;@$}+WRV1&r=eK%f$Yk2I5;j$F^*s8Ar~fcA9AV~y z`&Mo^kuAn2pk)0Qm9$s{!$Vz0ik-uFcpT~Oao;vM0@TPg=f@WA{J^lXF}CyLh}ikjMQnoL&X3(#29&#vgOTfy{zrOb ze0~LwY}tg9nA-_yDs%%@mZuwIe+Ukz27h7mKy-8tHile)E>ZsU1Im7xD(1W42S8-o zKfBEz%(;isqy-ZY>7-8PB)LT39j6{R9a$9USq!pOW!g7x{MF8-N*3?{OeDL>r$EU~ zBHW`FKN?0-Ji%I)!5@K=_liu4ZfRLAXMvKNNo=zd0ew8yT4twTd+j3;-nV@|&h*CS z8k_v|iF3W7xe)ieL1Nqr77jpQ;}OT zR}0L%JRg*NIvbSC)%l>}xoXn`ps}8fN`POl_*&G^rui71?AL3*ZO>g;sI8~NFFxDN zUn4W#6j>>LJ*;T|Ly$#(nde@ziUv!+&{jN-TbQ7uI^r<;E%PrBL7%ERVt+Tz)f5}C zuqR1Y#~0+wsNkrWxH*58EGZvMTKaB`XX24{k2ab-7Jro&st}yzS#=`L%#0 z`e2sJ&};-vAWC};AJ*RBb%oE+ql3LtuV{Qzsdp?m=@8z{)j3l>?L9W5S5J1UP%EWH&z0qqO)&A zboKxdoqac-iA?}-s-k-gc(ER*EoX2$2RewG=qu0p0zV}=(l#j>!oFHJMpPw4U*lJ& zR6A)O$j#j>vF;3;Qz2NH5Ui=pi~A$`CbIIRXZ5pWRxm`FFho87VN#!ik~5$@l*$pJWc~=>vJpTm_ZqM?XE@8mbL&Ym>Tc~P zlet}Ln7hZY&f#OwBTW`V51x&lobc;CLZDGQiC(8j%6{qME4rn7OM*HB0F2$2Xn{_V8J29yVc&2t07y>Tq+4Hq2{Qzdpa75lX3cOwCD(iP@MS*3tlEv1r$(fSONxj^Z5xQ-%E7A(bWOmJ{)@xlTx;+uHbMC_~yt^Oo#I`jmMH^pzN zaE_KBs2*LC17YziGw)#YLYtMNTlLaEhu`4L5{fI+L-FEFN+i}4e`~<_tir&GFNX9gpmP^`Ei4#)=zD=PTPzzLC|_Bz%NQts^Aroe;U(gS zPs1nZ&CMLPz088$a-(i6_P~|1IM>+La!OdMYY4Z08GVtfr5Z=oA0y7!(I@V?)a5}b ztk4RZw2`95)@Xgi-+4F%c~m{_ivng;)F0lX=@s=;Hs2L?xn77occk;-{p-Iz-q^7I zqi$_CaA6kcQxg@T`gLmXouK#sN#fT zX=v*xv584b1j4%BTf*M=f&_3)YEe@_Um`6ESGOgaMDj@C86HTQ<^P=h;G zy=t0sdY|nxwxfm>qmmwK$PJx|xgf+2F>4B5`jHDA{jwJR=*BXF;ivkmW>Q>A$s{==;BQ=ZCF3=vspR1NEnE zlaGNt|66}h`g2{$_2&*zSN>_%pPv9D>(4w;vi{V8lJ%z^RNDH3Gdom&li1J5J;5Ad z1mOFNiUvQ3u?AZXu|IT=7+Z+p28SAzvDPeklu^l1#y-4*Gv?JO;~h21h=ufE(tnHW z=3>K0*#L0>79VBw1dmR_br}F98;+Ym$??XmpnlNt2KtS_MRHh%8gK!c`piQ!n(GJz zQ$w@1YG}rC{XaA`d)hSB`=+VB{6E1|)&bi8>88Soe`<)Pc3n(<26bjPOo^>FkK?4j zyA$hN2fl`n4!S*Ex+gr4Xg0K-{1|!}RtLP|2igCv5D|ar#+X$6 zF?2}A5Cz6@A7Q|fu=VXx72TxjsFgKh#!lLLE)dMd6{O1yTz$r2LfQgB5Wrg#8Tu`KL(dA|5Pydj6_H6I6KXeB zax^j)Y-DsO#Otd^eZ?!;rXwjd?C?RcU-xpdR0$xueT<5vL?V0fQ``mKx`vn7(9~%9 z8(KZK32yA$i1}uWt1$o#w4N927sw0emG^5CZo4+8@%#pPx(3XQpV8i3&R<2qvAYPD zKuCkY^A|<~{f6a*PcS<6!<%qL{=K3zp)A zazia&$e@{|qrH3`x7(iWg$iK`zypQgk#ab062BK5l|QqMCSop5S;Yat-^JA}J=yVq z8|5mCySn9#tqctBB-**hLG=~&;(1WJ1oagt=>+F)3h4yT10|i{r-71Aa4y_RCpZ`T zq!XOSteR(MdBDhQBTp3RnP*(V2x$H8Tnfm4;EXHF&uAOVxQjO4R#hjCX2eNX_sHGG z!r?R;fgf;`qZbuFnV^f(O(UY*ps|gu7vQ!!P>!{Punn95k`lI| zt*8}xO6Rra2CJ9o+Jf)2FP7N2i?|aGG92n|!B6qZ6Q}s=3n(^y#gRV=-VY;i#JVT< zY$32-yM({sqZ^kAM`zN>Q)AJ9@YpHmWqgj8WWU%Kl=Rf=proh%=b&V7$n2C9_n*mr z@hniXUo@5#3cDLV9GfcJZu!d<$@XVuMHO6F5c|1`%7hUcrV=%HRLQf&P#m%614c3; zEU3o%g6@~J3H8EgWjd*m0z#|DpA{VZ=w3 zAwh9E3&xLSl@h&@=!ve1wgd;;t|z_&5C8Hq2M~0{A6jIKCycvVU)EU3oJUIq2C=E$ zNGx`y91e!(3Hc>f_K;^qXdKm`My)s1-jpwvwGo(sZV~71#RfOrBXu{#!+PFQ{6Vai z-AD$mIhA8vmXPC@&7i799sV<@s|Cfmw#+eZ>y$Y*29(UP_zopM4g*8?5#nKB-@sF$ zCcx;blMVwje4a)u1>kc!_WNRk&jtvZJo*sgir>ISh#gPYLPg&rI=IfK7Ha_J<%GWh!C=c&__RY`T3{{{W$q!(gmtk*{Mw z$z5{SgZhoQ$K8lBmX)ivo5el0gt9efdo5dYw%4*X=RP>unsZmRY|Y1llC3#^E6%<( zk42ygKMH_$tiLUi3gRu_`$S(SLK~k|ci} zr+JY3WIW>et=$N53)Tq9HjZaek6`Eg^T&4vwNmfwT{#N}5hIj>gBlDC#y9#9g@IBi z`!})lxd~0Gjt~vTKt<-KUHXi(=>`5Wz-t)+ebeOlkqB8-;mq10|bFE~Lrk zQXK#wPH0{!cp$h$^heY9E5z`ckM_m3!C^Llu*WtS@Bamp0pE)RYIO{B^_P5#_|YBV zV=+&Beg7@EgPsMgQ=kfMpFXiuMf8G7G=bXk2p(0GHqAXVI-r$57;!m3IOSphR(=u8 z=52!scXvH9aI%VqaGv|uHGDgo_Hn;1L=p`5F@nD$J zBiaha_q6oG#FwEphv)PGqxB+Qj2VCyP=>K^KNQ+3#lFJ$3Ms7fQ0%st9gaohr1I}G zc!uN4N)bJSP+8e6vhl6N#1LH=!9`yqI0Y(PJ~`0#2$b^ZJ6eNEJ^sqgz^X{!Ljz~! zhE56Ku(1e?GqA7xgWm`!Y(cyY{x`0ejHVv|z35GS$592Vh#sd`6zvG?_&Ug7&VhKr z4OTfgEh2h(NCe^iK{WeJrS|e!Ijuk?T9uZhRreo)(FAfUyF*!WXe}A6^AxD7L@C(? zN`~mDl7PTfnb)cx(~-CN!BW?}%b4e(OCrWZ$f_YCtA?no8iA}TW@rhbTz4D^;ulUN zyWD)nsT!u<@<3h{VZuiLMpQxhW5tY>6%H7Tn00oV=8qKznKcMz!;I%*+)~z@pkbkreuyVmUv1WHKRlcpR7n4v1!5` z^gVtl<#J?z;1xgo$?{7nO32s`rSuasDg3N^d~|OAOVVG$Ocu`gv6Lo%b%O1no?1KJ zETG7d2;*G;ALhOSEUGO0`woLhs+eG+qGEu8DA<67imsg~t)O(+t=QeMcI%p}uI?Jx z-L>l4t{vFA*7v^eiMe-XM0fxH@Am@3OmozlVOHQ`G+oO&$Kd(k+D?MCs`84dP74 zd0E6GI)mTXS9gZl8~bgIt<^W`h`_Pq7lM6p>hy#EQG?rs$)k~GL3c3D&Wl@v#C{sF zGf1E4ur3lL_GRuKAl)Ji4+u}u?0~zhYa|^9iG5G(E=cTL?K4QHX>B$b9$!fpf3xB% zVR+W|CrNll%`D^IHwVlPmP#Lx*g4%0keKDsATi75- z#@ml9W_&!G#T*Y3vy6Xp!z|-3Yp|GCfMh`j`Wr!FG4BM4+1m>eixihEQv7vZW+hl+ zksvW2y+C5|jR1+ArS1WVouyuslJU3ZY+w!jVn!t>=R~KD%*=lj5a#`{m*IX7 z9bI>=u_q0F92_rJ!qbCzMF0=);LB9}^zIPfs}L_m6H=UJv_I ze|&5czqJHcy%p{NuXl23#)v7?`su+=w_8 zIKD!ips@#NTSH3u8)ZSInQvgkp+J2`picJ~&XwUiF>pJ=7mhU#q{0{5MrRKi-?Mq( z*JIf0N|63D+@BjX6?fO|@zem0?PKx#Byg@1RQ^sQ*g+24?*_MLg5k0=ZY%5n8IEvT z^FLzY$-$pgi{usp4QI{vaATo8X6eGRl*xrof?wW&!qZ_4e6103%awi>bGyQF`v<>* zqsk2_m|G(}m^b9c{zL+LvH<(a-U0agwy(z;jqlmsBsZ9_u(FU=drVN9TNnReb#m&n zz%ta8cye$5$37u(?{yF2YG4h&D|1xv*bBrlS5xw9#`!*e7$gxWW^!)*f^KC~>_9N2F3 zpaGB0l4K1M{ujDl(OFq2R$dmQ<0a_uK38fm2{j^^hOMPy>usgjdRZl+LI5s!`&nu+ z3AJKO{NOK#i#AVcFbOphzUybc)M659rDf@7fz)6UYV`ZApM_G3NvJi1X~E<1mP6qq zG#6U3#bT+!B-9w0Wn@dF29r=@{C6W;Dz%t|T2r%(Y`N565^BsgXz*@y1XQ$@QiDmT zv4Ckf*(y$v_KH($JH^QxET7{xk0xo#_MQSq%wbzh#aU6sD9h7XX?TIV2@Dt}ERneKVe@c_JunQo!hA}Wb^u_F=P5f;< z(ahPs!0p1Ds<(vwtm8)8J-=iB>VJqEZTA0;-CJar=Jb|qPEQhP!utl`GLt0=GTCiglaL>wnAz9GjeV5c=5^6Y_Xf#x5?3Nl# zLX83j4ZinQ?^QFT29r>u2-C=7?~O;`>?nars8!P7hv$OVLqyvvHJF4NWl6)il#NnA zmtV2Vw7Ho*BU_?nsJ@a#bD;;naSEanye5-{!XQ;4J!HgM;F7id(gTyw13tg6SKI^z zd&8F?SSU3}vczpvSx84T8E6ilw${_x0+Z|qSirwcHM8`!_*<_;TIh_*(iGKsJ0L?~ z5{6KlyclZ*2o-ogD7Bb`TJ_9osSnifPsUjnFbTC9o7GbLIxMxAgj&s+Rxc~17Ytw9 zNE^8UY=yO=9g&($Ld~{JQ*~fiT+reDsMKH*Y6P2TxT!RbNew2UMmT9WSIeom^)9No zMi*0DyqhR4IzJ_MX0Dq#PTObLCfbBrs|L(j=w?^YWCI56$CC|o^a(a}(N0KjOhRwb z#FR1NfJq_<7Vvx^mfVU4Ok!0uQw|q2YKF>D6Gmq7s*4RtId17KuUL(+w6U`K*|LhI zGQrZhMoy(%??OuH=)y{gRDY#Jq@Pm4yN*&qS6!jGLzT=DlVk=^6zDh{e2R8TCc`95 zrWY|ok%EZ~rjHiz;~oDdfW;;OjFtgh1*f8&kpVCX0~kh3O*O|61Pf&%NfvMdq|m)- zUM|}M7Rv7yfy$9=77diT&bhNIxg(vF+};J0+`7DqT_Vz1!vlbc5ob1ZxJyyRai|BER?k*u}Nr=MRh<}G4OjKdc_7l;`I?2bxC?ln12HK{9`M(Q9NlD z4KIhVIe|&&eFHggE|yJk@Ghu0z(mV-ZcJx2yyb!y%L_ByL3~_WLY3E_(lV3K@>XJM z^1|Pf)GM%1_L9W%8e&0v9DD#lG33Q0tJ!)>cT1&$rSS~e9mt|xmfo3!-VcxiV=Zr? z0`FI(7L!ox7->0s*}zQVsJNt-h1tXnW)oK>pQ^VlU|eW-IhRNejpH9ziH75!)tgD^ z;S4b~Rk=bCER<^`u`%y&VW@}YZ3}k`%^7xi;RD|Pl5UuUZf=q#XQQ1FD&h3RHVf?7 zC&WX13NCoNCM_}vE#4z$C^9g`=PcBMny5?iZ%Q2|p^hay83M;$cqAIYf}y=P6O~(1gGs1?zs#k*f}!?tTWT-~HFA-Lql+C3 z64>QL7KMRQ1O|$e$qbE0B&^;pAQdJ(5ET4zLecI@4@^Q2`HAT!D9A2G5L84dK~iq~ zS_s?8_|g8x13#Nv;A6>f;T2xZ$yIic@aKW`3hsz{5|$gJek2tDX)s9`{BV+rgEW$) z(jbi?sRBr4$%^#^#l|An#oUuEa`B#`&BX->qA|y~e`ONpSc=k6_iYV9hj*CIAVAb$ z5^9t;(I}zPxFVkY5M%ruZiGby}dGiSRI zv&{(7F4oxK-{67SMVpPe2ELiI`_p$beIzqw66Vq-%S;&$Gi4HH$~25KHD|liH#0T( zH+W!njWac8H;iSfI?oM)xI}v_vt$xx*^OyfTPoI5EEDyi?0h=EP=WU+Qj1Bb702R- zX(0b=YbD2B8@NVA+q)t(u^x<%J7y-~Zi#6kYXZDPGv^~kQzKy)M}r{_CSflyyJ&N^ zFe;f^ojzpOIUk(2CbMiS0TZ*DM46&`TU_w=ROZhlWDa6BoUIT2M4r?)Y zgDpfvdnRo$32mjbJRRXj>7bU@tx=oV!FSA!aS>+{R+MR>ZG4VZG;{XHYU(JW!I~Ii zU=sRbcG2cqVN^1;I+Mw+@j*~L6@PjPr@IH(H;2Igrv zq+3FKH2MY?yuFZ?nS_?-5z|djaG$iCAlxUdB8eTm42Hb|KU20^3AYwjD#l5u&sASa zS4=`zzmPR!tpHdf+AFEWB-Gl(w4C*dv$wrsxtDR(m#*GOEheEB{0O=Sd+D7?=>4*(_uJC@-{!p+ws0(Hs}xLiR0>As zQVO=tsT72Z_60ZPzX=AZ;ncQd>G1=-^jSux?xl}1GA3bU?}!<#j!Xfk>@x z@S!Bdl`tI2WmpVAbS`WIU;oal+62p{fj_8cA5CIwa+yD-sLoRGeQHq=6Mm%Uk-xr{Po$8ZL5C!O%@^ zlCZPch{OF0I{+^TQchay3KHK|ZEbPRp>C*2UU@ehvBq@j5k2<^cu2IC-g=U4C96#P z*SWl{N5EM!^h!(CEBK(dXiNilE=xCTg}WbFqw`UFMOJtpC|*AISeS&FGrMRL zA7U2GoZX!)^PE;n&PcqR3-4a+qVXW12Jbm#=1juO@zE;nHKJ&hMlPwrB-A*_m@WAY%O?=`~G;?-ekzICY*!;6EFN8Y0=a*SC3G@2EEErwi^;T&WkXlSa zt*>Ua)Ysgcq!yDP1 z#{FXfl1%oGr!AZdSt<5#gkrx*d+VhmC}E!(&SqW61VGAsRWB5hkuV8JN^UlqSg#NhIwCEhkybmXiSOoJ*rBZ=3_4m;@%2vSi1(uqB*`=h2*qC&OACm@ITm zq6%?AP(oFq7m=Ye39VKnrW;bRA={TA47~X9Aw-XEV?7tKX#FbOppGYzBBjeRXz zajC^5)N0PO%*^c#gc`h;keW`tuYC$1rswA8CaPp`e;#A zafF>oPH))j@I4L^u##*m!T}I3ee}hZytzsrOhO;g#B>uB^pivo4uDjWEYLQ)Tgc8s zEZZxMEwbK>2aqP})x-sFrDOn10+P~;n9+iQ0SqPx0~kh-hpBnn*B4G=(HQ z>6k^5Ej#I`j$}CX7>MuY&e*V5c=VQdUx}TBOeY)sBqST1lhvh-EXP6kCzx~#tI-yg zPFAHXY%|yy89z@}pN%j+q@pkhEGl!!tfI?jt>lBpEb_I6cNj1Eyc}=BS|t$|yp@+l zU=pe?C3U)QkV>IS4P483I3}2cnK2EtyA)ocnX|o`+2#}x35IX*Z}7nEqRmIbsAOt& zHjrJ)I2AIEgpA=#QDodgrR@%i?BtzEnA27k6&)Y3jD-fSWjxH7NtiLyK-SOj63v|L z9n3bT2)h`)!N0)+vx_#j38Rv!)!9pSbq-drL$FgEyx^&(M0UbnNu^m)X3HeZ=P-*X z+DeIrIyt_!RkH2J5pB4VjTtgN9)U9nHz}rx_VJ%gMKkB)q$X<-5oTbBgGpFdW*2SZ z{|1X@&hB|`7c4>Cic#EXi)m>yVD`~=o$uJcLiQc)tQ0%1>^JEtvF73k()e1&J>p`t zjw-93vf@kvl5&%nZb-$3?1u#5l=6fmOPWYF(8ZsHID@dOIbdOhRAJiRp$^Y#8Z# zf-usLB>k7W#Vu%7gQG^(-D3R8jb6zOSbvi6Zt)P3F!*$mii0$Yq|zXbC8+{PY$|1U zi`!;(x0pG`amOUcK>0#xI9JM{l;{mle@5FY1$Bj#oS6%1p((btX)mp_F3Wwy!Xi=$u&izsY1!7gg`;I73nkf_cD-=P zj_-Oy(PnX6@a8YWWfJ=6LJ<{*D@r+D!;N@v#0*-v`(j)yHIr}$%(Xxo4=>To*@vS& z81^Cx@eYA-Yv_;Zp)Y0^Z7zeCXy)v8C%fuXFZF{>0Wwo2p_fF`VBPNm-S70x?*ARw z+V1a9x)@Jm+-2}qPkLbzdg)0_H$lM-a1cS*{X=T;snPA_L;Uf zjkh`N3DO)H%K zb_UgwcJ|sshTeqXAp^4Y3LY{HB?$-62$FEnk0uEZ8OD)>hYVdw@&suaxYa9o?SNr; zeV-jr*bctZbSWBhgBnaija6!mO318@3*H*Z z(lZG)){};_mxJP(T3m6BbWvQriz%+KWy$m3=0YF7$`7IoybOmee~>;hUQ*prg4=A; z6O+)>7Gk>5dRX9)*hLU-ReMNcyS0UAs1_C0@}aE~#Ge{Ae6^)MtQRdvdSViK!sBONoe&pG2M`g4g2IVLD(nHNctDk13lClj)vfeRoELX+ept$ zLeDSAxXuG`hnHyPe0*j;@YMah9oZEc7y;A3eI1j~AJagV`U_s>Z0jLdwl`Hr0*P{KS`W-F z+U$nC!<#v~HqtJVL@mB$m(>Do#(l?bPHq=0L9G>|T5GGo;=-yk`)E7mJNEODef3cQ z&D}iH_TZ9TSYZ-Yrx4RHb15~LYvEf*smUbNEKZs#l8NXGcd~SJ`=Aa?LpnMdPhVhrp6@1o9L>64$@9tBRguAv0P7T!NH)$dw5u+OIUJpSRa@8s9r9y zQSseUqm8u{k2?NsWq5umsgZtu#Hj^ot9k)2{I)%=!p%b6pk_)nDiW@#0YSh#oJB)^ z17hJos7snzX&}E5v9LRSA_+BXk_3XLVLp&}2qhi@iHESn|8r^$$PK2}&}?ebVQg$d zgozj2&PB_rfI-rWzgaKB2EGT&9&Zj@^?1V`j|fXiRkKZGtY=eM|4!r>KAJS-h0$89 zd)C!PrzW|pEoPN_7nwW$mXTgbNllK4@8*)4kl+%V5Z_I0#zej%YthxH7RFTUr{uKw z)R?%akf`M3gyjDmZ+96l+|~WgV1Fs&OEHSCx{Gmyn$KUPVs9fw4GlhEVkv!6QlsMj zMP6=3RhvDtT^EL1;|aGUKjQOOo6`!bjHG4%dn#97@?q@&gHKB2lu=dZ1};^`hW-C83Y`#Iv@RlA4gHw22o1k%_FUW5^;+s+rG26h*yf zNQa7Lz1I_3|I_zDa+JE!Si(_ie3;_`m@BQtQCgBD+@MR4grl@LNq!)?kQ4|~F_LhU z7A2`YNJU60m8b-zDM67+Y?=}q3Gn}3n?!_UHn2-`fS1W#`t8mB7PX95c8Za;E>6at$st7pY zO>GG^YHQXCmcI!q&Kvy%MfI+_=s`=^HW<(?nJosjf9hk0PtA^bA)IT1h<&O!!0@GjFR|i>SJ>s4;#P zweYOw7|UptdB=J(?^sW~mIc?-jp=4SqXl*a04;=&9$LVw9EN@{&Lmv3*4S(mtuqRVC)zNSzg2f?pjP0vGWBfhHAI2X~62^}Qg>0aoE})>&;6eNQ**2Ucj>EMj5aY;@t6FpMrSKC|iz zmLrZ5mgA4sWO25~#>N?|4ZC0yp4Rn0R7f2eR%oeNZ!1jDtg>fW zVD>Bv^np2HMZeY1_geCT%nc-A_IO&Eb@u%F)qluc9S{2d)vPaAVYY20Hrm)u5{{A) zB%!U*(w2xmtBSGAv0^N95H!0l^wJzbqxN6N*=~vsE4`N_tTdhkidYS9jK&!pAZ0nu zVD1aUTLEFIaETc9NaEB%^#V2M1er|$h72Z8!V|gEv zr1pV+%r*4Q?k`|@-;f>-UAz-xD6c_c(Z1KLHD?#GkHo@(!3vIp$WU<6Wm#opxbwjx z`_YWpy&23%2MMw>EWAZz$U_WQpiuqsr|1l85zVS)CpOw(IbvokN35qIM`1Cm91Zu8 zSgb#qqXWf&Ip!h>dkydI2%qqgHyoCDfJwJ)*j+C>LPh_e5zH!&S=-!&lAqRM zMGRwBWRg|(EDId7EDNC{?3#PWXbO`*%)S^&m_6QBGM{}N*OWf-5z)yB@iBd)A|d(M z*zmB39)4})<)M~QNojCl$PX?6`T4OWxz^s;S4W3YlrZbDlnI(u1z09n0hWo{2Zdl} zfxgR=7p#B>Nmv2AA!fb;Aq~PJqEhL0#y5Lh?HN6InzaT$tYhROtL#{mm>r8!?E^rw z4SiQ9FPL2|k}x~G7iT`Zu9%!3yUk}dJ#?#9MHhZ%&A|#yt4k~#*er3})Eh`mv5{m| z0+tGvfTbeLqou6$8j%;&3zGhXF22KN-6o`NawcjT(e4#t$9%vx+| zg8rNM)IQLsxrV;mlNapTP9$O1;@weo|1e$5Fe0^2V$`?CEjl%x%e$C0#!Q+n!-$PG zSXX1Wu&#y`s;(B{WmOWE8g>~=?MF+}jbgx(bSDW*f;VD?Px#0i&gF1Ui$%f1Wphs; zp;P0dz&NwUgwb!kCz2MHh7}1*!-@nec#$w@!}cJ$BC8^?WU)vr*&i(uyYYzrdQx0i zB)scuD3Wp3eKc!<{zI)lX<;U8H;-Af-8`(|yLpVlu$%vptPQtKS@b`e^-zii{iTzH zS>x4uL)HLLV?!f8EiNQ6Efod_j1#`khcmE{7`UCoPqMPSDDurAC6Yv6Scp+(gP=&v zEXEQWZT!!-GFB2CK&&J`TFS{31D0|cNmxp}J!ig@Eu$h5k|X^RV-vdh`2iEAZ_Vu( zwO25r%rt9hjtQF8roke_%vgkK9~gnThQ1e)7tCx4NthYl12Laj9ak76iD~f>I7)uF zzn7b}XD%YdRuTJur@vWtSQVBX2reNDEdtOFHr1C+=yOh5vYjhbdk|I}+Mv-^rS7j! z3UitBW%fm-{Pks=rr77JJ<;df!|d%mCY@jYxR_(#3)$!Pc3)(7Y|r>EwYskJPs;FX z-Rt3o{H5mBNzI;PSb;N@3oUiaa39n*xk>n}lbIl`6^15mSl4>N zGK-4dHQPK8pI_Vx>eK1vgOGsT6(7tFsC@QQ)%=HaJvu%(->7WK=$?-@iuaE@+U+?# zaz&3PO}Bs8e&Xrgn>=ZrcWj{B^2v9fZtf7fr$M7rxi8ioAKtvi zKW=-KrIpVL{`mc6%LdJB;*)cAaJ`SM>vr8ZxyijV2ZGB8y)|iDUdQ%w9PP0o=K0=P z_e+WQ^XZ4CSd}g0bjrb1zpl2kuL+@wr4^Q+d^>b;fotGO7>ai@i-|KyDF|Nz=dKYQG>hlDf^1)}k zhX1ifKkJV+p?xow-H_Ha@U|X%^5n&afvLv0_$=~jVw*c-=ai?80`IwR`jk5* zhTayRpU3ZOxGU3Pa<*%~-%D&+AanPzNjpBoL~j)1NA#Qcym!#_9`BY_eo#GlSG(m^ zYS`PpuqaS=n$zaa`Yw4Q-HX&6+S#((-19T`Us5uMFCM5H^*+aqF^e8<{Ur3wY*V|sA*7Bp(GPivyrZ2yuOrdg*dbPc^_~eqfCJ}Q|Z=EQW-N>zB;nvwdb*Oz7M=f1^oFr$%`EzBT>Lq`kLp40WthyMXb#uqSZwS?F~- zyMFA6NWax$y~JyDu`A!CX_Ra8he_pgK0a_VrSJ8{9TLXJ`!*Z0E@r{*1-W8QcdRmX zQVx&chh=V6_7vOors_7GC*=-UH}CA3%K2PYH=DDk-nq%^K6lyP@O1B?r$4o8S3i4= zFrVe^rk~4fH)?ZGj<|&1&(xo`yYu}qefDL>uJ80;?WEkEUOP2qlxxLpZoPY~oByR) z%_9$Yo6_0w;#W)b- zN_@^)F#quo+jhZXT+i|gpWWB4__6J)=9cQ>y)30``t0Q+dX@C@U2@-PdKbqnr5er1 zyc|)dwRq3lpnkqWe|8F}XxpVp_NEt$%>U%&>_6DPzOdJ|bH9tRi8=C!ci;58YwLJ+ zNqaJJaO$1vuRjLOS(>NpE(h1bP7@x6&pX*`Oy2bqhqay?Bj%Cy-L8aP-(Z)pb!v}d z!K-c7Y~40}L(g3&?WVa;URuz5pRM%~)#y{vY`flbA) z`Xt^il=2|3`Ni7S|NOkU_>mp$dafDTJN!(Jjyuku&D>x2W$Dlo-48@v6ZI4GfAG57 z6Rs3@@NJwha^AK5KJB79RxI%MIaUVFD=p2r+9UWR?SR`LFH z-ISiEV=FJp{-;knH6PUR5@70H(R>Zg9jZh*!6B$qk7web^1nTJn)$0wode)&7R?3es^f|Mfm&8 zP8s&cn3cz?hSqrTsY$!?V*hz&T)mZ@<~+Di^pSP{%XwVSh|k9_t}HU*&b@W%+uyjq zZ8`9K?j3(Md~(3AoA|tGUWM#aw_Pd~*ZkwyDpf0$5c~Nihg@H6Jbm=FU;ne)`+A*k zDaNaK7waQZ&XxXT+0H}w>uOQx)b`d*H^w*n(56shi`yd$1=cUTIN|#6-?v;{RJ6+w z5%1FdW5)O#?)pAydZCNGR!`2eM&Ekb!-2O;KOWiGyaTPqi6dd;5A158K!EUS6v>x5N3OBYU0;O|m-r(&y>i>RX?0IcwFk$7}ne ztp=R$-15ta<&S=~`#OKMqgWq!sp#2b`&}$PXGYrX9{oDpw>5J^++|%-xu;?E* zv7*PIprP?Co8SEHqLWX4_x&A;&pt2wZC!mMcGZWIRmJDNHzq{n+214Ld-WImmQO6c zy2kAd%v+l(dX+2yC>Y$H|T;UwHta^Q4$Kh{k9geE%Rj=oy4_#`DaS@c~ z{F)LUD&7>I#W)h5#kdon#rmyN2hBP5ylC!QlRDk4)_d^=5od(&^keT{R?Q2f zd0ppff9UrF?!I?v>6NHw$D7{RT`=iYtH(uOFRHm~nz+i7jkU&s;NUSi!!_4`2V)0{Hh5_!rt(V2eusx^a#3A=HvUz ziF@0;FM1>G)6wn8!d~v)^X4yIylvowHJ6XLE!wo|?xj7psjqUZF85@Eb4v1~p7kCl z{Jwi{)e8+*yz?q_qjQ4LTe>o-|D}P4N@k2JUAnFHPgg|UE;Whid1hFD7xB4~g?F0e zh&;8j-&-DXKcIcZL)%+Nwu>I}Mc5f{7hFE+=D5i5^-fo_NpeXP_1yX_mrZnwt7T7o zsXJlGqf_--OrEzt{pjKyBClst7xZ5}AYZ!Rr^cL%?-|!njwA6o-rMfyufO)4CEf*J z*canm%rnO8tJ-yT8}~52PhjDfHu3A5d=POTiL&?VUOjTmg@H*oF55Oto^|$NuRbl- zZ!(@wMoh^wVdb44*Gb!_iDEBQsC&Ti_UK>TC?End5cPfb_@wR@%(OjaDkWqmM^wn&jz}Y zHKs*ePK|Bsw`kAE@B)=OcRW~amFv>Wtz3S}zr>;9mgt$2I(*9MwPePkpHjWXRT0X9xXp@Uh!i$9nB@xKw*uXkh7MRj1{9FsEa)A`=G{t-t-Y-K9y**ECza!e{=l z3Wr;CtyS!wlC>&-+~$1g{kXYzU;WlBQH+m=<@4-&e!E1Avdh1|T-l`LAKPAy2ru34 z_5o4n&s&c=#KidDtnhC3FGqTuNf&zG+Fmp64s27!eb5mxukATjr9;uiNoW5F9k#c8 zWciI^{ABAjD*pqwTkpj967x#>$JDTvCo43t51F}O#;}qtLhoCAdEGGAC}TUuya~>0 z_x`=%pLHj)?{P_5`0Aa%#jX*jD;3-;^0+XiT)jr^Coi!ny6$t?1MA=ZsNdC1-hN5! z(_nsF;eN~J6+XMO;GS0{FWzWZ^mFV#*UL|^c(=vbBRNN*X$@8c`YrfiKf7?=Ch=$O zvo}5#8M!fUgL1=LOmmw0YrP&G6><(~Ird4<{T;icue5aw{k5pr9>lwSr5-L-JP)*t zZCvMN&oX;k_9>U1XX}B`7m3A|?C;?7RmmMx&ZEK<`_Bt~Y{wUGQ~Ffygl9!&5A&^4 z^ZCNzBbS5?i_6H_*b)`X9jV;LZMs#5@UOvBx}}Qkbw-0t$NG5``yjSY z%d~$+?mKUvAwG-oEk28J;$QX5heO#1WQy(mc(tajo-|InRV8Hf^-=*{su$Q_@1=up z|MW$zM>qL-LHSX&>*k*|)V1w)vEL{$B-$o)sYT|yF5bWWxijO;)&e&-^xhOOtA3j; zV?Qn^F)`xQ>GQUumvjquuV1&WKKhXG-?U-5T6-6l7(aPLZi|C$`_KBh$)Oi}yhEQ{ zZf4hIU-w_^s@*u+b6bripPwvsIXH3L>6lBd*S210U$0P+Exy5l#|JEZe9&iE*GDfe zmbQ1=kXfs3O5&x8%PKfryWX#Llg{zKmph!W%0YiO&ZY5zI-N&*)_SmcTGfVuU3&eZ zh~t~b4ue9Gw&%wP8j!B$mQqlyA3W>epBqJ zHM=^79*k|JShuizuynEs<`fI?R;?H*Ky=%?eeY3^H*|QtEFFCO6 zUEMpG#(GO%Zu+!r-NMPndJkr{8Tr=z$$`Y=U$+G1ZRI2CTJYrX(c7ci{v-0popCt! zt6#OFq95`evUd+J?3N+sfjeXE;*y5uTbH zXX3apxT4Jx`(3Up-raff&;93fkF9z>%d>E+$joD-qLVjOZCUJW&pnx=N*{L;`+?=p zHUzird$|156=TyoHX2+*><2z{AM0)N_w!u;JUVsw;@b+zE!u@18#;dP(5{95?v{8c zqu9%L?&B{c1UiZOtzBzTDSbzUSu5+6d|YKzi%u0vEX%)k+QBBq<3{Y4hqb?QW7miD znxg;3b{f<8egB_^u8+RjVD_e7O)t+A_G{<L-5+TQl?c3U zza0r3_RpxK-YGxYZ#Mo<>?%I>yteB3c=sBWKlBy$ivQz3qia~nH2=_df9DO|Eazv@ zZ=xUjKU*}p=#iuIMVzgVor(9_7S{I5^vjb@U%b%gW2xiUMr;{zLD=;V`M7rHj%#0Q z=YA6yTIbCKah_6iSqG~ekwc4o@3WW>jyMk9->IrsTXEbZj*ovdZ=om7LrxdcrChu{ z_mJ5Cj!YjWXDUGLR8)97p8lTLwu?~e6#Z<6-*uPu+GJEWAq8~Wnlm)LcYdtB=2 z;xiYQT{~fO9g7kh!%n_!KVi(&Ns-r^4fJ%6tXyrfmFttOg}QbZ^%3*4n8(ENmblJ8 zZ_kz=1{X`%>(KS z{X<=zzjWGv=g^$~_9NfjDfLw7Pil2MW@w8ke+s=7&KGvJuQVb}tQWX4%jb1)o3Z1> z=im`(H*L54eQ{m=8F_U@>aRb2^^bry0T=3t&*z8qUDl|l+x_wRukJbA+WUEoXY04) z%ly`-YjoeW@56WY67T&w{~a@KcFf#a`J7w7EU+xs^&J(nU+sOtU91mV{|5(uT z=&pT%r&ml8aSDC$9$2sDh>2xBcNTucyI5aUf6V#9mu{ObhZOUkrfYCK*Rz-D*Pr)o zBKmny{w4PscKf~jQRh7k(`&l7I37QGYk?=1EJYlmAI_FNd$vO7hKq81J#TrrrT@J2 z)iFn&WXt=vpHI<;1^c9QT6I0wm@Nb9bxM3SH|@n!Kf8^=)}`LWI{hj9c&u78dDfYT z!Q%6zaWl8AvOE|UTw#N2rxOcDHdd0B6?*n=Zq$%|gGV(ToH%;o=fK089VQ6=u*QjV z7q@D*%Vzo5J9RrR_(+Wn zOt(=thVFR%t$2^-n`rT@R_x9E^@k@qTg|v5?B9Ps`~2N;R+Yb%hv3bdo?tyXwBXQh z*`E}UGkyIZfA+iIcCJINYirU!b%+hx@6_de+}4l_3(mEDJ2=2*(3Ib@)#%eVtnM=J z`c;J8-Oo0z7%=fHnmY3Y4x!u^shz7@aF|6U!wm6yxZ${GD zwY_?rh&sPD*Or=aVcNJKMIHgUh78Fyd`|O?-8!ayy0E6nxBBIK{Wi?OK5osS*x}#v zH*4~rjl1bS*nKbl)w`!Zu0F3+o^RPJ-?_x)wMS+z8B;56Mce3%lc%e6{_;3v#g(|t z!@DdQ)?%cXKl~yR;u1Y#BIl0Iro$f_(kp&l;VZo!l`2ir=>~J8XF{w;TqHdSzz~nf z6E8pD)nsvWutKgki-aGAcZ+n`(rfdY$?S5yRIJ z1d1FB#UnMUcdBa~&26|wuge2VjHAHuJvW$^nuCw@=yg3{iR=!K>t8YD;BSrUbxm;z zudXfaVof>tjDR7+tuKNiOgZ?VkAbth(!rso9QfHX;B12>##3$h@?)kPcuWL1k6?+> z$2-idY080zk%5Chb%^cZ@G*l;Iq(R@cR3Ek!Qb1&pI6+itJz3xr#E2mHz)AY~+ z%xq93Z%GqhrHF(5fSivR6}zfA%olFOdL90PAkII-0{meh7<@5K8RC3`!Gk|#x_D~8 zv&^D;8+0R%=+i##%Sx6piKi@aL_Ga_xePYtl+)O0Z8^unlv6%S4vV=0aqyR*(BI^f zcOR1UOrQ+WIK^R!y;S|;`=h45D*u2T?;o&Jg*fODeYHP#1vV7pu~C&c_>Z_ax8(eK z@trBhhd6IwiF3P6F5&gLdUBZB z7qe4?IDKJ>+eJv#RV~yU77uxm`<<|f17_7QiKiCX$vSuZgJg_cEOE`boL69yFy_=J4jxCKuXW4z!-QnaY48Ia>P=lVFma5HaF~~AYA2BF zV9z4wY-PJXrkqB^!7+&ORGqpw*_6|mICzAEoV_P5%s1sUArAH|<~C{lna!r0AmRu+ z_Xg#KVi@O6Glni3IKr69z1XtLl+%pt(Q}ha{md|=yl;>9{YZUZxrN((X03G z&57fNOL&FVjDZ6y<9J{*06VyqVGU1om_FK+(~>wMFZ1M_9sSRep~KL94}a6s}ooP28(gbU0}`kVh$k=&UmQp)HY*@shv>b z;E^qI%=bkYaVo;l%MMb#X)pXu?SvBt9FU#ub2fi4fuI_#ewhZtt$jo!N;cPBADO+BrF~{uWa^al{cd zY?x5#VXVpyt6{u`gSo3Y%vS<&a3;rQU%O6mwJ*j=gf)6yDlBo%{Ny<+zbPk)I3k|- zn_V1DImti3Ng)pHRY7X_v~NyRI~a*xha(N=y4z2tnTa`#IJi&2(UZ)-!bL%BaVp2#^Vi4!^U>{69;EAj3;@<7&Dv!#1ZjyX_g-b zud$th#DU_{n9u7z{x?$&RZkayOnBv4biT4FXE3gnoGXo6nHfJretIo z;(G1|OlJlTi)SKnTwn<_<@J#o!4p*RFwP|6h?wzuiz#O^adL4xt+QRrZ_0tg0;r+j zoXT#O&y+J&!wFZC98EdXG@K6>D{`B1rfWF9In$j@IWshzB@V3$syVDLW)cVYDOl?} zBb>{c)^HYaTwsYc9CmSdwV5V0oJ|~c4NW<7h$HHQH8kbS)o`$erktNO9IT-!XP$;q%x!4Fs)J2yxQI9|u*4cJ(Up3&(4>ZoiBo}d zHXV4p!j!XwIO;l^a+VTDU1w9yG7SgoY|2@#;b5IjIV&_Atg|U+rG|rbHs!3+aIns% zoYlk;xsS=wWU-pV`eF@naKD7D!^&&!>b_u{Uto=1hri*P52Qsi+MHK&*qpGIIKmem z`~9NoFJ@;Qaqus}96+iZJLj0Go%I?!c#O18Wrz9NpyA-Ls3~WohGX8&CJkqI`Y*m} zJ1pj3iG%x6Z065pHp3dd4n1avSLTEpzNUF?Ax=?PV)LEwb^T^lUd-24SfkhBNW(UG zv`<^L9mauOK5*dRfZF9!JxiN%wh_k#m+%T}e6yD+XZsIuekaZgSmItHbo&4}+(t=# zF8l{^k~pW^_)_4~n6ra8a1cgo+`Br!!HzL!Cvmc_^Dg2zay#jRmhCgOv-<})8N^A0 ziNyw_EiP+rncCSyoc^5Cz2uN$rkuURDFhrC(n{`y16!MNAVlb|5|A#AdEdex7pXaH zJntut*mgorJZQO3H8vRMfQEzD(9|3@HVzU8`vS*d_1R;C)xH?#5OG?-5__P#mp|-e zjQip+aqM7;?RMQZo~E25utu*F^F~{TtFKHsM~PD(mgu3@qW~D%#=c+*06T&czoNtv zQ_gYX6oMs`TJiTD3QAY6%hb*V6FcWk>|7)c9tmK-wz6CU#W2Lfd|e_A{uL7sW~k7E5s4Gp)o}1Wk($F|{);$K zu*7EZ;6*#NFUGkBYxFw7Ir=q06A$BDCl1yI+xdj2dra-zfHituV_4!?t+0Aq6I0Gj z;^6Tka%N4uVrGopB2LzJZvTLtJH)9EOYDL4)JKg>Rb*eMN5%xmVN zocErqa%VBWAdVQTPm{aDL5jf+U+a0ylmpW!_!68sP6gMSa$XZh_?kN` z__!(O4RQ3a#Ag0D>Mg8+XFMP&?AJ!`ex0he!*YK|9Cg3HHOc)waU5ZZ^-1oi2fA_Y zABeLRme^-;6+_0Da{eI>jt#V9{`rKD#DR&MTEf2RH%;w)f_3oZ3>d*WuKTn5EK?5d zP4v2~?R+6l2rRLsoI42N8|U>E*64L&8@%2&4Gz1EIhc-KHw}}5*5*+QnDUJ|I^tw) z$AUQS+)mFDIbqNl+rd2rdu|75!;hT4Y07~=X9SKIW9Fa9!8<#8{O1H}Io4Tn*tTQy1M%1rN6dBGgYuL!joFSk zS@*j=al&}+$-6qk&^FH9fjD`91A;RC=W`8BIXQ@fM;*v{b$xTVDTkh3(BV-Bay~1w z2bpqmk)5o!3w)A9uY(;eMY>^4Js7qaGq$4a4VEq(!~SATAU*<+97u>a!9nY+38bq4 zq!xtF8*<>M4fmiF*(SBpIpQsm`5b90k>5B{St6G>GE^dOID-8iqx;FM_dI+G+%B~$ zib+u-KXGK2M4~xTUm_bg5+)G~zH`oyNGFc$k;q1l{2>u*J}n)Rh!010OC*USr6rQV zk#Q2KiMv>6;S!m_kp>dE#gV-dsf`m1v>g(e#gXa~`JE$OB=RRms!8NCM@C7+#fDjC zeGz50FY2l|Y;ZL-K{}Wqy*Scd`kKL!!xFj4k^2&H!NXi=_auUUFNy8FM5b`0fWK5?R5KffBjM5!PP=%=*ga!0hCfT5%j{E|Ccw36jVIj-X{0;RlYCkw{Vw zX89+H%;JcZPH64rNK?tNz|%Wuu@Y&=5xq`m9p%VA$tjVGl$75j63dZ(64}TRR*i9H ztMQg|#z?IWcsLBLr9{#=GC(3TIKnJXHf#Ae6^B*qZxbX_gM>7UN{#55%G{H$kf!0u zsR_Lz7=+abX%_)VT(|*2=^u?9M6%_^B{oq*M-!xw2~x@gX=Q>8;7BWJc?L)7NMr*? z{3LRWBWon`j3eVE0uK>W>nM>r97&f*7)My;mz%BpFwW^LwdSa_SYPZjLEdnroz%*e zm&G$oB9%D8ystIuy*cMhkXqw85-5?C962G8V;ngyk@p<=OCn|PrUJBU5^2Ygn-Uqw zksA`(z>(V$xx|rM60yn8EdMPLcaGeZNH9lEN@OTUPDx}lM|w--JV#i?cA2f%YtHeJ zTIC9`csfa>2}i0*B$Xp0Br=C1%-4RizA`xHpwzm~kzk3uQ`uporH~Vg2Q4$C0Y^qk zBvQqR(H%4EeW>Ip+|JJ$B%~|;eQ;H8=1ut8!a4rZ*JF;nl}LMj0-7R`sp6CrkQm)L zv+a-=WDZAcByyP}Z={{lE~KRNlt?#@urdG4Y@JtfPD82nmLs1e z5>%X7{vwej9I@Al`h4JsB9WL9Ov^$dS2*&!v{RuZWciTqrVasHG@ok|QjE0J3q zIWLi6o{V!*B5qy`StpT`9N8+7(8`R{Mw$%LOIUg(FrH`IRG15*b*HY1Nj7V&lg+krL^^kvNI$Hp9Eq1m zKoh35SR#`-vOyvZf*9wjMBa1cokUWbGLE%Q)MqV6a!F2nGsY<=kvAOaDv|m>G0r53 zOyGe_Jda*-p^5-Ht|X-$<#GDm)v z$Xkvqmq`8gOv^(eyErmUBDNhEXP!hRaAbu#r$EXaJ2tO#G@8A;0OV}AAICT8s0-v@CL?{^$=?lqPUqb~V?Q9o_ zv?CGX;Ki<8CLD?QU=|gj5@CYl%MZ1TkTl?ANRB9?0YR<)z}aKMk%$*2mISXq1gEm7 zk3>8%jTZ1aBsiX;&JvM%?G_xFyF`2t$_eq5793xGP-#Fs@gM~!igAMDC32UDH)gs7 zUg3gMMc6SQ$SDNA_6kl_3K2d@gmO;?WQX9$+$AFW9S>-z-z9>Ab|j3Fi0F&^0`c;K z5b=A}6$}U`NrdVQs}(#P*N)Xe0`U~?@t}usL|=>+h>xho2Z0DBWuQQ0RhtXM8zaPT ztCuk#ybmSfSrxhmzcGnBEuK5?9*KBWg-sUk%v(YAS%j#CO(LF^p)<0KFeL-RL4$-AsiKY@6On8yf2 zas~**n}@8l5{R6m>X;yY0+DvoO_0te$S{F;;wE<;vYa3h>@RE*5#cC!fJJ$UM3oZ) zq3sK`{xU(XNrV?nxnY9b5{MY!%HIN!bHZJL$aqc)M2_B55)p=a3#1Ab=ncHEZz&78 z<250zK~j;sO1GCJObW%%-|ls z_sI}|mHaT2&<;Dd0y~~!`!Z;u9o&*0z>Dlu!>am2UJQW`N*K4p&f~yNHPNY3OZG*o zu!EZ*wUPpnW4^9H#HOs&6NsGsY#{=Q$6Hi2heSm0;9i6{UZPKX3Oh2Mh616z%wM4K zNg|jjHi=N~1PRNuw?f21AT-;&0OWUgk$1V@k%-K+m*7YwO&~JDM1go#g2d*7pY8^P zC#FS0f%9B)XehuZ6#`o2f%8Oi#4KSz#Gr2>I5M980`V60Nf3xAv(j21a)j5Ah|mfV z2wB#_Sj{64&&uHbrbGZ%*7GsOt_XzsprdrQ(2Tu zA_7oO3ywt2m>`!-kUu3-873EeR_3e$;oYo4pnLGi@$-`74O-YFB05mH2q@nM!47_p zXPrcF-;GTo)H{f5g%@dwf+>9j;*A?K{$>@+wA^5weRC5(9cz3s)=_>Jq+%DuI7jhFG-%}^Eqhp}hu4jN?t~b$ z{J9o!6t%Csq-BjJp)FZ?`E?blB7SPgwTPqfl~3bKY5m}kL8~9vB96vaeyN4lOP%OY zYPj^ZgliE;jYj>ea>#+O%v@UsRjXPjc8 z5l7>zpwz>$}h2CVjOJ zB_)M88ehdVzS@TO{9w=;#kGi|@l`_O3&(tA>FYPHMI4Q1!6(B96vaS&gqPo{k#~THCo6aWuZlkrvLb*mf7(=N=|~UFKTE z(fGn+GQ;-OtY7gF2Cd5B%ocGpzABJbUbb49zd%XPkiN!oE#hc=xodnC*mTUsp!Jk% z5l7?8gS0R&?B#_UE2*@aMz9cwqw$4TsSJ7Tsy@Qm;A=hCB96vaCDO{peSK{I^9F;K zVzDru?5#vVB~I(KCe5=Z09N8_u&tUBEd zT7PgY;%I#Nl9n7BbN8#XoVqbz#L@Vwrt$UuZSR=|U%j{%aWuZFla?GC$C_FS>rpf!za5l7>zmd4kR0=d^4v|e#7;%I!; z&LXdtF)TvjXnf(hiedZOoto6n;AENk*hoNMI4PUJo7jB z$}#z$P=i(i*CLL_SAfQs=b%wOhor9)T#GmwUv)LU+P@k%+n{BM2hY%mqw!Tw;|u5c z-O^Weu0r6rO~DXt4d2>JGmBdG`<>Yd^tI{8)VSR z8_SFlN8>9{lNZ)-ob=V5YY|7|tC7an;?D<*7_^>oE#hc=HI`Z!Ozg~r$G zW9>^Cv>tIS;%I!e)cC^V!)nr3oy!$(fA6LT4F>Qw477XlA;ht z<10*R;d;!gmh@GZYY|7|D_m-!FT7G=&`RK1#L@VQkXpjmXz6PX*CLL_SESSuc^S0! zb1mX%d_|E~E_4K~=i9Y6K1g3rxfXFWzPf6Bx%?mQ&I3M*YWw3GL=hDQyMTfk8~VpI znk^fWKp+W0kY;&nNH!2iGuZ&KU`6bTy@HBeunSMoXYak&_bgy9JbU;3&pG$pd*{r~ z>`t;95a;vRFzkGP=bU?PnLA}?-n*oyRZYcH(XbFBd`%;j9z}7qnQMH#&MIPruj#_q zlT+UvWK}(8DPP10U$t?*#u{IRtRhDEnjw6xY&&m&Rn@VI7~yLssj?sx>|ZzRvU2m? zjIZ-qMU3!OCwy(a%jt(&)t0kWxrhPh7s0j%mgRuLmq4W!x}jAGkZly&uRtJ-Rg z@Rm2EY6RC7InztR>P+_vsuTA+PMr7j%Qt5MgtCt*C#;0ZXXjjERY$Xm7@=w*RaX^CXs3@FzP75RtRhCJVx-dL+UD3VUsu2Q zMl=6m6)~b*t)$ZBdZTI446Evir*&Z=M);aVDrYTQRRODr5vtjwg45uXjcvv+JIbnB zSw)Oc%^?-;9dP+J{79Zv-O4IrLIdI5AF-)w^4CTx_(RKpp0BM|st7RfdJtNO5x$Nj z70!FHrwr(J(wF6?ZLDNp#E2XoMJk=c7uUb&YpdE5FRH^rjPP|dshn-Ys+w6vj8Gjz zD(oe=9JcL>Q?2SgRuLmqb4k@76j-i>r_4R0&Xj9|qv0!9h!N#FR+Q_OoUS=mRmCb| zgsP^#H4g5vt=!wJF4b5thu`|5B^k;TViB6e32bPB6Z3d*gS@uCS^TSw)Oc zooLF1s=1Gs^|ntd`H)q_h-{o>RG9s*?mPZWt2%5hT7u_3AR~OuBb9DZc{g1G5A(u0 z$K?%H5hHw^EPQo|J-e4x4LMe+i4nf$lggQStGbX?#0b?Xq|%vRuj}S_Th-63B1WiA zHNG&KvkrTt(y9(WPDMzJP@QJVg#^x0mYZxm%qn6;HcmGx%zVpzdlp#LmdB%|P>2}e z>kOm9?da<$<15N4VuY_VjS79uKWu)6Ro%fVVuY`=NTui4e_Y)2C-rnw^!z8Qh!MWd z7QPlWWNvR&wI`r96e33WI)_xwTDGcJSVfFbEg%)nZD1vI$jD(ISXKB$^aO9bKt`y} zB^6$A!)1#b_pY?6J6T1HP@QLdp$g|w$C%9bKMB7Jg@_T^IGmpJ)M{KLQgH^-`)y1U3 z)`ZL518=<3s$OFiF+z0-sho4sd{eHUSw)N}*QKIdcSnDjZB@PJsR)P>zAlUN6*j*1 zWfd{P*X41(tm+@EB1Y_&uOJotG0V;5%eh}BMyM9Xsm_d35hKdAh*ZuT&NJmYjw2*S zlaA6M%PL}ouf@U__OBC-ubwBX z#1bQXT_b%#|FWu~tRhDEx|UR#U=;h;;U_Lxq@ERwULvd_M)Ce^BdIo4n?qMefB)F3j%F1x zLUj|Vbc_1!shRg!)g!DTMr7k=Qt1|j*Y&Jwn^RN>#0XzYgfFb+5>v}FSVfHRwN&`p zv*P+Ut?Eox5hHxv66fnV*{shl~qs@=~} z*&s&vdO-NX99mTstB4W49wgO<%4i6$r+j2`xR6!E2wx8gUsu18GuNt~W)(5Q*TY7I z?wQYt_BYZthDqUaUmrq>Js$OOlF~Zjq!dK=N!|t)Fjm}c#B1ZUn()fav z(A_Pi2Rv_bIGk0)2wzVLUj@I8I?t+_SVfHR^)#vQniTrFY1O!GUNF9{U==aK*E7P` zG2@?`XH{>oiWuSRS>p@qYsbhHcUe`>v*9aPh!MV?6TY^dx9iGa-&t1v5FX>dc%|pRhap~ zCL3q4iWrfNH;oE2kJmV?>V8%cBYeGORNB|c#@AP@B1ZUn+o;eNUJbOWKIfvPP>2}e z>m8%Q?Ui>P`QOKluM$=fBYeGUROk!uSg@)FRuLn7{hL%hL4md0b?+YV^T_pK4VUv+ zMU3$EAK@!B;QK18x{FoB2w(4!3a!Hmo&C0|S6M}jP`ytoEE6udr+)X5RsF;&Vub1g zQaR59%s1ugeV(#Kj40QKq}l{Fqd&Z&YE@xY5hHx9B$e(d_wBsm6RV1{iWs3hE@H8Rm2F@XQXmw!>SgtiWs5#oK!j+{XYF;W2;)lDq@7{3sUum z=&{Ymy1%=HdX_T$CzN>s{tbnQ5!v{XR5}||mjAe?Rb9d=VuY`+NTsuZqo`H&xKQ~b zMyS3vzA(aypLS@ls*_knj8Ls6)yB$bXyjeJPO++ti`3V|2-SZ{wIysuUwFo>#k7q% ztRhBa;~Nv9?kQHaf>p!_U*D2SX9IhRRsF##Vub2DQaRg(RSmybm5Ugm`kqv}ZRA2v zv8pp!MT}7WKq}o+#*KS@AN9Tx^zt&Rh!NTNkyN^E414|1-d45kB`QKOR`ngLh!Lt^g=+ke z!zNnQuuH)ZEW`-aZ=}Nd!ewax>>I7>L{*h)ecSPhW0*ja;a{ zB}S;an+TEEV)N^^wW@PjMU2S&Mx@f2KWBB>hF0|jtB4V8V`EY|TU2da+aN|nxCyE7 zSPxc0XP!LrnNLmIC|rb5!}|x25fSzvm5%U!tb|4$z4?5r+WkuS3Kn97swb&*+gQ}=+j^@y`brXoh!Lt@LN)9^d0Sc4ldK{} zs5U1RjvKfvK6cUvR<-R_>RV!jY765FiQKo27;9BEtRhBaeoIp6%wyZIsz+EwjA$G9 zgmO7+>}h!GKPO)BRcAZFS|zpGWbh!GKPBO;u9ef2-As)kj>2w&Th$~gzHswJ!< zMyR$Um2(bYRX?zb7@_J-Dm@1{AoJj%R#miEm5Ugm>O-pjuo+fDKdpZGhMi3|&SVua zA{%{4rR(c~7p}U|sy<;AF~ZmOq|({I`Jq*XuTc>aBUC$(suyg=vfY2zOCMO(<*Xt` zsPOp_>t$e1!DZL={&$8|{mCj~gsQ(#;WZAcI`~>;ix`oO9Z99LF@JW;RI7S~Rm2Ei z_^b*WAztGsG@0M?I^~NP;cI8%>+v)9`Npc|v5FYsD>Kelk@58(RuLn7?IL{Pc{Z!s z>3S6*F~ZlbalSS(zZ;FRiWuQ*H{lD9My+ZotB4W4b|)3iqi}hBze{IqYJ7dqDq@7M zJ%lg3CS_H{Hz-@g2www8)gLxvJ3MOOYqPBC0#*?teC;WG9eDZvw^-FDtRhDE+RKy+ zecgM?j$x}Bb|ZWR3o*ji{|R3^d^GHAt2&)k#0XyljW4visOPqmH#0f>H>-#dzV;Tr z@Xk-G8h8_0f~VOaBYb6%sy}SQat&JV#!*%^msP|FU)jRf0WV(c@bx0Ah!MWDAZ*H)v!&ya)@U;)AaKDW8^}zM7PO+-{Sw)QSwXg8C z!%qVzSykU#RD{F`U;B{?#|`w=@Zs-oSk+OiB1ZVyU--JF>kV_Q>TOmLBYfeTQ|#~P zGkzFR6Egj4*sUr;VuY`J;p>6h@9$w%x3h{E;VW!ZXt(=}jc0W+zIMM&`65R6DljU{ z#sy!Wa-~&W#VTTiui>Q9^|dl{LW5Opcf0aMjPO+`eDx|i?*Xeik5$A7Uqz(S_0`t( zz3r^3#~sQSF~V1|@by*GiZ88dKC6fkzDAHrw|V@X@4cqYXWXfL5hHw!6uw^F@}XR- zI)qik2wx>eg?90*{%qsxE>;mEe2p?HtS`Jz&#E@NOGQYG@HN_~w69j<3r-}^LX7ZL zYE|@Kr`CtS?vzJvVJgd6V(A>)qrkM2zrNE_}^c)O&ZUI-XU;2w!7J zrDv6Rp3SP>VHGh#RY5A}9NVgfE>jT_BUEEag_*$Ru%vx*p@nn)_W|H3)8^_6*#@UvfYBYahga^Z~VK;!ELRuLn7O%=W- zmYi^@RjpU5 z`zh=YF~V0ZshrnFt?Cd~5hGMHNTtW#KE)TGW>rgAMT}6*Bo($pSP9jixnjn?rd)rp ziWpI@I#TI2Kl#ja_P46?f2nd2BYf49$~gj9)#a=rMyMJ{)eVedPub|U)l04FYgQ2> zRE?z4`<{U#uj*%2BOXu@5+hViq;l?;BPJUcvx*pzjUz~-hO1F&<`tw)d#}@VG`75rrs$P%4SFjKxR7a8u>kC!O&OR(^RcEt`7@<0f zRGXtoSPD=75nfoOTV=0D)wje5)zKzGB=9V;RV`o@F(UKFkVV#HbE zxun7}>1At*(0O%<7!l#Iq{7VOa{L`z@3oOB*An(cjEL|!8R3GlORTE*!q@S} z7uNFWg9d(VRr6UzjPP}W@O8rU@{O$OM^+Ide4R)teI#}CQQfw(s^}9cLSlrklZ3D5 zm%U$WRj;y&7~yN4DHqxuGT?@1x|DvhB1ZT+L-@kG7Om=xXOu5ugs(G6)fYBn4llUx$i-H5 z$g@gCjPP}q@HMcu?>$zv*KcK2_5>j@!q)|)!Vw#N;jx}o{p)4rix{E0kW{!QLe+LpF1o;~ zj(tU`h!LubNVSpL9J=_1VgI$N5wEJRi4m%cNtFqk(bv}pT({&RlZ|e#DHSmy8<&tu zkMnrsYgH$)iWuSRQc^jyVO8{4Q*cL&P+dlS|JL$`Mw+Kja&$y8LbB zix{C=Oe&rE?ywnFLbtSpt6ny~%05sk zVuY`y!q>jwgz7e< zLZV+mulZK>2djt?s@qBB%*LxG8#k^}zK9XoxPw%>^*;3S<6B$R_>Yu|7~$(qQaQ6> zRll=}7@@k$lneV8X2Ys(_*nTOMyT#KDkRRn=E%iXb?_%jMT}4_BbDyUf1Z2Ds@F|6 zHuzMjh!NRXPAZ*^{#VVr%c|~V6*0osKS`xCzuhyh^}5CQihQPg5hHxvBYc(pxbr}( z>hZZ!5hHxvODbpPt?FJ@5hGM9NYxvRc7;#bD>wJFsu^D>U&IL2eWco2Z4MnZ>-JBr zs{fbjYhr}zep2DQ7nlBnuReE~$;OMUB1UB6U!>BR$1BBFHRCH~ix}bS0a9Ttau`2be+0;`A-z8)i$ZoNM*{`uG*#@E1a zlrLh0ug8V2o8SNS7_0h}Rm2EiPms#ldadfJZDK$}g8MJAs>8lhDq@7{ zDN^ayd&z|ZUbCux-zya{LiIGMutmWN&CL6oY`nuNVnjBcA(d{uI5W4ZtRIvwVuY_} zN#)FjRh`5tVub2BQaNYlR`m|6h!LviN#&fGTh-7XRfNO{)eEHR51U~n^yK7s23~2h zaW<=n5!rZ=R5}|Ef7o=2RlUI~VuY`kNaf6iRqgPTijWwgdYM#(uo?Z;^qGExRZV9V zF+%kUsW6AQJa@}Z7g*IlSw)Ocy-F(GEAg6?RdxAU*&;?{<26$0Y~ak?s;01t7~$*n z1io%%6*0os8^YIiv){VK`r6OZ8~Kp74FQZt~+sxD_0F+%m8DHjUyX{*neY`n!PVnjCH zH!9o{o%-xCl~z^!n+ky#;p+pV(!QQHzHVa`F~Zk}Mx}jORsY|WFJgqRl}4p~tu(&Q zW)(5Q*D9mZzO3p`RuLn7ePmSV3$L{uX?)fFp&}$k`1;tW(AW1LED2lHMXVx5`1*uY zdIZ2oZb0_e8youY*`cjPUij@P&IKt6Iz| zVuY_RNagG)R`m_5h!LtUN#)!VS=I3Wsd5n`R9}(GxhJx!OISsWP<>4*XXZCB+4!7Q z#E5LHCY2t0@u{R%HIk0<;q6Gs2w(ptm7c+#Sn+9eTjOgntB4W4z7f9g{$8t^#lLnT zM)>-cRDB^?*bbN8oAJI?m2|=5B=u$*d8PO};p@_EcB`e_2J0DAy0dSN)MaFSM#hyDDGA2wy*v3Ui3QX8qChqg7qJzETk*eElSRUH@U> z3szOPfl?78eElqZ&AcM>9jgj=Qz~MFuU~|(OIH26$*Q*8P^pL!zJ4VY_DU?*x%0og z$f`bN6*0osZ^G9Hd%yFYRo&NJ`65R6`khp|&EtOg0Mic7*+{8~5x)KqzVN;;t9pi2 z#0X!1l1jIEyo+EP<7@qml`mq1um1^O_?vyJ3bTrs(7>tY1+tVndrv#05f(5+%aN?Y z^mYjiY_{(V%7Aay%g~uuwBFy|1uD!FGE&urRQk%}FZ*_T-THcleIX-N>m~5@E&D=7 zs=6jnb>Boqh>TR>oB7tu*h&>Bv~<%wwzd)O2`XHW0Tm`AvzflxfK+(S9Eooy+;@;w zO=1-?prW@mWzIoaH>1LQ=Pm4gpH&^fDr8h`+{WLaQrg*&?BJ-S>&>n`!YX8>s=HCa zO6c3Wp4`K#K4KLzvZNc4YHv_rNqe7lFkDyFUN`Ka@`H@@wK1vmH3eDH|6>(0($^+N zg?2ywNALZuuM=2>jP%vRs4%Wo6~)(E)#a>022_sryeX-?+w(i1!uE`eRBc8o+*9N7 z#Ci1-t*>v`7cw%!o}}`wuO6GK93mrCy-0=o3oO^7h5LSKeeKLDWI*L;nVXYpXHcNs zPha{1&PwU}+J{xhNMBo!%DcYCvkDndIdZrqsr0CIW#sact*>)fg^W~fMJn&iF9Q{3 z9vNA#tx2^zm+SDSC&5)PU9Okd7c#P3+mOn;T&r1yjErzwQh7%>crz6tGE%i2so)PS ztBU40diQ~#!UY+r>P;$dU(?waGN5wQavxId1{Tro_Pt6zL_#emurFjlV&X$3;U!t!fpkkdeN2NZ_kWPn8X1K;>vr{YV84LU;tI7QL4l z1uASC$VgRxQt4j#dFcGBZG=ti3mK`}kyJ3;(^B>OCysIBbXFlFRXdTYKWMrtA^g=5 zZr)2ph>TS2oIq8MT|vBUQVS zYJFuqRM6+u`Brr;tB_It@8fR}mv(j|JN@DN`24&HDy%_dq-u9ksS*J|i!SN6>0B;kq-r3kbPGR!zZSS8tGzB~6*5w_xA3*#w|Qf&Y89)H z0hMEH$s(2aKCb5$D)Y!lRW_;cd=$34Ilt}vsr5CGRmgzKG5Y0@YEMw0-Cn=n4T;g^ zDrXfk(pN62yhpzVRv`l_$B2|iD)0Kb4^-Hmk&&uF2~?|Dg^W}UCKX!5WznSV9GTyB zOO-=pq-qGMjspcosTSS)4+9n2Lq@8GCQx0-DrBT;7^%Fo@d2xlk*a-2rOWl|!moBm zLM>Tasd6DBRr``k?+1=N@1xVL>R47GBUSs63I@s$Gkqd*2!j$@+zNu?uH zG9BTa>i|+^v6maZob{}YuUT*ydOKB@Y!>ZJw0R9MvktU^Yr!lc4BkIVkM zw?c=}5jL<28BjTTWdW(Yd*!vPLPn~FlgfMM`5>#1kr5V>3aXZtxfk93x{dH%Rv{x* zMWo7R)jd-`d(f)3-bUpR8L28J)%L8Ka{sQ!S=D$}AtO~INVPMoTDx_FyGnEp=dlVI zsTxVD|6^78de<(sss~twj8v77Y5=P)nDHdY}ceT^p-Gzhv2PUTM5*FsRCJ!GWn zAX32}T28-X^G9ri_pmQyq-ugtbsaPsuFLDpKhG*;q-r9mG`CmxZZHJv|E**dGN5u~ zV-l&nv+*;lkddm%2~_*{Q7sA?8Q~OC;hYVZp}RcRW+Ob7Rmf9)&otNItKkddltqtd0Z zs#jTsj8sKQ<=vt_XB9G1Rg*x~WqVa$$Vk;RQhAqaJ60hhRnv_szFY%Yg^X0yl1kT? z%zPoMkddkxMg=Rbc38+SimY| zq^jPivAtP0dLiNLyT^#2n-eMIppmJoR$*3?JSN-(P<2J&d zScQ!Abp)w&Hsl!9YX{Y$kddlpQhAS2yRixxscIpW&W0SL_Gc9`QWX=byD$IO%}A)_ zP*x!$RjoqRfA8>et7>BvGEz0ms9?p_4liUCGN5u~em1GXpul|nTJq>5>+5M&AtQaw zA(hU&97XA+_h1VdscIvY_b8gvPt_MPQgtM$bmrwKTFokCr0OW6f)!Ub7O@H$P&u-3 zG^s{#HX8fBeGC$6d5cxZNMFa0N@qj1!>#(Oav>vCb4lgh4$E1Ej8q*P1L{ee7x~j0?ua2;RRme!yNk)Zi<9km`wW@1ag^X0q6RKrh`kd7kdeMlA(hUd+?y|F6*5wFs!{38 zSzj4Ds|b;is?$h?nMak}>y@$!8L2wms9+^@zyk*?w!Rj!3K>v2vT+8f4h029^VId* z?Q2zEvkDpM>r7JVY{=uvaHc93GE#LGsrCXt`n<69br!3Tk*c#vrL(c^r|*ros&`q1 zj8vUtRIuV|8@aov2$7Mh1*FpDlC@mHDrBVUT%(Gw&MqrP(-dxz^-g^cud0jYGkZ{+bs=knss!K?v%O&@E`?3ldsk)R@-g~_XtU^YrE+dsLm)z?$vI-fg zy4#Z|6zS%r*LT|p{cE;(W^Wfd|~wUAU8VORL5MYqVuS%r*LEix)(<%s_4wd}zvWTdaFNu{$Pd*ygmAtP0bjY@m4 zzS>xYj8t7iDqYL6S1w`|GE#M|QNfBU8_%-}8BjU0aUH2fg95Yh=T?U~#@Nsk(tw-hKHLRv{x*Ht$%Jyf}n0hJ>g zHl_MLsk!m;2#+<4@&P75kH?s;E>Fah<>1>=)I>2!y>q%B2BUN{h%6mNg zfK|vy)t#i$*^uMmudG5ws_qghc{JL0fNC4afXb1LyGey-zmYiXuxk%NLM>rdAtQY) zBbCmE>?wz{3K^+dPAc!VaWt!tk*a@^N@qj%l#5w~j8xrYRIuV|8~3vc8BjU0aWAQM z0R?8`?ZXC-LqaXDvkDpMYXzxvHZB;xx}Q~j!zyH?>ON9oxw^6ktJ-i+RbR+R)%`|= zamjs3KUN_lRsS+7SaD?|pH;|!%8`u+NTsupcgM2dY=o0pg^cv|AgOdVHXdH=xc{ex zRme!yL!{aZqKluwp2jL9!$fuvf7P8L4{2s9?pFjfYr;j8r{JDqSu)Gk>2| z$Vk;=r1CD;AFM(~svakmce#4+rP>BEQuTyU!HTO~VOAjnDn~6pNvgv@fp#a}y_@4c zv<0j}M*4b+R5}~7&97n=GE((4sl3~K?*FNBAtP1K7*%|mKY>-qNY%4O1uL#>yv-_P zK;_8BbEMjdvyn4n`AtZu<-e>#M*4c5R5}}SJlt@gDi<z2K9cSJ%h|6vs}>boEL8{97Kyg_#K z-5lF>e{3VI357P?Th%)+hpg(9rRZH?=fH_QZQ>y&ZPQieQ`tO)VgT(q-f>LiIsJ& z(NLtRwK-Zcza98uH{E2PpzzuK$R>^Y#6ELq>%GuK^W8t`s z!=VC)7vc8&$jG>@1ysGG$Z(`M;pQw?ZsP)rjC2tg8MYQ}KH+9%zPY)wEz%I39Z?nL zNCA}~n@o5@CJp(?EIE_OG5cDK3qLs-IcR!wD@|&d;1$*-~4jHx^CE&#anW z*&K;ASJuW_!bJ+7n4d|VwlW62vnZSscGr7e%61Bh3$O>M(y z#>g}qj+Ckq>Y&={wn%l9vlLA&aL9!k7llDv1CdEK|C6DSMJB1TMJB@l39cjKsj4Hh zD(k{fp^@>m^-XorNUW_X+7i}cWn#Q?l%M6wbYzmNC1{yw3h7hKrpl_?SerX7?ejwIx}+hV(&V7KMwn3)Oxu_Jq0l7vG@WlKx# zG^{Go`#Kz{YT>3CBx#K8c4OLOewN3c7Sk2hyXyRG55h4(dTb@V9P>RW_fVMxiIm6Y z;B;kXh}K#gXg!}t(ZZ%C*Ia?;Jv9G-<{FDmYiw>)UBpCR9j&Qst%GRxEwUuK6V<-rsWuqs%m$wyXXd|OK_TJOx;D6DxCBI(ent5pZyrzG&? z(MCMtakr7ANOntHnM`fxXT@*y2qPYHN0EfUAXRb!p=Kd z$;mhEGe+?%IK?Ta~OBtj)+D=1Zj0 zXbg6_9SEx&CuER!J;e@ZW)=)Cm>lni8cz6NRn3@Knu~YPr*~0c!Uc9CO?f>h%L*}Dj)lFWJ+ao zgFYMRbNFLQ1x#8W5}DZTYgVaRx740TYb(`j{$Q`J#hT{N*q?PjRreVV4% zHfM1XZl?wYC!gTp9-Emt1{_}yDFq|YMkb1MP_vns#{&dZyOfzkS2sp#TjH#i(;z%T z9SZs*;59Od{$xQ6BQR+Iw^UU&_!%X5gpxS%hQ|1!VGtgCtdaVWcg&Ma$cZqr3K4Vg z97wE@x@B_1{+PGn*|pVCJW_O50qh+n(YXgmnm+?Ji|~UfHl=H*goBRRo;HiD(F7Dn z3iX!-)(a>Mm<+}TDQAC)w`bK<*4DwP?Qm^li=z`z*TW*j9nWCq^RvBGc2rMf7ENZ^ z{h+@oD5N<{8i1;*i&nzKEv_7s`7l#%F|kGps;hA?EjQb-91D!IS;~$Y$R$cULK^ld zH<6KYGdgmX#D8l9=Gje=ayZ(p9o`m;9@IDqT45oa7=#n!xCI8c!q(n zQPo%#`fvj5!Vu$g0?7{kG*;I(zkE2qNQez$xc8ub{I7WAFLy8hmucxjl>32Q`g!uy(8|?2y`pj ztKqPqQXVi0nY&1FN^)~v6P?49P#s76R{%6Cah_G2-c);OXFMrbG?i@ojS4PtQ+72F zn5oS)HPkM>ntDy36Jse@fCG@`8rY|{-vrJgMp8R#!WljetEm`incg_NzOtdMs$)hX zqp@~d8>&+(4%tW{9jKqvGA$Yt=Z2GxZ`3F-pOMipV8MCd(b#?Gv^2G*VhDEc%1}!* zIw_+@?ul0$!e3A+d zld(s2$U5$4=orf66i*&>%vK53Z7uAm#KocDRSOqBhEL=J566+axquMNlHcGOIO)=W z*|UKj#=?X{m*3E8212i)q@zZY3@)jg^&BZuGK=lQqo<`})3w&-BI!UYl}u zppLquc_60DF{ewh5qiz_(q~dkgP_!^$F+YZB0Hd*9;MH0ksdG8FmK|?XmvD(yZENM z#%W=^PYEZ9Y4U=Hhjhe~nLpU~z{5TMz*#ujZ%(0$z0OErDD|(Ga8{V6xA;%owXVR< zVFb^j)330vKL~DJ3Xg+Rfz8#Noe6OA0<2HKo0_JEX&w#S_$bV^@G5#7n_n;~&umrm zZn9e)kB-7V0~;%*&WKjU;cmgLQ zYT?|NmkD)CRJLmqpWy@Hs0NrzG*m@Lc@&cNwJVr)foGBb!DV7H)~K+$sxH7t@UspZVV~_{==OL zX1|eIXbN?$YEP1~O|?tnV+7Ss?V10StyAp=zG9FbcQ}ow-5;Ff#&oAE z@pyHBCdciox|}dhWU(EYQ>SnoJ4to&zjTOnLf|hQA>G0LmyS@K4Ebw^_}9-OT^;>P zC$R!&Jb&p3agvTfMno(##9-qD1=kP|l-@&an%3 z_|!F4#&919cbT`;Hp3lNFypMMZNVE*EA%{~1kUTIWav=E*lCoUn+&!-gF61t~jP5AQ%u9|EY84-ipJWgQ$c;@zt<{Zw)@{Sr=mr_3G) zGsX`bA9cDLI>i`QeOSS9J>Q*mCjv*E_{%rA00O;ocmZ4wDdIcI&G8Zc?1qx0J2m>y z$5Nuv%R53eu3Eg==F!~o*p&l`z!kGr@ZJ`g1!sfcu6DTBc3J}*5qBWAgvWVs|#|OVuK>n1)f*qiDivdM1~0 zOi$Tn+`b?{DdY|#0kl7r-cIQnIxeC_y6j6ua{UZ{ZqvB~%Jc;A@ zkv`t<>FmvEKDy+f26y@$TJdG*)Jdo+mz@$q?=X$A15+qAw{A^GJ}$u89v?Z3v>odzdv*vgyXy}0f48laced$?A(bJGi?nVHX)0*A z1vJ?msE&@EyRP?7Q-HO30+oYU+k=D(BR!qkZEJ0GYL6IF>C|j)-RjhQ-6m}Vzp|H} zHsZFmHrj|s45_q{L25i)Lr?W`48-g>ZS}0|rKg_Vw$?^Hd&H1RJ*)FR@T6aO%2?+= zz0Fb2%5i$?#cgYC)Qd+9snp95>VN4;kK5MTNRLMhsia3;KTl73+_u(6dOTuCB|XDj ztp|$KF>{f^IdkZ7$i@26*zkZ4_-;fq+__akPvdINgRe%8=l>K=kK!{mU0+0sOOR^8 zpS8db)FM?#!4onYXV$_qt?+q;aJxrJ_l;y`Sv&cu?L3^OQa?NIw6-?xIsyOi`?J~b zz_U#Ip!LiqdUJr|3r3PYzMPfGIb#qysct*!)UWdgs>WPm${0)X40B^H8D|V8eCD|^ zmzXlff8@5Cd8gTj=h@dbWM*gPcbW$^+IFS~Rfe2SFGFW~ zP-V#N^fGj&2UUi=PA@}edg!DMt=@#tNxhkkcUD&xv8TTui|Ete#YFU-X1=q!uZTYV zeOKf@{oP7L-)ZJ`m!+rYr2RD`y3cl!bsc>BUS^_$YNtv&>+q{kwBL>!&>^Jvohmx6 zG+WiduEjUD=#s6?5Of;i=H>1AO`3aZ?tFQSE@bC9&_(FXSIg*9bgBC{ znCQW%x)hz~Ko=qD`*L(B$-(3%y$-NF-jYN2m^oNuI5N_M_Bqr}MrxyhUR2}%q8pu_ zRL$sc*3@;7kPdv!Ijm}GnnNf3@U@O>{KIplmz`b^k} z+`USj67bH5n>B{v1r+f$=hFj|k;Z89*BIHx+7fq>FhQ*GuurH-Kpp9te07m7@*4H2 z3kp9c_kSl5O(J{}*&dZ~X5Z{1-nT;)3r`QwnMn2)Bz=(qn)KTEm7R@qExC7&uWKg( z@uTh9iNiVeuAK-x+P24AffBUvM6{!#ZP!U8aO5MHK!+dnHe=KFg9~gSf@|FEE4b2T zAh<>+0Ux%|fj4sD2#F7dv%^Hm?0&0A;Kb|kYi%)1+EerGsw zRAXnD*LAz*UrDEX%v$iQ3*9+CLo{u=v&`FO-B}*oExWV)*v8#i9&}Zw?LCFM*{08+ z4w0Vj)WKble*Tk=E-kinV4eQ-1k+>IfG68|)_^m2KUxDWZI@aD&U6dGBT4tO#QlyP z6LQ92ws{tvIh!q~Sw7os_2&DTuo?12Y#4AWo!6TtO+SNKqc;$5LO&8P{&+y!h$D=V zWG|95@gxO}NzeC68av)wjW{xre!%8C&aY56z;DzLq|$BY^zDhjJvz1WXv|x zl+5THJD%H+f<3yiUN@3-n$%(9v5Nd{q<(&-_L_juM&MV*NnQu4jRhbbM%(dDP=|x| zsNBv1zERZeEvU@lu6=JBbvSINP~ECFl9%5hv7Oy@Oz)o7bEja8AuEnVbx5xhxCS2-WX8ia>eE)& z8g=WgR^hHEZyyN4keDH7nEAPqx!w$<}&m5$TFg>k9<*{x7{oZNo^fU3WuC zuXS5d>9wmXF2!Hln@*du9a}vqn{wAk$_91sP1%sM1E*}vHjR``>DHjySo&UXA$xKf z?dpJ2f5L-l!Rat%8*w_Ux!Z9%Z0e?*4qMLFoDO@oL8rr-ZX&8pr}u3%vR$Xywhr7e z9}D<`8J|-L`Vh1uR&0w-F&uYePSKogD=8W>*-rDrsm-`zf6|BfPvPxN2kM(59d(lS zpyR43?H(L8mv-B_G9A}Y)17|5Yqg!@M;8b$&!*)SU^qm`6ME@393L_?dwBmDyg$3+ zC&1coLWj{>Q`b1#`P#W)q2TrLk&Zi%Q#GT*nbQJKwr%KGJdx3G76D#zif?K9hfs0#dv#4T(-{GgtqKYw{7HvhtD_T>iXt=)Ss^~P?b5wMiEIKMWO%@#$ zohFNpicXV7UD1yDN4rKTb4E~w<~*m^F*_z8v#$U)yS!`EuW6l_={4$EbvtOdYuvLcGu(2t#yzVtuMN+-Vbdcz($TExUF(k7 zdio9PkmcUKqoYoe6E!LBV$ICLBj^;*K_m%0oz`veMS9>%(folh_)T`SlKe>8Ejv!l zq~Cblxta94aGab;zj0Heo&PE_v(L_76TTd^z9!towSzU`)X_55ggf0<=uDn^XV@C3 z%J`FeYuL3ec7WF(nI;~HwM{e-?rvg%M7D_p!gX1xire?rCp{zYh*Z0U7)P`=RE5Vy zs~VfD!%cOK)575i#ls8mc3H<>A}Oa0=4ZQ1xzDtEZ#MGC$T-04$<{b)V$C*l_!VM0!n18UO$JT+veNM$d0T^NGUrHOnk>49lKeE;b<|9nESjpxPN8ZX zBS(I!b{v(Fs;RhINY$Vt{i&KVdC!cj@z>wk4zyOBJ8F2X_>XHAYb6SOQ_9+S!%8UA zc^k{xiNMj9)=K_$2UNGp@VolfLL_4P{nrRarv@5EVPgZFm}#ww!L$l~pa>V}T&J%5 z=RAH_S?HOy@U9HF)>rDBj;#@A=1RtzEE` zc;bF_aHCIkWu!7UYfx5YUT#fp_Mjoda`S3(2jvYJl2fcI1`>c^*1PvYI1N*2RiKEqCl!;|BVWyY6$L%`g_&T->5*UhTxvCzgG?Y zjS6IULai;)NKIu`G!}*_c6wg@s_uW90&n0Oo(`K?VKh|N2#;cnhO@*;*UWV?dgm#N zb+Q2Q=RDTQVmMD4tdj-Mz1TiDEj=B0d_klXE}Xy-`b0G}aOcYj<5zj&F&=Bhx9ve| z#l5@zuazKd>s>4Eb=!0NP-HE{A-3F94!cz9=?^8)u|PKu0ioGOC{ZvE9GwcULk2-ZC~tOFt2p=2Eh zcAe;9&L0^4rE^Mwt`jMBp5FgUr<4L+CsHbY9`%>bsfu*nNa{M%P}LQ)bt0+j%!Gvk zT}S3C6ze)QU7?8Ak=Y8xx=wViigo2^fC61dIv2&dPIWGdcpd3n6ze+Cx!{c1h}S)Wts7C>QEc6a*L1jX(WbPWGfb(! zx$dWfTOs~pftg!_{(7OAdx`#fp_#i|{(7OA`&9mVq3P~PKV44O3H<`NzE&`Klw)qt zS>{dnnUN8&LyyeLRX=M=*Tsnr4m8=}i87A9Shv<=GVR0 z-MjpCuLO4YzwX6uJFEMageLf{Wehrqy1gduCL6Q4J@?BP5k0b~T{fLfJdL5ox4twQ zcQ%YPn$>kCE`ZC_cKDWx4w$hulWIWj%1G6o&3~$vbjtm%`L{c5f$k*epj8p9`aOJV z<&O_GeO7g__`pn<>&PN|z4Xu@(x%`?iM4z$gfvG_ox!{N%v)38_5?a{s%C@v9Z))2 zfBW6WHTd?MaJ2FEi*?4}VjTP;ptT7ekE4zUW!}u~AnJ*x>S;IOz&}&TasF<6O}KIt ztERFJej8j_9}QkE-8$ zDVI@r%(u)o4{LT%%a`{&8&NwAx(B*6nYDvonhe@nF%2bBU)j(Kt)ne6D_RBjzd=i> zoz@VoPDk5GpKV9riGD^jD7z}JYU;2dIm3nx88)?g*r42+=-}$?sWml&s)poF%~C(} z>bxI%1@fN*2OWWb=@rOgC;oITkbf?bIUNSaiGQzJO8$GVKzaI0)l>3cNUcj{QZwAY zSDAwT@N3S<8YALy-1Wm5g=?^PyMPlNx4_4M~DlbP(nITLzvZe&_( zB|H*O{rpiL2dP7d1LL0F)^4S7ni(mtoCya}a2g<7q>oVW{s_F3g8#x9mI;xQG9D)0mDAuLJ{umX7op#WMc@#m7Jf_uPt1?iL>d(r4i5|G zMM?`ofDMVxsfyCqD#*dZ!}xV!IFdEIFkDLki<5e4Wwkme z6zU=Lb#rrNTcja6J5m>Im=>EZ2(mvSTsmq@VNvmz(P0qe52{2({veR#4`K~E8J7jW zvax>ELDkSur0^i$jrsXmE&Sp#qi(kRU%3iN$>z(W!%G^bEEcQzwR2qIxhrL(9rW7FLv%m4)Hgbo4VkNRdk(&d$iNc2|AzUIe3ck|xl=yCX~an-Mf=qKGmI{lyc zCc2-I=#J-mO+d(oYEJ=WL)47KcvHPR;p=~dKc}#xZ#K{^(HT0};sM9E+#c6LoV`b6 zA_a4tA#C%5D@K=$EGrsY2HmZ2R6}cB9sE05bxiS$WhzlUOn%^`b3+wg_!$oo)J0>B z4LC!Nf6{WeHC9{4PhE!R1QxiU+;A~CZdevBEiEZ8Djz*2TnN9ZjzLWMgW^PnFDwfe78I3~k1c`+UQa`lY7alE zusDCvgrc$egX&x7z`kBNqZuAfKs@%$W^&@SjYreMQQ`7}(!voVpnxM_V2Hw;H3n0O zW_AscO1~z~qT%6@V@4H?9#d8nC?olqB^5?Id`!5cc+{9tC8G+$MX;-AZfr}ImZEUs zn1X`Rv1MZdxoa`L3de*;7mq0&Sq1~*ga%zO zAdHNULH$vTYgCnDn`e=PsQ(L6A9(ULilkBloXID?Q@kg`a@@hB_ zev_{rcp073)C~5mOKhOYUBRt!p?unxrRR=AuYF*8EK~oEjBTl$g?(GiB%0t@R2}`& z(*+`v;6FSF!*Ckp*#$Iusf4S)IdC}ZejZ6NO?_}6$Qcgvf-z-q2@yu25lyDGAIA7jI zFh8C>S!R2gAFkYVkw?m1JC=>j;^1F)r8j{ZO1E zjmz=;HXCXd9>!l>5cb@h=YRBSy!j*SI2mALXeVipc$Fud7&=d8IQ_d>RWkdnE)IQf zk4p8|WZHi1ul)7D0QbOpv;w^cB$gi z(_T4rwGp^SPoed}?kM2_91JIXtC4(vt5>R_b~|d$o&FR|xvC^(OYzl|vPsddA!T4N z;VW(0Qwi9HQZVVRh!oAaDkCk{;wvOAX7fCbH+3t|_1MNm^W9>@^hM}$3ZCmW=RVcW zTvq~}2X}2_xBi=~Uwbu4I^hNUG&uSZw@tfG8-v;Z?kI3^s0Ck@D zq5WwRRM$olOy>w@Wz?O$Pnavp#vjNij29h0dCgOX4j9k{?~r#+M+#b-q!f(g`JK8~ zHSa#JuZtX~(zWXr#MP%akmq~ip5ln#ssoAN!jbrGuvzmZ^dUr~usKGTg{z}*x-sfH zkbrCA9-DPso*Q+Nyo7Oy@`v&~FI=e0&lB9+bU^O!ITr7)ZIZmVLx-ac=J#ZJs8Taa zxlKpl)^G&gU)u=0w?l(TaH(Y+T@H!A62mUNweA{7L_q@5c=n6$97vZv3i@tuv(Iaz86MItTHs@CS(SX-p3v2kW?6uy~LUmxb}`kx_sMgQxK)#%Oo zU&e;i$i@Bt&_;XbW@q(xEZIYb4jVRjaCYt>$Ct30os~6s@ZkRabBAON&C0`Vhi_DU z@@wl4S$^A$gOBMF+GC3lEd#5Y;XeLZQT4x2=(CJa=+Mvf|M=gHdWHs8N2j(<%N(z_ zya_ACU+Dj-f5V}k!v{83SH>#s_ocA9{g?LtxEAg?Htgm`!uQj?xT!5IPIXu3e|Y`4 zo>>pN?Ljd@x5nA)86Fsm&WUB#H)u1MhTDL9gjv+}?>Y8xH#ZZ$e-4R*0&=ee;Qk5r-T?0Gua!@~a%=>fmouYC@A78B#)p9W zhFQP-A@>_Fd#+a25^;loi6-F&fSE>ME(yRb2Ijc{+#A4T{5NrY8^Y#|f!QJew>>bs z1mN}tW=In5{Vt(U0Wdp$r{cr<8AbYY=Lg`jz{o|wJ;AJBd;@`d37G#S;rapB z{l`#fclhAqXKxW~$N}c1pA@$~{A0^2^Ss{Aq0naV!A07$-1e|-J75NTayEZMfeQmO zhdICgn*-dHz`UGWlomY+Uo@yE(d1m zugYFe_{aL4qrQZ{*q+OO3x%e@2N!8ia#g@IdUDopU+70|z+CW$vM0+S?cEQ|Q_T7K z#kgMqW@Qp?3*f#&=1=9<&mNX{BVe}nd?MraH8;Nq8OEbsQfWO;J7erv(NKEN#ARM~@O;ahLZfq8^EKfl<2p9AKt z0NhGoR(o1bF#hI_|Wf-z}|YFMyNl0aPhN;^Nj((9Lk(uIVJ(u1k4l6`Hj0cO~{a7(TcpvR4JnO-VSk_arb~`y{uw6EL+& zINT4;2PUJhS6<|PYhz%x@#JiK!Ft;fm^sY()f-Odt_0@N?Ui3yZ`R&2;64ZD${iHf z4gT-dPWOWEKV}A2Y4PJW@26}f;|>VGZ45?c0N2VaTK4jb+_Au%mW10GxbuNo9)NoY zm{m!*?ZDpGz;x@c%Iw$Qb_K2vFa^x{mE$PjN`ZNtIluNi5x7;r?6YHHzj!<}2AJ{8 z`T0feFkq%8;idyu2h6L?`L(}&f%_epAv>w~{J8$WMVNtATDL~^bT31ePBy};Pz$KuYR!~RRD7kbAEpN1NRSRV3igxzx`p$+yLAqz%2xB$N*K| z?(lyvdjnuVSpdw6|5IFV!O8v60|PTc&%g&4Sq{tL{QfmyJ`KQq3(Wd^C%3m5Fgpd{ z_5vn905=MlLj!O%z_bP6P6Xz{Bpe72~2JhZWwSQfjN#jzi}M*zc&DLCv)iCtNr2r?0#lol@>296Sh1U zfW!8;3b>z`^(!xO8|P+(c7P8qiMSkKiUV*{fT>HuVP1{{=5*!~<>dlqC_wn*l@~0> z#lYRntY10M?*qU*&77ZKwD&47pCqw|+;6~anwL0#I3L;xn0=FQc$`wf46M@PSKi}+ zJ3om%jPC|uRwUtYe*Xe68xKlc4z$+~n4BcsvA~UB23BeDD#t=__ZVjpSa zd;*xSm_ypj-U#^qCuYd04;O>)_aB-Ox*a~a$n)cN+`#c_B`~X*Q+~7JuD>Do3oz>s zQ}+D0J%QT{n0=V@Yp2MK0j4bpmk->Tz&y*G-@LdAxX*zp-$%vgH(ufVv=x}!nDdJd z>-SM$3inm^{QTwtR|(7o%=y_n6u29KS${ue&#ykv-Vk7BGUsOxxnqI3GXVDlFux_? z4gh%l>X*p<8<;_-?^X>4#MV=p$T=$ZU(6R7|=j?vw z9@zL8GX%mP8=vL2hVSQ&g8e>xaKXP`9L|Fm0<$CucOY=ffax|`+4E~J6M*XjOj8mL z=g%iG1FN)n#fRK^z+KI(UpbIl0?dje+~&YN#tb=yKVE*3dm{k10JzV9JF+x!p0T~1 z#0;#`;^i0THS+^-cwfST037ZgFAB(A9)QDgTor)(52WK7;7%x4dGWj6*dOfeH6|le z1|MATug!}+PR9N<5tyk-IJ{n42h7m{xRZgoFaUQYFt-KZ?gi%Q0NksgZ@`Btu zz^qKd^#|@NV0s*+e9Qfo%`U0djl6vVh_24fQbg++JHGN33oWyTL{db%=y(vD-?6rgEK;x9iqzXcfPY9 zZ2ke5Ee}&1?svS(+Xps}1!m?y5_9uFe?2gJMZ7rM&vCq;4or+Wq`mxB!S{24`G7gU z^6m&+_rsM>Sf$0w9^SSw0Jy=Gik0W(WqcFehKDqy}Tp#GbCjzsuR&jJ)!rUh<<6AN#BlJ)B;F72u z4+HbOCujX02sYjXW{;W5p5OR~dEK8G^oxsEePG-rz*R9T#H<=+2{&$$W-fCwf0jE0^rrx`(v!3856921n1NMVtY6FR366dMu78V) z&#(XD_chG0IY&9HJ)G~>2jE@+cg?^R;0_TM>DQJQ&nwRdW+`(>dzAzIE@uW-Y4PH4 zKXqR~?!f>Y`h7G2hyC@b0NhJZz-NKGVs_%Z;C^}~FsqsK%L~pgeqjbyY4OSn&hNX- zQ9c>-%rl;!><`?L%*t`d)*HrmF)-IK=NBK&!)^iQfdJf7z`UJ=yBF-O0%l>GDvR_h z49u+oxO;$kECBZcFz&Ys56oTxxWT{-_vCCj@HnE38O$>-wmvNPE`&c0xPhmta`?^f(cVO6$e544 z2z-BN0PbRNw*t8FrziG{P46gRemX;OiT109oS6}t1|MATuUC1o+a3YT7iTF>9&gF^ zx7*op{{egw**gb1*#5vgw?J{*2*1+ao#(>%2cLL*l6wl6*E~5}ZO0NiiDbi;~<1^?RmkmcdSGQW2M^MEI3{o;P`DPVTKT-lTR1zC;)V9J@3<+b*%fen*@`Rxj2FVXRD z>B5ZAB={sNMZE&NC4OVIKst?T9Mgh3Pf$ITWJ+prM z!A9UN0H*6r$~U%eFTW-5{a|3`GUwMnFurq{fmK?(?BQ|f1pzqRpS>D@s|4=t0341_ z``!%qm%s-X{Oc7Ta^=8GNW$TLOA%n2lW=&t@n~S)S)%+V`rYSIOW}Mrd~lKR$#%K` zm@5Ks*8_8>CuiH=%i!yNV9vh9%dh2L0qzoD>TY#$bL8_6Fn_a{fmK?J2Zg3BLmty0l2f0*u(rS325)1z&)D89_H`Efc8EI?#BT3w!9-) zee?xxcV_+SV@rr{L_m8716Py89+vl{fcDM+?&2i&Fur90?L7_L>q+cw3--PTW|KQr z4ozM>#?t}740dy_@f7zz2LV&<<~;130L)o#&SekdTLR3ZZqCErhroR8=3MqLzD@3e z>qqdxB~f|z0cM1obJ@fCsAh%?!XLl!c@A(V1+aHDFw5MWM|ocb=6yHkiVw^CCor4d zoxHqz0W;Lix$I$iCjv9W&3VLk3NYupIhQ@`A9pYVtF-v#?_S^@4`6RqKzm;T_j3|^ zeIcT)mjxSNa)3L4S<|jO%6n))d)2@-C9#M75TV+}6w{%3oeUd;0-blEfbF-)aKdYX)v^5__1x%LCfG2DsY-*n2*pz1M;JFo``Z zZ|I-F>SGh&wq-U^eGCq0?*QON2e3CipuHyGj!t3^%X?`+d)EPXM-qF~KLXl&6S!4L z>}5iHUG9PB#J~p^JpT0?|Mmf91ap4%f!DXHfvFev;5lusaR~2+J06&`lW>^7#mvAe zE#aQ=_K>?Zj`Kb)TLIh?%=(oB?R^x`-Z#Mgk;ESExBA?h5!xF*xZq#EJP!k=n7Ksp zRWU;b6WD76?x+CvE(vJwTHtO^Vh`Kt3jyuD0o=+Y_OL!ORsq$sSRka4Y+wp>|uP11KPV8xa9%ty%x~kzk&NKi9M{3ZubSNk1c@f$84hd z*gv4XV&D!8V6QQtz1hH>n8Y5I_o{&QmI8NA5_?#`Zv?dW9&ld-u-E2m(zh+}~ZxMrcR);9~OUk(YdC2*f`gdBOfs;Ntx9G77i}ZojT_ zU|w2)neXO2%5g0)x4Su)J*1Fwsm2+S$WVU%9;E7YIM46M@P#bJBCAdd5%hg}8SQfB?)!*=jYKzpwM z_g)fv7~dZO?R9?$?qh@xE`IT0edGdD!Ca#Hr~;-ji9MV@p9#!`!e0D*w+C=H0kb>_ zht~t2VFp%d@v1k>^UHCZcfGw0+{euNi-Ua5r%q1#s*GDo! zJ>i3kpFM0>1A!UBoU#{R4s2JYz)ViUp}jh0V3iiXcGVikdFSOA;7(=MuN;`?>jT=m z6SxPG*u!@J?|}9`0`8k6_AtK99u3y+`vA8avwr365B7?Ii87a{9kc;6FNr;@x5dCL z5%%KS0k*#ffq7Nfi|6n@{co9pRa(5-L4Vlt2XNazrgD?09NEC^&zxUgupEZ~Q!VVp z$A{&Z1I!u1UOb28xQQ89rNyfpSig72aao?%e;)$wIpG&L*ZvpBwJ(6__IUEV^Z{l! z=KS)4<61E=qnSgiUgbdjLCnA^EnXa!cTybZUEV6-8kzNr56>5$3Cy+3C29xv0P|Q9 zd)N+E0`sM?7hk_Pu7#d}-^sxT7r*fj?_7?9n_dpuJasdoO^!KLXlY|H+I{FZkf%mp_beZ)OODKYqsx zLx3xE+jAYKptnkwJvvVD;HG+Uu6~a3Rk=97_+|n(o7qI=y&#~yD}cK(fW0RI+Is=G zcaqq{^UA*fv;9-f{^rv^fZ3lpzw**}4@|YN7vImb!0#MjZeR{|Ui}xx`z}wb*kF|w zFAnRiM;zx}j;(;(ky*cTpuPNn_C^9XK7hR=0@`Z>Ze9|5xW8N+(B5+39tmLYgMjva z050R1#Qhw{$$rehDlLBfXiwmVB(aC(od8U&oAWr1pAXD=ZqC)uaooKfn1|e)hrRcJ z`NGY)>|uGkKkII%KJ5><9hvoOe^}mpV8**SkNA!N<`_5UiVw?s88A1yIS+eJ0rQ%h zbJ@fG@f|a;N{e6p{svsP=aRRVU6@H`FB`c1li0)g+9ANqc5@!(y#Sc2+?=btn7;>r zdBM$j*!v2YU)-FBy=|WVfA+owKC0?ke-a`D1ZPl`P+z0O5?&gNk6=V+NCIbI0zp7f z&;*eP6(quhM}3eup)ejtV|`SsRr<#EwrX3!N0mS{0YL?ysBOi1TftyOZ4qoW|L@yt z&&kZ0GY@;)d++c6yXTjav*w)dti9LTYp?y@2lYgpJorDA{zd^aM&nZ13+rpMfLWRa zzZ-ywWWn#Jz-+SP9OV5yF#GH{2YGwFg#E5@^04G^;CD7Keml;_kNK@eV-!RDOQpZ7 zfm@z|AMNEXU>?=DboJfmfZ3ISAIr0kfH{=FFS#6Kzfa$t_^tv@9%2X1xDz!-0rAhN z9Hd?flW@*{s2I5OHP%WG2R&b!CBHi0mSn-NB};zy1Ghc{KjzDJU|!d_bm{g1Fb6a6 zW4mm?E{sd!g$0^DykHkBOY_g0qt{s`P(vf$VEWl1xUBDFsl z0GwB2)5Y(CEcuNC?xGC*Xs7kSG-_NrJGc{=bs6~44xRy~BY~f@9lQ<9yBe3y4mvfa zTYt&?=qLXIT%T7&*XiUq37BCTmrBo+!vJPV0>9*Nxz1r8Fe?)HCFAJ-?$#KP>Tt4W z=F1-dw?Sjm$?-feuWMX7IsOXF7YY2580rAgC4yH#Ta6XMq zC&x5kYBesM95({9CV^kF9Bh}}2h2}0;FumyY79tqILSeO(4K@VcI>Zv5xBQBHkBOA zZ-;=%e=W0}o&Zdd#--xNeyMT5OijQg>xJ)Mt1%$ekxJeWaMx>WDm$QFz6H#!8E~|# zdo)Hub+#AkGQgzMY{MA(boy*(4W)K zhI1O9X1(|*;J&W0>Et~Rm~k4HN?zK*mB3t^fJ>H_^X6^?=6f0^;U?plzK;U)gvO<_ zgEnBcXTUK%Ueg$m>PTgO?Fbmp^t(p`_jQd;n;yW7 z(>N^EF#GH{2Y$WY%1+*azzx>ebn^OvnPbN}#BUWarXA-H zzlVT%!j5y`_XaTU*>Mj1a^B8P-u}RysIjT!W&SA3l3zJ+lQZyR`L-xaeyf4IJp(`b z=ZAr5v*R4}_bxCW+Hns0JMwqf4<08EOD_)mMgvo6$2stut1*fp{-w%qOMzRJfgkIq z-^-HUL%=$66CmP3CI+eeS_ahnuQXNh>w)1`s+)EmpPLB70`AFkZ>4kFidk5>N zaPkm-&TDmSM<+61m-D?<2)B9dm+E~GzO$PoN%;*{lxuI z~S!;y>f{mn<*+ z?jT^i8kfpWi5sRdAl2a{FZ0bP8!lD zcANvhC@}ZhaW;M|XEp-!k{##3??Ye?+i^C2w5x&dV?F~;9+tg0@T&x7iXCU;M|l?m z6Sm_V_b65vNyYFSgr3%*# z-0>P~>CYwy`Hjw!pC7oYEcjiWCBLP>t+Mm8>4h5ko{gWo^hdke15%vxjTbGxhQWFfZ6~4svt?^O+rI<43(5`vJb2hLeY-KL>v0z)ZH|9Q3kC zV-!RFqh4${hPK!V=McYo8!nap8iBh-V=Xys;j%vTGaElAf57_CFM)emW7E~g{|wA0 z8fS%TlY{j?PbcQ9;N&6vlIuhKj^apQuGTo#^PKAAy#J=gfK-Q5eTaVOKW(^F^}qeV zdG^Q0&$<3r2u!iYrIMHR*h#?5O28${TMFDtU>?;t)>EA1r5wk8h<;m~Jow)U$ML)& zz?`jdsr1b6F9b9Oq&l4VF@MYiZhitkXT4kx%vz00r5DQg6JQ=m;Fqiy%KI!ZJ2Wnp zyu`h(F(B39WCslQ4>p{#16%%JID3nv!O@?for04`y7V{$m~%8PReC5rXpCZre@^+5a+Cu%OJmc? zu^5=^G%l5%DaXCQ{2+m!b3WPt%+nf|PL2+ZNhb%>_xU88v%h}}xIb&GC5NqCr5^G= zm9&V3o2p*i(+Ov*Pg2jlfIC@Z)9JYcmnlvt*o=uI3 z$(t(w-fF`+)yFCCw}Jba#-@|^8DO5*xODRF1?J-fe$Mh9@mG{bIC-R#_c)DFK>Tyc zA1qe~0e7~>rjsK8%yf-QC&yA?u210SEJq74-_f{KaTI}F<;)V`Zq(RR@_G@U`+@nb#--EWPGEkQfgkhv=fLzhm|lO!0yhwt5gI4)OV%^X z^9dRQQXQ%EH^qi?(w`R`rUTcYvFYTE0CShdrP3ee{WUPZP2iU-2fur`6PQkoOI6Qi zyYZOMM0X(7;Uq8Xr>EL*PVzE;34{4=~?P;Fl~f^T%VrY{`IQ z{&-zuK&rz@Uh3;z8_r2y*2Df}!==g}9|QM=#-@^&{`B}mSeJ^EM>_pY1ZIZDrQ%0> zX#nQN1b)f-<9DjR4b1uke#toMrCnn{s>4ZtY@a`G!#U}XcJ-`0+=OsoCCiWVD7i$Y~>8o^GS_i{M6yl&svBF zzXfiO#-_7_zY_DgO;~*&4@ono3_AKYj=BR*eCvj#PH= zpbh6_2h2wg*>I`s;4$DfYpj*Nw)oMm-pP{R`@nsgfgkOv|KHKCjFX2Iu7e$v12fr< zv&E1676H>_$2stO5SX9aaW;Om(`~@KX~#M6`wW;K|FFs7!0!}bM%i%={3Zi4%Z_uf z`;{6){i(yj?wM}a*>I`sAPn4X_Hb=-kl!z|tK{8fV#`O;mYttX)y%3lRjU!hldHMb%jRC0+ zCmi$n6yWA*Y`XMa3CwDZOBFw+?+=0bj|6_n>C1X-D=-}zmr4%GyGvt0s>4YR>iKox z{;aX-EtK`W~9cYDv#JM^8+(p<5J1NaHeRC5(5965{OHHOr!fqdM=Je21l(g8 z_%VL3WXbP6;6AeRv)KXL3;l9MCybjqQk47sZMal&3V z?|tAt&4OS5p4r*`iNFoj*i`zXyyLUvHx;-VJHI7~-?gNj-T=&92{@ncbQ_NKl3!~K zNOkx;$vEo1#tdBu*SnhTf2*ttf6dLNhp`692>i+!zjer#W!1k6~C zv%Ex{eCaiJk z{K?MGCI{;;hc!kCfq$v;QST#jU8msWkt$zOe-{EXBMV#u zFi|_sCT|h={T!HAG%lUIzXv9#uf)&NvrS&c?^s|)YFsKgcz>eCfK-PnryclB0N=BHXQTsZ-CjYajbW%^swn=2xHU_?G&6m(&=RsFw-^83fIPudR_p` z?OE`<5137Mem1?7g5N8^9C?()kNp@>7O~=B4CURxN5|`9+*~* zW4+eNuDrNkcyz9-0w<4D^3qQ()EEWCzf}CL2k!n1{FqM9ChPVu8Xj~tNes>I17l|A$Qxxg&dIHH~Su^zTYV?e6I3CH|)e-=3M`;`;U zmOq$}I)HmmW3Bkva3g^G44A>kio7xohWeT<9}Nd?IxvkImo6XO49qVz&Ivfc43wZs(&d(+X{lO=|^gK@Fu)?*;@pa(728>VR(#bIam}~6(Z1zVx zxCxkVXMy_(FdH)9=}AM8?wNa0Jkd(9OcdPW|sFv-~vgwWO*q^U6#0r6OQ=^JYom^ z+J6A|TaC5ykpr$BnAhz%o4pi)-yUG{PZ61|^3sN5IenhS#Ny&)SFE>B25ybUrfLT; z+!uiPo5rOIm;8pDivBB{JS=`T|HAcZKL+MKjZ4r=T>py?xDSCDIav4!t~$x@QqSjV z3`lh-dH+d2&VIA;PW+UfyCcZ<;3dG_ps|)ewc+Rw?gQpwjnne#eA&&9{e({d^IQfT z!+i;uPc@F(=}zBne#G@E%ykXN$s=9-0>E6RajD|Ra^@;v!WsB6-0uVPoW`Y#-B5}>%yk-gTtSO`pGA}&b|`h%N+xjO@n;jRPbS&g&eXY)hE?FQx_S>QZFb6scQ;OO?Jp@VFV6=QU3B67%DU>H8`$dlPW6a=IHwKlBMOM-7wsS>Za!I|7($jY}uT zmB6gE^RuPzIE4EXVD@WVIynvk(`UHEPuqcG`VIibn*qmk8wSiIjY}uT6~KH;<1D?{ z6T2{1iJq?d#7^8j;}#^vF6s`6+yFpV0QPL4Z)c{~f;4qy&wTq=3l z&O2%(`hjusNGESSFwF_LWc#CkxfPfnXk0ouHURTh7P!9vbM)yFzf^L}M!3bm+@f*m zJOj+j z8kZ`5#QhGK0~(hu+`Kcr7z3hC@}YCz)^oc z1g1mdtoYf|jkvdg>C(7V=|R1mSd!}+g_B1r{V{#ZfSI9jsrWJ624L>hxODOR1u(lZ z@MHWw0;b1V>Ep+6`vEgb6w1xcfjn;fMfpn1eoJWGs`gym`NI!N{%t$w-A_z zG%lSSzXqlw5tk$f(_iF$$RJcAPCe&Ox{ffO$~k(#i1e)0@LSw2{)Y_1Ar+?z$MGU^f(ik3o_uS zX9Jjp8ka6TZU*L;cAQO)jo`NfnDCg)azugoege)}j-LawF$0crYzF2}8ka8J4g+)I z1rk3?UYi^oM=S$oj>e_SA6EmjDiPtXN9t5UM6T1~7luxKwh`?+&^U z^=zCx(#bIan9CD!Npi40G#{8|jkCga$iF`Trd{LG$?+C2U)piD^kBQ^XkV`De4ISe z$uSO?OA~QPaxi~f2~2$k9Mj{Qz&xOF>E!qoFt2Nzr5BqVr-9#Jff?k_EXQDA&P~K6 z$-(&fftjaqdH9{G{uc%2QH@I{$8*5!)3|hU^ctJ%8iA8Xy7V{)m0K#u zNc^13-(!Fol7Mse_oILrlL5#0jR)pxjkDrsOJCwv0rNwRv+Teo2giRm1G8V_(&_mi zFnz|w%bP3*{p0{(iZ#v(*CBqBfLWq(>E!qpFh8^7Y;ptz%10bbaFHT^COM3^kS2P1#K|L-9L;z(7MOO8OP3xy zf%(q_oO62o1(@7P5^g#lQbrF*XK!|??c?>S>mqA5_h8$uKc2D zg)_^i$Kt|pZw2lFjaBlxpqIJxuU>l2SuvPvJtj*3%Er%yNx@#P_l$A=Krk?_DloOm zKdsz2@6?*AspT~nS6(z`)ac^kQyrcMrd3|#pEmiTnu^M?)5q5YD=)4Lj&VX>)NoB` z!J>J=1y?MYvt;F%s%bS-Lvun4=3X>!;k-FZ=Ye-c#sw-bnyP}HvoJJo$u)CA^RAh*Xx@1>{$(r9 zoUv%$qRMOLT(NN8m1FETX3U#&^~G}*Hq1*FZ_YK>EJiHn)hrDyS#Zr&j)Ga3W%K5S z7B6wc)Kpgor}?K&tnp91WKwxeaPs)^fl1@XjB=2#zJ6h7&eE%Emd;r=@5-9GB@m(J znubMJ%v-W_47k)NHdFl1)-3xl0x=U0fIP7F{&dJGmaFwBVaa z5pVh8MfD37&Qq(%7A?4j59W;-Ra~}c&I%}S$(*a^U9ljv1W7n%^f|@F#brxj8uJ#9 z8CABle#zo`#8CfiSUPXPHCN2J=E}NxbH|Kw;b9%vj$Alz*}R1#7hE~!tTX2okE$!H zpELLBd7%a0gyk;2X5^y9S0b=70nJ&ua?zrBp(QIv&RMu{@p2g2DAa?(-z?}AG{<_D z^)Sq%_fgZ_o@^(QAP*1sml~_LHS{WJHNwx9wi!)_Iaz(lFeB<8Vw7!OHq0=$?&UkU z8mn7FUL)K(#0c-%V?>NY@(SKlTor6bWyv<9qoUBucPdL-OI|M7CJ)$$5rpGKpcYjH z>RNS=C1JHZWt4R2r`SRtm=t=3KxtSKD3`iPPz+uNWo~XWaJo0-v>B0wg&rdkDl9M} z*B5&I7eh5(o>ZYg{md;(_A;9MhbqB(n1k+J&i8~X&xb}u_3Fno6>GW45O=AVPG zTJJ z=%iQD5d%3z8R<#DaK~7xS;9XR{ZpD>gvLW6c78{ z%})Y^NV=OJm6#id`6RPqlrhe|F*s^w!1VcyaH%VFYQQvRnmMamZ!GBA8p**g*mi#- zIyTpcn{KS4jC0^Hbuiz=H?v!RYKl7}l)PfVtEcFyHgn z_%HWg=AT{D<~!J)7wT<9nZsS3$KhwL{-Leba98Yp5(x||4i*-xpn_(rVZOrOKAj0U z`B(wu#*S~}XO;3p>~*?Wd7sIkg6iHKpgx7S%yX>+bx=`11$9_aPlEcHdgFOeqtqL_ zK>b5KeH+vQozHIeA{dqX@Yxk0tZhdne&`4xQ+ub+kYXcf zUh6S7eW{BMlm!8EUtoAUa;s6c#eGu`XfznPve2lC79JNcUk#$bsScVe3ykpdy^OLq zmLsKJVhOTqpD}!Mul_9W)0c3X+toKMWn|-dIssYnU(8 zefsl~Z3y=Cx=7z~RfvqaJ%;N%6&B$52Jt1^_=XWFF<7D?3N&pah=Qw{h007Ry=pGg z<(J~K<6cBx%C1&WQl9b2YGn(bSoh9?>ZCk750sSWkL0xB?_W|jMNfDQLBTo>qc|*i zS!7Hs4Y{O2e7$cfZ7OJPG0eAu!#Bs^kQ&A@tL&tt6^gR@4hIu)7z8xA8_sa3HSHR@D zzTvK%hThf-0UGUWTHQie9byHuzP@liQm0tCz}aGfE$rNrI${l|J5(8cD=4wYhe1iL z;=54b%gP=N^Jb3pTHfasb=Md3F;6lH4YR69RHMZG!!Y&UikfJ0P8?o?2>DPBWCU8wF+2q`-z3~V2d;N z#1PJ`Ei>}q-d}kjc%J27AsiMn5)Q`!B^-1FXbDQKaQ^wM?3+6MV(o(sb6?5JET(2E zeZqRqMgT54Mc4r+PN3q@)i6dt)uQy#>VCsOQ`O?SS|jRe++%10>@-qyFst%|(X+l# z+{#uKEQOQydjjSOJz=N~S9a!>yxq96&=opH*q5y+SlZ7peHLP@vHD=>2*dnCC#v_a zF}AgW3?J$WjiL3{QW-E|UE?*6G|VZ;OxwF&HX_ugDtJXi`diqV|MHs4FPo)po2`y1 z%2c>C?gz?LIC%NKDo@#MCr`&(_a=b)y?T0)Ma{CF&I5Ik;EML{^v;>wb)3byCa@Cim%<{QyVJi$m=Fmhc!PLS6X;PgHL#b~D+ zS&?rLBg}20 zdN9f;+ul&f5Y5-oYA_<>tVhS;k@Zezo)MV@eOy=SJNR5~XmI#XUl?W(AtK_(Nd!<0 z=?>xg!W97KgiuwGRt$m18qsDY1gk7DEUKsy$Nm8o$Doiz_Pa%u`KiE zBHT5?n?33Yhna3oc+#}FG4>krhD*N|z1g~(kGr?2SAyp60+CrL7$@e(j5WN!*6-f1 zS9Kt~35%?R$yGuh6RcFsfpNm(R(dNUD`B`Ri*Z8RD}6W(oYfZ652IZ<6K5@2Nh|03 zJIcMZ2&Nz^v=%IH5X(W_iB35XnKtMj>eq@qqsQNA(>U`hBC7^;j4z;WjE?c%o?wF8 z2z(U+UsVdfsJjEYGY9LADAfBsDt#9)mi*2h0rN8>vK%azBciLSf8~w6R~H$N%HAr& z)!+$V~5JzOC_#Ml^Z+GKnN!(i?{?-fub5g9j~YtK%J|S@C{I6Lw^SKHFfU@XnCBXMuHlx zsA^EsmYD@g+A>#wlD13(C~3>A1|@BoTR=%$=5A0@tXlO3bM<-z7v6(bacE%p$Ncf7 zVMbeUrD^WPl?p<`gXMmuiUOS?daTfoKx6CfNkA&RS#l7C-Tc)rhZb69kz+(2Rs154 zQr(e9*O6!BQHF)fBXXf@!>?AkY~@9IF^ovlTDiGXF7$16kw^F7f=<8rkO|GHZD>&$ z(JA>V!bn|ZhZcu!%e;LB{Gl?=8256Nrc04^&Iv}ZD+ol+H6lyBIE#$v)u=W$xPsBS zrGdyc4eYXcE?Akw!mk{^g1Wkjl6ew>y7pRLlo;J2P=)Ggw~o;M%n zQB`X+ZDyh`~_^Z zq6Zljn05K&NLM_HuQTg;lfPw6<;?-_s#jZyDyth<7kD2QGF_0UF}&HBT$$eco&NU?Va` zNysJ62J#dtVu#J=4D)$3l;MdBFYa8ZDqvgDg6~+?+vwQL_J8NFCorr9E3pLcZlOoV zqv^hR`3xi4_Xbu9wA5P-bEg5bgXEFRp^@j%GhBe4C{}CC?K-qeX>>j+7+R`k3&)^} zq;X9%)QuY{Gr2&20l^)UZ@ zoGaY@l{3OE6o>xWjwX6E8fHbL>3+p%O8(lW?}GyJ5xKO=WhXB1WqWw(XgYw4FmGZS z0L>Z(E(LNaQUNy|!n0tciIuyKrc(UZVVw`sh}^y&kJmQ&@dIzNWWc3XF7*o0)X0l= zbsbGD_@zT#E3ox)d0Z}AaY1nR$YmWa9ZkFOUx)fTkPyMZrKGiDEq8Hdh#t9k<-#RH z0Qq?7XsX6Vhsb#%K+l)U3c0Ms1tHFqOD!(YDgMWF3KDYW;{vtfKNvhBmsYv##D!|* z1!~15rdD~Lk2*hIDv(PNE(q=ro>8s%1-0UTOsycPRy>AU`6E_JG#UJ5ZpK?{L4o6X zxjZhHt+?RXJ#txx3p9uSWDLE7Vzgi-zZ1kBx$MOSiadZz8*4+)t5y)auj_S1{SDMk zMHM4XuP6$YJ=NqC*V44V6_~_E2@Nk`evEcW5dC*>rYNgR4RlGOFQxpEs>sCk@J1@@ zw*(_UJfx!XLlhg`;`YG(eB8jrgG<%utMWsG0%k8G66WoIIUb%a%tz>K=?heWfW5f1 zhlk<6^c;nY<-SiY1}@^N)dP@|kmXE1MGucB&@oQsX@7f9{d%>$S1XtKxF|;-=6(IL zJgb94keBf;;!`hgu)M^tMqKJT!fSDf6S4vhESA0%@Mvh#7;O49Dv;U2cX{tg7bsDe zfv$5e60&g>#y9#jt~$ZxUj0M-e!{>z3ZjaW=E8O4fjX666>iQQXz)62PcOI?kJ~eu zj?L@#jQ7(0e1aSJ*FWH6U3UkDCQ)LBDU)G7MVX9<$%`5)M3(}(w4Ot6)c9DJ7RF;< zLYJ1h7wghe_tY58WOQk53-!kf3;Kq?$Z5b6J$iF7x`RJ=FDvH2OxG5p>2ozOdx8<( zG6bCr7`5AKg!kne;ln4p*W5%2^+2sX@eEUQ8bLN-ra6Iq5~t-;VqAhSfw)v;X@r&- zjoE66H9gykpVF14x*XW2jk1;1zwSPB$D3Bw{FcJC;30_>>jI0rw}WGP(yn8oGVSwR zmxDM5*)q>nj?`{Z)MQYvA@Ah5mV*i_9Q*5}LiHS|n-%UhW%oE-HES4T?QHkL!NhLwW-1VFEwASrGs5F58>M@ei$7GbVVmI^9F&0V_=D1JyF% z&6fCw&G?ar%wNH_3P)q6s&2aI!oqFn$#EfhRKE?z*AKT>ZgjO*cHn%)Rq}S^vNs}^ zy|ebR_jMmf^q;jSD^>UFegYJ zz9(B<#z_Ec_k53T&n?WyW;53TBj-*4deK;-zU_mShPh8WRGG;S*jy+L%% z`GQdd5uHYsv4L`3W9b!Oe>aB3;AQ#*%#-MdRW$z^KB3A1k5+Bc@osJFILVyjvkTLpxIo= zD4?XtarcKW2N8g)MHg+!hk?if6ge`F!oPN?^2KOSiZfz2OdtIYWH-2*Y&8`EWqu*QmWil)i`i64a@|fhcc7C^dt^2x#LA8YHQK{0J{OeuS5{_)dLESc z*ZrWxzp~d!DA?t0u(a74?(THF>x;jutrcxOFM2;_PjCuEFg&#~3}|6FS!aI3kED*s=JJ_qHljoqKV6oqOr-{5r#Z<7VW& zI=}nI16EgUwWlRU8{yxo?kuK-o?@@K1}`If>)724)l8V`~p zI)K6+t+Kr+><^)^?*T2U_-I#H>z=Uk#4Peo=9(cGtt* ze<^wuRDEI{1CJRbx&Yb4au@0JllldFcbyEe#p&jbuYrNo7dS=y22}=M2I^K633;x0 zpc>UZ&Q1}EwR*AB3!vAL3ReSahQif>x=G#p0Vu&e1j}3QCW&Ea0*-}Eyb8x;5@4hQftnqS)50JDpBhAcW^#OagIsc z;iqh{S3gE_v=_$6#b!0%YP5oKBtTyJcSPr^?4$DyD?0Mhzau)2#Yab32^15tG$N1x z9RZ)8K45vAeZcALD`7M^F4Z$-4Y3a^dl(UwTe8d~=fR3T6d75%uxx3>E%(q6x_aXZ z7ByD}9fxYfu^4rUVwDQ0pT?XrI_I8O*{OSYLdu+$I`^tjVKM6$zJyw33w`X&1Rv|m z!VvWiXS!v1LG1?T$m0%p*|nJU(FSUn6CzJ3sTi}ElLb_g=aAWVea7CIgS-J#HHFuc&*1liPl~MwMh9nRtUA%imQ|zMwiA`JW&zGguK-^<42R4zk%lb zs?dV=HLbXV8r$Sjv83p27T$V zsi&+K3l-;^18Snk0N9Dd8?4P3hK)i$QPZ=p!TvIv|v? z8a*9zsuJ=mfid9?qtDbXYMnA<*@CnvYU4QI0hQtK&vl+sDf(p(7;~$;XJJ(IIS{*7 z5gmJ=B2v+3f7_A3%Z!6qOqw_l&YT(lZgU^GD-ZFcB6<_=R79HlgoqDsZWJ-iutLU9 z|7ad0FI!JI4dl*2@*ZpQ>{yi%=&_*YspwBjir6K!-LiA)<+(6n)dzKg_8RE#g2(ls zg&Z_<)l6}J*G_G<+iA12l+7xtjrsEwSTuS9L5c0D$FOJDO)71ypB&i9b7=)>{j=>Z zNnpha?qXK$e?4Zs5dj%zXOVxk(#G+iB)05ume@*s!YjSVt}&ZHx^XT`AU0|}u}D%S z2I$c({0GWjI1^7Sk<%cB;xx!N)l+a%8g}SYGP-K>+hR5YH~v4DF_9@6SE3vZuoOm_ zatWgRcIX_na%vN7vn$Ifx*W4c6+|tRLY}f@({_ENSW;XzR`$UWb@5??K}pIquFQ9Z zP*C?)h&Dnv@MoD&d=zE&@mGiQO92+Y zc(M4UrmZ8)h^8(-3-GiP2NvZ2P>cs78y5f|Amebq6Uw*&8p^|0xxF za8ao*I4JcaOR4)Ur3&?bO3lhrWg0@FrT)WG>gSeHg-Wkf2OlbC?eO41#TovV)h*10 z%29>C(dBK!G$OxO%^`Ag0+D+)l3tofZCs5j(2oM#zQL($6)YAP^iuS0v2k|l@VUC40qRfv~E2Adw#9m#W zzzNl($S5h%)ciFR95qTr_DmmE5*LAzxg|_CPCm(VvA0^NaiC=ORhFg5jar%g!^R1E#|=@X9R`Socte^Vke$ z`YIJbBBcXJgb64K5k?4WC4}yQA1WcPkI$KTkt1`et6kKnlp&(G#Kx#wIvDxZ`O!kT5myYQ9H zvrP0u=UFEDA*VVhw$P2snqHtE(oC#})+`hKkOr0VVSW5VYnF+AvnBqas053Le29Q0 z;0=Iq8NTD)*wSFMVX!nxrRhUA}EX3I;Q7cx{eTJzVF74KZJgxn8B^K+hCO>R$(QDZ; zSS&64qP!?9qLnUayv|s2Zw&Q%J$@L`C@-)W3Or?|mVVF&>m=Wh>8Rxjy|HXoQr9MNI9Mb3GRe9CJS!Bl=X1?+zSPqBYHKt0S zYtO$SablesZz{9nrV^+hDH^o|cmTCef|He?LxjC7vcCiC^RmA~wyH!u-J`4Mxfnmi z21WTL*s`DxR)@n`)u0;PD;UAh3;LBRSf4L`M)fPTqi#^H>M8L{znAt6e;L2@o2w$= z(&I;MWB>=ZSR==b5-gkIoFOdDi}`&nB1Kgft3XOV#B?asm{c7Yi#-f?C8locIe+GE zu2qoPL(EN#ullRM@INNkFDcOFRb=Z3oZcE-ey`{TtNr1px=mX1^`2th5%V3F6pij zGq~>Ru;a|1Q-wLyGBZ|T<3hg{YA5_`ZK|m~JLqAgo<_$uQu+OJK*>OK093Q`KM_!4 zmBZx>w0(*i3TmgK=7W+N7FXgeQuQF#wWJ;tx1g$67F6{M&nx~CWsp`0?Buex6A;3; z#MjvymX~gBKK^A9>Qt-@4m==AE&sJRv~?aq7ZE&6igQqI_uu71{frK{f$O2#1OfRb^H1)%ge z#$5kDFuz>+{e0Y=EQOlwE-PkM|7v_Wc5q8hsE^tNK}TMX+4lykJ5*w_3p~C@Jr;3Q z49e>UAjz-Ga8LK^%*Qfs%2cy3tTI5o+H$ZhC)DrBTCnQQzRD@6^0Y?n(ILXKc`m|_ z1SN4xU>;q0z%YApXjw-#5UI$I-KvZl2Pz}M{QWUOVnam|f%=pYV6c)7v~P*Z1)wA< zQ$X3HVnm_mZrv?T)$3lEgxWGYwOgCuB3) zBay)tLe%(t6`RzmVK%N zpTq$hwG1cykd5zPN4Md`#Ap+}Dhb$=C8Ifopkxe(h9lHjprpPv0aPZb?g7R*=_r-- z3OPw-*G_sq(tq?{=OcYsPJFZlAzGY)b~rBG)}@q?jS%SzV@?oRIib+5vzT=%2Z01^ z+DvKVJLU8a89L=!@f5=fDh`}8q=%SL@-sx~U+bn zc9#y8aiV{f3W}B5;B-Y1GN~>15RZ zZu9tWir)YJ+@aimEQ=@B>x_h~_s>);V|+PvG1+zeZ#CU)ZSS8>T=a=NQ4Qtp#mT`T z=}j}YVwuYk%pQ6_E_ac7fKBn-Mg4f+-5<-mijMFq5{tZw`W4IFV)F zsJe*1qTN3ZO(qscY>pP~Bf%~W*(u>@P$#P{{S!g;2Kzi0D|2h|s6o{K$hLisFe zqD8TSD^EF`Clu!p`1ANK=Ol75Df*}X^&(>#qY@g6+k6z8)(WwWcK?J7VxMY>oo|UP z6vd`D60wEyS@$Tm+~Zh^P;)JcQx7jxVqXW!5*xh;$0|cttDSYfbQW_*Pf0M2m}Rsp zi(q<|rk*I;i*ZttvE&zueLYeKs01ZrFICplshT>%#eQWylERIu|3~63X~DP)l`8J? zlyN7O5cjz5x18{bg51#9*etFQn^Z?z_qL4j9c}hK7SC*D)mnFMsQsnc@m5xyj|KVX z^=LT4w;`vqhwsdTUyV7s9k+K~gl<5v_PIA;?IO9VhF8pCM$l=F@Ml$xf*)097vZ;B>$;NEsiM<4E7O`bQbO64| z1E*rGwEwRJRB8oOZ3T27?9cCd96w#yp?7mz^ULUOf%r1$rMhJ$YAGLZ6c#I#W3x7D zJ#7wml6t(Vjp(%=WghI79U3=-?nE`+D{<@2?wvTXb7wK%$ad#WbUaFnEpZA(6cWlT zku4CM$!|VybnST@Ee#ijEd2TMucTFV?|Rt3f#v3yVJO>cW3~AcdX1=T<&K@${3hnp z-f)%bv|Yv)%jnVW)g1JBq83b*hrw>_Mx+uD3=3|>O|{e;J@l}Y6-C@avY!!MQQV0s z?5ew%`$<;)RK1A}J#KiI>)CPL#5L`>zJ!SjH@pGj9TM+@_^7?|Gd}5Ruk3~4?=E+< z?9}>3H=j+EumXD)TGrhI58Wydu5#{Qj$JEI^7WtSwcW>xR(0Qp!ocT6Nl;#G`idgu zGr5<=J4WOr)n3Ln!aB;>PfD##mkHF274CdQ+pz9@ggfsf+<6CgUP`$067FnDxU&g& z9!|LPuoY;FT5PL^@|AvLL;2TXA7nM0j}@R&Oe=|Z7(fM8smbzF2KjCRHAUTf9+X=Z zGaUGnPMY^Y^-}k`Kyefs1sIg-QB*l7>A0D0QCC^iN{ccr>U$RTGf=W=<*T56ho0*^ z*PEcGtGHO5%(@RUx(C54A?VFy+d|2y7@zjy**=`Ee4N%sm|py_2DDgz=&$0e@pw|8 z-f?;&H5xuS+V+n4Hm4^>N^Uc4Pq5djIMsbmL0;s?fG6-ciw+!aq%;OiFh{vf4N`1b z($fh4J%8zd0Co=_-e#1wxo=V(1U=sFeB0Wm_+;kTYQt>6-dotPn2Evci(T3J{vIJ9 zlU!L?%ZVM>yA3m1M2{FtiJt#AKE`(0*fJS=YGVhkH<#xdJ>JH3*&!Gn97Uza7`_{h zd9)Ed|2c&o{<+cPFgA3-P>kj@JwMpveQxnm_UZD|u;sP7jeU_PM*9v44sXZq?3?%W zP&e@~V7}Nn%7~sNF*DmWk4kKM^&$pIdK$w~4xEpH6k#(V+V@;+;$>|TjeTP|D~Eey z*UHXa$YZA)=5&v-`Hwx~N)Ep+qA&y~yS*$wCAJ>j$hpj;_Wue-8o&;EVYLT)zosm- zR3!DDV9YU6)7=3|wm5#zq7H$QZLU2?26;NnqDn!@(;GpF1wRZ*Dn^fiGL^;AGOkrQ z0sC#_x6y6Kdg#Am`K_9x&=gEc4U>eg@8fYb_zza}LEYs%jG*-~@T9AHK6cJ+7^W9{ zJ&s7Y;E+d88w6|Ia%9CIYjgKOp1~D^24Dvbj6=<8``2$ZxnmxJmc1eCLCM~bbXSL! zi?|t-><#%{P_j4V_d)$bJ^eW-y{k-Yf{K?DR8)zNXRO|G`}w$b7&nK*kiZ1BR%e`1 z_I$(H)Rg&#+SGMC>OL}0dN}W@eO=?1@pN~O8j;DR*v^fW4rFO|u}ihf8fRfQ;QuEf zi7BeeM6x+SVC03BC`b+v$4s{R^XE=h*&H#oW+ly zKDFlxB5IGLPdpDxoQD+K!Jr;d6ytcO3V>DWnAxjYys_;Yv8A{AJWBCFe?2B{uB=zf z5*GME3*gvcrkFADatIr1`)3++QAZjuq4Q|`s5bbu13yfk_of&oR~6=S{CpQ&|I0BS zi=370V=rYJAbPdWh+bDOvfypZPk@uHH6kca%1h-^t$rY3SjHeK3sGFDTQej1;UQld zk%{w}jjEB2)UNY2ZQLJA?U0K30QlmED2DS4#f|Ovp9>XW@FXs{*cWN*U* z*w?qf7`;3{vZhwhU&F#dZUEAYl{8Yq2$I2fhY_?>r$(2g_QQ z51kmz!`Cseub{aZA7yd#Lv1;MC_W;fM=;y-N?iLo!P`(XwkZH=*8HMOS-blt7p$I} z;h<`KW#RnE(L(G?wZjN+!-vPVFF!e8;-emI#;y-gA?2rJj>0!u@Qn_9iDoN4C9@k# ztz=1MFme^b-)lr_3aYqU)K*lad#c!AQz@8)eDDQTSbPx){FPz?(HS}Z_Pn#=dpgQ> zeRa1H?#xG}|K#Np*n-xQVB>o84fSp!C*cw~gATNomE!qy0`;8a1e;TP3|>}qd8UeO z04kEI>MuY^<@Oa&vODm*7Ih3XCccC7vE}J-i~0sA$;oV@TrUQS_hST}uye9|&3fK4UsPZJk>q-b$%Q#Y z`0|e=*8!DW$Fa_(lIu|SzR5@O4OZWDfDZWl2s*^ zs+A6#SXqx!;aXTCGR)^Ho3t-St$rVNo9;ygBg>qC_TaT1_1T&il;oWMoHu;mg9y!d z3YnM3s$kitqG>kE!rRa^+`jxQHBn3F39LL^J{VuTgOaU05o^YxUt}U`%UhS%+di$N z!edrJ?m|rPVWs5~6BN9A<07M?i>;go!rCooLn~JW90rWkzRhg(qL!`pz1NynJa(`r zTGaX&C{gRnphT^#Dab5kHqpdRxza!yTvV&pD9p9my;1Fb7JZ@-Z6ehv7K@MCBBk-E zVQeck46j2$TZ>y)8(-vJ!Mc1@t>Ec--6&KGwbaC+%L@(@=nY%tzej0kABV0|KR-0)&f+@(c z<;?J5h$SK-(@SgFctWENS!<=w)qrTq?m+BFkKgeEJ6&MAE$+09nV_=QHYb;MjD?oK zOmDc|o(pYrswmq9s2egap$0bbu&%Zg+j?MXe{7Ct%U9Y-@SK=mKs7`MX;nucUUFQO z#kQo}QK&a!EmJy+K*>~(b3rYFa`Iek4$HmGpu|_aXFdH3sFli2dUbmZGx5VQ2}?>; zPgOqN(sx-Fvv0|(HXr4r-)hx{{a6xVtlIfpEm=H`UCP|{e4vttsiKM@e$tADFWEEs zHr1>fJ+hS`(s`0f4OE?>E;PfD7Vc-pqjrtm)!}SjQo;06!F2Xi7Xr!!fOug01S=lY zxI;Wr+-~6<8c}BzDCsg^0P0zlg}!G!{gL(b8SCC_);;WKa*NPwzsC8RFa$2Qeu{CnHna-TYTZRPvuM zmj9&ji~Ogz14T}a-wxDyOXnuV$Z8mIOBmVB6N3a_WlK=Bdt*$x#Y8^=ZRZxzvR+Ha zsoAXzwdq+Vhs@4a&8~#a!CF*KlGc#b5Nc8BvV&vhlFQEqCEG6sL5VTWv8WF$>NMnN z$?vRo3B`VP@e98KB~`Hwi+TZ+WtNR#WSM1JA7I;DS!2Wd=ZF6|5Z@>mJY_(`5wObn zYV4@?;Fh?L&m4PjOLkwMfq^1zrKX%*IwA+xo`U#Fui!{f(ksYPMtTLugOXlBj-N}f zAj=!+6=W9FMWczO3NvB2^#%Ckr0hK(U4IC59*l48fqvXW>$kdxu6R5?ORatc@1rVJ za?r2FlVZ;}uEmumviSEAP{HVFfU53xhsD24{#v#2_X>dgXkI{U-ANLaqApU2KKmG1 z8)=xYR=8ExVJTQkJRuP9zDH|zax(+p8(#5vMrQk$Kt;7 z0uowKR`&+5x;Mbpy`$oKChRMG324~c9liv{29pnq+}4vXmp25g2D1L_PWJ)_=Owu- zpe_|XJ8Qcf=3Q$g5cjgtYH~wWecb8^XXeKzGZ($JSJubr0h+muwK^3Kd`r$S)jreg z6FUv7YA{rJQq;&f;C^&MeyAtfz@K!YM!J!!H4XDYFE2>ZVpgn5<2hA)Yf}UdE1SC- z&fsV23MxuBv62{ayElGEs)aA=AbY{tvO8J3+!l`Yex+#yh8b1XsXY;g0%^vvkJkF# zMN1Fh-*tQRfFM3z%UxlUozspH(6V?S1C%WBqn*lx(*{toWbjT6KX{$#R_SVOn7kx2dRn#l2w*>$Sz!Ql;>-zFBR(!CwrD9X@?jNG#Gs)jrwC zp8foZ;qv1YEr6kmpwhkJV^lW-WjjN2jmUo#HsZDsT~Ms{8^9a{_sKq2tWVXw@fdCh ziUnFP@UhnxQ6su42a&~>ieJaR1-WZybQxuTXn39tcL=UoqqoN2~L&V8p{z_eodn1=>spMCk zniA)IGRsKfTq@BW0`2ruN$%c=&61~hV1dd)kF*}BcD7o`_^$};s8oT;1DYFKFDhLQ zXwgu<=rdQFbHE)se#c`@*9paj~tCRRm%h2`DnqZ zzHFvmtZ5jOm1GbLJqofq&kSK$dG$fPpi_ptL{lw|*B2JKLUkow_-N-^#FHO5WTya-$Y8MBpiZh5F3Loan__*g*%tfkJ2LT7?2Un)uf9s9R(f>odltvl!F(!C zJ6NB4Q6>C(P_h`9Lo>1%_-~-3y33wFsqW^3lIkw&H&WeY=c`nA&jcmaU6!NHJwf_o z?+HWW=3R{lORGbT`(w1|U+`IXv&oBis78TuDYc1yex_mGTL1v+)vV*rzzE@X)n%hL zQ&l?a1}JB+mq*kEkxDCT=*heBw-rfL`_4^p|;gq5695V}2J^(4kgT->M?EmqW) z*|J5emfOC_s$Fi?53?!FVovQam8ke=XMyU*zK~tfcr|YI?rhZ&Qk&H-tn3w*CA$Ww zx0IFK0ZQsR^rJ%Yg9cIt@ymx&b1|EWK%@NdV>be1QZ#n-wsb62`HhE0ToV(6Iahu2 zGPVhKb*xs7)Ig(!eVf%>tc{uyCe1-(W`tI2ZZ16a{M^t`jOwlknyxC;n9(m+jHCZwc%=)Op^)&3O&Ofk1#*puR1H;gRxcL9ZoxE(9Yu*kd#CeYl$1 z$K=55jF&?mT0^zc^r!B{Y)mz^Rnrzw@K;CYEb9ceF5pJxd zPphbQ_veQeJWq1CO$jarfhj`vW!#8)+%CQ9qfiN7oLD|u#nlL3SD^adF@%G3L7OjD zQDSvn>N>K`o~o`ZkKLGO`(=%>~%;7Wtc~s6AIYf^8n(F;c|ELT|$J83m?XoXSC>8YiQp=JTlBa z#^?$8?q*uOdqeN=zTD7w1>LQl_6nN5T6ho`Doaaq9PFw!l!xyKp$Nm+VC*J{B2~tL zJ9b*#$Js-wWdGKhwTK}jxJDSNCRst}^;t7j+e0bdlH6GAY}TWWa2tEs)h+ZCsJ433 zrXS%JM^{3N(S&S8!0|AC2Z^zJy#)oLda)C8kuHTqU%6GNK7GCrBM%$|?G~1Xo>*&Nu0vY%!vD6jOm(RnS>%Od2CbO8yWB z3!e4Wv~i}4v;;ZrKzi58DXHA_b}P}J=u3MYj)-E4+}{|8E6w69;Oi5P733U#qX ztpFvm-wsM-XNywHZuU3F7Qm0?L+Vfu&dZ0z7{hbnf0a~fqTNG^d;A@KzfF(yv1t;k zpX0l6s-2~C6h6t07;57hhs|S9Jx5r5@QFj~^J}K`a+zKrjmRCmY@&V9E{|5r7v%G6 zsJg37vZAKN)4d_AeSX6r@v!QXmB{l5p$DpYXk{R?Uas6)_6r+Sb9f!wcpHMb;_{~?T^CJUhmHPOo`sSU3(%BXjtsmo0R(nP1581KkZax;W!$;KP zM@8uzPsr=rfbOD|P;r-g?Jm^X)WAII%NNT)l&u zALHTPkk1uJeH+~yc9Lk`=C0To;r?miTB;`8+Slk2_K}QKR*RRc+*@V-H5i$92s;;b zf9|<#Gp4jF#!`0=ntKe)ABj}%4VsnJlcHy#!@c1UW-D70G8zt;(|w(Jm=M1gvpNcU z_}5M=%!zFpROd%sAQ%0v^cMI)c|{?B>g%mW(_uEG-D^q_nmkruxPMc{IrjWB6nJsZ z`vk(z_SMA^wqwG?H+=ScS$?nw(%|UM9>E@4SpU^ie{@)Z9{3>Y9n}y&RPEJj zP^pC|%Wo(z@rM1ko~v)aZT~H>78ORyG5D4zpia?zT)0|yRy^c)W&lU6#B2Q>R0k{| z&&9<6Qfxc`N)`w_4eHzK>2^@JE9wL59=o~a>G_~!uFKUH)d))b;Y*;lt9Rc5b+@99 zfwz#B!U9lHRdL~LYWYShhX~~xtsH!mj)a>n+#MF~yB6+;7VaTX^*HlfkK+Gg#ra84 zcd2`u@xQOS_dF=!yc5*R>M84rI~2vet);EP&6hW*d%1|Y#FTy35>qbDk(eG2O85=7 za3d^SiG@4g!eL~7E7WgQ`gB)*H1WGMdg@H{=K1kh#u>$|d2?(0-B;u;iU*XtC~|GZ zLwJ9E(EMZ2{J65@!|vi?cYEa?RB6SrwfN1y1h-A7ks4DZ9ES&@91|oxzMSG1% z14el^e9LNUaqrWr)gQW>hl22zeoIP;G58TM^9l|2?+r)utt#d@9zn3GQi;mx@lrV* zfI-0u=sY$6cDz(jt5Bfb@HndhvPT(a&vl*@FmILWX%!efqZmbQc)asXzp9<;&2qc2 z?vWeg%J-e&8G6C#=*@D+$7WNjd)4Tzyus&Q^GjGe#fr5P#sti7tx(F*Ej;{YQNv<3 z_9#;MxDlO>pM49l#H&c02V&fLV$4b6ajX6DRuq(9A$tDCXQ)vWyg$HyjIP{Wgr8Jx zr22$F^wviFQX%Uw5uFM&mtzf6l?E!#ylcf+CgZs`9HI{{GPgrllk(BjZNM&4nD_Ex z*U`9hx%z%BYEsf^n%@#DS5U^HKC34pU=mckH&t;#gDK`RTSYCl-*K+%-v%g!zN96# zAC$B=T9C}Is?5WcP(snYN$ZS8D{iX+lr$*s1|_cI0ZHsL2V|UoX<>1K@#jg)2aYy|@i97llC z>1uX&!12`i%XT&NhQU6!?-txaCn4%%ftl#LGv@ZMik?+n#YqhjJi^4>rKd&5c5z24 z%*VpEr_r%!b76M1FBc1NPc?S$;PAf%c72ICwB98bqxOKB z>xD}PO^lv@j=APoWdGUO7T>@YXf5F&wSi`EK zeT}N&y8^pD4{{01IK1Eis~jwKj!p`xS>dlqmP07vN%c8hK*ej7nxt0u9fZ;patC|D zq)I?-$;8!PfC|I5@?39#lIg1260lrH(pvY!8c5rMV3}*#g-r8MKm4!$GSri%(SWJT z{^~BKK1SXDE4AX z-Ln-_+^4D(<5{Jy5EhBBg{s!-XWIuO4xct(&oQT3`PvHB30&1 z&N;23uB&3goG|OE7yh96T=2(y$qoQBTjYT>AtQ`YJ%MX@ULbJkDTJdx=YQ;F2?j7A8$6IV=Gx zP5C{?Ld{Mf10w0y0QTUj?h|YHnEo69Ff8fdkg&%bP-aUgWBw>zBUmFns zQ))0d$@-%76a$%~*Mt}-!>Lp*@fpUsVDStWhZ8mh>(?OKxxdMTmX?o>fmO1H7$0k& zRGVWk#>G~T4O-7I65Pt_Qx)C|(?0Q>*e|uAUutg?zm#fzDSb^qfe$n}qFx{>d@rvb z)C%v^&YtYq^<)#B^t%htm1LbEOB`elfI%jG(OA<#@);BDY|!7>FD2R$W(2-BhXUQ& zjmj_lRG?oQ#P@V z)6Dc-Vs7F1NGaj^2R)(qtkOnIoK2@E6vy_OXH{o9`Y_}6VLKP$8BT!F#UTD+jx{DY zJ0!L)UWKiT5GgiA=u-!_I%>8qzQ*bkGL~*&6OV&S*tckCG3hrzx<6V18u^F%b$_&E z8{EQ8kMNMgGs;4tnSq3ktbFsLSKhl9z4F<;==J06i$1Ar!y|jM(mlvlT?6+4v9Ad0 z{5A=EM_A9!MYiMTKiIj5&m{AkuaUx$867ze(-K-&e20{XYx1)l*g&3n8BM0(AjOP|PU%K$*MR+CqS9C&0&^O>psCkc3^ez4f7!4^AVC!7Cy zx?!;srW3sf;>0z4VINj3Q+h_g7{bK2`Z1c*g^!dRvltzL7Nm7C_eq=V4DR9%Bfg6x zwPS>j;RU!6fN@Cm9>{`Vk>2r`Um6?Fr=B?QsE}`}Gyyu=Ql^I`xB>@zY0TXbzNsc& zsV6*POkkF$;(A)NdK4GS(CCtsk#O49jQ3Eg>6dH^i{0)XFPmh~vm1&hYEVna!MG-sQf<*iY;ZWpAeU3rRbJNMA)N1GS z2hl3_>d77wre6PiDRt$vlMr++n{@bJBd7=V(v0f?Kr+Rp(-GnbZ`MglL-w0(d0yPLDx#q;fI)rt~;RNOkNlunw*FRM3WP0K{pK0 zC`N~GLlWI2L5GtmViMyjgeG?_7$CnY=1M)}SH;vug8ZtOK|LqGs+mFkzoe(r0CN8S z^>o++{r`G8#jwu!nVwF6_FVl;PiGM0`2R~!htDPyY@-gg^#5xcb!cvbjdEexg>OY; zUn+!!_}#~#iec|F3d>*DX3y>0NC3^%!X_TJwM^6I8*$@KX+8lW8xP|K9~uwi$Y3e7EK2EjK$BPt{1Ong zr>>9*G)Bffj5J1014JWZeDOy!M%KH}3}!)8AWF1TnvwJWoBM*G{GXfq!bM4%`?|vN z{l7Q&rLCh>?A3(VFw;2_tkFDpY@3P??XSRBme~hCjq!7z7FKO6VVLCOY+=;`zx~<9 zS;N9MA!Xu>t>!(KG7wr?&k6uUD^{%hK~a^KFwfzeNJkYgP4gYTJzxS?p)!IkBJk~9 zHa*t~r;XX?ZL<8}#}i;e*%apJm1^ZygC`1?<2dDM=J~F9f&VhHO#>hHq#{6 z1Qob#6<-8q6u$6nEtvgRE9+!Efi;Zg9-8lanff+pADN`|O=%wqS7B1Jb)-+Kn@{z# zuz=wW3%R}7aLNLQQx?hi+8*q7e9|`c(3ot)Murw+u@*wR>|kxEKYSDFJM0L8OYDP` z@V%7}PaMEV+RzKD)*6bbOw2)_>Wo4GZxp1NJNvmGA2`GxG}@p%Bao+#MhA^>wL7F$ znrmCUZjaYXqBG3W>Sw@ApA?8ubNFN!lDi;zO*n^-mRZ69{DgsGbCqA3vYk(g8+>pQ zFT(zD;_Bj+BKfD7J}Km@$p)C`x5OVJgN1ruO_umVmiVR~>;+$|$|JKp+Iyy6^Gn4{ z@_ctdCUrzVQXg;B&665E`i1UKts=tQwQE7`VeuPA(T z4xU2xzRh(X_fKkQP7)Nm6yzY&+z0yEy6Vg)f-F_a9!t z6QAvy)_jR?O7l5&j{Byxz6yKI+^|r<=VW1aru`D%)MMYFE;@!x!9HowAAnaW9P!;6 zSnlK*#d3-5^Hjm+TFL-iE7E2aet!k>6xN6t_c6#V4ZY^$nI%TZpwcad-+dIM)E!%}nh z5l+h^N}tr&0$lQV!p~5%E4W|+Aw35nor(c-uJbJQG(`0nk1AAJ7}crTsA?9q(vnzU zyTB)t@Kd#InA7mf+Gn(ZN{NGa$nononzdl$wNHVnd?;3Jq<`&e#ZU%o7#r!ARdm?ym8L42@! z&=iW4csC5m64X?O=GAa2DjUy79Y$+#+aRktAai2yn}<0*zHth7ep6w=Pe#(yiwkJ9 zl&1a3!>w?Q3ea&t)CIi-NK6Q$v!YPFxa~#UGvrf zbVRVb4s{-P4~F`%zYvxL;GKkESmp3dg?{sy?}3m}8PJ-gn!pN&X3qQ=yfkL9lRbWs z*z>@NZ*7fJ2gJ5xh1ng@GE2;%mVh3x;CB&sv4GRH2tYU4-FSfpiMyi#1u}Ul;@WmV zxX)E7Wdl+%^Z}4DL-=wq>9qz#yxjl|Vp4QR#&(Pct|ov0QJE1JTn(0AJ;i9@1$x+G zhJ89HD$tLB((}qcH5)n;7L%6(xgV5}V9&j{+YHMSbjJGyV5xyW@FDs>P>@t3>JgS_NK*ZFRbYX}GW4jAVTO-^0lo)C ztNL!RL+Oax7Ix>uLdt*u_?Yfqm}`eggs)JFM$Dk^!o!>PupbpzXkegiRnWJmPXP(%V4E&?ZV8ZK^#g0${kou+D)Le|7Yyxv3wXL&2fiU% z7;2fEg}z-U-#+1&L}k7q3Hs)XTfnrw(Gv*OMM-!;hWTd$e)*;i=#tAfDB2iVaH|VC znA5jjo;~Ew85k=hV;2RsPZCbU@RSG-sUZ|5SpHWbHUP9LEa|LdfxeIIK)0E7ziuRbY{qX4!?$6-qD; zMnX?gz5VP&Bbl52UuEA9oRs z*c+t?62cf&Bo3_2^gLfv1P3AHs7f4V&84zxGpTHtsZ_Q@VX3UEiB#65)Jxm!5*a`w zS;#D%CZrHTDYbIx?TBoeG(&I@LXNt`VQVVcf=*k|X$v}SU2I-jXIrus4>#@c^sA6S z2qn0a1X*+vIXN6>3l2ia;hBr0rHo^a;2?w?Ewvn))?41H&J`Slki(xi@@c*22`)m& z)n2Pdlhbm`<_iu&$kA2Hp~tcXf`brp1pUymg@TI^a)oR4=&@{(;2?w?(OM2YmMs<> zgpi}(4=r0FxCkNFK&>8)WjGDV(^A1f2swUX9ClR;OC=-CBn#JaP_AtylY~OS#sQoU zI`9B(;eQO1U=JvT@gapdJmx$t7a9nmhB1uNk&|Evp2RKztu%!pC2NC%SufB)f%0%l z!canXLZ-tcKSdj5Ck1>{NVgm44^%wiw=^x;6_ALdbC}7l*up+9EgzA;%fw$fttZD!2$C*G1yW zqnrGj;2?w?*K=7`1FrJ4U2qUWj%>Y_;UpAKI|LUY62|ovVjs4my5n?^=mbdT$DKi$u&uz z+;U8AgVyq)JdY%@?G=6!LQfpY7W7k3o)R7UNeKNU4&6M}C)+89pWG7kQ>$OAf#mAu zsXn<-WkFdfUDM9GkYpWZ3!V6qlC^=2WR?J;H3}K?sPX z#*8u;Ns+PzJ5_wsv~s4Rp2S%po-%|SLMX?VF&fC8M_#s(>ww@OgdA;&L#NhrMRH9# zD7XkAS4YNWSHV~+7FJv;=4vAqdu=Y_fZa{ZGwLW{OhOnv010OTc{(H{6GF+|8Kom9 zLFzDe323DVhNz=(j@js;fXldcM*Rd_FEf;k=PB8H5koWJU)-GM8o02_caX@=Rcqj!23Lsi(0^Kr78;h%#sk%b;M) zAl;6fNet|1J}i|`%Il08K*-Zcp_mYem1Z;9x>+P|1y2bsLddm{xMaN)xt`O4gAj5o z*Q-bVM4S;^gpg}3U`53f9dDj=>Wadt3uFWIx)D>wbo;@zmtUGG!S< zWBB^Cv$0+ILeTBEg>Jufu5SNCkd)Kz!%QJ+$dcKeCF~{yMAAM+>4>D5koqXQgm#}` zi0n4d*v-P6pe-|nfsU-jidcwjFJIfPKoZN_M2V=UQ(Sx7c8wP!P(hW#iSYgKAr zFh`y+TD<-W|7g-xA(aqH{fkjLauT%gIlBb3(kq7KwQ2@t0R9>X)vAOPRtlwVyyZ{d zHKCUfNR{3&(YjnLli@C=>w=3Aa(yB$3uDOwrco_m8r8yuT3NO)gYm(HtKcMroLJ6b znoah!%Pamr1qUJIFwVtMQ6nD@Hw6bF=MvQjTo{nig&BwACG$Y*D0?*8?jVM_{Wl| zf^h*`N;H&;0PVTI*o>uCy0 zO-`{0sDOYcQjC2`Lg-^t=7v0P-8nfN?=vOHK?pg#b8%FVar`AX2q8yn;;=D+S^@rd zC1o@(`LHIQ6gPxZ+iN}giv(whR}M+f%zvG9@*dO3R(s#nPa)gAnEd$wis+wnU%Y8B8wgIwz91&cKCUMKdb_NS*MHCOsAY6GF7|fN2qo`il#ZMP+oTM331}t!T@XV_ zVTyN0VpBt1PUAI_i(*Z#NoV;4?kk~+5UR>#(sW&KhQc-JwcsLzT&IW&-n+DOHJ6kJ ziBvwl^G0wHLar>vWhd(}ARpeLh8r{O7Nf!IcKAn=-U?}ikmo9+3`PnJ&>eQFu$Sy~ zCJK-MC6f-!lE*@aeAVHd&_M`wKy3iAjs(OK>UqX40j>0sG_uM9^MRUZg^NNys+Uhq zHGxt`6X=9c!#_+25wG0I3J#e`9`VV5w9B^graM$ukjWoaT=x)zZv1I=HW zX6Ib#!N-a66Dwksup|g&Ytm<72_dwk6r*(HBuHIRSW=lGWB3dGJl2)XW`8pIpR$@H{BIojA+;VSh}{ z_zO>pvs)WHVwCXbQQ(09q^S!P3d{i(yfKVN6FmHglcZq5Gl`VklvWCp4GIHU0Qn{l zNsxM-ux2Ae z#@c62Jb0!oLipfSX9ycU$_wLu3dI{`S!4O*$5&WT3vptU384{Nm>&7KQQp)P7G@Jd zj`Um{^8Tl(;2?w?f8^qjSBz$YgAj5YBn~qp$*ftSmqrtHHb-d9RS7coj&ZmcGW2Q!ZlW*%{?03Cq;Jn7SOhV*DiRGK5kR%;6( z)J$?wW|oE$5BlU@B+t!_B=cq_FQK=d!7Ih`GR`8xb3*9(b(!bp%=4lb!SgUP#>ctQ zbK*hI38Cj2Za{L+_36pZ;W?L!o@;F(gr1XJlz9RE^Q2Gi-{iTT`8Ih6tEljt5PJTU zIA!x%kz5fRK_JvvXdfZucugG8F)0~VL@EiJ;Yzv`duf$zajr-P&GE_iQdkKIgiyi< ziUO`3!ZtcgoCEI?9r{lQyQIW{RGkgrk0$Ap{f%U6D7akoK&xM?f#jmhKYt)s35LSF zq`Q&iu7>8;71pSNNy$tZr?v2w5c*?EoOKMPI$;Wlm&nz`%>EV=T!fIzl5x?RIkpB+ zIkLYrARs!75h08baUd0b!-^+;vP+O`4GEWvG1BVSY9P5N6W<8tNuOMM^3)bLzL~?u zH#6Ay1~^c=@l8ILK-3D!Gf$a6l%;aVe{z0P_E|joWicOv1AS%6!UF4 zJMi6r3G-AtI`$Qo;1}F^DkUr-gqAdCl#ZMPsr`f{ZFMZE&6+{wRK;8|>CW2b%A6gJ z8XAF6Ng$Jh`^`#4!j9Om60n$F92V29b1bGO0wq?J8#8Rd*KEl)X;@d z=5Ql~UBZB3#SDXd*1}`Y%9GsaXsCcOx4a3L`=KEc8AXJ#K`~15oD7u~f!~!tGg49}zsLLIWYxkjy9@*?stf z5u3~|VUA5>$ONM*1=qvBtW#DE5$zS63Kb9yA*-?6#3g}-3|Rx3!tNSpDB3AZVDsRQ zN0Re|-RY=9lN^NIgwXDpj4~K0(B_5gRPn1K*JM#Vl4w$8A&3wPTEaMWCyRnP3mhE< z7a`|f{PGxZD3qhB~7RWhI+PSAat-3EQ8@DOW0eXnhY~^7o*1;D`Z8vhLB7M zC2wPtj!23Lsqy=}h7xAuK87^g1K9B214{*ddyMi9zlj2_i23Gdw zl6_b)$-aZNWbbMv*-y89St8r!oOOnFT!ys+nX3YHLYO;5X0DSkmk^qJIJdc{g}LV# zqRBw~{-Q+YDQhbf-iFexmj>)*4=brS%*7UWwUCN$v&sf4$s7M@lCw}s2$f!Da%pXZ zRYHOT?-CsrbwXH^69>v2DsxDm>_161P-5biVC$^auhl?uQKo#zq)+Z$Cbz%zQc@b! zGVnBzPs3R;UG&FA_)7>qdct@O3K>d;dK(7tK1_QV7c6E$zN3|dkn5E!O3*EX#5wRT z(P5MbVU&mislwquPx@rPC)xHUlKmTFspS14lJ#M8*o$VybZ~Bb28bJ<0YX^Nh#RRo z$Z|uUp0A__$M2v+ZdqPFkZhDIpE%Md+Yp?`y^9bvkS)Q>0+@J=az=*u(I1Kt%HIA1 z+Y4*tGqFN$&O9QysEg#HO!i7DF==9!lgC0M7hhNUlkAKPQh5lM6d$Wzpo)kt*haDCn3z8IZz}F*~+j1Ls-`afKu9_-I1Zn zaIFhN)dBTn2>lLbs4k#zh8hBLWXR;2kxh#d{f(q!B_>NH71b3!3OmQbQi-r8Fqhw0 zDq#TMDtTEXTfU7KzdD{XdJ~!3AXBO)i(WGkJwh10v5ayMlJbNROkc%zVXOZxe>F*V~#Q+z1oM5XQ3;L*)T=WeDTh ziy@3Bek&Sg8U#{UTVtcaTILzdT182eEG6KdWD~Tc4LnZNdoyHmOzSEv%PXw=Sb7`U zzz0g$%za>9Gxv*`P!zTnqoheB2rCFe=-^yNDQ52RXL+P$>>6m5Rx+fdS@V%-7P(@a zuBfe0dMH{bx+!KUb||u7DWRc-RCSQOR4KBIR6fj0D(~7{DsRw8VzW>Zi zGzPn)U^Z`IefX*DudFAJWt;5Bn)V>`1b4gOPqo6#*G5AVZzJV4V?WqFF<3eT)05>4 z>KFtVL>cTe$TCnVS}S@gXlMcxgg+dbTovA(mz5wN;T<9LE-SZpH-vY$7*fDrn3=~4 ziUuXd`(VLYI;f~3Es;*Z)`GzXsRmZ;1%NUzXJHR>7Nv5`S>V&69X35?LQ&)}nQgwp zHbQ9IeMaesq?nNU8M}mq`z1rNaR~l^26UGLC09jLgLXe*&=-zC8YMmh%R4q`(=AWwcm86i|=!sJo6E$4<$AI=6xf5AxzIg2t*E7sw|Hy2GM zi$rZrj*SZC2IfmCMhifa&y%zfQVF3{8%F7fq?j-_%CJkA8!Comxj_Y7k*Fw`8CCU~ z(N>s22+gRN+l(5*j9Ph`p)ZaRAdaU1p^6Zyav`J4CGsI>-x(QmhSH13;rj1*Q`) z36Z)A>4Z>v3Zr!7H29oPXP2;W{>qT%wF<*VNaRTe=4jp>SY;8VF-#<{hn>_`w2J@h^v87eO+j1MT4*9=X3j02@%l7nGA!~d-K{U)507e5#bfkO0} z5IVUrx0C6@$=wY7r^QeHf>$qL0wFYEKht7mUr4eyP)V9CKhD|>2)Z@ENk$KhQk1O0 z4-%3Iq2wcs(h*59A@vz{35(u&hBR-+7_p*vN68L2sE4A->L$!Q8Zu$!OyyBg+fX?P zzWHHo;A8;bq{?G39V`qYga%zc+clYNt90}m$Tz=XN2)vwh+ za=qcMe9}Ol+6%vM&7d0(-Fa9+(*K~r`UA+*&Je$5oN!5+C+idU7I7hjae2xp zb7a(8b_p};14E{)5)7e7Z3)$d>~A)!-aOd@NBzm14;(#&*fpj{uQVWf^oph_jbAJ6 z6vo?30*nuvmN0G)TWqE(_A1WiszT*uI8-=52p#ywY?RN}(o7-Tf&?=Vng@>%a^QY5 z7<01~cDN0RbKqT~Lzf9*Q6LVa!U~uteX>opveoca1t8@ddC4XYq-w(j!%?4XOOg$D z<#Mr@5p_-tBo}4!Ia7do<(3d~k%Gq}FS!&8l-UKzHA$bn_DrrrJ(f44iI9D)P{Y$l zX~Duj9Ayd5RGl2%(1hjM9;lAhid(gb!77hNx(Yycjc!MzhNp zl4ORkvQ1^kls&W_tSFoT5ZI(ojRR$qcIhl#&8xEXN8_vP;q!x}7LYCQ#h1MMl z!$;=eLv!#h82`vzJI)Hn0fL(laxY}u@_Lts&uZ z(P6EAtp<{dGIw#If-)!1TJl(D*ua9N;T$MDC4|0gCN7KIZ;(!t=^G?C2_feW##ym` z#|U}nNuDo*1s5UY+DH0|7{i+?W>OIsHc$ybRdP#*3Qj`Ed6;pQhw3^Ka?|RKsbq8* z%dM6Z^MUAbm_rC39O6Xzb!4@zJ{>1W2T)?-7Ga#Vb`ZkcC%GsSe`AU#eR9uf z_@L161a(w=T%I!U#&IDhL`P13Y}*A_gbr8lkT6w9Vq(Z(Rb2Q$RZMtXggP=mNzy4H zDo%*%%Mgkh5Rw=b5~o&$gocJECFLs!YcBl7KttA_@@5f~^%w*%(zRxHF?#LvM%t;V zXD3h}q){J4>OGRwVICe#P$00$o+Y@3zm|iyuo9LhROiE#;GGy|p!_~!R420QUu&Ty zH`LNquNJvhv?@#ls|&LaPV-Di--}UU(BK;snlR@dK2{KdpdbWMLHO6Mbr%5)*XtV3 zuaKCS_|RNhpoEE(Up9pZEkSy<2q6HjiefteXywlz7TeH}B(Ax>Bz0m`T!cy;AFqmukCQJH$R!f)ZG{m)1JiV3 zk(*X~B~Eb7_zA8df@|&%xUftl_K#CX#fArkCnm-x{_EHzi`dL&vC;aF8%-DXZPKx? zp(;1E?8+j+xLt=)MwAO;IoisM!g4g58H(3_l#phjC|AoFLJ1QX!UrbrCp&3yk~%#0 zCt~WTV+|^w#}r{@wM}nKG53Pn|4(RIA~bE#t4YVWd{5VjOxhzdX%|E2$!>;JfL1Yt zey?H38PIBmBEsXs6Qe@m{NJbD!io$g6SHeCLukc5hE#y^wjwGXp6~FGScwA_ovYY` z0<3wbV?y}}q5KF#&7k6oXFZOPn1VLgM}dA?KTr^GV40TwpnQM^68piz1$_go{Dv+S=LQvWNOi+Qe{d=Om!p>TG+NlEZ71>?P%nA%)W;!s0nOTV;4?tBI!pyA9 zPynE+40Qp7KVfem1p}(iP$Zyg3?%@n$S-kl0`p?_ky2Y0GKoi)r}c|ubZ%oHsBb(mA~ z`??tEXTdW}uEX!C0?MleA}36MBX1{S;v=F$f1+cAR>~9FV=e4YWtPeBb8I4NG#_Be zIS%DCl?BarL4%p`e?uxMYzt+!p@j7)k&X%+Me}Aq)ZdKc3t~d}5hRdBvv>yNmIOU?^vN zBH1+$xSM}`q8ME;(Dh~L=i}2-*o!Z8QF)vI@*Ly($HY_x@V}RmMZMae8IPeFzz`Ot zfefht4PppGHJBj`)ewfTC=F%E1JE#rd;pDPC;-rKh5-E6(-Ps`3T6X(w~`_BZWTi+ zK>xPug5GUoQn~=z#85Dx%?x2d*uoHi|9aZ@U+{gm9^cc2?>qmG`F{Gp;CqH1-}egN z_x;d!Adset#iW?9T6BQN|k{HoHHaza%Pi}cL zW%$TUV+J>iS4XO1Lk0zeghq#}{i6DWcYs+URY+VIUJVRaCx*l&#YU-hSyqWxRUc8|(@k!xQbNH*v0fy$8 zFpLvL*n2Y1^6IltkTKj8WSLc}kQkT%2pg=53;{3s@INFeDJmi^JWR^V=7hv}oQQ9m z5FY0b$B>9{DKI=VJZeBVO#8>d@IO3G6-zf%ec}^Aa{r|8#F}y85%KD%5H(QAY^b3E zW$`%AD9Ns>qLNfBG+{Ze#>K0d_#79}__+97)@w{tB}EMhXX_y0VM(f(D9BN{V{QAZ zBjQ21On1YEKkpzLvc(Lp84B?%n1dRtSt(11PgLh{DMtu#`ZXyQX0`JnfjQ1lR4hsi z6b_MAL3du;Ka_XtH{`e@81eysib^R93L%YQFEE5p)+L5ifQEtr29j@_Iy@pgQ5D}G z@~w{wo+v0Q|4Dix)c+~e-xTU^3H7%bas*X(7;*-b&Ct(i|0J}*=ZZAW{>2bF`+y-8 zAaeF+Bp7^kgi0hfO?)mtv$V)b!zI66bV&W zSWtpG(W9g0vG9P0+rxtfSRUONbMECVyo__OjbcJ#dxwPtg}c_RAKE+2*`<$5-LUZR zdM=?MwL==X)$QX_&n4X1C9H{uhfLCd@K7~8{bKbXEWBU;@J1b)Xs>7sC1cb32U`bP z)Ph=0TFVr?!yGB_YSA9CzUYOIveY<*Okc8VdPAyOc&+YIyC!xh zhoxL6%0bUFbKJ$N@Xo<9AJaNSuKFFd=uIC&j(9$bPILr7@ z0xmgg^Fh~>tQ>cB#a?1}wVvR8ZcBb~Bs;L~AUimZu6+49+E43ppj5iSG^72v_L#T* zw{qN-%R_vJ-Tis{wd;dqM?vj>!1Tc%=`llSKhADx?MJIHVQurn*&p4^dZt$t34~YV z*j;q?A3?_r&o8scXv{1!n#;q-ExO0OPn9Y5MID)gI57nTWa z>Eh)xzq}wHv6PUH1&vK9rWvwbD#H-Q24~Xbe!wM2RL&?iw6NE^f1iI5A-QE3A(dWj z6?0w9&wKI$y(ceF2l|8&%`2hqs!R(~)?f&|$2rdYz1OUB{tMsb_MrY+dUe4Ky~%}9 zql~%?VJT5CgtCl;EN*>%5hKqrV&pl19JAD@B>*q#q<>q^+?jP4=_U+eq;W=)+p1Ng zQ_f&4m2WwNx{qzp34y*LKAtX`PAC(YvkS_fBfNzX^VF-KF~T1&b{FHIEsMPD<`-G= z6eCNXBF_Z)FVA~8&5_WWR!kp8$e$sM5YB<-A0aG@5F&aY^DdD;5heL}4($riYXjWK zH??P6=rfgCEUQ#%Q6`mI^i^AGd3^GVEyW09OEChFBVpMI3JmWP6dDhkbl5^xfm_5L zdi@N_bu~ZxIx%XruPZ~myyP%a=LF+H>oXXSaK?vuj~k%0d9Pb`BXiu<5h+EpyBJYz zho0M#pZ(f(BC>oIR z&m-+D9a&aTk7#=qdi0C%2)Bu8{ovZsUW~!W9Cz`mJdF{aXzk~=AT;M0^HF!#{tNEEXj!|QQPhp6=q-&=99D_ysr!c&~GCnNuxXVo& zUM-^V&dG6CE>DiHJ!0e#%U5at^0UgJ99RFham+>*AX(c1No z%ct%G^_yPFTthm$i!s%fSnfxDzLO7FV#x>2!{zEbVub%-`q20N459D1XD$!lVK~M% z!|6EhlIPQ@>-|B!vbl9f*xjG^p1eTs$%}$|Pg~c}`;)?Z+_b0lUf2FJIqq`1`SHB4 zUt4myE&1i1b_*TZ!Fjk`eMii_D@-5Sf1M%BJ>0^jwV!iB$?d3FiSfX-8JgH+cXRe8 z<*HG|O}*l>b6w5PJu(xshs>1g;0Ed*QTN|W3%d7+A$0FvF3re^4<=0D4vq_rOpK3% zrHrtkBI@Py%kN)LW*1l<9C^4DDe&;o+q-@!>@kSB`Onml$jnxV)I^wGRwusR+A^<;7Ca z@p$H!?-U8lcZvi_qrds_6=PbEuY}Mi=gqIY{4WKJyNhOEF|pHY7==epD>qw?Q3kn* zMUC9Vf`a>a3trSJFlv-gi6NALJ8uhA)WjnOA=AA3?LAl>uBUX#Z-|2S zucOYV1@bJZ@?c`n9QC?aJ=fLz$`^$V%NK=Bt^+RWO{lvz(}LlKPwqpIG2FP>SAV#J zT7-m#|Kwn|zFuh!b6w5PJF*hJBP$E)od?r`-Zf_ky~8cX`n~Ie&Uw%lX1$#!R4Zr2 z0JhL84sPT~zKja18*&`G)P91KH+A`ifLy^4kSkm~O3II~Ez^R0fkGeW#Upk?f|@6) z*=ufL;W6R-31LL}_d`1BmDnZM)t|Aipjq3CX~C=wVFRVwzrMmNTNqU8Gp?Mt#FfI%Y1qnk#LBh~bkkDvtka$+)7bJ2P zgGA02G)T0+8ubkmLBh@L+92tAJtD_lU@TA?Exe}TGa%c1D1fl^s2$Tm>#mb7#!^a7k4VZl0pt)Ajl!k zgEI3Es&ul=XcBnQV^)b_OHkZ2bdZX7G z#t47jv%45CZQH|r&o5r&H^z(n<~&@kz9Yu#E7OPZl3*t%jQ~ICwNTRpYZpDK;ONmPyFXu~C@L6DiVBxkhy%?Lwqmo?LUU}ZIkwU{*PP}!Gy$_{`>+Q?d&XPZB@8Nh zs!hb5ih=gWRSo>tXN=v`FVa&v=xNavH5PK_I9Ia;-+vo2$GmuxDfKTrD%9C&>cv%0 z%2^G$RA~O7noG@29!TrexX&g}e(aaw(P7}DEhQ?=Z>la-bWBN~h5H{Eudy!TSs`#l zv4`gAy2tu$qTlwpz4W2(F~Xts#*f7xm1(xW*2B5Y>SXcbmwF|R8bo({c+t0N#mE7V zxANoXKRO>cH-2^W8ue7e%;&3P?@Ziqrt0P|H~Eq4oj1mP)%UBzy3GGRKGW{<&ThRA zR`KRa6rCWdZy;!RKaihXJrZ0LCGNk^FHm%21^}f6H?)_PXUuATuH{w$@gTeJ5 zKdf4;eMO6UTwc}Ut81OwG^9k@ijXcIEk9Hq|E+T7EWp}V-Hwxdm=arOdQL4nLAk)r0dWJbU9ez`0U&HS%Zf!D)Rjn7~K2aUE zcgL+gC4=t7qR8un zuU{(cIc1skWU=8yo6S?kbeJFYq3G?2OCP0w*--gWP^?pYgOq+xr!Kl0t*E|a@wE?s zcIcBf;Q6|BT`R9wJB@NsEzUd{owfCD{TZ)ZmwZUrd@k@y8{?*>%e&0#+N7mF=0IAt_$!^D7c-UnQg-qihTY*tq9O3o&Cj~#wlJ9tIPcBhJg zsxEKcW>s!e|5anIe?f9`Q=?e#G#(G`|I7UyTm5mVYw7V@Z-f_5Nbkar^_1qv!rK00 zpV#?}_}f)J^|g7=@ALE4PXlaHeH>R!yZ>x^*O&t>e9u~6Zl2aV!2OfsL1{&uEKZ+x zxN23ug{|xV=-gsm53kQ1n)l&$bGZ#x&6;)XNrx?!<{!Q`^vlK`_xn_?bbI})Uv-ar zueBHvy|TwpestOr_2S^12bK8oV)D`H##Kw(o-N{FxT)#ig{xE_;&r-AeD&mQGh3ys zxV`P+ldDzE{}VfmA3xexZ*|SH&4ut+)vhjl8>gDH6o0n9ZbiKL5 ze6d0MCwqJkcWV^AXa4bv77kPY9Jp@sxV3p5&%2D>v)*vd9^E77=f{r0LoQd{(%=8- z?%4L~BGs+9o!l;d+&On=u@mVHTb6WlTQEMbOnDy9ai^=)DpBieo9i82s*Ubz-{M)b zBPScjHOf?%_ZYuw@SeN1yr!GI3>didT#u}|frUPfJ+n!%Yj}3!5j;Qnaev>96%EVp z^V_%}{Hf9S_)q-!v`dk4M+~R@!sDNQ^6Ar8TZXHbxo!XWVQpyJv^&o|XHPynCa+8h%!M(hW=6c;nCew} zSLokYCPp2THZD}Hnl{~Fe#?Zq#ntBQVN_IO| z)}A}v>&eXJ10u?oskEcJ`PTa`{_|o+oqiR4CTYm6WnJUb;@sMd+7z{Tf9sLTg-UbZ z5&Zb}W&PJ1e;ePLAD0J2H8|F=tO+ky2fSl$y4DPPQ1iEPZ3=fC++s*r#zUv6j+^+g z^-+g^ww^ojX0c_|xo&l5OfBlv<5876b!zi=Y+J*^J*QeX+q5w2e4XN|b#3My@VYQ< z)7M_RTb>&<`rMb!oxKaWhtyxy`PU0CJ5Si|SF~~a;AyuE#*9v{JbGNo(W-Xb4qgA| zc=Vn-#H{?u-D~Gp>gBpJ$!+-q+h2QG?a)2)c9tJ2`ObQIEwpI|e%zZJWKu1|emFm7 zJRkbo?&+~xZCZF2FMYLpvmO0Ygifx!$N{+N*UT|I1|-eQ~k#9BJ;& z?d#KX=;fG%qQ!KN@7Ar|{3bKP&n@}>#-_D<^}jb{`ufU`s+aMbx1w0peMKCyy0`y! zXv_W$JYF8BrnfuocK%rAuidf@i)EZk_8sNiF=cvPH-n^MJHzMI;`Pi8zoI40YEEr3 zH#%l~gDrlupD%Doh#X`QQ(;BSoUYwhb!a)D{ae3bFPA-U9#Epz-KnmekGGqfBd&+s z+F};p_1$4r+ZHybc)fFQ#IMosSJru$J|ntZk9CFDr|6O&I1wwFKtN9O_Sdu+Np`Fi;xZmr_SFT8oUe&-t}LgtN4OPJrx zHEjDsP18<*bwkhd);??{xG19}Au4 z@wklncC*%lUk#=YI2TiAX`y$~^(+!PRZOW^^TBSnyX#7NeLMU5MTw(NJJuN5VYcDb zlr)Qx3#{w!sD3vl?fmMhuj*!&aWhIbe)zEKC9^>--5YkwY|6_o&%aWiF4oz9Pi4d7 zT-;&!e`-Lr*Ww{BJSuZ`xn{nt#N8vASCoo3RQJrmcQ;>Smw!aV;N zyLktQXlJ6GS`z52^HPKzq=a>$Qks$O@on)`Q8o-gI@S~}ET zR3~c3;tCh0KD{@p)XL{g>)n*1dA{_UTw`>?mQ5XMt{UFmqTi<5OBNKpITUku-C)w}Gq>mbB(F8y=RLes_OZ#ZYsDPS^Yc@e*OVD|@9#|$$DO%x zHq5kh={9vY^;2C7<9_aq4Vvm$_fjc--s8b4J>lhvmz#=r?;gAV(ReEFFY$gO zzh8ay6wg0Gzi;6EsD+z*)r;=gcAl=B*&Sxb7Aqg^&-JyhpOEs`gbsl`U${TIc5bQp zxVY5_w|l(3PTu{t=DWb*7p?#Jv*ptx9ufR}+rk=!X6(9BDK_A9YTbIy6?Bik|NU+I z#<|bi^XKY!w-TrAJGHnHI`safjh-3pR0->Yl`+2+<#zKUA1{ddaL)CerK@eY9ct5T zcyMr;$wyrLFIM&&w3*)zO}bF|i?Xv5&xbyW(r0&f@ZZYI1wY2M`Pi{^E5+Sw>;5Tz zPQkPHypaYK++H+V9D= z2Hrg!{4QL)wZ_=J`yXTCPxAXujgA(rJhbNA|LObJVsDQ&NIU(Yu<3Eeun#}jHt8(e?th)Ehor)eM-Q1u0a^$b(wKl9d7Cxz+ z)8!_=oHIB!y`Sd+n+dAYqrNt>x?IR_daFa_8Yr6>`D86>_)om8!~K!74mTU%yKL#i zcQuEfu3y~bOWln-_POru+v(ZM^yX%*R$N~BLCxhbd-wVRwTQ+|KFVTYBEhTpBs&pG|16-~1}o^=~k>de@b z-Qk@+{kqgVwr2kl6>f}rdgpNG@Xb6

DsPeE+&$vGf@u=AC>|*80xW?)MuETDC>^ zK0nXvx#8uOmwQe>?D^7ZWsjd&#O=G%I%>fAF~d~4_j$hfx2)Fq;Iay7y5*kJ-+a^g zu!C*dFthP%(nnWnHD}4L(cy{(m8)zVce3oFooza1Z?>6q;n`vP*~i|6XJ+0_j~ezz zdYW?F#aS)3ogC^^?qkIFB8E?FPsS`CeJ8X|kM>PAPTt;BQDJMy*!9_Wws##e)W+4} zT$?pl4*XkvZT|5uGEh-v|69+UJF2gp+|OtK-&a;#4}U&3hB_u7A3I z#OjNAwCj`(Tu%CP%fgZEZdB!RI-EQo=dvrL)6d%Vw((&pxo_z7kRyAiJU>0ED%b0~ zv(aUzLbDGzwa#{!waZ7;X9dk?ZWs4YO8mq6OUm8rb$T7{@}*n61=n-no70gklS(d+ zelTQqki+dOwZD2FdA*+Y@ zQQTl3``3lzHn;xB{Wua7=kqSRD<3A!zyHt9 zHVHhRA5|}Q=*8U%?W(T&{(4R8ihFkbGp={#&UcUSIDbt)Q6wtLGrPw7xf_m0pHJp| zdDYh$_lI|^TXV#5-cBAkS+{H1R{gR*1&=vcJ*@gxUXK_JoKWJSte(=D3Pw9tHS?PkX!m z(!WXp)mp@zIa#pUt1>>a0k-`i!yTHQF`@F;PrbZs?P5p0HILza6{BlG_%-##(wvlnGEj%OM^0@GJk3YvepZPg|4){4QPoDM8e>_^~ zmzTU=IMu+v{nJ+c?$ixRxmBrIuZATLd%Z5=HY|B*hm_U}7FVCpqfVg==_Rwb4BFOgj(5i$sh<~Dn8NEvUM{(Q-u_P;XRXNWG;9v< z?_6tR*6UE;4Q35)pBS*qefig?D^!_NCY_7A;&3zlQWvk%Wp=pr@HzF%iYJ-%SN3`Q z`f_D++bu5}cS=gQQfp<6A~$ah?a;bs-0#(n#jh=5ct2Lv>PXX`DYY9v+&;5jOP^i? zH%RqHEiqA4d9;bw`}}$3^*KN1_2TjNOWlt7c^xqL+-UaS(x}tA`4x2SMVE+?rK@j? zIlF#ex8Tf}PA$WdJ3JHZH-AnqKH5FF@cXAVd4BzJp#1Z_hOUh(7(80`K6Gf2lhU2W zhKUtTc|LQ#4WkQ}ZPcb~D_y>avpbG|SM%wSgv8%=_}R3t&*RGbf!q)4jAJq1JsO8E$Be3fz1Vi8O3La?#lq2}%dh#H>s|2cmV_fSr`KCNv{IE$69Q9sdFA~@ zUOy!iOG$57;_wHqhmS+}xsCgZjc%g`i1w487v45?|dl(jF?YP#3?IE3pB4?cCt zWRHjIE5}wT>uX;=rD~TtpxokF_vXj$tDF`(Xa5bO*x|)5{#usPyL{gGD5LM?p!y5A%?hkq@lxNnOI#m5*|717$7at=@2Q8({32Es|5(cHSk+LMz=&Gmp$|SsSH1G< z)FRh{J{)ahRXi>FV~E>QRll9Pr}~dL(PrHF(CdY!PicC^Pi1LwG@|*2@RQeiJ{=O! zcUkx%r{Z5*ySl1RKl*Fpyf)?P@qBF@5ZI&5vRYpJocF_Y&;5rsdGBm`Hh~}c{h#em z|64w;x5I~Zw`!kgF!I#yCbLg|t=%emT1U&NHKTp&%}D;mF5%!y?=ojPZLIV90ng78 z?Ixe~KCD@?9NOZ^&(D>6T+3} zhwklJy3dT)7NhUaKjyyU+01Hcqn%Y7eg5;=SzbQ}9;w~q$f=$)V{hEP)9><7FK*wi zr;k^d-0e`U+XCYY4Tc~2vMOQTffA>?q{g23!#|~e@$|;izSXRn9IN8=WqOaT{_Wj` zMKi23W54z(`K3qT;K&kxm4+YcENL^`ZpE!wqsul+ZOoLMKCW)m1!-ZE#b1Y=n7?6s zQS)CK4Q`imXVw$5PtP_F*>&vI0^8ANE4SU1#_4(aPxAX^ZTgU}_Zs!B(67`>RmjiM z^XHYfN4%bxdgJ`0nHk%TRQso==i(lA=XpJ%t6yEclF7A}-%l5mj>|uGdsbtoh`T1= zDwXv==lbVc9{=fs16@|vm|wWx=d;V&-|0M^>)W$2dcn?CrzW=x*!| zh|;#Nu2#MEyMfBsBBfVYkJk^QJLaN)(m?6%yZ3mda#IXH*cII&4Ggtt;qCK@)7{CQ zRpn0NpH137-LZ21vav7TpPSMCY)`kPQ$tub93IhXny;5i;8)?7v;V6mD`8E-#ZvTY+i$YHjnD9+tYV<>4r1L zHRf^TcJg}J%47SGw7HWmS15e+e44VxH1&p+b&V<)xoT3S*+Add-cv>_aXj5S(8zW0 zgwm>}(zgANyN`?BlpQ~~7R%G<=eQO2tt(KD>y&wKE3FYjO9OErs?T1aZ%j*c2(7yh?F-=P&$ckS+W=ze$H zyK$Qm=l#-|%ilR^PLtkNEgIcFdAxp`had0o{s^C+(d~~M>alM1`kBLO-miZC{^NdQ zCSEK0D0aE8e;?j&J$8Ton~Tqr=N$Q5D4F1JBuYN1f ze?Bh#V@>GGZcAT0=kt+0Y875?zRzLx`+HA6J$Nzy+&Y=SvCe`yf>e_v8P$bW|zG9`NdH~R{9Qbd{8{GSrhX&#+Uhd zT8SG6j&*Q-5mmdxyR<4h2Xp!L>#s8(uG-j%>*4+ViidNpqv-^K;%F@^iPuhEBaEmRu+7X=(EPeZPg52B!u29&K)) zvAXuV#!s59yk4Yted8CMR-fT^p6!2d-q(Q7rD~tpcgW}5>Z#m+zF&;faetO97!Z1A zMp{qqPkoIZe)REbG;T_juRXav{K)UuGdyW`>089MYeD5)XBxCPW%>Md@~sy`#E*OL z__}`3)tSRL=pMNpyqs-!996Qr-;Rph4%4-#TUXBLV|;ad!=^L7R@irHW9G1j2bZSA z`L}IUHZ9U1q+w>+x1V0_;&Qk@%6|rK$R5+uV{MT4j1wKdEWc&r?>Fh&;LGky7tMP* zYIaCz!<4;g(cV#wAD%i@*Xl-%!Q%&}ytE11k!<;PlJ~i4KF!{Z&2H*$xv<0U-)oP2 z<7ZTMOyd@(0{cveEjQ7_vPSc}vp)A~RYm##F?JqcQWRSho@G&z!zcPRLhrPyX7K->U!YVz*z;Rm`;K)oFRhrrn*kb)o`s%k%zR{`{0`m$qg6dE~F# zlf-SS{Qeg;N^MS@%{@LPU;p~gm#SFJjsMFRzF+ly;tjd;wmtOAn;lZ^&;QIbr(!;T z?dZAM2eyuR=SakH?%%r~cU(dr&+ysBM_xO#rQv_I(|CKK*@YW)YqGX`x2fl!+x^FX zjpx&hvlCsb)ayc~niKnFeei`#F8}ghOOAd!^T87THBRSSv9NE_Y3;K;_h0SLsh)b$ zrd=mTUT(H5Wty`aCf#n?tKLUh+Wyu1t#-#&9cgxBT=isQ=e_+vh2bMQ)OfjM%~G!2 zJ=eCZ8$J8;+W$4afk~npz8rffW4fv(D)ekIeDICNapf{sC^Bl&;ALgg{yX}kcNV_g zyYi@13;GtnxH);orSt!*e=hI8a@^zhtHXcs`4X4>;`z(@p1xoH{o4Ppy1D+nG%n?k zgEdyq{jYvF-<1k)WUZ6y?*aGo-S6>9&ClF?De~sJ`;F`7u;zzGzt?!>f3@e1t71Ff zJ)EIf`g(V_=lbpbeX@G58WV4?I(@(PN>92rW!RYyf4yION3u?R=+bx3pT67Y`sH#L zOuW;y@+W)q+|T#@&~v3@*1o!K?4r~qM>P3h#ogzXYsgH3y>ezS|{B>|fu1a=-Q- z`g+!`T{XU6dA~a3*pp*<`KK}`xu37!u$zAmD>iY^f6XHq$HPOq5B=fooA>i28P_M~ z-MBXYxn8;Ua>NbU_DIUTt^TXM>6Ln~YxeBk&kvVs^S__ktvlW2gYE71XM28WkF~2F zU00$)Qg_~W=dG&d6Gr`tcJI7w+5=Jams6u7RlAxmP%m1%_?)PyajXpK+pB2r&iE98 zRf={VV7`lB2);?2KAR97^<(HG3Pn42={UGsOk+x-_xVRhous>JD>|UF`5J#K(PtE* zquhl@?Vo!r_1~{Z@A;>VJc%MfiXMrMs!b1?txD%h%{*1jiug#hp*s4%TuYygjgE4y zTATYU!f2+*qqEFk2sV@+sG}A!MIJ*9>N0FlOmFq%0zRpi`Lp-W+a3lz z^ij0vDEb51)Tfp|)jS>c&>tR;j-o$)O;zaHC`GTZCpkQBTyI^k*D35tkpK^UpvKo{ zPw{=vh1*F9&pYOp^2$wo>=Amb@yZYgVPp=V>m{h>W|KM#Ev>wcb$@X(&6tljVlb!RO{E~>@e4*G&5}thnaikdr{0!bQJAb>QCb&Nx#m5PsRs5 z*%IK%4o@p?=Z7R);y2OO6kEY@PGL zPn3?m67<;qagb# zcw7xTkN>$+*i#T5^8m6MZ2Q+7On29Z{(#i|jzK!IqNC`~+tU&IUHPwa2ivjrDGZOR z&&sX?7ZnQC=P~7({LzNTf*w2eBJkue-K6@Q%=uf>a2D-xKj%Bl9=*6oD61Ge)L+^c zm7aTXeAq*?%dg?r#tz;T_L!w4khN#h>t%x;+h^KS(NW7x5UqOC3f5g2?sExv=$87k zW^b!6;sSlP?UaOPu`$s4GHcO0#_so*t#c`Os7ln%qFN7UC>dzSdP>9N#(ryWv93Xn z%_;-WUb;0uaUZ|fGMHsOG)tqSQkx+1OsHNhOW0Emo)PAjwi55ZX~KPYaNw?5UzW!;8F}FYKubPkM7p`=ae5ugna4swvOes|(YFJ=K-x^-WE8hdnivC-dx4 zlfs_ImFLY=xlV;WHI*mL%xkT}o?6OtE9J=!L66<1bZr(L)!hu7_IBxFH_W+!su0{? zPr&2$SD|`?UaB41Uv-q{a*@=(ggs9xPu#WFa|J!NKXu`G&~%25oo}QBJyqQ`VNV0q4$YsS$M%OlWoqW3=?`5k6}>ji{6m!r*5@hJ4y|Ji zL;ZPLd1(C!dTf?CR7@6nZtj(tcjnz-mi07-2S<>(SM=qb@f^!d65uh*vB}C~ZfP{- zkN@>)ILln>8PC15nkS&0771v_EL$dvuF7ckE$x~so^#wY3229|eD2pyYj|k2r?Iy< za@t&0_-o_p8113Wld&AmJ22N>b*K6gw&J7&o?{keBLofFVbmjtxa6&^aL&^~Qfdc8Ra ze4lN7y20bt7CLsihU)VyJonxg-QoGi+|s@%H(`_MpwF^(HcN>a`&;HViTU|(THbMC zPfvIrGqAKPwxbH`oNRI+){l$ICM;1Z`eNfO@OB#Jo&ht=gt(l z6z+5X1b7C(L(fF0a!W@4xFX!nKzQiNmijz$am>iD#~cQxKIQ>jZ+w0JabvxEUkrwa zRv3EZNb1v%ggryxdBEIK)*CN>lt1hlng9>YwCE_BMRY7rPPyXOa67}{p{p12d{rWa z5$^6Y&E)8)+~$_H$?c2%7WQD&_n8}`41K@(GdcmDG4RmpO54=5zikNjXRLW7I?5Cm zqv?>mbv*lP96WT*OLcDcTFJfPcE-a)XJ^{}xjH(Y{q>xA#J@%qzh^=MJQEY(nFP-R zro(i+7rMUvy>Oo=C%`i$0iLPw+`B&065yE*PX=>KTheL0;+cmt%p=iJ+08A@zH4jR zR0)r3COr2(E@r`#+uYI?|6G0EJaWJJJR6=R<~Eu6DbebM*TVgo15cr7^E}wxJFq&f zSsH031+S6j!t;>1rAKI;pA%T;?YUqcJnlL??K|854SVJ*&%6PXJB2+9l;=|MT3>`c z3zerun!Y!}o)?to_S}bF3wstRPrLMY3Whz4m1o<$gXzK^s<6IJ2z!<$z_SdV^`^*l zz4}|*%FhMcvFDWK@X&mwIhJ?XPP4B1{bfC7={Nnkx5u2WjHjHrr8Vf9 z1<$?DajW4m(+6A8>V?fjxVxPf;fZ0-!C`aF!hg4C4Lme|=#gCye4H=rS(^aQO9}A2 zoB+=&@Z5Xs>)^Tf*k4UR*7^iwnM2p?uY1>LLjpXn!;{tAQk~j(}q3oB*3!+p2FsqMqHp{+5d&x*{M90D=#}7_UwYk zoV0N5SNrM+vxMAT!`<+7GPjA%&o@6Wh-d8Y!c)QA5}o1Z3UdK_cRS{kZ|Xz)i;kZ= zmok_sdADZ|JSEL7J+eHuN~N%8FFdWyE!DaH#Eb*Np7-H#?IbJuXH3}hK>|D`bp zT(uK_4NoXf{9``}k6RO->^Iqj-@Q*yC7_+t3Gkdzp1b?pxx0Bd@-;jo%`L5)*i>K4|m8zrp_4cD{j!uKS|Q&&y5zjc3ig1kcmvmPXS$`zvpS+xZrr zrtC@j)$n-M%qFYw9;;v$NM9e@pYP2h_8OAh^+j9k;x#pJoQzBPKbCS8couA;LHG{VJuSI`0kNDr4SDky_EF^cg za}}NksS&fSDZIcekav5onMb0dXuYIu*@V_+VY}P&i+SXJo?qc{eV&zTr-ANn=Q=#+ z%)rx{dof4Oo68sPvDYoX!IRtEQhok7P@(npz;%oD{0|hOO&&O# zDeU=EdA>-JB4gNdLwP!yzr`2!+*F>w6Rk@Z_WY$hWm8Ye8ut9HJZn=n&KC68`TP$& zd(FU8n0u4o`=5D|?Q3W~x8QO6wB@U3i-bM5;c@#b{yBCBo_inf|AXh=$Gcf3%>3D6 zZfTAB_4)H#cRMb6V@-6FIbmZvm48TqU^~{6C;^`6 z1b7m|lhh=cJCXR`cR{cGL`U7*^B_FAO&e6}4o_Yf8t!wF1bC9dQ;ge*9yxG(xSeDP z@Fa()oN0%y*-8z*-Zk7#3V7&frJ2=!$LLmJ&qMI!q+8=TJ8y$InC_m3DdBmR+u2n5 zAG4g_?MVesfA(~nmESaXw+Fv9jxr}UJW`}<%F$s@8nkoo`AqLRFz-F!b|#H|`NMEK z=@Q^cp8!t=c-osRs`H$sSIlC3_qZ~`GuYfFGoJ0aH(U&RGQpF}+|oKe;?i+*$#8c& znc>OKo^-3nm`n1zJz3zHWZIy1j&8az+0N|X>tk8r39hSIaApWThs_30C({OvD|6dw z-vryS#~}5@{$9^mB9CtSJAb%8Ic%1>rQ>JgiAN^{J$6la*m}(4=1%17>-)y$2=vE# zFazaxtn`{*&|~{U)r*dz`Ak`F)_b-=I4ifxO5N+`)44)fd6Xyf=f$oBJvJ*ZJalbL zTdLc0O}X#h7y01%%G}Z#UMul0=A`F6c3d$k>vqGehx3K{lV5pg>|sv<<)QZ;1UkC(c&7At@QdJnw|#z8Wzp{$3x@h!NO|(s+}|(g zu~~)TdD`SqFM7mPTN>`qWAIS@X#1u{)7Y@52t3qZb0<=*XCvM1NJdgkKd z?y(nxr0&&zCHmod^ROpQc|QHO@8Ynh z1UyfgHq4#KW3RnaH|!}1Pipooo_#u={*+2UJEarQP8oQXaMmAd_H7CGrz|}6*fX{7 z;YY)sa`0p|9@^$?Jorl3Qy!iw))MJn_EgWXrvg0H%&ob=jC?ltgH)jIHe zX>O^GHEuMYVn-M}$2|#;+wXKvsS_G|U3lo6Oxw^DjoJp=v16|XkGo#oQnIl*PK~5q z@2w9Hy&gsV9{bUs=6LrWyDu8R}d*5 zHshhK|ENvzTq8AuhmJ3E=RdB)n8x8L5IE+voQ16UKIyN|){@X&j1DXVmn|;xU~PNE8(mGsvUY?W&cptK;@zLeuq7Sl!y8g_Rupg z|NHLzwVrt+>=~jw^d8Qj$Bt_#Jg$aowpKCM&qh);9H!c#8V(JOYq;`IpMxHoMSDCt z%AHf**;mr!+?_R2wL|k~L?FwyLo+Zs>LqhaYiqY>rmYIkpV6uvI#-Sgv}5=C80Dek zH0ZHeW8t~?oFAv!p+1idWZ8Dc!_&?5myW8>&h>geICkrK4jy{#%iQ7jYtg;nbJz*+ zxa-Vw%?8JFoKA#i0ikAVdgbXA!TQ*&NeO6YGCcH5gtj4hQ(q6aGX)-VB0--g9yoj< z?3tPX&$I-1ro)qzZcW~@G1txR_iL2hr!(Mj>kmB_o*vj2)-zLi(j0oXWYA;lGYg(e z=9aF|Jk>B@K9}Ni~n`( z`S7$ik5gM8XS!f^ov)$IqL~vN)z>^ub1~PAB$dLRh44IK9w++5(Qi+O=kp5*=+7c} z+;gHG_0ks#XVF8>A9U* z%a7C!XRUyTu3qSM{BkP}n(J`iA3G0M!sF&Dtv@S5^JkUv&^jOXtX7^TiI*k{dh9-Z z5uUHO&%dAB)-l*0>sbSjIf+!#kBVxE}t<`i>E3@9DUr$oCC z3MzE}A16c{mE5G-%_&(!3ca%6JzWQMaW6y|(NXm5$b0A>UDMdjd1#f<%KDJU92pNa@F{jm6yengcq}C zM2ThPD^Xgy1B|aJxQY6*oOxwyAzhMvRYc+!OE|q++Zc0w3C{bz%t@#%gQBDjB&lFX=gtxsYS_4 zPbbXQNvP_qydg?kRyv9@o|RLgtYO9Ootg3Ooe$a5L8u>C*&s@?6t+L@MTuqQgec8f zv03xt%^J;~E<&whWs@lHveH?UZ&*1k$^&$Yz(z*_9c@ugkbesXJa&%7g_O!6rEy5< z5>iHmlsO?~X-HWgQnrVbBdn~Gk^aWYV^MC_RZMAzSYDJ-tdtYwZB`nJ@)IjhiISIo z&1<%Xk~Nc+MxtzC<&Y>xS+RS0W4x8W$)4^)d{C4Cz!HhpKj=@;44T-r%XFYKAENtA1O z3@e{W%Ntp-E$@l9<*(V3NvNvn(6D)C?^=G9m8qi8-`=HdX_WKOUlygUrFintWt!Pu z5~U_9Ekx6i!^ptiU%7E}llz6JMGDKZHQMJbihwmdQtk{-+h_~ev?3pZ7&GbDOyKr}(Gzlrsg_PG>=_g~~$4Y-uF0yhl~R`BX?r@u=<3D?$}u<%lS?Sh493$D7`jJ=cX=%gS(3-eaX` zl$*~NSt%k)szSCuv7%IBB~FyytdtaG0V^d$*~dz0QLeI5N|aoMBiPD{QiGK;q6}cA zm?(=`DK5&Vtn8JMUSY*ntZ2LyOa52{TU(*3vhtcJ9aw22%5+wai?W#&n^iL2tmEu? zMEd*(E3ZpCDT~vTCy@olnty5 z7UeQ4w?%m*&bE_A`qQ12E~0E?rJE?fu`*ATG9@C|7K<{Hl|`cLV&z3q67$|#BT9W% zCWx|ul}Vx`FBQQySCkg4ydcUVR-O>$TUOqavF9(1X3Pzp@jJ#_=dSD-Ce$`ox=PE* z%h-0F6{Q0!OGJ5_m5HJ}Qr1$FMOn;B3Q?}GvPaS@m9v!XbFX;&Jcm8+3UyggedDDn zm$xmyCDdG2-W25qD@jCIU%^tfrO#ioQd1Osy@#>Y5+!Fv^Ix+)9_5a~YOGWfr9CUv zMVZ7(6;WPcrLriWu(DEmc%GH2;)$*l!FE7AxmmGQ9UE_bDzRs~P~BN6BFay!^bnwE6<6N ztCnr2y(m3csUylZR>q1lpmqdX4^fIdVU=v6v|(kTD2rIBFUl=eMu^g}P6XR{QC6^0 zPn3^XsVmA=R-P6m$CD9kSwyMBN()hzveHMCYpm>(8fK`AX3Pz(##<7{_uQd8d+G{x znw1rzMAx(Jw34jWtPB<99ai=W^*t*#{hfHzGt{>&*A{9nE6YXM$;va5mA-+c`is(+ zl~06P!HP}a6L0!K_KXwi4l6T6nbFW@l@lfJQ&t%xN_$qOi87Csf}-qX=flQR&3>u##{LZo7$FB2-TjI-%xz*+dE7!!+qNVkGFUtF@q!#5DR{DsN`x#4J5v2tyKZvq`l^vpd z%8ISw_wm*+(#p1+L#X|%Bo!rjYwO7i9r9?^7(|Rh3 z@-{0^h*G1M_0$vPH&(idQm41|%oSxgE5C{IF)LZ4+(@JPSn6R>cCeCLlskQ`Cq|Ur z{jBn+D8I5&QIs0}t>;Nmmb218l+**Pr;#Z2S!pTCMpjyjl5wD=I*8Jjm7b!M8)QAb zMcKnjUs3W7ww?i^%wlDjD1WgsQj|VJEHzq`Z&(>8%BG>#GeeY=!>sbWDBrTOQj}uD zt*4gkuM@01CQ6YJ)>BNB_gE<{O0JRCQ%RJ4tke;u(J1SwFG|#CtF#lP7Ax~a8N$jo zQLeC3D9X*KoMUV|ZA6*ON=H#Hu+mSI8e=UrP?R@V87@lJan>_Nlv%9ANPo7Dx1Qpn z)OgM+l|{M2%9ElDnP5E)M9DwVD)U8Y%F6GeyvR!aC^z=@lPpz3lm)D`73DT7okVFi z*;0cDKdyC>>d8 zCt07eGFX&SGc2`QlyR(7m3AJPX+2MivYM5Jq8w)BPf>ErveXc1c?v7l#8dQn>v=(x zwyfL`U2$qkL(K`xP~JKjf$4bxS7x-TOi_-Cb2ExA%X|%~5-G*w#w7}%w8oR(d0fL@k-0I!wOrB-Y^zhmGu|n&B~057 zm{#dx1^tOF!TVj5l5X!zap|%L>1YAvq9X50JH>gDO?RFWZieS|3XX0AL_QMA^@lEu zbbmyV{!Df4l%vW&Wd4^!6jvZoWbgEHEthbfM2?cZLzmHdTpu_kww$ThB}2?|RBSme zP(U#?{K`C@&w1jC^PwV2X)bf*V`vvN5C_aY`&5a_3C%Xe4&*Zik8D3Kkje zJZ=X@in?)Ooi`6hVna%tC~l-BLP{y8xCJs&)+w?klyQpmr7u)9qScb56e+itC{~;{NTbRM}Lo9q;YUlsAVRl+N7(yw$`(w_rPDe3C7-6?Udogz*t zOC6*U^l(Z!x4%S*quJ8e{48+&p(PxfD7Z>#Z?yU1aa9#XJQ+eBQBaMS%;Te+C)O<- zqQudeXoPvZm-Cb;&O`MIEmDikr#LM)W)sC-ZbZf!6&|-MBE3a%RUIvg+ZWG;l!;C$j<8_=THkLi2lyaBCW1UBo9!|kr?PU6%%_%ZhMUfSIq4UVT zs2@^jp4ols*39uvDdm)>of1b!C0$WwaY_j@ENr6Sh$E?m^Td)wpPuR?3NH1GM-*9+ z_8Haohn~pM-_NP*6?TbIf+|Mekz2Xjx{Vprc&G6cy@a~E{ z=f+H@U?G0b_SN*()?Lv86V*@RV}HxZ)IPd52TVP|4_= zlfx-^RmA+qE7*hdTrjEg$nhnLD@G)p^B}yw`Cl@p$kmr9?r@Jh>O3-v+)lwcF0JWd zAyM2gM3JkMT;efzu;nqgsD`wh#wpV0^iB~Eoijj*Cj*qC!~EY-U2FPezqiml6j}S~ zsXtodQ_A$ehnCQ-QOOf2+RsyT=Cj|HU=ADeag`rF@l+|M;E4pYUKWa={D)fRKPp*m zn1V-Ty&@E4&H4D9o}QY>6g(l!K1QXRatShI)3G;BTT`gvepYl zSv0QCCF>Sb@TjcUgmUBZRNkf3lKI=53Lcg9y2_$)d1@3>@Tjbf zLQ!96Twh4mCZ^y~S#JpC#^tGtOu?hFHigFZjAW%-M){ElJSuCm%A#?3>T#yvQCVAr zqE=~KUrE+rrr=RoTZMAt^3=;r!K1R?RO6bvsmID>?t`(BqfEi0vbL$LfBH4c?Wsh| zsn?MRJSuB@DCWxb=aXn%R? zEvDd6Sv!QHant@fELmrnf=6ZT6w2){PerewmLd^&RMsvvF4|v7q=p5Vf=6ZTR#{X- zPt{`z9+ma3%KEb0$EnjvR$r#zQCaV)tnIOBH+yOhQ}C#)J)mg)r)_5HT9?a64L36d zkIJHF6n>pAQ~Q+>o=QSb>C6U?%6eaoD|YPEGM6N)4O8%_tPfOHi{EE1@zmE$!K1Q1 zRO4E?Dl#df)bN>AwukVjtdCSy=B)>ld1@C^@TjbhLD3Zs&8XE|iU+9dt8ErMDr=w0 zdawNCtUhZrQ}C#)Pe9RGp0aMWSiad)=b3^>W$jm4uN@oG&QsN1G!2;z9+hq{W4E27?By*$iTH8Z-RMzJzYtAqAl6q<;Q}C!PdaWcnin3^bJzS`20Z;wR6g(>H zu*%x-$=~ff)!-%DLwHoym!Mn?M?H{zi>Ed-1&_+2SHS(Tyz|GMA9yO=%Qg!hm32go zYs-lF9X&OODR@-YQI(axQM)3ZI?fb4D(e_1cWpDFQ>xvmWPg=?#r6;$m33TYrJDOs zdrvK53LcepLS@k!RamnAWC|XYby8)~8s(|S*4ZAyqq0tc%3&Xl)YZ+XZ-3*4HX)&7FM@dul#Y@Tjb_plIEot>ORX z)z2(7%(ULB@TjbFD(gUjSEhJsBvbIHtn+GIG&fR9)_JDjQCSyM*3}mVU-MM8*K7~r zQCSy5S)HVYYnXyZWqqTv{y5kopQk=$3LcepNoCP>R7c6W&J;W<>sysY*HNCzvB8cD z9+mZ-P~@QNs8fJk^&ecvRM9H7?p;9VBZJQ}C#)A5<3A&{H2V z1&_-5QDspL+e_B3Ou?hFuBa@kp{H`wuV~B$kIMQ_*jcjfFa?jw`c-974Lwz8BUQ-! zjR*3mtm{J2<5a`blGThUcvRMJLb)1xYCKc$sI1>X11o6g(>H50&+0wX3Z? z^*dAWsH{Ih#h5Xf7t10Qchv1^|E4yLviuu#Ykt>A9+h=NWpzzle6OcoX9^ybbrV!F z(;{W<%Kd0LPd&Vek|Gg!6!jOVROT_F>JP}U%u{ojf=5w*OAo2lCkwyzwx?2TCM^@f=5;3mQb{pE1p=q)l;uC1&_+QEfn>IvJOesNv7aYS$BkTGs;uZ zTc{=TSKP>>vi=8(uJp{E$gz5V&FL;#MVNv|W&NwNo=du+kEhx*1&_+2-DI!Xs4q0G zXC-SMQ}C!PdiB;{>7D=QQaew*#}qs&E0Itx>x^Xm$P_#(D_SU5Lr*EuG&zo?MQ~icGLwd1J|1!4y0yD~V7v zu3djbXZBQ@H!-XTJSr=x8W*ji2c?G3F$IsxN~W^*cl^4Pr`~1?9+j0GR2tir$dDTw z&o_~A{lpYJDl3J`%6)!G8c(&~W*dV?Wzl=l^sB_5$+(U(1&_)~sj_HXo=UOZX2GMf zQiZZwNLDqb;89trRTiCzJT-_ZcvMyzp{O@>e0?cduP_CV%A)Tk^v4%n5qataQ}C#) zbZT7m%2HCN}#7oGX;;z%Am4n9`=-Rb!G}4m6cItWgU9z4NuKx z3Lce}NhnvtC>hrdrr=RonT4X`YvAs})jV~RDR@*?me9CH$+$|sZEFaR%F3#;Xk4CZ z&lEf=E1SxqtFM$Yt{F_hqq4HAtW>*FMSJQLQ}C#)94d=m2~00p1>Ujaf=6XNtg`5p zKu-;33Lce}Q)SWIm>@O$kSTanRxXwGdb-@FJavmHcvMzyQ0`Tcx8G_z-&1ir?6}}j zS$R~}UyXlE@2Q?l!K1SBf}-`1W>nR`hPLHt&lsLIEIGB?<0&RZ&2d3aP0OMuE@7$OTLnfUW0sr>&q3m(dk|}u9xXKDec~^IjpXI4M?@>$UQxfD+S>-^v*-K}K?2^@wDR@*?d6h+1 zU!HoEDR@*?1)-=fbVc;O?631o!K1P&3WYVQ&6FrlW!Xb5ndfrkQCXEhxw-LVt~NF7 z_r{a^DW>32S(Q~*RGN8%J++Q0cvMyuP{HTRp1Q*nJc_CcDy8X`MHQQ?> zv%#aNYM_$Xha-uPKGeih+xJ=-9z|6L72L~tWiO|C-%{|XYSaMbj+Drl94~pQK2z|h ztjC3-c4;qvBzt)VQ}C#)nnKZDZdk4M98Vo&3LceJ3zXZ-v;s_)tmGfqalxaqYO5?- z0X#LFDR@-Y6QF`CfTu1q1&^ZYfC{bvo@()-?IAphdJ+^>o;F$mrpo?0z!W@cTy=$_ zJX!%fHSZ%d6@f=()dNN66mut%p<44%_AeWf|Cx{JHWGnHWz|<%w{o7m?x_^}ECr9s zY5*#DqVDAn5FVA)LMR&76tm8I z>MT?6sH~QtavQ?jiPWA|;2ZllJIsF~PklzW<{O5|qq3e+S*0H>xWQAo4_OKxmDLJV zaQ1rY7pCA*RBKS~nr+V)gWvVk`}A>Dv%#aNHlR}2ha-Kr{yxA{OTMr&Jc?=yDz|yq z+=*Q5@mN~>S2)Sv^Dy0-Pot1WRihm!H+zqbX!wn%@_lJ3cvMzNHdED5?V} zSB+;+fAE>77JOy1;89dZP_7!SI~VEYsU}A(1&^XS$+*Zt^YCMthpCQQ3LaIB&O*^V ztazu_m!6u&6g(=c3#j0kXo_S-AG2BTsI0Cki_S!zdWR`^R8}`o!84JkdL6e}@F?n8 zP&6jm=vvfM`A%3B9z}JR9+HF3MAKxAI?WV3YFs^pqC7eid8*hcn+1=`>Io`~dDz^E z%r2a3i~YN|DyuiB;OzC(?XN8bkD~g3a%ZBJ zYya)xsS4*T1&^Zof=X;3jx=BQ)^na3cizhID5{@~iySn2qowkDE?5d4RgL~aQRV6E z;HfbeEd`It8Xy!oDC#027+8)BAvWA7S`bkzD zrr=Ro!&TPyE`Ja8R8OYhQCTBGS^XtzCR6aJtdXHCPiLR`9tw zJc=3}qP`1J@ThT(361NRjO$D8Av|haW7W85e|hQ_Q}C#)aVm?R`EHb~nD6Xx;Za%R zb(VQ|x~FO|1&_*lPG!+mUPn2&yb50(WwOnOU4LwzvDR@-Y3Q)lsdTKaR z@TjbnDvN69sclTbqq0_kN@@oXq4$fHl^XuS6g(90U1&_*F3yPi-5jCUn#BQE?lPP#q)=MhukMj#& z_S8>I!K1QX2Iclw)vqQ*dn(^m6K^(nRMsmhD<*xp9iD2%6g(I75psH`_s z)|NHN3VABsFBnz?9+kC8D00xVo4s;guFn)aDr>V)RE=rhPfO&f!A!xUvbKP7uLC@h zzs^f-C2KiT@Tjb)G*j@XtT#a=Grco+@IF0HW&YJjW`jpj+dw5TkI{_k zyJhzoPc>%>9z|^zidxMv=<<3`tzZfsMZE>;AwtYXm2V@}ILj0~sv2(#MU|)bn0YGI zbu<-$M`gVul*>9US(TZBM`i60in8eaHlFIm6g(=-soPn#&YCD(eGK?nv34Z`Wl{y~Pwfiuw@LgC>Wn(IeMizj^8$Q}8J2BT!O} zi~pE!;Gv4r_R#P4Uw9PtF(`KpK+i_c3RRLRcvLm^fpXQTIHBKQPjzDo9+mZp%A)Iy z^OCiMDR@-YewCGZag`pP`iv=fRMr8NMdSKfvi`>uJSyu`m9=kH`RksF{lnG}9+h=a zWzo3KNmeJO;89thsVo|or(R$R9+hn1B`7z0bNz59g{KZM1&^Y>0_DznJCaX$*Zx&&8d0(v zc3kkNY8(OOX79Nx{R?@jK2z|htfQb@HR#>xo|?lHJc>F7D!u6njcsG8&DlM5oGEw| zbzFK#W7skC+m)Wmdy}+C1Rh150F}W!X6|5R+a+`3S*GAo)i^0xZe{b-2BzRqS*Jj` zYS7B&sjE!Eqo~uMf^)-DaevXMA`y5Lbq1818zs!j=Bd$4!K0|JLAklnGvk+&-LqWZZZXrqAr7?8q#_B;U?de^;FF}Mlu^biuyrOjmxxY=BXJ>!K0`jLD7*y zTiM*P>pgXhDR>lh1(d7&kTq3XcTdJY7^dJ+zYF*!L`8759Q+Le zJSyu~Q1r}~dO2%y?SmEM8v8hB!J}$;9h9r#CkLw5@Kj#R7xT@N41<$a%Wo6sSS@5VH-cmhmv95DlPyNjlJSyupD0fbwGpwhoMBARj zqo_Nef@fGyO=SumMg0$yTMsM8JX6+FCzygqQU8L#Liq=CK+oB^==6b5w1Gb0oC@LD1 zJ6CR>-+Zd4<}wA3q7o~L&aj@k$`m}R8V`VSvzOip@2O@F+8)BAvK~}f^c$Z+Qu+6o zf=6W~QCalt##336*erNdR?<+`V9Dyw6g(;`naZM99X++3DR@*?@=(?yS$qFt3Lce} zLS@l&b5B)GYR3hS%6bSC%?;X)S6tfTMai1N6g(;`rOKk;(0S@4Q}C#)RG@O39CIf! zvgolPo+_Bk_7EPGm0D#zy}Z&Jo*KavJSr;dA57{2Vqq4F{ zmKhe_m-3z*UoDw}M`dMIS@a5wr`9k9kIKph%B^g)ZVZ#GD@?(ovgkWT{fbSW|MFDT zly+S3sH_~I=sJqFPhX1d-BsqsLZ;wRSr4l$`b@E>erF0Em6a0|otMp>$ewjaTYBoL zRJMoks4V(kR6nkqH;Xp+)F!6jQCYb`xw+Bjo7*Qml`6H(f=6ZLQCTk~eszqedNT!& z%E~KQRKuu0YjvF{HT;YzcvMzCm9=NfyD2^OcpBS7cvM!5P?VLdM~WenC2JQ`@Tjc( zLYX^}h1aI8_EgEVHVYn=RREORUzcK<_VLu~Ou?hF9#L6oAD_R+Qw7r5EO=B_K~Qdg z4NrVNtEW~o1&_*lRApW5x9ew5WlL|f;89uh9lp^~ZqDz?_F<6}Qo{vI!K1PYt1Nma zp{K4f1&_*lOeor4^gE6{axB-*V0#FU$|@q1xr6u4d1?()@Tjb!Lb6sR1Ap=vZum6g(=c3@BF(y2kcY=Pb5|@F=P*s9-fbb%ZH+6je?r zDo5<-{(-C~vf3y~q?iD(eZM%$-Q8U%vmyQ~Q{LM`hIkMXM-n^lsZz>yrDp8*)ETDWQCamt1& z2IYM~RCD5{C{kSLnH3*@Mb z&11&}j~Z7~q0F5KeJiP_Mll7C%4#N*%bG7)`9D8L<+VM8M`g7T z%4KDctTs%+qq15G<+41rfhl-Y)-#~o*}O%bZe>SF)?ZA)qq175tPj5FH`P;J^4W30 zqq16q3LYt*`jRPl6x9Y4y&_H58{=ocdfHP}V{8^YifRjrev?I8+XZXadulsV@Tk{d z+ktZPaN2U+8ldvT9RH;!-gX9^yb)m>%Ht2OIiPZfI9X2GMfdVq4z^|}-&bkb8Bn1V-T^;B7(wtf6_ zPd!%1X2GK>-wTxc9ml(`Jyg_E!OFv89@4kscq*o_ z?IAoWtFKVBmme>%dh9=PCR)lAJSwZ7Q07h~{~znmcq+?dHVYn=)gP35M&G(^)qg#; zkSTan)&P~2ufVk!DSg0tXJJshuk*s$lDzkBN8 zlD3ENsI2EgS-mA|4^!}{tO+WMK7H@0l%;GIJSuBqC~LH2J;M|{Dr-_G%Tup21&^xy zWKgyzkw}sv?_7Q!S;5M~qo^q%YF3DXM~!Q0Xk5?9xbAQd;Zft7rp86zv*f8trESmQ zQCZVLxg&+XXUS8en1V-T%}`nNJxiW?mnnEu)=W@t1)%R)^3?yBf=6Y|Qd#spOP;Dy z#*PafRr%*Zxg&+XXUS5*{RNNe;cQUBBW0pgejI1Pqk1?;^^hv>sXa`=qq63L3Rd1z zcbI}lWzADrRC!NTDr>6&kII@4Dp+|>jb;iSm9;=+QRO}LE>rNR$}a>Jth}Xym4`=B zFMtXjUn4?C3Os6Di)381_GT`a^Un*izwU4k;ZfsStj0C-(2fJ1YFy6t0Up)EC7|4M zhpF{n-fpSjxZqJeTnfrPcbGnR&8!O2!&f;A9@WETs)q%3Mql*Q6Xk6W;Za%3K?R>X zc?7Tb|m?6g-OBAQV-jZOW3DJ@p$? z@Tl4Qy7Z8!)EjOWwp4KT!lS5-plq#(GoRcHt!(h99=-vpxN%eEuVfjNxu9HC7Oi4i zgGW_<6DU{t3uVfs@l-3O;89tdK?TD0e0ra-&FF zPi3rOdkBxJ;T{F3DmXVh z)v3PiAv}sY3d-DIEB(fVUp;k#DR>lh3{drZNjj>@k=(Hx|$aJ{#Z)k9YBsDwvRXF=KiTe5D5f=7+(94NP!lV*FZ z&C@cj$kVnpc+|Mgt8w-Hv~+Dxm0=1Vm30ABa4&nRH&gH^>LMt&m(LG8S=CdoFa?jI zz5!)!uzhtRrmLsEV+tNs!%LvtdU(1+E@P!NHCTCgRMxkkTn+m-dVWb3sbS7WwubPi z8h!`L&5ieFoXPH~#!SJZvc3lutf8l-Fa?jIE`tiz&{OX*1&^YB0A+5l^&h^yo2PCu z1&^YB1m(`KxnHPstc6q~uCc8KJgOR3K)Gr>S$WlRPt9No9+mYIs9-fbb%`l>6!kMG zSB*ZaTWt1JlaY& zS=+U>oB!-1HT;LO;88XF6_l&t$(M7z(MMny4S0A{r+Ed4v zf=BJI+o0V3Dn9+kVU`N+FL+ee9Zq|*?}w%J z)CH#CQCa_j3f9n5Ra@CCcoaoXuA`%}o8HmbzMC_%lc&})1&^YlK)F}UrvCH%MNd7{ z+GfF{YM2O=dtUj!u@{v;88V949eAz)(uY`VG16V^#G_~ z4Lw!5jU5*}ih2-KaNY3Ka;D%>R1#3Zb;DCh+uAI6R1K4YGB?<0-LO=!hVZDYWT1lU z#(p`L`*0RKs)oshGE)oR#_y?@n1V-Tr2ys5mCKGK{;9TPoni_emGzLyirIXmyQkW= zv(@hnL?d8&JRn+1=eQiC!#*lrxYu+~#In1V;` zuQZ_Ct8?ofK0n`5!Tkk~%1R5$9Vzr%>1SllkM3Z52#=~^I#6!T)9>0mb&e@`R91RW z!QZucs&Yr01&_+gpt9(9ZJt`q6g(;`BPe>tL6xW9a(XIJCz}P2%F3j&=yz?N>dX{8 zs`8mZxn~^oTTV*_D-VzAVHQv^rgucfZQAu+f2sUF&VonvFstg}OIu%^?WsbY?YQ7k zS=m4ZXRoJbF$IsJvV+QFdPi6BvnzjB*;BtW1&^X~fJ$o!+NunEXtAf-b+J8!N7e9Q zP;T~aE0Z?ArGhntM`h&%6`*ZA_>!~43!K1SBf^tX78z0t8>#1E#!K1SBsjPoL=w8!PiMrVy!lSZc zR92le!>@U&4pZ=`to$nLY~AS6o|?lHJSwXID0ft*FIf4ur%o^hkIH&PWgVPzE0L#i zK5NGXkIE{jvSMy5D(I;$Ou?hF9#vVh+ZQjWl*EamI}^ZcvKGy zgK{&9{)%EjnNh!U7CfqlkEtHMUTc3&Pvz@ws{xP7DiX>nAX$x=f=6W)Rap`9?bDtb z#}qs&t5_&2zhrG>3LceJTxIQlqF^&mon;Chl@$vr#;i0{{dt$`Psl4-5B0FsfJbG; zsjMG2o_NYrg?d^F9+g!BRB#pbRPA1tf=5v$C5w7E<<2j0p6b@yQt&9M6e#zK^x5-U zZ+dE0A4|cbsM4U^jH1s;d1_-{OTnY6QAT=5>)}5!?_KuP>3)`iN6q=NpxlbRyKwc@ zmI}^!cvKI|fua?FszKi__@eBu2M5?JcvKI|s~*1ItKw)+HDwAOl~n;0)sWhyZx{5` zTBhJpR7Fr!3EHyPTs+-Ve=r4)qAG!+6`RJ@d)BTVU1eM~2ikGLqsCQPjjP41Ih8!M zkSTanRuxdedFZKcnSw`ARYAGeZIW;PWuvD`53)UkM^V*4xp`Q$_KUeZ^*mGXD5^Rr zx0mU&oSUT@7np)aRig$dcU4J$_tsO74z@jnM`b+@%2k6t%jv29Ou?h5nxKN8q4U&k zrr=RjEl_T5T+E*RXHTUZVtWXWqH2T6&2yuD!-AW#NHtn81&^x66QEo*o+#NcgQt!& z1&_+A1IoQ~hQ3+IQ;mn(9>SxjCqcREjZPz98}6wiOu?h5x}a#ap>|I$*tNz}Er;1G zcobC+6zwl^yfwQ`7f+pF3LZt(2bIncwAGk#W2vWF4!2qGD5`<6?W-)op~$f=8`~Pl2+JQkq#iu$P1DAv~&wPpcl%^RJyUH~!!(cvKG?sUFf_ zpzu`bk+u);sI11IXfM-NrqHVgQ%crQrr=RoO;lEk-)AoI)CH#CQCUqTi;kAck0s0M zsV7F+9>SxtnyIX_Z(l#}sjW=Gqq3TVa#xkxvYyH9sT`wi7Cb7eh02JO&i zQCXc-R?+S`c6jRJ@iq${mDO3sMOpOC8WlLECr9s>I#Z} z*G5^N-@28{Q)MSw3Lcf!O=T5dvS6#Hl1;J{JSyv1P;PF}x8o+2{dJltcvMz*l|_Ha z%TqCvZ5BK#tA|i#SU4)vNmg&B;89sUg`#S#9P`$*o?6coJSwYKXk5u8>szMaQCYoJ zR>c#Gw|c7D6gw_>R8}9M+_)ZMs;!b?$fjXHRvSX0zZ?Spz`1-}ycjo9&lElJzfB@TjbTDl4jd*G!&jFx_Usqp}8p za@U9Sel|}nX9^xg4F=_2Y0tWU)k05QWeOfe4FTnz6D@wV+^?Q`e1`2IJc=4B<8qbH zCDmBS6g;XL!-R5s*;A!v+AMff)^JensH7D;k7ONX3Lcd;LS;?Kx9nw4HJD|y;89s4 zg>vIcBUzs?1&_)aC6pVNry4wOv*1x#qlI!==_TtZQ}C#)F+x!mtpJ{CHQQ#vqq4>d z<+9RB)Sa>@2+bPuBvRBwQ0~h7?+Qtd+vmWQVCx8G4pZ+e+>sc{DZk9$BAq7I`!^4HSLvH*J}k4;|>U zu5cE43^j}@A2W=6(?Pl4WRc>j^z&>D$)l+mpxkQ?t5#O{*;6H$B9EaEH303-1XaY` zr*@y5^87JRHDQW8I%^iF817femDzTCYA93W(OJ(6MOnW!-QC1f`!-#yZmOp!-tEf9*bzHghYlF#~`De~y7g+fukzHL}@ou^VR zur(x)p#p2d3!vg(6Y3d?)&%lsY7r9j3L4^^CPCnW2it4mxFT8TvoSR zKG|nQEwq&X)S9!;&h2UV3R@@Q(+J*c)!k;hPh8m7&tJdF~MIKGP zbdRhwFWAbHM~~}eQ1Q>+LWZJ^Jeqn1RE&Ad+=;aO>1qRV*zIwq$YZEL<=26F#Mr3a zhtodsji=f%MIN2?DySGkP(qzUC(3zh6jS8US?fW$y*#corg@@n)T8 ziadr294Q+>nSh9U*Od7_1oJ=I3M{gfCy%CH2SvvNZG~_5de!%^uAyinkES->BdZH% zkw;T+fO0F_mB@lMK5Hgtkw;UTK+*d^XzO(Qa$xOU#}s)qwHZ|WbH3Uqo03H{N?(C2Wr{q83e4VZpo$uTdXsMV z$31-ycQZvEowXfQj3FpXUlm+niadr2%&50O(~C zaTa-OOMCva&+nt1aVFD^-`Dvfw?iJC{sE}?kN3ZsB9Ep%1VuS+d_F7la=TB-qp6QT zx#vWW+!$ZS^F<6r8+kPKF(|i=EvPuqys6Nowq%Mtn%bwb=H8lQCZMAxGesUl1y-a_ zK*hfzZDoo)n%WQQG1Ghco#n7w`F`+OhnXUep#m$?0Z@evK_gFld%G!&>)|gXea*qpbD6NP`lU4<_sLmEtw*Z&iVpWj3KB#dc_{h6nP94Sg{X- zihn-8V<$ zJ@RPk=sl=;Op!-Z$3Vqjjk8RVM^nc^xp5s`d9@%p?Dp7dJ1+8Q>I5ivLe&LA@I!=Hp5k8siCMBC^!Ym_0UqThnqNyJUZ(%sD8#y-@ITqmlb)@ zW|2ozXYN7eWQshR`uZN!<4lpqP=QtJEU5U8O7n*%&}H&y>YPyF*BquYMIJ*1R;}}( z+^V%R(#1>@SHpEokw<4;02O0;5a#MgvEw3-roI7{ zpQ&|!wwvy$dQ6c=QRV7bnHoH~sTrQD#&)L2qp9yexvS;x zW7@vpsjEzp$54U2{5`1n_j0DSwi@Ko)Md${e(9^_VoZ@o_wWZ$g?LUq6;L%T6gl|ujf)E07W2UO3~aJTKWAl1EclLDB0rv<*5j;*zK8F-0CtT?0j*J)v#bUvHX=12;D& zGDRLu{Q|0lg(6QB>@wL?Z!tw4P5lbW)iBBK_x{h`dB90hl>L7WP6P!dOE4U`peVv@ zxCF}1=G{wsTqfDh?atl}w>z`U&R!4|LS;}C_!YnH_oPnwqKu0e-NSzfDGXZfwGMAiJMT-fpC?9_dPYd8 z8g*vVE06SSod_v9h|#6~DWvA%J2moowm!wSh|#6~C8W$AKFLzV=u*!{*m}+7GA?2u zOXl4_C{Fwl0l zpV0*GXsmog?x6R29)5zQsM_dKbZf=-GpL^@Z!SuG`94qTDwZNfm)cH9?aWg69}bnn z@30gxy43bUiaaE?Z{yE><@GR25u;1Zbfv;^J;PGO=u$5cQYtRJRqpp?nR#M#sU3tA zjbCI-9xARQS&A54>ZL+T#npe)qmL0GkKdP3j$cJb$w%bvjECqf6~1q*Pq* ze(6D-p44S5MT{=>GFM9Z1VrC#Amh2uJerHIj`UMZwhdFh$&XDMQIsa;*Ea6KGnDPnY~-Gr1mt}|GQ7+q?2 zS1KIW1uR93F13e{GRO5bmLf)%+S8Q^$Mr*&A_h{j?-gh4dkLx6qmonEWJimAM9Aa! zEJciNYi}WC&c+KYMT{=>DpyKb@NDgQm8=`Y=u-O#DRVXsVJTvCseLu6r$4{lmpog2 zEJX~YeA(E~l_GC0e&&~Vc~Uu+B1X5hzmQVd(EHv~Sc({3>eWKZ-1mNxrHIj`UL&Mb zHuS#tN|quhJj z`snZzmLf)%I>?m@XJePI%4`q=DPJ}Y7E-;OjpD0+@opmI(Z^E6=(gSrJUFt1DisG6n-NIkx;jdVV7+vZx zSBlu;Z|+{}N$q}(jEfju>Tpf!x|#c*<4GOOQpD&|X;&&-qdv@1#6ZfI!)75xt61bs z`Hbi1c(#7VQpD)CT7;C!p*~AF=xZ`AVsxoiS4w5hvsGj%VsxoCAw`)dDSb4*k)?>y zrDnTQl#QcqJ?awA*3Ms-9ufm7UpD3lspBC*#JykI*LNm$JWCOy+nOt+R5tW;y|1zq zF}l<|A$2J1;0+%tFVC|SF}l=zA*Hgh&mVuYoCtX=_=b#&7(K2dgcPl%5HWAnx6bvX zE@mlWbX!LXDHWIAZ`{sO#OP9Q6;kGY;}Mo3MwfbpoiWpt$C|4?6=U@9x znGIresdgcy;?isHJeDFxm&&+OD&IuNV<}4!qf2!NDHWGqd)KoRF}hTzD;19GLo7v% zF4ZNZR9yO~cR5QDqf2!QDf6gzCrc5dOZ5mT6_-BhJ<3wV=u*9|R5-33ua)IRj4stD zq*Ppbc{Q;VF}hU0E2T<_2zeaEQpD&|142s0rI*(lmLdjHzJ6nYkU9j)DTe=j^=98J zspo~MwePFq*Ppb`}z?}5u-~jaizlL^>>yc zMwc2CQYtRJ9`1UbEM;PJsii{7To2#GQpD&|M++$xmtGIMS&A54YMCn)j%yuD5u-~j z7g8!Nedcf)OA(_>t#ED49+gXYj-PQ?0%AAcSSc({3>g}#n zI2*g&Aah8JF69U*b2jF(6fwHgJ6x%7Hbz*A7+oqWq|9-Bkfn&xrPjJq;kYhmDPnY~ zAt7as>mHUOMwc3PrNVLjm8FP*l&_R?Lh21%%Gb5;emN2H*!f18d17>1BSK1LL+`N< zVJTvCsdYli++%mL6fwHgdLgBeXXD*0MGT~T**H;1VLP?x0e1WL z9%m3CkFT;6F}ke{LP}*r?*V?tQpD&|qpp;);Mv;sCYgC+bg3~RrLv*-0PQSAj4oBs zr1TtaVku%E<;zA8uDZWO;IJtPKFzHDp}QYUdX zu3h!uFFg-`$x_7Vw%#eER5tXw(fMs@ix^$%WFcj)8<(*ZF}l>dgp|2%?0BoRMT{=> z?g*(dmLdjHzHGclNMZR;w3J_e<`&=i@;MT~CiLqbYrpZEiu@o`7)F*@##Wj;HcvAPU6fwHgCtWG>OF#em4NDQDOMS|f z3TNX5mLdjHzHEG2NF4+_l#RBpU-z8n;XZfDxoY=1W#i?YJr8(Ntt>^1E_I%e zIuv&Bh7Xnb1uR93F7;UX>CIVsxqVU8!(3-pf+N=u#I5DHWH#n)-Q`B1V_G zP)M2M`W8zOqf1>Rq|9;sf~APjr9S6Mh2u)yCCiH#Ncl?n^Fr!C6R-a=5%SoZ zrHIjOT`Z(jHuN6gFqR@lm->Q`GWP(TEJchib%~Ht+0c7{RV+n}9@nKpYLMevvH9DV z5+RQXmLf*Cb(xSd$8`fs5u;0eQAnBN`WH(Pqf32BNSWh0;%-@9#OP9&yHep&em_eQ z11VoAUm>K_-qh{(yXt#H$m0^0B1X6MWg(@qp^tiZuoN-6)RjWYJnH?9rHIj`t`brz z8~UjCAC@9Um->n>^|p1NCqf=g_sAR)11VoNzAB^^0V87XJy&1=R8nIsMT~CiY9Xbv zq1XAVS&A54>KY+st{Z=5DPnY~uL&uY4ZY64`Cb_pF}l>(U8!*0D6teVkn&~Y8$ycq zRg&HZAGzprM9AYjmLf*C^-UqAvZ0T9-(e|Ybg65F6vZ`@EqJ#6z*5BMQrEdss_gEHjZE^Vj$(q#tlMBW#hTO{XaZ9S7js1QpD)CZWL1HY@Eqb#OP8t z2`O_nu4XA>bg7$Nsc<$PWGP~FsassBa5lF4zRV#pkn&~YTSBTGStsJEhku5jWmDOh z%~HhZw!ST-R5tXp>=Rjv7+vaCS4vs%Y@N?i#OPAD2`SZ5^c9%ULKuoQ)ms zli45!Qod|_M@WruHqM&yiw}ApzJsNR(QSQKNSU*73ri8BOWom0g|o5e{nA5Xbg4Uq zlsOxtEJchib(bp@&c^*LMGT~T*|=Ls;nZ5xjRlu~$+xrmd6ptZw{?$@GH2s0Kag<| zqf6cEN`QOA(_>eczP|XX9HeMGT~T*|<+gy`Qsj?O&hUi3oYj z{-KPE7~R(WLdu+tt67Q|UFrv}l(OL2I_O8z7BRZi4~3LD8|SkWF;eG#KbCqZ0;NYr z^CO{0?MdEur#oM!WKyX^S&A54>c^TCJ)_=}TFz3$=u$t?q@2NJAMvE#$x_7VQV(cS zpT1z+H@;uYQp7;2YuSpXHC-zyvIku$FRL=*RO%j<5{&%tCvtzd{N%8q^&2MUw25yX z5_&GD8>+Qq9wge^ovw_N?pc%>=wH-7*t4J~GnOxmm-Az}_NMM7&1w8yG?v|*-Iyz7 z*X7pc%cX2td^JDg3ioIFdb)cCmMmPF87~z_@}s%-`J=gwxzYCd`C(Gi){;v%kC3YI z?9hf>IiE>69UC{dtRBma^%SyeM{~ogbJ-26vZIqZXl=?Dobl1@P|nF0hI5-UP3ewI zW}-Zt$+WHve(99u*Ug#ElruhA$_-^lN1>x7b4#{IYBK$}y} zl@Ke!Nx{y>;)a~FDO;W>7J#RnMa7{F`LeWnbWcY|reEl34u7!*`kghSxx%{gdM8&Z z6-!b|80_pOF=tI_vOqbtd_P$j%1*9ZUv_evhjK`Mv7l5qOQ2r5>wf19700)PJ{-HBu4FZ6APNb`VD?DRx_ zonD(Ac2GRUA&X;9Uw|ObsMM7D$gidPQYpK|DdaXevP68ALpABpG@}I zsxjn#0#exDm@VbAg|d?!8p=&f1mX}SMWL9el|8;969JnkE_E5M2@w@P9IOd7l~gR} ztXN+vZgOmKpaoHx`KYWhdCbW;hO!g>X6qHY_eG$fy)P{BdVncP%eOwSJwipahC&`e zv!}N1P?sgkS4Gn7EX$3couk)4b|!N2Ti0(i!?H7+8_l5$%UDpV0v&6p@XA}psV5yN zW<>KBeHA*uQogWGw~Edl#_~hz%Wm|xL+i682c3StJdx>^_^S3M(TKBUbamaC7Veva z$#c4MjOCn>VhK^A^Us&JWNNa~MKN`RT!8Uz?&_Os(l4T*N|PNQ&lQGibC#5mx6Lh? zqtS&*2eT6s`E`W`D0Wulhqs_wsI1p!0)ETprz!Lb-dQbc1I4%of1K5v|6nb0RtKt) zlGF+jA8HlJS%^=l@h7ZB6B;kWUlweh=*a#&@jI8EDuS%a+p;XG_3cg}9ZrQh| zM~mywA^4^>A|#p+$f-o=d$*Ia$?D^YQQkjh#sFzd-Lj*3%qvRkCdYCGf8XzUX@-2R zngJ23?yngPjtfbsv|&ydNUnkK`E2;s;IM%TdK-f{i_4oGOxiZ2#JkCYe7}5*Kc-ph z=;TCxBPP<`hZ7h$a>M+IlnH_Su|m5F!e_3ZgCYOdxmC zWF8fdDx6K&S<+8+C#-;4P9k}~_;3y#q=<1Wi&GV)6(5T;qhtKO;=|_5>NYS#cthqA z%jAosT8ZIAX!(|ja&F9@>jCQ2+^~c#a%~%tQTY1aaAp-6BN~^kR8iqFmo*AN~%W>H52c= zVGQRSIN^^MKohC94ClGig zc#|_QHdZW^F*v?6=U|~_Xnc#4AEPo|6`4U*ai~q(z_gguv`5;Ac2=`uMcEGKVUvaY zNs~D-3}sf0O_s4NB>Fx1S2R1CwY%rVMX`*M9o0^swG(4;l5NCXZSCUZ*~s{M0Xmm6 zGKS8;$_D#{WT5XP)98VFK8d30#p$LqG>VyMW=&JmszBm!7CC{F%CX|c9L^ieFm?P8 zMObu3Bm2kpCUqK{X=>`2L#GS@&Fv_?jkzH@SzO(=c1xKDEN%Ah|3W_xkP84fv4K}r zX>sSWYK^X1ML1!QiwW&ba>C+_mrI$I%W|Xn?ArV&o!OSkLpaA4_0p?DZHalB*<+1P zW|$Z2xF2>Vs1;MHrIBMgoP~1G_4~4zJ8hpIs+3|d*WGeaEh#BOqNn4foD52>s#2(7 zjF9;hNm;1^lyioy)mIcu(9=?W-MU<95K9V~uJzeMAvc=IkByJY98=pDbqi}UgmsM; zCvw9Hz#g&MY*AQs%4NTb&XnEh*qF_a(jvXhBYEP_bm!#ANDedqjxk!jiWV8cX~X)Z zSZ2Xe6c_D;O@i89iTbE6tU;{BWdsvR)!1vLTM9#1Uo4>I3}e)nQfOVPysV313_8&# zOhnU*Ni$Mv>FubQiDkS5iaI;Qsy?lz$I`)Jp)vtOWE1Fzjp^vAF2D$V_BgFVG2teZ z!+>Kh%^I78=vK+a*lJS`LzWs>qiPSTuvsW+XML)CcH@ znNL0JB$_nUXec!0viB@CT5_9!e~GTq&CRuypg*fee3q`TM%6JbFW9%$XiXGUPrVvo zs6I8q+X_4XdL&3U88vQ9`vkaxNeeQwmAGpk!=~TCnD*#S7`LWu@_4!xBo7Pm_7#Jz zB4uKfH;lfazHBQjX}w=^dLl;H>8}fhIYBynPU@~Ov^Ph7>GWdbmvPqvtrMHRbf*XH zPERzz-!99o%j2Skf1g&zD!-&yUclOCd5HE-r0CtI;M<9mv!b|Zw74l(67MFlU!a6m zfsJFd*TNACUg}?R4P&|3f<|j+>dK`0-WjIlG4-z?t=4dyW3r`!+J)iECuYau8+Bpb z{mL0A43%;tnGs592AAz{!AdHp3MNjJaeX}kL29+cw90kg=CDHQ>E)MBpZQyVF~t$h zeqa6JU`w9=t1jB)vP$G_Y&?U+I!h>7RAB2yi)-a>1;iXFBUklA`Ijof zi+Y58b=XTowJD=YX*rhgpafN6m6i@sJ65%M3#_`Bo9N-9lb;A_mFHZ&a`S{8fmLU< z_>+bYy_7V-6GPd8O{su;rHCId6vLsB69&Fq6wSr#^J>@SC`@RD$Lu^iQZ9|rZzGV1JhT%{2ddy4W)LwkqZhe3l{ zxSrr^ck5*I_vsO=@nQFDCSRQJH3HG}C^9V@#B2A!qL273n<^{91uxz6c0y~$BmYk$j} zHfPm9cTc?5Xw<CXD&NDFf5mI z0NtTwdzd#+iMphkSz<}-xI?S+nnz;6U`eUV+X=n(s;j#bjxRvR#mcQsyP%Hi z)@vt6A|#u6%%epz8Dc_fUd0ET35T`z_EKQF#xFuAPyqqGg6g$3Z z(144|r4fw%m8+oHPG2AOz2kJvhr0h-luWEIZW_xLwhUFL#92V4JBgc8Y6(Z^s39FB zzje$j_oK!rJ#H|3sCj3cXR=zb@RmdWG#v?4Uvi_a=8t~k&)^WE3Pq*jAJ-h z=`3D5QO54QGOna!KEI$}Y+fSm^tI|H64zo1*s6V1D{n!ssB;%+!@st2Cx_ zsa>tHr>IFS)el2Ut3{`^bwsqihS+mkqu9^xZvfSr6RUreGI6QhZBNyzi)a^hQmIXY zpi{QE%4Z@rPicBoKegSekE&6vJC|&qGn^~a5I>Gx{~5YvlO~CEvO=e^;;gl)eU9~{ zBiR37B~Xl;$B6rQ{GMREwUNfY=7RBS9p)fi?Z3fB)*Pe)td*SbqN-;A8 zvM66L_~k5Q4Qj(y$Q!YW!4U0CG#U{%ox(^jZYj0{?acx0y!rsafdb|dg`wPlAxJUS zqGJdNdnX1?PsEqUv^Om((snI*1G22LqAF9Fv!L4C-rjWdWDcV`>Q~H8Jm0=BaX#oQ zgp9uHDDl=mS$9RH#~@s-2UJS9-aC#Sxk?qHvd|93YE|G&Ueu_p+*DSjBTCCScAZu0 ziQEMiSBA*gcr6JNW3t-Oo21f+PKpX@924d0W2@e-*j)?5!?>{}Nj29x+61jaon!MZ zT&E9@osy`jnwFY6 zH>F7~H?A)i3!}XBNbhlxPAo$f%Ek5Sb9z4^Q@aTdoe;aYS1lhZkFO|Y3lrnGWy045 z%N|r2!PFbK1lw4ebcyY533`Vi+Ty!h+?Hb1M^<_H9@W70b>-3=wg?xohgjS_Zg-X{ zkKdJ~a;4l@v7B3+-OPjca_YFP!eW_Kbj|^LNpnhKIq?t>hrJys6~~NnIZ2EUd=%cf_gtm6qv+6DY-q>%8LQS&x)YXhpr=gcqpKO3s zMRBhIZjXo&tgdBw1yL%Ni$ldmn<@Ej4vGp$YwmKBMP77j5owS&5#%TMZV|hB3F0A6 z{{B1ymoshglnNf9%rMp1HDYbPNcXiwKzh@T85qQ3f2l|hy@~JEg%7%V_tu+WzwY$e zUG$&xC85%T+&P-z=^rbi{iC#rF+-GGJR9hot1H2Z%|w)Bye@x^m0{e(E1 z!d`)`!yE1HQ%X|B%Me~rkk;-wDn!9Ru=WW4n(V zFk$k6aXzZwM9D{nD5`l*26r-sZT9hljhe(mG{*QITMRnRDsfx0lgD0C@h~jkXLvS9 z1{+(P<#d~8&Y_)u6WaaHe8M4SB>Y|sSmHq*u~T86rP{5xWYVkKR?yx=bxM@Z3kaGf*n%Cwn7bD#XGvwn4O0{*Wa*)F^5ne=d2yXCsa5jWKU^fYr%N_D9c7I8Lr!*h z7eQi!M!~NEYX@ z(jx6d6(7(|bEsC-!wSXdIIw9u;nNmq^LED?;oV~YqcrO1ov8FRd)JLS6tIbn8hO3b zhgHznY{_obS%Igvq2h{t@eS}qTp;y7|5Ef(ed2!qx`!>cyvq%9fnKow30~uC*m$fD zp6(+a+=99%w}kTuqW+yut80LvzEzF*zLVudBY{CK@hA`_YaRg%5_%s_w@4+8jan$r z4wgksWQ;xNVd=Q<`hwi7&X=Td8$)gb2NZo~n#pbLieXJFtnan;&%N zM#qnE4UAyw!WOl?{OBlEB)Z2M8S+1oXLXy~IbutO_hlLr+U7J(nxzxeAFI0PhYPr=jl0msR3Xseyi0I%YN06}8bPIIlO1 zXbtp(uD^@>`g|RogKgZC=-swB@_AI4_u&Ddn5I|J_hF5qfaidUC*|QuK{TsGXNCU) z=fH+hh&f;Xm_Ra(r$Gz#=sfA(FtUWV+#{~kyumsG9(#u;mCEV6Q*bcZU7y3RC=53z z_R>42Oyr&ClIq$gC-CqwaT6(0qTgqxx?$>sec#EQZ@d-R5*uaO3ny_j$~`q<7eDks zIgDC0Nh|e8v@iRd^J89zy6G1v3Gz`^oIjkmb zG2WA6F;P&XzI!@~=hE{}eXONNm($J4iM$ABg0_mriHcpBO4O~C{#=lC|I|nPQ*Yh; zwWv^H{u7;4zc$rYJR?*YMT&SPB@;xm*^1Vyn%b7iV{xV<6IvGWRMoKe*J=XO&Y|^9 z=}dbX+pKH2l`PZN-$4&iBW;KYkd;Ql9l(tOd7q&ke2VXe48RORklI;*UC3$f85uVabc4KD@`jDa28 zxl1|BXku?#lXthq7_XsM6HeigwW9CwH@CF8lMp0Z)}+l>d-jkcn7R?{XhgPYOU zNUL$z4K4a=wZWI@%k0(o($Lh^a7l-jYiL$rs5s5$ildD#zKT}E(?LQdAb(_JxoB2V z+i|dGCnU>@!Hs)vW_=z8S+U>Keo_v@E*<+o zp>K`F6k_^&4Kal?G^A;{%_*GEy6+cFVj_C(WvGJYopDJ_Rb1PXn`-<%=x~6IzX2~~ zb6dV~AQVi32O+!9xwkycSp80iVJ?_Jd)22kat%>jZMHa8qiXlDuA!t={{$(Ys^(_7 zCbYGmAF`WG^<9fl!EZHd5uQWdT0~u!1C#;tV7=9x(<(QkhooxUt$aB^`4T;5RpU!T zmIIW#=0^((H)+EhUEc~k0ny(rBwtzZ&) zE>%88Dqo_TZ8g3$WQ=5Yo6RLmy$kLp^!136ug}`H)MZ+q-X_*4rTf_Btac9t9x236 z$~L60@uRNvt=NE3S8AS;AyJx2aL!uQ8F6CmHJ-Lk@fooUt1f56ty{w;33g&@KPy*m z8h)Z$Jk7*^hS6+#c3k3Th|q(_d>t|yPTYY@zCIne)YbUjOxl@}K1Z6WOY`A9Mq7K$ zRc=ms&1J)hYp&$$Q*))RDXCGjw~b{*b~ABlNWMO$F=yLI5xbc#tbb2OdsAd&8Q-*oK)t6)c~Say_red^l0 zZKFA|n~9sFkjf%@|Ca$=WH&r%&-#`63NyM41 zJAzEVKmKt@=CHmCB2L%l&G_-7;-;R>L%H#CzF5FRN%2{4DLa zRToXU%F=7I!~BQ~Z&SU=yBN+@==23hi+53!t4w-VDrL7gh1@1*G*?(xULTW2p*WF< zYleL`3PrgeFW{OGk#OJSWQXY5VS+f42)HI>6ef{~7-Dgy-Vt36o}M)9m}GDtKc0o5 zYF{$gpc=nrXeeu|@SUfhFe1AaNU8Fr$s?`7h7ecH8Z->` z94OI>13GNqD+RbUu9kB+YmZh}t;$*4I_^G%Vx(BYKsBBnq93TJ$r>I5PxoN>pQzD| zr-&gm`A8zSW>1fG6?_&y3XCU)*Ayxh7vFEn(S915P=pvL#wngzzVz@#)kOwWXZq^s2F3$d1S&1lY5n9djQ_@_J;d`jyk$M7KIsK^tri4^-HlOsBo#3FS2a96$4 zXBMzzBLVEHPM0PN^n-`-H6ad+SLqAQ&4f*>k98H}H_F1!T5=FaDy8^!wLIzs)djv8 z0S|p#SHu&p#X9JQ)Z?zE?;W39=`+xl78pmm zO4ActCd#?7P!Hs`xZzwTaH$}%M63~0Ml9NWsH@iL3&WOt#DGdAuZf0ftZA-pLnkz( zCnGVh42<#bE#Lx40l#d^a{#*D73lZGP4m@lNRht+uVxWbXi)`;ryj?|XS`&TTt*pk zV;kUKLXg$iO=pWYj?_P&Q(;pDN*Rr_XU=H_Qm!#^$wK{5O7iPPi6mSj@Q6kc4EQc@7=;2?DZC3zQM6Jneu_doHg;$fXFZuUv>V^Mgz38&m4H-A@%V1+PI1Ju z&*>4?^g94S_2M_+<&WBkCpNiLiRy%vY4UOe_Qc#u{M-ROX2u#&9IDi+Uzn8-wbgzw zM!VRdJylXY2-SFAhDDj$l)0|aWhuIzTctwz%e|_T6~7l;yEf$<6^H-VBf~#eV=bCW z#N1WX>g-{0v{FHL&9hQLIbp(5W~G8|O4|~rl-4(}J;MLfQL3EVYt!N-yf!^D8mX*yfqvFs_oGC-VyM`Tq0Yx!GF00rAupR1xTmFV z3m&RnDi-id$9MoZR)fV>Y4?UP8eZw=65UEoW)h0{&Lb<3@|}-WAf-YwY}pJ4wV2l1 zF{oIECf{m7z0@i9BKIh|Ntas$eOa$mOqmluDUzVL412N?6|*a+3>xwk-0$l~Y1#Iw z<`U7RP>WWtUe?*&;37ty)q5?Y&Wcs(nW|YtqG`b`rjjO*R>s41)hcY6^9QPIGI7_u zwX>*l6mLa1?)$S9!-0^jrk3$uR zsV}K>iBSJjYXP{4-)8*v+VnQ#a&TPSW*qmrvu(y@)&8je)s}^7Y$?`7gvJ?Bp+qcK z)g!2CmdP4pR|QOE7dSVm(O~lRxjGwiLvs28(=%#Ob-OJ$*^IDpCRLb*;X61Dtuet< z@w60oQ2cKR#~U;MTOtY$ssAl;c_Z$BOGK(`FwGzu(>FAHUc5EC?KSmnE#bi?y{-B0 zHQjB^bJaxSm!Rq~cqf~yG@^}ZmffJE7QXlfN_yf)RhLq$&X>BdD}O_#qUE!#&1bJi zid+-h+T8Y<^ETzSs@8_-19eO4jAJXwwtZP~`W>uzadP@y<_ByTukKM7mM!J8*grgd zy_qkks-l_(%dN7e^0aa*NTPdw`eN?zyVL8lC8u1<=F1bAZn+H$_1n9xi*635|HJ|w zT~zhPqZiXxMf#FV(_d`A)W=5DL2q*LVjZla4yv&udS!h2duq|=RJp#s)q1azA3j^$ z3Y)!l$|pCA;kU}8*5ao>?_w6GIqs&sxods4P{@sD@?+zp^4u`Ixi5lo6=9EjZ*~Yf zsBzmwPL7S5MK4v+oU4#7w;hu$71S6UcFP8YRrv434sO1aMnZ(E#OWKMxH6+f)JBes z&NAGsT3%!^psTXkuPYpv@mp8e=^H9<8PCP%ITBOqaN9>2_rG8xw!qzc)|YoU3lSl1 zie05e)k62lu4=>d$J@eKlMZk4RFj(EB%&r|-e6jj8kJ+;54+Z&PdtHL?HaA8O64Z4 zO6ZkZ)Z$+YddMgt3rC0rOL9k=M>c;ABy}rhxiPWMY zbki#>nnh9zVJVq8JlqBq)9zVVPNuDLIcX11$EwO+<#N7c7Vxyh;wEDU(;X_M1aLCd zNF8@uX%tvTpfW_5F$wzXd4;0>dS0QZzm8NW>aQjhimLRA^NL`*GR{0rBR5jMW`LT9 zt1eyn?^3!egY8ubd$YUha=+Cx$5K-B~acYuT6|2t@(M^0G({)M<+|UOuje~ zKgCY~E7e1zxojz*^=P_nr{C9uMng(fdvn-1eVSYZMqIyQL}VX~^%*CrglhyRL-GL-s6IF=Ua2oC zs^tQ2p+j!~)d>44V^zjOm9#1?zRFvbyh@;&Q6)|y9!MLQG1j8OOJ*%vf+?*pl^iA8QiV`e_u!su(>%S{BGe zxs=O}t(_c+kZjI4OMC;b_xQ!BFzPG6DGfGMTO ze^@3helw{SjarqiuTrmK)K_n?qSRNrS5WoUs|v36pYUd1bgGtI z4_*HDTn~L-WvPcYRYhdQYnF|>cEyG!UT59Pao?0N;ZPJao32KSSEFlmCs>(lROi)| z8Wp+O)}~(h!a6xww$GHcZBIDuRvYictlRgn41GFN55>MRsk_smVye3ZU&+;7w<=8Q zjJEdlYwf?`c2q!g3EZ2N)({1C5#|*k>K*E#IP7wg(@wE}%(4; z)wW`B z{QOsH+MT*<_ASlSUwLS4rv4^;i!=3C?w07B;anNJ$ui^kjj&7xJBaAn>UAn)+7|1Z z1h!9wEnlfmg}G2Ymtk+RT)g3-+f| zV$^HRQ)14oE48$Ev8hE0zfzB)HO4!E@t%g)vJ zShZKfX)^C#SQ?)u2jp}bm!77}0eAU-x*U)hz*T_hazHf!@xzg51H-wK5}jXRl=dFM zm0-wLd({j-S2=Z7-C+B03;0-;CYz0pSNwRWv(UFbh~KZD2IFp9pC0pWOP?O|GJ0&f znI7{p`e`#Sqn|y!(NCLs8U5Vpjegq9%joA#Z}ihV9s z>6N-BJ|$x;*;N74A{nMJNhdN5^iNHDjy7z9-by|6C(-}=TS=G8#Ywg)-rAM6#8BCU!qu=%ayu{c)XI{*%hv(w|gb+7D+xsk}=5 zz{KEquAr_cccW5ug`Td82W!%AZ2GII67c=Ny6@DfzDkv=?P;@nqD{iTO}Xp_XS`g> ztc+>IVEy~bGTnhErC6V!-j-=zxhyxD&#ujn=F3~?#xC#SkXx&J-YVwS>S1u1b8Gd} zTL;}*J#?E&v$?5+_wL7VzRDA)GE|Cj0_uk2_BhagH*qZNE2KERDqHeC;MTcvFHy9V zw#lS&K`)<`%LWr%xdtycmCL%x8ZF{s+2(3Uf$}cG??8ws`kpDj!IQYtrsP{pj_P8xRp(a!Q<`efpqv=X zZsz6u<+SnL?uWKXzCtOlDpe>LtP&N9dqrEJpvq2mVj{n;uv|PJ*^(QY)2{J9U!)=# zFEbU11@lsou$PsJ#8gg-xMUQS3w@;}=8}}}5=!0mdbzE;>R|rsZon&}x~o>@h~91} zH<929ps3+`sjiH^1lS1GUTHQ$d$2$oVZ$raMrc>XirtguPMnI-aN}qK*j1e#*kc(r|6-B5K@bhpt}r1sIT5&GQ?qz#UM z9{5S8+l`9>n@AgGVSJdjDL2xBsz`>uyW*5pKCITwgx6IyGLT?T)JR)iN7G0vs`xRi z#+QX*SgkXo>iPi<;s>*SjVYW0TqqF1lR?JH^vO6CR+ zFRe|D^rmJt(i=SLz8>Dxtj4XvP3599nJ<*_Twgp(ezKe&o$%dhaZJa6_JsNNgt$q4 zze&6Q*~xz8b~vQEc}@nmYll7W({AE+mB-+o`myYWoHK@1(d;_${4!@1ZUriqoP0S~ z%Hj>JZmG{UW=Au)cfeUrw+ZE(@|N-3L}qo{+AZaryb^8rEAE&$MqW0Kxue2osdnov zne^(m74R^l7H-p-fxwck|K0|9XNP`=L(_}NkvD$$ljDut?JwqsZ;bKhCphPLF-z+9 zA%B*<+0u*oG37^f(7s24zL=-7PyU9{AeQ zwAfb-P~PO)CU5JV22Zrf*w*2UN)47v(L*fDjW|Q}d}61#_QaNqw#!tWoQQ78vTdkJ z1+EKC4j#0Eu5ogxjK|TZ#m{r7X&3jHiJ#0M{1ngdLs!@x>oeC7Wu};@MCuwTovf1ml}iBztd^o)>M&)#6rrH)15<2F49B2 zLXAx=!}%Io4{ap&&A6%+SLV&F++a9)3y%|aO;f=90Hg|4Yc5UnMa7!-Ta#RMZyZGtsK!4z@4m_#_h-ms) z$n+j_>ifxU>Jn&&BCoF`kfhZVp}skt!AXgF zs};mnvYeTzGHKxqJzh%VjD|>wk!I_YI{jN zF;i^V7qWk3O&qi;>Z)r<+&TdaG;F9+&SR(&s}+`HxO0U>zEoHZ#9W0GW57%{W0@i^ zEXkmn;oqbs{;AIq`0KPpX(AA_7F3-+i-T@y`L+5A#r2NoiL2WZXTEZc_z~~9xy?hl z@p8UckWS3$%%t#fSH?+qc4c}72fI5K^(@M)ENmzgHx=4vdpKcp*Jg+1bX${_AD2qm zElwe~$r;TR)|J<5gwWrcSvatytGj2(f(-Pu&(4xW`)r7`&t@6d2tO>&$qvz7&0$^L znclvEj=s);KBqM>^uE_V%>R2~18q z#Owo0TA5>8+9-Nq)62T-%QaJ>FJU3@nMv_nnhZJl!bmZbp;AYJS~)yX5TT+IDT+aq z!=hdoD?m6+W^0*woGA0xrik3)5hsAMju_0*S)=+=+3-FyDHip4C_7OO)w_8;OBXEa zA6US(PB8we<_T#P%=fWBW8TMMxBcI-*WO1ar$rO%$SmkxGBCKPgRVlC@DR=R+2vvp z&8vtfpNhtXA7jrCIk{2^+h0ZH;vQgbzJRlgJeqfD-Q*bdf9T(qaAhe!mNN*7QZRh2 zhhzj0m*I0$aC4pITPDi6F@t@IyJgYh#eIEU9Sbt;t?jdApc6&`)cQ8m`tX;cyewa- zG7C%TL7KitjNy;<5Zlsj!#9Mfn=k^fVffr+WUkYfE96S51~{~wvaVR#q7^n}bZ&Ro zqRu6Y7cI%GlL9iS&Oj0M3OgBOLAdfQAqDdmE$ZtUT(oFWCeI?!5D?F_x3#yA@&4?< zcR|(ko9HOGz(s__7ZqDG*r%RpJG!&G(;Z{f?G4sJrYEy#@!;S>x}MZY1C|mnjxy>? zO`FyWmKg(ee(JYG>o-Yx7p%JY0T&jQ*t!~Q?u+?PBdE-Hb#W}aE8}Ogobo~hiFT3y~Y0x8ztT8t|d#CbawQ2 zWn>Q`)?I>bKyh%jre#%{HMV4=nINGe8^L1?Crdf%XM%b$V>Ny%g6_>M?eAZ>cyVvH zD~i#h6%A}{zT7^00&7SVo?!bjy^9z2_IC}4?o5~=mQ07?-pt@&|KQ@z!Cp;qt~lbc z7>8z~J2U$(dX0#$RhMCw*82+^gU-VIm9M9uZJabXb@%jktX#Ch8C<$@xzn+-dtlI6 zx@@p_U{R0kCR%H2Z0M1dh5nW~ZO*EJ?w)#E;L`!abi?hUP2Z_Zhh|NBk_}%YzoAck zsdeZ3=!E6&WK>l9u0m~ibw$*`YQ2=MiOo}%5{k{0r-rUIIq||GM&Zp`u5p)df-w_b8_WH`H|cToYi1HSHScRpD%N}{I1?iZ)bmJe{c6< z>g1@mr#l1b|GrGqKiix72jxeuaA$vJaAALEZ(mu4HE)#__>{?%u&p-Pb%k6e%0_*xpQEZ|9;VgB^o9TPR}0 z7f()5>FvUtzqfx$|I$T^byP%Nz&W+-gy0N4RnjxDC^Oj6-PhaO-J|Z#1d92!TuaLh z!>iH!Sl*jlbYm^6b6{YgE1Wb#t8H&}O(AD}i@SRk_Vf%^nzJPt%uhPIdIx$f!QoOm z|7e>pAxk@Ym-KcoSgOke3P`LsOpLi+B9Yx){XJca7YA}4l*9NtL{-UIUe1>DLmAv< zP1`aCu(PjJ7MF}^o8J&F9p%Tw4ZV@)vU2F7UHF}=Y+y5{=SEO}()F~8s@p$Q+j-)?rd8`E8HGMTy8QeDP8t~Bu zH{4BxxwhGJht>|KTSi)D59e}oT86UC+4=KkkF?C89gM?b3!}Vl9CM$yHse~Bt|U;5 ze`brWHyE3>e(dvWK&p8kyZ8Q1ov?!_zcXHd6?wd}UQx-=KZvev-o zGV&JVr_CMM^xu)`>BtzrZleVe^O~`1&5p3)IKcCvLeg7jmX_%3(tiQPZ$HS&$h=Qg zIO22DH4Oy_BPPIS&Hl9>tDO^WcuUfnaqnZF$>4{&q2RY|I3Eh1&Wpun{TpsJt@@{I z*Yu%h*ZA#Ru5D;11I3B8ST_`HLMo&SLV+)o{lLfUfbmn$1KZafnO0PIvw!kCqhy;p zPlBZV>?qJj`BqgEh(bRe|{3KtYk?y)_MRDM?EVA~YJBeEP z5FMU!paylp^w*#&P$V^L3Kvt&D%}F00!InpZ{*##l@vmaDuV@4qq;z0)J0pkKPBs;-;9W3%?JJiB(L&2ZV4uj@c zZCtRJ!kntbK{8mN2tiK&@gPFFaSQgj$q$y6^}#y2oTVhb=R_ejwG;oY(lZ^2_+8 zN|If#=Us$?HsiKNc{j((;CITQ;OFd%`D4!w^Y`fX#TQuiH!W!E-zg7*GVFo*W6uNg z_oy%t8!?xO&644LnrzZ6E5Gy%M^SCzZB~3YjrN5KUHg!oFns3OHhd|E7I}eNEN3OX zs4XYK(kk{3RjYyBu2q2-W38Ine4B-Q&!G1W#VgH(Di!m$9B0&*UJQ{`_tF7%HMzYh zSD;@%cle6_NU1pHl-K7cGBzJYsYzdC$ycR7g<6w+%pE2wFR)YIYwATHryZ)LJ&;9m{)H`-biQ};05}w1gF(?0(N^P8xO5O4W^)LSa%XUp2Hk?~Kxvpus z`sP8rX}MJWOa4ET+O_kr(lCB=&-)zeQafDc{hQupcHK2|*xHE+|EDwk|KRth?wY>s zuySs5xoNDRzP<%-UJ8BRWt}89YuBakklbd4rFO=EFxnKd(IW`u8_5|6xw|Pv>^LDwWz3FFI`8aro}FV73@JufCiH?tNfh@)gpC zJmTf~=W*12JHYJqRiaWUJr0j+heKPy+;FwzqV)Y8%stmg&ZciS=sWalsnpxPE;(v{ zo_~5?9s%<>bGE$f4Ed+PykO+KIL?QHoxXwc{id}0N{iiAe162Wsni%=bm(?HeV@S> zo4~yCddX4!F~#u~eC~ibi#c7N7cb@EQ((Sm8f?qV<>V$S9t>H89xdt&sp zfcq7gSKNv>IBa%TM51S?{7<`{)QJFdb#QGK7Sj= zxZ4G0Ef1@ z%$yjG#y!`3o(O&nZQU~Bg zhn^Rmdo!51M$YT+$!-Uj*W54ErK0Q(fhjTxhT7L zgL%Nnd3N6g1&@F^=10=*&iJ1#&p!t92y;<({{ZGGBj?$@2nzlU=KP;XyDziYJs6+A z0Op_vB&XZ;^liY`hlBYnb9(=x*MskX`9X}nUg&$68EM&{7td}PU%vK1oUh_V$4l_? z^5=1s*E_)ch&dTYn%6;e?iXNwAH%gn-(SES{t({au+0yK@ZDlC*D$B&#j{J}^uu8G z_$g_#k4LBAyElOOB6BvoZQ$+z^UoN4$AjDXXE^7_iw;}d1 zaCd<@>gUn=D30U7e3Us`e|jvqOTqkyIa?fWCjWksN*#w69X5Rj;JYH2k1}Vg_nqKA z3+7kM*~){sXTiMnmw1CCiaQp}1qryDz&szrQM~)1Q|+OS6^AWe^6wZh=QC&XkM!LL z=6@3C`zM$q9wDptc&Qz&0rTk?j{Lh8%rgnNy?%|kB3^XZ;y4=LO@g_LIa^*rbiuU&jpPg$`4B zQ2n?$0f!~H)VIMEA0tgzQ^(8G=at86@%gpP5J!i{dH$V<&mTz0z3qR58uyP)-lAcGUEF^_2RJo&JpVY`o}zn9o0* zdmWfJ8#%8&)3`938PZ3GDc+yJ&^y4jJSmx%Yn*QP^I)!GF3P{_zGxYr#+&(Wz%GSTo=Wk~wO5aQHWiA2tL)bkL-253-688Da!T9bJ zFqbh$v?*S)do?q7D-IJ!=eyrb$lZ{DBfGaG;HV$FJps2HxI4f-#H=me>%jd6%qO=q zuhae<$D;qeD6V zB{Nc2(1lSPU3hu^>FvC4_Zg|>c+o+BZQKc9@(H*JFsCHoJ_P2I3AoRJxiSHFEtuP5 zIBNgj2lLAqj{3F#1@qSg+;d=Fx<`Eeb_4U87>@jV1DLrn9QoG)W^n>;HJG6U+!&ZG zF&z2#J}@7T;mE%W!CaAm`v#a>6L9x}c_;z*8!%5K;GPCEW6$Vvqj+BqX8#zD;ynmV za{}&2FnvbO>xb@wTStR=)!x!S(r;^*=YTn%IihXcWnjJ*!%@69gZX|8NB%qn=64CW zC%`;ohK3Ahc=_xF8gq@4YvPWo%| zkGMRT2V=M$q2SkGeorTmIP`hD-apTL^^DZ6c+sKT)w%t^9Bkyg{5=K*X)t@dR_fE| zFS@>Cz~q>VvRedmasuuHU_NH#JpX8XJf9g6F#eeGO!@j;LhcI*I2ub&QpU@l3HQDvJ2f($0*`Y1K zZPxdN)A{AD%;2p!GP|ZThmGqT#k&u`LVeeP`%a8L^6$3^_5Bgt-(&QVf4k3?Wrnxnu$9Ma!M%xDTX~Rw{R#Cg1$TS` zeeX=D?=)~{$LOPYuS%%z25@)8=%aWaO{nir;Qo<7-=1@lmB*{Wy^&d4dF%=QdK2n9 z7TidTK8pAK3H6-??lUp^$iM3n>iZtJpT_9h2m1aFX6Lywhi+aB{mYxc%n5RV{)PJE z6<~&goI&4dV9pM50e$4(RbcK2at3{mg89E77tlxk?L2Qr>eYDB5f$$dV0wdGKp&Ow zFf&3S{@D71QE;0R==)SceHVfIa*V!L!=HN+>iZvXe~HmY@xEeyvi7z&xC5DW^Bl+@ zm2W1YzBS;6WAu@KrzO;PCb&-}(D%)R`fdStPmDh5Pk*0K-`~LfCq^H|`|2Z-l}8h} zG_$tyXo9{aU`ou<^(|X{J{`=tG5YBG=QUt%)b!!Lwm?021-Sdc{4$24{5{DG-ikxq zCl}C1+;bt$Ja2mGkvOl#iw;{}NMAEE0>mF%Ufu?7Ac4Mh3H42YJ0*d>3lr+Q0^GGR z`lz3LAfdj;z&#nGkLu|zZ%tND_X2kSv$paeeeDVL^?_R+qmRn>q=fq34emoR`pCa8 zCDeB{xSJE``*}irzXSK@1o~e7wq)h82e{WUYby`x$KM8KC38{zMjp&$jJ{o<@8e)T zuW{jigYx`sFn2LW5t;e};(i3?;TVqWJ__bZ=42dUyL3Hj`=f&S3v<+tb_BN%vr&0D z6wEy4Yu;qp7!CS%f zGH3IT=4;1-8Dh>BFXd&78N3yTt>2goaHe`dxu|$|>YS0<4KF%u9NFC;%o~}r<(bBhw=zTe=&;p;4sb_n`poqp2j(Q^ zY9y#kzV9`Py@7Z^X@2z~p2%P<>N zUsiy52XnT(P`SMa%!f5DoR<9%%u#zbl^eB>e}j2RPjvohzvC;xyp}mzec20K z3p02t4wGFPKl;F}*7TX{%LXu;n6u@D>dPm=d`{CB&I^qn-vDz9b5Zr>E@ng!_+#rg zeh}bn_2q{qE>K@+zVRb)e`hwTzUvu-gUZA?99%f1Bbx z0-xX9FKyzjIBfAg9pFsyQoa8NxE%(h&Zv0z19LEQw(_NR-3?}dInrv1gXEVpgSX-^ zaWwB-1+K(wlz*p#IhQ$`e`0+N%#E79aJ!^_?S3%7h~a2o$Nw=Sg1{eB95hZp4Q{6e z@p*m?m_wM0ilYzAQcYht4)Sjp%m(Icvx&oCDi$8}(C)%1ny3&rsOn4dEj6~|-D$SBP9p4#v4!ELul z<~b^ky}=yFTvQwxFaw&ta2(WrPXKdb3`gzbJM5Of9|q>FF&xFalo`@ThpC=Yds_o;T+?UH%lpB6 zlsQ{oD2}g!xn9#3E?=sr-v{$!=A!E9FPVXeI81R+d;2xG|6?|)JhodhBlQZr=&;2> z{pq1#nwg98??`5ZLi{oLNA=|>aK|zm0{2OkMfcOQ_%F8^Ku%P zb7DBscL_7(A04K=Pnm{Ym0;O{Og4J{sitHG5W~AJ(tQHGgnD@l!qdZ>#<}yuRxZJ4UxDm{)%tf`!dzlfz;*Y7^sNc8` z+^?98isLU}o@dUM7m8!Qqi3XEj~5+MpE-`XVBW@DR2+TG2!;4#ienZ&UjXhzW~1VG z512EVi;ClNFkjR3h2x<1dncHmYx=?*tph*94Bm>v7RPqWFpt2Cj;J{1fazo|Dvo!6 z$!q$;{!tw72Jc?oX6An@fR>VFOSd5 zEHH;M7nPR8y1`n5X~>boD@ z&lBi-CZWC;z`cBhERQJv4q=AVg8E{Pw;9~q66iZFp}rw-#h|{x`XqV(k$^tidehk^ zE>KUYJkAMlws=1c?hRSzNC`KQ} z`(7}g4048jrQZN^Ymf`HbDB3j0_M*_&YP};+#lo&`FjG)b3x9aZ{K5Qqz=N14qJVp`qu?!IdeqY>dOgW@-h18 zeC7-=pG%EurOjnRI=*xl`3vz+-p!)J*W`tq< zvE}d6;4X>LNA=})Fpn@7H4gq2%)evw(RjB1@wmSSFFK^Y@Hj~G&Us+knUnRv%ndLj z6ylF*9HhJ~4RPjv{CIHdnYEQ0={r54zH`A{ltAAt3H99r?!g#+)QL%H^OXGy?Q5@)0wmRNA>DbFkjL1h3gBg zGu#g5Zswxm_%Smg2>da{L3w@<-2X5e6~{lp%zV2nkEl2f1oLL*Z0&>MXb027TvQx` z%tXaO?R*)y0<%$ZoCfA>=Az=b3e2^dzHoWa{gU^B`IV+G%u#!LmYJwHs9x>hV7(nL zI-=q@49pSCMa8iOOjgqu_K(VA63ofWMU}?~m=O-*kEvc!d3+GurOZafaRZn;n2UH+2DPhkEQ!%@9@o*8M?Twf?J z+hu2@cE^j3sJt8uriD3Mo@t-VQZUDA`oei3I|XLQE*+-4kXPd-&aiHAQh+nxP6BFh4^DDkCVZj5uu^0DFFK;~*8}G0AZN&55zHw;&QQJ=g1I8d8T8%FjBpTtY~}GYaF504qxtEK^~w5| zUBKt z`pj{h4dxTf+2WvhFJcC7#bJtr`oBv zO&{fD9+(d1q&{Ia^+6eKN-k*`>plm(dVs&Py5Gsm$8qpnm8gFkfd*`e)X6 z3z&Oi^ijF}o*9aP4qH3_KXA{+=%apPpHW#BLRo~qCU9wHZShh&Uy@MY+rga}qmT0U zK`<9E7gevW0dq@?KB`y00P~opFI=za{PGzvGsk3ZZ1s=wun#kMD-Kh=qP*-6?#-G$ zb3JGWvyeGko@sqI52nDJt=^OTW@dzQ_+#>q@_aJ5bC`|F^Ce)eX3pjx<@tUvKh^Yw z^GxmXPhkGaoGlKD_c>_R2*Li^KIsAaZr8!6`030E*uBdgO?WZ{8+r`kov+L z^+WT)bTDU&m+HYnFe_rX-NC(`8N3yTDKBJqJjA7q>m{4Py`Nb(FNXD!F9h_N)=S9l zB>~RX?_LS+`k>vw{EzbdP(po=gL^uGzCFfqzJM1UZoG#1X%CpAgIvHrYDYydrvy2J zz6-%z5#$2;Xq>s58S;+~TmBvZ_nR1ff7ZcoG;)-hntsxe>AU~3ubwcGsJrm zn0E)cfIjl?d@xrAIfK4?!8{b?0{ZBD;VCdLF9qT-=sN_=>>wA=N9D1c8N3yTtvnoX z8)EcP`}j~oeIEmNVT?ZV@8*R1?gsZjj6U-3uL<@23*1X40(lPPkILiqV2)%is(&5? zb6ku*>L<5=IZe|S?susl{}h-@VmMlVzMdJp6^E%mr99sr;>`W&{osDitgRi9zGo8Z z+rEtRTD<6R^_BGJi&CE70;WgfGMU2y9E~4C%#c1hGP{O3(l-h2BQg4jyAsTIV>r4m z`ghFWtvG~T3Zto{K1$K~(LccLH!0(#zu<0@>$Xjs6-ZnYn11GDy+RzK{&^hrSI2|d zoPawE%;n6gi7Jl)mAuI85B$_-6M6+$?Z!1lP~(O#IuV zkGOF#A5FmB0OsKYTuJD08fUI#hV;>4 zvP<>lwgepM`>BZw^nWzYJOS>d?~!r1{sp*0!R-&Gk2$gbjK<$UdwVmuEnqHXjuP z>>u}&9!K;0r@_p4zs!w|BfBpLb2xK)efIPb*9B%Bb5Z_%0L*#J+3Zq(bqSbTWAu^T zN5IVZfQ%!`zrDcBkKrhPi@{`>v-wBd1~8|@=p+9=4(591YAu#`n;mGc*PRIH) zUUWqHHyg|Vb5VIY0nB?7aGwNoBXe#Xa$IoxnAgLnpMiOnIrfj+hgV-Hj+tj*zYkt? zM8$C+m^sWv#jyZPApv(9m@fvoKpa#aH-Y&zb5U{p5zO;CXKZgfd=UEt@rsITz!G^?S;Mr!K`O4DvlDE(={#}2lb~P1#>|R zM{#@+%=eg!isRQ{w)=2&9No}23(PQcQE?Q&oThQ%ILN=Vz+A)JO#Is$FZJ?x7|ip` zMa8k}Su;{?c+nBX^@AB@&Q@+T&p8v!qs&Fc`~Qgfh_oxYaJtjd`)6)PyMsAcRhNEP<`G4<|E8S`FAmxI}>m}2lH>{Y;n8|cK84IjMN&u=!lAAEtriuXN==iFrQ#9 zDvry++?Rm+Etr{~kp8*)0_8CWzV8EO33E|#tN}BsbD=nBT-^xfv>1-+-&tU;Vb0BS zpuZyS2Vnjd!gf-}QsJk-4Ziz6<7O8W)a(%Hwxn{v5+mo}U4;|EHyYQROio%n3m* z5XZsLcQTlZnUis-^KNfmLV3Ot%&j_StXKDfc_@aXIDP|W`_BaOY$&%^fjN>nH{L)T zwC;Tjm{XaHisMW$7wKFm4jLCO2XhB=u3dwFkAm6Zy!bfw19Mc63&cU|D$BsUi@B&c zP6zW@oeRZ5_3BbE*TisC9yfvcHFIvgH^lolFnfPi#_Q%K5C^RzwShT?xu`gXz--dF zP#omnd%;}B+)Vu2Hh;b!%wL&{isL2c!kimNpxmhaj)FOrIgZ2V-pV=l_SKZ4o$!g&8?f$3(> z^)FCg4*dV@y$gI))wMr^YMR z0qx`7&;S0;Cz)AipS9LrYwfjPYwvvq@+}6=Mi;L?JAVu~UrNX8qX+%|o4|SG7bP4tqiO<~M?KCd=0iP&rq4u?N9tvniw zPOFa2sV<*eVNW@uu6j;I-TbQAmtHWrq~weY&!cmzW|z;MHM_2|YU;e{b+M}XRk2Gm zVa{${5npy=Lu}dNRf|^Ld};OEx;gPh@nuV9H!N>h)Y1Unl~vQq=f&p6qEn}wv3%L$ zCCxX+Gv!z@8>Dk9qqFLwb7s{oh*nnB&8exXh)#=E&7LD!FIpaNShZqNykW(n8ylw7 zm9JhqVZn_JH&(4!w0L>L(o1_MENEDC!~8|dTO0bSw`j$Rm5{Qbt|h)|*^28jDrRt2 zH!O*-TqQVuRiIBr_1s?i&5BiCUS3@_=Zr90i8t~8B>wNRvIE`+fb(pQ%>L6(N)3zsxE zFI?QZZ23}u>iI2V?(s{Pty<{Xd|}I~B@36`*bEA#91qIzD;HmHO|dR1$Xbloom<1L z^Q?bO;2?|pUA=6{s+BD(8{^^P*<-`Ano*|9Zh>jS6)SISUbehJw@bvFpF|ULLea#` zygBxUH?}}0+j+TkHxeGOla)o`XrdxyCs}hXJCSWCW=4VwI)Vii_4scN7PPIG2QzE% zq_(SVGwynDbye5__-(?u2MOSH$WG1$ujI@}UPpq(yL#JsT5dMmPOPZbZr>d*kR0u@ zUBP>|+fG(bO*obF&bH48rPFC|*s%rR)t$xoT#Pl89E-Yq9kngTS_kN1fxZN&L7v*q z-H+hrApR{bt^9{PN9qH(vD>!g$rDy`_et9=g#%;G)X?f|+ZiSg`R4v>(A?wz|BXqI zwRK==huyYg5~O*D>kX^UwUg!N*k#*RpKCk2R7q!--QE!o+ie}^*lh<6*a`cHl7LRQ z3fi8k(%p6!ER8Izs?v_qeWkng0f$qyDyxC20mUV)5zy88lp?vgpWZ9?(S341My7OY z&6K-TG%Gumm9wqW_WcJR&cZ$Z6U&Q2b|PL>XeVwf3YX7^nZowtbOl`NqRx?+^9S2` zGgkIw@U9JD7i~KdTr)bBC=c0P<%Kk_$h9-)VypXd+v&0s3yVtZwp~HH?8!C3N4e5! zJFmmOc5v!JJ6WA2=rJPZMx7V!#2q1MZYNe0+RlELRT)Ug#aUi7$#&vJ5!<<~$VL%_ z%dhPeoIRD``;wF^gX7l=^l_8+Ux02`6GNQ51)`MmV`yWKd)aoLi@_P4XN8lU%qi2{ zz`m~Y6j1J0f9Xx>Jm)!nFB-l*-=)#|)(HmIUUgw`@$4IeB;|9<=atVdr$o(B=TOY~ zP0V?-bhq`G+e4kd~-KVUsJxY zt}}9YXHI;Oour3b-J@_DaBsY}I#{{?F%&Qw`B+hjWEFEdZ0AS3kGPeEJ0b)@6ZU)( zx2H;dsX%>OBz0~UK2MRfPXXE_^PrJ#udodG`x#yDYj|vXuWpBtueNm@d~eX zL1JjbI!SCjy=!{xJv{YV5uth@%h&h_IDy?0TB1jDkzZGZkO=CYN7cLdu%1}s;J;KqA#lSz?9o+7A=c^iaO87(7D#coSO^nwx&ca7UuYY}l2sQq*YAnm*Pq+Q(e4<>CQ zOs9SK6hQ7c=Kr}YTFLkCvXMFS=DQASI|obmu_dpS;@E6E7sBM28pP=f43ML5?PTi7zxb|MC2s@;A#KEQT<){SxB3zW8AG24#x#4n|9)w34D%X9`} zJA-ZK3bsK#`|QLilC4pZ&WV<^{Mx!}uen-XaWjXb3&r711@xkHGz_-gCQzAqI@P4j z0JKV;vOQ7gYV))K&^5wuxk+Oya!As40D4QHp8#TqmSg=MkmmaiAf+7wN555`qN}S# zvgzvdIZ|u4OObuGj7~9EaO7eFR%GLEG3Igk!{^aleXi&}s?oNio?|2UM(6#$anXqT`x_O7#T!$jA{`~!$&ujb z8#e9v5N^LLPID!oe-mgupe+JD189g8;Y)yY&h{%nzZVx604tA{r{@DYL7*ByI*z&; zkdC7k1JZF+D zRfpUv$3f3nB#jagSnn`L#2kjsmYT(&6kaYpj8>$neP4XJaf>WF@u2WaJVj;0sgkCg_Br+-{8K?Bo@BA}~r< z{LpYndFCh9qR$lP^te}`nQB4RxhR&rwJ@5v*iN*B@n38wZz!=7tyV0#WKuLSu?T4q z{M)hQ4K?LRPqfU%Z7u%m`*>^6=dGo?yK^wBdlQIFG4PHhZY{PGH^6z9zH1iG&2Y=B+4=Uf7wR- z20g|q#BXBG1p5gy(kXj;%__U?z2KUWb^_xrH}Fs%4CMw3vbsNPJ3BSv&}AYHM>OK_ z4o6QSa4b0uxuFq3$e|@9A%|NFRTYe2(A}VEkeI`52scQ#;f`L~poxxKXjUD!d=HS0 zQDiXPJBTvZo#BV8N`Hx2?d#ChKUVy)?Ys%OV~Is*Viy%+I2gR^ad5QT-W|B+OgnLf zXvn?EHtH05xObcFabj{h z29VponBU$lMTFKca zhPeWUxuP%_3g9jnnh^>XM3FKZc9|+6r^-#kz>5*A*%&)S^P)~xHOz+pyy`?jG=a#a zjVe_Ws@hZ&jyfICkYo4x3lJ&ofQZ4d-zkzNNC!4{=?*)wv1kjP*o=0)%yzD%^tVwM z2*Zhp>n2C+L}gJ)Fm#bUxhWJMS^fx(={5dt?65Joa%W?(Wq)3y9lT>3I?KlL;2j8} z-cz(5$UQZo%^qyGeP4Q_pdFm9Ph-x;B55;I{nb5gXZ3Dy^@Vm1Vyhn&KCqL$;av$| zj~N&B4&XU;z_CvtU*v*ol>} z>vXZ}&VkT}lY_R~iq=vv!bzT{L^D0uPR_{_ehAyZ5C|7d%A$R|UQh>zh&4NNi`K%K zgR94j%oxS_1Rj||;5FrHVy}754i>baK|uL_R7<5)Lm%wDk3g7Uv0Hu{c68vDojB_t z>KnTR-yA+e;+_*haTRpRu`UC2hjhBv0GclCA4hZ>B#l8Wh28>mrKEirc6|>OEyt<@ zv{=#_0hI~umjEf=*8x>ZS|^|vr6K$SAdUMD1f4>NWtV`tG?{q-)(c0B_ts}f^-Y3) zY&r>)00+SDxCN7(slB0jjtF5_FjN6+qIC-vOfO{PR@WH-_gs<)l8qQ}K&gTKj(eC9Rz_B8G)r*81q@;omo zfgsB^3CiXRDrW&o^p8;V?Bf?_tPw|vj$a(q4U}VMYfGQx#k_qsIF_Sm?K93|C&YJ- z(`BZ>rgy65Y-`!lu18XEY#dFDubE|w;-Ck7N7`6);U#Vph2<%2qR`7cCC-%^XKM?* zxiPpdUQ`l83l-r)REck3KbKvSuf>TRtHrr6-G8Ynm$T|^UsH2G6)2_x8+K5cx=!DE zPg+Z}XCxkLqf!OvWvTG<04)({1)zVCs!f*KM0^{N8f-ftZ6Xcy5!u z!|wP=cG=VMQEFZtk_#4=8M*@xWNn&`)(WOxh%uM6M4VP@1i5!(=tXo>;mY^Z?ETH& zJVU(MXYwf5591@ysY64obaI)qt6~!5$Iy+H@%`Xp5L6zP5m1oBpI|%LNO5;ExO=B~ z3md9$2;^fuh*Att`*y*-yxfNYy7v7eqov2RXMpfY=va9()G6-d0JL3fz$QH?j*M{5 zA$v(pYWiQ9f5=O#Oin#inW)TvqZ35#RM!)G17~0ySovu;=4+}x#FNV8olL1rY|M`n zzir!k*Nxf)(;s)(I7W%h6UHCz8KZP846e%Q)MqN7i$wgneFVD_;~P(Rt}R_`J2UfW z;FD3z7_Ko4fl3gP%x_-Av&FviWN3vOy3)CwL&C{b^^ zG_zPs#WP%XO8Ir-FO03JC!S-V@qkwRLu-`hYZ$Z~v!>e4ASnpWtTpz({^nvUequkh zlK!N%lDh)aYb9b}QFq+scZw4XcbZ!B5h>9HzU;FvA{w`tGiZ`hV+K#AT=t)>!G>-3L4ft}%XqF>2=gen-e$8? zPT9}IhL7KbH;9I(BLgkqv4B+TsYYvf44Vba#CcZoGw?4xF`ltTRoJ1HIUb{y98G)luh%JuhK^ zXEu3VF3r$LyX=P;^uQ?PGVqx;iR9RFz+v-R|FHQ1vegkY1MHoBmur2Cy2F921LunY z=^AbWAl((V7Lc}^Ujw9ruaM0Nnjxy*3Uk(pvI=(3-oY{(ewv za(f0g(EUGa!V2`w7yc$|zIY64Vj8yGt?t+)rrYoAs})tF@HX z`~q|yX79!@+<4Pt|0a}W$FX-K*v{1`cmGCk;}39?$_M*dj=hJYK}P#%Xqpg%L8y?? z)y-t%wK`Gf@(7z2@nJ5|8ru00retB~ zngEc}?0+hbIyaytdrcc4-FTB}%nh0Ln{#*e__mHdtr0vfdK)Q#7J5?3$a|Vy$ zd&S#s@Pa4;P2-A-LdyYZ+qK3(z3bItZKa&MX))8H-LGE5wu^D>wm0h2dx2UkDwO^f zo>O8cF9jjj4(wnRHu$*v9G(4KEz^khByev@}7Fig#{mt&v= zfF~g+P|U&!S2|B)-zKB0Jq&j!U2I8542uh=#DD=8?M2%-HE~{~8#@8_+T*Z&QZ|Tm zF;ZQ&cg^`i5<>tP+4T&J1*ZeTu9YZPJq880dTSmPiSx?4M>aB)i^T(3@&lr1KzB*W z3OMFa3g?IN6fQIuYZh2lSzT%;N6do-MdnGziVdBi%wd*Vf4?Rk+_t0sXyN8P94TpE z#?jeBGGe<3kcNYzfHq1gCIAhWQXUNZHwiQrkZx4w;-*fO37P~xl4ANDq_ooPD*;Vqc-1|L4+Aw+@? z`-3(8cI6DLYsDx7qz->IAa(dg1Hs`-aARCM)h+8fp)2i`Az6%h$1c0FFg_ZEiLv*K zGEBoF2c}15b%m|i;wOuCT)~6l*yWgtFJqsAFHn(_&!)y7WT?#l3rD+dSs!if*xl8T zbT&cc)OgKxFb>f>IfT(jLn$DQG?W9<)&50*G>ozgkQ+u>QvMfv+%98*uvYnAspXoA zDz8B~4V#)lw2E-JGb=vyv3jsh)pRK_nLpHZGAg9mvv@T7^8u-cr9#DEp1k=GT!7&| zSI=moGS5q@O4^6260y8DdfPw+Xg;a{%vLSIs-U8L7?6s>rna{zcJfiicBrnlU77{; z^-|no@6tl&)LdskW7FBmva{<>H`k{m*F`?;J)B@WvyMC5qrzb0EG^z7(s!nD3yjz{s~fTL1urOt)#y6 z_R9`o>kTEO&2=ju{ql#>)nxKZug-BXAqz~?;vFCN#XDx{Dze*}WF4&*3`K4l3OOB+ zhC*mx4TZ3U(T2bVq~-7S2(BMWg!SI-{2ZF=#2 zQ1kwi#QWR5OX|L718+%4UDr-?tq(HJ@c4QS!r#ZX$6IzE*f>0?=WLHAYqGqJH-)yt zV}aOwliGN*2J=~L`eDpa4+n4}+3PFl6EQYbY49vH59cxK}#%c1e2V55Z6*{0CsxIFaH+MJ+cU zziKB=l|d6uWVj+@Q)CaL7`hlssgUyfw3Oc?<<+#5SCR5;TFSFXc_J<438Z{GE#=!L z)6KH&ESCISQHR*~YJ@sk5bC%UM@rA+SLiF-sU+9s8AVPCY4VTw%H+9Y5YpK`xN?j+w>BnpX62X>t+^ZtU;Pi*$-am2 zPThLm3`n=0(~&+Vg?Bd~-Fp66K)Ut(i-2_N`8NQ0C+7Ue@}%j(GubwQlXbq<8{GoC zpBXYIm}Zwf)p{W<<-F8WgW$k)G{U+lI*zG*c44GuFLnacims__{m?p?NzMN+b8347 zfw!2qa-2Gh5Y`4DA0}8KF3l<32q`zNBf2GX9Mr9b`n=xM3{IrBKjW;CoI)u%T;7bh z?#-B`VV!$fB)-gcs!$HtPO&eJ6F=p(_7XJDBW83D!%dCNGi&82Tc%xMJKU|9$AIB; z@7me>ynZkY9Jj+o2YV1fpm$DNa}|5rfB+~?>#8w72E%C^^ada|B*!{k zB6V8Uh*6E_geZQh1Me&NNf2CEA}Gt(GjOv%Uf6)#ukI}E@N%wX&faSUrkK2!^vU}Q zm<;>pu>8Aj3e)0y{LqB>kBpVx+jyNP*T>*1G+jANfrZpJnr1Cw`m}=|{bh7-+|m zt9Mwxgoiif!2V6xao&Zao;bRXU5v4^jx}RvCUbJ_1m1|?Y{QAmAm2Wb6;0yMo4Y!* zGpE!#*bM>f?;) ze)`;R>~Y(9PV@vEz#Pr8F5883qWkUSOx-XPOI(NiU$+x=h1Fb>-G!5C`^)NJM2#e^Ya%u#^cbGf>Mf=hX=1Lfd4_L9iHIhi%DBR;abxZjM;3r+C|aL7%n(w{1r=_BZnk2o{y}6bRR;x~946R^q1#CEFvZ|hBPoX{&`OU>buAZpO;d(O zlE?P_n}tPIvFc{VIm57;dp<4Id=EmJt_~Fg(ty>)fOLh2BPmVW21vd8HS_d$fNqmw z7zpFL(?uu!tf+f-AoGa=DJV=$)jsHgxw+9Tq@C+!8P&bx5J{F8H@vYKx%$g)W6>r_ z!2s=`ow%oHJ?}8`s29z7_DBk$?RFIF0%N`8CnaUUG}7#IxA#MEpSQgBMk?Uf>%NoCs9<~!zCbfybA%{A#M}{ zr0%xJK)*52S#UCSK{loeaXzQ6`Vb&>!7c+m14tbdTXEKdk<5Sc0QBpY&fOfL_r`5| zqp9r|qj8|?%qvE;4nRZFBr%Hm!`po)bw?iFetbuD;h-p6_iYBL(Xo4K39V%P>5xI^ zI1DB09ESlKo#RXgq;s4FfOL*?Eg+raGyyUrX?WcBnaL6U{`Bu0BdSaUcqS(?Bd;^+ zY^!$m#+)C=k~kgbbVMDzQRZo}`1H6jR0 z1y74u!P7P(70tue;XEILodVDBak!VDc5+=7gvHxmUc?%5VAFygyX)4BR1}+ zsJ4?E-1-9Eb%deD53!|Awi7}qyX@80*Vt>rn;?n1z8zs{;Q&gnfz12Q1Y5a}CllQ> zz&B>8<_f(MF+ zVz})-phkbc%w9WMX8M5c29woDxg2s;TgyVj)=7F)yvVL9JuIH3FS-gooXssNCFPHx zg|qOYthF3itR*I_@zJ97NF}{awu4*Ul;pZVdk4;b+RxfOosEfE@6pfxOZ+SbGr`-L zC2ZBUqlT`v5Nv)XvO_$+6s}~`Twoz9n_ZdsafH>c28cMGj*d?y(n`1$r&QZJ9^;$2 z8iV#z!L2w8ig(Z-Yt5^i9B9pcAggmihmO!tYIrNx{z{(q!xnVB zf{Vu>h|kw+L?>U7*Ls38crqwukbwE24EFFXqXp@E%;6!ZOoVb)Ad*m5)c8a3|4N(X%KndJ-W0<(s>AUJ)T!O z-grd!Zs3#=U!(QX;JIT$<%9RK2LW{ET!hD_iIq^n;I~Eq?hXncbAgw|mAC~l z*4OGf-%tOe-AnHyY~E>Mm_f%Md)OskEgL=V2c#Q>9|oiwgx>oD?9B(mmuhU{+o#JJDhZ={LVb;eQ9Da`U zVE;ec0~})yZcKt34|2svNj51*CuUanO&IOs05-|F?T&eKJ6ydz4u|REmq*L~8oZ0| zJMsp|F}wjq>ODS+ad02=8yUv%=sjawnCr#HVQz=ufOhGzac?6sa1n`$nI(EiPgXne zIk$$THj6$F0a8ZWi@T_Emn}wH8^EVU_ox}Q!X{tX92|^9g|Yzowrk?`eigCQE5J4j z(&iLGujhOAoC0OE_r4mCZd6+jNH?l|3y}8X?*Y<5GG9fd6XFIyI!WFPNNIVpdp<0Z zW9OXiI27OVnZ zA$;)ySO}22FL%l_7cH!4B`LH?02vZ2?PyH2%j0BnKkn6cOylg6%1PeG95`J@U%1y! zllWe0Z97BpX;^5aBOwNfIql35uS^}d8mB|fF`dpKu_jUVP)KkXyK+06y}g zo4_w=-**{?An_v-@;n!iZm1~-G(vo01)wtoY6bL+;I#qL#Y2|nNO{V_{DC~>+de8K zjW3B(XgnazqZH5_d0GZYbK~oaG_dqVKzRnczv1fI_B#yFxr?T@4ztc>%i$EysM+vwt;ii9op6vO7QqH z_b|F|_whn+v)fTasPsZ@-X;OkEyp&XC1Utb0n&Lq+X{vFk`Qh3_#z;k(K{Q80b>YX zjz}Iy=CUtsf zg}(}9D4RAB)~={g>`la8VpV4oIhMVR`1#xo9$|4{HE~}Y-J18hx<3Y2a(!q+XAOM; z9c7JOwx13m;X%AI(X3shVuYCkLZ3vwey^wr7VzaIp~u+Fh~nxHO?|haLvo*2^nHuV zn#rzL+*&B%XoTKTE_`E)JHO^og{6X_3Whf=;qqW{%OM%4W(o%R`o9l@=o4nH@!AnPu?jx9$~}vW zS5$OO4~@hlM&eE*N=RDZV1eZfWhkOf5bk;M;75^y+Kg%ttwklXmlRYdC)S{@1ve(}sJd)t%UQ{(J$yw9j^voPGDnk< z0QTIRfmiP}fzOWa>9#YiFqXWd&~}PrqK}>_v9xyFprhJz3M|?gb*}Vh*$uq5xN|quP64{S37SZhbO`mJG+NvgZ4o8 zopKRG2H&zC^MY6HSj%g$X)2qsl3IJ*yLNI0+~o46X!a2(6}F%2iMi_WeHPPd6O#^4 zYtD(|y{rRc2^eP@UVzB2n#x3RH`YyX@62yP8^bxnxM%F=-f_{YlSAz4anD7cdpE|V zV-keGDhs=tl9$J2+3f|b1jwcB^5(1_VEL^|OVX+b4|}89J#2*4b7(DH%la0eHt~{| z0O?YT>j_vU*RpmSOdDle7%Q_@U&b!Pd?qg;VWK49z2%#hi3j$}0U3oa# z_BdJ4ErT1kXuyJo6FdnpEQmwBWXM3S%|(D>J*SKRP8S*YG!VD#;*~}Ic2@nq8OYLu=++hEZeueQx`yaw{og1kAIVE!K zKM^R9s|NB4|75k>6(+0DMX3E{2IbnHu(5xBF6~biYX1Sahy5v)&;Bx(uN5NC?TDfF zH~eV-8qfZCiDBxuKj{2o0@wZ`r|)^XId-S3C7YJG+i=PeDVh!4Fq0KV7i>Yv7fl4Q{-dyv@$=fR*+r`;Ay;&?sAl(kd>l@68HNwUOgEUeSZ%5*IcyjE$oh6j?)7g_P^ z1;dEDJX{f8|G1bcxbb43Z$uByE&~?hBohPJ;KmQ}-ubSL`&ja;lHB%q4eo+CT`Bi5 zr=>7jc6bdo==>QSxJ)<7xCklxIiB~rTK=2|@!d@j#c!FBIiK2pzkd<%47bAT_m zIe_D_Inb{#zN9(8b2JCIqx}(P!M)cUAd$SOLh@eWoviliZk4zox?&)g(6ZBwX=ZlD@Vxf4>PPf13USsK_7wPwyHQ(Ml4$|1ugVNdWVPr`I64wCI z1A31E(l>j&0!ZViA$WzRaTQ}T^vJPzPQF2AKz9S`khHG>dRQPjty0tiQZ783uW2k% z<&q7Zl{O4WY57vQCgHpl&~D%&ehWys422q+Rt!kFECZx(2>KU5ipK>KeM7*j2Je@E z^bG-r3?3(=idO)QaSb$0<$ zikAUt47(eUMxPG@Qay%Y*rjPF0#a*S1n5bz#%@4r$=?7{eNW5t(xw1XJ?;af*8MIZ zwQe_{T39p3>M>7G9^^f}0?_l4M?D~oEPNi2M!3Ijpzj!Hw}GBF&_M(J$v}hhJuX2& zy63MLkj5-Z%~LxCCGW0>pa8*8mVNUsR7ff|)(92?~`v4l8 zw5jeE2!0xi8i&w=zf~ntncCF!9QevLyIMBbhMx;Zpst*=aHKRvg4^njHRW+Da z0hE5cN`GqayZ4YSI;gdnc&=wp8+jcm=t0 zg+iu~6o=@O^GrW220;Frqh_yL@noiqS2v_j7PgRwuY087(LG|(od=uv4j1-{)U;O@ zNRBJ@{*3Y~L>otP9GhduKZ5v(XERc&R$s>W~D z4UD?QfK}}f3I&EQjJibZimF5mxf7<2 zp(5V3o~+W0c#~_y-SO+>HydUoFS(qSETkoe!x$*+mv}fQ0h7XtA=iq#k8Z^h>{c*V zBo(d59T0`-ri7ZM9lfmR?lO`^0URnq<0cz-er%V$8!t}1KLQi$GQL7W-cG0QkHFHO zH>33qj%9v*FUn3%{?v6|25V@WAzPdNd718(j!u8n2R}*DVqT%`?}941X$;%1-$dm* z5KUHW!LPjDCqMeSAHRD#iRCi_KTa4;&e_7BQbeB8Vo=F z;5>t$zr{;`)v9PeXw}UrtGaJAOSXt%G1om5$9k{6D>0<+N|bE_Vf?n~B$*9*@1?Sx zkLugdJiDe%l<`YOSW({i9OPR6y+`ngn;rZNwcW=rJq_X9FE9^8B)&n|?rNiQvL-Ev z=#>$77iHY?4sIknHvrY^XoQ7WD9e0M*-a9cYyaBc2FAbdVd|?77Ay1pKb1YM&OA$3y)lc6HZ=JB!?x?b<3~6f zGUM(@o+!kEa8~OGybvW1w5lAJit+Az8>fEpi)J+uu?k5%tH2r*SKj-p3Ug2OR>^!e zAh&k(dcT&tDJXrrALb}vjB(^fZtT}BJsX&p7wf7j>8fHN!`sYL6|=jlYJ{q*s`h*U z?jD}%dXe4`Y7o?8(_RCnUF{6_@N!ojm{C`IvzrKTEkN$41j?2K1-;>9wMl)vi?RcrldGKoPm2hot#I7pAejD;P+jW$Gl3%JJ#_s)y z0&;3$w(Hd62GJ&ddE`e|*ob|6dv$mUQ}^m{)z_?t@*}$md=4e^R>S5T&zh)@>p3SrReFi@#M|owgx;X>8>gJaN`scYh?fk#q z&Cy`|A9M4k{#Usva4&%m>w}g0BrndAjenc^rTvaINVxnES?8_sY zCYUj3eKfg{W7UN`8J^mPJ{DZfiY|8{%FfDQ!N#KXVBqenbVtjGkm2+%_WH;;f%`7y zhtQMv2rkaF%gIic`R3Fv%u?BaDH}n}e!I-Snzj{rYBla2fyGbEPO?kY8(Gh=cN(Ht_k@d-}YF z731P~-*NFCo&(el^iDt;0DBdXhP`-rUI)g@4D=B|+P$Vuc|MLb4SW62K(7HZ!{#ku zX@<@2P&j!v2ks`-Y)r5BryATQf2tRjb+@2nyoPn<)OhvV$Xds%Uj<~wZ|%<9=(f zG1Txzt?hdNV|=+6U%UYB$5#>l-NrC^0I-yLiq)<(#(QxGGJNvVq3Ho)V1JUE2=E9% z9l`RMi)OKG`|MOVjgUM}COJ1!zcYhapHxouT3-k6dyu@BDrX+eiZxOj$aVj@n;pMY z;r=B9Ih8U4TG2TvTNym^qw9~6?}3zBGW)|VVxK!o@W!7IKpk(M3#kA7=R2f@Yy+N- zX%7K9`u=k|wT^DNny7h{0Maq-BtV)Qf4@)1w4Vp0V_F_()-mmI%-dwsQgf^MNSuKo=jEQ764^`KShlSdFJb37 zQXCTJMtg2%MNH3Z5e{w*=tJF_8gs6kRP79ABzacMxuPbzWLPx<=+$MrS_WWqDSxb$ zVQF~<)OapQw4!j!o9wdf*dMe#TDEOg-1$Z*9O$+>y}hsap-VTc zAn&%{Efo4l-e$gY5WDEz2G?OE z14}5&u@L6|h&|p?c&Q@QYdbet_7$~`)=sFWBcYwqeYOjLor~#mNKX7Kxkk(GC~OJh z6^J3*!P|h^Uuj+19VmUJeEl6oR(!bfE?ZmJg2-vapp@I~zr_lM^V9B&88r-3*tLp_ z6S47?3=yrRy7k^b%8M5vFn)?CW7NYFoZrV8K}3`4gIo7w07E0-hjbAr#$IR~@pXUA z$k~OTH4AP_4n(i1G-I&Uu&M$nY8Nwt&*oJ4Ybxg z<#6O0;g>LJ-vM+;(hdN6OQ0iwUJ)n{&8_Ck2!+yK1?X0JidDEUP|a}TcV23 zr=jM`g3=U9xFpoRkGlO>b$gfZsPgGX6zV2F@{!U_Yap6}(Kuf&`i+2I(d6pdKDxoR zX<4XMO9j()!*5RemCMQvSh*7dB~ZiSjM}??jAG43!CIC=d4RajGuz6_&$03+=34m^ za_Jt{RDQVED~3uTQhiIQeED4Bq2v1}hC(4y{MRw_`Kh5&h*XdEo6pY-g+iow;+Xkx zo2FVpAyPf5R5-Jjb0=K}er_lfBE{4FO7;swp%5vaJEml>87hTH^-{l*{kNe| zh!j6fQMkoefK>1LwV_am6t5}8$UJLg9REuPS|i~LBPSFbAXNuH-0PsBR*2LGQ~51c zv@1Mxe0LiPg-G#xr6|a=3MQUl70e!bXz+nSdj~e>){~Hpqj&w*P%A|0w}kq1dhCv& z)_}P~1lgnFo#KWJ#KjP$B33z?NbkzT|IfCDJq0w%-BKJ zXzYLtPCN}3FSPQS2iE7-cyyNaC4hzae?d4fhB`~=h%qFn6T#(bJU6!2D%VgcM5;Uc&1ayYP>2+p zQWUQ9Hu>@xWGECO#mAI_jgD(#f44W-P$)!-dxT=lN!iw*tcxsd+B6fcn-Y~#cJ-pRoOfZ|lDEx5< zj*T~h6BsQxQVZim9Ey2_)`>Oh<)UVB%8F{eVL*&&#H%=wHYeHZM}p&;GXf$^An=hg=V~=)Byh$t z%=xNtA_u=YU2>!Wk`>_OIuiI-a=vZh%wQtI$VN}$Gd zCVVBmJ$_SI^4URONslzvRfwW>3uYhd{z;PYVZAL7t@~Gj@>zP;hQK8G?vPe`?|(3D zo3E{=YiL`|y2Idgw#DsBu6qY^nYXz2yTa8ik3&rTL{55vtQG3KYqIkm4OlC3$LENb z&pw)$=VD7g8DJdj(_NXcKDq3OAeg3DHWPi2q*3u90=dPqEkKqkeeRC~R|ayH2CU<2 zI0}tC3IdM zoG7~A(_M0;Dnu2|5lmxJX*fzGjV3J>s6S6XX1j5j5#=f{^sbYPH5H;LlLfPnHK!VB zssy4nXA0E6HEqH1w;LPNt=X#9TzkxRW3F(b=zeRuDF8zX|(250v+9& zC!cAJ!Mo{CTsqr2apD!$iCHtO;fD$i1osZ@7~Bkc_o_ha!7-e+&0#>xjDU{xLW+2r zv9UrFaEV~{vGH;v<4S>O<5q!&NT2aQi8LNtWZ1h!nvl~2+^TPtXEVnIVoFlY6(|U3 zo_F5C|iCDQ;NiJ?F@x^iQ_dHO#UQd>{2%}+F1h9$w+T3?@{xg4Qz&bB? zRNlGAXz%Y3-ef6@Sp;w?JLatr&B7B&*;abFZICpU+eU%hax2fKbpD3r`oKhM%=kgp zDN8T0PMKI{or0ms2?vHW4>r9zM&M|w3PGo3MpJys2)EPM>YZ-NOd$%F6wG2kauNH} zMz+rgG(?IgauE^E<428@QT=wpSvl|Vi?-zsejS5!h*7zPOw+iKqUAIO5Mx={Rv6G# z0_8uNo%cxoc|&GfwYe9LnKaZoC*Eb9vvj9*&cr9JbFzM56&@OOV8q^G9U-62>@dkf zbuI$*RiksYxD}FcooRGdh&q3vug>=yoxdT_c+t5zrSp2xdGmJi+%QyhjzW6Ns+SRq z*k!ZetbdYaXk~?>bc0OKS?tz^{HgrfJdvOE&j_x-E|;??skLF)SLHivBr{7{_@4J= z;j;}b<@~bHUSQHVFw@eZDq1?z06m2)v*lG}4+{muIGVb8M53e9zSKs_15*_*}0Knk&`1~ySRJ|Cpr(MhV8UlYP7pmiWNzg ze@a+nyh9<5c7ImFpE7D=C@Ol=pwrX()sTJaji(Y6Q~(;f01*&H6u_U;edfAWJ{iOVl@E; z+-JmM33(S!aq9e5A&Rx9uUIb_vGxlTkUCaRfmDo~#ev!G^gG{7QT-W>H5n7HEpKG#qvM2epa#h75O6G=?FivqFf7j+Hg|+I zY~pZh*gomx>ODdhrxq+by0GB$*=;_Bc=}&GSs`-f>D_EAO`$U-i3*)9P>y(VL=-BQ zNsBgPBzHCX@9dmY13Rtb^STci;rw2Q*pw@rLgYSHFq;6$MO7vk;Vu-YPq`n<>ppC9 z_j}z0legDFpHTNFXmS*Ni2pMf%>#_ z+SQOct)0_YUFIg{LX)*ZB%UMO$Dser-IwYd7UKz@YNO3|vQF>-SVMe1b+O^75NWOy z%wnSQBKBfQqB4A6540yo>jCj8X(QK5)gZMCEw}E;*

!@vqIDMwvPz(zP%(>qg7=y;5VB*PELDncMzj;u7 zUX7QB#=Y4rsSB}L`n-|mHJ=N8*hr%grMXWqi#=w<{-TlQD+1+;3oQyzE`$n~i&<(!h8i)l_t?wHdDqHiojyna}pc>UcVNSFItM(%w+xg$nyg(&ye z`pW%)k^8@Va%Z`6OAX-mO;<+Bt=GvH-C#&VK^&9&fgczv=Vw!lIX3w1nSdby=W?Vh88QenC`Ezl_qP2nDx`b{b&tC zm7!3G6wmdc@b|dW4243Zc&QJ?nMn1n>4rifQv9@E3clw>8y=m;PMv#`I1EE87j~)8PJ_e6rEX* zCz$EuTdX}6KiXv~1?gpTPqsA_&_j|o4A5f&jRy3DKoq`Hpwj{E6zFU~y9Ht&paa>w zk6D8Pp%;gJA`o&*N-Pitf_G`gP}CIx8dxDw!(X=C_vBrd8>=Wpicx(i&hXIjJOuVNlZ&zl&rm6f> zIVj)Wnr7k~Q%%{rELP?*HxGWzHCie}EoUo5UXGRb$(-iwdL2P>?ZUg}87hTHRV!4d zkIJ=1{VC5n;g^H3Ek)|Pta^}=_E3Cw#R_oqg4ux0> z%9lLlbtEoTCcda>@CF$#uTpJGfK9EQmxhC+^ZDUk^Ns!r5%YTGfn6N=cjg{Q+0C-Z zi@K+HF~z$U7+wmISF`Xsy&%UbfGzXpl3Mxjo4P43(-opcm5RJSg@5nL#DBH&cTqfP zXvdTc3NbI`OP=3yDfpF%?`^`j_kd=hkE+&as}QxlQ>eyZv1S-X`$H#=w1)mcSNlmw zr=^~$P}9c*pU>XnhkIRRI4eZXn*_7iLt&rv2}xp~bdNw9(^=21h98*9-)~I_+}~$Y z1;c;db+yS#AuzK3MY#1=eX2)-?}dg+AyWODQjLN0O&nt7Y*%#u-lA&_l|rQYvQUlj z4H!trC)#nd(7r7=OlSDnyXp)#g-G*t!K^0=4fK%Q22RFOK>B`2B9OD@!6Nyd$-}>^ zrrzYC5cA-xz^snJlLI(OY4Huc*6#|mALol0&%8Ob)BT3AC zuRwirKRHkk%0ujPs1=$$3bB78 zNtEPOfpYWtG$KPljevI0Ik|ON7aFb+h)pZEC}&&w&jfPr%q_v1Nh8*Uk5y)`OD4?1 zUuH{cLMdX+Jry>Mm(bs%o_F3utT8(Co~VOA5ued zUg=hQTUaptUwu|i^Xs%+<(k-h~NumG>UkRKmj0*8G&Kx(%~4M4zot=)8Q$J*fMC{V0o7cKGXesPFEP~ zD8ziv7tBdS^)8n5MJDUX0^!5DOdwtJjFe2eocOfTLah*h+<0|>d&<;!mk5n(y!|v@ zi(uz9S(9=K0(svIWcdtuHObsd@yN)f05ny&9Y-6KB zP)b@^Aquff^6}5NZuL>zWW-j86f65s_{VLl4243ZXzfGcZx~w)g+ipbRVfA!um(>Z zcxXU}H$t|oFrIo>+)ye+$_+w!`l;B`i!Hum=H^?WU*=c?o~M;k)T}m2!@^UDg{RbE zK-=)|U77N^OY?D2!tOT&a=B3!rDM*@mpu33-@7vLO{(TY23SL;<{iQ)x5JArpYD<2 zyVYo}5Oe#KPxB$7`3cWM^QD7@&ZDO0N<+;RqUJ6&Aiw6B^7%}f<{n>ao{~i&YOZ|A z^GEpiu1tKtpqk4P9K(!QikqNIaO*rWe6Kc|D@4t|s+7KXP?L{hjiFG86yH#a(fQWs zr9-XJ*d#xCLi)CqcYPdgHXIZphX>UPoTpAy3wsoNs(932AvV}bL97K?_;9aGytgWE z7sKOA3#al=<)D1Y^C!pP`?zXdHoz*2W8GpRM&k9F$vr;GTa2~}Q6K)6Eavj1*;XmG zqHc|>=o#2xw6Ypo!Y~=B!jZ*oia!|hH z$#*S!S0=tMsHU=2e+ahf55`t~Y}uck+N%GiM~?5?jn)cLuUC{quVLauAJrX(N+DAH zJR_Aq_O;GXDMYGY3zZC>CU~XNdz$h`!D04sez@0q!%ZP_`>kL$c__5hVM*esArV_0N^5^xePmPU64TYFPfncVoaiSzqjZ*|l8T4za#=PtR=Bh{2!$ktQLd+#B zjK+-Nyd-GlKco};T0CLpN`*vtEZ@66Vx(1we9jg={-MBR4;|lk8486+ah_82a&;EG zcWp9M3Xy7pQe|l9r+H-fP8dpsNI6L;3x;P~!?Q+MLrPNU)Kte{bh%2w42i>!iR4thlNif)fcgmjhbOdhxJp?iJQd0=SXx!caD^kBSCxQZhb^}xO1cdvTO8aG4TmIan8Fv zkedkP6y}~4$nVHG+GI)b$xI<;`B7o(H5*bfPD8SHebOkd5J~P8k}NrnIS9uwaU>Hf zA>MIJ?#lD7dknQgr2bc-mK6z%)OdLme5!c#B86xRr6AVl@b6ujcz;oOyC@!CDxAtc zm4osn&qq9_1~Z-JYpQXt=IVJL)u)Z73Q?DDDb>(i#7zfVLnp{Ky&4jUnO*Ap45dP( z{4dp`Dc5R(bqoHKZw=T%KT1*3E{e}_xk7Ygr6hm8A=|q$8l1q- zHcl+(gMv$j1wJc%$#7MOTwfE+VxsaQ_8XGKw)*!1={~auB$&B{?T`j9Nqwa>EO`xq zz#TakStW?Rq=zm&Zvm?HWs|!?r2m6t(3|R9qPy2u43$EpIwDjaMyBtVF=5J*V0se- z&XQ4Lqd@ak+^}Nhnib)OwM!bBR)D{pfsCJnvbd{TFQJo)q8{%%|MZ zq#wr*6Mv;(vD%GBKH2?J5dRdxVsV@)5Gg|f0Z6;34-~Hx#p|GWohtr;RXb6#p=#Wq z0~hRdnGBaNU%8}DF03iu)t>>e%>ulc%k>#^@p$n2ufSD*yBWBCe`AR+S=18uWA}k+ z&(+5MACio5+vg(Qh4Pek@88ar4=4`0O)$o;7^-9yg!E zhR@4}&jQ0oAvRuULKiJ>2(MUlW5e;7%Nl^qU0VI$FnnJ(d=CnAT#U{%jQ;qyF*>f? zJ~+|@BPS31YJ1mP;V{@A5iRKLZwo|ke@CE6fZi1-0_ZOS*?|5mPz|8>1gZt}SApsQ zvE$2vE>_xT(TtsagVf29F89EMf%SQRUV)kfgrv$ zUm!LF zXl=cy%>Rb#5+fU8{%$2WOCaifwm@M(=LkeA6$?}XXskf21m_AA0W?k^R)X^cssVJq zK&%Ag1*!-1A%U6zl?c=f=mLS(0-7KYfdBF98e^Xii%cxHO!m20p3**(1WLEhWJ!zQ zY5(?_B6#({D--Db+h@6v_a@;0R@Nr`7q4htzI-h2{$W?OX_ux+)-=_0f#^!MKw&^p zfoQ530?|}61)?kQZ5UZr1W>g=HlQm6ssS`hpjGiDQ>HAtv3dEFDHTnNR;*|MfPwCH z*EOt~)!eYcnzv%fqSou0;;G4Ec-ab!=9e#DylBY{7%le0pkn#TmWHMMVN`L%+aE&t zYP3L$7B6q;4{2&^V`IarhNa~BWC0B)|RH4h80UOgs*OBX<2k#Lkn!6m%m-T z5)D1vuckfquzt}e)tjkAJQUxz zzVL*ep}G3=@S&xF%vl=gKaE$8hiX;Y9!!n@O+rZM#0{7$gg?7t~c9-x#)=&0rD zPovcARwW~Wr&WJ+srl-k(j@irBp+)2cG^>>`Y)B5@~hNd&VHQUFu7{(w5R6IzV%(n z>3BKloRb_VX0~iJf6A)RtUfBV$B%B?AKgik z3+eExyQ8RhSy5edWy|7-ebkYYCn0kM8|(Cpyo&myzF*1w`OroY{P({4vjlOEM%UXC z{=9nU;oVbLzB@$SrBoog3rB&O-Q}_(47Qgose{`@>K4qqtY}HoqE&VARg0FznV=Rv zs-68jnfFB*^YNtfz9$P7^;YkqPo%ud^UwauLUp8sR zzxHm#LJas|2E#oFfoEtaAk-p~ta5i>c{j)>JmV{0t+he*FwSiBTdVCm2bwdQONOwQlCd)mBidGNnQxS*l=%G(cv8W0m7_Ob`o6?n>)_7~*R5Q2^HH7I zuR5f$k{Jcw+$Xg^^WG)cH1FL4`Sa*4s&@}WOC#De@27>1=4I?ZW!@B|!;jCTJ@t6? z{{Ea`(adUaI#J5tUXk^uQ7YE1k{z!`x*9-@zGO7wqC`p$&s`}q9#~&Zd&<=QuKNX> zJXA+&raF>WN=Glh{&Y;OT&S$atK)x)4Ak*Kfmmu>Pw?`@t$WceIlz>K0$pb@4m#ne z9_p13nNX|mWaRB;VQrPCv`ETlJx%)4UbUdlsumuN$2ZeArFmTPqxKyFQF|^xWY+$& zqL!OiENNP`a>cS+8kW|zptHf37oUg}70r(zLJ^682{r;?DwPtWw;4J!W+H_6*eOqG zhTR6wWGX9*jB8KWVd+Ob3QP{K2sSzVOdxXLD$fThbpL1=U2vqb*Ic1eYerhvTWQ88 z$L%ja&nTa#3(bS^V9a{FaIEedFoOO z$YdSLD43eZkLwrP50i(gNk>sN=_p)QJbqVuN3hA^F9MMR7XmZ8THUloOB&*`qI1;t z)Gs?2Sv?uK1rXCs&!fNMR4G}UDy2UUBxbyrcb?=z?FI`(?YJD7o-@hm5RFtWqRX2Z z)nm4PQf6^NMs{TBzX}A4{;!I&BOPHVy|%YM6R0XQfvVzhC#U}CMoTWFJJICl(efLL z&#S9g6_;%|OBnCD^Hb><*5>?H2MSZg!lev)V{~YpLElwHf|~Jd11xLD<%&9T+e^qa-WCy zmHXcs7byCdX$}AW7qZ6|LdYnU$!25{(Z@0cuy3fN8{>Q?~KhLdb^z!rYf7y8US+9QM&3nD?Hy*ul zPJHONg7FV5`~CL&etnkr{d{}ZCv(T1RQT-BqU`^?>{o-%8Fx$NGpDQ^*Z$BwGZJ5U z^`Y0h_n-6JA8)+P`+n!-aWh^nzx+oHZ=SpV-wsavoyWiT_mN#6zxb@rot^t?(*yuut7mkz{bFC#Xw9MZKj%#CVbQO@|9u{o<-PA`-kEdf&b`30W`+25DVGUPpM89ik0wQ9qP>C3Ji1k^^M1)Y?kOM8;!WPEtt5YSYC2KO1rhqF3Zn5+CRQBzROX=x_J)ECr>fX z@$2cCxzGN^ork#v_|DJOEOytdrVaLYud>sz-16hzi93F5KH|2qYDDc?^7H%wJ{vb( zSof~LJNpl7m;Ma>P;AiH+$91XGdcZA3^+evhQ-8IHM7*1RA*{?*InDfKTbM$@6JeD z&+=K5e$H!IbVb3OMV?Dtel59{=Qm6^)uG~QxnJt;bz*`?oO;{sbnk(;7dP(_)!nP^ zi1l3->|bEh&OQH! zd-h7h(^r-4cWgE2a&S*;JNelw{NcI^Zh?Jk$1Jrgyf1@O!t@q*E$!mYhSwNTqDjOQ zPcLKd!P|pkip%rWacS_Z<}H^u_6uwDvG(A^#jh*Z&rE z+uIw{_1HGGTi$@xY1VApF@0m$zSHU2j=Q(bV_Et3hd1ZDQM%{-oV}k`uYb9G>Th$m z<~z2>KWt6F`uh{F=gZ(#v&YzZx8h6t-#FejW^`1~Ildkpwr+C2-ze$VRsq)<4|etI z<9pNL*R%BQ1BwNlN-_E8PuJ&pZLJOteQmX*>8;Ou=DEhm<1^~lt>RCn8>d{~x-b2_ zmGb6~p!hhdZDdK13$qsym; zLoa69bJOqT;fkH)*PG`ROEq=J73Yxp-zRvMD&Z(U?|S@e>$=&m8_n((Jl1<-?U}Ou z_JbZ?T30EqfkV$VZLET~Sj&FO&+@uo>xk3)O=pjPke_>(?UXwG%51A-e;Ra{alyGy z^TAE*e9Bt;AM=#@t?K7nx2W&Cz4MXusVf$`QBmq^ZOEYTj#UQwZ*U5|A6n@KVxvOiN!|t+_=8+hcd60xLSnv2`)Z!|5yJ$KV&-< zZx1OLXgj7t``#A{{IK$OmGh#bMb0xj8`s&?z3$g0Icr+nzqa~)<{LMszLWF6=*Z|w zd)ohAdvV|RHVtaLiyND>devNud)ywqEB3~sJb@!#jIHV7-_)x|$zsFydh~j6&AV!V zQ|${EZ?8;QrsbYdJx<8|FH;<`E-=Vt_W!#7TJZLTXKQ^t@7ZwSlf~J_9RIKOlKNf7 zbxJJse*VYQbE;=Ac1wSPk5@agG`uU&aGD6)a;>xePs3I&ob6TJE9KMIKX%y6 z{$ZKXT^^^}b{E$;el31iel3ry{CbUL<7Ll=-Y+1(mixC&9Ts!qO`c5mCbfL%-GA{$ z+0XV~(@%VUSISO)J^1ya$$5?)pD+03%tmI(|jU9bD`fmGrpg9r5D8 z&~~7Vk}R1X{-=V9lW*!Igbs!K7F`tozgacZU1gv*JpE^)b(C)SvTKdEha6mU#iu% zO~IvOuh)sMb~+|<+F)bbG_8l-3eKA9MWId4=g+XL|6r2e#CO~KT+Vz==E(ZF*%cUY zw1IDs%t>0mg4Z5p+0toKL)XH2rnFD2li`0IkE~m!xTC?pD|#RQQ%>uNh2K6O@ie|f zjrL1Vm8?+rUvpBXU+X`u@B0`zE}Jz)9^RX^WA%+w-i~`l^=mHk0`5juOI_E;^K0L% zRr9#^a(_`}bopAvyn;GqTY0zCxo&S|-i15oUbX&`^O&3$uXD6_PT{^FZx-wO{VFyo z98$}%U%!jD@+Qc&f$L&b!*tJ+iHfw5@JkFIU!IrM_dmX}^m@?in;9-_%z7v?q7C-q`uJGEdtW)@V!!T`RPY9Cwy4_Cg}60n4$xR%6>WB&i{49^>5b?+x|%3 z%_F+8?8mm(HfcIHxKVg;o-*slU&c`CU-T^HnaLe2yEb)PO5x`&1MwNLuBJWu6kxnJ^fUdj8Jr29*yYgH)nS@!|e zbG=K`eM7CUa=gca(z|!{=`jA%&|Y`0rS%J)b^cku0Sz{6PI})mW{Ta!l@CG=05hh?3AZabc#OP5M_i+!HG z_E@)b;gb8)eMsEHp-ntph8>glUk6TjHqTSD*ZFU4Mjb5Lq39-gUZ?0cF3ZzG_dcKc zRe9o)=Vz+O`=zAkN1G=Wzdrccj7!>1Qs2bv>kdBJ_-*}?^Jnt*?YDbCHtVyOd*vOv zO^)MRKHnQ3To&f2+1uN1SX2$)f6XoDlex@}{Bb!#s!v-r*Td$NY%gM(e>Z!ZLvZ=`=b@r zD=zq&es(VVTHVj5PgV1TybeywHg!vtZmz{Lj%YaHWmtTR!0?r63$@vjN1jLW^VB6h zKONonpiJpH6S?ZOYs>M7uTCMCV%c{^=k)B{h9 zQD}7Pjl&WKS%$>f)p0H#(oVJ~>#}!@)#rBZOIIbW^NosGPG(&gR%S%_j|!(fBPX2o zX0gpB>uhmT#c&O{zbl!K4hwUh{V^s#rhanC%4_9av;a2YH)@h~ust5L4YbZ5hVQPzl&(^=lFno2UCqLAA zD%Wv&{>gRiSffQ=M{8F(VEkTo=3~Q%Q%R3k>uYbCbsCY+c_Z3=a(+>cnvv_@AY0wk8+O2XNy0#AC%#Q;a)k*(EMrTahBZLk!kXj zt=qh2Qts)@CSyOjygb}9bW3b)`$nZ@U2~is9kDa0={GqJd0#4zgZ+{8F70v^itG63 zc$J}f>ROd-`>yhkHF+M$+#zEfzhqhVX3L#Ur3W`mJ8YR;7amMV7h^~{$EO_rBP_7OVD}?V z#=(8vq6ZAg^r!Pp*5!pwZfBRWPV@GxY@gU-(VN%u`{RJ(X_lnl=d|MUgO}f)yqR-i z)tgyvxf*pyJTb0w=;l%l^U6AwwtCzr)$)Xi=fe&pjw^67o4gJzf4woF>A<5!U#*xB z-lE3vGV(g`wd(|rG>_ice0zT8=;cqvLL2zEIWaQo;K-!y$?KH7AC>##9<3V|d1928 z+%NBsJLY=SsppZnyzf4{L|y7pJ)5lex^)&M!uJ%LwX#b77oOu9w3O}0e#)=AmPvo+ zMY)V8=S`Y;X4~ebxAO$gS=V?`_1E%i`Ps5fk21raRgd@-vL^kqt`jrf8d9m~;Pk84 z``r3&pX;PhiZKX85}`ALmVb{W}V%2mm&$bM;Wvl3(a%KcI|%qsmM zpviI{2h?y4Kk-q`Ki#P?Da`SryS1DDkZEA%8P%Z&p^8+*Lz z;@0?6RKe{7I(8no?n}G9{r>CopjMB%M9%IqNBZP?F2D8)^>GaxpLMnDPieo@zd!ey zcWFRW>l#NY=Zah5_Nm+p-(}Y`v@4zRP16;pWgX7+Js9(|{`VYi$M+qoes;wq*Q;`Q%Oe0wb`TxG!?%PVmW zvu+AV?ffw~+tvNfe&x5->8yUAXuHQYz@mWrT*sF_cg9wFur>3`L5Z=c+_#oLaHg{7 zMynih|JeM!>P+-3TS<=h+>FNy9$T$(a11>4W=mV^qs}c_Tyr|T`r>WBW1ENWxL}Z+ z{G4>ZjYIn8P4AI9qD_vGe`4xS z9iJ`mOUSm?mlj-T`f0dtnqgD6rzkUEVB5;eJgR!icK5&Dv|>o~X}>>>uXifTddu8S zWzJNwWSMTw2K4>Z$lW_@8JEG~edl=D{vHy)WBT@x@`J6X$@c!#PJSzoGZUZWZ}6x7 zOa8y=@TYM}{&|`8*=ywe8v3VxNZ;rF{-=iQYc&5)J~_{d@7jCTzPMfOr2Urd$j>!> zgDa2zvEcfDwO1g`c4U;82d)!vL==hyY?b}H!NHk;V8>=!#p=a05C|^an}w(?fQ0d zY6M@vE5a;|7g0BTa1HIywohBGz-u=wjkFp0N;3Ic67X0UT-)_lf8PsxERAwMZ%I=4 zc9Tqky^QJ;)W45Y2)-W{ye7ud2=8nO`=%}a(VX{@d-^jC|LHvQ!0SPvPo-QEtERwL z5Se;Xu|1YXcpVCOx;3onVCvyn@Jbm=qn+?%J$c}cX%_duTiRI~yRk>;PxBX5ubX?= zdx9}f9e89P9UG<#HutcXKr@f5#^^zswto=oT|!5-mQTzuom-cucBg6VOGqhM)-w_gL# z<|3Wl%sud0B1`x`Vd%L~KYJx}5B%dJOXFSEJRFtPlXkM}tj^-|2mbMoocMh0s5rt~aH_yt4o|5d5*$j*0TApz*$>Qxeq6hxt037?M znLC(0=`qcZ9vAiq?aZu}+uqTn9X>86^vE^gdtC93rXHT*cz)~JlXFMl@o zzznoB!asz9IkrFT%s!?bek?rDBdDxFjrfbTE*T4 zR`;1_l}3-ug5zGwEXxZ$e;*gT%eAEujx1~s!e`$z&EkFbVSE0|QwBY-3PDd_FK$)A zyd5015za&y*T@?#56nH~*dELO@W9=Hr4d$6$eKOm**x=hSUmH=AA0cs_V?hUI{(yf`of6WW3H!+@u~~^uV17WUXHo&lZWKp348=se+!)>=EYS zm<;n0&D*Jp9;h~W&X-I#z}!;}J%2x@e*fU9{tuoS=z((r#$Iab;!yMc)I?7{_6Sw^ zdaAgcxu+I-;Hm+h6(7Ibn|o@b2i7R?v@2EinYjm7Fud3Lv#0Jqv{Mf~A?y+AeE8#Y zb^xJ8(|eNo=wThjEps0gU5$0Kq&;xggQ0IfEE|F^` zpR0}0#bI_jCLI^d_W$z0s$yyUdw-gt$C5q5=IUE? zig{LZw&%aHTA=6eSuOveodERwecfn<9=IaFR-w8hn=DD|6Ug@PYaHy!)--O3xu-RH z*hEJ<`8u~j&rS9S-;LZXKPADm9lp-DMUPzPJ4U{#*2ZL==bm=N1NW<@9zHkPqv!8g z9Y{Nn)!r;Chh-aHFd41L|%y?pG>V3RD~PIvS`BAoA2 z!nZR)&oO>Xd!R=icgLzndv-T#rzd(~wTCTz`3m_=+u>Qg*d9w`ANH7nef)5nmBrk{ zmTZ$ccfT8GYwqd&4<1OdG**B|_Tl$xAiJ&C*~iZZ_UyDy>VZmH8a>z}?3wFUf!$mr^$b7{tPD_}I-@hQVkGsz zotUK&TVv1iU2eI>+%xDOJcEhns&R&kc{@YUBm4ZiLgT#Vo}uW0RT26eI%B+(xd$s_ zEXwx7XaehIVJAV-aSdmC`291R(gu5%sO{#S5$N%SNA_X2=weB8&q(6AUb9g$b8OT< zct-z&CmcO;Ts8MRY-HY_G5^rc*nene9BC){v9n7xtD&6pHG7V^WZs|gq@CpJGl6)L z&x%A3+)==h49K~Bn|W3gdf+M#p48_DBs1qHqKBQFxCLG+bHKcvX!P7>6N4=V2B!;m z*pde=n*I!J5_%liBg~%<$I1jmo2*fM9h;0ExsJgaZth{X1+0cPqMgPmZe=m|OeLN( zsnTUO_e>+6c7|TI=AP-q^VMQSCUegW;_=EDp55FtlX#Y7Xq3a$!`Hf5=z((-w&p8u zC3C*dW_v8*9dU6>{vIg?J)77g+$SVXyyInlEaspm4|{~oYvS(>F($`?_h&BKV`*dy z0dCiv!wQ(T!#(r_#tXJB!f+cMGs*L#c0U`X}`)K~FE?=@bR;aGKP!6g_Y?ggq`DGqA-tsb?8_ zpueysf4r8nJ(fmW_6T(Nuw{qL+gb4so|Wk7%TBH|>{+bCntSH$tU^yt=1Iw(Wm-72 zvAJh8dh)SH*a~m`>TK>=!}hRyE!IwI_H5mi!lO(*{9InkJ?xR$47b)M3|nI|$GB%5 z@xad|Og;R#uSXB8;jmf%n9RDKw9XsY9!ukS7L<-Xt7i4)ovDXsZA6b;TYl8bes+Ud zf8eaq_mI#ZbI)et8Q`)kzp01!nO*W(J1~FX9Q2tzf!#7B?ekXjG+>Xgr>lD?*@+%JYV6sJM!o0?(}I>&f(IAA0`Y&i;RBCk{QZ0z=k^#R+V(B(2W@^wbufaXro!HuoGv zPj>bQ+oW|T*aDEW9kv9p`oMhxY+byrbu;(GvptqZ_&>&J*|U?Am)$V+@Hu}NJ#x;& z^)%jW&L^OUEtEK}In|2yHudoNd;~r4Z!qlGvsQarF5_;~>-$mk$Sn9d{}HpSW5jbT z{#Q+N&vD{8Y@H|G+;id|JST}~MZrF!%-cDIp1Z7ua6eJ($nk@w9zOQd=z(<(wrYc> z-!`o?_ncvSERFDA1L1rxlg=)$x#ui;U_Wekp3Sp2_nc#UER8A9!G53eWefWzAnDvV zj~@7ciqO{PnWNdstv&p>UqDX*_Q-68nTs+$K5ud?c%Lt#M`pbW?aCG;-46F$LXQ=D zgl+z~Q~*0TNj+E518Wa#$zLn4u|51+3F8WF z0dJg}w4LkdfmIRe6H>hOcykXsRaiT4Orf3RfA@D2J?vtGTaQE2@0z!Bi|w;C!atLR z8m+(DHJNpcO&8|*dpmc~)0#cP*84&N>weO4-DP{&?}gdPUYR}n+WjyaJM`Z49K44f zwgdNUx6B-Q*W|eKxpAL((oWcN-Q4qlc-k8Je=+wwB%a4A3h>_XRx(Y=Xhqyarb-Z+?D# zCGB(%Z#3nL+4=R2cx+DX^)UB*M~@uWX^WKQ%{@OzJE?mFMVotm5)b^`&(y=m^$R`n ze&cr2zMb#h~!FVKu5xx>xR3w-s08avEGYqPQ2U^_e6Bg}id zvTb8cJ-k2gN)k(B3z0Qx=^j>YCXs7gCiKW-3R$*hS$61=SvKi=4m0)eEPM2@lN`rY z;rMnoC6i`lHp{X%%gREsN*Ds#n0k0tR`fh$kL>boh@5(Uqj^>~lGXau(}r2iva%CT zNY!~+%sn}XC+q3r&&@sX69B!2*Iw?s)7+B_J-65+9526-R%=W>d|bKF(^k~*^9w8X z0|q9Mz?3e=PHb^i0bTunk*rrOXz}Xr;h^f#(}ktbelUmxO1bqTZTNy!*D|(zjfBiU`G7DFcKOsgy*a z_$tLqd`r4gDU*e=L@7^&vQ;Tr#R5}6DIJ9prIhwKP+L%#=_wWvH1lS18R?e|8HcRw*gc@R1%;N>!m8 zRLXFnTvN(+p%hX|KDb!2t*BC}31x&*x(J0=V|KFDfdBXoTWdwF5{j2nP6=g#Qs93^ z^9|;LYAdCqP}(SEvrxJ#<&ID+RC+Y+6<#KVQ zky4rqWtdV13WbmKYO?8bOgzlMwqrzT?HAOieOMnJhAp?Q(=N16kACgB1l4Hm-<~NU z?X&{VE|7LWxoxIAH&Z^CDZk7V_Hui%$z#z}C}q{ydkUqTQYHvxmQvOWWuj8<3#Elp zehX!+Qu5`|>0OL3lC5fG;c2C)7A6$0^C&YVRw(|8IxCcLr6ihAU5xLNO}EL*dl;># zIzp+cl+Hrgu9OKv*`|~oLfNI1Cqmh+l&lUsYp+tu3uTW|dJ1K~Qf3NepHhwq<$zLN z2_;S`x$+rs+o2R+q3l#jAE69T$~2+yv%r$wof&yECXZW%r=+5u3#Fw}(m8U#T`3+y z8K;yMLg86ylFb?}JX;hsUnl`e*>2K~1;*YmQ&Q&V{fSVNlTdiNO|t2}%3~0B_yI&| z-4XsTd?^p!wmiT33Qu{JwMHmTM(KGXls?Mi=)_y${mEvTT;*E{kAtF42&IBjQaJN= zVw6%@DDg@eE0n%UNe~K8hwl=MvODT?iURzpqoVwUQc)?Zgi=WP zNhmj!vPLMkm69lw^hQ}j&qBPNd`cN06bGg36iOkbSQIwkR#+*ugz`&etrChsc~Tca z$dFDcO@)#{Dbs~=Rkd?pDE*X@zbJ2q*STb}b?zWMRTQ;ZD7Tc7x)^Wgj#63+#ZmPq zRw%!f$JvEbM&*H59>TUrd7cWTzf#J$au4rwxn%o1QFy`>^@vavlcmZQ=PmbARJ2fn zmGVI-sg<gEYj<&01+Ddo3NE-NLM8>cQRrGik-DJ4)S=an)_C})(iR4AvFa#$!0 zm2yicXO)6~c*Hs|R4IAfd4G6S>nB^EGQ!hSQJsWRMky&u@^%_1WvWmLDy4{6p=v7S zxKL6kC7ma4r@m6!38k@8Rtcq)Qr-$BP$}-EcsrSuvQjA4O0g=6K#e=ALv)X(5!1N*O1VoJy(h!>JrfStOJ+N_ilZ z>`L(}!>P1Ni4sa~rCbzBCZ*&q%PBjhbQVgeQnm=Cw^Fi{+ zlTxM$C9_ga3MHFTD%CXLmPaZ5gyO7}gF<I<;@p6@vq>org>pab&V<)ONu!j*jd(lR zmEzNwD+QDiE|iz5<^4i=rIfEiNvV_?O?W$5m2z4rg_YvhlzXNqWvWmfD&?e53ab8O z_2<-UYGwJ2qjS|^M&$O zDOZIuO({+-cst*f(ncunloBJ9_e!}al<7)wXvy1Irz0yV!_8bu15@1Gg)~Mg-qHiN+T2rGNF$ZvAr!c=MvuE}XOvV*g2jP-EMOn#k&sqY z7TgfitkF_Y?JSgvYDX#Pv1R+0n|YMt2|bKsAI{R_Da)Z0H!rpima<6cafeF5rW7ww z`Wg*}mFzS2*-N&g6n7X{FZQuSdP>UrD8&ti0a;t6$4%B*DW$=ak!2N-9(rL?Tib*V_mFkC9`(gVA&osu$r zu2kG*eX1)3`qPZKQF`tH3OeM(h^$C4#T`zAr%GYF4UI)Rxnw); zp5o{z3cCZMHMRp(yr66(hUt~LO-om35H+N41yhin|^0<}c!%#{| zd6eO{4Ey5=2lXcVXrmN4$&`ZgryJW3OE6OIqNrN&kh9kU>jPt#?W~rRhdc`gDn*{% zaKnc!yUF8jCEJn3V86|g9&Z*lnCHTL#Ok$qN*YR6Lc z#~Y&3v#-`j%3GcoN>OJeoEtbUbym)kiaIN+Nk!FXkW^I5aQn;a@a zR1`JVOo7`V9EI|POT`UNu-j~;(Mpk}SBjjfhN{vd50_!PRPegPzA)@EQ+6vwo;!QY zlzmc>mkYxIsiZ&(R zD!4@TVqa}hikLoHk>Q2_<$(;?BG?DEj4MAV<)wl@W^c`o1+3A$hw^|aMb){Fq)LKk z4kH|-;vut?;s$42GxiZ9J-8-pR0?}y=q*-J{?iq<{;2a^QP}5T=8b0`*h4(ODzS8~ zKs&odI|-~uc>VI02TW0_&V6M&>dbYNiX6J3qEyt~S0$;)%Z0&#^#J>$+9{+IS&hO{ zahJ!dpKM3V3b+7`n_e!BI)rI3$0evNc&5V zQo^L7dI&R*&z}-(VDniH91o$0foa8qwRDDg&MObz__D9G0w-8e<~gH0as|+eoX`!W zNA+i@R6JyTdP>DhDk-EQ3vXyF6*ZqBfsaB`fl|RNqXm1<3#qu3WcIsCVX`3&yWqfG z6aVQPTs=L+rBP9GScY1%9lQ#|Dq<@Yb-pXb4NjGdY=184ag&R zU%7Ow9+)h+DMcQ3Lnh@B7W`Yflm^%S`n@rWu(tT$C4pzj%4;9o@b3%Ys|dIq zU>kZ2u01scGmpQT*AfhkpB~ZFWkCw zJ3ve9^@rdgS*}Q>=DTrR#Z*>7L7|6a6(?El)!LocRDD6Ahh&vd6vV-}Myjm-fZ&_lAyldN;zhchl$S!V==9+CyCtzI``-E22%Dp64AAz2lXvWEh)Eiz-Z zC(bI%rW04uL$cuhMrW1wTRu=zodks*lI2UrxiJxL$d0Stgkzwuj#D9aMQ;& z^pLE&NXhHhsP@)-mZ-TgK~U%+S@lSk_2h4DH1%9i=pkA4NfylcttzW}2=5_!NLB-q z1#@0g!vuvMlGP9?xCeu+#^%H9r8z117lv3tp@(EOB3aq8`w!Dpdhru-^pLE^X5)%d zS?vUc9+K6BWG()gkXuua1%)1x)f6c>zhJBPYf7C}DyvHmuA+xz`ID?;1(uK1)M-JX zhh#M);2>0fIsg$qFRnf*KxDSxW?k9+Cy$=j&_A zxk|4BH1$GI=pk8ckaA*UV&D82%I>Vyt&qxc4~4O^pF@I&WVIz(9j!{lX=@ilkWoBBW2C@0aYi|evYOh1ce@w)j{hk$6BK$#H99H^j&j*6v)GHzl389V%Nc%T!Z!4ftgecJtUKQxwANGuL7|6abyF0y3geof zvIYwZJtQkwQF2_GS}rK`kgO1-;A#$A*r#=OuB)swfQ1s8?##B)RFyE^7J5il z52WN(4_2GuDr<+J&_l9%lB}ccZhC6!jiAs&vU-_id8;hve!Pe1Az7g$D|^3d>orwh zQ0O69y%h!R!tt7`vIYtYJtV7-qTqP--cz)argjJlJtV8I*|@5!tdD|156KE6Suie5 z#k^78H6&R)3OZz1!MSQ!#=<56K!pvfw+86)NkApwL6I29hlJ zjzd$W2JmsAhhz;xDjVAk>*38D$DH|J2ZMjKpwL6I29qr3g_Uw?YKx%IL$Zb-m4USk zN7=Xhz*d^NCn)p~YA8~0rm!c5CL_~q)l{Z|Okx{)2sMmQxf?(7(o_vWp@&ezRS%&W zcY7_2)l`2$p@&c-kdkZk?aA{;Xljk1&_k$^NWp3YSz(JSHq+EiL7|6KeiTya838r) zN;us^Q@P;RN^C<9$r_Cm{Im_S3N)|tKvOLRg&snMBPA=p#3Hh#rsfF>J%k#gDCo=4 zzCY(`>XD$(V{m2v6Q@r*ezQInDfWQdx0SJ;oNCQH?BC|#h8{wVBNUkO;@^OqQs^N) zj6lksxuF^xV^&-7cNGA>;9z)UKM@2Esr-1PWaaBs@|&coW`aTw$(n$a>73WpI6JfHe#sy_T8mu=`FS+kHboxPgcD=733YBo~2Sc_Kd+YA=N@G=6*`i40X-yZ0a9}I2JZH&tf@pn zp@&clk%I4u*b~FWDKo@-m_SOeQSfLmpodV4kb=s?_UO~N_d4r~pwL5R?_#7NM{c>y zW-oe3))J&l?>G26)j%5qM)Q`?Lu$AbDOtm=_fke`YJ;HAL$a13WjcE`^-xggA=GlD z)esbVNY+}U5 zti77LDk$_2YQ3Uh46ycUs^C~YF7%Muy8$Wopf($`*^3^MwGk=PI|u&WN6<)5k%b;o z!%axZ8d|@39IvT0fx?J>`CD>W-k$L#XXYna*BK<%;0rLJz6@4y0t| zVfJdOv!KvJvUVb6I(s#>MNsG=)Gnk_v#ziw2AI8?GLGjxL=T~MD+(Mido|TWQ0O7E zcMnofb=Zm*v#G)<)B9fZ5Na<{&^x)=naz3hkRI+sst`jUFHNHjF8qC5p^YV?hv*@d z-;b26{IYSUXKU()pwL6I;*c_(^P0*u0TK-c^bqO*QjTmN%&N(j>(^_lwxG~MsDnt! z<25U?d2dZc3JN`hI)qe4mIKwe(>qN)O~nfeJ%ox!Dl;Qs8`JOT4^82VwV8?@LLElR zbk1waClZ@7podgG0V!GeORg)NH8o05=pk80kV?xMg>k`(t*H}&LJy&iA|>xP()eU* zp{XoUyocx^)G?%>^00NgkuF42odks*GJB6B#U5~r{jfD3r%dNOdI)ubP=KDoSz=0| zhxG6yQclbb)o@Q^7tG)L5%|rbhv*@dKZTU6yj9hGIW+Y|Q0O69r;&mhLKgfSTT?kF zLZZQd9zvZ_Jxs~=-+A$g&tDF3#y0k^NrAPPqS$1i=fa$vMwTJT0>10 zj>c{q&_k$8NKIk8v$7An*od^6Y9%Q25b82gKD<$bS6EnQP0bV(dPohgAjKYVOWEs& zkyEBML=VZjij-Ud8aBM_Q(M*Wgvde;&&w@e^q3$6i?<(8o^Q_GO!xXep2c{?6&_k+mA1PUlS9?Z8X=GktdIbA`xE+;z-J^2ehZ^1 zFF~P)WIabpe&_2LS}bs&%IYB~^pJ7AAX(1iV~1&KrJ&G5vR)!3kMf@UyPs(4uAtCE zs8>kA^@Ke!bj|zaou+b5hgz`8f`?GAk&-Jwo_0?cXevNZ=pob_q-yR^#xj z!^JffDJb+1>H|`8J*=6xRb~D@$`fAEyCa~-;3cy3MJ|QKm z0rwl43KJB12=y5$xgHL1@EfbCGlD`7p}rs`*F&p|=^Jaxbr$a-dIRpX$b&_k+`5-B+kVU5z1+g#p5^pLDn zNSWS!X=;I>&_k%yWL$9fr74?vJPSR9N`sV~^KkdoUX5#npwL6cm6nVP?!GitcRtTT z56Mc0lsw9?+Gr}r0#2caQ1JJ+mPWbSz}=Uoo(T#)gvx-FTy5a)OH=z6@+|Za%36&J z9B{v(|4U5NB2J-)R3oFJeTzf%jO}Q`Q6nY3{ud=}L_?6o_O}!8l zdI*&nDY-_$YhZj-HRdnpS?D3v$bytSzu@&7nzCBKDfEymcxPz7Mu7ufmoiUfbrBSL zNLDsQ!BK|SrD*EDpwL6IvYU;on#yXilJ^ijBr6BWf^lgoUQp;ESviq1U9ktLESFV0 z3q2$&7s-MZTT_b!g&vZX8!0)XV8zyy{c4_t9zx|o%Je=;Q{x4N9zx|s3aSnptk{}L zxrVFgA(R7BrYm+mRSkBk;f5YkjeJPS8PzrRbuCT36BK$#mLpQ8)zDO@wLA+wgvyVU zX*D!;M^NY?loL|28WZYOc&MpX>v$G=2<42F1KZ7>82q9N+~@xh1N@f+g&tCk0!Ybf zlqy_kji#2Z2bTSO5IiKSAX2g#u+D3$&jwDRhfsx(g7px_w*O4uy_%}FkyGd)RAHpj z@!f_Vo8O0OD$gb^qlZvMkaA$V*%QOPuElIOsJW3SDD;qO6h%r_(GFgG;cct_cb~getDa1?|Fm zI7C%rYAnw}52;28MZxhJ+iI*)Q`Xx!g&vaShLq|3Mn{!3PEhC}S?(kY?l&}bZ#&OI z56LQtlxgKP<-L#wv z)Zfb~^pI+lRuohou0)#3xQ|olAz5BXnOU56LQTmQ_w= z#R&>MB&&j1mZlyE3O(ef#1)Z(?`-5Y3$sjrN{k*tRWhR{no;N>unV`@^vZ~T7_P4j1>L)1lkgRGX3+^hzRn~Mt zp@(Go(JVGDP3;vFdPr7vq~!03+KgJeAX;TT6cl<$Rt=IB)8lTerV1bAl}8WBs)>~8 z%BHChL7|6GwU8>o8U^y&h?LDVwN+5)AyjRoiLe3xAcVskwqe56P-WvfwCJRh54uDD;r5`XsApy%kqAl_{Q&3q2&O zfmzmemE|EQ^pLEEG%KjlZcVio6naQjBc$LS0JgD}+ke=lvLXb99+K6VWZhYxZkDFv z1ce@w)x<1ox61k?DD;r5re;~1ay`uZjUJNauPAT~&y(Wy9+edⅅr5W{R?8RJ{r< zJv6mIQ0O69&DFSo%4y~2qp7QcLJ!GmL9%Y&yjD$9b_vjHg8@Axt0hwK9S3ABxs*Oi zQ*{M}9+DM6vKB5Ix=K?Kf_UP?~IF&U}Q0O699Tf$~YpvJC zU7Fe?DD;r5PDsH$Hc%59jqaqWCxSu`$?8n9KHQnMOjCJ}v4+@&9+K4sDS5mqo*!kY zDSttshh%jnSx$D|J2e$8DD;r5ZYs;j`V!l_R{0&OhDQX29+DMIvMPP6F;!C^1%)1x z6@nD}ECsSwKWvzFr^<3X&Lp;>hh%jpSwk9~3fEMCpwL6IdZ;WoUin(j+p4MQfPfP)gcpd_)LB8Hhh+6aN*=GtJ7dafD%}YjmH|B^E0knyTAZecrm6`FJtV8QqM%*) z?q-0h;Rr#Yhh+6p6jUSPafF4YRtX9{B&#n{^83o_&NY^nR9R;Qg&vX>MzUOUOxUg| z>yx}1=pkACkV?aLvnTi}9Zl5|6nY5NAE{J~fEm?e)1Dienjk3j5Nd#;7-Y!R=gBHf zof8y#2sIF?^nkDpD(|kUVS9?J=poe@q$sF7{8gr=db;=QL$Zb=1!oF-Vz4Tn zVNrm}%66JbY(o#p8bPuQMLx9Gl((SJL$XF9m4dYha|2#)qp9YCLJy%vAq8WCtz^Xe zN17TeDD)6&G*WOiXHN{vvfQg2p~kg9Q0O7!3P%cN6y(9*fNScopwL6I#vmon6!Z!~YPq1$L$W3yWm*kQJrERn2o;HxX*D#J|12LLdI%MTl&nVHr$5ta zs*9k|L#T;J$yIb`+EII*)az|l2?{-=8qr9}YTSO_tB9sv2?{+VYZ6kj8t_wMO_eyu z$Aun3O-9O&?S`?f^W2zIQ(=Na522>09zwf2BOlJ!)ImX^hfq_IGCfoJsJW5)JhWsm zpodgrn#z)Ail%A_3OyuiI#RM4aHeP~N>Jz_)C{Cd=Z2=v3kp4inu(O08ztG9qN&^$ z__)wRs98wKxzR22xiJo^8tnvy9#W0jNXfZjw`AT$OMSVq5NZ`tK)|-~`Kz*;iW3xi2(=n1 zsJh%VmFGIw&_jNTwIeXz<1vHi61|JuC2(XNL#T~N$=SQW_Fagk zHV6tmgxW+X@7o@kHT7Lk=poc*q+o8qwq%(9Jx$fR$yM|aYKzJON6Blw>T7DYpwL4q zzZEH2`AKhTr`FUbL7|7tjaZ~iXH& zsHxe4LJ!H>ft0+az!g?gcLaqVLhVG#^a`t~LbrJj(L<LQ^^J@E)RvWbH*tRs*iEn(8em^bl$v zQm`Jv*k)cBJ6Tg_1ce?#?MF&pD`ThnkJFUfUEV|V5GsyPaD~-Wl%UW~7H7;L8O$7@IJtXTC$;$J{J6cow1ce@wby{UXZx+~OYgSm*(B={EA$myG8IlEm zgP^Ilf#Ly9L$WTBtg@qe_SKZ{6Fx5V zkgUr{$(0S(jVdZ@yr9rSvaXOUcqb@L-4zsiNY+)P;64hr<4fH_ZmBHKr(8u3$+||e zMy6iVT~kv9g&vZ19Vxgj!|~d`;$m}6B?<~XBji}#l68w@Ewx%XR8twA^DOj`tlKIJ9LA5;I{sEQ3>Fl6NY)*awSUvz44Qf< zDD;r5yNZIWG+on$8P&Pm@&#!8ec|bE&F(1*DnI@8xP_X!C@A!htoumGf1sqMCJG8YBz&Q0O7l zC#2-{3+}OXmj4IdL-depd`3!E<6O7w6*P50Q0O69UyyQQjj|_(9r=3toL7~v`;lj% zhh%*vS;Yh2rqI+NL7|6aeM8E$@|s#9DD)8OJ5r{V*VJV}p@&dEkV?e|U?>qkY>1}P zed02D2=x;w)5>egM^NY?)%b;!Y2`H)CMfiftlvn%)d9}0Y1O_vol%wFBq;QdEV%UR zzvSB5x0{8gt_uo1B+H1D92eXXHB?y^pLsRVL$WMLR@3SuV>IO`DD;plOGQDuuwoBY zS(OBZ9+G9HDE7nv@4%y}j)FoD$x49~tfH{NU1d*|HC|BYAz3L&R@W2n-e_u{pwL6I zQXvJ$iyb(_N&DvCQ>d)Bfq!9%?>9Q$Amy*9HT6NLCu8OwSZejT97m2$dEo z_&FQ&u$jx=lA1atDD)629a8K8w}gFn_h>55SFWOmQ0bA9*Dv@zY-3f8E`mZ2sYV8* zrY3FDUd7$_6QU zltZF+cP*vHwNg;%A>*<|N{*{p)TDBn`XVUwkgQBdnI2_L`F-d8Mh~Ivkb;#Bs*!f% zn{}F+EhzL5${s1GA#ARGi}Gsft)S3DsLV*oqYQT`fvOsnfAF@@L#mMlDOnA8$8}9b z3JN_WD=Sj68gQ4Qsf&U_523OlWqNhcRNkMwhv*?xcBI$?ZufHLe5t9PfEUO;V&ZWW{{AJo`;y@H2O z4oGEU1Zk6>`#nEpNmJ*0%bofXeQ56LQm6s$IowKe+<2TctT6naQjQIZvHkr1q@CxSu`$ttEO7KL{yxl|1s zq~JY756N;-6!h?MfB%u1S|lj+kStfEUi}{&nfhftkQ~t9>Uzv)M-JXhh%vnCGX7P)y`>DR)GvW3q2&un`FUz>1e8_ zpwL6Id=w?em0e}+6cl<$RvAUHCx#Ux^Vn)Ci#6{ddPr7Tq)f+^R%L|>3OyvN9La)r zX3*3bL7|6al}8HZ23(ixyXAP3TV)l^$a{z$l2w6Z8GSlt(bPaep@(EuL`vSJz)ue} zbyQI3Ayg%# zJo+IeR{+R^|4hlZRGEwhm}}s%AXIgvFbe;- zj#GcY>L?1%6p#5i_Gl_zP~d^RY^Am1^?~QKox0c#TxGbEJK)h^$Ra54P^zAy*b~FM ztw#%M-b+y6p(Cx2RB=W?Z*oj*aadC=1qB|O)c`5^b1gd3;erAW&1$G9$a)-@qnysV zBq;FEtVW80YCNo0b%mzh2nsxmGMUefkxG6(yV~>l3?51~K?>F%*p5sMX{xiTFbX#C z&>l8LD*5BpMo{3Pls{7Pd*KE1%e>TCVS)k=qfBOIGoHZi`ewmINcuZCm|5IQVu+WPyiKChJc-q+~T}oVwzzsds_`56xtIk;-b3(Es>@%fiGl(TrMmuw z+9xRRP^#NsD93EPhv1=9@L#AXL4k)-AxOy;U{dp!&A`F8<&1(2JX|{|6i{h9-T#vQ zRHTE4QazC3DbOZtGTkCO*TF-no`1>8%qW;+;NdN~h<13}rgOCywlkdVkmJ`gp`K_5 zJTyHNspQZ1PJ#jtrFtU;IdXhDD_l_Ep;RBF)f;k2r zN)7%C^;=Njq0|thphegg_-8k%e5stghTx&pP^5-40(!|exsHV}3fcn?rH1{5S}rK? zP--|*$yej8puj_^5lG2#U7Y`_5IFc&F&7^fcqlazDS7o6IQ7v4O+^a|Jd_%R6kEIu zY_f|@R%1P*pcmj_RJ-22rDHTwvWHxiJv=0`z(cdbk#Z1?oM_Q{xbC5SZayyXP-+ZP z`2-BB(|C_L_WGQZf&(26!kn0V!t1tv z7zzeCkI-311O*;SO+pI3Q-I#gH>^IXsXKxK52Yp}1wWtXV_;91gKr-N1s+OGK}xQN zeqq;qG?mVQw*($aO;r?ol4M*(1O*;SO+!kK>p?1b2Y%VZI)VZZrKTeV*A(_dY?A6O zDDY5f22yfd)py;0ptGU{1s+PxBvc!_AG@x$3p|vX^A{?Ypuj_^xkx2Hu9AWR52fZQ%6wea1qB{T%|}We zFIxFlf&vev7AT56Niq)y2?{)n;&%?X)-OaVKO>-CZG(IGfrD>T1O*vyzY|o1k@NZ{qp~b7*PWU6m5Dt#^5DyRq}Q+=CJS(cY; z(N72}!pKy&*;Gg<*0@tp5e8H)YkY@MH3@4ZkAC_>Lh$2FK}8rjum53GmNn!!JhhTr zgD^7HcNvvF4%Z4Q!pKzLV^o$kmYHSS(V?1hJlBgba$etORF*Z~J!JkR4%K2oMHrdt2aJmJn#je%waxGjbn+S&RD_Z9`Z1%jY$&(pj|nQm$W(XRRF>tOypB4NOGp@*>K;Z#mM1E? z)k_E}!pKzHY$_x|r{8n>SDd_lAgBlfDwj33GpbdfAZZ@D`N+8rRq0eNAz|da?qyV# zHRL|_nSzQiGSv=7bu#jy5j{UFyWAqE2qRP7$EYl8OnK?qC60t|2`a+KRQKCdNGP$< z_7ScZVPvWY7?q`$?B#AjMHrcCr%h#P<48Cxs0brdJ;;=>OsBA*jfgpsL!X;TqauCaFu zD#FNAPuNsQD0&?=jeD6epmIg;uNYM=C)_6%!5e8H)YdpiKu>8raG5PL8 zFLNY3@?>s9!pM33KSrguMysGAj7;?#n<~>9=L;&r$W;H!sPxvjRZtN|rg~PQl52q9 z3M#^Y%4Ln`7!?|0W{vYtzw0JK@Z-=^xHSkP=k+|JvaBK3Y;}T)Ff!F|8I`_fTPvst zBU8P=sK^>fC| z$f(X0*0_E7FQ0KFYzp(d2qWk9GNZDrA;-oy1r=drs#h45J~qm$cwU5&ss6;M^szB0 zs0brd{n>}=DM3XTP`Rw}Dx*3aL=o#?ZIiZC+OTZ~HIbGS`V5k{tZn^9TTkb4df2`a+KRPRVs^1RK< zf{HMpa#>?HqoSF1^61%T-*grs_)%8Fy-XN6uXh=hWevHcoGPdYBUAm2QR!o&MNkn& zrusXhvaBJ;##%u|7@6uHHWd;|Y+Na*2m>mYHU7z{XtjbgfBNj1iwVJxn*G%utlazhv!Ei3Otp_q1u+zB z98$}@Oc+qPtTBO6S=OlipF93W2!5O>s0btHHIY$S);MrpqiavjJV8YmnQ9WFIvLC} z$9iW7D#FNA`!cFZP?22nSg&7D5k{uk&!)<>#?^v~Ffvssqq6jp$FScPRD_YK_GeUj zy&e%%gpsKZU{sY_y>6|3W&6ne??1qz!M&b>iZGz+Shs#~W-X(d%&0D}U_V@6KLkZxU1fKl+20fINSNJy zorz76%5XFi8BBFXA~nm@i)M;nu8PbHnb8fKs#o+TdK>%VYkCr$D-!Yb%i}#miICYp zG?3_s_w;~!b>xg_dt-E^*%CPuKWp%FrTyD9k&l^54D@#Q#Zw^c?%R-DpD;JZQ-jGq zz{6&1vSWRBip#U8F&d2+j89eOg_YoMuIx$ltxc^n69WUu0Zzp-oYz2P=E{MgzEpQ_ z!sGf-Uq^gs?Yfki*wm5ePjx5zEEeVhu;=31*UXM&|K^O7or%HJKyot)ZzEmeM;qrY z4_8IF5(;1$=|^g8To+G8GA_=8A?G#F^*XaT<7$+dImQ^9jlP$|YvP?I+>`9^5X@{= z5F{CS&0_C+nX?}lh;KIg5*tnK5m!!3gDS>C3$o2nmyMI#m_lYxjv3--N19954J0?3 z-jX7;m@-Vxj`*NEP8}_s3yNmW1s2(v+Bg8613a#}q;?QOQgbCK(}g&v;5Mm@S`p4P zVdV#fa-h3!t#qL-Tvxd!KG@x1U2H(z(6KH)V5SD*-KoJy1BWlKt7L%{PoelVM5;wi zqUvWhBm^vBb|nWONPoPeJGD7dP%ib+mC?p%h6u>KK~z6g1@UKEkYD5d{fWNL!h|Je zByCl7WD$xr7tmbV-MQK9w2f0(7GTcktW zzs(k$p;|YfvvbZx<8LN|TNTygIcMTHeQ>aQZJ+9qy!bhOw@jYR@i}K>`@Sx$Y4ey; za($ygsg+I^2vt0t=H~81PiM$%OKmdIz^vz~)WBxv$50kPN7I9U~0QQMs)SO?OqeGi*U zHV>u}y>7e3sPkZp$ml53d@DSkoHW6skw*=ltdOd~44rIm*M&1LYQ)F{sZwM?kdWLT zz43m_9n|Y$?&^#8CL(4miS{uO7sj{av)T$!r<>NB7#xhR4Mc+Q%-2&Qme426Dw^Dh z%L!g-#(H~`1F3jV_jw5uz5b5=&1QEmskb}}Bg>8yj^5BP>-pB9zBZfCKQTLc;)8>c zm6estIlWyEn~M{JiImx!+>k(JtOrwJ04ZpwePv|^jIDl8q_Q$PlUhcVGqt|pxgpU( z-Io=$Yc{7up_Cdr_XWGjvnyO{43aM+v})AHKp$-F+Qh&@^fV&%>*9TViJnMzZ+}l@ zAk`6xP+YrV^*zbKL}vhCBO4fbFw8p!S;a+W7E(ty#JhWFROlrU?`R10yrHhH#6Y4m z+MC4i%%7yIXJ~L;J9=N}p|TUSMa(u* z-ak_|ObEcp$`@5pRWOwrSK@@T75t1XY~YoI!?Z zJsD)Na6mfM&=d!Ily%iWZ0o(juhsgBgChNt2ECtzUdjUTQN-?9uzm}>Vojjim&{mS$3UVh(nThXV1g7glAJjim5oj@kM0A3X(hwda7R>S zGNgW_+O%gu;v10Ryb^JPjU@km4ME^G&HKM zt78832s_<1w>rMpSsY>M6-!$bO%cmWOQL2Am>?9EOXgtFvAouqVUo#gLw6?4?!gSM zyf@s$7fHM!$kklIzQT~9iHrvDU`M>qizx#)aS}JYFPW(t38BHKlB~GsWnN*6><439 zA+Zo%2$D*&(wCjFH%!lXV|OQJ%2dxW8?Rsm7)JBPfM)}J$i%jGeQ`{dZPfB?Fm0wj zC?P5Q7Y6qz6N7cdGvfr8?bY>6CEOFY;V#UrVS`1aJ2~ho1gz+h3K>fcWcfPO13D_F z#`a^&Cm=+ao6X*=+*$-cb@U|S0~$S6iWMMPLt9oe+Sy5sr+nF|vPof@XlB;o^|cJe z6e}dPr-sdD`7&kX*2Md&i7D`YvkePT-SaS4yfnE2QHaS^v@`4qD!2NffdQ;7VQnlC z?~HZw!7E=%2VYb%9!slE<Vo@29?1WrkLREWfT_T{gj^XT8WU*k9O;-`Y z(n<){S=J17`A}Agc7&Q%u42I4oM>7&*tH3TJSS?Bl{Lz2J~|(2u?EaqG#cOJl)aaa za?stwPncHc%Uj+y$5=wzLtqUN?8aaAMFAXbA2}SkaQ-pDI@UHVbvf4C9?FTHce|Fc z_38pRV5MrH3+-v{ET{+3+)VXZKTWz)m0Ads!F9=vz45-y9r-aa=To!}VV7Vb>M$M! zn1kpy4X#b3q`eqfD+(4AWKVNGLLd7s=95`B4fYQe!U#<}XEc~dtWS1zMUFchNc~z};Wu~i2 z@@1N(aw(jxwx%eEEyahXq!q%`vvl~By)ntpE{$w2n7aVvn;n~5B9pN(hh3iXWhaNV z+2|@*MPey+gTRxQxZHapUXoJxsCaA}ECUqC*6vHz&FoC1sEP0INv@61PI>Ai7AY4R z8nTgKW!+5AL5EuZV0MkQn`f}y32sTy-g^5b5{|I$E&a>bf)+S))Zk&ZcL#0#Qf%6f zEKYPJ2RemymSKDY?#pO9|C$IJBLTN0fxZ@PB+kIrMOW0?SF0^NcKl>QV^n6qY~h-Z zV<%ANb(oU%3;}8F?$gL+wg?Vlhl-Ykxk7+wyOS2d_WC1}rf$rOWhg`rWre#+xg=)y zKp5*oU!t!g5z{Ei+FDc$8N|-Oz-;unct%}iYm#;-@jF6z$g)r-p9?~(>e@zKrM2g{Gtra4 z#=uOBy&2GvtIAx0*`I;Ue5NjV4XUUY9%NkXUO~WtK9fVtG;l2o;KM2#>;vt?7TJ__ zABbmdjvao5H6571vUbO#`iQ2Iy}0`%-r0#wdV^*hGiUQLb7r0I#|7+vv@*4_Zf|Tb z=Tj@8L-NMOxso&Qdg2`o#Csso-G^nY{sF9)G1)Ci&%k&T0`mQk6oeSQtT)#V#nI3$ zA4qfz4GeZ~z=qqQ6mHF92Ib$b2t&-{PBiR(BT^3{HrJ`dRHa#;L<2D}gf^}+jG1qA z5Uc>@9i>Qaclp2=QQSvj-OR#u@e#=0+beoHs=8sc|5P+>FS|TMlBv#L;5HE5cGy6Z z;aZ@N?*nnJ2WOq<7lBJkvnKG!fB4W| zL$f94+_|S{vd!#E_F;$kn#2IMv#L&I$~)nh-Su>zA|^x-qVuAdA88Obeuyc^gmnX& zt87SjoK~{=KQo@f{Sy7Cwt7JrKq_+qSwa=w6_G+L6Z2_9V7b}k`!aA}CGHYJRg{OM zLxZ>*j;;T~L-G=l6*CAK_ch+ZCIg{|XvcIt?n|XD`fQ6lx^wRR>g*@&i5EfWTn=NY z8_+7~Xcap*Ba@9x9Jp$4kx7`{&4${EaWY$~SqXLqivb(1%G!2*v_+y3geCHIEsr^K zmqrJ}>Yld~Y7v z?n3aU^uNu)O;I-T`pJCmD@dt84?A(%TP}k>|VwU+5q=1*p+8_T8&ESE=t_)b6vDfqqXa>u%HZ zCv_tD;~zSb>?s{mRVSE?MQ1r1>jG;y);%CCJ-hG)W}vG=1L(B(d!d0Wv-idHvG3UL z8F1IMtf1ymZ&c69n{syEl#H-AU3fn4qU*x{TXcmBoHpX**ievdKZ7e&I88pG!rV4i z{Z%ej0PY3Wh^%7q=tvjHT2~oxwM3V5ygGh7)1q|YuoIQ$$MXo68a@f04<*a8uCSd0 zu88M??B&T-A;dU6AuL1t;?%YUy0j<}Sb!w=bhl(?JXE={sXXITm@-bdJJb6PS?k@v(H*Zw`%N1wy@faK8#%*ngan&Yaua|`FZ%Yln9 zhql73-?WK6ZoScZ^geE(#<`{eJapBF_jUFp25NDtd5QQ@zb-*f7gkP~jRv6xY2zer z128)Xg~tOY*LUOLAoQ?SZ0)h0Qc2=z9tTNxk6?d)WjKQ%+f2NMWK73mn*0Jic~e6d ze3`;coLdohQx>wZ%FTyKVDEekxVy~iZelxx?B~5Pc!M_BdA<=Z->A&`&WOr>_S%!| zIGZ8bBdb91Er0HNqilBmD4Q97AA{$MBW!lra5h8V7fsmg{82VDo~!n?4&-olFA~3< z!RDL;iJeW*7fsli1SYVuaJ|6+Pax5}MuWf2!O9>g++xpPtKqyG!q+(7Fq<9M&jETw z7`=JI17xvsY2qL~mCb(5Ymx$0{EOX#GRFAn1W0?cj zp=Qi=7|R^E4z**h!&v5E73gd)LdmTb!+JM+OpjHZ$B4Tnd~WaAv4qNz%E~OGIm!8c zAJ*`TxAa)T6q&0fY|v&RXB{-{6z+s#4VAci(9&#gieQ-mue2DmcL-T}j%gm2BH0R3 z&VJ0bq~@Q2r9zMwBUv^LgtZx)%~{@*WV6kVw3r5Z%aHe5imV(9Wn+nhH#6c@IpgpO zB1`b`%dn%rf0H%J9xo-?BcGPBNr1L^Kg|P-SI*u2)hzSz%+oiBJV&D%i>O$eF&;mh z8J-^F(rieZY4&$eIl-Fwo+%$$Gr=CBW&v7~j^}%)ES1MKPfJlezQp^5Qf%PwVaQyl z?9AvXCiJWp&sS4fwxHYivmh;|KF=t(?~c!SM7Whte#BPRB&ElVTr5^y6DC2R7F+A- zRe3$8UfT=6>~3MqY|+Hqf%9d^-^^uOzc}11;lw(p|C)q7g%uF(v}FMa)P^V^86I%L z+O2?ayv~f)b8;bZ+NpqfSaucnU-L}}foR!6rsd^)$sNn*%RzNTzI+_Z<;%e`rLbPM zRWLP3v*R6O1}G3D)dHj?n`PW?5P1rED2y4cTA}96#hQgzA|5IXO1W zpNC~s;e|0>jaB1*j5BkbH9pFzjvb#|mEts-J+Ajz@Eo z({colgDR<)94PCoJ&zo?IIb#C9MyLPvU7}EAS27#!bidPT&c023#DV#JhD|SnFkA{ zDC8o#raa_A?)WVau`OTeTpnDAti>Z&R*pA|A(-mkV(@gVUJP!Q8*zcrIia7R`m&WwKnzESqTVWy%a zS|zqv>@4v}7A%TosWtU1Y|p7mCc@@lcT& zTi(;vCqC|@n^v>bMggd;%rhETPg+-J!+uzST{RcV#tDu>IjPZ5C_l&jg>te@o>4J+ z+B{fu5RBYq;yeY&Fm0ZETqezvgKbK+&a}H1#kfH{_=usXxw#xQKI*yrF+LgE?(^)2 z7sH^g3M;dFSzreC!>GJ#z@moYIO*aFz4wA^GAgY1f>N&1`d(1SstYuotD=@5k6~uf z>w$lJJuHXlx}`<-NHLzjVpqWbHu5@^?7xl3YDM~QBe+vp{@aLbl|Py@mbTLuSXHqb z1E?RNPJ)kJCYCBbJNApAR6chKj7`3l!sI(;KC{3KMTb-8zp>58Rw-ksMkR`#6Gksa zE%+@S!A81cm!(rF`%KdoT~W1O9nZX-s&PDXwZlmrX{wVL#j>?p+ex$iW16Weq{da* zjG!9V++ATcuK8MlrRjf>DIf_@h&j_&U5U;a%%Sf zGi@aQX%C%g)u!kF3|wRbJ8k3tnYPHLwc0WNY2LkG;j(%x&&lF{S?Mj~>!+OezSucU zT>tBdYnvC(TxyDUBvK}(x)Z+76!*v33^6-qo)I7DvzlPt)V>~&$pX)Q^j_X!nPebr zCT4RN=@p^Yzei|Bi{CHdTFoP#Ab6xYIA=gyPbVu7P|so zOk(#V3*zDQnF?Z~_74hT=Cp+cv9WCIda-c<{G@wEi^h%pDvV})n!wk&TOk0_#dNSE-si;`@8~sGG_minoIx&BYG!@Olva-{xdkP2 zWtU3!BsV4oymLcUW3FKN%If7v$R7wDuB?OUb0qC&kG{-{l;?^Ej^~?eUZj$Fhx+^T zGjC3WvUzhNmCc(IschbyNO`W7d2=Flnb&%)qNc>JXprMID>M*W6odx)gjul&nnNZP zw;Y}#kHGYnER&9#Eq6MeAD;N0SAMzExs2I|7ltG^YAcuqQ}t2+a4^;|ov60La9C6c z2A^zngzh-ck<=aMIg+|#Bu7$rnB+)mnU~G>s^v=C^UQ2;T`-$nIQJLb+nv0+yojCN zU4Haxw=O>}PJb>x`alNcH~nDl%IV_x=H|xR8PFJ_yJu)15$R42X7Az$09&j(dJ^#g zh3g`^wbXD4><_Y7)m3E*CwCJ)uDhbai-pToUJzRhvpF*#&8W-=fHy+T+x#w>)3YSKb@IfgBSi)CKc3R zT=PTY>29w%s_~b>GDIOS6t(-lg)wnTKw*5;h%Stq^!Mh7NG*R@VC-&-IyWAFomE)vh za8q4V44zg=E(R}mc`gP&Cs>NX%?c47cvZY`7tUBy#EZ<^65Q2g3>es1deixEaU!}v zanxWgkew4N1v0X&Ep@%R`_>Mo2GCjd?kP*VyfEyxHX_kHi8SUeI%Ahliq1R3O-0Ya z<+-Bsww&qNqb=O8Qu!bAd@O}%xz%ao3ebY82q`*?&Nx$KUXuKWoovU2w{W?$u*4YZ z!g{IQLkP@=Re!L^B0Uw-nK^VuSnIo~xtFB(64!Kr8*`I-inqKd|m z%ZOJ97mXvAv6vhkNB0jE;%KafDUL1@KbND6#L?yGB5`y%x=0*djxG{M%h9g>N8s8e zOGhm~KDI!1l@2~=Dts$muU?FARa`JrOVs3s#DH2q=gXYc*v+o0acr3L(8T7Jv0=~S zbj;Xu>9LDrETtba_Ey*oCKBtDU0v>0w2-K&qZ#t9ek`XgGuzg%9&jo`H*J{n4flfQ zcxUTYm!z}0fCUt5DkPrjF0ZMMsQQj;zIJqyrN=dAUhELKOT)p+;GqyyQTl;)#o$T#@Q8;Uara2(+#&=$m8(9P|CU-~p2CL#L zko_W5ek)y3QfC&OvukRm_{=lrW{RJMYjURe%x#a(>`bJvb1Bl_lUy5#oDp3~v++f8 zGHt(JV_K{l^H&SF?srMOC+Y1Lo0$<5{rfM$cDH^ydkMqOoVa_w5&#ZVcJMnvSW z#*em<3I})FQ!j+XvF)HzW3Yh(V2@(J=5W+vAa_xI9l#dhIb%nB0!@gjK zPLU{>m2LMbb4j8P>$rT!ue;gw?b3PO)L0a5E*}&}JeT2$!_YQgc#v7o9!&>a6=mTo zb`7|rw@B<<1}qZCj94xbUzcZ!#L;$5RROMX)!21~@^Lw%P*xdUD3qbg{Drcz?Otid z`UVpNDU%Nlz1O_W7G8^-!QPY>yy^)@Sjh=Tu$LO^8ZGVuv{y2Bd3dknpAi;&MG9*( z5N@8|3jyHXKD2ivaFwOKVgaiF@-0fWe3Y{nB$4{m{~E$rrlE}wgB{8KM5l=-9pLfE z1Bs5Ifx+$#3A1-7mDt4VBihR6)xXJ;-WH(JtWWl#VjSv7p+AlLNHM=))qJA9Y*22( z@q7*x+vR|&FuD>IVS`!^j%_~n!WGKe*yhx4-Tyu2IoS&aW1bV&2@3>co|6-JSpuF$ zRxF^z1e#hh!V&ia4(ck4!_E;8PbdgmEC2*8K8Z?2<l)3V%v+8w96eSpEY00l7KNL8Mx-bV zGp9I;!qz=zFA77)D;O5_Z#Gep^kR1$-8j9XcFpFLc#0qUX%92cpeOo?%V7@1T|i;E z!(AkP9s-(d3EdGxtuJipXsC(V>lL+-&}^xe=ib~Z7r?Qu&YYFl)RE{h1ITi=)5*jG2hffH=jns_I#0wrpGdSD>F+3ZVfG4auM7LCkrS`b^<8l_2a+C)`1Bb7`dz>Br2exh%`31wcT}d7YHA%q5!#(THpECk3io+uE9&>!b4{bv1P}xWt2A1We$} ztFpYh>kv2dv@C6H*e;A3iRCP`0OX-LugheX858S!+$bhyHxp}<1DmTQ_mFvJx3)Id zFKlgXrRN^;?Qx+xg*<}CUDx%BjTy={l{IbEU|Vh7yBi~crwVImD{iEA(Y%IvtcFpR z+3lzA+w1G1zMZ82)fX>h!`qDQ4Ow|jaz@yT4g$(l%&amV80>C`qLIedme|4t4K2Km z;r%Hz6!G2!3WOQ!G&}lIk?v0E0lr})%3P57#9kNgaQ%Yz1@odteT0`R)~jVlrb#w#V19$s7nJY37NyhUQw8lH2QQk641N3vPGJ7o*V zt0>=ld!+o_g!yhR)@fY8W@5okvP1#wgoP-MXD*y?G`BXix1zY!$NGkPdhmZfFPLKg z6W@EvMCdiUvA`4W>qr2;1QPTlQs~8^R?6H)6&Xs|8&~O>q6(-c(#Q%i2~i)7G&i@j zv`6R9r`nLpQFm{D5B;yl+Gk&aCDD_hty&BF6Mc3ute+RDuWy+*Z+^o<^p`v0Lu=Qe zpxXV=x*6T*KU)=bU5!ImADQ3Q*s!3zC3}YTJ-DO9D)-1R*08X3VY|_gow570~*Dq+E-_n$wa^4Vb_pzm&A8BoEYpI_X^C4tUdT3Ad zb#{|o%_XULs=FhC8LB7zI*wjA&{!W$@2HCT!;_U&em!pxUg|U{#1q&M@e1=2rdz$ToaSU0JVG})m zzCSfU(W{$SsK)vwYGcZ>D-tcS6<)($YK;#gdxoS#j8SX`|=TNTA3Hd@(eM0>f` zdk`WjgT>S?nQZ))G2#;$X9GAg>Ka1A=EtT)3M(lA@OVCAoz z76NF`IudwYjz($_X?pqiH7zCH5SD8r&n%h)nWJvtoNQC%NZ~e9j-<9Ba_vk=<_Juz z8YM8HVwxQ3G7Xd?1KUiw_3$Jk1te8X6p&0YP)<~t=E;>DMXd?-e(*xY#kI`}cNEwo zl}ud#JJtLJuu@!7FsDp670l9h06DyXjz(2_;QB0CS8jzv~_uZ&$zfrGagZc{4=rM%cNRlL0X zicB$b@raBu(4>0ojir{{qH1AR4_<32tT1O>v<#eaK@=2^^G;ZM0BWV_Dps{v5>m`$ zUbO_tydos=y5NZ7iLmB9%zE4|MOzX&6PPU)dqg;U2(?Um*^*0p(K3=ZUq?D02DRFC zC%*MznR?9`SV6;9 zvohbBBeK-f@{3N!eyG~a6$Y{OM7m(9E}axYXwEr#D;G_3kZy_TPHi?jlF9YmiI8b- z>g~m5BCs4=4{!?@X*2T3flqI`vB=erWv= z|0ALDdDA=Atsk6OYhRgy)K$n&It~bhAk?W1jZM*ItxH>D^FDeUzUteS9w(n%*xIll z+Sa(_xQdCOe;uC(@wp;YGMU)be{|I{+yObbiuUlVY8x8t?pW2v$=e>WY()01mH9{OnLW0OnPghG#o4h@|gx_%^N|8MK= z7)TB#yHXWX7k{K;AvRg{cAtj+lgzT5I^H~B-wjH3As`} z+)msFmnM{u8|B08K;k~3gj^^e>ML;Mn)ulr3jJuD1-?biRt1+;=RcBlD!#; zMTx2*#oG;RG?x9fZ#b=Y>Mm_|QRmIs9bY$AB>c;1&aO zP5|6GU{V2ap8)2H0Jv*`xlxOA>>P%Ew*vEY0Nn3@IqZD0ifR{`--m!%kOg-Vc&r5G zlL2s70&_@$&EC7luN|;zNgD983ddRu)`2ctn9& zq{TV*D?>(S0rT-suxvwqae5mtKN2`U`5pk~@hmu!@BabwN&wtj!0dYwm(MF-;#Uq# zg%;=N`(xlv0_G0_CzoHjyiM8?3Qfj`4zGNv{2sL>6gm+fI%J%a?_;=DwIvkV=VC&I zLUR2g=X(+`GX+lOC*vZ(v}$oqzULyZ<-qI|I9Xo@cR6q`0@M3Rl1`P+!F>_et^=le zn88B(;-3@G4sIFF_W`p*;HcZB!%_A4BrxrlAc127J~|x9*9Xj70w>$g$(Q8&&{p(} z@S(#`zPEvCy_Dnp4BCxgGJ3o$mHvnUNinLJcNhkhD zzJ6dX5I8S86Yf%AKBdJu`F;$zF97qDz{%xO#=Qkh^`}9A!wYvTuC)VmuE2TKf7QTk z1?Kx%a4o<+EHFs2!-+pfzQb_k{nx_3_|PHSMaIi)V0p=%Ja0&4HB`|ZYBW=wR}ahuS#XB~cQr6K37nVxh~Kw? zc_|A&iu=C!JW`Xn4mvE!Nd_Ms0VPO861xNME{-48_>(J>z zxTOJcHw47}F#zr;#g=2gQZX&i{?`UBDdh1wwh_*5lflz}zozUhNT`e?ee~A04`U55@W41GigX zz3fc5gE1JWpaB66FWmpbwOU}xzrq-vRTQ7U$$U3E90XFg$0ye+joI0FLZD z@fM2{|F820#npbmeNbR!J3I0b?nGct%YyqjaLoe4bJgonii_U??#?Xy2)6^6hqK@+ zfO`U%zX}}buhX{&=MViF>LGmS*asgk+^2!rlLbf3%b~ZTuZRyFUit3CwVwiW?bjL1 zv;L!^@grd3-|)w+!{rfRUKcnoJm=^IDu!AM`=T{|4rL|HIVv)%R#%rfP8x zzfXWoH88hnakBmH0_FiN&f!Px`J=$Jd^fv%%Ycb%aSlI{Z#^)(v^ZJ5H-Xus#mW5k z{~r3|_|V}OFV_I`MJ-O|cQY`@-=3Y{sld$D;v9Y#f=weZ_iAynzK;O&losdkBm4ap znALY=m+#}iY|!Eye$6o07GQRMpYxlDe_rMCRbc)maDH~4^aG56@u9;HcN8!u2EbJT zbD9?C=+TFant{3fPM)uy9=`!*m%#bS_a-oV0^s()D-=2$A39`yj(nd%{dWv7xBrOa z_QyXjJD2?!Yh3uyA@keBPvZL^e2xdEDgbUSFwFsQi-0*h0B$WXgIb)U?_m)9LSU}B zn~Ut{k2`_6U*KeY9e%yI@N-~3wvF@iYd@|8=062a<|o_lzkvBx0Nf9NxlfC8@ArY(A#fn`l<%j& z{9221^8GvLUjXLW`*^;7`cA$d{bGFR@XPl^U~05DC*L(-a2hZ-Jiz%)!apxNKL*Ti z1kNwtKLGQl7U$$k=J*FN+o%JI!!O@AfcdAu`Q=;sAog3}Lx+rW@_iiFJ_O8bTAb|P zcY)dWA;wPOC*#V2Ia-Tz@;wx6P5@?(irXabGb#nHUSN36A?z~>N2d47II6E&fLkH3 z6Y!hi6n=yo3drwb;6}6XBl*4_kl%NKyC(}jlJ7SG`RxMkuUYt!e24x7U#`Q;en$a! zqQLsuuQ4FMMZle%g&)axen5W1z+Dx9-!}vDyB)agS@<0W`JN5P?@i$LWZ_5pe(+(J zGm!N1$ML{b39Oeth~L71{8j+h5rE&t0r`ypcU=H}-wnv`hrsO&!0*L?{Qd;o?kxPM zydCjKFn@d)xKjnz%O4akZNS7;oTk3I2$-~rQ|ha7@cSAtcd9rIzbAotLB%QjC|*i_ z8cg5)fjeAaz4Sc@tZD-Cs{^hj3%{emuN#=H0!Q;8UghI+z}%FD-~OQA0n8&3KkO@2 z>~b)0&jItNEV%uEEBP6|Tt}ollONfoGy|t^w+;iYLSVh@OmTHOFpE{3CJy?6xj@A! z`chnd9++EIoQB_n!2D9hDf}p|-Vhih+2Q54cY)jY=N#juFY&7s7>@LggOh=qorNFy zV|hS+Yk=#^!jJrMB``OtIF0@82IeO!PO%^P<0W9;QE?i6?|&3~zwn{M&wdes;Ye@$ z8Ne;g!jH=305Ja{aDL_TzkvBx7JgJN9|7hGiC<m4BR&Z@OwBQzh40NY!-eMu-`v``QR_O zL;T876)>j>oR>eS9GwMBr^GL_9GwE(CSYz7IP#;e9DM-i|0*y@vO|ZXxG(#q0EmBH zadi}MCkm{W9wbj=Kz?n&oe_ZF#(?}T0xlhZ-`4{2`wnnF&cg37==%&Xuc|mreSh#1 z*b9IU9bWb;$F*6&G^;obzXUMnsyN(;ms-=q@}Mt@%c}&&KKTLMKdH1^~ah+r>Zy&zcygbP;nZ&Y!sMmcG;}pyzFu@ zaHDFz8oPWQn0r*5MvvbBvrEM({3u@bdlL0MK6Kdj)9{-COjN~b>|zQG=ZJ5Qc!?`G zFS~RDH>BpP=t1%FX<%+vaT-1D2j(#qr|=`Yyb8=76{q3%!Kbj-10OnU`)TabEHE62 zZx6e~6r7h`76Es*ny;eA6l8NgFrQX&8a=)P%#T%^!jJ6y3^1>%I1Rspe~tPIA3AKi zDEwG`1x&Mw)9_0GbFPZh@Vg3_8&sTz-;aTLNX2RV_6LFCn&4aGH?qqv;Qk@7e(m|> zr_t`?Lx-1Ls6C$xOoPC2ewpn#jaOF!lgNUjd^QUVlI&pZxuP$vpIo5ebox?#zeT}$ z#p&h1T`RC&`jY+r2bc#`oW^gz1Lidqr-_3@p23_pK6KdmYWRH&7(>M=b|L$B2@GRM zUz#|Wg464O+aj=jad0g#Hwv6BpP~oF!QH^@l=x-F0gZ>A0p_;?NAvu;{u<@;iohVr z4qY4&?o|cnrSBWS9q|7+FF$=h1k6bS=clg$%p!@OUf%>TJp$*a?*@V45(>L0{v~-f zD>yHGF97aZf%Vh(7GS<7aDMte4$LzWKfS)M0`r!@`RN<_jio97@8#bK3QnhQ1z7A0 z+zA5fr|(CBX%aX;eLI2amH1`qdkFHq7?`WF;3)3DA}~m@!%N>=6`W3As)xP_+;%D7 zuy&p431FTVI6r;&08{$ETsCgMOnpg@qk;Lb!1?+26oKI!z2iBo;B@*@eN_Woi@^H% z*92z0!1?Jr0?el*ewq4`f4>UM_p;z<{qsSA$)@j56`W4r3NU#TxYwk7_5PjsEcTD% zLx-Qf(}9^Ka9;kUxM~5$l=x-Z@cr^}Pa^YXr_u-|Gb?Bn~fqzog*2^!+k$cM7bZzCQ)#*8=CK@7siV z9v>WD@l5_b449(?&QIUt1%@%imzTa%6`Ys8(}1fNSU-JN0Mj9Ge)?Vv%oP&9O#f0p z`%A!lJqwQNt9t|{o4)rcIGw&ngUL?dUXbz)Yulr@ftm1Io~xg}#{zSbz;XL!>Pz+W z>AMPPW30zvrSFi64z>^)BVpBQRV-eLNE`so-?}Ed_2s!Fjba=K*)AzSAB`H_m#%&$ES%84KYZx0^VRU13Cuhdr|_eB<<-FSt2hn6{{ZIm zDo(@i2f#e2;xznz56l}XPN|0|-pc<-nz|0nd?Lm3`+%D+uzqnm510i4XWLKFV}J1L z0cJ?zml>y2?~VZTnJhSp=UW8^Np|SUZz-;PCj+OiU+x6%eu4GUgVvp22*~eM;Qp3{ zAIW#*%S?Rx%d31G3*0FJYs;tjm&$dE!q2N*wkkNUe3t^ZTFqDSFO{QD0P`sor-{?s zfccS%Q}|IidK#ENsyGe5(pNAh#D@+qyHNaA3k(C&mnQDXAGHe3%Pt=S&QSAJ^dNp+ z0r~X-cU~5LWS9R8$nO^5zL$kx1^7J<%o_sdSI+nS6Y2zf=&zFHi1Es9XcGv-#x(nLSX&$_yaI+3Y?!FlmCnm!G{hnJr2gT z>A=j*f}?yE3Jme1L)VWWJ1kakx;Q0$R|3}~<*TpPwg7Xb!1?KWD=^=c_+|Qy^xX-} zFSFn%pO*v%Np^VY`?7-5=}U3{x`Oj6mnE;_SsnP$;iWI}n;P)ahe^qfBeuut}F&sX0c_J56915MN&Q zYXojl7JejOG9bT;fJ)Ip=$>#aJ~n)D3?zs|}TLg~gF?8~k;r!DA zW2vIUQJn6|!0G+*SKvzi%DH*zQGv_H08=M$es);`jG2WW`Qt)hE|vIY+U0$~eIA%^ zNc=K!2LksKfkBcTUUqpR1E;sk^T7Q{$`?4Lypf#`d`n~~{(03eM*#O>f%UR8@rwrJ z*9P1fS@==?w=p2Ui-1dK;Yad)Eg-+!f!m&iAIbM@Kz@G!?#(Rxs6CqeHufjtLx*i= zP5aRd%n}u+_?OztbAh>7#cBB60L<4_oWhUn_mIGld~|rl%M-voAAsMUfcy@82WvU_ z&|%v}k&pZ_Ltq#XUtaQ^23#x)KeFH2fc!QBH=Kpv6!7~pFn6jrjX$0Q<^>g}=u7gI z>_*JsLx*h_4Zl-?nXBS7{LT;<&e7X`-M|fH;Wq_LJ`K#*Rh&k?hk$uP#cAYw6PO9_ za_Ri^Jrl_blMnX5n`jm}~{+b1F`w@ArY(q2e_1JrB(5Do(?%>~C1# z$A=EvE*gGw1coEM{Tl;rSr&d&9}EWMcM))Dm7nt75sH_u0kd7gMKaz`Lhb6a0^{hB zi6efm1GoR*If~mwk2?{Vx-7WE!RBm%k@BU-8dMHgr$V$oGXUIY1eUKGM7Htvw{nvO zB;1X_+$V6nUjq4<-yGc0z&!=bUjpDt|ABij@u9=kSCQ{jT$=~XxdP`W-}%7YAaJ&P z3O~~0yTCjdfZy}LO!_BDXUz{~`h)7VBL#*5@f9ftPI<3P#JcGEza<1aD{)1*kAPpd z;7RQSxHbyR{Q^hhARRx#9avHls>g>88>jd;f@>qdJS1>DUfQ=!*Wi8u%%S^m zel|{Hmk$aIFrO7Tk*_Gfj-4srF9UPC zj1%pGgCqam1I)u&aAdzHfY~i@etH}{34X(e4lg}U#i z!2SI7s6f6S0VXDJetIkcX043N(1YxJE-=>#+(i8Ls;_`mp=pZzJs_Pes(zlnE3){>#OK-8u+aP<|cvj^Y6ET z*&*XH{7d@&6qx4)&QHF-0(0cS+4VRDm_-8TrNt)#`Bs zFw+FiPmelaIs)J}0&~5<`RQ>dFmvbyc{u#^s0U_+gv*R8@<$w)A%XMLV+5FQYH>^y z_C@{s?E+(+jcDGdNw~)X;-1&x>K8AqTv@-&%7gg54qQn&w+quF1bvnF9~(!Y-W3>& zHgrHJRDt&&H$`Kuv8J}zlD6p5dgG(VnQcqz&E<`YPpg^}4&znG8P{V=8y83MK4Y_? zao)0Kv$b(~W9w-;<|yl*(s+P!8VKCt<;wx#A0_FiN0N@L|U%Xl+#M}Kchmm{<` zmn?0FEi_|G7Md$!4UOiK_Qv{HQ>=0E5|(wmCzTlJi>DHO@!rHo&FF?r)hl`vy^VeG zH9d*W)6^3y67luR<2^%(O!e?u<|L#{n1iVSyeL_#n2p(hw^kH@s9OHdU0=WcOSh}I&oT6cy4ceQyj0Qj;~Fu=|&!@#A$P8;&tJ32jQDU^0cbC zgZ%@^e!SdT{2UrgboZ@^_jPt9I!>z!;bIqFNqtIBVnd?ml1O1!5hxe=bO!lt6(S7sYq9~#=PW}7j5-|QX6 z#k)f&C<7-MqtO$Mx!X6KWTYQ_iHZUK8(X)fDvaT6CmO@gJ!gyC&vVzVu)@-YJyyhW(;RKxc4T|2xkYT6VkopTd*M-z`{3?kgaz9qd{fLa*vt&Bi z&WfgQcvh6X$ZG53WtW_fT#b=cl~a~2UlCmzT^3y)T>-PKZc9JkmVT`@z03H)rz&Ig zH_@2;XxU}0gkS&kY$N?J%iKu678_{{;Ztgi9yB2~(pKI&@{P(HkxN^;va&5b(->)} zH0Z0nb)=_qW!v1plwCrb^+gf6g;EMwe6=qYL@g z;H!<{oe@T44DTSCp`XV_E-H02FoqwPZH%NU+o9O(*l5#pvAOq^ZLNfUv5}!tBmITS z+epaa`&LKI=sD4|qpQqw&fdXu;@?qR|1>J*iJ=>idIy%C7<$S+cQk(Ub0^uUOObj% zqqq{OQkF7CuecFJEGSEnxYRmpxX)h0&!(@q#eH@+xFAADuc&aJ{cnpy*nRdUi^Ej+ zS-}AjRZ4MGVWgjqrQb28{n|)B)|%d7+141HIM+z8f*XeKt1x$b5G?jVla9Rq6)4k> zS#hMuiN?`O&M~AZH&Aer1yw-g zlhB2`KMw$`RCQ8$)%GK$nsUs7N(dA)dw55~*ug0%-{F=&srJMRk z>QQ!2HAa%G#J($u&myV<(oEJ7=29 zjr7i!Cm8Ab$@S}ubWdf!kxo@^LJ&l#P?$UBL0Dc*u1AW8`(``!J*2K;VfTQYQiJt# zRYG>ZiikD`D)gZTe04 z)o%Uz%+-|DXv;crVlTVlB1pp>GKy3=Gw7G>)Gv`5W#@ixr&QN`R_mJo%I2E%6|2D# zP7A9}v#+$&jtC^+Wnc?ZX{OMp?38NM>$FC_F^C!7HC)xlFmg~#Vc?W)3RZnI zSB%u7`dER;6;*`BG|f{kC)1#Epf6U_aMK)NHS2~j%?g-o~@B9hcIM!HO#r8W*8p3NFM7N&E7{shaKCPDs}HMzZZigm^)ba}v5 zM7L}@G8Cg&{3B}np%r9P-g$vUum>0C3A>g}|IJ9h31QH2;WY^oyn?xlngdI0CMLoa zogfkqGOj{T2=Qo;pol_}@)9N`byMGEQZBbs9Y}G>v&h>MT;8jwzT@#Wx^R<~SZO7M z61M;(De(j(GIfrvD6uMY7J6cF=}jhifrU4hC0NG3&#&sY=%y_nj8K}JAysp zK=S{NX<*NNPxf^(;%yJrP%ej~n%XrqpEa%&f*Aq$Q*N5{!v;D1DAbU=*}lsFZ^=fF zkd2s+;q4wc8b0PO-lDkpOi3&h<9~@j{DLCozhxkPkty*n6o@x4f&N7T@k@$}oj`0I zop>FhGF0<8t3D4zasnGG49^LbUAt{ZYkD7y-$zP}k!Wcf2I*6b^t@6UtxtSyPXq%m z{J@n~0Mgrcu<->e)l{yguuefm&9<@?+sY;rhw@hR4o0Hj@oQuFyeVZydZ2s*8uDs; zpm&im_w9`X#_&JOHXd$_oLg?}j836ls?oCYeZk}9(~a~4#_)q>#@wA7%kF$Xu2AoL z?slVW-fq;zC9Kf4jy55;2{E)IBZFv89yCVIpCXDgH5Sy9U^NGgPkDvRu0BG|G#?{= z5vdYphaV#KHmjf?h*s=rP5;CwyL(HBb^JfQ+ppi!df$ zG^MP3AN(pSpI=@!IfgTfq0Bs{OvB~x1FsTDu^1ir7)H${Z6Ly@v~6T^Yy<;-qck?s zUfy_lJ4V*qm|aCBhA|5Dw8)U@*KN;`ZH@GqrN*=mVE8@>!}nC5@dGjZ-_Mx))W#tU z;3wGwFB-AzYm79pX$50s0qe=Fwny*{)VsilhBq%5!GF*-a>q~|S7|gqyrY7K>Ms~0 zpFku$;2L+ZzLt3oAAmp7YMXTgDc-TT3#mg{RH8ev8b4V0l_GJOb+*EN_EY>UdV<^# zBpSqMIFCfo z4~P=&0e)-D>v_YEm1QLc1A4L~K z3?D_$gMRfR!Ua^aw&Z`*1Xj^a>r9h;oo!oAK{Jk7wMNV?Td5`MSh>yJ)*SN zQQ_~1(Y#$06__!4G}UFG5FtErDI*!V^f@{^0d)(zTirG(&hF|a26f;H(HS<|s0Rs9+pGT_LijEvck^SPUyPhZFX39cSCWVEAS znt}{6ZD?e%A*1rLVFk&o*s#^I;n8fsWp#H8wWl%qrKws4re;xqQF$p4)+j&~EDM6- zRMp%UBFw&AuP0ggQsC5`8jKmzGimM>93Nx9}iRe1?^(HD1+y z7&`Ddo5zsixP!of<4!}0+sM(TK+pBUPK)UhmOq_1d4Hgh2o{)9N2BZYX4ys5X-T6;vyHlct<>UEhh}ssQlkq+Z_ui9_p@u?X7o+Z0gq==C*MsKYWjiK%C^^+qK7wh z6t&6ehxe4@%-})8|125WUz}-2bH0-`f9IUFV>)CUVevsztF$F=VrUBzSF&?gAaxZ> z!HX;LgIN?OLNmEN6yMHZXCq5!>`J|6w9cak10AC7=I9cb;Xnh8dD-NBUZS(M9*}eg zb#2euK`qo$mgDhA{T5D~7@`RDXQC?`i^jSRzc);y+nYQ1^>LBo4wZ_;?4SgKvqP`)Q8Q#WcYFYx`J5gb^NTpM zX+MA|>KG<$^`fv79C% zr@yl*mQ%MPq-hBFYoB!&U7ahS4!1_h5;xcEc@2gVc zebT=AA4qZM-iQ?MnTt{&IzQ;d(e%{zDNds%Q{fwQ0F=@he+EY@|8&n)|4?y$OAJ+CzaZJ|?Qp zFv$1l#ParF>$bA3WUPzNZ$&rzqSRn4jr~QNN@;(^I-CcuUm2sVm0@li^xLsN>1TVM zyxL-b!~)iDINX@~GjtkISw>mMp^0@IVl=R8g$y;12=j_9LKok+1>CV6;+!2j>s$Yc zyzkr>Cm86FJ4t??JQS%u*mGiN7E*s>W=SBmhLzP#Nb!pPW~BD8b2KgX4~BcvPNA3I zj~}col_Jr>km?F*lAj&k#UJ2DLM&pZL~$-CKelaRhY2wqmS7;m12?A3}czGw0-Xr{nUzvJmJJex;)>W2d&cyHuGX#?;u8a|Orfe$zH#t-`^|u1qFX1y9b%4XqlR(s3(SI*r|w}qCphDy39^dOUlpnA+;}y=#5A{%PZ^R ztNcb;IaB(LvdIxr+dyVe+jt;4Ka1KMZM845)#fQuo1&bn%~KKk9I4IEt*}!ac8WR> z6Penyf?%tSLG0ly(1+hG+kl}h_s5=lu@Glm{4U#Vd^m=e*i3xyiN-Xn*u8{Bp?8ki zc&rp0R%ATDB7z2Ivv+uIHQo>Tb2qZSGt==joa3dZ5vg;T1=?&Jbr^_ZQiwVX&si?p zOR{rcknB9=B|E=LvQtWu-KshU@L zke5j8tJ!=KwZbR4CY3&9O%d{Q2hp_Q0rn&zdMsFUB$^XlH127|%!#N~=sFGG*KY1O z51E>*1fWZ?8b6rzV9?NXes=VVi2JOVPW(S3Vdr)>BaKE&F~x+h8Z5OJ7~M{Hhi!vI zmuEifr8XIJe=;8`B;$hJX8atA3q=N^|=XlxcL|BOrxVvr3eb%-dlU%H)K=R#?yzG)I zahaxmA^o|K{(n5pCGJ7imQ7qQan)52w2T2IZ9R+`(LuE ziWx+xiru6}nl{UlWms@;v-Qyhx8$)Ll$mO)Kpji24E1ZcGB+ZnkNS^VrB3u{idEu1 zYUfS;EIIE*$OK!o(5pI`%07BjewiO@#V}^=sbLS{KilZ^zy#_|q0oDFr{>y1^w>h6 zz+s_|_2pP4@(A_0E?{*Nb%LL_dQh35FTZC%)NZrwp<;Gr8u3S=i8_w`uU^Kzf zj_pmfROBpvV%-WIo3N4o1Ufdf5gC1#2(#zaKg5j79$FImNO}hr#G2XiCboF(hf(yN za(<5WU9iB(&d~xVb&{~$a>>nbfxX}wb1%5k3=Z|f*hzb}m1P-APsiGFK}4tK5KK3_$GL6C>Cs;3So^-2|6CGcz=yA z^QX_k-bVDZtyscJKI^OJ(B+O$rDg6o1!66+w5-s`NYYR%!ptWqbHrhqZ9W-~qJqQa6u$bm?ddH=^!T)pn@(J)=(SKUGb)GO%!a zBkazwr1L1Rbf37_QVMMq6-y}%G-pi{9?n_`A7r8aa-VGr&aged+ExOE+0|F$L-u_8Y89-nb{UfZAwkQy82h0I zNG$@U1XyZm<)+rrhRR6#i9PL8%kFrMFPOpdxW5gjjkyoH*VV9~$GD)6gGsF59TwDb z54>DM1LB;>s<#>GD=W8<+^!|OZS?!%`^dDiw`u;E*XlG1<};Bi9B+GdQz`(q{c3kp zBJQ*6Y`<2}V;txa4x`_w3{e;Q;#Wer==L$a{UOwd#z1tuXJTl-vOA24!@H7O zABvP+i>8O>MQM;%O(Q(?@D10*`H^hWoF>nmiSx3{24GSqv9+?oHeRlL08gPnJ<`Ut ziCnU$?2-x~we=4&;bGqHs(2`%avP0=S%ij65xA^IGv5q@Kfh zc02EFU}={PyR&Y%&)W54*nQS6NB!=zq8uqDQRxv*K^?`q)9q0dB3dzi-5P9S4wRw{ z$DL@jcoeqM=3b24T1O)jTah3Li4ww-V&L6%t<)Ie=_6%#99C-V*&hAq(gXHjMt*qr z#GzMew!J**sBOa!mTcWNR93SsI#TlTf!4P8=*W@8F490fH1L>h-H2Lt$5T{LSo>5> z1<0`GL)}YGwA>_@oQ+dhsVTc-2X**XQ)gLB?0fo_ro8wT@tcsE56?^t{SGPaTY4&$ z?I~&*ZBL1P+td!ZXAsDnxYL={OS>$aR@A&jH}%c1?-j%ScTbgFb^@4N`z)w)Hd;Fc z_kqy;boLW_9(WloHd{f#-T$`PDKQlpVFn2O6P93e4`fT$@}QzviHZU)Ge$0{e3X#s z#&=x9xU*lQt_ciuA%<~u+di}YC~pav4UP1p&LE$Dh#e(Vv{7VFVO44RVe~8(vat*L z8n`$9=WOi42h;A!gR;9J5!=Bvg}Bb9ZCt7SSVk}J%l=(W4H%8Gxdr7>HbXo@%YJ<2 zmx>|Z;r}b7)-tEPfK(Mr{TZpHEL8^!^C`e4r1%c6bx57Uu3}(P0jTZLY5Z*Z3Nn~| zw#&kpT$6Ll$vU+HK2>ZJkm8O+iZn963Bo=WQT2_j)(K3J73{8C;PZmM7g z#!~Fh+~%Fcj0fxDi6vjCyb(%Z+}%&j`W&RW?V6C{wxfMz+;%r0#clUhq{QyH^cDY! zADOnPaG!N-g8^PoWd)mDgK^r@uhVmMSl7%d8toLqt3e&25)ySvNbB5fWtW`_Us;pd zR0Fls*Gk+dgt$idvZu2=VV4%1!Zn7vq>|)R8b-_jA=c3^;2rbXcSe9=)&UDDC^r%f z#P}$rE1MkJ87W2n_(yfUwd`Yzl<>P`qviO&fbKf2K%%LlY;rXG@;+1}Vrl|nR?tMr zRO~_5Ud?t*@PElu0{QK?T)6S%B9mTpOCZsCd6H>gWv_fEBRC<|_XR$+^<7-SQ8SSpDA0FFl)Vf8$(g|4Q?1`j&H^kx&N`9w2X z=Z8_!(!YucbH&o{Z=>sTA59(9I_=)r=)!|oHfUqq9&UrE2vs9}HuLaGTHz0~75+%s ziieP(d2^Hu?hdpo_OSS*^v~@%F?)8xH7u4!v4|a-)(E=T&zl)k9-`n(jim=Mqx%BC z8I5`aC9FK0jnt_uHH_3gEOk9yoj^T=r;rl+1e7vh?-OVT#P+IGGH^>Zn}0y*at~@Q zsig8oC1vE=%6^uVCONUa8wF)5S`yfk>M?3ah2bByn&+!sO^37UfC`1pYtv0tnT@mc z{F?NYTmmr=q{es)#NdV+grQzAchCTUcZHWCMf27ZL$q&d6-#{{Dc*&>6)9&509f;_dD02 zTEP4Itzm3}a3nu9ioT zo8=Mc76r;ma3hf@m) z>H)QwDDk!Tu0zGIqWR%1-FRw(dO)l+ge(?(aziyQO;8Vr^+cp~x6;OnpYWtsT2b+| zfj;+uItVwid25<_KyM)$D&B~;EPRShwN#p*9uT{TfH}zw2PwI@cX3v0fqFn3Fho0& z#@Pt?+#jtT>H%@g5YnTcjYy&i>H%@u5D9pQ=}8aj0dbKCT%pMFjEg)!mz zqiP9_`xDL7w#DpgDubRS^#uY(1T093-!sRu4WNcd!Qw=#w&w=y>IurdZEvobbH z8>OuHju4D`cx(wQZP{|^k*NnGmquk?B>{D148e|24SQZ*@F;G+;5N|pPv8c2koCA* z!0CMi_EL!6S?s}^EH|*1Ui2PeFSF=9#~!TLH`w!TXH{{o=lZu>X7|hnBQ)2WFW$ETJlMBL}m6!n0rPZTUxdCux$Bl2m2dO$QK;xju$0ZmX3h;NKX z0y{)OO;8VrP(vh;mA@va2SkTNvnrwq>H*Q!cqEWjfF`I1L<|x>Sv;&P;VG;vO+2kE zLCLKwjWWJWf6pvOI2zM&88-7EWJJe0DMnPSs2-hqFnS+U=2a3{jzcj7%W(wuykU2? z78Qrv_>0o^J9WjX!aoe6n8Rf-^bX?B6{!z6fV|RqW1!Okk26O zrK@ILa=zx;#BGKHAv5tdN9+`I2pVGmRq-@h^kgx z6VwA@A`zcib0sxFJs_qV54m;WFZNU`r3vZ*F$W1cIl*7KiH~mKEnSU}4(d-mIGhpz zs;W{6cL|NXh{l#GHLeIsHTW9`8W+Zdcj{D2XxtSzZl*%^XA^34;7aRxQV)DKBsx#h z!91x4^CTkvJQEsw+h^x#{EY*R8-Jb&jl1Vx=2=G1lX@`EqlwOwbTCiq!90nGKhK25 zKK0po8h_(J!E7G_92xG*3JRPg?v zY6*@1hpD4@Hex5hoe1ti1dQ864Xl-7Fv$S@7mY1?_Hnt!IMBE-X1MrKEuoyn9~;>& zdQ~kxH!jrz#_X#G7552^>xSdzFY5!U*vu*Ms3V|BX`3)+a7M1YWCAg8TyxxA) zgBqknWnLwL^IHZCi5n{u_FQ3XYa^aN7KxJ%e$fw|zlz~G$oZwKU-Knf?T5R;ZfOD1HQ$yrXm0YAq;}WFixHD`lh4Wl|4^fC20;F~C>r(Tft)gG_3ml4a5mL*mA2 zf<4LvpMJ_r+Bs*c((KD>(iVq+OzbtOq%)x&WYQ9qER!${i5sgu_C8aSj5(89sltni zC+9&{DyJfrsfyUa#PWu11K(5TV!6R=Vp~WdPy(@NgUx;@#jzwkkR` z>OpD)QOQypg&}ccjm4gAvr#6_Eu7PpZ{XwOX88oAv3xG!(WHTL;Y)cY4grttR|0Wg zRcAsy$Ye4qStheFByOyE*rOtaI%AP=9kq{FB-gR7xt+6w$N8j9W~FVCMZDOT*-Gn_ z&f+h$h~tzP(_GT8!qG*@f-l@ut-4N3tXy zH`YPy*|xFSHLEuNvP{n45b-mqsWYJ-WO5vpER*vX5;xW*?ERlIxr0MMCIjF`wpuz9 z>Om&gP{}g6k0EhmJ;dJUGQoB4ZTU=1Y~8=aAs~Uj;YPOFIuq(aCcmPRW%3$B;>LQ5 zJzDoK@zuMwd@a!ma*cC+>FjslBE7npRvf@mS*b4ZMGprrTJo^?oyDbvNJg{)wk2Oz z=SMxr?{CNak{}HExnqy*m$n3x358tZGp(Jj|2QwP##@0-Rh%+r6{o?VbXLk&?omnG zy6IyFT*biggATHgaT=Xxbz7eGbe`0MJiSoK>X=^V>5Dx#yc)TOyJm1Z!O&}=VS3Mm zPqDgK@Dhjej%pCOK^;~$b&Be;3d)Y+~J}Bp6d2Du`==!s>+f~n=&Q=9+c{Ru?@6_I@uhV;{ z-M(o>Z)$3|2~~R95`i4;90}+A*i<>U#FwY@4L9o;~#-&5Dk*ucc>S7klnB zdz@r&C&5_3*dGiNmg`3JXmYTYs0SI*1J~ZaPkp*W*YILSsJk~q=`0Z@_nJRP7_y#7#dnr zohJ1l%?QUdyXiE0P@42)0*l=i(xk!yO=&uBbp5K+!1)_8=7F<+1#$K-FV6lY9nSun z9d?faI?u{5ux!nAp40=UUXFPV)_D%Yo)_l1i1MVRF%?D}Op$ibzlV{H3C)5p8JeT7 zKxkj`6Fu6Oa*H0#+jFDqFYYZo`g+du5}#o$XLS;n1e>f|ma9_+r}|EloR&Hrar)8e zt&_X+mtAX5!fA-%*`-BuT@C6%HO8PaFG!)mQk;q*I62I~9v#8(l2&ddeEuPy@!|4@ z7co_9p}g!BG`1HC6b02LEv!B2!Olh$sLF^R)e;(iF^!*u-nO(8;7$a0 zAp*v=zagB^*ehvlp|p<+&kjk=9cWw_bBOp+EunGO>v2J)YVo;osTMFM{DFXK35~l2 z$F2T##%ykuw>U+6ze;v5X_Q-A#WcKqsqB5^i!D=~%Ay_RZ zu}7B@_i#@MhP}g_oZ)-I#M7V$uARi^f$c9C6jTF>`){-@^}zNtjvW6rZ9H;IvX!Q& z2h>HPY;XG6eOhaRdO-Y$gs(j{INzz(MkCY%cIrlIZiN}o?s5_(N200Cxcf#@vj%0U%8fz7`IS7A;Fg_ z5=+cK!NmIN#Ha^}<#kLfKqnUT9}{y*U|}_tRe`&3z3Hh336w?;B*j3LX*@3G8jqwZmtM;lytD0QxA4?B0v=>epE|n>}oW&l&EoGn;L)PK;y!gebk^@ z$(cGdTifxkl#OVwXGuMnM7x4Z*A?*ZfoH?nomB=vx7L34n`5-Z*b z2p9XlXnuH0E19%V8S23ao+wa_7eA^cG=3XaBR?sH`I;Q42U~&0g)!$#CEO)6uJ|~a z*j4R^HG7RZ>X}jxX4>hCY80tS>H!(`uQehq)QEaeBcl97ub22yEurz_K3gM`1NERr zG%k!eS`8}h6B@UFqBZKIXG%So=};o@&|y9uS;XekSyR*lYBW+lz8;ouYzoUa+|%-H zlHBqYFSPqcr@NZ+;`O}QV&e#JEpior?@)d6c_6hXHsvZb4&3_ z8IdGD8%-&mje3b^qbaNm(TP19-K>*@zsyptn@*B?kmNeYB)91#cVf>2pI-;#XCnMz zEWFtaJuK@Io%1i)gKOX4u$M~o{=go5G6()oSn*=cQ0F$TdBtaNayYm3C@w$Xmhh_T zuJffHH&3&DERyb&WgW<)>9MI1L8q~KKa2wwm3~u52(jP(OE1Cgz)rQwO*Q_9uUuw$nNE8 zd5OcjdRJOeaO@*39A~Kq$62C46(W9AOKAK*XnZMA}qH$r&2uZ+QLgW7R zul4DzXG=YpEqnx2oWbH9YwcC-qbceE(zy^Wb3C1>H*`z3y+cxa-kl~n+QH$>`Dbe|CTP74v_?hm< z;!NU%Z%h1wy{6qdckAA(n_oolu!yMG$nM=fI|e*(Opo&{-Z+V28#M**KG@ycg@*fu zMn{MC@#_}R%dbmBw+^u#9Y*r6P_da#FE}PPJUAFN9dKB?TzvP$C-@yM3^b#6!fyLulgv^VFiy z1}6P7!KrD(E?v5ZIk><+qgrAGjMFZ^qDxF{bY!;Ews=?U`H9}!|2(pQSZk!6qP0_uc7j*A zoGd>Pleev?a!N@uuG9hdq zDWXL2_N4+#1(ga23J(h^9u^oH6fRSn~txL?G~LaoYPFU zrbn+yZD)_#$Fui$p$bkOd$A{OEHfjq(Xk~qBXi`Z%m7fcN{lnd@&hbW@1!!;^gS=g&c9IVWcMiK2p!n*hD78}woG$z8~{6$JL zZ}=Tt&LueFMTcl&bvlV^*h5ca?@MR+BdTGBH?RjYgmYWMGpyPzHo8x6m57+I=t#T< z3yzKrOK^|1`@CphLkhiGDRq+DT+l&jrC1QTrF{R_Il9G_qh<_PD@gy&c{B0Mtm zi{==A4L(b7OqJFPd=%E8nYEfhVzZ{~Vb+wrV$`?^-NUTkpdZZo9rj?>aE4BJ)=i>A z!#XFpHNg+ERt?7fkl;8<5&!-lRKplf;@m=?$?(P=jOC9#U{q#_RfA>))u34cr<&sI z&*Rl&uIK_>QthW6gL~M2E99))F(Rg8WOPL3(AeN+RFcT9QC+Am304PK`xb#2c_iqN z!Xc{i4TeGDwS@8oADBU6TxvbfbPj%C0rRZfF|=E^2stYVTKsGqe_dxxa3lo9O=f%) zwr)19Qx*ANGgVwdTQUc_Kpk>vKa~sIJ8sFQYQq1+w#=KLM*)YZ$~f4bitK+bWBa!J zl9{UQpMZr9eQwW(>u2#Anbv*210&GtgJTEnEpY6BX8>vsH8fQ_q*~8zVRX`KA$Fsf zj-k;J;UQ76(ZNmYM#RK~c8HL>5I!gV;uB-J1TBLdqKOs11gfFbrLp&=C8&mKC_zo^ zK?&d~z-LQfPX687bqWk_S}i)XYeda%?YrBjj)hBnZ>y7_34-FLK0XS2o4GzvQ%bB1 zG#w}dO-C_m+=T97B{W4pC_@YEK^frr$!E)eD*<-2kZ#>WLh*ULzWD!wOZNZE@`-=k z`X<3V)lA#qqfkk+pj1^7t0YwfDoGVlj2btgd#GeM`avZ-U=Jz@&$a%iN`Ar9sQ)i3 z*(t$1)l9qMqyN2?tmxYNnb)#{^ScElpZ94?-&tym=Khl}uXvixr|*@d zb9)zBoP11{WD8q#+JCBH%6g;Lxc(HLGj*Aub?%iuyz{y{cJY(#e_yVd@2ie+ziv7_ zXh!Ehmlu6}zGItq$NdIPshFeDpwy2&x5vLPQLpox_IDRQj(&Q>hYad3T-=3{9?HdcWe9a$nx!m%(;>c`)*Iu9!jU~ zA8ZTg-EVmFU)AsG{?W`u&4!>Lc%q#N{aX%gH_$!uqc-*R;pURntbzdhefe z&7G-vSN+@LIWjz-P<8bNpK81N6spyI=gkh~TA!SExsm_is^z{Zw5h@XYxm`iQ67&k zeaib&{Zua3eJ<}G+qPlNR|i!d2e+N;^W^)(W$tfjGXz2`6u4=uQj{#-BRiMP5Gr!^v6$%pI`Ro_|g;Jm6}rK#gm(_=I$sz z>S?BQNjE<_>Xi1k2~CG4>0EPRn}OFp{!q@Pd#!Ux_RmmU{QK=aHh1utGH7y1r{CxU1*M@cOSa*M8O@&A1wQS6mDDZNQ|u5et0T)OmTUex+0P9r|JQ*@p4&3k?03>`rf|Nn5|JbF9PF*vXluyU+WnY(w`e zk8{S3Ihnz`{pwH2{uU z|J=P_?3G_$`ew@2`F!n@liS>{aH`ELmjclhVz!@t_U!kK17j!Le_rw1iARU2`#Ika zJu&UWn8#s-+Z`&oq}LU-y;_!y@LKxM+WD!A_6;amD6OCOLEjrW|F~=&7#CCMO*ij= zihH(u{B~~nZv(cSY+G>YyYR#J?+*1TRz7|F`^8;qblMuUYI~Z^?=H4?-4!0$H^)yi zu0)6C0?!HGOD)9|HmFJr$#J(QTF+~oKYQn zr|eSZue^t?WkoN2F5Wl%;A8*EdB0QlwNK=Hz3IZKKa`)kFS+zlh8b;qwpBV%`0?yY zMK7uQTs3FDydGAe$xZhxUuPPWp}4xg(BgGm!8cFqhkb0Z;_k8BGh0j=GqhKezEfuB zkL%}~Jm_X&k2bZF*1ejged~T#yF_`V{;&7hHg}3^az1Og+CS8BP|df%&`A~dhJ9K$ zVOeO4;Og&ktH-zfl682&P}gE=JBIgJc`Pbh_EC51u9`Zz>x@p7oSVFuTBBl#&pqCz z+39IR`cG(}9*_U~s}_6ejyawwT0I_r{0adrTCR?uR_(`$Z)QY% zU1jtJmA86a&F{V2%s)G449HbEVqM)oy{|7(=Le-%^H;yGv<~+mcGFKTUD*DhPUl&(_al`Y1eDEUUk z)%age8t~|S{YBm<7H`^J^RjPa760|n$a$SBZr`JRAN5b}<1<}~zRh;_^o463r*-&! zn)9GHgC`VH_0PJxN3XnZ_RUwvKgD&c_r7VSTFwuij;d9td9#w;ixwQTFQ~`U>!qr; z%30@!%Xe0}mHB4xuF!EHP(H&mq zeZAm~``j8C^IUl_v)IFIXF3nDZXX!;a_|h#!s|Z13{QSw%pdLi&ZTQ8mfS+UDk^19L0iPkFX|{ApDi*Z97w?w!hbo_|^{ zx>h~udh1}nX-Vd9>UKYP#I?uS(@j6Rwp{hag$nnIh(F%x@Bw#!%dqKQ#HKAZCS2cM zUgh1w_0RHIM?QS=ZR&n+?gYFTr{-JJIjE=W$kgT3@5?{Vt6qITk9%tS6r0s-XsxUf zhvNIh&-=gXkA+=-I_G%op@M#uXZ4Nim09JPZSkTvkEgaSes#^wqGt}oG*Ee|Je5z~ z>iNqZUXo+N=kmJ!NAsgOGfe28eAKG#Lvz)dwP@$i2kY@Z3 zza7o|?a8+h$B#eQuIBUqcW&jM2PO?}*L(Wq{3$!%e|@p-(Bt=>_iY;%mt)S&rGf2M zG|X5aS>0;A>OJZ3adg4rV~)CS=y0IG$Uz6URLjz<$Etc;QZyU+snnm|HShH+w%~A| z7JD|nfBMVf1&e2PX;UlTkb_@6$iJ)Oy^lRwG~BDUNAIW&m3FxGDV)3E&fiBwznq%; z?fE^i)t5a{^?LSex53*#^c}x7RlR?PrH+g{6j^RdgQ+*hCCL@-)BKMKGqTqBW>c@a zcM6tzQ9a+sspI|fziwS|VXKT6Bdcc1aeTwd^U5di!}=!&J6-LUzEN&*2%Fs_#yMrV zCfn+so!X~S;L3t?ld1h)>G!PfJa0#>GZU9KJ&?EMn4X!dO$aa1vW#cr|2lr>MX3i` zzs#+9b-7Q?v(w9zRO25jUj63wh@7q&HZ{JV{GEG?L6Pp)zioWV^WOKTU#1zJEQ5ck zZWo3(56P$WDxYyfGQH?@CdU%%pX3dj{*!0S%g*`JzH8n;dt2u_-+p&)me$Ws*COAh ze0@ic`K{8DB>N6MzJF)Q+SR*ijk!KQ%FnIB*!LwnT=;75g_Y0M_;uWKwYfTWN`*o% zKMb5$VtJOz_3{Ob?lEeGs!#lSs(e&^R@XaSe8a;&%l=pWlsP*#*B-v}rpo7YIzi(QJ;c0X|lMdNiy2rLt$@e$y^heOK#(%jUK9O^*-?@+f_pc?<)i_D%bMMo51*iJqb~@*7>sQR%`fH^N^UEn+>3+w9uk`GZXZe+z?RUn^ zd%OMl7P4%`f{yGu;wbEZ3G;(U2(lZaeuad88jfcx(+D$!j z@aoO)!OKbwy|erF+{|eLj@EwA`R~IY(hnX{ zp>q9&Dj(k^eUHnXk7Y|yj*q3Uj$A8^V)Nv=}@VXa&IOtzxPMaZP zd{$k&{G@TJO+)jR4ZJh`N}Y+nuIt^q+{L$dN|(4_;Yk0GgM~jddEk5GQ?~iZtYgEQ`NGa$xa=`zX$N)vQfott-P87cz4VWf`J$V>aw?|g(Zl21-PmGR9z0qU z^vnL9DN7wo{;=kd;f37lU0rgq|~J z|5dN@TG-%e+}e}d7J42|A8|MRFZZ8%XUSElY|i<$r_H>ZzgF87y{3G)-!@59))aNK zCpot+`I-%XRgF22@7JShp1$XXkJ%N`?62P5^UJLH>fIJ~T{pGGgP4z#wod!BrrFd% z-)Hwpf3(W06eatQ*z}m@R2Q?wI?27jJ_R^Ol6>|^xe z_`0>*Z&X^cZ|cZArRrZyI`vh(TPXs@{4>yZy3+Z0yZcNU)BaV7rM|B-hi?vwpNHb& zZ%6OAF;9jqdYY*~f!ei-ZV0{^pHsh&oSJ&#s-L1Q^}D(*SJ$=qpKZ(-6a8zPdR$!} zs{L?kkrS;KZy$MJXH=cnWoA9=5_P)9>v}`ytZsHEXmQ?t6W7lDxOdp%h*2-&^YMRI zesxk`UYp~6;d`Ik-k;lEpVNPCef-z;7=Jyh{8jztPo8*w`{rhMvUZufzRBVm&(-hh z-lc8#GJ~Gf81uI4TF>R3CZ@bSpkjgko@>4B_pA+v-kkd?s>e!>QNQ>yB@hf2?$|lV1^aU!uDEr$2kl zzoPDk)ry+Cq;b9d1%u9Ic~xfE_{&53F0UDv_mR3^+}a9Ee(I-g&$E=9+NoH{;|Fq8 zFTcHR$5}pmeOfu^4xE?cS?Rl@D*m)J?X!L_w@a%EdOi`l`oAebuAx#A4!< zBIj{&<}V9>ab4?|qs`eDTSC1~=4#pUdd_oeF5jvC{pNu?f3OtSy~zEI9%<)H`?v8I zC3l+BW9Rg$|EAl&Y5i~MTE}dU@2B!mzFzyoQZ;MRBje@m-rLIVo$udud&rfAKQwzg zxKgq~Q+FgO)1c4Mj{S$Z-769|F2nh{g(`f`x7)yjjXxZ0U2f}rpW4mFjIa7RUo~E9 zKj%q*=W|Z`x$(YhILNDJ8SfXrl=phPWQxxzmG70Q*&pq=>HOexoYI|JGN?|Zwoo;J8@2@r3>?|ELz50 ztvj_ogTuOajq;BSpF1Xr6MS^l#R_g85gO}Xq{w6^r@=B3*S(8>*KmACgChRn(c*Jg zarm)+c%Q_@DbC^T694dsc0D`fYz$8D4vve{8R)X+9~~YV8%iN~zr@8!{ef@wXPxE{ z2am#g5YRy5Y}qMz#KoyPJSbX)@SmC)sv-rE<`n!1i;ELaS-s1ozMTg&f@&8NBZslz z)88)eoz=Fcs2wr}8bQTI^p4Hh6+g->{`5gmoy9GXUq7vSgEF*h#0M#a2Hq=%8Mbef zyo;koycr`j@F&19;{Faj^4K-KMNE7`LHxKl!Mjp0x6Daf?@k6^+9&fNO>(Ark#kEK zM-7Z%#;M-D$P-6R3Z`kC)cuyD2L6J?jFY44$tXt+yenih?%g9M*)>!{cz4Z3eCZj@ z>+*{nax2?w=<@{{_#>=;8wb9t*2M|_$^>e-Ie*6hdz~pCc#rSjH1H)d|E5WY8u&{r z*h*phmR_}c(e{Er7c=#NI;V5krWw9K17EA{;slk1d8G(mGsZp+&C3@x@ON^s#){|6 zJKiy$OsG+74D#`H$Orx`oagMQ$$}btK8_mrwo8-q*<-^(9X0S*6Grpxsa}zG4b96B zHSl+ouz#HnfAOc|yt1RlJ}*CqdF4n{LtbB@2L2!t_V*e|GWa=qnjJZT#0JP zD>rI-z^(ZC*m&4#yBBH1VM5erw77+Q{O=zVlYpa^ec#E88u%L;IDY*&s@E__O+M7X z-=PEDn zPdz_$am*QxJTCCv4cLMnMEvfk5r+w(fvli?b?N9DM-BYtp^MW&xD`Kv#}s40q? zzTy^I(L-B`J8FW&BQ8z{;8y&k*_>INY0NgI<3=&ms5REab&hk8!x|Gqi*b|&_GP<< z)=vr4z}MTu8K_;|tqJTqB~hdH<#)+1moDMpRf=hrjxTW0QB#^}N>2QE$x#D;i)8lq zc0-cgaMYA#nkK`S-*(iLLk%45VY@dk{HUg*raWrw^|5QHJ{3@NQfvq~+g(Zj=XS?! z5zNLp=9Tqm1&8`nM2*Vl>c+9B95t1grt9RTuN^g&nI^LFr`3*{DokT-d9>eAQx!G# zxjSmAeSxNWq8h4U4b)r`w{VQ=ojG(R-DRE6R)I^9|$m00?a-thQpXOgMP7Bl&6t~cR8ZrC6<2d3_ zEAmM$ZXxHxXRj=9)U-qmT-k!A>!i`I9W~#4fu_|LXj-ENj*2kjQiGd4arA1#G`UaD z7R88PpAgif6}OPH-!Ds(IBMFWMtP<0*F_v=;*S%G8d$3^&Oe>s-*wcqLk%2(fiC~| zkCPoWVNCPGfS6Q{nsC&JMA7TJ5Lk+zyI~yfINfX#SN7Om!Rw&QLB+VyD8&?MZU% zD@RSAFVMhMpNrEiahp{9+$ukn9aq7HzUYFk<9mkpQ1sbtiig~3Hx6s0l{`j-wIFrO9E>4N>U*a?) zG%v(0ti$ysON-sw)S32+DX4)OgC_mC!oN;-*e}GcE5=cpKSy>RY}ZhI#1j8kujynW%x|A+))}TAi`ai!`v>>6rO>%`DWY8cxWzTa?PwhsK$Wn#9+} zoG;MKMGc(kpk2=um)p@x?3N;DbT62$jfff^sF88K-25l79+FVL*|0?q0# z(5(3a&Dt-}tos7Zdep$T0l+$I?e)V)+Vkzt8NWk~+TY>%;ChGsbOY1CYt)XKjZ6dk zvZH1b)8wkw@;gV(W~N!tKIU6T%@(GKpAYTJTTug7cW|uBbLNFuW6-nDU7TXY`cZR- zYk;k`xzjk?Q3Gdrpg$hlJk)WV9c-N1%P(};?l6wn<%AcU2VtBx$vkd3jHqL@sN!vT-vyY7f`RsKVXa5(BbHHJo{SM`=%_i#G~Q?T1=%&UR=-CLd`CXy{Alvq2*;dHv2kGE`Q9Pt z(@X<7J8I4_4ealB4drtdHSpDh$wcqF{b|JJjbFoaY@DuD=chaCkk5Ihf%oGaH5Zr$ z=H;ll$TV>LanxL5n)u_;yna9p{Pz%0=P?6f!W`#ynT=EWk@x8zZ1bXVuAm0~(;7HF zcYf_FmUjI5TxH|Hwzy&&ht}ASOf%N2_7X?UHKu{ry6qau=Q?U&k4_?f_W!i)tz$kn z*f=vbIGwoekdL^0kGG!f8uAi{KcRvDy#(f-q*;pYj$XIfIN){5!Rrpw!1l6h$m=d@ z{stfM(|68GvDxC+`5tQ2v1OotiH~<3yzVm%c-b}N^#C>SzdC@|x~$JDIePu%FwO%9 zuZK)C^61)vb`5#`j2bwaf!C9CnVva%{ldn1H@@oFpB=m&F%29K?HclWj2hTGpmG5L zgT%=*ehr_nap3jm#|~bJX_dBlYw+U1X$>j*OI%r#iAiMn>q!F&VK$ zB+}`T_)P~?5*B;~8noI%BMzaW!QXX48>S;UWrW6gDhLUY5O3l74_aMK!T)0dt+$R$ zkdZn%vP(vW>&Q~|C1B6kvdXHMn>yM3mI7|A~dfPGO|`jN+hLmVs+$e88Ow^=Mc#S2VZPz@h9T1RHX0a&z-I+9&ncR^dCBLih*jgH)s zkrF!M=0((C9VsLuw0bj$GCGmOb}POt8Cy?H#n~vT{C$T=a7s0Vs^MK3iPGbEd6QMk00Oqm1;>k%I6on35vot# z1nYB7YGO3y4F_q_mgz_{8Cj#9etBO~>7q`!=G(~-3@GEhhE$p}@WM1s{wo1VOCXsUsX#OX+T89A&Y`($LNj=YtT z?K)C01C9K%j)cp|Rvj5ABiD5#b4H@B=ty-L*{>sEGO|}khRDc49a%0TcXh4P(1~V$;w%bkCw5Rx7ivL!_TWWS&FhfJ5Z5L!?U9_+CRDBKsU7e>p^I zXNy11T!+ZdGSXMqXTKj&Ep#Mzc8bi^k;O97UPn^oAWeXd%#xALI&xY@y6ec-UlCPQ zM_$TEgpL%?Nt&;9BvM8u>Bv$UnW!W8Wn_?!WXwh5(01=4Hmj2g==+9J(?L@sWF)ta zw9ZZPWIE!Jha%%dgwE#sWn_+yMCT>VG#yEuk0SGRWQmM?t0P(SlV*aBES8b6I?}WN zX=dw4vVs(utRrh=WS)+cDny!@Ikpzk^DMxD}Xd@ zb>yEwisaRizCjdeqa$sKQ6!I!+$c_w);hAk1Vz5lk%A>D(o#nr$w(?4DN%|vMRcT% zj1<<9F*4$(BgIM+^_7myC_@on9hqB}B0f6uy^N&Ok@Mw9sG%in?P#w7_ zBT026bp_I-)sZ$b(o9D@f=Sa{M~YOWNK+ljP>CXGbfk`qG|`cu%A`rHBOPVLT}SrG zNC6$GQkAHJI&!)iMf`Q-Tn&m8(vjOWDbh$ss??%LV;y-cBMo(=Yi-gr(2-X%(n?37 z>yRc)M=r|903CTDBOW3`d+yr0M5Wh}gY_tqNk^{Kr$}}kncRRPId$YyLy8pBkv)wl zQc_3$kda^=Db$!WHFczyjP%oykS3)0PDl30$Tl5$C?h*`BwtgacIikD8QG&FXJllb zj=YzV13Hqk8I5yDN1DsX5gpklBgb^4R&%0G>BvACIj1AHWaP4rq;5gfRUN4-BR6#9 zFB!R~BVE2G>K7f^A|p?9Bt=WoRMU~_GV-I243&{xo zN-|PONBYS~Egd-~BU5#xXGa=mhK}Tlq{v1c86qRcb;PR^Y0l_KB^f!dBa39@wvIfN zk%v0cxigKEQAY-Mp-2`TnbDOZWpw16j8xWlN181&Pt`sj4Gsdl6-ch%jP2*NCoR zU8C&dKqRV9yhzvX^v7Nz3|>ML6Cr0x5%FF8;{On^Q#tF@E3SU8CpvDHhy(=6&*!BrlBK&kTfiz6i5CLMTj>tZu~QHsCO|P)A^<&~!w*uM|-nS-b0qo);Wm zQKLs*q$6r%9nmANQW`z7j_8r$fQus+EiM)i{0%_`6Op@tj_A1$Q5wt#s=iD|R6aVQ z^I4}fIv*X;dlOX6%vAg$UTabjH8NZ{at-YEGz+=8@V{opNGY|VYG_Rn(Srv225N#- zLWgxk?M*v%L}|9`NPy@;`&s;uyDHFD6$uEG*mV^NEGDq7PU7!0OhishM}n05ex=co zy$+FsDpFjz-&K)-05S3a;dRSIq{tSL(>SU$r9hHKP(P?hKoMD19SJNV<^}IOpH-T` zBC^mr5}+dAD@{qYEgq;yaXEGCv5EwgkUQ#n713K~w~7>1;|x`iVo+w7Q(qlX)zFbZ zwcT4NO;NdVthp)@sMZf$PT@AyD-$k6D55kGDx$2cK`K&QX>zMbKuJ;ODWa;$OhoQq zIufK-R6eCCrp`q9RivnzMOzgqp}g{{h}OUbG3H!cjgv=3v<5DtNh3PgQi)rP1Qd}o z^HUMEajdUYq@-G_zAB;)w3d&GlvFvVQxUE4R*|AA!*(iy=Q#0;6{;e57KZJRR7ccG z&=Ivst+YxLq&8189T6RDX~ZqgR8y%{1k^j8tR zl?$mzQI%mBM*Mr5ze#^4BJ?>%(Xp1Uy8cH!e9sqt>(~o!Eekc4f0Utq6H)rai#VWL zR+Gmk3^heksIlx`&ou>5uCrg~8lk;*NeVU0>xHJkYx1$3oec$_mV|~H=JirU`Mhdt zFSp(ZS*T%Nza!-dx8f(TTDwbzDl93~Ft1md5*?h^FzwY`QmA2GuQjFSWvGFYLJjl! z11VS`&|rJj(O%0Wg&OAdMrh6Uf_WM0nxs&}yxwXGykL6`*Ivo{Kur9fLE^`SdHo3y z{8XNrm!Zl@3N_5@9a3suQ#N#3ut0ltlN4&0*L&vGtX${f!hH2cV5lS?y7v_VR*LhiIr_ULQr&)UZVL6@3jA zAt}@_uYZtIH5?Y^wRgGp+9N5{Ft1O{%WKMCZ4KqyPdq3ZYM7TL&NOEKf*Ov}UcDuS z8s_DMl-j?_4vXq(sI`(p4fAqlUIBwfml&hHZc7R^%*%y&rJq%ylcBu()4Wi_yj+-dDyzZ3^hzrs9|0nNWq#1YHq_@zZ>ekq)@}Wk~1%- z=u3AD)ng!Kh#KbQi4>gW!E5Oi&k2TlA}Q1`uN2Iy=a@m24HXI(S)!qad3hnF_Agi) zYjq8;OA0m2D<$)S;t@DJj%2FCR@oHDGNR>XoEW!@N=< zm01wtg4^mkxIt6;8+q}Im1zjvivM{PG|VeC^Gbg7YDz<0kQ8c|7hLzdz<;KLUVHrV zl`_DX2W`DTWFifsln7=9LjCwWnM@w||?VQjH`EHO$MG zdF79sf5=eBB!wF0l?f^Po?@upqsR+2%quhV+WetO6+;ymO%!UFR~Dq~d&+8E!#k2f z4fD#%ykJi;)RZygg&O9Sjd{TpQAh1nc`Q+=VP1aBYr(+n9S!w^q)@}WvTF*)g`?;a z?bU7^d7*}R<}z9_;|3{Vplg zFsdL@xkNs2oN`&daE76BO@cfv3pI=?gcLmgh1NG^sk?>>krZke<*(-j6r58A>&j1) z6lz#C3Tp~h@2J+JoD6kXQmA2GMKq?0pHO#9R^MciDs6Qly z8s=4;dBKq_QhODiLe)SG^D4o-;K*jE1Cl}w^D4=_poWXISG}p^g&O8nig`f|4K+qm zs9|2EnHSV>mG(L!Dbz5pGRzBVXsAz;LJjjO%eH^W{?+Zm{%}T_M?rV0wskSMpZ1S1snXE|uSPL(P{IYM57Tq}27sj_qxx8R~+h zP{X|HFt2xwpQJWal36q_)G)8QNO_BgVJio}>($m!r6q+L=2ee*eUr7sEkkve6lyGg z@qM1L?Yf|SeWYNIg!bawC(noq5gPH8pV&~tGHig9T2WB>uDbHeq!(&fh7DPUPS zz8O;X$`fU;JZe~m&5^QKzP_&fN9lzcmSGE)AynQ_#pX~AQNz5xM#^4!Lv@i9YM56` z<^`2E)N)CohIxI1l)dtXx+5vnFt1k33o37@^mA!ms9}|Fjg-CeMA<8k8kS)jr0kXN zrYqk-dZC787{W4y${T8wq)@}W+9GAIyrK3<3N_3tlzBnr4fRG+s9|31kg`|aP=)4E z4N=3q!k8CS-cS*eLJg~YI8ye?6J@VFYFLI5NU6#feUfD8KwbIy(hD^#!}cu0QOUX= zH`EPDp@w;NKq`ZnHXM7u9dxmyq0-H#YM_RBb!1-eM|zGlR1-;|hIvIIrM7aR$Kxs+ zYO17A!@N2%uRBMo1{vytq)@}WIwPgFa@sE6R4|m+0-6_Um{%9(6?pzuXG7JI6l$1P zSLW6Er;>vVHC9rnVP4&sSK%8+(;4cdq)@|FRClD*irTQzHJB*-ib4&`FbXNCJdoFZ zeYd8DUQuofsT!zZ8TMcqhW02~#ZWaRg&O7+jgTRe@i!f-RhSjhqQm*u{^``vavx&0T5H-vz4k@))!Zkpgu3=m0 zg&J1FUPyTgFUaz*sAhhK8Yn5$Ft6T7sXgWX<-DB?HCIxoVP1WhSF>Ngdu6EIl0psh z>Wh@xQ_{_Gnr*1-l0psh>c_m^tc)sWsCSY=4Xb>Aq}1w7d+BZvQTEEChGjSaDL6&} z`FrW{6%Omlr(Y~WqM?RmIFMzyWY~>ehKiFEYM9p`r0lELP?sfz8b%F93SP4j9cxcm z_tu6gwgmFCEYvV+2vTbG{?_EXU_*(Q60xC%)o>`IDjXOaLQmA1yoX99x zheX+Hh#KZK2`N933hc|B7Nl_dS=Vr)^g<1*;bf##4KD}h`@>M@B!wF0H3cbq4GooI z1yutzjGBs+m(1{DfmN#wRbNu5VbnCFpz_dCFF8KNP~S=lHLQlyky4evRQPvU4SNky z!@Oo7rOxIXTzXdBs%v;%dZC8Za3)f!hGRB|9y8PjNuh>$eT$U6hK9<#l4gq ztwY$C4HYaY)G%r`QmPtR+dW=rs7{hX4XfcCM%A8?B#5 z7_}TJ4@$+#UAOI7L#>k(YFG_dAmt{hyyvFBBg$Sw)G)7=NU3!Q=jHu+U%oHBP{V4t z3Mo}XIHwpY$vR2_HOy-@QuZ1eDzBta!>Bb#+4p5b)sqxz7_}BDwW8p>Y^c7HLJh0o zI!28w8r_j7dks;;yw)RSuOWT28Ps8s^g<1*;de-R3JqilH8j+5Nuh>$Z9vLiLqk24 z6lxf?5h;5O4V8L5@_r0MMOlxsT#hSlw*pawo3{%%VI8s>Ej zDOJOzk6zw8s%v;rdZC8Z@HkSchQS95k1$m8%``96Fs~DOUa+Fz6I_P6B`MS}>LgO| z>33Kk(|mi^H&pl*@rH+R& zm7UrfD)~0b5H*ZCkCfV%TmLgI(omHpg&Ia(Kq{vg6t;5n!5=oC)hnu}q)@}EaS+<)yhDCRXkZ7o3HT)4N zRl{<-(uEnSt)x)HysjZ-uc4vFOA0lNx{g#vk%z1JSywc2xuNz*3N?(nfs}e(^!}R* zxQmA1yyonSXMWOvwyg_fG>@`FU^SXtUpCF)y+s|Cu^g!1z+fES@4K=KWw~m8s0}rJx_5xoVp}Y_8Ovwc|AZ%9ogLSOpbo6YdA`Jp@!A)C!|yj;k^Ju-H;S& znAbx+FLib>RKYzoFVryVXQWgOYi>Ax-%vv&g&Icvf|R=6IKRK(Jwx4+6lz!vA0efV zhbQW$_9Dt&L)0*@$4IH;Vd{pf+O5|$4A@KaLJh0o6QooP^IV=##84w8g&OAdD^m7# zXs8>KLJgyyB2_@70%wTdUSFMLsDOQxA!-=)3@No&E`R$ZrJ*KD3N@^Tzaa(J8_HrS=0WKGgvl=JgUOdkqaW zUQ(!G)bB{CGc3HCYN!X2LJgx{A*I$KyqapL@&_nG)UX=9W)!@dN|e2Zs9|1zAf=AI z@J{hiy$+{KFVwIazClXW@M78|a}BjaQmA2GZ;^uS1#_GIF6#(GU6&MUnAe}o>sUSa zYKHnKDbz5pcSyk*7QB4?CJi%G_JblM8fuu=d*aZZs9YbA_6l&Ot z`UfdE?n0YdWYT(~>?;a2EW=Mo!M+Tn+p+VL`sx++{-6knh8mV3h|OQ9H4fX{&`>uH z5rrD&<%E=duQb%|!$hHmQO-!IvqSOr1Kt~I{t=>3!zdS|U|)u|h8lU4qNrh% zD^hCzg7DW8kV6a%Md<&WT@_vLJjjufs{Jhz-Ju|wOUfBVP0O$3qE~h zsGlW;8s?P}DRs1g&pH|^`}Z_2)G#k^<^`WVGE{3xp@vo72Ptub4L<8gl)dt(VHu`E z%3V^h<|B0FXG<^CunbeP3}I~;>XD>S!@SZscn#8CL8mAM)G)8K%*z^>d6}VNC50O1 zl@2MWJhYWV>i?Eodu@>vYM57g<^_KbYp7|bX)M$*FZf1c7bidQu;^GZYr8K`roE!i zh>&QgVO|-T*Uba1s~RfLS)x$GynK;LCLRVacm>8#HzkD{MrA@Ok09Xr^2D-@*BEN* zIS~>KHH^xPR7!f-`r*!@+=i-up2DbMR2HOQ|AGu7!?R|drmNw0fhg3lYGg%9U8S5Y z@v^0%Hb@FJ%qtsG_G%ca`9<z?+}F==2ckF3%oji zebf~|9d!Wuic}w2OBErH=?W1=O8Su~ z)G)6qnu2N!Xnb~rp+Y2u8s=3MDL+Aoj#a7MxKe)FYrCXS!@R07uec+x>l&)lKVl%! zP{X{cBV|8V8Y;^tqEN%A8c3;g<&~*B_ZjL3Nuh>OHIYh6gIaw?#MU;{B#WM5p@vbl zkn$6h=wLOz($%QyL=TeMuv>d z2N|k;GNMq!yc+5Z!3(a;4He@-6lxgN2q}04296ePrA8Mu)Uf14p@vb7ky2OYn@S!D zG}LTQqEN%ACP=}&put}0qpPtx1yQJB)o7|IwO1PIuB1@IyqY29CwxQ)E1yn#rST#! z)G)8+%nPny4V5D$QK(^FEs(OWLqiqzCJHr-`WmTJB0HGZ=G~s33{}C0DAX{jB~r-+ z0j=4QlcNmPG!;>(VbnKzUO++Ry>&GrQWJ$5R*hDgQk6H_rJ!Oa*=G6fyb#3$ahU*cADwcsL)G)7(%qupq zgpK-DQmA2Gkx0QcHdN!zyW8uG*TRhCg&OA7iFqyQ{P3!wn)nih8s^nmQ)+vq(KSq# zi73=CuP&NW+sjZ@C50O1)m2l&fWss?J9R}ZA@&xs0XuZ@yI4fBd-Uhpk^hN_U2yimiuVvthn5S|km z>TEWmP{X`pnHOAR8>)47qEN%Udg^&W<>5Jzp?=Fj6l$1P9P@%}Y(ovmNfc_BS1;`a zYXhFA6x20Lk((&gFt6Us3uU-d^BMkzq(H-GIvJ_Lf`FO&PHZXOR}~>_A0-7E?llD| z^|>8B(;UH6RnTy+shR@CFKv9w8LwWF0uA??rYX^}9@ekA(oj<*1sXxw*7J0v)H!!i z$h?t;x*#dg2&!F749(ZFW*`-;er5M>C50M%q(wz1%TM$uVt1dZ$5B@pW^dXpD2RfF z=lpFV)OAULhEubUf|-hrZ0Z&Lcaj1Pr)DQY<*Gy(f`(Ibkg6eE;5i{R<<(MBpyAY9 zr1A>6dfm=cqnD&W!>M^ll@yeErN&SzC50Nc-RCDl`BtWRp@!}63y=yHUa&Ho1V3&8 z*-)DxC}^l*)Ivs;OIv-dp^iujH7vtLNU4=s^ZmKHhI%h4(5PzAA!#vEu*bpPohKsK z5JP3FLK%XFQ%jJ7voI(YSZmH0s)VFK!>Of6!K)cGuILB_wYri54X2hNrH%>JQ$(a-7#tNr8q_E09w2`YGw8iNu|cHK*OmG zNF}@uH%baLoZ5(#+FpDeo{yUSu=WC`o~aQ~QyEdAUjl zL(P^HXgGC1Q=(&azk8ycq1H+YG@LrfsF`8678~lgq(CDmTQv?LB~A%gjchfpZ8X#e zNr8rY9Y#u3gC92v)S&GJ8crQSD&ak)xuihDsiR1#wZV@Y!z2Y7P90;^pWW^s2L-jA zk^+sOY}Gi9R1R5<8e#Re8|td0K*POGAf>9o_mt<70u855YD#ouQ$6RJR722k>U*SA zHTa&APEw%Z)G0>swNX@3pb?a<8mEyeE2}Z&+VQ!dpw>xJpy6I;kW$s)Yh#|IK*OoC zNF}^BPDu(hoH~b;ss>*h?<55pPMv3zQ`SSbKtZi=Evh_dICVi&aJ1Q&q2%9&>L4l5 zaOxtX`1RokNr6UCw#r{ZstuOE;~xblBU3N)O$j8wvv52#Jm z01cW)L@Yt%pw19 z*RNn)YB}oCyig;b-O%%t+ejr`jaiaH4WsU8N;w!Wk9y>V8b;kkD&cDMmlSFkbx%`{ z)%a6VsA1K(kJMl>eaL3q1&^;yhMntEhNxj)50FZ@8uulI8bJZTO=va2&!_UCOKPFZVC@Q)|Ao`0ketWjU7il9S6L@pr_|Bt=%fRC!m z{`e%=){1rQW-)e!B!sSJLJ}a-Lr4BQ49Nh|ki-<44eN?s*NQGGYp>X__qy1ycg4lN z_TK&f&U$#TG4lOL1EmnrBDDy5ik~3&X}5PiAO%{3qSgn)8{3L{*g~h9WN^# z;Y5Y@-2C!;FO5Qly6KOrk0^8R^hk-vYWhT`M{wDyywde^`z_Qav@n?z`4{ z=RGQOTBxkCQRuM)+zwVYHCbPus*5+ZRLA39drWGbJUP{rswtgDEfyD`zNLwQPOBD# zKB%P5iC8ux!l{}>V@p$fR2rzA*2s0ZA*aem)Xq+gsco5Bj_+3DRV~$xrHzfQ9V1YI zI~p}Mr5d3&%ozd05H-)(O3DW`AEj!%Jinl;D__B5St5ZkwqNO}K_e4Ghm9JMC>>Q^ zIW#e>YG}X8K^1OY>0C)9`q`tN>VTr|#fj0CJr3q~$dgA3A_3F41>RVb; z3a8uAohf56)3!8JH`FcfdN9R#?X{d;npRu0yuCpWY)*}+X&h8ruW2FlMxlWc(`!>R z;)+4n9|xwS>ak90N!QSU!PT8&m4ENb~NonV(Rohr^1`Lcm z?TW?n2&-g!X;9ga!y4vKV+Pd17SzL8jXVz$ImHGLw8g=l>&N?(*#l!J_P04AgN;-4m9Ph{5 zXBJtMY^qJ-3_%-=OD9^}dMtX7Ykab%W@H0SGt}0*gW`Z>eN7$CA~_CHW7APdpm9b! z-6BMBr$jfLM$@oXjLtViI~Fer(3xy%@=}n7)3T|l=Bc$!sWP0<96hoLCpzMRlO^HP zGQbeG;A`Rda7w1H3 zbE-ZR82TVFWF>b*uPx=);hcPM#Bxu~)iw`pOof_Z6xuj3gu+(aTt)#998G_UFIITu zr4xwZD5cL#k|EAm7yLLq7-Tw%I_{0~hfcS%tE-6k8`-y^UTNIq)_ONV^Ycr)J7ZUS z&2>lm@%|v!lscppU%?Da&6-Tpff%C1kjlgm%0eUOo_l5cG|RM*TwnLwFiEXcCq=c2 zPX!0^pPCMKDNgo=>7?L+vS`L z4Ne82dfg^>@|OA&z6=YvB`y?e@1dT5s5amwoGZDZ(Q8{!-O*=1UuW&|rt4-LY=Aw#62hX6WXZum1$_|t5hh8CwGu?E## z)KxJTiTg_?7I#Pd^tzbbF(DBW>$T2 z8ops}#8`+guaPLtEwZmYc?DdAuH-~Ya;z!&uC&0p8p5#XFL2LDhK~*C46b6;?OTss zR^|a*IAu!cdzO`WIO$vCrjvIKimYQA=QiPFgVXQ)OCTC19aI#L3<-_}G~2md2!{@I zoecFKt34~IE6~)OD0i-;NVH6?ZO(jetQKr*6qgch+Yebt*D55Yv?iNs;-hhd*4oru zI~^xy@YVNBUbp(KW)uR(xGlp zl|tm~F+EvFJGlR8rkNv^pl_v{r7}SY>QcBgh0f9V3r*JBt!_!w zQ|E`W{Ob|^tdK?&Zw!~CA*82XTwf-LzMakkC{H>^G&mQ==Yxn)*&KzXwPfqjGR|04}xZ_SJ zICGS;+Pf(3v^m*4I5;D%5SyK^gW6?td4se5pgdi1q4uWL(Ci~DCn4E+si%9w(6G2uEkw@)fC}na*vws-MUv7)=ci! zt)@q^x~6B(?vq!^Zkb)1S6H{qw%NSe&2G2Mu90o-mf1F=E!{G^HeeWayCnv1cgfO% z#mOIJ$%0wca*>n1o;$s|qIFxM8JCCig`%M)ilwHrCU6%nG`+Tc35QusvAoQvtzbmk zzRLt!v!tZQsfe%Vx_%r83s?c9IEXPdHn>cp)!bb?h;Tf5c@7~%cXOzj-* z(?h&yI-QAXoP`Udra33^g)g;{hGUB9guBy_&i#Y@{b~WGY<%BeSP(C8AwE5wpQvo6 zlS2vI4%wWTooZ@`^ZB@O_-Yr2@$Q{-IK@#5h(4#f@g)K+0X&j!OswRad)PucyVmU9 z>But%t*#RzalK^vKCjA3tRb8WBUvaEKz!z1^jygRz99B*t#qBFZyHd$W;Me50va24 zJ7-a0yns%X!5$}?Hnz5}J$*-4z(tIihp2tdxed|2_?qUYbO6nl$J;Dw;@vaPBa?;3 zDENK0w37Nupp!cPFUT|}O}7Hr$INQ%Zd1%`lr@U^UW}QD~xL)Ftmja>doib!_$PNYP;qQHxb-dzxMn@Dc$LeJFt+eeM{q`@cq%` zWNRJykBN#J76 zL_<>}ZcqmG?I#KxAwO{0vNdaiVmlnoh7I!c%2Jdv7!}(d2D?h+ zekwXaX!PZb#|kE^*=`!2U4xy`uRXD`8DcYvO=y(m*bGR=#vhgv(~|YA7>i~l+)Gt3 zF4az{$MvCY8L6a$OL*v34=by1pfmXTIb$!fex#`wIb~Zy+?u82Y=Z;Mo&d|$a;>w^AvmFCN8)vV&ETus3n78e7i+9)^kf3!| zCJhm_#1zZm9)VL}&T1IXs!3mmLk}`Rmhoa3&*o6i4{1LlN$vO*UOBd>nrtNfa<_WmDsq-N8t&ES!9Wt*70)GcW*xeyvcS2W zLb7A@rd97&7Jhakz7`rU*)cH7IJF=J1DE|OZdQ;f{V{LOi9{@m_Y+376?Yg%z_#4@ z92N2ItPbS>J+DS}s~g>R9nq2Bf##)O1~;EYq=j1t9nJI|$r4y~^Kt~0-f!ru<5t7y zF3aQI_ed=(^B&}gF?_4B?%rV4KI+?;X%zFm-Z$KyoVmJllXPS^x_>!%Yct&;lNcg= zc~0M7Tkc5?tn7QD6virVVQ=sKgwp9ldgrRw^Hq;hkVH94w|fVa3k%)DBg;qlME7h< z(qML`W3o2w+O^I0uExiK+(`BpV*DA71KSW3{ZUr>z+knzdLq~>{VcaTW3cKR2WH%! z?L42HZtg$nabSAj_f{G0JF3Rs{z>NcNrj)&<{r<5kIK@vXM7x(-ZA6jK;H2WfAr@1 znXtTTGwZh-r5_d-IJTDDwHX=jZ0*hN4ZYTPnMUkgK1auH+huk*;_f3~iLG+$ci-3* zwSM<&tXgpoc8a7+yN@5zZe;)X!ClGYYwy+N*8f0o*>=n4CQEkAcos?57&?;_`QZth zvx%;f?YOt{$LY-MUHRj*Ywz+Ir(Nw;}aGs#{r(r!gJ>`iReks0gO;uGM#c7Sz*IeV!Jehu5~_;ZK39?&x8@ z>1wmAnl^U%`~Yp*=;frIHonCAH(k>PWw1w}63btM4OC*gN1zhR-;oVeV!KD663;IE zFVF@mvE3tGiPPk`wVJQ|pXZPrxdR2 zUu^dmc&mmv>F|hCmh@NR!^&AHyn4Y1@7YwA8gp}6J6=s?ipNW+wS89A<1zGC zZUtY6D*het>S&E2YoRIu68t2B}dn!Qb_VBR%dZ8{Zbk9K@# zlD=|gh1`3j&!W}X6R%M$?_TwLko6A1vsH?rF*4~yClK2`gA<7DK3)(K{S~_?CJ-As zEiQEN;KOl41Ap)X?=~(&uMh5%ftY7nWFW{)&@?u*NiA(04HxQrnL-a%3y$u#yLgNA z%_n6nbwoUu5H0=KFcUq~GwhYz2BG8vXW$H+Z&X zUq5f!vbUc+ZQ0wcy9hyU%ieC?ZQa|gyKB4ZZtLD|-No&yyRCbBiB{0Y`|$j9Yr8^l zVcBLgqASfdO9hvnZ5Ht&TNsdtP9(Aq-Gp#PDcQ$?NkR6pySFpu$UgS_sMN5u+0&NC z!>hbxSx)MHA}yy1#3Wlz)%XdxoGM7Sa!uPF=;pO!oA>uys?8E&TeMlok9M0Sym+RX ztD9;YTWTBXgHI2`Pa@zEdG4|_ULIiR>3DuH10Mu>u3_guB-^xqB#doR3B<5X`=nHK5ZKu8?MV=QBI9`(DyH_f7aY+ZSb34Jr{LCS9Q=09hY{*`~+RE zJ#0|FU2JI4HJg2W2W{xIo79cu59`1Q{cJo^)r-;!sL2oV3aCtMqZLr4-^44RGINGR z#xdb>E*4F1mau74vx>caxe|_!b$=Yh`DssYz*~tHq=P^~pNuAUE`Z6;FYWFu zhO^Vk#i%>wy#@n^x9?ndfT>d zFv!t{4TN3zH5}*4Yy8Hc>G zzyf)7GCQ*9U7d^%EM!+Fv(tUj_Sb_}(y#G&{cx4H)9-t$ys2V;TjdS*``9XPYNq{a zCH*Q_#{Fug*_nC2T4|=XwO_3?gEQ|}E6vn&zruRVJp^dMV*d|v2!JCK@A#v>p(Z6g z?r;uYz=ddyxHniuMG#m8?4y_C0`fScxby?^NS+k`bXBDzx z!=JbL{ZoW(nijGV{6Oxv>9kTdZ20pgfPbEMO#;N-G@$Q;GC3)kjRXvIf)zXg_$TYv zB*33C0o)OQzHwQT0DsB^@D2g!dvE6}Ao_MF(Olion5s!MwlrBEC1!afbe03qbd9q7 zmMI%H@NxjZgYB3=6GG$yfi;1uiF16sXB2vY@=~fTLyGAKbKOP>%$RLiHriFfiQr{H z2Fn7w3Ibjj=KT!x+J9u1L1k|6*EB(Ox;HpY>NY|9)>dm8L3TAl22lz2gSM`3GN^7% zPoRev1+HL;^aQ#jdd-XwS3EN~GOsP48DUK$G~&0%R$3!?OQZI#w%ax`Ww@NStAv+H z%Wb`EXGLHwY)TGI&8i=Z=zO7PgP?Tf87jgW;# zaC^dOTN<^0#oLxnk?}Inrjq5q;83k6 zn@?YJBu3)rI1?>R$=a6Ycx5H7DyvK3jzhi!20*f|uAw^F($FNm#tdh|9mT*Bk#4$! zd)C*d5nEJ<;P{VshFMN1RtJ;)t4&uYtHldXS0~&3Yfx7wtJ~5Y(f!(SwV~gaiy~iW z`uDoEuMTfo$b1yYM#UIA#>U<0yB$MF`z-l$hPiFS-kM0q!(Fl5`zqP(Ns@$a&rrQ4 z-kHa{ZPUw|NM|1DHcW}86XWT@n14zbts-B)nsj(x>z?`Q)=pW{&)q|JI+<&`_BB35mLA`TI!ufxJ?4a9jC$TDvLv_;` zW&7dE=2TIa+bz!eO0S*FxohF|6$|NuCe#HYaO+s zbM77wr*hBl2hP$vi8MAbFnrd%ok9VVf?s7MT9UPObeHd#V&{7h(G31`K^(u|SdJh& zUy&pR7KLrgmZE1QC8+;ofJCysCehH;I5kePq~+dk7kQA1>3}tG%04iqrN3QI z*xkQpSBba`$>_c;{hB%AMYb=8NiPT$v+bJJ;9tQGEUBGS3~o+kyEXiIc};uZS+928 zZ#lMy+dIU&wF0ZrHT`2H^bhe0$~Em_d#6UW$1AsgtZ5H^HuXv$ud=tes%pvTzBG3_ zOfS}K7gsiwv}J-z{fnreayxQ-6^V+MESX)dS=!RlR6D5^ z4>eex7lme63x3AFM`~tus?qsPU8ilj_l?K!=dyUBpl?~cV(8HF(m@r2;-l&hu5Xx8 zU((IT3F|QlkAZeBnsk$u_jdo>)Rdf+s87vE)TQdDv`h^Vj()%Rz{(+I4sfOy74|#NmW5f>1e-RH-&n}5@jQmAC{C92s_a17B8*nJGy|9yQtW)o_>Nf zQCmN`As#2o6C*3TqAJHHsqs{2sR2pbq*jTCY}avcL;bPLBPUeOE_5L)4q z@c$+gcG{~nen7t=l|u)W4uo=3ZT*yzZY>QBXsd?$Dae}gihiY|28~P%9X4u2qI6Vw z<w zQTh$799S`AXnEYd>@VC=Fr*a=!&BPQuEO74ONyj_Ei8?f;NdhCrE%%U#pI{S-%Et3A#^~`6}?$A6DNPj#DB;^f()Sz9ZAF`*K&wM8}P_cg8 zaB@(AaK3d_e9Q)FKlM%2V#WH=%P~@cq>WU3%tmTI^^MeG#i0?-a#(as5A2vWH}EGm zG4dDREagW-a6o1;uDdl*8d~9L8?9irJ_FYGE0dl2R;EXl^xWc1S-xwbKc`&?{gF+T z{LME>^Pw2*QE8SYDSmpmU{lyZerNhPmtwV;#4A%p$M^A)@f45ix&SbhfL zzoI<#n{dU}7#xFEShKp$ni9!k^=&=s2)$4j<7`%InMm2J(k_v*U!!#*Ww+`?qB&LF z+Em*zD^cChaByuZmPpK;HZ5KdE|bImEhvy;#R68`-409oryHUtH1hphz?<^jnW5{j z?xkbLj;|>7_lusU(C*izTd$(LKq>6evsbU~-3z-G1pbJ(g#`uOyLZpa>xR;!kUpEZ ze$DX*uUB;2!h;S!r$g-U?P5;pT+@`QZke8P{}+pWloN|RISensvVO-{=bF@{)+zZT z(tmydZ*Hv$bMaWmzMY$Dk}b(J6^juucZ9%o>=^GnskzywVzIS?|Kay@Iu_h7>J7wa zCr0#!#YL_^xEEzyOKN6I{c)^6>X7!8|VI{CZ!_jm4e=bIn+{-VGFbRPQ$9a$>t+qoS&pxGrG&7`Ow$Re-rz z%K7$f4(@6&_ZYZ?!9511XuNA5wWA*wUvDt}J|4^!%ym$3wErW_;H^_+dc^(5l6%UM zd)9)x9reBl?vw-d{+@x4Zw1ru|6Fce?C1Lt&a0EboW~r|DsBOo>n*t3!8~liJq_kH z3+`PoUs!NIfm!G8uD@YF{5&Xte;vWZEw}@~%rKy{+KIX#y`rHZN-UO3Mx%Gza z^SOV4I|a<1lU*)6zxmuKaFfB@#T=%mz&PY{v+(z4zzmq;>gnv84CXWDboOmEH79m6 zHYz&%J_l1?>vB5##)5g4IhB3up{~!te9s)I`s1$eFL5~sA+NAeQE^LQ(B@#iu5-Ed z!TNgPd>Jz>CsvIusu$*_fth9CXg)s%%v(~<_oD>WeF$c^2De^SoHxbC)nHm0U5@&_ z%8xA$$%*A*Gx@P6nC?=}w{KI(#K8=2GS~Yhm|vMAT4mq5%{j5nu|@6k>%9OU?*QiZ z7MI&dq1P3E@738GLG8m zS}=D@IltZk$kRu`Y&_eocT;m>mBOqg*m_8`=PfPnCF;N^-G%H zz5w(4VXmHvyAOIh9G(+<0~?hv7jBQAz^rqG%h9VWezbn>2xfaJ=ld}P@!ORds+Wqd z=W}H+sAY~@r%TDXC!lxRF=lQ7kfV>!iRGW*vVRHH>-$T2a0HlBnIqb_FU*|>=1L3h zCNK|La8H7H!-9Js%y$Nkjz3~^(SNZ~QTajbwgZ?wq@3R#Gr)CahV-cTaq+pw(Qa3R zYdXcPcjFM}$B*j$4b1wd>g^*xwg9u61y=~B+=3edCTYPP4CV*}M}C|D<}3?tKA5X5 zxLd&7FXj9=k3hYP!R&CF8^7@SAROlkFvFP(=Yg+x1N06Av;OI>o^IW~FPH($sq{8P zzpMiD_cL8RT^@W4<~!!XdSO3e|ICSPh>c2^^ZlUXulFPRlQ@tm4G>ixp2Pt zarqY9y-Vnf3C)6i7K= zkJ`64m@}ADweL^h?f`T11#Z3J_VxAXJYk0mT?TKRB5U6*@W~Kxlb8+1#n&UQ4$K@2 z?nE&2Ex0Se+-=~tLA{THdE0{f2u$w3WbNVmK__}Q1ak;;s{Tgx9tUQ=L2qwxS2BaQ zPLai#xECzB*nD%lk>1{x+*nKQSW9l9CHIB}N9TRly9nzXY*bYFN8AozcDLY)!0czi z^#@aB;OKa00+?D0t{Kc63+_ZP=UQ-=fVtkl^@4r3gZYvc=Rrx~SlPm!9By+0#BW@{}^{;Y$ z(Q!M18DQXO-kJbr3Uey^==kaoFh?3VTG!2G25+4r%NOEau;g~S+T3oWcaSA_t0fn^ z#;)FhmfSfO+$Qkj9dKVTt7;Eg@BU<=NBw`}Yq5U8Mn$DZ+zwzmS#W!UDYW4FfQcKp zw^8o_VD`AqwNI7L4};qeOwRQ#ryB34fZGYo@yw}?KTZYr5}2ABTs;*>=kaa z_&o#eF)-&WboIjL|NL=xI=C;uOukWHZy~rvU_M|@6_-oF{S4-!oAi2Lg8LlI(wki_ zJb#3bFW0*zC$yBK6?*p(= z3H#x5G_EZL^FQXoe)t^a(YMTy9u?nTpUcPJf3W1Xzs+$Z)I3QkBeoO^-s6mhHI}OYN14rk57J>Q7f?MZ~oLFCMR8)RYy`#a@8n`#W z9S&yPovxnlx`KRxl4pIX~~I-Y39ZahJK?Pr>}ioUYyucjLSsHY#B* zT<irbVk5VpNZ-@JF{t6ovoxi(0fO#Jq6Ufp7DPUeVaAfyJPvZC-8x?xZ>sY|o zi~8{+Zf7uEEVy1^DlE96U=B2JbY4CM=Is!dzMj>$Z!d5kf!X3I*ALbFLEP?OMp$rD zz?^B|N}zW+nD>}dt+R>i@HFN(Y*bWSH9ngN<{{=(>owy32WH4KuAYjc^A^*=+{m0N zF2p@T%o2V4js&*_n13>-@`Jb=!4y2J_qQ0_5HLqGr?QW@bHFS%a0h{V3(SD$+=|?q@Ljz2w@b z;|>J#FAMH2Fuxi&ipzE{BM-1qQN@Mq8xQ6}=2Z5P-ko6Hv(WnyOrKZu{?hm|4$OH5 zj_g|m<_8OIt5sT)Jpb(?umcoWR8%!U03A6KmV4$kXgqoU%do*lsKW5M+R)8B#{4kl^A9Sr7B z3+^~DXIpR=fw@7-`FT%GaR-=lm$`A-6#o0|;m0oze=mI(eqf`biXZjsgTc%&a1`gG zz?@;hT>$193+`4hk63WefO*@3`v}aB7F>t-kXP8KgyZ7J**Ra#j057ukF(DmkH2>U zcO|o`ahLx7sD&PJ|FPh11otGk!{2xP2#=?J9_$G2A!hK_DKbAu?;UVweqh#ng&CHU z#)Z~(-&t}KKXmIf=`FV8ia)Z`n{Uaj_pzN`lO^|t1(%0l^!p#yYuKo$@+uFX9Si1C z14rkT9|ZF=bE@Ny_rdM_3GO%e)U8)FuYL(`2QV9drswLwbpms$1-Agq#-Ho;mXIEp zub5MV4A+tbBBPN2WEq>^?o#g+X>7W z29E5$j2XOjimd+TjlqZ91)k=?q{pQ-I`u=h|eB21;q~Bdmbw1)hsP{22r#nX;;_*i~E|-E?$Q-Gv z^5sr2k4ib;52|+wnDcXJWY*Vv9hf_q)7ASBm}jJ%UoVYouYx%s*R40a-tf6a;7$kA zuY=jX@n9x1r?amS%wbZ_ueToc9uMXlDHm>!-@vTDmTOxz>VP1m-~l zN8`|wU_O#^ew-;^z6SI6jm`OTDVT-K>Ee7Rm`4p9<;xN<-x)ZHOKg+e*oN4sgzNSF z7>3Wb0yCL8qGkPKIQ~8x%o7G~18{FMgSSqR>1~HkJ_fgTN4+tqYj_4IJ4w0L*9uNA^twbESbJ`)&gB zi-B{_|80>Q+Y%cURa_`vc4Ec>@gi#v8V_~`7dPmg5AFak%M9EgaG!$dwWZ!Z`u?+w z8N79h%sx8*Ji&r1MIbH!_r_Lkz3XE?UoSjw#s8Wc8-$HYIDS5NAU+!n=0+*!k1tg3 zU0{CM+Fb9%ZE|CE*i7|K2lK3y^Xsj}0p;sp%6D@0c7dqM-$i+t7qIE-rSbGhFt1o} z{{{1z1@{A(wf<(VcVjTyT5$Pb3M{zZVES2b!@x|i;3k7TqvE%(&(U$tZk^m1JCK6g3whcF-1wbcR<$mszhBIZP7mo9yTXDy0^GIW z_RKfuK{1%Pl=JxcxHGKVOfy_rQE= z;HW*m2h-Zw?C+6aPLgtdz5QX(*HIhj%o!Hk1z@g_a$);!1ao23CR12BJ;a=ssQp8IdiI03|qKTn6b-7L7X;NU*s9_S-$H(&1!aBqXTYd=~1e2(l} z#*E3nk1RNvFF&{765vYrcWu+vOY5AA!F7ns{0NWZdx7b}oGuSa!3>sieq3l?9Rub? zDHpEyZ7~0na$&u1!8Dh;e(3Bw9L!uP=j+ir=bvCY_BHEm3uad-=j+jV{sJ)brCiwG zE5Y0%<$OK5|KnaT^U7TN=+)2ru-^4x?qp6EmxsYDk#c^$be`rlX7JW2e!XGtYYXmF z7_?!z>w`{@`sKU|Ge`Dy?r+ESx8Ue|wTTwoKHv@=V6OL5oUpsH632t%T=r<#>&GwL zZdd(1H+CyFDv(!l_knrBf_o9nI~Lskz1Dx{ff;JS zjRTXi;2OXjYQY@`<_rt&0x(xta5sXv$AWtd%<~r9n_xb&;Jya)y9M``i8!x}&D6d- zf!WJ~>jtLOf*S~Cj0KkjGtGjV0p=JB?i4WRTX6pdbAttU2bf1JxM#q;F6I33^f@%b zdth!$n%m<6Fi%-ot@j_WLp5GaYRQe&V>9K;OfbhQEU@6N1#`Ov_aK<3Ex1>}ylcUI2IeOVZmsE9Ct@?@{kC9swcrZC z>}$dG15;(eO#n01f@=bEgavm3n6oUn`CzU#aP&!r-QS%% z1M?d;UAqyt6PO|kZeK7%4IF(RFb+&g%K76i9gjCKL-tYe$K5d3Y{Aj_hZ&aKYzvOg z%O7sZ{b0fEh6Qf(OpN!l-1bnNkD%{y9t86tbK!Nd9~biXD`xQ4DYEzx_pJrj1KbZ5 z9DP6CWwz^sQz>3#_0oBPdP}awf}{HkXIpSda4%VKl=nRj#r%PdiYm?td@vHs&4;<1 z?)s|{hv&u;*rIyj9ejeP6%FYHe;0Rg0K1b`TDlqv+>bYCNbq2G{ zz&#J{Q!w|>5%gw;f9Hq3hgi%E-Z~}Tu^`^LG0f4p@f^6fn5DdRI6;rNUo7?3J1RG} z1vV-wJ+iNe83)9R%D&#<`Wf`dz8XutMsSB2^vJ$>mU;`oU2o7M`<}Gadj;IP20gMb z_h>i9cj`hlx5=u!L{E%j!CJJz5__ARi~TLkVwgWlHATMFg} zk&}#9TOFGl>x7MpDtlD>^Fcw^mh2GJYdMAQA$Dp@8EV{)~Zwa_J40`16PnLSQ z$LGd2#zsYzFVwz!Gvk1GQN^zu+%SV4*;j9=Hyzy37J3(3>Rk!$77M-SEcIRk_r8VR zTK}*c|271-HM6Srp!uV_rCwifLkxP<9(9&_E#T%@=*_p(yByq220ik3iKX5f;660y zk-zJlVAmcSgWHx_ReR(^uP2xZ%#pIHe>8$Q%%Dg28_fgr?~opThf)~V==$f|z&v8$ zD1NUpgSSqJ)9+dedc?gK;pFS$FTwrFtST;~x7}R3IPV6oE3+y+npcN|Nij#qN2)kC zfH~BlNA{i14Bk3LrFR*)8!hynvDAAV+y@3d%G0$^w2R+H;I?5_6+iN~hoxQ_xS<9; zvTvHDUMskx40<&0Uu3Cw1Gu{kdSu_LmU{1i`_w{jgOlvqV{>pjF{^8j{Veq=!HqKL zQU7QL^AC}eteY+abEC)!;{mnDGhp5pIf>q{VE%Hl8yl6s)E>JrgSSpm^|vnI`dH|V zv(!t1n`Y3Xb=XN@u3(P5QQ3DFn8yryG>*Rq=ChDqblj!iEyz73H?|2jDsH_|j;_Dl znHdMfi)tL-Gs4No@$TUIGOKDg%BzWBT0~Bg2WNtrFLIK+x*N=sA}7)N7|eGfC+JaL zZE>m_J3lURf42v>JF_Z(Nw1%!-Vku(4SE#6nP5&9If=hlgIOeUg1^)+UjXy2$Vv2a zPs92i8x_yr=?!%)lj@wm(F=XLH#6QJx5e*h3-!|c(OKYB{i8Ryeqz0X9>uxFQm+o& zObfkpEcNDtyV^qUaZ9}=;NB4RggDcB2(L!*FtZirQTF`1}o+UqgD)akl{6 zrf1+f3T#wpKiRlT_oZII3~^Ls9OeDx5l%i{T@UU~W_9iMilyFCaGx0TsGqNYrt2&D zKt&bjt-y6+R%IWJe{nD)MNTqaHGw%o@$W(~*NU7(Z!wscL{88nf4^Y{Z=Is@ zH}+55?~IL#&fh)3>@RW>`zC;yDsqB-N^dNlssZ>jeJxTO|)zgg;S zb}p`O!bU|EKk9G$GUI@FQT2}j;6@ts$loR~$BUd~yt)+3LXi{3D;ocv2J@E4N%VdJ zv)*}Te|KfZ+AaiQfBQz7jb>kNQW)^TmEC z?{8a!%V$=XFMTcbhJYJy(4*t-nPAQmIf=hFfw@=Y1b-=C-T?E7$Vv3ppNH>%u~AX^ zOM1m%%9+!hcN_v{yg|>IkHDO6p*IiAw&cW}OSn{^o-z7CDJt6_~$^ zoX{RLz8uC3#hHp~d^rK!Sq44Imz%&m%^Z27()%x%&kTArpKW*{u1mv4#np?>gLM97 z4=@GHxp^SxdNbn);zf2GKyfLJaPodR7~D8!Re4H!Gc5Iv0e6~(-gTCGcYu4uphx{^ z8JMq`)3w{W|H_SRj*W`SU%HRJ5KMRGRPEvH&x|987g>8yzbpfHAhSCA8o(UNoXS4R ztMkDu2nXivC`LPq2-I;Us zqTzc;;mCux-D{JL7|m4F*)&?Eb5E%goocep{1?7P5H?+S1? z8}z7sp9S-t$Vu9x!zK8>0vi=o{HT5R0kfaTN%Rf`GezVi?Ry+EPQ`dp1x}Txw}X3FtXJ@Z+U>t!z7si#A6s0V8_UB+MU@8>=l#J9 z5jlxo9hjLSCyC2B%s3U(iy|)P37je}7lXT2tXC43#bDkNIf);?fLZSvb6j=>(_Q2w zdLzM16gf#;j$lR?7n+ae2%IV|CxbgrtXGH&<=-Mpy?enew$S^~Qtu0JzZmo=pSQg> zH`W;&6)#UEaUKL_tjG!eQa(=ybG*n&^ezRnP~;@-_B1n&f%Kxt=OqHCYPVOwy(`u$ z_(5^Wy$xyTGa9azD5y z#d-xl==|TuU~;cF$0ZNU-XbUHQJfC|^LLSx#N{wBCy1P&M{&L!%p#GK=)C}DsmMw6 zegm`d4Q7A$2GdjIB<(hu8JOx8NxM;;$AW8QmTFhE+p%CyXU@x0!4EoKxE{=HA-(AO zp2n*uz&y{K?)>DN%wQL%$c`(>kEP&#U{>eHh6{0D2R14?Ke~e{Vb0Z)`!NE{fz0Xr zNHOD7j2D?7dHDNOa3?UU^W#D=S2CyagRXmc6wLD>F6syMk1xTjePb{#QI6VeXE1v) zr}CHXhv){Tj5$^O=zRMaX7JW2vba!x`#*5gLV5+#`-G1Ia|&~+xX^VT*MPY-q$l_H zKVY6^PUSDf<#lEpC-CCnZStfEqdr+R{+?*TR6dM(4~okiFlULJ#E+Z6+$(Z|9>wJiFrSE=L~s3Du};KBMHiQ1W*m@S z6mjV(aH_bJgBvE+EBHZisRwhk$VvRT7|gXIC+JaJ7K3?B&5fNK z6ue5}LhGw7!0pW}?V*ZG9Lyl*ygU{Bpn2vXFwG&o==@9b%s;@K%A9VVIgc6a;uO_9 zbAiCA{GAVO5wkjf7lV0;Ii0`XfcZ6~7xkCcYn$GV>jbe;aqEq8w2mlZ#sTr7^0$Y; zsr>B?t}0Y-fpmQ}8B7y%I)6_GbACuK>Ib#&bzp8`PS?KoGGp@h0fAHb`!KjSnANrK z7hry2PUr8oci=gn*r=%5jr{EaW`E{%{tjTq5yXqCeFqAh%HJX2CNrz^cQ%;gnbY}u zDVXa*dh+&t0LHK|;8I!*+3Y^T}Jczsk?gwUd{%&|Djt8+((fQjQObK(U_NC`W zjQ}$_q!*0~_1|Nep?ayv+Lw+~<_cVF+q}sAV0qyF3GQZQb^bmE=6U9H{(cGOr;uLM z5At{8yYRb$*r>RAQI7mAVa5URqVl&~;AH;Nd^7~yWM*~#&IWTlb2@)71#?|UFX{*N z-v_`v&YU)%nbG-6_Pi)?vV5lNBVGab4YN9b*Sj0f?ZHMx=Wh|1KFqm#QGcm@hk}_D z(u;D`zH^wNda20Tm$>5uPUdd`xD&zM$*j)br@_3&oX+1Lz~tQH#zp1t>8N*0Fqbj6 zRoV|>{W1=JKk8mr3vZnw^LIQxc}?JC`Aq&6--qYjV58#NS0J5#XM#DFIi0@?z+4m3 zi?-WH)O8=2&F^>XrS*s7hv4sy`1{$+;H^_+{t|byz{&jG9o)0veq>hX??w;cc?#I5 z==|*gCeECz7xniHXp98&9&>-i|7HF*;O|d7=+=q1PLcUrj!$|&6y{X^9s%xhW?lQ_ z?RzJfN14<4`!1MILwZqv_lA8r59h}A!A6C~FPXp8&zqScj*84*I?r&tz{&ij@#;)) z*E6g0_dzgEGpF$x{5F0JzsG`& ziYk6Ie(nXPr-7q-1~Ef=RAl{);y+a2Wb-BYI}%)7s9t%T=YTnxIi0^(gSk1R7tI$M zPaXsFG;_N3&@0Sf7pKVlC3{{MIGMk6|K(fYavu-2huq(-z;t3x=WiTLWk@gTZ%@?w ze_+mLj{21>@2Q`E&J5lIwZV z5BpaOdb0jTCDnBT$Z-RM0q!(=unzw!ev(e&UT%sK5?Zph< zIz^U$^nFyZz{&D24_t3> z3EnzIm4BN?IC;Bm18x^)JwJqeq4hzTpr^{0q2LZ?Ru{h`!JNdLSFdDzz6#7uA-!n) zC|@20^J+*h%2B?2&x{j1yr}Xe_GCEDvV5Wbu@1OS%lB&4WY4Vvr}Fo9a4#^c^Y=qA-!P~1ceAH*W7}b);_5~HAb-1n z>C2p}7v;#`iOi556_vkJ1Wx7eLEw&OR_E_LFqbo@^Y>vePlfcNevrTKfcYk*7v;#` z&7O8+N4`=~`MZt4sr=m@Tu)|o{tf~&mN}ij)4?1W(u?{*{{9opp$bhTIcWXU<#RY^`d@|zZGD{hV-Hw`8%B%@|B9p-@^q? zKo??GUuGpFxuz`NXZk?j~k+?fWR0=a|#^`vsUELwZp^$lr~g z$MyHvsJMDjj{M!983)9R%HJ}9Q~5gp+(c$|{i;arPUphYD8_d4U>EbsG%mjlT9WTrVb4*At z8W%dgJQvKrnA44aS1^NJoZ{q*aNI-36<33Mlv$l0uYq}=IaOT9kF{RJ@iaCnu3pp+ z%7edwDP~TU_tb7x%#a=xnIAMh{~cTtvpPSH2XiKKIzJYIxg(?(^@G~uDKO77r)!Tl znIRvj$o!zZS_EuVQGe;W>lt8^>L0aW8kkeXnd+Iv4Bk3L7QZ}vau~P^nbqah zLNIqTr}N`AFv~)EQ9tPU2j7EP?^QQ`u3nU*{M(foymgAq56Xk$2q({jeZdU~)eBB& z57L`#saFqfwuRn#mU> z>q=X|%n>=EJ;=WKV6GQAiQbc7UJ*Ho-gnGE+9|5_-#V}7#x}!7Mdxn;m|-F(v9BJ? zY>|`LcOIB4MNXpkD46F&PNMe(Gmay8QTZEt1JA+5Mn&Z>^^ZN7aX`GN^oqdkZ_uOp zZGxp<3%EH3JsO|qgSkoMB=K7U<_(dP#P26C>%S?)MWVMmm|~HW=v6Ueir*w~^#(m! z7oTjYcOJM)4SE#62f@4~auR>PA?7V1E)sut1k+jMBzl9uj1@USkMd^$#`r807BMo}A-e>}IXh<(Q|I&KnG%#l~ zr(17a#0++Eifo>yE2Q$K;N9}e9Gp-jgWj~q) z?l^-UjT`^A)Vl%PT?Rc`=e%mE_Yt^n4SLkyHvcc4|A&o=F0abK3}sH$9+X$pz)TP6 zMe~Y|FHZz>u7RVxx`r9Nb&4vlZi;a7Jh&6wqs*%OpmuxLQtu0JzZmo=ueM$0#@O{j zomZW}b!Jv&AGO;cFjJY+wcBA}PB7?EyIl_EhLE1T-5vt7#K2Lzy~~X6Z&Z)s^1lct zZ?~_({m!f^F4S&2ylWTdJ-~HiR;5Swjj+@^5Zn}l9<|$XU@l=!*KW6hdBC7Y?e;d9 z4?}vxwcGb#Hvb?PXSu(-f$7Se%3o@? z;b6vx^rHQU+N~bUp$3lH?KEca)+wrXJ14@){g@B#YGze_P=9;eQtt(DOAUI|ZogUT zt@9zymtdo!vX9!W0L&of-2Nf=cOsZNgC4cpiD3R2(v!E_6<}^LaMW&(GlREIQMKDM z5l-&M%ixwVtBMP?Th2#r?6_Lx`g9|3+c2xrqju|IsaFDSph1t?trpC2%<0LAi^iG8$!);wYT&5ddNYH!PEqx@ z(g-JSw@PrMnANpgv!&jV;7&5=QM+Absdpo|do1)`x71q(?sJ149Zzrc3DzapsCaRa zoQEp`Gf?D&^Kf*$S_@{D$Vv3h1@mu_6TW{Vs~%v6>~o6b`4JT7hXhV_KI{o_FN^gG zeo$P#1@o6r&2iZcOjnT;^e8UF!6Zda5|<;voFsCRxLn1I6BBxo#D)6#HQ*j&*6o+_ z{_#4P518}vK=6b5`P!f1droXrTs?U|?*yicfurkq%9wEk@uKSI10tN5m~TW*(4)NC>~mcAkBy4w zuS72nW{}7UaUqq1m~jN@MUq!kZymV9n050&-X5oexsW-}KEV<2@Cw6w-_46`hZL z8O)o^sm@PQJs&WGw@#7e6}895;C^FP=f`GW;JGQ-sObFI7fc0nuAbbFabOb6>HMf= z#;F)DGC!!F*MU2MS)Csjg1M48oga^ac_yS6^@G+q%fNhY!FBl3jh)U9>TjDwIC)*U=A_p(fZ{yFc*fnXk5siJDI^-r^wok{JjU3#^-^3u0QWt!y0~oc6|TF+Mnx588c(}{DPhjli^hfiK7tw2qaw49 z;xJ0a3F8%UqXkYjUeWi1W56{qtMm65FsCu6@|W`9Ixu&JxTwE$y~-KuXhG4cZaMT_cviRlU?{9+pm06u1n|_1m zV`8JC^P>-#a^_sUs2|jS$AXy}(u;DGFUK=O^-_`fLENbkPM!znfLjo%7o5-@q<6oi z-s9k2FzC_z_7#|ozjfoMi*qM1ote|cc@UUUA-!n)C|_#9G%%;i7kXagEN1Z5DXKUh z9^vG1J`UU&%&PpLINxBYcN@5eEcD*7)cXkBw+21R)6Ktg+sus$<)7T&oxycsR^=~^ z@e7dqhs6_d1vlL{6f&_V;%FZVB#h%qvGY2;4h7Tdx7c09MLL&hk`lKphw5? zv%nl3(v#1t=YYA8In}&Mc3;j6-a17#ujb*CtHAw-S)Ctmg87I!Ra|I&zwR$sXJez{ za#24hpNqisGjKGn)qtsEPUSDfZ#tMG4csQ+<}!n~PLaih>OC*Q$>-mT!ClL&7Z=I; zezBk@Ti;W?PY9eUubv0@wpg!_rxfR3!EE|#us!5{bOF;xTTC4BTemzGDV&og#}1)w`ZEDl>$C zRO3rWaN9HM#YO19WOr{tPd2VmUiAStkXc=OB)}ZZoL8@;|IP(-Ds!s%(f;Q#gSSqR z#f94K0&q7ltF!MRFwZcjvX9#BQ!w9!^rHDf{dfJG4zW$KQBnCp{dYTN91t%uKPb+5 z;0l=4`B4sL7;`#5>cPwi=|%mZ{(BObGniBPLG@g~4Bk3L<_G2J{0LVdy&v&%a5pil z@`Lo2Sn9n3?p=c(#W^?EZ8OISyr}xoX5e;YR%Krv_TLxG1m<+@)(GY>gC6DIJTU(b z=|$UZH*mLsd5bw}M_GH&x@p@EqQ6l+>PLG-IC;D62dDv_ zNA{fp=3gQw(Yp)GV)9N5HRDJQ^lG5mua3mu0J05d+M7mXi12X`hjcu#ivGugKbGj3GW<5eNJ{S10E{vBwkR}HSgLhlqy zy|ckxV$h@U{ys1-i=1S<{}xQn#`^fte6$moE+Qw<8w_Tg$Vu{L1~aDiI0oEl7JAoN z>fHhE5rZDZZyA`MnbY<2O*ZKe+YTEQT|e&yrZ01xPLLL@`K`X7ntWoPLc;-g85bCgghYow(Hm-wih-kUcC~%N-(2DPNLV$ zj3bB_)w<*uaHkpc$lvS0JR))u`<8+ET;wG7ZL}%Y+1RM){Otp#zsO1SQp`Alcv1P= z3hpR_9vz2X1mfiJU}l1T!XotHCuG^k`l<#ZvEl zaF>aCO*P4uWZDwkQ;D|^fq6Z|#p9g?j^^_pnMv;*?-=DsZ-dQoyo!yAn=f*%6wEjS zwZI^@Mh#{&6grilY-=3H zW22&rOCgw1%z5=n;#>>n3=6#rz}zS5332HOo1O==!8WdabbKw#7g}czX9jPbBI8JJ z9Jn(Kdeq-uw$P*B!CPv<<$?PS+*aGVet7L6_)Gm`e`fI3DKbCu@W~Kx^#(m^&vPPr zI35)0CB1XO-Dc362<~k#CEK}v(7Y(KZw~%`8<-y3yBzr?<0$W62J<;{M9VnZf1@3+ z9>PY&%Rj*nnzss>aX`Gt^r+qXS#YE`LB>h?yA(;C`PKY0ke=mUf!obn|wpLz;*w)ync=ZZ#-W8wi4W^1Y zU7RO?nIq~+{5T8Dr54=nU>-Mc6xTPHAwQ_d=8rk}`@7(3{^t6t>TkrY)u}`5SZq{O z9Q{3iXPj@sM#YPt;4j%XfEfqGi_AV6w})A9W5JC9cLTF@p32ETA)l#UvCQch&F5VJ z?U3*KkmhCiO#b!-SH-N#U*aZ%nQq|7z7v`8>&5Z35WhM2@Jw)NydXY;4Wm= z^H<<#JXi?kVUZKsgZy}f8N79hEMF)uf3)BV!L7BsIWDvg>t?~xx@3X{M{!6+xM==S z|CkctqU~D@?qmy&=B@iJII8!57TliTI__bP-wxn3^>;i7p!=M%eFaCCmMmjy@jLca(XwU4;L795Rh zBO_eY52qhlaO7{wf}?eCg9S(R9%{jnzsE+nXk6&|<0nP9sK0a`=|T&R#>wj~I2y+v zlyS7a!e{A1^U=%TK48{cUrD$x!Q|}a=CsGPao(r?wgI%dvYxlj7RGzxQeaN8;O+zS zfq^4`x7l0LFEjGPKfy-F@q0jTFl&;sKOgxVwcEj9j%1GG$LkHBqdc7p=4=B;^}JPWKL(_mteN+V)kPX zFoT)%{BVz>ykpFrVc)@EPGyemHKH{b9|VK_(A>hbTHR4=hZ724;F*@j5(bjxkb3n0~-}jPiT*Fd{z$T1m;{nhDr14 zOfZ*+xb!^e=O4AlLNIq5IBJha!FHIhd%&DTDFuwFdz1M>IiaDJhzkuo3%eBwtqJGf$vMrch4IK5$0x%<) z)A=zK%*o8D+M^tLSA+SCIh`LrfZ4FO-Vd^GD=@v8TMPeJjW3hH9M7E2k9lD3wcwru z^Br?4f9X8o7JWLz>abDK`8yrVi6Ji9ZZsa81?EcTbbj0oW~l}D4VbO>b?sC6F#+{< z2XiKKIzKK1voOR({h;ySPB8B?ryCEp-Vf*Ru~G5-75WFAe;Ed5HglZ!()ssTFz1E2 z$U1`h#{w|d8#v0p+rhlSoM)e8Jop047W)fv7C36(A~5}!V?QGH5jPA>4RgABXM(xV zf?EjY1?Idwkl6PXm~~2AKXmqW1e4F4&c2>tCWxHSzI1-K5zP6_>Du?-U~UU@k@!*j zJ^X$>o9BAMu|59M)GN<$RUtk_!PUQ!E zukkjRbt=q$bOe(h<|2Mj|LqLs0Oq`Uh4Ga9mjeoYar~!5qY#&W{Vh+|QiO zj~BrFz?|oY(BH_utq#ETD%hxSdr0jo1~ZX4oqcD5S;U;qzQtfZW6rZr$a`wv4F`6J z^~4siPa5aGU`B_zh#%B{CxWRnaFnOh!OUY$=g0M6o?}ku#}{C>A7u7pS1`T9T*MD* zw{kFJnbX-<2j+AO?ou$1GpF){)}8Nz*<`TUk8Qy06Xv9T^Z+xEIh`K~FvnPM=YqLQ z(eU(#C) z<};BK{Ots8!=W8wov~5Tjk`U;3<`6Rb|ZgBgPCOD$i6x-r!%MX_fjyAGw1m$_)!AA z_rdHk%FjF-bG`+49hhgCQ~A*g^?nX!_u*zgioo;>b5cKs zfvI6m=f_Mi7g}%&!Mwnn%8&l=<0~+|s)ByV`%xK~F(EG6kElJ8U|N~e`7syFby5x@ zT)Rb(Rwcp^8i4iTy zmfGs7R9!0BoPu_FMZeNfgGLUj?AyCjUG1dm#%V3G8sT+f#K`i>p^3^7Lla{v%PSHi zhE2c0%=A=sOGA^CNemk{Xk_V#fr-))dkYpW*= zuBhr?F=61qVPl3&7&K(;i1L96v~*R)kdYJ6J`-p-t)2?^Q*{%n8yhD~YOSrS3I27T zW~YTa*VHym;AWoC+*CcGF_mhnZoq!kEwv5xow0A{hDitE8CLslnllN{2#ReU+dFo_ zT--&^{|>ILZfa<5nB0=Ld(|F!LmQDuwX@M4d1VdL8f*Wby?23+tE%?LCrzNCEuN_q znkw26qNJ2Z+MuKaE;G$cyN6C_3N1u=G>DBs3Z!&Gi@XvhfgBEVjR^PRy`sJM_w!m6 zul3cIm!u6QEmUZ$NCB_Z$4^^>e=Gj11-1EqziXXy=FDW$2cUTGkA6Bi>+HSH-fOSD z_S$=|z4qEmm+&moHCJ8B@FnNWsII%_ij|<=^;dj+$w#kBUyt@XXV!2)i>Wivv?URW76 zcB-=c!bKNd9J|PLzPt)!rEz|pa(-7cY_gpAB2|gWE-N?ow=1_I_Mtv><6RQr>@aqh z1e)%?^epS*K5JrVFj~&>b}%}D4?mAm<2-A!smh3cnw=Lm&Q^hk5cQJD)&r9xjeU7J z^0K;a=eLf*%jWcvnH$SP?aNK~i|MjG!}aCHK_cflzK_HE1mo;8&JT=TD<9a6<&O{J zAHRI3Gq}gv5Sx(MSJHl@aY}|8k>QK!DhaMHXYldHLHSP&hmr8637O%N_Hk}VV|lM} zzAq>yodMJN1ZfkyeDUR%UDAI7(7P1J0?Od83}+!gr?OBBpy^Wx-2mu831cCrer@tujwUF6-x6fOGYG`%<=Ax-ue7 zcX4cCY*Fl@*v0t1E#>^oIKNBO{3ho7C2l`hxdvYu=Sj&Ybq(%975dGpay{ zTgREY9k(7~rtcUkO*;RTa`sEMNhdYKkbGm6WFW&k%$2dS%+1x|Q2MBWcx6>+X5Uba zapKjDZ21#R-9Y+1#@VF!22xx1_Vpn7&{%#{vZkb~uYJP9?A^|5yU#}jnXQwmuIT(} zAKo&rM$^~z60xg{bEE;LDJMR|#I3cd8BIwi8a0{PP`Wbdm?o#ByYJR_4R5kb@D?@B zM3bFe0#1$hjEgxNh9<+}j|D&OHYib;y0l$_v8^3TtQR9f*eG=#uWiOpkHFP}M)(!o3I13lrIl?-=aSl_v)m+|pT`!*E{|OnyL55?-i>AHqfC|-t)Zb~_ih~H z!d`#3;yWHji=zLhDyv=g>tip)dsNvZOY=NQpaEMr0q81cXZakU(y@fj9TN&Ah3)47 z8Y5v@K<7y3`z)ZSK&t@N3-m2OJ@Q3Ap#Lk-lYr((><c9Bs5?G!QhHp?_L|L7 z>0YxQ$>pDsZoMUe7Z;(-Co9ILoY~Z(LDKGXo{QXwU!T)jY$H?>~r?<**M@`%z8QYeRbEmRJ}Y5}>ToDKaZ__LR)2&^zR z_#Pt{W#?lQ`}lWT(%F}CUV$J?)qT&pvlH1QGyAL+lT&sqYzAW$B&*;vP&99-^={&Mwf^ShIJVY(t48Pch+R_o3b(_j4p%6>{pGtQo*oe1GqZn6_flXgQmg&|=T zN@;K^D;t~-89NRH@ux8bf;KhO{a>r=*N9GL1|sHhq2=&!Y0Zlq`d2eNd(lqgJT1BR zrn0w2lJ-=L*j4ydCow1|r@z;1_|uUPkXBa@(wn-MtUDheu;J$zeif~xJvM32EjOk8 zcmN}`U(z`@>0Dc$bl%J6tmdCuMnp~Bf2Gf`rh*JNS5{GacrwdmFN~P%{D`7rGJ{e1 z$YlEYP5U!R`?m624NPXBmLppuDps4!&e@r)d&26jL7V~sB+E~BF1?E9mPz4-Z_yckJFi?4 z_TsG(Z&mW<%xSah(VI>;_I2Tw!MPZ2Qs6>s?VO69xfLlQ#6QRkEKW({9G7(alCdH8 z5pYpB7cv(DW^f22!S~o0t&}QllqxGBP@-hh#r?B^tjf%*0VxCC=tJKIv{)Enz=sM) zx2rt%i6Dv3mdic%X-25YY$%r)D#3CrbZBJ$9y7=%^J)YgCYhZ%jdpz%h}{HY>tuqY zUx~LyuOa@amqlggwYmXsaWmWoY_vhLfW9Vu_wzpVLqL}ak$>q!g-!GEqD^!C!J5Xo zs~K6M(W(m@&5vpHWByZR3i~yCjVvkxBP#mM9`qaIyz2HFtikddvkGOojk&`(bB;H5 zJ$}=TeKmRjr(-F5x%Pm1%~u6E3PcZp#5v9vI(Df9Tm-In#gL5!q0{g8fJXL!CiZ}4 zj;pQG4KDAG0t4*>9e^$o^4#M?g+yIal&EbQdSEiVhUtVaJ~AkwfD{HnJ}E?e%#GOf z5FZzVb6pWpgfw$2dPo{s%!zRDNHf_RXpKvni$M+@dO_twAq^)RN}9!hlpF5_bg5ML zKYXZ=NG(N)v@A%ZbY<8bLZ)~Oa!Gl|O;bYcHP+N9A!QxB78 zjPq`x6+cP8XdKH8MdjJTwVX697B=PbdY%+L50EZ^ukj(79+7q3DPXK)Cyi zv|miZ>U07afgXy^v%Zvd{$!lr0~t&uRFVKt0rN120}pLM6YPp<3DEri9A&sPs(b`MV&|t>P z`-wtBK@)!@53K_ja^{6GptYpos&Fm_@&(_j3F>UX+op zMn*!WY6wO;Z>)#zH@LWjvIi?mQU7jsUbXM8T#tN`&XFl-I_CLW!(`o#8;(d)YiOM3 z8=POtHlaol_jf zuviuKq1E*;63GJe8;ZFB=I2w3ILBHS)FPgc^t6Z-`C7y=&?2_P?QugBp+JmT>!3%Z z5;1PA+tiY%d!~J%iwD-kBo0@nP$@41kwzX$xE|G9po@bB)+tF* z8~H4>kx;NovFXn^``v=wq&3^mgL1EGXijl#CuE)}vmX^qhrZ8J=A#tJD&_bJMAjqa ze5^83v)w~LRESpMmGOU^Jw81nocZPC**2cDPfSCJXk?gCCE^x=dy`ICCF>8&-9 zR53qW_Mw!0C8mRW(B+fav!P}h9(%(FQ_hJ%L6dd=COzI-7v~iJ`z^o!YRzU8ds>S< zVNL^=$4`0bhE9MksOT3=U$dEC7#sT&n6m)|vbLduypa>PCXVM=KD!DY<=-uz1^TMs z=>w!XI+k#q@WLy8*cl+5>gdh_q$<&Q+`PKiW7^KgDd*y*GV?aegv{365;aHET+2l%&rgjhZ>J2DLmz z;&|gMfS&BB;qAtLj}+@ykwjL4a$ijH>81KKE`)n8pc7=!p>67^71Sef4At1#e%N_{ zPL$XSeCQHCb_t+_XwtAO-d?nhoJvFN5v2$ls# zxgU>EPJI2)Q>630-MG?QMr+&|e&fz4(zqHnTH|W$62Af1xEhwr{Rc9*PcpHI~6P1wsL32cTYy{#>~BxNsyLT_0lZZE6C zvl>6>tCvObGx$L#2#ne5W6*CeYr?NN-m|PVHdr444`Q`Z!lBYnRfa`$DMPXg_Sg%j z{8`>smYGs4R6J$K3S_(jJ#uc;IBl}hs^V^+^E9@!p$toT`|3^@J4n%QMj&Ei!&|X) zx`&;8s;F9?9=;&Vt)Yp=DNi{ix<9AsdR9Oz-eyAW;mpUw$7JS*%bdC46X#B9|3I|s zH`wU&_3lnTNAqUv305VYtE)MhV@JGybzm5uwE94Uctk`*%IR}A19hcpa+`q~u%#M= zx=&b&liN=T)B)%of&Mq3zX)4=AJESPIt8@-vp|i2bcnwMkPh)51*AiKJ0Kn6y8-DC zPaVAu@&5!!hj@QS-s!#{g=BVO%Q-zc^F_Yw#|C`|o>)ePUD?S^`e_LIv&=FIX97

YTHG45gw03V#FZCG%8`|ICIv)=fYJX#uzO2^A8hxzSN1r}6@!|1b zXO9MM)yEDzqCMZ(i3il)t*9w>{x)Ot&tw;rOEoZH2`BnF1YSdwRLoV-#AB z&hw#E_9pb7GYxtQe$aPa4W&zaD3!gkHff(xiLfYsCY8OqF@|t^`9i!l;n)077&u7D zoECt-);Dyk&De9wYc>y+)og~^&0gLLMIzMaH$i)THM-fA=nYpx8(fc!>YJ0cm9!^R z+T}_69mZ}5#qjeh0CN$0UfW>(O0FJcMu07C8L_;*Y;5(g-TtkDgVQGfDYHEQC?rF` zg8)7+u_W&O0!;?-RJry6K+j0)UIXY~B{s)8iB{#CNtq?BV48+z)473-qIJf=d0GF7 zcy*b^*U^S|BQQjjdx@Z+f=Yx`KIb%pb6^sXfW{T9bFE)($fz%qb?~?!kGTEiRr~gdRh1qqD6jCbQTI{*5 z_?eV1eynav_`~7JBU9NM${Xy{usa!Uuuo56hZetx$zEHPvabP4wp2IRr&J;g68qX{ zDtoP|*-VD9&rccq{6_qmf=szDpDE{hO!+FdfSXhH4aoggFg0#@O6*?%sq`(!a!IAH1xTgu34m1k&IF{=cNQR(zFe@4kiKMD?M3g( ze337dzN_#Y*_Td1=yDanj_kEkK>K}ZrN*eDAG%6v3oCTRRMRKcYmm4Yv$5x4$11p5 zf=LD@*Vn@&BjwEWHE0GnVDXduE-bNg~o&PU44 z^moCs;RtGauJsqcsPB#y?XYdYTFP4~?Gq!$Ibv~vPL9m6^7D-w;@EKJ-Vj5pY1{y# zIp3%ORt$)xp+lxWLMw)!qyAWRp{D)@F!z2r-_pvZ{L0yYbcg3*Kx=fek-e)KFT(xh z02azfQaCaBsDxq;p!`o08T=}&@ECA}6+SO4;YkF}1{cg0+nIRJ7-x3Gjzyf=m3FMs znizv{jX?y)qE>iz72ok?t$vB%*|qpGY5|9Mk3>WM$C~hKMskDX2FaT=If7?5A$hZ# z+&Hsa?O3Zbd#N2;ill8RyR!p1;n9N!GH7F{6~2q1l7~$wW#7(+8N6MR0YuqI+Nq;r z=PHCCkJWfs;oBML#vv!hX-bCXeu4jI$=% zd>|)2kdveYh@6-#-qX2Ry3lC(@Kx8hD@Lh~U=6oP?K9ISj z1c=O;Y(VlZac^ml9UjXj8pgd*26TJ$p4k#Ip_k8+(=23eOA6D1% z`0IeZfFHPTVl0xf7gXa{ix!UX9V}99O-v%}f@<(bt@6hO5o_J-XbU(m-m{=JUVA}n zx<;rM1CK2LGc9P&`OU z9;N|ZBn`lL&joD*!e=D|ovaAyeJbow{H=cf33B`1wG0#Yj59%u%1r-Ma*`2;a|M`KwkJ4 zFSJqU>EvI$JS#8!YpuKeM|hyI`M}!_ed7bz@8n~muq@v8=o=rP0J#Gc;KQRp2rww1 z?Dgq`bKpHAIPe~3F(8~rDjO|>53h_WEu&T+Q9OVd1A(VJ!gnzaRMsT-@Bu1IO2Pad zCL8E9_{%cd81HOARS0>-Gy+Cdn)T6&2Z~`Jijhb7F2z$(C`M9hF-$hl*@nL* z{mvM4AoLbzqca;;(3|a8nerq$&w>j4BH+ey^ow%z3-%gx4Fq3Mfvyp8y9T4HkhB)R zD3a#{^TZ^=E(l2F3!qK704CO^5oXq=!ES8AuMt0!v}5=s8{-Z7V)5Q{zrNdiHrTy_{xo79q`?*CPZ4ZqmnAJXkJ6y;zpZXuR8+td|dz%hYbU^1(nS3xZ*KFF8Ny^z4#H z$4)$eEd%jjARY`%s*q3GwxqN_t>5*QgB9?3NFE*g^aBRsI|kyxKzyzb9F^hQr!|Rm zE7Yk%KMzZsNc*JIA%QCN@fMLJz18yQslo$U^9>L8jY;svT<~x|m+x$wNl+|5fap z8h{OSCqPDR1YJ84RD(8xu6YUH+VIxqRnawD%UN?E#i!Pw`o^AS?5j|@tHP=59Smv6 z8d%6qOimA*_3sz6-^!%<L=vW_`=0jA3 z)Q@E@IO`I{M{HGp73Nx<`7sec<``X{`7uRo*xcN5Hf*j*qW?{spId%R=Z0P&B9ZK? zZe)Qu?FE8#P2WH)5~`gYNuMTyRThQdq2Q!=ViGK!n-TYn!6zj>F;hF+q-V-kF|b># z7QYdq7a#hf7xUqPm;twq(oful8~Vzxu`ZG31&g4C$RbBN-CF_JcknM%)hT=J4nTP9 z)CbcW=K;Q%=?^dttC%s#$K6f3bGe?mGD$0KdfqYF<3;J^_Z<5U`NY0MGAKn)zC&~T zu7o@H>BG(cg`g2Jih*hG7x0CAoBjMA6rQqcXb>3a%&QS9l`=&;^L_HwDE+y6A3hFr zXgt@(t8v9I2V3;U5_?l7^DdzC%6}8fre@ zm2l@ieYm-fLPPmB`*}*;ku)?1p`m;=8Vw`FIVTo{hAEGR$BQwaXG--(>1nc`uPR!B zs)JNOz8b9p9CQjRK)EhV@aD>OU5PhQdNxyf(gw9!O|gZCWk?TgsYG>-6G?UopbuA2 z4rT$V8e$V5wWp^vRS8SYn%ViAF) zdVbN+l!jvXuaG0F7yAcQp}B%aE#>ciZS_>jzKk5}OEV6BpR4QxYVKLi#r@o#eo%(H zX@Fi6M5_TUmPX@7wSQ!Dy;miY(G69EWIEINa+nen+c?`}>sPW2AFIKx%Dwm|R5m<3 z&{fH<9Kw?%;xp<#Tis_bpC&7sqOQsaGtDl<+$Vc?<^6~fMx&n0o84s3L3;Fnx?F*L zq4w}|mDT*b^9iE1SoRq*z`iWhjxV&@9e}jjcLLIC-wVjEHW84P%&&F?yAWuEJ|wlK zecL@|s-sfP69$KZS0P5XP&wbLuK7(8ID;fnw*t_U#Vf0=@Q2K-)^PgR*m^KDYI-dG z;=4_fs>Ql)pv79gqrAmfw{F0ktR-gMy2oVit?WRm;YNsf7dDwkEAK~`Wvsaxn{v7; zdlBOC14e^;B?)wz)(syt!yAorcV&m9*kC$elf!gVFatfwI7u9e*o88SF5dim>$X%Slul!cH-dRbXdoiJ1$Ri)X`82^fMbYCUd~6YfSHzUW-Xx*a znz$UgZ1BU~+A1|_@&XaU4fL@lce+Q)Lz6|IO z64no>qntUv0;pcT7z@Tx2y;#LU7uV1DPBjBP;_1YER#=dv;fUqUUeJBJLluaLzWC$ zVc6?aF>g(rTS2}2;{Gu5*NRYzXhn#LA|1U@4_o1w)ke4dkw4pC*uY?wKBl0>M4kRb z>nMCc4Uj!&F(|~IM z(J-zo#4J@rd>xPyY$G5Q5qki+f+2fX6fXsW;n4ZR<9rC?18@rasDOzT7Uw*#dHGUCMGQ)#xZ#L% z;6f((g-~{BA!p_n65*DppZ^<{Vk+oeYW=m)*FxBjuwZvJPpF6X8dyS&NnII*LyS~7 zV6|M1*@BqCWNw}Uj~8Wdc5xCIdP*amV!YebJ(WIg7bp`7rh>)#(3mwPJ##UDfcr0X z4>9%Ao>5&H6pl}xYk{{CGc}Vg#OzdmzWtVnzCWqZ=j>XXniPsW3OnIMs^ngavuiDc z6r+2WFlSp$mfzO`-Hh`q3Oi23Ao7@pOhLWT7ZWX56sd59B2lMYkYZ7pcLkbPuN&P$qznKozK^YmKw4Tuv~ae%PlMB^&S5q8t>{!$R|bn@5-f;HHOpyheh6 zP14gxdJ-#C_mp+t#^J_@8LY2GZsZ(HRNhW|_;l#FF@kgdq+vgn`R)Nmzq^*m@hJ7) zR1o-njJ{B0dy+v@R%xJf6k5v7wH&#AS>`3CF!<}mgD1IKlY&gfNwC+(A4Y$BFc23`&&uAWqMso(@R)?~pQE%}k4Are{KPnPD3QIQ7vE z2nf0Tkn4om+R5DY&H)i;A1_u`gJcmXD=_`O5xss2T#BSm#DQv~H1JPWd+Lx(e;bmt z|CcP$Si<6dEKl9$re;o0u5z-bP;i3pmq0>m0b+{tQu}WM`EkvAfN$Rg>>~PcE|Xd! z^~*peL`oa_#MhA>oSclzPI1a*=QTPc3OOu&gd#P_wVNwQ-U(=qFy~<<#)1|`zW5IL z*d>x}FKAuWkJbyFB?}h|(0*n6!%FPL_LwUhbGGsEaeKgT5*E+S-V?Xu<6iC`kIdB$ z+>7(E88y9HIC|CWq%kw+5W%v##%ZWVA|{@_ogs0%Yh0S?GaEYGhRsOIpb>x96#dwb zp)voxQ}jCuZA@xhE8^LJju%GfCYx5|Ek;Z&Jc-ynB7KNhKE*!V?9;e}66s9i%#*1A z9O%i!3lag{2BY()lru)o7T^HF!;}l?Ooe@&QyevE41mjlY9%ijbawcsT__X{5o zAEn*_@o{1ixZ}fskW>rSq476j`sluZQL41tcp?L{YxW2dpjw({Dj=0Z6wFa+h7bB- zX9Jol>9m(*Zj1!RWAtJkP&rs(Z-gx7h|8(M|EofRCn9^#7ie>|-^;2bxNsj+seej43tzjCL2kjm~+zu`!~ zbUluIQ-vq}*Aw$!bsgi!y6YGJv;oIp4hI?IgxC@!0ng%~u-17$14Vl3(GHQRE)8#1KLL}iBjr;A!Oy6cQKilJN z*Fm`wb5${$OlCK>>t3C@;(gxkVNG8Wz8Z0i3_pC%)8E{#zr4Su&pq@8^$$EAxSlz; zd=(W@k@5l{S96T2h^HgecnY_g>DkbBYaG=Y|AZ@bceT*jPg@03_mlRQQ}C*~{=_e| zXQsXKVa%20OAVsQ>6^?Scf)4u$ehiVxoW$7U=2fLk&K3kq=$zLqW6~fp$KsBximI ztCk`>I z58VaGRUl+GM5Xhg+1!kC6-FM zGveWT#e~fMl6Lep3888aADFDO4+VLRyVHX^9@zm9{TL;tCm_{&F9vWA-~gRKqvrfq zZXiaR;tcsqnU=u zP!@0?KQvCiLN~*>hwSiqRp9f3c%Q#p@pZRRQ&}}%!r^-i63Zhve80G#oTr-wl&5OJ zLy5Ug`V=Xz+X2|)iQq+gUpauYBp#>1s)M0*UT8EJ`V|e$cVnZp>xQp>Ix5brEFWXt zy^PfLsG5ilCYr_|pJCz{vJ;n@!9+7bJX^WYb3KGNcteQW9NkU9Y`UBAHrU;Yzx*dV z+}&+VG1%SV1_JB>NTt(&#JS06Oog~rxn!#WjzzMXz81S%qO%Pusd{lbyGnE!-~iYv z`B*K&K+n~qvM_9pTr?9nEZEKbFhY;L0T$x-X?|Hgl-&-c6Jw+ni{lazG34n?n`zswdb8LQ?HW1+{o-$2QzVLnSE2J!-2|U3o}pyynL7 z1lNeY6ou=q92st&pq4}95R<7tHlaDOJ={_PpC9VChoy%V>giq|1ed4aI~JZpq|?fJ z8@H#Sf9dC?%N(hPuA|bh2E81@EAZk@SF*#LkPYE(01wfD*@>;^h=B_ zXCrI@bi1T`&WA88wc*7dmVO{#7amfMN+Xg!|F2Q=|9eB!{O#M+B=`Be`NA8b=8JDr zGmn}-dPCHF?rm!3QS+B?h?>88o0@sl{Mj3#=Fi`zW*#+v{f4MH^foo~sQHsOM9r5D zMok{gffK|0xn>i++WZFRI-u=42iVY)kFgT3d1l|Z#)y94^pK7!JTTGZ+6)uT6jaQx zbLx7KZ!n^)rIlslSTUung{Gv6mXwjW^Hjne)WSUp=vtYn*nrxkmB)krAC|c<4_E6= zV6A{uJ4Q!_Ido=%8e;qCB~e4I}jI2mTn#X*`eU`M$)jL(f*A`#8uEkl;OfpI8r(aCfy<0EGYgo zD^vWZ11gbvR{LRG9lav;r1DqO)dMP16GA_1KA?S)ZlND`37|hnShFAYaX^2Pu%&+3 zazNS+EB&yW0WA_tI{;lIP#2(!1?mCRB+%V}J}eL!_#*<{3+NJoz#om|k8}Cw4RFe6 zEkoswVjcmc)M4+KBGfs>532!moP^c-VdnxmM#8vlq~Fd16qc|?KkQ;aM@txWUz#rS z+7T-j{|z|}1sDC7­Z^U*l#x6oiA9W z0nHbPJk}@>d2E3|9e^$nh&*;ku*+Ljyx5RR_$+>dG^LV*jna^Dz{%H?RdEtl*pPr2|HE(a$%p-+ELOJ zuN~{8J&&^`t>-@g(t2_uwMaexdZ=jkI#g6l_8}SuvssmOwYF?mFT|C2E=NyB%rxn1 z(~8vWb!DeJB?Z|91@n!~xi+DMexB9@GhwxI$QHg@H(cOBMs1bKxi&G_`oxU7Kez8I zS6Qo(>mt8~{3OtdZ!L0a@j5DUxqd3WQyY|nV(|ur_;H62PKX1Qd>#3ykS~^x+km*D zgWK89JBMkJ8{Ip|maCRpcr6!fH12?^vF`f;sr~FsKx(X8=ZDP(q?>R}fC_7yZ@LR) z4`#gU;?<12yp4@~X5tb=?Rq&4SG*|t6gmTtVsjp#LTp6V2HH?-?~O1rn7N&jZTKx& zFcqVHVLn@tdURe;Lxn@hr?%uk`MgVp-b2YJf8;EzS8UXLJfQ%?H@gIt%-gvARAA%Q zwViPV`KVZvhjdT(eSmaNmu;oyDwL@1o-Uv_)>a=ZsMDyEgK`ul9N?er=IE|0lN+A> z*`3ZP$PM`)P4Y25jHJ17xscG_BvuJph0Key6A7w2(Zp4EqRGUC#5-{QqqE2V?EFV% zijnPGj42Ma`Cc!1|3>J&aqbfF=dqY~9!y!+rBdyi0QuF%^!Zp} zbowN~0$baI9;^a->LOkV-j~N59%l>)N3cC>M|VMh^@rPx9NDx%xow~WO9D`vP@ut& zz0ie@2+^3#HJ{JC{1)M^Z9&`>8Vz@iCGLbq;=VDNZ7d0#H!xzEA9VeI>mfFv-;tcs zJx2BFz^SN`FI7OGjpt=2CB`7|%_*qXFNgv{TVhWpRzAEQuOVZ_;c66?a1)?CQv=N5 z=J26~cz0=#gT5nt3Uymps?8vsAm;_?JglbAa{>&zT)Ll#EE2z_*`<{a!Af@xzSVmd z5;emy2j^{X`MB&iozI!%tXWof0>DEQRKn5Nt1@;1Nnm@r3V}&y4%Vr-I|%ksRam*g zKW}zr^$?tKu-QYrYp-FQeA%0_Z+UzmF$gc3w>&eDc#hAPaEHY$zXI@E0)GTBJdha6 z7;7LgnRfM7*RPO`ah}WN^EeQ~r8+m|++vj?a;g+!g&}3@!|;F&r*QKkL-05JlCj?_ zD;eCE=%NB^Q;W@@r?OcZLSSAT2*Cm6hTrCe{1zcE<%PV2kZ1BjoL3Eyuj?xiMM3{w3Anzk%NIjk0jMl1&$^)PuI@OH`$zk&nX}2@8PZpUJz3u{9P4=|h=Cd&~_a4SNi2aUW_%GNneK$8192q4bz9$(QUgUmr-UV}I~_ z4m-+o2*`Dvfy5t~LVAw$7>kHVk8$%U-eW8&q@c%uU4!B95-B|?is3pM!B}12=tQgR z`lb;*ON#>k|F!y&)A04Yp7nL0>ekQiS$#rZUXS-?^(<9y+!yU=08ePL7mOYC?^@1|(s zmKH928WF~!>NRQ9xqwvYUIgeF3ELP7;lHd1o2j1FjjznjRZBFeZQv2ik|kXRsl0_+gJzRdsn zg^^#cglCMrvmOz?;$jK-gpH3xDym3v{&}Zldm^BJ6zF6?`=tP`M?LupAGh4F*Xbti zkdJX|s(Np%4L%cZY~z5Fy(*f%+&Bqzec2Pl>ao7b;5PTtZ9}-RufCD6Q(tRJ`KVwj zSoFC^+9Nn$=`NhHP<9XMe}t>%?A1||y~#cQhwo}O^F(s9v2g|unaQJ3{zl}5RwCcF(19i?$S`euIw%1JQ_P;A4@I;Xk;bor)GJry@=1#BU=zA9GisG=#ik**t}}DKFnsgWHe_4+_u;9KmK=9K1Z+-P9E+9dYltR zJtq$bbvpNx_Wu%}5B}XeBYZyKnn>@S9&`0}I6_vh^KZ7phf{#M?x<1mst{+F3OxWw zTi_``xo!}?h+SUXT)?r%i|Hj?b)xq0i3gW^I7jJj3g;Z+q1)3h2UCe(j-7smiZKgh zK#o~(|1DHD;+Mm9Uoom%j+1=Muktbf=X}gXSOpw(+>PkGwj0eQ-%r|qd5|UxT&;vA zgWrX}UX!UeKuTq8sC)hDV&)%gsQl{UKGGnY7Og7W1){3Pfr{y3v>3TsTCC5n&p})4 zFdU9l`Bk9CPAfyrwsPGnK+1KV+*ttOf}3`s+dhRZYoOQms9X%I_j!B-m#AUng@swY z-nURnoi;?zs2bQhq*f%Bj*7(C8)gs*&m8(>7XiFm{_c*A-2!O9TbE_A*e8Uy+Ud^vRQ z0ZmfQ&r;kOq#=L44+q}e8>cxUZ4u$aA(dT2HvlPi7C1^b(1GbO03NiRU5f3N&RgZA zt<`ld-k79BY!)dDr-?fiHC)7%z3RV6!wQ`jxfoJ6T?>ri7vV_j?$e07XVaJH7);Q+ zp6?gobGX1Amy@r8TZGk9furXZVT}x~{&(H?KTuh>aPZw!HP?8*v@&g{_; zTXSg~QM1F{6Wlf}u1KHIlJlS}CccNFngW|y#jjy`6qFGp zy;{f}EUjp$rW{og9dN_IRC25%=J#VqG{Xlir>3RZDOpKPe4cvS)Z{6a@ zN%6RiPO^OuTD^h8;jzIv1xLrBNFMpgmJ?8%9*MaQkRH?}jnv)5PXMXC&~E{$`wA+S z)qTZrfPP-Vl~yGn-JFO6(w)hV0=h=_DCwR=U0P%S{ZhWT8<0A;;L(}?C6aZGAGQvV zVh};Sb;zg!q&c4jNU`ejWAFB3?**jg{vSW~H-7995G`us#H*RUB<0po+{kX)GC+E0 z{*!?ILtxTlwY*D)r0 zS4S|d>;ENtS5q+b6JFZ9P|Y`bA%*xw5Ze^GL9vZ%nGlk6c5(m0zPFMdP*S)siq8TO z4o`_-`UvKr!t_a1z>f`ny zY$@_!8@gPBh||zuv>YhmF@Xg^!D;hA-en6yKMO#9hPPLOZ{Ec0NJk(o@4_ zm-JKbpgrkwKpzl(q8Y^ofgS{;I^`b%QtR_Fe0+w)HULs>coM zrmn72_Qz5FE@LmQXrL2~O%2S5*fbailfoak{5gxR34x?(QgZtN$4=kKrXZ@ zY<|&}11nB8&Tf<0KbG?ewCnMZ0?Tl}18k0!l6Prs{rg-MJb; z7`xDLW7%+L$RQ%P;Y{706Al=NPx~~DuZih0)OS&c0g+mzp==*uHvS6&xL^0o?GQ&i*9zx;}lW> zcY(pacGHB+uwW~zQM&S^6v7y=xS#E_*26J^7rzg=<2A7H&Sd5_0F-@PFVg`pijPyX z6mTc%AKa74$vZ(Y|KOfGU12}37DEQN8H<7GcQ9zV2uAA zTn-T3P*J`>F6xglO1^N(Boxvm`k+6f$}Q0)%;O86Q1n=(&9y68g81{b>XL6`{Mk5xn~5DKm$ z5={-x?gnQk?*AeWHHi{v(bklmFe$sC5qF`-!C#me$IqEu0*Tik>nyfCUehF>R@A0+Y&xmCZt&*E33wSidwL z>iQ+h^-HU-VBq?tS=KM;Te^OU3RX0+`Uw{>;&OU%d7)Y&{P=iO8XAc+5L4c<{%3d# zwVy&3hvuTbyun!!ew=jik~ls0qA7d3H@8oK=BB!2Xj}?hO^sZ22o{oM=`%CG`V$j3 zbni`1$222mZI~l&jNc0fc=T`=b_2CnyMc}6_;^hEgPC9bg&(Ux$StvQ0ztwG1VYEn zDBS8g7Kjzp59c4z?{f?zG_lt1JG}g(T`(bC2Oqc=UZLmO97&6=T3rbXh0;P8`bq_o&VrNZQ@wMqM zCOJGMA&RxX^c-KAbQU#9cBdk%q|*@1Z4ronmb~m%Eb_8S+LxhYCftq*!jtQpAdhl> zTRNYhXvwLzF1f59D|R3-Lc3Kouz1=n$D=;F82>$>$3;5MKsmYu|1cmuKW+p1rpVq0 zpd#8N>0Sl2Kp-lHbn#UWNR>}nKkUywG#3_Ln(itkp=~snk)Qp( zU}&u%=x6^hKS4XHDu@$}%fx3xPNN`8(7&Te2IvZe-=1WI{yrudSbtzTxiQ(fPcDA1 zFwS}Vl9|4|OFd!Rv4NhcoI^O=QG@1H=9>pdJDyv{yzHc)*5^$=K@zve(5k>bue?9$ zY-n({rkod2*(B5#eMx6~(s@eyE%p#Y8?=YY?R?g{7jV^iIA*Qeq=QCxzja?9`_UzG zFt1P2T5C7@S4~3gnsj!grf-z={$bg7B4brw$Zl>lI7h>fj;YfQU?bN|NBsMqsl?Uk zyR{Y*`OLl&EAayq#syoouib>UK(B~WK{^8^JuYZ*Vyi+f%9$eV7NB)O6ndE6id}7- zM=N{r4mD!JTKhW~Kql+9rmr;igOwdjmc6Pvg?U00=S{4s(U3K@3!&I1TXzhHWcU&L zKBFTAh??weB|tW2C4K~VHDh`%9_GIKlPNKQaNMk^z{;zBlNCr~881U!f zF@g@YN=JcV!1c`MqkPtaWZk_O>zI zeJwG|JOegpvFGn+H~W@!GcFd;*<~?IZ#<3cS@i1ls5S=0dNx+wvk<9Jlo7{-Vk=4M z!)-BHdo?OX!fe($%<#MW9wx#qmU+@zw*eW~_H(z)&DEJ*o^niiYF4tmy*xf^Ond2? zlKz=}DjXqfNJ3`;n-bUP3qcQk^w47|k>7oD4sm3VIa!YSd{_^s3{0y=RaP6x~p zDnY)WGkFTbUT)w=Ms>sP^ry1elfd~h$gt%&34?no4o53lEk#l*>HI(%Pu>G64qcpX zp?%v-nMJM!q(0xN(@~%Ae*mQV$`Y`j>MP3uslJkj(o|o`{S4Jt&IF|T%CiCa3Xljg z@~6KwI%~~4lHlCefg~%-xX(~9ti`tbkj@W<(YL;i4{Fm_YExzy@bY?VP_){Ir8HLY#E zHEreU;N+;g8k{XwQ@8_XQIB`v_GT`Ni|ER#ldjHHbn(s74_}X_iVkC&L+Pt=@Gz%W zO}cv3U?Ge8w2Z^kusn{nF#2D22$k!?&D1kr96HK<{Z@&(5JE6EMH)2wt{1KD{rIK; zoy)^K80oC`V|WniG204ae9x?60bw*fO! zsOpZdq^(dJ|6t&igA^4(vSHx(DOzoTgn?C(mgyFbMkcNfgQtZy)} zgAC){OY~!$T-^!dyItQzpl5uyNAUCZ%p;n7h%2r0N3CZzNjz%>LK6``?e~6MYqMt zfPI@}m2(JD+=h-KPwJIJbrhtW`#4mJ&ds%NV+{|gG^EjTK>>NRKxMUVm_Z!AQqi|k zt0r!NTd^qZFxzO1SyjuSF|N94r+c0~XRn6kT!FpX7N6cw#=EV3EL(_E4h?WO?x!PA zmu|}eJu14W=K!r2=tDq8H#GJF(rx_)Ak->T(pDe3!G|6PG$`M01@s4jCW9l@=4=Ka zwJ)Pts#?7*2BcPREr6b`pyn(MNUh%P1*Gc1Zvs;5v!?*5)!PpMZIds43`niseg#NN zdl`^k>2xM0j;g~r7m(&h)uQHizaP8GkL6THt=WDL=*v>yG5D)X+B!h03E|(T1cL@Z zY5dAU3-Nc2gk26uCp;em^c9Jv^$`f{&$?D?=x8=<&B3&~8HF60f}sb=p)Z)$w|CJ5f2((yi4TWogoC5(j#$O^A48|~K#=dM|V5*m8 zt{8UYTpDTOT zdH&olm95t1#iLtNpC7f?CftOhhs+4 zXzF&5T`wfNj=kZ7xp8*9xARndBkLZN8{}E+50_dKmxmt)Pr$VlDz5B`xl`e_1He4M zvqi2Qm?gNH%uN+yGl$L&uE9tZ90=Je7zkm=wmc$(p{%{xXd^~H+63vK#zT23u<@(eFM#;ewS@*|$oD#>{-tj~$nb zwbp_QKUaA_aqE17C@$`&B+3?kBvt+g&Q+*NAy;SFf+2e%OxZCK zZ;;D8kC!ui?h-RUYN|%%%?=_Qi6b;XWCQW+J&xucCl-dgafOs^P51c`b&0x%Q8M@gIsHi8XPI zv9AZOUtb}3(0Bom;54oOe; zs4qvBA>1LOQPrUixI7j^@jl7aeIJ*!qE2#0Yob=GI{F2zJcY;Icb&p@0NN_ua|fWO z1mdzwr)yXXw;|Y%_AEN&7AVe*G$!&3> zKKs@Yl?Si?eu%p3AVe*GpJ;KS?tbft%JbTPKScfUL5TX2#2;Gs|1V98DdyjP5?6t; z162K=Hi>&#NXtpw7J){e#Qjzqp`#!2GrO~_n{Io#QzvR$648(e|8#wx*zeMw;p0Zz$c8n7++VjL`bVxE)3|B|NGfg^Tj+ymUbI$g(o?+De9zG)OIw z2*lbw4g~lCiqbXXF94}29=$t%T-L_H#`4Zg!E{s_%v$#|SdPYU(iscgZYtp5Xr?7r zx2^psSpI%*_uUA|Ys85S*)tlUcelE1L^ae6EPsD?_Ap!We77aBu4YS)!RGY|@ZZ&n ze4ZGZi=|gZDtjy2GBy1V$!+_Snf;OLFG_aqm*$)@FMIZfOzsqR-9GEiccBJDv!sDj zb$`76bY!%FP20?-g?3z`UU)1ayoIjuhXl;R3#-z)!lnRG-1*$+%D3VC$+TYzXs?UY5C^>>DlnS9_++`qVz;GS*#*e7rNn0 zblLQT*jbIk=_AP)?H@o)<1p$4r-j4ijD@v~I56y)Sks4hE56m)NSQDUJ6yyl54rgo zgh;;Ul9$p)<8R}BH)nY8@^j9F_Dce&mnH8O8<{ht1=(BcHukg4NA3l@tze}_8~j?$ zrR|%qVBIHDe;+#de{TirL*DpTg{t_fjX!B+bS`0KO)Z%G8HF=5EIbZ;YVXq;Fbh%!>PQ($fFd&0Is8x2ggVS2WOY#Bbd_94&yKoe6NlYk=qrakzNJ;A&8@$7eG|8 zk{pNOp)6hY4es`BmJ_w(Fn1Y~E?dKpzOKzy_j@tybirjFU6U}5b0Ca|>9U&bLvXrM zk2XT%Y{x#*tP5M0ml^v)443s4DW@LOq;SLZjR|NwFOOw*V`z+FBf{$50@RaE-_Sf~ zFtfAt>{6@iVT1@i$3ZpPepEyEcB}h8SV0`fn!a)91Y%}&(bfzlx$$>M{6@x)f$?>A zLUjW?y)17)X~#)kM^MdrrBn*w_H@&{>=_d!rh+lhZ?huvTBkp4Y%o(j+zw0P=}e3f zv%U!i1$abLa5U-EN8)fyWP{$Qv7~Q`+o1+~{Lt9sV5zhUn!6lLfv$&CAU8Ch(oE2T zVgsySM!xVx6!g*v+f&Z-+;Pim1Mba@j|JO+Ef;1(oa#0Nebz~eBqyj&NLvCgQLiPE z(h^X@wjvb!Zk+Shn(5DA_QJ;aXs|J8)&?>U&3F3U#`qpWh}RTM4BL<5+u-04G-8V|`Ajy*sd%UVX*^I*OvmaYschK-W7npp!|_sm6c!))mA1<` zwu|-_v_+Whg4Ju%?Kw&GoTRgnPH0EzI-^EJFN`_QryRCkZ0`oY`M${xvz_R&J^dae z+g4p*=M5kbyU{~Wz~I>0i9{v^iyYcSz2 zYRumOwS9xLFYa)mm%{pIrR(`3UNAAc1D zhI%>Pn55)!k!puGn7Vfds_C_728O3tLVMeOTyXvY*r>16Awb4%hz=&2FeLg$+Lxy6 z_GTDqw=P1UXQZv>2*!S(i67~OLB1 z#j*ds*)*!{d!qXn?eB_Z_K#_QN5c7KO&`QWeD}MM zS?p1eDim{`PVkf={Z3?dVO1{rOMjZmxy(bndIrO#Qx0q8zj@e>ISw z5ObiL-;r*9oAlzQjHnzb^%^IBbkqyWetISPq`mNHC|_MM>qYsk7filjkER8OqZGS) zlNQFuE(Y};xW{xo{paCf&$G_%4S0cs0E54(P^s1Z8b+Aizt&f*L|%fGZX8-;jGhM+ z7+e{8qr_p2hjM%wo{idP>tc{+ooYdn-0IZouEM)_)(O^HVxnnvzcUw#lTKxLQ>oBZ z2{s3a)4N?$*b4&w$G;E8M7KM_y1Sn&>NQA$Ln}$@oqxJiPHpSx`YD8aeclz&-gn)H zG03`7{;&sGIN(gGQGU{y3?}hVpy?KB;J(9~Y88@2tsBac&c(2J9VMN~E&}h-PT%j; zE-Sskk@6()jc}khQohk)@<+hS%P=@g@vEi>-?NDbwcJf40HPxD2`td)x;C3#;|nj* zf^YTwd&{>8%rCR|MbTfqV06`kaJeMco_3g{V>Zi@=-9fTG&n=10zc*45T-wX zW*0fsD(cp1t9RP5SABsE;$+tdUtk(o;0vsvsKW6+jwN~A8@3K}+;8aqjn(x*p`uQh zW%gW9piW{uZ)oE%ytW?^TU#PW}u9I`( zoo2UUHyIAJN5K9bz1Z(K=$}*=Vt_e}8KgQT-u=TrU=Z$aros{*0zar!$iFNgQFvJZ2_GMEW~EmKs*z_|dMQc@54aQ$ zd?R&sC-rW7A7Yg$+zL_Kk~>hE0YPYeQx@W$zaIO13DEzpVA!t!=|Rlj0@5=&djaXu z&3A#CdOY+@KzclsH)ZRgP@as?1E5?=eM$1;ov(TT^vi%wK_4s&_4#3gfHY^`SE6Tr z{sE9;MZ+r%`>_xGUqE^Q^k#^}?@E5#0DWJeu~@0-bq13G>2A{uKx!%ZZ-B;P!c`Xf zGN4BVzi$FMS;8Izbe-ff2!y8$V!J_JY)NE;uz7|>p+@3nwP!?Mu708)>&&jOk*VH3vVwsC!R&WH|8=^2kpxsL z&>}#agc{V2srTF^fYf{LwSe?M^DTgs$GZW2O}_X?K+5Bv1vEqQ`(J?8O6+Ps_FI6o z2lN9{KHUmvxp2;Nfb{tEPC#1P5TJV{b}yjY1v(06W)+G6(ldLtKGfhtAN8SSfE4E& z0V&S615%u`fE4F{2J{ud`E!2ke*jXP*8)DM zg}|sTrD2d(d_$}?nD*bLu1Fh&2=jCBk8wwWp}tqk;`tU2&C7Qh`lUFoTm$jvm*(gD z#?#U(fS>Q{s)Y$s=Xb(mqfn>dn0&4l5Uf59%KxLbMN_aef6KBsC5wl41ar_n27bs( z>mT4RRvN~CHCgjLiboG^uh@Y(5GESNnT_>Gyt0ZD4+P;2Yy8MApcU$U9II{FMLwK~ zoPz}prfw$%=6(m>9~Lj)YWsu}q#s7Xo3-5vT4<)%nt9a8ZI|c!1A4GB0(&Byv)Kur z@{|KL@Eg=kwH5E+;q__o4V=HH&i#T!g+Uq&CP>u$BIT+G1Imo|0)O2gn8cdcmlfF{SRxw)>p?niny31Ml>JyS-NhGML4x20 zLGJFf4#dQJzSzbD-bO(#b`^rL;{PI-H<$)`svv*1>uD_(RpizI`3gi=VUg0S)98>q z$*a>Q`}d{gb_o{iEUFRZE+{MkB|!{}R<%2iLV>LV*Ov_GdeAET?x=z)K-rRI!?-&*puF3>$}JwP zGyAX$&?zMdJ~&Qfb^QW}Df_$t=s@iADB|A?_9@(FdL8V81_~;#!1GuivT>wk0h5j{ z?5V(l_r@8A4$K?CEp&K)nRgYkEJ_c{3(p?52GT!p3JLvW*>CNJdc?RK=OYAj}6^A$_LOX^9H2?oIN^#ICjDv zW5CSrS=Hh+)3pA!l9xL6C^6+&)#PD?75D+DK0;t z{~|Ndb~NH5Gn^i85?~25++BNR0Coj0XJ?cyP-? zk48|B$T@%HJ<@-D;Vl{gvml_TtfUA=78_Qz+2L2k`gDg0}*z2 zt<>i;J2h3*OJ%LggaEhb9=_`DRiy>*ELHMN{Z6=wYRL7I~&#n z$LRYHI>60F-a;F1j>Woknv*;9ol_kb6P_SgdbW3w#Xw>wRLJGT`D>lNDM5F3Bb4_)Kf~0r%Rj+~xa4ff&lTH#?)rXkRyV(uF-}m>v@Be<1 zooDZy=d^q0&di;%lxCTR-Aza)urLUm%!gBbY>;uF(4m_@dk{`Y?Be>CMA?>*L>Ws+q8vj=e0iIYSo?&K zM2T0ie$P=JAS6-Z4TPc@@7>(M)~*psrG2>FxJO7P;_ymV@vk`T4rMy8Ga;GIiz6fx z5h;XZ5_uz`J*=+{>B`3FB|;JrCNl(K3QX3%uIsiC`kWa%3CRicB|>8Nmaa2MCV=H4 z=~E_TmlLYMb?fOHJ=5!%Of;|Ph}J%l7)p8z#Q zT0o<+8nx1>yGDaFdQ+p%H2RiMd$u-^&aB!n`iPM9uk_prqgoLq_ zkhIo1jjj`tYy{Bct4!x%YF4HZixN7=JtC5jOe0n%Bw4FNs1p0qgpf>vw$O4f5t0eT zWI{5bIE0W)D85EWCKM+Tk_pB6gv9PrLSlC{A+fuOkl5W$NbK$-BzC{ja^DgXyH^N_ z-QNj`-3NrkuAQbk#BNSPVz(e6v0IXm*nN(W*sV!O>^2}Ic4M?$TS8*D2O+ULfRNZ7 zLP+e6CM0%WCnS@;^9jjR?;4FhBP8u{TqE2-D4t#;l+G=4myme+h>&;?Lg$|1K>9s9ltg?49Z#T~od#+8f>UB=%y1gM) zPx88GaJKO@?mM2|kgC_jaQjhbHQYHVUe=7=jq?^>Nf#a5Xk&NdgvIO1qt=zHXxBg; z#%+FjrL&eEX{0xLRo;a^T$lFvL!0V_u6ovjPQ>VinV-{1&Ex;l3tgXNdJ1g=e5U%p zVw%pr=_zvO&+}BoTs*zbiDuU^+0Ik0m}I9n(bebQc$;FwK|CFk7}MGeo3@AF14>V1 z*Nee}Ds+lYZ{w;L*@7N;s69M|ev5l}O4G9c+$c{!DIt$F)7ofx*d=Vj>!gIf({K2Y z)q3=ZNDY#W@%~%)^G#g@RFd{UhcCoQL51?bVGN?P5Md`l*bLsr_hZ7d$*S z{yU4}uK#ha~;%2tD<|&zsjUpUw~4YLk_2G=6rx zXYJjCv&+w-c%V~5`hm5-ZLb3%+z{G^~&1n;R$Vif;eoekMp7A7Smp; z(Q;Z4p6Pgz?2zt=mh|`!J@Pfkj~*-bVeQW6pDM6+x&^6T5~-!;+tal6?jh6*$XZ!n zdPJliUGZT9^aD_adJ_Wuc8j`Wa^mrruts~npxuPAfqqGgHhpYccv7QdJ$_P>&YtN3 zQ-qTefcrh@sXG3tN}BeneB9-=iRDQL(fiUnrex}$diUTuA`~mFS(BfQ7@SwGeLUVZ zmBtm~ER1minn!a=IyKCw@(2=5Ymdq|h@S1C8?mMp@~2bk!3p#v+}V0#MwK+ua*FQS z!}1LZiJ2CyMe4;&yhYDnO*?m^I$!XDv%{Rd>i*-j0hoXqhHzuml$m~4Xw1~Y?3jKl zB(0&}`}!7d9Bv&O_6eQe(qr^T9=FYbDPVfKKA^=kA32kwo5mm06X4WHcn3VTitgAh zUU6<1l}Rt|*RUJ4302~kA2tEvLlx}bWNmj{*NadIUOPaeVS4R2LXBA8R9*Kmp`%=v zP6&tncH=&wPZ`YeE|n6^*ajaHXESBAR#i#1~6_r>`5+@Oh^Y&2Q*xOEL01=8}?o8licV`%G` z$6tR&AsH=v?@?zNy##Mxh~@`{Ta#`x|+O!P)VdI*<(@~8&AQD9$MzMl1_W@|BH2uFqeNDJRb zi0TbItk#*|8N$EJf!q8XEy`YMN_WGK-y2E&t}Fe3R39B1y1Lhf37h#E3982F%#A}W zLrLRj^rU5SOgxU3p+{=bGS_J*qXL1)&X%D&k`) z-+Z63*)$vxH4Xic3q_=xMn*pxhVxQT+&qY?>5L(rKXY%ISZ*5hy3S}H*QV)KudB6f zeEe;Of0V5vg<;?+c2y?QHt0(m6+I=w2%BU8oss$)K7n>4u!_GC80C*m)2NRRXPKl~ zg22L=FR?6ko>$_uoU9pwz{vGPJ5w}E5Lg8=wKG*S1cBjrqMg?@OAuJ4g=P0K>=*;7 zIQUaOrfY^EFv?}>*$mAP1V+>oJ)5ang21Ygsb{k_Ll77*m<(q#hEuI7b2UQ{7!6HE z50PuF#A!KCGX#OrOc=QXjNEDTpODSSO}!^~RCqdwyYS&G3p860*sU|zYoo+zxll6% zfzeSI;Q>Z?l~5zRZOHAQ^z28orTE8!h+UZ~i#1yi*j<@j41IiWh~d{B=Rzh6-$XWt zMtHrgu%H{Wm8y8s-$V2}MU*$#&P*Q!!ItQS&W=yeo8;6>n#gbCsr-g+T%}RPli#>` z(AOyD6v>+3&^h=Cdec}hj}C2R6dI`9pyd+XLW0mjBZPtN&)Ea5J>qT65Cp~;VH62A ziqIX6MG^vyBJHyqMXCfCMWPDa&X=BN7YP|*7EhOHErOtBQU<$tXjYXKnjr{`>B7ht zXyhZC`N(EIvY9U`*X@Y(96Wa7_wrO(sWk|KhPk2vW2ZAasY;xdt2ILq7z;Bntl4=_ zGX#P0b_NCx3sqU88G^uAX)>I94(o{izGeslW34bU*>m95TG`(S0&Amb#~HoVGdwsa z3_)OQH5nc}`%p6kfwAL>o~_d?L167M?KnNFOSP)3*9<{m9AHNNGTDv1NkK+fm7>(& z@)-ds*<$@I1Lz8pq$6%)G;1hC=p^$97{NAtO4+C_2!e$pEE%ap(6hefDmsuhzGsAq zRl|to{k)G2`fzgV%M*-(0!JDxY_04aZFEby`;NXP$j-7!J0J)SoMRjAton*V%gvf4 z2&_xY%AX$x6%j_@aXF}nr8RJN6f+1If8)bhKGu2!LC-ah)^UKX$`;KM1lF$}SyrF7 zYL+0d?gr2s>tBKx(X05(`hdONnl$l+ugcv1#A5 zAbO$msFQ((C%t7QQuGjKX9~A4cIzkwA*xEkupB1Ov@rH)h9EGiGb21Az=&ucYD82C zF(Oh!(}PojViggGCa*CQgGvLI$GV;PaF)GVvmj{3{u}Pb^!n?`?YC7FpaBJ&c;r|cawo{B8SEn zgvJ&I^jZc|kGk86ZjwY%o}jT!`=$la3!O_K?kuw2mD8E^`gm#V13F4Uh@+b@ER7we z4AAnRW(Wc!!IBrcq(DV6uvX-d7eUC2Fd)^4{#Eg$ySGbTlwQPW+BYqTUg&JDlxj&= zP73QSSl)e?P{qRgO2;Y)(F|vv^^CEsh4Hm!2m)ht21W@B#KQ3O33 zLl-;o5nTook)G0#3PLQWGmTW_5UC(UDh&5XJ?Z|zYow-q(}L)AkJOXi zixR123+L&0@(ty*j#3b!yqbYglx5`ucZbM9kRULA5r*5jP;U$CJIxXV7VeYqHNu1Z zji9J(>3%8pSl`xiz6>I=CtEgl`8aZ>n|`R^23J+S*IETZ>))(3Qi(v?m&w?&{Ta!Q zej|@t%dpvE3SM^fn06+GGn~xFpfK$z-eIH4586{f z@H9J1x_BC)JI-S`V zB!;n_2_g+fJ`Te=2H{eTD(Bb;7=pl{DGh1?E2Fp)r{#~DAqWiIJwuFK0Y)x5n9fB< zZMkSRE?1PyMCq{ZvM=A)B;*KSCqLXpoAaaOQ5F!(XjILkGySr9bOX30n;f<4$GuEO4P2_qYyCXc~>QzqE_ z*BDW@H5umCtn*aYwJAX`^$u%u54}FEQRRka2?A@Cu<}#*Re}xs9+9<9u;0=wL15t- zeqvZoTEN2^ImDpV#wRR;dNpSP{EOBm2%JqU8H?3O5MB%5YuE}I;bHzp7+nksquozf zR8R^8P|z4+2aWNCwlfJUo#j_;M-c4brcAdvi~U@M#yBWedB8wh$Zpzym{Gx&$H?z? zC?;Kg^0Y;IoIqHNZwgVDm|PrM^T z4j%=Kvk-9p+UF!>$>Ez_?;EdWfjihM#5#0^^o2IFshg zp4y>82aPn&SOkIf8?&r4dy0XzB1a-lgq9Enq+X(bRXpkbOLRL$lwJ%%rhU_b=!MQz zN~xA~-BA=#x(}L)Q&M%cx zE$PZBA(47%gNHgwL5QOaGs5!+82M@bDu4Sx8WFP_`P=4BQKm53$hd=phN>)&bt|w9 zJIf=jSr9Zo$C8ms1kyFQ3R`?_MtIqYnjGl{Si!>wh9x{D>ub=5(UuXhjjN1sHj;;} z<7}iRqe6t*F)Bu=JEI&ujD~dm=AnO~fI@+h!BaxryImC$RplS1Ahm+%tMLMR?9N)L zD71X6S%Sc7C@geV=k>6@7KTrDwdo52qnR+gG@-9%2m+(EX~TJK&$>a_HA4^>9ZiM@ zulzMb5ExxE^(sI!1cA}RwBf<4?3y76j3j1+7Y;NECxjS<=>WQLl^~;V+x)llrkmXn zolv?XnmLU*1Pna?qe_t0E(qHDvt*&I-Qfj=$!T1E(jUc*-AgFD&bgDE8;KNx$HA@g!J74RCl*)xSy^;&)Jg=0}(v#k|SnmrRq*Xodj&kVs5ri04nmJ6sck=)f z-$V}WBM9vy4D4J6)4wX7bgy-Z)w(+}?VA=vFLdrzN@?jy??%>ZorRH}CA4rIr69zy z)r>NYHVZ0>fwdxsCHDTlSBE9ZdL3qh3&R~fN@tVk}P^Bageizk1Nu->SK*0xdCw?K;^Q*wYU z2>yR-<}Zx~J}QcVwIT;E1fgw&0jWmxuZkz#=Un1cdJ(5--?Silp|iPCswG`Hmsl@d zX|o(ID(#@=)Nu+zBsVjSQ{)h*AjByQ_c%T2zUwtk)4pjz^t#9CN$-6Xr`y4_bzhN7 z$0`W1`p^*=9fDi3Q;BL-$*mcJz{r+?Va;bA%@71e2s3!k;-TM&9P%j$`4onGK0WEq zDY}V+qC7z#FzuTbM6Y{3J?YKQdcF6XygE)nh_iU6af%$`6ofd1;U1?a-H~47H0_%f zM6Y|Cp7d65jWdOu!UM><;DwDc4hTY=)x{UglF=-=A5BxBC>A0VSwtuZrx3z|R1x}D z#gqOzW*%uzXJx>;FkGz&1A5yl#aa@5K{#MH(0R1#b(JwKh+gPSpnp|7`HYt}npYTA zF1+cLTtMdtrIePQ^uEY?pM5?&!jEob>1jmx^f1gRA@@lkydF{xgEv_8=GSc~2zltt zl95UZN5l9X7GJ}UPy!P;zvL2M?2_nmIB%jLGYtj zMn6)tAA>A@T%aL}X5hq+*0%g5vl$Ty&r?onlP@(~e8C$H(Bow066XsewLf?0n<|C1 zKZ4-T5SGNLwl2ucXzkNDM#MCxFbd!-MOO@jd~7N{c~Y|$^#NbrVdLRoUmlw9@Gxc3 zhWR8smqRyOunt?^2voGjM!005^Kmv@PG>pD!eKcTf)jIC z7wYl0T~(ZX`YH&VX)KwnMDSWKV;9jp@S8KaK6kCtYToT$RSuk2v!)7>QDcwc+!2? zC0L~w!J76>3!)b~trM)C^qye7Ig3_rnpw2PbhLsH&ky1e-wY{DtGvQmkwdhC5UnuW zqxGcwqSt6m`=$la>mIEqy;rjoZE+o~AjESg(`ZEw(F#Je!f=n)lkPvgMr+zPEr?$C zXg%qDl%;4(=x7BYT7No3a=rd*ZCjB;w1N<=Fx;c{q&rx269+}w4>wJ}s5TA;Md8N<&D5A3VWV5nC%Tn4CLGYw}Mo+3~Piiuf zyJVtkK~pS-Z}A80+w7S=$u`rTzj0^D5}p7EG{RE7WvP+&&6=gs+BZSaUN@s}G1|B0 zj3i5~O|NW8wjx>eq?1Qap3$BNf+uYyyinJ7dJ2>#Xdn+M{^Op$I+V;q*ul zJQ|$Qqfy$Uv5frrKqMs!hFbULPqW3K18)-XHE3{gBKu6+Z2xj}9ju>G+^339_*1!# zH;&68wAJ-zwd;alc5+77XKUBr`0u#Rmx7tpniaSXj+llJBUeN&~J_C^rA`5>b=A8T(uVI*xY&*emO z+glC+J+}Qg+g$(B?RvetB|nWnk;7gxN+xxod+v7AJ$GA;h}${RLyrdU3QWl!8_-($ zChsvSNnhoRA(9YYBQM?H79mwC=qLoigU?tJ94_eZ`?(6E@j*uAux~PMa}SnSj?P8R zQLgdvw>vNu-|7W9CHk>T6Vd&R*;TQRGG_BCAHOtw*~ltbt5E5>Q?iY3@zs$_?d2S$2il4kAmZQ-@2 zMp4_j_S93{#VCFwnNp!jMcq>cp{IV6v8R5gd+J$61-Pdcvq=Zy?zxLQkUY;4+XMRR z$?Ehf_!7%k%bKD~85@O`n|o>OL|*v#VwJQK`Q&UvGUn_Fxc@-evGQ zE>JF@o}Hda>tswY78*N@OU9o@bDvH=i9W-9R@%~S_iYF5XYKhb1{pTeqnLL}DH_qM{;&JvDut1jGKgyvl z7Tc*IO_~mkvVEE@ii24hHS%bLoJb3lASA8#EFozrOf<{*QA4kdCWM!W`5KK0iCjxU z(nBzrBjz8;U1E$0ooEYaWy=-NGc+lnR<4G5^4kJluoVa>XUkC_ zsnE6p{}hRG6ffSmWbx9Gk)GYSm`c^UUD+1-qpi<&W9<0C_d?38#vw3_n|<}LybUaVf}A zAtkx!UVpmlBp2NdYCX0kVaqvsZRS!HzoQpRl$tsnf?%a8OS+`v1+GFm>M@dM&Ns@I zf)0V7TCpCI**4ls^d7ZzL)OlWTWa5MfTT(-?VBL@)+D2Et+j9M7+KDYrTfX5asFrM z_AsCFhV#uKyZC9Fini9u8eUq3a{$>9VwCC5>acz}62!dBHv7}4JdTi!La+}^GWep?Q_uQN1sqz30repciSY}2ezHIw|zJI<}X6`4bv%l z*j?A-lo6zX6gV4)hd$OvRYnubfLBL1jv!bb%94=~MS=7fu0rFCXM~5M=>4vIP#E0< zm`~O4D|OPTkLkQSN3_NE1pghjmBuS`R_(t0M}9{(Bb2TxWqgKkuKx1P|J#r=((3Av4&RdN|Q?*^y9 z4ob!@_$k}Nx_kI=mT2v^Ah`VzOS-tdgR9{7PDWnb{#Ltv%FS*6h13QAV|1OpB7c@W z{@SC*^|Z%=;PJkU9v{&jAIr?+v)bb`{{@fFdGxrx_E-=+{x+k>>DuEJ#L^q76gy4W%T&2_V`|A9$(TPU-&P0>=Tad9>v;^8)}aQ!Q%%RJ+?C${Wu#V zFa7w6_V}m&g2y>MdfZ5REC?Qluw*15E*LQKXpi$}=J5^f@ing=Klws(DeY;0rwdp# z)}9K2r$sY*8mT=k%g8dnDZ3%Lkesz+tm@hm>oHan?TH|GQYoV+wX`R7ES~Vy2d5`; z^?@&}2O5E?<`o+3pUeyEO|=(Wsa};B?S&wC(IBH2EwmReGJ4_+>s{S)g6utPll=2E z=rn0z)^hf;_V%E1m6lDlw}Rkphm78K)85AYOK=f3Zk22G=9@41AkgVi z3+;^{cr%R+X8s`En=At*>V9P4u3DQQXq&^5Nmz}7@o6zvVMJZZ$i`>mIFOT>Xj>s$ zc#Z%g2fZ37N88}rf$6S?%6xE4s^#we)!GyM&WbACv?qe#$ugFVR3eamUwiT)BiY{M zATym0HFv=+ywq0?ljSV}@K@d<5O~;TALn1uR>kOPfARx)TePp%2lBdWUj@O}4J?^N zhzoq(rhVPcC_~nwZ257g=w^9V7d&W^kqKkeUTu97Rys?(wk`;q&sh?a`nte_FS#1+ z_7x*y8b=w~19DKFkSYTQ&4;1d_l1k`jMwsA}#t01YwWZM=eF1s=m)cw= z4Oj!op$H$zHZ>JvbIwVFijaC0AI{Q8doKvyKa+vcQHj&CuVx4WqkIO2bu8(p8G^v5 zEQ}yOBdC71+kU&$y9?-UFj}ihf6WvGW=&=mqZv!QffSD)=D2J({7&*2xn^TL77p4_ z5ZX}K4nn)>UlmVw>WUqwh{L%=ZcSeV!LsOu&f`u=EIjFLB#{UE8Nu}fZqxe*cB!$k zn1wk&M=l7FH@8F{%#nwlq{!(ZOccdN7AV9gQ))>tz~X>u;B7+5QE$dMrANEna`wRq%7_hgqGDZR*%Y2UOUdZDxY z6ZFoINcl~|!Sp8KAbOK9y-~QW`6l5zWJ8sqI%+|P>kZM6$#XNqG)oXzi#)PwD?_v# zu33V>dWTtj4CQ<#76hy@kD)$b8PuoY!&ydXZGymA#ga)%1esdTRoF{zVw7PodDND_ zpuZ7J$0@;^U5|OY5D9H6bF3J5{-Zs4+tLanwI_n$$;T`iNr(%iKhvJJs)Ikh7-t6FOqqm4yXYs9ZIE9EV2v)vhMe<(X zFe7lYoaT3?HQ2aDv04H~S&O%0w6}tw=SS9KJrt-3nzM}63_)OA7KU3_N5iW!PO}7o zbzN8<2KvT|M$7S8wa$ z^<&NMXS=->g_e^wOAuH=!m{k|taheoh9EG)nUO!si7U+VaKoCo*R^Ir(43bgBO!`{ z#5uSMi7UYv4W=pf?%n~YZe5}FR^4KL{X5q9$baQB{Is8IP+>kmJ&B#n-v7JNvt`u z#4XS)L16V4mY2l6sTqR6NMlCU6E}wCiRhBJMOw2UXdc0mkq|{e;>L3o5;uuahQyf{ zHL{er#oDYOn4QX+GfUiCnk5LVS;F#?xFwn)2#op6$a>vWug5NA&D1=9*1UTq+9h*J>a z6oz}8o^a;8=P4=9r7AE3 z^|jEoon^hwhalu5k|iUR2&5}<6*dIA8AKnK$7Oo~LO3p$XSzw5LC=^#AdMafvz|~n zXq75X5&9|!Mys>lkBl#j%fQ|Ew~i`uXh1<|Kw-EypeNmp zMK^I!lqcwPrhU_b=yh*EPkLLh-h$;bzkc>IOTn`B`q@UE13}0^2bN5NC<+>_8&{#x z;ux8yz54puldnbf)*e{rk2h%#1i^!Zj2`sU9;A5oAj%d_FWAc4K7yV{3pes^&Y2#b zk|UOsaUqVS0}p2vSn-yn1AnAF5d=>Lv1BAfQ6N2%tB{M)jO;wu|14HVqyJ9hvq}1J zUc?KWVY9WhSF|lQR;!cC))20Y4`&e$x`H5>9>>})n0btdX)I>sc7g3puC!iY8zJ*HS-8OVE^|q<%LO(kpK1lc%cU%t3{e!m zz_yy};Ntt@0|{pB0^1gC*Ls0%yUvav*xkUAHDFT}WM`W;y`2%Vvzt-I3v87+9iA_+ zea;-~1-6ka{p1U5B8QIQWDwfR+Olwg?Su#t#d?8lhmKzm;y=uiNrbo{_S0O2w4Y&= zVUwo|Z29qaNV<(aD)(*L+>VCr3P}l$4dUJnJ=j;67uYUpZx%wovwWt#5d?33V97`& z0_mT$H&+??^G3&)*7WtY>6}ygFn(f$aax8a|A98!@Ae}8*1br1rJk0;M3x1?i5qOk zy6>=FS^HeOEeMP|%#fcM3Z}`(KqI1UWNU|<4+8FtH>f>m(j*L3n>x^R}f72vleT(*2{vswNrw?2+qK$PPMA+(F{RgL-wh|-G;nLY@DE%63AKXNj#@T9k-*N974n0s}^f)Meu9wSyPcp z7NnNZzbc;eS9FP3=|#k*4}xGz^e!W`h5l9Xq_>(x>|u6zw4%{+pN?1%B7R<&mh+G# z3uC`#2m+(NF!*8*UFe~U#rdkxPe(?X7kds{G<>Nw2!e(f*1(5*d-0t{LjIJCFd~Qe z1tHhMfK(65M(as;E79%Lr}QGjrhU_b=!H(}#XL`X+e_5QFkO}lqzig}Rm7E<7LN|- zXaymw@59wbOPr7@$uAI-^VTKTefc8o%^4i>I?HkGjUagQ21{l*vRa}&dWR7)ja7^S zaR_C|3qt4yrcw9?8~hWlxxC*7Zj zZsMR=Pa{qHrUlX4h$OA^9iH@l#(JN08hJ>PLHbI}SbXNT3gX!(VOH z==Til^gI&XB4YV11LQ)E6p@SXv<+MnROOVmAqX~(vt*<)LcS)_8gLQKdy|Y}@+66&-GnR~0B9Ly!RcNe^ zjDmS5G*+HYpUr#yk1JX%&53t8#>0= zVNdm+5?CmB8@)K*CwG96J1x7Bn_h96yL~nzcT{*f$r^3&;VhSRFoF=wOYAT2X`C-! zRSc{ZIrKb1*p7t(sU`HUiYMLOMYmH#>BYus+BYqTUg+GWlxj&=P9p2|)|GzJQ3^sF zeT3nmD|N8g`dKptfjQ7*(wU=kzY`0RI?DsTqM3rg94gUU=JFK-Yef#36@<(R15(NK zuZkz#uZeD_h|-HJnf6T!q8B=cE2Ub}l`~$VwVXp)?*Y21qZEWVrV1km-ILQkJKdK< z4?#o)r^Ac`AI@@3GX;S;OJcwgGWBvldWAZQgFofoC6PsD1mz+mEJ#hKe^or`pYM_* zhf@^snm!0ZD~Mj`T!js;&GR@I-9jPEhx;#rcx}lkZzX z^skC1{p-Bu$n-%FawK}8bBa<*OHX<~$}~qeb)8HX7@uwFG1{onyd~a84n5l>l zXZb}l1%bI!Vo35gl4$G;|2@#~+e>0p6cgDId1OZr27h5fs@k1Y7}w$7#? zWb<2Q@S_j(TPOt*f{g-n6KnyRZ!3_RCtZ=+xW_;zerfQ$7lScVb=(ddL#z&(YBT{7aV!6<9wr=)F`mv+pw%EXG zhWkANs>ee6@7iBM@HdcMdb(`nVGcC@iVtVGr?m@$_8cr3sYH;w{9J`>6k_CjOpdd` zTLR}`kj_ChjyHtllesPs@s_s5`ez>NAKDv1@TMpmbkC4=4(CtJ5(HK$k1Re|q_rsb zHA@g!Wj(SQvb=o!rCEZ&sw6DSsL;~Fc%T`Az^E<^IW9O=K~$3BuScEJ$^ye^or`Zy@@eB1$htWYY&huqAq-GttSw!js;n5~NDv^kVcBKQ-<1gd;m2?SUY8(3_1E%jC#TWYPA5(DuS|5E@GVs(8|$BKn;o4(AeC zFnth&wimt7ImIc7g(tm3Snrb}#uNXNb3urBq&WkcRyYbZ#3qr&*#Un3gHzEgL1R-u=xS!p4(ml^5TI<=3 zY2UOUdXve5_3Xxz-o<9LZoh|WJqyIfA?+&&(Jm9F+o)h2)BQ9{5Lm03MZjyRLif`6 z@O6;Zv~~LM^9!vQb?D!x|A3+W9f`x@6I0TX2lV%<11macJ?-7}WJZhDtS)Y>9&rhd zxYX3R;g0@^Lmhn+`}ayq%Al!2-Fh9hd(nf^5~8D7W+#PhIewwK$5gNihdb7SO;&!I z0&7~36PN?^ULfCzrO>tZae6ajK>ll%LUSBr1m@?A2)Go)LxFeaz`Il6-6imU9ohjl zgU~vA3{4yC+jl^G1}oTRRLLxXN3@l;9<3-HSa#Me9!Ij){)QHhj~kR`mCk^X&u%*Z z=h(0v2@0n*CMl-~2)tOoB={olA?AD;P)a3rX9BBgvIQkCg-^;2d1Fl#= zZF|Gqa*;vQQt`ZIjd}tLt(!Wye_C?C#O{fysRL5~b(FvAC`WRX7I!kh_S(PcZvNGB zWDvGi#A@PPH=#S%siLf*Yd9za`aVq8B%0f&5d z@PS!kfVNj!?HLh=>qkmk##3w5yiA7rPA+7g-)_agqmK1%W6`lB> zDaw*H??U^vAL(BGa1i}FUW-2SEhF@q?-|t~bcRthp&uB<5IW1KHK89FbtZI<5rO~f z<&=*5F8hRD>fVqJs{5JOBJQ6UA?_=T5cgF^(S)uuLfqFFA?}-u5cds6v4nnMltkzj zqZC5784V-!DjEY*5{M#0^TURf{@*kK{DRpu{vw zWzV?ez8Py12lP~xo@}T(jGOn!CtrTDxM@Bh`kLhe{)@~CASA;-27MX+5vL6QI5+Y> z{3C?Hsfp1l(k$&((Y)3IS6Z+u^kMwLL0Q-TTYOtLUOsLP1VwY&)G)9^cPtuL)Ho6wasyp$J9<{>SC9_9v2cdh>@K;?LkuA?;6Lul|%P2p*cVj#rsbEz{ep zj0zO(@~ZA)iQGcojxeROz_$0!(sw|w#`wFI z8AfxAa)yNV_molNd!4n#?GM&=f|k z2~B0xnb7NuVhK%SltgGcqZC3j7!4ydlM#Xc>&0JhM~m4fZ~1wH*CIdj7`f(WKG#Ll z+RXE_faPLI?oCEdpP$^?-{HEiO(A`e{Rj8$TZX{@UU^P$?km`Nr0QKp=t?UYIS8#{ zgjB6&gjBu92wiCnqi90!Gm0U!j!|nuA23Qyi?3Cybz)*_g8}{fC&puzq*kp_t`#Jl zv5eEb{U278QG%v?w9F8lL4@-ELYbp|E5N?NuOLQ9aWEqXp%6w$aVR6CIE)ceoP$v` zp>Re>aReizI47gdgmN*8C6t>{5}`bdQV7vge>9d2Bb1L3f&c4eo6ZmYtSfovEkA{M zE%H-@k!ya6a$Pj7%{)I2mWw61VvL?XKVNEphq4Az#go+@J2)NCwZJ(|!^A=HsmU@o z*e)?G4HF-Hvg1fF*OYUl4Npm|V>pugI|e29>L1q^VuRA+(h?m;hyIDfQfRwLbe<(y ziOh4r5w8XN#=&}D{SkFNdThjlH01j5+5kebuXZuz$+vP2@^%1bb24|+6IW#;e(<2Q z0sS0J8#HpnrP0h#kHKk)gUUGu_e_oJRj0U7yqqItXaa!IYJj6*Tv}X%q&ON#`Z@-r zI@+hk#rL6!B$@#2H6SgS@?~(=T^vt}8|3IeAkEPuF_F@n2+(stYNDf8Tv`&HWs~n7 zTToWBx(0Fm6Ot21`yj)FCf^a)mrj!thNHz&shvFQBg<_Q`wd7-^wcF%d5zU=nh0t; zpf7iX9tbiek$j+Dkx|l`dgodXRhI7Nv733!L0m$D_^iV=>Lpm+h*y~*cQK?p;`Jc! zNFL;f?>k@+<%4Ev4Yh*O?S!-CH+MIM2MXsYzeC-FlxE1 zRSBw-p;paPM=KG_(!9taR;@NHVlEK2F zM?S?mW*TtqjNZ8BF7DwwG{_YPXn2`<(15EdW;?h?(#>V9yV^KjYes_g%9qUYXkPgc zKNQDZzx6x(@5T1ue{V+cA9F~i|B8Vb@F&i(xCh(Mqbj8`h1Vk3L0V2Zo>{QsG=?s5 zTIoZ#&5SpMt$;UN+f!UD5n|nv-J1>=)FV2^>pYV35DcVnq(@z&Gt@qfXI2}qa%~!W1O$E~Y2Q_1K!wz*z#wW$4c27%sa%Zx;bHj@amnwfcQ8JT&L5i*1GBx@X0MMYX&G9#BAdJOLQ z)cLXch5Rh`XlrSP+RS2?7!bR}02_!1`Sey``(3sI$<>SyJI-G-kKK6<=BXpMdIRh4 zd$dF=JeChx8ag&GLJ!%@2)edtUCQ^&@+EO2UlKO~mopGpX^l#^;@-!w+S;DrMWfQK zWHt^#)Em!z9J1PSGoimC8{0V>XxGmfpWx98A+s$aNXPz5#KlAh%vU-Nr`NgBPI~i&->lqRSqL(OO12L&yMKD8w z?LXNHB>!fF=y6>m^XS!{=ILX%`UCrqJldiao(s)_%l#<6jQ%J48i^bklgMGvIy}PD z)~IwV|F)lHXOEHTU`EI^u0mv%g{!f=Ti*-VIJ+PfFpP<@?iEw)ps-N zixMd^E0KbemEk`h+e3y5GD3!M-6Qi1xeovTjV!tE0g8C^ft<^<6k`_mcSh)|(reN0 z|Lq}3|C zd2glon$;Kwun&kal@VGEcRVVa^wn8-*lHrTGRoZ@Pwt-Wz(0kz)2R=_Kv z?WuKG${wIWQsSVbLJ!M+3^q zmw4^dr$9nM3M7=Qrl339LkfB@LJDvLSXNVz$uN=CK9T6roJvR%uYLN2NMJ~a1g7-S z?Q1SYy?3>-v-U;jvYFd=7n1Xfjc;1VVG3Sc>tk%6oFjkAu+T&2js#7;T>g!(`d0~B z^7x|>3l+C!%MW%<*gi0+o_*NO(3RzuR{r8<^Pmx*MDN~SVeP6fez@?*Z~5*R>+_#E z{G!j$-+r1Kd$MVn5=ld@Z&J$#J38$?I{Cdm!MR_URsF=ZY@I61KDqiv(eM$cvb{B| z{PLi$chBfnr|0^5-j=1_s+*QAbbQ{ag|olYx%cN^wFzrAd9D3YLdl%9t9%$x|H1vx z^RF+zw)LU1w`cVHK7X#NeD#~8ZawxpM$f5NyzS_mSA(~zW%X8l?)5ys{Hj`xX}Eh? zwGG9S6kjc?6{)^<#KhD2vhQvjzwFyF(W+i8)%tCx%5T|O?O2^&=bKmfr0|;?3YE$} ze*N|i1C^XwUffb?*sBvdU02`L^2&l`9VZ+~ZB=#r`(ON3aY*rUKOY!=G=Ai|IvoZc zSo6l@g@08jx%S7ok!zl`zW&bVt}d!y`M6p>td{3XpFUl#Dm!Ya+G9=HY~TIAyw|Tx z?)RQMw0=aM87t#DM>n}&dh$P|_b>3R{D-%CzYd3+@0c|1^8I_i{QTvl!FHv0;l?Rn zoPBOjlOMO|jlI}?$k&D)K zxV2#J{rkU`N~(Th*Onv0uN~Y|`@%OEU6q(o&Fgm!tI}g>`b!G~ zL(-pL`sKZm%@*}JUo-EkbAE1{`slIJyL!vr+Q|z~HD3Ds+3B@r+^;#O_OI8@-hJzn z7bf2*m?zujD|>x%-SKo_z>l|Iy6sWxIZMrt#=LtGd4G zzN{5CV%&rG54Z8QEIaN|_8*7&%=-AH7W;agPMckDUciz|&$kIUb+u&L)C2i)yf?FK zg){vRU+($-{e-$d*>`c8@ zC)DzG+ub879cc4f;+tfl=lCt(#u1xE*N(+?>AH0Zz}Uu z#U7&;k7y7vr-jOI@Mo{r$@WZ}>Lq9YFm&zAN$>yLWtZpsY=7(E$*>NwBTkpuIJl*X z)7x^tr8wQ>_|KH^X&o!OO4!K_(Z3C8+!Norul){-7eJ4wX;}c@$s*O{-;Ks!-YCF{#NZ5 z)OPY)z^BLVJo}0LX6KNi`+R4;ruxy=uW#PGvvE|~iW(pPb^rbN7u9mcgq zxVqG~9J>m9U-I{phFWfm|M}b3lMfhbxo)Xr^_;mrZ>eRIl&ZPYcCJWL%h8p()_=QD z=PhdapM@RU?Cjt0Q?=~Ac;V@Nr*rNrUT5`JHE(Zw*!AAebEe;Ww%^WagUa9QpQBQ} z?OOwH9a(j&NMzoR6a4+&`Mun$lM7euR$R$Nl>Fy**W<$%*k-=cEKk$fE!Fak_zM5o zI`Q7@Jr~Z83$OY@UiW2D-?HyLQ}EgAs$P9pyqAw}n07cJdaYWomTLX-zA?Q&uCiup zuFdz4^|XJQkUXOJrTM3lkEmr-%f)@i9=_A($ep;^Dj&Ow(00szyGIh_Sog`6)gAMw#Z?9*1!Fa>c5+7Wq)OM zME&(kj~}Z{t=4Ms?uIAktbf$)(RARYR6Sy-D&=b+nuI-+#>Xy9LYz! zRDEN1XoarVp1DxD(!bTSwe+}2dB-{0%q;q#ddh>(7pd)BEf+@jSTrK2*w>%F|5mAP zRaOmh|6b$WEBWSk3*Yi@m!+C6xP2zRZhN)d^~cvdhzqZ(<0AL*Qyssk<3_c- zG5u`eMunSJnN{lAC(j*R_={>UHST^f_?N%Kqla0@i=7+&(d+KKUMIG_^X$>+dai{X0 zwp)I$`qPBt$9t4gaj4_ef+5-CE|ysIk*crN_47`vtJV(wI^>y#Q`#LE*YVQi1=kN< zU99wavzNNL;^OMv&Rp91MxUZx*Jl4<>$dqDhkSk{C~nGytyNaN5WjD8v9r}vE*9*R z`-3Xg-~ZzLhqrz&*SN!q+Jmmfv_Abpz~4(gE_QH7ry(D7U4L=r_r*eLG#fB^>AAht zJDur2YvZM7Tl|0ef2MU z*E8)$R%nt|{|CoE*Mg&lm+N}iZ_cAf6|NTzx9=JCi~Ze>=l7`K1yugagi z3vP6|n(yb;)naSkdDy&DS#@5hmakkH+T`aCHZD@~y?zX;_Q%-ZKJLdGYP~v+y7+7F z87EH%&T^Mi>uY^qGgpP}>*Kwx-;?@Y`6ln3e%;&p?`(}1UbtH~)Z6;DakDo!sT)w* z+xmMwO8-6O$n`1S)_-@e-I1lKLtDD9caO7OboNajEj#)CvFQ!hyuA48sX+_6{<_oA zZF!OF0VB`kEP2d*eZ5ETom~1uYR5yT*A$*~>F4!XZAbTZ9lG|$2W#p)n5X=4AIDZ1 z*`Hm|sPT38{xtE^d*%OVJL;rbzR}{hwTF(S?~B;+LzA2PqI;=&wJbhmk59_Ob#*o` zEtl<$ZQqu<@@tdtA1^ZEzg)iQKTS^-Xs7fKoLO#M%EtBWuXH}J{#2<0vrZLX&?)%l zkM-4hwN&e89Xb&^Z^9d?-oF1?uIJZXuiqQvu1C%1D4yExf11_(Ov>4Ojg=j>pHbh{ zQtgk__OIlMygzVgs8#UUM&?*t$)&Y<+tLiyr}Q)OEvDP<&im`-^p|8#h(to+k9Bj4_eGhe(6lU znPcYsHnLB*0tpq59v{(uW{n5!3!dFsweH-`hXNn@&O1}E|GT$ZtGv0-!>QvrwS4i% zrv7Ws8!9Nb%ZjgnK#Lm$R(o_+W0sQ5uANaPw3o7pa&S^Hb=vp>9XS8WF>KDFO1(fRhV z8P{H%I=Ns>qe3eN{CFYT>5GSpJsdpYKU>Z&FVb!7jmgc*cj{PUK;?3yKdUnE#+jOp zx|VEl;^dEO{A<6wWBh=x)%u%$Uxt=`wfv%|U4N$UC(DjDzjwT9+htc)lk~aE zm!Hz>cI0nw-wSvvCjT?1E-qMeAaQz|3a4K%%C_3DEO~6Ls+Wr%>ND0jw{zO$ZGe<+I)$Z{6P7AgI~O)2r^MsrB!UoW5@Imlr}F-A)MFIraA* zjw2B_f@7v0aJTne-!307%kG!>LrA5m|BNayPpyBa^^GAP9N6;Cxc+Thr+;!fU-dlY z_r6qY(MhFm>)P{u-~a1KHT7NjufC5sKQlh(-ahe9%HO}0Z+p}BxMaUQF(bR(OPH{` z-K}ztRu5OLi!JP%knmpqxK*`w932=_!~g0p54Yu5^w2jfO7(*lIZu92{IBQI)pylz zYG3Gnq}i8c8Z2r4<(=JCVsEPTANaOkb#2te((1dCpT4qgdi1R>!wMXkF!j^Kj(^Wz z9^9||;5^08j=gzdZ>Pi!D(?6i^S}P{Znd0S-x$64>tBmRT$ugx<(k7*Y;<3*z8^Th zpiYHe7X!Ze{dAGhQ+7@MJ9hk@vI%83rLNo1uh9Yf50#4iaVc+}&M!w#{O)S8JoEOp zd*<6Qq0Jh+>)!8_zUcC`Ha z`{QS}Ji4@|o86n;bH8`mTQc8_kwKH!Y#mps*}`Sp#wFU8lzwL2q_2y-{Yk41=^JuQ zKXGesp*Iiwk+^^V#jPs8O>I>M+b89$qx|3cOOEVGZO)ca-_w#$^dHi%iSAeGySl!i zmP%gnm7i+da9>|z$n-j2FC5o&`I(nDlyA3vj>^x$#NepjwGv(*y!4FEnF-qmEIfW~ z=R*DAJuBpw_h$jKQpC$o2e>)0aq%1 zc`D-W>8F)femfck1V6v)PFMB)MvlUz%0FLnsmkNG&69^58$Z&~v(QhyQoh_(^zNVK zXPg=klTXF9Zk?^-#2w`pu4!1}M%5{8Ual7OO62rw{fEaCx|_ZKhUR}MITin@Q3KDP z32c(;E&fS!bIx3IDb-N^yyd&=+{y)ig>BFI^Zxh8?94EJ z%YAimmsW*mjV{vY(~Cjh&Tjods}=86e|vnn18sWNDf)MbI+Y)6%m3~D>2F>B?UPn1 zsy(ii&H2Tz7mK$kv-Bn1lKm1RFneSfzrlA^NCq77vYkQ#_8+f&!_jT$uYP5M&h**7iwgcm;DP(iJ?5B_`d7bk;vxvy8_o7zs|YyHq{ zVzFq`c*#E__^!V zH~f}v>VH9vpC8m|vb_9rLlfQgf1U8!`CIumr6+FsC}zf)tuLs2b+-TcLXkIDvnlyQBV7l7BRbAL|T(csHyWQ=$`~9@?`{K{sSiC=NcR5Fc zg(HRxEu{P`x_sHat8-tec6#mE%7=CiYOVZIelGnm=+}8OYs9uYf2i)OA)nr!|KaXW z?SJIzT4hS2-;v3O<2xoLOy2+grV-1&+S5BZAT&02yV!N-bH=>!YLSornOZ3C{Lg0B zJ8-mA&d>@?8~+g)lRjd6^|pWQYxPlAZ+V}6dBxT5bLG0I^4{u~+_Rodn_E}K-)?;K zt{tPg|JCzik0Oqmf89A&ZEp5?S4JOS_x0VxnSV1^u2j&J}fqS;LBIvniQ2h zeq@6UKfO{g>h08rF=tA>x;3ekW6~Q7H>LL103cY5q;Jm$=^d^IWBF+mB~I-)5UJvVPN*+28A#Ga+G9uEx(!XmhmO&3Ce$ z%llK<*tXMd4%yq~m4ZFrxEnU^@>>ULZ@D$^*|hOziYyv=aP(*DxFG%D*SB*`$eyo4 z&HhIxbn0G4`L%srpCz9(J2Z3J*n+?IK2&^#@lQ~j4*xteRqb!aCRhC|zWZxc#wDb@ zQ}L%c3wMA2%HWzaYxu3Xm)c=)i>gi6Ma93l$v@)Ep}mi$ZpfYff#Rv-kHm(#YUjIN zF6#4+kq4)3Eb+>`5x-6NWXZ+0oyQHB^~-_|{~vpQ0Ug!zME{~Q1c%`6?iL{-xVyW1 zfB->)ySsaE3Bldn-QC^Y9Rjzjy1LGEdf+?1|6T8{_1?Q@txP6+KD%~zpFTRn@V4*e zi|&UD9!v25ExyUUs(UWYF*{m7snqF?tX+CG{5Xcx+MA{RsBS5iS3c>p_EE3JIo?*Q z7R@WkZ}%}TtEOICYn$2fE|}?lS`SkDlEvLD?MD_e}Kv?K!8+ z8(Yr&=MryI{O0#7&#iv@Ep!C{Hk;@zX#C0&iY zEgt;pkiYY)Gd=?s`whOc4Y^WV8QvF0mP zFJx`T_*LqZO4ehKAEjZ##fq=fy!n_b zHN7Ivp8YN6*j2G=syvn7!ROw{cb&dm{$KM#gIkBKty85-`14@ZzAo?Qy#2a0aNoRx z@5k<$mY~A_zw!U;aq54aZ%?y!*^!{t;kN32gj(Nf|M7TyoW^mA#|)_3?ZmKvbMbbl z`k}EdPCYc$V`z9jb*J4U55_xj@>=0*qYKwr(*6IGzvc11|Cs!r6NayUt+28B)cH%}VauXtX}U3$I$u%0r-XF+ za%{`P0=|V7mw53gR)=2MhQ;4FDvwFKki%Z=|vY+nL0du%I8%p`cL}2^5osl zqn(%(DF(5UMM9O>g0xG#RCjD-W6t9q(`yN5^o+T3&T^6=wzvuL7Ii5GM)P-1S0 zJ&%(on-XWn(mn@2mzk`_tMGu5$GvK0nf4{c@OBgCy*r`y3m0p8$2yQM`cZYhtFHgl z-|9MA{jIJui}{@Yel$wIcj~^%DZffJUX|~BKW~#!cQO`loImlQk{{gj^&Pgb=BNsD z=4T&SxJ07h!5M0ASNGS_4Qdmu>Ea0QzBcyWdTsZ<^IH<%Ti0_#@!(RmHjnu^Kiz~D zXU|=VJ}RWOx?WZJmC9r*bYM}sag&C}i*TfN-(YqB?|S7JjSse66~piDiSFA9goM3X zoaV@cvF8G=X1KlOa@~^2Q*O@JumuKVS5y;1hdp4uih%Y%` z9qtsgadX84HGI{$s{5j990* zvDTl}xJ)m-;bfm&slTiBs*blFQ5vit8fAyy_O54!++AEOf~upA10C;-Sn(&#pi!!h zIu58h;g8da)(?%;eo&RW1#70iGC9ZIXX^ci8%bVo8<*&7`FuU*=KQcE!8G?uX(OFk z6=TKq@zM818~&xg;??^!&6=e<9^~$^#4mqX%Std%XZNIwc2{28G}o}p+fQ9R5$pWd0r_vAi1xJW z$d5SJ#$$_tY;@v-Y9i;;-D$E6su=F|v)i zzB~EJBY`vbeQD5T%!dc7*6mBGj?<+t#J>8m)zlB_xTEf)s=xo&%LpHu7Y zf87tM?fT)E7=gCZwyx@ZgFyq5`aiL^?UOFegQO2?Hh3`n%kVWpv-;Ih^JweX;KI%0 zmM-|{2Wc2k|&jUlsRciIOe*fy; zxJX~mqZ#adyLn9L)i2)P`u+cO`_(wB`+DL3R`XZAFH?SP-5pbQ*9-YHJZn(x5B9uj z{5nTJbGK{W%MYF|@P4wVTWr5w%UZmvzwqrF^*(yT+|fc}?#Zz9>%&(+p1z%Za{1d} zj}$dpzB@UxP0$9P>Z$*htKPSdc_6X>-NaAstL?PHl<9Y~m2bMF$E2V4n?~xCN^PfW zf0XL7H|vW-s-8M;>ltTmffeb$ZB)mP$#oxe37fEK%AXarCl5HDHm*7!-}z?Px~${s z%y-p4Z&B1zO~XgGWkPg^|=Yf#f=j+?u1dTKKOA_X8&9IofF9mf?H1 zb*lKWK=7;folchhSb6ZQ<+bm4FU-z?P5#?I6QsC${LqOAF_Kjp>NBNG>#sqh3za&pUT?6jyNe(?cI;(HY5nmr>e69QwYn%!gTy63-RSk<4&JWlL6SoYk~iK?CI-?M%W4J&@W zZJIplx2mgtt2%0Y7tHD2;{KFzjnud)PW>)hvf%IunZp{X_Nw3Nbsx8rNiY9yz2SP3 z)ZSC=rBB6q^I_PXx4kQ<_RPCAbl=QB%g!oZ{dTqP{-nDqR_i*r^MSzMgS%|+SLJz) z{Pj!DoKt1w*y0Cr)~KH|e1Gy4*d0(}{K#rKw{_^W^H;Vj`^(mS+^f)t-K%_0_1Kty zh)4d@byvC-Ka|mTg&!kD2<8~J$n04 z-=TvV-k$YiQPN0n1~uF5K4){Q7FF9mdb`*&g?;zy2MN9;iM;+wwl&@A*8j4sVEaxB z6aHKq61nyJoUy)@+%u)awQkk3euz1wRI%}Kem>0VzW>Ox&1=gKjxcTNhg2)qHYk_A z(*Cy({KJxTP3ti_YSw~fv$uTHKT_YZ6&no6F!*HOpC^1fHw&5C>;9*;0gdBFsWx}j z?>*C_Y?;~O?0`2Nnnrp$;&=HKAww?L7(C=kfmuWErtjJ^c9Cg+y!Q@YY702EyV$-M z6~c;4oAYkvvgtn?m(Lt=Q=Ih;qh|cvKFKw;UUGP!N%^6`kg?%^@6A}I@Rmw#_}@pz z-4(ZCgiM}u(!I)mcSNy=n-ae2^KNq#&rOB*pDmGhUBqPS^%3biR~nzUU@^5m&QE_b z|4GD^Y0@=5{dQxsSjRHfuYWzmnH87rlsUek|F(-Z(hU=*FTQms^mjsMfzL2Rc@8U!^5gK?Y8o7^(GdNJ#6jH zYkeB8Igq?k>ataS)oWkzP?E;q0=G1|JpW?tF9VB58!&lmqyoKqH!Bh9T`KR1gcBmX zDb)U6qEbUUC5=4&p~`7?CPjge&tumAt$$sjxK#=DIGu3xq&3w7uJS10_`mx1wDxTGIJZ|0 z`>+0~{Jn41FYPzsOqu`cPrRaD1=`i^)$MQn>6qvKy66dKP5E2%S_J6~Acqupu$OIzY>E-3yXO!#@O z`ul0th1xA9_g%Zbb^UI?F0ZWcw|QDT&Y(eYhR&+`U)t^AvH&6Ow5 zM7w<;Dcw7^&lT7bzqmvyxmpH^|C_42KU9IQLvgb|H@+1mS4;oq-CAd;0StUsjhp=v zJk^$5LE`^~YbGW5S`;_CUPgV#4SYulEWkvtoQv46*s$jU5d(8*ntr)hb;I~ zH8;CDxheCi?JVny&g+s37~Lhlh(x%`(CbB7KCErIrjZJaaCPC82N2;~QQYkL zMaST^D}^q6l`hHj1O)$cVK+N`Zw~Z7<|@C-QSdtf9hqq26*qet@d(VuvXKTkGBPW= zc*V_rT?{}B@$Aj@bxq7Hc*V-95hd!a=tdT_HxU^3!=6>z9iremJxCL_L|&VhlsVKU-NgB+N2rH*wnnG_lmwWI$8 zM@Fvql*r@}k1&5Oy-i13ljF9N$^|AhGTErkhHPy-9LG>*rE!5ti_BZ`2wQ%O-62;T z>&SJH4jHvBV0_XV>mt1iOa^3NRzu(2i>?^uSVy)wBQmjRZun%#GS+NQCS)AjlhJ68 zm{Jbw3)*ZlS&(sTkIBIQsO)A}%<02Jnwbo&1&f(+qDO!uBm0#dnceUxeonT0>tuhJ z0~yDDWjFej^Ph~&%7x5%@d(>s*+@y!m}8h58ON+#Mi$IcYa4_ybYx_fn0A8c43FX` ztj3V#j#-lNL}sLTg!bgRe^^W?I9fT*c`sz(Q%gL8yZwP}GfXBg zGQHqY{4}~be5lFzAoK6`_#*S~_T)q6-|g{3=HKnfj|_b47iU_uc zNJey3WW^N>Y-5k}Ur6J~$Tk;8Mzwift1dH&8Er11F~bk7%;Ct$tdhw5JFApd2eL{U zS*0}wvK$$iRR)>aqF->v;5Rn$8na(zk%5^nFk6C%x4xAzvdST&`VQNmBO|lQBNHr& zz#Pg}JzZZjs{%5x_kgS!rBfy-Z)8wg-7v|U_*)yj*OgRHIPx`Tr=XV2-S@?*VGtT7mkc<59|%x?3H0i#1g4a z199?YjgMr+Azv^hpfO^JkzmSilc^(KakHPKI#+WY6q7D|ow~>@5`BlWi#az8C+GEIkHO}BO}MTDKb68BPlQ~w z&W+~CsI0@WQXOh$jA098RGY7?8-2oLT53$-#E_3Bk$+SjB zwHe08WZJmE1pJecWIx7vc#%}b(-tVDDlf$?{b}X)ao>w&@Z@yLmkO<(wM!& zR^@YKWSjBKhp*9mC*R!dm?fDYtb<2qXiw;lBqr0v1*R)9X~iS-CjXUhC(JtCT&UCC zg*vd+xY^;%4YKN9yph_>f>Cm_!=4J(d+a|~wEd6lJD&O2Ka1Dl*t9qL4AF`3>!P=K z#hM#mhqoKp%VAx}I(?A&_ZW)9o~VOI1o5m`Kq;{!v9e^He#qd_Sv(8NA0&1F;hFx( z{5xxa3v~t}1HFU&SQDS+qG?u^oMVHKQQIlZ!+}QM2fI*bh*4*-QD-PJ|6X6ikoh4V zVSV`xSu1u(R-5G*4o3#gC}7!IA$3uc86jSAvnLRb(Dzb_DvmLkks1?oW}{0cGfHFJ zC)O2HGJJbRYfQhXdmoyNh!^ciDjuOd2h-L$Vlrc0V8$T>dueFJk-3GOjE~s;{b$w$ zWO9f{SRM|WdEac$MDdE7{ol+a7nsQ|FjHJ$rn*z=8W}tqif6a(mK5c}*IDBN17}%o zcDND&_r=&ZGMjbQxxlPPMob#)*P75n8O=HyTwpdL(?&ePxx{eyx$n$6n_OTvBU4U1 zLYrO&m7Pg?_{gQ!67_z z5Sf1;FAgCC*96e!(dmmmGwU2irh<5c<;UxOPPPki>LA+uZ|0~A%rO_3<1R2KTwqSR zz?^b{IgLzg@d#sBdxiHta}3WQ1LuCQL><-M$+mn}yy9m6_kQD?3(R>JmMPf>Z zXRaa>O+3Ol-%Jwqo5@^521XLNbH8>wVXh<7T|7d25@n6%q&+u~@eq&Dip%N8h+Sj& z_S{5fv3P_!83SUZFqvD(ycdtKUu{^wTt(S>$NK=ck%=iDp zwAuN2rZ~M2?Qs*2u;eP9eX?2Sk$A<;o&gE*9#GFoJxu1Y3(ON_#7P*grJa!ur#I_7 zb%A+?%)k5f9GQRj>xBzhFI~ubo7uejO& zJ%(bp^`8vPb~n2?uwi?W)ZQ0jW_@sh`RGE{CuCqNiz0q*6`m{(MAmjHx1G<(sO_uO z*texW8Qa$vje&cEj*Q$cz9RGQEU~*0eRs_IYGi%a7|3#DWY!NCvVLlHpkF_XtX~=f zS&od%3UeXrw^j$T!i=mx8UtC5jLd@Fg`54~V+bGp(Z|q+M@7edW(19aEJsFWxw()P zQL6*}l1E_2tVkLIS&od%itIvG6s-Ym;N46&`$+M6BJp#6!tg~V6Aziv;&oVJ z7A}(3v0t)1@sa5&UWaqCUmn4toV9O}Oad2}gvh9ULWg^ewyqB-a?vi6_Jfe)#c8;R2HqnIa+wj;Uo{_ZFwp z;p?Pwfk}-_3sD2kTOPccn%1n7#swxVGU9{}Tan=F+|Fj5bS^OIkr^QBK)=EsCJ@s) ze7`cdz+^Nsz6Ze-M)Z(KQ%7^?7f@*tB|WQixX1UbiTH5m^V7*Ax1iyAOD;xD}9W!CZ1m>cD5 zINASryTIgif$>2`^}YPAM>Wj$__|Ohp9^*Tv^viF4xf^Bv#WhV`A);dMP&GOQ9!HX ze0&PJz!cJ$@a<_CAXbpAFfx6_GuV$OUsk7yV|ye6pXzb5!}bnLq-M><1)|mFUM+=a zD~gPm#CX0sFGXr?`;ttte=_p8QyiIUq7Ec9Oul4`W0qt}AXAH&s26%U*>AwTQa8KU z;o{Qxa)JG3ol?leBc{cntKx#p>X*za?E+KA1*R-A(L|PbV#^U{xH!QNpH={2+bU6Q!Ol4%$ zIRKn%nM@UAAP4HyjC4DZ$yC*tvr%FsG?{7|)7;iMuE|u_nC}sm#xt238j~;fu%sqa zQ)5EhYb0}IwCR1NyU<^&BfyTfXnoL8DfiX0hMj8WS=*Y-1Y>W&XlVPd1>~>DaF_cUb zWQL2^VNR!se4?JoG(|?udFS_Jnz_I#*b-|7UG; zhjl93+|q?Q{zjdaMx9p3z_|@9*E4n(mm}63lUc1@VA{CA1h~Mob%AN;0@L0FCeQ_@ z12SpE*uc7PR{oxo`)nOuU^*e=Cu+bscHVC9TbbkB8JQ>Ibyx$FyvBu?Ob{~fiD|mM zUjvirf=qj2X0~~=&1AZ|z;r|AoTvlaPx9uq%9wS!BQr<54&!tD#ust3C;a^BfsDAw z!M$X}m;o*@16^PSxxfr|ff?cgGZdM3Vi41bzE^(JP~4&r zlJ?o%VaTZC4t&;esKfq8?(2qY4BVeLnGqTT_vcM!q{hJK>r7^p#=z&XO=k2z8M!|k zgA8nma8IUDtj%JMi9fWykJak*e%)^A7^CmwGzQLXOlG{sK;KPf0x~H@3&ay!fv^+5 z92wc>iO9ef4d;lP)2zI2&eciCz}<<+f{C}Fe@&B_jEuMmg>!yflHB4@CM2!zQ;<>X z9oFe&qwiBS2Kw&E$Tm-NA#1u;2ePIaSu->SvK$$i6^sn*Tj02yf94n`*VHqS5f=>D zcklJD#QD6Cw7$>MvYk-yutG%L_H8Lg=~H zCbI|`agu=vS%)R}HklBuPWUX@=EcYy5(iT_XI;Ezz1R&2No#YcR;NL%O;HycZC;`= zo^MvAHkqXw1KXgyhPN{tD6bhV3FXB9GPpK$u= z)C-P`9K+SfsP*16^z{aF4A*E`ur5{`W4KmhV7;5nI%FKzyUDEA>V(gdZQg)PRWXKe z%spFq{1S5?wGo+W#I*G+Hp^r-ArnI|uskSH%fnXbE}qzmc@Gq~#vxU1gR(tv zh3jUAV<0f8H&y&-GFy>>^FCNSH^pskGTV?57s*(sbo=At&B^dt+mWd)7&v#ylm7T( zli7jHYGS584t!@aJCX4h3@j0zy{}_3yENv+pN_#Mvm2RMqK0^4d(yY_b(7hHOj%+k zKgc6)hlKCfUS!G>lVioU3MR7;8Mxm9S-}%-IO*4ZWd7Zr1IYZlJqMBbcY6*Y^Y8W? zM&{q^{RlE@JDqjXTkIafkIzwLW>VijEjl8Ox#5{($W$a|WXE$(>KsQVsbFB4xca1% zZRZ3sMI>Si$alS+nRODGV&YNUkg%Pa6sp~?lgENn$f)B59OF(J`;F7chzl58r?X4v z?&8SE?dyySS!a!`Ge*`qBg>JIS?7@n5EnZcMVmrne;6!V=6KA#pk+OJy}#XgBkQ8Z zz&U`)T+$dgUYN{fjk&$*$N-bMqA||1u4>G-;f0@=b*^cQ^E%fx=FHLdQ_VUzG$v!| z`fE()rpCa(Q!trZ$iT5(Jh7Dz8au*~k?ZR=GJVABuuR#T=b7XBlFS`sqDsV8y3e#b z=6t@3Om^`I=RXBv#Mkas$~yOuf!ATV`+RN!v(9~F#Pq@C@wbhAP38eI;!Q#9SJ>eV zPUhG{WYo3;$I}N6b4<495i&6Ip-mfR4BhIOCAY!H$f#rPjD@kEJTmG$K}NOtbx_+) zj&)?#Q)KRo9N6pZSTjPL{tHPv*LsGGYBS8Arw&=NJ|Qzx;drKQ1sZ z7;bho&fC`wx@7jtj*Mf!Y!P4!a6Dg)fJ_;Y2y-K9z3T2}9XG8Gd!TLf((8dO|*GR-sobSVKg1rX;iHav^k2==4cuNZ8n+c8UyWd zWMq3{Xze*UHI+Dh3*R327o+-Tv0@nQan~4VkIBT+7-)|pBij>OYtM|_ODCA^iKEql z@riA;C$7dodrT&t#z1=<8QGrrT6^L|DII9GCxKQ6+7sVsPeP4>_Lxi}je+(!GO|61 zwf00CwBN~fZW65yv?sCAo}?NB?J=2T8UyWdWMq4iYwdaA`|Z3rJ}I<1(4OQ*ds1o) zw8vypX$-W-k&*35jf~nSe9j)y%4|;>tq!y&wb7om8UyVynRG5N=`{x0>{v&(IRi40 z#a;lGchR$+Hut?5HKyaiY4=Pf6Eb)=Qqc_6TH9cg$)aUBZ%5m12{5r zUF1ea9h;n=)8;Yi9eK?4(->&8BO}K!KQihX|4!|0LFW7^ z-~v++8F=>r7N6^5H=1<{Ap_eEEVW)#n`<(KUC1ip0#g*3|j^E=p<)tS^%(r7;zk6yI(#r8OpC z`2LC}Q$}M>M_CldWZ+wLtn&@$?J4I1Q(j}7x2J-}#3{b5rrDl~8sof9C5>@j2fqEr z>X-96RWxSP!JARd_Egmv=VMq+W1Np+b&Y}V2{f~6XpHkV*VGuew`10+r7`X!(?&Fz z+8X1$&2=;e-uE=?)YTa0b?Ujm)YlkzAJ)ujpfPa&$7C96O!zj-eO)7DE{N?IHhB+^ z0h`Tjxv^FU#<`KPEjQ5^=({5$vzj84TU;%Pn*_Gl{mODao(Qx zE---_7y|v*ZvMP>-0rN-GAP_q~>Rn>8CMImoEr2nf@A+ zImf7kCNlt;__QCJ8dAH0$qdvO-?U4Qo6I1MnX=%}G?N*Oj5@c0eXk=U_jN;%QTJe- ze}C^#7notlsQa1DKPNog1!e>?>fY(=4rjzJANKf;_q9f9%#6A|-A!f`GMR-H`WD)6 zwfNYYkhJ?qqmfbf%-wRY={Cw?A1=pd3^M=j*H{;rame_J7QmA4x5qxm_Qz;)5@^ydPS0xS2H>nP$WU?P(-#*$PQp7gLZ?^LgBy zi)Bn^Dl$#Px`1uWZ|=#)j*PtCnTCv-t8l$D)nQ#oX1d0}KEY&WXbim9=E%r#4n{^? zoiWb{;|o-M&=?hVYZnABqIcyxD`Z8 z8XQ;g@AZ{nQ_2fN`JpMz#CN9$bXAgaMH6E!7o{XMlq`k<@A6u%Rzd#$>TjD()v2d3 z@On=}2{x2%h63*g%SBa&cd%gTVN*(EF?O)LU?mMHQz9s)C@H>nrN9}UT+-MA>{Y}~ zagI_i*kDf$OAuF{Pl}ga)!C!fso}KFZDP7|od~q6c*06%Qo68GgA{Mh>PHHUbAY{` z)2yY$bYRz6Qo3{HXQVu3MSawva1&<54rM8QYtWW zg_M4*yd`A=D=9=CELFKqJ5q|<)w*~<%6ew9(JpWzGebz}#mWs*HnI{8-na zloEE8b%~S>%%rBblqWIMmz3VDTp^_|yYh&;i?H-#r79_JS!qv7A66!iQoyd-vyK!w zH+nc-JLicRz;!;7@{X0b(XlzU{;c?rQjoLiks`DDInCbNX3Q zHgS5=7_x;YSgA+KaaN|1@{N^aq|`0Da3UnEJIl-N=hNS%4$xE%$nphYbY_D*tOchB}e`wDZiQdPRcJ5-mQh=3V zq?~4D9Vt**_C1<78-Zm8D_uxA$jWI_F0=BKlv=Drk0(pkY2r1QBc}2+B*WH#4^#>IB%gI9-Fk9T>STawK+aPm?nKU0ZZlCnYe3O)51H>e{hK3rV3;vt#>? zJ^X_-rCX;?no_5Qa0NEE7DfyTgN{ZZePC6a=CB(epI=dZQa$P(zlqB>P!83Mwk>bPY zHAs=^7o4VdA*Ld`){?TBD<3CiH#4tE*~3cmWHwy(vr>eV1FQs+a+s9~q#R*o7b#m= zxkt)2R$?c&;gXq^T%^dJ-gVm3O2ic7eoZE&7S}mT$`)o`D1{mK6c}#X%u0SzcCr#c z$}U!BlCqDLeWdJVuwsW3Br4dtn!l+O^}wcJq3W|Yi6 zu6&M^9^As5nItoql`*8$W!Gj>vN3au6zD~OJ#l1b*Mn}EW#yY(CnG6V-zOT%TSFP2 zMbIvl>V$_$SPg?*|mz4bFADXr7OE)Ws|M}tQ05Z0J|b(mrOHOa+8vs zUA0M(MZ{Sjj|69abukVy%l%Qcf^) zg_KjQM9L*ATdtypQk#@qcC}q}Cgm#EnMBGBR<@ARl$A%M3}+=}Zkc|Rm0F}E<*X^B z$dNDTbmY$y)1K?RBc&}XY4XUdTdWizWe#UGCuJThGf5d4LG}F@DessGBjq+Lg*|Mz zj9}LQQf#cOCFM1{u8{JDm8_n!PHuMfBgKoAb)&g76qI#xFyl>%+)@IZZYgz%iOa4nq{L<=aUoeb7AyTp ziNnfcQh=2Ex<8uIq*d2|Kz|>aFRG_W3Ii|x_blE9E0Z#n`!$-BRCeV$Op5GRH>drw z6~V%`Ra`kgDJ{89Pg2gXvWt{7to$TJX7zEJmA|MBmr9&9mXtND+#zKhE6IvUS2Mfn zSAA0YvNDI1j653mNXg1d#^SQha8}xqGLe-vq>N|f4Jk8O@hu_i%w}aEDFs-$LrM`= z3YC_k*;E_oFpZPTbQz}WHPbRi4@u9nUS5HBON3r9lMg1lXawPj#F1>ViK_H z5GgTP$y#34iN&LFi~>r7x}Gbyd? zYDUGXBblwt)Fma1mBXY=X5}j>0bHkGU0G)bGeM;MVC5z$lURvSPrBN0oyw$aXJ#-d z(U@_oFJ04_DMCshGvi6w!^{~{+?c7=K-QVc%v4g^G4q6!UCd-{C|x#Yc9AlL8G9qi zv}L9qDLa{2L`r04@-~*PY0UH{r9CqjNZHLy@+Q*tm6gS$Ol0K|DXqDVZ&T^o#!Mel z4zaSFl;f=2CFLY5iJHkeu&ft8-56lCQMDUVq3>LOhOS?NW}dseoQGLx0pq?F@+W$h~Klx9VJmL@qX zA;icL^L096w~3j>SuwlG%H_FEaZ<{#(wCGJtgItNW)*Up^@y0goRy@z%!<#-Hc~uT znb<=ziC8JrQz{8rnMX=6D>q3g%PmaZOS($2(wdZHtSl!*_M)uQUc4m6o3q~bmX#N> zGNX@F^0G3apHvpHvcA7myjaOOP$~;pi91Lto~(=;ES34JbRHs=xvbnJWezK|hDv5O zE5AsI%gUT#l8MJkp5anSz{(y{in20%gk)l~a*UMhtaKeInOv+~8YPvCtlStal~k-m z9V3;rti&2Cm6WU$BqfxU$)qf1CC)hM3Sp%wDREfYOv*S`nvIvP@vMxPAeFJKbet%a zG^~V>GKQ5glO&UxmA#~tWF_)s$@s7`Zi-ZVSxGQWDt@dao*|WdtYiw7$|zRGkusVU zkC~Dg$;uW|MzB&~mSpC!vXhi0tR$N)nS^$A2GW9*#H<`7B@rvJ=15l(Ryvc?LMU$d z;%-v>S&1l9(-8Yxj(DLY>>F<99`N@7-m z7Dy%?DnQyGD zBjqP6SyoEsH!F)tvD?*JF1<=J5m~uKN)%T5ua-=7R${G@N+nk6ky4wLP*R4m@}88j ztTbF}!(|F9Gf0`v${A8-u@Y$=nrw4f@g-#eD+5UhWyNc~4VN{n^daRGE2l^~%S!4E zXtG^kWicraS&6z)GS66PLdqLfrjhcAmDHQ0>nkgRNcqXi9#ZTP)cOh|#f_C7n`ND- ztb8XWCMzAcNG1*|S4c^~O0lhyNy5rOQc|$uwM{Z{D zS;@9Tx_nsiCnX;%H%TeMO4*&#)tHr)q%>pYCn?idDZNX&DzdVPl(wuy+AWzjyzLYr zr4lo%NomK*Z&Fs;)%x17N7kv#Oq#t?Y0pY$QUW+@B`H;yNxDzE0$FKGN>x^_kB!16QmV63`+#(HVr3~Q*X^obIS)#v1~aos>CDP2Qf{y-=#X^PWab_z zL9BQjmds6dZ6&1(Gf|I7CJB$&AyU$_a{Z`eGPCmLm{fAIvi!JI^01QRq*O|<(w>yk ztQ;Vv94iG*NmoTyW|C5cl^>+kWM#`~>8j7lTT)uElI4tKdb1Kp${ki_lk$a?B4?%R zJ1bX7`Nc|=bCUVP%1Kfp*wtDNJTI9@thil}N>o-tNr}Nq-iwlPXJt7l!&&)E$~ab< zUXre}hG z&q>L}GqdY8>GEUc1t}$2sdHU2O<37MN^@4C-;m5`R+f-*i_>%5luRvVW|7jBm6xQf zV%Pjz(p8%o_uEqG#!6#S>acQ(l1}G7VViKuSwimXdOpmCK}5wyPPQ=7FqJhn4oEj9_IODT`RKKa{Se ztZX7>9V@>`xx~t#N7D6}mCd9?BY(hQUZD8?~~GinJO=2orbLJCZ#tk zv0h514=YVb>C4JGQu?uCe$yP9>Oq|{~QJt-quDfC{t#Em@gG$_!Q>lQMu6 zpRdw2kd+an3}WRPDT7(b`c1l$@w#|SN>)~We3wikR=j>lr4=jfN$JGOV^XTx)jG}d zQ@ZN0(wCG`tQ;dHGPkh!FX>9p$~scYu#z%NGXAUtl9HU;ll8Y`vawS5k5n47(u0(0 zcGczsq||36md%c~(X7-bWdbXQNm<59PrGzoW+jZ2R@~-F5hRm>+Y`-AD%IIllavOm zEFfh$D>WiY*A-T-ky4hkN=1@PYgVR_QiEOhNNLDQj>ytgj$JcJX~W8MQkvM*7^aIt zS*$c5r6yNiLP{f6K9F*il^#)Lo${RZh?Et~%!nqLYpkS*E|m)G8bwL~E7wV}i55n% z!Sc#b{uoM}7_zeE%BU%U{(&tz^}=%E0V)e6uw!?Bl1S;|-_?=n(lw~Pe+Ne;L&eHI z>hB)nNo1Q)JUmJA6^%f}PccEv_>$zM7!Pk!x+um|)$vx07a(cGPY0zalcjK0H^IsF zsI0uo#dSI=h3l|_Ok7c;pTV$#ZLTVq4T|wlS*+xRUhES;z+rpxsv%>=BcFJ!n)oTM z>UesHzhGe{A1K|#>k}1|Pt{??6FT2n{Pa?cml{J>u+5OQQ8C9v-4& zTf|=#ErmK}DQaD8R&~IH%N}+q<$zLnKUNAo0#ZNIqDXNsbz=VpQo~)?hV1>7xA&ODmvazB*R&Bd3YGDhx zr~8zW7YZE}KRr|(J`S?NS%VeBS*&}!%CIVM$);Sqm$)f(Y!7bT?ZsbR6vO*N zRye)CVmO@@?$>^!a#!Wz%B*nZ0gB^LD;~Zy6|O0U_mC$H<&;vmJ-JkS{8U$OD2B&pI4jU* zSYUq0`GZ3y{z|Iqc;=znuojU~Q`Od1DY!LF5`W!7MLgIFiSu4}@%x?)&iUc&)W-vK z#R$bqHF}Q9;?bC=l)S1J@GVA|&dNK3xos%${YdEYRy~E2dD#oKdB0XJTszRhFNTs^ zxwsB|lPcEn#1$`GAC-%h9ExGr55@3a>#0&aeDe6%;M+IhdpNPO7%@52tay710sa?` z^UCFoo3}`3#UpPXFB^OtUsJA=7uS!2;+02CyLV!S4^?%%)Yi?4AIyYy;`P;v@l$iv zQWP`aU|8X;0KSt@t_!tJA1IeEOilP7s}@@d%`#RzJZSzzP<8y&{28NM%%oO~uWECA zLy2uD$qgljp+qs1#7g1$4Bw8c_tZlv+@6`L%{&vP8Omg(_^R3KtLmt(+j1xd&wo0J zbq41OxW(ZxryvE}gFB=wjtXuB0D=n{9I&E}3a*KYjtZvNbyRTrz*PcVz3Azn=;^F* zIxC#c3a7Ke>8yCbnQ%)=$1F8j#J@12bUaoz5p99**Fwfe4I(SFz1eK3RGYCf^t7c? zykHuxV?{i%wW58Uzn%7Vcn$!sunXG*d(bng4(^}f96>5Tuc12U>{Q1OJMZY?bDK1( z4qiKy6@98CIJpMZ_Qi_osBMj6_?i)VB1cTQ;Ct0j;k_1oyO&hd(E+}v3l+X5%AnfA zE!?Ck<2CFp@p@+E%BQke;iFX{#o)EDC}D%|E|%#qIo^w(AeEID);lb$a8ENShLv1VJUFheOA2wh#9=aAkr-bPII%1*Y7f;&ciK59e3^vryN5y z8ab7Vk3{j5f=4|#x_(kFJQEgwSc;0WO;C)Ns@zJ|;p>a7is8y|dlcKlm097+lNH02 z1B}W$6vLI_N?WhY3Rj+_7_QvLsJvY6KaG%F~sLD+ekUkH#LwaAh~e@My5Y zm8U8fS8k_VTzQvbxUx+#T$vTFJVm*rmD?*9SKh4{ zuKbl1wK=iEl_x5OE4MZ(Z&M7P(;hdJlS=VWyW=QIVb@`$@P2+dD{7yaQl;bd@@(-} z8O5lRCQIS{d~@aE{k&9!)%J__&n@iX_w(%H{rpK)hxhYRfjY&-P6f`5Ppdk-pJx~E zqf)Cnyf-c{oVb?Ns<5qAiU$l3+&O^n^F+qOlXf?(@ScAyyTncl7x>mqba|`&Jbd?~ zRMegXzQqw0-t(tdE#x+DRF(1GDU{BnT)dx$Z_&p(yq_P`di}ATGlBFVK+jv?#?lxM>;*1(}#fU2xo`=VTDtm!| zczCQ7HF@#d^eKy=4~oGS+C_RnrFeLW_S|Cy3}2}|MYuiQbSBI$wE}IAxQ^Ni2C|~o zARIxlJv?G?r&w1~D22~XAyW1NR_Y}2dLm1qd{#Um9k%s^is7qlRyaMG%2M63K}#_! zuj&|_xT4~vj`)j|0=I;5f!{i_Kq-887tW(~X1-E}3V7quPnr#buhT z!)w`6)b(<9#rTRieMuR&-SD!kso zjS9~Vm|3Xs)z%VJa`kN4tZOszR4jAE_Ty%cD*v#BEW7@xhbgm^F`GV9I#9UPfR1AJgEkW8^|c%YyGumH&4GWKBH0 zt)1n1OD<%ztOZ8Dg1BD^W66FYqh&4BvOG&SzhJovlM5LwYZ1GkC(ti1?pG^vA){r5 zuuJvJa*ZPwGFsMRqhDRPUmMAVjFuIuWkJ6z*HdyKqh&2&m+F@{_bVA(P>KZ^Eo&*e zRKF}&MRFmdWi8YCHEC_zc^x>bAGwgxvX*OEwVQYUZn;*I3mGkIg_Z?#z8jC>Epj2F zWv$e*U<@r+#5i&^kkPVMu}h6%UhY?Rav`H-t!9@RL(5f-T*zoyYqWmB7!@S%UY*po%cH&yB}xmCKobV)_N^#vq#)@mg^3=kkPU>XjvWuM*42x ztl#89M$6i$WgYpLsg~vPf*r3|kkPU>p(_EtYO{@vUHWNNo*S*ng^ZT9S z+Cwg6w5%;gzlw9e62RrGSdh`OwrW{*KaQPgxu%c{87*s@)~|Wmow;#lUjFz?IIU4TGqaQ^ea^&nT3p&wO`BnzHP#FD{CORkkPUZpi7+t3~3Q-S1+C$ z56Fd#mUU3eiZ$s+Q_EE>v1}nSTGk;g3%2EroHd_Z$Y@!IwJezPmg@?+kkPV^peqGT z9I=$!aCmt&-j-t~ku5|<%Q~uMB}rOmfaPjIE@ZT_|$> zRS4cz5(_d~)(LdMJcOmn@5z-Wan?R^A){rT)Uu9eS~9|NWrPb0u^^*moznURbE7wB zjUpE^TGnYT>-F?*Z!FhKav`H-oiVcd^7^U>7hYmPM$0;@Wx?FATx-aMjFxrI$m+*g zvEhSPF#?W%*A{R1R z)-^2)#;`wU)gc!$S{B@`u&y0o3@z7Cav`H--C!5=0LHK&kKsCUA){s8WS1I4%XO1n z$Y@!&w0^-Dp5UxV@Yaf0kkPVkYgy-uy>4i^Dv=8rE$a@tGKh-eiLK!F3hg@Z7)~V@ zGFsMMEvr?;Jo_wHWVq!f7G$)nd+3TLUW2TiX|noRt{&t3Q92Ba=j!M zGMeiFw@?^u<+E?uYPtO3%^$HKqq!bxE?CQ*c{Hw*3mI)R91*?8!T63xSb{z zWVEcu?1I-J%ahl#C%KT(vYxO@%_z&&h+N2MSx?agXRy$k%N4&(9LD_`K`vyptY=!* z;HWD*Sgsx9LPpDa&Mwujp`7)KT*zoyFW3eBy8Gi{6U&tZ-g*)XGFsM4cERf~hJ|Kyo3YWxYn1IwM-&a`%-^oHdM?OJvg`N z+MI6OuRG*IM$7uaE|?p(Y@b?KE?;=FS1ibASwGPQ`wehiD%oX;<(fb)WVEbbT2|KT zX<}Kf=j1|0%L+r6x@vp1FXV>hDgkfGhy@uf>$jFQrPhEj%Qcr=$Y@!A(51FzxKlBZ z$M7q;kkPVW5Ueu?xKm-ds=-GrVF5K}O4pgf7RUx#emMA88Z| zGMXzgy4=NU(8BUR!meAcgxRGF8O;?1UGP38EdFWN{<2&b$c2pNipu>0*QUiC2X*JQ zJSvCGLPi^nXzUVCY*mUh@U~n9a!MC6T2^#)@s@IC&t}W@id@KOSuwP%YyorkTdw)J zWEL`7R!nrMEhXe~%yE{hdT!}LM$2;7vNrszS<-Sv$|GIKXj!q)rDiW|DT8cYUd%dkkPW@Xj!nO9O2oU(o?#S(X!%dS*zluxo)}YlM5LwD;~Pk`r5js z@f6E7om|LhS@E^3Z#ACBw_KOVg^ZS!09|T*75&zuspX32CHsYpmX%P;YLLqJmgTBS zE@W)Ex_4~fwK;q`O1!IxF4(qUc{}6zE9q(?n821&MMi63V$K2r&ZDyOS{_eX$Y?E0 z!Y=W|Hloo8yXD$SE@ZTIs<#|NWVEd0M%GfE zQF+LPjFy!`%i8S!y@%zhPA+7$tdvI9GS2EkE@ZT37$dLj zFEUzI20cr>^JuxUkqa3uE2EYL^U#O;RhC@HXjz%`EYUB^)rnllXjz%jrLM9QmHs)i zB4^DY7cyE_7Au=ubLBvn+5`MN-fp|)`a&*bw9&|kF7^I0yeDP3%K6HE zA){sG(z0MJZ{`^_n_S3fS-G{WBiAqZSgzgVLPpEV!!8(*fvF9CKobVRsk&w#?W%*%`Zm-87-?Iy43cC z=TSU{?a76VmQ_g0`jKJJ(6QbtRSb*!*dhs|UG|(Ojj`1)tV~ zC3uI({wk|MkRjdtn(-qQ$43?Ak{zWVEarTGrh)F@i1ES8^ev zWz{sYc5znDqH+w8(Xwh8S(eM6T*zoywb=#zf^&eqoHd7B$Y@!0*d?Ce@yl{uAr~@Q zR$X*C9=|MC>|(NC$Y@#hw5&U~u9vo4<;jJNmQ^2Jj>j*{HH=)yXju)ktOcR{ms_rV zgo zoLtCgSxwR9IEI$%5xJ1jvYKgGFou>ZbqU!oWVEd2=u-PA_)Nty9>ee=6N4JQ{eT2@PT!TLJ>`2E_WoVA`@$Y@#q>=I9GtMXmiVY!}>3mGk|6}sRKC%DGc z7~0x$r79^$0~sx=wU+hi?$l7rRhwMMXjyI0rPf!`3q#y2*LZRvqh$qXSsCK{ZMR%U z$c2oS)t0lM51YGGD7>A=@He@T(X!fUS;c;on_{_gl#-)?jF#0NU2tv##EM7N6Yt=x zdgMYz%L>%8`qel+%yLa37cyE_2hI{tY-yX!-DJ5=kqa3utD}~cXjrDrmMcnW*)L?Y ztWM}s>ub{XSp_XuadIJ}Wp&oF)-Q^d&2sf47cyE_5W7UT@LV(tkKs0QA){q=VV8Jf z8}(#V1j}`gT*zoyUD2iP>X*$}ZgDR@2Z&Nejs`MXRyQpxSF$l%EmtXWA){q=N0;N- zm*pBvE@U)U4|Ku(d1y_?^}B9bt^?#kMsxLKmoV8T*zoy z{n!Or%{KOa7tC1^%gNC|M$78YF35sU+*z({QPUJ#H%Nm3(Sg+8BNTiXrlWi^7ClSA{R2+XpBOa z8V&dyk>%P)E@ZT<(dbg6u`B(~rc&t%bKcXLBA~5VR9j(WldujtY-L}Lr>27N-kuytm*6$Pw*N900A%L>-A>_HdqSgwYZWfn48)=YG%vlO_SYPl|v3mGkImX_6R)PNF} zt6~+Ig^ZRp8(ofbeh81@A#x$3WzEsD;N4rxRj{heLPpD)%Pv@7a9qC5$CQoaLPpD) z$1d^226Mx5-6j_@TGo7YseZv-k$s#MxteStGFsLGEo)x?Ep05*DWi3aSI$M67==-<2JU6Pfzq4TF%u4m*zMsux3S6rA)V(A^*@2=%aS6lWA8O^nZ`vor8 zDzov(*CrP-+Gwn0mw1Bj>|3s3)cJWo^>3VD|RstUlyIM$6i)Wx?#V zTwBS7jFz=U%Yr@IejdXQYesfUac10ZX%-iK|(z7UV)ka~bP8N(Z|h}D@tSOLPpCvre*c-yX%zYnoKTaw5;P=R`8caBP>_SCNc{d zE$f7q6*q5$u9j;VxscJaPNGYl15BR&vYX}dYAUmk(XviyS-~?dEU{dB$c2oSby~}c zeKbc+%T=zK%tA)XI-_NI^}OE1a$O=9GTJAd&Y}ypNLV88IaFV|96uk0jMl<)oCPj8 z)4Rkos!4O%LS(cSo@bYMf@gY`YZJMU(XuX}OU)=a)3aPrTgWVAw5*F-*37c@ZkDSt zxscJaE}=`UWjNEbT${*+jFxp-%gVYpQgO=_y`^j+GFsLZbgAPq?0c{A7&avrGFsME zEh~HSDyc2kP;w!oWnDv;8pG0!3m>ywOUZ?dmUUgrDq3ybBFlA(T*zoyH?*t-ZC9MUg;qqXpX)I3btHD$%TxT^+?NtPX$}9-sD0? z%X*A1wU*&i!Iojkpv!UOrOR>TkJ1)YuUdI*KL%LT}Q+at+A^0wIYh6a~9r2OBo*VlRjy*n95{d&Po^ zy`#Q`$;w%&?v9Jlow@Q zs6&~8MtS`QRG4|8E@cWD<@LAnqRb2RK2y-B%xA4_W^2|6GjFLd^U$aW*8t@*-|mZb zPH5rx<(U*Z3QC{nSa$9-d6{mL>s`F%9FKCq4y2|VQM+@5vbu3fRD6jQExvjia*&%sC zJ;4+-%4>b))%L}ACkeGlxs4DS<+XwGnzX$0u|f@F3L53Lq4L`A?Z>tj>Jp})Q7vjC zP_9MYws7ryONA{88WrKjpxjl?b6XFXQResMkJ$?v72zf-!d5>|t`=&83Y!gRlvguQ z;hcj|`!NNLqBaFZZJx^A^OT!z6>1by&?ss%P}FkibL8~JVxVx z^M$&QDQFb6Cn(ngv>dzQa-p7O3L2Hey%g2&{B_z|D$F4?%4=^>lnwgOy5-A!4u4}W zXjBgO@f1b5eEPY23)QK{W*!>l)f$xR0hV-|lPy#&Q_v`{eU;Y_+fKhosKrb{qrBRH zawCUL&wcD%p?+ox8s)X0@_PB^r#2I+L#?eBG%E8spxpL4dc&Xhw^W#UXjFu`-pghF zlr`OcQ_Eh^s0iD73V!B3M4@hG3L53r4wTFMu)?exh5DE&Xp~ob<#p`ykK8QOc2jIN zpiy2OK)KAXJg?u5LJeUG8s*hddA-zjbdFG`F$Imvd?!%m2R>a3Uw+0?VdkMx5q9=o zF7w~{Hvb5FL8Bt<;whJTq5ftH8s)V=s4(+F9Wd4A5E|umfbycu3pJf7Xp~o1P+{hU zTEY}G%IiSoMVS}sXQrT0nLh}W`QbBfsW9`>2%%A4-9d$!7itt!&?v7S%8N2D)KyGDqcUFz z%KY$|w^W#UXjFtfy_d`UY~S0gWG`q`guOiFGA~qzqii;yQC_`4g_##>CR5NTuRh9) zGB4DVOhKc(`hp5GFVyBo+X$giUj398WnQR5n1V)SzCS4Q!)M-7VdkMx5e@+5&QsRk z?#9EieC8Lh7c?rufhxkQPJH`rq26N(8s#+zR5(fzYRefm8_+0fFsN{pBGf>ppi$Jp zpwKQ%KE~fyaF0-DF$Imv;Sfd5YF9PEQeh6EQC>qqxg6fLaPb>o`+nmo_JT&`a2O~z z(tG>mSI-mbSEis*Uc*6!ITUKQnKp;eC~5>KcUR_)iP)7fQ8^q1%4PnZ8%kcXRG33(l-FobE{EUme@5OfK8Fvm7c?q|V?enaQaco?#W6M; z&?v7%K!rIJs+uWi6m=*l*ADM3t~gAnmzaV^QHOzY+4y?ct@%Q=JJv=BjmqKSipqO% zpVuuF<`5d?6$2IKa6i8<&t)%YR1S{-73NT=l}tgSyox}DITWhbakgI2C~7RIFo!}d zUG%APVK)D>&T+Vv#s1&yLAK)L?#)cIEw3w0|~(5M_%f^zq^zxLK$WtIwa z2#xYO5>zV_oy%cs-wxZIY$Jq5<**7=m_wnKFa?eBssMo z1&yL=L4`RKs{d^31&zw#6i{IfEfwYv8s#+=RJbp%^6l^y_JT&`a2hC=L)w>xTK^Oq zAvDTsI;b#*LLJByG>SS3RJbn-Rm&7KiaHupxGxKJ2UF0f9L`V_?aP)5a|n&{nhDCS zTORRF_0rFM4!>eAXjBf50p)V|_ijfG66%0cZ4RMPUdMt8b12klOhKcl<3PD~c*ZqZ z9}D#^Q_v{tcu=k#-cgXhy-@8>vk^k0a(IHGN;W<26HA3TghqLt2r7s7<+G1FA=b_B z%d^-E8kNJ7K)D=_&cE~Ug}R$5 zXcRRY)M!J{=li7xA1>4$XIL+2R1Qx8HO4|&V+w!S%2Http;2C^f^s?BE4J00FZ*^l zhrOUtIXn%N%VDSU=3gq*CTH3Rp;2C^g9>vf)M-pXqo^}L4Kwwkadx+RTPzT2!?Uax zG>SSC6ulpcJ_lbgW-X!SG6jvw;aQ4WT5!YxmI`wSjq;iUYER=s$CL#x{ND8l-wrpM zVE}jbP5$u3)Z`0s!*etf<{pn zfudfNJ{!z?bc9d~n1V*-@M2#tqV{?Dhy|7ka|n&{x&)Lvru?$ms?%=qIb6wJ(5M{F z_g-}58@=S0eT3Tg9GeYjl-H%8!W;@UnJH)#br~qyE9nSvW$`8l3bl|aXcTohC^t&E zbG><+3-vow&?xE(P;~u^KJ?rkp}L-H>jjO<#+9I4i+Xudi#(yuURqOJoKZZDx$G6jvIt_KxvFQIbIxAlTXW#a}=;r0^hc&4CH+v`S9;r6mr zxV@lJ5#9vKjeFPKV{X-9zMp@Yy`WJM-mD@lIjjPSx&>6Yy@Wc2DQFaR zD=0S~)#tV+J`(CPrl3*OZJ^w^_r(WVe<)Pn3v7hYs2nZ?4rt!YQeh6EQC_!$ zayg{=sE>V{zn;CIQ8`=$%57zuj}mH~3vGnZD6cy}g*gTdb%H@#eqlDV+A{!wzDu;I|isn)*73L5c<+TJQmOU}8*=kO%L8GX9LAky1 z;WuX8Ak=~LEd`CD?gJI}8$x}>6f`Ou_k(iTpywY7b={@b3mWD1KpL;HmstuL<@KQQ znmN78XX3Tv<(7g*wT*{BwKDmmPumf*_On#jHlR@vJ`BnoQ?CB}yARj&ebgK51&xaE z5fx$nL;Ia9RNpIXgwQCjM?r;cL#X?hf<{q~fpX`S=WaJ`kWjf-S}$l6^|<$#hfjcVYkSr&8vCZD!W=@Qyq*Nr%J|U!)#`{gLr(Ym*Unej2%%9qd|<}r5$YbMpi$Iwpu+u2s8-ilFKARYo(JW!LHn0b=Q0J2+Fmbs%2X@srzKf$TPoaM z(5MJs1QoXVoqU^LXMv3n8WrJ7-ivx|YV$&sF$InCdKpyM=7oBNDQFb+3aGHn3w6M? zHbQ6=^{V%xY*3pQ>PDuZQ8|1KRM_S%73L5c<@Gu!m%{~}zL?eA=dk&8HbQ7r4wr#) zTbZ6ZCDc@=piy3L_2ZnP0Xqo@x+g*g=J5~iS0Is6b*m_tj2IfO=eeFQ4Z;r2dIJ5tQPd}(!W;_KIbHvQPh{9!W;@!e5;KR z8by5tD$Jo!Z!-mr%Hc{-VGb=7<`5d?^);w4hwJ$q_PfnS2#w0&H=x2C3iSk2&?v8O zL4`RKDu1E%f<{r_feLdd)cs6Bqp0seg*g-||90yIjmqHZBY6lH^=q3h;CJ;xL@iuwzb%Lc7>7Ha*)wqDSv9R5d9wA$HHVGf~DUVnoM z=Nxi<4i924XjBeqXf5ymqB#el<}wA1@}d)kwblr8DAY$xL8B-NXRS3{4r$Ios1A48 zY(S%^wLrNX(wu`(bC`lg<#269(VT;&!W=@Qyw(Bb+TrWHXYX>6KPOtwUeKr8kNJ1LAf06aOf9tp_(nVIfO=eZ2~IH zp-=}h1&yMbfeLddR0UJeC~8ws<_A7sUomhkp{`>J8kNJ%6g9v19UECH%po+&YjaRx z4$tv9e2cxHQ90ZKRG34dHo4p85E|vx98{P?q4Jr6Mp0XW3Uesb6sDk2)K;L(51&J! z7BK~l%Hh_Eq8wT(%po+&Ya38u4mUgj9f<{r>gEBwxnb%>n+l0D>DQHvTO zqHNHI?%8kc+hNQ5Y=qFL9Jcfn_1g3fHKF=41 B2^7tX(iniA-+LqGeat_yYMFvY zd9_kr^!#3-?qCWU<+U>?x4r1eu0nms6f}z31yuNCSD|w5x7mP3QM-b2$FH4M{I!u# zQ<#EAQQ4r}sPgU&PrUy;-+J$23L2G--9Wk4`~H_l?k&_Rrl3(?yMuDspxHU04t&7Y z3mQf30m`-BTRJSD%E}584Q! zQQ6qrdr|i3slP&vVhS4NwGSwl4Qd-gUCb0TifRoiY#Ty-z!Wr!+82~-8}!s)q4s{r z)(aX%wE^Y!lp#Zw?O)=vQNa{6DjWNOa&4o_vO~8MYB5vLD6bq);r*~etzrrqMdhk` zEo?jf6`{I4Z0iM$qS}I@IapHcIPBBTLd|6g8b!5J)X+|cjSy-XQ_v`?Jt#MS*tu2i z4MMeg#6}2>qB?+bnV(|rhZSl9Q_!f)cLe1!-(uI?QlTDT3L53r2^3vlrv8xbhZU;% zqc%cl6xA6N5%gL3<=0(>n#2?|is}N&mT5_$o@NRfbxhemiHf5ghQ}0Wl-B{E+;REL zS-qZp!MEO>AG0w)qjK04l*{3hPv>_RYBE#MD6a!Sxz^k5prZ~GYAI9DDC!_k?hfl- zGq#v5)Vhz`2%%9_9w^s(FW>x!$wG}`3K~V_E2_);?Y9!@TBe{;Q~@Zr_TcJcM}8#K zFHAwBsBYeiwsE_+jvOphk0)%spi!Cc4$5VI?zjEd7wSr;piyn32dJ<`y_D28pivPP zf(rZjR=#cg#a_^;2z#msM_pHPxKKTwv@t-Vyn2BO`+1>GV+tBY^#&F8^FqDK6f}zJ z1IqRD2W5}xEYvPf*$AOgR9{f7%(kNa`PYZ<={q3H{0W~)OhKcv(GQf{UPnIl`DCFU zX9^nS)gP4028{uPYWcK{5E?}d07cL5rMlgJ=gS`nbre(3C~6=m+P~=2YO^nI7wTQ6 zpi$HyP~jCip*lZfBZNj}V=yR}ja6f=>MqokOhKc(4pv_D#J^j8<~MlOdO@SShA1z3 z{=87dOhKc(h9-F}^j`Nd1=ro8AaIYMPUXCs70c@0nUI?InLyE6ri@*1JMXdETf z=}bYRyheg@>l~JKy?Ek9-s=^npiy3(YOjq*Cg*NeRFIc4X3p|*L!MhK1aI#hYJ{Its)p-P#8MtL3P zy^K}X<(q9g>Jp#Bdzpepc^$62o*MgZ2cb58(MAZ3@`{0KWqhb!9oD*`k5Gp)1L zLU|qZ(uIN7txQ3qyo!9i$SeDl)6WpEte0$r&?v95%ImmK&+RVM5T>9}Ud7(aSY=&z z{GhM1{W0Ylrl3(?CCZE5ks;LAOhKc(;-Fj~Mg7K|eqZkJvaJ_1%4?kRYIbk4wS+pI zDQJ|}cu+KsqR%ted6j?s=Nm$ee$_?@jq)l}Ue~OB{V_rhh-bf<}2w^%QL{n)}+_d!54+G|Fq5r)Yc8+?P;aGX;(En(is*wTt)a^_Gng8s&AA zr^t)mh$_^zOhKc(jt1q6=Mn-Nrqto^9yWo8Pdp&&D#Q zpi$X49+VqZPQ7L3e4)C(Ya@h4d7S{tWrN1pLfys`G>SSARG1B+TE1t!pi$IGo}z5z z&O9>kI+rPE6m>Evcl@He3B+s7_pKK+DjTyvxoptg1VSCd6g0|fHmGb99i81Q-MMoA zPkiQoX9^nSb&B%Z@9^)}5o-4jY=qD#uTw#VnHOpZQ_v{tG*DsYg*u)oXcToiD0kgF z=dojF3UwD#&?xE*P+{hU`jjbXR5s286=q(joj=%0rogMtNQ4DQZ#G_w7?4)SXO0qr5Ips@D=< zuPr~b5kjN9u25c7FQLXU1$5>(it{_^qr7fXUeuz58qO3n z%IjuOVT)Sjz0P3@8s&A1@}d?c)LLKJ2%%A4w}J{=lu*@7L8GYKK!q(zsLz;!Mo|kv zg)K^`*h(8AG>W<%RM?`<_StxaDQHwS7J&*|lu#RfZM~pTUUzuPwWtZcMHMgwjq!piy3rDlckLLXG^= zDO1oWuctlbTGS+;`F(z|5kjN9p7E4xQ9_-}6g0}~*`#{i=j-)8Q_v`{=ad(orfg7B$glzU3d* z3mWD1x~E)=66zSHpiy4SlInG@uh)A_L8H9hP+rucglhArjSw2;^(LsWMXl@WbqrI` zD6hAa7quv%TKr|bpiy3Lg9=-ePjO`@7FFgmzZd4H%({QlD6bDa_fc~OfJstdov1sdhG98}n%e)V3bG6jwD`b2qAixO(PHSPK$ zXq4Bdpu!d<)QwC*qo~h7g)K^`1J|-%&?xG2P+^M_Y8g||C~5_$F!OVLHcHpFUeKs) zd;uzKQ9|9$6g0}~OHa8LHQu+V-4L&8s+u1 z@}d?c)bC6|qrARJ@_O2P^;p+N2#xakR(a8TmxMZjDQJ|}cc9#rEP8vLP!BQ%jq>_l zdC_~9g!&It&?v7TK)EYf^!7TT4qVUH3mWD1qw=EnE(tY*DQMLCsGmUDGPAPi?RAz4 z*UmwsBK#Rt*m|G!nZK94pivS2q9UZs3$=mzIW)@aH|0f{7it<) z&?v9pL4}zYYAI9DD6dt@i!v|NZ%jd>GXDptF!PoQGY^f5@J~>#7cJhi^4|4)<~wg- zOM^y5_?L=sjUGoW66#8(piy4`0TuS5LT#|2^@2uGe}i(pXp0f!z7nd2DQFaxWiD^X z*}~oJ+bLI%)Eb~%JEZGGLJi)?MhK0{#+sm9FG_2BgnEi8Xw>#v3zS>yxZW>6 z&aqUuy`WJMuB{@ZS>nh2_R8DXMhK0Ha2*vP?I}W?$P_fnYh6&`o+8u}OhKc()>B@z zrwFytCN@H7l-K&8!aYT(!AwD;yf#o?w5JGlK2y-B%x?(FMq>LYONE(-Mn$-hkB~^Z zkK+cP`M22%8WrKjDnh!CL#VBr*%+WvUYme&dkS4&7V2Q8pixvaQ07M#jUXrP^xF?Y z&0z`}MQsX-j>+_)`#6Mpl__WxwHYXC8&n6nb74n62H1R4TQ6u-HZ}+4_7qxiC)5z8 zpiy31fC{rA)HzH+qp0Sf%nzRpp#J z@@=DtDQHwSwg%<0(fsO5UlZz8rl3(?+kkS}psVdd_1N4-2#un)^If zXcX1LQwGYq=7JWx3DtHB>jjOXwgVORqC#EE6f`Ou+j}p{{$<0uZ6wql&8-(S%4-Ku z)Nhc2?im^D+u?OgL8H8OR9neG`8>LI3}QPj?gqI*V!T6-%SAvB8G1(f-L58X2&RDY(RQPi%W zT;}PX5uwgu3L2I9Y*4Pv(>)_XeZ~|t%4;`J;XNZlb=lh13mQf34$6LO?->zl4pY!5 zY7bEM9NcC^sIQoUMjcc3Orna>4#Q&#G|Fo)P~klz&-&I|u#Jrz8kNJnLAe~#JtIP$ z&J;AtYadXq_0l~fLcPWmG>U2sD!gYzs8-wB2%%BbzMx#|rF%w%s$vQnMYT~B-7_N8 zeM~{4sQo~>aTMJ%BGiU0Y=qD#D#v@#Hl}+SS#_XxpV}&}GDQJ{ep7NqIj$3@@e`5+7<(03z z=$;Xw2DP*iLZiG2K)G?$HZ#B4;?yWYKYhieLan*8rJzw%Pf)IH&{h`eBBr2G z+2{qzZDm@uDAa+wSTAUlS8wG-TlqG>l|N((8s*hTdC}cELhZ7v^@2uu^-c0R({JTs zrl3(?{ghY9nDyrfbpun-D6jsYXs@Kt{BAeYTNVG0`MH9&dI-u03NLUqly^@2uu z4Fp9;bL!px*ki^ELY>MKG|Fp`@*4QstR6zW$rLooYp|~uc};ryxgCVsV>cTiG|KB> z<<;}J3*HlI3RBQ1uOZ&cSRscO`y4*b6g0|fsPbAI|9z@Z&3CsELZiHffpR%~x~Sz2 zLLI>rG|FqZ@;d38j~^H6Hm0CaUL$r0|6vLm&?v8%@;ak-(JG-nUUU5&+ zo^rPe=cQC{Pf*N%(Zz9iH^`&ut(l-C4MZhIZE z$#%_!TFewQ%Bxg)9eVQ4PYBhzjrD>?c})c6+C1H@bEMywuVxAw zZlu?8#`9+h^&wNxD6grY!g&CpdbYC>LZhf@pxnM(eDsaeg}RL?XcRRal$!^5^Spbn z5~^i;>jjOXjsiv7i_V$nb^U69P$x45jiQbQwW%TKv+f0Vt`zD!rl3*O3?Cs;G!G!u z=nghQXjJBBf^wOsc>tkaVhS2H4{!{qa2{Y2Y~^r{2pSdPu_{73nm^^+M$e8mLTFTk z$EgVEijPpoFa?eBIv$kU%5+s)sKrb{qr6T~UUbDrsBf5pMtPkG%JtZERa&S$I@x+b zqr6U1UUbDrs3VwyMrHnFP_|5a#m7=%=Als$&hilwNmqP6^_jnjy`WJM&Q=lLT-J4_ zP%D^%MtPkAiq3VZeGHh|_9CG=cD9j2qo`9sx!z{`!V6CmYBp2QDC#s&w3Vsc$!Fd> z@dRJ5H<^M))$4RsuTf{tJy57UyVwY!QC??&a(yq&r3f{ZDQFaRCMa41L)qAH;kUO4 z^)yq^DC#UwZoZ&RuPb*FYUllJgwQBz4yf=*^n=evHB->2Y|I7adVsb)$G#%eeM~{4 zyv_#YvOz~8q1HaYMhK0f&H-h9_#=@}gP4LwQRjkkZR4Zuw_hpL6-+^+sPjOzGF}wT z5rg);t*g(*S4=^pvT;5rmyO=-2W=@-X;)h>Xq4AHP~nkCsLz;!Mo|}la(xsXiG(t@ zxtplX`@Kk`s0%@bMQX<^Fg^?HCQXjHwfR`sI(P^gW&*$AOgUe|zfJplEGLXBn$8bvJt750Zh-M|zyinN-$vE7QpQd!LO#-EF;~QQ5d2lxv679||>(DQJ|}4WL{$s6Q0yU8bN> z)QzCb58odOwObDxAvB7*36yIa)E^2}!xS`%x*1eBm$JP-Pr08dXjC?C0p+rhb<7Ue z2=zBp&?v84le~8DUipQ#UeGA7+mgJ5n!yw_%4;Dg+RF5y`KVmKm6tFDjq`W#u)mEE8s&8_C~8sUb!UrrS_yROGs>J~71$A5^$kZs+%u z6PbcWc|D-KXs;CNd8VLIUJv?unQCEAY45k!)&p&X&?v8ml-E^%J+Y%uy9}}vG|KB? z<@M{3$3O1iz4je!DQJ|}Bg%`eRs_@#OF^T&9tGvbQS)bi`mIo{hgk|5<@K2I+VSZ< zZx?Fc5tf2Rc|GpyMQwwwRtVK*l%=3iUQZ~mUEcjawsDouVa}nJ zf<}2grM&3L3_^`L%u>)Oucv*zsBL`t+J2X|^Ij(&ZYgM#*E8D7tQQq(y(26Ijq-XH zl)ExAvG1TULY-D*DQJ|}bINOSzXdx8wP~@Xpiy4W`+Cv#qG!PgbzX_3piy2gD6fJO zd%rAHi*c5MMtQvmD%@UI_#9p~-crygua}e;Z7-otn_wwul-J9?UT%A}^D6H&bfl%AQC@F=3b)tgK8JIwECr47dQ*AP_7ZAFwWXj@UT^t&(e^s+ zkI5V5d#~{|mV!oky{)`v4t@S)p*q!C3L5404k%iCKsh}BzN4-dYTYT8f<}40tGwEj z?r^tIZ!iUo@_NtLi@eUh`{J%bT|d=&L8H9hS6<7eJ$IQ<)2CSq8s+r?DAx{O_~VbA zgz7upQqU-`50zKWMdvLNYWt%s1 h2$X9ZxyPQ;X;Z(wRx$;R^7>eLeSP2YXA0Hv zXzK-y@>&k6mB}9|x{W=(%Rb)gSf-#+UY{thDUbd*K&W;ztQR!O>r+tSs8XoUn1V)8 zpMj$J4J!BbbC%vO)cl#&3mQdz4vNn8=rjG~ntno!I>u7aC~5_$R)!!2WuuMHMzdor z1&zwa7ogmz@`Nc%o)K!wah8Hcd3^~g%!W|!9d9XU6!jITFdIVkI?+rqvn{6p*l-IXD zLQ>EfhfrNlu@p3l`VJKJHgtZzZkJQq3Dy5pOF^Tk??JgUj@vsw+E%Esr&$UbMg8FG zWvp-wv8B&O)#;XkMrGqiPf;I5y{J&vGX;(E`UzAkLr}St`JKJjdrU#2yna?*&v*K6 zj8I>lVIzb_dHn(^Y==VqcBZAEQPi)XXm*b3wdkIW{}yWfIhKM(QNMw5Z(kkp=u@+W zYB|?Z&?xG6UoT^Y%`#Q_gFF_qvEFXq4BVo+2;0 zdMnhgOhKc({_>Rby2g7AJIB@w8s+sLPmx#FuoX`V^)^$`D6hXg<-D%;Ua@nn7c|N% z%XFaf{;zGGd*c?NmM{g4@}ie`t+hsY{MyWWH9OCGL8H9ZR9;=*xNwnBlbC`=d99_q z+I_Lk31@n*Cz*mqd9AIy+HP^$Rze+pzKswX<+TndHwO6gwzuL!wV7urXq4Bw%B!Yr zr+`|{6g0|fJy32Q;Qim;yIH(0yuf-vqrBEvURO=}WSLL{F0>Rh%4-8pxwg^D=Wxx7 zECr47+R#(f4lg_At_eaN#1u5jYa>rNubsTtbf%zDUK@MLc?q?cDQJ|}CZK40Q5^>7 zZue~u@AVy1&?v8F%4?1N$89ZC-o-W>&?v7>L501jP-ij)jiNRK<&Nepp1S;eq26Z- z8bxgm%B|JE@cJ&_31uFzO^MBdMp0XUa&wh*mfg{3V-{1;sBAO`<&NfbSEf)~U246c zQC?eua(fD$WeaunWtM_Qd2OY<=&Vhsc2`&m8s)XMuNSoqI?ER7(JL(ljq=(?dC^&$ zP(!b_6g0|fTkl0VrW|(iIb42?rJzw>EtD7KP^hYFEd`D8+748hL!q*+w-hwWYkTEI zGZjM3y}?q@D6buSy<853YIT#Ppiy2sDleL;5NhGgmV!okwe((;Lz-$F}4qr6&y3TNkp8otO<&?v8+l^4y<2~~8brJzw>yZCxh4rz8ysL6L( z3L53LtMa1RIiaR6wG=eUE8BZf4(Yl>XP?89@39m#%4;{}MYE|w&A-=D&?v9nJw;x$ zcJ5m5wdg)eL8H9(@Dyc(MnpojxZhIHWVNX(DXJ-=va_=G1m)Vi{hJxM;B%~@XiPzx zH5IiND0ij!_XE~jW_x_X=CK!PG_`jculw1HG@9Bc4fPsRq|sDsP+OrMSy{I<+iPoy z@E4AdG=`#NWLH7CFDQBjGF@Z-VfcN+gxci+n?uqVY8tRQ$ylqrKXKa?gm?HT{h#(rB-Co+7W$4&UxT@fz@;tt)A?S9?#9;*&vz*9kSADbg4! zXwMx$MYrc`4MpvlG@9xNipCQ3dGg%JBgE@I_9BgruoI~0?e!*8q|sDoP}DpWz0NE+?6Kd9*K)siXF7%Ir&0ifKt<%-z+ zS>kmFQ>4*US5VQJKi*K3dD3X=z%jxZlobiKBF*w%|QnkoQAdnA26=`k(n6FL}*KBUo9w=`b;*^4x~Ufn@O zx5IJlMH)@@07cnY+x$2BtFH%=!hVipiZq4_GG7R44_l1xZ~hh zLs9D`ji&m7qVMRl&!1)2ON6u8i!_?*2P)d@O7M~T;ohN2H?>~A;l zU+Ay8oWW__A7^*cXzE~4)GFm;oy>FM*o!op8j{BA2lgV3EosBYT#1S03`IFd7;8Fn zvmckSeGElygfy1#ma?2-DCan%c6qdGJE+7GE{8O_7Q;bpYc#IM5o!igq|wv}P~;=E zaxq`b6lpXy5|kTR?eWX;eS}}g^&*X?MuBqe@Vu_oW=hhzzRMJ8G&Ndzo&CqjgN54Q zam$m&P(eRG22^x^*nuh1XzCD9txYy)W_#KnyRHzgp-hp+P(goqD5!l5K`n3dKNp+C zxO!DFMH=mO7^vv}@LZ-yW2mv!)uv#44hNOb|I+{ah$(3BRre>>%xYzRvwsQux|lD= z^<2_g78r{DN*d!H^pHoSp&nz3G@2>`72U>`GesIrjZH(fc+y5l8bbx!y%{wijtMH6ac4AErp7sZvm`U0go0MX<+pc*^FGG@6NpbzMQJ~-Cn+-&l}8#) zO-e&8V2U)FDgzarjqjKujix4pa`k%cvak0fh5h6`ZGR(;rpiH?ANU+~?x&{v-(%v)IuU`{*2{G zqp2!T(K#GwD2jqKnyOAi9m^DHG*tu2)l0XiJ2^tqXsQ;}aVC!B7WD;tkw#Nf(on6Q zwe=#6rlx|5&c+0$NTaD~pj^Fli@MWL^dXI=rh_u4==eN4ee;ZxX6AQ>4+<(V*OsddAV;T_sc{Q>4+<3{Z5YNuQ3#{kl}BOPL~#p@P15CaCDX z_cf+Sqp4#+Mfbg5GesI5;jy4xHoEO{{4)~ade7S&l15X>p(bOrRT!f{SJO4+h#Y~Y#Q>TL3o4xj5QE-D$E14pVrcML3BU5MGH{%4M zvR|~>AdRL@2el_ti{{=C%o>emiZq%!15|USuGnwAAI0lzrbwfyGeNaw>iqU|?icDF zrbwfyvp~5BAN%N~HbQ;R6lpXy2h?`#_0~3hdkVGJOEw#%(bQZ;-PZ2u`B$g!#j7_{q|wwxpj-}rYq#_gp^BLzjixRJ<<5-nm|1qM zP{%Sw8ckgS%0+nm*KLB#U(OV1G&LWT`GL=(J{y<=h0UC~R>>4;G<7K`dUHB`4u81+ z3qrlh6lpYd8K^BRl-0Ln%p{>!F-00pT@H$ldh}V=>D{S9?edC^l{A{V0+c(N@AB}- zenRzUiZq6z^AuZn)|H@WY_o>>Z~1z2&Jt=WQ>4+p;12 zXrJF-7(fd9xzAAaA&sGeY+Mg2IvXD|MH=U2FG1Y^ip~&eCTEZMZb841{krucjizn{ zMJ4+%z_T%dHEK{V>)Iw0MUcK-6I2aMFWQsJJx?NF6 zH2?EnQrOSd%j|EY(bOVPu3j_O+pU{W9hf4Grta{Ra}cT@Q>4+4+<5>F-9YXMWF(bQ5-@_DXGJd;b8@i9WlPS_@>QPT6w~besB8{PfY&-_)Ad?Bo##xv2#n8@gxf!W3yV^#rKso~@KA(rD^QP%ay~XS;|g(rD@_PbFvL6{bjIs303pgX+QA zc&2aVGE&&jhHu&5NTa=;0p+rx+eQzjNTaD|K}ENXqnIL%rk(@kvZ33?LZ(QgspmaK z**N)xR~D1Pe!gXjG=>VY@dBuBMn-L8vt0%RG@AOrQ^{?kj49F>D#*r%pz=8zt9m~+QoOEUiZt5m zBTz0Ix}RUh6lpZ|F{tQ%e*F(@y-1^}<)B4+Egw=sUJbP7Nz^%otN8^NTaErJVn{i zeQym@q%l;Gjh{gsY6!~4)7P~)Kq7pMDbi@KUqHER=)QOBPi%yw(bTV?qWj(wrbwfy z-$1!+=)QLmQ>4-L`W+O_&r`iRkGTIFQrOQ1pW5F@qrFyva`n>v#$HU3MpJ))itaZG znIes*{siUfrTdK{rbwfyzdV)P=4UZQ8cqENl&hC+y;m?r8cqG}DVI4?*w0d?NTVsb zsJqr0u3ozJzQh!1G(|U+St_|+-!nxTO|1zkx?Y=nW@9Cdrq=S5s|_jaXAh=Gqp7t) zMc1oMH)?Q;Hl*8^&V5C(bR^ZT)p%t<#(n?qp6KRMUPUNe{Q!NX*9JlC|55% zO4*kw(r9WEPbJrDFjJ(_R5MVnUit_-i7C=(YE$pEHn%=f*w0B!kw#OSd5X092zx10 zq|wyoo=UFQgG`aeP(kb60u)^hq}E$7^5Y_j@KdHpqrIAga@o+m%_b{s4N0S^Ej{IO zAYQplkw#NnfpS|}_cp_sB8{fD_Ed5etVnCZZ3z-zO=uQMpL_jitZ2hV2U)F$_C}K zq5H#prbwfy-4vx~ZpSi38bbxy*d3G`eI0h#f4*Udru{2W6hOzdy~dcK{h&oa&4piqPzYeh5c;L6lt_qM^Mq(=*SdlG}Q@I zbT$SsMH)?Y1{Ix+5~fI_sV<&M&c;bhkw#PdgL3uK=apA8MH)>V04lm(4>3g=O?3qo zU9b0;B8{dF^i*=a*819RIno#^*vbciq6n$YKezC)pGjdqyD~)@?Ue`0WkdIeg-nq~ zQ~97aW-sgEyo#A3jiw4fxoqhE@OY+3qp5D5O3udhOp(S=K{mRBa@lxd)YQ48u%D-x zB8~Ry0m@}Vk1D@piZq%k^ptZDul2vNeXB8{f{D{5Zx zyH}FJewH&u8bbxy7yzofkmH84AWYkAUWuYsUkHuRn{hAGl$Y7nUCJ!KA4 zq|wx1P%ayKPkD?f(rD^nPbIgFHNUgu&I)_IyMH)?w02Q6XIZTm8QzJcWbx$Juyq z;sA4@$z|gMrbwf`MuT$M(7nx;-&>wEni}IN=OA8%Op!)Yhk$a~(7nwRrbwfyLp_z8 zjfG5+#!x{v4g+Owi^cxcvY`4TiSRw9NTa{c7L*x+%q*w#h%AycGr@z|`4 zR}{TBN2v9FvOH-tH9=9aK|{_Istr@5(Nw9TE|_0wPAFZ3!W+T|KUNwdFE6{aJXTp&R2+|$ zmY2k*#+JoPM#hUKjVLOs zjhixK-ScBPh5hsU^zPq#P+{M~{K=)|l{KZ4<9XRV2Il6NpZzBnO)HubuPPcJA6r^e zRaAqoy5xJfcYd$J9)*1d_8XjESyeHvv@D+2r7S)rUY6ITw1kRj-!`6;JC2H~EGnK9 zuPM#XidEKD#fyu|%1kM3^G6p9E-V-o>z6;q{Ii|;=cwS{u@UYM=IdC@)HhZWuQFkp zNU}^Orc_Ld$EFt5R9BQ6Iw#h@qIgnijm^u!g#`uqy-{p#@)x6wU2IfYynKAkgjl?) zs-ntL@bA`xu-K@o+Hy)qitlU7i;HT>JoIX&r* zCGqN-s*33pyjKR{7Zi3Ik&~NmE0G`=PW7W|Or20vlb`fuHrAZi1o z_%?`I6fV--*pT=*({RmhVCq#Jx0}VsW!hCutR!9*H~VCM3Mn9J~&Gbs@yv9}J zqdjBiGkbJZY590tF1wb*(b&u$o}ZV^znZpkP+YdCBh9g^69nrSg}r_)o6q#$ zJlw)IHJxWoe0)XK^n{~ENqk&UZJ8N0(V)v5T*^yIF?NcEx)tOVj7XHWwd1<@k+r2$ zip+??41a84369+gVgq|qgGw%d8bU^Vh?m4oPl7s5E;0j8SE~6lM&hHxSj``E^GCKf znqu<{*=5X>R#4FnGsD`U)2nOZlfzv1p~0W87QC8b$BA%?Xjc)c#CBDuB&Ry5PH@t7 zvb$@tG}slAzl?}DS(F%X9SUyo$tu(6)kda@+jcRzsM0kH+O5%S%8Mq)^UbiSJYMCx zzNFnm2JVyN)z#+At8T#TA`R^_xjmb6ggU~~L;B3cw#t1f%t$X@#BJEuxvlFPA}U=s z(lphs%O|1Y^^s@C`b?f&QB_k^R(e!CW=_J3E2qawC(||^kv4;_;m|&vN|=L_zr3^_ z>4Q}+DW&XV1}wGZrAOAraXiQ$F}b$JOhcgGvp=!h;XI~W_af7&n`y6jepO9zK8+)( zXKZK_g@-*sGPNCqGwq@>I&zpcRa?xbCXFjTu?nWP6>OB>#3d&shfm}4a-zP;&Ng|K zIe@(EDe>YOb2>DUhaZ54e#F_ENz#B zrqj4w{1a(S(3;EriWra znr1`XxtaSuRzm%-`&XjcX4M?8Mi*6;yICkXM4H{)e&c2={8zC)<;7L;arxsYrTON3 z%beiY!fA`3TQn0FX(T4KDlzTsI3YK=zyWj;fqpjDEBf1TGu5TY4Py{JHSXvKAum{Jo_;?&ZTIL#*|R3eBlrNWlhtw#<8Ny#t)mKT|G^QqD0)vfU*qTa}F ztXEQOdW@d->+IUrfw!^9&RVDXZvti z*g#6FeWv7Vn#bsA{%I4MLSix%8;Kv3{hlnYE-osMr6YP;B$Ss|NXrj{fKuxd+jA&4 zbBHeFbTW?HOpW3<4y2|+H`$a0rK$Z|<^ zOorR|hjt6_>?}sv_#)<{NbleXOy9k`g+3)L+XHotm0C+?wN)R?y^{J<#^y z)Y)UbR+(X&sRoS|(O)N4GwruAa}m8~!SMdWVuJ<`9~vtd-lNZ;*x(_9diLpG zXvcl-l3Xm-GjpjgwRhW&?PDYQ^eC*m)HHhwcDQJkXl$I3Kn9H1F&4fvEt;~T&&f7<%*M^lycZQR`l!iL`)0D#U8Z)V%ls~`Qp^2mv zHBFMuVw0MR;)=5Tf7quaXodf<)#TEWf4Vl6MOD@Dp(U05OUvV_z0A&O+DLePH#Vg- zJ~cnZrFCwVW+xs`^V(+Cj~%L0S@qX+ zZZ7m-=27i0=6Z8wQE63vc6Rq}b(O=3=@_mxpuQ)fgGk<+lq>ZM$&z|>2gz_f%Xd3} zPKumiRFQD_Pa#b_FlHpn9S|=mElRG2?{vZ)HKn%k&5pL8+KWSg{)QzM$qNOo%4bz--+kJaTO(pHyDUxRP-wgNd^yQ@5x9Q}c ztJ+6pr%$-IrpitlBu#eGPzl)~W!SH$>e5x@J^W;~OI{!I7bOXM#YTE?n#`aYov+VS zUQUWF8rAcpkS6v#naCy-RTtEjlvWI?8eyhIDw2C3y10e)o_Uk0i|S5`<)T%+sq>)0 z(Xfi4cG+9f7;0#vkBfR(9W+O?!Gam#5h;3In{~Bu>jV0xBHK-Nh{Q3uc1bf}4+=}l zn0%KL{hhvm))A*GG{qy=Bl*&Fs-3~6gaC75!|4sJ?355?I?ONHR&R41w9H+hOKi{y zz%XY#JoUkVRSx(Axg9(3}AB!tao^t!sv~-Y!C{a!w zB7Kq0WTX3pc=d$Rs(5!Zvo?HiJYHok{*{}nopj|dxB!A!q#8PnX}E;`gk}-z>nItD z6*h*>NvK^ydQ*QrTwf1$E5oCT^BF2Gt1v5fqa?KNV4lNVN;g+oQ)sX>Bf;37;aAtt zCI0A=X{a@_{ZJ@)LZH-Kv96P#%i19{zNlt`Su9gNzHYRama;1?jx_5pGAUrFmU02* zW)WLWDK0<{jK@pjB`Irc4+G|iVGk^+5@ThUP!4vXl%?WKNfsl72-=P9S7^ViichYn ziHCwzA=J0b0Y%dW*u_Xg%}SP(p~m`A7^s<xdaXIq=1}Ke9j{63XHyp8=G?*-(l&p1 zB9G48&T87d4+8I;YMa^<9v=KAu0T=8`ou5o_T!(nPD3(m%4DjmLrEzrDX|6kpi}2W zrIcWEY1MRVgT{?B2kulG!|XrWl{Tpb3(Bj_<>mU3W+STcLMmIDm&s(1LDet~ETb~f z6=YJVR557g>FTLt4WXdlGBs-08A*G!LLz9h73HB-x>SxccW_~Jk)2)85tCkF9>P+B zfb+*lLpANpj-gVyBqcW(a@k@=*kgrmO|<mz~MZms|&-BFe=efELA=6_lxR9uck^h(sYeDQ@`D5D&*jMy74_P^BSex`YfY z_28x!=D;VBAUR6^% zu9R*s2njnT#ic@OCUrQDon8~K9vV;MWCt_Q4T%@WOQ)n9`I&<=20m3a>Ebr~tBm6E zvP;~e##mo7eS!s!=C0kG?3^Bh`tamOezCcuu)HEXJW{gEnOjstPMqDSThsWH;mAQb zpAa{`^i(@klNqGniJHtN{f+~hm{}HH85>~kiz)49TIR5dk!H5Z?4)L$8on_LPP*4t zRhjl`?lO%RmGmjG3ytit(_CB5PkASnZ9e{V(5-FAn8XB^UBzHpo;zG;XsOSbGxpSN z*_`5A(#_OlTG!a1>T%P|wY2wV*&;~cQc3kTC6528?BAn#6P`!A&zGFCU zXlq0X6=nhcIJ2a${zcHDuU@@qq*qA?NLmHcm_n*2R7{;*R6f19VTHu{QfsX>kCtdm zbx=kl(n0*RYIEkIZf7;O4Q0?MD4(&uroS=E&iYbXr&U+hHl`r68p{?`9gk0{7&oqA ziNzVfxJuJO504EPTTN42HRc9*v+A{PZ`=|_rPJ5--V3P0DN7&Gj&JNTV=ziygG#3f z2Qvv4^05E`F4n4M}(P*K>cTn&J@xWp*{RUvX9Ml63DVool_i4mqZUU6<(# z)3(x7U90a1qq>rY7FtK=()eN{dx}OCOZ$Grp4ON$Q|=vU_Pu|^&+m4)C|8fxd4 zC1m#r zm0FOOo8Zs)>lm<)x%suIyg1$`qLMh)nvNj}mLpfJFwK{v^RoL_j5kv;_Az3%$)YLK z3NHrjwZ~w(WoU6trI~UpudXzAJO>wS{XQU5F6pFE(=K)EY3e1N3WtIwntn;VJS*3x zsjB%&mrAi~<|a(XBtX<&A}`cx9onXyEbAV1SvNwBF;h5Qn=Me8>z88jO~kbw8=!e;4IYnRFH&Z>5Aiur zsJ5k5R#euOne)o}Y}jsg01{DHRYkG6ZeO3W60gB>RJNe{R#9D7jVMVj52bB^qk_x2 zwiNV(-OPDQS$u$5O`V2rnpMJeE*lA(lv_er$A#b!p{(mGtm<-a&|A~-2Ll$fJkhO4 ztGoJP=as5t>J~9eI@mmR&J19K-8|{?OG504DE7KcpkiG8OFyNqy?hW=e%F^O$utCFZ#}wvVRewc!Q`5*t1S!2V9% zG>ys4BP0x#{+e*Af`Y5JG$9+KforU|tjMh3No;1RiqPxp%;O+UV~$NWvl?c?r@`gn zJl8JaG&50lB-O||Vvt77FE4fW!+z23N%)yQ)5%cUtR~Ad&tM8Rvuq{99A_q(k^VR1 zyd)xNvyv#zJSUN4W*JFDGtWobl?8RTnY4JiJf#IQ&RN~1WR$ot zMJ46ej0NkQ4U%DlQHP^e(|ehuB~1w0)BcoH`k4%mnKPQClhhQ3{QSXi+|$n8$W9kH;+th|7;Ds`Jy8V>U^{Wt(Q*{%de?-AQ87@|= zyA9`7>8H$2(rjd-Ql%#H?6&@IMi9ODKV>eG*Z;S(>;KI)pPYmlXWPrw@BSq0Rte>} zyNlFLO*g)0ev_5IKu*iW(mp@HUj`2@Xl4Y3*EC!MsVAsbNtx9q=_5s|jBB{(@)DI) zHO%E_oXJ`zx~^EKlg~-?I<{19{>XwUi|AEsb+YN#u%*S*U82pX&az3>mXRx@DeTP_ zk=1K*+p<4o==3+VIKNfQCiH7r^mXF;#@DDBM|;6j>SkLOtwl)@hV2P`HBv32tCL3a ziltmaml+?m>ZOjo3GJI!xYz|$>6Xu>jX{b?w|K73BI;f`S7#BpU|XAF;ap~P%4KtP z;#f4-qmDIm8I@w*7J`*`5zBZo-J}g!veW3Y{qh_$6pCIfS7-Ixxg12Vl&iC# zwCm*Rq%&M4m$sZ#-FH3u73skJ0Km|u!%fpGrRcnUHx<=UG^j+`?IU}RMwXdwVO)x| zr>HsNq1gwLbO47NZ6ZFEQ70G zeG|%5w+NUZ?T(u2=%1psC6t+B0bKp!q=6R(3A8ZH+~i~~-6g)4%Z^2&*Px{^lND%w z-CM%ELy9X@Y8=S#GN31ItEVMnaA9I~Z>h1bH;d3j-5U|38_KGt+ox^1lMy%6Pranh z57_O)m~*O8iW*zexH*#oc-U?)lr^Fp>`ms?66NM)CN=KeYAFLSujfJ?qPJs8Otz$% zp>c1V%F9ig#Z-+V!yML)XOh9XOF{ljvkcyfS21>?d2CXOw&@RZ=Goq6|E-`$W@XA2 zy4}pM^e(+E~x86KXy)&f}ItG; zR;Wyhjjt^->tIJz#fxjJs?9y8u{7^l$&MA&R7^H65;FIp)5A7mMdqP}rtflpt~7r) zH?5k>b9(hd=_|D1fSYefUYh-MKxnVKsfnl*>Rq=SNyu!S@ z%GmgaD)!+ArO`3iM#Dc%wLqA)Qv}$5RMQ#_)8NfRwag7R5ygZ>;BZ8{cQ{Spi^?Pt zo)OEAnaA*$y_DWPQ%+9@Hzh|uqLIJLZEI$k{ZwtVR7Djn2`gjjL2u1XXP%3rKoBh5 zUyNg>J2crrQawisa5f#bdjn_04qVp+VJ5qCU1emtb7x#mm__LBeZE@SrO40ke_aJG9l^&7Ej^WJ2BB}yanVem$DA<4JGHfUR!AR2MK z$Myh??HijShOjTHZ^zmc{y`3M=?=v-O{~f6nyP&^SwO)t+muY5nuJ{;<(#5wXu%U~=&Y5_{mo4h zv3~V-r@IAAODvFDg70{7rBL_n8C%#k3?$T*y9 zu?LE_xo%mJnd8VXRufwzPHCi~tKp&Y^-odbDrcJl4#y47Z(U<0m%zGTSCYv9JHKQ7 z+fiK+)|mzKW^CLjWD?bf{<8peg!bP#SU70*kxbiUU9V=zJZBk=BN~*mOiE7Ea)O-o zHZtD&$Ql04IisP>@N&90x)g6AFEJOViYHan*2K&_s_Iqho^#YgmJCa6ROb+Or44aU zH`0*uq-T$rM`+cW?tFU8E~_<3GE?Vf4!!=JJtf{wf74uE%)AL8R#8=HZeDa#{NeB{ z!#+AVu+a6PCYTSmR~(xv)+XyL8&T1wh#_^eYl1CWkKVH3X~@hZx}Mz4at9N`V`~z7 zWt#stJ5ZlkzqanC%%*7Vb@kgeVDyTO$xS9*Z@qG(dSA{>ZH_p0Oc3Ky@ZZ5B! zHQzPXBi!rmo z(?1?WCZm*0f=D@&?eFc5Gm*!=+ zA8bDZ@(c3q?3jNIxjRp7%$+=$mY>0D&P07g<~WNdWas4P<(PL3L_R`2 zZI)^Cm}S5D?RyuPhuYOyR?4`gEhUteYeQ@7oo!)&X^YGtLYi8}`@&SA9g)Jk#Ap9u z%AeOjh5GhZ{!cEJjPs$F-33o$$2x~! zv?4NWsCC>TYoAY0hp~(_Q`oC>hNRo?GcG;lXiJqJT-xW;fk*>>I!c%eQ;$>$R1Q)D z_2b4M25zhsQ z@J(^IS&GIYgM0ft`4p8&QE19Gl3B5J56Ht!k@_)_>d7dnZtbf7lcrMKBPOp9OwN9$ zF(%!GRR8Fbi}26Es!v@0`A9Z`OyWpH8sr;31Egr;zLxEp@w*mY@f-( zvbw{`tel2Ln0|p-Cb6Y2pQILcMFV9HD`I)cafE4+j z2;cf63B1y}{%@vEju-`n$EQ?*CvBGyLa_Ew-QeL=iuXUK2)W*`^G+(KX=WRP%@|!^ z1|yqYTh^0q!yC;Df3Ai!+1nLKrdBYV*}}o zNIImpw9GZB*a=0|cJv%wjD1Rf5{2%yz}|wL_+A07?LYG)4UE87+l$?k0GX?ZUR^1-8EV3mw`*`) zv*hZkxOZ!+oy;ynSzY0Kx26ie1Gd}h3g5dmRrq$z(CP}`yERq#osj+i@U(S%dw*@(8+c^eM6b{}p9sZ7gPP zc}QEIdz;g**K$jY{^#xoZ%j-1_pB(Z_x5b$eKBrx|3A8-%%!_27jva4(_I&}7q9dR zG4oy0eVfT`di5{n;_4{lrd!OFzVwurv&@9C++dP+F_#$p?=9wXvDbSsmjmlR(P59V zIpc~-%WA9Q`Q}wf_HpEL8y7tSmL^H!RaF&L=4LVT1m48i5?e@y%cMBgOqU>~xDcGd zG6~aW!pXQ)1x3w;*E7cCDQ`c&lzNenjxM=~2E~5|IY^Ce5v7vVD@FhInVT zys7R)WL8eYB20fpEtA;Nm(Z}NGPyF9No<*v)4&K*U&6{Lu+(^(csiEE@eqs3vWoHf z`J)T?9%=i~Dt*6Sy^mLTo_2VF!S*ywvj)nSmHrZ5(n^Y?zNhXrP}ZtJYoG#jsCjcm z18%fo_;W|2pQj>a@PFP1|UYk=}RfNm2vA*WS6u+D2$>n6{^cd8~ zJ)E$3LRCe1h22@~Pjv;{x~{HiM>IlXrmpO!>H=u3L^uLfP|yXaE6%t>CtPxGi+Na40k&ep9^sgT%*4l9Z#FMyx>*x29?_{vzsX3E#UlRrvlYH_1Ab-OZawf z=AV7-cQ9>f_l*C|3r-w+{qLo8V7;f`7|d|y%&HUbz2TdX>v!u-bWv`)x*=sX%_*#n z%Pw4M)D0+MLE)KKs(&%>f)YT-SiDGN#7Lcae`SiknmanD_(aw+IGv9?9 zzUW@unku*cjG?ItZ0eJOc1^vWt(`y1XsRl^6N%OGBsAU`>a)x#{qrx~x|h0_Ii)X$ z=OG*P;H*qaPWRxf1|;SG{Z=<;Wm*bE)TyeM>&YD!*5PanVf+fqcrTC1m z1aR5Nww$Q3B_qo@xFL|%m{90_P}fz<>&#lw4}dZ`zsWFK#-*)>Jvmq zbKc!0)_Q%PKyU2!&iQ&tcef9Syz|Gy%qY44h`|YS9*T0pDIbbb!JZ67ty$$a6s5ep z8H!R~(=i<5lBcFiqtd3ROVfpUG&MpW>fJkYsHFS89LgWEV@An6hf+dMGLki`{4x^d zB}M zv`A}K`L#&OYp)7zs`504HdSJZ#tFJGkH!h~MVIJ9( z-VfL1-c@tLoNsq1p(kFnW|f~8DX(d6o>Yk`YM%5L&b=y!QkAFKN%}9tQ_^?r^`-(X96{7rd|*7C z$ZXaI5CxAlr`9LpP)=V!SLgT=Hh-l6TEFnl_PId%3mqBttv+AoQ~37IGB<0jY##N< zQKzh2^bMzFjo_7S#alR_3Yz*C)Pa2ecyePRIq0vetBmvb6ozHH48q=$KL6-oEE98q z(-}fnqjJP|0pdD=sLak8r8BGSj}2;MD}^lDWx?qTwI&17Mmr~z&Wvi8PRBND$@oTX zIG$XaS?5MkS0uU^rn4oHlls{SxCo78D%eT^jBQB;j}@;L!Qd9o+1C+64aCMWE{tOj z)7epj2%v)zY(SiqR1<-;t*i;6vsn$k*Vs}8vKNJchuw9~U@*@13yH&XZ({2ZwpgAd zVEAg#nx!_B6Ac#xzwh|-dl*h^v7x`%Ny-kMa^=cu4Z2yhA>7R)HX0j%UQmBFFxSN) zqz)neh`em)>VV0<(IfBI&R4*A-2|DCv`m zDS_6Zy6AN%rUY7tnxfaCm=b6mYKvZnVoKl*S|hJ2SF&~inHZY2p-)Z>Zq_{K&Xrdf zi^R!q{xQ+4hA(ZEn=ZyUMxJ7)YYWGK5o6W$=n*Yo<9@Dc6>ozW`o^x=Pp!C@~!fq;Q@pfdiwXn|LfumCP~R->ipBJhjF~ zaZYKfBqv6ziSVhE=@>+MI%X+FZ`T$UF=BPbT9XCZrUhn0>P#!gOiySK1@smN8*1V+ z7E;W*rpPKp$}_q}Y`9BMovqen2HV&p3y`y9^FwAd%nz*&$%HQXE&x^T#HEbS#0AuXdSKwpIR0u#CH^ zpL!Z#O;TuGESZcC2NENr!}RqH(oa9iNGuOpJyR7R8Ind`)O!2Pi&}3=c~R>I*P3J- zlOe9nOo}s3VyHF72I3j%eJwT&opCxt2np@HSUMSy7Rjh1a65pRh5Uo0H4hU)XQDL? zVZ8#w_%iu8jlov zI5)P7EjRTWhC*0~@p~a$jKk?dc!|+%AzZk5$xHI+z5w~NBm3F%g_<66DQM`}g zZEPmi0M24CrDamXsg3cpF_K#8-kJ^2T;NmRAk9?fMx>|g+{p9+UT$Q1lFp4x&(67# zDP|mpg<(0H(KV53M%QGj8C{d9W^_%an$b0xWJbQDhaqgqKCdJWD={F|V02F-2};6( z+SEq-sIPCRB(blG%7uyxgE?V~c52ZLIiYlB{(|2*sCNK$Uhon=F>@esBzNEM^a3t}d0T@V{?V~1`t2UEH2iF0Pj)f8PZXJOwLn-H7{ z^gW3&JtGMiF0N>Vf5j}e3#7z!Y#^4j;|yK9wyKeQSE>SXp)v|fro_lpu16MWZpkEZ z#?gyO8su4R6_Kk}FGoVP`&CCwu4KYpr^VPJ3#r--=OGoQZgQ8Zm{;w@v*=6ve=0I3 zLe;!EkvffVvZ$+?HxH@Yyg89d=2b^7vbNeP$3cz-)D>H32>K`rcqkdgUKukLwH&OH zhv>?MjyfxMIw}uVwC5!+cRIXePm zbtxL`SV*q2gK#zA;pRlfP$S&%Sy`#!gc0gEvNFb?BUtF~2;+5t7H+nc#cj0%NYuia znXwwqXi*PmoT!KvZU{F9ds@1+_Kuz|E!fi#ZPz+F+Z&@TVfq`2`rK-r=9)qh(wMUl zw-k~Py(W?B#kE>*v?1)eCRr#XA-Y~!NN7J&2j+51!G#!C8+0ZHgPBY^(LbJv2TX4q zhac+1vsb;&So%u@{m!;zz?oCQQfUuu@gsVX_!+&(cGiR0{9AZ& zBxn6WyQpG$b?d5ZUZ7y^Y_kCc%R2u^Y%~z*aen)T=kEux|LuHFP=}kxqCL4tl4eMb zxzWtPloHJlOBqg?(99xVDNcFMJ1I_C&O0fzF4j5CJ1KgAS!S?;<+#aLUJ2np-gM2F_4QE~MWasmnhPJLLrD3jX8r=w5lTD>;?$+F(b>>wzyYZRxe>Naz zX-IGpB?GXRLAe^zxuMjBnu6YeI$J1bC*@-Cw+!03Oz}4N+4{QaRfn6$5DHNx6rz^B z3(b|r$3War>OxJS;6R-%6ta_Yu{;!zqJY)bd{h*LwbF{Y;KFDukq-F%q51-4FvBYw zO&C@iVo(<-Wjbr3JEhVlYnl237I$^73FHpMtq^ku;+9hGK-|*kM$npUNNhR~H)x$X zWI*xw&)B+HIzFh4X3~LPn{J2(pAy>ek848x5dz{tL)1>MBKp7>Q^EAALZg|j-kn}m z^da`1Vig#NProYED)8gp^s7Q+WsgvWS_OWB+*7QwN2p?zY7I{_tLfBmQ66VGWlaNF z?mR6MV8L81b6LS$Ez?rLT&b>x3{x;y5dfyybhAJ0A(DISL6WuYL6Y(8L6R-(L6j3o zKK3BWDGP{lA`Lbhrz{|0ZgpHjhDB_r>l~iep|2!$qLUnxmqgaj%VVglx=Jq0OD2o) zoMhS=mcG{}$A_SLvryR@H4B~8093SNO4YiF7;!&*1cQ#N%n$dmtGfAbVa(PS^EUf8)=SUU7c`8nCvN z7Y8LI^5UQbM_wFcM@Ws;!4G2dNyFV$KIDoU@?l`t99>sHaYFtYnDd=$4Rjaa!wtDQ z(PEKC0ZfE3JkSMAQV<)e4fg8=v7sSSFdM23jtxA}reHQy8`#s=3vCK!qla*%A%9!< z5Y8xh=FE|udAiIIF3*uU0$tRmN8KOCuv?rhcS|x?^|hqT!2p)@t}J3nshggx>8q&K&cO&FbF@Q^*esm2XdGMF<@ZXf#cnkxF^fOInwDy&5@29GcgeFBG$6X=kWTCAlfs^L8?jfqSXzX7qxEQyr^{}=S8iX zIxlK&aQb4pL~?C*vp11f-0D!(_yzOP9Z@hR-6;ig(j8PVC*4^EbK;J}HwDCob#FMe zmo62mI<8L9#=#@#x?J)hlO^Tf&a2D1q0&}C~iy%UHsR+!uN7M0jI^=f;9wdIX4~Bv(po{Q7_C#_^k^VFIE`j7M#40zA|h%UmEe&{TjcZv1|3`0 zO{WSXHm6eyV{lHVE+RUoQwtuRBe6}=-k?$Ydxa*cm&uJtgg|a|MyKUQEzF!79XHI{ zc%~~p3_s$>2leGm9k@K*dW02(ZJFSg%w8P}%XsBIl)PdmjOi6eqnW+pD;(ezNA8-j zc%}vSam_yNg*^;b)po;1tIBg*)qx%(Jy{H*Y&lU}A;OKtm1A^nais~D7gr7s1UlD6 ze5toPyWt;%0<8CBE5&=FFvA;9Z-6a2$qlWt64ZE6UR^5fNisdcMc_=2d}BaOj}{`( zrbj*xKnU|rm$%>;e{#YyCY!?eh_EPFC8LK6W+w=gGI~T-;+jsz8&6bI`4-G+*v>Wrl9km+M(jYN!dSTnVSs3k_HzQ%w zyjgI2lFdu21Mq_Dx;%L)3oN{1$JL`c1(RdA{dfNU&WC}~;rZ~e_IN&=j4scI2REw8 zNx3s~c6z@2xPp+8m4)oZ+w6xTA#lMtai@{n%N-?+_W2hK1M06E{J9jJGak+9U znGtp4S1GR-g|~2QQP>+jTNEL}wMAjieM=LyG->0Mt<_d56G=bhLEFyndH&i!kHpe^ z54|_2Dk5)h(AF5pdxOrRUF;3o@@7W6?kZ`#CWZPQ*W@fl34537irML6<2^rG%vRsK zH0MT7CEdg}jsb_plk~ARzdyK`%&5tu2bqi1zXZ-_Q)psC-zk(R68sbjHRkCl6fM&2 z6bj{$1TzoxNld#N3DbyEdT^6Q3B9*4OxR2J6~z=GVx^c;jKNV%St1&WDTTYAbefAu zpIJO{=Bzt45_u(4N#_vHo+nK)ZA{vapCE5-StpY=y zKBZlzRcBc|5po<9Pl`DRiYH5sfZ|CpxZln15a!X7pvvNU0krE^tzt`1nb@1$F0dX+ zuyMKPa!l^_T!L_Q7d|-@f~PIl+AYVVzcL#}$@~E=E6ZAD{vykfonK^8<|rt#Ksg+W zEK0-$t|rJgG&rqguVEP-oFbn<kY&Fjn0yov6B73Z?3u z@qu_^gYEOuu*6?})Q*U7Nn$X8ODan^w_o8WgK@o;dRe{eia9ySkX zD_}=_avtzkR{AR&+M@yX%g?~NbSjyWS5nJ4e`=%&CrnZGjQ*Pr>$6jR9>H1la)W!mnl0u>@pk{-#zMT;`3t@*x(Xg8OvmF5Kw( z{J025=10#B$luBAx*oU>j`}v^LRbi67Q)47(n5F%!xqAYo0sfg=-Re6ts%!K(>Ki& z#w|b%qiqXdB}`iY6K+|peQan`fSV>YmVqVdBiS+lj-Qn`*A~P?*talcj3zFO8{ZeO zFfQ`8frW7rUN4LfcRbyRuaf+bTnIIwx^I*htb~)i;AV7<7d&}O_JWt(p1t5Fg2fANJVa>VRnf*>IAe<@?lEt!xYVJ! z?25AV_4#lS5nZ4<#$YaxorskJ8R^!pl>2>{Gt1Wd!(FL(?Ka#L*uMPDbH*v%Uh5X%7&}6X$&6LN#>`IwgPU$v{l*)X?3b+{9uYB zk@UkZ`<`*6KmU5kk?IJ0?|ZDHmmGzoN5>0sbiK*Z9`TbL?GZ=G(H?P>9PJTDsv~i< zM;y7MrSXUB?2=`mmLDHoA$l)r-p{)UbK*?Ah{)D2aNTdQn`9`qNS%)GHrGcxKl2f)*0Tl zH06?Mou@-G4{ZK6d-`KW0bw0A&cSyl1~+@rUUbG>Wwp1@H|u2Y|2^Ssp|l5gdHQcb zG=S*)w5SWcl5(*is}Xh=u(WT3YF=j?XINKda8)oUzm?4HvQDlwndmLLT6>Jn=)5|AOKL4F z`h{h2!2pXK()k6$^}URN`U1urNOUo^u-VV%Bw1+(?+X~zV250?@Hzmg+|4cxL`~+*=o~WB>f_tQT#wNcpkV49DON5%{#M zn+_8nwY&} zsHV$u2PxzVsl7Q-V1k?db}5_$CN3hm}R+4AK3`GNT;T3 z!y~V>;F=d#%qj(#nXoqErnzS))fyV9SU#LhUl-#zNg};I-0BfGi!EL3Z=JL8a+8Cc>m#K@cWKC( zou>-rl8mNMEq5tt3Ki0$+MJl2wQ!r8a^b?2aZFDx80MFu@?y+YwoFpa9COK2xpC5! za!6I`RxxM>n~`4IfD}cPY#b(;_IBOFEk-72Tz_X;Mya z5#}`KMkBY$E_YsBF~^kWnr(iGuK@O3earOchHoxOFdu%pf)1%r-Qy_#ROp6}lyF?6 zLN^@UWE(epB+cBVLN`o{pj^K! zsdOfg7#SU=b8K`wC!A?Bt_{eYSbs(cO_Dn~&2jJyP=4h4Qxy4;Q|a(1M1JIUX73uv zjOK55m(;d~cS&z+d6)FIrguqiYkQaUy7B#Wl|7+UawxHuZRyX2%G7NZTcFe(7F!gL3u&osU2$dFEz_M6vAnv5 z4CeQT>K#JfwnvvTcup+rvQbV<>{3!rOziSfPE72QQ%+1|*N8pr8Vq|ZHpn}7+CPen z`!l*DmGTI5$+-$PrG`9sNUc2&YTayFQ%>qzEFjO1UNT_5DwwR8FC)p6`LfXMsq7Ae zyZt%F(@Gp3f=yvCsz0*`MEHcg9bHvGYm=78s@u^NQ=sIrDXXN(#Zx9(iis(c$%Dvt z7og&~*WA5Y?RHdb`P=~3TPE7I2)&=pzH6pC79!FMQN$R#h4A9L>=nX8-d(Q{KB8q5 z!iBp!`!&RB zws1~zyDglX2#>;f@t~lA=D2I6d&gQdWluSCrKOD*a2tTEU0aqd7INny;|jQFr;ysNFuk*_9-n_ z23!TZjcsj`BAuAUZR8@-9vOu(;i}l~>Y7y-vNLXjyNz*kVx~`=d#M}zw(1Q#svYd$ z<_$YK!S5M6;Z~a+S6z9c-sn~@m`QH+f}Q@$$fhwb*hy~nf}P}6FW7OnN_QMNfeYI^&nCRgBd6?{wJ?rcNrydGbJLZiUwNm_B5i_& ze*&x}FT5;j-IOW0DVEABYgh)_+W?P~hrqkZcus5ovysv9kHxb6Y=m?KlLw(bzRa(N z7Hj;osVYpWb;Xm=5HR<-00R7)s638-}|1D#wWR z@-iG-oS`f#^oE^eK#vqO^$Z^Il|17SN8L451=vy=!PgbaM{-7?tV~`gl%Zt)LRsl{ z_iNGQSUjE4=nS5H4$+$Fj}X>lF#FV_kHX-GR(QEuv)q8DMY!bQX_0RVi)qn9jOL~z z0MtR=bZ8*8rD?H0Z-DCHZ0arHFjAZ@Ww>eToO^$p`)|7^N*#wL?s!R=!wc1<5cGnb zZZ^BFIeR5@7~|x`OfsA&%9&EACtM|ec*0M2h+Su$-G**PHtx7cE+|YLlkE#*CmFpk zM!L1};UsvHe@GihjVCi&s{eh}0lS+|+d0a-7&xn7+M~n0aA#6otX~VK;l5B?7mp3% zdp*Q5QJ7TIy3_HvmP`%C1MuHyECKH+fhRMgQJOGuI+dQWZ%(lxHjD(6d<>sej%%6C zqj7j`qXiq81(`|3l#;h5hNqt2nbnir2hWbfFnoL)nD$9$*Q%;( z0&p+8AwG~vr32Pb#rW0`*=OLc;A*YeNqChyg5P^|mQtW!+k4bDCEUG9c`3c`O=?@U zNqDVOCHWQ!ezv_)_fCFxVFWQ{MjZ=kvVA1^WV^KI*Xzrnm!;hu`}$0LeiAi6a1d zSF|qx{sRL*zXgEDfauT*XP&jOfz&9xn0gc*(1r}>Y7*MxOh|kIJf~|s2(RYV!$Dnf z#dX?esLWs>VBWk!52<_x6_K9K%xG(DG|(C!OvKF7=APU(x)V~sje$D>(%?5szn=rY z!td;I5Jp-EvlDL??rz=O3E7)nP}tbYoqePTqOREI1V~B5Dsnr>cYL$Y306Nh=U^4; z1lkhd>3E3F+y|LCh})Nr5~-xTDZi;D>~lg+gA1>_WqoK==x95?Mv>!i+MN*AM;C3p z>`n_~PdKGj)!mw3ehY8P;D|SjPlXh1#Op>#LBlOK0wgbGZCbAR$vu6(U5smCg>*4) zgzU{OD0IZ@#y(O6-BVO0y_Vo$&EkPd|6+Yt4#~(Ql1KkKI{)pF&7RDqzrB&74ip%ub&jWF7Z9274 z>)#ycJ!cqpWE_lXv6{+7m9g5Ip_-~iOP1Bt4%IBGU9zM$)?YI?SRJpdJ~t51nzdE> z!@SuZV1zn~-y(pH-*n)LOkAa23GWPP&RP2TK0oa>arF3(sE*wKydx?^{X=v4JEB6= zLp5Yh>>W`d>Y;Z~g{X&W-)SCt2USSwgo4AvDR>Mw4$I-|gMl8cAwCovAI@lc*OW=e z5}7gi#_qfz_MpZk`~@x0j6%>(>_N zKDu?s*`l3`c^|jK^=zW{Vq@ghy}X0%Q9vi~4z@~Osrnsk4`V_diI0rHTMlp)ViZ3# ztC86T@_(h(O}9HDqbPjbIm_%qwqMQMrzrQ+gDwX1d{i%J5{=ymkeRJQs_4BEd6=RnIuP%Qr#HmY^2%&l#R4kl zimk4$U*kV)Xd|)YINYCY*65yN5Os;Q$@pNvgC9-2twk(j(_+a%EtMXHy=S$x z8-W^98?Cu|8eP#1g~g zrcAye!(H4U2}iZ&YKxyjb0N(pRvAk$u@QG-ok)e)ao9CfExA%mN;N_ka zcYUvyui>`t^}YDR`EVS53RVo@2{-ws#1n?*QN1T@Y`vL>fx$^M=i0b{bP& zdqWI5Y=(CG{4u5e7#)PSI{A&yNbhSOZlA|1PWv!Ex3JG2)8!A^KKA*8?KYqDn8fS$ z;oabB-&QkLk6F34iu{%N>MwCYQ6q zzE~i8-^v+@oacDE=$&(@CQ}>>p3UTYZHIk%VVd%S2NMtbVgcUh3BRls@DM5;sYw0g z6z2ucZX)D|*5zEA<9z^QQ^)|$tVuST$`o?fS@2Bh9{##l2s`@)4T|p6DtfTwwlFrB z$)pqgD8)6KbuzPxnF*pqm;TjZApC7K%DLkMCzq(jyZ!JbQj^Q&u# z_PFXuOC*O@Qo@h?t6y;07Zsu*~A* zi(G~%vtmpQe4 zB6ha8tSW5@0L?ARt<+zlb!{HY#78XTW6i2tT3ef%LctY*x|+I0v?^nk1mKNY@P_#! z@rcbO?iDkYT1l(xP)BpITE*H*y=hxiQx#ze02vnLRzj9&P4Q$r&3&xl#ye|Muy?WS zY_#Z-hEPj=TWd>OU@aw}M%AJzh@5zgIYOteHZfS*($W-aZ)s@>Bp3;BFpvl8YU}Do zVE>%hT3GSu%(^FB9|XtcJGiO|L;~jrYFE}b)RT0lHR5_pcz$CnZc-h#AquxNN88&P znrTC(>ntG~$426$7K7SAG82GzgR>Qw#CnyHAYn~ca>`evj-)cw*3niUjD!Nzpk%eD zQ4L_s*MT-r?W%h#8N=!Tm0|!85fU9=KWb0N5xk!ofWD;| zTU#3&bW&)9HIRAx6Pdb2W3Z|f%|ftEfyUP6#z-hiqJoG)EQ&UR8w2g_k@nX5_C|$q zJT)Y+(3}@RR9NdynzX}Z-mI;u)ploxfu?7DNoswt)#3Tr#v8(o!Jd|Gt-YhCOAGci zMBBBF&i2M=OPD@hQj>RdllX(c<`N>+i)*#sXhYa@2@nc4i+Ok)*}VOSU#|0q*2Txx zCDQRwEE8~e6>>T=K!+mWrX?Nmcp6^Oos18Nt$UFp>s&2*5xs}Cy2d?k>h4shTU-Wz zn@S~Di}4gsRM2o>F*gjWVa6rRHxA=%Pf0yXI0?^}?#PzrNVbHIYISKepZAXs<*Ftf zLO2pCtBj%2eA7=64D?nRYYf8?s*1fHS=cF-D1aTa5N52!?JFWpEe#zlkdQ;sBGedY4MiI}LTwRD6qqs9_JAdI{z$uCN)_aRfg#vnh(Ok_ zI0v8`BE{%1FmRS+AAD|P$uSGo#n7`MQzAud8sr>zdGS)}FM=*NUQ)zCbTu}vXbLv0 zXt#GZbgC`*>_-C*M`+&~st<(P+hApXLnP1@&tyOq9M}V>ZV_xXz;`{btAsH>K48M> z>Kg;~t#Dsk58EBoElR*`?HD{%2u~IwJ$Yz@4X8;ZHo$FgM=%uaXouV2_@+_F$8oq@ zwU7f+^z>}Xn0j(HUlG*_gP`_ELlD%GD`2UkUY(XeN2s}@G2GS|z^X!3QkYrv>kajR z)?jM~3~cd6-nj;eq)rx!1Ue!uZ7bRuRtW13jE`kfBXx_Sp)lOA^GS^{l&cdiZEgt$ zo1l}&1QNnaqZu;9Ab7!agjbk-k_gU5BcP)nex zp`$4jZEdj+zO}K;x_BD-3cAKXs4>{l5$p&BLhztx0@kI+K?a4AP>K!1ZNnf;X~2Cm zkG)WHpe58+-_X(E9P6F&kyIw$pwrd21tLvtk!Vw6qwq$WfYh4un?Vx0QAnvR&5fas z)<9=!mHZ}ZsTAT@%Bnfm5HeN*F##-{pkAULS%Kfrwe{eti=P_zZxnj@j6PyoA% zxz0kCQ)|<>!7De((r8CpG}zP@)M@ogi^B~onwwTMVAmS!hv)J*O?`c!Bih*7 z+EL#cSQpz6uUkg*<+9Y!5DW@*78M3_rK7Tm?k6|W8@cz8laq55$ zBj4rP{Xi1 z>qo^q#=!rOMSoytT)bs$Va;^PLvo6gZ!USgn2pw`nirHx@38z}*A0A}+ zMl7wFDCN~5@^WpicVWaTu8D-g^iCSAV0TX>SH0S` z09tjqk~s;|t1qS*Y;KK|oTV7SC8^OAF3EJ?(t71YWj0Gr%Zv0acEZR&!= zU^>?nW(&C{)eS-8&~ZZBO(&JbmPVtvmTE9fj&x=N<;Xxc6NVnP*DUqqV@Nv6qRHGP zsnJ9($qWX{iOOuAT*=MdRu%(Mb#=3XRauu|OQ)nl^Uo*K;t5+!8q%Z%WDmAXgPX+iBCDXoHKDEpsMhqW z1kYtPrYlUOO}P+f1E{t5by^o@agB+yy&?qKLeR8iftS8`hjwb*vR2oaSo=#tu05vK zVvUksSBq=hn_Z@bT=a^NX-iydUV5cVG+$x@?Jfv;c8FTLnNNA5jAUs?AoqkLh+D^L zJ(tN&*}=70mSJ)8kp>#Ywr;x^Os|GBj90`BO1L14nv`j+-6}8Y1LG1fU18$|uA+6h zq?9$Fc8KilM<)H%)n-Hw^Hr{h`3lp-?t)Oo7Qtu4v`{)jRwNI`@fQ$zatM6eV|khD zWqFYs$)2y!&VfO#<%&4E^0~)&jVojIphtOxO_t~6K`26 zq+4Frh4cAvE9v~2Q9Lg<$XAQa3aHm1S{)Vwc9O+<=5>Nhq%|$QC;{yh2!R>>3;FLi?pAv7^vx399+Hnd|aSv zzu?@FZvQhEFRH4Lj;bX~mn~boxT<=IR0yY4m6eMZFRrMlsjjN2C70IhKe+V<-UHr`EfSY?P#n{O$h08}W3`JVk_i4Cz4B*~i*xB&EkgLYaxySi@E8v5NDp$pI17?jS zPWbm?;PF1d{4opeG{F58Fh{-{rP}-L8n|`_VE!u$?iIlO7%+ELzzG~^C%gLossdsf zK6p6Q_xTE+?{)a#;e;zW-sd|AK4zS-%OP;_T?|8!vVH=G?fMkJRcGOc^*hG}zxM&I z&IN8W;J)ethY4xH0-x_j_~20jA3HmL3NT+X;x^&V(u9Z zg5NEG`I-^8AvK)oA11os*9`dlgkki;qo6-B$VEH<)PS?I^W%W~y-}`#AKK+#fGPJ= zsipA8j^9GSoMprr_@P}^17@8OXJMDEfccOSXJMDy8HQ>I-!^u+!+^7^$31|1z$n*H z59p$Oe+10Gj5v#W9Cd=vcOrc7(Cug7hjwlN%xWXfg5L(fTy4Y|_@SLY2bkN9I17G1 z2h4AbI17Gn0H*9jtc6q$3w|d8rrL%3z;kODX?gU(#VX+<9`E4s;KE!Z# zcE-GWJ7B)2@GB1(+Y$QXVZi)B;b+F}2e`Kx22RNlC^zGde`ys5DCZW2fm3o2oT0vm z`@8{XRbT8c|DOS87gx6f?gtEOS6{T>ZvgXGBhJEa2c80P3LiY|_+cJe446hE&Vt_{ zU`CBN3%lIFFhnqZS>z2Iir)mdZ!)Y?9NY((hZ)YU9&>=-^MHAk;V3_I92^R`vQvG& zqv3-G5v&ui61aaRUFe#;0^>_Jz(0h;BeTy8ZehK zoLXPO4{V1^W&xxVPPQNUcoa8C931Ymw( z#0{)lKeo7*=z?FPGkv~C8AdPMALc?TD$Z;SMqA*q%xG6@usakvYk}6<71Dacoy)71 zRaP#rxE}2ecLuxLJGF*zeNU6t67CJREVn{-(#^7368-5|dh_zuZuY=pCoHvq9|wRp zn>TNX)}OUtIMF{aI+C%H80rMlZrms)+SRVDf(>1?u8uG~^BN6zb`jCB;Y>W8gr}`> zZ=$ob;D$}rtKhNCa1x(D9b9fKSQU@0?~M(Q$IaD)$I4UiBxqct%OEW)reo;SeFP&{ z1?m%O?Kae}y``Zo*c$FyPyx>Hy$qk9!smKl$vpH(=&Zh;v3Po{5BHwyYaJg;4D_{z zJDb9N&CMOF+WK1BR(CZtYhd=ya9ejD7^@Fs5O!0+$Kda&_OAquV2IAv`qa)*+h7<7kDeQx_5Xcw8PnW*4eCNz7>4#YH9qK#X_vr~3 z!LYxriGg%#EH#v=IJxtbigwr@a3patEEBB=!L!5gkTRy&mWc-c{K!O$zpSULcU7=E z*c)6G**5HdDst5eH^TMkOc(OrT0bAcxOfro2_oqE(&*&BBHNnEqZ6~D6PK3} zR!bt2J%5gD`N!N1XGGq!rE(h03r z{b0R`KL313LA{W9u7nGbNt!llc19paZHi33(lYsSWTM+Y8rgPU1kn&@KO?bq?e@9X z-T)+5UD5&pbVX(?Iyoycxv30|zYfZQ*RLbnTKttX61R2xE2EP?fBT6WIRiLpBaw4> zo?J+wXn zJ@h@)pPu5q`OisHTLNco@R{k0!}lOL+XUa#i(iH_{BNf3A^7efXHV#7(BwwpAL98k zI6)535Vu`dA(vtznCT0wBFzh|1abW)@z%t!f9d33SR`cpfqO}7d%&`_jUBkA=;!fdh&TbQ)GhG&{v`p zp-)72g?0l2u+|C^X9q)uif-%r%G>1_-0LEfAxMMUGc#X$I{=xjxeR;cipb;zaJkQa za%9VWWf6>8Vze94g=hSTcu(ZYV@$bne?3>~;e8klZxAj;w-VYd+ivz>35rH1FQ|x4 zj-4Ex{2z^EZ5qCp!X+4MK!803-!xR+g=Ht90&E4G=pj5nOCe_;2uj@pO~e;@drdh+ z#eL-jgl%XI0o82ZfyOAKQGqf28*a_U$k{&~UxZ12@`<;hYnW(S3PvP`J`GDvT>%C% zjn>FS`_jm+`lTQOoFf(Y`OBH4pzN9;xaYj`xpx8c-)0&j6B&P{MLRkad#yvDW$EpR zlym|y5X`-67m8ZSG{93VBCSWSA~aj*&lK5FLs*DtINcZx&OK)zv}Nd^v>kB!?TZoX z8nXy>SIMjyzFD0!D$zO@;TJn_h*1hb05de?tPH*}0hjs+MKz_s0U19qa3}>mLyC`( zvg7xg;oC2RX%p5akZ(H7pg6pXq-W)DMkx>#W=Q;F#rsoGUg|rZp*UaESjZO=C|~5+ z%qZ}W72nT6d8zN{GwkYl8M%&f=o!}YtE9}Xo)m}mq-R)9N@1+074O?9Z}`STuBVVM zBv8J_dRp=Q4ses|iT#d``UuZ_zRTf5{YlTTp7)Zn@b}QQOCiDAM`rfk)9#{o$vvlV!RBN5p6gHUZpry3Z+0)H+=X(kt%PzucPrIYocO= z1j-kA4sxdO*NX3>I$s2GTiEfvm!Od+u5#gr72jXO#Zup?=gg~^l)YYwbDpo3GwuOx7~fnbk;?>~_<`10XuFMeDJC)Ahp46XSLDLWay$${u+;Zy3{ z55Au#XS2}OzN<>l!9T&$bMem%_*@8|Qr{f?4Bd^lnjqrUnUBw6Er;k>0mb}a5crp# zp%#CIkD61C1e`?wn`e`oC2>>9M*!KVJ#>HqSnKQA6C4Nr@R@2^F@mb`9cEai##`TraDrk zIf?K+v?hGyf?2*p2M_lhT6>u9&{q!B&5q3vRow`mQZfa-n2^A~zE|*z9oN8LY7lyc zRjwpR#q`Ta5t{xSaz>lZ?pov$=qKOkhB$mm$vyS}Im6K>b69b7 zUPz%7h{7zv4|-kY-9~u>MAk&b2nm!g@{}8f72j^1FG}YYwBt)Hh&-=BI6JKPo=^DJ zHXixzS-$exBYfqr%-KDAbk-V9V~(f=$Mo4^EXYXFeLC$rLW@l&LC&zJ#oSZktAOtoat2?@vC!_>aDw^(;mrx) zAN@e*ehLao^%8#a8B;0V7vj|bhe&@vLeQw`$H^IdWj#>#7YG{b`XzFPX#%Zi)(2}C z9fAs`OlQCFV!!u9js*{}|>CT4an=nwV!0UjQ& z1&c3~P3h3nw9e>hY*R1_v!E~*A%~p=jU0B7Gvt7+#yVEak1h2$+K@bsPQj0jq{M}Kj|OzW(w@ zfB01673;s)cgdOiU)Vgm_1DMp@;83+!6hf$eB!KQSAX^2H_SP$&wu078^3nL*00Vu z>PwGg=FYm}yFYv3g_m!?JoBjsuio|He@;9*aAyB~OK;uyt6xS>dC$5HfBCONYc8%@ zddA@u58e8K$DZ5ot$Q|}`G0@x{r+)xzjELItsJ@L^3NIZ_bff);bVFmpZNPrOJ4cr zo$qgc`111L^B>;5vU!*PZ~yh^PhVa7g+I^#=!NsX^T@Z)8Tn%OjO}ZGarb9Wef0U2 zT;9K58a&`f6R-AH{QQvT4~$IwUA5Ccf7_)8y#FiTz50X|pZMI} zSI1}EeBw#p-1@WQZn>+iXZLM~UH^;!+j-2#fAU)Vfd~HkyZO?6`Sl-t@XG#8ANl2} zbJzdjZ;!3H`hnely?D*Qh6SJc?H8*1zqInm)8@1`ZftvQ?Y}>8`r?V5Ww)*U(P>++ z*nVf@u^TV?O52?W^=^H8+3V%e-Ipx7<^Ij9zkmCi&;Re|Z~6SkhW~om|2y->u8UjG zIBIx#>CcA4rGtZCJ~H;jv#t!k`1E(HFI*IxvGf<$H{bV*PdxtI#?32lyJJ!3=l*=_ z{H;Ib_4vn{E%%=`c-nux_rJez@Lj){*Z<@RHy!!g&tCmR;MymjJ^qM~?0oUw-G7_? zk3an8eLG&>HU9(8e`fcCKYQu0Yv#;fxGeeTHLJ8!xV-OwbN$VCt$65$$*Ycj@qG_1 zxYhU80V{jnI%y(t=?}iUZRXZrF7N2tV-YD zrr@7WyMF7^2amb+8{JzzctvW<E|q4*4(i0*gtEZ<@WvRL*KY~u(mtAE%U~eTW|c@(~;wR zC;a)_uYUOHs+TXHJnQd=b3Jx$KJ^bh%huf6`sKIEPCx14+qgY1{p;s%I_|-r-m)y* z=WqGNFMt0;b7I3|TQ03IUg!UR_pjx1)~)>QDNCBl-hTa}&-{x2J-znl$G&p*mg`fM zf4F`B!$0-m1uvZS%=?4?^XA^cLzxx-y1s6X2;+?UBf6}pe=ekR`%-a2(Ki~VAQ@(cU zN3-$cd>_ouy|J9UvAU!GUU&dm!GgP)$*uLOJfQeR*w9?LAOth}+L%kU| z43d0HOXMfaFw2#e;4^0GAwOM)xwN$8NfiM9$xoJHHZLu~3@Q$ugLx@pX87di%t~Wl2N{FIc7eI>;O1M+nArqV0pG~y ztOLF{OUBUWVQ?&2TG9;Pc-+F?hAK1ZPpvPHVTF0Or9nSr*nho2-Kf1~o@ni$8p8+RO)U9ECprd&Oa4GY01h zMcx1Lf0x1SwNW4J#Y;dHUQB zJs@K?K^d-EKt9~>L)X99c!($whyfr&Jzipv0n2{^*Tzy zV7<(kqZLf~!#}K*F|=OC5DZ!ykAa;}{K>5Iv2dld1fv@5b9(vKSIwB?2!{J~+q>_1 z(TsUF!MqQ?@p$Tl4JVp06>z1rgwMv5{{1@OgHq-AIi6tf78|cz_xev>moe0a3kZhC z2HNL%VnZmFW{oR|H{oeMEG7ppSHCO-c(mCP>T zMO@YitfWlm6JsTF^^%)e$>Dm*?^uZsN)jbqz*H~b0({3|_`)$$r@D!il+6lnTu%) zjwAFEm``H|S_4}_2`|w9ev)DK11f5mqcLs6aj0JMc~)|yUNRq>CL9a&k``7nOD}nZ zmCV*lIni?p; zo(-Y1d|0xWLG+U9MXUrXOfc2etOR=^N`-vzz#Ps>meSuUFd%42Eh7^pl}G{y_Er?L zjQsEO9nVW@m#~rwUb2LjU=F8LAc`EA`ANy5S~$aA3o|M$;hgo7YAzjJLir#S9+)9X zNj0w*W-wC1*+4{LiTn)Md!VGWgoTA~%fP`uI6%*Jbl%wKBN(6j1goD=A%BdtgKzrB z8bQ^I#c&XeBI^Vw6|%nYm8V`U(`9{;Q4x$H>qJ7uWqsq2il+qCbBu~$6j>(`D$;|) z*;Fpx}G~!P+i2R2u6{03ZWvS7dQ*Nv2l%{`Yxj) z7)92pimVHcTk^D^`X{3z7~ewanTyj16-%JL7eD^o3zSL&3=G4`K`@GjrxPmfWwiWU z-SPn(zQI8-iiT%EsjvoGUQlgeR0N~QT1cp5%L}R>Gb(~nWSyzVLdy%PIoM?3AQ(j! zwuaIY+46#_l~EClBCCo}@rXjp3#ywK6~QQ$$3#$CB3qtP$(AP=MMG?hBIawJ+wbbb zb<6*X$s!ml`Q* z^*Zx6JC6`l!;Fexl!(G{qKK&5Zl4*TRB}WSjH2PWgsK9*F&4u;%XZT{P58(6T_%fQ z6bY#^>s!?FbY+OQ1Q(6&j;6kPf(qV9XlKZqgbN> zN`*Cg`!~EPsP1G`1f$3b6DlqXvuL?qujSaa!a*>KtVSpmvV5n$Iv}XlGAe>mWHk{g zZo{K*xb74|bt9u97)4e@k#+j)17m{f`;3ZU6j@P1g^d>T#tYlO@Ebw(zl@4t6j>`2 zS?~E(l_sd>;h+W%f>C0=8A?UWKRe#mL8;`JCm2P;7D9#Az&O0EbUZBX$j)K12u9Jc zl~C~vFmXrh$AT)ss0c=p)kdi1Fj*M$g6gA;ieMC~c0x59zDwZq%-E9wLA8@n5sX6B zL8#E`cpTUN>}Lhln~aKJ6dSGtte697{^)+NxeB%$*@gt8$m%3iXbn8BJZ`_gR_M`t zGIknp5R78OE+`ez+rIwJzX_@yMny1+tZqW3M{mb%{}xnNF)D&lWc4VrK6S&%e-Ko+ zF)D&lWc3m%9=%_<>W?b~)$bS;!6>p;DYAZ8|IA+m)d5GsMK}mXvHWT%6_%g%@DE?0 zRI=p>M$zy*LUjy$WAuJ;$#YxjTnhZ-TgGG&jH2QBa8+1-$)RmO6jWbjR0N~Q!aHR( zV+*SJN1;U6a|=Fdp6|nw5=`hAiyuB}Q@fzLj!_YeBI~_`3S%CRABW3(1=WnBX(_=d zHoOon2pi7+(bWMo}@d>IbMny1+ zEF9>I*m$MorV9mCj8PGcA}da)cuRS4@tcqZ6j`4>`?PXFbswW57)91v zMHY^u1l7xoieMC3>l9gwYY#a>P#u3PT!e#Ql!!_|spwNW-}O;HrII6xU=$7CN2pL0 zY?ZTq{KyCC>@NJ{TghY*jH2OsxGF5)HE_pDLG>u3A{a&1FrkwB6hYN?97^>02u7hA zfzr~FgWwxATs(Byn}X^QMny0RRgzHgR(aPO&s-*`dfyEf;UE}=Dg~wDJ_W}%bM*H0 z1fwDt#Tui8ipTts8=v}?pgN)gF2X@DimZ#El-dxlpYZT`C%jvi)m?#QbbbeNl(Z{B z8cK!b$9`~HP*8oT0%`bKPI-P~3`*5{9jMECy#i@`K7vtXWuR2Z!g>j+vyLZ3K7vu| zHBP8_jzSwAq073IQ4x$HYl9-oclj~@Pf$I`s0fCLJ$wO`j^FTWm-N*9Mkt|oNf<5k zn8p5{3{DGwB%IyE`iU| z-XDGl5%l;WP~m|XE{i^8eF>D%42e{?_`dd#p!yx7LX1jvDWSs1L@Ii4S#L5b#Hdu4 zK}l(epOpK2O&gv%OUOF>J(LS#RI1B$D(o*#il1=Wt*)uoIIF)9@(#HhFgLG>v{g&39UYC^@WvF6Z!eP2-B z&8QHgQf*PFJ~r_5=LOX>j0!P8C0XMdLe&W0XpLF3mhBQ$6{rFnh*4!-3njuDYHai| zD#WN%TM3nQY$lQ-w2$!wwo$j~>j;tfpD~)=Ot&64OgBre+*~RiX zt}1M%-<0$EMU;yUiW0rGaDfae%{3*}BRV#Lty8dVK`I%8w`&*V9`>Rj;%6I?x<$t_ zsnLK92=#&uqV%dWyX`8@r%aeV-94%8>%@po}{lm z@cVDzF&zI_?HQDHEbeAg_M3kpy7XfGCZm~diYJF~yi|(>gJ-lx2oG&wI5svGu#F9} zOjb8Lq{1=Cj3X)b0(Z9zq8RLcKk(_Tf;>kWPp)d~N?@MCT&S%bkEI6#y|C-~czP_c zA+C*#!&c-hm{rA*M#|&lO%0+s=*!E6gD4lhC2I}P+|sGd_}Y5Io9A7y3G=oNZ16=x zT4r5htUy*I<>sM_u^s1CA%)3cCY6TA`Rgj{>gp_-r5>+=B4pt}Z3K4Umo=D<_GHpx zYSOhytWDa{JpdU;qJfq;-9D?ToqiRl2Gbli)D=@6HZ`R3Qz%x`LYp=$CDcq$w9wYgKYmOxyka3ovdD-<8WD}d|ANG zV2Px^lA0-BCe$$&-if zlmc%cb=MTiM;NA1PQpBea-up_LmMiT6V=HJPE@BF&vf#F6V<8KGo8HPqzCv^kBohK zlbCwRu%jf|n;JYZ^}=!A%XkkNCbY&zr$vRtXf@GdT7>h6BR56UI>6=;xCdy$jZ#mH@W>rcS5V58bgJ&Sx`OiRySPErE#L|(TDmK^v2D5{60OM_I*phsa|zewpRCqHT~+_T@cxIW%7`sPi5xit&!48VPZVc?V;R{U^9^iwWyj{~l25v-?QOnIsG#WmdYz;&;!fH{xh z)Ox760l=gzal(G*0Kd(E`3}R`*$;8Q0LFa65jb4y-@Y8)+yWmwRNUr4T1xllZaf#>=msA= zX2VDDQ*kruAQ!<04;3fk`4G5vFT)TZd>$ep!AF{-${B8!! zQ4QJo`2kaDiBtKV1(>@nacX_<2h7hcae^N{ck?7*dcxWD(*U#H5-0efKgI#`H%pwV z-@gGfr_oBT%I{FX++>MU`F$ENU$(>veti&d{{@(XB2?}y_+uA;QNZ*toL!tA3-lUb zF15r7x%UEYD_|O;RPKHbayJ0xYKF6ui|yljzDEz+qQk)b9+2Awc-Dv)>}X1+(x&{WO>S)&p*17JjJTM_uy! z4B)=%g5NHe{2l?^Z(Z7RU$i!NblUhrzYe08?kgk)K8gDfv1OzTXR&gb`fKRGPk7><7Xg8^q3SI+_N??$SUKHz$`c74E)f}7XT(@#97#78(=O1J0_x*nY`N zCGjsi?CM+A0pol4;9*x^v|lw~8jU!MI2Z)Xs1awdUper*0Wh~1aTff30GOW`aR$4f zKmV6u;FKN~ae(dZS;VcR5T`ge3@{Z8XJ;3TgL47Xr0_Gx0p9;z0GNJ;!|@gIufZ-T zXP9B&lpI!ZfVh+aXB7un-!$N^V_2v9-U67fF`QF z->rbVg<+lQdk0|dWjLq$J`I>ZDg3PK`zB(#Xf2%TyFbHZtM5SuoLzm(0e3RPI@R|a zz(g3%slG#iNh$oS>$?Ro*D;(^eLuo5+3Ndo1J16#p90(+4C_?i2LSUp!#UOWCBVF? z@UyP(LEX@f;Dd)#eUD=pinMRP#~W~V_4Nbp9ENqOZwFxd7|yA_7XxOC!q2+C9|z1W z4ChqeuP{uu`hMMjv#am70QUgHI@R|#fcamBbE@ym9vFAP2M@~6y1vH)=46I*s&6&J zP>%NgU1Y#n)%P%9vJ`MF4C_?iHGmmrIH&qv2bd2l{H*KyWx#xk;hgGwH^XGB@AnNj ztNLR9doSRA&9F}O{R?1TV>qY!9@gvg9Sa{k?EHH$T&n_1T^1b9FLf~t^25V!ys_GV zv#M_e&|d(!OBA`40eLSelyM+@J_wjkGn`X>zXzE66@F&_BEMe)=D)MxaJ=>!!@wyy ztj1wDetz48v#!VNRdD|XA3XGW7{;eKe^|vZ1c+ZpRVX`HVG+t*V!+vr+v@<=Y?Nyl zPh$Kf0CSZQXEDzHEMUHF#2NTu`+X2Fzcb=2`27jH_A2C1NqH4 zkBZ~pcKqf6?pTJkvorEL+aG&w@J~aJv}>PRT*! z(w*LT5qZDH-vM{zdub6JPX@Nr`9J?A4)nvxdjQkKaCE!|^(Ap7aK`}d0>Er^ftv)( zml=-Q8Tc9WI}`Z*7%;CgoRfZU0cOF4RAXH~13#?CV!)iwa8CRN0rLSPKSLZ~KDZe$ z-*AE34wy%?;3B~9kAOK{qxHaX9`RfM*cdIL-vRj_c7CM~{ASSaWVp5!czuiU!*Q}z z{9!$IGYn%V;piTkSdR9432=w4!T)&s;BhZ-nD49Cz&tB_@L+ak?L*+Oop-E(Tm&CH z>~JV|XbsF;zy}ZAzofo`AL4FV1MLGoc<6Cuz@dJ-*Faps2M;^B7|(C5fvzBiD0_Y= zcPU`{7|uz*QNVm83l8=B3SfS~a3%1+@SCVF;vN9ZZy3%=?q30ONIww3q1%PF4?VU{ zg=>|7IiKN}TozZV+(E!>QgN34y&5n#WWk~RJ^`2?Fx(9I->SZddlWFQGMrsKP6XT` z1K<<*;Net{dcgFmI8!}P?i#>c!*Da?rY0hmV_&Z!=M1Wef=YA40B!5;y*b_`(p z7>?GX!_pr^fVo(~ncF3{w`%}%V-}nraGwIqy$t76kH-P?nh|HH#{%HDe;o1}eDHAc z$6~;&P;n-IVBB{DW*x&h>31n$KIa1WZNNNf#2M;w4#<50FeeXTEu8C74VXq1XQ~Iu ze}L)Bg7br{A;4V6a8C8T1u*x!!2KF9|6sUM;BObt^Vh;WCVcR4!krJ8%Z)gL{mup+ zHv{GghI5L8KLFn?I+otNytP~Ff~_wS1D&wPU~DW7yc@!e!Jd}xmT3K13x*T@1EV7uD~V8R zt*g5s+O9>r+O<{DhOpMv5e`Kgqv6gjB04sliKmmWuSODf?mEl34exSe!K!#{eQ#`d zJZ`RDESXH<1|1sR8`rX8I%Y$B0QMHN#AqEIE#1McW-ZutURy|OX>V$ZwlyuUvZ&wa z=x`=Bwq6^HZGinXhj8;TEjd2YA5V`h2QC_6(-rIuYmJ@3*02_8?`i8cSPx7XYBd(N zw=}c?LDzzcnGggo!)GUaw)#ru!5?4ftiGNxkkN-b1NXI#k0l2BTEm@9;lAePj#X`a zEp4m28k#lmbZ5A&yAS-+hs_e6`b{R|!+r38YG40&Vt7z4Jp-Q_O$;m?Or-mmoBPJn z12SYG5H5sgdVFX3&Y4%z51k&oB=U6MrzfB}vcIi~fplstHI%71x$~5YcGwqpByn*f zxwayd8W~Lt$J0LQoQg~;RWY1OuJw&1l8A~guc|zIB(@0*nU1ZE_a`!GaOLu4iz_QD z&mMyiiKmuVojo?1PK|=5?BDURcp}*kyS)v?2bNd);NlR-IAb`zAwGOYVsLqFb-c1_ z=NpC&__C`%@j1K}EUu4S*OC#4lI6k{( zdt}Sbr8^>5y@}7Qq)&}(3!W4?`@RjQMkasqEII=IMy}nSsfcXZeo|!1?%k1z$QzUd z=$=Cafjtzic`&l8!C!$T;hOC=kJmg%FPsPkpMcLyUqnB{l{dGMGR)PVCTBz?CjEGW z^mm!0XAz1qM1|tr78Ql!nW%|Af7vP!SP_~0O?2{&$Z1bSCLe2=+!2|4gfNb5n|XF* zvd>=$HLcKg91E2Hf)7-|NICgfWb$WLH1E=BS|(?Jl_yFf6Tz}pFy;KnWPKUhbmmKM z2g=AlaHRzRllSd-AXxEs%j8cZbMLLMXqmhZ>RpnFg=-#M9QKQ9p&K)2TK{LGr|5K6$mA~Mn7KRL3k8_u@1 z&u7Nlk8+$H*~ZSAz)lwekKblazxQo8CLefd?tP&$u*3M#k;zgp``hJEGIrpWw@Sw6 zu#yh2=PqzsrFP*3I~D@VF!b&-eVgIzJMfw5yAr-5r0hC4YbIxr$?I0bKO~sT;N&j& zfU763>yS&oOG*P>G;APX?vHH4B}6`S%C;^r!vT?Pk+Qk-W~em+O?O}zU9bb)ax9T} z0-SvYJ~PS7CEr8Jioy9rT0dseT|pcQfZKxLL1twVbb#`mLZC;$86|SBj#KqGm-EWe zk&7b}m-;JzM7+7n(wmnYxaDotn?OLVCsf{n`gRh1b^at!3gYh}D`>qzOqeB^x!7*! zUJLrt@Y;ci=??hJB(I!(gq$(S%q5dgVXoM6-+WPF8c>rL6mCQqYO(M?3eITwFMzW< zi6ZyIMG+WV?kgir0KGKpU}a@Yn7y$?Sg*rU7Pb z)@IRQG}Mk0?ViQWUWu78DBzDpmv^<^Mfr=9am8w}A3{p7;H~^U2+vJ@@-P z=ggV8)9&4k9)Xi^)b|nmk79R!+wArWBG(snt%xLbd!j{9P(+I$m;RUNFFn?B19klz zi;2;NqO0_6$H-QhdQh#5CDAR#TdXU(Wi66N$7(SU#&OmY2Pp*w(ga^+4{~M6p6K;k@FZi zdS+gnrL~yI(LSii6(F}8M5XJt& zDE2_3*dj;8ranj%TjV^3jEXH}BaK{+kt;@SCyq$hJiHpk?xy+ba&J+3DtZ=rBvBuy zU&k~{TX>4+#C0`aI;Om@x6s;PK6W??U3!z*O_j!>w~VdaA~3tglse#qxGL<6YNVCE z$n`=_Ts>*Xeaz*~G|mo{xytECsm+rVU0!e=s0ts)dSW<8=_V(T8VCZFpTWisExNJFVMba<90OOR5z||OQDX< zg?C<5Y>l9{4Hp77?w*Dd`GynJyU3o71Gtl}fZ-e^+ACa+!?LmxkwQew6;k?fv2O5< z{+$|1OV+ZKYPs#1O(w@+u0V@}&Fx@wudrKwV;nME=~2kY$-mMb;nFFtzhsQ!#=0#X zRf0C5(Y(y&)tSv;wowDbB&H-@6W&p$z7GeYV)O1}A+>vlrWHD1(d!V?10@N7Lm{^PNwtsq-9GQ=aH`e%>X*hyDN6-hCLhcZhnxnr*4qY=Wh|okh)NQO%A* z&3e3>sb=5Py=#e#(eD0E&1%@fK+Sfr*KFe;HB0McTeG8z{YZB%E|hcsiO{{TdlydV z0#@v~x@14ly$cXKUg^{uF*12r@`z*_=RE1Y!x_F)X-Quy*KdYz`tb~mh3Iysqr=0v zw8644fh0A)2>np>A{wNy`w$)L+UAL(v2>fKCJ(9l(xhre*(B@=O{#|@PFwt4NvifD zt-g`wYdsG~FWCr^=G(;$9D6zN5Zf*hZ{Q6<^2TKN-bnX-VATR%(A^B=4hUo21)6U+cR*un zmj1!Rc@>gmMd=;T9L@J+`~vb8*HN-Jd2I3+@7T?(b}7xMm*I%yf2k@~YY*VFm`PV4 z_isK+cj(^b+(_i!<{Ua$nxq?-q3HfS!%;hkz_+|2)O?vmB0`uRT)Fvt;Kevg-F`jZ zHyh4dW<|VZru4*@A14r0%|*R&Kr-SzLYePvnp23*MZ*WVj~Kn~u(tSgNjo!2gE&f! zG~b0-^Kq2C9Hr`-uPRBhqLyOEp>G`TIAFHAn>P!qvX!Hi`3+%wL-Q?rvX{!<*0uD*DEhjWARDndj7e3oU8;8je8uq8%uHiGpDpSO=u|070F-(X`8Z1G+# zI_>q%G%1PWNr}5kC0CWiO4Ke~)FPgpX(z&9 zi5#)g1uN3+io6aVk>dDOyi_(AB1eotfL`12<{AN zSdh-EbftKA(z}B7w!So$qCKQmQO$8R5_Ag1;1rGs{;9hs8A<2%(u+(rSW13~9L3-f zmbKI&_~cr{qRPlUD+r|9wYC$zuB?O?8cZVis~2?tCBjwdcx2qjhn}}y9vyH(Pc;1z z-GIoE*%w)6?FMuPofSATD{|C$1cOkyIP~PC`&FS^LUg@UY}3AJLFgr&Q+1^VQsr!6 zy*)EyqpP^0CscDqcZzaF52?YI2~o*QQ3ce*-(@t(uca56YO$2`iX4@87t53?c%Ma7 z1^YQyiFPww9tu9KNf7eMl^XXQ6`m(wu?kXP^`tgS$rF(yPd;Or;>lqaktatv7u1s) zh)H!Uule+$%G&VeGYVqVO+ete|PtG$u5jpat zg})~Wh9^k@JQ-i9VcN*>T5NAePtG?y5jpatyT2!W3{TSjz9)kXPp*MAJ=HNh5jpZ? zfWIfh3{OS|^@Jy?QLgGk#6*>>sNH#v;RW3&&{JK*3y~u)uJrd}qTxlJ-3!r?R~l96 zg3GdEW2?AgJJoT;?&X0cOShu-YBLQ_Uey73zrgTBh)5T{K}<>;=_b7YvJWUC=4obwTlY$72rGuBcg5V;q2->fu#% zy^WAtVmL`ZOQxrKhLa*kPA>F!@mpyT^mL>g z{y1Kp!w9Qk_>^P1L)#23xY*_O_ta0)C{ zn#j>mBv^!^onSpV>3=}zm$NM^gRBdNYDF+euXU~9r2Ao^8%V2Oii<$27KC2Xxe$k* zob*0n=p~dMi$HosEJ)|wx>CG5>3xRv_Pg9oE2usKJm1233wbfE5jpbzCFU?=ynxQK zFm@UYkt0Th$&fbYSs1$vhR6|PtI2S%L3a^_S0YD@oq}Om*G-00PZt^OOyr2M*R;_` z;9_++-kTT3%xGYp14dgYaRx=?i1Im8taCt}L1zVy8k@*blNJm@rQy(%I8PNW za>V{d=#~&&uZj_9vLN)5PU}+8N$+>87fV5&16IX+2XnzhG2gjWTBEn7MtMb!eEN;K z7k3>#$r`0L7FIKZC33_%%`9t^nrdOh8w`;nMrBNFu>C>JcD#UQS{RoY43Q&74Z*N& zm?T(OEew{(5i8b_)!M>pX|P0&SQj$O0`kj_0>aJ9i&Z%1=6UsloEu&+wV-fzL0s;f zoLoG;S!f*%{nWVT8hTdS^!Q^<$pnM-l#Mk$dqP}xadGzCxPsi-arwCglS(F=Jeg~c zAM7{W6aR9Z&m^!~E1Wi5=`)R8)5oNkbQA24fKZQbtjA z^x+&`1RXesjFPB4D7cpk?nS}9qTpv;wC-$%3jG8Qe6S_MARdg(@v}m`fS!T{u(x65 zVZi;Zkd8MY7VT^UKB1{Pq#F#(j(`{kT3DiOhHl!t747^D&QWx>aV`$8TRGPfudj2C zuFK7w>xS1Yob%xIdCuV_?6k}9;2=1{gU>lf9vtFa9A2N{oOpKKe1zILVt`r_H7wDX zspdw*UWALLBy^4APbRA-VvJSJ>Zoi#sonxSI>hpBUP8jE)rJM8WXZN@pXBW%wnyGl zpMXD^%$%5~Pf^b5DEs>~M$yGr#5ub7%o3rK=M=0&=9MEnBZ6M4U_A3$n4x&8+ax_y z@>$ARl3J7Sn*0}D>z1t;d!Dok>l9C6o#IJ7GyZIeu6)bCu`vIg4CB-e)M}lqT<559 zv7aNG0 zoBX7@#~$4c%X=V?t#uhrN%i`-sP@YS>IGdVsGivO9EnLA?!z6K>aCcnv-uEX9`-*+^jqxbV!YN}>;tcN66 z1&YE@b&100`t-$IUnv+Q-}~D>>v-$?TlgTRe7iWeaY;=5qB*s9#(YrwyjeegGfc-W z9lA5`y1}=7*gf-!ibWfzPfm`UbFB8i+O8<*RAc$+=dM~dvi;J1j~s0hd)0eY@0-)^ z!5YcUhRi?zaLsjH2TuKU;%5&Yp498g?aTKKY43Vz-`b+;hxe|V{_Ldcx6WVM%{}Al z^||+UxV7gGM-KdS-})ub9LTL(v~HCC-X*f;_6dW2ZZzOnRvn+#@{tcaes|3+nYn{s z+242m)Q88+i(mTj?8k4u{xSXi*oJ9COKP==eRJ%xh&IK&XRLec*s&kiURzTB`S;0p z-@K(%f4}0=+}f-DdSb=-Nmq63)~;^c&A=PW=D43 zm)`2)$+NzF=An0g-a2^N$5r&tV@JGo`@*ZsvjTmdFn9GEMNOJ6`7HC%+m=qdbIMPn zHfEM>ZCI@1?dR?KzqvE-@+ZGJaR2M`@0@z#;iSXOCwqU`KBm{kgP(U_vG#CrLR`@k z<0A8)tF7y^^9u%^9Nw^hr7w;y>ECYTh;D^RZRfwzY5LLq-P6XzXS}=b(?_fH9Q|@> z;amFoW0kknzGPmzd(QOy{`~bT-yZPm-p)f-e)CYh>)-tI_=Fm-mHje4ZufadYiecN zb^V|GGIC3Nz4EJTEO~U@b-)emS`hmj_uBmg=yWeeTboch( za<^{%V%^#DR-bt7mIdSI+_A59^wiIPerMcuTMvGJ)wrBl&F($0DslWHgX_1cmf3gq zz$26XyrFHEvMo_-CcW0?`uP>l^}T5J^hXCiS8K%er@NnsNk2HR^Zl>S9kp@o$)jIC zc>jZU<&W*(YGK92U$ovZ`QV?^M-6^CV#0*g^|K%DF{fxvpY>JdcDQ8li$5+dK7QLJ zzwOyr((hkKbpMZiTd-i=A6MP<{CNZaDm_1M)~38(&t={Ak*{*|;@FYDl;7D{8~x1e z%um~P|Dj*2KX1D!?zXu@5?8mquUcMOlV)4jtlp#B+4$7d`;&s{G2P!=Hcp&=Zes z=wFta`RSBp!#;=~{o^MM-G`4(*7YyRd9DAU26eWyoYXyMa@n^>mhC+u4{Q|;-`1KmvQsA zPtKXs>z&^|?a}q~-kY!XR&@Ad*cS~ppKh|^WMuQtevca5ZSUQEXTJSTD^J;<+wQ&N zv3BJzB(}R@((#r*-~a2Fc4;Xo5tFw)x;^)%!R_C_ETW{^qRTd{X|JD;oOx===6y9Q z?C16CKC@rzUavpYtX#)O-KW)W@!l7AjXJS*PUYJo+UwWFnf3=cd*0qxy=>K_KZbp^ z;KB~iY^rwa^gSbHEdO5Dx9aXr=qr`q7 zGQV-!hA(R9pQrS!x#wuF=$$K;-n?hsvm-ujoPXa_!yeSW*FWp;5#tJb&Of4+{Wk51 znh#I8Ir@`plG|Ke^YN#9eDX(~Mj!0h@@AzP4Kf#XxxL?{6U8_7O53HMAHBBlwVGuu zW4?Uz(0fm&zmVCrU)1Rn(^tHwznAtey6>T(1C4uDZ9DD0=%=2gH@()p-(~AECohYA zId)8?OA?niJJ#c~CCP`LuX}9X@fWHlK7ZM!Jt>{nMmEsTFS&Sn=FOciP1gN+=dQ0G z_&V~5xMpK_{qS6N?d{F4xMF|&?#K6i+Hc3R*S`3!OXn3Pe7?4N-Ft5jrGMXqKXN|4 z+jZBzbulko`tpkQ)7E+4d*Iy>zb)ufZT@ZREBDNryJhm#rBx1YY4!8!U-y47E0Df| zYb%ESQE_Fj=Rc1fFrw_HG`nBAzq-CF<0{?q?^c!S2GaNR;Q6)Fd&d0m^<}jWKXhyC zn|itQ_o@pD;$KO;vR@!OZ+E`(ucO}8ALYLOf_Hm^o9~^n>Va0PlX^z!^`p``bvHp`unpsA;kLVLjT`~R< zW$yTylj7-{FTB)>aKCMw(=+WYKYm41<_NcSA#N_wbSYsfxvW2hMQ0-1Gy$iy(!2b6 zlhs%Vd2z3@D&tIqdw@LO@7R=kO;)Ou5=Ldwb43yEe)4?p35Q0Qtc6la7?nj&R7TLl zh?by4zH9h-n#`G;8Y5$o?7@E;l7FhNJ*QX z!!2AprZ&z*xak=wD%YGwCASHyLeCt?#Mjp%++>mb`Q*v1^K0XaQ@SmIp&BvGN-i`(x-H zekcrG(-CfJ`4pd*zFP97zaE4h7;1-vnU|Y)yFVt5F>UZl{#-J?+h6_|s__Un-Lg@h>U<~yhbY}7Vhd29Us7H-()9p|ySBsrLB#E50AM3~%y&oG|HR|I8 zOFt&!Lp?@>`&y}|eA$tQ{PjRJFjhT@etJ47dhTCVb)vr>`r4JMr<0!^blDbvob`0| z)6>OIPd7!+pKm;SoxeZy)eF;~0S~`Dshgjk9*nsLuN3Fq%PXNSC})jxPsUi|)5A{> zj{-)Vo&D*h=plbD_0w}1V}jQgx=~BHsNOI0)8kn~M=~7b1rR%v(N-i=aPfCeqNOnp|ydj~ddv$;E+z%mZ2=o)K>axhO z2CI#fG&3aq^{_ya=YGUd4?TxS>3oBAvy?P4B+p67d4}XODY@8?R6}nm64`nZS+_1Q z-jgJzt-+$(!IT;rl6g|n#*om>14``;Ni+?*ob))i@RMZvNp6yox`v+DrKFxAIUyxY z3`rtg7}8dr`$gp3^0WCiO=4;rtmmbqfgyQYO8Od-%5-@nB^r`0Qqs+k+$klO8j=%I za+x7%M?*DI7eg{gN;(;m8B)^2kgSlB1Vi$Ql%yDvY+7m{c?`*IQqt6rJSQbCNb=m< zfp#;;`m#@AE&)bV=4mNuX-Hbr#0{yrAsH?uEey#5DQO3ZXnL49V?M5@$$uNQtP^FQCFL)L33mOH7o(5mN@^IAjx?De37rub-D%RN zN@xzL>Y>@7DxrX@64IwiXim$LBt7)xDN8ygO7khE1eHPaM2{g!>WD0o2Zzw3m%XVW zp%~7>(b7-SLYHt2PR1u%H?bZg@`i-NOzonBj?u$oN{p6pp^oXSw;x*lv1YxX+&)A} zNzqgsG)M@EUJ66PYBF)21^|JPMK>iz3#aa$F@}fKl~+;zfl)dn5pL2?Y1O0qf2qSW zPx`d*0(!-_cyUCytp5(GKS_A~#XZ%q!`n>OHdPLe+xA7{%5=NX>F3_8q_1WNDJc7{%5ggGE}Y zT+IwyMUurB#a5QV(#vJC?v^aZD7FSO%UWOO8Ma=LEXF9dhA6hETqf&B$zqIRYpB6O zhRb!aVJp5K$;AJXRNKZdNX-~heVMEglEoOs)^KL&<+^pvl>6Hnww6d1W0Z1@P;8AD zKkKB)S}$3QQEZJ=Y?bEJe!0D2>ubqkjACn)VypJ8r^cDAwE8%S#2Cfa<&diFu&!Zi zm1HqSv2_KrXnI6#xY}F(c@Q@B;9(`a zQu^WUBgX{G3k+_;aAJ(&;W)_E$k#I>-=LvjF-Gw)n_1S#o2-$N#TdobcxG86Z?bNe zEXF9dauiz>d6V^yWHCmuMFkf3cl5}ctmsBKiNqMi7R`&yTBgXGtW3#bj1u{Y%(6ya zu&j}1jN;)WX6e^*(viy7H8CRZleQS6csN<{a7neottM-?WHCmumB%c)Xek&(ASA{pwx&R8M&so5HLo{W!z7C_iY*$OBiwo|w>#`hFJJMzK}GtZH~ATN~qAbvIeNB#SW$YbLX5N!FJ) z|M8^BY8(eK5@QtBEJ)3L{x^Rd9%Hg*#t}!%Suw&|`or0fn)ii&z3kuj2$nU5j8SaO zVU~VX(oC;`aaC@O!$~B@C^4K1sTsplMI+)&*0*uQ!K3sz;GyN;u3beE<4XB_U&|>b zs}@bkkr<=cng^+AYs9xt|75ZfC5thNt*e=(x84ixb>CyMMoJcA6kFFQwtih*)XQXD zEm@3FB7ZHj^wwKRmv>tcPV{0 z>}d<@e#v5t62nEnnr*)KYi-^WwyZH^jACmsv#c=`cYMh5C(;&Ulo(#mEPXVm7@DjL zE+#JhX9@VD*jhpozN1!tQ4CGio07#C zC5ATwtHw~UtTAMaV#~)YJ%&H_xT$wHqX(!QPxkRe5*+G${w9(bYdwmg$;y{3#wfPR znPqKV;G+8~H<0KMe6xJ<}n$e&bnykkqi!n+Jmntl3hk|8| zA!8IK4$zqJcx`SEP z7@DjhEpQTvF$(KWNYxmctSyqo7$t^xDJ+ViU|D0x7{%7z%+g~>{h_!U2(c@nCB2Go z#;Y-02B{iDlT{#Dj8Sae!z^nIP1X~V#TbQkFSGO*Qh#W&j!G6|6xMyrvR=z3t79vi zL}H8*!{v~gk*636mNkZqQEaVXmNkarjx*VqE^RSJ=@0K`mbE`LS@%g6V-#BtFv}W4 zleI;%7^AROGRqo6lXYCO7^AQrWR@PoNiQeAWU`vI#z`c`C^38pQZt6vClyZ?ENcuI zqu5%-ENcwK-G8z%P}*XQ62pHn%Nj$Ib(Lf>MzQrUv#c>RSr1DVV-(gS%(BMNWW6g{ zj8RytnPrWk$*S50Cy^MV#PCr_)fftvHHM5)Y(2&-YYclBV@hXfi!n+JA7_>x!{kN7 zyPB*?lEoOs))UOK#?WLflPtz4tS6aejiJffDOrqBSWhv_8bgy+r7cb(F-D2u(~zn$ z6fA2D8Kc-*!>l@ZrTNC1h?!~PsTh24^^mq0qr`A6&YJyU*|XVin5^-V#TdobGt9Ea z&}5ZK7Go6Fv&^!_&}2O)S&UIw&oN7nVdL?KA23;mB#SXh44+q61MaMxC|K4QGDflW z0<-jXI3p%{nRpTdVppwp^eX<-k2zQSZp~;%io-FA< z(PLc`y$ET9yEa~_me+sr>j9H>UI&Pf7^B$Q0BMA~GM~jygS_<0l_qPeWHCmG;Y-ZY zBVX3P+LMB1jUi(cTN{}bhgb4&Q|zi$;>j6&aFry`D`vwu)EK@@5@T-D>$|`HWwM@< zEXF9dUSXCsh9>JP$zqJcdeyK+9xiEm={A!U*AXHl#we`UAQkg@I)C}@R+CLuwq!9z zVO20IiYQ2b?3lX2WG$Dh3Y<}+v56!`G)~38`i;r@QnDDM)Yt3Gs)AQa`M>6N6)bCg zF-GxlGqC0kC+)K}HTvE*iL8o$q(Sv?3$tp{D~@;SR=&?<4U;U!D7M~U7F}P&y65-C zi%r(mlEoOMkJ`#C-PRieqxzbxMyzEXF9dwkx(GBa$nd ztW%Q37{%5OX2nQbt^VabZL;E%AVy-0V(U#v&079UyEe{b4U{a#D7M~WmTs%p=^@Qb z)*Q)VjACo2Vr$al?|B#SXhi`s>==AQX&3Aa2YSk@NB7{$Zg%+lNZJKf)i zzQnM#Q`%yT;^7`<>9u@mY0*rRby~6*qu6>|vDI<@4P9FrwmNpgNhHQ7w%&o%jQoYm zdQUM~6C{fpjI5mCIzc?~Id3j8Sa852@J$(4DMyhOKdu#Tdob2h7sztMqEsB zwT%vjtv@7-F^aAIimewq#;!G4{kz~K5@VFs`w^t(H$<*FIsVU@Y|Gku8KZc3fLVGi z(+=l_hKI|fEygGwe#|UA8g#GCWbKzM#wfNvVOAY_#X zhhG3|e&=ZQ!a?7)HX`4&8>@0LM)B|vv-HRpKHvI~$;y^2#wZ?s$*f4B)YakX4NC;e z>LFtk55HoTwQa;19@FNT*+dLV(W;Xt!jp?rzMLqimh)ITbF*Y>{*jlqlfU2F^a9D28$5%oI`cP z)+EVdjAHAU!J;eWnxVTEo2=I)i!q9=?+g|)Y^#Q0>w=yn!)_@Kb#C)LNsQUo{nxIW zY_jqsi!sVK=6+ySJ=TU7PF3XlMzE;W5JvqL+i^%D+~-N$$(~iw(dyUDUTKRkD(gpP zIomoZZ4pLg{S<^1bE)uY3X4S5iClC0ZaVra+dsp*9dn!Ufno; z8vgPylQmYd2m==1@rj><53XNv2o}Yl)BO!zHd%8di!dTW>!kz&o1WhwiEuYEkOD!k z_#qO>B8+PN1SEn*ZS1G#x3|(Q;a}KG7Gczq{?4opc%_myxcQ1VOjdL+h>!@Q+BykI zpptfyEW)U^P8lq+_4U{WKcV`kpq^V$0B8<+8 zFD6MPX3=#)ZLCFZ^MxksR>>la%8FnX%@dHpzr=ier^$LuvIwKHBAG=aBe6u%J$y~F z2&1wpGmAVVY`!lAAN)};M7XSP{d*~ne-I7HZutfhn!-d2@ zmG5qi98S5qjdh>!@Q+Tx$J=R5MmQrlsbWG3-X->WSC33?t+i6xR=!e)|1 z7?s687jHyfZHJdh7GYEt|FnC6Xyiy1VZgFP<9tXW+?T*LWL!6A?$}2Nksg*T!l<_R zC)15++}Y=cCMIi>WD!PX@lTwyhmq2P$=WYjgi%@aEh}@pDEw^Oc$4*`WD!PXU8u0` z%K7*~lXYGnVV*ExS)#$eD(?2+G)}oTXy0Oasz)PJvIwKvst<|T=GC@QDp`b4Sq+%w z+(*42S%gtp4VmTKM|~q%gi%?I6xNA?&$kjnq-H7NoiJcoqQSod43_SfX)9l{2&1y%n59QU?V}b*7GYFYQ-!6rjTMqb z7_cnSXvQp>3?buM_~F+3Ob_=-7GYFd7c)zbhT1l&q(TuAVN_N;vz*&TC&?m=%4*Im zJsN7iFgpn=M_xq-MOT&uy^PD!h%U29hH{hN!K#8L23QdJk#BR6p99?B`155)B21^=;&cz zI@$ok2`~y?&YqlI;_*A#2j%FKO6Plf`}v(s=2E7!VsBc|(+T{;=H~B=`#I+AXG4%@ z6f|9Z(9=Ra{b0P`@20aQE>mNR5G`STKU9654RHUu)GO#!Oo`o!sX=Y z9S;+EIcSS?fqGKW{&Oa07khEB<(16vq>9FdUm2DRwBuAyqP$v?QIXPT{da2lhlUMb z$IqNNF}FB(Lh`i2nFS>t8>mmRcL0|-K{=654Hp(?z>nMs-lCFX&u|@J`59bXJ)%s# zJD$OBARDd`%W5Ij@{7`TD`rFU_B%sc)^>i@)C8+@9AWmz79%UjUINiWSP^PPq55;P zr+NGUgVXvX^N&my@_&lR&iC{aErRMTZ^9W8^0UY1<_F>YjiyNcU<4>B%qcvF7K(H8 z^Rmb1<>!^m4OEQbLoAp??tt@V3@XYk@FxsMaJ>ULk~32B3uojy#M8uJD3m`eJT&jB z+yL76ddeYPP5^ne&d4orw3G~Q(57Z(7w2W;YNc#$P6@8~k)6iRMPI>J9HeGfU_D{< z3P7A)Me5xOHP&E0V&JkGmSeHEpI_^>_tc>PUd$!>CJ)aT<{gwZe5f~hcxw6}Z`P1O zebY12#IHH)eYDrxH+-m}RZHyB$vYxFH7&H(5K!*N(RrU$1sUD8K0!HKMJb~9pO%eD z&ot|gUSBRc4Qv1E@T1uO;kK5zqdA{rY9+2P7?nA;@q%s#9MN`jpIE8zI}ls<}mvnaw1 zb4G({(0{zcH@(54@4v&F_;@&FuC02oFaR6Mqc0<4eh)KQ;h@IqeBBN7C(V}d6^faFyb z@3rdlmSpGU0|_nWd`Q2nO>u$;v*uJZ9~evUcn2iPRkXD~;Mw=cKItCRJeXoBJOOj9 z_ykYygx*;0`=R+F!H{VkW2_+iCGNSx(@9Hq^|omBAM1=&0ERg~_!-Xc{rMqhwGNcv zQ)NGb|DY(>M{*$jTjQahwIG9qjHFo8`Vr6d(!|eTpb^#*9c6H(m5QH|Gn|B<5&u6t z`4ioeLy`TbXO@t`Y5#?=rPv+$;tdwI|GHu)o|FDYXblz!Ti;Bh0teEYGG`9&l%*N} zp3+OQzQx(oa<%M&3HiCjom}xV3ua^QHa_IOXnfHGOxeT08482$h8pUEqYPysHb)J0 zp>T%6pqr_Ny5J~7S@=7mhUPP%7-quVOf`&zP0&q*xwont2p4XuKNq{ErZ?wAyYBp1 zZI9}{ogF!6a&}%pd;+ezv)P)Jw$GX_tato-*3X)54STp#HJ;jG`E8B*8FQ7OpD|l> zlQQOK%vM5v#%y6*M*NJ~M!?T{Z{7&|*=sNZaP~UPFr2*(;YT9c{@Lpge*8Th!jGhX zz>mMDL-^6@AMoSv=`b4UKe4Ve`-y)>TTW4tcnD(u;OBH}>>0pB2|^ zOlL*6H=VOmVm6esqU*6c!~GBAvOHs+8M8B{+T(S`3d~rYF;$P#Io*RXqI!<4n00WD z4cTk#9Gf%i_Z%D2Tf@2D>M|O{xi@6CiF0qu-Ym|&MYCm`ds}+rIGb%rqr%UQY*ymg z@$D6Jc3R9}pB-NhV8~}l^uaqc&ad<@1cUTCPbfT7X;MGVcc z7BVziFJ`!R5sZc(KEW(<_#At|!)Kbs51*q4At(4lN_stqf|&&lg|rtl6y7XcD5PGb zVB6jQ9sB-9i~677s#&%F6TG!Ium1@?n@#+Gg16yZW)63i!fNx5yzm;JBlS#LgQJ4* zs>YG3$BA$JpZ$$Ey$AlgYIJw7Bk8!OktH90(Cvl9nVTfxX{4Q!P)MOu?0JUcWjIKo zQ|w=cqca?&&?)vJ!_gTI(yX9xpMN#0Dr|cijBpjX6MJ_)JU!`aex^L!gDoJTON4@K(6&yH-EHlJ|BHwe$-8A-#9 zzpco@rGM<9O9wCiIo%e=tq)@U-3L1@KL4X?1GxJ)o*NC|>EFS+uL|>za}+#ExHswCeBc8IV3OB{gkee-HHZ z?wn1G-kl3_XXAUpxdoF-CbKU?67a1v)2?`0uba!8G7KI#pA7XV82$?%d2jhbB>CkX zmYxJtfxneWHj_g@be{ri!SDH7d=G|0F#?|+jK_t|Fa3%VaWt4>eh1gVob{w`!<0EG z?s^8_SJWGU-<-5dpYXKcOUzt74hm8xXBQOUdxH!K^{uNUY_$B1XMXV=Z{0$mIo;p4 zfL0jZGxydDC)v|?Q2KzhfrC;#;xT#qm+6OevRyBdJtWB{??!6a?Ti^_sn48>?{~Vx z5BTLV9WE|~a2RG4go8F}Abha30>Wc?y>q5b^CYNgqWUo*0Y7u%59?%ub?OoxEZZEi z{lB%1UwX+a$-@`QuF5Tr7hmB{%IZR2>P^E}qXG~0L3!0XbnVhT&XPKI?bf|}mo6O> zJ6nXvc1%d<(xnUDJ9q5ZIf2fNt3KiSww2ngUpr;&=lGGks^a%_+D|CP7wwJz{Oy{B zpWXRog#4`?{jGWoeq1Sc{LD%5Lv_(kWTuSLKZ$pbE2fY2hbl=LsY3YEf|!H~<%cLC zg;`gZ%T=%^CdSjgBzI0p{Iml74E+FYSKyjoAta)XX1!|tHcnF zQXt%&VdCxy16Lh(RsgqJV%7MW{#^&$Gr%N`Ak#qzjubA55Mv0ItpC%T;X7#_CoETvBU_ZbNeG) zUKlv)C!Yt-JyB>2WS4Mtff*kLZWb_`L*S-C-v_{?P7-z_@#a(?4I$45W{JcF@~<** z_W`p~;sVvj@EQ2 zCP$oV_bygx{acX~5?_2%Xo3}FA8T@0Qa!O28v4@ zaBG0sBXNP+GyUU>?|^AU7cx>H91W8_fO$yb0>zoSi*>-Xm`BNGi^>+Xm+vN(=+>V%jxvd!e8&aP<}lR1F2E+Pxl_+ayl4 ztKyae^Jo~jXMuUu5oh{G?QOfnAj`?A9Q1S5Z!K`Sep@IoRq$rwRR0pM!~6;drC{aI zfEgABZY(fU9C2nj$iEU`9w-%dgZXy=m~SL5n14S4^Jf^is*CV%$8k_n^{M_{1dO&= z;DY(L2$-c3r|MJVd@nGMgn?TN%*&2A)4#TrU9PRb{B)!6uNmF~)ogn`=)%twwmvmE!p zp)Y~CW~nGgusgH)TL5w)xQd0c1oODUKRH~Fkd+0%yJxpf@8q!StjfT+Xtz8 z57tpQCXq8z9` z>fm$}i4n-a^^pWz?-2SZepiO6FBiD!Vd%RhOnr9)w6@)VB+`{UP*Gc~69? z?=)~VR){DEst?lFN@4^uaD8+Hu2%?sRKKHvDYWAp`qOe??y=)+{b>yJtp{eC9p|9$ zD`0-K<7O4+myFNXi{`3?T=f0MN0DiO=NW8vDK4=#T%dluK5)$?Hc*@?E-Ao_wBsDg zF%y`DcAU*WipvAQtg+)9^z8y>za8fgmlF~rf`ZooaXD$j1&WLN0hg;54oZRIQV-|a z0Fz?JIg}$Cm}z#LEiM#iA21KtaSr-k0cM9CXVXV<{sx#6cASI0x+^hn!a*rec}ZXI zl`hvH9Fz>4gT84i@r(%$N(RoM-tJz>5c9>M-YCxZ0QU?IN^~6rs<$^*x?Jzzpk&y! z#Rc08t{+xn4-f|>nkVw}IW`>e|5}L`OJba@9Hh_vpan!(hjLJVTE&J7RF3n2Yb>#W z%0cbrQed*|IEVTu0Ol$?&Q@Nk-(|o&YR5U~+X~EHJI)rDNa#B*G02MK5SKWd`31N- z4+%)H`fUkJCy5Ib7rK8p1ennhR|%h;>bE}Rg}~e(apbQPj`XdS7-Ts)wFB~JgAM1@ z4&s1&8Mu!nwh}%EY6r)G`M1OcD{q5UcuocfC7}<`o7w7@%G(u~EQt$N-Z>J(3h@%C zybEnOr}DN0e-Us`N^G$5Rsge8;v(2C)-$$pP_<8LG24ghyTVuO{p#=|bxg*Ye$D{p6DE|a)G<)wAw z5MXi@eg5r$;#Vp$WS3H)^4?^_In{4G__qPKPGW*M0TM$vN>24g{tUC>oa&9{i6d>eK>d&xxTz8wsJt{Dl>xKDj&m44HUhKF zj|6GH}BsHds5z17@bg8Fp>u zpnAImG>TC9+tRZ<=qU-PDP)8{Zc=E5SWt^7pxy| z`h;Fm@gC^0I zfO`g*S3}@vJl`uZ$Z~QT&uik$em`7-<9(d3fcsHm1C@i?LG;tYp8guB9b5?9#S$Ax zAI%Svfw^4bg2j0nFmprbqd4CU%t}R{f1K$$dLEdUBraHc*&;D!dHwZKd)@}z2ND~s z97lmUA#s7?LglEt2KzKPC<%T3cBveRz;u(iVCCo|F{}_TPVI%-eHw7t5*w@>Gl5ws zaly**05Fd#`uxjL3wB=yW=9Adwfj#b23bx{<)C)@r5`TAvE3g7?stg|R1S*E1#1y& z9F&5^r7ti;BrcFXs^21D<|_L9<5C;Aa$xQYfur)Skr-q-ImLypxAnm7QS>>-5|B8XRUgCnqYE4Lk`Vf+-*_09S0pZ2 zy}bj>Cn5Avoc{nO@_A&C0<~uv-|7L=SmJ_Rmn|iR72?II-l*Sb16)su4OWgpz>Jo- zK=nrDm3@DtO$`OY%j{&zsVuO|A6JU-=T(ELfeZl35 z!9gidebm9Zcwo9ooY3cA-WtG-kQmZODNs4GfmIcl#X@6F^?4!VBp`{5EC=Nrv|>nO2-%0c7DAYi6ST(G#z2gVmdAGOoR zfO%HY=U-mxC$|FgZU`KWAKyp}vYedaLjBP9emLj2{03a5^+H#mxKNzqBt{^qT{-J( z3tYDl`pCZ#Vd@(T+>|i%-4Ld}rNAu@p^w_>OTg^5;~e%kjsf$#9p|uLa>0w(KgB`G zh_i#fRA92~IEVd`0*MhC@#?T&QV-%H;BJuEVC{K1Fpo-{;h(J>)SkBjvq#bA-<~Oc zhk!Yu=<~uo=9UrB7Ba!_0%UKaNB*FgRKg}_}b zv4QkaJ4g;wUnX#uhtNmmogJpW`M~+Y(DzuF`kn#ql@R)I2tYVuRI3N|^cv0XN#NuULH^y&n9U3(Tzw&f~HFj?#I+t&teLD4rO99O>Hx z-2M>y2zLUQ=vRd{QC@$2b#c0##0VtyfBrbq*9W*OLg+gmxH(Sxc)X0CquXeNj1Rcg z5-a)_*tOy4dfN!h9y^Z09AB)fbG1Y65HK;X36WUOcq;7r==qHXz+5JAhFzOJ!VLjt zRv7vg0P`=qK3h4cye|T?FAUsaU?M9(Kr-sh=3fV#YgU2p9N?f7th}Qu@LNSVCKHes!TgHj-U8qT!?W~Ri^c;cil z4)Q&~{2*~+{P1tjguC!{JR^pKQZSqsnE7GgRs*vw1g;xw{Qyjh&1_cAOW>caemyun z4Vb4S&W+EWm@N7GYi7fzcDf#z0}>a(IK8|kj;^DVz|`7;43g02kE8ziLSQZqfg`)^ zfEg@tmGIfD57RE;a)Bw6xM2RR241@o^fFr!1@ zD1L>&luBG6{|HwO%!48Hk$*1$vtQx@#f5MufN8iD8KgisvfCY)Oo)F0fnsP5dqx4obnwF%X#XD$cJQRB!pf%n5;`I9~_MBN7*^KDGdJ*p9Q6 zgC7c6`X&6Pq;^bc}e1e)yHmNehLFuWv9#48V4mqpRF9z zaqco;)<|5ia%=!*mxA*zM@{Ja0GLA|a8w`P0Ta6m86=}VZ2moka~**BSmJ{D_cbu5 z6r8hvk-ITJ#X(87KfiWG{xtyRGKn+d=WzWF0cMuO1uDlE(02#n_K;QGu5)`?0L&c< z&c7VgUhW6xS&0kg-&SD0wc~OoPo2@F6Z=9hMj?4__jmeBG{7Bo7-j#G9JdXLvtvM%sw9j9yO2Au|g~ z@}}ixM-+bj#oQ%}DRlqgj65_?)6?B~BJohJZRO zHGPmbedr+X$n?}S@6fEYl=QyoX+wsx>FoTH+~NZKbNhnqX}LYT$+PApj+~Y|Ev+DX ze17hPUUtFA-0Z0%vh!!=`WFxX(x4Dt=6dlT%JT{)ITp;oh#&lCjI}5zPfF%6TlofM zqz+8ZOdHxPE)rGnBaR9j*SXxN8;r6&#tfg4TRdY-Uctn|F_|-GT!27=!F7cX>JOC*&26 zkue`Lqc~@bB((>rJ%07t)x&jZtb4r6^|tGLS6kP8Wq4jwzGvp;6c^4YoLCaqa!9MV zK}D#}ysHqExRk)|BOw**s75$cpILlyNwU zqGL-J@QHa@I5TQn=~8?;jkGOAtAtCuY~vk#`sMg#^iKM<@{IU#hw+I&j?;W^@rR|F zF9TNLNvts4b9?liufwU+S)l0Vx0c?+Oy6eBw>+MPZf)U~m3Z@R&cy4`DzuPUj$9dx zN4g$EZZ+qqR~*4-HQ$X?q$4<7Q8;ek^LFWtx^yidTIr@J#@ECLd8YIjg>7clqzbKc zOSjG1!jmp6<%(Nt<;g9yo||U1)_mJVDSg|u#T6xST4_ZKt@PkQtxWq}P{3oY4BMHO zv_sp5s(}etT2e*Q-lQGk#3c}n748^0D(p2Zn}}StI7==`>rHLeFZ8n>!YH+TVYGu` zN;6IQHlYIOaBtR1kF^xasFLVs9V5|D#>At|l^%=Je5cUn`26CEnPV5u%Ru9pUy`Ev z_UOWxh4WcBv+1^e8Gqrd-Xs{X)~)%*#3vwPabDO%HjyHZ4;xUOu5Bqy5e{r14@8#y zU&Ovp_!e`n4|3OYt{-xxoTCktC7ip)$l1Nu{aIWQz4&IJWFev#-H8uQ1lwOQEINqg5rDBP8NM!6F%mfu53hkMF>q8&fxFkhJ&&A-8;xBe_kVGtwttp!)5=QX(eqv%UoUwC zT{uY<+|9bRvgDWy-%og}N1b=+RrSzQ7st$s$nYgXdF}qkR{VRHQU9D_- zjJ7SgUNq_@IXb3FbgcX6WtwlRR=Pb}>$z=q^o9#?M)UoSUP_DZb5biG z=Cf>Ta@^?*-g56SwBdsYQ8I?G+eQ%R280ADXzY) z$D=o;M8VUU4K-f`F4WU8kj$uA`j>lVH7Uu0Y7jKvHi}OcLX#kRsw@)mCz{k|p}UH7 zd4`H!alht!T`R8zxr;(jJ`^6*(8{%_=-5gk=Ej&ufk(JUZ>AcJVJ*#(%i-v@Mec%g zrnx?A)`#D1$+TIC&OJFw7nPxR-n5zK-i;VaO-qo@MM0Zb-Qmjvo|rC()8QKq7FSDO zRz4SXi~1VG^Q1Z$^R%9OFgKxz$+mvoI3&ISmXmMkCsX7}WBk&6yF7*(S{J(96JFzn zw#~7j&8t~@T5V_`h{m9+f@A4HY;(i;Z@}_Q2Tj&>9k<*62A9sn2hCTFOF#<*F&3WN z7E&M88YMg5x46dHd~L&gLnEgb<8to3{*gxYPpKNm>kXQfq1SNJ^mY{IX&oR6SGpO! zr+)GDq$>y47hhTO;wjxSZuDlFcZ<1wGvvgKo{RlY8n~Q$7c%gI*+lx8i)uch#I^>S!KD4EU(MV^YFBLs!bz_KLD(5aVk>S+?-S-tkaw2jMb763i z(*m^mOE*BoCEH9FoL8LG2V}Rg9Heni49GMzPdFDan!=12i7Da2V+&wI^NEWoX$vjV z=V-p4GJHR3Wy9i&wDQX}ihi8lE^Monk{Ri~Dw=Oj6t$wsPz7D@(^@=%n;9+56ViRV zPk(?&87uOEJhIf)dhW)Bnc;IM^Of0`hqZJ}DY0aqqb2PW8n7Ve#qz=}3!puDtat2Y z|8qmY%2+bcz0F zFmhsZgf@mm|1%pou{ko|z|j_?z`bJNUN>;jr~<*g(8%Q@C;G10MozQ!QuN#H*gW&y zND(u7G`T@Zeb?|2BenAU_zf5h4gz8w4br-5zK^iR)yjsiN%}1nopagDAM~{WhFWay z4qty7TL~3fSsG64*2*$FWcUVQ40%5jgI)tHrvW*U?%RPHp~Zh%2hI0(h7aKAS5tUO z5WR>S7cJb=qGKYWW7BSljv0W3dgcSXWw0%U7wTIhu(g|Z3p6az7VnK-^ewwe+HX0X z6@v*)<}Ey8937zfhN8{WX2Sq1oJpXi#Z1kKKG8O)1MNealh$wxje-U8*#@7lqWPcKxdyr3+c=5pzB? z)C6jXG{ZxG*3I{=T`r4is_WBA$tnEF&ZFR%$GPW!FT)7oiMEgE-Fr6Id-Awf@ z=J)N86DySL{|c|f1fRST6a4=NUaf>NecU*^SaD0@{){iD-!@YfRIpmH6)vaqw7-V> zkHMK&xee0tO=$`Fw5wVo_5tJ26wxrv<`8g2!n=QBMPhCNnky2P`K?I2az$b?tSb_+ zX=quIP^)%m&|;4jja}?2a`_seRARBx9XYXBS*w;*Tzj%;Gz_>AKHRsm#816+_$rn0 zqkTxRkZFvZSjZ&&pMIl%2_7HMPz=j_uj|JRHy~;pa?ST4EzvwiYm3mRr@@Y27QKuz zw+_X8s3r~3z7J?N)DKJ4Z5|uy<^|A9W0(pQdzjv_qj_~M?%2fv>6KfhH+t~F7%RTu zYXl=mmQ^ap3g3;RtWr5D*rak)5WTE&ZDEp%j`T+i<#SL{PxLx;`!pP%>2|4S(Ra8i zD2|w<$WU@yRWFGt0Ei2nH-fUbpU=>@mC7-n@VzbArCYMZ-uWIbJ#C!r6mcj|j@q0g z?i1*DD=}c$+Zm6p87$Caeqb)qex9jU+Qwn$E zUvHtc*{+oyiPB0>HkplEJ>u3q?(NeP4=Jenlo-@t!e}%X+^5Iwd2%Vvyhq;y7Da2! zK~CI{*KH4m5!|>t6+Nphd2#ynpvIf(#plO_=^Wv?zB5kPflzR~EOumnZx$LyQ#A!5_6gSb_;8@p}; zqDoJ?XExS+=VSOkeV*g3GQLaZp}|d~km6REZ56cL@QLSeu&VfiTRyyZ_~Joqzbz#P z_=a7A!woxsFIX}J8cJx6%C5-$K)OnCdCLKj!{$q;mFmo@{J=p=+;^lx<9USAEiE^5 z?kdap)KV&G>jK^-kX1%4msijWk1d5FYuzo1zkwy_kdJ6( zcf>ECPv&zmN_ zY7@RpY7Wthej!Iilkn(G!lO5dk)lbUp+{SKokrZZW2+p>=##%)rDKAI%rW%6ZJUJzZ$J;siTmKxbr;lM8oTh+yd@5 zGLREZFx$v|Yvh^(Bbwk8Bj-a-G}UL36HSnI>O^iAa-xBv0WN?ddjoWCmcAQl?6+a% zT%#Tri5|&IfO54R#<7G~tzuXIrg$={S1E=e^9~B_nJB&T!c9>aLbY<#HZhow zMf<%eo=Ym*LPq)Wc!~wK@9^Zt3~b>Y@@}S)UeqpyatBUFx@cfq%ehC86ASKb$cY6v z?M{iBL|qj@Y{dUY=3t~*V3j_lOXIB4n}n2li*r{|kN#gpiP_$NeMO;Z{NEMDyVC!} z6@?w_+QsAwNg=!xjaWjVtddLmFX80!IvAPNI<1)(EYA9uT`B+Ua2xb>!;$%=~SOspNmrGl>{^Fw+)FWLYg?+JibbiP4K5xCO7U`shW82+bngbEu1Vt$guz3P{fnqZhTN&%PHv#OI9ir&wJ2%0XghMEB#* z8NM0y(tG|k8+RT4NXH|Yv+&$tPnz{*__n6|-ZN&3kzJt(>kzc(Bl}1_H$iGMc$zbM z$wzExw^q6Xk8SRm-GrXYdXXY@QiyLNhcIj%J1aT%L?9_66Zb| zv#5fm!lDu(ab+(4vLqoH&uAn^Z%U2l2PvDT`y%7heLL|aWm@#6tK(}X(=%>0bZJ%; zE(19MNlTE`QBq4Qr!V#C^B@x-E+}~k9R>m}i~6TarX?$f$zzkROddlsRI_ylzood;a(B_>Y{0r(7J*&eNq0r#$Z6Z8cV{!m#N1~( za$*br4dle#{Da7e`;|1~5waG@iF=N;rWa58Jdd2f?L|)9uRLks{z6XN*Q|!Zr>Yxu1<(6xxkATN}CgjBA0Mn8{;K*b*XR zPG~&aKr>H6`YN+9QyhgL8&WwZw9V>`TVymrHL!|a<5?lvZINeuH+mfLibeUvO1X-q zdgQS<%c{ZLl$Gn-1vqORPsO7`ytw5@g=jI0{u0lx8qWf$-vTo3%KOr+Lr5lukPO-f zx)S{h?E@{`q@gzX-aWVIrQC;!8z zbd8&fgrni?kfQ>dF+ly^y%VTiKC_nxarX_uuQI`9nZGyCb$H5nYs$di#P$q7C z$~ja8Lw={(!DRJLhTh>uWR&H2(8In+BWw@0*mL{LRy@=WjXF)68;-fgOqV+;GzY@|qPU}9VeQC;=fVf-pYly^5~*F672?WvxU`++q0xIne>v z!kN4HEOnMfW0?bh(JYJ(pvWpU?$s}_N@?Q(m%44qYTT=dvtr*ASlhjNqkC#;#fs)e z@jhqETika1-@IhXLpa4I#46;(Cd3xxR&y;xTWepb=d;^{z$GQ0X26AYif?5o`{815 z9-E+IZyw7G^p}`Kp}%bFuqPhmODyvHE0~jF2YZW$cjlF*WA2QcjZ=8?=iK^4H(^nH z-0N`&P@Ep1mSUh{UwE{#3@X+y`S^eLVhmP%e8-|4D*Ivm@{Gd=;{rD$B)@o6J{O^) zZ@uEyK+jVps3!eU6Rb}Bzee(|zBZGD4mTRJge$#aT|6+$SF{Mh{|lp{(-U7Y zu9sdmBaZen7r-0qh?R=xlIbqzkLhJY52pWr>|F2d5KvL1Sg|3B1yN7|Q9(ga5k*k3@Dl+mMb!VyyteQ5l3a>X z{=QFg_ipz4otZbU?%Tb+B{A#Zd&l>-dyqg(f^>ofM*9nHIFAxBGY#DG`Z=7}K~%+EA$aWq<_wq?h;8}~F~4$KP25b# zFBQle2y^=q0$dWw6f*?wRbn}{y-K_xo=p;qAjc}?Eac=gkOUuOE8zoy$8gQ=^Wzc4 zJN;&z-V7{rJm&_jBMA-z5Yht>(q$O1kd{9#+7D6PE24TMi|R5JRel@h61d3@LNlam z`*ZGKuTy1LJRyRh4pEoi7qeS9MO=YwitC&iZH)4B4}xDaUws)~;R6na`?hyMUN!IGylSXkMpE8OMf_BrZVsqNSDm{q>I*FpPRdaGhh59Z zzWEkjlCDe#ZN>eJ;$eR1tASt35Gfc=F#VzQ@HkG&m4w_<%GpW>7^TCD8>PdFXCgWp zUwCRESuBUFm5gPw(?P)DJw!5C4jF40BNscNlEre!!rd%?!(1M-oiNE@Ib=MRr=6CP z#d64cI#)a4lEHGwcs@@%5t7An$a;mb0&GUWZ1@PN1$(2{){?<;$k<_F1ezFaC4=RV zv0E{s85Hji5vjdoupBbpV~naLjjC?=Pb^_ng|<*Ntl|k|?Zg+JI!ZRnA^RX>V_WFQ z+8l1Sh!iOqEQgFw6oa?YW&#fHcFABlWE^7*kJdBB#EOzEmP6Lpx!Q@A43(RE zEHJ&OvxiVBkviuO(p#&!xnBwGNX1PnHcqe{mLveiF@Gbcaxxs2ljX3SjNw^MZ@Nn} z-N3;lJVBq8ePw~^^(?11y%k8WEGLa@td7W#5i85da#+q9%$JG*M#TXojAGCaFbNix zkYTZeEQj+DV<8If{1nNX{<LFYGKO*`F)GFhT7cO6@YX)Vz7}6W9euyhpN2@hd%&MMJ)ZUX8+gCMNXnH= z_lqz7V#!rT=gEunSB~+r98J+Po^S`A4Qnii<;b*_W0EWfZoq?+MNp0;R*q>)YlM_B z>V|hW>e}o^g>&Ujls!;-XUWVGBa8PDUc$5Sz-PQwoz+Vq_{L8wERjFNRtbc`We&s%|HrL3kP_MMT!erZJ|B3-M>cGemUd<@~vmQ(w zfv`)mP-0`hpJD(RqbrybDNcrx;@zkxwyp(wqpc<0iA<<68nZRD>@zbXrE?$W(v z!C4Mn+iETN>$2c)P_9V3w0RYUO2vPTE<05bU${Mh(z?3&C%%XSA<1* zI==9PZHEoKEQe+NoREzK1e%HQ4T-RK;YqW<;a3`uQjcQ2$8U&VwOjjCq}4(h=yy^L;GsA@T>I1JX!XYp0FHxa>nY(dFja|lPA;#xF_j;bvh66&6DB~PS64gzxXOr zKj{g}p(l81&N>UBFear)gfS^gITjNSPrBU3JShb+DQT4Nms3otOHa%(=`THDIrOBG z)stG%lR73(sCM>JC-+P8tJQf({(5y2>5;it50DrF+pDRqmzHh4 z4fr6^KKQSEk6_&%c${2{63jZQ`)7^pT<`AJ5gj}0$f$2q^ z3x!gN)H%_lx6_~+RZ1FF;B2G{obgnFHF%Y<3Ymh6b0+Im)gjlH7nXJS==`VV=$` zP5=a1mlxxtt1zSlK|0-aN z(cO=o(x|qYf;66nNz*Kcrl*s38}33yGuX`n4)4PygXNGhml*6ktvrk}<&5%MavEip z5f&9r#221MNUbb~S{D*BNkA|JD@cSPSVcKY8yVu4du2Z)t(z;`A+56=_{c6DeYvshMM&SfSPngToREzK z1kuk)PhOxLYYGS0A`MiSPN41tyuVTW{(zHyBMft;HWdot-6_qo9GZQJG*_%t(x^0` z3Y;NUHY$AxXC#?rMhc?d`QIWu9>d3zij*KVvm9!EjgVS__K*lG_8rOvu*sbY6y=8{ zV#|M|^AdgIA5h0{kKtRZ`%pS(Zgq*$IhI51`v{o?IZ9ZRkEC-)C}*knyjtCt(z?0T zxukWLL+hUrawM8Y%O{z={0uQaN?Yb3X0)`$a%k&2LN-EMn9$xi5@9vq{a&yr^BiK> z$r`eK9%7QDX_iCs@1(s(RT!5)RO50y9KoZklb~roaD^?7%9`5L7^#uvkaO8um|{f6 z!r(1yqA;7OO=0gc@B$4RFL^H2xF=wjQ7yo{W^V>Sky4~#mP5m3NVn$|k}-k;@2Qf- za>%O4SU53x+2c-=43^D@@HaH;5hQ{aqYdRO)@S?GxTS(N@hUompyR$v(mc z{Gc0Taadwa2-hT0qy`aRo0`yA=?%-FH|+`82%(q|-HAl-VsxP#JEM296X21l2&0zd zZLfp3sSN=)`4@*#HKcfrn{f}bx>4R%$D^K6Yl}IN5j0u&2{c~lHYTF#h>sq<`(yC+e8N-Cb#s5<Nl|$E?AkDHInoTFoo?$R| z@rjbfa>#NsRt|P1Ne0UyW3q)IE_T2{W3pth95QAS!@OZ27^IIFIF2#~EDpkgD?F$A?QoLTk#Dv@f8Jj1Ga?5KviQVQvFUA z&uKcCD!pJi^x|PMloMl`WUw4EHW8ynJv_OpXH>D(whRs*0!kkoUL+2Pjb}}R!#>Ef zjTDwc?VAayMFsDg_c!3h*iJdN&$of*SNK8&C+GddG@VA02PVt z5n{VzIV{xj&bL)LD_GWE#1!U(+2lnjCX{Vct0Z9EQjoG8JqS*)LkNn zO|026xGaaP(~M<0&!mEL)?CS8Ib{5-81W2dK9`**87zm43we5Wr)04lvi`EzF|XSf zN(RdzBLJ@b!JQ}`5tz-Kq}Rog#d63hO)L}0l63*XMvLNPh`Wu>AxBegV0ub=#)R}h z*Te)D{4PmGx`k^N%#(W3JoK1Rp82tomF>ZbcP0ipv$C9%0@Ga+0#jY-quoiKZ0+*` zscN!RHJ);)YP>Tm*_rMRbS5OYvgNP2X$r&#>`wS_KY!X=ZUk!KL|hy+y(2D|j$)+o zLOnZ?FhPvq$f!YJ-oec~n0b4)JJD_@Tm*S-rocDH{>IO^v@|C)*OZLlk%{D>`8ej$ zoUE<_TM3m`Twbl1t)f?%GFa`2X$^y7AU=vv7_=^w!;voc@KHl>Ktph_hEU+5-71SV z)@#v3eK}K8GZHLTa3B^bw`%Gnt)!3@_CrU3?u?AU)Qt4eLWTDJJaAY)ybCz+SA=P$ z)V-c`V>yOX4x19o13 zi5|(*W3vqpsQiew84qifl@x0g=W5^EHGW;(pVrmeDTf+xKJ(r#B7?Fgr6(k1Wuzxh zb|u1ZBxYp6TLLUd;++X8_Mo6aIfl)%$?WiI1gukfla6AO*)4G*D7gia6$h)H6^ChK zuetH|k`?5=C+(TJtjTDF_o>vvXViri_P$r`tc+%?*|s^4I+(9m>C9KGGF-~|Ug@6@ z8Z{iH9BRNtLxCzCx>CFoey@`MVy3;*z{nu@iODR7JIk5u&bD`AD^-Bey44A724rD& zCic0#9P{cQI8NyV9mV$YwZw^d=2q`45?Jpn5=$JfmUhg#60qV2 zhsRHHyS%gr^8wj73LGifx^g;~H3t9-dckX<{;)`MYZE^c8r#Hglr!4^q1S}AZ6z?E z7~}xTVUTf&oqLdRrgEfbIM~Txepb&{cg=Xt6D24nUV{h1(sUI2y{an__uT4=#T@I3 z#r(jbY9DS3t~K`Oww-FHRI64-*h>#D^T6NFPrf&(c-@M{I=s5U_2|*~4NGr&QoP&l zs57!vg;lP>!OIRm`a|7{lRql4W@7X8W!`&Z$%u}lo{19g%ikRvoiyd6zT2Mt==-#B zpVV)<^tZNK&#bC6@L=1&8ejPO6Y)MXw&U&1pNpJkY&*O;v-I~LZcHuzN`?M^-#Gud z&sFRrORD=4*pZsZMPVe9UaHQeEU(%-LbX>?U>|NTr{sRq)3;hoqZ@;Bu=s{c1vd<@M zx@+DO;(h4NcYMbrK$@qEAko!M`%_+!EM2`%E^XtQC$M~AyLz9nh=|DMaQd{BjI-yCa} zv_tUgZNGKc(6e<{Eb3IF)8=PR#yeeI-no1Z)M^v?}`uJY?s5C569H}KB^ zj%OpmvNetGV|yT7*C_+9mtBPwq7e2?DI z;`{reTYgx-+p2S)CPWT+?G8uDCOd0Szpu&oDK*Q4f7YV(h#n<+etgrY;Zr_N%`8{> z@z>*~?)dKB5+ZJwwl%8$_d{c1_pBUx!oTv)19x3EgaJ3v@zkH^63gsZ@N0bF`;~qu+jYTS;qTNl>+i1f&bw=czn}C- z9)EDo)IiVU;`6az2k#21zGP~d`H#OiyMFh3*S$R3<@Z2?hELCXug=<+dJR1BY?Z}_ ze%w`i_1@oId-i_fc3FGVC|JlZ{_(%KJ zXj-ag=Lx+|jsEk_W~~z(CF2FeX(+V{p0nY+Z<<07~FNox1T(G)O99((r4@bdZog{%X`ha zFr(k+Ws;|Ee{o5`yu%_si(d}><6>m%d&||{Re99hxHB*G-F9^5Ti<uW0ne&e(CEB788TXX!A&)S>4v*PXWunVuWe|*k+Uw@F^V!Yq7TFw3!G5ppZr4I`H z-20ce9=P+y=5^awdFa)>gDd6NZ_y4q_USjQ*M=6IDm_v0e=YW}D7SI+%3bX)PH?sh zF%l<6ebe-_RYAW_EZf#z`{dE5j&I%a*ok-EJ6C0Hsp`RP(+|uY>}V|fdG+a(2VUyF z@2*9&YMmXkuiggZuQGiH{?%|nlV65MJv6Mw!Q|Mw_4Yjb*are1_Q%twc8>XY%5Co~ zI{QG$&9`U!mG3xUYtQ`xKdgCdOpJfh+d1Li|KiJc`W>h+eEFn)VUIOiQ_54n@aM*U z4PffHZ|sMVxj`YVzg4wj*Ef z`Pg42n>F13tnk0d>CH8=v;H?;j7te^R=#)s=T?<(s(Q(J{Oc+Svm+{euziDVm#3ei zK0W>M#ASUkbXcjEqd&1f`u;bo7yY{Ftn2*m_cxt9UHBFB#Vr?S9ldmPcg4$PQ^J=H z5PrOPrb4NtzMnOoTBrRpch+oo(*xCKf6$=!%S!|=^28IdJIgM!KfE#ViEfv-MHkfH zqKe;d9d{Xbj7eDT-2K|pGy7-B_TTNL4j%`XSp7zDj}t+wUhev?=wD*I%4!ISu%Z=tUTAeYnwpY5m;H#r8N9-DMd1yv?5zjaN3f{eW@r@f(zMH(- z5p?{M&_82$|NO#V>ua5!GWYd_>B$0j+vyH%XUA-QW?ik#)tk1Q@~7~>n_u|2fO(ZW z`r7{T8wY{U@4R+by*JB-ta!qh{lCaJlP;A^6Xp2q<}%SgH=Oj`Ww_hp`CF6g3jLy9 zJU=&@9yai3jiA9_M%;f}&1qHl2|WjI8#Uv;{x?sZel+>=yjia$iFgby7ufd4TGJbN zeinLvsBlyL<{g3_{OY&;$Lk+1_U+@p#s0l(;L-r0*EV3;*_w4{Y+ISSaAHK$M>byA zf2`c=UH85*tl#X0cYTrd^{bV?-Sfnpoz3RAxPP+qeACgwPV0bg-6bB~bC>8x740uf zUUJ{!k00ObTHH7I<6A|4_r#0iVq6i&cYgEqjK%NGY4hN+yFPev%b+jnq^@~-!1}Id z#AosDKQg2J4EVVL@%hr}*!!2C2<*`A*dJADfAY?*w?~})x%#fJ-`^Zm9iY}wiXD#d)yI&l?eRIZ+vI`njIQj0^ zA3fD=YtLo<_a)EnyZlJ&E+zjyKlZ_o=5)_ov!Q>l*GDBye)>ZEYZG#MKRj#lBi+U~ z`flQenTah=Kk`<^?G=alH3)m4-syJ7=SO}0Le5GDLPxa!-7z72RXu-=IMXP~C^(9yi~wYuZX{E45vbuK4;TYj&6$=)$^yXSG?kFXc_WtVzO zDjwgLlRdGIVo%6O%M4CVT(h8<4eucFH|(QaPIquf$TFL4CYOxQNDWR)q{)PlP@{x-a4Mo+-V{5;Ee+u)FVJ3o%Jut%G zM*D#9sa5lHvBl`-L^B39xj;|u7`&A0Z^K2JfE#?YVJeuzD4 z_J?8cCNzH=URJ{>jOte=)r!IGF%`oXe~L@6V$j>XFgIwJ3k_a;+^Pp}uk^Q}S6HqY zO@}YHV({)6%#PKSlZtr(1qzwI!*qOOm7S7~6y;G=-@!c-#6PJD&`u-)r# zv+BWLo%Xlk_unwJeB*g|f&jJ_bKAgOUVqy{c*S!4SvmfDmNR4UNdf-04)_ZH!H?h% zQ+n#D<^u+QIMUyCGrS_Z-NzT+wd%pW(7bHn?_l}c&@1%${!w)yV4nWeBn;j`i${hW zItn+LdSdYQSbv+i%eDNXOAu5~Ol`vSfLBZ}^{8vNVs3&X{tZ`I+HRS&ibHjd?t zY3>6im@sMZieu*P-~Jb4wbg9nW;476A)<}m?# zmcI>07(8-k(uIRoTP-C9{du+6ZfH=LGwTWW0TbZ^28K592fw<4v()FeF5hFe#pXEt zp)NIljaq!Rb1Tan*G9wiFH!PyGltDgZ3&aRt#+CowAI#PtG$LnTV@QiMWb#W7rrYe>?RatF5jYro#T$ z!mXHYxnfv+x)TQHZtP!ET*)iU@nIMo!TfF5w*BG%=8tcG-inFy0fQr$(sRVN3I-(4 ze%gyL*jw?)naBY!#Cl?S6J{U2!vCAc4zILg`VfX{A96>#_lJdpr=Gq(VEXxh>F)z( z0Ac3AD|)eS(bP<{KWy9>NEqxBSQqE#rOX^)X@@u~ss6RQT%BE3%wP?3?5RC7te7FW zVpzSyQV(p+fmihB<|FMln|)@Op@hMi7t8hQbMs&f_l)!Hgu%H0)0#QMpz1s^!{CU& z4eJxrlDgZ@S~2*58h_guLKw!U^~b|x?x|;l4;Y6Jn304L>x4snYD8IWISCVpuki2e zeqw?Z6HgeLF)=qKd#e?bK$s+W#nL?6>Jl^r&vGRaW-P~yUV@MJ^TfCaQ;}otnDNM4 zR?H~EOovxY;~zNxEvsENSF(0E8jh$ohGY0BQ#)k!j^6s)gq~mOFWzm|!!XH&xfxzD zHGbhDG!svsu{OaLG%$?y)1Ne+W5zIlQWyqa0cK!(9%J%{VNx}WbLq5u%^2nnu4?>k zP2m+&xyyGKH``*EbU5N~!!O}NLpC}Goc-C1VYV^|Bl_v(-Zc)STl|6Ujpc$@^cnrJ zVz4$9W>WJ*G^cHHq)8!KkKhQYRB#xS3u8<_l=*CY{wp?qfk;HxS-`ZK}e&m;|l{#Y?Mb16OO zj~T=KnWFh~;)Br7to}^Z^q@aeEdET>FzAmJgFQm`$BbeA%peSY9ljpqmbIAnhSi^$ znx0h|AH>YC_%lnxY>$oKZpF;jFl$F;ueM^K%b9$}c4)=S^#OASVJg5Y*7lcYXSB8I znWyP_A?}MLD`vii@$U1T8V2V|tDXfK2IopMhSkMF!gK|PsgJGt2u`xmd-Hg>NYjID zW1*!k7Hb%6hgQrIA24@m7+lwx^)R285(c07hyC4l&o+F8f3wfa2qXIY^x)QiF17f4 zw}!!TSux8s47PbI29}Jb_TwFMkA}f=S@o>+0kcZOl+17~HS1yVSxuNmJU+j~wBBir z&%K%+Ec)h#EI~JaS<48k0Xv z&x3>!bMBM{W8SmsS!>brpheF^gu$5(y;yjD?|G}9b%YV^2g~)4MbCP|q`)icnfuOx z6Xv;+`Mkjg%tpeL1SQx9*G&HjmI7*>z~+mG2_yU|pL)LUMw34b^N5DQHfF{!e;y?a zJ{$zk-@iTl7A&khZ9S&xS^2E(?ME%P9@j89zgsa+h ze-b{cJuB~P(WeMg8D5dSOF}YB2qXr_3zh_C zoe)UO4vXZlMRJ-;YD(4(HYSRYl7?LJl$3PglKxUMic1WTB-@hUlN3mscW_Zvz+gSY zvrxIDkCfokNLfNXsqje(!~x?Z7u{$GJ*AjBqotGtb4fKR8OkMnr3Am;u54x5yxDq& zV`@m&K`wbxN-l9pxRl&P6BvG1S$NomOZrJk2A8miO|p5jzM5m=CF?aVaY_k3ol}&8 zIZ`ZueRfFcHIb6GT+&@iGP#7sd5O(iobk&{m_j8BzaxYxOG>`s zk|Zg?A34FaT1uk1WQvqb;gT6r@)MUVl#*xhbPLi_DH&giNhV0iHZIvDCFi*0At|X^ znz0^~l6Sdejg(9+!!VR_2+EftncQSW|Gwmm++9Pkud8cgDllFzy17AcuqlVKW5$tzq^ zOiCKpVwgZFnZ+eRQgVz-qCvuj;nlSntCp1P=aLqZbvvBbV5%%7KXXY#DS4?5!!(eR zAGoBElmyjfm;oSR)*lFDl3`L(r5=+Em6A!fFv&DJvxhxulGgG;hdQH%Q5FE-5D^t(!1RDJhx6B^9LPT`nmtC3TxJR(UCLb4eIT zSTr^?XPDMf@+X(HlahnM4AW6cLPMCuE+sR$Bt}ZQg)+=QDLD|vB%`IIcuOWpk&@TB zBtuH3g)@v>O7?QeL@B8i!7x*$B!Nq2O3C+JvPep{wqmShQnIKuliVvM2f5?{DOuiz zVb)5?ptel1PD&PX$-`3eJ(oNtB|F+NRyQeG(4I-=NlEz*Ofp|eR&q%jDLKa_?WJT_ zN5;BUN`fMpq?45V$R*>Xq>Y_nCP~R6E}14Jhqz>xlnjYtth=QoIGRcBlM*+V+$klO zxMYEp%#2~I;!^TAmkg4Ud9e(WDJ8L;nPj|_EaQ^NQt~yIOqY_TT^MV&lx*gb#Zoe@ zE5j_8lK$P8sSN(^F>u2OPk4tIK^khBz-G$9FX3&y6}3*3veOJtP9KtA(6eHo{-4+;Iu)kwt|IAHLXQ zSbtPWc<4&3*n)c5>YvDRwBwSqJaw$JsMIX%T-rkS_%&xLL$p`ibQnHWR1)sA zl#r>?aJ-zrh+-*8D2h_xzm&j)LYOHjNf?OGRt5NH^(C6Glu&J9t3-PYBcdTC5$Mot z_{WoE!bAvLOcFd%-8KC*VAwt_WQ>iEfBI`p+Be2e8GIfjj1iovSkJ&ww)5|gzyaUC ztyuSR7GVstt!E_*N%i;NR=>ZrwUe_5quJUlS!iq7?w3;(>pRXOjArXOVwHqfOjxd} z($)>bn3OP@tu1gsl`E`s{D+Fwin9o#*?L~GP%oCNkF+&{vk0TvdO@;8xfJUT&LWIv zYb&wL<*FuaJ;_;w(QLh_*}`%u)^W}vjArX4$$|`(tFN?G2`6Mogwbrh3{n+CtS`mt z#94&VY`sD(bGfQZTjMy3Fq*Axnk_7sVm-!LgwbrhDp`=Ba`lt8j&K%XG+WyxOVpQQ zmBfJ=5@9r3uYpwcue+Zevo>DZYRy@M(QLg=tg`qD|Ccfc1uB+{vk0Tv+F`Nfl(v?0 z7GX47JBcN14T>LsQL*0SEW&8E-q36vY`eR>OWOL0vk0TvdQ-EtHMHVp#j1pp03^a_ zw%!7%KRkn*rN!kte^*J`3gaxoXts6{OO&g1mq#Zn)&kBVjAm;$u|zwZlTdDZqO^6K zvk0Tv+N0SjclV`{igoKqI0%U_nyt4%s@evQQ8!6j4~#?({Cpbx!|x25#@@Xsp}Taj zZPb|X=`)J;_DB#xB8+D19gs2>9>+0ixU}`tNR+`3o4~(r>s^#cTiM&2Mk!VcCvxB^ z&+rc{)12}iO6Y!dJdWk6FKwlA7GbnzIWjArW~ zu`1vz{M#=~7^zrKaTZ}TTOVq+Zm-k&bH)0Ovj}4Z!#BCy@u`4^XMYpRkMi*FsMV)V zGnNA|@MSMbgwZ@aOf1n;u$G(1$k$6?EW&6Wenc!$%NTjZx}CEKquKhHSmwwp)(Xxd zjArW-%@#&pvG#KoVKiGuh-HqvVwK?0AdF_~Q_U7eUa_J$i!fT`j}prqdB!qFo-mq+ zpAkz$zU8T6v%Aa4PvN!*qj~tb=HdKO8G96K8)p$lvvrJE)$tYnSI;<@q*xa?i!hq4 zFEm>h=arqOSZ!Qz5E5ZDTgO4l#(A{W{QE^QiZzk52&36LK`hatzIZDZex0@$$S}Rk zStlT`k5ONuguaW1wyLJy9;sLtIEyfvt*?kBY=wRBd5U7S83hL+5k@Q5*C184Qoe38 zL$M}u7GX47Cy6C&wK%$~nqs}oS%lGA)HlQuE$Z3L0d~eRwjz?CxiHPFQ|wHVjK&mhi!fR=P6Jkr z^EiJg))SmX7|qs?#1bQ0&$!*|6zgNoB8+D1jArXpiInFQt5^~oghUw4)>)9McKF+a zcipI1;haSn&DJ?$iCP}yx9ma1O5iNQXp#SkSOM^gsar|=Va75?o-mq+KLgg^76`A{ z4$JLYw2(#)~3BV7)Q7*!e}wP2uD>6Ul^C-r&u+{AlEPmquIIyQhytkOTs~lLNSl@6KVYC?jNh~pLOiY@^S>_lLMzi%7 zu^PcEmg}ws%Wdo~T=-x#O2Jon{v-VBtL48@B3H|=5Bc)4Vm-=PgwbpnHqRI;)-9=M z2@+y7mW^1kaHtIYcl~w!Ud7tTS%lG8e#EMU8X;Y@HCm-ujnkNvFj@@#iB+5(Hin#E za|2_UV@MdyRsgYT0}Erg@w;;;7Rpid32uupT01O8EHT=g{;>Qo#S*_DLKw|fablU< zp<;z+Fvkg_u}ToDG91SCv7+Y0-imdZvk0THN=jR(_gBBopDNb7nJ9zrg&;fS;!dZmTSe2zM)QcmVVtvV3gwa}56=Io3HpViyD8gvAsuHUtD*&CFZ;~-= zF@cE*qs6cqu|y1er#%0QVx@5wVKiGe5~~U*MK1?@u>Tds+QeCe(QH-MY>hm;aD!r< z;w-{wwrUVdoV9J7b+Wr+HJZrEMHtOiP0iM}%bPDN)@aTmj28J?#1dq*w`@MHnrHH*2gOD~p9OmN|xm(QMTt zR(0?LWB60M#gPxn7%u0w2&2XD7GjCkyJ61JR}`!FWGt0o5Js~VL@aX*6|2k?#v+Wy zs!uEt!&ehBhAY;)oJAOo)qq$chAF@NT1~N*PGz%rR7~X)~BD z!f32!#4^WFu_9+O7Gbm)HrH6+zux*)#xlo{Fq*AkVu=`*ths48`?e`s`Geacj26Qd z#1b*YcBoiQW-$*5quB}}mN|xsHH5PWqp?DXC1QwuS+N#y7GX427_meQe;n|PiM5ln z2&2WYrN%lu?ZhEw%N#?(Xtu(M6$r%^vpM@#CdT0>Zi_Hl3?qmoVu-W3VnxhGu3->H zv(<`N<`^p0M9w0N#%fJ0^K7nIuX7e*G*%mF3w^=aT(L^eK^gpVFk-YAwk4K`Jf5d8 zmN|xm(QLIN7DfZp^gVGktH{3Ghub2I7Q^BSJ z5k`x=omkigG3}gwQ#HmiN1ia6hf%~5XE)>fwk_3LM*dH3i!hpp(VB-7`;}_0SoQ8; z9uP*e6+UWCOnX?F^u{se8&p04sjH!F!XT?h6EW&84SYlzj!1Thtt#2yU z{hUP@Ery+mRg960pIR^al(Eb)B#dUO3$esn6tA@<$QZuCZ4pL`VOL^_5un_w<@^<^ z{5<9YVKiIah=nZ*Yr0>*kJ~kswuW&QVKiIaHCr7%xp#|VE#oZ0XtsI~3!?!U19vzT z>n+YAjK+#1mWceRi|@UmSQj~qFdC~Tu|zv8zWalv?3p}Z*k~~yU%>;!XyxifED^*0 z30wLq)*Q|vjApAhu|zw>9W%xHn6n6@vHB3}2JizT-)hvfi;C6kPV~<(2&1w35)0=q zOfOwHK25RiMz_n zL$T^FWaT1^W@`wsO2J{QFC1+YYdB{SMq}MZtm43c42?F5buVWTMq>>nmT2>M?x0w( ztwM<~8tZmqnfr2c8I3B77>h7kG=>pNw0Z2yiq)I52&35=PAqdY6l(!z5k_N;AeK2A zinWKc2&1ta#1hfieedoTidAYcD;Hrj)<|NB5ukhB;W6wR#E9?AS%lG|;Ut!bhONT# zafle-P zij~b-gwa?T#4`6v#oEeQgwa@;#1g#{$0)`6ld}k;vBnas0*^edH=4<4MBdHHMHnp_ zS;P|2z%fd(p5ZLQXtuJ6WnOP6R_*1?7GX4&TPqi?Hxz3LXAwqYjU$$5^SIt%&*eia ze{mLJv~rEt%7yC<#d>cA^N=u_tqH^uwTz>UVy(W1u?VBFCK5}GHn`qUtWhf&i!d5% z60yW+gX;~&YQKuH2&1tk%W@$C*BcvTEtg)+ScK7{F-5Y(dPA`eaTZ}TTT_W8_7AH> z4W2qi+FEljvqc!q)-=u5A9arWq*!tHF&1GoThobUj=W-B<}AW!tQo`-kslEEP;13{ z_I_rIFdA#7w1tRoe++$Ev69v>7GX5jEMkc<3hzFuBcoC40mdSX7LD1&68#IW(JR(0 z&LWIvYmQ{0Uc7g1gtYZ7XAwrTHCM8*mhs*>#d18zJS2=}>kdn~>PcIla28=STk|wq zST4niTFYz^Mzb}aSmqHsPTJbUS%lGS-Kp8a5nHk9Jj84fMzghmSfWMYh^<(6a~5GV z)1IHN|@C5oU`p8fzu7%CN&m#+F~Q6l=|+OiUP!wTf7Qa2TWU<(Os_(`7W$ z9%C%RXwg_rED?>5CinhIvFbn0ScK7R-AgQUG!*M|&LWJ)x{p{Q8c9dr+^1Npo?x~J zqp|KMmWal%#OA4rHE0uK5k_OJk>x@Jj)%QuG%7sFScK7{@qlDuTbw_9zD=Z54Zp*&>W)YprGr*Bgp8;%UYrjArX0VwoeaST8=qScK77>xd<0 zJzQ@nR>jSXMHr2>o>=DfhGJzs$5@2XSR06Cp7rX=Xzbs@ScK7{v5{D!9pdbuSd*S- zEW&8E9+oUbU@beOt)Leei!hq4MXmzXWWXtp*HOY};-V_dN&aTZ}T zTTg1X@V;fmdWo|LquF|jSU7)Sbmsz<8qwV)TLoDo( znDCBq#xn2s5=QgzSz?Lx#=f4F#}$*2AIohKM)Pp9=3)QVLsu!*Db6B{X6rd(nftP0 zjeLdqO&E=}g;=7#=0;BKuUJPpi!d7Nd18rk_`OfuF+j0~Zez9xqp@Bfmbotn%4i(s zEW&8f*h(yOUskN}SD7usXtrLo*b0)iR&W+!G+QrOY$?`x&LWIv>t$jEf-BfQe(L*L zOtiE$bUX8qFq*AbG+X!lRr4dos{I;c5k|AMjacSdR;**3MHr3sDzTb@QXGFz+X_+D@#B?65H@tHv_LO4-50gwa^9$#NkAN6}g`8ZCA*7Gbn#ye?VTm!mFq zTcKEKoJAPT)(*)+y=beUw6%$|2&38BDOtjnVoi7hHNjOe#AvqOAeOoHHj=ht-efGo zXtv(eY|X!A%_E96m$L|?*?Nmu*ekI`4bFZvVu6j{a%k}|d5k|AMU$U_EemimSY{lx! zS%lGSy-zF=L%eoVPTE?>S%lGSeW2OeTYKl-iZ%N~<{@D;TL&~-p)>AmT}s+Y_=vFx zquDyB*}`j5iuE*S5k|B1p=6<6j9~?7>vzr~jArYQWQiCmR_~9QhlJ5=9k!IKw6ygY zXAwrT^^s-^cQ_R*;1gzxFq*B8B}u4^v26J18(OIA6 z!b;~X#OSQgiB*-kVmw{0aW&=PGVUQ_bk?z4Y;EVZ5TmocAQs+Pjj7t;32^_gh{osK z7Gi)!-y02@h`8g#66bm-QLJL0vd@UoStp1kW`~E?wm+>{^*IYMz`_R@1Z9z;FNxJ0 z@{lpQ&%X!f5^Z5`$;#4!7nkAiBRbUojY9`8|Yz*&gVS>H+)_JW^Z*xOiGf^Qpe7Gm_0en+ep zz<`WV^RA&VV~Y5sa28^8Ti+AQdsLTk7GiW;rz8t9#pD*`V+%v9KLt zn{ViV&V7$8Dp)nX`f>K!dZyXS-%qt*JH?HNqAW53-%c?I_o^K zL{I55{?m5KR$b0QjLy0sS=Msh%2|lfSr>^V%Jp@LrEqOpcliuPWAl&O(gN`jc3qT+>R_k5;VHoP`*j z^_OIc(kPbSaaLc5(OG{J%X^Ee&RK}jS@03QiQ}CW!dZyXSvF#MFIQjALX6JxlPt*a zByyRYg&3XXPb^VidgPaK7GiW(fMi+Q;Y*x_7+|rP8deR4QH)siAP0dmx+e5`5fLoy z=PbnNwu%$Wdo;e`EX3%n5|RZOog+!e_CwT850VD&h0> zh+wJ73HFW{V40#(nphp+Fh*n6kv(e^%gI@Y(QTC>mWYNvMy=p1#OSQD#PU8yy}?`VsutH$+EVM245PK5Tmoo=fWDqS%?9aDTWn@1R_BtSTByk9;4_ zLJY7>(WpwSR-n`d|5I+=2G`C&L}?ahAx5`VjaVWYdW(9Rvk;@RZX}lX7WENlAx39a zCl*G-+BW{=EX3%n8o96F~BlKqb9NNbOfVuVBdvRh+t_2XCX$nRf||68hYEX zon&mp=&ah31sR@1E`_rYqqA-zmiM;t5oaMrXVuYIdfVvw4Kt1yV40#(msn%rFh*nR zpu?~x1QDedI14eltw3UlXy|RD*0+p}7@c)9vAnm9>70caomG!m7!7ON_>!{_qnGOz zVm%EkEZ6GZCr2QHrOw~6cf{znf{5k4T&Fk-F*>V0vAmb-&hMEm#OSOB#1gfv*H^<+ zjD;AT)ljmm(fEL~2&2_SgJX|FL(%XshMM#1hfa+x)a27>h6( ztBGU@3(8jC(~LzJjn$M`A{zR5SpP@HA`E5y&M*nSLVOaEQnFixlc*W#87VgLC9DcC z98u#Zh7E>i`^Kg_<5OLUgI&&)LC(~1E+aBBC^_Acnd(e%Ig-;8T@&p=AyIaFwmZ>o zZ#mHOpu^1$huWhJN9MRJSAsJ&6?BBzZ;R>^8#Tny!#)%~wuFyEPjE&PI9=ivNE!mY2rtB0&R@#nwa3qbSGz|I}$SB zfyJJ}L|3*uD`OIv4v|QvsBdgklszgodQeEHoqP-R01QOH5b%0JlGAOs9E^r?MR&sE zk&Z5wqfu1qZlu@|o9p3_cxR#mqLq=5gJX^^9tiXdgDBMJdYGxt%5qL}q`M|KSVT>h zs05*;!YfFIAu=yb=3sK4bJS>Y-v=bwAMeaccBZ=>&V&S4cD6@3sHU(e-cSQ$O;tt( z_KxDU&Wh^|Vre<7u->5FYAR2hV?a_?#so)B<$xZ5b!I|2y#`O5>bS@|e zA~`4&!iqx;1W{C_Jt!!u6*}*s88I!WTeNWW@Nh(3qXve zIZbmq2ZP{3A^M@6w-4qn513E>f?YmV*)i)%zz#k*Jbsef<)!DF56D5Fz^;o?q;TFB z#ARU-T=%H>0vCol59kf2KAe#rtu@KGj0rwfhv?{7kuY>vl)wlEojxPgTVrI)FF5XU z$H2fD?@UO^_F@$K3oPAS$uKBcT4rPv1R#UfTFz8z5o{{Hf{lX$i%w^{Tq)O<$IkK2 zpNrl81S*Kw89{4o%r>dsp)y4Y)L+;S4w_JpmS8=`fchI`H%bdkIXkgFI);@I0}o z7rekz3+piA(T|~&d06h5_dJB|`l1M$RWB+pPT+Z%^{nrF5mM&ItVoNILr*Qb0_57y3u%VxyC=>(y$Y!bCS*Jb(N1a#sZu}x$mQgzDD3!j-c?9L zmb12;N900UlKoge5A#0y7riad;mLDUD=Le$Rp+IH{}c9dn0*Ra6w^TEt)Krh1u3HL zZfU*$gtz&eFAG^6UiwXLbKsRfRVIh?nn|y`o2F*&ZI-z54(4aBxk|kCb;i2#?po$O zoFCNQV^B~`w6_gQy-p&7B17=}%Cbcx&#io2f@61qt3bJ_%3(EApi@&XTea3rrh;j< z1h!v?RA*XzqSKKW8WtYrY~4CMA);k?M4Pr@VG-eBZQCZgT86d_8x`8}R=XWH9IlQn z9g23oJQvq%pdnrH=1t9sPO#zP$<^TvyM7=qa>5qgcvn_xhBFa%t*sphB!y~zUNshO z_Zqf><;+HlJe)P~DvV?FIA<0V0(LCNWo5&jr6X;e8?IB+SmC9oWy2L>*nvQ54kWtF zq7OBW7`Utq+Y;<#2DgqJ=^6ZT?Vx^g}%UADi<)nE6dOm+45I%(t4 zu=5=~2ulXH^Nh-{(~u2!$l%`YbvKAcvs*Dbxl&zjm&2WuoPE8O68ep!7hMjbIX9Py zQ{LkMHd)_^xrVEOt>drk?8WbtgkFZXE5a?CaMLH8I1Y4la*cA1ONH*h<>D4Gj}9#F0}XP- z;Q~HABOPu%jdx|ibyCmaf~aaip7)?4Os6^1$AKS{9PC5}d`cdj4&zCIy>zyX;!TH;5F)^;Vz!_Uw;^9BFC5!kxpy-yLFczu-4HdQoM$FE*d| zO?pvTpnJT%==t|=`S#+(wR;D65ftVsydm66sS5B_1dEny?T%kY_q z@rPgD@m!4ia0`=MTIFybQZ7q0- zmK4t`?ZrQL${U)8>O!_r*|-1AQ(hm+bmh+_eTvMLchl=2bKQ(FymJ@yOGT#HinY1I zf0@mT%EGR{UZRT77H)|e7S4lnMQbRm%~jzAIq~n_(P-*(Z29!x zuGJOZwPMxaZU5<-*vDb+7s)=3P*sHcI6`G%=M|yn%8ptEoL8>+m$khutVBewuSrsr zs*sZ;RkRN$>;>8mU_Sbwy(rFya@eORq-t*sik-b)vDuWHzxFpH#4bR7JLXk6%CObu z6>AjSyyx|M&xu`jW7B1PZx>9tx@*6Uv4Z@!^t{4LPgV^X>DN(L&wpXA?z8R)c8+-M zcX?Kj|GNAY?((guJ$XCZyt?mpV18fWYZJnW{EnAb_Yl+idKqF^L9TEc5l&oRZG`QY zdK)%8*Rq8?v-@XmHo7XddxaC%W6QXXb`u;i6DQJRcw@!$rQy-iAnTmvOmlU0rYEMl zvcf^sr9b}wPh5pBG{kmAVK#mtIoUnQkwC(PjEt0Imk~5BeF8j4J1EabQ3qwx!|3zI zNrkySfLf}{9VM0J@jPm&E-#!^nCtVarMlcvQkm}$p_ZESL6K&BeSWnx;xj>-Ah-DS zZtLT$<(a=BP54ZZCYV#+Y?vRVBMtZn7wSz3^f1jLe`2<9`XACRoVPq82)D_o%EXssgd;v6 zh06J@i|Y2K~t&F(JvBoE{Vc^H{#A zY+@@Am01lfxYYtt&EYjYr6|uQ6q%!&FP;|Md@;4y=8LI?HeXC;lSejROc~e$JxN}M zw_t2l;DYg0u?xm$_QRkp7mUyB7o5-Rw=AUng7caE@Iu-zIA1nC?>{UcTUQQ;6EZW| z@Atw87{h;CfzDWQQH77Y2ujWj%XY)pqj9wIju0-yYmb80zp8>iSVB($7Y_LbX3>Q~ z);G8uH++LL?a<|YgUhbs8(f5?U_Zwo;#5Gks@DQ4pgJE&XL&uHnL+UD5Cymcz}$KY zs6a)rKzF>zGme7(x$!D0oM|3a>5}qQ_sAr729; zzbXq<_%YzBELLF#gR8PYYE+2UP8SRC%VFvisqm`I{h{#Mtc|hoI?XMi@Y+N*z-3O0 zvOIr$O$5GRWO+_sFuFX)FBn~(^B0UR_W%k;7h%ug*SzG{O7T&gBFa8tRr~b`?%6VW6I_+`+WQec75i(@cXL~~2Hm%|&1yJ;X<}YL-3{JllegG*tmU5=5yB{zY9Gio&Q+@hOZJ&!81X zmx^Rzw21H)?uU29I;xOb4^-B;u*#T5K} z7&3)7A1qlU&u?`7vo}Yxz}RYEb#5$~bur44z+ck$pYS;VW;ZDOUM6Yl&9=RhZ(Hf3k>}myVHR z$#Zxhgm2xgFj`fli`ZSyS}0=ms)mYKv8X+7<4G=o#^*riF&g>67RD_TRgPTK#Omc6 z5}vb1KGmqkQCNpOTSH;>sp>DRCK+}cTs!|GSBJdpRs1DsDGz;ruz7I49e>B95sqGpr!!}T7$>eISSc6 zmFUQHXW4yYv(bY;MK#}S^*x+|+qORO(>Kp$z=I+~@J1rb^(lD+u*VJKp66fk=4)zt zxvNqa=l|Vb0MovS@h=zHvXJ|i?VHv)|FUJ-#JtU|1$w%R?^AaXs5iTBy>>gkKo;^h zN*9R3lDR) zZXKQw(K0-uP1~@ri14tsZ4+HBL)(Up3T=6--ELhQ7KE%!M+Rk#cV(q!I1^ooxcO1U zgQQoDg}JX}s2w(1dS)?-(G-;j0y=w7>^AXvCuVV__L zrM9#j|HV3pnw8U?k!2qo9zRL6eOz}_#X)ryYyl4nSgcjUcBQ)9E{8iQIUBx|biFlh zM=z~m{XZzHsMyG$JWg70znK~n{7xY5HhZ4kgxEt&u`4Qd$~{M?l9dU|m^u2yAk?+cnyi1;5}rcAP6c!DV;!2nvZ3cS;by zf7B3~1+L+0xEf}$Q1dJX_3>W=FM{dnzXr~>+OD1kZW_X)aPr33aQBCQXFj6!NNQ}&6O7K$_mYM*Urb; z&r!5`O%98qJJOu#<6zx4$-yp(K@gKir^AkL5rnnqbekNfh&bJDS6Zgqk(~yv`w(nL zFJIOgEZRk>8-ACvwM+c&IctxtqU{EVW9*KQ=oou!@7|rF;$q|M1JhH|GbW@*MkqMK zTE{yR`Pm+|W6oyctSsjwN4jf*1Ac>fv^&YFzq7qZw_Y)wVtaMBgPzC;`bp==2%tnp zaE>&>PY$);&o=wo$=2f5e zkIJyyF_I9Vmb`f0e_NYElm|pOOzpyJ1JHfX4aWoJ-I*LiMH*@U!Aqzt2Zaqq@TQo0 zLzKOH=U&}<$3^vkmYkKGJ~}eOosj`8H6wjA^_kW_{=l;6B-$fnh0x=E7*xZyw}Pjd%a%dUyDC?X|>2Ua6&*A)5oO=It zQaA@(=!DyJliiaX2^kqF$u6Tso3PM8QwnX}rfu6+twO_EnuL%I4GC%0sujMs3}Z(| zmQI`(U^IPc^O#EhhEdjFDL4@>mAl8g_(x;B%`jdNAH;j<3Py0ED}LPQp#DO%7cx!! z#3%M{H!4I2$7g4or2*y-JU_ES$j;z|q?GJd;qqu8 zzh~5dn6B;WIePYwaSV#>*D|$GZ)P?H4tmcRxp`*yw>>9C5LOV&gh`L-re& z?oLi~#U;mQIkP5p>^Z>E-|ciKC-j4RD`1%bx;w>ojv5#@Ag)_&ZV!g?&LpkoN$LgX7RYZ#ZlM$$%M`2M+Dd0L(^?!?-AY@PVgF@ct6V2${ku|4`pMfcueS zb1O#~P+AuiL&~Wfwc%J}z{GM~PWsSp0$}EIoL&yyzcql_kp~XrdORA?_!@ z6vKuCDL1<{0Mn7#6c?O+1n)^IGZx1GTg2{=)35%&mS-r+b|Zyq>of5!lG(FfcO)u64yKPFkf9{#m} zV_g6IovEFAw3ie(RtGQ(I4%G_dus?mL^ah!|` zwJT(@R1)5*W8*R;KRAL6?EsBaM9;`7jl{>}7J-<^QF zCl7t--xeSBy$-l{^U#O>eea{bbAY>?hd%VL=1uToN;%a>1HgrGY)N^9tOFrnUj!S7%%BemA0oROUbE}W;KI-cS zxDh_+o9d&!xqw^dsn6qF-EJzU$j&tEJ3ZIMxQu+pV%NHU{y+B41U`x)?f)|*Km>Hc z3Ibk42ogXv5KbeKkOX>Q0+Cxm5{@7@fg~KF0tObxag;qgcExi&S6%VMa|uKU2#Vl| z?t0;kuE_2x;F16DS5@6T-P1kOuIs+<`(Ntw=}t}cx1Oq}?y9b?ko&Vo?nNgKv+B(8 z1!MHMP~O|%{-#*bANerOwyh;xfd`G+>%P?AqiYHO&b5TNC7F_v(CGY8!%FirhB7BTKeIb@ZO6OH`e{1CcNGTO!M&*w!Djhr$ zs}ZFIBgPE3uT=c6UcSIK;dzx6^A}eAdNw&^QK@aWqSG40X=+pI2~&u-RG1q zDxcGR=ClF5dX{JRn4VjK|IJZeHS=Pu!_1%8eeV2e2rO4ZlPj0bom*bDaA|jJhn>F| zt5iLFa?L3NJLodFfzFpVN~`%iLyPRyBAd17v8-%?akW}>RGJoUu0^%9K+8s-&{d1n zX*JJfOsM08niV+J*9rIQg-wf`m!?Gp| zCW50LzfTKK%uE|6BBumL4r^h5&g6Mutk=WT-b7gwyCr0n-|1;wF# zzOXS5O&!^^(Rq|6t zk;yHq99xMSaHak%$udbu#?95Rh|6S|B5eP;WWjdF46%1Q0~_iy4L6IS zKJL3m1^VMuGaH8q@EspfBS3QtX-p{0ZQUeFK(i?+2A<+WchgT>y}i0=PA&S7es$W) z!)*E&cGaT!oweLei@Iu&ZK|u;rme26%Ft?RJ8L!XzN>|`L(&WUiMk-Lokcm@wfe%$ z492D?r#5F#&UX2LeaNqIrTR3(#z@>K+@|Axt+0tGsnAceh2ADE^dy0DK~)CIMo$LC z;8jqnU8>I)>8FMBjZPhPJhG{d*}#~k`cA-IRzi=h0My8OvIM?F45tU?%fUiq+usAr z8#6d9EL;Lv@=r@&AnRDV2U=?BaLf?aybQQzOV{j3<2=~H`FVj2jSFF$9?mb^nm^d5 zhB3&EERhkIIrwhHmFmM9tFIXv`cxlhj;X?yY1q2KMj}=8kJ6TBxbdZfbQ@#XN(~#| z5!`|+)wdY;-wNB$pz^^$x={LHpk*G_X5K+DI~I&ruuGn5^&v<-kw4)%&*Ybx|+6_Za# zDO+RT0@z|I+y6-1WnM7u(&iR-`IK>|%@%h}i-s~YL?UX@)?iR5bcda+2EWIZ>SHTV zA#5k%e!H;wn>6w@>Dh>NOAOojm*!4fDe$A)(qMZ`xcQr<`kM7>;%nBk35EFv@utjO z_$z%$8+|=3++xEyN74Lqw|L5Mq>Vl{3AaSy+++BXHu|cUzGC!=4d-6NhqTeh3(`jd zeg0_pk~aE!S^7d@O1&Ibm<(~3xBKx&rhv53$6n#)rw^4_>{fNN4i@P{+UVmQ;U;`c zksSL)-LU3KAJRr29}2hFFqY{!{@yH}GL@x`KK2VYw=meK$uOjiKE8_cF&i$rSr3c! zA#L>Wjc|(%gY{5155ppTNE>~8FWhv3EfCFM`Nuax{T*uit$temFg4{!kUIN)Pp?UD zSFz-{o!^hVX2R9qroB6_SMzlZk6e6%?x}zAeYLBeUN9p+b;;+)-EqcEYe(&zdHH$2 zeq-3@C9NV_)?M?4A0Bhk&_?gywD#&r+oWb{nu|>o&5Ut z=XPKB(JddP-j~r~(hFZcGWob|oi4awZ{~}CeC6#S+aJE{iI;tbzlYu`Z(Z^DczgKK z_x_fD{ngLatZ{jsQZ_$#`KMa=>$&%}xO3Lkfxljw-|dnXfBcgk{_~BRpIE%A&u@lY z^v%L62Nb=aKcBFE{>B#Jtn?3_-}mbM!N-cnow@dvyY{zldGV`FZ(P#-w&s0OTWp&) z;_oNx;omk#oAqd~dmeA~@S)w)Q=gnR^WqNsu6=dpi~8SA!Rrp}ojP#z{xw6pj~m-> ze$E-opY63^|K9#Z6Ej0Ezw-7yO>!qZQ!{^u{`~XC^~asQto!eN?DM^IHr)Esuz&99 zJ@VF%Z*Tj{=eu8V(SfYL-~7*s-HQqeQfAcOv#tE9^Ui$j+?1+gR-OCggJ%}x zse7eGt^K+FyX)uc+f^?7Y?1yubo?v#bvS(1yL$O~srQ9H>@U6h&GOBUm2Nxn>fg`$ z!!2Fz&dE*dJ0z{)n*}$$s&oIYy(`?UVKtuiuEe|><*+WrZxz!>iDX+rLk4?SVpg2_ z#BImRx%2`<2EJm#Vqc!(=cs~a$mg@rCFx;tdO}0S>Z=J{Qv5^s5N6=CePc~u?73;k zSba5xONu|84`FUCUH41V*KX-3-oe3F%o|6xJ}Lg5xHDekUw*T_>5J_cO&Z#ItFL3= zn&Lkmccx=>-OGrqu2)-?w8uzaF{!~mImOSR64O^2>Os>Fz8DuW*07qxCB;98cU*4{ z9fi@j9@YpIR&x;+9{c7g7xqsx{ingjaNuK=JM#56r-mv1Ox|&IF7LF`lpIyw$mr=T zeQ|h~;^)|f$j!b#?lgVfseF;K`r^i+6hEaYL=d>aJguC_Sbec4kTImjLl*5l+YD>B z@b!1`PwCnnO{V-r{3RZhINVZMaJrjBSSL{%Z~pJLo+?B zyOf2D)fWm`j9!;E?KH^rwMF?NWA)X>@TG@f`g%(_k+J#`HNvGFex-bofv=dF%h&WN z{&RT8b>^L18`eWTMkQ-IUxpDDAQ-;1cdLV4;fr;Uj5REdoZaeRz6$Fk5f(sSnR4;L zWu|`=TvVasLzq}CL>Uk*3FH2B<1HOcEtV@eCrd42bUy{Go9=fgU#Cc4G40Q(!k2UV z^AdbfcQRJp(IC3&eo%$gUW5hEcQQKxVW|6L*!=3Z{1e+dWWXuK&$37Jz;WCOqvzmY zB_{(<5TBSmET_RmmS;*nIOdtrrmuy{7a919*_qS9@Wl{%-F)IRrmw4%FETRx9flTm zIUR)@=9(m7F>G%uUu3MIXTrs-?*|{<*2VNCIzT)pW7V{i@O2jM)bzxwFW6%G>d0;r zhKx0=)8S&)cdMqF@1%`XMFzfN zN-va03^|Knf}Ov==uPP>mgy=O&Kp?7rjKksC!Xmh7@5~T-`TGndOn^xLol)}jjdlY zEV=uqyI?qTV*hl~J>yDaE^~ zx*9GgvJn%847Th~t>C)0;et1!Sfr12$qWteqyMJoCO)|I=&77I`Vubvb%y;5fNk^Vr`NPL#2@}v3tT8(-gm+e1EuS??2M?rpeb`ISa-YyW@=N$Z?&>+0mcW zo4&>>UxHDsF~dgti%a_AuTC$V->JC~)@90FZAAOE8wOn7LNH z+8JT(P`(6X35!W*hShWMls%>|B#bbEv4q7Oub`kJbI3C0pu zp75oz)3>|-mcW@tSie@j1Y-#+U-;6)I;W&@nM`< zsC)@VJbeW&8L&y0*bz0`dUFlr{$FJ5MPDoY_qgVHuhm@m3-VIZ%~4-uy6zv&nLqneL*dx zjVKygl&5d^8kku)yhk?fp}0+7eAM4K>aR%48&XtQ6dXRRBu{Pd8rWZK-Wu3{<}|W$ zmls8;jb4V|LCFqA%eHMWu%58y8@PDJ_1vZsuU%D{2w?s%i}4EBmdiu*AfRHaxdUix#h%OB3uua9AZ1e%bw#2ANO$I7(zMx zmreR{fQ}~@y2a8F){AK3FnQ{05Qo09w0b5*sq%PsrZ{BCRu6C}LCiswaSxB49%&X# zYf{-tS6)B8xR@TSWkejb*)#8aG-c{^-+=>j@N>NJ8@<4y`LoMQ7f-ILoIlSuuynlK zs8w3Na3TKBfjDDP@Pi6bOz;_h)wEJ0$M7vbrjT~WY2}zn&R>c$)x#jAAn&D|RiSkB zjD_*Goo@7#s{0$#a@bbg*~SkgE0U)2nnW zzJ*UNH5r=u6Ax8J2X09Cx1AqcTCik^NbDm0EM8xxainmP-ZQg8EI=l!v@rrp6Lp)0 zxWtqhJ6oNwmVe{FhRGvu-CKN9-O@x&d`#?Y;l_3ZrZCyhIJVD;BkIYEkq9czj-D(L z)AP!+2R#Unbx}_ruedILV5!$CtcUO;e8dFevGT_R;?+k?ARe2Im_WSxhzZ1qSK%^lChKc*{^g_BM8`bHXN2HZ41RJ5rKL;e&dtO3 zIk9GX><`*82#Cje*|1)HykV0~wc`78%wK0#&BQ7E7nd*0l%0D{Ngs{`it$C|wK_%9c^PV}4y&JV76 zdaN`bP6SB*ktdUwM+fkYT?@#|Rx-Krn8%Yu#M+9hDNglbUz`U)vMDhC$OnOUrfN_f--+G=1rjO#>8;Wy_AG!Cze4RudGuYh z12LRi{Elml)kR!1M*M8@_;{XT1c;lE7qcsY?kra|;OQAuz8hj`|9D zG5ZzBvA%r@rtt~`Ka=AwfyH=D{538bD`!0+WF9sfeSnLGFSAW~R<7$wKHsgl zXsn#szGUFpM_`(;;J_H^VmtYRE9#kw5g=}ECnfL{k$y4q1ZR^+{dhu1tZ|daQ$*$^ zk;nL5ILA%T zd*t49;$q$xGD?*98Mq^g75$ORNg~H_qfM;An{~{2j-EEfD&pg~F_~eXI}?{YjDiEE6d#A<9P+Z= zl_pjaeQzw*x0k(j?SRE8)+jSV9PvsfASB3v@I9M{U&as+9HY}(|Q zuCwJSemELzi+~J{WxER-dlxojQX1PbnnW7Om{A)UGxEAtiTqsxP9B|+Eo}5hqlZa5 zHP68ns~g=-BV*0@%UJ6nn?$^gQf26DyJhIi{XV!-e6r2?si)Emf-DcG(r}9oBkyil zB;_ZA+@|Cg-3_;j{ku-3kr8F$-GD3hRGRp6UViGSBKAZ%10j}(P;qlL%oh8pBLA5b za5+yvs=*~anPfjlvP^>X#07)3-+rpdenG|*S#6QLy=tL1;q+pDQt;+ zFnN~>ijCfKVWZDE!iJm07>9f~zTy+;T->egkKX>Vb&NF(+H5x`;8%P^jR4J^1ww=j zg)NtE5`|*6vcIxV zZ60j5;QBv$s>m@S>b-H7wmic|wWZrQ!#35hErjhRTt`n8`Kc$O96eQp?JryYyK$w6 zox_`i?dYi@v8QpcU(^k2o=h`oV@Lg=a65Xch@M7RL4(!lRFTa+Zd-NZ3tMippCV#E zWkf&C!|k*X{rSIoN{H7}OY~Do+)fSAPxWwne)Lq4|K3wYUNNhKvc-Nw!qK(cNgw(w zi;VRf5Uf;JY^YH8o>z zJtJec@;`6Dunfnj8By>GFD$4BgyZS%sEaYMK`FwWURihz^!6P)_O)pYbA(` z)mL-FSG-=mlrJ(?UmU!edRb4q7^i%ZvHChz_&S+)T+--zEm6M6SbgzhAer)Ht*2f5 zPWd8Z^~E&<)0g$Mi#p|tjMW$CdZu31(=OguzQ|a8ahr+srE5b%nnTJL8LKbu#&9c9 z$0_e*bYD^)-%*?2XjxCUIbHc8179(3!MWzeX2++<16|f zbE=5x>&Kib(#8nu$DAr+`Z{{5$liaL=Yt$QRpjWYB1caZ(f`+85UugiQ$_xpP8Ind zI|1ZpInLxia5Be#-H{ujgbeyWdQ^+Ib5xF=Dl#oEFZO%$qo;~gAw_t&iZ}+v{Ui&A zV?G>r`j{tvI6k(XDIgC2hzZ%;%Ht4R?8Bp{iiiVoydFt_>@77uu8;p<*?s_t$B+Fj zQsX~owo3h}pXwhyRfLBi+0X4T>x8vp9X(aV(#o4>Ovs~C9Gj-tZox=rug8R_V@tf^ z#t9ZjPZh}@6B=Ebxb-k{Beoe!;>9>e#%%bK_%QP1r#4kaY5U279HMmeR1u6H;>2+m`6Mv+DUNT`ojCg6t{7N_ zapPX_z%iWN9=IpKy#ns4KgclM^jLt$k19rz&U*YB3D)TjpKrsRlHxuACq3xi^e+5= zLR>U%=}fL2nA4JQ?>6%Jx`AnauMj8x^Ntzr66uIL_p{6gvrKW;aIM^GFuzK|@mqu& z!F=t=ndN051Nx)SH}F3Eg=vDzjGxId-hFgrs$AOukIMypO zT$AHxQcJ-+=7D<|OyFr5uA98m@VGme;fjO$uHjArbF&9|&w%-B5_vrl&R1YMJ|pAj z7VbDa?hEE>#ksZj{{;6qnERfU^4#hh%geW5n*LdG)_k+3b4xJAigQc9iy>wRm|gXf<1TI|t~uOWZ^JWO zG;Vri;#pV42oN_Xd7Li{2RB)PD7bpX zy2X#-z6ItZ#kqw`Jr00L*)GF$lgDAVPBIElP-Amk=6dy{a~ z;|ns+%TV3)_zNDl0&_rd)^cU-kNWJuI0qMvHT|qy2+Vj#&g{1s?i4WR?iAu|r-WJM ztpc-Faf!nHJ(#;3IWydwAz(e2;V;T?-Nv!(j~)i|hT^Q@n)1rPy$@#4E-BBg{xW%I zf$8;<6KBAwosE8w)< z{3ZV%u2a2ifoB(k`K98d9`W+Xtp&3#2{#bjU0^;`9NPz{aHqmOWe?^(xMigS}U5!_}lr@lgI?&-&zE&;Pmac=sO`v}aW zS1HXseiz``C174t9Q!Ay^y>xpwAXyTb8ykP>Cp|(O28~j!kq^08Zhe>XD!cWIVJZL zn75K}gTQ?Vrt|Btz__Igxgs!YJaBh{`Pc*3_zirqgp0;4T&7Don6-*?OFzc%4lo~i zke9mG=Q|4*O(J;(U{)*6Eq<&=e*p7-5{~iny@_@W7mb@da%Es{Pr`KqR}1Dt#krM( z^T2%xChsj+VBGW_gJ+|`+?#~sxb9iSP#%p_xhJ<1+*^uui(embA9|3-`gIaJxftUV z?%N0`1KbaPm0(N!F}Wp%?+n=Pc^mBkE*fk6Opfj89x!hw;nKl<0_KnhuF*R_-!E{{ zxP?o3Cxbb|1J?)4U=Lggm@*ICEHD>4a%TI&{8*(J>Oo_sv&pfXhdppC&sTwaC`q^v zfqNRvoOfY?aT{Nqif0eMOTsix@tcLmFTHCrw7GF-zn7d#19Atr`xR@=Uo%}Yz&#G; zHO0BL2ju<%rq%nfz_@Y!@vJA9*@|=Pr@sRC8!)T(QJQ;uunf;`0CW5Y0&@*_0Uq}N zbGzai;kQ%zErk2yV6r}x^4vJ;caCBt=`4@+dLX!xB=X2j15=%Zt42nJ!Tj)%4D}fN zanj=?aN|G5@kgIXj^jKht|Pby!R+}|a`+j;S=*PtfceA&cM!}Ej+|Mpx+0vk&t#bT z-6?+e;bBj3e^sni4{Q9|?Z-PBTr`RFI15Z}67F6IC<61h&!xQM@W&~BELRtQ;q&ds zMPse!roQLlS&zSAJsTH|Te)hEXV)o4fVeq@dlKAl1NV$#t@@hbb^x~(%qK~>vEUAZ z(Y}NQ#;yK7fM?Ue9DhJyu3R}D_fU)^o%JAhod<3xxNpG~eI=#2>C66n1ei%lILey= z=HVn9izN8?lu2EzSg4_rPXbo$?M za{fPrsD$qkcYt|aaaKLd`ZfV#-UD;aKcze?XO=(qGlLZ)NoPH}LBMcuOTU(sTRo!t zM#UtO*BB4Cdf;{;+#TS4f5<6ZQ{U6^_+2nf4ol8WUxu5m7)d(on~I06J#y_la18ep z4;<@t2M^pTaGk*2t5~bPX1Z|P`3RVej+|KzT7ugS=1mXW2Vnl0gc}KY4PeeY0t<{= zd-XV;%?H!zTYOgRqu@8Fq?OxF*MC z`!Qg$PPK8i{~p6~)l)IB3ghd5mA9_A-rO6~-<7nt?k(v5C^Jmq&Sd;6h2{F@Cc=%3BETG7s|B zd6ahtxb;coF+X1PDDO>hA0?4TeN!{Mn>?oTdvP58 z8=ONu{{q}$#k!>n<+bVLEuA}pJ4>-{^4N|SgPE*2N_I=<*2(>)`e!k;iiCKiymU9RselV%^e@`sR3)HxS&gB=Q))nI7dW0C#B;dF*Fy z^eFE>a2t}yWBgwADDSV}KJ_54X=iWw5de3RV%_qC@$2tVUOu>D5AtSvlvfFExn16( z`E#nK%t5TAp{6(4#&f&a z^^KRud<({L&i%r9;4W0GTe?u*GLQ0Vz+K}(-UA-xJqB)55_#-r-tj2!@8B9d$UCL0 zJ)ND?uLrmRigimrw&N2#%DV_$WfFPR_g7%P;rQj7p`b89!w19xE(dDM3qm}~5uL;M~9^Q4_~(D!vPAKN(xd5zD&Ivg$< zH+@+@&Qgp3adXqRFSvpv@>pIbdz3d9+|nfSI6t}`%p-QrLEqhA{%YqO((hX^&A9*$ zW2B3Nye?pR+c^h$qrgm69HqLY-&`v}K`dXV=dm@OXU?E~|zopaE)-I;!0 zCtNf}x;W@t0A`e(bC9|k_ZZKacE>S<|Kg;hs z78i}1zUL9jZ-DzCi9ELBjk5i|U*Muily9el>8Ut3efb`z1k4!4x#b7_mnw$g z(m3S@+wm#j7AZDS{H_FZo#Nc$$8z;3m}f2W;>!!)9PdO zswDEbK6yKs2Q6HDx-dR3CK}>`f#T*AF4N@* zxMsbRm-|z}bXA;NIyZwn4a`W3y!dos`cGF3tim|OkFlEJ#M#{+|6{4lB;BelUNJ?Su7BTr|8pr3<)e91FJA@@^a%i=lWIvZiHfubaBX!xi)!D`N4K~9=OXDn=n7X+^#qyTwDIKAFKtl z-6AhOKUhEh3TB_;+|rrhe4!Xvg>g#13_LjiF1@eJw?ukmg2`4~B0YwK8E26fuLtYz zY%t3#^5Qv`m)|J{R$-jhuK79|&7k18;ABw&Vh?|?fbHOc5B9G#dF4)QiCMnn)dxBS=z?yV&9I6gh>QC{P7 zu-=J_#z+@i{Fr`cfhn+a4*E_8GuO`9qCU}&05xB}E@|b?V0&|<<67|!Mf!UNq9>*K+fceBC zFTVffc;h=Tjn0+n$GcPi%W~90F|Z2b#Btso0M|{iiS!r1p0ggm z1ap<*-1MNn*C|FQft!;aZ2#89anAku9pKh0)=dw-mwXY-LB%CXmnH)--^WGcCXeZo z4W_^1q&(+zDF!o2ac=3tb=wOS!*FTb(q&p4=bSEcz%5a%n;vY3t^@N&#mV?N%X<_| zZ4!CRx3?8T9cbLzjgP<`Od^l%MtYvi3n46lypzFYDb`J2*7Lz0<&6b5C5b%hyTYTq zE5Q9Wi9F`V!(g`BIfr)q126~doUI+FzQ^VJeW&80G1A3B-Z@}2J7=4}v7Ap=j1b71 z!#XDG+YE45DK=4kyA{m+iZkM8(}VTxc`z?qt65V8y^H zjNokgrsBzYHqLiqM%=nB+ubqX7AQ86zN^9fN^yzweGtqO7J2ddQoo&G_9#x)-*}Gc z_ZP*$DvXo9tZyIMI46D20QVKRQwn4{C(^eEm;s7Qr0)bU(=77h^#` z8|PFnv%vKNH&L;P^sNAMiQ?S!ua09?6Am-k00yh zJ77LhoSVK(mxGFdRT!uG%XB?r<3#;+C@;RjGL4lu$9A0a06(~PicM5rx`XMjIJb16 zzT?1@S>(m13&%rMV3sM)EnWD2b+uw(6~-xlsmGPzZdYs~JstkZSZ2N%(u_Md~J~zpDxt5*-*?wanZQxOYUUF2oN`? z@|+4_yInonjNkZ#|f26z3K{*2_1+?6b&=ua|6hzX6k4EYmqrd2XwiM0#)@ z+CGkRZg;zZ>#JBdJy@Q{c$9Y`xS2`hF@9@2%KHttTaw6Q{GRnFZwt8HN#wD;`Vvgj z;j#JQoPH;P>8v=n^kX?F0yEqqFTNab{xJp248zt!MYD>hMi{vDV* z73Zc0>suX|ZHh}2zdedk(Q~bDuY&tZv5Df>cm&=H;i7SiAJh3PF#QzgR*zWULSW8M z!ml&sE^Au*h>RFYCbEqqszRYz4E+A}_wYP>+3J4kY22Z>c3R?SvAz zIrVQ$uVZYSQ~$>L+uX*v^>1y!byTdIzLb~mQC=~)^OMM9{ap;^8pS0lSAPKWU=n#O zS1*8h%_7e^KRyHVO%jgty5{F4&kwc-0UPI*AFXYiTYj7duDfF0@`LT^Fpu&^fh$cS zkNI&am}?c6C_nB6^H>sj%#WAB{KX}-&lgMK|y2zuvN^r}Q$m4kJCNK{uE>XU10`o!=d2EOFgE^qMMEP+< zG4LXcTf6%`xR#@2-X)4(Conw}=awHVS0liTx5$exSL_$&fT>iRn;z8nQpE@*aC6dw z>3li3Un@3|9(RFxSaFH;cnQp2i@bO}SUA`TmR}8GeIO&nWC!_to3|usc z^ymd9PjPN~uz#BbX10Zk*Mt3U7|cycIM&~%!PF_vO<&R8gLy3p_Y25-S23^(0&)T5=1b4!;_;Cd+5$Pb$y zls5v*R6FOO$4W3!J7<%}bh!`A({|25-d->t+Bus%(Ql2jri+`t&B3)%ted`!UvH1{ ziol(hL>|*`KA0Li=b-OxU>>k@HhnqX*a2propX@qACK<`anU5ww;PyTJLe$pd@$v9 z&LMs^U~aT?4)UG^v&GKY>^Y`yynqOek!$DpbFum=ZO&-hhD8-0`!Og9HOa(VTi9D_&MZw%_ z=N#f!59Vb%=McZI!1yO5*S9^GZg$QlkLec#Guh5L#BVv6h@G>^WBYQiVqg` z_pAqbZ+Vor58Rg?j7_07w(|9^3gbB@2zo__Hh z<#hr#K(TJ}$V~uKnS^T%?pKO|RhYbVgiAFt7wS$v?w7g?-1CZMOu^O4?W^X*f^Hc8pXgWjK~j%^t%e&J&HBLwQ=mXo&occ zowMoN5!?r0nwBNkwB06ss2HIHZbALt`dE}OXxiJa10$d%Kf^r!)I{37hn!9~M6ILCf456m>h8R6Q}h3U5h%oQHEbztsK!m%FJDh5_zoZ71uc(M(g zHY0I4AomHF88Z`e)FW*c&Lzf0vYx_}$)fy)4QsR!;9a5s72P6GFo2ae;lS3PhYz@^T0NEg;iJkt%!-|67`D3(4% zy>#I6z?9fITRJn}E&%gu#Tof#YY(mf_Xe1*F*#rVxq46MTZ_;P9v$TK0~ zV#vE$$+Wi5CMU*!U|v$3N*C2{nH<+K-vskf5{}^>0Mlx|)Yn?iO?l+9z=RZ+D1NiR zT&6g;_^}d>e$#l`% zKWqN>1{1V!`uc{+v7V0tGhcB=xT1YFIi^b#%tMMxlrCGqd}^0x%iqC}*R&ev`QoBU zq{lcgvn^b_9?airFe{UA)FT4sLB%D~qYli+iZjy1rbi*C5rod@%KjOQi2^FdtgD zczxNvdG2Ji=1XP#Bp0s-=QFLrV8m2WFSz3_Wb}n0{Y?@n4)ce&m{iX|K3M;pTuDXXk9?p5xuwV1BDO zl`f9`%*|jPwsMZ`^D|(!CE-{<_JH|Xaf$S3wha9*E}BH?7XnkJIJf*|J2?x?FO$e) z{O$m=O>v3h_ZKpkB#+;zV0tRfEq)C5957{yOVn;$0p@Jzr<-R+Z{z*8Ns{$|= zDK3#7%fQ^CI5#~w&UqHhM~YMBz)_C_U{Zf+(brLrg4CV{PNj;qBjo*N2z9zXIt-+j@grgqaz>H8_B0Z*pS)({NJ;p%ZonVeAE|DIo zS73b{7meiN$L%av9l)HKgrgq)z)Vz}p@*&94+B>L=4p#O=XBlzX0L^Fj^92oUnb!g zzr$co2}^yA_}SVGay`I|QJh;kZvj^crr(vZ>F2D+ATVPsT)ZBv=Vf536qhJ|SAeW`N2?d zaB*-{asKE6?d%Sv#iI&J#}oI0|6PWj}@a>y<$8k|2SG&&Rwvb?miYT?Xz7da|sFpJ8k zR?T1N$ds0pghuC&8djP=>ipparJ)f+h6INX8PLN)zlw@ERg)`cmsU<*R6ebA`a-Bs zI(t;6VhL5(T9+I%2*zPzYR5%(YMLGBi z*HgGI@%j1x>U{-gPaIQ;Fec8NH+}xZ;_AwoQzsS|jT}-maoDhualDw`)(Eu1{BvSR+i zsx#+LndLj%cTP+H6dd#HJKlGO@5V4TDyhH4Gp8<`UpaqzRYumxE*T>#P!oeJ=LexeBMu6y}i0=POVn+T)#SP ze{Ldt){lKR`c$=T395N; z2F2i2P?1e_8m@@HP7BY;OxMCynQgW3C7BudW05i$+OrMPEDuHwg(3&F$XB7uEfR?*uao|b5SJxt+AW5~r zpii}Ev0vaJf=z;v*R=3u=}hAAytZ284J9fUUMM9pC$paxsmjdLB9~-pNcD{TNp*tR zSqQl+L{@UizmKq8W4Jv6TY*f~+~=!iQ@`|aLNh2MA{aS5JI5ill)grsK-JfaQHfy=t7L6~C90+du2<|UZtFlmdTILLqB*B`G4``7Cp_D^8 zwZU-H;^;-`!SIl@V5Ha=3riAzD6&kPl?7QMTq|I;Q9#~;t*D4NfnKmweG|I$SQ7WL< zfl%bLP~@we?UBRbt1_Q}oM5C$XsVVvEHbf27K-C#&4RgaENUF=_Qrk`!@b3kk60iw zhDAa>G^TS?l&pr5w6(#=aoW`U)Il|uWT*S8j@eq6ndR$QyT8}aNMUvfo2`z)+^too z>ZxnN1HY}k0{s4_^yOdgUsYS(;?HdTBR_mP4$2C_kx+KqmG9N!Xa2^925b>LoEKQd zt^tt@ta?bsTtm!6DbAA}v`#w+17xHk4>u?p6_O)o&s{sDKrkvu9{{bdRk4gPmjB zqGnfW_!$w?{Vy<-5eP+y3Pm2xyp<^`pR$@{7w zP#Av)b*$>qs#+6;8hLU|FtStFk=d!4)E_ZFEv6Kt~G>wJ5he z2|zmR{55`V5_N^mY-eE`fqSj6{Ra0RFlbEm-3psu)QG$JMA)8!Z32J!p2z(zVcU&+ zQ}OgI*p`X9r$w*KKro_@O@pPAqiaX$8XldQK1R0iXi~4e6}%Q{#N>K{Wg0zlsDEKg zEk96H+q|%4dd<7X*KA7-!?wDxWvi-YMt8kdV|5gU?fHduJB#o`MF^ET1FgI0BSVn| z>DtC0kkv5D(eVW%p9Z_3o!qPCZVp_Yf)r)jtQAKyPY6a{388l_2}PE+)oPw^s^z}E z7&*0z-R162wQie2xrY{a4n|YaAso?iUqV-TNYgusfGE4-T zvYmZ^%A@eIwj-jceL~@>=upuUYzs!uL2upAbW!h6q$8prvvTzpRm}q%3elcMUYP#( z`*OA;*fXbxTMRBnWFk9sZhr@q07oC>bGFlm7S7Qk7)T%rEZSNKy>tot!|}4KF1^sw zK>rTWmmPI2Y_jua2t!2)IB2-_Lek03n=P_zeb@WZu`+vukvBAS=>xTHJCLV=_IbWQ z`&IDD)J_S73(%>hw$s9BH4EFJyC_Htg;U#w!u(NFmyS-Z9kQqT<>JUDmhi|9sUoyM zW>2Ua2RX7cKsP>C<+K+0G-nSh!*~I&)grwap6GtH$N*tq-B3M1LM2jSf8k!;CL;QZ zhT5?BtKFa}3&bf>NkIP`iuU?mNXuQ?wh~1lKRp;Zxe1!S>S_BM<-E0GX{N90cqu-2 zN!!X}wMd>p4ANGAUDa5NyuBYIrdJu;GD+4PYN#5(OhE@ak=diGjL!Kyq}GmxJzDq_ z5v-via~0{4KdE$*-pQ`zK(2$xDQ*RuEb1y3bq|Vqo@+cEWVj85ZNGRr(y&c1o|ePb zQOKKPxcwfswZiQ=*sc|}zreOk*uI2KhI<$`>9+++NWOTA)`IV3jn+awhigf!YX{L< zgd%?lh9_WnG%QWzvgnt~@&k{5A_lvAi*g!@!pky>(9;gpTgk9L6kggES4LrYX%_xw zk0KcuZ63TpL3GMYdLoDukP1iri<3S4BD$mJ)w3?TCxRUiHSu@A{{ zwiX_owm&6^ab0*ZL@q`|mzO-8q5GR29)h~MT=P|@*Ibl-e9egT)X0$Zjzd~icgkD! z1-cC-A7vi(d|l=ZRHNp(GIlR08+G@@bS)u!f7{=n!ox)y)6noa343q-%s z1x`xx)|LO5x#$7#9Al zmw(tx;a9EvvyFe`AXE#lyh1v@B>%jDKhwhxy^BAXpU!|z=nc1{@zkQ{rHKe5cSSig zB$y@hS4+^@h{CB$M~fP*MAhjNiY{v#4ENQ-l^M9QwCL$P8mfbDS0~_T}R;6hJo+9#&Cbu!McTD7zRQi6%`S7oqSnhdPO3H48Rb)NX?9 z&m!0EhpmHn%EUcc*xDfRWT879Hd*MnPqV#vY8H~B8M1`5swtm=;!#|tt=z;+5vk2+ zTv*o;KUMLFTv>)6EIy*~;!5mBqu@Xh>jZtYnnq+4<$Qpl^Cy9EwXwsHH?_!DftF~i zCZiFW+!iB^z?x@;_#;ghchth?iD^4`m1-z;=mQQ%wrG*(F%m#ql{t3*9MSe~!w{u@ z(J@;6CJu1+cYPAgIMVTuoW>uH8G=NIU~IB!@i;Bo;!;FfZ-lmKk(V@N44RGbq;w5o zgfD9=rjduy<*3juV7HW~MKEZpV$U=Ob9@XT&LeW+}_bwu$_h%gB_>N@{QUFU| zQLTr;_K2vD934I?Y}doqTnr`dfvtz&zBAl7C`l7fd&1UBJnag9%Y~a3xsv5g)b%u2 zTIjCXv93*Y*DScAZAdfPhQ~w-z_8s zvWj1y9+3tR2PqE;k$2=h6u<`c{}4z&-g`6uEa15Pix8w!6D zNH5+HXj$BpNvEg9)}p)7Zx($c;)9s&6*0r|*r7luFl3WzHG)_$jgCzdN#7_0b+;Dn z@*{5bGKpjd4G578h)8yqk^CkmlC2#gxwyYg0Ftq3exT)Gv~p;gi`y8LX617%8Dec= zV(Fv_7uIoxi;jq+31bGWRx2DI@f2iPzix#^Hs(*mCMSdM!S<|}Fnk8vU{TIHqwq-E zRM_P5+?}vh39b&dEWtew+e5-F6~86d9JZ%~+v%{$+82UNF5``aO?Dj@8E&XmB?#K6 zn?-oS<-IG*99+@fr>RBdH;slJ8NylBVVO%>beJ4s8PBnDS06|(z$z#fxC1SRU_F4V z#_5nRRq6tpR4E%a8GSkR<FMW)&N}bWxy6W% z^yED{`T~MeYI9)luM`xST1H{f!lLYWEHY;!O%F-UIWQWBR(%DW0$uoCA*N{;3qcq( ziV;yZYJRpTxrLb+ooxSmU^$j4Fgz56%bdLBiQj9d2bNc10EMAN9>*iuF|)(CL4(O+X%g*ct}!uhxY)fcm>cIsn-s#0Jc}1q~-3YIzc9H z429+Y{f*Z9uNZ>X3Q3Kzt89t5R>P*1v5_+Y@_pUjaPSvB3o!g~zMNn=?=>QO^PT(BJa z3)nJ6S@=;fawp4BSq|XVLb7~4`@?M%w@5{W(TnJDclO9gANpi z3!8mjhcUET0@7o$k}DI;?^wU9nn_pr5KjuDm(!&%ysB9h`I=2DR86Q6WbAs}s&>+| z@r3JgzilV|ado&2A|aOq2En#hM1OQ##Lh1>b>~2|uNE1GnauVo%w9xU#L^M!aXJRD zp-3a~<|V)3rKi|SVs67qI6+i7VXI@V%f*KfY%*WPV~lrvLqrsepT***N+4Bckw9U6 zMyq;Xv_TWfetOJ~VSL2grWI`Oh_FwBO~!T-pT@+eW@!e-QD*2h@yNDD?SG-DGS)Ob zcl_*j$BQII6PqEkuBHyn?l6`5BI!kOk4^ou33XiDk`v+%u(cGuu}HyxX8>|O&H&^r ze8ti`DtOssooq%fLswnYCM@Q00YsJ9NVaJoCNolq zVD;!Gss}5DtePylvd;E~?IT&DI65>J`Pj7~Exyu2)GKdfcw14ba=u`U^HftJcFjz} z`s=(5R_HDTyjx5++2(37$K%GHt6(_wfbTb-klk_i)}BgSSokJ zv$1JulG)t-1Hi#8^x;Hpk?u-(x5--o3`~M|JmvBSFz2qIl^Y zBF0Z?q6%W!4jm&CDA@4sk4Y!J9o{R-G&fFQ|BUp(QGtIVDx+}0%IkPR2xXOihvihqs%&@TQtKoI%Bj4e|GF&vct+m`2%_UE*ez558#Oh55r9NiOb3Mh% z*%RO3)zue-u)@FmNxoVXiM8`d_R-RMJZy5crY|g`L;{t=c7kXbm%t`F#k*mXqsyJJ zjS<}Ih7D^f75E_<#WYyj2;Z1cWyHF6k*@!RsVUcy|JBq~tGn*0iB}@BOOazQF6W~2 zMh}zo1)BM6Ejj?%fR_Y&v_KKID$4iC*ow&)gm{O8^4Cw41{6y6bSRV|yh&KSJ+SJ2 z{=(!56G!a(Xey>q{p5Ro8Re!!e`{| zA0I@p*fS_MlVCICChUk=++BDHF*+Ldw1fgfV8afVAYWr06WE}?#3~4%k-xw7bf}gQ ziaamga_SneM>FFJdnm$KL|zp7p)!reT1U;1ri*g4Xe*Xtp=-ZnD;FJvcP7jD*qWwh zbY*-^&JHzhnUqbutX&)yWQn0dAK2t#MG&^2s7Ybi9v8OeNdMlVo^*jtZe-@$6*ZQa?mADqxf+uc6@i~Rk_#)V( z#!ne~ZZT|VCCB53(Moy~6(cC&Voae6n|;SIgevZCI|kHVmT2S(sAG1b z!WRcV=x*7s$a!=QY;qo*51ZWMF&Q?wNH7yNwMZ~E|2ym#Hd3cfrjE_^16vu6h;>b4 z{3N6Bb)CQJ*r&=M+9<+u{Y#A9OU0Up44&gd8GLuxWF<2z2!uzMq7*gddYsZT7%oiH zor@;aNs3Z4#pT!q8GcaB2Pt5N+sEEIxCruC$emHaFAnNk6;s%WJMzH>w2@`=xW4j zz)vpZVnrrwanq)_@1wJxDpJeYcr(yL&`a!Hu zrS%Q4>g}6K<_hkySc0_1#E020r#6hAoZ7I~{m;irPOca$Ik~dMiv2-`UMjgB?niO3 z%*L;YnT?N-17}s={BGssScE1g>ZidbC+duWoT#%7s);&mF)1YCVlR!`Tti`LJS^HL zvoxxe7qEESl$*Y5n^LR&yiilV!j@!G)&v4eV$FQX5#c4Zp>PL%cacVlT-K8717S;3bE^O|+^mSO?q2*&(zT8^$ z4WBe@EozF{e?wqZK=fU&n{qb70bBGiEr+2`wzy|2 z_q>CF^t_CNAWI^7S>b~5+=~8=7Cu!Brto2liZV7CHE>y5zJg?|;PR!#oRLa`cBBgw^LYQTZS)l#P?H}x68dYLgSqp zD7pD}F>D`T%`nw>Ic)Nyi05Hjg%X_VdkZ!>4*VFlON1M~obz#eY^tv}5_Pq(6~HFP zhGPudMTQMWnW?7{!*-Kl`y*`f1BX{&`%J`TFKpcBl&HWqK1VYLJEJGkgZIlk2SVyM+qa9PU;7-0Y(#M%_p}9 z^%5z_8QhhkF7cI}O2L}XllsmzeBU1Ldr4%sbrBzpCAN>S0qs&4AE`Xq*szjZAjEcr zZL+X+g^e9ms*fG1p260)hw9^i?631Hu(4$+W_@^VJ2S6prWPqehTz57o+^AdmOoyb zie|ml(EY!_j}nca4CW(~>2{tL;Rcm7uEFj;qNVK7`{WETs`E!@ufE*AfIWY7cAgep zRw0`h_|Dm`zSzcWwVC$O|f|ykq9Mf)o%A312 zaJdh?Dwpre#6b%qqM10fVy9NK9sAXHEN&l+U*6BnrZ z_l8!pA4|L6wqHDy14X6DeiY!>MFF--l2XEFvC@^vvl>v-D!A`YRW_WaFv-1C$(k2L z60H<(A0B{B?%jSFHgoT`v>lHWlQr}d*rZ!G!!`>xS!*j`ll!kl?+~*ELjS@^i!4BL z;jjd(&LJO*%}rA+mO#OkrC0wcTjDRCB||IvqF6Ngt@2q=!u^{VQ41XJ>gsKq8A^Z%S3<7Nc25M zqO%E@sUkwi<)o6W+mZLlGd|Uw$WHi9M7_Y9k|%yfVV8@8{+3jbjGthyzkG$ zAUv>Y4dTlI1ZPg-QwzM~%M#%;CS7A9fg>wqB&3_zz0yp%iEn-I%@w?Kj`5Nx-s>@x z5g$Jr@fL}^_EaR+AldFjuGA1aG1^RnMZJHCT$$(KD)%r@r|PCi67J^Ur)1O%-4ORQ zAV9Il!^i?|z+R8gV)qBE%DfdWkt31KYgUejEq60E3q}{9k({J4^N^@=p&4)A3iS6} zg?P`!R_8^TfW}UMtAsH94J4;E3=T&^WMEo@sm(sTn&T^Ap?Lgj|DEC`Etc-&r%&=F z-8As>l~pxt^5x=hVUsWE?lf$e7G&dxk$7LpB(+U0^p{t$LsGR9owHmX0$j5sEhTUj zkK#AR_eI(DMH-qNpL~rRE(+nR8BXibEf$TRguim@RFJ`xjX9`;(v9%_41FY=5a%!iCSBuB`8`ZU#ab}4!fN>69 zpBu3ngOY*dRT;3>h-MKwuho=?gO!>t!bX*ArMxKrNR8@OCkh(g8Ec-)B)pg5hZc?U zkM7-FK_i0k=U#B=ai-{aIq;M#wk^Uo6}AzATL7D!7rzA?r`M^zgRp%p zY~RBsPk#g3N5Y0t!Hk;s+u-Zfj_0+iZj8D$L#(!x zeZ4v63-s1sZ}#>HItJj#4RySQIU!IRZO~GborcKD=~s8ydnKVtztXzpRlmyw1QR`#uRw779N^b7mREwj=U6#ycvoH(HqqU zBRFhkhp3i(=d)6zrCh-cY{2`=^V0DJu^jSFUtJfFukhuz?-eGC_L~idPkahkn2C=> z9)AM?hz~z9j4v=atH}}tF7W@jdk?TGjy7O)&pC()=m9HOQPE&SL{tU3vBqxHSd*Aw@4d&^O`@?Id!pXA?CjZ7K=OUx|KI!Ed0_Y5nYT~f znb|oz!reWfC(#F;*YALRg6M3q1!=+o|8DyWAUA4iY5_2YB!wVEqYHoh91)LLF__6U zz%e>mfCdA-ApMT#@WLAGcP1sukiNlvEJVY54t&fz(%l~>*wp8O=yw*uPgGz#$Vp6g zGgH)%IYtA@!oe_?V69v`rPC*a-;LB`c$NtmF0;lVhN&3_+&Lg2N9s z#e84`MnP-*4$d&q?}YK`^H9INDIR_Lz)55ifd)*-u+{Ip2*)77_y*c{H`>JpO2KE8 zsdsUx0Hp~uk=OD4p&G!3i~n8-Y{kxt5I#W-PK1*^{{@aMpwk=V)F(^76So{t_S4$| z>-+#;1EHpo&c3Yf7hvaj%5wcq_?WG&6O=$Iq0ofL324#(PS}K;gmD5EH^`ST%9m%d zX+v=|n#d(8#oZ88`!$s;J_Ad?Lx=m2yaIMX`y{~`T0^npABrb*fj6ePkA+y;@x!%Y zryP?xMw^xmUz!?D8$Rvtliubdmb34uoZ)e2P})%>_-ev|Ff3Zw!j2~0K|R=H8{jo1 z95+qjg+^SUgFjY3>I_k%FxE&G3#n<@-{YZOee{N7`kgRg4-?g1My@bo3&}9ph13tW zOSNlOUz@6fQ+B+wd51jY8XVYlr5S#3NTW3u{EPwd@z|K)`fcq}3uQRe2TB_1z)L9& zgy4?3Cx)H!_e)?F>?Gp-B^fC&)t2^J-af{YBW|Q})>s$~N-2G6e}a$br=SyYKP1$H z*k&1rzsEiJFge#u-)tXz%|Yo8OVs{E@%T0OSV(V{!3pyG9qdbU#S^wJJA}JB1vs3+ z9t5C@;V^U8oJ2wegK{gTg0gT6m>Z60@v{(%O}iQU#VK3HA=SU>f4F-w|B6oeKpFCj zbUIN7EODo%a1B7bFLeh%yf5_?K-@EFp!jjmWCsxUOr-$go(W&MxM#wT(79)72$0+} znT^flv$b&BmDnCB07F|G z0GrRTiN*FCzNH)Y2zyn1m2K{0;cl84Saa!&8u3|Z7<@dB1yq9EfI}Jk0E;l(8VU^+ ztO$X}GSacsX6$vZ&`_IF1t$K6hGa;guyO_42Ae|OIvFx1ECmdhn+eeeW`|VU7ku{Z z!v?SS+N8qda#IipZ+1shU{a)M7-LUC>?kQzhsYtiy@(G-Rnm(k?&yRmO(!f3VdUw* z^a*%aR~(!2;193j`d7rp$c7E;)Jft2BQV4<)0TGP9|lJPYKC2{0@b zVR~ns-Z|OndmQ^TmbRO{e%%NG?@YKu8=Pw(EiHnfOiCTEq350yG1hs-1fsdDg2k_70`X)F(_FuZwd{G zJmK&Q)M6+sI2nL*1i;ni*(ZPKM$9G-sGp%M%z_Q3fOsuM-jbQu52KHG!Sq= zmlFtp5_1JW7X%4GZtvxtdCI&G>4^&tv6MyL0CBzc2Z-x6<}^F8_G=Iq0Hf5@t{`u> z8=$}ks)qC=sKQC|H*~Pa6*MRYNhrP?qBxP2dS@x4AgY!QYqdKH76oXEp{W0qMEK_7 zFb>cR>@+kA@{T(pqggPoMQhPRSWXV+7}-<-{yaI@6rkHQy^Di;hB_+HP=MI>nECBzk0Q1qk znR6%s<{ag;)tjN7iAO`m$B>MV6SGsAQ41C9cOWGqIHMsPngu)Qu_1s-f!#Q~#9=2i zn&Ywo#!(*}d*uUITQCi782zwPF!V~WQNht2Pev>en!)Gt;&Gv{Ar&ek2@@tE$5{GG zG1w1Q{hx!z;0gGYpW0K{C2g#rw2|81AaA6Gp(mmM$DzSALB%bU;EVgQdw@EMtGdF2 z-UCR0_eA%xBNKxUW| zq-dNIoN(CbK}DFi#o96wJqU)5zDlE>J&@|5YZ%%TX1?Rj8djiAyhZ+ zSWIDZ4qTCJkoOz#d9B7tx)T<&bXmqk%e2pQ3=yCz&+1JBh(F<30}yZj+zC(-YB6yH z$tzkoZsgg&sQ@wU86^&nPhq?afVg|v4iI-LzXHUwgijO*w?A^6JxF4x96;RpKudiK zlu%k~R7Y6NiRB>o0=fn zf%7$(&2y7;0aE7f(oo*vG#q||USfta4bOjqxkM+pVE_=vv-JR!rz$gX08H(Ik(C|T zV0?0dCm@3>2B@HV=QKCOIGjd9ErR&OqvXnp3AtcTf0WUowK%IxvR1|Ck!O%otTBb3QYH+Vn=ROC6^ ztJc(X{?ZF}H#mXf=JS^U5XbYE@c{AsWhy|;Y5sBoKsoi>p1<4)kUW2hU6nY4Mcq3!!&iP--h!|6!=YJ*k#r=81{a9Q zG+2Lv^#GVq6PcCE?r)P3B)$_bMONbujD;H?F~noUy70_joizi9cUmU^#8nq6Vk|r; z6~>XPoYL8<$9AB3unR5ij0X}ZLhuESi|AP0@-W^L-{Opcen(l0Iu5OV8}SJaET^9S zR2X8+*P`eX9Ox~e`BqkS{%4C?)<%ucA<=7VoIJf@9Cg679&EVK!o=MjnAHn_1Dc^S zrs39{pxTf71o)jzEdUd(2OnU|3$I`P;I+>1R%D2B4$brlgO?-y#B@js^*fYYDKqdB zo{!WTkl@rlIx0Ol(_ahw_9__Co5up50}opmGMc-DWR7+*WO#&Bdlh{4WAKEJZb==3 z$Kj%9lVsOcnGNfz4v>c57nocU3gg52KSTPM5WhD`HG$DyS`bF}!7B`}K5`!<*oS7k z0tr96q1w7nI68!G@-&r1T=T@SKo~8*UKH<1_*xbQn>nFVM&xSm4Vf)rpxQb%Soao; zax;D~HE5e=Nv9F9=LTUfJnkB6{K3eOoGVLS%ooBW1q zCkqN~bz*2h^J&9g@ z@EV*(Hl4t?W*)nuw|MD#BR~df3N8c0E30xzfGsne*YX>#0rJ)*#7`RB1oJ$lAY8*f zrr2W9NQI3b0b!rOGT3G_LHbAtFnFO&H+|BbVIc`f`skaTfmzZ0m^VC+CVyFc3zbmK z!oz8n6!Qyy^aU-4zaeu=B*wr%)&Qs4gaI}WJaJf7A8PQp(e&}2ej?h37_bUEBO5Z7 zET0Hi(O@LR;V_j?hTdnWrZMb&YXd_ayJSCuUt6aXkJ?ZQ8W_@H=@`acxbT2`WN_uz zkA9v3_SiZ-xB?u+Z$LaaPV9_5=@0PCJ?R!i%cQvk95P2j+cy++6TN6N_mL>(Ffgh2Hhley7qH9L_} z*>Di4#+75mq&AcySadTsMfg_3P0?6@lvX1s@^Fy4AqpA^L+G)<7XyG(;MM{D<#ve9 z{=QFXqTQkOc!eMB4*)Wdfq}>JR5=f)VMW6LY_b0GSRT`4w9NoQ8fFs)0I?lW#`2V$ z87f+&j8N#F>7!p7#b*J9tXPLglU7O5EeN)Q5ldzK&MY(W#g{w9o z)5{T#>n99zk@ORP16Cp#hkIYbGn74B{j^L>kq===A2s%H(0n|LLu__gjFVHTOJS?a zno4FIJFVn0Bg*i zTX;|3j?pmlJB1_}dpkvRhq0zb3Ur4RBgCd|F4)-3WfH5;^+d0Ll4Kb*O|Ys{#@r(; zL_fG8b#<9&$Y*=Hxt9Fd6Nl1}9&I)AD$aHZpTa>A`W?^_!D??9kAs!TFzk~2VR2NR zht0@*hTK&1_*g_>s)y$B;qwv?n#+gFh+8o6gNH-F4n6ZuqzbA;jk*B{d$SQ>8Ll6oH?t~gHt;;+g62B%f&ei8z4dd7#Xx zV?jlw8{kG9Hy~@_-Q^Q}Twn*uFw(`(*7ngT*{LIp0N~4=XCWEqLNc!6M}GD&=(b6* z*`j%<^*;J~zc$4o;C0hPZHmoijLF81+iBuaeHwPCIQXpucftsU4eKzRPqC?e?jgLC zG=-d{P4o7__1niL+XSb#kA+ysOWdyRYp8Y_-bnCwLV5>GcmVGn0dR1HK8;5=dmpyR z*gxTxuAxpp@gS&-dbz^OUMg%-|D;db3Q_p$Zq?v7fZjfI2PO3rze3B>&dC^A_yh~^ zjG={}Fv@iF3h_HSWOyh@EQF{K0ZI zz~rhEWC}RmC0NdqV91i-jD0;}uY3-f<=;La<0@xT!0WwAE^Wm;Ifq(dwy81+);}hm z)2E#WKVT*uhkGdOKnT^@As)UxaaJ9D2zz(&wHk(`M^hlHT2WTDlC!EkWEFJ&;K)PZ z>Ja=XrLoA$#EFAsCmv1di>1S*WoEP6Fi6spxUo@DV5<7KyhG0DP9l=(S4rYbn`7n4Pq@5JM82sL+co>f?fIT37cxnNi%E(6+(9baO zoPzks$olDxP}Jz-kcjo$?#Y1zQE;srrzhYWD`nD0zf;SJJlPPE(Zx43!vV`|n~;pQ zVZl*_L!qjM`W;Em2h#=cL!MLtsIBtE#xE7z9uNyZb_E|I>vfG4roGg>BTs}o(VBL$iW|}&Sj7zhBy@m2kO1N_%Nu}rd}0e#n8zoL0LpEALNjLaV3Cee+ee2T4^bAXoy1Smz?W*x z^gCeUJitFBBhd~gh&*6Dl-5D*vhX`@*akv5nPteR0ZxOV4jo-dgJBpsh##7ZBqT!~ zerQg{lz(VW{*k$0ztQj`bMRR?45L&(G8Zs*w3T0(6DR=&`1wGXaJl{vK2*RK9+Vx* zdf@NOCE$2qC^pKGVpUXGpH=eU#7!l z4~B*+spA3S524eQxNQL8)Q6393!u3Ky#;6lL3U7LSZ-l}n6@iG0hB6#G_8zir;FG` zV4%b@72rmyV{t;oMuI)6@VjBSp9YG`75X0Pd1%Hh7@6p&F9Y-t{6H-LezX}uc$)~x z90YGEarmkN+XwnUL23@Qo%)6bxb_}pmv(ftm%$G?gOmbkD1Ls z;RKsmVQGNAH$#Q0-3^9UX!s-svaUO9ZXEywJiiWOLh+MUvT<-=rZ8?PpyB&bXV_)j z8Lf08=|0X!MGM+w2f;ZbfhKVcWBAJ zqF`5W=HSj2wn5QG&*GvJ8fa=8{AQKfI1RKQw%%GVFhjyEJ|awjY}G-=LjOpR9Y6u_ zsFO7IHj=%Mtz_?Qi^W3<#ETpzDpU+1RSTw4$!RFi;hv^YFoYDLpOrI7p<)QB+UF`~ zvO>WSQgr#OoGA(wLr4|DRPb(UGaeoxxY3m_Qxyt^kRm2m%`y}UhLB>wXEmFqP%(s5 zgL2huxTPDQAUd1jMrA6!+n-Q!4OhRU~FdfQbzR0uVXZX&Q`N9qKmj0FA$UEUP{1^QPdLz%&&+uJFe5qAv z$F0I3**AEbr{oYr=$+L}f%U;kiI}fYFoYBvnWC(tR5ryyDjRJtl?^W-mG!Zc%6gZ4 z=5nieHXuoQm8J_7E({@;?=0lvoVN&z6$*xsVmDK`*h?-T(*GK3s{W)9ev$=*p4=x|@EP%wlP2aObRE30n(mMIhrA;oc~$fcECu23bKL=nDGRA301JR&LPRDps7?yD6lhLGw7QMtNeM^{*~KgS(iB&49a zqlf|k2^YXbSgY`12>HCVD!r2+f%`gziXo)>Xq8H>^LmAfA*8Yar$Xn9)$k4rsLwaL zZd523LJE7Ppn_&6*|%dW+o`BFDO3z06>ixDIjZiwyo%ymg@PfZD9#i^Y^5Pk-Rz?a zD6;UI5fL^klnfzd>0D)PQ79NfiV7AK)r0`JZ&fH5LJAKHii#=vLIJ-GW zZYkv?x9GBxn@<_ZP2(a_lc;J2u;Py-4sHN-mhF+G8>$9#w<3Wdl+cbaJpiJB*xe`! zE>cf|3Kznps(A6oeP5DiPM3{ZOuR_k)=ADO@_-v4h`@rOg32nOjlIYWb>8Azo(SKQ z5TsxTDf(JaR1oNJ|3RT(2q^|KMNvDcXf*tX=a-7Y5WJ{2cUv(k>K_$qhLAcr&(wPq zYKD+{7*kU_kzX117gNc^C33DM3?bDRqAH(HE9HyE^+HJ!6qw3**qSor1Q1gomb#0y z#ygF9111K+7kzA$ZWe6>03Uf=X z@%}PLOO5i45}2>KrPlZ^VM|qmwh-YMxMwR?GK5yHUUUjJxP4c$6(!6R0kAm8A5B%6P0UuTd8nteyN~OF{$7S9-$y% zZ}>+$M-wI5d6Vz~kY3?M4u=%Z3?b*Mgy|truur-}QE-udBS;IgqA>jfy@EUpwOu25 zYu8xJeW-_WhZRu_p{V=B&D``rWG;sz3Kc_0^@OQhb&{)(qhzy>QPuBZ#}q1tkm@B- zxvB;XNQWuhabu=Q&=LbF1Uwc@gyRY~hLGkxaf?J0bdZh+wWTFjv-c82K+Y@!v&2!6 zp?(87p~zqeW!MsCEI<@cj-H}Gwp5rUQe%Pnz+JS~TdVG9^+d>*lZpg}P(m?cLY+_w zfDi-)rZOIC&k$YO~K_<$j_vMOPkc)2!3p_l6tq&4?)X|1!9o#fwt&qoi zsBZ<5V1H6;Gv3xq>m&8C`Fz=It>~&Qn`aeW8A4qRglXcnwu-Ld1X*~^TkBlhPAcwG zL@K_u@H3}dg%S%!I_BWD9*QQ5R9-u;Xu=R`(upulycVfw5=D>=<)0@YOX#g;#05vk zTxslU>9n3U#kEtUm7?~LR=6x70@GkgWC$hqA?B|5(z2C1K*YurV~dhRI2gYLFLJo7 z*ufCe#1ZCDfr59mJe8ucEDj~806?P&va!RRu4oX=Lyw?Ht@Bunz;{HcAxjC-!U^uK z_F5d8D&98Lax&2(VOhM$L8gZ%hLC0)VfGU!xSvRxN^z)SChGu*u0>(^9bE*5;f1B5 z=Xe;7L{9L}-oaY3K#{AShrFhEhar?Zn=pL=QUZ!ztcd=aAoR{Eg6z1ac=@(Q0`yWP zVvEt7?OLrC^OKynoM>d{T|wtHB5b=@$=AkNYqtSrR*VkphGcSJJY*zO0JMg<<)JUw z$%sG_C9}iZuOu2-GKBVTAjnJsdz!e3M*b$ zg0O4hys#al)xNYTYpZ^*tRdLLohi{J451RINshX^8=<1Op{UIeQe3p4P>)Y@zAQ}h!nChzxV_|b z&qm63fd(cDHC7v@!OUX_Gmoj=0NM-xB3P62nB~YQZt@*{Yt)4yl+1jQ=Q$Y@Z`Sz! z#g;qflNp2287TQrL0Rg`xW%Nat;->EEjB+Cn30L!Bth)z(WiFM>6``JhO{doc{o^wIexJu>u$M|i7nDlC!bu75BF~&}>CY6*W|`_)*WVQm3?YXS z#DNBV_!}}11O=ut9@@_kHrPyoSe-O*k%KkfWtg{&A^4()jq;5Wm@o4D^)q}cvekb1 zB)=5sZhdr;Z6phsqoVvnv6dmUrwUWn)=9OawUQ{2tC^Ut_Z2FJkg6uzfwMCykPJak zU@GIGj~GH9F$H4b=5!IP@vg(XWfZ{|ePonxl)!wEC+>6=!5Uvb;;W(M8%J2aae(C; zSjK5*T)ufO$l?B{Vl_i(R{(P`dxh~)Q9V?s7(%KRR;ko;e2)|=hL9?hsA%vcFZ`ew zOyLd*z1xLwFg^t@a(Jw8V+d*56K1SHK~Ht3DC{012(suN&uCrY9mNp_D2`iA2k>2i z2=mnV_6)DsP{T2NrOJh;iY5%9CcO#MgK*)3*aH+z;>|RPUj zh7hKS8Dl959Xf#^qeJ^LgAO_^ypyZDaJ3yW5|A^5QYH~2UP#hQ_FH)Zqcfyn_KzaA z07!TgmI!|-+A@TErV$_YP(Z!7^HQN;2q|VUg;`O@j2GdRLd6hL&1Whr4SjP#2KUzr zB|}L0m4$}ljTi~vC=?7K#Y&>c>D`?1&`S(qab*hgcXMmJ*D-IP!5}ojCdeq?D1rF~ zL8|)Q+#27_#24PpVb!#VPbH~{rnF@Fe#}D&(~|i!QKB}ut|`J>#V-t@Uv?9whd{xS zv5%s#WF92Q5&Z(+Dm27fWL><{7_>S?|V z#o5iVakt&0bsPpi6{2~paivuUCs=jR!|P5VspwYY>kcyF_6*HEs~9<4RiNJyQ*=H< zXykFij0K1SVqZ{`tcCjE>Jq7O_J(r+rZ0&y{4?Dp{BLQwO&D~@=!OaLTq^$ zRR+Um0t0L$Xd#u=G?SdDsbK*xK!O{9+*G&&bXU=JkSas|R&-?ub-hlQCK>X(qU!_J zm0rd)TI7VEgFyEU+5B2tUHZ=ze4!{9s8aBQq98-4;3G=~UnvT{{fvT=Yjp>yWOOH~ zq)$hwq^7lGI@kjC5TZZ>Y+u=ZZUEVUU{D2uJKqS_KrZt_5JRZlM^eC-(&YF#VJTT+7{j`o- zbW&>@FMD4tO+2*AY2v|^I3wGWXtW%d8A@gdkfb7nSw)~^A$n1lT*i6!Pl$>dP!~q%%d#PwUV}pU>xxv7uqY-fcz+^E- zrzpY@AW8KI(*sd4pd$Vhg^DyKh!w#-uylx;PSVcNdPOF=R>%)CnSqj%rlACTT;zRc zfCS+@@IgJ;HQ0o;Ay$}n0G%v{{E9{l0g@C}HHzh3=P&ETZ{Sk##y{d)vk? z#5O&jcDmHi#?#iH=gM*{var4k;xX((FUx_Mfg5DDD4-`{niko<6o=;bCrB=`*~n2Y zu}8GEv^LGPo3voJuCXo*mO0$>!ywNO26+u&kXP4akhj7ji-r+n;3uueiyR!3EMf?d zq-4Uh$fA)HjXI7Y2%VlrkgYtc7KltEQD<&85JS!a$vCMto@nGOpw8wTl5nE|X;Nc& zglX$tHeOO=t> zwH}hQ-UeRc?Ie9W<7gTyG1p71p(_+!Cc={lj*5#J0wie(VR{G@)chNYLRHohWLYmq zYTd*8vQJHQ7Z`sL2lmS!%LL+i2jJ9Y@q7YcX0x zMuikP3;`EuFR{vL+{$?9O@`2$Oo4oZ;9mr5ybm*P8AWIUO32($zEJ}6MV{($t2MqS zi7$*>bDhiom9S8FC|=|Mg#`*R>c9}{aEUM@5d-~vlODB!l506zXlsj0PA^Pb+TnnN zp5S&CTipAKtY6_t1X$aaWif=Z?hvMjKtXvADGKxT2|>Jzkk^a+u`%V22-4*GYkSA0 zKYTpT3$gaf{<8sqAVOh9G($-IoVe4TI%*N*ZAvmp5ru*wq>+s zFk=M@y1Fn$p{t7#WIig_cGl)zsLCqR)rG2rBAp?W?n0Q608ybT&+`6Fp{lCLQWq-N z#wiynhESF}VS1n}3}|T$ib6}h2(l_B)@q#o8rmbmxMXh53 z0q&&~wHQLiwJp_ZsHoLMrPgK|J}kwu&O=Q1bqljh*iGzrH zZZ)K=Ld6hLwIZs#HRYWM7j>wJ{+5HA!j&Q9+Lkaq1PWqzr6|mu9t3gjWceV@SW`E! zL$t%RHlF_99sd2TxhK@MvAiOkA(S3P0@PiCx;9o&C>TPDengSC+L%hXsJ6N`R#dn$ zgj^E{GZs-XpcjTx6nbF z0|?a=1sFmF))QtdrNadk*rq73lNF#9NR;me7kJ%?*1DFqmrBEIX=#`(Eq%`AS@By% z&lJu!zJ0j>GItF4HlM9%a|^l1p{Ak@L#WO7glRF5#@|WNN$8S81i?i*L6AMY++D1tAlZIo}6zg@AQ_M~(mQp|}25)u6VApUl zZ|7SmtSw&T;H}uq5L)%v!e&8%sf>p#K>!53{d$~Q`2zQ}Wz zV5(r6(!3+S)SC5XRGJx;scI`$GK6+~VhY%?1|9e_+cU5~GmKZz)YIK{6iSAWG9Q$0 zokV5g9#un0P+%(Kp??@c|1bq&srw&myd9V~wz2rhTeKtb7F4EOnH~q!Oodo#KUw4N z%=`gUtquB;u}v*tzR2?|{EJ|XFD%)jPw-U%KY9CCdLwT<2ulQO{L9Gvp&c>fZK^TT zqR&}(P&ruRT~YA~B8j}r$tRqb$TRsfe5)9B{#WG$`QkBOB3RS8rqSQX8+?L6 z=$=zKVcn7Utk3YTL;N)bZDB^yK`Q7?uXJH3!wWBRsHfBphA=PuShHALDHhrt=a=?U zz5`IzAP7p#9mdD9%a98|Oo>>vRoYpT5g=O+s1O8S%rT=L4525OFY>Ja8NMxyUIo1+ zGrf@)b2YVq`6KTppWz=${MD_L`Yp7+;!TFoo9&rG^>!Eyu_823C>TPDE*3J>?_LcR z3Wks(f+(CFY$XTp{I}>cK)EGEIcTf#eR2TdV!X4;*2W4~hLCFvVR|4c2E>l1C>$~j zBFF}=u$|8vuS;o!02kisS%GKIVzk=PHgzR0Ow2LhRvHbhu6qKWhBU5DP>1*d@d-oX z-C~AD#U!TmONh^r2PUK`e7w#0(o-c+;SXI;kd@oNsVoFs|0(_TCKzuyfOh*IcOv;Je zC=h=(VPUo|APB3%B!U1i31|-(9zljjfZ-8r_RL5T5f~Sj5M?0+ORosI zIdGmL10r>Hl(k)B=s|VXD;g(VWwXLH#MFGTvZ{AF(b4y3g2l8-zf^;bb|82Xq>`l_J74EFS7m{oGeApl{xC^1_I_& zDwe4)3BodkhfZrGUw{@80Mv4XKYl0F1T29bV zfR+&iK#t*SMelWli=~i9LDop-D1F!#!iItu(Ysf2OoIkcMtb*4aZ8R#!O|#4_UY9x z&N4P8p^u2PCPTzw`?4CO@PNY}B=fwHNdMd&>79tm4j^tO!B~l#NwkxjNqn2gxtT;0 zQj=o*g;9CxelUC00aYnTs$kV#Lq@671-wgf?~mkO5wE^qQg9kTd&^@zH0J*c;jp6H zWzrw@IzkZIeUuh z96_-FohK*}pbG>I1?VC{0Q|om?koPeO*-Y|pI;~y{d0{VQ~%)4P-!H8NX^|p*9k8Y z@NN+F@BQ;e(brEYYg2%qM|^5rTonNR&xQ3$yYzsRM_2tx5Ei9}1i1n9h#+*;V}j6C zPYA-I^pqfffSwU#0O%z_VF0}#2!PLqqlz|#$PuVb0fJB)d&N1QV{}E~1G|DD6Om6* zg-@|O^T|oh_X_`V3ja@JCF+R-G>zm2fQBISnhindwR{96r9?Go&~IR3T!RMTNxkBe z6BCkB8Z=0X>Dv#6i%G%pQ3(TKlrOcDBXGpuPmY9ln7Fv!y`lz4)|sTnTd?V%MEx5^ z3GwY>q6X(6B?*(FlM)gWO;`?$Nlxz7H>SE-^ii(Nm4lT@A$!&kkeSgS8fB&F>fX+aa9NQ}?CORT9 z1?WQAkDTuB?eE_;EGVF3ZJ#>+0YQNsKtNcmzq^+grkKx4433FPNk}rjAR2vVqNvFO zxIvz!Ko9hV_DDy&?{M-4%#?$g6H@dyNflTFEn>y%t-nA~-FZtEdYh%HWvI|hK$OiB z52$UjqAgDL7_~J*yx2I{B-MnW>R}jR;Yea6L3RKcErL2uAvcSRQzEPx5(ukuqccu& zj4{zv$V5J9`FN95j8zBL8ue$bg=963IgDIcI{K5P<8Te9+~BJUb95`u$bly+kV6L1 zAqSj{G3JB0CDTn(&DqYRRHG%BE_BJwkH!fT)dgj8$ppEn;)Co~=OZ*$R|_Hlasz3Ml(3NkPnC2}0}fbuxGBUhz;?AhDF3Ea zS&(2g+#zh_@f$%{O12V&ytXU6g!Z|4j4elxvE=|rqMRX&Qo;~03;$_3dq~=$r=Jjn zp2n9yp{r4hSvi9-Yp&%CMq@C@hPgNxNn!Q0GRzXZ)%Kyso?DeKuwPOt`oUNhMcK{G zvur7PmMuk^De$k(dw4VnsLgwlhaUPs5PAq-H*@z8mPK$8SIC@80a;ZgIjipxjCpX`+kI=X5Bat5vkz+u4ywZX43XoptTU>E5 z+GSog@asThsyTB#rJ}~h0jJO)-|s-)+Zg%#)br8uHizEkO_}+z+xHEf>(HWeeCn)Q{)b^K%1Ia}Iu*bakhT30eN-aE(IX>NUM ztGtDFZ7KENThCUY^=w66t?xwg(E6?fq4l`zm4o%odqu^h&;mw|_NpZVBdLc~ZjlzT zx#cZuiPo`}Y8en|HK6Q1Bn7SOM-Wx0Jm^J1P=^H8js6h*{YWd{i+A%U|V^m82luP(_}g#XD5!4iQb0QfOaEbWB`KN{m(8 z5m)VYU?z>Q%5k(s?7z`ZEdym*3n+UcNx`h0Ob})*u7|4ghiTEmsFY!eF*%o86l&gz zPqoU7Sz2B*2^)EER%5nsRzrd+tA%>Gxr9x_EMwF1>XO-{1G;1$LFf`(dKEI^Q4ZLO z!`m!61qaIJlaYvpLe0m23#>AedFFUqOjPI^b`rXVodgN8lTc}6eGplZo0HgBbP^kz zS0@!z#@5S8FLV;F^BSFGZuKgYR6x&DSVL5333u>lHFxlkAb0R+wQ&%W7pqx&w3@Zg ztJRxG8J zXc=p$mO(05xuEPlBn2(YCI~IVl^*MsS)0fw#> zz|#bwfk!PQqY+%IlZVAe#U>@h_Ztq&5@OZKzmpHG)%aU;0Iydd2PtoQi|kn4gCHG_F}#%-&@?^(p=<_tCpoxw%{ zU=lb-BbukiM{(zs`-&4AV68Pru4+$%meOMjRT1l%MQm;c{6W}gz@G%EWgs_e0T89v zgpIlRjv&mG7ej_=Lv*{IK^0C9IcC%J|Oe-~6~QInMXg(j3(n|Xg% z*4yHxb&WSo*fw{GCh+H)_ZI}#J}2(~)GdBkGob7J3&B+?#t!~-i@5*&W2e1mCa)f_ zCM8RE=*jAVx2JA6Rpr}%u7AI|{E*$P3OA@yY<0~On}!$9T-mF$e~Y)3Cx5JbXr8Y2 z>mJdbo(Eo*`KiGtZ{OC3id3l^;WsrUde8P7Ka_~P6R~(m=%f8#H!QusZtY%wdw%FO zWkq~Ig_e(YQNGh6+B_F(rfekyV~e*M7q-b2>xZd`VA)ivMy7C%|K zWAn?qe|^wqxPJRt*M>Wf+>Cb`Gt=+sgKIAq?Y!{Q)X28MFS4Kg+@a-<7rT_2yyaR< zvBVvn#l5bLZ|f4bw|VgC!k3z6_73xV@3Bu>S^J#8 z*RSi|?Cxz-?wca-=3@q|>ONw*@3wbu*G9F;y!|BL%jpLuh`UJNas1Jv z=bJ~Tn8%A}VRtM0!r6OfJ$4rHgZIy!b+^L!JK}la(ea08|DAq6s%G!KzRQPP6y+|b z_#V2RMWSnzX*#}#P2WWq<{kLy=Si6@Di#l1b|+!TlxhJQUrqAJoiPh*igH+^)$jGo z>@EJ&^xHp1crWkQ>i(~v(ltqM&wo>Um~D{_oiB;|uBhKHPwjU^+PK8+o0+pTi&`Ys zDVFl{^4Kx8x(9w$y7Tt$=XY%Tb9}Si6&ihWtp2lI|7<;6YjaR~NGoxFS$)LhGG09^ zOn6teQ=1tp8x(f`_^kW6Ve_=pd$cSboE0kWv!gt}-;wqzYv1jgnO5 zi&9np6!GF&&~-caZN|xH|8*i=#P{!daL9(Ben-7S7sib{`Fy~sM_ia6H zQ@^i&-dUr&gY()C1%`&dKUn2u^5fyr+4nuOJT`sp)bC8!I*%nf0 zN9FO8N{n}FE6Rn?XTE>$1;ZW6AK$%pQKgDsYg3nykKE(-LC-nPa2PJ8obo9hw3B3ztmkx&(x1yT)5u$YIou?&#tcWyw0IAzWLH@@89oo(P3x{ zzXlx-H4)`P__fuvujf=9ukR=Pw$nkH@Wa$KC&azPyoX)yyZru5-AKRZ|Fr5r^4FhzS}-7Pa{bLAU;c8Y@R&irSG*|nIXkV{nr;j4Uo88l z-N>s&+|P>V6PMPMnRNH}O;0mUcB*pHeZ9zU_ac5i8|(uA7X5^{uV2@pm`8Q{p(~Tl zc((Ugep6qv_=yPnPTkXXzpC-N-RKL2fBdz@ql5l^#q-uB)$`BZb-7aKHu+b7<#}kP z&}U%S-x+o4dQ}j2(I2-u?Ecr5Gsj+vc6al>$3b7+dD>Mxi}a}E^OgUx>EtQw=%X!l zdUtr}mi5Iqoje#PEf9Lew|>{5R7>rhtLy$McJ0^MFGP8$HhxCHk5QjC2)ibiG6a=g zo^WI0_uH>6E8BD2!^tgcbn57vP`mn=JwAgTUacS0-96;|g&S*Z{kr`)A>p`4f0XZV zp~@p_EcmzSSL1drJ=5ydxjOBZ{;}L;(y`C+GsmwnrSCJ3zrK29x5(i7#l<`G)*OkM z*4Fb<<56ccM`jHQ*jsdpTd8p$8aiLfA2O@u{&Mwg8s{^d`>MfT2`=vU#?CtsI5>Fu zvZ=3Yj6PYfnB6~hHg5mPXHWl*kDu*m>d6{%e7oR>XVDHnr@!p& zcB=40M??A%b9q=*d$9%(KE?f>NxC=@G@t^CrTk*bkWhPU3;x+ z5ajDT@l~TEF?GG04bFPkv$4pRkRlh>S9n+RmUtHV=yyBfRLjFvnl5g2`1xL+$VVc5 zy)Jy!gVA>?i)Vp9ZDo^N{*Sv3EqQ8U`tF#H@8>Ra99Sc@c!g`@9^F3BDdt;YN0jf} z<8NNnEwW?wn1#ommMwfctJ}T$LzizhPZ!TSo;VeVZF{YXcuwheK7R1P7E$KUVw@}P zB3;mnav{pCd3s%k9v;&k#1Au+eo-L)+g9&{-;TyOdiQS-J@w+~K{v13w@8|Q?!k~@ zZNJ@WUOp$yDl&b|-6ToyU8KvtzH;6>{SQTcKeTp2c6HCHqt8Wmvkx?X?lEoB>)T(D$Wg~+ZEAt#^SOY2_Z#lOWD<*in8 z&1AnhQCCyqTKX^BJGplWuO3|w)nDtr@@jjxHpN#Ithqh*%d9T{=)G6WTh=DUJEK9J zdH3D+EIc>nheHoNGMt-rD&$uGajDUjkJp`3?Eb>8t;@_9Q#NS#9f!+VVe4BjUtRC3 z3Du9Z?bE2-`-+Wf|Gmrg^4n>P?)|m1b)qOI52_W}|MX6UwpG6Q^kPk`ia+f7Yf|sZ zo$eeIe*UoISiye%0&Z1*vtYx~0cX<$T~6gK``+jdb!v<`D(c`f1Yk8>Pgz)DZSdAs@~i&;>)k+O{my5 z@(=CDmo1#8i2S?$veN-~m&}n4lh^DRU#aE%rMt$*Xct%hV&kOaWxv|ly2Gt+i%vWL z_(16|kGzgKbm-0wbNS}{r@L<4_uJ<8n^v4VT`qOV55rsvow+oq+~^&`{`chruf43X zv}DWV`Ypy}1_$O<-$o6J`R%HhU2>pd&f3L3PA3Jw^f{dd6m{C)`tFBvCGH&?aZ;4q zviTfN+5Xx2&bn5wKPC=q{?)+JBUUXbeQr<5y?<4_bhA_04{`5rRGY4Sv)$D*sZgmo z%~u=zzkcVqpmfnz@#h@#w>%yl4MVD`6Wh*lnf+a}0iMUHvRKnq4;4{(~9gk82Q}qVXI+rnQv>(^IzU(&ZLTE9)yL& z%zU-}_{~A-e{^dy+Q(y}-R3ceM(74+7YVJ@cwleAPxxieB%3$Ay;rU^_wzOX;wMTh z9qczQ?Vl#6>P*Wx)1X(A(CZZr2)`V?)HgeB&-oaa*!b1@fWEJUU*4N4qn_M)Kg z$h2kQ>8%!jU2RI^rp4!vckj4cw1XAK#TJNMseSgQr_atSd$P~&C~<4^(5->htG|OO+j6Ha~0B zF*)&a%~jP4UcWISyj73*@2eh3SX)qcZ=hStgH3v**J^Zs+nl;B3_XWzkm`cY$zChWAt-G`|r@Q}Uhsm#NJUW<|^xgK5qV4Mmzl#1#*ikt9NZcp? z`o}~*6g})%qjzZ!rCj{mcH+*2jD6P}8$3PRyxi!cTTVm^ef4o2*V`03P~7X}ot{CH zFM5WIoLYX4=k17k>pm9Cn3ZqMwR{6d7rQXGthxUlRe4olQ`YEbJG&Q|SklS!+MEmB zG-JwPA*p%3QHWvl|4(Iyr%9n3&i4##pdwY*RI7s06Er_e}Ywg7&a>5h!uG8d} zny;5P_sG9`<@KgFvS*5Vytmnj<;^p`h>BWVc;v!I$A`VU*?hsJb1R<59D49u?7hc7 zZHcS5{g==K%_C2(-FW@p;VBVguE&+g|Inj_=jy&sCyiPGo)HkK2>m z91!yIRV&tE+2Gxarv5e0XM}5kT0*}_?#QR-t*b^#O8jL86i9_Qzb{Z}0_)Y(v z+mL!KNADh8b#~*}Z~E`TUbwWrFKs*}V1v2S0*zrDkEqMrQQaxeNDG2RsY^RETZ zZ!WQa+CW2DsnQ?YUe5lt*7MOB4PF%!dK?&5^>&B)kw1m5{%BYIi<95pyS&#v<*!2P zsy^E6nw<3KU@@-i@8@{>VI%zsQExA|>Noi8gpqDS-;qz2%`AKL*jHtWz3+ANZqcam zb(~KBxLk9pxtt=#B4ZtzNTdqsXlNs*(z`o4(Lul-Q9WOD7w4W(=I zYt;LraP`>l=iDt)tV^fCg5Q7Z5AmKM`bFV)@t!5*h<-qfhwf%L41^PRQbc}_8{-=D zyQcq$3T}5??}T@|GwJoDO-Tz!brOErIc2S&)}X-MtUE1 z*NjZ9HDlPQ!a0pInuIz$In(pP)rlVc>JL4tD>*f6K;0JG23*+QVBgJ|H?!-1+1lyU z-l^kk3f@}zvCG>|htm^MTYY$Wq0x_PqMmhK_VkH(-|SwqzzWBo+*iN3`{?~2PZu3u z`*eP-((R+49iI}Lw6$)#a$%Ji}bkp+svekGdBJ4^{Vly z8)vrI7j5_YL;cXx@89_rzkTkATbI~gSB7R4sde0Trmg#<9i{s8|7}`YSHs!XWlwe8 zHn82A-Q%nNGDCmW)ou9rV@tNxJTiX6xxss%O{sjsMU3~qd9t~C$Kgk+JzkxW)-`yn zpBV4I>!0CM;J2qv@Bch~zjBuyWER6H8L+I7+gfT*tk*amG)!x`D>b0d{}2n+ipv;rk~!iwd0Mlaf>#FFEcz5 z&*H9&Oz<1?z>xlW;CjbZ{io}%j|!+Z(sA9U2G{>CTKe+Q1IM%uB||6Ho!z4Eo203Y zf=-I`ZkrQ+c1-thx_9jE#SOvRLj}LLQxCUZ6&4sI=nwaN`oiVF-NOq@_J>q>FfIe!Z97J7i1~&w}r5?Uzkc&OM*jeNyTz`|ZD7 z+7vXesHRNNw`Z>X5ZEE`Vl(l4VchUl!Gk^iD3%o1*zu+9CGnhD{Mz0l;XY6M)e3)| z`Nhs*qF?9}JAC8Y-g}0O=>X$$%-63^o9o7BLw=hPDGgg*6J*nN64XvxK4nGwN< zo0iUAUF&tDhk>hpDcHN7?bD8{PYHcbr|w($A?)vxwT}I?-*9Gime5boi@Tv&!$~u~ z_|QYh5qFVZS9jd?;>W&QuSS&fnWJfb!s*G2v>Q){w-W1CLQioQ_HJ0Q{NaHLagRQ< z*;~k-~%KDk}kIvn- zmAw~Nc+}wL2(?g2tS>j_xsns+pKr1 z(DUTe?|KzFQmJd#tL~@PUAWQW=+@D@&P#$$+|APkok%Zw;`SHou5D?P6JGo6RcBOd z-8XzizrIs$j{osxPWm1zHbeWQQQWQKK@$^QZRgz;{Qr2n;KIFWwzYGzL*Ol$n_!n7 zS#o?%{Ide}Y2W^EWyBvH7Zr56zCP`rE^#3TTzbA8xFh1?*XKLF9vfI-%&eXH{Duwh z)pV6lP#wYd=OcFnKI|nu%S!j;nmlL0gHa@4P|534RPWlV_&-o!Iy9E8pu>}VoZ@P45PI?HuKm9hj z2A6x6^f|ma6F+old^o%O=k)%4$c?)0E7q(Y^QGQrc=*00=H*e86Oa7QkN5@_9rZbW z^9G&UIAp-dm=29*9i_g0bWo9n(9tuX}rpz-_8J z%@HL{0G>(Fy;6Gd6K==RX-wIO?X6;i8{%js&)&(&f&-@L@F#9mK~Oc8<1iJdQeuXt zxDTXL=WwH*PE!P~D6hncy*F7$HI6Oe41g=rcX=2DK10rG9NZnD)8LVQs9B$O4sn(^ zxP8y4;g07aQIcE38&7E{g(#=#?dKZk=kuG4gr`P{#jQbEm!%LZ;J z(rNJUNGt)T?Jj?<)`xNMhhU6((XG434NIKjgcA){)Vab5`;L}4B?t!(Z$vNr*5I6* z8i(z2Ask`*SACMdEMZ|g{&twr_DKiUS6Ab(&Ls&4f8!c+CEcUdSC+C$5l(HmqRz{+ zyPYnnlEr-RylR~Wf43L&KJ&|6fNq{&WeBGRT#?V0&C3)mt>VLWl_eas8*%>5uGvS8 z!?MZ|jvf%O+)oG$0B0CwF^(JI1c~x?=s!Vx~a`=tGLHw%3#nBer9F>1ag zPDR2IIv>}%$6MmKo8W{=F9urTR5Fp}baIc6B~E1%KF%vE{-VZV+rJ>3IItacntAHp z1GRtH&mJbS4i+kV;0p`e@z5D#`3bjKs8!>ztg3_~+PZqPuI*9FVw`G((-5!l@44!G zEBRGD4>(wIbQ;Vx%<8WSJ%`*D=&7=Wiy;XU^KJ+1++rO=7 zwQVhB;gQ=$Sy-OySjehJIJw*9OE~Z0igwkX@GbQE=KiTqI9NMSpYhjf+_l7MkOv$; z!ok)IB`g^AV2LFk@{9&+2g({T-+hE7P9sRsX&`~h;jcHF0jjyqI6Ba2pi!oj^ZH+) zGMVEvAsienpsY=+4nV~<$MMetP5|M=!WGNUq=HMHS@H=a9P|LcTf!7e?{N`AG56rCpb zveAZcuy$acp6oI=-BMN<;o#47<_D;$(`zX6sF}L`f$9yi9N>y6`%Ydo>ATtXc7)>& zR}9C8&KzPXt39OfxEKBNL%xGhWf4-#3eN*h2g1o+AFNr%F_LFswON+3u;uxjKArO* zt4kjEbS0eJ+m>#G;|*5~O$-$vlg<6p9a280a}UD7mI|p|I%co1V*<8b-uO*pyBiZbDYvU*#{iZ;PP zS!x`X6+<}q1J^j_-#_f^0ZY635RPc)fB0td?iiIU=F^vOBH@blYrw~uZ`FJl2U}g8 z1_ls>^L*nBXe5kz%Kqs`IKqe5Hyj!htCGby{Y`LijIG9DSpx_MTTTp)jhmEL%VL~3 zNYQC*2?Gvhcb+=R5@#UczyN}@_@~zV;+8n^gd=p0ztt07l8kn-tb{z^BoYqwbO5z@ zJRF)vb3TIz2Xi0&eCN>|D|RIj4)$M2UG&WoATsBZOgLlk3jZJO7KQ3)j)PX~G(K>} zl*P50Kxb}_lS(*P6S4gbomdQno8t^79LzhERsK@9?<{eki3C}><4~#wTMv|#G;gZA zC7)r$N9f#r{OhNdIKv628eCD+o~?^Rfil;bMl2d|F4g6tH8OWv;*2Cdx#K{Q0=ok7 z3jalxU4Vh7xvbG9IKQ-PZ>5Y;PAPn>$ay6jwtgj6DM7?)Mt_jAM3VHHo>tjYYO31f~yAp-xn>r*HRV?3n0I+mq)L3FZIn1 zOPr~MgFP?e*qs|@rCwwZ4pd+YJumuMku^=hL4BSKIdaBQRwm)pB`(nS4D?=Ui8GyW zuufoDG@<(mOPm>yqSM>}LC`o!?&ojXt8utp%_1B(xS~EUkNS0=VbS)^BplJ!VV`1& z1H%iDS#!OH+J}s@fN-#`W3WEfS_mmRP44Az5#elsD~>mwO~2`@ zmc{wCm~hI%6@%~ePv0(5@hK1tuz?Aar62PL)g#ad`&pwJ;nMQ<5I$L z!z=vvYIzG9b#qzE@_@6PaO%Sq`?xx(&-+;NSwT3@;ffL>caMSrqq!`oDqt726?i^!Df#04dGy~iYYbv6of|I9A`D*sPNL!;g&cX2nT<768@y@^*5og813RRwvli| zec$lJ_WTA_8DpGHCOF$dZp5l_xEy{N~kiRT(b`wrVyu!a%#iLgGi|+}Cau%R@zYTn5$>#^ciGeEy?fvJSEOCB>6rD!k z9Q%|o-x6mJ;k1M++Esnsu2z;fKM@Z0m54Kc#xGX%`I&HX=aWr1x%1geIM_;~te49V zL4h*&^FG1}k#VLZoT*}o163DncZDm4tc}N^kuc|T08(K6f-vC77vHM`EO8DJP5>xl z573F3tFEbWxPBcX98m|cJRh_u^M?ti8(h(@Ma^p_t8uuj9w8iT!!a};G53aA7ULX+ z6rH9TFu^kK=TM}aCC)Lz!E_8aA1o z5r=I*NjR0^igtauO#k}{mF=waDZgd_4D+urjQwqGP1XSgDD zQdc~v&s^tAdBC|$IPLHX|5KZ{gUm7KbA@oQHN(6gSTka(CC*jC!7_&WSRW_+k_Q~9 z29RIwpbXl!W=1U-Fq-@4SHcng>3nMVv}-E=aQV4zf`fAfmN-xiK$hSW@=f4wOPre~ zIQ^UJk67Z|GQk<`S?_}-&TSK%Q-|Z`SmN9voReTK_Dx&$*I%e{xIEt_94tRJ@V~bC zr8Gn)@h^8(A^8w<%dc^}<|dE#c%|2X%zg3$((J^ivOLrp@`-5KbUO zmjIl1i~UQf?c(~Ck8ngC#IkBbD>-Wa*b+_=-~oV?x%hkwOIi5|CjzccfKz|T@t$fN zmSsmcLKcpr@~dPqP5~2~O3k}&vc$1B!NK~j#^L;OAe?iu&VSw5)?2L)<2VuyjsyUZ zK1d73Fb+J>@BiRklHACzu+GMhs+d6*G2<*^W?IB7wTRhm64NIsCPs-+q@Puygg)3> zaS$<1Xa)rl<7E*OWD(Otj`5NN)o3}UlM;h_Trk*b1P->67{)6&m*p7rSU*h-D0NB% zqr&yI990c)00BY?zDc8%82mX+4#=mLRX!bLoEi$%a5<*E5`#ZihM~F=gTDoZVT=;< zN{(Tj>%o(TQB+s_p&JZK6{;3;Oid*wQjQ5%Vur~vo=VIDIcBU9vr~>?>5Z*QzbNA@ zQ>dP+s962~hrIKEkFsd~_#xO8!7eJG2D^|-Q8bqZ1VWJxmNO(5h$Oj~LQzqy*s%MG zir59aqS(ORd+)vXUQqDW|IF;{>@#=IT`tKbyz+lOAK;kh_nq0D-DjVD_MUs5t~^XG z5zU@#IaMrIuq9V4U$NzSvE<|M2HQ1axri;x#PTFtdWdBk9;i+e%Xw@GisgN_+#r_y z`10jiv0T8GgT-=Kwmc%1zPLyP+iPMuoGq`5=_i(t*)mTooi_HyD))`GD{HP4YNUrUeH9Rp-i41j37|T0sDHhMGL=)iXTW)R3gO*SQzVo_owz1g~?!%h>#7`Mp*6(07 zm$9W*G;fP%9G{o_)?zEX2!XAeP$#fupjhr>%Ozr2&6dZ+lDn<(bA(uqVT)R^Gv)b0EM;u@N-Rs*@|Re?W6L@nY*sVi z>I}CI9jxUDwrnhxd)cyySUTgN-$uEia4aVz$(a zTc}6T-ry0-Bie*2xJSCQc+47`V=CEa?ST118(_*=YEwjY( zI$KPBe(}xEFRYm^RF7V!goDL0j4eII@;F;YiRCl4{3Mnwb~S!Fb+EmqfGvNErk*YD zh~*Wwd?J?Y-Hf0Aie&;@{t?S;wyYG({cQP0EbHuU{M;&*er$O~EXT6tGqF6$mLXzU z&6Z(e3GQJ$PZ7&QY*{6i1NJnUTf}lXTNa7s2euT7rO#f5nkkmqY%y)RX-B_n;YV0A zRH)8-8$ThjT*8)VV%cyXqnRp}acuchEbp`BMzM_SZKzAday45D#PT&;W{73qK87;2 z*w(ier?F;)P=B!HYOx%iZv0#)miO2)TPz(iys^6b#_GkIDxr$lGF&VR*)m!zpRgrI zEPG{|ScizEiY;Bl@-bUB6iaQEp*9lB%WN4Wmi2fBu!&giV#~&2**3@c*-9)u`WnkA zV%fHzv0N;cuKkT=zF1bWlDg)OCGi3~SXxmf;TONChKM;OiFV)>CROU05s(rDfj%T;Xo zPAtE(Wf!r`9c8F<#PTd#ZWc?)fkyM3Smv_jeX;z&mhZ)qKiW_mcCdM#&z8+av-udK zNfXOLwwx=LFWIt@_{kb;sPjZ~EL(mM%gb!pT`a@K8R~qoT*#IW#IoLaquE0&$Fk)D zu{^_;55=`X513uv;S*$hJUF%{cXy`l8J>r0{&cMHCeXqV#&ZFVytCW zlVNixmVT(&3}W@Ln*Ka(aTY2wcInfsM#?Of94z7X;O7Rb=}YN=|A~dlTnCnGtwzc$ z7HJDCmu`!b#bUGZsI_EfLZR`uyg1b+Dl?NsVxernZdf4~4gMFlIq-)lD)TD%AGVUQ z*o=uK!xjDAGY9tJ_6GbRKh`mnyjLvNQKPlwVD5f{KX_D8Eu=q-CDT?6 zk5|%2e?HM#sMq0fdWTqS3B_WA2PTWg9y=#li;QeI?Vwm07!|ku;EyRGmL~+Qvp)PW z7TaCKBAKtXR2FJ30iv6=WZURs$-qXQh&rpu!sxe(1wI7&OoC@(z`tfr3!{3LZ9$=^ z%vGRy4E|6F2Vj}=AiA-@e*!bvkC_RBp8>WBg_6u;X30;s9sPE&7F+cIPU1-;qZUrt z$s%Jy2b(eRv$0rgHa4-AOxuF>){m4Y&st~{eHVx?#ey}(O)OM*wEPNxs5~?pqvdyN z$;Mbe!Jn(FC5I0 zf@8v7pm|C(c1&;<+r@F3sLM0UTC!~kr(28kd7Rdp_R8Td)l)23Lfl5dAEW69CB*x! zFl%gK%2_ZN-sjQ@%55~1XduKwy=7a_ykq@jWkSaA4o71FbKtQ_rq7!zGVJqq2ym3G z`zO{>_m$}x%ST9hw8kf;PP1q?*c+JJVXEJVUKT$`cZcEst2JLp=@qr-{b)OtH}D zcNpxSYBgE5mBk|U`qOIY=-vf-+>K(fSrv=a^ir#lnig1#)O3cmP+J@Y|GQc&cI*`k zC9Es#zs_oGwVcH!BQV=)cti*UMq7)VK`;UzJMam&L*S3;&*-`X96MdCB?A+LtLer9 z=D-T>hi0V$`=LEBgvw4wA#9t#ALAJ_b~pUl*jnrX=dswj&$k*Hjn9S5 zTVl;(iZm+L)+!d(%TYHnMH&@r8=){3*6Ub_^#N0)QL(la%GS$KUGcDnjWjCOcB)?I z+;aG$%OzGmQ>0O`x~W*>r_A`%QFTm_M#aKwOWikmOROuHB8`f*gNlVYbktK!kw(SZ zQ7Ei8=5VgW`jIKps94>FvN?3r)`y}exVIfODpn7oY~R2fULmpeV~R8?R!0O`c2cok8t~X=OC;9uOp!*#+F8X~meKWAM_t7fX;dsc&$;%>IQEo&r%J3xm?Dje zm8N1%{N;>`9F>o!XxK=jV)Y^lM`_#^T^2a$dWrQQQ>0O`c2%*qS^CU|j@s!kaupzr zinSY2+rn;a<;!nN_fW?%MH&@rcNOdYeNW!b#rlLP(x_N_5QS$$jJ0~=!do3xR0<~8 zNTXuysbXFK+KiB+7BfW}6$@wZ9Xr^14L*3xQ;ynjiit%U6>D!5>#U0!?sL?1rbwe= z?L(A*y`E!=G%8ka73QiP)NE#KZ4^j5`I-#udifg2AoWm4pRIGFrtMfUl z4s+CxOp!*#%22Ve&o7f$Bg#z)Nuy$As#w_P9d!~@q*1Z5h}yw84HPeZ?7AKjYdKS- zQL(aBtZlcOaIB*?$ICw0NTXuq#MJ9Fi8YNW(x_N{Rje!j`}mHI`j#ous961o!hVR` z$iL4WeuKn{R2VC1RIL6g)>FG)JI_(CGDR8{Yk;a3_Kj;LR)3tx!$ukvYhM-XyZVXpIh&*4p+2;cM#aJzvm56zhmT6E>zE>qiWO9`UdsFKU`PGL6lqi}TqlCx7(z+b zfj`f!+~-yEtVJwZf4uC4jWjA&zKZqU)$eq1)b&h}M#U;1YD4gdv6lDTV}PT!KO7^$ z6UR`as6wLfngXfF+0T!1)LBfCMo~pXZH6vkdu+hq5=U)_mm9E=Mp1)^!udRI*vflK z=I1a)8kLQ~LSZWpd}F~w{IFgdDYkDblD|BZRWC=1HtCm?DjeHBu;>Lq~P3Mo%zGqDI9UMbrjnci^`2`(D3N zV(rTmX;iEORjlztj=$JZ)0rZTiZxm&4A(gI#0hUmtV@_8jfyo!D6H4=UpsE&sLuS2 zA!$^sv8rA;iXJ7g<}yVZ6>FS|_2iUya~!pdDblD|;G!;$Iy7Q@kw(Ru7*nsKCDzMKkw(Ruq+(&c9JOJsiA5R}YjRAiBPCWYQ>0O` z4pOlK$Lw&mqoy%M8Wro{m{(H23`%0`=m?Dje z6^e=FsNb0)O`tbC%e`TWIZzKH3jUI90mTY|1|IiL8)+0(8bh5PLy<<+YYI{JSjIko zg4Ao0O` zDpV}2*KrbS2~(s|v8L)+P%lTl$P{T*tZ78qnZscx+<2LJS`?;cB~zqPu_{%piz6Q{ zbJRfmY6UjZs91*+<()Y=YA#cxQPgyz(!nE=ZymSZL`OZr6loMyMbySv5ZJB^|Mj_} zwyZZ+(kQB$DBGh}KQ;XxM;*izX;e09h_XEj*Bl&m3sa;~u_7uKwsO9-@;VKsgrrfi zYE`VgMlOESQN5TVjf!@2+S)e`*pd* zTF4Y>RICOS>w}v&Uf`%#m?Dje)ff|Ng~Zyh(G-C+D%OmcSdPkLiZm+LOrg;4-0tgs zf1kvf#T02&tXV?gXfrbRplnAiWr{Q^)@-R4QrmYLysx9aVTv>=){!dK`|rLr$WgoE zS0b>HM#Vacs4lP%V_o&yCi5Lt$`ol-tfN(|%da`+I!7&JiZm+L9HFo*n8ODohi@=N z8Wrmpp==Hv)fKZJ0;Ex~PE@h3d?WK1M@?ahG%D6fLZRQM zKKtpGha}c~rbwe=oh%e){>J{V-s`AGnIesfHIFDUg}=co;iq-q67qhie`YFpTiv9AAg^fvcOtQ@9Dqhg(@V$B)z z+)0j#Fhv>_>nw?d?X^?r(mNcrgelUfSZAwPTc5P+GDm&F6lqkfbBMC-bJ-hI=|{5>up6vCb0;{o<8xqvY^>rbwe=oi7w-=W$hJNU!3n&AS`mKY>q}B8`gm9~G;2x6|)()J{hu3(vwsjf!<4QQp~?qYhTe46n+~E9|DovR=ne=MNE-KQ5Ok?W!a(Oi|ZWqDO03T)Wt;MJPJ3=e1>E`ZH}>$ zMrGp?p)m8f=HRGtOp!*#S}2r_b)v*Ni7C>kSeFWgv2Z2OQMWTi8Wn4iP#CN9_9K71 zLt=f%6lqkf%Y?#MxYF*Z^^QSLfdFY#tjmeQBL#a@r#_orFMB&*S>vhf6 z9~GP=^;*glX;i(gAc32pMp282!n+;dL*Vcp zfBfty_^O#U(kN;PQId_1Rs|e2hAGl0>N=wA900E!iX|IIF-01cjq8cB*|>4@o^Lto zN~TDoV%PeJz3&qo~`7^7cbV?Q)zcA!!tK2T`^k_W1I@8#}6! zDbgrv8BsfcQ_RLa8=Y{Ud43c|xsEB)sBGLxl5oNQ1-#a)e z{dkNR2#`imcN4V*?8CaIu!J~9IcgYFq*1X}5M{H0W0a%jGesIj-A9zSZ#e2@rbwfx`-#HR z;g$tsl%sY$(O5~Ns0WC$ePjAoFP+>?vN44z(x_}aNR;gxTU>SNtB!h;DblD|4-sXv zfqlbK!%s3LB#ojTCJNVxu=kFA`J)#d^%zs6QPd++LiD@htcp2~DmWQ!aDOUl6!j=k zcErY&B}Xl1iZm)4k4Y@d{-Uw@8#^jEk3t1VqhdWyl$`^N9{u{hmq_LxWr{Q^))Ok$ zfY%T1=BSNMF|kOaVm(RJrm!1J_|+{dKXlYcrbwfxr--sW>ekGuFFWc&rbwfxr-{NG z!iT_)V?XQfsLz-pjiR1W)R=yUjCa&tr-CEcNTaA{iNYfVxBfjdu5(l)Q>0PUb41z9 z&$u!;(NXs?MH-d)=ZUg?e!E>VDjl`OX{H3EQL$biY9rW|sULdJu%uD3ULgvvVX>6+Pagct zW72zPa4gcO9KK4F&EXSI1q&SYFjJ&av0fv}_TKyhjy%Lso1S6nMH)rDPE=F$Wg=Q z8!KrP^|r)9Mb=wKjB?aPOp!)q{vDz=0RoTbvwtYrz)`<5MHso?(xWzA^etxlX%zK2QFx@_w(PtK zr#LF(9AhPoqP|cRo?#s|pDEI)Y_>w6UoXRwa?kSWrrSU(VjeFL}G2VQ*m#u96{^Np1>D%OuG7Jk>}s98*rM#cJx zsGi^y`{7Z&Uz_2mCz&FRiuJRKb>PDNZ+29-3rq<~qhkFc^}<;9p0ZQWQB_QlM#cJ7 z#p?dqfU_KRKU1Vpv3`?SSenbaY&&ri$zhlOm=cmk#rj>v!n-3JRmv1;RIHUm^#rF_ zubht86+7xSrbwe={h?wV@Zthbtd19&5|T#6`cvwKvC>XC{R|gt98;uGu~w;Ab3Z$; zz)_2tB8`f*T4G^o79ThAyLvgk{$z?YD%M{r*1!{L8y%Iuz|@O0D%O9AvLhRg8+j7z zG^R+SV*RaRbza`NqoY1#iZm+LKSbd?3b&`P&Zz!UV&z<9tfWz~@Kj=c)qn#p+0uJ*U)s{MQ?f zx|u1`s92p;tgAaMImS_&USeXAM#WlJVxgkLZ-Xj+l^j+vMH&@rJr(PL+wR-cQJ*qJ z8Wn4Op)l5lhi^RNcZqe-LbSo}q)?+`Z6Fk8{(|pMx!h5&GDR8{YeS-N9);8=Y2#`f zRdOkqU?Yu+wULU|weY+L9Q8O;q*1XpCd#(g>`otS=cwQ!6N@w|)+Q>}ceTsEb=18~ zkw(SZlqlQhAL#bTK37Q&voABTNTXtPR2IvAPO{`!QCX#9DYc+TiUXhVuNbZF8Y87Tzo3sMVJv z1Hb=@iM0h$*k14<@Z8jX!>c9Mq$`ktw?7)n6KhMN>^$o5%ew9Es5_VY1qDDNEGQPY_sjiT`R=?+ontGZqn zmTc^Gl_?=sl+DJ>o8~NZ)B>hRqhfU<%4P%S*pBLSwTVR5D%MU!c{A^*#Y~Y#Q9Bdm z&Ag*tXNok6+J&g~O$7q!j~+Y6Q5!EdX3{7sjVN#C9knl0q*2-EMU*%5j+(&~X;iFT ziNdo3Od$g24_ck}l=S)Am?DjewVR4{N8|K$9Q8I+q*1YUSM|af(MXB4&JvRi(x_N_ zs91PEwxf1tiZm+Lo0O`GE^-5HqcS?nIesfl}VJHIpDW}j(V6W(x_NjDi(el z=%|%Ukw&dYWfKK|(T3j!8p^v?Ng7qc9HQ(Pb>tmO-|8uu-}`#wi!`c)eN_oBfA8bp z9d!#+q*1Z(of;iGYzR)Vlz4VcrH7uYy&E^5&2G1sD3wt2{zIwsz@l@|5c~G zJ2|S6Dbgrv5K-Q2m^U$@kDHhxjmpMgqHK@4=hfZ*a@1!`kw(QDLX(x@Iaj3~^y-TtP&;q6hRQL##h+8q%15XgP~ z@~hvG9`z!}B8|%7aH4DuGiJP6;;8<&n)swqu|^QJDeT66h~L6E>N2KCqo|QY?Fj^q zY8Ws;*dybVmSkw#IYh_adQ`PZT%N6lu6G>STqsLjA5d&ttF3zw(??N9}TliA5SkO&|(0kK1!Eb(<*!WPDDVECRB4CU>;q*2r)qP%_n0PUAw;bY<-od~-0{o`M;&x0mJgma zgc?O1N|c?mUQ+tT%Z_@MDbgq^M3l|O$DyU`tdwl@yUWBPjmpMhMA>Y-eaj2!j>5O% z;zk-3tCT2jHXQXLQ>0PU6ryZ4w$2~j#Zf)(HnB*fs4}8(q`~drRg3>{R0C6_Q9Y_$ zQM)a=^dCcc`ypvmtT0hMAr5>9RGt?s{YG;52*)Cg%3%djHix6ebb7&2o81GBU?Yu+ zHI*puDC(%mOp!)W(}?N@9&z4w{cX##9kqlh(kQBuC_9Rta{qZ*j{1u!(kSY1qB=ty z_z;+W@M)Qj8geg~U?Yv9rW0jH(VtdbbGxG!Fhv?gRT1SKMIH4yQ>0OuuO`Z7{@TaO zuX0qua#KRms8}^bc}G!4UB(n?6cr)L=5W{*ljl3?Z>C72s9K@0G&gq`u&JZUR+ti! zM)lq!q=cy0tmEJOURQ7LC5@u$i1Lo2KgNurq){cTC#omJfe(QrCQkeLR_XH(a|ubK zGT%Uy&HUS|cU$SGf0!bTiq%Mzx6eCjzxyCOY@|`t45Dm5{Og4eIy&k|rbwfxnMB$4 zx-(F{%25w6MH)rTk`ls)!2UD0I?YjkF-00h%_a)RL)^-{pE}-A``>S@q*2t7MA<$+ z1MWU@)X_|lMrHmeqHN~3SlPIRqn>7pG%D87MA<&S>!jhIIBJ^*ObJP&s5wO09A34~ z83#FPDpRCU)Ge$xl>Z+MFtYEAj*5LbkvPZ zkw#G`66HNtI_htxNTaBeh_dI(yH5zzIBNVuri7$XIXqcW9hT-78Oob^(x_PTh}ssM z!iNCPH$IbbV+qG1jmqIEMA;nPn*Q3hj{1`+(x_Oc66MXIqlzCk^&*X;P9w^jLq{!S ziZqHkohX~bUTK}*bJTB4kw)e445I9ut$%Lqmxl7@kTfdRe4_C9!VOmfhe!^GJYuY* zQ8_%5D4RoE33Sv6Op!*#I*TapN}!|eV~R8?*4Zi+t^_*jPo_wtVx2=2j%*#_53U3{ zD(6vCFVd)3=c-t^66mNSm?DkJ{CPydU$o&$prO2(CygrM`BFk8@t)gZlKGoB7HL!o zFCfZh9-lems8vjnM#cIMQP?+dbi?1>IBL*iRO|q06m=m{m_OXU`tzBG9CZOxq*2rY zqU`G2dXK$u))cANr%aJX)$1ZvuQ6py4|G)ZNloHqo_-W!Z`qZ z2=uL(^QWWcK4D^!Mo|li!ebe?yZ-oKj-$FhX{@AC)TKmWd*OD><0aizNj4TTMH-cj zMM7crzguzKd`Io{6uAnJM#Z{}D0?j96DMwwSl2K`8Wrnu6>HHkcTRKEW>1?~q*1Z1 z5DFFe&B!8&HH#_Is90ADh4rdmu~(j>USNteD%Mr1UN}Y-N~~Vbm=cmk#kyL>+HU4s zH#@4DDblD|*AQjTDLdEgedtVybq7{v&w_pB))X;iGmMA_bpYs-$B zz!Yf|wS*{K-@s!T*Onc115>0?)OAGJW4Zg3FE4Y{y3d&sl15S26J_UzI7SVXY)oQ` zG%6c65QTjnV;#JqsBaM>O~qw-At5sj0#D; zmM}#cRj*rAy>N_j)c!A+Sfo+0ZY9dLGOm6*>LsQ~qo~`6+7z6^2O6UsHSI+ci!_Q_ zN|bkua@4vn8HzNDx}7LH7ya|-tkP+cjfG5+MrGp;qHHVwb5O-Mj@tZX6N@w|)-s~J z*>Kc6rbwfxJBhN{__O-TBOUb*Q>0PUT|{Az!tI#P#^yU}&MU@B8g(|mn<)5;w)YmC zcB-MgXLHi1SoaWx*}x6Q!>N+P-#8X&R1WVI3XhcKmw)r3ql#Z8R{_$fSj&Y%1)fv> zlvoRyB8`f*LMV)d=M+cn^O}i88Wrn4qU?BxbL<->)_qKoM#Z{c#p+OV=1Y$1`?`rm z8WrmSqP%^>Q8zP18bv)wl2NA2;3iA5SkJw#L|vpev@{&kN!>UyR~qx#0f zMA^0FRrTpbhVu3e(x_OE5asO~mr4$My=jU-8kNIGg~Im2bETt>XNoi`)?-B3IRKt3 z3nbS2Op!*#dR)cAbETv9e#?}QG%D5;MA^Q9=gJupYc^A)QL&y>vG82!sF#=`jf(XY zQMPa3xzbU)zimoL8bv)#l=ocesNb)U!m{%;VELua;~K ze8>1AjmpMzMA=ak@9=ljolKEN#d==F!kON6606UST%5t zqn>7pG%D7sM0w{Mj@tHpQ!mme>NTQl-`Kur!D)`FWQsJ3dYveHhOM5z{O}y9*S$=U zM%C*LRj-Nj&)(lr8+~9(NE#LEO``0Pg7XbWO=5~Pih7GEyHc^ytv}r4s2i9fjiTNr z%AR3+55A&@qdIZC=sGi^yJ_HUMx%(|$ zBpc5$MH-cjkBG9_7?M45OGgd+*p!eoD%QtD;kgn^iQk($>Pem3#^&*hr(O&xzXH z><$#1{`0Ndhp&jjI@xUt zYGv=tfi$XwUrQ{cYTnsq#wOA?DnB=#NTW*ljZoNLCYl@Oml z@2I`LF}_HnV*MhqFdGN#z2SC_I*%#Rs93+MSnu8S(+7_FFH@vZv3?`UX8w-t-s$P6 zso$Csl19b)UBxs&;d3{rfwe=5%B8`f*O2xvvXC3t`Q>0O`Rug59l-s+fFLcyPKblyi zQL+9~vC3|4T;!-*e=-zlRIL9Jg>!7|8|!Ye$7n~L^|PT!qhkH7VjWdH;|WLA{9-85 zs966HW&6fig*)%&sNugFiZm(~7R=p&ykOF}yB)RnZ-yd`iq(NATd$8l8hWmyHvZjE zq*1ZfQL$DZ`^P?x`kE=ys8}6|vh5Ybu{I_ObBNn% ztE)HOQjX<^{x(+9s92k*SolmrN1gMJp-7`*ZAuib1j2{F1uKrc%29{W90b0PMU9Hp zS;gvIxx+n<%IILu@}yC*HY3XR4SXh{qt;o+P^3|@x~N#M&w6%|qh4W(G%8kCqHKFT zzj}2KM_t{~#3GG~wYiFwe$n|$9o5*$P^3|@wjjzo&aWr!HE3N!kw(SZQpLjcC`X;m z6lqkftyC;r-`HAWy~Px1RIII4th}4A80)A9*E1y~jf%C6iiPK|^(EG|>l=zRD%Q3t z7Os9fs^bQRB8`f*9Z}d`FbD@mWpw*t8;KQSiZm)#Hx;YHz7<Sm@$qhf7Ol)Wax zD?~^A#T022wF6Ohoo%}(FT21|!#6bbB8{SUBx)n56K)HZ4EWJeS2IPLK<_&De!cEQ z+1_hdyXy8EP}tW{vyP&A5M{3d{@ibUSTn?I;hZ0~Ed4Fl`oM z_;ywIhL`L`-BvhiDO0F18TyGWNNPX5$PbQ?Hka;Gr;SZkQKP9{g@O-(pYM2b4@d3F z6l!!$cO$9~5a_qtnUf!LR54Si(Xn{)HSVP3N<>`9ztQP&kyakzl-$f9g z_7nf8YZ=!IHg!Q^?(S9(ix9wfd6l#F-^vpg)?E(ar=F6A9fh!|R9mN!CbgXou z{M+k%rceWvCx;nC*;&Emp@k>AST8Y!8ck&q<)8VLK;hAi8eOj}qITzc9rpAD_y)(; zYx7M_=24^Tl}(g?z0#RNjV@shQT`>I2^5wPHJa*66#PZor-idTNB6lL3pJYRN0fi8 z>o^u_biMi$<=>+o;aI5A)BvI|8=c_Kq;I|(feN#|#}sOS^7N>EiP{ZhnB^V24*A$o ze=vm_9cw>{g%OIMdt-p3w(4x!3pF~{K%#6b&kYCqJ8CjhsL`?ZPY`PsQ>X#T(|Zpf z3IfoZYvCW*>>2F=psZrqg2HT1FohaT6%y4GWZ0w3W^?#9 zP?#swXsU=PJ8qmk>D!5@FxxL23pK{JT^Cm>?PpMe=s7@Pbkt~SZ~|&1Q>Zb~r^byw zg#65f7`7&^|D4KxP@|(46Xk!rU%?b=G&PhcjAQfUVm-hVYBV*BC_A^=?f2t~9se5F z3pJW5AC8nL>@GCJ^PHjlH%o*+7k^CK6@q_3EPUc1MNTjsyxf)M#oFQR^F7;K=hn zJKa%FF@+jUO(qJ4A$rfcfo(Rv^yJ~QMQD}YD@TEj)fW>>tLdKf;@K2 z9I>Uz25K~QNCN6?rck4)Ly7V~$GyoEYBUuh3eWhsb>F;x9xBZCD^R$hMpK6o)!oPf z+hkA5aa8ZE422p^l@bM)BDD2i|H&;JHH9hEXle>kJ(=3#KU;?#wU8;)XsV2;9hsW^ z_SG*t>Sd--qp5PDwrA?t&`ARwwc*yLUZ~Mjm?*q%!tLhGcCB>O0ZgGrQx!z*Y@k4R z-V?hzY9>>t0SZSp)=eb}k1s6EC+nYerlW3S3N@OVrl|7H9}aO;`8K9rsL>^?B+9=> z?YOP!y{O?>e7$@)QKxVT|J>u(OI)nifWi$mI@WZe?D$mt=kvoIHD)_Qp#~_=QCUTl z|4})cDb(0lrij%<;W!T;0=tEK9p_>#X9_i%sv!!m(Xcd&0@pw5s8^Umjiw?*ZNe1% z1Did*zG4bBnyMwro{0v}cxzur{lgS$G@j9+k%wYBW_( z6rRoD18=roQT$Dg3WY$q^<8cj7S>aZ>TTJETum_m)FW)NlTHD~=^ z`Hp&)Db#3crckzAj{2A>)M#oJQT{#Z52jF~so4prF58>-LXD=5B+9>DyD^0tO&ujv zY`q3Dg&IvAO_Xgfo%sWqLXD>82n8Ra`eB4A)Bt7XY;=}AhNxYDz?zpbJ|+S?pqc!4ztM@?_%# zp)ea)tbFHjN3FYq=^Logu}&n)W<3N@OV zr>JEM@4o>RW;>iI)M)AyMfL0xgx{E3Y93Rl(bTCz!H1}Rcr{a~0m_s4(})TJfmvQP z6s=i8XfCwqHH#FKis9e$p&gPbq-Pf{qP{BP@}1H ziL%+y{qQ`dP@}2ygn|!&la7CR87j>7DpRNd%9D-ri7Esc*5Rflqe$f1C%Elml1U^ z5LlY07H_woqyAzFH9FSiMA>ZU`TU5TO}$W~sVj)u8{*(virH*l7BYnzOAiOll?enY@+N#-iVCykFohZ&YZ*~C8&O9kQ>f9@ zokH0NF4l2Op+-}85oKFhAC=cIg&IxWEfjo+%Erq~p#~^VHtr!R8wkwC{7Bt{u7svtbhBAd3O|2lxKO417p+-~p2?ZabvT+$xr~%58jr)m$ zMJUR~3Cm{Pi3+pb!xUQM0m_q& z=ZNaX*?9YqzN1lLwkoDjqhmc!l+DHk`9Jh<)I6q8qp25&!g_V$2##9B6lyf}qEJ{a zeNI`%6lyf}l2Gs=DjTmcg&Lqd*?5^Kn~m(Hcdm9N{GKV)=vc21WwWs{K5_;WX4`NN z)5@sP)T>1K&tQ8pg&Ix0MwIOvdIsB%Db#4{b)n!xR5m6sg&Ix0L6ohRo|(^J3N@N~ zlPLdsoyQbvH1!ry{`I<*Db#4{ZK2>pRJ~qj3N=7^TKOHKb_N35CiC#Su1AI0zGVtE zI@Y^H*=*<$pwphFl~JRq_lWWz0k&ldHJW;#D4PvE0_@EcYBcqMQ1Brt8^uha1}IN9 zJ|xOs1soi?{%lm3t%51k=vW^S<)4j{m_m)FJ|@aP8<#VM8clsdlz%psGld#WeJT`u zh|0zXOrZuSPc}XyY9tWYqIJu**&Y>U+j%e3%Baz?J}1gQ8&jD=ji$aJ%0C-Rm_m)F zz9h;&8(%Sn8clsA6nu!vM%Lb@UZ?@elZ~&58V3X_*6mROznZbxIGQQc=vdzn<)4iw zm_m)Fz9q^(8=dztB}9#;z9Y&%8{?Qljjq@CL=EG5%^djCZ>TWaHB6yK$NGUN|9XAS z6lyf}BT@eK+NHOt7iu*16H)&4I*cjQXzFL7;6qd^U&|C~fbz8RFGM}Y*|=`;JD;J# zY@t4;gs9Q6ekICgLtjaCOE(m1H1(TMHiC=w5>u$r)bB*uZ0IYgQ!-2})EJ*bGK~dm zVEvfdtRz47o7wF)d<stR+W~8LzOk<;aS17^t@oOzM(uA%o-QHGt^*qX9V*Dp}ZNhGAC4rtBYz% zr&NW@CxlCxOaVrW=!GW<6S{yS0r9|}R7P(!$` zy0WIU0l>dv3ke`g$9TUNSXkt~kW@^K< zP`IuxQfDX%m|uukXkuMsO+#gMIL`jYnzGWysnZ%l;aO$j+J?$Vjdc+k0q#w4WnZW) zQad}wSRSr#sEf?T!i&;V{Jf(4@#z^sQ;8_SIIJI5W9GEdhG5Ljd`M(|A@0u&4UXBH zM`;CBS@#Kd8~1f}rL#jd;h7=RBA!T8gA8)v zE0Q$iHs#5iOfGX=k1@q>S{WKUtu8V%6u+daZ$EXlbUUJI=5|oej;)Oo z_%%SBy`EA#1(!555i3&x{Tw@Y2#-J~8{J=q3S6MSv?IsR1v8IvbMCW zvSD^GH*HF3ePx+t3Sr17n^syEYN#u%Y^V(-?=NvM`v*1582Q#Jr-sn4OS~ zLLM(NTIHY8iVaa(TN|z^Z(U*08J0F9Gk72zho*p`v6bbsL*NNa`^0}D(m6HM-@GWG$9EMZOlMvg9~#0_BXzS)f0fdghbu}OtKj^Kr)M~S)|6M$S=JxQ z&&$mlA1%!^Gl1|Bjg>P>;oJfzO5-dlVt!s|#1PC$tOM-hN%3C1JPZd5)v>x1rYP1c zm}#yw$y-)1W&|f>gQg5VV7R22$_To)7)*f1%&u<;S9^0^jMD_E7RADXMhyW;kHkC~ z@r&fsuYAfA-LIOIq}RvPi6ZGb(M%>IRw|t-H=ZATB=~#qP6wJ$aF35w!AVs$GFII5 zi|W!^+bwX;M%|{Sv^pGwiCay$4$ha{e_}eVo#Iu8>+4IWCIP@9($bda{tUCpCW@se zf60qYm5U=Vp$M09AC{pZ(~b>pUMrPu8c9vHn~D=v@#e_WLdDh9k-CP`s>&n7A-GH` ztDPOHtj0DSpD=^A<6tk2CrqcygxrKN5*JoQi7Vwea87QlsXU@FOy`5(`0B<6xKN~V z&-^Xt++2|2c_K8mv9zu{u`)CWE;<`vdR@v;dqM zO;IqZW^P{?P9TBQs>EcO9+na7a5$cR=;|gk*nh9LnVM2$c+2Xo4qWtmcNO6E=XlC; zb!`w58yZ1rg$A2i6`5k@$WZ5mjJYPG_Knl+{PuaPlW;%vBe-&hOCan`LEB1W@6X>sWD8nEO1>*X$ z(wcZqNj%6PUU^Lw&qC)kfr?8C?UxST^QahbvW_jJK20Uw zpI%W~Sq1BJ!OBRz=OCa%533L}=QW+vpK>F1BDZEf#@!qT4Zi}QE2yL_F(siYs|uIa z`P5?~UyA4&N?AjB<>h$p(!1S|jTH{TDUq@hqVZZw;W8FVilaN_CNx;@j;=|9y~Q>4 z4W%_@;b3tMjCYmQwN=5ohO%IA46ihpQMdutL~EiY*kCjXs)yy4aCxYbpHZy1k0JY2S(L`#=1JVx`HLJaA|pQxf!6$ zS`SnR#?4~OaQ zl*Wn#WCowWaM(9hOfs75#v|)1X2IyvEE>y7vw@1L#`4IF`4@N&U3Q%<9sb*<~$r5*muF+X&xowWd1cqZR2uepda| zaD!TsY;vHWPJ#Ih4TY``%a21bt+VQD8(ZTD<`l+JeK=P8J$EgwDa}9e3MdBI#a?6^`qDd={@<)Q21Jh-#5{K7)I5T0gs{g&k}N zwrwSh_~Dk71-=EzAJ11VGO1{Gt>O)?Nhe)9kP{Q|Fcu~py5bG3GMM=dB`tN@#Ng6; zx4t7qtK4G$@Hx_2<1_Bjk>J>ClX!A8(pMth1E8hhaDkgnVV((KD?6c^HH3;h2Ubf< zsE-u9Bum-6!LOt^J%XZ|1G)JVoT$d~H=^Y7p=6z)50?qTn?t zU1p`__Kkbd5k3CEvL2l`C((73w25j>r)4B=cq7H&2P zjt-YaU@_EWXB=GLfcJ5D8_JX*T_b^ROc>@`_L+pM?B^_2EDXFaSDOYG1dl=5&KE#xUmLym-2yP?r4MO**K#)O|upsB>!ra7? z5w(k#6#=xD#l=3Aq;o9{3^B0xz)7%kQf^vFWa?B{6Q&!TOrua&#x`e=zY~K~pywKT zoXrYdqMHsz*M69f-1M<^r8V`nu;TBzj;GzwIXzy+`{|4`5ZYTaf@x`aeevt1F*vCT z`ZAM)*}QV-w_8rVb-V@+E5s4F&uXf#GdY$UYnrF0Nnae7`2DS|K}M!o%ZSuKif6&7 zLVaj9l5&U>jnND--o3oSk7Sdb+%Sn?YMO zHcXAg>ydQHlVm3FGTRd`!6D|3S43dK4|jOgz!!AobT1TMtHSs8@zY^e=j71J&2G69 zED4@$;AX&9bVj(|YIzZCQ#EhUp%W{11G;;xHPP|=i#XXfS3#lCVYtK#Rm0T-R5OGp zoKRU+X?=Y#@yJL;q^_Hm26>j1T4?hY)YbJFoanWt(|Au&sqz%JA184P(upjI-khwf zgnc>*C!TRUcXYf2CEIhv7&2FIIWd7Ci_%>X}5T7E%ZFfY%1FUEJr;CFE9 zE(+??@I{%u@3A~w6^7}2tR}XNax+3>;QP0_+2%{y@p1W{2Ps7Vl4M=J=xWLtl-< z+0=b29X0(=hui02N@kW?ni)ybSP+44&g&Xsl_M=3Zn}UaBHO>sQduzR+h3{hG)}p@ z`k|f1LPqGC0Ds$r842a%&!g&s<3i)$rmwm(=rn|m>hCu?Gc1cp3okWo?<(Je{1 z{%Fb#!(KR;7$pu8kLLxvvI!0MUUB?;Do%IMw5sBTa62Q+E&hd#4igP?v6pD<;mgXg zrFF2%7^0i>Y&ZG$v@)$9kH^Bp?KkYCx#?u_0bP^RNgHF$x8L$G4=V|zW zBO=r)b{;jPnUf$>Px>2w6kLcu&uOL$nE;HI+=iyok2Gfo#}BN6yROPhL#0{iIq9X@ zSru6sIsFD?Wmjb7WcTZrT{DWh^HKd4TF=}0BqJXlG;GblG}Wlgm)Ia9St z*dl9RlBEiHSL*@g%6g62?^+g)v6Y~@$IaYMi;R5mRw zJ(!ygzaDSJorA&bA#lxWyulnE-L?K!Lgh4@oVMVL39lFUrUHxBw%<0XfCDIC>%Wun zIyI?)vA5l?oJ}e4-e>MJ|09J+!I2wVwRXJWw~64bxXFW8e0&1=I}i75{ZzpcINB*tg+?iY%|?N92=cN0ncR7ZXuHeaVDtgT9oKQ@L5TS;LDBT!{aHv!N+TYK{%#DNYEaNMs{V|8fHlGJk;Z30_es-4UP&R>6lNaNw-G+s}Ybs|ZaB6a9e6?H7`cckO zQ*`62-HP5ng+(_j-)r{jD^xIR7Co)C$UeCjo@4>GL3QxdwIQW7#YSdaWB3m<_ZuW9*8y*ZU{?j@-fe8we)=Rrgh>F1{B+g&9{+whd$n#gil`< zcZpTv%sfIl?z5i7T~j)7nDE)q;x4gDoSCS;PhzG^eZ0&!Psf?R-4zMEhCsZWVd-8+A@MYpqqNSc=JXvyiX19 zv9yPC8+o^dZ{EY}ZK0Y;*)EC;Y(<(nkeb~Wn|q|TJbc8zAt#xCI({7LFw*_y%fMvC{v+RXy`>dk|(%{h=4dHQgT|KJtEE#*pyP7#(U|4_v?82&4BB(v2RYGBF7R< z2Ju@Dh~wQO6}O?mvEn%SXhLXRCi`v(n~bFOHh{bmp{W-~(DUHTZ8XjO38Zt_ zE(f1AOYgfEXqiVHe&P^*#q9eE1lvdPXU_hDSQqev9g0L_j^`@K`G`@7lcwHqAmwRN zC@y_pcp!fK_X->uOutC+Jhxrtua?i)O~|Y}IDQ)7D-HPBp#08-GL_8x3T%m6<-<)f zTID8s-q0#%ZYt0!H#WzfdpBF*kG^BJDNm(KTTDC{bSJ<^(BRVsZPWw`>m>e5DC~PG ztg|GP9;eNCS%oJ+bExQGNxteLI$E-rCtUMhf#C_*Owg>3rKjP`Kbnb}QKdzwi3+Q) zEsfeDRHe5$F9K2NZ5F80+bmS4w^^u8Z?jMn)uy*us3*PlZldU+!@k17lh7umNx8*) zfANpJXeFr#v6RUiEU81sj9;=?&ZMpRoQVg^-z|#Qe9n{11TUE3*U)%!n1nbv*N{5< z+9CVyn&iUxf!=8LYcTr^nxDj=RSAT zyK{ewU^lzVZ4npJ0!lB~x(G%?P8Pj86l!qZgoBvOn-FI}=Vf!=)9Fp`j=j@JQ%8;Ap2ajp}7J2dXiWc!Ufp)5rbUozfax#{;#)V5}YrI6Kv^Bn5Vq4?I zrkBpSN#{1s(n~XYng4jyQYX>5ZAFb-YFpt%GAm!xC;6-t8UZ0U@bi1qAh4+2%&-s3qH{#<8Cg*V$pOvg*@bJp}Bo?_p& z;GQXCl5?OYX45V4;(Bx|ixb_MTj|dAl~y{EY^$kP>z@oFxuLz~eacq&3x$M*{PG;?&mc)|3 za@8(uF&bO{I9zT;(O0xTMm% zD}13H_*&`yKp6bIzv0derQEY;X(si~W7cL;AHuUZlX~aUqHX`6RJZ!p9m@u^L6d?XHA5*)lTB^r_#lf(z-61lsvkNB?Y-Il9b%mmGa!Y zr@pEtY9?yKLK*R8=s~~7%NBa(5>4u?!`zH0SJ8KM`tKGzG&n}!bE=K65l549(@G*! zr^1Ui)6(;T!P=_G)F3`@DQ_a)Gs_P2?~9v(NEldV@Z2Zq_i7M~sc&pe9+B(psQV(5 zh!cBrWan;oW~{L%O$O53NVEnE5k0=G!J@cPa}5?kdS-^- zn~q|?G)k!Qv~Xf~F|CkT?#WbQp{-4G-t-}dM)M$7*XD82Rc{{cGSNKFCZ>6B9Ff#C z7jwyJE*YJk=JGB<%_VJ$+V)YflG3&gtYBSkk^TgS6^GPQLa?_Ex99m{pwwvJ@G zxw$*4{a*EGXYTDD*BuD$9ywt2NztQwRhtBHP1z>yrETe)IR;Ok@karBn#_PHqvur$u!aWb+h($!wrL3- zllzu9v4?PrDgXiH2Td(<;Az>G6kb}6-l>vdUIW#Ff~b3%O&@EmGf&&5q;N5fof5B} z{HMg9ZIINwLs-tHsdDEUB~>1yn>4eDO+>=C8aI6m4=;j;GLDF&Q%^2y`#`ozq0wPTZKxV<=!Z5A;VmtpvMP9WM{r`C zg3>5%PNB50la>Z!)A$Tk{uFz)g~idh0!r9W8L0`TrRDX_OI%1^cg3+Y`aY7@xRK)E zPi|UzSg1Q~?ZBKehn^8OWjZDUF2p8Tn2Kl30;!=8UD;9zD&Jx?*~= znL4ME&bTL~WGjzHW89fc5>7l{rr5*gf2mBKCjDP3R?NZszf?F+kNsaNmh}12tsO$> z8Gs{_>D;m~klU_7J-xPFm6_tAixe?u8KT9@h;M?H)RMq-gg7xWS^`L)(6q;Ib-- zenSs9X~`v9%YEB|`&_ss;WYWnw-z{)qQ$@BNW!aJAo%>$qP1hYxRHG4`$YvPV8J>9UsWb0hu4jp^$y>6gTk^& z`vsON@JJ?0!QXZ7MzO1ycF_tX^6a~P(^p`mvGAZ&XO_R}zrtuu}xvll%X^hsoifM(`I`pK!wXP)ZX`$kp`fy!C$UKT6 z{umM(X3i{=Xh|&jBPcycM@~BYE)!nz176%k0j%P$f#9ANUL)~iy2TnPg}ohY&9s5{ zezG-F0?)CuM)GeDKywqCxuI=MWWwi;xHVlEn;J+*VHk#`$m~!Z{m7xYlVQ4yw4>HU zxQs|R-^LLNPVr{EYUZ>%-Fu7ZzpmWw=AeIP#_`sqe_P4jjZy!$lAG%mye;eBR&vk4 zQV^+uk)^S$0iGNIuZPSplxqT>2NjNkH|0$$tqV2Ol~y*?2Mf(OqK2SCeYp)2oWkh& zP20xt9=L5A$uzn-(AqYV_rPe|NZyXzwvlYd3l&D_21Mv==Kht+>e{MMO(aBXJh&Vb z%CD>`hv%7$3yrI(h}4yZ%T2!<)!%PDf$vv}zlMajy5M;)D?10K;rY;~L!+i)mzSQ4 z_d6xz=_Fc&k<9HgO~~Es{{Kg1ZPP+#i=Z*##r7e1^^{q%3n#I_*B;AaxER>f>?ea} zKbaYDvl32&;Df$UTMH}a9X;2=>UoFkwXk}o_28kNYx9w})>hB79y~ICZEn4_wtA-Z z;2HC4bL*|O)ibS^vv#-MT3bESdVSaK)>~__DK=Td#N zT%w1j)X?JeT=A?G z6*3p#Yf*(v3z@5$wWx*Gq6(Q7GFL8ZQ46g_74n>f^6V;cT6%sStoRp(D@q%y8qAjg z@N6Rc)sy-f8*he<{*tMcjyy#gS5sM2*-%+pMbAp0pV~IHa2$J%OZbg~sf;}bPHJ*p zTE3NsZ|PF??flwYOHX6kZV{?3t!ad>BxZ-q-M`SmDyP=KH%lq#a;fv}3f@>B4pqPx zDGm7bNm;|}+A!ReX691nZ@dL9-@6a**~lM{w@FupgHiWlq{N%|p0SiTjJ*jgC2qZU zHKoE~Zf>Ywcve}smVU=h$8O*JU;xYo!BBdBL9l4#$ilpmqLSdan&~x>nKijNPL8sE zQ%cME+f6TR%yo68vqLrEnIXPI+^Zn}gM!0~M-&tmjTjmPKe;)jNaW@KlAFT}1{s|W zZ+dfa%@ET+5GoiOcV}*HdK3WPdgW0!g86uGa%MJ_9y?#C626HI2C?3uvBg;sit6NB zc#N6Xgv6F9zL%gXdmQYoyx`D5BZ^0stsuax~lV`kSkgsXkx zV+Arxh7TV+xFBz6FgGhV$CS9<7l5Q^L(*e+QsU$6vdNF7bS3@vLmgwyx{BH9as>NS zQ-|;sKnx$dUyy#G!Qq;4U1ga`B;1M75S|)=p96SX6f@edu%IM=#PE_4!Knr?Neva_ zYuVuU0#STsjD!9qC4&n_mXwqPD;WU~QFsuZ-;-M%uCFhJ$2UjqlcKTfaqu`6XgGV* zb#re~$_fq%P7Y=tm|vKW$;K+C7mOG+B0q0PL6GY<2v4}?XC=|;fXQi5$*|&)BMOI^ zL)e^XVH_^44pYV8v060^!OHR=pMuFl`j9*tL(Qq&yN3sdespe+jtO3(&-$6;(;3eU z8lTY$>#?G=vZ}EzjA@Vd3+EzVD~$nzf}@5E88&?Qph7|6V9J7la!O@GZVvv8*Jdt% zaB$G@VS|Pg6jSR`7}R3uSn;6X$dN-v4$mJsNI4EiDx4M$%N%H3|FYAenP9g)JpE~X z{KV71A>_Zya}?p7MCMrSXS*S!Gycy7)G;B5JsRRJmMN^ijg%zT&rD4unmJk%zGqX# z^MWmX;ic_~-lBsqQW+Mu*EHb>;j%Eh<7a%z|LfT2qG4UK#@>s0ug0lZ~L*u`l2XHa1jNF-%u& zT9g$mvInvMZ$lG4&53@->XPj50g4s>o;Dhsg36EIy>%P|Q&lh|II4Ka$o!$h^O3`& z9dF#je}%;V$SZ2xU@|Mkp>Q z88)PN@Q8%bRhZG@`B)n&D_LzUHd@*SUW zUSLKDbIBP`m;pbl3})lqm2@9zcvfv4_;%s2w=@+d15a(q7r8j$TtpQ*t~AMF$K}nD zLgabDvaAjzw(p|oqNI1Fku1t92M{7;ZoYhu`?CuiNn#r{@dpt)Qb#0>e zX2T3Cb{b0^R_`%=X>^vha$G;7i|f0$A2&0Onvwb`aQQ%ox^ak$Em1pc{3tUQz}MM-n)mS#kTmA1n=~S+XeQxJQ!`OXM02OXDji9~ z(Md@fj7m*2x!43X(}AQZ$%_nokekE6v`La^bc&M1q7u|BDmFdM#oR}BCCaH6Cga+86#&qwdGC5X0j3H;5j1pfP> z!zB3HVl;iV5c{o$^bJ4O>~w+sBN$b7>~b%Er>=I`sw*QG!pG)f`|Qk?b<-fNjd@pN z>0tHSZwuhJkINB%mn%+u4fF*6_2i^iqp|uWNwp!~cZcdxIMxQXV z$@*$4zsdS(BFoKl({!$z=a1KCXe|~lPs72)Kk+w>Tdz}1x${z~Vhszr4DjQ~p$|8~JmEk}rG^@Hg zn69^e`oHPv{<4Y~S)YvbjJ`eHmeH^OfB}8`!fRZe4L@b1r}ym(!i;{|nK`uUu#L)3 zJ}|J?UAG>7=1zgYmK_4L^)9c2hxN_~oBss@Ux9taCiZ{)??zn$z01Q>8mFd>v3s6{ z57%_I|1$y9C*v(`^a%BG61?9ah&*hgB^DO{57O#+?nCOIf#09Dk_04K%N@E>Zb@0nPed z0e~%D`F4PPT|u)C>*D#txWhmbVO^r~odBA}P3SOx%R%!3>*AFUb#H;@yC(c$`8sSK z2=szKxJf;x)Ylt}`MZ<%Km2)am-Gjt`wOPGfPGnn+P5J*t0Aqr#@aIB!x+$=#9GWt z&n}}5>m8-r0_+!o=0?_GeMuM9pSK13ouGN1byANgfBB&M7Bs!lF>I*w^M`IqSc5v; z{OU0f?1zHx;wJoI`R)eIiyobyKP=z(ph?FDgiXp9RS$GC0yL$piclxJmh<{Ne5}Ye)!xkw1E?XPq?#u>Tzix<#zz{`_F?StOig zg{WHsnrB&u^(B8%Iy^2v1kGPb=(=nj2<#1iaFhNLRlYv3ZzyPHvo2BjP5{kf)=BxI z{9!$ogXV)I{Cx$QO}D|)1p?wPD$iJ+omfLc_$%0@OECI4nhy4zK{ubZcs%&^b1p9h|CXaRT`XBbwaiE#zt1GX>7`Pn;e~t#tO4i}{@5<+N$AUew z9ULR@2RE&oU2d#_zzq0M(Jc^o7yjV3KKyb1v~K6^1Aztb2RE&A<5f@C_daO;W}W1P z`X7>J+W`LA0Xv~*3wB8l_O8W_;EY)AG|;89*7QHnMfpSBh$Q_@23g=My62nlhvoY=Nq@hhZb$e7TcZ4RXN^(f@!{VddxEZS6aKJ#W0UlE zFzBWw;qT-m{hbNAi<9tocar`d1l_Yq`1?9Ze?Non?FoDN)rC&Ch6}K(48OcFKXTt)K#Vb%?$*7=S@pv;*N@$kK_F6;Usl0`{@cs zk4>9cFwPbW{e29&pIJ-inE=e&%cf1Q@0)F9fm2||dOhU7=EFuXruOXFXHZ^oN%5fJ z#bbu&jV&0m@6Ms&V+um!i$?FCF(5sCXP^DWV~a-TjU72UR0t1;92_bs8edehzn^ln z`3X!(<&?V8y4m{=AIo|3AwHh_nO+ z1w>gO^p?;elud(ONa#&Omp}ppLJ~qk6BG@WxMDp$Pwf4yoV{?0B1OgCJE#6E2li8J zC;!jqd7hcsnVs1kPtWsz$Mbs4@^K>dNn>W8|X^oRbcpaHKEk8Ul z5}rCSGBccC5ScouATK;7Trg#-FkM`Zhh!`8+YJ7^V0a{F#j5@@@w{e1Me)4y(vp$( zgqfwqOJ)?8*Otb+S6oq1iAO+7)w}H-9WxmDTn zJYnp}EC>Ips>*AMmoJI%iM^7@f@-)Bsi<8#ue5skNN9-&HB)nD6hy{M$tfy`8wNro#hA(jZ6~{@MPuy1I4WBa|Z}DF~hrd;uQ&hXWZ2p|0 zf+=GQ=8PXdY377Eg%f5?%^x2@O;0J9Fl`R%XAWmUJ}p~OT0RFqZ=5r)wyeA)Hnk6b zqgXb-Z%JA8997M8YRd5qU~$FrDm+Qsw{qTMZMZg~rEeZq)7oKLZ*5b(X8bKGn_peI zymCQJp!<{_fr^zFRdwC179jD`Yf$1fw61}6)#`CbZIHxgx`nH-mgUC%F?)uOBOiQ zF2Lc}*lBr#;@7xZ=iNDnM;T%@QG)AW^QwY0uClDD2M~BQ$dfHdtCW#eV{O<_<6qid zjzi{_ql?Tf*H5NpGbWdE9W7V!k7M8>+OM%ib`vp90;WeC!Wa^HBy&a?nKSabSBd0S zgYyepJw=Ri47yFm>3JUK+RmyN#`A zG>#Ol3(kKOu~2k!YG`9a#I?|=&xg_q9^JX4IPsEtz5h50EL@bd6dEVRlMekZ`Nb*KHUXK2_Kd=rF zP5XJSnd9cH#0Jf$)?=)&w)K#x0L@W$9B{aW@nUG`)W>TZ57>%9VCc5c$=`7jtnL}w znA0tk{m6=*q3A9(R_qF$y0s<{s@vKvRJUhOs6OwxD6JT5PEMZ)e%^cq zjudSr&VLZGe}l_krlkv~zf5Zxq}!}JxEtP4U19z`1po&3G%QLRJKFgnbm z-9o({3Dtd+8mjxY!^)19#-X>29il}*89JnEcj9_MRwEZHGBy%1Ia?PX)>!y0W>gWI zs}EH(1V@U- zQDCWvahkkZ#C(k!XpQ+x4g$rz;`6lt+`xKh)@4Twky8KcA_A}x`f8x1KLqts3*72{8=oj)5AGDeA~q(lOL zZZf1~j8ZR1DKxc|QxHW6h_gK1f7$x2jX+mNi zq6nOm^}wDdZO9lU{!gUE+BiYS@%M6Zl{RFI5_?6On+*eyE2#5RnoxMu~rlG@ambl3|SeqfJzQ$Jzc@|62aAH04r|KKrx>Pfu@K zwW`JL2Ul;ubMvCWqr-}B-n!wzWs7oBR_$wXZSTukZfQBELD&A5cG@@mozrvPyQ}rS z6F$GYasRtUJ@QQ6pv@`m^y{a0URHGWpbY_*h@;Cl-8${6(5I*W<&DzTRrk!YU*Gt*Pjmiw_G5K! z*Zp%VvrqasRR7J=o10y?`0TW|*5&kC+w7*>^n5?jplQ3J4TCQjyKsN?nIj9H(yt%8 zx$@y=_1)9of8xEDZVBIAR57sWr3da@bMef+=e~IT-VQC-ywrHpsycK7Vcg=xKXTAJ=E*jG>hS zdY|;yfy?&3HmqPyM&S!DzI|h(>|?joRX(X--`8+wi>@d1`P0w6{#yCHS3W!b>*ohe zx$?uS+nn}9pEDMI-uy8rgR`t_9B?@!-zsa_ib*wy!!7e^#2PFd-3K@-}T$0*Xy%`j{9kE4sBc-xruv3Hek9`8f(uHEYx-tpp6m0iS1Bth%lj@Z z!8Lx&KqmHi4NL%-1^C2?sEy&u$fc*5Qu~zDp|}F6nD4O< zLyF(WRTVAFdg1jBrqrRz=wVvGCMDN`l%?X0m%f0mrsr^ginNkaG2hj5)#vwd@olyZ z_6&xpkYdXvW6dFN=ls50o^iZBZYmOVTZ>iXaA6CVwR-&$Qp$uBb7+RxvE>LP`}yFH z2;XHle%aJ~qtZjhnjevW-w32LKYg#`$8@^UXH=w3obPSPyZHV&r06>tt1W(U@8)}B zRfz2j-@6*cO5Z0z*5-Rmy>oT#_pt_<ABe8)r9hr7ViVUP;+B}L3Ib4D>T|Z`T!RyjiEYnjkyl-GLTrj0+c|6lgFnV1NfBD-d z;+fupiSL!tmV5%Jk6?J`#2N9(8)rsh^+=|#U`|p@!{T{w#4_^9AJ(tmw*u$JI4*DB zp*o()OvuP5gR%q@;2B5pxIHVS9{i(yqe_*%QkHZ>eZUtf_^NSLSq(`BooQ`hcqJn) zB`+>zR$NMzO6hHAK2xRiGE#0=DOpC!D=MWgQs@!9VF4jz8Yz8LN*^O-mP+Yoq|~XD z9!QbCZ&xWjjg)pA`a~cjUyT%-g0HmjDSd28M&X3P`u}VvjWncWasFn&Kqga$iGOk8 zs4JNvDv5K7Oc|(BII4)0{<?ndhuOz<7@vo44*j3&_^W;MvHywjPA%) zx2V}^AMG@yW+*Aas4-mXW8S3{|L^kDFQ_6%R{KM65kW8(TWngUE&63j zgID9KYEPXUtpiohdb6NeRYcD=4H? zb!yKI+n(0fuywwY5{$)Gj*!xAji{@tHKn#IDZyB5KOvBcGB_$Y(tvrjZ zBQ74j*p%wY+dc%rSZw7Z)ht8$)yJ?kM@b3BVyi$%>3;3lIQ$D!>Kr8{7>lhj7F+bI zpJD3}B_$Y(t+5tc^vjg`hmsPE#a1ZJRu98gS7sbRFcw>3q?-NflPxE2G^MJPlwd5j z#tA9CZP2fthOPURlwd5j##?NSc;(_dOsT_p>x>{6%l&B~QvJRlFUEyxB_$Yf^+luv z5R)mf>oJb?e&deymO}%tVXhT2cm|cX;0R=_tGEeBF{L6Cr))H(j#E-(tWpy#Qh&U( zs;4QnK}nH;RLs+XyoZvu^n4*fg`1U>U_{z`NMQ}gl-Q>SCnMGG0;z_H~ z!^%p?%15%ONo;@hsL_&PN5V1hUP$#q?1MWmBzRyaIP_;! zrQAzGyuiTLfP%lm&I=i36%o1bd|5?F>8fA`-q0x@m>Pf=(poP@YUJgtAYTgFKPa}} zk=qH49z6j6&N8+a!uy_AR4yrvtSqisURi-R)6SAlYQ=6sAo$#TbSeC(x27aw^j-Y2 zw`z4_m}ii^QINe1E57gGRpO7!<*DB%Vr-Oq?`*Y9wbm zpF5v4W#X7{VF6zw9Hh$%9pfD}w1)Z*9vGQ{XV{Z#O@?MfayVe&vj|iXhUcHVHxJ)% ztZVqyHsy)rty(1tyFlLqM$0hv=}9t0WQgBcVXMq!oS_h}tJ2Mw&4LY*bAzESF=Z%A zG6xvyl5vK@NTSKXP?wl8lzE>949!17#4w|BxvdUAN%Y41Tc% z$G3LGzmCHR8)(A@4t9LGM;umcx)nd4W2vL>Tv(kUC-(u926KAnb`$Q!kx;G)-X=15 zpm;loJSBab$bhW=lH}V&8j81xJb;haaEmQM?9(Ys;Ik=j%1h?i z*i!+&9kK_fw?n|Jb{_H-8^o{GZNE0`4&Zzn#|JLp(0H9P-3v>g51lX~mdpWM^`{|`TT7SpHM_1vDq(fc|X>*tKT z;`gzSn?WBu_^lcP8A!$ScYbr__p!%Y!z}!p=o2N|O{V8N(0*B2`d}%B%;aNh=1>6! z%(3+zIR8t>)?M(=acqtG)}AH8^4w?}3&ofjQ(xrtdSP4-VhoNcYo@cL&$j71IJW)| z{*wCvG=#Ok^)I>SSK$Za_`UV7@iT7yiShhdpUu4Gr>#%e$5Xa;hTn2rWv{k|*l&H< z?c7F4z5kNI2pQA6<+!R}m)iAlmEW&2@T&K56(8GJKce$Idb*Fu7*_`kkprd2aaDg| zo;j{Q1m}P0xcV$g!f{-UDN((|_%}AVtywR$jhAj~RzA^Z2?y7#|9fx9*oGEx>Tf)* zE~=@i!k3?`R{xqSSABeK`dwMp6PHC>>Mh$o&iOA){`^xPoxXADn<}bNbV9rXy@yVl$z`UtAw{oGr z@4>X_fCz${UDih%Fh?cf@Gy+l4a{W4xs?l_I4uRU$^&;6m@ATSxzKkfn6DM*<}bO! z0(eUV4u(YB@&JAXjDx|AI~ESU5DEpCe4rZO=+{$kmxbwg? z$e=c^R-M})^&JkTn+Gl%Okomk6!gti45A`9`ODuQTn?^Z56N(dGr3hV5$CQrTBFfq zv*93E+n>qt!LtG|lRa?9f?4Q+TLxyG2kvw*7kJ<<1M_DO+?`+^_P{+3<|Pl@J7D%Y za^`sdEDH8(Fxz{JV%D1Ck5hfHoCoy5vt&3J64gf-%ydW2w99@T0aI<~Y;WdF1-Di) zw9DZ3Cc_Qj&Q&b?k>G6l=*Mjy^*sP?M-qL^-}@f*?F0915`E0y;eBz632y#&0@qiu zZvHZVg&y@y12;E`KIZR4kNVC8cTp03%->xe^=$#S%Y(iTJnH)t-1i>zwdogA8Hl>o zM*v)J#k$o8=hbl@^&Jlmj{%F|rjO-!hDUwpg1gj%z6U(&dlcN$N%RGfzkOhuWePXM zeB@ewV0tUg&0juTKMu@Pi@x+=>@PQHsX2~?U}}OtQ!FsIr%hc`uE1Lk%+ zXKM%P$j?(?-m-HJ`hEb@m_PPGaPyb?x+q3~IJx;d2wYAQeYkbgB4Ae9IfwjR2<9p~ z=iu+dV4ksa4*EU;^PQcu>Erxy1UpkqaPzk_xPFRtD?jQh@~H0^aHUD~b%(w>FgM#d z2Y(+2^OBvj`OEtK3XGpW#6mFqaM0HgOdmUE)5rXc2eaJHIp{kN%w=}YrjPyiLB%kC z3~u$Y4cs#x^nKz{-`C)L{HYm&Q7*Rc<=CD(fEi-pf^lzbJ`~(^#ZVtZ(AXJ8{?9Y@ zEd+N`5`E+@19Nv0t~Iz96oaS;!fwp(x|zsZqmRHfOec3ZnBj_( z^8)-8^_H=U3q;Dpe6YTnI?STF09L3NsgH!#sMEVsTxEA0xd*IrDd&reDcif@BFN6DDu|_!y zKTNI_xHiME&cVT;%0;zjljFEH7))*wj&=*dR4LAAFE+d6Hh{TNaf$M`1I+7+bITvw z-}_{^KtXWRN4rOZ$yHpU{LKKfCJD##I~&Z^igU{!xm&<&O`?zadlAgHinIEGiz=}F z9nK$u#)Keua-7VX$x?kCt|<)TUqA{wVZ>bsSskyRDF3ydZ@l8qfMxOZAKtx25bjH zf8~2^5l#w6zb%Y@8H#>Un7uvi^phbLuKPA^mHW#sCkyaRe zGh9D4J!g6j-z^ShzM|+yJ9ATU5pS@~O)reDN-eA(p0oa>wp!Y$A0jnee{5>Feo32f z{qjJ#{)CT;>gVq%s$c%9bS7MP($KW<#)*NV=)z10u1F0<+ZOuY+uNwn|2Mo=JzTf0 zP1=g)MbTOm$){oe()7Je!qKJaMbWRr{!a?Czpfb@&VI9IY);xeEz<7E7DW(!Ci=OE zWPiT4CheZ4xHc;8LhJB>9iao;prQ7mP!wBrKuzs<5gV{IT(=VzM%U-2N=G(KM@uV2 zH3tf#B^ljWjwr&Kj72QMxh%{{eE&OM(3%s;Ic}TKQdqwx{XWi3d+)vy=hZk;v_BiM z`;FM6M(kt6#ByLh{-Ou+74EEkwEndjZDhkAuodr@PiyJJ%ZX9gU*b<2zJ0!KO`Eh( zv^sr-zcAWA^e}q{!bzd*{VS_Obw8!8Y#pj!X7q=gwDd;Mv3FD`xKiqOhBl7Zhm7%Z$OuIzDjU?Is#uJb z+z;SLq{)GSD<&D^t%8>v7%f|h$s#F?;-%Wpq4gF;gK|rPP_(HWw$O}@6*64Joq;1o zd>y1rsn>MdUc4_$jKlpxA)r@QGR!O-rT1UiC_x%O+Az*aQn~&AUH^fc)S~FFLJZ5S ztOnuwU}`vfTWzZ%jtN_f>hn@@r047iw()JNTa&8QrWe+S(!<$#>9sA3>c^+=ZCY3l z34g7>sJ>|!RUM8#w|-R{Ob?&?@NG>fnwwfEQd2SVAQ2@Oj)v0LuWqB&cBIxFIc?BT za?x-@sfc4zV|-HT$5%rhqOkRB?bvV>iO=FS^y!GLU)@%#O%X3}hfug4N3=;OJ14ca z5!MB%dk>|qP`0nOVPU;*Zwl86;d-qQu2DIS#v2SFn?B?pqp|qIX__{mD4GKsbgV%r zJCs`6oQhyH{o^0u46hXudv91O6==l z($}1H;d}aCKU_v`QA^3ZMWIA73yDAO-l9ZtSMhL%4a zI1rBJiSiBOb^2IABzQ0#tM{-YJx9HVeOIXNW4wp`JG_V8*k@p8UOMz>p`CeRA-TiP z*RW?E>;4{gE~JWu>2jQn#d3U3Z?@&s(Ve>ts8s00whX5}Uz3Hk(+2#nY58gQr1-cG zL!+Ga-v(;h;4Sj0%UkEH|0oClw_VvZbYN>J`_bxGH~Y5r-->zqu~7XiwBIVMH&+Fw z=S;&oZU$Cz8y8&_I(Z*^URsZ;U1>d5-4}}Tu?{UX01^dQS-f5t{adKM5Nn_MqK69x z9LVQVys&;)Vg2gV`{#m`vqe3c3tAN_f5A?4BDAxV4DS8_H_#9Kq56C-oZ5u4UrpO^ z18%gj55h=X!e6nn-N^MtULYL(CRBGq_p}ulUhoZ0OtJ*@Y z+IOaHxC2)Udwm+N`{#kQ4cFlxu|z8PFm2}Jc!z$`{&4i`qG1*3;k4WpSk`?It~(KH zN`Fzbt7V~-cKSr*NGz5*h3aefhjtbm;A~PD-4Twyi2H&Mg^xS(2YsmRon9FIDO~qV zT4DBq6%7lc2lh4(*Bvu%psaD^5=uw9nW%hHRKP;_c~VfII9b>G2sXk)Vm z<2I)BN8UGVS#K4ddDcJS5Qzp^@7@|?F|)1zX{hp zje^?Gg4)l5`pGD$&%+xh#1<58xoTf2tgn4X6cj32ZZ^V#Lb0UCVo5L9nbxx4inR3F zS5Pjsx1-?1vOF9ekx__(8;X)XJ*H7cKSvduUbqpPXQUT=n3IOBHPVar<8LUP<+^`I z!G}mGxB@A`08UkzMsbJghoYyTL9Y@Gnk76P#kE^Fn3kT3{V0Oz*o>m!mC$`R$d1fT7N6}7r6DxS`$6OGHqXUuM(sKa)(ade3XfS`|YI|cyF3ZkEH6dGL zg9QV=DXL#NDZF#+ES7h{87qU~`XS-^m6&W+rY|U{U)iQ;w2N?lQ>5)iY`#d#!T<99 zfv;Sa_Y_=Q%QU{ASH>*jT(fuB&K zt3<)@rs=qC{5W-kkPK}+^GZa-`ZpDkb$aS7$5ejYY_L(CwWQYTsUb(!l6s~it29K< z+#0Jv<}5gM`iz;FOE{C%?W>BNI`T8-hSB}RCmBUiELU<;*<0(;Y=(tSJy6pntwRtK zLkHY!ri-!=cQ@vKWIy0erS_drv{48%3(r9;DNalc`#%jw-wtn?E_}bkFS0UzyNqo~SVyQT96R|`) zt6VJzO34_d9+y%sJF8q{NXQr^o{c2>F8kdiS|AF^$QUKwkP->(TyIFp z7^VIurMMrKl=wuXxk=n&NXQr^ zzLFBHQ?=GLI7%98t+C5a>;5hG;DWZ5ClzkPUujRqD9vRMa>%lqB6ssyrfB}zEUvOv zWsDLBM4DR;?=U1}j1mofw9)qHR4wiKrk@|Or}5T?RVj1*lcYTWqPg>~ z8D8V_mU_4g5$S=9QF~KCcGnTotwa)6XYFK{GoA~ z_1=ha_3jrJV_zM94^m{-WsF(pIN%r30>^(a!z5hv(Mi}7(bV3=iu;*cS&=Y@M}~iV=Qe>Qhu!+&YTAQS^#I6)(x>U zMOq)6rNkh_B-iS`21N~1uJSj!EA{>c&APTIXwabi&}NO=G*Lr}D4njr^&qpsW+Y?u zy@zlwb`a{RLNxS4(9qG?r=hW{hCVq)nsbYkmN826=MsLcBkH&z zx(92W|w&`-(IPZ?u_kWvA}YH;Ym zNq>>WtVa=EB%0Mw_7@M25hlG?37_kgP z3vIQ9K0P?uE0y*XqUVlfX68x8SY|SJ)Y&D8-X%&eq~M1JKQ#EE!4D07Xg|vj+G6|E zgOeZ2guU3!xt8cS{yv05){l&_q*umC6vaqvH6&z=66=HnBCg?H5OSNYaxgxz_w-^B zi{EP3RS7PHRDjnRRw{tU?^eCExT@ds(i(I7>hiMXG5_J6kj3R?B?0+{n?P0Na=da0 zZ-<1|q=98A>rV{9A|o7v*{n@>V>MCYua>L2k*#s5y3;`&iTP``ng@hjtc@7V5~Xcf zCCn{vOXQ~M>;`6T&6wN=<8jMXi^7YN*Sh5xBrZy=(mKmiT4(KZFf#LzrsSS|;qd1l z=zHX{Qmt|1_<^T%QpuWqXT2_)M%OfMQFp}B`(C}nuRXfzn9|+5-}~eFMIY^bwcB%F zEnU05VC1oV{xW)Hux<(tBf8%r6k1b7mx@YdqC+_b&Ic>t}H>JE+vhmvDS;4X2cI~CT z@y*#~+3WSc8HZ&Lyd^dF2m9YX*PnQ7+Opf;d13XKMyH&&x+wem?vHBM4tW02lP+Ac z|GEJm={qXwI|=^QI}N683bpO_(z_SwI}7Un4|>1D?jp=Gfu|4M+bmSS%g&D(df&IhtNK5)^|+yP581VBp}(Z$hPK7m4WD)QyH`CQyz!hy z$1E-hym9xKMYra)T>r{(KOWkSPj{^OOa zC*OX@x<@*G`d9zJk$U+o&TjV1-jQj$x7;}Y^VwH@_UXE3eY?(Imh;G*eurGs?4gVs z_P@99`wu_c^yHsEyEv=;)RNDiJY!My9fPNISe1TR_D!9?y;I+5@%&luF8}8_cU{o@ z-fK_m{@SQ=?J1so8(}A(RcGnN?ws^qT(NU9U=Y5~uJMZuJeA=Mjg11A3RX3l# zPTz^qZD&S($4q@EP5poU@2|B(roN-+ecLB@pK->^&7c0~kB?1Wx^B|-C*9HIk@Hi3 z)OP^=ckL{y?>woGC%@MF68MXKYlz=r@-Zub|6+fq&oR*B`x0V)wa+m)*{)E$v-bPA z{G<)%U7>ih}j8KfZ172)?IP3Twc8ZH-aMJ*$ zBhK{3c}FaMir}?`BzV^Jbcw4OnLv3WtJ^EsOKimUzgkW-c#$oQD7^{cNU#H#n zVwtucn0A8U@9P;3d^!Xl_Vb@uJxAhyzc0Wu4s*w_Sf)L%`dA~BKJ}#Qw#Dl?N-)b5 zvv4CnjI!I}V?W9Cbnw6g1TzX}hDQoFp@Fj(#panU+3({AaV+t*U-a!1%dA2gel3W@ z@9T;)rC(a)AKFoT0w?uIrn6w!gUGaReB1-^OooNIe8KWR#xv;Nu%+u6{$cu)@eFg4 zjNvDACi7Xwo!Rkvx_e-HcwpEgOj|z`Mq9+%lD|;zB^Z8I%aN$ZBj;qtmve86p8cmS z!HSJNGPa!iSeQ-)yQ*RtX{)bb*auk`)}2n-wqyv1c8A}G=?R*iGBPfuFfOGyE@gdO z$`x@bcg3abRw*qE>z}BU!;O^2KAFVb?buiFjtQ00)<_wnQZ%HLiJcFP1SyPjsY+@J zM(R0Dr5s_T@UBA!>ZwH3NYF26kEx{Qh7{k+%h1|LX(0{Z{z$hqT&2i;R!Ntr6q)B* zq$oAKsKVKbk^7p~RF+q+EUi}8bj|lD#@ty{-_x~&VLg?@7D5vvWu{7zJLU4)6)NQ@ zgZW0K$o)~t9LcE~Az(0tDy5f^(uR!|p`(%VXUuL4?TnNxPW}jT$6dzKIMpLGGMFlr za)^;~g-S^?QZhODBQ!Qr26FH~NHShWqp`FU# zXIgD>y&+Qi4@HhRw{VtGDXM^sl%ZKe@g5)aRaTo|hW5`w6v0R_th0eCJ&4^W{!=Li z!!9kD!Fqjh%`Z|0@w+ev=3As>Wo3#4^e;VyMZW|GhY!ghgCZCy!iOTHaX?XeB%)Gc z-_g(ySIiyxxVvTxK~bQVE+PoVvYQ;UCFgF@gRr}%DRsG$5{zZ%Iu@LiqE_y%+19YN zLrDq7VvFTu+Tt#hrqm}&N-!2%Y;0D)ni{qa>qPr_zX1-v#THA~w8dR0O{oz|N-!2% ztT(G)M;NwBl$2mBw%D#sTlCA6iYh6=SZuL!t$sB#Z2d(^3C3cJZN#)izf7tBQ&NJl z*kV7k`ep7l+NLuuA_&G}YdBI(TlCA68mFWLW3h#WU5sDcUGqr8uM?D%U@W%8ovB#& zvK?}FO;hS-B_;1(W7|AeYGxU77fN&g&)1cdU@W#qS^T;?tL0`>>IWqy7>i${<7{;> z{5moN7ZC(wu@ywBS%$P_O3hJHg0a}j5mFq57|u!?^I;Ri)}=~HFcw?6U`<;?#$Lb1 zl=@0Z3C3b8Pe`fdh*meh#g?NCTVdXgAPB}{D<7$*trq8fKi8DHQAr8LVyi$%>9$y3 z=H9T4cw2)Y7>lhjNHuM-3{9y4N=h&mTVsV(0OtlcDz5tDTzRK}f3%2_5{$)G2v<#8 zH?CWJr71OlH&qCNvDgYD)$iltjJ6&O^cZGJHR_He1i@IO#v#@3<5G-LKiq!t^`_LD zN=h&msqsRpDb5TRMH&n;rS9t?Qw3v@D#Qi9k0Ty!^*DCu`|=)*{MkKu#^bd(tfMIB z9nlHw=a#e`ZAy(|(IN=OVrwc=%`uAeax0^M{hwMW2*zS-nvl|MU4G&{i%h8})j~=z z7F*MWR4berhV;Dg$wr2)&1yv?7>lhLV9i>d_0?H_GNsz8MTuZ6wq^<`+G1&p>U~IC zQ|e?TB^ZmXSr%Jw-TTEmrqo^~B^ZmXV}w+?vUOM6Hv*>AbWU6dg0a||ja1XGa~kX@ zH>Dm{Qi8GAI#x*07Q^3P>~|R+kdgmrJ=i=E1Y@x^2dSnl&R?d~AWmEeg0a{-4yk@$ z8=i429yf8eDHY@tgdiA;t>cku+B!eKSEead6r_x%3C3b8f>gOLE^R$lhELyD!LVcly=z0RQ;K`<6urAU=~ zeo$)Ik`H#7Qu{dQA_&G}YXMSCzxvgmH`0_610k*p#$s!skkZ@yzK0&hw)MJStvIA1 z2*zS-5mHTCy(-@xYf5$J;DjI;i>)%Gntru>tMNCc)CdkU2!gTLT8vcF)~Q{_^faX= zalk+jjK$Uxq?+R)cfC$A{3>DBM-Ys~Ryk5lTijvWl)6nx3C3b;sgTmgdD?1d*xIk8 z1Y@yPVX?&>woR#N9A*#%qs8u#P>EEtFAE6wY%*+y6mvnQfkmncDSqFf64SoRZv3*G zp_#B#*&<_=T80!iTc0XhWUNxv38WfgAY=~7Sf!Q=sn$3%+}fhY;bsoIari_a1F4ud zAk`qn@5{j1hvUoXThNNQ@?e;%q{u)j<~>ZcNRd)x2VUN8iz&5KNs*D7Zc!;nu<2QW z6u+;%K}v#Wybo4Mk+E7|i4-Zt-u>lWyL#xB@NBn|B4hP*m5}O(Gd*p0_U!GZR0<~w z1Tt1ztC8a7X%8hu#%gPgAw^ps9N!K%H+rd_sHDhPZJl69k$rz+!40O=#Y&0{q+;F? zwN^-R{9(8tByG^OHl@uAP)G0!Wt2j!@py%*fB}K+6RfiO_ZH!&<+Hlj>14@dFRceDF74O$; zN{WnC>Qo`6`}JPqbIvwx{ivkKSf$Vuki+&onJW*5Xe}iPDhIASLlIv-!pBE zQc`5BQfFAC<{tLrgQnCXB}K+6RWGD;zt%PGl50wxuB6CVrOq^@bZ<n|86-n@R}}zw__@)vv390W8RUq5h;Ej-;!kw zDOdu!?|Sp|_Oq57RxiMo*^!#+vK3{;<&mspn_OcL?8@4jNacbEHl9SgEG9P3C>ifG#CZJ!;95`<^c2*Zf85z%3Tvc4Xyp%G9Wfdr9i^TXi31kLa z?ebyh;4j;m*Ro;nFH^pLyMJl!v-$^T%r9PE z8Y!z-URuGYzgMtQmM@p3ZSf9GxvIFVI+&4>m;1{+odL6|8|V@C?cZ;OM8YVZ>Y7MJ zWeIyhWE$J9-o3>?%VYcazon#Nh7ERj3~(G6! zrw>3o;Z%i@?Z2++o3ms_B(Jgp6HD#<8f+Vw$@%|R7;`5>jT|G;xNwNf*Yg#@4!#_8%w5XaI0`Y4%Fgl21_sgIVj8*}Bw`Dw zpqir<=Z^SX{04m?Hg9_G`_GO8v*c7}t&iWVB(i?P@j$IsF$8#Pl)qUa#54-CsWO`) z2Q{Tjt3=<3h&uX@H(Qb0MEU%^N7aiM5bXCh4G}g ztY-NyRLfP(e|j;6StIuTB3zK0Gum7yh}+}p(&bn@{)YWlc8@G^%lWU?o9g?j=NDt? zpOKlH6PzB&FI`X!cVyo}x?YtreUj5!&MadF6cZZBrNtGs=#s0|bO;q?3o9@s{%oZs zHI>yFnZePSqs_aJgDZF39Oq+gFn>{TwO%P|oncu%VITgZ1+}{Fo)C1N9$#umk(s@4+n>a-|O-;lDBHrv_;jGD+^Z5FRc=_iOWmp*H)L+td7hViSsKfmz0%i8MPHF z@f|=0zPPtNH6T6{G{0lds1gs$CFcxleVV&|KH@&{HiMXfVKJQ`F}x0Ew90M4AaG2TU1+Ex|f_@(rOEteW3P)#&R0r^f~k z*3s{wj>K2D`mNBxYWlrCH!rJ6?@s^K&u;6D@xR+iqbmQ+52_ob`R}%ahttX`GBWXD z_`lnd{M_%iuq1uT`pta$EiA<}yn{aghPg_>`-^GG5n7= z206pZ+2~+n_#bZ!a%AW)7C{Fa!~b|=kR!vv#t_pC%pcbNuPq;qTZ#A|X!7~P|IqJf zW2%O0`XF9`VJvii_Zc;c^x!Ww9e&9c^8>fo*IxWr|5DRvy9Zmu!4@HYyUX8!;-j`f zVnrriLUHi-+_AIG|L`bruub6A14(`w{l7DF$Z=xu!ExeXo4}9w<=i1};10HlgX08W z77@Fi7;&xJ_A(-eT>fgh z@hadUw%-g6&JFSf!g;|+W^P`vVB*C5oWg>_;Pi?m6_qP1Mh`M^Vnb}dty9u6+3`1P zvHHgZ$A>56A%aTVAs;R6*T~*>4LZj8>2FK>* zcytKxNn;4uhenL^f*l;+=xAr zGIZFm!Gp8<4>Z#l%gW3gJa{nw4(Knh%xzL~T8h^D-pz{-#Y^qEg8@U|lIqg=H7iQx zf10)e+Zx=Z|D*qHk`AtPUhTpRZfhmNE}VOsuhbW5K`lME@4V&QI>ZQZFR{m!_34>g zW8ZgAIDq3zn?7zUioEw5lM^lsk0}aIEy|ge7aHCvQZzL$GNWM1$gE+RnVlT2ho==x z$(c5BN+iD^cly{!VZn@o!jVqol-dfs7P_>sY+iM7_3DvD)9@I(eEtpYzqA8vn*|44hn%+lf|Gm6V=OXJ-uuBfQwkLA?QgdH6-82Rd2!Nj@( zfAWf^+5DSWm_H$>s9b>;HP z1vP>0Q+fm@;`jbb%hq7r4CGZVtt!J${k3ObIQ;ns`X0F~+`KwDJv?=`z|dJJ3+{l*gnHuK>R-T8f%E{FKpI+ zAA5{7#P${LGvW7HdyC#3^i(p|og#R}?+f5;4M*c&*A~SwWY|zSD2TI%F$5zCgE@vA z{ws_jyOGOZdkpzTFEqVC4vr!J;W1<@YT}gtz!*|ifdRL=whHH8Z5-**@uSAaociLC zdgIdn{+8nidyO^x=f;r%1Bc0hL7bC~BZCI(G{+IYSc_bMk@FDcPVBhKB<{dy|60@fcFSfyPf_O&$@q*Uf+CAKE zOz?w-pPX4fl10PtYc*n4n>EBwhFh%w{)=4@%E^$`WeuF}n)J&WF!bllUi}9T7?dRh z*y<*xa0R?-r%xNHHYc;Ux{uL9%5Sk6)*M5MB zEgJ^|8)_hZ(%il_?l7bmfSHwqRv7F3J?adP4^kveZcM^;0CxwN=aO*$2ks3pTkl5%AyIpI8_WlabIadk z==dB=&I3Z7*bUXG{Qd$3%fV#urVgPY4kzv?%1*)P+#Xa&i2R(fU`miUkk1-Agt3I>*ST0py);n^h-83jT6U?8U6zW{t z{jIosFPM_ulCzHEroJ7xyb8>yrzB^sUz20^SpcTP(~|S!kLj<;mBY|TFn@kla*5h$ z_&KzD91L#d!upMXS>niF#-HLN7 zXWD%nOv4vw)!i=jbq15KI5&O$!Oa45W)dy{?s6~>Db8BXX8G|$on2r$yod;bTRZp~ z*T#Yw@shyA-pFP>+NbVpDE6*K1#qfe_7L(;b3Tp!?bJq!E(L^ z%sYy6(?{-~V1~Vd2!b2OU4v(Wc}{UwKdk<~0p>$T&dlFT==%ap=v7*EFXu~ftqM%D z*97J|@6(SEm<@_^^P@Mos}&;|;pb7bgsFdx1p)VbsBtDm)C-cCgECvyHGKRir|#Lf8ffW!Cm%_WcVqG6E_U$`@v-Hk(^sOGk>$d zEX2X!)(+S|PS}Ipo^dd^`Fj|yox2BP77hkCj_vZ+JtWNFM{$Y#7@`=V5GS|%4F^}GShxJKT@`~_pg5n4KIX3q z%n3<2`gym|r5z9by`k@hZ6W^gN){@@A}>z2O}P;(5J3zKm4 zMarb#J-zpAbF`PLsgpl6g|M1xb4hHMEYwF`V zViA}c#aZ>4+&$n<1T*jhYLoXtX8ugOV{q*j#Rw25C$0wRUxHikp`;qRaLnJuV6Ii1 z%wJ~Q=S}2p1M@%cHDJC{oSWT&;9BlQyT`%crf&|e z9RucW#ktiR^?eBD$bHo2u5UK3^#fC{I5&Nxz&!}&JH@&A(F@!WpWt&s91L!Lbi}n8 zU{)&5+V0KzAa^pDtCMiK;BEo)sp8!7N3PkYnl=FkLn5vm%xxaH-C$aLmRKLlr8k(F zigPO$=5Gm@TRrG|63jOq^fmch(+Y7gB=UDLm|K!?>_<<4IphnWE}_0|V9Gpjr-OOi z1NR}A9$zN5I{*!7ESNQ4Nv;L{nB##to;E{zBP^Z{#lc{$50g6z*SdnqQ=D5ny$TnK zz~| zC`MY2ZGWcSV{ozM_nNjC2ZLMw8sS=vVg!hjlfPq;z6RVQigg=b4gvQLn2!|aW|!-_ zFTwQv0TBeZ`rtg3s~7>|hV?A<(9yt0p*#kEU4o(Ai{*N+uY`13qR>?%1ncn1| znszu22Dfr~8y5m#e)>srE%C=mUjXSh9>8Z^I2f$@tahIV^L7$09XdV&^Q{N20jwP= zEV|pJzV={xd*B9x8RLPQ1ZJ)WZZViOj-1&)wxYl`fXQ#blGC)NILvZ3Iktm46hn@| ziDUb_+XF{^4|w1>?*0|rlZv(0ubICra4&&rj2h5Zt zTrCVO0P{vOY1i66%z8T#mj~fP)JZKQ$8~^{zwG~KDF#syoH*9U1>jQn#U6rn+%WBS z$F*@_sukzv?__YNfq5kf$8meFVh|OFW0-*g1IvZM}2<< z)A+FD`dWesB;o!9eLcZ!OTra`dkRe3R*CJFfa?tAbj7)Sp3@fG?TSHE1gCNyjVrr6 za5>0USFR|>f?BKg9q*zn7aks3GJNhn&r|J`W^xEq2fq8`9Zs1Cyp`E7AVfGTsSXOfjKz| zcQv>um_A2IyKe2^9&pRS^f)>($M#nVW~JiX@<;AuF!f0|&Oa9@22l~5%I{4W`V+X? zfXts;Kc~LS6ra*Hy1t#FgnRa(WK~FH>WJrC9#;e&~(Ee~RB(hrtX00P<+U2-= znqq`PoSgjq0}Nf^fup_w-DKVp>FWce&;!T%SlvCjKKAo<9=J+y>%o1dSdJr3{!(AZ z9?9);KFaXGvE9%2z!ifl^T6?YwI{&6rC8?F$&cYk{}4>ap3)b$ei^~#Fqj)TF(L4C z0#l#0J%@Vxv}rgPcy{BC2ea4%R|96fBWJeL=V9keFmu>&5Uh4h?gd<10A^TU8z(m7 z6Qbh8aUxGKdTKB|GuXF^KZny(4mEV!zx+ykM`4xE7HyPY z?VPRsvE6?Urb&NWxj5+S4rZX8v*~00rhr*&=N$B%0p<^O&Zdv~y93OlcFsZH9x(gt zoJ}9wOOpZ8S42f{tKUPx9j(|z?PY{Vefi)fCDGR&IjZoe?@VwPCDBKJ@A9Z`3%FfL z^s#zQ?_zM*Ceg?G zc+{i5C&0a&L?83_50Cn^K^XsVFeGZvJryHBoZRZ8Ke$mz^kqPP4w&_dOEj_le}hbA63=x=AmAS!~}xX}+>b`pK8 zk7GRQD+aeTi9WW!s7HO9z}=8UAM>}}qrRuWz2-sRevkSNfNMG|aeZ*z*#pc-#U&bd zCxbaIi9U|ICxF>t(HB4N@_y!GFjpv!xpW#&`8m&@6@#bJ zx%G4Ukun_LbK+n~bYIpHOn1e(`N4M3Uok=LY;kW#GW3#@?W!0fu^rw7=fHJy;%xQ7^6PHn+~(Cxa3d7! z)=sH!wnu&Qz*TtAca}$ee*kx75`Da1cnHk9ic8clzX8)=l&wB&<;U?p0H%lH+{Two za3jGiRUGA<`Wv64*r^yqMR4L+&d(dorPP20k`mP1D+0NPY(ch;P!~8M0wU^hyeUL;S{Y}9`9Bud@2SOr$ z2ZPDAbGH1^-??C_?3{zYXM?%K&e`;_zul)8=8wV6->u+wC(+09`@2Vd-+*h7YbzI9 z{UPW`Uiv>0|kA0P_bs=b-NnFb~-|2YqjX*{3*q<5qs(fN7AI*k7&_ z17LIxK%yNmZH;&_b!5vU+qWm2;#;0|_!C;K{wtmERH4@Ai#ksAocwaUf z%v{AK@?)`LXqUmMU9p^(f?KE9M1GtH<}$@4^5a1;k6HA^mmmFj70la;OXSB#ilGk- zPJXbT?*-R*tSsk5ejEv=o8l7rQ2=IwMPIxhyq}&2rq-e_o@4*LKrx7l;N%C})fM3G zRBR$Yc7l09af$r+0?hXoeewBYeY6Pqv{pD664l4iiV+}APJXaHI)WRi*hGFz26LR^ z68Uigm<<+v@qX~W;$kq@B;i;e_bLWa5uE(sdT3i5m+APqz?0x!QLLLE>~CL#X&6r4 zPTPX%qBu8w{C*}6%p?mJUoModPz<6XxcR#b+-k+TwF8z*9hhhmj_v9~#Yn5p?So znu6=B*hKyg0h6aVH-FgH=bkt-Uj9##U*M7Tfyu~!m&P{ zR}7*exV67GOv(cFsZHY%mM#oJ}9w%Lc^=!#KH>-=*MgOrnqF zx5J~p=fS=0LEn!a^`%b1eH0FcMCI2XOs?V*&C@f$%uAw=>y7nb>Mi=>=U=WjE(3Fo z;+RXP`Iq^=RWXQ);KcDhZ!@^vicRFl9x(e9=TiZM8>yqeW{cZ#Eik)+qXTApGn~}Ku0?^k1%xF93pzk;^Wp>UsZ!v$T zgV|)~9Q54}X1krU>Ek^39+)5OoP)l$Gx7Nl4u(YSB@fJ0JLjNp8JKl;&Xzy=y9vzg zcFsZHQ(#`Rb2fc!FZ&fkKN#HReg7={UI+(+o4)~E>jS1paf!ysVlYdS=;QYWQ84E! zj@F&VHU9qa62%}Yf)f|OmCM0Bq}W9HdmhZ&igWXqW$@G1g2DRY-djO z!FI4wF^G!b#IgTg1nwrqCaSlGz&xQiH$T`vJ_7TJ;@sL5^Sxg&B6B!7<&WdR4{@Ax zIX6BQ>qHz3Zuz6WEX4>AC%5rsB)D)AeF4ZX1arFL5|!U3FgGO8$9mfi=4p$*_;%0! z`!1M|73WsYAeT|RD z_=1DM&0n^IEX4>AC%1NA0B&*;ed4|m%t?w%)UGZ7b43z;YzKb@^Qhw7#tr(nTQQ~| z@#7HveFofnicOTi{b2l&#O23!-w{kt#ksY6j%%a96e!Nk5BfV%F^G!b)b3f%)4-J| zHjy8zz-&;QTRWg1SA)6PqA$MuxW0NA%yz}O`9V9+C{M&Fo-aCkcLHZGIm+h*HVg!hjQ$J$4^aMA`qR+V>O#ySf;*9#Rl{23M zSPSMfi@x~$(ceqJT&*~_a^bvii((KJ!KvL-{!Sa`)PHIBE*t08?ze#3rC2wA*-k(3 zsP7wa4N7Fax#{EQ?Ex?&?3_cppABY#owL;k^S1%aAMBiizB|A?Wan)9c)$84n19$g z2YrW@;=K?!7~K42eT-0y0C94wk9=^GlIWwq6<|(OT%vw{KA6js=;OS#1Rt%ydxV7hfHqNa*e`4d@%I|A%z6FWvgXPx&Oh3gXD!)816O-uU zIJp$e8VeU+ek_-Z6(b4-C#Ug>?PU|VYZU8N&g5(GA(fElkiS$@ubOb1i!LElMW z{%GeM#)G@TJYwf;`J=z@fcebMIp}M?2=8&lk;q@RgCU9$AWm-OHyYe{yFQ0{E3@fy zsyEtQY~$SQR)agyZr4^W)OV>zeb<89oJ1eT@u$IjVCNjlIi<{}rQ=|5Ygb%H^aYb^ z=N$CS1ygS4Z2qzxoC)RllF5#XjNHqm&x2uzLQ47)ZzI3Jx4W|Ku<{CLW7_jWK_l5kwFJ*yZ*MQ|GbxbA#C zj&mM2J^=TnV%_|pzVs!sjHOlge%T&ecf}^sH^!sBDd3JzqL2M;tw((uz@3{!AN{?} zqrL~g?MR}J{r7z^KPoO!yGk!dd&a@wR(@<(!@=Y!PU>@RS2MwsB;k1fu}U$t%iz?m z*w5F+an9{(Be*{)*3A!=^SvJRZ3Fj=2YsJ-)b|~@hD#HdGwZE0m~6!*s<(+?j!mME z^|l(!DHeUs^>z`MYm#uRw|f8^_OczKqis&rx4W z1==YN1~+}=hJ%@sgli41N-@;O5KM<%x{<+M9Ax14ey4)_vtnr-+*bK~amFfzY2@w% z^NQkRy+NNCpG{8uP6w{{Yjb%I1fyepw&A!Q?B>@WaNjoz7DXq9Ta;a45ee;7(Vp;fIamdSerq+wGjq z-_GE+f%!mjiOTPDFs+s)_Lt*Tcf|-Na1wsl{AIZe1vg2tZskI*0?cW4&gMsVaMyy_ zt++&fybR`h#Tn)2kiQnycrF|VgIoTXp05}I;w09w4*JG|i`ezq{OAVxbzrVlTp~Yi z1M|G%3_oo8SS}xcX|Y`Tkw{+~Fe4Oa=(G7T6#6ECIYV*0KXj^Jw&$l6gQy5j+~K(L ziU*GG*Zaf+$M=-~=z(hou62zp6GTOD${+pc=YbRL8Qdhry0sTttccU6&qvmAvJzZW zu||E^`Z>qbE5JOcIK!^39k5-!My6K!%rpFT9LJl0>8m)yu1#N8$mfDt&Zu7- z$Mr$lYI`}yuS?i}GdytAH{6MHXwMVDEm5qIKO5H@`c49Kv*Nfe6XjxSr@fH=7MRpE z(ifh=Ikx*l!3S`Z8nG7KWa1!Ja6m`H@qj-sc zHV~~DNZ^c2AaYSuG~tpM3PL0kE?&485XR#ut+v*_t);hrZTq%fT1B)i2~h%y3brb0 z-%4vQV(cqwMby^(pJ%Oe_FQtqw(s|T-|suWWX_s>)>?b5wQp;$z0aOCz2I>k^<@_a zpj=(m=XH4Ub>N+FW6$+~c#i{T!c9HnQIA)F^OlR(oxYUsQx^xITwTe>_LX(B=INrr z&X}j9*>4UW4g_9}i_85SQf~7b8az7QnQ!{Fj^&odk9zzXyxws6b*BgMJ_JtRH7cXQ zJJx*D@Yt@?uXVXa&Eh{NJz%~kBG1uozRX?fAM0rv-ub{OPsdBsm-d_P;&|kxxs{#l z%yIt*z+AYwXfRzTX1Q>n>hu zzKMwx=M{&5Gw>FbFSUP8;L&d%4V;TzJmu&0y9qqb=mn4YE(Xq87q2JzV!-*Pi`SD~9s7n)6^u4D-zR|#$=Hj{Xx&3aUzEF=jz*&-t=k`OXcq@Q&n~T?z9`^xf=P}^D1e}l4 z@zV5QxgB?FhBXHNyn52(Lf}-U;&sx4?d?k7)b@hMeCvU8w~N=4zV`!X?=j#V1de}` z>d_OweBfN@;+giFW|vax0i3V9cxo5)yJ`Ia%lCW0c`OC5b3ep(z7sgVbMZ{RY5ZuH zzXK<@xpzIr0cVbjXZWS*F&X?;0OuDjUQc@L0?w-`c%AiN`Th|&hkL=J9v=he^}QzNNsKm4eqq(DWf%Btd!21<& z{@~(ur^j66Yu%3Dt-?RAp7f{%&J8Jeo%P^+W&>~@bn#OCwbXL^18}n9ny=9}t$myc zekTB@%*9jrJpVbtkM^4eocXDEUG{%VfU~L>Jl3mQfb)M`JR@Hh{lVkF`JIbr?3{*2 z`Th=^+&hx(+}VD_I{`T7xOhF~I}tdw$AEVOaPD*QdXn!Kz}e^GxpwYkKg#ziaQ@rH z>q$P}orpW)pO?W)E8jElYyxl=xOhF4?{&agpNiK>KK6eOaPH{^kLCMq;5_Bx8Tr!6 zjd-sB=N~R!Pxd=;3-;6CpI3MG<2W-OII~^6?)Wj^2H@P|;`JookAd@iFZ@_;e+5p) zmwJ|u`Su6Sxh|d`-@EH~F9*(zE?!Ua-3gqZxp+q3w0bZO`RoTypD(A#*X4K~0M4nY zc%AA2^*tLnAs4SF`DO!Wbvj;}eC*faz}fENx#ioXe67HFITf#ye5|Lx2hLx6!DD%R z2%Hn|QoHn|$GO0n>EanXr`2cL<$B<3bn#q0I?2a+dM9vx+zUU-w+A?Xb@6(VFXL{+ z6Y$d_j4F?co!IE^k|Pj+4loV!x-I_W`uzX_a&T)dv-dkQ#*jsfo$nTywx9;<;9PsQt`2kXl{!1-=3cr1^f0B668*OR_~0#3iL_N)iv;;^Ot>Ki>zOoi1Ka zdb|Xjk6k>YM_N5)Kbij@Xdn3J#m}znNBJ%Q&U_cIC;9FM&SNfKPx9>r&S4kN$d^`M zMj_whzL8-S;h&c)UvpRU{RzOCmWtQO&aC%yfU~d{Jl3nF!1=O^*OMOq2RKi=c-`qi zfA>w`MDX?C6hyiLG)E`?v$ag_tWc{>HK z^L&POJ^~!yeJT2O(u49108WvMXXHz(r^G7*PMwR_ot@7E-mSpd=Hm5KUs{0kVk%xI z`Pe>Q2hRI0UQhD%{T9|q@XxC!yo-Uez{TrMkMqG}J#Zd%@p{su892X5#p_a!-vQ@6 z7q2JzvbN%VPW<<##}|Mz-^J@rj|iBo1I}I-Pxa`!UcCgIw^Hyr*DIFC-++_-?cU`Z z0i4ofz?%h}RW4q4dfbG3zY3f|-_d+~(qja0ic;{p)?)&2rnz`MmB)PG+w zT)gh|m8;cuxW6kc-!o9(})u{s8~H zdMc0Qz_~RAuWLQF0OxxyUQc>F2Atn^i6^4S2iHvxyEtB|taC1?TikHLI4{XsH45PO zRR@!ZP20g>@Z8Cva3nmrB0RGqG;5MQVN_Mc%t=+3mCv~7yzxavqq=w=o>e|0G;8{d zsz#NzJ^58t^VF zpB$PUnH337oG@z1qWKHzuZwn-z3TFCS$WmW%JNC!$>H)DGbQVJ zOQJQ)m(GjUES+~<&4jAZidADSzpm!G@}=|UFR590QF_AVHS-ogmQAffNzW*sHft`*XD)~H1$9urX35+I_4RY-H!fPTFgf+?1}Wil z7A{&o*DdC`^~;wnsA*_ew)~uB^S@|KurAEYn2*;5tmCb-tpA8v=3cRA!SZDd%W9*+ z!Wm}-r`MzIEV=;;A_mU~ipqX;tuV%&U-K=6u3UcjOv>@M( z-Bb_^T_zU&WrtpC!_Lu&^PcUz8!34zuxUNW!c9j5D~Cm5ph*5pD%JGM06b`H3# zNQ?+VMuen7W&`-CD&gEl&L(w-nkPxMGzp!T?fBGePsX;8 z$`#9WRS;27&@|QYV60NmWmYLT+%#(*s%9(1uyR}pMR7^#t0|DftA-I2Q)pIbcIdJY zZC4+54o94~BF?*G_c$NLZZCKYe8NsvWP$CU>dZZ_(BAmknw)USffaqiqYt#Bg}+ka z{5e9?Pjw>a*)(Hcn6aZWdrR0k&R!7mPi(rWDA$Vi+f`OjXpL!ZA9smUR#eHheQLO5 zSM+4B$)%tN?rz=;{Pw=2%6KqiLv!PRU$G~3K0S0f22)||M2hm)|GpVtLpwS;@N)+r zl?FDjn}v{p4G*d0HYA_sl$~c!4s45@Hz(|rmfB6lR&-R@vFA7$8=KeUckGU3;2VlM z&yG*@*|Ch;vRF=gUf8ihfo=Q4&hC!N{IbBd-L>T<&o|C;<%s=Uj1xG8*+s91k-E#O z#$H(AZHJDxc-8Qp-(d;=M}b3 z?poRbP0#ydzYs~=pJgu7k&Cd3I6p7gN{i~#h_kRDIQ9ikfTo+yv#mh+d;LG0*gtw+ zZquKKO^o3_@zm&fgBxwBmMD{cVP~(vC~SWL^@rpmlWIXO9_)(5=N6!1T~!=*8cM^? z8=bC``K|ef2(~czWUrRUQ-B^9e5lCjCK|&&><({G~3Rv`Mp$I zN1R(X1wj+`ei>g+m3BA@ZDO9Zi|P0rC24m7+KpX(erqeBX9W5Ipyvd79MFH_-)}vQ z&;CNOAJBez`Wm1&B@OL9h-^#?zoE<2Rhk-`RggPdJHxkZ=PO%5XrrryxgKMk#;_F` zUzTTw0_Dy9%kpxY4j$jM+aCk8u`F+JG{=l-TWmH*x!4z6-MY6NUtEFEsDraF*D)pH zT%T+2_|zR&Fi?b@L*dc8IC7Wl4BV0li$-D#3+#$`!O*btn+Qgu%80W%-)?%kuU+!; zN|e;|9A5SxvPZW>N{+5PJskH3Z0BRUWFLl>qxNIUx?`;!pPpft><(;t1d_Dp*xSv6 z%suR6-7<>Zm_I%4zaSD@fC1<*ntV8ZAx5{3zAMg;IHy7cEy|65jrI?0D=VnBoo8#` z|MA#8$o8Dt*nr6u5XO1N!)qUf8qg&L@yG5Vg&i9!T{uKw)wUxT)hgMe&(Wc+>S}jz z6Fz(Ih4?zKH3QPYj!#%y{MLIWZ5&LegWUu`I>0}e(W-y{mQgQ0;zi_!3i1(#%ds!0 znyI7ZiFp2wR4sMNBF;|Rc{MV+#Y6YJvOxw>M6-?mA>$esBseie&b79LthY1V&YU9dEx@v`va@87=V?!JHj+rwdJXZXWI_^gQg^TI7h^U+V* zEr%|SWVVDC?Iw1`qGs#qua`td?+Gv3L&*N{ke#{TZuuDQ$4Ig;PETl`JxtKkl7q@p0hDVI?uYIio=2`VSE-D8c&9#w@ZQ1`Evx?1L!7g zhE8H2JSxqZM#&XZz#Vm7MaK`T+p$o#dvq;4n`xsb6mKj<>m<5-f?!*u55WWpxKUJksXQkvrB#l2g;c$9#$?rtdeH}U)kAF ziF|H^pq|OEGp{ykxm3X3_KMK_d>ZFVyR3v9@X1pbx^aNZxlR8ORax$9c~=9u5M*~ z>H_>okKbaKp-xv8jIB_;fw)Zaw%h%)h%ZaHS@9(W58CVBt^`JMX_sScd`0E}e~37T z?DZ`Nk%5%M#^%7rFM?NS{V&e~5xUs5fej0hV7HYY020_>K&;p*$YWo#V^;5RyQUETMWMFIbsQIP52Dsvq1ZJ`kY11fRbxqX>pG_5 zzQw(7#XTImmDUe!zLle1D0bg3aH|c)Zf)k*&A0BvEgZXVH*T)*6fSljg-iASlU#qa zT+h3X&sOWWB$3#P++CCNtzDCYR{P+H^S&LsCXoP7_x(tG1u9|%eBeD%w2AV=9QeM1 zt{3iZkd6~AyA8RA)~(65q661GCc|}LBST$C%e4XJOL3Z>ChT1l=(ZQKoyFJUKo&rd_fiD2s z3MPJQF(B;*));6rAf2uK5KyknzaBMd9GreCBf=j6>Bv!w%!Ufy4S34v^x}6TVxXPR8f=knXqY0exGbwScsn`W~R&lJ}b45k=)WBFX@fLbcF0^ zj_GLpHQNQi&Z{TN0mDQjKJFjFtz>n611e-FH|&f+OMR_zVY_eaYwK1QSkdF9pzV@X z`3(bYr_^9fv^O5%==!^Mj8iXC+G@pYI@%Gvh`uCR=UjS~-nh~qLoQm+GaWD3v6CcQ zqoNxr3tdxn&DB?_>$!#Tnz>?LdM>9(VR9e9FQiJ8n5Pp>+9iM1^O+Zg95Q<*L*($q_i9kHpx>=a^@h}Omg%&QY({FSE6bl5JF!{ z$`^rz^>6P3M)Kgcp`aNl74$gaVZrN&pkpY4Yg5Ml03oADY&8b*D{>>T5;z9%9Bu@7 zV?O?a+jBuGmXE|%p}Rt-g7me;_%FqvGqyR9H^s*P9Q@bWu_>z}u^sGrH*aE|fxJxz z^>$cqTuJ~2CB*FjZf%=5@0_>07*j? z9lTXQ%!pzhr6C@-SKS~=B=^0TzpMUvVUf}8Z!1JdIN-NSxhD6s9DdQy(!A_vQQccv z&$Y9h2S__8TKssa@fonW>nS;@!L-F%vz*%sL56`SS85`NtVJnL*0-!fnmh~uaLMAg znbd5g(t+|@5$Ctz*j2gV*wk#VvNpY49SS`9ri5N!L5(a&l`DtgE-|H;fy#**w>nrB zTaAjlx(NTU_Ucmn+xSn6+96ch)pPJ)jS$l6x=`DsAZr9m5VL*5&_A3*BU0j*9*)f# z{&)Gd%5P_W!a9xr?6TO}!EICWX&bw3N{|B&l9BmZWWKf-{h~W3Ni+`i?VH{l}kf&#}UJ1mJUIRT>0n$Lvd_WrLX#}K!9=@of zfu7p|X`qLj&NQx4>IH6`jrSwFrh^C>Mu#o;p68y`^Ex7EfTI*1#VNa~;yVoiGxZnEQ-s?Uznm3nA6Bx>fDR-r$X%IR^RgweDC zP3MA0{Koun?DKXEK4z=|j@;rRJJx7L;tPtyv2g`RE5*MZi7&1UAwAYG3t!>CHdJ@2 zt%0Q4I(ARHA7STrfmjy-Z}ewyCKsdfEscg0n$o$9iT($HXpZmOw6^{A-EJdTC(CjQxe5VSiLkXt>R+o~lwsb?E$ zDh?D$T`rpC2I+(4WB-W2^qUy_l7oD&+RnRyJoHub&6gO(hwW!>&mjR;aAZ;Gqoe>| zd${Y6<2J z2+(P4js-P0B|7&A*lTpo51X%(CZ7YyU3T)qIMrS?Mw~O25y8M4#MA{77*0CW(=6Tm z1bbwdE|Aw$3W(lA6T1rBs&TVpPZa5`7`L{jdVJC|Xlp72L_K42lm+lsDc(BVK)hLR zocH6~{qn5oG2V0~X%&0Vs@8$v@QGBKLO=_WOFQZYqg*Xwm*ztYjR~M=JB9!s^?VxI z+BJo-$s^q9pUey=YbUFdw)iwCe56nJo9$+E%XuGuz-&k#GWAZ?&GQ8g+PB2k^#jMv=tqeAPAex;HXt-!r4(N1&9sqQL z(N>~v-4+){xBt}w^Ey0C`Z4y+g&&nxbac|S=)MQ&Q@0P8DKQ={q#?rd3Y=i+u#@6> z<-=ro?PDyjq2FplGnRT-{)0%YW*h!@gq=CL;igsjffb1771=vj@o=rROI{CbdYgsP z^hsdl5CnL(A@s9@WfsWI3gnglpna0IUaSPSt;9U%s4fP(jTS+AEwxzr4}>^&^NvV- z65UE~`OS8~GtS55ZJ|JJAaF*-%bdiY5PFQ2-VE0jKM+oV!itw`1It=!0}ThVYwf_A z7Wg=|p}?Bmh&;XAQJK4icf0B4cLH``%IudBKKu*fQA&(aXZAaG)5n1o=h+>IpCBiv z#a{ohYy}vOK;-GR6ULfxi{11lVireF32gcRGHAxR3Z zhe<*X=|aerJdP?sbK~n?T4>5X||I(MZ5z~WUag!0*RlV4ZuxB?`^gUcpW(6 zPH<5$WN0aIaXi_$cC0UA?t$D%h;^YK!n`kE`=DH~Rh2lzt4c+HRD5p>3-%%)EXJOg z1A!f%iT<*`9k;UsdA`(aqz6Fnc2z6ensPo3ka9i?(5c$^-OVxoPR^eb&YnfuLevet zGNbl=6h!-NX+@uEogt{4W+~DCgreogE{<))QKDlP2mNig)>bZDsp05OLugrfG~5`m zLMz%oS*6sjrdqkR>=-N81Z2NcZG`Nx6Ghi^0%t_IilZf_i#pX@Ytk@C5&DQCspAL| z1TNq6eqb$vSn$e3we+R#EwzEQ(Sjm6Hl>W7VgT0NH0V$fo0ZP$9O~R-m&7suu#EJx0o^RnQb0eEvLQ?D zR_GC^!FB@DZsjl_cdu0Zwo-ig-{>s1m{OE}smN__vK0k24~3_FlbbGGNQ6PGvVvfz z9;B~nty6+9ajZ(ZtWs3-B6S86oyuL3FYA$ZFCjoG%Tz$Ro9Eb@lGjP}-i2K$`TkFE z){#U)gE9-2wN|h8=Wz{lL8(9NL~@h1jAWxS%bc|7rs3E(lm5foHh^SX| zsMg#hENmBQ_dS@gc?yOM)M75lq8q7dWssEdZ;U-@p(Sr;#y>aq{L3B1lGG}On(+}P zin}4M=(e%BF}hyDkM#bcGk0xj#v_c0(~DL2_?-sVj(=+%9(r-X!O3w!yKPc2p22&Y zo+~4zm_^!D+a^Xg(^fUMvzw9}_Od;1l@@zGpzjLA3aQHms{qxBVQ&YdO9b~ANUPGi z?JY<_-igubmFS?R?Oevg-U7_ag03=Hdt$FIa&eT?B@sH=|3~tr4vhjORnoA8Wd}2~ z=B+3jb!80sEVv0FWjxh&nj{AOSo!*>xNXoIYDpfP^IVfIS?|c$3xueNXBT0+1q=&Y zIn8=X>IVId!EV(J9kv%#CZdOBIfrdW)5_u#50}Nta^7wQksB%V#9q$;4hPF*+6_6H zst@s`EPe}9%3>RGqQq}%S*L0`O@f&mw%jmWiOmy+FYg|%baaxqB~v3O69JWo__I0* zc13kUcTO=rkGh*p1CKyqV(MTc!iLTPHFkHz@yRqd)Uoez)(k`t5>-WufNtEM#bgmc zIpdL-LeeFq~XB!cZjPM{p0) z>X&c}qXSpEW4E1&=*=Xo1n;&_C4}zuLfmzGEXo5-?Rj^jL~JFOB7%0)A-G~wgN?sL z)Gps1-;j-XrgJ08uw%^`wY7m$Hb4fJ8+dg*Z#x5yGRvIDOOdD=Vb90!Z3m0jtOPB8 z$n@rc7$-wVWtue_Gq^*T2Yz(Q%5%+hHO5W64WR0;6@%NolD6v>RY{?9cQ~}h+$w2e z^;P7pmVeeje=|@v>W#V}UPFRYe~g{Yy49sn^_A#J$3S5!rS_xiR%6Qm?A=e&TN!oJ zt`5#|_h zXfqzI+rgNT)p(vAzjGe|m#*=K^*ctmG|?+;rwWVqiRWx4SdYJl86ll9F`;XJ2;WTZ z7=WN#ciYTG<+e@Cr27FW2#GXsb}k?tnyxj_CO~ShZvpy_wDX^sG-|{BGJflifONQe z$3Sj5C-(;!j2QzHP3*YCaG48FElPAi{lG#aUToIdxv=$VufuWE)*jq+^`a@#+?WwN z?dmiX8GzhYt3{vlcqQ<(UK|HV>+Vi)=P-gz%et2oPEuZyAB6}EN0g-6fIz6pU%gHa zGVVS!BO>Fa$AFe3CM7vGa^VYGx}$l5Dv4Vn@faoP8SOKTv|`V&j77o3STqD1?4;>o z@e}UPF5KtcbSFA5!a&r;ba!J4rlw&if`+A0RfXhUPR&`@9s8US?v{`dW+d(p0D>b*t&!oU8leg5U+)+nE zx+dPu4N3ZCLv!>7R!Mxv5=L1;p#WYtRED>!wl6}GyNOrmptZL@=m6re$R)312E2&! z(!>rPhObNA+zxoTdb`aL({?$SDD4)O;u?|vBm;5ga;2nA2Bg#aIe-QZ;1E;`XsSG2 z3n(Ix18AK zl7^Ez%|E%To@n9C7%meN<|n)fb9`!0q(n4aw;SMn8H$^WhL;eR zWvk0p;;B@%vfZi7+*hG8&j+M3Hv-cBqYF3a$j%J->V-hjjJ;56Kcwg!nbQs>7nLQz zqtQ*TDeB78mLshcwHoM&F-Af)u9TcfYq@iAL(BbaKwU78uRd%$eHl7(?G%ocWqV2G zarYM!&FyCP1TX6@>1OP=Dr@l z>9Kl*XQZ+-Gqa%WtgcQ-&IbJorc%){s5i$vMOIkwb0HhON zRvd-K0a9oB5& z*|)P}P;)0b1~bNJZ^HVKO2p`hYVjFR6WvX^@x4Jxja&%kUAIOmt-SQd-v8H| z#=m0xe3^7R>|?AN+wq?^2f*X}hA+Dvzi+(6n%CmI3k^DBwRIhz%1$Hm_JGj8iFB*| zC3nYyd~1?Pdq-o-c6RELgcBV&@2AO=g}CmMQzGxQjwJ#pzq6o%X{0J9fg! ze!9&N3e3KyxBGFkW4ag4NOUNls}0WUhjMY>i;0mn0kJK=#R2F9%!T_~oE7_J#>8GZ zL!fd4Ma)yWW>?4%d8J9K0(7~g)wpSWtmS|>tM^;C1JY0;w{IiQp=VTkE zZai1E6qJ8H@$kc4__@DscF+(2RZ%h*#j1(bc2G5}QkSA1SkV>kB= zi0XL)amodq{*43f0it`ul4%4SjrUYqb z{{>T+j>}$ z&;(^m(t2jwlt@}^`COoB82O8Uba|b#A@vCuP}Z6IHvs8^{C5HAf_$4vV?bG7+-e7; zulybbbfeT2?n_tC;#5E@CG8?WI`^7tp3ViN;p?@4^ffFVRIj0GzVxL~`f($_5{^h+ zg)F7UW&>!|ROhw_lT&ZfRPILSZlxktLMN6D-kgq}rhy$qQf#DHQYNz)9aEp1bN8aF z-1nCDa^n7iu)7$L8`McT8_;;A3msn6&(|pNg^9eQ>G7eG>w9waIiy8?rek7Cla7fgrKP$$ zCI(aPD2#Z*QwpU`xw*&0@IWGG=OyvM<*)|crO|zn`L@Fokgzv0u`iN4JzF#+ zt!E;2dm2(PIBCCB2}py3hnqs#9gpFwWe3VyS~t9axjwx&kw@aru2-%rORyg5%)1h4 zLOioL@aS7y{JDT*OX&`DSRGE=;Xuoz?53j`jVE#w2O4xPQf?g3)RDoEx1=B(g~)EH z%#87-iM+!f9rSoU#c-aZ39k_W1Zrico#;cv`K&oft4k4a0}O6W~SqfpCykHkO>ckFm|NRH?%tJ)%;U zl{fg|#XmU|$SWBRe|y2o41Z7Ki|o2$DGn%Zq7ecccj427z&3!UnP~Dbqqu1&zBCTm zC3nn!aoW=?Y|Y}(67(Wzrv^?bwGu1Sd>)^wgSd+l#o<|Qj17x51;q$2M-dQ>c&{qQ zC!rJIQ6gyd)hLrvY>bOz2^*^uI>Gmrse2rOwj{lK+%@@L`an8HT?J^B*!V|)bb*s) zrfK^C>G<&;Aij>_w>}26Rv?Z-I)3mq7KKIu(h71OAf*@&NGUL)1VJw4%n`*MXS@y+ zFD9Vy^wWj!wYdY@7Pt|#{2Vl zh2`d#0lZG&F96=zRsJELbnGhcivg}9upvM}c+i%|X9p7Sn&*v)4YjB(uG130%ldhf zas#<`ZXgfa98%MZ-1O4-0=cEZ_kdaHlorM&&EYv5uiLScC2EDkaonunw7@I(x(`Z) zly_26-a*RiDJicb1xI2eQ9X~89Vsb0kn%uE$^$0TEwXVx68}a)v)K14xJL~|aFdGN zGnlY0rJJCoK=#_eQvY}*AoYE20iUU(C;O!1JEA?Iv+-TOQ1=B zGzd4_K-U^*wSo9UHj4L61N{il)xzaBfPRkofZuurP_?8bJn(AdYdi6SxM{5tC!9e| zchE?y$I8>K-KIYr0Q`30oOqHib-$}8+5z*)+i5g926y$u?v~q}v?q8;9{nU7fJ09} zUnm#O4L^3r8^!#~L`h?n7H(Ustcvbjo`n}evKt16@p9$pR=cD%aEk;LGhb_e&79G6 z3J1+f+iAorVFv=6SQzefaKL{d2Q-p}1=T!j0x#X&WcsgXBJm49;A0#Dg>yh~QWRbc zdu3&|o%tH>D~_V#VYDjGwMQR-r!wB0GBNsNJM$wP3x>5{EfHsSb|mvJNWm-5D^J5g zPLhnXji$y2oE{my3ulhC9L$tNJPbR}wPXLuIF-!VAyd)V(pyt%o}>+U`U-b>lRPC$BMv7+!aon2mqv*U3@FDU)~<%5BYpjOs9B_!bWc zrbL~S1;VDAa&oQ4(2=s7d|z||hQu6OCJuEt6QL2o3|SYHQ_aw0kDoOh)pck8vf<`T zv*Ed?mJJ`=h07_I0n)dAzYa*>`u#Sb{nEqy z7?8KRinVBO?Yz^RB`J7G4;1S^m&j(+$#%)pjpx%+4qkzRvpNOsSYOv4&D2i&RAn_* zCJlBBo9x;q(vw1)r>8B+ELU#guw`;3J2^`Evbwv}8^0pR$3<|Gib1ARHM&vvg3bCH z-6+C6_(F^f%NeVoZRNu7YDXH<-KvBlXQ=I z%Q_tDVsU$#=lg8&c2rQ0dhw2U&I)R-_R%Rm(WLZQIbB%wc&-MtLTdRMKstB+4?sG1 z{s|!Ucpf!r&jM1P<^Uk|bKWu#wt&~+i}7jP`Ec3+p020k+*aKME^Mt+5O$#Xa+C?) z;CK{AX7=ROHqLWB+UNrDW{aC>=El;HlNF;QnF;IeO8BXTG-;ug;&8%}r8>owT``!8 z<8an)Oxh{XaUOD0lQO)aM*9jNHPu!?YO03~)Q$V6J&a7qM_`oW8(q?|NXn>ADWf%o z`#F*-+YsaeLa+YFR*|Jr%v{MED-Ds`>D-2R4Akol_0-PPb8vpF$;`aPXmW>$R*TRx za;M>&lM=aWfqVNbad?fKl3H{mRF7cV>Ux>VEGmsI!bphrhe_cJQ5+!?nqx13Q#tsO z_CfekY4gy-5V``UT`F5`0b+;KevFkbc=LNS%Fg>;ujJ%DzPQwm-{?jeu~8R$T4ml5 z!vH*~*p^$Re4-h1P=+W=FgcN=IkD`f(?7))-8weMN;JnJIl`fpZyU;400;=-;7=XH z?ttn#?z|1i-9zL?i|{%!h5^2{c^3Di;>FEGWTLa=iQ%+u5`zlZq%%oQFy58PAU9%3 z-43TEMu;Wd3egv@jzS1;pH@$joZ=1a2pU0#zLX_4DYrJ3sd9{M_6&i3&}{74TWX}Z z&PcISyJPpYpzi0fjcd|dJScmcmW~LVf>;FKrm~okN>RanDnbu{QoM z0@8Wo20+>kYz3r^pJSgw-86pLNI4K#+Kca{9Z!=M&NfsfZAiix$#V)KT`r9>35f$5 zUX}LF9EP{H8WCJ{qSxc-r8b;XiW7(t+KH4juRLRF+@EE`D?ywK$A#j(XpE!bI8JbK z2fJPVvDTq>3}=Zn6}E%g zrALv%4aHf#-hsH`_~jX)UH);&;k!w0`0jw+)Q&w_pPaJt63&8MO>k*3u()ttE;Z*zBOsX4#Pz1ZgSvM2ldy05^oGEbUZAk9l%L|G;Oqj zz6eM=1x_;(r!QboOz$Jnom~%ep;SMXvfQ;2-r*s;>C?U}LzL?XOgyg7l_SCRRL`-^ zwK4zbL*J6ZM66y4Gg9(?VAK6bqW|Bt2Xl~TR*sX6ZEnHYC5LgiMcj{ol_@w0%Sly0 z5u!9#)~B6JD>h+yq6$C~oJ+e>CE1N~mWL{gh>N2vhM{o1D3#5kkl`3BrgCltXIJpn zv|Ckk>t{LSR--=xNR9piAT{gTfb@7-&IQz%LjkF0Uvg=7;68-Un%=H!`ol0B-f`-s zgB$xGpE?PtRUg@zbO6tgBRh}n1RjipMP7wX8VtRl6;3o838~b7J{yqw&)h_#{__+- z>OWr&Nd4z)0IC062S|r)4V-rIu5Mxn4=kp80d@6+L;h;76Tw)yb838Wa^v|IV&4>B z>vRN=*55K59g3I0W0z#NhMkrQXI}&d=*GjS1zVk~r@c=TAmv@8aEn2!Jg~BTEC{8Fv%gNp6M+Tg?X5+CQMcCUmRkCAf0Uf4&)YI3Eal-7jMLj``SK*yEkHvDTON26(fe1! zCHtZa?AU)6tV6OLUxWjt5RXUHE;%e3*mk@u6-S(B`4}ToilBCUZ3cwJiPbM*bE$9h zPK(XTv*Ft2Q{hfp{)qwx({USKbeCX1TSpEp2hAzYj0*?sm* zuoQVLndte#{0RiL{OOFw6xs3Xb8EK*wsDWH)+Bl(D)S+V30XyEY<8!(r^7mbks=Rl z!_fto=As5l4aL~%KA=YbzRce2E;D_=>IRclO1T_%Ra?bEtJfNZ)v)rhN2F%y;rxL| zGr4)cC?pFWo8>sXSp};YcY-x;FIWdfNUu}Qz&1A}zSg&~8Rv@F&)XfXwXx}+vY!1+ z>KQ{bsO`)WwrYB^l2vOi*t{XKLp;2w6e`+03s{)T+MMD_J;sV2&Nc-ic8B9_dzDBV z;WoTDzp?po{+d8-zxbJ@?Pp{mGYwg$$oRzp4a@sf)mu<4H%xQbv zj|4=C$^vCO@wTZvZyz?cL(+M|+&VljbM%25NWzOH!}&7=FZZ7{JU7&TA4ft!r_MqM zX|mW2ja@gykx{j<6>J(h-(!myWPw0O<&OAs}~RoEF)>LGsf$5j!)y zLSZ{!S%T@#d5?z z%F90Hgs5((v;!fHj(Cjl=^H*aAUz%9E3d_<6xP+*2I@wp=-C&^u9UxqGuq)uqxunnl|2QorJQ@wVkG|z`*=05}4Q=8ND;S|7iP!BQ5?$L^&rR zLs`Sd#As5bVs9q)0;?jE$PxTL0Pu78@>MB|1EJFwc%HU*dhh#zWn5KV-&)DKfO=8M zv)xf4aI!Vu&N|=B`tgd3JMkZ(=P{vXjNa|NEF9SMW#sEk{#h$319_Q&yoTJzIV}~% zwL&1kpZ?YtBu}apolm6l4tr|4F<&M$n7pA}k`9mOx|{l4x;-frC~P<^J&yFO8gfWP z8yIua3i1U&<7F${OMt#2oyS?QgjS1N48%=AT0x!$Y0NX=j-?5ndkMxE)yt-slg zI)4*iB;2{~SL`k1wcd0G_X_%#@<6VJJ`B+url%Xh2-lF+n2 zg3R2xmzj9MOo2y{Ni+xAhuavz<* zkF%OS%7~tfCt@D-wFoDmr^A7-XrsGv%Wuc4jI3H#`*06HOVboAtqUM@=%De#N6XQp zEYBBi?kMNFHi;Q8eJ+^0s+HU4wn^>eEF>;Lp4otI6Nr<-O#)pDXoEmE1JbU~0i<1D zvWn0zgh@r?m5^wA5Gd&~@j#}wDY--N2>1L`h>|NN4CGnPz+8NfVZHv*fqbK2vpu+U zb3NYO#WdXrO)H{$>o_fn?=}WIK!Y8d?q`6%PUj~9S})qs3JP6jpjCj>MqdJ?y0ekE zx@+-E^!&%dBRQVFMp6*UkdbzY>yagXMFL|y!q7g#d}{o{3(TT3 zjx0PH*mMHgV*B_VY~qoU50{?{MlBM@Vv(TN)u4&~7L>=n!ubF>>ydr`3fsk3y*+ezPRvs)wfLOr8@fJ~Fx9 zAH`1};rKupXEF|R=B=_UR@jc{4!%2=)nOb1f<5|Kd;do+T19+-T`_upc>l){2G>cD z3sxD}wGy8emEhouQiJepPSdpdj1FKWTa}iiRSzA3(FAiZ2YRhbw3dd3egf!A(zdwM zR|7(BO~68embE)5+bG-oNQt%LVwQPyAU-QUjb^cGG$KwPs_cMfSbS)*J{5!<`Q~KT z#_|y30!eM4Y#%0-tt=bQt3Yj&aDqA(@*_bw8T*JGe`q(01>I6%*=Cuf>bukI{P~MB z>({uQKlc=&^DoMXjBhAv%-%eu^bi-~FayEQSKwzRrWV3GKusFF+jgAC_=H=96h)4J zIfG}9%mnh&_Ng;HUl8^+p(CaZyHN z7S0zg#Hr~W{27X=#ZnTxrj%OiejyyK=*0*LVnCWj7ey-{9%q=xL5}sSxbdc|Jms*dgU@XSLTJAb0ABF)Pwb@I`zBITr+0)|nOOkM&ky19z@Tk>E&k_kL9F^4nA$ zoqn6DqwC+Ms_5>AsS>|Pg`cnL>PM-(U#{|go2rAuY2vr3@MB2HzfFbuh!6&sZA_s@ z@CB7ayF;@cA51cg?z8Gx>pdE^2>a|K!q=ys_I4S*bh*iq?kYApt& zJ3oI6NUPv40BOZ*Gf+2cN@;8Fjgljm>3kS6IwFWNtJWKz8^>VJ?a&GcV$H|z;)JR8z*yXa}S3q}~Lr|3na z{;@B#V=S12rYl*yw*vvYl!irowEw)ELkAZ+c3@|@L=PM9`_Z8UqG6i&6 z+NV3MO$ReC%nWRJ3MrIpIL27)ddAknjSnM9_GsZJ^^Ud|K*+#``$)L)1s8);1qP%? z3kLSLN8$sDA|-oP-cW%Y2a{hP?kiqQ1^aNuH1Cr5xamwE!E~G~JgHbD9sL}{v}3T* zBrFOOeGJjh#&;}Bqh3%?jBJyFk+}a-J64Q6SWLvEOsVFS#jFba{$<~=TMTfqa~aA< zR4D8gNf`q$6!)eG1s-?p6;z!6d8@ZYpxYZMJsX#T7If2q2}1; zG%F(F2H)S^EA0js(VM282RJ3^JiyPP+bnj^1l0af&jVx;7168GR2VB?eV zCIj2>`*M7!UQEQfqPW88&r+ElaW1V4FBpW*`qGM$-3@)>y!-6J%C6^nU5jK#**XE$d_W86+3e<>3AVQn+Ld zegX;mtT8!E`UxcbFj*JBf#jitZ2asXqGtcqjyK0-X9D~lm4m;6w2W1571gcw*0CA7 z<#v0_UTH2wa6I+!1gl_JbH~%_z_tTn2fgld9WzkOa^N3=)9w*x&Tbs|7ubesFjuAt zx@85s$ka@9i*#2qw~FZR7jb1$e>Z84dCDrRX`F=W?Z6a2~#=+*Y7*elZ6tWcVGOB{;`Nv^2_9Z$S-4-yq%p1WLFdcjF7x?N!z7 zV{Yq6(v2w84L@X5nxvbyKy)_4ureb04TfIf_=-85bVJpqWie%)Lj_ZH!%tNtE0>Yw zv$DqcilBzYaFTbu3)dzSJLW7)p=>};;cKRqk>j^=#${PKW3pI1tcm<^ulEdaUxg-G#^P~`Q?u=*vLS9l5b0N{KgIAp}71Mm9Sa8rmh9|)$&6V2ZG zRFe7t%D_jaLI8TjoI|1C_nte|}A$KOpB3NZ`6a7nIA$%Xt6L!l5U za+IQn%JiwBQixQHo}mhMBN^+fR$7HfF*HHpnv&Z#y~}4P6e7h4rO3;+^2Qx!<;@s) zxc|X^`})>rRg;SSv3L0mwL+vGCDbFS*OLRSKC{HIhKk=5H`hQ6{wWoChgdxB)fN9j zzM@{LH~Gvq6bg}IvQnHpz&bhF-#U3=j&<^^e%8t3vaOTH zoNze*;Lv80@_jAuLh-vbQ6X}Pbjo+OhmQLIL!l5UW++8|j+Ku*^O0vh^2{GI`0${E zxzhP^_0_wMGaM8mhdIiDov&-1D8= zk?M;*=5xHEP>2-uz2-C6P$@*J6^VRY3tWs;?;2t#6e7h0ho{fcIl-?0NN~c#8~3vr(VNM4hk`cTLiPvLtzp*cl)OKi+z8}v=;i(N978VyH~yuK_QCpCCMe7YNAJi z`*1_05UK9zl8RgFyz2x*r4XsU*(FtSUMCtVg-G>XrCOO~twg2IS=i6YnV}vBwpvrx{9xNcoCVc2iEDGZYGu;`L4x$(_^bhC(4y{7ESC zq;pDGoFcJ-9g@bI3+P?JWBP;qaIZ5AM}^3-T`&th6gJ+!NfJJ+4+Zk&@M)xA+njj7(akswIiM-=DR$ z({zms-QG3Eh@ud=Tp+pWz|hxB@{&EIv4%<^QeCK2NlkgQmkI9U4243ZnAnNp)Fg`Y z4TVCauzRGqz)&beifKZDIZiinecsS0M4Br#7j}RXRUk3Bf>yDiP>2-Oo#aZ^eY~Mi zh!nL#k%#DBFnWp=TzIk-9Cwlx%*eOIvrDQ_tVUX)f`FF0`dHTQk}6b*$w49JutYEm z0m((|MoD7duu7motSQ!+{3yMEpXYS1>pOV}u{bgT#V=ySw!bHJ(Rni6l`Y(aF z2mSW~QTR6m8VLw)3Mf7Y=+6RiguPO@WZz-+^X0xY=u5s_x1_`ZK_GaSW(-9wg{b3= zqDFGrGP>qn7aFT5M2hvDC`NhcxL;%_6e7hYr5K!T4PJ=|&LI zSjmHFSG>Qayn)Hf;|n2NZmBsaU-G6&)McbjUOH1~|ScHwQJ(NZC5`Aen1WHkHB{`$;no#PHoqMBr= z6e1O0iqEu04$ZQL{w>=&?vMQtiIDbgd6cw=;&Z%Lh~vFd66+59dskO^>`Aea$CtGs zA%{XN1?5YgeAnB%y5jr1@Etw`bJpdmZ4uC^)mzeWkoGcuxL29cUm;??s62-Ev2t$7 zI+(DVWsw(kPw--jcanEK(~U-l?17GF>5BRH?}OF8q5}SNwmU zVnX5DX% z@!j9aiAkPuhD}xqF)JU2sGcL$ml!IANR_Qr!!xbn;|5s%ok+r!98QWDDuqaOoKOu< zau`U(CpvJm&`uB>rVrR;EX`3m3zmZp(Y`Uho;5t*CTXxfh$< zOS;Z|gfA~Q+sYj`(8`@L;Bd~t?E1ddS(RWW7ptM#fgM6x!0ve5``$q7X-7= zLm~DQBgrKKW$8>#T)>0!*-WEwflPxj>IczUTnNjwa-Q}1Z^lFg|I+t1A&}?hyxZ|y%4-Yz=d+@mWfz<=LvD$ni$$unS zZI+QlAxbh=FjK5nVu=Db*#52rK#unr8w=95HATPZk9e~2IMHOJ_o5NWO#%vBx=@6`MTNoGs9S)hJ^ zngsG^=RzAQWKphllIY7@$Akx=qV5ur%@S(l>IC(PGPL=X@p(WwT{BSRq9^Vuq z&8>pD$V1_4%+{TfMiIZPG5~S-V7R3VkB56Y$Qt~Dx~C*!&!E;}E4k0)o4m|0*H}j( z=KD3lECysQX8moG_4fp#b$%pJwzia_;%OwHm2S`m0m$t`d_LMujQ0bfagBF?#(P+> zv+FR$%JXIaCjy!Y171Zk_fkAEaw!1)M7SM8ANdPK1jz!I9dB0~{S~7Aj|yg;heh3Y zND|GyQ=m@m?FL`o@EnXC$63S23^{!K!MuHe=G2G=`zI}p5rCdC(tM5l-Rl}7jY5>> zDZwoCP>B7Uk!HU@S&24h8r~CPQ#`hw6Nm$bmPOX}KHuN`Cub!$zq38|xGN>CtPq9x zjpUO&-?}l0qRNP^5Gh{mM3L;bRT~P0NO7Rs~I|QiW99zQZ}s^Nt(2fF9H%J*WtP(iW)RPksdg=izCAl7k75_QFU zg7O9?FOM&6l*m7kgYqR$?!Wb}uK1P;-wauu9e~x@{#c#GD(#HK>g>B7Iqr*%)(TOt z$;u(kwI7#6wZu>kO4bq?#dA;yk(Qy3B@863){#g2VJEKiq4n;ieF2 z<_Kn;heAuulOzt0h?Jo)I}MNfe8W%7vIf9G8Srqb1AirmSf+_t<#oaWN!EQyrBH7q zQ3y!ZwSrklR9?icmn2HkAW%Y*eKHLCxA^Wgoj@h2KF1IDa&hoYA+WGk2%oMxoLwFn z?$;af6e8tKLOJ}5e%1+f+18+iL#;uWQV+@)WF;1W5ZDDKJK3bgWT8Wn^?Z^68cYrf zF^5|OvyiB~i0w!c4RD7*2?M;W2AG}c!z?#>@K3gYiv)6oz{C2IFdB}f;GA&*E9YSi z3CzJ0Hp@gXWpt9XjYe99$mbs6liUH1N2+(NFcb=r;+sm5)<{@oylbVQQixRFRjMwA zh{+xq?yC%?LZtkmQYOvk^O7iTFcb=r;sK@Tn`!l(pIPa3c{7u!ZZcE~k?Ikl(m<{F z&Xz~Pr;110D#YfY6vV2*zjt-T`w8WZ{(i*YvaDf$9B2)Casay4{*s4B%>iDiS@#s; z0I$@BV%+Q0XfBM>GyU_62-#i4|*Bb5$k^7$n zvzl0x{=em`FP>@TNrwHAAu`6^r4ul;o-m`k3_mm(dR`1Ut~VJf#0=jR%tAiq#Y{hz zBzAcJ5UA6-w;v&gQC1$-qX%JqUVE z0s5jU((Jp`mwlf97^dN;8@ay$a__p;$gL2w8!4F8L}6K+DPMhO`#MF0y^WB>+-w*r zL`G)|WqL4tA<^CIHbbQlsm2Ob-Vkh(n3a!>62q(^7`cx-IH10NwMUoUaxNAcKD{%k z`rK}~D@5+&1+&m&MC^%@#OhNnkXGc%M8)wB@%bLX&@BU7>UNufN!i_DvQvoJ*}^e- z=snBJ8uvR5g+ip5)+5ChL!l5U(9BV%)6G0CDW5MHDuqaOrBLZ6om}Hwkcf3sTPE9R zt>7`8FYkKSmkmdS$gx^53q2HKFOnphc8Ne~LCRlACGLyI`vvm>fi z26w%X{ime-zG|oyBK0Pr?s)~^F2NzAf+TMD7;XxYTU;=!iN%8Xs(kfbfDKZ9Oy)76 zcPH~iNUZ?hGI`v;T>&ZvTbUQ=Q~FH#=& z`j#=4Ld@nx!K@|*jr2QJ<|LmL^kod;zBvpBaH595i5fB{?;!Cm<%fHH+ptuKEU^F& z?KK7@Rx%WPs(7r93el)aLB7djWLLc3Qr^JimF`~OyS9}i(-{Hf3 zR^N<7bfFa{q0DMn%KUf1BO{w1?)5!m1%*g+L@+zm!VXDh!{l(MwUEmRSV+pIe_?H9 zfz6f*ggPiyo$B=w9A96-*+N9(orM^iuFd^SDEycB%B>vc&fNe$}$0pm)YQDcLo{FISnP>|`wxvZ6{0mugret>VT$08(G~n~uOAt13Xxk#FzY-N zN_&YUvHDa9lnB_keQSa5wB(92+9SsO$0iGfn8i%tB5RN{5>=j062ZPI!6Bn^ez?~I zhMPj9xk4~IHQV`;OrdK8V*OeyP})jqog})WK|R~(&!uH%75j><0VykepT|S*QY6UZ zqEnQm!pe1jQ$zo^dvv%zXtYp>q$`DVc#wOIhgx~>XNlCNnd+Rs%JO-DRJ z=v@tkLZrA))y=~WD~zdq5SZZQQBg(3r8yO%IhBf7r{Leay5j#m<9Qqc6(qpJnwQ)Ayjf*<^y2=^F-~5^S=}OR8FrK@5G*QX$%5hhP>Gl^3yhOAp7g$A|US}!-j(2T0xhq8a=Olyld8dRiT(ZXv zl|rQYO_x;3c|BpM6e88DN|iK@d$oyK{lZWvM2dsG=JQKKr4Xt9EL8f|2xt1K6C<{T zM9k_v!9|kkgb4r2a8-z0-xkb5KIX-8`aqIcPDcgOa?;l#*0G#^D%~}y`HP<@`E#tL z{;pO-<^aXJc9_f+BKar6KfRbHdnC9w8!ClJl_4HoI@Os;R4s-|AyV}fs)YIQUQ*J$ zGSz&?3oaRYeJ$aghO0v4I#4hR`Ir~YH&l{nzTpBTo3FlG^O3r{>l}1O8RBKvfj&b9 zr&@t#FI~KJ*~+ECnpF#G>Z6O6E$xnlq)#_|_(ozfpPtAj7^>xIRP*O849;7=eBSEd z(wddQB{fU0jn;MIbk4=0%ZzxX4bg?ArGirg<0SPVNaLAFd_=c1`GVP9FP=}Zii|4P z(?$Gcg2hh!0x5)^D2RWdV6j9e3Pj3t1p<(AQ6DH?C5l%;@hVmPpH^+WWJA?hJ30$$ zGF-A`*@8~Fu;O}GPX@f$`pN4d5f|CG|3oW zJ6*)XDmhf9-Fvn+Gwq~%GRK~Dztrg7Bw{s0moHj+Z7{lQS#Zg+rO8b^nWMtLHMY1n z%@&<;6De;Rs{4AOV(Bh#TpC?;T}@TZ^5x5x|I=Dl8!f*fS|+6F0z$-Idz1&$A6=Ziv=g_Zjpu9jVJrnzGUBXI<*WjH+h-J926?IsLTDoYGb7 z>3hC0)Dy-~{6W(U>E8Iuxfxav41OpO_5QIy^frDZ(4u9ir#17gvpgWE--A+3toh5A zEv{J_tY5zDx~D4o)IANJu;BCsME0cjieWo$A$o@{HYKvxl*k@|nDf&D1p#$m zv($9G=hOqnG$X_-Mu>ezi2X*07X@PVen}u!@0SJYfw_5fwaMjoLc_{8OCYMM5QiiT zjPsV%1eeacuII|^F0J>~K5cy_OmvmffX4(RFn z29eP}L<^SI-vwf6eJW5fpbmjb0c8jm8xY$}hE+*GpgDki0#yU*BTyY6zd-eXuq_4@ zs{myQ1fbjNej|54a9RH9_;y8djTv-@3O4%9s`>L8Y9>rT9htu<8f>VEvNLrPYv(Om z(mAzeS*@4YRUTd%`>O%SB~wYYvH>j@i2dCvfvD#Kff(56p$~)# z==DoIrH;vWVDTnj6y;^fjE!obD3$!&gKshBJz31_r6=FF8k`3V4wdH%FK&?-Qm7YM-r`t`7}&m@tlJNsNHPidcv1WL8f7bL9|PkXk{#e!E2yi$Qa zyM0=WyblTou(CGezi?^ek|kz2hN=Jd>*uCls*tQ{s%ZkTDoqzC2&hsZn(9)4XsQ_k zu`10Js1(pFfowo?1gZpdnLq$KUHttqb>6S*7Uy>cry&I=xsSRLjXp60Pe53#mM6=j z3nolhbY1~b0R1~`t#6pp@Kok+X1uO&=y92QsJFrFUKz;4*?*5;>PtDPwso@Y%-P_UE+t%O4+uOmhPR*LZ{ry9{LxV#s zD*m^T`6=?4fO$Zr!*LBN9f@leWNk8@o5;%l+|0VFrUW?KJ5(oArH-pBYPGKj0c;$}-q*>l zMu4w_pTDhxjg7OTv!9P0iQwyP<7i*q!QM}e= zUPY%)wx`KZJY*l-3dsfu9`ATs$9$CNrjGo8%(zK$c7l3a1Cb32wWoz-Dq3`A@6-!6{DF$#c1ZB6nA5)DGb@Y7%sK*`D!Pvt) zlydA-&)xgV*3@wy;Z~@qyddU%Nvr?z{S4Xc;o1K(!zBF78=p1~nQ(>*=Do9yr}4VqSYKO!5Z#}`~n zZ+Yn(m{48=c|CzX--91zl;xFcbTVgFwx%uvf1C|jP-a?i*h%Gt;ZrWHjO1IZv}ftf zC>URuhKzEHjNmR^1}ZE-n1a*g)ZS=nkTE?~8h1(l|U;s3r@$+xd*&(fPweRPJ5 z8sQpb1aB)F=RqLSaK<&p&ldd8^R21L$TYrA*8;cx_xVP1fYGEmq&N3==m)vG;~L}+ z?`E6MojhT#H*jFEZ*OuM@bkitOZ@`nzgjQkSFbLdh_goE|8}$u0fvg ze!A&Ay&8M_`v1oZp#YQ7dTY?MvZK9(>}W63n_V!vKz1Rx2HC;8`lhoBfaF~1rvywM za=_MD3cLLvli|n)r42zAOkbKf?8L)`k{^20DgjLeN4u?y0OBKYvG>k zx*fb4goNT}6#e`I{X_jt<_=urvP13@Oh$~xJ;2I1qe9*#p ze5e*O^bH-_-~aCy@L&pq!y6dPG#QLDQs2);HpHMq4Z}i*8e++z=G{xHBs4V`GMZX? zOR^CA03}(1YfuvSOb7QQ4_TvUSu6@X$u;$HTQE)i+-DAFntO%{qolTB}t=w}$fZ=EO-e1Jq2DRtHxm90dWuC_&FO)nlH>uiWY z*7V{LdLb_!)04IQ1P1MWdb8e%&fvEP*I;VE+tV^@0$_uw(ca%TIK3C3xCoz;hZjtpsUDAwk+v=#p`x`=rs8uUCtDjp~zES^~(mFnnm=)zY$_ zL%mL&y3qaA zbYObkx%+#EG$dbCNarZ=(YmAM}It;cKaM-q5{er#l zm1)=i@`;K6^%#=6iuq0Uk!M;6w?Y-=QH56|tt!%LKow~SMJeBge6-rfI>9No^jK{1@Xcd)UN}5@R^Kmic26e_cp0`Uk5$omb!PBESFXQ1FDlZT@cnZ?1jEI-cF&eemo2vNl!z@m}NGi0dmAh_7~fv}IS=a%U$9$z@-S>cptpG9SNJ=wAEMz(to8V;P2yJ*4FUfDZ(cJs5gKKil5 zftr78omw9^ujJrWYjUXH{)F3m3-!3~wQz8&mq(V=E`G$p&ijY;FYk#f4zFuyexd#C zJqOlwsOIF>;E2WPW3#Ts9e7@(_Rf=c`sEotz1Ev&H{LJUdHKNP9_^aFPkei@L-T!C zIv0!Fa>Kts{~ew9y+g(vC;i%dD4zOpii1@t*$h)%MPThZ;9K zmoKG3luz4Q-zy&0t+czywcbjLema6+V~K(y+1a z<7^eG3~P9%L~xbxt+CA~t-Q1K>5FR>E_?_Y!SBBnuhRT_z1Elf-&MZ0=$ZZNlaDG- zZuq)eWA3vgazG)M;pZlBewW&P_by1foV!DhVJVe14{9|$x%`=NaqUOF?3AgB)@$5Zu6+nu2IIPA?786b?4vWE1XRtV z>lVZ3VRY9fj%OG5ePz|+v2%$-1rI#E`DcfeP7B@CB8zj%Fj8@A9EeQ?|O05lrw&= zYdMeK^X(amUdcFQK<6^;%dPkQJfO><;q&unTC#V#eVYS^t@my4-o=kQOX4zAv#;IZ z>3|_$J%h5GcPtdV?oHMbzuTU%+7o?Z>4-a}OO#9Knq$jD!|`IDN}g?0;B$vJ@7&f7 z=+5=)%Rlo9vJQ4WJ8;)8@5HZ(Dyn~cwXhDi0redDk0yPKRJGVc7(jvX6ispajss^hFnZ#z!h z-ZEFG*;{Wm`m?`-KA8}N9VcS?T26 zYZjF2ZXY+$X~mPmv%2R^;JOSgj?d1YwbavjeFGz%H@BR_>-c)1W&d77atAhz)HR-R zY0pC5Z+`qweP6EG?6=o_>$>y%;19QF*>`n)n7?tO0>!R%tzRvB_ZC@NrIc9w)3!*x zF*zD>|MMl=&Gb2*KP!(P&~121VEM{eS5#{TWs&U zrGA{z^Sb*8>n5S~Z(96*mcw@F!nW}RmR;QHP}TEHrs=Tvft zhHI0ea*tV<&oQCO{lKUT@s-}yI9|djQ+Vd5Pdi^R8`7j!O^@Ss`Ml%xiwewpwtMmT zP26v%nQr{v$*WI~YtgpHN2mOo9eUJy_p?REDyhfo!qkSVyUu@lrR4LhBd(iUUf_>U zr>rg!@!;{s?@L=8FX`4R4DXy@ zHRJw#{)F%TWc9iIsLT2G-E8vmm}^h|c3f#Ck^F8;kGA_E_KHop< z`S~}pSkp$umj~aTuqWZhvXb4$zKCpY)zQN#*skj6{q_T1Tz78dY1#79<=d+>*Xp`& zd~h<~{xZ{vT;+#b&HG=s*J!`=$@0Pxr+B=vy=(0E^%`kE@lpS|mBtS3dh27yqn3rE zMi~73;){64)!aFCZXKVzjcXrHIU2I0*!ZH?19vVx-{RB7)N%gSuhe|2i9O#|{IK{_ z)&)(ARJd|~cK(SL#m4@soi`;*%Nfm&lyc5kCsWgli)(%eE^PU5%n}i{yrYB-tK5%)_i43+}BXPeZ`2W8zN8K%lYfApV`4lAAKy&=6jK& z>7rN&t8P~6U z+q*kc3Og3GI@-DPyvsb^joJv z+NJZE!;1!A>OJ?vE%(&C_I=0B4n5l<;>(^KhsKOMm+z8m^MRr6EyVoh@g5J#)N;_q z`(HYb)V-NJecnHis-ohWWJB4?=W2E+5~$=8uoB z8J}3yy7H)teqFQIPyLwZooD)vb*>?wJ{@uwfp3a-dmEuq(( zn9e_Q+pd_stWBuxl$teWKegCD|KjMq$6r*OlDA>UTo%r+ij69t>=0Yv>HIFOOGJ+@ z*=YBDv#T*}*R@_A@3?q;)syW4TuOZ}>tgp~SCOkQKXKbP_+F z9ZIgzxn%PJ7r*xyf4GWYl`TyVKEAs0AOF{x22U*bwBo%lXMQ)Bw&MA@hWz*v{v*`8 z{n@IGb9l{JGJAa4c0HbC`2Dd-o{6dBq~=X4vf=Qf&EGe!xOlGApuu~G7S44(Wk9J> zJ9r-7OV_{g(Q0YY<^!FZjE-tnKfS&#H4D_*RW`9`P}A5o3+?lq;qfNLcI=x!&ym&- zew8Zp@YL`#eEyZpWOg?5^G^5Iw)p(J|Io&ZgNhH2TU7kw{-TFIlufzQvE;A7@3*T= z%kU+kh;>M=VzG_mo4PLfmSbM={4M%j%#o#evY+3U{EaJ5Xct>}=C+1?t*ho9+kVQ+ zu%lhNhp*0FvB$QOd_Us%GgtKgd~(NwT8=I&8$5rQtKZPd;pRJz^>|n7MT?<hPye(o`ObhzPrB9}WnXbZ*3F}j4>trQnzt%fC&-7#<8|2|k@1U< z?aDQ&>wLqt;ORn3!)lEU|5^8Jjj2=4*YvL2>Q&8Jre`>U-B>9t6zNXdObh! zy3B68HF>yosc(Eg%sA+K)Vcn)rpgzZ%8Ii|=QbpY0x+?aNCm zK3*dam43b7VDG}~)BU=+Tf1NRYnIVJTmHp&c+OGOvlAxm_V@VC^U9ZaGVqV9^C|9||3nTepW+o0`FVn0 zhXovWd)9JoyND?vUhhxEo$WLG{g?s?(bdc=&u(9-?3F&BmfAmkv3|o<*G=_~H;Or8 z*0N_@fp0~fPFC`@ZQrw+zweVDeJfp^6_fM2*VhxR^A?Ee`_0>FnZZ6?3Mlf(LsgI ze(AxFYtf!7D$cY^`P1~|VV@i8bGYz%!|TM)-vx417+UP|JlBJz=GSpOwsZZTrkf{5 z)n2oR^BPU`np-#8bjBQe=(xW$9uU428e>}sYapOv_e$4p` zXKn6(EOv&&lHuhlcuZ_RiSNg~UPr|r=;qXw_b>d=%h8AWtewg0&97tmV}8B#tZIe_ zOAm~C-Mr6^`|m@BW#T@zKQ=r|?2|G)sQsHn^OEb%^6RAX9{p1mkM_yV$CY1~rGCtP z_)9cgyXY4MAr{Cx6Yidm4Zu`ZO?XYA-A{*U#2hL^Fp zU*x`f*ZUElBQ}Q2AK8)ji$A}3n4IL;`sufOeE;LufvNYuBc5yH*Ts&odRXPc!{-CW zPrjb(St1(+?Fmc$h(R{dLr3QO+j06y zu{WI#8gy^-N6a78x@;jA-v2DRi)WL|J#cf0J2Y>wS-{+Vt9{>gS@z~Nzkc(qmTg6j z1D5e$9=!bi?{s$X18;r9SkpWf$u`D}T(53sYkgw;tpDG)oHd zYLjj84SwEwye`gd-lRIVWgLn|W!miY_FUNUu-Li%w({%sQb|b%9(mrmI&)pN!Bd-W z4Gympo0#dq)gk;m!^el8=PrgFdONZF>B9W_W!3A=o*u(aR(TaaCA>?sF}3*h%eOvL z?6W<3ljr;Mb0`u}AW_sKev<^;G4Tn~Mw#c^<~cWnIMDkHb9Pbxu7ly29D2 z?r9R8Z|{e9#S^yI>CgMauS?GwmIsVE7W24dT<6TW{Kl2wbx3{wUf$zFeq0=OXPU41 z(Z0Sjp4eM`U+}8d<;uDH-urN&$GGEnUk~fy8}_2e*WWsu!^5gq$^4?>vMX!XRUc-b zzjeM#!`BYHwY>hft4-gvEfpIQmgEuf$N5X1W_Lp##&qrM^kS8d`{C$ez8Pl*6o1sS z|B1v>@4r|@T?uYlnC}l8He{$CzOU-s)eXzOs4=l!SH2(eapaGeWUpFk^!q-A`D4DF z*ZoDF66LIFTP{kyePcV9Z4F|~Kk_FB8pW<^^~aG2So z=a-PlE{)Fc?OitqAIveSVxEVm9$Z=9ETI*T_jU4#)^Tm?H{$ve-QT<~eDuMI`6F^f zetA&t71zhOo$fuZ-HdBo$M55dT-o2Ldc+{kOCAo)LrYW>0vOva!+Z z{Q44&Hl4q*w|zIei>6zwwAa%lmb1(Bb*N+WshNbLzm6rsv~hc)z%w z-#2YoJ0iNmuWsCj-}CJbhU6kwe)rsZ-K&&+tiJK-Jg?t}-+nW!1%F?W^Y}f-`TZ8p ztmQrh7QVK~KL3*arJf9SJNazQ`w8ExSG7M|;(e|0Q+XXy-_K1jbc-IjSp1#pRj&rk zD;{oA^LFim2UkxjGn(^X&3IlTX_kBay!-NcW+-pFu*}PvcOvUO*k0h}@V5zBY`51r zbgn^-%^8dG?U7{%w3=3bMVanr-fZ*Eb+TNSF4ry3uDyJ_Nz&F) zyDsUtj^C%=&UJiy{?qp=ti7?N&EI%#36-O(wC?G?qIb`UcgF4e__zL^DiEFFwM*dL zf{iBhFOqro10Mg$*Ljy8PR(rhw>&s+(X8OClX?^#_qX^l^>c@B+IwyI6ORQs^W0h& z{>_vrYb%-@q(} zHgPs*3gmOOtJSyD&_SQwY@G|$vKkRSXn|ASKO>Lsnzb{i&WK#G!PW0=&R$^t%)j-I z`~A)5-?o>{Xn$_nld|ppE&jjN@o#nE{?BV|EYhshw~)W}({DkYo8|ZS_WXbChmTqL zU*QLuIV(EY5Jsy19!E(jw_|bE6+YfU;yeRd4 z!{>9wEbmS_)z3fj-{Q?4aB;)nzGwU|@5qx-o4gT{dcN^I>gO3dHqV6lZMXF7GU(@( zbuCiQAI|&R{Nmf^PQTW?r~aGSzx8W+kIrT*rE8TpJNJ8?^_I(} zd+*o$+c-^WIKjhxQ2#pr#yh*o=Ww=Nfjj?=H=yUSMP`;UKL5t+ylh+jYOW9F{~K?5 z_>8vgAC8Uu8*j2pP`pR4#IyW3@9G;I)ZesGYBN_B3fvz-bpMe88 z03ZG_=;4z!vhj~GaTGWibk?E%LqaWs`T-BN81(S(BhUfYf9jIIcL9|#2R=J((3>+( zq0@)%XgTn!^ag!jvV@48Uo`qh%Yo1881$`RNp1n{%>uO?_(Ziqzl$s(j`M_7$yyHl zyM#ecem@-BkFex5S`KVA=&O?@S;N7)4_p1$}#BglBA$gYh!lLHI7633?nY{a?6tS zW;}k$nSF(gYKfMuJ#yAems~~dV|5{)soy&T4iE)1@rx0?WHqg3yR=lm{ z6ee2?@EeubOmm8)gHseaY0sZx$gw6%$V<1^rir#c@W)dIeJRG7K5==HmIHq$XV5=_ zCAnGMi}|SKz#b~c{h5DK87&7~40`z2CzyTjhq#lXrk?W_$bmlx0ZvNLBr;i2b4nuz z{u&D^71CmJc`b+76R))EQx-Y!ZxJwSAJx2QVH}6fF-zp|eP?mNz&T|#bF7@gi8#8h zsxgPo4bnx@pW-AHIBr}k`JVi-hRln4RZ!x1M~|FaUgK2}InZAiQJr)g+<42Zotc$s4|I*lt#%YM0v}@QX9h}C<8Ag^+ zA1{YBVej)O*%Mj zkpt%?sP4Rx&lYLpz!}h>hcg0<#qhb7!?m3D$RQhW{@lFNkWl4#(LTE&hg>+~mP@(+ zAt#X398!AX1@jBMHpU$#C#%#Paw_^)4!9Wfy~q;wors)^-fH8(tT5pJF9PSHo!L+= zrxSAE|9^qwdZpkBEvGYb(jL<;$bn-5G>1nKPqlHnk}dz1yC-ts{08;$SZklCjnfS| z`N&I81x^>G8?&dac}mAMl?P~ktt3%aCC*-&vc$e&KIf2q6c!IKd`0D zf<0uspl8N$ypfakeD*<(Iaz|bMtmI;^UxPL2C{@^UBAicSq0CicOQbi^5moW*2>x|v zZC|(4*_cC*nZPvY8ZxybnSU^AuMyJ{TYdzsf_c$t{o|7YR)L+R3S^)((iLyM=fVGa_Yj8 z+?u=^Mh-Kn5-%nedFoU8e*qIPOIlheVOf}HxWBscSAm+iE1 zU{)CPobyj}HxqL;Djl3@>EJ{ohv(jW-$OTTe`3-RXL>r~kW-OSUZ!)OnGQ}Ya`>EY z-aq1sw$HPaIHqejI~|-k3deMx=OPFGTR0b4OPqPXxbgX&9>?Y(2aaJdvnI~5=rUJx ztecOV5@bn2=_a&)e9)Lfj~fe+vy2e(k+tdt+mH^*xk|kjA_u%64!kzFK;uO&9gL23 zE)T~Q&~g?l9P8+czl}MxKTD9)h%BKO_U-N}$4uIvrN|)%FXVI_xMIW-qyEr1%a8;0 zgFeT(|1oj=S&kfXB0+T8E7LL*uL_TgdAhWC^*ae5$oe%OR-} z4xCwl6CX8aqn5K4Ih`1%Mb5M2WDY$uzRp~S9GE-Me2-pzq~)w9TMYWnWC>oUk3F{0 zayB3*Gg(4gUL`h3%OPDPahkxA+&YhZv{lR5gq&<-310ui7>a2*n~_tSEFl}OBhM~q zIa`ne=K*L7#(SRDa)>?YPuiSq>ELWf4&($as??r0TCW7M#h|Z4l7e~WW>|mKm_z3n zT-C_y4S20P!Dt@Rxv>*Dw@IA5WX$D~@GJB{K{&Tg_r z_0n?4DVA{ZusH6SZWYvW_9~onSAKpCy^A#jI8~zUr!DXvWAp%2swOA_Y4~HTFW_%96oy9CZ?07h)r?!o?(0Uz54)3$+d3XXjuy@fJ8dc#&*ayXY`LHk2? zU8A|0JMc@pWTXC2&KZRR=Qu6rtimaDw%T)J4(;z?Siq9pyqn)0Y}{wspDVCcZvjhkGtEhXt@<*I zGw*!oSK2sNk@Jo$VU&989@$mPxrUqpjMFo!9I=#RO8aviIU$T=6_9hJmh%sCpuf;e z&z~D)i$M=(1Q@Tqwu8w*OM20{aT7Uk+=a1#@w%ZIuUp8;OO~JxA02nZI1cUe?R0SN zAZHLUf^%4c#kzaiICqg#jBwz5nQ!SRcP)p=NM5jyLc6r|U@a}@KG|Z>L!E(FbKVqB zE$0DpDv~ASWnVE5xlESzp?N(-PCLfwV_T10c&6q&LJk}+q1|uL!A8q@Otu*G#mJJR zrmJT^W}=q!1UY3Gr_}bAAGDmO$nk(Bxm7QlL@v-$_vaaM@T!BX&3+X0R?B&g9DlNe zmf`8Uj#|zOvc;h1oKt^-=W01Gk<*+kA+M@yceT)R$gV=-^SpPTFzc zNceAYNNB==XAsbzkIRp5(e~#Za#}LZ#NhLlw4C?I@gvKOgc!*aKvV<11 zA$gTH&PTGvpeGXxTW_c9eYKoV$f-v@?=kynZ2voJ29NIm>cC{%Mpu?elNsaIaS( zeYP9Np`1U+f$@a4_*Pi5mID^@Q#$ht7u}@g=#j&{OkY1|Ku+4nX9IGel5jj+vpsMQ z&5%9^p}A*7j`6tDt8(M#DVdOym&70|x{xjgLQg%WnUS-cY=<%1K4dXDy`<)3K@MDL z11G4O*JLdxD{^4|fS2iWceZqJvLgqM@z8>g%(|=fGDFTyvV<|)c&*P|Ehk4h;=sEt z2E7*;kv8zsagt){+;br(nk*r=kYo18j5%~H@LhHBdS;8b^F4FnGbH1&$b)hC9NY1( zrLS=uIuGF!7xFlk5SLWjm_xntA%~AUycd~Q<7JMV(_{(9jf5G$)@bKXekBf^-_4EU zP_F_C2d)o|Ike9Ok;9L5w><`#m_LP(6HAuRIy`T;$T%+=r*Jyr6hV#^ixXBRH#uOZ z9s2BhaY`bGALnxT+NmyXBz?zZ&8|8qGBaRw`6puB|fioy=9O=ga5oeqRnV~_JX^=e% z5)k6=F8~o4@~4fv!}W@az!5}6Y&1w?4bq(p5pPLt+Hy8bfph z>87ar&B!2}Ak_#GfH`1TvW+ z4+OG@A$j$@^3ND@S#a{Qiss@>>K@v2`WexJ4A-zNvdCh2Ej|9?{ zAs+>@fFU0QlERQodcLRRgcBWU_JT8*A&vrB$dD-lImi%N!%Ze@2>f?=k7}xl35^TYWV1l-F=T{5a*${Dv_Vy`natFY zaY_l*G=_K!WGzD`3M5&He9L6ymqr{yAgyQt+8d~R2Ax+E|4`qsPzE8=$|oc=c(5;p z5b5YkkRTt4z?!8J2aswSq?QJ0q(RzfkdYcBo*}J8?uQuCMj$sCa#$dL7!ofKyMoY9 zovyDy+A?IiKtdQoXXaazRgGnwV4+%Pq@s1ctU)ptqV7F~sx(8Q1yYY8)cuP|cW=ho zDO8IY(orD08S+FRHyQF+AlVAj{yZ0m6GL7Iq!&Y82_%{!F9mXlA#Violp(JLQj|UY zeJ7AQ40$V%Aci~@$V`Sj6UZ@!Oc2N;hR}*-CD(>}nwHTrQ&IZBRj6t)Bv2rp45=%S zaE8nf$U25luUsa*E-=o0p?brReger_jCYP7GplNljtq$vszFAa-ueP2-De7pjy-qS zpdelWp}m9r9qg$;cR$WJZH3oQhLqKFj#F`}87(*i8A7X3!eoCoGENntDqe!dX(td5 zhMW*cEJHpCAm16{CJ={Gw1-Co62_2!1hR`E z*+qSRG9-sU>RITp71Q$?Mlht5Ku$5Fq(HKl)?uq45I2TY6v#q`6cosJh7=Y^=Q28M zMFkSikP-rU%#aKMu`7!r-8dcZb0|aTC_9;~a{}Xd2$jK-#xWC-J2NDwKsGbPLLiyT z>97?NNEkzk2;>Pvt_m;b@>DfmAX6Da`&{2-pYJfvSfO&LK;uwVBa^Bq#u+M9cNsEJ zAdM>0IGF_Ul_9nQsZ@z_^5}V;n=wQ$kO2(&BUH;6q7$404EZfM_Zad+AiByrY(E83 zjv?O!(wHG%1=5otUIH1-knaLn!H@`nBr=57u%pQu-eR14LRGK|?corC)Mp69$$%UC zG31s&E;1xhATCvD92)w6km5qMmLcy2 z=Lth{2~KNk8mE)stYb)5fmm0goR$I!WJqU$Y-C8dKrS+bRzA>VI4wSQA zAi)e-Cy;#%86^;dBURBl!>eU_4v72aj8jOcjxuDKK>9mT`cZ)tcc#b&fox{T1%cG6 zNjX~tvW+3D1!7x^a+V0BFGEHOWC25H7Sl~;k<2(2LiM{gjhsawZY~rlERZt{SuT(U zbtvbUKz1`^qd*GPrJRcbiDbxDfjnf$8i6!*rK++5iDpO{ffTAoImHCBf+0l(;!vM* ziVI{3L$V8`Py@;-B9Q3}Ss{=t4JqfiKt?iTlR$1TnmfKj?F1DOd!h{GF%{;T2RhOf{>{~8hm~L+82SW zX2@WHyk^K!fjG9LssaMp&ybt~x!sC#%mw1xnj)40+0Bp&0;$=Ca;gesCqt|SQn)SU zG!aNJL&5~IogwoC@|htE1!CKd##t$loebF_knarHC6LDLsp_;q7BJ+zK<+W*ra+3i zQPpRG1TiF|o{z<1hU6AVes`+MCy@3G$uE#dhFA*ZB16gvuZkULoQeWj!;oqM$?icp z^#sy}A)x{}!jSm_$<&dm773&tL(T|fHbV-C9wsxSlHj!LMC0rh$Xtf}63A(WloN3Z zb*8HPg0qkzdj#^7A!h~R(uJzZi#QV*vR7~}GbEQlK6Rz48UpF(Ns%~#d|=2vfz<6r zISvBZ#gP31$=IE8Dhni>AqNC77L^^L*QIMuj>Le$Y>1`qe0>nB*;I= zxBpP;MI#d=D46~T4S~UnAOrnFjXC81#smHP86%c0TeEX8`F#YkA+wGkHnxls!x3k$ zfzvAGI5KFeK$r%#>%mo=1E*e$V+Z|!mPBsUi${jb z7m9EWT=YsbiZZ|k$&)o%r zGocQNn!q{yU~$V(pG;s~cm z#0GYQMB<*vIW~MZ5QwM-%m~cO36l6oZgAO35k7k*0_^YPW+2fihi4%W8+(%JX|mm% zb8PHcAc5eyn}pGoCpU~!11Jm04W1+;BF<<6v4y<=j>N@zWO3w|2=vg8+}@KL#uQA9z{xu&*$(?W#<8(ub3-6}NOkZ;8ad+J)R`k>uFw|F5gtZ2 zmm^|tf=*B`KB$o#abQzS2TyWnUaZTy5*%UuqxsV~P%&tY$xV$sfFn2)^cmUWbzh62YTiU);{?!z-4V ztHilrJx9ctj^YT4V6lWFHZbepnwKJEMQ83!Yq(SguO5&-i}@o|;>b3V@UhRf4s28{ zID(Jig_EHP`^^)(8$15uQbr6$npNAn?UOY-Koy?_RoM z91&-kq8t&UQ=B70m0ciw`mPWNm#q~D-wSecgj4W4rdTm?b(#Y?)Nry& zNAa=~DxO!A@cPD7$WgrPg^K4TRaJax4UwaG)zIWsM|gQM6>=0W2gS?7C+wS4O=2qK zC|-^luLr^_fvJ$AcsVIv4~EXHELE?V3OS0GGph2Cv@?*~nj;4{({GwU9W3FbOd4_& zubPV2`g|7GrK&4aAxH75g{o{MB6#h!sN^hF)0ql6imEoM;K)f=1>20{gS!I4d> z3I;$VoenvQS3@N)sNogiRg0;Rqj)t^yr70s<;7IUQM?)}UKgB?<-RSv#xWIg6t53fvJ$Ac(qWx4%Cb&BE23n6>=1>mZ*Xw0C@fAv~aUjHSI+p(vYKgwNkv+ zUJ3J(s!-N!3KALXP6)fhxEHgw|~9u{G6&*8!$Nj^fo(@hV)T z<7lZW5J+PoNAc>U$!nGH>dREfQM@`UUdw+SFCkTLmZ*7pm0uMpRacn`If|F3k{8U4>%yxRyi`USauly_ir1^zgI-J3BBnx);?-U8 zf^$kk;q{xTkfV6Pt8eN#MXD;nlXudPqj>cYD%cL^lv%>djj52MczFvIKc`652&O`g z;^m{stC8?p$yCTuynGceI9E#51*Srd;^ik)Jg?cp>lafYNAdC(DxQ~ARqPLu$nOXM zNAU_kmGN=oqws3aRLD`hdMaKQ>b>%ms`*TX9L1{_sw_!A;Ogtl7pu$m!s{MWAxH7* zt$5v9c_WWhxxot(q#;M~>VqodD?O~$2?C_j**$Wf}%PpDv&YhRtaRjS;W3OR~b zuuyTYDZ*MvA$MoHCLrb3S5H9)AiS5x72nW>PYc!dZRc-{H_z)Pxhp%96D zcL_L(*Fd3y?NGxx!mA2XAxH5F6)K*WRCQn~~%rb3S5HB{r( zLU>(fD�$!xXO~gRgItsy|GH9K~z6P(cPTUP;2MQW#+5_qc(hc#RM$7_Wi*s??LJ zo=k-t#cQNcLDWG#CvG5P$T+lT9DBNrb3S5HC6G7Px+i8Rfb`p)#;FoV>+tfybOEFkLJ}Kq$=NV0+EIs#cKwtjH@A4t(XcqifSgRjH@A4 zQpPifR_B;F%OuW5tbzndvX%K|VQ0z*46}j#7=;sN&T) zaL11Qo*uAUG8J+ZuQ{kPu7>oQ%v8uxRC7^fTn(v8W-8<;s(Gm5bK_-9!c?is2XBdx zh8#sTA60yA9BR_nCt1u5H>N_4QjGymX_Auav3=OobdJueBPl*21eVQz1w3TBmp=_aa4sI#cQkL1+QZV3$MmZg&f6eo9ad0<&-La zrb3S5wO#Roc^ECc#xoUi6t4u;i{vF$>zE2Tiq{TQ@z)%Bj9Fo6a`j#7<%sNypU-Widq$xMYD#cRLf1*6xjndh46aFRLD`hj%vK5s(1wLH*yrOV?qTC zI1{}TUT#c<9L4LnP#K7-P2H~KPt-C|3tbdbAxH5#A@TxMv5ZY>O4V_uLXP5fQt`Td z^Lk^c(nnHLHi;CCstG1)0%7v+r zqj+5sDu|o(=-sBb!mAfkAxH7LEL1RF>zyv|k*Xz3g&f7}3aW||1*oRDP3S3ASC|Sp zidTx__3=(@oK)qUOahUH9L4J@s`z-hUL0?bszywO9L4LJ;$>;>yj!Y9G8J+Zuj|5# ztmqO3wy5(|)G&dmkfV70qj=T(-fX5+Jzy&2C|);E1<%^RYwg4Kg`NqoJW~in8gdk` zn~K*+w=>~V)tsr2qj=pCUNByzy%ueks_{&P9L4Ll;#Dxbe1cRRU@GJ&UUyK%$7}lT z`L(6$8&e@i@w%&cZCReJvQ*hm#bW4?qj=pDDqz5~n+c+Z!Ayl5#p}LMK{X~lo|HkV z<}ej<6t4%Uf;pdo+?tkaw$fF29bhWtC|(a0FYBUHc1qPxrb3S5^$1njm=}DuN2;8o z2uvDs6xCx?Wg*+hiY|D|z8g|Cl&O%TsGbNFL@gfrWQ|lEWGdt+s;8*R0TR-n@^wWu z{xB7ClxjQ^DyTfXGa^;hr(q}^aul!ULdCsi2(KPYg&f7}g;0SPeBMT?rZE+A6t9;; z1zz6UhP}Nny!J8`aulyuLIqy%*#oJ%$5hBsyk4UU_7s>=8LQ=7)=zk4jwTRk$WgrB zC|kd2=Sfu)rb3RQdWR~=37Xxc509j(4^tsWQN2eM zf8{o=;JpU1BCjZ>LXMKx2UNj~0zY^kR;so!6>=1>kEr5%%D%FDpGeg;rb3RQ`h=>? z#D}ct`jq-4XL`oRLD_O-%({;4XMgIomK-mis}cdcr{8r{beRq9hnL_is~n- z_)&Cs_VN4aZx@5h9Hv5!QjK4z;?=nQd_ZNXy1`V)QM`VmidO@UqEc0I2F(jOis}!l z_-mCLYHThhRenr`97P4Yu>7?1?x_zKOVwtkLXM(>Zygx)#(T^knWDs6_ zPmwC;nKUotC|(9s@oK=HB2~kg3OR}@BdUz&hEydo6>=0+CRFjcVMq29sWOYDJw%S8 z%8V*LH~JR15K%=`qb*Y*N2x{@RPniCzGBg3sXES7$WgqqqKa1o=7v<&nninv97UB4 zRc2%}S<$&)ymwxzwlNiQ6jgT7Lx{UCI$)$!*~|uvye1ADMP-I6{@ejx-;k;`Oobe! z8aad)RDZF1eKV=Do`Y68U5;r$BSEuvsHjzD$K2#VbFmc;&;EyLOVQ zbxegErSb((#pisHvNpY?NLF7hN0}RCQDr=%zG&tKa+DrgqRRLT zJ4Vb6*Tpn1ykB>ziexI}C|>1J#m^~lhLx%_OobdpRRLATXIQB!xP^knR7MpaueU4nb&;y9 zOGzNokfV52K^3nCoMENPdnt-^$Wc^PQ3c0C$ZgK0$mvqGpQ(_esH{-M&y@)?J5H3U zQp>0pauk)dqJlH5R1Ie;k8myo_M2_NRukk7=KIs&}RLD`h zYA9atTu-XbG8J+ZF9%e?+<=x+dw!n^!mGeaiXunxa#XzF9UrL*U@GJ&UQVd8AVFas z4!6D%CRIC_3OS0Gv*Oimq02_8${I&|h#bYMrpODt_Dn48Dpg&W3OR~bEyb(kBj;$T zTF+F-QM_skFX+vZJcT<|6gB+KRLD`hTof<(w3t-2Sw-_gj^b4ZRTgA3=1> z`oasM#*c0DYMj`=o-h@16t4z~SMBlr2T4`+)ewn%{|h*ZS3^|sBO4qyJcQQ}rb3S5 z)kyKmwKtbRs?IVMaulz|sDkS#Xs1@%1euAsQFaYQk)wDuQM|@wUDr>l#xfOh6tAYJ zg7Y$r*TMM9ou%qFQz1w3YNmLV{9@fvs$AC69wJBaYK|&?PU(05=T)g%$W+Ktyjmz; zD>JShB~?F|3OR~bOW_5*(SK?jP)O9U%R1Ua^{W5gmr}KwsgR?1xuc5D`GZA|SX~wS zSD8)J3pt8c2gU1h{zGi_}Y1_06=0 z$WgpH2^IGmE4(H%6>=1>&O!xV@QDSfdd5`9QM|gK3dW19=+5+XY&BGPHQ56GIvsKp zuda$$pCv^rO4V|vLXP6)i7I|o3D?+C^^>WPqo}%}%J>>vsyc6_Jw%S8>W(U?1hj7b zw+2epKBhvBqVhsjaiSnAI=2;h*9;WZD6$PAk?(&2N2x{+RPn3I!5c;{l&T1(LXP6) zjVfLZxW<;M_e_NxMdgDk<7!Bi_jcMtnE4p2!``4uZqY5q?m=0+AgbU!L}=BIjvgsheV7V4iYf?I#-l7%^Oy=bN;UeS%6OEe z>IzdKNAU_q6`YCSwSd^hKPgqdQIN@1dig>U-8;LsBZ?Ta%L*zC|(0l#q)xz zFE8Qc%~Z%yyh0Q&kEY}1OVwDWLXP4!P^cgSI6FiLucb_d9K|bCsNgu2>&@e%Qgw`} zkfV4FLY48JGDLViV=Ck*USWz?pXB#%q^iVj=r#E+8E_P@!KmUjgimAM5?*bY3OS0` z5XB3ARY0otF%@zYuc1N(eQ8*J>F7k^RbdZcIvsKpuVF$3H7xgW%?+uV&s4}!yoRHS zUlDnBcl{$(IrgHJ4mpa~2*s;x`PY}EY7A2$NAVhoDhm=6dgyDdHkfV5wMO9&zSLTTG z*`(?yQz1w38mD;Gs+_f=R5=}>UdU0r#-j@6Jk&6$Ci>Ln{*mAT2Ht?{vsfye6T_f@~%$I^FWuExQZVnM8od=V^eWcuiKk zHWw{DT&g}MqDY4v#cK+xpigj|hfgd>RnbFKg&ajS6;&DOX59kwq+U|hfT@t9sG?A1 zK~!W#H~HAOf(G$SDv+s=qvSOWRs8$~&wQn7Hd7%-@rp*3@!4Fe4l)&T6jcnW;JmCS zH~6lZRJ~v-?V1HTzlAxEjk zOjPk|obEhoic}3|D�$v8XbxhE%O&DtS*U_{VaSTEfA#P_QgxZBkfW$(ql%x2 z!bU9cl&b7UAUpDJp1@JwcbJ1JvcNX9k5xyiGJa1AIf~a@RPpP>(5;`FloxwSP3DCh zrH1oR#cSBA#*}?hwVkPuqj=3nm2nNF%IYZXH*yr!0#v~$!`>2Q?{ZwK)-V-v6xBlE z1#zDrbB&j(D#rjLzhVg-MYRZ3a6BX{I`~9TGf|Crrb3QVjm4vLFhw zqAOjp#lc)6uU$-q9K~yu;&pgoU{$HAaFPTf4LOQeJgSUmuT;%qDt)u`gf!@a)2 z-J~jW67@okqFN(VzQz1w3+ALHM7WR~I;dOUD0l@%s=6~3a+GT9LRAhD6e|DS^1u_RTFq3*QM`5w z74!zKMeRi8-!T<(6t6u(1zuCn>`sy@i?a}k9Fc*ec*(QKimTb%2xC4P@C9P~>Nh_q43kkg?gx*365CWlu1PEYA zC?OC^Xrb3Y=plq2ddv5obI;73J9DS(N|yg0Pv&98dgu3^bI-YD?sTnMBr0YMUw5<0 zyIt0*zle$%L-iL{QC-op<=Asi)T&J$Q@=7}sP18vGXiv+eCxsE+_+jr#f%Zxy+&N~ zPCjifty(53W(;5VvC2CFXw@o@s}eF}sP1Q#v;CsyaB9_DQ88nv{>mz61QYt@UQV#ZKC!YZe2yt3t%?`YNVCska`7^=UqYA9CYOW8rwcD{B) zHycYu#f*`SM_J`$qp^D0##;56sF*Q)J;tha;D<^{SBq&?;VJxtg&9NjIIF1jlB)Sf zS1;A7k443dp?ZQ1r{p`pL7(7c<6Q+q0~q zn4D!3u4V6D8#6`;pJUa|kl;(%snfQ3;d^e|*yK57i5a7W&l@FtqiK^PwCX>iV#e_G z0;{~^p;kTmyz<42q53}@{Rz^7`{GqOGtKU-aFX!wZHgc#>nAEta5TlSEp;$siI=W@bw>7QLm)s z#IHKm+SK)Rm#COAe0^;AqWfXB>WtTvEoKZ~pRj5xtfmp*?As3gl~!e6S1M)# zS6^+bRhR!$`C`WK^`+q}b>3OO*Q!NtDHSt@udi4|t(O+Mw|!N&zQ+Gc{mP8t>ubZ; zySE*6vR0igDrO8{->}L%gT2P}^}MKnAdRylo{p1`A3e-#xohObpv<Do~W2He67YR?^aK%&J`6ihH7eSX=skE zRqu+586)%Suxf26@TII}ztvCGs=ePMOL(pxF-ALFmsL(XB<2#XWp6uV#wg)>ta8SA zx=QCTw{4svzL+sexIU|#5}tk9S%bCeUQsb)_}YL~G#*kZAG~2v*HG8jH=<(3@U@}g z>(Z-+Kd)7zKA<>p{}(ZauZ>(^_)_*!uKGZ&>i&>LWy~19Ha2{{bKuqYYSr&PQYvN) zUz@Osa!9_W)-P?=s<;26RLmH@HZ^?xs`azWv}(ssl!_U{*JiA8#tj-=?atIxh354GgU%nj1q2X zl0A}VGKU)vkL4mf7%2U_)#sF*Q)l^ebmzBcLz zt(x?eDj_q5uN@3uS3dEZN44q}Q88n*-W^#*vj$q0T)+8nrSgu4%oruyiB(j~q?}%{ z#rxa4Eoz6a$x>MvGe!w_HcB{XkJe4Ksvs(63}3sj%9-2n9r3QOyF|r|p&G`jbx;l} z;gI_;K3n_R=o=~@?*AgjQ0>Yp+9#sr+$%?apj8KpiWx(-8>?uXr-hE{Z|9cqR#7oy zWaIm;3SY`-FF>m%eaoiGm@#|}cU6wBEnQ#Fi;5Y;*Y2*0e6@6a{f<_3{#W^8#_*ML zRgSMMTwjBD>x8QxAtu zxLm8Q5EV0quWDE2#I>gDYqOQqNY0GmYlN%97miD-el99z3|}>@a(c?Wqu$>CSFSHy zutNnXW5)0`((pxFbFDf{RLmH@MzPA!O9mihH5mcoSyR2)fYaYRi}%J8AG)P ztDJrKZ@xZ!f>v#|it@#bq51)eRYb88N=7!t_oku=z3ADI$<^Ciy6aLt*df;t>yZ#_*MPRpjfU z!hDrO8{b*yq)RO+O|*IC>3b-t*WF?@|Nd{K+isvFl-zL+t5)w9amqO|Ja zwUmk(L)E}4r$wFp<64O zj_pu>@I@Bd$E9TtsA!BK##D`Gm2-CBiyy3p^9asXaUbzTjHzm5mEG48@kNZOnh>En zRaC^7s)?-HgyX>V`s?npsV?F5QbJ;&qGXhJGdYP><@iqd`e^oTv$X0(Q4s?bzjL#E z3CSkAD#}6iMO)maRiBB97?q)#^^Lml*qOq1wt@{Om-^cTQ4wQ$pX#dcrR<{{@83nM z7K(}(Gtz0S+8qii%@(KZcaK(`A}V4`U(;Dd`3XjPgQ$oxeeL6_$k&?(Zn2m4wfY7s z8^oBtX1FTy_4>52S7_CCq9O(=PkWxpDtjBtLPhPF7*jQiRn&87x$n%5Ioj7^@kNYT z!r82{*Vmb%BF0qBVU=^#`r?az@Q(I%m8gh;%F{CEvTA#jj`H=^WBi|~SvvG>3h%rleAgkobQ@ z=4_kZf{I!cF{Y}ORZd@iyX>q>bqUwoSY?A4Q#GGe*huiw{59R>?c{KnsE9FD3s|+D zs5<9w_(!d}UR1=Gsy0>)5!Lr!yyz!d^`xkXF;xe%Y70>vurDv1;mgjyDeFJhqbw8KtT*+7u-K^RX#wjE3 zjoN0O_O;=rDoezezIqH_=3HX9sEC2e(^CqpviFojprZOB##HsPYBd#p*`tr%bB!+H zIpT{LQ?)3<*R|q{7*n;FRYT!xu=u05zpLeOQ4wRRmaxj%5}mg1JDwc=TS`cbs>2O7 z({0bRvoyl{_o1Tv5M!zijZlpj6*0tF z!>V1Opwevc^-V~O6W6JtBF6M}EUWCJ#C4(~1}aa_J&slO`uY|sYMI2Cs^cS66+@JY z7*llutH>fP7tbBy$@~JSXd%W_{e)FVVjY!IEl$t9SbPy zY`iQbBnGOco*sudg;h=o)vrzoKM`NVn7&SBl|38dwp7_5##Egap=uHpF=h!*XO+E# z$3sO6Ge%rzuu6~UL^*LiE-GeJ|Dx4c&U8yic3akcxlyY&+DiE%1|_6k$r{`TZm2FQ zyZRxmdPr2nnAtd+Ra9TJyu9U~Fcor2c*NGq7cr*l99E$jxyOq1D0&N2lqX_L)z4Wq z3hSI!rB$DaiWpOMZiK3J8|8}_Q*~a1>J(8C1C?iFJD*i)l#n7H+;Cn85o&oADq4tv z%F}u;V3oaXY`(2h5o7wg(D3z}8xF+TSjX3Xq9VqO>ldtYjx2pL>{-uV$!Ve@##CLz zDtqSdfQrgaj9J2qS(U~*ilK4P(yT7whC@|c#5lgxL841oMdLialX)pdy?(N5w%&t8MU1JslvQhs3jf36TBB9 z`rlLaMU1Js(oh|=(bu@E1nfaGQMU1Js z&Q;-yuN{6ZDq^5gBO7mJuV>ZvP*6L_w&%wap_YxdQ*DD7)7S4=WzWWLq9Vpr-QcPm z5879qsE9FDH?qo}jX9zs##G&8s6M%5r7N_rf~bgr%9D*{u8Jc693fbqlNPW7J)uBF0qxfmKd6%rWX&Q4wRR{%ELfy6}$Q5TTaOL`96L zy46q(-93G?R&Bh!Y8%9us@q%@zWCZ{U z<0KpTt)4%O2(=VMMU3g|ZdN(jFx%mEq9Vpr{e@NbcKDX4h%r_7u*%7X*$#*9pyDFN zRNd>U@TKgyqaVMC2(@HIMGRD)Y~07H24H0Ow^z1|)vEJEMU3g|epWfz_;THe$7> ziXlJHs-KFA7}M7ita7qp?ti@?Dq>94ldReeew?$;+Se|-s1g!ms-9w%la0;a`o~PI zS}ZDJ%($Lr)i8-`)STPT(5gp7MU3g|8CE%Qnd8QLq9VprJN!?9 zahc=Bj-n#QR6Xyi@Wt2WCy9y}Q}qI?oVd)^n-di=rt0smD%g4t6BRM0>P1#Laha|6 zY*7(os$Ozc_~MIenW%^{RsUd>J+8+^MU1I>*;NJOdPh{mn5tJ;WshssT~#d;1C^(L zy~?Uxq#eGo)e_Ivd>2s>WBPiHRZd)HJ8TpcF{bKuR@vKOv#5wMRd2A$iOXzku`ZuebxXdkVN>s#{s&`mLB^->8TAUU+K~%(;s&`!#vE~-GNmRs` zs`p$KzWCxgR#e15rnW5)F#R?(J-h~xi$^1rmNeMCi!>FZ-wIdPf2vPV?J zn5s`$W$%@zi;5Ui^(m{IxXfO8t*D4GRiC*keDT%t)1o5ARDI4WCoZ#BekdwpOw|{x zviHh0hpWsJW2(Mnl@piQE4LRFF{bJ(SA{RWxW`59VYc2gMMaFM`qouB9<;BUMMaFM`Y)@TY?!V01yK=Ws%W@ac@U|v%9oAR zcUPGw1}aZB2C*t7+33CUvSW1#cM}ycrmvM) zBF0p$&MJF0)=R1SBF0p$!K!kUCzy?$L`96LTGLepv(YFjVxaP5V=Y$gB-vQf{EcU} z+$<_$OkZoW%E`t_lZJWDavmuvVocRKtg??A=ZT6KQ?)Lu$|W1-xbb^Y5o4;>GgRiW zuO~%C3{;+Mtj{WE-{F7*F5jOBwR|orVoYBfu*%7X*;6*JP_;~qsoIcL_O?+iDq>94 zMyx8AY?wV|x~PaTRU5miVB6>w6){kGvat!Pc7QL6;rRn1$I~IoUXS z%=_DF)m5S*##C*_s&W{|7g-!%cZ!M_Q?HD-XW;Y9iFKZk4KKVoYD94~*DkEGXX6S{5o4-`vC5u}yF^8dsoIrQ<<@MxC@NyixOQU|PV;arzr6k){~94?yM@e#&w;jh%r?uR~4+~k3>ZbRGwO{ zU{!@=7ud$KAd z8zWUVh%r@rxhltl_BBRS#F(nRSygV$#*v~T##Gh1s$e$m6BRK~d9sma)sH0`>yP@O zXX`L>l!}WO(^nmnl+aW2zciRc_73 z)E}r45@V_+xT;__t`-$BP-yHQ7}K zvvHNEh%r@DSXFM##@C`EM%kRVm-0^a>DZy~c%lT`ajxhbvc^4YIvU)^DJo)=ozqP_ z%?lRx)Ks&bX>4c7cKi>|p9`VL)Gb<4IkzL%F}5??)ShdZo69bolWp(Km1VkmyK~Li z_V%*c+RF64b<@Yz&C5(m?}vX@;h*!|e`h9iwiPmk1>L!9OJ)K73W@TW7WapKYCs@(XjB#o0nnz7w8OnaTO)g>8j2xO94-v2}InMlM1{ zaK$_nEiTz6fjIp4K3@MBA^r_h~WN`-exPx0%-*Zw@I~X1tG}l2L^_<|9`t^WELqrJ2s$ z;*6>hk0*|xf=yTd|1_)u_yQK_hiNJ#F(lW1w02G5LHuL7Ay`GxfdQ-MP+!TYlGI(Bq68`fh%)5VkT= zv4fV#aRoQG3b(aox(d?kxUX_e>u%s%>#4nFRoq~|tF4=38n56E(yhuI?+|xSPOWvzjRB;PY00(cF!-iJP#SOQ=20+(rCm9U&8_(~ z4P2RhdUM@NGhMlEaX=%v=eO4G+#$WW&Ss2(JRW0^?{4dy?<-$zIf~WR?5u2#CvQe;TH=lbRX=2Z(b4C=@-b9G$v5L{-iY-&@!$TD+%d2*CSqVS`Usmvt&LfgLv zH=ayuz8lS^E8E;wSn3b1XfO5DPU?bX@P<;+FQHIx%&IZ6KkVsxcTyf#@kQsxt^3+k zdwxDzyk~A=87=~hF(%Yz#>M~@mMMRcR z-`RrMT^pu@^sT8opKYPBP5qO$eA#yOy*oF*tp|fsChN{Eb4wguZ)e!*S{XF!ySlu2 z#;7UtMovB&ejztM-@R1zIyXHnxz=oNJEng$d&J<`+0w?7K)Yy69c`U_Xr-Eb@ zNn677CAMhho!9%F#29k&NX;=EP4R587Mq^l z&NfU+ctlFi>F6!wmM9DAFIT&o=+%~I#$j5OX>P}6COxmbe2x#nY^ev6r;hw0niSY! z>Nk+WEX^uZ_iF7eV2|3{yV&d8YQ4hgi@g7*e|Gj{XOGp*pti!cUiKerQ^A#%mK}ur zEjxyg!PZMji^YIz3rsckah^;hYU*)<{%PpZUVP0wIUL!@qs$mhJOtDYJcB*Qd~+K% zGcA}?)1GRhGT@GPnYq~TQj?7$dGCSu4zT&^bQ1omw?Kr~L-@;ZtdoPRZf0%(!eb8j)ppm9|5+mEMCo(SWR-A=65yY@A82lBX!t z{+ns1w~W3m_J8du%go9zZqF~K9bbIw#ZG89+7*sf(oS-wnRZs4e<@EhRh?mDKpTGU zFAm)jMf0Wuo3G5i+3rqfrrJV#2l$nN#yzsX?C`C-f$wrwzXqsnr_SYcsc=hJqjVP zm#M}iyULwxUB>yOF^IM?OAEPK`MGF?^*Ahw(@eAm zgPR=L$FX6YYMao49e4M@8th_-2{}Nh2Y()`ou;b}!X{AS(5Tb$xydCK`lEMtNfY=q zrS7p%*;kH>Ra&sI6O3K#rry>FWrb`P*Hj{?V8QULi=C=M;^Lcu{|x`1kE7EkEijht0~*OkcQO080lG%U)+)HT-sck zk<3JDt-YPNVxSM>4@-{v*knOwhOlW@hI(?j zh56Rj(u%~#Lt4AAIhdW9(!@st3OIF#Ir79tKIll+X>~~fhgzRgC5H`he2jWjN!DdU z>d9%((#{eaSR=KKHjMbj>ATo%0QYyQT0Z$HI}kD{*F$UKMiMr-mT17;+(VDCFmmV$ z8(Q7L%r=yiYBXkW>AP9$NYN*=)IKadtuHo1dq+gyTQ2_G-pFS(y`8aCcYIWvQs$We z_OTJ7o4Xekd4`KpOX%xr#xw{vRgWuvCgL+|Opp4{Y=e^knltvntUH&it!c>>XcOOs zbH;pqk2(&ir-ps-Lc4~%CsXXY@iqKhFa_!wPgQUyX(dyaG^C>Vz;ht?A%gb0N5%3NFaxwoXgAGLvNW z6git1C=EmsDVnmc1@tTums5)Z;Uhn zv3JY}U)j7M*Syfpc5V6O{QUX2)~P&Imv-x&j_Mmp=LWs69hT{UcvPpdo${yE?)Y@N zDi8bV?dk49b2>c}^-o6y)S*+p77D{~3tb(Ro;@quv(PRxI!y$px{~^fBM?+snejNl zL}!_olN-e2UIm<*-kono^TDxh9WwVNxpt|-2DmeigY#{jX&d1VUp=V8mR__h8^tA| zkZZBKiHpyWQsm7&nNwa~S3@b090dv(U^A1{&=O|Bu|ys*11r`em9(djr-~_3%JrJ- z=;Euiiqbmgth!2Z%hQ-VUjvON-O~GvjR?!9O>NW%QVZgQX4m#ho^VIds*gW<{{n z71jBliYSauTq-OxK92Ja@yS^-}h7fc)H*|^!@7_M_Inz~5W!q_@VW+tvU!?n4X;ptu8A`U^S`bqV$6?d1R z7z1jHCsFpn4)-`*I?;(srwYzR!l6?=Y;ibm`|=joJC9B{uf)-9=K|2$a(BZMK0+1S zB4CN{JL$q!uaKUN>+G_)yto<178a(PadCQQUIjp7SZ{ZhuR6?3L^I&;n6;$JQw@_R zPMR_aok*c+%qtvibvm}mm1pYnm~D0UV!{Y>JbiZ(rS><{iLc}1T=N!KUoc%;j`^H- zdd0U4As+9RMk|Cs!TOEH;t%iO=U+mXDf3R*=)_o zz2&AK)f#GRxYWj+k9r`rIowl&4LB7??UdjuE$7nh%zVE1e`$J-<2GBB8j;FYSG87E zj2Jn(s=BpmMD@s#)!C-1mX^v~suFJbl4)OlLYp6=G_K`#wjGorDO_e!(cWpQf$Ko% zJ{`K8r#v;L4#)Ev%{2=G=4g>Fxb$y0_2+xuB5FwuKQky%j|IT6-`5Z zvn4eIIm0zPqJ8A~qLfk$@dYbXfiOh(8{k$kK6zbIsa#`x2%;nt{tady@}oCX<(XN? z5-w(IZ>Rg{bW^L!wW2kT&bG9SXsT=-U0KuGQau8Vy>)bTO$x0YP0gva%v73!I&CzG zkdn&x6d?xMNuzUw?YM?WZtg0^R@`ia+XP()g_zNPlsn$c#3|{bhB|ep(-iMDlgquV ze3HB5vNqs49@Hi_f&-LVoJk1X2T=!~GqbYY7-TbiEy;kDi;rS>Zvo=IJRXDn02aYH zqTwGy2By{1POrMiu^vqVy{seGLRVT+2BteBsk-RW97<{H#5-_mxQb*g<5CfPc^A$b z)9triG`u5CnA2w3a03P3Ii-KX6`E;GD+K7FPKXg17boFdQTQPVnQ?fwF|aY8Z;0%U z)Hz#1To0_vuzZS@N~aPQN{#~RZEFT6F?&(7OEZgbJPo&g;DYq|ow=40Hn*W0g6if` zRU=xPaY(kZrlMl>$k8oLn1$3dXDdclr)sKOLN^3Sgh@9932f;r-mRlOuP$;(FVd@J z-1d7-I5-#WnEPrm!)%crN*+s#_EXA$S)>zpRK(6~PcEabWJE7FFGh1_H|p@3yG|X- zmvgI5hr|WVc$PpL-wuNNaOrMo%pLGw#Ly%Fj&|Dovz@q4CpMDcutx^CnN~mIAUX8(fh$Bf&=q-BxwTEKM zKpCmXjPK2M<9Hd}$AL3|)IPquIpTw2poowzv-TiEMu0(cidY|V5@~l++#D`OcUIr8ni{v0O;e* z{C1#l0>b{7mMTqKlT6-`rUWfw^p)Frzq_{;@S$*(!23F;l-}2|v4etn-L0JiY_JjqAp<9vktX zvi4keHGUdDQ~ps;CzAs|WX3iU)sw^1v2kBohEF-;G<1Gp8y-wW56;7Z%RU{mEKg}W zec#XVTEii^0YBno_%GoAgI8bT0aBR2Q`r``b+(kpKL5YGi{EMy&$$NCrkw_*&NF#0 z8FS4=Q?9X?mjJlt;yBk}Uc>KLenVpkk<6 z?lCM+4=RT0nyNa3aC^KW#`o%-kRBLEx<=z)ZlfD(@C7yzWevh1 zMU4TSk`CkxZJdw?)Ta|D?g0&dQw?8p6OzbcRIW2T3`Jc&ANC>}Cl~ZMqZraLiu>*H zXwM>FedG8kP3*W1eWi`%H8YOKqBOCNY{y%IFTIH9I6*k1zGFbAq{Y5{$4N`kI>({g zYsPur^+D$$_+4tAcUAEtag2SE#Jg+i39?R62hgJvB=yqh`1JMZPBDwpxQ?jbMZH^x z9>(K(NCZ2k6Tj)lF`rzZ=Nrj2{`o?3rQY5r*SJY2`r1f0+jR1>uy{lN1AqLB6%i8czu|E zHc+ye!06DIGI>UezL;@x?75+#59#JB+MLGLpC+AR((bK!XA3oR|J*u+aE#zxUokIS zb3=$HJw}Uo>zcpiU@%!H?^!VtF@QEv}*B0`dag>id^ zr$CWhpczKeo){uIHxNv`)j5EKZ~8QoU5eNfcuCF!2`R~nCs8Hoodh~t@5D*OGo|De ztxh}XiwT{~zF6_6v@f=FV*6snNiT1P66ZGLXhe~%)ZRr)HR8{0A0pDJ?Sm0Fv+fm% z#k@HJxhdh1DDL4JeZk^DIMtnFVEqQFd_Ys}X(a>d*J)Uu<3j_P_ON4A178Lw5q)`3 zncHLfW<>XZzS;4&=)PIQ%WwDwpuSmIpzhJ^2TQug^sPir#p6hF|2?hFnI-hEQQa{5 z*RH>z^sjYYQT=Pzskpx1UhDST{xGF0sXwgwtEN9}Iz72RY)bAcVHP`R9oyrWI(e^$4$!4wn<;Mw#PPeL^YU;#&uuemS{fJP184eaX z$&)zU3$^WqE8c`tjNaDv{9^AdVX+SdbuZc&@45J+uV$R$Ea{n_D;T$^B`;5AB6j9+ zJK99gk@kMG=bmutH;d|=22Mrwn?+Sd+$Y;_7F8Mh)1t2EuHL>>G`%>}tmuBS=c(v^ zvgoPkezNGP=zg;3spx*P=v1_4{!!E@E^b*q=2c@@Zst|#aTUk%Ed6pb z?=+j9Ty9~$wbi>-?@OyuubS@4<6V83DNQ^BF5vy4xLkZ}z{c6}L zvbmKmwHwA9sOjS-)}2{c3f&KTd9L~3#HBy2>%uoU179D_@8fGFcy)GvTlO59>3`#a zV>A8l!gFw@|Bbsfy8Itwu8+PAgfCC64}`lwI~WM3o|Z8X?wq#5NAlzm`pe&M@ZjD6 zyLQ5^P0h$P=et|dU3iX7TD=5pZuQI@_LuO?+BCf%bxcEMQU(4u&pSmeTIV>#QK>1p zo}Mh;J!*KK&F`ki!3fW>utcox6Nzwtn@%LsZ88z=#L8`|xCh}oCwxkgI&M)$dhwz) zzYS)3qdCW5ZH2F@{D*e!t6h0!d;qX)+rt^x(7v_hlk@ZE=epD7sk*eM&EhqQW9Eo~ z3gZIdA|#F*ep)3abuIJ~_NdpR8xLfQcv+;n%}@QUH|LM@+H-V}c6qvT!y4b6U)+Hg z%r7T*{8AWx?XlB{@o1`n^5`Bd89<+ET8cv`1L#x5iQ~uv=u^cxus&6sBUV711M5@8 zIdTQWIj}xeoTFAioCE7q#W{Kf#5u4&osCLu%JzOR+5t`*n}S%*HCSOY7(7c5N$ELZ zZL~Q(v5Ntn;>ErD&D|f22X!IiS^umxUZEq4XPw}Zysyd)Fd3|aOvd{IO{UVpCgYue z>5`d!dUKfNVJg>(Idh>c---8)*VXXr?f3+Jx~-$DJ>6Ysmc66QqyU?lMAOf33;W3g z(0kw7Ks(kIG4MhAD|O&Ypc}}*`*s@}PL~$j*gSh{bY)H{a!=qcoB z_oK)#ya(L-V8JOwuA>V_Hi|3-?#!C%sf<3^a0)UYuLX6->jCnno7(_6^balrHLrYq^5pPk<&3{~BWRuPl zUC+2cmD4vvZjmzM!=|{FV`s6bW47qGth(bz2}(T{lpyx^>k>@pK3am<$(ZNFK+#sh z4)d32$SG27YE~}W-H>10X{&cS4rg54nv8ahXU0ca9}DZ22AEjlx3M1dEicDVU>#|zjlUpGxXhO+_E7#@KrI(T=Aw`dXwwE%eo(C;fdj z<>q|_yd~6~kKjR^*o@}73mJ74Q}_Ue1ChKH*|(0mVe;-v?`X!$c~UqlP8Z2fqTcJN z;T7UP&@5I+DV&=-S4+?f;F!IH{>EcMknx;ahU65blG=aVIgJ!4i$`oMgyBrEQGtR%HDpDM|MXJji$?^K{XLL-fnbhWi5 zShCDVRL@HZd)ml|CV&v$m>ei|e)gwn%XPc^8 zS}Jp?%DvOL*aUA=aCYtDb_g*&)2Bx~FVdyWjKqbr{Kb0roZT<~ZiJ(@6}WK=+luc{ z{d|W4QZy?PFNEo16%lXgR{HQU=>$he!P zLU*>U&?9^9a!`@ZhWYnP`e?{05(FLy=e&a)%_zuXm>JJs%ZpZ|Zk zD>8R_Bb#ydXfhqy&R$F`mu42_nz4n&zERu!&Rk1>>@D@5ZKvRwhCE(y-`-A>U%J;F z)8Vf6OlMy0(di?M)y<=-Mzl8L!4H)+6&0gLj&5nfF~^$bY{kgxR84gYjxf%nlf@x> zRm;1ekx;~C>V|3Ti1#n~L z$cvwS`wsnLO&=-fr{ejK8}yS|z5m`%20gXX+1A-sXv0?YP#no?&UY=vBX{Tu`-q)V z0V*o1aB;al3K=chM_FYNy`+?AWx;#ms`vjyaddhzvyB2_CmwtE&Cb;&na&J0>I-ts z3v(^>sG^v>=?g()QE!6$2Y3I^6e%=K)Qogy;uGVIHgSXUij2nPnMq*UWoB!|m&}v2 z{c_#;On0^u&!UQL5Q)Q{(+CwyG7 zg|Red-ao2(MAPWjY)w^7)u_r;b92*(n$}cyWOKGMSCP%ujP%X>$It*nhx2$}0=I$W z)NVl~C3l`D_!Z+^Z%$W?fB)8Z#gsyCtXGVGw*eM0l`OIy;zUi!J8Y%8a>7FEAK#vD z%3?PT$>rD1g+B>&o-Y5tym$sp%8RGL zcsB$%Tiw%aC`1N~4{g^ZYM2zTDt0(Y6APn$x}fnOs-C zc|jRofip6DiqNJMox>+7TLObrWpi zv_ihwP>OFkqh04078nHEAD5mqVQPKD*r^lK5Y&#ylA?A5B()<%Lr!L- z@SFkdm&d8}sIpA`tk9LUwJDzfTgEy*iic~p)B9CcbLr`-hfG^%Yd)Q(xHGdRRKZnv z;mK!R4C0h2+=^NDC=OwSueL?RsbYz)6N@|VO2>!(&1RTuv^m>T2-M=JvC}6`Zk#Z2 zysATHD3g_vNiE{+S$_6rOw++)d)G;+^-s1!b0e!uPaHRO!nDbCbn`R4ovC(2A)iMB z%XiM_ralr6{BCQ`sFXagib2q7UpFybTU9$kh0+ry-~tENn&q{vM{$Eco29KzxxLg zHYX!96X=x`c-n+Y3eIU3a`W@uODm0cCQYlKGHz#zaEz1PIkaaypuR=plhPBXHq@a<)}_Ui zhws6CxIL|H9)47P{nRN_CX7vYqC@cHLNz1hDx}?|>ZeYhI;O6%KJAW}LEarHEvuaV z9$aO%72A3=mEg~|mck7_(6dbkmesHy_|-Hon+_cLD)e^C*x+v~o{ebDlxgF}Pp=y{ zM(R%`7?YE_o}PR&U60y==Qhw~sf|Vx9+?@JZO#?cBWk>(k_>8NCr_F%ZEC|LHR`HU zQ`mH7JE-wwCg2PTZp?0LNy|wqwvcM9aQ(@!`STd|XiJW(g~+r{L=`YT5`E_X=A)Vn*|1g`EBXP#Y%v@YLiL<}m8M(9{w}Ww28?sSF z%0{Z$q+38Wc1OM+(eURLmip=^rzLue4qK`y;pxKB0iM|M)w7;^n^)7pJ1OwulG2(aGC+*fdhP=sT6AeAdjF zsWcuUSc)MU94|b0lH0in_>7Z1Q}@InJ3NE^KFNGt+yr zINwQ0qPav@fo}tFuWIoO@0GZ>8Jjym&V->dJ(ee`hTjAQC%^9DgGpl=ri__1wlU4m zX{{}9m@*50rUmxEVyZF0`3HSbqAgzu45)I?sP-K;aI97Ne&;A>R9b(nsKb5xbr{Fe z*45SFyY#NNa6}x(0lExDlKL=!@z_TA{Xd$~ z_}5ljXOY}+%{5ZTRpzha*Y>0KYh621su|69LcXWTnZYZAbkNGT!tw9>SqfnNRhJ-a zbzQm&EzMp&wa%)ncBVs6hEIZw;g2&~giMF4c9|1+a#K;H!keZdrEVgMotqlzNG$dz zC9%+#nj&?<1Qlt(O;d3@3`UX?O8qHHDDx$#C{-{$#mdpu#$nu-N1`Tf>TX(59ev!v zF;d+JbN=-A!IZB``fMp!O?@`$RsdCaANJ#%jhY(v)fm)Alm3e6qd8w?^ozA%h4hPA zN}^}K0NKpRbX)~dWnC!&My%7tjex2H2LPSAtqQCWmm$AvcOgKvoK@W z9EPpX{=$gr@B;+AtL6CS);)nbO6YkEr|ZX9baE7JERe4xxEja&*LSL2MrE)H^Ge_4 zpS)TM6}eU?GZL$A^&Dh3=b}}?RpK~oh4vXnR3|y8&zspu(5<|2p3=KrO3qYCVIvJG zMwdGQjLlixnFX0AgknzdBP{7E4m*qCFM6yo7$s&Sd`s_)nAm&WOZDE$;1^|g6+84N^q{Oq}nRV zZo=9s%4V|KD#2vp+A7j^CexE^?(J?X;LRTS{KB?eSthfjqa&R%myzZ_Q>n5{p}hxJ zr?ljjlo(&CsD$c<4+8{y%i+L2I@g|M1}5 zZocl|AwyOw``dbDybN#Y#?y8d<NoL z`qK|m+!Fqc{;ZA9WH9rDgUrKedmG{RCNRA*+;c0Hl^sF$?t=i!TKI(dy%)^m!kK=} z^8FpmTQS`J@beLvDfg4tvNF@28OK~O2gh&=VWR-%AHogBzjYki-W2@4+F#4cX5mB2 z%J|s0Tkv}~m|+hPRaO>eFNJk8z#J`HSRBK^odjlC40i(z+zF=VA@W*Qwgx`Bd}f{> z2J@V7VSYzK|C%slj}~oD=cNI^Z}Bj%cK_J8)v@+KaIM0I`F#TIstZj0qsrWx_@B0C z#&HFh8-z3MncVGQ{u;wkyLtl5@W+&2)1Hp^Wt49en9ZMzFW-;B{6sj@o>{&#z+4o= zQTeU}v+`5X<*S9Gb-+x1T5+r5e>#6Uj%NJ+6JZo-=e9w-{|2|lbBcCa1`%(U_Q2TI*wJqeG6vg=T-Skzna^C@&aa?7ZkTX{-^U|*2f)S9uUs7XL3)1 zdD+UDe%}W3)!*a&UhraB*%kQE66N=LFt=Md?e_^7xDU+v|4{bA>h1ej{VkYXUshb0 zU&_}AFk@r5wZTmTv%i(o03Ta@)Zq8Iua%XZj1MhQ<@-69E3BOM z`vz=W59XZL*<9#2ekWGn2&O;+EGy%q%ct$FhXS1e=9h0W7Rs%Sc>e_E!M7B*u3^t? zS9AYWR@RIUEn)Feo;$!SwQ{{Wtm1#@l;w+Xmw!2DS_GtWAIbHP0bX1jOr z1xwiW{1dF32&VR3#>!}Wr`wBJzo&w^K)5i!l$XoFydqp!UJeEKUocDGQ+`c*rr%@0 zoNDECykze@FdMxeZ*OZbyI47GkMdUq=0xGb^0z&>--CH7#vXD10JG8uw(@DeL$G>n zFgpkr)?SDk4Q56RwJZVtFVgW2pqWDWVoN4IAkFLAqqIVy&u?ey7T&KE8$Ug9nT zb5#tt0Nf2=w)_}hu!OZM;_AWtCWe~;?g=nkQAfr?<*>#31N=S}%uj_2^Sd#)>xIEr zUTpT-vF09d6`v|5EYBBW^;j^k2p3krqrv?b%&5 zap3+gj3d_e^!Qi6%I&^E`S777Y}_F3elUA}%UC4W3Fg%pj^=+G{}(ahLyL+dCC7bq z`G^|^rX~TG1~WMUHwR2p0Hc|*$d-#1$Qu*vxN(b<9pz)0`q`yWYt!_G5GySFq^KX{D$S3 zxN0zq5^!gMc{&02F_@awqy196v%nl7Tv)tRzB9o*mB8MAz-+UI@*8EZ5==q3u)I+J zJp;^RF&vfeeJ~YkM#oFsG%%;faOZ=&7R-dTqT|>H+yP*I7sJg4cNdt=){eHf9=KhF z!B<{v?P?j!>;dkBb(FpJL26EK--hD%)7BkSb{#&n&|e!z+l4=Zxi^L*KaYZWIRW=J zm@gA>gK^MgV>)nxC9HhpcN;Ln6L6!zG$!C?fN8RFdVBd23e*l}A{{WqvH?D}{0+tL zAA{L=!{|6D&)a|*7Q<1z)nFPDa8tn?n1EXVW=R6>XfS6a;4TDnO#*Hin0u|9&NGe2 zj|zjYyy!e@?s%+u3f%r1sXT{`8+&2kSqf&^Ceigq^>NUqgUZ_Rp@sfxzq%jokKY%8 zdCbb`@=(6J>8GR<1QifG>DWTq3)_Bt2<|8_-CIU;hk!dC z%x5uNH@LO7!u$#!TEhHNe5VV;ApYq3(0L~AtOVQ!;C>G7${4@I-3I321l%iNK1#r? zx;3^(_|Os-Z!cEw3g(h+6t@OgTf9HU>My}88XC<}H9QLD-``VQ*u3r-H1wUe8&r1n zE{faU@T=SXF8F=*U9sKAhZg#4D<8FkAAq?=II|z=dYcaJBQRrjQ})90vJbd9V6KSa zXg~f|Vepj~Tlu!cntQ>$B5YV3+kyKxn03A%9WU)iY$gml#UGpBZSnh-;P!~IHwRn; znDd1T>*v1(cMF)@a8D%u{+*VY2FMGQyfD+f~u!F1Iqdtt|~$nTS2 zUKTFQFU?=x1~Yb~vS)Ip-)Ue@8x`;OV`4_z?CJcG-!;MHtep0{I=H+r_{xjUv*u{{ zUJUNiJ(S?!#4}kek4EKF--+&o5CfYCWmw{=B;mGe)FpI66ZhthzJ_^iv^~!Hl zKmP{I8V$DcX?rwJ+z3p047Uv2a4@e67uJucUk)3K?G`??&|h0SrFq<*!VpJG7&j&X zcNQEqg8Tb8MN9RqnJ+mL3x6h!m%kiOw{@OU&zr0o$ z;%L#FZht4hz{B8X%~bZN{n$9#o?j*m*`g(kyFCGS3fw)NfTMQRGFz2Rc@6jb`J80j z22^>T#TEzE+pq*2O|Qq!i?`PSqNksp zA&!aRy6HO(-wIhDtqIpnR8XsEduZ^Sa`9v^t z5^x8BX-~i{0&{c%?j$hh#&CC_AzTXPp!q5e8kck&x_{94x!(fxBYbEvXnRj!-TGi&^K(n+t>Y}^KeWAgR~YBl^!lmv@Gg_1{Cxs$P^a=s z{h2wRJ>s?%CeGfj;6}#Sqw>v8Xzu`UZ87$!d?zHdcP6-tW9(7+Zck|M9&nGv*rW2j zpU~b{;8x2=*9Vnv2VwA)m$3T%KDf~d?9EMRF9U92j6I6?rwQ$y4epmQ_9)&zCA4=R zxF-_W`!J!sFTkzR6<;6Q3!`d7`jMr-?Fw#W0(-L)+B*PTTa3MpQK%CV+PeVU6*2ax zKJH0q?_qGy#n_|reU{MPT8H3xJ3h38jaQpv-3TyK{G6pe7J^yq=X~QIZGX-NbGe_h z*t;9d-~61<9+mH1FspR?;;`7;9?b53&S#IxHwDZAe$Ha=M_^9yb3S`iAD0V*ue^kf zFMj}cPmDc^_cbtI`8iAZhV-Jwvq$-x0A^o5XDQ!eFvs{gpFN8Amtg+j=PdS~0rQ%l^Vy?# z2Q9+!c6?}Y+o{D~6_{E-=d(xK%L9aAgZL9xzir@pW9(7+&IEIXpR<(j9x#vjIbZoG zfA51?ZE<|OJAkS1b3S`iztg~E{G6qHhk^O2pR?Gz0?f^R&SLK=Ft7MIpS`V6zW;*R za!Gu=qrr^zb3S{ty=)c+UwH|u--X~7C$M*RLVLdecU6o%iub;R_Fe<`evCbecb%mw zcPiTO_PhzW?+NSnBVYcg{naM4Hy2!Uj6EvfQ3>t+6x`Vf?A?&i-mT#7i?K)J!5azf zeF*NG7<&}&mWL**kL|(jE^JtRl*8T>Foy_7=l8?f^KoEKkFiJBLtG2y7Q^29>EXV1 zK<9rS0`q(fNBMhC7<}a=y?)RhabE^F`+oAOKf-Zkd}s;F3)xEv!yx{IiXXm1I)V-wiBG@-q#!7cOKTa<4vG_@m2wNU1s^w}%h0?*5^a8KDdUw@9(TS9BdzuQ2$^i;bgtJ2Jr8$F-k;J4@K8JpVqSy+4AxH^v@~ zldmVV_W`)CW9-pbA6lZ~tpPK}&-uzn@g4-G%gUV8$n+qEj2idDhXm4+D6BF25kkDQi zxF5&Zqw(PUg!X<1?vDxVJ)6+pJK#Q#u}A%F(_@p>$9CX`3maA+6z^m(2l+Y6cy&0K z6aAd8|I+w(C74_MoWTC@T^roy!bZhg17@P1vy^WEn1Y}4m5<^* z1I(p<&SLLQFc0}TpFQdyZwo`A(-Jn`e+2H^7<)WEAD=9LJA`{A}BMjw_mazOaf$NO1 zNA2Y#Fjoo}wH>?-%>6O;XnXc1nD-5P!R;VjKe+Nw2bHaf4=t)4*tv~`VGw_8+d<09 zmH{qhy$)a}a8<&(^_9SuPuaO5Pxj-LH%-Ta3h3`D&GV!vxN(*4{BFEV18`a3$_=!Ug|V3 z=Li=T2erRTguz!{Y;n-`_X=>g3L6#2-@v>eTvQxifLZBhD$mNEJ&sMmY$aS+9OP$5 zVN?|M`k?LBE&w|>qtPCf|c89(Rizf^CZ zfLY@tm1j2&i@lw|RQWldJ?d}!fXVtfi@hVj{LIh!>{0oy0&}~cv)Fq9%s>5{#oj6> z4=Nji4=qvgjs#Qh=Y004KC)mA^K+K+T>$0^Kj*VY@!lg0m5-LN?bdVP-iWbB?Rn)> zRIF?)!rofoHWSv(i?4h`p&tQews2AXybVlmj6E8!&IEIzVK3OvX`H+c%>BaQa!TuX zO8xBvVepj~+jvEJ`8vSa`}yEgG2Y`tOITiZ#=7BP<_H&+mxIA9im^v|ISb4$412-6 zkl*XUJSQBD*S2^!!SCCi=5Gfz0B6t3p5PjV4a*DJYfWgc6WpN*?46s?-X-9! ziLpoddjQNw!bR2Fs;A?84?eVn#Y@LuQegHnxL}^CKK2LG6~j^fP62a{aOB-qztmnX z0drLX?gn8X;l*Z;{N5Je?Csz$;2sq=EH5-pz6WN_GgSVf^1Kb0VZw#kqvKbNU}hNh zf_dHyTq~Hv40}P2>g@ty@Rb+Ni{(7Yl|GKor&z|xtHAwL*r<441oJQ9!s4a+UF}Sa zL-^35>;>bXd0jb}VZw#A7xGgr4B4Y4tR0LDaQ1dk3vQCIVR2A9XajSca8Y?V56tB; z_Nd(|%rDbKfoxyP^#gPUx!LS#MgZkS6V48&si-Y`h2*W|(k1YYVVaOgWw)_pn?_P>E?O>(zahx9?TEgNWd%Fq4ApV3M2dM^^PGIlAg!Wp&btkZQT0(p0g1aon z9*w7WCA9ZAxR+w=4TZh0!EAMbFVB|aQhR_I=jVL=gUZ(err_r+_Rauvk)N~JyGHS;}`Hm`*=uiT5Nh=lVH|y=B6vXv5p{z2F{? zu}A&mgM{`z2RHZ^zP$L#N87jUgo!KP9^l5s*rV~e1TRSjDvI!NqZZtx7<)8sv?a9H3+|{G zd(_V_PH691aJR_&vBg48P!f^+ERjp3vUw;68}4NAtCH zuf+2c@u4Lu&*Q+%5H2duU0{|P_JaAN_Hr_qGldIlFLa&YFNC4;(Gr&DO9Pxe&sT$6 zCTv(7G~akKp}m*Ey%S@P>TS)dRE{YITEe#H8-m+L*s$`^_I%HT_9lay7h{jc@kL-x z@pG2>%Qawb@pHa*O67YR%$t7BVsG%(I3JG>Em83f7luLn3CrK!;3me{qj(p9InvKr z%6Ac%tNolM-uuBk>*p-?J_WPVZ{p(}Dok9wDR6tn*rWEhUqX9L;5uXMQT|R!Xzwy` z*TvYQ`OqU^UiEX9{FPlZsBCR~Xo+es!@%s}=PdT-fobt`mij$f7a2Lhc zqw(dog!b+S_hgJc%HKy|R{gCnFP3=A!KD10CElrE4)k*tdp`#A6F=v(NA2a;!r&_} zVfniQ+ygQ8D1UDywD&P_zw_nAS3a`0jWDWo;q^NVTuqEU8vka2X%Q}JySfC-u`%{& zetIdG-x&7n+tojTxkosP+P1xVewM_E(UXD3`ghlelHBZ@?y&i`Mo>9+22m;vEI1LAbDZsU0+d$s1fSUOJC`GMEd5Q+|US z)$g@nZWb=89sC*0Ut>6`k0*q|S6;%}--`h*W!>+71Kfwgx_PnG$9lgv>(^EvG+wO_ zu3Xs2`T)})oa@)uFKN7L0<+Mt7tAyDk0ZbwCtO&b$|@xo=Q#&vp>R=o?iGfU zj6b$K(|-37a2E<26~}d8ZWAslj_1L=X4nhHLB}UQ1M{tLVR6uXA*+KI)h4;EohFs(fdGxkR|I@=<%a z1I&GfJ$s&C0Q0JFVR2Br?+Amhyx8KPJbwso&`qjNqT<*D%=d(gilY`xqhT)?2aPX3 z1k)s3SRCZ1T^J4me{69K#qW7=rwSVt$FIO#D_mF{wB33b%<~2pjDy<2=U~=ert+uk z1v%Po4FgjtTv)u+4)z2yHio0)iPMC^S6*y+A-~xGm$GiR+Q9V+>*mF>-8$1}&$itf z3cqK8yHVJv`nVs=lft=vecLUnkB`9o*WiMArux|WW<1XlA6la7V;Y#b!bR0b7Rp_C5x) z`Yql(+vC^~Or@Xm*`sl2I+%m}oaMN{;b2bma~6A7g1JSwsP^{|m}g_`(RlhPn6HEj zYcEt!tNcOb1YdcvwF8QGb#R*t8&$sDz>E^kZ3n)1Y226tCS%wO_756&d%!FeE-H>= zgyA6Y#})_8H;xB)wXjif+yUkR;iBSr3(SXxyZyUJfw`L+PFqi}AXefgvDssYRt!=AmLXTdBGE-Vg; zw_6wv0)K3AP@WfqJ3-i}I4%Hlg>X@E+ymwj!(K2B8h2j>^OkU7agd*nguz!{Y;g?5 znoq!Oaz}i9>;h(laA9%K{AwncgA6Vh2epI4!JHApQUACO%q_x&#Y^qrE-(+qa5Ue2 zN*H|Q#g-TH`_BMpAIIMZ_m!}2UM%ygA%9Xi7PokC44%*GYtM8%VhbM^HXiH+i)#131M|lidsJ`Ff_cTT7i=%ou08>?(w*LR8svC8 zEes^Q*y@+^JT$=B>vuPBql9(y+-<&3iSjZBOsB!6)5ConwZD^u;lklhdi@|r_AUaq zEXE#jPl9IZNb$GtNL5|PSsA!mw34;U=9&ZwFAV# z?N4(we>o1!FB5P#fq6_gm1o%Vm2Y?0dmqd;cd1yS%C|F^$-=qi^Vy?#4+3*+0(+-` z`MuwsuYRdM?gjIbaBdtvj@td#!r&_}TpyPFt#UVxm*7K-8;6gh@pJ^334YEO@Alvh z0CS{pQTaO&%f) zM|qhDraOVXAA`BXZ_gLUDA>CZ%sax-evqx+sGU~ct75=cUThq_kN5`(xqT9FTf*M_ z1l&+?M}xamSUN6jD<8Gf2NK$Q9^98P_9!FU-RI8>wnx4^4+Xb9xO!p3%6AaBgIF7{c_4lLw;X@0>W#g!wHvbjZd*ee(Si2|vd0?&*&TW6bIB5HEyD(&r7Movc z2ahM<$lhBv&Nr^n_Tw9HLmp6ZxaIS4yMg;Yn0_^xOgOR%&bocO z6U^(vxqf|lq5ORgX7vYs<+E^Gf!QsFqxo7|7<}c$HVz$$HI3l@AA9ctA60ejkDnw% z2mw74MF_r#7&RKyNKk|Ek%0ux$OIxFU`2@nDO8jQ31C$OhSZG5v9#5D`@VR4+uGOl z(F#7=nh+#GP(f=&+bXTL1!G&ZErM3_`+nEj=gdqpN$}C$`~Up!dOjF!uL?xo+ZUA7FM|6#e^KdaeqY52Sbw7y{I_0|ry_uIgExF0;0yUpNu<)>@! zYCPNpyvv^Lo6p313ph9K>>H2u%iD!{AAkJx)(+P1T!SNs_%B`kNbe%xRUZbuYYvm% zBH-P081&-l=ye;v9Ow4{@4@c$y5UhTJ_(#%29MkkdFdtxCm{V-1_z*g(&3S>2YcXQ z9ng*5nZSFu2VPIRJp{bdp3^>)Lh)Zku%-t+z883554@iAs3+H^!=qmF3cxq}_uql{ zU4v`*(sI_v7)KALE4Le8IM1}E!~0O>CKe#H$6o@y_YKX|c`JcOd-u5K@xCJb@nhO+ z_?*C_yo>`*RX=zvcPem}8NAf-mY_$x+kx`~gV$I6wgKli2CujJQSSc;oUC7HJ9?wX za!&$ImBH()epdkJ)_(BFzb^pi+Xk<<`VsGb;I#EakM(;IIPV#}zS=S31;p3kkDuP~ zSnid;Sz_?|s^3k(i5tAW_;N3Bo;(b^mw@xW!Sm~SyMo zguJjF4shnA;`NYI;?)7?vj(rPcH9M=hYka8D{$WEj@PXn?6(hqGwQ|u+c6qA6{&bV z+QIR5DR5@?gU51ffwRuw_0`@l1Lvm(uebiV81!BSPX6xx+c63_=cVHHXa~n-1#spV zJilDge~JEOJ3b4XZyLP5+VK!@e%YN~xBjREy}tpc?4{&()TEWG@xYmxg6GX2iTbfW zYJs!3A3U~WIdHye@cL@Ue*@<^gXi<5TRX;s-hSYWdAa{~TnL<+6uh48VEsM?oK*%d zfZvJvJkeg_eFr#C8N9yQ@d|J3E;tOlDZp8J7gMO>!_SKG~fpc04Ue9(=-=71VYJ=yOo2Eam z1J36SUSI9_7I50T)9a=uC!*Zn1E=_R{kP*>;Dl4~dbWf5emZdG_Jc<~xd=FMgV$F( z?gh@12G8e9w{}#5-fO@)?X~{faSm{*Qt*1VgY}yVoMi^DFMahj;5=dQ`fA7Xz8-u=TT}z*+Xk;M`MV!DZ7Fy?+e^LnG;n@v@cL@U-+?pY_gcTc@XiFz zWd^UecFaM!OMtW8;Pusx7l5-b1+Qm2sMr1qoRNRf`t_v`E(1=Z!RxCXG2r~j;Q8(7 zHZIA(?ZA1};AuO0){l7mfb+h=>#N+nKVrWdfBg7(-Q@msJPQM7slhYlrkxjV0nYkV zydHKZ$M08x^PPV1I6fW#&Myp}U%zgAA>Ll#4B4yg=!<`60Ow+Z*Bk$+CmrC-?}r}C zT??G=7`(pf_ZV4zTs?H|Ai?$dVkRzH?|EO0J1cme$G%}%TX&K(A?uljuxIGYWg z&%bVRFc#(P0nX4jQtFph4o(Elm{hzTa=`Xp2%H*&*H``K1E={g@V*Y57K7JYJ5EKp zuK*{|*?&8Z1kR{bydLeKJdXxWSwDE}xADNKGkATq_p`wHrorp29o&EWDR5phct&2* z_Q#)qlksLsdwaBlaz7Y2rx`rI+%)5@3OI`lUSI9F6*%{H$Ll6nXQ14Nf%B@t>#H66 zfb)JTUXOOLKL-8@{&xKFW9aq3V}G0goRGoms~wjE=O%;a^QBumP654t2hL9oUSI9l z3Y?cy@zU1sb>QUuS=-UqI4=Rt41?EKI~D@xPJ`E5JII&s1Lqlo*H=4s1Lw_DydLe~ ze0cykqyD1p=xe^50i2ZvudjC837iKEUT^JSe>?-6zZ$&0+VMVc^7d=}3|`uH90#09 z2CuJn+ytC&7`(pP@gQ(sFnE4Dx{WvL$-e?;;9LFIFAq2u8N9ygw*)v}GI)K}@4LX+ zZt(p2b(8y1sNX)|41PPMel5Dcknmfu9mfFY^i;eaeCGHq1F2YYdK;mTtd-cwab7ynEB(&0Bcgvhz4g>SrM)ng_e#SqR=LC@464VkjI5Ppl44 zuMW+a;9M|jZuRsDb7xjfyXc&8B_*TMJP*&PniiTdb=us@s_~aknj5K_Srxe`9p<#g z8yXf}zaX;c+NIYlz3HOr8FQyMT+^^<-n0da7hJP!0cclNO$=QgnGp$(zhKnjMc2-& zzrG<|i4&$F>x|0q)Vbm5Q|HbKS60oPUQ;z8JTY7~ZMqbF&EkdyOK-TQVZja8T)*Ig zxuNAN$IQBZ!Sz))TyyQ>1@kZJo-k{{HP_9&W^vKWbIH#Jf@B~)ECeN+Lp=Ue#Oh`*Iq1`nBA6E2u@`LYE| zm(5vpL*0@&)s4#*&6`tQHEmMWoXL}GW=)wBnKFBN<>a|w`?RVlGvibzxq{wU)KhI@%g- zeJy7B-_?ueEnTu~NnJxh(X`VGrq-hq7kw7ID44M1`uatS7chR!iOnetI`T8=v<7%6|N;b=E26w7v^6LSI)cX`gfw^^2(9d`fh6z_Ff-_Hz}@3q(2pb&{K z$Z(1~oYq5`j=Rg*^+wojaf&xPaMz z$MI!_-KY2RJK`R62gioo7jY-%IPNgV?Wiu_-#8#ryt(s)YIiHX4cf$<>f)_VygDNs zAM*LI`%6i7+#{W)Z4Ku*?#!T5yvvFH?jO#Ycez2hG~bDCKFx7M2U*MLz8oidXyl5k zL0{>`E}j}6``t)vdCuf`;A|&0F_>V86KxAP<*(XJzyF}C%W=0l?wrDfj=Q+9-fYt3y|X=FDvqa_i;)9Zq{?VF6oJRl2RJw59a9(rx-+E7G2T+6-8K0(25Y zFkl71MTIT`bPJSLz`7IAHwF44pi?Es4*=aJX^wkGEwb;!pOu5ZljXS+{cOG+amNRj zXF2Xs@{k9s+Vr6cN;(;-kGQ{sfK-+KDdfIi8T(=31IXpLPf3j)Dc;?g6?T6UaX%2z3%ikX9QMIL$Ia-f$yv`XnHLH~Zz%~{4TH8; z78Y4!S~^P|x3Z+hX=-U0<&RG!A);qt$(P-xM%` zWZg(f{+i#m;8*leMZ=Qytk@z*sDqkD+{$yDN_%7EoY`TwqQZ%mSq+6@*O~2RG_|Zc zwyPtSfnODlo9D#GV@zaJHs^-i*3KazcURbjM0Rx5Ubsmqt zHK{)-+(1VDR2md7?8RrBCzZm`9@ECxTXPh&%agvAvx?xb* zeOBQ0VRs-|eW@E6m(=S)^!nCFd`@9~*uAnW>@IV{?rVu5a$s|yVUQDNn1a=L%z@3B z26p1KOf1K)-2E7O)N?j{sdhP&oxxwe6_F4^trw`hh(M{li*==$mC2l8pnQ{G(gS+MG3q zL?xc##6zb!<*m!lNDRLYj>!Ti+H#r`-LuDuIR`Zh@=0rj{X3w~l5|^=V&f9}W?`V? zL)Cy(iPZrzs*6=JrJvNT^x-{9@25~s*;*(gq_rp(Z;HaSh`F(Wb0g$DG*i0bXJ)p$ z4KriJeH)4|QvRfU`x;~mM-SR7hDR_zI_;r+>P{(tYv6pVbBg1(bFwXQq8+wV{^Sb# zQAYha?q2ZGvB&S@j3nq0B4Vcer4w5fL<^nR4f&3{+mI?p7E-|^QpQQ7!oe7H*sYl4N1v~iQC;SHSCs$Z$pD|-AzDG!Q{S&4ckx=3d5QG&uPWdYhc|OacZ3ReZ{0quK9%Fy( z>C^t0?1_FPcD~d4`vKvsKRdA{FhPclbz)P4VfRUD(OPIxSa8?%)TB})<;?n|0hwxS z+>Caq_)utmC_>W-=;xvw-uIzl=nyKvfHfVE8X%tsv`p~s0i;9gzX6${6~Chd*?l$m zGr`1^n;Cxe$H21iXKx&z5h-o8H(r`qZQtJ-E^P_p%aN2U1M;g4*)kH@oJUSMdDObs zzy9`i3Ug_Ty)l$wZw&WC!^|MGb*#UM&Nh~@jQ(y$F(xM%HNT4_+dR~;kllzHI)l{E zfpox#HHJ>L`$2>@HVmCXNmE|V`mh>0BPxe1T`)Va+R3?@yAA1nb z>N$u*Pjq$3vc+Ea7`hp|aPd-U zZ|bP4Du1?dM(SYZ3LoS7MsIMb&PXY$*YWHZHG|`AVlSil1+0Sn(fpYSLqw#lRVX_hh-rKBIy^9u_~pGz6kcGcU1-;q(BI;I_&D|PW=X3Ve~C^V~=laf?< z5UM<7_42P6)L%r;m&x?Wp{#>?DxmWvjYC-nHPcXsV_id!S)2UnaHjt5|gz3Y_k zgk^rv@f=*YIq|6(a7-DCFV}fg%S54B+h{$SHD>JQ{HgK4d6C#W*zYi8JHqh`u{h`& zxcuCRdorq^_F&VW8V1{&Dhq2J_vyO7{-AUliao0?He_NoD&ubV@H$6f1)DYp@k_Tc zhZBQe1a>>B5OL8|PFXNz=M>J?mBHMr%-TThzOO)L)Uay-q-zB}*@zwwSoGCt+E}no z*9sQ^QX`J;x$>tPJ{560BJoguq!>2ib9Hrf_Q-X}2eWNfOLe@Wz|OO##%AQ~4#%Cn z1onjNU_}Q~@$Kxk^PFIHtY$YBYz5)=ialH_RW;XifO6x{+xjxSs_c!r>^da=rr%Hy zD#jeBXjW?@;{KLC%p%_u>t<^`gw=(5AmAY?S=VB(JA|UEV>bjbbi>hA`Sx-+rLy5> zbJRfr7Y!T~ZU~F5pwskR!;ye%;1F6h0LE%(Hp=O$DM<(dy*>jU2eYisnoxOrV@1Wr z46klIDAKPq+;K0faWmmpIs%#*E>M)zWx?x7!eyOyc-)lW(!r0TV=Okc)3G=147<-r zKlVafp6y!**#wImxN0^aGi0H_-smxDeqm9?x&w__(d{Tv95LcifDdP!_;8*aTsbZ{ zxGlP8cnrYFmE(psp4Y3=!`Ml7*`zAH`;zRKq4)J=#gs|CBM>ij*r?u3a@c6Xj%(1G z&x)!k1fL%ik>!$bt)%hffGRx32&%$k^o=UKgMd`wee_?a@T4ZFy!9<9vts(?GmZ9h+4e&7g15wa?nF%883o6 z7~=v9@9kaBIk6L@SigzXbmH%rd-YXU8n-!pDXT>kP6YIhtl$_0uu`CM|LJ%??NUHD z$kS;)bfy1v0iZQPZ?T{DRX}e^+7>_u1o}0gmj(I@AT5^~Me`0pk9|j;Vy>KxWM824 zIZ|tqQy=`l&h5W*E!#cM3X=>+cT59J8q$5&0SIhmlohv(RGJ0p2 zEw+M?yH|W)FIAPkUI{~`z6!e_*LyzgSVkmv@0Zb9d~Lv2W$fPj^cS~TkSI&k*u5?K zt3$tb;>)M7X1ylv)~`MIs%*ZO0}$Ix_0%euZD`N>IRYabH;XCp%l5`*jQ9sknH(p6 zbI_zZS=-@!c3gFJLFEW;n%rNg$1Fqw^tUbarrz~F=0Nx9cXma8o9XU~K9y5(;K>}j za+mvd^qFAA>fZObE4UJOg&4h5Hs_)HrlEjCc z1xFZ)oC@#l>G*=9k6$&Fv2(bbZaf99wuOM;TYcKGtDbV)N$?65;S1itoMJdMC(Vup zqt9e?1|qRfFO03I_e7IBc5{++52I0@7E!zb(BlGa0Q7T#o(0q>;`9ojrzDN;t<{p2 z1E^inrU6o$Y#t!Bzn%fqB>JPm+Xrx~>Z5zG4b?C-x}g38$E~h)*0i#JjXtG&|784Z z5b|cD&xy9?i|Sz@#7*9lh4_(BNRk?He;tlpnIDc#&fx@;*ayZ`0`dG)RqVPTjG!C* z4uo)iPo?X7l+nuA_cq`QiTCN(1Nx;h`n?wY)qyXc!kT7H+^JubQ7lNmw+G*$_6b37 zpfBm%FTzFnTN!Y&-t#2Pi7&%G^$I5vTT=5-ftOkrn*@9KHpgll8vS(e=;+j7z?~F4 zdD2k3iNm@NF<$A3vDs*fWk=%6bE;!!MdGVq$eta6j~;&oPW*9$a;+KNqyII$@;_?!J`5QXl=A4)#R-4pvk-2rf7lX6P8bq45_z$QQ~ zHkUzt6~vR&>MB67#)(e^p^3A@F*_U^QW(n#$BuMBpJn*G%|~VRv^_)*l4=RmSm%8!VX>-aKDK4^?<%1&;~#o1mg60qR89JfW`pZbw}+HGnjn!c`JI&E#Ba=DbOmJU#$Xsx6R{9 z!zDkf#m-|aNst?8Y%SQq-~-29ir|BYJH~ke1CF2Dobq>8EOnwE*ei~4Vp!*!jWw(y zvq7WtVn$WSj#|6Fqjpet)DCgAE`1h>Pef^0*I`R-8RoDKupwW26D@*8ijg6EYPVn~ zNGwaUT8^S6s*}F~NOkh#fRgsl5*@6Yg#N6K$sGQ)y=ZH)Z-S9DsCOiGO%Q+ia6j0$ z{|pqJ=(__~ob1FdlNRzG2rf2Z1Rrv-(e)JE15k>EGdmZ{B-8=FMf>tWPJ1gS#LhDw z&1D93uWThAN-Rg6_#`+iT35_+;zMqQ%zNsl!*O>yP#9==>}qi2NvN58c++JAZo4V% zQ{+m8gssTN*kWvv!LOh$1(^g>oC@3pQ)V$BMV$q?9IYrf0Fk1{X67ts&6_Piv`_zu z2@}zkN9h(Pwytmko^baM;($ebN$H=$s3z?G3e#DTU#!~g;Cartg~5hnLXWUXp7t>T zId%4ut#$UY-8prRy{gr5GwMS2s{KysR=gG!qdf0P_qmN8;7aw7>6rNBoK#jKo~hjqP5?KdW9+<1`BX7; z+c^1aLrw>v4JiSnm9Chs`|{Y4-)#DyngsnXV<1d6}ujpwnepd?h(+D4*g}=7g0k z?D%I;9wd}Kj$SsWTKoudq|EeX$$@PE(K<|tx&SO+tBj#4rXpUAB>VIRMk6M)Fcl61 zK4E!6v0$Dp5y7r3tnf5gO(M3hB_+6OeVu(2E+ly7esrtD3^LMTCJ<^vhclc3DN>Nzls zL{ZT_rn|;iO;SVoZT7;{{wHguTVLI4=50lNG=2TC$5}+iS&}deBHsrn%iAGwn9af4 zE8C6&6cxGqP{@#gqJ(M{vg<*xsEvkWlN8QLV5F`?J`}PW+Uv}#NqB-PbN9m4D`}PS z@p~&{mAS9C4F+-bZg|yRLq`wow&c9)ay3;S;z?zEEmJCE>v9(pKiaz5h+$MPlU-2j zMrdaL30+ZlkI;PN9Yf31oiZNK-O|<>e#KDf{VA2H%-!#$p&|R(kT<0vJ5?zjHomT5 z{f5&u(6iy1x<OF~HwjT}Gd|tzUDV0ubxHjZ}xMI47 zXT@s#9!cfc6)Z`){;{fTx{AxfceEFBuM}0J`&rH8Q%Dq18gKrw- z|A3$rslG@sP}C?HaI=hvk$_a8(&FWkH(;IXr(Fo>GlHig61}OwN)kr*B}A8dCHGnw zCGIvM!mTDP>@*)b%P+!lMeCz285)${RnR8I!YqPWFAw3qnBMce3D27F%n5>9z4Io= zd5in5&81grxl1Th3ku52r9(N!1Mga~T!j*482nrOd&8j!JCXhkrN8Fhe*|1HYi z0y-{Wj@^W))K|MlrM}9jRQL&SDh5mc3I~4i=)d)y?`AdLIFLTDn;S@b90J|?Q$uxxjgO-Ar5T68& zHxx54o99T~!A`UOq!DtbjKKtV4-+k^6E;Kff7nuzvL9~V4`n6^hr=>$LEgP->lnw) zk+B|O6g#`KDBQK@u=(xHTQ7-7Gvdr~2MfI3aUmaa^dnt&!WyCnP=mj?w$_NwPmZ1j zlN~N6F-Y?1>WjWvo4T@`jX_lUC-{j8J4^*rDXW z#_)?^z%^~tm}UCNuslJK(?Ic&l}XGG^~TbBtQt~3e!D1$ll~RXD7r)hdPg` zqYEtJKE*~bi&0H8lIjW=$IGZYG=>K~I|FeKaQ`kZb>c%W$7qqZmi4zj9;L+5yxGZ1 z;`PiQ-BR0|M{Wnlq%MT11s@X4cpe~K5{CgjEF(4s=q%BUgTeow3UoT4hXq;)NYzdw zAYB}P1&}JB#HLDBiSDQz5nWL70gkvBmOwjS)pk5e*reJ45`$R+`vhijdj+&7+`xyN z@+^4|;QTa>Z!GH;;t~&S3zb(a)xO;8g0-;NGTv)goFU;>gXCkx*S^sNS9;&pzN!b zx>(R!8h4_u)cqltv_r3ZpmDbuW%$q4(xk38wbT_uYAtoe@V}{+x_n?Qb@@PE>hd97 zEpfWxAFz^S*2w|pEh3xUQ~x7v>V0WbFG!pE!?dYaYAR({#8$m#-NfWTTSmhXkJX}b z2_+}q6){ofiU&YNgkEtKku%wp#K8EM5Rc!q7mdMYuXh(O zZQaUVTgNu(P@sy@cG51@c3uXkdpn)@qg?lsmpUhC5&MDarI>NwuA`oAfP1AUPESJ) zbmBMd@7Xdh2`$^tmc5z2W%Vh=Cifd#ro-oOTlP<_ijI-PtqPb-4bz>;RBXL7`M-N* z@<$@4R(H2POP&L6s!jBX?g=(^HH<+B&tW?YRDclU!y&j(8s~)IZ@U?{dE*%0Y87%yhse+nR7ijM)L>;7^-Z9E`d(9H&v)TPqeR4)Ke zq4whkF!ibht@QQcxngw@6avzEQK>7$6X#kRhADQhjVJWnfXToJOb##%B-j*E~Zy<%ePEc_R+SOHyYQeHkB{e0y3|0Dfgd%9<*rR(XW zeN1EZctV@neIJ#*|Dx)BeCgsuif|*(t1XhdUI(U=B3j871owUp$MW;&ezLqh+`ju* z%t-`CQPGw_v4-Juba4v^EX#N4^FQZs9iYhEA$-O8`}>_3?j>M268)g@z$ON!)rdnB zb3+B@hLX8$z531)Q|LYD0pDYW1^4D~ye1>bNyjTJ=!W&fdR8Dp4IxEz?C7Nyy%s_p zuR4gE1u2DG8XsB(;~r6k-u*)E$0(@GFQ~>ZXn!=6)Aa~`@JD(won*rB@h)8b{3dveB&vzw|gvphTU!$T+4n`m z2)qNJYird&KC!n}4TpEA%U<_Kl!8d}1f3^PAp{!VoCq$-!o!hLh#j=-ya_=ZF+*t8 zs7Q&L_<%Cjjc&m!fC zl$0m@Lf1>MS|qL^xVV_12-n+`gx#BQ{7|mAK?IcsdPz%mIB2EDQ?3BiAamSWKzhpM zDL}u66a}nb5l^0yQ@@h5Bfz3R2y`4EV}JP2B|dbS4>9Ik@#xP{h(Wh{PUVMyu9q?% z1QZj>zK_S)XYrjVUaC&p?5Z{z)Mgg$cDs##_N4$QzB_mbe*94=n{%ajk_cMw{-kIh z&@JZK+bxd{%yds2KTmgRv%5d(W5l$e%(NqBIauRx#9R;H(OOmwe~{h8i0Q!Z!x=H( zm7E+g_iwG*#PQ&d91fHhk&qZVTdUq7hKw8;F*YkABgW84KVobtq}zyrxF)9~)>1}N z#oIW&S@1T-R*hRx6q_)+$H>y6ApifYapYFtpE9!UM^#Px{E^in{QV?HmRj+Nk%fcz z)~`k4&IOlsj70Uw zwxzHmrMu8>2cjv~8`_KsbFdo;;|G|%oNnfs<|8UL;T*G8u=5CeV+Yh&{(*qwG-h_5 zoJ>q=(Yb?h!W&Ryd!yH=u7=SDFTteB5$5u;5xBf;XtX0MRyhKvjYkY^Y&5tMzlO*( z(z}lwShHm{zCu^ez51VUY~`aLgqbbv_CnFo9hxAAl{I+od#HAn2-(@_eLbwa0gxVH z;oXdSgykVXdW7XkKy9LHUI3&=Soq=?J;K7P`1J@2!Tk7p#y60FQ|Ge%$|ar0ovk9Q58ktAF~x~2BYe}b^=SO6|5-|GP>-)XBU z-|qmVeE%vS<@>#WlZ8NaRqXK?FP z(;y$NQj`N(u^b^LUp4Z70Zy=L`8>5HNwZ@)(bI6#>g0u-5wYQ{SI^FE;{~(4_KmT{ zh#nH^JECa08t=aaWR|ao+44nNvdkyA1R#W#W2rXu(oRf6A#FP68>U^B)cjrVI$6*C zuVTVoJ`>*bnIPk_1a}jl*KlSH0qvO82Jw(hVm05h`%dzm7dX)hTCiv)=y9Jc4s^tD z_3B8V6I**?aj%saxEyX2+>2_W2l}eXNUtX7aMWQS>w-YCI>eMoJ$i{HtMF@ayq_jxyequ=P`;?lsI7n(fj5YrfYu@%FclP0YC9Vf5-WuVB zs)r)wEh|o+91rlsB}QT^uIRx*b4)VfI4-s@S5a&Ylv?}5_<9^$X8ha+_c!ksD&K0a zYjsi-mSO z@yWVPj|1i?f3Fjpn~!7c=ptNIlr6QXc5rK?x&8;|^TO^6-i4Oo_^gc3*1*_gKhgx_ zu-ffJI}s@H-pCb~a`|am(up8KJ+YrkNvXunrc14s*9VD;sOKpFqa{LD!QARqL{(*k z(c5~{=Z^qAA(qbbfC}X371fABM}uQ3&?f-Wv|=Cn3?NlE+|fuJ9qiGah!5etPuiVT z_Rsf9w8+jCXM@GV()DKu_l__&NH633FukhxM*S0e6;=C$dNqmCC)2An=(kbQgFo?m z^<}>=+4K7JSoD_mDlg^HUL6BSpWX;advyh%M6Y5U(|sbv^mii$0q)ntJ{(5q))g@I z_Td2VK#oj|*5l#qxDf}3u@9&hzn8Yu#RA3q{sVP!9`|kmizWqKV;f4qdN1T`4 zzGAGz5SiiVl<&uRTgpmeI6k7|8v`5z6JvBmeP`+&Un1!or5M<#32yjWp*88i=#__B z8L2L2`r!~ae_x3MOrl4z2_Q#l>9dBF$CLQx_IEvFDYrB0P*HA#=%yrvz~)7;h{s{S}m>9_hlFXvA5W1J%tV5|MV}VUJ|uYOXA& zbuVsg8d@Put90KBqvAPXcPNg9KS`AqKNEGq40bTfUi%e5Zs&S?aLn-c=pA+^O}AK=h9w{>Okb_{Efm(bw$O*D~Gb!M4`D+0NjdsZalK z34fpEkqSlI;rhKESA$e)wZijo_ge?!ri-7#HT_w3^m=qD?pG;(BUJnsd)-KQ5vu34 zM{v}bvVq%9FU$-<&7qkfJfx^u54(ol<-uwfw=Vk{KV1IzWhddvg^V!o_vcMv@9RZj z%|mbs7n`#CUMC|Ul*KrXelWvc`xZ8XocJn4#XgI<;JxLz{OG;TlW?mrubCqrZkpSx zse><#2Tpg&56WG0{+V@mk6)gi&4!AQVr#-K!p2pR+Z*-J^!Vn$spGd+o{Co;#xM7` zFpk%QzLRh=856@_Fe7x~Wb(zV8P1BE_?pgRy>}q=Bvu_el}Dn5d@T&(|oD$6j; zeU>>s%P?}&ur^lx;GFWjN9Kt4`4WrE~<8w8Oh!6Go!M3wCVmW-MW7>`IBb294<2=>4yvK zx#a$@Y92i{w6zk~8urf=`c0CU(&_hqf(V93^!Ik_@1Y~lMSCn$pk zu)*te7?#wLPvdtaej5hCv%bm9IU4pdH6-2vvwy{r80iT5>R~dA^rP6=)ws6;Gb#o< z3cEb)p6Hp&DD>=$AXGDb>Cabv2rIcbVIhOKZy`hSq1-VkJ4x5$T-la15J0i>rCtvi z%RIS*uH%OwJppS8pw1%*eFKnQRrr_>?e-z&)2Ca&aGmh+Izcnxp9xxOTb&O`jewPa zl=3@(G{*=GV|_XUkmk7BPx}KP#mj+aQ@l$6Dc)2+Z3Q5u{8vDRGNuee8IYmur>z8} zIsO4ibDW5oR&!hdNOR2d(_ROpc-dGkD&9CiiZ|O&TM0<*##MmSZuIvZT`#sgD6!>k zd_A}*JwU7Ksx}@4Gxs(`-(1Mokz5u$`Ldyn1MqmE>^#(dnD>cz{`D4mp5Os6SF$GF zC!*n4wDD?BLec6Oq+)bM0vHjXp210g)H65>ka`BM2BeW9dT;9w|k%eOd zh7-bKUdCIs8s<5%9~Q1gGOvB&RmBwu%&HwWh5w6-+RU$IfeU^IIwhMunwym9z+qbXwGuF z+Srm#dSRguq$OqAh|~I{cv>>WO+H0&!YOyKL`X~XHI?~IQhN*x890Mcn0e5nS+9QL z&FY=vM{m~ay*0}`@W(hrE$nXVF~aFn^+vdyJA)p8SnfAtY9-wa^*W&No|mf912VAm z9({Xb7LRw8gdV|!YvEStmAtxSC2#phr{7t)8mY{$`rqDUQsTGa&SqRKvhQ7h5qhfmH-urZrL> zvqMZCWq)%2bu$!Y-;E3%6rc zS5!1NmcWc|$NCK1_fUCTnTvOsIDrFryH$4MRO}nz5ZHuZ!_k81g$70^

z;k$4q` zBXVf4f4}4!9(3Hx9dYK5k?XRmk-gP(=%>Hl>)%jeZ3W&(hmK3WxuS9iG_6UDn;TGv zT*%hcNEZL07ugw;9PIyjm*I{Kxn*N0GQgUm>{abVsLM{TG^m;C8h--9w)lGX$eJze z7(Midcg*OPPU0*$=T@DfXq>KsDHyP*;kV&5V8B`f=v$I@A0WMt>*s(Tm$aS!)8kQu z8W3j!(qnH^0qH>k-p8e9eQpJ$k*#+C8Yxu1N(csJz-k4g#z#+6PLBz?J&p-36&eT( zt3YK$>E!^>V?RiRLm`oxxT`CldbYs7G^d_Y%7_gd4Rjl@o7{B3oF;X5v3GQYuU~yj zVUg8PSK5X5!!)B5FU(?LrQ0qq!NdM@rCqrhmwCwZ&f%q9=H+-_FI`Ryp$br_ny@#%djIUbmZf{_l|n)|Kvke%tv`|BIV=9Y2-tX zivM%u<0q;H{w4C^t|_1t`xaqs@~l^hZFTo6`9Q!X1?RC@*o)uJYaPqvl1E3zH3u2= z3Km%2ViC`sHSJVa@a8ql!WGo;NnjHh6ONswgsWMPl=J#Ws1>|W0?QVELc=8mxT~^TVEY+TVO);PtF|5Y5_8*H z($Vrc^1j;IJ_73#i-$7QOV5)#fb@#BF9FiYgZf(`UXrPk0zB7dQgGK40mdvB!X*_L zq}a^BJJ@(#-FoEXy`ih|o!S}H>}q3Y5qW z?9C#YL$I5PJR-X`z-u(0YX~N6fWO*Hc$e;)wi?O;)^jy@DJ}(K zIt2nRit%^zarE76=o@!FBm)~9=3*H8_AjDbZ&ROAQDf)v^3LF6@R(TAa21G!LO11( z0n|K6D&#H4kc{HQaffk6DsIk~-8bwXqhEMqskwuX(d_IMM6+W{Y*|6bE?Tx<`S?2?A@+zm-7N8DB3#M0ocCtoLL6|u=Plf>U1DzN*Zs4qvSia0k&Hjb z%LZGTtI8^y7mV|*HwZu^wqPgzc2~w0?7{b5T$5O}A1VXi)iCF8s|q4VfhV64JvxDq z?vD1VEi1tvxlTe>3)MRM*ZU@=P7ncB`v8&V4T$c+xeVV( zkG2&cSL0JINV=ClAVV=5_myLhaiT`MWb=gsB|P|apf$5$z=75RMyggdJ1)jYSHn;? zYheUG%HPFi*t_B4uFkVC#(!e(flSd!WE!htG?{aD+98Vb*LI-8nMr1 zufXKK3LYkG2qFeU@7jIVF?d*Y8L7|y#7ISUPaH#=}!iS8c;Jt?`rwH>O^YBh^+sT zC#eL3AjmrW#c|`k)`9vmIbZ{hxmv9K_v>x3TJ6|e2RB*Qpco8*NfnMe8#(6ibzCqi zwx@=wW7@=frz`k+28N{D8~5@yGR&yB>1ex&T+hRRPmNr!XkIc~-{BBUeTPHiDF~cz zfa=my|8y(X(+RWE!P`7nvqHQT=bsP<%wE#B8PMsgA>Q8ybb>JYX+XMA;&zWNlwJj- z3#GRK=|U+JU9StJL4b6j#89d93ndertsa6{9^#$QaJ^vJdwZ?9Os50~D%^KNa0xel z3L5#*0+fimqn+4N7*kx1@ra>-nw_B) z&Gj%MvFS!XSCoe>L)d>nKkL+hV$h|qM)3xYpd5c%q2-uGXHpMALXydx4*EJ~Cjh!e z^a7cx5M37vaZ-FnM(-B@sipZJfYj17Qyo=TCCjoS@e42MypTS~uG_-p zT}#iAN>Xecifs+K3rY9lgFITLU7!|vq5y5fwkfr(GF>)75#iQ>op9;YaGWlrOHnU| z{7x>2#1Msw+Q#xih){%)Tl`cg>)BY&feH122HXXRnYsYUc)P1g2pE|XmwP&P*!wueMT2hleq;Jfm!=< z!2reyYQMh@NOd(&(S2X~IJvVDZ=@-Z4zoA?4yIWMFJgquHZjs3Z>gyZmG5dCgpH#o z_uYwMB?;Zb$@)@7%}$9J(OrNM;_T=Y?eS!;l9S}> zz5@u;6U-f40cy{aTiWwK0`wE<`4<6cSX;^n#(5>PT0@uN6_n-H^7Aod8-|1~sOf6R zreHLliYGN)XcuD5yK?w+kic$Eb6#l+e%qBh-ObbqUD(C}mdcQ!>mWtwUP4)FI0FCI zd|)Ue;M=DhwLTDpTtmAq2I5Sq19^MX<~H`ZsGNeCM$wcYz%dA)^t%XOg*3esE+cbj%@>}ywem#7XrNaqD9bVrqX#6^G>n-FN6O0&H5}z; z;$nSlB?NSc&c!B(n-vyG0nabt(iZaZj#IqfY5gEGT)y94_fzs7t8%a(H+>$;4AZ>| zB{?5@eAgT73khfGSUx7~?!~)Uegu5Pu|mVkFbKI^cEpA}Ao?3y8}8BJ@`H`X!jsTB z1_3a+VfW2&`4-2Xus2-3cg3vEpF+QSyI@$C;Vi|Jj7V{NI6mYquZOTdTQ^c|f0yQhQIesm{(x4O;gGLr{g+nauM+pjxe0sgRXwTBIZ zLLTD%v(B3LR{z_Vt;X!|buZ2DT!o+3c{gM<&ImvD*E`qWJ@6lYdnk3BqS-ZoFTKKs0 zMCU8cJMW=;oJE_NV1Dj)7PZRHtld=VP)G2?`NQ)Pr~IvkBVs2yQ8)nt`^dV83v&!? zh!pP+LwGPR*z2BvuB)a3fB->uAUF~Mg^`U2s18N|K8yFkiWGE&%Ud7?9ZvbP_U+7v z=4?h-2+91i!u>08xP#hX$!p3Du%P#`P&gRoFrZI)+r~CTDNG| zkCD~wXx*1%Z`@Y8t8&q1F9DY4w#w4h(4r2ewC>F>?O4=G(6pJ-t(=d5-@`(9kro%m z;b;r?dGH#8eSEoF*f8FVTD(@uUN;dmFsC05xGzoM7FQ>M+Yp1vMKSv;}DFI!e(Az3hq3Q&|~5F zdcO!nzNPKiwC@MHP%?-4HY)Y`L4VZf!XIZt3}uY%0@MUH7*CY>+mGx0sG9B%B;O8( z&73Bhv}z9OEX{F| z58Vn#bNmOO`|%gBe(k3n0;KxwD5xr(K#G0n96)NCV3A#hD#`*o2f)cf$3Hk*;&eN~ zSi)nSdOa?lEed)!oxWk;UWLZUtU%i!QvSBRPELxWPcf%aGTTwtFEFCXmkx0p> zo#H3qW3tx{0Rbi^4j^IH_YWZXvwqKLN;$}IkVhM^dk$k*XZ)(9(?^`~y@?+C69}S| ziGH_t)X2X59@Z@pOc{w`s$3H6obS&_CIPQD!t30s#ioE=Jwi(~TO`~ONjXi|qo5Vw z8nmss$YwCwWH0PN`QM|>RY61lY| z7uIZ`A@E>EXXcn~NXcx-#ZoJ?A@BfGTGnl|n_wkk3)ybsG|XpQvcY_B2$Vk8ISfBA z`sFZYt}|}>!es#`Hhm#d;l-SQRb8;Ucr)KOdvz$f50-o=dI&N7J5Y6)FrAa#_UN9h z3$yHXj9QiY41-g%aZq*BbDmSSHH;Z$6l-R$yPHjJdd@um9DiW~#`Db5mPmX^Nj1*Y zEUQLo!-UoVI!Nb9qX0hFFne-*Y@R&H=M(sW*pSH!i=S~~==2FV+$zY$M23MsVKz2g z@Kq7PF-mtrK_w3M#lUa0Sny|8#_($Q!JPxc?OD<*5E8y=5%UGG!0vGS1nH(QjzEUp zHuVk61XhW3!gCQ^Vu$-%Q~KaQTV})HP;wuz=Ys4AMn$kAPQkZegt?w}@%|n51b$R_ zJrS0k2%{&E3cG|$^fIRy(e8)X8P_Iv#*4zn*3PLe-p4MT@g!1MuMt?s;*N0KlGOAN zl4x`m!^A(>S%^y7>%Pg1>5gkIjgOtm z^y8U6oQ;v1qC0lsazgNkJwo&`?2t3@o2Q)dg?3`~IH4dC4_xNNVC>-F;)Dw9h-ohE zmt6LXju!Mqko^MVF>FRo7$XNp8Q&Jr%h2idLB;eCje7Q8=s>IAeGhTKJjd#?Km8FT zgKr(gxfKjz?>&m|YD7|1XXOx&D?9DOZ5&PX2g%l7Zg|{ej3&G)*YqJr6{Hj#-Wq|N zH>R?+&aib`!yFmum&PwVlDr*C-r8VKS@DZt6@VJ7s!>S@`L>2r@tZB#93Y(pCiEAt|H+z#&|e0j%kffHxEtq^zYNr1h_&tul_ zdU3rPg+1=0hh+D?QFMyTwKOi1qSF{Okm7##xzf!N+`&yj-5fd_kh*lQ0Cb~RQw@Oh zTKfC^G)~!nK7uye!+@3u9>?%olJ*p!dP$>Uc7s6N+R(}SB0##C!;9>7@@5{g4Rs)O}Tx{U(baOC!t~vo5ehherywd-KD{%0?@SNez zP1{!G8-&T2+&tH@y)m;B4yr6}ebkikh7&}D`I&^6svR63pHPEBR~>0@gq@az!n}zD zr>nL^>nuU<1q^(1U+StUA#L7?f+%{D60dA(Mf72}Y~o?9D{pPYOAi=(nkG9Pr}ics z9Oc7ghh431oha4tj6YZ7mlz>JpbE{ducvSy2>%DbFdpXwxpsNfy))EKRCs1;ybXV zKwWt2`y20+W1Lvd+G{6)T)4QMegwoLVSPLPAm=YbE@Mi3bXmCkANK8BJIS8n?1@6RUGN{bbQ+u(STRZ-_7kCQC>uvN_t_!uW24(M$tUmay_t5?x7ZnR;{d@+eK(+J1~Zsu z|2#(uqR;=PelQ)a6H%uC)l?AP(XXp(Dv7wJ=r&2{5$=&Ov>IwaX95JDmt#p{uj7t% z^pa8by0-u{SHiT6wr5KBMW8FoI!{jYwnUHP>@;4XNrxSu*HY(~d17$4G)?yJD`fv( zd7h-2(|cvUiK3+~QlwHND@E6bUA)2`=M}@{@AJ^Ee|pb9<6O}^wrp!9wzu~!d%vqI z>~5hAi48@2Ekk~t_*{gHZ$}sZnqB;B?~t?L=^4gd@-4*c3U+ z2M63h>R2pHurG*3C=T%AM5}+MPXa_LnoG7;q&?}3wPJD7f^;i8C9ziQgqfvhH!7M- zw@%2wGrEcJ+H?9r$PZ!9zT5x7RwCfxP8rn6!A>0Z2zIJKu#;o1?bQ7n;jSLvU+?H# ztiqE5BXr87sto{7rzZ63Au%@s^g3-OLaI2q=^AwoAYIiq`DsrA`VUk-VD0yz_W`Yy zv{L-PPM~f0U#G~~81zad21qGy1*A`R`e_5;2+^tZG(bNPDrW-vo!V z0Sgm^gZPDP_@5t{37QIs(cV;I5&@P0q#oZY&kS0HqSYkOW&<1uG~RI0B#-0qgZM2q zSRZkJCi8-~OLALSbj0Xo+46ixB>r$Ske%qyHsH&S*puY9)~SO}+M9Ociywe{1VD4+ zD@H%g$~p0$30C=Emt#Ze6)K$M-PYaolJD*u@`y~A<=wOlHlSinl0Eh?3vpuKU;%!N z!$3PIK@NyVj~iurFY`NqO62Kqj7il`cLP%W$*qdL zlH+GSw9SWj@2fuj10dD27Mk^Y$uR`b{rC&WJ1uycJ0S0h*P5=!lj|jor^kOJcz^bx zqwqxAF%FPk8AHvZcsx8~-u!?gV4l*D_pxo3_XuZ61!NJ-C|PsQ9e1u_BUeOl3n^XI zMY!Vv_pvavigZ2bzfZsekfw7IiQmoc$?M=JGF5G+G zb*nvt*6dAKh9qrm`>yHrJd?dz`i&R8Sx2&eCjq!cm_OTp%Iy$M<95gm@^pz0t@NL+ z1*G>0$NaRP0D4Qx*aIkleh*j&0lh3~oOiTbUiP4QKLzMJ@)V2W0zCKUN-yy2j{4+O z%>~@r*8Mb9*GT*Cb4w;;=47#1SqJ z#F80zz2N9pr(;*|1D_-AliF{1T>P8Uv7nn;=FEH2$;jwL`2Ilbm+Bh2VR)!H+ljBJ zak{p1=vk4hze8AV`?_p}(+%uIim|B+J016kaosBFpludV3t(OZa1woHXods|K+aKf zi2hsE?jF?KzUy8Rgm~A6e#Yn{4hA?pwIOH?!W!zPz$j z&Xzce2&0U+hA4;>zeYnmx}^wBn}c(x*ZFPhvt#VLZUv&(IkPpeK_WWE`KdjFE05VT z*sEaAyn)%#YY1y>dIpCYrDtHnvu7}DhT-@rN8C_!3wmdEa@TyVpRVDE@VW*)qe{v2 z4OZP=-)u0IpN(VNv)M@n+DUAO^iA!0Xpaix%7sONu3>A?HE0dH=3T~(Cv}aq2wf9) z5z&?hqrO$IhIv&UqXpc&Q} z{%1agkjgB`C3Z;#$^kSSN;AvK$PHMzW3#Q?G1(lN)_DGBKBxG(6k@IuG*?nN7kcRU zKGn~m5ObW|Z#i55XzdhYuG9N0r^wHt5ObW}Z#k#?xfEiqb2S%2>H}->6Q2V4U;pF2 zt=3E-<|yy8W~2Qa3Nc5h-Hjg_vV{ zBFD9gSL31MyVTF25OZ9S$dRTDF59#Wg_vWm<~SzDI;H`C^9NeTK;DiSleY&Ctrq@g zKIi+n6=LoMiSkShFZ0mxJys<}GdDD*AKX}ieodfH$YnhRgpZ6*E zb1TH$H%ji4I4ba3w*fPT2(p)pzZ5sMn=~8yp-YPmTBw)aT5kBnuZ#TNQiz=Tyw<8) zZ+W@MLB(ZnDa78=T*PvcYL|}wJt?jB=(4vGbx??9DP7XMsvo*vGjvmX%cI|Sy-9m{ zKlJbY2=yk-Tl%5I837h9~j>?wuVQ<{rd-bevxp0gJc^na}M2V`0UwhWQlcsW?Q;-!|NIf&JP zKkuWMsk9$e+CWLJNh(gF1f@%wJlW%Y($Rgw&;=#(1AO7<@OVPnd<~EHNk{)lLqAjL zC(-VWC(3Wqoz)NR?Ls>PcY@_i3)E-TX4bGK$9dJkH{EqQ7bwIscWI5-ORuBF_;@+^ zRPoqL3Q-m`2eD*bh;M$<(SA{BQy2Vgh&5nruF&>!rBc=WlrYUjtSggRoR0o)3^%pT z9$iX-VyCu1>5^t`KXhO7>4KEckKX7iKS*<7KXmsQy4jWmepuu;c#>QO`J3Q`LitG3 zGD!dSe#-cZlp$8KrWO!BEHL@F6z1Lm2eaxeGL@g4SaD8w8CHAjA~ zm5(y>QD#2M%pWs!|51B_^~}ucD!k8RpMpZ9aD-Bzt!%in)I-O2wVy*F<~TZ$!&vdj z*7X!WheFITLUZ(C#q)|j9ft}r7caC0HLtY~1ckn`&k@pXq)D6e5KSq>S#l#(P=t zJ;TqX5OYm*P>4C^_nG5L zKZioh@fpd%;hb3LCf93@pGP6)S+1pU=o~U5>#xP6NMbZ%Apg3MA6ac!*v z7bJxcrve%w&}cxbgi6j`)}YMb=Z^Y9X3+GMaG(GP-bV{YK2rs@@!zEx z$$iUxEAMlS6v7+|F~>JFhp4}Sz7s=sNlmtE{agw$*S93sNi;(!g7|nj_*C(zY7`0r z(j3IP0Ds;m9qsQaZG+;`WvvtCCrVJdr0IA>eazH6_xIbq+9jwevZ#ibb1(}(v0_RyJnW}?ELI<4) z9Ryv3X}WJ6^k=`OuO!v#2oMU$T5nj z=Cjz(p%8OqVM83|*U%hm=zRRm7-$WJsWWtpnw1N@toXj(&#e%14?67JH~6^~Vs2Y= z_n|SD__-8fu45!uZyHnas7DmyNYEVABNyV&`=q0NoYFQZ$r>|Jexd}WOPZH@MDd-D z?n(W&wBB#2LTu@2eYRBb*iwbqQq9r5rRiv&*=tJ^!THYAYC_bgQ63xh~QA56iZO{Vm5j^7TP*kc!RW=OjNA zpE^(>E(kOy>EDGv?~|^KsuUi1H9}S zN}7|DtI=<*LTv3K<=jcx)=>)wT1SjM#ya9{UAZvhwfJK@b=k;vHVQrf>+k%}d{+3B z6(Z#&f?4FDa0cV`@49TfS)fdrJy&zy)Ky~keb$)F`+6)8lNW6({h}0NQM^nZgQlC& zFy1Q~-#7WW6k@J*nhUq=j~F||3T#&NWIxHxelCTW>ki2^B5BdWe0-uN20QKF1c&J( z_@DXQ;!{(IdDaVNEiuTTugK5L+CJLR>6!MEI$UZ2+PaKb}BvxfkITDnv+=T@aKKfm9bUJ zFdo+A9IS!nAYTz0NHln(X&WM|*dIb~j%4Mq7DJx;(z=ebUi>#n6WRhyJukAAQOX+rUrX{Ym=C zKE!loye?&^shA5>aS%*Jn2giZRQ#$IBmb}SB~BsM4D9OO6qv zXp)YxhGvZJ;p5|F7?e&`)|AeFNFD$dPgQ%LW}mu3q<%m!i#!x!cS#cULnbh=k`euI z22obadZ#t;Z~Q@xvCm&9FbYkb6{^u$A=M|j-_M+x{Z!x!nK=bIq{n2|F#oCi&wP{) z1y>|UZa{P5V3_qoGo zfI=)~uwWK>C}hA;Ng@M=3lvN+;J1N`iCJ_W|NkQYTP@(936dd}6afyJiH%v0mNYVC zm_VExc!6A&#YOSk0u=&Mb{+LnW_Dffh9Ogqd?{WU|l3+vq?JLmE^K zg!)>?N~M!?oK95p(c+jxA?7IPGlw>bITT`!QzgfU(SxmH=g+c^9Xr!HHe-r)^!~g( z_Rb?(64Ms^7~o23-;9yGB==1rN(fdcVD*tI#8O5JW|=%U|FM70m1Oo$nLyOo7Ymdm zswZWZEoGj2#VfsEn4IVq8&6bDGXnu=3u&5FE<`f(Rx_b#5GCh%$(VipfXu4~XD{qk zew99(qYwyLA)z)RZ=jWTt%N+(=hP0Y$u7Yo^Px!Sbjm?nE%Gn8ksU(pqw1Bv0AglJ$90Q-J40u42aLN_*hv$4Wv-+-pp8LpeZZ+nVcK4 zt-NCgS;wv&wtwiJqjm;cj;ueTc1X?Or0TQMT77o#TqzcS6(yg|XT9I83IWNwLNJRw z6xRM)Nn-662$U&9jst41R5tVbDXjOK?jw*vii-T!LLo9@SdKMp>`~URFCMi&xaY{7 zL+S_D;-P#}S>GV|d~hBKna|yR-4!C`8w9h5NUo4%*8j5tQ6yIjlr7y*U&5egxltm^ z%FN7^QuyDkf@DPQhwPo*(%_uhfRh94^KX8`6#|lVr(hO&D8#-;lGx}k3#3+k zEgQ-smswW!A1rJNeG$&+gr}bbfNcbahR?l{nd!+!^S}FbP>6ZHCYTF}$`9-CUy{T+ zd{>}^;HWmuJU%lom}3PI91)y0WPk3S)VU*73?2{?B+c_s-sdZRO%wu>^?kuC@=%EV zV@YC7HVUL2Um-K*9{In8oMGIp?vJU*kbxza=7H*2sv^BcijL{xt2S;ap{8mqWZAX-BshQcd2|7e(EM_EIk zQI)02bG{?q4B9lLJsdYH%0}!=n`u zS>_pX{Q8#PeuYps>j=SI=wXrV!z77qA0bc=+5Bu~-m(9WySD&~qI>_wcL6a73$Yay z6$6w|!a^);u`rNEK~hBQ7O*=ouob(-R!r=`e(dh z^bCWZ|JeZ%Ox~wOCDLb<;3GSB?rUaf5NDj%AdjVSih<$~hNq2$2aW1Ou_a5@(4G9Q z_h97G#Yz!9l^}Y1l}2ZoMyk-D5@Omb;VJaWIym2T+IX9z2@ zmABPGlS-i32sO)}vG}7d{1V;dJ28v618AElT52*wv7gQTq2g!>! zeSVr#Ka66<)+8Wi4Pv2s;F;P5o0;Urn?Ad3Y38Q6G^QST-jaKb={)mtT#c;Ph|H-3 z-a5%LH^t1&FOkfHO;C?(!;y&UK;~3}%$YWkN=4#Cx6O^@1F6tQDjRc$R~knIvQ#mgAFu%M5b~Tvfd=L zs03OQq#D7`i<8DRU@PT8ji>}Qq8h+5mqnz{_B2I}xLv4`TfrBDm`lwYrKl4)%fT2un9WqP&v?Icj% zCbXyoTB}hD&!O03W59$h^eh3YyB#@z$H9WN?ZO(BKxZQ|LpcR1wG$yYO71~Pb(B1B zP`sqE#+00=m~K&?^L8Uj%Bz4QA`vn>_?^zrvN)cL~>FmlCO9$G@5EK zm)x19lR!Jrl;8Ma9D-5_oSZ>B@MK#Fav@hJ*iuu7d^}M|TSy~a%8-wo2ot7CdNBi2 z<#p5}g65noja?!QDuIWK$W)|p6Co(*9h9Vk{-J4fGBhBc7-W?PBN25fftUMesCaQ0 zaQQX)w$P7Px{xi<{n7_h)nw7`5z$f!>^wy~@>2mUQ-R7p$;9-+diR1 zCD8gvwe(E%O}QFb?-!a>0?qF-fA|QTKPd1IjzLZrT2ulpxCLRT!H=-v0-Q9i0q-ae zDn%t2vQz_DIFJA#O`mPJ`XaU|LD(fhFt*YIwF@>EFb!DgvulcW@u^i0N|oQgJtVTE z5_l@%moCanU|SIh{73RKuJ{)a&=pTeBp^qDn;ItJIb=#LNLgr z>$sL8ih8muhm#@-DnS%Ykm*7s(V!r0L?m7)k=;b&jS{;%;36xI{I(D|Jtp1EF5E7| zH+?mkI1S}V*Gx57XB0&~^pviAl40*#mFkx%yWyY5sIYAo3piJs(>wETMQ ztO%S+5O@-56f9+`DHTj!JdTn2o|iJ z6CS7p9ws4EQJUEZK_|^cNw<@Xo@>hR>(rWHT7C_AUihFA_*j5ubU%XM0IIBA5L#3M zt))~;c4gqq>13TLG^hj`tEdKk(J7zC+yTGn6az|SVZqu(p-Cms+<=Qp9D#1{sTEK!|-{ei7{cY4fqj0+<5M~WxpnBko+69|i$%{9Ac6Vo)aRshM z*5p!>%oN~_O5iPBZ^m2;qM%&Jm`ac_)dJRH^5RXO{bP!Zxm{%pR1bVnyNijmof{=< zeRfaNjP;y=43}wM78z3sGR~x$vhfru)3_ous013n(<;D~<`H;LPF!(G&+{n{@~0BinrZ+mP&TRQv;C0TX7;#UsIcT;@<8o^ zP5JerKD*Cp)=*(`<(H3KGv;!lp-h%VbWLPSCCKhA)zrDtT+AYb)pemoCD8gT)rehb zE(R)Tu$A(lMpS|tQH{k!`bl2A>9hS)QKQ9-3N@1aOCG3Quqpq5U!PqAa@&BM=;O%H zf2H}D`GVCAku{YduRPR(&gr+4OzWo5q7rDC>(!E9Y2FfAR01sv)XM%!lY9w+WCSe^ zmvnJkSfdhHD}l^V&Vn&f0UQ7x3~wwu2T92O(BB?#{U=tWLfton*okA&L5Em3%EM zyU$ZvQxc)eKTmlqYC%A7 zs0)7OpQkW=f>H^h^g(7AP@&=HDIthKh~)cfq&sr{c}kq{EB`#@xu_16z;6^XRU@Xq za6JemsLlwK)Sssu!g9bsVk1QMdCE}Kk$;|Y9@&5YJcaULWH1dPjYexZI4z$}i9{uc zym)&d@~0ByKM|RsoB|_b7D7<=WRz6dkQKAkYhjH_U@aAyiYzxF1X*rHNtNY!gM#HuHRXcyYs!%)q|1@dgUhuq z{kG)Y;^&K|7l{F{(3EG|dqqT>WJkxhA|fh5L}|#hK^tTN>;odALo^~d&S}zNI;wz! z#-Iqfqm=C@bIyz%+Vim+=4k8bvZ< zNM%vVsz~XWE10D7v;HEHYiT&J6dXZ#ns2$GNS9F2^d`CS)Y^bt*c+YCw>QfQQ8HAB zO5m?N+SF+A=W_CrpUWXXnM1xG#D6Zwi%@v`B`QEAP_KsSc$1Sn(hZGkz*fp56edAh zR0CKG$cs09w(Y5HM&WiLe96D$f!YO|JGoK8RO&dR-R$S4M#up})-r3qMFpq?Io3m_ zKd@kzZHjLVYX9Y_ptgGL{}J}71ooRFGZgGY10U@Xg7MXfdefa2YO|w35ppyrOpXSH zH08GZ?P%aDB7)z6H3pQQh~=pQG=K>t0(`<#x&1LU^YVc>gZq zlo1u8AvyeM@s8VcGMuzHJ=9%*F@Q_LBq}>JomnF!S3#e7dE3ipQHeP zv;ptnuqJOX*76fJIk*yOG6{kV*=!o{=OT+#R#O}`v(o^6S!6+XR743h3!y{=MT2}u z;(nO8A4%MgCjK9%RtnufYV-7_CLBgYLnnduu16zJ@WtJTV9* zh?+{UH- z(@n^VsDHyKp?klg1l{`sB^M%nN6DQ?zfkfd(odAy5$O*~U5NA>B_jMkZ}Uaog|p2Y zP7<{m$lDkt$Qy27X*G~He92C$aVL@qN|1Lxlpt?2lpt?Yl>CX5AEi(tnWGd#q=G07 zAW{L8h>&GlBjP5H^RfP-Cqw#F9L1rm9J0wC=oc8!H^j}24F15dIIF%Paj;u5uxCJ6 zgc=Qr?#V%YJ~#$boF(yMh|dSk#3_iJ@8!6G{yfymL!|a7!Ffm*lnM~35lV2en)T5V zQs@^O;?9%G(NPGxSKc6$Iq0kyk&0qc^6gwcEXwPI<>k11eNS*s3l1dnzoBJ{*xF!h z5LW|~Aa8e+tccVQC8&}IN;Qep2qhOHHAcyuNKH`kBvMn9+7Su<+)beC)2Wqmpz=1#U|U!RW1^C!Gc zDE<5T7>LQ?3|b(jG-JujCaPaVL=|}Vf32kn*Z$}lN)><-45dJntcVnZ5|k20a*}O%|R;}B#ZRgd#Lr3!WOri{l zq|w4HEh$<_qTlQ&qS&f1D0@>3Sul1=qLhb7QbuIBVaqNf>BbL@3>0`)+388Qa>^(o zP24JF0^4~k+0{|HEkxtsI=c4d?;-x$=nvv|MG4}E>kKJ=t^qeR z{(2s+n`~XZrnt!lxD}H15Ii1ucFEG9;b2OG=JsINW~bK#y?~yl@W*vw4JkIT_G=#9 zH_+WP%WDlDA!tAeTk5sdMuq;H$mBl2kG=-J;RhBC@gBN2O3;09`lP@68d#Id#jqeh z(v9woJ2kL|x!x}>HXtmHyr=nQnYG*^cT5n)va1Zu5c-T} znA6Gxp=TJ_JyC+nz=@eW4+4=!d!1H>-pdN?*YjW3M;;f{Crq!e2o;)L?lcF;o#p^O z;2qR6s|LPf(F^3>4<*PQPMEXLJ&Y#*uQQiN1KtPd^+Y!4ZG({wHin@DBV;5>U~7!9 z#beK|UNmp05Y3wi8a~EA1~2VE&}q733^vRA6ZG5x)M?qxLqN?+Pj?;yU(j2?&#FN+ z#$z>rISD1`S2*G1wUKn?W18Kt{jd9Vs$Nf$Po*>i*^tqH->)=p=vSJzyl<3VrFT%T zxflb~YXM47FSz)~zFuTEAfKpYGY61kL;!q#6+q5J$-L>{p5>$|AAAtdBE8PZ25d`l zE0j!{CU~mZ4SSj&`iVr2) zpf>=rA=|bYwIE?SpTI0a#~s+D^9dv>%_qD#*%g)+2ntIJ1ce<-UR;-mss{dcU^L)w zH%d@gxY*0Su&|&0Uo7lCy#c7=*8$Q|3lgR~^#4p@X@Q`yv_O26>o`}ug~A@gXrQns zP=dl9)|;1n0)*2YKX0A$9Y61XdBSsAuOCH-U5;h}+0!h*2juj(UG5=z0p=5wAp3hN z&jeJQ?(sw8zt3GB59Iz_uP^YYuf0Mx*m#T5e{<49Glz=N%)y`hxC36=0jSgd({c70 zBZf+ULkTJkx7M?t-00kv?Ko2$Gsy1wFOI7}_4?-t|G}+L2Wc$wv76mkq?tlxX{Ml) zlj%PfxqD78%JQHD6@r`j*;hz8{bxBM|3#H_53MG8V<5q0+ssi5sz*mHj8!^nVch?x zhgMo6s4cA#?+*fG*}xxtoCHRng{Un&)*{tbKK4PQsA8+G@e(3CdglnX^H{PQ8`5Jf zG!9+6FvsE(5q{(}F{D>??7%Ef61h7t0RdOg8*n8Rnq7FMkqzawLP_oe{OD`on?7p- z<*kl-Fm&Om9I3pLM5C>t*s9MiU=GNFK|~7xZa`kW4Au?O&4TN2 zyZY7;O$YP`*>^?>vWF*zvdF$^Ku|~=J|dB2zH-mtp{rhNJ}NZ3>}Zsb9gR}%gMfM) z_zpxbkX;B$kR3d?q(8f!keoYx4oYu&;8v~*E<*L1BO4Sg99htQA$oHMuDtA!dw;za2dU71 z6QA4%_|(_H_XzX?T{{{j=vsJ^Ox{0K7cvZr8yFLk^|%G6x-(g#USrgxdN~f+V1srw zbPMfj2v+K99$t1Op{YTa(bRHUk|`Jilw>+eP!f2kjr$~TS%aC3+`)#T@O#&|MS2t) zeCnP8&C+X&+sta6j9O3`S|g|otr1j))(B#jYQ%dYyBg74p++>-=Du|nYr7pWS{Bo$3NyZGMdO07Utiuspt&vFRvF^$Ak{ZA5kZ!Xh++LL+6}n ztL^{c(RBYy&8t)hjeowGuYc_IK6pMUHQcmF{VC2DpXK(pn|f*Gi?Rg=UCup!fb9~K zit`)9=G&{;B7kB~Q<_on&2j*4WyIhR+KBvcmDHcdxkzoC4Q; zI-lrknsjz@XO9Clp3e1f%v>DV;bVnU_o{Gze9is-tZkX04e$1p<9yAxuZo*$cpR>a6+1YJB+Hu2z!Jk7MsveFm;xg++WU0#4X3PzbNOIlOYEIge zOEpJW>^|x2xqX=R%~sZvUMyAJu+kPme z`@ZGNb`}#nZB~{v4Jc@{Ag!qD~`SRVSVR5=Rf6w!7nXgd#zUi+D za=Y<|XH9=le$;)w=KLOpzJ-HrOE((T!>HH%OS6yIwtVbb`k>|hSHJ(nm9%h1WU;E8VzH;-PH-s%Z zu)9HC|0Ss1{<)g%rG3MS?0L`a@%e|3GrmrC51c#5q}-`ptLInrbz0F^_kG3Yv)^71YS59d zXCA0r=s>4sc`ceYDN^!UcaIwRd|T#jeWmompAN+vjxcS)?ecZc9)qt$#F!V(YVDHn zaD4-N-+nKrjEH;S_VGundCLn|*>7e&|Eo`#7gZaSs2y1Lnfux1MjLzm6L5QzNp$R% zn)94}uRlne5nk43P2RO>J7;Z*-+$I5VC=m#rxo>sj&3P;!#U=DN$(m{7*SEmln}UDYuR|dtZ;5vgtw9cE%&k zmJM!L)Uo7^lL7O_Op2NB;S{`Wv%~!kf7{Oe?K}7Gq20=--;8{&cN}8ZEY9Pm)$eDf z4g;(EoXIuq*Dt&0WeXY|8ur?#b~T>?KLbOS?iu9weyMrW)_k6PGkS^N8}lF6mUX`M zWp9ezJl=n!f8VO{WR`Y%R(SmR2*)M4KZn=OAJe(QxC*vUcDdYNQ?&8#bMN0+X1wfF zeQ?J)hS$bT%0FU3A?NMY?ng|zkXq$ktz)HKawQl)ecJW1$$(~c+&Uj?Feo_vsohkY z4ZQ#OdVPAv_bDmS&r^$(F~5Iv-5wtAtmm7)WKRGUqk10KD+LpxZ+Q9gJa(99M(-KF>U3@YI`4kA^sdH_!yVl7Zr-~1(&`Hn8?Wj< z@9E{fvwhwiu<~6}=6RkW*9%);(B0nfSL&sdo3WiwUs+W;@xkK_`8=!bu3!E8)VIYN z935#C8c`q89T35?C(R-@^+ z+9oAm?P*Z*+^&wTH%I0xb8i0Tl`GslhNK6UdGoW$kdS$Q*5@m--ypoTYdx>o74n)_ zu3GD9&El^9=WCW3c(ibAjgmJ%SG*q8=3A$dEe!5oU-O~Jjhi#Xyije_l!kkQ{;a#S zf4sj}^Y`f$y1czG=~>%xNhLj-lv)~n`(ExV_s^93*>BA5?KhT`@g4ahsfDd~XP0Ql z>cjUr^?7mKwTX{)tBaRzuQIOFeedY#Q+)f&Tp8w-2HVd4x7)8r>{xuh<)_SA?H4~; zS}gJ8-|Xq~ZO8U{Yx7~@r#$mLi&wsUfA*^5ArrmquGH65YqN22*hn|s?X@13Jsmz$ zbL+r_wy~+L(glEPw&(4pv73Lk|TfBEqEn&tLZHcmvuF&pUX3Iq1%V(V%85w z%s%1~-+bwk@t)rX)+q6a|EtX$d@imTbUp8do`lO6|X55}( zT;4JDcWtz@%lEPI`&%{UcfC|5DgL5=ALEnnonOs&OMA0D(>Ol-qv^>GLofAc|2uKz z^Q|U-7OpACw|ibKlX>chl|kvl^#<+T-FK2UDtu0bdC!eDyH|Nv?_gf5_D)Nxete%a zacc2ltv;MC_@<^q`3^m8-sEvLt1!!BRd`TFnS9!5+NfQXv`G%GL-${MHNncK=ImPb zX>&Cv2j@H9vr%*R#hon%SPgl9BW3cBu(F$r6s!0mwtb-eG>hQ(oAOS+T`P6k>3kDw zZol|&=@IXVN3Xm5etrH**fPt(3wEr?b!Ff9N)PXZvC%CblbK#Z?2G=X7=NL z4=XW~Z(r2zMf}?1+ZTbOXKVj${BVBzmj-{V zBM*5F@%eyz zYs-JDahJd6`vHHy*0AG>XT$DS;_vzPv>C(aoqAKI(7mbMAG!`$x{1db` z^Y>}53*-&;x>1F{j|;mP6(89wNcVk|lgWZVTL&fcHQ&zl`MBr%t?qW0_=)vSC68*p z6o+KSBEy6uV$p&nH{Y4Yn{UDe6?j*{Dsj&ta_Gu)GH<U^*(RZ#+KhWkLQ1RSf4xB^EHdjD*wdkg(t6i z5Ub(w%r{KGwS4xs{Cf&NKDK&vdUd<1!!m=r=kw5gpH=>z<8Cauw7E=OUawYX-aJh3 zDf<53^7;N^-&C7aXJ*j#xQG_+OAaOl7OmN%+cDSG*2}MVuxe|$%&f-t&^c4P{><;N zZ1$42aSjvQYR!IXwQpYL@IA*~*i0zc*xTI7^;OAXl}^>3S>)-wZf#0W8D6HzuKOle zr?y+$W@)PP!qL@_d-beW_IrhTjz4x5zxs9J{D&WQw29&U@vK_m!*A}F_o}k;&-+y^ zE9}|%Au+I$_x+>1&cD)5nuUcmyj%Ut+;u0yFC=iitoEPuhr>G6vK@Yc&l?9%)#_TN zMW4*?{-Y073$C`=^T6Y)%l`>^ovZ&?%cnN?zPt;y-SE8H>~*U?HTiR-(-b4_*VJ#$ zqS>P>c#ZKM-uiB4JHIo(8%&|KaR$Om((=De4+m-#s-&fI&I{*IHlIgndy^~sK7cFgSb99^4 z%o8`q^cq+-p>Wz!|98h`9bVh*>-?8T{fgARGTwMZ=-E7bem}SDIdMSSN8>Lyt&@G|~LH{XO+`E2~Rmf`vH^^9dPpO2?KsN-C3d86kK&7*i->%3?=Fk;fz z8oaL0+O-Oq_G#^@JAKAI>E2+Nlg*esn}#17Y#5ndxOK()k%8PE&u?F%(U(An<*Rk; zb;I5AbkW7}bsD8K+W)9zi5Ugvqz*p(so8X1ulmCqpK$DCGwXAy#PBH#-=5^-;9^H7 z^F!tHW$^jjsNeUb!0 z-HIM*{NBuENWzki<616QRBdeiMwZE=tUK@G$NlmnL-YDCH+cKS*J;PKed!m{ir(Ec zV2ej`lTOtFR!;T@jcvoor&w6lkq$2Ec^9xxz({L6VHcTwZ4^hxl7}crMJ8Ic%B}*{KYZn z6+NH7zf#Gx*rvDjI`@saT4P0Zvs+yM<&x+>`fU61XiV(Z?X4_2IP-ojadynO zT_K&n^E?WrACLIs?s}5T-)R*Z zyKvq(zF+Whsat1$95X7lYD|ZP^C~qq$jn`{+t%)Uf2>ivdAIwX<~RBNn6mvx`_z`7 z?|mu%kNuodxxfCm`{U<}#b+ETSh5vvdQF(j^VqP^``6306CT}avT^8b=R&o3 zKk?%X?-#y5mJYM2{AAdOT7?cbKj*UW#Sw0YkCQnMoEDicSbUo6@%@(f=cV5^elA8X zOZaxn&0}&!jBI%zmY-+ppkCNfpEPtr`5JhWpZ7tA?5E`f{*k6+V8l+K-Q) z+5g9@^NM;)$mbNF)_s{3`^l{M(tT|<`r9R3-gWxwN%IR|hP&N5nfFQD^z*kyE==ej z({0?E8bzAh+mx?!wQyV;z8^Qay0OXIC$5$O5i7nHUb|(W)#73%RmWZ5SMt=c$hqmC zyZ4>&{{Fg6>Baee+%z-))ek*qzUTG%Z};Pe)h;}I-e>gqKNgxA&)mQL@xT`xJxF)7JR^#)|g9#>)nx>jKe%?HCc=3?O+TMf9Tiq{y zzhn3NiJucU#LgS)&F$=%m|Q=wVAHw}Pn~dX^Yq(2KCkopKDzVGVV^arYiACz<>TSH z`LoDn&0F{6*-sfbv`|*#;nEdP-ygZ6=a;?m zZ1+Q_6>qY#_poL48{N+S+VINUrr^=K>lSBaZ||z0x80V!dCl+t_|(X|%yhqX>X!#E zzdw01|J3R?$@Zl>1iw8sHZ*oi?e=B=RzKbCx^*d^|H#eS8B5nSuRY18TR>Q|mZ7iu ze_UN=4X-mlKWvpWYH!nwXVWs{5565+>2xuE{k8J-CZEoOj#qn?Iw7H3^AUCU_1CxF z6P)rsdQ;&0^K-|qe6Akr?)H6Sv-Y#L@axB_FEAJvslap$)4IF0 zqV<^CGn)1K5<9+LlQVpK_f63UOvl+2czE)`<#o-sx90Y~j?ZYbqMb(*uAkxi=6$gv z4>INrF-`jNpyDg8KefZ@uu)#quW`N9;+OYzshQZ1Z|Ars+4-YSrwJ4Jd!NL9ck^w3 zbY(-6*%sQ;O*WptvB#s6$K}TS{iTtERy2>dc{0iJ#=+wqo!*4mcln2XA{Hq7|!`FO!ZNpQ=FaPef<+@*4r*2W@i zm-8Cen6we4Qrs_I+s#gF8MgDH zhU@XQ?sl%nw_BXPS9#5i&26*db=Y2YO0_n z?ze5x#9!_G`>oB&p83jq2ffV0cNDdAD{9oQpXO)Rh*n36`F@Q|^Siw0V&~5zJn{~o zz9UzifrA1Xt#E2m>tvBB2CwTy+_h{nCZ@RY><3dl@+WNEb8WEihC?M=m-TF$l|GLr z;B2Wn%RWumoK+pnmi^iE&zh3)!#8~>bZ5b{%+DPhT#MGR9g@&*zDvPBLyzp7wIj0r z5c8RRa~rl@VSlE`_-Pxw!mbajpB0b$ee!kgrH2!Z9sgFZlv&Yv#`%{Rl~uiXzE3*O zH!E;!Z9-Q0@_KRq2VQSZ9XjP~v#j#w`4n<@tP|d4V86fRla-wcMo#A@KdIoARs1}j zztthDytw}JIva{NFZ(Svt2j7s=9pid>Sv^v`&&GZ``@l@y=+zL@HzRN26a4?qPrjR z{lg~ryW=h%7DNALZ+4%|_5H)ogj`B1u)Qw%U|DxO^Y}i_%j_I9eaObmy}I@Ld3kM1 z-Eqcw9tB2@EHGwXyT9@N)^EwvuC?f;{brI?{Nw9IrgjcZKYPAbkKZr+QvY$c3vgLf z`Kbq=&)kEeBV+8sg6EIRrG;PeHPpEG3<-#{t66iZRy%?r@zD`>k-_+M9YySdW6AH+ z#D{0G^sQ)E*JrxL_C9w=b9B**!xoe`=7T{Ap{B z0>?mO7Z)-h&N?y*IIzV~3x5>@Pu8W3yf~S9qnrUi!G~iF;r~D|)}m)?kpC`%ry}Kc z;BO)fwS^gHs>YK%TnOIf9PnVMg}>h*{|lmdeSMRkoI`!VbCHs-4!QH(%q{apIq<{a zf8)SUR~u@(lO+`P>5aJZayvA4h(e0F=;?!Z+ZAu9=2#*JemNe0blfYshnz!WE{Yr;GmH&O zS#Wq)>fBus4pAjWbX@pQ&F0Kz?Y567wn-D2Yksn)K@j+TqJqHnE$!3GU;T} zF>KDHc~wV_Em=Z+CZ{)fT218(wi;@oHo%$fF=V`&V}~4GpZpPDyyP4jPYvXFk`Q19 zX&G%cRviz_PKMgrWC^}9n)lCLLlqC1l4S8Ti#tA8&Y`{>kn;$Z zK*Bl~IfusVf*gJ1)JG2V8u;pR@gFkTNHwH+H9!u`_AoZizPZ#*&2dK#{4oq12lM~A@~$P!}qtG(Jw?W+lL zxGxwRja9yy=DV^gW3)`bs%*f3`_FrGkVS}HK#3dxShet)`YG*#@gk8L%LAr z>*k%tBrIJ!?Q_8CfE;oXhT0eN|3eNSx^_C|fYS*%xyTagqyHEOUJT*ixU%8Es4&!q zk|pdriDoHp)$w%60f$VZ#14!i@OP{3^Mh(TWY;Aem|?(IrlZL~HK#jr;0zF2o^cU+ z;_)F{47CwtiDNAE^-i^&9>`e$OY%DL&u2Yzf-iDl=7f08be%O$ZO0EeCS(b9K6K{t zLN&)9ImxgjFQ==s6V#jlv{M77^;dHO$reLx_MD&`aDtIjm@J__dvYDEp!OA# z15QumWS=`Z#FCgHZ)kQN)uyX`!RVsbL|MlZhMequ_0EBvaO7k^|G>yG)WUHGS_9AW zWFmpcPLf7Lq{-=XHk%UN|E6MUP*x z$l-I{o|Q?v`lyZteUa0YETNg!Z%|HdhtBil&`5HJCG5*<>IdglbNVSbKkbt()tvYo zaL8^zeDUL8)Lq|#YCDkK-#BC{`6~yG$bYkgN0YzAGb9Igh9U>gUWnA}6@05(cZ?0o z0cSXJV6QhKucW8t{nd6xkS%mx1rH~^Jdde4Bay@H+rRRJ+L6VtgfBJ9B`75<3yIAy}-T!Iq}rBGd2etGWC;qV1_X!uk>nf zzN+nvM-Ci)V83WRrU=>LbbU=g4jk!#6FYmnwVE>#In~G#w0+xH61Tc`CLxD(5*~Lf zY$xqdb0#Cl1D51fc*!M4HD`)~^G}NodiK+)Ip9po0f$Weq=r1N7JDCdP{%VP2Xw`!3zxbMqcIJ^K^kkY%E7JYCeF|F*wO)+l zQ*vdRnlm3caCQgUc`^s;8P9lDqa_mxHs8y24yx^>kZp$AG%dZq@g=!WSviLuFUYA3 z;aHI+p=p+BD}G3k9WN+n5!oWmnQ(th%~_0`0%QqxI_A1%spc$EaL(m6DWc{qRd50| zeF~~M%M_e%2C0SAoaG9ROa6r7YR(D;XPH@t5^@eb4z5JbZITo@C~2%O-XVuxsZVKr zQjudtmXQ0$6Lox6s%p3jIs6z0HB@s}BS&6CHD`^212t50)+#tqLp5ief&(>FbJi<3 zP(w9mgMtG!lyhheHzEh-LTFuA-LjR}ka9MWErwd0?TKV%e6p*Wvl%({Nco{JYNuB( zCg;$;*n%8+oj0rcVk>gsDg*ip?%~ThG@fn9fjJeL{&U*xWXs>qd&%xiI1qVm@_IY@ zj*B{GGOZI%8M1`tGWpNOG+E3vo}FaN-|Xx{j@-^pm7U$lv4SOe1+=(JPQIk^OnvRi z0cS6A9+M?#Pjj3^c1m44`;haFar}1;B_-G8>_<)?#_2VwA_+^Ea{xJTW(!+vdzuYZ zbJCHMeSaOy0p}2MV0?kEgyAa=t9=oO^hNfZBRSw4%>m~aa{7^hN>0Ev+pX5#Q^%8m zoFR)6-99~yoOWahTh6tayi(0MgB&l$>Fv;v96WXHoJEca zSwg$tsFS^#bB=5=)RrVmh`FKD2y!y0Yv(+2$}>*cZLL12ITw&)M3>wiOIib27;m zLoMk5^wl)t#49!DB62#zlDukGI6)3py762>4$i;v^qsew zbA@b?I4A!^C#yMEkz-DlP@l&``dn9Yt|7;hai-s|SxC(xYQ$Fy#;Lw$XG=BbALPJ! z3;0T&@{gXpZXhT7cy1ym`*?04C;NDABPaWK?jR@oe!q*H(qsvF%{%2pb`jk^y@#B+ zjPr5nvCV4EedM%aoUzg8_1JlUoZ@5&ZR+|{diI@%WDEIR4;kdo09>wzt9?B}&M^`& zLo z8FCsDNBM|!dfEyy5TqJXU(XeG;5_P?DxMd}AqN|bd4AIxedQeL>m_os_eFMHSzh4l zrOMZ9l`lDm`g(($JY)&2>EKyp&`Ehw4%rQeuWBTBm^15`6xK6`ze5gehj!;#iiO(F zd$NVz?*-1IuUp9+uIr0TZG>}<`PwpP3^@UjIJC|mk;D6a&XW9(Kge>YF@Hi1Kd*Zg z+k2bb4&{7C4&Qec-ikk^=6q3b<`pZkQO)_P@HKz54>^EHF;idPkOOlnH2vpn-^rH0 zowNNwP9I{(l1PUqEZm~rFMcA&lq_MtSpH;p?jN%H&>H?yaA3bsbABU-A5Z7iiZxPm z{vgMeEWy`F_&!x}%%yo5 zB8TS=`-K61!XUqQYJ{AEEaup5hJ>!$U%8NzMmR90BWw7LS96S!1N#mUvUtWLH*$>0 zc4%+&RXL-!lSjdcK0NELnv)kfGhs>W>`dR1SIxFI2}<1UdXTc)N2yJ$YH?fKwDXlgScV?dub_s(ry8VW@?%0j<+>uM{<> zIC8R&r$i1o&)9s5=$gyRd`11M5!9kZ(8aa_c(6?2b>DX*?>Kv(e#+N zzm3|Cbq?%Q%mJqoa-5kjm*4j3YG0L+!_T#LwJKay&9OmF_H#lN1xNp!P!&1kf(qNa zG46?KUvL&-s10D8*!?}oG^|_a>d0A0I+g6inuQHhyQs$oj4nfMC9<6enki>|2UnMk z4Z1JeA%~Bj)XH(A)tnj%PVc7qkE=N~6`aM^k9(*&_6m;CiUh5i%_hj>p&VD_WHQc&+uH)w95>{^ohu?}d`oO57Xi9s zqYiQ|GR`l}+~Jf%01cnDH5x0_BYy`BFgA|xy+z`X0<*?BWGd1@dU8Nm?x#W~D-iho z@Th1Gf#sgDA^dWfz<`in8jp*PkaIv@$pPVOzY4jhLa=0r@+@Fxq>Ur+B&8C8F{DJ| zRLDezG|+H6D;ZK>AQ=n^705k?IBL0;7P^wO8G>WQ5U56&b{cudlqeCG4H(B&X!$c_ zia>@d?99?@XCdR%5n6{C5-gCX3~>{P1v?;26-a%4h#*LqcD`O;p^UQ|wZi%i2oCEN z7Dtof)qsB-hE`8lUd@mYfgEB;U4h(Z$TWfAsUBK_c$Vpnrwlth?h#sU{D3KtHYy~T zA%_HKC__#QWDP@(3giJp90lUQF2d#sWHm!N3FI9^jtQiNF(#$S5XfSN&cLA^5Xel1G!n=zhRhMj zO@`1hzem+ye&i2-gZ;vSscoL=AEwny*eL^-K%|`&NGL-d3S<>S9th+CLyWZCatRYO zqp2l0V;JHhkkt&CERfR-p;;VLWdSzdFiwonGKIqtX`TY9$&h4$v}Xvld`hq7I2nf! zNSn?OV=d3?5JPeaqz0U5k~T^B@?{A1bwRJMNsLoOXnkUcg+R)hQ_Fq=sl$+o0`Xx8 z^>tORuc0yy%?tiojW)>3uUSZ3P&}JR(6V3aKynD_A0*>+jE;!zA40A+prKaB=zcNe zpR8qwcM#Ev43rR%wkv!A0{?GD8?WkV6>>#|+*Kj)FF8s(@E0D?nv43hXGjZyL^5Qf zK&CQefk2KhBupUp7&22JhH#RE4Q9xfdMjU%aUz6PU6~f`ix3quhao+M))t0L7f7Z| zD@^-AulM(ilOnY2;N}ErT?OLFkgEcTV8}Ir%wxz6f$V3gykYG+@Yef%IX>ZGj{+JdYX(+T_Fr>FYOf9K*cY)Mm$Si?$X9)FGOs}tzjB`q8En-Nx zKz7RP&^?8GMG4y`!TF}*SQn+7*@EN25E_q_-gx{O$46*QVMqb3n4=gnS8&XWQD27z z;=vH`MPu&4kVgXP!fuxQ5J(5O93`!~mTT={$O*ymE{POPLBSc%kkSJA!Vq9m?*&VN zOdFZ!d&Y%DhSYYV@42t4jMGZ^@@I&XmU9*`WSHPw6_#Q4bJSbaLh#WLY3+noD~9Y8 z$asdl6v$bIj1q{MxBvrRu6lj7Vw@U6Yav703*;?BItrwESsLMXfkZImpg=Y-B#)L? z<2^%61>$T)?UWbD5QbC{NIF9*3q(^+gUwYS%^6ZhAk!IQDUi1eDIt)y1d_s# ziUPUGknb9vMU@Juq)8M=Z-&r4rM2EVuVtJrLhBnt@(EvUt*K>mfvjXmHG%wONHKv# zRHRy^1agZZ`-HC=l_+PdKt?fy#_X*(=F5yTMrc*9OzlvuZhEywGfuqFy26k?0;yv| z?U)GUHAB7%#Ig$Id=^MkhI|o75JNr*B#|NS1+s!69|UreA#Vlpf+24NVp^4Y_Z5gW zL*5C*lOYoX62cH#pWb@wGm3Hg3at%7OT*@$qblU43VEkOOsdhCdkD*$8FEA*KGi9w zr9h@K#6ZhO_&0_O6&wd!szvjP*PB;3?(uLcLml7$;6>wRNGstOcTVrHGY4wlk!yKwdE{-l5y*6gR2N8%4wO?sz5F>WQ#z`b)s4)1#+4p zj|Fn2Gvz!NNM&z|yb{PDhWr%Bm@brKsO5e7lOcr!Qok$Zlo7~ohS&87yRUr00lw&K9vkb8pNR1wp;~|hZhQtcwDMOwJ}SX-f#eIIoTmb@2&BkIfp{|Hw?NtlQBDml_jQ6HwFP1kOgVXl)+mM) z6No_w<&+Xg5<|)hq(x84sV$Jh3|TA?^Inv*S|HsRQd7$#yuc7=fs_iRT6RKf7ekx{ z;t)nTO9V2MA!`J3f+6<8vU_i;wN!8>Fl4Pjt}^70K<4#Ow6&3PCh5S??ks*;mF$1Z0YMCIB z(e$UG2n@am(l;bd&LN+cMuaHrShs4!&dRu{i#^%aPpi=! z;~W=mM?!!zgm5xc9Dz7PJl=$ppS&<0XI?{r*w-Y6lE`)o&atn_&gTW<0G-i?y!LZn zj=WC=f;IFa+s|;0sG&fdp=970))M;Y#GwH)dHN6FDOGTsU>35pwTvT84#@gbHv`B zq?krxNs$niyM#a$pmilL>YXFkRLD(^@PcXXs*p^MIPhK`#}Ow`D@fw0C=i~QKHbDkqOGRYgwWfgKoAUxCSD&!VN_<+*f=ZF|}_c$Wr zxyTVQS}qBM8ye4%T9ErE@@mKtv0n(pfhXq9Iby$<#Sz?>VShg*5I!;m!kug2uu6NG zkFiYx;r%t6BMzVj;|osIPz(1{@!Va&zK+t(X zvi&gU@YE&59(I*u#LpwnvA1WL3B(af2G5EA;2cLDv_No<3LtYrbsn=5%o6bA9Yu($ z#v+=$$l5^*XBXrM>qLG63Y(+_9R}acIzezc4xQ~OM<7^?&IE*Uj~qv5((&-bE=7Q! zNPL-*bzv>@<>lhntN_o>jrcwqdzBrmk=3Z2@J#6l7BMq?5~ zbEns*#Ez>Az@!N+u@{UYDB8i97Jj{~hCujm5eQFI)1Gt0v8f|RaNi+sG?jUMocMm> zDi9o+gj0tjV&+fec0`0-ID*H@n?xfY*K*+z3IwY`6g0&+2amacl;VgJ41{;&wU4|o z_gZZCk`R&USk4j17>$ssFM&UV(A>=d=MNwZ6fa^1SZ64g!5K# z_>3(fe60F%j)-RhNAT!C-e~#?1kzYQUOhO%ol6MGfqwV+25pBRC@BiQ@dsfh2j%)&=96(4X<9wJ#))=9f4=F-mjX&9GU=H6wY~%4l z%!fit%!kjo9WftL1njJ2cIX{E`Ftp}M5ZH!9ngg4MP3-8sLyDQ2(5k`v4>OhO|_tPObgE;f0GEwL6%y!cOrJ+cZDee?ATaZ`Fy02|JMgA6taVE{hqZ>+H!5F8K(-9lPj5;y&YVR*M})%B0{ z@mqfIu5({lGLFVBM$)Q>T2MDbAas11A!!X~TF6oOsxP!asp6Tg6=w)vsZ0ww3SZFo z^t-pEuNR86~VNSqwv*Om6x0FHJxc8N8zi9!WZNvX&qx)$Wi!eDztcB zQ-!Z@Oba;*U(JLT&r8y(29qUe$Wi$6ROB^nWABB#g)bkbg&c)1I2uX))j2T!o1`_7 zX(319tA)ZBjQP64*B+*Y9EGoz3SUq|N$UaALXN^$E1?B>!`PT6eC3M=Ort@L!dGjd z#cL>O)nr=8QTS@3$O~$?NBHW*w2-6l)mGsPYA9(9WLn5k_-d!{b;0#${zJmo0;Yu= zg)c9KukH2)H%VIim=)3}%og}S7{b}Wqqwv*H z;S2IQDtt9%TF6oO>ZI@mc}ZGHOba;*U!76Qf`+1*n7`>0N8u}jX(3193+`!3W8S&h z%0ZG=nE})oaumM0DDr|D&J(`km=i%Y&{ zGA-mNeEFhQ0p{yRmj#<7tX(319Dc+H?qwv*N;p@l7gb$L|Hl~Ffg|9f& z;^Qz^%gA?a{lyW8S3l2$y^LXN`MK!va4E=LwgTIZP-aumJ>2`z}G zL`h#e3o#C>!VMeJkfZQ5SZF~n54F8ePSP61w2-6lHAIouiP@X3NLtsK7IGB6hAMpZ ztN*R6q~!p&Q6U20D0~e=E#68+0oU-lCziX4TnDGFaFDy>YCv}Q9c zooOLQ;cJ@0*Q?q6UQ1d&lW2sGxkBE~4@crhz5$lm&1U)mSLBpqJ}jP2M7DMKCSoD10pv zT3{7?O%}eAnHF*sz7`8DKB6S8!%Pb~3SUcv7Wd^Te7#~?$Wi!ODzw1Yo$n9)B(37p z!4mmg1vm;{%Y+tehrE)7uf|LZISOCPg%;0C(u!hQ$Wi!Ofm(1hhZg^N{heImjA#zi zLXN`MN`)`0J97(2TBb9oE#xSCrJ@!;>cMO?N#r$xX(319Yn8&+@xYt4B&{7x3pom3 zt5v=x3SY077IGB6)+l^whLu__X<5#sc_ByPYpu#xbK$E#(?X8I*E)r-?IGX#OIrR+ z3pom3>s7v52wx+a7IGB6HmH0_TFaRhax`}2e>vj?wxiBr{D12>K_<}J%UHIzEw2-67D^2N(_65IG91-KbTQ zYzEEiBaORATCq$EISQ>ksAWQpYQomMxh-k!XIjWnXzfKUKB9h{2;U`X8O@=_kfW%^ zKGfnP3htRpTHZ_xISOC<6~3UCyNX_3&9soC@O41p>)7?o+LG2OriC1ZuXLdWIgBWi z>-9C^>m}1dj>6YLp#^(N+Xmg8B(3tvv>M1!_&S7I7GyJMl{9MRCTV#yE#xSC9ai}2 zdO2-`q&1moAxGis2x`HR2z)KOY&uEOI?A+=qwsZ9;j3Qmo<@?^Po{+&g|A~mi@3rX z-V`--oC_Fzeoi?9WC$%@LrE))X(319>o{u3Yba?gWLn5kww9so3!k-#y=)D9;Fd_e$dGpHb?OvC#1ItH3 zzWaS==FKbn_H7fso+L{5FKqL#n;ag(6lsL7r-ZL>qxZaPsT-Igjqvq!ny+V!uYWK_ z8sY2D!qQSOLssi7Bud)P=LsQ)7h zuTsDWH+}Ttb1ii|Q=}2pb40C5T!@#^SWNY#ZsM2kw*A>ktjDCmb!^4(g^A$qTKzLrC>)v8)*dfGEsW}by?!O zcP!O#k)lW=sJ|1X`xoxNEOi=Fq!HP8g(#g3+<#f>4W>vVe7!1sVPD?QWWMrZ6(MPa zuh)dHUB+Maf~BT0MH=Dj^)z39F}@ZuMH=Dj4e2W}=`KrM!4zqPuQ!Rpu@|=!Yg_*L zf5z9-Op!+T`iJoK+V9u+wWU_N1TDdntWhI;y_M$cIpb^3O9+aPM)-O=&6lNmm?Dkv z^^T#?F3tg7G`_B7iZsI4yN1&HFH60}6lsL7_lR=$UzXbPQuGh+p+SxC^*&L$9lrYa z7aJ@!ohi}?UmpD03;b(AV zHEM*fj}4`BXsKGJNF#iGLX?|BOC81(X@sv&g)hvZrEX)2G{V+% z_`)1oYPZW(Hb^6UeL<8Sqi}8cO_RepOp!+T`cnA1?D>i#EOic3q!GUUX(){5v9~|J z;SJ;KUZzMRe0^o86@a>K__KFf>T9M*BYb^L6s}_--@D*Ku#2uD;mMPK*U*8&E@JHm9o-up> z&E#;+E2&r!(g9!!x&`1+10oZFzUYu}o<@w3L)Y^F#feEmoGI(*Vo z$6M-Brbr`veQ$hWeQo1ic(bKmVv01v*MEhtjgJ4>EtY~;lhH;R;R`21>TLz+>#RG@ z8)>NtOp!+T!fSl(dDuT(w%X2?TErA-gsjkmx}w_n+VCp)2sY9PUn>b;gEm`qo24c(MH=C2Wun~Km!-~R ziZp^+g{V~^4s20fe^~sorT)ScX#};Zp|Av7q~5*8QX5^3pTTqbQ6s3;h{F9BZkYL) z$;MQsNF%bbx}h-hxZZ226PY57@U@1aw6AlGuiKa+jqru{YT6csXGSdbHdCY#zSc4n z`ilSYkk6hlzSg@2KZ9$MQ6qeOA< zsEvqP83@eAL0kXp3rkIAiZp`Sm?-RDxNW<_gqJOKG*hGz)FwpX+y*1Oa-%nDe`&ID zHB+P!+1QjQJwL>AZI*hPDbfgEn-Qh6v3R??-nG=1Op!)Vn-k?`!&0074$BH_Tc{D# z7DSo0@y53iOEob?8bNJI)T+uTo!OsZvT-m|q!HP`J8f)V{^u=qCtB)irbr`vZEYxY zch6359y`FCyLpu<(g)|gi zT*FdFGDRBU>u18(Hq-vpW2uLjB8~91gD6+U7YmlN)Ed865t2su+EMsg_5Lq+x70pN zkw*C1N%-3S%(!W3zQuU&}JZKLdt5i441yBk!wNF#jh zDtx`&a`rQpYGaBt!q;x5Txj>PEjL~G8`HmTV2U)t*C63*#MQBTEcI`uNF#jhPL%G; zc%JA1!q;%3c7(6t zkH`gM|NQeMCi7q4rYO<~Un7LCvlp$mkEQ;7yP`-VeC&6SXFM zjhR1je$PxxZF`TRNF#jVyF0>s4Zc@Vq!GSi!q?#oN4#TwHQc8t(gOO$R=RnJ{=g?f(<>JNQDQKS*R>V&Vq98>?ar9NbeG{RRsQMf*j znXlRV5PtU%dfD$m{2hsqMox7jb>)g}=38GoK8&Bi^@XSr)MyhSevhr!Qs*&6 z8j<-iMCsOxu3(BZ;;N5*h{77yTLsNU-D^ciBYaIHY9Ju+M`YJ`I`??YjJ-QNt}Ky8rgvbv~hdkw#Ech;ok|EVaRtiXx4mrV@o&$8DQ8X5L|` z`YJZ~i z7M_x_`|cb^O7WdY>uM2x<;d1HdBuL919}%@}py-_TPeLK=~cHllQW;VPD; zE@Fx_!q-7W>1^QohNWI+iZp_nOO!iCS!(lVRfMDwR69|6jN1CW|EyuDI8&q%R0mPI zZQQZ?v3FORHHS-?B8|vKCs8^ZuYPdw&X#(cDbfgET}0_@;BktjcKkn8F4739o2d2S zYb@LKLvGyMQk_hZMokG=fSJwE+y~<( zDbfh)5K*ohD`r1qsoh>so}q|flx5Y(@q%m#7Cy}uKBWxkTfEP#}lP<_{d|iT1!o5iZsI42}J4Ei$`si zx|}J}2qijXvdI-970@HPAq`R4vRNAGU3F_kIO zh-{ogl&-IXAAPsOQa3V18sY0)qI5QJ4q&O(UI+KEkw#FzBx+sw4$F4;&3}EvQi<2$ zBiKkIs9zC<{R_8&13vhJr5<@5KZ`_2BdA{!rDv6R)Mlye-cS^2L^ggyl+MPt`(0LR zsZ*IEjqr7z@P*guO*EPRCsU*mzRnlE9zJc4&n-3XO%)+&gs%(Id`&jKu40Nb!qbuSk6@O7o|wbk1r&al*Erbr`v{nq$Gs}~R0Wcr>ahreZt zG{V50-1l3fDAQYScUM5p1LpzOE6z_WsMS9bdm;iZsI4 zwWeI?D|*tRQ?0KLnIetw^*iC~sJG9qwbWkkQh*WC2w&G3U#Ph1=KiPB>fjvLdBuYvEW2uUM+-5`9eeb?G6SZW?qq!GSuBnszI zxIKPFdB^IeZ9KsgX@svo2w%sn`nyg`?exB~MH=DjCZce^jP-TzRnP8gsS}tYjqvqH z;cKgJ22Hcn+f0#0__~=W95>Kc=bPU>Z>hQu;3L>bBYfQ=d|k2P)kj$Ba;8WleBEk% zq1ENSYM8Z&$>H)J;%D%@a?}W4w+UbO{^9PmEOiJ|q!GSuHxyc3?VvU0ZDD+U&J<~c zuR9Ed**N!;lP0ggC zMH=DjUg7K64elRospzN57iomA`wWE&yfW=1kSMG#_#^Vv>|xFGjIU3bB8~9% zknnZT#hdMDsnMTk&nilwe#iZp_HgeZ58ZK>tHP`*ebs7HyyOyIVE z_f74VYGsNvf_jW7z0Nl2@^!B{*kt2=rbr{Q@iRyqIr!!NMZpf6Pfq!GTJAWCNg z=h&7yk15g!>Pe#9Y*=cwe=1+35!6$LLPh!E2RpuwV2U(?dYUM`|H3)8_4P4Rq!HQp zGf_GlcwWy^ZC|MfNh5syg{UZe4Sz&#-==$yFHPp(Vv01v*I$LN-4FPDB}=XQwem$8 z;p-Wq+{{~QFQ!N%sJ{{AX5LcmOp!)V&k}`e=D3wTc;w-hx|Au>2pkhR5w$k5x!m& z<-!@!0mj#_nIetw^^)*4wegtqEOk3mq!GSeHWZc|N9;w$*Yiw~M)>->p>XV2`_p$G zwA6P@kw*A>g(w_Fal=_*)QB zuM?Rfjqvrlp|D(dC$go6{98px8sX~=qOffs_3YF4++wLWnIetw^``K(bK8aYTk5QD zl`ql=U;iKqbBMn1PGn2PmMDre!q;2E*G)?%*IDXQrbr`vy-k$vUwDn#gC>U;eW!ep zM)-P1_`++s?bW_=C=5jWNDf_+C+@5x(9NzVJ+zrK*@Bjqvq8QF>&< zJ*=e;VTv?@`hX~RWV6)mOp!)V9}kw#D-5vBLAhfH{4)beKDyT^Z( zEz*c=d`y%c*>>J$r`0U=JElk@e0@Tc&IaybEwwp~c995a1obIVIAY^?_*%~kF-x7! z6lnzYnW3-@bME{3VoR;E99n`mP@qOopA&`s3;v)pS%;gpaR^hS5!v{HD4h*lfw9zG zOp!+T`jRM}4Qv~hTEY}*1ocm%+_qt0xb17Q=}1@|DGtFc{~?jsclwL5t2rn3-~Wl>Ra>%Z!Dl%cFz-$ zMns4^g%y@_d&-ffZOmt1q!AG=N0g2b&jna&F;k=wzLqD-?J1UutgIp@ji6Q_%IztZ z8pRZ81hpbj@QXG)7htJ#m?Dj!Rw7D|qDOrD&WK%1HeP0mG$I=-6Q#2;=8(4sS?b_b zRJlkae62#1&IXR6mRfmLMUh5Os}i*ylnVZc?ANjL5th1$DbfgPHKO!>dACEJnQEz# zt0`Zk5!C8}!s8T6J0_dQoxAq@3ghc>rbr`vts{J`v`g6&mRfU76(MPauK`54wQQ+o zrbr{Gb%}D@yrs@!iZp^+kEoSYlaF-myVg8Qz04G81hqaUmF?D2g<~*Ve`tTE!ghVRCpDQ=}2T1`1#J+&N3V#uRCU zuWg9ZIeaX>)fSf8bzK!9X@swBg|Fj2dGjGl9m*7Ggs<&Px!{k;zGwXYX-hrM6lsL7 zsPOf2`|IymYSZ;pgrpI^wl}^ohj_evyy?qxm?Dkv^)ulM&%#*h2Bt_OeCvuhLW0S*snIetwRVIARxZvT}EmgUZijXwI zSGl3k7oLUL-1xehDbfgE6^4R8BB#FFe66Ln+F1D_jqo*?C|zIQ?sjIYrOsxGG{RS< z@U`VF6@RhR>YFHEq!GS`5T)zuz_m78-%>|2MH=C2sPHx8_-!7x)W4V_jqo*$DBb4q zEX-olzq&S65t2su8ZLajv+KR}mU@^e(g7RFLLY_1|CjqtS>QCMGaa71TeQpVRYOp!+T z+FSU-voMx=i7C=~-$KQ=}18HBs=3HarVssSlYV zji73X8VC$#CQYVU!HB8{L%5ry@Iiff*qbGoIzWr{R{ zY9tD;#lo#?(JyN(b>}w97ik35M3mlF;yQq(7Hq31(umBDCQ4@>*8wb5x1FL$Bh~@N z5T(9VQEo@I?5+clMnpK4DBV-=YUf)`+gK;6tdT}U*eoK%tDP-1i7CgSw^>?O7Bd7^P>9&DaJ6meU?Nzx*BdC1@g;zUUs+}p)2x=lx z*q3p`tDP-%GgG7y)Fh&G=J9H0OMS}}X+-8H6Q$b*UhQnDaX(Y#B8~7hg(&xGXG>km z6lnxCl_(rDaKo#eE%gmkq!H9KqTF_9sYyGi&q*U%@ANe4wzSqu8sTeSqHte{QR3Ck z@0-?p4f`UE$l-oO=^WzK&X)R;DbfgEKPO7JUcB1bQX_X%y8 zVv00^+Mg)hdU1u*QZF$@8bKW(D7@O)Qqi4MgrpIaN0fWDv!#+ukw#Dl8edQ>TH&u zBE%I=OWn>CX@su?QSKbTQr|H}8bQq>%AEsPs&*GuUeX9^Hc{}4HeBJf)R|0?Mo@Ez z(t9FY?b*j<<9Vh?BeKy(l&&vaXS39xT~&mn5xx#G6o!bi%43bMbuTG-eTDH^&Op!)VT|~LH zY^l0IDnil-s+%bIMH|laEOiA_q!HA?MCldI$0we!<%%X7-!nxTk&Pr#x|Y{}<>+op z{eE{9A!&rK9-?$Ma2?xH`uxVTg#T3#uRA;bvRMFmRG;=)9WpD4O65M)DcAKb?iZ-F5TKv%MDQxl15NR z5~XVyM}RJqjY&+AMr7kCqI5R!?LU^ffGN@lUq=(Avw_EYmU@dR(g^ApqTCU{Qo9dT zH4In2NF%6|h|)76Jl3<+lT49DP$v_G z^@VnCJ!AibrACiXzDOgeQ;5QIZMfAg`uaReJ;@Yl1hvRSh!h^{S!(Pa$`@%w=1(O` zXC7xnmU@XP(uf(+X+$ZT=nYomsg~ViJ<^B>PbX?1sIhH)^Zt;=RZQEMy{EE98WG_c zBEqc>d+KycJnhB#rQOk@1E73+Eeglf&zoB8~8MvG9fS4NHB?6lsL7 zONesk8Q1IeBdFgJ1;1z;7X4+brB z*dtzl?fi93HYPGf8j+2wiPG8l?4`B8x74Ne$`@&buWN|X*}yrrr9N#?6lnx?Em3;* zh0hhSRIE`^q!HBbh|=o-za4qx1D5(#lcGo?sOyNrwt?FzOFGur%4Flc(TXCC$j0?V z>1^Qhu`PA`7)6mr`1(Cjc$E(P5jl79A(va~#IcGZjqr7Y@HMDyi#seey;)JD5x#CD zN{<`(d~8eYG)_^Z5x)K)d_A||$%`!YEmNcszHTB)pOt=k$&#%t^~8APi!{R5ABC^7 z-<)%kr7oDDDAEXDHxs4T0p?dEony zpKbA!r9NYdG{VdKATDSWEqZDbfh) zL89DaSWB(4uZoZ~f_jK3Y`vHbJcjKw*_g%@X+$<2CQ4@mk6|r!5mTfQz8)b;X9JI6 zE%g>tq!HAkM7eudOYOFwDi>)4^%zm`i#9xlwbWrukw#FD6EzSR%myCAZe+6Y5L2WP z*?58|osH)XTx)Af?fr8VA!&rKCy8>8Q!I5WQ=}2pQ$)GPDV8dqp?r}>P)`%(9;aC9 zCZuf4Ew?%%YS02tC=E=p#Ewi1XpyNVyW#8 zP`*ebGXD%wI`eo8YpLs)B8@ms`5RHnCVGSSa#1b2$FQUk5k6~tA%Sbl>zKAt=_zZZ z5fT2Mq2P}Q&NnP|5L2WPzMdn>9p~3FzAk2pG{V>O!WX^;*izpyMH=Dj1)}tsEPRLB zj>gyY168?5BYeFmeBnFPEOixAq!GSeB1(?{IIFbOS4@#cP%jgOJq3FuzC+DY4RIAA zX$19mqV%j1-=Suy3z;H~pk6WM0#{Va157qPVTv>&8?PD){)k+3#I18Iwew6BA!#Cm zlCAMn9BsoLDMabnm--CHIouLJVf~|Kc|pBSlwTj1(Vr~ot4yIr`uf07=Pw=6Gd~+B%sgsjx&BGi zj_@5ubKv9C{$_n0!@f`>%k>pe!R5MyDb&aaza}a;!go1B)JW}yk?FdL`=%Bkgl6SV_;hjzDIxA9F>sBJL&LJd&P`137MIvY(-JwL)y z6PQAc^tFU2o%y2@k>Qp)mnqapU*Bc$^+%>q1C-OE{zDWvh~N>0+Vo!LTc9u-sFBq7 zMCo4nLFAmvY=qm)R+&eQr2b134EMCPeD|(1Zj59KHIl*?BCN2SruJX!+-@E)*wpHTXy*R=q6n%xDOa8+)yK_HHp%#_neVEYgp}DQ3k4qDbz@6W1@nyaSv0dk<=zc>2f`L z(Z@TYLTzict8$@6QkxQ`_Y8-e{q`bD&0q>OlG=d*^)JSR@qJqn{gelZWYFnaoxvqF4b~h^2HmXyV z3pJA3E`zVLfkJzzkyKRplKtyZ_JtZrZJ)u{f7lmlB=s}lOSbu@E>$kn0OgFLI}jB- zik{09Y9zHIQMeC8yB9^SeG(OFyN)T;$Ov~LYD?Bld*_YAE%hK%sFBppL}}{-8*Xyu zQA?OYjih!VYB%=v?pEb@SYPXPt8Ab~Qo9mW&D1^DJTc5tO-zwSjM%#owHZ?f)j#)3 zOMS@{YNW40MCm>3Tff-mX-m}~tRh4WP`D>z>$?+$Z5|b^Yro!TsZOR)1C%q`lo6%d zyfURTxEBN`TVHdSLXD&dIg zDbz@67*SEyj+*!49+s+M3N?}%Zm9Hf#hF5lq~Ov|80U4l{;|p#r(0jgF@+jQ?Licd z0O(6?x?EQ>g&IliNmLZ%sBOIS&3{;54>N@tNsScLf$M*Fm!&>q3N@12izr>L!&lk9 z#!~B~RDGdFQhOUpm&Q`tGld#SRS^}1GNosJPo_{KsaOVT5>u#=R5ek-SP zP$PXc5EYz_Hq(&J^d$7K~VG1>pY9uNOAt5ERv1YGoQK*qrlc2u3WO-*#v@=tv z0m{k7XhWghOTT&fVdWL`(a02Pq^~hV>1@a`Y9>>tkm!1&?gCOrb_n6N!p)Hsr|G!xU;HHOWxv*|?4=)BxpVV=_^7oQ=mvcRz;;wY|j@ zYNW3zMCokEwz1WGl?~KLYAR8|ZDTT1sFBn(qN1D)*)~pL3N@0NZYa#gu*s|Khzhkm z#uRFRaHtCAa=|^nv(yF)Rk=_j zDNj%XcaPm>sdA=JBdG%oh4pp(G0)s$sc}r91}LY#;za5C8nA8iZ!L8kQ>c-?W)c-# zUyGSSjig$Lib8bo2XDH*K4S_sl4>{cjafuZf!NUQ zQ(x?SA}Z8&EmNqGzGf4pvmxg;UonLmNzE~o_F#RDJXDnnHIiy0DheSXCHH#AGKCsR z9b_oX#x;N1?p5pSZ%m;EC?^|piP{$kjAn;VB70hD;9)94)JR|LMCokEqnj?KP$Q`h zqILy8`idXx>rSRnBdJcJqCjCbHhJ&0NtRmaa1|kHB-Ldo%*NjL?tQtX_GJn+Ksnjy zCQ4`Ht%g@Wvea*xLXGrwFj2wT_=+jiNGeHGa5iE`sB)o3QawaP1GBM+Dbz?RWvKL? z@)}d90m{inFHte@h0%Q5_~0~DsBQftRfMRKzUC37vmxgIO-!LiQuB!lo&y}p6lx^3 zfT$>hgmK9^!1YX_Mp6q6m7b0Fm_iLuPBso9ssa39$-B0A$ypWI_9&GN)JR{45~Z^t z=Ku#Vg&Ij6MpW<|;FnCHMpB0p73FNmIl$9Qp+-_i7z(o?_bKZft;&TOpqy+RNmLzY zrtV$QB0vm`Z|gzoeen$IGQQcNa|>!qF@~U;7$9wjVaVf>KH?zR?Y!FW(qZu zI#y6}4zTMnDjTSg)NzJNZ&9csDcqC#yqF@+lG>ja{74&|OG za;%CFHIh2fP}+m_HJT~ZNa`e_q7V{Na!+&)Q>c;D$%evg$g%fbrceWvlZ{h|ngIls z;jybWb@oKVj#K4Ajr6sMD4h+tCpwua)JW=7qJqcX=b1u{q)sC$3ejOUujQQx#W1b_6aJ7sFBn;LeoaC@AWQX3N@1Y4N*}pm)z^!&J=1Sb)KQp z%k?r-sFBq9MCo$L5&LVVP$Q`ej4$|uH{BxFIZ@RzY9w``p-?MF>>ZgxjifFzRC>8a zGld$UoYs3WQI+5aqdBcBc^@j&mShSw($^(K>1@bec>ztJpMf7#9DB=xTa{P%N2Hu7)JR`f5~Z^t z`*Jf=sFBofi3;w^38qjZsjG;JLOhra*_RJz3N@0t+ED4)xQHp#0Oe%k8lrXpKbVaL zE&ut2@(TZm+`$xTq_1m<(%Cq5%+7GiNZ0psOrb_nzauJm1o)IG)JW<&qM{HFdXOW) zswb;jMvbJd7nE;Zlqu8zPDi1+r}wOp+-`FASw#+q_>UVGKCsR-DIfrw($g0r~%5!#vh5=9(-XoUfO@?MCBF! z5qXO#)JR`96Q#3pZq27#Tk5||p+-`-5ETW>@CR?YMQwD7s%6wj>Q+OcR*s^(F@+jQ z-DartY&0{48laqP+-@k0rsj-IA4P@Q5=@~+`nrQCosBhW>YZyik7NoplDdFXY% zg0t~GQ>c;Dy+j3PW5Y$NZJp5# z-s4Di^z}iTuJ#bzn4(KMfhp8T>Ip$zx8A@PEj6Dh)JW<{LG5*H<9th9#1v|PYMC>) zXJ{ow_!LodaN;7ihk)>^=Pjt1){*F_?~KoEPqa=;#OF?pxA!I@UUzRY(GqWOk5pAv z#P+S8P+vXW8xz|P{y7-_Iozvm$H{s2Xr+T_N zfiCmLcD2lHOT|DJi|tciT^(yAv*qbuOb2(~^qKKi4+80GQ3yC!pM&LidmDV0oZZ`z z=wyo&TTLCB^rp8bI%lWmc!^}PD{1Hn_4@0s-jvrh%S*;PXD0%_PWE=D+By;;cyDJ* zym$7Tl$Ti0lITvgb#-bJ-Z%(QCBl5?wRCkaO#84k(UVGcEyT1KrLsba!Ey$FQ(a#( zwX8g*66ZswU``R8KPR4wrF~fgby-tKroB;V-&RviH<4klKI7MAzKWrc-N3w2J_SaG z4M&^L__Z>hOvV>_or(FLs!D%y%E?5a$fThvo27u5LoKF-pIzxqo|EjF?}bOoEn3Cd z67O;Q2GtXl(thD9nf)T92CN{c0z$rZqP7YZskcvWBDv7(P9$eRvxZKRNJiYxW+f8` z_a-`9pj}fJgdri>);U{u59+?H3F^`?M8vA1{3rC$I$Ochp)_@B$nmB_7X_U+i41wr z?_*Q&pKTr8?FlcnushMCQDtC~8YHU9s-iRFJ#8&IggU@l=ERd;Dj9D}8EC4Ep(19( zh&ippt20r1v$~RAOT0VY(w15Xp%vk!wt9MXeRWz0w)j=$McJoTf$b>X-JR%cEiPCz zhS8Q+z}Q{G^;2TQ-WVFbyL)@)K(A?;TYSXR$zU?klSt0P23JIFVFGwh=uK{GUFeCH zT!dlBs%o^tpzRvoG}|b#Z+O#qf9!AL-ZWn$*Q97-@S$kt-Wd1b_3N^EXok1In z*f>KAgS~N$SiW=v*dlY{UA#2`O`9f_9dVd?YOC-u%{ljVV}%dPW78_zx=_{vf78sT z%$u~ZCza@Mr+!V?v`mP^p;KQA%XtTr!Baqe2gKvA@2ryYp0qNV+O8@~|1uzqbdf)b zED8)#)kjCXTUQ6pN2$6x;~j~Z*VF~`g+!c_Z`x;tZlHDo+mYz$iNn-A2LzgDp*6*A z33^>tKXQ7TmptkV!y5xu)cm~MYlycbQm_l|;htlg3*;i`OLumhS-{^;Ow4YBj^-Ym zRZn$E>LzfUl4`+OUIhP|@BgzW;!WTF3SX2oVW55Qq zgsCDM)HtSA!ZZo?LRhzgGHGt@@={&Y`uv8Q>uaj(XzH0+gKZE3fFHFoL27EnSuBQX z0xZsNYfa#U$X5s_!cc{>R#R7oL1Ho>z|J^K4CV*h%dRmNsoa!bZ&X@rayZTSb+or9 z;i=k#fnJnR4{d61t-mUx13PYwWmLuf=Ak=rp6x?pZUbrSF`2So*HnAs8sMKQp&=5; zlsAojVfGtX+|v^8^fD0*3UTF~UAE=BL6B1F{q5P6!z5UToJq!U!(j^j#et-{WRndw z94-qsEZeR$tD9rE25eI2!xWp+`C7PZv(B5Qjb>1Bq)>llLCxG63~uMa-<&GXSu|M&BRbY0?NfpR@J|H89YT)P3SdinBAyH= z$8=s0mL)W?deyD1IFXlM+dVpl3A2n;MLM`6Q|CjeZ5q{VJZZOGXpNJ{Muj4 zOy9yDV_t$LA5G%WnmL+Bvw04Qt`BUJ64^b^~xTP_7T=d>#J2Zxt zzAJs@5bBnANHVn2gEi*9b7eZww91(aVVOF;$+=%(15&ZUQZ@F8oV@b$sU zB6gM@ILe}9-_)G89xpWqj(&q!SSBufy@A4q=IOyfWw+N1OFL~fP^`&a(_mf*qX!&1 z(Kj$(ukB4H;m8n9TRvC!2mRUk7?>)mb6BrGVy-k16i>}K@gdX6s5 zUZu*bFBpXpTSd!D5IL9C8{ac)0Suja(Kz(eI6A8xmbwd}d1;akn{3AN2tFul1>t59 z8fiG$qn2>O^C!k`nCU?Gp%!X(hxVjLkrqvRv=&uxGka%+$LDLybZ*+zP+q*+Q%>oG zLk)2z16H_ljDRe3&4bfzaFm&U5O^FiY8397y76oZPRxoi(le)Pen-4>VM}2~ywTWN zdplc;Dh}BwA|1#t=$V~JiBkl*RSD+P8x1`Nj)X>IS{L+m_ZDLa4iJ3(dp4Z^iJ(t$!KpoFZSHFAZBI19v3Gl7n*De}va1D_3*l5JoFoiA@}-kIOXISNJS5WBv%;{x z)CS8dgZ5Yp58p#p(0s>OZMbBs`*~K3_Dj&rpu?-7O^sUNeDa$>Rfc;nQ`SGSgcM9Qak_K}2Ws0bvbR>*5_&ol3t;_Rmm^0U z8v~8eVe1ze!^Q$lhxv8N(!!9^voHrwD&_KZlt|7$aSriacf2gx3_YZ*F@y53fvWi7^@4bcujauF~jMHymrY?{tpj7`%7V8O2p{CZRAdM2+8F4>Ob zb<)mffj8xeOPy4+iowj$x&8rNxMm78T@K59v@q#4bj~Y}d+L@nyi*X)136c>yVti@ zMSDBj;7&!aI|U_iFRoU{UR6;>j*sdGT1Pe9K&WrttSS#|u-SIRWQsbkYW2QmmM0$d>fx$6xHkfB zOffeG7n3{+5Aw9sE|g*|-~nZ!RauVDPMBIzPM5L6|9JG9Xwv7+rn}A;#-@&Jhf7Ub zVN4ucHl!?GIe6CK@*%@U46d9tcu3{2VU_WjgIilG5@i*8$6|CBs4t|@4llZja}5s` z4Tm6jK!GU2YvlLgR?FUhBN+&L4x6yrEtzHKl(!xDPh1WAR zWRdBDn~drc`bsN$rbofH%BcCl$vM1a-p+09?aBpPR#BS4uNt5HfsYA@meo|lr7d-Q zU#cD@^qu?)qu=6bCBdVc-YbO-;AF?vYS_*=JC6N8UrQdgE6#2ua7P@1W!?>kKz5Ji z>=X zzAwVg1n{a@bzcvBr_L9P8+&LUYD?nL`Eh?yu;5VRa6Nnljiq*0p3}Z8S~)>&&9Um3 z8r#itPV|79Q>)9x5Jpt!u}3cUG0?uYkH@Z|yB1Zq`G*>65LyV27jRvmcO7h#M$0b4Tdhot z{Zki6MpY)@gmke_F>=$(D;5DZ^^P^yCDe4QOXu{A(`bS#`SeUX2!6T^O~CL3EuOjb zJ%lGcg?)dcR+`VB<_5Z}{WR$4O!WI6gja+|!808TdKRD4s)J4G(JjBj24(A~9+Hfz zOu%ACwmT2gYT~C}rL*?~^{SH0%hV~BemK=Z6H4vPx5C$ND~uujLyzkEWQ9=&u?(*; zauNFJ(b>+>qa2rH87kORVfzzhtKY`~<+dc_0H5+Sv*}{4I^ea*!k=G8w{kkQu7eAB z>^a?T>CV5^MRNKojC?Pe#B1x)9G9fIsWSLY71rF8t$uHAL+BvWUxb3zfP+mHmJMa= zr|C#CI<#~Z6l|)n3R1Rys-R?aSm`P#*i>N^G`w_S1)It@EU$LK0(z5Hy?);sJkbL_ zYe>RdBh-UGl9lk$s7d^f+Bu1qxoIDG^^K_NNwoChGhVzFRKfdAy5_dQ>jm&_6L8sA zRsW2m(K72X?`3Eg4!%GwbP8+F>%m23uASmfaJbfrdU}OxXxY0_&y7B~azc)8@~oPy zR?L|vHzK$mR$k5#+EPk)up|BV;oUvbk*}a3`N~|(5J+6QMsGp`*KkYO{I<^4Xx8^O zM!V^Kso8bLAWX9K$fsI~dzYj!msw?usdpmUw`!XCxq7RlF_%qe3}$@UqcN9RWsE7W zfv;A~9B596al_FBLLtcwe~Y64vMx?+Wy{30>Rf=s(}XW_t^b(;#)QxxQsEWat&wQ`zT51-xPq zzl5Tx7gd^E=lG7p5_{K$FY)U#%^f?scztFc-kjRj87+_Y*_%YU1byj2m7$`~%g~n| zR2c^Mc^UfBgDOL1pO>L8J@iqBR`0*HF8*h}A!Mf9cbVj}uJGv8O;S43a> zzAJKH`feqn?=$nd%erq{GS3e!Y}Q0Cm)5R@wSwaU8;0Si}D!t^x%kRj+a#Cv++c`p7oop+(J;`sCwEMfVYQ=j_K z1!OZIl+>q|Vk-@u+er00V9PXpwjHHN)W0qT$w0@;+> zXyV}BHh3f>JlQbDw@1K}oo08zV-9I(!Pl{P;~L$&CpufdVW zRy2cT|2b^w?p~lzF!s+Sa*-&#b8ZTq|7?zT<0;Vo^4!*4LC*WrXU0ZEJ0<75M|Xz0 z@N11>Z&X13LV92}r7>F8v#=+X=*Vff$SyTzy;14nkWjM-waE^C?UC2SH@~Zp@d_Op zGAittLC+vBY!yenyikwV{pwQ}6yDO3wT$)+@jBEzDc4y8JZCfIygNRmp3)zP3wt+s zY8pM(%wFdJ4_Nm0jVC+dnc8N4h>x%}frbi9Oh%!v38O9%Xd_KwjCiAFVYy=b8)8-1l!q!woF(&Npq!=sy9Yis1u2NG6 z-35N=HGifkc|q!^9TtfS@s&5Gyul)NA>Q)FL>ha$yYo+D&X7!F&X^kHbQ*KUWEykE zlsBEmoG~Yj`bHIBv(;^}rVgJki|?Ft8e{H^^a4yR}4RvD*0^N3=A;KWk9Y*p*-8PaZ>Nb-+QJr3A z)@{?{OsJI$c$Pc7oli~917*fsS^kfBGJDgif?zwlD~$I~>k6}C=W~VeIVDi7jEi$R z8NIoB;{ez3+S+@Qi5R?$JNq(Q4q|P(r9BZ(`mFAQr}i415j3+%o2n{L4^A%GgnaL` zhAWJ}45($3tA4s&xlogRbV80>cTs+Nj*=)x{e!A>mz^vr}_&iUzKAa?b2|1)$pP zkM>!8W}^8c&Vb#O|A>>|pQrqYQ(-4zKjI|lk>R+4JR!P?{AeG&Wpc!)q zG6Lss)s$0=BkEcDKiW|>eG>jtLZH*=CelBT88w}>zuejBWq*0}&*l2dZz{QvZguJ} zf3Wo1+MY=Et4}*Q?5|Sl?m;^h^`7(oah*O~^}lyrc=aUW{(s-O-lP9u{_W`TgN5K9 zPJXaJY~TCALeTAT>3s#N*}pB#A=*~GG)L)g_)BxFwr?!WQR?pF?8}zkaKrY0OMApR z$$39S-wYiEkhVt`0Q);y0Ved^vjEhcMizkEo>u^@>q_m=)N5<I6nZc})#5DcJgEgoE%7z=%-jDDO!`c;4V!?uKhJn&I3G72<~=pZ>T87giU5KR{SX~#+FTNF;;YX;iA<%8z|gNq8oF!Z9#o5snuVy4_?Wh=w0n?mP8MO_gw88otN@=az ziYl#LU2(;~0Lx74N@2=YQYozYtELn-bx$sZEw?|H!k%p`rLd-(h-!G{svj0_IG~G{ z*tQPb*`ejQ7ZH2v^nHCHR&0wdG8}(nF4CNBD@7VI*)}iE!8E~><>7ZC-Vwgz7Iy-{ zy@}%arp^`f_SvSTGVIhz$%9U-rjmPbYOdtAb!9q>cco6h=>L80M;FK*kQLd8aES2V zrDkWUMKpV3I6Y+5lV4KZ1vkl+%%a)>mC~Y$5pJFJT0hi%&Tj zc9PKIP8}?tu8igFSHGrp_Pb}*?V#cIyJuBqc;ZsOdsb!sAw27bO|M%hMYB$OGzz|P zrKE;+$Z~IA=%|x@|6dZz0YR7G@G-;Lq*7Y9!Pn`5uSoOzz~JXT%b?0Dxn*Z*ru4?s z)@DlY!daXty>U~cLt7ImcobBuyS;06ECz2G$Jfe~sFLwnc+MoSsy}==wca1@(%M0P zICWY^f4I|ag;v)elvfzPQ)Vu640tk*Jy9r!g_n(v@uGzJhPup~nC^OH(;% zZ4=E&?r&l_LAHtHB-dr7Dpt1{<-ny^QJ$!F3%(k9J6mEw`K^=b&8*V~tIB<*{41@& zUmM&Tl_m(-)rM<~p?#~OW4mV0hKJop%c^7Ca%ks=&*ftS>R12{{&Bf~ z=?_;OKrA!inxo5QDZ6k;x@?52hlTV9ge`p?F54r`mfDDQlI`h0yhJr*xXpG>EqByT z9tv^npGy>C!%i&

^8Y@S&>uI3sKEX;A_8z;0{clXYPkhb6;t&cR2&`Lh+&Z!Z0{ z+Ha0+Q|LFBy8SqdKUrH(mL;D2cw4^(hv2WTf(_aH7i>c3(`)K>E|qOlr@b-{XE?F* z#))25q!pXnA`SU7T%7*zG-YePNJF~*)unmr_^l|D;-Ij^R&}s$YtN;n zW*Y$VwqYA;QK9&oX;H>(lPJoJ$+5X23P1J9f!aWG~NDCyu24|VmfUfBv8SkkSO z$K2C?_6oA4AtTaC`bbCFhbFkx4&W^8D9oroJtaYl3~p_grDjfF0K zt@B+F2`l(PSJLKX%q$9)GB#MWD~&l79bBSO8gpvFwq)jPwT4_$nNv;F_^Y)P#++&` zg*lZts@77NbE>rz=A3FRg*jcV&Wt|C5iH9gPa#%JFz%qt7srG&uk`tR_F=v_i#o^* z7ggpLD-FNyF-RX+R*f+8m8Qi--8Z&P*Y1Oyn10>|wsj-H>->T*Ud=z-p_g*zeC28% z_;d>zeEDbzo#uYcYF{`tZ87}f&AxDJnrZ*KHM_0;b!&ES{p(gYj0)RLHWj`8iqoF%cGcI01T`_6hmi7lHdjKa}lds}BBY{4a@8Sh)|UaN}9#GAxJ zdTp#MM(<{v3Qq`dG1VT!sC3U|a0Qip6?D}y7`oFGm%-@Mn)@6KF*!D8IOJ`vA*~_(DA8oz9Xjmw5GAo{ zg0;_}E!J+9cG6c1H^qeQpFf4(NSt5Y8MAI{H!Dpg2{^q2l-9o6CrWGCw7h6l8MJ+G zYN938mGs(DiDVr9h&i9li?_$%4m58PzQ!%#r51K4dSXrLb_n@9k!baL5(ldfG5xNY z0!^30s*k%^vuuRxG`VFY!D&r-8HwBJBFjj`rt6h^lMcZR5^GMwElqe%{glR_NncqHWv`&b@j-z*vXsc2lfV*LOzW8?vg_1Li7c9`DKDaG zoJ;nqinZfZMzN;SYN1$zPWp>AW%3^NnmT(D$&|;ZL_)_9Z;aYW%kwYUhaPp}1rCbf z9TV_G#W8LN`azsKHT;A4Piq!GNEG^rA7*JkKm%}B34WLeoWAsfWI%U7wHl$<^!vXq z0v0fS=wNhes-jgxgP&uOX(S3c;)7!X+Jl$H{Ld%qTQBZt)2GErA6EL*ogF{=)Qub{ z`qY&>BJ`;v-M(el??aav`gosv)rEyozP76qCKZop%kGx!&WKG*|hl%$nq>ea(iX}l%j z!Aeehdl&2*5-?#Y{0?erzp&7;)IP)thi^FZ0ISC8?H7Ff88UrKKiN_a2b9%QE6OQL z@IQH6`BOIWg4^8ps6p9udf!jYvlPuUZ4~+`t))n-GaCPt&{8DS*(*&ndn0dlvTMFK zb75@i$aZ*PPHWtY4=x*07OxyUYjF9HVIu}t&Kf+Va@erS_{_nrtrdx~ioIhoZw$Pb z%QwP@t}u!*-g%!F?kVuty{sJUY5sbji-p}I&zCZynXKYeOGWJSffeG&PjT4 zhD^5ompz0u`^?w!SK(AQ;g7zQNB_G_Ub~+U z-6};o zQR<|i`3^5@s+o!>4BHbh>bg^sXi2QO!)HkhrVolGG3$2vk{GnLA{wDbFV6EfUEIyV zfq#=Xrb1Lf-Y7gaXINrEOQJgkiyf-Yht|X*@NsR-E32uE)sG)vS3S0VY-~#B+|I7~ zomE4u9A(31##_~)h@jQS$z*(?*O{2_wI@1fr{)L+*>8xAX&P5sS3hoa4D3`5i6c=p z1dysB%%GErW$@rL>sKA=43BuVlS99(sw(pVv`~Vr7Z&zo`&Cp@^w{RTw$52yu^5)y zo7^-QTv3?25>cuM!NW$C@c?)3m)eK@EXXj`XiK~& zl~#+x>nDsJ+t@UEl&VA0U?wX#lNO@v1$^vg%&ODFcE97O?MFdDQzNU6jcyp%G=6L~ zUQ&+dsjG&hy1Jl&b-^iXY6Z#O&Qx1R!b>ERaAz4cFYX1D&Va9FY=Hs@FyQl`D2I8I z7WSkP9RdEa02O1Kn@5eRtsWh#8eBC*McfkxP{8Tm%6Nmmhj7zBmeE$0na&sxv2+nA z03QLL2RRw$HSvLzN{WY9sLbw4F02sMgXtMQcI>Fy@ngr1jlnxs)SXF@Djy!Js;sK& z;1?|VzVn;LS1!_X77M#jWH7!=wzX+v6^~?ni;s?IJ<_j+Hn)c)l@gu z##9_ML-2Hkhwn5%|V3y=mXhZXuhQ`_^YINiVwdgus+z=Z-zHxkW z&G-gkIMFrBYGJq>0*x*>b{aM_e65GiU|ROeFb#Cg;IEwCiAzvw3>cYt?iHyMANY^#tABap|<>K(cL&CB2jCm0&;?aJQW(XKLZ#*p|&tC7^ll&oc0}B z&;T9uxt;)wi#3g|A2Y7GX?!f1YQbFvKB@r!kNu>F{z$fat?=sSR<&ct?paKho0LUYtqw+?nJT$<`GpR5}jxRCKzxcFBylsA0kz$_{;KaG(yR%tLNgc1pZ3muTJw%7_O?}XbgT;;4hfu!S7c5Mc=fWl+`rE8mq^R z8PhbnIyNbhnmh+Cdv2{u^t2?~)R8Yth9;%rsWy0t2P6tskD6fJD4Bw(+93&CL~4Px zq_&PY%(|v#nLer#<87-o8KmWKoqwznA6h}Tk0cg!!=o)6msBkocuH#wu11EyC-lT& zg$qp4RIocm&&E(IHazQ6F;&1#FfhZwR7}0rZM&7#@EGE75Wd8XqMCz zt8JJtwx)V~qdS#VM^*6f?>1UT$Q+cOuw{#CVx_N}ac7=5*!THxIxMLO{Inc854;q+ zzB(58b!GU`wec1%VaM47HikTv_J~}0!pW$+*y8&4YgNhYr@A=wxjkyuACqbOv18f) zp)8I6+seQRHXW79Z(v%A^VY%gQ}!G5q4gX1?J%xp?7Lk(GvO$V`iL@!>qovXw13~n z96;cwHiE#fVf4vwGDBI(8L|QA=*1KzFTGpHyg*ZYJLS%0ZXlA7BkE5@j+ieYc~R+U z$qP5h$!Q9zJEdy2Tnoxy=2@~oF*$kjr6mt0Jt_IY)v>`1IJwEIoq@?g>{ArIKJOK4p%FE03S#ovnyvgJ=)p)vV#S)7^l^cH8& zWE{Inp@$+tZL=7A{>&F+%a{G)O{LdB@it8@U|%U^EfizVUkk<9^3_7|rqXMnc$=mc zU?|UVeNGHCIbi;r=79K8mot%`p`1~Z2xyJ`3d_)CLN%`q8Ub>K{Yl9g^ra?GEg}5ouGmRm0~eDZ8wnqtqvsp8;&IG3mZzPLa+aMweWOFyymPm0p}}BW+c)3_w zUHQJ!{(T>_`@m1F_rR}>bG`cSb~sJw@BHrd=RW`P>|S0uta6~;%7+afF=FV@^0MLfGyJQ(tZeAep#uk24j(*x7=3l% z>a8a{8rkBu8xLAAJ`y=^`3P-;T9fb`_<0HSuSjIxa*@d7t@Xe7|Emv(3~Eix?42E* zq`$cj{&;+#{+IfHEHa>G(9E75_tO>KfAHT&4Jf;BP%5z?747KMU;hmLIAxnifpP@sM#J>kqD+a$nWJ)zzsli8x|b4Rp2K`HxfSo4`@d0fT~C& zEI!mt1I^i4beP^hfaV$2g~e9^x_3ac$&T;`Y+*X|yDMnsur4gVeL!~tXr9la8wI+r zKr?bD_ye{ud-(Z&tRW%%3d$eq_Rm2#1at?2?p)S}l^1o_facXKx`RRY1!!7!hCg5n zvxo7`XAKGAS5P_DhtCfI-Dz3uq3%-9+?<2%QP8}cMThO>Q_u|91^$2ynr&cwsM`!Q zduGwqfUX`iC$cWAeo=QNXx`01x6-bW$SC;1Et9a*wufo@;WoS1{|e9%0WMK=)ay#kv5ur4fr>w<1`aK0-B z09#l&K7j9HpxJqMl0{aB|JnR4P#?nYHR0!U(45CQ*{-DS3een`gYHhyJRGRA`_=2+*X7itCR742%2wLC(9x2EeC_@`8cq`mdV}& zp!qZF!t7x`e-Shv`E?8M37zDEeys|>zh;g8G&Z0tHmFMZs!zK3(P_cZ8U%3=@W`&W+k zR;+|^7k+RHs}GEC5Nk*XzryNwDClZ(uytmBk*G_ZK)uU!|LNB(EKZlz14uYF>wtU-IYh2>=r(2ZklrgF>#O(*NZ@`B|! z6*T7xd+G6EIj#ZCjjYR5jyqX{Wxy@09QUT_$^!TMe*@iXtPLy2CgA5kpxJN)xy(3D z4hBt?U*~JjI8N>lnhw7%V4Pe8nqT>KK6^M$-ohFcVR(DK8+4Clv4`#X-5l*L0o^Kl zD6e7pLwnnUW`tiCP~K^vY4PiP<;DCR4Vtt3x&V7OfaWg0&Swwv_abXlNy78@2IxM{ zVh_u^#-1>)!4GaGF9GrG1)3(m&KDn+cQ$C|`*i{K&IQe-ex1)AmiJ!PV0^fRjen1T z?r%BR`#eW`{|4PkxNriS$xA?d+p$I|!{gfpbi;D6Hzh}V`-846i#@F06G3ynUl&jx zcYx+0zs^@)tlxit=1adWz}~uhMIu|m4{n+AwFM{sv9PF*Ix6YjUe^~!m19Tg+*3?H*9$(`AV+d%Pg)SBwk_if@$| z%$wi`Hxr-F9+smj2KyuU!7Y=$ju`BZ;0HHj&sV?L&##Q3!fs*pdrK@5c?y1T3oGxA z@ZE>8NM!wLRAr8DOVCuaE-XIuGlex|5Png+52&~4piBAf`E)o=o&=f;{5oG=)&kv) ztg(L6+x^Dy<=r{xFfY%7?mO1v{5L4is2fxhiA;qb+>FlG4r1`#NuYU@b<4rOV*@7K z=WlS?)xsaJ86A~3YC00Ot1UniV;$z*#%FbyzXL#%WSz37^I~;)oOc*#PRgP~ zzrO&@t*l!<#4qX|2hAs}TOmY;@vT`0YlHBETUdP9&vyn*1M9-)7voYP`4g zhJMck%@tC|`vt4R`u#mk%k0L{BO=$3$H>qZLC=Gj*cY&d&?=0?_KD#x9md0Oa#%kcteK4M*_azvV74FP^| zGrE>Jb9->Xl(*Q*k;rh?=+E%v2Ao>oy`j2kY*RyX)1>C=$+eApZ0j{os`aMUPu#0~ zL|NIk0pB-GuAf*vdHh7LuD)iq$Ybq9KquEVjrW=+jrXQC)zy2GCe+t9H8j;v zoJ6kU?eHS_PIxE`KFeeeuX^5sifM44ZhdEbW_zM_FaHPA67jiHSv4@Ghy1e8DqyypHw%-gS1bqA2)dhBx?q?LAa~C zvop~?1D=yMV`gt#d#n5DZuqdXww6JyZOIv&^BJl3o9j47gR(*l!OEb2nt9METE`>@G4>h8~^9rd#CMg z3Ie|G_y4~8%gmfP_c`a>d+xbqW;QdQ$a(!t!stcWT`}IXTXs)Hp^lLbr{_bK*Do*V z_IOW`({qHK%AUl~Oxd%`vCGn4a(Pe;*@FU6bsb5L(T>EVF@+4ckH&FoU5oT6_Rlfu zZS3DIM#I*X-Sa|ij$yEEliyQf!Rfi| z@?1j1xT1Gjmo0*rGxxG}W*wK?5iIX^)TJh8_IFu2OXvH`)R>8(VRCLUT7TzE>lW7V z2({<}wEa0bFJ5VT04q8@M`ib2X!~M>Kwa7MiBJ`dSSBrK<1R8<+b(ueOqKcqShK>lBwvPD>%U73E8uk8FhK`WzWa5=OcC| z%92o7qj`z%lsn`+ou2Ucygnw`bF^<>P#CX=J0tkqS16*h%}1{2A7>76Sc6SaiG!2rj7OQ` zmYYb4rbml5L@yh4UCFQcGLA+-da|-X1E>gV=sX_iG%c01^@ z8AWmgDl9jmrJ#^jg?}ab=O1W{fOzFdLyMJjW?S14NU^ zZj86AL52jPd3MEywlv9ku25S^ts|yM-a2$onzxPvl);?mIM<~%K5uzgqbQ&VDBVa+ zDC9=MR3r2ViyPS?N%%v6wOlwmSjuirgC}CGp6vO6#ne`6Kb%mgW7;Wd$z~ZM3aQ~% zVdD{%&ZtrporMoeR&>9YBH?S#AdFMT<=o$`G^baVukMf+{mv#w@Ew@@cC?V&6wA5i z0_EH*jb>_7)$SM`cw+3@WkwxoWm4kINO!<_9jG1n)I^?9g2W`}76h`&Q|NMsQtz6A z4TJFwg{dL@>kd3Kk(NU0Qr*#w zEfU>yUVu#uifnc&uZFH(8Zc(aY!Kryo=3XTp)jg3#y(uDN_2PHBGE#!B9m?a>Q%<0 z5l0Nc99{|Rx(pNqY7z$_H0utR7hTw3p+SgGlaWQTdr9b8#`%5ep4m}Yc0Y3UYIe&- zR~FLIhVwNz*2QrZj=|tB!!Z!&ORrwdX%UfsK41f8vlU!Pq*ya}9uGZ0N*5K8wWLDF zW)vM2dN6b?3L`4XPpFn%ILGseON=474gq@vW3O_d%Xqw)>ow<_BM)vrD*tv) zHXkG}gvkZJ*P(zcINMV;ACTP%K<8n{yt6bvXR?b>Tj_R^;!rTgvTV9`ako?yK{eY|3mejACHzElC5z&3TgcM2~M?0 zCX96zBLc#}kRoU&67^U!^6|S7Mg?MjoKdDK7O6^9MX5?e#Y`}yUbGWw6OLSpQzUhg z@$`1YLu@AVjw-<^lAuw*ER|+wvns_YlA_-(LrPa4y`3$p1gA*iM=nuHeYUDnoFb{; zxRk{tSr&stvavniZNq_kfKw##7vq^oLO3gggW3LlmP?-I6iJxTHohK+Wq7{ZPAJws zoFb{pT&i{zsdhq;R6DAwR6C;j#o$xb4g_UZ9ZPa`flyKb2(E!sq`}HGG_DXJRVbn< zQInutj-$bbQ`GCZ1nJGirX-$Eb>b9B*FwHoYAhg1NsJhdCJS6I>0F0RNj%>u(*XIR z-3RkHo~FQYEX2lZ$tfyHV;_k@I*B4xf>R{X!bhTyPGYAj!6}kxr%8z3rH@9M1$n7B zMG}!*qLgUdtx9o}(W8ImKlxSw+#p4vI?$1gPVzo$C1iCe=DjSRl zO?qC#W@c3%$#BG{QC>;=KyZzmB8>?QX{hjM#-a*S0nJhXtMEXoBx!?&_R^eyvI~*! zw-Ece3hX&Wg-G!&#ALM)8Qz6h%Qa9TOd)|%NK`c`WbiE)s~)JFUn#TVSme^v8#R3d zir1P`WH5{AY)oPI^(|5b3>=gcDLUg=3L{QY7;z~=UBIR!fBI)}{Q{!sr7om{9+gajS@>Aj2THB||astm3eMyTer6X^hsyr!I@nl9lIxc;b>U0JG?ieo}0sa8bD zDH75T0f%tTr8z~?_wahq(1^*8k|II597i?a6nTqF5bAMkO7f?BmBB}fUhC<^MG|xcj%ld`->+3AI7JfqOoC0mQNF(CIPyKG$oE{r+xI-5G;oS^@8Y^a zQPTTyEiJY8 z^V)F&nVDKWoF1alIbD3|6E*u)<|N9Qip{Lg_Mr(so1rKKE5nYtR0+ac8H$>t7NbZq zfKea}iRx4G>yR1r+Nu`B%uvztaB7Tz(cYiifdx7+PZ*0<4!ZP1h!6%{^i zTv%A=`hzygaI1P7dYqmn+q?@?Y5S|CrD0Pmtw!<7ia~~4y*@piz)%#k z!x=>}tJMfBmP)IUHn{MTk$_UG(&V(^Vx*y@icQi(H6LxrC9Xd4Qd9YPsTIq5j5keM zxpndwR zPNlhv*`x9=Vic91#yze4iUhR~-fFG2QC8aYj2wLQgT8G#bjrB2RQ%E_DRUB9a4Nm5 z#%|XJsj`O_{zfQf%h=c`i<+pwOZ*m2fh=RW4u|C^`Wru4^vpNu0SoS0@aKRQ(aXmTZ@=pBbLSg{%sEnN&8&7$S8cYY zXLhA(xpl@RtXTZvvp+3(;-ho!R+sLXv+Rve(`sdI8lfCJS%QjF2mI8q--UrSJ#x$E z6#n-=)!6p-&Z_J4idwaDJ<+f8rVlP$_;JHs*~;<6xS@Y++!%#u zGtb;_y41d?;_0x11;6zhT{wFBmidRD=%yT-IUl}wJf&yC_|bEZPR^`WV??)l{l;Y_ zyw*ng^w*W?(F^mQO&($IbGi9b>jOGObsu_m?SLot_FA|2%XjWt_|)rf+Pj{Nf8qXB zQy#kWo{=978nfg1hn4fG{jUsd&^O?#^UM0S8$PT{Mr7Ls??p{Jf4pm4VyNrm!(Y5m zF?!Ut+>8&D{0kL!S8G1E-J{o@HT$=N~W?-#^V!pq$S+xiY0j z(WI2J>XWp`)8^Q@PuJCK*y`N@D~`@Hr=~t%FL`~pXXm$m`r+5loZs5_=`qjFuY6C@ zj@ZBM{IRfh{oi|RmfF4c+KNBh-f`C>_fFpY)ZM>tnb<;BOzDocGb1BGc!0CG>xEK=_P-g+upz+_l=VxHm@DxG!qO zsvb>`c%}w^Q|;%pzv?|Szo7B=@0p`|Yf3e_+IftVu#A>g5D2({K1$t^8=yo5Q}iZStB|6P}j8SI(8Ad2B}X zf^)L_*C{Utt-o`n_4E0THuHjBdac{%f7EPvY){eNfU5Q5mvnld&xGHy?&%S?U&$Y} zA!B=xyJhg#dru#E#rbypsv-N*7Z1As6GiXy^^UwZBJA!Q1uw1c{Bz<^&k9BF?lC`H zs#|n=_tlqg+5JejuX`+?^xP8_es0>NZPbUiUW(3Lp&WDWS?qcs{n(VEq3@5}@`Sxz z$hMHgfaVd8H@VR5f=wd=%4hgQdQbzpUxB_>~>II~02dAO7~K zZ!Is|nvB{1!&}MKikpobc|7#Pmkxi?XV05=ZT?tNQ_QlZEhS{_kd(zW&$#ZyS;$5D~3=@kz<>XJ>`h_osZW5YJ^z@Cade(%` z^~F?W7*v>*r~P{RU6;2lS~!_arDJYkn8w(Xbho3I_xkFgr$}Z~gusmW_(UULjFn+Z zw?)f0vx#o9lMfx~abtY-gfL7Wf%&UjmY?>j&M>5dQu|(Q?)TMG136|>=@?o>noV?* zo9e#LPQQNi_F*jpCf|A$wM%^{<)M|G*+eBL>31vaZ0f70 zUO6!J%YkXYFx2h{GpTOwXKQ_JH7p0_R)*wa4~FbFBsy>vaca$u-N zW)npSrIey$-}siN33AH9!1cg{Vo$Zn4xB&0R}bZCnCcULx#){&#xV3)g!FV<{ifX) zLnD|Ok7P^3v|tz;?Xe~IJvGx;PfLcO9z?d5E?8gai)qC$-(gRq%)wi4!;N2x06u2U z0>%GF(rlv9gL1l^3I3oJ8$I=yHptO1PmZ7dh%ctC0n_8_#kKSp{tmi!409fP8qqdf z+4;J@JRC!wF`MWC6pgF$h1=KaF}%zj7)B{`zx4+uwAYoH>j`5RMUUm3Pf-c)x`+Gd z3G>lIBO&jnB%Sy8#~7~2;j9*%YO0TfB zd@MK-D(5G`X{2(hn*VB&aC(?)G6r5ISd7cxT zb}DBAf0i$`S2-I6Crsu1B{&sS&U{)DAz4(;pMn#paz@ia45=nK+`)SUr@G3CqJohl z1mkpNr`S;ga7<^xqIC=BLD7DIoB-J!3(>jx3B9+RkoQN>wQ6lFuj9PaplaWJB%WWy% zuqhlS^&QS=oxm}yVtP&#SwD}BW;TY2QjBRFr9ACbjKZNKlj=xPm$1>$z&M>0TPjB> zAe;FaCZY?_o3T-sW}HZ+y;M#(HP0lLFEHUGMTrI!CdD+zcj`d&yejKLPWdS&Zg zvPJdMq?%L*3yELh>f4J}bH;kzrrH`Rq!`9v>vmO2sh1|TOh_?|pb@m;5Rg-!}NHL7TRveS6i#?^OdEb9r zMYVNRNHL7TR&QXndbMucsdp#V`h2gAKN5jMAivgcQRVYzm*Q8z&QVe6L*Kj69 zt0}VeuB}y9O{!Xbu#gzWAT-q55z z6;cdikQ&dV#FQiTe>FG0f*ObIZOBAo7=t$^fUCvfuH%O~X;PbPB!jo#Vl&ojB5_PK ztWf_-d*#(&O{zy@u#gzWU@IM5&DMbT-kz;V?GjQ9W2o1iOiG#cT1PIuSCbmhge>uY z_eTkJZ)~M&1I^Z$(FZSTQlAJZhB4Th%%lQIB~riXHHTVMA0{{DT!t~&nt}|?*1<{j zdTLTjs?nU=Vi<$1=>}W(2JD)w zNzE5h3}djB&7_p}q7`gS)rV(<6vG&7+O;A}%CErnS2uIO)mC4$N@=G0@EIY+Fa}$5nUrEHHS^C4np8wp1VKa^! z^N3@(%5JLKDiBf(W3V-!Nh!8oncRK8CZ&A!iD3*ryvxT{1J%~XHpoO`7=x_^;A(xj zc-&_lHL133nGkz%g0Wr;nUp>bYpJ%@2`Pp#*jmJ-lzLGdYEre@ArpyV4E0(JE}!+3 zIMk%>7E%mju$9ZC6k8OBn$#5`#V`h2OPG|>mnjZ4smbk;iNr7lTT8*!d`NMqNu3l@ z3}di$HgCfu(g6o zDYn8FEbm-VwbdsAnMe#{Xs z-H)w)QPB8*Y$K_*oTdrGfXYgJn-VU;M( zB@CqaTT2=1A?*26X%nbRL$@VpQp$@%2?HtJJE0#|r2;@jJz0O7CN)slA`IoC4Frd1 zqn<~=(XRd|Uy;GTq6sO&7^PN&!=-4{y0ozvGYhwbx8@2d!We7%D3hXYOf{{)a^y}; z>Wq*gjM3I(Oo|pmzBLW%2sRR7jJDQ*qj~k)G4*?BwvvSuVT`sOSEb0-*8}37*QDkO zDZ)TX7nx5msbK6Wtxb9ygP-D!twM@0MyV&kDJjNIL5g|-VT|>9ib=J^o_siV@9>W` zTYm^!gfZ4@EjZdQAB@pbuM;wn)?zc3@M&dEK}gy4z3r$mV`#u7dYj@fhzWg@+iKKw^b>NO!n7^BpBaLlGU zB!aZ<{zG4BQYVEJVT@AGfnzq2=PO|2siHUrb>{8GFoxJb0F@|}EutHBl{aHvcjA4w*XHrTl8@-VfjZCC`Y*=;c-dA5h9QBSO zPLLE^yMz?O7^HRprS(dqH`;Y)N+gCcNEND5zTS93NHL7T8%0cNI`-s^&khz0&`N0O z0TvR&7;NnXR~w^@-cY_R#4rY_U8AN{1XtgMVI{@-5=-zyfBkY8rmMk}(^m!c-(z zG$_vDush;<4GRmmv$BMH0frJ_1WGw`Vsf_KC$kso(JPkndnWbq$#t+=I+^06xKgvj z*nj71|19rQu%td-2r3ylO;KNJHdmjOl{`BMZ#_uj9@V*k)gZj&Hw36|=vkH~y)#9b z{hIY#{IZcr2@|t2X5wFFQwIl$|`m9*z)q zP>6@~7{C6~b1(RLX@VNJ|I~))hhZh@rvAoj;Rm5KBRaaDT(xXUXHV+m2jv}@Wk8hw z1%}_*03|65{Bv;n)bwoq`S`4~H1%Bh?^h#AIqiJq4Y3 zYKGcLQggEKC5?=!_N2b(NQ}0JhJ}TO^>y~`<8+8_V~>cmE0R&H0yLEA{s-I3O{@;n z(JRwZlQOfj?0)}ko0oyYnUpEs_v;RSs#F0{M%FJvd&=b-5D@FEG460&hrh$v{1qN% zS4Wh8+kR*$de$(MAdGd)(4-h;7@}5W9rn6n6@!;!1l3Ng7sBzM`3Y%LGBfDAH%S>Y zr>12krKU~3f&ZG%Mhe!JWb3BB1wb9LuztvHnTpEZACF80mG|9o&t!Ws+dpYbw(M886=S8l(X$i{NmG)i=0I$A691eRRHRRsnwEO)N>j0{4GpvR4C{F_*G2Xy*&+30w!;5) zTQ_h;<5Q0tw7}8njrdpmlN2*+7Q5<;o0XD=@1^0UKoaqKXW?UXa`Mzvd^9ZztUg1; zNenHTeHck`GNGoYrQ~F#XU|SzOKV&uWlTy>lR|T*&P<=08d~NZg3wHMce8Aqs<71i z0;;;wQL3^sZWE~L%EGA%OTDe2sw*9(Dl7lJ0af!gh^S`Dds{&@Qf>joL^WqQyrZb9EgPvQy_xp_mEzn~8~A!I|B=(pT((Q0^f}(N zp==!&pPU(bbB(2EMlgFf*^Ckc|EJ%oRpRXb_-g3lig6| zTBo|9YV~cV-XkgR!va-6yTh*pGZj+Jz8-zXwz?rI{k78#QEY6Z8=_KapPv8rgA1C$ zwFf6kv;Mb>p)IQaC;UN6?Ei8>xJM%X`vu{bTK@wD`LA^u!?V8sT8}Z7LUYE=ee$SP z_a@uXZYJF1XQ`q_bnoD1ThfhcH`#lxPvom+MjU z^$lkFhs{cb|828sb<5M~)XN;*$bGFp%TO!&uNl0yar*|=vAm=94KaCbWA+U(d2J*1 z4Kb;N>opFL*JFEVTuDEzqA1YH)&e_WJ)4Arjy=;_&!{qIK4j<|!` zv!nQD6f!b63_pa{?D8L%b&--{5=zW0>z6nYQLOa3AGuPwk`kPeFjexuk&sPC84#sR zC2O%8%3c}{)hIceUHqw!8+nbGtC)!PPeXpp=`$4@8qc3%77q@4-`@S516+=N_=P(C zYe~znr)zQ~DYS2~I+RgO>Oaj7V; z!9XcPq!*u~Bm8p19r&4|!yf1G{`Wm$qU3(3S}PeM43`Da%5aTHt*>%Rkxbs38{wB5 z<;7L1LxZgDpBl9Pf)h;@={HlCN{8@{;gL2ig?H}KwQHwN;bC1g9#P?8_+WG=o2^r1SOm`+TP5}GU!{icY`F8y zDU#HKUKfC*|4JL3pTi3QmNX|ym#PE}+9hSib(-Ys8#{ts~y%v=$pBlCuR59P5pX2cO>hREu8Nfkf5tha>q&fgv2Fl5m~N ziHj~Lu4g%MG3CIGLAm>s1DA}KE35~uVmnq<_MHf=zOy(JdwTcCoxscxIC}p>Nw|f; ztniED-$^2+ZLvKJ%npI0cRXnNG~6f1I10>bVI);@`$nQbM}et~HxE%Nt$a0rY2+8D z*`-%tv;rng;7W=Y!sP<9y$oDq;64ZDZ-FbRzLZ@(Qj%h^Q7Q>X{u?1M42YdS|Ixdj zmH_7#SfgLG`rd*JdY9eWD6XxfenfVQ1%@O2+qEL|XW-1@9bYBctpVIEz}U*btpct! zFv|PMN@|ZrzrtQrV8)Ag z;L!M>)ngX3K|A7q0nB#-XY`+jyA`;N+pfECs6R0>=?^q z8H|00Nz-TSAE9xQ6o!qG(SJr1&CMhkWQV3NIY?B5@l3AUqtIZ0p?u01%+u77JX@q@5U2X2ADQom$4 zFMWi2qMZ6(1n%uJ^ilafE~mavfjd)%J}O@Yyai34N~&)NaJLFRJJ}Te3a_V~-xOd8-??^fIeGc5YGV}$be3b^`YfacF(KudGd$a+j zv%rRS)o8)fLD@_kfJeaC=1U5388&_|!-u7{0MY3QhjMXG#r?*27SKm5dvH` zFiQoF>+{7?`>qohkSvwdZZG)Y{I}Z%;IFglYyD%jq{`LF<_qa#(C+pL0=ItUkhAmac~(J%Mb`4 zsrB&EM{&>um^K2(_4&4MHQ;&z6JG|7^d$=nNS6G?K||!+3EbTVeg5O%F<_n(xYFuT z1k8SeKHqv&g558HIV*4_jYG7ax+E~H64wH_j^#C{8y6Q|yiNqwiZ_E_vg; z^ilf;55@f{Y?MliQ#&v&fh(!L6jyfwGu@!iw|(maw+xu41&-E<{^F1N?;e2x$&$bJ zrFJ^vg_G*zeymr0YXWx^xbFnEwEF%HOqF5WW@+_p2~4=amDDdOp5uUV30z6>Ot@hJ z!!7&w3(Yg5fy)ut((2&`<{^PAtsZXyv(2E-x810G2Y@*ya3$4)?0hLOrPYJx->-de z{`=bn;4TYnN%f%qR(m+Ux`d5VX?__D%ou?yNgu`YJYbd@^!fUw25^r8^NK;AFOIHX z_6iJ0mi)ytjcbR!aQ?S%pq@_mp&WxT?8h0BnYI^`dcV4VFFiD zeW}0o2WGfIpKm{+bLl~g|RbGX1TAa*6yw+C>}GW4~C z`~+a`^~U*$(^rAn;*Ila4~qL^z?|{M`O#M)QIbNiQ7Wmvq^|=oJq50`xE}&cQW^T_ zx@a!2M8$ zKEmBH8qX}SQ7Xx9E#$=r3{_j<*N& zu{a2wMHosAvAqw>iE`k+2c`-=SVmIo;Z?p4$ZHAAaDgkWe96Ep6*#qgUizrMj{@^v zIrQxY=DfE)uQ;GMy(%yuSz>-3H+{NtPDdJFywk#9_}L3b>vZq5kbbA&Ww$Co)+8g6 z+4aJ80i-@~g9Vn>mnGp=19QL|=jA^;Osx*1u#8RK_KyZpnrJ9 z3)RC3%xDA7H%>=j!1PIXGu3 zz0lv4K91hI-XlH%U!A~f`%?zv?cMm026V^9^>z$(CAgfux;2@cJ}xD5O13|XF@qtR z5bGR}O;L8K!=`FQMQ*-cspseXVpe2c^8R8fgm(+W(BR(!EX28(?30~fV z3uEHFnFCz0`2U2sAx&%+wE2(N-o-XwGKEkG#B@s>Ivq9=>4PVU@j3WBNn(85;68DQ z{rU|Y-apaRf5ed3eo1KQ!EyZ)645@1)XnkllT)XrO-{r+h!V%;q)$%ObKB8tgwj*m zr>18mie^sCo|u)EoSK=DF}Z!lxI3k8Quh!O#<&Ag4g6khjT@_eag0w-$;z0XF+SVY za&Rl#0KB<(O8Ol9D~T-zA7e?!OM7vXGxtIldFh^1X-=+JVy&T zx?o0Y*;9O$YKNn|G(X!W=jOMNb5EU;-STBF0=aX9V6c60k$dFbv7t8N#6{*u9*W$< zGn#|(BsPmAs}wyR-okj)nVw}7E0VC@*vonyAM0fprH0`~Y01Y;k$GXtQ&1@DHtQx+ zq03{EH{*%reGlT9sw+DGt{SLKpp@9W!milRAd~FDS)si7)2L0y7Jtzo#`)V>x#0Ke zvS)`}aJHvxJ|L&>u=lb`&glI4X8Gz4cS2|&3BrF&(481scj&O;js(Y0$1ulmRCa8< z=c4R6A$zXKo)FpdlicQ#>~RFjZJ_b8#ku(^PgZEOE(yU1=gOOfVmO24HhblQD;C*v zP(Jvb)00mU(Zw^yJ3VJ*&rZ4Eltp$g30;fYDqeJXPRY67UUcQPt?10l36|aSLc?Tt zY-ktRJvr1ayR$=O+6~-7;~?{_%TpZrA8PkjPESRr+vN204s^O5f#(~_d6p_p&kxS% z-Lf_2tTXzob=g=9=jWHWJo{bl6`?OcMSNaPpbH9HLcPtER{<^@k)P@I`{saq37bWF1$!R)e}nps@hZX9#f-WL>M2HbM@aGR&@k2CP<0an_r z6k)RG19rm39^0rwx*NNbN!hUHrIS5HF1KuRx$Sj_IEF&k2-!U`*qJxts_f20oS&E7 zvrff(&bi!UKXIWK9sEo7{OEFL9&mZSa=B*}$9pcz=!2QE=XW{!h&8V|>TL}+xjdC! zp4ox%o`cp9`(~%-WW49g@lNYqJL5gSv4~Lu#_5R*cI8=m${tr}OZjTCe6_%7E|!}X zBLi(&v)Gw8Ai(Ky1QQq8l!4Ccu@qw*^hk17WcCWSK2boKd9zJU^JO_ND4OAV1-gLi zmlt%K6N5vrB93t)J};9ihlae7fwDWm8U00ed)d>EM(gaFMF?|{KJ_S)QHu+H|iGzZ6;^eIBEWLLiHuT2p9HN zToX+>8rPXOQFF{3atw-|-BR`p&^hKK#W8*8Iu&7dMD~2dA`Rtpp?oVQz!|cqw(RK- zI~W9=<_}z+Y>b0wD{_vV)pQ<)!=@->FPOxrD0?P{&SFjOiIbeUI|J3G`J75nYSW+u zJk~K~j&O_~RTz#q+=s$hq?bUQU{qi9FwWbjQZh{#G$`9-w<|P|CJgkZE0Mp-?r_;X z4IY>l?4DNFzI+-+$J#!$o5j2K| z^cjmS(;BjDA$iQbY!y4avzi~);()vt_yN-+ofYE%>GCu@T{|Z@F7YEt>4mll% zi#Y6FMn4Lpxor2cQ#eNrCHFgRIb7z45&SR_2S|0{2RjbCm(9YS3x|Q?!t)5=*)4k# z(O_sH8P2sO70S>o78)MoKt)BhNV*|uhn#l{cr-1@c|+iws&bx;=_Y^*j;_aMEOMEr zkaUkKw1WLStXrgJL}9bAe-e0=@ot9Z4NS9Al-&**IN=?PF-qw$t`-#171vt~S{oD> zDt~cGtDa7aQ`gD7Mj!4THYK1{r1!C5p@-mwQ?o;ZDQ?3s3m|SiP8*G3{V}`Bo|wAS z(=c>;Vni_}-0H%`FNWRmhyaFEXDmXK2l7Qx}5!=;kypSvDxX#_)jh_D61kjW?d> z0~T(qUR145v00=B*z+EaVC&*SeK1Lp7X~>!18q)^y)G>))e0iI_*(KuWCtS#ETzUk z9n=n1`K1mKqE01V?~F!qc&#RY;luu@rkO0bSX=w4kl*;S-d82%-tl-GhPo z+{Qe6{;-(o*jX;iznZgs%R&r0j3v`LIW{y512kQe1<};%#>FA67&3$1nOI?DVudln z_J7?9iC@p{H7;MxdU>j9Zm00FJP^w(#G9~AK!Sa_J!rZFOG&Buyb0ubwor_oHx^!s) z!VV(Of%__a$Dcdss}7<{XaZNe|iQ(x;n#W-JbPVNO+&U1x|sVk2jp<-B982iXsZ(*}Y z6k6{w8JfxHQeCW7F#ry#OG9z)@75XU^p$a6snoejor!U6$k&UzW9rhRvdfJ77&IT3 zIBP`%#oLbJQOs4j7h39vkA1lNEuCQ{4Fa_u8yjNfapumqOV%Y1QW(2m38gTW-P=Mh~D7?22FdYc?+XJIS7~ z^A#e0jl+1CdnLfS;&Z5wan0+>n~lysESOqognV_c%lwzK=`mdO9iW*pcL%~I7MFs% zmxQi@1SQtb*nKfif2?8m$W8atWj!gw^(AqfO+Sjy8;djCEuaf}Os{l7|1-_2{dG&~ z50&fI-Yn3Zp2M=|L#E!<<}bRBW{<~Ah`U0v3#A*lJdqYrR8Ttu$(|LgP_*O;k@I3v z{%91#B(#btn!9)D=NQcBcEASIz~vDx^l+ET;FG&$@X6IO?i8?QV3Ds}$imuM%8cB{ ztuHDn#wlIfvRhNTV_Yz?faUGmLOq(3v|j7P2GB521=uXo@7V8S)E#JbPTd9S7sh)Q z)Mt#k0BQ%L{sdJOn? z9Ey917lK(S_~1u)MgK-^0Y!OecSqgXCDho=Yy z&h%oc`uPTB`eObh8dBlj&B{Xy)akBDTj`0#`BvJ43NqvGK?NT2%n!J_Bi6ISiTh-E z{Rgtz(#Tu^edPQtdhRN$D=w4s(69LA1wX}T6PK@dc zxXmcPjg{YtE(VGC&4gKw;w?n+a-smnsEWzoi3m~htxHl-Q-RT<0Y=XCLxvOg-MWy; zb3Jh8*d52lHSPAhesF7qO7g+2FQ@`+7U@;&w=wE%?B8Wne^iq%o#?(6AMl<6Rm5`N z0L3M?fZ`HQp$G5cT0j*t>Mu|`7!`yb&xgY#P&AiWq`jc{$a6%cyzkuaVMuTnf?#XQ zKoB2rE?kI-YBFw2W9q3(*Ccj&NVTZo6!O(5p{F;Cw$pt)cxOS5b@wu&X?#4_9E7J& z-BoyebnEz4a^52(DCga)_A;KC^UY=erMvs!`eFbNKY$3!jL3Pfv*DSZhG0}{iLpu> z_}&0Y9rs?x2_dk+Yb1MS;`z@P*|PfRCwDF$Ax9DOjmE{3h~tLV{CPJ4b6p&$o?^zgvQe5!2~o5nncE8$z|s^hM475y4lbtnpSN=qw*5!1B(Jda4E(Luvw%e>@1K0fQDJ?Dj0$!GR4o1#z)KH)XNnb--14 zrbQImp!)%KL$=gsExD6yrkp@rchrS_v^@>O?A{HtGgQV>=KunO^=NVTf-QB(GV5`e zxyM^G*u9URtPA3oU$O?X711SY2(qm2R0xFL@$R^VyW$pOFu`ojJC*Dix{6&OMbOm| zp4QExJDTDFZ9V>g)`^q@fZHBaY^)?e#fDDA zN`j(}tt7Boj9<%y$i_r!wfY>XUrAuXn@AGlwI|P*q)sUhfoLABOQKEqJgT0bz$|o1 zKarkCD8zq4P&i0Tx$Kmt+_icn>9DDbam=XnOa(J4c^c1>wVz}do+t04H7gID4xqYX zrm#reLD3tHERs{DMuGYQn?+iU{ZouuhdsYRupbl;HoA{}jOC`QA$C6~aV42|&n#q~ z!^VEQ`W{1K6j=*GVe{Q8w!edpLCV-9t%Zzse93AP?!Daga71X zpa(zkI35>?MaPTE+!hwQd>$=Hw7HGkt=x&~ zU0XTnC&EY+sQ{ZrO2qzSM$N;X-v@gY6#oUoCQ!vJ_Xzf1GU^KUd@iekNaHhDU6pF8 zQfMK%=2YWs50eIWp`Ocsw?NOil_6p2A=w(YqmTmOCDtuW6$7M-5dox3ilCiH)nLku zDo7Hi0zo+#&s4=CRf(!7Rf(vWN#I_z6UnMdaf+n+a4DS~>Xb?fRwXz^67gl)2~nju zMN&gbwL?Fa;Pv4YNzfI#St_kQHB>21krd50kg}L0%VL}&+1Q@%YN-;OB8fCEK^_>) zJv~h)QAd^F6iG~Cym~sHkpSh;pk!wMR6dhY#E+((NE9r*o}40?X^c0P5TK+v>@=XY zq;LDSlq(X=vRntJNCz#Re0_DNB7$RmRf zC@gd%ss~L+%-!+V?NOyCj_OxSV z9E!>Mi6s?su9$;hl>CD=G>H4y62BX{RIxrq08~s0dFo9t*bAN^0k6rAXj- zn<~XAlA;?%W~p(70I34H93@49ayc$YrN}*8f>6V;DaoI1`n3jh3y7kZO0C(~EO5P~ zbEcwHMH*!`FuftQt4OsIs!O$_LZsUFSHBp1s#<?#$+h3B`77? z7?-qjit4)$gRjL_PMXH$pL2Tx zqUbf2iOW$vc_%!91@MFUH9DhG(}Iu3)Luqev8RQS zS*ndaEhx=Wm5l*!2UtQY4hxi}$LnDZv3v!-NaJv%lJL@#Urf-8Wh)ZhVO3HKwe*}K znLm6>Z(+hz`bvz_#TYME#W1OPz+i-YMTC51ggZh%LJN0tBoFtRpn}z+M8cGkTB=3i z6e~VM8XQ?eElO=(6snxWMpQm}2CNLwPd;=XKuN7s6PzLw^_Z4=t*c56quNRhO--cW zi`7mA9jKBYm|1D8J|Y4jP0`GKY6I1b$%2sRjc!V6qgvqf;pY8^H864z@_aUpJHjiyAPnB1PfHu@vN-BK=&7P~CL3^rwF)*AFBmMK6tS zS{XP+wzyu>NlPy!`O`a!=?$rgnJ22YRP#;$ac!I{Comb(nhZ)wom8)Iio8PkW~rqD zp|ae`SQODy7^R;ppJsFAPsr2Hl~pcDsR4IXlp0!sB#VWG<2bHy5r|R1Z~(QzW&VNi}XC zB(?v!qSWH+N>crzK&eJ{Whp4NieyQk4$S{GnT|A|a9Nv5(e%i*kgXS>Pf7mlt>pFu zL@6DGk5(p5QTTAZq?2x4D9NAR2btc|uM^fX3~6brsKW7f)hnDLuRO+(V+n;^X&pNa zu+e#m={tZ-Y#O5rTN9g(UuKl}_K!{djz)<(D5EL{XRe2C59sxjCibgp{T(kUe6GUA zJ`7~TcY$pDvp_zY+T$AwYVq)KnpC@;VYV{0dN>{kT%~jBiTXrMxCv-8%XtxJx=BV4 z6g1&CG88p*K9ej>g7CW-iW-Q1OU*Ar=+?Tg9My+?r^D|zl%N2=y@DV$u9ixxS|Kw- zm3|vrDF(HVh%m+63JtbOD$U9s)ynIDnmCeeR+T}P^q z^79b;3R-xGon{nO@M}idu>XcpEwMktC>m3~WfXS*IJHu(pM?%?{T!pn`ge@7VSk=c zWc@#kBI_3zg`FW$Yb#&DNgf}W5)l>^9+4at5gy*9Yiif7$tn20OG>Blol{afrrmD0 zGg;r}C$?Tw=hUd=aj9LRlE+7dr$j~JETUr={<=m*rKCnhd1>PR<)}54F|?RTpB+U$ z?=uu2|6z?!voQ@NT8Qa2k;FwqE*LERFZ2jwLr0i{-@$!T4#0<+95@ztzC zQ_TYnxk`?5a63#EzMKa7@GQM2&42iyb7zHlI>d=n(Am{6xESNApChHeI3)MWKK?+ znvs;u22{0sm!ngb>KG-I$TAhKso#PqJn>73Wx@3_ zXI0zxS=)*kt9Lv`_ZnCl-hS2L=gv0@nRBGlnpy3huKGbi-k2WaUvrdnoR)7-n0anP z?P5H7kU?yz9QfzwJ2n zWiM0e)EbXZY5MC+Z`{}K+k-n3TP%Cy)3jQdn?@+dPL`nJ)B!&=>~~>cO^@92xv$4J zZ+7zKA0Ik<{*x95f0{Bc_dk;#dE~vLrxpIl?vvhKv*)mN!uw0BzuoENpp{a`pr`AM zxp&N!(?3mUvh%_HA2)nsZ_JPrd0&3-cw}W!u5x^K(azKdpBS}n!l4EI{y6{S^c`QG zTpZHz_B!6jtrNa3cym`|yTQ#~N%?i!$eiU*f7q+~V~-Ro<$v`4*z*srn=wH-_FHIq z!V=_Mpd1^vjvLYIodc`xiR#lf$iAe(oYefY?N_yYO*txZ%CXD3Gj$&t6Y_Si?H$fO z+AH#qa%|>&_~P-Do(UbQjOkY?{^+gaN6$SvIkQ@g<0l`edgbRgHtv7uu}vov_kMMM zr>So*-IX$0X$Ncl+WV5K3{UJ)G-uJReOIqK>}=I^;*9U!=pT{&-Gqm3>3%Wsr(@kF z4zAPw^1Zgi*6(k7YJEV5sP0404zl)N_LAjvYT{dObbk4lOTTuX9$Bf`#7i|5`S_56 z;)PY;Z0c=iYX2)k8}tqM>in|4?S>EQk`dW zCI3Q&-PM}UZTIN4<{zK@&e{Y0emT@}@Y*xa)V+J}Ul&uWZg>AY&h}yT^Fgw^c+Zfh zyA-=(3+}$Z#>y8?XG!w*Z;w5DBJKMp9}D>7_qXzEDE8-l|MY#g?b-XJV*gmb^ce?p z=h?jT2d`VZvU2A1d*>c{V`Wm+cQ2b$Q=hMwyuRCtUA4mlTaC5>u`?>y0e%fTuQFU7iFsjS#3+;sZD7|*VhQ@1GG{r{95Y$vxvgZ&IY--hFk_(-=3N>SJD5>GkazqeC(;qU+=H>V$ulhAy}>g{tXZGH5Y4Gp$hM^x%FG2xBI`?K~bxOY~pzI|Ls z@9tZ^d2r>1%1_^;`2T$Htfw}+4jiuH zUN@m;^s}#aSv2F>E*j$`gzW4U$|N7cGDMJey!ml|c>msaWYg8AWpy)kN1qi@P^r3ZiaI19+R4Q>FlJT%DJn?;g_3S>2T^q@W@`_xmn*WX_?-2)*f^H z)+1t1p6jynoMX4=%Uau>dFGM+!5^@QUT{u!|2pO6p!IjIw0=I{(Pm!IORshN{EwOq zkL@Yi8&I`={E|)&^qKHm);&Gq_AB|LHe_rMa<>frdhh8YuQ=b1Uo~W3`r<+Nf1=Dk z%JGA2leOXRdG^DL=B#(lXn96C9{Ig!%^=HfHQtSQcFh+tt>4++tk3P6;wP>S*%p!* z&^+StCKtM$T;@2vvDSsT7vHWFvGMkTk77D*u+&%bmo=Rhzp`U@hf>ai4}bgAx0aV} zO~&m1;jQFq#mz>JJRbVtONYPcv**pbHh(NBa;a->|E&3Y>4|0OUmQEBa83J=%HDbu z{ffSk!Pfrc-+8S;Nw{z8Si5F@bakcT4|@vUL()Dyb&b1%iS87bCHwfaw?B1N?#tj6{(du`QG`fLww3pgJHVUo}|~)e>HmB zq9wc8R62%!pJg^R#-60R9lgBQR}VcpGn*m=X2i!Q@My@}Rvm^R|4=%;^wBSUF|@Ka zo5-_NC~D%xYaO)=sE;4YHJg^w9@}dbc8B@u zu`vvlhxEK#VW*$EH!cUJ3BxEqK>6yv`v&>if@+j!EcR5=+}}Qq@x_EPOfTAFJJELt z0)a}VuNRsSdP>JMF9)Ut!_ZGgsIT6#INhQ5A@9p{|Bd$xD#h|gY$IFf`US_dVi;;Q zs#jv=ydAz6bW5R!Fx0>F7~YrLFbqXLVRnpu81sjB-6;airqVI(7)FW1qrXIN_SMtA z9GDIaL!&FDjd8zYVDl~yLJH+kFhMoXq1n7K;S584kkXpm#C^UP>gl|nmW+vHn9}PW zRSrx?hPjgrAsufv1Hs~5=1#~ln`ri-w)l8pJ%=x*b2%_w7{*3>Y{`93;YTyxwz@LR zH0&v7LS8dJKBONVnAtno2(xs-`a)kl)cee)mH<=%wIKRk{Lqj}ukSl-WHzA?Y^-}@ z`%k#d?2YNc^w3jsnq4+-bt05B43GKS8HV}|<3>LG+?$beWi;Y!(-mgF!UQN znh~GblD)^*mcyWDNTtBf>^fUqPcMd{r>vOVq;12$SnTVc7>1dMJ*CMti(mA`#3ILR zqTh_rYT&7ngVC*VVwfxA7)GgkkFOWkiq(~e`=_@7)3DO$t-hE(222CXN2z)Yub0d) zS=iIuG;Gi0AAHN>H0UA!$hz`yJ$)I5eyl;U(fbecVP8G{40@{9{ykwrY!h980OO${}AU=%FY7P76nR5%*Mfb#l345BmEtr-hl% zBYO5n^c;`qsX~XPXkndZ5k2VFfu+qkER+tU=+RMZmOp1Zl{ zQn%+Q_tbZL^5|rVmgM$)#Xa$E4}P#yw5D#)Gu)Ht_MAm0c(ev?Pa*e|LXVT59o%!8 z+f%24V|9kx(~o;jcYB`Xo*1|1C+@k>?df>7qf^rDxsQ9wyFCr)h7zr++f#;aAJNWo zd!}*Endoum;tskX?lUm(&i^n4Nn)BB|u3 zMVJXE-s?$ZVVn!XMUsLfuJ%JHS<8Vc}Jz_ZB@jjha9i4C;x;>4Oc!cG{jHqY) zhxmN>H0j@z>w#Y9j+NeD^4JIXzCS5Z`;?Dm!Gwzci@-hcuJe3Dtek!KZS$;3RT0J^ z!AQP(xmHBf+A*M3ZP!;rwi1lwtG8=KzGiP-H_Wq2XDh)-zAh71;nOz7b&l(6B3lVY z^3_N3mDpj>ZqMprwi1lwtFLQ?7b31W*VhiV5{%@lpKBG4%db> zx_}-Nq6tRwbvb&y`J%Wys~&767|B|Ynu5x!CALv;vW-Gx+zOE5gbR=Sd2<^DGY4;kgukdZHU?g7|!Yb_RlAe#g z?^(t1&9Go3Uju~|9lco8LfywE-s@R)WGlf)R+++zVxrce@=wD(s}XD^7|Ci7STBck zd{uJex{Iv@BgK^^tio}fKlX#CJgd!YB^b$9wrhnKq7ECozV@+|U?g8Tt`)^rxapEq z&#E>psAz(bd<{mg9M=V|uPn9_jO6QDVO2aX&*~1g5{%?)h_I@RJ=I41%wgo;hec~*DDk`11tVT+cmMo^D;3Y#QuYJht8hiFsWRb1&uTYY2}bf& zD6D9;Azydim6zdJ{mE8>k$e?NzRtL0%#WT`{Tg@^O)!$L(ddmX5sN)lRCI%cTFx^) z{6}a2TM0(;HHKL6DJPBa@`A5sdREieN-&bIvBIi&^?Fv%u$5pWt8v1r9QHKA*-sv9 z=~;cwR)UeN#=E}oA~fUL(00$NVomD9zuJgRuHNgYrv#m-$XEJDh3lNB&G?T{d$tmc zl#K~^*UQGwOV7T-vl_`(f{{izQCJnvhG(^atpp=kO%hi0u%iUFy@l_mcvjokN-&bu z^}>oDtc0e%(EdKp>Nr~oCe)zVzchJ+unM2eYkakEuVa+~247(iO)!$L$-;_`6dK{` zw{IQW(mg8c#GwmqGB$YyxRH9?ifVOY_*tV=BhP`Q#`Ay*h(;xuj#_7cpZ9HQ`t%|lGUxk z>H_Rzu+54Z_l0M*lC1Y7tOt8`TyF%w!?$@H)BhDuyq;Xbl+T-7$!zS0^Eb4LV@W4HzfAp+cvz1^ZU$+aZ z;yLuJhO(7lB&$1wRqfn_5{zVZ zx3CIlt(+4$i|O& zR>RmzFp{qY!m4;3dRD90N-&buLSc0d?Xhj&Tk=`Y>LgnUMzXq3Se=1AwR_`_)b^}; z)^mCVBOS~4SQd=r>j7bPI$P1bUNv{V7O*eDNI85^ScT{7 z;Ioq(dRE`Cm0%=aizHufHQ#zx3)fe|#m*1}Bl&trScQG9PN=ZLv$~0`1S9!cEUf69 zLhaETdmgCi`r6G_f{}bJ0qfPq#zp&gc~)m%BBb~)&z*mF*6CR)tirz9Rk`xU^Ic!P z*-9{yuZJaHIn@hVdsZ9SN-$DfkGNLkdvf)XKely!#nq=i=QsM~wf9l?O-dxNWPvBRMIr!zdO4T)rfe^DG8tcv|R*ej?VX+SmwPXo8WfR-!k$L^H4~`nKMGcNWL~mzFNIE{~6C} zB3lVY^0m>mBHb}9K3iSh_4Phm2}bg@$+e>6E4|4BZ9J=j7Nq3-YOP$o&!HFJv!Xq= zcTaz1k7re;6}r#_Bl+5lUT?k%A2_$1XN42HXo8XAdR|zSr#-d}AHQ~sXO)^PjKr^> z%17lE;@zY2(NYJqJ*$sX94o;{zFrVkquI$=?SN2HL)$a&;%n{y^P-I5|jyQZ~Pp($FnNY&gm75csY%G=s)l+ z_hSE^_Ez*nm#9p8dQ-IU^~k-jqT_=Y+3FSaM3*>Q(D)1BmZjcxGDRIL*cUOf)i(5) ze7(oMh>@*c^|AVqt%#AWUK3X5VNdPJa`h^DBP`$E=_LkM#s0PO?dXXv5r;j^#i4$i z`g&Ha*oqif75g{rUw5sd@G9wn3ve*eD{AR%MU2xomwV`4S?3M(c=x&Ve%J=*Y_=js zw%UOn$BJg~(6g`B^Q^YB6)|$8Zwf0q-BP3%+Z`}&5h1S46!BdlT^ocCd?OFB9of{{kJM_83%e!~5w z2YDmRVJl+fxNv}BgtUB@VoUn0)M+=vijGskNWR`fugU6twi1kV6ud92Qn07mxVqEf zvEB&lcS0AMU?i&#&>LMM1$(k;x8xZlES!x&Y$X_JgdYm4@O*VX_GWj_YCc;L6V8V7 zueE<9tf&sD=Ii9ty3w=R%vQw6Rv!zibFrrpJ`j2W2UB>2@3Iv!vehTTimoBa%4uP% zAJ~c*+3HjDI5kgf$1xw^92&NY>g=cxBU|ltts>*Ph^>f`tv(Z0;kdpmb;s?VuXb!j zjBNF}u&PRXY)%W0Fo&&(k*&T!j~7>`4PSie`I^R7#K=~FidhXj=MP+fgng}GD`I4; zuY^@Nu1Te8rFm96*@_t1>TB03?7_48nyrYDt-cXf`ilCUt%!k@bG{I3$G5_&KK4`_ z(>|W{o#*SEF6crdM)tK2Ja6w-wP{>i?Sit;V8Bu zMz-4TT2XDt$Jcze5{#6MAB0sV_7vCaaixEEyy8DX2iQt5yaG7K@&UZ-Wka6jc3sKV z`P~;>*NJuBvHB6c-t$ZWi3sV{Jhl>yWc8D<3TH#E!|&NjFp|~Ju2p0qC_$?M} z7-6y6I7mGu!r6FhX%tSU;fh?yR)Udy9THahnm@!=f|0BayH;Tjp0D;;QK<<=vO0oZ z?^u?zF`umjBkYfG5B*2DTErXT=jWqKgxB!NkKJ{t=l!%E9^;JdQtn}$tRce+n89s$VeSCF7a}F_pW_j=Ahv@*_Y>J4olA*J~}6qoSc|4AhlQf)czS= zQ?9^&Ho|}QcmF%1b6##yM$wRhoXqTuA=u$3lcc`PLHPwma@XMe{360K@cUO8cr_w7 zFS95ol#!b^CVyB?#@NiF!u-5Yaz=mWN3=3>3JUTIoS$G3uG89KAjRy2j{B=x8Cm)G z{-7i7b!O+_YlQjZG5&bB(~<1mJ~cHZwS8K8d_sx{FhK$O5zrr@j~$X(loIh~8j_RN zj^0ns=os;Csz_aDA)L|P_w9J`Lt5VNT15;jqoYF5$Y>_Q^1g37^4j0&5}rf^3FaU3 za?_9;q*OeaJZ7z1?eK$1`sRK9So}Coc82)9wG8~;T82|9Zjn$h8T|%;AZOI*oV+ZmnS|sx{1#Ad7AmbEH}Be% zcKwp$vW8?9WE2%-<`xyEv~z^Hd{T%=SCFeQD&=%So)PJ)y)B_|Z(7|zMKc64Szc1l4}R!T~-3Jw1_Q`Ydz!on2q zmvvkuoT7{o`C}--&M!HsaA(S0TpVoD6EID5@M4a`wUQDSm)eAKs|>7jUSUyY zURF*D0>@IDLvS`eOhWKs)xdnnPc-z39RND>+^pJQbseJ2}Ds{cJj_MjPCaiunC4!%T<) zV4|EKflEnu%FCH0>EM&z(Hw|;YC(PcMX9#p&`VBE>YG_O%$#}z)GwY&Le!e`GF)vU z6Dj@70#Zaioc16ZnLiRsWY#c*_^&yl)h8K_;A3P#Zhk>-(fAB!c6~;RsQ#4!VM)Fg zM(aG*R~%zJ*;zOT z=H(Zk`2jd``kB??uWF(OrfEMyGNow zCp)E+JhEQx+jgNtLBqMa?Xi$%X60a0}zl?r)IQ?WnTl{KjuV&h1 zhL-jISKyi`9bah==jtyXl2Ir@UGaat>i~fa)OLKy0moq%4CG~rUsP@jWz8uHLr|3qa&TvpQ!ugss}0V7?ZTrRkV=Dd4lXa0VrR-u zkpqu7Q?~1*4X{(OQP492T;~;k!~LbM6zI1l%F9h?{Tk%`ut7Qz+{WT1e*uBnT^cq3>m4vD`Ve=W|61d7CTG z@Z$hnOM1g|Z>RsIvB%>|GQqj|FyClc2Ec~_?!Wj(eq>PrO+(RWL|TzW7aR+tkkCOR{V{G>VH)NsdoW#wh+HuZB~S zI;Dn^izmYOVM7FN|9mFGRNRvO^~VwsdO?p{bOwP>Um}bw9v~I7N%(JZImP89;xAQ; zV;cBOE+XrvHdBdWrvB0Z9n(`Nzh=VMDHt>t2LHqXlhJnEINZkPk8M9LD`zA<_rT{i z=<85`=P{i!^RkEM6eOXmV;}yHw)E&Zq9dbyC!z{-vPO$XP~rhKo~h&y%gqVlTs0OK z3~_-U{KSnEpDqS-uAuM7J+7QT<%$J-`s2z4aju~6r$w%uKjn(qf8^sTpMr_&#`e=9 z*NL@3*oEbXM_~uHxF`Q_e8S_6=3h|{58mf6MixkhMgP(VL}5RF%{c7Z;!~!uBO5dAh z#GBbuu@ckVPprP(Ge^cHpNg$lC8uH)PKUUH{7WbKaCZKNLU<4s9{`5E*`WBiIX5pZ zJ}%h?c1~rMu%n!CD$15{I29HbKW<%Gv0g!1;c6vX8F?jWg@Z{GB|)$+G>yd3{+DRmP5wxBmle_JY?ce)n*i(gdHT_^utsqnDE-_XPd zlz&mu`5H~Q4F55`@Bshf*K@+-`K#uxdrX_C0l$wL@Bp1ZjKP-%eLiI<{y~^-QvY2? z;gJ4ceXS@w1^>_d6$=pM{D1cAOvUo{e>x2JrsV(l*UNZ5aKrR}JrHL`694Z9;@m_0 z{~(a?lJ%eZaiM!T`JbBr?>hKDHwWqk{C{pHygQHo+#D2J6vN*}`fJ~l3SUVfm48#n z9n!z^#VdE9|B}2rd@m9I*!R2KvHu&|#RlH%zuzGfUzPhy-+%kZze84R*8e*(?fy4S zjQcPitKNU7=6}`HxF3D|cWRJ<|5a1te$e#asrlbFHO^6kkM;gLHUHbDrr71#|Il}? zi(QBOPmMsjf&ZTxgmmBdKQsvGM?-Q(=4TDT-eZw@t~2PivdfzGu&N zsomOlOX-(4EH8g-UUFj(7uL!TVz6~n^G`<<*YA+hwR4ZQ?b`R~k^+O|#^T2&k{jdK zCXyTT&rOh%%i{4D>z-fd4@a8erxyAe-wgVWX=0KXeX+kcq;X~R?c4~i%!4PNsR2lM zOlFl7Y3zO+!Z5!rKBA((niM~);zT4;B}}|uInlT){$|*R*QXN}^^ls2-VjZ9-h%K7H^v z8mFj0f7Rd=ZMT$O9XqA$CW#<3I5ytKmuy&^)C- z-(yWNiLLNQ?1Qp1Gb{u!!Qr9{TQ$v2${dv4EGctvQbJZz68qO?U;c#eK3zv`gC*)zRdV>xNk%6ApVJPSEsNE{`#m3B9U6vuO1hS_bxN9c zv-KAwt!L{LwTu6?jPrLg85!e7j7W)>+hF-W<1<4UMZ*i7Kfnz&OlaJ=d92qGnl@|R zyh#)MJELA7y-J9WZ_=bmY-}_9+nr4sQ_sLNvZvKATW#%%p|xHt8QM_C`7OEz_(74Z zqA@w)U#2UCp94Jd4gJ<(v35pz{0d;spwZXH^$GXBffv7jCvz#G@@d6?x0cw(*tUJI zaOG1{RE~bF`45!~fh+clwxkzBJEcu7AHPM_Bai3qSN)cc(Ce>g(SJ@3r9|k_4=J7( zq1P)Sj*j34>Nx!FR#DuDJkqB|zt;IExS2mVW2CrZ%l8`CK;f#O|5-3QnIl@qRYU&= zV15nYs)Gw1C=sfTjhadC1N^XIT`(nncDOQNJ-_3GE$zx;%Lg-oIayEUrh>UMfV&cU z3&H%V<-GizL(UJD2%UqCn(Wu(F2)es z05)p$>zO(|vLDL~anwxQ1WWD)OKyrKcZ(%A!;-thlDo@-y9W81XThxl_Y1fuk2v#T znm77A*gasL|HZ!!&H#6i8N3utH*duKZpoGW)$z%4+B&F&H_rlBn_05Z`He?^JeYwN z+)ywJEV!j$-m&051yk-fCl=HA@H45Q%3#_Da2JE?31++nHwDa-7Tj7epIdPI!JK#0 zKaPGF--Td`n4{l$)y+q3^iO97FGVwPPg!tTPF7V}jHpm0Y}DjD%iKj^>IHBpflwnb z^~*YXe&^{0U>;#k_AA%H3NV`jxB`s*6)?@tbo|QaK~Im4qjWIKm?K)3m(TFV^I#q< z@95F`>T#YPU2jBJhzgyBjhbH^=Yy#gz|r+aLol~#Id49;g1Z~cfU_OHa=acV&il;J z_^5etc-&R!p8)PXW=-cUTJQe^)9@T!yq;bm644yY@^c-I>P+W18QdRWT2^#8`u7%e z+!%0U!5paMaPoY3e#e6AT{$ZB>iPa0<*WV$4uhAX>HHGc(2`5E#_1!Q2$UT?oCIV3t{MtHHcu!F>wmgaucsT2!buHfpB%SdX{k z!F+e2!^y|Fyq?yIjS3}Ti`0|3mS8$+Id46fN9zHYeHS@;r6H<2&WTH_5f%ENra#vK z_Ko7ALgTSfqrFa#xLIJ{4&ZJE_boGcDVk1?*3V(JqC$n(sG0Ko4c?msCabo?$@iCX z{^o*th&hwq=g?aQW@epWz0F{@GiTE44ZU~3)T*n~^XBb-2wV>4NIe}V$5H#@s8Av{ zYO-ICqvsK=zzooGp5K)a$O3b2eVt#AtAGW zf~nKk-){?W1HjzX#NkZm>86NxBbY-0Tq3v&nns1XVWVc!qw`=9GXlg;SEsGfKNj4x z0ea2AeGKN@X8wL@9d89@ICJv+dU+;p446kOxD{YN3*cg*_dPRsDVi?c3K-BC&7(q9 zS~zi(2kCKM{n2&eMljo$ljD%Nx4?X&<-B;w@3&x%whZ<=zg1LdDK=_;exCxfLCeX0 zUk0 z`D+fQy_WO*(s`>Vm>;?X`_1c$^Dj1PruAc1T)=&n*-(n3+^#6 z&suPs!ECqS-U0KO1@}FeUoE&$UR0#SshcRxpnT=v@wO6__)|I^#25pMpySQ)isRneG?pygC-l6y{8EP+iRe z^C5GlJZFPD3g)Wuj$irtq@3s5!E9&Fq(|Rx+6SiLb&j5iqq^!2=2i>tQ7~TyaP%Cr z#Du8OW!R{h{L=VFf>|5DT?cLtn4S|IJvqDH^^c;})Uu)biUMtdDcaXbWOHFKtT>GSgE!ECqS-T|}Mg8L54 zkpM0Ueoul)ob1G5${%sPz}y_b)daT~%vR=1@e;Qa%%K48d~kn&IqydQJQG(BOj-a} z8(cb=iOiYCN8B_p%LBLx;MRaixXC|%#PtNTJ%CFGw+~F4DgN;icNv(+0ytV{H-UM9 zIa9pEy$)tq05=5OhhWlfcE)E~4~QEIW_JMB8QgI&ZKpbVrt?BeaHGMjV9w+>7To*H z;H7A~$WGk7VQj*G)PFIsZnSa21fcg9`8^GnYitAK03ELrHrM_d}1 zeimFVn28qLY%og#IGT^OU|wX-G#`}bH<-ao(M)md1os8Arg*9Teg*S8b0)tuzLIxG zh00^2X5uJ+7l65xIg?-FQo;1K;D&&i5Wvy(%N<}I3*hL!aT7CmDViyNKY}YU*NN8@ z2c1{XV}|9lbw$_Dy}->3&?9aUn2!TE%HPjmqVMq^-+kaJfms#6EdjR;%+PuMdNC-# z>%rW#z~L@{otHoP{%G1le7=Q^np`h3cORI?EVyUDY_{ND1@n#t_bHg~1Gp z;9}AA-Ixy3i^P7*^VD7Wv9s%=A07r3b0#oU6 zUH;@aE&|hLS#TW7!K`D>FOC<%ylKI`59X@?j^g+cOy}kPaXf$l^#OD6Nr#iaPwgF- zbpPA$DV(>kQIq5F^3n|NO$GBDb98<;ts5VK`Btmv`CSA1gJ2$g+VNXf(v$sOxB{PJ zW25HhcQlwAnUmv?{muZBy3*fo2l!ggjBt#d7q2(IBJ}?WuJ9R0&vc(c+{0kbU**qH z9=d|LoH-|s_=vyLBrX%o2n%j3m?;+AEHL*5aP)U_OTd(P)``P(eNS9HFt-G7Gr>I# zrsZmXJ>s&!{1m`l0_@#PD z0W*v_)A)$H0n8Ht933BGT7b!6&QEVVn2iB?69PC||Lz6zegH>$zk+G@aKu`pN+Rg>w*0uFh4RU`}Mdn;EsaH zd(F|qpS>3ID|63+xp=#d^N!yT-W~~N{QCw;ZmF6o+?RM}Pm(eK+oVuu+rsJdVD9S_I~13+{F>4`?}WeAi(?c??XA zcOAcU{`BV8U0=y4Q>yI4nY}k2zy?CkK4uUzs zoGCBFmHHUhFW9L0an-=o({f(CG`>b)-uWbWeA7RT3f+w@$nOJSp0MDa1+zuVdE?sw zXWPNd+w1r>%}0B1&x48i%;9LS%QO8wPGvAXwVdboC2(0_YJcwN$=4(j#z*PLo-!JLKg6S8)RR@;=W>Nr0-!HiZ%=^rl=B*#N zAHbx3?LTkyc~3uP@KQ9dPQ7^}E*o4Sv!*;x1UCuHu>g+rqQAl4!(yZ6r&krsd<$+d znCjmK>(vFb)Pj2o%*FeH^^(A>2;eB*4Pagi;AlO5n;FUrHQjs=_q8SWn+10#^h$ph z62NyaQ6i0 zk>5pN9uMH?`&_HQ9B0mSzd(AG_eX^;!bZ)MXVSX_OaXHyJ-V)$%?#;L)8&socUcJT zJ!Z+fiQ5mR&JWJ`Ox*VvP)jhies(z1dGIF$*d0u(Lk?$(qa?<21v7Xlnr?i=Wmt0A zmRznSmuJZpT5{toxk;AXO%@#G{}v0b4d(4OaIYSA=1so;kgqpVj^OzLHfpANCcShp zcmEQsSN2!@-6A$Wy*1FQ0p|VR9FDHfy?XJ+7mNOJM{)kZMok`{$5DKX!8{efk)L&7 zUbWzMgZaXO`vJ@!7TjsaaJ_+znkf#E2Qcv#TnjK=w48U|{}hh;f=T?{@k`%FFy;AU zFn=&-8Xx8Pv_Ej($41S>Q5;pl)VJW8fazet^#U`{f*T6vIt%V*Fn3#U4}f_}%XxXG z&t2AmNk8f2g{~J&dHw-R*+2dBM|rLYrbYlqd9Dwpl?B%UOu7X(5X?vm?m95HS#WoQ zS!%&O1!l9Blk@y4n877zCB$!BVKe3V4=`1u9L`jyl;_%D5(7BOb1N|2EVy(qgDtp` zU?y8|w}Dw;!7T;ztOd6j%$r)y%X2cy^L;RtN;>(g;*;lE_%V$3^n(~^raafjdp*HS z2;gWwrh>UMfTQ_X2xgfDw;Ie=3vMTvy%yYeV2)XE(fEy%pGN&{K?Nn zW$px+=gI|hmz)(H+F#zEqjv|;kK+_;UcGpJiMYyw6ZZiY99`;WgG)cx@lAh!<@uGb z|LUF>9ZJGRO|C0%eADn=8!#_3N3^HsaaY3c7tD|zH61q>H>|BIM~8M-cl@3yaq{^3 zUKkx3h>e;&KA9T|W{d?l8O%%z?jA6UwVW64bBJR(nB3aIaqI{48*_efl&BLOIulz^ zyp_PzwBRlU(_G7WagevR%m~NW>E?~N4i+3ehwE&?(eu*>z&*>XoEL9=so*w)`7?l{ z=clFX;{1z^nxEc9U3y-|SN?pW`Vg^%X!B+jc*Bd#e20k;6t zznR0)UYEZi=pO^-Q|3(L8wKtVn5^dheha{j1@m11M=B?n!AsF};}hOmI6nQj6?iim z+$v`Mj`Od<9AwUPoRi+~V3xIXeEaEr0_HpBOnOuYhrz_Oa`a4jCayA=dKO%3Fg+}| zL0}3kxLd%?x8Rn8dCr1+3(OY*+-M~1S1`lcIC+uJZ{Be}5!_ZVsVV+k6>tl|tVwk^ zT<&Y@p8OnQ1}{a^)gN)cTX1xJ7L(@qbky{I={PC_ZX&btb)6S4{aw+E7J4U9n0vsz z-O2GyzhCObA)ogfcSZiNQIqRb=DLEp+=9ylGeXOGaV&?Uv0!R;cl`R@H$DtzC3Ak` z+X!Zxmh=3+1$S?OS=`(4o8Xg|nSD_A*n;x17|c@^+&VBXTX1iJ`Ot#<3e3-1&WpD$ z27eq(jlNDCruC&4xF%qx1#omfxB$#g0bFlz(fy)BeX&t9`K9MKLzodDc3z!&aV$cA zA-HqW9XlN(>Lnk{gaGbw2uuajpugkS^!>j%xB%P$rdy`N^^oF_$JakQ zI+Tr#n&0^Hz+7j+-3(^71-AgqBNp5WFqX9}c{%f1hY^X!PFGjN4YuIggBu2J1+%7lChlc0rH44a{kUpi23c@pz-$cQ=<|u4 zV7_Ngt}E|2ssZi@n2Nc&`tvyPeF$b?BAPCL7vh~baBTzh(!q5HvxGVFuG4!G{V#yY z8|sYD#QgzoCYb5N9M1Ip4dPaSSw7sKqdzx!2h5Cohm)Tx%g66AFeOJioGH&6p?4OT z?FGSl%?hJK?XXcZ>D`C-dVu+!IjUP-{-PjIwJ17NeYB%z$_sHFz;qhp&%KQ}MuKTO z-r@Y#-CM!TWloMm&fkMzmT5V!{!Spi)nJ~v&VPKweF)~g3I5zV#PKJXwbwhG-~86P zAv%>Nzk9*#XHL$GJiotyDRHZ#Cv#r@au9DBW<+AJ)73L^BP}?} z*B(pmLko`1^LxP^VAd2zCvd-kNxscLUiuzBee6e7L25>aKA}~_|xc1;?f!WO*%1k@I#C-$il9|r9sV5sUdDcA@KQ8gy!3ZP zF|!>l#3gf5o_zf719OBqIe#8^CG1av88FAulR57=C%;)>mfjWY z_w>7?L+4_nChN(5tAiP@mjfK zOyNAoFMW>h<=Gn_ZWlu5%y$^P6ivtN#5+~Meb21CK6`r9AAfJK9<7s2Ex3V*qZPRO z7C4%+UoU^Pq4x!t(-%6NoIh`T54IvjltXd2(J$D%`HvHAI>IBoqq@Z+=&TdCr2{2Ig%G?h`QIX*n<6 zmoT8iVAia1#z)72E-w|(|0$TCn3Lo1^lE}T#tdGHrqf%Dcd9-c9omeIn!Ij!dTa1r z%ykWh7lWD4 zoXPK<;1+{vw9e6!Ie9&34W_e}^YTZ}ulq2Am!j$NLfilg?rsby1Ki>D&iH7r)B6}) zg$=kariBL0R9EEpyiE=xKPSy);hhJ>eWIdUy2&RSwS079>3oZ>z z4=v}#F$)Vve=uKvS-JO5AI?_;CpH@>I9Y_Q;72D3}cdE=wH{E!*p7&|Y2GWV$k zN2CA3lKa|%qt9pdfx|aF#PCelllgeJ5}0YsnT|{9UkBzn=Hxtk@lqVym=TV#)8&P@ z?H1fta67=wDdEIHb~-(}4qE}{tSB8P*Yl-dnlmTI;c@g_r7f60q8&Zc{qH3>5!@FO z6WUhR;RZ@lCcng84kpWj8v$m#1vdrE9TwcZU>>&Mo(8kgg4+t_ zEiLEOOK;@wBQW*Pck#-Mpv<>1}|Q@5t0=bk^t zWoH)A_bj+A z0eUpPPc8Mn0e2`skH%L%&dD)eie}1RRd98g^~+xeOT8Z8t_aYh@r|?8yBXZ<06ogz zQMK5$0@^r)WCt`!rifsGo~y=gw0fJtM{G#~Ui&_FP`l3w|g21?!2 zbIVC!Zf1_wzm)Qk9QnDO8N3ut$5Ec|jNtUg<-On@X4Vu3)xk@adON{=6re}rJ7%d@ zqIOK^Ol;Il<0HLGm=Pd$rg>`wF4;owYD>KwaH9hBD1UcY>MaEKXn-EYyVX)}2e=O` z^nSC{`x9K5I{x!P@z!GoFGVxWM`LiQ0eTc~hNa%M;0gouXnc2C>fI0S@c=y<-!@CV zo!~yQ&^u5L=fmxz*8od|5>`*yH zkH)tjO!Os692&igz+9?wiXM%xE0`-)PNO#-%v6X_$t+p3Dv|#%{0FhZz`DHDyPxQ2QxwClz3@;_kvleavHszU_MegMUTdJ3{2@u zl{hqdb-*-IIYp0--`>pNrD&%47yvHELT`$t-VAW_Ec8}e>OBYUwE(@Ui11rWz32vb z4u_4Jsa`05mog(j>`eJ<3@$Z5kJi5oOTA&>#s=t7{mr%1dlKCG06mKLJxjg4;PzYS zm2T+d7}BDd@>c;|HD*ooLHTQGsn-!)p8!3Ica){xcyLoK^p;raEd#eUK#$_xW2yH! zxB~%t6mOY$yZJZ=+=a}V=7aQFTk5q3*V{rb-%@WZxG4d8l)r~8^_~Q`K0r?#AC`K1 z!R-&wi^KRzC*VAdjhf$md@7jk%$eqc?&F7nDU$Re@6YLb($m4*6Tngao?r$qMbq8K z6SpRU)8EIx2<}a0O>vOk50-jI!Nnvx`Sa7O!Hg4yc^z*6u7!nOe@ne=a3cfs=)8Zs zrQQSJo(RyRI(^krZx^_a1N3No$HAP@$jP(w+($pZ=Yol4&NLsS*9J@v3%&kevMuy( z0yBp>zvJi;FwX?&(dUS}!0chp?>X0AW?&+k>G=2}g45^kM{viPHRX@yw{ns*7wpz} zT@nkfKC>o0I^Mci>ZOAlWT7|NQg0@>`4)O>EcIRl_hx_|EejRJ2A~- zLUGur`Nh!;OgrZM;ur*Gn4}juJ~}RM0CSh57s*i^E19A3QPagi=Y_QqT)g&k)0e>Q zl>CBIo=1@00ZYAO;7T_4uTwfcYBGbDqM7b5F9FvyK#%g*4@@p|e)Bd7%&h@>RQHd9 zSJ0#wW1%<2Qf~&hc>#KHh<7!Z z518|-zXM>71?bT_Ua2Ln$FWg!^di@Tc)XVcCYw33)72k+k9jjQcqy8Wqj`HRg45UO zTi`xn)^FZ^x73Snh39(MsG0O=9lDem0b*yWtLEU^2k6ndkp*U~%4we4&IR+3$|-eE z*OSkK*{O0Gy#rv5shpxm@m6XrAD5nAOJ^i{d z3d|(tO!G!@ECjPu(u<6P*1vUN_A%$T{-vd;brq>c_0m0p)5p;dTqd)oI7sgXOTAmb z-DRP-(o%0dxUB(tv>tqEsrMVW=u{_%rg%y3B4+SXG}C(37+h+A9vyEPmU_d$jSbMF z@y!MExXNkPt8HN3Ryk$8qV?|}m=bA9UNm|ag1JQH6g`T!Gc$N8nkj$%z-0#LQM@;R zxl83V<68;lIh9k!NAZ3HX1~g5^h&qI`iza5sb0kT%!~lBGsW8yT*m-Cu|8YsjRH3* zK#%Uv7lK){yKuWT;()+qru#$a!UTFULItI{8BU3 z-!gD(1N5j~_JBFaoZtDpWQUkg1#Hwz@zVLMA(&>&na?BD1DANN<6q-Xq|ivC!LPsrNCseF1t@SEqH1301^K&2Qc=2GfK& zQ@r&2pf8vK%$eqc?6a65ztnW|LC57_aMv^IH@-Pw9$?NiKB}utV75wnk=H}?yy*il zdzmxEL3Q;VGk7VQE)F^${R}RqQ*fRugNb9#FOD=YT_rtz92sD8m@~yee)5@dqR`I= z)k^`mo0#>Rk9)u@X3j5;Enr@g^z?Cj0_IER{Ngykj9(mLKETCvwwMnvam@L}kp`x# zq^FM~156HcesSb8;}-|5y9MBGXVz~%7K3?;IlnmG0JBHZi;RQTweP_EV!@T};^f#b z4!RyXFM^BLKDVs~t{$_dIK=r9%;n7apE?-#8b{Vu_2)3yo(BGePmb1nzZa zO?5zd*#qX20FKtHZ<+D)OL;i}?gX=bd8yD9-*3W3&6H=lPi_gOJ#&s;WL~I$05haV zO}9=`9oMvSO8{807vujBr{@w*qP>ILjoMvSO;bcbAI!&9n9MS9L>ik%mmHH_Ys_a zJ`RC9$*h|f&3sht<>WZ**EAp1z_n)9Z$5g1xtclGuVy|bfSE3F`uTVS%ogVS=3^h2 zpPBQUkKyx_QyeM>j=JHy?CA*d1IBvwrh2 z9?VqcT)&$6SOR8+#6`{regE`LFdsAL_>JV~eEu_-qs*D|OkC7u_+sc^lkeX8qzQ)h8x&4mN6jaU_6g!JMgH=z6>dm}?}x z$atw!Io2DjZpZ=a>!&*1*B(7T|oGZ&N- zYNqFyHNZ7s)--Q4AKfhVt^zkCKra@0)4)8Ua+>G1FN4{oa>{(r_!7Scsnp7K+* z0_F;p)98%@bF<26^cFLNp^9djk7vMb4$!0LQXgCD?E`ltK#%fwcK?`AZEV!sy3)kk z4ookV)5Mzx=6aRW=-mhAF_lyFs9s)SMhp-;Q~o{$_kDmKkn1P9C zy7M$Ww><=|+!ao){o<$rrU7%NJX0Lq!1R;!^l{{Z$!E?K2gN&{84(0_x;SY4yCH(p zUvJz3?k;9canSs(wA6b6+>QV}IzIM;iM}#8&y~Q`WX?1`%5y51E|Q);&)0y-X3j6q zdCWjsG*h07A~=1XCxV;KtSJu4^CMu^Fz1XuNRn+DyPxA9n1oiQ}k$j>%hFBavHtw!ThRniXI*3=U#*B7i`r0 z;_U(^UF8%#ah?Hlv&w14w;0S*DyQgCyl;T{Oyx9sC&8SNp~RultILcC7(3H>zZJMn z0eZ2p9}H$1bAIQe1z;Wt(4%$oWiUG=y~uTvo;Q6C=0^)IYM{CvMC#FTc~%6cU)L&u ztI4ceFG`;2xJke)}fF9MsSTHkGPE!YugITR|%J^cT_coZrDyPw_kcrRpuu(I` zOXF(^rl-nj^hSUguX4)x=(wB*=4qAF=FrTZOWiGOa z8mXKnFTI(el!&Iu3!SI?D4Z!T8Q_Mgew8?={%*C@yA#~~0eUpPjh1@bz`Y%yN8>wa zsdo%q$sx*oXyUEO45URfHa(_*U7QR>90G_09TP&QyetDBul+^ z;Ccn<(Q%#!<|dWX9OsL`ELS-t&osX6U_Mkijowi(F+=_9kB*NT%;2SHruu6Du0?=e zEEM{K8K-iZ@!bPvvC3)U-2!Hp%4zg|1an;F6uo$iuktY5mtmvkSNB(e8N!^YUa0P; zfw@D{i>zn*cg~i8sW9B}dp7=CSI<+>zm*xh6islN6^M<4sIUn@96`z4Q zEa^pZ^!>>S`Ep(9=7aKbiNfjTgU&OJ!1ZL-FWxLL`OKN-gPvQ=0<%EkBIBU%jjRLn z3UiL%NRHz85X=|Mnd+4M{s87!fF7N<&K#-9pRx|oI({y=IA;Cw(hN*H=1h5^@2d;~ zGhEWs$2%F!bmmO)QeNgTgO{S|>VWJQD4cE`qUR9{!L4G}FWzln-e%4eFV+1)Fvlgm z$av}B{VF#K&tI@nGt~jD8wtz^5IbGGl$X{Dr>lEfciV#-E%}Ytey{#kFmsvni+2^6 zO_E+@yi|X?z`VztX?`n#`dVdwTApv?+2h+f;Va~7aw}W{%K#%JF2$&O+ zUSu8A1XrODpU+^UMt>hB=2yudofif(LmV|7N9V2a;2vhyFOKzKwlZhRGsW>Gm>(p) z$T(;z^6h@GyUNu|BQnbxb$;4+!@i+41b8=3Qq_dzg^NqUiS z(DAzo%uCFfj$iV#gBiROO&2eXdzZrL;-xy>4K8Z5lV`tpD}t%PoGD&9U#5WRE^(3Z zCW0FV=6>cVeqH_1y89)V{mhy2LhJo6U}DA;k0a7A)pKQL@KQ9LUph~>1J_s5i`TB> zL%m=DH zDx9fa8tFJ?e#vi=!kNyit-y6+)|3}o?+1gqPUSRto)2cJ$|>Wc>xdV@e5i67y`x}a z#{1VZjjslnCMu`V>kDR}$|>Wcb?AC9x2v2+Z#kHCDyLkBk>0z^;HA?v_tP|Q-zc1E z-hKpkT=lEOL3ycs9lkGsjhZ{ZnmD?ENmn^VkLIli%uJQj=sf{ujmjx{G`@Gh>{B_7 z-f0tJLT6*6=EkAuQJ&+$q^O)m?;0>eRZcT+)0q*DX{VXDBy`UQ_Xe|m>+@$|eqhcN z2c3`3n275zY}8EaF6FNdn3l{rdXejMb#MciAw6ok^AchhmD%)JVS9*Vn%@2>GDGLQVm=Jvwm^32h*E5Qyg?Y z&j&M6;v(aqb!`Ed#mt%FAZ|IBX9GC$yBW;u%$e$i^0${6ycA8B7g{&I0r#tFSy6hbx@v{$m8V`$uVAvrkl6Ac&7@uw#@p)aXFYQ=1g%= zUEK)gc8QCOgRYC0gW15G-~7G_=3VAY@si$WV15kHqvs`2HwNd0>bV@a>dgA(B@s*; z=1h5^dcF$GU`a1BFI3Ohfw_q}Q@q5@WCkxq)75h<-nm=hbkD=c&$AI+#As+aj-9%0T@ zf9HYQzzklBrt?envJ>21NiSY|A9WbapUj!^LiJK@3cja>jhbnEv~IKn(~db)yp)$7 z%#a>6UA+*Ou5hM$xh8^(tQUH2kpXT7vwrpRAed#$nesyMz6NHuq!(E)R9D}CIUK;9 z53bbBPLA_>BfS%rdZll{?^$A_X3`U%uY&2xoL~O3z~l$$(Y(z9bC0AKd3?}% z@C2B(0UZ4f`0LEzrD(eKfTDa?;dJXk9Jmj`os|6Q=i}_@xZc1<&6Gciw-uQ7%sKgs zjF*o80bm9)XR0gWhBAYfqUqu#Kcf^*cU?@!N1?)*p1<4z?k;9c@si$3Fk4kl^E~29 zFh8lBvaZp2`pjGL`6@PQu3wE_OE4W(PI6UdDo(qWV?h zpyTo(OT8z-tq;(nJiiBKzshOyQu;O==h&#Z`BTOhi}xCV>7#NQy-{E$shpxm<68*k zX_eFH?Ev$E$|-tuUib~nSu>P4Gm zftwVdNAkr!Dk$SnBNo_j!OGts8$@>YZ~3{vA|o)J*dchxb~8$z;y&dTlhA z8w2#{`sG0|k4bv^>z7SnUSiI4{X+AxgBiRO&2(M7CxX*ohkXw20JEmNkl!-1o!qfo zW1XG@?m}k$^jcf$wFlSRLNDJ^Z!EYe7J3g^>OBr_b$}k#>DyqwWzMgzeg{+PPX9Wk zx~c`H0dtO?zOK^1bY{*}S9D$6hZ%2vBlV~bu883Dbu|cF9*;1N z+f`0kPicML2j-~CY4j@2!S`gaQFF(qIq#=1BS6||{?3NtNK-h|I-U-0km^^7gYrDt zQg1rAy94xSe9wS+MddVk`3lU>DyNK(@?7pN+`nO?=H^eM*9uH0l~eTSJUEycA&8wR ze+A&K5749Y{(WGcRXNT0c7yp;<&^PJ{{8?{{_fy-8-Qt{a*7`1uRoX}DyJFWG%#~i zPSK<5rWIh`P&tj>_h5ciIYp1gckWy~r^ZIjZ+_Fj^iVlPkLr0iGeQtM)BF~Jn;f7= z_40tF-V@-~1nANHz5`~T%4za<+CBJQ0XAxGUX*xAFCI)gmDA`A0+Xk5iXP3!OfdJU zoJMa0m{(LzqxThucY=+XS{w$%Fu+@SzH%3t~UPL6}}R~cL!v!?l=@ugYnrGpz3phxTJWH9qpPE#*y zz`Uq(n)>?;%+D&P(JOavOy~k^)J*YG{+cl(K@!~ z%=umay#eO^06lt+{wtW@nKND2QNBtpQ0ofUb;@-PeIMj>g)=?ZE2nU#JXZu)gIUwO zQC?EOT*aJUUPgkM7@$XaSpeoi=KS*VI5RL2P4^s_^0HjvOnG@m;Y@ki0PYoLO?jc? z_bV_*RZeq!R9uKWW25G$mjb4*%4zfpz+A6#n&bCAFw0d=qqiN*yDF#AI|3%=J|zx~ zUJWn}R8Fa9s-teqh{VuNbKOqsMh}HE&09LSL8@ORjyUK|2D6kozj|H==H&oAy3hLp z%zjBP^1h6&hyDap=6)xCj^9X*j*knO!AsF}&krasaS@#UKCeEwX3V5e11&KU@9B(r|`yBW-E=3KwZd{F+L0<%`qi_8lh=dXi#i#fk_<0EEZBAPCLbo_n_ z?hvznah&!5t|zfk^NS-MOmpT;^Gk7b2h)c+zc{XDMmWY!7YD7+1HnyX)-R6PVD4ki zFOCghUXt`8=Y#6`JuqKdaKAC*7YEgI^n*^0Jx*WGWx!Qp))WWTX=5<$ne)rb05CZL zdh~hi6fmtq)&eF8XI*RE!U^r)Hqj*8&) z$J=;tQ<-)1qM45+ik@yh=ssmBxJ}IZ&Brb+>%y#G z9M^yu%A8*u)4|*+=|$ERt)~xzSuN>Ba#SyGGlQ3+>Ea;nqXsV~mO!=erxiOf|DyPZcwO|TWPLsbo!91jL8olSiysmN@z3-S2fnaBvk7M9U zKIR`U-B;9PCP=R#xRwEWl)nLBMyQ-7-Wg!#shlR>)nK-&oJQ|UFh8lBqDS>|=HpII zg5s?OE`eE7y-@yoTIyX1?ph1Isg`xO1%>Dp9y51=L1n$qV zQS-ars12q*bAHzwO_&ja*y+yGvFL9OZUD1>af|>no;lOJ(RJ)RFiRya@;ZX*`9(1A z25_{l9Rc$PbEbGHf2S?O_YSd9Gja605a%-^KQ^}~DbM$Uc~a#x$NB4E-cvb6kLvyxFeR5O>z_uiCYXjQr_t*U z=4$5r>TeX7NdbEF+;Jh8Ma-G%fad85X7ExpT^&&Vo&@&-vwq{-1Lkw)+&WO=r8@l+ z%;``1ALsNvnW|uFGG~f|;=Pm^ycA6r2hCd|xHM+{;z$QGh&jJFCWEHg?` zFiV&-#X)|aWJUymoi2`8^sfN7i&?)oz5??zbEY_Gy(;%qOsEPrY7Q3}2h~AyFx>+< zS~rG)DP+zRFV(>$Fw+7!`g_ya%;2SHy1bCz#Sxr-y?O%N8fM+RXx6KD6g}N~Md#@~ z3TIlcJ_mO|^{X5obRALVX=g4(u-KXOYJzLXtQ&`-M|I!bQtxVTxdD3gocb0pOPKSk zzqMdq3ecna`y9-V5*Jy2blxhv0(FXwn&Vf`H3ZWpfTQ*0GB5*}Gu0_^Szv|+a5SnS zX7ExpU7gbWjsrKFS-<=(1+#)V)BMtNsW-vAFX=_*g^rIOz#L)D6fgNX$qZhKri+8t zgAyz8_Zrx!`NdHWOk?K!;^+hBYDrHY$0#u4ne&Td3NvDW*oina$N4mc6UVuRyG6%o zj<@LwXF7i8gImh1DKB*Vz6fSFbAEaL2F#%VJvv{Oe+Ki0jhbKnE@Vc4*qQ2}2Dm27 z`i-v(m~`e$@zQyr2+Sl&FR~8kxV#h0eCAAXP`rzo!AsF}aZsKg1-F)2zc^k8^B!}4 zar^@2q@))a2VEbWy(%VD85=cI9OS14GXlg;7e^fWYk}*`tX~{ggUMyiFOFNl%$D>b zS*WH4P- zPIH{+f*G%J8oha7mZ+SfN8@{e88JZYOzXxTaGzV~{R!rr)xq&5fN8CA%J}H`xDw1T zmD9v~E10<|r|8jna21%>ne(gDyf>FcyMm_`8{)oDj&gdldh zI;G>SH@MM~p1w|R1v8g9xBis8P#mkkY?AaM$4#*V8%0N$_weu1M{?n-g+=wE%d$w^Sgy!$@O^7kByq&_!@%g z$edriy}?`^pjQ{ZCV*MOoL?QR1@lsX9@W9;V7{01B99NcJ~#=c>odri{Q*Yn$8 z_A+ORgYt3$Os$Q@k4wE?b1?0hGwD%YvcL?N^dj>@zlS#&%mU`fyKdepqW?u^@KQ7# zN9W)7BRG8=KY%;RtSJuCtGFp9bTKw+E~hzPb^_B^<&^URoqr3!+@x|Ey+vS_tDK@o z>-~0SXnfR6*BiUReHx%gb?^t6xaWfFpc$BU%(;0{#z)ufgTP$NoT=`~+bCx6QZzBY z%KaN%XOC7m-S;BtdCmldGv(zLaCb3lii7l4TIxLq?zI3t%Ja8i&e|ND=bB&|GG`he z<+(eU%b4@a^Ht2iL^M;L2P&K{&s5KY70#6BG2m`u){R4%U&_WJMNjvMqrei}0a?^%>i7H5ixV%25dWFkF&x|!$y(X50E{X*D?9!U=D84k z;dapP2W$fKUWmSMj@rq?lCiQQ5f_hxJFhl4{Zb8|&wGIBBRMNO#(@03*ANmeI9+|C_W4UNr*4RxE}g+#Dmklk@qif_ zqA%QD@`omasgxXrZe%a{Lr+KsqBx8=s&BR6-jl3VIsFFAQOQ}^aaJAP%Z?8nX7!E6 zkuC@0iontH`AEr-K01u-NW}R9a0^288RzfqU>=m5l^yHBYzomAo*#n{?)zYpHnP2B zmr?xadG&9SfhZ0mj@p+O!Z>3)UIy17Su;CG-RS%(9vk{r+tjxK+;$uK_S@8V1YFD}PHVIDBfq4xWFqB9 zPjJ^n&`0xr`C!WRoWb+QU0@#8bGmkt;#UJ^hn_Rg_ir%A^qfu~wO0xCF^*Jx=+M%| zK;IBB*Xub0edS=PC1=(CJp$&L2>Qt1*bZh_h`#W4gW8EkFh?SA)c&<=(AT$ceM#WX z1b4M$t?U>A=6cC#>8DELS zJ;7ZgSu;DjLtj3arINEsm;1r2ilC3|+XUu~5Pjk4Lhb#(z#NRgQM$x#iJUG}?&HBF zOP2jplXL-djpWSIh4kfv@!HTgAIvfv`c{Fdv7v7Zn0IaH`wy6QTRCm4>^&1qXUUn_ zOa59Wm>VT$RSs?jvowM}DhGc9^K^*5@Nz)UM|EJfNY3oJg1EOO15q4C^@!~F09^Do zP8TaX&H~d#a%Sm5cDTR{3ejh5$2c%WlC!d7hGf_Z?! zP`YdY^R?ux(&Yr0Hm`H~ndzf+Ne0tHa;z^rUC1BL22&t8(rT1%NN!H8`O6Of*zSVOE{pBg!V;mjvp~Flc#qTOG1NEGNz9KL;={a3LL+$+v z$xyg-nE8`;gZrxueYH0AZ3g#F1by@zdI(IbHzL=!bHH?!oLTx&zn=|eSO^zht|(nf zz?4hQtiBO<3z%gQIP$aa0JBnZX62dU{eom5io>X!Qo5`Gw>3ncaXI}2Orzw?(uMq- z);lndjSn4W@gsY?g1Jm`X6ZuhX)no;K01UQy75GDzm78+Po#R}0(YHct=gAqVCG29 z%wB3=?gq0mL|=G0pnQ7)Oicui(&cT*Kop0Wy&vj0BYR2TM>@`|UVZ`Ypk&SLrSx;Y ziTZ&L9U5oQZe)YGR?q3$4Jv;#z*Oov1APyHc~Z~m^ijLE70d^E&OqN$FtIyzb{OdE z0wzt*8R)wf%ve3AE2mW6=1K-49|rH=pz<4u58R#laCLT&zUOV~dllT)2>K}B z_JKJrIjefq{w<6<;zNg4UUc!J_A~>G62gVoBP!3uV5UpXtlc24985(7j?!frn7brr z)?QJ(AD0Y7ahSEIPlBrr(P!MAz60h{$(f}KwWm#BTE88+Jv|T1g_1K%7iv#0lMGv7 z-kx5mIXh_Xq-X&k^yF*p3~JMs+UDz=IA*CeRqTT ztDe*8qxQ5G%$s`7K;O4ue$;aY`Z~TFACFG-54*yhYtGRsNJRKvRug! zM~4wd^{p7(e92nb@h32Uk(^mNlN~REc`Za=xE<8Ly$9yY2pqNd$0P$$97c8|;!4bW zn6JQx4l6s-!DLC!%8m(OriADVx1&G8S^#E)(S2V&igWN?c(jPi~0eQp?MoNr6O-7Z-(J4oNNHubFsx7miiuWaf& z1g^=3zVklRmuF*pyMenxvS#*D`#jvHzKP&wM9`NAeSR=c>N$hJ;1mnXO+KW!Ay>zkMeg3m^(ta@cgCn z{2Z8nO3o_ZUIX)b1djCW0<$LqNAtvAO9rAi%<}j9FwQuCkArLdnJ%3T^0%vG0^yqF zZ?cXv%inZxS^98w`Ahx61e^M%gZrZmefQYZ_XxOWBIu*?w;jxvlH+nn0;K;;#+$Ctac1e<2b^0UuFekXKW?z8Zw9!z5%f{H|1+3p^_)SvyaDC| zJ*SHwjb9xFbIO;x^fS{o0nL_Vk-=s0RmS{ZS=_)-4G={U3U5)bZN$!g`)K;P9i_4NZcB!WIFFH^xR z(sKss_b`~J^qek!R9?1$*`wzS^qm0HX0NVX>GV-~Nd}Xy=M40X0y9C+8R)A3Q?2I= z^gRXUB|WDr2UK2mO9mnz2JHs*m+$L1vvTkyxbO7g>g=F$6~8aEoSNxN0GA|LvvNi8 z>t|En5OCMq&{u9#-y(3;5%f_xc*>@}SHNwFppVwk?gbO`wXXabl!MM-F4c3o{Gf90 z0aK{w4D`(hvrNzF^pU-*z^v7C2KwFw^O>GA(C28x?|I=vhgJ>@^j!+(YCWgZN9{%) zm=Zl_pzl^N_v$&FJ}Q4}B}4I}!>l}S1h>P6zJJ@)cMM$1{kn9~#gFP+l4L~WEaKN4 zT)GW?qipIM2ks9M^ig?PYE$1m;2w#fkMd)KO?}(Jy>CO`5u5sAzCk&~hYqcr8sx{N zk`W;OGb=Awg6kJSAK6=IQ{Pl@%)WmDh7;GVLfZ<|ehyTN^KLtl%3a~elVzf-}T zEm^DlNVlmk6Pzc4KFW_j*wi-*+%0;2x_+AcwUs)3X8!#{I?k+I{T5tAaJ83tHn>JkMh?G zX1Sg-u=jB=tM!~tALZ}cVD{=c1AQ$I;ypX~&|wxo%HLElnR?DZ-#9RT&~v)@iGBvm zJ$lYS-)b-$^qfKd?vaczg#I(}pFh)aX8HDSaL4rFPADza^h2O>pg$_&GixrLIcdCi zeDf8`--Pe5p9vp2IGr;y^&Gt)bBJUFi2pL#Ihy2j#O9HnJ%tsOQ5qA*G8UJBhtn_sP(_eCCc96ZJ!IawImVo)I2IlAZ$6j`y*`~CRNw9Z z^AE|H*-P^fTO6ejw5~FfQvn9Z3pFB7che)XJy9-Fy)fd>@Y}|_|uaegJdnF}8!|DUHej)pM_8Ad16?qxE|8j5uAnr}p4>a8FBCvscGa zdr${vm!8wvLGLAQlng|17{#w6t{k($(fY*Gf8;b_ZRY86i4Bg*%a!1UNYhS^7~rKLBQ(g<%-JbE-)t~XH`z)enS1lhYl@VoxY23EfY+! z>$_j>`RAj#$T2_|T!1KV5#%{oBBNC^@ZM={WLt4@ide(P0!WwL`H{9HxLw zIMR2H5vOa1s2-()^GH^UpN{Jet`N*}$x#eM{B-pr1?OJ@vrlqX_2Uqjvs$n%TDZD& zq4Y}ulVO7!3Z@_eN6$y4l7T1=qkgagSLTBIQL<*`fVlgjV;$$jupMR`o&P78t&%gd zm*V${WFU&eD1KD0zp}yQf%`YO0kIrETF)W!?H4{bw#WT1NL>)cVN_13U3(4Oamkvs zL*x(jZ^?0EZN}xE%IOpv+=bwl*x)GKf7swI1^2cMt`E2tts>je16*Gl+*RO8Y;YOi z9<#ww{64e6QT#f^MYe;|CD#UbHMsdUI0|>I4eknX`)qI&?)j}F+d=JGo=t9%P3{?+ z+=n)}Ziru8o5*&MU)RG1*BRVk8{B!|rrF@gKV4>nqxSC4VO+TXLjKi#VO;ol6WLK~ zgX;wDUp6>u7hAM7NM~I?NbS%m;JQgxYsU?^K47ksoaP@G^p~^2JS;h@{_-DSc1TVO zSJz)szyG;pAd17NeNM!cqc%7i7wFi|AYF9flD>;;2LdkcyL;#B|g@19zJxKarE5NLox!ye@4$e z6*%7u+&amUexv@4xa-=-I^M&F4l|C<&p9pD;lqaxtN1-283E!yqxg|u{Ad^#?!R0N z?kyV}?K?ScgCjqu)#;Jz$NAtcvcXY*nPr2cag-Zua8#~JZE(~M-C~2IagaaT;OM#Y z=`b$b@1%Zzbr=_(Z!})qV3T{(21n)X{V*;(ew5B1hH>HXBYk_rxNv>MeQkrI_G*6^ z7alG>PdC}%s62P=U{FrUFUGaNLG`i+IG1EKzu15q3}%d;`-S5hlC zDETAwy)SiAJ{q-GG+r|7j9AAqeCV(mFWCX+h~$X=HSwcxFFrHYF##Vs%)+JTmsOGx zApSFI|A>3SCij$0?pd4M3r5^8EC&kgSOa}cQYY2>Uz5&-xc|Dd&~M>GhgCV~kr3;c zj1L`V`9b4)PfJFC_%Aa)*Kj_dRmWIIUwr7W(pM!J0pdS1eIJ24<7{hvRIbK=xjh0$ z<>fueG>04BUJ>`94UXEiPmDOb<-jhddyc;b;eLv6JDtPnqP17L=j3z1b(0K4ar~Nc zMddUL`j$(bS~=B)OYP~GM&ar>YR7*7cmBC-2mNo{KYpIXZ zFSq7WT{;u@A264n7o5)Ebaqhry9UfG$!X=@K;O$?ezKvj<@vFWYw)4NOkX~(EdsMg za+)2w_|bFd*ODQ9bQq;G*%8wz*3lauI<#$P)@S#KFMEsf;e$jLH5HK?(N9|X0`ZaU(TviR{kq~_W|Eigz{^BVxFGb)e+>K!N zN{-q?qi~7)2~1)aw!4VE^lOo^-9I?UonToRac$ytT#0aGG5vveUlZUysP1dhVp0p@ebS;g<)U|L+rc38#lOfXm5 z;D&&iDLFGcMEL{rh~%u|_Y{~7lCz56yI_vl;7+|L*3lCmI<)w4y(|?c@n08wa>0~J zPR38R_s#W#?3f4Uwop#`L!sP#V4jwol^u0pzOupn2&Pk4UB2n;pz@LiX0+t2>=+NG zER+kggW7`yVAKd4g?lHMb&|8P_jND_C1;i&p$Hu1 z#}i=Qkernr{{qwMVrx74LEnX7ZjhXn9XElg3gN=-p!lr-^StC@@V8n2@d217$ywQP zdP=P0Dtzd$;s%46VS}p#^Oz0ppI|QTQbR5jE?!o2RxE$nzDGA}i(~sJr zKZ3bca#r>}3}%xJ?tL&PBxh#FbqM#|OVDoMLx)v4SODhs5H8$~?$Gf7n9Y(St!Cxm zM=+f(jhw$}U`9*M%#KWiQwHWm$ywR)DwwxIxNtkDefbE?QORlH8niEGU50f=_|RdM zZ$rV9N>05Aa=3+$r`^$)s%=@ZI@`8ia72Z9+Mfus667R*A)S=n(X zn01n~O21uT8YO3ye&2&>eP!f)I}eP@1~(GS9LZV5?`|+pNX{&N)Q-Oh=FJHDDE+<# zbNW@0?dS?-u;i@bHyO-4$(hBE%HI+&_estw-<}5ZmY&mBFqejM zhUG6EOjZPr(r*ZunUb@zV=4PZW$oLTx&{(cFjMK8A3OdrKB5loiktm2mk z=H>|cDBtb{^OWSw;z!}G1@ocgV(_F{? z7C&kyZv}I21dj6K5ikvs)8eP=KZyH~nBLaqiqhqLFg+z_Rt~6~_6Cy|K_7)X3(UQe zvx?tSV0P;D>C(9;^c?`xxewc6mCoJ4WQKBK=}h(x0y9o>R`Ht&<}MrD<6yQ+&a6DA zBHaC8&b=nG9T$PQI+P2ugUU-5nA`{)<;V44=1b1X-amm^EjcqgXx+`*V2(-7DnDZS z#yS%4p~I|PksY1ETpEERJJP}AOU}xU5-@j2&diRk(Dxje_atX!$G^ZF4&}n~gX%|A zCf57lLx&cwLA}fXQy@7jJ4(Uat><+0gZ#B8z`P?lD?2^`b10MxvxD;EIGENh>wKg9 zI33JYlC!d7Fqj#V)6zv}$A!@62lJfdtn7Fh%#Khl%npj*`(RE;E(U*_^;;M9i**db zhYl+{#(}v-a%Of=xGTYIl$@0v+rfMm%7xj{9s2fzN$Ah#QPP0Q-->ALc2j;ls ztm4-yJJykg4;@zVD+1$_oK^fD08=YDEq=OkKNewq0;czX;Pf+o?j8W<`VcPsd63HA zBrr=QXI1W>0rR%xtnAnerrkh}pP3z<5$?rcJd(32FQdTxA(RU%FVqfs!Bj-x$lhgO zo|2rE9UH)WDLFGcE`h!nCDzdcA3Ch;$N)1mlnb+i`i1Mjlu1qtS65ESj@!Ykk(`ws zTfuy*=XB+Yo};4Ov5xNe&|ziAm0$*ia$$B*evAN97=a@@{s87y$!T`z;x`1`!(a}C z=rb<&$H1IAD8vrK_$7czioj9)E(J48a%S-x3a%K;iy``qJ=oRuA=VD6TjnH{uG?nN+PO3tc09{>}R6S=&c3g+wx9NC)$MvgM$Ir};D`CfFV2UJXl^-*}REBb4`9bB%59T4sS=s^SJsaFNVA>D2 zwqrcm0j64VY=?1v+zaNZ5Y9M1)`Hn4IV(H%fQcEw@w4I*!1R`!S$@#I?w@FuOxIY zvZKu?jBnsWhZWZkOtIw5>{tXHi@?N)QW0JEfS21~Lck!V^a$)64w7XyiNY1j|1@kA#S=swHFk2*NW=9U>Bn!pUcKC&Gn!AuU}jO{1| zvqW-McH9T%RXwNkW9hlz5$IsZ`XanZ_P%f;zkUyRb=JE&}m8)yOOpu(F9kamP zD><`t9uIwM!F0?Iw!^r*bOCc!2xpwmE-)h{XBEH6VEi_?hrqlhIV(H<1tx23WIKj{ znGnJm+c6bPh2*U4xC6{u8{9T92P9`^#{}fZspGJ|2_HJF+S5ORxiy3{w&NZ!|B#%O z9W`J+x4|6&b8Z30&&&=gS673%PjXgvJPKxA2xn|Z9hhB`v$CTRjI)sA7s`nw75~NI z|1OdVoNaz?44mQLjZF#T!uQ3{zK+YnxbS^I#Pzkw4YkP?*yLu|Z=6zk<>ivXyQ)wSUeoDwVDn*OV&Y{3TyBqhK#qHOj%!4J zEkC%Et=Fve`0je_$i~tPc177H*fs(=`#?^qJmQI%*oSlFf>eKW))5J&X{S)6y)Z5 zM!1F#E^rOMZb<(E&(MJb-9rZU>0w}BNy$|2_|ho_rQ>H6O)4m!2@?vYmra{cG_$l1 zv=j(6!(F4Y3kD2x=v(!5&Gc)-Ao}*Hy&X_oUYEfp- zOqZGdg3%@c6pYq|P%t`JIm?lPC@Gsh5jOlBI1r3Zb#U220qdVbNfvx^s3&U(l5=?H zL~;uc;`0hV6^^L(RB!rUojoU+o%6Z3PjhYifmA3QjB^pJedki6kp zg9}g(hGh>Kk&n`wPtFNac>46BsreI2O7bU^O`bX_`0OR6qWoVvY4Xf`Sqbt>Cwfbe zBhyPuX3X?nI%C2g99KJfw~v~DjS`O29o-%G`7os>zjG!}oH?U(MzJ?Bd04l^p(UtY zlmCc9n%IBFw35kFi)JF;Lqx$zoKc)Oy#I*Y#FFt7rxbZh6K57pESiksl{kB{_r}EW z(-X_4PnkYr_VmQuTz3{Xuw=D^k^%=e+ZZIAJe@)*>eC}NW7_y~6wsODZz!5D88P-2 z_33qGYHDgmDN0z;j6OXwN=s(WD1nXg&$7~@$DwQXkv(NUZn-t$o@qs(`;(}vS%r%b2Aqri|PfArP z8=OkUYqOo}Xw$u-?o~2s6=%PFia#ex;6gomT=o(iiux-tq?fUc5%2cY&h3FTA6vKZzW3o| zy`sLSRMw`7TNSmAG>xgFS9(l|YlhU*3^D2nT|t;)!cm=Ib(9Js0}>UVCn;{UYlLg0 zYm{p=Vp8H!KU36$*=gUn)ZC#+IdIKQs9lP=%%P=q88PZwR?$*xO!~g5I94mR`sMN zEc~f24ZiW?@K5qeW&nX?nBD#fq(w~k-DE~qvXxjV(lKv2G^J(3&GMc&G@ zFC?v`gnU^T@3bA!Bfjmf%FoX7LFh7~M~AY3B8!j>t=;My zLauhJtthDnsh(azxgL*P-{kSG3jo#RB@~SauvA7xyHKk3+jH@5aVsF`00ID zj>a>7*w8}CieI!`iZg5XOUO}&;`bzR#qg*#iuxA)oyo<-PcJtR0H4@K?$T|d(%la! zMO3=J@LXM@sttzJO`P*XYS)=+)}J9cg|rgVX+nA)((~euI!MWJ#BG6ehPe7Rq$&}H z;$N1CVD{l7ex{&M=+>Vd$7g*blHx~lRsUL1?_7y{6tx8<+gd8k*=aSNURmuGq8oy?vxr&#u4Wd zYIUh<7Y_Evq*JqfqoV$(_`p;iby9E{Zhy>WN=E&xb0DNE8GC1+reqwS9qU&A)7Vx~ z4=X9(QxkF6-BdHk->$Es?h>I(tC$dZ(!)(`S`xW<#RN%6P4N{N0)#z+K*z#Gr^ zAn4@mw9QB_VT)VcrKnpa21}+Um7^bVIor3)@fF9r)lK+HaK=Z|8E5?9czh3u_xL8F zf9NlIl&qy)s5vh|VrGiMnO~O#Te%ed3DOFY*DE1$bG}-WK7w?R)3$PdI-0w(R)|&Q z#`HR6;Zb@)&&-PzzpE>HmsuA#H*F2n-X$uPHC>g;J$n?Na)fWeeImz%E!$wCQlFKS zh#;tJXxYDw)@h}P!l`HyjaA(!&e1GX557uKlA&Lq3;nFH&?5v&T?YqxnHCfUFN0ER z>rhm}KF-xqI2TptQKP8P4!!LTOb&Z8YUZB~%i`+9|2%X;UmmPMS+hnJ;+DMK;)Wz z1o91pmk{hApdXMWiuQ)GgRnw7_dFza5M*aPl`1c~R`!;ZS58RpN7Uc1QIS0vo19CY z#BECDkF92-XTL69iT=O?X98BDNH~O*X*I?Dd@*T_Il{|mXoY@v)@Ws&=1WCyrpnFj zt=l&amc0WlZeL3%a{Fe%#0Et@5>Vxf$sog0$=GzNe6Z6CZ;0(&NAJc_)C1&Rt<^$s z_B*KfheRnE4YT7KR|rkp`2Rt`xsJ_(#3^#8cJ32MoFZR9;^Iy%s0vS}J<6GZl!6|- zMoHP=K~YlQMAStEqc;F?rKY5fBd;e>QQt>FQBvLmM@c5zBgIb!Qbxj}f;#G}{=4ra zBh~i<>A~H%&PaNZgNc!phO(^Spq4q#r)xcUYFgc| zMY9;)EXFj8u_U_FYTWoz#NDl=NMCiL8jKv({21V$nsiiIxW5KrDk^(pX&V(^_Te1$ zsK=Lcx5t;gLh+4!5V0w{K~cxfP}H*7O4SeE)19lMd#89~dS6l&=UPv3Zj2U>60U>` zDM|X!f8_NE$F1=~DY*SPEtHJyv(M;P(K{uz?9_hF)mbS~-Sbv`;&Eo})5@GLD=BsD zrBGVz%U&Y0C=Q*>((EOQf8-L4Q;)dSf$(k0<2=53Ps2HdqbeRk{5g+_+dS%?oT?`8 zIe|-}{YJ0cMo}HY=WL26{{qi{{+u=9j%p7irE=aIPLFe7&Ki$D=6tsrlLU9vt!`_| zMcbEix1zeN0>uMlq(Bul8itTV)0CTBO@EP;nB{!sh>~%Fo{#uUf^&6);?L#?Db9h} zYnHZ4ub8*M;apTtd6sbk-ZM4J{<2+&^tVnhWxJfKTlQYyT=Xc2MK#V_>9JICzJlhw z-ktIqnqz0>GCGxV)T3tCdot>sw`_rD3d`PLKTxSW5;e1@+nA}rul8$89&X6b*KE)*dnb-%}lsZJn$XKbS`=qiu+LY0KUQ* z?{IcQNpUXvn9M;wU&q~3)dya3GUT)-B(ataWotyhIqLD8s&AZ&Hi!tJV?;G+iAO%~H6rw0>F6OX18?C{ zYbfv?Mu9hNa#Q$E>>EewLqg|(y@kTuK%llwwiD{(!fIh9CG7PgBzoLF2`Rhp7RtU5 z1B0_y8awG^8!N(WuZxH~`umW$qy(<|>!=?P>mT$D} z4?5eU(HZ%zQhCfds|Va~L;)>St%B|=9*;O3mC6lW71a&rsaC1n8;4e+lXJ;kh@WT# zik&k=2Xe@{Ap5IL*}G6hN4_C+UBbH71nD}%K-cWcgdTEN)ttjh8vBZhdVi9r@C!HA zASi8AVcb}_yIDzzIETk3dP>xuoT`PMYO~AR=!K&XcBN;1FQkSpB+Y}gRY-q@bcN{L z>G^NJkhW^)zJYXR9Np0gwel8mbpoV63&&tMMhw_Hng{6=c*QY}Jh%YtEEGa|RD`=y zJNGoCW#YN>Gf4cDwHH!_&>V&T<&&3xSs{WJZY_d$v=DK?2t-Nn*(z}t&Kk4T1}r(o zc07V6_6Q!79>HT-&NUVu!OKVz;Sqf9@fF?eQjNU=JTwdUz>R?(;TCj+ThJx7>@;!< zx&+*UPf3N=<^LkrU`?R^$M~c_=V?(sJnG&^y|m^UyejS>*Wgw3vb$Q5Yw#+&2H7a* za1CB>%FRQueK5#1FbdSRYw$_9Yp_PR2Ip&Cg>wzL1{@)B4PGtwwJT@eUaObrGM}SN8)HJ z5eLP8ZaEx;A^wLR2*4%?+JJ+`g#^PWv}kP4!NX^u;8722inFvhxGU>hxGT|%{B2(e0t$@6j{jmv*vk)*Ol8%8A-@x5wWb^GD5& zt0!fj^d?SHl)i~7<7^O3lir)i7pc))`e?%BH>&|~C>~>n;&8A-fp#r|LvbJSQ8c%~ z4#l^dvOgh*0uMRITFvUI_&bag&5Mc#xmjUEucGOH#H%QW1?*KUgv4IOKOnJJ@hT+t zD&E%4{Q!xUc*Ho8QE64ti%)^{h43nFfT`?NR71KzaCgH;V6WmqNbFU7uAMssiM@)8 zG!KI4WkPedb`GAxjR-m1s~{7!v$u-7Oxb&aS@uBS7Y7YxC~Gh5(s|M6_kXvQ#@uKi z!xg0sS-6_VG+fPN8m{Is4OgslwOfpVSd44%Oi~>!si_cNoSa({XXc4B9!!8Hdf+}_ zbQLo+Vm@?u&`?O_{zA8UP>h*<>hVv;h{9An%wj;BJdPZ-%;BLySw+1zKBsE4bJ0%- z3Io^flubG62@jsB7azkJ4@O2)b5f2guWF;9^w5om>;~tOX~@x`{un1kBGsLOxsWZ& zn;7({Cx<#?$LzL>zju3g#u2x(AI9$FkezQ)(kc1`fwIf7K ztMEjnHuhh6BB~6t=^vM!j%gOR`i=(^f20JXBaN4N)I~x^=y_4&JSm41b-7ThL~qCR zW}xfFqdaC;5ovW7MnMFNF|opCXM9YZC*?+>2_Gj$pLPvp`f~le1J1 zhr|2Ez%+^)W(yx!g?km>*i4MGVPL-u-Nky!WifK=%g#l^Hy0CT86MTY5~neMy%%2& zr9PViMgNCUY=67CXndjXbiU?GYko4y1~gy9Xgs6}Ax(oMXB9a<6de?FOf^(dbl~wL zI`a^nd5Df*M8}ttE29t+l#GVr%V-X=w-#h>P(X570_vhiw=6-d454X`w9V>Kly?fx zt+w=F{&cXm7Qvmdn|wd4MZiLd9Q8|4HwWw2BDi@iLOWO`$k=wKypI6LEwvJo;Kz86H|I6F~r-kXp} zWpIjZR5LUbSmS`{BN43kcJ+h|SfXh=2Vu!T zawDp~QEb~)z7Zp9a^ve1%20$NRC!cwSpsFUN1c?En6@(z0kJT_nf+bc!~NQNd&F0M zc~(CkzWa6YVrhaRiZ(Az;Pwbh6EI54YZERAS(|{V;o!9inIUTvGJn_^N#l`lH9@H3>r@^%duChs0|VXe9!#Nq7truSs|b60b?1l?ch=jyECknuHG^ z8Lvqg9cXA05%@lQ9JtjnlFw4bKG|y$#QLV(;Aw;`Oc0`eCugY}JpK_$*{G{kJLe2^ z9o|ikp6;eCYhT~CZJX=xp4zXYovSz0>}la|7vExY*2T51ikj5yr7dt{)y}eaLAo}z zxTNtax~;6hSZ0Bv0pr$nJHWz?r*Sk?$yBLGQ5x+^;0DUeerur z#s=ptS5q4Y7YG?TIf2$gy2CQm7k-@Z zsITGPK<<;Hme<&;*}*Z;CNx2zzeA^RZ9Xh%!+HnAo@T?*8`7Gp%8kib@HB3WTp7rj zN+YD~f4l~XvyvQsmST|3%SEQ14vEiYY0{05cq)84Bsmq1%ugISnwJN7R9!B*)qU>f zT#UwD9^a%SCC8tH%zK+M5^l#-uHY7X#tYt@ymI)Lm&V=u@bC+vLPgQ}F zUaLJQ{7CnIHaq!sf!cFa)Smvhg=$Zs;_rSY72O-DpqC)G5~$i#ZpK3ZP1|K`o!yC6 zmY^+o^J`kaka1x4sW9zKQ4JeVk9N~Un@BT{`j4avL=VLh%T(jBa!c_QB;=?Yov+-V zv=kQx`MW1lf@5*)ETn6vK+-v1xkFsfQC~ygLKg-svHYrw68*XdGje>&KPoCP)Q?E^ z$6_T6_owVuDjPA>|6`}wm|WW(s6LHwFL_xPl#+9x=S56$REK9jLYx zQWnuli*&9nrc0ni#J0_WZCruKmFFr#RjFExoA1`n#Uj!9nb--5xpN^gcbRsMo~(IP z{U%6Uy=>EUVL`cQuLHG0xgkATgJyNvWDN6%uFdOh}xy&qURk{Szy$ zzAG;MX08!3t8P!sAyvq_7i z#9|Q--71z!)$@rnVaq(x&cmq*@ne*x&0&5}7964M7Mru#6Utf|#h%dH80_Lj95T}X z|5(d}NriWid=6|Ez!PuUPSGrgN8)A&>Kt6>iXODq>wn}vUe_;HTD|W{sSQLAO*%@# zn7Y%ni2W~uB2B2-5}N_=)D3S%TO5pGodX_P8nq7#ITC_K>(X{B+Il3#`Sg3Zj3psB zE9DkJa&(X!6C}q5$t{EAR#K*+oh~C&mFS%qqej1z^=6#MUlf<4UYg8vT<8mjQd#>r zA8nLg+40UrccOtH*C>(ZiIb^#txLdvT(+nM##!3T;8WrcIpfEo@Rg+_it*UJ5ru`v z<*g1W&Wmds&!F+=H}_V48l|+YrBgMBoO#&cvJc(&OGywGrtx>=_%Th@CtMYP}98zLxJn! zz=@qL0~?f#gQe#x3s2Bn3QFTqN4_T|yfm{EgC!W?gtx)HHQI8eOAeBLGe*`a>9=Uf zegTplOT~xAi*(2Oek42=wFDC0qoT|ViBp=gvBLT)#Wyrg@%3{1=Eo^r#zG&K&SgVi zhu!Xs4oPJg$m_kk@hoIP;}&-MnnRPl`VG^F>%IPVLPuHmO7-Ku>bKMU*5F6Fau zs!=xrYj3G}E#W1Us20k?S{j!ZF{-L@R*k_Q3)g$`KO8_Tw7L=!R-P-^9H9=4OZ!0a zb%JY#G{Io7vwar&1QaImD4hE$xs2%#P~TNHPnI>fc*~P2kWJ!mdRR^Ms2K7aLBq{~ zhgCem(l(n6wf=y!))j{pT4fl@UD$xza`2eh5rZ!nU8j+v_)S%$9uK0Z5{;-7QF5hQ z$ayRoKLhu|ml;7F-PELXifJarG?yOQ^AtQR<3bkdkv}JnVk0*#VXUdEh(&)9i*w|J zbUflUw_RmZR9Wl56gBShQ^Ey?UlQEv6g-EQCSwSuU>}8EUqz{iOkc1LQx=>6+ty*S zS&A1z`m4yyS&-((QKm13#62lZ6)hCmN2Pp&$o`9|MTA^k~{MA!d& zhX40v_&hDcU;fz{jw*@0hyjO>Rs^H6p;iBmYaZG|Y8^4x!NreiP%7;uM3;iagtRdH ze68@&{s@kX>|B3S&0MU}3dMQUomioog2n2a@kG{2!C09)V+$5r?0{p6)p(W1TFmT4 zwZF3V2*&>3%)xT|Sa(K4DMnH-no{}M3AcI_^9Is`+M?9%i$0`0;fY53-a9ELV~aPT zc}NZ0;IK=svNjIq%MQY1Y}ep*!D1$@cW0`A@MFT43@;K}%jmI{=i;d4NDPwEm-18^ zwJV8qHBYJMxh*85Z0(R6B_bs8yOO;Z zKw2%z+9i;xMB`EbX^Uu5-h;%WgP7zg!5^Yw1LW8&uK%A*t?J-}L0TbUBc;`^PAHo0 zwn`|`B8$37E3)6miW~U*iq91%N`yxitLB-&K;iNaMzxL>Q0OBU?Qa+%@_=%12mXt} z-fX;oMx0B7bg?)`Bdq+ zLoygP9S}#O)G-H|GULdlquCcaXE+Jez*>6mB9W^p!`Kz1%J(NxA#a7mLqktP;`$VNnUt!riW*1f-at>|PWc$4Xf2$}(-1vcMS$gVO-j=i1(Rtj zNo|)MG~vC9MAZe)3G*g!p?A=Br^*c|;b=8!%&?Fn>mS?%ryUOd97G`-o;a2gG@&e9 zrF7ZgRxhui@ry){da664cAf_Vil-`-o8X<}TDuy>e;rmgv{o`c7VFb#Kcg45A7k`e z(KMoo#ZWvtMf8LL=kpCrVk}r8bSi2iHA`Pr3-cq!BxZ)o8rSX+V!x4 z9-=aKi)BS7;lQzkp@EP*cy>c{Fbyj1Y(TU)PShimXmd4K6ifp~%EFBm_@alrv2`6F zaf3}myxcgqL}IfNLQT}?UWj2{q3es!v%4!~2lc%+=4n4R{62RrQWNnDp4 z(1m9-@uCA19Ooh`Bqq&A%XRU%D1xV_TB8309kO}B{ykUy0MYKaHVtU!aQlZ~^CNBm zQSXYQZ*ePcogI*lU9tnP6}kO@Jj}fMMkV8u>hev$5lRwahr{I?H5KPd@F`ED-L{J> z=q$b|UFdryzTLjXlpU_6i`UYZ@2;2eRqXODuAx7dF5ZAIx9_e7d^N|@?O(h@oDh$D ziVp>c9&&t2oHHIN=4_vdLP@p2r{HXPGDawTnP}W*#V;L|uyj;nV+T&h_^hR~67Wf+ zs`i7&KMQrQ36ChR;elje;1LB+W^XjnBg%|+mB+;+ia3)i8azrva*tdUc*5|WQn8k- za5$@K`5d;HRMFEp5;Q)_?TblrVRuMe6g8RDNMvd)J09|Am_L`iO!54rC|IRafm^Zf zDUlwbGDYH3S4wB8qzkV^VXp++XI-d%fO7@s_WSn$V;RH1xQ$XhxE36szZY&?iLd6> zIAiP9QQnFBwymQ@3sP);uyWN`QHj+(c~OtaRj3ane(>@^;%1kc*e^x1OWDik-hgzE zICmHl_qMcr=0|aEDWr~=%8YRgLWE+36KghL<4oKWi|H?{CQ3G40*8M=)kpLvJVWMAx_{ z*ASqjG!QX)vt!G>82~ZJ+Fk)j8f*9AH3qfr$qjU^@f_vP%3=6v4S27CfW@EkMl9jX zsGB#4tV_YL?e_WYU!oT!sQdyRu}Vt8ge~+Ny&?g_z4KZ$Z3xg8!1bWSQp92e8mhp& z_qaNm6yc$=n;_jRT2q=$ohzgSz8pqNc}xh?41sqbxU>{@Ybi{rz$tuYa|&1P$4f(K zwczYH=Njy!+o;q9#$r+S6FKGN;H-9H8*RK_EUM-OknR-OmQ3n9Qx)zBDez{P{ctPF zTVYnhre>O;V$J7jnh}uHEQUP9uscmXBJQNUy_g0?&71u*!Z}Y1r>hnY?eS&{(jhfl z@JsY3X!?;PGKIQn`swL0u*&tn>Rk{RpgX&`ICzMTya5c+DKtb^mr3h~1Fh%2w4Ky` z=7};?t*BSPXa{+tg^EfZ9X!savOWy4i>dSy=gZFGQNE@cA3x;YqeubjBq=rE3D4ud z{J7ATF(;uEv)-;1<>KRv@&wFUshJwlkKP`D2jh<$QH9>2 z*cNh$$F^&4A8Nx2sSV0)ek8;@g|5Z3!PcgoijT?=yrh7Mv~EVWbz|kCt7@8P?$1CBc#?s`Vdm1 z;J$^#;U0y=_tFs13~?2sgn2kk?w(ko$=7iEBy-ycw}dj+AzH!E z%;j@tnafv0GndbWX6{)Anakn+p1CKr=H98*T%V9aGndbqWiDS0&0Ibgnz_ZImW9?_ z4)^!WJ*k=dwwAfi7-TM=Gs|4Q8k)I$E;MtWG{{^I_xH>_shRtxmbs4`WGZ=0m(Q7HE?*7JTs{|?xnCM&E{FSTGnZV;c;PVP z9k>hki}7dne8sfRqNE!55}4!@GmjX17F#tj%|kCOz#w#ck8chpHLk<-T?QseFpDx5 zBK9lz<|eL-$F0JZ_4vv$FdVJ;aDD*>tQTZr%nsXL+YeOm$;0PH%-EHCe6P|t^U@_0 zrnCK$J^V!@y7-IUc>;oBh_BuFs$W6_|9H@ETHgYH`krpU|5?6QJK!v)?!@#8=Kpxp zBu(e|??|cu(u6S<-Ycs3?-ytIeO>1Sjay?3TQ2@7SMVNJ{JDm1RWc5FhbvMy)`D%< zrp`US`S9Ndi$Hr|;;0O7I>LPIyO;pPz@B#LOrBH1HH>RF#wflaNRPScnLoVN!rP_t zi{muFUrxi|XL1CBCg*9gs~lhyy%IrgN(Fd^;$I|;2${$a*pKbA6h}Fbo+BbzPq){Q zHGwI9%pTDU3C7JSd1>67M&9Vbfd{|GL*n6WO7Yi3Igdh`%UL6JSt@{i_y`C72jL+q z>at{w#mW@#!-%TiTHzj8IZbHeuDHR_i_f47jU}EAX>>iCp z5O^STq14`#hfiVF(wi{X)1MZMVZ1wvHqdEQOh=m3#Toy#2Ye$s{v`e?k5QsA+!ENG zJR6E<<6&(ehUrR>^tbSv;p#gGlaT;j$;;u1Fr5|=odsN)hxDHh}itpKKn1?Sa=DufF@*k`C>lyx9%U?D8)j(f?7H{EF zKDmRxcH=8^>9c$Ah2>;7!czGXF~xr^uQx)IBHBJpLvw3*TRHk*(I5u2_s5V}DVpmm zJ^s09v9Th$6y8ER;&gIo-Z?Nj@y7 z#=`X+%*5w3CqaKS&x1?q`Ea4;wYjm%zL8t14wXeWqM6Dm#Hwn_l)d<% zy`p9ccLbU#by=Y}9n_m9izxgbC^*Hw-wTdm!ATP>5)~Y7rKsTa5e0$@PO7-t0O?{O znH8K%#MPf&aAa#^P;jmhQJ{h&92B_2Hzy_Vkh%CR68RG(^zv~03JEP?#oP5UtUVKN z*Y~JBgWlzmad`Gj@!KP31pn}e%NgGiIvTM-ViW)3NWJ!pBY0;U{o)9wHHUI_rrmRR zI1sNB#|90|4dVHM>i`zy!EqM#GL<&4Wb)Xy+`U?fgyW@dl&ri3?w^q6^QbbWQDK<= zmsYZ!uN=U`NApY4h5H!%qbo|rJI*D`poiYlH2XZocP%`%P4qrgyiA<@R1vqI`Lil? zJJvZOIez)is?Z2LZ|I`fvE_f$&XIc+uw3M8sQH24J-||{&+!J0y_5z)d)?p1Mi}In z$2T61@c0C5XLl}H4~_J8so7m94Fa!Hr#04?fH+E9XSZOZG8}}YQH^+o8YUj-o$B?o zS}XOnw2Qv+V)+(yEz6tVweBB?#dWo_M`L|9y%%m7$4Oufn^=Sz20zxkrTx2mE4;jZ@2=FAIpssBJGoJtr3JEaz>@Z6JjtR^Y|h zvUBrYi?wO^ag_JOj+cW?XFvz~jUni}#wGg(oXhX<#fn1oR0G&irnP{0p1>X;-(q@r zKmy}Tp>HuQdcpc#-zzk`jOAge_yUtjU-gR>Itk@V#d%yNml&4|`7(9HD9(88v$!Cu zMe`zjxw(>NEPIJoqAR4U;;75XhU6B~(~#1Iq+rdIFE26J!|<=lJC3RHh5JjQ5tD8u zYn|Q7R|PNltI9+Mx#*=bNBGwS(2uUfE3j92)F*e~lE*jg8N8HdH$=P;2h(Kp)_T-O z_lPS+HFyzEB7(>B_}kbuvsV~^q@j1BV$r~W;I+0`ASloIvUhm=*?aLqXcP$fRwPQo z#SNS|JLoImYP57!yn2L!@ZwilmK=c47z@7#p1p7JZh*eO?7{z=7JrBTao4R!@GZ9_ zRtu$T$#7bqym&WB?HBLmuOs-PF!^f-zUmjp!BwCEhx)}e_!~Ale2d%R9PUcyuXO%W z@P(Tb_$v`#^^5cHKi?b=sRhMtaXtY7Q^;ibK$?93Z;{-K6iGys3jtAr1fsoZaXDck z_7#v2&{BM@OT|f%!io>)Xfa-9d~tndLKGU<#RBx-S`CnHbfIPC4eQlx{9asu8Atdl z4!e)=if7*|yYV-^_Ta02aRSb=1v~J!F#nZvaSlKtel$NOw@RiA5x#H?#df_XI z@{QuJS4#M+oWCmgYbk$K^VdE6wUWP9@z*o_wU)nX_^W}xcJSA3@ii}zUT_g8b|_AJ z1I0;hsr#oW6LP$Z7CmmkiOTZ0Sm*K@NGR#4_1Owcb#N2l%l4pr=b}*OJ%*E5dhgFE z9=|JaH@+9VSc1PZm#(MN&h}Lme6^3fy1ttJ z_N}MW2q|5JRINRN2Z9dFLlh=G*ATLt|h3Rps6`Re08ps5mZ)CT}dg)M1K0c+Gd%Q+b5tlr{n z$bL$KpjQ_fzg)RZcnBeBsO1OeEc}{Oe3HfXUc6MnwRVxnwsmvyC2Pv!y%aEI{tYNJ z)Y-_TCi2}hw7=q3VgwJa>Rxbxha`Mcmg=M+LQN>U(sX0Wf zFOVu|IegOr~{#9&!2Zk zVAX}MDw*yKYAXH=^=K+uI+w42f`a;+~^EhwXX^On|UFNMz#(_Bw-mdd-((TCj? zkGoLOyun4+EBSZ>J_$TnYV+t@Yck5^J+v50AG6Cjj6Co+i|T+GiJN)b3$6E&jZF&# zr@!+WzB9i*yMk}buF&qwm-j^(+&2jKLDz1?lGdBy=Or7Q0~^TA&8T&HYSAL(;g9^l zANj$SSjFc`wqCQ^Dh>~blwhY1BSmlk&%+ti#krZtCUoFD(7q}AKone}2C;`AP)Vx; zSFzwyC?Ydco-03 zCHU#3fL~EfW8{J5i8&2{;C9fetW5Ejb~SLKTAcosI>0Dbh z`?rX5!q5$7K>E-p@K!bkg`PV&%^&5Zf8jI#JOqspVO}l z66;(kk2)<2VbB8cQ=E@xAwH(i4!L6WnS@ zv<)D}u?fH<0cZcl-cprH~w0!hc*yts(tINasM}B@Nk- zE*JM+3#nd6`H&Whv?_wsQG`(n={|AwkC4`ivbzWpPZN?Z)^aB#*0K`P5TWJokXXwa zNUY@*NUWs+5^MPc62HRj3rMW*03_D;BcyAEz8I{qV11`SVtpMUvA!;lSYJ0ttmSe@ ztfeoc5kiXsiM5P^#9GEeVl6j7VlC4kv6ga3tfdmtXrW~}B-U~-B-Zi}B-Zi-B-ZjQ zB-ZjWB-T<7>3X4M2PD?=F(lUV1tiw;EhN_RJtWrRz*7usX$xtr(9!`CYv~M$wRD5T zTGAk~mR^upOBN*7G89sw(2@s1+10k`#A&^*K9wgQ`4iamb42iXPAS=L1HcIA+eSQNb`l3HzBc>Pav_DFCnp(1CUq?mR;4LN!*8zSkJ;O8_r@( zy!kA*d^r0|@L6sdaduVkS#CLTc4hF{J4A~q&tm49hUP_}h>4?KckxK@#Y)}9LiDfN zosGJS73em#i$Cfv(pa{3Q8S66i3pXTBh@bYba&Dyv*|?|Z8p6~qt5z^{$;5F0}&3k zu~GMfWgdI+hhXV!mFOmLw!!f1@9fD5*6p5a>Cg6<6+xX0MzrebI5 z?zm#bIUoC8ql#V5`3JN`z`1ydqg)WIRKA=7UQ!iC+o&dtYymK_(Ww`(^Z*j)AqF135I^&1NJKNLST=0@(rGB7T zWw5Cg?7>B)603eGVkGm6AQc~e7-x8#m{7v+Rp8Yi80SyNG!Ifrgrv>q;0;70u$-9U ze5r^ty-lWh7RT`Cpz(oak(!vm$D;QHTCq@2hk;mWNH<7q2*rdW&F{#iH8|=9ng7sF`7eqA-VM{fMQAX{ zbg>C^OdWN_oJ1FDn!7_v70GcjG^Yv8ffT8Ck!=`Wr`I=e^`>{2)rwc=T`5pnW6n37 zjOa|VADtVt=w zw5nLpmMZcKdqM)ucP`dHiHg^}L_SmeU5&{uFWy)yHjvO;VuL!75wuJxs5Q=v)EZwA zTDPeQp)DeXfhi06HQ-fbKr$Jya3dL0VERMA+s?pcZg8_9@h_{4gfvNX&C?;hAo7M( za`X8#Bu=mmkhu9g07*8Q{$-i?L*Hor!kqnC&Epm>(}AE;WebC@Fd55TqUhcAqBWN1 zMWgAVJxiE=3u`l5Y3%hFk?HC=jH> zZ`tRl&C&mjHFJkA6NVS6;?1b<&4RVq-$I#(9tbJZ>^5=QMM$EKxQ~-4G_ON~J6ZX_ zflw0_FZKjzz6Lc&*cQ~nGchy9t$O0=?IT{a3fN8-S1niQSKiz)-rRx4KXnTZ0ew35j|6m0bLAf`uL+}PbrM`bUuEEnE8ZYw(Z=)K&KsqEOS{KZ1HGYd83o18z+q{&3bK(Z!1M06*o!4LGCaYpy zEv_Lx&EDF3-qR}Ay-a7zT4NVgqBLqS-usVVa}a7MqWtEpiy=KJdJwW}q>z5CW`3KV zxn|K$xy8oI4z$`W@X}5#aVeg7Eezh(Lk*{*wx%?~+VtV^^n)dppB)LTYD1&%I>Nv5 z)1XxD!-~11oo3^8?mVYYt0u9BwLe_8{$xCw(X<+#eHZPE_6v{Ou7T~G<~KkJJYHDl zjh5iTH|BS_Hs^vkxvvWkD+RJfoaEOJauO?QM|#aHO5Wf=X&NlEOC6ltoLxc^FLq5A z8FVfp$r2?pOD9ibAOm8#Ak|~u4h2r+5iMg54c-=vj7@G%E1|X;3X|(#oujpI_UK8d zr>HGI4^~|Vl!>{`J3zDA96%Wn=d%3$4rKYV+U&2x42<0E7`Udz#+2v1YJpTY|Q(vv!5HtlrU)@1y!a^Jctr zsUM{Nt*LB{&gDRcWY?z(NNm!0{@#> z>Gi_jJ*uev;*@$M3%NvXr~^+S?>LoyI4tn{r|AELeiRY+fvkXM63w)et>r{%CoeSM~hPmz-6M|k#iRoyFh)95*C zhk;9AS`D5Qt_C@gTryGGrPS;p^uW2`Y7mHuXrX>)czb?Uc+`bg%)uj$TND8_(P;TU z@Lnlaw!KRABJhk~q}G!=P-?1q=@IXD!y|M_ z0)8Ks_dxnr#i4}IyKbNx8{QhQ;cad3&|lR`+)q_ot8lbu@)e490HfU^G_Sy0g&u^Y zt^dC{DHY42gZB(&C3)y))v#*_>!qonP?*A5z3sofjzT-~6gz1e&sL4P7q ze7VMZ-4o-9?vJ0pRqzV`&3L+v^WaUX=i`Tv+!=G?y$RG) zVnM&Rop32|s_Y>BKEO7rq=P|uGB%fC<8N(QYqt+?Zpe+JU-G*aFHV5emd@iPHh9@T zvbw#}gr|S{O%9*@>K7N(@%jS^H1b zw;99y?}|cn_JPp%KsFEEzoJBARUvzPkI^a7O9&mLP%CDNx`J95O5QUhZ6nIux`Ef$qdEgmnBiTxR%Agnayhv-qV({n~$WS9y3p6A~}$9S(^XaZZE8i$^OU zT@^=7@Pm+e@#x}W#iNiowBC^T z-YiIbFYT0Kzvgc3Dz%<`^=s`a&Cl|^v8deKmeXS6MIz2gkRBI(3~k`LOPouG^rVnz zL&x(%8VHG(hvq_hRNO(^J2(b&AaPGs1&KSP+cfC`P5Qeg9fHLESv0bpwa~(1mbyaX zp}FCZ*g=@0U8Q%7@WQ8uAo1d; zLOVg`=HcA`WA9wx&L4rky6d@%DGi`>Rp%aMOLX}spNG%Fl zAfd%lnwms1o(@E>2>7`4`ndM0SMWhYdDygpB!x;_xY{E3FIDu?8j#|n1O)Q`uC>lN zGkLWIThwd$kk0Syv(J9-z1CiPt+iDe>uza`-79m* zPno1O_f=kMxxlxw`fpey=ZmgOb!}Af4df@PoFgvK#4QK|Al1Lc#=-72Pawq#H^;W} zLbS|J-|(_{6$XT#>U3-FK=$n&sJKmTz#e&!B3cvXIH6-ov>T3xSq)iT&!+ERlipdn zw(V}O1}jH}EB6^ciHr35k3iN@J>e9ZThI0vF3UISX66qSe@_j>--y#yF-gSW(_*cK zs=dU&qPqk;AlI__s!OfR*-lw7;&c}0rz1$or_(q-F#!3?-!SF9!Y}Wb>)s>f4Q$eP zR_N;dLemrK@nBkPPG*EsOO!csLHTYJJ14jMx3JiAxHHxc>OMHky*p1%?)P584dr&? z%V}OMW86Q#i{`Cya(;K9ds(8W>4p+ExBGKSIXl83-eg>hlyHdGf#1if&ibRny5+^@ z9Iut=y<_B~g1ZZv{SAsF$5L7n=UTR?T*Wk(`|L1|l+!}wBDj;QIcIB5}O`G47WNJ>#eI zJmcGIw}yM_6Z+xd&HizaGh{ly71{{?u_YSWY7AvDQkq`ZP z2G!RU=FlPj73qS)G~_2;_$VzIhX+fza=7C<|?>!ufjpD`@p13Ve0yUzDDuniN zH0$!grUPe=iyip$re7a{Z?)LOnd8PboUPTj<>OJsQevNAj>{WN5KIR1;Crwx^sQHS ztjTi&dDxCMJM#lsr`hC`T;}O>-rmvz)?H04?8x{*kX<kPgDx$o)3qO+?>efb z#F`>UMrpYTt<4Yh57yBo&kwb-6IaG}n1Wq~AU9RV#P?-|>-`RU{VhcCDbu|&?vj%` z(o?F7xy>%wabR_EtZB>JntF;dpqA?5vGoUp2bOK&E$VP#4^>>;xh~1)ewA2}ZE4e$ z?R<3;+{Wu_r~TJZ6dbQ6yw|H4+Z!Z%(U#in<*o9KEpL^&yjA+k+bYQ}Sl(QgH*xmm z4)nEZt3?`hVSKBW4)Cq|rsjS;Wpln7c@C4lJuzF{WazAq%dD^EYRkM?U&|zZg|$gq zruPV1N+x{=4_p~3VM8Z9UG;OF^_%i%eNv~~ZqIr$=^=Gyzx0#2#KQIK8=3UAnqzL# z+ai!R=`CPg0~we$hIGgGbhv+(DQ6Sy3m{`x9tYX<`X$Jw*Ka{Ky=2d9(<>TIFDIN{ z(<&AjP#L}NI z?!F1*Pndf8z$T3JhE14ehQCdiHjqsi5dhhQ`5%x?m}fvXVRnFQ!t57Ln1jO!bHu(0 z6LQe|NQ|yUIN*S5sMGw;0_6A zOv(S58N-##|D;SAj{WyBWlZ+Sx_vVSK4-W0G5@?XhU+l)&6s^NMp}UXhMh4bVyN5n zTwS2}V5U(VHN80bc|?U6-I#!_<#Cs-ZchHT8QFvHVyRNMlIT8&xQ@+MnoWAkTBrGY z@`SjoQY>6+$EbyCCE|l}Ri>`?9!-1QBBAh|FUxo7%R16{jXqi~AwpYX(6@7@W=@Fr z&K65y)VfjasgcKu`0&U8>Jdqzr*iuQNf183ILGAAT@51S(f ztZDBNsf2u@HIV&%uB_lRzVMJYJf?3Ex3T?K-H6Gdh?+8U;ubnh9oF1-f+bGW*}(y@ zNC{-;PLI@$WKX+J4zBE|_c+k06GRktD#&cQQXugQR20d`+o&Kpr2Ve$n2!g|Rx}r6 zGI+Uc#SSCy0GTvC&*glD-BoaK)8!Sf8<#YBuw6{$Ob?>mVd( zqNVy2)^o{261{Vs9GF;Ljs$JglBqHrn$_w^p_brn{HaHa`C1zletl4+U-ZH6tPw>m zM;gwayq^2yoKGK`JL*3zLr~HXJ)Cj{!6_0VoW#m22ufRsen%}$3c}^hI1eP3;{FdH zWJ<;ZcY_GxajhHobK4x`>UvKoL>s_QAtz{)UOPhTcXWu}1-cLvgYM_P#z^478ELN^$LswF%)v`@s*6M%U_?-KfFBYX4^$uU zsvHDwWo$50N4nC*zu+qCwMw*Lq7>*?au&}qr&#iu1;J#HSr8;ZcJb4{fXwznCYIS= zgomncaVgE5KuT%m1X9W}T``9%B_gs{xgC8Qk#xOzw~qS3q0^(fHVukkvHnIE3Ian)Sp+$wIe8`m@U_ORKU0?kE7*EDidkEf3^IC1G11tyZ-?R z;($IISUY8X`=|JhE@`w_L4Kp<-zlPVXDVM?%Y6uBE%y& z+&W5<<2$=^dP<#QO=c^Qa22)!$su=MZ|ah}w-e7^zg>=sG1&EoZ7Ne84T6$ccY89E zjy@L-X@8Bi+RYoWc2Xx>X@%>vdY%cgdcI%Y8c!CkI${yO*NS4x>FyTA&8`&lG->(u zIts0}0)r5r!gUL+xm2yyYISWrewdoQspL$na8Po2)7!hgF4re|$0RBX^(V7HMP+%~ z9Xm6to4*Rp)ymnSy-{w{Hu2YQQ57;%t65TI!4roOULg($g6l+dD44>c40oz6;d`l(G@E$GZ{M;WQvX_gUn=1 ztax$?k!C9+>uz3`YHbG^kQpzqQxh`3Ty>;1e7TBwW7cJ5AS;6`eTGf}S!vDzS!qUG z>7}EzM+XoJ`#iT)|COKTR{CJdiJt@U;gPdjI~^-!xH;B z?M~E@2WPO2vH@65;=@xf8Gz%fYriFrC~qbQ2Knya5aI3o zbYP+t%)D6ng%kyH-&Bmv(cF=py|MrE#p)trwmUFS2Q7#BDT+)7$$C>1kA=2$p-n{U#AP!FP|7f{RSPTB}+XB9V4Wcv0lNA&Q4+Mu=o%WbrNy(I-J; zv~lKxta0{2mH)tKjFZ71oZ`4t+XYi?w<~eZE~@?gu-enYY8#Sji-^IhZ73dwNwqEP zf)HI6qH92-wb~0oR_%b_Iyy>FXs!Qd4ckfFACojEM{I}b>MS#h8D;&9Sxf%h@=|@~ z*lD%fv=zrredFgJGhomKBd$wFnw-5=c4A&Bhef62Cd$;|G0wU%1lT|kj?&QkKsG0m zAhTYq3EzIuN24QGgZw%1H!HjKv6S7=NM*OTQg%W4WshU%LfhMhLeAYjA=?SgO=r75 ziA2u({1?v^W0H?z4DsMor>xlYnP0wrnwX!Iryl5k#{sV(`&leD<)x{g{Bdd97stH% zryr(P5h(vHcEpc{oVy0cZx^9gUG+bU_IH@_sa(;<%#oEXt zU#=peOGKB5LJC%IJIgIxow}k&-u1rSy~BM8tBoG_iZvQpAN>ytIb`l!bPk(w5_GE` zyRrDb$VKlQ?K=qFb{^GoxiFdZSHFVd`5GyNTeyLw;!_>0vR5w})xRc)eGIX+S~P3R zpSVdmEp95(9QKr_J!w&HJf7|PmwqCWx(x4eC4M`c7ZoLQF??hqsGqa9n_rR6*IEm;=)@gFg1!TtfVp>0cqJ$j;GM#`4AR{ZMgUn?9 zgCH};zYz3k{o-3QOIfCurF{IT;O%=r_O=>iqMr|f zjK%v5$jDhM=p?Nr78$~hZR2l%#>PcuT&sR%St*u8=R-V7C$IGtF8q%v|RG+}KKC1T1cF1@_sz_$2v$vXsAaxBKi0 z%7_xk+0t&2?)@T>#b^qQgV?pTD;vYKFd*{I=OX&E%hQwAKu8K} zu*T%T@mzo1<(7Ikdy~YM`{4O2cdPp9C%T#OZc{gxF84M332z!rtH(f83gz@5Dh7a^ ze{{b~nd1J^+B?S0yqhFgCZKq>%5(UUxCGlBS@MJ*FN%m@pr4W#Md<9vw-m`&D;0@o z_g+P3f+lHid^|)eLiBTxqv;(*kK2NJY=}a=AD<-D#J3V(hym(8Zv)w|!8NR_!M;`f zK|CC+iRRvv=pc|cwz|s-hdJ4mWhKHs#Kn6MD=@}GvB-l${p$}Ax>fa4=ceCNoL*cv znS`=&VM(O^VAorSTaeeBo3=65!Z+oSdIyv4QvK`~^4aK>k#c_=G%l=+tP*Bl<5Xyz zCkG|%TGDY%`Um+*&y3WM_GZ-fj`GK1R*ikri=JYrI+O*AB6-H?zW0sEr7`KFVl zp*<=K2dsHyg`%rK_ba*u)TQV@LH8-TAM~)IXFv}q5+%Y_il%^mqUa-_)rxKfbtw8F zXpJIS&pQ=~Cg4Mg{tS9h(W{`(vXT`=#FFV&U9iNG>FX0DEN96yo-m6igvsK`CEgbA zbdV{!O%3Cv!+1ihEZ)UoyvxIQp9{Ii_m?o4c;~FFkT{z z=Z5h<5XSp(81JKDJh_(B@@)v?>3%*QY_`2$q{S2c%rcwW7`#_R#NO6UyX~=|JCsk2QAl8p|V1u9FUKCBOjRCZb$hu4b>)Z*v=<0 z#K%?S!F=Se!(w`0e}=Q7xvY_}YG=jzwAaJd>Jyd&X=Lw`}r1L!>EBX1LXSL+Q^yNx!g;u_CmYcn@>_5?! zT}BMueq0aBu;|&YIV~bv>rQSWJmMw) zl1V-lh)^@hr`@dW-ZBj*nHRa!axY)%O7?S8%`AdyUfRmnaKN(vhZZb4$th26a*C7F zxp{kxed!RDznar5YG%t=YuOP5Lrq=4Nr7f*&Rc@!pV3tVq6qJ})QaHP8C_ezj~F6~JK@ zJN#=)Q{KXIF73X!b0x#o#zEUkp=KI;UH9}fo9e|Y;r#p%;n}|t@=A>pW$9@k%+Bm? z0vQJ`6w>ZW_y*{aVNP(pZ=)@6xo}%+W|O%cyj%ye9oM~}XOztKfadyhF0HbA<(?q)`^0%T=HBLISVw;PuO>O0KxkmOK7Ram2@zZ z@%)Y5K>r`?@z%+i$R(Pb=BZSRlsc|rndLjv`sC3jSrjOP60Ec{_5(fQ%#>+elwGj2#We^qi13@ROy4L^kZ z(clSnJQY-00;TfOD!jDH746y5toiFoGiHR+3@-Hw%SMm1)}*qv1$kcO+#zRg$ZNQf zvxl))sS|3%;U~LR8-D5B@Uu+L$&O93H$pD^3euyxUS`SC&;eD}EQAbjDXfqTYyK^0-XSig@$$ zGIcBK54}$c2&JOQN-xniQ`9MktyYS^^WwcFja0F#MjBEIrrsX!s**QcioG#l{z2M8 zhpn`j4(hyFCBzP%An+bv7wg=u5N09EYMwn^t((0%rqfSm|z2o=#6DOQ{{m z=~|f1p2MPu;7qq(Q_>>b`vbcNgl89wOEO(2%4IC+?9^!E0xmu|#jUE1HJqsXiMR&U zKi@mv^^U;$zVXvUfYu}QLmg*hrVJz+KS2Lxe;WYU| zQhK8Icp5)~qfEeH+*dZhUEFXHWTC^s6Ha7*-BBF7l2sfjxZb_mw zmT2USTUWizvsPtBtnvDiNW+y~ zi4u~S5$l>(qAjA^fdZ`~dC#V7vRRN@rlp*uPc0Z0qGmD9&CsDUV!e}G{2*7A(8HPh z;IUH0ylB|HeK0CL;k5jLGNirz6O^H#fup_z%~(?4G|PEp@YGO}u)=NRhtOc_K7%_H z(fCGHGc#-WbgZe zs7EBEDh$nm)jn`=t%;JWbk}tGL?k0!<_cH1MxiZZ-2Sz0=3M%&-b59NOFF*}yWFRw zNSvI$r09;q0Lk)dZ)Iwh8c!QYSC~vMy3T_=_cN#>7_L3BMa3;Y=F!bg#s55_bJx2u z>K@oB(eT|N0+@LJYWIm}B*Z3Jv0a3mV;w+@UR>_JO_{Pq5e#~ zgu67J!2|Fm+@m41dYpN2l`tt~G_x>$i{4^hpF4C&F@EyK9s>Y)ryC_fZk9}=eqoA|t(wI`| z-_ipGy5ajB=u8v)WE0{;fA{{G+<|V4p78reG~AH_?Lfs!&Nzn3gPfLiWFDS!Ji>#@ zh2qUS>JO@H5)Qy=5mgyEDbUj5*}A1eqUpGQE6ZrJ~4mr zh!%D!$<5Q`{3!Kk{)HJdlvN^|8gNpTodzeWhuZc2p*Bsz{h??=RcJbayk(~c4Q(r# zc0SuO{O9YABZ5h&E(Fci9{3LEKNSfBVPP9UCcly;^O+?*lEVg*WE~MAQ6Dny z=sh6&Le6mQi;<*T`})%6$S`unf7rg%i8w1EuADiET**n~-HaS%@?K0%?oW7JF}mnu z5D};OTn30cWs1|11gw-Dr9av?%Q>EEVJ#yNr|$6Z9in2h0I6Po!@+KLK?Mp;cCsi= z`xVI(uZX1r$N#4rVzhLHw_8pSh8Rbkl8yhF`q7l%n8{&sS^Fv*RO z{sAGZvo$Xa2zh~!rw4>QP00EIA?pcQH6UbFm}%R+GHlY>ua-%hb7EP}iDd;RmR$Ao zjJRq>xiHV#W1UMZQ{$QsvSY~4fXu(Ttd}q8jDHGbmdMgl&uiGhG*O?Tw}Z^a_1z&l zD@5-P(PbeLcTo0)s18onRK5rL{V}rB`T;1eVL4SX862*c-N28H5q7{AcOK58iKhmy zFqWnt8gA1LBK|9ya_&t|hivd0+ZW0=e;M?Ri4})?vRmXU2S6zmyqsS68xK=0iAhWTI>$AUAcok}pXNojE#V z94Uy-7(boiXN;Z951KIy*ZlAbeMmDW-_hTiLYYU?#~N8$*C2;0VC@uHLb*pNA5QJEtr4H(HM z5i)*22tt%SM4>`O8od`nsE@Smo~1rZ^#JJ4q-*n`kiN0`a9D_r3z2Z1_EuD13|$ZQp#@J&x_Im=8bNHy=WNYA|>926-@?&<4Ae zwd__pnC`>U1+i#Ry6^~K@NQ+k?pBWF&F;{J+d|&!&aULQWz`RPFd+v>w-&7rnXr7y zp}f}|DTwl3emY7Q*i;SNu-KZFt?5^g7D0AqVJUy*Zsy{}-X_nKLABteB#9uzMNaE& z%IPkOFj{P3#_-zHjZmfl6JR+W!2}p#=ZsRK%L~iQkN!&n!sshBdaK4RpTjk8C!R2b zXjwfVNPA{GG?b0=YVI6B{O*LY^BYfzmN>=jqtsYob?_rwCH0M)w^?e_Dz3}_H%?UB zK79&g+ow;1Z2PnZWZNf^KmV6bSZSH(l(iFf&zQUjjeDAgiM5QO6G1N?qsLAm5>jSw zg_QkC-^x%h^f{1`MzQKJk|&Ixp$9_rSctZS=no<42N`LcI4U5G zULrtwRS}pFQ(0AAivAzD*iz)DGyGD7IK3N9Y+R3+&VJjF6~I2oNG1%;3NtYse5mJ zrc(YF14_KjqeaoF-rd(+v!C1am*}-)#kzk|CzklmXVke_;Zwa&<*5gA9#!jla>w~* z=O)>si&ST}n>|RT2$KfWdc7f2FT1z(4JY*3Gh|B>aW`&Dd)sTWWnW}k}t?`4?UgwPL zLC2*hbxnSp3)~AeE-%qn?tPD&J;h4qb@^$?x%p$9r0wTUT60eJ49eZZorYP< z=Z*Y_o?q^Xa&=IUI)76K$&09gh=Rkn})^c27CLi5LJTg?TsK4 z9^M5q-P3zOi=&dBj11GB9(J^dz8(MV8!i9rqvfVIFj|~_Ys)|R+VbL{(QNQRvR!@%i z-11D#ag#ezT&K-nDSzd#bKS}2-}o*<8j4b$tjxxyam?oHM+SREEFxt;cq&Xk{9pYc z&k}0nUA{Cds%<=O6=sSRbmC_ZBBVRP;AO3QOl^7`%G(A>32V;#CK`wTRLt$ z7{4Zk+ueSsZePO_{N6_%@GyQ!{ERzUmGR3XI`7GLQJ*{`r+Af@etY6x$vGug8(5o= zgX7+wCWof(QEpRjLBsmV9bC#ykvXo{B1@91WG{@hjpX^)b`d4jp4TJe$aCnp8Y;zaD*p>2L4 zhmF_9IdpXWL&wC$iHk1wZE3W-eKLL=(eLD+qR8nW+ZLY?BY5Ir9vwy3ofB4jrwgPm05%tKFew_#c>3nwyzU!VBYrG=o`7t{oEgKGHr>m!Ih%+s2#^D%3ESC8)+j zvua#gv=>LEGAIdEbvBHx$>0#HqXy$1{$i>`*4gywXruvY5~_w((_#(9H5t_P4oqkG zqOhT`27M+`F+wAAK?w>r+iB!BRqE7G9G0vmkepMVYwCi>h-#W?)rrB18#Ns@!L`wC zU*~&tmdI;E!*rAuMHf`H998R2RPIEF&_#)fKkopyDuK?UXf^fX3=54y(U(k%(j#Fk zd+_375;Qex`f!6YL@CNEp#13M=}(~6M?xswYO{#uo*QjASP~-B*tS=xjJzc{rom)G z@NWrDXCjKl4UcLM?!2xmV+fK6}xh&Ya*s~kM$N(WlBpg z?W(q-3CgI`pOI@zi^jD@rJ7M`(TKDt-6E=FQYz8drN5ht(I695Hfdi>DwVKBMY54c z&|dV_LIx1D{u=LB=}gVH)0yO*Ze~_HQiFz1v8S5vdW#kdxp|wjV!tyc)fb)d?uKaM zL52lRNs^PFPk4!vV`G-wyJmbWQhC`-0E2>W{IAQkkr_)aL zwv?A(ZlHpix%jqF8z1UabBnG`dY$)E;@iX&_2~kUfr`GC`NryxsePj;i>%Tw+JvCF zO^Y@;T>J%T!v-$pjp14yuIuivWiiC3kn7DO!v-?k5BDECJt!fpgN=ZaroR4$qORmE1#Z&|1r0yMi@_~8Sjsk7r%Nxal1yv7*J@gx zcbXs8vRr&ypb^e6-cL$!rj}qz<*o`aD&ciV0X7U%fc~zOl;L~Z#E^er5iI-qi>1Or zmb+c)-N^I1Qg5lJG^^&~kEgxSy4xCch~zhMUibP{y-cb)r){rQR&y*K)Xb^EKj)WZ z(r@=ti$7P;pe;^j-*&s><+O(m?Y%gtY0h@1m_a}5CG{ix9#`C)qL79aiEjltPTib} zyHgD1eOIT>O<$sHx)cUJc5!!_MAPAE=H#qRn%285tyOtx4eLhlBuz(zZ=&TBI3nhB zMi>TUvv>0&r!&G+s(d!*L3J%lOXx(^PHWoo9IOs_y>2||81MNV(BVX6|V-FSZO|}QB!UU!{8Mw z$S~v;M`;-dt;-K>(XU2~+c->I_K~|wZnr^h?}FTZ+sJMEqLIn1oFFN={Y^S^`JIDE z?!*+T%1U#`L37_((Qv5H+;;{v7pi{wox7yF?3msh-IWVB1G)XRPt{KiiSIi@;(OFU;)_$%0t$Y5!fEdoORYixyayal z$(*XLJo2Z-RXSxQ3@qFC!Kbsx|TImcS4wR$*?((>Mgchp}UeR zz1T6QI>>(m!7l@SH<*u+umva z=L;IN{dIZ_BF7(+eD_K>kno$M$X}uJc1n@QTz7KrB4M^KITHVOLY99-4aALpQAD=U zo|3_d%)H+!S?&WFSw04`e2m6B0McqC_)w6M`=Dum#Zz}bg6Op*QSkSKx26mlr#ubfXy@e@+YFXAV8UcD0Jw+MN#OiTlv4(DXsP4kf~HAPzURd>C*>Rp(C`G)zN=hx!x5}^%x2;7g` zU;iOFj>2*XIT`!~R>Z#WWMargjT^{CiSWdGINtg$@gPyC?k{1YWV{u2?PrpcdsIyA z#Ng2}E?1jkwJyD(%uP7OGT3lOjkpl^&4CYZF+#0_6GUpa-7guY@c5OIl8GvXn^-0M zs1!0D7IH)hk1&}|`@?fG@9GtQU{1Su=@bq#QPrI*=MP1{feAx4eqm{xu3QoEm@Q>c zA7!kUFS~O0(m9o)2647q^+>~eWfppykn$m)N6Tb}z7nHtx9ZX0#^Gs|GFDA+PsJ}K z$@41R?x{nA_vJ*xzRA{0bCRL5eEk`j-ukk9x#A%txcHrrUb%nkWbb%t_InCebe}T+=Sk5yn?5Ch7 zG~Q;=_Z9svM7VUH%R?v(@qLI65|KQtUlF%%n7I48;_s;|So%2c6dkw{r7;!E3|+xT zw$^X>m%w}DWoo5g*(4*rA)fH|%ZPz|Ap^ZDXMbNVqkE9cXIZk%C52El2ucM6WrWc^ z#80odS+>#L0J8CWE67IeGLVhhABG6ATqzIXsP)IEF-GdKaFc3%``ovNj4u%?n!ohDWaI!hCK*BdIz)nQR?7+RFs9CnAx z<#ZlU~?NUTX41CcxgW2mC#hvn2V z`-wQ7Qs?<}Vp<9JjiG5-$APjYra!g%FC>OA$zLvi(xBOyXwz}8W8pDZcodsUVinOj z89}wmdF(a3rXC6xqZ%a(th#swd#0 zB<%fp)!&E`?Bjn|jc{|=2+s{}1Yh@~0&Y>R&`Om`H(w#rQEz&Q+~-u-1HzwIk2_Hi zy>Sq~A5!l7q`-CCGz^7Bd?{>{zIFL9^LkJex1dY973 zPu=*gIr;9Y$gBTRvf~tbt?z--Moi07i+|;M7ck_wlYUp4y%frK37bKG89gv%p9A+m zxY89LoR9?WHOd{*tP}RYhRyRK65SmeK)QjW$=KEEWn*k)af*@~`AmeNBcF40D~OEH zLN|k-DfCu^6mZX2M=*3*b;6^fb)tP_rMN8Yw;=ELlgX2Mf`!MX{pAoV=MQvf=Enq? zyWP`bq=iz?v=WEku0mY1NfAbLMOsBHE5wzcfejE8V$5~#kwRq0&Kf0Y@2n)_gObn; zltES|X@@y9$9G{m`B7b^f3CHrYcl!^uF!yas2C|Du7~!B zPDWe-HOX};n#d&kvWqk;k0(H;>?z!Zp|?RMY^6FHWMPv+^l^}_USg|rW5|gO=}tE5 zX)ox`r1O)lBG0MXF#jZ)`0(NSGohj_+E9!8MtYUbIDD`6Dn;8vy_%QOp6S(E`pv9v zejN7dFT%c*rnI+5(p%Q6Wno{Q46?UZgREEQgL1t(43`N%ay65HE$1sbL%Zf9_TJ_; zy*@@}CbRV@R5P!RVIt*vKh>@jb?~A|+wP<+?)|7R>J&{^{n5E;IYD9?)wCA#tVidc zA`+TlI=WTc=TF4#{o#4jG4N`*SQX-`dgjmTJ;2o~J$2R>+Qox1OPSb|4YH#G@!M`k1=B%xRB!>v zjtVXT*-^nJos(m8sCyxs>dauIfWo*azo z2$Dg9-1#Y|`Fj*{m5k<`r)j6(Eim>BEM{9u;zyC0)1J${K+n^fV?qsVt{R-4U z+qB#m1TIM19juuLTZyh0MYXhna#yx4zGoTF@zw_=*ePzg+upv9A7U+jutR<`4@$6X z@8@dD2u3x3G*2xnX|uZg`@Gs@heF7$J@Vn;`(-t?+&TI1s&H+Exr6ujl8O|1*kXCN zF1Jja>&{T!xUAGA?;L*k^ecv@Z;jEVO+5?v@N9PH{EmDJZC*w zZBVW4wwq)mN)-iA#X@JPn1h5>l(rgLMe#%TH>;u++(Xj8`-2q&VSi_6PK$Oqn0lzT z<`d{`(myTvJ&-p@D~27U!zzo^4@q+w84VerEG7)lz|zbU;}`wVHM{jd`BMywWHHY7 zCzWu@ujRC|eBqXyUqe>K5iU(u|9ZCb&u#jJnA~}s%3?v!MFrJ@Zc`+4eWN1bQjXqV z-X70zu(wk{cDr&M)ILGpP6wH}l6bYW+mP!)r)er*0HqX(g|X?Th(DRHYYCnMRqES6 zf$r1vUITqX!}h20mfj&CyIuLiAmfuh0MBSEN56H^=3s9Tp_P?N3 zMa2vP%k3nP<@N!P+vhtzf!65dFbsJ@9fK!49hk4_ zyrEF|Dm|<(6#>LN@st0uo4q4Oh1|?n%Nj{Nm_RIUEuUn_ga?c7MIH*jr-Wd~$z` zkogBSyZQM)%-z&Ni)Uj$KImml%iqLlBUET6!Es z|AvkLIfnauROUk#^m|3W0oi(TD6MYm$wxrn)Gw|DnG8x;CL2dfKz8-22f9_`$tq%3 zrG6D;jP18Uq5P_mY{Kz&q^??=mI`ALhTg2@8G-k`-FV+x)`ekt-%>J@F__2h$;GjCrtk%!PoiCYL5B?|`{OB|mw)sL%$Kb(ywy$ltcK@=fkZ%3hth=XQRK z5nKk!X9Q)Xu5P_Yf?+2*_{rzEHpnyIOSo`?3pBG_*Vb6>PWx?Jq-t6JIqd1&`(N+u zz3VBj$DJ-*>32y(E?`o0nbB$&l>f2juXR)r_zmO<% zSjQ@y_FJTljm?_FCg5bD%aw_HW15KGuzO2Bx7zYcUij(6C5bpmNH^q?m?}xQxg_GQ zm!Cxa0opQ6mGc@-g{#of>zkAaS0TfE7hHvYFI-qQ5;Q}bsJ8_>iR>22=#ME3wiscx z`V>Y80@}p+%kcb(CZ9`ZK=Qd<#S(Pn*BY|5$Mj&4S8R;EG6J+&^13^Z5#Zo4&DNg{k>01%Q+1sk{?Nrde>f0IN z+Yf-Oq&I*p-)4~IyB=i3T5ch>w@-&}<#uj+TM4qa(w|1QF9sRez5(@*CFqZqj)s)a z0@lyi-hayj44Xi5*w)LnL3wdqZ>c4fXJw~c8di4XaA{}WY1$ATX`QUvwtqSqWSq~r zpkL{56cOAvbr5_KWYZ}FGEU_yA!2}*@(>PCpJy4Q_vH`q0ouNKEXYDiYnyrz5Qn@& zvZ6aFm(YhCNE+6omS;|7ld~r!1|H^;Hh15xm?v{Ce zAaDUtPkLMAogb~yqP69s-43K(@Q*Sl)1t4lHI1AfrGRfs6uO26{@@zNQ)NX9BSX^V6GkIOoEc8-6b>~4Ms%``&N92;a; zcF07^JfJ(NU_!~B>pb!cFPN#}VSA!KE1Rg~HCYSa_2J3?faC{bJcN(oK2UkR4O62p!j-sm->eaw*w4&0=t) z0Zo+$I?b=b?E6nwIxRDKw{06iej{uf%T}#M?%Mco0)tkTO5ZQNwjjEnvsC15>CBJI zHjsLEbD1PYD#7$^E|U|Bbmp683QUAPo>gGNca(Z*8HM*dmff+G-6gf{{8sZ-AHOv~@-t0YU^0-T-`<1MxPcg3Qg9yI+hWhdnlOWC>Zy(+__+!C;> zM1RY^Uu!(1r3O^B##^6eK*@l4iBT6Rm67obtyPn~rIF4i z3saMsgBd_`S)+b%U5saD`;RpNA$K$Ra#Ck7r`k9V@yDan-0&*rJd^(DE_q$KlcU_G zuH#TI!?Ha*_I7UivrKzA`sT#XIG$iUpUUT{>^<|WiXtQrRI5`gtMWK$zf@JrW*K## z6}P(iWBvr5jbcpz1*5l4&kONhY0+4INhl9;k=DNqJwBhQvim+Pe-vMX#qP^`)wwz7|iJo!kD6bezwA zRZ{cLML(=Zd}l65g{QD7@yMAVUAYNvc>18>~$O}*B>jDWw5g}*SV50BV8Wm@_?0s4D;%;c}+Kz z&E#P23K|D)&ZUyJIj;745bgQve3oOb+!XNAB-pZcU{S)Ucoij*X){ms?7}4i1r?^~ zu)ZJU3b1XzW-_2D;tiya%3umj&D(Pe?PbqhDK5f>Nb%LF!vMB(u#$G04u>|`GA}Kw z3&zTTE&0;2#xPtNDY#t5hCjj%1L~*?!`PXBbm-1}*g(rXj{t~3WpKh_*zgIfMswys z*(1t+##rdtAY-8ygN(1a31mBA@f2V?TyeCqeu8}aHIQ*k-vZqhm9Tq4Br==tXjm=C z_MHC`qECfLcH5TQ9U$Ye9tIhw_6Lx0YBjW|ab==;__&rp4jzm@y9P8(bGsg7sr(LP zd$qGz&kS7*GOlbX=%W3l%(sKAMt6d&M*Bl~wrP4}K~}yRkfky+4Eq$wQptiWU%9&1 zO8>tgEB*5z%i~p$<#8S)(`s}9=w}n8EFT3~jXnXg^!^oOC0Gu!0Ji;DrpvJ>sTuD3A0p|g8Wpn1BKIF`i&fsFnq#IVJORxi9Iw_ z=tvkUxrlki=N9CLW`fY+Wo28ol0Kt5pz1Bc z$g*YJ&X4>D?Bl0|+WBNXCvD6nHGrtAQ$0Q-Gx^Upr4bS!En#ZqKcFOOn^Jk_M=P~x z!s5z*M5_eS^0q0}*V*i5o~7Io_NCd|`OVv!<`?f)sp9Y(RINRmOi4c6qx#9qk0wv{ zJ1YsFOC`cRYJ>-o#^!xKa(xGgZ3mdb)?yzVqu@5lbKBGeVYYmT+`^WR29Qm=CXh`# z={j3J4yFri(GXFnrB@2FZE87a$^;pb=Yf{$@V*&j+thZDEg#%2Thi&Y^N-q#`1-~l zLhwe{!g@Nzn68TL`YZgDXv6td)}d!sUni_dG^3BDc;+!vXv{}-rQKr*e<37Zmkmug zwzo>WClkgiVU4#zt{%^(Vzgt*gI#-6*N`JXu~@YkV<4zywiyBVD%7@9_J*O$8DxG6{5^l z8hWh~iGR7KLvnF+CD`-2uM4Kk7t|DbPC?GDN} z;Mq`X#+~qsm@?yg5>G0b@0B(3wVS=7Le8k-+}xRe&8^e^HZ5t|`>DJx9aK;^ySRYD zCYz!4og(ZqzGx1}sv>HcxvC7~J(4Xb zQN%A5lf>JA1!3*6DKQ;+vFX>P^`m)y|D+af3Qd>2Kg~ZMNIA*1%cJ%Cbrno>`&aWp z!IevXElwn{s(?#qD7yPoy@!FLkw|^f-5>4Uzhg_`jtym{2hC341E(5pTh?r8gxc0b z!F_Qay4Yk$26fKy)n#$({>yqKN?eSkDwMZ(RxDKkM%v>VcoD#On_AN%z z?iM|T`(;@7ewu5{OHp39vB+EBdw2u4O*f1Y30S1JZt~jR(R%fgd)brkiV{{^rY$eDtgUv=>);~8WA(YT9_N^SlMo2^QMQ*`I`Ag)NMc7vESOw#x(iNx z7yc}nUo;4Bit3MLW=Rc;?moNsY_K#`(cOvO)9;;5WfS)%`L}ms7->%LF=3>C={@Y; zk7=aK`Iq1rA2`(=t%*@x3CygxeGTtaFG$U5HgTIM$F9{Pqe{MnGs0(sSt<1oq9r#m zrHjh&ZQ0!_O0zmwWo|kvlJi?xkJIe*vq|v)j!Rcf0j6ly3u+eTJ2u>u+bmx*tWw;G z`kgwx$T>E2%KgE%J}S(~DHMlpy5D105H_O!!N{cR)WlPI!wSg1(}t z19a*b2@~y}n-rCSJf+z$fo##30{?WIE*e*ZY-803vgPB4ppZeYBgt+2$x0Y8Ry@9M z>b#Xx2fC7e3#LzDS3-79`=-y(>9bU)&tJmn^S*HUG=$TqIh;N#b~Sw^;V`!F4bGN*4&&#>VFX9^*pe(Y z8W)`W+VV4y!(cs$d}X4vMG9og#-~BXYh*!tmDhl1q)s)CjPZX8>-?^{GHI4lqW-~2`TH9Tl@*O!KHqY?58@yg@6nVOsM8glvk#7l{iNE{~P-7>$R^x|ATi3MhH+WUZ8 zEyTXM^`mk(3D=5vPbB&u-&V*h&huHj%D0v=*X`{#_q;xFJcVT?r|*yUe*o+Hj{0I; z6{Nl3-jtq1{{~|iZ{ZwRSilI!Ts2(#c?*+zj4*Q?CpRuy9H}3Tv-sY^{#x!sZ|HVn zi`t3UaHmte=$4e%P(CN++_(cr@!|=6hd5>3fm7BU2`?GCLa)Dqx{Z;#i9h-C@g1o* zj-17zR(y9HpHE154~gG#&NB+7I_A9#-mV?@UB5TS=k0jG8iNOe?4nzwK>c%^YkwIP z^ygI5Yfj3U-tXe>zS3{w8p)xHp&f;Q%?!bOt*|i#PabIc@ma1FP*6bTU zzbfGL%oX*fU^6BhTL+!!l%p@eFD|KNSms<(3-2a7;=z2|vBa`X?KeQ?Tv{%LFv0!@ z8EjW8KXwzy_^~g6Y>9mg6!K$@d=&Cyq0{Ku`Jq0SW@JW7>1)gQ`a{J12iPdL57{Ws z5tk!xey1$DCGFbCzX$DA>a}xe!r;~TuaG9ZHI1~7-+wFl{kMSE-}77L_T+p~>i$2t zS3aH9_cyw1$U&#A%}c_y`A7L{a~8|PL2 zbtd&!=I@?A6zra-hP!9YMd6Mb#+syjo%x zREoToBY&qIm7o`Es#e#R4{)%!A8y8JTVyI+OH|t2(XhXqiMv%#H$0<`&{e{Kfuwly zK~Q79zz4d{eB+tmv42;YpmQ=#bWV=!6paFu9K0UoT@RrBwug0%i7pB??DJIvjujCL zN7+}$=CnC0&}#p=idI?+NjqQ`=f1q8GyXjFrgGmbWb(_sJ?g$8jHV z+POaOp~}vRFxB`h(v5pd%wlg_8>TV0h_3+G`}_ueL=6n12dsMP#f*nr5g=TsWaBdz zN$(GOh_bzZ>OuHnFfZ~5q7Ml@F&vAQ0lp(R371J(u704Vs?*q$T@Q=HM=(g~)$vLM zm7JIN{=&InEz;f1k{(jGIj(bKr~LC6!evQnc70-de~XlsI#)`aLsdo8nb5ow-9+)_ z;HxyzP!))1dDaHef`~}?xSUt2hTzgw@!y~xsaPs~S#(rBsMYHrMBnM+&WFkImr*&M z>IIG0RX%7#vA@FG+doJfN@@RgZTSBNwV_-#l;$eo^psSzAzD3UR72t21#(Hfs;#lG zBRbz)jgcxHTFMy#42Z^ez4u2`Q{EqKIK(?}3SZvMp@BHOJz13H_?6LHqT+ecuTYPw zOfU4a^uiiO6j#)=?7&-@j3f*-m_RmTeK+rOCii20*Q#&#Q&Kv&+UvfLLqRU1>#ugI z*HmK%B=38VnB1@7F4smj5>V~g3mHq?d*e3UFwTuQ$xR2&92ZL*xIw(xfhNx6#+$RZ z5}zCU8X!Yq0mL4Hi7`q)_R_@^bZtG3MljWkwXsA5ZbhJy=2oQhjrhW|`QU4F$|9mg z2#pMafOYSsV3+DJUk*wrjS&CI$7|T1K?hBc=};i^PEizOUh+gW)x6}1ZN7QQI~inN z^3DK-w&kTHq;xb2sMECVf(u~-RO|WHM&9_%p?3(OHI$xGUCbpe$&Lf7i^E%lieoL+ z#bfIa2%RnsH5E;gl%Ms!@sV3X^Y2u8Bje-zVaCTll6Y!ke(R)Pjg2`-wcNg@IV&U>o#AI#+XMeJu2%(j0X!*%EkRNIv zKdgcLbcXwF+8;APX17rXGNbt`!Z5J{vQ5gDL1xSG-4N{&qj`@Sn8kv48VYIm&W+~3 zMAW}CqxrxSOJFYl&uB#d16}TiGopWnLGxpMD>f%)r+@{XkHmJtEEa^*G>e5JL1wXV zCTOXW8S#~977O11nZ*KrVa3d$GcNnXx_osEu`^dKS=Y;y5Cuk3uKB1`M$+9%IiMc5 z$r~Z^l~6tlThd*jVKYU4!_+K=^5Wd~73aDWg&tR`{c?C2^A9Awaq!EjH*8#G0=jv7pZ~SKN?K4$M6}uj2O5i$Dp-CtW`Jm^`5?Cby344 zVvwO;FftxoYq47;_GOWpLW!I%TrKerNQ+v9G(LXT9{O8T*o7eLG2J?p!ryqwil!}W4eJkXy1e2w)FG|n zFtOYzC~g*fF_4!i?ZntXyH~l{QrV(;PhzPf#v*gNM=hkcUkQ9wO=p|cjmu}<$5cpa zmv$aQYTt+ob@mcRb-LMv@AXBvWLRbD>Z_+Od2R~@%^y3>WwI$m+!O?gCk1gRX`U3; zf_wvC*$1lwUQ7!E12i1)V$YF=pKc`3#qL~2!E>X+#og2cwZ}us&|J1avdoSqDjVwN zvPK@Og(v4%$1e(uz+eco*)#H4-HKVT#KFPB-Gd`^NPwgwZ)BX!^~YJTuICrUd!Obl z*O*jYT2enY@T!1)bKp|pf3?1@_eG=BGAIZ5Q_yTeyXI?#cd{$St6B`|qSd7?&1D0N zN)F4V$g(&Eeifvad4qoV#IwUDzKl=tL?J2A40)CAEu^bl@8+$%(K1zgTb36%&HMB0 z-7I^@Hq`TP5ieb?_oWSl$~a`!UYPb)^zbNR0hI|ya<{?FIcw?V0eyi&%v?$Zmu_G5c7K%hYW??G2h=rno-qBi&#EyqXIn5Di zm(Pk^Lbv}f4r!MUkI*iMiha{Skx8y?@|q=IWHPW>L}X&kGD3@}Z0F6lhzV}2MR0X# zEfR`KaCNC6>gsZ-tq=Y}D$ee<&@TDT?tI6&iHkbbfNQY2n%!lBxN zE$)2mTbTtGwjE?CAHsw(o@6}e9xc@qAd_so4l?P`Zy6INF%k!=7AC%CjTAJ4j1-9Z zF@@d6UxdUW^EJg0LIZ}J%hWV8s8|I=7Z^QgIARE%c zW{=e&-3PKET}WDK{si?+e7CY&?<%V_L=f`Ir> zR=055iCV+$FSbfEAYV*pS8jlQ$pm-BAd&^Z_-eR?mQ$DxiO_YG_?4F^TwJRZ4^3vL z+4t>=Yo=F8I~;V)WsTGgu0fcyJhq~_Oq{TYHtqvu%Rs_dEa$hM0iAe&6wo^TZy|1X z1FgG)QB7I{bC6yn86CL78;`&`#NjPu>_~(S{0?9~wnzYp$P3A~HORItl&^e;|Dk2s75}k!EZk z%@}M!mOLb`2J+Oq^W4)UhFn0_HtY^%-QiT;XsHYOhEDO1gKQ~i2H67eHIPx&4Io=? zHi3@N1?7K1w%kN1q0v5BJd84m|9M-2#M8i$`o%>cTX?PnRY!$3UkkE)Wr|t8Qe&g4 z!jM^dX{v2uGeMS{=s((G^gYmo{UyC;Kwr_6C$WTlQ|l(KQO#HS1!36LAfvQ5gG{8g zEJXK!Lh37x6jI-ZHASdzV}58zlZOlSK39<+w@phI3b6-M>bt12QR;7j!in4>DR;NX z5=RXKdflRKrn*~}5hVW!ZRKZwiXV{d+|&scH+9mOOIX_7NV24`Gg@pUTPLMO+aM+E zZjqHh{sYP?Lkk(n*4No=E6-cyeQur0yBEW&nVV0w^NM?GBi{^9xLf2E#8T z8oMoAFC1cLKd*Ea_rSW@<$dOFeLE3{^|#(ZiOlp*hHuyyOu;#%8tS-A!7!2IY%USz^M~UrEyqZQEMZv5~&JCwra$aW90-HgNBn4G{ zFF*V)zNd{}?h$I_2lw&I_~EUJ8F;G~2yq*Y1PfuC?GL{|HW6m2!Z0=NvKX>2gf|Wx zu8+Acl@p9*HML!_0CMSvrj;vBSm*)8@@|zSO8Ef)9-&5g-c|blNy7!{4`__87Wtm) z`jwmfcra7~+OL~+R#6)o+w`Id;TC1mnD|MA5rg}XaXUgEZhVt{sO?QJDN{eB55u>z zZ0trKdK@a_nQ~GrthulybmEY1&1w&7l&Ev7PijaT>%$T*2kkS(w>Tf6j& z{|4CtE40jV`z^?p)%P&?jrR~g1(u39aI};^AHKaK4Eq7dmfHJ4=K6gj=nk##c97LW zRv@d#u^_9*2_UP7xOumF)PgLxPlBujH-W4kw}948kec5PvU+?MWE_^`?AG?#szcWLLY)&8TLq~tyR>%hk^4t%_I z;G_6M%=`AX++)hQt0(PEi@FnMRJf~uRpb`VDB(CJnyTukKT1cSz)85WiNp)|ZthPu`(wWYE$IZuUr*m73p{LkVz|JXFfq zqfvg>czrC=H9Z!oe+N32(XK=khDKV1ckFapxp6yl67LIkbdIVY*YwP5TypG2>K%UK zk$O%D9@#39cXSrimk?GFsV^RK4RW%1M}0KdzsSLKt0pg3t=8&Ike6KCc^X0gq3rXG zJqM|b{*I2&7{p0m=33>hL^3Mru;OgJO8?70X1gE-K65B=LJ#s~PFK0(b zlU1a5TmV>#Ed(=Z1^S)&Lc0e4r`PP%5t=IT!5&`Pc@nAqL~EZ0bsr-Yn+1AEk+`Z~ zt>|MCPthWfo&9;Bz<*kv*< zDUNst$9T@TF=xfWV?nL%*m&zaPBS^F6wN~|w6r2qFrI6$p0L5#SkK?hx*t#a=9h9B z=pL<|w1T1YL$m;7Z6wpv>V7B4ue(?5O)cS2Or-Jkg$w{u6LTkx;?zoOr9sYkyAfe&~SO`zCSK) z`{I~a|MbI@wh;SQmF zZqRWh8~lZeRLxD+O1PwzZM2Or?xiA=t9nJQ1v-zjjkR)eRp3^wcWzySMmPhclJ8j@ zuv8ED?iqRU9u4A6^W%voqz;m)eD-Qo#qF@aN5<;p;Lw1%Z^-FpvN7qBW{j(1s6T!wn#l#A zP%aOHD3pp@I{8=5$%WR);>zBL8U*B~bVp*|sA{?O?8%0PrdRqKijdP>%_>elso5NS zyO(jr_8EHqeQmm```QWpJ={^^&ES2po1MyaCA^OpRJU@~(6qS;uZu;-n^xjxuVp-x zyOUmXoBB(yNixXz@2qS0OJ~nGtM?31EAC&Ms_MVyJ-$px-3VMM%%CXWa(1gLEOWrp zlJmLp#Hvy%$%-tVgKgHPWkUaq@q|BVZQoRO>=|zM9LhCgF2yWOXO7X*W{MNs_RRtQ zq(>5k>od_E)8-Y`k5dQG^w+e?bVhz^yUBp{kx@jD_rbYo8!Z-* z37uA3or#f5f!xC#uXnhKxZaAR1tG%hrWx}J`iYv~S~L-jwe0{J;0dy_h2u9M^IUjU zK_s%+ALhBv3S`pg2Wp2o?Y~C$oIrTTqSqn{Ov%a5&q-8mY}lWZ@rSo9C1gM+7T07? zsYQvwY0mJfrmE}OW3yBHr6`on^*J{kNez0Ztdi$+)l1i$L_(|ezH;eWbQr8_ z%@1{ue2w>Ka?tK|3)y>KB>F8jPv!DvnM}2Md$V-4Hm|5p)M69EVkVI%y+Wr`g>&bo z3j3&3sk@QGcdH&m*E@T5rgF#GbUD|9k4a}}oU`dg`Jorfd%5qKXYc&E$WMvjPWq|4 z@nt_+P4*zSX41yg##gl4<%1YW6-bYtTd$YE|IF|4vu8J*YdxOds?w6us@rzZXc}`} zA#G$mFRf)g|6ibt_PkuiG*{7p8SEt}qRvFREK!oKid=UZQ?~w~#ObyD_4~=dXm}@Y zYWt~I0!5yvyk!Xid(qb7$sIg9)f>DuvL^InOTrr)Lw>q0A)4-4GM4HO=HJ@a{ghAO zU6689AGKb``73q{dAF$+zqQ&{D#gzTe9vz%=yEC3Gy+4RxTU$lM zDzm8il0|75JWjJHk;rN_&z-WcqJ9Q5szlk78KrLjTDZ>gv{%%lvhwnjFqja}qV4^0 zdJwiIjo(L>>GJ!9cjDyz=^(_|=Dr#h-jC z!}au2+|2dSMAzA|f}cpE2|xKh_{n%B-_^6$!B@&fiO1*Nk%*$u7=|xL>3VOX9;MR_ z8de(>p0g5Wvoccu9wUsZqAyYH+&N!G|609bF-Hc1o7814%@d{QI<~Zs=dP6ZiPDs} zkcN0BaY?88IP6ZQ8E}hj#N};ePoT24U7bw>+t#!dWZND&OEolvWaL&MmTB&Mf09MV z_4^abf_tAU2)k1{*!9NtaHaCSGDc9k zXnst9s)4)5v(;cl_xnDGoc{mReF=P3)%Eqw%}WR&@DgN-ASQqsMQsGCC{z<5`XY%& z6pM32#MCirP@F+Pj4_H@t8LZdRJC?cTa~sB5f#u{i}P3;>rfE~wAP`m@~ySkz31MS z_mZIP|Nnj8`6chIckbT%?0x3>w(VBeHXC>MZ&%lPYyk%fDD_>aiXif2bCX~k4)Hov2QlveW`!cemU?5-;i3`@J-_H^qCGybH?)2+>P-;>(z?A$(0taoT}7C(DMYy4Ir?@Qvif82p4Yip$JmzLDHb zB`#S2{in6wd?CJ2-Z5v$X_fel;&KvPcr(4D_gjAlzc}A`e+R$8e+Rx<4>Va2%iMxw z__pV^1JS)6g1M+bhc2(zm=M2=H**^l*DCF0lR>!YFCJn9U~+N|Rp0_;d~(wC>TUAy zV+{UG?`)HkX%@y_ApLdTa?Y3hh5@+Q$>q?u>r14AS;p%2nkVrRtmM)`NWCB~+b%vI z3|=bt@r|!nudtChZ{kIwS*={f*l(!O9eHKpF-E>HB52#!y#!fxeB;PI1@&W5NU!4C znD9c}<@hq?;PoOiRLpDLO{Tz4NRw*YzaYlH>t^#d+fbKt>5F)zlVR(QL!BMY4u-A@?bMOos4EP>VwCG=W-3VWx=$edmoO^Tn zF+!b+fqv~*S#%)2rDH6T@nT?mHfbp%H@Wy|N^Z3u>ka~r#b4W19gNiWOIP5lOZ+>p zbz>-?{U`LujQ`PL{5y3`SG)BV%B}l=FFA1upu}}QHz7SJNK4?~EHT!dhH}PoCCM{(oB^Ptq3h~Gv>$v>{v-s`NM0UJ#p7-5|I}SAnORh~E=Plh6%7WurN2|1OZGiaFz?iRm8$X=3`PK$?zT z1*GX{4#qSc{S}a=qw}HgXp@%&(scBeK$?!``i#Qhb^!6t0g}AqfTR^SooLei0Y|sW z(G5jx=qWeZiFX$uO}d{im;BfW%a1Q`6z}Ok;(gEgedhcopv4gHUO?hyDT8;|04XMa1f@qnb7s-+|omK-^MuY>1HkNElIV`D&q=6 z*ne-oHN{$Z;d={^w&?t=z-^zmh7}e!x-DryhT$6)+TO)w?6#o@2g0XeD2A!6MBOAz zBdkQW4Ouv?Ftga|xZLE$(}7a$)+@3_WOVotOt>&vb8+~B@&n-;_5zo`0}5~i~i8w?QX&th+ z?%omDhhcHR4(wVmqK>}1!vusY+{x1>*x8)+<>u{<=w#mlKOiPB>#M}q-H5r>t)Na8wm>r<`wcax~v z5YY8)^XJ{27AI()=UZ&WI`vAo8zMQ+jOvM z$#O(xJm*>4-S+&VcX1@)b(D}r?-nE%bGd2JKhaTq6}5+@%MmVJIEm6@x}5P%(O&d&FJK%zv5|Ghz9EH7yb`fmzccTnt=yOh0s7lK0N@=b}!m#0|kX z@%~Ox>Zy0?j@n>}@fu=Sh2+^NuETAcQLYVrlJ~BfyQnj#>eE$zOR*cMTEed%kp3IX zgQ?^+JG|d)*1N}{u<@Vbc*wc4YunE$s&9L{PF3;TuTbQ-3^LmsE;);LJGPD=tx2c4h<8#Z`_j9vg>)keSVY36p_|0mw z4Bu53-p!xLpq28yyNchfck?HDsT5`6qBMwtScY+d9TDWDV3)U8EuC8k5_Ya1pyNb*&QNmgkz1WC;ssJS@@ufJ^Ki#~|kqqs`7U)gD9SSAgk6tk*4q?kNy zoV8Tx=M%HHQ@0lc36dV?n8#}fGYx`e>RA|6A&$e`v5a?WHK%y>MA(U#R)h*C@NB|8jMH52^)A;|x8%VbgkaOkmdPJm}TTtzL9a0a{XS zskW$ZQ`F}rFSc|0K@W!+K}StnqfYEm|LakYW@jdv1lJc$@2B!l>5vmbynbq|h@(kE(<(z^#3JZ0}6tkSDHyY>%2 zzbPGrtc{*}Hk;B&@r~7r9oI-O<*`f@#2L5u#^VM@8#CgDksMS*S>mSo|JS&&+oZyX zsBOQrEUdg!ZS4)PIlhyZ(-v4>!&?F?PThcyvpVAoY}l2@z2O;ehxpGtmsu5s!$+Bt z@e=Ax&nL2ajz!{Ws*+pcGzrCRVVWMi2xylAPFvjqq$#go0_{GUe)j=s^6OO~O@46~ zxF){_A?s-Jiv_IOIJN@P1k{z!D?PZ#B*+h1H3RGp9`njQ$ zK0wlRe;{efB_bj250<9fKc{f>P`@bLQ9ug!WFUom2GBvH8RO>zDcnnd#CrvhLi-Dl z!l*Suvu^;3r)0FqW; z0f}QY#&puE3P@UA3M8$r0@~lgT@ECzehwtwJAoA1mp}?_A9UA*<^n0SQ-O4bU;)ro zmI@aENy_hlq`@0N(qIC{;?iI;kj^-yfTY2JK;k_FNE)03r2KLgkn+n?AZc(JkTkdj zNU8rkkiy*vq;MOG!*FK-9cY%%0aCc904dzlffQ~VkixwRNa5ZHq;T&5Qn>d4=?v!| zfV9AnC&Z8A@flW=QlLT4Ph}@ngz@_cvFC;|4B;*s(wE zb>e2S%2fNEYY?LK0x(5Ufk~Gq-+_n6y=xpSE<88byLKLakRk^&6S?Tq;r6Iqr&gXa zbiwaCNIwso%rH|OY$aO%O5okHZ72|IwvSn7zO<3q_Cb}6e}CQkkPzP_m4m>z-MQ@r zT$h>3nTq|!(~Ge|sxq~)1HqP^UTD*4rYV-}v4!gKRQdiDskY-PQn|-frrI7&jb2&T zKH*WS#*J0AizerL^9KI53cmxc>BDMU69e4VDx61|I;^g3!kY2#*S4OB4TjovJpr1| z+XlMeMXorxk6m=`Q7Mi1{>lX(Lr>gjQMNu&+qw@XM^3^{MQ9pCWN0_0L2dK4XpO3k z=i0|V5$I#H$H(I);zf^C@txKWn}6EAsy%K0TWnty$I9w{RRi5<+2uSS9n|6}nVZaS zJ(%y{L9*|Fw#5s;qV38cdM7*Ml4<*p~~#CqEyY|5^LAXgaJ99mW`i~9!qvycg~ zXWVxDVsCkn6DzSjl3B0)w`;({nY*$e*J;4OTvv5zreYeRNdIJeV2VTyy#e)FvC4H z+|(Cr!Q{5f2JK149{+A~PsV}2aZp@&=2Rf%nco3@Y&m5EkaEfdB!Y6v`9R7a?Lf*O zKXC~8V-}cP{%~u%WpUpw`2&0SadVkYinUdjacdsRIP%D@)x}+kd9jN5FckA)DCVGL zF;BHm4vRT9H{zY6DCQ{y7$yl~I)V9P)*;v**EYQv`*gY676qQ$D3KmHsYMTg>WqnE z**LX~qgaUN@vo_6IFN>2l03_S{kF`9xQ`;mX-`drs!Byxu3&zy3WBxma>rx#nEP5$ zq#KTScn2u8pnyf@C?G{G52HP9#pq?ABJ{0Lpm3UsbvR@mY^*kvc_pwK}u0ChKZ z=>My3?B{iDAJtBJ;nbp3?#fhab-}tzAR>9eh4{o-hvF3WpH2EAc>#SH$CX{C*q0gI zQ>nI9si)peja`|VwB~fo?@lO5P5KOT?4N}d7-rSSKV3g|HBMjEwiop=`)b>UV9!%M zvN4XUnh#%hjrsbvXKLL`=@}&QCF)B=i|$8X#J%zl*N)vd{%NBQ?gDI2Y{~7(>(`p7 zCze7pb*{OuWf{7F3GWv`>Uuu_)K)-0W;8wh9H`y=m^jD=?^Q??BGfxr)l`?t>rnZ! zt>g`{wpx?+#zW?Rp22DR!bD-pXWjwa5`|4))hq76L-S6xUHT3R0O!SVX*svbadP~3 zi}4&QES03IUP0kTjgxT2Z5NMulcHPut(sbpvp#`OgoC~7dUavcAY3!1jFNGi2)>SZ zxEM^T>$e8Fs(>-TO$myDPI*>6ecX5Ph*C6|muOfE(nGX&p!hT@IviH(orpI(m~jdz}6r#VuKEWv~8Zy0U?31Zhl)9-6tp!Frmc%$iF?CkmQP5y& zRb4K>%BGE7Ro9C6hQ&rdYg(&U-`a0|pW4;AmMSQ?IJ3#x3sk6vYF8th!qv7;Ev{{Q zSQXTPpsKV)KyiMF=K#{ufJY1ZRmanSHCizfVuv6hIHO|}wRS$qQ%c}RRhSaBmJ+o{ z3Hah*08c?pOpW~$&a*HvX2%nQ_ue3y*YDf*aF7^m8K_q&jtZf@T(U8_&VE|Fp6a+W@SJTBuL$)$4)K7D zF{UY!<0))6LL4zgNIs4UvIBn4N*#rWq@Cy#Of9QxPwa=Qjq1kY;KS4^T&OB8rAr~x zMWqF4QOtBfwN)FGoLZC|9Bn+j`=ZlrnX1~qy6vU9Hl|+nrw_U0yNgBWX{yWgbS20N z-(qCvhY&$5M!&^(JuYUd&n+Mw56|G>4bt#2mL?v#X6UprAO=BAX*=5In-Lfz1t@bVB8L3+~TgLsT0S(fT#j!z`-RbiA?@j%hveK zOpY&Ra(p3^Ju*4T8JU)u>s#Y7iYz|9qf2BSf>#%Oqo{c%h?+nA=TU>~iP%Xl zT|iN38Si8lL&tG>?g33M;T$WwZM+K&@*r382^s=5AnP+E4xZf!lbhvHF zc}QtQLQTfek-IO%1KZ5e&CwCNlLm`G>~BN|EZor%+c3wjOVc|HBHAkw2F=q!;Y}vX zjD}s{#}u#9~ub#$wYESZIpvy$Tcv?=8aHk}S-$2?=!qqX~)Z zD@WTv1NB@RfYduY0qCj%_F>NiQa|xeK(Cu02Sf6E14!e@Pk}Ts$t_fxXdexJA-XBOy2d4tv3^fwoWk5F=;xdq?Uw;ks6XUoKNYkKy0@4!FD?kdj6G#)H z+anG&0XzXnk|zU6GH+|v(<|N6UjS*k^a&tYnLusD>HdVrz3Z~K6iD{Y1p2_9o(eR) zFX?}bLZv{# zwR%|(;bQ`p$>>J;o113c?Dp2}W$Amh-%;DZ*vz_D`wmD?-peVvqHs;>2fhSqtrtj?`zjOwfN<~3JcIIj^^?E;94SGCLdyY+5*QGlMSyfWbJ1uo%c0jFiZlm*4t-$Y4uF zjHg|>>MjOixjlZ)U;z`ox7>aMh%6xFcFQbCNA;0{q8R4#9WrzI;MAg(+t~X+#y;fU z1#&=FX*FGPIGR+}Q1K>}RT-MphKwfFE`?yTipnNq|3+5Nu@J4cvIUv{%BemZK&Wy=+d5-xaZl^0+bfD>OAVJ(Adt(qOm|)+~n=nTHHJW zNV=R0Bwe_PTe{o30l}V*Df^g?qR2yB|netp!p%b0dfP0mD!v)Ryny5L)U=WB}KGpKc+4EniMh z;~!T#;m_XjR~EL`=!0^W@DLNv8vjZYKNRR?1r$w6Vm5N&Lu>Hl9sFa(ao%1FALO{FBcl)KJ)eRGzh_oOy8M%~f=vJI(lAeg&4Z%wIM$2j62GZj6 zbfBBekL5|do?{&{u@L7yQ^4em8QBnaGPI7G;#_kDUTau~?s^R(V9C>G>{b2Qi#%pu zyYcZAe|+MJC#pZ|eCXX=yvwws({C>-_8*(J-9yz2Ix1@}#3e;5G2`?+D63cbJFMS@ zZ0=CQrt@>sxvUmbIGBNk62Xi*=aacg5%l}H0CC8}ePNX9mfL~$$IpcKd!S&pc;S0% zV0PR_UGB{b{VL{Sn2tnlU4wkYi3F_c<}k<#R_b`CBVTHGvE2pk!d&YBxJuT{IIx3w1=zu2(*~*I7P^5Z%VKY&DJWi7IORDYpPb)%tEmWo5q?$ zaXUjJe&ZlUP1BR85W*36vt<;=xMWsb%#ud@TD_zRpL7~`H!qAnw$z!LmyD zZi7CjVG{UC$?xgi25G8*omSK?`drs5o00A9{89w_*NbT7xK&n&U0Q$n7z6Yc_)rV?A{ecw5Kp@qXn*%Ad z-GMH)GR`@HMTTw!QVkiKuZqr)R%l$Z9N8osmrP4;TXl83L|CSD#3j_pl9~(oa-;cpnfi#isA12>{Yq@Cyw;ip$$JkNbMD-Qk9%dT zcF#pkK7Y|;K3bdkbEhTG?ZE6*A)hAf>D=VGpTlRoqi8+nV!WdoZ(*KW2V#yQE@W@Q zUW|bAQ^}?M@oU|W5ESBhHD5ba1R0b%B9LJRd*e@Hyg1^3fntck5f6%5YT3iy7fk1Ph)@7PtesJ-Np8yt1=+znKg!_3wi zv?rLdEw1A|SbCEck84+Pp>;kkNXCG2BFwNw)-rr^F0O(UWwn#mw&Y=1dVPOv9BIJ% z#A-HC4N6GJZ{-z4_G{t9i^174zV=feCGA9AKuL~U0xOWEW~aKxQeNv~tsv$F~A1ZR*fTrG;rn_{!V*xX_> z*|_)T0$#}wrsf?v>#q9(=^0jr;a&6@9#3TWWOzJbWkjErGcJHyc0MLNVT{vns7!=XSyuhqUm>KQ_TZ!!a@`t}itix2;OC3M_u9}BY&~(5ZO<4)-zkt| zKRL~S_pk*88wXK4oC(p98icr(vk|i-tZTevpS-Swq3XBp4RlojJ1bWLsnh%>&|BvB zK9Htiw}cw%gnSF=%~9mw&422w91OIJam)i!H)s)%IzQ~9XgK!}kOq4%1F1vwSD?R{ zy!Alp27LvjiR!+HWre}Fo2f&@i&r$b<=|U`TTWT48+0|$4W`QpsQ9?cJmGx;besA4 zs9!ZeO**tCkiwV>Bs&fVk{!nb$&QPGWXI2dWXHomvf~dx?~Y<<&jQH~4q7GoO(1Fi z4j3xTBlWtC1zG_GS^@oCS^-I`zX2(BKL%15 zp8-j~DJX3kn(qxHc|Uf3Hv%a%UdJe%Uk8%T9|B!4nsM+2kf!K4PS6y6A&{o%2Lg$1 z1d!-PJGvbl-FTp5@SpH@#ph5<%YA{)wzQlBq&Qdrbb|TuZq5@8T>0FdHf4bbT(<&Qw(cm-%R{uAEY_}pNUKL#o_DITbQY)|_Dttcm5 z36SjF8ptg_G^0?h!#`Pqc*96>Ies`_h5a>sd1S{)2zE`kU&MphnZDUVvtj8h0PUZ1N;R?KmdgxQY=|{K^Z*#YaVzm6 z8^!CAUtySs#>%cL#YG3Nv}_YosHdw+A+7>N-;xWR!zC}_NA2 z;4;KA`n8Ag@q!1-@Z}{J@5^T~0oBQSmd+=|D*MXecA8!AJN;gYR6ECJ?5Bs{-0_#z zMLh)B1YI;NcI^k0YCUYh>YA$=W;mL-21{AXF&4X(nLeEVxWlZ#tu?mJq(z%)t-rVx zd>V$`0fbz1cL%;#*|q}qO4rKw{!V^_p1;u$U#KkXn%w$8eEZA=X=5yEhe--jXLP+x zRBv4`HYOGpR7+RFT}|n3tDyzGcDW9U35?qcqhv#H2G}-vTF4w0a3_lWSTyn6pu3!0 z!b^^=Yt)RV>NL*<3Q`26ATvd#|NoyNJA_g3-%62J5hr01XHAiHtfs$FMe_BF{J4&F z+|gsndYlRxR^pC~3L31>OxF7U?PRt1Vi)*-tl+%}JHu4@uN1tcF@af=IrD6JGb{Dx zuq|0%6t7P2z-DEeyNOSvu@S~Z8g{dtT7|2mQ(2eic(@uzrMkY$I9ftj=BhP!(MdFN zXs}3GR=s*Dn*pvsM4Mr7Vmgc9te!g|HZ;iC7idEPyF{$Nv^(T6pbyQDCo#1D<5xhU z;{f1B>rU+fdv7vyIFN=Qyd3qlQIvN)kh*{^Kp)Q%DP;Mj(ZIEKqPv6iA0OF9A}z{RBt@%h!O^ z4PFPNHL8z*G!*z3kcI+2G}n-!2uNM%Q9$CLg_2U|P}h~dvc61B_%~T zLNJyG2)F~Zx(RP_s>LlVsYxqO8;r9xP1R%lYQBBJ-VTtwCntE}KwaBG6YJahad+;% z2nVtU;tezVVe|f}dAQ&u$D{{4*>^PQ6_gIKIAOE0cG5$qVE}>9#^z$PZ*{BfpiZ@6 z_mdaA&FA zY9^jpIuHBJS7K>#8b=aq=k7Yc?9{%zD0opv@%p~izlC)8cOcwp6X%zw+5WsmvYQ;>sywt9H;^Mv=!ERd_xH+Zbx0U$$4*tDmb1^ik zYn_i{Q802Ac1zAGp1Zng75B(Ze+y#-{fHW^z1Jz{7Fpoa`` z#PEP2<{g(~%Iq3c-hW@;_BpcGx#uzQQmOWn8+cr^D!C=1crTPmI|zgKLFA{7Dp>N^ zx!a~Dy_9NOpGwx_JxVz1_2@g057PY9*gtQJT#e(hM?IR#$yp!1ETUl|3VX}Y>I?Hz z?WZ@SHvZxM95B@7{sYN+-Zf06DjqLM)s6iZ(+vYvJ71*K;w8trRROOs$MBlx11n5( z>z-_OCO9hIvK41qOgkC`e^2;tI$ZosxN8P z6+B%qi>5Wy;iHk`_OiOMZ`5MGV9_HLFzwL84|(`FXIqa6lf2{{5Qd2}%Mu4EgGjSO z6-t@nB~LSDa0ZGg^DYi4hla#brYcAojJA1R6hqG;8yki(bp|0>kUF#CN%P}gl4h1u zA4en(2G-qMiV6sQVbaqwe3(CWywRUYTHknb${2SX|$wauA9a5Nl%)?s}D^}o1pNq zTyJB=i2ERL9J6jr+5XtjiVO)&Hl*6Ewt>nzCP?#8E1`fq%*~}`;P!Yxxvjv;%aRUT zhD)Z{icQ3h>q8!fY@4!6cvV1?P%$LDoPl}Xz}W+u`!^Of^kc0D$08BBEBf({Y;<)z zA=FRa%UCka^>XrkFMphGJY4S$-S-`b5IH)sWL&qgVuCFq}DT8n5e&jfW$dSMm z9_cY%5t8Hk$BsjY9EHYFf|jOlEPDCm0;4Vh8e%j6wyA{Qbk{m*LgXnnN*5-p)l&0f z3p2uyPl;Y53jhzg=6e1>Kb|$>Np_tJLWn_ZX;N}}$QnO!Ttej9N?f@0D{(%4!hK6$ z_IbVI5F*Fe434rG$Bm9dh#WhKBbLqMw%p`6gvhZ=ueRLmxP-{{ogOv2#c>FcV``6@ z-Rd}m$Why?X16&mA#&~8qh_}|4k2>P%o+~I^r8E?;}Rm*AyGI%rY#A{@%>B3Aw-TN zBaYc3ZHRH);W&iIaZJRKC5*cqhY&eV5XayGZ*U9#v9K{1mDk{LC7leagCBwWjpG&~ zH*e`d(KYVA;D&?)AR*vx3R&@ekK-01_Zh}rp67dc2$L@4;8W4D;0YB2iGx(X#((It z$v#iA1CmfKtN1AVC}{r4a3C6Ni=k0r)vN>qmree)k{?in+AyXf9fTN`$dQ}0_Q`C^-X&k_xP-{nS6ng8_JVKdo^l*Q^Q_|#B1d@!N8Fa@9ET7&wuv~h*z&yN5F*D8z1s4E z;}Rm*_$ZvfmObDbx)&XX5IJ@=j?!)WdPAG~dC3V|qBIQi3Yz;g<~M|Vn7#$XteAJ9 zNf-fCV|=72^7$$EvI{|oA?#t46(I?8Fs~5I^*9umZip8rdS0Uq26KGMNSW1-=k3Cl9+c_uy&h{^B@=$T?S>v7ttJNRIDL$00mA1>M6Mge#fJ6k5F*E| z;z;IuN#w;O@?>&GKWl&j0mixBaSD<1m*R}2YCJ!_=QxDO@tX{ecmwpl;}9ap?~J3Q zON>(`RwK$i#Xzf!j{bM>BXA!&i9(dvVU!gi33Je6=EW-N2}6D%pH}(!;O%fI5!d<4 zy%LL}B194D&Qlacq+{?>guTk=oFY8(5xS3@B0^N;Pnn9m=oEP+yCV7JzW;%@n_prh z#zKr3F=|AT4W3cb8HPnIqz`NHH=RCQYY5%nojyX;=e10I{^s;~H@iNGHU9BlNlCs2 zS*P@GE^6%85C)PSF@JZ8d>9ho`yWmbAu95|QKqHPr{={J`od7YH6m-R5ow%2c^ynG z%`H)e(hdEcz%Nnb=b!JFjOgo)XesqZ%o*m5m@w2Eku%6EcKWK>Q`E89^I-s|Te090 zOUloj#zGA3-CR2LB9Bp*;znmX| z`#T3iONfj17ap z_g9Wbh&+=N3M<(uBDIVdaBXxPLgc8<&?_DWqfE`N5IOMjYxtFv_4CSFw(!d4jPS}P z4EM@%hIlqYXb1ws7qhA|Z5h!1#s}ct6U(%me^m%V458jAD@aO5>I2P-nf4$<1DPAW z?f6l(Ge39i?t}M<@P-A?J0BT6*F#?RxCJ=Z!!(4qjYY{ops9w20)5vIl|RZ*InYUl zwg#GSXnUYalTvVr*Viw;VBlqbagb6Cc;=PyBXA0sqjDkIc&M2XPutp%9N)PvR)okg zTO5|Jqw+I2#>Eb-;!=oQO~z$2adR{i7jp2a=)e{r5CL}BBT6(oK&si!&Th8p!Qqj>;AzCVqu9jw#y`Wo5qwu2;B)6-j+2mdz zOJlVgm#Ra@wnXVEL@O`O;Mg)G$9EscAw-VL#nGicJT}Hv;JAdyb+vJo^vn19jqB5y z*PLj~ZBR#@jCdI9S=?l_^yk}+J-|Nv*(a};NS}KmNmS&UvakrL6;YT4zZdXgQ$^BfG z#^!75pjYTNb5;t`%CE#xknjpFPc-K?sumj(vfz7=;}Rkl-^PIT3cOTh$R`EffH(VM zt;PBrUdRct0Vl^b;^eqSoTR!0|DnqkMxnw8NJ6=z>C5XmUb^9s+;?~LLNRSurg_DB|eLN~<85~8dTvaox2%5fcFo61g_Lc z7NX<{Mp+S(um$^$d9n4ZGUQw9xq$7arY!Ss^~U+PW(?NiGl-kJpoAC{UpIoLp-ZP> z3Z8^+xZ@Hc7hg>RE?gN@I-$r*tQ76ZAq&2@a9l#<+Sj;BV}lkl@QDTwVDSzy8v2*= zBXC$zL3m6wA@a;L%0^N!g7}UU%)yNaCQ15Wk_7WfHPWLj{Xp@_o3-&PK)@&d70Bfh*~roWfPD& zYH^0s;_R$i_~ZPZ<9dk;Js#KPE_5M=eqLtieE*Cl)!VX%KEm(a{_i^t;`Wbn8VFH? zOENXM%4zVU>>7;oONJJBLk}3}4Mm9>de>&1CC$Z+5N3|KK>2}{`HfDKYZYqAIZZpK~P~o7Jx#9%Z8RX{lT(9sl-=C4F^sn)L8ty@AAjf!q1Wr86 z@{-J#b=}g2upF4wsb8@Qpkb3jK?bHB!rt?R_vU!w5M9?@;@ zVo8YMzhsmXBSDI#zd9A(GQ?O~Z-}p~@VrJFQ){wqL1WV|>Bo>}YG?!WT|>+%$`tGt zsQU2p^BJ;5@;fFoh~#ba7|RD)EEiqk9qfNU|LuZLidH0Y7}+xv*@uuda3W)Wk!5?81|^T$Th_H>TBq~8(;Y*Gl;Kpi?4$fUl&_^ zz1d@YiInjrM1zV<;@6C?;bH>&7P0t3TgmbPUm=PgY?K-CHPXD9#mfybzP2&+-;J*^ zCNqeytt`F{iN{yZ`AeiUNQee)XA-|=eC;YGu*c(TqKhvfiXU&38SypQycu767-D?Y z82azV*A$bP7GH;MdVGnL@g+oqQYP_h#@Bbn1on7*O?L4mMDhC>Wk!4*Y~GBo!wfOL zjxzM$jju+NnHFDsn_{k4r1IEv{t_wUONa)|HHlv7Aj~ez*$lG`1HC~{YnA~|yL9vB zi5ULz{cu$-o`fj&B%{oTr}^g1csk1v<7uIx0+@l`c;&=>_{~zT8lB!jJ?`_u5Y^-7 z8cz@pFR~in+oGYM$(xuc@e6+LTOA%WnDIJXbQBbD04+9Yo6y0$LWE#B3jd+2cJ>R= z{&u5m3Q5?^{=mFw`wtEI)~%tXfqiHCC8dREbq9E*;|6a)_iAmjBYgpG7>Lz383A;I z)8=Z*58M=|jS#iD#waU75>nsnw7Jz#zG<@~N$i7qon&#!ng7QPL2}q7KiT&`NsP>o zPu=f;r=b%kV_Aqw+-~8-r|!=R$?-kasVzi~J2N=q!|!R1Lx>#rW^lxN!ZnUVh#dEe zqhFraZ%UsHc^$dIL`V8k#GZ~*h@1}_XZc8MN5l5C(gO;;V%#i~_bf=^%Ip&p4fqxh z6HkbVC+;$!hwvY|Y~ehnZ~~ID;G1z9=_16CC6_Xv4k-DRP41s$c~PEMG^JnzCM!C^ zPH=gQb1!GP5G{W$W_giWJ^=UZ%D3>uDg&&0=xs>^8FLF1^>PdOtBpe3M$Hm9_jSA%ZG0r+?tq|?W+l4Z z!jD3bT*~B~)}hNLcc?724WmWaFxn3rMzL{pMzmq{qmUin`#P(IX!RD7&}Fu1LX4}y zaS4%YbXKnT62^XxONdqhatZ{0Q6(CryabzGak6Aqit@qIt1- zoMb4Yd0gw44$t?B&_OA>D}9UO!C+#VMw5fnoF>=BQUQf87%&J?liiK70>~Vx_i~!- z-9?jUtQkx!^MB~pe{4j~#ih^%H25jRKL1Rmg^KzHM6L86k4+Z=9tg5||O) zENw>g6g&k(U^LA?!e{}!#+cFHby9^W^&q26GkUgpG5U`-6h(irt(qmubN!dYts5Ce z2Q=UoVjxW>$EMTo@|)q|&B8yQL{s2@qIcj9a*7I(@be$00NthSxj>w;Sy+tNojcrd2$ACgarD8SirLZP@cxbm z$>+F)$aS%CX?YE~5H954Q_+DfK+F!}Al1?M4_!9dmrM4D0&m18`QFes`+EZ)Df05r ztBG^7Jr_6Ib0N0p;$|2J#IjwsaIRK3?A;@bxa{t1kZj8RaWAs33uL2ShHMX8@aY%^ zU3$z&H`=2(qU_)FBLAj9zKL^k*$PNnx&@L;nRX$Tm;%alo}UGB5hq=APM4@qqI9L) zj$U-W!(`{!BJuz%BKODeuE-m7xrTRt547UfkuJvxG3X*>Yl`j~D&pf!dPOtoNRc@@Vaf9S&s zlHA&4SNQGR#9O|9fLECq;^%Zz1dn!s3z7W~CO@Z#B6y7B5+c`A#?@UB6dhF-Vp54? zf1r2~%qIH<$=-w_C~ii!5R0I=yB5K0;rv&iqf@f5zHq0A12$* zgJLb*PL$$~ADjo>K=t?KN8rBaa-0yY`Ij_f*FV^W7IN^Z=xD1DH4_J^R^vZ(*<@p< zEDBS3KoZJjx&8v zyJKdkLi<6C`#2YyLJWH|adYrCLtWUW7{>{YLx>!u;^?MkImvMdkz>m!jG&vGjD^wc zIE2Wtm2qh3qWB6q_*8UY3lP&-9Hgqjf9SHw9xK@aNhp`;6@?##Ai0z|JrwFF(|L9> zxx;secg#ZRWIfs0DMU+l>(Nfp(M}=SDUPmoW|Ljjt({T$Q3#UT)y`~k_w2>aQ=FYb zv~%Ac?GzpD6r!Et=xS#+*)zMfGYUTnL2|p=nN98?p`Bg2&BsE!(4FdR6{4+kj4z%G zwhzhi-QqZe$Z@PVdI)Ep;}RlQbC2Pi<~W4Nahf=~DY^30V?nmu&FRg>tER6n+$f-XM;HkQ?YiZV(0B?1YJ%oiK5eYC+8EY~kFMW_2i+7DT!T zF<+xNLG)nA}pF3ayy`ZEsA|&e-022DbN}s3rWhMID9BeH#lJLK(;6#t0T=;ylF5@KvUV3g!BN1Ioh7jyOFhPI~uUQX_0e!cG7*F*ZcUSA9S z-T5q9cjy^yN8*Qc(Zuz+9DjJ_xocnM_w~7qo$H`kuE%AiFAXs}E;q#O!Pgk#9*OT8 z+6w4ID^V1Dx}k3Y{oG341fX9U;-tf!hN$gbhNc4j#!w3AZbS7z_ZXT1#LEnGy@PxPTCZK^(GS@r%Iltg%MSu1OOePQ0}tHCLcw8HVogQm zQF82ap$kul;r-P_##^W1F^=;chY&g5F^Hpm#klyVp?t96gz7kcF1ODP=5St| zsX;JbjGOBXfS+>Ouon~0`p+gl%|9S)j z^!H2*@qXs5@V3d>HK%k^(%TMseQV_PQ7wCUqvq`Cjhay7jY6L9dM1SVeGCGL8jC%g z1z#~<0(Y^qK!_IXnrXolXF-i2?ZLG?uIL)AzQ@^{079=HnwT*Pr8^<}LRA z?)A+{pt@Fu9)k>B<}&mK1jo!A%`)GPU!iMv$_Y`q11$WmyLRI%B9}NWA#xpTT#CTa zh`=$3!2J+`4T!*f5rKPWMBpft-}DHaYci-C-|rc^WiB)!hSq456(I?;!1v6H5r4d) zLdyc3)+#RSV_!K1KO;v@LEy;>M3GCGYL?i{3vth!5POqC#XI@lzx{uEPvsZvSh%}4 zBe7$C>CXMVt>$mxl{by_wwP1nZ82e*w?)qGUa~X2tyl>q%OEJKALlu9k7IcY+~v+( zA*yy#rn&Q-xn~(t{kXtt#>Ux{wVdWf_2Z*9T^QAm#ozI$n_$4sQ%7O0QCrB3(D_%Lu+INgP)`@&4!FLJu`YHw_;1{+k3^z|3` zvyLsDlJqL)k1eif+P=7K&g`vCf8}S#%`^#q{90x4PZnh* zE{q7V1$!qN2h2#=w%W_P+gAHa3z7=_ zk>xFL3WfPsh%tJrQM&eGEy?dRKNip57z)~p>Rc)vG#D@Ywak+z2Nl_-w9F4XrItfZ z=zi>yS%^yAZ_sl$ zCxd+=-V|?7??CSa*!VBB>(+hGl494o6cb{o1!%x9rENQ9GE+=+j9Ve5m^k9`1JB?& zEsA6hknA2(ERrh36cbn16w~u``GX|Cn-mjAy6%$QHN~>Y-aL>^+oD{Y9)1*p;-qVe zWs_TGa=WHj=^iECj`PdB?V8HHty}87t>@HvTThtoZJjgC8@6Fc=b*I%JK}eAe2jci z0lm~s*dFLxCYQSI$7BuMPh5%%@zJ(MNp5q@VdKn;)xo!=p5=r_>n3y_OEO(j#n%#O z9HkyZ)K3_8jkhwft?$3<-JF*{#e0+=FXiXY_WqGb?CD+Yb$Xw8RXGRboRxEF&Qm#W zDlqx7Ehb+M$K=Za-A=w7i_)2Hc(pTpY|QZMo#8@! zG%3^YY0mJy3>7fDc%5eWLfpfRJMyCDrZO`hg=Z$Dryu|D)VQlmA>{Vv2tb z(N_71v;E!jcP!Z5KgyfuJ(pinUWl24Vy_$v#pPHiF28(>4Z}N2o2dXD+xuwW>i*8k zhFFzwqq9>EO@lCW|uSBU%Yy`4*xPCmUsY%Xy~xv8bG5C}=rjdb<&=CKX2@ zU*o=j340=6PwqBf--Wmy1EJA4vDK+Lj-dtaHW$}IRCAG0R)i$X9~V0!0g4dcVl`&-ZW%&rM$Gj{R^g&{SLtGzBv_)tJGV?Aea$j!-amXF)cnZKY)y z(A7@Mix_u-`-Rg|h+1B5l=DLpepAyQJ58@M#2j&xp@*iX1chFH9o+|3F0pCn>ZwkOy>& zQGPEZSw`|Z%#SJeYePXkiP@3A#;^AihxFa$M}o<$NT}gqjLAmJuY`%?xNfu z<-U?zmKc}tO1J9kZI)Bz6>TW&ELfZ05lzl3#J?jv))qJ`tKPBfxFYCiV)4c z&nPoe_PjCZG^w;VGj` zPr#SWj|uo^LqP({O69-&m;Hl$Oc{ReCv$hr-2+FFcOHOI{z#1Sx5Vha+DmTe-`Q_% z-wximoL8A>fG~5Jv!L%eU0>CLw$a_^QcQ@tzHO8h5~MQpp;Pr^sfrjwk+Biyf~d@s zTS+nKd%pLM{~NrnC~>%VMjk#6OZbO+uln!$!*egoy(Rb9#O(=HUpu4v+6C3uS*X66 zyRE)vAj#6Judkdz?Xk^$4>*H_sM6<|2IXMkK}Yoxh6b2H;VjK5v@U3)``A**Z2Bxe zfu>rUq2!@(AvV(u$dkFYASFMRlbN=9Q4XXrHe*$j=;MCKDVzn~x;(_oZF&AQ@1xxO zlKg^-!d(+ZvkO{t2VCMk>cji!Je;A$7T;-J|NO*0-gCM5*eSO#m_fG`-x^Xwrx2O@ zgs5X5v(ZZVgmRSh%~jI7+(^0-lGvlM=_=(5|T@(v3g#JcJ>&&q<3^6Ze?@~kR z`84iKf*tv>9Y56V`xG+N?OSDK5qkx_FAcHH{)auy@9_8Y3vgL!?? z5cM8ml#M{vR%~TIc^jIoYDCvaog^b~qitiD<0Bnwe8Zrwv@6(pr2^>@sR=}~1U0XDQE))TE_#_l>t zS8%eQ*w6QGz+y#h&LKG^BZ|;;Z|04_S@RK?LLYIt8#gpl5*@R=+P5;GI;ZZLF?H8C zb%m(zo|)?I>(rfLNF9s@DykL$m9<}!>%F!?_xhLMPXA)u(wOuH-&N8HshQ>;B4YvX=z1k+$7z zaTXV2Mu<}oileUkE3?UO3*^f_#ws0ilBm;DL2|q9ugoU*vM5fn?5`9@dYnjh*Zq~* zWM5^nb+RJ;vfGidlv?X@n-DFz);RY*GQK_>pSF9-@d%OUrwWZb2!q{y+ru|>Pdg4F za{RnUj%OT)5IOD=N56#E4|l=x7CCr&XxyE9)^Q1uYlU%@pPcWVjEhcc>L!Q0;5dZH z@oL0zigu;$9Sh?{$00W#_y zoj0U;aOI$ei1miNu06C*jE@xUY#9UhiVH!AA$(wz6(I?8)o11fnchDQWsKqT-^%r# z$Gm*ke$9kX3cg=;VF@v;FHKy$ZHgb^OjtjeIY@{cxybZ5y~Uk@v+)z|G=14;p5qWA zN8gBJib&%Jm-8Km5IK?&N0u=9I1V9l3^tC^&7jpvg~87m_~+AT)~ej-`0Oiw1g_9Y z6e7=XqpS!?ma`Up;#(t%#c6Bd%*u`c*?7iyaV|WxPC4eAqKOZNwTg@izq~ z8;19r=C!C13b|;bXlbJmnxs-WdFLJ*Z$VK_!J6{_OSC=yxK;YhTIY5Xpbe1@h32c8tmuy_WMiK`#C!zN@$0bCrh0>pEcR@W8 za`36>n65&MFL97+FZ_oto9v~L>^J+ECLu?6vc*BFD?-8e&L+EEvhg&o3FBSV=^;oi zW&R5Pq01)s3MZFTVO(@4S8+j^e+-4qHNhp_TAL$^(uq2l<<16>sXR7uI1cS2pS%^=aBq2(A*H|}Q$4|5B__>oTM9CY{b^M}>j*R&r zISWA@x-Xn0Axhe4tlG<_ z3wOQs^jXU7jgS8ETQR?M zAqX*qt&OsRq;$;h-!doWuEE#2?R2)&gwt%H%fZrurs0LC$)QGB;Ya|EcA7L9 z>U!Jh@s^tCG6ol07PjlQ(;xM4+o^b1ID{DVaVEXz+fGk68W5-5cADo55u&t{jdDIo zLr2rkG;b#CIfgJ`^cETFa@*+w^9(Le7=BSdZ9Fv^O!Ht#uYJ~Wi=TxN)GsN5&9QW$w zT0wC#mW8Oq#}-a}7C)R2z(cRtsVzi~&oejwtq_+2juC*5c7I&Oy#%AzC~ltHmJ~wGb^W7NW)C zBGq#Ihc27^QE3*3a%pj-gAl`#+~q)b<3DuSDBCs-cg?`W!kzeGp-g&5c3 zpxpQXJe%w)$p$4|s0m{@3O@=#aw+rsvF=hfxqHfL#xSn+E5wC>c@xBPNsM!tvsQ@q z)QPjpHG<3WBy^>YONd-EqBsh!5nLXS^Qq_^Te2w7QMngd@F=->6G$Bem%_y5fD#p}#=Edgld_x({A+8Y|QHbp&cv&RgF*4%m z%&jHqy}dT4%}dtxQedN;HbT^9iBV>BPA+j8U1o?C`c;N>V6SR7ip0&w=khyS&yE=_ z=({BnHW|Qd^L>*MbXLB=T~>JApW4$`(RZu&^LNcntS!7x-L@<@A&Z!jglNK#Os1!O zF1W7<@17crb!6OE)QP8Qlk;O-3<#0^Mq`gpT7+#epNfvSTTdZX2h75EWQ!luaQC6?n-h@TwHxXv8veka6b(#cs$Z7Q45cHl49z zH`Zw*L~Z_Jlo`eD9jDQHLo9Y58S1Xsb$yvc_G0&e$q0&Fo(-91S+N_i$~)9w;^(*e ziDCI$`GpL5LD^hg(n8dNFuaG&sXNx@X9S?;Rbd5IOrAXX)qyZ}eST zZrGx8_}bErq0K`Y2UmuS?59Ojy@QRO&%TK1G|ovDqU5AeW+dq_^JXp|Ziq=b#!!Jy zTr^kh4KJ^mb>Vq8GdB)NleQ)zy*biAQp!*vWU;yOst=Bw_r&Ulx=LJV%Y z3GBJj{jSk~IIYs1;G_vr+I~jaNK!`L!S-{LD&3=87-y0@aJc^inSc=_#4rvs%8HPL z;mkEJCers5A|qetW;Hjn36<_CPJwu(iv#w70zy>ac%y7$5Oh>vo>Ks~w}2s|uQSL0 z`jgZPokqWnRlF0OMncr+ETc?|lEqG=rG^qLe_qhTp|}gJRFb>ZQ2uQRT&A4BmLltO zV6;0Jqu#-2DZ@TTGbIFWH>ZUVR|#W$dY9DFJ|CX7(A;~>>d_zzt+*~=t5APMC% zV?^OcAxIO-d^Z&8DARdN z*<|04W^pK&+DG9>AxJJ|t_X!X%57xys6{ISde~_izh=D3 zX(~ib@6Xh9mDBVwL*L}RxQne-;#6AnZtiW-pyk@Wtr|nvA?F=rh{_*rs2u2ILt6u# zX=r;Ob=LH5?gM*zFRlV+8Vk|JC(Mk}$^qUeyzP5rQ<1lM&hT!}4c!2aGW=_A+Zdo1 zjUT{!CRX!Iaj_}Hke)Wmv~+*PyqNB<8B)6E_){qF4$9NqIBK2XfJ{M-?@jY>O|<5D zrCZ?jA2~z3_-VA|AY|Ezu95jSeuZwT(@Kb1y>0=2eOc3-EFsGJ+t-lgGv5cU#>o<* ztoOg6tUaA9At(>KqM_AYi%koGR(Fdgm)^Gd&wY6DCrWO=`jskXOM zO^B)$7-gDjB~GbY+;mXW^Qd>Oo43;1=nBgMiId( z)ofy&vr=iJC?!w&>XiHj-t7BxyeWyv`EwEn7Q9uQ__ptzQqWzq=z7SIxsOv>h~aE+ zTE!mreFK$qqwLlMpDpJ+=0lRG)#Rq=k1*Fezuo(Tt?!+9q2>~QRImxWArXFkLfODzw5Y! z$aT7LWeYDpc$?)og~)l1IAhBRlLPJeb&%r_BF7@*D6wQLa2G0)nk6Kfl)BXD=zj-4 z0(Xd$C`5^^Mp+S(Fe)!MFIE^=8d8;A<-_AqbXhRMy3Su7+?AJpB`u|}fJzb0B3$Pb z*`1;TcbHQ|h>BdDsmS$Ck(;tBl3(uoAK(;rNlCs}g3W*>r=-7kEnSyiI9)yr6~Xrr zP8T8Sa!aNzcQ{>sZAiD6t<@^O&AD5fcBn-VWhkmxeabIUsh!lNT3GOH4sSH>jXw zpc=YO8x3_jQ{tncxy}?Jn(}g{DQ`Ga-ZrFO@urQ2hGBhi!j|4JM7-VB(B%wwdJg;0 zX}JgULg1R5mO|8WU8a^FJ1zfVXmgu9-i|`5Y=7I1gxNl>wZJSB<|HhE$`kKfg_a=L*+oH8sZq~Y(pF)yeUyE+KLi_R4jf;}RlQaj#s*J1!w|4T*7OuRBg~ zTteg;A+G-UxbC)}*MA&_D9yU%&!PnsbSF7ZA##o~&hn;wuL+asC7%>xxxBAYhn&TZ zlMRzNSs27gs`0T(Hd`1K3ImjMpp(B8Q**oXO8hhkoQHbA(-c4Q-~oQZj@>1evElB-H$cY(LG2VNu2jLbrR=GsusA@oK`~A>I4gT(acxEEkFpLs?>!6(psjeV3RQ)Auq%StoHW`=*mPKXR(w z7gOyVrvYeEdmMMxlREgDsZEP@y#Z2er3Fret&EdXMqbv zh@sqOlxZn&mw7P-?l!cklQ=4E?3YDbjDty>$25tvn@!^ESCXi;NgOu4SmO+u-bOIG zcTEv5bm|IG-4&*h?R@;CFLrv-FXCeJC0aILLTrEoE}(Y&hc27^2P8irVeLuB>Mznk zh+#=CW!{Yc&}EbRh{^44sDHk*RESnRE{@n4^y9(+@V(e^2$5s0ap+dVNsg8WmH9L} zAO5P*k$~OO&@FWmg~;=~QO2pPi2lXAnL++)h<%@T38cce_gZDsfsx(i*5 z3Q?OcExd}5gv#U_GnMIUNDW%2b;}ubkEsy@Qlp(;@B7;&8u9L6P3AP>39iJAT&oLL zh~Xwpba_d_E5Y86ykJc*Tvy?T;8rdpa zL?X!=vPPEde&=;==QfR*QQq&*=kxvl&*Q;)o_k*VS?{^`PB7{z1f!nf;vQ@0VpBat zxmo@!O1^+mPtn1sZ`ML_@Q!+_zNPHBlx)P!ZAnX-W(|~F-cip_?gCma65V3dQ`8W* zX1P=>Sm+w}sOKj)4a-HNp6iI6%z>b3Io&=K0zH|S2Y*(I7s-}~G3hi1g@9u{WxbfF zh!_W?HgiBNMF$b55VR}BF%}_j^p7NdvbRvOn@E5I5=6XNf3pTkF36k@WKD^m+?`l% zYYu6TAt`Y0+Wb8D5atEp6VNh9QU)Cv3W4u?F{KhAfiZR%UxERD3?phIdkvofzSRWE zYd9uMourDFjwt{@u!(w3W9p>iai`v?lFm?Ex)g2N9FjGzPgV>AdM4n{)}nvIbvLbtKJ=F?ey`kE0!+-I`3G9&wRyNFC|dj8w|;Lw7|K>2!F6NNz2cPvcUF>@BpMIqo4MN_Qs!|4q) z7lnYUGZz>C1LKV}7lnYUTN76YkuKgHi@4tdQbV;QZKgRX1e`LMa}c}*{h_0XbZs}0 zZWZW9L7ZWx77-!bu=Y|seQ5-pnc@bjDO^L6pPqh{9=P8_dPI;O5u`_?O?p5_#2@r9 zn)D!(P$Kq2ucoX5pD6?$Quc$)>3@(rl!`FdJ+BSoCuu8kg?iJ^Frz%1RzV?9VUDHnZt|76 zxVF<=6auaZm`k{ulQ9hl;&yWfEsa7T%^p*>aMKlE0yjM{YKxmYX%!R#72a4%>lVgP zOpBOWJO;?2rBVo_qMsQ@JwORaAwl~@;7edQ2ctGDj7`6$j%QpD2O6m7;m~Vm(^hfM zTzhG&C`!vg@AP>W|fuch<-5={>~Zt+v!bz zGaVRVCrQNy&r*~cbnPruHl>5KR0@IAb(r$E*lfd>q1AR^1hLtJ5&6rH#<2QRuM2Sh zsmB~l)D){;_!sycaIm^e6ir8eCCeQB-9kYDqX;2j6axG9V|jlJ*df|A3IXd;%*s2G z>E47W@@Xy#0oN(MT==;)s)bZQb5RJm&SNfF2E2OGTcl?L{!|<<@!_Zz8mIXcR6kTA z=`byeLLloBmNiIPOhlT~OQbXWeQuNp7j%7!7Nk-LC@3zVvgMk@`N=P*<5`Kf3UwE%N>C4M@;u z|9_kgErmeMXUx*H0D1u#+^v&zg65zQaQvi<7jhCw(L(p55OhC^i~A%1bnufe#(*_~ z`qtz3lSqmK!qTjT;y`A#IEmyZy9*^7QF2=Xfv2d!zh(`TT;4MYesX)za*+T!f`a5y zv0x#}I3RCI{N(m#KrB=Y1vcqPx`8MJ4h+Ujf|~Rc%|RjHP{JI-j+rQ0Xi^G6lTuvV zfkYRZ>cRD9`RWW|O-j*0lQwIiICz_ss&6SM}Hn&ncl;B8WVa*eUv-w&5Zf|{mOM7I%zK-YK%#E^TZ3eh3yG|fRF;ILz04k54c zo}sxY1YDE&a&fP3XK5}90hfCd7n<8m1>ahor#UGEoJ`D#-^Hnw6zTRs4Bb|t4FO7O z_ZETA}`|4|5fImH2TyK~LC{A7nP zuxv!hZ3*;0in^r+N-oIs`-9vlS}qbr$3l=?CZ-0NA%Bn?izx@eYJ*~pKT+k9-!cl6 z2M~28<^tJKe~=%KDTVE-is@cJA&5}YAGu0sE(!tHB8p4Efo&Lco>Jmy3ILxJGkP2)K^(<>HP+In6~O;5yBhi#rn6X)X!@ zR|&<%6$$Qn@&?U8A>g?3M?G)`LmgaD2)J%wE`iT*Z_+Fj0+zd&Mc6V+(ZU2oAsBiT zS4V`n9pNYc5hY*1(;SKe26(d;ii3BVd zw}JS{?Th99z7OJ_6>iaOL?Q5D5at701SLfUI9UQ(t4@HRwJb536dDv7Ha(QVp5em| z=LCd>3KD^@ThekS^2ia!ra^N#@^E=GSqx@mBr}!~%AU>$W{3K5{Dnyp8BdF1)1sId zfv6Z}WB@ai!(jUOu%n`c3KB!L-iWb1e(l8+M^Kax2hdsJT8N%4-$<()nM_9NJ)6{f zQtFMPI4omhEYc3KwZn+~_X{P!uxaB?pw0p-ff^rdAa^}rP)9e{Uu&UWQ35UIe6?_E z1*`1nU`@jIwdW?_!9eehsUT=fj9?H84uQXS#1U7JD&(4Mbrq`jEI!C^kX zX@RjplCWl)Mr(n`xWdAL?jRJ%_zOX_+~W_rtq(JbLp1WuA)bMB{6nx}L7g=U*Z#S) zg3{l7=hiOF_i)zkz zI}f9g2pzyEAPn_xHZw$o00vcN;BJD*1Sbev77{`&w8ybqg66JOxVCxj@{SA(Vuv!q zBf~-hqSzw7(VXZ=HiH?AOku?`BH3ufv18aQktPDVCW^@ki1H0UHKAe1QYMEj*gjOV zo{mpB_7+Ct6^w+kfoIewpRl&wz_ttP>Ofybdw3rs;j1F$@IUOcl~@t9^i|vp2((Dh zXM@B10({z_2c&T)aP2OwXE|Rz-1L9KJLwj=MYl)=Mxgm7Mht`m_gE@)f6^ng{xEF> z`s+DOi*_|_#9i8m2N=Pyd594Vn@1Q472i}@Olx_Ld7$$tV+5{J2sR05tHKOsGeVgm zXdp0y(Qx2IMzdR^LF6W_0&W4Q-N$!Y#gA5-`kt24=^x2ymC-_oM2C_cg^WNu7>HjI z*D4_-fe|!JH;nWU>WYyuLOn3DLZ~}N_6VUr$%7&_1)-i8A@Dy>J!!v(Vw<3=@U|lZ zUF(Nyl@OA}2>h1A2>eEW3l@21jL<-gtPmQ25%|r(2>h1E$P1yt82KYK2%~U>6fl~B z5PAfO5d#17)SjNC+1MsQ@tKBem5{xj7`2R#7rthUYK6y#iRru$oi|4Q2(>Lf zQnbC6bYDwBQj|iYgM)`7@SjVg>3Jy(8xNrh#|XMo1V#*mA~8}zC<-G875X9w4Ib!9 z(HI#c6oZi!LNhV4M`#8{A^;~X|s9~I^k#OA2NeL-lLp~$3ArZ?KOaL_Isc^?`Us^*RMF+m_M zB#gzT>6(QB9VLVjhR-7zPIjIX$J>sxaBLklveMJS*2Hw8g{PCVqlJl$r=x|Fg)Yg+B?c8GQb-21~w-P zTXPFXPjg3CPm9SGw!9_^)5z_aVCLUL3D(-$nOjUWaitBlXL9@*HqMh6tbiz=uo!k^ zEFfq%mMYb#P)YS(23NBS2%)_N^2x;9+|kqC#L>jYiPj^ujlr<-w&R^`oW}8CXtIa0 z#y67b7lLBXW-$WL|B=CLW(;pn5@4H&nVE&Xv!|PdqaA843o~n{Nj7}c`Juq!-X6*J ziD7t0`}(pY8BqZ(QP}U!4!K&8ErD+Aq6+DRNv>4PP=4^Dc9u~`I3=0Ta?qJfIEMi{An0yQ(}rNXAQ~c05Nc=-Lo}laPOu}&L^n6o<}MrWjsA3ho=b1$ zT62FM5E_GKN0uiu(k~jiWUDrAFiCSKFmorpaa)BAwn2|Cn0{nl)#O5*4>VCiqb3|j45)GqN6&@ZLQsodn!Ba&mS9GWkIu}Bn zIDjK!6A%?e4+uQW144bnghY)MW{HC=IIf(?Sm>Az(QI^Ej$I-#6C$>Wsj0mwHgpY5 zw{#b$M4>X+3sX*b7_uEr&rM32YIs5irT_!)Wi-)(aI~1=@gvNg06#x=q$!^L*esKf zFmy6ZsibB^H2*U3MfCh4IM|!%6C||Tfk%#PG_6rGA_3yoXgW!3@&+F>GDPU3JWR*M zLJl59cs&#Bi9a)x70jL#4rYp2;Q}L?D&g2tSg7%o2$#qJbduO4VLBAJyB)qDR0=w# zgy)jxOb%1Tp27?kDyTL!26+~1Z$I7~3F4RH>AN3Ay!YcrlSR{*(K~9`BmQ4VOK96n z=)J2ZMldao!ia$o`Xf(hXA65*ZH!>=s)G@1xpgrzMo14MD}?khvPZ}OqbUfD#>fky zF&OzHWQb8XLSr$SfsheK2>j1eJ{=!xY!kE_zxbHrT8NJYMlIuGiLV)>TH)~-hv~c! zofSrHkIy;UUURyyr675NM`P03n=h_;g!^D? zA3C6FKKp4#=;RvLj7K|bH2Xsg7-7B)bk~PAApeb&K;PU(;VuaSfZrKs7_Nl@5Q-5D zfDnvef(XXQ7@;7HtPl#s$R42pj9`L5zvayp26Um#X#;KVbSw+(oq=-vk~vPWn?MpF>lhYFcdG1kB!ESw$5X0B#Z5>KZ>cNw4?_i(Yja29sH5WaABNBY0JT5qNbIBL+g17=c%}F#@k{VT8b6r{1*oYAg%1 z-^B>D*I>jz=pII({Q*Xx{XRx)3z2Yp>gR6JwdSO5uVdnAZDL_M*+?PEpBc$!!3#si zlbUXtj8R({8&kL5#%`F6dfzTOG%OOW#fbc0J$`LAj6#aEWiquj*lcZW9Uqp@SYu;kA$oYzVxxjD zq5rrgu~?eEy4t?lzPjFeEFa%dBfZ)Bnp(bSCh_(~Ia|0SBC$33XL{Obk2kvz*MIgx z0Jk4nI$AzV?@^owi&qBqLmsRK1)Elfo%#R#;^VFcRIUpqurve*&P>@m(`o96}+Cv@)sw?pWB z2tBsp^CmZUZ}T1LGg3=ii>ZYcByBBiU2WD#EtaOY4;oD@AG9_J?`_B;6P9GzP zogPLA{B>GHYafkef%Y*Nfp$ZT7zmBU2(%kx1lo--LZC(Bj^ZEp39X(F|G1B8A&L9e zuZ3}31$aq~dR-iRRzkP@?M2{?2KcI=`9Pgp5^$)rs6`iWQvdBLdC%CmiGn+8eo39u z%B_Q&jvIq+>J4zPR*SY4zCviWwi!`Be5u=_mRlY-Ho#P3=#n8uoe^sGNVJJmm`Ba; zrc;&y3-L-AU-R4M#w{!*IzbM2Zq}j}u5u^JYOtTOnrP;x;l&`8(hl*Yv_tE|w;<^2 zTV8TLWspF9)BqADVm^=nA9FOf1Ft7`EoyniI^tR}bh$bH#1>(3Z2q`{vV-vO%I7YF z{nQ)pVE+`X8SIC*`UTtX-lCRU9^h%XRt%xG+28!;J!MC0?Pp;(oi@7R$JGU=#TK2f7on7HGaCjG+18Spfg$ zGg3e=%%K;0Q8OBwPcl+KXP=Rt=+%t?4k|a@DGB;IiCZFQPT{KsRkTQpFqIg(MzuAx zP;*<8-XbhAl!wq}l!vX2%yO(5B9nm;L}m#_2((C4t5cDoj#<%ztTxAo+b)RDD!#hb z{&rQE@01VVJLLoD0FT7bKS2p}Z^BxDaw|sQJ3Rg2ZbOQn+xMn-`P=L{w>6-BJ6}zd zzTf}fg{eWtZj7LZ?869T0^LFi#-6I#M{T9n!7!L&loQ9 zBw_OqkP71Corkz}@u;AS5RD@^8qluCF@ko5CqpDQG;z~RM)zs7{TI@w(VT}rd4nS~ zG!JP0e#b=wa|aU)I>}c#p+1dk#Za-i+Y?uXH6!IFG$Z9E@T8!BAW2XHYf7*_2+u`~ zAUyCON_cpn+oSkUBVSPGZ+(ckpQeCOSNIx$DukwMm`e=NP~!te1vNfECN)05(dO|1 zw2*`amI@FAmI@GQ49qCtKhRf+tpR;i7(rm+ePQ8&g;mDWg=d-ZbZO%{bC<6kUSscL zDlv5VZ`T>hM~DsOV{2pc1Z#%a)L{g%fp?LG$EJCmX?ujYErZs1$yeK(->wSl8I%{` zJ>>=H0H4IrKS2p}f52LRvJoTj9^Mic?mby)+U`5IJ)r+9UtOqzZ~B3$u?+NfaeI6w z{4pm-C}A(!?O+3 zza(G%#NqC^7UIy{7fIh0))y&HA+nUGz|)%PzZcdA5$cN(LJ6Z?@Y3L5l(~<4#iO+-a_d%_`j~m6;Vx8Zv z3hTRSm>S|c5~J3}m-2qLy18H;%+q z(DA8&x4pwOe_>Bq)>@CK-v9uQX3!qNPZ2cx0alR&F__h&medH!=g^)}K7wbIk07hL zQxSc_TCMr_3MgA!>*IWE1NgWABWSg`e7(REF*-=YFVIn6kkcJhQ(zC}9a0PV%0^0Y zO2f4f)#g4+JQ3zSj3znS5RJlcy9cm%%!(CiVqfD`U5U ztPgxI#0Y$cA0OcFJ36>FX?m{}z1o6*-J%VL*hPHhp8f5ruwF~q3w~1ew${%JSPS@h z86)ts_&3eyBDKAuMeS{ZsG;}9w!Z=ehAx1banha^z&ov$!L!JGfW)F6XuYG@X!sXYLk)dJ)k)dJ)GN~9rGd9PFw1lu2QNBWqC|_F}BN=QB=<9Z0H)1cpyR7pf=cGMe_!`HC?0m7dI&DTkG`*Yz^qs#0a_uyc^!^HM)Qk zHGD#&Lp;NyIp}l`9pg3aw$W*yC;A2rzY#6?*pHfE`A)N7EO8QaK_ImG8UeNZk{+f8 z8UK7HqCx^4hzdz-Lpc`P0HHL&2to0dV}2;{idBK$3Gy-c(R~|<2z>g`4Gxi zYs7C?|G5ub_sXq(BVW*aCcF(X^EY$B)!DyY73Ks7Q$s(QjuE#Gkj5`TCzyw+VW1^r z1Op8|MB^SO6mQGf*j&J5EcBflzRe1j@=nF6d@Z2t`2GLInEKzDim7-&9I1G;Hje4o z28iQIj3AEiA(@~!{(d9tY0Eb};4Zfj&}ggq3SRfyRbd^5G8i1C4CdAWI{78gy%}o( zN4H@Fj>4CK0v*L?Oz`fzXK0uwehI_4Enl@zgH59ikL-5vwTAeUgKMF)G!HQ1yRdjs zenY${zX=bK%P)s`?Z^5cUI#IPc)_=f0^`;EXeZ1&P?PVsK3G@tx&}qE1_1`O1$1hnT1M@N$!Sj-AdC+%f-u5o zJ_5sNkAANM{lW}6KvYmLK_A)KPH_`B{qp+%n6GqV-&0%*{x?s^#1~=yQ+|N|lplnL z$mN%V|F5t<@V_1-@E^YN6zD&n37P&jtrcHlwW+H#@HK?E@)6gzy{k|zL#Qa1TN|ox zSRaJyCq@t|__9r4sQ7gi^yOBodrCX>;mq&CiTh%>7Tj+>geI;C>nW5Q;6CLB;URMQ z<W>kG3O@7wt5CJ#gU^3@OTjxu$@8_9L~}5%g=n^I4@5-;qDe)iwb4|<`XHJr z7(q1Q+hIY`q?dmo2ZCTdNzl2~`N|^{ytxLZ1{weS^oH^dqC$Ds+NkJa8z3qM7(rCv z`(;5<;dwgv&de&}rR3`G(iHyO?4%fClDwKB+70SCNadgH#^TJO*8++Qe<;naM zzDB$Mc2(H&;)toi#7P*nw&9qV8XAs;5i}fpaV)Umgl$Ax@o8$fviqEp!)U7i38bVxIg=^d1ttgivRFumIFg!Pjnxfp3 z$nHcyQ{KHP*J{d*nsUpg+^#8~z*B}MLn$8rkMgE!zL^;QK@fOO(2@SRkS-W4R4YxX zpE%Fs!jktEYv;e}YB%&$uOai($3FR$o%!@$G>3=_)sk5M>)_1Qq^xg~TQvW8gujW{ zj91;Zsb-zZoy3ul>9M=)<%3@n%FJxPn0^Tzs6MK?ruOIOMD0E4SM1tNfBz)it781{ zA^tHh4v_rY376B?7VHR;>@{|&?v3Z2+*hZjW+wELc2QqevHhid&zUznt(&2?S>n>^ zv}uOEdrexKM-&-5Pk+9@clyN$Q~y~v9U>;DI%=(!c&50{h|{Utygucl;jF+yHED)5BQ`$SH;GWA!UE83KzV|oR3Cb;J_=V1G zkkOnRY3;o_>gXtvOPI|6AhmA4ZPfkYlcw1o*-&wEp_jw>h9Z^3r6wnQe(fe@1^ed_ zD&1e6A2LsR&(FtBha;A#CWi0d>%1{rbcEKJNp+m(2E-8s|Rxw1e-r25m6fYAvgf1%dsI;iU8?eh&%wsE!Ef!}p{m$VCVt0V11 za?)M_B@%b0%Do(NR5#j9bVRUcPZP$JoS0)Jn51WGZ7csA zzOZYePdB|YHJu(EcvPDy{;p_>PW)HpcCorI>V``@4e744xy$>D`l@dZ3W}4&N~Nuv zySl9$-fPE*%X??`PTR(uVm$8i&;>t-7H75}_33|govAZe%Kc$c*8|I~pO&BZ7X9Xv!#UDO4k6P5dU+>GFU0ggmOuAxyA~~`4^T#(&OOm6-NPAgYUr!l6{6Put z_0{`R&Q^~&Gw$B;K33b#~*J{%3V`JV!6&unO~euP0a-x~m;9n*Fm~QQ6l( zt*N7!-_(CFQ?{PmHED#NliAq?=@T|PZ8DWp+djv=d&J)R?Cp2Fw=5ly8!_XvM@Xk@ zx}Uq${IT@H(fDW&u3A3>EPszlQzAcqi#^NNbUC)1w59(^r^(&A>!SJDQnk_{9l*eGQapB=w|h{mNcuk(JW+-8o55i|ZaN|Z{yR2ooE{LOpm6Zz*QvPpgS91rtv z&St)}KRjikw|>sMqcP?ZDq=}vazw8=Uobg;HAdNShX1+V3uP4B)t@GLt?y99`?>E{ zj?`1z-{E6&452TqvWySP_L#++=SJs$2%g?EmE`LC1M1JLex^wBilmbCj>F~plKg5{ zh4y=mo{E!vn95A^D+9t*NS>6JF(Gx^{XCM_y}UiF{C!9q$-nehnNVe7dxPX}9Z%2H zD0P_4ey4mp>$%pO05i!keU&Tk6F>fx7mqfR&3#gE_jBn|UB&f7JCfYf%{$yMukZ@5 zzaP#j1t@Hn(IUB#SszYk*P49EjqRLX9v^>BVcFg3IZKjv@#b!0f{w4dP|=;_le}hD z4&NVbL;QL*rK|k;_Dg3+#hg+)?DRvC=sl5aaehwnV2^@JuU@^|KZmnL@6eaeyL{|O zKD4NQ*^K1%FVh~rFhU>&PJg1)P)~NPZS?!`C%Pfk3kqDEuAci7-PHEeq*-bM%o3-H`K_zSJQtmt zb+TxomnZRmsrxwHvJFA61zlIOeyTs2 z@^RtXy*Q_~_>(+d!^3n#|0($-Kel?Z!>Lg7qa^oSySnmxrS$p1hTAXdzdiC@zP-wh zVRFhZNIre?!!2c7L##>uL3P%G0VAgko-o`+>-^er-K7+MzV)~sn<=_v>V)3om)Vef zg^&8Nf~1ej&OE%I*i(CKpFib9AE6^afG@N`$VZ)YWCnME(&azLN6Q^s^wSgUEXHhAupcR^)QGw*G24ND8vvz@y)VB;z41hFhJ$?@?S zLpyick+y@wTRzz+^y6FIhCK%tSo7vv?E~~n z4F+~@=U>uyjq;{>BtLBtT%)DNdiHi{FSplw$Lv=-C~qt78f!_)B=2^|V8-nBpLXz; zWp3G@JuEx$Ws>;DLCZ4^Eg<; z)8;pp@BK0D=(uY$60d!Cak1z$nyI_pW#x^xE-8m5cH7t^;F_EEie=r@J)RGHI7;Jh z<%EPCE4RovHTBuT*t2hg_qqSCYw@da zQqGRFt(o5s?lyGtT7IwHyu@~wPy-&CFGuo%p^3?T5*ZHewVPA7#F{0O^=FCvH{I}W zC)aFc7uuA1J&Hf9{95nf`wxL+J|XKhDUSlIw!#$o_-mhrKe#OgW%@ zfy^H>Kh@dgcqt*S*#;&a6)BPV6PQsC99sOlSGJH9^4(^!HC( zMf`rVULo9nM)%-9)mtqPv0QZH*m~05 z4?o#eVeaE_A3LeS;whz)z3L*mKdnsJlDznZ=cavrcbNC~ON4!zd$#Kq%cru_^Xps_ zE7VSqe#o2G%o?ru;%tmK>A!n?#UoTydIzQz z#%w1!x!%BB`8v@#Ln|_GyvQ@Fi7d9A}=lYoas(kPv?$Mc( z31mGdW#Shp4-Q^6fRQ|Bh_Ymd{BhphH8a$fZ|kSE;F9O}`?0sY8@H3(D%sSm?`EGI zk~32t7HDOU^*Nt6s9HDtk(^7fTrJ&QXYcQR{Xx}o(w5OtbyoJ3V>^Fce`wH!6D~2i zItBg*4r#6xPo4F>L++h9`$RUKyO;g_hd;3=;G=E?C*v%Ol%FlNIoe;Wcc6i4eX^Id137O>wEpOxIxcnrBP~hp+RZGLs|5#!DA>lw5qYP= z?+%xp_u7M$=PDOz>n`)RO}YGQjINeT6Z#(*2K>?K{rxx^hL>#Ix|~yIS?_bzj6hs+{B0$8k*WGJZan)Qr8S>*{E< zz1NN2Gxv0&1We_m~40yLf!zG&ZSVC#PiDW4*XVcOtzA@(x~shXpuS-+@4P#Dj=!bz>rsKxJv%UOv%jBx+NoS7 z^P6YE2&pRl;v3{lOH=O zvhGGszFfI;K=R|Kdlx2`RbORwaVZS(T&ARbv)_H2o$1R$RtDO>yQ46_+X@*HH*)_< za&rCX#J*dGZk#fa%u|2L$$Uj}UV3t!#P9iPrK+h`2d}P5m~&9nw_KI93+Yczy5Xr$ zQk)(2+C{}3X0IJVuE#NE9t)IyXiuKk6mJ^!s3Ogyi$;lcmjuPgN+Ks=o#E+kGYZe0 zS36lDx2ke%($SA`s8oM{*SeUD*YmTIRJ zM{X$|exNmGGIP&J(muow5-;<&PBPIqpG+nFg*PYmlAP?LNq%^}*q7^y@4NfRn9lL? z8nA?%n~-{vljkG)uh4l+%9j45-M;TX^UKZfuD4NPcI?N9gEBrNyieV2{Zk%KS`#~R5NS`|aS>|!Ws=+k(MJ;vR;Apn z-eogn%G>g^=XR+Jrs>6?6!$eSCWUFhRETPx*B`0C+vW8G^$xSUhyn-Rq)|W*Q`HYfAu0Xq2Sxh#iY!u_fPzPOHbl5v9oih zjGxS2YAJqimELdo*m<3m?68}UGIy4;7dxm|jula{-M1-Vt^seocCGy7pt&M7rxv|U zSSdMT_lcc8Z{0T6zp)voY@+cb!dZEJv9TSj zu5U1SAJ$i)HX-wzY0UU7n-_jkn{!3CSLg5Ad-6|e6$Vaz{kFhNV#2n{?9Uuhzcp_0 zo&_ZjyApZrIpXuj9^I#|-sOXNL(PbFt`!3p#N6r6=w2xBQN;M1LuSoUw|V_K`LJw9{)y=J4Kb@Q|y=3R(ND-@3 zPj79z!+x`2t?0L}2aBYMzFXD-G3E2(7({;Do6XAyUbwh{v|Go;L-h*{ZA}UNL;?Ot z-+lHfBV_oyb?u94wq<_lUN!aAO#8qs>=&Mrr)BzzI}-WCeo`j$z=I2y-pb4u?_2-m zb>ex26>~{kkM9Xue|W;>CABdD-p^L(oa~p}X~~Ui9h3Tn-3VCyzQ&oC&M|0iCa26g zx$&6f>4e0qQa6kzL~)$0>G_Pvdm7zgV)Wiejjppr>K86wbH}!FOSxN(PcD%cyVGM# zN6%SiS65nbe2p&|9_rK4uD657fR*;Mqsk6TEg^JQ;`-gL>r^^-efN8Y2?4!xNSrS8 zOgQJRqd7Ss?nFVFSaJpFf5h*CH$BAt9jb?4`DwOf>x--A4$HI7C0*Qdg0$0{6&vGn zX7@@W^qhbjp)n!j=>AU1M<6M7<_j90R*@Yd_aEH=EfI&u8wD))VAPRExMzb>#P zH3JP;3!}5D+EvXz9=7`W^Xah;`|^0_Z)j9YyBTKHm-w}3kLbvx6RN9snh$xYo#NoGBQaHJ@$=AFtNsn*q5G`A z5IW-j%{dYGtGbMf6y!e{U&J2L|Bp*QE#5V+NL5{V&UKc17gOG{ApfmWt2b917&wN+ zYvPsq+9Z!Y4Q-_-^RR|xy9J{&e5yFX6O1>XUf|tlb+G_C^$oh2plD6x> z2@%)7dd)kd!csXv#!rXoDZT5I9yY%7SKIqSC3E-Aj~2hqO)zJNi>tmes{dNu z8}-)?Pwsg58;jUC=j*S%4T=Qa_6iYm)Li*pp4iaS@Urc$FWBuu8c&z1ykp8o> zv-)2z?05S8kjncm1Ahd6y{EE7v@u^+J+hlzhUE?`wt`< z@_dJkzAFxz2dS%epX<2jRm?fJX-PY~D0v+mNahie2N{YzAHGsN;FpZZi08&%zQ-yj zNf(^=dUu-Tu(fY)yx**Y2A>TR`qbzwFPpxj^UlKER(3I0xB1N-Q@?5cg00MXAw|+Q ziep2(dF2(0W+f&L+WAzFJOx%&&6X<0(3JNFb!xKHivJ|uO>u1)b>ohr)WCOpwBt;hOT;XNt>Nht=Df< zNf~R_dv&71;Dlh2sVE>Ff)72J}@)v#EIC!bg)oT@9 zQn&hfs9Bhqwf8R}`pN!&d9svf@#MJG>#a-Po!0VtRb?wN?QGy~3H|#QV~&j8`s39$ zM)A_c*8*-S)D+yDVlFozU(dtp^6YIdi*>VoUo=z>mF&C!t>NUT@LMCYRlC;Qo8@dh zHT0NrY1po=?Q26A6V4k=P1P{0JCva_&T889-6A@3H+2>r_I&Tlt_e9(&%V?1=6F%9 zXt88zLoy$db%yNg+I<_d>Z!=wE4=OHSyey9FF{TvFZgQiNjIR(oPOPWDK%SJ#bjMX3aRYt>?2F%^ttym9woO z?|b&%P0M-Z^fW%P^VNR$;TJDW+&a^&^BWT9er5AhkFqC!C4Na2l?MMZ*1t&f%9Kc| zdG|+ert;jk`4&4ppP1v2yeQJM;bL}KU}i%?ul%JWq?I!rhYz_K_;Hg~-OJs3ZW-@0 zDYjU4R$`)GcCRn}^h$^OXgd0hVEa7#7Bu|U%4J=vJU^G%_Ux4w^o6OnnGtdL=rWu5 zi?+$-K6g5$FEzR~kzIb9CqrgY%ICmfGa*m^3={`ksfk z8;{#8ofJgwm&o|w^^deGIX944u(Kdhal-0NM-thh>xT~8lYD95hQqd#9_*7@eB<@G z{;Ntqv5Siz75umPNPi>yL!zJD@BFEr*KeCyV;e_yxf=c;gy}Q&sL_18c|NZbuJs;E z`URO6FHT%A?o&cUCK(@O|C+z4!6~Ebr4bVX3m!E@&g^husDyKE)hC%xlWgnT#c$Z$ zxV~6Q`GZE(wIri?b6%`c2|QfzF?Ij;0a&jC}edhF6bxs7U(+h7CvR~|{FT19+ zG%jWR+Fq5O_cBUez7Y%9_gG4v*p)fkbkuja@6%hug!Py98ThS zpjThTmywR%2lk&8eR0of$hWehy6ZM?*hK%q6WgZtu1xlOwQ&lyb@4YqNuwKbW*>9C^iQY|>?W$Rx4{ajIer9{W z?9M@qha*moUpeF2xXi_xYqCaKd@0_Z(m}TB&WP9gWdBidSNfp{mjAmeuX1&Jdi7QAGE(nr$)eng+wNG*-SlAtp;uZGd@HY4 zuhPy>dh9qqtyF&78p(p$BKfD2oDPlfQTY~6^pSk4+(%cfspH3H6h0m5CwcNU>2G9S z-~Y`0-G_|P2fOG!**fWAc`eZs>K1?V_EUF*yINPr&heRCxpPT3iR5X=dR>Ug7u|c( zb{U~No8765{bsc3NX4nq+!to?F+ z%$(b273KQv(iaaakv+ZhlGF9ErM)&DyyMh(yzZM<*{(e`wIwO?7cQK9;&K1hn|?lu z9W*z}XIL+1MO=_8U7~&F%IHrlIT9Dr?iRQ9S-gFw-<#;$^~l_~_W_$pWIt0Z;gbHg z!7J9os-{39RO=aO_iL)JHg>A%^MtqE*OiXWf1RPs2^vy#^Ziu0onLN9`VWqncxGlO_>wQLTW}{J1QD}TajZ*rr^M^U7w+#~gab~!YhV=`#5Z9o2 zHT7rbzgg4hl3#WsbXIrekFh@vq`lYNmHVHPyEbjuw-*~$EcE==Vb{bS zb9|ji)K69YwL8R>ZcjY;)y}4l^**O)jqLrgYwV^=UsUWmWcxQlufArN&ygGHXY-$i zd3TRZ?c>|!K~~87*oi+FyLL66ksoA#?!?vy&V70kdU8%O^Fd~8^oLnl%6lYkeL3~2 zQA2uYY^j4Oo3ztaJI=8OntOMU`;FI9%AbczM~_I)NZ3*J=wbtDC*JWnRnB)sL-)j5 z-tnnyFi*d|>qOl_SwWJHcMsF^DQC~N2qpgysoM(D{NFuzsKn?ydhG0tzQ0cO{yH?^ z5$hwl|H+Y=RU<#oBb&?@$#2Sj-gEwyaKT`%b`Qp<`~$(d`FCv2S)K`4KmD0QPj=GO zaJE?atimVV4>G3fPM8z3=eiPFnzkd?TKkLV*Ov$xFFPIX2 ztAaaey*G9U%`ltOeQ#V{N1ulGgJ$1wdABn7g|my9=>?*%Z0+KVxOPl&qHkKymr2`y z&bc^lNyA}IWv{9M^8?>3E{fSm^eHIEpSk76sWw%x-7w(Xa{4?h^wi6B&Zg^S+)ujJ zB=mIts@2gTXTP3Gmg2CdQ=`hwXLwX6NI^TJMx5q~>Z=US>Efijm)#`FLH($)RaJt4~#T z2$|EXV&yE5S%RWc^2=w{@>nbl5^4x z>b-tgYiV(=Jb$uqt*tzL4sK}g=wZ8MggIGX$$o{mydm+OblUydn?(kPl%<~Q`nv4p zf%)buB4YX{vO9j5o2&TR!^HQ=jF07&_ZME7JLB1hMs>S0?-mZV8|I_qep%w925B#H zUPH=)_Deb)2e8Ljdek3`Nqjt2ZShmGUnb|6s_RU?J`PZ8m%LZ5QM|L3Eonb8j-4bz z`@~kcEG2r#{SIjla(_n7vB>icQcvzDdFu}*DGs`v|5Yb-TAsFqYKi>7u&MTqZbKjfWI~q?dP4J$PLCzr$UA7b-q_SmlP~P$Myv4SYy4not zP_|nlXUYlfHwEVl8`S%h{t=y`)VHY{=ybWW_MUR)#}v!5 zlVPVK+paS#Ffb)` z6VvA0Q4$aG{Ka)gNVw~QN)~ypP@b^ntj@rb8;9vQA8qLLco^sY;fVDvbIt7Sp7h-- z6>Zvht`-pwv(@u`o zjgB9nmM_MR+E(+L=kNuTeyP?*sEY1kbg*PsRZ`&oW8>_IbpQr9ttV#+_)~ z7&42@Q;SYmS5@897_m(%YyFFdA8ZI8*^jrDkMzHu#)oF6tyx?-SiGb>O-yw;XLq)C zhoN0>cOGUseSCw(()dkESG*lNXvL<;F^oj=PQ7qX4%+)5Y`LXTKx$cs!p2KQFLExv zX<)I>Dt=4Y^sJHiMf%0WJE>Ys`~J$j=YsNO;{Ie~CyL2r7NTEljkm1N$kTGFLRJo(ccLQkGMF`0ueM0VBKu5a*zHFSYu zKw-|TXCsWabl5pZ;%MV(>*3@)hs@(-ypeN+(kmx_IZVzr+>E}@{kXevW#q@MvRevm z_j#!&-8_2v*2Qk+jqwIG7sa1((y!Ib-Hx9_`*=BumcOEU$OJ_1-t5fp^^@WpY2(+Hw#I)ts0uY7*2Rx7)n^t;m9bss9;B&|K~*=tPY!j1{G)~eNRWk2@5?xxi9{FvRF z1f9o{_YKJU)?;VVH2HbjoaybY*smkvoJRGSb96}YHBniKu%kJ4rX9#Qf4oQ{M8r~r zL*~1=@v`iv?E+^FW;~L8IP5 zNjP_^!<~(0Dic!Y9JqEUXXLmcuV3A{Nb>T55~Veq<9C#mFPyokd*Ly8-yll%)|39@ zU2R^Zta-cA`mmBoM9#~yM4&I!Fp#k&ZUby{XE+(MA|{Vlg7|RPU-%A#h<=izGcWJgWaCb1{O}ZdZ5qU z=_!eqUdcO_@5;X$@7r$nVxO)HJM7dQ)&0TP0{`{xzCNuW{gOP#_81|)Rq~|5j>gBY zzCNp8cWGDsYK{I*thbj^{3G*p9OYa4{8e>ucJDnI#n!y%)a3c=yeW6?pZt=daTqJx$80x#kF;Qy~~#;x;Y(rxwmYLclE_Rg)4OD z%jgLz=Q=nqo_c9fFsUcyRq?0pieH_Ps^X>=#O$(DlIS7lKQ~3r4|G2LQI^mJ`XthmJq?{k)f8_-rwGAL!gbnXcMqew~W*DzxsnJlsn7#+cmJ{Hb2^ z@|K-KYTRJaeI)+F+a+FW_^~-X^ZFi6U_l?lq3O2%vsQecu{KRkuLI?>p3 zd1SsN?*WL`N6b@hlzFIo%PBiLvp9py6R&f|D2N9xcj)z5-A44|st_^{lIOgGwUp zeSY;t?#!)Uzxp^;lzi#JAnnNCyXZV1AGZwq$U2OzQ@-WS4%5DsYW`ucwI_N zJCoR2|NrUyP;I#;Z@NuY7Ks~~A3j&HYRgnkvdDNZnQzFF9=k?TQ2B`LfytSlj1Q4| zQYPcR=$pLPB?;xtL=TxCg5TO{bvYudP3WqF?>E}+?rp?Nm%segHj%N8*U9`a?bIsE zldry|k@-O*ap3K3k7b?`J~BV(v|s+6nY-$8mHsK)ygl2B$#c;BD|-s!V`tb@mx)aL zFnC#a@*LFmfU~sg;9m`7oRM)z?i(-QA)a>P8>-29-_zV| zr!}c#HOc!CS7VA}GFFG?k@wcfIq-^H@#%{vv_xhwsb15{nwi?OFGULU&UKOGO! zKgj*Tt~Fyy4(t0@lleo>%ue=9?l8}bVrep25nd+W0~U_zHpD}7$;u_(;|?w?Iih|% zuVZXR_%qYJH)qJRE)qY|=jrq@?5214g4evSDG@WGT00Mjo4k@3@miyX_xy0sSCdR% z=8$L;uf``bUWYhj-Xr@2QWi81{#;qL>{{i`*l&uLYm)PmZxTCAJiqNJJW=y&tkg#< zFQbo3{xm=G)|382=F5YDg$KgB57|fhSAox{?_W#ON1hOke7f+%*!OPnCK>y^6Ka2a zU~aIq%lWux$sr@r!3UTN!hKw4hs2B_0EcE9{j<+ZjQ%i3@8O*p^oDOq>Oyu$n5(iX4xmZ#d6 z%NbY8%`;vQ=1%S($o(ssKgj;!g5t31heioqEzT}r#K!)ZRGHm#{FRK+dPKh4^(WP@ zQm0=g&jp?oo((DVk-u$~QLsxZ`(%1+<&(IPd4ZHSc2Sj&ZwTyLm6lR0{dRM&()*c) z>VA(pdoN|#xmhedWjowVyiflN4#7J!?oLbTF^l;?cJ1MHW?cpKi#t~ji&ywuJ5KsV zj~D0kO#<&MCjEk=XItENt=U)kzLoaZJKP#T&ZWqE(f_G=^1rQ*#FxaI^kXtF@z#?v zX^(4i?V>6ltt%npu2+{wtC#oB^L=VqKK|Ftvc6VNP6g|!Sx0}moBz_^HAs|5B z;JvKV4D)uOZ?_C5@h@-a^6k) zFYmcK8JB|O5q{o!QYQYB@}J}hjOTxP-ThC?Z~Bgg_)mVnFKgM7s|9(J?+pxIx5s(2 z)f-YKd3&$0(ecl%Qc3yiD~q-14;W(%YQD+zzjfhU$+Y^0zULm7YzfX?=JrL#sAjf_ zN}OcQ-cKR9lG%Yvx|1@YzbGov&t|^PigA98kqZqiu8?~7{b8phQ?$Nv1c= zNx5R~%7w>~JiveKsS<>|Rm5eg6EZqC-_(*By+AF}1qw zqw(ldWAJ_HLtpiXJ~H1EeiBck#LVue?tkA$^ln-oQ;Y-u(J6*kXJJwI$QAX^&8hvK%5BqQZG%lVz zYjthMGGZ^`C%KjRnB=9yeoQ5LNKWc?+Fz2r`O`12%2QtJ|B-eU&`m8(08S|G?o!;P z0u*<5cc(z1rBI5yySv-N-QC^Y_2KTW|IX~}+`HX8$T|N#ry>3F&CJ@hq_mTqrBB9w z^=|O(*F7qzb-ndawM?~#U5=sp`DM+ajUKztls}g6PP5c&*34>tpw-Q1Ayr;=x*R8N z=#O!APu`1K?|aN>KQ@l)Ha}~(%G(ck#lN@v;@b8nuQ`LOj@=jS*NlE&N*qqOA=c4i zUj0VK%hB>^wljgT14rD+ns-^gx8)ulOLB8agmr!qE;fEsJ$B(yuXmp;_Qt2w+f{{I zL~|^!)}-vQe#^^O&%dul`@s|2)=72j$L-)ljh`1y`ORZ+)$t{3=Pr?EK&&Dg*UyNM zrp>i^->3OqxmNm6_LK*1wunD&!R-KmAI)-=K68`+Em%S>-2;j zEea>dx3^Qd%@a583hY<(_RRN%d~x1V}q@5o*QhI}9NY3zyx z=L%0qe0=rzfqmkx4$9JY;nqu`k7g}xUbs#`+r#%hdOzN{z0!(n>#}SZmf=vEjCT*s zsxa|!fw{Lc?_5}OiC@bu6E}E#8x-;1*<<%S&ehVhUd8^MCYRlix=)5|<6DQ@^0>g^ z)YETWYxla}%>l>H1ikp&_F%KMWuqrJ5vSIb9F;572rgJN=CtXNdsS+9>G;<&zU@c% zOwm1j$oR>3ORRZPHu~rqjYbs>-*Wk=ZBIS(O}$lYXWu7|XunssDRuB;!;0^xRi0Wh ze#?yA4s{+=>GIRU3!4mD_M`UD1>XmLdlm6^{7(^Ie~P@|b*=mZVh``Ja;aL6>R)%) z?T22GclWs6_EyYc4f6JSKD*-DUz3ZrTk$LUvcdzaUP`oR(Vj%{uRIS9_v6Le(q)!p zi&(SRp7nd~ZViaC{qwTbwXSiS$S zLWegl=Cz^TsnGXxzZE;OuJ56%#bacwf9&~zrr91fTh}mh`j3H$ug><3KX+HE$6eL_ zmF8^A(vj92T%o>K#|5>&W%E6q;$4A(qtxq)j~g|0>$32NgBoUAo36pBc|*%PIxb4~ z>hnzh{yqB*tJJT<@UcJ39^DvYjEWmrzQfD~H7f5`--oSp@@e^VIm_l7rt+_t*!oB6 zQ8D+a@72Fi7LUANqS4li$jQEPkeosk+9x>G;@fc7e{`uEcDtD^=_z7g~K!@*m6 zd*)84xN66q^koWfuGD6l>Yw^od5%So8pJI9bYH;r3v;4m?DkgG_bJxk^s#KUbExmn zjea+5_LxzTS3hW!{LbdnL5iz?RleH=6Yg0$JWb!leb=YoHzD$m`zOyW@H@IL@q&Wi zK1F!Yh5N1I3ZG1HCw7(?71P#u>?riTajQ5x<1`GH!FyJk7y0iDEp~rnf)_pCY>MQ) zvGBe#C33F~pH#g*G;PO9V{#WPrj8ruraYSaDEtb~G>uQa-q0-O(e(A}UrTp-`Ni91 zj;-&r^@2misei-1uHxK%J^smmGcLceuF8Mqsj(@`*sPUX*IXFTdf1%-J3subKmM`v ztxPs3W`zIhmugp)L_>a7Z`ygqf8`rjJl5bfJFfO@yn27KN~y|L`B5*h;=#m?zXWY= za%t{`+MoIrkJ5L-mIwv9_h?pPk#DKo#}kYV_o`6f-GrqEbx0C%%6(O*+3Dm37JeML z?!WriDUwH(MP8>8j2OSVTEMmLg+JBs&X=e__FjWK&-9D)yZ6DZleYvF?iF*A%J=xo z^otKhMfCYw|7K4Pjy$|+(gA<#-{aadW5m9-V({Pkr|R!{wQfo8v8T)Ytv_*#`V?qa zw|nQm_2<9x1n2s9ZPWxaCjM9ZReSy`UcLUear&?LwBdcvjCq{4+TZH`E&qRwt7_k~ z0;`jhOZ7G6zuM7qX5pI|b_F#2f7{VKT85wTHm7|1Uv*S_o(xO(K69Vw2mV%X(x9KU z3Ln{<`fuK&uDA1~Tex&d->I>Dd(_-NJM3{r?cbRqy*=tzJbv%L<(ty+{Hm_)PWfNl z9D7qi@rzKx?vJV;A7-4d-C{zoHS1c}@BHJ^iVFX=KNXMNzklpOGphd0``bDm7$bVn ziX(x8{?@K(BS$P7pY(pU zE8UZKKl1c@@`_u>hCM~H*fi# z$t<&%HQUHSD`Y?8otXE z@Lzeg-D{2>qz=Sg^~Z8<_(HVbVg5hU<% z=BC%9tUV;I(bXRifxmPC8#v({_9%G8!wG-U0=AsaqkO0Ba1@jf|M;bBUL!%^uS{SR zzB*Jq!k++80e%Vr|9(} z1xzOA({C4Ff+@JDDoobALTjB~x`rLLP! z0(2_Dqxfo7JzAjYzzw3cdN;qV*ur!Yx#7T`^|w4p+;Eb*;lRrITdm}pvnSW#0cO8o zby<17WZ1mabYOLPI2(&c*j5Eca*-#Mc*VmBdo9dGzCnvmn0Y+Wc_toVPTR+rDh@i< zI+XLC8Xee!VEf+X#4^)KBVO@v{@F?EhLa8*m|0l!=b9bxH*2LwCl@&vU#FoXfPG&U zf9F%Q=g&??H=ImvIGNGOE*_!HRm(n_YPLBGI`9b2`Ydg{Oed=wPBu3jXo=WQ#p8e1 z%7IQT@d&eBxMq;p9mCFhPIO=-VS74gL_gDk5%zHY*%4h8j@W^5yWI2jb~BGRIuXT5 z0**xOgA2B?JMwtwgN`~L)(k%*oVRg2gun7+9S_r&uD{xJ;2do^uJh#4oYO}FC)xAJ z{UR?q<*ChkoCV97ZT8dhR9swqTVA8h`821{g8>OlC%@*n&Ld7Uwtijq-$N46QR zDLkAV#3O7;V`cQTw^=%c#48?7IP=2#xllDpG1DpRhEoKcuObPY<3gt-5CdA*_<+c_6j;NKj$%lVrFS3ZApnxF$`I_Q^UhnLvl!uG4Fc)`Q@XQ!DPPIGkN ziVJFuAGY9_S*wK`PD?i&aY-cF{O4M&(Ag%s3;STful`5v?UBdc*67%eW37ziSerjO z^4Jo9&Q#IyDB@X(-?Q%6Ye}cA8xE{M4<{TsVV3eay~RK9%zj-L=!O%7&LHs!Thr5H zKACyii&w03+*AK!X-p>=ok!v^0({;3blmR9F@!Uzbu9tc8^N|Qlzs1r&cBrB=adX$ zN3r@P^Wd3_@AV*0MzwLeZHm<^r6JkD5L(Yjs9P&3m65d4Go5 zYRUF=K}X%^md)e!%% zIc=@VJU!59PPIngxpUdf(-WQi!hv(#dS{8*rqc@@xN-yMYu6=pO{X_H-sDV;dupEP z^g&0RQ(E?aQOI=qq9b0wT9r5cb}>Hv(D5TD@3q9c%{=|l`SW>sfE&(0Hyqe&Je;25 z5w<2rhix<4Gg!PL=2VPxZ1L=2{_~!8N3NeC=%_U|r&Xt^gN-#dRC9(LT#?Q0$ax=z z&Yx=y*YZHEVMeVHngg}$j;uA(jas9$JWy+-QERm3KrOo?YmITE)>thM)EZ;d8mBo> z%kIcp7R@<6RgMy)BD1GVgqtTh##xfI5Or+qwiwbi8ZF2JlWrrGMzP=lVfbAU#7EGbIJtgdTKiBG^fd_ zC)G`7JvwUty124uX4BcAIS~WPM>3s_np1MXHpFLDSi;If+}PxL`Uv&{1=`vsCk)rn6IXJQgRq zV>-JuXI{ETjZ8;err6ex>pXij$90~)n&UdpKFx8RXTRpS&T~L>T<1BcIj-{@(j3=$ zU@x}zFV}g*;n?Q5&T~|AT<1BaIj-}FTNhg`*LmQGVzt?Io|Bs6I?pN1ah>P1=D1#~ zXEeukt+Sfry4E?(ah(T_-hb=+1`mUd7iqF=NUQ)#G|+ba?EIz%Ei6#b2sw5a3jx4 zbiBnQ^u6wd>#59feua*wc!c(RYS3L=;D?$+IKFMl?jH|Ts6k8s_) zC+bx328@+QuAjH)sPppYA?^CTv8^9D7w^#d^V)ciPD}9^L41w-*H;XNRZHgifX<)S z542YP1O=?apZPf6 z$+JwPwE8Z``8zsloMAuxW{mR>H}d>6^87IJ{6go?YvVUMP2f>{WeRP+)81w|U(g*7 zXMFKG^ecDV74=QWsX1|~rH*Ji;m}cY@vTyIQPvtCSCp z1d7+8Li`rf#7Qq~t%&ISxnGgci6(N0CyxE6F3mCXM0Uf8;)W9y9bZug<|0CeM&jZk zY@4IG;Y3F#Ewy>TjqLZ$JTcsGVxp5oW1bAuo}Sav^)&Oq zyJzwjW^RXqP8%`#43X3{;&RuhEqggAn8xH)`ob?lu z!{WSKVdlw-j@V&v44Xx5=we^ahE4_H!1nEBZx{Plb~haO`AX|&FJ0%!iH;atoUhu; zefOGe&gF*Vg$|qxV2eCF(8WIJjn1FAK+;B>};gmt=&*%5D=y=n-7b%;jvN@;a+^AI^9XL0^ zc5nQ6?fO|>A67sIt|6iCiEHm&Xx6IehEvIn_Ebh^7S(zjb&#i7s|q@z5!jw>Gd6xT zovP@B7Yit<@H#b&AuhVDH81ZAs-dIq3*fV)s!mub_V>)IYYzNOpy|}m9M^ejYEGI` zM?08#YH3c$gDag(r#3nbL@UJ;N7Na2-q;;EUvKJ{m zr#WzcYC82b$90|t=%_Y#k2Gk$J&$a2Lv-LXJ81KS7PG~hmtp6tkx{Fm(dNdQ18p{) zCYl3nHl3#E*xPJ(WSg6zlY-h@x$^++T3xO&_{jw8JtC;p%xH59&4D(XPD{;koyQ*? zdzMQ82r?wwZ`E16JpCFoltb((I26q8Bcb+CDzg>5fjQFyN^C!)sbX)9K-c z(-R$aoNs@(vAA5a){m^!%MGWu8%`fLoWAIYH@xtAwfpk3In4I-bHnM6&M3-r-=~^b zN@4pozzt_0I$1>?h|bX5PrQj0HqRiV`86 zofaYoT=U<1F)6j#p5bmdBhV=zazKycf1cgZ%rnvrXB0YpMGolK&-?Mk9PNfP z1|45&&n&MZh0Hu--EhXC(^lk(D8BY)ef`DEGaendH;4VJ(x3z(rZWK@wKmG{d{D!5 zCc5EFLI>77w5LM5LHEr(lihHppd$`~*yfNaBg8FK*m0hUjvB+S_v?Q*ooVQ(el@O~ zPz+VrJk!xhEozA;j`-O}Z!w)2Za6d1DK2ur+K4y*qK}zpmgZb9U&F<*Znhf^oN+vy zs+Q|KbKP*}x#7%5M~$KDwXwjBJPX~(^N*It^%yR4!&$63uE%EyI_elzzQYjl!ED&I zvDA$`%iM65YfjjHwG0po#<2n&aZtw3B1he?zuMj&d46AsjylJ|b;}Cdd0FOJg-%bA z2fSoU>ol?Fk;cS53xJa5*9h#?P~XEQn}#Ov_N#zfh#Y_jE%wYH!Wo1Dp4uQWBCt(p__y0eAd zk?q-rP7iU=fb-M6tNS|H+asOr=#&?)!+CJofH~sYSRieDcAz8PghD5%Nis1PVV#}m zz#bh}c)1c*nQEU?*{@yb*vD|E(f8e&1OI2uboOWt{QQ{Rk^S0>&Y#<}Ps;;qey`D< z{h9;qF`WaN1MRUpvONdUIYndG>{N8|H0&|q5IUuV1F!g2yQ^Ji$}v2Qj<|S2r%tDZ zy$;#hENdM>=YVkFT)8lD)fM(yGS5+T)Lg*Nc^SI3eMx+23f&Z__!64)k3-aqMz56>pD*9iLO^zy?fp7AhELtd^UMwBIXY!T9k_n3*Zbjmvpp}|$n(;TJg?A!^FM68 zyRJ-Y)_RSOdOy6$fv4w8=ZzcATXdd@PQkf5f#*Mi%slVV!HUAEka3)gq2uZbf$mr3BK(fpIpS z?3x4PY&tnK2gccSa-yU9p1sPW9;TB^bGl?4nc42h`SL;s-r0jO8jv(kKl8W&|JUDI z^Kkz1GUm$%9W`I;4?SOEI=)(a;CyO2xzVxDm+9ou9GEZD$*VaqU#8=yIWS+QlTUMC zzDy^-=D>WJP62e(e2s`%VS(L|b5RhTy<#rl+V{Kf%GUO|kWL}Zxmm$S{8+j`+Ivlf zHD}1~U!zS2_E78hoNVvh?Um^ib;Bu!j=JuxxAazaGf#1J-igNqqNVev)VgSQ4Rrqe{#Z?Piit=#r<`5$X^EMq7CL`^f2_6}dFr^~)I~?UiGb}nzM;RT*`9iC za>~ z=)n6(ur)u|Z-d#M*693s-)ZB96M&Amk;dQuvueG!cso`g?cS;_I_g*#EAVr*0NY&1 zd2gpVa7-|rK+Q>XI_ERHBj+m!ojU07!*Iw9m_Zxy4r=?p^$+5(&F^ZRf&oDt}(6**uZ+~M7I zyS7?$TJ3=KhNn{H=J>9IOE-LCb;2DbiIKsB%tQy)Jb3x1j}$+071o)BPCW5C zY~j1c5lb>`t=Z`O5(`y)FzCoz{ZSUXBiHI2bktgfYwX#!H71?8ZaDM)=*V%Nj}H9g z3Eaz^>vUUOx>{|PwH9c3;97mY(Vm5xGdjk#UUo;;`UjnJVu$w^lT8p$i z@VoNV~sSbHdh={aTJrCebJH#NnGMb`f)JtU#wK zIcF-5S!_Bh(Gdq+%oE~2%*E%+tI(-NPFwF{Gt4}z(NUj&-78T`47WhqdR~LhJV9YS z58u<}usIiN(NXIVj+twWxmc$;a2;hj>(POqq=NgRIdpVNrfuGQTajsr!zFjmG*{3<}m!w%}=GpIta{wK9&lrv<#eDk>GxHooCk;8NHdb`euS4j- zXSuL>Z;aF2%ySqWanizCr2~(-xUM^bj<}h`Ypq;qkNsojIf~9Ia;7{CdSg1r(D@-8 zXw&S>Z^Vzy3Z(7J$2BMJ-cv73=L9;is^Pfcx2yS4yCaYDC(%*+JFLSKw*5=4pHt|- zYJ@y_9`6#(65mjJWS-MTo>NAiGw93`k+2r`w|$kyo=4U?i%vK(q0sl5EAxCXopYLV zqg1rwrgI*h3*r%ub*UC->tuIio8eXKGZ#3=owv1FIu|tuez&3Bk!`+&&QDPX+MMx7 z>oWFQ(z&cTeOq46Z#q}dfg=ozbK<7C#AT59MjPj==-B7$imlDE)-`nC$N+gtO(^-V zndiEZ=bDk{20F7v4w$bR;a8lo=aIE;qT@mHwYg_U7srHKn)B-F-m7Mw+vt21k1$^+ zSC5)zcjR2$K}Yo+=Iget&C*M?zbW(`dVJ>Ez@Xc)2dW+6TE4aXeUfbFQpv z|G(`YG^f`0CNE6qBRWY$4%o)6I^p6v^AkGaA{Dm)ziaKxHh)H^m}rmqVG75|@r!QQ z9l3vfK}YR_aDDjM*au-Rw*C&n%+fhK*&Vs>d~>7Lcca!fqt*|jmfexHexf5L3GYwq z_VM3sA4A!%Uq-E;My=nP1J}K#1E+ouC;S9>Y*DXWt%IfQj%*M7=>qw?%3(4}_nds& zKF-n!hmJVl;_=WoO3u}$4wO)p_-DuAv`xO}-wGYm@)#ZfgL_tT~ zkmEjh>CVw&_W6=|qH1|&Bu=`<%o9y(kL#bWi;m6+(ID7=JWJ2*Vy`9p9s?b<=HVJC zx~=chiRp$D3my2WY*-t!{p#Gc=aK!2jm{472%o#$@7QjT*&g`q>(+J4>vS6m#5UR! zS99Q8X*%)TaN=tY{0=TNPXct{r+lGbA6J%+YjaC7~>Um`c0#OSmW^CfO@ z9cvc^XEetr2|8-NHdegdCb2O-Ni_%dWz$KfIq>CoZU0JzPFg`>8?-x#xQzhYz7Kk$vp`VTmp68sBi@b;na{zA~dDF1~Sl6E*WG zvprcfC-}hRyQY&B9sD1ZBGcBr>&1ItVdo+nI`C8Uur^j-Z9C0$vTLB3MdzkSQbyznYI!h?Ij6a`JaByWwdIku@@NkH4gu52>xSc}Ibmzb z^^*^s(PC#_B-$MJ{kUajoAYaV;62ZLMw<(`;S_YkDddJz*bS$M=D_=+W}Az;;S|#x z*L^SUhEqawT(_sB=D;!BY;!4eGKjf?qeaqri5}S$oA;b9pV#t(AxSmNRNq&>W~`cVw-K z=!iGPa9^G{WQ%sqFP%#0z`hQf>%ZMu869{J1orpj*-nhHw^`)I*jwCMaK%- z9oes{=%`}?jA0d9zhs_j=&TSq;0m;Ro*6ss`Mqwbq- z*Y51%I9AgQrxrT!8vtO-b8XZHvsP_%;9LM(t!LH5+bY(a%J$T8qgGuvoO$A4JQztL!yp&@*jT>F$f*FCIRP2)anoH{gP{}JvwR~!udVOnD=0G z)V=x5c#&S%9oerA=wuZK-g=_et$z#OHEVU$YPA~mx^xGlR*2>#kJM

2z|#33bEi ztT_|XPU&ve>Y_P6_9kCzI$bpmC-a0ZgZ-=DGX2L>HSAX_Nxy%c}1UK^ZVts*W54qqNCnJ+g352_#8j%zS9pK zI0wS!`dYoe=D5CAAAn9nna1&UP|+b~t%2w?BPV2cBXPwUwmpN;sVa6~Xj8jgzi>XgZ_Oxj@cO$Mn9YGX|YM zkIz_i#D@*oma`+(xO>lU~mhC z$njU-%P9D+Jk=WGq1w}0s}4?IgG?tfmZRV&ROF`ez^9lxfltD80`Fhz1m0273Ebo9 z1g?N}0_SYlUh=5I9s*l2r)tl9BEvis*+*mnJ9mk|_yjo1h&OhekVM;llkLAU%s6wQ;Q?)0E$SZax5Lq5hIs1uJ;Te2OmL=rNI5d#c|V=~ujMPv$-okWH( zi5F8wtzuG~$RsAch%Dz8o*;6`soGNp-V6|16{jNei6mn3g2+_PTn;{F5Zh2D3yFN< zT8D`&b*jvdiO7{O!R1PbEUutn`^b5+6DjRfc`6h6z)lw;i`kh)MAn+-vetfbzHpwD zaiO;OE4ECE5-I0Y)f*G}%+5d}%h*{=L{^{cvidQbBlp2;2DxvL*9Hj>mvXqN7A7=E zc7qf%NCkt`H%Kdk3^d3BgX|?z)Tvr{hsbJPKbhmpK73*lK;$Ene~6^yefb8FyF3@A z639IFnY1M`ldF#=B4=l_%h_2=P9=^yMdTM}eoJIIJMj|A>N4{Vmzi_h969gs8w+7e z$Nd^eBsG&aL}obE7^X^uLE-_fN%py{RhgW^+~&6DUMo5MACBgwnRLcTp}`^YlVY1cyNP}zwEMBPI3xynFP74tg)ZB95*;lO=knpMC5jHiau?>>cAn6QJ-5|Y)~SU zqhh6Y;5MI0P9m~;L~&*6l#1=K3OUYjsuv@PB;`Ddh&*KH7?DRzJ`;J$Bv~3+<{6W6 zL|!v#N8}BYX+#b&*-7LuljlUnaSNlSRb7H3Nj#T5%}mZ3L?ok^I;+f z*?CIj0F#92Wc7cUlp=DENoOKYn9L&bn8|4(FPMBJ@|;P=^s?4FCKZUhWzvJl5hnA9 z9A$Ez$awDQJ0fzmq<1-naWly3Z+HyL5-G`f0*Jh3X9AIb*x5=%)`It_oiefQ@isX# zxy?U_l;J!HGO7SIr}>DKa;h7xJVo7me%&GxkMrcrCNn2s(vCZNNOq2zK_m@lzD*<>J5dYEJl1IRHb|x-VV#8r*>8|H z2JtK!HcwT9tTo67gJdoiHctqV98NW=i-`F1_O zV#CPGSMLO4YJlC`wViyATJCOp`;og z)pt*W_!y+LLE0E(gh5srtzHOLr)>@dhf zgG4POYbAH8ajr~c6O#}k+nB5+vYyEmA}bv#&(X3D+eMCMmc}3(sljN0T=5Cz10+9|(<`5ag zCUGjuJWZGsA`+cRJ0h`}tRUjcBtsRMCm)kgB2#&_d?NCjNuH`QstreVCsLisULxg~ zq^~BUyqU}*;>9F>b?J=b5gSOPFq5xD1~F+{Lq=tFs#O=ErX=B+R3MU?$z&qcIZvWm zGO87m=|tXg)RfxNDaB5+I+CPkXAO}S>^vlrf}QAfWz=>i6^QI$(x1o%ChLhzWpbT} zydHB#adq_`uAT$8)gsCRpJgYqj!9i2tC$QVvX;qeBG%PKrTUmoJgAZHOk@Q|%_Xvi z$uS}+c;1UNka^MwCmcRqK;#{hO%0{9l1KGvBS{Xjle38=5tuwAl8Z^Arqb!hZ7xEj z4-3DoLQVXRV$e} zHs`5Bq#@7gL?Tt$IZxy>JMmk~Jj2+jMntwJo6Gi$A!h-%=N6H;oF`iwnK?d_Rz#|D z^?!&AWAcDVW)C%|83JUU>`VfP_%m5aq#u)4MEWqv)>h^j!6bypC?;Ep)L;_7os6o( zq$80QOm-4!%j7GOgiJ~X$~>c-s$T<%$Z;+j#nsVfKRJmxDn^jZla(_!C6bfLMj`{4 zL~1XiYB32VQjf_!A_I6XynqL{kyK2o z^pH^_nK*h%5|39x2$2k2eLs=&>@?{mqmD88PUJX~slBChmWgj4NzO4jN8|*PpuW;M z#Ux5UNzO1?N~AQCvi+sgl*vUR6P#+CGY^oCT$v#*S7sk_Qu6o|9w?)#GTBJv1ZS>3 zNIEsR`WqsT*y%D@I-S^o-z*B-d#7q)r6C9$SD0)j(#@(qR632B6dEQ;evX<*qyjs) ziF9XjW4Mfp#8J^lNOGS^Ng{Wd^dmBm$z~#QR0q2p)fdX)s0Je)xJ6`gl1L72;l)wX z@nGjWkx@K`8AeOzH#-f91hKP_$X<5N5h=<}%rP=g8z$|Dyy2+bMEWs#Mnv{~qRYM~ z94j;D;(nDT;?3k8k(^A@jFVC0nFJ9@&n;X@Bonvi7?EA1RlCg~<^j*O&y%l+Fz%F=t6qfyqW9&6t#)EuD!@)r&bqe1#&@`|0oM0&ClXTEg4vonIo9VSs1NT)NCqC|qZJ)4NsWRi2C zj5@dF3*&NFtp6Y0v%QzD<)DZNNW-C(kuNM^47iAW|UMHb7bbWFw*3E@0P zh;(G9z!Di%o5?03=Qt|sQt8y=HqR&Wf}P()y0a6!Oh$cW=OmF^OmZ!kj+4nWBGtJ) zaaTy^6g#Jh)Z$trR!ZjyJ2_TK(wUuoL_V@pY_)W*F*!=apQ}e)Bb`A^O01P6h)Kvg zN%AsDw_cJ-Oga+r;`Xc~lG&;Doijv=vlDKE%(I(GE+P+@G$yj2$$lbxnPk~0^Soj* zp2%dbzLALBb6>gKbFYw7h5NN|lgyle$rmC~ICFu`(s{^aFp+yqE)W^aB-s`jCEN4K zWqVqXlbx%tCK8$Rydm;{NxrQz^S?}n5E;be6cJhdr_1W`x5+%ixOxL3hd9q9BK?^h zBqB41i|Xng?E^VSI4Z|>S!)23CPZYOh%WPtBc~v@@C}iHOnUE-nVT_*yHk>`OiJyN zq%xCeyCtc`WH6DlPPLxD6RFFquHzmV^_-nEM7pt4WUq9-urrIuO(u?g(y7DMdk{I# z&Kn~2IdiN1GU_Ee2Z{7x$M=AAzOgf&$ZaMciFk4K+6QG+BPOqiv}DrskaPwxxkaQY zljet|Q;|vbBa&ofvXV$cCca0d(}KwqB2k@cE{+l@&(3!u<(OnTCi7%tvV=%lCcej| zlYz-XBGI_kWg`9AX?#LPHDU6MNLD8GPD&>YlgmUJFbOy%o#sr=6G_jc{AuabU~-Vi zX{Q>Ef@h>to9BHak*Dm$KP#Os>idbDWXJEkbZT%ihlqonaYRBzdpuCTOr$H5=#GgsR+Ya2?GHF93n8|h`wV6b@gF)hN=&4#=iTE(_zAGI+Chv)qV$$tj z>9l52?!F|QnLHsfgh{~%(izTV0+CTnsy~#@SSE=dNiu;+2$9K5P7|5Nq{(9$HJiy* zBJ-HkdLo^LOg0c%%q0F(>8!HIGfBQP2_W*5$zCGWoNAn7K9^B-nKUNSh{PrPH2CGa?~OmJk`qn8g1o$rmR6M7}fGO5_)l*F<9QF*DmYnI{gDoRlowIjV3t>1^hxA|8@#VNx`_ zBzZaN1d*-moQxoyZA?x@lw>=T(~%_c<2>~uOR|HV`cWj=$)rJ4Nqm_kj3!AwCRd0Q zWwI{1blNZ(5L1#4Od`gTB!tOuB14(nA~J%BPiz@An#p@2DF@3X@G)yX^ zDlv(ZOpuJnG8rF^W0_Pn^KbB zOxh8N$@|VyB5|2~CX$p%^;9xX0VZpRlw}gnQ#uux3?I z zX~M+MOGdS1GK@$7lWRoUGs)sDqda&;btV#>$vz?pm=yPsQ7M@mCX$Isd|&DKGHF4i z9Fw@YrBj*75h8P${3No3N$xx{YBQ5SA`y9w%_EYG$#)_JnbgfI^E76%mPm6Z&xv$m zQprz74Q4W#$PtHH&r|YA=O~k@`6W5VWLg19jx(8FP?8f&W)za-B$JtiB{{`pRuM@~ zGnrjfk~2)^6q6)2ljy}I$;0FbkpfJHm5@$pCNWA%veqJ{B>9)g5F%T6jcp?mp64rk zX&DuRNmU{VnVch%ib<_9GAc8Zg+y{Qc}Ju?llf(3R23$*%SjT*WCf89Oq}JVGmlAL zB1@SB6WPLKF_A*NHasfGJfTediJWz))zYe>bj~qpT}hJjOxjeI6s!X&7MBv+ZVuPMnjCc(8NxyR%Qk(xZqd1^~%E0X{s5qNwy5{b#g zQAb84V$z?8CzA+urIUq84I+7%EFiLs$#o)InZ&6l^Tgx1Xi6kGlO03~Gf7-uMs;S= zgGf&%TZvqEs5#x%Kt|nQvb~`sH<|2cB*`r%I~z-Ko5`*wl9b|F$(l-1%Nl1Q5xJ)u ziNs>!XeOf)GwDwxHIoR8X%+ATcoWdk-64PB5{~JCX$p%n|3lPEt3~SvNOpaD4l#vh7;Mr zWG|7T+~yQPGHQcEwK+w5NuqF68zOO;Y$TG5N$y}7m5#|aA~~2u>L8u`OllJ;#_ica zLe9(ngrSrRBz!Q5ZHYjC+6lZRhs4X9qy=J_kmOTQ@TRJC@)DY* z94}uY@HQ(t-YU;*<#2U)+fL8CTucNKOdLzRUPZOgj}lvi+XHW*>g}1UYWYA^PVv=8 zWmXNe2s)m^>18-fxE8$0tJj*N)q*^|jXX>^54`cJ=b2~Z>1*U+;-f}2y&50vMI4cJ zyb;9&XQ!%gRw&0y%^(xbGf_D_VoY*F^}XV2srbTP z)gX8)7W?I`_MPR*$*X#iTJ4o8$T34XK5FCxm4hQMk~+$&%)V+2%X5@!VRO|lZk5_Jy1GaFA_`vwA6<;Gb zGaNTyV}i#GxUv1IqSUXyun3Ox77^7^<>4`8;tQGK1Dycn@X>~eS1!@&`J&EFRm)2? znhB3;U*&MEP9i(bJNJE>a=2C=MfmI)-5@a(;XDfsQq~~QZn-x>n>UN^oT{f@c$g5a zvxu6Dq#UKlBaTw!nIb&zZwzu+5gwm$Dl;DEWZ(%s+JFAhW%X<@x(DwTnWbz|27E+_ZQ+i z(?`t?N8$Mbj&pGHkL~e;F-$44N&NCJ5RD33qqQSIR<&I7lgdLBt2&qm7A*2u$A zoCj|C^gNP49*4O2fpHFYs(z{Va1`bV6wWs_U-@7i786+|5#Kl}QXct}Gce9-ZEzH? z-r=e}cbV?&A1(<)Yo2Np98V6{4QyG!+pMR13XuQpM{`^1_-wBfi2ZC$C!JO!ykfM^)z* zPEiDp>LQJ!n<6+BaReEoMng5wB3^Lv-YX&sD#t4ijfX{Y(Lt)BYN1y?ao~6^qDm{` zoeK^nVq?P9$EwU+oe5Vjq#Ul!Bp)1q;6wS!s#ZQVVNCEEX^L=;tG;`yqn1UW6K%xT zU{#A9Cfw!;%HcLM;p?&NT#JUsk?%xQn+sKgfW z^2L6Lzfq*3aGZOH@!Q4(mz~JN#9JLW)+@&k7UIWP;%~7C57)DwI`}g2g*GoWS7xC5d?Am_f%w zhX);3y?iJSN8!OikABruo4H?66!C^D z*mL5$e^efCbr`h>9NOS-LMB#GKDp?yWf7G+BRg=Mhu>MgL1oSZ2gLD_6@k$>Nuwcu zA`#v-QU_L!!t35z!d;{Cc)^Y_kBNBV_(gf-&t8f=UOv=9D+(_!g!_T>DDqyBys-1Y zUtj5_dXZP19+>$0h!KO|4%k6CzUpF~i8su9RWXBul;f>tnF$_fi;DIHDF=_ejhToi z4zDhB7WPo9McrR;ln+#gzuMG97WrBy*vvz`O$r?tGkk^A|GbXqxR+Big-h5O-i$GMU_^PfPI3VH1 z#0%yfuJ_9+$4lKRF!9bOIuBP3-pcXGMZ2y=;I;(rM7`Kir*n%yY0-7ZI58jCFUn#g zeD*A?96ozm1kT-X_87!YE*c;vJ}^G8WfdOQQiJLU&xB4Xj?{|ayEG8>R*}47l5tC~ z2%q&@sOo&yOQD?HYQDBB;-zj!cUVNE9xZZgun3I@6I{JeeyVct&ZUbW>kP715kJ^< z;QgT$iukCBPoZXq-`_~19B=5@Yw_JXi_jo4!NYtlk$I)+JKwP~fkU0+l=wQR@~Bg{ zMew~QxC@A&9KQEtfQ85w6aJ^T0iiTw~BNn5(u-)N*0MQPJ5^Q2|U;6cc{$D~lR2Y$42aZxzKYWa5=u z3?SS=hbqTQ9ak-)R(MR6S-p|t7@`O+UU&}@-T}v+@|`#nz7ub#)&}2+OCmxYpXoR+ z|0jhw=klF6N8vfnOXPraA=dJO#SvbtTuC5Lp|0{ASKF!1acYORqM%=}#y+d|@SUb4 z;w8rr%JVfGQcfnO6B49BvwTI0#rv<6~*_JwG`p|%6f|6eI@*df&prL_`Z?}_iK!*#bksc+@9`C z;JErrd>2!Vj~9GAa81;aL}15x8u>U5HG`@=N8ze_DBP$j53f2Vyyo+%>b!b?s3>)D z>Zqt3Y_n6erzAUYt#y})z>WgqrW5w;GTcJ-hB!y5+e-Y)gmSH_(@am5S>%-)d^{^1 zI3j%&Z7G5TUfm&T#TNe-$67$fiQyEtDUK3cUA@^Pqu{z1JlJ5BV`d%=Karhkp&{N~ zQ4Wtr1?70duDeb29X|WTC~tLh&IB(-pNZE!m7@m3B6v-*RlJ@`Ieb)S!tc|LRE|0^ zI+%Fn5TO`eALxD6J80&l*8n>LEsuuAF*>xAoCXS z-3g1(*xQKMb$5u@PqCxUxlGi~?Kq~6xtUihlt#LI;H4tEQ(r|QUGK@rRoQRL}v5n5ABRAR?{Rh`>2P!V1mIaD5X z3nKo)Bvt3nWk#uf@o|+2e=hS|MXBL&Fu|zTqD~O!5rc{w6aLHv-W8(06 ztGIs3@r8qCL~%C?GayG*eK=|nnAA8TVmv!)IGA|B$-9VXU3%3*FLjs1Ln-x^ z5_@F@ChF#jiMlm+G*b@G;6yd@c%+4+etb2m+*6&vdKGU*h!(=;FK)Hq9N5)KXGV2O zAqU>6P)h;s0I^?upK?Q0r?GH2GAoBkCPlD4P(6gJFQV$9&al;`W3S#(<>BhLRCOLz zf93EMQII0Ou0WosEdsVE>xLjv8nt_^vhF!@^agoMrVc4HFgQ$gEoE z2UjWYL_~2FrEU}~qK4VAUpcTeaNBE;SBmgHI9b(#5C6q{il2@U|H}EI!>WxyTG%5K zC`Y}mZV|p>e5f*WzXmJ9BcEO6;iw17;iy51@DX4bM=6O39#-Mukcz^~1h^WKL_Bdk z6zeC3`1i0g?E2v-b)o0zukv8#!6NF2B6w8a&qO?NWa=q1A9GS>wOFhu&OAWn;Taq# zGT_Lo33N15#5)g7Mps2}zQnDHqcRgUUrg})RYtrHpBc#2tInrP;Ixbzd=7*TN4->p z&y`F#>b7!t-)SVW$y$`y(NYoa=>SEzr%e^XBY!86wIUPMFD4w7Q8`?_p(4D-S}4M6 zHL7Ye9{nJqJUglu6V8)OIb1!1BAhvz%FI3OuN;nQq6lZsstEU@fg6p z>$J=xDX3YPGyeH$QJh)ut$Pv|7_R3VH(ln#KLNrKAqeU&kC~-mMfIdWB`+AiX<C9wIgTT2V3K zCQoeWXth>gl`HErkg;T2VgqR`Q5t<-9L>rmU%ifTtu=xDW88MS(Gt!Wg6j#g{6 zRtxqNE9xjkp`+DWqt$}5!(*PW&lH7@R%@+R3+Bs;N(Gm1Vnau(wT`3Ub(pU?JYS_L z3LUN1dX5rLaK5alK#D>~tF-~6?DN%|$8bDFp`+E>sMUfow4ydq6gpb1OoA7%cnot=6gpb1tsEtu;22s_^(YD*t=2Y- zvX5b39>W0?g^pGWKEd^Hs(l&8(2814QRry3c5syHS9(5*o}(yqv|2kkN<48a3;J@& zimC^1JBbY)t=2A#QvEuY?@+Aq+^@S7g^pHhw^nPDSDdw0loM{4#D~>S4=XAfe1s)7bhKJWxR!Y0Xw!1!Kr5;dMWLhBI;z!Le_!1jBTCGzY1+RB*J*ZA)uC<(^(9vq0<|y&Rv3q{bZdOzj_;F6L zp`+D0gHdW7&Y9~NJek*gYl=cgt94eZm1zBmC|1-_ib6-Lbq=Evi*`T@=dH_Si^>Ea ze2EPmt=4(1*6#d6l32AyP!u{^tqT~X*2ed`v({QsFDMEft=2`Y*78eTnpjblN6HqW zqt&{EQL0~M8rC>wMXjYMbhKKRwOV7RhwieX;=;$0Vnau(b>$EJ3Z*D?v|3lST3@%0 zy=K+AOi}1)wXR{5eQiwPwc!UpqANCZv|87-T8X9=X=_DIp(u2;S~oCCjp4kR2W?UB zDGD8})=jO}mrvcMTD7XfhpS>kN2_%Uqj+tEw7FnKt)nP(v|6{dT0!qO&9$Op!w(3H z4IQo49j#wwx-404MFmq7I$Eu}TCM(x;;ylxPE!;*TCIQo(68*{WDC*JYTeUn?FsEz z$Er1oqR`Q5-Nz_(JRH~}=FTC!Hl9-yI$EsVL`SRjP^$&U-c?*{ zDMg{9)q14Wf@7~0b%&zR(P}-`YQZ(YB(9YJJ{S}mI$EtKS}nK+u%hZv6gpb1rx=wS zbBdo7TYqTTay~ClqbPK=TFs_Yj!TCL9*Wgo+j+^=F3g^pJ1i&pEyiMna6sP+_vj#lfdRtv`P z1J{~CQRry3zG<~!46Uf+6ormf>pMrOFR?89Ieh&-tWkr>uD0H-1 zPK;9hg8BN)wc1k@I$Eu8S}m9_D{3Z1p`+FE;3zd;%Xq$yP!u{^t?(SB=F5tDM^Wf# zwIXQ!f^+33K5itRA;%CMtyV;>*12LY8(L8T zj#ewOR;yL`Tzjpk6fDwLwo(Q3u!C{^nh_iGMCp`+D`!%h% z^1L%WwiUIDqR`Q5CB!KE(Pjqs%WJM|Av#*EL|Uz*&2Q$mqS{atI$Ev7+%L%6tnSAx zf!wb-6ormfD~VRCM!C}7R@7IDLPx8W)TmXK*G7$bvR~+Ewc!70SnoPQEh}mlMWLhB zO3t-lUq013Z>91)h8gC|TIguCQfRfZR#|e@iYiZ0=xDXze|&jhcF0?)tM_y(Du|-c z(V|je6s$qmN+*6DXhlt=D0H+aPi`SZ!M@y_kJ#HN3LULqsW}Sjb=sM=m=*PzqR`Q5 zrNJosI`rf*^j#pw5FM>nTCG-+uGdyuQB5fd9j#V6j)H!{mHB&K8zU(S9j#V+j)Hy_ zTRp#~6}6Y5(9vpT;3%jCWB871eV{0Gv|1TC3TnZz*NXC7C`SVwtyU(EQneQG7*?Pt zbhKKTISOjQ=jK*aXNp2ctCa<#)O>Y(nsISIUK?{L3LULhR;^Z6{~9~2s4EnOj#euh zMycar$z%=sd-8E3)<1GI(9vpT*J{1J+vbTCHGrbf(Q4(;`UO{C(|HU(P!u{^t(;md zI38M2nHR|xqNCNyWz-7CwHi?rI$A9+trlGASy3Y?3LUMMH%7s`Sa6J5R@5_!LPx9Ri&6F~A}cD{VmTVQ_N`1b3r_m}R+R4&IU49_QTZ{-J{ne32t}czMHRp(wO7t4y4>H2+DuXCXi@*;>rTLK ztlIX0KgP^s6v+@GNeLM$nPo~Lq|BKKkug&;WtKvUOqt1;F`5jC5K3k;&qL%1`6l zBSj9HDl*3%7c$gU8Y(&sQ=L^IL+T}{=rl|%RfP!rpfbkpD>-AQNOY;O zsl4;t3XvgI5z2iRaO|&`u32BsRBu(tkg5cgGu9(}%eNe9s+}riNL7Uj()i3hNe+HC|Ti+V++cd%CNv47c$gUBPi+WpFPQ?F5$|df+}RF z>y@CSOWxlwHA59L)KwG8pEu-LZ(=yE1Pk2?k)f_vsVlB;wwb01s6vLiUW4+_M6)s< zEB{>Rs-+4U>Z(OuBbLqTV5*BMWT>k)l$-(N802c%)W@ojAyo%T<|nrmh2}0ZwNe!_ zq+W-L&M;LtuKlWzq2sDc$F-uxo$jXYsX~Uj>c#6y9lEkDa`zW9)Kx!Tm#LRjArn`q zTgUcYo3+RBzX9dGCjLWQS)30W$1)w>cK-z#QVrs%eOO^sAw$RYCRB8WGs1B-)fFN` z$MqJJKikMYG&NimGStU(-U@RaMAP zR}=1v9ha#ri`_kf40Sby$`iX|;hhO%*cK)tb8GUd|fsS`O5 zOhcX>PKA4Uh$>{Lt6flXcB}c)n?+5nSA`69wTJT0u#Y6JT*}lnRmf0R2kLrb@5=tB zo>=OpfedxM10}EZWQ8;KrW$Fgi7I5Mt0Q&2_(03VrY5LDhPpZh6|2Gw&xIN8P=yS2 zbq>nU&{X1O?zoVlu6LoLGc;9F6*AP-g}P*hraGxYhPt{!MQ3Pgwkl+(>pkj{8Jaq* z3K{C^2IU`Lvgfaa8D?7UrhyD~b*HYodA>bus;VkvsH;c3u1%q$A1Xym z$Zg`Bl2=TKX_Y zorb9zs*oY|AyoAF%hY&P$dDQY<)6Q%x43`G)G<}akQxl-A7AqPWh(zFcU;KOG=@O= zX~^@JsrOYOLtR6uOCHOQggyVODrBf@7>Ke{n zvG)&6y`%~m>KXwh=U%xDDc}6YvC!2<6*AN{lDdv8N;%Qgm#UDVu2J#2j)$&&s*s_s z(eb)WrCH;qfedwx2}+Jjt^rPmu8OLVp{}t(`R6ZF{Zt`CUE{)WiIQsoQ>#=VLtP(J z*WrWvE19~k3K{Ae4;6j>GF51;n+7t}^$B%-IjiqnQ*BfsLtUQ+I$y40U}D<dRi4S)HNk2IfAVxuP(kCx*DiL zhPtK(CHL2Y5_{H|8mkH!>iQB&-WL@$y!MB!Ol?+$40TPTt{X?j&ocF&DrBf@I+VY^ z%IqGP$W-xf-3*bTt{K#oCu7OgraG!ZhPq~kF8R7Ex>PH@Im~djDrBf@7Il@qTjgU@ zdsQJrU0*@TwT*Pm`>WPNTS8aD4eq#*p|07~)u;CML8e|%g$#Ag30-o3;+TjRUt!N^Qmje^yCFhJ-*RR0~zXC5LE22 za4kAEJTEs@g$#8q3`(Xk?9{M?riQ6PhPoC(`OgAg&Rb>Xm2fTkwJKz&YcX{d$~ycT zQ5!CIxbmvz*IX`$dFnZl*}+&*VA)NEm4IGsb%4~ zM9Hgw%V8QaPkJ z>iQ-q>1w*H*OkfPQMphRGSsyyDCv^#TQ>EZDrBf@HIzJ3sObB>rb?ar?iNPPz- zk1x4Bmgv<3rn3F$CXWoM@1f+{M($;KSATZ6m&>a{hNkfYlz*Kf-`!`bjVffQ>qjU* zjdi)#o;Ec~6*8oLf{ISV)Jj#zklF+l_QtWhai;!Kg$$|9P|-b~HcTVcPi}_D&@{F{ z`Dw_WH&s;?GSsydDmo2QLsTI{>Sw6vG)!$)g$$`}P<|RY&is?oRO(IcxR4?B3siJ( z3<=Yyp$ZwA#&#$_4cQx}#;8Jux^_TCr(tThDr89g3KgA(sfRYZ<3fhiPAET(BC)+; zs+lTeNbQ31&#>Q&ygX=XcutwE3K^QlZYV#E@$;@_F!ksbw?bs7>o+Jr4f#obQ{z-2 zLuyaxlE?Du?vn?YO0m^-Awz0!P%#wOb;^{PriQ9QhSWYN|Jp&`-!O$=P9OVP$j~%? z4_z|-DRs)FG&SgFw?bs7>klaZsH|0MU#UjnjGcU&Q^-))e(EZ@@2#w+YN|qpy8eWc zcg$pkXBXc(YHGYHWJn!=@;mD5XIt$ybx;*Dqz*#K4CNRet#h)3sRF;a<3fhiAyT!A zH>_)_lPY9L9fp!eirh-%EIilL8db=UIs)Y<-)(xC`lb?YcPm7OCVv#l@A)jb3%4;< zUllUcbqq@0b(GyZxY4aXrWUF~hSYH=5pw(b+{G76CE4LthzzL{Q0{+q(o}O*$k1n_ zf5lUcu@9r4jUq!`C!uo2YGjpXKRTbaUO0=c)h=XchNqzX44-*+(Z8k=|LRtb40WA` z^1HWO>0S*@Rab=!sWVVnW2=k(KXEm(e!tGt1Xak8It%4@@8r)8ZZ>sB6*8pGLCKj- zj$zisLyws%ywe>QGNjH!$#Kc;)v4qAo9e3y8B!O*3Poki@YTbnwyHvgCVvsiPkzkh z>d8z!w#%&$8QL3{pxpl|ZLz=afO|Q*H;|zfUWUpUOZ&a?R@fW8v|%s;(+zNL`1D?hRA3RUt#_29)0$3o|4>XX=V7 zWJvuTj!UNg+nR@XzcU;Jjx*1j|O7@1Sp{kIf$=`yC?hRANR3Srq<2F=uZ#0Rw zH;|zf-hs*)Tbvu6t0?yC|wOAE0r2Y%XCHL~L2^P0Ebzc=Sq~x+L zQ36?^++=TKoTX0?u{1l_69PvLisl8LgMfXPAczXjGT48FaoUzsUz0of0jg8uc46RW9iiz!B*&C)({OQ(!40WZ2 zitY_lwN)WQDjigGZ%Ap`v@k)Kyi;kjelR-5aK!Kj4lF8B!U;aml?b=M7WC zR3Ss^!LUM6vNufaRfP;qJ`+@QZczXjGTH!-b{=Kh}gDY>l z8(v8b)h=Xcg%8sTH*YOd-qapd$WT`nsOa7>mE(|GIWnZOLiwMsto(k4A*MR0LWa~M zP=0SrO@FO}sqa)FLn<4ol81|CGL`zUTOl%}9)Z&SaNacZwzT0D})KPc5$dJkl-x%e&{y3h(ypR)q{rBOjE%zpl*8(7;r|V{V1WP*;8^KMi@e$J8KI$dGyh zN?x1Gu}%1G$XHXyR3SsE0F=MBS@Chbp{B|ocPm7O)RUy--5yg@RUt#uCL-_IxXn|A40XxhW3%UFc{kP6HC4z^R}m=L8*C4WT>ln zI4De97+ zC^XeY6*AQIJXFqDj~rLAM02Z{`au;k)b#>&mEJiq(v|6qTOl&k^B=*7_z3H2 zr3xA9DotJePkvn9)M{18P}fVLD^?XZdqB;LBg5k>kQb-ggK(|e}ss6vLi z%0l@wo18bYgs#t3Awyl|s7roNps8!BkfE;fP;wn5x1VPg?ocr7jmqcTaUnxp6{zcj zWb@xKHA@vT)KwA6fA`Ub*?ZnFmGHdlLWa63QCId`h3c7VstOtEsto0yQ{Fj#|94Xx zRUt!NFH_gd#B=(Z%5lN15E<&K61rrD3I49svTm4RUscFZS5@lTuw;E|Q#Vy1LtWK^ zlCI=!Q+8_*x;k8RD@2C6ss|;Hlus@V{nFGaRmf0R4Jdzqoyhb0JEj_4a$U$!*DKVO zzQV^FO#Pt>8S1JDoq99=Qm{i;i-WM zWB&=aN>^MLGSpRzy7oNyT@h1XszQdkY6m4>UcP^0ba*V^QH2b3)d@=OuOSVGBrsLy zs#_s4)b)B$zH4~sTBHgY>Z%)*bjf$mno51mbsS36b6P*;8G zYCAP+ep8!NAwyknK>4dmxyCk?^SWChGNc+nMX#|<^-+ZksW+iy5^`(UX=!^?M^zz1 z>Mbb$iE8Z`>F0I|(|GZQTOl$ujfPPEs7C^MvPgtB1t&+?ox#e zb+x3fwDUjjX6j#6$WT`+sOY_Hs=#e`T*#1W4HdnYO}(KC8B%S6lCgc0VP9%fqf{Y7 zsx4IXUN*H}6*4r9c2LoK+0-3X$WT{%D7lyA$O{cTz9C_le9=2@8pu#r2kM&q`rsL+ z8mdBuy56DVlB=&G;juhO6*AP-k-F->{K03YW~oAkx;h0Vlb2_QPea#_s*s_s&Oym} zD$V6nKbktL3K{Bp7b^Nl=@Gh8-*q!YhPt{?SKDpZE}JT=3K{C^3g!2P{ABB>@C@5k z6*AQI9(BoY?=*E(6*AP-Ehw2`g~z|__d@8ZcF!FbGSt;QD4Aj28*>ks`c@S()YSvZ zUlG04sLX$+p1JS3kfE-g)Rp`3OTU?#sR|kD>IIcEwmMm1^Fj$SntJ#j*M$sq^`@>d z7td`rH9{3K)b&0c*T}(BCYr*ZI*qLW8S3goU0*)>P61P0|8*-whPwJf$yrp6E9u~! z$xWS6g$#A|qps%*B+GB=t^ZsXGSt-{O7^^TZO#5~GgCWNAwyjQsH^|``RbXffa{&O zIAo~n11P^YuB7>Rt*KS2kfE-D)V1lc!2?Ydlt1AbyCFkeABHaZ-~T<;qUC59c1|{#$OX9~7?K+zprV1HS9|aXdafknDpWf6ZRmhMU4i!DKjSgp< z8cEy=k)dgffb!3Ja%MBNTop3ZH8Ln!p`6)X3|(21x-Mj>YgADF%w}q+DrBf@G?d@H za%MC2w<=_)YYcVCna$MO54aT~LtSH`a>kCypV>_PrV1JA8b@7nW;0bTnd?G^x<01k zk~5pBC9062uJP0*XEswgle;ctsOuA`=$XybXjRBi*QeAaXEsy+szQdkCO}2cY^FM- za4STHx+YSWoY_nrRD}$6O@i`!L(Xibs-<*Y$WYg3)Fo#&Q)^TqLtT?Ym+bjrht}MA zC7f-ZNaebap{~!VtL)D8S4{O%g$#9l5xQg_W;#FZUsFG;LWa7gP}ky?K#?cP}i5#^-IBVyG(6Vg$#8~qvKk=_T4q6GNf@UM25PiQ&(Kl z-gQj9tqK|Hni0C>{@VIzmYzQ+i2WzrR;ogVx@J;WxAm9LntCLyTOl&kH4Dn0d*%1{ z4hrYPeyWh6uCJ&|-WN5sT@^CaHJiHR3U*xR%9_rt5E<&4LtS#7H`PWJGSoGfy5tqd zQ(=bRs6vLi=24gY`J0uEJ~s7udUssNP}c(Lx?THhMpKPdAwyjY zq5PgNbGv&JQxjDoLtTrg>&@)N51QJg3K{yOcrlb)f9yBSPdIzQspxktB10?u8p`h| znS8-8`4k!4S3`zYxP(?HlQ&gb6*APd6e>D-Q=L^ILtV?LOD1pXD^0>u!X!0weqLX(jI(cMhh2KC$CtoN`zM^&^Ln~ZGE0oEb>aPkJ z>RJsIoxG_vs*s_sHPj`OH+54LGSsyeDmr;n&pzm;gba19qb`}esdrQ%Lz7<*6`j0O z(a9r2EBrQe$^9wsIkX68wt3ox46SfOQ1V+Nt{r&J+BT|WfnkIPi~%i>Ju1(Y>&qM>lag}<=tq>XN+Du*YOk}E+Dr9I!ZGm#HrsLuscxu(@Y&fpy zjzWf3xE0F3`@KAAs$wg`G(OfYWN3vy(+UUI$kf%;235#V*EXo=D@0T0R3Ss^7byRz zlgq80%c_u}u3gmi{palqnktsXO#>O~+70E;qHCWUl+08wRmf1+ zZ`AeS>*ETW`c4%x)U_uZmpm#9b$k93Q^~Tr6(U1jd#S72iOzjY)l`KHb?pmEW>~J* zh2~4c3_n$c40Zh;l&nyGkC~~TR3SrMe?aAo2~nknFWzJ7x+-L-Yd>{;@ZhbcrgA^x zrhyD~{R!pwy!;+BQ?*qgLtO``EBUm2&zTyi3K{A;2=z?tm}E6il+IIWL0s%V;kHZ_ zGSqd5x;D4{p{%I|+1zmn|ujL-|D2)D>08kU9w!{dCFHqq*D)ks);|bjcVSrAv3z z)T^qHp&6criv7?7ZU40WBSu0Bug%4O;eRmf1+1*n3t)ydZ_+b6|y zZ-%ZRs*s_si`13kfxcgu`a=~m)O88U?+y8U*;M}A?zoU4bs5V4M(E;~^4&JoTNN^- zu0YB6&&zH0Q|H&1+M@~?+8bA){N#(KzLe0Z=-xnvx~@U_tCUj7t`++yTu0^0$j!V2Zc$5#GjfvKE%-87IPbsNfG5tS@lWt*uws*oXd2TGoaOPd8;f#bM-ZWKJ6*8p$ z2`YA2aa-Q|=W|mZt3rl$@4ry~*+FC+9?Q|)iwt%B2j#!_px}GM4o?facb|44Lo+Jy|wFlkt!JUbkD zV*e^r+4H*@B12sdKt*S0s=6vZ1x7Qpuqnk^#nU?we1P*(;hzk9Qn-*aYW*u9NaAwyjmsVhhO#`jE(QH2b3JqQ)u zy{0y*LWWc(sNAt*ik+BO0FE_mb&oM>rEAW(oF*yQV&7-E20`z z8a8-1Oun%yWM~=>L-~98--$bVnp&m`8S2Uc6`h8uqy^myks*~e9GBe7Tfa^4ovF7} zAw%jBD0!7Fw>u}6EH$-C6*BZl$p+=Gmj5`@Xo*wNMc^^GcINacj`=flk9YNa!krjT19GNf`r$<*bR z{Hf&oOtn*m49)N{DEBpE=Z(fmjyM&aAu`mJ8_GW_7cClEWLbDrey?4~&O4 z{F6|A^0nUBQ`uBARmf0RK`4J!x#RBSVy336LWa~+P_pOcnJ9Uw3=K@3RD}$wLQwvB zdHb)$c9<$u*c}%#w0ob1^3SmI$|lU`RCM4iMS5oQvm#uCp$+K>T$dD=q<@db& z?5(NNs*oY|Tv(xe-6Es5?J?C+6*8oXL&@``-1e7Az0=f8RmhMk0p<6+ypl5YyDDU8 z@+G1CCfC63E|z*GlS$WT`$>MH&3lI^Bus6vLiDnrR5 zMXm!jk4~J>)P7aSP}j@UHD>v<=}e`4&P@Xu+EGa7YH>Z%SE-BG5#R)q|8)u1lfQKn9-LWa6tfr{=ZQ`w8V z86rbnHK|K>l&RNMAwylS(s9X-GBrXKGSu}Nb;*u0^@A#8sH+xKbVr%Gs|p$Fs!d(8 zqf8Yp;iiEM?Wj7T%kLNHZ$M?2QN(Uns(mraR1H`P_ch-E4F&! zW~ZVvM25PWLgkDZIfjYX4&M7P%&`9R?zoVl88(CRGko{I2s$dGCYC3{}J?&690r*;U_n4=0A znno)qKaIA>l8!KSP8BlL)fy^#wQTCi7u|6oL#hpwzh--?Numc$byS56skWr#cYc~$ ztqK`Z?ZOIWH7}P*k8S3f?6}?(ERp2GJLS#sFg7T9;aCGoJQ~gvSL#lI7G7b6M!PK9skfF!& zyHNgWS!74-!{}of8S3f+^-L@+$MF4UHG4J=yZ7lb?zoVl8Fq#8Go0Of=O?C`t3rml z-h+xhmQ8)C3K>$}p!{R`q1r2ZoBBl+GNigg$@c=tZC{GUg-sy8T<$G#yj)ta= zsX~U-`%r!#%4dkCa+Gt^K!#Kw>e^D{vA(8WSA`6zzECm^xn0=%+kI1`RUt#FAC!MA zzfyF3GE=Z>Zn47)CW+0hSjDu z7-{MYRmhMU7?ez-ydf=-80RlbYagItKepc3{8Frl;891cXnN4s*fsUsB0)xbkCdmQ57%1^#$>yFQx`a~5n)HNC^y5~(@RD}$wF;H^G zmRSL(rp3f9- z&m%)C91m46wmLb6Xa4$gUeU1U6Tj?^3mKaHCs2O!ZR$3A*3=MH$WYg(P|;^SQ^~8i zE@VhefRaawBqpr+d6B76s*oWy5h_be$gSs$SuIRusp`6rp&3pJ$0e%ef4#;#6`edX z)b$yZzjElYx7L#-!wjcr7cw-%$)QWm*qtAkklfS_Rmf1+=TOlZnyOOG9TzgBzJQW@ zS*{++j;)%;)HGGdkeUKjCMM+8vBb%Brv6if45_J5e$UHy1)Hi@-K`KAn#PwN{1)keU^`Wb)^JDl^+u?V7F&8B$+C`PX0acVYeu(>S6E8Jfmy zC_j05{befOtF8+f>Y4*3@9N7LNB-KosdrQ%LuxLR|GZNE+PkS$s*oWyFRW0eA>Vt@ zIy}A-zUEel3?0|}prr4irQ4F5s-X%Q>RJ$#@2VBLCa6M&x)uf{UGm$0Or27N40SDn z@}Dl%&(*3#mC#kRmOCzFsB1BGeSf^uP*c-XAwykXLq&J5snoSy7c!)lK>2g;fYEdQ zH1)nJWJoQA@_&7`(fAp2O;Zo{^Iy49)ZxfdDgS`OvU0DGqmd*InH z!zOjyaUnx9Tmj|x{Dr}%C!0E=3K{BJ2^F28sfMq+E@Vi31La?}t!>`1p{c{FkRi1y zD4E8?-4Cub)uOKJLWX9z8p{2zv9nFqq|=>>&JY>uS_38L4Y{?b*FSOLFvC;Yg$&Jb zEtH?(uwVK#HPy17TLUuGwJvnYBjxT?Qf}+#r7Gl9bn?j13crK$&z15M zPh-L-BWJY>8Cv1@v_kobCsR!txD_HpT|WdRE0o`{P&#z&Q-ut5{TP(YP=0%isXA}E zE@Y_dCn(ubqU3ihnA)WZ8S2_ZUGh5?OuhP+>q3UQHbdpqF8S>-rhZk040UaxF8Lh` zre102x{#r+t#n-SI~GiBSA`69{Y+i*I~Gh;Z{)g=p{{LE{?jG-?J=gdsX~UjexWY; z9Sf$aHg;XeP}g=S|45PF9%E{&DrBf@2X)EsSTOZ+6W4_db^QwE_lEqA1yh?B}^E@bEo@Eer- zUt`zUH*-JZRP+ph46Sevls^N=&sIDceimk>b|FJ6+)FF0*>2f&Q*ShPYe0s&_QmT; z9J=nQLWa72r!M(fPE%Fhc3sF&*B|k^a)qu>RUt!N`{Q+)I-?31>iRP%xtDv6s5}2^ z=qlO5tq>XNIuMkcqv~dB+t5_$mQEoWT@*9bzQmK^0KLy zTRVjebsdKCXMo=)?W<(!l{QWxLtRIx>-YP)%9yIt)+uDD>nM~z1FX6E;$Nm3v~vm> z>N-YUbtjb`XR1kir;wqp<3Ytni0k>h;r?pb!6{^@>qJm8dHEZ=rq-!KhPwU=%6Byn zXMptYxGrR<>ts;UB|ighs-`MrsOuC|^s)SCIIa<@kfE;A)FqEEQ)^WrLtSU6t9jn? zAFc^qXH_9XU1zB)@8O2AKPT_MGwYd-ZW_o?*EuMEefV$ecW|u@s+%fgsOvm+jaW9T zgQ?}JkfE*%Q2u)U$Oq-JFAH5)RUt!N7pd#90n-|rD$vOt7c$g!2`YL$Z>pIpWJq0x z^4Ih7DU7KvR3Ss^3Y6a)r@m-D-_&7M$dI}kj?3@f31J#pI=kaShNf{XDA~R8J9SM} zQH2b3U8fbwwdkVI)k76B)OCZpiV0y(Dh@6*AOym%8M*O#P_} z8S1(RC67uu^0xP{AD$n&Qgw0DK!&>RQ&*3q$Ih85tqK|H`UfidNHNt>6*8p$g^E5> zOwCY*45|Nul0E-U+v9mm9a4o1DS2bl{{EL-M=cK1NZ-{>0~wk|0x16)w(fINN}DRL z3K{B32<5L}Ym7VE)l^qi$WT`z>Uw_On^{fGR)q|8C58&m%Llg(G4-b^WT-0%b?r*u zBZaBd@40CpLszg#p>$SpUD8gx=2Y|w78zRM15p0i;rOIWIUf!09+c58WN3xSXoXFx zHL7LmTUE$VS8^zS7Axd-?fpZso{OR|@JHl6&$jQ(vhPije@8xz|f5~R*j4EWPD-Cr$y!y}|rt0)?D@2C6 z(gr1uukjsMZM_y|xKR}{)RitMnMPclGn-8v=;^wUp|12${tEW_?e8Zx^>;6)kfE*& z)YUL={^X|8zwZ<>)Rhs+KPvy&@bNZNPxWyM8R~kFx(;m2SKCyTzD^-SU74W#{k7!R zeqWnv(a$Mls4FvdrL4N+oT&l*okE7X9)j|(IN}~De$&(!1DryJx*n#k)W^^KZff-h zP9Z~GS?IVfe7m8qsl5Z8LWa7sQrC{YvnQFl`k_!Z&zTdk)hCTn`P^XZguIxd{o*(nms&=M!4|56`>dFD- z_u=rSn{t`TG2AI+s4FLRO+Fs?pQ(37IE4&#<)W^HTgE?TYW+y3kfE-}sH?-p8z)Vr z8toJ^)Rh~`@A>Y@>QyrJ<`}1tp{_jC^~l8B7m6y8SfBN!nQ+LKWg$#8) zPFKD2?t3rml3R2gCN?WpUs*w zUjw}S!}dYFLf1}J$WT`y>Uwv<>Y}EqPIS{ihPs}nMBgfHFVuWzh?|xWmF+UUC&aNoHtDUtO^LWa6tpsu%8K0DA?VH*9vbX~~MG|EEx*I)9x;7l!2 zg$#9-gNjbRP3StH3K{AuPhB#3Q*)-d6(U1j6`-P%H`R5zQ^=622o;^Ysq!kOl)tuF^h3q; zroK>x40TnduK&JoQ_<94s*s_sYSdL_de2Lyo}A^53mNLFPF;tpC3?=(yQ+|(t{PDO ze3&tR>HDTut3rmlUZJjSW9}t1759}}Au`lele+TUoRHsCWmU*f*Q?Yuy2<0)O^s58 z4DG1bpxjF0;$G@ntF%+m9fb_7uojfxQF6xa6CPiCwF?+`?sScTT|?J1s*s_s*Qsm#ylWXuZBc~`b=8H6zKdn5@f^28WJuKuU6L5`&*f)L z-BE=MsrpdXs^GNHvC%v#5M$TH74AubC>gz^xD&Qca-z89T?Be^Q$2sR|iVO`+s` zC|_5;<8E-6#y6^vp=mUO^5>{Nt3rmlnnOjWVXDMJcU;JjdK)S_4O6{UAw#MK zl%GbCV|U|B{iq5VQZ1qU^YS+%FAw@WJeD6=&?VEKQm0%>Q`=P`LtP!9{G+l~t$n553h$-VSmL^np{{qROMc^@sj;e%p{|Zl z(Vtu}wMP{)q&h+Q9rg9It#+Hry40-@8B(30WQOusmY=*c)lwBQq~0Y}yLiL8rskp{{OF{wEg( zH@elw)Dcz4km?TQRuUKY^|^~Lm@2m1{dZ(Y^?-{0G=ZtHs*s`Ql%DZaL+r!oa|$xl z)e9>ifY?5>%h(5vArdRn`Xp&9mu@-uAp;Pe%y3axO*g$#AQ59N1nxzfEFn(C?w z8B%?q^2b&u`(sqMsqIazSA`6zzEFPm*7>yb2c}Z3bSp%LR6i&=v&r;t*Pp$}RBctr zkm?WR-+{?r|K8uGrl>-O)PS(USXErc3|~EL>a;3kX!0LG`N@yDTs@ho(%-n_LWcIn zK&a@Bs*8I$x;K!a6@CaM?~2IR9XYu2wp-!MHeS1sp%o6I6>i>Iro5@cs*s_s!BEk? zVJhD$cU;Jj8Up2iPO9?z8HSkZq6!&OL!tcMkl(;#>L*pmkQzp+4zR)`F# zkD&aO-i&_rj+ttx3K>$vLznE0BKtePYHF@3WN7juprU)jRN^&mg~-s}7zq{K8+YQJ zH;|zfj)IC_eGLugjYisq46Sf9t+4*=w;P$7p$Zx58Uy98H{@E>)M-`7kQxgWz4|g$ zXsw$DGNi^q`RB^gc^Z^3)ms%Zq&|kq8N09K>)yJ&d(QN5_4U0fWM~@Wq5S=IWoCv3 zrn0PaD@2C6K7sPnkgG3K9aSMi>QgBHDqH?GfvGL3kRdezN**b4Tk&zdp{DY!cPm7O z)I?J9O3GA!RmjjZCPDdW4C&sbnWADb$*!L1M(>Y5U-t8e&Zzqcx6sB0>9$vd~EzEgz^ zb$tmXdqZxYmz&%5qtKOfqgx>|)HRK|vuTXEW796*AN{m%2W@bo?h%n^hr0UGu_m$qe5Z zy=aH2%s;plB12vCsp~-dqo+)@P=yS2EeKsQL-{M)Bf{frxhiC+Yaw;XcfpyurwSSB zS_I|KY;xXsICPc$(H$2u)U}wpiQZ=?k~AjOWM5flVNY1QiTk4EupSc zwPqYMRrV*hLS(3GDU^Sg_@QepkDHpT3K{BJMqMM`TYA^jEmg=+*K#QToRVVIjryi) zZ*nU{hPqZz*O|{7Br~;G6*APdGIYrdmsKp-`}Huxl$%`_GSu}Ab-nfZrlY3%t3rml zRs|(p$=jyv_D1Nsp$Zx5S{;-;Qsg&Jnrgentq>XNS_9?pue(o;dE3+xRmf1+TIzaq z#j`t2)!pj4kfE-1Q2zdEk~(WfQ`=P`LtX2s>#ae#HkqpMv+F{Jy1s?-dwxUKAD;Rk zymnZt3K{C!KwYN_Zm4J~!#3B240UY`O71WD8P!qYvD{h}GSu~5P;!6Ccj}tjs0tbC z`aUS%^-<`0=ohy_WT@+hprlKF7q_V{s*s_sAED&_lCQhHRq+}iAF-`_sU)NNJBP}er7=&Mmvjed12M26HaQ2w#p zy!X7GrZ%fWhSYW_|7!G)@oT4>dTyudLWa~1DF05yr!SnZVd@K2$dLLKN`7;)+>%aM ze!*0-U9JlmQai&6MaipCQ=L^ILzCYH)&V$j}OZ zgObV1t$2Ys+fszR(P+0jE@WthduWC7D!|lkRmf1+-q0mG_{&-wI-9Eao9jY`y7p05 z)pqI6np&d@8S45S%Ac_dwCeD(si*h2E@Y_d59<26?%b}XW~xGly7q@I`MUDyQps?( z$+FjVAwyk%QrCj^FZ40hS`{+XbpR^*$-b$Ts*oXd5Xzr79;rC-BU2CTb1OuK)FCL@ z8zLx} z%L`3a`Q05CGNg_{`A<0uRi2i^)HGGdkU9<(eNL$!?&a&MkfCXufbx&!XDc<^ZR&+T z+zOGQuD_uCG~_wO)Q75&A$1Ze`kZ3wS5?T6ItAtT#<52pxnL^iez!toNS%htse7YI z&HRfiguT&D6*4r9Gf;jSFBh%(psBN}kfE-#P|@cUQ!W2=D@2CWIjHD!im6kokRf#* zD*Bvas{H}ig$$_+Q2se(<>-bjOr2AO45^Dy{&(D!AAa*QQ|%ABE@Vhu3M-5aAI~YK zE~r9=CVv^qPhOr=O!YeCx{#sglq*ot=akC0m!r=q$j}O}hAvrQ|LjRFy%F}t1BYD~ zGPJ^LLCIdcxNg8mQ~gyTLtWRQ{MGX7-|YIncj&sU3K{CUL0t(d^jd0a&k?smWT@+J zC^-Yjt-zlZvb76ci;p^m40YY4uD08*T{czwm{Z75*DWajsr1ydbvL{ex^AjMhPrN3 z*WSdnE1BAQ+;t&CU3Z|Ok1tb`PdJ4Psk>1AZ%O>uCv$02o&ItP8B+I1z0rFAU{lpj zI)x0W`%tleaGuZpZr+QgvY&Da8B+iJAL?&a$dLLM%Kt`}>Hof&*1C3_c3sGj`VUI> zp(N5&ef~XDGtM}L4BcOGu@jB`{jZCkzIVyg;ImF4LtP1={3oiPPJW_?sn+M5LWWdA zD1T<#oZDgJcSIcFeOy<9MwLYHzr(lD@2ASp9;!PUd~ab zN?mgb8R|+Mx+Edjy(PjG(Lq(nP*)o2lIvbmPh59h$WT{WsOWXCsrOVNLnG%I{ve?!6mknDK^NAu@Da8R)p=y4O@wRmf0RMks%!C)d5E7O6sp)Pqp| zd??qwrv6oh45>^|(d%AQb^dn8g$$|8P|@q&YT;gX#O?AHS6f&f8K>1JG z`#!R+pQ-ZyI)x0WoKW&ek=uZ!nG5C&(@2ZoH4+zx3{4{!l%K|!v9B&L)khUF)b&{C zlKX6Uu|lUzol}Jjb>*h64_enqVd{+p?%qd+y7EBDo|nY?y&uSAYKtmls4FjZ?O1uV zjj7@ZT^BOc^*EHDp}Yf=Bh2tCRmf0RKI*D}eZ(YFX%o3FWT-2D=#oU~g2}U(>aGeI z>Ux5@4t;a=h^b?$kfE*uP=1EXvmD52s#;>VLS(4xN$MJ%a8r9zD^wvvT?L{1)z_q3UQo}#V0X*>(%AC=t~_W9gY+2pPZ z8R{wm6`h8uHL8#yRTS!(*d7$Qe?Zdurk+dTx{x7N49fq8#%K0st!HYLDr87K2NnAV zH~F3lQ$Ne|k$JBaN$WT`asDiO3Ib#ml^kBB#Ve%DIxh`a=t0Z;p zYmz#LsdK83p{`O;(aD<{mD+V7L+W`b|9xLgj~2gbs#qGQkRkN~l%M>*pAP+L>bNRo zNWBOpk4m}rJ(yr-`mJFa!_vAgWM~?tq5R~NB=~WTsi)F8g$#AQ6tC;&(6v()GSpQj zUYDt^>0K8x)KxZK*Ur%OPzI-vp{{b&wKY|(zf7%Dg$#9-kJq&;bT!H7x{#r+3h}y3 zC3(;(WT>kmRDRvPi@KC)zAbdkRfP<7Rids5I~G(kRU?z@LWa63Lq&J5sVl0GA@wqp zzwVX4zijH$%&rR=QdNSA9a>zq5L$yo%VDOQ#({4LtU>y<=4q)*|s-*rO?$io9jY`x@u9^ z;?Z9xHkIvBr;wqp+ECHSoBBZ&GNkH2$=|M$_lc_iHb0%I4%uB7GNfLI${Z7NOEY-Y z2vd*da0(exb)llyhfTsXHmgF0rcn>dPrgsjlBZ0)nbUP4LtXVlmn0tfYF$fHmsBA` zU2jm=j^=~Mn;MwQbs;n97@$DBfjy56L&QR&COZEB$^WT@*csMtTa z$@eUc3$J0z<#t`jP*+3hitC$grm3l_kfE+dQ2Ap`at)BWN9|vFglo}zs*s_s#?+Pn z$vXo~CCKYmhzxZ#fr`E>Vk+t5P9a08DU^SQ^YGxWrL3eKFHK;Rmf0Ri=cd0wa``k3D<=T zb+ru2cbWP~6*AP-3MzlB$luF7L)Sr7$WT{n>dKmN$SqUH3b+*_LtSm4qW7|?lTSK@ z45_wI(R6unYyD28B!lY<&5>nBjw1Y%FQ>1y-~H8J1%5s8iSzx zG`_kpW}~V8s*s_s!BEj@m|CF<8B#-_Y?8qHN9L(}*uDEYcKjx8u-YJw_csB1V>{+N)-KQz4hnrFkg_h(he zP}d0RN?v?RB2#^fyW>KJx<*1pCvU2738#=DH44hVb|{tc=1o(lRUt!aG?ahsQ0jKw z<)&tobX~}h8Uy7YmGZvm*f5PZN;!oLO=B#S--q(PsHp|2kfE+|P|<0a`d1Y)q&|j< zzAtL3_VaFq$dDQj6@6dS)FM^Lkop8Fr|ykAZ8Hzf8_rRQUT|H=&@?`U^3%Be>bu)a zRaJ!ybxnYZPQ%m~RmhN<2vs$NukfE+QQ2xsNqkA1v)(Gdrzf>VZU2~~R zUX7YsUd|mCGSoE>O1^_j5}&N=HN(`v@=hT`UGu4{P@8P4P1UL36f)GcARLz@#;*SC z1ygw|I)w~%Eu^k}J${*D>ZU4WsB00FJg3Ol-Er?;4pW;exh`a=YcX{_Gim%%QxhvY zg$#9l9lGS%T%Ny1h5M_`%T6IfT}!A-p1(}xui_Lk)U^~Udd4<&N)bj62wHzw?{AKE$YEB_TY6VpEbG>ZgQTcRrr;wp(tc3DsZ24Tz)B;t=P}et5(P@~< zU&D1FLuwV&GqL+hq| zq5L%D`O8%Cnyw2O>RJa?FxDjdP(If?947z0DrBf@J$1dDeQkGB9bR=^$WYg}P|?Yo zdgwK$kRi1JD*CyesUKA#Luw+KEG$Wz-XWM~@S zL;1;1PVmm#rgo@8hPr-;*R?Nnb+6;PkfE+0<8_(J^}18YP}fiKx($ZHd=q>StBRP}f$d{JMMPbG_d~SJ(Qk3mNMA znYx}oIAWZs>~A=Q40UaTitb)hn^hr0>K7>gPKA7~XR1pB*M$tJ?Loy3EiOmd^g~SL zebXsqNbP{iADPDfFpXWRkfCY(3gvh2ce^)bHr4wr*M$sq?SzU>!&IJzP9Z~T7gTf_ zrgo}AhSct$WE!Jq_L^bpgGR0k8B)JN`Ny(+u6H0zqfld~kfCYpf%4PHIc?B#QwLNb zLtT5J^6TW~bG>SzYe*BVa~CpItf^DTP}lEJ(aD=St_m4ae?a-y=JL6o zsd3F*7c!*wL;2U{y}Kd6*PAwykvIv)M=>LKez@sS*F9&re>-_hSV8S@|*EYol}Jjsk2bB=jG~a z|33|jo66tT9TzgB&Oy2VHTH8-vEK%1s;w$yNS%lBldqWNyPBrvsX~S(e<7?;`f?tb zl+M&`Rmf1+MJRa{Ajh@i?&M;oDzz$Z^d%_tVgh;gRxudv{#O&!YO_4pEb2i6*8p$hKl`zTi50rdzvcoj_X2( zW_T0I&+xssj#T_L-VBkUu3OYq@6OVx2f`WP8|^}dW_TOQ&u~ccj+;#7?&wyC40YXs z^3M(v`t53MYLqHusOv6uwHo|YRa5s=AwymFp#0|!_q&(hW~y~3w?bs7>ppcoJ-TXh zQ+rh*LtXzs$uq2c-Qn%8UN=>)v+F{Jy8flEh68(EF|}9~GSu}Sb+tQDqMxa3@47Bz zs7qcZ+s}W^`ECAAQ^QmtLpv$~lx{^ZqGqyZez8fAX zrMtQnB12sdP?tPcntERqGSrm}D*9Y$YPBk4NF|4gZIJL>Y3hzDWJskTCC`YOTMNTr90K3AG5)7`BQ8G2M^fb!@0*rCOB zjdz|$hPpCBMV~7>heyg7?LvlT_#l)&&;OUVS4~r?dbkxLLtUAmV*lWIS$>|#)DTt3 zkjfmo{BxzLBt2ahGNc}YlF7?$MZyi4O$}3p49)OiC_h7auG|%GhR9G?7V47c%0uA{ z@IWuOLS$%$S;KKjLY^y4by0;3bv*(VeXcZhSQRqVm5sXOxzbd%-fo4+P}ieS(dSB2 zt5hLFUD>Hio-0k|ecyEP9Z~G1)%(nnlV4!6Q&jobP5^jdXl=n>G^O*Q>Q+33K{Au2$etfIF@_* z_Ke&8iia6yAM6w|)b$i~%|Cj#kEuUYAwyk-pkn`ov#6=DLtGa!q@ITI?=0ONyMB_X z8bh5zhSW1q{+*>spBC6_D(x_*kReqV%0H*br)J~BG`6WihNkf>lz&c0t`bnOf5J3Or5WK?hzzNcP~~Gv`dU8H zdXB03s*oX73QA@ux9y7_`^3~7RmhNf9?GBD&5@0YpN<_sH-$}$#;EN*G*N(P}fV;C1>m>!ZkqkQEr9EP*)l1lC!9(cU2)nU1gyP z#-=Vi>ia}v&X)^2YJw_csH+@xWly-PfT`W8kfE;fP_ci)jxv>Mv^y?jNL7IHpCHU0 zyZflADyonnRT0X6ci)|s1)7^0p$ZvNm7rvA$W6Wn=KC;>t*VfrX;cnMjzPW$##FH} z?zoVlu9t)IT^mE!m#UDVt|~$KE>r2ox-Mj>t7=fb>r&|IrwSSBsuq;*GIdE6GSpQ) zDCv^d=AVS!`_?$OLS(3`Mo^NF?}0HjL=`gB^$L{#+@a3Kt|w}SXNM)KkfE-c)Ftl& zm>Tr4TOl&k^(s`(*y<$l)#>NTnW{hDDP*YYHR{?`vcOlSp8CWoWT>kab=7-3-{Ynd ze(Dr5)K#0hhPLVYqN(3iAwyktp!~H>yD#z_FtuQU>q3UQUZ<{>0|xdrHDIDs$WT{Z zD1XM5&mA&_`>XCGr;wqpders8?-Q4rTBZsa>Z%`(OU`Wads9z_eVFz$*M$sqy+K_U z&$Ov(s;MeusH*`~>>r%jGZpPvUA$MPEB0LtTxa{QV`*M1#T%munX?G{eSF{ux$2lQNa~ zbGLG2sH;g(v0>o6@l@CwwN)WQT}^|MuREph%GRd7QiTk4HG`5p@At-E;ka(ALWa7U zQ!@p`v@kRK+Rozav9?qZL$i zZ#Wg*8^};sYpCen_%O_HqIMxeGi(DD-5aJ(t3rml+CoKN1q=;)qu5k;T*y#YJL-~G z0j54wg$#AIhl>3Zu2M|xR)q|y4p7lo0j6?)=~jpgsdu2FuL4ZIdcb;mWuUcTIh-3K>%Usq0SHs=t~_ zJj<;R8BznF{C6$Rsy6hXsj8}wA@xC6q3jF!UEHQdsX~S(KM*Rq4^16ag$(V(522#_ zaBIAMhzzZ85L9#@eh~IX;ji2@kf9Y0rWMLQG}TrWGSoFBD4B-5;usj79j2>7hPs9Z zC99E7=u8!#?N*2kbqx#3cQp-N+f*S#T^|J{U-#`!_b-@gJ;!w+LtVq6t>#I+Vh8=2}k-zj9MYZP@|Xf$t=sTB*H zLWa6VL&@Hd#4F`{HaB&3p;O3E*BI)W(eljZjA+HckC0^)LNqmf znd?G^x;~|@RyV5-G}U>zQ^-))1So%h$ty%tWmY(a40TPUt_j;mJYg#BN~e&av&|$Z zf414*K56rv@y<5L&JVt#Vz+P}dYFIRi*SzMI8Ve^tm(*Hr3~Pv}ftRD}$6eF^11 zPm%9tG1XwTTOl&kHI2ID6FO6yRUt!N)1my1lJ90QRdkK(LWa6#P?vl{XKI=%WTJQJ3ub!=Y=LDrBf@K6S~SHq3UQ z7C=S!ys3{=AwyjYsY~{}savX$p{_+x(LHbK?Qh)*k)f`|)Fpe~)Gk%XP}kQ`(LHaf z^aj_340SD`F4^;@=Bq-6x|ULx?0HiUZ**PAP}ef*l09!~kSb(o_b!Ku?s=!8dmb5D z;fl~Dj}*CPYZ#uFuW1)Dw8E7^$uY<^o2hZ%x#L2Hy1s$(j}&+R50_RKI?Kdui#SDqhS7c$hfCMbVgrsk?bhPu`U<-3}MuBU! z*P^D@s6vLi)Gs zSA`69ZKSTx9?DnK)P~Kj3mNMA4$7Ya{!4wVtErE-IE4&#eNSB-dZqi+RI9B{Awyk1 zK>0I3w|_d_H1+(?P9Z~GKT_B1e>wD&)DOJT$o^L_;#m|p{^~|b?oT_*G)Cv;S@5|wKXW&hjQM?7xrP1U!6jR zx_%By5^~-!wMG>()U_=r-}P4LDznpdAwyli1m(L-?No&fb!~@=o}-$FuEx7u7c$hf zgSzA#WooM`WT@-ccwH&Nv-z{TT^BOcwUfJIe<{yYdsWC#*Dff3-jMgBs)pm5r3xA9 z+D%=ZmGYsOz_&{QXrhbY=a`9TzgxwI?V^$R`Mv{&a_#Q}a|ILtSU7 zOJ1j#diap*LWa7|LHVl`d2McLuqtGz>pXSI>l9NrR3SrM7ohxAio7;A)$FiaAu`l; zk-Fq{im9EdkfE+i)FrP|OqD+3x{#r+%hV;WQ%o&Tg$(VeD^StbDNaRq6f&f)LPhuC zFY)#vGIU(mprZTmkFXE39(Bis3?0{XIxg9VrUt7*hPrM*MfahptE!NpuD_{E_Mxdp z$J`2$p{|=y(S2xYn<`|e>lSs%J~UP0xa&fOx^6>7_o1m-s*s_sJJcon&{T#Kt_vCJ zx=UTM4^8z`g$#Awqb}KprY@*LhIZ6_sOUa)D!LDmp%wlUy8OAfKsfil@s~R;WN3x| z1|>|diU+7U7NZ@Td>X^AGHEpSz2nrCpL?mGJ-Q`bE1W!z$7Lp-!lh46DRY zne-qRrgXhd%nEFhWWMT?c@5+~rOAhr^?EjNwQ}QT~466sBVka2fHh*UL54Nt7=iL1z8CE%={`ce?$CON7GOTj_AF78c$*_9t z|4^T*l1xlRW|$i)zs|79&-H$jgu5-#G6K>hC-{;Encyu!Rt|9cvl&%0?z zhSlRxZo;wiMui@cGk@WjlAC1yAA8>cCr4J?y+_8F!{iJHw{U?p8zm8LW~E(8t9+7n zwRh&+%+B<#2JOxa6BG_(4x5~@$zXB@W55Oj<_>JKi3SYj$jRh<&w>FGki*DGO-;Wm)5VLMe~B^UZgD9Vx_TQOZIZKv~wf zfKbXBvmg817K3`EL?I2Abs?dY<*)FEHXGFYBnoM`tb4`C`np6R4WKOVy*Hsiz>vyU z8yZqGs|$W0ERQrCbss{hUi5oI&wQED@BpCjgESm;wcf1)X#OHj8LK-gX{)BS3${C458ZPSrgt{j%M~nPu^IaBN<%0<2Zk68!6xJ8gaMVSFQtkMYpM3utjD~0bSlAG0II0*U>pVcAETrM6 z5~0q4->wJ$7a!Gc?2;&?;ixG>sj>3um;Au8VMS_)G#s^+P>TEa{$+FqDa7Xq5`{Dz zwT)2fwSuWTe&%ro^%99f8o}w`!Zd>#VdV{WDRC`;TEP$(T~1fK^*^4URrt^jIfebdi-k`L1GQtTv@yWcn= zQAop4vxGu9s+NqbXGs*&aMUhBskQKVzkJlJ!M|RX3u!oNH=)#+^2`UeA>CC;{hUN0 z4M*)^vYzp~#~d)I>-|*J1=0Y@>e==Z%H6XSBnoLbY9FEQ4c0(kJo&qGzhh+WlPIJC zl-0BCC)B+FfxXSmuYD^RMwM$-qL7BmIzT9Q&-PS_LK;9>z0Jjha@W@v0fjz>G#qs> z26eNa2^7+B)FDD4NBq3_$n7o5ZwC~9kcOiU6Y2{14Yd>>)e0UVWg!hm&BdVJCQ(Sk zQS*dyTjQ*si*g|iM;#%QD%WRT^uzO!LVOMY3O`80Q454pJ@)1Q@U15q)QcqwX*lW< zLP6I#q;k7W`?^YMh%|t*B5#)xN@++6X$?OuWg!ih^_PUYxga0<;%jbc#Yu**5#>S} zj(RYm+~e0CK%o{$BP_Hczd<_)jvt3_z<@L-72gzoaowSv`WxGOFC$q zxbNK$hNZLejT`+^Xoxf%RVLJZrL1$O&UuePO-U5eaMU89AnZb)Z~v(KOoO^yqL7B8 zDuf!5sFM%9{HQ_wi$oy}M^y>6NuuW7IXz}j-(W(0A-EgUkPg< z4M!~zN|o!0&->I>26dT4Aq__@6H1lqN#zS3ZcxvbD5T-2ql8kHA78o4H3szwi9#BV zsuAk`vRvD)TYr{8-SF3g@3=vo zlqjU(s4k(@8g}l@7rob@-Xc**!%@cxrON;P7jK_7sH-IkX*lWxq3$U)eC|DN3|+qB z@l%OH8jd`oKR|<9RAeD zzG_e}lqjSDlr__PIHBA#y{jY&X*lYyH44kX*RWrdD5L?DHPd?pq0~(8okKoMJ(LZ9 zCs9blW&I7I)J%`BEAMozup!a_%9`mtl2EsnHvI9Mp86Ogt0qxM!%Kuu>_8~v| zOM`lrL?I1FJ&I5&N__vvUj2K6`h-Lw4M+Vgll7a;7d*tXZr2; z-(^tu`n|9Q(s0zH33Xcm8d`qq?H+7Ua}tF#9Q7DNsaE-wXW+Q5>g(?$3TZg%v4lET z%6i~S@BJ);`ge&!8jgA#q0|oMIjtMN!=Qd4QAop4k0+Gs0nU2WL2zWH;hp}Uum;j_ z)DsA$qFC>|@(Qbu+A2{TFsQBNY2n#*7P(&n`W^(Kiz z8jgB0p;V83?oX<)1W@I=TB4AKqn<)2Rm)%a>`nF<)UEy?tbsHf^;AOLU6$+6^oQPU zP+KJmX*lX>ggQ^6&VB9U|Jk4(E>TFsQBNn-*%I~s`5jQZsK|MgCkcOk4M=0#E@iTw7OTKJS9f?93 zj(R?!lr=tBIP2R6^+t(88jgAap;X`dn|(jB=DlB(D5T-27ZOVK8#lV<5^H|=|0D`& zIO-n>bxTpKp;vt2g>N?+-u*hlhDgIvFCvtxuM6JuL2FjIN1~91qh3rX)xO^K{wFON zS;r*`X*lX7gi`J6bx+!B`Qe)+3TZg%r3`idS0DQ)BkNNVg)|)XGD4{tQRg2Xa;ZW6 zQlgNCqh3xZWy7Bw-1RntDqL6C5NSB-6@*f?Jo4<$K7+bUqL7B8UP&mW;i=!;;F|_@ zg+w6@N4<(rs^56~<=1?|px!A_NW)RDCY181*2h2pPJ{Z6L?I1Fy@pWe8>$7H_{L4I zcRh+8APq;oHU@Q(L?I1Fy^c^flHSYXQEfos2WdF!^@O?tep4Q7G<=Peg)|)Xh8WaW zBnoLb>YoVZw#Iqa7uG-;j(Q`ZRJnLOstqXoAPqdXFqTho`Wl$GO z6w+|izYyv!Qr0U*uYQX`JyD{NhNJ$KP-@QhrrUnyDF*d!i9#BVdMly+T*^A|^hf;C zpnfG$NW)QYBa~_>SHApV)*SneHx$-D8jkumLaEW=6~k|Soso5sL?I1Fy`50Eks3br z6GuU;s^w!6g)|)X4nkp!4nJqV;|;GhsOL%)(s0x}38iMRAKf&*YEb_wQAop4|4yhI z3sFPYyX5-TxcnuFLK=>G7eih3H^WY$SDN#tnQST)b{6U{vjeh*y2K5z*LK;Bf%2(38 zk5JgNody4|p8Zv84)A-4LK=>GKSRA}=yldC^@TKmvZCJ~Ae8D4g#yYNwLcRm zq~YcIAfeQH`H90fdjL|1&+8-#X}GKp#mM@sL?I2A^Jtog+uwW$!YT^&uM&kc9Q8?ty5ZF~w??85OBB*@ z)PFP7uipI_XlhEZrsK1sdq~WM95lXd`C%xqs??npn`8lBQgESoVWrn)m#4f9!ztLX^6w+|i zR|uuJ-}}Zlgutr$*PSH_X#iz;?^g-s_TEv6LK=?xS`6yAL?I2JtZ3@j33U;a8ON0W z{=fgaztQj~5`{FpT;Cwn9nn#{g)|)XZ9<(79K-$myQD0n;i&J#pstlDqydyw z%ikrG+ZqqJg|H#g0LrSb?-8m58e)At^#5-9A4nlSS4b4naMbr1YU^dUu~xoslPIL& z<@y1k+`Y{Y0EN0E4VU#pChL>;eFjXNm4>&vr6?EDa9KZ!k+lm@C<|%0tRE8!x)`#? zYp=ZNvyH5_l!Y{0)=vm^2Vu0Kk4}I5Z3gvzi9#BV`YEB@*7&8=5NSB-XECT9I;$?9y(#|J6wDlVGX3=sNXTvEk84S2r0zpaT0|zO2gq6 z{&p>)hT(5G8lC6g<5326r9>eONBy2q7+FFM`F#F=BnoLb>i-c6=NgC-AEn{JNlM4Uu-o@y}bM!&$c#)<7DL!Ze%fp5-prITD359Ca32t}NJU+@Nfgp> z)O84jF>^Jd8&p-IkcOkKODI*Yo$vhmHw@}A5`{Dzbv=f9$Stq^cZ2$8i9#BVx;~*) zxgK%Ddu%nRk4qHNaMTSnO4X74hNEzP5oP(`N|cy`h+R(Mhc}8r-QsqlmXU_b zx-p^L)Y%#pF4y}d3TZg%W`uH=>uQNY8jku4jS83R*Aj&^fD%1+8{5#$33V>~4SRs{ zN@E97h|kS#FKQWSxU5?c%59DFB?@Uc>XsU%Bp6u_k|?C%s9O=rZHYliy8 zORn>3BdaMX@n5@|pG6Asx$us{8c4%s-HlMn8r(Ok5`{Dzb$3F!edGBOg)|&>E}@h)xNm$? zqL7B8hBXSU@tD8;)LW54d~S9pQ7)tblx2;35Na!sp*8;E?t5QlP%{#RG+fp_38k#@ z+p~8)+MpgGQAop4=Mf6aCA2}^l!kAXD5T-2^EC=-8(;b0qCtI2qL7B8E?}s)UGI)h zGpM`YS;$8kj=GSc-ul9;UT;vBN)*y?)V&z$ocopj&7e+56w+|iy)`QAz0Z^=qydyw zU-u!@99RPD>tjE=@Nq`gmm~^lxUBmUO4S#irJR2kVGX3=sQYP@swE?u`qL7B8#tC(AkYl0;$}T^YD5T-22|_7r-0nMHvDOZo&k^N98jhOOsIYH5 zS)z~zP?j||5vnAu@!Os6JAxGA^B##p8ZK)yp_DavKmSXKLK=?RLMV4XfBxM>xsZmV z?oTLX4c^aRDp5$oQ4i3lur;0~QAh(Q%Nh?P)OKl&#+|Ny1X764CnO4KxU2^eN?C*V z^EbJ>C>PRj)J24H_w(B%3TZg1NGN3u-p@Z=qL7B8N*aaM;Qjo&BnoK&Wm#j2P}9;H z|MZ&b3{r^CH4=q1T-H`XDQob4{=Vl5Yak6rZ6g$xOHiN`C95h?NW)Rn8ilmHpMSnY zAq_{(Fck0SKQB>8!%^EcD(q3W92Qz54WKL=?jY0xXotN`=W*9gB8B*P5`{Ee)=okx z8}h#QpCk%tIBHg-lmsK|R}zIZ9JPy3Xn92OzIW;#qFhMBQM)w?t-<@=XG#>(0Lrq) z9zv<;+=pL%duuoFn-YaIT-IJfDQob)ck-S>L!{xTeS~uNy^oeCq~WOjgi_Yveeb6v z3TZg%fJTLVqhDgIv7ZXaAi`VkBL?I1F9n`3BEng;4NW)Qw2&Kx!Yx%fDAq}9c z`Z`Rg3!#S5dpFNt`S(a6KF^gXq~WsW2&Kx!`@^?O6w+|iJfYnE;b$ZYX*lW#p;Wne zfA|xLLK==*(5P^I-THh{Ur57Imk>&oi`UovBnoLb>QaqTmO~2h*&$I#!%=@pC{-?A zU!FuE4M#m#qr&C7LZXm{qb?(qDiQAop46+)?U@%q{?QAh(Q zt9?}o1tD*0U*EdZNo)4ik|?C%vV20Ra`E={42eP-j#?s=yM4VuqL7B8mIZnGA>+Aaxg)|&hBa|u^_rn`rDC!GoIO?HKLI^xws!bK%$U_ zqgFI3T&};8D5T-2RYIw9@fp!6i9#BVs%u%I0 zYE-yfACoAg0hHyv4s;yDV21eG5 zL?I1FbqJ+unYYSg5`{FpTwOxp%mGKe$A0lC-!-zHFHuOtWgRD!Di?2+?~*8_;iwaY za<|H>B?@Uc>Lj65xp=GmwL~EeN1f8Ba4p~U-oo-o!%>$LN|lSZ%KJ+c(s0zn3FU5; zha?JVIO?wnrOL%y<%&ch4M#mfqr&BSszf0Tpe*nG8$ylBT7LYS_JXp?xBgY4kcP{8 zB%zcwxc7chqL7B8uFxnY!N?lAkFY$_aMYs+rL4idcUYp3hNJ#gqr%p>SfY>yP?k0R zj!*?@jqYn+@o1xASE7)H%X&1Slr^}|zd)jphNB)sD7VjFDN#tnQI92*vIh70uSgWq zaMa^8Dr}8EyRWc3(g4b`#^VWv8UEM<{M}nmTKNFO5`{Ee))NTjwnj;!kcOk4NGP{8 z79 znM5HCM?H^FST0dFC`F-eToB(O4M#m+qmY)*h|ZBHq~WL+XjIr5C5b{BKv~v!p+;f9 zvGr-U|B%seL86d`%lbz`DQnzh>&&MOswGiK!%;6H)V)DYIJW$Fi9#BVdNHAtZ}9lW zizEtZIO-)D6}HBe5`{E?vaIn^LMh)Ef6Lo`hZN%TS&2d#F6(84a$Do45`{Dz^>RYF zt#P9f;TuT9QLiAB+ZuP3D5T-2S87z)8bygh8jgAup;Wne6zi`f3TZg%)r4}F>){fG zG#vFBLb=QJT!}&&j(V*|h0Ar7L?I2JtXh5@p)P}JMW3I4>v`Wp3h}wwsIWZJa9OV> zl(Giz0Tv|+X*lW)gu-$Oz9>b>db30!4M+WxMumHTp)tV;X*lYQ8Wpz2fI-Q&>TQH_&m8V6QAop4|3)Zf4L)<&D^Wz#yB*5JPJc8Nk7j{0{(xqai)5`{Dz^)5mwYdq&Y-@UKV@JAAbG`w6_ z5(*NC$>*k$%#G#vGALb=Ozr9>eON4KD9d|4K&VTlHGY2ZyDvuy@p+|0Aq|)HK|(2O@P7Um5`{Dz z^&vuGxkMRIijp<8S$u~y9Q9$1LRvo4dx}IM4M+W#Mun~Mb%{b6Kv~xK2%+%SDeUKO z)P9_mEq22#LPMnCvOY>EWewhz?<-MA!%-h2l-oBhmMEm*sE-p0ZHU(3KHrfjq~WMf zXjIr5FOevu0hDEpPZDZLTI0!QUHy0=6}}kytwbRWm-XL-Qr6(Hl==G$8zK!yeM+O0 zM;KXelqjU(s8170S%b$?Ztwsh3u!p&Ga41P#RTq99P!%_cBD7Q84_CR3`q~WN~YgE`8MKhsrw#J={LKe~h%Cg2c2?Z$; zWQ}Ls=dQOAQsIlC9TJ5!T-LV;<+es!qL7B8{!gRA)_8$LAq_`;n^10RyjP--hNHft zQDJLbBT+~LD9ak(B@|4N$r_)(=xNpowb_!eA<}SJ-y@XU8ZVJ3q~WOVYgE`8KbI(^ z;iw-F%59D9Q$jm55 z3k{J5P?j}*O{hmp-+1}&W^Z6Le7-~>4VU#BLbOi9#AcS=RVHq0X1qc-4nKe>qZ!&kH09X}GNaM<`_tKEl33 zqL7B8{y-=!mnZ{DQL;WQQAop4c%)sNLPAeL|rP5yeN? zTkI6&LK=>`fkuU`aj8Th4WKM*+>lUvq&3d_$WQMqq{0_N&zC5q;j(T-D7Q7fC{akm zQ8(78ur=;5E6Rm59Q9{}a$93TqL7A{>n4O!k);3yo4XKnn3WZ?`BH(s0x*38k#Teg1NZ zLK=>`l}3fF@mYyN8bDdrxHX}aH6HYZU;mBK@Lqd_hDgI@-G)$ZYy7Q5Aq_{}R-=>+ zjI95WD5T-2+Y!objq~>k4UvYUZm&^cYdl(_kOokeHSR#DMd`ie@<*)`yH`sT(r{UK zB$V44qx*!0NW)Qg(x|XC9xG8u!%=r8l-n9tOBB*@)Lk?xY>iF(g@#B2D9ajmC6w}w z=0)#1juhhaWQjr=F6$gZxvlXHi9#BVx|>ER2}aiB0ihw%aMaxi<+jEXBnoK+&u__Z zump;aD9yRV2d0VidE@=Y?xrw9LqC-$q~WMxLJ8f5hWtIBvG(k4e6jc*X@vCK%WqHw z=W`F@qi)-{{f)(aQbLz|Nfgp>)IAyM4YxSw^Gedt&_Rhp8jd=Tq29Xleb#*irz8q# zIO=?c^7bEmijnmai9#BVx`3gc^TMXJe*d6EAq_`e$WZ5;{Vg~UpnT#-5`{F^8S<7^ zI^DKk6_z4C+YTNcUf71mw}$RTeBdbN5c)j--1?xX9ipM1_QE$<|K^*=z&BVY;+y+c zjvi}IjuY*@iSt9SVX)7;08uP@+e%(xdV6Wd?p@obXAjJl_H|bm{Z?_Ju~eKmwC(VL z;zYAtIp%lT#fg?*@oUHZYH6srcWS}IU%f+z56(>OJ>+fMKez92snw~JN@F{=4i%?o zwolFNIqdD(zin!dhva)_4jr1>G2vzrdb=&ky@%(luf3_`Cr6L0`l~bb^5TkL zJ>r*-&6iiYKIlALt9#9ra>e&*^{RieG+dY}mD-&uh@K1n=yk-;BP9?uTW@#D^@`sv z9jbJihg;=(yV+=UO10JIijZA6Ff%o;$qxCQ(#YsoX=X}UYGzMqcITd*`)78|lvZo? zW~a957l)_!jTGR|J*(xD<>P*cF_* z?P*kw)jGnc7tc&hm3ETEk?;=-C~Bnv8Y0(P!)vx`_0E#l0NXU`Z6OT4t~6Fx8+Gq^ zTl^mNz1JR+6!5pAx3E~QdQkXAMd$(r27&PXieF#u9QFKGtI^Uw9hliVje2?ujc&(l zEQzu^er|Q^SaT8ZZoN|OE+6f9{>h3@#ZWA~eN);uL`YQC)c?M|z43XQ41 z6kN!hQ!`uV3nL|A)BwR8+8axG;%K>33jMehTwv=o{$BKUgnpeO2bm?t-c0Pzg@A2C zig`N%6sQ^cn_?gPvtZw9l}~wf|AZ$h%rXI$V1!sWiL@Dty*Sy%lsZRp45{Cn((`7N z9~|hkwzYg{GbO8~6*wQjs@<+F*Lx5hZftEdR*=Zs=Vr65 z+iLmsj@Dl@3`;!dcaF9iCnSYSCsaGk2?dV?{Mc)DWTPaXqMA0%An>bIdljLsXs7z*WkK zU#+qk3RNN+E|#GG#<9o4QB!#k4I82)CtxZO@Ifq%u6q7^xYC2av+CwQMiiVAxe6ac zVHto^sp=Z>4*E+lD!~{BF3|Rc33TPapwaQF{)!J1fKmi0`uWrXw#?3{CQh@K8YLX8 zyoy+2@TT+1EV&5&b{D*b@dIiS4I`k#&j$f{x@+vTVA1hVBC+iKN%%Lf0(ZyjJ zgPRSQFO=pYX@RcVg~=4uXvy0J6FmAm%<2lmh3P%JcJJK{6(HD_V6KM$$Lgdh0!&F@ zHnJ>!mG-InG@rmuyf`fX3Ui2QL4-B70Dnx2IhMBo(u3;^&ema6mL%jjFu&}Vowr*|j;6H%yro79 zS_#ZGYn@Y2%047)LwCVC<)tx}EROfZ9}R*6VA3=^4F52*r@q;eyOf(vzh3Rn21>_~ z(bB~*MH3#BGhl*2dHXggpgyW7NY#7r*CKCEZkenCj)II6F+Q)!o!sXydKV& zT8#F`VqvAR41K7z%tK?9tT`hrfL8 zdRQ&SapC$#bFx<_NvH~rg{(GEpt2JWKyq0c$=jI3A>Fcv<5#VlTKjrC98|&T>p_AO zqN>+k@%<(aXhYuK&Pj|&920-**2Uist;(-)xvR_(ottgz{@e zx~*P?m`SZOUyT3)&1!72+TMZj9&y7j1^i*l;B zt=Y6&0L)`#G=`c54B#DqxzRc$yjE90)n6)iS0IRiArhDl)~hv|L%Bg)aYhy-9Tj08 znA6pufndXk0(<**qK}6eVB1NAx8YSEx_K(&Y8m2EiYt6gQNBxTUE#}-(vfk9FacQw z{!Xp6;2k;z7GJgPHj6!nR*`ThwBKgpkmPW42UXC`dycAd>s;gdJ^-JDt1E$@6SsGva=csZ}vx;7Y6*xpolR#*}kZq15eF;X2 zo~rTqRx0vgZx$k)tqzPNm-`+>t}D$`UTqbNH{XMivLm`1S z()?<-12J%F7~)T=cCkJ$4rAZvEqBYUY8+*!p_VD8fn{$OqIUv&)S+W)L15Uh2RG?o zLP15N+Yoy7W$9?^K^Gm?wQX4Dt~QS2D$m;vApuy1mLcA=Fg!djbin=q{skDE&xk?3 zIIN-vu*{g6#949BsD-6&2cqb9&q894jGG@+KSVJF^R)_9^O%C`cO6p*|472nQ_L6| zCJMId9u#t*v8iNhg~7&EFwxMrTb4-F%zFXyY2@)z0!=(Qacl#RW20Q2ns)@DY1|&f zejAk<4C*kc>0p>bwi(^mdq-f>fo>f~DfUS))&oO#ms&v_IZU~Cdi$^uc(Ci$8-rdb z8jlUrLE1R&2pR~`j+UhGsl{@=3Xz_e(h;6QJUh#6SOYJ?cm%f64L1fl0}))>!zp?P zyY;kKC^0U6V)|dvjd;@yuiog?mN2FgSxGZ!L74Ez^Al!)p(}<{u(2m59Tw9owYxz< z(fK8-Q47yi{);n2Mq4Ox>VoV=z3s3$>kK~P80`AdUiicl$X^f2DYep#ENLTYA_$`& z%v)jZdwdAPo)wJO(cex4{|XzGhZ`qW8YeKK34iNCJg5bYVGlG#h<UmBhI@gbn1^^f+`rmY*^6St*3~W!^l$c0+b|wIPbOP!!j`=1 zEuc=9R~m~VQnlj8V}yCB;$3lZa81{5c5z~VCkKNKTL|-_o2mLcH0A9E9^fML%o^l1 z^W$dX!BE=F)dtL-$Ss46_d;JbO|gl18gx!j0RAr`8AMI)-GgH!jf3NfTGhu+J5UHq z!$=CjZR<3qUZ~>KVM7Y`51jmZ(`b%VZfb7We+G2p^MKf&haqpr6SW7uHRGfDAF+~D zKNToKB|TX5ib3~KjX0%$D46XawYIjD`56bg?eI?+(V@m8NWfCw5&8qIzg-fyE9H7D zV!MFY3{#!yL3q5cXkH#ZF3e(wIgAX9`&wMN_OBdKS`VxX5>(HPZvxlww) zT8v{WRx*+kjwzI*6i^^I!%09@S@FxQ02?faikTfnIKUJNVDRVn+Y!L1dxn?S=SWZR@Fyf4Ff3I^b;(!h}R5 z`~?O^nfn33QHVFrRv}#oA_pRX0(?u6L3uNAP~&_`7?eZPxAQJhWd zAQ6P17Q0I^$Pqb@FqTOu&A7|{_R>k{_=L=aXmUfEjZ9`h;t~Xw{yWeUi+wN!+QjLD0|WwFOE8a4&jM#! zJE*la7aIe+s0mYf3Z z>FuJqkmvwTwwv947{L@sFlzh$vBuI;HkBy!xYUG^an9SjNP)Kw+> zoT#S?gWIZu|;L#F6R`MP1~pH869jV)@=<2P7E1ls9MSzlPe!Rt4qx(s&h@% zb(o2Wp7{VC`oh?*E2?YNotdjE$;z}x=h8o0XHU@=Tl5b{OY4VcWb24&djpZDTO*~k z*bN}7IK3{Q5Uy@dS=q(3i=0@pX%O%fEiU~`BuZ19Bj?9dUa{LR#`59M(QO;g_C;$-CdE7<=)Ae+X`ODO-*E-$QaqU)uEF({bcicpk-3FAkj zg2JH(mqGo)L5QQnF0!x-%`=aTAA-Y6EzBJqp%}QgdjyIoR@fMi4neF5H%uN5!x0=# zgBzm|5SYWn;KdS6%z;izVf>J`IA!S|Ci29$8fH6-{TBSVfAOJyr4#-g6_+G?YITQR z-fsExUYWEI(gs*~MsxXY+J0M+TVSw|sh@P?iy1U5sV zHxvCMof6a5E)MT$EH6WnIGwLk^^S2xW^{7sOWee?W43i(N))*{O8=6GOdP-?Eam{- zA@XuObccqdByQ-2tC&_^nmb%>A9KT)-^S31rX>D^U<}FF0ikA0W*Lwe@OgD&uPN54 za00G@t;T~w^(@vviVnH9%XE&Z6=&4aq_wIPo4s+Sh59NM4zwD0tOhpAOr26^A(raJ z5f_1;T0Iob0+d`7x_@qik5;?TbX-(qYOGUf=!?m|;2U~xm?w1vbXlV%kX5~jk1Kp&~uw2_sr_s~|E|ZelkJLHStlG({MWc(PQQBgkJLs>}%8RuX z962d(NmPP1u}q8e(9o3EAgJJ+-)^zbWHVF4k;RC*qZ^M z`Qy<#fUyEL;O3iCUc@|E*biN%6~&#_SV?#d72yOHbUD$MCswLzuwW<{4wEm#z~nYB zg|qf0lOE^?V*Eun&6q?+rKYQfgw?1ty)qnQ*#xs6W7J7t0$Rr;QYrznkZLfWghQ{8 zc?_AcuG;}%@DiJ2M>~x=WaiUG8U7tFDZov$dZ%%8WvJV3wc&OMIP?e^`syE$kq38R zn18~381N0;aiG6~nR)Q5Hk>Fst_je6&A%4m>I(f6Bq-HkOg8^sX|#R)uO-l=eN_Lm zeYD%DHcr&_7l?+dD7prZsjqc70J{irxMSeBnpAZdUb$L@alEa6fN-)tqY(HBnRT0V z1BJ2%l+}ZkU%g`(K-zev16M%6FJwI|dm9cGnqmYg&>ry=ex>gDbp40cGsvXb>O}!} za(Ii~RvXW}(t(IbUPxIv+N~dJdtf`7n@7^Z`PuR*OwfcK0gsNc_TqjNwxc_XaCZPW z790hEq|BZQwIFXAmFmTs=-^J2By{N2wFI(}&P%F*BtDr)TS&rgRDg9d>Sh^k`AAAE z4d7KOkok?Pgvk0+W~iKiW=K2Z!qGfAcUfvRR^g})q|MAnT@_=xSX!#iVopF5E#wd2 z)cFv`GCCcMAjOel1Oz#0S}_c5gN%lHw;6{-A;m(J7U`xesKvHMeW|vrPG66f<_^FC zhjys|o2Jl1XBo}M9l#y9HiQ{Zm}QT#NllWX3alqejr!K^666W{)u~lH7awUunkS^%FMwjSac&G@yHfesO>{|@+`Jo6q+Min1YHss(RD6 zI`Ld-1thL9f>ZzC6w%iZ?4Om95_Zdh=pnEeFkl{np%`+DTF|8Gk%hs9XK`u{ClWY9 zGR-;lwr0L@ypsB7wE>lLymtYrjqQ}s z5hYWX)UVSZos6p_PRP2`It5-=6#=9;MMRU5xTH!aAzD;?L2%FrFO!Ur--`pr;>8yc6QocJ#^HJu`zHZc{`R zr^}skEM6YxN*^Aeu6@Um@dM>kD{zb#V(V)0Cq?hW^BgreYKzy9#MLh(_-#Gh#svf& z0Z|Z$OJPBZkm#eMlD!&WD1sUqm=ec>%qkk!pjkD*s-!_JGYcB=;5;`hSe7BEmPrwH zgeMr}O=nIF_Vz-c=fM!3QBUm3L5Mwq^b$yJh*oYwvdMbL{?hiM5Gs?qO;#qIdZQsFyQO&^{iUv_~ON#c7(zo`eGO z)j(1{p(xItR)eC7aER?NhH_w`OgApkKib$Os%w{E6RTOS!S>|vwyiip7t?d=Pnt!- zhysLySG@tJ{+%$~A4TVc%JL4by9P5SJFPOz^_1Ry+8~t)z}bbdU;`U34TT^FOg$ld z0%JGayaoG4nxYT2=DbwWU;7N|!z)p%bJsfcBPJ6_OefJCE=? zy!mNr4s!Zvu!mNG8_VFFz;p%TZ7`K5I@Y5&9a8s{x{bwzUbXipimh6US{hi$eWs*p55;qIJkfN>>hbZvAR{y^R_1^)m(RuPL6x?v(q!Z zx%MJ0KsLrU3|>G+Mqp+LVG@;yBhoa)E}@-mR!V&Rk8;q+)owxdwDLkfND{!RnTb>n zMqW6upfBO@X6UZynS{GKlV=C+fZ5poi!B!9%BxDUej?f;xbgT5XH(C|wfLs32GM#Yn;Kch; z>VW6k5NU@|0H3Y7lCx^%ZkEXUG>jEp3= z#DsOBw-83%nwYyq+)#(b+yj;2#g1A;p~e#W2b)mzF10MXWAF-2JD?8NT_;S2pcxHZ z`~bI6dCTHVEjf_~i4o{XZ1#TIm{8am+X3W?oCbDOqxm0|>GaH;T^AJ9!Rby1u4Qd_ zUD%|8Sq%73w^Lhbv)*}Dc$G~z>mn0FvCVCli%gyZ8`c-Ng>QK^;Z@v{kyoe*AA!L_ z40e&j)wDs&5lh|?HVjc&JGYVU)(2;^vmWKOERe4|JiPUi!q&ZTtRLcyJP}q5aF}jO z6u2HyX}&v?4Z9}Cmqw>-19yRL9hKYt>M9O?160e0E4K0GJ1;cAh3kK0vgE4Q9kO1F zlQ=DlvBp-s1eIFOunfMI4s4E^mqAmUa&K+yz<_wM1_Sw*x<_wLNXQ=RxYXIR$&jKvrUc;L>h|afWhEvM}E_!p&96C zsSrr>DkR8AGpjYx@bGwaM7xy}0PrKxyP8v@i9n#KUZJRz{FFd;QWUrFVl|~Y!Fi36 z1_uBDga@FaaM6dNqYyOr(R;0)^GI|omf9=@$|jYb>L_(joa}sQQ^I`^I1!8JW5BWS z;IcE7`W(zE7E=Vo4sC>Zs8BO?n+`_{Fy!buvyzUTu2jRWw*v*-VGpj(lrkyMv{m3m z9{i0ch-sjNcb(Pi;s2yQX7!0#6iULeVFhotW8PKmO*L1m?sq z;_z-d+wvx6S|~qa+ZWG>W4q~inpq<(%pe}=cwI%s2yl|9I+|WHOMPyZmbbL-^XBZU zjKPCo_B^Y2W2cP&SIc6$$BvFnDv6?UqbA%D?NiO%rwby!VbAtt00VkI8QQ`3w%7%Z zVh)BU8pS2>;=LaSjceuzH^9~*qe)xfjgHCue{i9tib);lp-D%*OGFJQ{I8p z;Vc>IkpVP(*${Tjb9+uHI^s5v*P8+%Iu%Qqf8YwNTB~Jmd~&=}UK|@+gwN>s(w4%= zrV)Q+X=Gxeuo<>WCN3&LKES;DkTCkD7&PdLTfF>>>@H#?DI|!XmU1h4X$yC0@Msav z(O4WKV=fxBfGJE-^5*HVrfUyg{-X9X*ppOD1uCQ{Djn2U3c^ZXB&F&2oHlc{I=ZxJ zVrgP&)8gi8WofLi=x;%DPmU}u!GHZUW?pbvIe`Gt`eQqzhygla3BV+1_jlkW1CRv8*`gav`>`|fzD5RbdL0soHp`=pFlS-(z8;;JYcE==PWDg z^psa_m+(P4Pk!BmoNag=SzgyJnB%6xwq4*xE;`k7d)qL>rqzX%A9&Ud<{faOn;Lg} z4O(paVBG{q9S9$gf>Ne~LLxkwi7>GyB|$!P29pu{mfU)G6`n5cl%@eKhklqinJl6R zS;A`epEw%hD=qyojJ=V!Ki1T}Ccefu2U)muqwq6a?29Ju*EUoDyiS@1$264%$ABQl zkDVk$vBi9Gv@|X5tUpbaqY%<*svC{Qr>Slt_IA1|cRE{+Ue!2F4YwaBS*NLPFb;~B zv1fDZ9DsA)^truZ-XbI z;Kna+wGHbWJe~=|eRMuY;LTtAU12rnf-`i{+##K=4HswA1!*|3NGnOt+781@@9^x= z%1U_=E+nF>g;J)yf zB8FJ#3w##`92$%v7(>7m9%V~-*$nMVh?cq+!svt0PV9j6tKBp_;{v7{jDo$bCE{7$ zVR&T}b2stc995!RD-x&6$X!0$jf+pb4}LJhu#+YU)AXXaI5R(hVqqpA4Wy7Dq^xT=d}q0ueTYCV0?a62qz2SbQkl-Jnh8v+dt z8d?(I=m@#1*{8wMjkrm*gvzxhBk57FSK>{rK#sqNq++Z^Ja=aMImT!xv_yxGKxAZ) z4%M-P6yop3k5QcF1 za@NCl!Hy)IE_kVI;`3K#Pb~c6o(l9EcaMBQ(IyoG8w{N>&mr3MP+D)F7^UbDMg3SF z4!xnr7ZnnnW+Cvf9%NpNw;1D|Lu3r7F+$iFF9AyM9-_i#dJxfoL32^XEXCZ;EtZoW zn0m#$h{zaXv(p=!;!qA}2-Fyj#g$I9Rl}RuNoipU3|9a^@6g37quMomTe1m>)3r7p z{ok*a7&{@QL5wrrb|gJMCUVJhS$<_&2#%EIM=_9X1>;6a^zxLqTiPtXY;rs75_kzz zl`R<3ZNjnxV!C$MXT@jLuf2k;ijF#)G?7yVw8NlPsGn6hjnssD`eZ;fKnqXNVH<&1 zN9Smx+lK2a+HhN$T)0Ql!jYM76VhRz1;YY3L`DHqJG&(LCcn6?8q`@TufPsBKAb%` z8L+o7P!ZG^!v^99DfB*yyqpfVS8$ggu)U%>3)K)0%uM6EWKKf8R1a_5B;vdc zI6HQ3K!qUZmQUBZK}XRcy_J@iOrdhR`Gxh^8CE>Bfi%6-S-_nkEiB7LL@wgAkU{lX~hSwlyd&(0e5vhWBO98OaUxTMl?=yLCrc}HN} zbM3xFCal=qu&PtA7O+v#y39O#b>Xz}l$m?#jz0%+_He-i%Ka51cH=C%>YQ6=kUiwy zEjXQ2bnl>@P8zy*gH9(6BX-kHD-}?WFUojj;iNWL1tYvL z?nJo-ThT(hJ~--bs8ID6w~Uo1Co3Zm$XSF4PGzJpQQqutu5R)-El&3AhLY@)%5I2u zFjNgC!NvAMNf=oD-&P$zN&-yU3nkz+fLXz z#Czyzx0|U!So4agA%3JVIXW@1d1Ab>rBYqoGBLiTx~W{A81emyiOEW}0^Ndph))7c z+PD(%>YWQlC5~A!B;}BBQK7oG{B?J<;taa?Sbhvr{odLp&fC*{dH!b3+@lOal`Nf3 z{(6{xY1q5eZ#5#$U&_JOOqi^EH?e;YxeHc8-BJxQM1dL?T$I7Ht~W~3DQH=Q1?VBy zT`R~E#NZ5M3ku_%F;`U$I<7mdgXW6L73nX)moeJvOc?QwK=X!ZtJ<=5XMn&qsx^d# zQb6G6UK@xamqPJLp9G?idRq^UW5WwvR+53Dp!++}X+5}#ss`anxbr}7vqdJ3C^T;G ziC4YjQb(NBuH+G$aA4UZ@j@cQ@6frJ)I{I`1E0=Pab=L?Erw^2816L3u(CgOqKTUX zGhcNmJCr4`gv-kE;$*onv8k|W^JdHzD2!DXH;--JJh?Q!g|Y-h698w*mfJ&31EON| zmN`!oNGyI-CYPyTJ-n?~hx?XSPT|eHa1B2k`hYuq;ka@7_&v_!1Btp&_3&8ZvGOt` zyLIrDb#a;nZsfGvxyhf5P8UwbDQN<6N^Z`S;$%D=34@t!1k(rUu7SW!rwn&aWhCn5C$)0E?_O7R!dG=2YmEj_PKFRn=gp ze{+p=_^JUM&sz1XHQZ=}26sR;FY&B0e~2E}zMz)MYK^6J6gxS+mrOCdidU32fo6s{ zp=wb8aqk5j&x0&Fy!1yrwuN)?s9S?ojnEZ0*ak&z~0$pwY<4HKDyZ-FE14~RVLv-lLg{nq#?Hiyao`@PASz92}`-lp2Bo?aplmF;9#i^P^Bzd=IB#uIaxwWDTUZ^ zqd*>us(__Jr7%7*4!OkD%Eb7@rip4{ygIsAfyjBa0$Wg#PM-vr)aeuOvc14@fIH}Z zF{iV&XQY&xpVOxnO!K8QPM=ajW~WarCyUdk6kiya%Q2wyo6UnviW6%R*rdPn9?<$jGY`!j8w)ei(590 zZrQSF%VKrQ#MqKQS%n)0mnJHk#uf{5as~~*ttW{%v>5!J_aeRaDrVOO{5eUI{OF}K*z(pZO1$K=9S#H@b(e}E{`#gX}ZT3 z`Z%~eh7+^w8x_P!RR3ynEd3y^+e1@qoi+wnfgg+^$?E~(N)L}Nk%WU!a5%N)FJXV0 zW%Y_#FTJ1`*gztrgKjjo8H8)LKfjZ1AL9%>Dr0#=WUm{u#1y5RgGayNaX-?WJP5vy z0g0*-AiO&RsRakoVel54paYJP73_gyNNr8jx}J4j5aAVJNT3AYiKsem1}9xV9vdN5 zD9^S%wWo$5ZV%;lclMMC&Btw!5X9UfYU&ZgE3r_QAiJlMbFCOrwyPu-YlHOY6tR*@ zkWZ}SimZRN1WN);x{^x3%i9;9!7qMKnQfC+u46G3lAAD7CcS73%0iNJf^_^8RTMBQ zZo($NnM$uo(-sDo!ijIC$}GiRQbl-wf;3jQ_a^}+_5K9B1`tO`Db?Zn!RSRo&rdBl zbsQn3gv@b-)N->HiJkpz;pj_&j|b(!wx24GO?k7%NDh!Ov)cQ zM=qU(MUt{Iszx$o%EDy5r?zk;v2t{{P%0MSa-YnP2$sfoP7M`%^NQ447y{Q57-F%w z!4e2n>-Ukt#4HnN2+oO9<$#`Jq$l{(^0MFB3a{0`La{ovN;j)UMfrf!)WQy2E-?MZ ziB+|+eFZiKOR?a95&|iV6@^11(`K-3Ws+FTa1?|o9^jH-3W3T5ElFGw?wRWlp2KxU z(=amI;|@+^!U>PU{Y5MOT$AoIjWRFQDX*5X5z<7!kF;u#n-GWI30;+afuy&4W`=u+ z@HGh8$TxQW$R9(oeQ10W*{a%r2cM6}nkmpx2-nBwf?+FpFt1WEJxR?!%_;~KO$?IJ zgP4huV9%(c#_~>`Xc#4{QjAMKm|+`uQfM)moF7Gyu=S!EkN^m;)8@+%uAa-6A-rCe zFGIZHBxjC+!D(|uwZy(G;;NJ?q*Kay#~L(RCM_x-ypLB?V38et^+uF!oT=c}-GQPe z6RCcBrn0*Vu;$OgIg~i_C{)MJ5StK}Xj;2R*kIv0f6Py=!6Sz-%+aZw)8kPnM}?kF zkJ>xbW5+o}3M<=HuVFJ7>4!=pEo>zEda;U)=S(K6V$;yX>Nq!KW8WbR|0WGR9o)0L`FN@#eV=O+ob};ZbI&cDbBr|7HZl7l;Io4FGt1?K{mZ#a%zdpoW2wB z@NPu?S-y*_9?X4jcS`ssCEPW;R=FE56A zm1i@|91e6cNgEBcnRwpJw*7Pa4$mC)=JxI0xBtjK@4$iCX=@UDi3uEAz-fQ6yNsuA z@V=bLXwtT+1=z)zzBJr&=yYpTk95c>(u;dNKwdJ9eVGnlS?b1OVXUF9EfO66W`Y!r zr-h)^>~xM?_+nAoXBR@lA2NZR07xHXGu;G-jeD|E^OXL0FhyCTWezdTsy8Zb>YzQiPERDDl8}=aR_Sdk|hoFy$e`Lk(<(zM zzZ6_40}#)GhTej))uea9B09y$XKSo3)!Caz0##YCGj<^>D~+~)NbE{SjXpFCxF!}5 zq^ZMU^~liSo*wquoJIv2kf>WqE{H z#`Vi4y~2W}&mIVY`^z1$*wyNl#wvtwA_ob&b|P6!1T%ju){Smw8Qz16XYK9F#JkzR zr=v1P8R_DmMzaGCij`NA1S!cC96_*Vt5NaW?dfu-9BDrqWW{5n8K39eab)~J`4l{g zR-LVu;DCcGup>3u*XY!iYOvAf$xPn#~-BJDY-+7gM48@RS){^Q2&4TJ$s zhl$9D%)8vUbul3_;x?`UWTxiEHGoK2J}p|KOwZi7b+Kimw?yvn#e;>^*tuWNP{;7{pT2CWZO)tpJ3WvNDgyos}_Lf8B;F-LQ8=#b#G6p;)8 zQ5y`@s?+gFaCS^bnIX>v-58!~cU64%bCq+t0=B#2^_365==1OC^RFabvyUzP)ndoE=pNh>LwNst=#tJ!gELJ5e(e9oL zobh)1(Bvk!=({MBPD8baNg7E~2J;2GKbF)&;elR2-ORHgGFZm7vomc8*Uq8TLaB7V zsfCG|G7k@I0*hCRLcU5FdXf9UQB5UdUY{sP`n*1YOP|-LaLKP=uttwiR@do~EEmW& zQbi0T_Vw3H^36bVYMkb37pqb-<{k+v<#BI`rOQBakA$X!+Hj>2AegHXmE{u7QHi1q zPYi=H2AdBfjFx{!i{YC(qeVbvn#e#BQJ93(i72DuCZLVG_dY7@w}B0?(X%fg6%lV_ z+rS>M(Ni8qH+ss$=tfU@7!@fG8@LbH=!q7i8$HoNP6Hyd75Z5A#)exW_6guJl6jb$ zVOUoOrbkNd%fx!A-rp)XR{QA4v{V0xL>9dol6xyhpQnLJ^ z9h<0LLhqzH_kW_eMYq~P^W*zT{p-i~lltcu*iXuVA>U6D49(6+A6II)S*gr|bbBH} zUMi8Jk3laV1^OGh`qn{ZdSuvUa+p+b>#K$W+dzHPPwcQB)!jIEfat+5bLlyShGppk z>h@Qgu^LBrX-=J;yH-N!v|B+EmHL(jflGbcf`Bdi9TiQ5U7bd&S`u5+b8v4hY$$t2 z*v78F3?xu5SPv*rFPP^a&^CNi2eburkO6HWq1&v&U32N)9nhCWQxlYz+;7}9y}YJ> z0~qR0JXj3X;U zMV&QVm*rcUII=FldOk|A;pZH3%HbV4)$aJK9wpC7vju%Zu z1RsDbaB?DWp^q?psw;j4B$sfUn^m@8PmtG|hvT9Y=&uJz7mjo2&__5fl3QOj6o_w~ zw&6Hg`hdFq)#kv%aZ>4glgJY@O_fA0xTcL9N>u8|p}?h%917TgLUn@qAmd`=8$DHX ze50poj&JmM*0^Y88#kagzR}}Z;~PDmHNMf~S@J>M4crH8^nl*@Mi1zzL14`z3{r4T z*;#^Hs(6Kf_%m=zCreLd-koxrF#719IPi*uh^~6SBQcrC3CG~{pq&Dt)VnQsb z2Q&o8^?FWIM!_wY`JbCrw%J9H*P74&q7+!m`JY3FKIVUs-1@1Z)blu@MQ-yr!ET@} zZIF{Kp?=oM)`mRWB{nSwEzDsB!JDYWV z+)HRO$exKwNWBbHhyOD_#Rd2SgDDTab}33!-$IPzizS7zkJ3U15Dixpm!ksB|#Bg5v^{~O<7ZgEQqeBRqeB%42R z#P$_@UO7q%c*Rt}yRyFWYl{_uxw&Qq4o0Mr-Csb@*1+A?B2I9a*9ro*2)DGJ9Ng{9 z?Kz2<(cAEL(TamSFvbOWYkpqIEx*#});oUHYnAKEK0c6gWPI^dN4|&wJ?e44(rL6x z_P4O^H>Yy!AN0#3w3H6)jEEwjLfWGj>9|db3k|quUz)M&Z(x~X2N8s zfI4irAk8QUZ?gpY5McACahcfgs5K%TR1af~`kOW{ZkZgJ9N#ov9@)HUamyn7dvj%U zY4hSlxjJ%DsYEZB@Q$sh@rA0txMi$7IawLmGB&=rI99EU6eh}>{ms=){-(uAH{MJ3 zGz7Hn$fll<1$N0n9>d-GiCVon+-|mN_0E#l9va3=GRpQBk_2wE4Lk==*1(7qJd#qn zR3UrQX@;M{#AX<#n*$IkMzc)aOFkav_JFOl?(DfTls~E%lv*p)2 zo`wk4mrNC>0`E(6~Eo?QPtQCk^r;_;j1o4jHmV_SL{7n8^P;S zZmrt?e9!;j%2|F9Y80$t5DOQ%53}s|tLnMlg zDBuadd@Q4R8kgoGX@RcVg}Gj>Q7?JBV17q`FAWz8!-eTRyLRv0 zJvCJlY)fz#J^tVF_VrdnnZsLvVbFtE0-jK(324BqQNJq&RbS4NeV9m_DYFdv;Phkx z{+Pyjte#G!!YD!B0!-gQhIfdRg?`R4tCnI_ZLyDgXt`D&E(}B0(tqKZmih7&dX5Z0&wP2RO82I9WAv8rWyf-}T!Db1 z4jRgK9uYWz9?fpR>WR&5;_c$#kD*q*PSRE3i{pL!k_^5K4@2343#!3zSIU>0O}}34 zub!~4#S%co=VEw!k@dI(a~gUWP$R5M>x2 zco_yMVL%O<4RU$61U4$?-_V%u17km^M$EL&zXdbf=ij)P_5))-sD{h5&%f15_NvKx zhikAXWNVXb_jl2BpSB0A1>boD&Kn--)*DPf70VoG%8wV0EE zQX#Z*h}^?wvs&P(rnP7i*j|BeV%9kQaaGDDof)T==9rpO3BxtLo+>Cagl6ce%ZqiE zW|E$p09Ax?yIotxCs0>w*UfogZBBkx`vI|f}C>G$=`dY=lh>_Z~ zYd5SXrDp2w2+>BwFXQPn!$PeNp{g3}i?x=!tFXHwIz&vgWI2LC)wvqBd~SXhwVm~?FPVEDNQMCQ0uMo zif6=3%dB+DHOV>$D6ldNUXU)*NW0Q#`rdN43{O_IIu)I!rk$}ELt=IBF;rH!7(=C0 z^5_XDZ?$n8H)g%<-FgK!ykTuoS{NRl7p)ENEr)+WkAa&8R?Eo-R-%g|!9$ZQbI#rd zPeQ8M7M8l5ZYw-%JTh*6s6hUtRghvDOiw|sNth80NuSP*Ud`6q5hjl4ReKOBmNGZO zrj{Kk?Bd6mB{fb7)LrU!t18x}6Cb=pRY>f@tMr=W6#nf5(7+cm0U=0GMOA{dcEWrZ3H-sgn1%e>H^~| z0nv+{aJ0$H9q?RZTBv214Cs)FGVrjBl>x2IhF8<~G#kz{#o!UJTsE|2ylf0Y_RGe` zGGR6b%!($FHl`_(B?B3+qb2T+s7v3>0ygfOpVQ=ha}Cr$-~4oiOfABRJjmATRTcKG zO&W}4-ZZd~71Mw%W2J#9o4`;PV~vQ(Nm7IsGEC3J>x!g|)A=Q91|dc~@uwr%yinrQ z1vbSS40o+OP6o;qXnwFHl}Cmm>=I9>8IE{+V8E|0$(&Pc{d}B{_}#cyF^YxphDZ{l z22|rE_+3!ctE609V7@z5fOQ?r}$pr*%pd(HD&il}?anXJ>Qs$+n z>BMcX+1ZuGcTQ<*=g3hhiHlrjD0J^&Q*#q27S#rXN>&;t{8rHDd&SGx^jNvtPH2i9 zf^;B}!~qGk>0m-uYM77)*+5yOrG_yxb|Kd?wHXtGxET|}xET|}xET|}gfwNw#4yW@ zCu&t6XHo&TrB~X)7q?Cqp#Qe_Hld!AV=O^+IIjaoHsU0a?^|m(5S0d{gwb3mP#)(n z6w<|_(#(dtZQm0E7G$6>wrZY(;Ux1@fer`Au_-Xa$$^&{35t2B790|CVQR*PT-d3) z2#ySDE|TCLd_64m#lzUXFE&A&_r=WEx-T}$#xcWY3UenNiBq#wYMP-~v4|dvLllY$ z^e?rx?vV@`Zg+2of0`�!oW%yHc)4afU9{JF=brEN}s7P(fk!hMC0K<>(?W-J zaC)fA&6`20GH)uVWnMmWv90!EO@?HPSasO=*u zp|+c(gevn|vu&KZ3T9TOSMMZis4+0OKvdSw4IJt^)VaVG%naJ z&Hy&EyKMO2v@RPLGoQ!`0iN7uHoX>r0Y6t2MMPB-5G&S|6~EkaRQ!US6%

m@yvq7h^IE?h^Ny9fjFMXO9NGVUA!1}m@Htc;F*Mn43de9WvEPeZ9v>@ zN@YRECO}pWmMOEV5wd4?R+dq-GtrjS7b&E;7Zfj=g8-CHwS?z0zqr9gEEBsM$pJpOd`gMvrd*|)yEaS zL&K&8^ruYFqx<6q?|;zsX#H^!SGTru;AC1%e;TQZ7q>6VJ;pxjkGXWdOpRmY%QxsK z`EoZEl`mgaapBu{6SP)&x^#!VDx6efWQt+V=3}a-Zwdbp3aN__HhUt*P~`x3)E+?N>T<-Wu$ANM6z${X@>Utl^A_tkur z!u_}}z9FF#2l{7}j{^&(^7LTAF%K6OobvKv!7U#r7QB>G1=kDLc9 zoV~1ns%v&iAyH6=23=unM{ctfJ z-KRQ1XYP}o@s&OqX=}4MI$V3+>mfDRB4HQm!S=T~=WXr7^4N49jIBD!UFlFYRT{SRD@Di9{9iVZmoHuh19=>6xs7>89BEh&BvG4gDC@@+`YLaEVR zg5*ia%1y}!^M7|(t+-z{N}ZGKWxvC23hcSPO65X*yj_$HD;6Iz0V+3sIz=xxjzU97 z-ph@n&=GEY&5fhbF;9-BqMO}*DjM>-0~MVUKdYj1;%HTLP8_X@&WWQ{(K&Hc6>ZHw zQgw7OIV{=uXod7xA%=?BjyGx+6FpAk!BnXVw-B|0{WA=1nKY&z+uooX40GX{a2#MT z?1i5WjJ?nv^46x(2eW zT3?Hzh5TSGgj$}l7UGnzP=sxy1VPkdaqx1(!M!yWt%_YN9P}#-%wifbbYj0o{0UFySXHnVqI9u#z(qEz<>sJD24m~g0(;&G9(`CVi8@-c zhBC#p6hbI#C{vUZ;>c?#Q|2!+7Uw;GGe~G&HP{1QNHYh>xF>`G3$$g zuvc}E@vI7w&1`pSSav0A@V0hVsf#EH_mriTM8-I|G0 z!$He$*Dl9*R*w6X4m^c)WPI@yJZ3{VZBR~=L2Lh@M=+Yhu-HXz{Dk?TQ_qc~?zeN} zD0GBf>D)L99rNTUbc9{xoOR5TqjE-X8ys0!_TkChRvEX4Gx;RVLclSl!$OwG?h$Ll zX`nK6LFE2+_5#?!&Rm#j)fV98*X0hbJ~L_On6&oKO(}A;vce zsfphup$>-Ql3+}9EeW+Mrgh}1H!Qq&FOGpGMJl22%pUx&1L=P4QjCdVw|fqM*0f{x zHNyQd(fxOSY;;%N9~<4P_s2$e@cpq-)wB&R`mJ}HaaClsu7uR0sBnxaA-yP5a(clZ z;%}+=C#P4&DHftUmxd4CrNxY}=;YfP^`+W!w^gPsh|$vA0hqP4O9ePl4}1bc59d7R z8YP@Ul*r;#qE-m>G#h6-cbnBhS@eVuog>Z)~`c(?ST7j#axhiGBD6pW7 zGqgS9O-QYo`}JxpZ*O0c(MR6_)6R>Z@tfRO2E8jc#>NM8W2x##T(=Tc`RJbBK5Isn zl-yW1DI#dRq&R+EPVa(*uf*w%G4@ZYl`^lq+Gd4$wCf+1gGbW4lrVf~* zH^6Cw-mpO7djnLdTb<~E3*CUu4L6#&1}d-M`lYH?MBXmQd!yA6WW*PS3)A~&WrAC& z0wJBceB)b$$SljPp+r?kIF)dyQ8_kMt+rrQSC6y~ZhIA{=Gs7823oIz#3lQ@eGZ(I zQpgRftKGTg{bn^>XpVSM4KWFFe7Jny<)H?$uCcq#)^4z z4H`O6-li_{PK5n6A-%CzVi7_6BnBFnO{g6A*@Pft^~8!PD~oCx5euq>XouTo zVPNVZyAr{Q$MAuBCP?>uFY z1^Z8_PGYdOh_~S zkq{Pikc2QH&3H&cm~s&qF%CgYR-7G*8~a!sF(t}$y(xjg{x&7tbh0Ud0qdw8)p+}) z3WQ6A^5h({a-Pg1Y9db&q1wumxvJ4FwiiF)_72VYcCcGQGviI|WM&bpgUpPKr8Bco z_Jq5V@m`8_2Bk+4M8{Rk&cIkSJCC4AvvYz5O^+yM=U~spvvVEg`s<>d7tWz(bzUoJ0*_(#!^U!)J~>%N?vs-;QM=Q?D_b)b&rV*;fs<0I z)vebt4=JNwTX{NmPTZ7o!8_E_b&7b7p%=n*dTS!fxaXRP3wB*=BGfdTH4&$MrJu$X z%FFHLH*^%n>bIKfBi-_+^-&PQby?S|_lUMEd7*GU1f z_Xeps>!pCO09=!`UJ3{ctfK;|354z@?cu~QN}D^~5)9eu)nv!DPtfwjmBhW-^eI&r z)^T^~fXYjI_bk2;x;cJu#kPd&w!S{%bxU6#@j9t#eZ-5>Lvqymh!>@gxU6)o{C?fU zi_%A2X1Z3TUpMih^bwbxu2t#RO}r?5#AT>!Rr+-kuZKH%@#COJ+2Gj(_3Y!C$yEi$ zc+|tx4f?&Sd4T$;Vec^B0e2jZ4#Qz#@sBoc1o&R(RMUsYh~fQ?at+?p8s4@Q zuj~*Pc36L+wvZ~J(e*|Z-oRZD<>ap$CqFY-lSq>F$J$ZUx~Ba1`T=FAQ&VD+ph} zwcwc%VxwC@O%`xAh%ZCJ=nupC3M5;>g&Q;hU;!`Zkk8&w2u?BcW2#h*xhh!CU9#K- z90OLO(Mo)hwt%SQxB0rL6?2iKy$xcTi{;9($SfiVU*b#*Z%2V7cX*w5iapEQCl{p* zWpO6Z1rul&3W2oQY+xmN+F$H0ClC#0*gAcwnd_y-nN6_N(BSq}Y6fQGDK%8t2|{^M z$MEp_L97`2@~EWbhP^j4J+pmkZqH$F|ADzf-qhUm?0)aS!TsB3_sobl4EP<=MK3YJ z60$wDkfaDph%U*_(aCXdes+2$aY=e0EFoI29uP4jErPj{A}k>@+xE}xJ3MpHo7=a0 z-~J=}yaNYjr>$H3!&QXBfV=_#z6(mO*_fL+ojIceKewLw=0mRG*Uvq%ENd^%z zQbB|i*l|lMB^5-OYXt_1(kv{!%XP@1hTE?rN0y7B*N94JATIMVkhR+F_$R|b0_bt( zN5|NW$m=6q6&;7`m0G)lgXDZvU&-b-afEh((Nw{i&VVHu-(0Iwp;HfDmT3)xmn9l2 zHlxAIQcmb?Z?q~9{%ZM0%k)yNw-f)1;jcM3rU*|ilxuLId7S4FEutZYw%UX@g<`2; zj!u%|I0|0|O8;Tq@`~4K#BwZ6$SVbtx0MOFjc`g`L`drhnv(Nv=rfiHT1Gd9GhQQH zG~_kVc+c1-WEfcgOOGlm8h;1681t*cJ>T(Ff2amIA!=&Puy=;~CaQ*P%?wcEAjy0;8(Bw{)Z zuHZemV*pq2r>7TMzDP%W*V`2>M?7Q9_-IdW=R{+QnLC8&&X_X~bBe+Dj5#SCu%D4o zq~Do1)|s9&KD27h9C~FlV(9CPIdd?liI$x)XAb5ReJ2Lk&X_X?bDEgk8FS`fPT`#x z#yexq9L%YfM7V?cN3{+LZrA_uDX&dG+-Z2-TD>zy>(p+iw$f%9K(lP&Urb2uWWTHA zV!z8;&N22em-d4GjJxfC4A>J z?DWI1(o)F=)54@IdNExBYtd}<5|IT2Cu(XHuMM|d!!*x%3upC>})y5JV z*2PK8VUFn$wqj!n^aV*FMvQzir*vR*R1zHYLinr+bO_d2)yR}N8KF8LZe@jj+(cHf zKNGjG28E4`mZTKXIiwP0vb-T>Nj&oO$6XpL-S$tTKvqWYpGJX9^C?d5jBBDh1MRan zv0Hl}`y>GkkzGaq%r1CzWNnhXlzH`qx_uS>(ci(;4 zF6|LJZ>^|dl5YX?7sC5YVuE!3Vt9Y2U@=C&wg{dPv!nAj%IHrPK^y7|79@sigW;dT z#PFOdSd1RRT1OGL@G(WNGHz{DjQf3O*bv>HUXe-l;}y>IGB#7({DBMYy)E{hheyG| zV<2&9Ww3lv^?W=V3Tox6JQ%mONekv?`g+ryy?wpeV|XIgl^E#t(ut&&xvHO7n%Ul} znqZzYw<;6Mb6OGT#`+>v*{D#U_eqA@e>rD>KR|T6F^A%)rWxgVGf8rwtJeCGA zB$-L~yN4p{?$JC3?J9mz=V*`Pbrr!>oB395+!8e9*tn%>%i?iM*%TAwmZla&tYP4v zV52V}j7L1#tNafmea!)>_K}{|n8BE%<+v{ll<_WbLm?uJNH0W+9J__c(!PUMhz#>L z&Imze|eVhEv85#6pATT4vk{UHnOLfQnl=AsLi=lisy#rPni}d z#mJNb1wEX8WRnKo)3W)_pi7lE`P1&BlQT8f(j?D-K zEFJ@y8k52W86jJ^EIDcmm#779;gZa;TevhMd<&PQ1qF{_Jo87_s-aM^iYP9sWKC(T zij-5m>#(v?{xXdCEl3qPbPEz@L`OklbRS!~+L%q^eglVFHshU|i1Xrd#g%HxhvEvh zTD9C7^i z8c*MfBTjz`R~&I%J3NgmjyNM*heq?y*07wd#Smu7)?$b=Wot3SnXOR7h|DjzAjGWsY!q@dDw83T6cdbrlCg-O(u99)?hmTTL*B(v(*{PcJ;NajI^ zX$zY{Hjl{7BU>-pn@w+2-B+hpnZC922b_$I42N8_8U-fWF;vU>A2 zzR7A~tbKh*??2~NTG?`4rVe$HrE1Dr+w8nF^=`xq7pqXW(AzGTNAE=wZKxg5Dz!pn zABu|2{7|kTRa~*A(U2lbwhf0AS-xpJq{x!>EG%oNRliTAy*@?b+~!<%o2^hz?|spm zQtY)3qcy@CFq<>Z(i4F@y*BatHt!W%@~E2 z5x{XyRWlZuS5D(YY_(#o%<}H0(?lVMn?$OT>HX?RIe$&nJccd3hdO>q>UV16Zzs)a zA4liv{ps;cRPRlXXQF!OR;1=-22kO#Z{O+nO4O~O1}C*hYNS$&#Cv;ew3vmfsaM%h z9BHO@r8ojj)n9Q0>h3EaVcyHjapFm~Wx8N-#F-peBn53PaFOJia;8WU^{lBVz?YVo zE>MmsGYVD7mJ5XnG`YV}QM%vDQut6vW;m<8_3v1RV1Ws-RDi0l>v$Pf2N1noyw{vs zBrQ|%VI*$K;Sa@lTUdN3S{S|N4{5|2)Bmc0J(OiSo zhUO2Z(w!rNefauND%;ziaa%q{U&tiYk@KoC(yArnoUUOoU#@0!0PFh%7mQ@F63#LB z5H@|zscZT0;J_fSf^j?IydqAbr8U`#`x4RftE>tJofp<2pQeTev9M4PlM|{+cR*X7 zX-2kb@ANM`s4v~$*_}>R*H(9>JFBWXu~k<0%r38}tH@OJRMgaz*W=4THHQT8;q8UN z`E0SHj={k`X*~`81YTgTrGF#<`ep4GW0@1i-DyUva40!CKqS4^}^?wzn5;2$?`)KunHOh z5NGi|k$L@XBqlmnling#r)km~<=hjS^rqRncaz>Eb)RudGK-C$Z824bs)s%4b4zQi zc(=VujF@jBd8W7**di@78nZ1p8|B7r3pUlLX|`Y^tu>GKtZvJ#dA3Lk<(g-UG*Vsj zY>}qQHP04lq*n77>u~CW2;JS4J#{rbH9d8m_1#@PRpp(T*)-l!ThZBre>1s^b1YU3 zbNEQWeVD_C0N*1qg=nZd(fyI8!=lUFH90=O^(V`yl02RV`x9rBh@yzo-RAVX(Oat= z9^B?6%;dPDC?{8&4MmY^%8#PR(=){B38c3V{XDMqC&iQng{fonePQBEPA^Q5?(MQn z|4?7LD}#rrSRgv&yiT+DM8p5y$L6VWYzScj%uu>_n3>N$#n?4CfR9A>W;4TS8Z)K= z;39n#lGn)?ou_sD-802J$Md6%%$go{1Z#q99-e7LeS&ACsm}SRP!3P-ytGyOALZyI z&rws$`%zv_^1L)UKdDA)#fL|`vS=+Zc^ebS^f{bj=C2MokiAiI<8!aRw@+<;5&x)IlTQC+k zrJ?S0HeIHU!{Vl7dN;rpg2hdV+oX=Z;-+K--sngs)q}giEZxrxjP|Fnl0z_peeos$ z);ln6c^qPp*MjE1hvBni;erLyeBbaw%vnqKWia{IGCDWO^fq_(Cz8r10z<)KW#18Ov|Z_w-T0VBOkgRxVnVAq!OM_&VZRCLN2cNgccXc#`UG_&Q*na3 z(X!6u1ob1=aiTkN5(Fe4nVH~@G=I}(f(9g0al-d7n3j{IgTZv2@cj#>XdzA}OU6J+`uM5uQ5HYT9Un?4PMEwrpMTvXQRkneI_MJJw$^*&K^$;4$~+T>GRN z%X=J(k^g*G>-b-Gg3*O&_@532qrv~*_JdJ1q!tYH4)kVw(|x_iVtJT;e0RaL_zIiV zhjMMK!fIKwMVt3`7*%NEOnDH6bWt^yVx|>g*$zFgbCe-XXPF@Sm>iUZOH!i)s6x9| zWV&VNa2wT*(CjZSH{HA8Wr<=*G?cX0ZJXg8y>YJJeOO>|>;JG1+^csVj?DFS&50Qb z?zQ{>j2pCSAr;ABBKP1ixL-tnx(BOsVF|F*VCPYl!3D|8$VeIsfemN7@VOdR%|~f5 zFVlO3`ChIi&-%-L5_bIFMa~!NNtdOf!)Z+D#2U`%^qSiqyv&xGkE5x9!R|~@d$p~s ztTEh-K_TV{RNLaMWHFOdyF^>Wj9ousUdc=;$2<=dZDMG#+z#fZ3tJS;?>RPo^x@ zgy%}Bl~w#T=MV4sQbllKCB3L_nvGf!jNmC42FNW%4>nF3m5tb&Oj^s4Kbdql%H3qr z+9;0lt0Y4hEWxW&=I*cQH7MM~z%g5)REqG|aY)HzR8P7O zU+YQZvksfxs?DC1$t)~XFiuu&?vym6w8zP|P*(Pl?Ez|fh^&jGaX#^=CPU%9D%E+6 z@ys_}RbEq`uCD5-s;H@(T~*yvRa0G8SB-BfU}!W`UWtVT(QhrzDiG8uE~lmY^~be- zQ#Y^cv}KsXr&?6fhy1n-gZO~L7Gx05p{gw{hqfStcn(!>X*sk78Dum<@{J37XE?P8 zk6~1=`Z_K$WWIm2-SZVDGnaeM!ctP-u@)v%p}lce)lfDm-7nwGO;R(AyU0mufL4kv z_ko3lD=Pwdk1&i^+C~ZbP)wKO|3gv2h~5t+c`f#wMoz{j6zqc-<@S-0@l-{3i@dN! zVNI&*`Ww!TvT_9ue1q2fq|x?*-^A0@DDIO$S-EnU1S%U<$s|yAQj{>)1v(~D0drrb zVp5c&;l_SR7l#>+0j> zjXqj6KbyhJ7~xQG0p1$zNssnrQ~Er#>@Z%48!pEw5;{Wwsl|A*HHR#YPL$k z^blsq%d-Htea6XbO5Acd3%*f#4$dfa?I8u!aD2_ZW zLmJ9@2UZTQpzoySw)zfx@_!iK?9BB-^Bm9*A#EeOKNQpD==e~SFoNkrNnVRRG$(zT zEMDYa-aA4sz&7FCq7=P(kN5X^6JyM8_OYhbVp`~eg(X|V=k1IHmTqhmJ?iE+y?mv;Ot8>hs$Wtf9HewK|>Vp{cq8l!P==$KT0rk_@}N)6<* zd{e4bTED4iA|2GsM@e~&DYK6G%hMIq`;_I~naDt<^3cNzniFZf3D#~lp^_lwa zx=dYXt!t+`my1n}a9)YqTG70u*gMs^*r4uI=OV$>4Ckf4mVxRXp?^($bgFX|W@K=2 zl#?^OI8u!aD2_ZWLzKNLA4^neGvV1{LfW0KpX)sO)P6*W{(L@38=3uK7%qp#hoOTJ zNFPS(TG-{%()$RBV)du!4dG)9BO^jQXV}Cl|#I))I{prIq!-J{e^Z*tQ!~;{ya8sILh}Yu#kG$5ct$3-* zORLv-iDn;H|HyAS_>EUiANfs-H0QcQ6>sdr_aDVu&hhq<-*SyNqcL?_psuio#(7TA zQZB5QT9nhudJ|P~^PTWybGrRLda_wyz6+mhx*LU6e#M`!A%vxSSPz{4wJnf`(~6Y? zcuS3?X^JS*9O6Y3YmdGn3O5Hv5yfhGW_h97nq7In8lQ(4BWDU#NY0Ex4$~vx=r z%Jl@@6LXy7Z~5i}WMFJYUX*cMk~5j7T3B%NSvMZ3X~t=jSgkdyWx}Y|&7k$Z^|cHQ z>vLbsu!o*Or#oxY?$eH0&quUm{!JW9Qn&6|WdRpYsI-lQ^$=hPNv z6faY?TVhUaVMggKpYhs4sy{t2ipu?%)XGd3Js!dr6_*X*gMmeOC8Bt;HN`Ox!0Fpy z=sFFhyH?=qVBM)~dSnGYyBey+B<{tBn}-*2_*z(w0!_X2qA6+XycbQfsZU=tnOY|C z52{F?Zu93&%a>Ekoi8-jmM_8OAx>9Mnp~Mp_p;})-p_=?kwe9&K~t?#2gy8d5#g7& zL`}(@107%HDr%fN$txhtokSKKe<*SoJFugSPrPg)}2@q(NK#q8tUvVN)crM$i;Vpq4ACMl`c{38X*MP2caM z*Frk928-FkTP!_;QP)^MY?<%%hUfEELH2dtg0zXrc?&SlP0m}0k;i$9&~nv0y*5u_ zma)&G$wx*mS>nN1mqm&3K@9@xNzCE76K>FcZD}^B8DmcS3JtyoV-^& z$~P%qe$bWA<<0Ya6VvY-#v?IqS&l0n6=vBuCB`kw@ulg)EE}i9xMexMG+mfwvCYD!Cm~Ud-vK(u|d=ty7Cd@Z6Zdr~sVZMoJ z)d#wQ)<+TaK*@MAqCLUzd@zD%A?(4BF-k9vxLs*}Kys)MfRQ}w(87dN&*VPqQXgK= zgeaNb&b(OPc*Uj$io?TPbld0{l z=8h*hEEj{Dm_a7Jzmdy(Ow11TTPeQMuSD|Z#o$~=IDJXPfbB%ENbiQA=HIe% zi9M0nVrd5=j?zVd`#+ZLBkTb50{Jb90}Po~)8cMMyWO+25x$KEGjK5bbx znL2ysw^7FLhS6&+Z(ny}F82h^GXc%LaIS^P8UAip9Xj4F>e#O^tKoQ)I3d(Axkq)= zYBx=Nmu%-OcZ$~j`esf@H>m>c{`}tVV^YgT)5F~~V^V)}KVp7G3ON)Cnx2!<@*ufg zs3%#LN~Txfds28eF(}et^HC%8CO<+bf(6AEq#9Rd@s1_tMpZIgjt{L1v~9dnS&sEbzKLno2gZ8L-7xc=h)ZWEhwi3!W5DlYeUF-KzQh|+?L#yX zWMm$e`NA?;K@4~`q*C-5^u82sd3py^L&LoT*`CxO=Yql6!Rl0NC;+T3v$`w84s#dO zhJ$ptF_2C4aTXt_HuC8N;hlkV0qy{pp zQhk|$W!dF+`Axyrcw1v6+SU@p1r0T6x}u>5mo(IfYxG1`riXje1Ne-4S6604e7)VQ zYb4mz91k^z5J=6BS2lzel4dGdfmGxCkShSM%q@435UeK|-c&ZWIapM@H)SRwIpRbi4>$`D#3NMdQgfjWgH|=!a-HSJeCo*tYa?n zKs1G&1HkSkb!x$S;VAWKl|_2?ur*D2yeX3FL&?xiYH1k9RDxMNccn+NwivFDcC;j7 z@fHzvj4_9ragim!Ooz=LGY;F;HlGt(8;2Z~UX@9&V2f0kizgNCwqR3BEY{Q%YNGOz z(mAv8`ayQF#Q^D)*$C??yCL##${Z{>pqy3oyYi8CBj}Bye`!k9QSy(AfTTN2} zuuXAXWn5iq-Z3NDOur(1vb!>oOg1++hFXFRRSh-V&=IE#n8Nn6R()0Hp|1U~Rom)v zy;4$WY)wK5APvQFRU&n%_#pB)lNL_F8&%oNvcchFDlPd+?x{~Cnj6~_iA1nhTmlzK zmj@fF8yfo2cu*55os&f`h=xO`3#D0c5iC`K4%BceJDl##j%ZJWfUydPKEj4$n3r1> zj0F!5Rv#LUgthXd2m`%9sm`H9kzpOdmc~dssu)x-!-Fd_Xn}`@2m5cX0U;xy#jj#|a@mb(tG{!w;tAITwR>b%q@+nbs@LQP?jf4q33BO4kS z!N&#=_1);l(b94;OXMSgbXO+JKKy4n!SXp2j3!#+?QM}(-XmiDLBz&Dy59(%nnb9h zy)DrkWUJ5XK~kM)54D6Nco!>J(TfOnu4}@u=|*=j}qBR%61QSeR0(FSQ)8 z#HxOYR&o2gtX@mW=Vf*LzD7@tH!Pi_J-MpMdmXM9S{eixt-YzCMWR`C^kBFu&U$!= zvv{Haal%6s^R?|QvF1diBY|St7#|qz>%+e-yjq%@=^DiBiy>5jL3ZEJ(2tu4R8Iq4 zwDjdXXwa9*;D$4 z5B8^r8Y)oIY@I!)Poy$eN1{!k1&R5o_KpSfQlSNrczdd2ZhKQa5#`@etwQPre2F0( zXwXuKRn}Ig7RDpdqNmWbZ%-vTWeeUqPA2=M;!H#{wdh1h469XAo{NGGv4{o zz1J8IMv@(gL_FF=#!@XrSJA%~pXmpTN-P;{Z%anv9UUz}`YcQ@I?czjj`qC9`5njs z{fo3(wb$4bgyoH~Bt{INOCN6K2L_Q>UFd{l(ch7-|_SR3wp z7Yw93`#@)@pFvqYFgVaKyA#dA3YL2RV7KYQc9_>1N;F4emL%DQBBdHW+=2AlQ+kS# zwqPRG6l;z)w)?oSalUb3IGAh-hgwj(YZs~$gOgHoqsDcyU|U-}6pythwCk92Mn*eF zx`ul@g~jNj4Z!AkjmCwEV5GG%-qDz7%JITB^zb@D;Yc)+UMmU(is~-8<4XxH2=0ZYXvsbGs?`%_g=6Ta)OCwzr0I zOE3}+hU2luNMmDjju#?SJ0fk(Z7p%jg+f6sR(mjx#%>X{5JxAfqX|9iNKE&sbMA+X zOl(Y|XtcG)+FRNz=`ACd@^Uep=~~%Pg9fE1Gc0cHsQSZ|@wVnrb5lf5k;RSa%8|?f zikkAuNOKeJ8x+p*N;A^h))9$Et=?g#ic;*5W=pU&8fx!oZ;E+VHw|U6cB+H)NDsrg z$(9I~@JGn=?*O>hH;usv-hph5gquAR!!m(r>W%6nr>ql!@{amG-rAA~Ci%U8Lrw39){nqYkP#fHy%KHVM6$KD z-P2<|eOS3ucUfDot%>G?!egw7WM|Q`nsPA|Y>u@hTN+yvp0d082FYXSlsB+St-4^kXdq3u)7ULkDWiSbI}zn7SXh zo)t|a2DM=fjC#Zqp=dJMDunTR)LI%O)x*K2NGuUaHhZhyJ&2C3p?WCT-Vuq0n_?kz zYAC08PGNNq^ooU>;~f~W;lUt=oaC^hS_C)Omh4N0o1!69`oU!H$cU*5e?64>t9U>ZUXzN<#6b*2a#c=apFMdY(}}sLK_Kw1qm_gk@U57_wV} z(PV2h+0>k?>~IvF{pPk%GO0NjX;VLtsz-a~qrt$2fw3k{6@biPtc@HRg!|Cn&=m_O zgNZ~k)J8YvMmxqXa0?ies8}qSj5Q{BUFdy5C>X{7K)9{F!$^lZPkI$9!Z#8MHZ{VN ziDvKi5+iua_}DgUNieR10@&Kr5fMr74gi{fnsh(i383SR@yJemg1}k@MKK^04mBrZ z-kC#wpKEw87Hn>9YHv^AO76Yk47voo(d2iprm7B2Y@)fTBZeVE;c7O9Ya-B=Mq^E( zcsLX^4LvfMMw$_HVw)2fzS6|7^Khjs4N{sC@kk7n8N|6|Cqh5m5^qknH%B}}pRLiZ zYttS?7qunShMFsu9_Xgql+hu!z?W7Y(F2Y&b~J|3_v2Rc^VS?_4x;PX+!2e!b4))B zZ$uL4oTF~g6j(Lfiynxg3c?*udq)SlIa+RU($X9?L)}ma1Hs;%0}K-5&R(+<1vS#q z)*fz0z1u-&M$nkj+%?j~7Und3-O&_jY;HB4Ak!VJ?iPJKh6aor#@F44i~L+<86v^+ z1oxDjhl>29rCVeS6ggaG8P{RY4a^VebU8G@g^GvAy_4qdvMl!JE6X%Kg!{d4dvixT z-X8J{WNY{|wg#J`;dnHhXhB3|Ru7>&OEnj&?cSbVJmA4R2JPX0L%AMxvzwzyv@C7B z^PTR>;>%{1W*5EPwpe?#wFT{>2uoI3TjWxUi)Y@}3)_Ryw#G2pl6FyW(_+w_X@bW+ z1Itj_+3mTm4*Ec`L|Z(8N={rffCp0;DPgwooEo7RXC0tk{kmi@*4Pw7ryLa@lo=e& zE*m5@tv4F6NK;!=N2}Jfi8~Zi4++guW2_xz99HwnM!Sn4=kXd)PZRe@81cd_eM?xt zRJqfwW;eC4R>NwO81-vuiFX8h`qIlrEQ(=pr=tl2HL+NG(9k@VZT9n+PmZ$um1(uCI0c2z}lxH;68K&xhCJ8qtvBZ>AzM?3SE=2*C^p{yyPORb2< z!srO0+inV(ibOaPNw%XG3D&reLrscdv1B}kNhhYZOgMsaMHh>~sg8Iu(%9D8;Th$T zOy{W4M$c}IBoeJnxaZgI?0Dsynun)2y?ppvvabmIC{;;tMISWFMFDuYps?TW{x zO~H5*2n=oDb_CC#spKI1@uvsF08~35VAz8xyp5O|8qEeHNJr!ex@N}r92}Yfu7%J= z@ffTKVvPq6s?|t4@HNF&3MID%q_}4f=b*m0kV&xg9Y57aQ5c<4=1UQb^vX>%sP+e{ zm=0`ibgBBP4CBFd8+yt#g41M-QdQzEpt-H1qcxZ??xreZ@z#!xWIGNTBPf-qc@ixx z7}he~cU59|tTEAwc`JQHY7xV~QSI^+RDQ>mIZ?Zs#an8TL%?}FN%Ic5!X%r5qX}zO zq3#*#OAQQ)`GU|n6~^cneTxLI*!2t!ccF=6nbA=%nsCggFdlXAucl$4A$n|7Rb3;0@I{=vZM` zijI5fca%|t0_2`DP2kL>g2gzf*778R&F%5#L`N&S5d(PUnxPL)sh@;u^?~(^_o}%O zdUc{bj5oz8-AT8{Tcd65ks$wQur^MrPp(4=kt%wWV;`UAHN~H=>-CQ%a__Rs9W&8t zwRe7CLPZV%&vS&$71FNqQS|s#RHL|lYESsZBHc$d<1XF!u$ftWk?LDhfVKwPo7>u` zmPL1-&8=*xS)Lxj^S{nf_N=$2i^ii^!SQZ4 zIFbyv;*mf%ebozhQpx%F(=L}NYOTU}+Sb&89!Go3a3sI$rzcD!cm|L86jU!*;>3q} zirDqxXd}AZyqnu=Wj?bkr?)@M(XACt9|9Ck@nMU&s#=;^ujx=F9cR_}+)Cxq3cCHr zFm5QQJYDTPd0tP=84(G40fr7alEzGVo)S%jGrt02PG4rZWyVp>9ClpwR)z+!L{xw& zHRsb-Tb((khB2w$lDKi$l%#ynnvi_9S~KPE|eYP>mtc5 zIb36RN^Td2f>lj40+CakAyHh1c12wc@N@136j_H6X_p8^Wg)%oV7}91wV9@MzOv-3 z%2$q*dxeRyXJ}#aEMcGTGa0ASkgq)1^AxlB%96ZaxF~xL6fRTG1!^)p#>-UB_Hmi) zQy-T|uJe6`-9x@F)g6Hx#}iVj0P=8$?~7%p_`XnbO^(;u9h9R0-A!6;o`;isUMjoD z=Vg+Ea=Oayo?I`tH(MSK;_B*dMRthh$MHH#17v@@!l4DqS)AsW%r}j_o6lbvKwOSDPb7hj;l@>Iyw>5 zr8bT3qUV|6_hecQC{K!HUCtRPyFk^pS1NT=ZD&N14#$n;9Dr)|6kz6ky04zL;+#m>@r;qGBSJaLUWnIULbYbB>YPZ{`IM2aGgGa2)myh!aZV)ac*aQ6 z5vjJn!LFxhKP3`$I$@;eL{vM^zp&jGd7yeRi&O34_}aVXBR`a(zen0!s2B@kqrR;8 z8xL1C<#6|?IxUoPJ!>fAidFZR-kP=!3RT%piG-a_7->2Y)qdX6W}OOGQ1g!~q-9-` z$wIwIid79bW9aQeAR2G`%m(YL;-XjNh-vD(NHVh6>9urObx&dNz4`@q;cw}rrljpE z-LKLGvO*3QR$FHO*ov+Ftfq+ljL^jCgpsX|gf>{4Y8=k8C3w2oS0{Nv;NnqCvFNzs zw5FHxq~;{mg*HbyL)FSR`uT|M0{NV#kbGR|qCRXmNqrvS&Q56SZ)nv!ue~g%wDhGb zMDog`M(WDbdg9Xab5X!}>e@LudF{BAzV)zO0qc20tII+LbJ=18_H_)vU%FOVX?P;z5e#gytj5L1C!kn4zuW zWVPj8a?@ljbD4BvG)0`w3!U6g8|wMx=IigT8*|HeQdEJc&T5LP&Iu)*PgR7IaqV$$ zLs^EsYgA7K2sAvc)u9Cl)16*4S!VwiO(?R$ z-qV(*8awvLHO_FHvn<^oUWnODFP5}dO#I1Z7NdHaxMp&3g`50TT)~EOH-}tHj%y1@mX4G1^$8b#t}r>=hkV0}zF~`Nd|$=uKg*XY4}Z5O%y*pJvYWPIddM5XSx(Qsu{zMb9&ujQ(n1)hLinp7Vr4E zz^OoJ(>8s~c{au(t;JfIJ9)`9IZII?>vP6)($(;5kwsdvpvbbFf>588FXezL0(92o zRaegNln=~ey${|i{(Q{n&ny0Nl56smTZZN&)9`AMMOt#8$g;h1Ycsv3Jw|+O&~XYkg)rZDf+|lF84VS7lCuMESq{B+RmFXVEwlM0dJ+mlA)l(!=#5xM$N zx;#fWDzDDni%K!}fi>e(Y$hvNmCuLGjPr&WE~hPex^P~tfR8ts@@lhlk}G>eddXR9 zHgb|Fd9ipR?Vc~5Y_Ht%@wQrCxs{V#pShKjOnsWvQt>u2VJ)? zCQt@aDa_>R3szT_SEkErdMeBLrX8>8(f>b^=^Dk7ZpWm$1_xL4(v_?G`|(|J%T{Ok zAO54pgj54oVpS4WRjtITC9JyEAC?waU5|B>|8Fd#ZeOUqtXErsJTqKIi)Y~DDtHiq zjteam@4WoF`*o^C)vZ?;kA{upwm+bvw!D6Zu~pR7&z@adTTwpSI7WLF<>j@twKHZ^ zRn%8jvU5wf?>_xMQ$Ba&wMVV_;#PqL(*kUp)jf>m&sJvm{{n$yw+aM)daw3B@$dH2 z0<*elb*Zv>+L`;Xv-kbl|Msay9r!9xYq^iq~A;6rau%2Z1rpGVA}>iRl3{bc(q`NqfNz?I;B+&X%LV5Y&m$1Y4dBiO z^XorxZd(VA;`w9G1Ol`1qs>XbSvc1S=4cOY4{*nUxyXYfy?+4aryks);BEjj^;zs- zb1J{rLGjsOUV4sUj@$-RFuVUb5cuo!oZA`ysQgEM`M(zeffw+j&B-r2;>2sj{GDL| zY8DK6)^hY+Fh3QXRi2f*0nD9B&d6U%_aQKU`iFPAC%hO4ti_Kuw{*V_<}xK`P4~xO zen}N8HaB|@-xvt=;76NVxusCB2^j z^EV}Dq+1FBuY=k2Do@v`eft31=Uxj0c6)n5+!HomxPQf!2C;aPJTHE+)n>SU5+1Z zZd@OjD?PX`K*qgb{w_F}Z;As$KT7vKFm?aI4mPKBN!|i5D+T8yuM*suV1DJn%>ef( znAZho^|PVhB5?15IrMGpU~|e}a_=!<2Hs&GkGKQCtnlED1-BN=*6(w9Ry(Y5`Ux<*C^@U2_XKmS;GFz? z5R&^om}dm%Fx<`HJFP%qH-Xvf1MFb4=7(YLaX5DXn5zWmWXD2q_ksERCX$B!Cw@jfZpfo} zs{~UgIHz=p3xR3!;Fg2y0CSVzoZ?^(xaYv^#w>L%mz2MaVA=%dq~9Un7K8bw;GD`) zE4cdvgI%_%{8EZDpDHN{%*2m2r*uD!bNdU1f%v16Hv`9mKDgQ7mV*1XV4eI&ez^n8 zLxOYC?|g7ifLXp3x5HYm8F4^ybdzAP%QlrAWjJ$-5037Cp9S}(V4dQRxNWyC3G9L& zZB887`(-fof^)K$><9~nZQSEvcPMl|m}{nTj{I)eVQsf|->xLEFMhPqUni~-%ppFw7?}AU+*gp!kzj6C zaz=Uk9PGFY%yZj&+tIc|N#Jn&Xmhip8_bXo?pQFVdvIjOxnMRbIm3=iq0n1kzWxcW zpVR$5wQv6c^SMu|>@egl#OZy&oIp1O*qrLWIu!IDg8Ac4oZB6&Q~v(zQ(!*LIr{6w zZ4c%%KDZfR_E&O-9ZQi;Etqc#j_M_+bgu`qUMbIr=NoYS17J?xncG3*N`^cm-6kA= zTQJyVn~KZg%pspC3H%&C+ML=;O6PenuM3X*uiQ4?N!+_&w*4%Z=foWeZW@>Y!8zsc zS>V12X6AG*&xzX)Tnm^{!8z4e#H|H$y$9C-?mjS6cj4(;^Ud&c7r4E^d`)mp`cXgU zS}+?0=cM0B;5LCdaaZ?rsUQ0tFpmn(N!}80&w~l>#^pKXFZpE{%q4LKR0fFFatigv%oy;!BKv^4Cb?Y@N}L0Li+6oreAPQ`jNabFgN&+_W+oW z&+xYQOJMpuI4VbHg1O&=BRl>M=8IqOPPZA%S|8jMU|#g#zK7(d&MXOBxhGF|C+K0s zl~M0fy|$zb{b&4WqrXnvFqjj4a9;!S4JBvPFHxj(DVVi6aL zI+gQ-z%2xGzTlkVfa>EP2?o1tQ~8CspZMTNpKE<^hd}*bfP3SM+zu*NM!H5k)A8Of zp*_csHu`IDM!YxVw+==J!6hKZAM0 z2lpPB9je{!CH-~=vzHI<05A<69Qh>?J(pK z7XdTs!CeRLBrxTTJngCYzmcxtm(Sz)O2J^4Z3btg`$L@hh7ay2aI+)c_L5&N_rc-O zYT!rUE{JlOPS1ZSu3iK4p5UzhGwda9o2HV$j`-2$#_a}XA0=n_(AIp`Vd1ap!~ixd%5B+@oOL z^x)nAH!W5YD2a1>o%(-AgWDO*=^orLxQoDiyv1D}vrjO%gl#H&uf>@?!TmIINvX{6Zm_vPV889n7xKSu{CYVhLuAjAh82NiVP9K&m3H+|j zougrw1KJT+9h`F-SE2gkbirVkZ7M%g{;mV}fncrmkfGnc;39|OJ{~{Xocwnv&YcYA zF%OQ~y%z*S@@P}(NBRD`4=xJsEpP|Ub=Qx$HZWiJ;C2Id1(-VpM^aV#QF(g^%&Q(8 zJzsqrOxrxJpHn%%8eAWkUFN%U^mw=qO!WfJIgKY0w*<^#3*EV!kfEo5nSB`Nto;&e zJ$VI~UkHw9m0x}ZdAEW&W{J1Fzk~Uw;GE=Lf^_~1=At9GJZpVm#Oc;J{ScT(j^vz^ zUx@n;n0Hg|+&i#i=F*bDZe5(SmJh36(qQ@pN3`J=E4K>F8YO4gk-_!r1cP0+8S<>$ zn?5-5*P?E2gAixZ&yd%GlS{z;NU&Br436&Wt_5?u2S@Vm2lJ^6Puor2=fLdm!BP3G z1#_I>kUdH}zK!GOfZ4alJ>3MjN-!sSaP-{tYl6Wp+f?~MM8 z4o3Z<)4-f3III7RxT5E87lZk?k~8v+`Y(ZAo+jAdkrMNKcF#JNt=M9tuQuxv47f9YW z1tY|n{A|ce;pBIGaFot_J~*mRH-Y=)2-nZ*7i<1b2UDix4E?CSnk5+QvQ6ceZy=#& z9~{YhI?Htv;*@@&;lY3T;K(muSm`Z~%Ew+lxqW?bR6pks{lRSV;HbQP>=@if;YXX3JenW7 z8<=6i>Fw|8?sPWIE@gjceC>3>Xh(z7%7e3ptQ^%>-vsx4!BT!RPLfCZt@kPKK5)PF zkVomh=~LbZ;I==O`^8PaeFX#2Y;&@=9Na-3@<_kKeah|?Jq+#-9`Z=Pw|&YB9EWiR{AhE_k1q*^f%xN;AC=$^@sLOHyaY_2;3)2$+76Ssk2a=g1FF3I@AuQ*q?yr)`|NT>cf@Yl3z2 z^Cynyc_ET@^vllRz93j9c@$R-KIOH7TjU{+>>c$f?*wpbeaO4Qr@WtmyTwBu%?EzU zr@U9dz2hNoI^=!!gp$Ak_|c~OSyAsM!5k)YQv6ZeuL5(1%qisk5X^NlC&?rI9s%=r znN!Hy=0vnd_|c}@A;}~C4gk|2a|(G!fa#SvNgn0L8G@m7X>%&)7lXUPLmt_C512p6 zoI=0%z)U^K+upsv)X1Dd-aIfVnUm}#{Z0ULfy^o7{Q}JGGAGHS{P+`?S7c5hZ-#{6(5Jk=gZrn4 zJo4X;r*I#8`EM6+dkNMlKd63g^eL|$+*ds0QT!d_Q{H*tF7c2@_TJ)C-d*4x@geUO zpYq-USMpW&cqaetAsFnk%_*Mu16SuEkL+FGQ{EBadOhTkerNcU_jPcWdB`LEZuKee z9&nF&$SZ@q*T8&g4fnHKKWrZ`Rf2PhXX=L?3g&Q&JbV9&o^KC;InINl`}lJNgI%_% z`eEefOKqIGA9fYE8wBfQ2g&=bPkGOQd)bG)?N9YrZ+r&aOu@S87xXDF0dBE}JZfiF z`jmG%xbr>aQJh}uQ{GMB?)H#J`SBN@@?Hh^t`B+BPxF@_W#GyM>y{sFKII(_uE&SG zQ+>)i7u(=74DyoKxJB9T_kK7I|trz6xfo;GFEBIQY6?m=XA+vV;0{7lXS| zux@rd2KbFt@G%FiQpJ zX2*$O&alX{+d<=}7lXORBG1mzxa~uN!7kfWcFe$;$HBcRST{SiU0V{^2|wE0>?j8_ zTX0;ST|X+9Nib=PJUd5roFo`Zmo}9h)Xtn{Hdx6-QrW;25`Ue zkVoa?4WIJf0k_SW?tUi!?Fpt%aBlh53TBaqJc|2KFvkkcseDkrpDGyavQ3pAWbYX^ zPMsg;fV)_*PH{!@ZuTkf4sgGg<*gj-%Xap0h4Gi{+bGEk?22{J6x_=yPKp=O?-hx2 zY6sr}S2E_Fza(!D!C;qdPV)8vSLH+Ap+4mu1}@_vkM2L#fVo0&Zt-^um<=BCs6BcC z%&Qi8_WGb4+*W6m1S;{PjjmJ0AI;l2OEARIrsBxY7uq;=oL&a*CxUg0)BAnOdkoy4 ze8_vxr@XD#;XOnAXmiq!>Wwc8hJpCw6jvc|Ngwi7_>^}NxG@iTRPX-Sr@a3IcZY{O zviDgq|CBk!INXkB<2`HqXmj!(^`GZ}X_YyJyk0P)GAGp=WbfAnL+R4ylpmLY`-z7< zviE*4f08+ce(!;qdXBffdx5EuIfcA=U{W$C*-Pc^1i_H4v^m*(8o2X30@5oMbP>OB~E$GN+KY3d|arQ^@-snCk>bS~~gf7BCw; zaY?k~Ry<`Tj2I8bv} z2nLt1P1O#PU#_un>UQv#;O-TyQyh@I=Y7h19o+jq{n$CY5Nv&d8D$30*k6r5Xr{7x{;2nRbTuAT(< z55c zU|6E~qe_?jaw5311?%RQ?}NEUa87=q`PdJEdBP&k?iWhuCBa~qZ7Ti94=<}Y#eMfH z636b(rS^OV6ZXSa7(aI3(aCpem)sIr&x_hvA6 z2+k=EsD6GB%x^t7((f6;V3%!9>29=f<;wA}e}da2Slus*{P^6rxR14To$}-J;0_V2 zTYk(1bEM$(bfx?ydyfaR*21at;|ef$2+l1(UIg=o;N0@#Jup+g&24t#NWV`CM)QkP ze(YxB)cLU|xB~>M`$dr-NlBh6Kd3+62Chf2ZuxO6n9~KPr>n@1AAq^e!rAlVlSuaw zFn-`FI1&JA!laGjUsAg#HVDv^jB9U+pXy2I7xXe(Yi6)cLUwxGKTweo^Gd zp^`jReo*^67hI2EUGoFX>4MYKmGXn?jURxy+9J>HXKFw00JA}GPX42G9uo|9*{1T} z44nBbxPJ-O&5rFZE(v@ZKib^vs01@da8B_;?`yP!S!$7Ix0mAOM8QzHw5jYM?sOZc zj)SwoU1UiYoRl9V?->ARQ z=2PC0;EwW;Hv{s%2IfkcQ{3<03+8c|lk$V~d!3j|r1(?F`#hL0$(%x7OfV45HYfir z2G{K&Zw4fM70mZ#PNCm=Fb~O`Lcf>5yeo4GdDAb&`!o2_=9a%c5p>P8Xb8JADzDA9={5{>I&4er=IwZ-1%3@nQhmwWqp7chGX&PhM=b0e69MV{KvOTqLA&dtw5 zf`MqZIr({|jZ^#iL~v&c*2xa4*RBNfE5UL7)bj2H^SFmRii6h$!>w?xhu#J^318L$7N0-?{zTm%bX;S%K5H8 z!gCV*Xw&0LA+H0>5}A|aQM?=r=1iGW$h#8E^)e^PBYPhQ^Ea7O$eVHn+6DY*)9sMt zQT)vk3Ml{tle=YzRa<|O^df4>6rkjyFMy#(gpGAE5kQ2Y4l zE4fdw%Qu?eB&9n8XFdb2Rw9{Bc^;T=363;%s>i=C z7$9t8oWkC#Bu+K{LUHg@iF1mB>%pxTtdqUeFL?&cyE3Q9x9LB|{T6<-Imx3q2!oj` za|(GwV2+nL$uBexdXZo#UAFByLpjgwQX6NFmwh4NGH@FN>lQChgZaDQob07|+2$(L zyZF(@<=Nwf=Dp4YQzJMo&(6_vuz7+Zd9@haLd;j9}gLdlSqDf^*W3@?-a(pkId{ZBF?? z<##ripx~VBAbVQ`L-J@-*+G782bU78n;j!yP7<7(9hZRlkwu<8UZ~&xOEBvN=VS+^ z^MGKm%QlrAGjQhD;9e1|n;j)TEeU)AKiZt^pyvzwfvLA}b~`8z7J@m-gQNQIYhcb5 zoRhs22N!|4+=HWaz^@hzcG;%#3#EIzjVo6^kJhW(22D@xyewO?~e!fKFRP`Fg z%MT^a$uBp9yGO8ken|Bs$@?pq|Hz!8-P-vYtbc$XZBFv2K4<{bE^`Wb{a}ufIfZ@~ z3Wg<&KTh`k1l)~20oAfaMVtJ2~4fvxE=O%$*(Pf!7kfW z^$^8r5?tCMPhAgc-|IZ&z@83)V><^|K>jmdc!> ze4Gg8OqrAHCH<}hbCb*|GEjYLG zdlr~)dB~&o{01<$Tjbf}l*;*Uz&z){QQZGaFxX|As=Srq%m?6R{(}3(&5l|yVZrJC zll($$EjT&m5-flT)DFUvMac~1?yzT{*V^| zGbA`Sznlu@Tn~9<-!))vw8*pDLGv;m1oM;!M}B!lFxX|A%6}C1Z-blmf82-k*Rh;~ z*;{Zj5+DL*BVyuJj@A=U{I0A@7f1{^dj72Vl0pf&0bD-hE;3zF;~8 z=N1RuV1_*8Q5>8N=0b}+dmKFNZl z%DWEStse5o-lxHA6r5XJZ345yFWvpe${UzU!8yehjh8fmNeIrVyivX{6by47{;;@G z^iL0yIH&vg!zIosKRUq;2-Ye7$bV;n`HtY+{C6#wUwO!*e$yYo{N2LY>nqY{n_GBZ zV3%#G@<#Eu9k^+Nb@DTDyMmeN!BKs`zhGFR_~Vprm5o!E^Eu#}1*`j6k-r&9o+^JS zKYAq2DSuaj`>LF-RDP*``7W571jqfSw&PAP5Bre!GMFj9;(4drtEgXQf|(_Al73`w z0?ZPbQ^-3O%;_>G$)oo72Vfo&oLf9U2j*oDc~l>4e=Ei<@T1MCKA?7HA21=oxwSLB zf?)#jM-_jRZzqAfP_S-x`~=L6g46Ru@(bDVJ21~!Qe%|^{dmL}gCWkH%xWz^sxvg}e*Ed{5>i zdDO1n4(1V=Q^DMYmqC6$8r)jJ zy0ssdfcdfDbp0eds2@ZhK&+~#h%{MzMFew5lcbvfSy+_$uAUtSA)4j<`nXt1+!7+Bza`-$L_)XIexV1b|~c4foYUE zg}gMFqh(GZ?;J1}%bX;S;_7BFkI9@u-fLjqlQ~HqwF|r4E60I4fA<1cAz0ln3VH25 z<$VR*G9U6z^C|Bvv+`kQG z%6;yBrg~#0m|B@r$eRylsmw|GQNEoB=4_c$$onann`BNQ?+Gw}lR1UFDfeTX0YBRG zaw+8-wLh~2!$A6@XtyX{$|cSz-wpy7lhf@S8PVlqhvGoqPM#KAKWo_f{S?aI9>_Y; zA}<(}IhwEX9l>aFgVXFB$-4&Jy&m$2dmhaD9vppVc-IHGk1gqv8D;d4yNxuUiZxfhV z4{}@F^s5K6L~y!(l033w2+TKp$h#EGow7Vd96SN$Rl(_YNF4QtKK_s*KNSAk8C->6 zbvq=E>Vqhl!(>jfcTaHrV9phsoBu8XbDJzrvV-c4#|493wmHS~U%E`GMec|4DXGx;KG&RB(E_5=X~h6%2OS#_AV|BYAIt z``E+ocI*RgA24l#bF*VHnBxVf+oABwxnOScA@5Ewf0N}&cGN?^cfnLX!tJ1O0#*J} zJg*iEcG;%l=y}g6J~&#x{X!oceGlzNJ~$dDyxj*!c0A>Sqx}5~xOWBX6ffkp>5p>X zVV7;jc!{;1+yz{XVDVcP{hZ{@0JjLtD#7vb zVte~b_1a~E!7kfW@l4}kKeKVT|B&pZd6xg@gPQ^Fm*D;&SSS66+v+zMC&Z67C+=jN zYXS3s;K(kO9Td+;{T9zP@S{zSE6EPJ{<~nV6`WK4Qh(!a!H_)KROwQE@RSdZ?QqvAs7bYk4ir(uebQ%7K6JJ+^$dYbZMRt%eOrH?Q?Pc*MuzWvMo5R!&ZLDjz8Eq zd%Z#9Qh!l#6jxk4`%C_N8QlAVC2Lq*DY$L_P!jkIezfVF6fe{tngJ#zI6a;vj{JA5 zU`QTq%-%fxw-nbu4tbSNbN%T4i{*!uF6nm_n8yXD>z8M`RNqheBfj5=A8k(cJ=J4h z6$}IMM-_j>o#vDKnon-bCwI1r%hNA0*l`}@JtbsPe@2xb9gy zf1Lbxy$_D+i5pd%Uwi#>Qav6-x;G=;cSPE}9Cg_4u0!6u*)`;|EA;2&OSKu z^OwP81gra5q2EuyY!sYTKjQ|S?pNOev&*wwM{7H6aCARd2c}hUT%J~6861_@1z^%1 z9HqMg%sGOy*7t@y;w}fXL2z#Ry#VGN!8z$i{oSpfD+%m@A8k(ZDBXj>qy^`u-zb=G zdvI)A9?TtrbJCBv2f;k+A&>O?Cz#Lv+1rj9Fo$_?l}*fyR|n>B!3q6Dc{AdL?C1uw+RBOc*UEhr%r^z+X2(@v9`?cg z1j5+D!BM)$gZZxDbp2SnYWRh?>%lzf zgL@gwwC5#z74pi!#0008H_0zSvIESI1jqfN)u)Djl)u-4x!c0o>me%V4}*D0aC*85 z{kD6dB(Ohzw7K~u2&P+bx;)8_Cdl|InEM3hX2;`T{$}Cqc2NGl4(5Fij`D5WzhS*E z{AhEt;}9^Nf^)JX0vRWRxm$2~`!A8RvremEiP#wxS%p3TCI5c)Gg1Qu+82Fb4|GE!{RS!#=pv!CWOcH~sDd^GCtC>GwAW=B zzld{9UKaj+Yh1FW1a4#?iwV3LA!(=QF?G?|n1 zqk8SzVD1r|@Sjq@N5K5m%GvazIDG}oJ02Y6$JVc7{uO?-x!ExXOiFONpQU&vznlQ( zJi$4|0mbRXU~cq~NBaE^%sYZ})9({+;5j0GwCVauey+s1b}*+1&dtwbU@o(AHb0ZS zKL&HF;N0|k49r_TxR1SA68JKHv^m*Pj&rSGjuV`l9jAf$ww1HlLGf}qn4fuYlpi;P z`IF$>?0o~w&i{0`gPyxofjLZYZgzBmS!LyvcANrcod-vDTnOeC!MWM-2$+8g&M80k zfxI36g>^*mqs`5ZFqnl_&SnRdkELLa7o481RNlyri@@9_I5#^U2lH>4lgbD6hqiyK zBv6eXZEkiP0%oq2v)Ms$wFJy^502~@2J=n9x!G|Qn1=Y(3jXiZZk-0^$AWXS<5n<#7MzrsV8T|;W(T!12{5Y# z=hlC|3e3ZTbF!;fx#VOU3Wnk(BC*n$}Ul`1Q;N0~4E||Lo=ceD2VBQy; zuAdYyM?k+_-$DI?A8lMe_5J=SU@ow5_WKlym&?H1B{;Wu*$AfeU7oI+9eaXl7MznE zGm&lv%o&0ceqOKY@16(dhgQy(A5?yS2IdwIj_kb$%!`6^v*W*DzVIHm*U64n$ZG&| zrr_N2;~QYEv~c$Pp!oYan0p21rr#gHeBguI>3z&k#E&*7J8E!lKA5$FbIXsfgSo=W z+46(zxDL!cf^)OuDKP)_!R`28%*()!HYYn0I5!W>WrB0dj~|1%)xxRsV*{9{1?OhR zYhXV00oTus+Xqam;GFEB=XAYb&J&zleq0RZXI9RZ9~AdDgZY!-+{*bjn@R#-#E&*N zI}Qeu7MznEX~;MU%yWX{cBt#Cm%w~r;nexD9kkk=Y38n9IhgrAxaDBZ5}cbISAp4~ zggoM2@9qrdixy68M-`Z6!MXYQD_~Aia!eKWXFL4;x?r@UM!T;a;qwSCwsH37?DSmx zCqB7bR9x5c6(hCPdcrrM&aR>UtSZIExwv$GB;KBi&udRDibtZUc^%Ql zcvCz&cOFYR-IvV_52Ul1fpmZ7z*K1E>dHm^nf~ZNy0b6SeXx9BQ6{}&VY+WLV>d57 zFfa%$GpUj6aPPn}rC~a=GSihE99A-^j*i6q(7e`EXx?FMjj2R?b920{`QQqLeM3Wi z+4RVY)JS?|raRR$3=>iVqy3$k;gN$OCB?+d3oVSMn&yU*(Ntsmg0}gP(>u`BH`<*! zu%Wj**ieQmQbVKJU~19AhO$9upGo(3j`pN_;h8kF#EAtBWnIhD!>R0Wx;Hz51HqAO zcQ9!FTe+~jZ?G%fmkCw|Ly9DZMhChm4StP8o3j&n+L$CQ%?H~Pkv3Q`Z{`fD0pGyy z7W_^Kl+Xud0*wbQSug^lm-G(w3@%BIj`VgdNk->3N0+p=b}VXJl4x5zFVdPq=*^9` z&0m6mSwj6Ym^3hu>08n@G_<61w70L@eDupBEaYZ&_YN-+akr#za9P(NVly*5Yq0aE zz=45-b}Z=(1Rf21DzJax;>ujw z%V5HIa9(W9%QIqQJH^JHimkb${2ydUZ0xSsn!9IwK=)b8+f8Lah)ec$%~}M?zn5L?-+R(JvhR}5KCR5|y zDRqI3ZLzTpv9(Le%42KpD~-*$XI1IVG{-JB_7Au-RvLaWwk}!1@C1R|#>bwBtvzuX z42`WFm>wH@Qiz&^OGwICUs-)@EL#?gjU8VWqs$E*c^6|Iia_p323+dKG5xZGB);7g6zAu^o*-mDd5gVgB)IhB2?%3Ms zrsUW=iM7eg5^JO9#MUmjB2s$e=(5<@5reU@(N(e2{+<0)=?z;Sv|o10L0=x-F7zwv zvu)fuTJ?NlZRWzzSZMlQr1Qb_C;PG3I+_w1*oc~f?Znq5%C?Hld3e<>;gb*AvwU=? zaOn+^JxlgqeC4x=(#W4lgzl8Jk+SleX5s3dwb3)UpT@Q;y`ki5(KBM}7M!7TV{gaD znuCe4)!QZ3o^WG)Y-)V$kxd=jor@y$Gj>^G>>tU~Hf49yPO)NyT59{)Sm2kW{-$ZD zgJLLR>yo##E6z<|FSh1{-%m}HHYaaStef)r_*fKf`b~W7*PA*P$HtPE#l}KziK2{p zB^n#s8iqUzLpF8ndoKNt_GZA}Z^!0*ko~-NWP0h1_r=ylxk9nh=IHG`Yd^mF9B8MCl$utQk;x_VsW|8~i6ZG2s@1cC7gSK^(iOo!OI z-B%~}+t9XdN))9f5L?%ZGV&YdzMjb1IUD!H-{Z^nWz{@6IWhJKyv+Qq`#H9*spRB( zsMP*C*Y>o9D8GrZ{zqbCQFwUuzOmCbow$8`&VN^K6W{N@8@H<3G!~q`*LujiZPO;q zoqs!6dMb@YA523XxaOSFX@Sx&B5+Di-AGCy+mB?GM$fsi)1J*BGJ)7GE3`=XdIYfGScWvKMVdpCXpS%94t)C8O7r?u-4ZO^J0U=&^Fb?JV`!>=Q05J^dM`6Kbr|Jx~cpOK+TN=rFrJJ5yI- zx>AL$Htxuif0QSWxLDs4(RGNg*|1f7&C4aDKYDQp30bv36kHfs*~d&T-Q#4qLQlU@ z_d&4~_#txyHyjQ>f~C6o{QctTutqZ1l=Iy5UZ#ZR^UY;5i?|&T`{u%l(sN;A-9a&P zI41UcF`L<(D!o!N%Cmu0O&db{QkLskvVLKyp@0791;gq}ABfU^6 zbY$p=(2~@VN1(%^_dxGAcS6r)7oO{M`k_4_CkC^o1Xg2jKP;9xC2$J%X0g4WV(&(% zJSA{D_9Cpm^;`Yezp*!s^#}Gvp?!;SE3o%p#x2ADPiAM&#omr=??SZkKWE%!*lT0y zKCd79C-#nK+}`MW@eb?$*!vf|BB~#Ytvho$l4f1-?Xa_$ckI`lNhat=-)2`ivfnbZ zuL+jr++7eCcn`f4^xM}NN8aW~c+ZmcoD=9h={=A&FAv4XUQe)YW!3#-@2owm>?X*G zk8PXiicM)9TT+4g|7oiKpQQT#$&CoIr;=lTOHc>3bu3X4LzgH!H8xg4?R|Xgld-PQ zl<=D4%cr61fr@(HK;`<4)h%O@@(#Ky*)u-pUTRhOt%?OlXX9_Sx`S{2SggTk+}97%Py-laIy6c&SEaPbnk&q4^g~Q7{cB z?oF&)Qij0#N_~86Bp4t2t6t{s3jX`vDby*YUU^{SXYk*x#D7H8q9667=%OUV-AQ6> zJ^D24bhV|4m@-|gso-esS#!3PF613@%MCg?CaS36)Okd#op~~?+WbQ$@YGU zy=jbl0DD7h?=kG%!_Gd9z16IAqfE{~GI~kn?ST z&nyYe(mBc>?8KKhg3!hc2Fdj>%QV`$*o3M=yD}JQ$*(F5HSas7dAmOjw63afaATgC zjc>479p&Ma^6Iu-5&Uoj;zWou#gH=_dP`ErNxT&pQ91LW#B;2BCvhk?kds*qvyHN# zk+V58*JipTJa!#}P;QfGmjG=+BKWQIfppS#8PG4pt>O|+XAsd+J8@IU-s;X(F}$r# z{N5hZPNm1BZNb|nvI=8rTVp2{7R5MyM+ZGLnm{M>1g55YmqUyvIVIn-pFPy1*O#A+ zdE96_@t!?tH>Trazw-m(^UDb^D z_Gt3lT)X-G++~->Aj|AnVhk#qdQZek8miHjfK!H@EmWWJ3&7>RL{&Yhsvd zhmqr@>?f~u^az?YUx5TVV}2Y+GlYGbB0tjkfMm@vKPsbc> zs^t4l*Iy?F+&V$(NkRYPc96oBtPoWWTS%K(fl_-_$!t~X%(*%(JHBqRqs3$bWztOe zvvC`5lAcu|mGpnNDkC}k*9Zj73ucgQ(S3$Zb+u6MKm zXkD&s8)Q5>`Un|Sydfmn zWf%n_$4=Y;y+}0iCYoL3tGVWq|z+nz_Nd*^)PJL#(RMilGK*gM;aJH%84NJ9#rihy=)JPxl2$ z|2g)F+oFl_NHqFS42(`{T^U1p8)!GT2jpEri=Dh2x|9C)q~AfQmY7amZ(|6fDtpq- z;Fq^SC4uG)EhMMGPD(zF=6uy%!qY~FP9f2<48*`2bdLPpJM0so;;Ifn>OFQGJ?#~U z1;$tQq~~P*-A6ddnT)6#QVeYp#KF{DD7Ql_mC0r+=N;ugz?53^*lK*S$G^IbtIRr1 zXEixd`obPG(*i6B{;uu{Bup-|vBFNQ3T!ELiP2w(RvF%cYl}eL zQ4zo=z6$u|j8vd1-4eoY2``p7H12@-XKge-a-$v7gfyDG2-?dt?f6YvUxJslR0a#D zmGc9`fWm3Bqw(dX_%ExBFRribm=;Efw<_by7s0Io|0~9k;P%yY#rFp1dn3N1@!Odq zmFsWkV4*U;`Dgg5tBl{?qORNU6^(D+jxUd3$=i2}1L_#u<46jOudrHxa=jvy_`r@= zlvhLHUAcZ)5&pxS=tVz(UN}_QKDEfgN7(A@H|{`H;y`s0YH^G$PEI`D6>OarfWoTj z6HHhr0Yh+ET+sY}R#Sh+r6vF+pd{1}kam@;R|Txb0jnRDVNP(}SJe$Fq;+cu+oy%l z%*4lQv{VkqEbP1 zK#vLMyMdI;ZXj(^M&Zr7@|Kl8Am~bb_7lWmzBV{t1{x!78x8saP`sc+d| zvmIb^+U0--Kb9Q-zWADSbJ0>1tjbU{F+2y;)~5MT;l8-~<`S#%7?HuAw4!J!w5%1z z$7HTBpr8C*CwiP;Q`%bf*?g$G@jQ-%P|UAlNp^b()P@6vipa&%TCz-dCjT_gCzAtYtHt0(8b^*{P;kU@ReFNwU z$->8g<_P)?&=f&$0%^GK0x2z<_Sc0A=5({+Y-W1;9+SHFvzp+!HcnuDbP=x%xIebJZ<9b3e$Cxf<@@ zo4GR5Wak_3F3F0i#`EJ2phd1<_e|p=GsM91+k+f*;p=Poia)qff83{E9Dv~!hcWnS z(XZ|Na;8D?HS5(;MqTj-pTn=Z_=EfK1tmBq<`{5fQA1=X{KZ^_*}=oyxVqVcn1$y(lGupxVRnzktQta z%qx$^$3ttfv;zNjEO~uRCEVjnXW}OYEK6&*gdnPR2$+y#ART;A?Ii5@)WEnMoqp(% z--1Vs$d+>2QfkMqufY7>j>WH^Z6~LI(UjU~JQ$4^l*9wk_&_^ejX`U5Dy61i{4~9x zV+z$=NEFddHOS=Kvve>T?_QBE;Zs0+1lKY0xu~(nB=+jI6Y+DkFt8JM)Zzz* zee4E!@50m&aY!a;8mZ!U?<)R7G}lbb3^zqf`%-3`_F~_ zd%4R`wBs|xqy>u$&_zGfhz|H&j9n8?K=*;A(~?U&vG9mFJ*_@Emi4zgTB(@pJjJoo zz~VMdT;BDl&XUtG*KA!5n}mXu=mgyi#;6u^V9Y9Ec0m)7$6*75i2&4k@1nnVLc4-v zf(o0iGQeGgaVnH1sxM)dU6rOWp~6QMSX5T2CL|9iWdwsF*{fQXMY-^BNLDH$)~cAHqLoIQ12nPE`~Eltw!$%7UPetgkQX z%&vxlFNskRO@D3;RHJZnkbWvwy}P>;?HOk}%L|%6@XmDXg*&Y$zA=d!_PAY&uQ)!A zx0~An(Mc}_*FKN1qKQ?ZX!EL~;4%bwzMZ%pS^YkApNYRfPYFjmF%BBc5Y)ERl_s8& zqDKR!{r|$4iZl>t6)X^fxBn}hpnz-M0gI-mmXF}@Z4dO%?e>^$RH+VxN)?7;Z$W#C z?C+v+j_`{m_AwAtTI8(;v|V0Qw)@XTiH0Dj*@=9ZN@Tg~iO~3QJ+Tt&iQDbw{a8iDcpM=)P6?s#3JuWR)+I|J72y12Y>LZXIVt5~_}�{1FDY~~(5(`)2vAbc z{XnY(Rm>74y=!swJS>i+xAIyX4U<*C_h4Lx*0=*rl2o6_y)XybjQ_3C#B3DP6)dLF zM47#nl>iTl-AmBJQ|#uy2A2=9<5zFCJ0e>dxnL+KSQxptbBeY^D3Kk@F%vnYW_C^k z1XaF9FCMv9h~q0^>oWy&e$N^OcqaKe(oq=<1%snu8iVz>V=EtKLuD3&s_zv}!P4rz zb-~50b-|_21?ueJt*z)*>nek{Zb$Lm+g%gdz;Bo+yh$6KS$m5Z3{`Iq7FOpn>D;tvkKBu{HF8kofn?8%WT-fYg0bMV zR;TM`Q*8NYC-dsR~5hWeY~RchY95sb91J_@9D_4h!RNs0XfP?yxz zlTmmS%>&Y!{9Pc`{k8$MiN7a+rVFhfztvwp&`fbV2}tMjF(9q`7XxW~z(sx29@HRc z(;m1>=+brfboI{o&FBgl!ny9dnoCgn>L|>-huW(n7@7i|5-Ke8dT1!A><%GRjnZf! zjZztqitpM8!;%r|C&Wma5)Sd~IGSBM5G?e0^AHMksa4e3v#u%UQ9#O>YV<-$n2&?= zVBze>xTBJBL+eHjc|V1yzpZU(e5_&Ol@op?`Z&ZHcl6?%ZNyQcqZh|rA<2~5%7v>U z&!YojLTFyOG+a#Giy{cijE`8PG+j-xvg1<9j0mC3D6fwe-sP$Zt-%uA^1yyDYn%4^IDbZ8u z+A|u|nH&hhDCu-*tf*s7HK`d}tFzKeI-^PzaII;jFs!(b5h!H@);z|@%<0pVXcxP2 zRYkIM)J5%CKrcw=cq34uAhOhEgX8Nto2+XKq;o}ymSXtW2(Ulrj6_e zOmW&Jh4Fu^p}4}6l4>4L-N+j4Ds3QLq zpgf6AIncA(0vcx0Kj;WQ6@obG(tw-o#T@LRgia4RsXN^rdrvP-g(|3xEiLVN{Mdi! zB1)ldE=TmT{h4R|lwk)%L@XHrSpfeCp2Yyh#7x+30K?KY4&%2-lCtBtS@Skg*=5hG zN$Gj2^15utttvUWt14cV_eNVj{Qt_68Fpd~wK?o#ytHfc)Ky>NO;z$Xx>Uv2<~7oP zbL(m+-I~RxSHZNlSc%OWDw@7jtaMBc?t@U}$z-5!i}*8p33hpHDg&8W=OD8%S>Dk& z97Au6xH%t3oeE)g7)$tM8dcf7`w!<)X<|UyB1^%-0MPogWUl%7p8Rz3 z)k%Npgf+@;j-aKv5^LChuVnopfU1ZF1KlgB@d+SRDqRDl(yBboH-~#v9V~%Hi=51u zUfNScDSwRok0sZ+G@>PuvpYqn1KlHUQwc6LMjbPx147JDZ88SU*o_iBZjlLaq(P}# zbfyu)txuODvtMjHTecHzMVaePbU-~a#a#$S>hF|=;9ClsyG1=BE;VQpxnn}&z4~S> z1H+-eWNlj>!q9~}r>a81m8J9V?r<9-CBIhdexBs$1U>p~GY)f%#| z(Za+Ut%x;RQJq064Eh|9u7GW0D@jW~c91q3l0>XfV#B1DsWscYRN3TGxJUvaoZ$qU zLC2WKB;rwe^Q1K;IXZF)o-Iel?x$yEI!Z|n?~O@hgp-1Bn7%;LQ;ReDIJdPN0xKmc z?pV!7tI4h;+P#loN1M8C-PDpu!(Axw9AOg2947zJ>a+H#4J{{bYD1ff(cvTSPH@U- z^M|H*(i4pfu{w-dF!mCh$=d90CvY|?yNM)i&kyzy_677yDvZIl@v?-ywcs4W_ z*y#`qT@(ryV$>0z20i#R@lwZ05!wc-qGb#_u0^$rGW<0bwYyTi%C`_ZXH0Jff?|2Z zy?JZi*nrnniI)+J$hZTQi4Uq^7PcF1GCe|GIYY#Nrv`9{m`_Xf=Fb#47Vzb?fQNBs zRT0LCE!c82sjcxi6FrY_HGnS{1Nd?=fDf+y1%m@SRJ5WBSlB`xK${TglM_$r20Pa# z8umwAwuj1hDBoS|cDezSAV+bz9i1*lur%zCW$(nKp#s|HN}I`JbN^5UCUN+Lc}^@* zV^=}FQ;LO&%Gq_CKA5Rp4Q%HsyPtW4Ycs2183~i|_h2N)gy|fHgrd^71wUYuMK|&1 zjGJu?oNZVyMV`%{SscpW+x+q{EKY?^oLM}$DI#T4%c+_bASrcS3qx#A5<`E-T)w+x zJGf)^$6Rt1R&58id5p`49N2a^+j6z8NX=wxMFOKvbgdqCH6j2Vsxvo!C++E4v?y9b zHUMc2*$t#t=Dz__EAv6Qd;pMInGXYUjJlKQ(}Aa)4(E;v1TKwP z0Kn`WDf7CzQwPWPybQaAVSC;JFHU`bn3?twZO_Yk*`DjnsYiv0{m)hyZut376$Xv2 zr@~;5evb;nQh0PVrko1V|En>Um9fUGV@*IQ_gkL_(i*b|NNdb*fwabO5l3qb4-C^9 zlWS_sKvQFi{x{Z`B3K$=1XY`^b;FqOt#NRAr{J< za%rVtF~A`#>U9j=!MYv6wLj!9sNbMpK%>n4!NAaLluGYcmDq`eJ@$dlsut;D^IBq9 z@;xrb4xkq;4i7lBq7%EPcH3k2aHL*C4F|TDFki;mC4O9GBa2gQyRz$fL-9Nb5 zU5TC&Kee)RNF5jYVu>fjXu*vEwS*~Ifn!)WL(irQoTzm(5g^A5%J%^dr9XTvjB_YTA|0PZK*+8l;i~_wQg*OhgQkvv^r2lUP zjRw+FI=FDBQ@|!5RUCdDNCz1nyMi*cD;UtcpzH%I@Mxw&Ko}HosIHp;D_B-4WVHS6 z!{B0JrZc&$y9INd;5yngbH)Laj77A^gSm0 zm9ODEgXs0G^E+4Kr*-y?SxuKlANk9j8@`nLx3?dPCbmTn?#E|!(q9;DJ%lx)?RM+_ z^JCeq(S_UTJ2qxVbm0yzY}*I-+u3{U*7q=o+h(`Ee!iW(JG!t%US)6VJl_7geGqmN z+wFzh#Lb}+*X&kor@?|NYXSK`aNS5hZ zguO9ptdaa-Nf{=b7#gy#_g3O{Eugb;_y{c0p)GHLwj4FoPFx&djW{VWIRFVq@C<;u z;E1*Gi&a`Xt1I~61%cq&Zz1G$Elq#&oUgI2JGeFoXY6K(Bo0>Hz8t(%2}g_ccMy6a zI0>slckwjuSaK8@viqq)jjz`#j!L~qY@)e|b_K06br_heUad*&PEjKDW^5m6sEV&# zAzJ@+t3iQvRMZ51uS&8CRjvQ|YJ3F?*KNd?_w57xT^0X1-BZS&SZcitmI0sUvM~?9 zNrg?NJUlwGRARN)#byBJ%K7k*zx3=$ujij$Xdhf$in4ZWs;u=*gx00TPKfXlTUo7y z%aN}`wImM%4!FF0CE;KCaCaRD;$Bk!jBw(EYT^ud(Zx#g%CJ&fr z2JA$#h2lB8v}4J;OIWP2YZIn6sa=~_VZW1|_@pRz?8G&w5>R6Azv6uy62ZFL(}1Id zEJLhbUjWjbLq7siwF))IYN+rVAT?BY1?WxWl;8RjkS;X@Ac*d>J_%^L@T2X78Z^uX z(le9h0O^7)Y=Gt(UhC0KFq`x0tt&1F6hhZf+HSLs1X4 zQ9m9?Wm#<8mIJAzcLAw-h)sz${$s(xEId~rdS(Q_U3kN$xXkP7n5XoxG=5b5u6g5i z2<0{eT(Mg#Ip(%E6=H>r_6F)1tU_Wc$L7fH>YiM{mbF4Ff}OZisN8(V6pC!yc5&9P zIX4+-hlF_vkj4a(*5Zee-;oIcgf5}I9J=m5NC24R2G_Fm>aWE1N5DyctZixhG)FG@ z4J(+cl2QR~JA_GQ<(7qTa<-BQ9cp;3!{|8};GqT=cB4^^M-W-p`g}VKIy7?bsZ8v0 zoPB<1f*cM;1F(Ue{Sy*DHj9d=-)s@LsX$r^X9H!4MwEK72j%T5poat{fPN$Bi$KbS z8U-yi_W@}daaX!Cw{yD`cf&5uZQ_Ad@7j|tFKQfystPqH>|UgH!br@XG^eNuQ#i5w z;YM9*_FU~IbSpF$^(-U!QR~IUECE#I{f*ihCjtAi5_ODAlZo|^)bs^vmqX1JG(ucg z(RF}vK)Mc438V`YbAfb`gW2aSa?Gpz8#Fqmyd)&0Ff~ha{h_)tU1SBW*NT%Uk@{M5 zl6X}d=*Vgu@W^h2oGKD%v6yI*Uewj=dK3$uu18G(QiWhj8zlN$cKA;2B)2F}r1M4P z$R@O*gPFjSo_2P>bxbP<8*BBWt^6_xmkn_rWkbg$vZT9Mg(Wga+;)l^LX}I2+iMdx zYoN+}IgrYHEs)CG1ms<5aD$eWj|1DX8uK2p;YGqTW+MIJqN{DkADO%~Be|~2rN~nn zZ#5fmYqC>x4zw|*wP2N+$;cY0lQFbk(_%xbAuTqi0cq6Im?v-U!saL{+?=>Z<5dCI zDU!6iBJo(@4L2R)X#zC#DFB1j63n5#it3lI z_PBBZO*@6r>FhiOEpc;gN^-Ub&(qL!tn4&9%0)C428Ssy#p^{Hw{`4Qwy4w96{}fB zB$D)utK=zTW@#i>0A-G32ye7aI02|9pY(MwtZ@kSTPINH#a z3lj_1dIHuJTCC^mQ-Hf7<4DBsa%WD^f9X=O1lP z_wzqY4{oOw-H+0PAHM2+)V%v=sd|4;;$scPJO^0oHJ zo2F&rsRmIr*=ttCFbu(g2Gj5Z=4FvLol$6T-MgUfi0p;Cm5BT`9(mDC{CMOgJ9!qI zp*L(gLzFy`b5bu4wnw^Q+dKK+oyptS1E(=ivQ|!)N6cY zZZH&?20tUzSQIw;$?CoG(mfg^ISVF-jvE=_N6-lzp_=&B3ra1pZ16RfcGe zXT3%(2aoA=nQUN0@JnR~Zi>8#8777n)vr0>-d(a05rIYnO3bC-?NvZ(5wi+tjLe(v0Mc#hcN^4Gqi}-GuzH*_ zcapj$?sx!#?8m1_B)K7g~>1%CX>}VU~-l=64e!wX}u4;;xyqUVK5TtY$rad4UPL~ z7%&+M0i5oFP3}-WxaWGn8l5lbC@;5(`G}q&U`qXmCD(%okTzI|*mgm3u%5e`vSi>< z+q7gbM=Wy33pSw8f*mH~0cRL)TiK!^!*c0xY9Njd)POd2HL|=a%-da4@ z#NBF#qr&fRk8H-e)yl2ykq&-8jU}X&djVb|cntt&(H`WR?)FG7dLb^0Q4nl}HGH;36kTmx)$Gzgu!B9o`&+u83s3?t3nau;jUb5rI zizZ@~2?`?%tiHHy2Bm__n`tg@!sVqjmzUszv${M~Ps3$vn#)$W+@I!hzX^1M>~iGl zObgkPWtpoBr+H0a-fHc8q270`E}Qt(^P1GS2qSr2z~ zgvosfUP~34)T`U5sB$LRJ<752bV|3eM=XH<8j(5mM%({PZ?vK1n;AW5w4=`S#+I6t ziQDX+Zw^z(HXzK5b?j^;jnuKz0KCU6r0Upu&>l@4)1fm~Jy*We9(j#5$kZfOEo@F* z86?2v7%NA#M^2`XGuk8PXdQbRp=cd*_++SKz3PZNTCYAMtt6j;vOOZr1qKS$!88}N z79Xi*nTdcHwy};dZU3=#Bv%%I-T_~&5822Ytq(&CI@ut$z513zcSTnl^eG@MyF6_| z>%-T9de(=Kq<``OeEol^KFBdxdhNvy$G$dWJ-7f#BK4pWU`v@v1)lg9!TlFlVC0nR zXzGD(on}3Fx;?U&rQFm97XO2A=r$FiJu-|wq&`Sr^IORW_B9S4sR!s1)4LlS&(?wI zDl{X`RH#?oQ1XwlCiL!OjLcFuG8oK?EtI$Cs6cGB=U5D+J;$ekwCC6cq&>&8K)O*x z8a+Q-bq*!9ez1SmazD}_p0BBH5rZx>XrVzIWN7{P29VZ|dw_b@4;BeKk=%{1jP=9x zEQxh3@T107q2}-M2kouG9;y@Ic9FLSFr%ga1-(q-4yJ*Tc&5YyN0R9bb^oJCJ0w&z z6n*$}uaxsI8|^M^3o);66I;G*OLA~>LtrVar&{bWZ7@y`-X?1T*)Mj!XpUSSK`m7c zE}y~SB+mtJ=Rkl%N1WzUz$$`DGry#kXD`YrjPBTZCr)@~yJ_J}XP&^EEWv3s&o2+) zmLYsEJA~?h8Bru;k9iJLY1reO`?&ZX^PZjkE{++8#iHg@VpbrQ{Tf{CNq<>B3McxC zGfummo-8;yHl`hCn78iJ6K3%;ns}=7OglMVB}=qBJR$+SfXz=1&O*5$c`ob?mCXgo zf^%@7jX4PyXXkNS5|93^)l+ORb~{}Tc5Qt*+dT`S2-7)du8+C>ei%97_>+{vxULSmgX_qMgk2i1K6zYA6uUO?AI5(v+S`uE+E<-3;G3}L zmPzNV`XyJmdl%dlsxE2$&xYh&Bh}N)apJH}({M^^D5fe-s)Zt3x8^`-ob#JFfXio+ z5p2M!qO~Ee6XIrE+ML}l(&G-A0XR=FyUXrIwK&xDOMJ7vLWJG*M-8|Q$%Z3Lg!^VH zUCuT3d|v*WE9F`!UK!@B6C;G6{k0fEz@0I6b7xl5)3~22o(qvND{-{4kALJ#oba~0G4|!4DB%yLW@?y&IV&lY&@@}nsSOe}MFHOw8fb2S$&t&q@WDHh>i7X-iU3)P@_V%01ZysonaiF^>t_1 zIXrqR@hnHB^wI7C8z=XG;S^!HO$Q|olg|%% z57_-jc@G$`+j8##yO-U-Xj})j_VC+p#^0h@?DXdUh~ zU`Pur0m(IB{`SaSIBOZVfZdPPsk?XySd+N~tO=KZ;p)5zEAI(@b|-{l$he7$2jDt4 zko`Tke@W2M=61dO>)!nf5JGzBI9}==YuS7TTeratc#4TLZXs~u{2}ihOAq;bjJQM; zse6s4ZWYtojpWf>GIiAHyZ<&8owP*8=*`V$jd7hfp+BDZN|+fg{JIB69@`#)c;DAN zit{n0Kd$?d^hc2Q+Z`39NE|8eEa{gs+>a$2z!-;%p;?)AP!84k=ey~vi?!Wzj@Uo! zrmr7^vEJMDpFp}D=S0*zy|?QS&}!-KMxr~^d%N;5{L>-uARx8UzRbAQ0XbWAfOLS& z`@P-hb7hJOIZV}mBn2#7jFJcUdU>yJW!QaCwK>t?i2h5P=gG>z73>1YkvUbT3>sY zpScJn50~$-wUsNWMX6)jaj6IT9c+W@qJ|1pdJ#ua7*)CY38brV&jINg-5(6X2~YL-VHyy}%%VrL;;hXj?x@Y+7io=Lg=sp~E=6*e z01jx|B!v@38hxz8HqCX`U>oPj`fGVJlewv)5(m+8=`$Ot+n!okEoG9HT4_t9ERED; zpj>hXC`>$Xt92hq+RJ{1TkSMSX*HvX_GKVVs*OOJR1X>CEZmr+a;;aSp%Vj+siKZ| zmiokHqPlPk3Knjil9Osg)IoN)JS`bW>*0~ohVYOVr)@Y2>X!}mgx=J%ah3F8Lg$iE ziL^}INuf4C$E8Bo>~$|U$6XOnlEePyKxG3gvTkl*Q=ME`!Gkm+sBIzcDa4Hpm9y=6 zSo9oxLFXX+sIhrNRwXJv-DaRwf{rS{y}Ns$PkY8yT%ii~R$N`dsa5j&3OjjAgH!XS z6ph=V>*DbMc$LcqF;i;f2P!SxC<-n;(-*Vjf##EOXUz0^Rz58#Seu;F#`Ar7#4oLi zaM_@6-}N~}T|4GCfV7*HUJ2D4M};7|JTUN7o)&_OOjG7Hy(Len+&ZR&zzh3|rpQI_ z?b+P$3xlLSRc@1v5R3X0;zJx+f>kZmLLsisp(VB+S)y|EaT-a5k>Um;h12*-OOF)k zyMEu=vwnl}NM;kmgS-m44||C|8UQ5ZoVMQfaUQFP5eQhT`lo<$q^Pe2(n`M(NUJ)# zV?}*bbvZl-^~=%h@5%)_Pii>p&{nB~s2ineYu@w}kxF?4PZfq!i*jNghhAT8AW-Fa zmz{L_H-)0mxs7SZ)u`B@6`RzueDw6BALn?(o(%Kx=5E>2niWmrRu!lJYxj?{_S44C zew0R7cveBp&fD`Qwc}QA3{YjSHkIY|7bQz@toSZHse9-05puY98xQLqvyIp04aEIm z!4XwQmvhrODVI2wbg?O$8gi-a4Z7Xh zIpTZHHGNk(t^H9Xkq*^=1f-hoUjn7h2v)=k47HUw4oKa`7{s+yZ8^AJkvcoRS9W5^ z!W-cN~siE!5 zF<04dH-C`J&E}}B!?7-PQwYmMI9fomk{WmanEm%a7W+|Nh`=fuoAj69?f1cn%R|jO zutc?U`FPoe=~PF1QrGemad1A&=uCAKGeJ_bVxo>NZ@_h3TZADUvv){%tfi>fkOcQv zVrhbsY)9?&2qWU+dWB&qZthxv%?c*tE-X^WT?$-$;~YSGRH1g3iXxC(tI|(_G|`^{ z(#pcl^?5}Tk&sGfbEg66Y>s=jbT&5)NN01G0qJb+8X%p`)dT5>O$|BG*CJEW z&RljEY@8b{Io?w1YmW9_aQlyP*hb=7S8tQ}ci8Syd@a*4AT7UDxNZ@LV#F^9wBZn~ zqSV|C$#Z#lTnpwzXl`*TubL;nhc7)F(wPuD3rD6TNFO{3?3+c)F%IZ?>1IW}FXKg8 z1pgh3b&Z3J^=Ra1qP04)JBEuwlTj4jmS_TZMemfc`7n68Ktk7i2yW)l!y!zWbqrLu zt}XawsI1*1Rii1t72YL>DxNdF={W=-XGe$4h3_0pmr6+wZkkzA$|FxAzYK2LCbKDlxIr}l`r z!x8dWJ{$xURtw*(T3@|4F|}xvRR%-*V5n);c|=VE?T!w1ijNL}zs^tFiCe?a zrQPaJJl#38DTp&~a>YWWvliDz^^@Bp?Rn3iXN5sp9V~4R&Xjq7UGNO~=8-M4Hp5*C zSfYCK!RLc^_2z{;z6$li!||UU8hmhn>w5zd+ge{Ak-d%U`B+DfycxrOAlPM(jZWIL zd>EEB@guS~ikmm=;Izozc7Mp~3`WQ75rwL=JIM_rxOF>hpTE^sg}7BFTAKI0xo$^Q z@S+wNC6AKd;YO^;92$ca$U~6r-E}R{jXqI%pe5v1uey$`(@&{P>_!bkg5Zt6aTMwn zW9WZiYUfm7CY1ky%Fc-ov+t{Xn0nnZj zm6-6t9@4$oq_w&amtYa8V?7Tim)gqOi8cG> zdhlc7DKMb<0STXJcro+P=qaI{#O9KHj>6t|j*0P=B)9D{(u= z|J9#N_2*WpKYum#=aZ)XEHm|IovA;Yk5qqf8I{xDc>9^P((`bH5rw)XDGh!M!vVG& zvgq);nyK9Gp?cv(6~Pofu%Ab*FZ7?)Xa^p!8A3$>4E} zXp5pi+Hl+gq~ndx0e!6F4fGq)vvpX88ZaJB{gH=eOfJvREZZ5Hv0VQ*4bAR1N%eb^ zRB!(?BvsD=+CO_z*@?%TA)2#0tNuaMndgv{!O;!(1xK&=nz!ym_KM*aj)KMoi9DJU zv)dQs>@QsAb~~)N7A%L2`}~qJ9Aka3vdF5yh~sotHFWzh^4b)Ep0Y5OxEN0 zn|;hRJo=Ty7=}k3O&IZQ#)|Eq)bMCC7HD&E>UDDET@E2(zVRRoED=`r%C15u7#zw^k*dx;2Q=ZEW9$t6N3<3Ehn1~dyeo%(X))^eh8$d z9WMjvv3pIB=?^k;`w@_i+Og3hFT@S&(b0wEYy9iZ57+p{_ z@mz2-RR3>PPik!}t*cAf%_efNfRD6AC4g07SdJ{mR3A4XHoZc99V#EvLiT7k%2D*P z$}S7IMuqv|1HrilM+yXLrej6Tqz9PEEtaCxIGK5lN%&2nx(&h2JY!Ds8mH;IJoj^{ z4@E@;FQ?vSP8)l`>5|yN&A60qMhMCsNzr`sf~u!~Twt-j0@D|1dalyHL(kPyfkqV( zGNeXwy~|MqtzeO8P%RLazj3g=XoJ-5Be*G>s+2OdbzYD2Rk@13f;%9P%y*WoMhcN$ z)uJ4dh)Z&nZ(R$nqO_le-F994q7SGW`myMSxJdvNkwGF8njfp-XyhueQKMjpSB|aN zW$S0c7lN|IlAZl}1t&{2@Cc0zMnx)-WN&aY-mYtTgbhty(0(Gg8K)9FR^C>Y;)-)= zV+lJDn-C2&1*#_anzA3rYQu&AcP$o|p*~jyB_=I0V6Ot367kP-CZiK(1eyjW@+W}u z0W^nPY8^|BAHJDWMbgg5SrSZKL<<@zJ+CkU3j?&t&Y9KTg>%OMp>A9^ZWLG#IbB=a z`l>{S+#~>#q^e-mHr#F`?>mQ$>vnD!xVvOE2&xkLf_)S(D3Kcnf|0$vaG)}OxA(?@ zsgg>lzG6b6S+zmeMf^ciE zc~WY_eL#9_I;~AUD{k)qsREt5u2g}}LpoG}{s|yepmVKE73f@FQ3d+BK#s{nk3F?d z32(LcVe_Py2dqX|wkF5J7=iNCkJyB&LK_Osmi($hV*^$gT31y#xG~Sn)q9`gLA{0( zbYe{ya-`a-TJLCv_vSL*%rI^P)no;?o#c|0S& zf;j-IH(q+q7VmXz+aHNI#=m*F5}3}T!db!E2ECz0UZ=XU6tk- zw|{GnT?wQ)mfFb}!I|;sJ{oyu{QDSqI}>1Z)!sAXk+tDAECt|yIL-yYzOHQ$Bi+78 z#1$Jd*f?(Ll8VkNZm?Qff&V~N{HDPjl|@+)&+e!U)8-V;*r|0BRzz+pcZ_(v`_nP_ zhhPt?i2|$-1Ka=$YoJ>y?D+L|EWQ+Jz6wjYFfZd!pQe1AJV5y`xrZE&B_`KC6vpx> z?x+cFew`MVC=A2swXdse>f+bWMkd)-Q>b}f=$Pi|A%9{@=)@_5n@V}mNWd)yY_e<7 zWWxgBdMwA9bD&_z_K&w!oq@z!CN1feK)Rcj7BQEL8+R?M3G;hEE5wa0p|<91ueCL2 zd#$ZG_seQ)&P|uvnqLK^t$7_#=GNRD@roWLUI;S>q=#O~dkAfb8TP`Ykliz9hFqF{ zuX%q~Bla_9HBRKmsmFi#l;V0}a`%&SDpYT!1;9 zyb?NH>0AN>#wCYc=9F;|MiFz`&H&d>ND^^1?-r4I7SIYoToY~*M1}YgK`Vi@X-oiV z(*)O&Y zF%7DObpujk9c`>58Rx7ZYVr2*RlYoA z#ET+J&#Q3NP@49XKICvW%+v$$i|&k@B(~`Y=2FhI#bWQ77|w&mk<)n)&EM#MFssuy zcE^D>Ut@mdfhi3>tYy=sg}qQ{?T+9&93hBYM+61RYmaNRSGj}5|Rn+;tHeBhY6ShAojHfhK5 zPgf(v!Q|Hu{2H%k1p9F`H1~q!_>1U1obJOI8Ig3%QxMaRBaLXiOYdXp{WScB{V+O3 z#uEi`3RHgn8FsuJ8|vwZ0hdzEu8LdL@x0F5sFMw_Wq_Fp>q1e~$&x6t1XspfgQLRw z$gGM>DihDg63nE^1Fa^P9%7z6L#dc;o=if=wDy_cx?dt4m`OYFU5%+~b#{RMSjIG~ zc67oni;a&AAdywmC99@8S#=4rs*H9xu)^GPC^l((@b=YYm6nJ%If=NV@j8}{A{-BJ zAycx5DR~SM1DU;-X4G*cDN-@yq~eagQ?V>I21}++Dw2w+NE`a1^rS>Iu^&D?6)}NE zEy1B{_*3&5&YTm^Lm?`SaNVTVCS0<_**uQs=a8AL0JeLWwl%mJd(8P#>vSw}d3kjr zpOL;OmY7i!oj0f&d0jne`_g`>m094y6coGi(^-3(O5sv(PugY&CvS^RYF&oDp|U^z8c*TJar_81zn9gR%|qp! z{;98Tjvln%9|ffS{%Jtk?{ku@{XP^p=(X6%mqKA7_JA~5K<))U_igx!K^0S5`Ezz) zRMDWI-&8~O3_fs(1&#(lgX~0qA~y`r3#{95YZ=a{uoHi^gVoRlK5ZvYJwKLsTv{x8 z8S~O;kX%@9&+D+WTkNc?P7GIJ2@H*3IU2pk8?m`3o*PRptFgOxa`niHWxo$q@2W5A znG(?Spp$`ERQ!ZvV_u0S9z&LuLPL5LG(XpaKwE0m8@+tUL@p-w7!tXS@Wx(yHgtQl z8OyN7(nPLy0}jb?D+jiAA#R~{&oFK;Xx!eT;jt%f^uoAB*{h`DhA6{45@ltWZd-aB zS0Qxoj3$@O?iIIM_P;gke`hm->2bTJ@+xoS+>FO4&k9Ik;p#;by6Z6thf6TRQ60HVqm zN7fALXAQb`V8ejgf|`6P#qiMP(0$fI-;oV}Xn+KGhM2g#v7|wb_rHEAP z4;xP0P$(kB=Z+Z89fnE~slL=JoG@J7Ct)ZQk>VS@C`w)L_`cInC?ds1p(yO1W%c(Y zFW=lOz6*eUD1HDes(0MybB3ED(tJ;RnlLd&uV?v@pnPyN_nf>6XDekxqNg~^-ApEneWNb#sr9HuaR!B8n8RjX3amCPRJ$;AJ8rZ`ekk@ zVs0rFeaZ3B_~w&||G~6ayL_2jDH#+oEagj{JZH~+GVy)i;hUaYF8{;JP2S6nz&{(B zvTSRlBZABK@N$#qXO6(PzwniI;$rP|ZgQiE@4HP7DPj%2-ffe>-hP3*6}m@TgQ(NSjUe&wyS90&=!Wr)8O3aJBEuQ zav7Nl*O8Pe9{2e-L!pQiCo6@tfdMP;V(n1>)g{6A_Y9RHQk|w$MR`^cBrSrZMUb>; z?BK3J`$EzsbKS&!?lT+|k;6FUz^>oPg(a?ceE++lP(+FeDGFz>;BDW3U?>!k;(Sls zG7lDhXs8sCDstFxeq<;Vkz)E0!}$+GrHE8BQsFo$a6Vk!=YB(>h!i|*A=@e*)!!PH zHPp)Q>c20yrC)=;HoMGM@rKfogV-y$4_1I-gU`dH-Sr#=sw5ELxFs9 za~-lR)OBm2AU|uiwNVCY-1R4RoY}^rGutXy>9fA%yU<_m`_F7^zAsCPRx0_cN$xxk z84(mwghdicPpZi-3BG@9s1%WENk%H~`12=*N)f46WTf(j^;1Koh*Y;K)$$x`ISPH= z{QjoeY{Faj*<>gck#en4dd9mWUGMnbY$z0w;*N|GQU&fl4;v~)q}t%2N>%FlE(yN3 z7%D}i`ih4tbACNys1%Xv?u=C4G3Hl|UKQ|PLNO7N1pe+s} z#e+!s;KljU)Hn=;@)w3u5h?#eDf>wEt%gDoDSpz6!rRoe7z#zCctj`)do-gIiPc3% z%pst5@kjRu_~AU;3`a%e*djhlT`#PPJH&}qahD(;b$wQa4gGoNumNI zQN9&iqDe%53|c@;AiYUm_y#;yB2=ZcPL2^d=e1Ebg`U-~xtRang z)(~Xb5Miyk_M2LuPsW+kK0y!onOK zPA?hIP*9s+55 zgr-!vW+Lw$SM4%Xibz$cRGz9l#tj7DPZ|nEq!=a?#XUM95~Wwn6U86hzrYXYdCG89 zM2^Ra&szFma-SqWeaEJ$F;3)L=Xu)jP(&W1g~&Ts^-}CM6pBc3h9jSs#vAuNhDH%- zCTS>aWGAaIlC27@XAFfRQdIVm%Nxco4TU07OcRR2aK0689ASm$A8&=nA7_QLiYyrm zdI~LzsutQX&?QcMP@g@8_SYr^MGT=@e3k;qL*JK*6ASI-f(EfPTBq=%;%t7N-q!~W z9Z_TOUoJs`T#iW2wlLweYQ=33&;mijfEEg(@HYq=3Dh9yB%q~&P6gsd7u4y`S^a&X zX9s=W7jkk+QXmWu?xO*N&Jlreyh@_s&D%+?cYHr9fsjHGDX#5Bae{|puc1&xih89O z9Iyt@$N$V+YcN!3gU9N4eSwGiIYX_8)HfbA_49^W5vd!MT54gcwsT?FeO@qBib(Zo zp&HrGXZ4$pmJ5$d!MEy9)j{E&kN|?c{1_+ z>=9%7qKT;@hIHp)W2*ibQ$>uaQuK^zCf;A@Gp4EVQz0ndo-xhD_iGwc +qzk`( zV`8a@vHX@&1pHRu3;u@eTAh6l^-%rRP$?qSzp4B~bF86n2dsgw_J>AG>bvDqGCkBk z#}tYzo|Z-~UzUcH9Ez9=%9lKOK9~Ds;`@N`Egphd?h=h{8N4%A zpO%=C_ELU0&+kn9718G=<->2rP5shc5mQvD$eWgN?vsiCwzPC~rC~azWKhJglrMSy$YpALrqgT}zCFhn zS9z%Rnb;~~Y@gDUgHmJ=8ovSKhgbvttojWSUW%@&R4Um;ZDbFE9X9Itna>F110Yq^%WD8A_nz}aO)ZM$#~;F zuNo>vq}s1k#ZVWFFR=XE)UQ|3^V*#|Ma8CCCukCf#jiN=ZF&}n<%JP zIw6-h%zsFmP13=iryNcZGP*y=59jGJp(`TIdE#@0>xJKxV5&G%f~cVWKo<$}2SP|3 zrjG@7R!kgyg{$fC0L$fx8cNJJ+J|)Var#ojmwe#aBjs$NrTg*xa2|&qzZ8+?V)41q z^}iNhtJ~T{;1Q%R&mxKYfx8c-@ulFhWuKWtmoYDQ$okL!zDiI?`@Mx zir~q@m=L*Ht{(K0BHSR(6rn*7Q)!u?0-Y&Nq+gvcuCA^B5B_3EyQDn9qeV;jY#xZ= zlri?MPEE|op$AFirNYxm%g)xg^Y5Bsy2*cWSJ(<0P;)GISf z5!v1>96w}wtydzDALmK0Lngfxk^ODrvsZd0#F^>!IYCUXFA4g`rq}0%r;}czB)vv^ z)9b$un_lXb>7@wFtgi}3t9URb1@n)=3T%h-^2C z&tB>DeQ{dY=cDLSZtfQvCmo(+u_+ND0`-_) z75V}{gaSHMLA_;0{gIJF0rXShb`)*jW9ktk^YHIJ@0<85f+y=2;Ea!i6TerI(Oi(N#%rNJTuP;s5!(`8s?rN_V7v_ z25QB>`(z5|Jq^e45_Z0swkcT@F=XXSp3gWw`IU*Uh1v%@oPvHMY zXAPS_z#0bghGAom=_=e8+&!R0!{jyw_sKOJ6p=%TrUDfrQ10__Dfm|XG5(4;xls!G z;ss&ulZp2!%G>ec@?{FA!cT>ue97}SN8nqgv7Xe=n$(E#+;~icYBdmE+UGt26I(@$ z&)G^jF54P6-)Ffc@?Mt&-~A1hB2t~3N~1=02bSeh@U8k|8YyBLDFuBE^hlJ6_vExR za``fiQsJjUP`>0z+i3U6#MjoC%5r)EmecdGoQ`Gni&M+#Z@J|7Mg!%vc8VCU3zb6; zHTQTA6)LwwrHE8mw`aZYLFH9F4lq=TNOgr!$>`i!h-WZ-lbR*gi66Q*^22!s8g7b6 zQ!75}T`x?jh2jLi)*?Z@`p4bAV%SR*V1!ceP@o~VHZ}Ub0z~PP`X(dEw>-JPZ7AAf zD54~b#b+syJoLT7NODULNve_SV6egWbz{INQvfQ3-N*5RpNbgBt->cOLxa=qlHt41 zh^L5@YlX6SxF4E~W70GkOYoLOS~VGr{s!?2VAXmeeT?C%h+OXwpJ|c)qBt@6zal7= z{8wwFM`rt8aF;uJMcVNLYDEm>>%ynFm{yxXEAJsy!pz1Sik(tlam$wb3^BqgBAcDZZ-|JxVxBiTeyQREkLT1EtE4NmE@id>0u?MWlRCDLopLLJ!5U zhC&f3HY-JLwv~Hrc8%N0UE-k{Zm1NI>gPhGs&N@FTP_9Psz0W!A{Ggypsxk^cb`nW zc?2XzGtgfQe>=w-_UZs@&|?KwKa6a=)a=uhnti$=_UTH^FlKskGgCM_G#rjE5r&s{ zUvW_0(BhLXxx@@+W+@81h=Z|w=H`0{z2DP@Wn-fJoi#~Y2h0OL~dt@>kH zDxx$>L0=L4yH6(Ge@sh3moHN=6@DrNv8C0QFeDTrDps20Y z(ZUCwR2*T_L=j{CH{oCENe+#Y~Q_GB=wj0 z8t7ppKb$9QLQ=$#1`4y0(h3c*@-SX>M}00OQ(XPC^eSR)bSQxadt#F*jKLZPeDZPm zGDTBzC}NzHFL`=Rc{A~aiWBih>Sqls9-D8CoIlwbIljUgnKdz`w5nl{`fLMBHXho8 zg@H~L27G&t<_n>wGzJ zpT8()lrOJEb()R>*{h#Y|750!K`s}z?%1mgE|%9oW3-95B9g2YlH$?%*0Av>z;Lw4 z3Uv+KSFk&;C4Jl_(l;QGPZCZeK+vKc}_LrDOG+_^A+-FM0mKWomq;(|lX_N{ky3V`$cg%uL02hKKre6Jte; z)4iz}Lmk1#rQloj#~3SOjFp1E?#93SWa9m!v>3a5DSayZR0ztKJRf$M8lUMjKNh~l z#Xc)H>pbK4mnaI9SzC3=yjA?sLoGj?=S5SX6p?0&`0Q0*w}~@S&3arA>+4QI{=guz zYhgjvMjW+O8U>2FUHtfR#m`1KpekC{u^1Yv9o|XsgpT_*Uooyz$-gbPCZ~*^^r7Ub zCiqvvif=aQYxz_L3`!B>@Rax*?fTlynz2{h7=afA`BmNR5j*Dz-|_xyeC27i+`D>o zrYSUv7}P7mENegxCWraffUz(QZ_rt>Cmz-~L#c?A`-O63eU4R+f?D`?p4IO$rfSM8 zfJIFGbCjWo&9G9EKQE+rpG;xAsbM%?T#1-iDLE7|sg*BzPB;SJcO1Up1i7sqa+8;G zO^<={C-3u*!2hqpzc4??${(A%PfYF246WyiNG=p|EK``gd$^uuQd|*JJWG6*ieLW3 zf1Wt8R16U0N5EKXlmW{|7UE6#(2}}SDobF2&v&c;Y^%(trgz0Ky(@z0-7uKmVcmw? zFlxv`AGYdRfWtsTjig?U$T>z*MU*tuThd}9>2N_G#q@51RJL3MpwZ%D!d!7<^{f*_ z)4NXzqVP8g8VQ6E84}_ophiKb0%`ZFrgxVf&h$&hV8-jZJS!y6S40sQ<+G}M_xbtL2h+HhRaFWB&`OW8i6N(~+5)+@L@*W?I-z;&0Uu(7?H418B z#;Q?}{|3MB^M0%NBZ)TGh{i40?o(+*Q$*3O>@6CXXmnrCb$yHWZHOi%V{lq2+W?m7 zrRmAlq9veMed`H8x*>(eY7w8Q6{Z%y`3%$e`M zG%%ykAN5&F0@C%)%yYZmT6j0pY2t_xR}sTlB@&Gs=(h&G4XeiSbW2gO`%=G5YDJX7 zp#n0~!LRjwK`AY_Gn*^% zjp{3k7nmRvF^Kzxi&z6)oEkjxjrP1u;zz{~fED3~^IT}SDI(2J#b>YK?=QreLbnQH zztAD5ht1Ms;^@pjdCr+N3i%FAR5=Eg1!*=B=isILs3(>XMHJ-;VP$1nvbfWw!}mod z7K%vvOCc=|bKlKStMJcxU4eZ%Ds8~q^cLhg53d@-OA&cJFT6$`23ld||YFeb2ui z0pIkN?=7K)vvol(KlQoTq>dt{PN(=Rb-hrgx5bHN<)9#K`F2ao*Cj3AZfW`E9(~LA z>uj`qRsP9n`348}57L(J=!VDCWAz>$^F|sSL?~iZ-s>HeY$0Y;sL2DthZr7XoxTX> zazz*x7j)(A>#6kML`EwplRjvq{5MawUTUONL@E1=&$I*|WTYG-s7SP1r@-@(cBOn% zy6^GyS(&|3lIgedN%x6TahdrB7 zfo39%Y>P{1>P7<@ZT#|X^D zCiHy!XGwP=bRi}rMGWZ_@mVVG@xdZ7PMqM^I$MyA=r)qkP)S%nrk62i*K=y`Z3OS# z=L!>&B8D_UnCVJ9+zo>I`4 z_uP+6yzf@t@adI=Ij+9bLr}itc^%W*c{1_+j^RsBZd&xkSJQ$#Z#V+q`y9UDL<{sD zX`P-5Di>2-`IGn3Bk=zZ;osA+smzHfzZRHMpol5-lZ;fSd#LIRl_F9-l99?A)^&zT z5vf{~%40t0wkr&--cTqaMSCv_88Fa0o`r@&5h->lMFumLtAs{Bt~Zp5NcqeWLT&37ige=&T)+N5A#d^IiR!>70T&cyd! z;XCHMp4CD|s0<3v4JKO^F`m8w%(ufmQH*r6WT|Hd20~dfv+EEv>&EMET)h0o@PZZd z7Bn<2Tzuo<*jS%3e4gyV=Wt}R4An1tP+dEBet7PZC39~M-?(6Tc+r9zuWPLD#p(3( zD=#(TRV;0sUr`}`jz_dT%?#XlYA#=~-SvU!S5SPj{g_@ddnMgeBRupjb7iqFw^rDlm6#Q!1&qgp})!Umg#=@)MlW) z;_l^mxVWEh;{K|LwX|``!W*v(H!fZrUbOf|R~O;smcj>3TD;#QEmD4Zqih&lX^r)v zrI=XPE?Ip2f*ZpPOBUa-aOnc8 zuBowU$%63QMIf1fb9l)Dl<@`27Rhq!hr1)Z6@I^s~Z-X_$e`ndc!{qqMkgm6YEL)2f zU$=1HhX^NA_qD-<^H*ts`b>wTcyWcvkuxM8m?NhOV#ucn3Ip|BvNY-7<)c3fjS%M= zA+VDKEdqtWE)<|JP`Mx$?+JofyeA3*IO4Oygo68`oz{lSwi=2ec1h?M=Pp_hzH#mi zs0ecxp*l1!X*ztlcEi5i1aYYe;$lIJ$R$TD>URyFtN$)Ou3R72_fL$RH})xK7=d3a zZ<%p(1u^612`UGgFQ@{jPLK_>Ku`@(y`b4Z*9ocx`jnu0poM}OfEEc_0d&0}fIgo# zBR97l9j-?ui4<3O7_h6PI|P8>64;>2?o&As8;`E%!tn=oO* zIcLrtcV=1HIpZdrIrrM}W9QAATV6iD?96i}Tw8Y5Cnru^+^}HD+{VRA!lk3FaOvV@ z3zmc}w1)E*-#CA1Dy6*b*FrQ1sfl_DAzRblK+q#Te>ADJN8-fPdPWda>sNxpK%LUb zdtyAZp5xk@#fuU9rSs|+%x_wR#@vnfIb-LKEgxTAUN?XKwbz!HjT>J!VM5(G^X8Q; zn0wB+vlg7wBi;z$V}G7DF@3|twCA`Y3@Kihw=5U031YeUFF`C9|0$>f=v6^17q19n zxp-O7Y@pu@0yyd?A4#t>)UN+W+gE@^@qO>_ij55_ih+tPC?%+ffMTI2idZPEq9BNf zVvB%aVkZW6cXxLyw%FZ;?f;&0WA-vD^7;Or|2z+~v+um`dG9&*&YjuWWf!&36Yp^g zdg3E)nUO8p6J+CmUVe&7WC$l4;bbeE{(h-gIYQHFfTmTDCUk%%H0XbBh(2LyQHDG? zb3hsNb(0qNLN~#8V`%Za!3=NO{7J-82zx>32&=t$-IZ{D=v#3$P(mM4+|5zk|I^T^lQVJBPq} z!NJz`9Q>_qt*o7#ol#5g(gg+g8xZX1<)qv)3F#Z{9~u$_FG=B6NX{@jvGXDP!GfP70~>1TNC( zeMx9(D{>Ap(7;6++^!{~nk~AKK+#6p%USJID8HfQ%qcpL%H2@vs_UUclQzMd-fD!_ zb`q_H+q+6@l`Z6F`= zK~hV(C&YowdrEr&)m><-q5ZVg+*y~Cc^jfqcc>?Ihu(*q?BoL%ndy3-Lj-zj5+X#P z4kEzqSEU~^XVPEVn>lPW?o~2@{k$z%)ls=cO54FTnd9p|hxQLeKWP65+=BMQi!Y`9 zTmi@8KVO_=PBvC=C>}B%_d>FXg2x-4RkF0vFsaZ+^LQ|9v(k-27tl=)HuRow zz*KLOi%_@7E1!PaN01wCsD*Cqty!W9CFc0DuWDmCxvd*5}BL5$9 z*KH5@AJOYYcIaJ>BO79z!YvpjGjR)I%@MJ9>$9pD%^WI5GbbAwKF(kpT-w4$rsaPf zXBV(_Q0dFK1(k*u{JgD-O{Q^1F7&b-XJqd4hxaJqSma|jtIE<$p|Uhn&?J&S-M%MJr3G4(j($*~2e<_lf?Et(R|v);DG@y&|2`uB zLzQ%2g+sd@>um$sk>&CXRgg0swJ=ucsD+qx)IzSxsO9y^sO;l)BbC7#_uNE4$^T zZxKUz%b^a+3vZ??NO|*`wk*3D(YMzj zqZ%S3c$Z(vgHH$0Rv2Oy(q2HbTIz_*XpWE>%@JZLIdZ?Oa#TJFK--$#9P45mAjf*R z1-%Au&~s1nlr1=IkqdZy=bgUkD+Z|bUq>kK9|!_jIqHqgEHsU9FH}_-vpkcmvZqIx`u6>&h=o?7q+fL@@-hXW~cLX)Gxw+mpyQ|QwTIh;wXrUW!>3V>Vz6HGL z+wjmoo~VQVfe#)i{iAHr){^h_*4e8sE?^yzh2s~u{`*m-d_aJEAy*Foc{2f_(7+0j-)cC?k*&2B8ZKz0*w3$lX`OX$z82PEfAKZl`r$^lzl zDIE66dc%<&(lQlUFnnp^a1hTBN|8W`6CqS8p&L^ly&`Pz9x-MS{}MB0*_r zk)Y8^k$6{RRV11$6p1FA-6GMChJfEOQ6%_Wj#8w|S)Y{l5@EKMGa_qx@d#O)BL-R1 zi$`dMa`Bj*td$S8(AH-+>r3biephh|h6cR5t7J_8TR9nSDs4`=cj2plL92A8n$2B~zzDFp^AM}HwmS(1zo)ni zG&gst>(Z%H7rjRWnDUc9Y=dDgw1H>(mb|zZ(pRnzc`8|@Pt$<(X&PLk&x2#onnLJD zR+^%?1!Dp}cJbHrmD^=FCdl*=!3z@Q-@lKuT#sy5#aOQ=Z)r)~``-rz%?_$Uv&(K( z%Ay}xY0Pj7ssf+F_*+%TbQ(ck(ZYPHH)HUH*7F4_UrBE~&dB^&1=$ee|2{L)?4T+% zyX;n_7Pf(`G_`RHssf(``CC=!t9+OteEWv`;%#^5|MKCEEN=~DKCGyU)O!r0 zY3@Aw{WaEZ?UVw=ohI2|ex9eJW%89}FUuDld^OM9K^BV)PamAnytG?}zQT_nTNNHe$m%uLVnU)V6i(@Qgoyf4@~s*ALHpUH8|1Hrv(a5`X+z zx5RO6pDxd?w5VRGSM-aG{PD-0jt4J{S>ESW>z&_ro_+nad~9svRSuq}E25GOj=fnP z#@jPzbc1Dot`F@r_s^JPrP8){37K@VhfB-6_TKAzp9Y_R-s--0*}&QX2OUxeUfs8{Lv4rljSrV{+%-jbSN4td^K9|qz`Ok&TJE{p*>udtTfxO6wsqo>~BPGTfSJu8gxc5fW5q*~W4B?Nf2WA zhh{yk%pb4BAD@!Dx~a+eg60P68a>HZwdUX^XUm4yjNde^Wzv%LP0wCluX^!g*iioX ztxV09H(Wd}2fwdzJ>|LW8y^4D;c6k~%ZzQ!lWz}PH8Ejj7so!k=bpS$xP#x|wCWoM zv<_)pz|o{eTKcO_1*Ujye`V|=)=>eJggY|fIrW5XV;U6b|v2>)qnBh z=G^xIhek~Ald;t18SfAN{Qeq0pFSIgZ?UpW==><7=P!=`jn~bfyHSuu*~YQma`v2i zWyXz9swH9e1nROjRDmrO)*4Xu=zTx++~P3zPql`ODO;y|#bV~a-}zjMnUP~+x0WSZ zB)8^|Qv)q`ZHxb$eCU39Y*9O>l9?ZQJdX3{T*n`~URpoyY>@LR&f|}Kf17=WEcdMS z-@)r9=C46teZulwurC?D`fc8_zuTU**fr_+!lCH~$4oz$JLguMKc4G9_-<whT9&-*hxjcE@ukJgWT^JO5;b+H= zZh0E`+b`=l{qnnxiCbC~3Jc$L(QVrPZcoR?9DWzNzU%)Qr~iZLPEq|6&1>(dHmJ|K z`M=9Mo_xN~sI}w&8t=2ij4B@X?;CcSvFWzkpS>Nlr%3`^;!L+yiA^XOYv$SY(W0c( zn8pcwynA*WRQjf6lj*!a`MBrL3zsf&#y5XQF;6&j%_tsHVAMGNILkR;_F%&br+2QL zTe-XK(*8Z-XD>?_SjpO9@l%uO-HUGJ^F|K$V>68NmVY+8Pw1F>8(Pie@!!ldkLWe1 zaA@-}nx^9}@0!Q+=I1^BSh>ZFcQ*nXdGW{ak9Virc6EMa+|;eO>GiIzwexp(&(k`s z?EIhBrCdf9aO1ug%6U!=IA)xe$L-N=NLpw_A*0NX4)KrHHnQqI;MJs&Q4i~X`q666 z5~J$-3Yw=SrY4Mk;k$5s&zt^tHyDP0@SpxV)@z#WwyAx}`>e{hdfSfa8>07}Gn{5I zc}Z#8F{gchrpH_h$XM1q!L_l;qQF)DiTAhJE_Dh#x~ak~`-lgo{hu{&o92}F`@Ag` zPVVU#y*k$YbJwJ1F=Nao#G78Yno{%pwvCm{Jw^=W{jfjccJ)%DU;FUqqiP(mvrq2j zk$C2hqrGjw#X?>7T)Fh_NaGJx{3`Z78hnTM7e8P7ta~u=W`%+dEyKs8+&N<3F}O?Z zl8;~B_e=&7xdyoBe)Xz&fUu z&)Hm)fBmw2QNC!-L&M+XTQGBl$u!(*=ZtM5=M}TxTJu5Zgp13ozqdP9)*)AX?q|I-{k9uwM(-ZG;!Lc2Tfa{Z#vAJTHF*Eiy<<&2 zZusNH@l95Ao%8H!xfgkd-Y_!1$e*7{TTwRQ;gfaz`p)XOd;XD?Bh&c#J$~nBi!bel zUn#cdcC%MUoqO`Pmdg?=XZLw-q_dUTL;sY zIUcmCKQr<6t(C3Em^ODSlNx?EZr9dZi^_E$#oN2&$k?&=CwhGCH{CRC;Ht?+s|~!C zJ|F&|%F8h=EjoHTgxk~_vDdcW%NzCFe9T*2zH)a(?gm}=j1E7|_rJ<@yik=P7PJ4? z{dVmZK20@AIK|_Q3bET8=sV0d@o~hg>Z4-1-ucw=h`Gsxp$0)g%S-t$t-pQzET@2? zO&t%V9f@3EI=b|Y(CrH^xPQKsInLkOm6>mm*z;YrkMlq0o!h)r)vFI?7$=&Uj{46|ub0y)SMy8r>wgS4F@H32#u3-(7O9KIez6#S*1mY&pLT1v?z7$7+xzvq zZH*0EE=gPZHHzcWTe=e5Kr&=*xcna-aHO z|9WoyZEv?;${pS3Q-M?Mhh6E`?svkn7n=?L%wJWM?{9vs+@;e;%yRsC7i73U=~IB& zxneI1G*3FQ;zaOxPs=o?VHdO~ru1_;m^q*8pckNi0wzx+AhzisM>Ij7&2D|SD*>!W&uQaA8+20BbXo$;Zr5$9iX z4~f1wdZ-z%OYZSi>g{dl;mY^_&EM$u(^u2Ns=uFWaNy388Q%)u==N%G+uo_cFMJCe zG&afCF0&th&g*#Zq|&rfe2)x-I8!!0Fqw<+Q2Q+9gWVg1i- zFE)|$&JHbo{aKz9qvjR9+i+w^iB-H#CyS0e(zUL&cgWB^+a}~pxWdOL&wJaOBKdlG z-l~4~cjJkRUz~5^IXUG>{HfGE&G$dKw&Z5;n>SMz3|%#>cs%Dvg8x<9VG7E@0iee$d#f!~3P* z$lok-)}`kIV?5Vy$~?~`Ofj0c;$ftQ$L0OM+vv%$m7@>TvaB)uQc&0Yu9=_nx)hnb zZMAdc=g-INEx%fOY`oSy>DHnv8_PMCo}IF&qF)!^R%hQniuWn`;lJ|vaca8?ia-+Rjn-Yr)*52A{W^(7Bg{>FQSkxxUdR%?G8PCl2 z&bc&V_pz7N#uaVSv5;B4*QUd(oUS{q__H}(JjzZQQO<4W1H)^{ZC87wF1MdQy4DHL z9u3QXuhh`y$Bt6hzK);!=;L;e2tE#;*EBl(_CZC@>dXFoSm9o2_l}PV0aZFaILhn% zYul-UAt5gJYGuq`bF$CHc&_`~aeUy>@D6qsBTn-9@8D^>&gEM6yY$^}^r4zTH8=9{ zlWSmNiD%XBXYldG=bQK+QU2}D)oNP6cjkf_qbqs(JJ!zN_57{EmoeIzOz; zkfkYQF6}LS@MER4^p53zg?_(Vb7GE+t)(m@3z<%9y1cpbf^P+8moawld#OO4mZyV) zHX1jr5$8G0Wa{Q7eJpDg9@TE#tLP(Ly2r1`U(IiGIet9w$36{nKCeDKU&yf>DY3B? zRy>KR5pT5ZsNeg8L7t0ER*&d8WOMzm4M&!|V;*$lPU;P_Dv2LA*S)iJ!ZF9U3**Kt z_8%Q~z^HX)r?7y`@$NP6FnoZQkKfII34Z zza=@|WpuaQetqwOi`z=x+c0R8>nyhpTgUxaP;pY=`3qO_CoS&jW8v1gu|con+`o0R z8VwJnR-7<7p;(S%-a}{2b3gw6psnAl8y<$;5BFYUSTFrl^o|CLf4y2_c5Kr43nACc z?`*r;sflUXtqwlT&kS4g@|gY79xpzmRViSy;ax-T{t?$|FRfMZ&fOti?%n$Cs&OKG zWkG{SVP-9lHtLpS)$rMtX?2@5?>=yirtYYPd2>{KzV2ngk*kV5{VC>y7CCGOS#pd=B=%a+uQRxmp&Jlv@_WIJI|}wffJ#Boa>$9 zzQ)H3SOkpmhEq7am?&0;Sl-RnA z>mLi(7WXbR88=c>_Q`pow#Jv4D&9=rE#9!EK3+~ni8 z^x3^DW16(S`qXI7%U880?rc58DWgvQ^AU#w|S;qQ9@V_~=taNLV{a6C9=5ne z>mGc*I`L@krz>yb=N$Dd?wB?<_sE~o-5U+HK5niZI>2gD%&=mAo3Hpd;@2%5QhKl2 zmF70CXGs3ak#A?l@O(^zKeW&<@UBbzp>=)fr+uF zUzKlnapl(ABYJ3ujSnn1HrEP!o5J^;w)L8){r=?2o)v-bx-5G8hF_2Q)XulKz&`Wk z84q85fBJUr>6LG1S(RxY^zL+GugFbx+m+vV!#zjKrVYc48!TDtFe-Wp&oee@w)^d2 z0pt1k>F2`lt9Q8EuTV5?ipF9@-8bi>k3~DL|?-fT9|zUA13#}_iaz)*vC0_}e%-O`%?2Ou!6$0IUOq0qON)^W z_;ts(-s5cZJ$_r{`-}4@(!SJ+^z7(&I(EXL*dApb_l!7xp!|mniwRf5o15@{U%NI( zo%lVqX02#a>7`wwXV+R4mzG#N?U;M!d4*pGj_!0bec!iuM?N3$c|4@$*P(4<*Y~>B zboQo!t#738_)f*XnO-vXJofcQ(4%uT_XV}z@p9cc$ADYM;~EATIn6Hcx92-bZSc#qzWe@}P4~U}G2uu#c*IUo7-8Ld-Q0rUgG_5{WOfJliYmbdyMx87E z`M~>=k86HiTI1D*QvD-eMDycqb;7DogT3E(&V0O)U#G9NtJ$PtyFb1!vvrG8MCN$s z3{rcHJevHZ+|tgu3kAiN<>NE+^;4?f$EN!YE}A;uG9B$aCcG;@4ohr|%N07RO*$Wc ze7-(ex$3R^jYbx{F(L7o(Yr;(Po&RiXxZ~Y-hfF#ZMwKk+V4@lalVpePI`u}n0C8+ zVv!;K_e#y#KDTkf9hSQ{<&K#a@zizQ)j{QhPVqWU8C|zz!$J<*Px_7ip4e|t|Ll&- zd@ipHYrnR-v-0f(iv~8|2J?6ozPrrm;a_Qhi(kfLW4|rp`h<^5K2C?eSv0xa$y4)r z-Mmg;>}$Ql-~0FU8_5^auEzYReCAHV)`Y7(u8Z%FwR`v6`QudVb928&pC|Iy!Mwiz zdd|;({PiF2Z~nTuyh&QyOS!I<<>$e{=@SEuj`Rtf^3>Mi``p(JuGA>p=l;iwezC{y zy&3Em82z%;*WVheLxbzo%>A;-qN}S`*BNYU>{0CUkX8Nfq`H2)*8F|j^3x)tPkJZ( zsh3ft#l6T!$z3};yj&LGb!gJyz?@UFTjvX=+Wu(|<{szQcg6ERm^Hb~rXEikUTpDa z@Hvy_kN1Z|7PvOt` z^%Ebb{Pk64J+Jfsuex%--VF+zf7!6`8UFruO7g_>+ctUMEf+d>t=FRFZ}@ZmXy6y# zV8rw0NngTN7g*YRV&OZ(Txt$2uxefXJ3oxeTswK>R1U+^t>fxWZPqg*a%@AlvwVNo z4dMF>BvmW&=+wijYg%k=&EtI?d)#AbTUR%(Ki>WA2a_WYkIxxeU`)ot%CEUTx&4`t zSkEcfxsE?BFLiZqr#cA(IFI9+S@xfNI*c37pZg>XxR-zH(wUw`IS+Fm$rzm_H;stTL({g*}e_2^7=BN>h_q{bsX1By|pYZu3L^OwK~t;+%MX- z`Sn1n2VXKm(~Y)#ci{2){KNC$b!ZejqwxOppX<5L!gqE(^7IHD-cui{p*U99VAkrQu80r8f%(*yn!hz5E<+=lKDL=KN~=qqNnjeTSQ0 zSf0$=$@ToPc@xKkNmYM!<39Y6@2_icy42O*JvZI(EpIzb+w@G4Hy`5fz8&n&$JMavPthYH?u0fZR-QujXrrRe-1Udo?>gfU~l=S18doyEBm3r=<(4vEJfz@O)#t4LM8m{bMTiYdz7<(S`TN#Tic)JjuD*tYY`GZ#VlF zI#IbxmmB8iR$aNCw|`aY)a^ z^w>S0{?^`8#V6%>(=ha23Aeb2Qn_b5=S691d9zUG-xADdIk1kjsZ1wTbxPST0ntZ)wPwh9uf3^R7(jb?S z@5%{uQr| z&9q%FJNMY}H(t$d6>qFPIeYQghGEOSdmT7;!LHlym%htyhHZ)KzIe2!_~@hkZ&R&9QeTr z;B2bVi~I~3^p0+w;j^Iz+A3rX%k#LgBh?)8G1Y%^iXsPoI1hd&ZNJvBg>IZd1fzQl zw2&RNr`0mookg(;4LFk%Q%|Zn6_LaH;(72%0%Xps5^_Ar8ji0I zgS<#5XXcnA2YyNtIB8)?dg@adImgKX4zT>p}p zZX7x`sv(Dujrl$L&#bB%8`ULF!jaXrbUC!&;Yc^oX6;o|iUVFXR9>|t4tVKusFy`H zyr9RG;}pCsR9>|u4tVKus27Yb1MPlN!+d1RY3f??tC~t*&>C7H2U-Q=XJ*r~#&uL) z@H3nSTIdJh{5Vj%hc1VD*&qjgtqbP*(XK8gx?YrHi=5wt17mUW=90Z>MBRDJ4mrF} zdyIeE)K;fGG)`UQ93yKuP7OSko>6O?#bsKJ=f*X+#Qg^y^ana_Dksdq`P{7e80pPr0>M*Nbw5dn`D|%#t+TQ1vzG9O}bU{rEAO_HOCb>9myK{ ztMH$+3^k`Qaz2wajE(*IXGZCAXkRoz4)3pwggzr1>+~0Gj~jBb?u(|#2_kEl$CB^c zzS8xgamZBr&l)z*2B!sb29q_^$G7fEGQ}!2qXkqMt*Se)g$Vo3V2YTvXoKDE;Mb>a!Bos_}r;gJZIWT(w=aP+K zjGEI0Ia&8tSLDFVfMb6B#VzVM@m>73=FxS?L0k6&GAQ0*0~2DX9`)v+;Z{r zT0L`SAaV@I8Wu~}nuMOYPhrL|(3&HI{KCVa$ph7#VC2BnIH-5$I!cCi<~TjF!Rd*d ztn-4AqrA4#-{z2Pc#+dEiIeqs?vsu7gl5AlEE}A@$jSP64@ZtQS;Nw(c||g5Wv+7s z*+X9o|Gh8zAqVD6;Fx$HSgei{nTjLBCE3OgX8`q341D z$l>RLif$(&qIAv$loKs+;5?}2kfBL(&pHl7Gtk1!0LOAnp14K2ap-(VrW?X3%i26( za2h!rp;EfnY;bmyy<${t##vXi2imOW49!NIVaU;Kvu+&P=HbYhPm;<{whqT!Jfd#% z2;}hd#qMQeb`IBRGmSG6Io>1=%s=K2+dQO|(!CEb3OV)$JJnvX$l-ml zrPbYDqjbDzpN^I|(C=zaoWy}^eq9c2b3AhVU`_r)?){Li$Ea5Va(H{-nl@h5o-xST zM%KV9alFDTT@Lk1L{3w(hNXa0qYApYQx2K3$=HCA5A(}Ut63$~oUzE^?df~3dr>uK zTsAo4kppKR=&zVn7sv}KWvtTnOh67Wf%DMDlMI2(oQcS(N!GB($!YEdHD{8<>HDRv zy_%DZoJO!Ff6ZPGCa2BJUXzg%NY>Dv2d}2-sUe)X473f%8q~%aDP+>h9A_$Wa8#46 zUk{B-sX5b-V@uYco@dpFyqL%wXF77=N&xz+bzE^W`DNzJKn|}@%RP_C#aCv|Oyodc z_vt+sSha}&SSMle9X6uNVux5;W8a>T( zS&tk$vL>l%UKJzoWY?z z%O}hvNn~!%mTYjgBBvNx!xDJp+GBMbI4c=wv*wT~fN=7WHMGZN%2g9}oE^yN%s6L` zKCx1B$mv`s&dp>4Q#EH7a+<-K{B<7om=r8??z@rWNY=2&_we(JYR(?yz+4E++|fQ~ z)SSI!54~3ZJ7*tqpe?XWD8K8iI?jHw$3W{uiUZ@my}_Dmx*R$V44SWvj#G#zS$kFvubB-XV2#e#D>rM$Z z=cvRvpU1GcnsZFz1ZesdRdbF@oNqan7gKXiNF0a4@uk$9lM-if!SAp_C)Al?>&R%k{T99nngw7!c zT;@2Bq&RS$@K7fXoyW-OO6M4a*H&uI6N#fg&QpoAKYopaZXDX?XUO3-)PMiyIdaH} z4afYc&7;h8^P+KHWP|e(IUC735BYmHG2KBo4$b`)a>|i4EDjU@tbeIfAL{j*>@mf`8!=8pOT$idj zg(ObjZM%Q!P0hmnabGsg%yaCGD(e^rn7Y^LTIOPmowY4z2d;>g)S!b7c1{OXV)qIl8c zq6BjIoC)W+;`r`??tRgc$l1fqR+c66e&PaH&0%Qvo?p8(6M{zdoprQxQ2W$$qk- zskLf{yP8u8IfWT#)})(y#+Z3F;#AH?oGQq1BVN#x@lh{YsM}K&IkQ=NKBXSpsOD5d zPAkSq48Kra&8d!@QiKCb^4inO)SMc~ArliWAr3eCs5v!}<3iT?3G2+{rMGlBwBKtX zhmQ?7ch^*n4GZLulOOiQ+@`hr>vCwHS|SI|@31r-GM!vdXCCvlkpr!QvD(1UNY6Z9 z2RX1Gmh|T-#_Bj$$l>GX@z>2m)f{W&_%W|3{R)!PrqUjoyA5*4g&O8Hb5Y?Z);hV< zylf?}*O9%q=*FQOJLJG|49omG(Wlj%x)NuON$K@!j=kii|6Ym%aGAA>qA#%1c zPFQWf8^BVv9ys;Z{_&m0C=}AZ3IJCc-B8T@EeBQ=Q)nCn!!{?2=-UIaX zMRVj#BWqYXyznHasmyI|k&QSlkpnXWEYTGUzgNd`M-D$O^ncd66>|7^)_>oxbv8I2 z$l>$h&Q?Y>)a_}5oUF%2TjcoDv^0_Xx{=|ZxjvrAF(MqYp_wr6ax*oj9dgLU3XUCfNb}hO9P(pZf&C-;>L5KLg9k-$3aSF} zE3P>ND#GCxAq3`LGa03WmLp`UW(!B)E+H)5T8>=D=dj`kxrks3N8q}dE*ycgos7Wv zlaanEWV8yI%MfP`kGzK=Ap%Kbh^LlwzA$8w;1uUwNstij3G$3lc%#UpE#ov0stycE z5lEC2=ZxMsQyHhBP{EZqEWrY~!w^S-(^+GNgw< zMl!@nAPX6?Kp^`V0^>PE`&e&PZ!^v}q57($qIEW5(`2CFI51?NKnC!sR3J$zWC25R zh}?HD#9OHF(t(VhoPyJtT>$11$a;qS6sp|pVl%(s*fGRFAmI$L5vqL**(i|u`82rn z7sxb*bQDNBLvoAAj&Mm$mS2K1gCWfXvXddp1agxhw0C~$?VTTt6CqTk;AJgYnhV5< zA`V4s^kO+n}6-Ww0+G%-v4lpE4aPBa~O(0r$NkNt+0;$9hTAylq z+w8_T--RlgAx>KEzJwu;0x4V!oXAfc3zZ{7sF$T)uMoy5Ayj7>(n=s78S+OUW#N*L zEc*rG$&gP1No2@7ft+K=N`d@fNV-7m$*W*k-U?(YLv{<~F+;`+qzJsdgbR#>26{7X zz&MqJY6?UA1+tDIvjuWqitMa6@;e<49na-TDD9z0bqVop7915A9VObFL*v^zATla^ zU?9(eARPk<5*DB!uw^5~0mMm#v{WJR|6+9EvFiyBoUDi?2%Kua$mL{}?J%y?TLlz1o zgdx=3N3VMl;~W&KV+`pmkoycNqUDv($zHY=7Kjx?$_vDgA!Y(eW=JK0Y-dPCfjnnO zWq}kat--}yAg&ClCXgNssVb1^3@Iv*-3%!vkk<^EE;20$x7%@nV=zo_#Vi=7u}}pv zBvc@A3~?36T81nZ$YqAm-s!K`>l@?b)$+=hEJNGZSH!8q5QsxZi(e@$C^65*A$7mRF3rzhRtq!ppoYWz-W{OlC;3;GAIytwyZg_T*tN zecKC_3qxKCWCTN^1ag2OF#^d^p0=l^XirmyOctDYhS2tm)!UvUj8jLbN|@2eUIOXG zkPZS_!jNYIdBl+40;y7g#&Op2KJCpASAnc&NGpMSVn`c-I8@Z&;vtYh3~4WrgADN! zNd8JF(lirDFNU-b$Z>|a3#7O?Rkap~7egEbvWOv5H9W5e454+NueZ*XD$~fFgsLAy zTtwvK3~4Noa#g6Rtw5p}(p(^q7}8Q89ja2*58<_(A=3o%oguW%EA+Oxbu}7iicl?K z2vx1ttNOt>NkZjOoyHk1kj)IqC6FF9D5tJK$iEKb(nQPayqzKT0!e3xoj?lLM3JVh zKx#3>Rv>K{VkMBi46zo-REE?R$QFiJ3gjw7{6w2yGo+5-6s@JfWtQMrGKAJ}uihHE zGfo~6CypVBBF+Y#I62VcHbb;Rs*wU&#}HqEJY&cx zf{+x*;!&HbDhf^vL%Iv(0z-lXQnC(JwGfCeL;4A1Awx_AQo@R=S_`BjL$(WK0YkP5 zQv|AUW+Ra!MdE4Cx|}GYl!C&qH#O~;=zy|0-4E>Z3213kVyim=}hBL_YZpABN=C{P_1Uj1cBU=;(XB?$Iyj( znG2PZD@BS3q%T8?3dF22Dh*@Q+epylJohanXN zGL|8Q1oDO<1qI^mrop9(K=v|ZrtrGQ5L)NlIrZIHGH6QUs1KfFzAuj~d zq#0H15=bgTG6YhrIpypXNH{~b2;?$DsuG0Gy`@`FRat>NW=Iu*gtep`Gl6_#NO^&b zcc+{R0{P64HUg>EigL;bq$@)T3gj|F))RzQqeW|~dM=Rt4B07=vL2N4MIaLxvPU2< z7_wO)9&MPb}=T8_+R$U4D!#E>xp zsnL$AOa-!mA%g^>ZBIGF1k#=%#ROvPMLDGeGMgdQ1oD<4H3hP@165fHq^LJVtOOFt z5IcdGb)=k@0vX7V0RlPBkih~m=|okr0-3;&1c6*)$SQ#p>P%G!1mek%Ljp-*$Z3I8 z=t5Oj1QNlJ2Ljo|kVgXP*_Eo^3uF&NJ_{s=59MgIyq6m=q=Z0TF~me5Dcv-;r5XfDIl+*G$CkInbeSs9{K@nr2 zI?IrO0x8>*a)t_|FGJ!4@{l2i1yZ{gRh<#YW`?8*Bu5D4JQ2uthS+F%n_n`dxZtem zO;x1@V%3KtM+7pAA!h}m4W*oG0%^;Trvk|pMmZk^(uE;M1+t7G=LAxtFI8O^NDM<9 z1oD9)#{}XOPF3dxa)==}1X47Da_R|WEJKb9B#j{#1k$A+RoxWGN`{;e$Y+LJ6i7@Y zRoxQE35J{$h;e_)xg?NT47n|krwmymkV;Whbw?nP41qH~J%hxnkXb5Zr3%?6A-+L@ zq5k6Q1R=6-s4fIZSa4WiL=0^YbtgzzIQ=3+0y9qkU@0>B6hUY(>p{vH7}!4(V&2Mw zU8%#n|L`edUBsEhMnt>>S;UcgWCIttjHVoWhNK9@mLYH%jT~!hhRo-PaChN|h@6kN z2Ll%-``tL=z``hq4IpOZ?<@I3FK(_NBC-?bSn)P5;E0IxjUytCK#)_E?9aj5BRB$a zup;{hko`G1$APD+Aix<)_UBS@1Y!-1hGGAc{9#@;yoLg?0((#Lm!HQGc?m?c*?@CI zn+0MIP+_tk$mr!zhit(j5GyD>Ts&+ff3!~_3s?kV3z;q^fBnfHa_o2<1p$sJw1u~) zE_lEq5X>D8=U;%r$P~E?MD!_KA|prSzKkP+0~f?HXSqOl@6_P!v9>0ShHo8%F@h>< zYeo_XR-WwE)K@t0lq~beANAt)aEVOg@KLvdBlf&L4Y@lPk#{he%7%B?8;*!fn+k+; z;Kd1RGueV=3Hd_=%UqE>`_2(AQjog5J&vmO%;734_M%?{7x6SQyD$Pp{(=DQ?|g93q(35!5@ z>YC03#W<5#z8bN4S-yC`YV#^2G$g15M{` zwgb**^4FLnVonf+#5Te1r=GXGkK@By*J&bXOXVgSSV_KkWs=v+&{w&NdKwDvu-D1ARv81MRp?6p$N5AX8Wbg1G|%J%k)Q zp90d7BepOO-;=)|8q_pC?@d7}8) zZLEeps2Y(vmm`me;B_x~q9EAsa2}|^Ikr48fmqccX~5_`#W{HHhByMTu_C<#|It;3 z@X*VKPqhN!fX0Y(1Y)d0N~;jO9);^nD;rX0`222h!NEe4_UIs_9`IjrB?ZS8rU|kL zL{zL4=h(tEB>ZpsL&C!>Z21L;K)99WHRtexX=ZQ)=ej=lEc3`D!Fgn|1q<{&dWkrb zI08dM1FN+hu_6uBG!Y2d&>W7YW0l^|B=zAFfT9xf*aX5yFYCJO=rQMrElkJo{pfJa z)7<$`&_T#P7%dip!y7FSoVAt^&SlQA!c#1HCJ-*tbmbfeGJG`f?E?1&!bt*we=EnO z5Q)yRU`Rm~QiUVp`e!ELq6#x_O`eftDZ-~!1+f7VylUCSIpRpEDiGd6f#C7gpE#H0 z90yir1rb?P;T-5vT+GOt=EWu(O?i%pv08y6qRnjt0wkDa%Ls(K3q*JoWr$q5Rxp5SKRpIjQ@!W&#E&OawM-Vl9$Ho*>OeHj;W9%d36;kh+g?@=gNzO z*I=eXj^yPdRFGHl(H(sh)gq=sj^x!%l~)7db)2b?BYAa~ysVoBTvAl;mtW2)8j9)wQz1w43PDv7(t0w=n1D5_viCL5ak8{V!} zR4Gh_97z?1D(GQYCLbL>T~Xa;D&$D2zNq4(ck=q)^S_E-E>@ zsGc(wawM-PDKDtuH{n%iD6JuKBrmw@s(3*S6_qtpAxH9xmb@<3J6br0I8r(=6>=o6 zfs)r&tD+keRWwr}NAenkDr1^}X8rHWR3OSP3U{sk9 zFBriKH`dWnbsR>UfE>wdh~%}eenKh5YbR47NAenqDwqMl>qn<~8x)l(ybL7^awM-| zlGm!M(Y}gm7*iof@)|DX)y${;Nkx^;RLGIMMo3=o6(UMomS&e!ts-sMW9LXyVRbp(+ zJ))zkIEuCqIg(erhdlgjzQz1w4 znu4k_v?-bvn~tuu5j8x{RLGIMrb=EWr8Mu&9LZ}As&vQvFOgRsxcx~MB6-1el%o2~RLGIM<_i^M0M}8=gje~ofYCc* z@~eOaLIwQ=uMibgbEZO$(Q$L0*a~g{hDud8G;!WB_?B7hWfs z3OSP3Vxi)BDXLFQg&fIiiIf-2hc(1FEH@7P$@`wbk-U~lUKd?n`zWd&OobfDYZ4(yvLHwDT7jy3WFL6Js~bg?%v8vc zR4Y*hcU?dgo_vmck$o<*1xwBe^bt9dY89#q)7_e*^_sO(RKuAHIg)C%$P0wf%k_oV z2c|-fRE;%41-1{oplEc)2qbawM;HLd8dvqKalJcUJXP62(lGjF|;$AC+R|ZodNAlVvR6H+5RRM16k_9=E z*Jf0~RSGQ8U)H8K6h}%+rb3S7wMFtWOP^gtQSE0cpu zZIirC1l+b$RK1xBIg;0Qp@O(DHr@!Yg-nGU$!mvDK@I!wsp+Dq?lKi}B(I%91zvE5 zZ7RG>Cj+L@AV>1rB~;+$vTl)=qH4=j$dSBu3l&6#yxfFW98)1j^4cR*;04E*qT0Yz z$dSDE3KjQSBD`)f6>=o6eL}^@p`ywKZ&Z>6Ig;0YRPnLV?|Ic_--VYYQz1w4Iv{z~ z3~s+$QT1dhnKMt<`*y(awM-qlGpoty`CwmVpC}_~Hx>BJnF=|Q*9pmMdD@pWMKzeIkRy4WM3wGYPf@LAD&$D2Q>fzi^wRrZ zcUDyCOobdtbsAOt?0BKmyj+T^)O5&>yc+==Np%KQaNP^lczAJb$^ zir>@w(XvimMU})<$dSCxp-Q(Jis}ecAxBc3N0n|h6jhEHkQMnATi{5l3#j5p9383E^ z4J|vxRLGI4aSc_x8fWd_bx~9%vp}oSAV>1Ljw;=1D5_wlLXM=mfhr>s5oYZC25)>7 z)mElLj-tc(hM)NL{aTx zD&$CBPf!K@1tV%{iTjNMgx3S6LXPD1RPq|Xc`5md6nD>tkyOu71@(hvtL4hgimEA7AxBcZK$UI{+lm&3Fcos7yk4S;A1PadzYSDW z97**JRdq;EP~I4oyOW|?$W+LY zRNql$NSmTb4gUE=QN3m==o6 zUy>K}a%WNbTTF!<$?Lb|RkO|V>x$|(Qz1w4`lIqHB3=`jEu?uNNAiLxS9wPjUVkYn zccwy)+bCvO%>H2rb3S7l@C?$dKtVHUo9{}QPoc+5Lu8TdF7Y97A_sW zQc(?HD&$CBhC&5Vp@!z7h8vg)Ig(caq2e`ER45!!ryGGI zc@>hppoWU7J5wP?@+yof-5M&Y*-V8T$*YLu1vOMuSC|Spl2=hw@i_|KU8*K(Sa=D| z3ptWkG07|Sn)Pr+)qtsxBY7DK6~sOH`2G5-!m9^UAxH8u7AgaxTH|nKm!e8xD&$CB z@U6WD+A>4|s&Vb(dMc{ROobfDtAynBDSg^fMP;~@1R@J^B(IXF;{D}(X|#c&YRpu~ zk-SVKFLR@MI~COsrb3S7RZ4hiNn5t|cXui(YPgxHkRy4Omb_fPx0tG^?lTo~Brj7` z!K+d5TJ@-1$zsB*&@uv%1v!!z{3nSr&kt*VHeOLRXDZ}KUhsb-23qif{;J@cvPDsi zVk+cFUgadO67f~GDylt9g&fJNJgRtqP2M@jQBh?u6>=mmGs$aXYQ7qZ%6d7}LZd;B zTENLvf_AnK4 zBrkKx%d+&i?TYFawJt% zp@OJoqMoi)RC}2UIg+ZH$O}|Zc~?=5UrdD@sT$RV3Mvop!YC@sl@N)1&KEe6R}G

mEDf%`R>n^uSW1;T*M#SAzL)1V_&&-vH)-B zcSqoF)w!GUgy7q!5kqtU3t)aa|TSmq!0Ti`r@AY!7l}4369zg zgZ5eUagiaSE{XcMjjL=8+ zJ>djiX86huUAa9C+$zE9@=Nxe98+IExQ%{&+e_2ciD_X8U(Z?f>1%i<_5<~mFQvQP z$LaEM9=J>V>H74MU#^X*?~~weiO}~n==*6*eGh{BcZ5E&?^!3tE4M~)DZ%Q>jqDqa zsc!;YF+$%npzk6uSNS=`_3g`G?(lQI@}TzR_h26Na|(UWJZWXa^YNiWmtV546U?c8 zPNDBCFc=wDU$r!>mu}#ecy_y?;dbJkI>f$eg6jY z+z#$%`m6KbYB24B)71~^-=7YqAn6PC+i88`%fY-pf+PREM=n*s%PL#nkr_a8oh#y*j48i^07kLLar` zp9XWE;KJhX0Wgn5=%aT0kRDtY@S%h23&vFn=T?K66dcK^;*Zwj+#(o!WrvERxcX** zQ^)Du;C?39uyXrXOnv+Iu5366A3DPH9VZwD;*Tz_)`07X&`0e?Hm1HgaIcJ^?>#Z~ zeFEIg5&Edz{YgxHzXA79gg(meQ~Opn9ElGdj-M6dw=OX2{G6|z({-x^<{Uq#(02ux ztNol$ALaK}!H|7)=*stQa6gOCNBR91n1lMG^Lrea6a1XdKFaSFFaG4(wF?vV(6G+sSq0PQnAbcDsr7#P#f`SMHtdpVek z{hY#o9|7}eKc~?5Jutr#9KTMh+p7n_JQAUg#;b=6u54(+hmJ6PCxGb@oZ}ateWcF< z^Kw6@$nQJBe8|uF^pXF*2IhNyPNDBFVE*IheEKL}4jbZm#aDLd;_rpv+61f1FU89k zn3CW~vrgZuz+4)kkFIAQ1#_dMFL)iK`xV~+bEn{R{Waq56AZqxLv-@ z%7gOv3&G$kJ5=RC?fCuR{vp^f`<^hevf&x{(4q4m#noysX~A)Q!MLLP@nc}N2reui zIl)l6bg1${?fqncQ^!>i+*yLv<%9ISJ*K`Z!Cf0e-#23Fy9?Y;W9WM{roMefS2i4o z4;{MvQaw6WFbu>WUHkH4aNRNV0Yhv>T12WC`ox^{@#-BSdEuk28@L)0%Z z!R-)iSUz44=52xt%g3j{d{NS;&c|I~ek3?uKB(M&DHxs$b$d$vjo*RWe~kM%EFXu0 zIZ|+8`RD>OEa_9{V**S;aJqa@c~k@wmJceAo#5Ue*sy$D1?J;|3(LnHV16L!3+98? zhy4!Bza@P^j;@2x+Q5ArmXB39`CM@Af(^^ZMlchC3(Lp3U|uWf3))BZ@(M85OZtKw z<>Nbo!B=*u>IYqCz8Bz9%5`MF0QUzeU2uwi_T$I>{!{Ba7~Bzp)%k_m$qblvf(!Gr z1?J2Mebf$J3g+#SKDGa@1#^Soba791e_k;7$_|yESK-Xf;C?39uzdUl%zp%@^9$wU zu#H%!fDav9Uoan3zApyT9l_DO*(rh{eRQbuLGfpS+a>8!m+!@3-XXZKe0&et}@F4(a0c>Jc74F}^xhb|wqA4nURc8Lq-gXB*a z4C$joWglG^a^SWJR+nGm=D@r>f+PQ3C>VTYhbmq2%f;ZX5Nw!Vt_Sl4!Rh=$&tcsM z=2w!wpkFARhXuoo!ylD>H4lmR36uYxk=)J(0G%43U9pQ=14 zUQPj56l`dDfVo6)PP)GGpg6r2%%>!MK|fP{xE;)Q1gDE96oe}<>SR*It0h{1@l4A=WPPBRniyaC|)iQ45dqlDj&pM65!Nv@K$i| zlhOs}D-Y6lOH6&Yfx9P$z6WFK`zN^lP7U`n+1Dr-d}W7j9^@Es$4BU+>)Xbd`X<4Z zBlN9;zBhpRxSvzZQ{MsRUO(q653=tcU>|Blc{{(IKxxDSC39Zq|%$nP+iQ~aDFzdOOa#?LAAeGtqI ze$JM;B@wpp9jEfko2kjycJAQaAAJlDHy0`htAKh z2ykjYUjXh+g4N}N+O>~^`KsW!eQJGofVnq9AH~5x1jBQoua^yZT#xXfLuVhg8%GI- zf%v1V=c~cBN9d!tIz6VoS#W1Z=%f5z9#h}@z+D$Z-?w7wy9eCQW9a*LOnv)Vc-{aX zI&|eh@sa}5>E{&JtqCwiKj*tHPU3Fb9^PNDCEU~cepKEIGX-xUnm z#}0*GD4y^3aXP=;2kzJYbba|CzwA4;vf&VX=m_)68ZaGx&Zm$3k_B_7pHukdQZVoI zb3VV2RW}KS>|=+*FVqfw&d2Heax1vI{ptGhL4N*oOnnc7+jpzaf4+QByM2UUSRUw) zA|JFaw-H>gU`eYkAE$!ZDmbUyeEFbxvkSmnCUL>*Anj9mJ(&FpJRc;dyS}{!%o_x! zyI#`$-^;#f_41jD-YTid*vBCuRK-!edel$ zV|^Uu?->Cu_}p;{+#%rl1RGXvr-3O5&aux|Zq$Fd5X>7SeZg|0{@+z#t`VHBJSd(& zDHwcZ2lKNpzohT;K92dtXJ0G0FN6D=V8inJxNR#No{kS4Vfk$ZbCTe=zF>ao{_i?4 zc}ZW8I~d$~f}wQjP{kFM+dIJBF4(Yq`~=Kz1Q(W%{ijzp9EcAcx_nUmXasY#;KItS zO)yL${^;^?61W+`hUMdxU@jJ1SUx@i=97}Xpr5HcZUb|lq%X+Pb>U&bNcr%^AI0eb zGu(GJr;5L0aPlB8_KJ!3vj zbseNQ*yQ7M*Fh89Ho@xhOZ}YJg1N%aDf%U!19PjN^R<5z&%Xlmke^fNdunNA!*lSV z!?Dj7_jL9o!7z~iDEbHFm$Z-5`K1Tkm_J=#KFBX;f_b%{Q{?0QU_R#OeEP^Q-v;v& zKc~?52$=n6!~H_*k)9_QeC3D2FLXUR3fxNt%i~#HKgwWUAvmWzeEFby{w^?AOI)yi z(EIpq1@mvgQTeFaXZn5kOzd-l4;{LCME5UG2U8Rr&qpxb4shoQhV;>)OZRI5PVJX( zgZq(Sb$+4p{X3Zb%RC=pem)e;k%H6dqx+^^U`8Z;!TeHxC`=8s6h}Yz zajO0w#r^%@9=o0UFf6~%0`mgF>HJ6e?FKU<=?mtU`hPhvX9!LgSHx8XgRksR<(KS! znUB-88!z{9x_0B$;NB=$U4AM4J{D8o=fK?>p^xhCufRO)=M?Sf!8@=%79Tov_N~IX z44AB+Q|LPf%z5r;p9W1?*uSCe$Jys`}Ak1qaR2(C@Aj$ahl z%Q2rmUEGiRI9`+}VseL{h+?9e2%f~0d+#)z# zKIl60Q!u}ixL`hL{^fv|VVxU3bZ~t^j^g0OVA=(z%P);T2Em*nIG&H7KI*p@1%t2b zQ2B+@-5KCg%6W@(!CfR+onNS4UIXT{f(!HW9boQ_&`0_B2bh&-bN}h`OZj*@m}d)4 z=Re|JAQ*gQhw3^=*Zq`_(~Un`16*+YLGjlHZi`^U{4xV(m*8}Mrucgsn5!f%7zfnu zei_X7BRKNQU%@;oIGz6}{`PzM%7&-mLx-+BsDJeW!7vbiRPjgg(gLnS(x;BUO<;0@ z)A@zs<&|JwFX;>Vh4T9zFdq_}F2BTGFBp7fhbmr3{w5#Ct{=YZ3~`@TalUqv(*2x| z)3v)_0rwrj>ik0b{t#2&L*Q1tf|qZYzUK%As@b8l??`Yh5&EeAw=Sl>)4&xX^ih5< zjH&NZaPN%JNA}$mQ{UIX-5H^e>g5Aq9&?V*&x-!g;b30m=X~+93i<}XZ1ZypeXj-c z7C-0HNA`UJ%&mS-q3>5<{y%%~0v}a%wT(|8Ktyx~MGam`lqk`F1mh(b&>50}Gctk5 zMPdaL#001TQkdZ)0*R9d<8dTbt+u6w)~~O&S}&~%cq0%=K%-o&0^$X4RSXuiilEi} zpS9MWGc#w-Or}=f_y2uw&o7f%v(IzZ-fLgh-h1t}_xaR}Gx4MGsl68C1AOQ*>XijQ zH!xS4aVCDGH|7Ad%#5?(_iJGOV8)sFk-V+I>^0*o_#FkNTb)S`3x53-hUBFyQTwO1T45WV+`9kpyG2s&Biwn4tPU5BU&bjw<-)szO2Sqq&HT^;jG73_W*aF!Wwdz+9l=RMiW1) z{G)g`n{bKh!ArpHF~@7F2Q+^E5}4B(IxmmGz!WN+A%}?{mB-b)F9G+C!X``K7r>;gFy)^qebg@d0h6O}!Y{sEl0ADEFhvTNNDh*>L}5Vk zWhDpImvO*dr?AQ7m=Da&3YRFKNscwZ{2_*4yd31u^(-*W3YSO@isvPT0m+w@99g)t z9k@dZn@o=MU>BPMAG#9BL3W1ofhml^#mhnU;A&uIb%LXQK?mkeg-awa<=?M?`L9lJ zCjj@T!hqzsDDz54=iuPLmNFQ)cO>Hgfr&#L|A0QUuOXWT0JoUA;C05e?S zjCf7$gX;4&z*Hz)qWq)hf1)rT`Qm&r$wB@3EECSE{~$Z?Pk{?5Y%)213(TJsE|DBm zuU-UZcMLARUXi`&Ffi$QbpFNTsC+Yl$x^sP`9kBX^MJXy6MmG>S11ffzO3pM)%&r) zO^e}YU9T1Z6HvHB`9k)q-vaYs3_ojmHvrSBaEat4J-I_+SP1+}R1bEWa9p2F^@ZYj z!wP4rr<5;mnsABwtxtjbMqv}>3-LScHjK0Jq07Ko^yekOTy4gg(ntD!0WizWI17Hi z2j(#|&cu(>w@qOveRL&~_dVbaroivGP#4>o_|TP1-phd*ZN{0>NAk`DW|0|ZA@4oF z+-Js__>n%?2+W%bmrNgg3d}d1@FRV2+U@A~@u5rPjj#8l4@LqrLE$9ccpT}28Nk#i zT%z_t`rt-jZs~*{>4RS?3`o8b>4Vk4{UwH72FcAL|>4O{-E|ESMXoWM$LG^DCaKjZgS$(+@m?;XEC|_uNuo#&7 z7=H2jLgTA@f%%QXCCV3y=K+NQ$(L2W(DM(Pa8~_3)xU>KxJ3Hkap0O1Hj%uPe{ZG8 z@9)5UW#(tnqksVXfygB<~Br?Nr!A^@VV60P}t)IBIWySD4P?{UQ!$tv9{_?wC8I z?2LRil`o}xfWn01wW_C7uX0SdMCDrmT(LP`Q#&U+|8>CJsBn^h)^gMX)0hIkhk@%n)D#$aHEb%LY*w^U(>A6-`cKG`RK4BXNfe%AH= zXTbbM;f(Sy3z#Qm=AIaDA=Q!^RAG#8iFO3ri0CQ0%ILa4~!Vo{Ytn!8G z{RH5u6*ie(n-9#*3YREfh~FAu)}_F26EH8Q!0!Ms>Gw#!Bun4%z?`aZ$3LQ@u5rd#Tu8XFbu>$ zt9n3k^aE~`!X}gB8epa?T%vp?IU0buJ%*ok`hEw@9~3T`9Dh-mWO7jbdkVOnG5oCC z`5VA|q;QGkpnU26i!QeF@u4eOzKj57jKU@2NBL3>j6a57e7>9tTo9Q16pqHVR^>+f ziCB42)zBEPx7E$xIK)q_>QJZ{EWl-o{V-ZJA%=_7m7KY?+q>bzc^ z56q=zoQWURt1@6_m~j^Ay9Jn^nQ<2U9tEb!jI-eP7BC;1ai)4eQfB-*wq9A)1JXl1 zfxAFq>4`-3U?ec(6wauBCOJqC)c~_7hM%<_3ITJ!!X?u~+Y|<@`LfbOR9`*-?i+buJD> z>2Y83dP@EI*}z<6##!(i4@|ikXG$OOTLMhTjI-ePATVpqI8!~K)W51QAmy^KKT|&M z0`8!~(sPOGLD&BSe?5HYN>mR>4-Eq5Vucfa@p_2*g)4xW)CrFI!5b6?Bwva2kUtJ* zt%vG>3n^?OIY1Lb-zXo9LFyl=8NZv<)*DaW}Jy1>5Xz= z7MO7s{O$(kw`QD)AGNm)3Pb6mE0G?05x89`@cSY~erXTj+*N$&GV;ZgK5B2d3d2DB zOO(ER;4bfkAIUosI@Q{=Y;xHmiDNA>yZ6!{(d2h>x1 z=rYQ~)W6X<=OTq+ApNuG-zc9iHsKPL+X&#sq!4eliC?04XPIz`;#~w>gE?MP{UbT< zOOf9rz&)J;zdb4P`vAC4&HOCN!~RDpGb#$c5|oF-giDk!rvsOxu*vGdNE5$A)ESST|zrv6lbS28afxu}BYsg{BXBwAG2ByZ0 zGs)W@xO!mjSGZ*P_ZTp*n)#XJC4IkNVLe2fU5*%i5X{- zHwXNF1x&NTC6o6hU_MniBcDz3Qu?|*0y`l-bQ$&3gro36g<&B6u^uwvh~H(vU1jEH zl4AgHK45;OaLMHOJuq7p&XB{zkMiYBV7fgjawOwt2PR+P41Oj#3czm^Fv}E<>`zwp zfa?8bg#pQz6^_=KUQPj*1>F09BnQ;mOk}s=xseGrWfFpiOtZ*j%NBzvtfO}YBjr5st1A*HF%-&w3p8D}3lm);=Zzvq<5LcunI7Cv%DYS8IzON7w-gDPCc;RsQwG%~dJj zXkGV-6mZlox21ri`m!6iLkeru7gIh{c^v-)-p7IuT}HlG;4TB^#|mfgGnEJFzlFf8 zR=8y4@dsdDQaB@C6Tfr7?;T)zJSpi*#;-Rp7b%><&(tnS|9OC^Q@BL>kHT9O1|(lr z{Q~iO8My9iC4GtbQM>d4Gg;vhrH^nmz|?kvqw(%t3ImcatMt|4&MM$eUnl8Hq+ba4 z3^2piC&$tAZvb;Z;S$NgjIXOkVOgdm;tgxxh82fFu2PAO&0&aNVDkJORm< zRe6y9J0}Gky+`q~6mb238=C@-;+>rWj`-b@0*>nW?^D3_2ky}naMW+Tk^+wM<=qr; zX9D++6mXO;eV*&Q+$diLrhq#QxX~%#$WBw0B5rO9I2sQvO#w%GghU5X#oA1nPr@s8bu z{dD-yWyEWegK#ea)2-QrOErC_@z7=9HyXTxieIAgrT*ehg#pQzRsT!4pQniXMT)pp zDdJXJ;Zn^PQ$A~u<9FcqvErGiKd162eje}X!iTOze~I#Ma|$?$ZHpBy zRe4SIzzKdYfM3teB8Sw2(k8PVj&OZ|nPA45@{jb(wF(20FRu6hM*3!h-@~26OLo?E zR`HtBmkHbpDd4Dl-v#c}mgMD2xC&tIHRCMu`7L06)Y^GI=KwRqjAJ<>hFh{@&IRV@ z3P<%UqF*97vJ*ZI%$68_VS7mgNBU_eFmH8&qj*08rq>pcgZ^8^OSmjxiWM$d`mO_J zzQQRzr23CY`e=Sx3(Trc_))x10rQr^B}?CDz?{4_xg3;#=K*t>!X-){;WS_-cfya- zR|Cvl3YREf2=`}TUh4!$@qP|W#tR}xvhs;O;z)Va5Hxrmp3b@|_vsvL1m9LZJ z0H*&-(e)4ghe=;ixeWrw6@!b{L)6Yk12bLWjCf7_C|??Y`GdkGtIy8@^NyLHseDI* zUk5PmmphkZEHKkzaPe|b`OX4nQ71T(BLK|(3YScdr-6A};f#DS$x#e`-vHy<*0~&` zfhmu{#mhnIn+Z%v;nMLtk-mQdm^})YOpZ^0>AhXjmkf6{Fdl_VBySngGaZ->3McK- zy8dki=FJ#fyu4ITKLqA$g-ez``wpy=;6qn3+$dmfP`E^LOa_l2FdryfGC2+c({-oB ztMpKuei;aU#{n}`;bP}U5xq<0djl{l70!^uRIknh?ml2%Qn+OLZx=A_vADSOQTzA; zn6y`t%R%Wo7MQ^bXQa%I%?Gx*SzEPWayp*Ay;U`aTBc_}!-Tnd-rXh-V-$6$+QE9{dEDrLnlUdO-Db1u&}= zE?N2>1?I12oGE>zcRvEA&mNH@S^9ni%muNyxb%^p90rWm369ER95C}0E}0y+0`suK z8TG&<2dzW20rQ!{C6nWyz&Kuyk=Ig=Q-L|B6CBBr2h0S8OD4w*U~W^mL~;xOzdr)A zL*bIiu@{(wvA8%ns9hcf=A^wMuMw}QpCLK&ftjRm$>g{Jn3ZOnsXVy<1?DA%OD4xI zVA^AGadL3~3ryM@$;*x8I2M?}3YScdB4DN~oRKdkInD;Z24McEaLMF&9GES!xHvf| zeLI0UtZ?c0ok$P;=uNyQ1RuJR$#E4hH!55*Iqn7KS%pg`M=LOUV{vhEkly$JnBH$m z`jU;;ih!A}aLMFY49seUGvqMUQ__FW0<%NmlpL1n+Y3yOw>wYYP++DgT(b226qvge zE?N5i0!*vIB}yN)%N@Xc(g{DV&-+lH@u4eO`ig*=u5d>BO!fH!@Mr*Lt->X%2OEKT zH5M0_&r}|71M?4sOP0PK?_eB;4_(P{mjg3R;S$M_2Of36Jf?8TY%xHy6B*zr+n+Z&d!igN#^TF-FydQ&$pAS;{{tnCu?@9WS z>6c4^xmMwlmB(CQey(td2*&VsUZlqjvrtFdYhK#B0)PB*z&azz%{BUCHE_ z2+Sfg&eYCn{t*J^Nrg)$M-woAjm5>uLG9x$U_R~yM{;})Oy=KAa+uOL2DpL1+^BGp zKI?j456rzWxcGWc>H8fp4|js2^sNKt4TUrE*_6Jqz#RhS@()FhWa;w&GbILRoxbV7 z%01KKZxzl+pGAFn0+>AtXVfc`92bG#m%t4CC|ZuNUth$oLVEmSV6KS8#nl7C zO#o(w!X-=JO~9;40rxmCyA>{x994+-Fffz%N6TSdU#ft)F$Nc39wbLSF!w54GC3Xs zW_t>__kqdySkjkB4lm+82bj4Em#kjh1WaQL&RULN0`suKC6i+lFn>z{_Z2WdYELdl zA>k(+lF9KEFvtI0;#K8lSst0d z3{<#e>2m^eeG0gRz^qcZL~@Y-%TvI-t8glPO;+nO2MBX8xg4ZVdjfO5!lmPPqWRWU zz}%>C$>hBqm_I9AA~~iap6$R4ITW2fYkgG+%-9&5b-lV8m{|&!EPZvr{5}QTdSKpE zxMXsC4b0?EJC~yhm>Xko)^gMXbFacBlj9*^wx@u5ADE2KBz?)`I0u;J3YV;X+yTt* zV{q1TJOWI!!X=Yq7cgI2;!sJ{m4R>jKSYLbSfrkYLu@wkS2-mP7w^ADxB)5RE=dtL zDn;C+6mip2#4WJG6^)yaT~;(PoHHcva^UV!SS}A6%5B<=8|GbnVHjq+7Y;BFn)ump zxIltzBS=BSIn^rT+XB8u)E+0Rk*fX}=Gk$FOBu}xse0-_9$TQO89ygw&o?7jzoI87} zuX6U(S(TTTyXG&vVA8D0S?<|WudA-Sez-YcQsvYeu9{lyuZ$OO>g?Hbkjl#PdA_+b zXHT~j%)rdAoaUP|*Ai1+TI!wP8b7++HU8=`MdjYHqegkgj2b?~LcW@sYTwj(H6 zeAhdj(f=>FDzAFZw5ipV&I_C_izsURv!_uU@{9=`U7RS>q7q7Fbl_NT@fb)j{;VwO zkv_%eIecnuY2<)xE4p;@#CZ^U^32&)b0(Mg=gpipxx_tglzZ~%(WR5dO!kf`8(%!S z993_ed(4E%s4$ah+z*jv&#tVVJguf?@^${1)z?Rd4w}bR?)>X#&Yi64-Q??i)ySTy zv**>!nd>`$&UHVrU1}TFJMB93UA7Z#18u(w+Klg#nbYRZnK!4(mz6W_+^n%RsL(TS zM7_u=nlr0rW_2a)(VaDOHicIXACgx%YwALj;@qjzE3cc0IDD1EhhChQmsdCsrBFF% z_>jVRHFM|GAXVz8e_rLx+1E{-eSKBswBbW+xLF0RgQ_d%S5^<2dHwJUFR08LQdL+p zb=nP;zL__o`OKL;Xx5zT5m}*trp{Y5YgVOi?xI0ctE=ZMKy4o)j3f@VycRf+ zrRgVV`W`K?G4CS^)bwU8@O;)a&6M-Guw$m%w7`v-J-qq|$Na7U?n;=Dy`X!2!gfu;dkVBbD1s2!0<@Emhx zSerY4tJYeaokj7u^PBQ_=5Li7w5ah<^k_(tL6v|SggTRMqbU)-IK4=civ3Je?5D)V z-btjC4HD^KBPxnsMWt_S)+|2uC)1ksv}P?>o$b(qzU)jbcvE(k>nhIhXFKFt=FyLM z_0Kf@Q*YsB`|>(4^#qRC7o6e^x*S@oE0c1Wlh=}diLHH%rnhRr$=P{YV2fQV+`PcP zp4`wi{Uc5VO ztx=)7u5D&aTQT_lqC3e*o?y>%L9aBz{sL;al)frXQlLTW7>z zAMvRc8k43KZds7gzEbi+{$ByO#|eO>|x5nxuuQ zvyW$4)!v|cr52ocf3bb7f4ZhmnWO3c1zN*l---4o zyAI3sr4JkA&u~3M>bbqEJO6!eu<{<4?#euy(mb60`Hs;-w9D4k4h_qMC*;lUq7}Zp zpznyKuVA%t2d+o*V5DO#ogT>i->(0m1RYCW1DGxmZ%4&ssxfYtZ z+`#EaJo+f7S6`Un4K7*h(R+CGZ5^cM`@X+m#o%wSF%WH@n5N{WH3QsP&$s=iVFZP6-X{Z?6BoRk@a2mAG=?lHNtz$yzZW^&` zq0!JBuWznS07llx73m;4UhnR#{-_&wLr0e8kDPJ8{Q_%)nH33z6u-C?tz zi;82fZ>L0|*so=!TGgmE?DdV%^dhGgD6sj?(e%+}dRjx%($hP(1k>=#sp-A7(16}7xr>FEaAr`%1v?IU_`HWcU=0^@q#v{kK3GlekeOFQU)n zM1=GFhmx6VTyNC<=*EfGbB{MPOpC6L-rW7Z${#XGpQQPv7+5v6x^k$P3e_jxapQg5iR}%!~$PdP#?t z-===9%4X$I_k0uLbCtWUbxmAeQWgKy^$YmOmw@AHhlKQU?APL5Y!y3 zN2J^8K+R?9Ay8d;#JK@f9aDcb!VZIa2g0V?a?of;^4%Liz06_LA*zg_8bN);VfUbq z|AuE0t3mbSc;7d|{sHRe_@vv;p|L6R8wkqHl-mf?LbuMqeV)2xfVi9QBa}oiLOtP7 zYwW$zSf|2r$u*PlE|2BcLXnU`5+WmSo>_P?GBidYfde%j{g9W3-T7Pfqruy<*MW~m z@9v$ZrH|Gp4}t#QOZtB|>HppBsAPLe^uKv&06$vy4$&|q^7YX4H0tj?`tjN{SNe#+ zO?eIsJ)o#_Y!@`OUwDOHoL5S-x&EHQ7V1@HiWdXNU}^>M?LFwJv`5qGoBX|=gMc>u z+x?SJJj_`4=4IBsL!FOn1NS~h(fd3F5E5yxe@s%YA?0KA;vw2d`&#diGLP<*4(BY7 zu1SZ(+8)1RJDi^Fy*;`Ooy`u9zNMoy6WV@DmAi18e}YO!@Nv!@dq0ZK_fuq2qNpm3 zsIH-o#UiQ+TE~m~N204$T(01})YH6ri${O8qg2CmhNJb}seh{?R?z&NR|F>v$!Q;H zo!VZ3ZRx>hIHm0`Q7mH-3$ya-k7uu;9F@CX{rc>z{GH(h1a2Cl+3fDmj{S1PvA!XW zz~4?85ybb1{=Ol7{2Dh%l*ut3U0O8?J3X7^N6OEPss#?*Xz_+7XQN_WQ{d6(IX(J& zMw@ST9&SmeK`G5uZ0#rGXBYKD)mn_BcB>(ZSIyqMdK1Pq8V0UTPKFxEMgrP?24>y3 ztrnrx9?$J!EU2y=b|0P{P>cC4dDh**ts5;h z3(*)YwSjq?Ljw{ToRIC9C^NT@HT~{2c#!6G$gXu%r=jb-LyLQBF1x$w*y7%fz`hd$ zThfD|8j5@O@%1#U7>yb=N4{vvJ*BzLjUOsOG|8ixv_s7iKjqv}nYR!lDm6>gcT?Lt zhlXOu(_|mRY{SUnquDOhwK0ig9&M1_wu;5h2Gxx-<#JFmshtF>CxQU#0P4K8+!4GqiI zf{Qb~`k@k%dy6MDtcMo(rpNrNyhux#SIlE9gwHGCokhunJ! z1(&}S(VmYv+DI<<7sI%A47g>2WPXD1`CI7;jf;X!U8Es3Dhkxv$=PLM^eUecQyjlA zilfOW1WJ<>!e>UQ;@8GG_4tb|HHCe}EYZ0czY--F zF)aN{&x!Hat7BODx;J-YI2vdkXtisaPcR}#8K?{)JI5ox{Va0 zgTuHe&1T#QZ0iXe$aCrYOK7n56>PY$)~qih4)`GNk7%&9V5rq(ufGie_DN0l-nLd} z2C53adeK+7e+>5U2B$mlff}8jRg(LquQ;L`y@iMD%U=ZAqrWVygQH+o9F^(m+Jdhv zO)qzp&=3RG1<_nrgwpc~5S)_(egp9-z{iP?hEHjGSC9TrEksPZ!#a(x05YFx;dXHT{|l8W|15*sP;NZ#`t+Sd;(I*jpV?_$4_oSvLsC!4VR+L1&>lr)jeN} zFH!zh#bf|AKNHQUT+V|(3!Mm!pAXRpt$MTkfL6h-LO z-}UPIwYrV_5X3nHUEJ^@*tzPS9f&VzG?;QXgVHeX;}X-CX5@Eh!OKW5uFnZSN5d4- z<2NH9fd=os-T^)w3x=jtn~L*y8e?+lmatIe3EjROObo@3{tN|AJ(@ST2nyK)O+DY? zT(LA0pRD#%z516Py@SG9MrPVtMrPUCQFS>iG#{0=!wd;85VQ+X^!eG{I_&t#=BOPg;V0yL-GxdzLLmf_3V46Ot?i5*r zbkRZ~{%KU!1>B}Qp^_{O6(YQFOht~`aDpH(p1*sOS5I@HiUL{6nd1qC_8~^0_2)JH zw(MH`j;<;D=y%=oRJ6t<6ZK`iF-~t=kIEt}+SXGeXKrn-)&?q7%vYAJ$H+#7Qjafo zrQx8i;cDgwB^?iqyoYhebDt4Lqt`aZJp*b4-+c+xolN-9|{@WbQx=lMoqtnGMhA7g{G5kpoJ~}Z~=+3(uQ)l{}frt?Pv;;wy|mVYKj0m zg;X5SpL#PbIVg#)O zV;J&QJ391NDYX@X3>@k34W~hM1!;-WNC$i@#wO^(U+mba1<&AU4H4Oif_yq)mRI(M z#*+a_W4-euQ1x8U=Ygu?nNXo|cZ3l}eh-uR?l^K+bz9@HwP z-T+n0)Im@ZFAeMES(*%8#CKtPqmjE|k(2ufEsYMnnYHeJ3O8xtUTGAro2l5sm9RvG zD|cfHSHfZo_hBxG*us@~|5La>XvCOyY50`kGXqAFh2G!>8WgWsPI20M zFW)C$hvbVEIf0-Q;%hg)T9?y6pR6IzV&rBEKC%V>i-Q~bAk?Fe;aL+*F0vj&v$W7% z*|mUlV02&4OE_9+6^A^FCv5GfMGdl@G;qcs8`f$K%Psi1mLAm#|KS_2Dc%k^`e0lQ z&OGy5ijG32ghMbN^kagEDaC6T{%gUJ#;ucOswmI2r)$A6$dAPZ&cmC#`1%Jv_=YBH z3u)wjvLt{+RfH9|8GIzt{oHAOxet1+!EHr^Qp#>Pm*lz*6QlS8!N zPsK19u4o0}%BBSut>-r*jl7+@g=3?Z=AdAQDScshE zC&P&-!fJ?DWa~O@Zo@44VP*9++CnH@?FDds=H?d_Q8A0*C$Xp<6GE< zDquXJQv3)Xv?*Gw><{W2W`L$v!NE~Yt&6GMkh^ZCjK86I$pQ|SH6@Iy3t`_*#zThOZD#I7rWp{K3kM_&R#LQ06t%egc-22E0 z`lyDrL{6|5esJgj*b91|1GX4iHxyB*6&Y)!uua38fW}g46(|6)#0LFqP_p1g786-! zqjrP>i}mXcF9>8|5diK6A3@gWmDAU;Jb-k2gHzE_P0hsOsD1gfoOxgMSkPY!Uda-Y zUx|iBh%x<9eY2*&fMqXu&1GNJ4xckDtB^x<>-=N1){V3#+kT#MVKxMhI7){`!8*8c z0o+l0Eg?0dq=tEJyM_t~X6!w^8D=i5q{3Q%6jKNl+mA_)IN65p6C1up=6hKxBS#-) zz89Z?wkN<|GKQ8kM`%LB6X-slb9zXkH)YdgM-M%=^h=nD0{TW)1+YPfS?`hSJK^*U==d+c$PbGqzk#?EO#Q@NH2?q<|=uI@dgDz@CPU)v{D0><$ntH zEvY|^#lib4kk{Ofm)8=7?n=Ja;0rlYBVP;g1y@q&;%2 zSeVhxe%tHxRA>+h>J2`WO+$&+dblIWPMD69=mx|l%b_>;f8d4+MgSDxy8$2NdU0E} z6F)dNjT{7*=nSpTCR1K9cu@XxCe>$CmRH&5Ad&RF?6&Mu1hhyv1h3DoFav5RfVj{d zEp%IUW;o(T!$~G8HC{11c(4fQDJ;+QVOa%0hjTp)#2K)Sr*mV(Urhv|v-(<-=I@c&q zB83syK#j>}uP?)csJBh1SgM#-(xL8Q`p_{3y}B%e5+X|&s(d5ZMpbh3V7TOcDmp^w-N1|L59tg0lig^%xuQP%b9|wczrYu2Q*m|{5!lw`4K1ex8U-1N z7QK^FG{n}1LC#&`VM)%P;T)t}o#r5oBACbbEeIxHE`3*V!3HWw`(2wLk82%eemF0` zKN(&Mm*P_(Y{leb5M5mA2RS~;4v6q=lR}Sj9mM6UdY( z3H|=^f)0k{R3pFHp*9?aNy_hACUUC?tu)%r_a_joeXu}LID;k)u#!3?EWA|4VdSttu0VL?yr@Uu(;D{(Hn*rp8rSti z&0M~G9W`g3cqvbbe}M%(hfZ2NEOMfvK0O>Y(m$_P;M+8RRK(#)HuQbO5Fm4G9=C}# zptnr<)fAj&`)UeaOIkSW#*I}r{ESR9u4yJ$Fbra2T({f8H4U1#2~u<6S%oF`?&d-@ zvBgLV<{VRCn`K~I#3~R(0=!Vd>9&_a6*Kids8@I{Q->zLh{I@pGn8!xYe0?Quq~jj zWoiz@78j!+sF(QJ-+}s?r#9O_9m6p@9udq9cb`8%NG*^BX1`{C}6J zU*rGhOg)VM`9(^$y~WgppuS{kAt*@|4XcFT zDp11ZL4%?NSP9z?>I;7M2q@t)3=6Ts#S7~1eD`Wl?=v+G)K7p-x7`5h0}fjR>K&%) zK>dxWpMg5U)PI4Jw5$as@wOP$Uk&ODPzU&lbo2+377di7r3_R%-z^74bt~OA9n>cr zb|WZ>Lnj>P-!Bd70fTA*^&UU*DkzDgZ$>zd{-9>DY=c34%(y~O)f_eg)D28s3F zOT!WxP^H_-LCt1rHmLo4_m>#Jh~;Y|D1h*{l?FAOzSlsNa@d=o-r%s0L5W*&SJG8{ zH`Aa78Po`a!jyg=ko)oB7ipJp8W2iTEhBVFICNcf=;UxHP1g+Uf^eu79qNt_g^hvQ zB|kzIxiO}j)N30zjaY~up0uG=8aIuEshc#1F>aO%+t95vEap&Tt?iO<=tt4%b8=o` z)yX=vG#b13U*|xcHZuGyvPz9kB*&@E=6&r^_%Iqa2vT zMrLs$$aAF>5ZFR)$wHoD{DF{);4L}$0efBWIhwiHd*8xSs^Bd&X4hJ8(I^n9S;67B zT}t7>TPo!C41A$A!BogMR7_;pBr^q>Z31NAB=1tu+5vut^Ein(Z*z~$%4I8 zZOOHt`#75u!c#@^4Xe*y12`ET;MWfGXkPv&9+*jBHE^ofkC1gC&+fQb8#=?`JIS>U z^(r#P+`=eK6VukhfXpY3e=MBdz-9v%&%IP8FsLecz9^~{v7>=|4R%FehdP`UiGf=#OY!Jo>XtAUnb@7*Of8Wg&6 z_@+iJoX<8m4+Qmh&bA+d^QX)?oFlC+k`1bayfLAaiNp%cMs_FvoT1dy%R@gzavWUl z;kc6~=R}55a^#`ZlanmBg$sGgLy?i8T~&$jGl7-dddJSc@CEWxQc9d>%cBY#yimmA+DlL>&7_%oRr3XlW91@`J`C8EB3HQIY zorK$>e%zpBC)PwzBzd}RHmDg~HpEht33X$VVVgjSGC2fFsgTgEPS9o*@*PX|Us4wL z7^TR1DNogT-sXv#hr$!xq{3N+cxmOnI6Es&gY*cu7~ad!8Z2j(MJqCS<;^tFk0=$H ze^EUW#pMDeX&DVlcFLySl)_4)a}}1u@-k=Cs68U5p&>;*l4wws)LTN-I4M;mdDpPt zvxr1`R|L5PR8%Bc)PfEE|F#A`JCgkGnX`0%?9Ra}%SJCnjTZ+kbn#Aerh9a+LnEgF zv>@J7Ox6vo@&<0|i!H_J*iAeD?W%7nK~96&!gsPXyeJfwFWS32nzjNfDbxtbY{J99 zamcrB+Kag@J)|MjuHT3d@WfqwQIELCcS2x2ITP66 zEgsmYM)RT34$9MOm@`Et{sZTMn#y{K(smY8QBBOl{w{q`up$YTpbRmHTXQ60?uTWQ zk10?bu)|#Yk|7QmHaeUMqr>x!(K(S6GS!S+wsq$;oo-N+VhIa#L|ZzBDpxnj)mB(u zkQJOf3=6&sn0Ln-S;}l1!7!(prY>{1>}fdkBqvSNU5B)3r4c`e;+}`XVa1^lhl+#6 zJr6V=3%so5hm&1L-VCG(qMxnrDWP%`cZx$dQ%G^JzNe4yfsM7Q@&p(e?O;*gR~|O* zkfX(2edReSEm)0|^S}sDXK;<05SOs4D?xE3rn0^eXv`ifn!@j6Ly5)=qr7T zSMS18M_0#oRfAtNmm#TmaZ~VulDf;4kcQ1goP);C(b4r!V!vP{hkdoes=hl9~M<|K0cBjIOqeIb8bskStu z73zFY<3y9_9?s#D*P)C%U>0_<37a&k)=`ns9Ii8{>YX;p9}0_B#s!5kQhOjQLc&Fq z#_B+XQwfSLPl#dB{4KMPN@*q=dNYlTJJX;d+F%I6RAyptd+j3hJs#@0(4$|Cyxr@& zn2+e&KpC9!M#q~ls$uItHGU&wRRcU$s(h5b;rtwH3pxba>i4QI5(;uL{^Y^6KvcH(zRTN21GrPe2Xks zJj0$MHk5K7o&{${9HF|BoHzulGwlto zr65*p91e!7$q1jAiN5*}1Yvg|X;Z1M%C4lkOalwrW&TrM2*vJ4nnOg*>qBd(oRp!^ z8(Ni358Le4&mS8ed^enDOlyiSx4rT$3fsD6Lc3SSx@wUn!p|Z zcu=y2Hw%>5o@+sg?fJK$#P<9EsK0Zc{TEO&V|@XXtn0lCN>=^;2}*3#WV8L0pEwRw zF2_dRJ+*$2oeGwwgOeo{HiY2~061-wTX#(vX4ci)5eW9FDVH#^713f_Rp55>5=@ zeh+>Y=GR4^n!0Dwi05M0KMQ48g+!v2vnyHqQbk5@Bx9jkaIuW3Xk?%P;BgQZ!O|uoN3*! z$Weub99nL|e_CvUWr2x~HR=sw5dZ_YVjA1!ao-c=UK2eq6ZaZqI_8WxCl=4+fmkCG zCAENpFl2;%msW4t*v02$8LrK1kVa%A&Qkpnn|}_`FPN`OQCE}=EF-F+W;D_W1?TDo zZpu{0>Xp&4dN?tvI1`4jChWE;Z1!QyDXWXoXgO7{j8D}o<5Try)JE)}4>ECn?oY8L z3i~;50szj8fl!UIsWngPl~<>p4uiVtY+!k;g+q1yMFbKzN5*+O-TWF27CvJ_+20WF zlES6f+3L|pVrT2HblO)t9Y+ut8(+Oq8(-zNR)Rx0x_R_(;MxzneFcqhoSY1tYT040 zzW^G9ywII==*AJm5FP*+#~o-vmV_Qua)!m{mWm_pQ9sleTHgYD1d5<5orvh|`XUUv zP7E1ba5u*wmkwTaV)(}E5IFX}6!k$lhvRk*-1}W+RbZ6icps>5#r%$G&##guafzyQg3Si=+R9 zzJ2^7IRiu|h*u${S?T@0QPl~0A1$ix`8D7j?aU?ReRxyU@q8y8-jwWgJ{eU;mQ`w` z43w88@>T-ceu|j7asU4;s5I`KHiMGQpF2RwcF_-vy9bQ0&q2wKVj2Sp)eYqm}4h?D8YOjBYexcF8dXEFx z=)`N#(2_Z<`iu1!;Sow5fO0>f=e*OJyx7Td2JH^PMAGyuUKcRX*^cu-w`;jONI#U4 zp3dEf0|pli;zzuwvxu&P&Kw7Y(*ixT#pW3M+VBROqToPR`$<*gG2qo-;GJfXiROf; zw1Or-UrkfzaG}wWUomx<`9^PvG^4LD&givtdN@lO6`*C|c?&6sM#`PQ^A(A_8ro>+ zCKD7I6TiR}_+n79mgoUBk}F#f)K^R$i~N6xtL3?%ZefZ%Y-AAc2PH#ynnp+u8?_lM zPd0-c7pTnp7Ke+gxp#nefzfbQ9cwE+a@~P_U=dwq>Ukc99ud=hc%aaNES*$4 zu}8a)Q2Oegr(~iNNAHVzhp6Cu3kkILm2GVf2qoD|rrm2evwjOovdG-74bL$rAVymy zuSpnf3=c0h$+$u#tjc~1d$#kB`X=9v)K+klHw)x25gwVMpK-09i6G?*&Cj7Y zL{sBHeC*Rht?%724wASbk@OTa8VyZUU8s8V2ZgD#5;1L89E<^1BUP^(IsIoC)OnzW zao9*uGMg;}mCpuOnyn1tyUReG&y)^o8B=$H5`Hv*8_r=5fRdbh3{=D;4THM>R3UM? z{NGZAF8-dY5URhiQ(MRDWyqoLs8)D&rtcJJY8X&)KpLBlupdgJ{ZQydV~w!JTnxaN zMYnY577j5M+lqVsljc{dF(=xOthOxVe}spnj@j%X zv@wL@X&!;6|I9t-)u1HJ z*MX8W`$0+HXt5@BcvG6MCm$@y@fnV9$KWAZ*QPbRP9DzzB>r((0gpT$F=dG(RJb#c zjm?dRn@Q3Nu!;=7*eyZ{NvqmYZOG?QstwKgByBOwLyHb!3Pn>?mCc@DaYi`E9nucD zgWik-MiIm$peA7gC|aq(G(M4}Tn0*#awRBpQnb)|TAL5fQQ0*`fNo~1W5`#0%DaU6JC!>Rnt6OA+k+tE8 zphQA?#4Ib9DOUm!av`$~kE2;9DIp!WBRb(M3qG+c&eEWht~sj~UBU5%#|hCbx;O5~ za&$H*F-cOz5$ZxvvVwXAD3K~*JE5erj4|y*9=EFK;esO1A@U%LEC7$qQhdgm*3f%M z_T?ca>pF5A?#R+G#VA71&{-&YPAGD}l9ZX07F(0e#gzfS8|(N;=5efet%}PmVT?t5 zWt2sHtQasvx*FDJR+WRK6JzD> zhpt^eH2?3Ky^+?(YA)PFf-xPv7SlAo%Sa>4H>};ipSlrA{QoTf?_9W8Ra#$)%>4)- zI&DD4D*6@}OuCVJRp(6FX*3V7j^6M!KaRrfy)_2{vzT;dA(ZqTLi6-)PEbLY)4sMF z%qv)JaTT|?Mq&_6T9WKbIXrWqwWDXbtD?bT4n|YyHk$UY;IT3F{zBz~>V;3bjaFZU zavBu5T}v2^c!Z*}+=ZGA>e+O9b^)kwVK}8%$$sx5)1eGbM1VsXoFq2YR*0>&xUT3# z>|8_a<%ZZok=Qh@7qNwM8et^1giSK2X$CbH)YB~XVo-+In24Ojt&}z)3Um(osDOxiI4wl-*&YWn_Sz3vDNuOe$k zS_qy_WaY(73h%_Vd+ei*@NEzH3f-Z=J4B!DIkxU7+H3g2c`FrvH$h$BAp8$hr^xhOykElu!|C+Z2eE5is zX127(7-i;cq!_|RWLOom@EdCbG5h%&xkjS%4&0~4FZet_rdx^f0qvoxn^is**fhGjo9h!rJa3-U^ zoqyAved-QxDh<#9Ke&Aefn+p(xo_=5e{O~Qk0q{G4zQumX^?|!8> zzt$Z%M0F`@BNI-eLI@pgrN0YX6!~5`paeM!U=D7WfV*`YCL;(lUz|ighMo^>ScuwU z^B-Tkfesq5`MNnTINaXV`6OyhLCQd{8BAN zay<6>0pxXvyv*SW-WR_(8T;)Velnl4mAlDP*y^>9ID%LA7%v;M;O4_oaKcIX>bvyT z_G9v!+Pkf@-9^#d#yJ{Y-??ekJx^KBE1!6`QZpS%Aeqs+oN^bZrA40z-v+I(4E+V5 zuHoXO9!fke?*KIo9MWxc%xMANrJc+|4Fx6DZj=#rtwG%cN}9@VKwZbrl82yBSVG7G zOKMNNy}piPF)s}kg+ptiv1+-278Ym`5akB*CCLfJLMsc11a6yM?YG?mDm)qrx@%e+ zRscg4N%?Iy+(yr|HjtvA3*^1{`VH!j^56`u!EY`^gHOYXXs!(u8y>@dy4atyVGSW# z8y;1GAjv6|+Di-HQ?Mq1ZI8fqgQSiMFaHiU@a<5^LXN(Xk04b3e%rNBbiyXqs2)@y z!)6|LjaP3VmUxkRkNI$*xm#F<=u3oZZAcb79;bxUd)WE$HTXeMM?Icc#^^N0zvs;X zDaEOemQ`fxPF68-A-n;UxDe6+;ym9$%>vgqIo ztoX94W0&3%rS7Pv8tP6~FXJ3M+M-U!`7u=!w05aFVwL_Q!eprbA}D#K(n;VeuT-i5 zB`S;BxO%yg$%jEHA3aumIl00a3&!DBE@{%r(3wu*)s3(fCV}R<6|suuss&|e9Ct;l zn~o6-t1b6U&?vR|O&7=&_zFbnEK+9@aaa>HER5#YK-}>d{?jEotC0|`qMi^4k{XEU zEV`#)j|!}bLT~}L1*D;~_;#pd21idit5hvCkuyXnDq#~V66mZ7C>>&H=qzCwqAwAu zl{I6c*zq_e+|XH#_(4%eJ-!CCdfX&qbQ)9BS%qLEI;#?t=&Wi`16XI>2ugI;`=CT; zeG5u-)-gzj=&a*GiOxD1l<2HWL5a><1WI%k9j>4ZnHagi^^RY8dlQcJ&_dPOf55nF z4Y<=FGqec9oFyN&xDVo|SWIb{C7s742`|F^4 zZ=?>st%YdTi)pxjFxMFOC6Sw7wzxYmCYy+$k}p-&qX`PoO9tC>+`H_(-J|ei4|&oK zC_W{Z2sF3^2Zp*w0n<-*wd3XRp^{yEGkoeWCVMJH*p^A4^_8JHP=lM)H&u77T z9!~V{;nh3T5E;@K8C$irj`EsDR)YbP;nYt+$$o4F){J>2bImZ;hYw#Ma&VQ3!_7uBvilk(df`~B@~_{8RNw>3rm{84DhDqrL$QLI4}v*5JC=G z)J?!6L=B+Pr(!#}WNTYK5Zjp@9ZsUARxzVJylaWE%FRkIamu4{uahN%PA;=L6Vwh# zV^}M8fg3MY%E?i76MJCG8EHnf#(fEw^VTEbL#ggKv_&)&1X#h$b`=QE4P1s7*OP zW&?B}?I`9=YA$|{Bce;|uzran8#&13`B1=>(Xo#BY4+lc&GkF64DP@$mYKcKCCY?1 zobm=9q$3Y*gxKYXs#2X@V1M#s8YuC;ODCr-<=u1S2}}bmXFcpIVC6gEsZ2_r{xXeJ zujQ06)l7rw@DL=N59F2hBwQCgsKk1EM^*BDm8Ls*bmF}|0nr{ zyg{1`?>nq;G*fPwLa1& zUTau}OF&82HNv2beH}p9Rxm6k=r$Gf-;k6R9KZ+fZ*M3_UO7lb4YZ~kV+xpkPJppb zqfQ+L0B45i3Ri0y=%@^SjAg#;k0H2Zu6mw)E$CMFiRu z9Y6~^T?ML!6aJ~8@fgpAcQT-hk*+@3;Hxp}{fO3&w+%oFWq5WCsIxiCX>vG)DJnt< z+YU;GPM?7~kMDj3Y9LcI0Fyx!8G(g53zXE;A)w?5vXsdaX1kXfVi{%0`|i~)=IZSA z7|}N&HhM_}nGSI1G)}izG98W9UOyj9wV^}p4YNS3uKd`BSxf+Y$B)awN0GAk?pm{rdqYc$l2Pa0VReAvaHIm|7K9K zRfO8&tz4V-f)bCT4?*3`VI80XOkIRbl?{|dpu|~cqCrhJD4H$GUD_5R)UOTdkD$6R zzrTW-h$W(Q+a6HIaahEFQGs|hJ+u#BEClr`@~_S$gRwLCrKM?M4Xmw>|$gMx3NJWqThZKX=5w!Y$|O`CZss% zdCA)??hmO287+yL7VLLR>_nUbqF;-903imqxG#}5whggJ8&iBN+E`p03D1E`2FKLo z!KmB)VnX^M#2ym@ZSkF2mNC8NjX2asC~u>;p#S@AL}S~^7vL-Hfi{gxJttG1Py-B# zbgzWbgjlF42K5tAQg`nHCGFuCpv>)o#`tItkK*h9rS=eh@f@s2ThZ4fYzJ2$OSm1l zK&;O*a)JAr1>Dz=AtRM`(8~Eo?Ol(O zjpD=Y09|5icT;SCvK2-kxaTMXLtNXC$A7?<5Z}ibY38;;+nlzLG?CXk^KK_`PT@>y zbK<`A9CJWP&p|dt={aabCOyY%pv1Y8l->>=_0sTC+6VQ|QtxTeK`45ayHIX}qC++$ zY^FicAVb>6FF{HBSPjbDKB!8deQd{rjHm(g#fJTOvxhxDuABd+&9jl4rfc^sZ~x4&0Fe_f$>v3n3xvu56{w`p#7 zE%0^5ygnWr=$Q+@iDvuFHF!$vy0?9=v9QxmEn@re0k1*w?oU_4O`4mEi`O1 zqjSH~x*o-9HTEPbP7^b{T|Yz!-p9D$Y%FDSuvc#$9qKi}o7cw6(T9aj? zHc+x`^qxT-0rjiyG?H?l807AG22}t`?k)u-qo+qe0gk^XK>4`6Qq35YxVDhF3K#X# z|EVqin`_JUrrL5rQ}dw?G834`w-eNP461K$LY0eNmv#?!+n?O$RflnU^^c&1#azHs zGa6PeiE8#bU-+4S8W{csglZrnJurkIWz zDA~Zzy@nJ&!p*dyY3Xrz6M5G|i}U9>=ZntvNPY4kvnF^5$vWA3#ZP&kNSw^u(L zo!+%bFENWvFL6tdUMOcyZ;z<-VuHHYcd2E1H@MbG#HRF8jzrSCw<_4L1aDtOarvrS z-1nbf6`b;j7M!v+CaLN@R-uXa8_Bh=bw5(&g3|yV8u+h1bZR>m(A;JAwHaVBmgova zpNj5gaCk*OYC2tj1ve)a+%z>+a7}Sdo}w0qqO~&FaKvfvQc!iQJ4b?&`Eng788NK{ zCHunHfa=D$4WPt#iRRyBJP#&4Ue9;?BHIP`V^9*d1k^Q*qeWv0+iKu?qP9ucB!jxm zpq>ULjs@?4>dA3@Xi%RR6lTe#NQ5zZILK|CT6WBfYSE%U#c2IeKx0~TM~S}Q8!UOm z8+6~V1t+d8wy#|>N7MZaG=0f3YHugnpX@#?*OxwQkUzuq3=(f^$NK2|-eBcwm+s0u zn>-7L+cMCO`+Hz=>!KBIThMnz?XYw5{3ndCKUsWE+Q700-uBvy-=RlvN{Ca#n>bK~ z?jeI99~wg|tSh;cxDM~7xA4g=sD&+Lh=RRO+^aeqynaW6`3?L;BQ1G2$b`SHoe7Pi|Sn$7aiku>YvFVE@~Q?Mr&e zga2*H8aN(Ob%5>j_D!6*lJYEMf4ZW%0*4(orX8O))pX1V^vBUuEKD^tIvXM%l(M5 z{Vnb3Dg0)BH&5<2?Okv>k2CXZa^%37Kxi~aoc8*+@N2jY|M1NH)D4{LUTLp?hvY)- znT+?d++*(tdarMUrWZN2K!MG74o?3n)A6d@rKfjnp)-|7qmX)Qp%HZW5E6bV4vA@P zKMq+B0(pU~&#WqJ@u#=ASK_p-gK7Rp;32Rwzr!2y8-?%RKv8Q$m#ntm@*<~a$~|uT z+U}94hZfLVxK+%VmN9o}$Jt;M>voA1rPx$e9FE!(XzAh!97yxuzrPYO#Kw+lvD!BO zdJ?#*F&uG`A@lbX^M8@xEGTmKTFKpF%IhB_fA`-^RVOBsql#H1uA)Tzu<~-8y|K_h z4FFADT7X`%+8er1i%O6;cfW5MCFcjq|4-8Vod1aO5v|pkgUsRjPBr~%iuVU81~6WW z!@w|k`I5cdhsX(-P)UZ9yY=Ckze4gvBiLnY40b=bVL^NwZFS-(nzUU#0^$qCjun$Knt|aXL0ujL>*u@K95`55Ig;^Nx zBXo8fK8|J*P~1qq)1%@=@|_+PCz9{DXeN2Db0Sz?SqNsQ$$`5DZ3==PRyh zejw^RuRaeXJI+fiOp)Wf@}vPoj`Na$wzf*-^;{n4)qs){v1s8&PQd{+V_TH4Sc>g>04)C~>w|&#;A+#s*3Vy}GNbCafUxY%#f&?8C7#vlA zwD7H53gx47qu+jjNU%ppP7EAdptX)Dpu7;51r;1|NBLo6qDG6X#bMD@Jbb#B(`A41 zBXvYd=;|!G&F}R>0%h_@j+4JYg6kG5$H{x}1IyB#gc~>56lYh| zZrDhY`p46IEO^0OY26+$P;aJyJWMdfFERXdBQ}#@SOs5;@S1m{;k%8DtU*RP$xs~e zmxyshEHXPHk_UyXbWZ`*pDXNAP}xjTw{jL!e*z^d-A@`}FM*P^?A@TQW8B9Eh4+li zzz;*QDi=VL3RNrI`mGffSen_e%M2MWGr2k7Ek{ot;>9@S#TxI;;Ge2I8GO^&i=iMu z+3a_^^zK1&An1zRZHf3N(q<_rcsKeMi zsf8AcI}1IHou=%i63oCaY=oe%QvQ#|j~|qjYFOkss4SQf81StY96f{7o>aJUXxV1k zjz}XWI)g1snY`O>hv+i!IRHwAHmr>e_cG{>qjXxmCySPCXVR=p$EJ>sEn3$tpd3W? zCkhGah3~831G3jQIPBUa^+VH&kRS=6 z!s)67|3CJ=1ip&$Zg+BW2q7#dL6!so4-#w;mjDq1s3ef!i6$Bm6_-jv5)1_)h6K=7 z0U<&>MyX5pT54^pUu|n`6|^n^EQ_@*F0D&jOLr-4rL7`WEBAT+|9Rh;b229hwD-H; zy}vs@IP+xY{jcx7&Mas%E1N~dl{-?L)5~!v)uIk4Q8vyKhJ5a9J%w6evvYUCy@`um zv$DwxpAyo~Q>HtrLduDY=?JY#EFq!fD&qj7#8I4UjI{yQ4erUt^aIW{?$#A0R*P$` z7H;M1ekhHZmb(-J%J-X+%Xd)rwD@eKoS~Rv)me%PK+;p!wfnxcW$eCaQU5U@T^+U_ zNDKYVKw8wZ;io7?QP1U&{;A!*Ah=aZW|n>ZC6;8(}zKww_pCVa(d^=@#lAhGh*nkaKvlfk;n>^E@>4V zBhkFnmekJhWM@BjGQ_^m$t+x}(E|mK*z}!|n`Ph$4P(q(*5@}~*pZJTo1c%Z+Y>>H za^(pXSYd`K(ii@O*}}@{hgS}&=m-yImYTjh7Mb}f))neG9hL3ZK>nLCd_1p;-^tyL zS3Xhho*o=|2;z)rbzA3H~0C#_H=fF6l~rI|8w#v6^q=l81il+v|Wd zR#yUfv5ML$xq*bL^g3h$JEy zC~rR>wSljh@*m#yQ`U}Qv+c3=^Sp1iT_MfXbJ!?2`VVzY!W;_?GIzF^O^?By4BuLV zj*Yru!ajZhy&8W<#y^=~f_qtH{QCSt0RN=g`ur%KV49o_^w{J>Xn7XKIzHQot|IxD zn5vC~1UI4rwu1y8#~%kvkK9p%kQMGMGNyo9a=br6k+uwk@*bo`+Ac20lsokC(r$;O5Y$yg&^5B#yalK--tv~;eK;C7QapY zF2xiQc2j|AVX1svqEz}9V^eJ;$wIq8rmv2ms^<6CL3!N4GJe>oblrz(*xo589c(hr z-Ty~)Pi60DS$?DW^6{$2qfkX76N4>{7!Ys47u&O?PmS}Tc9vwLgF83BvD7`J9HRp8 z&)xZJKqd`weomeT+~DgFyG=5e(f6u&$>E9#*vz&cHUB?Ph-~;dE9ZG5wJ02o zuNf~tK>!;s>`XtAhGx4za!hEGxIndjJlu~B-{Ht@CjeD;FuS8jeklK8+;^>)^?}Hb zX5;tz{O9pU44+fj%R2&aSY}el9#?@gLGVCb;vP-k{$xHQ*KZsL84ilc6f&eF2YD7x$9b(5*X+ocRbG zujzVWnLFiz=wyBrvtmz`_|B450oR@BOkN}urqQ3$cfvR!VkFM_ zA(37tl9Y+#|45?PKMp}m!A&BITuS5Gc8EN7n8n3rzGA<v8S+wUT6hse)&Ud?nwjYjN5prei03;weaTek6jIakQb_5YcO-G3qqOdT#)2gW+w zJBn_s?D&9vzGCm#lgju$j-XfDrRBRyGLa#0`pE#^+;P&1_Hcd$>Mg8B!$}DINjUoC zaAdtVgQj_0Ci-T5ZecTlrEDJhYYJrlIfJXh+> z(Kv+)N*u{{ADR(4d5FoD4peBSoZ7$meJt^CSD$Hle_-O|LxBaQw3m}hOPK>Q+)(Pd z$uiO=>*QEN-2-oH4aMC=Nr|(^s_Dw$#A%9~ZYrbyu5t$XI~PjI{P{F*{#>gh-yC}I zr2J_pek4A-R*GQEDQ(-%U{h%yA9(Zf!8~7wI)-OrP0X5d9}C=5kz3y4Ap>%QWc|NnRtu7R73yOY{A#~g*H_;_{`h4Seu6N|R3%Y?!%hgp-s zg^}#FU=LL>7e;!Y@GOrM%tD*~w|1F^@3gn)cO_2*`lhtHjCiu`kMZ=xl^fnDXqWKb ztI}N?*!)4^?mJd4h}|Y}@}{6ym<ARRDZPLAlnD6+%5 z!sTKh9i^!UQW>`by(w?+1X3=a1=3S~z6+#h`#cZyzJ&WHke(XEgXso~j0ljfT%8D{ z%U<|FQT?Q86VL}j%QK;d3Pl@`o+)%UkV^Y3(Ai?qw}H+ViYI~eNc25GdXmtKK&sVi zK&rt$Al2YaAl2X?kZM4y&lAo(xJGG*0V(Y$Af+7#q_iAPQQ9+rG~TL!PLw#h97z4g zT|a-rf5a+&)qf9J#OYPFjbYS(qoIfTZybMQP|QeV9Rq`q>H9uLS+d&Htq7M%s8X`>BD)5g6(D&sjI)%jf@)%imp)p;Q1 z161d$fmG*(K*x*D%Yjtqn}L+y1|ZdWE0FFIdjm)hIvbE_(rz)34uE|cNDn&uB~S&d z3OoCORPI3_)#ZI4jnxoF7W7#^APqMRNMm(0kjCl+AdS^CfKXT?{U!pTp_Ss0y~3p9LAmz|Em|~( zz6xYl@U>9^oMwk#6v?Jd)b>1C%vbvlK}4eJhZbU+aL}at=t#g2OCZ zmI|ClQyGOoS}GI+skHe(I&r|$ZS{1%T|ins;IpW?-tsx5z{{hPI}!63>51fET|5_i zzK2_`IKo|%=r-r=#D+{xkAse1L@g0^CIj6nIY3r|$O0H1AN6lA)=e>F92dqF@oiP{ zy_NCTD?2LCE$*y{qm%JNDH%{vI~%0D&}oIpme*q)7iDABq7I5KY}*mJr&Gt@(O7kE z@xqpv!H&r|4Ye$v>$_fsfI@yUHfq-mb9GRGxFhn|-24KJlt;>6iafTR{pUi{76$*4 zD|evkaNC1ih}9;NDuJ~0mE%~st`f6Cnju}erpt}VYwUc((Oa)qOy7$o<``~W18S@w z!da)E$S=V$EB0>az@PF-6qD^2-bz?bPe=#UGpGNKZ)g^ z197KY*!e5a|3N3U{@>=LOY{rfTsVi_WBZY+Hp7FQ0o#PTKc|!*sfhorD!va(Ffr>T z)m8Z`=o?~V*&j={Mi3g?%ib#6SoKPLHg=2^%2;db>a&Sj2gP>n;#AQ0nXnJs5R2c0 z^=U_L3detPU|1^-lxpoO8{iMrOx|;#&*Lc9oLJp!XFE}lRz(VSM&?S6T^KoC?klhZ z{gN$sF6BbJYRkK?MPgN37VY^o3ihq-j~*WK?*47>4UBK!_T~xc+qnT08!yY>s>C6l zIQD5$#q<|e4#z$?{89c2t08VRd1Yrf+c^-anDBzEX?ITpH8LX4?8ebb_wFczZKd(f zb^G3G+fx>~uoGtiXyJh|Hc;(>pB^Zud!6urwXj#=O80$tqx-9;a%8v4Pu`A?{;aR?_x#am15l+j;{{lKqx{HqhqoRiKw{Pm2^#Ic1@fz^ZB zcdA5lfF+0Q#&}KI7Sh~cQ^W1%CATuF*~-`l8f=PnTNyudTN%1iFUCUXHm&B&Ha9JR z5?dJ`0gub1H&6kj1;@vMw7qdV(Erx<2I`H9DcUSU4k$uVkBI4^X-0SXnr7*4(~Rl* zzo}{VZR@IETUWjPKfzVW4YdF1u8PHNEblQ~rwV z^v74*`9&R6+E}dhI@j*RV(nEMu+O<+C3ard=NC>sRQhgdu2X`fbQ-f7s(qXa@K`yP z-R4xr=fuib^Gnbu>ijKOmR5S?#r;v_Xy4}kXWVT9)tMMzsM?~fiuhq}D8PDJd{^X$ zN9JHVKxYfKTjOjUbL7YF(j$Ad`FIEB9oZmsutcZoOAFgu@8BdSns%7zTyx`U9Du_$ z8tM47P9(c^S0ww!EeP29rAW?=cT~h%3l>&HZaRdm{oK8Nh`ZMhVfXr>(s+5UY+rxI z-M-$k1QzzCg**n}a_qE~6EkLFTSiH*cB-F<-t4nxr#iofAv@J~ai{tgY?}M4?o{7` zJ#u}q^`hg(JE+)^g^}fNWD>novF=}e@og-u3qpjr&aQ$gOQ}lflT;H?)0cjmWtBS7 zZsR+OP3+~hK9Gr<*pR?i_x_blljs>jZtI z;K}@lamNl~CSE%=C9OPmpOa^q#vzop@E!uvy}-W#(t+hx=)}pUu=7nIZMi)Oq($-D zKrAMu<+cWRKmN;rr`_W_&;PVS!|J9pyI2-O1yNK%74cUiTdZ?+w#}oDe0r)XEsUXNyq9?Tj#>k zNbDy#=x1U3g&%Tk=({pD#52f{5h)UpuS0YvY2ike=@5m2oug&Y zp@c(b)d+|Y8MKO2BUdcmwsk(if@WbP_FQDkHZU&Uf&Qk;RmSd0;%m7k70ZG*VR^tE z&)}^b9e41EJQr56c$~x5*nu5CT!uBeTrL`m-({AIR-*ey;jD6^tbcUmjtXIP2Zx)? z<#BE9FfT{GWV?qwyY2M&j)ReHN4G{4M;GsD83wY;2dsNPtraU)Q6ytDFm|K{B@>4Q zS(4~v?v+4iN!n@x+92geERJ3F@mOZ%)QZg3%(AJW*7S$duvB=5*&3CG0)VDM_b3W} z6w4Am7QZO7V(LYit%KtIr-Jffip35vS!9em6KSp#vFu9A)+WR#2IFM2J8~Jex3^)z zC`&i4vZaf}#qOrmg_Dn9Im||Rn;`{EV_AHcEDgYh__9dZ_A)G5Q5na5Wc^I}e<{FVN5^Ri3(@8yzpps{nYTYk2PM9C%Fid_X_azb}JB*gK` z94NY{MVH>1L3`r($#u(>i<#%Bs+@rZA0;mCl^tdR|z3o)DeBH3W|1V{BSY+Q`bPeLZzH<6qR zvk&xP0>QQlEPcdjitAzoEO%|f;{Bx2(24*dBt*d{ZV?YC)8YYx8BYCj{o z|3iA)olN42x^LodOd)4PZu<(~nB)Jj78D7kk)zt~TI{m?CDM*)fkW|X6^A6<`gBWa8!%~?{&bgZG&o&<1mK1qOjXs7rME^w`bFHxK#6U&Bp zBrNxPO?_oTQXWbtx+Bg=m*$J`HMwh3EWR3<_DIVq(vXqni!RqihJi1!To)~q`O-4! z=RSdd;~kwe!_7)u$afGfL5*678nxJ4$j3E&SI__G4mKydbdUG~bkt(sSPLbT3_4+k0`6s)x-h%}xR z9TqeLNadCR>74i`AkEXC0aDJJft2&#?Aw3Zw>j{!&XZRFEfCHZ0bL>JQ$SiWaFv|f zy^G&k0?Yzmx_9=wu+{#j=DV;7JufM*-gbA)8en@m`!4Tduvr5Z?C*uHokO6i!>n!TOdzVAJMYIgmEzc%HR3=dJ?M=G;P{;O3m^?IZnQ zi$_ijTOCn$$RR4HN?MklBpd0{QRb)^cbUG2lPy|!yhY12{+zPzpJ^?l@kX*fiVSS` zMpHTzp_Q{%*&|SRNY)7djhbLrOL_4VC5`JFcQMy~sU~p2K!qhrLRN z$%_=rTRhvxga1>a|16*j#X5RH(WMrx0#YA+5=d?T5|C?qJSRRg7g>|rC|c6_g(P(O zViQ7W8c4#B^zd!r?tfCLPdF$f0~;tFL~ZnZUG=dy@W`4^eFg_mR4m?BAH%^HX1qs- zde$CsrYucsZK!zSAGd9~yYB~YKT?4Y=DmyKytY?$gmWsk9Y#*v9ox2l2HSRvb~AM4 zggq6D_BhXdZhGw9{ju~HV%y$Bmveh;+nY0D>3b^{b;_&sy%g1sAy$qqskG0=-o*&x z?%1O362xU9Pt&(`QI4x9rc1gS1~g5Ozsow;%@W!GDvPh(ilG5iccHTO5|mI_t5n7= zJ->E{UOrDk;qs+S=_PBlKZf&0ci$4{(qbG7gIe*32)n4saAI7ksF4y)P>@hh3vHhf{$<7_Iva zhVn|W;T);DjYqZN!^;axr@zqJ52L(4*nb+) z=1VKqqSbk1#`3)LJI3(fM%(1P2zmgGc-_X% zQ;*TycG*|O-+_c@qEtH_W4rQ=EZr8&&GU?%YS}%HgBi2{WB;KV!@6)h1LFw)j`I+A z7c^F+ABIuU*b7H0UGq?6#%IrKFFrK8DcpkN8SpI{IA=CK`^;N)S$n|&?6=3?@k<-g zdqIHMgdfFT_@^7Js$)Q`YQhT@FT7XDvyMoR4OVIRlmOU}EGI)PY|p_F2q0M)DMQt~eFx)4yN_~Y zpA7W)QyWq(dk#okv5p6KGj=cvSWvcc3EP@_rUKGb8=F;YZ*-538;U>B+b&G2oVvKM zHFM*++53euj?ZBo*%KRkegV3MNKiv|V;D}F-~8OykI9_dqO)V;aTHP4z?Jc7mGK2Q zF!1Ec_K#&kKn#gDi6xJMx(<2t5H@N*jRc4fitR)$oh@6>(0`Q?sBG@UUZFd&(VEp! zDGahLE=+69sBB+ca3CBzGOGY5t`tjT?L0RdZKfGGcqJ1MLe*~66>N=Ql$9G-7MGwk z5=+>vBE-IJDbMdJPd>bk2P$1D5zV2V`GVM9&?VRNfb{dQbwIk%y451A<|qKUEjskf zwe5@|w}psaBFaDa7)A_O>KF7Lm&jl@7d}kgX_Wf4V!F%r+Zvof64!Tx6J`LH&OL0mUQ{K%xS z$$Mh$Sv-V+M{T!<LzJr$5GNQXz-N0`W=XV&DRP>aLKej_C)Zb?KD;gHLPwLS=}_Dx~ZPO<5VcsDz2>q zQrCV8=;Pw}*MaVrw`^9+I5$R33&aXJIPfD93_dPINbBSA`qXP#b$oU=-t%xFx3_`? zffeq78Tg>fy48hF>%ig-oe0#@r)1KR1L-B0c(o&3Xak|Kz=M?VAzoQL=x%aTMZ8UE z&*y@Jrk*k&O&|3@niiH>g!as?5Q{;aNt%hLC>ppld%KqSm$KC*M_s*G8Gr52j9GvS$)0MI$QG#-2MO z;J}6P9qaa`pOqe2&-_lk^3ZT;#mRO!Hh^7z`Et;%7)BBEp=4zJy(DaV(G9Ul*ldqs zRu>^c80794P*^#A&&nIBAaMx!_2F>lVj9?ogO9c6brfC5=Og)iIE@iaC;S*{#@gW{ z9(>5)lNkI|{Eed*vvGr+C|71-aY6W^SbH(P48(^R-&Cr3W$jK?d)9%z6>cRS z!JJBk8zmKp611eR#+iF5BCF)$()eqYaYj<ukZxQcDNK?%yzxFC$$#~@u>joMN-j= zoLkFHbS2Ehr&Bp53HO9w-$7J&j{x zF}*s{Gr$`t?F3t^YW$uDREixarGY&TluTQ|IK%XUPkDwlOD{j;j><#7p64GeW_CpDSz6ACqs6*(8iznLKZvT&^W2FpgU5jn zOLyJUbJGB2U=<7h*T6hXbclz$J=w*xc1L;oR@kkY_)l495 zRq_Zg<#LsMc0Z7gYQGGm?U4OII==m(MLgxlwpa`C-nOP}i?zo8)b7?S_CGBVYuH$m zVKB~!p)K2l9>A*TC3dXDPK~j62rTv=22%{9RCbI5K%8DA*V%bRR* zgqg23;8eEp#wM?J278epZy?FZk+?G=#CzR1ZEQ-K6 z(wO_>Y4+=OWXABa^-WK>7RF)|Cd3|~l;m<=Ls_|nE+ z1nO1VkV+W7>sSM4(Mm6E*jEW|?KW+^#H8aU#rPTEh_d(U?274E=eFegHw1P~FAUTA zW|#DV-Ah9*fzOb_I(n5pIuX{S56M}ut!*z0_t!srOpJ|gll1Ym^@v&cwrX)Rl-dA^ZIbh`ZiO^ANqjDgv zc{u<1wv5(uPC#p!j{<2;u?|SjHLRwWfF*Nb8^vfZi2;8L&<3pn*Wj zkF}A~a;{Tp?*P)${?qm?#~AeOU+mj=?A!i`f31U#1DcIk4Le+3eV(8qAgztKF-cDj zxgJP0_!5v>)Cr^({TxWOIs~M0vr&7fMY%xliA5&@sYRy)X{|a1NICOF5Vd0qkaFQS zh4ooKAeC_fkZNB5q;*;$kj~U{*R$4XHvwr)c9%u>0%=Y5utgY>D?vzGr`g)8(Es!k z;+qsVMy3HA4pv>A4pB)tf#5AlWJSpa``|mw8A137Hxrx zP&R`BYFdBqX$!(?jrvWXN}ltfY!%NUce_E)p6u%v3XD7f@2 z?4h=ms>m!1NnCzH&3dd4_aKmH=-HOSmiQ&BP@zXw@H|jdwKYE0fkkR_5?i=zXL*g( zvBm>GcHMrvT}9+8S~pXDU(w1`fugklBjgxM`FPUG5VZAEEDhnPofeX%K$^8V6R*YP zQXnlp?gY}}gP*bamlP2918EWZeIU*5F9Eql8ITq!?*KW{P{&M~TcohKJk~<;51`dz z=C431my0j7nCS;}u4MnAK)Tpv6p$7;rvPbz!^XQ7I4C9(3J)z((CpQ73fQuXzlNP9 zG84FP`nJ}7x-1&!1Y-cTnp08ubdjCli)_KyU3rMGPApZ%FE6f&_ve_-g_ZG(sw?US zV@mg;s_DCz_rcUq8hCJk2)kciY&ngCgRKR4(ioe*9cR*Sub94V1=`%DjTIBpF+@~~ zxl@^Daw1zCR{)n6n;eNf`}o$?j=nJMz+jpezbJRzpVC@R=FcepWUqVAo!WM%v|Um= z#clo`1s=MHU>uMxB4BFKMFcF%bP)ko!lOID5pE>DSLK{=?)}E#ROI$ABUB}3vuaA8 z;w-8xPO9v<4vW5*V6qnF(7c6cH_V3f#QbTTKd8%W+jCPPz9k-uzaNWKVR=0kgP$^^ zGX4X}4-7KlSK~o)L2;~ZS1i3VmX>w^v%@;aRE(LoAGGA+JF$H$J62TVYa;B1IhE=E z!mRS@yLA0HMy@f_3AMO_K3X~9w-p%CTK8-LwwhdpCG?9ypwopI7S!P_YaE8JjB%S0 zjHCPWut@^FjwSg~wbB|_vk5aHh*}x@n??=mvfEyyZLh0s@9~2KKHC_CwpDOy)3XgG zoUE`FAu#+XZCayWdi*U$vWLh%Lq9clR`o> z$w$HO_9=xTQv69NaN2EFQHGN>DWi!5GksK>EtMit9qc0KEFZ;}ErlXd9O_ZdeU?fQ zsXpjd&Q~mjB2t9#0}pg#&;6E45vekj%ICKzo|@~cmO>FJ26dq*Fu`&Enx#-giXlRg z(=W~G=W{RL+$o_407WGXfD_@5dp%&eDI(1X30Yu*ppBl#PaLJ=uWSBh?&|B$6pM5;5CDurg> zvJ{F)F+EUDDc+dt+m=cZsY-=v$k^n>@v0%h{b5U|h;-+vH0tL@T#k?85lf+n6xB*G zG}9T{g8%h>ouSBFLnr0zBVi|h-0ORmS`n!)_2ezkU>BL-xIbno6p`X8rO3&2a*75y zIdcXc?7y$y-o8y4H6-LroVobHPAviyk$Qnpk72AmJJ9JfSCWmT;$Ipz+ak17Tq^P| zW#V(MApVWY-wk23VZr6;pop?m8}hug2fj;PzTgDCouks5yqERBA5jNijX5g4$&-sC z%oXI18-#CKir89VNO6C{#+D)wI%`y`q}Vc4^q_`iY$;-FDHTI;)Yn`={BKFH+VEv; zc{(VfEagj{AMJtfZ7$!$*fRXP*PFao^uYhlW6+yCKhXo<&j?>B1?Om$dYy3}?oZkn zQiQ~}^M2dY% z(T!$5u~dpk^@ncd?6nk%Nb%<$<-B026p`xho*dT$Gw{@0FIoykq&O@TdE@&z!yEfM zk)jijQgfZmroJ^9)rQV-?gQi+le>k(NT6^(#xt)0A-T!V%T|ISO88JD6qrCvU44a^ z&7&+qVU{^gjWm$cIG^Q|plnKaNUkXB6HaC5g7BrGiQz6S$|@4O*H5hiipXK0$VhH# z%rqpp|IAV;BGqw$RQ^`~E0#(TsqzA;{IXuPREkJ-f>N!_a8@ESX4Utz+4(WNHP>sF zQV}V~DW$KqJjMja{dG&Bh!i}!wri`L<9X)#xusG>s)=3XOfbQ5|AnPcM2a(oA}=YU zkcg3er%g>=+S+-lP+fOpf-Vvs9i923jF#IMBxhQTa83n6TRf zodk5Npi_X3pcq0?al6wml>M{8pA2QYF(n>|B7nJ6Fq=<`XyYfu41e5CH^FiLy$B(N zB2wJkh2lgX#UCt%B2sKriXoZKkb3-|+t(RVl;I4Sq}6SMkNS_6S`n#l?=|(CmRb?1 zc@(wD?S1W-!cd>g{gz4*sXixEWBP=gKJ|Ew%TVyGhGQ;P#9XWt4CSxdgLrRN-U!Ld z@THGE`JM#jOP=R3xO)Zh{aTNf{>fUZh_*b`t)&`{mMWs9N|9`75bsA)TI$L7Bq-lx zON01sRZD%1+Dg|iydAJsDx#H7D+LC#GVcsGrPpZVd6|qqLrH&Vcy??Qv6-Nh40SvHn=44ha|u2&e3=?NJrpq(lrMR5T;E(leD@09 zJPfL5G^@3R2u`c+5=%*YDSzDSFV=oV4EZzVk=Mt`x;bN?=Qqb8FWT<$;uCZI)$&qA zUcXQ~bHYvze3?0y)XIl<+NNRoToFC0ROEdZ{+la^|8ElfXtbdpJslKLmhvUfZyKgH zWFpO*!Z*3?bd`_lEo-eJTKiY^9E#b&jeVVgMMIr|f7k8_2^Zi$?bOC3?R-zd132&S z$G!e$IV&RPw4j_2#6&R~6`ZO4oU@X5Fbx-=X8O}W2YQHm%k zUAQHiK9kJd>mQa%5vlqqRbIN2hp!cew`)*;KlL3;rHE7!p~~|$7)ZxAT5&Vdj+Zce z&M$?S>yYK9h%`ebWDSGRL8Il*&`77}#@I)!41d4jT`NNoWsH%Kjg-NQa!!^V8fFc*(`(O#n>N+=X2GD^BY!>usEasR%hP(+F;9)&C8<35Tf zErlXdoaIpj$au<9C?ds7rAX>^*ZbtWXT7C}R52fwH?;5XxV&$v6p`wJKq}WXk@$h7 zQbek`o=x{jAm>EA$?u1jLJ=vhP>M)~6RGcqK47L3nbW_C!CeMIdBjpGB4v$Irs#g~ z;C_u&MWk5hlhqfpAajz+;%*mnrCCZvq+HTPmcOYHvJ{F)(JT}>NpVFP%ukxLSPt0J4MB6kHVk})O}`l~Z7lp}-TSr`oOhrw_RiqFZ} zXJkcNw{6aWmbC)WQ+v?3V(5j+{Ty}^wt@6Cyf`7_mkfl;Y zsy#y0edYC22}9Zb$}3{IDIzz1ST@~hWKdpo-mCJ6S&W~hMGc=^v5XAmjL33EwB$G= z>a(2@b0f|OOumeGWY|8?$i>v`Mb7W6Hj90clVi0}L~Y)XkOj&_wc)3E)42%L`IDfq zXd`hWxn3(f@N#%eL%Nf-**PsV%$XBDtrr#WKdff{3V5*9Oc6Evi-b(@(;=%FzYY}O zr%9na7S)evi_+`K}?34;#i35 z*vbf?o8@gjklPH)%8~+*(J)D*y3z2XOqw%D;$iSD&K04v(=#_^6=wW>z}wkHnYV<~ z7%Ou$R=DcQTuMQ9ifDPUFn02WV4$P^I1G3Uc80vD10EzxEZxu5zI=#7s~| zl`na|=!WDii0_xx@&SFE0W&iXV&J6HR5xRMl;f=BifH-QeU=Xp%Lly-%j@wNm!YQR zN<+&P(Q=m>$ZvU&oNp#rZuru2PZveBT=|kGmy4P!i0^mRa%t)(_HF!q-IJ{4ifH-c zO6luIH5x&UGF+9r|UO&(ojujWfCmnY%XJ2IRz)tO6yyxRE-f~bx4*VV< z)>Lqi7o8GbhJtT39PL-c5?d)4>asNaxK|MGA1ZG*gyBmMd-6RA%9lKU(F5NX)avPd zoarrS$P}eJ88s?|8*R*Wvb9zb?RiBhC#O4;@%d7dBEN1(aGzkQ6p`weY6pGPqIJEY z;9CtxA1R`bl!BoK`7{dR{o4c|8NT$9C*PBxe980F9{BE8OJ#6y{d2q- z{=Y$nxlXlKE23R*DTkz~JLz}0WT#mwMWlKskZQUSg!}21N)f5v7bQX=M4dor5;S4|vWxyke^WIm0oN?+6 zR1UM6aEq6@CRt4sQIl*5Szv-Nbe`2@WRfQ5OEnnY6v8)b{Z-#dh8%Y{j71c3g78TT zC~$WAC?{L>6p?bAQ09#cV|4bogwfe%yv0k`XqrD!!U8xoKBLdDTosY)1PPg7GzLLk z_n#@qbN@m$dQ5ug^^``tVZd4ug-jDZd3jtW8*#E8(ShZ8c!L+dA^8bDWzV$ADk7f} z;p1;NOvO`k6cKd=6cUo zcOukK@U4cUt%_)?QZQ62{+la^_v!>&4PWZ*$@e5EU-DdMnA(tuG;P9n*x48QleTds zX-lo4ifGF1o}mGes^Ms;A{wd`$&nhw`|boojV4sulkZ7TzR8gq#P@T;*F>r}to|`@ zHrGsRt0LO^6`}Kc=M)nh_gR)g5h)%Nia~i;ZF5}O9B076tbLh#GdlfKg5-+M!575(s*t30B5Y`*wTAO|rZ?$^+ zbx8i&rngOAuS>dK@^dnSmxeiT?>JvhpUK;18D02tdX5Y#RzX_2LqQ)E#K^u%5Laca z6vTm-azXh(>!lR!h`!$?a_(~mq^-`pEAx@eoteMNd?&MCzf=3o=;!23k2oi< zI^H>{ainu%OQ~~WeTj2o(G2Irv}s*d+VFI2Iz$sd0nls08o;?sTQG!9%q9RuRN^HG z*(mSv!^r=IJc5IqUkUQ+PPezb$$6n~=spZzza08UC~roNbK0tr&dH6VoReD0os;Uz zoRf-XIVYu^<>Ve5wr|MZ!JYo`>PH}gDyp)l038r10CIRO@4U{l$||C=zn74tmW#^% zRUT21L(;08utA)4Uh+Sy{7Z4tnRbH9Ua zS09!C@9X0K_pC`vDBZm(tx1Zg&f8s0`j<7y!4QR+S+4QS$S4mvuZQk-@}@Xo$f*h47&;@pIemS4-jspP zxK*Q^F^!|0QT64{sG>4wRN6UCWM85^+hI=>+%y?6^&fBTdBNxNYHN=o+QW~;r%NKl zADZSzTYJU`3L_32XN{Cln}aOL`a&p=`kxVYo)3K_v@oZbgI$&!(}M=R>RRwMYK~X7-}Q_n=6R-+ypxfU+V11_arD^^8BS? zYC|T{Tp@fjMwQ*VE${psXX?hWX@#ru(+V2LrA6!KhN49mhoWhfp~Mjw)q0j)9 zFb~Lkqqv_#^q0FK%W?=sm zJ`6A>l=YX8pi2ilFsM8|{Dsh%^ucpNi!$(oPXlice>lj^ZBp7&RdcDLR7Me9yGqoO znI?BmgQ5Ax8+ceRVfg%)bh~@0y5y#aG&e~|x6xPXzZ6R8(e#&?~ zba^OTAG+E3NZP8jZ>K$!xh>Olh6~Bb(eZm07UqX_PoTRRoe&Ig1>8sJ4^&B zKAC^(hJ{54rm1W_@YqgzVNV6McS2VIT&{viP^}Ja|dGuM~*Y{PTMYSA`f0nG+F>ef&OCEy}_q$ zomE#6)%{~vbq`u~{~<_M231p0RSzXxs65?y|ev|uZ^k9xz2AwpL4DX>A2EaDaVyw0=vX&?Q*Nw?LNhttzwF(*u@gE z7|33vxXLOwUl50T8U$r(EvMUgK1QNWwpX;($6z-|t%k6sttSg^w5_*5Sh#Jy%?RS$ z$YXMSZM{sP&U_@iIpe8N=<1AAO*WOn45Em(Gz$0b7YDUS7zB2<`aGjj$<37yv{XXc zCYvk{S}D&MXEz9Pn{46%x5c(QG%*yO9h#7KcAArSQa^Mu&vk~NUo0E_JIzLaaKQE3 zE)mxrsNM=2af)c{Itke&;%>7V-XVxFa*v=)cdd(5hnt%ze;<9n7UpQXUaLnoUnHUjYmS>EJ z`vtiXAqKe-@v=t5iwW&ze`{%_^{OIz^_#-YUoM@2r{-E^DHM_7yIm-jnBcfyZz&X! z;&G)&YJU~^sBW-Sib(a0Ql*%>`GloVM2a6MMK>*hn=F+gQvFbrWMa!VkH_b*-E zkeH$+pj7mXBGwe@qvV!A5dYu0{6U1v-xAQ!j3Y&~K=~%O1cLbP_k0r267V=G^5QkQ zB@o2>E#aLuggY1qVF%+tlzIc4A$RJ~+CONBd#$!9P7$qnN2z@^yXi}kXpN;%M2h#- z78xNzse{W<@U4cUcNEbUrC_LX{5Mw+?=%GRjuJ6^nZ7*vo&@Dfp8j5K5Z}JSH?dc1 zxKp3C)=ovVBwKY!VW)m&FV~Ce4!JaEElvr76rn5 zKjMzp8Ei(m*NuJnl$I%?q|+p14MVW@IaB@&z3CjE)|i$fM|BLuQ5`t41IuGZqt`lm zj(1cCi4wbkv#i`JeRWxzwNMe|o-H8@$buI`&z48f(Wwxmz1D*=iXe?aQJ=(DNezqP zpvS_gnni998<=F3!gf$vG|gYH`PW9@Vl`Dns!N3G=zUQubYS54eX-F>P(%q=O2`5R zY8bPUj@zI`r;RXRSMU?q5VJp7y)uh_v#cN#cR#Qc!S}s&lCl+aWV<`Am z!!aK!Vm?#~hGHFNt{~pmd%Rn)WCcMDMJnD(!B7_%#<&OZUah?G*3XwYK|?1>P`>18 zY8}8pzHOE-Ll|GA;;X(O&v^{)UP1cCg>U|p?)Qp(PC}7QzF~&@tv22i(YCuKWDP?x zb$wC(3{Amqt1xz2VF{+YwTuB6e>$+k`1_ibaRXnvSKP`_L>ZeUWPu4nIS&G zd`tQ6n)doo-pDMBbq&Kf*HCBVi(SXLn7mXQ7In{BZT9&J)=gF$MbzeL30VweFKV>Q zYV@2Sc1!jO%97+$B2y7qhkp~vJWr9OuE=MsxY~!ggF`!%KN249iu^vZL1BQD41;!} zUB3}}=&au@(zfoea@z+8dH0JSC5ykvMLe>CD z`ux2bqqR`p34O5kZiX`u)AQcmXs8Bv(ih$+#NVvEACi-MZM5{!Lp$YXJ%+QMrvLD7+<=V%L0EXqE&Q9x-;Gl;p}C4>nG1>(f~mL9rfozqr+E+ie@ca z>!fkVBX>K_#U15>IsUK7@WlNdo7fdm@=)RJpItE&e5>JTl_CUoDH!U0{5Mw+@8gxX z8^rKsGWFzp5>ylN{F7m7LnhLU5x!z^3oOQoBSUfGh_U!0AN8lL#foUtM^r1eNZp#y zQ1GpWqs594*ri~oFW|qqf_R^*yxky%FSYmNdlFO=^4w~e+K`DflZ9{Z^V19oPp1C- zbekl6a#lopr%K2!`Dvy+X5uRs#N2YeprgxAF`-GFpZXt7e&Uf5UGtO60tzakRToIe z#Qb!bJflfh2Hvw?}vgM|TG`C8~E(!21dCb`QlprR+F9=H7X8Bop=vJRiOdfqDO=T2^ig9q8 ze>dBicxf&T#Jr%0s(eXUIYFMh&Cua~pS3~}Ngoi>yeM~i4|8(#DpKc>;!dtxb zt=hf@f0^qmmX{*(`j+q-b6nUtu4Sl`SOd}+0(hay_7e93ca z4}70@`GOPlmh*dj{K-qXBACwtV8{N-;7XL3D6J<-4veU z6o&MOwmclsmWw0WhU17f?1klNo7D*HUTlM_rct23hzP#&?=pGNYO08`{wN_6G(9Mf zsOdih9m^4ICrTj!dA=jsmdP_V{Zp>A_)kWZdws)tQxPS7Ad(Wi*++=!%}hZW?`a`vFh5Lwy5*V~vI2S|;>U%Yvd{zJ zzw~kPMq&47+AznzPJA;0LX5A(`xpK)*F#n-MbxUl2tImV-?Y3Gkyp-9@ZuNA&GjwI zOA&buKSo~Pw!9RP*C^$6YJca1Mw~>7t@!;9qJ->}99Wkm+SSgAqWvqlOU{GGP?-Y5&_&r^aPSSRgQHexn_}XyjlUT8HOsW-I)t>aJ_Fb!* zBC0m2t7_A&YUiX@?aNS2QrVD%RJI8$6I0n2@x)x;vkEAp0;M7&@8td%F&K^M?qMm1 zW$#1i#2Ba&T5^91S>9ZaSt*Jra6z+YWvrMZo) zG`Df!!#ngqqipb=P^jLS8J?C=AHFp6qMUF=$Z5`$s&{Udsd{TbXtxv-Z?WnsqKr#L zqcMZR&LA8-)(2$*M|mK&XPjnHzNV*$g0URc779gMTj=QkZ*v>Z5;EG3F6PbjuIL za<`DI#sh~U&81>Up@5xP-Uk|Ij_rGzYy_xNG1`hz@TuG%k1+culY=q)X4 z_h;c$bzSo7eLoNPemA!V^U#87L%f@~L59BvyOvvlNO* zahyW2;T{3_pZdBCZVZ;zr_EMO(=>Ohd3ny z38jERc`=)vEsqf2PKltSDDjh5+e?{3zPNsDr7NQJSt1~r>NE+jKR>Zlibz!vNadHc z*HS4W)rCssTeag)e=k@HMWnc-M>#KADn+EaGLXt|(@U005vgijDxA$cGb3Rm_NjPl zuAf>;MWnn&D93O(?RNvvuEzmG=oRoXl+1q`p7~D^>t3Z~sK@c&TtPCfRT<2QFZUO| zhJqR>1#_Yz%2Nu4@_#5Mi1%{kjgWp#m}4|_q6Fnjp4Tv~x>pe2>n&dfGQLQ~SA9XA z*Y?17waXWr;A=UZ*2h253#u2ruKdY+c@O;Cgnx3L@Tcyd*;Js29*Xx!^@^oZM5<3J zRf;_Es-;jwicbg1k%kuD@_NluDI(Pu1F8Hry>6)#k?Jd5w3B8Uh2Z+RrBFnQ2bCgV zCD&C#qd&j2l!{3CZJ|6l+3n~1$PU>mP!Y+t3fbsnGQVYSSZRt#woUa+T2bq#`jw?p zM5!9;-$-0E{!&jkXl-+I z?e)>64J)Hd8kSzu(%6O5X){VMwd$2DZ>cXSkudMWY+t^{Gkh-k2w$0 zbzN+DhC4yt((m1Sn?k$TZaD#TXZuKN`$SP|c}w%6rPoATmMx1eS+?{VKbtQ2yrJ{} z6}$kneqVG6>U(ghrJ8#bR0}NCf9Z!Qzx_>AZR zZ?O6;PSS5$v`b+BgIg?NQxc&+6fq53e*N;6hHH<)u7V^kkl~zd?OGaW7X{6~_&*_O zmX(Bk>)jSKNoofCd8c*M3hSulf>=Ia@hDPY6sTSh?OrH|^C_vMsWLCtYAH`Aal7{Hg+G`t}g|$nTH#jZLtqnc%M~Ek_ zh`X$aI|R|rO@eyG=yl8JbN?QrUP(LlK>Mwp-$^q`K$dVfd4GA(G+BZ%aA zTXAfa&`5*x7t}6qm^KaRWx=AB=<n2f1#r>IGfeNj~JsfG0w2}NH&D5(1umfHJo)&ZNX zPq&G($!4$)ShDPzMRi9ZhcV>8=!&mdIhBEO{Na1T*)~Gq$)Ce?OP!mwDpjANlHdzW^;^lwq6}53UPIOA;pV9J`{=xcp=$`1Gs5~pd+wT1{ zM#9w~+=+sY-an^Xeba4P+X#LIOIw#Lv1?=T;6HzzZ8O;EqC8zyD2PdEqM#_yBtdl5 zWI=RQksv0eGX#|YO%W6WnkJ|ks8|rdf9$HXT3;u;srAKzsP$YyQJ_l%QR_msz#}76J5UOhK94d5wK`! z9hyz(*;ly0rHIuotzX_)ySO3Bb{pDAsfE=qo6}IY!V#+)J+ehh7cFlDp~lCurAr&? zIP4a!ThdUwbjkI&FIyh)x}~8R`XJt1%4YCJpIN#1NPLodQt-0oMJ)}pYL_foP+PaS z8$;%x!Dxda8Ow!?XRit*HLo)E5Vp3-8=sHnHnRCyy=)os>he1Hp>+w`_Gc}ry>>x; z?flxQMMY;$Iir5zq%+SfuA4l$sD451q)8JSrq&lOoVZ{?{W;U7Eo*9Mu5DS?94#2{ zSGjw>4QEWQojP&S!UaVO7BoznT0gO{zObl%QvJdyb#=v)7fem!YYjUF@JU<3-7aMl zOSn4(v4q@zBXHF_XsVeeM%6eeMV3eXllwP6TYaAvUQ8L!2x7|U6ch#8CW!iSIhQu2whO|e zW4?Z5rT;*9QTk3nl)g()6lk{~N`Foey|qUWK*Due^_0^2=a-hxymUrB3gG63`uR;Q z%_WyqH7s9VdrdmqDH?EM7MLR;$vV>>e#g48ir6(5`O)RWyC~BxLES_AyV9Jz9wGERe6&6h`EI#v$x`s2)NjX15 zetu3<7c@*QuB|JstDlJSd2%86HJnjfKdGT`!5I)zo5*PeYDyIRDF@yCoExUpO+2&V z%(}WW7fhZ~UsO1G@|i`&MfJ63)YTSEJ#%t>BIo*s>slMmntP7N+iiw%=#wpsre({~ zbnIbr%=1<-de6qr-^AC9oxclW?EFJe6zFY1jGaS*7(4F>0yyTYAJ)w2IL-UQi_$+3 zMCtz$6b1TF5T$coQVWD5@{EuCm*3w#*4({L6Ft_|37q_m4Zm)F%yA+;CzdvU34QQ% zIZ%?5qF&?O&xsWGCA>BKzS`xfnKmjhL40?WO8=@y?98rWM{(L zWVUO|DV}EYL8O6IZR+VPCtNDmqQ#c9=3jQnjQlz@(B@-oWl;+sxUI5O3pe~cDf^#+a_}PI`anX_ZcSZG6JF{v z>9f1IP#c*_)W+WWCWJx1bXh^uM-Y9(fnC2Hc!W#SnfgZOP#3f=JO&T>HKT_zMXreO z{q*nhv^(q73RMD!+a7*!V#CMw3(IE&br7MU!^B^Q>A*&#I-Q z*@*xCxW}If7qyur^5~&61kpnrlJDL_Op9=lX2{ej@+iE7*0H^)S8<>YHb@FEU8rcY zrdp;|O||5ysg|~Ssn+K*GheGk;FQ!ufT}uo_6F)q7ndmIc~*ZkMOs z>35EVrhcV@OnOOBGU*TcLuX9sk1C;K+;gRs7x&3&w>sf%5=-Y|c}tIa4Pv89clvuX zx2lJsN#^hWoBHeUJoUfa>d!S_p8g)v_QzETZ~grIc)qnmEn+J2EHXan&LVH(KsD>F zMY;}*7ByIlxE{^3!$_yT^g(07TR!z)i>)P|{zjMX^!L`IsUCiw#7yzBlxaSvL9SWW ze0{GIJPr%-nPV8Q?DDib^_EI#Civ?F8IugRpgWzVi^S;O8-(gk+3sNGt`b$*^5rhucK^ucWjZ~3&l>key~+DOaP zM)L9!m66w7ta*z8RoC9yc#r5n8$Tn6vBo8OMkfArFDZ!8C6Tpvx}3x&&`Bv%XmXbN zd?0Tl<6e17uX<_LSkj&KY6a7*T4DH^yEZ`P&u(2>r!~mD{QOH(>TD#EnlbV9K%M`q z%hT>O{IZ0mhW88d%b=W~i?Sb<(2Sq&3S#_l^r_ix zr&{*bx@SZRt=le$)^XuvuyqS*T#2s942(RA^^?+pKL})p7YWyH3B`n`hBGVv&{CR2 z+?@;56uLl7G3?2yJGvi>6w(V|gJWxc32>UHN5HH}fGruEh(e-<6+lD7oWC0sRYWa3Zv((+22!VXZ-$OMHZ zx9k5N$jmTJb$>^w=o)nrU87E-Yt%_p+H;bLite1G#?nb@Y;T>Ut3)a9ed{DH(e<2^ zZ1sl;Z$a3r3unK8CoR!xm{w~wOslmTrWRf`+#9RCHLj|CZ>`pKoRrsB^kUNB!d1^| z4{4>8mGBn91FwPB%42P9dn-&;v))>CoJgic!vxVHuKe`dp(-=6qiW{r-(zl8lR3{-+|gRW^3nmqpfx&g<*fv%h-h_2)k%3xPw z;nuR|`jRFr?Jg-nNEDU{dky_kS)9!dXd9lQ=ru4U7r5?Hu(C1yr)B+1K;uBre zWvJC%o_1%%3JJ}0a=jqGqsT4jVj^gh(9CEX1u>&>?V3NID6K~2{Aw(##L^^F=j7*? zPAQ!??~0T$W-&7k>ehM_ThgYMMkZjndxKP`yn zbFpJe^JO%ECCvP#%jV03L&?#s;nJit@hB!IJ{PEsvFD5Omj3dRi?O{sf2rN{m)dP; z4BwzT{q+@*M}K`y5dFpFnkoI|4Z<&5@UclHsKT2}0&1yUzPKbY{q#B&Js2p{X#J49 zrB}RRdt+gDUQz4l6}8UL7`{PwdgT$3N3T38h+g4R)82X|XuY4v^6D=BnVglj28s|u z{Cr>D9=#LP7&<|X>8%sCi99;tSwVCH*K4M9LO@ostMPiVhOXPuxMWxD3RDCd%JrPQ zrK`O0Ib(Kr=|xSZtJGveqg;c3nO^paJi6*7L39-tmmZU=da-cv->tBcz4^01U5&l3 z$=jnZlhiBprh28f-u#uwqc?veh~DHX)>Pg^hoT8%y6jN|mN%69zlb{%u$aC-;Lk|5 zBHApWq{vcfPZ1)aL?m0ZM=Gr%QfU>EEJ=h)mO@HJwz5@}Jtg}tgk;I?J$p0VFu(u% zJnws-r+a5U_jA5yKljemOtAEHgFW`F#dy?ceyl|{jPZZ}+5p!MwhFGDsIBrAl>xTO zd-Mpl3j9mjKeYG-k5f`AgDtr4C5@6!=i88#KJvZzh<6Xge+ ziUbVwMz@THt6hsZz^16*i^X6qBfNz$`3Y`6l*H@ zH@N>(Q;G0LvHz*5q+2WqZ8bS`_P;k3t}<*YTxIY;$$n=mQyLe1b&=2p{u2<|I+7!O zj>Z>Y^t=+THP%(`ey!ML>CLuVm#C*ol%I~9JKXKyC{d5T#UpJNzdR)0{W`Dv#PNsCRJV=@ zXxk~G>opyPU24VZq2p4DUbNXO-H{$gDNhNNsg*4F)6u}nzGk zdh8n^bKuvLsYiU*4i5J@bkJr;Mk`I-Vbf~q^Y@P|gJw6>+M5<>)^0J?xlWHi^yN$W z9^n@iYyGStXVugrSBu=MLMD$XS%3d{SBJ;;+ZIo(JG*08&$IerX2WNz=Zsjc z_Ur{l`>r>{azW~jW-?j9#q*Q28G;jY*`jlNTqX1MOY?UWYZE6aDu7dx-ER}D0! zYlfC2pX#)IXXva{pRPeZ)AYTUci22u@=NTPLycjDZ{8J_?vLMJx*=+{>-T7CAC$K2~XeT&GbAycKj9Ts?l*y zla0Tro#E}$xlZGTOO#2!R_pbS#)&&OV1Q+cg#mp|k5ZX-W4_yrcBAE^ao>f!FAN+b zG3cE9Dp^(jyVFnI`l&w1dcWyp&Dcnr*PeqW)Qqya;rf2y zt(2F#Z{0^r4(m3s>H*ES`SD9xyn*Vrer@QHmgnPHHFuTWvbrNicMWJa^IpE>4*t~F z$H$*jS$B7F=Gy3e|2pa{%kVjA-$`}WFpuL~FH}lRb68q6;LxIp>5eXDK^tFH*Ujjt zcwQ`iInD1xwAuNPXl1*C^18bBhe86<4D-Hz+2=ed?$O&(o7bL;phxOck8)andYU0?jotF*h|QI8QSUW6d`|0mTPqXK znT^QW_cOrmH%(8++fSJxs@B)@tp0Ug-QxMsUZ>?x)!zLb%lG?oW4BIF8=3txs^~Fc ztlm-myxt1?O-d!^n+z_VZ{VxxRFdL3*4MM|=KigE9(8_Ry~@3ecOXS+cfxx9R&yUc zxqzay`Jq~NrrUeY$Ul~3YhAQ(Ori4d-4}<}AN`>yHfT?Og@LaY+dfLWobF{&9W(xP zkKSVke;m9lrq__U%F-&o>g}!vCAL~SXM+6rbrb1vgR{o5f~ZgH&OCY$-bK%(Yx5(G zOF4Z`)6pY6Kl^(2>Ps#oGwE}Bq+Y7$xCME-dkbW9zg%-`UFhPzRQbuKo9>tCQDd6^ zEB=O_#k8O3_~|%&V4m6S0dDQi6pgrUFyj*Cw;S9Jr8r(+POm$(p9h7M}dwuqXT59J>(}H<>c`?scLqP$vVP3#jp>2&`t(xGpDmg5RIEhd zQ}4@Wa#v2qxcl)wq|hVf+7pvKS6q7UaoKaxu)ry1eJBlpA zTBo#@93M)L-g_&1EtE)HqtyDeyiuFi*XWV*PxS^32M)(r&|~^!_n~D*z1#8Umv-AS zaA(A6GtYav>Mk$T4=Y-=pBXf^(`};^DH}gc^|uGwy|i= zi&a5q>pin)|F3cUA8#@V@L#E-c~otQ$HDEt6o*}Sc}iyDu>UpQC&R>kRtE2f&q&O@ zYxeu(wBb`767KUO!ujQ(B6*Pt1^vRKyM`-S&wiR3n-(-WnvPTJ=}UUt))=#ijx#zg z>2rGhq~pE$I5V8xDCaJ@V)dVnNh6)MES2a}Ubt_o>RjCnf48VDyQ3HP)iz9j(QVV* zF8TCG%hlK7O%?@)d+D@$Mwf%>7 z_fcVzX0)7Fds}aCDv@nR%i%U>S(T?xCz*d84WphO7@;+HQC)mkz!Rg7-z}4O$qYEv zQKf2STJ)M%_B*rZ-FCcxNW#0panqY{n~k~!8$1;4GTUbr9Nly%@YH1qD{%w2!P|qJ zFIP{O|FCR;7`-mg`{dEC`zJPbu1TXuvtZZc-v>I#(dU0U8uI;vkGLjlRxG?QCw23p z-G@I_6}g@~7O+u0VOI~`m~#6c4}z+l8h4M2HXYq9)j88~<)Z@K3=`+`xqa>!_&iqd zuN^nJ%B0=5ZFzkzoR}V%6>jlqcC2|&j8a^b!quB8gRT_h^i{D64W{F($mi~W?h$Y7 z=<^i=i}eiF&9_=v@q3touG6(nvrbfAuRk}sp`U~Dg7dET=s2YJ!FC59uf5%;qu~Va zn3Q|x45quz((L-|bbm6RXg{9X{JEKb?&g$1cg$Pc)z}1UmW(Qah-^IaMw0)~EJ^?JkKY{QRl$O0i4pGa+wVr`z6ZJdvW2O#3Hy3+7YzO-)IU|wGZZ>_?_g0OAU2Kj>?d&XVc zGvK{mNiRe3s5Z5=GjB>PF*i1{Eg3=AH9D@;E>^U5Up>%wf4`UZUK-v*={#+JI`Y@C zj?;e8avYK1MI2wXw<6qPvcpG1*+cpc#_xYvOdnJ@dr?s$Fo6jLJ3oyrODvujnVw51#b0U#F&bv&Vypd)Ke? z+O&X{bE<()?6Z|NQ|P#%dTfErqsjF3rdFv%hcH#YDtfxQ zX87zuC7lm+-Js8%WlcjI9D1#t(N9LNU8_ms>3N#o+5bkrAFZcr(E7WzQn*rRGcjkO z)z@hX6IwmCG}^rK?wx%TV-&`j^-S}=A9*bQPHOMDD`-3KI=5<-L7CeZ-%Scti!&2s zvczmMUWPpG_c~^R`gB`EZ=J!RCv|;a*9}M`6LZk5j6YW$LZ%(y2S;Hxw!1iV!vlA8PXmbtF6)~GUBewAOg z-gne#*_BEPD}D~^Qq|US{e-iMLtC4OkGsCz=!17Rm8W5e=S%~~r=_m?tR8a7K(5^n zy#x8DbWbj@eN$gBT4KVks*EoI^n7~ongcPVk2=zLVgc&(jD zF@ZN6eA`@XFnF`osNh}x^)`VXA0;nNU0yk7%CG3%uMSK6-k#Zoo*!4;`+E5~rB*-d zT_lQPKRPL0mVPZcF1Dn;6g-R!4Bm!ut{<#aaORNmO2FGKxm z3-`cl5y49Ie8Jn!?dMzH8F1;>=(Xvuu8grxNI4gEG3~^-qUY7SZo9sHyJ1Ig=5o0x z>Ib;rSQzMK&f1ASr|-MbBlT%~+Rt>JH$Sg0F-L99%Y{MXdN#CQm~HWuw$lYyN$mwj zE~{>a_&%uVVD6W6{pI2y>+Ia-^Duh7%-X$A{CG6(Rn^i9m^Odz9(G;(e%a1YM=v))vIbme#=@_T3L*~pX8M;qpSItzVN%H9(HS_0hUN`fH zly-Vz>ZAbe)kb=WwMr+GuZJEld9Aj(%b4k%l!m@h2d6reL_|V>Fg^wkw z*G`9K3%Riv-bqw z>)#wA&J1!Hltagl_~MoFwQ7$V>G-1aBIXuGkkmmZzUh=eTxAs%$c%t*j`O4MG4zcO;e7|2woBC+_dU~F&FAp!2*ULt> z@AmH5oAC208&=TvJ$}Gr+mQ(sYo7+XJH6PTf2v1x+qE~Ywu$QDeZxKJ!#$hk-V~1& zi2;`_q8pD%o(>DYB7I}z1pfdV3wC{?@t!Xdw_J4aapTP8ymzY-w%oR=O1n1eo^uwB z7qr)ISR4Cgqpxfl7vMIse0W~hHk0J7?RssRyxjlt5$UzmyA<5xR&Cp|72Bll4-a#f z&!p{kp-b4g+4|bHbllVHPV@e5-k)o`A2{>u(6@t^+MZVO-T9$$RI5|bSBLaCL-V`2 ze&Cq#GZNC<_dfV@!1?UYqK=PDi_gD&g2rz5>bWcRzjbrzW8@c1F!9kMYnLEVW|F>bk&l zv*t$a?V#pxxHnz5=uvWrhmxMw`6&~%Y7DR2E$t9AFiNK2yu*7R#q@JC4Sw^aEeC20 zUN8AG(dhJ#pC9w9U+7Lc>Z@A3XV|-)kum9x5njbI6ID&ToM^la={}#!3Z57n4Bs{S z)zeN3X*}cC7D1kIUo;a(rcK%y-M81v$(F7OpR&py_{P4NJt9O`EwbIA(2`|h&EwJb zIvL%%(MfyPzUJ+JXQX^Z*PVgJE24gkxU9Ekwe{Eel~rz=*}7^HI_84TG__4_W;*@0 zTR$&=uB(Y-bIX@$D1N2mn$9!&oUTLkIi1g=^sjv_ZM(dluFDleCr+)K;QL6=KK8z< z>0G0(=f*U2Gz^YPwTZRZwqwvrlhN`?;VQO;bY3a1nBU%ESF8HQxw=Pgoh-gq(DmV= zCAp?aX4CRlf8U`TPv;$77ij(y%?A!YlcpS(5G~!R#5Oo-n?>pS)4C3IHC7UH&o0<6 zG4#R3z@x_LKkIfWmBg>P>RzpKui)m4F$%r%4eiENEZ_CI#2~}%RYO%j$!>@0huix5 zRBL7o?s)J1G8>CI3y%#f^WN7{?5UU1g!3cj#A*$%&D*GNK5p*f{XG2@JKMGD|MKAL zj$xV7FMhCfc6=+{MXjS{hST{&uS*xErW%%6jycW$K5X-I-ik}j`^&!O-Hdr*3WIVz zuVkH?K5tKo=?UHOR{0`?^%1$+)?cC#XWNe|U z?KfI4>Ebfa-y?@!r1{F0N~$~cR4bwh4+y!ZAaR?{A4%dWZc=3LLsWuIM3N*))`^(TE@O0`q!1|;J2v>y)RtcK5>~z(-Zd32H~)hNjSYoyCh=EZrxyLH7F))p^%8Pt6=+-uF%2?Ta7Y{hU*k zrkQR3p?vne=u7?ReZi&Mmlv%IO17cvh1(;K(eo5`-7aZwrY;_1rP_SFbnU(P$dRG$ zTRTr57~RXue0g8r-OKzJBuY$o)_yj*z;O@l?*%o^{yCra-&r8>zYj@&vGX90uJo*Rh$1YcDn4w`BGEma!zR7zv<*vs~90Y&Cz&32D_dl`tP=~ z`f%K5ZRzM0r*@|Qnx|fI?o)?lQ}(XyBoRILm|XqGk>XBO{bXs}OZ&=?ahSgPk9DulMno< zAJ^20hgP(fnMKFVA2Bv)5~?(Si5(rvo=+g{SbfFIYR8z@}xTJ@`6dX zk_UdsbG{_Cu*kDv?UCidJK99wF6VVh_jbOp*f~yB_ZIdC`xwmvc_gem&(~ z7OwCjZCLWx^TR@JomE|8IawkxN^((8$qOuwKqYg1Qx|3>fs z>3pECGwE}>p0&>ni=SyI9=q>doVu~j*QGQcSBHw5?T(MseXlklHcP9jLdkk{pyH0i zCtJNv^^0>(D!L=?6(U!;sWz@B`oJ<$bIc$ zST?{}d&)dbSLYYsJqA>7TGz40{!6J<7r8i(ua1VPO1?)5*G&w)Xcc|U`F7j&@gu4& zl{!n6&KteowVd7;Zr70eX`!ndaOvf(%`>UPN{bC9 zgcODh++Z?)_ky(}cJwZrIMbi5KmEsLwiYuU-iM~6`70+`UV1e}-h<{Jy=Yy<@*CZG z_x5QyWY7QLPV>w7RMGwRaQSvLzo9?ZbkZ7`@bU~l-N85>x zKlUF!YWF^yd9bee_}ct?%sJjJ zhikOl^#1z)HXiNIE+g}n#%)EiJXX7Qmr)h;Qa;@bun*R!hM!*;%Cq_10^td{WN zjpecSSP|OY^*MjRGG(R5-5=Y`ejNQd`k-I(^67Mb()R&*e(^tL`t7hl*z_o@l(}Hjy&C^ z7#Xx;2%WzPX?=GZ?YDo?`{aZxIbH8AUKw6qr#R)>zWlqPZv5qIoI9=(-)o>F_0XhX z{x<%%=anb+I@ixiefO5Wp0v|!pDuYyWl!Uix^FMuZ7tvTE=jBBRG0elmGk{_^`|KQ zzpfAM->m4&k4tUe&uremyl(9WA2W}aKK|i-&-^?SA3FZ&`(1QCez$oR)>Sj-bo&I~ zE4KdI-Zu9xi>0}RonQC7cgD;%om|3u(SBzw>BBSjU>Ul_fIusd8lx5{GNdd)&?`-euA(v-l#b0i)Y@?Rml4 zbMMBxb60j==J>FC@{z5hJ6;bwUB9wlMK}8X((bp1>};2o4SKU@b=0i!VaD|RrLPNC z>$ZRPuJgB7SIVkB5B9U3?ob{ccP8Ae=d*b}rNxR3jp}hXy~lN<^XI^URzspr3{KiR zrtfRLmDaNdD`&_b*jQrG{B;g}zb|6O?FXm6Mh&Cu4SikdKH*F7r10$dcgAkXT|BWS zg~m6L{;F_Y*1F_Njmy)^gHE|jJ^K3Kb zQ?CEa{&hcW_=`1ji#CrvRrfvaTyNQqdZXvH)e7%@Yu6K5c3(DZ)Gh5_8uwo7izWPU z%-UR0GqlJm_rR_a`Z_uP(t(1|pd}OUT;^GRR9+`VUng7T*vQOO{@u`ge9`yE2G$+w z?(g?1P_bLp3PsuT3@Uu2$U) z`mS1WFFHT^CN1YE`|k%%p1AkhMEcV>hY_FF()SnXeErvRdY?kyN2C2g-;ex%-5;X1 zGc7k=2k7%19R@3gHZ15ypVRZSJzsb3rK&zmC8ha!`kbb}s=)WJdc3uizTYI*;c-$z z&s?|X!>^71z4UUoanFi84b?3ceZHIjdj3rRK~Ejtm;CZP=yFj9h8ac}8!dK7c;HV%C`F7~rmmSo0)wNm$%j~Wy#nR(FY-gnua)fdiPY$efS zVx;~C^LdSatA?9hqUUEH@-C8$RqOop;**>E$LCL^@xH7owaS=mYDUwS&VAR=?c9^n zcj_ZFU$Zh`817Dm@ zE?ze0nfsb8?pu@Oy4y5#&FFmpgl5}2OKz&u^Yl7OpBwraY0O>KHIwFVVBYR`qi@R1 zpg8;SrK5Wm@6q}^{IzMu?T$_cZQj}LxlG&P%AzyLKPP|hp>^@p*>P9*tfS?l{WNjN zu>BkE?2e3_)2iR#nOhJ02AYn$<*fDibED@2nY?d?G(Q@T_REOyM5&?&KeB1Oo!bJP zA8m-6L)(qkUt(3?yj7}(!Sp#TH$9FUGb}p3|IazJe)LGs>x-3lzxiukZjHU7?neID ziq3BvqVB(2%Kq1L!~~zMX;ZCE*}BH@=Up%E{ZQ+a%;@lFnSE(z%mkiqhQiy%t*$GUg{_}>IXRnv|wKhbv1@CUPu!r8xzc1Ztm@w3O9XD1skJ|Cw0JhDjD+@xUQ zeD=ACn*E0^#1(d%bbpw9(cW0)(A}ZAs;Aet`$6N=*R91*1eDT!mC|Q zbg^sIPkWnkoza7sQBU&Z>Xy~#x7E%wIelfc-l5h#==qqwz7yB#4I4$r%eBPkJD#`B zQc|9K>D^(+PGzdIX4R-%&aAv|ejzvH=nWoCM~}_V({%K_Y{jGgnRjv~{mGk}KQMlf z)jXSY_jxNHgrE5Mr}AEui*NOIxaUK8vq+!rZ4#f*_%FU}seHPojn1FyLA{hs-tA%? zdW8Qe{yI~ssO;mnmc6ju+OhM!tf(I|JuT05oBPG9!2afr8@8XrOxuU9KO$}%wA68Q zhOU_&ja&3KXV3EZ%jSQopMP7iNf}y~cLTqwi^@%ctKXl>;j-1_ZoiZ6cK<5J#>k)3OiGLU{L6d3_`beM`rbXEo27J@+MG#gKF;a* zQ)~Oa%+OSJ`M=^N`d&Y<*yECGWkKisVc-w$nvV}!Pt(pTR&P>hSATB!)GMp_s7vs_;@wZa(XH*W z@}hrv$NQcC)Z^0b&wug;%~7s7aA8aOs^MOHZ08qWzN$Cp*K7Mdx5wQJ)%4%$B6%w6 zbmwR0ukN~@$+s`-u{L=@`i=p6bd1}1mVH&krLc(A!hP%LRRu6cY^>@c-Zf0$pJg_yJWh{!+nDqNCs%F0M|C z=BZ4DPvA*0eg)!!I}JY<#{fr6;0IO3`1A(Nylz2q)AuUC&xXPcI<0tuso)tgzBxPz zwh=B*Y@1Sz!VrCATsRf{&N(qY{P;NB`j@}HfFHsAa`F&4LV1DzPXkiH`ZjH}+8YUi z4#>;N-=8}0Q>bEmS_4dJs>?)z4raCB5&RA#l6!#bk^mJibk_r^7{52z!xD_VJ;E5L z(GYOjBM1BwJmhq(IQ@X@bU=;=*uyf-d~J4{>qsDHBHV)?wjhg_j1SueZUb%QKXV=Uv3@cB zQLu;YJT!85IoAPSbqJhSU=RCyVaLtGxDNQZJ8)pH!R>os`97`#K0y6X2Yyakj6VeI z;rOY1r%Yyw;P~k-g406;M?nOqCvpaYJuFY|!1-F-di4^)fipsk|MxiXligzceqax` zmyxT&xOpjoGyih>AZG%Yu5gqT@rR8UjI#tV@Xvk04_;efy)1W|7WP5Ci`yAHeTAIi zPs8Q7j*5`eavW75r^+=?Q!ox*H(;&B_;B@r<+(Ar`zXOOW2e6ejv8_vf@KPh#mseu zNrG{3y#^o$t_(1*scqZcRpZnh_Eb~*wCoH*&TJB=_D+DZU>scL!N{=#dpN(utKz}r zhHI$ccveS_KPU{Wzr&2JEzBJaq-F?F?5BSg&#V zTCW5hJbu7Z3!J~_H5@sDc@5*_Wr7^RyaXMb*9hd~fWpAKS9!&@Fjhw*M-Ma!ILVXT z)(1Rl-aey5a7>Z&_c1nF1ZNC#x_~lw29KT@T~`t;5AF*yN)$2 zU|8nOV|&R?<%c2lQ#EsTwA;7rr|y)8Rn`2N!Y)AFCr4iTK4$bmBmZkZD& zIdSWr3eJe}rNAEcmu;qQG1o~$jx5;2tzE2V3u84MoDt(s2Ma_W~^u!m#*(#%buXwAn)26F!1@4Jx$M>QO0*FGI+;kvvBIiNUb(=Z(b^yYc(MUDz_ z%9kX7i(YeQA9CQmC_Hmq{5+^vb0<>-2MjyVK7X&*e&qbU%m+ls>mYLezD8w>P@Y2~ zZUPCMkM-uGe ztb(r#jtSgvU5#X`S4P>ww#30jK3Sr-U43voarUoFXB|?`gF^*C|HMY_NxA z?vVVTUeLk!EvJ#Q9S9x3qq9NR&T;F0208TletdUK;c0=o<2YxLQx5mwXHdg>FqE3N zAqXu{ci28>1>)c~JTK(H`(Cb7f*d%CU|Y+V_DK?SaCu6R^Y`+UAxE&kN;&1ZAmqUE za2>GxfqDs+N6^9LK_%gj1t#1iO-A$)Y#;1YfHPwJ0I-K^#}BO}d9HH_Ike0RAI|N< zbuNqGfLlh8*IclN*MgwTs~X%mSCO-ZI8St}!4PQbQ(We2$QcCo@Jv4^!(UwIx{$N* z^JD|Aa|1ae;2!*#zgY?{iOut>M2<7q!!kdv+t@-I-b9Wu*u&JajVZp|I913Ag?sSx z^NFm`SjF|KMvgAn!#LZtMhxf1xrH1%u!sFMF;dQt>(n5Jw$FqUPp5L7+sJ`^(FXij zctk$oI(Lvm%QMe3cPrPqi=0_t56k11xJrfV+(Qm6&s;0{1zhJoazNvvbwgG?4lKsa z`{IEJ&O_vw!aewrNv+i3#(5;<+@3JCg)#qF1P3%37|%4Xmg77{4y}93eeq0$IL}3h z^Fk<2%XP06!FegHz21c zAIIsizaHGSf+ytO7+-fjAP1HOo`Kig27zk|sfr7j>E_SZ3^iO9*Jg zwLkzJ#cThjL0{0pW&VvES}%An@rzS0m_^h5Sm#S8b-51wy4b{e1_|^LJn+a zSg(DrI&~3raGAxBlM42r!+AsGCv6rS&$!I3kweQ2$Cwx&uGE6RFAx`U;P3IdP8%Ty zzRxe{;PSLZjv0s!XO*t?L!tWwT%LBwF(A%#|McLt0_DMR+9L-n%Ba82%t-_d-!xCL z(*ZfKZNLLwhRyF5uDKG(q5b|wA_Tm!YaT}uIoc$S=V!HPT&JT5PA3uaLciJJTZ6n{ zDeM$>7jX0HjN*VoAgA5+pcd`{;BOek_@jUWx9@Qe!Q$7vUed?`H#BIQd(-$d*O6fk zc)+XrWPFtC$co^|AtxBbfN}Q3Z9d42Baa*l;!IwoSjcs{ir{n;A+PSpfpY?G&gZJZ z1-5zn^bo;OKu!XP0Uq#l6rE0TYOj6ah&73ZI8ah+bsfv%!^z0^b^79FM^{cf-^t_XCQLuwK7ie7`VA;-d}@|V*>VY z{hcbdzgp12>)~MJ(DfN!D+h7bLv`fb2m3A{j>?S(U??@^h2v--M+uw<4|pFh7~81} z#KDdxas>0@Izy1tnZ&UXzbDUiw1k{1Z6)Nmj<%5F#PjXKb##QBudVh-a~)kF$51M& zJJ-<@a?(3a?IGyk>xDjYwu3!f6Q4wPAHZ!x1LP=?x<^z+4%O$hp&@bv+mP!FMUG$_ zavdWf2eu*CF&1)Q8*-gtLJn+0t}|T7fo;fj;3#eS+YH!-f(~v&_}67({9RxV>lWTa zKaAUkBauVfFrBaZVFafQM4mP>lcgyzG#Z1IhzmFW0YqU?^A~+!u3@(;J+Jo8j8u*>(c`h08n_IT={tg~b}! z3dX^XJ#xUCM`){24eZBt97J#&k@NTdazYM##{k|-9mv%NFC&_dXJ_Ql@hs)pXze6W zFI;yQAqS2zuH!1?biJ(kO3=Y|cSFt*P!>23myWvI!u*;i6bIf*xCxX8$C-~D_!<{H z_`}~(yNlo~5W(>f!SNKq@e;vVh#VzQC)lr!6CN%W>@Qq*ZxI|Hbd86NsF@kNL&OIRxUsF?L*g@iDgwBG#D-^j-7;@k%NBCM! zdS{3Y*I9uaxL(5T#?B&Rt`m+N*zeFY+Opb?>qH<&4V;G~LRYQx2(A-}9Bbk%&>oe{ zb)t|1?<3&$c=R+at`m(MFhJ2Jy)U;XUO@zZ*B^tNQ{ciK4XqvHL0$j}z1Or7IduHM z-)+SRj2}G4Vuc*|nGvqDO33jtOOfX~t3`0u2swND2Sjk=#0fbq=e1S@Ctd_+od`~X zkaKT;Nhr6>>ygt7v_5#iGd;byjO%Pb&ONY)_s~+YxdDO>o~Ij;L+|};JKh0rS~p*R zHX+9h#DHgpzcS6>I*CHg!ad6ATxT+u(Malx%k^#s65!&haA{8aI5rwbDA3`6FC#W zdGLTYIP<6l*U3T-e7^xYN%6N^7-RcIh;u-MI0unq2J(R;D=OgCcy4*Jk+X%A=VMw) z4%az^982P?^u9WP>*OHk9&q6O#1g*~;Qe`kg#PX;7dhPlh1kOOYiP)WCr)$|v1aK9fx4!k#p z+t_8Bz%Qkn<|%fLB4-fT!|`k^A=AP=Kp}GAdAL1znIg-La|}6jj6M5u7`%PnJg?)( zaUglE_w5L7&6*rs_Y=tJ2l4?Ac$-tDo*x&eJ1+A{E64y~6(#?^V1oO)FuM|jKwB(!E$BL`kFVV}*L6}y9**Dd7Gyx_fGwLo6DJT*cN z9IJv39*4J)1OEa6w&8~8BSPyccJ3gDt_dxFHv;U1roSc5&$s~ky{QdxdEgyp)9=LL z=O*q7lo{uBA2|V}JW+dptrm=fod?LF*OdFVi&~gF50L}!TH!YBl{L7{X(|tn^GJj^ zkCCHJ;sh#7z30Yxg5!V&QUiINJvak&8%!WL=AR;m_7|-C6M?$p_IW1czhqA_i zB^K5TZr#B-yeSdZmqWCLh$HxB7{LIDIDU+A#feX8;s*0;OFe`vrvGz z`MECfp$ZQ=&W@g*-p&+30vuQRoQE9vY(0tmg-=Te@3!$q3B0bu?JJ)Wcm={6C2-CN zlMb}$c+?rdA>%p3okK!6B#{t*7WoJv2N;2OU~v1$r@6l;T zaHmO}g)G%%LLM>VEfl9)i*eQx$A_glOvpY)ZV}?mNNchvK4wIN5ZHt6{N63*HABF` zl@8*NtsHWSL!NMmIK3HX*ZZLY^>ENC<9cZO{^Yl2g;6nmFEkn)?TVRJi43 z$jhlcEV2$EU0AA_gbZXPkr0?Wj+4nD#e`g9sYb%(4Q$K!G}TN(Y+0PWgh(+*5xyx5 zwm9a@BP4`R;}jDT%7{FCSqruRK6ShZiDYCOARw|l@TG!8L=m%j*)OeaAY|9`8bTgK10C4BPyFij&sO) z4yojjhaB>gLwZWlqR{>_B4j_S#Y{q?_|!=!w^&W}>DvQKR!_NDv@+Jf9@w6RX!lLUNe%laM8h^y!InuVrL3A-E0Cv{(yQ;`p$< z5(z11I2AtAW#RV~(i3vmots(OJ` zxZlP5puk{9M?wz{(c};_4w=m%z8tcRL-IJ}Jcm?s$a@ZHuiU&Ay*WgiL&kE5J%@yF z$Tkis;E-n=(yDLs5)R;y5gam^L!3CopF>u2$Q}+U;*g#y%}cn8Lq@7nhey_pSwh6# zEx_H&RbLldbVT_RCzeOaK0?m(DUt7o)7)SV{G>46;L88I#Sy-SIICEy5<=|wG;-_y zILa~Rj3p$GIjab%WX=Ub@ce2c-qLG_c4|2CRF-NMA*&hLPskcZY6+Rfa#tIG;{-CY zfRL+<93J%eW2`OU4hmezuY#`(qBe{eeXQY~tql|nZ(Abkrjk&W2tfo zDP-g=As1OHZG9YPD|6-&0?XVAovh)IFC5a(0LN)cWy>Ma9CDFEesjn;Lmb(GPs_8J zkoByD)r2H4qA(PvYGh;tAs-oWBV-06JB)CubVkk)@{;BLl90EINEzc)PZ*g&$Qed< z5ptQ4_k=_jf^-BM}c`08F@m;3P$>xVCM~s z>_*6aMh*~C&4}~}oT`$MSVERE@`Vr!Mi!3bq0Ntx2ZSWE@+=*Nod`yX3E99%2UF}c zFk(l@FGe;H@`aHLgnVMebTp3hlaVEad}d@nA$J(5Bm~cHpB88L4*{nY%0z7p&MSyd z$MYIOCNR=S$ZbY$nc-ABSni$1VzQkPGeVl?U>G3=%*i5TCnH_Vahya(%m^6;h!{F) zIu1KSnRA_xc8vTYWEdlB$KzC67^xs6jgh_+u(Owu1%!k!l1oSdBOeG+W5nG8#~BF- zF0-2@CTAJhMo1Ty>LVd?jLe#dQ^_)NoRCr$=RF~s%$a9}Q?=*QJ{6yYi7g}Pg!E!$ zz+~*qXJk7eDva=~u_MEXJ0Vdl_bftsGUp>9Js24^1;@G0QmrHekKWBKj@~Q8iDapG zQ*j&x7TJ)H?u-Nwa*d_RBn0OLe{00YVFdOMiPM(F>28BhUuAK|6N2NUwiqXfI3rl9 z{nK!qj*PUi#YB=32STJ7SxZP~MxGNQ#fZst97l$c1%z~B_Or0Fi#huV*~*C3Z0u}fq@Iv8MmE@CC!G=fIhdp{a*L21j4Yjtom55? z?J=3m$azBMGBVu(J2k8p*@WO8Jl0|lwspj*Iva4JPcHW0Fa z5iw`%^kc+<5IIK95i*43ZsLMdbpQ@t!@m(Sosj}p?DS@2mK!GSjJzR4l@YIb*pX%A zBOyvGca{0r>BC4BA&QK&amUUCMy3)nf<@jyND^~$2(e<$Q$jW}BE0}d-p9yDLJ}F- zMaU*bBt3AdgN*nSa+~FzNC+MY)h&*MLgGlURGmC=L<48+c0Mn)1M$)|l$ zK*&r+1~0~`lo(k>hzBFz2 zEOH4Uvltn+3_E=oNhZXTkq*JwQDbBtAzc|MC!{yaU4A)Eb%_y2LM}6Mj*vMlj&ul4 zwSf^!LJAm3C8QlAuLxcX0kl98AUXC#XdGe-DP*cr!2DIpe&^o_=j6(f0s*f1g&gPoa- z%vp&^C?k1<9A`v47CYw{nLtPxBk_cMV5FXquZ-xe!f{&jXOigBqKKnnZ$_P8XnrL8M#P^Gb4&|*qO(ODsTuB6ioUur-YEPjP%@&o$-u3Cd85vlO5QZ#K;vwrZF;PCw68r zvLqFg#f+RJNM!a`pr-qRyggj%!cn@}7GvZ4~0wenfSGhlvRz4+)vfh;Jr#W;0Tlg~>@qI_$^fHzSh?(d5%s-A0HZBT5HwDpN+h37N`> z%0cX$U}Od%b&RYfM3v<}DI2F6$Veq2c8v7Q!Hx$bn+W;N$ZbM+EH9;8oN5Roo`ei# zq@Iw`jEp#pQ`s=`kq}o##^+(@IU}irc(U^J$j8npMmz}7VyTW0V#J7X0ZuiBkyV5g zu{d`K;WMYt5u8e!5idfF8F^2L86zW);#9GWEGA?Q%d4mmJ37pfIEKkEM&bz>%gB8~ ztXUlI<2cn^Mvk1oM3ND} z9T#U$NA|B&p=0kUh#>KD^>X$hcgwgufOvW1e@+X66UW~*0Oy1W_zQMV*M)*)v9o_O zqGD;KPmQm9_&Fv);tx(CqNPowXOs-3sbB`!F(Bv>Bf5lmQ=(1dJf?)@4vUWBu*ea# zJSeafIDeNCL+}J`jOf6pO5kT9b!g^IghloRo^Y9;P{QJPbK)?fg(Q%o3w3m8y)H2V zPNQ#RTSf^h4duHRtSP)zfJ+{3LmH=vKt}<@2%~ZIX%8}j>h1?T*p4U;t2-lX z`~=gySlwSU0^1pG@I@(#Lw^;?TS^I=1urRKk(X1#BG)lO`}8m^p_T!thGZ-7Z6nMv zATy(h(5CmI4$J)^C0aE5FiNy(pT42QfVS!dnmbLzdq5o>nwLGtxknvcQb68rO4!;G z!y)hm9%@6D*K-cZ~k{O|aZh`#pn1>DY3H$_7!bUhF+O%SesKZA1 z3rf&fg)2Zf%ZrW#Mrh`|!z>k@O|K}?fvo{^e$OHGl(4!7F+xkYgc3GZYbillDT8M| zw1hNK6Vaz*wTwD!{M@H;(Aol?@TM?AdoY|59a#56;Ab(7qf6I$M$n3F0?rSj4*i3r zCW2P+j~z{=10%y0!vs9wJwAiKt#1w=zA6EC z7iet2Gc1)BOr-9H*E^;%Mo>3W2RD6^!Eve)4E}hQh%y z3OvIEJmCeBI0bwXXDA8Nl#0!iO5o%9MO$ntC2T~kri5La)=`;6H3U>_JBWI^iNMUj#)uv*vpb-;--iIl0i-$(elS6U1DqEiz=5;v zD0Aql-bCmk1>Yb*aaalOQld+9FQ){pHuJ$Ve;OHnu^-wPLEY5_uwd%YFinK5THAn! za@QkO=M_@I9Qei%a@f@q)*qLdj*a!yF@RlY-T}|LHh}VY=fHUG1dj80WIP)fl0^#6 zOdJOe4)~wA(whh=5F$Os*E6DiTBqh$ppsLbBr*&A9Ow(>U-m?{AL zz&jO`moA-yjA+5-co#TdO&u+IfoDW}DCn=H;Cv-@bcTR_hg%bY&*12V9?lCAxG|yy zFJQ&syajc%^vR5GB11rVdV}+R%o#!|&j?+fdC4F;ZbMqH2uA1#-$02LEOSo~wV{cS z+?xoj7QDy&MICLp_{K2;FmEX75m01`54KV!1>&Y~gF1>^>f<_(8Yc6$YgYjwr zMRCwHg>OWHn+HNr#|skldIz?#B8{U9Z&)X^#s9+-mxp#n9~y`C*91mr_Kax3`#RX_ zugzgQ|5UG>sT)n_a(Uy=$rLV5jWsbIaZ)lq!j&LXJ>g@K+vU ze8GAxWOoO*e)yzEFSpa)k0~$EjBU%d6i7m_N97Lq{mD_Ck5tIt6}hN;Q?FLXJ>g@H>Zu z$3_I3U!f!wa)k1d5X$RG(1w9csg96T$Pvm5zPpX*GI+q-cedyd{&qN6pSL6xa)k2g zD3sTJX{DN`RH_$YT5vZ59ihBBp;Ya`IhfaRr2#{mQq3l*kRy~z3Z-fbQhu~7Z zfu>X&Nh;(BrRt1Q!5)TN!ugO*O{s2>RLBuZ)di($hZFGLE#m9HG3r3e^j?p*L$o@d}tf_(oCa2<6pHC@1SRR4#z^8l}+XxnfQ?23YgA|gsqM8!}61q=3q0#>k56a)nef)x}{|9PKzXJ#MHNkskry{<1`%(?G< zX5O8ho!xU1z))6oZ%Mz3UOn@xV2xD^OiKNc`MJe|a%JZ!$G|dQu$?q_>11og3^O9z z{uB(gu!hePLR$EaZ{a-60z)l4)?3oT`6GV&C|IYzW3#|eR!vxL^nTFnjl(YSS&P&H zLs`dB*1`sr9t+kdYJs7wTCk3^O-Y%2Si8-A{fOG378uGpp0dttKX+`fy1i?628Oau zpnf&D{Ms`Q^ZlBm78uH^O*^{rZ9DC-o;y77+U7lPGAZn(_` zhO$mAqhAZu0z+A+QP%Iz+_)-a9lp|LfuXGWu-urJv2nQ{8-;3tp{&y>tIG8BVZnM| zEijao2Fs6)yIzl2r+sK!2!^s6P}XnTN8cW@CaVR8vKqqjW212B%3yt`78uHs_mjd} zbi~gKX9cU%N4AAvD628`tNqA%4+d+#T3{$ko{@#D@l`568mt38wpm~(t4SIC8ln~$ z$~u#>UMjx0U&vab78uHE3d_yCS7lXvzSxhAI-l4Uf}yNtlvQ!s&WnO|wOU{(>nzHW z`S5C=wLvW~lyx>`$$S{BYM<9t?kwZKqTbIOuyO0cG>1%|R(z>+&q z**ZS)#{7Q%nzBMIFqD-}Syij`yF6GYud@3BLs=QrFR9_-zF(KC1%|R(Qr7H0mK+mAB;ek|9_3d&c)`f?8lGtF^b}>X5(w)zn~ptri%{Y6GjP1evY-pEq^A z!uPAAJP0=%7|Lo(SxZlxJ26-b)B;0U?O;X6e2LGhyw+xcp{(|l_5E!nTZ2`s78uIv zKv}X{zSP(7BelR#R!7Q`)pD>>KC>+ZLs^}?C4{WmzVli2)B;0UoxLT;OP&J+tCw0} zD60$gOXiJBeAXpufuXFfl=aK<{ay9(MXEjm_3}v0`Emy-}WvT^+vU(=;Yn;!zK`k(p)r+#EU%^_e78uIv?Jd`@ zEk0|rT3{%vkGEXEf>l{Q-eop0l+~B|C1c}Be}0{#78uIvM_C`V{QkmVU9A=v%IXg* z)wIKWlXA|pore$e{aUUT7|J@2vIbX3dpTIm*P9)g4Gd+S4=ef{AXp35LrMWd)&;QS zop@$PX}v;T42Z;K$gq^BYZUu-(a)AP&Ed6OOEn6 zpGCz$$lkkz0b-~3k+pl78uIP@s{jY z#zxHd>qWJ|P}VSSNezphKc!``cB=)3vW6%0>oec4W?$KUfuXEi%1XJc#++acQVR@a zjesS0Qs$eK`;Y#j^<1BIomyZhE03}!KY9O%U_GQ37|P0rwXeyM=Z9TKHM}EO%hduy zRsk%jpKJ^3&wnylTh#(X*2S=*V`HN4SEWsMUtp+Th19Qw@!v-UtC3n@D61$T>sp`H zTP-k@Rh*C&tWj!#p=Vzuu%v!&>xyw0ef9;0tdR*;yHd0z+A2Im^7e6s&_c+X{i9tV<|M=8Z3X*2!vtp{z?e z%k(Q)=c)yUvc|zmHBB+!q+E2>!?Wza$u4ahtri%{x{R{!%wNASSTCprhO#b)6}_4V ztK8R;XnrR`7_zQ_m1bTObJh6$`Uk6nT42Z;59?srrP*f3cW(;Tt!jZG>q=PetlYJ9 z__M)Us}>ll##OKmF*z~|$P?*crF|p$DJftm>uSo9qde6g<*U>JLs{2Q)+ycReHyH} zYJs7w2?<%#{ngt4 zRxL1;H3ODB(-Z6ZURMtZ)+K6zp{%

z8%6+#jqb)dE9VGhw;om9gTg^1=E}EijZd zi?ULWX!dNdYHzdE07F^#_$*l!EiCHX;tpTK3)BKbS@%*_%bgu>4%Q^Kz);p~Sn^Cy zvL5`hXO%mB)*`jQP}Y5vHLlk?*97YawZKr;9G@k}>-gB+PX+7bAIy);28Ockr>vu| zIdNgIveg1ZS#x2z<2CKsJI@K$EVaN;);!93eD;C$f+hdPt88E>>j7`c>vAXcslP5C z^`rbOB?Sy+&G(j6W74Kc`vj}GT3{&aL0B^8%{M6>>U5kl(r0C>1%|R7qOAJWuYWpN zv(*AaSr5ZHP_yJS6~S7k78tS~fwjM}WJKjZ{`{I?9ru&@k=ekIwZL2QdX3`E^Me&v z3k+G0`hJNel`rwtxL++WRE@{HC6$+F4#E0ZEijbzxVK!^W}mg+&+@aB6fl(agtsJ1 zp4q&3PUNfH@`@@y~tjtsk3}rp#EykZ11eg$iwT3{$^iMM3G^1j{}pEXr2FqHMC zx8!)WTyU@X!)Me{7^F%sWb#};}%=%9l%39_v zd0n!;_E|mD0z+BLy(L*Piw0|~T3{&aZCGy1U;NEUa|`?|dY@WgDC-@{I>p?>25YTa zU?}TdSTc*s*5;TC#=qsWj{MF36bxm(M_E6vANqB$CaML7vfihD$#a0ueGPwC3k+p_ zKw0vXI9T<6w=D!iSu3bt^Tv1ozNgO`q!t*;T1i>?%bK(g)&pvRp{x%R`gNtx`d%$C zl=Ts1$$M?VI%cQs7Z}R=7}k;IW%EtSqvcE5j`GK=gIZuH>l4bF_wn|RgEdwyFqHKv zEO&K~byTn(QVR@Ot6;fx)ViWiGlI2FEih!QhUL!r_xsP-H(1qn*=m3xYYi;93ozfL zZ2aJn)~EPtbX5xsRbwqIcXim+DXmGcCaDF6vOa?qtwyk3R|^bTpTmk)BUtL%G_lNBl7_v6PidG|7t<(ZT)|ar{*w`|4;pAXVQVR@OU%_%?UW*t{U&0`NR3as`{tx7Z}Rg3@ciVV8zt}L)O=@jxalwtHVL%x5k3CP%SWIeFIBY zU$XuD+zYLOb?{&Ir(nqX7FI3uviT-u-PZP5<$X0SPzwxI<2zWc8gsWyeK}ZD)dE9V zTVO@25vV9izw3}yZ3Eyu&p7YTU1%VMXtWCi$#sYJs7wUnooNiGuZ>T41POzru1yS?(Qzb;v%pg<#0q4l8=^ z5Ueh0fgx)LEUAQS$9?_B!NIyoEih#L2CJ4a%r_~;2d+Kh4L{~rs0D_q@jEOx=FfY2 z`zgU{FMsmHY+xvBCoESDxmE^iv07lr+U2vPh23}5%nMe-3N{N2S-W8!jFy<+SbeI} zwZVE+Eih#L0n4o%EAS@QR5 z?C(j*evj?_RnuVIs}>lt_9v^?nFIO;YqMHl$T|R)n|qtqYA`=o4GysV0z=k;uw3Ow z&d%r`tTAeVp~@cw%T>Nw?FKo)dQUAdlyxwygG?pNfJ~V%aL2e{r5c86ag5@It*4V6Cqn` z4z?`>L)Hsw$ESYV@`eDUogM;;mT42aJ3YN@=vURz1oB6|| zZjHH1Eihyq?OQ0;5tZjw4OaU@Y`?%z<*UGQm7lt;%K^c5EvyF1t$U|TXutd^KeO%BEHKo<>eRwFmu9pMR=Y!O8^BQ3F|eXzBUsba0z*~} zSQSlwWc0SbwDQDYty2pOS;xY1V`EmOpGE|$QAOKAFl5yvtJ&v`j|$f1YJnl^I9M`o z$adf5{k{m+duo9ptCr6atI?{9dj#uP`LmN|14ETR9#(X01Z%8XU}$Wd04q8+7A4FZ zV5o()VMW&fANn!>v1Wmx7N$}Q`_IcB7%cN)fAk9sWz~TdT>}IwOD!;Dod_$s1_;)} zYJnl^Bv|GPwic=9Hx1S77gjCf$T-}wZN&qAidB z2WzHUU?{5|ELRO#9|miOT42aJ1y&`~4)aaQ3r~IUMX-8Rwk-rh)~T@E(}NSs|1~*S z3)KQc)@fwPCxU`i=?I$zhN@8?maE3ZQALA-HC8P!lyy2~$&RU?{7Z@0a-|<+*E*&j{8JYJs7wvnZ?PSIuq=R;wzugLs{ogmOPOT)>mqQp{(YxYMC7KP0AVN=XVU&8C7iy!BAEU%4+fc z^hnl3wZKqTIxHC*l9hVx^^-%^Dz(5+Rt9BV@zu?(gLO(Z+d?pu)zW8~s1$k9{;@y5 z#;FB{vRYA=yh9hPC2E18tk$sH%qH{3jXtYlb=yKPl+}i^DlV>AK3LgmfuXFnuw)%2 z+p;+gMttDM##sM#OOL;BXt0JJYg-70vbuUpvJM<}@W>55Yn@tPD65;d%r_~wZoT%NVD+zQ zv%pYRcUbOtZA|Tx7p(Wy0z+9nD63MNn_mi6r{ioE7|J>qmOEZ!Dy*v(tk=~7Ls>m3 z>-&PmTY}Z1mdye~S-oJnG5=Ea*G{|G*YFv&z))6i%KGrgR~iMY^6@qc3}yB4mK-m6 z2K$LWmxrqbhO+v4%Y2hEalpiK!CImg7|QDBEtmC?&#HBTZ6O%S>hCSdl20H9>vFZg zP}X^{UCeG`LFnDJgOELszwZ!TUCyF zWZaBk)u>~$z);pjuv|4{jUB9O)dE9SCah>Rg0({}Fk}t#mXxExxQioMxhL8df*~sl zmb-q*8argIQ40)JBO8{h#s|Zzr3b6uNj3`%WyN91IFwDU%Q?RCE7Sr*S%WF-v2IJB z57xnTZ59~H8Uo8bbC^8!nT3n}ywO@MFqAcvvJQJ_#>ik5s0D_ya$rS|a|FR`e(bYq(lqC@T+^ zT#2MLx3t@p`i!sqT(!VZRz77tRWf{^V7;dn7|JT3e#z=4p-h8 ztSa?v4Z%=Wp|_;+a&=hivzn*{hO&yhWxh$NxNXzx!MZ>#FqBmcD|)6Z_gR;#1%|Rp zC~MgApSA_-NwvUG)<{@xY{>5~7y0A0Ni8sxHHxxi1skl!r`Q^Tp{&uAC7&_7)Mt%X z3k+qAp)C136~TI6EijZdma=4Q%wn0z)ml(p%=6l#RWHbPU!awZKr; zRj_>JhhEY?SUc4MLs?f-)~v7286K>R`nDQiDC-(nuJVUHoAyJnCa495vL;a0XT<|D zgY~vrV5ssFVVN)3#x1XPi?yPa2SY8q7M44gWz65@D_{9^+b=NG!b#LZ8S}wvrxqB> zx(=4FyczSs8lx5%%DSGiWXuO^fm&cFYcecXc^UJ;+Nc&7%9=u1GUkI-HO*E73|0OH zSkWTr>t*}7^L7;52EZ<%lKJK({ZqZSy-ng%O+lyCA!d8b-n zDC;K5sy1rXf?&03V5Ofd*rz?Sc^a~!)c`{+yakr~&DIm{KL5u4zJ-%C z3keG&sf&XTG6oq zhOC*e>^`kJG+{)6p?=MRm1YDvGYhNs$h*&vsC}B-y@8>A-2=<5U|X#}IAWcq78uI9 z7nWPk%ROw!>ZcYMvS!1IuIGbwwOU}vx(}8+m$x3%V^*-9RtpT(aE{NC3Z9s~@8Q;p zRvrvx-4Cm=)^Ox`&tLkDpQFCiEHG5Vxv*Rf-`{=SuwWh0!d4y(WzB=-YAAQU!D^`% z7_uIK z)-$l=iYG06=&e^)1Z${TV90vbTSiJbAZz4B!FpXSFjT|mV99(a+mvfN6k97=Lok%J z7?yi(vmy4xKJWS(R&QxHA*coRKu5HRZy!#Y|#nUiq;SeWxWE+jb6D6nBZ&p zu4aLu8omn4)llvNf^||`+b=Mb^%|_`T|lrdR|^bfy-rzOI~?+IuvV!BhO*v(CFipF zCPnT7g4L*aP|U%K89S^o}D~6V(Dk)(Ti>nvpBxqwBzzYXs|A zwZM?I5|$X!hi*eV92=}3)dEA-hp^n|*)~pmc6+dn?`W$5hOCcZwKh4jZ5jVj$6)nQ z3k+Ew`xc5N?;r$gqFP|6@}IzRv(3)b7dHp%O|`&K)~B#!9Lky5t??}f1Z%%ewqIZ< zYZYaU8Jd4~usWy(hO$<}a-Y;4xVU}mU`h1p3Wb;&05hj1q@lA!?ODnFD2z>oGDQY47G3_wNS1p zcl-OV3$%q`sPgN53(Yqva!m==bhW@x))%nc%qCA$gY}_WU?^(?WyzDJU{&s7`wND$ zHo|fW$Qwt1beM4DY&$#~iU^VDwv%pZ+x3HqC zuV6i=78tU=gC*-jSrtub+CV946yvy7DT?Hd{Mg7v9dV95F&mW)F=X7c+f z<9#)6RE@2$+{`xYi~S}C>tVIPP}VkBa@CXl%HKZ>*3W8zA?pWN<_k9Y`-j15 zey(jH7_xr!Efh_jRetZUl@rwhL;d>6TaqXLdP1;Ps0D_ye)g8j`rK#L=xJLBhO&O~ zmSo9i4}vvZEijbzD=hcUe*fc#H2uV9J*yTN%Gyp@uWl%~HdrV2vMmHdSvz1wM{lrh zQVR@Ozrk|%U*m6lV0Ey{^|o1H$od_Y`|YZMx7;^BSR>T}L$l3JSnl3o($d?OS}Qu+ zfT65iu-pvr(Y=%Q|IpX)E6oB!HQWu$jrlDTHs2Mj>^`<%U?}SkSkW2=YlB)~$odnO zyZ>68l|LX@S$%C57_$EImW;!yqt-48*0*Ybp&H60Q@)&=v8PnuZ??6fH3UOhuWf?pKT!+s^LDcTn*)2&R}g&3k+qI_m=dl&58G1-q~mM?{BlfP*w$RnX;tR z`DOl^V129>7|Plgmb)%rI56X{VD&oBW`Uus{V1#UiCb3&YlT{1C~JRMwM^@zg<18> z9TBW^&$n4%DC+>qn)>~>ZwBjqwZKr;fz+=l6K0yFiM#*keu2#bLsy{#4)$~qL5TiYzH`RAZubsk`| zz))62%DUpxlllc~nOa~d>o8buZ2VC1=EcG4IM8N+p{&CxYsm={t_s#$YJs7wO1@vF zg!l^~h5mT8kJ&6RlvSCs9;w^zy>nQDQdth%t=^9}h;sySx1@#( z$~8MQSdE9;7J{L<_cU1M3$|Kk)f{fE=-dm2topF*KCQVAt`1QP47KodSgA&k^Xs@z`cf@0WHp23YIxQ7#*2b=#&Fv&Fl3$O zEg6MJ?r8r=uqLYohDPt%u-xeV?a9xES}Qtw!H{(hS(3LKqc>`Sp%yl$7RoB+S3l-I z(-wlE%C~^!DlgABf;BMLwj2y)r6*+l;j=zh3k+ptP*$}8r@a%b8Y65L7|LpykhR@s zou?KU%4$VfzbtGsF<7^%1%|R(drPV=&r;U-toPLdLs@OSC3gYxJ0rnL$+P_eLs@O9 zUvghL#;fkMRUm2`1YJs7w zj#vdFqG99RxQ&fcV8K-m1=>ZtS*!#_m#nFf3eL1 zLs?y^Uvgg=ti@`9p{#C{CHIxVI=#?lfuXGKu%h>s!MaZ^FqGAUvgE!pSXGK_78uGp z7gqGXGFaEE1%|SEQkL9T2J0`iz))5%SZ-{{ePytUifs$QP*!islKaYFZB`2mW%cn{ zGUor>bWzr7Kjtqeu~}d!t1o5EKjO=agVkoFwZKqTKUi{2kxk~_S$^I)b(FQhP*#7+ zlJ`@BHB2oqly#o(myCINKP6c6)B;0U=TnxvpAxK1YJs7w3t+jiA@8RItIlZKFEEsK zA!W(?DZ$EC3k+TL2EcOn=JM%uYelbmV5o%yVMQxH(^vjJ%>qL$j8O}v^1<4m78uI9 z2$mbYQu$!j8e^*ghO#m#ODZ3%i_`)`S%Y9jD<7%1%|3I&bQEwjbIf`v{_(iY+MG*eDPz$TG6oqhFW+zwNUOI?(oN}+O;+d z47KnIYT;WoUY-`Lm|9>cYdkD>)m!jd+e*QjqZSy-x{|W~dNrqQu)b3Z3}szKSsiDO z*&3{dlWf1hP}bFy^;zfgO@cK>EijaI4J>zsJ)&-l-NAZUEijZdfwGoQ-L+4!_P@@y z5DaBaq^#8Kx7Q6;H?_b}*0q#%<3%UF6Rca+0z)He5-d4OWJ@pZ*}_`U5e0@?c%5&d znDVb(Jm5#vTFnAOExevu_;BtyDL8o znOb1Tx&fAqUg_6}DT{|)=KFQbWZOb8)UO+{Z62)QYJs7wsj#9mTd#P9*=m6y>to!=?-@6IcO=^K5>vmXfYLdwzqEp*9GwrrPzz_nirzb9__47}v%pXb@1qvVy+g3xyT!Hv3}wxM6`c=*wenVL zfg$UDSZ>VAy+g28-)1c^RE@c?%ol8O?_jNHHNa5TJXr4C+xcfc+u}7}jW2GuSzxFd z55RKAEAxW4PYTv?)2#)DvgX5zo+-h)P%SWIJqXLa$1&^YBdY~#hFW0AdI**~Qx>I+ z*cq%1YJnl^Vc##AMPqF*y)9U^?y&s=L)Ig(+>BlR&uQg@HApQmWG#T@u3v4dz0y5c zv(*Aam4DQ?P{xP+E8D^PK`k(p^%yMoe#*N$?>Zw`&F{4R0z=m0uv`u0J;Y#5Q40)N zPr#C^o@^Cgz4OChZBz>kjov3=nJ?HLpWeO1TG7!9hODPx+4fs=Nx}>OhFZ7~mQ-H0 z@lPCm>QR2oH@eI24GdL&5iB?6r%vnfaIo%G3k+pF?X%=~U4KUXO~I--!)Ae@tY;|e z%As8k3f4Haz);q+u-v-$(o6O~Dp*_80z+BPQP#VQ*5?H4g1c=C!BEy>-!G}*ne`r6 zex$GAGPS@^*7KAl|29Fe8qKs>U?}SapCvVHaq5B9f_0Z#U?}TF%KGf-AJ+wI-&r;b z3}w9p%hm9yYHMl*D_<=zl=U)Y-MG(^++eLz3k+qw0xLTAzUgb&`X1XtFqHKwWy#zd ztnq4rp{&xJ8tmxbutO~Pj3&Bw3m--gExi?rn)dE9V%V0(4-eApA3k+Gy zVYwR0+#9TIYJnl^ZCKH{H&|`&v;6`?v*BmPQluw78uI<09N!qC0I@7*p`DKYXz+6eM+z< zsRf3tm9S)7$o6ILK{bN4K`k&;!w+G(8n*wiLT775D-VXUK7u7w4Ovev?Kqxai|J9_W$ ztMRs4U?}S|%9`}{xXfT3I?q-E3}t-|D>`EbtE*aI$XW->jYIjjKY}$?Eih!QhvjA) z`L{oUwMs28WPL%_#$TJg6RheF*nWW_YXdAdNBwf_u@iz7Qwt1P8-11x4!N%k)@-%F zQ02db<;HyW`3Kw>te@2aL*wu(ShoFkEFOTP936*XsD+zgMbDJ?{Wxqr-|h_zwQw`F z@YbofR0!53YJs7wuVKlj2xPy@pB!0`?z5gy3k+p_Ls_%u*Iym1?;o@+1VdTh`Yah$ zKgAml4Aw~xTMGn6Q8se7|Qy|_e-+m-vJL+|EH`4hO&O9tdB>(Ju_G*FSHgI z%K8PC`!vhDyLKHHtet9sp{!piEA5V3o(R_RMK%izWo`FavOet5p!&A<{&>xJ+FD>J zYX@bOJ8SUK!MflXYk{Gx-(b0wgZx#TU{!n8T42cf9hS`4(!y$Q&AK&MtJMNS)=pTm zK9p_x1I>O2*1gZ!EHGs4f|Y6v$=cdt?!!&|m1xjnYk{F^?1ts$L;35t!CI#l7|Qws zR|>ivQhd%a(UUoD)*YTz);qK30X6I)`Mz+p{#=v zvVzt7b(;l-vJOtjn(edxPzwxY9YR_C4*9KaupW5BW`UusLld&@^I1KYSPKkgRZPeV z)*ottp{&DT)z#6vpeQ5jZl5*pO`8RVvJR)Lv)4|(DOl&eWi2q2RS8yf^ag9ET42bk z49mT1_SX*=Jrbidwn%B-?dp_s2bH_xoXt9_nN1IRq;J*fuXEpV7bayTmDg{9zN?i zwZKqT4a(}Wy>|Uz4SnBcfuXEpVMQw+tfM}#78tT>!m4iSXD&%8T~aYH<0rXCCCU zCaDF6vQDO~@1Gw(C0Hxf0z-GB^oLK4Pc1N%)dp6y8o@exqirD=vf9FGZCWUKgO3^dK(H=S3k+H9U`Y*SduPE3w+8Dm zwZM?o9+tc6$)}xzwNouHRE-X>Ts7p*H(2L>Y5N6+vO1QLHBT)tl+}r{9R-=10^lwZKqT zH_EEH&j(ou+CKr3|Z&Ga(~(N_rdkD zf^~~pV94s}`z7PBWXRS1Zu8anKrJv-jb7f8m7cuE5v=B$ZNI=!R&Q^)tXqB718RYx ztUlgyS;4CMwao%US$)0bvKIKPiE4qNtbX2dS;5+_78uIv?=8ua-!@(CM{o8wwuN9Q z>pX8s)-PW?oDr-W)dE9V=fiR{fUHFi_F2!W1%|RNpsaH~nf^quj{erR5DZ<-FN9@Z zwQJFesA2SK4u)DdfLbVP(Gz^-3pEQ2wQwM{P}ZWs`cy42log{aS<nSG8bn#L77f;TwZKqT7Od!6G+0~J0z+BZlqGA? zU|sONZ6O%Sio=SoMT7O0T3{$^FlEVFG+1YBwOL>&YY1h@S~OU*)dE9VLn%wvqQN?B zo6Q14qc;aubS-MF=;#GQEgS|by83G4&#y~03k-2P?Yz3f3!Xfgvm3_sh*}t$j5r|7cqXhN@BEEt%QmU9(`# zQwt1bUF<3k+pl zN?G!6jtA?d-)t5b${GjDy?gt}bLG|tYufMD0z+AsQP!PRPU;@4_)cqqp{&bcxq1Gt zL%%2vRP}YdChu;>gLw8#X3}uan<>vX3e-vyF))#7lp{y$@Yu<*|?*(h& zA2tgNWnD#C!|zUA6Rb&pS_=$iT}@eceEC^Hum=2PEijaI4J>zEzG>o?+k@2rYy6ZH zFqAccvc5Qd&CkKwSO2yo7|NRHEjQ+?`Ej^PEijaIt+(9y6|9T)u~#TClr_m)E~|mh z+N2g3%DT>5E-P5$%iAn4lyyC<=p1#1&pM`pwZKr;WXh5`Dp-@%0z+9-yyg0Jtk2r5 z78uI9!CTU=nU^gZ8mz1KwJiigSvPviWmWZA2kvJrFqAdbTdsz|nxqyO%9;i%TEhuG z>wx`j78uI9iL&Hx&IGHqT3{&aW>{`Ml+Wp%>a)hF1%|S2p{z-pChZffXVd~i>!@2{ z*|RSt<>RG`*BnyL{D_`NgP|7Q=CfSokA@}x^^<0Sp%&imEvfwC&vz6DYv2L4hG3|L z)2W47%@5mYt>{V*47KnMpXFLu-PdrbW`Us=-svqjHiA|CK-)qvly#T4T-Gr@YnWPK zC~JndTvo7NRSOJd-R&)xRl{dhJIJ;W3}wyqmSoBK6|CFU0z;Lb1uHr>4ow&vV5o)n z_$=4LDt>Gnd9ZCE7;53Y-g09jSXZb8hFUnAS}0?~TG6oqhFW-^&vGrS>1+6%W`Us= z&heJ3VX#^pV*3RqrT(CzBH6QS_rr4YhW(jkQ&Og?CCol4^$W8zi!&`T7nZx~*`K** zKg*0I`xAz(d9d7X`Tc(O{vX??VB&wFS;DaOKp9yF9BQ+KVQYRF)^TbH!`6eaj^mM}JTiT*@P-p?c0kNeFIdEGhYsfk*`u(iNjGFpCm>aCN5wM#8wxTlZ8I^7u3 z)9N>z|3s86&cS@!b(1#e>9eiXJOcS3YOeK%l78YBl?D{{SUL%5Qba05LWWzRa-4#*jfZj z*6Om~Su@Yx60(}9C5*8mBlBrkwT&S){Q86Mz719nwS?iUXJ92iUO8$BW2{IGpM~XC z1^2{eObA(X)e?rS=U^qT{M*Ko$_vBR;xeqS)DniR=gY9lA8xaRF;=98FTkp+HN0q9 zzm-DRt){VL6UJDPv-?F@$!mCyTEcJ(UxJmq8dqrxg<vdSJ z@>j%Dng**uC7UV?XT4EIR(G|8F;-;sE`enNQskWvySXdcZN`#uC=6R~!g4dfw<)*G z4lR5^vxH&mEm-cI*{t20BXiWJY6-*EQdqT2J1W@bnXj&evC6iE!mzarmOCq_p0}lc zXyIsM$tDb2%VD{_fBR&^w!xaImN0C+4aYHi_!`4TXHEq{5J%aU%TEZABGE006EBTeN){!<<7`8rvCGV)3Z&F6@s{M7y zYN3`e#)`~ipTauD7&2li?OtdKKlasi;tri%( zT>q$jQfis+>`$U|)EeyPFx^Sskjl@6HcvH{Y{HoI$jr7DRyDOw`)ua5!Fp0HVc7Z% zmVD+!wgDAuzZ0wtY6-*E=dj#-_|ZvgjtN%fqiqX?VQU?%G23YQ@SM!Bu9~Z)Im#QTUXKjR)e6-x5mN1<4C9D(8 z&Shk7ZCW!jV}GueFr4)jW%1p_PPK$FR%C2!g4NXIBwqEJSFx2BhON!8obmqqZ#*o7 z-3A#;HeuNMx{Rz#G)ow^zJZl|uA8ZrFl>EWhV_A3!m#xnEE#RG&FWVzGHV@B)%Hsm zwzj~!!Why@ySXc8y0K(`!m#yy8P;gEgkftdtmM^rO)X*A+6K$@>%*Df*A>EUm8;qB zgkkFkSneo~z4@!_gO#b4Fl_w@%M95R_uC!e+H{4nq!q##D>6g=1k1J1w#>EgR?QNI zvwnuv!QgJj30a#oOBl9(fn`d7?W~DiMhaoK{i@sVgkkGfSaMd%_F9jeSga&r{V8=tBr zjIko~#!gu7no{Sm=7)r=I>*>lVc6OQOMX{KwinjD8fjr4wS-}7H>{Jbl+w5RHKRk; zD7A!P>knA&`Zapae%}P^DYb-Q>rYsbT1C0_BIB@&TEehZ4%TsM^{JTBE@YLcB@A2pz;Z2|-hGWZ)!f)vpq4Of zm51fB-nnY&_+YJ7OBl8)z;b7Q>WX*P2kWR~ZK^PA?F&nuRLIt(T8lS>b*5Uvu(cm7 zw<0Pxx2HMPT)!?>OBlBHhvh1tQ-4HcY}~GvFl-$F>v-G1l)E>~+!V52P)iuL4us_@ zf7Cm<{e!hbEn(O?2$rk-j|Z-;7p&Bpwui#7bucWmH23GPGeyJ81x>nXG!)jXF_DdM<*RimY_v=w( z$tH}kB5Qz}uv(bcWb}TpY1vsq*zM$0`<*b{uj633=ZAm%@vNB|oi#u$Vc4ogR+Zo1 zGD{CZ+D7 z+^_nulJ~1fEn&EYr^CuHInuA0&kQkdpt%+-F&N5fREBkzT43lXH-?pA_9)f(>a%5$ zRmwJPAsDjGAZzrvX=j9f)v0Uy1x8zF-ugxA zUmN$o@dhF6_Jvx)uyqbBxrcQ#PO$bl+4{n;)f|@VSBK{|Yz$UywS-}-1z8szv3qf_ zx~e4%Tj{V|zsBufr&X|W)e?rS3~#v_1nWw*gkh^CtmGqVx>~}p)v65ZF|~wYt2M0T z{d!X^Vc2Tpt;BwI5r!HFDGvhON$I{d&(n^Fr1{ zwS+NNq#9kkCDpih$C@RjivLdogJ(h zY6-(xIj~$c_<7V;wS-}77_3uGPIzwPs&P&O`<*as4Tt5bQT6L}y+RAGQ%e}`S1v5` zfD-*`+V_Qyuc{>sTN8X%1s#1t z*lmqk!mu^bTf*|n;TN@pVe49NCHCv+Gi<6b#)^#INw6B592vb+@(W)MEo`BdFr0NA zELROaD~GBj3|rTG%he!c-Jq5*Y)yvcjxwK>PpKsg_iG9)xxz}nCaj$jc@J@;TEcMF z4X|9l_^jNwiEXtoY~2Ve`B_<8En(Q23d{A2&&rl+3B%SjZzUe(p=t?ZtjJNm3D${P zjjI-pUL=Iwu2f4H&bk>^@@mXfOBl9pft9=(i_{W^ty^Iwug1G-3B%TH-b$>-HnoH? zR-_uY!;*I%Wo(Sj`XjO;I_OMW7hyPSIxJU>$(`#(K9P8mTEeh(2dv~XTZUS~uyrRa zR}G%o&QnVmw(cT}pKn~EmN3SORAUA#w>}&&;QkAQu-h!PgyF2aVYzDXnevia!mu?H zR`Rj2MlE63ngz>MgU^&5Y6-*EJ>E(j8#S8R9tvZuNHy+-W!@~u*jPQFNlzi{c7|HQ zaMo;Ct{S(t+Gai);H(~M3B%TXu%urVG$B|+)DniRIo^^4zB*i{mN0DH@2$jY%v4Jl zV@0Yl7nZ9=<0lsF3N3tEEnzro9xPXlgIl#-8LSm*3B%R{uw=$gyeIlbEn(Q256g`W zz9&j)W{-g|Y(40$#A?)1OBl8ug5~7S3B%UIu#)%dLbZfp>k(MV`!z-_Vc1&W zt;BxKQcD=N9);!l#cQ_b)DniR$6zI&*;cA03|o)Ga{c0&ZHrpMu=Rwu68ly0EPIrN zF;-;sJ_)O#8BsFNU;9{B(^z*_Hdad*&Uy-#s|K%aE>uexwibHJC4{Ui)DniRMX+2o zcx^LBEn(Pt+FOa$_&_aTj1{TIGqBRM8YK_RxjMA)SG9!UtY=}lYVbUN%-OcD!m#xm ztmN~2bG3wFYcVWW4W8#?Y6-*E^WI9V#&v25W2{IuUVt?~tI>DiN#6=#w>4@B!&xuF za@F8@zWzDZ7ly5uU`f9!XhO&urF?~nbL6B(+`Fgo~4#Bob?(kR}CH;J=GG1t=C~C9~*I-4F=hPC0`}IDoZU&PvUu$-aox$2S-TK0C)(5bX_p75? z!mzahR`PyLQcD=NR>E@q;^VbcEn&D{AHwRc{pvmX#W_OQt#XF_P8iPm2v+ib^;1h2 zwmycHykFDR5{9i$U?uO@Dz$`R>r-zfp3Ajc+I|URtjOqH1oad9R^wN-gfUj68lS@& ztksxYZuPaHh22}(Rtv*f>tH3X#zSfe!`6ClC03(+Yx^@{*!lui@@ib5mN0B>@K$0q zo>xm4V@0a55mpzi#!1V6JXQ$1?N&<|&iWEo@@lkbV|`)R`pR1_A!J>umN0B>f|a}) zI0TbsR=SdDURZN4zZid5rkSmsSHoGG0im=}3smZp|4ob?T?-k7|LTYJ3kXQ>*dAGxJ`M{o1WvJNq3N`aIiKSjnq# zw_0Gx+U6~n5VC$y3k+F5_Vc7Z=R`RhiPAy^B+U~8yYV1}^7-L1M zu>)3Jt;XE9R*eJrz zVQLA()-G=)R%41#f9Ue4`c^s>Xh>Ts6AYyRKC@UM;%W z7J{Ly{e8d6ndWgxR11j~KSe8K6B zjt~91T`gg(|ET^%On1h~_vUwSv7f{3f2349@Qs6|y0<^6pEY!NQIp1adPSaH12 z)XbD6#WZLn_Ssz zPJXPQFek5ga4g>(jr_bK^P>H6R{n?)`FXLCMf!SCO8724)_+iDcFZ(AKg(vC=9(Rw zpXbK&h7=Et#S07b3;jzy+O}#V?TPizFDZ`Y4~`XP<_(D_dAYD8PsT(kdP!bZX33DD z#j*J4tT>wMb`k4_Zb_N^Yq6~Sf-$x`ksoHqi;4^L$4JpUY4?J%wQSp}Z(4&4Tf9Ah zK2lfd<*1>V#Tf}NwlW8>RU3IdJ=Q+q)s{HC9kJtB+cIBH+oQG#4U4tkgOHZVXmPtQ z^JTmH!otikvAp=Gm_1;T5}*eSu#2RSFGKp@?I~JJZF8x6Olbb!ld)J^Hx7Cf7q%{p zn{y+>oj4e71hlb7z6_$Z88H53b1?fS?xbZ=QO=OOzkzz^x604Y6)4s%`EFX56c)zw zihcY24igi5#*2p*=8sY$S(~KUiF=aZ1{iJ){Ai066zfTeF@+-?PJ=yOjU2r!+uU#( zx$`c)WnbQT1Dqg*w#|ur{{$Qz?kzoxl|JNjcCiC4E3+s%(S_j}Uf5%Zh8IdXl>(6L zOe*EoSZH-1{5&X~8EhsjnN(vk$-9zao=k5L>lq(xW+*e?nSK}PT?+!TA|7y~WNgi5HHE6~qg*8Sz5; z+2F$X#U=5)EHhK)nbB8N9M8-i6U#Ca{_u<}bGY*IZHIcbG-Dt=6|;6hzPXZQ^eL4! zTy}}Mu$z)(#5$SFEWS6_*0j{LHeEV(?%LT*uy(f@4I5?1|K#Z6qGGN}<~lWmt7w)D zrg%A7?!`7{pIJjQ3u9*akW*Zg(Z=E?7niEcVslMulhIH!_8bhR=!(T-gYyf`Q8UYk zoZ>MV|0$)lR9{NOO)%kY^kU!OKkXmAkTPW!6vXqg|65~aXVTgR4KvO)7c<+y|M8Av zo$Xqnca9lQ*}mlet>LE8_MD&{hLXqn*`XjE>~Frr`q{q4`kSSQiH`Nc@QRJh%*`-^ zDAr3BYw?(zGesFrw!7$MgVOgLe6fCej6SE)u{S@Y@fYiCejF9+X0PDwKU(1u76 z(i`tF0{?M{8#iX@l$vV(BdnqR7kkDmkZG^H|BL;F5$=b<-weioTo6AV)6;VEhnN{E zvLKdXWkjy7X1SQa?0Fsf8z9Zx5oG4(m?e4PkdhH*Wf4YuhOA2MIv_dZFFNUE?Sms6cK|yqcm{o+{ zzhT&zD^YQLNPgiMdsKaSvg3m@OLEQaklbvU#YA3q4z8`qrB-sK-V<$TZxqe7KF16o z891fMv2Gn?3?%MA#@1f>Q9V0ura|;^M5eiub$c~GHurF{){V5){IEerzsBZP)nHlX zdyM9^Sg$dr;v=GU>nLZIZz4Pi-DA$!>s3M-Nl6A_lJ@L52>%voP?XRof3(xn5?@Tx zj6`V9R{RYijkL#OL}r0I95RXEaOGu=h-bt)=9}eMJX4GB$7e$~K*PQ8hj{Y)DCFVRl)hxsxa|cMBu( zN5*Bj)6U$QnAN!UE2oe7FSB=90NQIttetsAmh>J)ikWdUKc@*|T`|9xA;-BHdMHON^pe`{b`i59Qwx4Wez0cE>!H zjK0)bZb6G(hveoDvP<^dc-f8}`#A8)ZlBHGlD!t~PMNP`fSG4} z=5A7knZE(()iT!E?8JhP|2=YvZ*c#rZfb z|9;1%W65_sDknQGcXWK@P~(1B2b-dm&X|3+k^f1Feed!z%>rvw(tWmx`JI+QX-m!V zOEY_KX_w=%_KA(;i&NRJrwz``$u;jFWaQ)*MNR^odeVi2<(5=l=7D5ZWR;N|z;0!i zY3|Y>lSXN~GM)4fqxXW!%8h3hCh3P;1#=I5TVpM=v*oJDFNe8YIxH7kRL4%_jGB96 z(^7x2i?!#M_gpxY`D)C(H)Y>y>fWPIuUN}IZ8~<3_2}8XUB@nM?YlniDP}CzZtqdQ z*A5MvG>-M{*rx5@@AdD{w816CX5d6u&N#gN8iyC$IvekGgde*%b?k#heY>MUve(_U zrL-_Rmh39S45fq??OFW4A@oKnO6h9Uls#F;>_WC(BzLctv41E0Zx*p-r|>Lc)^g!! zCiWo;m$`r~Yd3CbhUIH1pe|m`W3iZdm&B~K%uQ>yc`_^S%5;bfr9`%+j}1JDm6Z%q_W@j>{y&6LNE7TY^PzY0Z)yn+G->bS2Wutaty`krT$Qm7|(} zGo-B6LEYnx5Wfs+IVdwP+dLmHqj&IS1r+O$S!AA|4mNjdrqb@+hO*SQSZcuSS(5ip zUDIQEbXLaQiCqE3+T_Q~8Y5@0JUTD+AhneW%Jf_2{_HU^3%WA)wC7Z@*J!GJ_~70} z#2a9J2S-jPJ8a$PmuC{hre!dlCezu7LGkS3+@hFym{MronKN&>nCC!y{?NR=5>Nc0 zxheBM%qlL7Wfu+_!oL4$QQUlWXDmQ)wW{Bk2ccTj9Mdn#mW?oikfk(~L z@a+5%e#b>cxtuRQFuN-$AjI624UT1&6b~JdpB;88EM74m>M&y=(J0ItLO+yt4$8?- z_}Pf!l7yeh8&2k#*Pw(K;-lpQ7_s5;F-3d6jK<*DWaZ}%&xse2j92qVnRn~rh2ent zPQa6oc$iYUk9Nqn_-sewj?9NyVy53k=DjX@afs=oye1!nFrWU&FU*b=WRA%-4;Bd< zYK}wEQ1fVvek#uu=?9|ZXhmq+J6Tx8f24lPspLdBg0M8=- zQ%B{Bm)OvLja%lLhq^iDtciBLU8E71PGjZ~Q$eh&dC;5FYD{swcYZ%}htt~Bzw(Fox%NMJM&O* zP>Ffty3|N_rNflI*HMX6{J&IvVe|=R87;*?^2LdDFB&}BS7$G6f2mGy;_CVjOu5*a zchu}Vm4kCjiiZB1eA$b+XTu{Cxs2Mv?PW7ctNXvw{X3>&n_+IBA(wsx%t=h|;JOo5 zs_LJVhVJ}_J^G^@P8{2~vd8isBg8xg9PW?MKl1HjwGZBP`VV_B4|fX(n+G=kd>8VF zs(pL8VJ;YCK07J*?EhsaMMLvPjmXR!llAX*66++RwZwcd^S^Wl`}hy#5Px)$xnRp` z+zzw7KB!X9SSK?#ns=BxNm)l16_os!9hqlGc1LF6H#~pv;D6U7+?@_CFxP}Wv95z~ zZ)UHAu}&TE_KxgbUjA1dE_LsH8|fP~W`!qb)W6!hTxjrs-q*BfOy0j7U>)Sx=9nv$ z+!y|fLyHeo=~Hcc&l9krR zlgdgLUZN+!zm3B}P)f#U!N1*I8Ry0SXqU7M zGW)b=+&^E5l-AP!xWL(Cw{6@U^&fW|S&e4Li{%nuU_MubPZrzfI{%Zkl)U#KSG@Gp z^d_a=2JAWin74Sbm^u$1KaBR*+)$K$Tr$$k2dT_uLH;k{a~^vgZf0;ixiP;J&=a@h zS{JM{`!()me#gYzrj0SrD5Y<)&JE1}*|#R-Gr9>%WWj9~553KU3TEWlxoK`6d4w@2 z0}ENh`4rlpu<0!$ZLkY@>^D1cw;kmqG%t1^G|c?+N#g6$a7DW0FLgSU-j2Qv^vv@M{pJ9qr67zLXB6H`rtEx~w;1$2|Lls$-H);^J*)ngrRb5d6DN zrN4;h8NS--sa^7in7e-a8$R}YkVg)&Zd7y(=<|}pcr4nguO`|L4Y{dxq&W=cJ(GTo z2bo)U|7arI)kI(L43M2u%O>)UQ7^o4k<>Xqqp^NECfUn=3FSWYXFk!9 zZ+>%YNJcVR8j6DyJ|wtzJQnYz>{90p^q_%$ioP(OH8LrVi#M05Pm+SmaWS8*H&4h) zuMBqON+-c0nJ1k?%r6Ec?>_F6y6s(h86RPCnaL__4>6jy$7h?;Q~%jf#}z6JJTpk+ z_$9!YjPr%=;bXiCbx`e$c$Nd2>9kq~Pzc^t96Ulk8mR zm=!O*d3-qfCVwt#&H=;O-x@R@nl}%r8k=cuFCJ+ci_0GCmgM5S*B{cvLCKI)GGWJi zdlr{gIDaOabIr^yWnnmli;DA0KTNVSOUZ9(l(nzeUY-v*ZeA&EXL54&=Yv_=ne9)~ zvi7yN4a<&?C>iahkpIOF%@c{@4(=V1Qfr6q%JnXuXFfYw5;qs*k)^`^mL)rX@3=iK zqNSY`iF3sN$6((h#XMLwzs_YIX6(hm4!?zrc_G$0;k1eE?S2 z?gUON^8x=nxyt;@y~v7BT2f%2vj5A@?B&^3VCIQ`+0K^s%`iXj?!^(uV3EGz7wJrJ zw)|?}UW^s9@32zciy-%WUYDJ*_U2P_@)`2~|3s{q^*6fop~nArC;cK_CI(Z_y{+i~ zW4m1aX^9g3sQ2EU*?UYcrh|J-V*hN0@a>7LBwCx1CGRwpIze}C*+K5-%>RO3Tdx#J%q;Z@HV#B$(d{!p9Tv zv0{0gV0LY8H`_K2qp?lfK2!(qa+Yz;CzxNhOjfp(gzO)PW9uKA3 z?iJ_m<1_4g(>>((;=>iFm;SP8zVa>iNevXCIs>pIB`6%9DJ^%MoMAh(t+( z=>#;$zun+@gugtVIrw8#mh6MGnvTK$O_&%!i^TmX>MYBm`OG#yG>Q{vjmWo6Vdeo& zDz9k7EilQZCeV}QA%Ra3S(jQ#7;N*9n;PM}gNU^c)#y;N_V2K*RuH<@o*%XJ29uj+ zXP${^3%LM;N9L*>G|gu)Q)nyJ6nU@osV<`9DnCQ2ojQt17Wu4^8?MdQ*CvM&^~r3i zkWb_q8shn(RK8FJHgbiKn|@zLh~~N0}JxL)SL) z?lybZCb?AghapmmZg4iYNa@~EzV4E=BHa=BLf0N`QCF-@qxo01Wm+tsMP?(HrShFA zTrg%wr-iMtisnmh=hK1p`~Mv^m3WbHK_Q}sGW-V+6axx6xwauu0UxSqV+JZpKFnv6 zJ5zX$MW8;yR49Ak1My6*Vn^gH$s-zSYlf2b@rK$|vNl_b8dokql&Gso*3~xDCv%O3 z9Y2rIuz=+eD`lpVZA_)=>uU4E$@=<+Tun_XKa@=-6NScnd^j;Ql!wVG;$eRBGC{4PO|~(S93Dyy4Hc4&`9wS) zPvw*O;ksO|p=PMj;ndaGYzb=-Mn`FrG-UedQ`c>LY>-Yyzn~5kIh-N@T!HPI5ON)~ zwv{TGn1n9&C>zva#L{7U1J{#s0``KY%%jvmkZ{JxSg;^avjId41Dp9aQhnByw-IW` z)^}8_9cJuPXw8QEFcB)yTfA5`R%81L%#UV`BkAu5UB!l7t@|LcP7ySdX2Wc@oRalS ziKQ-lWMCG|LMN|SC4r*dvSZZ5&^bx!<)O_Gu|^#`2vUoRk8iCPsf@>Qv!ffTB5#^t z$w+NbrO$}1>0n;v%X>_lD`LiGm6UB5r9incUIqS9Y+StTR@KyTsvDiI4}ED}UFJsN zY}J=~D3HpaZV6<#V_0EAbN9hwP)0dEN@f(lN~Qw3~5M=Ll`h@c+VCbc}XnUoWm zq-lz!#+NBoysN}O+W*E4=hPx3-&XK-F|RAgx{T29%w|%I=Wv>~iRGBwLKb-Lwq=wK z=rN_;UXi|yO>DEq?W!LlTNAI1XHzx9HHq5##+uY{O>L^aK9wD+$>*^pZxVGww#}Jr zl~q#xg|GOU2(uSNS2}B!VH;$FZ{2{DH$F3lJ$R>4562%gw~jAfQ8|QXtIZlWq!$qg zQSjtb*~Hvp9<|hV6wzp`y^TdQ;%Ho!&33@f3*_#o98Y^Xur91{L5DgKrlV6lGS~BC zP0~7^JM7RZvV{aYw1#Z=>K$4`zKCMSR&mGoBHOZOhj!usbqVay8lp>x_Y8DJnJJ zS+$zx`xZN@*78^YzaB2LI@CB+Xl%&l8glsrI_zrV@rIg0ZI84Xwd0#> z=N9{{*K<{_RF_UGr_?sz9;xyL^Ddd-o~CjogzaQ1Uk+s;Zhb8-{h#FuQC&;bhP_MI z7 zs!BPT!E6Mb?21O@!=@(KcLw{M;LMc~wqpk-I*ibcDCq&2C1kMpk&o~j9R%H4!zXG) zRRWh;(@3P(CTUfRrHzPv7-;uJRENxdBtHv9{}?)FObeZT50e^hEs+3DG)3G?bLh^ zMoJ{8mrrk=m?_efZfqwcDwaNIbUDpT^4Yy5N}1gNe8^vPE@=;Y@&$F!Xc&9YU_A#` z>v`zT`WkFPJo|@``HDInZ8ggVa7{TF6P|T3tY_WDQ!dq9r`N3zRb$1TMdLFtX*)JG zq7`izSHJzb9w=rix@;1rwJ32F9uadx}nk}b63)2mVSv@1m}QhG?dA5&JANmJE; zSx9v(ZWGShP?(w!$Iof-vNQ?82Naix*>aZ9vBVXhkwvcA8myqiLQ|%LlI<%SyTlZ}n_jYIjy+M3})T|O~1JY1Wr zuNjK-(Ih%HXLiPuwB#otp1YN19no0;Y-fGlC?#-Va{)<)Tp;e6_+8VPX5eT?G;4_3 zBAr(f^HD%ssGA_G>oK_n`&sDv-!2xlHSb)T^4^v4?_9i1f3pKz%;b63NEV#~H_ zqc6J!!<#6cfV6<+XMn#jIROdUf&umj`O!}OK8e>SQ(bX733l3dl z3@M@P8e?cV<V3Asgj*= z)2U1|_K{)S67hP*Pj3eXJ0&Bmd`ny#Q*K;&lUc2dui=eYOh-);{mt>8@96GFQR&z<0w}ut=QKS-u%+DIU=Xo=uQez|Dw%$d6*B%J0 z1hw}gt@YRgfxFy+wd}WI*>&R;vU8h@A1he3O~nzl z(JZ>{PD`|naQD*^-t)58W2qLizpZ77OsvA)OiM*oF3AcRTJ>zcVyC##mgyzbsLMsM zO>QY)oxOZrsDiilwGd&rhPnVlXQ+vtJyR?$(As?amXrEDQ!L96jtn0F$(>z;lo%@y z0Nx3{b64_;W3uQo-`QDRX_mkp89qzk!!SEza>X&3J2HF#)a}fZqsf!`cgnlznIbCgzt! z`ruWTti6V;NB*z6#+5>m%sa776|g3iowc4yYdxauq!WE-rf{(OM3L{Y%fgiT9TTW% z((T&9)D#wW*odIT*a#okC|M~OZd^gITUg!rLg{F`@j25Sx~?s+`6qaU)UTlKrMTObt~kv~zAvWj*P_kI~irIKv8N zN3)6;=c0DTtYmJ6lUFoN&v11p7ah!&Axqn3v0GSGGVTNH058{<<7CE(sk}Iin~uUp zQ-uznwia`&Rv)%-6oV5Bx3Dq|n9pg(JBN6p8LX6kG*)ddP8Y@u)(}^<;k317&d=Jm z)QxFZ9PQ0+93$;qaD@#~&ZN@(oO6jLKX>w)kNn(4hf4Bu!ERyY=R)ado7kLb^sOv8 z%sS_ZPza8$g2fp|la!pi<|8S&=uk;g62rOC`I|GWGy~*Zq6sx8ulWcy7ab}Owa~p1 zJBN;=siJT{MiV=oyyhczy68|z?34rRJ529~RA^`KM`gVq+>g=3dnd2?i1#i!R37g` z=gMN)@Xo>A3I}(&AESw#PG0j7J6&|BBz886vG1LkU}c#g_hWfO&4MEA5q8^1^7(5UNNgb<<()Y)4JZ zm6+HvQowt@p-DwMqg2NgpQZ{MCstmSuf(x(+c|e|Z8>?i)rESI*Gf@V)6&YIoE|dAa|I%|C) zAWcnib6FJc{AIJVXl54nNx`OXf-)FqGDOWl=6al?^*BwFoj=NC79Yyy#c|4N?wFf) z0XUPP(dj^XXy=DAnQ`r=rn1|O@xpn=XkmQQ^yUCJGR9gYrWm2KE0Lf2!33rV6${wn zIDcQ8;p>f+j8Sq;6~?WLmKp0a>9{C6n*^QKC!OWIjNUGfA)GMQu?LK8~w7_3f$nV3jYu5kmaBrSoU3zzJhSaQf^i_;oOz#C?= zs9=4wds+uf;i}6jVBg0h5QVT8m0qJjBaf0$DVP%NxVAV*4y3F*MmKA zIomY$jHBBU#)HLgA4%4}$Drj1S!AJm~BZJ4u&@|~ZqC-d5Qk}i$UPEOLI>xvyK z_R^tEWZ91I(!5#Yk3BO-#;X(6O|vF}SK4M%0=FSK>o&}$1a3pktlKb~61WYiS+`*} zCCpNSHhS7D&5(%GnqWR#N!g}*^y%29ee_Aprv0q3pRMF;(?0sNYx8~d$;zhvtg)9# zmLI2(H)|o4mBuKE9qot_RBI#WE|s@2R&^b@jWzXWtjCWy!Bx3INW2b zVs%s6d$wy|ntY;v?<(7BAX*hEyYSv_o(-5F&wkSdf^Z9RAJw$=ThlswUhT!OWk zc%xd}5p$Kw>Q*j8+u%~WWfqo(^n9uy-O!YB)Ne!EOJPP;T=dFSSK|+7_uQ-rkS1h{ zMI658%o)nI1KVDrs_saXvnoRx5|r76HYsd=SH1vgLQ{NnV$(>@I%k)qX}6BiK%~jk z=q$l{bh-HBOos81apaF9)Z4UaW(?hcJX>U{()wRp_M?H-V(jJvAKn(Y$=>L6C-Crw z2H0dBpPCtG{WzBC)}BG9fi)Q$oi1n(g@cfiY2n0#%pt+{twIM$esO)sa1SGJPYF zX9{$Qa89hr*ywaYd!)c1q{%d1ELol5RA7>iMKozZO}0j7DPIp&1Avm{SfNXEJc&X9oZbDt1%9bDB_PZ879mFyj35& zW$dBJ>$@d$^nzG&6fcNU1CBg1J2fs30%YmQriT}xl!a{RdGjbim`se$VRCO8!#yZt zdGess(6J4{`YuZ>M?eGsO_m8OuTq^{zna8GCtJ=M9NfMz$*zL=fhq!<6SzVzw2f7( zSW}TI&Qh`>W-6Li#76pBr6H>^)-kzu^Fk8xF5GxEwjMS@lJd$+S)^vCeYsN6As?R9=H3~MU6$qEP=t2( zh9b4QHx#Mey`f0CRO#MOq!#y{Hwb&vdu=9ZF9CK%m;w_<+ zihB+NCcc`L(s8$ir{nT4#8H;K@N^buj$Ss+6Tc=34Xgg_-Q);Wzp-OVg&Zh*j;bJbGuf zt~@TPK35*SmIHYYrL9NJSDF=X3ZOQG+g^+wEjkUbWStu=WT#wqcwBF7sr!Q@tEPl~ zqexQDUQP7)Zix+EEG$9g1u@k?|F3PsN)IRbfGi66GAoIOzG#aLzBpxw(caeH(Y&U2 zwJ|WbW|h&rrmbth7+g8f(bd~74?DEZt7|f}DJ()dLJQHQum~|N$t3Gi#@ep7c5O=n zC@exuy#h#h9*k3o4P6RTNPKu^8hfIajNPnDsSmldWA45BG%;lvL~)}D6l59kkY;%4 zWPzG&k&~1d;E_NAfRd${oohvl-a<^#bu&?@9hy!GH2V!ZESAhoPvz`Olt!}tJ74=; z3w-o3s_0qj6AO(g2vco+&ml{rjz)7N+6tqE>B1E6V9Ge7cqL3sRnXJmsY+>Sq63z! z4bAh-%zBMJfhsKYX`BUzKBX!|^l3~dpqDA!!G_8mWsq7NQwDX3i^||(aaI}BrrT&U zqOd3IDbJNhZE;?C3`+c09vh1b%VS{kqPb=WZBEaWeg^7|&f~uL;fHpoR?N)dNtJtL+^J;^63+bB#S)oi<9 zGa%VAytUT)6R#ukUzfFZ@w6Qsw@%k+njP+@@+hOV_vLmgv%?dsctisY;pv?bsyr?# zW|c=T9XK*RXM3BQ$#zaVsyTONMIYDkCv&57}4@|MwDo|tAL7@uMD_K_rWm>&B__6 z0IHmqGf*n$C{u9doUEz1a&9VuRL)CA3Le$?R$-NLbxF}tGL|Y=z6X;TlcQjz;&K$+ zoUu6yo-#g1!OI$>qu{6FbQIiV6ydR2oEu&_W0!~>F>k53rDCR8rLr}o<+uk8gNLe^ z*|?|}U7i6;~=`WP01&OoN<_-8A^=Sl+c*--U;kdaYV?7!_knm_)90Nian& z!4h(j^Ok{Wnc*3=`)%oe*5ycpRBuX!k;uEVDJsULD)W@&f6g46E$^*dcotHPnPJQi zHQT1zd}#J=rzI6v%0{ZQt+=T$ZChbl$c|~ahV(JI(Vc+Rq}`T@tda3EC)h>CkrzOi zdKVc-t|N8|h>RoGF-ndqpeJW4320h2Y!B#&_*nuvB94}Tj)`omy^J=+LSf6q@UXR1uO!y6wVK0|I6-%f(Kp0u zz|(2$8i>6GGu8>7b1l|tE@>y*aTO$MN+h1D^eLi1 zrX^>VN?_Am$g+g`T!<@)2Xi6R5;NvPoQx~1hb_U6o0)yNrJZ|oELxh~6t|twOgUG2 zU20VU?IqeXIf3csv;}Yi|Jl|cg{G4N(JK{nHncfXriE2$LJRJU(^^C-PHMrWtt?K3 zI}+Pm7C${PRUML4iiM7}w@KO-vf}LRHcPP-h?5MP5)M|*m1ORpO>(2N1mIG(dt*#S zXEs&$PHftQW#ZLwY`i{+t<%!92RCKxEo%h>`)Z#MBvOp5)NL)~5DG{RL))jtmLj%Z z4C@DTJ4o04>rnNqjG3t#ZPiZ4VwA}c8$DVg0NWV8a&A&N8apU%&Q2BbY!2<3m4(rf z?9j+4Wh7J6Ika>=wyFt7W_FB}Cl6g7VF}IVVpu|6aYbt{ETQRA>_n;QQn8<RLAwuOlAek98Mq2;*5^I%CXQPqz~ z`7(rh(se#NYM}-)jjhhotFb?DadKj6I!!wQTQiYz_US5zt5lW}@GuHhwjpD6b#omp zru0#AgLht62^&+Lod<7*4Ud#N&KAf{N0#YGImK|N z1Iu)vbzbF8Czk0%)i)@t|++FH>SwzG&Xr+l&XEberuJf$POA)QK>6+O8_ zWfW~ncpXJvI*}z1X{k&Fvn{DM1d~{@reLtN5OUDo^3&bgg`|mAmTD3>t<@w`7HbkH zt0yKy7_9@g+N^^wHCczsYOxO9G?>l_^b2L9AIZhqZ{*SuU>W}^M#azKwy0Q^cs44= z7UxIBQijjScy3}0gY%wYL^EvGhYF%7S*lQqlB+YIqU5c@DoU<0xF%+%H%$ZuSI8t4 zDNhw(k+OA$SftEVkVVQ?hFQKaHnUCUYF=3(n-3o@D~z14*$W&wXR~8Ia?WOFedL_Y zPUpxu%ZO1JKX;}uQ^0uQR?qC$ITI`tjTxY!sLa3$MP&v=C@Ry*p{S$-^An+brwdnk zm@b7gd(x$oT}!%nYfp+Ujmq70DNOgW$pLk2vWgz9tyRdUC4?uJ;^jiu`f?R0pMi=2 z<@0dHiSjwA5G_Lei}TN(*ybB_q6tDN^EWex*0s@ILy8<(=@DiJ%dUx>hTC_!l{u} z7OjjP&^T1>;eH9?By6`d3TaL3{3@a{jQQ8aneoiOMk)iFe_hPTi;?zn@y1(O8xW zwb{0p&CfP^ER|Fo_B;>5&F0tqh&S7B^CO;HkL@t#M?ANF-o$h3YvnwFkxv*(Y%2<*s4W^DdRAY22GP9_k ztoE?JE{kh+U=6KKv>sY+Xm-nac1Tvv%&J;NeTHtq5e-ABqNP8*6&2;7Y;KF^*j`U_ zhSn$IUNbgS$WMQJyAS*#;PqAJ#S|-D|!j41rfztXVNLsTv>A zOV&iBTvY5-B#erqGgd~$S4EPjILe?|S;*$~6MwTk@s~%e++H5N)5+y=ktx4CYHPwT zkAn)*^5|s%@(5AG(`q@aZ0SBCZYqc)V(1L>h}fz?h=`#KmG*74(zd6ty{M76sB(lA zu(EnoERGsm3fqkW<6%s1pDd(l>ky>9Gw_>INUBUtP7O0i5nBSFmB4#rn&wTubO27& zTRk#Xn9?=B%UTUAk64QC)ECXFrWUuALn_6h`^{_KqsPu+T5!qU-iN(rb+))Ay?XN$ zvhTr(iBZe67F*}F4~|c+;J>@bd4oJJS*>`CN3G}t_#q-S>aWbzDP zZe?;i-MWBh+s?U_$?bIO?44~p=T;`S)2&-~w(Xo-ncPmd4&2$cb8cmFJKef!XWP!X zl_?7qF~wnWYGi_TUNd-islTnfpVS|t28Dfa)^Zhxi*G^^jkCqmeiU_<-JI4}SEB>Z z53Oo>uXsCUfI26qcI67*+u6AFe_EznuGJ&vX{L1JA5C(z7%oqBF1>UIp-|GxCiil? zSB2Gkp03sJn$(_-*QEFKye7S;>ow`Qd>7wq(p#NBJu^94GVxfp6IC}l_rGJJiiAyW zF>({*(}it(dvx!xntfrWY1PHt=0bjkY&&%nN2%nqMsBz^UtgOXO4KK_sX{)HYiNk) zhf?`M?Qne}(a>;uI$d48*1gF?DV}eTJ~KTtRYj>_mpp3R=IEn>Vn-qzdQ)7OI~0vwt~C#IxLK_N&EV}Yfq ziOJ;ucYUDxhyG8yL3KapllmJc4mCwLJUQkOvl%y zR#O+6T$~zDcR6y((!Dh?vaM=a;@J5eMlEaN*|8kv?4{k&JZDXBJC^5U60q!Yykj}f zHcGIAYbl-CRNYj^c9ys8hD?k76 zT8Uad*_LEKPnrd0Tl1`+PqsDBn#m;Kmm$onirU%M4xpuUCiNJEUiCt`nsXU*`AlqW z@bcMA=Cjk;YSD*MJ{wz$ynHrX8__T?pAFXrCon}3P8GA^+Tgs-D72}Vjf%p?s=_#? zSQt3Ox`5faq0X`{jmwd6vlKvyNEll3w4W%bB2SuI~b>xrjX%8BC)6gtM&x~i>dUW8jhcwXd}M2mUR zLeA5hpD?h_^P3+HENN+8{4WzApCFfFQ+VgY6SkWCj-iZnja%n!Lv77avOeBWn@ZMZ zYq3Himmf;h)gY|2B4S|&WpSdO8*=P=a6&L>*7Ib&tGtq*0C#A&g%I#x;ak5-OfWQKQJL7|}}di-OTgQvJ)bZIc=C z%yOhqTa#@}B!`DmLqmmRV?Ghj$5Z)aez-1|Yp5A&^sQlpAyx&DD#XIjI}4ohxRll~ z!sy^$!wADc6>#P0F9XoMc+}TKqlOWdnF`=&lye4nG+b2xM8i)8h|yL+HDZE#-f^Vn zFlJ89j87XAL+2!EAFxSmbby&jd1IPZU-6SG*UOz+S*K$=hT*JxLPo|<1xsWsogot$ zV-+}&v6SJ1l~iShjK>Yz+3ESfnI3$=D_$)sF*OR^}JMM*L!mys-#%65jeTq>K1CGnMOhzwPp zwel0>%GAfDfQo>hRFKDb-A8@ev$R`w z`YxpJEG@B}z65CEUmsW4B{a~Q#h&X;uVvEUO@)&5WE}5aQLGxawCQMCA{~rXF;AMW*s_*RDZnynM{8?A zYOnfonyMG10nVPJ1!{)sL0X^&$W&}#J2&)Up*OPP#Kscvs%E1HD~mDfU@gxYMB+=* z?tE)gwmJ9nB3q@Pc@gi7|MQ}RioNq9UdBDPA}-FR4$XrewrHZ@VMZQESiNf9Jw@kLk@A#UkFkKf!;u=^el@+Gw0!ds<*9Dchn8phvaWP#NMB+k^+4_Z&zND_wu|^jS21M0| zfnNLw`!LWyX7wk9&e~A)MjZS+)!;pDv`x(IGiW3md`>cU2ig* zLX;_m(ZV#Qzi%EXMsJR7$OgeS>!MWtItRj3jyVUyR3117!c?v{2g0~zm`FAk5rkVd zN5Z&ebO_cQxRF~nN5W+GK^Y)gTgKKJ}mKiNP z#Z?<@;py&dk1ae4RNHLf>8=v1bKc%0Dlar|(mD^)G6T~59A+}3No1>ynX@X*&n`Tz zQ9MFbOJiSz%&ie4Lbfu@Y_pS0-&Ho>tqe9QWGYq285ouFQ~s}%lXSV)gsjkR)0*a0 zCRdxXV$H5~K4qC~c_pHWxga{OQd!yr8x2vrZq%l9ZjJ5@lB}@Z?1<>(wX^G@wd<7I z7`+p@k@4XPY$RnX`OBcR#QyMNOCo%D7M3_3o>+Pevrn*GYi4p}d=syx+5KkD)#H1C zi`}}k_eDxtgK#cHS=onoL!HkujDXpFwbLH?|gX*aHClGb5YE3;8IzkfP%) z71!-mD%9l?^@aLeu70SdE}x3m)YPXMQu%CcE}Lqsuc7TKEALe*Plz%_zpE#_Bztxq zqG?^OsIq#M$`!_oU>YKrGt02daxR2%%jQT}S-nb?g;~g6rE-Op)vHvlu(EoU$`vNF z568l$+%z2!=-x^-zqvFgMP)W3ZmJR(5kqIiFe0|9vKSFVOQ?*Gpw>NtQuKW6vX+~e z+)k%J;vZ^FmZOB-_N5XyI{Ab(Ue6@5AWAyyfq@d(u0V2duBF^@bW)Bo*4VVdhC|qi z2*>=QR*k)Jjd270E}ILvEjUP5+k+U(3gbEDF6SWFj;EWa<0y(LUunBa+8#2pNitis zv&@1*&!63QJBWG~_iZRlO&C+zaeh843<^$}p<`akG%(p4ohS#f4Mw zPB#lLoN5ENBU(r{@$~e{vWcgsx>sO0y|QewRQ6h_Svgi18=Kf#n7c-0JZ`U`&8HR? zXJ|BOed^!VdcM6SsYzsOR@oi2qiJSwT1j))$69T-__$(jXH0*W7AA_Dlhii zvya2_AV)ZsOymejX$q}2`m$Rv=^q`Y={8G@YNM%~aBv%Dc&ss6w@zbV7rWWo8opsE zrO+@#U>ZjTI>unj9<(f1lr#&$XH7;Ff7hjkwqrE~>rQ5W+Pme&=QxK_-+MsGRUSWY z1zYqP0xAXv*n>SLIP9*Bt%thS%+V)RTH-J~?gPY0cOpmRy^Gp;q7TnXg-g@Jq!5jR zjiO2+<%*JKIZ}ujqSjbwaiN(!L{PDarx#4&IW`#slhY#@Ia-DJD>&RJjX88phQYQr z#98b45$uCDH8MUuY)o)mI^CE~89mK0!0HRzas~F9t6$fWrq``$Bi_=QZXXzEYwm6D zO|Kc>GCpzMcvG!{GwPviUaV+hIfbCEXRoKGvfGXE!g7K6s*0%Qk z?lcIRYO_SqR11=(T0uiXR>qr}*DAS8P`V*zw66C2*whqv5U`Sm=KNth@brdcifK=S z#s-@Jm?q7Q)m=3Z<*hu)Yz}}(oxHi&b@#);4DZiw7BN>b5?T(&J?H}I#tOwE<*ANuPS$JW77(^6q}o$sYtotYhIHzT zmbMlaC5;Z+xSH>4X^oO1Mz{C&bPe>k_3$LeGWr7YO`6_H=yH9_T-1>s%w&4{`a0T7QY3>K zn=IndG7 z+n#0z-PNFVUS6DLL5=7vC1jFyDPwI{TYKaZc#I!Rcel0;pe#a3G&QlMfXd3`)Wq0G zQ6-9&?sWG+&p>NmM}K;FW*RXIm5x#D1)oQ?W2%7Sp|BNGf6b`TlkV?ix3Y9Z4VUi} zElOTnqJ)SMqQX^DD%u6Od_1&BY=X zZXk2dqkc<^{xh}=zFtOIWDuAWh~v)C0Y7Dk9RTc;1Z7SmNn~lDN7fLMte)4dO$B+; zgM$dds>!P|zJy4)&SeVL4BXU#EJn3Rl!Bgi2e7kwq5^ipLzIix4RmKZd)o$kQGm2| zjn9mZ;{R?Q304+z6XWk`~*tDrI#TOrQ zg7nNZdMo)e&C_v!YSQhzSZbRdEw08?sp90s6pBdf;J`CQ5ot)t)~R7>{v4VeuT_j;+B zZFqc^S%>>)d+PSWAc?zwa!co|B<@bP^fdPm4s>*+xmmfw)bz;k2vyCRYDbEwwjf|l zrwpXq2D&;sy1P2keM5yja|ExM%S;(DV4!<2)7ISFMuFk$@TTg_0EL3dzNIJK+uhPJ z(9sKZ_&LFD9yjr=&FPMg-kz4`uC72~h1=Il5pL>Ry@u6OsI?;M@64Zr>Hg-y&W?Uq5@daGdScS5Pe=PeN2aGe1AQhYX^mG? zts|x>^kBLr(>B=O+|?Q^rZBFG%-(dSy|<&guMJZ09wuNOa8q?#zsb6_E#21A*4^7O zI1tEsWIQ)9W>OBO+uAb&9X%+;yXXV6poBkM**}=+Z*6XcF4^%sCLM1S!*^Zj?wLEsD5y`c##QB0>$VL*R4N|VC2$tgM$*%Zl&fIv~$ULuU*ezhT++8#hn zr9G%wogmFr=Jn_fb`D{0xpRl6f8|ySuvw+xxmp z!qV6%n z7*DpMecL}chcWkRy0t*y7a8})=y3$nd=ptZLLeW9a-l+n>X zRO=D5>>$km4YkZm@TBr8+1J+7*WKRPnJ%;|I|l}6Yu6}U1p$F&GQ5+JN&l(!Bl7}4YN0n3>JG-gyMnHEAboI3Nqq@i!BHO#E-OaLh ztA(;jBVa7rwW9ja*4ILn$2=XGjv8IxYWxh?wG`t)n!sBye!dBw`4>)QnK4eYhm-kf&*obn!3GNpM#gy0~6(jg>L zjYM%t)NN}WWVFh6V!37Ntu%+dSEEJpHDj$_TR1yk+O2VZO}TbOvuI=gBEq=F{#M9! zd#U8Qeytb5OjYBF;*jhJ;|yus)bT;ecf1w~xV}{yczte8*C3|3>&L&jQl@0*87MXT zznDiukSTL{AGU@h(-k2ptZoWPYC3}V!TI*;@l0OEUmn6{|2#j`G{~1ur)W!cxF#fB zse?i?Fx?cckJc7vG)bK<(j;>@C=^wxd%}_bgl@U) zobIoHl_N+h=2RL?6|=O(Yq$&yk&wMpahO1$I8*^kXFycQ&Jh@qa4QXvNZ3-&YUw>d zni7*CrAu5t3Ilz%zd=Vl&-Yan)fRuZGzA4ZBvk>a{QAzegrCesa zn6h2I3BjIUlvGa$g)AFVFz0aaGF1kw+czQB`;(IEjY+voV=--Y`6h&Veo-<#A*s^Y zIi|$YPeP#A2PMx7k@D_YRoyXSd^rFrLn8nteT2#{%QfA{lsQW2uf>Of0m_i@L zdrz2D--nY>J`kZ)4}?PTXu9%c!N~LdXm~1@M8nVYUzF^u&W@6As&tZ$DEn<6q>pSb zg`qC*l(sG(Q?@xbr89O|6!yYMMZCTXo%}y5^>lG=6O6bhiivJtrJ`=%gp%H$5-ojQ zvU9kp8oS00jTQ_s!a9uklKhyLwO-mgN?Ei;%VZ&qD4T(>v_g6nUKKJbsV?e{Uh@HX zZcPocJ5{3$#ldt(WelwTsEiYpD8VD*B1Z_qs@USsQ+dHxG>6%2)xeWQE+gV$MtI$4 zD#(>ILp?Max(@c{cdkLS;4tP%u_7FGL1bIV>zeQVzLteEHNi_mwjw6kp{6-~28VPt$i%v$Q%rYTiMir7^##tk4R@S2MIi@ze{gGFWPdRvEm5 zLQ7*_S6QJIimzs9h2p6fT4k`*4y};94FkjGqv=#Kp3KH;hm&!B#SEiZ$jx9K!gg%0 zKCxw_fH&L5#;{|J?W(u^g+JV3!{x#9uG|t1ZV7jxDF-Z7=gO@FmKCu2Vf*F$TdmP8 zT?JgNw)3B=ru6{nbPXE3>(_6fHFDl-dwuElJSkD%m{_K+M14bJV_jV$5m)c%DG`s? z)z#tu`c$%!eR|WL`L~}Dd;OO_bI!F##A5qZ#n`nXKZQj#TMPWJSnL_R|LR`yFY*7L zd&gGf3qv!Ts#nP`-^0UAuaST8|I@L(TUJcvv(s7iz6XypOV!`>l-_$V?ZkEB{hgk; z>M6;g8V|ee9gCfSo36#U(|e}{KZV;5@4J9GTj0oCHyoL|37BF4j^w@>m=6owA`gCq z`vNeJ3!I;Re*@-K`+xwKmwt!h+y1~L1kQ^e$sGWuC~$uIT?Wjp0XXvC*MWIN;JoxB z+>^jO7r>A7+vT;f*c))uW!f=REb=$}cZu~6@%)y(<99ma3%R#b@RB4deB~SN*L5Yh zz0)hOL}|KuY+NFfcvuhII|Y{fw`}jhH#u?p;{A=l+$M137lw1h``6+99l$&yaHhQu zxh=pw2TTny#zi8$Z(T1z>6^pmCY{ zIph+XRlp1joR|Mdzw?3lqLZJC{~iVASqsifzdiSl#d>kmW$NePN1x9T7zV@-<44(* z$~IyYPcH)QqXH}9{hceeG2k{yOSn%0^L>FMdl^3mj?(Ybz*HT;DgAK!1CtOqGrlz1AD@8~@}Xt;_6uMZQN+Pz z`h~?S{*Hck$GuEowO$>DGNV_bMPbkR%-HlBXH*g@FV@+p~>$W z;BE-uNBZ5a$?tyP9uD9~`u$0h-;2O4ISd52c)En2UHo^Xz;Gnx2kzmq0=Sa{_>q3= zHTk^>xKRy$@6_aXEpRt#@cXJJzk7lEo(8`^YV!LlaEo5gz3depEPV(}P?OJd8Vu{?rlKME+ukP2xJ?4gMUAek? zed`*j4)OanaDNq8RvyJrZ_jPsQmji!SnM76u;=0CpZsA@3T+Nbe`N+|cq1@!yw3|d&ZLC^NdqH)r8Zg#j&n9El zV0&v7>v!T=C$oc$I9lucB6G*P5)|#_u#_TKIhAU-nM=atU7WT zRT!SbeK+n)VpXhJ(R%X6HATqSNIOn$?3*c$EOR0?A6B5WBkx)Fy9ZXB8!8O>YYF2}AT*dAd;eq?H+2?08a~qIJ$< z=b9B0L+8X!j-9$s)ey3<*uJq7WADE_X8zwdlAD?+P7F^kJ8tD0meF3KV(DE53ieBwDomV~IHicqvL>OK z_!CFokBkptmyF>;?zBV7ne#jT&h)u18V+BvZ*4*wWS<}YfE)4C0RZ3YS9t4ulU3D zq6+fj7{$tC*%K8k$|B@e?DDgSYeqC&Ga`^y`O#en++rr{c=kkebV-@?OqMUlZMBWw ztBY$*`g5(NWQ8bwBCcFIg+7-~p&!S+IL5P^W!MXJ8EplMU|f~C_}OKdD<02Wad+mb zR|6DVy6(=*RjYQ-T>h%eRhiwF?z8B(^fq(FJ(-K|U3S(z6pdPNFNqzE-|N{^=87|R z&s?<&o@1FyAI>aozxy7lBzLoq^w#SlW>u_0+`*nm=O*@)xqM^w?(3Lxg7FnEWiGF} z;>Veb@7kSd^w)c;reA$Kc_wqkLqf-m)$z;~50Ik9J!A}5l)~=4xR)?5yqi6Vy?vLN zONB$YLMU|kVqd462swjH7JfW03K#By)$D2RJRk$?@+xxaGo&F!MeZ^R816Ft7^3f% zH-bAwYwwGaKX=Ozdzw49VBPgHwkPv4%(7p`cVsTna|JD@vF{q8H#c}Y7#GIInF41!jJ7Dd%PE{GiW%|RK|H0 zs7nA>iEo6&Bta= zxohk3nJXR?S;d2yOYfXsmbv)OV>1^&^;G8a%!`}^bSy0}*tgqjzL9yLt$G=0(_V9D z&BHa{;2(~`i)(Q&iDk?uQsVvW-7tRN!=9K*Li!O7=?9ib4-iTvzjU88nN48_vorTMcL$jLYSZk+rrG?7%-(}3 zOlI?^wE0A4^LOjar=0mTg{KeTUc&m;OtTv@SL{#uRp#RVUAh$o>Z|b_%e;Iy;!x(T z|I1R;{+TPfkYMgUHgm#VnTvnBd*2<9-$+zzhk}GdWRpfd?p6R`}Ct zc;bb1JDzr9c2g4LUss8zU1I0rNu&Tu|MQ|d4-3+rKY8iSzmo3swMZP08RtaW9EcE-=ZSsFeH&d#c)XQEb=bB1&7aB>jl%Cj8HOEu{~3}#`a9^O3YZfPyf^PU${9HeR{zO!da4JNmC2zwcu4U|(|9k@faeMd^Q9RDx zRS^YMl5kP6Dz6*xz$y3>QT&X(V-!@4!A0ewyeQ>y3jRbCPqTMc85c-6{=boZrJ|ib z5ykJ>J1-fOsc{+ni71{cq1b{q^7;%OI0b(qiodaURvDBI<@H%Sa0>oJ6#r!JB!X&_ zban9mVgus;ZpYu^PuqXwO{65A5^ReKsySCV9h=&z}6V%bI`r`Td{0;7?!JE&2J=?|P`U_A^TkmftTs z>fFAoYfo)H`N_ZUcjynlaqsu9`}GHZz2w$qN51hp|MR)*YaTp$!-mJJzkAE0KkfX+ zXaDWXkHjRMRPLHp-yV6}8Q1=3JoTy@UjE$q@9lYZaK9@u$NkrM|4VBQ>0b1U4_tHg zLtp&t+MnM2^PjzKpW4$8eEsPAKe_tDnLl23+Y^QTC%?Gf`TeS&|FQY{tM9$o>-*w2 zO`LMkGnvc(I(F+`H=T3!(kI{Ce8Po$-SR1^|2G%C>fpXh>fYVC>2Fi-JgxmZ^7~nz znfUr%mmjzHufF-qAAF+g3w`TWT=VFE{r>QM&i}z~@87ok!>_7ave$$8ffo*y@;^M9 zIp_1KkAHE$&%XHm;U!Wnk?+d?kM6qePmkxCR{#F8?&a&&HcZr zA9>x|zq$M!oBnj%3pf5{_qgQruY7ui{Jv!7e=ob| z(Y@|;ewTkA|LkWDDo*`wtNgon-$!pf@}-lWlHvNj+Oz-ld*kLG7w-Oo@!-K%|K~X$ z{oosJt~q7*`p(^7{@b}9_<_Wwu^H>+ijn;LFW;q#x)1RPynD5pjjLC%Q|0U5yO1X4!~d5F?Hg;xQa@8x;mdd2gL-@(M5R$ zU4&U=qoOa1t2*f;uBQAi*D9)J{*qBkDn8J<3%)F_qDmKWJhpK3TNTxt1r=fJRJ#(s zib_W^_Qu#P-&Ryqa??c^JJoJ@v$%>XZOTQ`u3PbzF2dNUDEHwS61H>e<0mUwci|0P zgt1dm9m&hCr|^v~!q};(OjdUNa<_lKTFIjFoi4)Isa}OQi>nT$U)=nXc2x^1!q}n1xCzyP7FWsGjX!WnsSgV(!bn*Rz`G@@h#OrW zGH!UgqIyMb#^)_KPiZ zP*JUKaTReRc~{-=2ok82H6|YR=Tw$i64abqTt!uO6{9FU(RCH5D83WMuHk`rv$(2- zesTY}dlev3*2l!dflL-Y$L^7z@Mff{9dAfOby;&Hrb!iflCGCd+3hjK`4@r@VeI#*Gt?krui5G392*yX;Xlob~VK8JEEEL4XvecWyTn4mh0Q(40O^^D3r+`k7ZvYjw? z+Yu2xZGT?KI-JP@Fm|Y!$SB;icvD5M&C43@%kXw_6~$q?KKYtASYlL%;Ij;0ppRuP z%Mp0P^C;r{{F<+>Rvw!YRD=PQWrog?CKdTPb>qQbRa93BD#Fm$SnOM-6;3`!;VaLL zIg-%w>8FB4+tv4*kv7OQjrgSHPC*uqWY4cA`GZ3u@}a} zt}XZ_hn@NR_8)U9E9Q8Hp>_j#YB;;OCq-3|ARhaNsvii!JT`0Str z!z`m;+}ZA@(90y_*k6TLDR1HLc9B^(dxN3IZ6nhlW0%D2Z^O{1>XJ9DC2!W3yqOel zPBf*zQ@lCBeDi7XCSkt$p?I?bZ^$B8Lk_|fH{UE5ZH){8eMnQtx@Z{C16-1hs# zo8!$l2U8}-F2eBb@2zhzq=im;>znG{{yO{F%K;NP<~8zEM1)*utsg8;WD>O@hcM4N+?1 zZyNAKm-&V%NNI>t6UUHLy7(LG+$Pd=ag}u6M?e1fpZAklQ*60-%`h?R%ri2F*ScBA zuKw)=iHbuWz`5OhOybz#Hc9$rg*q^XzNRgDkrEI z#wIJxs6=qazTbG?(iNtxYXud<*km;`DkPJT{N{kx!I z7@MpPn=G>HBvaO1f{I~mvN~knUj z>s5+sQcy9BO;$Ifl5vCVI^LA^6+y)?Hd#G3S*QN+y`NQ72T;=)7sJ@vr@eT)xGGH_ zORgzF#W3vaqj<9nPyCIwMooGBVzb5iiPtWB9Azz|iN)%u366^}sE=9N1^sxVsEmP? zS1GEq1r=fJR0B4u>u;DmUQt~ls0afp%M8ImlS=A^7vj2AP%#X9_e;E?5a4gDGYHSX z+r?EhhtPf5yx+D$qX&})X28nr^6Mni+^W3 z&K>LT8KiR!X*O0`Kt zn%;AsqzvblpyP|N&d!(|#knRp{w`nG#!tCpTME_S7$f^fW14?Xr0HxD{}ZxfP3LXS zPCJhepkr?72#)m|*zpbS(V^4vdQE#Xh?>`Tr5RPb|7VJzErBPG^K-G)j0yYsb4)o$ zAc(ly>3Ho_&i8YIeRVz8ocQ4IDDtZ}$V*FCjy8o|5w5!HAeoPMp1$ro(ub9jjC(~!L1Z4EE6jXyh*HeOGeRQ&KQ+>es}1I8m97 zP@l?fXPdQh?KnH=#d8t^#gYFx#0uJ>4>h@ZojvTrH3*7rGAXdo7lF(a+4CBstuUOO z8J*@wl+a9eOo|?vE^-s4p=NkBVfQJ?!5GVq&tOXPc7soB2aAzS<2cwaEK{R(+cxIx zb~zI-Ry{L*9*TtOz>L0{t+mp?nG6lT9NuK-k20ABSkRmkGq7_!XQ$Ac zt!Ry3D7PEo5KL$&-BIL0e0%uy-1mzC*Zd>b6q2ZTO2{)LC=~Fb@cvou3`|ePEsp zz?}ttzX7J@P%hWbPw7XaUcJB=0k|!|jR5ngz>%Mn9f}|I9Q^~BuEV%o>S=YueHrgJ z0dx54InIk8b$WIR3?A9##*aop&H(PM0_$ZjI-p`#0P}?a+%dp?U0|3{{J6;_+|wGk zT`>yvs>7>d`y9jVeXWh3J$&y2=KBI?x5JKm0+`=u;GP5KpBlK`j;)IAi<>UHTou05 z({>mzM{D3t0;WCy_Y~4cGcZRS&*f5hD?i)qy%d;t37lO&JMR6!+#G*qKcu5$|y@=JW6Dt0Pvy8Qgo0nAEQoYIf#og0DqZ-KLihr-bega?3GJjmtx z;f?_2>;T*m;CBHqHwYZex7cf!`x#)K)!?`18AuGI-7vuv7xIX3{e47f{yxk=#c zepdRe1Mbtn?7EW6^$Op=0Jj2|qgHVomG55RTLk7Jf%B3};dVJNj|rStc;tcmGcfB{ zbGcsi0}9`F0&~B>dGVup1HS_1gf*O>7moOK0duJa?xVo`EC5Gx{|QXnT7S9c12+WB zPXx~HKYPCMYha#t#i{Tme*XYw>pCvikKbE>xzZJ<_)&bh4wyd(oL79g5V-xdmNZopXo36DBw;2reEN^iXy)Ig zz}zTsUg?)`p9SVy0l0I4`x!8U8~p8{cIY@T{~>T*b`b7HVD8nxeHWNN2jDIMzkdO< z{Vad|)&h4uFnyq-u6b0^UAMiPSNLq`DXy`6yQ!W(BFicE-$&1KCT7k0|Mve z7n&V+GcZpJoR@w*z#aG|E)$RJQu)0~mxLSA#C=i|_o4<4Q+Z;oS=0}3)8%FFe)zUg zU>FcTZg!9#CV`s?;CC-@7Xi~cZ!B^Gd&jI}n)T18@|dPY0$;;Jm_@>|G@= zcx0EGy(D)na3ccir60wEHv{uFf%B3}`dtak^#M4N`(a={FK}LR3HKl{PiWx&2be_# ze?L<>a{w?W1>mSY*(xx2WS5u!W`KJ~06(fX-2lvwG;q%XbKJ1M9psl&ff)$E-2hw; zn3n@^RfsVAZmNpycMg|(FzA%M_WIT9wp7KcannV=Ubq#&oUDOs17=VIw*i=84csI! z7Y5*{zw_uZCQae)dQ*yt7&-Vgz)wvw!)lWn8OQ))0hv24*eic6@mvBb| zlL)}ks*Y2DSs#ESenY^F2jHk3zYUmoXyC2|<|D2+<(Cfd`-H&YkzLAOg`38g=Ybn8 za=&=h555H4dx064<~R&k-hH$=EDNV{TwgZQJrwN0`nye++DzYM+5gmV1B8A z`vWj9Y2X&mRK=F!rpwC?YJVIAOrOAc<@dwDWr2Ah0Cxg#PXM#)Rxa0zAK?xLrab^h z>m1Gm=Dh-EPnRm(2=_%`{t|%uG;sT#R~5S(H(k5pc8gazy#E(4*=-!>RUabU<-k0v zf!l9;RqQ<6bb0Zk`tt{Y`LV!x`R^j&{s_$2`JA7ZUkG;vFneC$kE3{S955RN&Py)g zCV}}_0FLbVGB7U$;LZVVw+qofgqtp}@YslNp9E%)H*=g(^%n1Rw7T{`uIZxoc z;sN2_1I!OKaDM@&{w-WTKYnX~xjq0#;qe7vo)S1OzmR@^2Bz+<{&I=mYG5uBI6r>x z2IdC={7CK#z|_9YUoPQR0rQ>!9OXlw1LpYv9P!)xVzdWw)8*&qNnk#!f%_gXuf4>L zpE@Dn0?3L3bF08nIi}*D!co3))TJn=anohT*-r>K`0Z7(YjD$LFIVlj$AIa*%nhgV z@q3XmUJK0HD>?2&@KpNQ>p8Ev8so6I>7rjRTs1Ip4cy7VbZFoPf!U~m8wO^|6{qZd z2KHVEOyS+!j+1=sIORQ6u}<7{`Pq90FlTGvHUU%Az`Yrm%QbNC2Ihkrxc>&`3mUku z1M@9cobume7-0MXFt^^!{X+F_uXymlr>bI);12TNlfXQqfqMa%mo;#Ee7Y*OKkgv8 zhXZqh2Cf#EW(`~qFzYmMSzyLAaOVMYu?FrcVBV*J`zSD<*1&xQnENzv4*~Op2JUHK zp3}hn9hlud6C7^)0CSiI?pR=IG;pT@)1`r11&pDA8v$k}0M~}dc@Z%82%J|v=fiNv zUx2ypv)nJQ1)W!V>;4?_aoj=i{!PG)YT&j4^EOwU$`8(jxGRBq`tw|_y9`uRR!E)h7ddI{Bw-wVtmuKbi8wD$i=U|#!0H~kcD4RD77bFRR7 z$!!MiQh~uEyHvO-e$-EWzXp!R%YFdd8DH|(k8o!J^TPlf#iO4K3?A9#rXS&6(7>Gu z+%8|PioFpxUG(e5j~4uI2IkxV+#$eS0L*m(I2t$o5HP73AZ%>GBFU zN{4F%h5_;8W(VOmXy8a6LjzX}wT6JZ{&udPz5ZuUM@#QOzZ7n|=+{j@ic&`d^Tby< zj{1ufPVrlY_ZNJvD)xTdblLeS9O-itFt-KZNX{L=d`koO17M!k!2J&}FKgiT_mIC%HQ=U;e%){<;(ZG+;{iAdk8QwQ5`d%dxEh!nHE^HyG;nVR?n>ZZ`)w}QtDJrhDv)tt?t7Ty{KjWG zAE}D1!c7`!9GLgG;_UwWpujK%ZTi`9AJM>3efK8dei9%z z0o<>FIq*?8zbLu40e1v24-1^VA4&O-)-%2C2b>ok*`@q!=T`^ZZv@tl-}1+T`F#YE zdNgp{9VS zg&X1eHE^E;?hN3TP{k6LyS>^IQOK1_ti(GpxgSiu=W$E|s4z#OFtW8T^Gm?ht&w1(^GO$#M363&oG} zv8rEj3?A9#=4Xmmy92jfVD0&z;z#pizplaWIN%O=x+-=$Zo0g}Z4lp90`rjo+!?@q z5t!Y6?az}4TdtoM?jOMY zCotDN!*Qgqn|_4*f56=SJAd4l5RrZX%=`YparXM3J%8ElkC?}Un=blwlY0mF9R|#g z{uIow<2j7K;r8Qq13qp9=0$K-agV@`e*@-> zzj2&B{o4IPJ07v;%8kkE34$;Ro+$dhYPhjxKF1PTd`C%Ub?skFo^56S_yBCG9XC<%G4!hjLfjQq5 zr{wMq{Vow0JhDsKt8fqD%ay>LRYft%IlixOls|n~U>FcTZu}@e__zk{A-Lm{z+Jf5 zO|G){81TCrnBNMVm!C=Q^8$lMcDdEmyjxW8-QNbbuTI2zYjvV_~pl*5mkepD_W zpou$319vqXb|`SS?80Sx)jO#^{%c_VCU9PUz8?{RPD*>=)tq0u%?=fA)Lz}b_oCRP zxaqRZghF+x330nCFl>* zz!|`8(ZG@3-_*cS{pGvBJt?sEaI>eQ-vIN1D^7(kmB0TK7(BAe%`b#I;B~?Nqx|J0 z4IG8<*A5EiM{>_NL=Sh42JR5Zy;uW>ElzL>MzCB8w{IP$hkHl^NAdg-P26LexW_ed zKheNZKk&~qa8zGA;Pt_Np>(-M6L*#dZX@_*HE>zrzNUer^*ygYd{Hccn=V8P*L>q- zygvn)8G-Z4hYT?I05Jbp#`)1Wj7o3z^n1e*i(((gO_yD+9rsya{+|Z!L0}$r#i{&& z`u~0k%)5?sldEtK1NVMl#*XsGeF3=hfH|?+ANL4wb-?U#v_Fo@qkVxnBmhVKTt@?Q zp}-MW=4W=U68;bu`TrV$k?+!b$J5rcAm}~SUp@rfCj^$#DZ@GVk$&IQ;79r`I+ptwkL>dD-=4r7Ah3Snk<#RMDsY(qeiWaFf!Qi>q^XyF?*!($ z0DjcZ{dr)%X5+Va+Isp9If3e#-v{PL0!R5(dhb#k`QaA=gGY9`;mFTVm*CvfXT9>6Gij?~pg>h1*fUog}bc;YNP$)8w}X zxNHEw{lM=cO@8kN?t>cqzNX3V`@lV^!SCbbC(gl-!sFcnLvrcz3g4T7`&Y*?YDozY*YO0{D@=@7Cn^e&BA_;CG)UzwZF|cmO}L z_ivi~7AH`Tz)hE5cq|tf2E>n7c+>*d9Kf#{^ad~&3mi%J;&(kT9}VC~?U}oP`KFCu zX*-3+e}4+hvjI5rUo7d&4@&tFZm$xYdwb?}z*P&Zm!FAWizdH*;5KOR+os9y65y`U z;P)v_ezya6e*ix!2Y;o>@6Uv*367_)7Z|W+msh+x2DoGZKMIdQO@14J+Z@1;@{PA^ z^1B+i{|w+q^{_7k^KF6iOGi%u^K1Y=8t2?Ih5P_FU4HHTg9L^F@#EFrKePnro<6F9 ziwmq*`XK-HYw}wQ+>n!>qy0UE^w+Z;Hr`1elWt`k^4dq1zq z@2kK)sKM{on*9C<-2VpfqkQ~zwToh>;-9pqAKANC!=l)sxal(e;==D_U^<*Q2S180d4XXJ@#AIh zC~(^}_+6*T??&Km3E)TJ@t`KZM}d1PfFHHD{sqhdjog3q>t*lpz|;wx>1T)kDE+Sn z=4>0k(tLx~{hSNTzXjlE{?@eugGY9`AD555G1JjlNL1qP4oatjYiN8bSM z=K|}e-(P^KYVr3U#jC@CIZog>ztVU`^Vd!VrbXbq?4WqnD=>Iumzy0_9<2gylfe4f zaRD%w37l6vAUkdX=2JF)?snV_%!2~wWe3T5SYVhD_;Is?%B>%i;M~*4lfXSAuwHf$ zzuj7Sm?^pL{FVZDh`{>sYt-b|3|yZEzb%^liojhIz>o5S4`}lHZ{WV5!S4}Gem?{5 z_Zs~6XwwUi{ee3|VEw|QNt0hEaH|6NQGRuagKTfg~x}1xy^}l;r9?Q zPdIUoepa&dC4s>szg*@c#qs6uz@5;+eM7&VUK%}%h6$dm=de3AjTu!QmSR=2U_6vX}aO zHUP89hAXwV0Nka({7&F#ywJ^F3b(CY=tsg$mshz;^@Dc+^X~yT+W+r;0`vdbdlUGm zs`LMU0s*3+6I3+r5u!!`4aOoG(HThK4oo1jD@fRqLS>1Nu(&`lpbVF>vF=taU#k^c zt=L)x*FZ1{MD;TY~RIyd_`+UxG=FZHWd+&_f_xpeS{=fTT!ZT;y_c`Y| z`*zQzK3;DA{xgMhZZAIv*I}51&x#jY{$sfFHKRP`ABXbBe%J}%&ep6~{woJ_q2?@q zZS@Ar+afUaN%~ULgU_$t0Oldhv480lFO28EYX+jaobn&b>-#p&$zG=KJ{#v&zw8H> zJ={B<`D;(jsKD`$Lp;;p0vqS%Zy#_2?Ec!~nfk_MsBbd3pQX{q_G1;8+wGh~eg7Dk z7CUDPAKQ<2!F*=t9P}L$?%+EPA6{0zvgK#~dah;^$UiRee4dSSi{~NWM%n$f*}-_J z0kgu+IoNR*nBUtun?AlZ$Uwiir?5fXoH?OR`P zr)mbGx}54EmbdXKoOAtL3GNcjy4k_>h-9emR&e*&_1Ve?!`E!n=hXhv-{-)+sadb| z_z28@H0Ndq)8ojI9eh3U;U)S~(}Ve?KbUhh=hm*$pCOu|K3-1g!Fj0=xGK$h*|7x7 zO3iuM@oO;mC+SPIgU^>Wfq6MeUnRa%FI>M|0Orah zeW~$6f3DMvSNIqY*E?~x`i0yLHqNQOXMgfWa1UtK%ic|3p4Xh4z03z~VD=|*srIrz zfA}cu!^4M{_?yZxeFuOEXwEAi32ZrqpHq6Uez_Ig1Df?r4=~Sb&hpox{cQvDS(3igcxL&?8QsBmFh0E8;+g*BX-0wg z;}n1Sa6cMciDtd*7zt*g=Dh4!0_LhDeW`ZvT#cK++?%8?m1F*UMl%rAg0rOu^>rE}aV)+v{+#t41nx-9y2T6iot2@!^T7?zK;Ntk^<4_?$~5{| zpZ+pKeZK?uXc~R_(Dw?Mf7v;Q{`jF|JNS;rhnHLYF?<8Tl-oH6eV2e)Wan(@OMN$L zhW_$$OW%9IJ(NaYKJMQE<|8}j5Wa)PA-~|m%gf%gzznr>4*IIVTx#bW?ESfBl*jnv zX78`S{Vt6@=I3o0>U$B~U()Df`}Us<^&L7M`2`#3}opXr4 zTfy9C=N$C4f_d4_Iq3UXGs+PBaZ8V^33&bkA6{iJ@AY7QW#=61eG<&`cFsXx8<;QboJ}9|OOFdBPSV-i7u?yJ^@_jo8S0x3Ze9lZ zq8aMD72G{(^s&Bb2J^D!Xt`VZz6a*hH2OHc?0ymUDd59P^rg1H>~EX~=1k3b^*7Gb zj8cd{PVF?umqBnBYu3w-OTk>JIk$A99lr!~calD5J2rrMN^@>@(B7?@fv7GgJ6Qj{ zkit3l4_*cLH_f`)!SwY_l(bNu;*VSU=7Kv$vu^sh{&5bN$(r+u=lNikrqRcEz8%ax zN&1}Qc_WyoHRl%3oPXY?8Hnm~i|3swoO3+y0{5y{pDw<^HQuyYRW%vE5nwR5(1CLj9l2eaMIIp}*I%;$E_rjOw} zY%=l{KD;bD9P|wVGs@1{^sybR0kg`^Iq3Thm_OJ#n?B~3onUs`IR|~;fH|Y-qwJ-B?EnrWT@{caL;C-Z%>B$_JR8)t_A-5I!Cav^xAbK>x*E*S({L=mw`vBW zy4?JIAcZS(oNxaVxJ{b1;>967-m&R(N)PsPc7xlmS+DfyR@K3mhYv5yUt2rK^ym*} za1xiA9-M!k3TB?>#NSko>Cphj)SO#-kh>Ag9ceh0k9#!(QC)87@lXoqoE{s&J)>DG zUL4Zn?>2o->B0Q+F1Y=g^-Payqz68{EPrk3!F<{u%=wygi)WUH(O@proLfB8pXr)` zs4l1YqaD@YF4L@+9oK@nO>@my zjXu`9zX#J|=N!gw?}FK9=WOMi;X8O1_NC#&%Ze8VedmHP?3{zXYRxEx_~Vuy3&CBL zMj!263uc3za|qw7VE$(39Kz@OSqEP(KD@l_Jq^q`cFsZH1kEUg_~T~pOmMYn^s#*W zB13(*f%{DweT=^?8R~lr+@3W0SU-2Z1oPDR@bZek0bok)oJ0Ig12f;wIiznRnA`1~ zgTBW!qXLLOZt3wXxL4EY<2diL4E6bD?0@J_pxfj<>yxzkJPTb*|~r2i$-R^o`3<-!yP@ z)97RTtpRhp=4g$Zz3ag|kwzce)i=QWJxO0`JI(&a7ht~DoL7IN%Up?L+@db0b~+!w zbOqO2vtD+b4`#UL-0~^=$MgzFKEuqUdG=pFn>+M@qH6* znt`Y;r+A^i|4!kY`v)E7VIL1ZysUU}=#Tf&i~{+`VIMO6?Q7%Q^3_kk1?~RY$|d8u z63hZS=TOeC19OL+v*}~Le;mwncFsZHUNHZ%bGCS4tQ}gDoKKzNB_CW5a6i$kS3V7a z8LK%fJ#2O`zbpWAMUuYMeA*LSBbYyE&TSmeao#^Q15sUW`D%X(=bW#6m!e(3hnHoC zE&dpuQ#GSN{&9GYis@DaE}&Vj_!|ReismeTZSlwFQI>*f(41SjL$Jo4w2jQ^3qh!}0xP3p4{!T~6^re^;h( zMUL}kQE<0v)`}Nf`DM5twdr%J|Cp~ffZM8Buk?5e%pT2I{yLQ3&b1wUUGd@N7Jt0I zhh`LrKTh$&bjt(RN3&kx3xEl0&MkaQx1WJokfbj)AF%vh1Lj)Ix!J+;dy8fus>{g^ z#`7KE9?-0p9h<;BuQ@L}+Q594q%YMDmfxH@^ds=$S=Vk9^&EOVwDSK_@i1GJ~jdN-T886S- zIJf@Q%i!M8tXsS=-+v9J`$9=Ki*x7?oerkN&e_T(^WTMFX4yFheb<1w-p<+Lg`s*# zGZ5u+=y%eNKZ0x3tXKNJ3FbY`S@zoOVEOH|2>BTwUZO8G-?RMo1ape!-0}hQOR;9C zkC#)v=Qwl#xC+gB*)ao5jpn@UxE9RKN&1}a_#K!(XwJ zoR=Nj!Mu{BFExD3&wIgqoun_7qa8;tkvM^&0rz9R2d?Yo5-(nM91o_q=B)U$ z#S85Sff<#gFV&7BaMfUL(j4z|3Lnq?-KQCd>T=>(5B(>FbI#8lufVz3`0#SGqYr-T z3+6)2dBw{dFiXms`A0Utcg~n)A{(63oO5^eq8%T?YDo3Fh7m^gRRSFB#~256q`&^s%4VeJScc ze0X`~gK{tzYR)bGm=6|#sZY|Enh)5IxB<*BHRsm;lDkJU5Y^?B4`|2z;Qp*xFFW>t z`AlIeGD)9vex3!UPIGQ{FkY?) z^SI``;$;VzH`C~2`hE$fL%nyr@SL5)!4zrEZGHN1a1%5GQC&{)!uEG=3g;XzSAn}$ zvu^Q1efNWDvU3jY<=bH1w{y03f$eY3a_qOjhnMBAgTDS?2H82AKGyeBG@}&akK4Fs zCb-%(`k1eN0p_=w^U4QLfq6EKKDN_)!2BzTOD!L?mQ?g#TolD^dN(cWjlyrem| zcwznbmS&U@_@nHwjT?FY-))@JycGR?*T%W!s}I2K*Q}eph0u3+1J*h5;pLUDMuC~E zIX8W*U#^XGDNmKZ&ial6cdBN+^cflI zs{l7CjXu_Emu0B$YH+{EK;QZd^*sS@YXakAIrx&%|KL_Tf49x+!JZ^(cU+}ystT0?WXS=Fb76#@nQ=f+l4|f{WK@~ zQtKhk50!x#t~s}MmGM7TGZ59K>LG`Ab%Kp^YgaF{ac=fb1vf{tRz9%V%k(fa)OS6& zU!~E<{PHB2S2X999(%$3D~&$Z?}x6&`v~yiC3d8y2lsEB2c}$eZs|sQr-GTKIk$9U zK3D+eiZmSCnX5GeQC)8B%nd1=bGvXmxOJMf(#@7%Xh(}ppIXT9f#OBw|vkO+-aJ%;?HJB zKJL22BNy$@>L+ZUah>=ga7#5S{bJaw(zjr73?#P-%>A09 z?@FJIjZY_pf)I}%Jk&AHh@_mP@`s4i6xIp`Y&?q_y=Hakv+hE-r5)SQRr`})RZz~zIR2<~#tx`mJN|LYWe z=#Sg{rM|ntZAqhV3b+rzgnudV!gkTg-g>xi0aJRra4Mc$+M{>De5E$9aB>)j}rXEf(l z@6x^Nf7#|rq3d^ApPL=zo(8ic4M%_fu9=wsPWDn?8@T^upwEAg*qTn?5#UbNteYJSUr7e~ z$PLbbs|Pn6+;f_xT~75Hxl4Y7bpw2Oxp8zi@5O#Se0X`;@t|fDh(Av8OgkRUfMYxJ zbP9)ljzhinKDf^7Y~gd@jsnwPb5?z7tFP$q7%qPm>Y zgZICa!ll+%y}Nvi&$S1CH%#MF!jn;AUjNF?=gC;Hd9U z8FH^?z;S)>iww9zaGideKK}B-_051|KcYMX?s#z38F1{MtxVxk^9%Fe>J%*I(`WZ0#@8qYccVzmqhv`lmLI{evI&pm1Wx;o{<41hG(}%(`jY!RL+;BAxvw(h z+MT%XXs-b~Iy`{qnegGoezH@2#d37FX2|h!;+S8a1oz*Xb;~b|zaxHcFXztjd{hP; zH6823eaCoVem)-h#%rBcezxUPa(94vB@M^&d-Q{Ldr==`8a`Wl8Gydt(07T}DfK~x z<9un0Aeal%=wtY*z(h3X7BA%P1@l}Q zj{fci^R?!@!q?@G*x!y1FRyqx9n9zqxSxVCHD}o&`Po{d=>@;;1G8OoI()jk#nYE| zyb9+1WG*Eikoycw&co^LI0j5018xkM#dgkS2h(E>nDv_Tvg0u@FC=p*cCftd0`qPf zj{g1=%preDZ|_N9hH1_%JdAQe(vF-* zu-^h7US9bx0A_~fEPb~0D20xzz_e&i?1w6wFM`x!ExoI<5w@O>Be$&Cz#JQ=Vh<2xr6U8e0T|$ zYA@@9Z9H#GGU|KY1*=s8wr-FL}O!hO0;fw8;itA(i9So*tGMCbRuzd6ZGawDe@C^b} ztvM@v4)wuhVD8kM70)(~;d=tiPR)7cgEzqZQ*&Pac4)zVR(yDQap!=UtU0gnT>++1 zb8g{dJ$W0LN7CqH{QVise$9D>uUjknCHV023f~AY(=_K6KF0HGF!h@A^7jTX8|<7d z|D6JT+rj)xbK2h~d%uMKwu3oztJvWdKIXq;!JLwYWBe6^8Lv4nJ1zn9bIp0h-veMa zY0fQtOyB3gyq88F!`EpW?7)YYSNH~knW{Oj@GS##z2@A)M}O}Cvq^K=`0h4d*bC;M zXVZu81TbZqv%+V~2WP^c>0oZwoL4^hFED>f=2Ge*=9j0zysSB|_C37iuuv`{_32V;s z*VfL^j-P?KR&!o<+y$n^&e`&nYJb6GzmVRJgTeGn=2GlX?Jt-CX*k+32u!u+yzICP z%$=IE;>BjiiO}~1n7?YyD_^yNX;0=->|po~*nxc+`0&cc$E_Y33ucMtyzGdAc}R0^ zcF^A)U_RBHmmOb&>Ao{5-BRpey>T>{p_=pRuPp&{hvvNOcnHiZnsc**>G3I;ycd(g z*W}c$_5{;EnRB!w0A{x4yzICW%x2Ab+3_lve{0UN!&cr{kLSIFc|v@6>GW_6Uw<&u zH0Kq*8^CPPoLBg^gW0D!ukaoGGRh@BUg2Z?(g%#8IX8XGf7M`CYtActcY@h$*Jmr2 zXF%U>Fo*m(DSVFk;21DP$y`c2Gd<1$GeUD-;hP5L>I}Hsz&xcnD_(4N^n|}}f%!&r zUga|96^ys=;pLWJSWlh==8QBP)8kw)Q#9vgZ!MTxH0Nf=MbP&MnA}$r!{@!ju*guqB%D^N}(@z7oKCrhnM6R=k%BiW_}WvY6r{56<``Q=M}!Y!EDWd zdyCBL5cO-GncH9f*am{(zu>;Jf8E{?Rz&tQMyxiX&G|!ow&iH z#uQ8#%w;@vai7*z;C`W5mH&Lmr_*O%vY`K&n!;I7XZd`;vFY<+kt;tx|MVfjP&hQC zJT$sIIA*YMPS48n(Ss|;m5mzM@9d(Yo({i<#*~c;ju|?oSw61O`Bdb zr`E|wSY0`KOlfFjWoY!s%JHGnvdYmFWrIUQLS>^yE3c={uC1CscWQ0b+^KV_&Z!J8 zTztm(IaPDY=1!e9yK2TjyTkaZsh5nKI=ika)x4>5=gvbYt11`N&Yv~+r;dhM%)+Ya zwe#jXGL;n-;W5F{!z+WMFB~zrGCXqV(9npX1N%AHS5q^)cItvlDi=&$ST&=vdOl33 zoLe_%TGjjo1EHl-sTmy{S5`S>RIt3Pa`4EpBgR0_thv)?*UhLp=loeS0_PXtj>?+4 z+Cb^J^9$x7@KsaiOslJ|oP~&)ia-WR$DUs>edg5pm9_Jy&Z=DyC=D#Aoe>Bm{yk${ z(d>ECr_QbloDm2*=&z}pI~^X#EjBnYDUqIo%NfE%$C2UE5eWV0p84z@e2mW%_$>8h zb!Rpme9ok?3t;f1S#zuBO)9TjFl+jx^0HAw%O(vUUNL^er0|Fdqf3WZBHN8B8!=`Q zGRq{kwJ>Pz+^X4=rq|R=npQV!_KZZ=z6(@#J8j0S`IB^>n>4*@e(kL4S<{iir_G!8 zGv7JBbGv6v!)_Jdp}s!8UqkQx_xk=1=`;)wEfN;M%HzXZJ5EDk@ok=&zbLuwTi7n)&l; z5F-7xZb8+oxznc3ol#viePBNyeyoPhzO$8QwjfPD{dlaBOf~a6Im=37da2%#X{8KMa~* zmqzX{Sg%w(t5k)}ePOe6`E(;YWKQZ=Xsmp5>48ScuBDxf-n-g5hRnZ&&2N<2kQwf0 z7%R8cb}`JX_KKWF!#voS9?WjIqA1r_dq7KRL80%ArnX|kEG?=qRyNi4G)h`(k2TD# zI>>R_e?!wM;B8%aQ`Y*d6-{;B9%B|V|Gjqv8gQyL!$o<^|JsCa4PORo=QT25vkbGd zfslsH(tbv%|B-ON2_Z8OFd7E*{tQ~N^`(%Yjyv4Y-0m(b+K4q+`PREUvz*PF3al@HV5S{?1)N0g^Q1DTqhxD_+S8v zWL=lyCfqon*;xK1ALyEYsu2yIY?N$Tcxt@(ZDpCvHyWBwHX3&CHX_D;xdrzrttuqj z%Zj%dt)&I|3=G0=1#vsqKR!e!95sz4l|wpSMP)UlPvlnyN&9|+&G#cxd{5&kt2gnK z$6<(9^j>=vnJrabo)JMl4~|nw@npMP%R=Vxl5}m!7bEc&Mp{Wn6(7~17*-)vIZwND`tBs^xmp+8+Z3^Qz`j#%k7Vl zPE(P}ykw$I@7~OS<*+KxH_SI+m(lxm!+bG}RzMe5Bbr?z{=%cmW){HPBtP5lG+#8# z=Ttas_wWVda?kRA`--qhyz>U0iPen!wX~zTskttvxM}4}sJfdsK(ntoGfIVg?6`Py z6rEl0rLp{jCa5q>n2!I7w-}MKFUrj?!;$iv!;!L|8x)*@{kRg)IXJCWfX$Um%oR0Yy@q838Y@(xDH3yXRTsz0}P zQQg6V{Ew9O&gwH^-8*4_>0T=?BBcdI8%~4L>PXo&5(XpRY4nfH~&@g?f?rYCQxiXM@qUDdO zI~v1~jD{;hDaA#;0s1#(gO&4wBD@)X%Gou`J`5r(`5L)t3} zQH!HCfs|kBe`>!`@(tT*amn*Pvek%|Nq`Lh(6UEYbsJEBs~{kKk|dAd(Hny=X00&SKI?)MU(&9J4pJU+KMt2>ivvSven`2QtUL+JQUxOZ!)y~&6U&qAcAI1Bn8 zXtb|y z+Ls;}D*0+*r%>;&+By`sn}NI&RmWq0z`x>EC?3e!P2fNG=lcAoAgB0OyiIeE&KI)O zp$>kt_I$$}th*wHIXs~&f^UJuuE-fdvxQxeSFI>#SELjALPc3d!$(GlceTlhLpz2eriU{%dYR_*5lO?VqO_kWc-~%HC@! zdksZ&><*=?ujqO-L01n4U5idvdN`Ug%fB#+x9hLB7pMZid`lC&vU<0ZFK$lg8f{DL z9W|;O8{K~1&WC$VbSJWXwUBlkO6f{SFDdEQkp87QPme%apxXZDEVmCK-J#r$N2xqR zNz))bsrn70(Q}nn`$|ZEQEn5^KL1ncn*!-N-%Bz^g_c&SCVrhg&1qP{}S<=NQ3a*j#S@Bg}#EaQg^0BqP{Cwju19 z!(v0&UL5Zo7wg3);Z9@Nrw|!F^P9cnS$$#*J19Pg4L;r8u7ka$s9`3}%D=M=_@5fVR~C=+^48k{xwpbT}dp ztH|*mPw#3kMI^a-Rb_cK(Z#DV7|>B*B+K!ujAXeNL`Je) z4RapJHY(lr@$I$Z`ady}^*^#n1~QyZ${jDGnU7UM=`P!1^zUT)0UcTnS5IOSbT9{8 z>@CG6l4?1!LY1usYaH$<9otcJ=!t>?NMEQ5@O(%z)EW=zE9J%^N&eXJGF%Lsm*yHz ze}gQCYZ?2i=H5{67EZR6Z1!K(5hXbsnNeVrM+*+e6i^rg&5E$OB+qDgwu@2n+9J$> zpbOh-yto%_RJdgSqLV|>Y`{fkn*Vq)`Q9cY=&sD=*d&EYW-` zf-hs%CP)&w{N)^#i$Ag4&P3G7IQAS!GIkG)=134Jj|4=#KW;^V*<5b^)nL4Tsp5Sw zYfudDrx?*bhle4|WDSmq%uDlNu+gy1&y*-KN}gMEJV)XP|BLS%y*GzT_ANRXrX8*l za4S+^7l#chja7D>Tg4)NN3T`LDRzQ1q~K6V-+z=w-Ktkvgy*@xY0NDNG_vRBRc5Nw>)p zn_VYuln>jNz&1&-KR}Wcdj`@kRWD$d<<<$2F8u~SB;k&MB;4ti+a-{s-*71;Jy&6$ zXZS8N6wzZ|L1560!!WVA_$3v3+bqS=R=8ziJZz%V_(r(*rWlT#fGLoP&6wBI0nZrJ z^AV~aa%#LEqG~D*+226B%M2O`=BS{B^{gh-Pgh&oB|1FEh;)?jtMMTUrJ9)GX>o_D zf^q_+FA&IVtWDsFG38basYJQ4-s+&-SX<@EO#bo@>fxL?Yf@TJW0oy_VX0 z?KIFDuTvfcb2u@Jta{i^&P6qBhE=5n`7C-<#JK42c67RPjpz~tp)7}rUThy0%|6TM zwK-&-iAW=F9vmv!bY&Rj@?fK(B}e_%t;vX9h)I+KjFPw2pp_GuwYlh0piuj7+>E)2 zaO85-6DZtzz6v$%%JyYHS2_*Ma5Io7E(fFYj{9`@+qW6LFvV4#gHXR{M9^Aa1S_!4 zfJF_oC+2V$f1+b(Xw0WDY90g!>j&!2tq7Kc2`d7K^MsMYddAf9E%o@1BZZ5bxe-G8 z`m8DEs6_0H$QG%_l5T+{{cuU*ggLU*>9G}RIzME7j3mTrPT1UQEZ?*n`c*QlZ1S(H zLfaNx{$w9$WlQE?Q3(gLGt$RYV{snZ@kn3*BWu;TyjA1!+YY1MFs)@sp08y{zA9^j~r0SS`vkIxa#!X+hC6qQ|gt;H_x4&h6-{ zJ7lAQ?|Z~?B(hR=SHm2MyHV6$P?*^bC4`+3By_{3oZ>f)$c0!17*jA)?rKLU7!riK z0=L4qO$_w}Iuvn;heFw2i*8dFIve~`h%OR-g*>UC5VIab3#rdg6_O6h8Zi;&^bj!` zy{j8Hhs~@YDi6&2RwynMjqZ*GKV)t(%r&YkC6?h_L^R596R^b5{zm3QrDOX>6yuo4 zNEg>&>q?e4^d6UOL|dv|S;tESFc8uRRRJu8BnugLLtm(; zr%LN)V2=0A`XvRv+CxijL5OdTgycDP0{uTCs$6sc%t;A8!;v0`xMce?c*_Rx2q&Q71Bo4 z_?K9}4zk>aL3&XAI?9qJTEA97`b_DYZMoeB$y5os1yZAu-hwn=NgqKHf4_tz_p+`( zN&SjZ;siKbb3gJsTq_b?S^Z>VgTntyT#v+k*Gk+c9THdE+!9xQO-@{KOHSN79THdk z{eOx3qn6xmCMvzCJ~3}#=D zwRQB&r2#fEZ8IqF2lOVl2HSU{TZlo(=e3xr!GzBX?W5Fi7oC+HbOLp6S8=NrVJ>T# z;j7DS_-XE;4I^{2&7rxyh8|XTQeef0*fXH}#ORGQb92)aY;GzHnU@rCDj4l{^SXpN z;KSB=%>YX{@Y|1i*2<{I@~=Ym)!A;y+8n@>SxvQ~uk9|FAT2-){VmJjsr| zSDxI*Jn4`hqsXNyPtL1gUX#h4>c~)?iw;Z9MgEm6tU9AxA&Y1I>lR}~u6&9O*g9jx zm{T4(EgW5%TOK(*j2%Sy6(Qy!t|-Wp(Nl2~rceCcIh%rt@Du!p!8^7EUzUdv z&U|bU44Y>dPg}FZ(ufiQ4b@6`9ZzsE$Gkf3>|IQGSVWO-CC{9ZrBUN&2C?E zu|fry)7zNJNxjhdl zX1Pk&Wb?=9o!a?j#qVN4cMszrVNvQ0Y+^(lgdB5UUY=Y^vS@BZ8IvlA|rlcxJQuWtDlB)l4 zNQU|~-t#G&DK++C4OKHyU6)TmUCnf7YU{eX7bM;1F;`Df&YSYBx_Vly7T3SzS-*_8 zYVrIqrZW)_*etGgv&5#t$}y9SH6`;)@y*1}r>#nC#2)Mj=2s(_C^ZM?Fk!Me@ypy3 z8Ol6`hG8f)j?Bjg9n~RmhEvOtq4~-!G8A*BBa4C?ScVN#X1kD0C+0lGCW4znPBmLF zKRsB@SRY6In8L~xw{D!p#;#T6hQ~cZ=45#DCMLP#w_uW6Zh?{o-5S18lid0SRaM3p zkta8wgiySsTH$_>URKhzkUGWUumWFH{N+IC7;`leT|2~F1BtGGR=NyxHC@qXjkl#q zJbsC%oYrr(va%mRI%ts#5V?4S&#Y%y ztyf3X585Zy7^(Vo01Hy3TI)PnW$lvz=cqU;gVaMw4?;RXNo)=CQIqQZ*Zxx;mJVIQ zKJ3`C0Y`|;twqHjhEVHcHZ!1o-_P0kB7bgwS5CFz zU%Cl{!s?)Z={_TRLqR-&fHDq3WT4mM%za z{D>!J3Klb9l%sl?sH+hjoul+&8x|r0%Q6Gd?!=yFvDy!mf-zW(;m*d>RG7J>7~k6H zxE(PlQ5+j3bo6&$fEu9LF!f4D!m{Ij*zYgY=_gAUm|sT2Ji7p$h~&+QPLA7;f&y8k z;97G(Re~;tv|7zlRzdoSa^ot6NdJN)+XK!+yvjN?2cTJs;{bH2y7w+f!rcey8s*ju zN!A=bfh3y;x}aJT2_?4(%B`|*Z7QsHaAk?rn}^=8VjC&I`S&k%!eIS9IV!Of*Xqwj zYs8+MzdI^VRd8~lUko_~k{H5}NT6en-o0*MlYyi^^fUd92(p2ZYiq;05axQ36yPZ66JHmS`GLlw$J2)XIU2+s7(gHvq< zM{deII9{ZU-ty6Gp$Ii03*rF=@_I_f$aP)GxoZ=o@jt{bMevq_cerwo!j-!~T0y~wNC zzPXSlssZ7|6NrY{NB$dfNNV*D%t`6Xfy$bn`Df_J|i_ff7RP|DkE^q4DR^&V+ zp43g+T~#4r?8-pvk)Kk7bg@b+m&{wSL5)>b0M%7dWiy+gc%||u-~cFTxKtarr_oNVAr z@C5PjL)O5Hdkg+QX%ECs5em-qvA#)+%fQVM*shPO8Zqg~XAEaP6&j z?4j8I&5+5aYJ13Ho1DK}&*6Jl^U;JHSHF=n`siQA+vL}44{6xAovzp-WIf>@9UdE4 zOw8l3t3Rg!i=O7d&1|*CY>5M~%eytSClA1I0~2jxGy4Lv!Q@m(V^qyr4Cydw|E$2M z-hu2+iHA@*-X$YveHg)!3=vAt@LZj5tiTR0R6eSDSo~%?yI<{1IL49~3UN!QpblVe z>?8_XaRXvW1s<{YU101o#_%^5%}Q+}6c#pfK-Hp>gq<|*>_Hp+tza{_J8W(|mnF1PJ%D%VH5!?y-5ZC+3E*>|t2mZSI=Ly97&xeINM`6fZuxn_=f=em<6@ z%em~qx;rtRRvaj<@}r8atLRc1S#e-3`G!sPI!`qyGI2F=#gTHe^$VxfZa7lzV?I9u zM#?h4AV{aEzQh+iH)&NEL%qPPm{Z&Bc67*zBMN`&evz zjD-mEBli5wMpUm}O@5z}(2F~ zYVsTT5A`EXNkBLzt4`RrxAudQxU>~D6_(>ilsqd*$}lXi2WtHVvRv!*-&w)#}==Pa-1s=@1fyzg2?3)Pze}u zH@FyZ8Ia^MfE7iOOCekkn^s>B3(9aoY$doL#-Ec_SH^}ihn=8hs#S~kBROW2qRwhg zB)0b=Ra??xOS%@4>}JI*g6j3*kSIB`2P2~H${NgVup1z~#f%s$29eQnRA||Mm2oXQ znfg(lZ;K_=RSa!rw=3^i7#utIQWIsU>IcTYRUezM8B)0d1C3a>tOxdXsSX)7cyTiV z`tzao-KtxkVPIo5r(|kAA#9jkRR+f(`B0CnfbJ!0Aq*Dqk8`JT?9>mZPagiw&d=MuuaO0V|GrVPq9bMsvb^6gF(g8aSu2;zvadMdV0-?`B9cKWD9e zswY78(R9l{SPKB5$C)c%;Hk5H{DwuR3M9Cm#>h!1k(|cpDo4)c=_BVR#EzWH!(4_s za;`b?$hkNzkLyoRN6t-9N6z_I+>25|btw3G0X#v6hoZ2f04t~=*>@<aADEP6&n3%*wRN|xe51T5X+L4&oI*I^IR*LIz*#W0okHf<*vo_YT?}iiWjZ{m;9qeX4OBaG5V;IuYy#MjXOqyd zMU*A+^(!p%iutiokZmg^nna$o5bpRK=KTUb3{?$IWEwoYC4l*6E|rKD8k~R=|MEE%jZlukgr>P8*#6REC``V3Y#s99L4G`e$P7^2-gY=z7i>1$jc<6Y zkB$n|lUP`mJJP@nuXTO3>zE^R)j4)Y;vBmp533uZ(m)EeJeq+lqh`K1-Ib7)c#a)T zOWU#*y5oDb&%wNkUv3^-Ew^Go$Qw5i|!)|rOaHU1JU*S z_c@-gDEW9k^fmLiq^>r(!e97NjPuO6HvmVJe2D4-3j$KeR=#BT%TQTcM;xewz;-f| z3{bfSJB!$tLny=8HMMe^f5rX$hC+j0As))_qSm4ZpoT0|s|Tg#b2uA;6|df+!280} zo5I+Z9(FLW4|f3O?3C$93XDA=i7@Q67oM{O;d+BM=HTlinTg*Q%Y-rf!B#IOQLYgB;G zf+T^%?(8Y}VwH!%>UUKhMzcU5LEaZX_!KH*QTw>{G4@;4mlaL5moY!$J2tAI5?4a3 z3yQitxN#Po^fU14KA0@Ep*rZG9676d`zSOqWdZc&V?N*zx|n^tEH_h5b;GU@t-Gvvu+3i1D{kja&IZ84iZB)|rkVM~|kV49B9VCe( z?sm|1Rjgny|6nH^lM|~+xnTb-a(MBFdO_B}t{2Wn_|z7Y37`1cp+hd=Mibng0~tlK z!vAO|rd~DVF@aUH3&ycgROiE4jfc5^;}jq|dUmm_V^D>p`ZZjYZ*C80{6orTUJwnM}bboV0IK1oMzFOJO0#|M4!p@oSM z9E17FF%rZy`*@5y_1VOYZ5TBF1-k>G2Yb=5Y0PRBRr#NiwC;?o=w0-C>sY{kr!@sl zus^W^@UhS=-@*iPtphMSq>Bm*$j#`vXZy+^-J~+h1(r0)k`_VwMwQhSkYpd>dPuSc z@)P(e+hsTg&sG_TO{>%pcR-RtxCN56Hf`W`t2myibfb{gB)W6DuKa0vAUikWImale%&S9lnmk=$ zje-Cs&G%HIt zkjegHNHWgUI-3^t= zTpB8qxinNJbEiR)$z0}EnasT#k{HhpgkIvB9{kGaz17MxGgQvS_$SHrLPysrj;@C~ zx}NFix>8&@GpA;i;u~K-Z_cVc=&{`hXS`>mGM7FwB^STkuI}y$NlKZ0hA+BN?#DiX zkpqx>F_m-}^IgdfeQHPR&;hs^K1e%+W4!2TK8k3}iQCoD4^hKgRA!umI~R9|&m$p; z&pHd~45{XfKi`~Hd*EY*Ky+@=Tfh#0i>#$`ZaU5FQyg!X8Yh0cHR{ioEkU+&AyG+H z@u*a5_u3#sB zNH|BYpeC-4cHb8=2Vwa#wu0LI1CC|mD=%0;?M^j9aQ(FVTb2(ULVBlEqZm^U+nr;I zeGMsIEND`^WI*&Btc=D<`|THsX>W3At?J8ln3#W>S;Y zfljHV(4o=mtlU2*>CRgca=`y?;AGL&HE{77M^&Ga0?Aq5-W*61Xlo9>gC6NKIO##g zU_Zc~G4`vZh>hP9gT;(-jcTQA8AAn2=Leo9gzoq2=C@o}4Se3p=Bh~f9vev|wp1K; z$eQbkkYx4a3`nx(T4K2kf+Q;d6Cfqz5EaVg6<9T`%x9zB7kqWNra)IbgC>TnJARSn z*#bxsE;cwKoe4=oGYpc1#g?gRO3X5wb=Kx6`$yPU7dOoQs!%Y`S$!Wfx9*y^H>=6_jEl5NZ zLb-G0%;b?ZHztp)xiL}FB|x(Ny#Jr-cg+;3>HFXUbvS6m$bL3ehUYO z_oFkJ?c?C*9emC9vDFr-HzZD5X8X8tM5KTv4YwqA^W@h`OPUL5Q#SAA%-TLoG0TSA zAJ}A0xCY<>CR_tFo4FNc8!f?MY0Q4mGW%`IY>{X-YdbMpq=4l{v&C(^B~7=a`H-Gg zW?v4;G8>Z&Jyb^LLVb~8N_z0!2MH6QeCL5WKG=Hi!J-qAGDj?Dw5S}x^c>)R3~(3t zFUiQ3S)_rGq+u+BBrgdlw|*V1rB1#}A?ayMb!_whM%X1S74(v>*I8@7aD>;R&vcR>VeSF6Ve_d-;zK`25GOpd(zl;SOszjfvC1cqf)bU8D^2#5e9I$i=<0 zDYdgQv;|nB1Qucu?{R_`jkJCn*GEsb|lVZkUi;CHVIKd)C zMJ&2vyC@p<%1(_uYFA#rF(0=oikpwHEK?J!tWh4z>h+2b>SxwPxnNlr<)SXigN(We zFIVcsxtmqNqgsMTBeHZV^jA~tu@FEtmQiIR0pfM+Dz##AhJK2;CZVEmj?Jf#D^(!B zbMO&jh8`i#MTk+B5aL5xf`{TD`en>F<>vVz346JTqv~g?XO405JdcUNB5gqV{(a4O z9^Q%>*4`2(1hNKv;C_<|wcn&jIaF{Jt%mVdgtum?+Zvz72p$_rc!(@^xSyJ^6El9) zfqIn2e$)Z)nZSF}?%u?PvFEVHsm_&+s@16YQZ4J2guNvfH^(9>>CG`2J0`qDrW7$F z2b52SBxApMkaAEOvwdqI$&>%rL#jKJZvO>I)=4)(lG^?qNY|>Cj|KMtbuUd=tnN4f zlDt`zubmO;BuL`#MUcc_?jVtN=|8Gn4sbk=?)dDS&-(buy99;NcEOvTGD-xK2Tb?OJ%>3xcfvx&<))U(R>V~+mz-)Nb{BE zGc0MKCDlOMtF&AJN%U=mB>LEnx2s=y)~+n|-3UqA$lqELTYhW#uMrWfx?4FA^lH5A zFjak0h3zp`eM*IGsnB@=QM=-Zbdtwv+zR{R$K#%j4Vau4fyY5R6VLjB4PC;ngdr+xUpbk#k(@gLeg zW>x&E8ZG?#WG=tsepL#iTWYm1^Q} zWMXXpij@0!@6EYV?uC4#f@Ig65_YR0^)EbEnmSsXw$|T_#I<=KQP#4O_p_;s#eeKP zWAqGSZH_c`W%!RLWR$P9wRB~8mVBOS>)Ft){k9EVIrlWSH=%jZ%|?g^HpYU%hGJ}^ zPA_xpI@R3i*MXt^OVf9F2T7vtRhj17Tj1K(g(c8znq%!WUPUqk57gri&gq+>T0NQ} z9f$8{#y^onVuo(nlqJ%(v9X&1QMOnj+QLzExVVkddR?#8)~R;uTefvG+13>%w2ycY z4t+x$1%wAp<*`yMSIXKeDVA-X$}v8G+W(qG$d&RdqNW5hC`BjM?;c(x&K2NihHbIAFzJ?#`?80Vn^;h z4w5vCg^;9SEQVxn7$?C^8b)r_l;&`OB`ve0)t2-iq&74|**?BAN*c1yAxZfBsF0*# zJPwjHjHg19hVe{GI^U8OLfWJBEr%rfo`fX&*w{(KSPe!dpXXW9a!Arxax1Sij5{pp zT}#5omU<+F)mX+FwbhFqT%)VkC%Re<>y$)St6{B3bhR4R#za@EVRdrF-UV!Fsx8R3 zTGkEg(Vb9**66*Przx$)_gHJmh7~6n!3C#CnP^z|8WDN*08ZYGL2OcQK?tNt<-;kZ z@BuXp55SELu1dMtt^=}8Y_lCJVk5eyps{nzd%RgFY82_lPC~@D(x|xw^%d2Hs=ig2 za2s#mjd=lK@uey0i={Z;K(MU{#B{AG2rx4s9HI$a7U zCTLnzK+&|w7O#Y@b3*9db1US1c8{nHbgNbra3^)kih?IqFmR$T-v5eYemOu1n|`%J zHXL1{LTYsb5<H6T3y(iYX0CFrPp*X+{^o~q<>OQ0eIN&%TA zkU!U&95y@UVBypH!}P(ji^f?)a`+r8a(-vB7ss$(>(tSlvb$8l{#-2XbeB3BJ%&gPp2G{MC-nlWio$5_w6%tLK3*nBF*N0<$h=jqSv>s@-7&xVy5vJ;bfogOsagw$!nB%CMi2&V< z)x>%~W^@yrQ<}H+a8#L{zkZ8mjm4LPt|^S_8hEVIQL;I8s;}Rp8Q?3L6SD?&{)mR$ zP{4e^^EV6ezns6RTz(wuUPE`{|6c13{-3mt-J&9$b_UZ9PikowG=&xVmzh?oDwiK8 zRePg)Q>n@kCQ3&_!QiuAfiy0Uq1sNqtN5kh2EO~9H^zrIv3?*{T=K)Rf*r$dP*}1* z(|2K9b?x2gk?3aNM=eTtS1J1y9O)UoG3ZL14{{w}^w)JCLzcGg>i|pQwF`@DQeR4y z+H`%Xmytk9M^fF)>L2wdHK@9o*(s@RE}}y^-D@0m2ShhDDBaAEN_WimicEBu#dKo? z>o)34PJN71r$|kMX|n*P&7^%mRjOvwtfiya;1kP9SUrmOC7C36zi%wU}>I)NJm_)E0(!1Rnp@s_l11OD$=QB{e~MP2KT4q}P@779^S1%SW-3c|9)8iN48@MBf}s zy4;d(fb`!=%YQ-ohmzJq5`9lW5_{i)B=e43r2DlBDJ!^ZR7el9q&!RNX-R!8=>kaa zDLO2qn5-yQ1a_`OWFrX>^K^EMeH~c(r&nC`}i!C_`4XA_P6r`vM)rpo=WJ%{((#4P@1hXNDzw051zb`@( z%^yG#eP38o2XxQHt(ztFf%J|FUkN19w+xc#`x=ty>ys0ELCkrO8dXS#L;8ujcbz2_ zqPHOT7D1BP^A(oc8q4h|NTT_5ND``dE$Jgm`qGjP#WuK)ly5yDNl2?9iEr0H5`A|; z5`7O?(gsV~Y)KzO`b6pTVG2X^l|mAIRggqqJtWa*TGCCHwAPY#K>AqedmEDI>xo$- z(Ki^9=$i~l^v$xQT1#4LNv)8W^Rj)fLK1yPVGdUG^`WGGJrB~SN~(bLnUbbK`j?Ux zL6TSAaH3gq&Tk-np?-Y{l7#9*ND`|3medh*qT+UtCG~~$zPk5ZND``gND`_omb4v` zq<%hz^73mTByqdKa$61QRi*D{NN*_VZb+Xi>GzP{R?^3iWaT0&7Y~vux9*ly07+IZ zE`lU07t3S7{S&$4Bsv1atQ=1yEgrq|SNr%dk9=D{OmV_si*#+N=W{I=0 z-)-Z=bQCf%U*-K&n){-r0h*=9jojeBdVri@v@`S)i|&0toV;#w3M}TzapHHfm9*ZkefhT_gHa;G0CKILZ#8o9EIKeucsnB!#zrX2HY<*%t9^?WyOz*+6u zjf(KauRSVz&4`r!RNGKji8C4Ufy?b!Syv~fjD3#_>=lI=)@UW@w$`1FZxROoBV`}q z3=TYhRsNp#_x6Idhz5)+@-VK*51DxFllk|Ho8vR@jXdH)l6QOS&@eXrB)*sYbo@3# zRSG|YB)tKZ?eIMMYPaW#{d zgV|}5w<{n=V(i1Myz1d|6brmP%rGNrHxG~5;o_>=--_*n@^+fbky(+8dANO2c6}TE zTG{nYd{M{WTiKN^T<|L5G{69Q3q5>f6DO+~Cf?=}8J;IwHSpR}IZbkidifI0pX|(6 zn9BK+Lt^JoDmR`#DVb&rtdLxTL$eBfJOwkXUyX{1N1oB1$wm&fwF7T-;vG}?-1|&y z9}iUO!>{6bC?yLu#JJRMFM> zP-Rc-SZxN=QJa+)snWnQ#MQWR*?Ys~9(}d)zb&_`UG$rWMGxc522L;eH>bPiBLqgumVdm|aTAyPu(@AF3P$5RiYK2&ByNz| zJ^&8V52}D9ZF~HAI=wgOb(5Q2gDShhyR3xWJ&7ls@~KutVP*5ahG0&+idMs4x~VxZ z4krhp5UHnLKQ_z@5jV372KXO&pP5dbW*bmGDR1PJV%{g7@|BUuf<<@-uX?#+?IG$E z1r!4YV6rkzh8lN%3QK#x# z@dh+`?N)*mgw5r<;B7fFA&vlq_b-Obt?jvO+;^{bRkW)EN%grWYb8H7=vSRFTkG>< zctSrCa1*lM8`2zMda_{)UbTT232(IXW<9%$S??5!y%#WEHK#W3jqz;?m`ilJef!A>nAF%4AswM&_5ZNHLl{C} z66BF6!l0nh_=tcS2xw#!KH7@f zhXFKzQbBD+Yg_5-DotClDxy{M{r_v7v(K5yuk z;{Cf=%;&{>wic|5DGKoJV9Jr_bFlO~1MRRBEBu7P-(2ach~g&I7xb|V6v zS0bVUU0J|`GzUdmR~B`kk0yOUp4nNsNjNc9y6VaHifvfKylPi_#U6gYhGoR7UI%!S z;5~rO_KNMz{m7 z(|s+{GD^13-)K}pV-|Aj3C4yH98~R$HB%3SyqOg8CPH3I3V977yOKh7A>_%VkS9%~ z8|3AXGG;A)<9pASV++M~7`y%hcQ4?baysE6mh6mx>aQ3f)4hD!VO)bSJ<#$Qpc^EY zup^`=63|m|2^$0#-6)8wDRry-i3Xiz&`g7B4C2Xq%CQDWkA38ZgZrcd`Y;g3?E;p2 zeik!FBq1B7M0K_#munB7vQ=1OyvWSESoK&Ab`@QB5=i>7zNQ=z)OqqQY@)}-)g z1D@_qq+4loQ}38cuWN~EL!4<#%++v>l$a#|k5_|Cz2PY_+Y#885_7L`vcx>tUa^Vg z!IT^plsyP=i%xsRd!&$(BPAw8MYv9((w39H#OO0rN{IoJHym%DyOb=A3i9mYZ z1JV*R+n_59y2hY{L0r469Nz`f^6(2FEn}|$rIxX3#EUYv7hnG$l(7vkGi@0=4X%+g z#@fvLQf0SQS`Xg7lrbG7U>SR@z2bG2pf{b8#4^?&0U?4B0HfP0jwQv(?G>kMtF#NT zXc@ERq$y)v%7~JpjGUa5lTSv-=%kR*2ni*He9{)m40$|;Op6tScgf5jMm9dh*5`Zj zxb-gNYkBY^Z8UceGw4`@CK<#*3Z=Wupw9qldAJQo%fp>OspTO@{NMTzzW!e-58O;P zr|d$G=E;Q&A0YvDM+=uxC}_Ui`N2acX11lb{Ag)(vy|wndQ=yv3b)*&4P2^lkVL}gLt<6 z_oVa3p(aHvx=P2Q`+d2~te}YFi&_=j0pvDxihg3ko->Gp<$9NIEmqVCq*cMuKBp?+ z#vQE+P6GN+G@WSBWP`eNPHC9ti#z!(mBoF;tw7z9rkb?g|OA)vHuIZ zw29Br2h!0E!j5&09YJsCYcj}CDrZ+0M-uyfjGHLm(VXaGxBQ`)e}3fMNT>qme{Pk- z%(paVMws*|{jqX*MG&&Ng7_c`DMnT* zaw3Hw`Cms!q~z@tXpeS4xYiWWw9XKw& z?2_(J9uYRXE?5IE=!7r_Oum9DG+_O~Al5B9naue!y?eYt#Xx$OOIdWN^FbgT>iiMV z49O$R8KWf+jc?n!zmp?Icxb|Ktot%34*j=WRf_*$%T+_SmE~oid`7mFg;}Q~6m|bq z7_`5t*mj+_KX(w7cYO52dJJ)-h39BrS1MzebPEo?=eTL4WqFq{4mL_hMuAHzF;wHyCRZUbt787 z_+g<(Gp7{B15-|H3YPs8&agT#bMV(PjAW0qFaUUl6-1>vD%x7~@ZIamE3&1+A60N^-^$aKo#3Z>)U_S%Qrk z$Fy{(cV~`_&ht_4N#WQK1Bx`S+QXHql~2Z61E)t5{jsqY+gCfQFw%f^dXYo}B5Xp0 z_MC?sAxC#GU4jVpR+rpxQgo$%j|>ixz&^ z;lt~6O7q6GL0`7kR z)Eb&vx8YxAti+g`qDIvJu2+-7KmCh5{+Em<@i-#87dvAL;19{#|H4cScWw&hBGb=) zPgXM9hZLaR>E)1uFGDw}3O%c@EAV9h8p`DCJtFHwSrLwU(v_9=T_`7u966~Rqgu{! zGw7YOZ;0MGA3ohFBLk-hq zG;4~AyrG76wKr60w^&?~%Qni{6K&52$1s(Pe@u=#Gq+{}IEJH;@SnF8+F3dgoFo8j zczu}61fv;Cn*0SDZk6Q-t4;#T++a0V#o$mayjiyS`m7wQsq8>`R-P|D8FNEf5l+xn z)w5zfp0ylKIG4vTOkGTxm5;9OmVxDX_toCRnzsj9fQ~N5>#xw~eX9DBt@j16Y^3!_ zC~9>Kz0YSu$JkK$%XahP%s|D^N7k2D*zX`xC#Eu9Gz6{`O35 z$A2U}+fWXAU6^8zCfeD_E#<=lHZ|ljvxUnp*ABLvAI+DB@bu7giaC-n9j_#8I+Ynb zv4=7V|jg!2VcBAbc^m)aRZBtW&QD|u;)*Ub#$vd}7;et2p z_m#9>gl;>Q6JTx^ohAFgbS^Qw6Vh+G&R$}6JARNN0}H>f3$UCkYF^@8tNlogW5mKd zI-q*>ld=S@>4He>d10CFwJYBKXilGIKoQol=?X4~djpo`p#LPxan+2Rbl&e&cCG)xNC4M4iE>Z?FQCF}tpow0q?g#8>y=VV_7nk{sH zHVEfz)Z>S#MeW5>DK)OW+$!<8>U6ZI+AT{~#=Pxa86zRDJBwW+Uf&KQha0dn3qJ>m zX1PE!r7}4J$gVE=ki4pPTF|((`Zu5OSHBMKa{nXva!~5Dl2(# zbc&yjfMRXMfwBfHEWD;c)-*0EjbD!b2eKQ=ovaC&HaAj}6Y)RaF&JgAia0T?IO69Q z+La*Rx@Ir=LB{L)tbH*brdqEojkI3ZVCT1Kd06&?l2;vR!MFm1$yb$pBC8^d@h`>` zy#&o|2{s@5F$Ny%ndPdG<%(pmZYy8a$sPdL!QpM4B7J8w?A2EJcR-$%LvF>>t>ud} zW-MoUAwCGkz;euf4?U-22!5#PWhnCuo9QwCd5nX+@IT54w-_h<#W+D)qatad<%QE| zl`p`Mj!8Xs61t3(;1N|vO6X;Oq-7eay=gg2f=jS!#c@As81sI!os&)6HC^Jy+g#B_ z=<5qz-C>$-({dmSgBto`*LFYVv#CP2>&Hrr5{tW4qW{&W@U61Wv1jhOwXSX$?QsKi z=uchXhdQ{VCs&jjEtVK9w67+EIBa7iLAqV$vkGkXGN1SYS>n^Dl{-gl=zi&ruCw$m z*FmAeQ}ROxPcOTu3R3bLjm^hj(Q%6X;SmGKiT;7it z?dIUbuxMd>4E>$N`>~R?701nJ4d7jI=yhW#rMXj1rp<`9jzrHxUw6?Sm|*SWg5$`K zxoi&Cjd%irj7Uj)XpM|*preGb+J$55&ublvSJ>{1H1EKP4$rO_9mS#p3=2R1XN-`> zN)E0V9BmDZV8JTco^-xLtmO*C|3;)`US1{pI@>X_no}*`)xyh>=8hmnp+~PcM_!1imUN(w*dujsvLuz#ax!c3YL3!M_1%Es zCuTN%pqqDj_eEH%^C(=T4`UAi>1gYVKzHJ?C1A0NS9BO2+O*m~5=g@e4dQgCHU%6r zKS`QM>3O9lCwg9Pa#nC;KoDx{l^e*e&<>aR>%(v^DmaHN)|>R6MOJ_-)wKi)_k9DpM1G8o2U0|FxJu~e z`w+w_isl`dCV6(nL^6s{VR@+Ft519(V3jV!nhfDO4z=lp(D$4=!<`cWF3}L z6l`dM^M_ZcCfiYZ<)$hl>Y^7m0@=;kaS~wxV+GD53m5avw44CKLx*;egxj93sDR#D zlzs%HMd<|~EiCLPOqPPd=?Zn`a3Gz0D47`yeI2V*oBvYJ*Hh2TIeO;MrhbU0ULKdK z59I~Z+F9i@I=Zq&PBrA|&Dsy`FsphDHI-`rL?C@kp9rLn>707d$Mg$<^fCQ%Abm`) z2QvNcJoFP|Ek2HFpr2E~;eBUqJGz`c3A0B$>;aQJFAbhpla|lJ^1Q9OAR0X*q%{VW zF)E@dX;<;AqmdB$UPs+w!bgETt$lRWeDtP+&T9E{4n~{Xj^$)u^BbsT4~|}eUgu`M z*BBk>UKh+yfMhKxGl1-Fuf{Q>b*Q&C|0h=E)AJfh%tTU7=WU6!oD~^8xoKI13 zG_kodu{)OdRjf6Na@Q73ybw)1D-V(*5c_qKUYgdSO}~n?&dezbZPH$G-MX!zFJYpD zsf=7|T`RPqN4MB{gNvduuJLlLaEqNa>?}cIEq5Xq#aEs^Bb*c~A6tY$fR~|75zhb* zn*mLhmjaO!dUV#<0!+_@DqcinjHSp7oZ^Z6lC1+EU(XUf1?U=4i)p5#l%;%k00&-B zT_nXDN&LiKxU|0_^eFa3{3=?qJ6;oMxqs|xa7S7f6>;LY6pNU>hv|nl9VVK_5WDSrvf;yDe%y;j$yz-F8zIIVaI^Bz5WBc$A+_U8f=bLp7^{h zC7~0l)|X{GQHsdh%Y1NHY;1MtILroW^4Dx9NvXVpfp0Re4n3-;Ma2@>{r*m0FL7 zS$B*Dwfg797L&d@AWqLfJ=-(i0s4pZWZ8=TK+4Nsf&LqP)bxLukL>qp*sH?!Ax~|D z19=AO27G(VNkwNg@m6JGF9s@cxVUb&+=C}k%wxY^_E-qin9Y8(e0}Af#B@wj7oj>1 zMv_SI;tn^=;-%2$L1q7 zubg3p!CDzAXb;Vj@>&-)_I*WHa2)fd2MaM(eh|97zpf2K z`_GgeXv=X5SKYRZla9w!C(0Kbf;)luIFu|}7GGBWch6%7R6BFle(z41uSXhm1ljVtBIBxnq z%u~JYluFv~kX7tKkq(T-wCA?<+hA@X!L)M$#IWNwj zI|D*#=e$mmm}Laoo%0G6*qQC7r#8|gtVk=n6a~HeDX*PJflez&&S^a|oDJn8K%W!T z26RBG1uio?O5$7jq65GpvzFOXba&>a1N+_Fh?@ zRfACK(0t2wQvBde2au$>F^$U42W5p(nPn31Ou+NWD>{&+mB&L{Uf?1Xk zZql-+%Lp;BsxOw14fMH~E{Zw(suSDGI(KV_@m9}C-j&!9a4QNmc5}`~e7jb!y3vaF z!#ctae`gi8hBa*q<*eF-x!tC3gmPEi8cj46)I~!#9KaevE|NRIMREtQNbW#cqQb0_ zi!Xw0{b?JQ8gfnClZUiw>!`BCQ(Thv3&&DtP248TrT`opXQEdCT5_)hE*^_W~|3lKH+ofvIrE^=9>Tux{e20fCtkY{* zS%8xf@f*tw!g!F~sR_yVX7MEgl{ZUzZJ?4@pBQbOjdQ@aC3V*-6E_}=7Gj{<9*HS& zdV0D_X^&G?vd7lOd|2?4u@B)JtCg57b#UA1yYY!wXUg13vT>l&e%n1jy6)%|AYEB> z0W#YUr9XBvkoL#E45Ssub3mp)wi-;PKW5el&Gm+AFHL5gJOiV6`VXUJ!Qez_6J{;m zsw~+YFQ}`lbCxh-ZE9%KFUv!lkk6m%tO~DfYZ}0(_ejZWO@EN}6XFXjPtZja7z5!- z;p8diLyrUteR_)o!%X=YYudt*n8bE5p409tq$r-XH12Li*R5I%omRzz768{9*~)yY3|(>y^04NR;_NbR_^oHaMd%E+Yf=_Ym&K+t)Mvf+SbQx&F}UEE@TI*3uq;BXZ?S(if0 z)tbs2ux%|XTF=G`QK7}c^Cr71r5psT0wH=c=iU3r9FPCEsmq$Q!R$;_!hR{b6GlS7d zGlNZo69XrK^C49HoOB=00Z)88?7!OPLyd%9)l8JJ8O|6u2RcENhdZa3ESx7bG9RgB zBo|(A77U`eV2L1KH*!B^B|Pg~xCRMF1JzCFZ28I9^>P=}sHl_b%M;t4fNU%Z?<^0M zZz;!N_PpOQVnU~cbBot%1e7QA2AeXhJB&16pC7S86?+EG%FihqxSKN?Ku6EQio@yR zR8)4dQBjPn*5RTFU%hs{*Cz~aZ?!ibZaTw zk!o*`zZ@&YWFXc)0SzbIg>upFM2{I~T}y$EByN|p(NK9}Ls^@K-L$O;0$J_h5n-22 zH;dD!cwZ8Bl7Uv1uzQB`(!9ocoHFWbn&j0L7_*N-C1)i&mN3ujewo7n6aaUoMkl>k zD0I^6BA^LU(!T(tJwaBG+7o;RNPB{bn|MwQIxuAg(h1WQwj5X302+>Buf}(>(^&gX zIKakC9!cc&v-)mII1a1x>Ts(H%}x<(cX4Q<WAgdFg6Brwt- zCz5F12nwu#iG`-Np)rm=f3Rcnfz5%YLQo(=SyYH8BrGHp>h+|qu`2x}j`=r}J}ai% zr?`2*M_aQ10@aC;H=t7~X*wr_AC(a*#X0m5au=x3S$xc80hvPZk$o zc?{Aeh9=+65T4TkFyp^G?3}00?lYfPWKE-~GIw$Tr)H2df%K((F9A)FY{3KSG+Xc( z8AW#i*%<^#Gl;wYwxXzcFFGiA2~us*M;PF<2aeF|y=?19$So1M$VuU?m_Eb*NF11h zeTO&A&+B|2?63s9mDMRP5)T^cNHnn}`W|-rZK-Sx3bkPo?$b0*+ zt~Ijx19W+|L^i*1R>Z$M=HJpWCUR%wy?=1pebE-7<4?BFi#Ce@WLDH8Faw+7Fb``R zivzFFYovoXkJpmfK0S!-Xs_CbB2Eip2DAy~#Lr;^Jrr@8b10&O@lZrAVp+!;rwltBvD5~mE~T-=TTJb0)Fj2YgIk&tus1Dl!z&M-j76q(KsG!@5^-0v9Gonmh1%yK7L-3Ah&)33vhOHva=J zyjukgblj#vk56q~ja%LWA+|?aD!lJbUq=G>T|AyQnDLEmVcg`K)cF>(0$`l1P|#j> zyv12WCg+7Yk;HkrOai&Eb+)Z8x?bx+&Gsqu*;&wAcUU0{I89V&O)-O;w;YSzQhpN-qvPW`YnhZ9Hwmgoz{|;OFn6>`3paU1YqqiOD4pPx8!gbTaL3gk%y(u>64z{Eb#4`zXROqvkrym`P4oBr` z(Wb2R?9P&d>;$o9M`zUz@7yMXS7ib0E0ASxkdaRdvUSL8=qZon!kOpotz-m8ok$DM9-iY-c7d|UB-Rb$8VoSfZ-ens%%-Br^1{nzCAG7infemr_iYt zF|K@atnk0k5JqqMkP84Bheey8LJf$cD+=448gNB%l!MvM8=g@!wX&shdS!AP43)#= zJHFf@-0o-JyWeVRmTaYV<_`JB2FV2*+~l`2naK|NduO+Tm0vzRs|C)3aA0Li4XqrKn8q{RabwE`juNkODboo5cRI%fWK>9|ByMT1q z=SM&q$B%(#3h!nhdpURO=OW0AGD;o*|$36>8 zu|=>ToR1?dEAl$fG_YrHb>uq$ZG(nj{!oDM>5|(<3=VVB&m2~1t z(YJ;$=gkKCn;@>M?hteZ&>MnQ0qKZE0!T+J_zWu(FfbAJmGQCXVrcYu7$mX`*rQXV zrGI4G**R?5@SQiBBpj|HrInDE{@=PA(u!E_7Y8zk(cE-xMlfKU3WtB*cKdY5^0%M&%;e7V8|se(u(u?69tjNkI+(w z8!I9=@lorn<(WAD>8y?^ob>3tF*^^<| zkNHtPc4;!8!H#fS%=TDfued+jI&?~;^&BjbpHYw5g>b9|-47hW(vn+-ZA}jLmy?2%hb`juYel|71foMJl`|`3&x+`_j!aQC1P%6>%=OYj~-gvf?Jg( z?aRltPVMCJH0L6vc{~jk%_F5teK;8Ks7TB7ddPXIsF**fXw@4Kqw?yO<#eM}%Q`g2XrF) zRVVDi=HbpD?+y^02(Hha(1zck^4*CotP?shAq^_cL$=%qLPYLa%uDe>_^kTamV5&4 zIg*>LkA)!1mR;8Z;S8yRcuY8NWtu}g{yG1KL3ACtl0EDBn!6LpFDKDG^w{9C%}3pE zf+Scv}ts4b@^VE9oLE=3Yeq@ArV8RO>*j+UZ?v{PpS&>N>)Gx=mloueM zOvA&%G}I3{m4#a>Fh_TJ8C%s*8JgA5x}8uRr{{IdNNj7~>!0Eet$hL^qR((l=wWzq z-3y_0-=={)|7uIeQPeE7_BMvBd%?c{S-HQ3_wl}rSZj7sCAM@euS9IaMOHsf4%UcK zfG@=7&S;&OD|fJ?Xh$4tgJ{T%`oiZTEk*c&eeXhCNMdA_X>&0kj<3=fmM)~yv3?)8Q9T3y3H@Cg0jXJf1n_P3hs_>n;7tq}MM!M!I4`l)PK>AFSn8FJ8WBrP@C?505d_J3hub2U7Z?jA zLuXC+eYTSQQqS8EGlTd4>$cjD>P(x@0k3w6q{CuuX|o zA(BK(P81~vL)4ddUv#=HQ>7P_C0>aon0jRgHk;&ogazgWs>}2=B}fY2T4d+Va2HdL z<1&?41W@S@l8$wRrr{2jCiX03Y9=c>X$DGD6b&_uLmIMFA(z6#?J?x@rewF)*>2qt zzf?*(&TAY@-wvg3Ly%Bhh&M;U!SHDgX_3iy#E-#mW^#Nnlj94S93w6CJu*4T=}gJY zl`US6B8yLGOK~O_B77p(u%)MKp8e-tgUko-gl=9w z(pf^4<(!undep}bgS`MGY}lmZQ&+ONX@IUl0Yxf1`!k_UHoLbSjU{Hnk|8W{=fo1x zs%T9{1RGXLb}tVgIyQ=!N04T=kkwYxIE2(kOWLBCW{i| zM>FgeHI}%jxH2)2>2e<8f$SleBbte7dwD;!i5Vi@uES0e=>?Pyu^0^75-r($HM-}B ztuhNG;u;sMq=Q~LXfnR(5B&WIn+k0be!)BHh3 z+|O6O*iQ@Hee+pPpTfog=~LK=K>8GRDv&;f$y0=LqBV{s!179La;C!?a7t@&b19wp8Yj5mv%p+wc%eVQcUO(S%lU}sy4Je^@DkqscurnDur zPW*_Hq9r%vEk_M79c>a$Jy`c@(?V3wua>R8VXPHDOl6m>%v+9QR!R*?S!CT`QA;O& z({Z{iMxwGSl@@t2zKnJ0N}5~k9HZbYPDO8n?!x$}V;=5c7v&yVq+1=@^l~(Tw(7ag z^SfJ>y9wFgQt1lo=`uLfNMhbF0b=!ZXC5l@M|rF}8|bH!ymQUnc_xex$PdchWd`xV zQ90HC>3PfS^=sGWz2t;iOca^J9e=RKdAFT%&6qLAl>sd+6B9S~d$u zxuZKPnj`CTa~?Dg-EubtLh0%<%qtS&Avl07i^~DSvBEz@6Hmdk0z6$`iuHh38rzuFyG@wTEvrE2B+gt(9Hb1KCM~(9 zOwPI&m@?>iGiCmaJ!_63)Ywj$QafcvY09A3497A+rp{0#3sPsUH)+1wOVY4JI7x$) z;jS=~Hkb=`(q^Nr{9NR$xlE+6CKBzCw5i^J+QYGCvg9*bgQS5qOqvgP4vHsf#3Ce3 zl#kDD(rE36ihcx)lH{RP(blWy{xmgdswHV;w1erBoHW>rmy|Yk?Tw*ct5^y<_ZsAJ z<3acWJ6R&oPE;(aX;Ft30+2(c&x6Ek6OTRhl55tQ5O+R%z(HYXyBIB~Mt zC0oaU;(f#tuu6eG5R@^bpEYE`;D$lf*;NCJ5R8jO!nwYNAzVK=aLlD3mh~6WCi$(5 zOrMoG-X}cc9ddks-Eb%($1BQ_6|k}p@$ga*J0@x#9EHPRH3XMj)^I3%oAhe#0H?qPy_ zlxS760PrE-Z~2D!G6ES^U=719D=eS-@f{O|A_%bZM2a^vc@z1&hC>lKMkz-Rndy6m zOA)!oDpxm}JzzK#k>mKZ@s#0?bA8`%DI!;qa1A|Ld|)R5Pw;atzBOJ8lp^v>(wL~* z0;Q{R$npJ%;ZQ`5vs{ieas1G5C?ZFNav;%$#qqzezcma+aoG6Wy|`($@x#6zHQb8G zJ;TF20Nju;3lePZdWRL?j~Q-7QicK2_{tR^EnanAJx$ii-da&<9uq6)o+#*EyKlMN=pwZ;%tU;QFa*% zsC}iAzf9%Z6pl8u+too4<5IblIj0x7O}1P}g5K64=}p`RvcH}a(TpbiKE|p7} zm-Qm|i?-b4)N3!!X(3>)^??vu6M6R?H=WDm)Dn|``x0w`D1Y+x3 z%HgS3XL>lc7!F0`_?~i%%C<(u2U?>RW?7?V4X{Q{3|gbcAHF|t@9;JX2zfMp%1BW} zDGzsvm$RSFg@rVB3!sP`o0KCj%gRHXd5AL)apsL5x_`*toCb1o{e*LEHxd+4!cSEK zJ7uyBujWd){y;BFA5qqX*4i zFkFhr^|l+2t=U-!b*>i;haz&kFC6*D4X{Sk541uPMdY#K53|sKdHBCg zB#Z>=H-IU|i)&__>z5`5MU0_SVkmG(m>+|}%+BCIK>^ktR<%41WXN7FE?Mx)2!W!k z>#dmY+`t?kwsL9X>OK!tlG(mqG72c70)r)vR4%*!BYb-dmm+cvP0Qtd#(CLrDI(Y5 zX}P>{y<)f&kt?iRD>AJWD85+>2bhk-qoSXF{K{}DBIhy6>3OCaA#ln%Fl7Y#@#QuVCu!$=dI);CNANKWIBT*40o+*^o zq+ljGTYmZuPkN#}ns@E%H6ue2Wt<~S-p2+n$6mvsh#Xb6eqJ80?Y}cTipX=R#=-`~ zPI}4OwqCzC9E!-Xpo?DKIR0Qb6p^D|IC8@St#JHEE4*-|6`pv670wuLN#*Y;yezKj z?=Vo@w#Tv_^)wBCGBGG(3`>Qw07x!UuaF=X+-n65;R#?Cm-kzxr}6Wo?mixnT7n-# zB`Q3j%0QyuLeI~-RKkV;T`6b;P+Sm|zfKS{_8LLQ0Ie5v0?=EihEP@9Vh!-+e0Iox z_;T!&5)Xty;9MFpJ3@+R<0>)3o3>Gh9N+&Xk&r_XIhvJ2@^ybRCcy?CPWIj1TI$B{#-MUjElnr)UbWOyi^^C&bmO(pSgD9s zKG20@w9x9upACm1a{NF!QtCr*z1v~96p`z3;mRGDX$>6Te{a8rK()V0JF$$3-qVuJ zM}((^mf^XclKodBRS~5=DU<~yr>+)Y!l~RdOA4 znS`+pS}cflP?I3mLDvgn9n>u77@!tGsddmxJ=H-PG0T}E+V~qW!&?V&p2xZNOC;n_ zM2K6PvSGqU~lYHdJWr=h3P{dSFxs-XQBh*kP^PD1b z^M~Qlx>2ny0wt~bqF74yIsCA%gT{VEq&!_^3eTq>6`A8>>k z%4D9X$W48IyVS$=fw5K*tvydYHzv~>Qs3ViG;x?U=39dYvz5{c;9_p9$meUlOLI=6fr6c z>Y$=ZHGL|D+tW9z7qlodW5y}FGig6_*h>3BF#wryC(?TB=GFMtB`G#A)KbqcdwD69i_>C5dsKtK> zWj&Bw)Z!~fi?5~C!Z%*$yX?fg(Prh>&yX-W8m5RbY!o3fJG4MauhuX5e9~|zBFDE~ z4m*zPJREI?LlHUdcRA9;vDt7aBF7`jAx*nG+p*9SPp0vfB62U`0{_mHPWBrr+a_`3BD2`il4DT0lsUr@YABO={w8vdI5B@x$SPQQv^BPV zEFLdriC{e zl1DCACm> zjYODV5HqE=6vLZ*fe$jT4P4|84$pcbdsfzozU-A*zYmV{S;4@_z?8tbf&3G*a3Jh7 z%bq1{lgGj$pYa3ZPadreiTa4cddlO4A;t@e=!F47ndF5b#tXv)1>q=68v3U4YonOF zT0Zw8UfV|6tv1qbwUPZ*+r|@p)(5_?TeJOv;h8@RMlvV)f{mGP1pa1a1`ZEQ4#Wca zlLuJ^^`FTIFMQ1xp7$TK;=7&5@0bJx%(hF=sIxqZ|#BmZvySNcZ1 zo7qynm1?-j9EvD*l29gVAWu6l_D)akU(Ixk6dg%>m=#RoZT;5LN2&1YZ3ZEg`j3|*21bfF5weY(kWSax3ufT^*+Np?kDo3iF>0~!`Yo{B( z8-vPCwKJXE>l{1NbgrL*hR$__u~!l8T`RnWXI*yHt#{|6FpZvgmNhzKqLs6M@ZRj* zS#7CPfnPwuVY{U@ZW!o`A_2f^hkWNc(!`~RakUC%fkVO~_+<&|2Xv<(ZCo~Jdm^8k z`z<8{3lukB>lh?AT>JTY6uZu1+p8sKXB>h|b(3$VUf>=k&?PH`14z6SQ(B z4zhC2&)%Q4H#u=xE9o;Bdk<|!lX)Kd#u!Z$QIjWxvH(afQg1byvjIO^F)WvJ# zefjLuKjIF&Qh0qXz)it>~j2BP#~BCKhagv z2){0YzTDLec!;g=0VxQ9nD00ro@mi*j(6wnleK(Xc*!VjIsq=5-yrh*RVWwnHZPuO zU>%S!X07*C2N32D#Srqs!!VRQ#2Wg74keR;m7@DB-w(AVHBDY;#`7GsQBuTsJ4JGr z4p~qHFzSJV=$%|aT3M796`zYB@e+@N^jpkqc8>S?Sc=7YgN4U--pf?!pil?vvBNgk z7rfsm{SMoKJfFHCD-Y995z|n)!$6zy z?_BBPxk%%&Ny7Fwee3F?h%u{N%6!45tjcZPkspg zz$4)_BS8@*G>Zi3wBy-`m&3ukN(T}fvEEh=QeBvV5Bo|dyG3Q&6pmba*p1(fLFH2B zuX~Yut6E*s&nk(d)t%_KGOIO`+dQ178*3HOo-Zlq1iv+5q0e%1ptId*zrBtSgnY5J)ja&mLp8`aFrM?MdbQHS}yN&^%TRUh+K~g zm-L~=JE@X7v+%UgF#0$@?CT68O%bI%DU|gN2|cx4g4jwvE2v8=x!ae2M5dLEeoFQu z$$j37!NfGx#~Ic;tb{cmeBF}@XBkZtQIqF{vH(afQtvUE{3=D0NzxbwHu&x|J9DbY z=6&q2X%MQ2k^DyF=wnCnv`IVJ?W@$Nr-+16awvDSQCdE{_AIniv!@hJ8Yr9vL2go1sRL&FeVCZ?HvV1@*hFAg z#8?iBAel#f#MgiTYcBqI$DRA!#bEm?H<~IU<;Nn!+kxP?m~&Ma4n^b$px@GU>W$gO zxuzQ~MdZp-t~AZVbcYS!XB$pM zipVumxTHzo>>@6QgLjn<&ax4UhH{Xq7XQwbPWDkMdt}fW`A()a;*W!@Ax~waS{*2H zINU5`%FTSIi1|*rNj1xp@6yFnpz*NBk2t)Vb!UUhrrfXgBKss;HY#bzmKj)Ro0oJj0=g9I+lbW*QDfTxdX?G@Nq2 zk*0{!<_cv!NqNyD^CgIN*+M~XU1o+;dLNotVl?nRPF!F#P(%%`=&C`3(O`Lc4aWO& zM+DI|9Ab@_m}`xA$CrK$EBr~OUhb((cCksz_=Ld>>U$MTO^rSa|9QLI=%*Kis^*WK>yIcQ5=qSkh zR6WNSqlgj{LRn8zUNrqS31Y(DE~rbwUfauv&qfowcf{vn6T2eD{uQBI31lv6aF5a8 z+k!ZzalfFH5ufi!pm)UQUFeOGlRk|2{785iuXn`9=0~U^YWbj0CXe_$CSi0EUloiE zx**IyVgPm&4b|nHy9c*rHw>)KDgudpu|jvp8n&7EGqgh`RF@ksDPsJag|gU|B46~< zGe(7<3!;}^6qF-P*T%^t)hWm}8C$HD&)@mC@5U4(E`EGL9L8w)G8r8;)`3Ts4;^?s z97qQq#{${KJ4gX0 zA4>b1@OX#P-cu*{I+Uh#^nuL*^o~gD!%&(Zm5$~lZ=tU-_A8?OABo6%Ai3zROkt+& z0|ccj^eK-+Oz&M^)~IZ6-~L40b}kh{FS+85mzcf%@>d*k zeAgL66j6bqE*##0y(;HNPHweYoaRaGMu!dGR~m~I(c(Jg>}DWuvEfiej>XC$ z!!;PH!EkThL~PadY}5U@C(b2Cf+9+2R4;Il>M8!VEQf=?l#cc*qOX;MR0}*+Lps?j zRW>MjIdbV?H-0w;l}nko^&VMew|M4 zm(|i92J-&Pj*DMc8LJi1uDeu1O3O9T!_{cG6p`zjX}P=udCLu#B68g)Ts;ru{ZMEa z{U(0cSKLTbL}}j_%6f-{S!0s~v5kI0kPn~Q0@+=%2YkN#ky!n(6j7a@3T2lrQ@aFHr5%D;qwf-wC4JCR>4Rbp z@&?>U+uvkPv(*m-&}iyx*q%Lrt9e_G9b}_)w;@bn{+7{mw9|v z!uXK(c|pOy_zn*|?aSWnBxMzDS>8Q~Durq*VjP{K*>3A?E3cPDCWDa{%y7C`RscS( zGucBCWd?<^nj~~XuKe_!1`vSj;eO8&er6N5r+m1H<63gt*Yze2MT}#pP!>2OjOR!R zqPxQyBW3GpQMYJ<&9%7;bq zC3&G;4-M~QJydM8+3Tr?ZZg^^qBi4&vP(TwVl+Ba5bL3GLEY6u>M4rURT1gyp)!$S z*F*i}$@T-ytnJpNzIDFL7GEGQ6YDwKx~+%~2wdkHx=ptuanf zL~&I@Sxpiq&qb9S=fkUv z0^WSM)+nHe3S23a^+0k_fw)m%g(}cBA9^323T;+?turwwVhq=cko@BYVz}@qYXmmx zcDKxr4-6ymuk~jb=(EBLVC~YngHT@Fr;omTg`ckFS}l~-yiFTgRPzt4of*H)D0D^x zrFAMLjeXs0^i@QCZxvQ=>r`q}^RCh{Nfa@ID@Q5N)%bU=bh5vsvTc%5`KZUY@q`c_W2PBAD^C3Y# z?TxT(lxHP~PI*pHrj*y+ zIy5MK;x;-+PaLESbrlPhh6O5onQMHxBL`R`^Z#`b(yjelh{{*7uZ$*9Aa`$gl;vYkW~rI4p3bv-ISAIRL;Wsjh+QYTy+ zj4FyKWv|4RA?NyaJ(+K&@ae}F47Vb3|Ceyb;=3}j_MK=t@R}^V= z>|L$!WuvJg#?@aalQhkdAQqRy1Pzha<#_z=`*AMVnhgaIpKaD4pvxs}2+$HiBY>_J zMCDfr8UwUe&@n)t6LbQQ_OF6+oXeb^j#AKwnZ}A}<8Uz}A7g|^t;9KO_1V_p8An*5 z{e$)n+&!R;=PC9p3RHnmu5aQqjDKz8#sVEB`~cRAOep)h!+28>V;U)xN!}bMLG)&U zAWioS-&Bg>d*bY=G4|Z-CxZ;1RqnelfTPUwkHjiM9Ny#I;=K`skmOnB@F9LV*PTWy zMbxTLB0h9kUoo;2QPwGkAj{{e_`YgnDWa^?KcTF^FEQ%P*G@&dYDKFX=lOU$=d4jaXl?FwVGq5D! zYYkZWpGdX2Mm4?&)VVeq)f7>+^Si2ciBawH?p4F<{4{3_P0D2(AQDWTTy~ceJHGEW z3Miri^Cgaa>jNnTs^3HXSiA51(xk4zDQlLSCm;%cM z>7-S)jKJ9Qe+wv5&yaIB7ijXZa&zbXG;GMXe7=R&)WDR?g@HN2Kjj2Y^;wOmwXyY^CIWr>gf1gYUlST%f1%k(LeiaspZbjQ zp>j<3<>M`!1K0Gg$}A$0Uea}u770?U?}#Ygc~o!9rwX9|714%!gwjbHYd33+`z4G9 zJSZrjnbxCr<}|Eb9u_$6JKNiXYhlJ)lB|$W2n;_d7DS~^)ld^3AKXnsypNinaeiXs-z*H2$p~2iC zS_J#nPup!w@%Gd1H>N0}DbI8@wecx!Qh+4kVRmDQczW?sOpSm(geBtF_?9QcHkV6qU{^sQMA;QJxNrHEV~^vdX9Oq_}{&>A!zou>v}tRil)Ie%n06_Im@aE__ZwCZt+SnfMnn2ltG z?4BY7<1M8hY7n26m6P%(uokhebaCWq95#ic5!2GuLlJ9fl}nj?DYSE?lRL_m3rW!1 zO3|CLlq=Z+l~37c^&)?)dX+04r2@ooo}&)FHyLj#qBoBhj-F@JP7@jmx`-e4^_Y>S zh|-FLvfd$~wv!}?b@dcMU1rn9`o?wF@IP*%P{b&viWD!0vjBmyK4CZ%ks~4;x=(Nr z_6cTNLmSzTmN`}t zRjv_{U$-8?=~DeOtaQuy>p*@K-R{ zzS@i|MU>Sfvc?=1unvn4vw{m*SkdE_Pwm1fEu|_Vg>sSVTu%z6lYgDcx8*r<=@M55 zMJ#wKmogvjMea=^*Lw<5r5y*qwirtl(bAiR<4EsoHO}_1ydvpJ#T1ccgGQq3JE}>H zM$KHmHXMq`@ntoaC#%isZ}pp~^bQwIR9d=I5#6a=r1BP{bn@>~`LabRDB3t2j9odB zV^I!L&BniTrIYC&!?2DRZGC)KDh#+-KyH(D6kwjjOr(f->P((X6sZK`+t)t(`v<~~@U~BL%+!tmz+)Nwg zVauh6Js;&Jm3M1gx_EwS+m1L9kA-+F#N)i+qHpmq4%vB)_;{s@XKRv=9l7+eQqyKd z%pIyfWqM!5kWTInk=wT}_%DSP;**9-w;As%q9(h9vVf$#SkzyZAe1QURY8Z)1@|^X z6DiNWwwst0G3MWj@N|{#r4AdupD~<@$oWU*Oj%u1kT&lKa)o0|4;87>vLaQ)!m3=}>I;Es<&RML-BhG1kwwLg zMLAL{QoYZDrii*9sj`8*nk3V>F{s?siZq?vqm5jMHXiIwuKHpjD7_VFI=RP*TvnvX zuUC`de@2CCx5)^KXyWPE& z7Yh}WqgoI-D+K{0U9<;=&lAJv!SH!%_$M~)LWzc^VGU3kMNNc@7cZ;n5(`VNbM@rF z%SGs#m9oyo8Oq?HS?Fpz0_SW{W(S=p%)iR#2gz*y-3$6cj@<@z0F9w z*zOhBlkLll?MI1P%j1oUmR=E#FIyH~ylm+eUNK$pVZ)p4(5o zXt-j%a4}CbHZ6@WT2ec&wy|+p<0tmbO~yCph;KYbbb-^1ewU}{H#yve*c))3VXR4E z^imPiu;te*kJm0a1iK1Sq#zD!gRyIVTDut0ybC^!n7(Xcx-@M}Da!Tu^Ah8zMaEHe zf>=LXAt(%Vp&;6Qksx+z<_cQ047s~@{u0XpVf`JJYyz_0ud9s`4I)xH2dF?Zq-Oq$ zAXWsZj^;0}4KJO)q}HmNzj%4A6>n^+?Oi@7)|n`7Hc>PSqMd66^-0h@M$j$)oS;6% z);-Z9Mvt#{t4A2@UzEE{xGxA|!hK0lG0<&-N`Y<{6ao6Opemp{1HTI#J`s&p*JmnAAg? zOB0$JYfBxY`qaKKdA%1^d08UM1A17D^4?Fyq>l;}75YCzEKRkai>cWNBgd1zo3hR(m;`wavNS=S6-40#_g2_)S4#OTp^R}U3Df^#rZ8y3dE4opyJVA6$zMwGB;euFvj}TM@G*VD85LQyb z_EMlxf+9ep1yuos1R0=dzPy}eYpemqpK>%H@a%1?cZfO=6nl}v% zbxU_$YiRcyT3VFuYB98L8QQQ-*d0$gIseMA3yh8{MMvtjNDw{n89`y7D+Mui77Ho@ zS|W(4vs6$i&@w?xod!WwKvxNx3)Cp68fdwodZ4(V2B0QED}k;S1n}Q}ebxA9jp)>! zf3B0e^w0HzlKrzv!b)+sXaC$Fbk(4{QP83L=etJVzl#KjvhLsquJ!nzj_z6QLX2R9 zuc%#G+lXFExTdx-zNl_d4RIZYH)FmceHj2}<%E2*Onrm3(gIy@JXGwF_s(E;!EP^oIG3%ac6b z<=&OG*Yv2ubfjNz3eSisL@J8cRr{*_jMH7>&Eys4YeMxq|2t(3DeF!!}6q#lbJD&9p(cF zI^~NOEm$}|KEI}Z{?etji%mX8p)l87=(W0CGZ*1p666{0Z^P0p7(1LCLEQhclsncF zw+qSxx>HaX=y>T@0(|0Yn2G6ICZ?~Mn7(dex?2!yq;CphjdYKoPaO3jFk)4P?T<$# zPWmI=%ZH7Y4+$y;$Af}Ofxa&&0`!2ODxmuX%?0|NAWtrzRnNz_s%6ViikH{a z*Dh>YjA!mCi{~#vu9!Dr!NgNfA76L+X*H*fU$~&SxMo4k{F({13+A6P>6D3+>P|g# z^5kU=tQ?m$h6|3f#x+>6CM$+K)nqMRi0D4OYpQWmyO_|Oo7&_q6LYg5Cgv7FbkkNr zr9e*!vg^+9)wMM=VR_SnlU0g@w8J;pHNp+b7s_-Oh+t5;;Chx{Cn0I=h5A^FpOIh4)KirB^goZya7a zFJ|02V@GZKK~a7C3};DQZC#|Rzk*43z4E+xpirS{u?7nY0=X7BBVj#R4cNyxvRBP(5T01d&X;LwzYV7o<#*RoV&Q)UpZz_43-;|&; ze3Wpc@KFM1G2L`XwIrN$H&yJ>a@Vzl_Z?k&@}oP`sCqa&sq($QssC{jAN4;$5I!sp zI=lKi94w2y4$7t)dvaP)j>z$Hm&TrI=p4m+GFFvl@lmB6d6I3x$ls+-py#_-Vj*9N ziO+Leh8fQqJ1@Fy`GV3&w*$|PhUBCR&rB<;tV?K57Nu(Djl-*<7c=g&B^D;%IfC$E zamXTl@|`sna|akiMKYF_&pvA`I=7AU;*Ikc#qnG1?bd3qM8;g1HWu7Sx~hbVDXeMD z6mrwr$t^v3MlEETsfB&@%p8fCp1DX6J}eGacbZ=jH$DbZt%>lN)C;`m9jXqJKVJ)o!M% z+Rd~HzI^N=8XSRBIbi+g&`<$d!Ia{i)%Tf~X;9dwWhX_SoiKn9^mNci|!S*|wyOCsp02g^C{jq;Glrz){TCY|x4%*aPS^ky8 zLdxF=!iTk|OUwvN>ajYF)uG$&)rYq4O&b^EOLzT2s43&W1pPDpHnp4{Q_C5jx87we zRSZnIK50Jti)c(wzbObG);>Wg5hQuqZB)ATbyB5?;&}+|%HPw*@96Wc+@&Afyy)cJ zp7NqvO3$jL+4~dT+`dAP?tb>A*Nbw`Jr->;byJ7h>yo6Cfb5XAh zEC%RW8yJ#qKtQ-?v*udnRn4`OsVx9)bz1<(KRx+YeMH}?j{uS`dS>4FwRQ7qmSMrP ztkCPWm*J!(1yH9!Y3`v=&s+rWs@BF zNp}&Dbd8j|^r$th{w`8)k4w6nBGUXU zFm|X#%tfw6j!$~B$el`7&H8GQE|sT6CmD;lWZ$*JiJi*Q2d5<6WvKVUdCTBE^b~QI z?5iGLnZ(TTvf6td7Xx5Q{F**z_%qTfT-qhHC-R`Nkq{g>da~DmW_63^P0FE<<~| z<{Hb?Mp~veQkGjNocMZ5HFv*+>e^QuFBctX<9tC(HSS_?;>1t;l8P9Ey7E-7D@aWS z9p7yZO)XLj)5><@xI*sIt8SikEa}O5wSsw8t#ITy-`c#+o8GjvMq7}%W5>?vR%a(h zax*0w((1gtOK49TenzON;SxdKI2cd5i*a8g)J&i21u=cN!K0h>nLfX!_7EG%8`DZ# z(r_ixr&{*ay7dwZtxE`^b=+H$-nu#(SE}1q(k33G^|I1|x1<$^8%fuH2o*D) z8qT74o8fdaaZfH#Q|JOU#St&n6&U%u)Cu%_-!8F`?<*!g&uz8_v*%4~jLTNVg|&-o zgmOd``Z!=llD7;n6%vO<4qssp@lVEZ`6I~ zj*+I;wfCnLrXst3J}A_bp-IhT(WIubZc;ny_2d#YjY+1a_0=Um5*_H0#{|(O+<4@~ ziJ$hR^_4iqnNpHF?xtJDncA)Yaavi9%$VrKwe5AJ0 zM`~+dee{%Q!}zudqK~*qsb?QKV>lqjVJv1rSvn^@lUA58_VDp@;rg_lq{h-oYHVMf zq?>Z+q!*2oxFgDSQfk(CDd}zxh9=#5#aOLf6=n_XsxWJ4SA|-*U6sCM4R=eCYTs9@ zb$bird(Bw=>m<8e`?cZzebQYproH}Tto)=;B<{u=)vT`;bx6##=x>6U*|{OcYlo`L z3IW|0Zi@QEU9Y#&N_JfGj@)JX9a`5*ZD1Z&8~SSd2NEA`|40yR=O%^pwx3^Hv#fDp zX#=(|m6n3iTgv&%8!Pjsg+)|dCHcFA_Ed$bhO|sI^v1y`(p`*ufW$(}vIWsHF2wAr zk5=Nbkx@(9~Q^r5v zT&h3lNA*Wv{g@{@(2qw5q93{JwmU!0D_g#NSS zrOKsTT3(8!s-^avRa!qH!Y(;$R9X$jbP4S#XQ^fMh+5WHj~pwp&?CnSqDQ#oxm%C8 z<7Ueid}e&l9)PUWQswk}d51as#I$koF0UfF%RJ+busN3XJ#R#Wu# z|9i_^M9CCNGDJlKm4qTv$vl?QM59I#(V!wzW{D6oWKJ>@QYjhIAoH9d^N=C@_ugl( z-97hQ^!q*U`~LUybk04W^IdE0z4ma70#gMI#~;M(*i@o+Xw$t#=<{NdF;|o-%`aj8K;VCGT4A$ zS$mu+D-sW<%9^~wslp$6{!^;Zk`#d6E2A|@W`l89>Gj1{raL5*S?r1We`bB*8i$j@ zHLkWv8AIxTlQN#X!b!m&xBgR7B%VTZv#GyU0F0;*mtda(|NVfHnPr?f>0vcVX8o`d zm&xSpe?9}bOyCT1nIO(2Hr#be;_=CUu(19o4_c@P3Dn!I8{;P6;2iY)cSvws#<&?{eNh*NhdW%W|g7Q3&>fV z)SB@J3Hn=7x#Zxaa>+q2G@Q4{S%P2m4Pv~4{$C0y==%^!fn)Nu)`-9{`eZyQ_^a1& zfiIhbWBlLpaDij#eHZSus0ZD{*P6lcV9JNny^Yi{ZZj$oWQ+FnG;enXrHlLXt1R+L ztt5VXQqy1R4?iesKJTMhX*z6AR?NvjPm4OUDw}NANe1J)Pkw!k?zL}a;c)THk55-l zDITib(KGbrA=v*oHU8YS1v`BdRr@6v-*{1fyx#KS9k0}z%`U0GVU})+LZ=P=L+Uq~ z-_knyY(>3Y%8e~FM@6VSSIjiF_xU{ae#-N4LAI`m!N(0@AADbXtdsq*O~q#xO&K}# zLss|b1dCH{zxTqi)`%B@-IZQlv^?A6`FcykBG^~=ZjmeYne-g$1$(I9apM`2bhd0S zsvLIw+wsEJ6}v)~%jdk=>Gv?a!?d2Umsdf(lIEN3_-Zg-h5 zV93|b3x0LZSu1b&<$sR1K9Tszt9y2Iut`S7ip|j8%!J~ekZrUVlQpmW+IH!_Drj^0%HatwpRO=_`{MS84M%$@mz(A!ooTYS^9yG`J%3Z(+dD4p zzTonvXJzrlz|lt5XLgV6VKRE)g^jVX{p)cV#_owN|iC_lzGA zu`sMSPWyH4_@;YHt~S<^-{1dPL)dreK6_AMJOA#n>8owxx8F~P{qt8hyIlY17Y_Sx zZM)l)TiD-#eMi5`8G$#yTf7@}Znl2j$hjWxyWLEFVe|&-_vu1cFRdNTjkK2EnVGgM zZug(|lluCc+;FK_Y3!8QrP>E)41;)W&lQfpGs!c(azbPEi}DF`!SAU!tBdpEG#xVw zDl6X~oENgyB;(uH-EPBSzx3f7i*?Jg=ffWCKo1<^z0mVN5m@lW$a*Y=rdyK^nhJiqfhUL5rG#+5rey2({E>bS!&te(o= z38l5&uYT~T&34~oPV(1=_GssD_u}9{-;V3L$hCcFHYvep?cg8B+@6&!^2!szzN{o6 z;(bfiS4N^G9nMUSO4ygIv17$b@dnrr3FxI7a(1g{gubKYrnVD~!2U$yxRGb44>}I} z?tv30-Ba5&+&L++^kS*XMNRV^`KIrVRjbQ)-`Pd2+sm2b9&Wv|&Cm9e&YT79dOB$; zYyEoXSQNHaZrNm;7DJa0gZ(Nuy%U+SpO>G1ct5&XuYN71_uvmW9D^O~;k-l9fyIUH z1Jd9a_Ml7gwf4?1+LhTn{pqP&h>K~7J4^+=z zI^D!RYQNX!v&P3uHn)u2I>3Kdal7dXYnOa}XZ&H`;RUv^pQl`}W%d1~Cky8_wRpAa z!ASdrClw7h@3w7Vy=D6g=Mmiwhwg6JMAhZzZ1=3^dds`+hrMmC*2hEF@;}|lQ+p7v z@h}qVccOp8DJeVEbb1`?I?HGOreDC*`!t-qT-kDea?y1|RgEG+Uq zv!bt6j~{PU-^|5$$M`ij-i=?FVb^4HQ?F~2daYXCM9=X>mxqS>|E(WC{}b1(R-c_* zu_)}qJKqBi|E(YW)VHaJ($*c3AHH~ixa@bQT%)s53OS3E{#$?R`=-aW?Ynd7o@b?b zeg|ewoUk_ij@9qeW5oq1AsI1hnVqBKT1IP(T&DiRIN-;b^+&tCHhK8*lQ$a=^u7*` z;l2Q_3$WkbF0SkDJ{^9VI8>>6DMl?$9N@ZswnB%3axzK{mOf6dn7HwQ?$SXf z+bUYEacXu1{Jfs+=Srh^vx;bM^hOGS{jd)^U~tTcx{f@yCN};HlJ904kB|JU<*+>bxL5h~goBT}ji?vZc-tI{mWFD#^Iei+mIiFF zG;+^4WbkP8zs_3)r>{%yetQVC@ATF8PxN*?|5nGbd`!6BkPyo|8oypB8ieUM7S>(y z^QYcR^=5U>&wEqHcG#nwqAN2zw~f17bt+je3HovVue&`e)`(aBiHBbEHB71h#iw;e zixTBk&QTS|O&+DS9Q5nzhqo}H14TEt7d-K6{qkR@Cd_AflntyW9uFFjtDYun3 zIn+b?ek8u4e9Dz}ZJqwLKf0=5U!2$cifG#rQ$CqAKiGSU+52kS@!es5z<%_AhKCMs zDc*g3$)H^hNzY4y*E+sEtKpQ={$+#kauu!X(&sIH?krBe6EyB}>8^HhkDu)?IJeZv zeCmD+{ao8dk)47{;r=`J_-EZOqvjREewE$Fw9D5YTvR@FXGrD60n>oPUUT7jaX|Gx z^Ymn$`m2tWbppSzhxPtX`^$UX(wBcIFmMaL(Yd|)+zO(8Bj0?CgfbrjP!n^BBUks05pk{5=cB}ur zhxJPz6?Uke5p&|m?UeRTQIOB=*^3q#=S}?@xJIpXX4(psJ@R8xU(9>d`PBj&-SOj0 z{0(&?P8$WjDmS%q)Uvx#d~a7hGlx_2{R`lHW!>B+o#*JT|8LLt8nvZjYpb|?@E7IP z>$IEmT%(0g0}{2P!W`~?8lSDzYH7HOFIJKdxuehpD5AYvy0zFu2Jl<_tY-8cau`yz8N;8oB8>znoHd~ z*7tN!%ND8BnfoqqeOyAn)PT=BmU~1Vuk-cJ&7I1#*Q6-=>CR}O>G@{q&NGuu9GWlG zP>cH6w^?a@yOlN<)J^O3t7~1fsn19MR$5OY*JfLW4&9ov=!@>WLSxki)xGu|Ib(F% zd)(`HnFAGUwwI=U4T1C9!k6q@ko&MP_>&K57}M|g0X@A&p9X!n+hfDT;`R$dZ%hfS zm;b@|^@cu~Z;uq!3-$S=m_K@M@#Imz;&!||tnhnNS~ECrUDm#+AX`K3=R0?Wv+OFr`eXQyFYI!9C7*BR8#d|cr^>_fsFmK=(<{2Er z`OH-jNd<4)D?eQB@Wgc1)`QS4H7Q8iVrJOL z1L@N9_Jc#^)5q7tuX=@_%3N9}uDI!n%sm5wK7Yu}fv|T6NzFNuBd7j$#>9l~{EcFjnx=Ty^ zty@96_U)7F8GA}6ao3=ZuX-&U>CjtYa@Qp29s<<)bx*x7gOW#}UtU z%O_SV8EjjdGCag!ai3mmpKF{>DvCIn^Q!COW`o8z(J+0jHm`F*@71c$lP1}>ONeN1 zb^MV++42#4?6>YT-ZWn)Z{$>S_3s_c4SyVKUG{a!h9@77+6O>?yy&iS;q4>Mk=i?c zf7oT)@#L|Oaju=mKe`Bc{+XHI*vre}flk%>y_bBh$AaCT=3Ca2d1HI&MqGk*>|8;w ziS2Cyi@r~pf4;kW_d_s$>dsu);(6DHRqs7@_rL7EcJHpwR==~yCe(qriq7jcubtm< zWX$-8VGoK%IKw=I^&|F2h|8!eI)gzsr9$r4ry)%j!hCYnwHi23-ZK~S4C^$UuQTKO zf(ylpS<>g>x>0XQXVcT>_Lk7zKdnD1cPc7Z`)R+2aaBIKa`p)CtsXC(70)$q)o>Jy zJ6LaEoWQyc=i$1nuwYkabSIm{Eytogx7zU0R1?6&LjzIf#1 zJj!%=73RI@Q;)#Y3-+3Z4DIR$dAl5a()rxkipmRL9L1&HZg$V7XBTQVysg-DoSMh5 z_z{zj7yopd>N&q5=*Ox>8O_%99&Kl{v#Hzel2$()G#n#MQ#YHxUzy;3H(}K9cem4T z1|->rb&FNWyg223PQ|3_y8G%I?>UzBPXr#sCUPa31@4r!Zt@uco?&eK4(7u7yhtdqYC@J)Fa~ha7`Q~d_ zr{$=bs+@zJFWM zRrMJ&PlmN>a;-E_eO@NS{ocXy_9xvfZES)~heRwLYFXR)lV0d8-PNe;l*8>|9Ke3nwtz2rnUBqk&9@JH`J~Bo7++?u zY{Pt)e(kY#z}Dfb<2tr`F~ZJc#pgW*_XFcA9Qw~Q>KfDFU_{OwdA}@`VV(N8+5|rA!t8y|rdh>MF^~{zJ z4$exqOtcz%Wbu#9nh7utVV#5caDTiaPFXHzTzKL}+uZl(jHXnU+bcL-@ZPIndOtt( znAx_UmD@FP5|&)^D$}}~Su$aeTDv1Aj@FmwZhw_yoI3U8htkf9tq#639~T@@)+1G? z@!flK#@J4texh5R|L(@}Py94&F7}@suW$Z5V|DK#)=o3`ih4(FX&~3-#r{`~Bh!>C zs@e5rsGQM^I&muIu#Up@_|oVUlRUdY=fpqyu6rhmDwOUo=km7`rbViCPxrmL=gg!j zIlkkDxW|rpJrDW|*8Soa$HN*{Rq8^2!MuX}IF+l69{IC*A5HO#tyOMw8W)Hjn#%`u zY$WYxZ*;@CwZ`D?CyGu5R&-&{;m zGy;zvUp_1%-#+fT+pYR56Z)6gX*5;Joi=cwJkQec=hc^$ostSzxO{3v|W(%dEkrbDY`2l@9pas5gIw(N<hUH z@lP%3`*usrf^9DIrPr(fU+W*_)hnf9%dn&_zoh$ZWtWF%i{x{UM8#J3ztU^T;>oKw z>KvNBCLj9ku}kJpzwzN_Z5PhZeBpQQ6!hEL!RZBa^wht>{8*nae=WNlh^6AITbwyY^}R%p2G2}bGF(rAOEyY<`tg#J#t*C zc?$X*!soqJYl1#EZoT!i{edZZu_ebZm*qFPUKP>jZhpgxkd@c&Ms13n889h6t%vGR zxL(6LX;pT>>Rp9t3m4ziuPS@e!!)+EQs@?6ep;;{$8UYs7l+`*A0F*JnAIBA$-zZR zWgn-m{s8O8zt+hc18jmr#@L2S_t)4q)$WZ(*#0aowRZYZ*MEb0>5CIjj8fmi_{@8< z;ZyOO*rbcjs(nir)r)*$t8;tOm7n`xH|g5!V&A=6{&YQse)~`FOD%i-T%8`MT&>&2 z*Id59*9ykXoHO-0Ul&_t?q4)J{!B~z@i1=S{o<9YBY)1k=y3$rpT~<8{6vFAA@F`7 zDx$T=GqLv^O^rvbAB}N%6!#@=e^Aog@!%hxV?8OjWNiQZ+e5g%!1E62yj^fi+qq|T zxbBng*Ppx$oWH2N$qT=2Lx)ZMQ{JjWo%)9x_D=mlYv@Cff?_viGa*TK4(Nqr{~@?ZK|Q)=|yF``rso!&>$jviRf7 zexbLQG}mz++q1=Sy;dFMcDs=-+jyTySuKuzc*XqTN3(wS?@lbV`wC;}E%Z1l6K3PwkD|)+V z#rj+JrCYC0y6d(FbYZ(3`_^-wGw|vf>yW7f3d}QF)*Iepq+`1^BjyHQIjX!2bcNw< zZa%M{7qwC8o_VBKi!|x^1kVlO{gz{ohT9a+Xzi?eT=~7??S_KgZxi*~j&^@nu+TFo zz4s{f+CG=i(M)ZzZ*`8X^nD3DmzY1{*8MZzV*A24hxn_5xxkvUJEPit{~Mf9Z6$6oEf(%1EN{=U1@ej9wU0;iv2EX*~zA7886(6oCcL4IQ zEsnnS;b+RqwMF|vyfa&xcV21lIcHV%tfYX}+cajjj=wXq({s77>~t8HFrH&prBuh} zcv`eiomj7ldvrUPpV9H_ZSTx=T>|e%s<(XKbIjslhpF}Ci*0^PUVJq)Cva4nF%4Wg)2Z#&rUw(Y8{HAuk?Dy}Mql0R6LqU&`sWXH(hCIRi5Jz1I`PyznJa!++BJ!U`AL^E>J zg7C7T(&Gh=!{4N=Xn!ex6V!7|!S(3|$6Ut2^9sn%zm8#kTxu4X?arY-IEMQH?V&rW zRaWfZQ{3eA?1&T73ZegF=goC8d1Bg4DX{Kf-|1#2+Bb3uUY541=a%+c7mxLo%Z2qB z?lb(yHGQ*R&9guBH{2JPTb{f*xTN2?@}&!NRNkei=G|Xwt~c#b1J?xi;ghTq&f04a zY}m5xrIEh7R^M@2*mRD|gVsq$Hwa9vg6xA(j2lvzP9DQYlk?!{mug!|P zDfvA7czsHA&Vx6zr?`c_YW?+>NdNrop55!c8kAC!wx{Q8qvrO?H|C@T-`#5Yt<3uU z2=&!Lp_j(R{Wh&?I`l!%ljRN*O*~>l#ctP5PKvNteb6=XNz<3vrWW3}mh4-W(O*vUkV}Y(eNL;Sf!}L8ZlOQm{si&{ z&kbQb!T5pW&5d-_BR+Vyf@3%j{-A%Q&l?V$c)ZE4vdQqi<&bKtPOpMSx&CkE5#oEB zDPDbLu5=kbFPpr4+11SSarfH$ZrC>_#rh2#!(M)hzgff!>-aBzdlXZ>mnq$yYtcPi zF>QaJyFZ$@ExVMRFQ?FESWNF#L#9;)Ei$(%g!2vu{m&}KcWwG4|8dFQp+|;+zpsmO z?NdisT7iA8)7uZNvLELrg)1(odfe$X*e@S_*(-YF%9~&(z2DioX_up6Q$1(z`|5gn=A6k-y_T%^+K{N)dd!EGsZH;l>QVpptP))~5AzI;^>*)B zk$BxL(j=&lp3|b1X;2U2Aq{?41tyn-Ep;B6JFsomPW>ACA9; z9;}#qgSjw)gmyp zDAf8@RQ8KsRnxY+1-otz%5pQ)Qc}ERtGQxvzv229>pq+rZhhwH_p{2^Gt_q_EHeD& zaN9c6vj2_g=9;qyX}|6~e{c8ltOI*>$IcjIH@_ls@mRlUhd+0D8gR6DqodpH@&Qx! z7TG1WDcK#S8`z?7i}}T_NnSmRV`jVA+;aPDuB^K4(!CJ}S3l^}A?1)`gHE4)Tit|w zB^x#0d|JI?rjF5-b|1{YQ}rjC-=EYcn*En?s1NMVb{f(zbC_o$_$_p}vPSMn_pv)7(mS17*`WGf z-xgyM~@KlbW4s<|xqc0&Yqu$Mj$ zc5uG=<%eC;ZXX){C*9~H-4eRnPaCt%Yudv5(WgHBtG*shP4}wBG^zWidPCgdE#rQU znlfY0pZqo1@$lTpCO$`7>h)<^XT}Us^+aF0>{d=+{W6_PHs2WcCDO8C#LA;}&BA88 z3`{k$>XomWAos@H_dyG*n1I&x);?ZtsT6zQ>*1SSEtI2-8*GRe-G6MRJk;OiN?WsSpBEqc zQ{LjN&uY#ts4&#ga&&%qIzq0i;`cr2*IxV{{?f_2-^I^EOu{sW2OHOA{ao>Neeshe z^$h=&x8ybc4dSP?iT+dGpxqVYHZ*Q}cTen}+6{Sw_MCllXy@F7D?|R&p5XfO!&CJO zRh0)An)yr!oAG6|foV%K-SF5M8%&!0o|}Da%~8L8;Z0Wi_k4J;k!sSaKh+Q7{V5Kd z|5qOVWZ$ul(bZ)Y9Y_8v{=fYHDQ{4}muCB04^{sb^rw2bZ|HZY^Jy=~f7N4k%+Im? za|=q#H?MKz5{8u2gPpT-UN`B%TVDs=v- zlG*YotdG|WaX zZrGpvKz<{SS!edV`t!%1bloRwmhZc?e%m5*zn$Yev#wn0HTl;o=bg8#??&_p-r%mN z)8wgt-If=VUstYb_25LClXb^#+Y_y|DW!?sm_9l$2IT&-f8^ky8u2>)m3ybslrz5` zX7_iwxaQ*$kMl>I^V%#+^4_*td#9mU1HX(Ir)~2`E`a+YxDF3+^Y;tT^K#!1UssI3 zNlIQcV5)~ph+fa0%f;eIN<#g8_59q)A7OGt&pinJ=c!N+>;?bjqP#d%@=qX%b3Jzt z*BR5aM&ko~QeK=#xa3AJ2>%N=j^ID>lo!Jd;gCx2q?*4`#(yh`3)aYqB(3lndGQc@ z5|#e$kH^(mS#Xg2Jvp*+4GyM&e7%vp7`$>68ZeiN@b}yxs}PS_AzFUqzNQ``@?!kg zkhskQZuK|gVo7T7-(bp%%aJn$^y*FdL1#(LEW||QpUBCJ@t?b5Kcnk6xKp3hi1Wi~ z@HbrlOM}1HTVCuy{XD-NqABTzt23^Jycqw5Cyv$f^11tx_2D$QCh}q*w8a^j_{!>* zP=o)5R9-v`Z_&@xQ3}374gR}QdGRr{#ePgfKSB$33pM!9f91tJ z(H7Ua_^l@GQ^`CxBO3gdrdX5S%~N0K2Yp!+^3xe@ad{E5C{n1wnfaFn{}HmhxE|_S z>~Xq(Ur$LtTz{djmq8ln(=m0D(0_fxBS^AO(VzWFXgUp^v|p%c$9!T<%y`p~i}*S!)@-NK(VK zYcSC$(mGE(IJugODtV1V-7L{x7n`)t9xSMjHBYnmO}!gJ4O-SE{AAeO^Au`qhz8o# zWbw!np~jY{*|wznbx94^E<2*hL0jBk^7g4R)+lo4BUVIX4BzGGy@^M=nl+Q_3wz>6 z5p8i_xFpO?942Tx{tk?q_2+EtUK2?TSDz6?Ln5MA#w%~1mW;(|@aiouCL3@lv-$z zYgFgI$8sf_*=URV!nyZuH0Wyji_4)K(LfIIn0FQA5NAeS{C7Vd0zd8oKU0b3@BKcF zXu|Op{bXvX#Y@(i>kCh!!D}jR*ZIPdO+t-VEi~RlL$1!~Ro#HeSA~9jh^8aj;#kqQ zbsq~gzO~T!5e>ep$33uq?u%rhpXs&G_!CVa-lCt7DCe(2KLJG38EtW$Z;Y73yY6r~ zBp%3nE3BE5s5M9ECy3`qwkDWpkTI#xo%@53yP7e^#X?gTjUT*v;4?RrZgmlAX4FCx zN;G(m;yUk7&F&=hGqV;NJo4qmcogCFC$4ewJE5PjT4?Z$K+g)$7T0O$?u1yOACeg{ zz8Yf9-M%l+2{mN2i_Oq^T%RIC1r%I5hjY;xdGX)J{5+z;cR@JT@&ng1gnlB3247Wi z`TlyYjJ}9OXKJ40$ks&FLK9sJ&3vL!LR;LYgmsP~n&xPWOM`e{8U2M)kLrxu z{pYa}M>N?~Gs0$bmN3==qA^8V+!uut*T`6Z781?h`vRGv`m97-eEquqd7q5y@*<+a z^B5OB%kD@n-S3Oh8F{f5QHVqZvsR!1F0ENo3(ZoZQ9)a5eX{PwjzT}nYN1IWn!mSw zInn&RT`Ou43uo_NeY&a^^;unuSZivbSz8OuI-+Tfwm8qS*ZD-EF+f{f`de$F8&Byz zU60Oi&;9<~Ur9uR?@6$x)wrx}LO&a7q1i|@e;*s@a)s)Hl{i*KqZkcgEOZ%08Zqkl zHt5yyr%7lE)wGMd-`GqvaKC}ydv21rPvA6LcpCf+O{huXX=MA^%F}3CCH zLw$mtlm!bl+lj^jZSmUDDCzz?Ney?6OC_33NYDtqx)63fTiEs;L<865lRFk1PnBpp z=VvF;Sm7=DIevEad7+#f#dvot}hy*v$mE-KXQBbs(-i*wjxvHdNfW93Yye)DM2o zDAXL}Y4CeSNe$QbLqszeZE;cT*S~{g+c`}-IwLQ}cQ5$5QmvoZLZ~@RG)K|4KKgOp zH|T~?gD%4oV{G~Zr)EOUky>bQZ`O=e*?w?M{-rrq3(fIbXigA~5!&Ke?wk;X7XF&~ z&gBpdDO8`SRMTHct3;?dMKs;1X8M;A#zM_$o<^?g614b9$2vna{qYw440$~p-Bw6z z&elScMKpM%)k8l{HV20Y{hT8jH?&2IoM^#w%_&07d7kD`_ROxXemKCG(%h5 zn&wr>=;mFzT^EUl+})v9KOZ+ommq0PPAxRKL<4=gQNO>r&`(}1G?$15>O4VlrH#-} zKGAriEzWaR_qSh#ngXJ6L|Z%uhsCG{2{o6A2F8!gsVAd_nnI#+LR%cm)+gq%P;-T7 zCZR2k6|{DdmQZt*Xdsr8eG625={#Q}8r0cjt!u8k6irHL&GlMniipM%Z_$rRO0l8P z4_a=}*Z|Efo6$1XsNz~^(6s!gpHiZMw#&|QSuOnBtc9O)o*&t5zf}v(ZJtJUe(n$r ztQ$4~aWdAZyS4ChuNIp7JdJd_+`Z6g(F3BHgSPm(tF~*rvt++>nukP#=R4Nab#X-v ztr=rs?g)w=p&#^{eYC~brcG_td2@%;plR?I4Y!6rA)4$uB9RVyrShT_EdXNlO7gk! zQ=-9j!DsOAG@l6W6Q1!j_?}Iuso-hwGd-c^IZuP{H-wrOf7Nj9dPy`dP`i4dSNA5K zM$3$JyI%49R1a@`?WLeyl|0QnJ>#E3&1;^<&nmfvQ1gbT!S{7S&0C%Z=TNA5$J5}x z5Nh84Rm0`y1JRVCyA^!rak&0nlvL^beB}8VdPRQJ2SI*5@ie&3Ld|EM2KT#A^M$9u zITUKDYN0`w88qf$tX|6gWh3L>Ig$J5B}FZo(%>eND0w-%auwb0Zjnn5T__#VJc z?vA-+ySRDLfM`!rkr&E$^W+R@){7JN`P@}-p z=p}UhC8^=+Lw=(to`{tA-sbs6^-;q5H0Jri^-&bmrwLDke^)Eikl%QU(G5De+JtYL z*Hco%)u$=(V}>;7h3HVr93-!~HgOvK+j)6$FRFR1FmJa|qf9hoX{-iCVKVMTRfxs{ zX>j?m^Z{B#rDHWG8YNC5aw;)9C)B7CO*qn^7osVS4rmdT_S1r=*|~Hbdc!KMX-PDA zT;SrCU4|}<(wbJa(6lC+iO2_fA-d%~0y&ZP(}rjoQjJd2IJD48Yt)EFjcRVc4Lc~* zv?ZD$NQ3V)dw*$;x=z|pJEG}}&f_z;ExW1+HSLK8&l_Ae%y+yj)Tq}&qd_#dF1RdJ zKY=cK()H;;G`-Lk&oQ(7h$2Z1HwQI|2Ie3h&mAPjJU0$I5=|!BHbs7_5(CwRezb^2 z1D!`NMBBujK6aGw!^P@EG?KA|n$ARn<6u8y>fUW3)O6u#uGUvj6>7TjG_In+WbmO8bh82=TN9I;%RUWB{f_Q z@ko{zbB{f_Q`w>llv{c~rPHDU!y4k5&H@JC`S9wKDxBlj14Z9J<+T|H&Km| zW|XDTN=Xejeufhbv>o3^*$c+c2%ZMNj}vM}@-(vjjN)nVXN@HNaCII{G>{+Jze5~T z3(Z)f!S{9Og-CUG-a*N>bFsz|jXu@nACA%xYQ_`IA*8|29NsOvZz8GTayWr#+N1Nh zm@NB!V7x>QxmfsaR$lyfKa&K0CJOvG5Y1LDl&E9Lt60hUaIqYT20w?yrMy#UXQ5^? z(fmEnPDF#>q2qfp%af;8N&4a1?o2c=ew2KxMmkB;?ib&7FX+-l3 zY4Dj9hD)~zHJ(KCo@%BXpX(shcoB^!)g0*k9lec^j^#}>fmAbXX(!Y?X^juj1W}Fd z)W&m#8egLM``GZSg=RX@97eJ5S{Aag3Ge+5H#Yo<2F4G*r=2b_ez?8}Aev^h&an}x z7ld^Vtc5117MkE%XhLeCnL#voi|5V}jXe*Abq*z(aH{d{7{$9+=h{A#Xz;rpw2X_C zx6B(O^fQZS@cM+yjV)(oyx$2U8ay_zuFv|#=-Ht3*qBW;(v(NkoI+FXC8<3Abd7)eS`R_xfxkn!nd4nP~oAAN=lB zUi|m^Y$h5jR9~Ex*pQb)g>BzLG3qBaF3!XgVPUdLbIO!2CM* zO7eQKlW6d}OY{&$ba_SUZAm}enBPS-FfZ^uz)r!u*iAI(#)!n)Ft|ssq=w5+S}kJj z5yVOp#M&!}C8^?fM5=saE%j2iZk@qG0F(ZIF){)^=1 zLO%zI2IlG0uZP2hnnPSHw8g&C*To!_)NpxDCz{UaJbEEom!kCSkVM@Y^D4C6w&0Mj=<}}?4E&%U@i$t>(Wetz#j9Ht|TNdd&=MWA4T`t!6^>AJ!)Z`Kko~P)=AKo+O)k1TLXz;ke zEn0nv~vIP!BWD;>Q(kZ#vyqPc^%c#iGA=`G{hUC4_iyFOQV z8rk)^N;IQT99;6nlV#jzULzW3P9h4vk%Lk$UFYjW18YL&dpkFwrif_ZdU_=FQeR08 zH|B2;4a^Jt_d7)r^MV^2#Y6+wuY2QW$QT#FSETivgP=0Pnq4{M=$L^Q@+dPF9_^s|I*e@rxR-*VherJGRmglPUgm!I-9vggh- zqH(14c^@+%P8h3#Xk4f!=*(nv>5v{{&xu9_Y0wMN(v3HU2sJN=rVl!g=a`DeLK*j& zFNww(ZJQ#EX>x&+q#tg6y&@WzU-(|@rNsQ=G?hFJzU~M$uX!5s*&Yc$+&q0lG-y(h zb}dLAvRJY{oaQaj6j9B`dl{}m%{!twLN!ip4m}lW-V@CYs`)8eA0gCyAez5l3qBIf zc;pB7(!o80(6WbL;j)g~p{)jGDFSj(K(ctm1$}>uR|p{RgYOZ!0^~jb77P8NfELiy zM|I^2Ccz;=ZovW5CCJnuk68gAA%5Ike0}}V%FGpPg)|;;T+=Rf>iL5hV)f<4!WQEw z`N%X=1RDHgiYwp;zn|n2d>6d$RJ8qFychXb1_)Wqoj;! zk}1L2@DkTU(@hN3Vf#~5Gm=@|rQ`-9)jU6qWcpE~i|c4+HGq<(jCfEoijftR6f<&? z60XioWyX3cq2a2A+r|~hMppr`6_5Y{St%g+i4EWLeF0IVZ!%W0R&=9eJR`#?nInc8 zMo?13$bL%P87ZY?Ec5f0l4XoEpv(UlM!Hf`!pLB_L?GfN?uc3-<{Bljb*CB+7ClnJ zip%pBN)|ECS(KiHxdwQ0db-vPz+WxDG6s}J0-!4+@+*HtDz2k zYde6EnUo|ma)pvmMp~e|SzKm_A-X>$p^RLl#G8?}_|X6=bH!j~ONj;ZoJ5H-)3i{) zHX_kXrf~rx20v#g@nNJDzVxBu%&g2Pxyy(nCERT4FSFn0QjHU{+Dgeq416p)#eEN87)OUXPj#CkwUDkB>BO$I94#h`JZAkq-Dq3Y8*822sN0aI(xCPNSNQ%qoVGsf_HRvG8Z0xq??VPnogmDszf9%*v0F`HUn|;wXmbS14J?G%qQ+%7}sr z4UUMH*k5LJ9SIHB(n$j1!6VK?JVM+;;noV*$9b4*P>BCbH)ts$WBh&nXLUhU(o#f93?l}V z#4_SSNj|G#Bqdy)@!uAUIX4p9%~Yeyte#M!!#sCr#TkS%OIY-G>M&3~p$4HAdB2pGGVogZ_YpEwC zTn_ij%;7?+naHfpP_mkl`;<&zq=6b2y_^v}O1N0*GGmRQnlM)9AWGITKZ_;&a4XvZ zN`^73%K}XmC3lz~)wWy>x%!-tSsz2HIm$dwpyVO)BTpR6r{pms`zd+ANI4~s7^#DQ zRYeNSK`Tlek%ntm5G60fK-N&QhH26%abTpBl3R>?rG#r~uFRIUY0uSWDvM=HNiHK{ zlw4%w2_@H9tY+$*A1+p*%vk-XrZuzLN=a8nzDfAuvZ1a~7K<*02M*(TyK|~AmS8o9sA|Mk4BtSr71SC;FQUxSKKrRT#T>*I`Aaa`0?P@6? zJq5&8KwJf6o`9?ukdp#(M?iiHNT-g{b+!|bAOTq?AjbschJd^l5F0J&=n9>r$pisO zq2#3q#!r*ZoYfOX=2G&3kzbSyX2iD(XEj?4em+sMgONU6IZY(9@}VSxkxi7uF>;oY zQ_PQpHs|LABgK?pE=Nwj;SuMlAzpqSy^Y8z=DB`1?sz&Q=9Ih?Lo324ImNSQcV!E((cZkp2$2;qa=-yJ(OHvRxc^xVkygvrLDtx?#ry^P!h~YAtf^y zX{gItjbYJ;QsT$RVoLHExk||uMw;u1NV(6*L`t4Al1#~CM($GbmXXdqM5MfD#GjH9 zMhYn@X9Rs2Dk*mvnN7(x<80kaF0#@fylpJ81P)e>a%_>T`99qfD;X$gI#r(XWk(tJc<>pYDtdq@+G0TPf+nNFgOrjK~e;{G=fwPhOf(62mkJlq_MSloEGF+S_n` zHZbB$i5ep%lq_bXjV)*8%E%N-k{H=ci5DZ~l(Z2;U$n8~{Ip`knUd4YY7-?~o)cx} z`7YITLsnci>ezFhr!hZcD4EV;?V_XuBf7&mD2v zIFi$xVD&jf3D>UeGTT*e6lc|hSxuwFkdaoSIZZDXYY`=LndTNHE0|{H7|v=TBPwG# z63@s1N)i~c8^>vuGxCCxMU2Fb=QK+g=`evK%NWU`#Ga8U6FH3oBbAg~X05Q8#A&#U z9g&%_wN$ecS#cxbG9~qxpRbgtFw)h5^W2<~VoH=5spH6LdNVSdl76ht%P5)0G)!fmxY4bAA*VnL~*u zBQGdv&7wO^;jCIRQbx%sW@Y2TX}J0n%B;_6s_De6o=~F5JP&o{{G4Q(R7yC{MKV2$ z-8d_4W@Y5gk;aU~Q_>8@;zrAFO2#oV!-KPG%g7B%+!z@+mD8v*vW1csjMSONX*5~% zd`fyU(#(_7cr!AP5)DQ|DN$!+8znl7bob)?Xfbk>l8%hncypT0j2xzO6RIh>UTBfBZt%t#d_ zdl=~(&RIQWc8Fe@2oh8P3SiC?XL#Gm=M%KO^0vIn825N-0^&NYs2zvyu_r7>?{>WF94Z7`aZ# zX-2|hIjb9toS@_tBX#3A%}M!IpBBn{CM9heGJg1Rk zRfUH%fXj(s3E5F=1pb zC1#9#p`;%p;}bZmL5yTjV$F#Da!xaekx)vuFp^El4n|B?a8|n*nM=uDM$S|6jFAB= zIjc%WPEqoS5xZ5KrjZ!tPC6w67!j@JG$R-}K*B!+f9phS-mog~i6n2~*ySTOQ~l97z0 zZQ!iZ8M#NvSw`YFa+*p;iYaNxYG|3vX<9Mzlah9fL~r6WHjMnH#Ga8^n>o#MM!rz; zhLNBxoaPH7aw!~XB8L2gQqq}`bCmR8r14hH%7l?+lvpxyhmui@EZ)XhxiHdbJ4dn@ zIYP;6MntKc#!3V=oJ@%=Bey6S&dBH;oYhuFQYd-Bi26=W^OlhflvFX&eHW+cB8KRp zl=NieJSC=#4BX9G4P;~mCFdCFo5pFju~>^J*~iFLO5QPIyN9#-%E)a>x-!q5_i`G2 zMuI5m!^lTU1~Fo>kFz?@NF^ojSuD@}oaP%NUn$XMRs#=k8UscWC^2KC=|N6o#fTFn z7Z_=Hh|}z6vFs`N&d5DVx-l#5bk53pp(%>kk$!6p*CHTFS966aI zAmsw`l1H4K-8_AQLwq>j;O94A6`!v1Y5);Rl0B24@|{M-V2-uLyGE=jcP?0duUM=}1JL`gCZogzfvfQrh1n1a-C)Fsl2Jem zz)vv{7JWPr=6Md(hd5S3=Zk=tpaW7EF~o-&=*Jy25WI#k&ts5|YZuhH1PJrvA@IY9 zJ`o`c70?jS43R(}EIK3l7>z(b;h!9PS}0(E5#@|@q&}?9cNu}`PK-dOP6oo}#cd$Wvx|UC0m5S4V+49973!>S zj2edjgWoWwF{VSIhCqGr=p?OR^}%C^YZp{#Di8yhJNJPYLto@TbTATK2aO@baujH; zf`*M%{C0(l4x?d_sO;Y-|Mrp+s>&^r2k~7y(BGsGcOxy|Csp`k4rX z%~M7UAkh;*!{%u@5VE!eqN6Yt3u?#+1Sfxi#~)+Em=*Nb9q??3^An1G9t+4LAZ(sG zG6HpW0K#V6Eg&S6COVo5(ZQ&O^oALC5i~eqq+CN=(h5VUb5|fNRx}W!o+usoJKbM0 z0+)OVf_&revwy-gka|Y+4SN}jN}8enuS_&(BWih!`)0uUVtj{>?k@BVjk(-&8bpjC z^@E8OBIFu}t!G2K*!bB2gta0PtQd&^(i=u^93%Q@ImX|ba0>kNhDpeXz5$JP0yNl& z6nyhUvPwRh<&4h11Wj*9JtMG?h|YqQKJG6(PA7tuA@+Qb5%fZ|m1b;`m}ZQOF?@zu zk^113FAe;d;=y5ojyQtVFR7osV(Q0~Hmk-8I#6^0=}EiD8jk;~a9>7X*f9bP6$OKa zU14VcAu|pgh#o@?jbIIb%Lt6j_dwV+B?tVl8ioNe!8yExEG~nU3Dl4gk_{vim4Sxb zIbd=dh!Gxz@6nGZkY3m`E{w32<{?V*!$>v|R>O24`aMy@HX*P0Z8Ndb$MXvpMtVV= z?GWWOM#%S7WOWGYqYu-75o4S~e4X468a8(r(TCZz06eoAUI9X`GUz~b2ngwlX6PsY zJVOO*h&~?lS?IhCX!K#wGeYK|C-UP38UvVvjIdZipkc8XVVV$uh7mR^{h$?W#+?Cz zlPcPbeBeFFb1&i=9Wlc4a}G3Yo{op;Y@Tui2}LHyxs`2#SbCl^D>4i8&}_nwlek{S zlNtZFH;!OG^Qa&0w-tDWG{TDlDm7LZ;Q782>ci$cN3c4V`q?d(p6|?xwe&pFllri0 zWfl;&W?BMa*RRYB&oBc@KgPLDA+!4#vYG~j&2C2U03an7ZAms5xdepe=P(d*x%h>=qKgRaQzJCx%26+K1YwcN z32tmO64AcUhw#jbU9F;+AAGxW33*NfLRSruXbBKD!rd8xtZo28awtaiQ3IlHh-&zN z5rjqIw1(|j4Pn$VD;9k*^8;59S4JRu5)hWd(?E=Rp)r3Ijrnds*t>vfjNo86$J0^! zNnfz*1ta8LTQ79J18Cp_(lvxwy+wYUK*QcmFrwcR)e+y7HvkQJ7l4dv2x|pO6IUN{ zQ*aC&H37oL1|#h59glsk72t>w{hp{VHlfJ4B}7B&gA8hjAzn1`_x!B@jiDjEI5EOT z!a~q65-%VL0=}Qb;-VTtFCh{Hbu<31#3f8)MC-!{3+bqmh=ZV{bdEIJBDGmjUAdT6>eXN253praas z&6=UexWWAXVniR`WaIBg?*}#1?@jZ=2&?lv@WZZpQDDVLq=4Y-6E_lI$`yhiV|?}O zkIr`h!q!7Z$W;cvGgbr*8wrfC)wngpVs$GR6e1$bKh)_j|yx`eLs?K#lc5=aDq`G8j)T=jn!vjg~tP0h(-6m zKX$IMI!&#Jh8OD#v1))_qOxsQ`KNK@drtAu6>3E^yjWGdSfVk{b8D=ss1?!hVtr*+ z*n6kKiJi(=EOk6cQ6U;$tZ&Q;w`=*uV?H%jgQ*qK@M3)zv}+`bb4;*9{iyG_@icUaX(Y3ffg;^@Lgx4KLO&LAyq=SdH)n85N@8 z#rn;Qh1*qQ)sI>c4KEh@H3S-mctqiX+f~eB1yU=b;l;xDC7czstHx>@wIUi`EIDE& zIS$9OSjE(eXn3*Yd9lX1hJLHD5})DfO*Fh%bp)~Iu=%A+t%!yft1d6r3+g;ztyy5Dm|&A+bW2Q4ty>qDBYb?yIq~q*g@3vuZ@Fa1Z0M;^MqDHC9p7ifDLN z`1_XR#n8(u4tQ^JXPG}it%!z~4g7SwW<=p$uCaPat%!yft1&MYUfIU55!E`2R9i$e zyjV?mvG7c(v9h36M8k`v#H_GiJX1R#MPG&RbquUq;%PFX$fcLj5L1u%@8U?!>eHnVg)1Wy6HuwKvu)CG#1hD zYS@xk!L{;;ezSu$R-x32Xn3(&@nY#mEHn;hvDQ*6qT$7A&5M=uvGdp(s{(38G`v`C zc(HK1f?2HJ)QV_$vDA36aJy=(2At<|NHn}yZHZNL?zCu$(%_2zZ1hG_E281WYR8LZ zJY>i08mlsDMKruv?Rl|`yX`6%z+&lM;Hp40yjbeISWQkgk*~3eq*g@3i>1M0;c@8c zzIc9(RS~r!8eXgpyjbZ4T|#TDI^&0es1OY=mL{>n>pYJ2Xyn8bHCD5!718iwb>zjG z@!fhzjnx%uMKruvTFeU9WyZ9a@yRTQn)pErDn!GJ)rnc*8lFk%F{{QZidqp3FIHz_ z1!H5=W>M@6HV*GoE281W>cWfFGQFT-jn#l0Qb7^X@M3i(R;|!!T*EDgdP-Prp;ko0 zi>1wrb*4{T>zY_{xm+xw;l=7ktf0SsOxSp^#>$;q5e+X^cV4Wtl2GRws~l=YG`v_k zymk$79DS+As%susL!#lu(&fcUSRZn_#%d9@A{t&S{4A1t?|^g2Z&xL?A{t(-9=urJ zjwO`W#Inba%1|L1UaX$PN^)$3vaxZHS`iH|mOd|5%f$ZPHC9dXxmZNQi)BEp*x1;R zEn($Dt%!yf%a9lA>z7&UYGUP6E281WG9p%NYy^4UsIk(o~bc zWHxBXt0Q^c{`bNI1NEFz(2!RrP;z|9*6*Jy`%Ls+9pAIxLPK7i$?J{7@17Q@yOn~5 zyt+`mq-~7%UbWu0UeJ(NCV72-P5Jsje;1 zH00IYQ&I<+Eidz4hkjt|1r2%i@Ran}vc3_hUP?hjUOlN^lEYKISE*9akXJAA`gzf? z#(}z3DQL*6H+e}8M|!Wfl!Au5`jD68Fi?Lf1r2%i^_0uuQtx%thc<`MkXJuXxf}*+ zxKhxNSAVLPe`K=( z4S5anl*{24-YZ=xXvk}@r(6yLHBu>P$ZH7IOLBOZKbEH{1r2!(C9n58et$}!-c<@3 z@)`!JiK&$NkaEIPy~g+P^{W4|%?32&HJrS1Yo@*ssOd^ULtZ05Mb}aS^@mc>5Op%B zx*B1hl6`IrRKa2!Av8pt;v*DA&!ZlHB2a6Tf`+J(L`iSc-)H0GPplU-l#Nq8C42dV zPp*3;P}7xyhP+~)l5)lC1Ml^yQqYjsC{MW-6{zJ(K|@|yo^oEf-fOod@?A;_G~_kf zQ{pA7-+^kS6g1?O?I|f$>b2Z^jZz94^2+g)t5={dRtg&Oii46_rEC*^ox6OYKT_r^ z1r2%Sl2@bU*Y6pqW}n)!pdqg@pxo?BdYkusy>3zp8uA)TUayb-yj7q+R0;vu$)Lf;Y zA+G{Z`SD%v*2`+A+C6f{(?5~|l@@joU8>TIQ;A+OQ| zuYB)yi&D^#S6PBrpk7i68d^Ur2POG)TW_?(==vcvL`_Jb_DP_ip?XbBsMiu-uhkkM zG*quiR4-|VfvWqtjT##AnoM4@5_p~WYNHf1b${m$|zA^r( zKppypEesmU#uQL)9a~oQ168gRG~{&wdC6Wr!|&zSl!Au5E+nsopMKCfP~Rv84S7xV zl+@wegLYbfo!`r~mfLzkLtfK7CB0j}4kxz^REAQ}kk@oj(qjv?f6Z>k1*%*rXvpg# z@*4i}$G~{&&d7ZdRZp}b7Tww|_8#LrK!&CCR zPApUX7}A?jvOZu}ZG z<$+s{_ItV8YFidGl#SV-TsCefTJcz*W+(*>dEEjknvFocrxY|q-3lr?eg$gZuWW?S z5Oo_UH-6n7|Lf~Ofx2HQXeb+ZfO6T8@hedODg_OB-AP_@ET8Gy z;efAgy`UklyU6RPe)lX1RJl^nkk{P_UQ_&DzE&w{$m<^ViVu7yP%kM34SC%QO8Q>e zrghH#d6xHDrxY~gHHW;GKUn*^Ks8=t%Yufy?o05x+ItOG3L5gdKfx%G_ON~{i zDQL*+VNlWWD^T;4f`+{2k=LzvojoT|>y(0qydLqC)Le3Sv(I7EZ)`T8A+PzKayblC zmQv7=*Q21KbAUkIpcFLZ^%!|c4g>YEQqYjse4Ei^^06W!r+I8`ZV$m=Qcy8V;%vjg>rQqYjs)1DH$H@@2N(Cyx9nNrY@*E61y z{q;cGkDdjT`JHI-3n>$m>P&>bR-L zRe>6&6g1@Z5-6G5h}V6q2kbk|dtIm$H01R%d7U-z?F$3-yi(AR*DKyj_SYe?n;#9- z?@B>KUayi@{RGEj4rf`+_a z_mo5TOWF7)n}H(Yysq1GQc$Xoz~pQwB;o zplr>YK(&;|Ud#p!QSbVC$?uZ+VLlsWNqAe;?^*Lt|8cTEDpQq$hP*!Vlz7Qq1c4f&6g1@Z zF(^4w%!ibk$JV*+T3@d-l!Au57L!-Xkw0e#>L#V2A+JwB?PPqUZOD3WpcW_v4N*%# zNu6YCanZ)F0<~NzXo&h0lsju{x9IideS8jg*kH?ohU)bh)obL8L01Q=sZ!98*HTc? zBPCG1l!At+&q3{MLXm8YJNWmX0#%|EG(;@}CC8U+hwj*aX`pUV3L2um03~x9^8u^+ zpZmSMP$_6A8_PlMZV1V~T(1n&I;Ef?uN9zNHWoB~W=){#{bUL<8#F|%1QpFjpxP+~ z4N+f$@@-?~rj$U9Q3@KOR)KOeB3WBr>9cXUQqWK~R)cccIAKb0d7xfW3L5hIio9g@ zwaR<_tQ0il^)-3P-C}`iy3ytk8uD60UQ(|W-fOs0(2&+Q5aT@|PLn&y;>l^Zt zdVT4=o>K}M^7@v%q+WsApcFLZ^_{1r=5pufDc-B`&o&#-kk>j-N&D#d;BA8fHB2dJ z$m@GgNx3qnob0`3Crwt{g%l;>y_p0~0 zM=5B?>u2)Xuwv}mKsEf;76uJ@{X+GURgw364reF@4SD@aUUJPhP%kP44SD_MDTzkT zMw@xBUzCD|yngqT>@T_FE>MGhv-N_8y#7e2*ZJP-5v8CZuTA77PtXMFQ>CCGuRlTU zV?vP#pLqP#s{-|}QqYjsU*z@sz;E^rRMX#Wy`Uklzd=dc5U-5iCyokKKc%1{uYbtv zkD#^x7yi6rlvRV~te92-*6Jx~F{WGk=SEK|>MB zyAQ&>j>8+iH#SiF{9z-2hP-wF<;F^xV+U%wQqT~!BdBJkP#G@|IJN6ff%;b|Xo#u_ zYJVF_%8e&I@>-zI++@FohH|(QDA#Yizt_kTOGR@C4SDSh%B>QAyT0C%)jo$C)e9QR z;Vz)u2>V6B9kl{A?oS&bG~~4_sAvuYwL&Rqh}sQQLsMu?^IyjavwsiN@V~4VG(^?% zlqiABXyYU8aQ-__F8j&n@T9-R-#ou8 z8p>fEP%ein*DkFQsLzywhP>*6s$)ttA5uECKYe7NM*kyD=8VF6MXs9d0V*!Png6bT z|G^^y^}SNikk_7|BpWjC?eb~b#eq8eU-OmOpdqRrD0g0YP|0E62Wl6TWS)3Wh;T1Z zgKeQHsbBB#WT0j#1r2%a?IRR$B@L zY8(FpWy?gtDZ5~-jJ6GED8l-n_A`LAjb+9Ayx7&ZjR8B@(x9QXu`fmV=Rr$01nPCA zpdqjQKt+$QK%Kaw^@4_|2A~c!(aHJVq`ez%4Af&vK|@qSQ10yJvQNvt4pfVp)(aZS z;r^hcFO=<<=Pr84QqdejLtY1fa!2KcpZ4l@x}T-ouU^nl4i5z7_Oh%V1nT&mY=qEI zga?6gBhe!T(;u}|G(u=7!h?Wi>((l-M3yQFPapB}Z?N`gz3mWoj2`bvp z2kIH6pdqRis0JoFnMYkX>$EEal~vn%K|@q)P{$ZTwg>Ou)GJVRK=lGZERbHo1G__WXbeswJc4S5|$UZ>o& za7Cc5R|*K?a&1G_^a3?YDQJl504lns7pRYvf`+IJQ05P82e19RcAy&WY3l_IQ5`|KDE0uzVs4k%PHnlPzQs%aL zc>mzlR9@C(HfV^-^byMMPt908J5Z%cK|@qmP}0v!+mO4spZ9I!DW#yHY;^Np5}~a3 z2I?=RpdqjBpjlyqel<&=A!FRJ3gbYKl_O5Y-cuL?>Gdv)&u1ca(yLs9vDt zSe9%I7_j)b;eLPZEiXGa8#I)S-k@CDXt(&3hJhNc6g1@32b4RL`sShERs?FcQqU09 z7nJz}+r#N&J_yv;N&DQJiq3`z*u9{%?G69TnIeH$S(L=6FDf3;+w3Y3C|`uU*=)Cjc0Xg?1P zc?|>Q&h;*x+HKK&zV*JUUeHhuhl6rCeC>^l&Vj18uZJ(6}_1;qNr-DHJqZBkmjU=kw7cKu6sGj@TdO<_fsi357 z$acp$Lstgs2Bn}OD(1a}YVql5{R6dDDQGD3qd>XL&-|hHu7S#w*VLH}8fqI^prS46 zfrPdJ4MjK_RJ5Oe+4u9esTVX9VKzlL?4F!c1GQEuXvixERJ5NDRP%;5a%hN(gNpX^ zftsikG(_csGJjxe-(*DFKrK`X8luL4YGfE`hrhk}bk7rfHujL${h19K%EnkwZhxKj z`kI13NOU_|SedgyX1r2!> zk(XR~4Ad?MSubeFt2n`{+jlHj$<_q}VBf`+_G$xG%@ zfjahJTQ6wHs|=Jo<5+yc4dZ_BUK5mphP=wjOYS8O)N4vXLtYa=H8QQqd`LN?`NtCi zwQnOEAvEMQk-Sd2>BI*Em8TRmkRUetAT-fSSe`8>r7CMjF0({(rU*!Jpz?-sErUB z@;ZyW+P`;Q#A|?3(2&>Jpj-}{OuuAC@VZkeXvpgv@;djct2zhjSEZmKuXDYZsTNj6 z7W(6>dt+NKXvph4@{+qF0(FH_(2&>ppj;m%{l;YP^{GewbWLTJeA z0#GuKlI_hq(+b}5ZQ}x^pdqgd$?N=G?=KA0mr6lHUQ69iuZzg*&YJh09jH?dw-G`^UKe{W$zhFO zy5@f3bNGx>(2&<9vHm{*X63`1NFZntQR!oH4~KEUz2MtZxE=< zm4b%6t{|`Pi=SB+sNIgVUeJ)&m7rXkf4NhxTEy3JFPjn zXvpg>@_M-M8w&!pSSe`8>uyl){*5OODL!tV?>FkE+X$f{uY1Vr*i$#`6sY5sf`+{A z1r^=Pff}O}G(^n-72V5$x<)Bzh`JAyyS|+I$~k8RYLQaV5OqJO=w1%gCZ(XEY&-xe zx|ajhx`oXlG~_iGlk&_x4=Htj`1+MV9j+8K zl*4|WvouhDDg_OBJq60mh)y{*c}hV;UeAM)*_Zi{vh&pUb_>*D?W`9x zs43QqYjsi=d>%19iGm(2&>LpxkIKGuS{qrW7W^f{l6a;2c5Y`hQ3kLG4gFHnyw1r2$9 z04kb|K>ex|G(>#}Dw>Tzwd-K(1r1Rjfiiz!lWU`aI$tShi24|mo6kRS=?@pS^VxV+ zDQGAgi$S?;d^7ix{()+fVIzcwygmWtvLW;NK;5epG(;`&Ub4TQnt0=RfjXe0^@4_| zPdz2+C>r>~C4ss|DQJlL43z6_WIi9LTAi#HG?a~{-phPQnLVge?Lb|k6g1@ZIjCqm ze9>pVc4zAa4S6jiFS<sQyYpLtbBia+#N-GElRWf`+K&prY+CP)n79hNu;w%pcg~ z+D)LEb+Pq=hNzXGTpuOZ=!g3Lut+IrC>vjba_vyA(Fbb2QqYjsDp2k!r(B~C)UQfG zL)2C>(^)*p)jXqFsDFqEtYe32Vl1;AB z2Wp?LHbQ8KS_{f$UarvxYJ^hIQ0Bh@}nU`zyff}V0G}JbJ17*uZ!6|oQFGt%3G!)_Q zprZG0+~a$;$JGlOitrDLQ10IdR7x)!12p8d2~@Og1geKp&=B<}sObG0fx22LXo&g? zlxrJu|3;wJCx2+d6MEwIQdjCeC&QS^)qW<+>vbW^^jX*6@3L471 z+{hZ9sZ1?7(AM!yu42I|OuwqDSX*KVMq*$7mTQqT}p3sf{4fqFtIXo#u}%KU+?dA}#R z2WqGOHbQ8K+8tCQ!^oKO+YcYy+sS96k5bT3HtK+K*%;NT)31TLLn&y;t1c*)4Vjq- z>UX7}A!-j$`So6O7u zwetY$1r23mFHkNU(6z~Ys_|eOAvEN50D1NO zXlj>0l_&)bc^&BMCB57DH{LoRP%kP44S5|zUR}?R{HEcFWPi!^%Gdm{{H;>Zkk@gZlKmxjvjnQs zC>tR(w2Z2A+HlWC0=qjOQ3#M3L5e{5tLi)k-J&ud#}D(HbQ8~t37!= zx4gyYfx1g6XvnJrC^xH=RmVX6sT4FsWq^v#u>&<|w2crNqB?>ye_*S>(-rpwYQ9p? z5Y-7(Bg0^h{Y|UxyZCJEo^8FLp=@*pXc(6godcDpxn9nl3CB(9;kUrK|@qGP_n)pdqS z*vrv%8)zuP-V~vX=I8mg@u_-2LlO3&2<5r#K-C{(V}ORd`hs$MS>C`Cr~yhrLtg#J zOPV`+VkmsuwgA;UJ3e-l4N!4%Bp|pdqippj;m%XTE`YRViqQ8UpH2 z6P@%^=`T;o3)D_|HXG0oH58Ov#d@Y`y~Tm*r4%$o4Flz7m2&1As7sWBhO#jnlsi)7 z9sYq@q7*c=zea$PI>|Pt&W2J;MfVpp6yeFB+?XQQmuL9>)nuH_1~e4mDHP!Y`6rwe zs8Xe%A+M33qVJFl)Qd_%L)59DWSo?3|IF(y4%A-bZG_Me6$2$lrL@C>OP?8+jpw`N(*neo+b&_{wi)MDFLiQH0VT z1}df$G~`tdD%u|g>VBo5A!-6B*XE@^4Ads2pdo4^sAzvU+SjW`nXMNzRIf=?FX;~h zb*)m+kk@2Tt_P5DIZ&&Wf`+KmK}Gw+K(#El5kf=M8K9#5VW2Kn3L2u$1m*U!^oKY2 zY<#8^G?b0AK)H4({b8UEnP4M?hP=)O<+36DVW7q+1r1T>fQt5qfqGaeXoxx&lxrK( z9|r1QrJy0|JWy_yBD3XZeKxvJwDp39vT;5rmks&1;R1EJQqYjs6j05~(I|cI7k4(f z`$+Hgu~N{G*9GLYbHBnX166afjSw30x)46U_qsHvb_4u>!M+B3DI)@PlTy%-*9=f{d`TW_G<$Pqpng#b8uGf7ycXR$ zJvC5$&$balLz%w}l(Z(HvpTwb~)BTx&Jf`+K8K)L>K)l~~m3sj?X zZG_MeH4Bui&Pg6uy+60}AwC;tD+LW@<7!Z@9nKvxVtk-#pJ%2-KqOJ$!vhiZK@uN@m+2}dNdO<_kxB-;Q z#@lUv91*COl!Au5ZUhz0MxfeVV7;Ir>LyU`eMGf(TptV6e5Ifv>Sj=`kJ|Y3vz-Ff z;zH{M4N(4E4SC(;y(Gf+NAK1k zPzPRQy`Ukld&z6r6C0KXYMN5ekk=egZghCG!O}*7+MpCP)$Hs*nH$Fe*D z8mKi&K|@}TfQn`#P@^ulUeFLVA5^M|P)PX~Yy5&>P+he z4N;GQa-)N+&IRf-rJ$i~JPyibL*CjEsO&4O7c}Jc1gN7;bh4MHE!^jTD}3g^QwkdL zdXl^rkE(NUpk`iay`Uklr$9wBAE=gBSqd7Wo(ARaB+OdTW<#KsDg_Nu&wz57U;OH_ z&jK}lmi2;$s0E&F*G1lI z!Zp?l8uEHR!7ES=ueB63pS*4&MuNTSdjok;V4%F!DtQR!o^-_Y@Oz*Yx z^_GH$yk1W53e^2dK|@}zfO2PT50++RU+lg5-C(_-A+J}->)Ll7=oP4qN~P&VEK8+N6hNyQyxnudCD^Fg1na{@CN8sF#$2hP*xi70rC0^6s!+&=B<@DEDs@^#1Vv zJp;A(otA=zsEYxIe{8@ul0h4yq1D;a{yWUddtrb*D3`Kd3{b^vi23I%sJKz8uD5O z%FRXJJ*V`Pd%V|eNDZ=IDDsO3sQLte{4MXx&q>VW%fgwPPR0+eJ!6we;A zd~~2rQ3@KORuU!8Nd@Y5rJy0|OJ6UU5ydjkye3d9l!At+RiLB|%J$;OIlTgP=>4`{ z&=9p6lw0k|Z17^gK#f)k8p`}vK0@(pwEX%#1NE>{(2&>Hpxkp(?`*oURiOS>3L2u; zfO47db=!zb1J&mNTQ6vcS_?`>J=yBMbi+r1xDO?=3DK||D!pjox8$h{!L(XAa`)qup6f~5LpFp|H%QoC*lz!unarLLR_oLobNu10_CzH=dghqsuVQj^>-Cs4=4oJg(?zw&2@2^9iv|iAV*RGxtub)>wkP)a}NIJ9Y5vaYNwiGnvwL5t=&pY6$K&@5^ z8uF^+>m^?DFJA}hv1hCoG~`v6ycSP-Yj&WfF0d3dcfY^>PzoCI+KartUvS=~f$IFc^@4`H_68+w zLq-R=vfseB`58(je#Y{STBI9puV>pe|Gj8lvihieA|dRLvKy z7c@le3rhBtY^w*2J|IvRDFqG9^!5W~%QSCy|EOj!OGRgT(2!RHP;P%o-@Cx?uU%iV zr9neEYzWGYDRNE}s3}T8LtgtQcpc`w{#FVa@;ZRL_hU=zEu6jjqCnlQ z6f{H~0!sFml)LERpN9l$-&d^{G(;T=N?NZd(hq(2#Xw!46f{IN2IXcc_YGX|ZJ>Tp z3L2uC_y~;^?)wT<&O#d@G?e+nK)DtrPcH^)rBcvPn?IbqCJ*{`wWXqM9vY&Wg0hiF zj43I5plw7cXsBMzK)I1fo=|(nx89Mj+0vk)dL2RaI$_QQ^#k>yQqYjsk)WjYO1X>X zPbfaZdo_98dO<^8N0HaU^?$rAh z2I}KQmV$=7nuBtyJ$*Y*&JI+)w=D$?c^yk$cjW$dXQ2ALV<~9JD;1RM*<>WD<8ye? zyOx56ywb=^{)Om3eXSHU)S}Ws*)q+Qto)s`>m{@(Xeh!K6rsGw>;O<^H>7lW&z1%a zMc9%e{CUx^#(}z5DQL*66?qN)njL zp7Z|LK&@5^8uDsOUSp=--7`=pePAPmhP>K=a`yxLHL>%eKs~1vG~{(0c^!Ls&+I@Q z^`Z5GhP;jkN=&MA+Hn2Yvh#4KL%>2kE|CojbGLFoIsT*1r2$% zC$D=yy#KvGEmsN}YP}sm$tWb-qIABh@sU32?lrAD1!|2_(2!SW@;d9NTIU4n@lUK5H00HVyoMg$ z^zcAkxWrP>kXI&ojrq0blt2yo)KbupS65K3MUB6?$)O)kXJYIy7uiEM+E98 zrJy0N?x5U^NLH3o{r-A!sr7<}yn2wAtSkj;&(AFd4SDqhl{!QlNHTW+Q}#s6L?F=pggnaXuSEm4b${(HE4PrO3TKfx1E|XvnJ{ zsOZe0k@tF2DQL*6KY3mB^+h`bYNs!3y`UkllRRY(6r7tM?Y%lE1r2!(@RS^1a=sj> zca?&Myasy8c{TA~r!Kbd3J+Fw};8uE&fm&{TEb(>Pqkk=?s(OF8MT7PZ5pdqg;@{(Cf zpx#yr8uA(qDmqIERL&af1r2#+lb6g=0`;d-(2!RSC^x3aEG1A^uC-p!kXM|%WR?=B zBfhZ|G~|^_UNTDw)C)>MLtbOZOJ*s78v3pEf`(e}SWwYfilw5h7aEE%&wIJ!tDZl; z)~gpZ6yZ2e$?-M&?8nCjD*rnhAv7t?N0*jL$+C?H<&G5los0Jyr9`tsO7oJOtgcDzp(5>hGN|P3xu>C|J&T5^(?Q9MQMT8vDi{*HMyZ!*IKnePCEs6X zDkU1G&IIM|5V&Rb@#})ul}d@mP?45-7O2K1I;r{E_rLo#P;-~%3Hm-%z!DQyFFu~MR8uS=@%x>qUD7%I|wXMi#WDei6+`~C%~&ku%@9zZlq zT?)$e0N!>TJ}ONq(J*y6s75A^n&v;dxiR-iLrH|9 zVQMBQcT~LnVcuCBtXP`yNBOPX3~%-5it zQN~rywC(2dcaN4M8e7hDm6mfY$~o5*;PzQ)hby!k(QqxU1C_kr_+2T{Fm*jB@o{+y zUiCNHJd1{@8$h`^Qqy10>k;^)4JDgsn7R>^YxA>CC^fg_JJ(@KiH510$m@zfFYF(v z3zZU$p(4G_&7hKxu=A7>4O6p09c`jFA5td$*?4X6dRHmY7%I{q-U8|kh zjH}mrr9{JCw}MLEAMWw9&7o)v6`8Bw1}ek&ByJ;>f(Ac7Z@y_{KG|=g`MDkCB+t(w zzgTzCaLjjrNj6;7TV|G0qG7MO zpbj^MOC8p?Jt#8D+^v*o*y};^;xnL^loE}hA}#76P;HG*;z+&IZ#MIyVd`N}j(G3A zS050C-HtSrY@%Um9;oC!WM}mf4O5R)K}}FfG)&D0CGAGGTZT4>^mTJJLeVhwD5!G{ zAyL}RjXSH=OEgS9Rt0t7?>2{`Vd`;E$+Iz5DbX)fZJ~OJhN+i`;s_7_(?%#7rd|eht|>h6NSSIV$*yRa zdZh~LS*1k7)T^M9w~d|tvRZO3mP4_?RpZM{TesL1&B2B_rYSBX-hVd_m!C5~S+l@g7iBIDO0P;O@RbV}T$ z(`Dl!r9{JCZ-H{-7mq3LDJ2?1MaGo3K^*9mqG9SiP^lJ5S-19&2LpAhQleq%eNeK$WSiAy$nk+% zqLgTu`T&&7^klnyU5i+tYX57qAsVJW1a*joQVu`ouO)$Mt(0h(`UsS(SGU=xn^QiQ z(PE`U!_>#*^}|7b7YFJdr9{KjVxnr?wO3?JS*et0nEC{iyQA#c?F)ZbLy_>9;geH5{;oEbAT0~T;FSpa$YCyU_Xh5 zy;hRf?3DZ73SMU`B^s{Rm!PC=m=C(SIa}I}J76Rd4O6Q?C7<_>RZ28muhpQE*XuDu z$tD{1`U=!2^IPI-#_lz3grZ^UYfv)#l5O3%p^<)LxS?bd4M(^JRPqR~Qc5)JwHB0H z^Zfhor|OBqZnbu@pG3pdH$?6G$LnTzanzwoiH50fiQ46}dXaItjZ&gv>N}!-d;UW6 zIvnTKTPe{nwT`GYH=U9Zs4S&KW2i{${T@{E98OS5H0-q=RCkj!clH}*%QqNG$`cJ! zKY((*&0lr0O_%TL^{9G@hN&MxH8Ule54yQFze>GC!_)>)ZZBW*$X+i8uf985SJ5!_ z6Hzr=^;{pQY^6lQ)J9OQCP(kKOYJ~SQc5(2ie&z0P{}iYsZye0uU|kVKbGG&l$0kL zrhcu0I&2q9K|^z!-#|%!C|i#|-suzSHQ7+IiH7U-JE-LKx`T0OOzEJMXqb|hMcZe@gtD89aIjLMVX6iwH(TyD;nU+ngyWSG4O2UKDzRP{ zDwQ85kFAH9Cl@bk8H9^S?R=n)y>h+FNqG4($P_ACxpZ;=H@cKb1(J-|$ zQKR<$>zP0`sAXM6!_+RIT)ocP<*-hHYO9oJnA+7-t~P<{tCVP%+6`3l7L}uvXqc*1 z1$CxUqG75wsO0s!N-5DWwY#Sh>vgYEqG75ID7U{j^Uo?J8m8)cDzP0dRZ295vV9cp zdf5Y1W7Cx6NXg1C>Lv=i{iKv=*lSNv$+JlCE2*`x1|dMb(&J5VXyyza@pWM>Jp_y!&H4xGNVlF zqi$15G)(Oa%4LK5s3(*X4O9DhDzR-WR!TI6ie#e!sP-D+Wo>^pgOb~GyY6m3iH5xz zf^ym5p6vvsM8nknppy4&`AUg~sRKZ{Y;ezZlTxB#>OfB=X5(X}L}RE(HVy*SMYHi{ z&*I2=Wt}=U8=_&agF(4$aNFpnlxUc01S)ykI7=zfFm(thmkn+k^OX_}Q-^v=ve9PH zZp}ntx1W>}jiDmhXbh^8X5))PZ;srL)U2-MMZ;cAK)Gyes@wB|;5AAq(J*xwD5+OX zjVn;IloAb7hkHt*DO=s>-$lxUc0O4Q>u_rE+)JMCfXB^suh5%t(j&)pxW6O|GT zQ%4Zh=-7-W0yRP@(J*zSr(}O!c>V{E1!|&FqA^rte;oy?lOd$H+4ImocL!>&Qleq6 zqd_I#UtcLD8m5i`m3)6S*wf}vG)y)3lqh(A^-)SROdabf$;SPY*Y*>I-7Z#2G=_>~ zBNbF{*dZTP^pk7o;H0+fI%4K8e8}E+|)F!1w!&Ew`-o_`KSGov~t!F=phN%{y zB!{B-qvuC!gIA7HqG75fQ9a9QoFAy$l@bk8tvn?;NDfMNp;DqTR3sZ2pfWTYo4UU; zGD>TPe}7*GZsU4!Q6BSt-#lHNaEOA$YZKV80U$Qv*S{7R7zkC*P!x7+u)qBz8m`xHP)8b>)T`}~XRi!Yu~MR8uMwbJ zy|~|)sg!7#IvG^*e&Ye9M8ni6pj^GU-*{aq(J(dAQ;BW-Wb~{)p(J(a%l&crF-Zn~!hN&!1CDv=0QlepMG$>au9`zsjW{Gb{nUZXqYPVlxTV8FhwcR zFjelU#CqMOlxPeUX}uFbwKP7`dM_<1c_Bpjwo;;DuZf^sHu$LgO)1eZHOW&h2f^#W zgY9>sVQMlcx0m^-?5vb%xL&7&k`Y$wHTCmLzX@I?N{NQO&H&}=#Yg2Vr9{KjnV^y% zm5(ST8m7(yidu)* zSVd!~NH#74<>rSYN8WX^DD2i;DbcXk#h_d^_(*4In=s}hN&w(m6(lVloE}hBH6ggQ<9BNmp6Dl zM3||RXxM8OD3^`eoiZa&cgB5WxNG)&#&Dd!NpW+){ZrtSshvcWUG zhm{fyQ*%6(n2lvhiN;WoY}^OxP|ZgAxF_xl5pGmUH0*UhD3=W$^=cnx>na+i9srem z)H_%y(J(a^l*dM%U^4O0(#Dlr@Vl@g7iBH4Hd)CkSS#sS~lAquDbun4*+u3>C@7bD**`8w>uKZ6?kx)+I`bhP|E#l{_2A9%*^e zF!h3`oI~(BUn$Wr^&+U`+4xu~(J=LrrxLS~c9iuOjiDmhco~#Cle*@;a&rr_i?z2> zqG7LBK)GyizmcbuXqb8xl+>%Hw!YwXzEYxLYN4kjF77vOR7x~Vz2>RJY&@%!Xbcs} z#_OOaY1=q+)&G7E5gu{0&5LN*>kUvY8+@c(tCVP%dec)b-@&WKG4?yrFtrF&^0qNv zDbaAf-U2m5>-9vfGa^r#e4&(R*z0Xju3p?99@*SRC>o~T0hPQzEKy1{OuY-r)r-f< zr7Q}1~yaWB_C)hN&-z+GX|ae*|iYQlepMIZ@xuDH|84f0YsqQ!9wNv-OzBcyV}3n@iC! zwUVeuzH6Tyy!t358m7J^s`2SVB5$rJQ%W>Uts?5DjWgd2UNz@R3>I?GL3DQkT>j&{0~lvA}FXz=wl<{LSN>^IG`$Br*;-4efi zgL1l?zLU3i4AG%OtaC;zHM4g{kM6y@_si^=nNg5eSX`D@5bw~WOW(9q^JnjZtVvlD z;w4#Q;-mA*O0vrEQ@acgchBgS*(I|_-(LMQic5-e^YY^z+U3V5#Pd6}%gd2sTBgTS z({iP#;;iiP@v^*(lvu|JlhTJ4#0xSDvqtB~bB4yV#t+HLFOR3hipxvl*;)Ddru_7b z;T`*Db{rP#l`+EnwT1cXu*lzIL);hU=UA+?EGJeLFEJG`F{Z@w3MUkekH;ovm6aA1 z8ag%ByC{2nURj3GWn`R`*|B3rcNCkJ_`@(MFTcoyA*JRO#fnSv3d?e1MJ6>xg{9Wa ze4SlXP*7ADn^3C1m!^bI9b&^qXXV69O^ULur-|MaY`)Kr7mg_#8;h5e6qWd&`e%0P zBJsqA6_uC8igIHmS%qWbNq#OVFO(fr30_{9omD<&Y*{QmDLamET@kUqsFtM3|7L1X zJXv!WzRZc2mX#DumZbSFZ7E1w$IMPcQqwYQ@+t@hOJ1dx6USziWhDIA$?VTgUF7!; zv2F>!cEsN9fr4Y1RsNh>A-4&E#ky5cNMzD@T=7-@Y>O``$(kH1j8BZ&9TrIeYLJE^ zl8Ss9I&7|_XfieCN=r-#fAh*%EYr1v{$(YdOXB9($cP*^9azxC?)fSdolS%BKbxI7 z3~iQNI+m8^jVauWXi!n7qN02e#rh^MrgM2oNxZPk$L|YFbQ};b8(UH|Q5DHzlCTp? z663TA?KoCkrUxb36!vsD3@ZE@*?ZYG+;D8U z`pFJyu>tX1(?gm5&eXe9`$8XgtV=w*B%Yg*R3(+Ly=}L6Su7`>A2&loa_Qhq>6JPT zlYLn>xj1e{j@+UQ>E2?)(9w=DC6wi5k2n4PN#*g9$+6;iiN+N#q3?1_;-{6z3$snv ziC*4}9%kSeL)FTOV@QzWutO95Xoi6to>%6fAsj<`MhGJ#(zv%raj{+) z-#WD1=Eyo`c9a3ANfVQ(FcNKZu{bQVii_igIVR=Xm_3OxE#1sBI_a+5&IM~WV}tT? zCY$yhX;a$}xCz=eA1W|3(%8_@JfxMzhU(O;Vrz>Ht0ihV_wF@@PFP?jABw?}!QHMx{;ZpUwN z*nZ!4NX;)AV>*t=^b}Q!b_cO;37U$d!e#`iW`3TPpJyh>C1c79%s3xfR))+G?Wmkw z!5){HtqKL$t}26eaa@uS zK?nWL#l_J!WJY~G-$KJO2X$F|Oi{^XyWf3!a^ksJ<@x6HMNW>);9r=NC)0zBcL%I_mA~-Rv(5qB?c(1}KNh3@WPsK*KSxH)H zLY@5H?vR@JW0EiuMHQpij6#C6`=cPM*zFEEUa`9hvkKxFu^vTcwieIQL8|hZtb4Zwq#C}HyawC*=~`%Nvwxi!zd{;eevn>m|2m@E}k6AE0F39 z*-Sw$kJ20~m!@J`)xiv_<%M}>c8ne=V@N@HS$vW$!TyQeE+;BxK3{5P+yzAwWQH8; zYEBSh+4*KL%^23C$q*}+gTnmHFfz%qV@0fMR<_}ioGC~Oll>U&`KuP_uLHD4bTyaN zs3B1jM;8{3;->4GkYW}&%Ccpaj!zRSel%wkgNi2R7fqD&2=l4jOg>9Y26`7|%SlKq zyUd&!xW8FbGrt#8Q)@TexZh(rRjD;cT5^Sy%if6%&nhW&=MsKrgkRhY&i@qaQHb-e zTuFO|t+Xvy4o-XWrKf1gB^8s`LR(6rx{sSunLU~O*XXX?oFXk6YqUCMaWMK*XE`k# zg7g*?XPAt~`brjMpN`2d8f~Y=`SGe5d+LoHUrEzU_FJ?%RsN0!W>(tF$(=MaxBmuq zjP){Qm?koWvVm4Jq@_D#Do{SnIYqIuA~eg21@|#0%Uv)zt6C$C(*$7tvr{>!(Y!ZP zVx^iSB~HxCiObnBRh=TNRAEc&)FoAdl)Y*KEX**;$3Ls)()@iOLI$Ld%Z^0VV4zw&$qaoKv}wtCDHl=ByW= zG?20)ZnBjYT)8ZH!Q6JaSl1jY*O)SK@JWh&?JBhJXqjDNLtUX&s5DZu|5B4R^H5;& zcAotA)ZDDRd~?+&Bd@45(nq3amTDx-u_f~z(vnk=sbz8jij^W$-ONG8lw<)^oMTo) zm7O2YDoIigck076^s&Y|=H$pZ0{G;vy%W;nN<(d2>e7T z){TFzSj{Sa9qXoS!#m1~gjc4So~PrGbUn8)mlV2WcI`O0_n=t6{(}d`Iu7pAqhGB5 zfPP(j^v=vEDa*z>JqE^DtZVh9zSQpNty{*1^yreg`BFC{?U-*)LG#MS77R4A-;B=j zlCr$qJUKJ%YL;!|CAh3-BbFX>XiKk`=>VExYHoR%X}i%gHngyzEyEA){0`T|!q@KN zpIv~~%VKHCe%A%14waeN=4=BptvMm0io19-3O#|3s`M<#oWv)qm_32&8u6{x>C@(b z?Q`-}wF`Gt=4>PE&BQuH#Z{g-RaH!M@UF~HPnw$8g#>p64_A+d%k*1BkQfe+G#B&hPFl%oox*eJ% z{(|Gd{9G_Po>P`z8Z#?0CFXLRxz1u1lPZ2`E}_H|zclB7{>$vLl2}g3=rPRuZ%gCm zjtW<*|CWmN-^zJrv8hL%y#!SfFEtBZlA6Q<%ypQYq5}VYL2(}Y%NJxKUtrB_w7DUn zWU?pY*~PIj@xs{nc=)cQG%MjdlgBgNv&*V0i>5ZQVrp5ns6cKe8Br zvRWMLX|6xvb4HWY)F!Dtd-UwqqoZEj%t&vM;mDR4H02%-)8NgLjaif`OIn9Ww>H={ zuLz<=OD8CWxg(+4MR_1nP*-y}+v~p3nMsCR`gI+)NpG5|%~r25BFCw+55=sjInFm{ zWp~InTw_dyUAK6lxuwip1CPwPlGSWz%ZOl*tZ=lzS?)Hs*$%0Zf+NlttV}+W?eB^^ zsS+7A3){fVLYY~rC^LOiX(cr_7mDr3YI|My9ou)nDQm9QiRi z6?RK>)yt0?_|3^$a)2_0wirPoAynKyQWZ>%qV);K1+KJgQwuTYOa3SiIgif&Bhf_@ zWX}o^TXr~`h{Uh4Y4fskxe9xGNTlot8J+7T9u_c;nU(wESRZr!EU(k#viP8)p=O1w zvze-yTm0k~vvR3-Rhj#8%=Nq;IdUTHGG$KZGAg}nY~B4Ct6O-m9YHlnY2UiUU{+AK z(9-MDaBI?PT1piHD3;)4t*v z-xfyCxWBtY%uNqsuai}tKht^9JtM9MiX7b0c($QL-yTCNw!w`qH#de=b`wg4wk#|B zq0H+fahJ)K!ve*4wwd2w9Qs)=dWR;?d^jYFVP%mO@I$7ELV3Dx93X zb%n%wO3z$gXr`RoP#u)9jr^oibDAU92K-FLT-mKgqmX>YdScBq)>G0tskFF!TM9Bu zrM4h*UOK)gH+Sno!ZbR!*mTf?V|_-ObJQ|($t}a&ZV>C)9hb1BboqI!DqLylLt5xX zXmj=@$=j;Zb?q^d)6&U>TiL+6OWVjZJ5nwUZ^f>~O`dv%#17Sw!Dx$){A5GYRu=hBA41^#Ou(cL+eVXP8ItfbIAwiZT5mtG!ir3RxtyUYt?4$!d|j=nC<^6 zrz)D89^9^IcSs#z?zbt)(Y#=uIke?K^AMU@TAXa|u9LdOdZn5FvsdEexq$>EGT}Cp zhe5KMMH;zIW0pS#%WBl<3{1?8&buUNJ9Lc1knZ&6hV8^+dq}@!3hReO#l+twaFz7V zD@+nste5`WNAFEbh{hBV8>%9?rz)ul9?ddwU?nJ75%$@wv1h(+=vZ3$k66O=+3wJ!chMMgiO#I=nRPvTJm4I&FC`rfdU$fNIYE=vEOoROFJ1f@ z_5``VJfjpA76#(7r>wY1BJqfa>4tOUp^uEggR)A;C&#GWR-ucY;hT%L@aSf4Ns)UN z|05gI=H2s^W{x+}9n5A0NS-n=rviD!W{zo&AUlbb)2s<*+1p&Y%%oanMq~Hqd2XQE zJc2lUQq9wmrox-2T$1D|8FRzp79in#QPwUhxqH^u$xp2!gJiX!XtQ=*+!liV%-dX- zl6zCDjud$}u4d0voEukGL$hOXQ(Gh-)p1Iilj?#=^RnfzpEk?ry4l?Lh?B48RF)sV zD2b!7Lu;4WYI(~3kU_;ftAvxZs6bjH?vw* zJwDk9W_7}slS#W)QPoOSl`(`Os#>SoY!RDZrP^!}n97t_vPM-sy3!S@&Ei;}>av;T zscMyCCdF9fN^-_r-CephXUE%Iwm%cDbX{t*)t6xsH_@9%ZEX&cFG_8;pemQ7HcMA? zL8{7fD(mEJZ&$5;CG@wxo40*j6?7%trSGPabriY`P)T(vDKQ-ONqdfMEVHULsI7=o z28twy(^dz$HOJTXH}eOao6-CE2w%Wo)3_89CYB0$(v{m9EIyOouw9mZB7MGHj1gH(Rex0eYr^+^20rIhZY* z8)OU3{di^W4HT6IVBR6HZEJ{T*SN>x%}Yb7%3>v5OLcR&dAvFq+`(Ok%b*(pi^N<%X^8bP({&al04VB-Yuy(y*+gJX@w(=5awY_i}RwJDaR*S;{0L+~yV5 z%gnLWahMsB^}RsQpZ-6M%`Tq(e+};cbLMc}?f+@w`pM+*|7mP;FNA~_>#^NB zIddDp_Uh!!XzkwJI3O;U?YBe6z765IL0IM^+aVGeVt78X-3#?=GA%~8Y}F<`w@vHp z*6BH;+qTUfot>54B0f4RtzBBncDb#vCgYxrHVaXhxzOz+GVPT?$XtIlDU>M*&Uws2 zR(_FrUd=QgGfOSa!-K3P@$5W#xG({jIVZrbE@TRaCMFgl^hG5e>$ zypP*H1&Do6L2F)2BPSoG*D4!ZR9X|QDru5xR)q(f1vC5BLSH+5%P!i#JBp;^)c2*D zCFF#)tqx7(_4ww+Yvwifaw}PrCLLSbQK=g16fhb#!dlrs!=g+T>w(+bwAyQk|Cw>} zb;s>(SBdgDdZTsd`eNqh&~nqd zCY#qX$PJ<9ZoXXAlw@?fwykrr+UB%OZyRr!m7CfoyS4eh)~WG$c51uPt<&t3#JtzO z!kna%MNHE&bb=rYotv4ERLeVE&uC~CZ{G*#-nHgtA9fD!e@ilhmkZnWwc=ySv&_R3 zCftfMK3kad{8(r-`aW6X%~Z%N6uWZSj;QL+ z<^8LUla6IuSkM-ZdjDBXl8ldAUz2K%r2k=MaN=H#9cotsVp}jc|7Stt3AU{n#{a{J zWI-2~jkjRH|IfmSP7R`cjX5Vb&s}b|!>M*BBdd|o{w>xkUAt0$Io3?HV#WDc*>ST> zViqdpnMLDYMaTMo?41XA9L3qk56d=$YC18^fC7PlQI~CsPTlHqH()qaPPVX`Rb1%3 zg$|*F-VFf)gkBApp3qC^y?&u20Rkkz_kVY0cXsw>cjk1flgz_D>{;CX_CN3YPTkqv zS$D%_8$vHU2|kJe#IPQdW;nz>ibf9}W#%=qtu9&|O_(BxLgv_1;F;QZd zxABP^(#_}ftPzEYyy2a9rc#)si|M=CE28WM)P2ey5_rKNuCwn_7$|=CoSA zcC*Y!b)Xwi-D-G1m`qFc!6{=&0}E;D5DyN>cIH`T4(aW%ZXfLA(tn4g+lqWvY=(Y{ z$(?8ci}WC_61i0hCs{JXyb7J$B4$uZ4;V5zdJ6=v(P=1;Qfje^RpUCDB2dFslce}5 z&f*hpr>6^Xz6<^<98+i}J2RkD4dD{7Jz8Ot6sZX&%xoCgFI}`sFvkAXK-qcV)M(s9 zJsyqekf+WyM$N-mz;!Y)RDqa!7|D2+}x$pNkG!~8O^~V)l8SaxO&M$iO$=7p8YXnNskx}Z2qQ?gz%D8F;8JTOzto9a84`_j zdQtP|UlK&px^S#A^%+)y_gPnU236+2KqoH|C=`+WijOjUAmH7z0S5ixpjRngc` z+%ulwbs8=yCZ>t&48!~gfYK(M@?h%U?vAY!LxUTBwNiEmotjo^y=Vx|crP9d%AFB? zlV4&^ru8wA#Nb5TaK%FtBR?(w{}%Al`fJd*c#4cjH};L3mOcR zJX0|)$&tG_ctSXP<9N3&ZiN#Mm+?!Mb3KoS(E?=&M-P4-ZkH6FWg9u;ne6P5Gd*LK zDsGT?onC5v8|DvbT5|*iJa?oS#HKh$P=wfQ=Lj;0&4i91g9=Al85%*8ysQQ3$2}^tA zbR^6k(Zt*5E`zuxqn5JIW|F%iiN|Iv>+6qq#;`6P9?i3wCR(F7I@|gJ z4|=u6@eUMrciQ0YBJo_kVF?dcXDd=qe`m|m9yy&YvnRcGweU1?S4+xwkf@~w*TH+W z(%!)<46x@B2QggWYO6{I&&?gKb6b}DDlt}IriL zl**x&8eHY@YNfq$C=5uUaxk@3qH?gC*9P-OAlF>hNV@}$*%L}BS4$19lzX+(Udj~) zq)^KFquZ&CTt?cxip-u+ijG=pa7D+fmG+{eFd&7Z!)^#ovDF!Aca<`GhWb7jo{BSv zijt6WMvU;DDptC5Dc(-iy`+3;OT4EatCdG$^j$@7Q)hfC7QF6=_vYcN${GBBN@+>D zgfC*{Q;F(}w+!^Q_v0m0MBy4o_rmr#zGv&W6b9oyn;B+6KhRa4s z4sW_z(%#jY+1G=W9s1j1eUZ$b)~5a@_ZJ)~D$4RaNM_x3N>?uN76hy?#*frolAr7_0PrAsa2hdl048_L4B50H|v^uGLt>Ly(h;~NcuoK zIx%Z7fcI;mN-4_*RuFe(f+=px7g^PzrKzu9Q+~(*f6S3%#a@5`McoIorCgo}(%0Dp z#E~hBx6rDJu2(VO=8m}VR*Iex>`2c=<6*z~)~bCT^Zb6d1zMdqWnhH~_lhJ=RmMB^ z_^XEOT9(u?c0#eay-n6@CfSTREwf=Qc0a?t%)PV>)eN~*4fc5306Yns%E~OhJxHjk zVHz95g5jcR48wh{*s`Fhy(=>-6PK$3}p&KRH3DIKJ1zxbxh$`G|BcMlOL)|ELk6Z4VGdbe&v#^A2Ru& zs<@K%;n!L&Z&z9NRuyS@KDfKct-(KfVtE8Uv%QrTi05Ys^ircR)NSJ>VR0s6U%#QT z0iBA(=2-71v4;go9%Uz%Fmm;s<&_p{gfaG8v&bIyqQHPLc514&v3O&c9rIWl-hkE8 zgg5wMM%|kMNvBp?Ow0BsdYBmI;WWVxLsMTL-u#ua)0A;ykm)H-Lz;%|h_0F@osY@Z z)WIiUyHJ$X(LKMt#r+_QRUuRpz*^D~ja4SFK9e`WoFkak-i3LFcAB@EKhTK@MKR}s z^^mRi^x6$ckqK)gtcpQ^9WLCFk5#G<@QH>2>_}(z4s`Xmcg7R4E+HN|P%r6nt%uEg z7WpRcVjbaFrNRcE80bh_6fa+FN133qz#qE8ixTH|_by{aV-{ZN7ptF2*4WQvb+zKn zV0dFQEx_!|{iZ5on^TmPo*U;K!_$|bnD0(sn%=4M^rb9j+0&P1U?K8tj}-;Z%R0ib zN(Jpx19hY$n$?%^6r|Sxr@7Fhj%=(l5%w`v1KN_E@xDI1C^;Id;>)13Mw4z`u$qh< z(PpIda&3D5yWJ0^HBH-5yjoZ5qj(3mZEBK7*@@vYNFUbOw%)8qi*ewUhOw3ojJ#ZL zR;8z6@t#!_3wjBTD?Ecc*iM=(uE3kF`f)MKz5wG>M1na-FgsS;-O}FG*6kWuxUPj2 z`Tg!{9Q_bii{gg}GZ4tVntHqJS6y25NwUKaNR)7&ak($9TJP<&5=kH&kyvFLg*QsC zE$`r0xayFXc=^QKDpxilBQ&5RneEm}^h^1xb8xKETGT?H-GP`bH~8BWo$8&6geWtq zsCc``RJ249O-02HuWMoD!OK~Et6R12hqQmA-)tBD%0C9tqle|Jas61<-~ zLCbnCvGtZ(&v-n!gV=l)E~h1T80&VEK8&S?iP6ENmh@p#7zc3KDd{j8A0&s-_%Jz) z#)rvaG(L=_W{1)EFjpAuN1Q#y)-H=BW%QZpNvK=OZYYRy#4;7Hx03Ev*b7rifv?PRI)D(Cl8t1Fo*)!CZ5rZ|RoIFTLL&QEM8E?!}5)-jbNyd(GK)0DhxJ`TFq$O=LMOSP~`1i#L zge`*hrM=H-kpxE5Ko$63ab{*fxc@yjE?pOMu zNzL>yS90Fbi#uvoYUnOvbF9B)_mVtN?tbMFlTn)Lk&Nb0xf>ots&-eL)S*&%pEi;gv@&Zfj$60tYz?)JPT;0izl=ih_nz z;r)$CJc>mQSMbqLBy$|gtmKbl>EW9DpwdhJI9D(|Lq2!p%MxNGQ zNp+yRoCjE_I@CR)Px4TA8AS?QMU+B;ILbXIdWOaFaPfJrbUA~Sd8ul zcf5C4H#ikBo*UfpMge43+@#snz|`EllK{=*wRa5k#-r`sefnuO1K5^s>4-P=dQ_*; zw6J@&JQ%X2in0@plc#Kaes`4yKM7Y>`60F$cm}P#-{X-r(e0Y34P=Blfta@p2ExMr zK+N_5H9Rp^irL)&NO%z}=5-^O7JdYC!jV{cS$ReAtlF8ehQ?VlV#Tw{sv2UA(;F(P zYRjX&{Vma`{47OL%=idbA{9v|VtRxt5yz9MIR$yK*;Qrb#-3=7a3$i{r8$K4BSi?8 z=@CvMS#1OTXiF0AO_-A>erUl8sje{;nk@5UvzN7(dN&X0u zo90&?Q8)v_lJs$Qg3k5F3YRD8x#BtWDcVk=iNJM7QPdLsQx00pk8u*pw4U{sA6cC3 z&P{gRkbUk&FOinntf)+9No8|r)E(n-siSW}Q*XT0dSG*|-zCmKiVaBV!5$MeJ?9Lo zjr4G?sNrm9)3{!hGek{mnxflHYqH*6Jgtd~K|xxRb(g7%c3cNnugvPaGoHGVly0WZ za!(_Yt7%MCE>~$xSXHvpn7mxJ(wMMax`uh>6sHv%b~{7~9ClN@WpdaJ>hE10GTSvwxrm<2(G}I#HU{*&J`}@92vy&Ci+~ zYw7KeM%k&857tAgqILDhml9|{U*?(<94Y45;c08{nji1A7KsWB&n(xlx59Nyu6yn^ z95LH8&&i%|PS8ZM+lr)*^E<6IO)>FASAV46sjvP>HYJyMGORyR7g(w6I%~$5gf`$v zZEypQWv&KGY=~*+kL%j$|vn zef3DTRrKs5*-E?mSoguP1z<<6xzb>L6|&e4vK85ucyE7uTRS~i z6wL6(HU%jW+7v|W$f}oi*0caL7?c)_Z0KuSiW`4f>E{os>Y5QpM8r2WW4s|wP0gOQ zOijf-<(Qh1$o158?2Kn~YFSY%LsOKBqSW_?D=G>`xVqkg60W+)sBm@dj8m_EZct3U#JtSlE!zDo6f$kVYM5+`ISdf|V*8kTUP$*d+d4`9Xh zIkWJ5FK%Ir_4hWl_tV+6duG7jxa1{lGX~o5*q1XLH`bvi7b{((gH&Z~bC&kakM~Q9 z=An@>2o2d2tG1rwi&eXBw+&5?&9&npq0kh2tR=?6RAe?{+0Kw{3{z2Lbk9I48I31W zJsBO6o-3n6Qgmf>NQ$nE4oQ*OXk~Origrf3#vjJ5i!{Vyrs2fXnbsMcj$@EBe+eB7 zWCB|kzfnwJQ=GD>ZEE-8c(1p89;~?4VpqDF#-R~sMHAOEhenm1|4<`F(#p;@^5iq;+BUU}t{cu~llXbgG*4gKADO78! zB);y>&drH>{Y`7SPU)mbr!{3(?ND&jo-*?p4}+&YW#;p6q-+;#YvJWEigm(Mo3u1~ zsKU0%axXpDR!86ehoY=7I)t;lfU8Miste=G?1nEz`DvajHAS(|m0eRa;fp8C&4izX zYjP%haVJL$TI2nANiec zP!7_OsHQ_*?b7-SNgrn?h*_yRzPhrMGOfREEs5fq3o~LxoiM_^W!mTsIvvPg^8R*tITTPBA$n6m|ovOQAXTana1JBP=+Vrq;;5_4;&mn^v$=r0NM zfGm!;^mq40%cU-{+}-gh-&KXaD2XGTM5%+G-@m}$v=+7hr4;i+#b|mk33~_EgV7LU?ZF)FgiT!JGICxq9f35XHd?xk5Qu2`8S;Ei~Wk+N6u8V5ocABA1 z(3N9pb21@|)0VQUOr$MMyAUbwVj9})O+2Y)_h+W7c(L^D0JtXgjoj8u-zTr(D(kKm z!K6k@rX&>KRK#2*G8Gv+#_HSZ{aPL8$z|!RT=`^$nS_XNDu#FioQjrxCw3|t?mMtk z(Ghu_ii(}p`dj@?@=R(X!ju$6Axu?o(FjvpWKWo?c6JpN*rNfuzDD;vYqN*0*JNc& zHw&bwA~GdKA#XmUC}-Ew6lL5MHAN{=7*Z6n^PiO|w$M>Zl8PD|nyPKA`T-830*e%M0+c@0s1Q!>R{bW;)&r6VO7MT{|BV9>c~f;s43$-2puQT z&PgkxEbiX$sddt9WSO(XmNh%!YNEx-U>KsVj0n}(gp3JQ-IYe?BnJoisM+)^Vt zq-ofWh*`-Ltf%Vl9wdY-sx*~9{^L_qbc>9@*Q5k&6Z{@$3N(Xm9-iu|pQ(x1ruaU~ zqqW6)9;(dqlnm~&P(5Cilo-2Ogu8*mv@J9_W*zR^4b!^NY>qgs`e1X#Hr^)pluft|3{0GkGAjgJ;skS z4MCc2N7YaEgqW!LgG@t_s8bgGpXeEiWSwG~-ejF_E4|4&-CKH-wTrRelS|2Etm$J* zgH*MRmHTY|WKnXOnt2g+$~Cyo(it20n#+a=epe*|`e8?!l@|AO8M8QbWnr}QEKv&5 z)BK-M3PaU31tOmA2}3wx4kTQ8*Ca@|!cOjG78L~D!nIei_X(w-%Vb$mqA_XgeHLkG zQ*q_)&?c0S+e4e2eI=u4Xp?bY<{09nT;+LaeX`3pyFil19-|t{B&B)3G^c7iOOtl4 zw?71~NK6f`cfv2}W1W+x6jH`%(V&iY2AhLAn)QpA!Wh)iPQa({-hoAoTAN}m`8h2G z1uacE+3~EVmdQEU&22etxs#d-3JbDw3MaMg8I96fzf!~pb+D_g8`SX$P1vART=jTR z$J+t4Cdl(y?Hq)VROv#|vJETBj?KV}S9+JRH%WW%6VWW^l~}n#QFG;eIOe&sF&sfB zd|7=~^l)psc($2F4km%K#t@#jfrlgK3SdYECRC@8bX_?UlA@C}*(t=*bq%B_RUKDm zq$-t=3#kga!k?;?6ZcHK*1QjI7l^U*4*#lvM;5KSK-FV!{~F|szR}ZQ4YeBg&FjOG zxGRT;CH;hAF)UVyQT%We0C{jf92U6h(y+weu7L8OJpGZ71}h`O7&|nY(T>lI8Ed7I z9P5~Axmu3kfr*)%s|bc6=Y-9#Yt~zp#26tkp# zvN2O}WkG7@B*Z>7IaknA6LO+WPshZj$J_AI$bqi@SaVJ1~g->UOx+f!?P6_U^7|tQvE%*56o9Br7wkthTzQt_Bk|42|aGM(tzs zqM4bnF&ST_@!&7f(oEM-v|LsBm*SQ9 zBE5hPZHVcdENdZDclCrRD^2)@DcoZ%na<~e!xWaLiNh3T7V{b8Foo?R5u1Y-1z-X# zByH(=(jkx*ZRJoH?i~vaMH-^<8VYqMTPx%JvBgatSjj82yk*yD4VsD^c};`ZNU+6K za7KbT2_KMMj4S(xCILH_ ztsC`18t5qReG6OLF+4L?+TDdKIs+~Jbk1(w_+(%7>6T1dFV|dynT86**^S-z# zHP+rA$8-|b!SgADd|t`A+{pf>i;g8J3(}>?lG&K+YQlV6R#cjKTE*-ZZFy1VDrUO3 zmssT-5dF_8XS!Wa=@bhW`!IY7p^DBZj@6)hLnkwv)qGyVa_ENJ*?H1EGwDxQ)Rgq6 z?Jer*w?LHD^rvkXHrMm!={7>Tx;^Z6I05Oldc{yGUmfn>w5|vx)4$?^7~U;K^D|gu zg567)6D^a@W?M(HjiOGEXfwUle?%KAT8a^E<_NDt?svhC&^THqj_@$L?-CrLVYEyf z;bD~4;uxWEWHyfUK&}D>lFiJF@IboPt{$NU(lT+xk1#ANSCIjRW$TC^UszU-@aogx znzI_A)yFb%#8)57%2lNLShkM%>SI|s!mAJFqvnqM8f05(2QyYhbLgSW7GVB6tl0w0 z_{kT8M!K1zO&aNzdfTOuZm(#YM!Ka=m6{%>7yN}V`JFHJ@WRi2)6?edousGog z?MO1pxtKeWjB>8~jwGY(s%PC)5kkeI<@b~~RfMhW815_uklUP>UzpQYSkO|C)7m^~ zQcH77Q%i2VxhZ>ccHZQ+d}~<+&q5Z1I#_gBMT0ut+mQ@T#d%b8P&P=9dJalKbT5Om z-_AhxbYp>MT?g~blrAQPBPKF996fJ_hodSoARIkALugqa40g-pS1{A9mUL+fFEl~t zO7|SOhV024B9e(!U<4gooXg&aJbe9rc64?QdF8t9mK`ml5X5Svt8cgoX_YZql;Ks$ zYHv+hm24OFaaFQfR7dX(OFeiEJ8lwl-}dFY;miItnY*{_W7M~h*}p0j-Gw0??tvbx*UDxNJd%83&3TV2aX$CA zCf;K$y$UN0DY=|#YwEz#OHG~h;8$XxLiK9MlXAI*d*9RK)ljEoJ7u3Zd&-^vS+GCo zNYX+HO&xTdsDGJ#p!2moZ*S!oq8+sIZC846so~D+CP4lrFMt@V^LM(VwT)?iW z8a(N4b$4_3b~{pz&QDqeVK~xuon#G1@(HJA!(oK$gl;&Jx62-T=ya${o%xzqVV8F) zWyk5v*xvEp?pSYA*Zeph8!9emRb(%^#8ZwL;qokL64;2g#bc#tM`G=ro$*#$#)c|& zqg{oql9xgqrpaol_NF5(S8Yv4atXCF9f{f(ozjwd?rT(ONzm2Sq$8MiO<>21=5L*y$>Y>N0F-%!B5EqYAi?6Vf zPZW#xaiFigv!^2->tEIr?~BfwNu!pT3-F@S*2eDcjwt;Y?d@-g+UxnbCe5KSA0VFB z4m{32k>3kzq&TTMPkD>4LNF^Unq_E|=K=3uB9~<3oLgHk0{ErW4W`u5GHk!ZF4-FE zn*I8v+$C9OT@!7;#4gF$iB2|VPb0)So4N*Y@~|wnINpKMeSEggw5&oCpNj>MQ}X-bTFhMDB_d6uTc?B)XvV9^RsbBbUM-vm@PEjhS#aNul3n?wK~5k z?m%T_7ZV4esEJDjAqjdf281LlCd5M$baI7WVKB2DFFBb%(A3+?SEZD0jbb@8O>t9T zatAs|X2$B87UHHVTtl|+YPK$9S$F#5f>s%xYnT-)UEGheO3b=SH!vl8q)2q2tG%ne zza6Kj2jbdvOLxyQx{!wd0%m+Uke!p8$7g>nLxT@OqzJGM!qT$heqGBW>qYsSR+d+j$ zDqK>5@?_xfTjmOyeDRuUhwdtiLCFaSMS9Y6Iao^Npfldt*}d4hJ|FC2%B3L7bGd(5 zlDFMAomVq>k`R}|Oz#qsX5g$99u1C^?jv92>=pqxpOPEGpwAujJmJtA#ZC#5oa7sN zvwEx-CXG0=ShR5eaWXSr>5A5fGmAwl$;rrcMQg;F#iEtu1ZTRUHR8;&n|Pd*x%+h7 zO55I{A6*)cDCwzj_wXrJlOvBM)1P=ztigI8QQr()NW|^KQ9PMe6pLAFrQ^kVt?gKF zxfd_xY>Ra>E*hO2&5P9(M}QSNZysVHC@6{2*QL=|R!M2JyrH42xVF4DI;(48SND>x zqI`i{M>jXM@{54hSqne9(E7T!w`p0dE50Pw5$~GczaUY+B3e^bUs_gPUme8(Mfpv1 zL{UBtDaz-^P$JW_Fh~*US_wrbMPj8heSa(}%JLk5JS(q3@swt<2C;4OSCMTG;^2n=&nl0sP+5o2eeW#disals+G&XIRKiw{ zwlwwiC* zRYPqtomit9%rDCC@9stc>&9c0Rw?M{p5NXQi}&{8y&+O5Ztudmd^-ww@BD$zINoY2 z{o0Fn0MiR^6A!dXLs(8tkk(xbL?I8phv#f=U1wUtrp z(OBo}yxNB1>XI^C7NUnsEuS%?hoary8f7{xR9RD5?;yQ)!)r-aX?I~RDHBu&HNbDH1$ue%0};8p()n!`5~cW^N>jquu9CzH5+C0sbi#51il3pM@U1M* zM|rqqjb3T5?Gp;>8Y(Iqiz`ZaX0b-iF2-myaLo;Oh~u=ZH^v_uwA&r2e<`#Nv3nM? z!zLwpSRos!JE^g53~xb8)=V}m3Oo>%8Mpt@!~7T{!D;)pe7n7Mn~otC?@@jI*2qbb zNI{NAh+6i7hU%%6wPlU9=!{CMx&}Hr@NYHC;py>~Zd||XL1|*=0Y#lSDL{qlYN1EE zX21g6$A?#P!tC1a`SbC}LS|NRlphcs=*I~rJD9Fnd7#{Ax!uRH=8(#f&+R_yQq<0) zX>yPgIirKTCCDzXNu^|TkT)d+fepHnO3Li0!VVkkXL258X(2T4S`Z}EJD{82T z+wQ|q1gU=d941w#GT+L{>UnVBgQc8Er6483mu&WglBi*xQJYa(8?7y=t}Cf1#ZV8U zx;UmN`q9?Zo=ybC_Kigfc`e(T}^kdK^s((`T zi`Ia*AzEKkTvkz1QzNE$+ECi!z1EZwjX!V#)!x5=&X3rcMRs*>z!Z>cLt_}>Z)l4juc1zWDHI9h|zV@-KgWwffZryCKab95=R zZ8)YVzp=cIpUGOL*G0=Qb5z?{RVw99Pg8H7oHb5TCFRkY#**r)s>XWNAq(Tn9JI6~ zT2Vi>v9_kd8qaF{sX!0l@~67Ez8+(d|%KFIPQ zN$Y`3ZBkfA6oxnUHQ|Chq^zk3dMiEp2I)MW*_4AtM!j$6EXV1ax#vN{bIETX(9mn2 zqpj1;sO2+e!{M)Yfdp4ENO+=EjDJIT;kKCe2w|aV)m%vkvfN>6fGet^6}1gDb@deu z-WE$d156EPAMSo?9l(o`{Yq5`b_JJ3)^X*OV6LjZ7VE&EIjrb$>U>TqPU7nu8*8Gq z1LDi6RW*%`bq)AZoT2BGl$F(1SC`a8J6vRWaYJcs4d$0Sh_vRdyvyDB)kS%SUX;%s6vLVRKyzP9Z+j1$ic*!>uou>FS(Z~*R#R79URfE9my1|6 zG|)=J4b{<}M(4}y+KSSWhVs%nOrzpUb$jBClP(*{+t40_=WdZ^Xb-iyLWOcx(NI-W zUf)m_we!w>PwNX z^4CJ1%_!(q-F?lta${9eCP5tcJ{$zyrLk}^Eh8w$h2JON4SsKl@&b+{88-Rz20XjP#x zI?x*!qk}wQN#dBqpd@#2aWuDrhJ8tuGbD=R(4ecE0rp#P1=Y?g= zNgR`y2}v9*%B9gk%7SThq&FzYJcFrbPgIgQC^0Na9ZjbrY}{ZM&m;_Xq6!~VnIo1u zh{0-kBR^OjPhO-ZlbAcH>3Jd!F}inTP!sctpbtt;9rr;=DMO!vl3(;wkaRKtwaoBJ zrxa*|!@L1CIK&e;<0BFSWPGR-2o}u1>$fHYA>XUD>|k$Dj8pZ5CduOx1C*qI6DGS^ z)%dCEc?=KrhREx32A!FwLxCK1~&%X89J{KgaZ z{Y9kei%`y5S4W*Yf8~r-{l=5^|4F3l&*Uj?es+9S{KgaY{Y9kdi{vHV)9s{~_!Cdi z?+1~dACc#OK{Mg}ScBRvj|Q`2R7I5@t)}|cKt>7sjYRnbpmjmPs{UfZJKH!+8K{2d zMg{&Vj0wc@{O%vOy4r*vZNn0Nu;b*t8$BU1Y9P<|?s3bG#9wVg5`W>A`28T_;!D`m zwz1OQe(R~ER_jqQvPTMNp)aCp!}gc<=yjaMthd`H`^fZ_uLls z*CI&j-!Y=Fey~>-vFki5($Y_M`ko_r^2%>T>dK#;#O+&ZRjJ#*d6T!l_oOd>ooImk zJ4$Q7Lj%*T8~YQVDd0(}k7YlKgoCKOHrHLstW??|$W8poPB!6~gd}|kG!d>}oK8)C zQieAd0ic}|foj}X14e|(0M1LiahG2Jl76sFl)mI9DZUdXD1JmK4dG@5J6~DF3PI3z zF%;`~XhPHyAq`O!SrOJfH@wt@A}F#V1nZov2u;hK6`_ezRt(~BxG&Yz^m@d;xSLSV~M$$Yqf0BagP7q zL)Z^)FVuvpS`E>yU3P);7Vof=bCt89PRa>?Li-Z7Q;GSRrX&;2H8Ig@u#}T^Qtd1P z<;oIqRyr6V5%4f{+|>hPL997%olOtkFseVzKZT8Rhzh+pg8K$-^+mmQ^u2L-lYc|6S z6Kzwf<#=q%DKx{HlvtieEw8`~v(*aQF3JMD7-&}msw*Q)~$BvF{efy0EY?2X) ztQ}$7#MWNCcxG{&|8HdRYLUn-_W#)bt~o9;u{GX2Fh6sK{ncOb$4;Z{|6~6~BjZXY zHuv?pza8!VAO82@@9| z%C@n(8Ktq=<X8pndQ@qXEscam0=m=%2;jr?DE<@ROEEFc28}4b8l1c zvOVf%@~4%iV@?>??4ZrFskW+Q%C>l_tEH#2UzK9%bR0U9R==p4(GZ)1RVrdL8p}(o zDyqt-&#;ni>cBhhy6}W3EzdF~R=jv=&Kx}YRc<{`*Sd%Ii#hS8g|nMF2I7hC;hC~- zJWUqInqG9lSLv9;uqO^I#_bCHDXp97@vot_tiHIee8#pDDA)dp{eJ96L{?iL|3pfs z%$wC0@9mpM3uVo#8|Z6qnO9dny|R2>O->N4&goyKRU3*J!cVBl~|AgO8-*E!1f7aQ4Ac8WXw7athPv`aGpyxMv?yiZOFWUL& zJvYDoy~}?jU))=?1?a@~*7Hvov)WHTMIsrIXd7NgI58{hwAEHSoPV>pyJKQ!D}IYa z*f;KagDMlrSdD6qyt(TP743}GsMg4vyS|Wm#%gknv8#mrEit1a?%G4YWUMv;pYpa9 z{@1ruMRv`eoab&b4BC+#YDL`b$ObSb)pq1DSQ&OZ@-I7Rc0hhi7Ayi}JZ5Z2-Nt0NkV14S^ko-w@i$i0P3~MZM zF+99!3KfZjRq0Je z!Xu~`%gLIQt7=1dOJV=yoKfc#2UDBU{1P> zaa8>Tw-o=!Haeqv4$PaJlj9l4Y<))jEdx8r%jHFY~P+>x(v9bV3upRosibeU|u)iJ_IxF z%3%9QZ#^%h z5X>4k>+LH8a~|h{?7JS!_J3h|e)eq-`^q?jKdnvWFL4JLaE0JbGvKPxP&^85{kxfc z8{jyRu3VlU2J=@5Ib#hx*~s%!f#uGxx|3G7R)a9 z>h%i2+@;~lknT#(kbSg?_zC;g!1rt1hw_Y_Ha|az8xLk%4fi%=b_TQd15A(F2a&Fv zA3b0W=A4|a%pD8n3=Ovr(zyW4f0Uf?cOLop;Hb#H*lF{tZ+$T67%<;H#5nR__#yO) zz)f8_DstSzjPq+ZXk7ddn2C=tPWD&mZH}KOftm3b<7E5fxEuuLIL^s>GIu(d3zeKm zcSi_Z%^8XdZ7P4szGogE75Tp>_4aM}SG4!oX$!J%M=<$HPS|$=WQxGN_7u~T<1G8T z>C>Yk+hNzGy9=1fN={C<6wF)C>eJo)xlxfFukbhmzSROENq zb?N4VDOPeK-J>B=!x>8uAF6Ud+|!2KjF*^gI=z<-xHC|Y_IY_!psO*;P)_Q~ZS z{tCv$*l7zYe+Pj%&VV}|%!Nu$#EfuSgO4wQ$$MYL$@wu4%mU5@+1Cr^Pz`qt1da!j{UJ+tUD%;22gKbA zrtM=DC;ZqK+`qsye9E|ueDtV2+4TRAZ`f%I@?#e;lMT31FbxLWUSQ%H?migQ4Q7|m zRQ`(mAnr~uOTJKXA}-6}W5$=GB7ee8ThRQ$8(==+Tu@y84dy2U?pOaD71|ZKBgulei{5Qt!U#U3Z?+r-ngs(?M3i<6z@_CQYqjE3{OcUq)>?3X=m?Z|> z5nxW%aOB51V4~lu{1EmL_g63j->W#`?{^g2|6+a(J8ePZrh@;Cij-idEy&+mFmnyK zW-whE?g=Ec6imsFDnEq3e*^avnDec>dLj|IJ&^s~VYQ6Ngi(~U!T!zzvw(9!{`P`7 z)POr4%vl&@ufRMoR>jHw)~%iqsaQkr?~!0m;arfv=YqMyfV% z5nxW%a8^46Cc3f8582<+tu$_t%{$7l{s>{rX`~y2}LG^N@-ykm7X$$gqColyDTog>LhNJR48_ZAJ ztNalD68HNZG9r09syN{<)!!9h7Vf0?_e?Msb1ul=Yrx!Uz}*k#NexGSya?vdomGCw z{;s)8M&vIORh;m50sJl6H6wC0cG`mS_h~S%aW2T;55W9W!;v5V1#?BV%0AhTtelL< zE4eC8_(Aebmov3T8VEM}F)A=B3?K_Q`%U@17A^Yflv?{GjppIbh0* z7)PIe{a_22Zq5byu?);H2HdG&&ew3{@0DQci&cKe{=N$4s8SUt{H6J!^~y3LmzFb5 zo>vxnlpp^D^8@FC{9U~wBeEfO+Jd+(!R%9XCT#&yrld|~pYVgYr@$;}P;tVKOW;RFV@Bk1 z?6lFRUwM82%-=W{%b)B;^ zB5ku77c{QB49pFj3-b34Fe?qXr@*|b;b@%mKA0Qks{9cC(ztHQUMSD|s5sf*Gr^oR zPw($zU|!%{kiTz&`P6{>ikN*_x_)}(@0ws<*iYq$?C<`ujL0rcDo*&jJM``Z^K~=h zg6`kgttBH;iJdk-`>0);24-IaZa$bk4M+YS0;V#q@8$YM*yrkP*4B zopC|!^STFQM8;#+`I`wQ%Yd5#row=01T#;=QM=m)CbL83uZRnAH-hQvQgI?KG;aDH z%&cz41+~wIfH{G4koRr>&IEI@hNJfC8Zgrrsq7Pe5cejS(jukCVXUpRVF$KOO+H#Tj}(%D^;o zF369)!L(^O@}mdLug_B1C;M?FnEJC-obcmoBYXfdO zFuQ8Fn~~6DF#mU+$`9c$aZCP)^Q{Y1obZ>%8@Ga~yohl@?ejTcF6Ug3zt@Ag(|~&j z%+m(kD_}m*aMTWc0p|KkRQ`&%5I6Z!w7Zw7I1v{*uQ=-RjL5-PFfOQ{z5~ok&IQHg zDKM`ZaPNcpQp3@>^LsEWuTuFT{H61X#;Y?TTVA8$gum1dT?1zHwTugDhjs=tiE}~z zmVl|(a8!Tif?4f4m3_hw;!XxraD$4I{df?}mVeg!Q4VGr=Yss$2h4m8NA@iOGyW!( zeX<`{fob@QiW7d+L+>>(JKoATdj7?)AN&Z+zd0A=#}8nBbsN(Q;x+`cwE?#yn0yUK z^{oiZ54WrQ6>%Z%ggej<-KFA0T&P|?59Y6TGcKrJu5nLBWFzdf1^K%bn4Ju`JTOrW zNAoe+TCB2N)MrFP{YSGUtN)eFw~E2HbzZWIPxg zKPva@fVu4V#7%h( z^SiIBIN`_3u)X^Y%n!ZExS(<3*UvX9Xoe8RY(_T>gJcX7_oKAJyW3Fa9C?o}`!YB=gIzXWsF|Ec^C{!)Kg z@ef>Q`dq~cf0x6)i@{WW!MLD&>jrZW=Ysq_2F&RO-1%Ux)^L<>H-XvvpDI6uzr=kA z=G1?yIN>kl@8(~j|M;45LHXMVW*+B){A~l%Yrq{0=6DT9`FjSKdH+%QA^fHM{TR%x z->Ep^?-lU3_y-; zOA~P+ZjaHUBmW(v;zV4i+#fe~bmZ{W85dOU?*a1|=Yrz$9GEu^xR1enrQxXD{|M%> zU#a{M{!+Q0x#sA|HfyUm;V<<^*MnJO9mdh8-}zt`nB6%SGLh z{2=ahFjLl7al#MEw@1L-zX9Wd^6kH1R^O0uL4K?cW=jKZ2QaxBj`D2}FspB@@SZ06wYE_C zE8;@jIbddOrQ$?fu0uI^2h7P^Gmbv}%JZ#Y9^f40eYq#WyllX|1LiXgN9FlHU@qB4 z<%jT>xSh8h9eHs(6({_q^Z2Gr#P2tHe{;bUaW2T;DloGQxEPp)8jk!J0JGH&DnDd@ zuLUz>M-?ahrF#Arn7{ADxS)Ez(eFk_CSa#6$lsm76c}((Ftr+v>iKLi6LwMgA^fF! zejS))yQ(OiD zaUt$(Ff(^oaUw1|q71(c=2v^@{oN4E)=Ez3-H&v41oQEpOpjJSRJD`4;QNxI(YQY` zI9+<4aT%Bsl$=O+1-LW8%!o2Q8l{SK1xM?vECO?QaWF@5xd_aooWo%*JrQR*zkC+V z8%j>3OKS~(1m>y|Rl2g?N-)oGE-2ks!F;IXM7s5OOz2C_zyxbk#ibMh+q0b67Q{UX zy(6aTxyxX9ZO!P&=e3OWD+iRnQ|m@Y=3=MK&tKx2!Sot%2ZK4ufIAz^RR-LRU{+{2 z8Yevg<_!%;<>ezV|5kD$-yTDL`~c?RX)G@Cb1`yxnKpfNWMAyG`Nfayn-Atd1MX-r z=NNF8g1N8jj-f8kmm^xPOBA!GK$R#^}g~*lCmFBI3L@%JY_BcATY;^Q~YW z;GC={=f{&^URH77l)w9ext4Q&@oNS57?_>+VS4iO#KK?7kNv>> zk#l}}mEi6G^OJ@ny)EaBj_ieT?6J`1MX2UuNiP3 zfcegV%ZTB;8#`@5{%!*%U&H+x8bx5{8gR{E4$^RO=p6&*Q_lI-UrP5!Fq`fl>_-Q< zZNQw&IX^w(E(Nnr6VnUgwgGdp0e2~wb((|qs9bFWCZBVD`EeMyA~5$EaF2nhYzdAF z=}iOkjD}ka+^b+dFyOub^Sy@4gWl-Y(UD2mY4dAe*1>PH!L)GBFD}G&f;rHDI~vUC z8g4T5&Ij`X=lse6aUX-(CLWx>)Nkd3spg!YAEY-E%*h%(>fbH}^SnlHH*jx&*{m(t zKH_!;Ghf4P2ksy+7je$d58{@Cc~Zks{e2P4=bZD4^Y-9I%^w~4Eq2=c(me>j<$$@K zbAIJ&Hn=CjY_lLZF4W)VgPFoPzjTQ!15>5p7J!=p=5EeW>Z<;T^5Z=)TeUO${J44G zD!^REIluT(e%uD;6$9=wFyjsgjtl8!f~nMSG)~$FObh4y;%iQu(c1>x17P0eoL|1tdEGZ)Mt3kj z{Oqd%w=QS!r?sid6>)nRa#t8|R8GGz;3(alI++iaarp4FZ@`dSVaTo3rB9do-`R%T z0fyY6hTItj9F@1L!2OA{e&v9;Tfy9=;hq7v63kiMEH-}SnZADn%#)n+OZP2sFM_$H zhw1s1=at|d19Q?M#`(3+l(YQbmxP+6U>BOrYE15iE;ZW;CjIPsNrZHs=jY@ zWDa)P{L+0Izcqo$>SvrheL&2GD z=ZIF-H)^jw1@krM{QNxw+)rRmUlN?|)!^O%bNo`q`IRfm_q#ZQKdnt=UnYLJ*MOt> zt9QVC#aX}j5x2&&(UHxu(-y?-3Z_KEQT%3uY2ut;{K(&hoS}4SQ~68wb%8sAvwrqb zx_y_|dp-YcP{E9F1dZIfFl~%`Yy8f;(NK zNAnR^f_X>7k-uMqS>vE!KP~{b1(-WD+^)!gzk>Pi!Ax&;9H;W*a(rKW2;z*LHoyEG zivsg4m>&;k+<34;Po4)Eb>!&Cy4Y!x%Yn>o1}4*hn+Rr#0apg5(SX|J;y6`Y=zQU2Fh6ikj*HOy1V5~P%;?CM$1*)C7b-oPf4<>3 z^sCrull9~{uLSdq0rx7H50#v-Zyj`KUxNAJRF*ES_w8rjc4v%^?227y-()c58g5I7 zG=S;Qa1@utV2(84P6BhT0e2ag8w|KRz^qhqB7P4dqn-kD+F2|vG*93czYYF?^DXSO z1?BH=!Q>fmdxEJ}a>BmTkkCvp@1M=mmB%k~xyn0dbR>#B(LSL!6%9%?m^01`=59p? zasilWS2B*yhyCJm{qoU~JFzFGE8F)Fn5PZ6SHOH=zWPA>Kk_2{OTpOS9^ll$AF82Ia0}qdh~15qm#f~c|A*a zJ?Q(@kKJy-JP3B${OqInO#`#9k`w9ff^_GDIqOEIN9X^3=}x!_*M+dt7L;xQm=Xi7 z7R+1?N9C^>%Rjs|m@0ry8RS1CDR zAN4agf{EVE(hcfoP6KlR=VbeYUO)W33e5QXnBE4k*U#Ulz`V*iSx@vIl)vwTS?B)X zxKRFX3T6)tNAar!GegM5SRDa(Fv(8GU7c|~D z70mgZll4Sg$d4<*++@Jr4dziLC+xcf2|WvD(Id>hUj_L4B$$^uC)+3VDscQeoWY;g zCgLZ!e*Ch-qwp6yZGQ6t?l>C*MLZZMy7&M#fMUbglVsK3~0 z^V6g20W-ne$T`0_Q(WE!v(A&jdi1`)ZNMDHxv}_vmA_=)-C(}Z=nvFK25^V9nEf~x zq}L1P7L6XI`y7~!o()cyxEwJ38jjk7Gr&Bn;YjZbFxk)P(`^8Ax&ilRF#l9?t?fw8 z+780!de4uJoQRz^Y7a%d6dbiLqh7##B6iyRxaaWOcVM1;k#Xze|An6DkLW(jftPUK zHFnzMe3QBJz+9u`gng9myZ&vGs(&L4pJTFEVIwSt8Yx(@NH*U_$Fr%j%pl(~n&?Dj@5 zHwhX?fVtCv`w2|pn|i%Nz}%|gVo3MDVD^5C>G}0Xe*#+zyF)Gz;7pV9GvZ{`zq=k204t_|w`{^^&;x;1+Y%ulx~r zIG9rnxbwg)H{fmt^MC>OB$!tXxc9;Q+kpE4%-SCXmlyJP6EMFq;C2PGrvWz=%p3!* z2~3XxcOaM(47fAFTxP&s2j*@A?qM)57;tZb`OJX(516qZ2j>UPdyL}@{CxR=2_4(5`7 zuyp0~H`$N-z&yb@zjR6O1u%d5Ot1Gim=`(cr$_g%y#;2=&zW8jw*#2C0oM)YdJRYM zyB*Bu8jkGy7EHkx!S)>mE(+!$&dL3Z9Osw8yrlkty7;>8$a$6X3+Zb}&8*;xhN7X)AQqK9%MZ*TN`jYf|+c$I0oMuU5CiTwFy|O>mx8%T$%!~$fk501CT3kB!PpZ1`^EVu zFk7!iEunw>cE)czf|;e^C_iFg7HT+a{twJC2HdG&E;it<0duDT_Yj!p4Y)VJd}hG? z2h8fDg5yVVSs%=nN>1b(sqDZR{Aq0>-vmdmUELYnR%2MYLD$8<1oJ=6$@N3%-HQpZ zv17+X9$K5}1zm3}UuR5Y8g|-bJyCzj-+jQ$H{ce5ImCcF4$PTKPWVCX{e_$%`)E_e zkLJTJ0e725kGK_JUNYd`2J?*p7g={qWE1SP$?+3@P`VSq6c}((FtZJ~{lP3Y;0_0K zwgGnunA;4v6<}U6;NAxFjR6-~5AnmUjUSi-11<_?wgI<4n8gO%;b6`-;4T4kn})jy zPObp6XdLrbo^KcRZ7XoMbH)k`K2+uYW_e>VU#-hj&lv$FwL0A^1EZYr2Y18#3H%?4Ztn0^E9P%y_DaHoMe*MPeW%(VvG zEnx1^a1)SMkAV4*bAI)MxX~MriDY7@&5zp^zm2XCc*Ws z1KbN>qMPcunP66EIC_5J1u#9E1^fFbxKqH)`ZeQdRIX}=uEh6;fZ29@Ft-3)HJF<@ z=hwb00`~}*!p)hUAJ+@62F$%0?p{>bXThAZWw2f+61oh`dK2{Ac3@81R?l4lX8qp; zb5!1b!x{W(ZK^oadF*e&P1fiUR|jT41Fjd$Q3l*OV3r$j_kj7E0rw7=e;IINw;vPP z6gzEx<$(PC9hlt>xJEEd8g2mPWdO{lJFs-+`{6`CcrduK-=eFdOg8IKOs?>PIe^D>x^QBZPhDg8LNAk-IQGzxqqp>8=Iy6X*QmOx%VO z$3zxjr!9y(7|gQ<+y`K$>>8{$4QbVbxmd%k1@14LA^T`k)gwynJ_D{C+(Y2j$O^WP zxGlgmX}Hb74S+d~b0`){`?kgRe*|-nhMNuU5inb1GyD9?%k|)$PY2zrSr=HFh_9CFD~~$@AqITr|9)=1@i#s z{PZqFx=(^xup85(Php>^M;Q?KBbWBoLqn9xa?Xy zCbAoL+GIaut{luXB`5rdLt`J#Sc3Ra`Aggi1CFfvO$oCtNUs_{?gXx%v$7w;KAJx~ z6wJvQj`Yp}^Nxliz5fIAy@o3XH@b98qzXH2$R1@}&cpZng87DXety)FNZFW3Eq2=c zxV`YhY%qT=XI#)cO?JhY$R5}e_2hC;31)@?w=bA>B`5NO?CS&b*Gj#8^;5@0_QtNW zuN6#>0e2vnW0jn+kDez!jWbrl_)wK+x^MFu1MYorAA|dAmC6s1?qtN}B{1vN=(%5m znO+;r-37gQU^b~|9Nj-4{E+ka2{12l4u`ooVP7$RcpJ<%jZDw)d01+9j{$Q!=VU#R z?mpno2lI`R6Y0K90@KDs-k#3VrE!^`A1BVhyb5;O?cV+L#82o8%Dt{M3FAv$3(WnPMe>7RKIosv!{l;4BS*OpK{KxJl_T`s|oWZ*lF|Qs2=UyJSLKd zoi;!Fh}#oPg@*e(xJEF)ZDD$T{V$z2?amqeX>B5YB0pY-K_%d}iZeaG@fzt>aE8md z@77TAU+jtY366f< z6-=Inqx{$t%n}W^2e>1^+^6A4?=di|Eep1fxV6BPX*g1;2Q$Nf+ZRl;0oMU$kpXuQ zn8P(3<;RI&F4b`4$DhF5Xu#bC=6(%F@p~N1r~~zJUK>oghNF7a0Ol|aN2#3v<`fM_ z_MHpnSp)7hFdH4D_hTzCb2J>~M-!N(8jkEc63pEO+{0jgG~m`acub@iJ8g2iA?hXB zR|BS5!_|T70CT5?BR?Jj^FIwo`8)OyT%X2Ho1cB87X`CS!~F)_QDBy9xYxkl4CdrR zS-SKo+FcPB>fi1M^Bm{=?4$JwUI+87h9kXEhhd%?J8gb?^y}7OGBw<8;3k4;=bSu` zDfbJ&x6T0I@mr+cO5W$7;u$fmKbnH zfVs(lyBo~^8E{{N`OPtUKXwHZGvM06oM*sY4(53cN9F1bFq<43Y~Nh*v-*g)@(hI*HQyTL&3uZDUr zfP33O??*$uu_um+Y=E7%p!~?6Tt1v*`WTY+E8ygxcv6kM%=-T{Vsz2FWt(7V7;?+S1?8t6S`sP_`McMbF+XPD*38sIkKY*2pW80t*{ zS7D&nYN*!%ZmEIZ*@k)-fxFf~?=eHYXTZI#(WCi|@4>8lCd(6=2l1;P+k%?LvIq7xPKAWOg;#yK{xqUKHjbGnA3bk7H~oO8^NL_M18SBecl7}1?T+YLi14ToQ3<=vD4;fAI%T_4ooiRg5t6VXDmT{Sbi+-?&xps zu)nhA;mbW-Wc;{@H$Nuehzf9RoDC`m2ZA}4bAJ9(ep~_OCW%XoGd&0SG?))G9K|K$ z515z7PMcp`XkLF~Fxzp?FV4RPSI8OCqs^}zG=ke-(o>g%elUk~&Mz)h4lV+-T+&O7 z3q4WP;WZ8{WN-H-@%4@M}s>}qeu4LV5oN&xJNX4WZ(OS zdjA0TtwxXR+vFUx{MZ)UM9%u<2iaF^s5cYb{u({9?@&X%6TzLW(IfkAG1R*U++zlM z9~$a?4(@vcz0J-w%Z~}*cIK>Keo*|X4fSS&Yu4yd{0=wNJ09Fw8a=Y_W<$OEz&)YS zBl|u!)cX?L|1^3uZW@1{S$<3eH-)o)`9b#0HPqW5T!%)F;&-B<-r3+T)9BIl!4-yj ze+T!zMvvk*>W^me+XURUob`(z*%t*f*UPD{(}6kC%X!A9)W2N<=0-24(0dBZt6t8d zNA`USX59JAXU7kP-b64{yqrgm?3)W_ftOS09Si0RFXz#t{J4=b_|w|_`tz0Gp3&%$ zzn_B{dx75HOfXqq&SM|>TMuSGFQ@SLU@*sfIgcLMcNLiXyqrSsbub@$IgcLMH}*nY zXU9%kQ2yqDiF!GY9<>MiamEtFhhKiQf$KHUJIzq zEm^`?W{Poqcv9&D(0Jh-zodSu_thI)5_ zdqks`3BC8htZ^xeVbJ`>7GQqMIluVP`FRDH21zgRJf7wwTEHyQa1_5|ID(c69V!A>qtT;& zy4_H38MtFKdQ?s?H`MzRxZ4f%UNqEu1KcMDdaGY<)^4l^Zgb8C<;P@0y>f8V4D`AU z^$r4eoPpkzhI%)FyH}$}`TLro-h1G_(CAV5TjvV1{MZuQj-2(&53;Y)P_F^pK3+Y= z{NFN5ec;UB?dT*+eXH-AcT zU57LH)7n(+F8Mnyfm64;n}N&ZY*4d3?k#m0j()geY%o0g2 zaeR;k?)PBs<{TZTDu48x@y1ts+l@p$%C`v#oVuL;7F-@@{rn)k>4tiHgKIO;JK9k1 zByi_y^r+pq%~0;r=C-Pv=YnPZm$e(ckGj`hi{3X4ez)ayB>!;P_r3_4?MvvxIy1*Q3 zpm!RW3k>w`0`r`gQ~3KOnE!b>Mf}EJhxrohv^jB6=uHJP)604EsJ!%Y#uCJbU;A<> zxDz#cR9=>YS;@Jee(>*L-q+|+e>UoRT(`$g8`Dedw`g67t-);1Ilu85aao)pJ=#?L zCB>yMfm4^OQg98Nb@D?I=T1YtW#Eo6(7W7F@6X`w*62|^dIiiUoD0ggAHe+T22c6( z_)EX;0A^>-`Q-=2tAI23)7n(|LGActaCMvwvabnDC+Ga~gUZ$K!JH-OC6+5%KVmtU z8#ou_#~qxpoWO^lA9sU$TGCUOt5?8$z&SrZC@vX)#(hE9X>&M5dyo&N*vonHjmkj` zOt+U)=$#DaJTIrvyB*AcHqJTu;fV|RaWt5dCB4M*NA1<6V3u<($d8*jgF~!M8;=1vVq<@s-%!JpQqDyLMgUP$27<@9ZE|KO}&T&P^F`4_C; zgq=2rQJf0y8R&g!sP`?n z(YJWwqOfmU&M@oz?b``lfq~vkL%n(678vLqYp8b$xIb$2sQlewsJ9Z_Ga5ZAf1iUH zb*m@Nit;i6%+6lUlOI(6s=@5- z+&?sWWZ#;%nYEJ}fZK|*PCfVdOZM$gE>p1NBzvrVD6Um z68o9ofO{IuSDd5%MAd)LI)+p3@RpZEJt_w^37op0nFFqcvq9zR2t&P-!JVhkqkOyF zQ15HvxKwfw`D-LFM!> zVD8uGQ8|4B%!iU*V!7G{-1lI1xQoSx{8E+E@%VlTXYi-BsW>X9rzddgI9~|v8qWH~ zne-kt)O#M>TN*uT|9$|o{@u)9CtXE*wJVt2yqu@KBE7x9bb2|3-tWPj>7IUQVHR zCYZ~;oI>vbFn{xMigNmYoUt6C4@EhpeEZD9`Q_W!;8wdoI4-2OHD@SE+Who(0GDf^ zH_cFQFK}^<9@WdE4E0V0cfLlC%E6sr9_L(8zx4)~Pc(YeZ>_!p_m5+zjp-%!TQuL9 z31%nG1z&Eag29}B@O;hbOnAV2;9<|0Wi(GSXxo59?t;pn>f zbDY7S)~51<>iHYs{we9H``Go5om`7w_(R>JsD`9b9> z2Ckd4LHThMm{U3D=LgOETo2|hiA&56I{xpR!JpQqvXAQdYvA7Fte?MD`vT@`4M*kq zC(f``{o^v`LEKM>owlI3>f+h%=NfZK}9X9Qst8r+p@_ z-@~ce=Lz5j!2N-=%I`oSEc;i&!|#~J)-ZGP#VpTMc>`Q_mL%vmQciv0MSM^BX>blv$Wa369uC_laj zGj?Tg`$GAV2_{?O67z%ZFKz&{FXvdgi5%s}A~4H1=a(PE9R=q18jkA6A2@?Qt<5h# zE>7Uo`EfP4zi>7vKc4mIsq%x$%X8p9=Ux=ltSK^`RI{CFlI& zO#V&d4F0q>Rs1I4mzm)DIUD51@nFv4oD)CKc#{0M8O+_1USfHn`Io1`ye;V^a#UV^ zqnCV{5Q?AIq9x#V{IfdRuV6OFY3cbfT zV;P7Kzw+{TaPMpMCgAu{kKs8|?6d{>8wFGAo37EL_PGbl(Oymwzstbf z;N?8_QTh8TnAg3WLhpMpW1k52m-I3@gFmg!&)+<7QH>s*&-_1o_Z=Ta_5BTeLkUd{ zh$t2yKt!s9CTKttATTQlL_(EF2oMwqNhAqPkP;B$5<~^D3yO%MC>BISdQ%VtsnWqh zl_phz=W}LGmdu@d@67M7=l8r`&wYJozhijsnK|d)GdsHpp{K`q1K@_Z#H0F6gPAKj zNxo}gwu(+tzcXYu2z8Ofs|-_HbV58@F9sX4cz96NuNPdJOFXLIiyq^>2KT;)c*{M; z+X%PIB_6Gpi!h-Zt@`O+r|*HO!A{k0^g7)dCf*j$`T9%u8!0ePv(w#gJj(`8F^BAR zn!YcT4L6moE|1wTU$E2Vu?c3UEuK7&6EJ7lsq&zF|7BxkLF>vHkFI|qKU;Hg)5-5Q zO2JiNtIC7cb0e5`>~wWWh8gG*kLEWI<`r8!XC9RA9GFkp>FTnO&CPtB@u)6K98O-B z)o{PCRn>*o{ogRx*;(f&k5_UNeqJ6M4OKikzlLl~hzHem;}N(vF7fEP(br?VOt_IQ z@hIOnJ;wV4ZlOy&%6FT`czfZFy2PV=LpOU{_qW4UW~-VH`g<|WVS0&9^1ARm%!{HE zUKgl-b72;VP7-ei%wf?9@#y?~zu@m%VWSbuLlUngOncD@@Aqjw(%6^*>4APvmT+9E zbGG1A>vRmo>^=(g6lxYm*PDN(@}Jic$qLGMJL2F zuahvJh)xo3JrmpCOcr?F{v!S}sP|a^gxSlTYsD2}1rn1xB zAIygN!X+NvA8dlzX^ZE4J*V$~oPfFL;;3q+w_CNtt~pfqO<@ive?7kot~y)Qx}rMA zc#P+V>+BMb`Y6j|ywPw0mw5F0@iENLqLZwv6EK%VC#)-4_Z4>F-vh!%BUl$nyjCzB zL?^_f^BV;7vgjo7K8N{UbduM%-E7PgqzB3C8_nAx!KwP=7~BQ%xI!M(ALV!A=V`Ff z(A6at<_XbB;$^_(icV6OSumf8PKZbIwgG03=p^y3z!cvlzZLi0ij77v4W? z7N&>jB=LsBOc0$=KbnsZV7?NaB;FR7eWH`Z`xmCnULg-jyjn0#L?^_f`AuYlU2~}B zw+GzQF7c>-6JXw8r@Jrt4CXtRcywQ~6Xu{Tp8US#ADA01j;dCEpH(|ESv;ujODZ~? z{Jta{t}a{Ex}rKi?lE3RxSlTYsEK`)uh4m+_D_ZxJ zVICBnBwid$H_-|4==_GjyeT?KyhSjpMJK$z(R>_cgI#MV?n{mfPSqdh;I50u74o3| zxbFad?*}#-!Sy1^qdm-%qLaiM1~XZ7l6arMEEJs(kLGO~%-!?YHiBwlZrbkPa%sDCH3q2tm}&F?h0nJ)3@db-qOyr1B9xWuFR{RgJx5uq-U zd~3io6rGSS#Y=$cD>_NMaWGRvC&Z)q_!MS|=p^xegZWc*l6b{_$LH7YJU5|WxB+p`b~j(pPlZ$WFgE-mw0qvauDX2EuQ?os z@07=QSKx{t6Y3(IAKm9vhlvuMB;W2ZsiG6&(R}2>%n+R<-ZwBSL?^_f`8WV`T6B_l zw;nI;rT4yRmy4d7b1#H0D`0h1v*Nxu0oZ-`FFm*Ra3vq5x{c*kHah)#${ z^HKgJzHfkyMsOWS;>Ezki%t@6Ak1^3lf-)i=0nj5@o0Wmu`y2&532dy0Jqa69@Xyx zOsP{=zPkIIN-(w91?wW5AKmA)g-Ni*bKbwu_l5exWVkpwt6VnNHHYdxXOhFo?{lWY zz0FpY2i0XU%qG!E=ItcRWzh+Bp>=iV-}t#IY&3$$mBecelOQ@F9`$898#5ptRO?^_ z+zT%8=sG?dW(hmpI`{=YJ+VYpbf!FdzrgVswQn4zMR%r&F5WbthvChH6)*d&^ovqt^r%!I*5gNf}N@^v<@<0hS}oD*TH0%SJ~;-!8>d? z3#@y@6Y{0!e<(QBI+!Ck)jF6Dx0tOeUs?ydU`~ooGH<2N;&TveG*t0u9W;h%EjmfO z-Z1H+6Y4_qIhhR|*BpvT7TirTX46~Mgv)2#xFWa9#6w$iB3|Nmtkg!P7-e!%m&d(>T--t!Mc*I z7kZz30xs+ytA@J%s18$~ovJR>AMr3L`!mdLcDg(+k-1Q~F7iC?fT`-@s4h*|SXpqN3whA{vPa>bw8fL>kq$G0 zoi2~pVP@IlIrAuw<9-9P-WJd4sE__+W6MKWe>87@3r_X(FP8Pz26{GMZMG*tQ0 z^{O_^qoR}aQ4-8Eq7&wWUbkL=c};YZcwfUT7oAWS>aYE5uxky;>lUr&gK)(z6<&Yx zbx;u|f}N@^wEkMcw6n!?&M)<4GEAC_qxl`f2D|2v^(C$67vbjE;>q(^46~MhJU_{LuFb}T^q^SJb>R}&>RxC1!ep`w9#_bN z*7FpY8Mb)N`K9$d4`z{zqxs#)2D|2vt!H{)u>#)E7<7sJ-aF_|~g2xr+gRYYwzQ4Zp1qWQ|7u= zL%J@>>P*+aMr^Qa4w<9=cm(cowz|6Xgc-n2RTr9%NieV2;>qhW2WCDyU0oKjv9gfo zOL;7Z`-QD8kKbX=u+!yn+l}JBir8pa@#J~bg=x%Am&c=Q%z$_>=R;V}^!zr0Gp{ca z*H-3)bxM6{!1ZOTtIIH$@$6J}p>_X0%;z@etPB1Am!Dzwu+!D=G|VM-s`}Bo5AlWi z?!iVwx9(fAF(DpQ>)sF7ovp4egJ6cUQ`Lpm{S25{ws_9E(DmROm><}w@+G&94R+0; z%40L!0k*n4&cobbr^};KNT}}tY&3N976sFaoi2}fHfBIP$ksg_r?cQx>%OZ;*G=Xm z{m~sRhpn!Dc`(!2sp?1l@fFN+n{%!M>W}>}C)w%h>?;!LD~XMUs?PNLUT=q~%TCuH zo!FQG@t|5)J>Uki)zxJ*On{xLF4P|%!+d3n=d6pl?qN2wQ{_u;HygJ+4#AyetIMN! z(NJGGY&3Lv)Q5SPoo?RZVLG$Z<&n(BmWOb?r{g>=I8}f2_vi-5oTNVn!cAnWtKVBN zAF)%_kNRT`%vPIou7fbRGcY&U>FQj*Sg7w_Y&2ALrq{vyVPe?n`lCM^Gaw#R{gDYb zhOMqH(_m(@Q`Lp~V=2sfTRdl7=zaWNm_OL5@}>Sb%?7*XP~~w6u0-*|*ZWB6=fL;E zJitzuM=VSSTReFlePGhq>GBxD#+HYqKb{wysz1hfbYo>s(jVjC-es#>2VcT0Wv8ki z^~YYAV>aikAN5Cx&`{r<*l6hbqc%)KcB(p4e>8{b#!lBCW7wDn#)E2IO@y1lR#%sK zFyFFM)rIq(E0h7y4mq$JuTON}Bm@YU~f6VacUY9vZf4l+r4O?CPeuUZ1PE|kZkMm?oT61SP zXZ@%@D#O%cr|XXx7(Y8zovA+(VKUh1`eOzg+k6Ohq4%rr!p&!^tIJB5P3%;4q5e1t zbI}&hSr_V$(xpOu<+0IF80v%ubg_7R)GHJb4~3!@S8( zm&a^2wmc;L@u}cc{W0I8`&{OPbwKOt3%HGJb@e+4bCR8^e$*eOONaXI!bU^aA5CCd zv(xoQH<(`RRCT622Ee?)PS+pv*_bDY2i3az25t>oU0rs={J~CD7wV6qWkP+oVxytT zm-?eBOl@|me5pSgv!Qr2RCzRqi({+HqZdpXJ6#?x!c4QpllRA5m<8-~d3?{t%7XKd z^v5c}srqA$N4HkyB>k}t?g(35{Vu^2y`}KFkBk<7KN9svRhS2D&RIWt{fL9%1SO&A6oi2~9Y|JDI@{sh$ zZ-P_x$6k+apUg@6V?W$gwz~S=b{jrF#YRI_KkAQWFtIl0tRMA9ADF@HRO^M-!3!`` z*s1DF{qZ`?*X(rtv6l^=Vh+{1Is$i|t*$O5!f-!?jfSc&^!m{NCW@UZUs_ikV7jqW zsU9y?$Tu+!ynj18w@^|_=!&I(S| zALl)~e`HS59~a=tl`VW-in{s6R%)+M_W8+U1(kPgUMj0%9rXg zoQ;_T9#naZg?pK;u0KA6S-?)0$7Yz_ws`V9PQhGcr^~~4yH#Ub9+LhjDL7Ssl=kS# z$eg41ar|XZeVV1B{)tUNZEzDtdy8b9# zUNRp-UFiLJIk>89b#-Y16T?nb7wV5>nEtkS&bm;4jDmTAoho1IkEv|1YYtU^ybd>) ztuBuxFzear^7s?xj4hr#k79S={T4PFx;*Y;V?sQbc}V)Bir`fJQPrcXCUe3%h`{+& zhil7LSHB)GPqS0ikLGs*%oJNZXZi6{V3lr zU>32{t-qBpKe;&i`GajRr`YMPFBR_ec73@It}a_$U7}&)*s1D5*Ovh>*|vD{x=ezZ z%1&38H`ySxIb`dKu9NS>eaTjr$6A=J>~wjYfw^jnC(q-yyYT%FY&3LvgtIXr9%R=S zdVWp8sje@zWKLM8bls>8*PgAeF1=yW*{SM6*Nw?A({1sbb-5qzW0+0ss5-KFqkl)I zbVc`dN_}*%!$nH38`a_JvsL9m@!~zk>kOA7#*FRQvjawe);ELR1)mfLvoiNqd>GFt%dE6FHo<~oZ ze(ZF4WU{g4A*^S5{xHF*u0z9RPI4U@0rxIjU0uF}S;|gT7rGAZh55r4&si7xIru9u zM)}Pb;;F7f zU&5_rtDBGCVE$yM%7d;$#qL9$vC*)cb3Q2F`Y=t|>DFlsjNir4btn-gjh$+K>F1EA zvB9o6Wb;ecp|{}XvDMXO8O#QDs=Cm1=orj-TReGPN>mE(E@8lU#>BhWnYVt}cgQ zPO($fh1PwU%AvlB*l4KMJ-z>U2)>{>)z#$$%q4cJy3lbeR0;J}!A8T1Ctoj(V4~Qm@};`OvM~eVL6t{5+*53Ic{~d< zik&Wxw_rZB#gpgp9n1=Lx;!?pvE?DGd&>7$!I{@_!O?N{I9yqu?DtXZl{ra&?1Kvl zFFbFN($}{NFjd*9>PP+Y7)+eaIqOILF#zUy7e{q@8)h~;Rh_9n=EMBRPS+o2+2ASW zP_3(f;mTBXuS*q}I_y++q5km0B--LR>q7ZH4U@r6l`pyBY|JF^pvq$`+{^@Xnl%>%PSqb_4kz!AvN9*>k8*HL*y`%% zhw02tRX^&FESNDi=d2&~$Gb3Jx;U!KFEG2j zY&5KR@;s`-)MBU0qY)c3ARf#-B>fR3I8}eNayWT^w3azZf5gJ|XRE8~#InosAg~52|(52QG`Pt}YW{ zUS+4M3-!kWnD1@zoOPjmH^b~?r^=VyAvV}GhboU_a97ys^0>7|sPArUG<111g^6LO z>yOSbPqEYG@iZIrz<5ygM~2{3{V~+x{NB8{&*ZFm7T6X^4ZXFX{grK47iWj>gw`6%sO_e zx=?@o0dv|GPo8hlnz*mSMnjb^)ujR(6XHRYM~wj&#m1J0@cKdL{ej?A@4G+r=;p|rq(44_+rU;=zXLEQ*s1DA{ZXnGzCVMFhHBkY ze>8?MTpX=~elY3mRCT8Q7zXnyJ6(T#&jwF1hiYA|f!oejSC?Zj7uc!lLj6&`cBros zHX2qu`MPQV^DsMAzEqc1Y|MaoQ037Mt_NFP9vLvtvD4-82FwSxc=9~Hg;~ZW6-UGhcs&e5o%7z&+1am+vbu@3K?nOV@)XFhAOye7*by zbDEthUt0H9U_$EZUq9$`>M}49>{QnSs&gD0?3zQ>M~QHK*y`#s6egFQsxEXrm<2P> z7EfN6Wiad5>FTnD4X2^J9_)rY##WcdHJDQM^y``OcmSpWJJouod5eXKXQ#`fD;rxL z!g{9XCksw>J?JHK!nzMfycD>xY;|>+4l|3LYJREDm%*&J#dFRtt-rl6N7$+ALVbRU z4R+0;>hp7gQ}y{pxY7?6em#nme(qQqrZziOzSQRiOlO;O=1c1!3+6d?s(i^!fXR1p z)aNr`zF?>8^IdH46mzKh`~ci(wz_ptv_8IngpG!(F4Q0OV4AYi^+!9HM0UEmJjKR5 zFdkHSq{8K})#Z@~Go76-kFQ{Uu*H+l?-rQd>~wh?VPnff(&r}xr|R>QGAHzTO&shL zT!l#Ybzcjn2|HC?sLvB&l5Fvub)nbQOqlVucuq$@ANxKV?3zQ>=L-a<>ho{leq^g# z2m4@-u~X$seO{tLsP7JJG%V-LgZj52%p>e{>!3AEoQtDA?*fy-PS@u%*wFdWQ1!>V zaP!&f>ar4M6FXI1sLxNrT(rfL*QIpBP~Yv?Xz1#49~%?mL6t`YTw}JnJPepl>~why zh8by#C(mOl%_dHuS=B(qc1kAA;Tf0$f$x^+K~4V@ni)q437ZY5h?U3S16 zW~ZtPt$SZ%+(%%eq06^2ObvFbeCfIo$;J$b2UQ-;;0(69Jd$9ZVW-RE1(>O}c=CCh z4f82GT^%t`uVCEQ`Qy82y&Dbl3yx{s9p{n~JtdN${* zAN5B&nC|R!>tzs34m(wy>2+Z=%lZ9as$(9a{SgWJhgSCW^M9 z>FjjtWgN_l>{NB8{+I^y89QBnY-fX~m_xO$_QIWHtE-Ez8NTm_jfSc&^!ia7rZGER zz6MMJJ5|24{+?t*$EBglqc_}Owz@oCfO&t+rY1X8{ir|Mz$Dt7vwrmc=vkOC z>~!m88qC}5RCT62=D@6Er|Xa7Z15CwsMgh4xR6KO>rw%xDmztOs6QTq@!R4#>q75C zpMvSfPL(gMzf3k}5_nMMF$``JTU~#=4KtUWE|0Y^zu4l*^Y|U+6gyoWm)O|yko3n5 z!KwNqB+8nzf_N%dMCK&@Q53EUTV4Gc!92!JRX^&Fr(g!yoU?w^ACq8au+#O&JeaT8 zsp?Gq@dM0mcDnuuX>PBdYF(9ttH@SYm%1>`*s1D5{m})cmo1*NF4P~{Fr(P1@}>Tm z$OgOSQ04Iw+q*)7p7PXtJb~#IH66Pm%syb7DY=b$&PS+n5 zANAHBRp9Eg)zzgHOb2$Vx=?=%f*ERy=d26$M*wCTJ5|2aAMdikt~pfwF$ZoTTU{PM z!R%nC%i|xI>$Z6EJZ^sszZVu84P74hvoRqa%seFhQBQEH{;2QKMarC{KN`Trv(?ov z1!fRCRsEe2(|X?Ci*P=8E-dC3;fSr_V$4`4oJr^=V|Sjfgq0uQP@mcngftIOjs%-`&E zdE63%pS!_ELp5)dM{Sr!>~wjwU}FZvgQ`Db1*htdwjP}!b3%XA#QFH)o@J}6-vpSK z*{SMBb@?1-ku9Ec9nim*wGrlkEuPa+A6;XEU319lNBwY1OZ)4B>iall;Ud`T@@)pw znw=_Nx*qg~$*?(R9<-kGVWzXwt(W&;K5}vNdBg&kpV+Cc2lRdMb8N6{4pkprfh*Oj z@Vbwbz7MSgQ;VIdE_6L;3-g36p1dxpFoW3X>N1oKr=h$ajD~xOt!{olfcc!AE{~sK zcG}{}^Ed%>o}Dg_Yiw+J2(Op){Nk;}^(_DS-B6hm`kY=rO2AcTtE)>>m{#mmb)j{i z0+ViY&brX&aFb!)WM>`M>8L;E!z^T{svoWUDGNnti67!bzc&$B3oTu>cTW* zr>cwjJ_@FnEuK8zY?zVkRQXa}USNY=bExu|0{1RkT^?V;EM=$5V=v5~ws`V9uEG>) zW7S%h$1QAZc?j#C&if9*sa^-~^yu!AIZ1z1glo)JS3d)$6FXJ?s6Ph7jJ7#v{pjZz z-ho-*;%FUghS|wZRcHG7-9s?{u~YR2^<_j`Z~f5_t|ePtUAn;ZW~ZtP^~V^P7j5yJ zb)kIUg_*-nl`pw3*kIQjs{U96x1OyokG(KQ+3E5KH9~!5vC**N$@7SSsmo56$3tw) zfOs(Tko3o+f>ZTJv_}^sb3%WF<9u4e^=7N9-w>E_>{Rum{+J2#naw%tN9%M0%x-qN zI-i2Mz)n?X`Z<6bFn9Z{c~kWV-8aRs!LB(}>&k%Z##UFCG?-!RRCS^LcnxNzEuOP3 zwC=x#S;9`0FS)gB%p~xj%3~AUezv+i&cR$~r_1BM$MJIt*l6hH?Gc!k>~wj=u`vVU zLDe6f1gGkcE*@Q1nUnNKH@IPJb@iJJ^Ex|K{ir_{!mP46=Q^PNI0SQ=ovzMB+u`pE zVWXj{GxbLWnELE={n3?;84wSub=4Ctovp4e<6x$+Q`Lp~<5QT0ws_9E(7OK#W-B{Y zzU20@!LB(}dHfFd4_jRxCFAgOeb{K|@@NRtoSkmo5@5Qq)8)~djd@@^sQP1o;8gvQ z=Ftt3IZ1z{!%bnUtKa)D^VzBDNByx8X1C2b*8%m%C79yz?$@EaVXCrI)tUOE4ooaN zU4IN>gQu87wXU+^#{NB3{#XgK(H75H7h3lRVUDs>Q`L|9<1ox=n{(EW`s3CP_?#ab4c&F9K1@?~syb7D#K81mr|XYgHs*ox zpjuZi!oA5>SC{!Pi`l8_LjAD|=CCcEvo5smFTz}Br^=UH$pou**fobLkFs##Y;}1w zhKXjU%cCdEGq!m0JVwHdXQ#_!3L9Gao-HM+}UgovO~%ABix7*y;LXIvYI29IAEoHr%Id zb#++|vyq*uF4P~#Vg9kjbJoRN_Z{*67aI*#zU1yGH^g z8DWbj&tnSAYwUD+%w%KBL((5}1*htdPdvJLGAHSePvO?H)zxn=%u#l#`cZ#`CgR`q zz(zyWAN2j11~Ad=bp6o@CW)P@&eZ4qV8*f2^~Wb{==^A?*3|;I6>N2N*$#7vovJR> zA2(o1b+YQB%9p+mRtcsCJ5|2aACYXZYYtT&&EO2Sx;&C#o?)lU;{}+hws_9|pgd;7 ze8x_f$G2=a4QoCm{jp4Ns{UBv(XEs@p+CZLQmf#Ou+`P?5=_y~h1Y$g^yl=e!aQhm z&ic{oM;y$P>{RQ8)j`;3?)%t*iBLyV&aLauVh;JKegv zvkUHXu+h-v+Zd)fJ5|0^mo{w7fOt^l(H^cRTU{Q5VV-BF%j0dBIktGt`K9w)46~A* zE{~0DYDJ2_m`UtZb*4OCftk-v*B?9B;3?)%t*d=-r`YQ164DL7FAW@rz3_D{Qu_Hub(s3>RQ02}#KUy4#dFq=`e*>m zP!~si6kvm0bC~NuxW3SOc~fw*pOc|JdLM47?YQ!Mx5Dgar_1+0nBq?suAehsI={PN zsarPT4?9&|==yvGrf8D;I=u^~3Oik0YO%4hP~X2a zfQw&8ld6CQs*WH?k_Z{3J zwz|4pfC+i3@OqAP+_%$pw+c*6c2+!RU8vuh!z9?^IUQYh)7fCx9J1>!t@BZWlU;Y| zxMSg_v(@GMG0ZpYRO^8H{8yNRHs{QP`u93aXiuwtx^++%rlO0ZKCcE7#ZK4fec0eB z=1}$d0Jsrsb#<8n^Cml0U8v6&!K}2!lhPoFSK7`1%qly^pv9 zCY+rvk4Iq)TReFlNicoc>GDWtW6ML*=R*Xi>hqy8C-gbpZw!N*##T4Kb78(_r>YCB z`>iksY|dF1>bGk!<$4vqZa5wFM}3&4>{RumpTCNMNn)p3_w>2IcsAHIhicuw0{1>! zU0oK!tYoLE3$6QuFvo52OxSDKrc{GPH*y-}<2a{=wC(mO% z%w%?|d87G#jg2i2VcpYtzbiP^x}WLM&5}8xKf-a`_u*Eu)zxnY%wcw_`cZ%QdgJ{n zHX4?5){oX{9hisNS;uucs$V=zXLhPOQ-37Gj9{ng4~q9b8|<1x)gPb0EoQ5$%O;rL z*s1D5{c#zlNT0&jXL-JN!c=Cb%9rw}$;Qe;eg78;7tL0eM<~wiN4>QRYPoBry zFtgd|@|e%YmWR+EG@lCvr|OTz9^LmcC-g@Ij=KczAX{Di{vp%1@Vbw5+$U0hREDWz zbI$rvfB0d#veWg)K$t9csyb7DjDmTcovuHYv%yo$q3VzIaJ$&*>T(k1GCSS6x-%8` zCD>@_@@)*$oSiCP>W?;T%z$`M<nCI*x}LblsQR%?1KA`t*(A$`-S@M!$w0@KkAQ1VA|T8vwqYcsW4gW zbn9gz%uDQ4b*BD!1LkXXy8hV922U}EYF+&f_YYfLT}nQU&%LqHP}PNAKN`X`XQ#_I z0j3)}Rlc_l-ejlCV-d_sTRi9d()sOx+0Raw$5A$B5(Rlk z`s0k?RQ++zqdPBiLVwWvkAL9GK2!L*7AbvS76B8bH$- zuxk!;9SHTK=kFGr>T|e#aA(=-@-03PpC4eOp~{!euRct3n{(z%>-kBT-t2ViB@HIq z#nI<*&%?}Mr>Y-)A7U9B?3zQ>M{D7Bu+`P&ILt+Ms=Cni;EpuBkHSX7iYKp2LzqX{ z>FUy&jTsORsyyQ0lGy6<$b=cmPM61kU`d_+oL2P?uvuv68A`n)AfJ6k+wT>@~)Fvr=^x|PjaV|@Mhbjfv6 z$bR1fjydyKabZl#BK2R+6+3ipqP zc(-SIn~!_oYOvMKM{AGq;^4Y@h&RMzyyxLw^bl{Z$9P}BE%6ZVH;?fS!~N|c-Yw61 zn~yu-!r2DrL%0sn>&l}-Jk{%JOSmpkIYoGMIJj zbl2T2FuPqGU7wD?{KroBx*9Q9th4j{==<1p;G)>->e2zG2Rl_==yi2COs*}S^SD%( z88Gj$)79l;Hh79TWY=fPV*%U>wz@pF!yIC#%i{)2sVu98Ry=tgm0<2?r^};08&1P| zoe|bEJ-?~oRIjVeWKLM8bRYXLTxYhry7Y(1VW+AKt@~GDX4;&yF7*Aar7&Av9Ib;h zFqhe>>PPP{i)7>9-@-;iweIP2pI9~~#Di+RB*OJ!tEZmcM@N`J>{R_h z>uNe1?3zQ>AMe0@##UFC6)-=uQ`Lp~;{?nFTReHbrH12kA8a&K`BEPDvN0hZRC!c~ zYs6NUM_ZUgcDg*Cg?Y{vPoBq1Ff-Wc@|eZOmWQN2J{Fv+KjwLKpURxjA9R298QhO- zb@kf^bBvv;e$*c&M&SEB*l1YJSwHHJhA`3Wbp6o@CW)P@&eR|MV8*gj^#^^f@-Z9i znnSg&zJy!JR#%rDFo)Tx>O%eDdk%lk9~%u_zLjBWuv6tr{SnE=42TC+9?jqkwz@o$ zV4h*8%i{%@skV5|`K9xl4f82GT^&cR$~ zr>Y!m-;v+PuLruW^?!AxVP>JR!ndkGslKN_lawF>T6 zwz|6f1#_OAsxH(Y>nKXZ`5)qZ>>=cDnU40%jaLRh{Yg3rvQY!%o*9o7mtf=1{Gx?Qnmv)z#$+O!3kB zx=?>qhpER-mv0P=pPedS>W@S=Ru=01=m9s7tuBwzFadU|`K3HQhWW}C&pE$ze(PX1 zv(x3Vn~g0GNq-y?oT@*LcyzzZoTNYgfD0K@__`J;{k~8In5yhl^`riH3?|Ozob{uh zj~DZmEC%y;sJv&{09ARUd51}sfdFOGst88`a>b9|=zI(9IP}POj zRWq2D>{R*E{a+WDWOk~2Y5nzQgI#l|`uthAv21mDOoy4pPM60rm>+HNobyY0?1TA} zoi2|vY&Z?;bx_hDmj$QlkES_g7P8az$9^_=iaAv4>JPXJY<26ZR4)EKVQe&1b)o)f1k-|@ zsz0bMPr!6%r>jdJHgsGXsyqh5J;zp;$4fA8vD4-89n30QJo)_YggL-Ym&Y+SRu-Ix z&>!^tvw~Cg$2pl3*8MGrcV2MOWh14p3pe1(jMvXE^-(RD7VLC&egftxmw41i&%sQx zIeDGuz|3c-tMek5~wupW`b1{JjEQU^>;g5HMY9CJOtB{oo@a0f*D|o zC$G!%FfXvv)nzIhw>(~lo6A<0#}b(J>~wkj33J94Po77y7x3>WVxytU<4!iVJS2To zS#YX8sv>hjAJKh8I9w!KU0qtkB(PJ}r8wfH!(_2j z&>wW%xq?%@4t@c*L_Dq#uOj0826IkynSE2TQ_S?u2YUT2n}@%zfsIBm4kE@9I!U}KFz<>^5^o92deKSd?N2slBJ`k`x1)kn&D$Bc|HR`8 zdCwa{$(#Di+xH-&5E5|8ptfyoh_=T_N-oI?z@-6cUehvy74OPD3__HQ3o!RO7ygy8iOFZh!S7F|^#dG%g18`r!>|{r0 zDeGVQT)zCP;`}<}(Y#f2IC-Bx1lN+SsxB0-7fiP3B=hzP%)6qK%-a%}jiQspI}USE zbV58jzdNRhb&=;=6Rt5^UA`S*`iV|*e&b=LicUB`TKDr|mWoaiZ!gSI(FyVB{YU6@ zZ~5L1SDCFUUy9e|<{lS@2$y&Mel8arJdeFC%4B_8$BHkf_3c+PcCpIe-Txy(-W z{!2GYgJ6@MM~YuIS0@-^?**q9Ixs(4M|TDiod>uw6nv+Q*9F#+afmw2@PK8IOkizlCt zjWEBm)6K^|HaGKi#-ltA!<}QR%OmuSP~Yv?XsGH;c|^iI%ud%w@i3j(>GJ5w#yl_{ zWcM$WM<2K>wz@nf!o12(m&XE_#kP3P`cZ#ug4xbam&XA%x;$u|{_b#*($70j!d+&o z%7fzF`KI`KB#&1at~Og$yl})bV4h*8tMf>hNiOkdz0866+!jw>=T$I2vD4Lg8ykc+ zhitvj&yDPMIC)(zz=gb}U-z{Bs<5$+s=mI|hl}zMue-;1{o!(4;?aHVt1uslPI8~P z24;)sg!@Fw_cY86(MjS}dK>QtvC&YiD_W;**_aRys_SzHxE?O?==_FzjF$&D-6bBq z{(c3sL3EOQkHK6Jouq!{-@(7%jg3aIE|PdLF!7=j;!*tuvM~eVK~=vjxX~{0sDAHw zjQ1JbcP{a$emh}Ki%yd7t?%OBbHzp@SQjB*I=`kcZAB-EmkRT&=!AGwzn9q1acQXP zHv{ei5AjxbjQ1nlc9(cmzwvZ!Ao{=!E-NdL5X@ z2D{c!d|v#S;8b<~25yCTTpcB*aP7<#>OseQ4b;)I8 z9+(~^b)j`SL2#$Bzwcg`>M)H&CyDn2%u}Kh&X3mf zb1<)pP7-ec%nzcI#M=XNo}KP~t;7fT_rb8yP^|;HUuyvK2sH;&1ovJPrZyC%^5AhDcobnK_%pBaWVWXitzj`nav(uel zSC|YB@rJ`paEVtF=kx*026no2Z~*3nOFUZVr9Q&@eQY#T>ww<>)_|$UPW8TwTvIj_ zkA`d=P#%xM^<%5cV+70#>{NB8JZ8guW{cd`;zK%KTJG3U0qUO2D!wex&&aR+2T3tLVy2gF3d`Hs-Jtk6Ye-0?3zPX z7kWMSeQf1wDOv~ex|D^xkF9Ecsm_nUbQGQB^)eG?r09g#OFF+dVLlO^B;IDGY()5#?st%JcZ&)MQR*8%m%OE9moQ}qYU(@Zwl zHHT~+P+dN7IQcr52lp*o)jFW>r)>8a?-1N6mw0r3W#)NXr{&?QuvMKOt{NB8_k&$v2D78@+sV$4em-J08|<1x=ECtOU%~y# zR=2MHf;rDlmq)qJ@%Id|(NN_M74%s>g$DjNQckhD2>rY;n`Y=)KRCS>| zy2JFg#dDq?

eyev@#M+(`{S5a+bD&$CB z@ZIqAmuJa_W>2NvPZd=fQz1uE*`X>oQ9w0%m;d@fQT=8rN*)Kyy)q$yyBdHuwWkw>B4NX+O+eY-)TgVg5bf!X% zRE>tH;??N9{YyR7|LXK1oSJ6VKJ{&2Es@8hyg&fJN zF{*eq;7CzaeVGb5lBx-+bjOCG+RRkQkyLJ|;$y>x94U(GH&Y=;QZ+>tKT_JYORGWFiYkezkRy3DM^!-*6k7Rwea1aSb&jc!BdJJ$6u3K}>}lN#!o7+S_;YR#dB)3OSOh6{?`WU~w?B zTB)c$F%@zoRclo7%15U(9?Y6?>!NAhZes{AA<+0Z0( z&lskto-!43Bvo5ffdZBdFJ3z;sz#eBiX2Jhi7Kc%UldgeQz1vX!`V)ydWA=&?tM|@ zNM7wxWk!skmCwh%EFC3|<>3CgaD&$D2j;P|JckZ0q#}%)NTWJfCBdI!}3T7Lq{@P+W zUnr_ROobdt)mh{PagQwQSwT_lU@GKDsxG31pfW19%tTQcYy(WAL5@`UuBhUbPk!4f zucGo{D&$CG!v|HmBWjRpY#>K!VK-Enk#>*`92+rWY;0j($dOvuU25TFy9(qBhTsYg zmfuW;9LdWURk~wCQ8n96)yR=leyGwN8;WWwQz1uE`J+mAY$&S7Oobdt6@V%}HdbEi zHBnL3-a%W497z=@@&d+r?fOtfHH@i{BdLN!3qb{ALs6Y%D&$C&4@Q;l*iclJc0wfb z|6jn7#zqfR>5h$Is*ce6S&s4~fRDDpz$Hs!9AHo#X zR;EIZqzaW(_3qjhS5(^F&_4Q&KXMDhPzC1{SQd}ycwbR@G8J+pufDl{wR6ghcZ6R_bui=u{u?h9xE2@1= zg&fIigvzUf@G5zbdLc*h8Yy|fJy=E6m8p;;d5uzed5F6`^O*`cl2@$c1+Tvp)f1*d zj^s5ORd9_BOPb@H-tC2##UY9!NAil3yx{#xMKzqMkRy4;qsoi~g>g8<@@llAI>%JV zk-QQlFVA@m*C{Hq!?cCSk-WyB3i1N4U5OQ(6;&itAxH8`l)TD4t~W_h9bqcuNM1?8 z3tF?Fh)E|eQNt4dkG<=FZ>zfA3Q#C3C2R;IfEZ;2dBq7Mmbc>(hwQLkWJz{RY{|%S z2744j345=y%id*`-7?E6yX*~RuQCh#`JZ#{dPjOsdKz|Oeto~#k@ddseCM7!-+lMp z_W*te^SOv&TE{XiT*GNtU6Mr@rnQt0_|#c8tyLcc zLvRp=X&p~26+{0qOOG>Jdr1~ynAQnQ>#+Autu?G`C5tdj>qM=EzFdBIJ1j_5qsm_- zi!e;iFs+k`rCK&@H)d$0)y!{S@QFs;*=))BwGI%ZgBOBP|6*6GB;ei_Tgy_Y{X$FRPY zEW$9YGnm$9-;JGRSTi0G9ukIWok=WJHezr8^e@A@S+WSjw9aB$m#%chA%?ZiKZF)x znAX`^3lSr}Y3OXyF-%AnVVKrAOzYko?_SfeK9VfLFs*Yn3$<3=Z}kPuS}XJ@eh2S{ zLk!b8PqQ%cr+;?Lg@*OAWD$mG{fSsAzuxiBh#A(@$4JUY7^ZbT(;8KG>b-{bxMUHA zX2nMdMmxsZr&^YY#rpu+En(!Z5Ath^3-|V{F4( z?HQp(7{l;jZj>y-uxQ*#EPE~+)~Aw17^Za>vDO9e zM!?T$4L|yK){)=t1@v0%SjT(4yP4L_1M^oftUV-)Fih(nmM$E9&DAApv1Ad3rR!d% zHM8l6a}4Wj$s!EXx=*t(1=u^BrL}ICEW$9YziAe>QzJir{{h2#O|l5XwEj*kdrdh; zYmN99>ic|zVOsYyt^FSR>T|=YkSxM5tp|vu$_B0_9-;GVo@5b*X+6laaNh&NdQP$k z!?YgKEKEV&HWwcHx=vTsi};<-M;NB{ux4QlxBmLdR}AYW$s!EXdW2Y54w1F@zQJD% z%l{I51qWf6)<2lmR@;2`tYMucS%hI)j}mJPSVXPx*b(a()*3IvS8x!9X+6fYPWtqt zhYjm6$s!EXdYq-}_@mE1%dozdEW$9YCz#fSo5r>`ta+~p4++Dxo+K8wqL{9gkA7-Z z!+KS+2*b4g$+ULe{jB9k4AXj=X&rXZwzCXt z{A)ssFih(iVyUw6#mH0dG^}eRi!e;SmPa3HSYuunT7+R*&k;-2FKnas)@A-Q z$s!EXdY)w+lJbaZ{s@Hpb%`;jJ>xDOoa5SU85lW0jq5|F@M^<_W{n^&zpg0|tEXJv3&;@ZmbYE|eY; zhNbHxVyXQ4A^7G!hBfj%)QA0@5yP}TCYHU-8`go6MHt5VgjnlO(o z;nPx!Ff4{&Xe~_FH9fl>Y*=Id4PU`Q7^d|lv9K+}oW@m)h82@6!Z6lX#6lfBM%SNp ztYO_NS%hJ%{}2m%J^0}3J^s%9Ch2so^#NLfXKN9|()Bg5RN0t){7JhT)?CRV4Ac6C zSoX4ESl3GyVHoRMVyX5J_r^4=5g!T<3By?55es98$JoY;HaDy}l0_KC`kq)SmvL5P ze;tjhC5tdD8b1(AMFV#*Fs!d7i!e;;H=!Vgv3?|${R+{r zmPi(180#lusj~6b=+U1T){Bxw7{>aUSYyBs_~4t{zTNd3>S%2BF?7z>*V@gx_fEqvfriw*01$s!D6jUd)Vfu^hgBssFOAwH9nkKnG!%)@n@aFVmM+ z8`k|_3Kn6Q*6PHvx4nk7!+!*eFpRYZu~ct9@xGtWHmozg7A(TB$gfE(EQfg1?e)%S zf@P09VVKrPVquGo$Kf}vzvJpU8Y8|H-x7vJ<9Ec;W#i;2*BDk@vIxVp*3w$=!MC(x z?E8lGs$>y{X^mo9N6c$m&9GX&6CM(VX{}8xY;0EW$9Yb(q$Zx4zkJ zSik>XXc2~KtxGHw!^-Wicx*Kt!?PrdFidMbrbT;5YSxG!gcf0#*7{ltKKLf?xavkm zt6Q=N!?ZSFTCd&qCX>6~mi1dS#4Z?fzfkAz_%-MojC(6&~s_tji^f zFidM>VyThCZEs$D_fa|;qka@xgkf5vnbw^be*BbSwM!OZnARr5viA;#b(~}ohOss! zmTKqk-r|i8!+Kn@2*X&LF&3^{HmtRO66qogV{NX}g>95of6y6*HAS)r!&qa81;6N6 z+FtdpVVxpbgkh{Lh@~Q5ztP{?4eJ@nA`FZCmfAzq!#&dsYs}BW1Hv$^t%$W6oW^uL z`QLLZ469eN2*X%@VyVctT(sx$hIO}O5r(n0CKitL@EG~`bDlG-b^cF$OBmLQZbK~9 zf1Q8(3fl>my%i-4V{OY=XnP5jUOS60%){+;x{!gr-b%X6hoy&vVUhnmu~gfOE5;4$ zOvxe))7qX`SeNlQ_Q&4UH`7{=N)}<5)(%VypOiGLbAA!F2*b2?B-SQy8b0_=zw3ZY z46B>QJ3b#_nAT2AYi#!>e>JRKMu;3C4AUA*EY(KglahwD`U-+Y7^bx|(|TdikT7+R*B}^-D_Gvd6)*&ki7GaoHsn)`pGNokW&$rk4 z)&3j7A`H_iV_GA2>0IBiMy@Pagkf6c#8TG|cn{IA9+xb_FjfVzuoXoQH+tlP(+%tR zRfHB{7;7A{um!;5tScsbVOZ0DD_DeKEPPwliX;5MK&{UvUUto+IvVS(Dp-VJ(HKuG zRa5Yes$rcXS%hI)6NqJxhGC6dO=uB@v34O=0K7vc?%H8k$4eGr7;9HzsX2$h^Bd1H zthHAcT7+S&-H4?|dU!|GuuhgN!mw!UPAnA-Tm@%Xo30_W2*b1{5^F~p`6UmnyU8Z{ z-pv(~MHr@4#k86>yK|voO)cD`}|I@2*X&l#KIN;5wDK8bksUJ8mp}(ScGBGs3Vq&{JA4y5yQG! zvIxVp>eIB=)mrzw zdfX|7wbJ^6MHr^lMl5^jHLPnTi!h8enOJH*>X$F(UTau$HV|5bVXSt|f~5I2uO79; zuvXttun5CgQ;21c#s)eXw@DUZSTyz^mMXn}d*-3_4J)*f&>{@eno2BtGz@FCjRlJ^ zj5STC3lSI%!@5%Vp#J=3oXJh)(m2)y8M5q?Dg(OIvVS4B3OiB z(U?gr6^$_$9d)x|{Y|n6!?b1*OGSR8$DSYcj_$vDHx*ihVOq19R_nK0jWw*%n+X)6I~)ftxbXwS8aqa? z2*X%=6HARn$Beu9luvauUY9JwuxRWSFEc%{lc7U8`j&BMHm+O1;kRh z9NF`?CmL4S_99(`VdZckvBX(a^ZBl$T(*}(!Y~gP5lgl6xEk|#T{e!CT7+R9E@mE{ ze$r|1QU`VC?M}%e4AVM*SgJRF>@N%Y{F?QZWD$mG9mupUzH;o#hPBgsb`~tcFs(zG z)+L?aU20gPO9YEBOzSXWsZq-JmwbQdC>_IDrGiBmrgb>ey86xk9&A{n$^?rrOzQ|@ zskRsA91QDG$s!D69Z4)TO8M`}cb{!oN0$pN!Z6k!h^0m;XP>eC^M=(_Ay|ZAtfPp9 zB}&b}?4+Zy(m25)42#Cm#8UMOXJ8C#j${#rX)Pg^JsO5}tz;2~v5p~@eFny`R;m;p z5{9wMHt39fmj$rJf662%hL_(Ey*GbW1UDW z)x+WpjA6mHI%JD5EE*>fOGN``U<~UB$s!EXIyr;Zi;_hcrgaL_+GycR*BPyycM%>E zhH0J3v~X0pm(Jy*B#SUi>olg-Ufp<-VO=d*gkf5z6Kh9^71po6uXxhOZ)vTkB#SUi z>kOu~*$Pi@Z&<7ED$+$5rgbK<>?O*u>LrUXjCB^V)V2BLCqMJ1VI3h^gkh|+iG|}s zJbvihK5SSIN)}-l>l~dfWZ_#^M(V546?PNpA`FYhxtawZd^nCWte9jGhH0IrSxRe7 zt@V;*5r%2~NwbueVNKdyct{wgb-rdPt!=c{?UF?prged4DJ{d=cB0TC4AZ($vrr4y z&!4GF)ajB%7^ZcRW}z1DKW|v~Nfu$4*2Tn9EdX8X)(?_J7^Za{)7t0A#a|d!XRYv%Fih)urZxYa@rN4Lvyw#^rga0;y5iZZ zpE9gqozNl-E4?=o3)^@+7TvhvSi!QFUcxXBZz7g`^tG)nQP)Z>!Y~j2!aT&$mtp-R zS%hI)HxtX=I~Z1Ty+{{f80!{d*+*Z7b*^L)hOurXmVNYPSYJsNVHoQ+VyP>sBilcS zZmOeE+aNq742#C?#8Tr8+^52@)^8Ln!Z5AB5=-5^z4nd~ZyMGIl0_J%bqCWrXM=6q z4ePEZp+y*`btkb@{rY9iw~~f+(j>tm4AZ)cY4skk))|HsX%;NPFs-|ZrRvv$pZmTw ztnn>^MHr@a57WB*?b?4D)*7vXMHr@aFVmX;C;uyk^`>MIhH2f$w9bC_wLZhTxlL#h zhH3qcSgJidWyvRJ8rCtB1&c6D>+ekKt({-_k74cIE?9(NTK8)f)@AHrx6$P=Fh#Hk z!?YgIEcoEVRRo50pJWk+X+5Y}N^6YPYTrX>5r%0!q*HFyu!+J-u2*b1<)-0v9 zxz<`RRcH~0X+5G@sDp|!4-EW$9YN14`=t1fM?{A8mShozX+1|Q)dJv%$go;x2`$1ft>>8* zj))BFuaZR=ru71`REv!xBE#Bdw$LIB)A|?F!V!^Sohn&`VOlQ|OSRZIA~G!B9HB)R zru7oj!V!^S^-30DnAXco3r9qT^|E9UhH1URv~WaZSdDuM4++Cc)T_j@kB9`zUZM!Y zJbX=SsWLxOm#CYi7Gao&uWJ^3@ST6it@8}4bT8o{VSHmd`uou`9&Zp!m0t0k^7nel zLd*)jv581184`#$iKWV+_)c91e+VqJhZxR!i&$z+`wzRW@`9KVApYLML&R{_+ZnXB z1r}-{hO^$uz?vvoh~cbviM5_cknh@&zlW(r6^*&lL&N|JgW*pQ@;zeVnk7ubS2OOK zZdk`j7Gi+4h-izD_P%DJLiza{-(^^rNfu&+{(JHpWO6(ICObHaQ=Xbn-%A!^IO_w= zf)Bp0ZhqwVhPClNA}9JnG+NsL3lGF_4?icCbAHuG7GgN-3u0kwjOn`I{9QjWTC*h!F~G8w%rA+x6)@17 z51#(`Bg2YI7Gk*8SHyD8uVW+&F~G9L@IS;-qk;>q^Nu!J4@wqdIO}U-IY<6uU}5b> z3}=0lfwht)Scn0ZEgIhvYdaZ@xsT3*-9=QL*&JASAO={rdiou)oTIV3WFdxo_&u?l z)Aa}GA!0b|2V%i5I^L~YWNQ;HkXnf0tp5_rS?gA*g&1JjqVXfKwgn|j`KF_q-bREt zo|0OK0hTQqKM_ksW6~4vz(pSl8Nj7_GS>5e>v}){4a1NV0Z%?fhd5>qyB$3}>xGEWD3~$37#s zdcv@7k}Sk<)^CWVTDIr6ePy&^y)9XY;jER3;O?_pn)EW`lIR#Qe2%ekhE z35)zf3}^k0SgLM4_0)sc7!T`#g$H6dYpo1g`${duaMmbdjRA}BK_03uA1+yl;jFcZ zrFx>1=6qs{;W^Sn#BkO+#8TEj`b%j&BE)f@WFdyL)+Lr&wNO3!xh016FUdlTu=JVy z2CZ^C>ye!?@I8Exhw^2$h{y}XaMt=6SboVuj8NYVzEKCavjN#T3{I-3nKpA@X$LW! zwIQ*b>-z%9LJVhZL@d-%(KTA9Nfu%_Yhz-mk@>dY9zMzNuafCP3}=ldmTI3*+pQm# zfh*M)BnvT|wF%QY`NyNC7}knW5ktfP%hn=oN-XCVX=lko3}lVpE3}%ez zA%?SdWLj@-xoI6D#4%5@5W`tJ5lh`qNz5sG&9Ih87Gi*fHAUJRODxPU^d>U$%_hUT zT(S_uSvxb<`M#?jH>|ncB3+2#9tMa7S*vGjOyt+uPm~SBa8?PiFu(Aa{ojQHMr#jX z;ei-n+48HDSkC#iRI(7mwaSP!7c8!UX6aBhNVOll#9vnq*&V>{`s$?5Fw8BdxREZIBPs(ZScb*(4Z>T zSjj>RXH8(NRbC#o$gpZ93o)Fv3uAqE?@_R6jnbMeS%~4RT^Z}&=j|OdtX|1N46tlv zV>eRXb&-*HIZ1(`So|nA`I(Os)(iXYw1mE-*3{j zey_+c#Bi-3W35!t3_Dt=815ihh~cbiVkz8?tF8jgqWUW+S%?9aErvD3a*p8)$wCZg z)n;IwBUy+6maR9hBNk*WwNYzc{bvZL^6*v3A`FXRJ+ahm>NnfJXuA?$J0@a?7#@uV zVr>Xoc#Plr!No=^C|QW%tVUuv=W+~K7$?H8bTttx2E-{@t ziCBJMVENcKy7l3P^}S>vMtLY$&BVg_G1THM_F8cf4a9I(3$d^*6bSeL2ytv9S%~4R zR$}=jwsFBryBOAPl7$$~YSXOrbnPWsh~ccs#8T;cXO$CAFj|L57GgN7ome;)Rdvj; zE|4t5aMl!J`DMDA?s)qh!@5th5W`t}FxK34@U1Q?h95~5VmNCmu~fPaUS;bV!&ZI zE@9;V+w{OJqqSZ_^QJhO^?Dh0!?bh-YpQeE7pRDk;*17+~3=(MPO0z#!t< zDq21(?pT-%jnn#>B zL=0ygrCI5vcPGh03}+opEWb<_FTM4Wg&59SqFL$b>Xa&j;jEL1 z%ZH|^K#BkO*nxzzs)-{ra7|uGESblH`S-iD*MzRpY({&!PuqVQF9sTO@ z9~!L@2Zk?x5Wx9B+d{(j$!&#SVR(iU=ku1aj z%T{{-OsrCw%g5Z%2F|LoHTqzY%ZTAxmk~=vgO}b~$wCZgU9MS5!Dw|!7GgN-3S#+X zG-Tyg0ijEApE7Gk*8)x=WK;AMV=LqrS_ z!&%o5%el<^B?~c}buF>{G8(+hH%Jy@IO{siN{`0=l7$#x*`jehv9^)XIP#W7w<1Cu zOC<|2To9gVz+_VIsc}!&!H0R(jdkTCxxWEL$}0A=cKQg?3-wXWUdo zh-0E;A%<(+ODq+Q(`!E8+_2_I7GgN-K4SU7IDC+Y((02e#BkQ%Gz+nOM6^V*5W`u2 z*R1qtTrOFN0hTQq_Y+G+qx_~@e?){h?vpIUaIFW3rJ}KVO}%Yh?kkdo7|wc-SUZC8 z^y}rXBnvT|^$@ZAz(T+H_42BRi?V?j&U#q0(xdTv$wCZgJwhy%E zf>qfv9D@DMS; zvPI)*Vr>b&A)<7@+pa={IA%*0Vz|~b#8T1V?O~r}A%?S_C6;r0_y@^C3}-z@EI+t} ze)0D3EXhI)XFac3>Cw1FvJe9-TQpuERtxB0G^UYRJ|474kb zuOy2wY^})0#8T1V?Z%{IMC1v>Sf6N?QZQQQNfu!k>rCtHU zqwtV0EE=B^OGRVVNc;81!wV&gFih(Uoi4P?qw$?&5r(n8)U5PqG#@KGBn)GHrPGxj zjXy~iVI)iBH0&n33G4%nl?LZj zPpPk-ZM6jVgg?vR&)NEK%j!=?tYkFN+Z_uff!G~e5T75l7KW1j@fg4ZR%<*wzdIQO zTrjvteRXxPiR_f5pP0R;&$4>rpo>CFfbuL?WKhr>4}`)S*At?D#;^ig#LxP^>HJ za5^y%OLq50UFZX`aA=@wUeby#3P;IZWx|?F$-*${b5=Osw^$^{_GKj6pG?FTW6(5G zSfQ|0*VoJplmtcaQUEhBu9(V&^FqmB+Q}Noz?wQdUu89>ovo(qokWJM`i!RoDX~p+ z%xX+Qpl4WGl=+OOh51AxwAhM87g{32Y$2c&l#mHWkPbstHcR$kN}pXVrn#RTX<7BE z985_jY7~tg5{r%ltu`HnJ@tSzN2SL_kXEU_} zi9|G()c$LO>55aM$$5$RLWywl3EfV&gu*3M+)8w5v-*;s-DS>mrw;s2%ppOv(w;|;OUq`%e~0S)GTa?SvKz+B-;hzibP&-_U?0tw^*d3XOiy z1&ZxW^=!rz)-G3k&3qu=7%{8?5&;xX( z_*dlzx4OgXWZjG^e|TOfVI>ox?qq+kPQYhY`Kc2KC84#i3zi1O*Sd6t`ud`=NU&gI z)%DdgOG=?Wn9#825$3-O0tNVaZvg7RzmQx(~J>RFxMaDX0S7x!(_#O}}0Y%hb+=L~l?G zd!~fzVvwaU<{Wih9;*U9@h+&_wm}-zSX+w^Lzpy7YTK9vP~tF{(+ylzz~QWe6Aq|U zH?lyiw&Wrl@6Pwpr-7LGTpNqP__;gjv+z?#A|8rhD=z-TK0eeVJ}07G-TlxETcM-{ zJ#iG;_2?qS8;H4`u9DqDZC{@~&d@)|kvRn)s#G%C6;CV{)mVoo6738P^uRzDhtbeY z#3J3;kp!JdHPzS;r$9@^B>=Sb-Ozx*V8fMcO>V-RPd9*VfG5749*II@LTT&`!8MAq z3SZO3$sD_{@MTGGRykaR04xljQ4y|YrY(ku_uAt&3CG^rMdG1oO3m}!OJz`UD1;9F zq!z-gkdpqiH0j)~3Z$QOa3dX*>O~d=Iw|s_H`J%H120-AyJDf3UHEx1?@_bs-% zdog)4vlvow#Ny}<4N!kkRZ`_2h;_s8i&~`M%-(@ybdj(iep9yNkQN4g{V)dXjW57a zh}8f?Nh{m~9Zqnz-#=4;u~NWaz`? z^i2a)!ZX2P zCHECStdhSU+CDsWS%A1)<2p}~b% zsY}63)Ox6RG?4|Be;}4C7gCI4$P5jPXd{K~sRK8Ip?Mxbf&?IaW26qd5c)cIS3p@I>F!dwM%1)0j?1?YLOL_P-0GHJX=p$O8 zD#B&I6~@bN^_LKZD?-dZ=oheqr>djSkxXdnMQGZXCKPDQMvc0dXMx97Z{O!lSe2HU`(IB7LHpS5RYHbjZt zS9@}xeY2mc#fg}i6#m}6AVgfY7Lcc1J@F24!QT_j%n{+GjCU!TPUq~&$#|X$7|dG3 zEDjbkJ$*2(+G+tKP)265a8R+CSuRHvFl^y89q35h>h4do+D0u|gP28dhk&Xzi+%;b zhXyQq0PYWmVs1tW+#o1+I5cREPB`F`ajHj-aJclQi4X816O62a$I^M}NHR{h4~AH$E*65T#f6SG>x|J1DCsHWUjVFElN;0z zq&mq5H0g=3pAU3~x_e;s8tjhu+bRK7JxoH{Wu|DXoLPE60>e~yvuHA)2G7`NI608o zg?T`Qd!nI)Lps#eKTo0d)vAs}u*v18OSup0U4)RefN zwczrn&uW87i0+!j$>{X>EGUJwFar#C)bI>6Zt^AuOoPLu$fO8dxkEc4W{trvG%+r7 zkEZdbwz@k;<3-Ozy6VA1Dlu`v+A+|XK~go!R7O2ZrG`r>dQ2WTDR0T?z{soX44zVt zYYIerf9E2or^02AY^*TiHp93)m^g}rIa4uBRe%Aj8B1$t&p`jYd=h|eK*gkf5eJw# zMZhiNJO+@{^`tto;ZBJtZ|+$L1(Qwkv$=IOj55h7z@jcDrsjF63@Jqn#)b2B4&}rb zgSQzprCNXmnBz!vLa&^=2^@zsHexyJ>j;JCW5ZmCk^Xt{g}tHJ;&6UOtY*yJfmo!V zfWH}>Dp-FjZu4L%vX*^k{B}EsIb67Xoh^OUgYZ` zuPLUk7B~_~F{^8Ean07LhM_>Sw&83fn#3-?4{klvf+#WLS(LF9USQJoq`zvM>!nL- z`vdcMG?1_MDF-r|30H!(enLklkFGy_v%8Zi-(aiQzwS>@BBFs#DW z8YMIZXtk6;62JWPjWm>h%mg}~hzxInWbNCR`gX%%J_*bfPQpqEC)+#ri-wcw=h1NqY3+_V_+_=o({1vmWSTc%!kQ&Pcr(pWgjR2Y9}V3w zUFT#%EblByIVC3@fjB7!gOgY|I>{lC)OkZolSa0;8SW>;^P=JTI@(qK)_7MJEDrMr zs)IV;@%{k|Iu+P%~31iaX-U|Dd?2pMuL6an(^Ukqife)2Nh}l!^&hT092L za0Hi=1!qhT_0M;vu}YHxC#sV84f7b7Sym%VQ{m0(L6U(ouh(3|IHVuuH{fOsu9BPq z@vVcshJ)~bEiTi8Ser-)C#j;Ln^gfvRBA;O&6Y!z_q=X_8XJgbWFQfu1tC^5OtR2t zC`EnWfMw59p$CraA^GaNT8&0LPwxtBCb!bfwdetN{OZ!s+hgR)0%m(1j*BN!Q88q zciJ&G+5H1?`HLk=EV2>nEFCa>RUBn>i8T$D(!lac=yS~SKuq|qhckEZ{slMq^J}gXx zh{x#;rddbp*$&;@q~@iLme|6&F1m@4k5AebjUn@~kUkhI+={;+x{JsF^kOq}sF+x? za&82j+k7nQ;>v+;*al~d(gWt{`HsFgJaZD90js=1u;4Zfm!$K9vdPNY#MQMnx3slD zpDUX>=#CV(T(0yS#59+S78UNCC*!@ahB6e1Bw);8h5Cco6sxcM;QMGqEsjuCXG(o- zGX&WQCr5JHKq3keiYEGCDLvVi%Pi(pgMk{+TKlb9cwi@)7=R%YwEQ%}(JhL&j&UD? zLQXhNQi6Ncuo&6Y)pV7*RFT}eFQp(?a#!iDqp~zoI=+1T_|8bAqhoxatUNGbLT6<- z9EgT0%POLk)ODyEyf8|K1lRFV8kRaN#4vpgQNq>YqT7H9B@-L9y691Z#in9}$^sRE zP#4U~c`Er?cEGlfJ}I%l=$YUx!SM;U&20?iV) zX(9V!1HJGBSrW1s{*WCAOrBWXP;6*DzH3`9D-P8(RW!w@q+pxkibhT`i85_&Jr``9 zJobFcx;S$7TiqD$Vg(-Wky8tqTh^5ZaUKNAk-m2a)1b4&k^{IAy!^UI^U2G#hxF{_ za_ym*OJBZST>hg-D+!nDAhu(_wOo6MQ!?nJHK~{_4)j7rY!qQ)MGi7x0DyA{#pw|W za#CLd;bd-c{J|c|K8G|oc41_Sk9*^iUw;5D;Ag-^n7Dq{Lo4}gARAYpWAdSPhpRpq zxxgc3^I@GmJl~EJNPd6yIGp;i4^g~a_IWa-uhqbHe6-T-x-U0lju(EOOk}_E%iWAs z3)ulHbb6x^T%`?#-kPE!EEa6@5aW=UrrJa@GGZP4%>nQ4gOwoGyeQ1(L9!qV@G%HI zST$d%#~lTrA1B?^LysOO4@KdDtE?`VmBER-OgyzZ1D+)?J`9dqfndO+Q~GMKp(hT{ zok0@|%fb7*X>u|V4R`nB!(i=d?A`>o;^c)+140*+iAl0zH3WG!cqPG^rFbD`8>*JT zP!%uR;DU-eVJHWgQaCw1g{hZ7efW$uShY78csB-bt3dOrPiMO@(ZHOqF*s9SF2KYZ zt!uM8LAL3xBRZ%TY^%j-(BVfQb9-TH4lzN(lR#`*T1z)F0G*r{ALxfi68f!v)xV{B zgNsCQsteF?s#1tSuUVBrUcUz-=yguoE6P>x#iNQO2Ms64>or*SEGwHWKQ*`G!$jw(eevuYhY-~dr8a&l$2XH5?!;I0Ba zRbONUx?O7DoPnmC8{rm)3UYBmNRR7@+hr-^nj)4CyiX>ZY}N$x_1>zz7VWP-=g{~< z2r^B|Rg{Fw!yOYUOW|(PgpSCBin7k=xJXGyXJFU|Xf5zIax{W#0Q> zQP#}4O29Nxc%DBHgbj(RtO6ck36?ii`>KSs5@D|J2TGVx;bMN1CU!%mWGJ7TnRYAX z!pbsOm0|Z{obY0t8d`ZQaM+vS)xLOmsJI64#)q(o5538fg~RCKG~eNrfFWOgoUmJwdJ&Hv(2Frb=qLgN~|8;zF}wtY(R$>{XrUBI{x zZq66gUdlL9rgGe%KOC8!2tAA(lCi5uXnw;^$%SF37&E5b*UfFnCe0165t4MexFaNC zbh#d)q;#Od<00I3$X0LUG~w`_xRMDdT5DLiy_D84bs~01S|%ZCo^&YWiZs<$afS@J zHE#|+=pH?fD^h80c(sSQ?U{00^)4IkLt&kOWjQY`oG4ChO0~5tYLkNxh14c# zZg|xu>2z_&9^!UcaSBSRtz}VA9DFFGpj3#~Xo%jYU~2}2aB=b_)z-4e7Y82-$rpKl zb?Ea&2p1<`Qf)1Zd~xuhkbJ46`cj9t6kbT$Z52MnZnp-DRfc>_ z&GhwLo%dV5c7C1@mVpU)<;}wGSj2DMAM5Xyf>nld ze37Zr$d#t#a=N4DQ))S~!hL;XHea23-$SPrFZw0l7*a!Dmu0osKVSC z&EU(n)y7>kE0-8`e}OlLxpzG?8BRAyJP+mf7PHVhz@En6+{|J2R#jg zsUXr&Ht1;>Oa+mK@g*s{SI#rH*|YlO4K0X-UvkeI zv~7xsxL_(^xHj`BeXv%#lI#h_}agk)=ua@h(bul6o~0hNTRKu^32_I;)Gf?`4m z<4PO(r(RfQMQWo~V;a`w@-j0{8w@01%W~ML-; zuZnP?W|TWa_5yn4_|OTOxuT)dOr2&LI%P9MHFTO83z2I}VNF{Mdtvuxs;$~EyreiC z?NS4?A+^y!e^v+j#3W;t2dFk{HKyBjaWxB2ne3G>_`tVd(x&?&W_U{~+7(YMmT!g^ zFCdwzo?w=HHs`RP6>g}e>gSMZs)WMsQ(4n!wwY3{=EzcFuon-!1V~?(c_}vqPg4ff;(-h*NIhk0k@Q{85#M-i47BtV~-TA0gD{y%WsPz&j_k zYxmAHU9)$N4noe)4x4b~LA3=Y4|ZCJ@~~kGRvv5}He7p|>qD$2a`~}s!OPD;TKw`e zV+&z^23Qo$ih>L^9XqkvGc}Z6sw8*%RFxlICRFgl%07QejI|}>NJDAnhZ`W>gxXcv-9{Qh8-Yg4Ojh>n&InWH3Roj-8X@S*^W49LwfTjZNo%AEF=mQs zLE%v`w(U$%fIWIDK^3-QnpAG$0G>bYr?voBsu>W<2s}PZZ=g#xgfH}Lpj~E_F%L+a z(f)8K=4Kh5e79yb&~Mz>(nJmAMI)N`cv(Ue(URJ|@DUsYK1kUN!ycc8B?zwqWnfnB+)R;iape)OzJOx0hc1Y%pyuko)#Ay86OQHEdEmkcbBL>-x;)0ah-D zy=UyByZrd6!@B&enDJbGd`|%slkd3Yj<=ZE@mc_{A)KP@az*C>tW1Y{q9J(kcf8+r z;jjlz?AY%QWdA zh_qc6l_q{-hvI;D{#TaOwlOVlqwCP zjLEHE3fu62&1o0iu5!4Ll;c(kMJd0+P;m;duvN?wEG!nI2n$QaD#OBBaSE}pr3yu{ zN*h`olwxcQE0+u3#zU9nVwf^zxfs?`OLH-7s`6Y6TlNxN411vqLF0f_O3H!q8& z?e3FWu&|vyZmC{kj#HDgy402@MRz(an~JVr%ekW4R+(vA3sCIvvyN@hbyR|InL$zB z>gPUJT43qahSOaZ1-@gT)4j}Ro5;=GgmPn`6IK$yZ9e_rbu`rL!4+KR(P&#*Rj3)| z&Z7RVXp%kd>D?cz8D_)ad29RlyJ+_Gt=OVj6nFdJCT-Cy3LoLI{i0bEJ{HrW$!K`3 zPXQSX>vvKzx=8kH8C@icwu~;4MO#J}$)YWzi)2w{v~B#6Q!AxswuNi(E>&39n`0}* z27KBf-B*A=Fy6@6+PMujbaSq}E2>fDYJ5R7k=j1z>oK+1jkc+Y!7(n1CM^3J9P=XF zgJxcM59^x-)B8a)uZm57G&(=t*=g_93n?|Qc)iNs*#|e8XIO0=Gy+b-d)VQ5j^-x& zQh=eBwI>(7vo#NclH8ePrSK%1ncKtk4ymp#okOlHsvQ*EAy*b@hNW{ut}N2LERyRaVh0+oooUZ#->oruY)J$(iCC*Eu@)Z?iMAZ$qJF%k`m6JYh|p@B~jS)1FACOnQQ=v{ISM?G0e+hEG0JB?~^{-YY?t zv$&TH=B2G$%8FA4t4dN#rS3lAd|K13#x#IK-|mjlhUQfHTjO0_@IaA2P#v_D+1a?F zTN>b-yyQSpG8S%m4Wq>f>;)DL&X^wRpC5$RVMIfbDe-tuu)DXfCzwcvgF!Z@kpX9a zgt?ZD42D8VC#w;jL+K6m4OYr%+fcT3H*E7ZREm1GWC%6Icp9cqhEP+a6XubJP*bFH zXf;JTE0#ezhgMUhvvL`vb7(b1I>#@AbPlbiNauuQkj|miRGkXmFYbp2W?+Y^zGNae z1G?wBP%;#R|7+v0$0u~vroR;ZAdN9?!;nHuh;Ty_T!<0fju&D?cmfl9g%}Z@6lg?e zO~5e|DEzh|z8Lu9_({!vh`TvK&-)zGvxvZs3?xFy?syEQv*9r+`V8Z=0Q{2!pzypz zJQfd*l>2oT=9}%elMeifTD`RM)0@*K&&6VFyb1EsZLVaM5hQ+_+bQ zXd-eT2nARjk()ve1RWy%a=5{JUAmqds2UP6TlF6jy|h|9B&xQ`I3#+yz?8t=bum~e zES`&2{SVH*!(ydui@2yGW8;XTShHn$aon>-w>SoM_yYYDJ$+*+QMI`DIND^@P1U&B`p(i zTMjQ1{j_4SOuSH!o4~$=L;iwXpWps~%ChmmR+pAZ1XKkS55bhvTdbEwB-o9$<--{j z8d}i-+uV1;E3jc^#EN(9SL$iP#B~uz!N#;}{(g8lcVwU^8l1UX53E~{ge(tZcpO9I zJpJQ*D+LF0VtE{G{TiGtrVPM5y?~}K-W^K@XTa+%LJ@e8IPB6nKPYDtvd%u#wKli3 zwZJVaISWx*7F68wpm-I*Af~yTO?Lb*&VyC9M4auN;s1*CAXQ@#YI~3Kzfccqs7*6% z)y89RbvzJG;>;@C&xZ}F)Mc}rwsqaZ3ffY~$NlKOZTh?1p!XgEF*AWbBywW*4DS~V ziJZA9FeGv!b$I(=NaQjU%evH3ncK|-RV4YFz#URmT%AmXvA9Z^%3*PpG8Mt%DrG8t z#Z}S;PtR6XmPSg)myaLc8Hsdsj1QER2PRDDtPF<((NJYsMYM9FT-s)zTFHxS8(`$c zPrF*q%Zk3*&5O;hR`ar8>-+QKs|*wuXkvw&nb7y1nGRQbg&H#%TpZ_8GrTxfO$HRl zp30Caf7Li#CCJwf?g1BPc&!JoCWZUNFjTN_C!7n#$iStmey?yBtP-<27Mn}YP+6cN z5GpV0EGwy~oKRNYSyoYASy>+HD2qf&qk&SW%~ng1Mm{oKR*Syy^{Q^3UxJS5SCJgi zSKz(HUrB;Qm-H)2kjNptH~Xu~pk;0L?-T^?M~VTn^mT7>S8Y9zk+i*60()+v_; zahnOeywh*0fQ>e0S(9x`p5Sdj*yS(Jo|@`D44h4E9EO3*rYRW)&JK$jX5Te#xsEA0 zIxIrkGF;j$a&%aPlF@~ZuqmkGIptvy)L}DVAxDSFc!hi&R>KwYc$kb< z$k$;}x!Q+I&q|IClgdTD4y(#V9uJesMZOM;$^|oKvxiIlQogFdT9b-7GXS>(ia3V> z^OJmK)bMcDv|hu*-_#atczA7EvEkvbu5eSMxHVC6X7LNEZ!k${zm9>m9m|T$SnoPDW5J%rJ|%WTo?+4|{XxtP|K7R#`$w=0%Ol|PQp>v_r<&kyY7 zZcRC7)k3kgx_f)0k!~#0P==(d;P)MV-i4(%cKbcbb;-_YL&Vv*tx%*Gi}>(89rv zoMuIq`D#I^CkT5^NkBhtITp2&i~FMRss;D`JMFEh_zX6>VDAy!wk#7*y(w)@^=#vV zUMOb1DuP>qV8EkODa*tD7r7iGr$^P$`TnoeA`XD$m&3U>&={R-5Nx#^g+)4y9&Bq4rGt3$>&|?zS8{=diKM=^|TY z&dQ7a#%K~Q+Qog4A~;(-tIAp2-WsNXxoouMAs=`z%dGno!0N8UYW>2iG@59VLwoIX9Z2Zaaz*>-+_qz#Fj zEqSnI&k&|=DAZKq)P14!2EpwXPX?qmYHqSvy`k6uWanaQK{O1HVZ!a2?ygugQj8lo z#j~v(x9Z|n7`(;#czg#F%+UAsSh2Xc$z*mo=&0x@t1O!kE)9joSC)+{E2*p)AD$46 zmQENSDlIR;9S&yu{WHawF8xN&V2YTeM0=u1m_?n}jc4-a5Q&LA!&fQ|S)L7%m})*!9xD#x%@~)fRDI6j za#9T_`NQIx;c$Jb&pB8#gTNxWmpU*kl36oYERsQ!E3ni+4vwNYmgF1nRFs6v!yOYU zOD9aIoX`=OP*K(y9TzF-==xAl%E{Zg3g@VxhqCyRr)nUE)anIheg zLvQ=*%BAc(@OX;Ta+Ocn_pBLCY0|yluc++lPWD%nCXr9scjFmOWl!W2ym#?emruX0 zG>Lo~_bbe&UssyUU~eGS4O6V$FlBN8tRxM``xe74Hn{dS!{R0hC@C$2eZFaYJqH)-VHC~=o$zmBDgv;ZQ5R>3S3URH6oS8P!S}gIs(ca$p0uPy4aCwLKrP^Cf*oJ=@$gAY%GC}2G zg$j^A+ohz^jn`LnJ0rmgCH9VJRCTF_E$yXJ!ja*$|0|l;t=x zTUg45NK7>!&`a2xFL;`%yQirAVNIRAPqbP}-P_Kg5wEh^`|vH;{nOxXB|O0ugcTE2 zmPLEGS};QFhCSyJ@HVSXD=u)s;Dlhg)l%&PSY>okI7(lO-fdh>5WlVsT7jC{V10Xg zU3F`HYj8$vek{H)R#jo(#O?@1q^c`x8D$KnKZe! zu6}ZJ5C~NjA!Jll0Hvxza!_Py05;<@x+D}F@3U&ByPmA73ZxKdP=G5uU`zSno~7mF zJ>DX)Xt_raJ-4P$Dg!BZ=TWmd3q<+kZiV}v2?xn=Kkbwv3KdcC(L)h&2RZvmrD48v zGE6xd4)rI~a&dh9l;+l^NzIKS4+(>jER~ToB#NHH*Y=1Rbh_L2bJA<`m6Ov{h^vFm z4U;Few^rlT5>$h(s)}Sh4h1X@D^;iz^u)Wm!&WqrfW;fE6er-NdELEHhf@@1htu3? zM*w*4@V%4!mDaSy@cy}82YpOgX=__sV`FV~bFiwcszM~C-;F>Hr=R8iI-Li1)4%54 zmIrh#b?}%=I08V!;d>{MN^6qblT!o*mOdn-UGc=?QkHWVp7E`%jkWEqt*t@WjZ?hd z*;kc94_1{|RrN;u`?1wbIhSgBhT2erEeZ0x)Tu1k6x=gdzDG@64Mqz+oDyuVt!szM z163yxpC5(RwJ#Cx?e347Cb&7++}_e&+tx5S*h%jxgjTW#o)?QiJDG?=d5$iCl_|<% zO-rzOGF*~OX|4`RQ#O2mDB0cL*=@s*udSWj);6g=7=sEycNRr45>hVZE>Jsp%H*2r zrrMxxG1Kw7rF1x@>U;VrURIpWLs3cp+Nq>aflsU1T)^Qp*iZYGo0nY&tWHS|BxKu= zT2^eG=(x7_hQ=w?4K*_VM1WzCQr+JVOAVp;Mxc+z2Wp#G5w5fvaG!Ybo^pGuBpbE* z)|N@_lj~YUt4n=-6uM4a&!$R4MQinx_Q|b{L0WsJzbcXMsR%W0=!C%< zL=~%Ss$CeWIDSjLeY*Ub@FQ(gAHvh4NbL^sAV7- z#G-UMxFOiy-qhY!)84=gN8_Ca3!PmBbau|ZQ$@&dT2}_gl=JfHtPmWJmBNv3E4jFh zxM-*=)$98poUlFup7n%_f`ldaBH+vVRlX>SYDvA(#^*?@6k|{AplG(?l?b`IDLVR$ zM297ttZds|he3nvL0r?F#T<)70p?_cu*{EZZ*FRAt((#c)vb0?Y@nwH{%@vYUO6=y zj>8mLA2ek_8rfF$!Y~(_nOGQ?yG{cSU`1LyhLdQm@vbg-_}CwS*VPI_a3BenOyV<6 zt*3y>g7s91(TRrI;FN~;$xTg@TZ4&Y80!(PKg9pRZY{obIGVt}z_(WVq0e<~@XB9Z zBP%Djw^diyLN{1dfoXv`uY?@XpvHu@n)=4Jc1$Q#WSA_E^vjf5)1cw(4%77xw5XF{ zx-5~TTMsyQ7KS;j?q2NKXJ+ZzMSCY6VR46+z>3~rIaC+%mdfa&z65TEpd~Tk*`?q? zGiY%=JD#bRVQ#wsJv!~erWz3>m!bKEl&9<(G6OQX4rZK!CbNSS1}F;#fA#WNL(JYDWSr=!)}AyPOS!1$0O(#!)1B^*TC zr}*spsaTOR^Q}q_eQ)M!)YoL%d~LIw`Xx_I>e+I~3j-`jQWUcoMBAklL^CQzwJIczCuIUNoHOob0G0Q++z^^t zmUc!;x_ocsTma<`w}MnbDswm|r1OPk))M0 z5qgqbR0Lrjswu2LbvUj3ay+Smu?eq|NL*!sD2?23n~%$>FaFG z$NALCQiux}KQH$|RHQOuZ86D+GpY9gGufZbRbkelM0md?C5vl%L_L|Xr9Y)ad7_)J za_Y_!YVuYk@~l9wVg}GRg{l0 zM@i-Q2@}SRD+x?6-{Gf{Kw#Xsabw1ml?KYoO7WYyt3{6fWu;ATyJ5fayRYCoZY>`j zVD$iwblxz;#Pw1cSyzg0>QBz{rz?};!=;p)(YI0YOe)AJEz)PYf74K zBj65j!X=}NlK$S9(s~a*{0(rIJubdMKgO&zW$xG%+|BU)lM*A4&bW2p}-~o3fU~bHUdlTyKoq##_ zHA=2;HTcghF24X~_16V1Q(V>q%obU2dx4o90CTh>&ZPH2z?}q`8E*((xAJ#9q@y1( zZwuVU@SjPCv9~vTztTHC-(2{?!>!!+LjsQh%#ZI19LC+rUKQY4pt2wPzQC>Qf?Ei< zhXAwt2Li|AZ2Swt>5C*rAf0vhfRk?luJl8Ja;ry(ivZ@9EV%LD-@gH~`NzT@Pp>KW zo5JZhV2+bGpxNSLa9EGd0L;aXIFsH{VBi|S-2I8r#csyLncLgvQ=hLJe(=bo+YgvS z9dTUukAOMnGhr{2?k=DEd=2n}M<(4VfZ5v-$8|dav+xUHFO%*DU;2Do!4Dppbaw*G z1V^0Fy%!AB0%nE(2z#r-e@=1U3BKPOFn^RdH(m7mRKQ%~h%>tP0q$DB^nMK=;Bc$I zzXPGAfH~)z%s8yxw*%&!Z!_a=0(-XuX20(Rj@J)fuFeC@6%v;zy*B~o?^$r`fZXGN zc_RxB>&J(H`Nk1v;_4O>jS1&;@tWfEbgZR=Gb4*n$PFf z?qa^Z44C&N&P^Bd?F+!{PM*2vTLf@>0p?zbj3kc6@@*w{J?bV1ek7# zb1PS?18xamPLVk7pV2J`+F0|EDEz>N8g@XswSGXXadFsDhJn=Y2OD*$t?#JR-}akl~Ht}M8DfO`lq zV^Q6p4Y4 zbU3wt`+=D&0Jrw4!XDNGCmg2tScwtVoN>Q{lMe#!If->k@4A3{-GjX`fcwe=?n=O| zy_!e^e5AuE9TVWpoq+pVV%_rhLnv^YtPb^jq_DXu@SN;nzHJMGj#38SXCDw<{*2X_btXn-oTn}Il&4R=9o(h=rCC)9qn2swX z20qf^6hG9x8gTbWtebyW&YuCyza-907yWw+FrQ?>q3*YUSrsoF;BeDL+@^pDWWixO zSqGSXvfyxhu)oB>M>^c%atYvW&0-JxnMVP$^4i(cu`ytF%7VKD>{SEi-7L8M0r$Pc zP$J-$Q#w|Jg3!Ir2w%_o!asgJ&HLZJ4MzA5f*(Bax3R}@M+4>*54iIHbA<=oO@O(_ z1MU&PJeLKx7x?`;U?yznlnztR&xg~sfO%^pf#cWlCcW6N)^9w*Hy?iRz~3e=#vTsm z1^|;BEpTfxoUw=P`?r8uVG}2N9JdBwHuQko5-?-4;64Sp@qpQSGod?*`DfD60N?*p zV&EekPU%g;ne{dw;rk=};NjK}VtVfc%)=6g=rL;r(&kSQ_cUN$%Yxe%aQ_BO{TQL^ z)_?2(xL&}VC2?-;OBLX*0nEn|hwY|Qdc*Mjs#`!kf*(BGbg`d44KV+dI5*ux0rw7I zI<^${+;nl=c^F`BmN++idjswf!1%Wk_T2IV<1!O4hfAEBJ&g0|fccNatqgxV#brd0*n(bhiK-{{_tGt%W`O?WBvitpU@J1y=*ODS$ae;@sklxElcT zl?U8f+l=r{g&#aJ+3N$$O<8c5A5Q`1M~QQb3;OrFZAbX_fFC^EbkSZMFy}~ICVSTb z=8G)$P^o; z?~eh~xxLWk<7|V&digqF_SwM+w>ToK`FsoD!}EY?*-_x&wuG&ma@@&)S!E|DoN0HL z0KW||&q-XS{$u7?XgA;o51zlK|G@F`0>GRqafo)RM|d6oC%}B>XwUdJ1GRP@;hP0N zcyL{V!|RXv5<@`v<)n-EZ4U5&!}-nQ0C&2?x}^ihVHW`A6^V2656kc85(6LUaPn^= z2z>>(K#52%FE1v}`27`txmn`e{Cgcv+yj{N%7i`M{~CK^z+OW+lvDV@gWEGW)a?Vz zL0ND(zk4)b&hUV{5HL4*z}*3uM?K)41I)V~aGwF@|2*J+TLI%C_`!q6#gxDE;l!4J zxo@1nVR-_hns(tKEMP#;C2B_vj^OCz(hRYVt_d$ z3l8IQ3}8-k#F>1<_V0X&!Sv!`^3C9I9Cwii+*i=hUIw_cu)&05J@_&9cs<&$3hEpD z;KAc;bnk|N=3#)@y+PnI^@H~U<}r!m_PFlzfO*RU?qk4w=K(jO5ymg@lPMh-=M5x= zfbh%2#iaK}_K$;7S2=X%-x&?{q3=y^s0!n;Foq!4Dq1{u=-GfOB^N zX3d!b=N6aM0k?(3pglaC;(QAj*b#7V%@+2yWH_F06?=~GRl^S+_}kdyxE8?7a>SW* zoC|>n0p_QDg}w0^?ClsD;TsP>cx2M80nB6%xY>Y-c)-N~bAThxqyx+OA0&nxgkL5u z23HT?{}FIcN~~MHA?|I!Y}+By>xLT*xLpA=Q{s4Bj4tNqT)-TW1&8Fpoq8&aK=d?hC+t8qJKm9RjglCtRP;6F4m2CeFP4?b8B`SA^4Z0TYf1oLgKF zw-hiZ#53c5fOOmnnClY)$J-4amu~Eej6q?E{$0v*6I)jexl?3l8h=qk#Dxb~tcA z_SoWV{5u=I-wH5yNgU4)gKGucLx5R(LFV-0eXC6*20qf^lpi?1R^b6x4RT4q-Lg>V zy4}~n@!Cd<;C=x7;DNu5t|?b|KV@gY9P5ZP>Bal0r%4Qaq{G-VxE(;~JitA?Sm^R{ zZ*chingj5_xOl<_X#Rod+n)Gf1_U;ADdlH9er*xq1=Mn=S>2Shf zJMpzg-1i=EsQZ%#9JcQxa8P7Bocx;)kd*)zKUiQhjqm>rnEyzeTU>Bl_cLHd9wO|y z;VuT;hJd+4;@rx?t?2)uaJ>LOc(~!P{QU%&l@80Si@1@1Sw9Po#)T3C6gr&Z_bSM3 z1Gp8A5V~&t0@~YNVx&38a%I8EfCt=qAa^3*Ez#J!W zZn}?yy)yvQajdYHsT`aSn5!ht%^v!5v&6thI-Jr=*Owk~cY44*2uk+=?#QJg9d6^( zOW^cHfT=q^dwLH8%yAOumR{^v&yX0ATIc-5xIXUz7XsWX9&os>Ww#SX_}bwI4>$jI zfpc>J^Z)F<34B!5`93~@0AbMyDjM8~5+w*~FfL#~XCMQ2U;*SpsiqQRT`|gvAE^`Jm)=gGjr$8(#8Mxx7|-> z^3J)>eb0H{^PczY=iaGt(e~1Ae>;GC5tz{JiTV8rxO;%Pram!_ezFRf8eZdDR~OyA}d`MnO@Uy|@+`o2k#U&lMpF2;vfy!>GL z&eRwM#84fccHa(N5!~Zyhk3lknp>)Zc*F7sU_z z8*O&V_KNFH%>UxUi{EM=qzy;C_S6{Scsb#ymt$gZ&gJMt;BqxKUcQmv$Q1dF1@1>l z_|Xm)rO0nNaP>*}F?~;_$Zs`p8&lx7Cq;fA1NUVTeq2X;6dN%SS3J8q9k_EeHc@^Q zr^s&#a5IwdWBP7Nk>B0GJ)DGJ7Wg#)v(t`q@Z$%7>2OzKzoF*UfXTDt9Qcg|=0|p% ztsF6Zi-4)O;~e-s3Cs(2oQ)sTw-cC;?KlU1o$p3}A0J-v@|XFMr!fkMuXy%S2wZUz zew23(FgM$A4(aOk zbGIGm!0$O=8tgb5Kl+#VGzO%);^oJOz;{0;$^{`2JacdEvKwYuWv?}fmPOu~=y z&Pb781#pW};CFY5{2m1Eu_XMczbz^9djq&VN%&FT?^ER0`9AnRe0U|Y=RA#3Kzzl^ zkHNqdCgDeUuS${M9N>POgdgR-H${FcfqOg&zZ~#;1(<(oT%vYohx;*Zh7YfJ`eVCu zATZ}?obZcncXEHJADGEWaMa(m8Us>YPVG+O7RKP5+nu$*-LA3m z`&)|qJ_YWZ6!`UiAT>XJ8gPR&HlDm}M~q96UkPy6CgDdr4W`KNr@;Lp2|uRqMPOdl zI7%L`T)qj+`zi2i1IGOe(P1Kfy@5GRkPFIZsX=Q@2>V*$4@f)%E#(e6dF$#z;l^-^}Fg<;3IM?ynF8eqQ z`(>vAH$-C-$x#H%Wf~VxFSNgfz$}a67b^$Hhkgdk{TdffUh3sH8Us>YPWDGR9s}-W zjZGxS4q)EXxI}V%3rwe9N`44GXE}NUldW;_NjF*>_ozhQM#^9Xu_XglrXly(=$nTL9 z`8^BV%SrfAjz6c!?*riWC*eo?I}(#ur*Z-dSE777ADH197f)W=ODQmA8W%4=`21Xr zVZ6MY@`Liui@`bP$B%)#S!3g+kNkd}BEQFhTWjZM^W&87EgQdh_2Ao1I9t8N^zF3a z;?;wDfZM0BiRA6}Ysp)%R#!ZJM*(-T#wOx7G(~=ez!fLq$A0J>VD8YkME3UxFwZ98 zN58Qhm|ao)V*OtpaGwBk(r-jJe9p=KxGr#^#(-3p6OQ?IQw+}8PHzS7ZjDW(=jT%7 z_Y!bhQsDPtiv0cw+}BC?(QjlulA2u&1a7d##*>%)CZ)*l8sHWr;YYvwvlRKQ1n%)9 z{FuI1fO*f3a~R+K7MP4xqMLZ~vb}pcFz4HG4*VtnQ)T z@T0uX0kg%9b4cHZz1l_&^X2(Pk)a9^K24+Z2xTs=HnFjeGbg`Deyb-u{77Y`0%py;vny(z+7p^Immkh zFt^!p4*VViX0;t><41dWLt|6|@fA;hdw|=Qgdgpt+wam`r{lvbQ9XDeFe5e2(u*y9 ztj}fuGdqf3Y(2<+UJWoSG*0Zm8Fz=qFnzq7>Otz|=P@|vdhj>EJ)^PlXUf0CQ~;er!Jnf%%EX#mf(-=U$Bg zsV=AdpdY^hZmS4jY}lQwZK$G@r#v%?Y|Yk+?fQ&d|Rb4Al2n02kWiJV{p#p<2m3O zG&Y_b^c(L1^R>n$(#w%grn!#ChgUp)%-_Mlcr{M=#p;EAVzSp%-J`LIYUKBrPc|Ql{u*Sucmv-OrDbcYK z7GF;Ca-6WM4X65zHa||gKf;EK=dVrzuD`~{lb8Nr6fl?DaSrw1Vqog*I9vM2?^nRA zvEv;0y$Q_wcASkLYKYFW)u-_nJLk8$a6pK48+H5xpd``z&B`G%lVUu$&JEW=s@6XS*)}rd;C^ z*?pzPXstNUUdZ{z_t2e=0{Hj$p61?FXqv*NYc zAMNGO!2CUmU#y;a&cb0}j{LpoS@^}`=mW&qeAFI9qah9YnK62X2&`3s|DsBJI;aM^T2Gd<81us$9DtssU7FQ?}+EqT)pw(6))e&?*d>( z*>Mj1%7D4fj z1%3xofFxO~Y!g3DGtx5RNUp)%UGg16v z%Q^k{W?){`I7;nQewj~iY79tqIpMN#XD4unG&YeOJ=WmdD13OuvjfU;J}?(+obZd4 zgZ0dKU`mqU*q@oNF(B3DBnSP=jlkUz#n0JaJp#zRJ47{<%XNzW`tHvqR> zW8=w7+)seHI|+{ZTd6T1)#Vf~_3{XCt2H)}US0v_Escw(7w+f&5}5C!_{Hjl@f@{I z@k-pr~;-Y3KuJHE^rS4 z)2wmKA18U4za3vlb9Kju7r&iw^as6wIXMZAU#uKFU!W40nkas;INHlY8Us>YPI3^pDhB6l2TuX_VpP1q+46(@ zcBRPgec(PxfnWDOh>k@H+Ou=|js~ue#>Ue#(>E+dem>wXNy3ly+uRiSEd|a@!Y>>A zehbW2JI+_2t28cAJ^dmu%}MyNz43Qo{u#wDw*F;%qeCOs=itMO-%j-}^?H=X z5XZ|2$N9Hjzzx#aL~{6mxkTgQ z;GFC8$ADX{vGL@fJ--3WK8;JH7uP17e~J&Uc>JiBGl0q0IN|54mr=kJX@of8NXh@ouaYvV@)N2h3uPizhGbpjKl*s!PdXvjaZ=6C2K{f6j7wyA2nwKEEHh zRT>*lUe;Tifq7r!66xa|EbvfAq^J8WV zF3)lNsuH*xG}e;CmLE*_eKvkh`N4P}u;Jq6$FG5V+8(b%`|mYiKD6T;+LP&9F`kVN zFG~&^KbDWPfEjMbIq)k5roxW1@uMHV6`1?%I0t@ff!SooIq3PX8bdkM<*<%|a(rOJ z#nba4;L=}7tQY#zQ-QhAj&qP>3NSP5I0wDl1k4?FoCCk7fqBV}v+<+6?`VwD3BKaV z`%mD$PJv(6s~DfehnHn94(S^W%p^O`mOk1+6)?-~I0t?Y1M{RE=fJN8m_KV=B0sbr zm~WHt<2tr!zs3;9%L&K)7zmt4V-uxs0x+c-XX)7{Fa6|=z}ynW zFSefHy1Dy-d06A($w7G^*BFrMa*~7j_6%?vG&YeOZvyka#wC)Y4Va8Sik^jEtQ_or zoCwUR8W&Fv#xqc3lo0rGk|P`8X9G7*V-v|S9hkWq7f%khheE*I7ln(JgLbeMn3g0s z)(igt=5vjUCok>bTVOi9Ci;tq<2o6)#(-3plU^9_DKR+bdayrm=V`2^7n^@(ddA!M z#j6J=*l_Xu)l}eS+T*pA59;~m6#3l;+#@OQ+XT!`JI=vh9RQ}oHpvf5FShit9AyKO zXU9448w<>j>^K`g%DYHoK&mUA{%!;A-W2$)2Idtz&LMpt1M{UFXGQd#+Rz8^SZ)`ZH{u}l8oedW+e~)+_>!9%AW$D?bKepR10A{=$=a3)Q0kg!8v+-m4 z?g!>~cANvht-!o#$JzL?ef0$}-FMjJaNyS;nDgv72Y%y$xmM#6*~?O3%q0A1FTVxm z*(iRo_QHCh379`6!Li@?k;Z^jmy>_yKG)BH>-8tmOCmY?19P6n#j^v-F&>zyQT$@% z$OEntn3WpG=bX~V{_58n15#a1IMy?r-Vhly4E&tynInMft+Das7zid805e_V66s|j zFttheQNCXS^H>zWSiNvO;$>i3lHjP9JsJa2T~2zT-M0eQ@lDYUzvJo!nBE!}PcP(m z0WjlI;CC4?WhwBh1?K(~`27Z$XHwv|4VaHo;P)9Y-zDLf3wcj?3-b{8@JeI{lYyD8 zaq;v=JE#HX)+m0lcEEP_gTVYo<0RjlaZhOs)5pun4k*WJ;NH{NL~?u%%=a3XNRAWV z#=IXsyo8@~`i21G(YQo%jMf;%5MNGm(Ecs~ZdMe(JjZdB`M@mIxOj3^O(|@?&7WwBu~`CDV7*F0|M1;bq0^z|R9rz>c%=qrbmKV-!Pt#q(?P zfV(jTeh;L`@7KURorE9l>NQ{vXj~$@>h=!yS>waY(u+-A+SR$h4AZzoc6A9b*J@lM zySh_jRK)mlvMbubZ-LvOv5Dk(6PWikE|DBIh&gJ8JU~bX4L~{HFm?xw7#rnSyh<76}o&GHHa-7*IeUx{J#(-3p6OML& zYYfg=jyr&RP-ElCL4Gf#$Zr#H+f(58&lLF`0ItJd65Bo7VcEb0G%k_-l>$?dgdfY% zt-#zF#V8go@^ih1 z`UoFhiTItNF$##Uc>eT!;D)EbuQWw|6~HY@!jJXG-6`^W1h{9D@XH3j?ZE7};~eUv zBX?uHEk3;B=`S1i1_Lw2j&tC*0GONXIGewxyeolu+KzMJ_Zl$o*l{*~Ea!(b2Bf;; z<*#cG>;)fQ@#JN_a0W2LH7-%PoCM5ON%*l`E(0bQ#V@v8(og;Zn8%XfSTDS+F(B3D zR4%FKEipLfa=8<@4>UHOUN{cY;eD)w$A_1NbI7-$z!-L%E#Ei}R}RdN?KlU1_X6{4 zJI=kNE&C6dN7&+$LgXTO$ZdK%7} z7yX_e>g6KvniR#)vfjL*>tn}IVQ4Rx`iWK-Q0OmeBKLp|UzpcQ%Z|7%|qaSc>z?}ZE$eT!xJYXhhoF#{iAN4X5nEDj>-3QFe zc78TF27})YV7l#<^s(LTl)tp+VvPZ*E+-tvOD=Q5+3cBqV=i!}##-{)aJ2h}fcd>0 zXOn~b?VB|Qq`I8a$M-V6l>(0AL!YLAqh7lHLv*Ji#g|jOw3nlRJ40jR*&jI>G5o^q zuxP*Q2d+$Gsip*BLHh!mr--*Bs*SJLd z0>D(-`PuT9cDfvxmozS(oie<`K1mx$bvcz^^6LtmS7YPx%LeWiU{-0IjOWDG=k$}? zGzO%)oa})8)!i{Tw0CXta{b2NQ@~{d_YdH@eIhc)OCNFP0CQ;)+%n*P49wRWN4cEj zpgrIBPxSNf;bqyCO%6W49hf~DXW5Gl$M(yY8bf}(oZ_W_>H4WXe`E85{Q5ZIZ2pDi z<6Pj1HP%X>4aaei8Nk$Q9P>w|&t~@n5WW$ZPc)7x1?^KSK;pS4{+B7zvy%6`%XIOvrxyTz2 z$ME&QY|}VPFE%-tzQ1V6+iJ_l~}7m_~C@2UK? zt9ga-il0r6D{*sE46fL7R;uyZa4i4!YguNVV}ItPX z*Q9`By;_w5?gZeLq<~}l;9e&j%P;PQFWTQK;MQm?H3YphsD4Tqg#W~C0OoZ&&gM7h zU)}}gpvGDDY{SuBx_^cJYWVQd@y65(Z2z4Cj9=p{KV-9mRPD4B{H_PDcQrqzL)pQ< z$&dBG_yZyXNOd`tOX4P_h`TIB+|(3tB~G}1Q(gmdTm^oQX`ZxOr*cGj(+{Smmo6#b zXh+?gaH-0XD$eGwSnv0Ui8oyTwhuJ0-<<=Tp|R2JgLa%6UjydH8W(N%?Ks-ya$xF{ z;27_Hz`U$+R(Vr$wDTiw2QUXTE>Zf9IfVTS`0$FCK9=)yfElZC@%S;`3SjCrE>Ze^ z4a}A#IO^}u!0gw!cdWR(q6O10Q(|+<-i0rPNz@Tm+kgKIqn2zRWwff=V;tBz--pI zL~`r`=DQSdJ-@-aFMN1e{A_a2uKd8v*0@A+ECj}k#>L3N@^%+6zf6K-yuSlxo5oq` zb0}|r1E$NjHaQ${CjfJC3b^sWEY!Go`Rkz^z`Ut(qL*UF{M`-A7g4xazs7R@9WcGW z6FIDS9ptzGn9DUTkzVEkbElo3Eq_NM-e-V0sBwwpNc$e^3Gv}2xL7%uzkPrikOas4 zJr9`6G%k@Gvw``k##wr?$x#S?PXY6V#wC*DJ79XYC6ZqI3d~E|1|-#BMFZA`)6W0iM)yAI0l%(8kb0a zlYqHK?-gMFsc}~NY<6%i;_1<)gUf>tuS9k*8kj4iaWQtlax@c|8#FFa`s#ss zE(P2cVD@R8C5J;f>Xy;LbuvB?a>S&Mc9089p~l7I$Nabon42{&ksS8{^Rk_vP0#0m z-=BdwvTIcO8f2WhyL3N^6?2UU3-YU zR=l?IMmhQcGe+YQ$x#AKtsQ5xE4DZ80cL~7C6eP+V0K62V&tG*?FHtmBsj{^229^0 zMBYSlTma1F8fWRnCdX;uw-}fQH7=1Hj{@^jG%iLCrmqQ@e`s7fe#fg9jyke~>wJ88 zC6Z$_Fmp66ksP-H^NhwNlH)~SwngJ&Dva(HyW2HeP?ENa9x5AuSDr9116|(R{CuAas_y-0w%qu@RRg8 z_h*g-=F})$Y(IeZG7y+zjZ0)Ni-37R;}Xg7G%#;yTs%2WMZBK_bIehZa)jsAqU*Pl zfjK7{7n2_>ze9mBlHe%srNAuExI}W?3e1xl7f+7S;MW4ou}4SB;hZ1Yz?>U}i_H(( z-$lS&s&R?ZR}RdrDc~LiW~0W%lY{dbdw|I}CQ=UP{5T4j)1z@Q`9VGB0W(4464})a zz^v4`XnDazUz|^QPGiDh?S3sBBJ)Bo#o#cXr^pHsx`OA+^Nint!VBrn3L z_GChi5tmNLnKEKxIE?dPCjvK6W0n3~u&e1aubqGXxnY>=5GsC;jh_pXf!W#FXOHyy z1OAak{_#cL2_uXPPc11LKcZxk@6us|hUDd)>Tusb!FQ>5!njLI3Vp*Tjw%WGCiw!x zoRF7R UN1;ybFCJy%Pfy0{-C_o?0>M zs_B)ptDItl)FtC56#B=N_{Wbcnd~q0m5eX;jqs23`z{@?qMlY!RW@(Vw5qZ>(`J`l zSmIr<=$y&3%VzuLOuMS0Y{oEqz~r)N*G`&NQC$`*-n2P$<|374CG)H1&6;zyqhJ9`BXHJ_}QZ;Ydtg874@XW88;qgR% zpED`1V(#>56=j}tJYI(=Dy!#AXB_g34IP=C$kP!;Ol4%?xIp1pNHG4?Yk8-=(8`Q^$-co;-GHVCgE_4m; znRXSH$heMn4RqZfbXot4W=)?rcmCY+s_fiL`)7}{)Yow`|y;yn@-&79k7gO}o16s#(x+RoSp1=jY|+70gE#l+7JBs9=8Oyt$P~lKxpe zziif=tESDFQC>EE*dP~fmV@`16=e&`D$blWW7xUpl;sU7FQ}Y0{o1msSwBYEnLFpq z*>h(gvH}53o4RqUhOuTy;+>2Uy-(VIsW+v95DXSCf8D<;4Aknw;u%B8s?=L{viI0 z3@Ql`T@Rw85geak)U{O=Qhj+ZQv+txe)on^8MTMfs!uS?E{3_SEfXONd(?iPR^3&H z6lXAnNOL2TJD4fGT$2b=zYu4zyAd1%WCzA%4o8F|@T<`Xb~A#bGnz(Zrs)T3f1K4N zU=Gh*0N7D`A&ZNd(@6wuaH69v2(t+g6sEZ$dfhSCQE~I&{oMfdNfM zsK*6H$2WC~RCI{E_2dAe&h_PQ_2oAxS^VbPhWV<7L6VA`MX*<|yJzR3V0otBY{I`R zcVI4a!0diz)*3r3xztwMFhSNjmmZ zY_T5~6MK?K>18F-v#qEYy^hMsZ?yXXKaB~_Mc+6jW$i48m03C_;A1eN) z^b3?XXin7|0N7c1gB!&g%*kr^1_e>xfL=iPgGg6Uh@?oKa$Z?n!R=Pq??H(xU~=H{ zDp-7~!hX?s`Fri>R0;YAic+AU$$iTcc+9B%rpv-?BY0V+(ed2?3M!=JiZ&%>ena{2 zV0wOQ5le9GmM%s?(}KyyI$_qf)aZ!venU>4!uo?(Lb5l(#UJbpM*iReh`7Zt4~1C; z(+emVJjhf!qYBDd1-~b9u0vA|de~1#y4H%pJ^V8xG&apB*s?IA^>)RnMZVcB5sfSW zB^tTQ3fm1zH1c;)VsJHIyD(N)-FYo{m^Gpd+}P3F&{&<3-%z*1{j-L~wVfHB8j5<( zm^f)N{L@6`p+XfohmD$j4ParI>?*sA{7pvC*H&a64g`xH3Iu((8^MXI3f*g}uQtpp z<{D=8LZj|L)zR+N9fuC6N*{V=b%ysPc6M7k!oLNAW%qbZZ`Nr{^Dur@bu~gu_wZ#y`{q?2HQc?ruy5MHDUa?BxC`GW3(MgI3v=?;o`t8&gT7mo z1`RXAy*h1$?-nC8@fHhb9`c)`;A|IV1cFP}_)Sz{+uDjV>QS*hr5+2I9~YtaI3avX znKRr(H^X$jz~r}O(&3@v3l*(bPt*rM8MRB^?hf~@pmV3<>Bjl3=8SYWO_2t1H ziT)mNj^qPuxC?2fq3Yd8^+7j4)w|uRI}cszUj8Hy?miyZ@&@-$9wyrTGEBVL zKVTC~)LqLWX$&|VFn!ws10R1TSl@|sJTKnP~wTbexRC2)F1}!UnTY5G^Bh!`*Mv}(um(ew*pZQpftE6@Wuy4|&|nv49rlhA%vG zyF1h6?hnIpFK=a{knLBh!dqT%)V*6Z+%QLYjM~Ajs?$*sPchT#8g4wXZA&l>zdVN7 z(+CYmD$Z||Vht{4F{dS2ScF|B?Xr;kl+uXrl zyDzQ!k-e3OC^{9ef_q#GDwOE%KFgpAEB+Cd4*pvS_>EG82o8l`p zBIiZ)St=1>o&QiWD~sz1+m9@qC_VQCLPL#6a|{gFTUGW$Ch3#3YRLxWnwq`2%yKJB zrmCpht?$2D0#G%qa`%Munt0Ht{o1`?kkPggseoVGV4!NsL`$u=QM<99Vfqgl12!17 zA7{X=^l{&EKawc^!aY~jKVP_)`aW&)?M6wS_%?WTS#XXKI%cABFD4vvJHuWM3>TiQ zn5ou&QJax3wXR`4kfWSK&87y#ry8MGc&C8?ef9>wWc>8=`3zf;uXpk76i(_QO9m11l!-SvhQb^z2ls#TkdLfb{%y%toC3cDK5 ztyEM!sC-4;gF1er;`b1!g(}_;tgtUYJ)m%>qYWf2#(|(ZE6zSE%n02&6H%)+a0ZAf zbswP=!3ymb4t2)f8;MQRSe0{)_~E)y$!~<(L#~$)Y2m4!Zy+b5y#-RcuTu4W*}Ti& zY90>Wma`Uo{ATCCbR&I?Idu^H|GV`6JL&&-w!+AE6`3Cf*ial}1_l{u5>=t|m&W?u zZysq(_off8y&*3XO%FKgT-P}bt>=z53-gNEE$HhnXkx7@eT67E8dEEPZ|%aT(wRl|}^{VzcjN0b~fRIS{@@FLF22wuOEF5Hvbgu~v zn&LM-QsJEHHw~$9l()yP=nAJ>Yfr!FLS^&1-`vtxoCR;crQBDrt$Kn^NANkN9Csf^ zS9Kkf6fdeWE2_&`u{cCE!DxGR??_a&n#*XVOEV2a0Dkk$wqgU#W)*GKo#yvCVhzpT zF*-P5P;To;=hXJ7-IgAFNu{*)kBns;Vo|ID=5skKsZqHbFlXds=kEw7p!SAAhRf~y zy!*l7-Kz#=)_!>0@F4yV?^`wKm})~6NaRUZzbT~}nVp_P`H}KdBCH@2H<|(=^f>+I z<%9j^e2?G!n^oo;JqMc7*(f~;>2S3ki=Q3z4{fz*NA1*2lz{Ff1k47sYYa48Jt`Tx zCEFg*!hY;?sx*v1Iekl&)p7WKR)yUOs;?>sD?y#Es8yi)E9wPMrzzYkpl(yt>!1dz zyYGU!SCwv*)NDj!mDF^{&<+wBoRE__kpnCkcreVnR^mYpZ$MpZY18m^fgy!G4X@kR z(7mu{X6>G%Yqz8aLDd!ZJf^B!yCXDM9M#1x&lQa=KKzgbsS%vw$c{rHI!3`jPHv&O zF%X)N<3m}k+p&0*_ux)8KmBd5to>t4ON;m5o(=!#=w7|CVNZupkIW8R3(wf#UDlB2 zThRdz*6pZ%3rKHMhcjC*;A7?PKFd`CQhz>xtjhMAI|89XCL%n1(P)?fq%d49)NU%i zys;}-izojbBT?FW5rlYD-7|&Xnm8H5b?7gxv-(TBFoIxWU+VEQ?b??ZwY%IzmCcOR&aU!Tl;x$6Uh&F;tK6U5%P&fO! z;K}3U$v%MMQ*=;_Ik@CFcc!lkFlW0bZ$$-Mv8^)BeXOYGK<$JBNq5nt|E|JzTVdaV`iHvP5n0u$?q-78ufk3O zwM$W#fZC_1GElu$ytG>hdjixa>TVOLRzUf1?2S~zrAb?QZ@+F*y0xb=jQcxq* z6W4;uR@4%UT4CK)Ll_(-%H;TJHU_lCj}TUI zBnQrbgV}IuC3@ugXy`+RC38Ui5pkxwE(Rq7Hj_c^P+^|&96~|#xrT}H_VwX$Ds-uf z%=Zn9t(v=xf{pH*E`*>Q)`E|mmBoS8Y;+2a<%nwSD;Sn~dm)nXM~0wnjTB@n-@F-=WC+{QLZw5`8Omgi1|?yI7Bv%;jH=B6C8KIIqip5U zVMGCYF8a;A{`OpC;Rpn0f7;Un05rg>)`(cFMoiG=lN7`+< zNTc>BX_B%ioG<&%(ISNR{ue zhHScT!8q(+H;{U64Fje&yw3y*|o$Esqu1?6Zb>g4bQ*W)=WkUW^B5iCI&IfN;$ zOuzY;(V>CaMdl`><6o$5%%?4YR{L0rGk=z|438C=n-R6r0Y(8alhW7d_{RW7up}rn zDJ|UHMG{9~-T__S0XvP_R&;m2>9Y`h@SWkp(>fqLLt{8F4;?cUK#OxAcrgr&B?aO` z5iBmH%p>}*!BSk}PH3pKwJb*Rr35_#5DZkF$*HXis0;)zesJVhoYPft*Qe)D~OO5mcCqXLN z6wnO1Rd^v) zKg>j)deC;dGOF!l)lDrYgSX6~ahBy4mD$r6pQ;(I2K94A%?0&KMX}jEMo}Dzk>*Ff zMR~&grx&Prv>Yo%`KlYlwt^HB!;Bt48LJq2#&e!UP4FA$-uxZxD^5|*qc@;h^7QwR zOWNsmZPmjBR4kDUQQ_6c$*fFULr{&V821{Q06UG;9L%DOKkSt6FEY6yb`o{~$ zb|Uih-Rc<_Hh*{7;v84i(Zar9QPzBnY+$+y0okgWPt2$1RPLMs>NrIeSa*k8 zVa&x$b@x(>y4<>328#XVbXSEHb|0t(O8uKaU9YG=gDO$fr=TR>!=U6@mXvQ47xb>D zAlT|%%YB3vM~0@UHpu_W+=Q81Z)NVS4w)-q@iJHLMrW>sMQ3hLl@ZaIEAjrn%>6-2 z?lV^AKJ1XW5*9CW=h2r1$2a5<)_k><>=p{jL6GbbM8fYmAq+5GoM`a(L{gi_n@@PlgjQ z0yV?@On>nFKBe+D3$=<~DD3(Ylx*Lu)@F#^GBr=UIu zqYJ_L${c&>5qG3mDybb zYN(VGA4ctlOjUFAz>jC-4lE5KVW5JmO|qmZpw{~7 zC4OwwVU-^{DOgp8>Uthll?BXmjP>je;lld9gA3=WwSB!J7xsDGnVrF-^&&3oQ!DzK ztrdM(HNX{phcPCmJ3Q!|plz%c@t_rmr7h@O>WqvW20>o}lN5C8x}#SMNuMa{9K`@K)FwH3^ zFk-S{;bg3I<4982e76|pb^`_oW@_=zW+Qkbnx+`EIgHkfj_pTm@p!0U^tsUJso+Y- z8+3127O^QM>SaCb&Wo}*6e0cGZlKzg1uMWHvL3TKypH}rF~~o_R&*XahHQIt9s!+I zE}m0ud8>F}oOuw8KuSLp3rp%bVlX}iJ}jcS_~bQ@m`TfN9+6FfgYzp8Sc%UfchA~o z2*JO4`L`1Pj9~54__v~#4lMY4wuZ}twGAq0BfgE`@3-JzE2iAuQ$qu6jR(;w#(IXP zQ5mkLQJKg*j-O=#CS~g)P#sl?Dgq^auXd-ao5WD)XZZ~)WSJ`pLG}u7?h5bV6<%Y7 zcghOy%oW~6D{7YG`4u%x?uwd~>RTnYra{r{^{l9&KMmIG!MExG)wrN@ch4FQV&WgW ztwykBKW^jSA^clU?F84c7u#Gz{VO%qaF`+xdS)>GVHucr#mEdcfb&!aVGU83q~LjK zqVIJ)x(v%nIgH!fwqFxa_B7g8?Z_~&OSL^Whj*%6179PJ|J)UEjCNqdkv5*O!Y4 z{#DpLG8FDH%W{vuj=EE`fm&BL-9QH9X6V+uNM;f(%_tkyww{1-_kS+uX)=#kxVAiJ zr3%4f$X%@E^YTCOqqHLjJt{M?u1^&=cjo!VkeQiPy}WBFe|SDm4-l8T=QfqQ=kLrY zH{3UFfMUzN?i=?TAsGW|E2dI~HfmqWxfcw$+DbwK=JK3+l?EAyhSGngAZlI2d1_t6 zZ8^&nBFWkaj>M=`E88y2DV5n74B5IfF#%CygSmXr111lYjnIp@>!%YSh`3X6TRGQCHX-0oA+1d-QsMuoR z?l~W|8!GbKBv-=IZdi@Mvgpp$`6sI~)M^Y=D5yN5S7NZ1u?MzrU`J-{ICRs7OiXuO z0g9_6(_L&~c2JhY8F`_;0wo=GHUwnYrv#KtkCcOYTs=$U7Tj+^J+HzVLCJg|PfV0i zuP%sFD42efwT4$k+`0@=S_MLfvQ?mKfp;wDjvQcD`moNJ&=_&^)_p8*Xm)3gfHvWP z+&xESiPy~pe-WfVC=rAykwnY-dKLsMub2D>f9Ah310%!Tvx6$BLglLlpKg01SnSY~O{C7-B^lF(E2i#y~DH_*>i2fv1%`2}=pS%n~ z?*15|j&#WMJs8O4C@y>qTCRE8nR&v_3~hl|lo{F=S=5)imtyAzr|>--U(5@S`og7R zt6h|D@+9+3=S5pOMddJMskIgWPU%q!kV^q-Hc^<8xU0ijdf~RXA0H^0Gn@$Oh;+K2 zIiOBg?uRVJnLGtb6t)qRIFtRLvcNly31=ab!j=)`>GGx)LBaBndE%RNxN;!@ zOw*zE$d2(KU98eNDjO=s42!g*Yd7VUG@_hDI2Ds_nU#th_z7}C_8H0p!SB|SRj{DW4tis4 z+}5fSFq2kwtQ3?86xPMHc6d5%#VFKJC^Xy!0k2ik$U#|I@?@_7!%L9dlpTu>CQaT9IRP1m>9B_6Wr9(}%yNnl2|=6eEg>y-_mq3B9iNw9wQP(QVTbQ)CkE+U6hg`$6XDb46V zOIcSYSY_rhpmwOZPXHyUy%Ln9R?<_uINKGW7nBmLmGXy2ipJ#Hlc?;E!XK}q;GB+_ zZ9j`T3sh%y7Z$9PfZ911IA z5BHx|`RPUT4D&MB!Mj!GbHFZpJX;O+4EQBP0B{Kmlaw-AB-qW>$?BL74Nuzod?9 z=%_rbq07P=I;`xx9&73Tc10tn1Er}@4oYgtMWCc{5dtNRi=Tm##>HAI>`hQIKJ{l% zGBHmpm9+r}K*@@LPAJKvRp~hjlwKtuF8Q3bG!htuSD8rPh~bBT4L^O6oJhDD&9R|TYB%Ef}E3Z9~*(Wz+H zY$!%b#ZW>f$K*6UMm;1|F-!FXRjTQ`#Dmhsh-+mb*roEOz05f+)NNar4Wwcpzz{e* z{BbP2!2*9U&AVbTwiJ%Y^kO`+6$9|w)K(re)N<(tw8>lRp}E#qmEL?*+(WR}Yk40K zC{=6FUE$*2qGlBh3V0ok6-0UOsNktB{aphkVCnCxLEnq*yv+`jbpAd`iHjCE4gedNi0fZ|isCaMlD>4U=VrWeqKooj4mm2P`s=UQPM z21fYNPoCCGe>sYxS2c&1{ss_)2)XnZDp3n}MJ+~1E&Y94cKEa}{rv)RTT6dG!w&$$ zOMgEC2XN6o$XfdQ7ohagU-3@X(qC*`)JuQm#HLmV9nKk`E>OkbHc-bY>J3oh8oA(C zTq6}LuCX&xB(9OGyu>vQvckrK64y8pl(@#LK#6Od3rgJJuRzHl1Pxaf2IHM=I*ca( z%fjF+6a;BI_X8#FF3$=ZVo@VOY0jWz5%4n>^^!%gr6G5T9--v@z@n_eA?AQV^iP)jrK5v7zp9P1L4+p@cO|B$&CuhMMzdu2ztHJq||NpAdav= z(@{4NvP)EB2u{s)jY@iZ>pu@+(u^8zQEb6V80$EpSjP$V6Hu~LWh07%T9VAZpTUN+ z8R)5`VRfNKtySYB+|0xd)(sgdB}jxe5H|ZI1KO3CA}pdE$CRWNi;5m*;@q>+IhPu% z6l46?`aVjZQU$XT*S&*Y*o3a?%mC+Hwy^8uZ`-4KP${NDSBIupB6l?zW_M+k^@e$L zg8V}-hb;!#V8kI%*Uc4E24WjXCufCr8)}>La)O~2Ux9w zy>ou^HEw;B)q{G@GGLyG)M3?nMGmmTNaG}e>JbFpreTZpRu8w?-aj+ z8?l7YZ;r$g!lCKdW>I~$ciD~B3d2Ce3PZVV6k(AmPOJG23l}h)i(a@jD_466JBZi- zWJk(lK)HtyMR>fo{Uo2DlB9jQsy-~f>a-t)Vu=!|=RUWf(~d0Y$Ze#7j<0e$7WJ~% z;1Ha_-Rd4R*wpYe4)iJZVA_rOP@&X6;{(!{VIGz7u*MQ$14U zf)s!0F)_v3clVAkCd@dZ@YHNt3Eu7NVJ?@Y8ubS@M(k+pbzozn4UMIe@z#dMO7%ND z0g5bjL3J-)Z~-Xsf{%fc#hhzE$%e~DP^YW@1D}%( zmwy2z8!p*AxlPr!1g+hZNV(cH`At9hKIE}?AC{Bgg z(O@>y*SGZoP@W4+$N5(q7M>Jfxr})hC;1HYv`*n9{(#r%9f~;!&An3F7oMpe;Z{#X z*T!R7Kw-0!pUa23y4Qpk4~+;8^tSdY=QMJ_d_@gW0I2PLLPT0Y2TZ0y?@2_Vn}7&e zH|ARvBVC`Z*}6Od}S$<;g;~BWla?zDM^*tE85@ zeAy(GlK{|EsoA$5k4Kuz@|-;?1Y0yPF{iqgg*nAoH^C7>7rK3zTKn9csfJlU=Te1Y z_nJ;DEOe_=+^ajW5rf_KKZ0An92OH^%&s&(Q%&uit(P4j!xJmJP$|1!t9*<8uia@Y zmb9y(Jv|_0-X<=r@NTx&EUOATk%}HhbOi*p#%8x0QE8i4X_(4PH8`ADAGTK2kt+^Q z>#_ii@VkU-i2p>c=DI`)z~f9i&t6lHufz{V9r1X4F(cF1ibftKz=;Dz#S$~!Zjr~L z&7wS=`n5`z_<~~@jLjA;JwZ=a#yJ3#44rX}%wx(FDnPAO)O=7^C|nIF85Lj^{yTM- zix1yX6n9h#zbsIDRaiDC;mkdHvgwb@!)P$+uE#;ipxn!#-a&Pm?s^5(H|p+Npo$fx zdLwFute(2WX>RHaOrzkktg7RXjTj5XwmuF(8nulXMnOqdHOyC)XRcj^r?N&CWmr9O zt|?tDiHn?LD(v4X27O_ zl36sm0zHd1-TSREV2f2SSBnO0p>MbAMX4la_EL3!;>};G6nYLcr&S&C!gj=LjlxU6 zOOM2IGDzk&^FYbm<`7UaKGWX)au~5auraNwo7xPeRj8-hyW(+~1?4o5cs#4CnJvpd z!lg{>@jxR}SqgZ2`=YshfJDt~iVlwlMs&z7jRW)0;{E6$um`3y%O5Pv2nYE>#(rNg zkg?C6k&*y9OXmbITFFjUz><`UKuJA(uGO@U{J>@JMySSnK9K#%!!4aoarYt2fIOl{KpQ%z4t_&j=fUCm95e1naoMW!F4g4JmMW*%B~Kcbx=ki0Uk` zRuzif3l8I?yEr>7l*gjRSQJ|la<{~y=74%sRT~RIaf~h<3HYyz%pnL5BES%Yhho!O zA-2)v9i2q%WtP~3EwP27*i?*&EtJO!qu3HQ*`lUf)I3m+D6y{xWr>ZhUN2P#@aW7u z-8)so9}y!TJULSxCt{tRx$u-I;|N`_p zb$7g`I^mVA*3g6+QTU%oyW|DaE>yg<%U!0Olr8PKG7eB?nCYiY0ptaIP|>GvG1EH? zQCeI&AUs;4rcT3WFQ@{elpl3l3X%%1WrAF7)eY+mt96B;uRH_uK5N5MKJ~3nv~&in zP8l18DF^57E;g#BE3-QTRH>ras1k~tc-H0F6y_(d2Ol{-j zmb^YTCww9!2gtL*u2PI%AXRvuh!sI~&S0dH+Y`YiMB{j zEGmo+&(q-^RL`Dl)XgJ`O;2uc#1y{1WVaDKS#|Q4T2aB}w6OrnVj89jA)iKte2S3W zQ6ak#vMnlP8$#Acg{()&Q&AyLS&`PSrFq33-gy0BeVQ!Jj*js6Ee6oyS=pkI;nbTz z$;>Is;w)ta?}C!?iH|@{Q(iPnvX*nizy>|O`}3^e)gp}2O1&v5~=!m?LQqaqy z`dJixuiPDDQCC>hHK4?HIo~Da;pd?2!`2`VXNMS;8+eu zLnW#lctNbov$UY<8oc!dbunB_XzsvC^!{2A2hGp)@s{=zh3# zM@{}m)*K$(keXvID5*Jq3`%N_ji99Fcng#a1=H#EQ$2JxAf33uvr$xMuwCRuC$Tz@en9``JhRld~C-*$MRv-EM{E;FtWNJv-UUq!374{5l@|p zuxlf00IRk1zdBS++N>N=R(u+pqyHyuDrgyz}twfAz>&Wy{Bkk#Z zw>;RVD7Y{e*;Q51VE0!$Y1OUZ@n&4i2W>CBXc3B zQdJs8f|53E4Jh$yw}XCCLBll3X{vlA)6_?&nf#7}wO2U?aax2`U zR@hbx*A3PtxXBiEn?=0{O4irB4@yq+{>Y-Z8c@RQEC0?_-d4>QMV=dn8uc@j=%(e?rzdr3Dd3_q>8|KPjcU!+M zZJT;s+UfdrX{SfNF6|*KYxNlB6rAgE#XZ)#7nIYY+qFx94Zn-+-Fit3+`<+Zb;k@|!+cAvHJ$>~L41{nuNv_oTrEJh;!|f?9bkNN%OO5Bw9x+AGpBc! z(H!``vW-f)vY3bOMbmEyTmG27|1j?-exKQ2k$W(4Yzz92-e;Dt-e*?zpS;iPsTAL5 z##8gd?=xG)YM?(}YqtD-iVEwQiseD~=$F9Ygs2o>XLcdhH8+P}X9ithP)EJaEWOEh zJNAO$ZDvnlzu4`3nOU{&QH&XH)Z(GC`b}#8$y>}+)c)Eg zd5PJoy=90YI(EFt>mk>I8H~2PJ{<7~OJGhBh)#P+gPj%3U4*UF~V2^YbA*9 zEt}5d{6PB0Ys-}W5#>`xvnLnIQT9$tzl`zzAlU%M*cu79^1tjG%l5Oh*KA_t(!S*X zzwySh--DyPf9&s|WJPgblstL=*db6WRdsg?szZ7IST{8PWJu^JP%<+#*$OKMrB@k) zl7V`@r%c{I#s-`oytgfew-(NqA{ka=x?8wYkQW(hVV6aQ%9&cIA=FfTsoqMqky4sRVVpqBw9U z8x(E@B^wm(19h9y$S*<328G{&x>q+yu&_6LN_otSns{(pR{J63H{_I}2H30LG>*cB z!y&O7%a4Ww-=kp23(Z*AP`T?mCCBow$H%^(5-aS>gJ-m2Fu$XF4POev3dLK{T-~v$ zvs5V0@)ZTpJfgvwrRp6YcsCc{6wTQqb^ahSkIBfA-4AMGLb2Dq`eU^cl!vLfmmh|_ z`kaLDS&JVcNcI=2!=bE=MCz<4^i3*_(DiDLL>+L4S}WWbch{}Pqt+bBbNGQdlEHeb zF*-G}+XoBMb!QbE!DxBT3MS&k4fu9dmvVkXO^vA566D8F#AXKMDJ|rp?GA*P_Suk@k$6J3;+BJwS&w_I zFwS+bb(`+u3UgWN*$PT#Jq}o5N22h{T`u;O84kJzq0Ry&Ga(*}!r4EI@VHfcKU1;T zPlMEk=_%&xiDKti^iWkSj|L?hq)%#(9R`iYarkgtyaqtM3_kCGw-Q_R7gy3xg=TrU z_0k91%;bI*9LDdRVob+u$}yu`v6IbPY~U5@rWb1i7!`#m9wr-XimzCvdB8)Q+iYx|+C6X+HKuH{UEAXCfBPC)X7<`AT0* z0ZJO1V|+-&bZZ|ZUYy7^pk%^yIVf=$D?y1PU|l3soJmjappG2v?1Bd#QRR(g=uhG; zoIq<-ok-9d0%9$J+Du+tUb`=kZ(vfD*>%`~ig#Hz1-Q56aG;=JVgE6q^v*^Q=L@69 zSKH?15o~Gx5Z;BMhoPF%^Id!C0Ha<%#CJa74f8j-;N4h!OZnEPnd3q^*kjwm_YLV+ z4WaX7y=v%?dezWzwDAJltA>JCBmR&1nxP_|BfSN$kLs*aQxx%LAsjr7H)@67Y3UD5 zPV+XUpBuTdA@(&wqa$ACn|lui%YW8=YIKP z9vq3Ces~cX-sa?xpI-GcGDxnH`>*7xyvyqc%vB`qzm%&Hoc=qxT8w=ArOHdTe+;+mz6_ z$LVHB=pO)SGdDY)Zgy>t+V7%IH&c>9Om*P9dCOo#;m0}YJffTfiRtQPP$4ziDB9$q z`Dp2fkIc`*TLsjqH_f*&d3?jA!bQIMk_+gi#(5l+)H82@lGgyxLDbS!I}?<2)wniIx@x09Nmq>v zKBcR6B`E2t%>-q&NYRwrh_@<6`u6|w^0>la2Ojnu9F18hbCVIAf_bP)bgdR;;|#h- zvykN&t=@wiaQCnL*xi58&d5>gx~Gv?I^59DnK?8XXhx=OXkNon4cA<+7ngbP1GeR^ z`wO|P9+lfPDwo5x%m0YqVXmAp4&gU;n09jCR?9o#gXnI^@nFa86i$}t4W@-TQ~53g zz7q>~Wr6rjC6;QzhILHOQ44{KP;*<0ft{I$VwsB`ntYWJaw&1cZQIx% zDnxxrzSM_Jz>tLzk<&!9q{t)ryzboj`|)-C9(6b$Gt+)>dsHWOgl$P*OMi$U6G@{% zi8ojZO7@@r9F*)jqK9})b-%b|M)tFEdc0b-8Q%vb6HW&~$!Hai?yJgVCy~t(+2hLT z@kQ#1VW8eo{QRIKHlBecyInacF4Z8;2ul3r(-wtx zc^=eYb+3mgJ_z+hhU$&t?M?%y=*jC`LXT#Ar~JltJP5zB1%6{~xP){5x^5-ng5Pkj z_U1NubJMt}^w+?KCy);Wq|gUKry<5D=dctS6X(E_3V5JRG0T3GSHLJ0kK{)9qQ!Vz z`-Gxp%0@BiJu?t2s|;2zlI`Tn0BJ8=OI0cNtWfR%u3)9ywOql|{2hFr!E^;v6wh{7 zpd;bHPI1(pag|bdg0+0m?g|6NHxWcQXF7 zWBH3Rn(FvG#MQ#B>%iO#-Q_|CNQtMf=S%F(hxP!7mj`xH2{m`B6_Euy`8w5zBLwcS z@^D2ec~}dcspX;ayl~jcwd!QI=b?2sQd#lyQ0=7`o3T87>e)La!qKmU07=!)QMPdQ zs+tONsQNW*Z4ude?!S<&HBNl%5opg=$ues}hx&=b5@kGE{gNOvq)M+o4uf<5Eaq_P zYVJSEp{q%Vsdy2vlV5Lf3>1Un*#)77aLVgdt4mk5p*>cxK3PUmXys9O(6nVBfKoLS zgOY0CGEn8pftP|3mwz=Vap0^ErIL68lvEP0fD#8z@x_624V6>~T|v!K{8(K`g>W(` z;m2`MsSxIZk_v%6AK^z=Cj7Qpci*<|ehNw|gfx__{ZMhbi-#g+DQW;HiQ^JblIH6` zNt%BGO5%7Nl*F+al%$!CWUfjxPeYP4b8W-#73YsZ%~N+d0xNgF10}KX#V8^X&lC}f zCV`STxKT;Mo&+T+z$l!S<5f^niMKTYm7x*3hHx(D+P6-qOJv1q2yQy>U$Md2dbx{ZUglvID~Z9-Jo=P+jc&RuHZtq zHXtjk%FudM3!5^rp)@rsR5;*luq@Tz2#@AnmaSguhGr7phF}DTXY!1?;P5O}zG&+a zuPY9B71j6~Yr|h5z3J)@l^%*>quXMf`5!QrWj6VULS9MXH#ZcS+XLo1fsh})+Xlb6 z!*9N-WIGO^a-~Pv@akT}S3YE7u1Ll|%j+85cQvq6D+kV(wPQWuih%8aLcZT)^-e^f z-r13D9jU{rHCL&_y&A6x#sS7|-=Ey8@ooh6y}~E)U?0fkja`uzDdmGe%}_A~K#8@e zH;40;x`r)Y!+a@+UJ%29SWEXA-Z9AsQn^Evy^(&myg5a7p2MVIaFgUMuxq91$h{6dO z5rxAU?V>oW99o{U5)du{f)$zDF$!FKnjb@p=4Z8k&93T%-k12Q+ zi>uI-_t zIi!+vOjwV$7gn_r8syv2SR^7#im%OYepX~+ttp0CW;593_Vx8l&_w&lOZiF;CAGRw_GXUNO-No6j#reS%VP_qj_*}skF5%{tE64OKgaUIvhx6onBcpT;jkHZ`479aKo+dMO~)AFCEpYS&Cm<>-l)n?~%C2R_M=Kww9cc9z*^laD^ zaMJTlwgoR<(YZQK^*l54poD=#;EtZMHk2*2P;ZNGfiGZml-?H40=L~bFXXw~2R%|t zB#JJmArgfZl;4e=70=yK@C%nM0GoTmR}p2$JYlg59F z`MiZaD-U_OMEg0J&lM=tdUmjnDR&}%rG=GNES<1zbTGZoGV?45z#XuDsugh<-gkS> zMi-7W&j4#1;yi=aciTC!sM+KmJUpVRz42Ra)4&YrD=LGbsF%E5<#bITr}}X{pfs>v zPuK=1fuU?br&+~N1#*=xYY1=>dJ(H4aLi5Bh8xh-WY>}aQFmnwAgVxq14P{m81IIH z$j9)Hm7zclzsLV8JO7(y2bvcD|Aq3Sd(0EwCh-5tkGAr&n3a`}V)?;2CMrMp8dWMk z>0it;L1!kdhi286~}Nu)Zdr_ z=zp}o0qurgQ|gvM32=d`9unajT{CpoJ5Ws3HPcmf%`jj8FLljuHHlnxM|9Pz{|m0t z?4bQ$cNMI}sG1qtx{wvK70S$2a3##9u7%mudD61ubA>%S06W?OGT-3~Ze8*FiSPnX zg(4$h0_=Z}8VnE4MZ%YD-*~?Dv=KZYD>-3NgJvI|GuY`fT9Ik#pV?XAjU|SW%Aw8Q z1;bEyf%RiKlxWH00NlY zaC0<1K>}%x(R<*RDu&p@gd%u@t+1HyI!!4YjC(C%&M#mBOUP-c^`J)ZvJ9LJhGfs> zTd!EhE+BLCJ3j~54)O@zuKBL|;1;}3$llWry-!KsE*tpG?f2Pjfg|+sF!QqMz&@U; zULFpgX=9lBRsOYsih6jsUPHT!?*gLfr4-Pq3Turv0-}}&zwkj-F|K=yEl(;ii9I)Q zCvXqxRb$peWYZ^-jdw6rAcrQ%FY~JTF4!CNBA`W%(mpy`{pePv0qk4_-$EgPXISLy zP3$n#SG2gDat{~uq3|8XMPTr}lI@#<7mohtk-(?bz7+{fGgV?SS+Ey@`azkbNsXT{ z&0!FpXc0Zld>6hTm8CU&dx6V*jJkrtOmSD7w+T6nEnq+9BJ*AFG2l)XFuB7#Y9ii1 zv;KRL#gr5o-6%58W&a<{b7@YX;S>?1I&40GR4-KdYzStF1eyg>+9`Y*zhSdMwBgx& zr!G#VG^EGv;GNV%aJ^>;F7beyC)=fhhmc>+{ES@^b|q`HEIk{(3$8c^j}As>bo_#I zL%*@PA%E~c6hw>?5`k^&?R_{H#6(ag#dp|bc{ZGgbvi@^6+6s9VY}{uQ)Yoc2+cn9 zibx|>v~V{)`**BpqRka2&3EO1VAsP9)lxIPpn_Hy`ZxD8OfmFsE=$qfqH`FYN#*-6 zb)Xb@>GCYvfWJBTnKft>do)cO|!W18TKAVH~tErbC?Kv^2fnqyfbsz_Yq((zPGve zA^7$qyI)YT@mJM%6KF@YcP8DyHmb;X6yWm-o+f!(Kcv9+SyNI?qdk!&eG4b^uzyyt zT>>n1KoyaUpOXtY{3BaPXrV$i!HbE<5=ydgK^IOp0n>F^J+~GRPSWcMxCfm+S@0SV zZ7#uO2-;j?2#7Y9R0c$wOK{bCGRr==0gE=5xC0U=yX7EAtRwYUeBuWMU|J4pzuBok z@?ZF%0KE0-G|p?NqRt#62R+nvRj9N#16w>4ne%ZkIW7>x=LWmOCS;f>hgKB&0etfX zIuSewl`Y?ggWaAnx%gsIMT>XJ?uyLrHf)ljp(4{9=P78qBne)BTWs^Q`GhoPCrw_P zTY#wFacT><`3vS25GOS9=9V2T@YV3Ru!~!hop2J@mCb-iWSqF?))14EkS;ia+QmA6s9nq)V-FZA zc~5)p{4q~bfu*Sbv9LlB98uC+`lI0%F1q9AxZtHd;H1n9%&3_;b~W8)%DT{-8RDM_ zUysSgPt~-6w?k*GXRYPrzyr94#bqFWp_T*>k2zqi+za!B9NpP zzG)28%mFG#Ri{R^oR~J;hHW*3&9dMz*ighfH~93$JWvlhHK}mG)?G_a2BxG`DTd1u z)PFev$b^;1TY!uh!nrC+F?^>CrC4u3lw#`FBly6V7oho2;+GdbL&sY+0EVVo`sD>k zTKQpE3V{DA@UkIzwZI`z6jzAUT^yz^+Y|^7_v|cW1^pUp;1WGxOQoTAMxu4Drwy(; zDsnyL2B0cjhL;5-!iq?ut7-$k^rbh@`3J?e>O2Bch^?(5zHtVg1Q_n2$mp-|&qxNJ zj|L5(b{9X)1A_;c{3nh~SYGl9-6n@EM(_n5^IebdIX=h?6=6hB;$R{=qkj)Y+Hi%C zVv!bMQ7)~$ge2h5d#9{fD$Vfdgi+ zbnOi&ht=Fa14?1n@Kq@E6x|0vv)DDP38^;6`kHEUtgopy$Cq$WZH}*WqS`zd5Y^_< zfV9`ZiTe zQC5RHESaD#hE3#96DnZ0D{gho7;IAjA34E?ScC#w4lFo;F&(?b_-Lgw2{sodmAcHy z`a#f(2szvUq&8$O!qvRHPy^}--2mNY2=`0gUC!t=!nN4rF_|;qgSu_}J_O!jM=Ohjl#^ z4j&X*?ZAW%F@C!5z$m%m{8xXKc~I0ceS2iMzVS`aQ&#YUZwzFBb9`Ot5a^v@UjVzm z;XE@a1{yseP&k}XoPVz(3&=861UQ`cJO9BSAFuKS1`80S125^z>Y!wggj`ZpnZ7;J zIwa_P1uCgm(Ua)a$8W%CjPf*g1Sl_|w`lA5MnL+kY~g+r+Ayxl3GnzBrM0RBS3ug@ z__q)SwZ=48mWAKIFG>T<8Y%E}mS^BsFc2O&OB22@0%LZTX&9Yh347pyCEDB@s`NvL zF>PpQK;M#T2)RnKZy0(BRA1v>vfGe2;=bW*IC1rbeZvbe$+E`dR&tg~)Y?m$kvzVZ z%(klIPI7x}N$Rpq>uuThmZ3vZ23r*iy2d_OY$P^H;Bv#pCtyed?HL$i2AkC3QPn(1 zYsi(5&>2CnfO$fR-}8=TJKhc8At9Iv^Vp?RpzGlbb3J4Oymb?51!#9zt5Mwrb*rfAJA2WO@w$Y>`T}RTI|nV20)iZJ}Tf zK0aq{5j^51t}~e5KTDe4zkJ z2Rt!MPcj<&HSZFWtml`}B?hiSE8RXuk?E>%I0r?;2OJ*miOrF@C$vZA=~qy}%$$Ob znTONzb=`H%#~p<$sFy9&Iw?kwV4jZ8 zW?>?of@1)T?gMlUkq(P7CDn-ncs2&>ch*OTq-xKSs=X?yxDU%{tTGr*@VLe;I3!ysMrv7!_&^&>^f8j39TkWa?0d=QKpgKPPhm{>jZt*3md z03RtH0EpBL14Qb^i3po==)`nY_4inkvPmb%Vm|C;07j|1cLTYQ(iFO8Fqxp5L!(g$ z+W-O+UEI0TAbn9?_8>ETep&rs{pl7UhMt{o52zjUEA~n0N%$B*ZP+!aa20T(QQ@-Q zH)cHW1--BUR}{^6b}}4yL0KV{URjVb5>AZx3Cu;(>j~ueoG&<%G9OfUVVX|>W2&Y! z$!%i_)h-a~N-X;tXs?=NgXT>={(>GW^RE@vm5$MlmR0&0hfW&^O(%B zpc%4>ll$M#kF%|E*b#|~t)K+e6{?v6g*a0H6S>k2iW|UIXxrg$F8~_rV^)BQD9%o< zdhLb>y=YU?HA>*}v1=3wi7M7bI6PEj2FaneT$P7vfFos{3d5bPdQf!G^Y@e`cpZzX+=U=wAf1 zIG(HzooyYEfvq-sRfH4v*i!7_N{ph#A%(fuA-@(mgP^wbjPY~Og?8H$9|OcUM+oM- z1XTn$&(EKlV;^=sbhr%If{V9$0=%Rl?Qb1rJ^ZPPKNe{pbdr^qX%FiV>^WfEi3mLg^C`=K3cpkx>IqpNAuKldXC($= zL4uzVc0J&wlQ7OwneT?LqKhz0KQXGIq6M@G9~I^Su-J1>kyXF7f96q^fsw@Fc3oiU z;HrqoRp@3bbaV<}77DTuEcCg;Smvk_URIM)#y@LNpyKPP{m^$7{B=LW3hwBc^w=uo zDHuC~TDYDg_jkDG2Tw<(9kGXn&tTZZ+8-Eb00wmc+8mf}0X-{BgH$7aIJ5CWW~5 zbO`QLP`$+1zW~~*WUC#TmvZ1u@Q_1 zpge|jtn>w|aI=K6p{9W*4dF6`?sQ>+DEFO0W#~P7?5OQq(W;|;}E<(t)qttlT zi5!HGWA8WPSub)CLav-*@yOvS4;w@dLdcQJI4q5H1S5&F@XmZjZ3^fQMuSpt4Tgt} zqBKItbB0mca}ua@h0E*`{0P?=lA%N)6taeZV_jWAW+l_n(-HK>;&rI6*)RQU7Na19 zQQTlsq*+6nWLrcILdbEKI7-PHTSYEH$n}W0O3>^#k%JI&JX3S1TxkhcdDtOx5JHYu z#8KW*D6fS7$TC8C$h_s9E%T8p8-G+`m&i>Bxj(4m3nwz1?B)S`i&U%#A%_5MGZZUJ zL&4I;Ot9=+w$LQsD6dR{K`7pg#~)SLD{>P;ZUe?$1O0fUtf1eOC8WrOXGCiuBAk^a zE|l$w*+CVw$u}kWDhjR*D58>!IuIYmMRHMQ&^P4b>+W=g8d$}E-og**jk57cF&?z( zZSybmMw$4yEDze`R%3EYO07Yh6^{GG)FOnQvLmfDQj2q;2Z={oBRsdKqQz;Y&$ASA%s%8s^e8@+6~!MAy?!egdDwygVni)f^lbRj#qFN zIGzx>2q9M}aoHFPHlV2uXletR+BjPmTIE}?1|2t3@Ni0$KnNw^Yb;eA2URL0adJ4G z5jhAUN1U2N)zy%;CucnqMxwdNMlE!sSe&Uq$u4`~| zI9?Yy2qDK|#$gMu#4wmam74;t;++MI8h~&Ve^lXyD1#7Ep7=o-H$@qQP{ujZT%%fv z_ok{@XyeD!JLe8heSwcGA7dZ$a$3Kk2($WArfEI$~jIs%) zp(bLHwE&9wj0?L0Ul}a`0VlP1cpyq8gi_x#N_$R%)H0Ztpu(!pkRdCqg)T^w&x&j) z!!=mJrGWs7A_Pn0?0ajv0xCk+3|i_M{vxZOr&%PWt?WZlIYKDWki}oKtPXQ9IM=0& zVD3x~z6`gfN=AjMAQy zU{ucR5>};6C{km*>mh?5obZKV!%JC^U}>%g-ZB=mBhnOAqLrw`0KBORPemmNp%Sje zmGBgm@Fpc#7MX@hs0N0!WF-yro{3Qq!YJA@Dc|;77ezUvt(=0EzCc?u%VqAnUuKr9Mag`A#Qlx#AS0Wc7< zk%JI&3}zg*8qG2?70qL5j1I5Qz#mn3BT6KM5=S!1P^3VAj%TN`N=2rTYT;c~cq_^v zgfcQ1lQi2&Io^pJgpgyZNle;YG@@Dv_Y@LF6EW9LtL7C5_{w z$Uz7>)-VoBxrrcGRu|-v)daaqRY4B@G}fDz)L&R@QNi~`4MO~;J+P<3fS4_taJq!vJ0cwH7h{l z8L9|q5<{r`6ozU5n$A!iK(iRC4=5LeLa%U&U?j7+Y&BhGp-L&{0XY!xKoJ9f%@6 zEO68pxdH$p<7XU{C(SAZmS%GBO>I=qW z4f54~gB_r77j0L|!Ye$K5oHlVSyh;<8qoQ(1Ya6?VDj18B387>dJpqqBC&4zUCA$Q)f(Jv?Q%c3A zhNcM&)(XzDwZ&!#q@#8dF)BhJNNB^PX`1c@cX%)rxdwYG0}Q68oX|cKdN9ZN+X0k-56ykQlNwSvQt?V;oF_DeqtQb zDI(mFP0bP^j3bOu#$X&6FrJ^;C7=}sFeGD@1*QWv(K2Tk{HVJ`a9zW~L5vNrPrx5l zuoPn_1VlmtqqOHF82eCm31c6@kRFTO2}w`|13D(E=r1nF49DvK%PJk!oa zr|Yo5k#eZ!A|@4pfFJ7Rp}eRZAs`awGD>?+g49ddB~)$&L!=zO%#gJc7VR4!J*L|rrnl8Z7YbD<(-QJ%e`TqNY)D@sE# zpjXHjDDys&tAaLtbC}$o{g=|r3Cx;6uawW6NGmL809D1G5E^olG1EA>=$s42STwU; zX0&+yCH|;FWl<_2l$ysV?Kuf%wrlJXX0{s)QDzI3WVXpNcyitn76Gkb%FAj-(K1<7 zlfRe<6u(W9?W>BK5CS6MHlwshQVdA_h+RTW3K*g(ul%NXpH(w#7{oMN!OAF53E_}V zG{i|@2!}ZM9!Ds_cVq??4B?GZIvsU18<}+|Qx&R-+7UvjFPH-I9z!#2-OPo$Ls|&6 zW88%rkz<7#E@OlmI>Ur=g_il|*)aVV$mPJaI>c)Sr_}D+;|(L!1Or~hW^lH%;*mTh78zL$x=6VzYIH!DTC>BU-SmG$GFLWkl9ul3<8~m3P!puni7g6f0v@DNsv{o)8MK zVKGqsMuRKPfp>`xOEMwMz{G)6*s$=RO?EZ4Y$Yt?11aYyNj7mHRR=B@j@o3~k!-jt zm5cd?sEfuxa#3a%_~${J+6;z`mO~jT)^)2Qv#ew+R8m?Bl_D*KO3(wU1UpPB zZL5$EJS<=qq7FtCK(V4W{ZYOu*o)c_LTw@#r9CG>>NruGc!sDe$EMIcWN@Fllh~KT zr!I8`KdPYOhciORGlx;ea*_m8aS6MI znQ1vgG9a|AY$R0Hv8K7nJhN=RaaCv}dWjImzm`$DauPhE z3R^`Lwlf4j!tV@OunLA+siiDSWwT$Z>+k3u&vRrh#2*=R7)GPVkQpG#aoC4G2_(8g zB|tjtt{ouNK*!h^D{z(!yI8EMWXLf@bKDuZ)i|LSbm0xB88p zrc~*T5>$aWfKA1VD(z>21zT&FN{lQAQ;JrC^#z(zL@sPM)cyU_L=4xYo3xsU4kd(Q zk1@((4n4;%W13!I2!4dC3>h+qdNg!p?FYJzoQ0QF?vSA)$sLy%kIEfa(HqT~Hw4{oh0gED`X}LsQXyLTEqCazU!ba1zW+PuV53 zy^x_|g?^aK($*Np`(}czbNRw@`IdRC>m^xvEm}Fg7qvNv@>QXks0|_1<{w6B&q#Ch72)R3ij%5C?-K0aw?!OhH#FZ62kxnj;{==8A^w~j&PR;;zT#AWniDX=x$wU z6Xz=GO$hbIOi`3WI@#7-Syz5P3jl|0Shfe zPD02DEg5K6qZ(|Ig0ZP>R~VbZ61x6HR%it|F|ws;;=$A-giRZ9BUKLk^PnvrImM$Q zk*kjATeU8PFlLgAGB2no@t{p^9kLuIolLz93t?(9n>RN#B%JP|<%H1k`Vz}cndN2| z!SYBG#>cs_b|W6NoDf>B;szwOTw6TOMJ(rX(Q>segwS%5i!%R!e;%~SbtTK$@@vrn ztF&X+QnZ{9THcB{B@37_JR-a+au7leZ{nzEEL4mvD^!GSr4^mouqv-?HZA#nkVx4WV_l(fq)gyBat$%FUoVl15ORg9eS}Rb z1kQnXi4J{42z^8xNQEE5>MBT&!E_ z%u_|PTRNH1pdh70T3b;XA(S?rQO0m8^wd;#3222G3>9l1^JKP_aaPhwFx^&kRVzU&8oVb+CgNg=D z31K8FnH<|Hda#O7uE;7z65Pd%Nvfj}TNo_>AylGzdr@^lD0MxfETZ~v>=HV0Cqrr{ z4kguV=*s@&TOEq2uA%{MLKw*&CdbwmpO`ThjJMGOOb@t&YO9y793;vHh{_T|IR}{> z=@NN!xXMEZk%JI&93>8o+>L3?Lr0N|5OSR&E-iJtFK2^epvXxGInR@&m5g9;S`7xK zRfS5h4T4PsGEWhE(LUHs#)EerV~0rhq)sgAWEm=i ztz~3>GQnQf9rC`eV5HMZtPxSrJ&;l~^E?;z`HBRp5G3kD2=#f)C|x-T9#N;4qE4?F zg3h7vks+F>qyf&-P|UYNKH5z4kSJ0;FGsUmGCe&uGlf;|9&=83!psn*6nFSy{Xbh>Ye=5m)BnG2Y2?X?o zMP3&W3tN!94C6-U8#AOwBanQQsG4fLENdy#^Oe1a&4;CJbm}g8mk_$bg2|+19$4am zm6Xz#d8&xE;9F97=qXAjgpw;TN_$R%)YaJ~G^Hj(G|^EXNeVHAS~HiG0YqtK>?Vwt znd&*pWN{^~T@equkq|~*n@L}FPFjd-!gU^ciRuzU9w)|AqmmvJDg!}ZiCU;PyJCV8 zEhZ=->^2e?%9aihw8_UF5k9p8c52AR*omWPEF>G{X23rW+GM+_WD^ay6n#R}MPnej zD04d(DpD5Z@nCY>bkniMeLUtc=r$9qlPn6Ms>w!HFZ@x3-l9(lVVr)Xmzkbmri3S~ zUJDRX8v1d3% zRKOjXRUuSVfDkG$kx|BQ5>#NisK6{zfX!9N;Erl$C{kuy#aO-Z`hrbig?#Hgt8Dc= zR?${_k*E!8!BlZYirNrDZRRq{Vy)y-QKJDG6m0ZnasOGiw*)(4Z$c4Is*)btlmM$~Mkm=bN)Rq}%(a{nhS)>cu;T_W@}aGFM5O!+I*W)#&8lW$dA}1pcM)j((Lf+4HC*4$n<48Wes4U zWFnMxHp+*`jssCfL;O*N0b+E7FuE5^VvQIBAqE;2%U8yN{t+yeYEE=I(PMK+2>x^@s{FHk#LRBscJn4VN#P^l-c|nazCr&f+Wye(9j!Yk<_9VkbIQg`Wy0f zL4>YgX<{IlIG4%SPtXh14OEZeQ7SbR=ofQF3qY`xNR1agP6$12#3=2N6a!LQu}hf1 zre z4@pxwAb468tim82<0p!m62iD_ifdX!)YOilf3pR>J*1befIV6=3#Z3NvuilYnZOWk zLC<6em7mH`4L~y(ssm^?L-hfvMty7xdQfRw&?#cz69}P=KQS|G8=46Uu~J-EnBPiR9~>I3Ulu|6$I(l*rh;-`Emhs z4gldZ{-}ad)QS*l<<27haak#%EJ7&D>jz}vYdU!tB+4R$vK0SP)?iTGBI^weHW-P!%_Om0rg_M00j1JX9N(2im?#FSYV1863Cw2 zhaa@B54!}kLMTJHlml;`z>GqJe!T&DGI*-O_Ft(ME2@Sc1>s@1s2U+uEuy$;aiVJR zC9Ad!RAaf!x=1dY1|o~*vPC?0IF1k%AcP7eu{dn&nZP4{)!-4o3IZFp-C@O75 zmz*idtWL;ek%E_=n?a;rkYOiFJ(y@pGGt9}S7YAvhN8?G_@fG=MRf^b921yEHE=xo z3U>Fawp(&8xG4}Vx|$F+G%7AYS@6$;Hu+g3Uq!;@V)duife^+;a#7|g6$c))$(_mM zN@p`1Bpj)trG(JZ`NSc4W}?4@W30$Q2sxH84$3fc$S^h~W|-fBx@d;kz<4o&b~J5* zP#7o1LI`77#VGCBefYs5yNO)_T45_glwtB%hACtXavsYtVKBP|b0<_O11crMT+)RM z~lI;5t}0v>96Rb8w^>NK>hZZn?lLmu?EcD0!f0kb@9%T$OS(M9Nn9qY4?K z>j@#pEyiK%Tvo7C))4F><$@i&S;7uVmN@JWGQr*MJ__frO)Q+b>I;i<8Xs)X;;k=?(#5Q zFifs^S5aAaJ>utJO9W0!OR#N121aA-5`%E8R01fDx#|OwqH1 z(6hA|$M;ph4Hzv7lUBg9MX7{PYF$QYkE9q-Yba|_w*alsgrOg(fLV_5Dmll@6*VA) z8o07Z*iasdpxGb z2c{n(?70vJQc2%~q)oOr$p%WPCYVErx@Zg}7iIR7{)YS@CSTgmVr?B70b!n)0|=paf{8=RB5p9_p`QgJ zCn4kvXPgqEV(@pU7#za94Tic6>_0Gm@IZOgkcg-RWo-PwV!YA|*F`yZ zHRMRCH1RQ!>yZXmcvz%7EGa2$sC;15V0m2Bz<$aYO>V)dwP%p1o=37W(!+z%j0UqM zsQ}mTottRb@s^n4 zII$wlZ*sg&+fJ)A>e9fbOB1VxUMlp~f^k)2bt7;6oQTsFWKa#`s`ky-5ih52eQBOHUK8oGN zgu`hg9kxh1nju%XmdcO^ps@@o0F7ZN5YRY=dH_meC=}3mhGGDvGn4>mB11y}O<)K> ziNRjfdm5vKQ-S){+F1S;dq#5^HB`+Z;bF;9Zf=lW!ef>4Gf9r_+O&FIUpd7L4%Vh}dq^ciBMkRN?&;)1zJh)Nc z)jh%Fl?GJBnW=)Ae+n~7dY@x6vCwR0?&a5|$NC~oQxHod2sGyZLZ~Y0c9Q9jdhKNh z?cT?b9MFD-&`SpxY6$2cL#}|b8S(&>!;k{dA%+409cHKppd$>00y@f244`8SB>>80 zXb7O=3<3E6J+u=2bCKy(l7G&yyXc>@3>EdyId;th?w0PKJVqA^bmtlRasLE}`Zg2u z+C-3NKQJXOt}cN8xzGlDL-qa*raZdpCPSE&ZZRYWbekb`RX#)Lsyhr}R=UfO2cUZl zDF8iWC=k$J40Z0>MjjCt6*e#>K}b?YxVgm+NQiTD^BWkebaU&9ox#Acp>gqHk#26o zBbD(URY66M+?tf@;=7uWFS;cy<^ylJz@M$wI1xw*wB zL?wj*m)yQ?ap{rq7>m$0EQM{w{4z!>b8CTkPjMrD&qIyVvQW&vhm#BdU-MD<*R8o?TVkvk%T1Yq5E zoee9oUpbD|a#9I+Uwic`5mF3x7L&gW%Xygmh74iy!vhAOuN=^4)@uRqKOW#6BdQEp zP1H!ULn8+*VBa**VTQD2s39O5hA=}`WXJ8*u@_7;u zP9iy~C)p@gX&e%=A`s)I87$QHgs3gf8mhHbBiiSCy2#xk0wpKs7!^2HxWJGhAhkt& zKwFwc>bW)2425&6O5;<{mR%~MDUTE7pygMK+{LTXKw6{zq&1ION~4KUD#eceq}Va_ zaqbqL;L;@5a*h&c#tS9fVSFe7XZ6(SplJy%KB@0&ihaoLsx86$T$j@PsGfNvJvfi1 zeCavr|CGgt`WG^U`eWa_xP~~A{$}4))7XEsisDMVVRzBk_aYrvyfkA;X{?_~X)X`5 zZE1X;SS-l*Rg91G;t@@3Z5QGfpB(O?D6#*|HAD_{p$z&i#oeV}?COtdCXEMuMYm|d(H!t8=$iQ@K?FJZ_AQ!kKhJVLs6Yi$=16P6UB zObUxt;sx?>iGG&K#JDSJjR$TN36&TX+D*9&^MpEg@%&j@T9A#HOUTCW^^KgxjJ~PG z5c&qkDN;M&5(KGlXsR(hCHh}@NU9lnsE*dy>K40Nn)PG_T2EGB9B31Iw4{J>H(;?K zr87flJ&qttw_Y{#`Y&vk>Vxq&(Ha-r&>CDBHOgqg5atp?hESG?D2r=fn#ag;^cYzV zK;ZcdF~$;zKqLIyeCEltLr;4%gr3In9@kYJjYd9$4pOQ44C=lxT>8RM1Qt(cj}ptK z)IRiBTdnbPP1>=$=m&LP~AqannRS z`lCPN!?eexMRnS1=G}os?rO?SWOvb{>JBm2r8NE33kIYI=h2ieJxBd%aS`<&Eb5Po zoF(f&tjJxdJj5garT*$gPSQhDF6IxmJ{AJ?MO44|q@mxPJ;rNQIHTCr(%hTMs4;t_ zG4#FerIkl??^MQz*#p;T)$Uaz%FHv0+|_ggKcCI0Fq@FWv5=}W49{|3{tF~T^NdG-W?rM{Z*Y=5aP$l={c~-spN}7GI zMTc0-XwgxIFg>qEUJAnQ{&;GV4Vao_!}r>Lp2df@ zUt|bv$HiFfw!?7LGdVdvA{Hvy$Pl*L{{utQD_Z6LS?p?Qxt8=rJ4xT~wKJc^f_C0x z2<^OCEM~aKhC?B~VG&V3*v)vLRodfXS4*>wv_$Jj%kQ=BIg16Yd&v-5hbz(AQ!yHi z^Poj;t(6c)D`mxE|5~d!xKSj$V^o-Z$#5*hA4N`Hv6bcmG6h{grf~5nsWiSXEEeR` z0Y6B!Ckap$cMEBgq-0z7BBSD>lu=r3M{23t(RMwp63Z03`Xl;D;~))-|6<%_SuF4) zSTKZ1i<<+qTNt4nnh;fT_ZTD9Y=6sX6$XS_Lj^{SGAOArStzMdS#?r#^-6OInTAP5 zrhTtVsxTekN2tyax&-$j@HpXA6|ntHA^6v_b7#CVX zT{EkPa;`-@FVnN2z`QUr6u_U3Qj`Gzz8fk z-(3cN)+$e%MtE%iqyF!d0kRIgLe>G0hb)zOVLTWl53RCu=u5BwZ@XZDpZluLJF1TD zG|n+)AdF_ea8%tca##f}r5zq?7%F@9?UTQ*#~m0~u%cy^X5~)~bTRqm>u@d@ z_j+{EuWqfFL4R-M$B+BE=j2UT(?2%X*3M%U7ZPE>KvP++xX3oUOyOnc~qeH zu^G4aRt&ux^2^|WCx@4~S2^4?)u&}|$E~eLHV*sf^f_$eip#qO#HKAb*qA==&Gyf? zEI&px2+wg{KKPQy{<&AX`keix{Y?AlsO>4Y4vn7O|Lv;AkA6u{Z>>MTCu{5U_7Bb< z4gSfzQianY#@&Mp4|Z#}?^4go6SiKDDxa{k2R}B|Gd&*J@t-Q1=k1>aT4yTkSO2;` z{lT$Em&2ytf4aSAT#m2bIjhTUvcdyfe6T+xtZaON%N=WS+^WF7>T@oKAD{hGZr_fh zCacWX2YY|)+9sOo#pNBTFv+^M&hwo8*L+9!UllxjL&}a(rqfD!!ozKTP;Yn~nc zhY~Rk&)yxM+N}03bqshsuMXSC+O4*BY2Bux(y-^v9m>65`nP(&c;}|)vI57? zs|xPwA3f$p z9(>Q`?i=rObkz8o!8=bqdGcb*DCKh3?eE{Mi|Ckj=b7i+DM!-yk<)WJex2*j@AK>Y z$obP+hO&lf$!Y5n{MrP{}j)! z7Y|Gd?d10|o1gRi;}(3N`|2hwOpRa2D%PE4v%QaQ-*SkPe;!0Fm|fvzKE~C#;<4<-8ILfrepgD&8y~AIPmDk*9@JccYmyIJk+4vuRSjF z<831dIUhgvzOXs-Or*zpPREb@ z{<1j5&)Z$r?zGHiS@O5Fcmm7bZ(EiLQ3(ta?`JK{@meiO& zYx{)uxpx0-%{%!@$Ej)Pz;a(k@p^EHMQmQLCNrm*IR!ud=}zND{Q5RGqdwEDyf!Vm zaK3SQ`T7nEa=ibTzUgz{J#F)bjLrMhy}M7D7Gcd+cc1-7VfTsK{mll%|9;+Q*1){pJ*2i)h`I zALIYIHQS}P$9-#GpYoNj_V#LE+_!z1fXh`Ee{#07ni+n~+K~Gty3g>- zaS3MS_|Y}}{>Ijg`ldXYnyS3#_Ufbmf|cd!9w=+qy8W0%m*@0P-Q4fbuv=S9;&;yM zUp;ue(T1J7XKxvF;H*jHye?sj6ALZ4p1j_^S!U_vp93=!xxdzqZBpUhn3+ctAAg#C z-quLGKFe|X%1SO1PKA8BJ@iWW+trHkUTtiaMXV2-cxR`}s#Xz4x7E1bEa7hD2NUNMqS&qr@{Pu zOug(T&8Ee4n0WfDdo!2t^JcyFUA$0uq|M7Zp*4R#8g-MW7jJiiH{G4`XN|J1?cyga zx_P8o_o!YCD*jb)?ZfqxVGG7(B`oxEiQK-``ED1@bD!jGa~C;WZ>tx4t?LM6QO>w8znAUyg~zwcL`d5^Y3=E;?E^z! zxms^&8rtH;r}o_)ct40A&rkMV+k3&IOV$219C59j-Fbd~`tsVU+W>#d%rEu zKa<+Uow<|w$CpLx3Vx}!@95$NR@a&zTX4WE>8C+=q7%G7aQ#o^Wc6(sy~&f;Q~b#L zXSs`(ovgEI@LS$)L?r)F=aXJ{C$4|Atn#@%T?4ib?C`!@<#w{W{%&(8-nhOlU_xbu zPnG5Ix5oXxTaEa3GE!a2f4;K zu0MLeOJc#b=03r8{(oG&wbr0T?|o_Ur}+IR`nhIxhC9yxxA&WLUixsk&G?fO|4Nuw zcg)bVrP>zLN_vUjcwQ}w_TIxwF4r) z9P5el%40seTV5{XKcn5@>dp09=_@WQcKavZ#_oRVoFiU?{FX19^u}@2nP%k;KQ-C7 z4HPRPAemdn#s8jWkUXS0)&@hk6_HybSMd9m7r zL4SlM8k~ID?CCvpWmKhEoPJ4Q!JrMtcPyE`%yfWb zN`;!T5d)?+a2oADc3|hg{9TuAnpJQ-(zC|=i#)!a>u<-cdw;g+xBSoPxj(;`zVj2= zSGxg+6eIe+jvSZMvroG%=6}*Pcjo!ezud(QHQzVL z=jS}X@^hZQ`8mJ8bLQv;r=C}{x-+f!{pLfKZ{d1IxXwQH_GQy@fhi95A>l6jT3#|M zf8Rc2ljb@1o5AEd&G)zL;Kk*aq))jU51-5$Q1`_`-Rzqy=e#$+*5}Evz@L{#{T*VO zV{K#9Su_6Chg-Zaf66>)yzIH-@k?tnxgRo9>lEk=dQki4dJCEjsMui-kC*3%NsX)D ze5l)?@uF&Gj1-+|<;_Y))(Meg5|&lWuOP(Zt=oP$#AD#*=@$FP%GDaqz*F zm48M(3$t$AaC?{EL%+Vt_Ft2IYgzt@Q-#*!jBMWTTy-pQREi0YfA7ZrzwByvddm8g z77yn2uKUDj=AEhQW1?247IgD9ut;9d={~t!7`wr#a7Th~i#n~U5ADkBD|;hD0alYomqP0FKXt)ozEP(_uOMgupuf6whY5oPN9 zvs>h(OQRBRUo&o-H1ERW!9zQ3-lkdqjh|6&%G!HL0+-A4)!uRsj;%|}uJ2TD)P>02 z#$KA|+%Fc>cW&@Vdj0xXGpBdX9kyOkWL#f%acedAO7j;js~OrW#Q)6m`{}_IU;ZdP zuU{JZ>P%=cE8?0muARrSoC)C-8}{jStob^-mDjq+J62dxw!w~=xzl=nGIw4vXIV$3 zbEaF9IgjM~7hD*<_gH~_rlogxGkNo;l}FV%)pS<*M+L2eE-Lm?JS}hxY+--a1-QRT)*MB?z*AxBEr*poN>Wl3Aqq;S59DRb9vz${+dRA+fc;Q26 z+98KXhpjyS=ntM);gS8Fw>*FGdM*8s1y;}oyyi4H5C2Kt=-W3i3vg|Iz~tCZt%uFc;5rFuxuYEL4P zcdp8>;k7Pb|I%$Mr!k%b&RZ347_?mfQ$ru_Kn zzO7?3&g$=fdn)_y^(UXbjEp*5`(x_Thi?Ohw|d*q_*?>)AMEJUrj2e)E-zoaKf&+o zrF@uh_@ZgH=6%h4s+kX`*ls-Z*Om{P&XmcKCocWxt*7k3_`HUd4sm-g&8X+?*JJt$ zqiUNz*FC!V&G+W(_3ht$Nf_$8ctDlms}@zcu)k8yKeaC3?q2P4+=p8ZQ)F*<*g7Sd zRi5R$M&YsKz3Kca*6jygFfG&WRAl5zIm^{&AjkL4X_jjvVpaiD+H^w%3s-A>GS*t_*87yEIBTSgxnuB$1J`)mJr zy|>}cE7xiI|GGzo(-oHvYB47LQ|q%$CTDhfA9L|?^jxt$Xf@jVMB{GuvkiKNe+{0| zPs!_nIlkLY4R@;kp4b08{rNesKlwQ?$DU2kzt1f*vXHkYr<(_KdD1TNPLq&~TeZFV zx>Y>l{j#jM#9?BqHWlWLwF}zA`$aX!#2AIHloh`1>$2crG~Pf z9&airo4VfW;U}?u@RPZu=#4MelGhWwJw4H7nd@o0d-335y9}3Q4!FA6dd4ib(9p{c zHmjnO5JI+n6wEMu(kn--ACmE!AtvThmy8BTVPvemm z4tMT-YI{g_%Ny@s z@P1m_u%F|f=au)5kI-);bYJj{`$vE4!ij$d?%%L9!Kd;`zhA7me|UQsvF+1IdEki- z+%LR8)O$|SA2rHZB!B2Wxz5aCckK6O{t^3R_=ft~Eo-$Z+iR`f&F6>5J)8fw`|l?7{TQi~0pzd~duFG`1MEr`9p}1erFa|H5+D)aJ=tu{{G*IX_Ky*Jsz;aFCdzy=kfasUtN5bzJRCar$K#N zk8sYl(;1P{XzI|BRwdPI+|RtfJAHYrrEb55Jgm0A-MOt5Zw#I|_SBQ=ozJh^abt9} z&dA9TWhd#cZPwU4ztzr|Uvxe^xXAs*(>=I>(F)T8c5B|=d-CDo^M$9@J)hU8N|(sO zQxjv7wl(cso#)^2n<~FGGIZ&nX=kn9=6*D~xIn%}HujdvY{yum7@|*feow|pf8k==!Y;={s`X%IM zSAY4|G3!#i!iM{Q<3?G-^nLZ`t@W-|&}3q#-t}v)s<3g^vG$tv0Pn}A_4xDlf%oa| zJiqdKH@4lo5go^Fj=AnTf7{@IYm2!2R#xvTU$E|U?A^7<`)3^vM0VL-u<5LO`1Raz zEhEddnr~Xt`EJ{-L37@CZ0Gm+`P|V5Zy22$l9Bzfdgv*Wddqk`_EX}nY%5>>cwAve z7vtTwO*q~4xZ7_#{92*4Cf$zdPgV-8I$!v_`OB@;mJcWQJvi6*z>|+zN2*zuZPKP+ znMPx)U0r$4`T^&2_q^)-#pz~2Q{CyG!Zyr3eXaSy4%;@aJjUCR9cMP~96fYM!1c3& z|ErqQ%y~P~VQbfNJ!^h_shPiczoy=kEw;%?e-GO2w0E1q&{+u&y*6DMQa$n{k9S5| z(~2$4Tz8!aP5Ur0aY*v_rlXPP6O#r{8{J&@Jj<~~B!S{#It47tDQKxnCsp3)cJwVyTgLM%)T})@A9RgA8Vh!Iey3ZOI)sJ$j6QQ z_uc&3%IdWuwDs#Ld_JMts-6aBkz=cV>zvp3e7yVH&-=F~nAh6O`vp5A8h`qbJEP$~ zS<-_^uUh@nYqaOAE#ay6KfelF?Avku>y1;kx0co18a5#zqUXo~gWS1)`TWKA`Yo@r zPV(iu3v+qA<&E#on_gvG^n;e?{k{%6YoqwP6&T+^9t`@Kz?)Y9h+zu$XH{6W(UdyD%g?_K)UZ$|)^_ij>dhgE@IKAb7 zNABe=7-2f$?Y-JhIsddSr(?% z#ykGHyvb*dwN6!^&3V`NdUf-<e@h(XrMMc==YM+n+Y` zc$fY%DB{k{tUg?Su7}B_TH7bpb{)abqhp3`d>6id@bEr=#ZI0dyKr84+paGwuClnb zuR)pXLoPY;`~2vdekChsoJaAZ%w`LmGljjdEhaVN*?&GKa^tlg@k01H{rn;wWFMa8^ z?OI56msvW#r!AhnOuzMfSbHwd<7Ur4uI}}j6|I;NZ`R!W6~E4p`d$9IFr(L&-t+(2 zcO?0FnD5t`-E)V(9rFB8p8GOi$2s@U4{12FR-VtqrK>y&vLD}W{5ofLr@^&w`u>(0BKdv6Vt#-}~!%vp`EQ4iroPVkL#O?M3&wJa; zKN()Qqm1+RRypU|G})q8iQk`4D=}b76L(K;$N4!AmORkgAg|f?%=6#E%#PRY)$5ww z+4UE1wLP(I)b2k7&c~0M_c$Bs)0WqS^6=8KITNmLz|gmwEc;y;p}n z3|d&$;^v0*Pd(%OkJ$8mH(+PTr6qp^y-D>l8a-o|ev6^Q!rH8I@oB>49(=ZS&B&=| z|3Ajg15Aoyi^4N33P{dTSYXMpu*;G&NX{7)B!lFfgCJQ+l5-A{ktia93JM~MC`b+x zL=*%hNRn6g)UB$%^gN`$Z-?Q``Ri2OuCDHxot>%t|HjulPFU>~QHN6|D_gKc=OzRD z-mf2BEOm)|Lq_+VS2XFfq5D3Wv7>A0A&I7UFK}_wYbobW`+xm2dH*lxzaGyTJLZQ; zzh$laU+w=_9sgflO#bx}8`4(I^sv`|_4B`STF1}+H2L<7xBsi1YvUsR&NVE-SN}Dx z>7$-DEd9;i%>U)P+W%bPh-DwGdUsahm_ZG`T=4vHVdiVjIJXZJEuUiOf3-KW=h5~3 zJ0EWM^Y$d$N~&MPK0lvK-O48!F(S#RxphA7@Mhm9$JSPVetsC=|C>MN@sSA=bY1&R zmr?(fH~YgA)j9+p#{aMWpRBR+N%GBEv;Nn9ShHuwAH^4BOaA|I^EA(La{a+M%ib^5 zbycHx_I`h)Q1gHPXtCW7~P-UkTC&AcqCYwr|&}Ph^1tQ-Z-B{Q@I1q0Q-&OyZZ$^M85ZStSZ}S+v>D*CTHCg5pv&kc~ z)TiVt%A67_|JiA-9vSid=tgbikrchFGb~t{9#mVIwwD??YKs=}&QC@4X*ZxxL|2@H z=nd>)!7J*PdVl_pxqoWP>!ELl3JY#kx3pcVy-J zt@*v}=(#~(UlJCi8AAQ}sZQE*-acy&z03H&JZa&%pr#DXk~LFy&i1yW$CVBqGxqv% z;+{$C8+-bf@X&Wtgazq~H>uCpPWQ>;ZAbU{b$IsEt@`<8co$WS=jU@qc<8$nsb@{^ zUHr`N$pjA_$27-YIX+oUgy-7{hlf6ipX%7M$-LEmPiA=N%L3`B{vqx!i~OD}@X&Wv zPz{TpXsq6p{d`tdc*?3<+7?$kv%~L+P>+NK>ANav&fgi(AjH_Sy@ZF3h_GN$9#@g> zqb_>0^ghi24^>;)0uy$P`zX6_pXP+e?Dt`jMV@*+dVkSp5QYWm`!VQfyi)vVxIZhm zXlG&j-m`M~vhoPen0;&WdObQTFFY^K$|u^Pth~OgNa3L@uSaL)e~GLDq8-Z0@5`bu z4RUJ&WqCb1i@sSZEVxJ2kXG~3)7BUF*RUWwG&gSu3$7c9FMd8`3+M)S; z|M+fIFzT6i%`66wnPcrI{8g!_Z(OPzsy=31H7*Y>?e~;`$DHHNRm+vf?@^}^&%Ve~ z@jwr+M~}Uf_Nd{~St|18c=eAPyFPa4n!@eVR+ER$F6HZU8R6M8dR@VG)>hQdHU(|r7t-7W8Jmq4{pWZCp4q6Dlcz@MGJ1_Ro z-}UHo0UclEI#yI)HuZcB>%cQe-BJx(6ke@P9nPc2PG=K2SL^u3UJsrZ*SS7Crq7RR z)@$L-(qnG`PkePt{rU3nv4wt5LwK-Kse7;VX#RuW(+Hld>XzDh?{vOPeh>9FEcjwi z6L{zfhpIAX=Xwd+F$ovk^0%XQkMhu}NS>nw;}7(E zTEaue4fUt+w57fLo>uU@c%Qb0hgL-#7aM=v>TjnFJhVq>8<+IXTEB;mtgv7w)fqZg zi|1a{&F^Uk4~>hqUaQCM^?TZ@N5X=M)h&&y(VCbLo(}M&P`9+j9p5EH4XMIm!Ekj; z+nAR5@A$Jisz<_ttKm>zEnH;t4xQ?K{?!Q{I@8gRv?~AVROjWnEUw^!}KEyh&%BuPtrfzAAET2c&pU>*99tjIZz@a`1WWb00 z{hl81&^edrU9ap{hvW0@^n3|VFL+)&uHNvxxX*oFBC9VvFFpqQy+nUhIaGaKJa$@v z|I4EeOXW$cZmDvi*C<-y!-CQ3mbNlgvZxct^L57R^dJ2hqUbQ3n}|-+XzwzAJ44}l z@wkS;qhR!6=iIFi{q4L95AA*0o{gBi!S5Na9#Qj9?bLMYUWWRMMtVK^{51j|S`X-0 zrt9b7p7WRXyeB*jV$Y4`_o${-){EO2B|LO}=x=AV@btR;OK-nt3_Ns3pgzAg_xvrd zN1rdo!b4xe{+hb?)xaP3`NuvE9&>KmwQ}svv7WK(cGOa$#`R3yCR9H~9;ZI)Z|8k@ z%-HFAb-bq?UBeHAhwAM2Oc0)ImEPRo_e_N6h8kB=b?@og{O@=@y3do~sibacOHjH@ zW^bRhXR>-EEJ#N*9ji~GW~cIdrodyy)$PLDD)RZ`;=`BlsO3*((OH$&=YeaEMEcvA z22UP!O9|cX*D2!nOoyio-Kw9;H|PWCp6|~Lc-p92%KG)s=^@5G6COIp5uM_}0(BTY z-_9&}aFnTgPcNlVOUUz{+3>`uTY6-ERGCtK&m4H@%7p4%b5u&T7(d_6TzJgbt9^F4 zzTYzs9;)H1>Zf|=QJ4Il`S8%y6lL|A`F@1ovj85G^>(dP>g4%+e-^@{3Wwt>MZSqU z{GLTG;aLn%dAe0U$(Q_G(BIAy;W<^Ueu#Ov^d&sYUc$2+9y9jPbzboj?W}x>c2Lt3+>tTLXTd@K8A-@ds?5* ze-T?<-UZb??`t5N;i10JOdmHZ{LPPj>+=?P6byPvc%cklkIvc(PhE9O?KDfja=Uk2 z+OrLwhU|%ZbYO@zL1Aj_YVpGM_OTLQ_}fv3obn`NPn&(eT=9E8fhV52r4i>%GUl$| zvlE_@>X!Q4;;Y|(^m{&qhmKL&CT9BdFTZD(dL%4ZS_M%Z>xZrT#p}`MxX<9B$EiQ` zI`%G4oppV7!*fmnXX=@Ee|-*5xVoiw?j9`BY`3Q!owWxZZ(Mp*8Xmf~p*eJEOxj%j8h!&$xVojWk32rA*w?-q9)QPNL%-)BJl-1mJ>Los)zI%b zBs^3@zvnyQp&I%P#Ox6XdgPw;r_?DzaEJXB}DN1Yy2e@r`6XTRsT@KBxo z9(8zo+Mzo8Jtu^R>g@NNgvX5i{Y2H5dOdnyoPx)!KcDs;aMQalv`3vnRDbBYhPI|3 zoz3U>oKcU21@EZkB&E8yWM)HEu;z=iu3`F0|;JQn1ThHF=+J z=e%f#p39u`w4>Lk3&KOsoBW=O!V|ikUxkNW>-M&z`+Nx=Q^U}&Ib4S4V|7dC+*^~* z7xj-zon}-GGpbwKicWgA@v>)JI_s)>BrLcBjzD1e_#%zG?P$+$@VvM`*WjtB4ldds zwWgNM>1{{X@OOC3{-WQJUGwxud#(!){f@)$`9pZ9&VJ9I!gKk?7oEKxJ+2$@gww71 zX;tk)e{Y|)M@?T)Bs=T=(Hgs&0uM{qBmdyzOYugO~9915aNyf9M)$TliXaFuDHdb{@hrggu?I zj>zQqJc1{^@~A^TkZkd=27b?Dc<2aHQ(?V6D|lard;$;c3p&1v&-tL4zn!P> z)K$0C(@xRl=K4MV!V_QJ()MeGhEaacGxbPVaGPo*i@H}e#T|9vssV`WC=%RjGBoF( zdG>|gU-V`m=b_)-cs;s?vEZ4f23}Mp9H|zwz@HT++M#td7FKKTbzN-X$v$R!ZolUh z;Tavf-A8`UtHSeqmhN*Lcxax|)+pg=HNl^s8*$;Os2-RF+}}<@c+}*BXXcfzYLR$; zT#4YJnMQLp$2T1+`#t#WbI^F+ZF{`9-;)IGe4?7CxtOM90d;t|EIohd-2!g@&^a!N zXTR%xkqn;CxSfhq-?->+C%LbkWWIJ%z@sJ~W^w)4Yt==Z>yOS#2@lOi8vFLaJwxo% zRKj!f#NHGBc2dLhP&H4-@^>31%=UWp*wesc);c;br}p$&d(sLIy@$c;(S1$_Pdk-E zTdZrh8+)^~hgPSspz(bBth?xs_GEzP72QnW=k7PY@VE0iJk^v(-3jDf^GS8TCnG%c z+=4u_C!Y#2$1=S{JK-hDh$c<7ZhbtiCl>DM3oJz3$Y!Jcv5 zkL2=uBH&4@JhV+&e`uxOlMS9S+7jqk^kiqhCp$dl)UA5*8u;$R73$*D%|pH4bHHQf z2Av19`{qVYc+^Q923X&z2#6Pd<2Ba@N$I3DxC*>yI9LBs|$wj=B?=wIuP? ze4erEKIezWWZmf1X{)y#?I{2c9mljSJlpS(-xDP~bJL{T==Vg6ta&4wedqTSgy+TA zKQZuhR=2cYt3KE=&D)M1dm(td`#r`t_QLQaRc)v{fnINhDZ8to9(xgZma4~TpKTqm zP+h(~@1b{~g$1{>r)&Ne@B2N);Gy|LS)t#@So|eCCE%g!Big!uHRFOmt0X*U)Gh6^ z4JSHk)ddH_F0e_64oI zWqkXBj$-$_>}@L!mh@)neOg|$L%-iC=WC||JZ5b<*QjrZ{YCF<2n$YEx3o39URRyU zo*x%I8`8h8Bv0seD#1fXB5nP$B);u$r!qWu)Z=uFeQ;-zx^5xBTc0ZMnEKH5VP)UA zs>0J#k+e^1jcmKf+m4>A)!^yMo<6-(mh<*U*RZZ2s`b%wvem`wJc$TSK z8rPyJb<{ad{YUJJ`tX>2LBIQ}=Nnf8c+9zJXN}~!{o`r~&x?=KM)0&!J)o`E=grkp z^!z+*3{P_PxVjUVIRB^0eoqs4)P*DFM)G#!LY%vs!gG|{`TN|~*8XS+_IBWFGP%89%z$xmBPX?&3uJ$N&m#+Er zX4;{%rc`Kck_zozskHGay?n|CLQ!8W)TVcjZk~49_i8twhiN!K{b_^m(K8Y$%G1vL zKL8K?kLDt6Zw1XL_KGZe>=Y}_tmm@N^Tem5Hw6!vmW%t8H+_ox%N9e8@_FX?l#f}d zWV4R4(#I-)veMX&A^{)tE37AvSq7BSF?d!HK`MaQsr8={+#47KLb}oi&XEl2& zSn7LLdRXOeR?1r?6E9{x>@BXRz9^#627dyZH@FIJjar3hc<|6`RYtUR>JRaS0W zrBpmUQJ-3+3o8$-vXYg;R=LN@HmmfcCo^grW|c#%G`C7BdLck0NPO=4xRRo1am%PK#zveqhhS<(AFMaZnw2~Dh- zhY>!dj8CcRQyTh|7Cxn$Px-*7tnn#_e9G^v^tL07n@Er1U#rw(C0o#pYbq-dRyoW{ zVXMTZr~YayW!s^zs-&%~Ri?4B*edi*Y3P*F3A7ann*PjUWuc|^v7)moh0MCmp466VNWaEY+cm4qX60S0 z9Au@PRsLY5h*jdG((SahN>)~C1WlhSvr^3}!&#|ssgiW96fvdSG+8e1h{I_gy*aM~&bSlMoswygBC$_Q3gT4fn4dY|?TS^53! z8Dyz59!l?vSLjy_*v#xL!b&eo)njG3ReE`-j==#T)2Fg$x21kyrG-_lvl2gO(i3LT zy?MdJV%$};2>cUEYt4w62idD9=vdSuFSkZH1a>%S$nF83J zSSp;AfmSKT3bmtWOLLzxj+NEcv(n?~7@Qe0eII*1w$yc2>e(7*4A(s@W0f+jJhs#T zR;pUhGFB>EIf^Bt&%80w>;b`wOPq-)2FdA!+MUgqSLp9Oi!9kw;XM$ zHmtm9m2IrNWtH2kT(U}3cHPe3R_V=33ERURtdz3K6INP@ROW~G8vwy{#tDk*Yls+Lt+vr@+@OIRsrm7A>0vLnr(TeqX@d@y94d$8wi zOMT8tN!xOYJi49IR_V-2BddJD${SXR%B!hLR$0o*Et_?hmDyIQoKI7_&p(Ci^IZ1K zwA5`u9S=!WiPSAmw$waU##$wiUwdA&$`)3l?I=#OQot(l3ur3JDmhunZYPPT`?vy#Vp5=I5E&9|Q1tmvv<4OySc?3rY#-X2P?Ewg;e z=RW1SPe~lD`$OrvooJuZ$SMK$bnqzye99!Nn3gyDlv_R}b;0NRQ{1Pt^eKl~>1;=F zmzD8WDaosIgjFW8lHDqK3+eQDR{5Tl_*SV?SbMTsWe6*At#XZ(4pu2sL{r_ZGKQ5p zR{5TlAy!FTR8wiKGMbeJR@u+WCss*NOjA3o(wLQLR+-O=o^|nJhkBLfB6|{Bs&aAN zaw4mI#7ai1WGtaQnXPh_mAqD2P*Quowo0;6T4`mKcC4fhn)wsAwDu&j${JP@Tct)B z?MZ2szgS6Sm8oU5Cy7;J%4sE;RgSZg!YYHyYtK2`!^{=5a@8tZSea{;_-|;BuJh|5 z>)eJt2`sgOm84cV#!51)jIF3!PGXfEtmL;!>`L16gH_&OrL|RBvvS5NGgyfeG?o8~ zl?+z7%}PA0G_0(%;#y@lE19hlQAK;^*{sT}==$UfS)Weq$zrL(RdqWFt?~gYxvX-O zm2j&psHUlgRyo2-CaZ*1*Pba>sm02NR{5BfD@swzwc4Jsk~3(O1~u?NV50S`XC;GG z3f9z~F;*GHN^+}Itff8atnw`@Ijl0Ew)W(<%J;0~v&!^3+Ec(Pw^%7?mAZAcrV2yWU}dva*0b`NRc^8Jxm8Nm*X?{`mA$MSu}b0w+H=+_by+!Y zl~)^T&+k@g!pc3Xe8@^5X!h5atb|$R7Ar}uvZPS}TXL(^Ypj(tR*Bt2D>RaVoR#MoJe()xm3FNWLMOGrMvg$4EiLy#q zGp)o}r7bJPtum37YF0VQ%6nGH(p8}cm(x;VHa#|%zYps;9N_AF7T4f$9 z6RdKFl|5D|-A1=_z$#y|a?~nG+iK56t9;GMb*rRlr#-I(O`j{V5^0q|tfaD3iT0XG zZkgXQYn2VG9JEUGJKFP;RYtJ#t5phj)Sf@AGLDs3gJu-lSt(;Z z`8#Q9lvUnkhph5BE61#ou&eg`X_XeN zd}WojtbAvc{M|Hl+$zIZ*=Ln+SvhQ#THQ7Ei&Yk|vfnDdv+})Fy7ti239Ed@%1Nul z@2Nd>&W(k;8GTBWPbu$H8VjXG+csTV*^h{%mRof3N~Cmc*R@TLf!=hbbnUJ`2vf=I z>D{i6*Q4GY(WM>NM|=9W>HVA%QKJ@LbF07J4AQ%CyhG?Q5Uubk;mQS~2eRw+pT4Oc%m)DI{VZ$H?0d9bN zDdmpw*s)v1&W)PJW5>S6DA6Xpwoxoq%P5vwYZdAtZP`>WG190as*4HKf>BDTtniF> ziYaSZk#qZBcHE^5*Zq<){v=><*2>KYF!rXI%U0C5lLziOk4 zZ>^XfRyT_6;YUV6!&%h-{xXVzoKo2Iu!u>wJzQw0!cpp8MfLbKtC*2mrJ!l&UE{HP znY_BsW*5?>0F**h`0vzD4U=A&j!)XGf^pHwsG9La8;@0@j8b3u&~iaa-K2i*8YL!L z-J{JaSQARCR(B~ClzHjfDbZ%{Of??6zp@#{R&0S$Vt7IYsNXzxb&s}2>PIS#jbhtb z=~D*zl;uW=qDg;FjbgV|Or5P_x)Y#FNu=AE5Z_c4Yl3<>kj|&j5w81e>ioJ-$z&9B zzy-1z#U7PejAHwfz$o@;N@x|+&>Yj}LR6r8>W7{Zqd#`Fu}ZWVSQX>3^Kg|>u+sKa z|9fH;nk}?h#e@e2Dpil&%!JiGS_RdhRkpJ6*tNweMbv?@Sv^jf7-@779=%nHQJ-m} zOIz(JszyqGZx_q8Ov{AYtP)jNVf6QZ&y=cbh?A50pH=MoLr)>#DM)jypZcMrS1KEg z62(!0CPu*#*ID%?#`Fi*0P10<*cm?EP*JpMQ5#fiokcBEvR2fcKzCK-gzDcb0lLCh z*JJ1*Jz^>Jr+^yiaHZ;z(zK(`wbF``13S1K{W^(iC#oP7SZ%}AkESS{F4wc0QDAP+ zb(U7tLxEVmbboRNxj)6Y8AsWpV21LeSbB&NA)T{?HR(v|N-be?}1{4OP@+S;Za~Zy1l6K7mR`iJ>F+w)(kc zTDDgyR%t;ej- zPBF_3JqgtN!c=3vQDTfT$tcl9)Q+dm3#2E3nleSS3eJps)#KxhC#tBL0(AUoMcoP1 zQ8Ox$`gdZ0XH=BA%(av~4@M}To*Q&H(REFBtC&j=tC)oZfBg)~D)9{!Lp$S&`iX0l zLS{x;h3l@4MdPu@aviIf`V27&_GwVnC#_MU3aUb1u!@oc^of^rbZ4+*kKsebQg*gX zGwo0_f$Qogu~7`CBMXc<`)5 z{l_Vo8%dQXukoO&Xdx&{Sxq zell6bP+Ex`;J#<1xoTa13XL)c4plqer5XO3iT;(9GTFq!%_R-0^mGC!j^uLNs!6UNhyrTbZow5QAu6^UEZcM==vRYY+ zplpYmW?NyiW-65i>u&?0$7vo`wprDgf=6U^5m}8| z_j~B50ZhRovbuswqH@&o6j=S$o=y5MQYm>kQ}BqaZX#=4vhb6RI?WV3BC9*7c$~E> zJXbMCCGAIv>dJvUg6aV(j(SYp3B0!Hul0_q#uPk)>In)*q@q6DKWv7h#xn(vpn8Ea zE5L^vJ1x9nEB_@^@Q7;A3g}hLapfFTY{4GWS=VRvSDbi(ch)Su}ec zRh21tL{>jbQLA)RF0)xZn1V-S(OJZ0(Q4zUnM}bWvIdB8Q4Md}tX)jOBeDjHEUKZS z&NBs%$QmTFek`^>@qL>WYXFTk5P(Ny4HjA3qLOZMR92?o5m`e(rO=HACM2%(TOpfO zfhl-I)=-gEr1Hu^j+)C9JR)nD7+2K0xb%QB*MAitAm3s4`c#f(?FN3KK9+CAPs5I&^Ix-i3T);zZU<_e6g(npyvTa^$>ftRtJzT9LwH2i z`=HF6r@8Ua&W+ERf=6V1AhJ@=F4M_T8HVXBctq9&P^N~9=k4=Q1DS$HWK9%V|J)xi z%VnKl3LcR)36z~1z25oBQAOU>J%mSOO%_>Q|K7I9Q8Sr>M`TSAQC(dkBxnn)-rqZD9%?ku^$Y#x83LcTQL}VSzzH+Ri9x(-v$XW`@JLm7% zthdML9>62AmWiwzGyC3j)Ly3G5n0Pc7F{3Kv{{+yrA@WLBeGVAEV@2)R1K!!5m_rO zMXl2H;ToIOk12RW)+$TU{-WzcM=fFs9+CBt7#FP@wQbfnOu-|vR*Nh;mK~L69Q9f~ zdm)d=S|hTkhP7DrGIUSsj^zM`V3sDKn!SHJvGVMAlAAnXGy?>vN{y5m}#Fin8c+Hb-4&3LcTQ z%Tgw5oy|%)kuT^qslM^kI32$imvo%>vwHc8S^IohjylT}JR)nqrKmS_<$s@A9wUn9jjw-+uJR<85C^HXx{+?syUpA{LQ}Bqa??hIf zcJ+5TYARFkh^)h)lIQ^h-bnw}h$40#e#;a*BI|pRb^F3Q*Bn)9s%{J(k@bTZ7oE)) z+Hq}U3LcSlL}bzN<*3U{!6UMM1VvYsbWVx;S+l146TGQ!X{OPw`p!1;h^(U`tJF8I zedDM$Ou-|vegfq^>p5yYQ}77tXHe->KVqw&_r5$o#8Ho!f=5utK$*Gmb>b6^9945V zjVcg;M^MM@xae^@Qr@+dpUV_Hq8h(gie@i8*K^cQOu-X~RNqFI z9;R_+$a3!sN9AV<9+7nhRJbB&MiuNAIMdc<)nf`Ck#$yNeY2z4Z;tB66g(p994J}= z)tx}i{?T(BHHRs91a%%1%_iCo>>KfuqxLWbkEr|wP&6jm9#r0NP*dK@!y~dTf}&TJ zh};;~x1#>^MQY;;XTc+?@hd1(`2qFf<#SZhnZ&A3IVX?Ex&+F5d^xHlQ}77tGN?GJ zMRg}|zW0f;j_Sk|Jc7Cc%A9-ZG6g;9De}giWe_X9VVMl$!6g(p9E+}s`9Q8L- z@CfQ2C~q|!6-93eQ5!shx(~|CsJUg=v~yHnrr;6O13NBimCkxo?L6GV6g;9D|5%FV z{oRY}$~x*QQ}BqahnAwO;Td1KnayUUp*MG^4IYv8$WoL=uZlRTKU46CtjC~CHR$+S zV6%=f1&_#jBC-O*GAwu0zf8d+vYvu6$JdHf7b|qNS=r}fSOIuM*1sZa!j=_X9aWhr zctqASP~NkiqdG7JkDzF(yYJZD7P)$hquyr<9zoIj)#UH!8`*KKX9^xMu2`VVk+QAb z!~Tx?fhl-IR+ulVvCX>06g(m;wlB+3$rtF#!z0e-uYgj8wA*Q9dC%tX2ou9B-rM7-RZPJn zvf_&@I=+_Mto=;EBeLjkUEFWmXRii_>lW>{St%Ckod}P}N+h!8 zcE7OAQB9eGM`R@i_N`1VJM?b}|Kz$jV|V8UfWXlda)hrr;4- zSuJI1=%~nL)KVY-kI0GuMf1?q&`}+jf=6U!6IoP4M=fOv9+8zDl(&YCI?EJ1A}fc; zq8d6X&2kJY0FTJZ3CgTd^n2K>wubeYf=6WK5?M=si5}*tcbS4mWaYLL_2%G}+Z(gk ztTjx*BeL>XiYmXZ=+B=z>LOF{h^)MzGAM$m59*KV;HcCql%zIzL{>hLb@%-A6^^RS z6g(m;5|r6rWsi;wbJSR-;1OB*MOH-eVmlqRhbeeO7X7`D`yR|~y{nf_U~Bk*DR@Ly zl*lUgsOmIFWm~DM0guRv21U=mg6e0@<$9?T+N^p^!6UK?imaja507@#1g78-Sur+? z_E+W>3${9HKU46CtU@9y)#&Wo92Hol#|4kbDh$f(uMc<5E$OHdOu-|viioU_m&VKO zsD4brBeIHGih4uO+UD5v^2bcUBeIHFimEaG>iAfWI>{6~BC9wkn)B*Tph~u?%d6U~ zz(-0_8$2Sbgvg3a_rVTFm1YVakyR3u_v*`0gPDRyP^Cb{QT?D9)&1koPCIHBQ}76? zw54bS8T$OT+EKyPqy+--2&#-77d=juuVSlFjwyIVHOg9wDo?*dbW|^<;1OBnEM>A* z*{r2Z!6UNDTZ*#i9Se>+!W29rtAeE{tJRi4x1QLnr%b^kvfi*1WznnOj>@`*S_%Z< z5m^;M(UGF=1Y+k;xMZNss=^dJBCC?f3go`q#!(%af=6Uk2K9={p}9e?5<6-z3Lf#g&6}X;FW_kVd~MyTn)1Hd z1CPjh3zT`4xNCy7-<7dfDaAJEw%`#pYzE5gug5WYr#h-NQ}Bqa=AgVabkzGy!6T@* zL75tUHKN^9M{Q#Y9znGLMJoVp$?xS&?5L|u!6Rze5>#vr1(q%-(MeO@8p0#8T7jY! zfVTN@Clq^Z*TbY6wF-}@VQWyPhO{0!svcADh^#iC%rmJXhyG6OsHsfBBeL3xtg6GZ z{p_fpnSw`TwG&yz>%3OhQK>fRals?9+Ka3lF#~!#stHr@h^!8vsD`xuu9)7dtE1*J z1&_#jM`Vr8cR0DD&M*a!$m%GvO0E6$ilZ`qtj7h9$m%4r9>r_i+EFc;f=A4#&Y;XW zWmoLY1vTZJQSgW!cCkIA-mDr?`$koJR4(N#ctj7oiXPHcildG(1&_$;2Fk1eIVOFw zRe#?fCCAxJw}AjWBCET|Dw4d`ZbwyS3LcTw1C)0KaMT#4;1N_$P-X>4U4Q#vM;%}a z9zpd2WmbS^H+B?pRFW-vT<{30Hz-q$Sm%I=$S4M)vj3LZiA1C?40fYzyuD}MgiQ9GG}M^ODinQE-a_N%9dmzaV_%-#Wl z`k-yh6`kdsz3_;vfuN`ww9#{ij{}Ge9$(cs3m(zKp`wRdC#)FbsGdy0BeI5p^6q6v z&0-23LA?tqrRp73TO75QDR=}m98@wz(Drww&2KyEFQ(uT)Cf>{6`}3~l68G8 z^)tJ_(rlxa)Zc%RM^xiIP-f0wKR7;~qslV{kH{Jc%3BRbb!G}4L5%{HQ1wII2~7VZ z`V~jbVhSEXjRuvNy05lYWdpYzb&x4|1T_Yfxq_wNF14}MxW^Pcq8ejCnQ9!!u=hhp zMQ+zUfJbDF1C>HOOnZ65R~3^wsy$Qih^+A<>)DqbD>`a1Q}Bqa_eECKr2}s|>J(G( zh^!Ap*4gS|g&mb*haML^B5MLDb2d+&v-A^3)nW=Bku_0d9h&kumZQco1&_#@B(fsz z&&uhjFPVZzWK9-XlUrs#?5HP9!6R0iDWKF1wlaO{sSjqQb>6$$z$2&+LD4f&+T!H< z;RZVo3xA^9f=7&N8YnXlOOEW(*HImrf=6Uc7g_W=_9mM(k12RW z)(nwFe;eqi@0o%}WX%*=bbPJ1S%IB;T=0mjSt9G}iN$X_svuMFh^*Nni^jFlX0>Aq z9+5RiWYM@BHJd4TMAlqTH0RYFyxP;mW_`;PJR)nJ$f8$!92NIdT@83d)_hQA6{S~2 z995Aicm%Zol=oE;M~!9*9ziVxMe7r7nXWyJ@2Epe!6T?epu!cQ?gaY8JCj_0%Ty5oKxM-68R9+9;Kl&J>2D&nZSOu-|lr8Z053Dka&v74hh ze})bQ;1Sd^Q1n^~ZI!ns9p|WPOu-|l<)CPtr!0Es%yc_9TI{Bl)Zc%RM^s}4C{qo3 zhUloJOu-|vR)R9spt<3w%S^!|s8yi6bHh=&KG!{jM^GPuGIOJ#dd199eVBqrP^&?i zBc)!w^@}ub35$oUwTk;M?GN*9zpE{ zl~eVO=EtOdi@G?f@>fby8$5#g6qK304Q7^p&r!3Pf=5uhK+$SL)qk?!(6^4d$P_$+ z`V17UhqRr1yY>i2MefroJc8P7dq|Gt$yTOu)Ig@-5taWOl&SobziPyF)KRA35p!b? zDDR9K>LM`V2o z$~!k4^#xP#2ZmqM!6T^sf+}_{ zCZ(e`G6j#Iz6M3>25rmUZG6#D&zOQoP~X@rq6(huS;tW|zacFUfJapR04VR=aMT*6 z;1P47Z< z{&>+*BbkCnP(Oi+s~Zhu4|_JjQCFCPM^HZtihgV6sB(vNWAKP-90O&lF}8p2){a`k z6g(p9xX7aSI=*QupX@uG1&_%3MP$+QFGqD@3LcSl!k6`y&DzftJR<9)$fEb#I4a&@ z-9vap)+t|B1H1OtUZrWm>$cz#S?557tA}YG4vsw5&rw5|f=6VX7g=@Zm)hW{@0o%}WL>c1qO4EHWiIQe z@E??9O0mg~>ctd1BI{S1MXfGMlBUUp~upbs1E+dW^m1z|m^%hg`h^%Wii&~}M6V0;6*LtSl5m~>BEP9Q|QTLgGM`T?GWmYy? zH{P~crH@j+`g~sUh^#+ER-#>r!W=c7DR@NIpP=YEinec;M|CY}=f>|$!6UM6h^+VG zuI=Wi%0KD0;1O9jLD6}c_Sc?OKR0#Ma;D%BS$~PFj1M9kJ1XpFodu7`x&_M2jc&g_ z`NdJKnSw`T-4Ic~9|#xVtt$hr^8?5|4^4ZAri@QcoZ zM`S$^SxMiRw#QL}n1V-S{R7JEuYs}8r*+g_rr;4-4@K6E9=rZ@RJRklhwzB3N1)7{ z-;?gEe7EfJb&V-_MAl=G^>d0Z3OcI%Nu33c$a-Qaa?o$+X4|ZJOu-|vo?43b*VyJ` zgO0k-6g(p9UrU*+nKrA=DbfM~ctqASOHmg6ZH1#YG6j#wqC;4}zgOXb!ySs$oNTia zo~9(Vkw;_&L7D5QPK(mzbksXc!6UL_fihQ>^g5fPzGMm>LDBaUgay6V*pA9{hC8Tx z==tR2*r3!6w&p!HcX8BvOu-|vUICRsF;tEE%aX1hYpZddDR@LRUIk^U(SQBW`Hre_ zR`&oNkrfA&sRmtRJL(gr;1N_@P~K`dD#tmU1&^TOS&AG{LwkC%<}(G4pk4!I&R=wm z?Xu#Z*IDq0YQzU+s_|pzv}GJMmMM5dRsv9TEK}ttO!;J6KD!>qx}dY*5m^aER^qku z`#CBnqA~19c08e@_AmvHppt^}R^CxJ znSw`DBN-@f!Rg*_#B?m=k2YL=Wz0%`|+_v)Vn1V-Sr4U(L`*x1ys7Xx0 zBeGJ0GUK8vqE7bs+RhX_A}f{1YEv|`Vvw$+k*VR|6XLr;eOu-|vvVuyedZ+FL=oM*4sbAw@gGW#ipv*N}g}b-wI%)z_ z@CYg!C_27^>gUAtT}vHxnJIV#l^v9Mg>(L@3d*MRS9;9@z`L@2GK1 z!6T@gc3ia2USBt$f}>6`1&^qFE>NcOu}dud+)*X2q5}bVL{@H4^tvcz&77BOfTQLy z1&^TefHE~4IU;7eqyA+I9zo>=WoGZ;gq?qIREOVm58)BBHy!|QQGzE{K3W1`zK^t8WIqD!&@Q7*@wpr>KkUss)QRkR~M`RTTMXRW~6IeHG*%?QTy{WU{ z5m_Zf){+ASUU5|PUz&nPWR(PE*2C*PZs&B=S*G9-S*1i){9WtPI%?c4odu7`Dh{yN}cw1BOh^#UqEAPak8y$6yDR{(QE(^-+<=s0Q?$wlcFT*2xSPm3bgSK&> zrT!(p-OJy!5?Ich#r@QAE8MArEZAGUN< zj=MSw9+6cMl&SoX{C^#F)MlpO5m}W))~UEndOE7qJ)H%Q$f^v=)UZhIj}FDPH9Wu+ zJR+-#$f8&E9aZwa&Vol|Rkc~_PGE7pJv|+@ktujYRyC1Tt#i`f9To9FXTc+~s)I5$ z%-x}D6-Uis3LcSFLuB1+w7QR@68)pI;1O9hZ5GX7`g^_ZwuU2_f=6W45?SlIlpN}) zqfEggvTB2RMdi@>lKx)LQQ;4D58)A19Z>29Tl$K#-*;3`rr;4&T~IVPXk1+ zj_XUN;1T1h2g+QfG?_T1l%tY8(mjAjWYq`dJ?lBD6;tpCssX4ts!^&2eJ_lowlD>c zpc;ar8qyY7c}XTm#eb|-cm&l56wN5A2E9f!#8#s@Q}BptGzMj=L7zzGsFh5?BeI%+ zGS#4G9FDrl6g+}z3d;M8!%@Ya=yAa#s5e2W8*CTTr~lJY?=uCDpxy!%t{AFD%i1|N zrnS{L#uPlF8qGkNYE+4-ox)M|pP~Z+ctlonP~PVbjyl2=Jc4=~6wO|BC(vf_nt_h0 z^RLc=M^G(5nd@G9?%=57Ou-|lmY`^V(LCHfxp_NBHF&18;1N_SP|5VefeIhopX;dO zOu-|l*0zTP(mNI$)d=~406e1dZ9tjI)4N$5b(tx6#Cf?bDDRbd2JB_;c^Mwj!*-&F zboDjO&W)Zy-5NZihwViV>9da<^*K}Uh^!8v%=v4?=2UqT+pO1O=`46e);l6=%7=B< zIcfk?@QAFAHcQ49c9ph769A(otVA z1&_$;BC@{UexakIqGRhUctloLP^N}-4Uovza0yfJh^%fRi#~VGQLnwCv)~a~-EEe- z6DXZGURp=>VhSFS)k9>R-EsT8qs}k|kI3o?%G7Xc+SB2Vs`RSvAv_|hm&lqN>+3F# z+Qbw*BC9v3a5W}c59#%&jJAg9;^-`RL{=Y>m1V?|7LJMVE! z)en^S?BJ*wOu-|l{+3e13Ji}mxw)g#$J1Hxh;?HCD5?Z)9cK)jrYY~b0guQU2#WR> zZSOzs8b7nG;XKZQN7Qf-D6_KBC!aW~^J}_?@QAFzpy(OBx)Yf3*`Q^PDjr``@QAD- zA}g|EhMkUzpFmUah^(QY%siw|K5^6;rr;4-!$j8c0pBfj)cS-v3m%d6E-3Rn<@?8v zGdXHlB2B>~vWAPS0&}Ksc2w=enu14Ujj&m?r|U$e`zx>AU*SnK1&_#jPhA$ z^Gv}bvPOb3bDmxmanypOItv~_jRHki4%EZ62Nun6)Z5841&^RcgQ8c=Xq){}v0IMH zmRwWt2x<(d2t`oV&C)B^eQm38l__{cHO7K6vzLBr=BPF)bQU}!YaA$VH5_%GDR=}m z9#jFTBp)k@Q7+m0A;E{ z?{sq1O{U-xSrb9!<;su!Iz@)m_IEb}Q|l~vMAjscRVCxD{*H=BqbYbq)?`rL$~)?N zrr;6O6j0{13sBblwnxU4!09#M_Opv>(3;^^0@92Fg*DR@NI5>Vc1 zIO;T0@Ca(D9T&Ar)o|3RXpn*lJv1 z3La676`)Kt!k3KR>ZqwXbQU}!Yb7XC`Lu_QB|T@)U!`+u3LcTQN@UfzpEc4^e=-G+ z$odGBxAKmflS^m8BdFD&(y98zRzEdWNi{zSI6$p;HWK3!6ULh24$`R=yia( zwuZIx>nwOg)@G4KuLC%015@ybtSuso{$e+Q%}Q86XTc+~wu-D9pN*L4sK!jeBeJ%E zGDpfk%l>&cnax_v6g(npyU1F5;n7e>y&0u@2#?6x0m^%%I4XIxrr;6OC!oxc^610e za~$;pQ}76CCn$5I%$b?{n4>-{sI%Y^)Tf|m_L^q_`E507#%Ky2QH@=o%#lLR0vxrJ zDR@NIXP~^*aMXRK;1SerP~K+&j;dKm_YfXIeGba|EWlA~n1V-8dq9PAH4Zd69r=T; zMzFBXf=5(iFDO%uFMsVZ&QVpFf=6V10m@qqM@?Z09zlHxs)Fhv<+V@$&PR?q#S}b( z`U(`)kha4cvdnN)?jm|z@Ca%jD6<04Z;Bn&hbeeOHTHut)u3kqjyl8?JRZbvm>3LcU59VqXNa?~WI;1SeeQ0Dq@)rUtf zIO-5n@CfRAQ1p5fZ4cY$ZsVv##r3%05!4TMTtv}#!^N{#MAeysM^xj8rPQ6k`0s|c za?}o{;1O9rTFPX_wOLt8=pMo&vW{BHWI1XoQ}BqapDbmvGTW?RNu33c$okn*Cd*Mh zn1V-S9kUc=(R%{t*%@_?DR@NIaZ6DaeW!_|;+4`pghyok0?J%RHQ3wdQWl$4kSTaX z)(MeCf1&26IHh$KJR<8PsBqOg>fy@Y3YT}(DW>2NS*JwSkHvDYbkxQ&Itw0=by{RK z&YmN?qehk06g(p9jK~_-u}>*SH7%zpctqA&Q0Dc+&I=+=J1Vlgrr;4-=R{Wf5hI5= zDy)L0;1OBpL75esuA>s#{dIyVctq9(kwxE!=%_+(=qz|d)D~DV*>qDmC5m~>A zEV^=V)CH#C5m}c&c~>?^MOM^3ghx=9L3ytn9Q7_!@CfP(DDRbnqmDBLkD#uCGDphD z+Sl5J+iK*fqWc@C(=BCb3 z+fj?FXbK*Ybsd!XJ?yiD7yCG>PgPC9BeMPwSzQMundzu1)iec<$odnMIa2yP?Q!2x z8LDdv9+7oJWUczO!ViwR#S}au>!!$}qta3PYUnI@MAly-YtH4fJsdT=rl#N#S+_u$ zXNXhB{yEE0U216x9+7ohWL?aE`fo>-t*t3|MAjWpW(A;Yn}&8Crl_MSctqCUB8&dU z$5FMJf=6WC1!d+uy<>bm zi;-%LuCZuKT33&hJc{bowpE{2`jH2q%)Zc?xr(W-D5@NJB=rv{^Sl0sCE^^{*K@?T z<}C6^>fsBr#&Z^VB=zV8)MBQ{BdN!rQtAN()+frPo(P(1e91i|kD{m;5xwAi0*Zd? zLG`-R@UsSvy2%uI6otP_iWorHQ%g}o%))e^IVx^FU3v28{K~8lDckuM?a(@Adg|`I z$rO1c^~_T0PT0p#G(s^yYp?Eiye+9+?#cMfLHIbRSdX zky)`UMOjzhPFKohrLC{)LmrtGW+}?LT)W~bM-^m>Jc{zn=h&b^&*xr>qWMf7NxcG! z&Zo3}Gp%bQmo<*F$Rm6BDyY!=YdKTokyIQ|bOxbuEm~OOPnY#6Q{+*UXJ*C)l~oZ` zuWLX4q22{;X339Ckw<350~Ntpa%NsW*uAHV*VJHm7{^)U*wTgd{Ch) zUsF+3dGbgq!3(JNOp!-Xo@yinm6NN{^4rGhFO*F+MsN?wqbSdDng~=x$Z9NNiafH1 zi9v-P*H!Kzc_ftt6djSYU4CPLXH5t;)HNiJq>{cMD~+P4hU8I{ry9vXMEfufF@&J=lMR!UG2A+t6! zMIJ?Y=3y#ODj-15#`R{-O%D}C)gX_gQiC$b^7X*PMIM`Y=X!XKv&bW# zJl0V?m?DpEX)G($s%$3`?Sv~`-QmsjWtpOAUyw&q`CmZoW{NyI{n-CaFMxK2s|-^$ z{aJg|kq6ukd1QJNsL;oI;x~1l$s?&~P?Te;>$37OMIK2N1ZAED3>_OA6eBh|ZOp!-Y6+o$_Ghp87<&M*IZ|iZ9M^T>H z@&+i=Lv+aYFu$T`Bah6g2#Q`Uq-{o}&sVt~4rhuylBxviZ4CvIbS&}6QHz-(kL+P( zP@#KxhADW&xT=6sH=fN@K79*4E_lT3tqO`(NZK|n-t@WaVQr?!Bga(@lv%ZYJ(m7` zM~z^LJd&yo%3SGHKUMJ?N3COuJd&yb%Dg6AW^<8fM_piwJd&yj%3L2NpL)h~Rr!=D z@<^%{D0L}`?Ogw+>hnfS4b!&NH6)LuYJ)OY%X8PP_f(@6Q{+(;t&rS$9Z+<9QM+vu zU8v%+dNM^GN!1n9!oZsE9F@D3?jd;;(#VQ*iLbVp@^*7~RSK~Wr{qK zdP`6b_KZ&MsEtgKM^eoM_1pYrWgWGTDe@@Fv%i{y3cbHhGDRMl^)@Iq(eXZNT|0CB z`d3lZ9(g3y0+gxz2b+_9<$9R5t*$(IB-K(-u?tmGe^G8KAITJXB-IL(@#T#dN1a;C z|0*y=9z}Vo(Hd0fYBXVrJd$ej0%`$MHx~D8wymLsbLAG$RnwDKt-^(a=(+s z9aWbp@<^(qrTpXS!4!EU)d`dt*QGd93a@b&M(UNUE!#S|)$8%TdpmB9ElHfimM78Yf$MM`diU_cD1T)!kBNFF7iPDe_3F z2dD_HhMZB=m?Dp)dcJ^a%@lbg)eBVUaSddOJd)~dDgU@8F-0Cp^#K*Z`%6}S8B^qu zR9{Q^=iwJjkw;PbSrUGi)(=!xl|}oeRhRCS$)UFsOp!-s^#>KY8n>AukE8}z$|Sg~ zS3BsrK^{pB1QnsWM3k&XdZx%DsX>Cew>XyPYPlFwd}}f z^2n?qpiDL78r732@lqS+kiU zkEAAnicmS~4sSF<+P-IsJd&DhDe`td|4nO`6}z(@7kMN#MNr#gr=RSo3QUnlQXg8% zKcj{+MIJ?YYB&`Xy;4EF=`;38VV8A~De}myX`oCE<=H%S7d-<`#$RnwlmZEBu-cx#+%lelo@+itvjai_YDT2mua8=q8j;hsFkBdAq zYc?oT4f%X|F;nD`)ErQGRgQTD+-2Qliae5<3o1fURE;#(&ewNT$!@xb?x~KN#uRyE)_hQATyovm!W4NVwE$G;b>j!7$RnwRpdxr&^8ED&Q{<7;@`NwsNDe_2a6DTt-d4|2m6nP}| zvCUF>$s?)FmLjh_!{%U$Jd)aCDgU^tGDRLmd1micP%$cpdNZ+muf62Z zTTiCQBeS-FGS!f)%{->aBdP6{G6^p03#P~;sU4sqRF{a7tIcmrkw;RWSju0GRK0ZN z$s?(qpv<`B?2TfIJd*kpROs1TjVba-Y8R*o9+#ZGZI~jDq&~Bhe_W%PB9EdxdwDk~ z^-@0e^0-YkRcFmUSj!Z7WY*`POf}?Q{)s8_NNSIzOoGdLz!Z5TwHH)G$i1Atx87gm zk<=HK@>in@Q{+*Ury5^^D!|p~`_b}Iu7_QiB9F}a3Y4jaT(PGzMIK4*0~LD3-pUkt zB()z@1Xn|@*vFY7kEFh~l)oCmKDvhFQIw||-+;=_)fl;Lz;<%zEj?4@ky!^og|0>s zrpP0ygP=lJqc&6Ik<_=KB0^T915@OY)FDgxt1*r#@+itvjqgC^;A#wL^VD-yxr{0D z$gIPlOf@D{&+YmB`(CEVBdPB}gRG?B>l^yhRSZ6=jM%GV3TPQw@2fG+~N7lKKf$=(*8{De_3_XHXGb4SA$Y zVTwGGI%X;V+}Oqxc@*WT#&J;DR2J3iRP)01$f39InIezO`URA!#*FfRWpdQ-Op!-Y zCqPB0#?>9(Oje+u-e2UA)JaQ`S6(@!W{NzLI%O$;HHt7r9z}VoaT=7VM$G2zkIA98 zI!uvAW}N|Lsu90@MbGQon+V2sy4~{q@`+kEAYH%0I56Op!-X zp1ph-RCAR@?Kaw$<2pI?Hl8W+$gC@%Of}@3Kf@GxBy|;3glb&f;mu^_8KB2S9!dRX zDe}rWKZq&vNa~uU{M9(h6nPZosmAZ1vZx&DO?0OnYsjIuYfOz0kxY?CX8i@qR6|}>e#I1dBz4PDrrs{=8B^qu)NN1^sy{@@=ME(X>B^HwQgsvnH+jcI#}0`JX*`e3Oz2{`3LQochaSe zxBoT61Og?PB9EjV3Tj=l@RN>e%@lbg^+-@ji#;CcsPRmZM^cXk)uML2iH_RD6nP}| zL{PKl_sH$2Uzj3~q@D^YJkb^Pa&5ETItMFbH<1x0;-PgV6*UDe&QGrP&spU-S2)8GEp^E~xbb#?W% zqP4N5zpt;`80a{;HJ&eyV7rc{h|#!VQ_ZTe)L3gaF`P*ySEUl`hZ32I6iPIj<3_Z# zJKoXW-QL&Q*%}{9XUB`_u~e+8rMEhYzujYrO^FSud}3{CI9<#qifq;5xV3S6d|7Kt zYe#Qae|$Wj8%<|YvBjCxhEyiDIGrS!x|&q9dX%Kb6C>+W#dJJkj8EiKBZ*7~DmC$w z8v9!tR~udNlkwkL{CBnWf1@LtE*iyk`BWlltizvFKH~Z1TN@kW?aYK~?~2tYLobtq$)uXj8RPkM zwm53!5UgCbzzf6ABe}7$T-Ml75bFyO`&-OdJq$14b#8>02~Q!6-!rM~+TuDRmCxt$ z)~f#2rWUftSe=_F8o5y;pUAFFDOTqvvQ%Z7%_p)WiHWuAibiVFNQ#+jN*KK;-4P%b zFpGjOqjq##rb1YF<_1U>Ct#wpMp4;GU zR;!1s^kiG}=3uNOiw%8Vh|Yj##Ym#y?3e7EvR6oXWUtWVyA7z)U9;9hZVm!k*f23A5LGd4|Jiz5{g$+O=-1vb*Kg@X}bteKS^LPl}?A0hV6IhD0WgBr*olW8;~W zL77;Hn;Ub90bYK;G3^3UkPFSKV5nS3ReqR2mHgChvBIw=E7F2u|m z?C-0p@E?1}UkPP4Qb_RKMJ4p?47buCAQ?*zh?S4AXePH7J(OcSN5P6a_8u7Hco?}~ z4gjKxai3L;6td8rq&ap|Xj>h7%(rB7_-8EBXgG%|0SN7WlISmriIH^?{vY)8$&HD8 z3j3Yx$V5J$%8p=^+Ed&_!}In0+eDUsZ_Xw$+)v~9fW8gqbBQGF#rS{oskP|>c1=dY zI>1P6GTDi&@9JdER+G1niG61C__#9xu+tPr7c48Vqba7==JJ!gf3aelOpPWcG8nAW zp#b@qOw$oYT)k0KW2|vVMr-(COzMn@GBFH&3R} z%P}9v5;)E>Rq-=Bggwb=D}Jnwud2fl6R;6{XM?h+F))cL8FR+1gBp%yBHNA%Ei=DW zC0T99&R~T-aw82ystX>UtlEx6y(<-Fcp=$}0D_F<^)Z$hH>-mVw^(&$6Jx2k(UHSw zE0qwzxAL>bOi=syY%EnMU^*boCP>ez)|AL4bd-UnxsTpT!mEr99I@w%iA?&;lz~Z- zk?~0*Jx1;g1qhjOq;%AyQQDCi!{}_Xd>SLQ2}igX{!L`lXH2A6uN5B}n@Iae~+YUgIGTD4wGJj8T`Q5D*)UajEVZ3Pfw58$LkGs0d# z@7{C#zbui9H{MZQ^V~H#p zcpe$Z@|f~XK4`Cr8@+6wgkf?4V~$kP7-iKHUu|zhV@lQNSGxfl)Y3r&W=hA>IAV5) z@pb4Jbn6Om20QeL6dX}7?C6*nr^6~vnx4Rs3C+2oU<0!=xsfy?ltfR0f6M?``zvD= zMpG0=Ka$UB(!sxJtuKxsw)0pU?TG>gd!yJ>v2bTc*wDwPxK^}$Hj5cER!n3|-4?Y@ zHR#h7^Vk?IIU}1ZrblU3KObOb5@VdJ`M4-b@s1j z1ER5`i;c$JbX25<(S~yp$~hj|JF8YYJ4=5+tX&~SDo+g zm`~wkQvTcU(Gjb7)$}7$Q?<_Nj_-PwU^r2M*+oh-YeHzC(ddE*a%9LA4wg1Ub#`~^ z-pmR#jvdnlk7^I=$=dk5kRCy)#wzwF3LDxe^#B(}5?P%ngWLEfP8=PY(g+1#%&~T) z#4(w|rm|p#AI4N+u`pg3Qp~Yt87!>F)WRFn$rR1-$yI>8#VXdaVXmHmW($2N#Fls2 z1P-D%Dm7bdQ6EZJiu#K}y^)!L9Q7LM9#Q$PkB%nN84RD}>0H6l2w2l27if&+I1o3J zQ@xe7o5wg=FU!ZuLWw#Jl>zcDECe-@NhR_MKg?+pw}+OkMq@Hbqd50!yDz6yqoXqx z9o~_rEqmg#wj+yCQ+6a3r<2xknoQ;=;RnR@I`4&xI0>DV5vnjY zS{Fk{IwvK@hSbfC=TjL>Ua7X?!ygJ>c4AxwIAz^KSW?D-5p!%fvEGkUZUZ<5R!Q&^ zqd*5nisJ*RVi6~03QBO$MbwIE9Vs3(Pbzjux;4ohTccRb_I}A+v)W;jW(19A`N?@q z?qf*ijjLiuy%ASNutAe&SdMe0Ev;>hgWW5QzW%`hqj9jMqtEDH(bv||EiSb%&x#pF zTX@t`ZLevlGln`^T7y;nQ3JCV<3=2V^^_&qh(>Ll z&@aJCcY8+`@j}Jqn2)9GP}1&}`U<0)tmuT?ntB1Ay$vOnOIy;h430+GMGT{viNd<6 z6i*`P3dM-9L@V5}Gg`~q+&a%o!J`g`%}(ko0FB&r>JR<7b#yO!8>c;GC|Z?FolN*t zmJ$R|9GRMk(Mj1lfh*?9affM?5f0jZQ(uXR*5^h?r)ClxIgE~DmoRAb46_-bBCgIrm)zOTP8^Urt)7y@TJ@n?G4+oD2epVP zsf!_=YBMo$5A?9Tm;IO`&Sp^)2G?*BWJ(tfcE)OX@o8ouaerLSN|H_2{}* zt0Po(B~uj*=v>N|RrVBR$x?nOT3R`p+ScLI_NJvgt2G*QxrDO;Otm;R4y2Gd#&moa zKjkE})7l<%R8A7d==LBGUh@`L`bb3Ag3BD>NU|*zveq#er3)~yiyy}YDeO{88YEVz z6q=-9$K6%22JL}|-2Y%Mm<@(bVq;#XB{-hY*GoK#D{wHprGGqE5QHuqJvg5i$G(0g zF1wDez=Sl;%<|~axk#uF(goSWaW?J*H-PKm^K@0AhmAF^s?sQgRm(e8@dc+BQk2P$LNhxUNkD)5!^JU5c&8Ewb z_*V@y4ippl;>5U^0>BT#FZ+jONE%!k)k;?iMPe*8G?n8M8q5P(Q$ao`H3r3`kQrE? zEy+n{NXJOZ#|~4;pTbzuU}xEj>(T{rLrHw1n9dX&6@@7rMb8lW+Bw!IvCgb|B~9}6 zCnj~XcKm>J#R(bAe|Gff@mWU~ z7-q!7DX{$!UAWCJ!o}W==Y%onymSXctI>E%hgl~GFFOgr?|7+-(W#CW5u&Ntz=BL2 z56+%8wnTY5vL|F(%xnB`+##-fqKb2!rDPJAdo-_s=+y8*kux>%diV5gbdv@f?k@PD0SRA64oM1iXCE1 zK|mT)VveKb*5J6c;^zi@GF-Dqun-NJ=+iQ(F05;vdLVE4&xxiGtha-uDE z3`UpbcG%LXo2tT1#|FP_0HMfEjNwk$BB~w#5nT;BY9o!y(%F4W+E&jaVNXHW5rp*Nqe#0bTx?xP({O>vfQ^Zi1bUp~0hd3A1_84Z5!+Dt8Qb|BPcoQjDD3TeAySSJ7b`=;FHE zL?Mw)7L0<~T777Y<0r;xqJ!my7c65&gwLeIqR~VKhvIaDTj)ZxgKmtj?FkLkFb=}3 za&TNX?ZvQzSx@y*1$+7qIham_4rQ$d?>UwltxYsEB!(Lj(fWnag^L!^F;%oSIlQQL z(V~XYy2b2RiZ>aAw2ZkTI&}3OOocAKMszS{mqs`BOu(&4V*}2P;NDr>(YH36N=~Jh zbG2#rHN<8IK<&kGX|AF*2OP83SC7<<3@=_-vv~2s#ly+P^|hm^hGg~d=xF`O!rI{| zKW3!|1xQgYB|TZ+p$>GY@@r5$9kyc9j-CEBZ$ebGB_0?y0VpQ0dJ^lgx52TtdFun) zm9Q(TX}69D4jRoHil{FB$d8zP?l$DKTUA{@UwYz=aZfX-$T?eW5!j86tgDK~aW_}Y zDC1(kcwKuVPUbK*%-xb)`4{gwMQgZdtRg2HoWga?SY*bG&r~|CSj4SpFk4B;)S*Nb zy$=RmT#)Ya5j6_0X4S|=<-j(o7FQJ6iK*@LJdz@073lYaR4a45;NAeiPqU=Fy>unm%%jgVWfj|n9`-_o-+uD5bs^(D0hc7>Yvx-gZDs}qn;9y1yH@+EdX6J3F!)G?n% zq0&$^%hK=Dbd*|c9vjWpqX^T1$_|N@s+HMOdq$w;omuxAw(7ia@9RAVS*t^6Pv4MO z7#}<&HbM2R+iaqTrU7XpOuEC|+YTx=02W3yO#2n-ULPtw=;p4JIOygZxvs~s(rOAL zOd&VB#)sVK5(Z`F2H^%}CcPaG%A_F!w>Uj>w_`gRN6l>C(U}g+j+rW9ZE)``z>0Oe zLa)-DAeXiKvvOttWUb1KD@vP%P}opT|19KYSN|-GuHf-ISM+@*h^I@!eMUjIIXSke zo$cM2<-oR_^%q72_f96LczEtKJnz?2&z0$KxD&S4w&-sZHk8xf2)WtS-w2~C*xzu) zu>FlV52|{k^z-ZTpK0cLl?k`3wJpM}u%Y~L zm;DG|N9W(bDzGvEm$kM6Yzx<43Dg}EyAO)p`7sW3r#AMJ+jue2#>;sa>BD% z${x5hH94bs(2p4-@JKARYKspGe{Jg(ww$Hk?YRK5;BEgKO3X3SilPkEx91h z67+qcp(W=}Sz_VeN@yvUu!&Vn*cTdFg@oR~Dk8*N{4Dh_tSMa5nbC+@M2TCCjE`?( z`5h~9L-w4uLDpD$65~~+Zk`^mVG1R0Xhui8{37T@hh|v9;-J8o|n{>cEdM2v!@EE zd4;XGd%8ST)7Y@Dz$>jZ#ryB*6_9X^-%V!KN5~iORk(E1`3k>eksboVZk99Mn>KyC zZ!?{(s;-JnTM2yMKAk0SA8MxEhv_VV`%pXWK1^o`+=sep_hC9qn5G8J-XW+{!F$%CAi}%bmJ_X@X~HTk_426cYY0AiI(( ztZEt?c4%9&4~o$(yBpbC)7#PnGYr%AqG>a&rmq0gh3R|^wduvQmSH*))E$+aisGJz z(EZ)i3ou;>ez&$6(Ga918t^u5OEQSF1bttTJ=G&=_HaqdmT4>^oE!3ti{fS8th;qg zCRoCOZwI&B3?@y{P;ac(zwz2Ev0NF`oY)Lq5nwgGnJdtqoSeBb<$2ASE7_hBow+i7 zlSpn=<9wo6X`Rek!gzBh-U=?gZCx|_8AMv5!S6FSTUm%#pPQ$A=tTkkFF3bE13}Z$ znS6)2Y2A#LX*!D7>0eIHjuLcr-XR{Pz+WBfeId2|Oc|@9?01BViR&^R;lp1+ZpLmJ zl&uKS3C-zz$+_tRdsN1>7G$}kd(pY#<>QuhrEC*ekYk^3^-kV55&LvbURaZ-0ibEA zIQ8PBec#D$hNa}~%mS^}-WKp$_cGcDe^HWY>I{}>I!V2YzkiNi!c2rxwlNDT`#Lad zlvDvFd-ziUF?n250ZDtnQUNiu2Iw$b`J8`h#PskB>v8$gaY3ouSq0)INX5On^rUe! z<7wtbhgdRrc$JPZGtvjK>zbZ|r4zCv?njv>;pS-TnHdU2=LBLH)HX2;E$3U9ZEW|# z&`vk)%Vw0pTdlZx+p1kEYf9U@12QEERg|VAp@pvukSH8(Dr zJ=xweXnNEw<7vc`7(sW2Q%fnky(;43&sl=i*0Wlz6Fu(6uUT*B9Nw7HjgBNcn&bAc zp*ZbY?WE8mwi&4SlM?x?`GiMH#Ia*l16~Q7!qE6)7UCf+5qb?h!W$QFEnqs%=b~Em z90*#H)lMz1U&^)C#>O&s?@VxY`(mbC8P}YPs#p7*$V;P$>39r zYC~t9m$<1j&r96YnIk1`>P(XoH#Nh{j(+5JrJVHiHa`bu$wfyTV^iAL9^FlC zdwEzlH5Ge2H?{3U1(2VWVDD%&yFB00oV-;49Ydru6Zur!dVd!?;Lx3)2!>5*{z_lB z>ToJ>Le#8xWP?t^QB^v`GQ(KrEk|+K>jOCq@)h%>p)c+5 z!Iv`~3G*6UV~8BWiFSkpP0v(1ec@eajAhTf|!_G#mIb=GQrQbd1h zq@?YvecBXD#J;TLEvE+p(0jzTO?+G`r> zjG>N}*3g~=Y~d)xvMXQ{UN^V`*$BIZRR|h2zmpILw|F7wAm)G8CGv)N#j1HSlecW| z;rUcHwtH*Jq|ytQd%LNr*gfFXwl@PfgAcT}c84=srd?e#TC7~lGg`Qv95Y(1nNw`G zwxoukn5-(XX;}((eV1W|Tzh3m*>zEdh#A>(-hpW~zw$)v_?D+5hqyeoVt$f6hp9Z3 zb^O716;QHky*!J|isw(#tI&&3%|qtOirR@$SzS3%Dywc+RAqI|iYxP(g;t|2TgR@R zvZdr2DO=ENy=4nI8*tfTc50L@Wo84O| znr13jLd%)WmC&;jx)N$;itwDS>|3?nd0k;`({RUlEadyFH7B3Vq3Tpr?2Inc966cG zl(TcCOd%`U6@J^A)vwqOmZA8kvup7;l^D}c24L>b^%Ngmso=gQ+EFJJH`-H86)(Y2 za~0P%E7Nh+ZKcESJ;%*Qz0*^U>5x5%Qf3nA=a?!b>@}Gu{P4u6KIelbz)F`e&6pU) zHM_W=jvw!b)}bq^mpRTLmn&nMv#GE)Rivvhr(loK$u6WcIvp1RRZP#CxvrR^HKScI zMQ$UW23IjfZet}C?TQ|sD5s)vrMy(p71DE5bcGZh6rlw;VWKH`+2jdOjj#oF>(C;TIA!?eM+mOo3{qs~UWWAVX_Gh8rjSal&y9{c_oC%w4ZDPFbQ~w>292I!HUcij<9JlK(b?|2 z=ys-yb-GK|IR*{W;_gtb`%xm~?~ImfW#^2S%$pq&cg9QRKI0~p884apye&#L6PrDW zvJz=cuh?@wFr)IqrpfNT{ZyM_@czFd$_k?^aFl1A%H#<|4`wrarb?>Y#D93{<6ea*yA@GGj%XZexY->mO=IEYG|` zGsUcjlJV1C{O?JPs>hYtXozQ(*)Tg{T#Bw_Fu(aEKIqqJW9NjvO?m63qhyPq8(Dny z;?a0j6?RiSP#j@$Kh|gb3Nd=gpSQU*52+7wWi@`OHAqRz*!Pi+DcuFxAniwugJ|F}gU`qq0$~IhD&V6^MsZz-5k6I$~~NgTNtNRO>uWu8M7A zL!6!BHa3MfPu}TmV^gfNmuP<5*c2WWoX*_#rZ}1pJ^Qdl3^S}t{%~?He50_h{Uxa= zP2o8&5N?Ufql+0Ul2<-G4xlPFV})Iu#p`@8u-x;Yl8UG~j;kwUp5uVBGJ;n4q6HQ`>*9t|0!N1#)zb3`DyiJ_{A5R69Cs>V#5VKo!8OUaeHdeghF!vDtVoR-Be{ue(Z~&-UK4P#f(^^H*YTCB zWf@jwH0QGDFegTeIGc}QAnpsX1{Faasp~)i+nIL~qMK}7jYDm3CpiO!IgT1;&Np_v zFcZZ&jud91ILB1LOcdvnmMwBthMx6dEy+yD7J0WVXJlo|@k_?amgG2Y_0&{lOY%#> z%9iApeU&ZAk$4^14Y=-zE~_a{jA!trgbQ-8k$f!<%RZW*LGKzbvS+&T(PwjG2PRxr z%Y(=nFI*Z#&UpFCLF9~EAq}EtynIIju1Ja7^HauJysX0*p0sl?Q5&s~ChBTOYpd%Q zF0QQ`t*x(HxUeoUT$@bRq@p#rD9q@p&>ox)cJP)}qswXmVN18)BY<(>8^Rsl=dsD( zH-P4hUPJ8sRCF=pVVc1)<@ zKVqU8H+>uFVk(~~=JNWPHa^mE{yhnA@um|@Woy!8T+@(vL#A{tcUD^O9EZ(H2fPEh zS?PvzBseP_Fk7+xiqWzg8#{;@Xf(QT#DXcJA=is=YvS}%o$G|sHYwX~LEEHwIsdnb z5q9=&lj68)TWHzCB}&^V*Tm^b40L#By%7!1 zqF810I_4tqYD(JWZ_k$6&3zUaD|ZgFz+}5CnFYqqiWcU4u-bMVQ)cL_2&wZV{B|8u zX6UR4sq3+D+jUI2rL!ZbvnEmb39?xc)LAoNVTR6<@d~qbRt;B}#j|9z!fc%tjjM0A z91So-XG!B?w$7@?#VnpBjf>ejD;gJO%$#Tbx9d@sX{#Anqoa~D1DM6H;2Z|s!s5EZ zXLcBC_g=HZUbzRG9ah`D*zB;^YH%x3;}x5UE33Up7j)t@?sjIFb#2=AXPR{}+xBOg zb#=@3XPR}L%JyfP**w|B-IY1TM$Z_hivl|wWAEvbx6H3H8Z&ery_mu^ig=*dpwW^V zO-y8phIJj9c%3Xe>0sVFLw34$wYb)+Od*F!Z5U%18*2Fz<|=g-Vv2oVb$qC%+I_wR zm&L8ZxCmnn*I5&UV3rwfk343d?eZvO_IY5BNM@hyc4L*Vk{HKhFX?I_&2>N4>QXM@ zu{Lt`L39Za>m01r3QcE2fnlFp9i=q+?1B^)_k`o?C&Fmr{Q6eh;$ zhHGVn#q7@1o=sBYtiqWn%Hh^%B7+-=UQcX^HyZ$TC`+XlO_bHzcC<3!@7cEu#B# zqP5B4MYW3-HH_9RX7}ar0|uni)EWcZJ=1-R-Wzj57hmH%uzUl##Ah&qZ+^t zC-w9ObBfngJw4P3Q##fRgXd1SSy)qVFsFD;HM|jP>J8?UV<%;ziZq_H72 zf_ro@mzQ3fO(iQayH`1F+i=%G?nrTRJf)dHu+}M#^u<^_R#g!-dwgCYL3zwxAz6DI zUm-!eR(yNt`s$Iok>SM)YZfnFxOh0ZxW0BY)sU*q4w;nr#F^Qyq2xp;hWyw2!q zi~w6Gy$z|MDNa8($Bk%HbG)^$ucfiOwL3nTU7yWu%*N_%oNYavNb>6|xYuIqh3w~i zJ~3%zQyYy;D!aD0&P6c&ws==ZZ*xm)Z)Y4E#Of2YMXVm1#OlR1RLF{`^OaBHbnK#t z(Y#W-G8T*4hO$a$)lH{9@GPMC$u)J%dOAQe*m;mRS#GTCs6|nFjL_D0FMPFQXKq%xW%S!2Ajt+%7EyOAE3OHb5|)faO)Bv=mTdRP|V^}6X1 zBbCqNtOm;!GmG^(y=&d}s@B6?@6T>)>!MaGRaopULJ6P@#qX*@78)JmCUG7VgRb{l zo6AquxN45Vv#7g!S#w`^cXu4Ohx5m=qo;Il9*@<@YZ4NCiPwy6u)tgW2qk3RT-x=@h>*{On zY3q%TP828dDRizGJd!?%?lqr6Ge~W~B$|bH#XEbkkLvGij0-6TUq}?wh0(NwU)0>( z+tbt08qcB~vFRY5eY_}5x<;FO`+J)j+neK7N9*OS4py?XXc+$pA7j|}tvtV%G} zPCOlgy8y*%=zD&3%ZojZ(Z;GHFnb$%`r4NDH?}p2`r`q{*ru^iz^Qv=eG&4vib4R(Im%!c~z#{RzE?qzXyF4szu zy6(Ql&Zd^GmN=aS#m`1Z(iq7Wu^J&?R;F}dbonqhH+QfOg%v|A743!F;(dMXeLYQmZ7$(dZq#P6kE}_G#Kc9%H;DcAi?l1LRzhC__#}h}vyKUuXNW?w0;; zbQ#SZ*@;XB|90{&()HqR)<2A4gpaN=J3^Ph48Vd+s+h~tkzu#z_22P{Vmc#U1x_!M zk)YamE9;2Jh@NZDjqpdIA(cawOwXD5`nh5n3>9O$) z{Y%#=(Z9~u#?t?>t!*lf;qW2|Za2HIiMHmAZGc@nQBzxo>x$xaWF~zl)2dbu4B)NF zp||CIHR}sI;(g5>eVy3r=*&&#m>uSR0zG1HZ%=P$cYkkuStd7}$i(W?@GOmUbZ27B zfEZgS1{m#a%R0L|mc>^MG!7IKc|4UkR!`keDv2lU*R#=gtg5Bg+GcTcUu$!78}>s3 z0DxTDm(so4Vo| z2ie-#*WBHOL-P!gW_`FXWYdJ!4T+H;^<*_YEnPjGt;?3hQ?0g5eSI_+*Vh>z@3(%e z?rv*tLNC*U<3RkV4YIo^|9GiI+yh&G1#t-15pQnmN5uQu#LmiQ9PtRHA?t zrqYhxTsaeRQ#nK-HZS{v=r%g86>8M(RORIG zmmwupN!d!?YARdOmDdOv1btumS4t&N4wWG(S45d|Qe{*`&08TAk)@v1aUg;=mEv8m z84~46;h@ht+gu;0&NKULcKEfPHKIt(?{;w-piXgW!YWL$P86qIV;87JD70*Xz&a=6 zj;v~(C|1A9E?3XgDNajSzADz4wK?E94ae8mWokFB^PX+9O7yN01?pDV<>`nz{XB%H zpAJB+Jjb|_bx7)y9A=EdP`3R6WpmNGQOC&@_qeClyGj_MTVa>2BkIDO%wc;tU(kwM zo5Ol5)5VERGit$%ZMSc!B4QY42b@t7yJ#(Dn(w0|j1MGi(*se&UVWZR#9LZv8tK`} zimS8%|J^o7vtga~EEluGyVf+syGB@|TVb1`CCo!RqZw}xrt5B!DNJ>Xy%3j2Pm1f1 z6st|Ulq=03sW$WkN)Od3PyF%gdj{oora|)W!WQ+qolteY~-u9Y7ax!0K% z$lC}D)IZx6sMjN5d`?xaV5bwkXEH^R>TTs3@S_lb%1j!%16LVMJK&Ykvnr~Ra?T2_ zq;8$}#Fe=6&9%aek?Tj{sNy%B5vsx9W5X1S(R$_IMT3tgpEFrLkqwYoif5a$e3OMhZ zOl`8SEbv~tP-UI3Oy#Tixz*bKhQ`&aPo|Tp<~0xAD-wLSJFdE6aov1-sb08f@#2Pt z>guTd8-1&eMjIL$=FhKPTw7nm)}6Ln@`In*>A>4=I=%YlxsfaPj<97xGLL&7H>CLg zB9V{HjYK~3l=(mL?{4!V3zDhfiM3S&=9(Yk%YnZ)|HuE0N9Hvx$R`uUg#CLLzCI^& z^ZMg5w+vkUGxm1$El%8Uq2T;=N9TXU_jBe&@0RuEVBOgsy?OBk#nh%^)mYY)c`LrW z7u>~yrS0a=>pxBA*5mgp!0hw~z9reA;(GA=v0%;=+zuL!w*RDH@RcnpJ>sqk!BIKa zhTv`o_Ze{S`6DYbqVwZ9tlkV}>{-t3gnv}_Me+MJV16PvUHpy$_ZXNR{>1fk++kR~ zhhR9VE|<945M1Xjk;qBlKJ!8`NpD`0L5;GRVLy$8&7uP`?vyWt<5zdQXs64?tMTKxQdCz!(nxc5M# z8q7zOobAUNaF>C3S#Y}iI~)eR;~$Yo<3Gtd5wBbME%x&X?1`WCZ8dv$=OcW&@Z@l$`DF znPeZBeOZk~wDr3RdS`)oL~yz|uYumbzzoeL%k*)ML!b!e)}1-$&MVu#y|8+}UFJlN z+?8|lplR2K?Ju>r2f_SYa7634C&2t!$+^q@JD8n!3oiG1FgFX%uiS5e`JR$Y2lF{4XP5hJ2z&)h_AOlRO`7-}i{HNo=I?^jl}q*XKQMdl z$@ScvUGClB_6PHr;B@VhR{s-!cBX{DqT}AYdn8f?CVBwpM!@Rw;4Sm#MBaf9E%aB% zRe_0y;Eo5=7J};svnGI}al|N?$q?LTFqehkt_5>T2<}cW4+U`4-hKt<4l0Op7gTn(5L131dlb}*|0IP!NGOg03!3CwvRxc>*{iU5x6`z)AS zm7Lv<-i-b9U0}X{D39M;u$?ZShpOg8hVh}rFU}b-o0ObgE{#t=0Olux)3wVJz`X$G z$anK{{kUadHV1GAL+?5;_X-Z~JN&inqjG-%X79uN%O$-inB{`g>D7Qsf%!xLNBheg zz|5tA2NvD_l7=lufjQ_1&bh}M?)_U1%vpjX+OA)>zvqLwM{v40)A7+0U=BNym#gC_ zel1|m3Bi2|%&!7CD)&_|v7`LUJrmq1U>+5m+h2EFo&xiNlC$GN_3=+Iy+`wMb@hSW zM`Qz-a|P!v*Vd~8w-wB{1*ePO9^f7a^IU*l3%FOnEIP(NE{B2}0y8N%oqfb@26KG? zw?DX>z&t28UEb62(c@rtIF{R|EB7pLdw}_n;B;{r0(U)_*9E65m&U>K7R-t4gAXmb za)~<#OjQ844%`ATmkCan2TQ=+1?IH??ig?fAIELOSGK6yC2>6=xycY5<>}|Z-6U9D zTuub{4KS|?&V5{A=W`dhqoTon5H}HmdndTNLvU{c_v;WG+5IB8R|Ko`_bPDz1#?9; z_eGa~Pk_4}%qMC%r^~=P&uOK`{8r z7L^}V?j*R62v%nwm3u9i8w95-m-M~{=6eBp#Qg@$ivb+<_dA?0CvpHjwCL=kaZXe) z48$Luzr)}r0`zDcu?5Wi0UY`97?|e+IBMsSrN}>gXwmuc8LYbr%)p8M-21S4EtqF$ zVh4+EKH@+W)DfQ(S=+=psz*C6?s3V_!8|26qIKM#!Td7>H>Y_{WDk63(dp5=*}h=% zO3vx0HGH-Y(u;E1;C!`7obcv3Jx*rMXvu;$cGUZ%j5dPS`KEV%u;IIG+LQv5o> z3<-|g7xkPsAnr6UnE>u+a2vo}CpcaEh=KbWm{$a++s}-E+q)a>93NVA`wtp7T@B`! zg431zesIr&S>MC;bmh`GdkdI51*g+n1MXok$M*Winc`xA`LN)0dZ&W>6qwfqr<>m; z`xf<~KJcMMr*|^eodf1qg45*z+4tuDIgy3<(4x~j80)&gWCTaFDo>m6`vx$#3r-hj z;(h^UzvaAKKdu4HrV!j^V160Ek-z@{bMOj(f62ajFdGG@vyb#H1#@=@y`O=3`#`Y2 zbzn9GaMX@I4(6u;9QpAQnA(-Ww;sQL2;AQU>yDp0E_)esBJaY77W!-J+1wYf;&3nzoyIvo z`_?2l!vtM=wtZ)!-VAV$jc|597iX7C_4Z&A=W+0%h5p+1*?N~i?+GyZwVZpqi*xJs zuA37%86R5QdTuTWW;}qq9Rg>9sX3kN>Ed!R%DM|o?|RO;+lRZ{kAt~Za60>_KE4QM zV9dYVXM}Jj% zl)q`g;452H+;1U}0oQp3*V_xE&Dn9DkKbPb^R~RIT$`i(I}prK0UXWC*MVsX!S#YU zH3YW~%%%|B2f%zR1a}pfFNNT~4(7W`&Tem?Lf9SxlP&W2QC{fcyyFDs;qak_{;D{N z^8zr(2XGYU7BDMAaHoRFhTt}V`A`V%V_-fVg8LGfZ-wB#3+5L}&W`hE5wIu0oVSt3 zkNj7~Z$5sn+JyYWhZbF&kHNZLFlPpER3GPoxj29$d#(WU#Sq-BVD1aS{TR$|LvYW6 zc{Kz#cM|7&@S#N)7xLo(FvkRN6qg1tO-jzLHyY1(3kF}=V%M9^y^IcdIk@JtxqbV9 zv^jS_w9k7nF2;uzw;#6Noj5Q#8qBksIY;Lkbb679A zohNx7%*qe@mwN`dbzmL~;PT*J0Ap zheL4BfcZxNcPawA+ehX^)_s)w+X6dmKiutY-p4T?iw`aISH~R&rX~b;0+{v?+zK$K zDmgn(e+YZlfvLNc+vjd?Hb=X)Gr_!g8RvB8HK^O`_yp#GKk3iC6RQup9OHv4IH#L` zSql3$fVo9*MBDMR?V~)s6U>4uxt`9C<=~27?iZY{z3mR}F~Q&~TU6yz`}%zdt`*#$ zz%96n+ovm+xF#?c1aR*JcO{sw3r-i8L%`h)=63-cov(c!Ow-leK3%_dBe>JR>_G!Y zEIRH#Sa&p-Bd+0`Za$H?elR`P`g6AGM(D->0%=vrs6^2IeWj>B{{$xIcq= z|982bj-zqw7Qx^vTWo*ra(@GXi@>e_9@o?D&q?nR!3a4={A@h~D=!bhy#vL)3U2T3 z^K#wu+3x!I6qqjxj%eEtH+L(TyOo@6Un92vKA7Eqz{_>(*<3rgeZZU|ILb%6T$`i% zyht$k$`%zz`@zdXaCBJol@J{1HUEhFz)MxzcPx-KA-Fxzkhc67*C#&AHTQ$4?T0(g zAAAJ!!1&NYe|6kdVE#|Z+3}6m zn3sRf%cbKM+Yg(g_7HiLGxU`f6-WKhjv={SLU1%5+ARb}?Xn{TmjKrnf}`u8ZUXlm z!MfvY$K?@lKLT^jFL`Wq+)u%M0nFKt`E%6&eGtt53*hK_>Q91sQE=8cc9Z*lT^bMV z@GD*>zOp4gFB)Gk?&fGe@K$gK36|=SagrX{w=|?)E4bwWdQ@&Mq~2NJE(p*g`#u*^ z??!NU1n7}{kA~EH8r+KkdSu@ozYbR)`+z%Gu)6vn`(h#Wy1=ap&?EaMLh8L2+?Eh} zpAV_`6>#4S&?A2z3#s=ExR(O-$lpC_=kHi_?PFhXhYD6#AEeh9Qm+HtV1OQ7Ur`9D zcLBId0`$nfuZGmS1Kj-qdQ=}zhtzu!+`j|#$lv`R4_6<@f?F(DU4790dli_R%qjZ6 z3&C72b5j3D{poFB9*{YO-ZNlck~v9_?A!CVb0UZ1LyP5yLa!Cfa+#C#$i5ty_sg6@ z?`kk#kU2?@>f-^ykbSi1+Q+ZK{V_m~{N3pZT>pX(Eq?wk0kcfzB>TwU6qpH_Q}}xc zm}_KC(j)us1oLy5Q|SE-%>QIg(j)uc^(5v+@u9`f-!3q#WKPm!{j*@0ApYp;>cKSz=u!NPkb3LE zZ4A&Oe=iNGcQv>#gwT5+q~1@!{W?I8{CzE?-cC=?iR^_BEq?WJoM0G;Kf3x@2(CGV zULvGk8r(#H9{GDoNWE*o-4LKh_4{B*y@$a)9-vnRy?=u_==VI%bR4CNUoDuJ;B@st z$L*(p8FlI5IYm-GMDsjng85JYNAbH#F!;)r_&l#3asTJx)W>uJ@A;5= zuMqbK|9*q~Jy0fH?P zt^hrX-*3SDRpu1_zU5gw*99M1thh-2Qv4QyX_q;L-YA&7%t?9_zl#M!<y-zUL+ zHb9U3y%)?c1n0M3cn-`z0`zF!{B3`l6WJdhTIjE;AE$U7Dj4EuQE}w&VIEH1-!A}n zykK?p!P;*~z0<&DWW5c!OmR5F?4>{C--ji=$UE@dK?S!}#VP9dBNC^p-;aa4RWUB7W6xXu7Q@^>AWvt>?U-xXl4mpO&M_ksDD z%qjF<2J>H;lk}*)9q^ZM`BDWgDpR2j*ItQ}}xqnD5J+Cr^}pFAJo5mNHDBm{L#hl=k?h29^*{7vQ*dVBpH{WCta`1uw`TVD|V&a9oZCvry(FJ!t)5WXqI(xdkA12DgqIfdS9V0QXfa9j=*426U( zinvg@?*>;dSif;t2be*@S@j|LLF2Fjn6q7a>T%e`U@j9Jd7~O%Q90KN24C5t;^t$` zXTW_&uzr3#3g&6S`S~&D-*Y0n;X@18^ZG&itpmXv6~NJa-HC!BJz7+LP+oO_JH@4^ z9#5VD=DmXR^W#b|pLOYZ{h)F2?O^T_oL_x>PcY;IEh;})K7;$UVEyXjMKJ#soX!ur zuYdp7@!U&%XyKgK5Bj}DFbu>Wm3`FjE(6ymSe?JbodhNkz)}3x3kF}=qAHi-at63_ z1?v}=OTk`x?P;tUwRJg>0r(i99=)J@|WuOOJHsloGuTjU%Ly;0|6Y_ z_po5_l`Xn*f9v6*%Im`a0PbbMT5(a-$GrdY7@Otl>SHf()q?e_k5(|t1!t8j_4nj& z4$RpuPF){YfVow0e)aJiFuxa^Uw!-q%s&G-vTx4++;P#>$6Gv{x<1|x?hwIRaZ%Jq zT+&n32hC45f;&mDe)Ta1W>Rogxr+Mu1enjdIB$K>^)L5=c}Q@)TrWrM zi2Dba{|0c>U+o&9((FZ7AA5T^b$z@8++l*X;-aXJ7D-Q4AGH5%1$UBQed`0vq~NS_ zrTUp!F)q-x;Rrg_X!4H*`kWye5`o@+#dz&=f}Un>@tVfiJu?u z2D3nLT+izV-H+G=X27NAWhLC!nUpz2{eD6)tYG}n)yL<--4dWj z$CnR>)O#G^UkqGVfFAXKX)u$5qtbPH z7lOGwK##^7w}H9arRUxM(s<)%V16YyzwyTJ1%pl4qS{Z>dE!5U+hJE8KR-YA1#_t2 zba5s>8o_kB^wfTw3MMHyogd_HRxr#7{89Nq{a?|;srSEUgZq$Rb$(DjUk~Ok!TH7I z5iq|E(4)A#4rZq}IpeI3%l=>v5}aRLjuZ@}*`kZfaUM<`mxbV(1*?k-<$VIo8G_^X zsrAkRb3uR})!XL;!@bbAqZ`595uiuy{LzqlPlJ0gK#%<0V>e!BLH4~1+>wIS#gFV; z7E*5joDrZ$@q2Gbz4O6+G(eB8pZp4#p9;<|@BawqZvlFg_j~O=H}VdAXyJO^ydT55 z1z@fe96gs=mCrT!y^mfR=vY)-6zk6g_f^6A`Efs(hXtprH}c~}Ft57wynaxB_2xb1 zM)t;s7G3)#y#oZpK>ShpLG|%&a2aA6oqSp@YC2EjT~D4lt+4oMJq57MKfU zP8x5JeV+q!hs-JT9tHEX%t?CG56#(gZe%ZfXtDfI=p6@UiOflQWZy|(#$-;Rw-wAM zWKN;?H82kf&aXax3g(Fbz4@^3KVaT9kNfMF_tjvQ3eJj)WFNJ+_kc;d^t^db&&AmU z=A(ks&3Dps`0fx4zOseoy)=JCc7IReRP$Ff-uOPa-wD>w-+zFayBCj(pTG0L94R=i z=k=H7S(k$84B+TGvQq_vuWV7ZbIPj`a2o~dmj~y9xlnLAKPWCYfccKhDf09wFfYiQ zlm}$r?t5c=g%2%OxeC3dU^-+@(xY~{7R*MOQ|Mg^<~o^E=zSZ^Ph?J^_X3#LWKPnf z`0e}Fxsl`Wp~cVN9xx}#oTNwb+X!Z>;QZ?MQZUyA=#hQj2J@)QDg6CAm^p8g{7~3; z5SUt-Q|K)RbBfGKdQ`t>f!Qi^3cW9Y`I^ir^nMEFX_-^#&Dm#eWDk63vFc6Iqxc;S zrdj3`dI>ONGAHRB1HG+aZWA1pt~;*%0hmVv^r+wcJDC5v^wj;(-fu^{#D^AMu9u_p zAGLyEApWTOT{>UUC~1x5?D_eB&yT!w) z)^xwNR_$Hp7rwhGqIzH7kTAUK_U)bBnB<`*u`Yahk=6)>+0PUi=4JHK;oFl%7b&kY<20W<8lp{&kIiHFU9Yxf*~JhQRM-};SPyod7$Vw zzNzA*{XUKFzXk3|!TROPE5sZ`guZ=Hy&VYVXcy;=3$^nOFslT|%k^>;m-S!@g44y1 z^xg|*Yk(ec*9Zn**`mvr8^PV_(o^Tl!(bj4oL|2D8_Z7gdHnqR-5<=sg46j+aXDHr z!VP7<(Dt-yaGF zo3KSyZ*-jZGY_Zs<4JJO3s&a`wU6Bn#`R(N(Bc=DCNRB%)9F!MGGHcLdfvFud6F$) zE)twBE;JsxTrl{`7FAp*Uq0pG)N#2U+|7d3`9b5WheGN-3GVp-J=$;WcF5ewf%wp3 zm8&@ZJpoL+%t`$kowpwa^8uMt=v@ouOEM?vk-y&u^DCKC=)DSN$3rDQ6nck%sgXH_ zUO$*MGAHR#o}LNjQ-br$)0@HE6`)6X`WrCMxb(bvO6~16FgsOoe|foHj`DPW!Qd-f zba{H9hg0Y2Vc=>6YvqfyAEf z-eAAOk@xt}V%ewYpL@ZaEOU|`?T=VEob5$F<CE5V#5a|(aoCzv3AKL+koA@sfl<{_C=*!LGO|B^Y$KFXKLE ztdKcLkJ{U~V3;8O=<4@ua32cLn~&|U2lHK-Q`q-=Fn^Uf$v(=zw;Vk;atJ=O`1uwo;FlWk~!oE*}`K-(-^zH@oh|DSU{tD)GnUnOWe|g6-+*k6K7F~TbfNK)0 z6&Fd5{5>tC-Z;3kWj(1Mr+L9EBt2C>&W=+gPUpw<;BJ=7Rrv8xNWCY)Js+S)ao+7% z+?Rz9Emr&#_0|HWU*;6{Wx>2p<`jBYf%!j~lk{l6^<6N(l{tmp>tJ?WAo-!tI}FT; zf+Jd2A1lC|8lXqxjkCd=@6z**b7(wtIhgAMI2zx7LooQt7S*_fj*spG_pD1#JuZ12 z%&y1z$A$bj49szY<8kr&5e3%_rXV=lPGuimC-@`5;452H9JP;MdN{QoPl9`1uvVT* z^?MBTc8g*^hz~7(_1g(%NN_qm@~;Tyy)Hd(TxcHdqhPKH;3zJ)2nJu-qKXUU{axUG zAy_`%)x-tN^Mcd)L3+DYWB-8IC@6%wu5kl`iFb@Uj z9RVNz0_N>C!Fg~LmYv)GZiVrP*e!NRC48$LmAC!Mp;7)Mqsq?uF%nHHj z{GhmugZZT3{NnN@Ft-QjQT_e`%o8p>Z(Qhk1%CsxM;(s~jRREv()9xMg27j|s5lyz zba^;+T;2n2tzdO=p*Wup=4zQ!>@U9w<^h?L`cty+88CmBIfdR^>v267KD6lUqyB!W zU>Jx$y8Uk}xaA@Aav}9Lg4-ORN5=uzh19zd+#LaWl&6n^`JdqY^7O3@h#x+*=;B9t zx)e;C;JBVTPfrF@6r5k4UL_b-F#f3Wl=A9kaNifKpC7*k^PJ%P{MdCNu5ZVO7M&k7 zZhAMEngEW*O>Kf9Jz7+L%*XHj;Kp5g>h^XXn2QDH=f{`9+~(5r)<-kS{Q;P_EaLuB zo~i63e?KS~d}WJ@qjq$Ohg17;CAiNER_6!l-5*l#N8la{q4&>_djA8r`(hp!oqaT} zI}*&G;CQ~M{Y`_J2+*T;bP1TNTzcMmqy6+vU~UtfZa+x#vG)iDU)iFnH>&psJe=B( zpMrZru)4UA-hV>sz3F(&kK;p&pI)tC7>GZ*{y7G&D}-J;q}~L$a|84!Pp=87_jz!) z1n5z}_Ar<~3C=IC{sZPsOZ?+Ud389LsNlGsH?OFjw}4q5z)`=J5)8hwMU_{ypU!zW zbzZ$6+*ZNr@_^U|U30|9!}4?Po7?38tzfM<4;KpNcJwdB zPhQTM7r%Q!-u-@Os<-9PO1t#pahap@M;8dj)Q!*ca-?@TxUUB25%&`?e+=OE0k>03 zjtj~qH>&ccDG{0!A2mC}1z=syg4=K*nPe#GC$eiTwq2N}7IZJSU@jD;P7i2xj59$x@6b!zyMVHS% z0{4tyb#bA5-k}N4FTsZvKW;IYUT*9j`WtRIH~`m{mdx1 z4+z$>PvYo!@G>y>3XbZL*(bG+qw)JIU=C{M{`$4IBf<0t&MH?LN5r8gFXu$O`&IHI z0j>ASdXgX1-+vU$=VVUu<1lb{fO$f2et!H3%pM)wU&{|g9vlp&It14WW-x%G@l{$d z_{tVlKY0$;oB{47!RqpvxQ}*XeyEH4q2uWHuY$Qpa5{gkEUd~aBJE`COBD8)d^sIijm?_X0&0MIRAJN0hG=D?6cQ24Q z)<1c;sE7LyZaiu6aQ&WfG3DP6PxF-P>DP#RIRr=j!G4KgJ!&7vhTur4(ZhNBd*Yfy za0h{F^>EnFNbQ%}c@o??f+c;H2MX@vU~Uqe)jvz^ocgODgLzGGe(ijRVcf@u4=q-? zQaj%l>y`+Hf%wDhlQ^ok6(P9e!EFk`odE9U5FFL-UqWzn-ev9x_Z45+qVj{rR|kaP z=(!)wAvn4pY)uG`+WBM%j-F?9ZU~O@;Fb^^<Fgt}5zJtK9@&=$bD`jLaUt#oFh2?4sN5I8%sHL=;b-6OU=9+TUtDUztO~)c z2Xm3&EI;^o&6-<26!zT+<{`le`^5O!&Oh?wS783)<~(^y+^b;TyxzawD1P(7w1nVR zgE?E~BtJ;+VlcM~&d-m#z&zsSJbqAn`wf_912`)8WiW5g1p9jwnBEZFFqjX9;I063 zm*8~u8z(=&95Ck0KlAv=UB8EcIo`#Y<13q^cHRQ!G{ITrD*C_of%&xH{POwhV16a* zN%h-?a$f~=Vm8>1b}(yPoYxPk-%&960FLVSY%tdf&d-lq!TeHiR$L@MTA=q2FvsVD z{b&KR+QoVOAp3^Fd{A&Z;{Uq-{>xw<5uBeNe*m-FIJeJ_I}l8h;B@}dJi}>VZWkPH zm+Jhx7tAkQoY!CKU!DZ>is1b0+w~00JK{r&9~TFc6r9eFHPH9~nBNM{&yQ!pyzb(> zejEe6o%6UZ2p?Lk@vfpBCBb}1aF!oZUL6IEtH69$aDM&YLtuXI=9K;4U%>n;fTR4| zv4Hzn@S(-BPvOT2U``X96=#W~`h6dmj|oor;jxdntH9hOIKOi51M_SM?sYKpi`)-C z`%VP2LU20!sGnQ|W>bJ3#qTmO-w>RiA3p~3a)2JiW!}WxNEJS`=Ytwg^XCAL;`etj`)}a>`uTAznB{`=tKS@$ z&4Sa#kLveAFkcAJBl{iz^Jl^N+4ny%hi>G4_}SM8W>9cC`>0$4%x1yui2v*M3parI ziQxR~dm79xn@?}` z2hFP-3Z_GFetryqS?lIJeo#K20p`5{9M#(eU~UkcpTFM*^R(cse39yd<`d_fiT)WM zTKxQ|0n_H@JbqB#_k+m@&MH^x$H|WmgZZ-H{QS5V%pYV<@`Lto{{mBWR+$A_GE|MQKzxEq2bIuO-V|OqIxjBy?WZ#isdIYy4 z{;zB26JRbEoSz>zf_YeQetx_N=56l{_TxY>HEz!12aShL0JBbTe&eAlz}zJ`KR+G; z^AEvUen@#r{ma|lhxUOFExP`c?5hEDs^I+WyBN%^g7dTQdtjayoMoSsFQ=f~-QJJ> z1s__ted_V^8DP$Lao%w!<;z82ZV{YczWf@@{{-jf$6L?A{0ly`==?YY>juGW6r5i_ zbS{`n-JB<1sQq38=7s={{QVl3#{}o+#|vQgI@jM1%7f#;yhm_;ex$%mx;c*@lz*GS zd_r)3_T2#HCn30}!R+z@?uVr(DIc$A=c-hsQqR4hOSDa8_KT{($W315*gWT>$0= z!Rh><^BNC=c}Z}7asD@$JPai2v*Q`xKZhf^++ejl@Fdajq7O`J1h0 z{(@r)eEpn<>lbl$b6*R|-5-+sc}VUV71z9CW!38DLDNF=5WMnvJ2>6-%oZN27-* z)_1IIUD3F*Z-vp)+BCS#=x!Zq?Ov)PS4?D!>9JIIdN`lRPcH3QX$%w-#q`LER3?=u zq@dl>+SWMOy|TNb>G(r3>EV&_v7)L(cx?=xuzZ zbRtts<+F)mDw`Nf9d9&l*i^G>EH&1eO$=vJ$))lSt5S*eLy62p%IjVto6W(>lu;<= z)7iC3$1G+;YNVLUD;cA|zk6llK$p=ta8hrx(cQOfSx4`(rPT`m#>X?oL}9&ANNh+Y zjnO<@FtQV4!>N2>DO3z5GtfBHYP79r>}fTc`v!YgLMNRa$xI~Su92L~8o1=dNN3YU z`}bHn8IM&#$rzs~#*I}&v8o)rN+rgICq|7lB9?&lSTPu@8d;af8^wGgT`b^-c%hh# z$DMy`hN79=NFtMp*TfqYMT}2mN2mjUC4BD0 z=lzj6^kURV^YLp23kb%Vbaphire~s%9$C}Vx?)-Dny#+?RlRGvdsh#%bQws=6|KE1 z*C3JB(Eb4~WwWWwnvwDGHNz9>Ow#%5u?3cj3zF&l8j+7{(jzHEAX^yE<%31% zkDRdAoMAkQF7npMF_9~`M67>%(j)m?Avao_f5eI-=l6{x&(mijUFJ9E#>Uf`6ub0$ zES;qlsioD?C1Z(AsNH;GZE84;LW-%SiyNZR=#m0zA(dNNy`(Un&yB+>@!yF;DxDop zWRs(*k)_oUtQ>{xv6<9{ROZ-pa%o*nDq20dWIQplK2=PgiDs3{9y^vxqOc_#N)#r? z#^BK8v58D3w-K$N8W+26K6Afay0-_VXW{*roRF z_RaS#`cC_~uTf8#KdSx0#>3l}+_T}R_O0K0mbSsa?dRWJoZr6r?!((RKlx<)miAZq zCfJUtGVF(~wGXyG&{8#@wrQ=syY`XV2l)y*Al(&v85C-L>%q5U*>9ux_GZ48OcJFZ zES0{mr}ThADVcbobUgwuii#ISZN29^?f7h+^PToBnW}m1TZ&ctwQo7QYJTGoA~V1J z&j0b{{T*9h?cVxw`_`Abm)yVS1?NJcWAm$fZrrzfOXIxu2O9UIh%!^YyW_&hpL^T4 zKG42pO;xmg^Y`{_UvmG(J@25)G~2g6i;%YO+4QIO3w!1;yqmzCJGTC!earjiQHZx> z_iNw!OChxcn~=)ZOx2?Ht;MQ%`_{9o+7b2nji-KxF+Xg9?k*V1?--#oVq>gQFS35S z1>Y9&sKOlhmm&X(mVbBs*YfX|?OUJgCjY*>=LI)nv-ZvZ-eu$b_AMvPYv1A5-CMsy zUeYyjtk~MSN1L|nSo`Py&))aIM^#<U6+xw%kP^)9$IY#xhiKvoZ&rqzrErRSfmKit4$T>KS+I`8b`xQsw|P-Fi0% zZTdUPx-?H!ZEh+`-7Re)e`g`Ow8%0bX_0%}uvdVjMg9%Q9uR1oqAR$=&0nFXRoRQm z+(C6Vw{x1xq7rg{Zt^ecA(NycZgcA7oG;BC%G^5KH)IAT-?Y5vDaTd0qt_pcpdJw4 zZ3P&DiK2?Gww>CyyL#4-rtqVS#re;he?@3+XkKW3=n7>m4jfP|Z+0OGWul1qso129 zNIGU7(2dxGx)Hfs8S@?rYn_Sfl)3OGWhRiWpVGca}q_Nr%1?46+|k2 zs~gwe7cxU7XHc0hra$pxlts3Ko)mZlgQ%qk@>SLIO%tX!Pn%Sp_|$Z5U3gO7*|iV9 zqHEz-DG9exjBucQ{kizM-iWM{b~1~!b$RWPRmz&T%8h3ZM$MT)-CSOz8!I}aW?|Ia zo~|kC0O35!pXui7v9@&l6z3Ha5BSp|o#WwI49XgOouGm$mYcpdT zbj$mhs2M>sy%05@OV`vYGxne|Lx;;0lzF5~m05s_yn>3PYf3xliI5-dJ*cV<#y{hP zlxUrsl@*Z!DQ#wCL%lI>dGm^u5TN@}d_-1Sn25qkyn<5i*AOZ3inea_w3S-x4-rF~ z81%GuX?J~(VrxGGLG?w;Hi00tBryP0c0e~H+x4nG?RMInLG^Zl*G0>~=m+zbTo|>2 zc^DYmr4R=SxeUrWb-7;Fcd6x#kX)&(+4*Q6Zoc}kQI(p6zqbZTnZZ*d>*jW}GPk$e z&dQpR*IbDr%^8r=w#^6C>gJ8xl^H<`FE3SX>D$Ict3FsZDq8kID!(Fa220N9LV7<- zr?HqE3~H_K;OSyo3*no)HJ?YDjDe%Irl?Tp_N$py)OV=1m*UfvSshf#N>BVuWzMcO z^V+&@J2k!8$iq`mnZ?SQp0A8Nl>GdV*4djn7F_`FOYWGG`l{Z!-bQ4UTMCSV`#j4QbJewp&1ecY|7y1lKCS}%BR7Op91XsZ zbN%Gnd+!~n&5-J5^}JO5dM}L}vsOLW2nx?Xcqh7W*e(fh&q_^@C z(hba-`a-4DM3^iov|*?N`b7v}Nb1^hT5de63qyYVtuuoS>2$ z&r)U-(`C0xzFq{jGErOgwOCVkBmmv9zk#Wu0P2cj&!U;;&J7T8rf8d97WEaX&+2 zd(4A-uRv#T!lqtc(()=zHK7eW*BroH^8_NHkXq}Hq~r=Eztjw$r)FrK`gyfcGbq!` z=}}Y3^uoLyPr1{}m{f7p^k8b)5j8ibYf8Y|H`hn1wkPJ=r_C)m)X{x_1U9Ry&nh+?HmZZuUmaU!-dkL~_nH{w?#Mov|IYV&^Pl?s=uD z8N-)$TyneDc#2D!dX93LgIqW%-TY}_4YjDe)y=O2{1rQ$0wixePkFS+yJPoH9~(c< zm;BvH(+&JipAlt)0sV&26F^sSyk~*F&u9nG@A&OYKxw9V(4`;Q zxO6#t*wCni8gm1_d9osTLz(xi!H3Gsr{-EuV;Y=IpBgS!AuZB1HeBpW?m0fW*=qo` zg^S0>$GEHR4n^e1|IxB>Vb8V*9_#|q;)Pa&K6~x+4!4foc*`L_*{dIOH__giBzPT1 z3swl#u2LXQD>g7^cX7mNY{Q`@&lqN50ia@TluLkQVRi-3i5#Y?p4D1E4SKwMJ{6)| z#|pKMIEr?uj;c-P zk#VPs-UYgx!-8nM&|EZMsWNZ&sSVDe9xH;F`Kl`G1h-3xu=Jg*%=c7PKlB!ZSqpG$4lTa5Rd1pgsWCZg zf9jMvuBdL@;+tbl3n=5365Sk#(csw}wWbxSSh@@mP9x8Kw}IO!dR^{ z99SMTx77dPUuIk0anZ8>m~D-p61B$7&@C@p)Yu<9gKr^9+fPU?HPuMxV?zQvfGP#)nLM6DIzPcJIko=JVXb6el#si4}F@S+@fBMrb@g3w0{^5k;x+-W#d#20~_6_v@#GD!Q)k zKem1X#E~tDQ5gEE6I9jKCM=L69y8qjezc%FRS-41!7|F#F`q#J zrEsPfuObB-XB2qv%9L>PwPr1rpU*@Ko>69sE3rda)p-%)_^{a>DeDfO=e>7^;k_$b z)wkqZHY)`KrO^ViaJlHho`=wG$MB@Ydb6P_-?^+o!$=63dt)TjVkEo+9oXZw_)bPR zh6prR5NW%#*3}5ruISQ=J$=C<3={l}qaQ~OF$#6#Iv@Ul(_ZI~mFT_q&lQGrGjo&6%9`*{I!7m)DVN9iqh;{9m8UXdcq+$B#R zhXx%1>Iv#VtRG9I6Il)-0Yz3|*=rjN7O>!!HwTWP4~S|-f7%+@!yyMuQrdd3>i3=@ ziJrPS^fL+yncmMZPz8T@I4^N(a&unD@S+8Ua+Sp&asfIh?&I{)!}(fU4}O!I^Eq0EXrvWI;=tiIjqb8uq9FIinFLKyb7#gyI z#vm}?U>VrlYus`b8p16u&$p3;!Yx{U?Mx5{MmXSP`#^nQvlm zuaRr1s(Q4x^U*S{TnxFCY6`g+TWXtBXwjmD3wpkbx`|NyQy2NsJ|Yw=6Z;;uCE1%J zEpPhpTJvG*d1nJwXCRT=zyW`y6*o6fZq_nI+O?qO3;8OxAaprGm2oL}>TM&#_(@NNpFN&{1z3f z+8>94!>%GJagJ2QD~4odw;k$8y?{(c<980_MsMsMKvB%<24hBpve2ihYIpog%DkLw zSgy>mN6hp!qCUG_HD7CBEe#lRKh#S>)Nys73(ruIYQ?jCsZlgiYn8RM6x$5fpm8xK z!p02&RW(4lN>!2Tk*m6RNUr_JMVW6S*9OjY59f+8b*V2^q|8SG%?LooN`c)IwSV|5 z571Xx6&=8HuO!A^*RhnRyw8>DKg4Wqg{mb*o77KSZ(6)ll2pi|dXP z5#?BJ8gg&38MC_A^I4!B;MQIbnN-T#>2BC8pgw;4MHek_-(CxJ9H+O~4f`9QZ*$lt zpzkpHSD+P)Xj+wgi7ez>66-JEx6t8{*hhkfr^tPe(3Wv@m!4EbwNn42NIgfPz?ibz(w5mpkb=iP1cf$Mj zlPcJX1)j1lFM1sxc`%7^q+ve$28p)(rBjG%%nVB*JzWS9tt4uEUKvaM_*V)+v0NDm zNN(3uMvV)g%3T`7Kc!nY)PxXjES-zTTKub{T~m8%hn5i92JJ^;<)(}oMHO38UhELQ zgNO|}(uQidR2es5`Em^u7&kz8szyT9bx}i$8sh>+QPemNlA|Yte{Kb;v0pK}v9EeL z`W}tK`wopfi)3v9PsY3PD2mtf*FgD<9snA}XcN$L%*H}xX7I~8bQ&m=rp#Vzm;6Rmew1heoJ`6!+i{2h?!Sf2#S*c_t6at$jTEt?;jHSCqXj=E;= zSo{iWGp!hF*DphL_GOaRwN+0eMY0@dnxu@&xQ3)$RUkr$7Y9tJ1)qhw8IpHkehTI> zwnbv!vSUR_K5N?$x)sk@Dq1tKjnUl%%eirU(8{j$W@Yv(3_v8t=8MnJ5)gZ< z$Pdztof{fg>FNVz`nn+aCG$3t_mTY)#BOSXm7VQt5!vkOpkTh0s9`E8f zc6^Tn20y^!v*k@1joGTGwgG$sr7W$K8=y_l@r%u(*U)YtmjM{~HNdQ^Q8$0UN+9FL zPVWHg`}k$K2k{3HrW@-jArnWNJuYxu>QAP~Ry4QnnXbzRZ7i>5&CXfR8 z9+;QF2EY$Zl5rP(A2XVu)mTTTVWVcuN$NQ#si2!wb_^u-Ty9eIHfAI!sb)a@wBrXw z?ZA(+E=C3LBciFT{2}G;QdA_lyl9lR`Ya%2Jl%|VeQm_wsd>`S&4JUm5nIuX$JXFS z^|d{W9};8i9aL*Au#6|;??_qcHf`G)JcW(N9>xzhZ`)d+dhI4w64q-gtu8$GawwKw zZPfVLZ>bkB+#lmkv8;9{A9NlUOj%iZJEH$0pQ>6^5^w1KRI^~{bd`+E_>?xuM ziQhS`B9%s3l#SE_>1JamUuS%RAzqAGsVI41RMQl@EavJv5zV6to=v~{B(+^?;*-R^ zQzcJgWP4J@Pog8RgBZf9V$_qQSIgFw+RAS<61ZYg zYQdaY8Z~pCoovsa)zUM4>1ik8oPjWEG7?`BPRS~ zq;^QcSyYfcr28Tr$ikEIhK)pr!^+A@1saS(n@|)j8y8UP&xn3AK>w@#*v@+otJaOG z`}IpyLBH0z5nrqI_IsEv_iL+WB7b$muNs~07MQ0KhlS`9#sp}MD9NSsgZJLc7xEB)y;!0@A<2{3-E$%B&Jhoz~y7yk`TKxinEbCNH)oj#I80OuVs|+%M_YN`HMQc?qo2>qC8o_hQk{oeLRGYb{3v z(1urAeI}*ij_qbNqHsha=aD($SMm10B#DsO!^#qkj>VjmJ-mitq7YP$6h#+>4K~Gm z(WNam2Vi9*Be zkI}4<(}YgLUINAM{b;>H*!!=c&Dc8P!dlRxIo*y&!r;l_DB;tvWXM0t%F*4xc??1P&Njy2l^C- zf!C7+8q3H8^7|;P3B^8{(QQCyGin3+G^0m>o<&W(p4~t%GWs3RbF3~LjiDfhw*jC# zc=M5j%B>tv0Zrjlh@}3+VGDpHWeZ61T>~_e-#!9#38VEu?=d3Xuzc}zpp~2l83aCp z;a9+_%!|23pF-@@7)=23Gx{9RR7OFdix|xYBJHu)GaqOgqd1V{L0V_2FYSLzeV+%C zcKKHzsrmarQuC9Mg4Fy%AgTEmfX?Td&jON~*8)i%3xUSqpV#v*_$&JCp8!cJwB;&c z^WFcXdK(xQ?^~?gA!KedBO7MLkY5Q&sWDc=?#X{%YsK!?FKzX|9BMt=h|kN(Y>2M~lHG@AT(lLaiQ~Nh^aZZb%Rpb`u-^jhW19JQ zAh8|&51=2R?+QGFKtEvgKF|*tVfWtiC?hY>T1G`KQn1zl8SVucvl9LDTvmiOW``c{ zgf?V{(m2HdQuEFMeC(z$E;|&On11IITA$iB?eYm;dO(2uCB4i^4=;%WxG&v;QD%7A zoc*#=^0e-3b}~cfc}5*Rv>Z{~QYW}|v3W3D3TEz>f?J6iDoV1ulv5!^lKsZIQ)Q?9 zC8r#X*`Z%`+KEze%W=fCp``MYk(`_>)F%Iw_d*>Rk&EJ|KBV0?psa5Pnh`l& z6wgx&7;!4`e{5D77mB{CKC9*ou%rUYyD2H3)kbULrh$u^Q zXjil=wm@5gX^Xe~DFBB3|m_ zEE?7j*w3xR;@g?mU4aC$=v=HM=*Z2vTxM*sWv!itJt7n0!e)}tikFtK%5HUF4b|6~ z*RcsYNVO`p`%ezf@Sz##=nk3NNpUwcaNEg9KxXDkfP@Dv1o|HHhiic@=28747yS`P z<^VfX%ukeU=B; z&@(R`P}IZ&0!f2y1QHf80Aw=;>&_q^hA@VsA0G~T z05d+!NFloX7Izw_j0Sy?kDg`7UT8iHQ%lf4O#wRK2*h8$pl3W16t+UlMA*vbb29<= z`Z(E2N2d56bIQWgKjDUvOl1%>#U_mbJHveanxGdNL0{JKvZ4-qQ#5(&1gOKj zI9_-b)MgWKyl_kW6s()$C(7WKty7MLqlKybwR!C`F;~F6m7G-YJU|vFa%yboROFoE z`tv58kIYN{QFw_nj`Ns(iy^f`1rx|}8=XGeXIFQ&C?*h6%G{BuNBAV!O4Ab6>p9g$ zpLG!qPoeF!HUxNjittBP9NCQYYiPI$q&S%bgHlm&0*KzzRk)JIqw1B!%c5oB20jI; z$(lOgA|g8pbE*Q0pc2GKNlj?+iz$pbJXYLx$v;$NOyJn}9>wVxvPIf~1WRdc=lK;k zF8+9a!fgT*ssVLPO=fdGJZ8WN3tQ6%!bW(^n>|?l*c;GJNm|&t6!e_^ZR;2bm6v!E zwr;18u+cguj$erW&31<+IcBz1K40}1=) zu?30F?nw7hG%0oi*=3*wg>->iD)8k6bsxQC$DjbRuTPx!58N6w;-s`!14(J6Jjt*5 zJ#Gmg6TOI2sAkmJC3gn1({Kec{;2Xl=kY@JY(hh4x#(P=r}?cjCNPwvtic;kdvmPB zgPu}%we0~*75|W$BukNYn65TBckvO#NIOU?jDBSdVAQ|uX z0oj5S3Mob@DEd@*hvGAF-@|)4d7yCG6vaOnzm#}=kWU{h;(nX59;_IkW0esq z|1WNpf0b2bcsd|K0yRcw9YAMkt%hA=bQsn6*Kv@i-C->~rC?+TOT4L@g=+nz2NTK3 z?_LR>3Bz~PAQ*+MKJP$|&g?*{>v!^3wp~At#RLb*PFgSPio%lyT#HR?ngj_Regv4V zs8eAV0r`VYi8-CRXry|Tp}0$!oqfZt;Rd&c4qd!Rx-gX8rd+chF`B{ToO#qT*CNDu z+mXSu9ew^VQ#q3!kN;wPAR}v%i>A1U%p~M(*hMiH&3Dl?F3J>}wm(sJzgu?m$r9=V zocIRAz#<23gm9js7vpaxpJT(JG%QiJr|D2y)41e8K9t5GFnd5Bl`G2}L`F_s_c*xu z$=!e+-u#J=L#*}A8{l@}oc5Ysm-{$W(1Cg((>%0{CO+%+dUe7MVW?5b`LE=_Vj$5`vr*wl5$4OlH)TzWi-MPa=G93F7|K68gkfDOU-U?A!C(kcatrmM3kFZqy`27wY(&b)Ipi}IeZ4YnU#sgaC@Q-b~MfW zeAC5t_|r6~X&o3>DOqcdwKbrtEtX%3W^BpqUZ)eW^CBt<&p#^JXkmGz+K@bB-Y5hlH1 zd!ay9)*5OrTgO1h3Mmqf72-JIQkb{hQW?@pmk!|1EqiRAAq#tk-Jv`O>4?H11SETj zmjcPYO#_hZ+uQ;qJ4{4|vcvTMfEM|PaDNCSJ50|2$qvrTK(fEHA4qnX4g&oZe^G?; z$_|qTB)Lrkl5fdFfP8y5kUbZ>Zy$8uzTv(lt*CrE3e71yM{Pht%(P1>J0pJwBubLq z6viyZW)nG*T}yWjQj})5%<>GLEix4|_G3^TX&w@mMP$#25kzxR5SJ`v`6=>U_Nwqj zyMJfbW>#+%IB$1LEe4Ltgdqf?h72Wpjc43aiICEqIHd?F$q9j^Bnub!E3o^mne`=C zhuB~{w@7AjTaGZ1R;Rm&)=3gp@1o@{x(i4Si)1`V z;#gP_PXn-DAR}eS-_i6Q`sq2!!n$)K4?S{61hX8*U@ylXro*s!#_p!=8HncYogb=u zoZW|Va>9WXZPl~!zrx9=5@y#pq<;)?Y)2X#PQIV+$hcSw@@^A}gw?+G0^X9sU)qqO z1D=o%?fs~Bj5jP#AW)-)%10CyXQDEP%Kf(DDyzKL+vP2UFF2Ifap88jLWi>pU5I?7 z(DlX$rKTwLbcXyWik(p=d>3Ci%M}!xBtS=i$9Cia?p}@$*}_L?aUbgSl98hqGizt+WmNVNzI)9z%cn^5`I`FKYK;#-(t3UT?KOFBL-)Q9is%8-o}x z*{4^BT@NmBnjTGVj~E#*?bUwsjzKQ@y(ImkPV{4}qA;$8)_Dhs)-rNv4OVZgl7PO$ z4kV(ADy9k&^94M$(DDN3+4 zc%FJb{Y6%%eF~fnOig55b2HRwC|?1&(9;XH@`>Z98B(-%SLBy72+euv?ZvH*pB>`?S5n=UKn9|Zr|uwAC9mfW zjGdEtRDKgkxb{w+rI&cKes`ktN4qee8-=g1|eC$mX?bCGD3*yR|m;v46dLpg~qsswkgZtzpuaP9R5Tn-3ECd)3upEaKIO3RkqgYoSmyS&JLwcs3(&j zxZ~nOq#1Pxoh)$53arET0~Tb?c`+C)LC*@!MujUBqOMqQ`G=~wQ9+gMIN zX0^=49#!ax)u?;Mi{{al_mOwu<&w&qNiSr!G-J2e> zql;={6q_4ErrzSUro(Ag9yz!g8=BNYp0Fyq&Hk3xeo%W+y8E?4B=&5}tE*p0r@LR( zDxRfypQ^wO9<;i0#eP3L_4&w=AGDBFSC+(2f)oN(-7k3=2?eZu$_?`^Y`RGMi?K~c zUGCBl5p%X=y-;j%h`SXV9`in}b?pH>(h+O>WVR@ZGwW0SigW;2Qqsn{?8jCB$$o4I zNKPt$8AvvpuLrU>o39DI5AQ#F5x};yyF|Pg5<1AC!)SQ+ZOn_0VRvYD;cfdC^n&eZ zjrJ*pFfytdF*$No2~vZ7J$dnCpQuCh4EO8H=vI1Y>s?AuHiJ@n(z^|lxb?LGXy{2w zx0@+ygo~V@h@}Q1hF%vR%2pbZ*n<@13qVqo%YcR!MOly220B$&Jl{$d zR9`2=9yPQQ!k8h&xhT6P=O&ju8oySTDY+QPVx!`G><_Ve<7oEOr7&=HOfBBPrLlLP zc=*b4nKg8adT13U8`!ksk{Z${L+i?Y$~`HSBvsb%l>~>ihvwO-UFu`r4lrA38L==eI7_kmQigCA;GNf zx*tN-@cB`l&%k8i^$gctPPv^L=4gEH&eHhKDbLES5wpYaxl!#z8GIU$D1)i9L<3EP zXDfq&j?h^}h+;Q#7FQbDSuUFvR(5C)k9Tv*wBFEKJIq`9t`uL4TsyJIqrMZ3EcMt> zVmf^KCI3s)|HQ~LxBLFw=KTv5@4x=&I?VL0a)$1oGrj-MCXGM4bFsnkcnuo&b^L=6 zFK6kYY{WSel3Ad-AGO9Cj; zL*d@g3@kN?N7I^0&J58uhMdA932in0cs-v6`U5M(Xv!5tMkM3#&+DNrJwZVi&2|xq z8S-|Ki@pl<1W(*eKx0Hk{rIc=uIA%PzYC9=RBalqsJ7}2%{oH0?{=&Gu3K$ERBaLx zq}qalZWvWt!me=9H7;5Lw4N(Vnr*k*SPGxOOp28ESaL{zkZXjj74o5;5}QuT863{Y z=;aYX{aHD(^TI;pFWpGfp&+t)kcle-B-_R@_wD628s)he$kw*gO^p93WtYC7vI`oi z?DCe%PAI$V<_QSQIBI^Jo>alO{=EbsJlURliKfKK@C2Z48L7^C(x18KrsYj?gOIHa zY7O`i62p~_a3D)=z{O)GZD7mUH2PhGM2DWp5LcPpx7Zed6Ccw1)I_a&`bo-yrlx`4 z>E<5$a7Ve=3c^SRPPcvPf6$=)aW;Z|IVy)%_f?N$K!=k2DNsUL!uUDx^_BJ?0L%}#2&fBj6_F$(B!Oc!EJ=A4C z1hXIf*$;#GT5`lUyR#qGIu9MxOv}!VvX|0cXTR0fPA$VdR`8T1_gFPyztz=mt>&I~ zlvHGQLSq4TC$KqLs&a0p;R1BX-x05x+D7bFR9G}}MR7$&1#;fyb|5)ecLM4sthxe7 zylX{)zRJUtgmMwHSGkB>l}Xs&yXc25deTLkUGxhV9fL{fRPRASSB#68t?pwDr> zbPV3+57wRSC@hmy5x_JdAL~wPaW~XH5_9-;F(Pv6<#%>8HgM`|^P#oqKSU!%I5B2io@%u5Ys*@XXD&g9A}4Z0 z8L(05hcAsi&KtOBqWa~!@^O?gTy@>#v|%<{xC}-N_tNf^I~uTHaib=Ug_v1|jRImsZ_Q&5#_- zk54igcF=Yzj`l3aTQWrnkRlKq&d*jnCXUxqV$PYjmQ9qleTTs|60?NHYk`ECt_2br z!lCbSJPf6g+*_YA$e`q~=pK)~gIGRof5NUdP=(0MIR3DZo$^7S*&-m9gZ74KM=5mX{_gdssRq zrkMea%`F-AMxM;1-HXqTN)=$>7xt6q7C z-{ddO0uq9`z(rL+k}rAAmsH|Fk_ufLCo)Z+`*yqg_5|>CdHZP~`IbaGA*@S)gm2S* zW3I$gjv@}>+j9S!?YXn%%{|BQ(F4S z$A-SnwxLhqVo+3`e0Q)QM%&64Www=N!H~6X9{vtm>KhV%494NKP3YVi% zb1J)~uxNTd{Q_pp)okRRC1lX(%JR)MJY8<1Z6G1c^MHgvNO>WIc{Pv_CK0O;<~M*0 zCbKm_LYNyVj8!GS0TPlr2qc6#8YNlHU(hXgLYR|)evZikZu@~G-+O?B%>E8YQhCP> zI{+kkoaB;T3}~j8QmF?LB4lfJP8q^e9SSjo2uBEYL@MxUZ24v=?@nYZB2_bxOC*uH zzQ}Uq;?P~>R!Bb0c&7gV+ws$g51bW5W^g-H#}bE|UK^#3&+wQ26WNLfS|2-sr9dQ0 zV^L%)9zqgrEdueb%l;OSXu_4P__Y-iZ2?9~ESM!*Sy=^}2YO-(=dlG+l~#bqImkzp zq$^%Yl36}p51%_er-HlU6_p+075&ICK3p9sA}Vi}iPk~t=5_X-7mb$1FNa*P=u>`psZD>=9E9~2YuT9~dI~4ztOAvn+nYg9;AH4)= zW+qJ%+9$IFfuS7q#2celO`fAvD^aEz9CGy!DHgk-EhN=7Gw%`a-l0u?nK5*rY-RMu zS=RUn5zxnzQKg$vjhoRxGE|giex$T8tc$SlABQ0$<2YUC8^+$KMp-xeHjv(x&UQ~W zGgm0WfV=>P|LN>26tm7fn^%|97e{}C;`2kymbe{BCV2)-#tYRFmk##6ak{|**BROe zHx~yU2OH}`M7mLcuC+{uOn8-8aUH8=mk}{eovO9b3iI(gL=y&%o1cvcqCoey8G+6% zlIY0gr8sY!fVOsdIb61jH6-0l6njXRmu{?hv^UZTVRpra-bf$)ZpTr}6}tdlA@F;E zw|gV|=}o#fQb^}_wN{M^LUN;%4oUEEm3~W+%PR`-QZA{}e2`JAeVPw@V#TxlL&D4L z@F2E{f`04~Ro9roQlq+-uF8Bx8J}TGl$CB)m_gBfjvEmw6++(53Bj@a*ef|9uOMW5 zPRMqIY{&`0srJ~TIU$d_nRf63n{>)u+`gH!jP40WdjpS~b(=yg^3Dq1r$9o^w*wu^ zVb21sVnkX7F{1fB&`J(V12r@H92!;5yj25<{mDERUFRa24dpE<)C7?XC+Pb?a^~&l zKwXeuyq*_#x6wDFpZr9@HklVp)}Txz@wot zxkbE#NU1mSd!ithl8Cf$@$3qXz)1iTdn0F2j48d5&kK!hM=nBRb~?k**da6`Q8ALI z zLX$8Zga95dcUytynkL!jLEzEQK_9mt(ZTlK$SxY?E-xT+s}*X2RG8T zAZjZ!$4x*obI_VeW{!Vd=x2S??N4HPI>M&ZcVq#Uy zGE^ijvQkWQWTnVNQdmF`hxgNYaL%WG=4BzDF<7+Y{W%&B*hm^}@rC1?SR;H>mJ zL%ij|mJCvIxuj%U8)%USd1#*%qS65Hfj_0|oBfKucNJO6Vr8;>eV@6Xm7E za?4ApjZj|QE^lF0c_Bf*6u)TL@@@#NmyBU~kzHPDkxY4Csy8O$UVu_`SA21AaTU@O(@@Rbs7tQ0Nvp?)dC#T@cC{n9+79oi_gzId4GT7r3 zM~#^!?^a^BAqd|c*>)5Q?M+nfZu|1Av(VO}&?KeDZA=O?fJC5e0TPyWH;`CVtN|+K zcyt<6tS3l7CMUaI&md3>zny?)mv~k@NVyi{5e(#Ml}X!X@t(X0>dzoPF&erqg#YovuaH9EwiI%)Po1dlVObJ*13z zoj3u#;wEJ#nv}U>CDGgQ+Pcxx%HrN>=Ol_kPoeOhQ~~Z>(~WB%44I*lGd#z^S+fVM zFfl0#%`>jS+1@l^dh@h1%M+iPuB{87nRj;W!>{OC_*MD@=Z}NXVq=qW;eGa+mX9^Z z?&eRC+Q%p3Xtv$JUvv;@tK^DZbSMo(Zh1e?it=BQ z=DVgALkIaaBEJOk%N(P&^8?w@DQe^=uZGEwiek;f0&Q!$rW70{@d|R=PmZ}0uTayh z)LLmcw03ECZREz~g?f!24LM-H|GxeHd-PuW*=86?Mawp+s?A!G#+fQRpqr8HdR3ox z`)lYu4Dnr1aYW0yRB|wH$%RoXh->vC+d*=u=>a|b zEE^Rq`v98|X){=I25FMv8w-Rq7}Q$n?DNGQ{J}R5(KIkQa<^@uh0$}BG8f)QevZJ0 zU<_3qRLM$D{7iUMsWox&;ccg;He=C%0zvPNu?5YntSx1w-`O)N?d5MSil37Gm)dnj|>e%@$2 zPyBL$CAo&b!*5{zEs7@`K@-bxY#c_g#D4{}I&T*rwmmFFJMZ1RNCKI5s@Nm)vuFa3%P*b8plfprt>EYca_)knd`X$Pu0j zK}jw=5A%l2Utv{e&nYJ#%Gq&3z25k23JUlFt@9W5gc8D~SOvYKWkUHe-71EbCl91P z2m^~@OKtXsv|?&lzFl4v_H>*dRXD&7^k-F)hH3`44MOh3N031|n6eZ6(sEpYS)TTA)z;a?s@LdHqM4X5``oMcF zr@rkjG@NjZH-UuynMli-NZBViu0OuqCr)JFcM6Xh9a?xulCteenG`6a8p8qJnNWfS zBe_}qf}20>wA%cKG{fBNS?*)+!E4%)2|Dg$kLU*d*NK9@q*rd=G##N)I?C{FqvwmVuJ@HHYL4 z$7&etwy&%s`c^y5>3Vp|LK~v5Y>!#J1;pks07l%XB$EUw#NrVP@gW?hL3i#BLX@G9 z%7Re{hiQi$h(Wg$H@c<3gazU+&DlJn^epBYwEb}sbCO{rJ%eWO@~N(m8fmMWQi){8 zrmEPQZ1mfvs=IMRH`cdgCqJx5**z#K^K4viJr{>%l3&MCg$+-WUk~JIt>k>hSr{LB zMj*>3wXrWkI!xEHXEhzwSpi`tazDvi&I)Udur9|)hAn>Fy~nl=#5A71AAiM0XAMxs zc5~%pYw;Xxf0}~fZ?+3RcuNF>-<41I)35P#7k+4#SZ<3`&NLBo@}7%ZQ?gBV$fOn_ z_w1$*hdPnv)G`9#@Dk;7s5$4BDURzNH>X(UJ?kYCZP_#ySFJVle5CYm%u1gXWT-AT zMsFK^kLuc$!$N!*x6#t(rnQHn+VUwWiD*>V2W^HpcO{e5vxW>mF}s}Y*lO$UPOta|*pl)XsUWq^nfhA?PVmuBByOP-mmYLy#= zqp8(?a?PjYc${1}%U#&kl{h|q2lXICTj|t&?}HyY9KpHZ`H%nz-Z1VMvOL>XiY}A& z*OfqG??$#?V&&EbBvzmQ0Q4d#7Poi;)%XZK4kRj6;xe-S+6N@|nzZjDHgzWfUCv+l zfyBD*Y#_<)JRq^IBNeJljcq`ZiUlMozwEyKH#h79AhEb3H)0}T5CafY;-a&FWG(n5 zAjy|*v6foi1|+p4ug6l$e*ltN{uoGVxdTYb@-~o^kM_r;mOh~QTua)Wl3JbtB)NSS zNNP!|L-Bf{fTX02ZoE5zq*M<8NvR$Ol2Ua6NvWO(l2W||B&DLeZlzQKASu<^Kv#09 z=zdQr6}cT0^hF@Kt8{@I)&TSZ()4<60+PE*m%DFUfuu$TkksgJfuu$c0ZEP40!hz| z#j5>eJmJhZ5ZyiN^-Ko3ic3`i^hFN42uSV>4Fk#Y=1L%2N;dCoz|eA6>5>lCNk9}4Nagrx5}hxLiywi;*MCwHU4o9c}=DcTNbG8a(W{>;sOrbfDr5vu0y)WqgL zV7Uon@$<<0Svh7#m}xpf_X#mu=%%|Kl6#Aw>z&wirenvct?Pku0IQiSy-PFd36ZXD z(a54D%^gC^lYnmKRwcVQ8eLvb3}^!P1KDj0o&7zK&_y3mW<5gdb1?(MYEU=7hBX3~ z=QsPJq|NTt$u9bUUe(n!dA8-n)gkac3mrC{l!fLhFKV5NMYS|jueZXpH-)sbj~VwM z4OP{v-Oj3Hvfd}}iVbtD!04#CO(nNzSVuQaq{9GkRJ7v_Rkl&D8f-c)YI#p0DZOg5 z(x&fr&lu~*b;$p9Wh^R*nZ1yQW0Vk;CZ%-mHze9)oX=2kX+B2|glEQLNj7xG;l2nW-v?i_7P1J)HqL?(;^{uGL;JkFi^#B)V zTNF(s>a8CD$qC*UfMgHqRTq)jymZ~Cf#hwOi^!ZrIdMfN$ZuaTq|LZyKO4_CNmhF8IWl>K;IHdnp>Q#TxRy~X$Y^;GC3yB;rV25}% zIjX9GCTJuuRx;$sH}%lhM3|t_rpDA5^*AR;fdyMQKcZ3)HcE1#PTToZlFgvrtio_{ zahK6a7;esfwITu|zvN^Pu$Yv0bU2W-b*${+ukCH$2+A#_^cawk(oP^D7Sj8O-M-Il zOtR`fhj}C|ZOx6VT1eYmwK0CW$*4n_1|8^yJjO~ua2r0CNIwlzMREq=^K*sS_5kkh3pnEip+kvM6Wp` z3U+0_lYGq|ABE@3%HWF^<%IK9J@Cb-7TNM}QG9f7-XxWV57FMd#VxOq#RIgE7*GlC z+M7}*02e`s^{)L&>X@!Q1^fB~{&BVNiQ);Hs{@0`j~bz-J(TxE5D&efd^DIIsM99H z_d0i*x@NO@TZdX2Yr!zyb*|=3H68bifWwqR%%~@wwc}2NS>9@{jN8Go|3*!N^4U%E z&p;<|FTVstQoPsm??C^Fjg}!4>S`UpWCfdl`;r7@ra|R4&%E{f3FR}7sLW$#4Ums13Ptw3neO;Ni z`LXkLo7dc)Ix(SPgDY@88?~-m&J!?$;+4Y$Q84*q=q-*3H=OaozCw z(W)IyC&3&D50PDTFpqZJclCOGo|G0X+rf^VZL?}84{gI{9OeIRPZ)IznO(^}Z?|m; zYje7AHscI__QzqqF<1tD$RNsgpsfo#na_syb@?3fs_)A?_p>2#)JqM5H{SRepe?GQ zckPVS3}9*~@7hr6qV+U?h1N&#H#NzPRG&J{jr8Tz3G1)pNY~;of_?Zv3wO1L@_Vt} zi(>48{leQ+v)C>i>%g(}u(@5gBKxs9{(FZmss2v1$Sx4IHvr>{zIM92m#LMg6Si(m za%Y11JQ5(YJ=~eVNpv8ww|T{Pj_lfF`Qq-{54*{JE`Nu;M>co27kgT%J=$6}t)V(W zzzJOiQXhGbecS1XC;X8#aNlI6|6`!r8Fc}XasqepVpM&B5y_dOFnYWmQicoLxCkOn zBeRVqKq8N}00{&636Q-&9I`b|3JtF(_P>|!M(t_FKBU_4BhbulG$l5IAI8<9_h-{iWEUGe;~FJ$qr$6qIIhK(uu?{B70f-a zZGr*nR|4g@0&0J##1n+XaW0V>rhOPkuZygNrK)azQH5#d=csJ)RbaXod$8U}+zl7^ zB-&xk+q_~WZrM%ORHh2jH8`f4=+k^FIuSAPpjN!%?x>k4t&eKA?Sq9g8S(BTBi?=F zNhD-OO4y2bgKfndUyK?SQVq!(nk*Ul;J|d(xav&TxN3NV-P5s}-Q*bT{+w$JgWWzd z*zJVE``^W2w-e@6h44RPt+<;Cmaf;9{QoB{Vh5EBBY9m#foKp3{mKP->i%v3oN1s#nLE6t>UW(0Fv<5cJ{V;9aCOr&i zmFQ;3WvjR&;Ro^qSY_ZS`HkpxbbFtx$)_XhF>~c$vdWwM$rPr0}6M-u{KDoG_`dF zq)I85GeYg~M@4&P%h|n~f{&wSv=DtSs!b9}IK*0+-_}(h($sdGcd9q$93EGplDtXlFF0r>RNS_)lN)&~s<|hi)=JlN4B^SP6IKYSP?l6>? z$PtbmpnqZ55ZsP(I%ilK!e$@4j)4JjSPO3q8{+0Gby7vz zzMSuYKr=oFoAQF@DEG2HEwYR5>I;qS&%Ug02DcK(7X;xJfOa*Zk;>#1ZDb}ii}~EcKqoU@tOMG~=#N061gFEN zq69Aj5+(R4K%xYv{W4L4(;kZ`!KVS)O7J1B1?)Tea!i`ddzz8g$8hf+*+WN=lw=*e zoDW1pqUq=4vA#eq6*!CuS7d;;jWk`v@$JBR1dvQqihJ$*QF`vR%#cy${32!I0A-iF zFh8TruNJAQm*Y2Q9T6l06Q&qUbr@}mnl4Wic4bV=JW)K zBh_U~&|#Qavvw0ZU?qs6U9m+ghS&zd(-|$wypP_{_^5P8TT5R#htV}~&S(G!!Hym5 zA=Q6#4%_C>0H_XkzE`jHrd4?b0_KW zZvu(TM6#81(6c}yGnp-=)HX0dE=2={=7Tz^$+KHYb{fz`eA_*3S)tx^TPmmlrVS)l zR%{8a58^Yf5o}J|F!_)@C~d1y7&TuVIcp>;q9zuOr=E8APcZ{mJ)^CnQI4a6TGLs? zEWNyq&&knG^T2qe3@e{#bvK^IBK)dI;D zd5%KzkwD!*I=y}kXpVDJWqY!Fu&o1a7hzwUy2)0##eRzeg9g z(>dQzGM$$gg}zP|M$C1a5yES^aG(LC!c+ngDApl)Lh!^{O8##p*}tqZ5T85q3~Kr1 zuq$rnodeqQMSkeY2L7@)Jgvc#iio%UUUG^xkmYUv9c5i=d)p_67|5F}{UE3%nsuyG zxa6|^*z2uAEuW82C=8<=vk9syN`f&xubCw#(7x?^dxqg@Yt0V!O9RtF(DrHq=J zlxa~%Wifr~(4*0iXUzze(ixcN=b~*u8~9r~ZY!gjt`!z`MAnVh z^0y}g$;?3~;$-G11Cp8JJRsXt#LBgtbJX?V^&r1DhTK?KXh zo6V?hHtB>(G=CA2>8*isd+gU_DKfy;$Pl)M#u$pkysgqS9tJeK1E){Rk59%Tf4OdY zVmSK^-)GfeH$G)1*B}N=%yeyfmtM9px??bP(Y|hP0;jC1ks)7%2enFdjl^!J*w=Vs z1r%8?=%)B%$nGvkk}Iq>cE-mNJ=JjKI#f$f4H}om7ZPwZpnO(f=&hu9pEXNit&c0- zaPI@w4E9>zmM~yx%tkga6T@TyVaXk(;F$NLco0#V@k5K=VeD|xrCF1eEbF%*Y=(>k zpfDra!jbWGp*uPj0Lkdc_&K3lNU^Gl(=DVQfCWj#u@13&)n4SAAwNy~;^!^9TXW_# zT0+&aEe6^WM-$PR{ve8ky+LkIn$V6#A?yi_=STkJC?>RDBb}q0(0aoc1U(o5~s7h){x!R&{``%=H=CfYU*ff-R#rnd%!2|M`* zAYmOp2NHHdrqmKf{*Qzad>JTX0p@odC_NGge!z!f$U-=~AKTV~>R9CgAAT=#&ym%o zZn4W&Om28k&UFziz_>k1^P6t{gccVt_TZK2CKQQ{7FhCNmn9e(`~`#roBYK-gb!~j zWP?vQ0?8|OMi?7HH63LC1tNqJCe~~x)9)HSSXQ(1akz3tBUC-^IJROo*;z54d}qZ5 z93Yb&B0ubeNZJ^=&hmjA2j*0!_UI~uw%|1F%5dWyp)$6;QdVV}S2TJ)mdZ%dYx7e1 zP%*$g7`i%}>l9(m0@tA-!Dez-FYNgY8dOH%mw--11g~c`kSt_=03_qF8%X42vO@i; z%Y>FPdIMpyxH;e=x`sf)#=2;{i^y74-qO@4Xo`!-N!m@E@|8eRmahXzS?&UovaA7; zviu8>l%*3$((856b{Fk-(W@?c!$p5^(fckMjYgERoB||NhXqv)D!Lc{Sa0eqo9?VV zG!*tmJ!a@s3~M-D+K3Lw)uS@=$0`B~Em(LBu#4#zS&Mda5T=<$VdLiUeW8*(>dL;5 zpTr>q!;R9-Agi0fe0lg~`vSxc1K9kJocoq$7Ll_toQS<8sEiwwZY;$Nwz7!wEv5Yg zbGz(NII11YpSn4{?#F&e`=NBd*7-Ue!p78k5=H$Y&ir=858bh-H*ToK;Tq*h_>$N7 zj!(|^dCh9yr0VgB(qQYpI8+ZZsgho(4tgP2j^6;g&!v9&?IHb8=;}}4`1)mNthGFh z7Enhq`fH$XF?s-KB@cKy{`F%Hqh+tCj7TXYDkD+~iOMJfbQQ-VPnV)Hx(Y~CM)g1< zYvB}vA4$5yZ5Q!;G& zxCFi;my`(mG74$>IRUR|`k6>kd@O5g#U7Kd_%qxo zs3%10I2g}zax_Pqn=yeYnBS6pyU`^15K9}zzLFKNoXljTFEdj$&=U~Ey&l~~^IfzY z=sIqKZvY7mKL{i=Y&Q$HMkl9XiqOxRfLTF|2_0rhEulIxcxIFL8{!KgUY_Ao=LS zc7(0fXUJg?krwrQ7UeyK2Mf%aY59+Ja0#n!GZ(y}z&I$Mk1dbaupbhFsWW<}?Qig9 zq~fjmP}PpaG1w}5W-swqs1Je=9BU!xs%wg4)&(^XcePdnuVPibOV6;Tr^z?YrHJJC z#)(?NeC#=%u8bKCyyZ4i!Q4u>ZYxn{sb2QS=#GQYnMJ{_!S+iijducm^gP1q<+!O|Pg=6tL^ix5GTJ*RdYu%pGSaVl1}Bf8@~osR#{zz04g zl^55r2#)jdk6+lsWJYcB(#E_rVr91~wIsFb-hF5^j=7B-c*?k@))I;92S7m{!@GdQ zINTlyaCIPkZLe7r`nE)`@+`ZA`aFIt{?;6fkEWrKI2-S3($xDHW}br_VGKW+MfFB8 zjPLPDy%q-B-Pl8YleI@cQu$hBo-NHmD(4Vb_hZ$MB^7msUs>NEA&u5Iwp2vNR^T_w zUGH#r^;1Bj-8zu6?y96ohVJC~TOOfsMB;h zAXwuf5^N;w2^Y}{UcyM^7WAr%QZ6DblZXN2-__N|`Vs7Md|MzGavE(34A#1U82 zVe6YuySuzeu~Ro+q?@wGfC{{E?~h1A-LkJIKR!0JuevcG_R}J>LMZXIZqeG#LE`YL z)^-MdIYtzoKR{n`Z^h0OxCH#Zi1(2((W#d=EcHf>%Nr01iGuuoRI0M=U=a~C;a`R5 zS}HAsDL`x6MFljwQ*+FoHrg@rE4p-RT)AGgrRnQ2b-TUvW9pNgR4VGWtWJWk z(z;V?qm=-4(pLP&uss?pD57}8&ZMihq;MXH<~i2RpsQwcSIxG&>T+~dIi39|>qS%R zaEZ67nUczB#GCC#+!DWzMAnj7*0f8hB}=F!k4Iymvv-ka83Rp~Sb6XL6Nl-f)wV3-|_Y;GdIl!9-Fjj|kKhcFsk+KBKZEOUH z)TNS_!0$j1G@0x=2ystabpf!$+DR0k8AtAQ`hP&K&rqo0p>1iPb%1+0+G1WWkbeif zT27|CPv9TEan{fli-*dHG`MakB8_1qv7A@vZOw=b6&>xSl8=eUXn=>?A8W=BJW#B` z58k>SDAv+**m#V>X$BGfASMc8$XS`v+5#St%6wVnVD;Lu6i;|KNl-P)br?~&ESm92 zX04&*GRn5$70%b9rkqx$0wWaFy=2XGOVNBZ8F&xPKw7Am+bz4o1v+jAK$Ei08zXxr z#(h`ZJCF`S=zx4p^D_kkz)FF%9OhP9V$re>D>5vz&gRQ^&8-kp=Qv{P|7Y*L1Vpnb5d1TS9e$Uu=B3cuqMQ4)E72vRi3oL==A6_7d7f( z5NxG~ClD~=Wr8^3Rj0Dc134Ie1G>(Q$60K^aGZtSC`H4YGWdNfxW?DuLIZkuPx7_^ zFHmO82FM|R=!x)wfauwE9P-k$>stU_W5+?fQ9sBGPa1Lo(X;C}0MRvZypTXwJ@FA& zdUhRe*$-t5Y~%FAI^IL2UyJevM0R}v(Ua)-7Il4QZ6P4iyb=&;ekX4ICT_Ka-H@JB zzW|7i^LXZH#I(SPzb81xj+%M^j?-GT*RU#|I){O>f=!s=yEWdqhdb;v;fUQ7#2faW ze)Q;g0GtYp8br4?;XPW?Yi|SKnmC<5Pvs+Tyrk^QYY+ST0Wf$Egp0|1Hx$q3)mNOx z{f`DtK7j04rQyJdhCFy3h){1plmM*A0G9Ysfc#m|696@5>t+H{p7^SzN4zfL3L;|C zlxy)mD2{1Iz_!8}O2W}Bc9`_6J&cgj%y`_`HR3&#Q3r4U0^^N^_Df-z1}8yuO48s2 z$eYf}{gFF93q>X_#!tT0{i^Bcw)mZPKYlGPE04+Kv7UrIv9G-E1zE-?^$T@FMej_T zj>YR)L{|2-&=ccu8ZMYBN9FaDHy4y9C9ey}qT9qO<1y@Y0nCGj>{JRofL8(V8HP4+ z3j7gg8A{$2U^;du7y}{Z#ONDoFl&=Cqjv9Mr~O(GRNZ?}wGQQ}g8GWnk{0zp5GnR~ z_hL6d+fp{uYJm2!Mu!hw?q{fzh>}G#7SI8H)3;>c<-FXFzxnR4!oO zV$F5{yiZJW_;@un`|*HM8Dj<@YWDL1QM1Q>gqrThgCgcpq9r+MH%JxPkE1{1Hr++TK?A=*7RO`j&N!IPwT8w}5L z;XQ=n)dSPrGCaHQahT3p{U>&F4VY+%W36`n6Wa&+MU)PJA!dO4@sv_<-l+vTaNx$? z@aKqw_B01r6XWZC2wt^t$j?1D9Y#RSWBh7q!_ckycsA&R_cWXC7L*2X?i(L$z*Cj* z;>yFikoF*Ug$HI5Ht)nV{@46fDpO~|H=IV@rnz4 z46*MD?{^_2e%Z&aLm&cCYg4{ zC>0c?7+mO7_|XbTJR32)p@$J>nHMm&>lE8(_LG>Z*iZyx^TVqes@Nc8m?H%>Sr%WP zjPY4OTz-?&yB3Kpl*NYEf4X9Tg=2$9&7{FeFV^9Wd$`~SM=)!DxLL2j$!c(J3!W6< z4|oh_6t0~m|48qHxXFXcoAA!H;F!%|PMOohKlUBMFCf~AvrKC*J~Ls@J^ zHX&rEs_cc67>=%Zu@f1DkTHlDtj*~O1|6u);SCC26e5cdvPKZgTu(4}HWAD_7#A4k z>*whv>4YLH5kHirvdAWc>@kd832h!R7D{z8VzQit-$)jYS4w0dvQVly9IklLq<<3W zSBh}GxOb|2AcVHa8`OytAbHWGce+w9Xac{5f8;mnPW*}fx&Oj%)S31Zy^EP%tzv2` zorerdd$G0%VQsA>uheRbvoM1si?u}vYl~PYg{MTkXwtvFP}E#6)|Sc#LTHQhqRyT_ z(YsZtw{UH7{U!U2y3>E6Kl@+!jXHR$u$R%W z*E@&|LdZC-Vrb}>YKja($T&+3J0rm^)ljgDG!X1M=?iwwdV-x(xdQ8as~iv#OeL|^ z7PSyUEf-aGm7aD+nzA^G3_{4bP7JmFX$7aivYyBygsgmGSsMt};HfouY7L%RJ6RNz z&NpL6RXm~R#Yxma2sJz;4S4ic)&dUpd2tpQgpl!E#ZVsarN`lhB7+bz-biB8e7tWY zvIrsTqsorbvsTx&OzIiF zRFB3KgpgsTVrcNpU1ShKhSg6!Ya+4;A*n4Sk_(jG$n?d4jMUpf&u-m1?Xf;v1+s!O zLvrk;gitna)RLh-ynvxCPW;do42B5)vbORdS$%nt>Iy)zvUrLP5JCrBn2nMuxw*(9 zgsi3-S<=CdaFzaG^=>K#H`OA#;EjB_WJzxO#3vQ8&9KfB;H6kwpku znX25RQf@c{zmXi~h7jh47$_A8f4peYJ+V-3xL(YS%D&11=|!E=VYeo|(v85T?=DiY%7=?uAhz{%F) zZdH~Jq7Fi+V;v(&PmQIFjv|8)GPWrFlX9f7cM>^-kn=lPk+dY~33z9bK?oVSMf{T5 z2of2Dka3JL%oT=$BDJERh_n+F&J_d&94gpQL()+2;2Ji+y_3B4M!{ZTL!IBTL3!yDM@Vsugu?J z>q-N9%urcCFBn4S-!N1O(0hie0s72PZ9s-}V9FBoWoDO4Pm`G`Yl>w+0Rp^`Vc;oU zz!-0`Fr;OKi3m>WUY3c)x(Adx|VV$okA!)O*7S4hm=BR+7WLm=Ny8 z#6YPg@W+cL-8h8M7O*n0aJ^V7D*Gx6q!)FzMsa1)q*sUOr7?x(NPCHq62e%F$QyQ? zDjF%tVWfmGQevn_s!4b0Vk1@AS6Lvv>XB;FYfX_#PP+V+dBH`97$qT$(vBD~6Q6vWQw*PNMcl4EK=kJ;fJz>iSZLc z$ws8Zrj%fip_8x58=UyTR*YSx3)k=xF6ttLx|%RumCWUWIpk8W6S7GUE-^Ne#r1?R zqr^hpGvJRGP5N;nl4`Hw-e4Y8J`h4%q!)E=;z~uy!W>_wSAC=&EMY~6(GtRF+cK6- zB^{x3jILnpY$+JOq04(n42M6AQ^uGWXLlwKfc>I4F0n+3nhBxiPE68)ZHEs$CiP^i zKvoE4NM?XrN8q7`&RKNU3Qn@MMNU$rCl1k~DMFw~h+x{(L-#`E%FF^ZAi~j`-(OQp^cGDG6rp6K|2%JDv%W>GbCf31=a%{qGe7p>GkO0uz{D| z>==$sj}Y*MsZ0rDgp*u47l-8@kwFL3`rZDuSw1nV<7&cLlChpmDT z?oPx&DF^uDMU(EGD&5X{%oENiPB$@7N?He+bpJ-WK~m}o)+|XEwm^DOr*!bINpFs* z7lg&^6{nYSfjaM?xUy){dz9(*=uG>$<`di$v3>|)4Clz7Voq>L4(o>y)(9 zMQ=JXBxmCbClv9N!3T{pu$#hX&)^F6Qo&JXC3KKG{=SoBOf@);(2MhHC%Vv>dO z6e4;S&QOs&Imv8ruiH+iBA`TVY}Z$`z701jONMBj5L%C7k^{I1E-^O=q6hsLf)AlT zLvlTQTLR{X%@RpvD`n;*a0NamD2#=s2%{W-Sq&NFNro2*0&yc2w5S?^j$m9|g-_7( zqU6I@LdY4!BxAWq61q5wt;5DNh9MaU+SusBIN3(9(JC#JE-=eC$uUYY4COSs!=Y+D z(-{x9+Oc>@Zj6{ELTG;ylXN8k`a~CIi7w1#2tI_x3>mSLhEO+@rMn&@LSr`LH?-u( zQiO`}MOfPSK73^xvjU_X-Rj^K2ukt-rc;^Z8l^DHS&V3uC3Kg~)Oo1))@YAh3zOY} zlHCKT%0i+buOy+`WlZBg%-2>T0lk7GUlYW95kmFrnPicC?O?01%CZ@P4`Cle|GW9x z%XBL9Rh8vy3gv6kFXW3vF<*o*po2`KU}FIn+9J!q1-H_I#Ra1~v;Hly4@rEP}fP?3@W=oZuV3w_^n5(G*F{P8kHjGqw3 z|By+>a1q?6Ua?ge`x}Oe^nHV5<~9bfmzxMSPL>5_^3C&1bBvRWLJh@U#v1i8Yj}+K zB6@QW^()I%(HlbO%{wOPz(r8{yXcJ;q!{j3vSWlpBb0H(58M&vP*MTyWeBf8Q)TEF zYs=p1*y$<94$Q+ku$32LVwzPt`p~oF@8B2>muF!U*C9U^!i65JHAo5r*_A zHA7?&LWUJF3`+@yUb+RPa-3r!v`5iYSyz%&p27LTH)vqRtCSNnB{s>p+pibVwsF zy#ly!m&1>`l_bnrV&sG{az{zzMl5oZix7FFA>(m2Mot`zoDfE?WCM~$uE~ybp~$&j zj9ldlA&i{#qE4LF&5I_zZWKAYEvyT-h2i$F6Wtb;UTc{xMotJL_avs|%pisvg5?~M zK?oTwiBZ--C>v=kl!X~-Wu3|tnCF}38RwAA&k_yuL=A*cgFj^f&!C+t!<>OzNe<&D zgkx@Epi~zv_)r#2x;v0=r3BZD8CKa>Ss=Zr^X54_>NTgsa*-G{ zA&e`XG^pJ=c9yUfi!4IO8lsWqE@3SZS%i?4!B}i`?!;?FecYSHWKdD6MB7qP8zIy- zj!DLFDa_O~whCm0nG6*lnm#CJR6amAJlAbe#}t-N+;hxxS07!X)ltNR`B^ye;}Zf4=tuj_1GdqDUCTy6F|2yuJCIvUC1NS+w6fKD<-O?{b8 z=Tc@LODCB9p;Nl8S;JBm;Z}{TZOaAQE|S~zliBVsr8sHZsIslSz3qEpl37bz8+TKo z=791-wHRBWa%yv-a-^qF*}0ieS<9`+G!uMc+a7FD?P83dS+xKVZn0b<5`VeJagG_(cPF0UM_!*3AmFC~i>Z0hU7v=+T|ewi{vSD{!_%0q2`uvF^;QqGvHCv?-6 zCCKN=WYV(=Y1c{=;3>&yxinMGy4Fb5?NjWiu$8O&C}|I{SB!uV>ak{eD#5!m^_+3! z3L`i6Nqrs3p+-X3f{B4rV=!K2(WKjsbmKYIKhlkQ*ZoAdy;3)s=RRYORI#bNC!bL# zzBrT@O+MHBmp-Fje8ng)nsnD=x^3Y1r45|T1cU8#%R3M#h3o7zR|3o5#X2K|b=HXV zD0E>AS5DB)XZ>iPYIFkg?m-G`llC=i-Cm3XK)_e5^0HslP6)L(VUiA91f_l0Ds0of z4C$f2LLlo5@5)$zO4GYA0o3O(O|199E85i5aZ=1P*8EMfAvE2#Xb@e*Ai6U|Qc|MH-mcr)3wbcRE@RBRKLI_>y$*fhfl*2PqRxq`r0u$ye)J3wm zZxO5m}&Y!9{-qztr9jKWrkfqD%kZ9$XnSkeuWQoXpBk#u1Tq!)EI z_=(;`Q7@=sx^Y>YUdjdPl%CgV@;6PX7c@bxg@2T5)Gd8-N0a`+OutQeZ9yLJn;;fS?NCbMLX-Znq+i)4 zqztr94D?uKg&3$;M^bm1bWc|1nEd6QVBL{)VGE=eb$a|n?+j5ds1kEgoLXe=? zX!3WSQZH{4|0LI_JNhSnFJby^8W{^!2UHL$#n=fIB7KAk&MkxrS{{OFK3vPhE?!v< zfi?wT>eTE3ZD4%dY)pL{Lg5dw)eyq0u40l7Y&(3QUz^z~kQKHur0mq3P-ZE1YWOk^ zdMtxRfCd?|p4#$0vPyDcvJ7V2M9KQgmdduvY-;NZ<()?g<+TO~Mg<1>h0iqURgi^8 zN&7{=rK6;yqThtj@7+cH&Jq1SEb)6OJCxuXT8nhX26bdYADO+-SSF8FPSsM);`9Up zFULd&2%!T1sZ0vP~(vj{$X=gY1wT(ssU2r4f za%eW#nW%;aPZ1(l6L5kQE9Tq6X;chBEnuD-z%IrY#ta z5EQb?a31tkaF$DhYmO9UIU^b;gvS47`t>bnPpb%fngaGTKiJcJVNdfavZvhx_Y}ZW z?P)ToW7@@fp~K2@PP9b`ZG9~oXemZU9*%zCY6vzMA&>28EYMW7J*_nCUmxX;vRrN9 zIRj6$>GcCCYKS(bk_h{}B-$W^oGMJxRU*Y~ z)n=IEmjo(Ywg zEF1Qdo7o;r6Kas2iYV!@mJo*E$|P%`C>C}zyE$8j{dWMwa8JFq zArfKwE&6VFjQ-(Y-JhJjq=XGfW8GYt1B!WVoZ~VGu)@ z;b4Xg$k$3VuwU8-Rp-jK(*mRwC>$Y3IgcE3XvQ?e1<&t+G;bKtyPaZ;z7H z$|P1RW+!E?@&K7mjJ%QFH5t6t!AOryI8fdLMiD zoDe1{*3ncHk74Vuj`}jBtfO3+s%hz5mo=5a)Q4Ya^8H0$`hrGYZiy8_2z}|tB#TtY zAkm$n3}J3)#X*w%-xu>w2wgnHBpm>; zf&rZpJv_@0&B6~wMU-Hj7c$|pY-N#Y_|Bw*eLfIv5kgz%nL3-A@F0Dvx0ZFJmzK42 zb1iEv4=wY274;s}WZ~9yi}6rmkR;)Mi53W` zuS`qe7q`2hA!SjDz&Ao@;~`U{Wl~Bo$uKB@!FQleJreg(vT*TG^o|fRpED*K+g_xx zEoU&ji~%A_E_T(#Kqq?oZkC-^7B!qb;Ch8B6WLJ}o zk7NTRrFyZ+lXT%INH6N_@Dsh?MZKVk>BePodMPKU6W?9Wiza{N#(4BGXRn(uhSyEN zYbW5clpWl{wCkXH-2`gD12!G26adT^4_7UcSa{6p2fZSM(HbyG2NcDE(q-5xkQJ;L zqQPeYyAOf8&@t$KXnb>y+FztBTQ0qvOc$L%5{gnpL}=57sr?K+L4B=2t#GZ9hma0T z8g<#@hq62oVKPZl)yM@v9Gd5g1M<2CLq8h1my$-6u?$W`NCG^EZP`^>y_oH zXoC>iaAcB&^5w!-VZPkRBGb)!8=9*p?<%yWIhV!W)%6w~U}vRD2cC%z5JCrPmL7-DMn29zFzo8Av6sl~)8Wq-x(tEj_ zbv4*-doUf!IccTXxNb5NH#sT<%Q9s;<7IMdovJc}9GcLmVR9PDqcTEhGK{GewBXI! zW*u2E z(u+Fr@)Iwb^d1oPq7>@JQk-7O1?t2%qVl3iFTVc`X6e|#)J*5vFmb*zO`Oj&$}vdN z57lG!2E9ERQkD;5%@M+gPLdW4Q%a_B8Z1AGOhU-aW6UZpoqJ0!T-B1WK8Y+s$ht=M z;Fm3pVX~jG6Wpp#qM7gYB+M@&lMpiRFlHrqpJ5E_hvqO-pwtmOwyB<;#`-3CY-xnB zr4bYLOK(?cvhf$$07)#|BTS*n4?@_=NH6NdpX}mAlip`ay`TyF7S#MkUBoIJ0qIBG z_=~Q*Xwv_h={Gmj5e%Jli`*tgtu(;EynJJ_xXN6j^_!S+LYVOnOws{Gu`p>E-q556 zZH92pGn}b9;pb8uOPGiQR9^@dhN@9A*)Vw{p`MK1P+|jbD6xh&l$3?38ZZ?fUxpTl zWGdJjkf#a&M$81Rl1_5_A$m#(J=I~7g*-JCJ;isEXbb=54JFH22snj9TWNYOwN(nXwUJ*jCYBIzBT$i?}ixBF9B!Y{-rb}D0m*8lavPB4WHTsvj zN{PA%p{^#RtB#>iF$P}yrez@%H<@VyNMnPe`c(k(Wn2IP`+Xe*P;^BrgwTo?lXPI) z;REAq!&YJawq=N}+T>tEp^L!sc)4tvT(J39u5}Sz+b3yy`l4%u(6#nOUF$Bo*0Xrm z;FUg9n-+yy*;G(jxRot}HM|&z4iG{ILYWO4m>p#6YzLDVtpu|IlYFB*gB;smGlxm+S^bS?QK9& zK8S{0JXKlg6Eaz(;3ap{iIfNFwKtdh$%JG*Ej;wXsf_Z_8w%p$pae1g<}@{NLTDq6 zc~r?nE||Q9m%qTf0_FEz7E+R)5e$i1MMS?E0}P0j4r#v+@=P^4oKOEDBe7|PnBp==XF*~!p9 z8H-rs>sW0BYZ!xQngoHPM%5*m{i2sEF@?%fR`ik(dbzu(mpP)BhZ(YlPdJ$2hi4=F zbS&;;5$h|RadUI+p?KdxxWztk{R-GS)L))#sL*f<#r_NkQw`$&ag4{uDhhdoQY;ugsH@Dou0 z74WAT9^Gbql)%~Pyp$6y5kgB>nWO_3!6tE+t-`(P0Yh~7WCP-nEV1$@2Jn_tdbfz` z9p^q=2Q1;y4`shg2rWHg%1UC{iY!9Ndht_M1(8JvS$|7ds`u?mZyeZ(EJDcoL@Y^v z831c}QHTse$oRn+zt%k%vb*`HP1-$F7PS&Wt)-Zx1Bzn7Ix%6ZuujYw`Ul;EmI2%Z z@hW_)vJUE17JJbHLg;}7Gr~?!9~i-L5-v)@Q5Fkl;?a@h@#shhI~ro5)L!`GMU#zk zWCJguT{L8RIRiZ)1|A^^p*>=tl=QvWnsh5jH%Ll7!M&2C3tJ$)sIxcbT3IydttRS4 zA)brk^inQRXZ%m})>i5TP1v)k<+^Yd$S=$~=||luKhf{R^h?JMtS44RT2*WTgfKg< z#L#dlC0NPAMRk!$2$>$lR2xIEZcoW{5Ltwf)j}hS9a)sD8X}7jvRX5iQb6P4EHoS~ zHUXm&916790JZD_@Cvs;cSX5}KCRMOG~}R(M#X zA}l#MY@i|`s=p#GDxr63Oc4!^&6)>^?s=x9MtXWOnP>=GQsb}=f4CDjv12`xp$}}D zG>r(iQ~)R7e+dQU9hek0x;U2Jk{BqT%%re71~7!oD24zODi{w09>M|-fxts3@P8dz zA~S=b)zBE4XfQ4=F`|eSs2s7Bl)yC6N)?S(L?r;;h&Ap6veNd3H69U`k}8!hf-#?U znGww5Xl7V)1Q+E|ZUWnic`rHJXtYS|q9y<(#XeSyy&iKbB{exVp|>J6F;Nkhn9y6Q zrU)Kl&iB36YPl#PDp@g3WCi{M)=ZHV^b;1giR83|)Y$l_kf`M3#N>aSn|WexI?Mi zu(VmU)Jvl!HRnqFdPGcAUolZJ3}OEe%a8(4H-<3o9t_n3)SaQ&L}=YnVetY73i_^K z%>=}LUj7uF7|c{+7o*D%Izb3K0_cvy;-VA@VewHybXZ(Ul#rU77WH%eAaPGLF;z4% zNi;E;pNVV3EK(r z+~QXY@?SBQ9-s{j;qhu4Lm1~mhH#Kt{ILl`NK20LfK5r8Ax}VZhI|3RL=o5;2uOz^0ROu9ie5Hjy3k9w=K%WA zOPELqNCC)^A@mYnqYmrP%X$m}_^@LvZ0 z%fNpb_%8$hW#GRI{Fj0MGVuQ}1IeioZf>#hNpWs&ei2cflEV^Gk`j|s3x5;*5@J(h z!{TBG;jME&Zy!Y}7gRXJ#fJAui;ak?A^0SOg~xG;&Mg8J@o58u&MCO2W2eq-;RaB0 zdQ`Havfw6E7Fxp1lc-3z53h)TTb8L&iqx1WraG*5RKm~a7zDsoQo8%o0xnEy!@uGS zT#OW2GbuelKiJKRlIM8DCZt2OIM1VZT0FS(OLungvZ%D6*;dRfZfVOL_9MjIOHp+44pf9CL@GM@cVs#e65;losHcByYK($ctFi(mW}yOAl?Mi;E)^fi zFlqA=T13H}>BND&v52loG($6pO2&r4ZZ#`9wg`k<%&`%D}Ns{L%6ebWk>&AYmQD9e2Qv}h+^YEd~UbTlaCsl_9Y4bwH#X?(Q1uIvI ztmSjdJe3mCg=%6VS(Vz5%1JTWrdfYrO1Q=B;WPuBX{qv7h3JW%{6br$`lR?ilY&GG z4;jM4ohl+eOQ58PRPzzZGt|zbDv76>Vfdtwr`#s$!N{K%+KOwXg}g@p$!l&|Dx;23 zD_IBC0$Im=;(S+lAX{Br!*|p`vjkDYJH|r|I1^G;59*P8EVNZ!?H9IH6$x(VzLb0)l&er*8nCSxtg$G^ z9WNSKW?K@^j9Ecm8POi+;u1q_W*_30m=f;kTkOz{dx#87p_N8mHbvI{ zQ_rM!Fh`#7r(R0R1j-i2Q_qCdmbwl89b>J^qJs7zI533G1t;ieZZ6I2VICJu5`t#q z8PcV5Gy8~`u;dUJv&E+33d(S?d6w!#+qE>>fenRNGIm@$eRfWX@sVzd&7K&|}ScGj7Bhneom5M~-DQE^{YX4Kjl43J7}XVCY- zc>>JOg%K9+o=%>{?wiv1Fk?M5+UK71Vp}l}sZKj{BN(SLj}MCHEP?tr1e8wj4&c~U{X}^ zLnkz<-jnHTR7NU`ei|`p)In8^)k0N`&Z?@KyH`?5C^W1x3hh@@QkwaIt=*C#ObI@? z#%;n^Wx;(Jt^r_D@bp5{Q{8A(ebj8NQ5jcS+_F4lVQMHzm>NnFriPM)POFl{tD>YN zQLvaK3iel%L=S4Ay-H$|@F_V}lGLNNFSHeizf`J=QPV*Vqo#u#MokAf^g?xz`<19w zkC~D8zZ!KN<_+4b#}GCRyxXCQ8dk7EO(P*KJ|rnE6&eS$6Xg*P&R9cYQ}Ko#J1H&k zB2uwUiU*0dFcA$jI>9{A@X?4#qmKXiUPdXw21F_O)l@cNK42=FF@&ka$AL7b67IPr zCP#WE!83ZEo*)Ugj0)W-lUl`mcxlw+Q)F#Py9RlPk&%Z|8|ZozkssdBF4}3YQ73N2(ur-wI_@IM@d!$an!LxT$$QkrOG&)$ z%nI^)iuO1Um$*Z8;&UZR4wSozGz>IUqe2QxDvR=(3hIbvI|qiHFoa3KyPL%&0lKfGw1f!kzcfaScGY{L!5Z~}pvE$cN&oNkL=+ung`xwX z2w5ug;)W$JrDLn017W45a@kI~Y_0YkYXZt}_6bYn=0c0zkV1OodoM!gBb+r@F}#nsO$ znh(09yI??_WrnA6C--U^y}3DG+FTH90{nLPR9(<4Ro7%x+4Bv`uXM<%GrW1_4#Uel zHp+Hs+xK1con?=MlG}vOP1)OkFRP3yv+4W&j=TG1)y_!Ty1CPmRkFIyO*%j3-(TPL zAK2r~;}EZdbsx|3YH;CeBdcRteY-!t=vSjkO#0JpeEDTxm)yLuYx+J9*!yYknHP_? z->vXvddp>=6*Drt*SoeazczKM_R*JX;$PfyKW?-lqo-lT>22lh-j_YLY};>s7t3`# zQA&T;^u@2jj3(zU_`6baO!CFkR|a^Ww;Nbz+Nq>rGq2U0TI=E4{Bf2wEZ5XMy?Kz; zFEVJe^0xyVb`%yn~b-1PMu)#txV8#zC1L1 zR^Jb+8a(FTr@6m+a^uZ{-35D(?@1`*RnNYRyYogpuP?PSrZnFd@nfU<_Jx_5%}T}l zOx`xF&BOD51XnjLXLUNnpi6MU!OpGsUFueT?6wlaJJ>;lHSj3;)iSe7))V;1*vx zc}H`9xW4_@S`P2KDtPdQv|VrG`kRk;GaZ!iW!;(fYqDxNUQ0Ohz;SErt3z`iRprZz zna8H<)F^L#&e&dibF+u~)oTrEai&6It<3E+TaRCPXZz!4SF4}@JAMdXezL9A`dah0 ze@4Bod3Dhf=a&znt5vFlb;OtY+pTFKZEOoi-&QBlL zMYNlI_hs`rSw}|kC70)N>g)M;zU298V^BJ0|MVB;e0}=iS<~-V&bY_FJ64FB=a&$v zRqEDn50g5SEimZT!Sa~dm{lvU>^Q!|y+%53kG$Ub_q!WIgZpkBwzJBOvDsZZo;$+V z7bn+KyH}aWIu*P#ddhn*xH$XB<9>Z~9l!P)Qm4(s#uaj{4m`g3W4u=K$3Is$7^qWb zW7o@k8ROEgZurqfaeE>jUYQVkT-dZov3lBctp%-;8d|0vTplyLez4bK+pfEQn;X>r zU_y(%m7A_U*|=cO*NWP;)>JQF^J)K}yUWk6h;OrILEE7p3|j4aTYK=>3iWzbE^Yt4 zAo#+-*|Myjt*!i~2F!?X{4G24-PA*O?_`)a^eC&oy zfu(oU#()oI*Ov4BoqvB(x@+2p^mP?@yYN`B_fg!J$C11~7MQ2Y%ha%K!M6{+Jzz;> zeBMF6-ORCNr0HJEbgN>F7A!;PRIg^?R?k8>QtG zFh6eOnb&>KrVP5hyj$Yr1lP7BH^(kH_^!a^&88h=+pGwTZG7C#POr@|`@gs4oqW5* zEHXe9D|=!zuTZbKR#@C)9*R8wAbcE7tS}ZRIG11Kexr7(>8zWwYOE?fQ-Da zUAp+_x`(-}?lSAof-d8B`kTZj{&wDH=E0tiCJa1W5Vxhrztxj+Z}794Hge)yYARx z7SAKkGyl%}XGOToJ@45w5dpWO4iO!t2dQAT+POd8+ShF!-O#Jht^9E7M$T=ly8qCzG@Ms6eQ-HL=NokmdbQCFxLjfJS0|h1 zBaD2wo#>u}FUKXBlqqicedo)^wf7tSKCf@w*v4D^=kVi>`ZBhOPCds3U;r?>RJ9(H@HVPf`-z7>Pl>u<>3Giz)5 zfwP7)>r7i&&Ux&qkgs%=^ss8oWswXbl-RJLctO5H`PKb_xU607Ow|BjtJg-FY9_GW7pP+V;9{z z;?gCmd)=~sJ-hb##>uexqbDaV@N$maxy|WbNA>SMDck2Ps&%84Jos9tA&#w5y>2SL zKQVF|SUdPkscGN7IXrnl76+yx#61!@8V{ z=@oudF??Fo>g(alr&QSRo2%6s+n|M}Pm#xbt@&7yP2~sNW~7J>4kO{q@&2U25@h zV{F62z07+KJ$Qani?u!GKfYx5RBy<&GWO^B_tTfxRv2^t;pQP5GB3Fez2(Q_=k2d) z&1-i(u11x9r+3o6+xcwU*Iy=jrT*yCF>~*`I`2CSyI6YP%~sF<@a)aMZ(mefcgCJ8 zRlQvAPF;6w@`H`lo`l3ZCN}2#skYC;*F#;OZ{+L8_j^8d@zuVvrYBl>9ZVb8g^#Ow zzs8plDSuY`D(~XR{f?HEKexA2z_x_8pE{RsExR|iyswY#^2FPtf7^9qnO(1uJpPqO zCQNWS9{sW3tn!!pub)0>7(V=V^01|pSpaValH#1{$Bh} zZ-K8(^-K3=H+)d>bl;J}t%DN_M$9s*yK(LDs7dV|FMABl(>gxAU-R5q%Z%ddq*+yt zc{zE_fu62CEXFCykNnoe{Iah9^wx(fHkNyo^1ZOw?e9cu`v)UtAMr}}TfS_<`#QtU zxLE3aZMbRI0q6aFf?gD4dmFZ1d3n{xRK9)1kV%`y9=mJI^=YT-kM`KR#nI8=ZHqUz z>MrPZ(Qa(|pP~J9PQGz@vA`|+)vgOV>3!cCo$NUDV$TlW$E<$3!|=!A_2zuL?-jcX zr;aFO-wGlP4~~But~guznUU}K)>p0v$BcVfJ{_e}xE>?ApbgMM)BDa^l{!ZMwPiGtbtUkE>pgUO+WsdZX z_`j0x@Lcx8KK_vJkY4X1N9T5YQCrdW>#9wm6|^HG*Vu%ua@&{J&(~Gw@yoA!%;tU7 zHg)3d(7(*Z4V6FD&F9~FyXD_`JLli|_UswM=bw6ISNiVM9uFE1SiY6V72!JT)Q2~X z%JA>U@62xM*!!N|wVuxh1@>7U)yK2TxI+}q1`!^h=}{Tw># zP_4*X+mbhJiT61!zggez{r$35U3++DUVU82YUYuS)vt^&Y3;p2ybJ>*CAUEl7n?Iq{-vtOF&$F#pu zF?p>ixl(>1DFk-cJ^|-UZq@w^q*nWcquVhey|q%Bk&GbJ&H*9tK|O-(!dD%bqMB zbCKumsEgxAr?%U!_>RA^?BX`NCOmKcXI?$X3@-cTpUU(7tA0zZvFKv10%H3&Vdu`pjXX zd5bP4ipDR>536>n(M-$7^SigLFlD%%&)$26SEdGTXuEuk%i>YBkGGF*TJdw0rVYOA zvAObb(t-zn?{1sK+wGHDWe&f(SGj$S)j!^>ZBymA3V?BvQHYv#x~Ed z{bAn56MfHTa$a%mKj*=)&JF7fKf(K*+*1v^*|qL>fwy1YeoFNpXZ6_O?g!q!_Yh&(S`Fo3C=W$V`&W=435fl?S_UO88 zgO;8=)F)QYB-FBF=%zbmd}j={+wpz8ZP{7-r#3&HSGA0ZqhHJS2EO@&M!9tO^hetr z!Nu*bQy(mUeBHw09^YTvzOf2}mNUysKN#yG`}8sfd>ub$F}o zRa^8ZX|LCdSv=l=RyCU*T3&fF&ksM|al5zPb~$2iJ$Z=X*tOXiRa?(px+fz_wy;|D zO=C{kE#BR>bN&{KNq@dLVms&f`>3Nw?`8j6o_ae_ujeeAO^5#4`g!vi-CRY#rGI~D zE;}$LuU@%Byd7SeUbBT?*J&&C?KXd_@yC|;zuIorw|W0PX<*C6@wS6kEwa6^zg+I$ zRW9G@V)rfX^X*z$vJbm#9FtAT&uqEI*K^4yqj|O#Z4xdR>9#%<8M)1(WzEs;XIjtL z(W0+oZPSq*CO%I;(!E#aS_6mB9d^7w^-u{tEHpIt_T|ypHn8Fsz-dd zy1snh&co6=1&0==&*H7Y>1pG)kKMl}dC}88x!T3)o3SG4{qgMk?k-JNdOv+&lEC%3 zKWj5EZt};vvptu$n>nURg(rdjQPbXSICZDr_(wgO4RdxFt+#df(ZSm4{_*_pA0z(| z?zD29dVSvTv^rgOX}bH!%&*PPHk>rE{im3Vm!s#1{kO;P7AG2Xc9^BpE&NCD^xmnw z|DN4)`>DZ>6+iKI#`kCbo%eVAJMTA|H#-06nC{R5-v6I&9MJK3>wb3|hK#>m)vK3V z*&{997`qP1T-IrPn}thijq~ufnww!Cw3i>3E02uP4_zrM_|VIF_tpJ5=d;V^Zym7R zYpze{T@$}7sXQg(T;4^4@hf`s{)gM=``5HFrDaEhhRj{q=Gg08=g{ZZ+8Xvc+-IX< z<2xtQ_qeb4_I#z{=#)u$u~+PGWnb#rqI`v2uED;ihpv2f)MZul(>Ir^8Ch>FXd0A~ zbfxa9+QzqT5AM{aXTonak0-7()_xGLX#GdCp5yB`eY|sKqgKAX`fn5(ja;fHtNvv3 zGvg8KOF#N5_UC>w=QR14GEI3u&5wU4IxcfP?%yI;>r0b44~3Cu)axtc+N-X;N0hI% zJ?`9w1KmT9#s#&C%Gt^*eW< zThBJ!FYhHDZJy2OwdAc^;JSeQi?>DJ?d#pU{L1UG78Zk37eC#ko}VvY@1D2lFyQ3& zdM-6Cq-?)Dvdo;-tG-Wm;`(et-&{4h`=(}-4Y@PBxWxBXk27Jj)`Ihy<$H3!gWVP_ zz8N^af5SI^zxS*?ZtEj6Ls^}jw#M03?i0Mn1s`d6y*{hEB8GJw(cmy_4E7Q+OzB7%<^*ip;>{a47hxO+vr*&D+IX=TxR>A+I6e> zTV9;|J}0t{;f;~c?;hzAwIw!o-tbm6H#Cb)xOCopf0IbBM~TD7WTmhF_ISA2lOsMJ zd+WB?6rI{{%kHp8d7}=kMqpBt5(R3{$V) z>3qxhVkc+Q&@AlLgp6OMVABT0f)c@|@iR37I**)4wb{Gt2uVx3{usTtU!p8&5g>Sg~vNjki;{z4aD@Z&e%> zysCbu+XbGB7dlkx)5?9loBx=;Uxri)t{UvmU54?v{xaR6=(%)4bNPx~#d%-6KJCa-f6D(3l?9d}{;(8)J$jeIoy#pLq#J-pZN(4V}#p?qt( zvDy_joSEY9zWusEf0J4}(_HGb^S?gcIV{k&=BvEjK{~s?L~=hWo^2J{?_B!KA+;W_ z{j1yN=e(a)_~;om$$1^Td51-E)dc4gydB@4Xc#ZF6jFIR9y#15>Y-Mj!Ic&FZ0>dH zac|7~F`JX;5ADMB@18W*Biy`YlLx0xxU_xz=`KHR^6OOU$A!be>(^|UIi${mTIU}; z?Kf(|HIpatEBpeYdA%Ngu;A^*mzneb2(fH(d4kS}uj##-4RJbVuQepC{*-}3OBXl3 z(y2Q6g4N;O3ZM5m-xr3i2@AdW)K_6&ZNQ*?x%#ulHf+^cZ|AD;#NQuft&J$?zU?0T z`Ke#CS8hj#{{E%f)Gv#3ZZ|xb_tN9d`tD9ary@ILp4bxB#`}kP7$0waSaH@q%H8zP zl+VLo)jR(-ukZV;bvCoVy7A-wmrj3;C|h@1uKu)s=YmoeisJ=-J>f!nZo#-}r>*&U z@amUagM$Vguk~Wh#LVt~Bi#9U@TWc#o%R2EW%l{$x#O4L*G_KVCG=FrVtUZSNm&Z4uY+QTkK)3l{B;B2h}ksbFu+kCc3 z_>E(un?{!Lm}gYn_dPb-f@Z(>+{w4|?{kJ9ys3X~!1$am6+=%M)?CKzIAq0L*=}ih zJg%Ufv%wylhFtDO+?@|?H(E7Qm)kY%`AWf~!-a2KzTY0v^wFeV2j{dr@chf3uDdmMk?t}}3E(j%|U zmj+afJjwl-KB`gKrY5etPlS&8Jg(n>lwYk^{pQaN>%OReYu&5Kb=(_#8pQQg`rLeW zbXb+N=Aj?{vIyNNp0DtF<@LtLK~oi=IjZ|-^)(=DaegV5JUzsGHk%vH3|N+?)f zV^h}7X0poL!p^?$nl)j@)X3Xyht;nW*`V<>9sB3m<)i!XeDLE8-=F#QCmsjiZ~6B= z?ndXHH8nlWCm$`EnsqLFd(dsWxCNU!E%SZJzw@PbXrlY@C%)s~$8RuN)hEmJ*3jm) zh8V5i>~`ymh3%CSM^4HN%LR;XG^17T56Kgn`kdk0du&ZSXf)oz?7_+Vmp1zC3gG%a zPB_+fRiKv-=O63!>W%f0`^V-FF&g{fe$^M8KeglO*o^kmuX3LHa*fTU{ax#gN#pW- zyD-<~ZE)v_llb@GF=_b*yZ*Yo*=M$eRt29ec{hId>g;u?1^<3=Z|CC! z{@pd%&9T>nvg^5hmsWZ|KJ;63Y2f4#zhmCEIcw^_Z~Dw@)pg@=7oAr@YtHgKoJ%`2 z|6Aafa`jIhIP9CZW-9lO*AtiH`C7U#J>u?+$vt`e+zwy*wrDbDO7(9&xj%f#w>Q#0 zWpn9!@9oz@Dmu^9YI)l1<(tgguLiZ@_IO@+9Cw<9&6TgKdt=C|{bQFjZo0@-*F<)F zL)j00<|KPH|aZ>gO+eMkW0ZW5| zJT znyOz{C+IyLpSz&?#~p1?ZVT3{`Yz7;YHjDU72ddyn#A+zxNgI=x#uHB@b6P6&Dpa~ zel$L~_E!5IXO@m_E%aMe{^f@SQ6mSB7#A=iY5bILzQ=bOXL0#at&vYWGQ=OOJ6N@qM|MEWT+UlPe0$a0>3Uzy_n8OFsyQvJ z{M_x%*yi_lT0S3KuuIozr$_EN?}l6D<@oloRr&>FHEhzH*VFmg50^ZYZ%|b3b>`KM zFq7j|yLZ24e|G)F+pSJ)AGYUDf%EuMeLLsz?G~r+R$qT(Tf5@qI_|1DrB>VComRy5 z9(N~W-`nE+J!v^b_OfYQzLn4DBpaRC_qqN@ALm_sFiEFDadB|DMY9t1#)p>6C{F)W zFVoB|zh52vC}@GP*{uzkU%SQmAF=NBF+Mxw(vm-e-jDFoA3l9|DffYc!n{{G`!wWw z55C;CX6Tf&t%{2;MOVAss`_UvOM5nO@7r}?+WU@9jmx^%8IqZ{z}5W6&?9?h?T+^t zVlp$a-rcPRmh)#6=O4FMoE^UXXL%@&Uq$YGF6&X1_CK@#GyTQojr;f1eY1^U#ZSq_ z`N8F8j{er!<5*6mpZW8!|LsQhE7qqD+5IkT z>fiTF)WvMGT}@zOhI;*T|Gdmbjx-xRKX6;`?rC2yZD^xjpIolE`sUk585_lKI2Jeh zXZGe!yV|<9)+fWC`5*k^`R)2=w|y)wzkL7qtZcH#V13j_b$#3~-4O})`<;3g+pf9X z`h&Bcxh<+%ra1p=^{jkt(}{U2CNzy-6BLtkHm_mN@6STkT#q`mE97{&toeObEUB@k zfxBM(&e6SAjA}oYAFp_S=7}$#bBv8#Fus%){>-Je;290?JanvAZ>pBo2<4je#5l+J zNH!~-);LBc!&|b_qfiUZIoE~>HC!WKIz~o?r}eh)h~IIeww5?Z;v#}$GQ5f|jK1QW zcWo_xz-;xr&wSPFeLklhWn_g|xJ6s56{!%KMcxlmv6?H_q71OYQ&N;G*aKkNT3jow zAu)q=GGsS5-J`j&c>s04p_WK&pK_JBr{ecWtdQ@QKW_r*rR+hf*1Q zh)P=ve?cC7>h{d%dQlmDCKG_4@E6^|Fs`T!{*JIJuI$(T5k+MTe?i8G$)Fu9HG{0) z7u917TeP+Iz$g0Lc=YO1MP*Ew%v1QpY$h1bX;M@MXZ>qy)q_vW&&5}jl{F~M4?ZEG zt%bi>i!$45#?&vW2cFIZnQHKf<;my?BZ|tv!wo-`!J5+6Y7Nzf(g(Gg_(}B)fOYWe z!0@N7g;_#>{8xMJEyE%tpGn5DkWAAD8J0z5tP06!)`LIJuCjGGYG+-k9%^IOOa@yK z`txU?O>?QwBxA#5@}a?ED_K8v?_8-2`CN|4@VGka>fN*{5?A?Okinmk*VgI*pXkry z8>yA0ddQy&Oa_1P7~4;&%Tu5Nac`2=yB(9M4oa{s?sl9GKklwBQ<2HwuQX%)pF#{lrc$}MTth4%D4Y|KI>V}+K+wze)g+-IzH#~UZ1s|z4qFBpL_1T-!2S$vcYrR zc+7v110!pG8uny|XTCAeeBN}m?UkU%)-VS=u7+qWcy#3uakQNqFe5 zvy*33K56HK&aZ=GnSxgUy0Oslm0bwDp)rdgVf)`LU%!eJ-OscPGC1cGzRe z5vbwR9`@q-^7n&!X9&)G3~f>?such-VS@7Q=aHO8+wF2X1NKp6MuKihOnoC z^3>jQEpgaW5gxZDWE=Cut+1!kV|XenPxcoN^a;09MS0@RdO>;iCC{=q+|G;exH*<) z<(uQfo~o*y-*Rp&7xq+Bo?KO%e-QRmSDv{0V@|_nU;O|2W9M^C+m2Z#>B^(fuj9@C z9$qtRsjPOBhs~}Tnya;yXV;jurGp-ug)6ZrJQ{bYY2SYm%(9-B&<uYGo)es(c-bwM_ zsXJj$BY6Hck91z%mH6HML61Ebm`gn~c6VIdd8_;IMuB}{vnb{Ns!vmRFw@Ml2W9)V z3uf7N%<}htw$uDEJakoK?>K19j5~|2YNDftm`7R<+mu{oc8;&19eXQy+}LRzwhWEE zH9U{5a~pWf@{FuKUwyM6m}SS_79N~6%(Dc2S{(^{Ovy~2lbJ{AbI-}+{tA2A!-Lhs zJR3MFQO2-`&Jxj4Im{!qGxGaqFNZxHAH&lL9=d9!%FP+}^Zal-ufRiBL6kLgcFv(; zPiJ_{3pmI9aQ+2j_4~rsrwcqZ8|jr3DbC~xd%D7tz&ujc2g~-xagEgNF+APjp+s}J z6?rS!{NKY_J>a1;9eIuyOENg@=?PCk^GMs}F>@}4J-y5;(NT}~^nMIaA9x-;$6kep z&X`oADIXr&6z)%7cxVNt?f%VSan!k=dBwjE5VyxHCB~D98Zld|#dAl7vtBc=L`S88 z!>mE$d&E)a0q{I}pALj)9zB|`FVEbLW38hjIy&mSd8GMsEZN6X!u>J3(0KOJqxm{n zbK-@thgOW}D4MafX0BQ@;+?PuGdao}z_^Ay`tK)q!=BgCPF{L6UrE30oH*LZoA5k(ZVZQKnt7yg9s7G-9OthQ@KAqg zD^$6Fu~RjJ{V}`Q)F&qy%ywwdRI_s)_KY&G*lRy}Wk-U2Il`XNkKq{u&!fln7Cevc zvnlKU*`INbk!4E%f41}XV|XUO^XPSTB0O{rKwE|C+0BK_!*!lyUirW3Y^JaA(6tTG z=^KBxB;3yA$7shKPNp3?2C1EEiATqT+nEZF34mw&+)ekw9-4vCQE!+9+#C>*l68}s z8=!~BH65NTMy7pV<3@I~Kzffoch7()sd=Px0bPer51hNLXQuMdwN2PFOL^jM=UsSO zm`BPQ{N(6G!FKHVYc@R3aGzuE6gm;^^Bj1BeV!fa^IYYjK8HQ;DG&8I?7?a&@BdJr zgC5&wb2>NsVgc`q&j%kfOXI_JHkUHSD<7(LJ0{z-y-)EaeGtght#_d@O zPXY5tbnf=0{}*m&89Wu}(R@|AIV45cvmBld<}tqcx^!bk9OGI6PdW2QS!wRfHz(?c z`@9k!tmNj|gUe~m^6;={6+FewBfT;&w!(8^&uVyDnn$W(ozYMC4SUwWLg?0gK*C(841pF7g!e&kbl zhMGq@<})8bl9XsSn(60UWLC@fhMvQ!BzM`WBn8zp0*MiJh)p21xyC1`| z2cBo>(R{V|J6~)t%dS74!_&?jq-o5v68oRN8N9Bu=cc{zxOHqrp8lgg53H-!vrl+nj0jQB<%UJFYL`p>fk@uMZ8Nt`85If7|b) zk?-awZJUJ0eh3~nb~=9@42}ITJgc}rJx_PI67<;qd^gX+<=K?%WnMZ1;VS=-1!=8)EbL7b+Plr91l&5{<)s$h+W#zdSZ$+xG z=Zf-_PBA7!*kej>>g@WwBw2%uL64mqSK*;+NZPNL-^!3LT*GVd#F$4K`>0c+%UliB z@F#eJH4J-xhR5}XY8duhS01Wi*z=3>Pz}SL8_Gj9413J79;gr1FzoqNd8md#kFBAZ znx>tlrZ_aVkr_)457+Q_cw)>W)o@8vuD^Z@)$k8^3bJRzzF$^^J%7RztaI4&7d*i_ zhdsBHhw2>m{H;7x=dkCt@=%?_o;%7zbq;&(Di75;?70Vz8~fYIYb_3X?7p}U4_&L$ z)@!^^3ZuF?4fD%f3-s&tnnWDo=dPD+vj-jxOFw| z_lTn5`N;H&&P~6+bG~$VT=C(_VqT}M^gI837#&4b51vyJz_SdFNM!iHhCo@ZZ4HZ1JH zcb}sky-%M)J1M!HF>fyWJlqa_TEKih;gOzHkKsxE7@jonv^E8N!Q}NnK53#|8SVVB z$Hmj|xML?pk303#1m>9aq*WgJ-e}m9?lC;+AL+6CD+4@-O@HaQxUzD$IaeA<&H0S* zyk;H~nO8Q)thpGjb0&CRXHT~rBeI4)nc*R)SzaQk-hZQE*z*iL&zaZFlSqRn7MuUk zv*0n91sSk3G%F{NZusMLTpxh;P2~?C%`MnvhR<-t2g) zY`C5L@N6^9Q?1jtEn;@R&$4sA06gxvpz}rkz;R*cYC(8*ayu_hd*NcZoo7Ss6b!Xf z2%h<-FSK79#9wnH*pAIA3=f?(XzW{tz8c3qEuuWXp8o7~xSd#d?wLN*Ts{23#MwcQ z9eYuD+}PvPxQ5Telfigso3ifE^00?KRTv#r!CE3+ zOMllr?5PM(CG%)*@*;<)E;BcgKFjWRdevY5(0yFR(A=mDk2&$9&hJ$%+%M>{`?Lx? zea&M^;~U>McRA}0o}1`<;65v1?@p7egtA^#o|4c0{$kiuRe7HJ>XYJOPc?Yl_575R z6N&{rw$Ih!Nys&7JAJ;lPN>dx z;V~DE*ry3br0W{=*sOZ+v^9@3wrQ^>TOaJR&8n~3d3RBYtMvj|ww;&Zabv&Px7(&* zJJ!$BxjlJo)Ip)&L{6n3W8^S|lHz)tdJExy|Gw8AXX#|fOJH0p9Fwh_CX{>F^M)7pd(Xmc-VS@( zz(f0r+KKzK-!yZgqh_$@%dVqL4apt6)@lb2U9ZvB`}3I>!ddO%`N2HW{`lZ@x7lG& zhsS8ABRp*=$ZY*id|`(8@Yp-SLsz89jc0hx>E@cm{Db>!>rAuMuVb|SbPCkjdO9l) zU1JA5c3*UXr;=&iJc*p>G2fiZ=vlBnUE!&2RGLF`Zhtc=?CA!NTYn;jYLpLqXy!ym zxpT_7#;=*%qld@d1D+Y?k+w$H>zhlMhdn(Xqn%#x(3KKx1G1<1Biv4Jc#@e(pWb+q ze}DbcV4rOb`@rLlPiLw$5}`ijJc5GTmPcF0ucYa29=%-|th( z>Kn@HuRMdFU6v#0u~~E%6CIV!l#Q;lznPiiZZOMw2EgOimbiajW*|InO^Exw+(D1w z84QoRPS{>Mb^h?a7y{3ukHMkvv@>I(t?#F;%xV7Nx$!zYsm<%=No3Nz6Xw`?*fR{C z0v_kj5TA?d)ub4l9*r8vaUIFEmzMTg3aTcU^ zz+W(S5@i`rC--kZ3c41d?ae6HA6kj*=9Cev43Bckgpg-RNZAuoE{2pSSKf$gnT`az zIfc&OT6u|;214~_WvnRUS$RFmwX=$qE#f)A3RRa#Lhly0ol7v*hMHi@#56`LL#XZjcHNhs-;0+cOhJifpgAuVTT2Btdwji6~WB*)B>CR%}+?IJ2g)r-e|PSeYcsaaNj(a)*_jqGY6#JT^LV z8^xLR9DCjpswFEiQLcu|S*ak(RaTxCB^!O?!ECLf9MzPSn$q$fR_cgyjg^l?NlX`r z*r?BK;_UOY?3pZ7O;%cq(uSb1HP*{lo@ zh5no?ZAqeBf9P);(v~vHDdSifC{!W3R59C|qSR#NLs7c3V(T*`&iYIYc7nshKq&-PxSXGc^!q?`#US3}D0A?1EZ$(x2+ zqs>+9WmblZ(w&tKqKsjsqbTpQa$l6sS@}+sJFJWoB@MluVYaQJlw`$LesY|ZZ_1vD zLiG+%c3;d6DF;~@Bh-(qY!)R!TH7C+J}b`jTh%$_oTv4v7@3WFql&@GR zF3P{Gln|w0x(K$?qBLNolqh3ZDJ#laR?3KSj+N&`iAOhJW-A}%dKk+}Zc&=Bl1G&B ztgM!iu42VjY(<GMWbCP+Jn z1MS$^@_R_hlre(sW1-5hV$(Opncjpwy9{LvW*f=MZc)~;@~J4NS@}$qXu6HW=Jrni zkg_1890(}|GC$nTl#o*R8S6tR>+bdq)!veF{Td6LFhW|?@Zv10e> z*KzLCk?eUzsGY1tN4b{ovoc*g<+4Sv%@$=CD;1+0wVRdY;)!Iply%kd<=4J#=`S;R^^QGR5lgDClPMz9SOr8g@>MA^v7U{U^JWtb@C zb49SdA<7t5x{Gp|m7bzh&J8FsK$I!03=-uCE6qj8oX1itr5deRv30&49oPNW0`_zl z>IN(ArRBCv$5MCVqz15Okx*ZbaU6lV=c|&@bu22M9P4Sdt2gxA>fzEFz- zR6Jy4E^M=?9jlZJDcwWLJ0WF#Ncl0OJX^$OJt57IFj1adbWsLmCvC%Y(jSb0s9mnvG%NKt08(o&SOth^&imP(e& zAj%9@vWRlIiuEKBW&8_PNh(V8i&jZ4N>^5riE@yYY@*y|C9fz&tJ-$jh|+TNzbNfqvYvvXMAx-SAyHPc@<4j{ zQa$TQAf5}XtPxM?`qpEsO79s*IYItEg*^#{I?hUaQL?{m?Wsh0nU&O{#BX3dDMcyH zN?}n(u=1NIyIFZvl=H0oBTA}!2du<5Beknmt!B2J%A&l_%3(uU&wW--iPEmQrA~;ljgvQR zEy}y?tf!SIzp^qzl;_)9&m2)Ev$9u|Ypfg+r9uZw9T8- z<(eoNI$6)}qI6;9Ur|=G@;_19yke=Rqufkb$w~oHnsv6GXGKZe#VSQb*~v;JQBriZ zo)<(p&dN)o6z*m{jYJvG$}6HI?ruGOL}|xLKT$5QQc=dWuZN{7iL$zZD>hgzkYD63w#N_A1*8D^EVqSSrEDmg{@ zm6fuh9Dmb#W{Hx0xK-X0r5`KjMcKv5Poh*AVW~ewnZ`;a%GJ5rNb5-_$`n@Wi?WxM z&Z4|H%2G9?<@}?ql1`LgSji+xpE1@`OO&5kIWEfcZ&}X;QQl_dXHk-mwVuC3X~jxZ zlp9y7an_SwloqU16(!4f>uD^?AXaKi%YU%)g(x-Nw$w#YX0mc!lnfKB=awj4Sg9si z1twZgIq{^JWR**zv|!~IQO>jSw=aAg7G*pu z&xz7=s`XqEWjiZ3MR{(T_1qCRXuA1WE#cx8&Pa)-=QrfiX(4~97{=AC2c9PGsS+?ai9Xs@BC%e-PF|x#%uP0r)gS;YH^^MQ=$7OAD zinNn3)Q%|dq%_1+A&)2}sE41KuM*}9StVS7M2RhJUZcKz>pVqc%`@6WDNfWp^F>qN zwo}ABqfM03M7?JElF{|2w9E1ed0scKX9{^lDM|%;)qEv$o?@=fqQp{J>zl8v&LjIv z6sb>Y=aGFON-2_3nAfSN7*}aGE>TdQM&|X?&Li~^1@&2CUZ3hbC0sjRp%!VBnO%QM zqKifq1!M1Pl;qAMV;4o{PcxS#W8Wc4ta(OTQ}bo#m>YZ(r^xKx?i6X6ZU#V!LN^t* z9XD5ZisJTi1=r`;Qf6RD%`#I{Jf&!onawM%KXr_XmZd)*IVIM`(=CMcxb#n)Qp(l2 zwM%!9`IH4yrD?9yMi(n~6h%y@-!Q~9uP`Ty>}9%q0acQ+j+(C|E=%^HC^G9(I*%Ku z`78vtQ=FpcXc}m~&@zrw^AE4cC_Z$a;#|VWaHq&RMzg%-tiCqftTXh%kx%Z(Jrj(Is!JfxHm#qFI^A*GB{+!TvE=M0itJNSin@U{bRIb>w>bqX(yQiQStQHNRZ(1c zgf4pQ{&Fk8$4)6m)fiyDc88SDoPr~Ts-D8EMn!*0)BK^|8)p@A_u_W!yDO%hGAM_6MJTjW!?ZKosJ~qfP$ldOoLs2iu3e|3=_pwgVtZ$j+=EWT|3ery4ZvV=j9&^(cV#|-INjqW2f{U z&V%ziDZQM68UBY+5;;ZA)S}2pR~aADMOon#>ER-$#1=6FTVPt9?-d@HR@xd*J(nKq zrno3L;EtF!Xnr8QR7vwM+C+(U3f&~z8oFwH;1nF)M7{5nV$Sn~Yq_Y~7rmXQG?naD zV)MJLje?^9`}B&LnWP{qmR6EqltTTX-%jB@^o)Kk)+>~iAUdFwrh)y%S!lVm+o?ho zEoKf~`hBIt3~fhRj5{q#Y*90z>2vLM+_+-hP`y&bOlbNvJYAvMQ5505DhgJT!zL$# z^T^e*C?%<9ea-7toX0JYUMWV^n8Q9~73Y&DNSj{9NUcm8wOu>0Zu$lk<9Wrr-XP=& zD8@rS$J5(;xIUs3btlV)&V$v@bTC45(N>j?_vg&lGorZjg(zicTy!np$$4Un@W4dD zaZ$i@UC6`PDOb2i;d-mtjDa+xQj>F`7}d357$s zwowk6FWaA@W?bDwF;5~-%(neG?AnQ?8BUw0Xkg7v`cd>M@c22l< zin?P*s90Jw>GzO*?b?Yg&0`luR7^h7DeQITxUQ@o5h$yJOWiRASPA3UOzaOL>kd8G17ol=S* zx{Hc&3ht@RKfHofo$e$GIuGt9$RkQD9Zhs5y6QZ!Zmkog7##()KF1oLt&h8G62%FT zyv`#^zK~Klq!bZ_W;p$Ri2PpR<2|65sX)K`p`du&qA7}-ERjOaQ=E=3`fWxJ+(?VN zvx6wu?^K@zj*`l+aTLyRbghw46gO8zk@IPL=P6DXH}p57QhSBl4k+d|+Fymm_7@IiI_Li5C|rx0e|Sai3v#%zQ^Bxh4=LrG;!YQl zwZ@4oOx`-?Ux}RJE?c}JGc%v_$jlT4^SPhN$?80%-Ekp`wA|Ktuy<(9ct#XQiQ{VU%bdW=Nii4^MNsgad3kvhurI4e+zX^sm}X!K1Q9tE@=FpZ0s|HKyQES!0Bv z)^mN;EY}vvn$HwGD(fwwXk1hFZR_r-y-dNQvc`tS^^#;=X9^ybHBMy}t=j&$r&74U$!kDR@-Y+d{cfrftZ_`iqp~KdEE<=mb}|Kz z%9s^&~tjxX?Pf6A^rr=Ro zvsKpS*p%x%wUH@!RMs3&Y3#5g6H`>ZRzhlcf+=`Z)?AfUs@n1)p2|PpHU^K%dQXij z_RVpnzLl)uOu?hF=Bccve@&d@ssEUQM`h6!s{O43)SK5jk8UzWvW6|NJ%mSP(Up^> zXl{JEsPG_9{lFAFDr+GqSHlGhBV#hk{wllBX2GMf-d9=aHXKUisrQ(IM`bMnmEJT; zJ$(P8A_3|jrr=Roi&fUAW#7u+vs%4xdkBxpS^|pBp_KJc(|PMXwTmfuR2E&$_!_SM zWMYuVsSPmN*<9+kCRWlf&b{}WIB$P_#(YXzvd$5m~y?IAoW zYo*G%w{7xwK5G?I@Tja+pn`KFlgy1IOKcWADr>dMN;kVgH&1nC3LcfU29&Ge`|s@y zP+u?wkIGuBvhLm<^sdj!MK>sBgGXhp10^-=+vS9(Ml%JE%KAWM_55q|LQh?03Lcg9 zp&D1U0V`H}ihd&>ZSbh9^(t#bx>O%}Y7tZLsH~43F|G)`MQS#9RMrNSwX6TDO?*}x zrr=Ro8$r4A@~95UcP5j$@hMaAsH{yYEBVy>Z9Vl2y-8^{cvRMAl|^fBR>>O56g(vNSw*P_j& zhP{}AM`i6*S#&MxsX0u+qq6o1MSY=b(H)ZYIaBbctS^M3{YCd*p1Q#lJSuCy8W*h_ zO(iQ0y_sh=cvRK_m38Y-(;S|v#1uR#>r0hIHEbeTJ(+?>WgS#mR6|eAX9^ybbx0^0 z0o8E3WF2M-9+h=iC|5&I-De6OmGzYx7uB$ZWaasQ^3C5rBah1ZT4hlUJyoA6cvRLA zl|?mdE?GmEf=6W?RasO+Ppx1I9+h=WC>jCPaHnLQUKj~o=X0a zkMqpI<}P_&oJe>;1Fr}Ax}{73{I zmGy&A^g3mIBw3A^f=6YY70S&hPYq`Z9+h=YD3{e*vQ{$%kIFhP6lKx7bDlcI6g(>H zf>18&6UmC&NSgWH19?=|MWNidJXL@xcvRLUP;|9S+ko5a&bO8$r6E)BsI1E>E9U&1 zr#$r~Q}C#)E1=vNmR6hfGOp(~*&e{7vVK%q2ipHo!c+a3f=6Xt4P_0Htkq1xqq454 zti`Jeo$=IRrr=RoKY?;Jd?8bd5z{2=CR6aJte;g@+Hvc$dMe9iTMc+r*7eZ1UYD$w zn1V-T{i3oi51yXiQ+=3%M`hg*ih6T&)9HChWNu7l3LcepQz)8;k^Hwhc08ad;~JHk$>H%DN>KIW{fr zJz}8DjaE#-qq6=MimFk!LW|;_O0wN%!K1QngOdIA^{1OXwT&rwRMs7pmA~u!-Ja_F zvCV=nNS%R2=XmOgPmE+Xcog*?C>+P;_05G=ZS+(=rr=Q&4JSG(Si=r7uG&n&qsB$w zU-$3MZSHi>{NgL>FKxY;f=6Y=3uSc_YBE#ssI2HvmZvr_1y7{VfZjd&x9@>o#0N$7 zbK8AnwK1Na9jykBq7sCt??MzjYFtl*#TMsH{Xf%X~M`Q&pLQM`a~eS#*4DmaL9U!K1R0=qxiXPfcVB9+gF(_O^ec z**uA~9kq7hS;^YS6g(;`naY~m`@&{V-DL_Ml|`S_iH-_hnR}}IE?Yx*6qN#05%V&U z-;H>psi#IU1&^Yh0+qxz8d==w->aTF$`m|`N(ssxmH&L%eY>a9eP$bjM^z&gsHEm) zS_SC)M4sx-6g(;`waTKs+(Rn=DO2#MtTZaCK;0FmJ#~>OcvRNYp{!hThK=5BI&C(1 zR90G@)v3V_PZeSc9+j026s_2_jjht*R&mK{$`m{*E4|7(|3Q-3o|?=QJSr=0;hMsz2uN@aWDl4bTq8fUt z5>xP~tX!aiHT2Z$Ou?hFa;q$=p{KSo1&_+g1In#Y^gi};Qo}!)f=6ZLRauL_E&7J1 zvh1_ffJbHJ6N(&P{`kj-->ymp8Az3cvRN2pxpkdczjf}r*eN`;>`w+$||I?a;7e`-BYcZf=6W) zmaHh#>gIm6p3f~coW&G8DyxXfs&v1`bWiPN3Lcde3yQuMKv}D=yqqqNWc|SuJSwZG z${N<-t1+G`u-`OfHh5H4G0CF+m95SEO`ht=6g(=cxXMa9CiiAfEo2HFl~n?i+h0?+ z&n@q%GfcswvgniLem(qXaiaX5dinr{g-@TG6+7_$VJV@=LGPHYmh*Bwrr=RorG=tu zjK4ZQo~H&e1&_)q1B&Lnc@n9ftH#nslC_X2cvMzdl~pL?gsq-B%M?5+s~o7{)t9F- zere*(29Ki3gL=}uMl-7SM?1gwRCA`_QPgunQLCBzUt8s=_nCr6QP0b`h@#3jlxkdH z3LaIB3PMrk>HR}br94P2na}2uM`cwMie9IzZIV@qDR@*?C7~#bzT@Mm-b}%xvMLKj zS?x9s`8|sqmGhW_M`cwJin8cC#h%*36g(>H1yFRPm?x3=g_A9sAmh5m6g(>HMU_SG zM|mpYA=8lA;89ssK_xJ+(cGZ>Wl!a03LZsO14Uz^t=Ra#e)Lo=rr=Rjbx^_g0X~*- z^8D5 z1&^X?gOX}oydUvYio>QMv%#aNI-nBTmm_pHx=X52iYa(hHC_Vc?o-N->hqeXx-kWh z%Brif=z3$fWX)p=9+g#3WzlC~JavRAcvMz>l||$FRI;MJvcrW(WxcGjzL-?@4^I_m z3Lcf!KxNUmK9j6hn1V-THB?zNE>F#23Lcf!NM+IY+7inOaEK{*R90h^b!+nrV?Fi6 z*R~q)sH`SJk)zD2L-7X5xGFLQkIHH)6wSrU&knumse??xqq3TTa@W|E7XP)`Qw@&T z9>SxtnyaigUf+4xQ|Fk1M`g88S+j319_y*DM{O27DyyZ+N?9Uae^1?F3Lcf!3Y5Fv zm^SN|*F5#+F`EUC%4)5$X1{xUxu+5zw-h`otBuM^vAkIL$- zvhwXpP}x(BnSw`Ubphp8Ys6I?W$BQ@p1REx zJnE?I3(7oTyL)W+JWBIYBtWC|WNqlSSp57>Tt_vagy3eG5aR1e<(k$9+bPg$@pXi6wEo8OH{(~JC zJgOQKK)Gr(+j_fzr`}}>9+fo_l&c1PTFg^P&e|+^6g5e*sE2j$Wa;Ipkxap(sCPgm zv5iKmZAv-LQ~xmqkD?}nq9cW}=sV!cWNr*NXB&e@RbvV$R}H%J_0)Ez;89sqLAh$s zov)|C28=k6o-u4h4MNJ3g=0-7d=j*8nOu?h58KCG`HcuiizkI4}w9Jj8 zOu?h7F%y)lMwwGBGkPlR1=~Y-RMsp|$;`{t%b!2IbHP(Bn1V-9?}BpUT3@vDaZfE_ z3LZtx21RQxy?gLX!yij~>JO&iQPdnoH7M1pv8PI1G!2;z9!1RsMf;1k(lN2CJT-zT zcog*>C|CIbiz_zu)R#=bqbffSl&gG(9I;(JmGzSC0X!;eKB&azW%DHRR_i;%Jk_5m zcoek&6cMzozkaj4rw%g(kD?ZWqN=;iQ~57j4IZ`5zaOIFV;%*Px)mu1YxTjwHk+etz9!0H`9@6WnQ!P*LsVPjsqbk1&l&k!d-)blH)Xz-8qvpnH zP{A4XE@~K@8}O(et^pNedS{+sZp@a-SGsB>v%#Z!xK{P>M2T#DJT-wScvRLpP{Fz3 zsgq2>qo@x+1?PsRVy@X9!lS4UK?UcAr}{DlkD}Ita&u$Vw_V=x)J~@0QPf8=F6zyZ zs1JL1D)CRYhwvzBgY=LbG&elem??Nv1(fUI{x2(5@l+$G;89syK?UcAr`~4@9z|^f zK&%wQPd7lbWWjd z$(v0sdg>fg@F;4hWD!;DyI1RZs^BlA+24MmEB^^7S9w}DJT;yvc+}kZ6jX3-R1Td} z;88u?1uA%bxLnqaA2|yiH8(y}J#4z7V{1VK0Zh!4MvS^j3)-eT-%K8G7s|MXWcDt*&8q=rkFf=6YYR$25DG@iP}6g(>HJ5VtuhsISR zdQ}Ziy>QD&W`jp%ol#lOADtb@n#B}6D(ib07iHxfH({dB`iUucRMrnFYxs}Tt9YvH z-{@cj9+h=gvdFPwMBSS!<@lP&6g(>HoXVo_FMH}6rr=Ro=RvuZjn<9slJ(4O+e3I% z)&-SC?_+zaA5-wCtc#%NI*PV~OJjSsm$`9(DR@-YC6zTY;hJ8a%6-SS1&_+Q42sUn zw7+((IN8ioqnLt6WnEEOS?&~S;;Bna!K1Q%1V!rxW%auB@3)?+bk|5`gGXguRar~p zuYAK(?=uCD%DN_5)N0hegWn7*X5jzdU@(RQ}C#)8!9X13)6Rb zs@Xp_3m%nq6O`LugX5pi;HeW#!K1Q%RarOt?6~2nI{(@%cvRMJpxm6_mGSdu6G;vC zGX;;z`dww6OtZU~r?Ne;S@5W=KZGI&eX44e9LqzPf=6ZjDHQFmv8~2NdFmUc;89tB z3FWd@NLJzhk!F5JEqPSdEukojK0oiNcbI}lW&I6`_Lq4Q`KoiNI*TOh22=2;tlKK9 z+ro@_Jyq>L(~#NVQCW9DxvNTg57twQn1V-9cR>ZOu|4%arr=T3Jy28$+FJG5(8E*h zaJ6oK*QEaJ+Nfi)%XXLyQ&g9s!K11{ z3$_1j>ap$_DtPLZXuby|kIISyMaQxUjZB=fZF4<2mM<~|kIIUtvQn&>H^5WL`>?kmGA6Q}C#)Br2WnSw`U(eJJHvp4x~SND4A z9#inBtmL4mhP2UD<@=KL%oDcq@Tja5Dy!R}KY#O7eWu`1Sx*T?Sv0OEWPgoj3Lce} zQYiBz(r;&hN}l?jDR@*?Do}17(*Ei#o*K*)JSr;ZgqkIKpf%2k8T%bx1Z6g-N`3@W%Ddg?u<;8D~wl10@>d2e?`PkqG{ zJc`N!%FT`FUcaBKBXj;9Q}C#2WCi7_aiZ39Cp}d+nXMr_Dl0~MNR_AavZt0Z1&^Y# zNfuELuFQDVQ~xprkD{`Ja^E*!`|ITno@$=l_7EOLXl3)%L8jnQS$QOjdbsBKgQq-| z{wdo-cvMzim343Cup6H0!W29zE1$}0w{y^1PiZ$Cw;89tHC5s#vuXa6_LFUG6rr=RoMO40NyDHT$n2&w8rk z)0ToqQ6)g7Fa&Mc7q_eJsk~_|1&{iEN=Z;u3EI*ht2WnC!SBPuqq0hYa@W|?N*o*5 zS88~bv*1xREDg%7qGvulQp8iO)7c)vqq53?3f9n5-!KJ_qRN6wX2wKgYk#lSNKe&G zZ?oW0R5?)Yd->bn%Knb0jxYs}qRNAED_fzjuh* zcvMy;m36oDf8#xMmnnEuR%K9bW$Sr4eh*KL%xtsZQCU?~)|H(3p7B)DXDkJe%6dU% zHObQO15eFj3Lcg9qRMJ>a9s;e#bmKr@Tjb+pxplYyz2fco?6WmJSwZ2%DOP3%tcQX z&uX*aQCZbNxp_DxL%m!LWFCIX6g(=chRUMfndYhLF*XYxl~q%XYtgK(X+3p}DR@*? zEtS>0^XA*0YMISu!K1Qj%ec&w$hwIq|Mk>0rr=RobyQZK@m)H2s&96i1&_*l36z_M zTP9tq>!}A!!K1S3s;uvej7smRaXD-jJSwZ6$~yYoktCizk>GYkFz{ zQ}C#)mqEFCcz##+;-1Qv%Vxo&vKpwYiYW^>^VBA$;89r(K@~Lniq_sbHCi?AE%UHK zZkq*<%4(#tYNxol+EbI6f=6XF1{FLzcLr=ZQ6g-M*1jf{&Z`kfeUr5dA|f=5-Otx)Dk6J9<@|(9>Sw~_zEa@he$uw@{CmeP0oTx^{}(*;o7PPvUutkQ}C!Bc2PaNwDo2! zO9gufkLqDpP%&l?)7a8fI9aok^e}rtTMc+r54))zHp!i|mZ#=11&_+=4k~!0cH*3fDQ9Oi811R4Ou?h5oAcPw}+ zQq=Yk9z_iUWgf8AY|{KQPgQ0L9!0$Yip~x+uJvJn4%sI1|jXdY58>C@?+s!+_13m!#{07Wy39F0aM+T^K)Ou?h5k&2?9t?*QW;x-E& zMU9dkQZ*_UU((W39hibgQKLb*yX@UBz4Ml*_Av#IqQ-!7Gm3t;!c)0Q*dD^8D*qNJ zSNYU;UQ6w%8BD>Wvc`gDiEp2-UkD?}na+P27 zVbZ0ZTFDeVikbq7uIH&5btest@2PuC!K0|Dpi&!xwtq{$p4n3`m9ag9M^V#2x!Lk$3lvqJwmsuJ@9|X8a<+%?sM-52DEq1<4}@kfJSuB8sNmXrP-gEe&VonP za1JO}!<#!tO!Cw^hPQSX6r^N`kFPrc0)Jc^p9C|Y|xb(tx6 z6g6LZNV9k2`OKL;Rs1>ILwFRm02KYMD%vU^ntt6=Atd*dGbKX-un1V-9t3bI`^y*t#TX||HQ}8HiH7K{gwnTc~ z_f)D%wukU2YK_XeHS_Q!Pqk$V9!0Gcit2u6NSD7owSg&k6txbNoAb0{dn#UK+e3I% zT8+3KXDd3s)n0Dxf;GY zFU4w4#lB$s0FTPr3@Ui9=c&O=!K0`xplCg$cGET3GSpLhnSw`ATR~CfX`7!jlEYI^ zzi4|1kD|88xQL?9+pLpnv}Fn&RgLXJnJ4(7<}1&_-57?fK#zG!%%BZu z`GZWsqq6p>tnr73we!@C+BORwmGwC&_g>}J<&|!FDp_4i!K1SFs;o5Gdi><6BK0i= zkILEyiayb5o^ao+S$xf@TjaWRaU3m`A>W5d<#p#qp}XFtX{W^Z1z;V)|P@tWgP>7*>Ws=Rb0b$psZW@KM`e8lDtJ_Ss$n~u1&^Y>mMmJa$3FP2 zsHc8q3LZrr0p*U$v*$P5@zgu*Z5BL=Itt1imGtQ&Pvz}kDR@*hj!6&AlgRy?pI-CS z5vJf#=da_S=nPBS@M)J?TPk?X29N6D2~h4DfZoL#Df{cSj<$#Js2-kFJzU$P{4h`L zWeOgZ^$n=tyI7t|)yZbTqo`A$%mcPeFV243QyrLsM^WE`a(7ZaC++CgQpUB3DR|Vl zPJ?pmVbe)dp7T`vS8NaAQCZ)C3eH1MHDC%JMV$fV&dZ6{|F+Ik%b0>kQQw1d^RQ60 zMOi)dfGKzs^#drkm+2=L-jQn5?QF*dkE+I5P_7#E*Xukrn<;oy);UnF8uSTCPhDUN z9z~r86+BmZsz4XpLwFQ*0hD>bb}>_?8=iWdDR>lh5mby}Xa#6nH}8iTq#FB~f=5;3 z5-3-V>c#7(@zjf5Z4cp5S(iZt?>IcQhbedzbp@0=>vb5qda$P|ce7dWDC$R0?rQn; zj2(+Tb$}^&6m=C8?JsI~%j8y_JXN*3&4Nc!*Fe!{dugjO;r3il9bgI`Mg1f_B#M5H z-c!|k*erNd<$ng{Do;O0@2OKv!K2p0>!56#lxBVdHTH6FJ%mT~@E6G<;&h|!WwOZJ z=+M))29N6D4WZ1FNP*ZLuY2m_-j;$#W!(hjKCy7F#q8#udaAFb;89t>s;noreq7g6 zUHV%J9+mYQD0gjBdBc!Hp89NnrQlInzpJdQD@u3uRQkb|f=6Zj0m@z5TyJ&rwx{|G zwG=!m>ra(cBUg*Vo;onhQt+s(zf{)#?{Dn$RLpQo!K1QnsjM8kt9J0zpplk>M`isD zijGR!Mr=r1FuBZ)qoXYakIK5OvZhR}x7Jh7kFgXyD(jA9nJ1A6B??{j)EcJXQCW9Y z*2pe(5_>A+TQ&?~5Lu8o(4hDl1ATnui%PwJwxRYIuPu zcvMzAp{N@4v+bTr^S13FJSr<1RE!~r`ZU#pIi9M<6g(;`zRKEKJ=t_mz0MRoDk}jf zch;N#)v6nw`iLobRMrzJ>yJDczVg&nrr=RoPl9s$tHt8x`8}0sf~^KTDl4JN`uW^H zS3FgZDR@*?B9%oyv+t=fOu?hF605A$eX1Sv)W=N0qq35KqII6O>WgDv$}4l@H>TiG zSxHsa|E?ZC>#1TBZ8hLgS;=Hvltn+u^}S>bUE5i*erNdR%TG{ zo``-*!c%=`S_&RTJp+pF9jJ#H4lJDMsbaG%1&^Y#fO78x%wAdMcTe4C3LZse1(lPt zetmxV+N)BH9q-yKcvLlFK)EY(`e|-Ym7Z-WcvMz4P{C?=Y7kD~H}a+M#RVDkx2MK7=vJc=p+idFz}{1CM?WnQVqdZyq})hGzc zRsOxGUL8Hve4)*PM`b-5%E~8M(eGOd9+g!nl;x>)Ou?hF3Wu@^OIG7WHVYn=RYYYq zNqRT0r=k{H3Lcde8_FsoS!?ZU$P=gEd`It zDz381{V;Kwr&coskIE_mDmZ&R)nJ*;f=5v$LAm$Y{`R)qtyya!K12C29%qBWev=lrlt1PHsH9WPRDR>lB zPR2#;QZ+o)a+S@3M^WX4qH0WDI%J8blCQQDJc@b_lslIHH?75$LQ;*7nSw`E<9Sf7 z8ZnE;Z1Pm+H8u+#l~nDEE6)YoA#2l&7+MU@3SMRRxs$%D=! z%8&lgX2GMX@ggW!dAdXNRF?IYf=6Xl1?8^U8V&81#Zz0Ef=6XlQ(5z#TwTjkFMnjS z;89uCWn6SON_SG8y2%tgDyxRdx;l1WW>1aVV6)&+Sv5hqYXG`;SR*qk$3{!Rqq1tL zEV_5_)F`IlQCYQB7X1~fgpzfMDR@*?9hF6&`|?!5O}2;dsH~TSqGOr9N8etuUSkR# zl~q?Ls(iY`->&o2S4_d9vg(0yN9Elmci&7cSvfb`9>Sxt>Z`0Z7w!-9)H$Z$QCTm8 z3Lcf7dUuP>f=5veK)Ivx{?t$Ac&foxOTnY4hM?S0IcHY>Z#?z%HcP>ys79dZNO5-@ zg{2zDn1V-DqcJFVRMH)Xr*dz%S@5W=CZK}V@YE2d;89dlP{BJ6PaR_l9z`_+6};o{ zRH2V;58+W%b5Jo{jRQ@;FZ7#KV+>R9sA{wT<*KpgQlD|2`id!dR8~t+!D@Ia%?{f` zcofwNR29=h%6lbKmzADs%@jO}Y7L5NNZVH*WS{A&514{SQEfoE)rRgkJav~TcvLmo zf^yZMI}T6P-D$@KkIHKIh^%Ey!K1R;t1SA744?HcQ}C#)4l0XQ(N|?Jzx;{qAv`Lp zqsppVsoE4z4Ppu&mDLGUK~r@)zV<{<`Q;zUn$HwGD(e-Ml_lP>{GK|^6g(=cGpOK< z@>Hr%?YQ7kR2NY0T6D$K;}<+tmnnD@)fJTcy;%2N$=|_K)0l!sQQc%*G!I|vJi18^ zxdu4G6g;XL-G!oco<61HsdBsQxZqJ)J%n;u*(GZ^Q}C#)opJSwY?P?SaI%C$11+V8eKghyq)Dimeiy12HYrzSB4kIL!` z%B=u&4UkB(wlW2e%Ic@G=x5tKm1d9aAv`LpKd9iDD4%5YVG16V^_t3}Gm)ouF$Isx z8UQMIqUy_jVJcn z9>SxlF$9!bd+GOMd+Ix;;89saLAiHs*L@sy!BcDY*(`We*6S*3Zn`{mJ@w`nmV!rR z4Fl!ApYmU_i~T*-V85l{QCV-Ote!)jn&qiH2P_4T%6b!&dzW~?gFd%C^$%0r z?|Q1%VN1cIvPP?{i-o`c%TrmuvJ^ZjYYZs20?@g#t<1x}n1V-Ty`{3~_ojNP(APE# z9+fo~l$-PPy_;tws|!=`sH|}+i~hd3r{Sl&BRPvanws*6 ztW}&v9!*Vs1oatHQ{=JvomnALw=)y%&}!^@>Yoi^iaeT{B^1q; zKQ|r7=c##2kw=g8T~LJ$L8Hp}PV;@9+Qk%kbk=N8Ik|^=q*s_CkItGS6lGm)o$)!J zRpz*@DtUC)T%o8MSL(jF!cz^HB9Ea0^Z7kcanI*zhNAgQ9!<>yMOOv1?VsMWvCmq` zS>(|@oDVAQ{k4}V@@Q%SC^`?)xE3xbcf)6$VTwG43e3!fpmG?3>h;sHU#@%V52nbY zv)%`lle6^xN_@gro;-#M)Nm0fw;I3SX5L#qs~S_}(bQs4aaX>lp{VlY(bSShP;W6s z9!)KM1hteY@)#;m!)2iIat+%aY;uAecH70{B9Ea0NB442IgO3Hx`t<&B9HFj3Q%!Z zBj-t54f1GeB`7+MX}j{mpukE}!BDi3M^mdFk=2;9$YZELHCBVlV_KwkpGjH$5;^SF zhqK6Is6aK=fXZoXIEy^CrLX_Lecpz4hMN{#ts@cF&hOj~d35@AP;npc3BR=?C6A^) z21Pk;d_F5TQ{>Uq4p8peCeQ5=H9TM5P_&UpQ#(PqxjLhKKl9CSm)eCX@@VQ4l{NLB zG4(t(lPU5TDzHj?3M%e1<8G$Nqp4k>=p8efd4vAR@srOw&lGtK6L94$hM->B z%^lrc3`OmcM^lF$K`mm6JeoQTD(-6BV2V7N`U;dA*U1Gp^OD1E<-WJ$B9ErN2IbCp zL#F>Y!BcNDMIKEZ0c9pc#COh71Lp+uFyrsyasc%8KmH)vLw=Q|A zF;nEx)M-$(ZqPPne8Nhe8p#xSH1!=QHMYNA8@@VRN zP+4sUBZn6>y6LliV2V733Y=wr02TKtn&yJ7A$c@)R;cj(a#5zpW2nGc<{T(@miai+ z$sE?MHuaezkIp&|DyJD2dG#vVmnrfXDzJ)P0F{ob@n82Jj{2-!Op!-Z7eTps_}}i> z&pdU5De`FQ5~#AAb?nmf!#tJyqOBo$G<6wNd8Sr3?z72Lt(hW^rmlc;^RRB}Lz6u9 zE>q;u)Q_O(d*Zac(DHS2e7ef-V~RYQx(X_fg(5G%Snjr`?l46jOd6?@*$xUz@?bJk^0I@@VR3P;M3d{OA?4!`--MGesUvT?ggoQDhp>NACsb$r`9k<9!>oY%AN6Y9{=is zr!F%^9!>oL>RHZu|H>D2J(b{!tp<5C^(QD-`P8|7U+Ad{Op!-Ze}STR=V(j#?lb>- zYA{pe(bO$au7(|cJZ+Xnx0g3EMIKH44a)r<`>5qF2dJA&kw;UvLAkvg@1uU(d{*io zZ8gZFsXL(DoX^!@+NYkX!xVW8MQg7ee&jAFx{jiDJ0`zS-BVqeB9G3x2P&^2=x)Mp zPw@Y+U7ne*F$S}HLPbS+Q_4`{sGn2yhh)FvzyCW%~|BpS^qvF>po|Z zM`t|%<&Me+54M{>+v|GR|C;R~c{KGuMWwrUz)VR;O=OBZn)**sPo7CR$Wx1$B9Er1 z;L%a8hj(_339Q&#m?Dp+=-cL=x;C$6MW1zuDe@R9u)pGgihF-uV2V6CD;kuUM)>r; z-d_oRvU7txnu-s~jcdY&RG<4E#u$n=@@Oi7qT-jR`KzZ&Fhw3sJpsz?p@NB?G|QFy zS52nKW2itio&*(lHQF#m9-WmC6dhl*)wuU{9iO$7De~y7M32Zi$P{^WR$@@@dcJh7 zeS>{g(w}V&$>S*djhQ5%a+=;z_49PfHNsP6nIey-l7gb^4Qh8mWc6WBz04GOG?fe# z9mlpe=819GtqW7+(NuC!)I;)C8}OaEq;k|7Op!-ZDTE4-Yd%xt(bQ9*+_)}3Ir$x* z^%+y-(Ns!MW^qRi?RZ=dFET|QO{D_m##Q~}OP76Cyz90?Uq(?Yq?c&Z&!}InEg3V;6lN~mh2{V&D5CsvzgG0p=MN#np5d{^+ z3p@c2l*0==|KjWGiK3_o>i_ptRUg$|)!mcnWRrFK^O@}I^!It{si&T*uBxuCeioBD z0^cYOveTs=BKWcI?|5twBd2v3lTv%**+PmKS?bx2l%0Z`R*R4#MwWUGlTv%5S4a^f zORbWm9=dX+XACx&;Df*-#TQpCto&zGcD9cO&nmD=z3 zJT{1trH*u@f^m3+kRk?B9?!pkNf|JS^!~H=tDD@kHVG+Wj((+1`-j@O?sx7+LB#CZ&$UdxaD+vQ&ym+1`-j@F{=f`65P^YI3B=8?Qd^ zu1^uck1-)d45U2XXl7EK!W$p`aK6ixdcBY$Moz1RN!i}`=ac%+ccs22q==EFTA38( zYad~kEA@zwB1V>KbEGIYrJvn8;Yu|< zDPkby@!|1IYP0ZR^}au_I-dt((>*LW&q! z>I5c5o+l~!s`o=7MT{(Uq9aA#IQiz2-|wb%^q;wf#6Zg9jgy$vslpq#f9Q}CT&b4{ zDPrWbPG(ZJH{>zww}lijvQ(N$9fP#+MI5$Y4tfGMwaSeQtEc&Q6WW)EY-=R?0m`X z#xwrHy+MpD)#XS9WBw!|MT{)f&7|yn$ND(7T^*B;?DG|Ysl8_=smg;3vcE053 zy--LIBTMx;Qo($ESV$2gOZ77;J74lu?^Yp2j4U<4q|{fv`-K!SveY1xvhyWh^;Z0q zmlrXz)Q}?;%-4}ZiWpgHm`U0BlFO?@ND(7TjW|+vDG|Ys(}WZ;veYP(vhyXE*A5{? z45U2m#yTd2=~`C5e)X)Ko?go3LW&qUt@TXG&X-)jZW2<&$WmiWN?pJ15mLm+QX80* zoiDk5Js_lrk)_5RsbG0M^&wu$#K=+`nUtL`IS!8#QpCtoo0yb34*P@@F|yQVCS~VK zj>DXgB1V?l;z$Mab%Br~MwU8-N!j_5dk*gvQpCtoFLBb^M?@bH{P?VpB1V=v)sZ4r z?m65oq==EFPIIJ!`Fco55d$et^uClywIUrV(ThvvTU-kd`x`H1V&t?;CS`j=u9ZDP ziWphybVtheft%KhkRnEw$}%atl;v7^nUEqzmYQ&+g5LPDkRk?B9&hBB)boWmUiGP+ zH@X)7SV$2gr%L%Hxe0CS~`dPCM-bFCl^-4+|+`BT{gsz9giGk)`Gw zDM~?ZMSm!yh>@kXJ5oV!{6k0)11XO;b}*^uAss5w)*Eho#I^9Chj}RzBd4{KN!i|b ze0$g3uGBF?iWpgH7n3>$>EMevY#(+ADPm-)vzU|}8}iuU6d^^7EcG%+D(H=~gcLEd z)Y(kR&X+tUdWVoAMwWUxlTzpFMj=IvEcFT|rOwygLW&q!>KsQZn6HP06fuzUl=8Vu z3b&$JDR2DLk)E~s{r}{pOpKh?E18t-4LRno5K_d*Qs*%#bND(7Ty~>da#{3D7 za0`i%rOtPxg5J1HND%`mk2hY;q@F9h(R{|IuOWgTR|_d(@jU!=&ukklVxG2q|J@snTkn(urbxew)mxw>*kN!Ck z{CK{QB1TT@^-Rk4hTM@i(k)&iF zendzS11XO;E@e{onCR5fHE(b&{Em_EJGn2COC71H~LW&q!>Mf3x zor0Uz^+JjmS?aA!N?po76;i~=Qg3slg5G%Azqt>Ift06|-_E37AiVLx+kWI(>zEQ! z#K>vAgGt%mklVvyAw`TVbvcuweC;FrO$0x-3Mpb_sdqY3#L9hu^Mn*JT+;`{FQnDh z!&7({(_`O%zwWq}!)=*{hUT0K`VJ@y^>Lk{@b<7}CRhWmsRF>>nfmZYwI z%Bml^QY-(%ONSU)>OGQ_IkMifD({6tiWphyN=fQ%@0vx2*Y@+MkRnEwdaoq4>Pf%C zq_QowLr4*`vca63uFh4gJol?jy<0HC^BwCqG;Zz~r~kdr(QNCpB^w&97E+91KmP*1 zP$}_Wj?Hb|R$1N3&b*)Ld4|2r%TaO&Y)Yri4#P}!4H|vDgS{hN{awaPp*UMD%vkBh z&f%sM{tnJ$cV@R++}O;C@S+nN zDo$0mnpU}7Dm$k}yV^U+9&>YPu4Ba~3n# zR$&gaY>}Isb7rnIyNhSX^JCtsRLiAZ~TE8CJY~OtIM&dOGFvZNMLfxt!f)7Ofp7FEEb_ zSPq()3MJ&YAswa3>r7#@R%5{YXwuxUwOra^>Ma#P$?eQ#E8hCy=F&ak%b9yZQvxoa zDgez{kJT>WR3FOBB;uUvqDgIo9pS8crJKz4)+7QO)dcyjh$`gRjkv3td28B2TVZHW z3e(JHDw^u9S!%K-O9qQ~R(DbP(Hu<4siIXyVuhT2vJ=f(Zfmw|qIE4)D@G^BH>Mj| zi;%6N>USE=q7n2v&+N1WW|@Q_qGdJTxf~3tc7PaQ~?6iT{G{*`vv(uJI0bVg|VXk6~CzSTbw7JO_ z)V7!uQut8{YjXg<(1k5#OxK)>BCMGW9w(&zfn9SVcHBh9_PjLn@UBz}Q&dz^LozRY zR10~8J7EwJj5R0Y#A7-&U7A9}=jqOnvkdvl7GV6Bg9spn{#K?T&5 z#FF=l=Pk5Jth+yx#h}2}il5OPHZYLz*oq&Uj7_cR^#jY{JL`|8%&}dSsx{*c^F9i5 z$3!MaiTWyV?4CeKN{aGU*yAtnNTjI}$dgmr=~VEf!i*r~w<3ZdBYAnuWM}Q-psK-& ztC*d!470CZYVGI*#nmp*J32!v}FuW{R z(d?aNnHX2+W_Ou|8Oq+q2t~FZDIE1^id}Znsg5kFGG@Xoqg>4y=oe8~&(}AsLZztA zl&wl>db?#P)SJVbTG#W_LnW#>=rPcsusy)CW~44#XcSYZh}7~yYuYnxWSmYn1riry z*>tPojJl)Sm$SyKGGAn1i1LEv@YpQ@Nhj*qYv(YQb z+I=?LWZ|N^y@5ukIqH|QZ#(>7G5xfmv}3xo!z#0Ha~Kts5fqr-qJgT(g3SIOj~sO9 zVK(&$?LLQn-po@-+W+&@tWL7|F*XEdRojWebQ4AqTe9V%J+@Vxu?GmwDYLJbD_fJs zB)Q$-ndYg|WrNR;by^_^<-_Z|7T$(61r-iaGsa5U>`|Zf7G)IC>s zol*vOa}h6IECsVhMkx4diPa;u&6^yP!!V{577OErA=MJAmeGp!m|F3ULf)b=qQ3~> z<4tVV0Z!91(Ah~Ja@uF?=nSc>vXL3@Uoffx-MDR+j#&!;A{g=tLw z8--HEQwdnrqbvlv_vHCB+5wf6r&p^6m|9Yqvb!SGXy{ZSlg>PH3@SHmWy^|uY!){l zRHs$Rl?(jlhufpA zXK2Q*e4AP~P-}@9Aaq_!Xv4)#5Y~n&(xk4dkUHSpSFeyc^zI~ zSBQ+s=JV)@j&L_AjKbx(zC*>wU2j9_+O{5Ox+&Q@djPN6u*@>XRBpnV^^_?Ig@}VxxA#g7C}|7 z)wRGkFp*R7o%CkM>A|F%0tP$heB+EwtrNR2Mr3tCO2~V{G1qZeaB$(}qZN5Z6drGn zueYWP*@?n5-4$V#oEzpCPvzw0hs4Z)f;BO!o;8Osw^e9I4mXrG;Ue3ClEs}-I)lDj z$6UFL=_=e!v$FZVJY8w*K`EL|^q@2|5xNiP)9U93TnW|&wTZp-j_kcqj;kR*i-iawq<;_Q&t8I&GkQ9UX9(H}K zLjk|lGC4h0**c#LkQt)k_Y_*peE2WpHM&6-cW(Jm;<(Al<4s?LQuRfTQo8fQhcRAz z>d@$fiCgpHR0dy&VUWDdDWRI=`Pg*4h{0Yx8cLWOn#7=^b|Yw*)x#onb^=RosNY$S zlFHW7j+tz6S8jev%zi3e^it}|4%1PGJ4k+KWy-2bx6Lq99Nt2*pdf#m{b=%Vi>#j- zfSr}uxq1{~{KFMhENfe7a&mr-Wz*7=v$&{?n?nu7e> zsld55qR`M5hDNEbX>}SxRZ}uwr4fxw{c4phMO|tsJ`^>r9-Z3S5mNUSBt54#+Ffw( zl7M+d4eLpg%RC*7I)hNvTTD(RrjK~0>+Ff>YH+e@I}@_j)1A#*Rl3B_VqpZ`p%zQG z67dPmpRq1)V|ulA=;CjGaGQc%H@C1gUf%rTdaLgt8Y!#`6DNPCJ)V*40vKz(PSb zmB-U)YUcNxz#|Vjl`JSK)zWM@fhD3?<*hfKHQRRXC}pa)g(4Q7W7xbwJj z+zvg@+z08w>R0sk%o%hf(8n?<_RQRLwo);|9m<*kW*J}RX-_btcT-!rFh%x^%^7nA zJRX2se<;WX{-3;9h|d2vm91{IXf3Q*txypZf?F)s2X9aOigT2|vNcnxT3CqbKZzMo z`=p~($kD0lT)AjsZ3!bn?nDl)*cob zs1m#;X-qawG1~a8kR}b`GzM&@UIW?90h_P)&YtpifvyDf=!o}BsHTlxvIRF6*lmVZ zUe{6D>skDIA+0)8eR8&!L%lX zxwG!>qImpV#|jr-(r_R0nQ^Mt0-DR#JlTbx;Z%}vl8|w87$!lLxUL#Vz7r`r z8SX5hmm8KUMIo9SAYvt480=Z^#v2)$-Hm_wu=@_|c8pIf;CGE3xGG5f5T7P&r_Xeo+VuK#KXZi*+!}N6!pVjzfxMQfhr;j-Lb!2p?2hUG2u@293VQd7NZWIRM(NP*^ zqF(!xHpQv97L1A`hB1w)o}o-{Uw==xu&Yn$BXgAMei{ovm>W@*@!;<=v72UCV7+Np zr_0t9t%^iWaG9E$oWy_|?lw2F<-2A9OF7xod!FBv&s2GuHt)ELwKY75aL-usj=7^u zPoiNd!BQ(-ZZBNq$#gP~NEsL$T@Ph@Ors+H9mm z*WVtlrwm$<;#Ck_^dN3+;Hv4lWJxPzS-`=)_TxMJ*;hP5(Cu6Lth#w?j^V0T-o+Q- z*?ozaH>TZ-a|&%Ft&N$F0&#DgE`{l)I`pun36E41F?O%oPw8ssA8|vU`EA~lofstA zkKUo}STC+Fyg6xFp!S3+=lbH5Ia$V)43igAxM#SG>Xp5AV1b$$3Z&)jAU*?*JY=ev z|I3-^Wz&3;nXMR9&i2o<_#M5N*!^G66^S<3=;(*1>QLvmvTR}R468g_#%vc^TAN*4 zGB5|NtJ8apnBk$e*~F9-ZbZ#tzP>SqrOv2{PSeA0Q0Z@1AVl1`2+x8RHUyI^wLg_k ze^m@0%(q;{wK{r(Kuv)jc;+0*nx-V{5=kLlNEmZ$bX*8 z;?m*S2B9=@Mzf)sFm|TK@EkXsSfbWEjvS4x`P!LIw&{Xd-O3&ks7aRHw2UL+@A}8H zQI;Zyu&1S`=CZiOgyO1W8p>0--0PuJRXsJhw~i|3NrY-}Cp|h_hdQSQuXpw?FsIly zBD;)@Cr)E^O+IU8TT*SQY-`J8OHekM}Blg2R$s|X&q1cUBJdZ-|PQXbl8}uL#>sQxSbhs^n1x^%4 z&QlIpQMHLboVBD)WJ}YQw1sRtt|e_DUzWGDO4+L)A^<{1u{J85o`FXZSL z(u2c@S$;W(zru1j9L%A=gE&jO%R#Hxfu6peb2_Tq=72T#z+_3MGll6Z_5cxTfK0H} zIMf++9_6>60zz|`N8!$3FUwin0~I|nS(-hfy@_VXKv%bx<|>%4s^D&isQn={#szb; zbZeExMG$0twfQXq;0yC$(PVZS6MwW5OzcFoop|)t-3r6U_f9&PGFb3r*hn@|d{n@J zw#e^HFXA>UCLZFLLzZ@#e3Xh-0lSD{{-^eqrctT~@)PEErJ)$}Jh-i>0c^wQ;HmtP64_k`o-V$KV z24pt1(h@uNKc-9EY)H|)P@Ka(6b?B9cdtH^EhA=t`~0R#8RnEakq@TO9B5_^aG!XH zIqBcnDsC$d85tuG)rqWL)+T|gY;J2~%D~2j>3SX}G+KKz4QZ|o&LwsAKiVfLZDC5C zIZawq5#we!%1~Z1fFIDCRA^p^r3l_+nvZ80NMa>`S8dB0rZ%A^4_?i!OfhQOqTm1V zTCtj2vD$9gV%8~YT*MR@p8rc$Aw9XuHPStAQF-8}W!2|XWnecIwB*I5bdy-&BWdvg z&2ul!B_#^W6X>W!X-#I3XqU0fA zj5|sJFSxquZVThisf63$G=K9~SL>Wi(4b{785}TrzDv9Vik9?zJ??odFN1LlWO*4( zbG8AClNxS&TCpkih}d#^dMV%)`{5$*<6WAy?X*4!Q?Fi9ezHuZJekLB0-6{5nU#P6 z=x`mcyGrKuQ zD+Fj3&hzdUdUhrlt949#IJ5Jt-zgklhd$p#imh94z^N|t7>WyZ z%WELbjZR=7%@r-_fwXU!$1PsgV=|G21b6!gR6APq;{$rV^5(4=oSRsG9;ns3@zy~LU--FaUx3BT?DAdi=VV}aF88zN zw-xW(r4d=euL$;35}t6vD@(Z2WSVlnuHDg;D{QEzDHrONS5wZ7PM|60ik9`fjmSb$ zyGweiqgZ6VNUsVHB%J&tEzeLgO@Uw6?q~`WHq_G;aCOVNGPL~{44!x%lZj%#uH6yE z3LEN)V)0PQ9=*{tyXSZ;0Lp-m#B)Bo1<4CnK`1&T&c9JVBvTEY;#=?NjIik zJ?T0ok})xzlq#B&_UfvC6}ea2LOg5Z)t^xB#H+H$el1FU514yZCNbIM)weqy$wvCv zEqOIGfK_v)&&Bg4MZ}T^IQhKenEX){^lTzzfM}&QXYVLe}Wr zfYMPHPC3d_6WKgA{lJzJ5!OX;jzY7?M{2AKqa0=2x^g+Y%Pd+uu!nzfs=76fp|M1q zWQ5I1p)m8K1?(hD)+%G~B{*9t#W#?*OD`^Nt4}jW<+7D(4Cm-EM;&*F3x+sB1KFxP zIdMsCW&?<$W;4p(-gjGUWkUPHIu6sFw-sRZPCaiE(pK6;wc5sFmoH}voXHZsv}`t; zqjwS3l^R|fLQepDw=kmpgON49VVmR2-IKbV`E+YtxulX3+g2&%;8dus{{s9H3X{+AVFubxkN=sH!a4o_sx)tWUm*N!Blz`h}{#lJ&{gUCH;! zS1ZZ-1ygTVS-$;#-swWscQr;|g1v#juCoiI-8Nn_TXX_TWoI{0>fLO{AF-pYZB&g? zc4FpcY~lp>m}7W(EMEPhd=r(tktu)utDWxr71$;O`sKCky~zdw`9zuv$H$xQeT{fvJH(DdX?@to9Q3Q&Nd?67Axh# zY%@!IG1CkUBG$+9)GDV2Dm>z69mQskg4Wc)DAG}ys_d#%t(iazq%t-db<~s92Kn!6``Hen7orf6SmnBZ!>4_@(tRk18fznmxtbJy|0o}cJ7kY z%jZ8*jp+rlcp)@9^JNQUGp5QC*X#ra-S?tlH#-N^hVu(=d_*`D8jH3~Z29eAcjQGRhm*Q0h(ryEeaC{GoariTAC!M550cPUnBG> z1f{s=u%sc>vY;GyTkUc@JuE_)S9-O}d7N3q;@Q#;Wg&G2N+|{$Pc>X8nynNHEaMA? zkYrSX-Z-yO)EnnDih5(DMp18=)F^7Zm%X;qU$2yXyiGP;W&1GZJ?rmbw*r*$2z zit$c-heNiibW_kcLmDA!&U>Okr@~WII>a#pcWC1{DFpHu6sjx`hM}}4522i!5woka zt2;A3xWOD59Un6@T1TB?F2~3yn zjskKzX-mZ`7#r+vVJ9Iv=+I1=$ zz`C_6+p@Z~Dx0OcwQ^g1Elk~7-2ez&O@rmBM?A%&hdkcaLmubpA&)Qg5ZA;SA3el1 zML=8=tFTd;A|Tt{zW&sv)`?wJaWh4#8{QL6_avf=<&~*HnPXbumVIpsqZRiBwVx{#eHOw&`Xo-SZ8bZZmygmZ0zo)E81&=dBx33{qRZGt+N+WX_y;Lb1+ ztt-QXv~CO&(z-BANb9~ZA+PKB$`cH#@o>#J=AAG~F{|Zlp-Mk^FOPH=+JAYhUDz{3 zM^&g@J}`8jmln^EeqQpn0~hh#BF-$-qNeE<*P?XOSER=%-T0-D@Xug@a8;Q3Bnd@uTXG)ikWl2z&kMzVVSfs(9t zx1f^MYZqLdd!jkl%)0fs#Z$K`e~Hws(5}68EAm$0x|O-1QMW2P8hDKH?N#eks;J2c z>a`87$4F_voB9Od^E2rlew+YfC1Gxh^{>l8R!|x*%cfDz;6oe-B8f zB~C(>8_P*(^G9({!n$q4J>!a)BLdBG z{2Ipomt7%yp`BW2H_-j<=ot2g%vkY=ysERX+%mCV(*^g#|h4#~2b<>?xDP zbq9(m@f18Im$+`bFg>f*-JNEVDOaifFL*k3hG=%)ogAnmI`wm+0PatoBf^{ zwZ!!CIey$^OH3ob0g$9dZX@<5OW4LFHM#{oJ6BIZV@0#CpcB&PDd>bWdI~xrjh=!| zNF%qA6?8%x?Sl67KVr8oQWuMxhP8vv-1z+TI0iY_3h2S5Vq$Kx_FjzBoZHqVs?;{M zwB0KE+voXO%vx-`ZonDPEsSy=npmW_FzUIx7fe039!p&o()tBcZ--6AvbL2bC%sqo zdZLDH=Q25q8_nb9&;;uNR}BLldb7XRyJ&r}ll5koth2j-byRDrB--q5Y-u+9`CZg> zo#-S_FKWuX+97ZkJ!PI}ER$OFlzE$fl04ruXnlw?a1*^8U^E=XDu$ z6x$}tSLyk-I?>nvL^LamPGFSh+>*Du25!eCN$sxjop!@lr}}liC`p@%YxYddB(FR$ zHojnZ$PaM&1UI`U4Jx1&41f~}wEl;U0Msk5TSd2tH zk+B%b*|EZA*qZojY!^P=;N;#SCv9gNlSKA1NxYJ)RL+aKLOYhShn784Q?Xb#L}TIp z5Q`<`hDa>j&MPb8W>&;8lkg#YHYyn^_AIDxoQ+tBgtgkn(){@(EM$B8 zHa2EfXTpsd*17qooSan@MW+Kjc)U~M`q98-0zW@bT3bPWcHl4g?6)5 zwY$GI``W>9CcDFE+)oT}=ryrkW0>R!O@31GIhMf`gdDdGqrK;r(ENuv4T8jEy zURDadgtR#~B@)udXLfKGA|ZXANzMel$EGe5(Z}t>t?GpG%l(&}K5ifGUM6Z^a{BDb zk*_n;vlhQ_~?*YV4K0c7v zfYG~JouBL22)<3aHZ4QbJy*bGXno*1yA1Q-xtcFS>+Ncb#twBfQ^hKViMgt^kTur3 zo$F#J>sFV=PT3#oi=Dn3ri-1j9b$GrF_X`iElgc$uL*1{k!~!_(hO2|+NkdW!7mf? zBqO^#?KV4j4+A&AmxxD}f+bF`b&2={{oUPeiPKZw?Up!w?A>mO(>veomT;e-U%%Te z;XY|w0+w)}ECowE7acxI+HI{p_X$PGZZ?F632*FovnkvsOTrZH72e!039l>(Q@B?! zsj~aSmdDDHFok=CH~C8xMdXm&hE(@W#6toV^ys zvvZl}o_$j4yaVB63=9r%lhNxPxF(~~E*i9LW7f2lt6F(ys&X`2DC>%A9V;%Z6Orao zz0(;9YIF-IL8bmON>H_1ObIHrOR6+ioho6OuC8RdYOhF1s^l#oJxG$coe3-DmZIa8 zyrl^%wTm7W7pJTqHnoZf7-Nf_G*d@xOVLfOKDen_y4jJOLfgdIaw&%iEvF69MJY3n zZo}BiZ|8Nx!*elM{Dj?BY4OwcH(rZxf!oF{e%iiZb7H)+RJ1|^&NK5VtgcPgP8c@{ zQSHR5o5L#LxQj^@Z~hA0sGGkIfAq{>lN$x|*I_$Vu~t&PPs@9O@s~)(kq${b(0FPJ z8k-KOH{eh$+H~SAwDAt8^qM(WESx!KnX`Cp#`qa?g`8z(r>r8L92~{!QuN5iX^E}g zr1^-uK}Ur&9}RAx%vXc$0_M05b|vh{PESu{bK7)v9vfGaKO`q@YUTfBbpSrYPNANw z$igUh-M29MSzgAAI|{`-+iP-RQn9yiS{Uu#O`R4d1vdm2M!y}PV&kV4_GH0ABqc3A zTcp(75MHDNE7ZC5#PlL1>judpC1^*D(_@}bqec&(`C78X^tmOUm`Z=yCZ^bKq7qZ+ zZIu#J>c&`ND(xuZLEEy1wLJ-GS2Q;Zk$@X#3zrFh;4NHAZW%9J8g`*OeM%bt%&+;7 zIzfr)bBi=FmHrY;OtIZ`B&N{YbR?$K4Xead+EK*gw260H64I_{Iu;@UH_jF=6aK(k zxRl&7Ubr;uLdQdy+vnF}w0D{VzAi^H%G|wH1q3)hO z5+Pt@bf_nT17F)a@TX@e)7#hI(=8rW=`-f4h3Sgt5&bQAZqgj}%+aTpkHv1FE+eD; zRbm;L?pD5KWVBrqz1uf0mk^h()5|vlb`j7zqq)h+Y1Ryy8?o@ER5lA}0<-u+O{4wW zc06=}hw#iX+DZfsB_89(evN2%#oa&e(j;~ph~IgEh}7DeJIdMFS!|86L2XYGoPu!rjGnZ-B@<=j;uTY7U#TB0%`MAuLAP8zOr{B-o2}?}^FN zS`j=dwzn18+lqv>B6~w*Z!4m0Mck>?nd~;poWWy2SeQ*$y98F#yulv&<8MoY`G;BBF$ zWuN!n&(gBYt^%H|<(F321@GeUUF?^lm9{g}P39P$Zz=CG@xC6~^WA+RDc)hJf5jYc zZ|Ff~`Q4t0X!F$GWX$sfbutPa_oZ-)AKsgnt z(J7jyI*P`-PNH5tp2DbCRiG5=Rp@bly{a6)H=2FLidC+f;;CbElW(6@yjPp`R?Go= z-rE1Fpzx+AWw4r)GO!ysUZ^_Y-W0$XYj-5>DdF9cejqG%ixu{&&D~Q5-c_Ev#{y4X z+AaRKD?ha2#-JqpmjO`k@V?AG{Cl;tQc~_$(voM1-ZM58DeR0a1EMrOF zTp1gRnElIWrG~xd^#ZL+;LZJVc2LT@o%i0TinRjO*-3qGR8`gUJUpuSZ71w(~QL z@rAe-Y82urv4ga*0;3nd_}dGgq1`R?X7H8O_GHy&TxH4FkOZW3y*<)O^M5 zwk6e;%C@#lwluY^S=-V& z+0xd!W=(5$q9vbiwo=U}8-_WMP=|(Yh^LyMujbUfdn)W1+2J)2FDGL~yT_Ez9+V+o zLhPckXM~*RD!6B4h?fw%*zOq_;w7{PWyrk<%~dROGMlriv=ps4H)GDuRWabje@eJ8 zVnxKoh+zt@p0iU6vULF8E!R z+3>EIU6vWJYq8m5RWVbAK6KrcjV&J?%dq`_F=MuoHw~ilHPZus8(XDE?{-VtZVlQk z$@}Afw;16@?`}!njy=zIfxE#DX|eZGFvW38iCsvOs*yuo?fj|Q+Ahk?#>SRr_P9!+ zRN;@8vnA zmr3Pfwl1s6#VlSXm5bTBEGidf%)BolUeY~R+g97LW*^-QNNNrPv-kD z^i1Pk!#b6vXPR9-*=n(5Zm|tvAsfA7v(MA_UMTgB`Hg0VuW7gFy=@s|9Lwh>vvbo` z(^=Q@ zZbxbP+3xQ&Ex#PN9jN7JyIWcPi#lfKig*^t-v5s`Af9DP&goiK963UK2W0j)rcQ5& zCunLg`Vv&`4U7cU+GQp!A&^}=??ox|P~(@MTTa>d*9Y1-`;xNcog>6L(VkSmb*GCUT(E3Pou#_tl zCrfxzQM&TaL(&udwI>@0_}W!?V!U=?+hdq$!!s3gvjuE^sPwRyjN%(ki^oA@KX}*d zEyBe}%9E|h>@>C(&d$(w*^2N|t!Eva&fenM?I<%v(v?pb+?`<&YHE2rp3)s|D9csYr!&Gx9P)1H+lUQS|5r#-5i z_N+WPojtnyvZ0XQWlqgy%X#qxs66Q4v!u!!EVW5Gi8h);*==~D3}bGi)1HK-{N>HuFT(g=jOw+C{(#!S~wqj$dP81b0(;R4)d%<2y>(H1sM`o)9 z?5s70t+D7OfSBe=necNA z{oG-gw7Xu{$Vg{quxrp5FK#QAb`;ZXF3zMUvUz^1Qj%W7elC}@yUe1s!<@E?Q`M~! z!Sr_<1AW6Con6EI1_aV=S&~S%K_uNKWGIpKDZIYWO_z`Nj&CqKHfT?#(9%UAga9jH9+E}DbZM%PGp%wN_q17Xi8`>RP~46Q z8w7ZHYHkLvb(7DQu`f?yYaPX{buj)L^4gM@!+nRFfu)<Knx&E>_Z&Ys*wZmGI5=qFIZU>z0$k)1H`1-?wEbdL-#NePaeFD{{ARCPj9%ju zqjg<-XFCf?vzs=6;LnG8LsCR^*Wf_k$Z+QXuX3!Rx6p3V3^a)o)i#(J9T^_%G1zRe z^K-3NsgB{%;r2{#hr#r(VN-H` zqoFw6C{NZkZ%m1_@F*dL+vBol47eg>9T12+R*r^ zZD);O$Z5MVR7=a%MaQ7Vs84w+4Q&}fRkO3JJ2O7G!5kSKA2T!KoqZ$b==zcFzQHd3 zTHhAjkeFXgvuHs$+bQ%muWmIr_H}k8or1X7DB4ZuilaJbdpgkk%T89DhJORUdR*)F zFKpK#P%)9NdF!FnHm$Km>{cnB*zq-rt>L{qCpF##Vq=+F&E%KVP(j5VEpJ2O*g!eP z*y=aO;6+Be%|D*w{j(n(`FG52J1tn zXV9U>`lC*0i>+z=>f#mUeIrO#*MT=6LvC6nHS+vaRjsp4$W&2cLW2z$q zLppltZ+qV`{iRKR`};F}gPCFaI*8AxIPf)r?aS#ksPF*`BsN{x4prrT!bcDihr zF$e=khDUpi@d^XSHjEEb_o2MqDl_FB4&Bs0*f-kQ*-IU6_s91B{;q*RR5lpmvZ!ml zg9DvI!+o7bH~JYC2ESE|NpjfUtBRgnbu0d`tYA2g&Y3+jRS!s{)=k>WIF4>pXicZ#S&a|&=}Wp0+5PBfHuudj2+z_@j|Bhx)>a0w@9 zAhe+ap@7B|-v-B+4o9%P%jg{*Y47dr9JYhPo1!l$+F@R2&uIHF!p&RI$c1dFqraoq z=rnt z=Bl&V3OrlD6jIrmDN&R=f*pg#&_Gv5Pah&BSDKm4Rtpm(MY53DQK)WJNHvdk^kHb< z*@e258BVWu)uH!4(BCtX8S3_h9{T-NI0QQBJ*+~fE7xNTb$25QhdX3m2D|%*I(v;V{Ej%qdi!)EBFlDZ$FPB}M}OZC zIv)|yFjhs=;WjbwX@6f|PjCBhWE^!MFBqjcX^t8rJ)MI?oqZiqY4$MBxRO0+)`my= z+B-(0B++l$-jQ`AM~%*|-jVJB1TYH$7PUcdbQ?XLC~-8ZQTox>>cH~~cAnOBbajpP zcA|MXW3G_1a7m%)Gs$O#oajB7eVBmrlF(*=|%^qR5YAaZwR)kG-9@!cCrBRVO7+2E|IJ&*UND z_PaaRZvV_wyFYt0`+t;k<3HP~oXBI7(()PfRjG_y4d{f$nt1XhEc@?c?W^lCAcX45eR`I!?f1@vO0Guf&R3n^{dK7F z6-nKig2hy~N-3^saL4cF&3FD-Dg=t5I#l`#qE2RdR)5M(SI@L676CYURh$!vYR|Z7YLV99+6E`Z;3<)y z?u473j%d}-9Rw~D5vWtm(5+?dp?X1t?V~u9Ykx%ATxqLr2?J|j11BAW{R&pgxa)30ZQoo-GRru1FC{s%8Bp5JtfP$xL^7qdX~{uEUeD(J81T)p-jzNxiMX zTm52bs&vBkk@Ta;sNy%*TE)p$?`=^3eSeX-2C>c1oE8R!o^?%&iK&(-@Pw$TRh_l1 zRGkwh>QAAncshaF7Zl1BA&!J?RXqK|&RSsCv$aU^ra_*hl{1HMmruJn37m4w)|~O$ zs6b5IEy1mkc696;OcS@Qr;XO;RC6}fHrbrw2Y#2ALpC<<=g{Pw;Wrwc2*l_iuSM1#+N@s-;sGRocmc<9=`?G0_L#ia&BMzU*+e=;r9{2;43?H z+?E(z3L0|YE)%RS{)oE*%(r83KLE4;5j-DZ`VIn1{Fy|;ax4n8SY>DuD&!* z-wx)nt(@CW!%_RvDHwcZhe{uDJux_{zy09O5-g>z(ns9+U_Kea9SiP@V16Hi`x}_X zHlANyy3c{WW5Eo?;5LET9>J0S&js_E2yPv?H-Y)3;B@WoOJMl_tX|PDyN2gOE;qSe zUJK?kf|K*>a)%+^FN67+l5^vQ()|sX&b86$o(tw8!G)#!RxqDXa&EfUL%|oo6i?vk z>ip7%`goTK=AX=X*kCHT-me^vU3dpnrhBDjN~;4Uz~ zZ0Gt8l=QjfLGA9VI#x7XiVq!fx-$0;FdtBIuKy_AkAbSC`*X1a`$AURo$+_v?0@r!8O)(ExaWasiou-#rY8os4$Ns0+#vEh1?Cfi z(_Lr24(?ZAK4S9x%I%9=Kc0XJdpDS$WjXgG$m!yA+r)~79r(~ee|6j|!Cb85+;nL? z{WdW73r<%rPXxCzhkA|=9bw$5VBQ|V9S$8gg86~qbnO+T`#Ug4=EKt^eO+KC1*g;3 z4DKv2*G6!wz}*7o=YpfuT|c}2qju-FU@{iBPglMVfh&M{=_Kdmezx15Qa!p3%x49s zOP9*+t6&bA;`(&ukq37in9BsGi&OIR*TAgU8m^D#rJe(3GJ+$0=YzQ=2KQ4i&n$$e zdlvK^59S8J$$pXj_jxe4DLJ{^?gI0|GkChXax;oX*db-#frOZd-Uhjsf=q z!Qd-9RB`oqoY?@*6s(+IHy^|mz*Hl+R&cKXbA#Y?`8WdHcftH6LLYJe0<&tG=T~Rn zA>fVz(;+xry`=ewO<-Ogq3>njE(Ei3Cfv^(!L0(bU2wW|sXn|8%%y_U<%76)fO&TW zw-wxn!5moR_UYp41aQZLsYGzAz`av2_{t7dyiiyxj)ZhK1Y z;(G;yuk29eqY-DWiosF8{Wfs-304l zP`by0%LrDNF4eDbFsBGkmoC|t2UCjRDBWFPE)twBUE;0;^NASTtzhnr;OKhvM=<-J z74B#1Cmt#od}W8ue?#C-kI+Z`gDRMhM{tziuY&nO1owV$zXNm0%fj>VDsb-;48F2M zm5==pFwZ-CMZ?kOaDC4N>2h-a>bP@PG@O7B9rRbnb%9wIgL?^>sTkauU|t@ByAaG} z5gg5`!S%cBKMI)b|qI{Lu;M{qRGaMP9T+wtlZ4eb~3bi?dB9n7@g!tC1) z=DY}w?7Ij|`-MDRoqgTlJ}Ve}Wrr#sRXXz;^o#MKL)Sl`bUp~?2Ep-sqyqP`iTga5 z+akD^g1ZY$>a{#w-F53CaGSy0AHf|B?g_73(Xa*|I&|$MaRXqsM{sFyuLE2Ea^5aP8o>gZYf$bmc+Z_rW~l4cxvkZZ(*lF}Sya`C$Y{<@Pr)hrf}h ztMfD2*9K;X;B@wpzPEt6C5FCxz&!m;(fMr!vpoj)W-#B6;HX~y6->)z(dn)Ob6E`T zdN6;9!5#Ew+>ghH4%vVC0{anvXxx1!nBNOdZl7I_>UsVxxNn6I9Wu8o&wj+8?fAUp zt*CGK(1B$Jo_LnIgWraEOnicz+g?2jr|$;yz}r=ve7$UY2kH?%bkJW_Jt9902!=R1 zRGf+5hrxX`Lf@9FPCdw>re^w-rV zbKAk37lXS9%-bWlFCwA$fjONzP&nlIY`5InaPIeD4u6lzK9{3r^k^_QUCB9l{3hq) zfcLIw_#b@epuf8OJ_pRv5ggs`ZUeJEf}`>{70lD#&(qcAm(*MdCi4N#g{`M~2+WEP za*qD$^6_{u2gl$J2lFB&=lZz|>8t^Bw&3J;*Y)!naBl!}tCDl|JssSAVE!yPIUg=Z z{(1z=0UuK3*X1Z)o(iTnf}`=L;C1&BMF3p29fteAUu6|H|`IUmfS9YlULfi#0x!1?!-Vl>}OHA(a7##WQJu$eG z;okRw`}uX;&tcd7%^zFQkjIA(`m6HaPjR9MX7GB>$?Krp_I?%Q{|4siH>mWv9J2?^ zF%cZC8(9seI|erj=JXic8DP$e!JQB0%`v!lgSjpS_Zcv^DLJ>kQ8(x=FteZJ{-gHV zEf3d!`>{W>&Hi9a1Y`_bpyDo$WR>rgO97v zt-qAt?O(z;3LiS?ugkgl_yR8I7lG-!jdM?wI9cB}!TdmQvObyn1(-j?;QkKgF}JJi zll46j%ppq7%?J7U2*KbhJ5>3lalrGzofx5y#sS@6Hbihu;9d&m(iq%3z*^iJip=knVzG{e3Pe%uk29y?*lkv#^BBXx6ikt^$}N$ z!BP4CFb4Mkxck6;NmRiaPv#`qwx;RkK;oJ{nc?V2Gbpb8wGQ!l5@-L(@19$ z%wgZ*=~BJdr8@%VC4!UfbM?{ug9TQ2KU(SaeZNN z`eHEMf+Jd`?;!j>3MMN!o&SiN19L$P?s706iNW0r=DRVt`@uXE!ObCq2YerK@B{7_ zxqWft?`)j@A(#z63g-^R>FdDUelO>A_j{<_-uFJv;43>+ex`VN0=Sn8R&MWI`(6O< zD`0*nI9++H1NR>=qd(?p>p1Es`>W9^G&4~+!xUi`6{^ce#_In0CKKAxgG!F z18DE@p@aVFxO>3-JO=k$Fn^1|HT((p%kYUx_vv7s8-qIr%<(a}b}+*+xXoblF}Na_ zvtn@PgLy*)NAuK|gZXp>_Y=77OJLspAorg|ZZPi>obGz`QE;CHGxZQpSI7Me z+^fNy_czYz?(Y+K4VVx8J)HXt9QGYB7ygrT^0-H?Zx4Z4@d)SWuc|yg4}FgZbL+pN z^|k#Q*DZYL(CNDZ=LW$1pWx){ky{>*fr4lL2mLEHw>M_d<}-W3!ndhTJIo&{6b zhjVg!D*NSQU_K`}IUh3jH86K7IX52`Y`RY{%s~86`I$IlUv66%NB;Ui46YyCHQ@d# zSUDfAeKc?MZ!k~XkEgBUNZ-L=vJo8V+Xm*W2(Am<`Cx7r9Hp-E%RBJiN|t%x_U|L`tB4AzOqAQAKhpFZ4530$G-4@l?`V+j;H%L$hrFD zxVi((y@Hd=!{unb+5KSBj}P|?jVt;DgRksx({X_U|V{nx2 z^)Wb#w;N+{cfuVvfqUIS+%IA4Cog#l{DKc1vR_>P(Kz`kFdtWPuK%_{!Dqod?`d2g z$+`ZM^<4qxYQf3ry837w@Ch(qjo{t~?hY`s|HISO#ovwKZUi&^^l*;+b%S8=l^t$A zT>Gegd<)z?g4N}NxSxXg-w5u9;Qj>Wwu8BS^jDSc`|$gZ!Mx%boRia){rnm*Z&q?{ zK4`r0Zo%LyJ5=dXm;EYm=RT9CtLtx&z7GpVs8i;H)~j3>gF6f9KJn0%4Hwb_(l|)J zYoDCouYmcE;AFqJ`K5aFBf*e9I$V7&NAveT26yhWdAd}NE+?n^T`)fuoSd%A{V$jY zm7JUIUy#nDU>Q9R!kgZmT|eiPie$MSp}C+U;(yD_!0 zVFDjI!ty%}W@ilUJTR9iIXAy0r1f?%`#14)>AI-O?=()Y1@nOx&V^myu5Mk~@F{%g zkn`cDOa8lAFbu>WRl3w)`*IA9+NTw?S%>FP>C58${xLXu4r430mkCyvj~9b`HJF

&mG-J1VuIt1xu+}Mg_h@hnS=cZZx|b#BcuJvC^e?-Vq;tNO~u{S@$mvz}4cgQr>+!Qq&E4i?ukoTN)+v+h188-@6 zKVNkbmvg+1*!a}q3%d)g)4qgE@UU!QPQ(7V_b;p4FzwNchE$a|m%Ik4VSn&AZ`UE2 zRQ2P_8b%iy-#a7z)H^h&qzR~HoO|lOlIa(*LMWW~*z~D`o@?c<-p}lK^APtpc%EXZ zqCnb!OJk3=zijGg_?T3Z@o}%xNOQ+eC84W5vQ-yK_W9_(ZDPAv{ppg}=P#}Fi*SF# z$GBfsBKy)@t8jLs&EAuCxLv^WsV6>7u5>OuJNEDXE@rBxC$eC+#`eoa>2n3wr(->3 z)j^+}GDqw#4cOT{sb0VyufyiNuf1-X^8-e*R*IQg-#xk}LjHYZoizvhUK7UUB3^&8 zhTqy|4IJMeD))o36h57MESk2pH9J*pWdQF{myNgA{$2jjl&^}6{LlyZ{YNP~R|siY zFhg(GtG3fxlCZ(pf?b-B24-=0Yy=lqy9^ZeKkX?7)-H=GSC z82&{y|JSJ{Pi)L(YiB248o2mV*t<64vyQfbo6J3@$DL3-G2A9+NAWEMrQcCf9b@&E zzWb>;-&|ycxyboIzy9qHLjSJcWA;bK`LN#OvHHwtgOYE=S7^k2hvEy;C^(R+k6sv;+x6%N(*lA8z*~J7~pNJzUB;Bfvzv`>9@7t1;LHz$M4yUiDeihFPVh-;Y@!X5AzgiW!EoseX zMzh?w&Nk*P z*FLkdMj{~he_|49l`4h23!?)suO=xkK2d2yW{I78rvW7 z-ql%e&+9fCUk9G*(Dy8w@a{VH6F>LsBb=;}Df8_to-d1C{KE5Rbk6SInU=Bsx5tR! z=esX9Z$CXD(kg}S`3Da1>)S_++>Fo9OWriaM^#Uj^L*T1Oz-<<1K*M2C~XtL=5o7- z)%bo-_=2^nhB<2=o>RYCx2x{58onPU^!)HI>u**!!`6Gv{rTmg=0AEK_6Lt+-Zhx& z^xxg#qCF_&dZ_2CwRjxkt5x~LEXMQ5TxoCbhqaQ$|ES*mjaNQ}jw>C8*HIj4KE2e^ z_tvBjM|W;tVicf(*GYU|vr|Rj^+(~3clT~pw#j>#S=pBaMP3b}`+gI7>GYu|;)>^T zK5vfSZ?bLile$aax6j1$960}-jlXS~A9QMUjlsTbZU!-FO;rA7op0N%L^V)Oxn8tC=hs<${UmtX zb=iD@12y?+D}U_1m@LF7sZh^1<^7OCM~z z>hyR>ZOU%h!JZBl^Ko31SN3@;G%@p8oucW%0n8in_==WS>Kv^QN5p|EV}x4KIil@W?yi zaHBA~`EK9@oSw4gr)oE?W0hJJK6}(!96F7k;~SlB-EW{{&|lBv;Q9BkrI`=C&s#fk z#trY|>-7Irx_*gmeJ3MhYRs9g=#S4-=hQmH{9jEMuE&F~8Qq(4;Qe3g`EfngEPbW? z|pGIz{P$f%FC{OR%6xCC=qxleQt6~=~)SDRnK7u#Zr-@}USi3szHM2D?x znVu%mI?^#)1#_J585G_a_I6w9`w^2S%{88SN~Z?5t9V?9_woGOh&L%29iwmK&Z8zxnUx z^As*-_uCZb)}VXxk&mR~9UQONZK~p$181DSZNIG})ZNFE?)X+?iYt`7>lI!X$L)A^ zWN5MIr-MWA`<0eQJI-ICA6;ZRK~F$@+@2I-tIN@<;91qV4<*Bb07=|rg?OikGuXWJOb!!u365sX3>(U;2+NqDT z8`_NL$12JK?CbMAZ*$t4Y$)jFYjHQuXUNnU`B`7z;dJ$6Pq*5^oL>Ci0nYb8;`FYo%}p4|WafQR zh-p2X9Wy?=Fjv48kFU_fQqQX6&sv7GVq;$NF<>0Q3FCCS*7e?YiLPyWp=^nEkP zF#05(mn#fE8~(0l>Re8H7B#n*^SAf=F??=R#&iCs<9o9AuTHPzu*wDZd8_T z``A6`*-J)aes>EqdEP@ z`?x zF8<|m((#JaZ05R8hbEke%F*s4ea4}zZE;li?ij~srdyRJJ5E*G)o*N5?ueCZupW+Y zPy2Wti1T<)`N26Z;@ro2_0xT@VFTvPupK5lb*ebIn0IpJ4#UOqZ*bj}3peG9*7 zn!Z3+AD@r)61NQ4(f(5Q13n+~VOgGydhIt?a`JOF4J$gOxW*InG3KStL1wX!@p+to zj}CuSxOhs47v}MC#@^{)mM+>Ef%maaeV+uq4fj7sEDiB`-v8X|%9Hx>V$4zcr^;(C z>MqiKG#l?f4D?Mm+9=mB#6wqWz?XiNct3Jz&6QggDj%JdEZQQ+pWn1{weN{<%L~2n zU#x@EZ!%@(@!d5?f`e`QjFY!cI_thsch2J#N-x^lUFt-0I%Z)1@bxM_AID!iD1J~; z-H%h)uhjh;SJdy0w8iPgehG%l`4*rXetMZf#fAnir zcJ(qzl{ltBsc>`4_Gce`=i+*R|9(yXsavr|Y6|CHoSuL5uiVfZVJ5|$<#&y43Cc?k zD#q!<`H>?RC~h1=jEN0Y$5&LSRPTkH4f4e0;dA$7nkf#;)W47`3n;kjrmW4-O zySDAaSEbx)h)(43l0LImXTXYS8EM!LT&{H2En-OAUSrvRl+{3$(e7mNWHZ+=#WwpBj{mGOwUu51e(jkAzLz ztH#}eg85ZHMoQU~1ZKBMslQY7xZhcuW<6%m&=6_nSIrO6F&WK`pLd1(Jy2O-b6EVU zb6@d*>6vP7xd9`S-yYbUaP)=e!t+a-UJMzR7(8~>fb~~A6jofHZ*ze$_+l(0byG)j zb)t2)NJseF&CeNqjl2U~7_XGB&K}+WrT?7aDO)60_xmn7Y>{irzEb0yTD8>Vmpi_s z99>uDcVYfUfhT*b_BB*r9bcMX&E)sKJuF0P%$5TOy-vJ1^n8gVt%a^`BkaW^ZGd4A|-PDdKSQ zB*W^}=A%Fx@p8rOcY()5{1f`0o|GTJ$2T_f;ewrtm+t9)aIo-QBULwI&yQ<{G2zeS zI|J`)yfP>j?pVFr;DSkxhVHezA=Mvvr?qW(w?N{SuEng`Prfv&&rq9E88z6kW_I)5 z1g#B5S(~;@Oip@yC*)MtaQ%%I(h|j+oxX(+z0UAf_+i>6bZ$UyO&^1qCoT%!(|htmw%yQj-Z&+;l| zqgph!Mf{_G`#o**{!;Gumh*hv9&-CzBx|UZYqEOplh@nN`$}Q9dYU8E8CHExn-^~5ea!2eT!X}%AX!9TGz!m&StRXzQJUaSZ-jd(j@ z_U^{(EndrHPI?@BttHYD{f0U4+{yBBqxx!W=&;@n4bobHOqmeAy=2!6c(-};Nw z`)uaWqGMsw{^8&IFO)5QxbVOL`DPL2+UW6edL?c(=?_~XRzH~Cyd}hG_ppPn@5V5K zS6Q_EzPaE2t((O57CmR5g3+bJYCMMI|E%mBG(@9ZYt+SkK^yC}Q_Pa@xA5+5dsEd^ zI?GJiNV@ zZ_LhmeAUc&EZetli1iqSX#MuxC1Wh+?3_Ddm%-lmZY4rD5(L$=Kh)~^y^{&@-*J}t zyXe*FNmc7_>>IlBIqw6J0+FSC#wqWYZc?w?G3#Z{kfzO_&haVdXkEFdH|=y^34DBq zjJrwHw3)MT|5g$ICgn}vEGcQbyC2Uw47??~WJ&edvdo9i3~y&|&3nMW=i$Gc$MJb| zkBgPokI$?*GruQ0=I16xPcmI)k>E$r*vVz=8K2?Txjo= z)swv#-9g(=U3|RR?&Q@GCX#dJ|FCwMcYT=MH`m-{k5V33wgu=4_{W~-)!5|gpqH+q zKkd$t=swMwF3*SR2fGdL7ylCLIFyalNc+0;Oi$_aw+3uAzL*%#L^}IdjUA49hjKlUCzU_PXDx%+1Zs|+jvz|Z9ULuHF`Wh^ggoJCe zwsT7#)-P&4bJQ=o%#d4p2J1}KSi5+W7q|5EWM}=9`qTY~B<}9Xf9y|B=i}qt;?&dm zGJRF8MeLSSXI3ro`tc}hZcp`CS2!?GI5=?uH;!BV*(Nl= zHS4BJFgL&U?s{yziuqlzr*!^4ALG4XjGSUm#~;OxX*gfg=S5G)-`O7;DL(OVb5F-{ zd{PCOiSBuE`rNpvX@Xg-AHjlWsPYbEm@ z`vK>v30Ku6+PCy{K2FzLZAWEOJLe_bI6bu;9SUcqzj5Q-^B?eK`w0ee<30&4Q{H|~ z*@7GQ`MG0Y!7Y1jZrlM^d`Z(c!i>&3o3mM_g;V`@Z%D!2D^zDQKnG9B@GJ&uPGw`H?O<9iya^o!X-%MC57yFPK=dJgBkJRZ?%eiq9d-4+QOcrY9#apR;5{2Om8MA>rVzD;oQ7!$hHg&X(Se?osFexWLETmz5oz4<%UPjKUI zy=vB~wzM6`jk~nI->{DswzAx~tLp^YCDfb5xp5}z9!RY@GLdUKt_3gBdT_CyDK~ri zg8d~#ij{Bu^C2s~dPS~VkblqnUuKn_l>Zey%J>G82&7Ss)z1j;(=J{~r z4CX$*FtRzCYq>gnI<4GdrbmzC+rQf9u#d9igD!KemuvllQfDMGCvo$yVtOf`?a8e? z+_>{~_lhr7EVtyweSR{)!HsKuk(z7%GVwk)j?wM7~;eyIFGr>p0d-I9n(T$7eE;pkKie%G8}yR>a)JMjDyo*&a$vEJ29!Pzk> zjFs=IF9lzrlk%%*X79(RT$8M~4j#te>HE9wxq_WZ1MOk#!zC+LwhO5Bf0J z&w@vIn1)@)wH;qt{yA$_*RPPFp2dsKQtCP$s_GN{=PbXjUm-(1s~82ODIlX9<8`c$g#M zL9j_KmR#`XEW56=AOp@??&*mj@X;Uq<6+_$vwp?dxv%Ri$WXNe(OF%GStkL4wVmzy z88Xzf27q69n8ICL(hd9iuCL(Fhpw{_gMJnO24N~$zbI^Q^4T!f70qP}fnRx;ufZqu zyY78r6Dy_c%s|A92A|Nd&J%47k{N`UW8f3!T&Dk`WOl{}{KjBFZ+V!|2WUrH|CZYz z1}q)yS|W%M?PA1Buhg;IVfj25F>Apm^x68o{u7dc7I>H@@Du!7xlquBWW*4I^DFoB zycHxfga!j|ru@nG?(K-vV206PhSOjqXfPuvOwp9$ATsT+{PQqj{NOgxa%daLi~>iv zF|g!tV3E#dsc&FCQul| z^;6!G%tQ)f&d2|hWF}DG^_O1o{GHwj)xwtV?5d$L$)0I7OH82cYb@p_r&|qNC#l!5~jw%giIt^w94Mq(y zAHgTAUn>gJD%sP;Du?Qb!DSVeA2p(^f-VH4t9J%eUBJLz1IAEDCo_!Q4y*iVB4$um z-BBGY7eV@?g&1}%O~M~-8jKEN*!>~x%%U)NZ)|fQ8C?pKaL3!3onfU*4>5)C6Z|W2 z{Mb&WYc^uo)1^nGOTSl!rDcE^Fq}f|>Kxu-Qlyq4VaI^bn$s)8(lSDfJNSf~knfB2 z>{=|w7#!hY_Rh?u!OTNUfA9&*kN+gwSW*j(5KuecGh<4_&V0l;10!(!bK^(^kT4iD1KLd2MNF%H?@StMhQ7#KrXetw#7>!y#hKujq3g#D>P{S9f- z&LYHs!5m6g)ei4%BmySCM1|-79*y2f2lV=#~y489dHXMzg%hheqP%MpXyjd@3O^Bst~ zyn@1Lz6u&bGL96cdpk}PrqU@#k=+ifzOO_KDCo%3yqGO-*?nd)s}KV}VQLh`UX_u| zYQ(_QK}IZ`cPPm?Bc^vdYiQV6OT&%}4Lh!gK`lA>X5{OY$L=#Lzt$lJ=NBAnxw7RK zD?XqZ1^I3OKf%AaMSh@i!zi$q4L8K}o_5q?Fnf<7%qbow_SqUd2g^^%C zK5sw__Srw=+$DB9taO1Y$EKym{1C{_u(UQ3T3&>fH$}^|a8Cid9hMff_9tCo^DalQ zGb}CCV*E93fqCIWX!%mK+GI3A!_S!)n-Mb&e8SBtQU+94PG$=@!W#QQ#@_XgCdv3A z2Id9aa=e7V;EU7FR&a!e$qznZJN96~@L43|PlE}d!GP=mT8+Ske&AbD(A4qlTC5lb zAqJNXI6e$yiy?~v-3+kP6T`}{V8lEJTCk7LjLF|iYHcU%1QS{zG?*QTfxQNdVPnk( zX?8m-e_+qW!$gYU+x`9(-L%hPh=DzCU+}Nby*<_fxJVrekDX)tj#m_0O@cp3~C5^+rzD85{o zeKeRv8VqQ%xoYjF!N8FixBNOlg8@Z~tDRID%t0E=AsS2?4dyTnCY=Uzga&hz26K!C z1FARIIA_vez$FJ)JI84-ClI3pKH-*X{PaB8CY%IExXrhmqQQWsmaCmJG?;9}ID${u z)=8K42Nyt~6QYc@&eC9V5TgJ-p&iCWB}3BAIT}nZ4F-f2q`h~oJj6(XPw3CC&_lOL zfAVQC7icgSX)s`j27HDsCyeeHXI_xWoN+Fs!GK{US35_COrNP{#!GL4{pQV9NU+}H0ObZk`sLHywVvSetA!Y#hgmnjwY0HRl zW_hm+YwTBn82K)(=xlY+!E$QdC+t)ZS`T_nUQ`wb&V!RxM(fAYHI*=vP|>k?8`%To7k=ty)5>j?iLfSX$2!a|i?w4CEQ# z-8+TZwOC9&Vp6&og9vUV1)M`Nt%voOW&+wN4=%WAR1*<&-)tjx%%Ni^> z*}_)lS!MMLVqgt|cHXp@fzE-`&R4?D7s3t*2hi%>pLW7d8)4@g4LjcnJKqR99V`X} zupjsqFX#=vai*)2VrRk4;>8_=ogWlC2dDUg0?ujYC&f;y{`4n52s^(JvjTVlpu^7tk zGpqdcMGRc+0{emj9T`w5Ipf2N7%6ZZd|_18xib0^{`5nPW0#$NG84dsFQ*+o#Ej~) zqog+GMnA$1KVo|KM*uPG{_qoa`Xgo$Z~>N|fPF^uNPh$=c2d2kn)fH{3}D#-pRjK_ zb#moW(vA?t&ZkkTcLxx51|sGR_=I^;=^6&QpFi>&M@rBqNNN z4S<3DSEY?J7<6;m5usscFbzf&F-w7YaiFDHR-#X8iBT9I^AXV`GXyc#U3NOJoX{kh zp)~vvM+|HgVVO4)Pyv@3f6~rsGlwAtj}vye*d~j!F7$PYcxe``TVmZM-l0gq%g2O zBpE3R1Jgw^V<-$v7s*H?2B&Me<`_+OhLtWE#H4_9!#XH5PYMinIP+^PMGM{wkRj3q z*BJh358-tI$&5oxKKO)j7HGYe&d#v>8IPFW{gI<+L4U>*{!E}S&>xbSh!}Q%*cp~T zlW6!OPtk(@Od|Z5OktouB%?t1!_Kh$QKaF|6p9w~N0IPHiNZjCNJg3Phn->hGZisY zKz@QRJ*;a|p}|a}!Kl(;rXxlQ_yV_Ow?e@s_@DC3@_7agMvVreju_aI!}9!E{k{~t z7ONf8Kn!l{4y^P{P$%+YCWQ&Po+Z!Duzc2}p`}H!1GO{>EqHh1Pd$ZN>Lulzz7^ub0u(b4OXw9bBfm(WmmOh1nTI>u<%K$N8kb$=S=|1b&^NYn8B4&0M zb5K;Glw{^0#<7cerMg9tWQ=IoF{Z)HMa&wY1;>8crX|}*t$B!v1joS_#_7q=N05vO zg&8(BJ%D6P5wio>fLhO&>86s*e8h|dRSJ%^9*=HW#LlqF`~t+_GVc)Ww|72~UuKAb z^#*)lXa*e&B$$tIT2c`5QEDY)M95?TB{Lr8TbtAsq&43*6dm=#u+i_ zY6URcbY~4CnKg)kc@8(RAT@BY{>NvQowYO=7aEK!Vq{oSi~{#>-OSgmLyTM((>nh= zDB7Ib&#E5Y55?=6owXT zyjC{gQkFB$n-J3qj>EbW;LE4N&anLPrD(x6a}(juX2jsUF!qSpK{8t?jIf_iG|Bi; znDTFCt4L-mVsP7Qx<4?UWc(@2htY0gBojbkj8a7BkW3(AaQWFZIbDXGVZ}KJF?z6) zf=y6tH<+N}jPo|clyv1qmBKYJWy{F~Bjz#q8R}K*%vr_Gu<~L%VsMA6db4WW8 z6o%hu_A-)*q%clv7=uYB3NbiO;k^=)iKfBC&|r2^7`X0~)QY7rus>yISY>QCVh({% z0Z=xUo8*8A;6LSuRW{-fgUiM@!H4R*iL$YW!lXq^svwzo3Ns_>=Y5h%pfJk=1)h)$ z?2-SpnHIt6wIs6-F}VC#DK;39Od?`%e!=*#GpzW)Q4J6C7N~=;zj!3xo=e7OKgG_C zfupY{5%GZ|79J+{r}A|89g;afVO(RFHOzb~9lu@fm&z2z_w!y^>t)rTuP!kqanb&zBVDa>HM3K^2QL}Btb?HfWeMHJ?e zuV4wuT&6IKIyFC&%oPfAXhifxlDUc)+(yAUe3H3FVc@eBBy*j@9B=OTfMjkUW&&uR zz!%1xQ<8m2rkKJUu3R~jWNuOzfulyNN#+(}aJu00rzCTm!gQbZJ2aRQ#NhUD&*Lh4 zQmd5041B^|K{9tKO!s!mC`|Wu?opWT?UYlP?(I|{2H$6_>EHJk>GOTW;5gSFFYc!9 zJfLXh|60^dUOc2QV&4_DNv%f|EjY)>&anEyO2ia{@&)I!vEAudJppaE^$bVQD=BxVrmdGvx`wkzc7qs zp3-1y5i(Cz52^Un54U%bzxzO^GD)1~FEEf#qk=?@G#8ot0k=h=Hp?;B|LV|AY(3Td!K(&nC`WHAqHe5+KRvUtR~a-n_{PXEf^LaCb&>U z@2R*JCLKW9VbWmwAVv(>0iq0{n8lz8fe~k4Bg8|4=}Te49Y?4}M5q+w?eV&s7xxV_xIub%WrmaFvM2u?IyoOX)t0mm?4NU1v)U!Lw3nXkm(vqgAqrJO_$GGk55x2?F>T< z9@Fk{PI*T%!x1Cc<`F@2JeKnxsbL7&5AbQ(!!1jWwPyN?c#47@YQ!^B$MGoxrQ zqiHabG#Duw%orLBT*=QZT{1M7u{0Q28q7GvsDQkJ^_|zv_8yrR;}HYzNx?jIjSg)k z895rv1RBgl8q6fbr~zNV7lvAZuA{6xuj4I0c$#8`qe;n@!cJsD5h(WJp>AqEsI zR5rSQHd&hnqk|YQctY1HAwtRBj5lV{U~~~<1nfYcYG=N?LZ(X(F|drmYohy81vin* zY{W=`<8TYHS8O2}eZ=(MFB{Nc3~4ZPXfQ@J7-JgDTpG+g8jJ}I2Hp|oVfG%w`81dX zG#E1)%tFKjfjkFa7*^F{;F1M?V{cdC+ktqPy)zbwfo&8#+eYd5Y0?f{h5qN=5vscn zd60}H4aN#F6T7qm?0mrx7^<@SyqLm(|KMpa$-tG^taoC-vsEOHCy>k%#PmLHu|bR$ zumS5}%&CeT(#}%E^gbT5rD%0O9+*IAv#8l}7s-SmruQ~s2Ms0^F*x7nyc6xFJq$w(XuQzIALi1{7&06&Qh)$o7_-b; zx|yroNrQ<%j54qRuPb#FncZB2L?Wj5v2hd)CK@s2KnL0yv3!vs8Rr-pc6K2KbP~wt z*dK-6^zX4W?ChptCk`>$Knr|f@Kg#^kUsCB!Nen`_ZTK1MhfV_t^2Y1UK-3k8cZS$ zCJ8aU`@A19tAM|7em)~BFp7*%GGeZS<8Umoz&PbH$s9loI2qZ|h&lv@FyJRjznp>? z0q`rdQ!|YJ8_A?12275iHC^RD3cFzrB4#6CpwB}m2z2A~A;cW+Vq~2KN0M4;h`HVm z%xwTJzDRN{%QN=z>S4sd)<&W{^ZioI!}Yiqrv1OW_VYAbwAg10Wq-Oft&UmX;U&!FVfH|purR(29Nn)?Ak@S zU&*?McnLA!f)kajVV0NENPmiGXkA7Oo~w*GdTkwP=L%wg0Mg1&%=u0-R}u3RFnr+O zQ>|Fay&E6!8@Qu`m;vA$Y&TX$d^EV)2bL68`@>?cQy93;lbvCu{RR!KVu~H8b%W5l zNnxNCJHyhtMMLX0#SYZEMQGijFi?w~VQH1n&?=?afm$Vm)?Eq%wb&V!Rv8VgdlWlR ztBlYpr!Y{9ondKJ(9pV1u>-X#2(1Sc25PZ0EUkw$v>s9HK&^*_RwadjTI>uaT+v_8|&Y9X{f6I!i=7CXbz z`hpnyuJ}lN+3HHB>nlYI=EWC6tF2dtrPYp@-edTUVh6^sozVJ@81@*lGc2tR8d{x% zRtKT=gV17USXw_3QwpwAzy&ws>PgR=WDI{%wA34fOMVhszbQ;)(9@A51B>6E=O)T- zy2OzT{O^MPFmT;6$@HNx-D~ksnC`XuQW#DxR(yC7(|f-6qu7D@&db9&*5X49d%m+X zEG>Q-S^|U?KcUs1&|+s;T7opR1`t|;gq9GY#m=y_1|nuPC?T-jXueH-W|q~q45Dbk zdODCzi)BX`F>nM3+rv*or9e2r4y8R5q1b_I$c5SLu(SqK7+9X!8J3nPV&D^1@EZ2f zGK~&)Efyn&nBL3A5Q-Ko8)Ae%LlMJXHrN@KmN;S>z<^%|_)|W1${TinSm_!@(Sm)G zIH5J1!a#pWMuNh8F-Y%AG9xGqTt`hZBPk4gu9jp*QJC(vMpKyXwInGFrxq)QQiy?1 z8NhP**!>x}h5o1fu$VE3F#yNmHb6^z49Q3%229SPxym0(dxw&Y3=L*1VsM|k?zx=^ zX-Ad@GmZu`o(3a_728Rtoe znbdXm=2TTZl98vuOs2soP?&XX3#OA=iWH`gTtp(tOrbE!F?T3^C9C`>QJC^~yFf?4 znRaCgBNxC2ru;dXsT5|ntXntFAgE9nC7&tXMXBJ|>4RzGEm;?{;AQ@f6;JRa6@XDNI z;M4IuOjwtp*4(whFG*%LVqo6^zA(mA+MFdBeHx4b4aSfLGlvFaM1wJ=!OW$>%%j1W zP?*Qe_{n4pO%a33&&xx{Zjj7;3d6Ix^f<{ZpfK@{{mzk$8HJf9IeQt&ETk}Jir0bS z##t}SDNOfvED!@OCQ(`Shz|!-^_+GVQS5wwxulb1EGbO)X}3ZQF7tM#LqRp-)LM)f z(CDDK3$e+O=Sjwz2D5|)V}lsouDT<7@ZnTaYbk|!Vr<^cIKh?%V@HEoMuV}Z!8jlW z$GQ8qWjPHyD`?npq}b^`hE6n?l@zA?IIlts?&FNzLLQO%wVH+e_Qzj7P0%o8qd2R29FQnHPKqO@jT0pD`I{F8w0_=xo6G>lXlh-c3cTN z>uK0=BkZgv?6@Q5SC>B#FTwkJ+3G1PT^@uTcfyV*Vm1RiF#RKrSy9?CR@yfp#=nc< zby!}*uEk=!5VIOE@S5@U=7p;4%qBkLZ4r6H%!J7_SWh=FAlp55TRteLbEhL~yK zI4r9l1h;08OgLh2TW8VlaW~9P8g?QO1KSm-m2UC7n{jv~V!!|tF*@Z$`w_$5ZX^+PCmAul z$M67R7IejVi-8dsp8U~b)xi|R^q%jji0M6D2N44XYN-5NwT%Z|E2q{W#PlBLG{oTe zEGd^C#cqccpTme@k53vApLE3Z9-kvL{5gu4-pk=J#PlA+48-7c?Ry^#vgJ>FSn0|{ z412mVh;(Hk2DecW0#Ux~c363O95GH^c_BOW2xV-;Voo5Y_xPMdOz-)13Nbici@h3? z*!^Lp>oj86({+kS*BQk0UYE0J_;VI9qr1}nt#*4QyFaY7=OD%mFfa#}jyRG_GUpJp zsEgshzp0zKi(JIa0u0>rm>5Ev-6M@Fq*fkcwg3XQ&!05HK^Oj~Y_NRJ zr!Yq&6Hb!M1;oJof@k-4wf;#m7irijKn(O5`cwH;BagIGNU@{*ejSkH^!XAEJ4G~@ z%T%q=4&C^31u=8Gd~TOYUr73Mm11XcO=dpHT%$1E=f!o3R^$8gpqOx`{RU!sk6|%I ztNR$Avnf zqcGiT)gcDQS^8X47MZT+h=JF6a9eS`>NUyK(_miEU|!N-UeRD)(_r4vU>ayJjWn3I zG?;fZnD>Z*<1x4$Fc&H!^P&kc0^m68zvP8OzL3lZ8cZ`{th?-#-gu)#+WAPs&LX`?VtVt7W7@o7hlAxIPW!m##xolP>|XxRBq z!%hccynqhOcj1BR7udB}W6@5;;ISxtcV7oF7X3lPpPw|eei2$f39a8W?7%6VKWlrS z&%X&fOvKoC7W zwA;Xt{7=8b$}c{`pMHct{D^_~>)>{1QrvBJJFM}u01bco(_jP<(|dUyK!XvYp*4^O zGYB!g$50qCxXi;m9Yn-X1TiOAA!G#27~aiw++f0v2w_JQF<-mv6#BdCu;&FUPsIp3 zqJ*6xi0QpN4@JyHpasj1=jF+iaSKaJoT3Ha**KKY8ittO^K>{3e~-noOWahJ7d}Gu*$|b3Io@Du`{f8V?1JdFB@`*={-IZ zXfP9LXiY+lAc`P^;pcr^hCS^ppXCuV6EH9;%dWkxAeqS&rbbszlw=eTgWlc@>~!*6 z)gu{2#GtqM0w(U-wr;Mer?42{4D3nlTILm!c9akUkHal#+tN~!QKrF6rNOAsV5ZSv zRB15NX)rTrFlsaybsCHY4Q3_{Mw14kMT60%!RXLnX3=1DX)t;;nAtQKeHx4b4aSfL zGlvFaM1wJ=!OW$>%%j1W&|pkyF!O0J3urKAG?;}n7;_qo1r25q4aSlNV?~2mOoOpT z47gZ9TcqTLk7WD21Tk8mUxs5%bDra%tLN;OZ4kpg7G1*DFSGiurHGlB;!b7zV|sgm}HzN%#1*eF2T;Q@?sTYo`FP( zfOL(0PzRQSaOUZ1#7K3e{mX5QrK^Y-IwOWX-$`Z-#UB_$l37b(U<^sdg~GrXl8h^b zfiWbRbrc51kYv_V7#Kr#h806M#K7m#;5_5Ykl_=^7`h_{$8cL^u$mhYLl4BT$B<+^ zDgMA1lFSAQ17k=sUK9q#kYqMe7#Ks6@un~^h9u)dVPFi|8CDE8AqM`>FR+dUNvH;p zG4w?Yjv=hen}`^0MvOeL0qbe@jrT`MW(#82<4iJsh+(hqB(s&mz&MkPKZSvDCYb;V z1LI6GffNSDnPh?}42(0$Y(orAd-%Y)hu9fbUIZiNG6*2N4(U`mzKT6BSj=_`^K|Z1 z6Osv`Fd>(IMUu=88cZl+aNl&n%cq5&v zE$&v_y|}x(7Fx95%$#$6yEn5B-`=O8_jJuRPGxqgMr(h< z?q`kX!CiK(`Nk>B&XhtQm)Xt&AMz|Tj;vGf>tc~{@^P&NS^Ac? zYyEDVpU>f9B%v9IvK`NKFrpP!Y+k+E-Vz45(0hpUY9 z^L4t~hkn)==jZR&T5Fu2&*3^BYOOcU&&R&Ohgutr^YiUzlW~4NKbwv7^L4t#2WP8s zn({WE`2OwA_WIgpoS%<4>6;TE%8OV=~K?HusIIp~9P$Oq@J56%%EoTENC$9!;(`{0}~j_eoS&)p||a84QL zjan1>nfRKGLF(-%?rR&`HclHyu90H4|EKCHk8OjTGY&^zli1E*4kzK69M3%++J4R& zXPfFpU)%L9cGJr>+c`%b{kqIqkA5i6dE-PDN6jaxVDbT=c=YUijd=^uc-MgY()4=Zz1}TOXWvJ~;1va6b6p{OyDD(Ff;~56(Y6 zIREKTa#C*w`qhuf9W?C{eO-=F$Vax=UTH`zus==3Gagw!8mhO9^KFJ>!1Fy^F%aG zKX$zTUgAi`ImFJz^5gE>c_JI9gY=jJ5i0(MLBxrT8&Sq zS`Ryi(TvlToop?m53rr+#?j-}i}!1-7(O^Ljk8|mP=9g#8PvJXq@Bf&vYu! zrt>ix(j9{5?~Ki49N7ocm9DooqsP8O`&VX%qo1$ZP8Nrwe+QTCWOX>nA~xJx4o+IE8(1ium9ZHBJ_4#}(t-B(=M`$4)&LGtNSFa!;?k^eI;t zw)er}#*uAIzYbE&nx7I5NB=wNwo}sKBs%1G*LF%7N4?N%w)wyE7dh+cP|u}}GhF?t zUTAVHbd_9Y_guy}o;{bgdM@j58W(>RWIN>?j_%oZ$~&AYM~~F8o&Px;{hmqNsbCz> zv3oi+_KL=l^;PE4$_w_`D>-WE^;OXtdu4~C*O%>7aX5PHwo}zOo;`ay)N?iC%u#>p z_4Uu&W>xK;t2=7xo~v0s*Kjy`ec4V;hogJ8omvh@uP@uF?Qrz^vYk4{@f^FSLu0RN zoFH|etD?p}DMsfO_Sow=YUy)RU2E+1jidKbeJhe)Q|h&8>M3bvSxmcskT`OXKMEu8*cc8~Y#dtVK>MADq_4`Kpe}B~+d} z6L&TB%tPmW0D8D&79Lm*+MEjH6zNGS4n@ra8XE&NI+BYuK6osKZ;^8DyOA%F#V# zINGX=?F@D}gIZk9Z#zSbqyHrly#DDAio;N^IBqv$395wbf|IkzW}21 zl$u=fo}Fiym1n4xXSi|Hg}zJu#Z^7rs=qw*P^}Th2~aCkk9}*uE=z4^q{DfAb>CIn z8D$*(8^ZN*_0-yNGd&$T{){$`j9uSbjq>Q3oG}hZAAdX@>UpejLRB5T_& zBUp_qZperz_PSW^$fN(gl4aJqSmAK=HNWlr;c$*0`cd9?RvJgv#oWa6D%#E}M;`r} zxb3X=!CB*Q^fi*5XRX7z9J)D&?W}V+`Z<#Atamux$G+jG4y~_^#?jB!)n8mKv-VPl zE4@W}p5yd$5%*`M_55t~SYMQ9vvCruNWJ{F=A@Tvwk^g{7kp-EllPjs{t0_b*lHa8 zdW!x@&Q#s@d-g-Mwi&0Ga@5A9}jKk zpu^Gk7q)ZA;nXQM=%wu(_Q5&gaP+=o=Q-+d^mU8v9CJ8Jp6rZhJI5VP?L#$2*v<)u zKCM;`tDAKN+WaP+@vVms#? zjy~4e&UuHUpBsBRw9Q{Ij=Hfo$Ak^PUM%UkJ(F|MIFXd2m(u;F-S#{tkaNj6S=7Mw zHEn^YalO2LaoJJp??2b5!$a8p{fcpP4!zuYHcwr4gguU3HIDkjERX)()Zccl8K=84 zbaddBo9dVuw$^pyG~u2ncZt5jH;g0axEYILKECd;FVom>8b|$MmRDWdZuZPW z&Mo7}JXdUe;a|I-+s2V=zxlU%p0xAaaX7ORC0S=Xca5X|FpKxkCf_rTKJMzp`|G*) zeQ+Ka=RjnatGLSZ>`LGi&vDTlJ~WOTd-oSF^W%ZX9Fp_M;pk(F?L2lkNyGis!giiG z9DVM#ou>{*KWDR@XAVa{tF)cx4o4ruZRdr<86GZlh3&j_INs;yl@HEqe*0nnw-Z?CH?D_-dR{5$KwK#`ps2*rGFfUPFF!^b=+5rt4p=b@AQd z=y|rC9}Xv0@$EHi=Rb#YB3#ZhwxeI3c3;!#=e@S$=Wz5n&UXAAj=uh}odAcU_jlU~ z=Wz5rn(c&lINs+lf^lSh&7ZO&qh}skUlEN{NFBuWvx)Q(8tk*zS0qQRZcI9DVI)J5e2uKCaqMG>46kC$7WMb7(v99FCqt z+llXRzU@o4-gXi=oPpW%e7Bv14##^xi5!miu_rdpXveHb&<^B=y|rCb-9l}dRw)fRK}5Q z_4S8#XFMI6pVY>=qvkNW+E(XwSUuXFpEQnI`gN<+*8HS3PI{F?AGynoc{|k8p<3yT zGeiAc9|^v^iaOn{mEKWHKSxSu)ym*-^w>Qes+G|=vALhF^#assJnS`gCLf&4##x~9 z=XAv#%CIk;dO1i}^*nb6 z8%M6A^tma>V}9t`IK<)T^=>=49FD#wv7OuwM?d$oojeXl@5{E6*EsTg_0r|Rg={CE zBaiof@;jW+gK2-a^AvD6-uo%&aJ<(llWK7;&8&QFWR1q8t1B7 z(|RlJ(IDAGdpj&uuk+QQh^0-A~IH=caP>xYk~6JJWW`I%;|Er<}v_ z-cNbs=wpIjPWUzS^1A2$jMJDDSGNmC)Zrm)&lQZ*SM{v^;yQJ4X4-cK!uGiFGo19qO;4##_~Iu6Hs&vhM+_dN9+j`x1*I~?!h zYT$6Z*J|i+^fBBXdn1PvwifNnjg6yUDJ!71jYNqGs7Fff{hii(6GtBXJ0u%h+eTA| zqvz0enmHVOzObFdaya^!U^|^1j`vz!9FE?eJ@e4~bT!Tabu&0X%}?nBHP74g)6J1* z!s&$ncD3fGyTj4X{cNX)!_ntu+v(|W^z%B~>E&?ra{$}v?QnLLYPQRE`Z%1!Ly|7B zoxTpod#!#BM{o0Xp8gI;Z$Gv(z~OlBd7#75@8Pub401SaOUFEBJA)mL_i+tzINsOA zuMWriIvwh8^m9MEpJ5Kid(Xoij`wYBgmF@;ZCM|2gD+-^ZPyy<$TL3rwf?p<%Hf0^ z7wtQvjq^ekQnwGTNBj0}x35XYIPx@|IAG>zYu_2`aP&2#r$e>I8At!FDt*t>s@`aI zOBeR~XS^eiKBtVcYE5uBx|XLywI=#d>o-RpU2CFMYm&p!wLBfFHQ6}oO?Bp4bjpZr zH$2Bh&J^S5YgN5$eOIBm?MyY!7&Slo{`C997~?#TW0Yr_ar8Zro;mODO`UEWxyLWi zJf4^9x*5ii>r8!Ioov?jsw?e0a~*kf&vUFi^NbUuTG00n&59jt;+cnP%{R^o^>e))_WJs< zyzMM7j()bPN3&(=@q(V~i>`kbI{MN3#R99JMaI$pN?IzF=VgLl>v-0pJij~g=wt69 zk38fob~yT+YdcFEj()D?>Co7h8b{vaal2NJuAbu}XPFPqa^pE!7 zjd9wkpKEQ{@w0brXRQy;IvMQ zo@d&gw;4x{Kl=BaY_+!e?G8tOCd<>I?PrH^)CC_^SUj|?=l(^`PUHOi*!!ms&MxEV zG3mwo@B7;AgR{pt`kq@qgH7=%Vj<7@p`Q2p;Oz6E)_xzH1I8JydeLJ$ALU#nyPt!` z(Vq#`PQ&i$e)pVbTBnDMl-wpG-Y(J0~4^^!=CZoN_q&`q_3)8|SVn zq+hFbO>LRY)1mn}W1Q}~9>ab$nj^K-{z4k^z) z^%1!dGz(qJuA-xim9KQE0_TjkMfd;O}C>T$LHn_hzDFRql#YFVU{MfzA|ltpGbNYn12z1!%w z%b7)LEq6HjN82oN#3FYbq+9o{&AWB(NQuoTT6PWX-I>348PdFI`}Uoh3)0n<6Dr@6 zqrdxyGrx!+9mdnAJ+lbO&g3PWyp~hOB8@FF&?5TZFm~3`|Ej2y=zr(WN%X%+=Op^y z>vEEKd=d1}Pezf8$tHgxm6<%kxH>Uu79fuP4ZM=MjbAu*n$}ymbJ4#^Q!h9CBuf9@ zI=wVN9{t;+VtB2k z-#ID{Z36mzT27K!?L|&f&>~GOqMsi*qx4;blj!rYlYD2g86!;^k&H)vG8;vibPO+~ zGm`~agA174L(~B#58%9DvJSOk=);Lx?)pjQyi6KnR+})<`%W9bR9W)!@?>Pv2>q01Lj7d&+D{91zM}eIk0@I23z zV#e+=S&t6CGr5nbR8dsJYH5NFOE94hgS>Va%FcImIGo8U)LP19D>9#CQWsH?^g}(f z$c&}2NKuQ_ut-}bMKSj0OcG+N)9>!kODB+=Oj`R%^+8NFqvuad3S(S_)zz$C(jw0c zCh0(4F-Z?nTFs+gqJqq0(hcMklQbX^^aCEXwDFS;Yckn_4$m>!j}Eh#OLLd22uM#R z8Ibt`lV~8>^c!K+^4d>oRb=uf^0Z;{3eGqtteY)7ql zaa1#EdEqDh6lBs8wVE-ZT6MhE8pY0A(m{ z!|^w6QHxZtNG*#rw@4?84712|i>$H8ev6#6$aRZ6wn#uco(y$drIDt#NC}HHWwH@7 zKbT2(Y=Y+NOp<`|Tn8z_q(0ViGbXe}_3^rv zhqLoH@~mgF7vnn3|Ec^cQRO!~rE%j5va7ba`ab8-DhLoGS5Uvyg0-`dfAtyYXhD;KJOk(ofPx{%zoXF94?2ele9p<4UA z)*8dkKy1CQnbgH7vZklZkulP0Ok#$YvG-?EFPxC|OwNKlVR8y2TL#KJ06o`ZG78Rg zCMQ7NGsy~4G9%^5h&-K`(Adv-9s6u{0x;5dOqOD#(KAuz+Q^)p31zmbGYJMM%OnJ(Ig>G1rz4nb!_4nwvIS9B zm^6p;nF+0(=U&%N(k#^BPUHzQC8egpsDr zO8pc^=E6)SVE<~yWFp9KOeTYDW-V^hNbwne+i!$7C$XZ6@PDV&tG&lR$DY`3aI83@vjNiodfSSB=wv0{3=w_3%{6U^Z~CR;IM z{()5eF`O(+TA)@{CR8hd*IK>UX@;JsG1-AyYd!M#o3iJbjK?~CV>wBJsKZw1CodD~ z=NGU2)M6()`WfO8Mb(#EUNm-`r3ngT=$ zVV+wsp?NOjb)J{9Qw($Xfk_$EDp!y){|{s#liMJln5+P4S%{)mgIrAIOxeYRj$sLfjOm2dlV{#SbEtBgY@rzUSOCY(KTm-4jWC_OAiOCf>Q<&5U zka4YNLUY*C>l~hDrz!G8C_(+CLY^QdI*-5kVIwAS5p{scFzlzZN5nAI4ih`96Q zut+6~bhgNJCZm!01(SH_r+jIuH9Va3yq<}>`U8u^EfcoGZWg)7q@$l?j!~API)IdC z(%WC00ZiQ0JC+MuYm!CoS|nomuu<78Qr{vYnAF5NUCU$!I=p8^<@jINT1PGN(jo~f zgpF!ykx>@ez+@)+d15&uD~8Ryo=J6#>$c_8uM{?F7?Y}q+GshkDu<0KZjrVYIcSk5 zOy*)-epM)QA3xbPQZwldQi@4;)nS0qJ2UAAGKWbwkRwd`g1lqm-s+N8rRr`n&?4_G z(xO_}sGS!1Zjlbv!$vK&$Tf?UtPwVoSv6AR+b0nc^o~R3j!;)Ry3H zemI$%tYLROeiQ9lOyYtkt$U=*RZx}Xe zC6h`R=@k#Bjo)#vBMsMx^8Ai*rDx*qXOcw@S|m>6u>BOZNIQ$1ut=LGlxIBpnaLy^ z*78Xvi9r5iQU_5Zn^K;-Amy78nd2v0LU$(BFk^F=(6({i>x>=naQscmmljFboNBq} zu$@I_TI8ff-ddz;i?EqDTI7mFVupr|D#Ij^zs$yOOd5b3XEGV&e=R9bM9lm-CdokR zv?8Z1qNXyL4swr4Bt!+Zrl^!4!Bu%elwG)5hUt9 zlXM{YyHn=rAXAvk0XfO!Eiz~6K~WDt#xwZ}@`lM}kV-u%>H^3*CbvLh^&+P=NO2|` zL3%M+gbp_{sS77VZ_2Y5q%V^_ASapZ0*TOvqUL~XVX_q@ZC`Tcp?WU zOd`T5){pWO1L@ABC8Aa^nFi-RlVxx!^rt*Y;QYxXCP>Z!gDL77dY;SVAe=8uE`wAU zLQzLRMl(4BvX9A5Wd6$JPmr9yQl4rcZJCq?S;?dr$R{QhL5dHhJo8b#8@Cu*%{av+=>0V0ner!?|ZXHqIaoaIdPajcDBtytc!X}_{F z5P5Qsq|9eP7Bks^4x^1CCm%Yj$K)_NT)?C}@?2t479GYPO?jxp#$G$D$<6@enZV>E z$UjWhqr(PcD06OfxQxjmboh)(Ipj$`mZHj_!}?69!`5CqoW)L8KbiR_Onyb?tm7#2 zb&xeowxH+C2BdhY7A=XLCKLeH*=lxHw9mt}Gh z&ukhtrt^qr-sN??82gk(M227v zpZrcF4l*xUOk@m5?IlE}f?Qzo3o_SON=^+p4VDqfiGD&?5b27jm@A14ML#E35s8O9 zyH*n!2U2w{k?J6inB+jMBkRcNf?D6!6ZsXjN^T?)7kR!i84L3JCUT~M#Mw+F1u~Ch zQrS6YD)+(e{IdAC&)A=9Y78<=>_tUNhgqW z`zUj7keW=ofQ(?$2V@(Q9v}~x^aqK#-({9}7*~EKEim@MOb)?$%;Yi1x&xHwAV}PU zM9TTejO}Cc9pn>}e-sHYde%ecf3B41uo;v8;LK!l9ktRNrl=Som6;p>*}|l}%HwbJ zBS$FeE66t{-xQ&Kf{v0C1O2pSas`<`GAV;RM~+d{Cy;MUN`q`UPRvE@)iA*NG$zFJwEDXnsPb+#shJ@C=w~^Tk17xKbBjqMM5TQ~dAfkqVA2?58k1fidzs`0`5*){ zmh~xRrt7*ivAx}ChO*N@b?9&OznJ7j=7`TIPhMm$$%Haz^qP4HJI#>!ER+1moZ>lU zE(lVW$&_%?&kQEfvEHvRDH%bW#4jjMS&#-yc7ZHlas%WZlWQO;UQ(VXAfZg2fvjS( z6eQv+iuwbj1(Tg1>zM2VdCBA+#+Bza&j#kXCli|If?nr&3p+(Ihpso2r!;C+XHp(y zIg?u;UzjWhY4w)!tOB{j#D$*Iz9XkFdhX7IdM@p?=R@q|M^vKsl!v0qd5vn%PHIH$ zVv@s8wuJwEpgfPTpC103NCr3!KN5KW=fNi;Y2b|ihsb?6Sw0iV0_PHwhj6-mB`22Z zFu?rv5R)cw-Y{7MlJpxzMF$zlWHi?4Z6>Qh(tW3>cYZSV4ovpIS<7S?GN=7PQ7Paw zV)6#Fx`4?;kcUiifTa14^3eKf>UDiJW9KNU-)Hg^WPr=hBsv1}l}T!JnA?w>_o&{R z$rF%0OoBjuFrg0HdhM{VKV?3S>c2BN43b*^gOF-Tg?<__d52nym^=n~$|MjZQ#i^) z{dD!(Pg{15q54@SX;3{{c*^qunJY7S3NoEZFvt}qRK1Va>WLyy<`bwskjZ|K2ocHI z3o?PpK9G2k$f@KfdqEW@$uNq^OkSeH8%*wjWQ*vOkz1Hf>PFmDj%j9q5dB)@!NX8hHIRvCB6B^e{ueD~g)4(OipQEuUPdHQ` z6NgAbkjin13?_lx0sDsi74t3NEIeILB=ql8T-TQj2&Vp9cq1G@)3D5C8k=>L7Fqk1u}yP z)mrDZ)=74rV5BXRQ08YKe*A0OUV+SI@*E^jGKv}kaxOWMDj;k0KRKwD${>sMF9A|Z z6pZv8li0X&D3y|&2Ds8Y!DKW@&Q#=_1lh_Y8%R)Uax!6lMlzxK+3R(FZn9Gg9mYyS zc@n#18(Yuh7m&1R$w>%uh)FV#yy?hE1agW=a*&YpBvk*B2X9<&&AZfFba~fm`llUr6 zfZilri?WfkNUbj-t+EqYqt+>rY&nP|0J+QLIY{rEK$oU_f>rBdlEUQUQOOTspM2Ps~c$OMom^@tQjKl_<3Fx_0QzH97t}rRC_8l5mj%MVzT>2_5 zc^q$7j3e2Jqa2Dl&SW)6@8*L1Y)I&t;MYBta-SpFw_SQU@eyOLFcY^BgAs zU|pPJ^0!MmEY*slri1KdG8uVtwI*i)YOP`t4kU6La&Ch3VNw9(GLr+yoWCtay;B_q zsQusN>dfSa>W9cfCaY8wk$UYYYKzKD^aKqy|aTiJT80Q_Q*a}eddCjWqhj3lQP$RsAWkohB%@E}=6QPjWaX91Jh zAc;qlGXqf*nJhuA@MFk{0@9qxJ&+4bih|@EOHoIWc`B0%syZDLN{=UJrXv347`2bd zG(=69K+f;T++ZS+NFZ^3BXS31EtA3^c_xu_7@3bUS>lrF#U_)p98SO#A{&wCFq7mU zou-oW1|_#fux;9Bp*oT*+jB|)L{~cy=g6z z>~L-}$pNR{9Lh5m&MGE(v4uaMOU@fON#_&E2j|QJB5&bzTSO!eoISr2c@5|5Vj_(| zvMeFe6yz3@h9J?Gl2Zbi>oMtrnV-$1K1RBo$yhiqnDoSzRpMooc|1rNCcQycG3f;o zcR58(2kFbC1lIdJCUo_+#Ou}9K6c__r14i!=3g+1+Du*}^Fk&MKwdG)4ifSQ<)P}U zyjJhWPIT1Du#%!;fK*&XBpOJr)kLC#Bws@$*d<$dRVE=I!l&1rn z;B`cLfRtKKWEe&|kV$5cwM=O2JG_qlHaoddy~_s5ybZOYZ6uNl&MGEb;Z)m1PCt-g zO!|YYWfB8>WfFsVE{lm_z`nx|5vSAlI1`0;%#RIfsz>G?O(T<9Cs>4N(<$6G;p5oyp%I zllPEQ9VFgfBG-|59+L$w*$xx#BWHnf{LM(C?kBQJvAA7nj~8z4nal9M0gPbT}3x$r5@?2^peg}}*vnw*u$vxG@(keFx4 zc>*$sNokOqOim+n(Z48ao+31>PnrCoqKN!K+ZDsGnL5(mB-)AbCiqZBm-&9 zR1nBgCOZ%n`35!nTb4|Zc@}|IH#Fhf>Y=gIUyjknf!^UA52!Ddhgp5 zwHD56Cfkvx#T{}ofE-}*5hUm?IW<5gGP!}wADFB{^$zzaY9pKnO#Vcky7$S+46=>M zzaSYNkW(9E7?az`{FKQeRB!f>qJD>SmC0J=37kW zpnB~m6g3OZX(r2%r^HioqJb=8@&F|EGjfW9bYyZIna?v><}cgxkLMJ%0wnWGA{$)d z9Aok)NYPj1tOt3{WG6_+*W@$?nZ+a{YJFu=2hOi=DXK0=F^IZfgnGa?;Ilamu9+z%p|QEM2J^dQ@qj6>9OCc&8J zuK!V<&2WA&$qmwhkDX~io-+wTt#W?;=J>i6&P^uUK}z|PlLKTolc^wi0?7Fd+x!|P z^RQo}2}h0}$PgyiLEbUR2U00KMeRf8jZDTU5@5Q|7=fG_DvHQ_CjY|u#^fTL_7N#6 z800vUorua7iJU($(&bFnDTjWRJTm=%2YQ~uBqPW>CZ9l>Mxm&hAbXhHMCQ~{$?1#g z!O@8P4zh;HVnn5hPR=@Hp2Z|F$UjV8g0zZ3QU3!u#N<3OXN*ZscT~?8i^y*vo0yD3 zRHoSEOhe`cOg_Q+&g49t4sj?d5aa}t?TE@Amz>t9UL+oo86Z2DOhHtR_~a}^=A}%+ zg9IcX=N3peCIvyxGC7FMAqgp}EvlDF#I->73PDt^#N@0-=2cAMgG5e3&NGlcOv-{> zX7U#@=TAyeT~Pgh$%xDaIm~1>q6#D@XE`!&U=kf9<}c(t1R2Dn1jtP$Cy=>l3W{ov z>Qz$`$pvzhNotUasmN&u(l|Ad&LCaV5NQK4G%b-AA(I&Dy}Q)mGbX7(+5}V7X^?G9E`j{Vu}H1d(4s29zQ)9K^pgk-tEmmmzW<u1+K>$c~ysqJu21MI;eOmfA#q0olPMElAfoD(f^@D&P63cZObUY}sZUNZkh@Guf)s2(P8E6J$vfis}n;k;!n72u;bE3Q~m0T#(*OmV)eJ@*X5^Gs<%i zdu2x^M?m5dYn17ru22mx{w{lO$MNQt(TCmP5o zCNV)yGl>n7tsOKq~6`6Df8ONk6$SEcRK_YeVcj;v=$ap48 zK;m>HXC=rCChI|xbs{GKR|Th-L;5z8jGgAX}NF z0ZG%HoOB@fnbZeK*MppfAUl{e1_{@boYo*!m~;WT$fPewnqCw&4kVPxM35xC$vF+u ziOD&TElgtJ?D?8W9FVGgC{HGkX-on^lJ_Mi1Y{PIJRt9x zAT|0^RCSPfOzMH88bD49kUC7-fXrg@D@gf)6g3RwE0fV6YX*@s7o^=_BFjM@GT8)@ zaR@ovLHaS-4RV;tK9CH*QdA^dYi(c>3nbT2a*~2Jm+xEoyz1q$aN+cKvGVisEZ&inOp){&14-3Gbm~ZI;_TI1IP>}>rpHA zOo}=I(w)f*kjG5IqgI_+6jdK&3zGpLF=vyr7}d)$*$6U$$p+MlG>4*2g0y4u666+> z2B?*PE=3IlnaX4WY8_>=2_)J)it2#Om6&`6*~4Trq5|eq)G0VEnIu5<7fc3$lv+Sh zTaafAlUK;|jY&d84OvK0gF$XE*@`?V7m+grPG2V5;Ou2m3bm5{PEl1sdNKJGdCoD} zjywq#Q`As6otb3Bon6)?77b`v?@L0&QW52W*Ea{MrdADE;A zS-pjvOd!>_63GS1xdVb|Y|05Lj1Ela#A}(C>|IH*J$kt=z z^aBZhoXBq=JDHpTiFtyY%s3)dXHo)WEt9e!-JGA+$yktB7s#0aGM&jJkXRSVSqxH-$zhPAOpbxXy+l!GLFzKO z3bK>QMC`e*nCt)vx=eWrBdQmZop5$B`4hzN3PmMC)CeZSK<+Zxg{X8_DXIe2at|hT zK=v{jjy#F4QPghaX~bj?$YLhHfm~*?7bNL*%2NcHn=si2XDO3RIPWyQK~XJ0Qr{#p z6y)SBB8icw`fVa9K<+WA1~TjpIkiEO-X+onq#u*+AXl062Z?l#qDF$`XEGh68J0lIa;m)dcCv zWIjmF=j8kW@&}UxAW>hCa|5IZlZPPdnY;r@@sgsxf&9iK3by$qugHl5GM`CukYumP z$pzAcNp+B2OqzkjdP7mIKw2~D0J59O5|D^*DQY`ND3eLpGG{W`4|0piWRO_zD9-_q znoJIY%x2OCwLUO81Sju%%5xZG0Fxsi2bdfMiTHt{j)7EQQV>Uprhk)D6r|@zBB3C8 zJ`ouKvWrO)WG?v+IVnNTGZ_Hl|1UYCKth0 zCQY$d#`{7}TaYG9x`8}oG5{p_D@9EPdCKH3kV4@bOx}ak=2u_8gB)WL729DozW|qB;(}ae@(V}} ze{ynz%w$pn)R5*${2Qrq)eUPV2j$_-%7M`L`fOKVY z8e_l2un$V8H&pUq5CffSEI&Onf^ zOh$t&VKNis7L$b_38GS-KS1g+xdw89iC=*1JNcqfRAP`>OqyYvf5@aANY3aK)g5Fr zlYt-sG04e=87sr2A;?K43qeN5q^J)d|1$Xj(k2!;d9c3LFsTU=IW{>xL7FjX1hSXO zIb=>9hoWACOl5K&CXFzzk4)Nu5R+OUH<+9N$&j3)&VzJdG6Li%ldM>SLw}*D z!B`iYn2ZH^#AFpnrW6$AkM%W?Nm7tEOj=-FMbUR zL5ifNsK+4dnS2CEk%k->X5%*|89@GFk`JUnT8gR-GJ{D+ke5t)fs{%|Q8Pi-Fc}FF zF+Dk>K$NbHOh6@Ycoi%Bw&D@;N$y}R7a4GOnQO5 zXEFq&SZ0c9f_Xm7q&-N4Eaa>P8N}oW$UP=cK&oY>s81mKnfPJGg0hhl9b^}i_#j2I zlamr;50m^L{yE6$1X7zxZ;=f)7J=MmvIZn|Ams^% z^)-q~OU(QQCY?Z11W{CPki|@X1$ocpf0)%`!4y>+WDJwvLCS`Z^AuzUlYc-m<|4-* zGd7D!9gvSqI)jwYO;LS77Be{s@`lL;kX(5v>NIAoFOxGMdzt(N5-u-Aodqe!WG%>e zCdo1Lub2!5$&`=s48^SWX0jNwkvl&*Ye3d9ISLZH0675|*RML@z{9E_LMhcj+aiMS?9-(js*oq;ZSp?VEP%X7W+y#_c_kuGKuWP5YK? zkkcWwL-W>M1!+f<4xPi2&V9m=4xM_2GUBLiq1`>5Zr!`K5AEnldNuDBhNP`fDYqCe zBe+}dWjYd2_0)dI2%>Q&W*G*8G5k z=-F7TzV@pFl*yAz^0*o)RIm1N=fXh zD|zzBTF!1c^~5pbjIZ+SlWhaXXAtah2P6+>b(D%UBMp%?xLfiBN%fdQf@Kc(%eaDM z8>=i1X0^SLU>Rv&A-Qy(o9gQThzuSiL}qmjdKM>#toIPvb4$u>U=%|ob6`&1T((M{ zU>RvqPoFZ*;*pYtOo0~vtE70#3*FFgP8M9VU?qv^kdeb z&J1Gq(`|~J6(?BM4v5*J-YDmkI3cojKmv2BaV%1`24ED@Gzj(!eKToh6}19nq?nD` z;-J<_89VmnV2gwZL7wK42V|$^G!-XM_q0g$W$S6B67_Zg1u>$5cD%Zh#WRt13@HFF`12Adh8$7*AtlyoXtUkWMKM(`m~M7 ze$hhmm@AnsDo-=il4Bi+6nE{A8N*gL9`h`FN-N2XV?rN9$#FFghzwreaGDOyI-RHb zZ7eRJ6oeMdy+*}-{U`0MB4Do;M?2T{m#%gRGU=Luh!`nhN2L6pf;PW5x&ktezOj)=}v zh4VbN@*v9O(MSGmvQG2qEuomoOho6I%X#Q?k$PORE)a$7N8h5;+L7%iRMw8{g02G6 zGp;2H3BjG+bve%Cy!;eIX7#xcTs5f`K-JMtG0AMMmi7H&8Hvg(+dPOFyB_fhad6GQ zT8O!pc&8jcnK4{HgJ7gZq#qFdpux-!I@AwC4GGMt1~y-Hs9)q}!aEpbvXGPoP<;%JCq|$)cP~aO7C$CbH`;k?QEMhID9-tGc>=G;BIFt3qF0#Ffl4 zscsUePoMi#^L92-+^P@B~OTKt9{f+XvVbDQ+@T5D08&Yq_2=%+F7c;qR6;% z$sPxSv8NUXGY^96mPOJJ?$K%sF~`iKs#avlgZpj})Ji1|YJmjG!-6R?Qp{Kt85j2M zNVo7}Tir3$%N*%BST4;$Fp6r@v+1y( znz4vd9UX$8!(`&1LlA6rZKaplRSQTS-Si=K6j>}$d2;ja1QL`>&Bj*s^X4+EL2}ChVy+m+s5(>Sh!iMC zQ4q7|&QR6Ui6d#;1kQBJ0WtR}`mT14I5-c2PbC`>V zYh>Z=7qe@5_4G1)?7)3|42M zIc~xyU63HTB-$#DszrI`VH9#G$qb@z6^^Tjj1rYgc1sX*msDEKMns7U(Wmo5svjb{ zN>+6XrLTnPH$15I6=ELCDuO87I~0>Vc!t(es)I}uCy%}j*stb!nK*gm#tFo9sQ2|G z5*4CRMb#k@-QfoAFqL`DMRzEVU=U@tgi9(arsOf}G^P5Eh|ZH)-5%+Y((jj0d2;9F zV*;WuidNEdu%6Yos>6GdIapRRNMNAa7EY?IrHVM}%t)&lB)7iW(XSP>5GS{}QBnPX z1nbk)d{w!zIKjc(AxK~@b(eoY?YdpX2{Z=9p z&YzY860C0;^}b$BoZx(XLUj{8is9<#rQyiBa1;I1XrbDEioua1q??FS(Q-gA^YdkX z0`(#Lxf)!_hf(BVlC=@0}RuD3eOZFLBO4i8x!mXliOu#9vVq|cQL)!ON*zG&w4 zou*zuuqFH|c`%CWATkONjADz70#C7u$SBbBajWM_k{LZ$uzK!f^$dcZ2TLCGtUr|E z+aer)jHk^Y!Fny9R$oJ8q4!Ue)%wbTp7|EmP0(`}t7j1O{HxV72zrhy)zLEu z*4J2Zu)d}V!TJKh`br@kVts)G$^CL=IX;_*5L?xj;F8Sw)MYO%Ld;t3q}U$Wn{ZzV z5~%M}^d0{=aRTK=1tch+I)C+5P6cs-<$lmjbm`dYE50=f5Ij*FA?pjzGu=dA;s2s) z`AeR_oP3x7k;{2kC`KyR&#^$vw5oopfXE!yu;$QD9LymI=5Q~@E}20vhZDuY9D-mD zD~W?SbQ77w1TuDP2_Trmk=7i#iOgYuVXpV;tDWpA zhWw{U2a9xakRQtFBE+1#dn(djNT9x?uBqy@kXnKAh!aF^Sk03@I)mula)w%;k5w)r zaw-Br)Io9b$azP<4rHPN^>iFl-=&m(^h0!)ewFyTiBf;K0*lj~?@d?OSEhSvpmEvE5saEb*3Leg7n>bYL(-RqBN`g@W4$1S z*@Nh2)KUsjdZ_wY_aqRx_Hz@xH?31&BV=8mItb1VNo8NgHU<)CPEIOMG#Q0FTyZsX zS6BPj7xmpm<(c^j)~}lB1q649We_E!m;xfBa1$BDNNW@z7)5ex6d<|u{rf3(bo?&0 za_PhI6ZPyXp=35U>+@94$z`O0dIx(CqQ~<$Z@sDgcfBR4Z7p)> z2T{+*)$5t+OFbkf$2@;l-?$0-Noe&$MB4+@8>93Svt)i@`$3fHN57JDS9#8UK+Ia! zuUGyp^Mh-NMnZ5U+(ihS#zNrq5`ycN+#quGrQh0a`Z4br(68+@kdfj&10cA^*KbLu zD7|gyrI|#@=HtpQwdBFAtDq2ERbG>Gr5qAmPe5chcqRnb^ZL!@G>768mCWWnuDYMn z5`|Z;mkW`HMy^#t%stU#9VS~ZUbzOrxYP>?R2@XWvEJEFY9VIk8>+-PWPSqmFy@2k zqWbZS-hP7ou>J6~A}UC)9{oO|N6MpG=4MZQ2ZCA|tXf2r?3%^3GW&(Cg(%c|pnPX7 z5Y*C7sf>eh5z(~@s2f2&uJnFkYat4??kmq(3k0?F>-5fAL{zBj4cE$U)j||%J+x|p z1nXCGj;pOHmaIXuU+6j3BQe#nUx27JO3P~54&@QP>m7QQZFP@0W^dBhp~EDzIgZ^0 z(K#2Z$4rS?_q>Qc(!j#Y@SIJj1L!^&|>;DhNTI z7m^1f)gS0`j!S>=iN>Y-)yot0+^&9}QXD*U0144U?XI%MQXQBM zL*!)XCbG?+k~|pKNsF8o60F~Aq~GxoUor>l%Ts;7SQU;OCOn9WYM`8Wh?33MP4oj7 z?ZmYlkP!X)&S>St6epLwiwOjde#fdAI~))=2`mQ$P8`c|6Pd#VswYzm&!6>n<|G?I z^aJ|pDxw;QTqJ>Dz1I>4N0Qn?WSU*srMmvGg;{D^j=onh{m5H#Ts15wi#X=``J(!{ zzl=Rlb|(;d+0*qu$pcbOh`fa8YAFOxc_HThw1}!RK?ttLK=2OaqSB8!!>Rxmi1{>u ze!pL5*>lai!LLmKQ{~xn$=nQGp%Wg5$|3CZl)dh}Yl8s^PEP#Jf+v*TmP_QC&zOQzLz{$gS({`#-*PisLfF=%{lWoD>FHsnLk;X zk64)_8KN^U=FCy786(FtvrCQ===qkFIXp5y;LH)N%;b1x{@3dHsAR@gS3w*ce@Y0+ z!yA;Vv=BToD+D4>t@RFT)}RErvI)WaKmyIos}A907e^ldxN?XSs4pEZs-KS)#~kO? zH*SLa?l(?Fn$o?KE@8ki& zajd?K%N!HltMA52l=(D)D(5D0Kyvk#BdtD&nx&UTrVGI{2leoX)`hu-)5n##>WlU- zb)jb#5F905OB8z6zr=y|WkJzp6td&G^oB$ZCwA!{8Dj1te^uX&0nvN5UO;fJEM(2I zo5(iSK}Aw6Aw7hc#QKk6(zAI7S4j}{7grkf!h3Y}|KR~)k0gk~QxW|uHcTz7i`>$o ztP0mQmCNbqYjH#1Y=tA2GBLz4@A+3hcKsq-f?Q_0E=zUu7NKk^BCR<3jg4lBD+Ezz zBq~teRN-$q`{Bsv8Dm?{X>rV+TSiq&21m9Z5c7;tH+0d8iYiga^N%>VVgx~+9pWJB zvk*jqAnH$X5S2lyBMJmjH>{}4Rul-LZd*}_tSAsfowK5%Sy3Q}IxbN-vTaavO?!c! zb-n0!8_;$rYiGR>?58`0$Yy9h8D*ky9bQ))T)o#9f;p@w1p7sZY|q%{w}@k|jk~Fz zj|VY_B=sE#qV&~)bKlXUp>fGDa?0@sv$0MbQCvGLqK^wE4;YMEE<)iU=8c9b~iXS)zQqi$_QO%VrC2ZbQ2trfLU z97O#k1W{eAsM+Em>VyzPwU;Q&yuLl4Z9~7xsTX}8;v}6d(#9gKgy34Dt3`SnlD&6} zrrn#WzpCYxx>ybHi$&kKPL{vi{$&Jp$~Q|({Z=xy7{`^pvpedwiHfFvrj0va9yE4G z_2ww!xIAmUF;S6pO0_IraqaJieo|{RM;XUa>#d`ftH#r#?x>9%WgJJXcZkxp(w(lG zu9<#m-z?WT$~cZ%?-8ZP_1od??c7m*|D)M3j-%EGYg{)lt_&Py97nCc9kqf=H#_f+ zs=`sman$;VC_NNCt_B!aZ;mpKqt+)x$++B63pmO+j#~d%F1yM3CcT^*eGLEB`{sc&XpXYY?2;-W_QO0r9 z`sS!rt69&_?xKNA(1YyFurQ$Bap zA&xSRBg)@IsXz2>sVmC*H*4Hc-#N-Sj;H_=MWa?vk`E7@=8h^@iMVkbQQ=IK=UTpt zwcLZFjN_P%@Fq%TLvOwAsO21G97nAPh*HBcdu3y6y;nKPIF4Eo5hYu%J1SCT8kcb# zwIVsjHECVj`QP-%7tNA~qm1LI71>eiOXpfC-BF<&WgJJXC|0d6s5P0RjN_;k)lp0D zDekBP9Az9wt!R!~`s{EU>+2my8OKp8x}%m}U+$>HRcH>43D4D}1n8Qr^gUf0$j-yt5M9CbwqpEY1aU8W0IL4*t z@H^(PKSvqIQ7fUNmYzd*)Dn&|j-ys0M9H|eVq7OV$~cZ%i4mp8)$Kr@NA9T49Az9= z_MV;EcWm|do(he=UO8+z+4isO8G{b6FY7{}3J zGDKTDhU`&fCKNKVM_DO* zBuWdBRgsbE|9sEudtKlAJRHaWIga;tyvO^VALn&n_jO8j*&aBq zwP8h#SA`69Wv8wNe~zDJDyjVOfY=Ke>dHaK_5QrL5!u5Wj!}gSb>*b4v}+DLZ0fQq zWT@*IsC2P$$Y|!TE*MeOOV>dFlz&o=V!{@q~iDpSeo zyDns?D-U&jbfR}NQ(aXdLtT04xGFcUyWiANRmf0RKI)n{tLIiz&&!{ZioKAbu4n(x zaZOi+40YwFuDhR2JZ)WfR3SrM1)%(zm$i{2tc}+jx)CBnT?MHt?ab2cO?{>c8R~it zDy)q;Uqn*0@u44b^xN0?aBSeO}ic{D2 zp55wO*T<@mp{^28er@D@yv83n!`gVPiR(g!x?Z5JN!M#6G1XZWGSu~A=#qc;={#j} znmVWo8R{xYUCa00ZDy)qQ#V3nsH+r|UmN`sKDpY|yQ+|(u9v85)1^(jOx;w440V;J z<67NsN()o3$)9wMy^x`M9H6@5{qlCfkxUoUaUTxGrRXQ4HsbtOF2$7+#iqs{~8`(lv1y#sUS0(C_ z=M7UMRUt!Nm7$)(d5Mdwx@PyXH^Vc)URB6YR~70?m%jcWQyE*h<3fhIs?u@E9Igw` z06kS9LtWLVYr#Kzo;Gzy6*AOSJt#S}UTufh-zmQugxA|G-3XDPt{Oo}qRS7vvYYx& z6*AOS6H4}ZdDZ&&-I~vY^Yv0I*M$sqy-Z#Eb1oTWYN0A*sH+xKbj?2+x)Qf`UC2;Z zZR)x@z1KBUZ>mCux?Xvp>snYFU#dcey6RBZ%>xaxnfgN&GSpR$RX{H1fHqsTrz}p|1LLT(U=93CFcv z6*AP-fVyN3O!B;QOypqWkfE+O zs7vP1R2@~wP*?My{2aa+=5U}YWT>k}P<{?gEmMUIb+x49k~v%#_KjnzkfE+t)ODon z)yAfteACSaGSt-?Dtqjp8Q#03?I<5*C>gpJjj8M87g%uUo(Txxp>gp7fBxGkZl~)xq)YTbEo|ffv z>=QNaOu8A4>s3|AP*)e~8k%HzXH%n9AwykVgNjw*xc&@Xn^Yk~UEP9`tnYy3~ z8S3gDl<#UE<}hU^H;2ejSC63l9GZGj6*AP-6UyJsSGU@F^1twzUMp3|P**SNdacUP z*`}tcLWa6}2PMZPPejj#Pt10!LWa8f1SQ9{`DXmIriyoVvw;kCy+y|*yJ*8Ohaagz zhPwJv*S;2KiXLT>JHiv}o2rnZu0hmQt8}C1O^sHC40R2L zk~x%Xxp{+I8+L^`T%rmY>KZ~_+s2)F(p0=|?zoVluAvWfjh0`K!>f@hWTKX|pM_M*RQIOp{|M4CEqDF^;Azc8^}=CBq+I8N@BzMrc+GSQiTk4O{T6pbuXnhHCz=k z)b%cu|Foyfojz}v+NcT{>Y74bjWQNHYwDURWaxW0Q=$C#Zm!R`bj7LY_im7(5l#yu z6j`Uv$rt*Cna|eC%^@;0!s#?Zc_K1ZUllUcH3KSoRhk;B3K>!}q1;H~;x64iu+!8I zRmhN<1tp)Q$Z;jweQ4sYa9n?>LWYiOHXT>pmTO)yRjs!h12WV#2P*p9YwA5!$dH-~ zB|o7nBP`lxz+F>+szQd;dr+}2cx||IZh)y;ecT9Z1AM9q8R}X{T{*_C8)WK=DrBf@5tKj6Te5AwXexVOcU;JjS_~EYK^WYL z+Go1+hpA?&kRi1M%Ke+MpO|j(>pWBQRUt!aDU|Fs{#qUu*8CY&$k1$j2<3mmM6P91 zPxNzRK!&=OK}Bc7RBctrkopKJIvb`Ys6vL+awtC=yJzk$VCt|cWJs-m@;gAaOijwK z4{QFhx81*n49&($C_fwVQoP&CR4Y};P}j#$em3N%k4$Y+g$$`rp!^QdH*@7trc(EJ zBSePODyY~Oyb>ILw4SN%s*oYI8Y+5KmI+to0aeJ*Y^;Iuvk^D&sYRw98Q?~U40U}9 z6}>8JhO4rQDrBf@Ep^FNX==18WTfwRzxR4>W0m}V< z-BoGo6;;TP`YarmoUp@dznMERT$NK)Aw#pVF(~xqx!Kaxud0xtu1!$>+2(kK9!pG> z9OOoh40Ua$uH1DpCo}b~DrBf@3zUDhxw2#7x2Aqog$#9VrLHNj4*JK`OM~4Ak)f__ zP=58wGxqyo4yUR@hPt*>*RL~HS2DFp6*APd1Iq6kod(x_wO9Cj-L za#K@>xZ^^Gx^_YN)hqjksVYOALWb1mP=4R2cJH6lrv6if45=@mVqfrTo#m7JrnU@o zUC5By4dtI4)-LKYBvIHmddM#l#a_tJZ0re267tU1RE`l&Awykzp~C7txNV)Old6!R zu6@*%=gs$ani@0GbsXPpvntFANQ^-))*VHASEhh|JiN`vH40Ro(uAA#Bj51YD6*AOy zh`Qvs(uc18s*s_s!_+0mW$H6k$WYgjpk&3#CuWz!Rr#kXWT@+CP;%sDKmMSesa)gS zY#>8j$AXeBd6#`DbTw9m40Rn3O8#AWjxse`6*AOyA}HV0I@~KiRfP<7oeWC4E`|x=um)b=d9FGfVyrpB^L{?`8uT>iUMd^0uzK*;Hv&$WYg5D7n7mRpH4-L-K{E zuRf}fp{{SK>-Qhp{c7s6DrBhZ3>}x;9U6o=Y&^jo7c$g!mb&B}hpEY`kfE;c=(v^+ zsdcqsSR1=lAwyl?Q&*QSi&i$3^c^=sWT@-h1IP7nxa-wcg$#B5Kwa|vFH-|mAwyk1 zLdo7M?;Spg->YKsa4j!ag$#B5L|scy{&mvScdC$~uAiZzcRf?dCc4=`hSV=mu`hTh zb*{%ZWlWV*g$$|lQ2sN`!wu#pG}T`fGNdj*`6t+)kE|^JdbmCQ z!J?+Fs6vLieuaw8hN)*Jx!FL5)Fr6cmoOWqTB|~a)MY5Y1I#Y-QEOAnR3Ss^Hz@x^ zwD3%YM2Ev{TvUY&&BhfdKO5W56+UY!=VW(W$WYf+sOW5%YNZMpQrDnjU&3sdTC55g zQrDsU+PE@l-FQ=1R3Ss^29#eLJ1ci+@l}|OXWwmIK1xyG<1`G#h_G`Po=7XT#JpQ{8bPL+TEcf2#bVe47cT znyNyE)Lp1B8|AOW-tPL9GDj6Mr0#{|icJQd9C8J9R24Eb8-E8S$8ht<6=h5%oaT-T z8S1(plynWwnDAQsa3?CJ3K{D9Cn))M<)`3GO;?2sb^QzF_YJwj)(^*ZQx!7Q^&fS~ zrw68i~ zMB3CyRmhNv59P)m`!A5^U-qe~WvY-Nl>jRC1uvPy!r{2SQiTj1S3)R%rL1dxw~wi7 zs*s_sL=SX5AG(sya3e>Cx)MLoWvY-WWa#@2NucEWZ2mPC`(gC^4#<#t_yM&6D=Mmx zq2qewf#Yf!)?qyzAu@DaN$I#`9hw@b3K{Bpl)B{I&89GiOI0C5U5{~B?6-qW?NNmc zbtR)NSsTs6as8qS8R|;TU9sab_2^7@mXV>Z6j1&rf}W`K_pGMj{#95NGSrolx~3k# zw%$}9Rmf0RDyZm=ZEBM$WJslkDi~W%B2N!V)W8(}GiR~?D>9@Whf1o8@Xe2|e{ZVB zEH@j-kV*p;`-0cs`#Wqj^{y&pXf~dJ@>iw&CYP!6s*s_swA3YMxm;LL#b&z^B12v2 zsB6#ZqeV?MRD}$6r4LFDOzsX7!}EMURmf0RhM;6L^0|$vRjQDot|y`V9rnotm0vJ* zUKKLb^%QkAJh6VTsi)?+*+7Q6o`#BkZeyyhDrBfDBXyNZ+$Mpkv8s@vu1rDsIh+#a zaHlF{s4H_&ehy9DR)q|8Wr2#$p{aax-E1I3U0JD1=Fn72Rmf0RHmK+vnwqT&8S2VT zT{4HJj;KP0x^h6pzThQmerA}%B=5Q7LWa6>QrErg+b)_ar3xA9dgg(y{-LXzDrBfD z7j=!wHfOP^4^<&UUAcpj1C!5)%7h*JdsWC#SDv8c$mJ(7OeK8Z%?2{ml^4pts{A|em%TyOt$WT`?>XK`@e7Jw@QiTk46{jxw2`*FTRUt!NB_8PN7p~>R3*2!b zLtQU$SM0M&Q-xF^LtQUI$=)lkQRQ3S92dG8t3rmlN>bOkkCV!k;}OvPL1W&;`ODjk#@mplVZ3SGrjAwykdf|7q%o&ijCSA`69l?}%wN}d5s zEmwsMb(N#8@6VpDWa@${WT>k=RP_F3D$61_8^};s1?rl=c;GTqja4B-T@{1!b2v53 z;S5#CP*kKbuBnmXrQUAOWbTALtQn4lCu5hfB$4w z=&Gp-8R~jDDEW6+6hFSn)NobEP**J|`CL@gxVppJn%bla8S1J{T{q87U2N(PRmf1+ zD^UJ?l{q>rzNtJ*-E1I3U3I7{d+HJ!O|?*k40Y8FUGlDeU61N74G42MTNN_YRgb#L z-m5yr)IL?nP}i$a@@ykrAN^7%?ZD7=OBFKI^%`{zsQdK@Qw2VBvw;kC)el{g$kOb+ zwWivsLWa5;P}dV9a;`JAP!%%N)ey>`ugM!{mo)XgDrBhZb?REZ;Nd)`(l2wzg$#8y z3MzJ3cor=io<-}aLWa5;2POaRmMdtXHC2TSspdh+96r_a;xbc< zR3SsEMK~@|@-E;)n2ldlAw#p#GAKC)`CS-OX_mX=LWa6p1?9V1g|l2y6*AP-Iw<*f z^hkRjCp%Ke*hafQeHdEQhlRmhO) z2<6|kl{m2P+=TExrMoI*=(sx3aWxrVZrTAwLsnYKSUiNcDt@&W5RFs*oYo3o5LQAMeGPI;9F3QoW&KU+|K5Qhmdk|4$V% zG#h=O{A|eYJDAG(u^R(2)b$pWf2x$MZbf942^I=7@^;7iiMfKqFu<)2nW&# zWw$Yv=My*c$WYfHsOUO0)m9ZUqy|Gp*P*GUs*oWy1j?_&Ouzn<)YMf~$dDQe6}>8p zg{$(}RqkIyhGt_JlwXH(RhsIm3K{Ae4n?yOy4I*dhSUfsnvI}tt3rm$bY_nm)^%2d&-F%cPWN0=GYMi$Dzb2;gZ*<3n45{~_GQ>uhAof2sGwj-8s-G%kNX>(aeZlITGyCjbQ(vhH{b_E_v0SH+8V7R;rL8wIGa8RO(bq(wSPN3K^RDg;0Lx z<*$U9dStU3Au_Z!7C}W<)NeS;(Y1jLjc_qk=Gf?D1!#K}FYwsne>EA+;PT zx;9MZ-0DV%45<}igt0+lZJ6q&3K^RDl~B>OVd_g&$k5vO7%I9petckUAVVYk1S)fE zbbf986xK%8ZSJ^`p%Jd45gsd&rK_oqs*s_s)lkv3VQQT!WJs-nimnY)@wU4WB17s^ zsMwdVHcZu3g$${+P=0MJJJs$TQ}3xlhSWMJzcvoV`=q0(-&7$(YJC`CY>-$Rri$%w z$At{d{06A#+AuX)6*9CoK7)#`jSCN~4PxeH1j*5 zqHDucdsWEL+SmmZT^k#5mZSF+WN3t+Lq*@Ul?d;N_GlL}G{P@vgbkLqYHI4SFWhk< zLtVR}{QDI7EX7n^RmhOq0~LMOW@@e~WJv9WawCb0dnx%SpfbnKmF%Lo zuOI!eb$HkI{BHNJAw#pVAIhJv8;erCZt5LX$WYgpP<}S#U7M+ks*oXd0Lp(VGUM2& z$)?KhaU(>A)K^fkFLT&Bj3}KO3X^^k`wKy((m= z>kxIxr&uqB``1xb$WYf|>e@5mh2Kr(+vi4z40RoOpsQ5q8legq>N-kY@;xb2`&A)B zUB@2i`ZoOT(xdy`2$7+#N-hX^79*} zuBbwWx=ul5j`hefyq*6WmGNyh| zg$#9lOI;bymzZd(&;d6>WT@**=!#Xv%}bH4!R0WA!&MwD^Y>F~@*S07c#P}jL|T=MT`A3biob?sM$40ZiLU4ze0 zDR1h@uiXfdp{^f8SF9>dey^=mxTkbdg$#B5L|r9^b?s$py((m=>u0Fg7rbQOC>yTj ze^ntvUB6IQvdzijo2qxv9TzgxbskEdqvZAFqUSnQ4r^nXDrBhZ0(Hq>#xs@pkn2K* zx-LTbPujOHJ>Jk%D^|9rt%+mUC2<^pHP0yZ_n`gv+=@vhYwXDLtQti z>-gh43!8fAgzG|vx^4v}=S#i=UOMa>jZ`5+U4I27|L&+JqvDxbuL>FJx*e47dNFjR zIO#@+40YWJN)qz(ho-uyLWa8TLdp4(r%L&2b=gAK*Q$`Au6xwgeqM%LrgEKfBSeO} z{)X~TmGX>jYN#q?NZp5uK4Y6YrwSQT|3JBs#Kkq~x~8M4a^JZBJ2IsHh4SASsk<=c zvMXW7o~H^KnvMUU{8MG0l>_FQdi1pGLWa8JmpYW%GmAu^=mL&XjbFL}nct^=x&q1i|PeJu*t@sl)j?sR|kD zN=sexmrqQUJLl#Q8R|+Gl+0m;obv|_58oSIsR|kDN*|Q`yE$$yJ7X&I53UOt>dFA+ zpNJYaE%TqLcU2)nT~AV1ww%|FnM(Ad>q3UQo`T988=WLt=8u=!R6kY7P}kGcHRK z|I*FWZ>o@?u3S)=V?FYuSET&EN5+J%V;5Z)GSroux`q|{`Ylrhe{~8O>dFHZ`x5SY zrpBv6hE!fC`FvhR_{I1R-Aw(a3K>%Qf{LNI@BitT(p2qBZiL8?dKN0WvppVmwog5XEXK0W!HrabrlFoMkqVmh_JKuSA`696%0!LUD?@8T~>t*bv*~=SFh}B zrt1IZMu-e`6{0TL*-Y(Gg$#8ShRPfpo&3A9vzaP##dRS=UC&dO>};kMsX~UjiqLV% z&Son0Ro8_Kbrq#9+1X4DRfP<76@!ZIY^Hu!g$#8Sr!LvqOuccq3UQUWD>%Lv}V(D^(#wT_veYb~aN_-EdvV(06=FLHY0aROzThRt#ODV_(0sH-Ma^h%ikalz+c`v(4G{eZzb6cB+t} zuG-WkPbsD*t3rmlUV(~z2~Q5DHmX8~R2`_iF(osS;f*2rO#Pw?8B%qjQp(ASz0Th6 zIK@<&n{Ez~Ayp5`&%C@R>KV>*8CA&8Y`hBPpB&^n2&Q_dLWa6tqb~W4!nZ@$VpYgc zSAFV||8l6QZ&V>eT@9#9j;lxLdgPXy4P>aRA$7@jIZc&Pg$#AQPF-?b{X$n4Rmf0R zBkGdlGPOVzGSt;LC^^gWcZnYfPkP5yAwykFf|4Vb-wrla{Vz8g$WT{PD1T3x^UB%Z zP3=^L40Sc5u6W&#es8M8ZP$eib-e-Q?S`C19G9%ahr=8`^tV&UP}iG5ArbqH z3{!1YAwym5q5L|OzmIL|fGT9Ds{?gaX_DZYspsyy5h6of9ijX>l)sN{YKAIgsH+oo zW#5>ij;ViCAwylAp`zkzSIY3K>#8pmM~N{FYk$#q*|_+N}y1Qaz#k zU9VsA66Z|)rwSQTy`bd&B`>)uYlj`X@PBSLkfGV=9h4;G`Os7gRmf0RpP+o#%b{zM zDrBhZt)P6DsokoOp{~9``K|?F2e_*W8S3g6lyvpJlsLbsZ1~ypxHx2}>uo5%dgX6c zCkU&zhAL#Jt3P$g->fz@N)Pi#7;z zSUjHmBz{~RGSoGgx?~qMwNDi?)HURRu7;tj{zI+{8R{DPK$oek@ts13x`shzj*VX4 zP4)dOuJ)X;16)ys40R2su1uAd&oq@Wf$Ktsx<)|7zJwjXR4rA=kQxc~Y)r|jI(7fn z22;aSAwy~ul>D@_yqZ6o_7ziGRUt!aG*om4s1vTr-&G+)voR(pe^r{woY2h%GSoE| zDte_P4y*TNRmf1+IO>vTQB!ACAwyl`sY|Yur$X18iQEX0p{@zkC0B~6JF1YOu6L+Q zu9Ws+^^Q#Jx{#r+iPR;ZZW?&o`WketLimjc{7%k~J?+UrEAQ&hoIE z4PdL)6VL4Mjs6vLi=0N$YQm&NDVGdtN>PCnRbVg zrOXdk%2id!P}lp^mG{Y7nM|d8)Qu1s>Y4}T&sU|UFYPn+yeed!i zLtP(G*W>M1tS~iD6*APdfVw8n9C6FkLRH96*Fq@2HdbuD_@t?Qs*s_sMbwpNT9;g= zuBt+Yx)xK{-rv(LF_r2uH}l9)*AnXbWl_HZri!UThIW9ZP<{uvb7bdSr=mLmGBm;u zq5SiF-%oceA0F=JjkOCI8sRb;;o$yl%b6Ob3K{D92rBj^+|5m`R)q|yjaOnt8k8B!~t{M~#>i+6^ZN}0^fJTf$gE1}%~H!kk@i*0H<6`ez5sOw`WzXQls z*(F?+FKHJtG>4x+`Om)O{$;9e@wJ zvNlX5Nabb&8S45RD!MjIl~aWbb$vlyvNlW&R)q}B{BEe|+Hfj5^T^N$_drEwzGs;E zZQ6wljc_lGP-foLZB@un*FLD|%$q8Z+RY&{)U}_wWadr1sR|kD`VuNS^QIQ6LWa5y zP?yZSsqa)FLo@#sRCMN@iq1STq`roVeh+arW<*f#{8sWL1{8=_tRTVPS^#fG& zEO!cLxq~WXsOv}SlCx}TxhiC+>nEt_SvGZ96*AQIGj+*XHkCJ>n+;^B>ldi#SvJ*C z6*AOyp1R~Ln_8&~89K`sprU8lspwfohSWu<=-yl5fxQW*g^u73L(jtq( z`>$&{LS*Q;F41wV{^y$mrt+qDbBGLeU51K%3Gcs5wN-@-so$V($5esX|I|9t`U_J_ zR3Ss^3RKOQkk{n`>ARWwO%*bvu0r|ME5BP|Do+M?T*%ODT!ZrOqz3dYalup{Rmf1+ z_5aiLxhiC+>&E}-O7Wx{Au`nU`~T@`tO^ULsV%CIp{_enu`lS7->x!sQ57)5KJor`>EIL+Tz>`dF8|?w)-!(p6Oz zGBk&OL&?t($!pcEpW?f&=o}(LUH75##e~dZ@&z}Jw+x>;_R%h6Xb%5@@>j~k2NR7l zwNw={)b%e^>`T};Or2DP45|O1{Ld|SPOx*PsU#WQ93n$1F7^jI;>QyuuMx#6lr~jH z6*4r3@u2*^QR%DdNu7$$Au`nU5UJEzkA68d{Oosk?Lvm;Fg}!@!$KXWuQv6eDrBfD z0hD~sCU^55Mcz(j>N{1)P*+0g`Zs&&d8QuEPiIV@0H(=+?m8wbydhvS7Peg z_Sl~TObu0q40R=;j~eZT-JCRV9lXAu^4N-**sdP}$zh`dhb5+QYN)P2{qtm;~ zYMDx!!yOkgq%uJHXVI#Yme#uw?kP1@Aw#qAB$S_x_eZ^T#nd`g$WYf)P;!=KKa{^@ zXzHn)ZiL8?dK#*2Ovv{FI;{P0tf`TzkRg>3O70HwbRNI)TNO?Hr3x8RnZgL=4%?$l zp40YvzihaS8!@+xVikNylkLyB) zR8ApK;_ryxTr zHo(m%sCD)g!!K#p+AXh*B3H0!WW>j z$9iPuHHesal2HaUnxpC846%m#NQGAw#MZREyZ) zmwSq-SBtn2B12u}p<-Xcnm2Vw6*8nMK>0O) z^!XF{P1Pvsx{x7N5h}XoO&wB&46WWuQ1VnMuhso_=5Z>z=8+*)87jKw6X97js*s@( zR)LZ^lvl5|!|R_6YraM?cU;KO%vTLcp1$P2{$uJ>Rmji?tI-Ho6g-{Nsptrip%GRO zU4Dee!U)qBcOyiGMpz>#KSEPORUtzotogtQor;bS85-fsq05i(yD-Ab+Jy{_uvSoh zgr@42aL0uVjj;9uBXlY{LS$%!uRuK?8=hRtOslxn#t9YJH=-`O|@5r45?S4GRK6x3N`JN+SCeF z$j}_V1|>VFyiz1?@U2tPIYfrK>O=WGs(F?o<=2Ec{8hV z8^};sL#XH+nrf~J8B(u9$^6MKkhbpnw@uAgg$$`iQ2xDMquV*ZG<9ATGNc+q`4yEs ze)m5<2=9EemvqO449!LpC_fvO*F6)@R9jWZP*+o^=xmr;rV1HS&7kCb$@Mk+mG@Sf zx~2*lQg1-{wNWhfu)L;9lyb*~45{W&{>i-3tY7ms3~OVcDr9IjT0r^Pc&B}>hfMvg z3K{BZ2^F0UQ+-}?BSeN&E2#XjnUM97|I?HEO#P(_8B(pGvc!bEy4J1!wyC#EyDnr% zwSki74SC7avZ;HjkfGUV3*~1+{=${1k!4&LGSt-$%Fq1oX;L-X9%epeS*MVpt~aS` z*2yf@Om$R+40W}Kiq5>LJ*to))d8wUY$oKlgK~_mmDN;I~y|8)fvj4FZubyZD9_7)-Ggd4!c14^CjQ&HC3{_ zJ1%6Xt1FbhD&^-7O-)sW40Uy*F8Q9XscWi`p|0*w{&Q^k`9o7xD!36MLtQ^`FZ_1e3qY4>PeW7IEl~=|Vzs@t2vXUDiGBk(%p!^&@ zGBEB*r=oL+40XK?l|9xYvhdi!dFF&Ud`-KMp*idiO>&RNX0LsB0K?$#>hWt6~kOkfE;O|EKGbnoc1@ zT_dQAkL$21WTSN0akGI8sdu5Gd#|ZVs*oWy z1Qr zq3c41)DkHF46tiV+g+v-zwQ(=w0f69$!y3g$(u=LI~85M$dLLF%J01*lVSBn6*4r! zWl;XP_o-W5@0AT}{yiNbGBooaLHU_KUMBZVQ{SjUhPswRMfVL;sT#T2K!(%`sOa8n zs+KBbNUenOd+&gvaR*Gjs|p#K!;eXAPB*8gQ_(p@hPpn1@@M&#tT(Q;348A$?Lvm; za21rFLwQOum9(*&4P>Zm^#fhg!uhJC3K{BJ^FWuW(W;Q4u1}!~##WMCmCZ(+tiB{1 z*M3#VP}f@OdZzF49;RMw;*JX$>RJaCT^puWs6vL+dZ;q7(Z&9kxTofpyk{zNQ`dzI zsSQy6N$*0A7fP6#tqK`ZpF#PvEYI_%k~MQ($k1$Tgz{%uo_kGARD}$!!%Z~8>!p5q z#i{5zM21GV87fz7Cggm{{VPLQ8_C~rBSeNqxP?Yo;LlT)OpR2940UaVir&9W-B*PS zsclfv`DT zsSB!*A+-xCdjB%jtflKhhGzbAD8Dx3{$=W-DrBhZ3#izaaQ`yZxs~fehSYAT=>5yo z9aYGX+5_d+yxhM`jc)C_kfGJP7s}tiYNf0+)T!v|MTXQqsObGG%LDf>WN3u@q4Mc$ zy#C0Yd&$F^Pu0ea5E+{JFQNR*cdWl;wyBA#kfE*vP|-DSDrsBSg$${$pyV?Lnf+I% z9ob-NtSV$keGTQ;e8WvwlA221&UGO}>L65dosFTNOnKkbcvZ-dIt1mPvG=B}(9qOl zZ@MmINF9cXu6a}ARUtz&e+0_Ue4U2JE1SyD-gO~ET}Po}U&5Le%PH9zF% z9bcO&*1>flL+Ut`U-MrdDss@&*Q$`A)q4WUule3NT4!`By5^A~brLGN=F>m0=8>Th zo}v-T^G4fnUvART9Tze*^WQ-EnV07cQ&UtSLtUq#a_P(;nOpJbkKy{-rwSSB`j)y* zB^!3oRK`wjgve0W87Mhla{rR=SDNaf3K>#oq5PH7G)bA1rVgk=hSYaK#j4__XPP$1 zRPN4hgvgNk9?H)~?h^wR)DE*TL=`eL8|R?>%%^#-;}51zszQdket?S3hN(PV+z62& z^&?dC*fGhSuTIiDf0!Dg3K>#AK~<2ch`lD=eXW40?^Pi~tM_Lpf2AD#?owH&qH7)* z>iPxB&*3{`-i_BP%wdtP?zoVlIXn;L=kSRf;~JY9sR|kDx&RfOLsKVJAw%jSROZ-B z$R`#59_;hGsodS%2$3Q6E7a35A+LCUwBBrLs48S=4lhCZIjmLXl8m5h6o#cpb{m;mH=4_Bj=uLu9Dy29%$}b@MZ< z>mKH?xppB#bND-ypTo2-ZfR%gQ&q@N*B?;PIW(1^r#miWNc{;lKQ@19WB*fl$l<=G z8mK~s)J>?@VnSYLT8|uKYKnM|!!g$$|tP=3u{d;8@$Q;+mLv#2alt0S}x>W0H>ZmGYs7rqEnE(4< zrmDW>jtd!5@t~wjM)*{=%U_uKTop2;9)j|#_n#-*4=`1}uj@jFRD4ph=1px?g$&I` zf-pka+2kF)sS5pE7c$h95X$d1_xC+KxKNn+FI6E!U5Tix$5-zzGL`sk*M$sqC5DQw zUQ^{&Awwz&RHfK4#r~JLUTf~ZVQQ!RWv5#Re9H;xu*82LWa~MQ2u<$%$rKo z-yIh+G#g2w{5q5;SW|UWAwyTnqfq|cO}TNCM>`e0Qjnn$J_hBluTkY&-rN|@*L&K9 z42>`ujj(yQ;uTE&s|pz!VR9({b6+c4f0xUt=m?Ra5vG7j;U+$=!jp}LoDS~-nhtPt zhzyM|C5=%2%Z8?Qs6vKDmSCePS%1)pH2IDn8Pds-3XDP z5k5{MES&2~d{d)TAwykhprUKu)D>08ka_}2-qFi$)9Uk#ub8Sg$c+#gQfZ;&J23Kk zGwb|jrgo`9hUPFGlt0V;I=u0dQ_(p@hPu*2Md$Ejn8Q4S-3XDPIm`g%uN0X>Q^Qpu zLtRfoMd#4ecdC#f^%PWe4o#I9;zo!Jsi&c$b7*RgDr9I5GeSk@(5dJgB12u7p!}0V z-Qp*=?g?{vTf2~cWgDujGQXA z?~19ts*oX-4N7)VxiTNV8tdzA?}W$Vn`)>E8B#f*(!_e?wWnID z<)#*>LWWe%FhWtX&zriW3K^RDXQ2Gd%U>`sRcg39E@Y@H7nJOWaxM2>P^N*YNve>c zuH4jhBLC7HrY@*LhPv`V#U6{$m9t^ZpH00u!i^9aQhA}|`jYc?83Ul7Wl<$vBT7iVg;DrBhZIjHFMWonNqWJnc)ie6u)5|45tM21vhsOa@& z>Sa~Pka`{}dVQIipb8mMMWFom9U2eloyXK+RmhMk8b&DRO0F+cDM!2GLWX9(7?huR zxxP#_Q-ut56^DvmU#3>5LWa6ZP?ua^rtYgkhPqyWie6u)s*iEUg$$_|p`zE9srOVN zL#iZH^!hS&OBFJ7rIdp5*VpY=SFLm^dZi#k>LsY?^>yNb>kAngVQCtn{MTeQg(tnr zW8G{ZLo;6n%Ae&iYntyiHC7ce)KwNro_popP5RSaQ=9rq6*AOSj=ENt8gSTDig9j) z$WT{#>iTF_{Mn}JsX~UjDo|IalGn$WnyCsI>Z%AOt5=Sz$*DYVnmVfr8S1J;UA4P3 zuVyOqcz0aLP*-K@YTck{e^aegAwykNsOzx|XVaMaP!%$?qN+lZ%PDT~Vf*s6vLiUZE~oQKsgoLWa8PP?xMI zQ>RrSLtS;LOIDPrv=iNNAww&w9#nKiITc+|$j}I1g~}egw&dyS-0kM?)d?%=RqaBC zM)(?yFmBY*%%*0jLWa8PL&-ibUGjY*Q{SjUhExM6|LNSgZigzGdTNq8USvo$gvt`@ zkypw=8{RP0MinxoUWfA6m)w_4eWVH*nvF(Ke#e&2H%#4Eg$$jq#zDylZ_U|t!l~%_ zLWV}z1S)#IDuwe^bF!NaWN3s;#oLHWU7Q)ePtBymlc&BkW8gl=Ee( z#B_ID$WT`osOb4JHC`1mq`E>y&zGs6R3SsE8&vdsnR;o48zC~Jx7jIaU=iG#dk; z{MsmaYUUbKKdM58x(0?3%6qVyeG1JoRcwwMAu^-}LCGCYUYG73*lB8#Dr86vhVo}Q z(e6VNcZcJ;qzV~2t|4?>@)yZWjhyR7hzxZNg^HeKQ(5103K>$vp!_GdMcWLxYig$| zWJnE%lC>eP4R_8BFxBRL*M$tJ5#hK*4ct>B!^dIGC!FULGBg__gOb_5x@E`&Q}3%n zhPp;U`QIm!zY|z6?7c-^3UQyWwvLtSH_qBC!**axl)8B$}R{LHVK zk*k5JO{$O~H4e)Cn{jc6N_GFjRQUz&|BejphvT9AC++uo6s+h}bU#Ffx+Xx$^(8O) zd*-_m_$zylb|FJ^_)buAzItrQTh`Pw3*88jp{|Kg{_Y^Z^;{`jDWg;&LtT@oD}A5S zADcR@3K{B}4CU8G*6#V5Rt$f^JI^9FLS(4xUFym)cHJOTBUK?oT~na^+K|6kYwAZ; z$dH-}CFe`_sP>ue{9&r}VmCr$NKJ$CdzAd1uc?KqkRdf4D!TU$3^N~ZiR(g!W@83a zbni7)K@~F8H4{qKkl%YvjZ}pUsabSfviF)gpb8mMv!SAU@4;|fDVDn9LWYiO4jq^5 zy{1N}LWa8LLiw{S??z4CRfPZ&SaNX-k!6`OqQ zy{p6C+iIEXLWX8zeo%hzHFZK2GSu|}ROVQZJok=Rzwz@DVehT@k?TT+x)xAZiTfY+ zH8n>SGSsyYDmwF~Zm2?r)FLSVdjYB6TDitlmE~@P$dFnLRJKi&$8^Iran-G45^h+(OuNkZ>o?X^)Xa* z7d7?b$L_e0A@vDVbQc{EW`2Y!WN0>4K}B~_Q+re)LtU$(qPwW6M4z}3B138o9hdB) zrmCt!hSaA}(OvXFIIi)kkfGyROUEUyce_X3E+>6%D)SVpYgc*JkRHUDVWVRmf1+7O3dVo2v4u8zC~JwnF(`w0n~Q&zYL5 z3K>${p#03sE^6v8RmhOq9*!$E8Q4X?2)k&twQhvS&}{4o%I~74rl~@Px^_ZEchRb0 z&7V_+40Y|IF4;v*J-N<}5E<(F94fktRt~%9YpRf;t}m!dc2QGvRUt!NyP^D9mR;1; zkE)O%wFfG?i<-*4-W?Y*r1nBZcTrP)R3SrZAC%v1njEgaw0rpPr)*b+49&)VD8Gvq zzw*MPrqXP1BSeO}zJ&6#A-j#K_NtH}bs%)fRoSintxcwOsX~U-S5W@_SAi3U*P6=w znHwQ8q`roV-cyE#b@-MlWN0=Hh7ro_%cmlycB?{$x(-1_?b zReiJTLWa}{D8IAGJ;l^nRmhM!8IDVKHo2#)3-^?^TU-}1G#jUalG&F}MNC~$g$#9l z1Lb!%`L7$74)>IRVOFP}jFX$#Kc22m8a0U4EPELWa7|1SQ8M zpB|W+tqK|HI!nhTpB}s%R@4nu$WYgJ)FnH%sp8w+2$7+#@1deQc8#!O4^o8;b)BOw z*|AL>QH2b3{Q%`xuk6^SvhHvrM26IlP|+RRRBu(tkopPAU(538fvLl)kRkOml)si` z$L$rLPdA%!C@U%E@Vjk9*#?PHrcU14Lf$iy-p!Rv++kzGW)V)o0_Bw8S45I zD!OBr3Oja&eXa``>bgl?vSXVXs|p$Fx)qchm+aVk!;XDd6*AQIS5R_XvSXX7yWfov z8S1)C$0a*sozu~LtP1={8^Sek*N^}T^BN>5<*4yC{tMvIfV?VL{QN^ z%G7RE$dF1575jph>``mN9@XNo>q3TRBS}zxk1};v6*AQIFjRDpDjD{uiAP))GSu}5 zb;%xOD(O+DkfE-mLCJy198V=>`|u59(N-|hPqNh`PD0Xl&LwYkRg={ zD!NCRx}ypiQmLW*wJdv-sYWN<2$3Q6I8=0x8WLvyGgZjYY@~sTeZjRXdz7hUCtVjZ z)b#{Z^f}5@OI65_N(<$WOZF&Jn^hr0DjigGk2)2OEA=TiLS*Q;(nH0*ggwgC$EuK_ zt_)EAEXy8cs>(O63mH;RLPhr|Q|DD7L+UB0=pJQi^l8_H45_D~Vqfr*J!);(qjG%f z6f!g$8H4hBl&LMMkfE+jP|-c=rLafUIpeyJp{~r-C3}>qgQ}3Bt}H>xfyo}VFYHlO z&$=#Ts4HtwevdM>OcgTJm5q)|_Nba+MJ4&pbsUsvsuU^@sOf^-745?gD(LKu4W>v_L$_?eOW!a-lWjyCb zhzzMbP|-cAf0+5VRUt#OkryiVCG1hAzEXt@b>)MK?opkklt0U|N16Ir6*8orgNp7^rh5P6 zx{x7N2r9ZqnM(e%Q^=4i3>Eu=m+VoWggt73Dr9Ijo)60JQKky~;<}Kbt|CzW`jVen zDjfEx&8m>0uAKeJ@2;Ca`D40RQQiq5>LMXHb?RUFFCy!_0PsV6VEE@ViRfO7v| z_cKeTW~xGlerD+fDE|qJ{LGS5(VtmDhPqyaihaRL_TJCK-kbcQ8v`;lhb4pZd#|bX zs*s_sQc(V$B71L@aHV{q3K{BpiMnL(HI?F5H$r5nt2C5f8}c(tmBQZJNEI^FRff7` z?=`hr6*AOS7Rs*;*?UbTy5vTP45@NZ(Y@DHQ&q^2Di7uNDA{{WZBc~`sR~fhneP>@ zl*cc-5h6pgQ4uQk1$&hIH!@6hR)q|8Rf6)ryCnaO3{!hmAwyl2sZ0JF8K$!S=0=DN zbyb0qdy346{5LX84N!#)bycM<`EO*H`bHHpbbVEWlFvltCI5{Kr=r&vGBm>KQ2y>P zyk5U!=fZwi_=-C&WN3snXoSCiId`0?;i{0Ku9{GO9m?Io)NxhFka`(P_IdftLH-*V zrk=U#Mu-flT0zNdEU$X8hpEA;kfAxO4JAGD+S-5hz;@UHqH~B0b-e-=UA;ZRzHv;u zkfAxO0~PxcR81E}cCcMmgPO}mhx5jLa|%D!Q0j4EWP>vgE; z%$wS)3K{BZL|roTrV`(9vw;kCHHM1Lys65nkfE+7)Fm@-YLqHuXy%(jMQ7fr=*%NS zBWwm0o%vp2=J#qBGBmmEaF|T*%POw}y(&yz7e2JTf%GHla)Qs9%z;`Lj;ws-RuS z&hyy+A&)YTr! z&wRs)A0ISzUKKLb)q%P`sP=soQ}5hzUC7YPcZBl$e4=h=;yD$ad1PpWokEw)ygZ9; z56_~-{&HQ&&U7Gb#kLR9I0>=e}m@`rob# z8S3guU1g?yaKqI3`%WQ4UA>_EidubW&?-}B{&5N!>gr8hpI7^1ps6GOI)w~%^?{P- zD4E0CxhA}8YVUteAwyknQCGaR-`_R06~A*C7l#aW^`+ywvTb{0grDkn>ye?Ze$@41 ztG3&$YnkpK$WYhYP=246zbeo*JekkacPz+ISAXhS@Xwy7OJPvrk995U23FesV%NxMJmVCtR3@)=9)d%BXLu0c?K9gb_hCyS{|Nt{B4x&~9% zoS)+UGgavkr;wqpA=LHIzNuMFEllbZGSoGcx;kCGdEQjqV@@GMUBjUKn(vdOekD^) zk~xJ8bq%MkuNLQPXKGV&r;wqp5!BVc!1bf1(x!9@8R{BIT@(B6{LNI)R8Ap7U8A7< zIvmzA*_Kq{u6HE0Q^-))XzIGTuEHo&(;s&V8R{BCUGh1=*wFQQ8mEwc@s znkSq>hPuWDCF^wUqAo+GhOR@ZkfE;eLCKo0Rl3phrs}43UC2<^1Sr4ek00E&&eTa& z$WYfi)OEOU>7k|?rE^`#P}f8#zYZ6kcyxlPA5x?hhll{b@9 z$WYfzsLU~eyIzyW2AX;?i&Mx@*DUH9Jz{)cQ#G?Wg$#AghVoA-?`+(c(Nwb>P9Z~G zbExa=s;U2)>h_FN$WYf@D8G7Jbvd)c)Ue!6Awym7QP;tyyS_0sEw59^P}lp^HF@Lg zlBSkE>l8B7HIKSxF2B*h)W!l%AwymBq5PVcyLtDp<_|pQ6f)HH0d>jU+|+==P9Z~G z3xbL*58Ta%g}ZtFB2FPgT?>QqcXLyJ6m<$2>RJTlcQ(13n_5@gDP*W?F?Gq^+*H38 zoI-}WmQa`6%}tdq=@c^5wUoN#Zf+{UOHLs}T^~aEbtrdpQ~OIhg$#8qqb|9dn|i0L zQ^-))N7N;Eb5nK8JB18&EvGKIo102k(J5r8YXy{FhjKT6JnVRL%%ayK`1 zva(aiP}j%QC42Aq&~>niQ^-))C)5=ednaY8Lp7(6p{`Xy$(on<=5<3?;u=mNLtU$b zk~J^y%}p&-g$#AAf%0o!-kY0xsix~fhPpnbE_rWm>WnI6sB0~hUx)JE+|*kyyDns? zYaMmTdvjB1YB_}r-OblS`MbHiH+L#}H%Ep>xFK}O%**@b0^zQ=M!S%q5q=hw%)Fds zQ*&y&5h6of8=?H2NZv1-8up4)$WYfN>XP@%raIMe3K{C!3>D6D?ESK-`gNT`hPt*; z*WUFnylSd!J*SYNuB}l1EX(_4Q+Z!?3K{C!MqRV>Z7*yp&1+5}LtWdUqVJbY{ig~U z>e@kFhn~4O-PEP}t_vCJ+DXSH@0U#-Yv2?z)U}Jc5}dks!_?M>P9Z~GpF{bbP42MW z!X0+$>rNpGpCTDu6@)ccUV)YnmdIIb?v7vxx<=j*}^GgsOwAWk~^%awJn`OhPnf(=uCJ*}?y#nowsi^_>N-eWa)&i_r=3&CP}dyTysXJL`xX`sn6*AOyl)B{ovZ-DjT^BOc zbu1`Z^YVUqTIkBw$th&0>v&MI=H>mesX3~Up{^59e$C7KWmBm-yDns?>m+r_`(;z( zR3SrMr=a{gl=sV~5_EB0$WYfe)FtniO$|_m4BcT*L-{+bykB-IdWS`ZM))n1Us3XY zIaAo#{?aaFXoP2Igz|pbRFAIixR9Z)vryS%=Ssdi(sRvUm22tenz8R}t3rmlzN4<1 zMaFG0HLjcMLWa7&hl+kz+EmW&P9a0;9F#l*$Y;9~o-eh>)EBCdA@xJ(ilMm6yUQ#! z)vkx@LWb0jP_hnXHWokeWBItS<`eaF3K^P>pP*u2@ZLQ0xmhVp)mMcKb^Qz_|E8=D z`Ds=X9oL1R)V1rUuA@!$=j&_d6Bc0g$1t zt5E)`Jn_Mp#5KYk_It~X5E+`oYf!N-Scg|eUYuhpXY8-*@?KM=2DvU|sOxV!t_dUGpK0o#DrBhZK6TB1x^o^=%?7(JWT@*ODF41P z(a6IOo4TP28S46%x?aqaB$ufnLtGa!)b$^ff8N-i@!uAvQVn$q8S09QZBOyz#VBTe zaQ|oOn_8#}8S07$<=4iIWK%YqdVZMeLWa5?qOLtzM-DT!TNN_Y6(35DOJ4F{P-+UC2<^BM)@d4qa1J zAwykBALuf5O%*cK^(d6T6Up;oz3_ZkWwaY1GSu}Lb;q3T9N~q}bVZ1Q&*~U4A49!L=D1R->^P#EE zs*s_s)KKzo`sYJapQ%EI)ZOPXy(k z54Q(3UllUcl@==cd^jDAwykHL;0&xo)2FRb69Mm8zC|@ zhZ&*#I+W)_Q(IIaLtUAmqH}1f%p})^45`de(dR=`dsQJrDoaqZ4(0jKRK3Zr3mKZj ztWf^$AkT+RMduJ1>dFS??+)@V`-yP>I-_04&>Uum@^dK9ho&05>qdwSb>#?3j!T{o zM}_CZQI|X)ntEfZ>q3UQazkZ~ z9g}}PG<9ATGSroay5#xLRQqYJ3mNLlOUEV8ho-KpLWa8XQI|X)n(8^-bsq3UQ3P44l4^73N=@c^5Rgk*m`Ows8Rmf1+b5MS5$n&A8 z$7Z=MWT>kUb;nrVS*M$sqJx^Wod}wOADr9H}C<5ho z0C_%iD!Kz8LnAB-<#zyiK5P^2=8w;DBSeNqSd2y}&xfXVs6vLiia*emGIVvA`#-+! zG+f8(Z3Fn0Aqg4EOo|E_6H$^OQ8I+gDimc1nN!LvGYwRt3>iWwlsO_p{4<3NA%x6x zrrv#>*IMgZ=dq9D-5-45{Oxny*R$^Xe)hBXerOjm)K!+c}Bdjr;s64At>3sdG4t-&(s*FkReqOD&A4u!Zg-9g$zxj z5|qEE)Gs}uys2AGAwyl2q5QdAW6XgrrXHE7(?Ev0o~EuRW;V%T>UF1(p{^=W{u;G- z@A^TeCOCx*bv;8}TQc@YV`{ro$k4f570RE>o$nfVUR8W9BSR~!1{Lqa_F?jAzSLkaRJ;#Ojduze>Z(m$vJXw|a0(gfdI2il zho;g`(&Ivgy6RAu>_bykokE88VO^+rAF7J?Au_bWdQkB`><}jZzUxAUR`?>VQ1+pz zADlvly6Qv4`_R-Gr;s7l04m;xrV38h86rcfVNiY_ntH=2WJooFiuYlUFpbGhAw$z> z3>EJ~Q+u33hPs+S#rx1yrYU+{$WT{P>XLnEs=8CiP**dkcpsYT?-VlB^%8Z-J~Xw= zDP(9Lz6=%bLsjuUM21%Q3RJugJB7(#c3sHO3Y*gkd!#ye!c?)TIzwcrs|8fN4^6dp z3K>!@q2hgLYLZjPka{&J*@thoIh5bjUrr%I>NTi%ANCB>$n&)x7cw-BR#5RiG}XW< zWT>k(RJ;#OjdThb>Uy2JWFMMZ?-VlB^#)YD4^1VXrpJX0b+w@`*@vc{bP5^Thi#$a zeW)tlhse+h+d=us%U9W5!{ocWE@Wth?P-PSm!wZ_>Kmt!p{_TnOMW8gozS)4DP*Xt z19fE`_f#8GnWpOuk)f`RP?fW<=^tBN0GWT>laIIhG+ zCUkAxzroK5ej4w)E@WsL-GY)=50+d^p4HT8r;wo)c8BsmQ_;2QpH)=FD@2A?*aOPH z>ez4G(alH03Y*N-wIV|+>`5zZy6};HrV4+f3K{Bp8%qAwKVGJ8IE4(UUQjX#`AGf0 zd#0KC-z@DyhNkfjlz*>}5oPv$qAH#SGSu~MI4A(X#v$SU_@Z^Q~2IT z-Wm3M8`p&l&2TD|pP^i_P5tK-GSu}oRN^1uif!t{C3;-QkeUV+U$IRUTB-^eQq!U0 zE4Ha$oI-}w3@HD2$ramF(`DL)45^t=`mcJ$Hg(Aj zbX?!laZTF!NN-bBSE)jVR=9vxD95ELJ}zWPEhHt!buGzpAwz0W67_Eqg$zyOhj3i7 zFXS0)=5X!3eYGAJGBk}JgOYpY*(sSCo2udzGPJ_QQ1YsXd<+=yPcK#RG?1YcE`jnt zQ*q+GYv=)U^yMzB`yY@{1~DNG*qo-zU&i_6@3# zA+;hXna1~b)GKSM?ystlA+-|9-&3xyZ~LREL7P<}L(}*P%3p2dH%&~f`%M)x^mwfb zN>-R5(;vlE#g7*FPuV#y4FA?{t@m( zrb=wrE@Vipg^KS)rq(%y45?qB;yaP4*LG+ZGNjf)#dji8*PKFz)OslWoCyib)0h9z z)Q7+8-y=h6Ls+3aUUDZgRcNOwWN7jmq5R&EJCUjXIfV@EjbCYn54`hK4^{ErK!(&N zsQ6CwXOcS+GIU&Z9bl#YM`q4OhJaa zjzan80P$9fR`UHIw%WHZ{{JWT@*nb;&zV zn!4%~GSqbf%752P-YeMDGY9mzkfE-Bs7u~?($q&zAw!ct3FRj*?-i^no;)(N!c$QG zxy{X&cdkhlcJCqAg$%9mG_CN`)ZfpWy5o=@7c$g!2FmYVd9Pqo#r{%-45_nF@$NO% z@USXmNS%Yye@#f3)1}(|rUo6+zek4Dc__aR<+-S-xkptYL({kb<@e#W{LB9~b@Xpl z$k5|;F(|qA=BU`|n5y{kLWWj&iPYvoduvwMusO7ijj#L$|5E)wG)zBr!B|qVRE39zU30)yFw8DRbk`*?*Fzi!P3IC`EOVM5}64xK!i zf0Qc@nAlcTJVRutD;boZ;jj_ypH2}T<=Gdt3mKZ>ZBYJ9N%6#_<)$)RR)q|8C5MV< zXzHyis*oX-0xG_4nA&+&6*8n!1|>5b`dF>LrYc=ig$$`wQ1Nxc)U@lWkfCYZ4&|pI zU&ETpep3}P^mwI)@{jUAeU4>Q6+d3c&iXX4k;qe-BOS_Pv6{evT%Hw6~=6|Y? zp{_fj;>XKWhh*}IBqSh1DlJs}c$qqUn<`{Tr3*?vt2|z&UQVG38B*z?;>XL>_LQoS zp=sO&6+d34>ff#k8G5`jK*f)js`&9jhE|x7Rw&PinuljZJ5y^HGPJ@>v_g4CWGdes zs*s_s%uw+&B2#ZVg$#AwOQ5l6*8o9LHT`Hq|EG7rut=4g$&IwHhjGNtBPlc40Yv! z^5>WA-YQ}D_PSfUkf9mg3+2x*`5gpPTb)9Ny7E$&yerP=&{g0b?LvmS?xU`?!yi9q zYOYhrP}luX{&k!6xwH2im|U-d2?>v7(Jo}DD<5^`z0|(5sehe9hPv|8ammlKXP3YGgUR4DrBhZL8!cmS5SGRZ$6)6)b$W`Ww|_WiK&Iz zwF?>QDgYJlc~j$Zs6vKRK`8lGd3~eJy;skhdN-#kWJnc)lGiHbWBa%thM0OimnvjP zJq+b{uY46?szz>A$j~$jL;2k+cXLxuAm^H{rsg|^3{Cz~D1T*>S1MG+lShVDSPIJD z9g1u%bZL9IJCwX%SBMO)ur#gko9vJNYwF+ws*s_s$Draf#ngy`s*oX71}eTgm?~dH z6*8pCLiv5TC&P)COkFIl3K^Q=<4}Hva(7S_&kz~vdIHLyUvhV-8g}oLN3{zXnqfI8 ze}2i`!PF(EkfE+8sY~t-ABL_frL+qf>MBoNa(6KGlT*l0*HcjO-CA2+XkUQKRK7UNRkfE+h)FpQZQ@P5hLWa63LlsWEX2>I5wqEV6 zH^U6aJB18&JxyJeTJNrD>bg_NP*)YGc+Z<^R907r45??Jawe`Wgb}Rd3mHl89Hjc1|!?!BC8{`02xIE4&# zJqHy}!&J#9bcM)}st$Eu;xWndg^GXlJZNf!Q^=5d9?DOnQK3~2n>ynZGIRx~0VP*# z`N-9L#i%R z;vYD_u0EV~oT7c!(?gp$Wg&gE{CDl{~erh+PDX!7-; z{N#JS-r)&Tlbk|^x*CKPO4oypYW!uYY(?!thEzi++4C~Pft!02GPTVqWJooF^7oV@ zmj_=k)wz;(Aw#>jF_iT9kNdF?@8ExtExhVrtvbA-%&qK z{;8{~cpAu1*DFwR*OO_~zfo!PU11vAt7#W9G>zs^ei~(OOz&wb@3X3qp{^EC@%7MD zTc?mA)e_48#De^+qp2UALWb0ukJej0LRGqu+#WT>k(RD5MK)wH^<5E)XhL-{M)jaQadG4-cY$dGyiD!#Irdi{Cr zLWWcusKh_QmCe*~r;s7l7Rv8Kxw4shvxasdL#iEAd}T9r&M9PQ^6jDg!zq2eo>sYJ3+-)wp>ZB zY{*d8TTuSW_QRzg?l=(6<=7pVBkW@=hpRmhO) z3gxeCqqhBd#8jpiRUt#u=mzC?)VZk}QmcxuY{-!64&`SkKehNNp7+KI8CqcvDF5>S z?{xXG&BgF+`Q7@uLS$%$J)!&z@A_tZH&aWTLWa8DhKjF;rmi}L45?mF{wu^jL)$)U zs!Ri2Au^=i30-nMyl^Dl*QRI{*g751eS zuFJJ@w5h>PAwymLp!_Q^b5>W$XzF*TkfE;r)b-!0H>#L=u#v718R{B9UC&PHdD>Jr zr;wqpfz-9Hdh*hy);fg@bq#{@ul8gvQ2vIgERA)A$WYf{>e@K!`fa9KIfV>$eL!9L zFOMx?YN1oeP}dOZ8u`kDn@pu@qANs(cGOTPxiiSeQ(fwmR~7FlWN3xMp!}I4d%jcH zQT1IHGPJ_sv_kogkEsz(Awyjwp!|-KpMf#8#wlc|Yb15acYI9Uatayh8U^JaW%(Hx zQ;#*(86rbnqp3^2<729$Q^?Td$3XeX%XfTK#gj*dR`?;5pS+yQFNev`a9zmI3O}M1 z%DHUnyi>?f*T+zP@^UVldc2uV0~zZ2gu3KhHr3xLWTl5^Qq zwwH8;$WYg(Q2tStbJtI!yjY*M$tN@M~IOLZOQ-OP@GRAvFU^Ucr)&dyn0`)6{&YkRde_O7@0KL;jb6(&4qrvrZvH)A$C; zKabi{@l;b&C0gilAwylWplBMQtCLg6keUre(+KK&r;s5v2g*;QJXm($b$r;wp(EC^jP{R#Cd z-DxUSEA2vtx)wsk`>;%Slm|M640SD{u7=ZIeaX~Dr;wqpAE5l?<*YPyS8H7%GNgWl zl7IDQrK$Q(Awz00l;4Nt^EWPIYO+(vkXizjH?d0|iw_+?O8@cZbeSAwylOsY|{aXljE~ z$WYhMNxI5~uDoq^g~(9X8tSTe?b#1awQvd<>ROwmYj-ODvm%q7LWa72p{`dOrygnQ zxKqeb*E%TK8}c!}(u^*DhpwXS^th0ruJzP4DBtH(O}*n3GSsyJ%D+4A^@rZsY-+tz z$WYft>Z-YY;M1nEwbvCQLtVdy^@TqokE7XHis@h z!{cFwDc{r;B12vOqb~VBB~8_J3K{D94a(1Oee*oIOnvDTGSsz&y853!w8qpKr;wqp zt>L(2hVp+(nkwHxj|&;<+D2V_+8sD*YPeI#P}la*B{Q7Xr`D-*;hwVBDP*W?2X&R} z*RiXqd>wU#$WYhsQ2xp$*NqC{TzpK6Mse9kj6(U1j zd!hV2CCv{P8=C6n6f)GckGhVHZ=BlHPN$HeuKl4)X82u|!o8-28J6ssOvyb(sf6hJG*@ox^i{VE@Y_dU{G?V4EwvrOjBc=LWa5yLHWn)T9Hw& zn!3HKb|FJue^FQN1&{n@s<%_fP}gB7|9HKUE=Oilmz+X|x{gp+(*gIbHPx=0t`HgO zItu0Y{E8f_izI}fX8Fr0WT@+J>N;9@MHN$zch@dtsOwlz@_5Pbr<4!ZjZsb^LtV#% zlE-UMvq8yB9dim9>N*jW?|M9RJ=H^3hzxc86O?p4Tx;4cQ=dD940WA^lE+J)Rc>ni zSdIHb*JY=Wp{`TZ)n;Oj0;X#A)Dye@@>PKm^$PXGNf(=7XTq`t{j;iy zr-2N0C5OtJI6!|cKNQa8s)O~jAw$zh0p+J5=d!84okE7XQbNV&vZ;X|Xcsc1Qb8q- zKb*^^3Jg(&45{0p{63U(+0<`NAww#4SfM|cO?4cqUC5BS11dh3P2D|A6*8pKK*i^> zsfA7U-WmBz(YZo%ql@=;KmrZ3Ip$ZvN>7e`!O$k6V+3o1UB3ne+1k)f^(Q1Q9^S2&kTkJ2t=XoeY~{0!w>HudvpRmf0RCaCya zHub`Xs*oX-87e-PO&$D56*4r9yP@=76L2o8iqBL ztk9p!rY<^#45^$@@wsej=4aZ445?gD@wsg3rO#C%LzB-9IhT>4uKS_lbNNs> zm&;7lE@Wti`Jns^<@ceS%ciDG*Dhp86%H%(=d!8#GgKi%st8nkE}Kd_Qx!6#ibBQbvZ<9$ zAw!cd2IVI&=d!7O-)I*y)KwfRK9@~ZnWYLDQYE1L4CP!lm1edoWJo;{ls}hE?QjYi z+Px*A;&ZuZl5-gu>UtC^K9>)NbNRD5xk&RD3R*IxV!p%c|mY85!y-3zgs9m)C!sqHu=r>OrXm`q_}7X*>?) zr%|d#xAUe(IE4&#Jpm|Xik z@Z8?UrY1Rs49&1Slw3FD$$cW6W_APudvY%+Jy{tRfdwQ zjdT@i-M*Ts%}yahT~AZjrTR0vn5z7vb|FJuRYI3M%JTCYv%)LwKRAU9bv;8}v)Yw= z*VOHcwF?>QstOgKm8M>F3K>$>p#1AmIjf8tV(M$BkRkOfl>ZKR`{7I4oD28LD^4Lp z$MqZ?SHt0>o-|c;i5?d+)KwiSKEF(T;uJEZo`>?kC6Q+Cnc1d}IfV?V8c==@6|MT! zy{0NG)fFN`swR}bf5~f=%fq8Q#wlcI8nvMOnIb>mYif^E$WT{pC_fE(tzyc9@+D+)GF|8|8Q2OS*|NY zhNe*u%1@)(qqXifHP|U+sOv?j_<5A6lq<9g8B+D3{P!JN_L|w#)BvZDA=LoNKL^hE(IQLQ(Sm zqNavAg$zx;36!7ws58%}HkEyqb|FLel%`Pevy?%2l;e8}GPJ^Gv_kpLW3g~w{@QgR zLo0lVR+!K`*A!EyoI-}WUJgp8A^*$3FJT{+T&>5240XK{l$RZ#G)$#is|p#KMk}az8mi)HAVVu`4JGH7e8}E-B*^3Que{pagl zs^V!NLn~|-x?~#ic&!O5yz07;p%u0d%0FJF-e0H3g$%9mO{ngog)KVIv?G{!lF40XLlUGjLDO0_{(hzw1mGgSO| zsfwq846U#WR6LE6VH%xX7c#WMuCzj#hN-1aAwyl=pyFw42-8ThQI885>grBiG7VF2 zIfV>OqX$$x4OQ_pkf9a!gz{ImrxX7V>z~33|8!l*&q3TB_->LFni{c5SBMO)uy>Lbs)|>L46X3J zBr9AQR+xLUb|FJ6d_TzwO?~4OGPJ@zNmi&TULi8H!oE=Qa}F~7g%3^}Su=bUQ09NS zLS$%#{b+@&huvyq>K&($p|1W=@$+6&E1W`x)Bq@1iCo>}d9SIIzv&8*AvF-nKkprs zFr=EP7o0+dW;h7SUqu@>pI<{&JVRutYcN!N-6$Nc8)ID;GBm>vp!{<-xo(&`>J&26 zH6%&bJ>lz=N4MxSkfE-j)b;0YS<9K)o zSBMO)a0IPTreSK9Q^-))$Ru4wLf3hxkfE+oNxDo`+@>o;hPp;4>3TGDjdThb>Kc=z z%hYd9AwyjsLiwLQ8gy&P+@|5Wkzu>85E<(Fh`K(1ao}WARd%XEhPpluD)IEfPakCs zJF4d&s*s_sPlA$jOuphU^~@es$k2`&3*~pzmcz-*sfu?LGPJ^Rp-WaM?=3bUtT5AF z?LvlD_-RnM3MBppjj1V4AwylCLHVyMbB-8N&{U~?+Jy{teNJ74Z%^CY)Hy!sLWa7&psp!{7rtcbv{T5?XJQgYP?g(P}fYTc+Z=9_=t8P zLtWocm+W~{i=9G-9_3k3@t#)|Kg!6^3TKBE`aRz`?89e|>I#ve70#g*%APls?Qd1c zP}jFfx}FbRN1Z~3y5>@s?0Hj#j%gP%G>v&s@t#)|PXifR;e1-5?D>Dfo^S8Ekf9ZR zM=O*)Zz{uaT_G~m^*vPlJgRuO!_IdK8R}X${Q%{^l9Czz9cDPoDP*YYN9vLpnyU4Wt`HgOTAZZoc<4Ik6f)GcBuSU4 zk4|bAGSsy+N!O{+Rr-`FWTb%snt;aJCE{i z{HCT|RD}$wpP~GB9y=Xxn99@(msKG{*Nrt$`mc%a-S^D=(yHR?1~SyO7D~Rlk&oTy zzkj`UnBk=>`q_}78U7NK+`qCO&9~Xq?yIVhp{{jM@_lnr=MQAsZ))kks*s_s_0)BC zX~~~WeRWM0GSsyJN}icZ*MM)^Pct>}x+-L-Ya?}4_$T*ErrO?6g$#B53gz#Wx$3|A zuBqBLRUt!No2cu-w^F1qRqB>1WT=lBNzP=zAk0LtR^_Yjc5TKR2~LnJQ$cYb%uB8ranxr3K{C!9#rDiz@D!a_I!^Ns*s_s9YOg$Z>md5Rmf1+?{r+U=S_7;r3xA9 z+DToq=S{V{T@^CawF@fV^QPWNtqK|H+D%=u=S{V`LlrXA^#@eE=S{UtqY4@7+CyEk z=S{tGrz&KqYcCy_?0Hko(yBs+y7p0*?0Hj-)2Tv+y7oiGd)`!o^s11du0N?u_PnWj zcd0^#x(-0ad*0Lw8B`%dT?eU4_PnW@8C4-eU5B9J=WJ=h*D2LAsX~Uj{-Ul^tG*~` zYO+(vP}gB7Kf}wd{%UFJnp4P7*AeRayI9l4rs`(a6(U1jN1^;aOjcmSC{weXLWa8j zrml@&4lZsg<=xta4BcUmLHVy!uDx^bZ>r)uEHbph<4`gUk>4ioS|wxn4YikC7c#WM z6STsoxAbgiYOzzuP}e_D@v{_D_uQk$g$${aQ1Y+xRmY#5cU3Ue*(qd5or3Z|zwy_H zYde|R=@c@gPDAVM{&SSdqANs(rf~+!zXm(Ie&e>LRylsh6BWhPp06`Mbl6nQL>KTI>`u)ODG$U8SzydvwolYP(a&P}jdu{tB?^pI+-sJ(5#bhzxaIqpk~;8XYt>$|+>1>pFEk zx#R1KrcOJB40YY0uEhtQ|JT&>xpald(ADN9l)u{Kcsb>ts^Y5+GPJ^5VTFmOGF}O+ z8=l+DbX~~M3jd=OrXPLn6;nfU>k5&fu7t#)Cr_3)u}4rk(xmOi3)O8zFd@h^X>J&1hl0!X|xH@@eJfd9PnWjF-t6j*DN&%HP5`1ji z|I>q}p1DsIGNe*M`73~&%dNv5_NG(F&@@s(`Dw_zTbL?;zjh%*UAIHY`6VBH=4UB< zUzmJvr;wqp)YLUi(J`ye>MzDP*YYZtAK$V!#Sh z9~RIqWT@*NsQ71YO^q$63K>#ap#0BN6#DF^VWuV&QiTj%d$U66SJR2VN5AQrYpUXF zFEZ4XEgVWIRq+au zp%vx~U4Dfd!wToRE@Wthxq|X5G*zaEt`HeoVeTX=R28of8CqeU(B)USDXegX>q3TB zcyCaCg{G<&)fFN`E6kf@g{tBeB10>@4=TLsIJV2kd%~XI?7EPl72Z!P{Q2L@`%G;s zrYl5-y7EEAd*0N};;N7#l^@FQ`8v;3J8x=#3026@G#-HRJ8H-M&HAf~r-2N0JqYE$ zy4g`}(EVA$^Z6r>XcsaxjfbH8UGLn6@k330SyB};)Kvf~ehy%&@uRAcAyp7c{#CxZ z+25kv!=|#9QiTkuLQwuIljT#J<~Q|+Q^?Q^ABK`WC?B(Xb||STo*^>SRT#?8P`*OE z7QPA?TUu9$49&0zl%L_niE|H|s`HpCWT>ksR6IjdY0IcWhEy>q`B#}?mP&Opm|E`? zGNg(_`Dx^s*8jSxVP&-o8Jb}UD8CQ0zL%_rs(6OTP}d_+@eFT<89w{Cb|FJEED06Q z&{T>iR3SrMk3z*WG_~9*WJr~Qif3r5S2^uMhE!>&c!s9RKdA~Cn&D$m@eEbPGem~E z%0MOlfsZSd1~h*mTzjv(E@WtiWug2GJFj}|h^brUb%n@K*W*zBtI-ry|4wfzp@J%8 zsOt&pdaM0+RZOL*s0tbCDo0(DU!8lusnnHJAwykHQrGb8kDoS`wz4W@sH;3w;vabS zHDS=<8>TWmtqK|HdWyPcHCQpv)ZJB7Awyjip!^J<{$Sf7Q`w$Tg$#97q^>d5k3MHA zS5;NWP*)|W#6NIc6AQf3)KuPTs*s_s%GCAU!k;sn%Kxk?WT@+DD1Th}3V-{6sRGZb zLWa7kP*=@rBeI$*TwN71)b$KhUUyvY-oG%KeDUX1AwykNscTWz8NIFR(Hg3dp|i3Y zl)o>({MpFqs^YT}8Cv19Q1O-Rzi?$MQ&YQ;p%p$yE0nu~slS~lAwx5)2^C-2RK+tyhPrA&`R8m0H-Gff-QhXg zoELP3$j}UHL-{M)mshfUZ0fr@s*s_s7og(jY^D~~RfPB^hNe*$ z%11Lb=8CN(^$2j#7CLKG}gSRUC7WhUWAILVQNEtRmf0ReW-XErZzWF zg$$_%Q1LWO?P#b98Jb2zsCXKx;%Oj5U5%jP*KG!e*KPJT(k^6Z8jYd+G|KH9H{aCo z#;TB^6*hsAvqV0sZckBNRlGuEXoXFo692$g+44J&AB6kzlTEY>8Cqd8Ug6DlTTFfJ z6f)HH5>)(nnM&VOyO1IEGL%1;mrd!|%T!ONkfCY30_CUC=*cbLsEVh740Sb!ieGcM zE9~CGt_vBOMhhtacckhVP6)%~(__8Ww zXd16U`PUq_bjtgns(2d6P**Fccp4eQG_Jp*UC7WhT0_OtFqP0k6*AQII#fIjQz=@i zLWa~EQ1LWO-TA62WM~>~pyFw$il>1Lb+v_xr;#O0Bhzczg$zxj9aKCGQ(0T7LWa89 zL&eiDm9w=fWJtXU6;H#|{jaM+hNjU0DxQX_cpAu1S4XIL8kxd03cjIT$j~%8LB-QB zRkV#NWT@*csCXKt9%-uz8B(30;%S&F+fEfSG>tA$@ibJ$(?Ev0x&p(GPJ@TNmlq>xX!=!rmhefT47IG zVZ}LL)ic$wgDPaG>+K|6^F!Bj9aSMiUA>ZYnR>C4DrBhZ9jL@V@Nr{Lj*shvu9x3Z zg$#AQOI_*LWSVBGQD;@iP*-m#|1%X`A4z}6RGluWkfE;ksHUtka zo|(&?Z|RO27fe;_rV1JA>O);is;zHss&aQ#$WT{bIoDf#W(E_zprb@r73K{D9fV!^KS#zjC=&IOT z6*AN{gu3MWdXaix6*AN{6w2?Y@q><>F;$_jDrBf@7Z)I@?`Njo9I6T# z>KYx6OZLWz?Zv)$F+5&lhp9q_y2fx3E6*AQI z5p}h%J~fxAe4|w%LtP(-S6Uv*~>l8B7H5JNVdy5~>x!lwj zQ?v^i>iU|xE*$Foys1~FszQdkra>kCfjjKtz3T^=%J;P@WT8!pZv37@-wFC3X!1|eiM|Rys3Amt3rmlWwD_@w8fTQIXZA?p>$~8JheeDF5}>f{WkZrz)O2 zGPJ@ULYLq3&xOgS{6V{rp%wlZl;88F_Bw?ObuEU9_q?h3KWY~;)U|}VWY3!#vRD-| z)U^~U@sF_QO|@8}3K{BJMqRS!O+CI;6*4sW${RHK|Li~8?+mlVrTdrNmP}eHzD*8sQA5HaLp$Zx5 zS{;r{_QvQRKPzXd?n+h2P}k4Y^?Q$BCz#6rlPYAWYYmh?mp5O(ey^!ZP9Z~GYpJXF zrytEXwRV+uAwyligf4lcYnRAzrb2iQFm|;nWTut``z)T{%{Hz>e>tyPs3FGb=rjtssBM0Ph6eI-F;FuG_}Ji zWJvu6b!VcGkK#LWG%(e8y>=l(Y73OVf64#KXKJ@o$j~&lLiuUbPkcUa>a`8pg$#9V zgDRZ3I+^^SwRh(l9DcXrtW(HP*LLcvmS;(KQ=f0tE@Y@{2UI+HQ&oOdg$$|Rq5S(u zH$U*$IaBAILWa~%C_nl4Q!dzMYU(EKLWa~XD7ga2oo{clDH-1j)2Opq6*4r9-B5n= zpC^0sRZ};dLWa8jNYeFw=$iUJ?LvmS_9W>tRqHoZ$WYhbBwYhT*Hx#Gp{{+@)gbNF z0;VQ!(Jo}DYk!iiL7}V0R#nJQ*PltcOkH&f8R|L!Rlx1uIh`xC>=U{sZPPAfsOung zJ+XJ#7*o%0SA`699fFE?uc=E;Aw%jfDEXYSqy9Vl%4}0#?a(e{NF5F;5hdJPG2N*V-Pu^69eX5Wlbp|R& z;{4=$MbB^hCWEP!P9a0;EL0X5d*Vm0Zu5?r>b76IkRf#rD)A3|%7JEyXTIm!r)O7*MKWBTfSDQSh8XeFsWT@*Rb&bD$W_42+okE7XEK4x8S1(YC1174^Nk5Ndfsy- zyv~;Ou&xjp>bgN)>#7x~Z|X&-kfE-dQ1SaMn;PR3GNf)n$>il4b)-W3Vy3n_g$$|x zNae0~q>QO-NA$RmA(fCZaW5s4JulPPeY4qPrs_L|45?&L^7W8>$p64@YMfKZkh%@Z zPrgd_pK6)fjM^Ewg=L>WEXwP*)nL_&RUum1BBb$dI}-bm9E!edD;P z{Z1i6DlL@1+DzEG^O~s^$F&O?nqfL9KSOyR=`pxQ#WO^Py3$iugMa5wTotZt2V562 zG{d{XamhX$bVrA^rk+2cD@2C6GC=ve!`Sz>yl!fdQ^-(PM(S!k@ayMH<^M;!kfE+j zQ2zC(8{I2!G&R~OWT-1Mbrl==TuW28oI-}W?uJUd)PL?G1K0q&T1;YC&P z6#yCPDjZfQQck)f`lLHVv-q3bWFkfE+( zK}lEkW<@rcs&z@bkfCW5hw{_tS#93ISxN4&$j}N)K>4$B@{GYN?hjvoEp}bV&sftb^Lz90dtkB=hO^tL48S1JE72nNG?R5$nQq`dR z#0q5Svt$~8=1(NxtG+Jy|M zT2T702?-ltnVikkMyHS=RU69hsOI;Tsyri{%g?6N&xQ<5;{_-`jSqf(x4EfboI-}W z>OjTQF!gjQ?LvlBT`1Wb@!T}`DYHMN~hK?WT>k_P`;~s*oR*^g$#8y3`)A>op?Yi5x>`ZyP23mqc+IO*q`!#n&iPIq%Xg zWJtXM<*(SA=Vx1Q>QkqXA=L&-Kc`-?P36v@e~%2QworaY$rbzaa4vuD6f!i8c2IsA za>X{4J)?FZLtX8m;%S)r#3^J*y$Kaxu}x*kq+Q66>HrmAu}zJ43K>!z!*L~U4P3D| zhH2!=tX;^^G&%+4uh^yrJB18&y%m)2>Jawf1*edquFgUEE4Hb$_vi|dp{_1a{!x}I z_UZ77S^g}lkfE-w)FoGJQ!SiAhPt{z#aC=o6P-eaRCg#@iN9i-`qL?7NcA8kS8P)c zWYyzBhE&gRT>gq}s-;uNka`;`zG9o2>J&1hdO`Wg%N5(y5vP!$$-fg;=&#tON@mmJ zLWa8Dg^I7(rrvi78B)EW{N&||ZR$6tkRkORRD8uY^%$j}V?LiuY{%7=?@GkjRD6vx)jo$F7c!*!hc4Ms6B54* zW9lELkRdeyNIlp9u z@?98H6P!YZx`t7gd>6*loq4ni8R{Ai6@M4TR1c?+p{^0sCEtZHb;K!TsB0v3$#-E) z)wx$!hzxa&qAvL^jHwk)AwxTAG?eUI`H=6zsES{YLWWj22FhRANwU^$97trdYQ^=6|6v|It?kT2DIfV>O{#Ql0)$WYhkQ1Ly* z)L^HOAvGS#PhRdRrgk}n45=@m;(LmzqWN@%$k6Vc0OhZTvV(6Vxu+mQT@#_=d&=c- zPwDNtkf9lV2^HT{OkHyd8S459D!!+f>Y87V3mHF3mYimC1o z=-(qlGn@kDXDIiSPms_aABg$#AgfQs)aroMIx8S0uzU2;z`mAQa+Awyl?K*jeIQ|~*4 z40X+-F1e?eI^`5H)HR#B>KCVwp&j)tRD4fS72i{kp%u=B z@>e#wr=$)$>d`{FLS$%#^Js-~PcikDQ^-))e5m-IV(MF`kRkOQl&r+xQ%s$43K>%0 zlahOisZtN?aUnx$K{zgdPchZmDP%}3go^JerWQDb45>v>e)4ipF?Go)WN7j~gcbUG zimA$l^|+9st{)a0(exOQ7O=imB2?bcM*!?p+GyuZMC^ zNt5JyhzxZtgNpAd3E_8q2D&a}Xokz7;(Lmz+luN6k)f^?Q1Ly*)Voe0LuzH{^7j-| z*PTL!)K5^l61}IGdas!NJu)=IRZxD0a!;9;WQNF4*J|pLd&<6W1-R+Dkf9m=9FEK1 zQ%t>4Tvvz;b*+Jl?!?faDW-Bh zqFu;P*LtYdSQ^-))2I`V~im6LZAwyjosY~uDrdpKL6(U1jzfzanQ%wEODP(9z zZGwvLDXQXo3Np09%~1ZzCij$-VMmpFR9A=$t?+-eLb<1ydfO>vsOvYV_?}{FkyFT! z+5#mj@%I!{SDZqI)K*e*PcijmDLpP^NNo$p6#T+*58(ay>+by7oZD_mr#Q>y#0$3mKZ>Ua0tN-JPa!)a}(GJyb$j}N;(F)~f zu}s~1N)Fw1fqP+T}NO z<~dc!kh%)xr*YTHvfn-#rqSqmRmjjZ{)O_>$dD)Ys7bqYF?SukC^(bwkl*u-Gqv#Q8r9t<_oHj zp=sQL^3&M#*xAOWeyF1g8S45ED&8BW*3?yn45@@n^7~(jf8e_n^B1T6&(w~3s*oWi zAbB$XyY2N?uN!3QpBGgjL+UmtIWGB-pOG#Srg6Q#Dr9IH$%B%+p1ebdsS*uTAwyj$ zg7RG@!uJANIfV>$r3^~C9bgBBe_W;-IE4&# zr4Gt>6${5T%qe83>yDtLE1}-8Urc3cq$@;*y3z#YyM~728tW7?)OBZ2(k1T_X6md{ z$WT{WC|yZHLdNf3e(y}^s@7Ql9vSLNM_silRvl%kPZL$hP*-{=|19O<6`h)x`mw1h zWT@*d>e^fB_YS5mG*g8Pb!C9^&r&9TlcAugA}^~#hPpCR*P@=;GMj4siYjEND-)Fd ztIqIjnBiB=_3x3PuFTXWGc;ARr7C2o>u#uchNiB)stOtEx`(=ChNh;sQiTk4Wr2!k zXsZ6}s*s_stkfklG?k)_DrBfD8(#$ zr)bacn?c_@g$zxjAe5iRszV(Io4Vl?GSpQFDxQX^%02bCkRkOjROQ6gNnfj+uTM8M z+$m&86^4=-%EzWT_kV0^pHs+?Dgvb|Nl1|QSu*v|+xqv&&@_rd`Dw`eESc)<6f)FR z?EmT7?i4cARh+uAci%n7x*qPOD@2C6N>G=)cSMu$ETxZA$WYfK)FoF@Q`4M6hPp~Z z6;7PG?5I`ANBuK2?5JOzLWa5?rLH`;Z7F2x_ILESkfE+pQ1Om3RnaMANR@_?uPfzs zqG_YI9x&D0DP%|`z6D0&b8P<(`Tw>m)Y8;XP9a08OgOH@s)Vks`#0zj-gD-bQ^?RX z$_6FR+2p5ZO|^Mfr-2N0JsyK?jwIE4&#JrR`eGF7Fwb|FJu<%05EpM`GQAn$yV zIovCcI)w~%RirNYpKDB2eqTQuGSpQGN}dDAnIiuO&FOGl6P-eax++uGsbgm| z$WYhQQ2tC=ns3S9rYiK&6(U2b3Y6@5IaAu)d-c4j51m4W)H6^rb@@14uSG6XC!Iou zUT3QcS;erVCfmy-p!RUDc`UkxWDGF*T~6t`HgOdLGKZN_^wn-LILd++P(k)K!DJx;*k& zq^>%J40Y9n^3O&0U)?v$x@Hg1E@Y^y7IjT(d-!)#Ee5JWhPrA8C3{28<&xq2$~s6D zGSu}#P_nBg^j`S7sk%-fLtS-(@?DRHt`SZlLtS-)@?EAjIE4&#)eFjZ4GCQ-2kUVm zLtQThC0*0{=E-QPg;U5-SAD4X8SInc8SHYWkfE*y)FsbgO{M!lSBMOCHH7ll4ZNlo zx|%qJ45>y?@iSQKn&lKSq#8rT&tOd@AEGNnhEx+M`KnE>qVoGG?Zf2jIfV>OqbZcX z0%ZMl=WJ7N4%IGXsH+)NJPlKWhN(h^)JstQ`G)*Pp{dEkRUt#_WhnpqDQ^!fQq|O& z5vq_O^$JuxjjmxD2S=(xhNjURDxQX^>!Va5LtQPP;%S(=dyFb%NVSBDr(vr2hpLbv z^(s_64O4YKQiTku*P#3z_QZlK_4pD5$dGD7>aR;>H;NTuLq6pF914ZKal~~YLo4h^EBtuWM=4C@9;eelhPpZh zC0%mYD;=()^_)V6y50&(_J_REZt9Fv$WT}3pnTV&a0U3_Q(Yl4)YT;@>3X%}jgzJd zf2Il<>gpPl?m#pyoYmdHU>eNJ4 z$WYfi)OGTunQKiI{7Mxv)b%cuf2LQna?h5gUYn!}8S3gyU6Wf~nPTdz$*Pc{v+_MC ze^#dIv?tm0BxfZuw8HnHozTH#H|{mzp!)NM@jYuGIU%+p!{>29n}WipDOH)VQz)U&~Xi=<7&2RX&qCAXXtSu zLtVq5;=N&Nqf^L`8V(ij4O8uBY8Nu3MnK8b<>PX_Yg0|#^NlKGXoe%9{N5NiZDN9| zc=E_l*C?oXZ~Pqg#v<2+49#$KP=0TiDmP14hzzZ83{<=~RK+VqhSZ0oWN*w)vNw>S zVHu8--sO1_igXHz|9>v17NU7tY3d&5+*IjWE$H5ST$ zO_X};$PK2BJB19XaZvtM#|3w%df3#AZ?y{7bHy}O@#K-AuFs(2z41rb z8!hK*7cw-%&x7)N!_-Bmkf9Zhhl=-xs(6LSkotm@+*2kd*&E2vaZP~odn0v@nawhX zz0rT39v3onTodWIisl%)$kgleRUt!NUqZ!u!&LR}R3Ss^E2#LoVXDOUs*oWy3CdqL zCikm1)Ku;Ts*s@>PKNS3s^jbqdsM}fM~1qlK*f7wbJ!cn7it$WG{dPu`MqIkj#J3c z3crSm_lBx?g~*VaMoO+5QA+-Q1-W#R{FVik$NG*i& zk8+FKcC~swJB=+>iPjH-WxxKy>ZxeAwx6#F(|(`Om$eH zD@2A?xELzl8>-?JB138ksY&Z^?=d0C-av+qYbli98{a1HS|wxH8~?f$B16ZujE<|> z`D!IhwOgsjg$#8qhl=-xsr^nNLuv(7yf;kM{Ykr!A+-|9UpH>;&)446W~Y#$8U6(2 zcU0q7S2R-YkM22R#Iw-$4OnvJVGPJ^ zrl9=ZFtx!cWN3w(q2j%vDqbNnr2a>0ce_+AzfQ6@kfG!H4NBLqzZZ}z?2Veg=-(ql z$F+ry>*B_S`AmK96f)GcmAd4&TDFH7W?!dW$WYfd>XLVKF*U#`WTyz~JB18&?V&FDtrk=NIE4)D-n~%r z8k>B`JG!Wf_dGJB_CfhGMfUu-BzqniIk7c$g!6e`~Hrsg<>40ZiYU9#s*<@`;%kfE+))Fpe~ z)L^HOp|0c9C41h~C8v;~-FpHm-t(&BJ&z2jf1u($|3Q*Hj|?5xNhm#P-Sbz%K5Vf? z{~j4Su2Xbevgb{$a|#*iI!#@&=YI@cMYd`eGSqd3x@6Cr`qU|8sOv0Lyys1&*rr{` zP}e!?l09##lT*l0*LkRT&zsus6f)Fxfx2YRo2tHDSBMOCU4)AFys00YLWa67QJ3s_ zQxELWE@Y_dGIhzGH#Np7WT@*3b;+JL^`BG7(C)no74Laf@t#M9)W1;io*$ZI&m%*} zbqz|7TKD|FVIQ{pUH={#IbgN)vgenCuE%z27c$g!le%Qjo0{wt zGSqboD&F&^((lqPWT@*u>XJQgs+Uv9P**}``6<(Q&zm~t6f)G63`(9Y%QGU`^QK{Z$C|!x}`G>-Dn{IA}$k1`!LB}O~-qc>FkfE+L z)FpdJ#Q-8KJ7w=y3$dX?0HiIoI-}W(nH02 z-qd-gkfE--s7v;|sh9Wb3X!3%3{df&H}$Ji$WT{C>XJQgs_dWIg$#9NqAuC%?$k6V+8!F!Os^UG545@pd;yph<$(~1sjw=h4u0;2Ip|I!QcPm7O zjw>r2m+W~{N1Z~3y0TH1?D_p+&sRUFYe0s&vQwArc~gs=LWa6>K*f9B)cuFF3mNLl zNnNt%O^tL48S2Uf74LadH=II-x^h#O?0Hjf{G}^IhPv`V#e3e=?@l2@UH4L#?0Hj_ z4{H}P)RmXIWY3$L>l8B7bsu%fo;Q{Ih;|`EyZ3&mc+abf_dGJB@j|?4G zekfgu?)hwC&ku1cM23#*0Xi<(^QO)^g$#8)NL{k$w}d_a;!#}#GSu}Db;+JL^^;S` zP*(w{c+Zrbbv;a7vgb{8b_yBlDhw6x zc~b|RLWa7EP?zj^Q#Fq33X!3%qSPgO-qd2JkfE+()Fpe~)I%q<3mMwI#i8OouPWa2 z$dD=l74P{^lk9n9=(rw%(v|3*PaF39M{b44&~cTdY7u?P}if>C3}8-*z+&{ zqiaBhx=K-(?0HigokE7XN<+na-c;$6+Jy{tCH^8%;xlvq99#ChsmV?uLtSN{;yrIF z!zt}ThPuj9m+W~{?>dDHbv+Ih?|D-voI-}Wo}ez-^QIb{))gW{UFE1t_PnW|okE7X zo}@0>^QKCi(Jo|Y_m+o>_q?ij&m%)Cd@6LwE1dFEaPz{?i%xJ|$j}Na1SMZd$v?O#LcM2KmszhCb@_jzl)EnpYvmrxWm4oufH8*q}a|#*i zdO9e7T&6xduU*JcSCu5kwK#NDzn}^k>UxH{B;_tw<8ORA8eu4keA6`;*?wHljx?}{p9sOvfE>Qs5ka#MHxs|p$FsveF@ zCck*_eHBbiyrv2n>Uy5K?!KJ%H&exKs6vLiYJ@I7!$x6-D{iVnhPrA}m(0*q&Hq#( zLtV9?;u)ISn;_qjOh`b6x@uEb`|4A3nQC{NDrBhZg>YPchNf;LSA`69)uFD6{ild=#nG2QfJMfCSiuTZdZj2b=9LT+4H6zx|Lsmp{|D1b^qSOsZ70?Q57=O)hKky z4CQw#8iyG+&#Vd=>S|0~lWwlfZK}uJs*s_sCP7J;T<0GRKdV3D9#zOtSJR;U_0Ux2 zEUJ*9u4X~`t_9(^#yW)zb-fgnbjj~ln9843yO5!-m!bUiuwSiXuMH1fbDctlx?Z8K zLESsIFx4-cb|FJu&7tI{?q!9u7biPl>c#A;kfE*?)b&}`hiaKBm_rpZ)YTHo@A?1I z9qeN2rc=mJ*Q?ak{_PB(nA(z4yO5!-*P#3}qHZ@kUN$u~mnvkas}*%kJ5>39rh4X9 zg$#AIrmnVMkTM>?Hx1ddGc$u>=^=H76TZQ8QZu54j7R9qksdI`M;LMOBUA#_4> z3O)3a0HFj3EwoTVC;8`{GpEenyH_jAko@2MJ{)`Zea_68GpF2h%f7PHUqANLgPRyz ztWmb+Im+gIxy!@zH#HP%l&v;L+5Y9JZ8tL%Ym}{aM_F5C&eknLu}0bIaFn&>smYrg zTdYyGIvr(gmAa?7-xP{9%2t=7U<<$6?5XOZ#ujUotpgloZC&T;b(T=9QMS4rW$Wds zEw?bXSfgz9FlAzXIC|e61Wo>zC=dFz`)+k$x9A#~lI$KW)#TsSn zKu6j3^3>REj4jqETL&=}w%3*}4;Kr?8fEJz%GNRa9J7q4z7&cz%GSY5**OLC@(He9 z726sQS)*(nqHG=a#&OGfs#7S|C|f^ul#SsqH!oi$6l;{NLmg#f=&6z084p>bY#rt( zYwIRguLp!;jk0yPqhJg3vZwam-q>P|vUP-`tgR|%>jR-!qih}ND4U0#YT3cqVvVwO zl%uSza+ez~2*ny@>u5*87T%iZsk$AFE!HSo$2iK``n9XqRYI{w**exyw!J)6zmu`W z8fEJ^rox=R&DnZMDAp)jKU20aMtN#-sjlCK!$^rN3dFo7|Sfgy6s%&BJ%Tvn^GqzZxY@NoGUFqRIJx_HC#TsSnbY%;BU!HnF zDAp)jXE0?~dbm%|Q)4TPhpbVy&Q!Lr_vNWugkp`db(XS)y)RE~UTJKxM%g-B*}~qJ zr%n-yH7cWi&Q!SfWvFoPi#5u_bDS-k^FMPL^^MqKjq>nZMctvm z>lco)wr+Q}J{O8L%GP;~f-S70Je3`8Y_Ue!I-eO~InnePiO8dG*QwpgR0ajBzhp(Y(ZncZC#TsSnGDpD{ zem&e%sa*}l8fEKprovXf)YWU&ZiZrwvUP>Bg;w^|pM_$LvUMd>DATsGr>5<0Y_UdB zS1}c~vZtOBiZzP*6;oj=dun#IvBeriUG3^+Bmbm}#&bfkMn&TqN7+{PR71+xVvVwO zt)r~1Uf0UM5sEd+)~_99TiH_&))-r?QMRsQ%FcS&Ge6eV>y=tVu}0bYjk2}c9jh(p zsdSy8SffVK>zT6i^4V?KQwPw+mqio&A zR5&ktYR)L*A#0Sa-zr;}mp%2gP^?k5ZdbN2FMFzHw6Vn+W$O-Q3-hw4ek~MhR7Ty& zR5&jiD$FR>C=c&qD$M!0u77Pf#(2mY<>B4R!~3py^fXUZj5QQ%l&!@PTc^A1oiNT& ztWmapr);5rdFmmdSfirxd#1wvWvDP3tWh5RL3xP&^+)I7=<&uw)+i7Es60gf^3;t& zu}0athpDiCd1|8x#ujUot$UR%^e;~xFBEH(t^1e?`Ae?8_ryg_WSMtS&@@(}&YQyWb) z9-)e|hRtp;)7A{h6t-e|f5Ty77=T%GO_$E%Yx>JuVb$ zl&xo(3j3F*cAH^ru}0Z?PT4~L^3<<{VvVx(yt0M<<*9WWjV;zFTYpuy(7!x&q)@C; z8TA5FVgE8zm{F`z9=^y_*uM^N{p&-q#Tw<|OUgs^FHfyJ%hZcC%GS#fTj#p$-E6j@ zSfgzHP1!>K^3+8_u|`GX6{f=eWvDP3tWh4msysyhddPYB<2{XstWh4mraVOd^3-uc zu}0bYJ5yo*^3*3nu}0Z?UD-na@>FIo;~{I5tv8qo`=)|<)}`j@A6+1uD+ zjk5I?Q(^z|)RjW9M%j8>*+T#F)H?eZTdYyG{-JE4e|hR~p;)7Ay`yZQe|hQyp;)6b z>RqP7{$;2zqgbOne2=NHf3>;(wfDZJUaV0bzOOt)|MFB{+EA=fwmxu_J=d#rwocs7 zP^?k5{^=;3>*3msr&h@riZ#mChmm^CbGD8ZiZ#mCN6Hr7r{}3lnv5;hsK|fJlJt_!hRX zf9R=W+6=`SMU{|q%PkY`EP3kEc0;j7QFvf%Id^pp?+W(Ry&Z;PjiQ!iDvZWL7mZgs z4aFK2jpdlK_rW3>p8BfGP^?k5hA@S1Z8SXfgKk5yMp4T%6-L8Tr9FmXjiSECl-*}T zG(0u6*HEk}*|Djohg{-g1*YuSYd*8%cSoP0pjozL$L?&VH)9klGG*sw^O=3O)|Et| zJZLnv5>xbmARk}svcjKDT=37uVhb8gt(;)%4Y37{rdCOyz7YxVqaG@#McstLBn6NP9%qp8)HqVB@S4`(i*HnFzmi7jY|T8PLGT?paoOxZVu z8rD*02nCI%)?kYMU<(&su*a1=`i_FFH}>6NH*c#~C}^~;4IG8I{e5!76`ndtC}@ZZ#)J)-iXRgmAqu?! z8cqF(DdT@h$^ECdH+oyIi7jZfhd*X2zP z?$=j&56=@@&}a`gXDU91cM1iKriL;_f6(XoG5oVo&=3{Ga0{lkA_6fyYSU2<8lL`9 z@}W@BXj@w{6(7UZ4m9lr4N*Z1w_*zCRyZz7pLevkHBBgJG_^HT@sVFd6e16ernX6- zP7?|mO>LV%{YEHghzer39aCGAABf?856yfE3UmBP>IDr^!F;hjQ}Ho;TPSF>hdVG8 zAC1z3Of;a;)Q(JHEX48m`h~&BKb|NY&}eF>1Y1pF3mRRoQl{dw_a|Zt8cmfkg=h?+ z|7O4Q-Xti@ah6cf5EVqeoGF{VKVEaptDd@EC}^~;Va^sTjD6%UBR%z~P|#>w6-?Py zJ~US{!c%Mi#KaI9ZL2cDR+&)H5Eb;4DyGOl3D%nCu&cO*L?P#)(bRCJ@EwlrzHYnH zdw9Osf<{v#5^UWnwxH3}NTy7!>FJn~GcNJAUJ_f-XliGs>@OrXfBj}Ke|;eoG@9Cl zsZFR($PIJYXdHU5i3T*9+BJc?N+@WE3VP*kOvPvKb41~QMpL^pMSsxe`D5=VLP4WF ztY*soW^~7#wQe^&Y^-sJu?3B$QcSH65gj|cc)_ur8YUDpnyO(6zi5eLpVc;h#8XW| zL8GZ!rfe%ev(;ZW^weoWL8GZUrsBt_Yl%XJLZhjArZ9r~1JT5Bzu1C?sGz+Xn2K+& z=Y@hsQ==ReT_1iT6f{Hyqs?fh>}a#mUBA5^3UjRfQxhd5r*>PTvHropYjkYzG zsV%8+MCAPu8_n{z4iE|&ZEKverB~f23Iz>O!Dus{srb?6aiY*(&}eD`Q+9lM{PBCQ z@gDw5Y(b-`i3zq=JJi^MMpKiR+JyXwjsRssL8Gb3Oxg9uDYM@VVmOW{9MEWL3R8A` z`Nxgr4N#b)ODJeGwFgu79KUA6r;qW}F+xFOO1eNkL8-c&sa(z`^m(+Vw-bf7fJRf( z5~!zzg2q^Xx1jauT+V)E1N$lFu#s5xFk>AWQ_fKO#2(t88C=ex^rek{Nr^3Il#~OF zrW%=wA2;?D3K~t#WD0g{D|uT#5egbj&0@;#Cv5fUVPidin$!y#P0eP?&R=Kj+Cx8a zZ>`=f6f~OJQ`tK8tD~lP>K&n=Au1Tz_F^i2WLx)e6M1MfwKr4SQ#6o^3%}a@EpMw* zC}@ZZMz(#J+Kvc}Hfw%;GX=)hYr0U-Xj}U-6+g1|2?Y&N!Dy3aD!#q`NE9+08cpq& zKz%9{G@8mVg%WXGICK3V@;e-1VhD|#Vjp<=>&JWQXrZ9d)EuU0=q#aRm%~Qm zGNRxGG(-ivmvfo29vaMgc)QqwMpLa!T_jfY|EzMJLwY|SOU!_^hrv6vcqwvSDJFdTsHg}D;PfoqN4+EWh+1r1TboU(wa_&Mb>p`g*!LPtec%j^8i)C(G-f;nXoQ+7_d zy(CA2oE-rwgn~xfI*=(lr|1>z456SQDwtCaVyfN*qojSiOUbOYb%{{WXzC|S*?s;` z#!jj6)bm0?qp5?Lve!ylO4i=PQ_CH1q5+Mj4q?i!st$Ychnst9JE5S_)K8g03~@Ak zFzXUeO%w_mO&!XVJ=dF``6}4C{h3hEXzDPgHZ`V7RvmrtFmLNNp`g*!;Y_V7)Q|@c zo9d~Lgn~v>M=*s|3XUT_Tq!v7-RJ}pLufR0q_Wkv$}WHNwq^+hji!!b3K@mt*}fYd z@YGR4L8GaonZgwo94qy1@mo*bDHJrCI)*9RD|dY^)#|BFg@T5tpjRHtRD7=-dZLL2 zG@3e&Df)vx&);*{O( zXzB!}wh(HSUDo}#xAl-v&}iyJrflSgE`IiJo?7N46AfrIbrMrH@`o?HkCMxd0J{hU zjiyd!3ZprWwzqDf<*%h$g@Q&?r!cjQXjEz}2JR(|2BzX%15 zrcPtZ#&FE+C%*C2YA2g$K%=SCnX==?vsbjQ=BWmupwZMBOxf}9vET1XTOBqUhX@6Y zrp{!lLh3bU@%3p>T_zMXnmUUqGQh_*CtO|Ysh5Rt9C}=cw9#hn`e4KOiqpx`COQE3A)cH)=^~Qc*?RK4~hMsC-2#uyL zU}_t&^`k{+1moepLP4Xc3z-@r)SYLp)$VPbEfh4Gx`?UGgj#0dPSj~^L?0Il8ckiy z6m3xQ(e&CzYkF$M(@edf(bOf1y0iYk8$7j(P|#@VQl_kjLr!>Yyr(*Zf<{xnWNNs0 zxa>FUPxRCkLP4Xc%b2pc@#iVWtm3Jcgn~v>mov4a*qZsn`+{+P<6^v|W3k8j)Ze*%b+H3sxS9{po zdQ2#2G<6eG8w>Twa<#{MYNfMGy`a(5%}likb;$eApYEw@p`g*!Elk-~p11P((>=9F zC}=cwD^oTP7wzyuu+MhAP|#@VHm0nHy_-Kj+uM3eC}=eGTc&LGzIy6JTISeR-t24> z4QMoVJ5%46XqW@M} zqp7=?qLULos;{_*22@+GZ-jzIQ+G3kH8ze%w?E-RPYwUMi3T*9TFjI^cPL-=k+i4g z2?dR&e#ewuRqlM(36FW|mqJ0KsoyhIW*jVe>)j1=o_bLzXf*W)rgj#pZqI9~J+W@s>GsI)Jdoh^JCkX|OrtV>?LTvs0-%Yesw2?nlC}=cwFH?49{)5kNriHVm zZWjs~P2I;-x!C$@+WB>!`lnFPXzG5ZRu$@i=P&K^)OP2ZXh5T>2b8VjSJ)%)aDq_K zXzD?x?0L#=Gn;~W`6!{F(bPkVO1Iy4w)gOEp`g*!pO~`!>(t|a73>~-E)+DHdYGv# zB^uAZeahk9R_QNHG@#McBTQ{0)VzE42t1rC6f~N8lqoy1&HUaA4c^v;LP4Xc$C#q! zI3E*U*eqBrKPMD4ntGfm+rJLF_wQuZX4IPJnR-E^sVA7iD#dF3b)xY^tw`TMqp2qo zsGkT0ji#Pr3MJyu*B!1G524Z2(@Y&o1iUnd-L-y0Y(b-`XA-C%pKs~~ji&z0RD3jY zLP4Xczc6L%rLQ|&PZSPlH1#Y~b`7xT-iw3r@Ef6^(bRKH*|q57w=@Umdc!X;wxH3} z^Gw;Zn~iD8c;{e*%>Q-5XZhoT!=+fDogM*K(Jbo&t@gUQeKQ777|oy^%n53k8j) z-b|pb777|oy_G=yT_|WY^>zZa`K2Zr&}ix(3DllKL8Ga65~y>8f<{yCGDTAz9}iBt zCOCI^h$tM;XzINLTSIIIFa-cO*agn~v>A25aejTP7%{9!YyNhoME_0I(AI-yvj zviHLTYP-u!y;!5Dj}oXWgkp`NK2D%EzueejjiNqb3gZTjv0pqI>~EYy6b@)~H2%eu z-M4vVt>uEVw#7n0LsT#Ve9Bb(2=Jj$&}dtqF|{B0Vb5@UdyT)s)C(F-ea=*TEB`_$ zXf*W&Q?pQMI?lSH_bDjMvC5Su8qjF!%LH2uM4`seXzD9vYokwB9PMqLBetN?)Yl2N zo)TNEQLX$<0=3mu#zSbdt$#CRqw(8aUcAVAco0!IpwZNS5^UWpwxH2e37u6hw~V#5 z%U!#j=xwd^D`N{9O)bOJ2=XJ^m+Oc^j)_Y-A8Wqvje@FK9HiQi836h(f)f(bUQb)MG+Hqp4LAsL9tFThI^{j8Wfb3V!&* z*6Tr{a6m&;aNT@Wrc(4BR$r@*oAN3Y=BWF%p;)7+)f9F67K>l;)FPo+qo~ytwa%DS zkEgB^iZzN_Ls5U7^YUGudR-{isBvRWrtF@>!}X5_E7%RMGxdT-M}94)mXrE_^UZIA zUHu6{L8Ga)6}9dc4{YZ>%nAjKrhcHP6`o&np{EuJ1&yZGQPgLPj|z50P7(?lP5n?& zZ=Sbz%G;xp-Zbi`XdzP82%e$9~w<8zs!6$*2FC=@iB+C)(| zopQ@4Pi=L*i6Jza+Eh`8Htipr>+K^HG@9B>QH?t;zn`~tx=_$)YI8-6UTyJao_bIy zXf!ocQC%xM8sx@*gn~v>TPSMuyn8?MwkmHh(SSx%TPo_5XWrl3Q}cv^MpIiUYEJV( zH+bq|p;)7GV{1iyzWGJL-tu3Bf`)7bXQSIN6~EqC^+wYxq0t_0%hcYKLde6b?ppOM z?_niTIH1wCwo9;ejM#!kQ`;v{?+C>jRj(Zqs986eda*`PJ0?(12nCJyaHj++d$X~{ z8fB|AfqFtHXtb@e1gicPV+$Hhl_yX?7m78?!(j>3^0yjW&}dr~3Dj(%SfgxJCQ#Q3 z1&y{<;I@wtaRa6y|tSC}@ZZW}@AgN|6jBz!kM4gR|^)Za21|(bVpW zO3zy^Sm})y3K~sSE9%OMm45F%JWMEPG?h}+J&S&Egr{y53K~t-C~Cv9)y8@1J)xk{ zRIQ@soW9Fpp4$8l6AfrIRi~&Ux8AtMQ?rF)jf#A|qGo@7*4v&sStw|Qq+)3=687NE1{s#wni)J%x$Ob<*BkeO*Ej<)EGq_^z1WFdTNePtWh40 zRn##LExguK=L-dmwlz*s@9*%d4?XpiP^?k5#w+Sa2i#8=!);Gl=`K?*)+lO%qMm-D zdI0#mAu1R} z8<|Q`t6&tJym-+JD9lm!JCjk+XlkaSw%sFlfTtD-1&yX=DQbf`TfXb5>x6g2zE`fG3NE}@_yTih#$cB57HWeRs#Iwv{J}&68cprT6n2P_8|JXl*ipML4 zx=_$)Y7SGjUI(wRMXjfX{L!=*G@6?0DC?J}HV_ILO|>!=pHZbkL8Gbt6R0slL8Ga8 zOvTr$RVZjQ)#j*Zy^a+M8cnq`W!p(Nu?{qIvk3P|#?qld1T6y&)7dn(A^? zv|e8c1&yW-U@E>|YusaU0~$?rJ1SbQ9fg91C^I|Iy11mIhpEl!Zx{hGZJojOlm?-o z(YAV-ijT&=LP4XcK1W5P(IXTznwrm4d^C;~3K~rwTWOM<{5ttwl`PXy~!`C840v)PYRJkG-D=1&yW-V#-ECkG(73YjOh`P5s1C z(cIWZC}@ZZqH!=&bc-10#z`YSp{1gY;a);Pqir3+l#PZSu}>BX8cqF_srV6lu~5)x z>QJU^H1vr5fl$zB>M%z|qp|gUCWg=u6-483rs^dc4~^^kGZg07Pbg@#ts|JS(a^bZ zu29fu>PV*IbK`NLpwZM(OxbAY-1y%8re4r!>S#wH8b=-eL8(@(YB6d%0}bM)y5s^sT+lYMpMTzg?bG!Zqc9C!#9P3MpHj?6ttZ$ z-{0h^4IePkfJRftE9#aZ8=mZ`SwcahsS^}+^Lck)?Wt3Qf<{v(Dr%FRQnz~QTA`rP z)JcwtX758nK|@r~UMDj(gCc?UdgP;RkMXwFe$Ye%8g1(orfhrZRm#3XL8GZt9c5d| z+qz6BXf$;iQ#O0`Z2qoL&}iy(MClveC$@`@WtP3K~tF#nkp>%U@lxaoPM&#zSZ{bv9Er8tc9F@-!&S(IFHx zn)TqtNX zb%mnzIKTR1re4r!>PkmNGit0*&=3{G@G7Qek$31{y~liA1%)}z6bc$`>sL(K80xY2 zHKCx<)YXo%7QC$;9yj%ZMpM@?Wiv{Ty$ghbMpM^13enJG??XaCLsSrrUo*8g5s1cv zSFFE__i%$JjEB%@Th}pVqoK#%Hld)=)Nh!IAA4^X3K~sa&yiLt$d(R&}ix=M@3utbfKWp)XhxUdg)faMkr{A3fk)yrf{D*+G|AP zU8g}|jz@)pM%%iTDO)c+9=iLMo{iy>xq>DHJrCy4z9Fdfg%vG@4q> zl&zPZ&7Tnp8cqFQ9?ihDK9=a8$Hjl|n(IsXsDh>!sUk z522vZ)IE-}tptTR<_QIjrtW3R)=Rh7Q9?mORM5ZfV`>{J9R2I{A1w@4UsnnRjka|^ zQ?_2Zf88$>G@5#Vsrdf&s!-5q>OrP#y>$QjMkr`B^^l{Y?X~GMrj?=5)SsBL_0oB` zn^4eb>S3nh^Khn6&}ixrrfj`*9v&bRG@5$UQPFyxArv&4dWUv}4N*b%KE+fy*+KT!%zQQDJ={hp zXtb@TnX=Ky>y<)5qp4>cWn&vo!!6l9=F%>^XJtY)0ntGWjTQ5CEeJB((n);ig zqOH8%vnKM;5EZoYD@@Vj;v9`N?_N9DOBpK^G}_jyOxbAYod1bX&}iy4N7;BoVUDYX zf<{w+XUaxH=lt_RL8GbH6{Tai)^jEr&=3_w;|-?hl!l{m(C)Wi<~^(v3L0(eO{Q!# zbZ&GC1&yZOVk$m2&K3$9O})(&q7iN7#X>=&sedF;Zwm#Drru%7)=SS{L!LJ=gho^E zG8I36{a7eyH1!@+ww3k#RV5TOntI<+(P+#P3L2tYSXf*W^Q#Kkp=ie6!8cludsAx1c{Htj%Xow1;@d;CS zMit{>-<7{S(tB7f6g1k_znHSo&^ezI3K~s)%2a&LA0rern)-|>8x7r;uM!FxO?~dD zXf&P{3L2ty|4$U~#4ub7ID#%4l6qp7c% zijT(5LP4XcZyXhk#$G}}LsSrre>1g}L}Ov|H^KSxe4(Jxw*JGEjm8P%w`GNi;psv_ zqp6Y~;`y)mapM}HpwZMaOxbAYapPX0pwZN_iqcn9-xLZOqJn5F$CTYY*k_;1g8TGV zdC{~oG}_h>rff8HPuWf=Xf(AvQ}MYmS}15V^*yF+G;~jC777|ot>CC=ZX7EVG(-i_ zSdpnMBsZSlr)nw`=D1iWXtb@Bn6lA0v-X3HJ$0v0&}eF9rckdTV!=~S2?dR&R&f;k z(&rBU5DFSiecw^hXsrB_X=P}L3Zk*9qcDorp1l48-owp=f=1g~jVT+ARcafa^3<+E zL8GbFncAN0M6be36$%KVT|88czxZji%ONDn1%-3k8j)e(0!ZG*)`q(w9>G@4qUsrY&|2?dR&HgHt5UdIXr4N*ZWZ^+a>)U3$)#+$eL z2NdRbPAF)!tsgOEqoGHD?f+(C2#uzG%oOT1L@an)2MGm@rZ#d^bOd-vC}=dbv7@5V z*z6VKAv8n<(b$Bk&B!}MqkR8cf8{+KArv&))}~C^Xz1BticrvKYBQ$dXNRm%&}eFN zrfhEL*$Npg=&sco5xuh-W?L8Gbd zn2N90$k$9Xpwac(o+*qQ$io#jScfkE+Isy|C}^~;9hi!**Tq6Xqp2O4im%sVp`g*! zPE5tu>qViU(Nw9UqP=p+-%T{2Au8yVWlY&s_X6g1jaIaBe`7$p=mni|Gb zd^EB`L8GY(rsAVXj~-}G(-i_sA9^V`L5UT*ve3t<1wM2(YA&&Wuu|b zd_NNk8cmIGl(pb(ZTPxrFK9G1k|`Svedb#&6f~OJ*-_DGv zZ)P|_C}^~;U73oH#;=8fMpL^vDjJQ4g@Q&?yE7FZjeiIQjjmTUQ}bj5_{C0-oe70G z)_lW69vW>c#gwg=o{74Jf<{v{OvUH?V?sfrsamFNz4T19{hP)^Xmq{mnA%n9)%^1B zj)%e=rwIj(wpGtme7)`w3K~r{Fcn{~kA#9oQ=^!Quh%ATnR-E^>ouCGJ)~YQ9$ohd z6y}&I6g1k_7^dRub%9XOXlg7|@%4H|C}=b_j;Z*14Sn0x3mQ$0cT}`jb_oRyQ9-Yq zz?8k8ZQ|MgJR1sg+$9t=+SWv-;-m5Xe;5y;(bOcS;-fKBC}=b_nW^|_Tp|=SnwsLM zXf!?*3L2t~)z-yaV_B-_(D9kZgC}^~;nM}n;<5;1f(bO!a z;-hhwP|#>%> zAC0qwf<{vvj*3R(ZK0qcDu_lWQ*;wH_mne^eX9lvbCiB;>IIFq)x}hNG!_X3jiwG@ zDn1%_3k8j)x|xcP#&Vw+524XikE5c|*h462hzg?7%M`r;j-&C$?sxnL3Ugd26g1ja zA5-zs_&_LVG&P^8_-O3%FH6g0YC3z@Px|L}!Z2G7yIAQUv()*`0j z>$UBt#zSZ{bs$sm_39N08ciL`Oi^XHUT<#x&6QA?W13LVXj?}y z6<@Ejg@Q&?M>7>)ufGTdji!!aD!yLperf6jji!!uRCKi2Pbg@J3Pzjbn5vg(T>A8? z_d{Whp9=+zw)HcnY&7%^%#%Vvqp9N^Wi5DHD}H6_1&yXoV9G{A@4)OX6f~MT(NWQ8 z94r(xLl|^-JHa)?=Y)br+d6}(_-L&2jj0zjnmW@_(P&H* z3K~tF#Z-JWjuHwQO`YwiXf*B<3L2t?#yA znmX4}&VsYmD-<-E`UO+*(YQt^Xf$=6qoUDxPbg@J3Zij7QxmBAm>sSfPA_I~9`5iT z6AfsztqYink4C3Z&}iyHM@6G?tx(Wt>LRA%qw$VV&}iynM@6GiUP9Z`bU;H?5RFTi zs;BP|jcpgtrCU_2uloxHjka|uQ}NOGrBKjl>X(kP7QC(Jg@Q&?moXI|jWw1r^@2uI zmpdvNjmbhmLsSrrE10smv24r4;7x`n3k8j~btO~r(Re~AXf$<|qoUDReOXg4Xf*XJ zrsAV9Q7C9Mb+x0S(KtgWXow1;aSc=UN&iQuZGRCI=D1HNXtb?snTn6bmqJ0Ksb4$F zTJW~EUCu-U8ckitRD3k{6bc$m{l-zzXq+w-G(-i_xSpwMsy=$ki~CQcjaBRGeL_K_ zZQa0Bd^Eli3K~t_=qPK!+uDAJi3T*9x{0ayXzU{tG@82EQPF6eEfh3F1<|;LsgV+m zjcR(1^d8IF)# zMLSn8wpgR6#g2+b<71&%qoVOUrff9!e`I;uShc=(t!QkqM%ntks~7s0UYUO&6l)aq z2S-^8-q!vr8C$GT)E`~FqS1I=DAp+I9!Eu^(Yms+#TpfjdzrG)xZ%Ei8@-2b2*ny@ z>prI9b0fEkvBeri-S4PqH2x+OYZUbWQ}I1zukRaMtWng1j*3R(WuaK3qVW(@M^Fo+ zmEV4GHkq})Hm+)Hu}0bYldD%WHy#s;HHv!JQPzUDRll0C#TrFD;_4O6jo%8z8bv+o zsAx2XuWoEXL!(VFiay2^y-I+i@yjze*w%Y^rBKl5G3s%q;&WreHH@Y_oGTPG+SW5n#Yf{_ zp`g*!pB-f_cw6rZ1&yZu!c=@T)?Ulh3mQ#5>!@fn>V$%Zs3028F_n>M%x$^!Chy_T zg@Q)gdY-BHXnY_PG@AOWqoUEMUE93zVK=>(((IvPMy_ zIw~5C3x$G)Vi@GcYfRZ_eAa%~81LaHLP4V=|97V1qcQ%6#zSZ{^}3^?(YQb;Xf*W( zQ}Ma+p-|9h>P<&QqcL$^;~_Le1<`nmDI1Lo?ih6v6y~@@C}^~;x0#BM#uq|Cqp5#5 z%3AQYCah;Xgho^EFclw-3x$G4Q|~$|8jY`nf`+Id8t*Y>qp|Rjg^Rt1Q`R>gLZfZH z&s2Ogt`G_uO?}{~Xf(bQ3K~uQld1St&f?CkH(A*jfc=^>Jvv<3*Oe1LP4Xce=!vwjjx1)MpK_UDjJQMKQbOd zLsSrr&zQ2&IBLB&4)-2jBNQ~+*5^#cM`O7k8(Yw5>I+9jqtPf7G@AO7srYDIB@{H8 z`pQw!Xe_^x@emrKf@plrl#Rxw>wX?wLD*9$Xtb?wn2L|a^+G|Tsed~v8jT?v8xNt; z)PIOK{S?O%0^@8a&`AYVU86yF&;vrZ7s`Gd^FNR zL8GbV9AzzdTQ>*=ji!b$6(5b|H#HtYqp9T`6^%wlC}@ZZqVYYZPNeEDL;s!l?C9y< z!&ilZM%!9}srYE*HZvYVqp1}g6^+Ky z3RA~OG&1)z1lLnqh8kPYXj|WBDn1&o2?dR&R&`V~8hdYHY(b-`)tHKp#xp`eqp8&$ z6^+KsEsZT`hzg>y22)#0G%kPOxdWjvM~_g@Xj^MCWuu{=);U!uXf(AJQ>fPvvEXf8 zEfh4GTH8_ZOFyr7uTaov>IaUBM&m7^pdl)V#yU*dJ@c*p^x==ahg)xDVhD}4^+Tp? zH1uxI{z5^csdXJ?n)`T6`Wi zUVGu5kG+Sd2?dR|wINgS(fC3rXf*XBM@6Ht_cq2uXf*X>rsAWqSSV;TwUMKu(b#TV zV~aH^8XGf3-Gigiy3N>4P_8-75sEeHoM;oK;-j(BcE%QK6t$_NtOakYPbk(XYBN_a zQ2MOx6`@$8sLdS}jYi}4#zWSqXbffQXtIMj<&PUY@u~OlaiLhFY;ED{1xojn2|E~D ztWngKj*3R(9-&yHsI6SRqS4rOM`MdMirU&y(P-Qy6f~4kK~LF+sf#2U^{fA@%|~O8 zos2DLbRKTYRD5o{DHJrC+RjnYXe=rXvG*|JA!`&> z?x<)qo)8KeieZo&!zIm<#)U#bqp5mFSqt9QM?yiPsRpLvbE9Dw;~_Mf8s(^HG%gm3 zH7XjTnX=LN&8AoF=so;YDAuURk6|i48WVRl9%FlD20+0Jcr5z_klOQE3Ak)Oy^d^Eli3K~sKa+I~;ZB5$U zcnFQACNmYE8y5=&ji#nJDjJP%go1{sAR2oxWutL@^G~kv9!{+`9zvsSO=T)R8dnJg zji#nKDjJQig@Q&?)0v8o#^jXo5E@O*a8xuJR|^FVQ9(2snX=KiV*Z1{-7F7cw1|XGaj-=QQfXyp!8a_St!;hs>e~$Xe<^A8j4|%8@)`~Xl$2xEayG^ z!Fb~#G&=HqOvOiIo>0(eYQCeQ(YRYEXf(BesrcMjbAs^@8ci*9R5TjxLP0}R5RFAl z*=Ri7aXD?DTVMYm6g1k_flS3mWBrN7LufR0kfW>xZ>voxXf*W`rsAWqSSV;Tb+DtN z(b#a3@emrKf@mDVl#NE^_Lo2CJ?s(+8g1*ROvOjzexabz)S-@wMq`7?#zSZ{br@6e z(P$S68ciMUsAx1E6bc%mf@mDUl#Rwc*KI`G=hoMarWg;Q(YB6cDn1&0LP4Xcqa0-| zcv}w$1&yYTW-2}!8}4B|gho@xI4T;A1wuhXR1l40nX=Jn9QCIu-ouB5f=1gqj;Z)) zY(CX^2#uzG=BQ{i<_iUlrjBPSJ{k`S1&yXoa8xuJTTC+^LPJy#jT4!&(fH>-);$Ue za~voXG}_ilOvOjz38A3T)X9#r7QC&Y(~XDFXzCQE;-j%ZC}=EYd_R>bnjrc3^-jY! z^|qc83K~tF#?%m@auc2o-hcRxP|z6vzmiWN*X5kf<FRSLP@2RVV zf<{w6S5*0se_iXT$AyAMQ|Bn^(lgJew6-z)OeknHb*`dr9&^tkPi@p_A`gwGexa!J zL{f>)O^+Z9+k#sq+=J$!f3Dqu$om=|VxXY)QJMt+%fymz6X^ zIdxN~51myv1D{;L<&2=etzZT2e{Yv^Si_%wM4zBH_)oT-xpE0I)PIttPu5ePTuh&A zqCRTIJy$)neo|Q}{W+mMvoJG1*PWS@YijN7&h+wEBU26@lN#Mn-!OL4 z_$jHb?#`Chwp{hdw%q(&TlL7+EQ+Zp&y|+7ps21)^SoSdt7GeHQ+0KYE0df`i4nkCn~P5V_rw+0x~modYyBV+;;|R zC#LGAjH{VcQ!_4AJ<|SPZNuoXld3E08m3MkJ8EoQ&GZKQO*O?eT{C}S`ONlQdqYR2 zsV$eCnaj*;%(V68DB?p~JJMZkndV%&wIiEbm>ODIlS=jUW>cwQGxEPo_nNQEQne-3 z^$nwHW=xo#o>n(~N_xuVsnb*4z0E|84!)Z(xvpkHdScD2^u&f~(`rUHq^FJDvq6OE z@uaLyQ@+funKh-MW>#r>eA$#L`rp#jp8UV5JyUx^GSMomfWJt0^>yc(Gi_}oDJKPr zNRMY?mLIUEQr6y)EfZ&Xyiyj6QDeY;W)ENYC$)?|Vx8-;6^& zxlDKS+;mw;bv7FpC_ZF|K5xr)%;}w*HYv!B#G$LLhkNN+oqfIO&X#m{ zrejXdky9G%*VF~j4-4SvAANJ?_NH?Sn{({FEh0UMtOxPp_&F6-t!t44)qj}H_4Iak zEiC>%IySp=s(jB=4Y14E;2)G7iTtuwMg`v8?l45)=SYpKe z{*~!;gUyI3z1?-)IqEd2pg&O;4h8k5^(MXS!Q69lhyHb91hzC(ljpa>&Uz)r^Lq z?{VhFtEBsyyp59-=xK4%xGvYPE1Gs|YNm|u=rpZ8t%k;n>Y+T>cXiTo zBsHU;mUP)ZT7px)q|)PP#m9fAWnSsf()tPG#!nni&1;HHl@CkdKO_q;MQ9yBi=89x8vO<#N3dad_#EdReE@*#NarYqKq>o*ZbVxTWc=ptZNhV&r64RJk~m zpIy|l)_A(5vzzjtR{5>Hi^!8fSgAu3Bc9rYpcZ9=DxYhCm}a`Vavj;hIg7&JZCQD0 z4_YOeFfZkT)8l!$nK4uJpz9uSH$ASKnrU_bl7A>Qx zG1AjG$!S7tOHp>Fr?s|swdK<2@jWREnH%AcNo@9ka>xdux+1T62W-S9BrW!b4yAwiRsYf`na85|L|kG|P1msz=r0)uY{und zb!l7Y92)w9lQ{${g|i#8o{W6&=CDF+u$H8gqgXyX0q93iN+-sdwpKb7?Vi)uPU~pj zQvxsJMS-jF0(JSaw08gr_f7u*;{;B(BkF%HM5^1baxg2hah#=722^V|~i zk43GywrojyV(&s(GT?8$-HXin0srXZHAG2zTDxd)0?^ji(>k9vGyI2U0V1CmCL)xN zt+cL#mVY$!mZb5wrtZ#67K=>tPn?lu+RWd(b8}j0P0^js^rq>&i54PMwB`Cb62H!N z`jYecYFXXYb#;XugO+x(1H-+AX7=9PoX+k=CLvwBWpgc=zBbyyz!n{?06Vg+ys(Lf zYOzepmzJBY9$IL%Qtl(?3&H70W01bl0?>Jj;zK-}qtT!1*q))iC|fFhEZaPRuk>MA zYGws#n&~evS2ROAQ2|CfUDFm(Gq#7Z9*aT9Rf}!G(Y)ch=#`pm^2Aw+=}|HMt@skcQMMn2WPDUbNv|3i6*qa&p6Rk_f!Tu7rX$my zOVNf{N3PpWDv@sDPv6_=)StHB`v>?;V#$_YlFu{|_2ZV_R4ZO=syw!nPD64T$zfOL zayvG}RJwm;=~TNvJ9!l!hzENv)v_tN})U@lEt`^{a8(yi@i)5gRI+QdN?7ZR58 zx{4ON2{w|QRaOd0*-pBN=8_IGiR2d2u5Ow6yD5TuE^oFBO^?a+%uRRay1H{cG%%ZU z*0I)7dOX$0Y|PU6SYJmgohtJLnrdwC>!k}DJdWlUN>V-_pVOD=&L$~)JMB5DACH%O zNHl&@d^>0!>!xc5zW91qqe0|gX-Xo|L!0xtw5c6mp7HUds;5WMRuOF=&`+P#zM)VPjL+M4KcU#f0yrlTX*mcp5sxt4@l@wN>Yyr_eBL#Sh9X*duF)#Kv* z08b}3J;_>>i}O=Dd!Y%iK&?<|a*;yRPiYh3WpX*ZWmiN&wY25Uy&^rjUv>TjIzRwT z6-KG2w-ftX34x6XMnR}y$zqaFUg6Lbg!+k4ksLbIWWI1l9hw%OG%fWt%NFDkFP{pH zTITv9?MW>4lIQ1|sfANB#y01s<+|t7_9u56vg0>R^1n1)Hm~DWm(_K4w6xB#+lzVQ zPidiVc{G_}uMW~?ig+}*nkxSXSCrnT373PE0{`32^4=}>*J!l*pY_yjk=P5~|I5zO zE*cNSzUjxRRFmmEuW#_SlCM?*k`Rmp%6e7W($`CONrdNjyaJe6;lHpak$mmXe@tTl z4?g+=P~7+K0#NizHWv1f^ysK4fB5Z3Aty|sN*4Qk#^gV@6*K1vqk>2jb(YW{Fo^Y8 zaB7rnCGQNOcyZ#|J*gPe=(B0rL+1wtgmQjBLvxxg)OR+w(soRi*2lQ&GbYG%It#{@ zdA+%eW-i8!ku3|X)C$sWjh3ECyHV6n5|#df9c|h4@mjTzTPT=%)R^=ntlHAkXnET& z!;4FvltRp1k5BTB(Y$N%Hem~$|5K#hLNozwpo{fp zjhLR=*D+9*7OGhHCY(r_#eTZJGu_eI+uDK&rC=lRB9D?GxjYjV+Ac^aDSxOaS~}Eh zk*S*~8e4)P!KAIte(KwbQ(+hm9*@fUqYw#z0J5l#eZ9n|5v&xZF=W|w$25(yi9-Vqw9{{)EOpF zN2W{IXe;K26WeY~>49{Mju-~V%SS;Fq<*Uv4p#GMp1UqG>XJ@)Q>}B4VZ|s#a z_Z6Ko^VRznR6k`ZZLA_S%t#;?_~Rw{!86yhtIMKloUWOT5Sp|i=J0LUl>I5nLSMt` z(D)X9Rfkd=Ib`i!DT=s^7SyJ5+B%!e8oVu+%$V?U!^hnML8%${U09vO?>WKf-aNWk zk2JIGH?1Z;p30yUX;jhRtZA(9+XISnVW#T>y`7wv`2|m;v8oL4_%;w!RcjqHmCc9dz#z-OLeNUjG_bBG;R{8^+H( z-*l!Xem#_KOi!EEqtRNGW5*w?4E$H6Dg0Y9*o=z#>0vwZ0Q19QVS=>wxJdc0G0}~p zf0}?6kWi%3Gx-lhf0T%Onll~gBx007LOIQMu}-j3>+|zj`8?CPoFo&!>5@GEO&sa% z)G1rA;KH)_f_3idVr@DW)=-(;`4D1PySxk!%dAh&w1p<9#8Ya&(zrDD1;*!j{P(3T znbtNsHA=O1_5@=jkIbkBvf5m2Y3}5UbBH{qi8#uwSF4kXMUka;mlShKp`s{y?jGYJ zRLyO4>v&8(>@`zeL+5L{CY!|>p8ncT^{6mSw=_R#1#kKCqI9f;&MX47iq1f(8g5fK zJz9UAzmQA#wux@?&9rsR&G-SRrqSukX#A;ZEH{@K$I_--rlUERGH$#5;c0SHl$q>% z>2Cjyd32U93dEvGaJEF1>W6C(^a&*4jnAx#^uVX_BCAYFc3NH#B+6 zt;lq}pDvb<%_5iV^#iI4-APp79wEQDv1^e5Vqr2ZG3stFOIyL9|FR1@+`|^Ez8vmdqud2wS>nUYe1f*u)!qy>x3kos5nf!*`pYbbP%;6)sqM z<1pD6r7MW&QA)A;3S)uyhE$23Z4_>k3V#p$MYtxPx+IJ{ulb#rK07n*{rf*GQl5E zYs$8N=~UWjryIshT=-;XX2mpmLqRtlH!9;@ay+X}&xZ1JiRaBCNU-3h#lv)ZGFxkK z;gz-wX5cxlrW7yCN$0Gn@}RA*34AaMc`i2_Ep{x%E&6hD)Bbd~NA!C*E|LkY9Wj2T z$II9D&aH?yR785Fh;W-(tPy^UoBS9>uXrdds4mMZT^7;=+7texh0x*3Mwk6_y!JC7>poY1r5#e7YzwoxqRZCIFnfhl;N+27Wt zw=MW?2wI0^@f2Wc#`H|jyi_cvI!%JkbS3kr+%S+HO`FlUz4%))Lpg6>($HnjQ|WyO zo#-`bs#L$#`c|q=8!vPCp?13Isc=wJRl!q-=8nfCHTAFR(kb1Yc*dG8koh*{!9pH? zEQ=GkrPcoQ=w>QT;l}44%F%2eb)7gBhZ-GF0=);vmvX~hJ=Qm8=K0vqjfy%M3zw>L zv9QdYvlq(4!stLP1Sx1okJNP9K&_|OuEfPrcS3WM!*qH!u&0Y|zg9t$A((H2D3b?e zJ3FYq&rihz)EA=lqECX2#<*K!>Fp;x31YD6?3f07xFwcu{T_fB8n)QcI3zTHrx^o( z8e{eB4rjL6<2Dz^2S!F74;+A1q0-nJfuXcW;}GsM#)bp zU#JXNik@5V$xY)&Hwuc`ExwhVUK!P|wzh`XH8kZXx#(wqIuUkn5SUS) z>CHrMEH@pE69_prwg)$&+ci%-LRUE_>12!V!^qh95^TPD=ceRx-IS9Zv{=J~`hGSs z{*k%xWGYqk!&w!nvKdozZLOK6);6qM%^n4}OscSN+{oRz_D&ji(1`s>TRZ6OM|7H# zq$@6BtsMV?<=8u(T6@^9Y`;Qm;}#udmj%_Ollyw-(Cj>?aE#F1i!OO7w_kNxvVU%P zpq|pd()X8Ay7z_~a_Lpug{ZMmm!&tRkm~W?v$j!oHI&QVGS7>TuMT2u0 zBV22bcoh>9+r8+<{%E+&g`?8AZ`7I~PN1iLdYzPgx7_3@Gp40$X4H?JoSrgu@~E*B z}r zIQdd&y5`)B7J8{-f`z5})Ci|bb8gClq&h8ii!C(l=DPVUdc{<9MqRF(ZclB+6XT-- zlpD&-o~Q?1a0tJRX(L+O6e`Qinz@C&-I?ZIm*4dEnrKVQJqGsC3nz|w#-=gvOIh>t z-~yNDW_r9L#uR!hdY%^m&VW6j1;5h4rOriSKwK2Y< z-wnPa+5K)?ovE$anqJzdZKCH$qm4@T{MF~iWNp}n?)*IFDVO9@meitsD5R{RgWe|* zt%;jMc~~nbS~@}Q>hA3AY^Lq5Z`n>Z=!D<0sdgIOzhx8I)^0fmC}4=*`otT-^-d@o z5t!KVByT|%L7E2!+B4nr`W4H$URS1@&f>CNyiHudC*)QBYAQXyHMgM9iHdX+>g99r zJ_8!M#X?V^_~H)X!FK(;fg{<&N?Daw(}M+FsWCGe7WPi0zZ8l9J!X!VEy}|&ssq#Z zV^^k?HkOCh)%I781SZ^y- zC6!2+{yoEPFVeaNCr;R&>W`y7$T#lblxLs}nVFbbDEl7M=)w9TjF~;|o+7=I?(3F| zqfIJerl+l+0a(s2h}>{XCN)?khIwfYS&4@5nAU$|;7X59bSu9{4M1ErF_&%4M0=FW z^>9Wms2zM%kUC+vDqzZVD7y2}+#5{S6sJv_TGx|Gmb^q7DoEXoroJC%`F zW;HOiw+pL*0zso0zsS`Y z#i~mS#4c`CP(YeLh7}{Dlj_8w&M%Uo?4uX{PwsA{d;L43VBI_*rN|~o& z*rbAa7hWL)GCg<$wS^7T_Gh4uFO5Z9Lj&?XB$?!eBEMiv*^o`zemGvU#&PJs1>Yo7 zXcH>f(DJ>A3UVu|fr57TLtp+au(UR9rbY?+M|cG{5p-*2=X&0dJ&?i%??u8a@ZCBR zOe{exRnA1xHh(0g9I#F4Hr58X-B_?ymbAd60555oE>@92wYiusu zUyrwFR?LNl6Z<^9>isk5hnTXxZ9VCQm8B!o&2+LFneZu1!xXnb*F3yRi{9TChZOQp z?hoWwJ~aFN|Db_pn+ZxRn)g7Uu>uzw<4ZT)%ltXBBGB;VIoYWwt*6Qsdn*dPXe&34>fe&O>p``iJ42~E~}`xpSyD^kw|&v&#V}o>77fr2Y1Xdw_O!*nSy6_7P~v? zw!Q))(*f!FF*MhG2`2}Wgu@D{kF_Z<9FS=(K_A? zsk)1e9ac{UsrNq1~eOIfEOGz zN0?^?dQu7H%eFq<{X%aC$h5hoTQLx=75T;3OcvRP#2!E76rK|#y0}!%4oa%&x49P3 z>(=dU)QKi>-$0Nxg>I#GMdH%aQYa*rgx+8zBONd#z;TE_~4`` zF-6ya0}JvbK!T^WHKQ@Dn4g9U$YQ!vEB&qwU56h4MX|^`-y1-5!iR0>W&IrkualpODZupl~0_%E2C)c zqHMW_E?Uh$+(lVzDpdTWfQ^t)ZN`YM&aS>TDs3P$Os#o^Y)oP1smOtph4a_sg4~3e zJl2M{wo28EHv^4RVRuYPOYBb@rvF-Zw|GJyTROK$bkGlJ_0kKR=`N^Axm=d+4@@*^ zZdAbiK)5t#cZ3oUG@Y8lO^>%^a2|keNNc`g3yxV*Dl{k=-G{d8@%(l$-X&GkcgWpm*ch3QoTX0}_WK(QgUSkA^q|4-4qGydAzHM(W`1flcEi92 z8K=Sgl)ZVb*7RCK7TRry!cJKh^2wVC(NgmCs;uN4gJ@ZKdMS&4?52+HC&$~hifQR? zp0J8u!PELJxMUGx!F8MP*IsBaGC#VL*NKCKG#3+PD&=11x5x_q#Lhs9Lk3{~D)v`+ ziYzF2WSRyqdcA@AO`9dEC091Kowb_gvIZ8;(b|zZ!2V^-o1<>RU5ru+WOHBSK z$(|NU^r$>Al$_L2R4j12?UDFnoZAI~gGs`bBO}(9Q za{;CB;2R4jXH`BDG<9N5<#X&~p^VBG2S$?fDIXLooK60_{&UG|O+*KfN%`nN@+hBm z4Ovtc6+z=w9I>NQfeS*W_WUOg#p?DKzIwHUr4_L>D9)vV3xY&ENT{T&O)P_>QXqp9 z!N7Q8HYXM$){)r-bp2*|0nW5}@fn|3%mA`Ku^e`)*x7raB_;Fri8$qe!5CArKzrx3>48-k_#AkS1G2v0d%iHfs9Ai(g6g>-7LSK)+=TDEF73G(CeF|DV&xh_Mu`4qk?#RbP-_YLk-UD9VH(3i}16!q?cPqnGbsX#CYlJ*bca$Ej8Qj>2zOR`r48D}v0RmM)`fDd{ovFFc2l zo3sq}N8|QlrUXe2|hiQ_w%@J=~c#`pruEh}HoK4@nnq zSFWO!o7aqU)XYcjrxVhnI=h=`2=3+z|DUa@d3#7UCkcb!U-7wv)|o)rn5Os2<1OtJ z4s-twy=mKhM|Z#=TaB;><7h687hBQI*})rk2HZ43n@D5vC+K6d=nrT9zw8?QR1dve znC4^pC2YEvJw3<#$SC)VG(8WBIQ>rt)Q`=x(&PVkqG~6J{~rVCrs2L0`tb_96*`UA zL=@iz{18a5#LgT4R6Y%=htXK-x|DO-KEhn=jHBG4e-t@SMQq2soUhoz2I+!(o;hab zrJ|SYE?^F97>?*2NHzq@{jfp53*#{}d~x&Mx9c30o}QtW1%tC^JJjGxpn7S24f&%d$~OtrlH`L5Ok-$@;V%6-f0i0`~Q|FyNpcV5#-Bl0qEsjgSP z^E%P^k5gKlt>Yx>TU{)E=aq|XFt^Ci>!NShx&O_fpX%(-3jX_(KC&>f?SNN~CCnm0 z6Bn#a@kK20LZlcIT=XJb?Eoo{l#-dC$|K$mG0Gp zZL(WJeZy%!I#DFe#rl2z$J`T-UD9!#Dsp3kbWL)@HODaru`+M0W=He zHewn15yN5wkl!(iJ)y@r_TDM$uk>y19)WHm6PZ0S*zIi*C3?aZ6{+@kJIG3=53C!ArXaFbozdtcU@y z5Slj}_cQbrS4w|_UXi8f1T6&7_)>VFD+K9UCk=6hN+@b@D*z`9DFuiD4rm2R8HC*; z2eEI-aMHk4*ks(0RaouM$BWB5K1nod8b1ioxROpDrV2O^Q&7JHRH33GH|3PlZ))?) zm+7T~I`i?OGW&Dt=Et_pxH`D29@##6u?K$cBR!5*-u!pkX)dMzmo;GX-0sefPW;p} zR$BCEWJiX6l^t*NqSt!SZ$xKPeZ8%1J%O|IOLT+wjQ88ZPSIOXVf?*<}vB~P0=eM-8%p>FEzDbv#pQ>RXznp}91dR>0Qq=A*+ zzuuKUW77CZlV?s!PpPRJ-!MHrefE@wT@!-s=?;twQ>|VDYJX6TM_96{&#FF4QCV)jhnV zfPdqM#ugf>(o^PQoD$FZ_Bi;Hp28K6FSe9p6O@U@qx7R4@e`#qg%#!z;2CrP+#Hwq;m0(^8rlR#A~@-aVBHCKpRp46hi`TspF;JXhW{ zB2!hKX{l(gs2JANR9RU$vU1o+MNPF-OI20*h?Zfw((;PR%R2O7L(TW#^V9x^iuI6z9ZP58n!t$JkyfP4$D@JtQ=V} zoH95=nN~h>cvaKzVPzvmH0ykJeP={VS!G$(u(Fn1SxZGzrlN9qMW(#6Wn^hpMQNtF zxl(1O>jfjS*%8AlDo3;oAC7KUIlL@0Y*@CUqO`1O*s$THRjL=n6)Ic)2 z_z_MI(e?#^!Tr9m!`{I1BY!t4)=F{hKdfokh>?{Q<;~4y!z#%Q9i7ts-?WFV#LT1&AE!<<-@7Z=s_uU;tGK)|i~# zh;&_NM@#D*ds;Az-rGyRq}M~gvP~nl9R-TW0;e6G={JO4+kfE9j2|OxnGq>tR<&^OjZ>HuwdxVTA}4I2Q0=|A$`;qZC+%$yEBXO&x{H` z(lNBO+=SFGQcG=juB<2gR_w>0RH=*< z#rcKtD1Qtu=#)Jf9mwj#2Pg4TpgH$ytQg?ztD>K5z|PSo$%f_6#LZR1TPo?SDAQC` zRYqqsWg|-~o2o`s~ZEx#|=8=FD+3)oOlMkBmrGM+T!3=gtQ2@< zp+Y;kuXj%8QW=K7qYx)MJm7KqTMaeM_dIRl!IYw}taEM!v!*Nr-NRl3FYN!~vvvQQ zL!Ie&OVa8x?oq}_q7*v?5}~hS7l7?U{7>?_-Sx>0fdwyI)tmeRY>#k~S!w@l}e z+Yr)q{3hMBStkEie4%B8eE_nE`s1$2GVF22-XK;)0o)FQ4xqhZOs%mamoLeTUpV$R zW16SV;k9JB{* z-lafX?Wy#wPr|4%(0YdaIu}6Q{vwt{b-_w{jGk01FgA_48>&|44M#n2ZcD zMNN83-+uf=7qwIL6c+c~bTy+YN7r^M>B?-y z$f`1XaS7WJ;g7+G)0m%9T(K>sEtSnp!*eaeo2$wz%ZHCB&*iFywG10h|H!tCXbOsr z`JESE;86MbgjCFnT?)>(==rm-ElJrE`!d>?!f5;ot3)YfHjRtBpJ9N;=n_I`4A*~k zruVl)2YVG%N+qFF%+Hk23oiUQI!AzqjmRwka%;o@J&p;FJ<$s~Xn$@SkKj8!X2jPC zDs7;vtAZO6O#3HX2ajmEvHl->-`d?at}A+eOn!jnx7WJs#%Ytb+1>4Q+9vJnFIuuB zx4unmZ`+y2`Slkh#g{}@s5DP>e32>BziTMk1#X>go1Vkx7i<{CiBtFDHSBM zNe0D$7EennTr`J(jQAQM4-_SnOwfQPxikRQWCQt0w}iA1<66{mYq}>z-4vaai;!pi z98k>^kTE%xV z-_-y&ae@#RN=cHixe1~-WHMKeizm{R&0C#my*$`s@{kjc1E?PrcEX*|-El)gJx-6^qY9F9Szo$3+h zwS*F*UV4PVPaP^W3Qiti#qVS#(vg?OBlW1n?78YuiB02h3^EO`M6|zTiW7+ zrSRa)`*wZEzwKxn^cZ$dkW>?&!UA|r{#Sf^*(3j;=eIm?WAUYDWXThH*FC6SEk&R5 zRI{jvrPo^HS4j$Yxgmhhi|i%obh1pI9u9GqKja6vb6fewlnskNyN8 ziJ@cojb2j351iF=!zBf{(HMVWt!8M)l#lr`PB%~ML%do1KXR%7T&$L>6jCY5`Bo{_ z9K&haVYeZDYT%U-Jc1h@;sXLQ*>IJAMUpekkkI{`7ie|6)&l%Oxe^-Ze{LUE>FN;r zVhO$K{bl$FZ;OMr(_Z0FnWS$^l*>QU(HPE^Q@9|U4~9{c<GT6L*R>x z`}t?uKjFh>^PtQyv1PX1e>yzDBMV>Il(TSN9MUXm2{6{oqJe19eo@5pUW!97kVUFY ztCO_I8oBh^i2<$HI4ow(cETc5+XJ5KHncbcU9jHJE?f~m`>e6zPzl*pKz* zQ$dU>sj@$|Uo8}OtIhUfQWH0El%BXzpcMs)#;hrBV1%mpASmgI8x(qX6uWUnS*#$6 zwwPwidLfCb3Tn38DA2QoL}Q*UH!xzhd=Qjo%MEIrEh~sJTbv5NZ>iX~72IauRsijK zqS?kBd{~vv#)lQ49Uo4w?71k4i=k#|h>Mr$a57j-`_pK!=+9u2k_^%`>m_idt-t6c z6LG1Hg!TN|Wpz=lyK#uNLKGsbE&3rdS|kcZy*SD-OBd^0 zjc4&Y7AFF<*15P4NX**i0!3&U9^9~o-qqYj!`mTiODP@Q*1H#8cA9x3vi?CEI{?rLIFbiLukPjLz7n6E%OXUqx=)e z9FT`G2pa8m!FFf?T2?<+#7}+S&l@J{8N6rOuui_kT4Z_|;RU-L&YnYAay5b%826At zB=t1*wXs{BU_2}9DZMq`m?qRc(l-NXimpXK(3k=0_i+=Y44OhQQD~Km?ShCi8N}fU z-mN6AMoB(k4(Dwp0os)WcIra^)P4@_D5y}SIH9gIegT>fjau)ZoD!Z{g*QkG^>a6Y zgoz^D8|xD^qKp}69H3sBfDRn^OB1xVjr1M3pYV<)bObD&2)*@ano#UV7SLUA5lsin zY?LR1@iUyAh@oS>;IXi$e$if zPb5j9CGtmI>d0i246<~wm?hKcat8g$MuR2vtAy5NgM1A7gVGTMl6E?RAi#B`lA~4w zc_v(R^liJlAmY5bFwsI=z?YbJ2gfSUDfv(Ag6j*XI2t>Fe2! zH3R_*YvXA&O2>mfbh4Z*B4}6|O~=#0c+&4LC&_Hq{^SlpfU(98qT%&+ctry$MM!6= zTXNW~1wNLY9_+~Um;27?=_MFM$mUX*p|QBE`X_HIg%NBKEM3Gmtc^pwS?6&=iYQ2n zG32ZmTcTJd5pXuW5l%#m(3J=b4dTK3zQ@?^)Fq>w4gtM0j?f9@7^f3X)T0W#gA+BnNWsq=* zhhF_7dwr-4TIM_QO1fx~5QL$dn-^E{ds2ZDe|%bZM+FMo*|@dtfNEPnR!9_IZ{qa^ z>ThUeO?&O2Q4ZVoIVcxbEXmcMKpII>0`h8UaHL>5W-+6RPr3;A&Hm&g4u0~i&yh-Mt1oM z3i)>19oQb>(SxJku7HsjH~?04hLj1WR2M4~46b^aV6ae*xJ)nrUNV7mTgSBltTfzM z>gC{u*CgQn)He1vM!lwsm9f&cH1O*;ppl*^#Hep}P$wFHCy)JTYc;|5d6(zlD@zBU zw?)ZoB`3)tU^OErrVM;f!U!lr{A-)T4N|3p5=Wy3ZX|zIcySpW2~-$PM6d&GzKgS6 z8eNk}=;JDztJyZX!3EKg-;oyRN`PbhRFjVxn>rX0xqPMN!&c(7C!F+;irc&hapK`aF}+pigTnk0FdMwB0dvWfUUM#gyCTfNzlhSqVzN&+TZk>_&2;l> zLMwgg2#Ff7b_*A=m`Cy?3_K+QWyYoRENdOFHeUb->pw+LCq}K&tx~xz6CqMltDUbI zDvg9}DZnXQ7bgrb`tN!6L{i%xWuCqpWnkv8dd%Z3v}!%f@Ad~U>c8NnM$$~6cp-fS4FqHGYXD9T)q zbCIx+q)gpfX+%Y2ByR<2Lf=|(Wv6ciani4<9-=bo%vBFD0^)bTd2DHv|B5_WN>mJ1 zvzV?d(h$iLOyflkPcn^1J*e4&O720vT*AGQQ3@~NkYt)yvs5~NWYfd;1neC`dKtqD z4L#lYN=NYyF4~h_=LtqZZ(f7H2rvrRc0m&a(h}q}17WYK!C2IzMN7V;*eQNacF@9u z#x5sf`vqirUfh%5DPF-bB&Z@$Ye*TKj2~EnS>B>_yW}Lw`IW^NC_9gqke{6`@&sO* z%6p?>zUcMg**AEyr#LhcnhHRr)ni8{~ z!^358o-^n{AG}eLPe<_5Ry2v=2x>M_5A$_xhZx@MXsDU@?%S-R{GqG;LA@=*kb+mR`hv55-3S+ODT+@=KQyxyT9 zI7e#YYb%Qn>D{w__y;`phD`+hCzi{07NK*G~o1mnfs}Y`YFH#R7 zTs^6fsofos#zge?I%!Qs9#Uqz5^ev3pefFlF+;Ug>eUU{3FjKN4bXG&HZ+uPdAx4e zrmCArHx}bQ)d>Q)wb>F|PbZWR7de(@dQuB0cCM8oQd%zpFA>mSLUQ9(rNN{KW=ktf zPFpVm0zvX#)Rqu;L-{5}GjUPZKs&FgvxCIRB*Cqrg*2Ltj9e)F48~9kIX6=r)dkGKw1I^}rWMJ3S~iS3ew)!1{Ib=Yitf029D9)FGWQe*|MpniV zc51C+1@Q1PdTi1UcR`df3UB~*6GDHl!IRPdc0h- zrb?A;;OXQ;nIPFil`lv1V1q!jVsP=5_Hd1%&hc9*V1^+hHd~608EX>RwN|BiQtWeD zZtl>WySE-S{M&$$qp*Q9s$!%1iq)~NEoJT^cc9g$w^K=g7JIDfcAx93;s_bb5H6ep zH=oS$@;R_JXDbG8Zy}20OLgevN>9xN3Vv(F@f|bbY7M>lQd12*?lN3=nd~TpGNTRi z-Wf?SZa7bdhM_iSq-oYr7sL4|4*275yUic*;xAd63spR$UNVFycB9c`HW)4kqu~Uu zBDt;>}^s&^bl03mBnkDJGPHxexpC04w(_tQefqxYJ z&Y@d;yn;JtP>#NXUqE_5y-uJvPuJ&$RDcG+Nz#2U?nx~LTti^uCxxU?S^)(UVL1K- z{qn)3!FqbnWKmEfMFKC#`?x%B9EKcuHjEa;W*aK*P{Vi!#oM$4vftD}(=vGPfanpt zC(4@U!~NPXtaRmQo;8QGQP){>$X;taZx+vAinPr0tcCas@nL7pAt{d`Ovbll z4GQHHVets)6k(Mp?#4lfrtNt!DW2>gm-NG}P$b5e_w>8K3o$USk-X@=xSHR=wv#>g zQf#o{`t1%nSM2q;f-uH6yzyt)sM7m6$$~ZDbM(L4ZBn@04`Gblc9IPH*Z;uU2T1P+ zL*9>$hnMkt7R0ngT7)gGGH}>I**o{)Ifuf$VvldW%0+&StbOc&BYuphUdt+RbnU)w z)d^GVVi4liR0q_(3luxyf%sl}MGJ8|ssjdOQKEP!YcO7B{lPe!jIt!pqY*R=TlCW& z^a&d;d&7vmlO?WOuUMHF31UTo7~(w|n!G5IVLotde_irDJ_riJ%)j^mlJ(K$Mm%r@ zbQKM$ws!}O38PKEAq8)%&@ohGaM!hHph-@^NEwf=Xj(X$KVAP+%HHT?RY=t&Lf*kYj$!?WE z>lhfY?afs9)!o&Wyu+9rR-5&l^oOC#3v}m!ZG3#sP{dg=2+~3Q@`7|*`3lRS}pDZS$ z#b`8~jU#o&mc8W&Vu5@)Ng-J8Pp17mAHx~Q1pbjNrzB!G%-EHE#;#5>W1S4SI%8hr zE@n(@jmWdj=^Yw%bA-7jWs1HqaL&yU z20=ks-yC58u}dHVR|iX=C)IFEpf_RfCD4;X<0a6WPLn0jlZd(mzJAy&;F0Zh{s%cu zb@mJLq9RsB1Qd@TNk%ge551x#GY>~GTo5lH{1v>)FzpW(vt*V|qXe3)FJT3b;3@Ph z9ZjG?eXYO3+-x-YD-4{|Uttg!{S^if>#q>FI`CJXRKxizZ^GXG%9BE4f8|Z5iNEqB z($HUdQ4#(M0p;PZ5ZI_4l>HR~j#hXGf7MGfh-2Y38MsZFPp4S~&uJv^D8zD_!fU8~ z685^|E6f#KlfS~iIsFv|fze-K0I~iGfvW?5%->}{T&6dIeSH=QQt=}E+7p3x98 zva`t;4xfh02)axzNd9oKTtG^3HmDD7F^x7%=81uGnkNQ<(L6DLSo1{S>cBibsfII8 zZ^GW@=}Dond3w`nVxFEvq%se`ldPXc>1>iFaDJ8#C+R3nm&1s>1Sodi zkX(y;N!o*c@crIsJX_BClWaVS#tW#?7|$%HF=uyv*2$2or!ijR7UyS{WB$=Bj}{BK z05r~ea11t>Wl4XKXRv31DVR*iH1VW|e#U_T#JVX2F8am`)VCVzO1)7b zYfyQ{xx>*ITxFZl)YPvYWk4SMv%5_(qW1L&oHusu9jXU;4+CEtdjuh=ONPY(B^k8Y zg*VgFK`+X3a6x$rXYue#)1;rLQ~F}8*#Thyu?`4<%b=&#JIB=NFm|!7$A-ky>2xvz zoV!7c0O@Et8U$+U{GCfD+%|SA9dXmdp>)EE>PkpaIejy44-b~XGg@$TO!_|2bL`KL z$(CQmxxIx-rw6!4GcTUgg8)MI!+_sylhuwks}K+6^%+LRkZ)N-H~5-$4s*Yd$8OF; zH*(&c0?jM%)}kwz94K6owT`kK4d&S3N=~`1tX@PR2$Q>1MQ4Hr@~vw(#0B_6&^_c=ED0>9_YXQd1&PvirJt}P3869N4edGS+Vtmd{lcg0W20_$AgKu21v$!=xk z{fVlh?NC#XKA`fHb)e%%9}{&mf9FZ++^$}$rh&-g9o0r!F?R%gZ^d8Ny4#Amvhd

{tqK*r|mCjp|Al*1VydERWmeQlqOH_t_}o&*(iqXE4w0#!@g8)AZ^1 z2hmJ)4y-j{hiWZ~u9@TW`m=o)Bw|Wtu8Qm~*2*UuCXk(39`1PfE8fROtC^(Mtg%< zu28lU(o~g;yCKvP#G1@wkz{jML8m`}t(h#We9bZ0K7GLER8}Y)3cy3fR6$W`1(u8E z}+I>#`0BZ^PGWTUN+_pE*rZ+p1lnN zPLD4;h)W_lJlE8e6wWCu!!-=-%BispV_`Vgmy1nN_yNwIIXYobFPln#SFw!?n3Cn^ zV;K)e-2j$H3H*c0DhtL~EV#16S;4S#EH^l9L2IoI?~BO^kDX;REg~$%n;Rx?6V$9< zEG5mZ&U?fb2VNnFZR9L}z+=0>gz>7lVx}qvw$^j{^`muNwsw8k)dBK3k@4;*-9 zV^&9|b`8LuU%x9aCp&;Oi)^+AfVs|4jwcL*^*Gs5@K@N1ne_kOYWfpM39iA|{9nE^ zoS)?i@J3VAFwuBj=b;$6?yMZtId@Wd1;WZNb`itjtSon4evX-6EbZ|}O?BZ1%k&x= z_A%>#4PYUNerI!kUT41FA97W;1Qi3PcJbEQ3oX{BFth>cc4hfqZ1*ogS^Ix57{gQ-}SH{f%*usK_1Ue*)!z)gXURZ!r^RpgSa!m1MO-%sLy zPp!`wnvw3Xg~4YIA2DKBTH2W-Y>9{tPD>j$Y?#9_bi~kMf-t#t@pVrcH{ZYV;*%~j zj6w2A41N3`d9Xp(;-tn=(0@% zxF3+eI$){?3wg;6;C2DG8JI`X8^_%N-0#5LD4&AUya9QC0rv_ptIup)-n%GoG9C`{ zk$ezNN(1r+ApK(bco-oue!V;gy|)3EEg$^Rq5*j+sK2?uEOrWM4Yfxz;0C)4Bi$`< z?HZ8xDAHd9=0f?@Bhccu+w(Xv6PR8(LSDB9aGAih^r0NN0@sjTeVJq!9|E%?U*O1W z;@R^jz)dGWsPx6dIC8_Of-dVSI-V1q&C){t^pOUVJoM zRQr-W4+Lg(G%k+33BXK?#zn~^dszU?gA$j3-woOGQ^33=aaK8^M<;>eo@OjR^4Dt}aei-CDC8W%_2dSKp(#>J7h8<<1UxH$5< z6&Xe!d?++jUdo?KVi<@+L+x=kaFdQ9kJ{r3U~Z1a#mV1tVAe$AqRLD1b^x;{8W%@i zt760Gf)9m6e7GD@@~C~&feA$8;>g2;rHq%O7Dwaa zQ(*px#>J7>X)4Aed?++jUTWXbz>Jr;1pIEOyam8aKZZO9_zQtq7LALOzb(LQkH$rn zm)dtfFbUHTL9ogZN8ZW6oED9Xl9vh@eqd%uTw~?E1ekfpkmrEB2Z7nx1bOcOv!e;} z{s5*+DFh=lmcNsMIZfiMdWkBp12X);lr=$K6)@KvLmt`ly%K{chlcFsS>RqhhCH(8 z&w=?<;u$dP z=YYJgfT@?b#>(63V%Pyb6dEgUIxsoWxH$PM0cKV-E-HUi-kX8BKN=TD-mAd86^)CM z=YYH)fN41$5roFd+Yy)(C9a|JlD(V-%y~_aR|w3EW5^?Wi2!qdG%j9wfq5$$7gb)8 z_X99TqH%HL^(Z%tzW7jRsJzr3ZeYen4Hfk=|(rpSBLp4%i=xl1J<8NDMAk-f6(y)dXB$;5Ih_NBbVT zn}F*D+`%T`D1SX>;$RE$>V?K5PZMyb09V>X+@dDn9FX@y6L4*S`=|-H-oSm;1l)>{D!{?xPHKuGyzBLds7o|WPdL;0e2E`Uo-(ndJi`N z=K!v6B@VU_ubv$^?`;B(>=X~g(n36Wv<1AdiMU6afTOMF^-aWm+5{Z6$8Sx*kzIA4 zg@Y}`D{lv!AJhaK+4Gnt;5q^~wh6dCz!f(EHxRh%n}DPK`$7|OpELnS_I$7jIPwQw zXX9WC@#>lSZ+a7P`Axu4{Y`HIj{L!*Cg7<4UTgx6>~BXCaKnK6s|h%IO!|;29Bd(8 z{gJ#t6L6;jSK9;}`GY6p;cSn&rYwb<8^(K4IHR>;;L_C@9&fg5d~jUQpEa^K4(`yn z-g;s_ZcufFykmPik|1h7J}=-i$4KaiFT*`@BLAOrBK@6nBLACnBLA6lBLA0jVleOg zv7SJ|xcqa@@#c-2SY9?|BF$asACNOk$|n|8R!*E!Q&wI)F@z^h<1W8J#bvW6o`d@w zaY=5Xx(G@49t^6Oar2`7B^{i5WMrOvTL;4*a)DJk7IYHZ+yZDRPunIpoPAM`5LkmzdEi z8>Gqxsd8A55(k7j#8qtQlrfcti*gR}A1XR4VtCYe*&MD3$KXNfr#r;W+YYz7&Es5t z^e(DO0K^5}SOD6FF9ADz3n!*_AAjz7u5qsMu5(@I`D%ZD04IGB7zMu4H~SXOPrZdx zW>tnFKL!^DQ+>h6*S^SZUnIMOCuP;89alSX-W91&S-ZDKZ9S&R&1zb|OkQ{QY8-0o zVHuP{^X}b`aSDW6DYtP-vPdBxvU@J4w4#)jFFWvKPgQL_43d7P(a+-AdQ5tn)in1- zcJ4W^w!W=6N8~-e+WK}j=7`#Q_ftW4b^?2roU^=Kq!{ESWAmCW-)&E z6ZA8}LemHZLfTsDfuxDW_m@mXBD{~)ha&HCvOn@km7iqLJ2URaC&?Iq<82%pfukRYBx5dOc^q44 zoqZUwd+|v!=<;VSpZyZC2RMx`0S7oO5%Q;StP5hqN-}yOCUqbta8AS?N-`lzXb5oZTqq=h$Pq^t@j ztLAcBjo^Uvg;%QFL8n8snb~zJp^UnYQ)E+i!aZHr@`;7dEYZ$KwounvNolfc1?!fk zZoqGUWI}&`WO|xE@{Q}Ff{QkFN1EtY;}FA@ZP;iDj>6_?=U_2g`h3Jh&xs(`50#c= zT!J%q^4WPf3dTK%iC*#qVk9ZaSdZ8MW^6-@?s!NtsIOhXu?~nG&u3L%OUG}aEekQx zn{p8w&WtHmS~X(P{feuc#xgFxHkLgAx-U{z>5CjnKOov+r!VrpYUQU|s8+th2U|#! zCaL&US>lG2P0neS~9>$OW2eTE$q;YU?;@7g?+uQ#3Dy#AGYj(vmx4= z1WF?iZq+h^7k8mEk&(z;Zz3b$GTV%RY6V8n9Y)~rN2*{9-xS!qYdTIB4cmim;X}u5=E$JLP z9upFBjR%3#UE?mK1S7L5t&Z~rRU6fktT7&+F+br7@?(-hW8P%fD^3=*)f;)2{3Z{S zk?m@DT(BW!K?LRUEqo!B-k?K{)wl4K)HKA`cOaz;pH3Z)AHm3s(jZRk@w#I3)=!oJh!M1OzX9W+!0BX9V& zplvV!7;>1Rif#tJKk|{kZV`c4w5Y|D`3ry)qfT{lt*E$`>!~XD%&g^FtIiO0RXs{n zQng#v&R=`{qIRk~h-#_sX4c1g9$u{aSnnW_R(-7JdTyIuZ`H?NzKFNf?1arlfz86X z*8HjZs+f0?pGP@GEt%u)VW3PAbXJ!qHl?W>nS0bCk$f3 zf7xgh)0*#39}PRCU)Or3xotb$wRmq4BR=`DvPQ zp`4L}e3p!#^5sLPpd2r#uRdKCnx;jrHS;MiR07k_14Mjg@0q|39V?p^?N#ezd=!2{9n_NntrKUS!4_h>5&> zjF|8nKUlE@)T!wOXm>&EEIdKgsLjU6qR87(!$aY7A9yZ%}dA_ZR8s6bS@VXizeu(2~y0~^@}^%5-fCu~A} z$xcEOu2TF;GV%};hCUOqFsEH-ouxI0IJ?0*`;m3_XX|W7n5f{=u=f8#AZoi2 z6SW&v7D2@(lsQ|n85Me(X#-6)s>((MlGXoT7*)tJjM<1q8`XW**-h5j?TGz9vuT>y z&?KS}v(Y@;0Ky*Av(@A_;D?k~qcv;82KawzFY%lZZ8r)RMH?Z)3B6+3%e&F`(%=qz z5EGz%WX{?+_~!rr$HA7o=-hK2o62vhfj>}#pug_A4b-l3pt+Lb4LTXyKm#YktEgLu zpaz=<@KX*oY891kwPV0)M_Q2xuP{Hl9r;=bjasoY8qBJ@1CAv$mNmEWY}SuUCz$6r zknD^6ib>9bL5Mn2R_#bx`%{nF!(yT%_FXrCT6&+hWXKEsRJVRTv2;iOmxKVXnE~nG0_qGu9IpHi;0fdSQcSr?k`T75b=u61Sg_4O$o7p#P0 ze9;sMU)#jjF8-?9C%z2Q(XozpWbx&|7guY{YW8Mq6Ya)X-@>J-VdR$$z?HIUOJpal zZGA|h9W>-K%)4i{O|n&}4)eN#*b;k$Q-pnslv_C^neAI_l3mLw!oJ03)+~LKY>K%J z<=yYwmOe087p9}OkrYm?Wh2> z1bzeM9gdAHN>7tZ;r=|GCe!Ac^w2^yWdW`9Xf5hZuMaKwrMh)6QjDft@NG@&VBKrHp#_xx|9W7aC&VsRDMw8A_!Y2lpV7l`qm}@$Y;d5*na*4u1<10 zDf8<%P7cS~a!cVYH(tK%Ucjf5=`?m1sRgRNa_bFOYuKl>Vr1mVo{3T0Zzsr_Zp+(m zjM_6?R(D(8gA-}ym7KP`5hv0*n7eWOGsSbn7vcR#loW#m7lsSxiR|MadpfIHV2XD^ zea$J}1qb5!7f*_3pG(dh(Ih@>1=rP4{}6KFtI336_T+WQzAp}>~VRL z?voKK`$rKg!zamj69Q3Ti0ws8ti%c9=CpjoJRGaAVxu6`%V~bZXcrG2#)_38CVb5t z#DuSziYiMQ&JvU+EkC3zOH-cCT*)7N;9G zVbh)O18Dp%0I@maP5+jrD>TZ{bY-J!y%RZ&*|2*OiQ0zUU6dgDx!AC~ffABoQs&m% z<=Tc_xwc_35{!m*7#UdrorZT92O)9@#0W)KYn_qzSQ5Ji+6NPU z0c95^M|*xd$biFafn<0wi{u9YW{aci;S)B|Kq)M4pk-ZIhzX0k!b-alF<}==5tAd2 zZ0+$pkJ$x#v5z?OQ#T-mW-LCq1@df zA$1nMJ@}rDZ?5wjmY&W+7kpmb2^vnn94F9vXcscBE)e+I~!5OV>Pub)lpn=0%iE1}eaDbiIVQ7(-;LLip;&Ct-9& z(TT~Y7u3h|ZE%%xcD1KD&#irto47%3Q($Uwn3A})!fr~1s3qaNzC(=W(n-c|R;&YB zpp?_juwv9&ZcZyl%)_xdD@ONF2!}?Slft3BhL|u&+O!l7jiyJ!p?!^*aA=1RlWq(> z$bl8Y&rWh->Gc@nJ&`RQn#1`z_!hiXGt9ak*c|@Fw!^DmM3>c3om%Rfx7k^MO|*%r z;gnSu@O=~qoWq+}pBs!^%idDB$q<^&yhx92w*KTWU29UHgB^iXq+O`@MIbX)QF-e5 z=^v6Om>hX0Shtd|j!~&ZJO7A@@L=j%X4dPV0!_5$1bnMqf9t-4*LSNCyr%VPOxBIv zamMkMtNGH|9C_&s6CXH-X4PZl_>FN~tO-^-Az)8_)aY$pJXnBcyS*xM|R ztTDh+$X1fcb9bOAV0W>r%@(8N~~!*CHB>yd(EDUia1EiBggM zR4e^SglKvg*kGK&pkr;A)dd_ux{Lt`oR2w80TAk|Ci@m%QA)LgDk?|qpo%KVn0fbf z(^#l1#3#wP(uz69$}RYLKV$XtDfZZ1kvCnDeYn=f#uvnHJA|Wa-IRJQSmtFHb+3$T z%`4<$k#W(Tn6}!0Plo0+)_l=~O)0C;7g0Zx`Ls{m5|fKX0bPST zvf)$OA%XMB%hnj#+cnvdH+Bz#wFFTGm9Ba92{oO9bropI`qi}VTj#`KPfturQx+UW zG#J?%th>g+y=EN&f{`5Lp)&^3K!47JOc;ZN;hf-!c#~x%xG>zg`2Hi;yj>~&$j7dY zyIQEMM7tRb%9hJucUQ>`u+t^Q=jR z_!Q5ZzJ&pYk4mx74NG-*@YT6s5Q*s4Tio3NF}Ap`OrmUwVJQgv#pIN#9d={~Rh;2lAk}(=FA%&*> zLK{uF=|&fxgS`o=J_lQg6m!=I8%VefFlE*L$Qv}t3e#Mhref#QVKVJB;k#7a<)U3Q ze-c9eKbeDn@xMF=--$W+7m`(bKTZrbB<)2Ew+(27=Pn zuw+Dj#79iZs#hD>zC!wBG=x$6o?%>@I2E+>c}EIvwwSk(#=((d@^wBF;Se2|%3(hD z4&T+n4tXM`zT)0X#>AU^$&IVXK_UxD^)-!canZ#8Bho9@?=M;KX_ZJIy z*uo{iYz3|ZVq*G6xAe*N1T7xTTgWM!@l3f4{!NYpmsOh1bRpJCt~H~vBo(*Epj{mP z+Sh-E4BQvOH3*-A5d?RhuT7@ZIxI5QbwKQZvr{u3bdYj>iih|0!~nwEQ5YW3!fYw= z_7<`Af?ZjRx=sLd*otKC#FuN0hcbl<5F?*?JHYP8;KG8DD^t(+&)d?H%+1*r82`q- ziF=x}V#+UVjL~cv_j`7Xd`5d=<{eI}0oM1w9^(|$3@-`^xg`(Nkj`(OVnH;MVM z1Li|bPYyG1_`eyTuGPWx+fc1g(H3`|9rG87`ft0nrhWH!0IZ_l$UzeNp_% z9t?@%t_`6QOQVnJx0B{o)bkfUlDYx)7pg09h9aA(J%tHK`-=RCyh5jWFAcOvBUCNR zMz)*oQKdPTx>>lKrmB^cFSre11i~Jroe-Ee1*9(5nraeH7R(IOV*HWo`qSu&Y!vz< zi};rPy8BCE%rKrbh{g(eiw{4^&B2$w$2YN{AZw|&)Nhk~oRDl3)MT!OM!};Aq@#YD z50)90MHHUP%q`zWvq&qBnL}S)j)TFXP9;Npxz^BnNL7Kw!5q{HqLXr+W_4$@iEGWR zR1bn~)&y6JtiGHubK)wyExs}{FL&UyO_#W*&dd_+Q*5C6kQWX7k-W;aPD-fVNcGF= zMS^m;uhXowAxArj{&}Dr?EuIkmzZQ^ASTB13lI~tj0j@+_#_#$3K5R>3B-h>U4fWz zpl>23xbGuIt~kl~0WmQvIEvqS_?5)B*^TE|26};Dj6#eMNya$D1Y;3mXEW}03rDx= ze8ISN7Vdq-XoEk=psjncs@aDa?MfsWbkmN|(E~AY_EyAN@Y(yUvoBj`w^?aB5NpM_ zz1G=4ga5f!6}AHGZ6<9^vz&KXnMzJ)KJb?@>dP zIW`^0>C}w8;`u47@_CSQ@*u_5&Vv-W$S?*cwmo=&a3e!fWG4XLc-}FD>?nt2+WYQ} zsBLX1@|iD$^)*6xkstk#Vc?QBAcHO3En@sB#R}Z3Kcm^N(!!NeLLVRPz$jSC{W#oHYsr0TEpp zHN;@onkArf&2hH_4^z*4=dpQ9c;z3dHC(sU+iS3wJYOpK#hT z#KZ`&5;3~{Jjr+mF`?s2>+Gd4Uooa#gP1sb7h+;edjc_$gEtZTilxvPBqZ-aOfddL zjFvS?Mha|Nob7{{IC}+A&U>@>vaQhkzfjdk`q#P)F7zbxFNh>5yikC+&P zXnKPs0RH30yLjeaAuhhbAgGY@+J$2r}W^??Ma8h;F8Ur9#%1axjp0*JulIEC`Sl5~Z z(IyBaOi=vsbM>`!U4?2LBEJDMVa{<7`C~WNI@}iCiljHYqy_zG)+(}yoF!e`@=@;i zfS!SMkU6v+-^kFG^3u4}T;8zq&3mn-Z{tsiK8(9g***E+bGS(!|DM~O4=usSqHB2y zNfZ4$*h$x2cNM9po`@Y$UINe$c!zR1c#H9Q6(f#EFN~# z29hYSS-5{7dT*nmCqwkYb>_h14A!mUaVPS+`M=JHTq@E2X56tXiKfWZjGSS!Eq6CV zlDyACUJ=*;jJee0D*?M{OHBT)rnN{}$|=b-*0$z-esL?2{6CV|>c7Ig)k19bm+O}e zCYg&(ahV{`yxBr$3GUnH^J8=)nsbgsd= ziK&(9Pmoo^>5q_f>+z=JQ5C|+E4Fpk2j#UClUKEK1l{`-w0nvHxr5t8rrlG zQocn@NFl!@q#Qs@NNJ8Pvmd{bjBbbtDNe-1)sV9h6S(sc6IVkjE!pDg7P z#Do`Jh}Z}&(GtXj*9+o8`oamx{)N*!_!m}nr|Wfm8T?w{(tq(UbYm^PGqf-+~07`s0gQ+DZF#NWOu7<8nEYhSQK=PJcMT zYMuA~Pyit$_998RU=!^pWB!U7$;L6vFnZ+3WEZoTZhus>Q!- zB`s$zl|sZw9<4_bji$@{!6t8pB~Qdi-rfID-Y%QGnU*{eBY6+}LwU5SH$w$;sk|aa z@*d-~9{6i``-IMhUVDZSTYq=h@<$CM+C#)h-qS+fX~{;?3v34~M)C!VP)~`@gP4h= z@+zIzP0n9h(L^=WBzOz3U2-j}?q#kQmkX7ApGvwA(8 zXsg%R%%wbt7}djOPUGHPeKO*BNTOuWS%IS*iWt>~U=V7-F=W3DH0q#dlF_r+VI+_1 z#j;J7E>*~_b6PJ9iOt7Ry(tEr z6*x*4F={2jAh~biV}^LLf5b_uMHJv4$tJlc+bkfS?Eebc$+#JGbGsP%dX5F3EI{O) zWLF$R{_jFQ)yqfiIX5Pwp?VPvLfwl3n;~A_X?`TE%bpXm0)f^w2)QJaUIJl;cyejE z11o5qWV9}BXSAN(qLR?(n-qLk<0C9U#7I*MX0ZhfZOvGdL1zVy>QltX0tACl8}Tti zJlS*?2}(+K`E6TRSR2EL(n0bBv$GZJj+oFv^68#lGsM$z9P8-eXo2zIWCP>D26Ilb z3pA3i#!?#R%}|4gs0$IJ(smd59hhtk{QV@O*GK(~&ef+F$;C7w6SEKcrkn~6UBy*UM$+OhXVl0oErBc~-ne=C0GhBv)==$veH#*D8sW_+D7 z5oppN5Lh~d7U$k z<@V^?%IK8P(`dV|^{(V?EjFkz3Tp?@^;YR1OGR>v@DcSOVwBelMP6y`FfNrqm`(GS zL1zVyaw%d|4}w9cXDNF!#FI^X5yC$c$dpSYrC(_fa!KYV$B;Xf<@V@DYlkjaJ9Ng{ zp_9@5L$!983>|ts&`s-RC`LrogNRW{%Y{t4eQo2K4HIi6KDvE%1l|lKhzNNiM)K${ zpC~)k>(Jf|G#PYO;HX|jjOtY|2u1e^n<1X;OO@=+-O(QuqaoRXL2?(_>NcM2tA%W+ zx637xKv z{7C!bBa2Hat0qdd^lZu5g|jbdVfjnQKqu^BBYEHA1lr*|ID;m0c$ z@B_B(xM_HotM%$r+gn`?E74I}h==#v_zt`)(_ubz(ji~-ZHyZIKhiJXr^#;|ETET| zi|0ie9)4h?!&^AJ{4&Q_epR9a@9!*i^ivO&?AHiNJ%qBKVK1-HCmu&>HXzi>$5a}& zw~ssM(Vtw_zQvB271fC1#mW+4J6U5pX=)N;Aiuh%(o(My@i0zP4!st+L`YLQOfl*~ zp(U4AR^T<~R-;f=S%MV|f(y)-n-}1nfOw5&3DqE3heBB| zstoZ2QB@-j@uo$pTJh}AxThLmmCb30gfp;gd(Fs~h+Bmd*{Q55ESOz*30GGkUZ7br z12te!YBAn&JiFpDI%DL_uBfSGd$Hd1KFIJ{)ug(zs9HRK6|a=XOK|bpQ1bz;4laFc z4avr^F{F80&0#xb36mOSgEWGW4{Ws|3aknrDJxIQE}x~$%9e_A(tmElM4Ust|BtId zd&jC~*zub$wmvH>Duw4X-v&LS0T+wM@YcY=s;BSjFL*W1DXFTN!Eb(*Ps(-3N{{a` zk0nl-BI-7}v)h^{UZHKLh1K?HIkii_p6h!atQoU>?!@PBdh^iS+u!@VvclKv-61Dd zZoToso?UZNHniE5)A_*Be!u*^;f5c^tiAX@Pk#N>j>QMAUp`~w$f+L<+H=;OE#G^7 zPIpJe?ejZ)JLcVy>%N)(VyhP~Tk5SCJ#6;qtz9#p&6xGph{_(9-}T^bS8ml86b-m><~*Vp}ia^AX%>q{3+$lTcZ)7STQ`}Vww z)DI?{a=GKf3p+0D^3~#I9WGt_b>az{Jru%*E=^pbln%`@9kfG@JqqL9zmbNrT-x+AsJ2yKU=J*5s{w`>jvBAHA^kzgL}i z&kudlUYqmufh#V5>xYZK=(qTlD`%b1Z{=gBTyVyuTaso6?)q-pn7OPF3WWL{PA zi`Tv8Z`1#;`8Qs_H0|NVlYgGJ?9Jy_4(y$CU&fMi=jNVNvhnXHzswx7`@C*98>i-{ zEdTWGX*ZvIZ~p@aE>8P)!+@i%Zhsh`3dS}Abr>!W>ey7c#+6%sK7a8^5?C)QDYtap(*33FQe_DEE)W{FN zJh}all$Jj<-#_z}H%cr1bJvS&U%kg!Kj^#Gt|@2z+GhF1+ee*{|Mm2{PrJ(h#r9pF zz2^Pm;F|+ieV%^&g5^6dPPky^i+8n6yK?1+-X9k)I&N0^UVn?)vrCUGdB8jBizEM8 z|G|o#i>iB8Y%g2#+n3|+xhiq~M*|=HbZ)QPrmehlz_*JX(;v?2KX1;2n^(0+D(f~n z@4siX-tzX{_dR-aX->{nvvv)Au73V=zZCX)X3K}e=YRKL=Rb$P=O6T1;pA&>yQ%pF zzo%AS@b=#3C$8M@Nx7u;iOpYcH@S;{>Ds4mYrkW4_xA=r|98^48{76=`oiZW>!$B= zZ$7l*zy((hA5!q$8-@Pyr~P_e>&YFK-|`N>9;~JmVL48q9rX?rVVcP z>z@PbKCbX}U*2}E)9Cq4yDe`I`}mGqe)#tD*|!{DwEC7`e?78f$=>x--ZFmpW9Jj2 zZ@TZPPg+#oxcuzupD$Z^{P`z8d$9Q@EhkL6@QSp8-zWdM;?k#oTRuW6`xVcOi?engcz5jJE?bujTHtGuS~u_hlABL!K4!~<$+kR1_9l;8UjJFY z7YfT|y9&GbaZDQT0i@)#ExAIEQJ*O{u z@$MdN{{E@!oWV0zrJQv_;k|bZxu{dksV(08%=vJ)oq2EF{d1dpU;KFE$a_Ax!u@r5 z?^kywZy!Ep_ca5zuDI!s!*_P=v|#A|y$MH>(zkBje&&)HgPyx^dCIok_q}%{{i=)h zUhkfNRf`jM4!&dMz%Nd_>bpPhSh(ZRzyn>+SoeO`xSp4MmfL?^_x`yn>mws(f3$jJ z_V`bJyyT7_A3BsXZ_JXVU*Gg+`>*Op-SpfU!9Bf_Gw%5Muyf3wU*}&~-{;+PH*9M5 z%_BL#9vbuD4F}SV3ERt;^=fu`tHob^aOu>C_uVtT`_Z!p92q!!;$NRs&Z}I}=d)q2 z|F+neaqGdAt@n?gnY_wz+9k>Dy8d!Tk9Rij4ktW!)#-I>7QRZ$4hl|sG5nyi;(Hb* zCDhl`BF#A!@6sNWmUc@*!nHC5i-$ooig6A%$TG(M{$#8;jKqX9NSGGv?@p!_Tw=lo z?L7Ukzwd^mCng+_m`$5o&?-;{bJar_u^K!Pv3>Y3%do#MnXriowDm+w)aLFJe-iIm zvSXSvhPHhOvvt(FV`DKb7(?4l?GYQdYG8US26u@-7j2(WX6yEDKR*^jOT@$k+G?jI z_{1+)Umc5~3!;e$bcqUEnZ{`^4!k)QLz}3H33Qo_BnFzl1eH|x_Hq$BF@Y|f5vJEO zoi@f|XqlauK$owm7V2Nm=@yH@);BP8iIC)M`#$l@SPa!lVgg0SFI|s&M zIx*%^904;9>{+`$7DE=1m_VE2s2F3$!4ti)m@bT=4JxXI3!cgtAB*YA7+SEOhS;_v zUw#pbAq|NMw82A|#VdlJ#A3*55)){{#(~&nFWrqRYN#x&-FqFWtkYuHl%aj&Y%H1-hxs~#^Oi8g)_REwG zR!UoPZ3sP(A~MoXrgX7VJTj%5l|nZeQ|NA`h+9i>q0~xwR$^3py{4tiD49`INxS?U zs7;ZAT@`yuYA|oeaG5}!t%ZRUGXbwrktrEwuOxrQn8AYw3mT0DdJ1`dkuo$xU}#L? zlrv4yDsqy-4}`#ku1h&y6A=no32;B8KhXNC5thdE(f!^<4ED`syWAX zvg+_V$#URKqNb}CrC4?N2OD^^Epa0JF^x_TouF@b7{+G|-#uW#E~x<*MBV>DfT zm}R!tv#p_G8jHc_97+q~FT|Y_| zV>Dg;G+iGLdc3b<9Zyp$1jcB(`Xg1Z!&a8AkYq7N(}ii1t-aEM&t0fkb0v#0nl74~ zDP7@h-D_|`9cdI+Nfu)?T{K%!w(;7kCHacAPqG-J={lWRrfu}y`MjsSr3=@9IWR`k zg=w5kSFUs3aK$=XvKXW38pJHJdFo$h9cVd0u`ZP?#%Q`|6{E`a=HubZ73)FCVvMGX z{F&;@k3IQOtzx|`S&Y$ik;hfKejPLICdK+qvKXW3B2TH>EA`xtza(3AcmfRz2#nEm zk(*Y!^3Hh6rC2`6VvMGX1_|X4PriG|QN^l~EXHWMXp~U8c0Pame--Ni$zqJAYZ$Z4 z_HwtMGgGm)N)}@@T{K21UEMlOYo%E9Kt>9T(R9&>q}prf1+Sf_Sp8@qMPQ7kYXnl2 zt~Yip$W$!41BC)(G+iT+s&qZ{`h5o#t5&iYqv<+}S*Abyz1h_%iuH_SF-Frh%F>01 zG5PDqFYIjD#^;j77){q`UDu1A>lG`RvVg!CP1hKtD%<$!k2mjBEZoPyfiaq{OlFzo zYID``^A&4~WHCn52hhhzP!#eUa{6m7GpGBS`s>AOmf4)Moe3Hc&O_!Hhloj%9E0>;w zzZRGtdyZr=M$?teEOWlm?C;&n6zdVmVvMFMN7HrD;lm}0^`T@jM$_f9Scn*lFZkeu zT>)m9bvR-A z6*no?U6REZO;?avG=5PIZ*}-@RIII%#TZRjNYi!N+?P*MtOVL1L12ugD-WrOxN%9$ zquSos{)3iQ9cD-tV>Dg)%reXM)%^M+id89DjL~$3ndP7(K36Uew^OVqC5thduCtkC z>e~O+jGl`1y<{;)({&EBOgl`U`9zjt^`>M5#%Q|6B31d`UWbxqDAq-i#TZT3IA+ld zkmjPxGg51ktUA0~vKXW38n5a4>6@!AR;;%ri!qw6bD8D9k#tQzwcy(pmM(ga0R_fr zy3RwYD%X+Rv|);MMn@*`-$yVrx2=iJXO;s;(lvMc`FKQ{=>du*i!qw63z%iL*Um>z zUaeS5C5thdt_zvvz>#zvoYm|04wkO%lEoNJ*92ynx@La%$PmRkAX$vjbWLOy`FRR| ze?PgXho!6gaUzv5nyyJWq3UqX?v{fT>nzD)jHc@%W>H_Ja=kNc>MLC=U6Uk>F`BLd zP1g-y?Cq>rb0v#0ny$&rGRLnTn?BvDSdU2-V>Dfbny&v&_<6Bny(?La(R58=78xA% z<>Fzhmn+tn>S>;94Nex_KZlEoNJ*HmVib=c~?6Iv_QV##8RrfZs}tLugZeH7~z$zqJAtCU%0 z9ae3-r%17WkSxY%y2>7yw${VDTDtC*EXHWMW@x$+Mo#UjSZ_!cV>DeenMJ3` z4qw}ld!=ISmn_C;x+*kX8^3#gwql*s1t$?0qv@(ds+t3geCp9t6)PZFjL~$>VwPEl z1<%eJt5}yx7GpGBvzcYu#=w+s-%+ebC5thdt}0Dek8^KMRjdysi!qw6YE9QK+Xk;t zta`~}jHatb)Ac~7@(UH~^sYFGz!;8QAXDf^GwpiZ9HfZeP3O*e=(T4FA;NUYB8<+u z1SyFLmr7h^aNZEbx?i#gqq7K~n9yFbJ{`L1CB^zwvIwKIE@RedlJ(AKvwl;oBa%fJ zopm|0`byU8D=<|DLWE)6#5ZAd))h!eG^cCE_pha%p;#A77GZSOmCWjeBZbV{^KMhD zn=2yB8<+eWtIa+3X|X3^@d_SCRv2hS#yz+n9znO z2>)Jo?=Z#sOtJ{0v*sZsF`+k65DwjU%}~WUBw2*fS@V&Sm~bLd5Pn~Gd6r^j^bo0p z(OCzu?L zD->&zWD!PZMVNIGjubj?Xol&bS*|6LMHrohj)8KSIo$mG@1H5w+mb~XomIyy2aXh$ zJzQn8jlU&}Fgj}yQj|X|O6&Em(v@*MNfLj;)mb+qH8H{Lm9;0lk)c@Sl0_JubqllP zX(RI1M@5SDfJ`Qg&RVRo_MiCbFN(EIvIwKIZe^A%wsBeeZg(kGy<`zaXZ=fKeOq^W zo?;D>=1CZx1^0*AFm2=ciY)=fnj~3-(OI`M%j_w8-*5APVl9y@!sx6!m_;Ksg%c(` z*;%n(lPtpMtUHmS`tmck2A3<=calXIowbBn9dV?P`^PhXDpp77P6(s3P|?uUhbRa) z-1AJiVx1{jgwa`dBPB6mAW;zdwQKo|V%10%VRY6#NKyW<-3`6a2xk9UCRv2hSxYrm zN!^gE6l<4c5k_a-%Pg}mPfp$8P^@k;nJ_x*K4wXw#?TM%8KqbO$s&x-x}RCHVT|7g zbb3#*u8}Ol=&T1cRmg>DzIS|Rn{DRM z`(&I%AdJp>7%8f~o-AJZoyy_4l0_Ju^$4@f{?+f_Nrj4aqht|AXFbZSVK`Fw@U1iZ zE7m&6B8<*@3@M5D^O*=!Di-7@)*;CvjLv$TS*EVXR~~s%vHClNEW+rlCzy4rIBj%D zD!)>(iX0-DFgj})Qk3t#y~Q#hO`E?HaSDVHY414bw+N6^R64zC7zPFeWD#=0&H0Dz z@TCLy2Tds{#y>O))J@Li|A)8tfRCz5-^Xvr0HIDmI-(;+r4tCDYwl!bk~_&vGSXEv zgcK49NlYd*btMLbI0SoHLB+MNx+*FVEObFpifch#T`cPw11r`ATYk@b&h2w2x$OV@ z`5%~@_n!Ma?|aI7%00K`&o3&g7WiWuY$va>s;Ibhsft}*R8>*ByeJQM(dV)IaTFz$ zc<=>}sw~Qr5h_D|vVopz0Hb12UU*q$k@;wA&u-9d{q*1r-GQAS4p)`V#~t9+QFr?j ztaK53aD(oHr(JrMCXa3s1c5~?$}ceNlS+2iJG<#$eu9LUrURwrP?0x(nPS&;xS}T9 z>hb*fc$|bKAo`&NrTnN8cu}#3RCrO97ODkRSTw(80cxYPJe;?vdVytp74Fqg^y%^Q zYl@k5_9zM->A$L2_L~F$z&lisoM>3k!?$@N^A% z4|6XIO!UJidJ9%h6vaHwp2krh%!moo9xma}3RGL9s+9*mV(N|gkU})W_>5ch@q(yF zwxTf>&rn2z$a5{9S&D|r4JY=q78aB?pMc}_r>NFSUVHAtLaY3ghW>$y*6=nT-{P>M zD&4aiX5Z5tqKEtPl;`l!iBuKo4z~S_mqod&nYU7;&nvjqLSA0xbb5BFtf=g0-d2*p0QN)r4+Kx$1>#KiQT63r1T; z^xmxWv2B^L9B${#I57)Nnb5`_M!31?Nm<)Wo;k~2rLD)8 zJJ14E4(X?qy zKQ+>&F{U~7Oedyh4IwMh&e_fLUuCA;8X`)G#o3db7EO&6M(IFWM=4!K>nN^kOj7G8 zuB$CnR0d<60Y>FACNMgyF`?1ux19GwiF=CSsY!8O|ibImDdqS+ppR!_11M^#c( zRaH?{Eu^L8dBnVAk6X-;ypr4Rc8k%&py5!&s*m1!l$JW3y*Mf@mEIhcmYOyZlcBWK z`Fdt{MrL|WPF7A^OuSFZz;ufqcX~#q*XyxJr(rckwH6SwJ-HdVQZPrv+nb;bYhp!J z>S2#Z^k;|C-8r71s9SbVOJ%Obi##pKlY#Qao1&-=YE*7|ju^Zew!8= z8diUc=vtKl@AU`VfgI8NUM@>`wiwKE`+T8*FQ)p^#hUhPF+JBC3I;t{G1cqf9=N+Z zH!BxTqwAUU)oFe`lx8VY3`wZZbhH#2QKGJ!X-Kyy<>uyw0+|e`d;gaP$q>`M0V&&` zlP$7$g2|0jeJfbnI1P*OB0T_gZoepLu3#QJykb^%c9z%cbL%{tJ6T$)ZXDM+(L&V* zx{WMJLcK~s3rCP$l`GLW9x*F`4l9s@k&wOcEtVZhs-70~27>9i0k`U^*2y!_(EM^j zo?vc(cAE!E(zK{1e?6+}<%v9hCb{IfJO zK`}k($?&H8WEZryqGNcxBAP^cj+EokxuNaKlEe&mPL40r-%7v2Ux22j5ra!c0Asx* zg$%uy+1=4}HBN>Y$o6DsMQ%=dt`zWP=nBIyV(@n-=2xnz^Z3L- zMy}fz2v`=N&V%zr!-X(@39R$zag)ZnbYaYdiIXOcPfngNNf!xmOmg!0@#9^taTCTQ zr?5lwIv3vblyJ*~&t1KKAwG5_-*TaUXAs>)f!kn&x0Kt?D1t)gL_z=FAd1?9->)W| zC?uxq-yKA_!T4<-NRk#rK@|1x$Dt$i=9|xeTO!|T)Dv;8#Lzr5j$T_l9C!6Blka8e z8UuF>@!tV+#03F?vTLPp0pkDV5`@5c5D+@zXNCI;@wWrBlrn^nfS(m^G7RkprriY$ z#@^Flg=@m$H-UNKLXM+5;;eAV$nW%v1fgyS$IXR%%5JMa{Lc!^t7^5TPzo#xGNeg0PvZ#M=1|1=sV;af> zKML{qF`P*s-9$Y~#t@D|EPWZkO>09R*{!sx?>gYtw4o2TdkT*Mv(1cS=lGOb9?0%d zV7@ftO!=jD({4IGm5Lt)wOlOpB?B|nj5Fz@c73^wVG6N{Retk6GYB`(AkLowwroLIg&2K{=)$aB(6nw=VcC@0ZIMvP&UWecS}x z?QQ6Df&UyZhh-ePxtRJs0_LkW^s#Qt^;O`8E5i8()SoJ+srr%eMf=$(u}jv*KQ8p)rB7gH6IrG#sMRmaVC9K zA6EfWZpK;YTMNv+W}Hc1Kj_;G%t0B~n*SXI=1Uo;=EI~f3HsVyCI}beM?u9|q|XaX z$c!`Tqx_Zw^CvUTLf-~po-pG~`Y3&`1M`g;XQ40Qa`-BK6x4i}^ilf80+VjWS?HSw zOqm&Hq3>oH!wh2+t9{%D++%I%>j(ZGVE$poS)}h5U^-mEt;WhP=}Q7;su^dY?{Z*@ z%{Ytvt_0>zGtNTaCSYDO<4pQoNZ&tz`OS>8&^KT%{1iV5t>xDX%v>|hLf>*=ZZhLc z=_7x61eh1iI17F60Q0FCXVT|_zTbd3`$`B1t+n3^ff*~~V&#|mzYs8mW}HR(ZUknX z8D~l#<@ae|UNPe=^nC=(S7w|^AEnQ672bx39|biZ7W&2mlWxYD^ilfe0aIzlS?F5_ z%zb8D75fwjOABpC-⪻M2d+x-#6i|#lihixKI?1+M6d&(Zv5+>7&!=D{SDV0#|DT z*B`i7ZQ#xa?tL4$6yQ$Vz~R(f7%>kUU9ie8JzaU_JRJz46>cEn*Vw?(yyRgUxIVx= zYXf&SaC>dwoWOl%14sH!+Q88hcwO_c(FLn=p>c4M4IKI3l{Rn#fUB{ABYn5nz)^l5 zw}GR2+ie5a1GqyraFo7dHgLUxJ7p8sZ9c%dU{xQ~Zw$79BfDd5;xcXEs6U-+14r$x z(gu$7t+#J5P&BmzS0=aCvZrvlNfUVfa4pnee~v%kS~pptbGJ zDcXA5uD|r?v;5_?S9N@#)93r2NZBC7N%eD+5@$=b$Dc#?qzH-*e^T~H^(&J$vKV(| zfWJK5-FOF%Zi{EJr=`f8M2R1e>b*&>uMsUcH&5>&HF%RmccVx!IuOAA3@LJm0c2H? zqlj3wBYY76L)?w`L9eW9Tb#mU_{i?2!xRx=Iv)dWjW=mJT~HCEx*d+Icwf@|;17YIt{ZyObSLWGyekgi8! z96}nTJ}i!|Bhj8ixEfm;Ssd*9?;IDwet(9$50c1^evIweEbbdfZWi}Fwxr3yzNO5$ z-C*flh8qk?WJl>T7e6{3(qMLUp?b6yQaQtsCnZSrWl4!reK@I~RDWHP%RNh~J1$C* z)9%QJ?#O;$7qBffSwUfDr&1LkEY)?^f%7wU%K$9-&7b4{+KuywVZ zENfzDcVj-3F<&L3Qu^+#!hJ0*n?@`9Y`1wC)oiCH-om`NA){U0scuV(8hfA>WTe0X3Ok#G0a9_wp=rdUG4{S;jWRgq&ZR~oHS30T$fZL)$I}8SM45(vdLiO zItg1|{t~2dto*6YOWDyS*iK+^b&xpjLG|dfkY?cL5dMQLU1)X)zd+)+KBzmc`E8YDoQv@x_AZsy+FFS z6KvHiOxe*Gj}j@Ka@u((ynZg#XE}s-RNLf8fT6SNn&QHJ z>rTgods3@1>Sy~~ksd*3lupuf@pA~MVfIRC2l@|qE@c;~JI!*(n)NWNW=$uHTIZnD zXrQ4R;sy6sx)(rdpc$?ZIY0>zk=NwBCW@fz!*ovX5NHO%tKdRN%aKHfa0w(4KZoGM z*2^Tikhz#0r3$BbIkD8j(9Et&>K7pYcC*Asz7IyeOL-?4IVD9thCt9Nokmp&T@ zIDTLA!n&7F;aH!Vi=;?|BAuJ#ro3L$UutkW{Pi8BNFCi?Ak}@1y$+Fm%~RBFGZSE? zD@DnXa_8+H0%ckFIoO-Hd0C0rC--u& zPuA0(L%0LmIu^GP6317IqciX2B}FV&BBzOMt3>r0gG zB(kg$MHw7^(z)fMVB{DZ$9yR#28hksPTMkGK zGq8_H-cntMYy>CZxeQ@hGENFJZ z;Mh^x`E`6?%E@ZzyBqrYLSJ$HEhT7|q*jXLR7&-=mDoj24&!%hpYJGnVExR0IJc}O zTyeecuoPKM80q3uE%3$mTj{f5Qo}t<`Qdk@hTvg2qv34JR3#2hjOIK{U7Wyg?AD+eO ztbA#y%FaZ>A(^BM)d-c1DYWfOR%#OfJie%4|R=pAK&MH{K zo-BAuR280i?#3^mQ)!+1JS8wI&qS%GQ4@r|?1qNooo^%nwPXs8yup!yDQ_$p;cw^~SM07kH9VXsMRrP4-mKb+w!zBOU*C=m zr2hIYJi^_$n(RdmG@tEmq;es#hr97QS?u6$q?w6aW$H*{nrmxq9^*p;#)q*=RkB@f z>Raf!34R9;P+h$vB>K3QgMD$Gm+N`h=be23PSI~Bb@w#=L_hCFcaC0sWztrbywk6u zgKeSWUfmy^gj&!J=Z&4P@7$c;j-~{d?O*Pok+#ISxhhWD`Bj3{Psq{K7{*h`x=`@{5!sSN`sGlX3wBO&S_i6ZV~3;-$LXtYIVjJyhD`KRG>^cqO z`g`lynSwOsQ)eAbrJd*E@asIkaG*bNrPNZrGUAg>NeS zsu{6)8~~(cSu$eN(|-`C3qZ|R$y|41d+Z|pjArO@n&-P4e?|2+qi@eF zaW@u|a_S$I#iIZgYj}ov2Ai^&{+~3Lko6AXdS#xTqKzKBmt&(xlLLCx^nCzz>Wo4; zJ7NB9O+ErwRmpEtTFA8(4Ll8+lg3u0b2M6*xfnl(K+`5ZRiKu@rwadoG=?4h0oxZ~ z(IL>BoeypoLE?iOeaDujE)L;KNK=@!1!bDSq`i>%62S>b{N(;zc;73)I)p4pJnmLV zC5+JsX)`-|1QNIQ1tf0m8%Q+pID}5<{zb-^42d6gL*hpZ)uT%w@r8zGAn~P%4BY4L_N?@>5%IF z7|cDG=e!a5fL8Ndz>=H%TNC)+A`KkZ2x?B{`ga3wx1ghj0NT?i&*zagT6A;wu(( z7RZlY25ALj&`E@dpF?;a+l5T}65Czu=y#AfBOd!)A1$^{XSgy*bc*5-mO$dG9V;Pm z2Aw-{2Aw-{pL`b5e*7G)-E-VQ6-OS6#iKG>qs8J8E&hjaP`@0qGD)NurMQZ*W8uYo zt&F^wce`xW%$65(eADyLTetlb^47<>in58-2JXd9=c>7Ee+ye~YAA8gY$njKGKo$C zNtz%kg0iS1%NSFxGS-B)@ z=Tj_djB)`m#f)C;tU#AS>Fh|}?(Bif4YZj@n@VSol}Rgbbmbf2zRtwvouRC|uPmZbzBv zN>SJtQa!{U`66%k z0Azu$#f*UT5Fq;X!ED6wmM{|%Z;Qo{xc@JL#M|O3NFsg?;d5*Ym_$Cv+fFBF<&2S# z9$_{nVC!bMG)R}Avv3HswnOdFAylXmt0hglmaF5}CF8A(b;p9>1(E z+bGR{AqH)WivIsRh;2gh)In?!cCfn4n}09osw>(4bj%Z}?Z>BJrGkxU?yZyqYWRVM zo5cit;1TWc&Ye>2uG1YcP6xE*AUVmj9DV>D!3ET!-Hqdr8QD3tah3NCbj=H67tRp2 zlHx$abEHz5^53x16Sy0*K{xR>jonU*7fnYgT{xLiMt@qGhrt=dz>l{8W=ZW=2u$ZM za#G!mvnX}cQaD2%w*rxUYyf|ovsrdVsO@krIELy$HhAZ-DP=pYB{#bRn|-8n<^dxtO#68BA-({c~bfW%wxZ1w0>ka+7| z3`xY#A-s<*wQq+&6CSSRzmS@k<__43?C4NP$5|ZBow_^LgJd~Tk*Ud{|1S-W4ai|aRVW79G#Bwc1-j2Q@}dd z6Sf>j%LE+9F7?p$9Z`y0Q<>AywH+=}`KKIluKp3J@w4T@Zy;fLP^#O-Rx+qbhn!oE z0=48%f#GlZr+m0%aU=BOa@vQBy%HLU;-l0*E50M2QMnu6#u&$ZTy{5TW7i~TGDH_> z#Jt^7!@BE{L=09OQ~$sU%!v6lI5ufgacsPFH}1nmkG{e(6gG86KXfZDkd4*Hsza?)A(b8pCDf0Xi zs8U*z?B$PikRs0=CO&rC`y)R!$4im%fk^#PtN=MT-*y;(0#kl>t|ot%B5z}bI?g}* zP~;bB%1-C%azwh<^z}F7#jSiN+`}8$gzPcF8kSmc`O3I%Snf7M3gLGxKmxdo;siN*$ zTyt$ZsUaJg*@r$BSIiREkPIPVjVDfu%<9LrMm8TqLE=hZ*%VqYY%d|vD2a{82V42_ z4}VLkqPm^GyBkxGM699nndHt>iS9LyB^w+czcpt|SURFPAsV7~pt=2ay5vVq1{YOP z(Nyaz7>btfc%ix*bG35hLk>BXs%0M<`W&`IcE#@QIB*d4;SdHw;*LBL5_exZ38T4} zL--b3-dK79O>3_XVFb3EK@OkJa5Nv}xYyL9D6QS{9#n)BU~vl|9Rb!M(9`2w z-%XHs3fLTmU%*!~*U@@#;-@S$NuIOGNw+4UY;<$wOQpz+B#F(T=`J5E7#<45?_%{p zCpR@?0ufBF*;Ja28_B&Wiss&=WR6TyOS`{yf@I^E1LLHVPBim&cSDZ9V0oqaF3;-- zNIb71BwpI{AeG_g5U9K2C3Y7iUSbbGqS>WGcnT8N@+zd5CDvk{Kt9W(Y0-+MlZCJ& zrKLFww+7H)EH%^$BK}O-zqljwxaQ>7K%er@zC@jh@V4?Bn&qzmk<|)rP=}eH%I~7lY4`9MMB6_%UH{J~+ra`Z%9;qUq zlQ#7tmlQRBtCHYvB6CVQ|CQp8@D4ii98FMhiEc@TH2jD(<@+U?mS@Pv=~9Z4-sbi%s~v_~9B*0|hu&e?-5T6s|3DpE*9cAG_%v;yS`Sr_ zXi?Z9tcE1w=Me74mOD0`6Z7tY7Dl*Z(-lAN*k?nEWA!=|60g@Oka)cYBLA2^(>()g z8f>_Vx}njR@?`*(74qXE3$D7-H9%U=RIdTzy3jD}(=|hX{k6xOTP6qVuiYPLSl-TG zU)`^G=b?mP{lcTc`s%|Hs<_vRrOvpT?h;n5Xt%u-+27n#ieTheaS}<#E=3Q*71(0@ z?Tu?i#Z&f$XE?XGFAAT~?sZ-`z-VM>>=FKo4Wwgq%;U+Uox3;9Ru@cBz(}+nR6{F`OjU zo<=#gtLcXE-kXSnO*E1>)c)4e@_XH>xW(7ko=(8=@WR^DsEl^u%W6-fa@vJ6Yfq!H z+SPPG4!q5IwWqsMtgrSo299>&lv?^qb-QqC?dcx$_x#$^J?U?c+S6y@uh;4Qm$$wU z#0$x6GAuTqO_GbGo+O=3QUXcTX$Kk#sRzPZEzTifaU$-sU-ZhJE)#n z@luhqQs52?$6HLLt`xG;*=7T;m8@FzXX`J!&|F#8$!da?r>sb68q8y~(+2KAY<3@r zyvVNi2Qc~Bfs9DlrvXXAYy9i zR0&5_A-|B0=&Wj)jGfe`rBH<0k{7qOLgM|}8<1{+X@@{}@bVt684^ERz+DGI2tS9= z6_`tzbQz@E8G{y7xE5NB;@rC+O=LJav86o+yWGKX+g03XG&H&`!6A%?#E<4cx|cDo zge0<~Yap#>akoQqv$(Zz>Pbvm4~cXC0_g#Uqn5(CuR~hP;*LV9XVRCDIO97=Jk4?F zj(L7BfmF^kUkZtH3m|cBSdF_064%n89^C+m>w6j!*C)=@-4odGbW$=^Ck75AMZXxn zio7I%dji?*Iym#98xYV1i8PSR^J5>iUgD3O3Piq{v)HNA3UVln1kRPO zz<3}sFCn<((LM>X=Mx*1lu7 z7w~iE(BNU`P~VQ%eV_4eU!wJCB&sqn1(=*4o^s zwwaO^?q1g%2iw2G_Hx7{Hxn>q@H2YnmV=Q~>cEckk(RInqbfRL{oT-sEaAIAewhvF zU0-G+di$4YK;KRSI!z5Lshgg|XBISVqb7wm=nm-W;RneZ)Pl zk~*_anh-nbLCe^EK4LEj2d4)L-P2=R-!6rwQ~CSRf*3j2Xs^!Qs5)h z0+~|S$!y2w8B_)fXjsDO^gMFYReOO`yZs-aMOQK|*59jI_;ihmhG~_T(d4!oX`r4( zKkiVKt2dusxtm?NYUa~A%UqtY%q7y^u_;KCs0KQhG~JfYZ^&(0jN`?0H=w)Thx!fR zF1IZ^l?W_~xN+-Shm;*nIl%Edh`rQ3Dg)xZt!0~~o86ak4$Si_Hjh9mz|SFQ!`m_J z^D8VTAi3GmpRnauSo)$gXie53oTEw?s1i*M_|a5VnyO0kAn{X(VW`zyra2YT1SUNN zDa52kNPOTt2N~i+-dIR{_?QWa4{v#p+>G%Yq{&R$4QTw;F#as42PjGG4O7&{tJk6s0dbIT#|!Rls6eDHe`61V#jB(9Ifl~0(KcOh}^ zmyo>7#&?kD+LS{$1QJ1?R?fb_kuvB?z6Tb*KcK*`vP{C?X!Z z6e$7HjVvy1Kxbhm{9mHuT=d^u~2)Cv=$BE}7If(MAr{_{($2CCcSS7S~$o=ICsORSjGs z4UcIWzC^u*Q7?s^P(KO6fN6bB;-Em?sS;`+@HB9VG(64X^r=qP*`#F`&fpR;HgQJp z1fe(V^@hFPu-AK9k7GC>&|4*yuml2UbBWkg-tj_Qm-a%JzjQp-en)&IFDpTyyDF5h z6ar^*iI}gkxbsFP2qWPWgMNg~cRL9QGpP18b}z`B(@&M?%!jkdMj`qJC0NN@6q3?`QLf>&C zaR=EjA+eJ4M3gw?brC~S92+1>Kv<3+*U2T)`96y?r-bfgP{OqkIEzcfqUD=-q5rw< zg>K{e3*F-S2)qyBeoVEXrQmLz7hI?6;u7iloa-9gN$B-?x079tbvoQ}NBc_0y!hmH zAsj-Oho3Q5boZGOXl0bAk4vQUYZe#h>>xM`I||Nm_&c@>E2CpLqJ%#|;7l$N^FJ(( zl}91^s4AYX6orDnH!uYG0GEjMBa35w6#7F73WJVv9C-+rsC+nsP2$x)txCTOvrL4)p%2q#aOGYSqiKL~6OH>|QFX_x_LodyosGK{a z5c}X&bbT@CBej%%#+J-@};RIA?po`8j%k z9UUt>ggD$Iv*^!4{CEv=iE5BWDCEAoL+D=EO=v%^I{^iSMJ36x8JTD)gDi?qL)Y1TR`~;rt+b(;M&PIxO6roUOr@_3!P5Nfgd-fO_J>()y`=M@HuM(DdTDeylQfgw6r4*a!79yV|3jKdXF(f!tC(K;Oh!S~ zvPyh>37-lI|6jbgqpWm3y|)hEiYhNJDw|taR9QV&e&_#O9IMK&T4wPIj{-seT>yMU zs1TnJ#|N_ug=s|vMWu_2Ts7tR$V^c|xTw&jes0CZKWkJp%E0DdA}X!UQ@_=bhfgC_ zmsXTl<2&-!`{;?$`b%n0#(go%D;hL%ME^v;d?r+isIs; zs-nVCf=AQhnuU)c6)&6YnjXz|4RI0QHB_)r?JBG&sxH4M>{^r`E+}zP!d&<|fcz34 z`ikULQCU?{fbUOPm7fLJT-3t+{6a&Lh5iUB&r$p-UlS z=!;olxD<0sQ18ouix3~`|j@P+n5lz3%PQI*~#k3h~*lZJS!A``3%N2pj* zZf3GC@fae(jE<}>si-L{bd?vODo}lul||)xAL1^g^FLk&F8ZJrIkA#u)HOL0t7%=? zM9~!L&S-u`O?jb9{!3~=U+yX?Dp*)uvq-3+x2B>CR`&H!-pjB-qq1gxS!qGu(xrtZMS0aF`FN3- zzkG3iS!tn*AEIJ)l@*mQ2$xKDT~On?g!&I5R8)n0ETZmm0c%{)98D2@> zosJS{z*IlfNIfn^$X`E`ZBwk`eF8fF(z3Fm1^Hzp)|9J5lHf9h^E(#zzG%Sq0evoz zo}W1M()%{ft{8aV*fl?1ICbrv|G4<=t=Z4tH0j>=@B3kN(eBPQWpV4Kb@^G!7%}P3?>+H; z;OHmkyT|)GwT zdf^|^pr-ks_K&~*#kwDFJ!jzb;phH-varkc`XA>DOA4GBKIs=l-_-7xHP70+e^=bj zOZE=y`Fh8Ucbp&mP<-e23Vzzsz|ro%-}Ks=Kfg7y=YlSMBUibyk4}AO*QDP5+g@DU z_w-XY{q@J?v%b4*;C2Y9&8U zH=lgEa>c^Vuf8?-_?snb-wl8L%)qA}dOcA&K2JP!@Yj=n`)bt4+uF5Tbi7~af(-|+ zT)AcC`Rflnb?l9zhmUpmIPa}j_uo@+=mOdwa&Bs5Z>aC#;Gg!t^~LDqhI86? zIoRQwIiHU#efY!ACiLn3=~c&;-+kFbeI zriCk?O#SxWkI(5gI=4Dwk?`}}A)R07-Tu*qN8-vC-gEwa-#Ff?{^ZwtKD_9%Q@vj* zxc1uSw=e(hjcel<-f`nH*G-$RdtiTXPsgdf3ir%->&3@A|9jb(i?=GrckDcG^}gJ* z$1Iwa+vBb^&A-&Gzxq4jKb5O@E?(E6>8rI5jyU|n>AnMQUV4QzXK^HJdGn**!tJN$ zjP7{ek1zDza4Ka_r>)x?W-ST7{ob{=-rMPwF{8a5PR;7+oOEf|&Od!K@bSOh_gF&y zns1lAar5)V9}ifu`HKY)E-BrzwPo&vzkT#_^}bG<4g`|_{^RAVkL=3q=kZLe|7^^) z&nF%4yye7Wl@C2rbAI8-Cr>~2z_@EV-SL1%WVe{6R2lw{nO3g%^20U7V42!OW4r zr~kfX@7gzi%IcChctqLs2{-q@?Z}6p9^JfUd0Y?gL+hV>_tNIdb2jhqGG}JOgiUpa zfsMT<7R^rics^9OZrT<7`tgMGQ3R;L|5YuG1s z=Z+bDVd%)CcXj{r{>d+VHKzC5_l{a6bvW|;2PMzm9hbM}vVwO{ZRyfbzhK11r@Ci# zFLIo`yVtD09m>9R){4uX@^1Y3_kwpf^%}VUgJEMEHXlm-=7ZVKK6Y)-^{aQ^kbnLA z?i0uFPC5E<^$)AUMPt_eGOOp8uTAVRb^MW2&2){51(9Y5qe=_c*E{0qtvvC9SX`7J z9+jMYYh2t4Ic9N1*{DT@I3@@@M*s0HoGA(Maih69-B$nME?P^CkK3a=%0>Olxk-C` z++Z0~xb>zn8eBQUBn;`oX*hl^{1{8nf2@nJ@o}^y+!NBhKRkdnTS}uILuY^SadhHO zr?QWKKL=OB%osYmkB>WsEm_=u^45lEOh<;H%V;Dem%Q~+G=@&Ck4rBpO4@VDWLZ_&*p@&HW!?t<7A9PKKeIt zrOS+=+{DM_Bbqe6^Jv%KqcJ@ghAw#!`s>BdHb!Hpw&UXtVoN18^3IL_j>eqDFm&mG z>TAG;CKQ1=J(T14IJ*2s>3O$w4U%rg^kx`Za=ZZ2m~*z>6OF+_DfG}n!w5*HLstMz zdN60ki5UbIT=1^qs-hxgUl1sULO_jDV&+E0pg85AVCs|zRnMJKF@KGUc_k|5ov0Y{ zU>+1(ag-evlo-0$Zj2cj6_XJab5&H#;;5K)Q8AB2#cYj=c|R)VcvK9%g2I&MsF+Yx z%)+Rcx~Q0kqhj_%#e5PK!@4w~FExg4ZKlv!jS0#z?bR51?GJ?nHRb_1ri&W$ksQ-ajbYsuSUuF3Bjt4E5nGCPhgP^}!r70TKo3!&%IjacrM%NReYyTQr_>mXdiYZmxN(%%YK` zgD^_>SrS~80B8$t;F3 z*rJOxTE2R|eO7yowOD2`jKS6*#$sbAq=gH9IZtCfCbJmEV2fr4nytTe&)=f4j>;^C zG1xknv8W!Y!)es}pAjWtzfF^s|1d5k3|MW`$2{z_-H z49jH}!x(H0HrUF#(4TaVGOp;XDq#Mv{!Ah7Zc(*!x(HO8Eh^5cphGeEq8jt z&$2CsG1$7mVC$zx@7R=}vW8I8M_?F(tqT#WmEl(-w!@7STeD;q!x(H`#8~<=#N|#h zfKVs17{*|02##vD-k7uPe2ukFW-*Mx)=sniyCX9%wiaWt>KJCen{cQtXpb(sJ4n^7Q+~9(X3Fjb>i#NERA)W%wiaWt&xo7 zqAh-tLf!C6c_m-3$Sj62*c!!H)Uy%mr+*%wud$kB7Q+~9(fL7qoYKDH+FkO4#_A(? zlMG|9m29xJB>nT98p|WI7{*|WMkHPu5Ln;aQ_WYU%wiaWE$Yj)GHgF{M1{tBSY|Pd z!4{1+@o_F}bwW3WZzm@!{xskSbW zSqx*aMT4(q>$^8ML^RelGK*mhwrGTmkE4Er^0jQ;v`-zXt%qe6!x(H$G}zj;`QBWO zby#LGjKS6<#&Tgxwr1AMFYct;`b}mrjKS7q#-bu7KiqKD?R6S!3JvuL3}di`6J6v> zXkr%VGOn| zQCXC)2WF&q(OCUxl7+x923u)}jgM2t%J&A0eMn>ZWfsF2Y>AAe5z7GK*mhwlWO1#&%r4USs`DW-*MxRwiR9?d$%xwzluB z`o?E6i(w45B!jJ&KmBi5V|Aq|FapCEZ21uzAIHaQd_?@0>}NIBc$vj823uK-rTE5) zf>~7>3tc`73}djB%~(nq&K|e%ZH=`~W-*MxR={BEz0r59&{*4K7Q+~91sO}pSM{gQ zZPQp^$t;F3*vc{3y5=vJ{I0Qj(n$jX!x(JkB32u}jQP4mW-*MxR*12bGAs(^zM|Q> zT4phf!Pcd!EeOJquR0&G|bagDW0W-*Mx)^x@qKO~=D_VE2b zYpfG8i(w45W*BU}w&$HRjWysb97JFkgRPl}?D6<&GVCzc8Qp)i2(Y|vu*0VB;VGOpeGT3^sF85xI^$(fFFa}$BjOD_X z%{NBR-O@)*VW-}RMqn6&t$B#m<~I3PymgVrnk2Ir#$YR-u_!52U*|t|b)m*8ky#95 zur;5tlrkLiai@(M>(4TaVGOnk7)vR`hUeEmpt0VRSqx*aRcNr);cw4|HP){(i(w45 ziWp1DS5wl_b2Qe7J~)WLFa}%2h}FvQt&=A^Ypg3}7Q+~9EnqC`e65pN3}diWVzA}k z@ro{m+hrER0EbUy$}uFjqm9t6FZ;t~L4U=k6miU@rk#OxHDg`N z^a;X$6Q8csSeM8w!WdZ#8H@T%3Qor_qcql1nMD{Qs|+#maTgK=A#Z_uy2g4$W)a57 zT7;PRIGS5hD9L&9ZjJS^%p#1DRgReWxc)>z`0Li}?=+TEPB>wVtO~@$$DL0UgaMb_ zd7j4d$SlGbStv5FQiy^uZkdQ_3$HCa4kxn+V`N=}nE1FcL_zqpXu%wf^@7YIjFDA^ znE1HiL_uh|_xFPut663d#>lEhOnlrxq9C02$WC;tN(#@H3yCmBRv0nb+1AaU4!l%j z&6HV$F|ukHOL5%mIt3rsST!<>FhEcvi7t6S=~8tV-?nlMJz^^7IE zj^KFo$S{rNkX?o_M%JGgODV&vH~m}GSYu@tVT`OB7>h;_3d3(~{6=FH$SlGbSt}3| zkCho7&hy@NL}T47vj}5k)gneK!_O;@&(>Ja$t=PcSvNA4JirL|e6>c`mOqtQgfX(} z46NNleudL1?aL__5@C$2m5h~$Erris81tFN5@i-)jI33NiH}oKm@@9xy&9`XW)a57 zf{W`|3x4_HCyjNt%p#1DwVJVLJf+|o80?_2_Q@>57+Gr&qxDfEH~by5Xr(m1lUal@ zvg#R2vGvoyK0j!ziw5B!0%44-n-Qb6ukgf8Pim|jnMD{QE5cYVY$;4TdNsOyC50m2?M3=(uKXmbEtfMlEFh&*<1eW6SNn=-H zU{`E8T{wt97$fUm#Ax>jUEi|?`W0513kMMhV`TjqG4XL2NLcvouI7(5))E(wC5(}E zA7Zo=9=PSD6B_F|nMD{QYdvGhOm=WV3qy4;WCXi;5-~eAdHc9 zKVmfB_~_tCIG0iyGh`NFjI0M3>jG>k?0q&7m7uV0l39c?vK~ZCe4JdJ!Xr=Kg(_88 z+hi7DjI51}g+|3f#?7_5e4UV48*$9YdI&MveEz882{c^A*4cxZDuFOY)?XNF7(XoR z*!zI4KNMvaVT`PY87oOt}$8)r^+nC7+Fs+ zRu`G|z>mk%G}dgHMHnLs1r1wHndNx62#u+oyti0p5r)V8S&kuqQO{oyqt*MTY43y; zjvzcGvj_v0?jy@jF&2Gh*%;mdBl`CBk|NwSg@>NPRm-rwrlzPmoVO@{L8?q75W(dWDt9vM8{U2F;U_y9<_-&#GXBiie-0=DY5jpi2TSwp5Z`Y(fpbPc&4iq zPjoG+UZAE>ACFSCjGtdqY#EOygVgu}sKreuiz>B3!vhA@VLa?rormY<*+P;7Z&D~RFgs~D9cAT;4Y}nibZ*q#=?Nd;ZY-g2pB^# zEGpEF86Ib&)KVdnyBE|{EiOWN7FTd3ct#|zw9ueOc3^sVPJY_Wa2U^773LM=X}~g= z1IBQWKXRgPdHReSAA3`t0fHY@SLZJ%vQWf}&<0SeCi&T+XtS)GsXEy6PnySBm@O{C zb4RVzEYHUoJV}YqwNpV;MHtH7bowYV~GiFN%65RP(SX z-%%cEonKM7Ovua2oGzgz(11Pk=oliZi_kZehL`aU2}5GV!qOrksiu5MX?bB%v~hhS zPok&L^4kK%RHZm(R6~!cH#Q@t5ndqnO~k^(RZGj0k}WbDi@^)$Oc>n8m@~FbGO+w*<#jZNIaRY48kG#7u_b_xdp*ra?<^Ow~~x zh7eP+1(bViN=%QnNU%*X*F5e_G}{E*FA8N$wO=ACBc>6H+EGcdy3^J;F%8MJ6+M!- zl^Y9&g^`$Z01Nf8u@;K?7-wtVU}5S^*fEW_I5hZr>Z^MdJClHgut)!lLUe1UjSG_h#i~0T(xz6n%l>)MZ<>fyv z$qrU25<6I~H}wqkj<<#7dhKC(dMBKLUVGS>?KP_MVh@-WP@Y_?37Z9&mxE0(*K9Sq z#?)*R%r#pzteBc@g1P4L7VR&lW}9HHdBT}!wh88%C!UFBo8YK^B5J~AIGKy;EZTtc zgeU7-N*e_3erG`77RH>Zg)<;<3uDjJ!Wj^_g_JY3V4pzCakOlJ)d2P?D&qnHpTCsl z&o3&g7Shu4JYrsQx?2q9`hs3hhRD|Pv^SKA3PcKs{+#seoNUP}deTzT#?Gw9JHFD! z(u!Z&*kDa{X#xKDre*rl#%5=SX6LBPbiXKhf)w2=hbk2q;k@;#9T=V__A`c zMfr_nX{qd$WNE3i=s-JZscA``jB1tR@rpT8mNzRi$0N2ee5o9-SIlx}=j3=ZvXm?p zrln$ehrhloEmeKR6Kwg(Ub4nb7eg8DoUH5|pXkw+P192OTcl78snd0eRGudw2DAKu zV9=W`T3SkF?=wrA7)CMXhgDvBKn#R@J~uKb(n@bys_xxpX{mTyPg*K-DU}fvb27Z? zxl($z$d`AiimFT0EtU1s zNQOT1oU9TQoQR+p%F4}1_hm_>I>^-9QSHeQvwZ1ZcedB) zy4pVmq6`H^Zz$96&6a{997SGi zj=sR8sz)=-&GH5iP|k4XRQVNeJT)pTJsnNYpW(}fQ_!p54Efbield{a$;kHR$RIdY zT55Sk40HzSSn}osbG@y)kET8YZN%+P_XJvZ3XR|vLmnx^E%^c>-Yyq28B!oK;Li0i zt+E%hVK64a7fAO9-RSW&-)xQG6GNGqk`&57AH-f&heDxu)sfTF%j(nwqZdfe$j%7* zQ6##0p2gmQXy}6AB`Pc3Cwjd>Ddd+__eF!HUW6`fs4%#>Hy8>?85y~4D96jzG!_P$ zjI5C4al1vTN#%`qhSaDXqDo5-iUD_erpH*h(S?+jYU&$6#Cyd;LHJN>g&W25_{H3y zFDEyIbSi$YHDbd{>a;{=VC)L|-MJVgSR+=JglVW^7os$1j+h%lr{c}cmAg&$iapj$ z{Pdc=v`NZ)_Rx;9(o$5W$1QsNIi5f;kQL2Tu0g2=O=NV^Io>Q!uE*zzZX>OvHd{p5 zhdlmFT_MUHb1SSIF%vynZpfD*8VU?A;FNP~?wqp4V0x}U+vB!qJFOT(^1SK(fG23t zf?A>Z#GF8OZboJX%a+_ybwdch;HQ;*NW|;ue3>ChEl2^*sS+d2<7Jb>dUVkWE!sG@o5X6LJdI0MA%L?VP!0QTCTbN=7 zL*86Z2>ph>Wm#O6Q#t7&xKb!PHz2C-Gc?Quwd;f$1v8nT+vkzonBD2FlJbQ@wvdLm z9BOd4m=(+o2HcWIG`;yy#dt96dfd6`n9CYe^2vZ<1xVxg#LQ4;z$;-UA-@+9a~k%} zMCL7Nsr=Q5G?PPP&A{-Ds?OE;n56pMzF@!`66JR$@@d#4_SVF-RC;Y<+8BCoBI>q6 zm!WjzKj_Iw&*W2jb+r>Ns%ppNEZgG=f*80O;Fh`ZWeP9H(XDP)`d&o*y*|8}Dud&YTuWRb(sw&BKWDa% z`v7*QN_eG9fa8*4=vxWgwLv^Q65_a6`8Wo<*G$8=m}YQXVhnwo9fI&3FpuN5MhbL8 zpjCcLy5f6HSD@||FqnY*{w#6y`M7S21R=kIcl4Lm$=CX<&MZWT?(=C`!aC*+R#Vk_b;3Jz60*}HuOp1$ za)2KNwOlOndnqtinsKK5Qu$pAOvH?{(Dx)TFPU*BeU!ex%NR-@g;?d+4BUU)(3b#y z?=?(~x{0N45O70ftXeLn^pXE%0&|5KXOZ7!z^pRkO!}z&9tP$GGtNTa5nw(s<4pR< z|9+J*N`_AN48=gl|^ zeTRVg*o?E#cN&;(4U`LAJ}mSN2WEm9XVORQZ6+{9W}Jn-I$&-w<4pP}zt6}RN*{$- z^}7?ew{7TawyCcLxGwa3AVO>PI~16U%{YtvUIEMkGtMHvtAP2l8E2ty3oyIQIFmlA zkI#Vl&Wy9r=ez}DKYkQq<(KqLk}(X3O|1Ix12@x#zG|EL>VUhY4SmdCfZ1urS>*Sh zz%-k27UkFJR(#P6KMHEOSm>JojK_?#(3dY`xW?G!cMWjYx1rAkCF_BC*^IMD--p2b z%ZxLnkMzaghJFn{3a#bW4NTCCGwGxHSP0AwW}HR(?g!>cGtQ(h5&HH4^MM&>q31zb$h#6<0?^|Gg zHRDYBsQmilDc_;=q%VS6E*APSfthZ`ne6K=dBcn|rH}IaZ(#mw z##!j=eK%gSf*%F7Tuk~XeQCfqE>u*xs_>0leUp}>u`funl6!UnDn za1AzagMoY429El_y*6;9??W3nO5d+Ga8%AcHejO*R^@ySjt{een*f|-14sUHgALq3 z;BL2p>jB&|HgKfxH5)iq&Ngtpq3>54xC?k*aZoCcLc;M#Rz?~1=?KW_f z-by2wJ zetZCMd!lgB;{y4?r#5hXfpgGXR&>FtT!!KJKpQyH=d*#M{$;KW9QA8eHgJ^Rn{41H zeNWrKjR0=94IH(PZ*AcE0oQXQHo9O{&Vz7#*hU=)q7{zpX4=3}ey_HHqw%fQ29Czx zzuLf2y?tO4*K7mV1^QZS;HdmMKZK1gSd|~O^NVcY$WO=Fz?}_TmJJ+@AH_Cs)L+%w zz$F9ss14jXz`bV!M}GQ)4cxiFb@>Z6x?ok#l;2@Ca1P*nQ8-*bH_fv<1Lu#zMfZQ* zftzjvM}ClR14n*PZUZ+2xRo|=RDMs}zzqlPfDPOz;C{A&qxPHhFgChiRd1BOOKspf z09P4>i>@~s&lgAGqU(*$lh@e5QN7)119t&%581%cyySJ8xQ}h%C?6+n;BtWbEeaPs z?$h{|^$0e)U{!C_&MR%=*4e;OfAF*o9GjQez)^qjsSR8baHnnHsNWs*C^ouaRW3BY zpJW3^{*q+_N99~$14sQqgAE*wTQAwfy<-DM^ZRdY;Annu!DHCyf>rrZey7^NjRWp- z8#p@eUS|VG<@bOM-1)%0ZUaa2k|rBC7jVDZz|nc=pvSS%1*`I-@hI5_j>_c{8#u~G zjtw07{d^lZI*+fmfx8H}wKi~6E-%=?QTu(}29ElT&u!pH-|seXR4)CWz(yBXz3E;9 zNQd?(VE$sl(N|n?3-D;KFT*`EFeBhkpF9{FPjJRyV`Of?o8u1prVn;Gpz1sPHsiNc z;ICiyOrFageVj{AKF(ziKF(#&Jf`EzN_5l?-V zmlu`IEvT%VJHMv1tZ;4+x24YrOdnNPS~YiCQCU%bbjB!YF@(r3FR)z3{zkm}2l5~ccZQoq?!-SLnV`7ZKJ#C8ZQ1{&Ja z0Z=Bo8?zxx_1>i9ZSjbcdT?2EU83_gp(?zx;>%1-BiUH z_&M0kv0O^Ueo{M%3qd-MN%@d2VYrkXyT$3VD3ziV`7otLD)1-Noj%*S`o#{oW0;$F zNA6q$u;7nB-17N0WL1zN2Y6=o!LFEh)fKxDBa2N0HScmoR4fyv$ihlRapPSHJi9LX zBC)DA&=5$Pw+)Ao0xxAywsvyWj+zQ7GJ{10BHpBVf%siKA#`Yl6!9f8niR<{i3s)X zL{I|}C?jx*h8!kEJe4^1vpBJR_^fR-V`2vpT~fbvX>;doR3$u0E`!GZB&Y?#D#DOr zs)&h^*VWQcNS}6Ug_QD+K4;;jsNNxR$;cJ&Zj_*a7dchFf?xHsbIm|hMBN{8&Xw^H zRQwNSgZk=HQNIE8ns8@JOVbl*eswROLT>x)tD6ci;hn4Mv6UiqR01m|cB{EwW#*do zGdGnhh}RpH=9$$St0Gnlte%uyMyOIJG!IdYPjAh5TkmD>p3MU#uiF2;HQKvU@66jSs!hPLah1*+NHVt8_G^f}`CrUg{GpIPq zbab3b-BV2)nwb=tPTnd-Za;>}GgBcuusCt+_Z3ZfL>Hd>=lb}Y*B z6qV&fC~XVK3cVYEsxrCI$5=I<+mI%$@$jNo+vql$cksCA>Ugl#+|bIZngER~d)_u0 zkYgW?u*_zoof+ylR;dgoAgb6(qf++opm+_=WA02#=%eSXQO;8n#)@(SQ|y^XEq5sn zy)MSZN$7LoZZqUw6J4w}@USL%HMLUikTa5&@*;$`rPIRW>rTamJF=dod4k#kzl)K) z$bT8Pxf}d--fP0DmKJf%(l|r$sXBg(p@UohLo2=d0LDsQFvt%}xx29f%|VfJae%VdIlz388N2Man7x(EtVlQX;ZT64)gLq}k8_DI}6cvY{h^5Fjl1DJWJ{ zEZ7^Uz$#S)1f-}m6%i4Xh#-n0puqn<=iZswo83^p?|c69Jeiz1_q^xadTyCJca6~L zpq#AvQ6uz8Ph0pyC;^8Pxqu)kdonHd=y81K*<2&$J6{ zPf!AD2Q`L6=_lJoXo?Y<4N7Qv7}N;XyvX3a25JcNyr8m~+5t*v*#qh!)?5Kfl-5O1 zLSJ2sf^sfvyH8wgpKb& z2^)Wc5@k+5^FD+1*+I=@>V8m9GBy*Gz)l4vuup*!@p}Q(Gc5PEA-C3$+Y9PB4*k^# z{mTdqtFG}EWFcB@P#)L~(ZWH^XR0BnN0@2~>KUe5fT9)|qS*{y1gM3~Yj5y6fO?d9 zQ3kIosK=St!{FTkY60`?pcXMjKQjLWQ%*xJ(Vzwy)KF06EO(E=8v*Ju=8XjP6jN!S zo@6T1kjplxe1mcu)I?BEGr~UXZpUz%K)5`|6Fq-AJ?C99yRCB;qglH=>z$FGI!n$4 zTW8M4v(w|qr#a6^XZd}>G(SQwGA^^Yhi08cW$P?G>z?W?Sz8QRa~C*0)vYUdC9aLr zc6LKG_ef82IJ<5dwA8e&7*x;t@vqHJ1V?{mT`_wpFg)x`#89Azvz(Vu$p1$+co^nA^#XykE-f&lHXEW;7G*%f&xqvSX;X+%U+ z#)i+s9Nwk?XE@42#V}W>Ohg{Gr_>+PG6k~Z17&9|kAsS3%02{jW~hUwoza(*JU_b1dUEZ#fJvy4f6I|OG?X=R4E4p~?FkKu zWp76mU-!F<^ZdF&F=5ObiPF&Nq`V4sckL|2Fd|G3KImPA^EsSy!BOdN#RA zHdk{+Zb^(eZJpBw>RP0$d|)-Zb;aiBuQD#LcdW8d015&{&_CEQcY;M^vR<^* z8yFF#0X)PJdogpRRLF=;?+(4yqrY;jqG+l*hF?jCHxi*j-jk4@P~P=UXW7(ztnuWLWGEbya3c#+Fd6gR?w2R5zbdvObt| zxU65W!J`~6>t~6VQFM8ppoDSs!COHw@OD5NP==w@8pL=M3jnh2W7^{iIeXS_3w7Ig zl$%KHc%NP})cm_qltTc8ECj0+nM2otDwHY!1a(933DMcX>0{UWa$Csl(yfi&U&b z01W-4s121op#o+Kh0u2JnnONRG$lDPr^o+O9eOT6PWTDG*$r*V`q*GKb zk=hg0*n1>;L^EW^lIRf)kVe#w6vv2^2kzh43X1Q-pGE78yYLndfw~28uxL|23BR!! zR1*Fy+78@r+Y@>cVoZKnXc=%tEdgs94r#dZc{t#xbJAkXs7M z&AgSM?2I@9Y6A0q2PHHI;aO|dQul*?2T#=t)SP*KRxrCql<-5wW zBSMorxtTqhT4$9Z=aWiLT4xo5aP@qy81c8xDx?Pw+{KFWSHKX10_&_1U^_fX=Exw_ zx+1?GMg?bGo;8GYd7hh#e;fywCpk0Gvn$E7#j{`un2`$(h84B720pT#{0`#+2l z(68>L?$^dZaunxb$r++LN-Cav#h!+@;6$Qj*@XnEK5VVQ>>k3t=N3@ zdg<(((%B_qsn@Qy0&;E>@MqC_;4YeOKTtF~weVa|H1Vn6J;glAW5N3m)E)SB2*;yae=P(*}Vesn6 z$8x{t8+(r)?tys9q(OB*XU|o|kaYL9u9!=W484&Yd`B9^RX0#^=^ZNfM@~;Iy~=bo zU=6MWLpMZYRLa<>6ueCU$!j`zpjj!oSc{ejN~HHeP$Io!L5Uoq^^h`_D>39~wj|^@ z<>q@C8avr|+Jc-2N-nP*43Fsata4JVExl}=MJ42l`O-S)5D`3s*#pYDGT2#Oz{3>l z%FkUfe^}=%2Rkuxrz>Wwb#oou%KoqpYp%G%yp@J?3~(eIBD=t|3|g%B7>zlM?1E*%Ai%qCH~ein9xq5gy(h zG05qe8gUQhp5sAeUv*d6>{Un#YVUrB_eGdTbwAO<;eAe$^&H-3BpK@P(o|BGlUS4_ zzpl4P(H)pg8Oz({Sl;fUH&A}8$iccZRhT*WvuG=EFJ&qMv2bvy&@fAs-W{N5wb!Ec z10~9bR+QVIXj%5%kB?ztOg!bVN*;kgRCpM zU@mE$MN?W=%mM41=Mc)UjiO}ev8?cOnPwjsT1rtTqh3!1K+h}k91hPOeM+}Vn}K&MF-U46-UHC=@pDngA&20~taI){2s%S& zK7lu%MF^;H zL7$PauYzM%yCj)|rtxn8cXj4bE(9HYi$IV?rFM!a_cRIZDWu)g)q!BMU zkP94diUe22faXt>>1c00Y4cCG;V7=4#W%LJaGHoLvG7WQa0KPx+3{!L#i#B}y@~rk zmLn%318rciEH$e&KwGx!jw;R+wEcd-3M;);UrP020ZIBWAXi;70 z8x2b6%LXM7Q$Y#DJWv9$7?eP~3`!tqg+w4e1to2G4)Ws4F!b_H@}AKrlRSrY|4E&& z;Xkn|M~e{X)5rsm8>MwQ_B!yH3lMGHXTs~uq{p(ta9J;0WeISfU7IDr<;r?ZZWPtd z;cXX&5n$Pr1Ki%omx_8;_6|8Ic2LKV(bm?*xTB()?r922O}Zy?Lw^2=Iuit-Hy})6 z%sJ~Eng}|)`;xTqc+Y0}@?W?J&vEilw1`#7JvmA)g}ZO7!awC8?s2rLMot2>bWrB# zCmu{+ue62zx@od#q$}hHO61I&*e8`!qGb#`8#qhaTJXh6Z@O7aS5p?qhU%S2x_uoA z+U7IpYi~1M10HFnT?|+vx_moz{#dvm7eTIp9K!<}4TU{rWGi*%qV4(`s+j2;kFM7W zJCRJ;7zHc}p%^HB{pQ)FWS%SLpxbUlX%?h>9ibkV-b!W}5ffAa%hTK+AA_hN#5-~Vq$Xx&>G}nd( z5rY<>1fmBhffxWvXr{Fgffxx&Ao4*81P$-yjw`wFftE3eMvnYS;tw9v+mIwTXm{pjrMLe^o zIq@)NLzo6pWSpKKD5FZhy>$8Vs^S+fUp|2eOLD$-<&4u9al{;VKbcYX29X$i^fzqM za(|Vh1)6gE4?A@Ga?~@DT4<*EvI2`uDH|Qg-yx_o7M|>h8j%B@9e);nEhl(11-X~y zJ_03b$&a8CSzVC?b%A)wi-6T{N5d7JCAd%G&XpvRw28MxR{6I`ct1dxB-bSwE+t zm%|&4MWC`$(&Ag4%v zNGn!IV-u;6=i6dzV$6nkVnT+0LX?FZ&rtT@ks7DIhQkJAG#uVUJ>L62|1A&F&6DFpwB>GJI3mxm$<1&8*f+i`e@LwA+!OU(VAM-34(7ngj^ zSG<(!=%22TLy2X)JegSb5t-sF(2S&s3E^qLeI|rP7VHM!8ToG_Iib%$SDpSbO8RLr z7IO*F;u1Z%Sa$8uD!y!~7?^!;EumH;mLoPLmbb+N%+TZ%bH~3aNX#8+45kjwzPHZV zfpCr>Ua-*M3@aeC;)l1d_F`+iXNy=8mbS$%C>qVndPdCzi*G%A@)NT~I@C7~OEvn` zZ6^&Z&^*Mb40-5``QAEnAP=;BCx4_0@G!us`RHY@prhB*QXX<+1P!3xjwq(ch?f_< zy1mii{RIoLGz&a}|1zGuLg*7oeW#wt(sg2KBo56&CX^y?RK^^tFo>E8@@%OnpcHu1 z5qzSR!#kS(H^ydQ`d=5DKKF8`9DB=JAFhWC66-8Vcff~eeHc&!e z4^VxWmj|j4D2rBXgw6pa^eq4-w7d*TXo=(ZIK#Lz8OH0B*uy+7KfZM9Dx?OL=);Kj z@gM8A@tz7Vdg#k8&v9$~2B+sj*{p~q2wIChs9>(g1`O_H)==dsIoHlQ^8=#LETW8R zOfNfRr9uouAK~y04JAXgtf;R|3K<^qQ!Ho^Rj+&w?=XmSZy{To{^}dMOm|_gMh*6% zUUKRgF&o^;(xAheLT0398Xd?9fq<_qUV!;ezc^a_5ggBEn)lFB=SaMTqWR8)c+-fr z(ct*flSK*E@ah~t8^ur8>Jv?Cz1f*zN&CCB^(~EzJWHGgPN% zzupnh?DSr6*;mP^Qg)j;N_(D^9Cd|U5;3D#eT8@$vBD7aQ#@ldNjX8oPjbZ$>4f4u zvDp8+JDy(fU_<;lR)VgqHJ10Iw>mw8ntFmU2n~0{Y<9I364Dti)wn$UF;;#< zDp$q|Y*;TFj&$@^{)dHB((5d9V&M{bF$Kd=BQH=wWAR+vM{}Fg_K%>y%34-28+oUf z=241?UfRglJ$UxXR}9A4WC4jq{_c#~VV#pfG+HcL)Ezx#rg7t->_$@U4)1mrLG{)% z5A8ryv-s$1h$H4MD&Tb>A{Ej>0JX?Jl z9M#jZ|1MuHIdzM57WvYWQ^D3*v=O1?6h1$oNk++~>ef=4u*tMLyfsh&N_JCn_0kvn zEJCfbeufex+uaE75z#XAaL?(Aw$RG4JwoX(xrA~!0Lr@3O7)xe)6mO3>&i!I0+JE) zr8@yrB59CZ8~Sc&;J3KavEflPCfy1qK)g*~e_l(E6>meV+<|G>xuEe8gZHzSgo2w$Q*w9_Yg8Toby z7;5smGHzo$WYER248OdK{^0qWUUTq1Tw#?~t{mQG)EvmDUfDSD(q6^K7ibM>Y`(L+ z4&pDendUSin`vEDsqUw_97;(5rG$9X$Zk9yX#<}=7*@Li8_HF2T%1WRPr12wC;F@$ zT4%(UeMGx>gh*K_iC~y*okbaVq(ZK{~<3*Ud;@cw}7-J`=Zi`~4; zQ=YtG)f};>^mBcK#1hI7&vvSUT$mNXzA^aRi~?|(oJMo`>YEboG1GMvVy3h!AX z>m1&V|5vJVeN}z%f2FF8uc}%9SE>&DjqIjLpse%iz^b{_t+s7Ll-!y!5Ni=oe)(-{ zXm$RC!{KcJ0cw)rBv`4#K^5~WA-yP;cj4l}Bg%(M*<6;B17I>yQ60&VdL7=uGB$w} zD`T=iMPF&$Os!7LR;ZEF+bauiHn-!+qCJKCVdlL9O2};jWyhaIqx}%cOdZ3WR%I+2 zy?GXL7B~qptD#kHF{`2771ZZjw4tDcTrns+Yxx0GDN|=a?Ps~mhFo(z3%LQH#Fm*9 zP-%>yjUN^GvuI0j7nP89VuS|6`TT|_i`Ed7kh=j?PnJsn^*e{sdp)6# zK9mr0YeD_Vq2C*!zkm|)YlhL3nAy=BPs}%I@#7pLwty1)z5yllod-p43NTx)riUhh z8qJ6lP(m&bl*mc?fFh3(D?tf;YeA(mVjn1h_ytrd%h9J4lwTIjg8Cy6jX?>yHlT#& zuAqe607LF>P+}%K22>_%p-(C3ovB4zWytLYCGvp$tC-E70VQVh_2A%Ub6gTYiJDUc z>TlLE6O@S6a><}XT<~}_VILwk+(Q|MzGw+rue+;Ps5b;SgC_rhS=y5f;nK+C;;?L7m{ z?X+Rm6?S}RbG#XrJmxHgkY~4Z#+Fw>oJcY^`dMdHfMY%vHKMOXovW}2g}p3OBj|%t z=ZU5;MZ0k@gIh)4&Lnz@Y1el2daO2J6Cy>?8E#$SsE4SN$(T>wu||>}K$1lNMq?tG zXPg6-J57GIL00YP?xN^)g8eKxuP|Z9~E-(poCo~rt;y#uqlwf zG#g3p)sj5Nv1PM_Uwdgq)>TkW%lEt}_`pU{+(~#PTzVJ*{75fvx)}wx5N+G9;LJUZ zqRgZ=C)Q;ig&NveP8+|SWn!B&jVcG}yTI3lL!x3mZu&0pbq$I0E_2ZPVi&mJEM`ua z;Itr_dCZ}PQB-}M4G-on@O4r2XzT)CXQxMF7x+4Yo4ddT*4PCuLXBPEBGlLgE;M5o zIP27Rfp77gi}PG|m0XUp&Phh5I?EPE6vK$jI7%`G)z7`nK_iUGCzc11p`r<3B*d$l z_vqQ_#B^pZG0T^d-{2*&#PT}G0ha55w?p)1DvGw!Q0w&Uq%~X{`UFvOvYb2zpb#xM znPeQ^56PftQ6HnC2;*GRo{fo~G+MWoQJ3#u_1*0>O&?^|6@28i#o=8oqc0X9=a!PE zGt!(UcZIWde1jk(x$A>pn*IUgYbz^CR`yqgNm`B zIwMqU_qKx)Ei)06Xf^kO676CvDA5{d35MQGSTx$sDniL)*dbxj_JX1|WYI2w%3@v+ zo`oE(75tB}w}KLFbP}iq%%jCTp=BW`fmj2ofVIf2)9#3HxpRCR-1Ik|*|bvGRHo7 z^vj@P^@ys0Zb1J}+W@wsHa8Hp`B4b#(QYkju@rC#fu~J@zs z3A;3^6V|A;G^H1J;`^(pL~KKH(r3|P_~$^flRT#rBmcy5Ya8p#&UnVaYQRm-l232q z0b)aNT%ONe3ps1)Ylx+% zUvvHvBL@8rzD~Qs)l))R#Xr4jkDIftJ!;PDYAHe$7fR~ z9W$o$H?-DAs9oYStkPcij~(n~pWFdrEsSVeVjI$%JkP!)_-fxcl)eZN3mKlzC%7iMH`Ds7)OD7%0(7mVo-4dG8oo|&}^ zSOEj5Xc~?NE2`^jtq8~Vz+s4}hy#4gs1#u)w~HVhqrYM$3NnhmH2Am)+Z+g&V-M%U z)lP^xB1N*O&d2zM5NQ!AY4hI5(v$K9lToK>>Bfmo3O)@lN@SPFYF?y;4zuQZ;2~&x z4sXlB#^!JsX~C}72C5lT-9U-L9SBMkX$C0jjBxw_?o*iBfcsRYXyG!2sXuTRm6^73 z65gUwS0k!*XHe6a7YC|8Q-eXZX1g>|x``>;o-1NN8`#@2uN;(!i(QVI&O1FW?4De} zZ!Al{Dyn5n3{y6i_Z4p(o0RtzZyf9L7R-#u-5DhpEED#6$|j-!Ca4*Krhz#l* zx_8Ga)I9hC;Y7uYG8!<*O!geWAe9B+G4%Pfe-`sZS$tBmrI>8dB__Km8xugs;LoBB z$KAnHChpYy#1ykH^Ju9~F6mOSIP*THsrI7-gw&z#t^@+deM zuWQIRbeFVcvMG}l^wuN{Wb{_+im&56=RG)&Dlx)N%LCYo=eX3-P6 zx!@wpvW6!n^@a&S=JrPIBeKPb)ZR4&X*+RGZ}>OjMx98a9gx9A^nLNx6ZYQdYlL*S z-pFhsZ6|K+jS48Zt$Wwgxea^Q7i83l8olXLT8A}mD@_rXATBO?Te<;+b;bF_$j#Vf z;G)kK-UDYYzNL+$@!1Zp@Z=u`$s)FvJ_dnAyg>}7OepUcL?Tg1p3ev}NKTW0q|I?Q z1{viIF6u~x7&OvRN0s{tA@A9Eq6;lE>2FBrZ7wENbb^uCsYlL?HPe^lcN$;8iexzv zH7YS@wD>a4Iped}@hH9wrwus`@$>?>1lkHV8c+BV7SuybjRqxZ%2ZI~im{0ol&C4s zf})9tMf(Vpoe?zXqO!Gctq-Gp*< zkxjQ7*))Pa$;_rXC|n_#&txa|;Kut9r`ep4blgQIOawKb6Z|+RJN|r<*_4dh#3zwr zOlfy*L2l4EvciR-Bz?^<&fFOV9mY;#d|ZDQo)gOpFkWa0fL;%f9A)gov3KFLm^IY+ ztSg^p4^{GSOY1BevX{rQOR~@+ZYPdcQ+BeW$7pI@*&5nfx`#;v;}c1_yC3+b-tpb7D|!D4Z*Bi% zZ86Sl!#nh8h^Wg`9S0f;f597b7p|pU>Ih9iXnE{Uh$W&HG`^K?pb_+X36K%Ffg?R< z6-62yIu(FM9}>=Kg$n_=qcV4|L#bcZWBFVvc1q93OP8JdNyxKVR`A4fbUiN5{ZTH@So|+^x;#H|+>j3qK?xHOmv7e z>YBDpy&;sMf(nvKvctX67yQ(E_e@tqAyjjV-GAK9- zOpS&a`ZX7XKnjYGuQKn(cA;9kqxG}~d&0G9uuqqc3T;_u2+>2(&)XUUebB|Dtec*-k>mx7FK{1j}$2;SFK;vjf)fuief|c z7qLO%R2xcT5aHbEKZOc8iie;m^#Vb9X-=+Rfpo7$pqWxVCX`aszG*?|C7rb7qF;gZ zeulshE$GQw+LL?2w7EmWwfZybp00hk=K8Sw>LWwBq%ke_$*;wXAj^WHv~3ewYFM-y z1=S9RAggDMTu3NA}7xkNT(UXv)R0xW4 zOdv?=ZT#t1Al;`BXy%iymtt(%H!TRgr1Mi1~qoN9<>y{}d|Zh%YG0H-R9%^zprZ1=3AZBs1Uim{9CZ`=$kIF5@YMu@|jDBjQ-cLOWsiycV!Jlwrr+m^fiMdo}f+C%_idc!(83l$$J->cU1|iZR zC_>OXTUpE8^lT#NNyt%23W{o(K#<;89mNS<|jd zH|gDjKm7`%n}&J+C%Q>*O&^~SNH^`9BHiNBONUBPNUOOn@|tuGy^7vs)*BQariH^( zg%7TMy5?c-2M3X*RX*q`cowxlP-JnaK$E9hZarLQcdhj`^20_}A0&Fwxuil~wCp0# zf+F;NB26@U_zM$nTsne6g&fr(K~WtN2$G@{>Q^A$BZY3NL)WF7^fnMKh}8$uOvUD-g&!p<11; zR;^A!jnmchL%9TJaVo^^VFM{BLQWKEp)!CkqDx0msE{MRpr{N4f~1mw)vrLhY1P-v zCta@v5YxVCLFgr&FJ49OEY=%Tr}ar~!H#xa zcF4w|tJrx$+JRUl-IQ7pGb%knQR#^^klt=SBiuk~SS)n|giFsGDm@{sS`d0k=d7#f zeTnr3;biH$GtqPHrWqES;1ePRrD??=MCl2Nti3K`#G~hMqtrShgf2>FG5&Bkvq4cw z3KU7*0=#||gQ%?kU7??P^rK;z(O5Y~I;txD0!31PUqwI7a7BCYjSc0fhz+GtP-IK! zWt~2?K!mFpT3R5z;3D4Ib;X+;B)t#SuR!|O{~yGgbl!3my_=<8#F^rqhH^vP^_r}g zE0v*$6}3h|QEL?CN;c@M2>mJsQMp`cG$-?iY{-_P>#wR@g?`dar)=t1F^J0gzcTWN zq;$P%83`QO5_(DJ{;TLczUVP)8U8fuCJY6Ya~?h4l4Rj*9`oL zmKM|Xjp<2toYHCg04YaT{yhp&LBdJ7$JhcKrQ7aHgl9~)1 z`W47Va4?tB9Tx45&uVF5UBg+oj-rwgDAkfckyLNs^(&D6FrgnJzOkX~64I1TL6I$? zmvqt@9Qq}~RSdo1r8Zj=Jt+PVcMbWYQT`webm@6S`5`orR}hp9l*l8pLvNY&ON6Vo zXuAd3!pj1(rP~2Sx1r{a&|#JX>Hi9U`X$0u8_f|OqT$!c(h4(2jZL=|x<|Rwd)eBi z+1j@)yv5e>PMy^LAN=weehtm{$I#N!^9x7h;CIm6*@g5=X$7MSCh>2e1np{=>>&ZdAWtQ^oj2DTq6Jfj3eUQIXXo| zu~Vw%7p-2l`=fhxeV~efXap2yrwAqaqY4VsQw$9$dcsnWFb#Q8Na@bX%`bA>DEmO# z+7@a>x#<)0(^GwN!n9?mpu7>F?DX6*?o41)^9l+8^RquHJ3p5#<`<4iNlPzu7vxP! z8Jj*yDTZEpF(AN(8dH$&ll#8q)ytMK3O_-YW*d{9n_e)=O-YzIF)hf^zJCHz1WlMp0mGd*Rpn#$;u$-_${LCKZSIU@zyrO(td#c*E zXs+Dxqq4Kod?JGUbq*fvmqDsB9aflLfbufY9c+0;1vX)!ZBYlCJ2O4YeAeQe@iH)X zR1P(?LO(mHd3j^A(mBS0^vU8;XbP!%)*=B#X|~am-06i#M{b@?io5e{h3UCzF}A|7 zS@}L--}31og)3#YY-E0RSyO)DSk6(s_)>E6P*18fAaz|8f(2#_V@v)RY$Y`UA z*vN(^Me>VK-yj!2VrW+C*mSoos}SkR&Bz)9$ux~bRnCNhEO)vsD-A!cnB|_NN#~Pd z)}7RXbU45iiuCBL+%)`#qJYQ;kq-rEtyK5ZC_Bvb7ixnF(mR^=IjXruFj8Rajmj1{ zuk)+WhKiJv<>rP%=@1dHWoH$-wMr0~oUHW1z!oaOJ5|OD)&3PxRP7Yin%a`|oD}KP z+XUyk%;Qd4VP;-YcA70Wo!Uv}sQmo&T%*yYX60wXjTcd=WaJfaUKZqz%C?~ZIw{3d znC?!=ETn?*X)sxZRk%%xG}?f#mxF9t-h|vS1*6i^Q*zVCAXXR(7lQSu_ z=>Tn*>9-L;&OBhXM!p#xL~3Sw>R2_7g@^|tpOTf9lAfBGr^V}i!4MH(bH!=M8 z@qB_!{jvk%WTtQ)Xwt3uKXlOhT_nWlvUHv;FT+MZYO26H*a|Sb$jcF)O3RY|)~D#( zw~gvL@fI7R0iWnboAb2}PnDU6vb6aCdXe)6#)c6JxzN$0(rnr3V@9P;Li5j|vZu^J zNw_of(iCmJtu-UBC^yZfR&O(06Tybp_jPns3)4|^bI`SAYve4*G%;Q)t7W4P%Ni7|l@nxp~!;K1E^ zdA7nFj6-C07b2OX+|)6T${v%4?lm*Vx25=K)D`+<4x)NxJZc=;sF{gAkv7t7SasI%T4#I{JH59AS+zGn};~m3jDije>qKxXJ=)kyA0Xq{2>mIQb2X-h3gsdAX_Sz07V;XqNyKy*Vt^d1gbYD*0M04Yp`zfI+fNXza+s zXn-_^5K{6zvZ?4{f1TB@)lag)!Z4^&Gt~(k5LI*BF-$^z3s0d$2Y9G_uk!mH@7@_Y;pTF zH5wm#EyBCC`Ph`d_x`Z^^DgZsmh4y%aqvy=THB?NaZ?|EX@U2aT@lBBYyRS_R7YmJ zRT19t))sAR-MQ|gLtliPdF!1V`-@+m`7!s``sGKbOxyO|?OAhPkI#FfTmZsTw2b)oaYRsYr* zIsL%_cfbGIuW$alIkI21ry`d8*zkr9k`%xV|7FQkTkE))qx*eP z{K8N5t9`YkQRkNzme-1_*{S;ES3F}kK9*kR-=teAJ{kVds#TwlZPOy`)R4TcIp@3g z&f0tUw_kIMSNuD9{*ABJxUc!ndxm~pe5g2o)cW<++7{Hi`>*mv7eCs2d#lN}Bn%6i zxNE@+k9|^hvedch-qIKTcjwzRGiRkm)nEU4_GNp|ZA)wihJW2=ap~J@eu!M#s?VnS z5&d^gTUKMvr_CRGr^WmK9NqQYPx(i0cwymp*+2Y~{C49$bB8v0Ec%C)wVUspRpw0} ze&K_N?rSE!Hs_}Nk%MkNFmZOooQ8L_j<(MmkyAD~^7)0Yl|K5pe%_ALH2Z!KUP)FVz@w;aHmk zQLEqWpWoNpYTnN&(bHSL^xty*`P@S--rkpXzMKBMw^6I5^A`<&W7Zqpet+t_R&^Zr zFNl9(`19M(UAk-Iojd#gwEo}LBe&PO^~JNJE_``ngmv52)vpdKyfAd~AFj(oetdA` zu}zPSjH}-EiDy%v%lzrn$QGUIH7Qv8-Lre|FZk%iF15cuI>PmO`JeeGyWITE1HVlk z^w3M`U%$S8*rxb;KmXof(ppd5ck0eN^F-Gv&1!Uhzd_4Q-`w>1OCP@U=dpL*8vAeF zS5J(#dsf^Yo;tP3ikioAe$Ou*{8H~TYxMlSry{w_ZS(sa>Y6pK+2@<4e&O9;cKF=i zi_&7d3~l^pw-vGT-%lMsZAbLP&}m2WAD^>uxt`w(UhT8um5a507?Ae<%Rz5{*!ks0 zzj_T{NhEOVcK<+fFA zXMS7z(2UGN&x*k--iciCLHOCO8D+yGyG+u@-oYg=C&w5j~D zQPuyr^O@IbY;2eKOZFwJ_TnQaUg|OasmAlqJoE5d-S$1baL~77lAd|&Owp#*KgRc% za`@)B-uFdsZS~58iyLlA8uY}P#_zqpZ(2voppn6&2mEvQ)_)ru>Q}fw)%oJ-&Bt2z zESt73ZG0y^{L9``-Z@rn%R<}vvfy_w$Ir@&Z++9|_g>reeNda=pMJS-N#B>>9eB^n z-S@mxyX*P4-Y;nO?DJ35a5p&I;P*@C)AF`H>3Mue>q$#@-WvVEu;lZr#y@hfbM3Hy z9vvB%y8HJZ4$SZKw6|TG-IJRPe6DrPm;1E7@X=EbWi|QVss`s`wpNP$zk7Rp(w9AY?~dy?`=e)bC)Iv) zbM?iaoEj98p88=zmMdj$U;E;h=EqG9`zK@AyI+<5F?~wocTtvgqmIOG-{rn^f2*52 zH_Usg%f;~%TYt6jz@&%w|G28{vbOcVtKL7T`g0TG+Vx)Y((O;wy1&~8uiRX#|K1ns zem0<6t>_k$YOLLHgY!=HS~Ty0i8C(z)@9_lH(PCQvGmXF z(Hq|?in?^;#W$A^|9C+8=x5hVU(olvf4cm!qE}M;`qM*tZ2ME2v~pnN?PqFz*Zjvf zo`16Aw6s&5x_;WJXT|i9=cX1n`F!79uWzV`ntk)p^j@#bZuI?vak1N$KY8P~g`uzf zJn@S!XRlwh;JZD)e)7!8q}whzj{n)U|HdQRzpA$M{xLP`)OhDmZd=s;p?8`I`!=Qc;1Jd7S%3r_G)~oZTW%toJoJ|S}|+?pS$ONd%S_e zSx_spPNREYeYV3>A3f8o)}?JfrvBi5_|p>~K61|^YsS5`s%pLKNOSw z-;7VYFE81ZbjDkL=#V}4$GAlg^?d$(%H+6icO3gJ>Ae~|-g0OE`d`tT$$j5?u5Cfn zJyWW`eQ)TX_QU7=)BJhsqQwLE+|j6Aa;>K(|IjgEdehGF^^Sk_-r?5V-?hKxRQH+Ede1Jq zv~k&yQw~l}P z+q=ql-B9af&jX419p+UFek-lX{GlWCWq&(Oi92PbJzHi8x_p_I`|TMRcXf)2dNe4g zSaQbaWp~O+Lzt!sPNy_XHr(UsO90w0r-cOR+ct?Ku1;y`ql?Bw4524_&kz#ynF#Q? zcPgMYYr!DxAwgnG4Zcu%;pu~>Aib8Li)EOy;Z9t^=|q!|h@4ysVr~#^GpUBZIS1!{ zE$sWsP)G=Um&;dq>yLjI>F|}oixtSw#$4L0)FS$&b^bE6Yd0i_Hlk9zTd&A>`^(VF zq>v!m%G?&zxQv+r^x(T5$k6uPdZ6Za=^N{>2QPUb^C9kJb-;lllp*E4Z=5L>Awg+i zlgypNMt)-d6q0h8Jf@o6&#d&JOf%sS17QLDc2|5fmy=c1q zf4{c$m%)p1$k2<(TR?T5r>*ywA#_L(Z8Mq&>Zh&2$c)OiC|5#)Xj>S)zg(Nx z`pYz98QP*tC3pL|HFhDB%5yKU__CoLW)!5S>(81-oD`Y>-rm(mhR8HSh-Bz;`*CLZ zagbH=(ovu247NoNXpZvIWlrb}LnZ_{A}(F#Mn6t>KhAJJ4sFj;_0Tt3DrdRmSTq}Z z6HTM75vmNm-d8#F3R&eu`f(EcIOF{|kNR=m@Z;?8aT<`D;7do{ z>Bkx8$9chzv&)Zj%8yfvIwi%{&3>GIl2Z%m5(SE@CI+WAIYeCb49@M6)6n4DBRSy)hklHYt_B9@DamPMa8^oA9fNaFa%vkK zK0N?>tOlnIb-%dk8=OSRG3)#T3MVH$Cp9Nupo9!@@+bLn@E#p2$G)71#N^IVw+jws zN~lJhEnQnxM_vNq_bQX+aJ>5wr)t3Xk;-e?oG#!@RXEY$Oh$V)Whl}wD;$b+EwnmQh9d1$I27qI3WuWj zs4u4r#mB2~C_X!()<-i%2$#u;CKxU%eolKg&O|&>g9+6-O*BWRG!_U6YKS{smwq0Z ziXX%h4_c8dcb3sQ<(sG*AQ2M8BQ8*mS;M-UsOKb#WfWU9HVFx$aS>ggEIZj98#~2= z_L)SnjA9GJFCSaY9_YBkMB%#&zF0=F)rwItcVj0C&YjDkUecNOA zZzk$KiDDVWmW@$7-UIdb%E|bcK~Gn?M6rxw>qbWDdDymB*^4G>y+pB$V(TUY1wuO% zdl#ItZtILhv5aD?je$Z{)(TfgI!sg>iUKZ{QEWwkE9wTJinqMb%0vy8D3(!dwPlo^ zu5(j9S!be3B#LDeTkRO7=iv*(r=BxWA4(LTZc*8O7GE1`34M^36|vt!~(QQleN! zu@z~cDCaNa54V}9y%NPTimeWe;&C;ozSho@O;mlF*5G0p#a2gf&2*JK`eV3>x=W&1 zMzKXcTC`<~VdH0la2%Fi4ApWr)NK;QGKwwouOUIQ+twP~^wqY;hOL1T#WIR5a>1sp zy1)PYnTZ-FQ7og_qJG0{U&qtWJz}C3N)*c|w#b*8w%)bB8)>3Gk|>r@Y*GJXme-ML z%chyA0}{nDiY@A+Oj}=jr^lP9ecuF%|H?a6eLX(qB?Gv!B#LDeTQLYVZ4GzMe8xmQCQ&S-*t&yJ zWQ*#&Gpz1B6SZ2RSVpncTe0=ap|;IT)GrdnGK#G`8AZWl>*JU9wlPul>w$%fWfWU| zz%|o#%juN|O%xrFLKn*@w(Q`V_3-FD-|sY0nG(e^iY*7D$jMR+j}CmH+(bPlQ7og_ z>dUCW=~^pMEThA9Jh)~a zK5$_5U=!6xqF6?;)sIoSkDAtZ*^Z`$tt^RR86{o)6DfS zU)woZH#9M9y(v*Fqu6pWN-wWp?&uh0qP9vD%P6)6FiQ7_C8>2+*E4MWB2g@(*h)}r zJwLQ>EfdwO0RnNcjAAPhT(cflTl(5O6E#4hSVpmx#3&r@Yz?}Ct;W)Iv5aEtF2z=z=N4`-ZMh_hWfWV3 zuV8DcM6rxwYlvcN`N6SInYP}OD3(!d4P}(xmJ8N4T5h6_NEFK`wuULTK3enoUnZ(i zBLw1N8O7Fca7Epq@CoBLZfa=ML#ITsjAH9sg6n8O7GU2sQmi-t&iwP1JgcVj0EOeT<^aA}{**$KOYrsG}0aGK#JH6v^Kjxv(T7dcaEW3W#nyw2((6Wv zyR4^)nkrE&qu5GOY%QDGnLVr!&f3xpPT!~HWF80Gc3M6rxwYZRmObd}zc z(9uMlktmi?Y>j3VrHigw-kf%g3|lRm2rkPgwo(yb)(x9y+LH0@8O2t*VynsAP7_SjLWyD-#a0HR^z!;*RJ&Xg#YYVyoMjYSV-#BxOTT*0 zL>-Z~SVpmxY1jgxecbi8kUB;l)|6c+%P6+86k9ZAGf~|oie(gA4>8I{cl=#Q-G9bJ zrAidbD7MBjO0OIJ8VvKXwLqd+MzNL6C>!1Jw{=PPA52^8B#LDeTRDu8Vj0C&9=K*bT-h|Do{4fv6w4^K@)@Pq4H}D@s0k9q zGK#HnimlgI{Na=HOC^eB6k7#`EfCsU)o;P^ExPahTB2A+u~n$p`f11*mx;P8Q7og_ zax;pun9A#H_qk(D)UD0I!o@O*ts-#EJbWqa(_JR&Zi!+U#nyO6>9%_JY&XtC&5|gV zQEW|6Y(?Mp>o60wOrlsuu{DuVdU+)uSv1~69g--PQEW|8Y@NKj&pZ=V>jnhkVj0EO zWN^jYobvG7J@Ly-R1b+_8O7EVM(K5a!oog{OjNo=v5aDCDx(6YYoSE3jACn=Vyorx z$iAknbrQugimitkWurU(?#}xw+eG~)Q7og_n$9RaUA^~yJjFycYk@#qETh;e2G`8P z0YP07OjJLKVj0EO3`Xg;mcIYxPbR8RqF6?;HIq?#9$LLor%luniDDVWR*7QkY-#!X zCTgcdv5aDC7Ne-n(^d10_mizgTmDa?SVpl`3R$y#t-jo(yNSBFC9C2ijWKKUS;wBu zDBT}^=qZ?MqVAF?mQifYQEa`^_25k=YMMl`jACmpqx3u+)X4rn6ZM8fv5aD?OtE$O zqgfxCsJ#-!GK#HvO1heU_u>~ODyS6#aj}eI%LA^NhmVw1TV$d-N)*c|w&pV`aJuf5 zD3(!dl`FQEo&2+bX{%JCSVpn+KLZ6qTRrQB=j$7FW0^#;jAH8%14XU!rIK&GChCYp zv5aEtQASaPBUGoPV-+Tv2Zu<@M{G+kZDv-%1qAD7F?Uwmg&m>u;iJ+YpG0 zWfWUafEyANL3jMUyt)1{6LqHzEL<$3*m@FNGY^0HX+w&M%C`|l(^y8a^%S^b{g7M$yQGuFHQmN-9KJ-cPOL8!j&FPxBQzwa3*)fYXyMkS zx)x14CQ&4##^*UkQO`@)(4XIV&qTGlNpMLD*Q|Ow>S$A{iC+1~?%>HxUHah9+I2P1H1rA{iC+COGD5 z&tt>SqTA7P<0FY885Q*wqjXytaT7H4Pn_IMNZmPC<^ zih3WMkRZLz|NQ>0nkMR)M3Ib&TE-|jz}0s2>wxZ5k70v$2*gD)Drz}6Awl&h5Z60# z7XZ;weI<%yRMZFHgaqlfMrTb##^|U_i6R*lg~|%lO}Nu_Nk&KF34^Bu>YuxGT z`F04Jg>LJ#M6E}NirN5AEymzbzji6R*lwGo_< zpymX@^=x+ayG+!x5=Am9>N9Xcg7i9Ht6~bOj~>IV5=Am9Y7?WH;7(V!p2vOql;B$h zmt<5FG8(pIur?>I5&V*FtCM7tjEdUADBae=TOJ&2qDD&;$*8E$8KwLAcbdJ49znOY zNTNtaMQvqNL)_`I-H;S&qCS-kj5K?kCzYo0`rjEedO9CK8;C*r}*g^Hie7%r12l2K8pc0ko3 z2(EvdeLUVoeI-#OqoSZ1D7{bVx;9~li8>=uB%`8!VN`qE>6*Od-lt8JO;#C_QBlXi zG0W?X5sCdx)M$w!85LE*DCuOi#8;=G3F_tboJ5g~iu#pNvg&A-iSINpQC~_F$*8Ck zjFQbydnqWknTe{_8G*P+Mn(Mwj+w6huXRL4)?;|5M3Ib&I>{(>#(X{AV8|UNYMexo zjEXu1jyV>s=(GJ{6ZM!xk&KG^ol&)Mr>o|`R!^BIuSAiIiaHIBPmNmh)@2iQK%z)S zMg74j41@TZKJaEZKRq|-20k|`b(ln zMn(O@s8+bsHL~+sA8&JOwBVAAiaH05>3c2SeK(o5(j|&yRMdG!p~~`QwOl}>(Q{*o zM3Ib&x&V$jGPefbgNmS|zK|%AQBnUg>IU5Diuq<~jETA^Q6!_H{sYJCzwW*GUtJS* zTUXMA<2muCqAr4C?%~|gyAee67^X@T$*8DHjH-t_UF+Vf0oSOb7D*Jzs3iZN ztaW{oz8KPNjgTmkQBm}@pE-`|?waj0W_v=SNJd3j7~x+)~X%b(1KPQBljbM%g6lV{K-piMm&!NJd4~VN?T&`gY-LpHa#Ji6R*l zRhLm{zX;fMKUVN$|ybO`%WMIs)_nRqDV$Xg)>Uejk%A^O*2uJ9wG)L zqoU|XXw8+tGn4M~@rRuxieyw&eMVupz}E+#Sa+MYhDsF4sHg^vx>=$wG-+d`2jx$k5B#LBIRAWZz9{aid-)5Vr8+r<5 zB%`95D7GShyA6vpdMPJK6v?Qlri{{k@8!BHZ!%GHB#LB&re%^taS)s}3a3+Q=Ga2{ z^>j1V{5gD{dhG&2Kdp@pWKF>_Z8+vD4W}8Vy7LOOJ~^YtWTpBXK#9)+aqyMBPv<^; z%!ApgI-=5U?`iL8=+7zS@40d8pn6WPZlCn|oRyf8QIMB|b0Q5qh5MYQsl)gz2b`Ok zmFrH)DI8;n`|@#SSwKF{hU4h)VZTTxouO5PXy&Cz?HuaQ)ooLh#^8WYLtEryO#=@Bv^-xbN9}z83RvrdtjU6HMU) zI&sFEg2D-EbYdy;k}@Ko2%Qy+6BsE*I0!A3PdD{7KzTyNoLYp#5>v8rGx9`f;@s%U zCCbOr>E}Kx@!;6wj5hdKs`tDg+jp}@x(1~6K+u+)p(#bJWN9i zXrN?L9{#LI@)6>6aI}x(RRnx%xOrZ4N?t~wC2;i zeYML{sw!B-I&*AV1~M?8az1<1==AIWDf2%!+t-ZH^M7zUZIwqy`fI0Cj;cD)wrXh{ zM~!mjgP^PEGw7Uld1O5K@ydON=rE0rt5C_CN`V2w#Hp7l8QG)8_@C-&9LaAw4bfsa zC+P%op94chQ5qp!<4v4s4FS%?H{21m2=nZ6J^?)yhp+k`p)E}4XMX$H*3U>cRLUkO z&XrcrS*{$tf^^-xh_j#dW2gh`lE+e;fq8}QtKkD3PFy*Ej5B&Edg3=F{7c2h=Nbp+ zR#p_?JXRkOpV$TvOiAfK#EG_s?lzVV{?=0HxY!~btvgAKB2Y~93jtb0QSJnsQ6J%3 zyG@@)eYzORMDTG1R~HMQ&ev`EIuXjBLM?#es{ru34_UbpU6i<71tKDUT@Ya<`ueS0 z7o^JUGRwesL{VjCRUs}C5fva2RRBarT?ar|=zP5vt^-hI7Ac+tKU`2nmsVw-T`T@7 z5x8=PdKK$e0au;7BJx*(i_#2~*VhCW)~jwc*JSYsyEiVCe=BFxOLQdDTYCQ+d^`r5T#lc--&RXN1+E32v{{gjGYVhqas zR8>g7{akDrN@$6{{*if0g3*)_i~N#$Q_i8Ic23 zRx>dvk(#b1C3N{aCs~;kU00J5y8K;IAYE6J^3N=v$x0xFrl-iSQqo^(pvjnj83dFH zPznL%L_<=_A)uVl*V(sT2b2@~t}f@F*s6cV#y`ndkgcki15R3{X8+<2EG=|*^UZ`S z#6)DpwMq-!{=Oz~OoZ-hl@_}FJJevkK;ZzDu4-YS z*}urIp!phwg=YUw=?a>!QCMj9uS!?Ye2v0Fvwuapg63-!7MgqbHI^%AzD8l8x##t0 zzD8l8xwGO9tFB41+Fhe`6%8f8(pDAiB#@+tuzw5!$%^P+o2<+Tzbvj=uYXewBrEj# zch!MpMSQPKR_OI_r&a5{Hd+5d^Xa~;Rvx&!4^2pdYrbWJv{2O(@Ij_8_fTnB<)RnsdHtjnht6yy~YYJK{o#M)D$V&m<} ziTxY{69**Qjn&IO-FSJrPjsJdeIjD}rSU%(k%hPoz+=xo5pe^JP`j?p8EfzBiW}re z9N5<$3wW1d7?>9J=|bp;@C!!yc>jO)Ojq9JB z-2ck3XayGQv?nJFawR(xTy~%K&fSG!U2HY*H8s%bOpG6poM4wfS>2}_|7LZcZgf~O zJ&2MlG%<1Zfw75>q&P>C-TXD{KHX%p47u23d%r;madAmWKB?EYIu!QlhIbLV5gfH` zz>sOlE=Sy;e#q|1$L5cnCmG;#bBC!MPiG5v3{o-N=Rw{SYV7=V2 zq=&+%S93lEj~df2KHiz=M1@sr43OeS?)r2ye<<6q*tfsE-@qhSQhx_ZB(G05U*+=G zvio#3q+?_4uH?idSA5_2N>)%WjipA;E_$_P;2`cyN=`zu`r7@)^2`i{f#jq?{ga)E zCH&V)gUiKt7;?{CZI?$h=Mm?&g*zoaBrB5I)gQDHUpRGIMW zxh7zsy}#3uknD&>O|KL+BTe+u%0R?9?FosFL2(KFou&yf!BtEl@9=}(C>{gZH}3!A z?M=X=sIouMO42|eKnDcGaceay2x4Rt1f?t8om3~?Nn}w}GznQqB#@YN5FM955=ktg zxbKSN=rArLE(1gz4T}Us1s!#89dsNe#swWmz)|yl=bWnQ>P`pR|9ju7@9XYUb$|EV zbI(2Z+;eZ;s&;$wy?%d|mgUCZRU?W1PJG5Bx>0O8GnHvkHMfoT;Tu6w3CSIyTl{nJ$k<_B^ES^2rJ85V>7VV9aQ@}I|9JgYb_ic`H=dBK3E_u|5gtb87? z+n?#r%Lu4Gw`zEA{Q2aJsr+Z;hAo%{&zQ6*oYCXX(Xw+r9&d(~k^ahg#w5xvoz<4F z%F39L>CRXExw$GVN&eds-VuH*eD^&J^|%9Sjwd@K-_1;Wf#th%QSq!yRGrsr!O!^n zZHp6zU{79tw&wF>xa~KLWi*V~zG3Cbb$hdXnZEo$hRIgefh_>U@@V;)`T6JyMoUHf zo4I8`Rf}ysBH!)J&GY&F`9XI+)HO9+Z$owRpXp?_-dwTe601m`->rH58NSS5v=>HC zHLWVV5N+kl$Z=<6_&m9paPUzwhWF!GXqaGbo|fy+^=Z8u6SqjTMl`oK8;;)N&+Ac+ zK*Ngg*Hzzo$PnmfB2FEx|G{66C8H`5uf$mOnKcJGRC!ifCRfn5n@!EN3d# zWEhEU5W!%OpOvMdQ9W+?<90YU`sa4UIQ-Y`mLyP7Fe@0y%+0p>XxsKDxTGrNLdPz} zKe}7lPytv=p5LcM+F^J{ss;4~-M(Os8qD>gu9j1exos|-$Lr3@%JCq6$&Jj@^S|G% zJQ;q}#1qKO@JhU6U*Gf6%qEz`+Fb zf?gl>yl@tc{!ZThzwwgM$^|{;Wvco9Y#6NhPx3tG!BLo8EHI2ACp)P5VNCAu|I0I6 z0saj|1OA)h8IxemRsiaA zXJ-dJnLap*na0k^*vNp}{+Y_~(0> zAwdB};Q`63y0g@roZQ^Z7$p{$S7C6sv$KlL$b+(i`5AfWXY-2?HB^=^C@MxAOIzx2 z)0{RAlXZs5tHOR5oyL=q?afg0$r0H!+?&t$c{~C5{cJb?rT2_Urfb9IIt=Z$Tw%Eo z<*2@#Y*o!PGg+}5dI5PB#Id%pXhK$|Hz&^rSC4VtVly=-(--jNAU-ICCKr{~6jfSj zdG4S;CpRNID@a)idIECY{w!}sj_S|C6lLM!sw+qnRVB90kmb(K$%aq%1YjBl!l)3Y z+}QnUvk4DeWxg*5R^fB!NTm%7Gd0`SnE%pXkN>2n$)qJPI#O;%AVvDfQF7hzQ^y05dpAf(eF#@DoYEj;t*fv<$H4d`59`AJP}(i!+CPu z9@QJn%7$gg->=V@M6so9;*Y{mHy$4UDu*J&pr+>gFcq^fHcPivE7R@wXZyS!O!tirMRQsk z)?ylTXJNDo;DGcrIjC5$xT=QChMb56!z?+N>&eOX`&IJQcz^|lht0!q2YAQ_M>Y0S`+b@FF=X9EUgPaW9}=h&2q` z3O|j)m)DinhG&$Rl;!4mRL!Spl7S~z;m!9wbHLwc2LhP^RqGi5+KQs}sjyf<%-*td z5O-n7v@@S6;>?)jsaj0`l^V{0RWdarJ0}An5gybjqp>hlMU%Znm^)f9PbS(w-=Cu) zUNJ1H7M6ksd1y+5J@i%Bfm*%@4M~PzWy9d%&p`wpPlXT1$%R4 zcyyqw3=59rgTqSEu+o>65zL3}$h^pymf1=RgY(>2-3oexsyT`33Fb%xPi0t{Fo5`d z!C}R7aoImT{u2~4-fd@%KbTB+bZk?tesUY4mT*8CzzpS1v4&?u8H|iOl^_B-wWS-w2^w5%eCumH{!cgxAC{!w!12j2r}2W+LzFH-pwOs^xW_tSM$&+2KsS_s9501hCCD-RC z-1Oku%YOa{{~K()=*9kT+Vte;8Tj00J~mDl=opZy*#A+RE^WbQa}>_4q-NOPib^D1Llm@w*1s zcbdS_8vCe8s}uiR){Cn=wOBNxk5n!t=V905eb(9MwM-ziGI> z*T4ueHtu`yJ1Ij^hI<7yxEFrAp}>cLxsnuu16g90I|=*-1&|(Om@=>z+@FTx-ywi0 zDiquuz2NYdddfLvigM~=!OiOh_Yai&^5u9>ajoEbtA{HQ|I;3Vd`koeF=E!^2H<`K zrv6I79oY+RJ8)%J!T!l0aP-z5g}|j;t0)WW8P+Rq7V4X|Oi}J>7F;HNVzsXu?Qy=2 z`rahCQ+mPaD0k@1igN$0f}`ivWAU4uf`4SVO;J91P;lkF;5NcAzk66wp81pDPBL+} z_q9_B_21M#6BRz(sp)R}KaElf+XrxC4J_F`<6`j3j+5U-z?B__-!PQZ7$?8GfcxWN z_>Ba=O~AZw;9!nY557N-6XT%zeg@3G!|)^d20v!zlHcC+cOr1(3~X=uBl!ZrltklV z$hRDr8>4YC+T#geUW~@Y;P*Z-pGV`O__-jT<8i5{`Q2N6(|}7iu)Won^p_hazxlu| zJ`6vy=aq5tyAQZEhv7%^Z3X82Xj}~a9RSAhglOeZ^*s@o$$c+50dX% zU~Y-V#o)IVm=~jQQT#}M?*sE?G%g0eDV(?1?COsM##gFY7nEBDT82sviSs9Is z;x`a7J!W87Kz#Mq-_`-Q=`j4LzI%W<5RHo=--xF$2IE7ArI#rAsJ?DsW*fLe`O`~* zx$H3fsC}D(`C~LLhJ2fVc_SJZL%y#Fvlbs5Ry|_yI}VuBqH$6DNPikIh0(Ye{H_J& zhG<+Azf|yB1I&hKTnv8i0`qA!E{Y$?M=u8-i4Przs_$fAGNN%&{8GWA5SZ#{Tnzbc z1m>P-Tnv62fY}y}i^1=6V7`yW#o(9v3}PjG=r~k;&jlts8W)3Kxq%Umz4y1Jz%?F* zAKCLCfO#nz7o)x(0<$+77bPF@>-#MFB|dZDZivRk;I{^t z=b~{j_`LdsGMipv=r0YJ^k`gEdl0`|VCF~TV(_a6W@R)k z2EWIEc_|tfgWre1?2X1n@uT+WyPj$qK6-195x|{jV0*I{^7n3F=0@XU$hQQT<?NYTyplKb8Y? zV>G`dRh6Onl_Uxu1MvNXfiW&A%I~lq7F90U)w(ELZ|(LfaPLN!8^w?G@g5{_b4#yqH!_!y$#HsXj}|_zXCJ(Z-=k%SYW0^JT^#o(6@%)Dq^4QHypV4;=ob4-^7XQ z{|dmiBbJ_zL3&yoII>fB960g^m&So3zq>RJ9MyMK95|Bi@i=fN1Gha69Qo&O;=oaV z8@UxgOL;=oZo7R7-Z4V)eaj^dZ+;=ob6y&4CO_YB5;?*fulHLWgNIcz&#!Z zj^x`A2ae*-cjCZNdwd%Qj_fbx4Sd;-So))Q=%hGs)ZeDWfunMB{YR~9F3ah$j% zapJCx14nwkJ`NnMJN_XK9Ib;q69J7Tqm3+czi zfusI5Jq{f8x7l&v$o}TVfg^jaivve~V`UsT@!#A*+!$0>2(Xxz_=19vuXWpUt$-|9GU1A%)v4%|@ScEo`ry?hiW?qD1^ zvcKVf$CvGhrDrO4TpYL|z-7mQO9k%YIB>*oVJw{Ozv%!`>IdN8*Q0O>uHnI?GrYb` zbxvS5UPN^EiTLsaXP+2(F%Qq@t3lta6I~9l`VOCU_$*ZtsC311_B?*i+B|yA+B|;C z+B|;A+B|;8+PpyS+*#h7g4ua9XZmty&#SDMKacJ;((~<$ODpFUS69!QUsq9CGA}s4 zv;?n87*|qJGjApyVaFp_^UMbg$K!!EdY8bss`-~GXDic(DD$y-SUEx&tK8e7SiixF z;+m@3sxjt|kXs`yf$i@urPZ+vcN@G`a9R%{w$)c4_*1 z6T0^jNGqO|-0;&7=ZedrH6x>{ucWdRf6}(@Po5`1G<^r7^$ty+mzJ;Tp|rVL!A=ZMzAb)u;zoRVr=Bujvi-s1LF3Xjlb`Or@it z85E6yTb053tmN)Zq8UA@erf-Nx@4gFf~g6wE&zRBQ+sGSY1u5#l;Hu$AZSsxp}eg< z6(U7sn?>}_@{xF1nle0gC_U)=^%%m$Y{}o)46)6jS0lib89WL(?$`c5#`d1E@L)*il)yh54JWdZdiCj`v6T} zwgzpl=`9=Z)4dCgdPb~9&45Tf8&zw$I!)69X>P+hSU6aSb9;;CaIOzP2r0O1qQn_|}>F z8@^kadK=%DG1Y}{64Rm3-%8)e6#dQd&sf`WDD;=HQtl{FQrc`#!nqXG?>R>uC@RsR zTn|cew1TQ+E{}k^fK#`Dx`wIuEZiPYRg61e;fA2D-F)phP{J=Alt^$fs0!v%1L}6B zT0q^w)M`)*nOYBO5mP%sozEKj5R~xiqHCP$KuOb?x)_wC&IffN=eP=#NWTM=)bcG0 z_Z29q<^L>PKjfRod5^)jl#v0dlFJ~jiaowP>(Qm z45&w$a)J62Q)!^qFf|I)pP3p9>M^F$K|RjYL{LvKH3ig@Oic&%7pB~x9%PE5gJi9x zGA)%tgpm{?VEFz{|5AT-F93>uEj-e0eJ7s~*ljoD!FFU^$^(Yk6T8 z@*LmUFwpsyh>4 zQ?sOr2rwEl9MM^7wbMaWGc^TNAyXbu z8yR;YD3OoCD3Krp>aU!-%u2o0O4ScK>*8w1LX%Sz}tP{dpb4Fg3Zk`fvKDxIjh zqzUbtHxMN=jtkWDRqAa5;IX!b9h*b4>WU%c1Gz$^O>na%5yn(^{+hX&b*u(po)<{%Kp6crB|MI7oVe zi+haO_J)CPP+F;rQ=xDU@LBWNXSvk^^-}T@Z)h7klc%IOo1R03o$EXaTEpf<_t{&W zO%LOO*6KKpxuQhq%8Zdlm?d`Itm&_t9Uj&7rKuccO!+^`OM$UIry5HxyhX^;A$ZaNVJd2Q`>;%m5`h z&I2Vm?gf>>xIclCyf1-D;T$_aNsjkHNe=g{3$$flas73SPEf;yEu;xFqFQaJS8cl) zA*nI-gKf@DHS|G1!watS4DH_5aG<|)#c?Q0Yo!=a(eBb$E@vX?)$UI;JquiSY7I-P zmAbPmmEH^95$%XhCc4uvNCw`RKu&1yd>kng-eR@tyO9F7H;x+3%xyN(V6<$jAvZW0>>6G^0Kf=m(+s#WO}~k_)=zaho6g|#e$S&8$_r>#g{G|}y3_Z*rsrck zeXDMOj1xzLBlVO(%OBI~fef_%fqIfQZ3Xr5C1F#2HM)u{oW1jOcHok8-M|#B<%zU4 z;3c)(%iWra5ec2^h8<;^IFg!XhLf~bOoIX#2df)?=@V$ZI&Dh8={?|F7dR?`d0`L< z3-slo1-b`)XEX%Tclq_#dglKA@VO~a*YrC{4_eD}X=~}Uwbr3c``)IOgNNn=pVE0R z^I1VM1mM}0Vh%VmktTm$=lbuU34g0&vNml~=rqfm5>lhgiFD0%U@z5`g|>uYBM75O z?UaD7xzz4A_1!S0(pbiX7x9Q4p)@us=A~~Az|$?&bg5ea!yJZpX}W+e=0FqKa&3Yr zP+PX88G;mC40m`ZvG7gUt|h%ol|nFqiFHu#(BCoDZJPIqu_PL5O4L~i*Tmu&J;2O% zG-XrUMiNju1^3j>>2_Ck3{s;ex9DRh+ad29x`D_{`q}Z%9va^Q{1Jyl@4Vc zs1Q^C26Z`8`#@!J-d{jTUMCbLc~1f*Bg8mR*^HY8N^n67w*-_(&|szBZl&(9Qg>Ua zUs$Qb;2MSB(V&7{#spAO%MwteC5LhgC^u7&f|49hg39L{n?RLu>UJyjU!Yz`IS%Cq zP_r1ZM) zs0|kNqD8fXdWCUYENYuYy=GCnKy6{%+ZILh6`o(EYkH!l|AeWE)|!t%YuAzqmj8OO z*HFTUvgXlh7cCY$*DGZkxACma?OeZ4YdI2;)Cm8y_9as+Zd-cgMvU*Wjk0J{G$fh*enyyQrmV?9?XDbp3r9l6eHo5%{y^{%t9s*MlFvA zRsxx^prrAqfs*E3WTn!yP*SPWN-9m?v+!}yW8OyU>!A9eNgT?Dpu}{CqeCV0wc|mN zOK>ReS#vH>XRC7%9o6H4Z^G9`r30-e<6QA#pl-)+P~So%RS9ttte0J_5iGsOm74ID zIqTwCC{%elsq$|q%haU)j@ovgnHek%WhA+$l=rV2@144EVBOed-OAnF-F0bJ5pGG7O%DzYFB|~B z5gcL!^cRSsv*}9=B5M7N1ZUG88f^5WHng-gCaLafI=vea{68kBpuYod`Eod zqA;!D*Hdc4Gs~YKR#+I8nvJw`IqqC(9T>LZCQQMJ2gbPsG@V!$swVLsB=PGzo$K=Z zGYjYXZKNpOQ{Iv@3`@yK*7Tfm=Q?+Cvx=^`W7+SAC86X{xF3@Hi4sIzoB0fZMXLIn zF`RwX-;l}`mdf9HU834H6!~dcVpI>wJk`$Be$FBFS~4`4nwRPv(mWTW>ReZKqSo+> z%emrWjEh>UFHM`a)wv>=GGMwwCPbKcHW3j^EOM*m8 zQq;DID6_L^u+-2LEZBNQg4#9>Nr9yASQ3eD(8jiQNeSpT(=ZWiddt~Z4}y*RDy-|% z+7H%+0=iCXM}Ar!YFP~c=T^Jlf*3}(B5xG#2AQnsaLaqDx7J_O5BL1KF1NahzX!(K zyoNwsK{kvX?#Av=*a~L?9@Y3_h5M1kVoGbYQ4tihh?|R|#SG_q$5isr&h-bVt@5>o z?nLKuA3_tYRZY^8I=Fo&;oSXW2fEN0N&(QOP#6-ewnCv0lhtW9F>8gc6dEmf8#kTS zuqjbX`Ul!=;Mphzv(5uf=L+%JS0!lZdeeS&uApA3wFJ`A{jFKJxJhkmFcdV38@mtG zZgi=L)|<9}iCb&UO4O$9tA!cp$kh3J@S>{D$Zj1tL#n%rB3b}5APOqEFLb2Zb{k>y zfc5L|5RxH*)+-Z0xrW8O71sc_?5Bio z^w$-CLw;xDvG{KIX|i+0UqGPeHp2UX&{x*eFW>65%;c}A4QZ7+K}1CYREWMKnAG8K zy}-eBqeYlNfJXpsgmfAq1smn%T#fZv z4yr!pR{Q*|xoG8`&Za!1cpLxgY{~>dW4P9^fmSi${8Mmc1DpWr{iF8gH_{cl5k34m zSaW7!_390-Q$XK~g;!_epQu&Az~9i(H_)<%m;{@C3{5I?9`8lUwEr$S4J`l@+KC<` zOX%q51IyHwYjA7vl|-%k4P;I9H++*=_a@D_w8&=HrM_NF!`dMf-$&HOU=9{Yx*81$ zb9b{bX|S56-M@5q(-f|d+z_?tgdaP1QVnHDRNFr5P3KevcXD|`Q#bCi0)*DTz@fEf zC$PF^9=`9859B4&8^k8)xBXmx4;I}wj)sa03!1qf}(+&j$;XvOq()H49XbfY`PcONt-Qe zNVv|G%ZZxTaN_%n}>}(1OH&nfRV5gf-OiLWyTkAk=v3ZetIgr`md8o=oqPY+-3^gwkPE;ch&xu>$j6yl?EEV*FVj6Mb!~n)+@rXp$AZtY zE%m6c8Dd)vMr#13!oqR6y7r8h6)c%_J*Kv81){63+V&EDjcmvOEcJ0y5_RqPmuX?W za|yb;+V(53o%e+^sBLtcB4#;Zu{ThOohmc99q_JGn5BE&c(sjges>)gKEImI2diyW z_;s%nVS5!0?rdx4N9f6F+mn@O0p^G!ky$4i9`Oh*Xxe-HGN%|rMA&1Z>A?8y=i;hnaDmxOQGC%*;4-n z=H6*v)8+eZmtVtWWYF|g&7^qTCz=4u>3)kRd826HP}`me<9pgy=P1MFc=c~+kyd8q zYu8W|3VmuVYu7TF6wsHBq>-}_es8$5X+1R#hF{Fya8rf!i&0ridQsxfmd3Pp09L8` zkpcZjNOiG{?^c+#ZQ84KV*{;?Ql7p8uE6TicTq3KnktLZ^rN%sC$RG9v)4QP-CMEn z{yg2EA@&n~G)ityIg^f{d+Y2>x-iIq{!wdv(O`rnUHB<-z17=QC z1Qn7Xn!?gR(ocT9TO0F}Hs+w#@NFW+iK?C|;UU!_y_Y(?4gX=QL*1l+Au|OpEbKJQ z1!|u1H?&i&Oaat}DG<$#p4wTBFN$vpH9a#~ZTo>5k=heYXjqIn4`P2|bgrCokM3CC zqNc(Mr2VQ>Blh3%S_1B<$o$oe&Jbdqq;E4K=a>5SPStY zk{spLcalgn+C@Z^R(DFJ5YLQ!VXiP6DI5#UPyS>Zq`syq8Z!<39b{n{)U~7Rp6nK= z<_hFe+pb2JCyztn7r-)8lfGthF_hB7<4m>}d#vPVEeaDuK6oj6$>f9+?HNBphqWpO zYqBb~ffipnKR(!vxx#Ne5>kvKF)78-C#5f+^-DId;;hGWk3;za-?AqAGbqV%IqF)?IcV^Z z928&C)ZM`|=DD1AJFd}!oJ08u)ZaNZyjFb-&S!DzWKi#N>TG;VURsTQkFU{9d%4yL z>Tb?44w|Q3Q4VD$C`tVzsDJXc=Rk>6+dzHF*LGXi_Jb1X2cqExM<(!Z#*MeG(XOVw zeC=^iQpT^KXb+Y{pYl*s%SP$KhBpnhR~!;{U@T0zzFwL7hA4}*f3R7>mH=b&gc z&7mYNn73t>PqJKjFs93>T16BF(^a#R%!r?fWog4)IcudLF?LIK&{{! zZ35-w)Q_yxeV~?esv`w2_UF{&K?%Qcpqe@LeCyi1pqlvF57xC5tYC=kP68#?6a*z) zDy?hRTG#HkuKm@zwh5GQ>5m~+xEu{ixJOaKrLVmHG*2i)VH8Ua*YOH zJ}z8FfTH^}4kZf|O=KL(0#Fo;I22mEOJnLjP^U8W8mQBl`WTe-_(fQKyn%JF6%_4< zawunFu|uxi4T|mnIh4miNx3^fm2i#^L0!$%XP{)`&3B+CbB_Oks^-+bLlmWusUty6 z<YNy!KGEK{>Vy~xyDP%khw57Y*x3PH6oRRZdH zrpiH4V3nj)g8Ca%biWACB2*gBB1G)ScpEKlL;>$%7f-4&=7s};i1CbL!kC-u|3!S@ zqh)!)9G_`-9`9SEHH#(e@_-wRE% zVu3CcWNy@;Sx$s}JZwf6SwA(^mVe)G&hK0o97@57R(~*2B1u|jXr+}&W0>d7ac63> zTu2cXEfTp*DfJy{+kR6$RCz_;+IbEHC{kJQo3Pp1hav4wzZMCJ~ zi*T;a??h_-!G6vr>OH?*s#VcaacMf5 zTx~-eF-NoQ51>2*zu{Tk?IiIa2oNRlhtO2C#C99GKeEt{&ZD>zeVt9THT}0&;?YQc zTRZ7K`EO_QSTvjER1dR-PFLHW0>Ex(W}Pg{5p&BywkVBI(0C|~bVL^2(b*3?>JKJ6 zo09)e8aW9=PlU12UU`k06?gHfF-IfqEZaycr)+6vO}K%LUNss#?6nPhN~vZEv!q@% zj*xwb8E!X@!cVw&Nsl6JK#?}1ZUgF23YidDfsW1}k)i$|t?<@mVkZ#fw{csDMC!_B zHKa$YZPQII;zLXcIy%>I@#uiGGExYXnUk6_tT@@V_Im=0+6q-uJ|W#krdP9Bn+rP`*DcOa<`*PMlik?VHoLgXrqkc+&4 z6~q zGIu)z6zz9$@NRdBKQeJ`0X`0n$plB6p=F=Z5>OJWb%2ts5^sYN+~=T#OFy)fqz(fm zsi%OF)Js6!3@m1fplDX)P_D9Yt)Qfge}d8&_qmn&D=4}P?NA1xu7aBa>J+|~0ZO)1 z&>Z77&P#ib&fwHrL5VDnf|9(n3#p26G}EJbnS*0}$$J!hiR2v(O7c>CD0wdgbt~ts z05ys8UIR+_-3UtfJpfAbJ`GCpz6nao_!yLw@r{L}T?T?12}*QzGAPj%l_dN$3rBM~ z7d{T9#!9873(@#ZphT+GphPO#g(O@ygObwz1xlpa2TG)(CuRgkcP|7t2~?14PEW2# z>TFP>k;|bJTe#amUCg-EphSYFL5Tz#K}p`XK?&z?K#5M15dBE%08mqy^NFAYN3&Mh z%ui90-~ynezLlUvzFI3)2PN{|14_8;044G{FbB9R8<38D zzz4OdYwE$EZXO8Q?~k?LscWVXF%$%i8lnCmC_JtUZ^ybH0i)?^KbZHkBUwU#5wC={bv z3*YK>|B9RR&YK>=xu!eu2q#qy_iXVDgWl2%I-qaDHWIJ?M)$7$yN~{Q*}v;=#f^+( zv}sRM-RnjHMs>&5F_wZJ`@tk(*)IeO4bqafYAtx+p{s`0t04hy_oEUh0y?lpISRdT z*9Zx;(-uu9W4XGvmX_j->T$VY2mNFmx}XY2=`|b7hj62lIf!wTfs#hQ5tKN}d#%(b zt<(vqXA{mG%Eh3DF_#6Pgv)iHWYJSyQxOWC!NZIDcy$nkK7^nV}t>FYse+3EJ{*M^< zN;tuMb~P zD7E;$k||nbrO4I63tvLf&?MAd7WJS-(ZYkIZn3BjEQ-3Xq<(8r^w>xv&K%0Spv1xd z3zS&$e?f^Q4}ct0q62#;&nII}#|6u@aG#(t&Ba#^`ms@+tPu|wvcJ&ue%Mt)6~`@* zv4m;Zutv`4iCWpQ--j-cL&klrFHop)%VFnMw*&6YNHv>5Yx=<1_$g2g*9}x`5#6`A z6ybo$&zRn&^J%1#CBi6S*03Ag-&#gu!M|<5Pxmf*PQcly(%O_sHm{C^CXf+Dkim7NEeaAMkn1B*7O2AtB)IT*w;5w zYn|l^0Hhh3HShN10fHVXg|xQRBcC%B{Og$-qSiZ8wN=g`{#DLY_iE=5bv4e{;(RU6 z+i~8G^IbUKh4Vc)--GjgINzr=e3?-9BzQf)4+1-fBp@Lb38?_O0CeFz9p~vdcjMfR z^L(7=a`D-CwEhY{YH zJQsF=VAn*Tl?R)kzF+PIV{1n)Rt(qmE!(&!xh!RybNxYmXG3Q~=m`26+|Zd6>fdk> zY)=KZGTLZ$90+}<{!dDuKwl>l=tzJNW=S9EI?*JKGKo}^=w}d-0SBJCQQL|jx#3D= zyPBr=_3LlrSzS^L?G!8 zp^K!%*U1fCB<279?^5EyTnNY;_adY$^GzU0mivxHm^@eSmgxP(5gK4R#mN z5`~uZ4m%U)dcJDwnCaL>LM?B)UpVKm7c=iLQwO~-t(laFs1`#TwxnNr$!6mot0t&k&b&gD8bRJ_D*~p%02j=i@M;h z7$^w?-RPV0kgpcdzvFHxFAWIlnbrDUzrJ=YWd!@(Vp z3A&Ar%o{enEhPxujF#7NH=b_VatAX-VXHNUp~2YPv}|KJG|3m}k#@E1OUfY}Iv+tX znm(8YDXhWK?L!{wd=uLJ`ag_3A*b5*zi^(eP{S_{XA}8AKXl0Bh^F7g&)DmIovHOy zoO3irJCG3z56+J87Q&b zTdmX%P^&q0x0QMT)J6C>6k5=p!PM_SJVjcYPV+6I1+aizp)cwiaxBfX^_ys$?lpnt0B z|D~H_LH#9i-hnX({T5@h|JRMx~+6H*|X6kYjpsU7EZ3a%{|*NV`k=hMx04*3;_VcCJq;!{)(sLrH4eXw)deNuhjjGY4AQM)f*85jQ2* z+yt98M|&ZjN8gLIIh4a$sNVW6`}%zE*4s>+sCX*JWy%2i2|xh9J^~B=ZX(zsg3{Ll zW3~s9Hi~vL+(tPpC%?4;b2BVpne#l$bio_SI+eN*9>b$HmD+?$XW>!wo2VHXkJ@$z z!T62^Z)Y=Hv&q`>0BqQXJ?9(ND>jj6*#u(M5#URsceo)Q1AkMuB(d3(SQ5Dz<7Hu_ z`|7Woy?4yVWG{0?;%)j~Ca@#VQlN}exT}wd`w!4BS=BxGrRtj{nyvX7wE@%}*#-gq z4Z5>Is~2;5`oJqOW&z;W^k?v+0dlU%5X=$peayPWAZ_s+g|eF+cDyOc-y+U70t0q_{SNkM-JAR^OmTK}p1RX5GarNn9-C+p_qpihADyVO z;l2Z7ehMO_qCh=qmmixsnO#8VEuUEWkz4j|x>s*4=S&G8zDef?l4vV~%Lqc))?>bP z;#kNNwl-6f`sS`;tO*rZVsAaHQFM*pQ2!8?SHtT_AHy5>sH$0l@n$9&i73+MkqJ{` z9u&h<;%(3euPaITP2qy9D}4wm6Ca22HNIsK{sB}wj0QJeUYCZN>a}P^%|#AACc5N zE432TPENhjN~KLqZ}GK>_!cgipd`SU18RxLY^BokC-30nQ0nn5xMoliu-pSGn{zx4 zO87kkiZ&EFlvnXBwHyvFp2N6fKnac>Pyc{%K2UIC^YtE~jn= zRm;>Dpro`!3`JM)wZWih1HMB!8kCfF8Yn5_JPSwL4^_@_r-gd})EAt09VpSkE1;z2 zZ&|p{KncHtp#H`=`dT+*Mp`#x&H+Wi1g$U15=WtJOO&SnnF0{C?Lad8*0NU=w=swX zaI*%_n$#m_%vaZ_c+mu&6*k@rdH~*7gqPb;q)=>cG@>1Lz&u<*(brR zZq0OH-j3C53||%XOPvXI#d!A^pI!tH>0FOxErdRUxajy6hndx0ThNL^YKS9l~qOlLTPzL$cJK5(1 zbO=rp3rtZVvh4D2*ixv{BjnC?uTlgwv*BQ3D5&aNx`O98sHnO6t9UpPMjJY-b$K_o zN&mSU6QIy(%YJg8DV!_lnWWG$%YI5C$T0lE&O!t6i`I5F(WGGmJ{ZG7gXuB9vW>4M zmw8%dkL%}LpJU9y@W5U&rl|;vUJ=N)WIPs_*$;~z{ZW-*(tqoh4#OCH78v>UJj7*f z8wR0nP2F^FY6FiYppT*JD3z|K;`(l?KP@kH6M=?VglbrO3P`*(7ArAzx7hS#pcD+CTa^N@YscaC)q1Ek~Kim-7i|s zHT*fAyv6QT9yfVF4YW?2fVP!9`pbLZCCcbQ6=Nx<%$xK%N!)ZH)Y0Wx*4c+t-1q_% zP77v@&wxPFbUuY&Ysk3@CBzs$%tEBvetiW8@YEE6F=C^5^J=hVJ!uajsU0htL5)EA zR%MU@FH<+ZmRy$EQZlL^i>&W93o^rxn^Cwun3Pfxhpn zh}0tguZ~pY7GFk_*+*c+GHDhsM4qYy9|vy;mJQiA;ru0hk`!8mqA4^sXn<n zF^F~o{)PF`W_u~)U!cU-l5e1~#KBu&B~`<@lzRuLa_0OXC`o-36m3wzLK40ON2B5z zzV;rz1=nSz0;;^sQqg8Vq3GQfLea)|p;AF@VjRsvgrbcNLeWSjlna#PNVBL>pf++| zx)m=}x<%10N4Z8D1caJyQ5Njc1wK*t~4ZXE%Y1 z$(zKGAWxSYD;&ntdQ3T%V%(SFwNMTD3FIGWnj-Hs@Gonpg$Coj2DF=CuGYF3uL;03 z5idia;;?A3ntm|E6mnJZx&xy~^OYgS)P|mgH9B@U*p#l<(Md1BrTeh?YTJXrxlh~5 zKIK>3xos!5>CJsDKU8UKYciCobLStzvVeg$W@GrB(8i0EwCF&E3!w&wteXe6=#lQXSAlh);#DyyxA z0V3V!3{aPFmzoYry4iW4uEfW|JJ$tw4bBT0cLONt)HEy<^R+fmg4+Q~xX_Itxt0m4 zjB#^7NjS6|6zx;Odyhd0zm1?ukl&%a396i_PeBQnPEeJcBLOuOE;REb$?#%LP=cek zKvgj=)56iZb`4*<)WXqTcaan~ZE?@G9Osd1Yi_z?dUJaJMGQ5|dv4I82$%X}Ut?Vv z?Y*ntKyTPkLKj-ue~z8qxJPLg^2;Gnh6#3-V^Tz(K!1~#;Z{M)0K&XN`qdvdBdxhO z^|uCP&jao_`S5BygdcDYn8Cx}3`yomv)mTN4iwX%U^!uzGhw?JIYL0pubtb~mY~&- z44m3_6gU~YxzlkLyusDqI%j~oflMuOg9D9=NM3fOgMz5*hA*2+zgG`3l<#lx9fu7z z*b@N;*oNbGs~b=Pzfs-UG@CQyRSK;^taHPaJds9s8;$b+=AsI=d4b1kX3FtHzDDZk zO!cSIE_Z}QJMiL}rIcv+MVpJIch&yBynYHIiYyqM)^OcOL>beG#15W@r5eu0;j96V zayy&S=sFe{^Y@}$s+87xfeV{1M$)Pyyr7Exj{do_uj3ma=+VomS*gyZPZ(|t@>q$; zZ-WXDfYsw09ABni`%UVsdfYo+vS1CK5{Bun$5zhx7v=6@XM^a3O;W=jk|4$GIElZk*@iJRj$UI4_hc znwI+SXiFveO|L^;fbLVNcr zaLeT*`E5R)a{U{;#0S#4(*eVae6Bf_?$g}GJ>bQ(eEgytj#Qh2r(kD;yz3|5Wqa3; zr`+no7zNa}D`5m|vk)zy7h($mcacES7u*MEHluO9{jI)J*_5~=m`qG%TxGE#OR{Uh zd>yFl`oeC1AdTEmg=v3yHIztUm}j^HQZ<9Ep|m9DdJRwD;?@6Z%fK|XIh2OLIHz3q zr?Pl4rD}*Rm1*<*iijp)q^fe+R0eZxc!8eoP6)PMn}|n;xqW}-kydM|7#YCsAllYE zs~k5;BRY6vAwuxZhoMQ5-gs`N+M0?kmm`k|mK?1S)+;WuJX9OFjI(jB&~U2aR(HxDIiMu!(` zJ_)q31MjU`m%M?DFrzte7N$}hodjB^W70}a?^-nbyGEt`N!|RY5f+LSH)5VCYw0B- z&c>&yrSJlq<&7XvGZ(t1HU@8>ZSR9wTTS@YP^TYCsIrcJ3T~v{iooAug15Vrb+?z{ zMLA_HS&0T~Xbi7J;8Iv+&ULqPi4B|juy|c*v?<4h)%kF7W)#I4%*Pqb4)*}o>(>pw@ z{}EshLEYJ{W3d|#Z(^BJJusTn)raAvc6bqf9BFXUlJ**m9K`6?E^I)cro{+#+o2c< zmy@WvJ!Z;+_Lee zi`Y+nww=bD#*cAg$(MEL5d3^&Ub}J90?q)snbil&1$AS~@P39 z^VWJR-K&MWko6_<|8CpM-)WO|gvS9GjU+COR**DSiykhJXMrr+>#It9wuV1`vDV;TK;P)p$^9Qc1K zGYUT!ltkB;g8DtDF0@i9W|vg*QP*zDq&f%GXLk(Lze}GZ%OBHF~^I_`L)wkEMSVlyH6%)P0QWv~c@C(Q=GK z>4*L%xM84#%K}g(%%uucDN~K01V{V0+MKYA;G;C6u$en-L&i8kn2 z3ZX6mbsp!q43y*`4=g#J1x2qgcPQV3%3!M7!VN)J6axS;SN__*A^wrNT+^7`u)&wnYVS*L@a~SI_`V)S{dou?@ zYe*~?#z??(mxcU#yJlu^6FFj& zu`D9v>0hcSZcsE2OVGMk5CV(g@^ce;bXuh z?l?m7V~Tmz*nns5!O-7j;n=*!LK1UWw-n`ur1lw$*j87y1<(#@gOPvt5UpT~$;3nJ z1NZ(dsM}VazLRddgvB#V2nKK3INSXQC|8`sWKdtSYjA@ScTo?D?gcpbk-YzK>O(k} z9M6Ih+)viE*=QPishLBe-H0+=(VN(0*mwj~IrDo0lyG?wlq~VR0qP*g`r4-Sdz#5}bV%XGuTBIT63(Q>r1BawmNm z$G!MX0%t`LDjC!^z9uurh4+AY~Xl z@UUA_xm*gr%!6ts4JAbd#NBva#Rh+4Y*<+D?kV@ zp@`S}d@W%_vNB@g5M@No(0!@92Dc9^Ov$HQWKrhP3_@}XMY;FzwG;5j+K|tjN*{W) z0uD15Y@F{@C9zDBi`EDo;#wDk;nR?d!7#8s+*c{Lf_o^U;ED(ST6NIRBonCE#5| z!!fiBFG*2`!w!bm4B3MOf4UC%$K$tY0IfwIfbH} zzw)&c`XnlSeh{sjIVe?dq!XdYCL{-;Xt~rpV)1q$JxMtsIZ;V28KKy7^u}9q5MSEB zYaX$9(_KpNCb?lT_8h(OmK?-)1Xaj5V)0HD-ay#-lC=mrvIOBvJdZmJUz)x^X7I7= zqBp*x3*tHcFno_O_#!H%HiSMD=$j6+Evel^cIr1mjRYlaN&G*cJ7dNXOD889Wk6ag zBZ@x>D7hj_68^+{7+(5g9qI>DiwfF9Xrc8Y+FTvTJhQjLWo-AXP6D0&jgJS3f3S}5XwHuFCU zH=+k51QpZw(jaYN4n+$w8Km%p(@xxdvZw zg51h)lACz{j401MV)4K9{~$N9fxq+g4LS#&IKlrDq65cDY0(8s1kK{#mjz=L1!X9|sSGM~<~TZ( zWixY7EhPu_6QQV1l7mqFZM`oRZ`$!BW0GAGYBfPemLPnI=P8Hbd!xY@BH$fxcHWU3 zqh%((v`k_iv1Fzdg5N4L@!WnGzV}#ssr1!`2)*e-Y=n5a31S?v{}?(BCVZZT;mzXV9Xl^ zDb8DD-muYD(^XbZp(rQK#mo`0zcOHE-)das`3?QjLCdsKo=}wQ8PN~LTqSfK&Ov8_ zBRdo-6_n(ldD9>8F^^chHwbTq?B%!cCcghQ8RIt=@0b3Myov85Ea_1w@==nDP@mvq z9e#PfT6%p(@x51H># zY5mblMo2Gd?^Eq4G`+s`O!CsYaj)EJ64Z&&)-D zbr`;2X0HZRZ_(%41$xkDY@F(8h!|?b0A9O@K zcOQmt4)YCW_`I_NvkK@lYv%0y0@XL`%<)qSJi!7jsCo)!Y3i8;Q__{Va1+M&#O2Nj z1P;S03IZ-ldC}sM+VY}>rLNjgQKi zUa+pVqIh1=H#5sOFDEDeg4}t5+_|&7IR&%xX3q5G&Yo9UF@Ii3QK+aGycd^N&MU62 zrfc>~C8gE1^A^o7EeTcDQd&(>&6V?NYby&DRn!)bD_0g*Ek1owQK-1QV(|i3P3hv& z1y!MnqEJQEVi(Eq|EENd@XYZAsQ!}DnsLP}*;S=ARj$g?#S22^v4opnRN^YGtSDU^ za+Q}>R#v$dmDbi4Ehts0t157zt;i@W><%&A>H5wHcF_XcwuSC5ETVoRcBtRDZR`n-KO2e z3(Vw-TG!&LkgKRJR1T3Uifz|RmsVHQpctd|3aHhjoPz42n%YvO7PX~@s;w(723b~D zS$QSYR2!;7Hdk3q)gqVRm9nb3#U-xVnozZ?x~8hEqLR$777Ro)JyT$Lu!ltpE0p4j z>T+0QT}7xAyf3eVNVTrw(wb03Sw%7I7)+?aT;)YnlZcdJSbPPHvDALm1!Jv%w(Trz zvnGPK=bYSpKwt{ApdSV)q1NU8bfD^Q>BozEN9OU0qcZs&!## zaGg1Bd{mYi*em+X{3}DH(cH|gR#6g_r?{$WVFgT-f2dID7St`viqOx1kC9YeR9o9i zQtiSDm{*Tt!cA3KQ5)(Z#3C31JA;UnaCfLRT)-^uthq&t>|I5?gUvmW0h)f%^c`li z7g**{+Y==Eg)v6j@1c-(SKSl0sAwr1SBtH*Sbqy12OJ%Ic7dysB$a zQE?AZP3M8c+7R4VZE0~09C$Quv)#py_DC+OtnR6*y4unLcC}$u8U7DIs4?2OHBQ701s4M4Lk-Mcf}%# zQ7bD;q5u(tv^_K~!PvW`v;bic1-25CO3yHj6-^4W8V9xr&wGO?Md;$n$+a#s7X`NS zOCdRYRox;~HZrGCEt}6_pArSCk^!1xCX}DP^yKvMbE6oAszODT;m%=y1r3G;#6oaP!Tv+7Jsb0!u&XIYI0P5XmJA=@%?&qYEJoy%DLxeSRzu+w-BaXg zT%wqr<}*HzS928?RkK?*TdB0Tq`Y83X^5sTMT=_5l>)^lr5J-r<>78nQoaat!BD}1 znyR{L%lPT)BFv#p7G5oQwrj3S;op4YH_QB;OGQ|-TMqd#@Yb+&K80lT$wYvgEG%ZV zlv+?(RTQ3nvGn$`t1;(`9t$v@n?W-4t=Q^DgN8Xk*%fD&TD`DrvEk6+>(KQOA6OA&Xl|=}Z&3G?t5Ha%fkXEMQ zB^aA~*V+3XSvvOP&C2%?wp)09E&?_eXMo?gv&$2>l2HSLon}u@~NUj3dxgl~dRkc`A z6;X>~*g6HEQpFrhkYve5TH3CIhy;615-LK7>e__`R=vz@j6#CpEuj(#fNga!B8bwG zf@*ZqFk4|Bk!nf}yXswQVU>ng4P>TtrDd{4?w$bFUysX{rBs(9XyOHw60A~?i^Kde z?9X7u6vAJC1RImgq^V6Li`5qBqQ;eQeS3%&?h=bjuYgCB zq1RZ4vA2R;G6DgsW5&p2^gC@l0Qj*XG_KM z!pCM+4QqM%^O0)fntT5A=YOW%k$h46F_qs15`Gzb`E?EcqjtP|!(+#4U*ryYp?bs# zD+`VsIzUyLUhCKL)#zWh4_ZC8_1v=hbH`qqb?sT37U-wHnOU;i^WgYv?>+UyTVFe3 z`?eFZw$)9nJaJl|B?H=?-}c^+h05z?U%a;e#f4XWUE+P?p{J6jJoJ|n-f28x+%3(o z3{Sl{Wy3we*E9PS@7(qFfR=|B9DR2E^6%6QA3t%~b>Hi!y#K`usbvp-@?@1K_nR{Y zbi8`c12^BZ{+XP{4Id0Y=fpFw-!SpTnO#r5mlC|I{D#dt%I;|WE-(1O2iu=`Ve+3- z3%=^!wY1=xEg$~Jf8l>zZF5}nk1pQ!$)z`>R&4(M=pC6e&Z*yhTyF9=*Cf1o%YR<{ zVdvRDy!mt1BPS+(GU=WRe|OFB*NRJrs(-y=@<%Vvaen>t>A$YM>4g;63Fo#4pLXQ@ zE5Ci*uv6a39sE(o*N-iKVBbgQU;EdS#xJ|%qqUd)^7W*^xg+Mk_~4x%onN=-;rISH zBkSBNKg{1Taqsg3|MHbyJbi2DJA*b|`L+9*n-X5X;P}V>+BUKCsx0m5x30g#_wH?9 z7f*h<&oy6kWxd*ZQ}g=YFYnaf?cR9Zh`K4ejz9OgoR#Gtj2ivf?Jebvw|=wZ)X+_n z%U>+-&OG?jfZM*l=VC|Mu0^9htNY6rm;Z0)A7*`W!7aMujccy?WcSRZj)JTwPT5m- z-9`7870&Exe>^$(Mp||tlz!E)n?HZ(*ut($FP(Dq3rFvGZPKRvvp@e~@-Hj5rOX}u z+9i(6zrTO_Jmb_0XTOzJGR*gnr+oXqm^#Ao-P(6PIJU2=rs|G87p?ez zXnPa*riw3YI3;CA!YT+N1&Xrodxa)V(j;xtL<)!kmI5tQpsloJ5rINMsIlUP;tsfg zJ0b!_k$n+VUvEo$Ro~6IXJa+!S-M!L_*St7yNW;s2O|=f4{aV-B+q%!&w`0ou?Sq$fSy%st zSDv1|p-2T6&vdscRm6q0M8h5AB=&*p9!)OgNSiS93{r>7tB0w|!l9 zN~?q~rf$vr{l`xpn!TpStcTA$w0`dgwMsusJN)OT*DYAKW9iKe;|8B;J^%XEeP7vD zJi#<_e6y|A&2_%p`ot@L9Q@|l!xOr7DXLSi=!gJ5;IzQ`^ z&R-w+Z2GZtM?YzPa_X+tzueI8fuDz;{;u|#;;j!J3A8!lU%vE-Cq9n(%j7)&V(~w@ zF>$Roe13e|kBN(xX3ZMks?#gJf(1`4iQUwH*o5!z%4t`6)xOoKBYQ8bXjh}p((adE zt@l>bv&rXY&e(7!_k6vLm+x%5xohpSEt(uW(({J_YvW!U_}oj+KK_R9t3Ti9yCLn` z_4P(Azq`b>s`sO=TPMz2=578|tGU-@U%mD6y6axA+j&%v6|359&3E*8xb>7bZf#sM z_3lsWo}b@r^ysbWYu7hDYN~9vdt%Jptr|QuXV8L#4c9y|#(8a#qs4`zVGh4`1V};>4gWo?Ao{CVv6mh?cdC-J-5|87yM%yJ#+QRqnqll zwNAUc_`BNg?yJ#z*(eR)JFp`qt?y0#Q4_s=#{Bc;+M1tS^nJUn$GP9WUifM|hrjpT z4coS^Sax_}Zom3ZR=#=X%6iWxw!QGy%G+~V+_$CadHccE;~(zc`o*SevtL?$F=u#u z@~yx3IbJL4@}%|`{(JhZNv~}D>&`2O?+hQJ1`F!}it3UQk{(k1^KJ5l=OgOXkk2fBe z{^&oWpV)Tii5@3b_Zn5x`O}c*t@if+b=J(oJ8wFZalCGiOPSLyn%fPu#mwIS>*r;$ zOKx=C`u%4MTUIQr`|ix$KP)-@NB;W08?UYVS?%QwhRs>}*z-^Sb@HWu-@D{)`ja=K z-rhCK2c{>JLo{6ov*HHS}quEwwiqt0yoeg0qH9jSBQ z1AneH_6Shzj>#R^_MU9{_XlEVcLHSciHaw-2Gm=4R6hEJLKKs2XpHDyR~=P zo8L?i+#k0&@rB@+^XoqS^Nvk#|1_oT$G=@QyW8WO& zCfs29?Ns@YPHQjppMPzWY4e-CzjmW#K#Luv^-|~jbN;IZ?_K!lz<|~!*Z6gF)4Qbn zH=?k~k%kL;e|KobAJ!FJXZzmdOe*5V!88>N zUvG`AvnOrFpoFvzC7BQZx#rsD`zjp2C$1}03us&Cuf{!WWy@f+T`@6UCq zl@%|YTC?V8?3ee?+kF2UAH2Ql$&T+W7=HU_9onCDkI8E`;>%ZhEOg}8{H}Rgf%%Kk z36&dno;`KroV%0n`{MVb6PJt&TzdA8PhB}*ovk@($bsNPbLzykc)#_gg0D7@4D=}; z9~{!;g}CM)&E3$s=NmJx|HNESRPz48)<4z$uI;Z!7B<*g@=>GD$9#2oN9X24hOIrd z_=gw!y*Byg4U6WKU)OWMfbDHbO(8XgusdHz1^Vc4`@rl6j z(Hp%xpY1X8X?wf&uRQ<5P3sdKHyrO%_{^f%egAvgR?u(d^F8i(?&Xyo)1E*2`htTK zS8e^^`DM@jv}VyO-Z!rQ{Y;xx4_@4RZ2P&j^?n<*@0z!toAKkULC-XNtn(%RXXZO{ z0{#KDuB){?+0)%uaDU~}-`1|_yCL)Rp+U1=J$={icHQ!pUj6Kl7Xt3FFHQgE!tP6L zU;X04=Jt|}yZ)=$bIroPww>5|eAuHyQ-AHWve~M2bNfEO_|&YOcW-I=RL2=DKbc$m zl`S`3_womK-@bm^tNk~B(&uQa)4!(m+wjZOKd*1utR%an^+)lKIDc$@+tB=WYs&uj z@?SqrYIFIe#Cy9f{p!M{FUvB2+B5a~ovjB4Ru+8mK=Gzee@J-a^>H1CC*1eq!|x6o zQTw|+yE5LnenO|eT`RsDvTjY@@>k|wv$~{R!k(mg?^e#danzT+@A(z6Q!{+^gejA$(o&&S=ggjulr+S zibc%KylFkAPeK|V?ZYrVCgJ?M5Le|8=*Av%OivP(&|^~8grdpu=@f~J{lM%|(&>*L zGw1?1k0$Nr7=F)^$+Y*E55M5?^sU`Yz%VR24&QYD3yA93dSTpWAuH{5mDK!@227>BBAA?+px_s^rLkO zw{@BLbU23Y2{Fge9el`$X`6S~-QgIzkI@`M_i!XZ`tY9S+ru%$HpkGtm87v*&Ve@J z7-SI``fUf@d-CI;<q(d^+RlP z4Bh{m4C%gmR-XvhL%A@=(7ngVtm)br=ZeBHbdQiZhJK0C8q$_I%LjyGu3;Fu3x5iv zo6Q4{hhthX4Bb`S0n)Tj&wju$bmE;i5m79}nQEA_XJoOFEn{#q!}P2H{R|iqZxer; zOvIv)8y2%PECy9Bg2sAXi_rD#42wAu7V~3R%=xew?YC1hhrQ5;c+jlVuOrkL`qhRS zL-&cRG53VUJQWtRDJ(|b1*uu5CrzuGMO7kF!_fVD6k_!ly6cNVT|H)^h^eW^EDrJh4D)7K%(1YTU&CVP1*kk|*5xmrv>1OFrZ6n#v9Oqp zVKIlpVtxyYX;3RPKb^v2oMAB&!eSPN#k>?2L(kKqP)D!TpTaOT;3av`YUA3lnEqig zH;2W{35!_~7V}P63_V0dwa%6nEK18ydz!|Tn4w`Yqr+n85hE&VfrzQE*Ty3vrl}tD zrif{##~c(f&GneiL`*$B=B$XZ=rQ!XVhSzw7~GK0!ZmtKf{1CM$J`=fuGVAbh?rJ- z%%dWvp&mmIHKEWzk9l9jG|^*z6fuqUm>RUGL1?7M#EF=z^q8R{M*6WdC1!fo^ojXc zFY!R_g&4X#Wr&IQrVY~mrcBf_A*LVAXa8ZWQg<}77{X-WLop1~pJL`4V=(*jJN$Lb zK#F+@A3cWI+G&g#OqkD%F}-`?uV0mz-tY97^MNEbgL#3Fh#89To zlo-l1d4H*gGX1tOrVr&OS=0tAdmqZrI394I4bX$D}0hEtL8Cwlf zJ@**|kkuH|k1EIp3SoH7ljag7hRXG!5<{h+r@cxR=~;!5pvMfLQXE%eNb?DF1BoHc z{n4vr3~64d#E|Cg#+ZSmnO-ZTvwHVJ%YPmgLtBy-z_LEpyBBCH@fXFglJ@QeWAwCY z9n&8X?DuvC3}WbaYI;mRD#d!R*jk;{Dk4l%@u3)|xi96gP+)4Add!x)Em}*;-PYQL z{xkSxCE_S#qm&dF#?*uE;mhPPbeFn0hV39Ao!sW^C|M5*7Q-mEurV;$nsIyffm*t) zZGy!ximmGuTkDViiYG>CIXod)45Qd;%UI3uP2uv-ESoe^vK9*#!zi{oFqT%X zMNhfzX{Os+Cs+)l*os$d&3v@Afwf<-7)G(xk+G;;vq%Ci=&3{PN6v1K`#TI!}Y3q30ooys*nP4%DVymBG>-3Z<$0Tc=U@?qhi)I_y z=T}|+E=95q2o}RAwrCEQ<=XVnYc9z;DOe1n*rJ(4+FEz~vs#i>haIMvObnyg!Zc>E zb<=}$f0e9Gg2gb3Et(P_i(wR7Llj%n_J2A>vZe?Y!zi}sjLRIO z`KY*-ALmNeGQnaP#nz3At#1eYY^eElg2gb3t)Yyi^}|L9x85mj9S|&rQEUxUY+XFy zdr`7Z3KqjCwi0y~1XI$gH`}+=$8sH7Xdp0*V#|tH**7-UpY?)d^%N|IQEb^5ORK{t zZ~Wt1$r>qG45QdeQfy`2Y#l9G^8|}w6kB%2qB^9xa@At*hu7%kdS0*?MzQ5kY~>vs z;F7F8g2gb3Ehl4X{czse3#F3vgJ3a?Vk=p(wIjdJo03&SI9G;IY`GXq>l^cL>2Z~0 zwHGXgQEa&tTNxMag_4ydSPY}s@-UXxUau5S>?>Il1dCx5TPcdIxQ4gNiBquBBzR{BG=TPglF!D1N2)^Nqv^Y8boD_M&Ki(wR7>58qAxXjCvwMMWQMzJ+Qu{F5!BU2@7w_q`h zVr!&s3xa9GV;xtt(8uzRg2gb3tx<}tdr$aYlB{}7NE3e+g;}w6Gh*eOGB9^{Gs)^H zSPY}s8qHW*d%bja87)>7OV)FO#W0Gk zF^r}8jaI(hhb8NfU@?qhYph~x>WZfSldRtbi(wR7;~0wu5*y2x{uwM;*EB^m0>db_ zZbPh`Q@-lHwVq^I1&d)6TN#X{mFuI!cf2K8lLd=m6kFpJTU#n`zfZF66D)>NY-KW5 zdb_CLvbV;rt0hOC_tT zU@?qhD~qw>@lA7O^SHKMuhz#`x?nMkVk=v*_42`n*Gbk~!D1N2)?~(_I;8Mn?Vr}P z(rv8~EQV2RO#xPxtKYaEmrB+F!D1N2R*udhTOV!w?8%0@tuunfFp90)br$tr+Xc@< zlGUg=X~Oe8@lpN8REp8}4l5r1aFk^A5iEvLY)xY<&2O}6+ap1;MhO2g!O`uoyhzw|7Xt100y^;u)r`%4)0xTyA*N^+7)G&G%ve+|YUP%;Gq*_ApMu3Oimio=rIqW%wmmmVR%;px2n?gx zT7+2c*{GGj+4Fw?tMnWu2^PaBwn`XFv-Rx$RrMunvS2ZcVr#K(i^`Sz=&utcD=1hD zqu5%a*sAx-wR0uw4Z&g<#n#=5t=qOWe@e2B2^PaBww5Zkrkm^GIaykJT@oyYQEV+! zY+dxclrC8vu0bLK!zi{&5i3VZy9p`tB+DaM45Qe(hq1K2v0(F(u9B4}SPY}s3M#e| zR=4OSSt|sKVH8{UDz+Y8@x?ci^|oL!jAE-yv32{qHKt0|_kzVRimm$?OY>~UQmv(u zRl5}u5g10XwH&ds4u2W`-B!u!E?5ks*t(ywG+Q4mYqLkP(gllQ6k87{wg#?$)+||b z1dCx5TMsI>7FLY=TC$!IEQV2RJ*3!jJu$qGWbG9!hEZ%itl0XwR_ZRvIxScXqu5%Z z*!r#Yv!^Aiacd+ZFpOgB5yZ-!ufO|08zgI>U@?qh>ruwi{6;~uM+|;roM17GVrwO1 z(F&IQ#yvND_P(@LB3KNg*m_K{wQfT9agz0tU@?qh>v6`Sp-#5C&H2R8=Z^>$!zi|% zP;AxoW&A8{ofj;IQEWZQSXw_+>#*&$NJL;5#nw}Zm3@Bmruu87tz^Ms80CJ*rx~jg zsYF=(O^;zF{nnuAf<>4b3hNofm}4~7iF6-B;0s~3U=c=TtwM}BrUSkyls})hQ`$Nz zSgVktvQ{HTvcBllpi;8xwm~8SVN}){#F*(#;f7E{$TtcWVN}+$h%v`dkD{>og=^BJ zEx%w9MrA#R7;_A*HYrs8-aJFHo)Rp=aQnwZ3}ID0&m+bh6NhgK1Ft`Z<)N166M{t; zmGuH*%rSQo1);{Kd$BOrSl3<0V+o_O)*?pM>X7}b4Yo!L7GYG@I>r*t+Vt3lbE~AS z`vr?ID(gkY5{|~yLz4wbQlJ%Eh5k_Ubj2KymCQHlq zlGU>vhH=|3jgZ!+&0~Dg=u#Dr-Gr%rQ-ff^c}nAD>88%QzNk zB8EOMm z(7`p$vv>tWoqq*-&)=|MCjLLe8vFhQQ!XJOHiIc2)?O3FVFe+;kV$3lj z+4Qvi92|g_!y802VN}*;#?o?l+l&RXpD_De4Sz8&aKfWoPdgGxblJ%cp5k_UbjTm!GN1`CC7+Z>gtJxaR zp2reKWxazKIbXaqcLqAR#>y2e!l+xwAs`4@bk+g zt3=92Y}U=c=T?M93_235eq{OL0dwehE55k_V0L5%!$!<42C zzL2)M#dBSRQCWK#OY<88cQ>yoSs8*w7?rh;v3lW~!u%6|ViQn<|6wW zb=%RM2T0Z)!6J;xI>1<0JUWqp7c zbBvb5;^{*%foL^YbrEe3z+6D-20 ztdAH=8tHbkWP7RZ+rZ*rFfiNoT6U0bwb7@qQOv!Qx7GYG@QN|JtW7@Xoc6e#6Hf9SJ zVN}+qjMW9-6sE43gzRXn*940&D(e_xq{sfV*T~-`>nFh?jLQ0qvBW?!O*?VxeUjBi zI6T6rtj`%s^Ya&PeQKj*jT9`xs4Tc76%Z`KsH|@pODk86rbXXN)&jvIjLP~>VJ*6K4?3Mzu6G5CFe(eGk;C5jrtroA zFDgu9{UKO{QCUAA#vId~Cy@uV4{IW&MH}x!y?qYsefMbrnM{OH zS!WPq#&hg>*#3Imt0ilaU=c=Ton@>Jf^}hc4?`;l1&c5$>sQ9oRw>)l2Ro&$-GW6J zmGv8AVc4_qMDLB)O4fgZMHrQJ4l%ONFDUx*4$0~-8iX(^3l17At-T(w-e;IAb44^^ zRMsDiC9+}~eeakDrL7kPi!dtdPsY+}V@emt4$1mjun42FP|?VtaF?c~V+T%=tY%`^ z5k_VG%~)D{wRiuvR^tb-nzz{@ zScFko{~|`t=I8%?08T<<9TzOZsH_W&rP+EuW4$4VEqWpmfiNoTB4YR{AEn=aceex5 z)?mRRjLQ0tvEuMeplmw$gv zvbG5pVN_NnV~NSbwEuz9-IDdMU=c=T(IrUfH-=sJD<(iKhrP7!35?33V?lZLRgm-c z(~>n&un42FYACkaoc}ykvYrqu!l*1WV~ORX>7JR+TP5p5!6J;xie;>JC@+P6+kQ)z ztoprqEMZhuO~z`?lTAr0i%TWTEm(w6S@c^Vevc~=gRi~mlB~IcMHrP;o3XS}dBOdF z!HcdHEW)U)I*g^wL^I1W@};dG1dA{#i(cz)j?von=UaciOR}0`wxvKAl~s?i%sknY z^gy>&l68Y%5k_UzXDqmB78-Sa60SwFe4}6yMrAc%td4^9$vNtK8mmCC2&1yDVk~X7 zJmRhO=OpW8!6J;xYRFh!gsqJ9CI;5ef<+jWWnru~g4M;cc9^u)wl9w+jLK@nSnUO? z-+&HFBU?B=hGhLFScFko%^0hdu(haS!$HaFA{J$YQCZCyOY0jS?{6QFtg(Vc7?pK3W3?2v zl9C#vN!I;>MHrRUg0Y$l*2W>H3nl9v!6J;xqFqF%DRTJv>e*A zt})bMj!IiM3Kn5hR%?Z|{&en_l68w<5k_UP_m;+Jww$-s z-X&Qx1&c5$tBqpo?N`6Y0M&ZbLxM#Zm319sX|3FD#gZnH^}1jYMrE~StVW_XIt{UX zDp|(`i!drHj5nR91V&(mZzG_QT(i ztSrGIjLPc3SX#MObiXuNvQ`TgVN_N;V>K1!dUWDROiEhK?-MM-sH~2Pt#8jZHOxf6 z2^L{g*7b~~d4M~=IffONW~&+2R1^rKvTk53ZI$xa^-~{}EWcn8MrCzktoB@~Y0`=G z6_T}3un42FIx`lQCM;}!Ygc2*+96nkQCVFWOY?`hzl}?ltQv#3F2bm+u8gJC#vD^a zzhrd~EW)U)Zj6OSVqt}+-(tzSO|S@~vbrm*Zrgu_3(;!+QNbdN%Id*bal+O|^PgWJ zSsw`&VN_O6#)1JB9vj*8Q^~3`n8y-EWzlmu%(~yW@Z^OXC5!zS7(~LTtlo^JjjsVc zo){uo0bz?UDyt7;wcuGX?Q!)UCt1aUMHrRUm$9xEtWody4WsgP!6J;x>c?2k1?$B5 z=M5{^uLX-RDvO??BhRtNPU!cZ%wZjrkpf{<)&R!RYTgoi!7#q;f<+jWHIT8i9<{C3 zUsI*6Ji#K2${M8DT6JLOO_KGrU=c=T4OUp!TvhS0WW6s~gi%>T7)zT|+O2JKNV3ig z7GYFY0%KjnE6a3wrhTYnHBaEtgi%>HDy;cE%F)lYk&+}>gi%>T8B6m~-!~uVkgPnx zB8+}b&xZY18}t(jgi%?^ime;Ivb`j2jS?)v zs4N#_HQ-83wNkcwCF?%HB8k;MZ!pThdzP|h;5pxgc&J|93{&Ft%*i8aV)#DR&4^rUb8;tBr5=?wP7cB^%;b+E2^dI5WCm;QJD zw9GJRgHi4cFJa)1#mDQKwDiz72N>fczh@xQQ`bWu*KX88Suz%uJ)|G14X-Z< zdxwC=X9X~ss~bJtczT{?@6x+R#ADm*%|aoK=C?~0wtBILp;cy zyu*Ha?ZGd)ut z-4#!quND@HF*X<8Qd0n9ijJ^!Jl$Ub@PW;`5Nj2@5)LnrDVRd9#-TS$gyl+qioAH` zB3wb1e9;CKPa(3$Mq|zT!Z0_CrYZ|qG*$|#JI{R$PZ~Cq2kIQt|=RRzF-R8BokhU zh)MJ!hp_iG7`fEE>@^?}IvAProbxUs z25eY2CMDDJFmLm>zQ`AuMbg3E(!(n@@^GNn*M*tjRTq{tk=!^v6fGl1x>FH3J)gZM zgv|-)HW}1m;dLfXFuXlP^Y`Ml7nC6y_q@2;d%0LXnMZBsDx_Gj2g=1hDJb*&NM2C!GwZyB`*o+2tRjIs;VXuavl8Kc~ zhVoVwL+PrD7s`}ZyvXVlsbSd^8Iev0hAZ8THvnR`w$rdOWzd^l@G8N=IT>P{ z@%LQD7v;{%$(A|!i8l{nTWzN zrKa-C@SekssOiR@6)BzbdC!TI&iPfRbAEr;GF9`dPUn2ybE@W7ozD5Z=TyzFI-T=* z VUbvow{uBQA|r*nR9?s}@uz!d;t-6zt5C9D@k1o6xm8#^K_yiY`gac#z?j|k)1 zs)ccF#*T0WZPmiKHe$-VFqBNn9;-ZTp7dlM3|Yw z^jsNZsGP|A3q##h0T4Zjxw+u?h&+!hK8?5Tk#o0%EL|Dj-}7uaznwhDzc6 zLETyzsw84^7+oydlpR=@l8B(HR8=($l zP!Vz!0mXGG%k2m#uB$o}*QE@?Ds@$d;<|X>7A;hzuIf-+moliU)Kwjd>*7;vb@{3e z#dYxswmMzap|~zSy;i5IIuzH%C)et9Rfpob_|#gRuIf-+mzY_ZC zOlYgFTMKQ~z!DQP?ADB4c8}HWaik^re5qDnlG8E5o1Q_R^x-1{88&Bn?>>Vv?7j@Q z&t|upBqzz0>`zHbO^Kf4usYl>k1fre6wXN->Gd)b8R>3YZ)wM2O|f}Bwj_JhlwS6< zKw6T`ZMRA-PHUPs+2;4Aq*?WIro{g2x<+E(#Qur#_T)+I9}kHI_)5W_gA?N&emzy! z2F*zxN5JOwCt2;F_Zf)|TtQ-=oZRfZ#6G^Ff}Dx?$2r{POze}I8n`*lsvqm(q?InQ z>a}RIra0_&kI$8C&CSbA9IUT~+jQj?SIRy0Op|GexlQh%*JvnJ_0FFKdc zm1avz)(ygxo}A>cI#ca_o6DDCXORR4tjSKl%afes)WI{dZr96dXi!|K z*Lnb2FxBZ!awi4cIxD9ju|Hmho!CFKsBj9s(0rnV+pSJtk~=loou$M(#r>0o=RH6K6sL`2cO! zKU-%dx#2au$;obv=Ip$pTqG9ED9lgnpFblnJ7-#!*1iRjk!tm$f>M$kHW(7UpgPiE zhcC_TLXoW)SGkkX)u!g?8toW>F1Ov|^82iY14zp79Yv@RRHWQF>8vE=BjEBm94QXu zgAS$9k26`N8}V5>!JcAuCc}ZaomSlUFewKwy+9w6n(2=znK`UuPL#ByfYssmqy@a_ zl?r%zP5~R}R7F_gCHALVAarYvWUI?Txl8g^O@oK>umLg2(CYSNtJ|LHPV?FPRWq}u zP0PtgKQIm-kJamOC3#c)PD8^eSvHh!hMrUO^nlCdb_YU9MCsY%wt8FN@e8XF81L5>$6N3VXfLp-t6;zvHyJZbhchuYl63KbUxb&@@R zL7to%NJ1;!!jCdPt($^7 zPjc9k9d@T%aSw(|^M>w$;p(wr+VG;ir)TEpv(_7#<{TYx+DAAY8N;1+|8O|yLR7{` zOm^B_hM}8k{jdPL#lB^PzvTBv#U#?3{^W?$6GIJ2fcx zS}`H{Qj^l)Rw5GeGYblg1Ro{?huazO+o~WGOwGY?HJI>QT^_H?o9vC0e|fojT24Ws zEJ&)=Wlyr({3#J?i7v&%AJg|X8aAawkHM-wH=F0$0v8JXaV`=8nJ5NyoZUkTpmT=8>l*8}F z@;WWeT9i9A7dNgLw9;CZ);oRqq*cVHs~owg13lI2OG!>b#&EYuR?bW+KW(X;zQBlE z;4ssiF8>IRZG^|K*MTF+>UP;(4!759AQ_=)iT%^<>7x?+Pb!jguszM{O2G;;$>y_8 z%bJ`ykuBG>wXU{WhGU<~+_rAc?zh_0(9M%m9WZCW<5oUwWAwJAwpJEgPA5$@jw+0a zg)3egJIl~vF%napc3ZN)I#cQ;19&Lm9cDITZO;l>7ytxK^l(>)K{Mj6OD4-=<9$?x-elby5( z@UewJ|0^#7uz0p5rKBbW(yX|-61RZT6b_qMoKBmjYqn$8ZclM}9a!UOi)Fa9JSs%y zq)Dt-8Qh4@!>YmQar&X1Dow1iLx~2jB8e_*n#=D=b)=+Rfk>M{?pAany0j-P+3T^p zyj2qoenk?oknjhRun$iSC$c+eFu}+{B6&V+XmB=>j3FCVM7U(!-o-sK-B2vu18T;X z=5V-NI8OYfEusiZd=s`9&)IY>4ho);UQ&tH+muiPPaxI3c$QO1vNS zZA-x#)@~S!(N!F_n#uNn7wZ=48*IIV0a^WK++}s!94W~*6ie;_gh{Oh)I9*kHP(1O zUlKZR$m(kr-wYd1ATnj?T-GF?E#RfzD?QDXO}VU&G^ZoUj-I4shJ47xDS2oieRa=W zX|h+hhZ3c^+zz(~tDSIi(F}}BWRzY)u6bdD^THO|<+EW2f*o-fxr)WU2dgXiVDhBK z9%8uVS>_GCF~#M#Me>b$>(Ri%_)qLd`O~S`g1K-GheOo}#WHYpLT{hlXY;!KE~{*d zKB=}8yVso>z+9mNsk`EgB{d0}X;X~}QP;iRKP#ox;4r%xTIxM9xXr z`T0_9K1XuE5#HUEa|?0LsLZY1>hPvww~Vt}*?VdKlh|MM;c&jr#yT~{p6W^QVwkc$ z6QBKT1=O_a96AO2Po0-$O>+9|sVQ*bB15zwbjZCjZDqY_$$mI4L$<2Skh<$iNli^k z^`P1G6^&Mz_@%{6c2&6Ei!7VrPy{yTgq^nVFwCVVYdQ;YcFM z?y$SvI6&71MaYj`r2b?yPLj=L^V!%EhV)?}f?XPx|Ex30iovqQm+VVT#__(UmVTQ< z_o7aokyn&2m3puWaVOhSd$E@AyqGKyPFj;(Nhv9*J~?N}+w!O7Wg0f_*yq^Yn5zuVEA-b& zdJZrHU@f2QNey_d`MBdV!fKQJ2lh8OyXT8eottE{x}DyX6wGo~W8>1#4I~H^i3MPC zvdt~~X5>C;!{K?dJ2}-Y&x-Jq2U;XcZD}||bo;RCk1*)99?v?mc5l9<(s@RT&F@Cj z(ml8QhYfT;2J1TFHhf&H)fslX)$UEhHo==@7?6seh+tCE-Bz4QV;*-!7|#)ild-@= zU3+AQPs0V5G?x>O+&Z03w6s$Q-2_~Q*PEJ52PlRdhRnlNR0n27oFMp}*xp}xwSc{5 zUar9nc&&jnS89^|O2rbFgcKr{T`5?dq&d;qmFq`J2C>z|k|%Sr!Jx|;7`dmJJfZif2E5&N}!NUfiNB5G`^030hsFN4zCEkq#JeNPk z=QeoN;psM7B1dwm*nMFz1h6`n>czP*esBO^k8(=oxY}e(_G5+Yu#VJD7Xs<2Scp%; zVg`5XODMceT1p_<<4HEO6nZUP_?dFZvOBedFdQXqA7mtO_Bmw@}VVoEh{%L=~%4BaCq+U`|ZXYMPOtY z=7}_Gvd`)A;6H;$h_16>-{kc>=@B%l93bLoT6R#>g9BGdQk*FsgH7%ytEB6t z#Cpn$)0kv`vPbl!a8uzO`g+C=el8>!ZAMUVBRd2uqW z^#x2`d~YmKK5HPwk0VGNkIR*3m31Vm80$4mp$;^yv2BE-&&`@;Sl;uqQfV^9>c-C1 zZc9;JfVc|GR7fzofE$(SQ}P#;8T0{6MSeSSs?BZctrgOU&FaOC0ZBOBG2DoOHJUP8 zBw=tlQ{6Tj_WAnR1lP!K)v)51O&N%kIfH*_wJ#f(A!2^2r z8aUVx39)ytUIPXIIS47eSkm}>K3z-M1EGEo?JxeX)zm1d#|&IT&Xn==w1C55xL(#Cg*cmzpPs8B z>2U%_fNLb4tymL($2AI!55>KLd?x{Owhw30;~pa6<{>_S=Ujato^@4~zFUw`3C!pO zuCGfK`c5MLKRjvUNAY}#`c>fE&^H{FSwWU$ZK3 z-GTcCnEG=#u3;6p_*j$aQDEMthC%3xPo#G9*EX4Q7MM(1?q)C(swg7P0=u{4c_wp$ z9M_}@Tr1$Z-)l0ts6r5~!iU+Nt@cxT(#(4TLpTc7M(C&Pelz|zeK)}8d*IFpEDa-u z3(-gQRe!n3)D|BKIxd2~p}=@TaUuH9yr#*(%nHRt(6<7Z)uFf$eU!iLz;zQv|<@EqFG87l0kLtNVV3e~(6;cE1e zKR5$S&4+mIu2kL*!1N5og_M`-&j-x7P+WxemqZ-C@zA&w}9Chii@D{ zTVVbO#YNE9_)(Lo4L%gADlhft1YpubaS`<00nEHmT!j2R0nF>6xCr__0Os>hT!=pE zFaH2jdnJ{^P>u-tIs(%>6c?h8p04HxW@;!dg1%BqSQAIxSS~TEd}O@P+WxamIJdl6cMtF*j41TY17?N5#auz(Gr+uDjXr9R_kj62 z6c?eq7lEn$1TRHZ<)!}I5g1!2E`q)cV5WxRBD6;-Fpq`eBIw%;%P*r*3kTw{YTS9RW^vwdMBor5tKWdNFz`PZTi=gjgV7?8-MbLK%n8r^* zF~XJlOKV_m5V)$!iw9zwoWM*E#YM`6GWnRbZGxd{vddS-_Q4qmRnF8kq7>T!i{N2F&qL zTuA;%U(71(k?^6Qmm`9{fvd0|#D{{83(*&cw9Hjl7vn=g$3@Wh%qsX(d?@I+2>RYz zh4n5z6m(n!eYIC(ZpBBzh3KRH*BcmHC@zA&3}B{);zG^|X?&Cl3^R-`Ya^>Q^gNMp zZ$yFX0Nm$M;{J;Q7Xy85*Wk+#tc@Cl7%3AO<}ljeRl$P zJPa4EZy<2vp2e3TM5<@1zlWp1^#yKo6u4f%or(fC0Jv7q;mZ&r<*x_Q15w~Q0yjSj z9QCVbqrlPm@S!MhRF1!*z>#0;`aHf2AyRp-Mf$)faMuHu9tExmaC4%-wFfR31+Fb{ zuSS7u1>E~l;93Cpa}>BXz+H+07YAIc7w}~Wk?NWH{g5bdbbdW93fwioEsFwoHE^q= zz{LT#ISL$IpEwo;j{5x%QQ&C2)mw`%Lx@y=*CTyU6gaAv+oHfxf0-2}?tv(9G>%@5 z0@o3^{ZZhkpZ*dBj>=(Phc82jRDX1RqD>UI>wxPL1+F)6?kI2;;O0buYYN=5C~!0{ zJP`%1HgF$?;c(q0WPQNar(wA8d9XF~(ewL_AyPe4{ndHVh>E=4pmBM96gbM?jZxsJ zUPeTLBmc5A3LKSVLlihF$461(evSg?fxiF3aN+BXIN+Qw;mZ&rwFk9ZRunjzkBXzf z#RIn{3LN?SeNo`ZUsXhbs{ve%m+@r?Y@ZU+pUp^*jRHshs&*JIyx-pdT!$!daloZS zfg}HSdla}Xz%7pgNBy)s3LLfDu_$nK9&s@WTsz<_ui(oNBK1G2zg|(`Xq|I&6u3^n z&5Q!q9Jr^Wz)}BuGYTA)-2h7hTqX`XHo1&;d5^-*=) z3LN>_5F*tJ*^Q3^N9~pz1uhP_Nm1Z>0k=2`9F3!m zQQ#!>s)k_1UcaH)`{%UX(I4TFd_th98*(F?7 z6gXOEFN^}$6u4DU;FQOGrU=iRCKC~ zd+EIlS;EPL4BSoW;HvFuTQW4&pk(;cZ9BmBeh=#CL%r{zo-OZU*?`B}NS zS<}W&%+DV?p(tnCq_IByY6Oo2=`ks1#@OL_8XE3oA4|Uq;ctNAzwPOfH{o{E5Yvr~ zO%rf1VQOmXW_qF&mz~7FzMP3O@(S{@3*$Ns?;PjHQ@y6=+=*X6#M$w*9XvB=24y(L zviV5KshGl^^wqxPl)12Z$%UB0I_|QXl)SsTf9Xu_pBU`JO*HHM$t2p(o?}uUNN1Tu zKIAl$+@)jV8{OsY>2H z5A|0U4%N9&fUD^vwqlYg*lsGVtW>nPgXVJbTwAIC7SFC5V{smI4-V2RbBiXpgC$g( z#e*6ajS8mML2fE{@x}<630p)_JVG=``Rk#1FxEkMA@sbj4&@nJ)3(0Ph8nsls)_BU zvao{uKWpUwZ{0_$ksGkUQd-4WBU>$~U#(;z4HKa!myU?IR8m`&;U=BeaLZpSCqv>4xcOnL<0Bbl@g z-vvzCitj=u?Ielm`wWs9H56<536hhg{*G_b9*cJyYpL}hJ;ZSBAtkd^dWY&PrX^j+ zWkKRvHbCO}+YKq3F%CkylQE7#;&v+_aYha3=lbZk5j?dWB%ay>l7nfv8PX^wK`LfaKBR?AqIzG%q}h;4m~GRRh*T9Z5AUR$BjBnC?9T^KXL z51C`;JPeKTrMb{FEq)5QqEC370Y6xI&zub{%}o{##F;vXpQ zETi6p%a*0(vE(31zC-(?6rQe!-6cC}x)XLrf6M=vc!SQYT-k@79K|mtkp6NKt!8%Rj_jQW>SWtWlWPdJZCP@x zL&&TiG_9zI)A=Gt`!O+_9)atmS=3hE0d*>BLYY#x5XOrRgg!bpel+!`@zkHDkju4Y z*v4Y%!HXE8upbnje$^e^?=}C1>cLW{K~YWod3uyyC5=&8SFZhqtVf92uW4Cy2mYpd zh%v=Lr)877!4?b$lWkdAtZwEiZYEVXLoc4cvYCrO=#3m}Swzb=GIKS4QHBm^BHb8b z`Mewrxq%V70rJFGHZV8Dz*J!X*MXSK}df11JP#d^B_?WW;M zzKwOq4wlV(_0C7u+$CFzk!UI$?Z!Au7dFUybh4E%rAnaQru8#&0$P^c!SpHU&avL$ zUU%?8Qo?$!r)#Che3=|e-yIc2mnti_Q!Od68Hg2zLb~8MR8GYWRVMo=xlWbIPD-x$ zuPWt3DfwV{vaP%YQj~I{+C>TOiHFC)RWf-?bR- zM@Ss^Hzbaucg5FbsqEd{Ov*$YPu&5DYxx9H7nVx96Rw52JzrIHL<;>TGuA{MssWQG z;G5$LA#r{0K%#X*tm!>H^-DdK=ISOawF@N9y%7@U7DJlGO7wu9O0(x+##j%D=jBUC z%~{+@9d`i|*OG|#Z^=?eLE<(hLgJ}+LgM9J2kAzJ+Ye~~lYWNOmq|5i;<_D^;vwC@ zq+yV_KAK{AUf5jCraRiMVTucGxfYcsCg;1g@Q9^ds*+p(s;ka&GKA<-w+G!EYrnUsTXo|+G-A!Cq_;kXAO zW#SWSqQg{`f{Ul$@_?SsFy+y33lwfXTfwc<&-6m=EfEX1<;Ze&!AyM*a1ORPVo% zIjS>OTg*Ukcg1GJlx*kw&>?zj{|T&C-_%Ns$0)Y-^=Ko$~Ih?e1W0+q<;C_6C>Ip4t}t&>P%NS+;Bn)MfKq@dfO;4|r)sM-8Lb zVn^s^N<~$Qr3cq7cEnmmVl(Uwis}i9>I(Aeb0eOr(~WqlU~iCDpF4Oj?^J!?=QX)- z5B0i?F}ss3o8ku}S6dn)JGSy#^lfqO^qBW}6L!pMp=WTAmcfc!G2T+ju5D-AM%!7B z`P*`;Udv{C49$R+%_pJF7TgOZZu8zSJ!!h0CNyqKcAIH}#1f*Y(tYHtx2!vKncS88 zENvZBZS_Tcpnu2M%Ey3=KE_x4qW!#>Q~4NhmyN06E;$=hbbx0K&EYN^S;J%g1ZzMm zuYX(d`53Ro`J1OK_Ua_dX73`H zc)R}9_e-DoA6gYHIb&J;KTM(CvY}LhY?gmmaP&2^#VJ+I%{wfce{-90bg|cs+*{pU zce_hY*03~o#0ThWJbmR`8ZVA7h6;DWZ zN5s1+I^Z^sfLg4ZtO8J!!{WD6Pj;7~69CS8fcV2!zKE5{8{bP*H8}+IYBor`SnP?) zMGq?0$tAmMxXs_V6TY@AYKdm7_)Jd!w(>c8CH0hR3R`(asG~3rA94!8!{WdRE1Xm? zvnjJt1sdxgFwffo68EwB1|&CeUC z{)r!JqWum%O(NEG2oksP1thNd1SE7=q;^G32beS%63t$*COWI&jB${*vA8@)v{#Qc z-2;hhA&++li+c+aXYAKgW5MG&xEc~q?Er~$X%^=>D1tPH<=}ZpoN-2%nnC|mX5)H% zb1f;5xR#e8amJ^Ra`A~ZC164s$n=ecl**)8kmy_}*7N`*u4OGGu4N;nK`iwnNL=3u zNE4X8KOu2Ot(qF6DI{KNagZJc*KDE{370zQQa4@d1!)Dt_0y$6x^$y1Ss`&P4qejE z8?5eNjOh06;J?gw(-s_#a5(;9OAp%43NOeUw8eRjW)1UZ8b*951#1f(<>V2!k~`E6 zR}+@AkrzBXbFffiE5DUgqg4&FYq*D}t>t*ENvzmbVg*C3tIZaad+Z{zNewF0pvJPf zR{5pN@IJH;PS{!KE3c%#AlY^6w7b%Ztk2ilEM{AuY?!i(AE1?$%tvr36-Fmdqh0V} z%cfj--F;>^4hGD8eoojsZL_9#L9Ci8Q;rgUgt> zSH3n$XP2%UEzR?3T3cUrC3mV-nYKcvF%!}Qg1b+5=ZZDZqX20{)=;bq=*taS@&;Jt z8S1SOGRcP)En3MD#F|ndIq``#jnGqPLz>M}%k)$_TXEnMYubu$I?{|aeFDkF;%K8a zpT)^z+2*=yqGMUkwL;=K$c9A67O^JU^z$4n({V3CTFg=pK;kxN#nP2oqhr}FOsWmc zQif}TZ?2iPZ(Ls@B)-j|V_EJ%G9cZ=xCM|n<4#ET;1g?Fj&JVJS3=5WI6A7OgWFis zEBNM&cOh{bv`8=cWsu&X$6>aK&@P{|))QSqoaUd$0=sXd4lo`%WCzf;Gq@yBvS$z$ zW!lxAMBQjss8Li9x-_>V7TWv|w$K)O+`)$^SH(kOElb9rKsfg(Z-NMKkX`fP%OcFy zCR+Wlb?JMSMSTc}VG*E6@-?GHX_e4da!F-T zQyLQi?C0RPbZx=(@pSHque;)VIdSoE$^Qy_xP$i;lY%Ah6}HDw%QAy%0NMEsHj^Y$ zk~^4+^Wz7&SV}}KABaB2+>Inn5hMoj2C+QcQKTIL*~-^mxiJIs@)vVGbm%zV8$`}o z(UgLfjjH7h?)L;g)H5R*%T~UHDxS>`!9(8C^^{|FGNl#AKBaWs{S>KHwYHZel&ZxlXaYu6oQa9*~HMK$oafuGYxa0Cd+RnJQK;qV>LgF^a`Ena;A#oSBLB}13w2N_R z-NqT`_0+~l*~?N}B7967D&DioW^q#rvN}Lsym8CD!mfw(3o%vowrs8%Zo2KLbDRnJNs9J5s ziRPj)y3S7wI<*1D>Pkl(trCHuNF|k7t$=>=P*~v@S3)=mD_zGIKlc1=2VbV3X17uo zr6ZSO{A+us5592;p{^~s$2#N#i*uKIa0zXEEsIuTFeBeJEK44RghYKU%BF!Waw!p^pCtvX=<}lcP!G#$zrcwXPFHLN9JH^ zvtS@L;h^Q-qcD_E$Flqb{A;spa$!%s02g^Iw(^EG@i3e3>%egR1LWe}lpMG6eWuk+~#CLYfCdaUji+2fgBI&UN{)rdSx;s zy@%k-c)MvGjcpHx8_3$M7YgfzUem!=p3b0XTiA)zL+$y+gG_}(eM|l>98@y5fvKnu zbxX(K%tl3>yo2v(S=1hvSL1wiRq7Zsfyv#XtwmVG>Ew_bXzclY-`l6<8_GD@U24Or zhkc5pbUdmClWu8#OSa5_dY*TxEOC^}4>WD%(~x^)99h)*UdV~2v1{`x67`$Q%FXLn zsUqIgw(@)csIjTwA>UeW!4)`P+2l?v#a8|z&!OgkF&vmVj6lm`VtDz~XtQjNjrW$(U8!ty zEtW@cUtZok065}nczGky5ZW4pi{4ljJIWTsdQ0D72XDTFOO~ZIYU33B->WT4-^7G& zS)7aS;LfglEsN<;r{rWk%i;`FM#)LDWpQf~&cpexLy}(Z4z+}LLQ87xBYKP38(i-O z30>E+xFfP(Qi+SW76>eVv6L}#xn-`)?t}xDCFHf?CGLu^TdK1oDmi&MyPjHxf zNo8SgOIy?}-_9bfsF?=`i?w~&rRe>>aGVEsY2dhg-mC~uer$j#tl6}U<*E~!LQpb{`~5VI^L#+`83vcydFg7Vj-twU=Z?=D7u zv8u9ciorgq#*Fsv%AM}6M~lv~5^7o71h8~Kc{-LAw?t8p3+O-& zY2*o>?6wuBjZJ@mdZegUCDRy{bPvGd_X;fumx}7!26^LSEsI|_a-YT@6?r(PwUvKQ zYH)WM)j+74;@MZBS9U`tQ4vex@h=VX(sk6sDsF?0l7CxR7Smq5T?PxGs-d@wZ$wLa5Nc@|AjL2G4Oc{$4hZlej!0y$iCITyH3A>60iko0q%dkO!CT=e{Nc$7UJZ0{h9y6bWaALmrF=W|RJ`*XT zwkv+6QYL(0S>mF+72k!2?OK*3KrVgxGkjM}219Gn@=vbN1{fHgGSK;=F92>ay8{L_ zYR4bwI+n#9AYkRSCXaZ;5Xvo2e=68?fBmMx>p z6KsvQaOYzX`IzT!%~nnsjodXf$5)8`Bi~Nb!;>Ro#b7%VF; z>MFEDqI_DHO^H2?+q2HH79Jbk!sx5Tvm2sHb_pgOga~E>U)NuK<`bSWCoT=a^W9DN zWRNpna_0p)AY@asW$}BAA+{FSgIE^RwMiO4wsJ3ep2$AR7_tw+dZJ?fMch0==Z!dq zsJH`v=!IpTA%fS+-EInEl5%Q9jj*YYt$ZN*&guEKa=H~u#It8&;<}0EvN?)-ogqxh3Z=CSXP5`l?K?}y&};FjDaD=LRISPvV5&a|ETx?ULzQ!zKeAO z);{PN^=lMiSwB{`;^}nk3yWqYd{A^v$vbR=YAVXHl}|DtdV@U*>_P7OM84gSboF4q zsVy3S^^J_DjM6q%dRp81PR4q`G*vPFUqe0216eDcwp?H(!~w`a0Bz-TZ9>*`SkDVR z`KX8iD+pIq13dKILC_B8sU3T>yMIHo$WG_QIUk+QSL`}($Rf?%S{7wfMcM`gL8A-4 z_oL=xO)VkuBZCA;PJH;OF+Xz2#NYg&r2tYgOWlRoL^meX=_B`WQ z94$+D+(<|cre!gtCt2zYoY@aj-#vn97ng^jA6JBA#G&1vyeEBmSCG%+;ugzT-^lePR5u3i61uIp-T%O zb!VwBLE=Y8Z$Y9?8Ebk661j?4(_u(Em~;w~lQGUg+Rfq`qdW7su8{VzxS@L76iB>Y ziuJfMNDiju8A!b38zJSexV?}#<1{3?DJs_V7bI@uKS=MhxDJ@PcwApdhgn=AB)WMD zy$;eTCXIkZej(PB3F&(#ZG-e9lRksQwe+iFGTp^;;DN+zEfZ1>!_9%jaY0Bt_ZuN` zyN4m2V7OB{?gFIgOy6~NHSX<@CNkU_NaLCGik`X!(*Ic8$9f#y6hpVo;b;&in>+{e zbm=Kw`Wn(yX6>RbHNsY$u4}}aZiIA{NjF2{THc4m+x%llX)N`up86N0o48$^l(?AY zc93{^yFmJer8*&TeG7EyLrB9JqXH5gJjR+XLP}TB=iz`RamMZ#ZW@m z>}Ge9-DEcjQY#9>CKgD0Xu>P5fMcR5tU*=L<@PmlJ?|EnD z-nod9gsyElzlW>VAPQRQ;0)@ZPV6gKWD!xG&tG=SqO#4fqf6;xyT79E%Q(I5<0yyB@i^xQV+Rcm;S$+cX8(G}R}9`IH$LAz*DJp+p+ zH>3YN*&((9I~zvS&{qYxs$sikVD>%%0Ntpt+H5i}W&uo<}S37nd-BVm*ySV;*?7X8$VjW+anp7NYZDfBs~qSESRnkos~L zBqR$$3|^b6RctoYZ5p<=9)E-Iv=UEwnY(K$)*wV0%7%x^#VWKj-ViAvdQ-t=fGG`M zQ`$);$+D`r9g#fffa=o1rYb;I-0|<5_d&OL%mrVHEf$E!39r z&<}6Rzqxu|bS*}sA9kSZHd|%pC(BcGI&Cha2 zCv9*nqMOSB=K)i5g^5pPS#thtvQ=mavUIG+1o*9Sl(igh?gHB+uS)Y*F9h#Jn?8Zf zp0>G{YL$<|%G33ZwU)WueM|A$dRcKl9$r!9sGCK3G>Eb7Nx*125r@32zX`H;@>#L|4F7 zf}IwomiWQt`rsX`FFipex}=g?qL{1j)o4_vZfCa2PcJWr>TfON(9OLi-cMtDIQdN* zY`iV2H}_anSk z3%-Am#u%+3=9oMMZQg0(^a#uL8bnnC~onwB;g3YmcVd zm-*=0iZh18cN5clJ$zhpCVWW@R|p?3$>~PyV)(e;hv4%v?nWba3w#+Y>}>;g7`{9v z?=*Z|-g)@Awub2JxxAk6@%#>ikM@hlXmd)KHf{wGa{Uu z2VVwDOO+?h={AVPHiph2iLJo%+P_<4w;pf@KKBNGI|e)^cfT%<&fWD(9fa>^A-2V} z<_^=!8e$Bn8~8ME#DT|mv5zJ2>Fnb%D7UhnG()`-Gt{zJx-_#@_C)CMMd*C+^eon7 zw3ChDL3*^4wc$bbv^`|bnj^3~@I@f0`L)r=WO;ume48HQs)+}_5i9N|yH?}uliB!> zr)~CL`j%2l`jY3Kt8sGLwJ~7E&Tk4`OXgm}EsAF^p?5E@Gy8lL?5w=g?DLeuDUPz% zv(M8_%(BM#t%+YCC<*05*oa3Hm=B=A6-dH3y|e79SyN-9$~(FOR`wTb^Y5PQ8rV1c zcumUh`;^r^c;*TB=y8!b>o>-Hmxyg+E3{nvHq9Njrwr3l?Bt<&DTeIRrmI$4<#mvA zvIMvCcG@Zv;SU~K#gK1)n4gciyH3`@_HTV4wpH3eXJe(#I7VfK)Lla`TjfBC=Tv=2 zrdg7hz3}P+8(H7D;+qgHElgLo6Cjv9^iD7;0c;?%V@AsM2 zz75|Be4@3bsGxoXgKsbk``p0Mi8?&C7W!-&Z_v}j$E9?D zkHCK1A-L`;pv7OLg3Lqv5O4MsBc;VaFR-@q`36%(?@|T!BCE+@~{e zmOa}r|1qS=Gh|x^eq!gX;D2spe`r~M*3?!wFb12MUZlHxuDKWR%=%7>-I^GKYfPMJ za4dHI3kYxw9vVBJ7X4>UkHSueM;Imrd%F_R0>7=3TmRkIigN*G?=8sa8_zu+T~?pW zuNL++Tsk>87dsXD$5!x(Az6WL7sh<60j%D*PO#`RQ(Q%&1!Gg(c1o8ku$&T4H}`Mx z1ZGjL+<~3B!v>c%q8s~jch+zXd$07@lL@pF#07P^i{}!LSz1V~Z9;0zbqrzp%9|^5 zxNWp8;$#MuQ+YO}iIv)t?PL~{2gO#*rT-?|#TC#{$QM~;w{?SaNPD1h_yuhm#`K$? zd||~&1>-W`oV*UJVlnPv@07Q7aV_i`<$!C+n3^n0Xuyj@TzhU})BBUp?1GWm@rlv) zlexi&__G29%y$Z5+#m-b*&JtwkK6S9w2k<4c*n0TS z*ZAAP#~Ea}I6=fXmjer^YXCMcpyG*I7Gf--x&qHq727Jm#sasi=d-i$M|2)|zE)jN zr7eLpjEK4x8)5>Vp@>4BMDR02@~(wC8GQo{o}Z=hlNKYzbGqLl2m0nNnCiTkezCokj=9(vK zzd@tk=9oq300@WTL!M@Z&Qp0z|Gg)HbJcML9w&LsC>PmrZU(5RkQ*V3XZ{KD7;?}R zvH!82KnA!rt82;q2D=0Aksmt}=_yM1uvY>D zIS!woN~H1`&yv7OhQfk+nL*)7<{IdA1@K_RY`wzfXJSpm+5aQ9aUKt$(n!OSmy2gn za~HcXq8@MsC?QDVo`p1xXi2$Ryl^>_#jx*av3O`wJTWPTvICe-uw;s^LVpP9DoU`e z(v2jFE<@HK&(@pA7m)@&NZKmBlo`~h=^FB6o)LQv7H;Z{^nsLj!P~UE(Uo0mtNatF zleKJ>r>Kc>!Azu?X|xXY@lW=+GHDm9Or9l=bXkM{?!egA?!Y9AJK*o`4t$^aCc+|e zZGqw!yK(UGe&`1Ho-;2Q^A47)Q)TYzJ<=_p~&py#CM;D;D?2c0t@QcPbP!$;3< z#js0M&ghG<#~8zkZ_Y@AZwm{{#y8JV0el-+*fe}|Zor6r20r@4FdmQHX~a^AQO_5n z(M2b}eEJu@RS3fm1|aT>F?@9l9}T*z8LqM6Yi{^j8@?;x<5Db!uWFAjrXq2syI{6T z>Q}fuVdqpJudy&OYP%L@)3IBH2h!x~xjV3wIs@B|T1X%fGIFsoGIy~p z1{)3u=?-iq04=xUv;}k!QwKAV6z5rzghy_u%~C8)FarnK1qDMG4G-Ph)#4BWYJ9XD zYOz%wK%%j>$66o5V_0w?6>iMBZIvG*)>V^A%^1vK<{t#*jL>>3s<|F;Tje35k|NIJ z&5f-h>c!#Jvu3q2pl8YAooJcvfEAtIibZuGW!nH$0V_bto0=cULY72F@+D~#O&aCI zIeLD|YU=qp!t(R3lAoZ=9N!G3xFJM$7z<%lvyRuDg_ZsVS@638{PK$ixxdjw+<`_+ z3;m}X*{H7Vnw4;itW;kpqf_=481*7#*s+LVlPiehke{q`@6nz$$&$@j8oK zumol!w9_zSk*%gX&{Bk;Xi)!in7+Wu!BETO01&&?+0+wwm15j;_tY9*v%HZpcQ{TH zxZ$eQC_9YSDWxua0y2;@z^n$|a( z*}K~M-eG1$t?y>Ux{MQJkOFtrX3f%b6v&T|raNayV z8VW@tuvLx&N@r3oSb^wZz7F3N_*pZWMj;f|!|oL`>%qMw%w~+{a2r|AIeZzi9}6X0 z*gV~+q(xF#Ef*LJ@(IIm~bI|}G znv*;FfP3*$nwdeBZO;OIy7rFN*cKS0%+LS`nxXOZb)n4RaRg*2T>4J7H>&n|z^Y8o z_{H9hbg?&{F81_e>2R^v0qN&M`(XHHpn_wxMELjw;THI=!zYHFroep__&Eq89u&Q>NI?}GX_njcrJUw zN9S(Eu=N(sO~HT8eaOIVhmV&AP5F2kd<7q8{0bjWb3E+O#&isakH@;Pxj&S0KLxj{x929~`uaCk<&e z%5|+~#R^Gpqh-v2jGzvcbqIW*f0(Q(5M|p&>#eROOQQMMje&NpyY|eYzKSkB%r`@O8tHzd zO1kw`Dn14rCEk)3^O!U~Z&7Z6K3#>)(kVsIEzn0H!V_qRtWlOdNR#c=iwWcl(5%PX z^Ak6gY3aDlfZghi{=gexDW=@u;@CczJaP2U2&S_7nLvTxP!=H%5Tn~3JQ1K-^pphN zIoSrMo07iRidc5BYg^o)mTPY98vJ>ETnEdeHSc77m=$ZU^Z;aAW+FEDxG9m5abuYZ zUk*Mo+Il1Q1^DO?z8GyceB97Z!N(g1-Gby&=oTcG(g8lIo*3!|&I@dmziFYe){i}EODzQ1FA^a5W^{T@Wu zkoB}E6+4eV1G0!ONbZfD_YOj7L6u4#PxKaanaY+{-=I0AYsqjgRO2zOieH5_p%U?2 z0L4+^i`KvfFn9EYW58;jVSmOh%m>2V^BX)2hDT}Mj9qvW{`C8~8jt#wXAt@Wq|TI&Jzwbs`+|E=lH#wDO?d+1BJ8TgHcG)x+p4;_d0F!Ob+ zSwpM&11|62bOyz89C|w8YYZP}5UMUxpu14ApFm`^)=@xoxvGAtfy*VCovM-hjF1c1 ze@ZjS?O0P!v7RS2JCO4{Hj8<b$H;=0@tWg$pJ3Q^ZAUQO)aU z&2t)Q%||uVnh$88HDAfwD769IWx&JRDECo4f6c<8u+ON;fW}&r(uTj)KU#NZ?eVn; z!X{<(ORfMP&gMR1f6u}?lI0zW)oPYu!#o^K<;YP!IJU9jYYrc05o)igK0?Vq4vcK& zx?CzVnFj7_V8|tzw3SD9q2&IGNRkUlNVoQ%(oM2kn(8`~{J(^Jo`%TMO)}e7BlkR$ z%lqU;=#$Yeqpn+*qE9}`>$|r}LLoy_X>lLbSQJtZYoQv;X`t0B<$VQRe(A0V9$wGf zN37b6#rld-xZZ`+85GNLR0G^cwapoXdZHTH4Y}-YI7W8>Mu{r&RjFJ)*$|gcvgrv` z-SK$JG51mGnlbrN^>O_C%Gw8Omc)#Y&ZrSbi~xNJSBzhtYwjav8=f*6zs}Hq$)JB6 zN9p4}$~9+@TpF8o7fLqGAw^H~pJbEV-r(vklx#K|fOVr_{*!EyTU3qgp8v;mliaVW zk=>We#=7R9w@{i@(yo>?&o@~DFLRRpwaF4fl?$7rW0a=(NL`j1oe{1+IfGF25Qy$V z$)!p9PG`O!d!g#rm{N=HP z=Z?p#>7pwZ(HoMED)KL1?j*ZDPY_cONKOBrV|tSCTY?X7ecXpsXtel; zo~lJ1twmWwtp( zk21g+ggOVV?n24V66M7)x?Cz#sb6Z~a!F>a$v#8Loyg=y;W5CrW%aeTNOxOo*l&w6 zYkPgmqonN?lLWf|$aBqolrP#MAFZ{q)Y6(pwb5$rL|+$IBLflIW_&1@bOp>O6m%V- zJ3l;J7Wa`XKhI^I8d{w)S{B3;yX>2nAjeS&av#a&3__XbhoNLoKg4UD4h_`WzICnEG-tS0XVfsp*QHSYIoD$Ny1>V!5Gvo)ZbIp! zl^WiA1FY$CsZM2@xR3I|<&w;~)yRET$OQ}e(2x%e`OuIL4f)XiQ$9!+E$-?rR6b~z z+<(mn$#m7!rRq6W^Zp8x8*(i`%sbO-O9|!h@*3qns!>|^LeJEruGT82jn-;ZYpvCQ zR$8m5<{F>3^6SjjKu%?Bd}&=wxt+{HDS-P(<}RM9+R<9=3A(MJpb?`xT0h|_;XY#R z;bqh)Mr)K)U#mHao3zfN`sG-%eC}&*un1KSzV1TF-_PaKwFTsB|4BZ{ezO|+A9MMQ z>S&G5)Y9tyfE0(&LuuxzqcY__Y9~DRq=QaV&|Ro}e9raIcnLk)|49$&psj4W3#I3X z(8Do$Jy1<^G}RgRQQh$LlT11)Tz8@5{>bEd6P*scATyIbBd;Hok!f>|?Avc}rrn$A z^4jc~BVD$>nS@32dpy;Msse!&4KMP{@#ket@>%?4S!KSVmaaLL?p^&o zEWNMOz5idlBor?WHNQ7B$5-ONr4X+S#p^-orJ|)-rPJ8!LJRZ#*?saf{=QI4p0A*w zxR)g>Cx>1GTIwtEO)M_U&nn9=F0%NhmidbO@csXpJmqbs*`br^FE1%6E-mxrWR?`? z7nNn^7MB)gmHABx4w*Z<+ff~)Fl%aNZfVxULLbBy_=+Z$Fe}LD~zm{AIqW7B<2?s_$Fo*Sg85+ zrlv>eGG8_`BSD0%YkFb}C*^BWmtu9K&=eP@s;i)~^K+_%gs8|Wh^qBgHQJ~qf0Y<> z(U?=pYbcY~5aSdT7xji=X6FUBEqWQSM)A{qrNw$xDFtCMAchEJ%A#AR&M`Govw2&} zi+oc{Py@akO|g53ot#yWpQGWW#1>eI8mTvbutxeyC;Lh%o~6@BgebS(WbeJvt(we7 z$uCP7?A*fb90pp&&J}bO^Od=pkd*@}OA70&EQKiNtcgC2HGK6ylfU*lOG#EK%AMx~#hafy4V~`o1CNvUdFPJS6ozFilj}LCai*tpZCiQinD*fvm)D>20x~K8ISy#!c-y_10b@q4GbPv;Ie~OO~KsmhAFUlt3AJ z`$Fn)3(Bj+mtsm$T*&LBN)%ZE>a_%wLsr2WM0S2j9*m?M9Xsn)sMWA;oE0Ur=_*q6 z=9r&D#?uE`CH2s%MVI&|W#;D~ulZ%uGBNQe6DAL8d2TL}$HtFBlp3nG z)FSK@J!uJYpPN})G*Qd;m6qk_=4az##X?Ccn^uD4ML_wP}V%EoUt7mp3Z_2RK9L#47Ten~WQ%*gZWn}(DTfsz=*`TMT zj>Jq97|!AGma@F8GRqY7Qj}a+r4K_%RZ>w_84M5NVe@5qh1CC;#k#Wmc}ir}0nS{R zG&cGtflZmxkK11c={^D%P*u0WB9667^p z3RwDZNkUyHHEB#^xjAZjgUl}~!5~Lhnp6QWY(KgMR#X~GwGY=cezXC9o>BF%6o|uA zM@|t!={E|{Y!CY6NG-rn2sZGUELSk~cBJ9D7Rj}QqK?$BC&{3AW-PL9^&T*;-&71! z{ibS;Gz&E>H0wTB`(>U&NjCB%GR!9&ImJajbCt?aBefwXAr?l2Om>ZC5f{0N8R_#g z>emXf=8#!ZKA|8#oA+2Z>OIztM%@rDJF6gDT!wO7s>O(B=4ckAD_{|3CORIA-tn+b zrl6R*{8G!vkseIjWZ%Q)t_m6;>UU}WSv^xv05uru?8Nwk9-d!l7)h5Gn8uisS?Hfg z6&AkyWZ{}jNm?&!#DX0RAQPjD4-ANU-${L}$uKllVnUvt6SNO%M5crVi#80Y$T!8J z&$IZYCbOjAV8fKek^x^1V1t<^g3ObAJq(Q+{cSHx4wi|sN|mJrTr?VH8LUsPa}DKo zDlRnnsuy*ioonZ|xT@`rwm+XOXxBga$n7sTJ2Ru%>1%%SomzSP>>VA~b(uE*vqx?_ zJNpAiyydn!-^P8u^7jU7w$}f*_;8c!PK`N{GGWt;1tsYmQ!J>zkFU_FdKIsuLqe z?0#m{6Mqa_5lG#$t?}#o8-G}9XF{#-uROaeId55~l}~;>X$^38QO z&xo3I;LIoOXD-^g@Y=(TTKv#GbJN-;&SS^gt-4ri=#Ks+`#(6Dd3f=p2JM@^aO}E` z3;sOuN>Ba2ZTjLd9ljg0U;iI{$B`DJ_N_YST~J@>dVAh` z=&=S7c|Hy3C z>f&49k63<3()9M8wKv91*|D(q#pmn2((Lq*x@R`lvb}bAagU_r@}sM+OJ09}{S`NF zZ1lzadf%)`sJYL&|IjrlYZF@^u-16Yi zUskjq-EiHYq) z%u@gG=1&$+?)BV#<61pb{Q3O;r>}VOr3<${HhDww#xEN#-QQ~di$_`oG9I|6TfHk5 z-?20=bK_4@Z}}F#)a>cOea5fe`1aZRpJ-6nyS!zm^zHB7*=tdLY|CMu+i&jBD80{+ zqJ#5p$n5dm$1R53_|>Yu6YgvH>-$mXD}P$Q=-Jm6T$eeBesKd$Zm@cUa9&-4vx7ZbDl{)~O~et6kmGi>N#X>{xNcOF?1Sho3sJ*IHR zRqg8h-0-JyTdrz2|EvB#)w}QBx91<2J7~+Iw(E|Lo3!k`GuOAsj4oYqxYKKUF6O(R zkN-0I!^2NrTu{2;*oB|`Pj`F#%O+y2?kU)T?3f93LaJwGPf z({JqAFQ2J-=)CvH>wSLz?d#dkcXXupUC^jQyW@)v%q|*G|B*{urmwEIE}_FeudKc; zztz%h&HlE(*Yx_Wqr1)g>8YWAkGLYM!zPcv>nq2nEq`$MQ)i#6|M}E=JFjv2ejIVb z&?{~oeCgJet0umke`?RdJ3d@+pMCVUzCBB8*X?rO;8rJYesJFL-zGlm_+sRm*Ikp2 z9v_~%?45~^+mC&(qI+v9P1B?kZo~U*A1kwDHjCg|Ck(xbE9J zah;=%XY{z^bj-c=7T#TW_Kx9whL`Rh)AQF`AMe_x_}-%9%nXTsSr8np-P(&QCuwZo&`C@4a;0p^`534m;AXd?aD|`JCi? zU+%W-uDsZz4^8h_S>Xv>e6`JcyS|>Yr}2(witjpq#mK~zFFXFVW&L$G6_idpGs&6P zu6~!^^;S0B`OMAHYq$3LNBe8B+x_tC(|_*s^AmAnYC3-$+M?~-r++9s?Rw{dmsW4} z+5;zR|J|m=S8r}hYSiS&C#Nch&8T~RqVwLzH%$5G?`?Cwzv|0h+YDcp`RV&FjT$tk zVpi0)yFP9FhyJdpzhvLz&AK(*>iX>JT}yi0@NwIl9_?D%`p_M(0-YKJm_)BOPyht<|SpUV3fmnf0lc zj&C@zcJ1MqFPG1#SpMSv?Q0(Cx_9RFw|(|^>Z?EQ9=GJofaM#me)Y4M8#;G7?HXI$ zd{m1xfAkkO4!iW~A9wwA^usz!cTd@J>y!3lF?apkw^!F1xxY`?^h?a#euL*dlmGRF zro(qmm~($w+3|a?o)KlO(R9Z!%k}?D{$^Ogzq5DS?*81hx8qB%OzklAjae)6>->CS zbAQ{(kzLk*a_07}+kedK@bPaAr*{4B#NWwp`yPD!)WBrtUp;^QJ@L`E+W-CNKiSUD zSKL*mRjg_D&;C zIezc`!MSDa>-sC=zj5?hIeJZM`4f--(XPk&b2sE~exai1u2x^X=t?`%;g8#{p7q$w zFLExf7&o}*!}+m0pSH9(c*jdUu6c2Cw?onX^0{~Kt@X*$zKvh3tnuW$>@%DG`t`;9 z$=CV|_xJ05U`Mtkdgbb$V%qI*bA#X7dzo|9f}x*0)+Or2AI8p1^}N{ak6*4_v+}jx z4|dwRJmcj9Ew@>BZg9=Z_-M|6i>p>Ojj8weH~wuS+q4{0w{DjmYro&z?CQ?vx4#@4 z^Ug=xZTgm?6I%3%-LkaJ zs2BDfdCUFYTXlN}&VCR$(rsCED^KjttKL|DVzD(orT!~{xr1|_?U8+cT9@vhy!2Ru zmv>a`8}LD`)PHZR<^JqhZPdEXx2AU+=ij^gqi0Uc`|jBRnDIdW+}yeC4(6vny6$koZhObIOFnw;uOD)*7#q+Q{W^SE&ns)4{Gi>oqJJ)Y zxg_hywhc3ao;!je_~ z@~r*Kr@Z{s;TLAUm%ZlI3G;jAeeuROcdz&COM4_Oe#PJS+&Xtc)HMx?Prs9Xb@a&Z zn|FKYI>*y<4*t^qij_Z|?w()&mm!~dN_ySBKKa_MIm_N0QM1N#Ij!y)b&Gz7(@N`i zee!c2UK|s3=@Q-5w&wb>%KF5`Esu(tB|;__7xXF2K^%5EGfbZxENhlc_K_6a4%MQg zt|71D`sDZ~luzt3k^H(!OLySC&QM(b0C z1+6ZHY=acVL`Nmyo3-dbZ^1(eENS)qY!cy_RW1YG~8?}^bH&!!gS0K1w((B!Lv{uGcgD=EhuDFP{{K^ zA$x;Dz6uKYEhwZhWtllWJzaxBXeXtL$q5R%GbrS~ppcD0A#&G=uKm*>3_S;>YRBfl zDk1bF5qG+rp&}$kv#@?a)3Smvvw}kCkWEz%J)o#Ylk3z0C zQpn+S5GT2sMhHC$&7F>UC@ADb5mL*@>4!m>Q$Zmy)HO1vOQv&9)DUY>$he@8JA*== z2nu;8DCFCqkbi?h+M)+k(=#k6WNc7~KPY5bP{_uh5IW#f)%8nINOKwlnA1y)-s+}? z&_l>-NPbYr@}Q9CgF@&CP*u(^K_Qn!NHe3}TZ-Lqu|`O55mL_x@raNHMo6{@sbhr9 z5+O~E5PHQIxkg6FRuR(B2stD|>KY;JfH1I{7$J>m0EBC7g!C36^^K4e5h8oqu}Vmx zuQ0o?gv;R=3Mnx*-YiS7Sk6n>k9@+*~b~J@xt0aGf zpF$XhAnfT~BZNtz{eVUY4b<8qa|rABA2NsZjl;i67LSsy!5<-cdsf19XS12Kr=ygg6CHfU5gc42f_A+$!qcqbjLxxbA+lUflywskVm&2T45OKKwPY+VP18;_Z`fAq`b4l8M$y$u(e>!CQyV3#E)@eD!zj8a zN6}HdOz>LnCkO16EIR3*9K$HO+8|Ws>-w{Gk4qLEmrIUe6kT*qSv2;~;u{~U;~Shf zOf^rA-aSN)VH92M5Gr-;eR0k{$vP}p45R3}g0Vv9i;mqT$1sYnD-kMnJ^t^?6H?bO z!D1LiS9^m+QV+iT*&{WLd=&{6!zj8s7%VD{k?y2^lC@f}7)H@$VJy827hbjNtYqyH zEQV2Zb!05v4x>)am@ZkT1dCx5U7ZwNJ*PC?B3Z5I5&@236kVMWD$8)+vajBgtVF?L z7)4hX#?tep>Y@W{$T5tft1CjKuF}`b@$j*3QL6=uVH9267%Q}{HwBAf6kS&-x>9n# z7$bGjJF3VrjH0VMLS_5fv93u#vf5CEz%h)Xs|P}5zAk>XafoC&1dCx5T~{*}<%`_K zpT=j`GD@RZuoycv>PuJbcCoM~q0dPA@nM$y$<(KY-+ z!H1GXhn13J7)4hfgz~`KWRD_9Jp=%Nu@=IfKny+x9BhhQ;`qKk$tsjH%~ z>n6#1Sg;sI(KX;Q`Pwd645R3xkyh$zwg35DQrDM)#W0F48pGvSIl@1=DW0@O7`gL; z#W0F4nq^2`n{rS6C0T80@P}gmYAa=Cvzk=Vc}!>+XS0>?0lE?OCry6$;! zL?g*^2o}RAx~z<)m*K|M{dY;$1i@k$MVC#{mHgR@<0XsUQAdtp6kUl3mGcel-J|m* zYpq~0jH1iVSk$dhEq`ilbyl)=3l_sDx*V6$^_^fbjH1h_=sNjYtu9hm4N)Nsqv%Sy zjIK_C#W0GlWJOosI^9kAN)#-HQFOT&OSi*MPRv{@Q#e7e7)H_MR&==!?^r2Wa|DZF z6kRDwzA`p!o+nvr1&d)6U8#z$kM5djm8>@fi(wR99>$_*s^zB=j`ftR9|VhG6kT3L z*Z3KAUy-buO%MskFp91;ghog4*(O$sD_aeftZstEFp92p#?tL@Y~uTWNLI37F^r-s zgR%7bTK?b-H%V5WU@?rMYlNaJ@qhQeEm?~Ni(wR9*BdN&wDO7bZm47Q8yf_RVH8~> z4HlLBq3hx^Bwdvv7)963j77FVZuOj*DUFOW+$vZMqv#q7tSrMdXItJcSziej!zj9L zVJy-Wh0k}Zm*Rz~`Wzst8G_&#M$vUELZz-RUN{gZSyu@b!zjAOF_vCmfwlwgkt~m3 zF^r-sQ_*$LzYXk?w~E`OIECCKn$bk%29L;bgo`3Spx-&VH90HMOQ-1 zUmr@=t%AicimqJ7vd}j^jh5~FO0wn&7Q-mICNh@ZAO7>`s40^5oM17GqAQQFD4KNH zRxkLUWPK!945R4ES9IO|!MCQ;I44*Pqv*QL&_y<1-siVF>l!w1X@MX(hEa4)La4O) zOR-CPNmi0zF^rrTO97)4hZW9fbGn!?9iO$^&uCs+)l z=qguq9XQ=KUb6NI7Q-mICNq`=-(-hT^Lu~V*wA%auoyg_b)8@_jG}86V_E1MpGS{+T#}U| zShHBHc^!K;g&6DDc-LftWZf-T45R3p!&rLzy5+aYyCrM0U@?r6uepk@u^Suik*rSz zi(!;K9`hKB`VDgPzUgzFhI={OT@)mt^G%7GYG@LWT83_Xd|F>mk7+jLKTXSk#WC(^I%#un42F79#|EAq1u3={C5$ z&{;kKCm{T44I4v--5NN~xj8vBN9m=J^4A;VCF_u25k_ULVl3(p$zA0- zypo3!MrEx=2){NbME@=sg_6}c|Uqp}`CNOV+FqQG^S zz71WYUK%R|i!dq+qQUA!6u7~k4@Se)Srvjs7?t%1LZYKO5C!hhd+&W&vQ7#XVN}+m z2#Jmo4N2?2!t#w|wQo<7APXOr^%z2;qr~v0?c4PJR>|@R7GYG@Fw*;F4vo^w^XnQqp~(ImR|Cmn{>j!sHbp)U=c=TJ;zwO z&G)(aG-eAr>kGjmjLO=mu<}|ifdHKq+Yym)gi%?~BSiK#=kDvBEm=0fB8 z_$Ie^_59Z)t9d6LN*I;(5<;S*MDx?8Y+1Kovf>4cFe+;cWA(*1xt@=IXzE387c9c4 zEEo`U#S#Us{^{3FNL|ke7GYG@D+r0!m#egWwGWtB?+F%RR2I5Fu=?Yh+`Lo-X>(V^_q-6CHT^C_g);5I5du_R!($Icua1okQun42FDjBPtz$M*1 z`zFbnAy|Y_S+6pdUSG|I?HeUo8wHCnDr-Aq={?((S)cq*vW^KBVN@0j$ds?xn19fP z==o|VCboo8S+6seUh;kZ_nB!-Nfs=^s4SQ`boInHxqv1AjMOz#un42Fb|6Gr@5hJw zO_Zz(!6J;x+R0dYXLYd2%L@lEdGk_qq5#*EPYIw zyd<+kvYrtv!lk)Fa1J$NW#RMsa5k=J@RK9p+e zH%18-VN}+qjMW0)F)Em(w6S)U<9&X$}1=)+K;r|=cQB8LZ zo9gQa!6J;x`hu}qY7gh<<2c)WQ`K6qli&is2=324!+54K3RkU(@Wz4!6J;x`VJwI zPGL}B8{QgtN zF3D=y3z2YyQCUABMB4llZ#t(-)^&nK7?t%iW9ha0-VIacN!BF6B8JIVS|un42FUJEWsj-%K8N%a;*G#PbX7bUL;tAQCX)MOK&NO zi4D@EuGa*MFe>X;#_ED^a!a;cK%>!1{+M79MrHkmkm#r(M1dJQ4a_fVN}+ijCCcx$;JL}=ettZe!(J) z$~uFP=qR0)lXMM=Q!kB}Ye*752U%sIBQvFN`poCnNmhbj5k_TU0tA-cM?KhW(kjWi zORxx|vd%J=1>fYlEjxcevNj7AVN}-N2#Jo0BMRKsa_ch5Iwn|zQCa5@!gr<->+i2( z?~^Qx5Jni4^$%m|`TFM00lAWuB3Oh`S?3w64Zg{3*p>=I&`bVK!6J;x`WGS5QT2!d z_wQX7fYe!=1&c5$>jFaf?pb2p-}}Nu$$DR~2&1wtGFDTfz|}gr8r`$5>vzE-jLN!% z5NS~pSO0ICWVPx`l5h_LAC*P7L?vs$s!R+@x~}U5i!drHim^H|nOIxi^yL=Gx<{}G zqq1r+mPN3xKm8mEOxLwnun42Fq8SSvE^{NC-C`t5>&HV0qq1TcOBkHCa`Xz*+$LVI z2&1xUGFBs@Yxn*Qu~JuoU=c=T(R&4D84hwU$d{~Df<+jWRhzN&e7(0|`5ejmP_PK2 zvg$CFZu5uii9;l-UVol&!lxf_xMrAcrSlgff78g}|3jY->!lMHrPu&jic4%^iQH|0!8nf<+jW)kI<4 z)u(c>WGxje!l*2IL9bj}o*DNXIyt>GwhIzWI?>eh6lMz+VN_O2#?tN3)}_T`lC?^(2&1xEG1e7& zzMg#WfMk6nScFkotr@GMU|B1Fwn|ogT)~kejLK@mSe<#a=52b#CdqOO7GYFYTgGZ2 zShZ4icqD6%U=c=TwPUQtf_3C{GgHs@gkTXyWnIBodTI15+crb$dRwpvqq444Sbq&~ zbh~6-5G=x|toDr6L8S1p+eTr`(rbC(ARbH@mBrqtWvngV6!&?tWEBb)VN{ld>1r-? zEn2oHN3tFgEW)U)j*NxQg1Nl^B_>GLTY^OxmDP!{j50iR&6|>SL9hs;vN|)CUSD-L z?t4bE2BBS(BaF)G!dOjsw05acMJLI+Rj>%d%XOg$Avh1YR|)Bpoj1uZPE?>X39y<` zSBN%#o&rNZyN-^9&cun$I4&{=M?Yql6_*-ubhJ5+^vlFy#W>0mr#a}P!W?!!D?i_o zP8T)D&>@)YBx)Uve?C4qpIW<0R zNM=qENs!0IRz06q*H!g=M{~IOR7P_+WoSZv89k$2HP{@+PIfe(iK~NI1PS5ClNv%I zKO<6?q#t%l2dQU@gVZy#{F!)y9EbiIf(b^i49LtXz=?>N`pNIQ6n2;m==2H*I@mE( zI9{y~G8_j|h72z($qyBt%g$vrVyapKPE7REVUz}d)g=`bRk{&MH2!`I{*ncLfM+H< z{*zu9Agi5_^3+O!!|NhS6j>56r8KLgT#aNe8(~EnhC_$9GmsKb2PK;hb=S+35@bH< z*&NPnMI7924(FMai9{W-*CLoP{J>fB37O_tQB3kUOeLv;3k4H>qG4wG@y-JUBt%>u z#3kkC7v=l&e6m4Pra3=kRB;K8pP>%UI0E0C_G-^2%`Ps=MI}=e;e9LFiv5sgbXUBK zDUo(X;ppG83PcnzN^a4!8ga@QyhLQl%w$JWD4*uA0$g0y3Do8>Jq`MkA)mMqg*DyIK4ZQPVY9!(vLAFYvAWs zn`1*9?<~2dwy301DI0T5n9^hBibHOtU>q5X-kiOaK)fVH%gjt3>B95?-MgJ$BY^;R z-aDOLF07Tk!9wd&UNj}YD5s0rm@eOwc43D}{1*Zay3Q}^68B#yT*rT+a4miRyO#e% z;ad9rcP;;k!nO4O?^^y7B}CQBF~vMIhN$u|z))2k1{$i0!$3n7dKf5|sup$_D3>}w zDdaFvE;S-3mpU+VsS!cB)IpI;jR<;K1CX;hkd(*i|17k zKA!XYRl^S-&-wkU;fIgs`~lVQ!^fKnkB@5M3NKV_5IN+KXsUtB44hqfPU2WjE{D?_ zupEd&Yc-c__40TLUk(?PS!I9^%A^__oH;cZ9U%c`gANH0Wnt>LLZ-mn^Hu?vvLNa+ z#4OpAk;{OBMTMAB2a5^?GM9{EX37*>$O>W4DvV1DVNoiKmv*%3PQrTv}$3dD&XCTxKIdX9da%g5)>>-u1D!FHZoPF zP!|GY62x12h$~`~pzs)8ROXQ=Uacig! zCCba(dxjUL%n3rk5)v})*33A&+lu%8r6qd3sn%*To5y zZE3E=V2=8>X{pCyO|g00wnTfxlsJ1@Mp~lHWw%NxPHUPc$(HU(NwXRkoC)!4$vB~Z zLVQ9Odr}Vjag*1NuN3?plF-GGZp0eWAUV8`2D>JHkrq!(~l$*;5nKyx#B{jn~m-8XD~mtJ9X~PDxBk3(teqB*e3~Kl%-#!(nx$ z+uW{1S5kPQd=;hS*{mLWip%CrxlBUEGzc%Kmb_%E$Ln>axKb{okEM~lsM_G!)2(SP zXJUF<(q*bbtnnqpm*q=h60F$mcDbCXR`C*OSQ1|hBp|)iIw8I|HzA(Arb_bMR+l~5 zmgvcFg)bQW5){QMiK*7)lvHN|b@OCtEYT zj^rd)vfYH2HfMVAxxqnmce|6k&eYU26Gyxo+d$dvs0vTAGd10elE!7c_&igVW@3ib zZck3~+S1Iak%qx!(rnZ-2EoOf*9*?#y491Gn(j(T^#&2eYu6Lv z`P=-cmyimRt!a)Vr_+`mRFgq{iMcVMXj9S??di58hZV1hB$@PrOMMuL7dMs-J+NJ; z8^fU|-C<=74YgKW3bP?5f77=y04k)^l=LK5DkToxN-^$BOJY9k3wO5g7IMizpWsck zCwkK}sulyijND`a1_ix`-Q!5IWu&E9t6(Taq*q$Exnn~Ev%5V>NiIwy*b6O@72JGh zyv5W)3t-J=fKd(yUIeE#02zaa#44Y$HYHelXqYuqU})c1M~O z6NNNBSzuFLqdNGVBWhyo9+{DOG$>D+$CGTcCtCHFmnX!#g5H)6jXs%=46E0kf~ioV z1KHr!4h3{;(h!U&Z-&F|NKEpm_E8mxaXQ`Ob!H@|r{E<$^lo+8A<)~^sRmHztO}?* zF*FQxr=%u3oG=YeGa?e*R;R;dOYwM8tn3viuo(8zbvdzuy|S0D)BH;EJQ%@kPP@yN zYBk>!Q*Yl(c)B&!gYhXfDTRvN%ZffevSLS1gK3n_o?){GSD9X@#c3bUV~@%STh`n87`+&bOxq5s%X#& z@%;7gWJ(4vG2NQt_F|5fl47z^KB0^cXL=|DZ<-_7n*!4dD!(vgfH@WoI;mcdVR**0 zwW?t`Q>DjzFK`y^C|6Q(6_k>kZgXJFSNd)khSBxsqorW_m@q)mO5-X< zahKN?BE2TAp{uXg?zMSb>B-hCBdlMlEyeC}rBX+21Y%A{-6I-DGK_+*fMi;*`2q#! zLuz1q{&MX6GH7;OU8H%FJvPj$f-;kxSB&{Fh6~e1E=RgMMQ5p#8v}{f>%kPkH6 zGB=Wi3bQ*>kr%HnU(RE*uq&%nygiw?1`D<8v86eaoM~>IrA|_%COJ-EN|l_R5t3rn9mNN?=97C5+aPnwFH5=uCF%&~j{9;d6mt zIBYc~-Q`YnW4=*dG^wa~idiZ(+VY|ty?6ijxfsjNX~X>%7VuAZ%T^OZc9p6hpJ#zC8b8jFvNS)?4GnFl)XMwSJ~DnvFX;t zB)1213>&V}yfi(djyt}r7&ALRy*XPi?CGquF_N=&7}=u_awd8lUJtGxiI46#!&Fv- zlH6&juJkloQ(}?H=19!+T^?_;*ND7Hrpsx~NKSUSGH?ZfWRw@6t1a?jgu zs}nRV=TZ%0fe(8C*}Tu6HBr`=!(&ZP@?<1o<>^21aP60#mhQ1(E^FnlF4wD|5EdcE zD$#Rbb|QzkcuXQ~DJe<^=v9urtM<$ldMMWiKmCzn($w9-kJM1nO*7kJK ztn}sfUIU9x85ZfxNKbXCg{Wi%qm5gyaD(bdLDJmGPOsZ*TtT9{L5YQgcER)9gvb4j!tKN}MAi%MvwOgrppQptNpnVunbuiKrTf+bdZ5P(^N zlt+_jPfALPBf|>q*tCsN9b+u*p_L%J6_Xh+ElQE66pT2fl79Zg-nb*G7{ORS z$~9<}1f6SQDrQ|s_C&hurKW*03&obYGOS5y9+xcP#1~^uI%4$YxQqt@g*waIl|7Fug7elVZB)i8=^Lgko z7r$=#;zBW}xX9F-rd!c>q`2)VRfZ=MIAr-{c)aOpX|TDlhGLRnlp%8HNyha|ipP{p zcH0q!&-N~haV5CfV70-Cl1%bCjBdZmlO%?gLCy?Z^k79xpAOt;>MjR)G8|qvidm0L zzR@6}X0dqYa^NaaQDS;5#lQ|qO2kqwT_T7HNvcT+rU+P0!?J_TV+dkhTw&HEUuH@9 zgo6BRLlVGtTmYnHV8~WRv`}g>pGZeNdtJ#MEB5K5x5&X&GIkw{VZNZ4rkKT;-HaUR z!K_nGuNRD2ri(iz2_sXomDO^UR3+N1NzNo!QYyN9z4XvuQ}1txz%@L^Hr#4qJ+4?63!7w_ zWAM=Nd7Mf~iJlrajZG^7{N|Qam|;y#PPJn+P2`FD{_L#M95%YLi&uk) z{Cm8qwq&PLa1j*%?pb1W9V=Z9(`{vR=4zLU*5XWc*=(3tiQ5?{Q#>dGix5+=%uIJ7 zCi{t5exLH(0DofOnt}0yEGE}?(BL6M2FAq=8e$5Bw{KkBz<~qtJ7~zD0evZMe7&3n z2Wl*PeDiHlYooN4;_*lG>(%K=NIEc}pu~74l6&ek*37S1r@+_ndAJJBsx?kDzh<3q z_u*;G8*bOMlYaWgUyp6oGOSf`4G~vZ#vsO*wXrn_*8s88Bf!xEu?r%=;d}$_p$KqI zfO|FqTnpe{jQ~f*e;@)}J>Wiz0CyE|-$j6&1IC_l!tq5==?@$CdlJ`vnIFffdLfqdG;7D(cDflwEPU5XFBE1->pG*QSO<<$&-_kf^e4i?~>kxip z6?vg>)Wjc%0QWa=^{3)s1RR<~j@nBoc`qWo0+_t%gyJuh35D|@u2f(c5MQBi@hF%# zfctYMN72DPp>Rl=)?qe|ti*?0xN^bSNZJzu!+`h-C6D@zry{^neY_k2j`Y430nP&4 z&IoX1FGnN5(fIab1UQ;+{2c-AKH#F};HWNq$koCpRQb(E_=muZnMc>|_fFrwqA_5%Eo1O;lC4r5?|4{XIFCtz8CVc?_aN+Ek z`h$SLFd)7{$s_xFC<0sza8E>lBY96nfTQ{D#t3j!9~BYc=z42sgt+|?;95f77ZKpd z?thB_NBwT}LVTHAsQRG%){g*3_0c>69JROB5#VYA*DV4Z>Fpf>j`Gnr0^AR1AVYy` zzXSxh?)Zc%mr8_hTB>Oimk}zw-IE=x17@?pg=fqNC0p9Kz=^&$0sj0~R#<^vi? z;BW$4NZjdYO?&r#9FX}SgK1ZX!A(T?%@5-m2_JId()T?Qv=5j~I2w&yEqp?i%Si}0 z0nFhwguT^~bgdxlJ_D6d<)FV^(0NxXdDZLqwDkG&*It|P`N**1L*YgEkBmWJBOF@A- zH*4CmmpF#{rBJx>2(JL9)fSEmS1u`t?kF%E8Cu?L5HKkMTmgg}ei_$DuUuX)jWekN zb2+_qIgth2(Q4$41?~he&aGTpxcrVsbUH9ERD-(~xJqFDR}Jn8QddD=(uJxID(5SJ z%N1CfABDozL;bD>W-WF6aINqOh4UeUi(b{VU$!$?*!D34(W_p=nE5)#h0|+?yd+>2 zzrk@deumPUiuASEp=slHaUA786z&;>Pu-1v`Av?i7Y27D!si0>rNGhrD3m-J-`sEE zIt3qcm#g3L!0Z$_>eoZbyAt7z-^Q4Z4>@EjB+iBi8!&VBFqjsuTz&(t(Yu;<@jZ^a zDvZ3fz|DIfbB+TXX9a(2xLWuLrMEHiaW63IzTr4pR|DV1wUsT)6&}`k}9Zaev2gF=6D9ncNOc{P!Fe&Q5)(w+Df__#?-KOW!y|KlT$2 z*2afiO?*P-BNgF&e#SK%KID+CkhrT6F&CKUk1?1=^UF~3Y9qY%anvzB|I z)CIszKf^I(x1n&0$c0NEjr-?- znfxzuj){D|!rBl-3s9y?&dkwgEVTAMO)NwfKZ$jZl zB78i~7~g^qxo~z*!|sQ`JWVHy!-XrC3PisO%`vEu$uqApSAbSWHTZA{jT@>zqziNx%XQ4de-?_ z=e5E4g12hp(_K2VKkyRo&`$ZJ^OwBWT=4Qi+znp#$x3Ds+@+KEFC^^dQ$5-}qZIGd zZg~4(e%u)z?Z`6~ue*N4LMWm_a2_~U@uqhpuNVbn=XoCO=n0C~o&LKO)^ou5=LL$_ zUAbz4^+9m9`4z9bdbAGKpMtYyqT+QI54H=x1?P_@kL+~mN8X>n`Ew7v8Q|>(=QIv5 z@aZld&%^Ela59S&k9s|wzyE=Nx!_zjS@BqI)A6ccK2!H-Z{W*Mcm9&M7n~&_2d|R* zbj7LsuwA{u@Lumh9`oZ%m-0Lp zqn_i-Pj}&CyE4k;2oXQs#kT;w3th;Y>r&n#@UH1W9@BZ9OL_N!_xm2?F+ZLM=WQo1 zP5yohPUe)uryu2=2+mk1FO9sJ;FLOfj`G6%y#bu0lb1%`CUEMUJcm5y@0%tEP(Iz| z@B84j^&pS&?H%@L$KuP6U9QrEZ#+0bC(jW+%3A==Dkm?Eyt}~pwUg(N$M`;Lau_~- zx{GfMc(3;$PwJaXc^(X=25>-ykDV@#@Ufpb3Yz5Aqn_hrwxZ^3ufjEpR?^^3v2_4<`2pa)J*ZJ6+PqI}4mbC(j{|>35mQ5rO#W zF8$_%x4Z{=Oh3b=ynDcVs0VorUz1CDJHdOi2YJ*lUxCwaM$hRt5}dJ4o+JIJ4`zb1 zz{yLKA64KaoxC*iHkllVmQQ#2u?@VI9^|q7{R5l>PF|Yu9W&FT{Rm%v>~iG@ALRwW zxx~p!Bd-FSo1DBf@_q@<6HZ%<%gY1cJn7`6iSMi6yzk^W;>+~=4xD~J?m2%)f-~01bI7B9nQ3wW z<OmgM^DkY>dj!0vdXUHTd)=kHkHGu92YJ*l17@RNj4wZS zI;Y8xN#IO#@*Md~dCS46aq`m0dkCDzojiv;#`k4#-golS$omeQ-j_Mz;gHAjaE$u-b+=D#U-)3;$a`Muo-#6fRescKqqr4Nq zDRA=A$eRw%Tqn|M_<6nIFvCF+f9?SD6 zlOsg@bXQ&`fj6xOc}&0MF6C8$m+V0v^~)xg^6J2A?m-^g%MZcHnxoQ%zum>x2hOo3 zue2hhuNb_`dXUHXu5u|a4&J&RBc%-`uQ<;?|eNe}W^-`0ZjfRmS|JU;`@ zPAAV1U*^ZZ!1>O}OCxXSJd{6t`RT6wF?^H2x!lQ1BX2c0HBMfd@I3@hos*YF-kacj z=;S%%v3_)bZMM&9G#JnQ78k@r40ZBCv; z9`m>NmG1P*vEZF*a=Xi4?%xQyls6x|yYy{SpLkdJpngo>#b(cN2I<5Av9PkGPcg1bEN5koT@j zc^`rIc@OfKeghVIv=i~=$4=)o_2WWtrZ{cyqkKEmkW8n1m_tiFHL;k z1?OK*o+EsemsNøcc%+dx37lz8oGvHt{gyc5kw)G~aK<`$4tb34OmLPud1>S&z`4uGbI2P3c~64#u9KHW z-T`p3e(H!v8hJkgXNr@TM&1%|qE4Pe9@Fm*a2|5<(#UH9=Vd3)A&=?TZgK$S(_Q_| zT#9}tzWj7o{usV9OpXxo)1ABt;DvgS$NGDfOL;56yS@i`Y>$5KQr=VGHMx-YflGPc zf!BN4;nR=dJK5v_%BQ>Z3xHSbLf%qv)|x!}-krP+;QX=&c`Ps6ze#I$>}M4eXfSS$Cn>FT^#Xc_zJ+8WbzIdzG84L>p>p#ca_PZzx;HUe(S)y zuLpSyUxQ0|JHdOi2YGBSzj7(B1H67K4xfIkZzI78I(ccz-vV$}IC+lzpu8kFk2ra0 z&qVoxC*iZUV<}^3uqA1e^vZFO9sn z!1>6@OC!&7jfyLRDxdDk-$3w=Gr8T>50;lgm+~fqH?s$M%#Uka%1eNEmkW7Mx|H`K zcyIL}PxOmRd3{zwzu?Qy;nJ_bS>@z8>IdU{7dVfZJo?^Ue$;`} z+=IMaxc?9wPs9@4*=m?K!@qz&Y2+bI4_(An<xZtr|UF?GQBk-!`}SvNTI ze4{=+)dlZt@W#2|u^ugP$-CACkM|YCUGQ?j`-KZ0Hqn>=j1&`(aa~C}7p`2LH z>CAh2M!VoqU-@0|s1Hh9@@Bi>QLoK&!J{5u>w-51ysa*HypQ2C7rgVpJGH9kbY_2O zz6&1v*%dB$?3ZkC!8--K|8l{jzq?%Us3$*j!DBf+;pU#xh2_uhg2#F})di3BZMh2` z`^D8Rcq71D?}FzAul^9;q5V3xM^7KZJG8$+efqKs9{c0(x!_Tse(r)tfBVOK&NuRo zb-`mfJLJ4gkN1`Q!3B@)R*MTB_3no*c&u+< zy5KQyU+!X{q|KZcpT5%?}EpARPTbvcw-srSGwR)-pwv}%(r`7@N&W1=#tm!g2!>~UKc!; zzyG-4u{;mCrRV&mzY|>W*gu%=g2(o9feYSf@UC&eWB>jk7d)m*g9{$x@uo}Ozg+NG zt`4~1(cdH1_M9K=7w5X*vAvw=f_EZ#r7n1s7jwbm`0|%7dH>~t$MRC=g2#IKybB(~ z_ZJsD-Vgba3m*Ob)CKQM@P2T?V|h8fw&!xdavyNP%LVUJ7rX#?s}A8EI`7SLT7L-d z(EcBJFSy{bfB&8f9?M@wqUUtsIN$^qJeKK($I(1HX>g<_CQ%Yw|n=vCeb=I6^ORk*5#Vx*4`RYZ><}4^L zpL1n&$+CrWimzO>a8`KcnG2V!oHJw5vPF2a;vBxBG_tJX%oSJuR69>Qf1q|H#{1fl z+UclGxWU%^FJ7`><%)_GWs%$wGe+i4D~~K$zT`T*HZph8isj`?mMvPzaB9e%%wD~; z4tcP#?>Jn-Jw!VmuRs`vYbDWP@OV5Ko=lI|%*|1aP|f&SpGW6Vk z{V-msAI2^9!}uNUW0ea=p83KwVtTME!eKtEF8!dt3=6|I65rGCr5ZaO-!t$%3t!}g zMwK-h-vWG@pUex!ndv}v!SvJN*(&^dwAnz{30e$vgCMR8#{{vZj0?IK=oUd6flvqF zwjSs3r)Y_Z1pm=2}{@ zGE%NBUNnDY-Enm4JvSPuCWu;dy!pppuh?R(2 zw6HYgt=Xlh*^3a0<>i`s)pS?O)#ZzEO3sx?QAXV^|dZe~`AFswdU%3$P zBED`>=`twGh!zNkr(IfFGIL7ljNr^mic4mNrcF&T43_9YDD^=2Q0rh|M)ctz&C!zp zwMBX3VTR{y!1Ht?P+kO37^r8J4IBE9K*y_k{J9a$dSXsqww{RO4Y?G8azjQ_8bJqO z?5|yuS4e>&;|t1Eq9|E6-ZmxHG)4#O#-#GF(V`oF(Tx`^pNu(q`MMFw^TW^FQp?k2 zc{!av7j)>x_JHw)ZnPP11*#5YB8JiYAViMxZSfC^@9($j)Ub+tz_=}jXlS9#){YOi z<^r|%-^zBTJ!@+Wf4cGVUi{&IPF_h(W29eIKQ=?pcHpBYsreR@(faiE?KbzksR z%M~09fCK2odOB#&U}Plx%aFpIk?^q-^*{R*f_^(1Ca*RL=o-W@Q(FL(2fgLhZUkB; zwrhcw2>LnD$zt0I6craQ0j(6Y3n(J!4IAyY(R)D3#U2~|9Z0!l3Mt!9fGR}F7dHCZ zwv_@BENIk|(((k2T|uKYY`k61a)>l2+#WeD)X@~^*ghrc4H-poFS6`oNjfH5c5`UK zc0JkO@2eYZl-0Zz?U!nWvZ5oskI)VOVuCE)Xl)-9GBR}|#+DtAG(OH(rW{vlDQp%V-q-QnXX)YPO(P2)o> zoqnV`Oi5#LXT{%z{}wfE98)cw{yXima-_z3bD8}OFfNBL*10@C30^KU;HlW)Ctp{2s=uV(}1>Fnu zOF{Po{X)=#K=%v!EzkpkHUcFCJqlz9+6;8Npg#irTo8Lm_X&C$=vRUofz}Ip4(KjH ztw28$^b*jWf_4GjBj^pF4T5$9-67~bpt}X_0eVo--+_K3$n1!9=@aQj2D?T7MxRJG z-eFUAI$A`w+?t-bU+-wuC;R}sYK&fmf&wrKy{~LN-kc3?^bI}nlrD-oZU3cSTZi7w z-#Nz1MhLuG?exCrnQdSPBAlq&gFim9-_cwiLKbX5}a3H?lv+9VV+Q8B15+pV> z(pDsaJADWp?1z!wQpKXp56wq}6M=jH>1x_B4E#7Cea>+5iENOIjRSh}ks&}KV}Ho_ zGvcjcYWC(-rxF%oYV1Y~j}D_Y&I=iDS$#K}M$msy9NQEP+#K{hjb(W{J8&iJg$7Ck zSClq$6w6VgS7YByp%73XF)Ovva@#g)BWHZrf7Vr8bmL<^*}%Byc357KaEFZ@1+Uow zGb7Qmm5G&V8X4qtXh>ti&<_j)2e{`8IS&5UHBBt-j`)$EL9 zg*qDBdj+IN7-Fw1IDTk!2VGt}xH$2P5=fRJ0z8|(gc3iaSwUlQ;$|_Zojw4e$j0}G zW)vNkAbwDoSc(w1h4?EiNg6TkZ6I&9Q@7 z6}@Vw_oq^2xo>XzTXvw|uEanKO!qdIC8iH*)~lM>t8T+rrmnt~bYxZ!x#Y)ETrK}Y zMjHyM)Xujf`F2=NvBNUl4$GkW82n@*l%iL9#awg*_xY+%K@dYpe}^95f0l3U5IpI| zTMZ1iD*1^xW5v2Ws9r-A?;;_LL7QJyig02LOLnWC*v7~!$2Ffu=Ih3qym@+Za)&;l z<3i|%5~qBoB<1&hmh#)jQeHyd%Ap%?TDm3-DSE-aFvmW|jxK?CmWinw2E!RnK1tsT z_UR}SN9)ENonc8lNkS-b4yek@oslEWI6f%`i6@zr;*-%LK6UX&9wg^v1c?M($sCf* zc^sgZXt398vxBx-A;e|~@5ewMGdnlLK!BF3#UIMoJXoQedQ|(HXA?>CqgC7vH1gksCmtIS7UZyAeG)mC2q6)CF&^^1zBPU3<8H%B+`hY=0VhA zczFy(egEw{!y5B4C@cQA-ihhCu;@cpIarkdD196$=U#GY;1W@r$z^$sdetXPGu@CG z0lnZkJrT?g8*N32aNY=AjdP0E&3<%YDkfF;4%khz?EXUjsA5^zlv8#~bP6jnOUXePq|c2Yj4O7 z)^tP%1$QIEcP+s?f0B6M;g;aN|NTJTz?R_sYo?s=&z9hWp%G=%TY|s+=S{-`DR z+j<#*q`yd}8%s{UiAwglh1`00DS zEx|osMwVr_1pofRkQ3Lm1ow_!f5k;D!B5US=g);L!7o1g)vD85f?p3g;+D*o;Qsqg zjsK=4_@7UD|7KlFP!6BU`y%jE_eFIfDXmk_FK#f#Whc)kpeMMiG z552L_rDXb4)FT#+&g=sFY_uQnM-rNJzqWfHy>Kv?EEWq7m(@=vH0|sL@anMP*1Va`$b{YdaJbHz|Ber351NZ`s#-A z-5Q#R|6Eu6L8NgdFfPcCt}_-=D8e6KoqcSv@nOi=8#WH=NLSZZY>V>;a)XWEVtx9b=j zgky;2t6{?pn2R8B5+PQZlj`RP)7^i5fS>X2vsYqT9OaQs>8k8dqPK2Lo5xaEiGmRw z!Yr?B(C+N$Fq)9_cCr}Ly;UDeh>GF|JrR?~@kdu)I2q0>$Gm>QYmzcXE7GR-1nusQ zj%Y4rmtz{i+kQkRLr>23vg93wZXNx0h)eu2FNUy&lNJ5Lh2QwrzK92-+1HxrrN?)8 z!^WlaiZT1&S3=yj9+rCiJMYR<&~2IM4JWVg*7nkqQ~txpjM|Gl7;sL^DQjxYE=ydL z(Vm6=mGRf0G0_{S+ADE8hw~7T-VKabdoXNZMjp`#883v4*R7oHC$Wimv83=L&TyBv z9|0l=pb1BhH+uEL=4*2s7;VTfR2(FFscEWbei2Ge_3MQ%ufhmsEpybD6XX7U-@snJ zoZ6oWnwkT{-w3=Y7p8wurl^-Y{HCiS-JML+rq ztWDfQ53qU$_RXRXsUC(@{t6N&>Rok!ZbgP1{ z!k}ki4E(Q27tn7scQDc0#2s2DOu+Dg~hi?1( zwyf0|hF*Hd4y?&!(-0+h?SphIxu2~kFU!yi-(NMzSGRT}j8(?6U}Qko)sqNa*IOdk zo-w)+yg38Z& zE^asyQmE|+R5KA#`2Mx^^(+Bx-+hmoXRa|eoMcwV<=>?k_Jv{FXDN-wYsSdnM3C;>XoMD)hGitrN+dX62h{z1rhI ze&KQA^K3yf8Wnxc`Mau5HY0?oW6v)95i4(HwxPabf!a(>P@83>lc^d^C?j%n?{9QIa1@=((YUe?+|> z=DJZ@t{bZsOEpA+D2WwP9?-hXOy5W( z3e+z9wZ4&P4SYH47Yn{KFQ#af@>re6s^}ZIUR;f^9%FQV8HyB@4;l8)4wcs!&)tYDo%Dyd|&3WU+zJ^}rJa)~&4qx4jTOQl+%VHMn^l$czz z-n}9$%-I{Nw&=!fs-Bu-6WzE!?+f}?_1tFs$+!gFtY&WOQsa^{fRv`V2*`lPUabU3 zX}rsU+C^uS0evipV}s8HT?_P?AZ`KsRM0Izp9s1S=vtAt3uv{V_komep93jB`XD*h zi0$c27?gjn76MYd5}=#Jb}`WHA~|B)vV(WC*s_IIdhP=t71DN_mj!nC?1gi!EU|4nFw2YWb{fo8^PwA1~HlS_(62AMkem=CS1GX8_zT0wO(AJEfst%|InxJjg+MW;-XiVGW z0Wm>3(gd|bYfFj=1~?hf-rI8V(0*f8M_=`r&&L&29sSg!pO5pZI-saXrt|jcRUHFT z+)k|OKv-wUA@?irG~*JHrr#+ynJYTZz9O-|nY+9fyVv3G^V$RUc7B*V4OK zT{CuzsJ6S&53~lCoryag4o{TY`YOWrFF~ATDRR4=Ojg>|PR9Jpn^DuXa5k0t2q2}R&jV5_dIpf1ZDCWW&|09M zOM$rqNEMiefqo%o|81LXwRt;iGd7B+3h$q`**+U(Aib45ACPK7PO!~J0V#jawaumi zDS4OLW>?vWcLOSUF(4&xy=}$@b-#q=x3<|PplOmC9IdI;cmYVI##=y23Tvb_q13P$ z#%QjX>tn6DQn)`d((3Z)STr$Jl-?32o1c_+Nx_yX+bYg^Fly=>Wmq;6NDY9-0I6Ki zjVcBa%dn_px)DO5+Zo9=LOE@qpxJAN&eqP7=+S0?)na)Ke-77_bz?f}1NQRy>VCEr zzF=o#1ltI!WONH{m}zWp#%{tg-=yuny2fVH2J7pM<}fEUVp$Ss`5%uDkLcJ0|mad z&jVsMNR7^{Es^GqNS!+(nbg=Og5<<6Y7>6ZWaF2bvALcxYpzEs;uoa{zi68AixwHb zXo&HP_7}fscJa$8#^!pT{N~6nt6_6J^Q^fZEh~Q67ig}Bvc)ftCp6cyC)->3t8zHeU4nh`nC^&w z+{ahl0uCo*kE-W4Crw|^MU>#XbI3$g02B#v!vEv zw+V{D>@f*JHP9A8wKlp9Xp@*RK^_%!r)|q}^xtB3zisxQjecvRjX;kJ?@`-~Y@mPbO6f>64KMH!uw%uhTHWbRmZlI@x$CDFbBeogsZ8(8( zY5=|b*hV~|%6qnIes(@~78%=Pm=}vq!q~spnhBT*>yNI|+3_|{KuvNutUJ2O3VIQ&o?R@7jJVf;-i{?6?>dXgH;l)fOYixWsNWIC&VT_ruf_ERKAE zhSNG7wNDMB6$KfW575mBD;A{$CFaK+(h9+=6SV=KuX0@0R;Qd z>?$BNCSesx99XiOKgcYp?p87C&Eh#8w(Wp*r(GCK`ODftV5 zlxm*~q*VJNAf?(@0^Ka~cweKX?mdA9&Cgnf&A3fc%gUve{nV^wv(glAe*^1BsBmYI zZ{p5?(bU|)dV*&Zck|inc!s|z_FPZtWV1?&MApl5d|Prb#5pVeu_uzppJVvb7oD2u zu|-Bx_my&@RLYZ;^TBj9mOmr;a~%6bnc{0J!ic5W))fCG^zDCdkV^i31M7JEUswZ& zaKbTPPH}y?jj80@QqmuR%co2U+z_Jv4BT*uLHiITY@iZ`MQ94k#Gqa`E)u)s)v%WHL|JV-2d}XNHYDu4#h1o6luNi zMcp?M+z4i&^wS^KQ5OUD;fKi#kX?ot3`(U>TchN((9|cSq+Av z!OIF;%aEt-BTYMQ6kkneN7<~#NFR%p>8oqPoE)aFMZMHCR!-9wwCaTiRu!5$F3@ls zTO+0LL}i+@kZShWoX?io8MVzi|B7aP)B)^R)qRscpvvfK_YuN-9g2Zh+XvJeHN~rC z;#uj6qkxo#=$xxC4ivoW+j4P^gpkQI((q?D?d>1mlG zRFSm}>8HgzJkdTf{w@3JSMBI(acXQ1Ym*l4W?(K7^77ZdH=ESM-*V zbbCfYV|;ZbcH*;;W~nhY>IO82w9{yJ{QYr?HZo4i@@eurTz-#`a-C~7tH+wn>XBx% z+D|pB?U`XrOQ_b_S6zkhp?xhfb|N=XQ_!-arr;Mf1;3~%Xl8q;DceJZjTMD-FV4la zIHp@Sp$QpEsoeCx5|Z%<$^TiOg*^yAr+9N)kbj(v-X%)u9oa3^&ze)ty}TLQG;&c4 zsv9E(v4#^_AR?y~!`~A^2@iI~M27$l<$p*Ef<;_09OfVtT6* zfk3csrg7>flCEJ&iR6`b@UY)JY@HTpGfQ!qSyCt5%p=0o4g;_QsL04J z8=zf-$*p1(+&*9z8GSZ=@7|C^Qf3oWfUW$(6e70ttKMq#D|Nsap*5xt zX1R$Dtvbl{FKfcV)OWsMQ?t3P>nOIG*iw^zB*zibcQR5L4zynod!1fUaEz2kP!Q+` zv895O8H;>w)0ecI#Bz+JFO(1k_3;fGL67tS*bERYuyyiy%()$+lO=goQeuKYN3!SR z%)bh7py2|i6ILE^g0pM!{m1&MrO06(#cy?(dRo4%e7PF6v(f;-mEil9azAnpWOmqY}+Y=pTx`iBT zA4Znx26N-b#N=3x7Qwd5&iF)+G!w1nEi7ZTXPM`5B<-Yt1R6r=(%X{385|u;zmi4l zG!MvTLs$f)8p4@Csv-O-P>$HHvTbj%ZGQ#SS8SgH`mI!)e*kfP%&UD1v{TSA$gy7u z`Vo-wgZrG6AG3j872EkhTr~D-+=IMF(DgtM2)YO8H9@}ux?j*!K+2DIfR2=~{0m6= zaRA6_(3hE~Y0NFHt1*&j!}5c#`W%pAHyxo?40*n49QKzQ(-!YV@KMa8}UYWtML_cTPSlhAsG6tg5+7YK%6sob&1|T)k`K671 z2Q*4D@((~~2>KI{a{Ct`wQ|#Ln_)@XwC#sf+9fWI1bRgf=ZKFJG!96ud~xnq$(s(8 zvKGaa@y@$QN^n}r_}FZNjT^JEKyNKTL09@seaFT0K*JQ&GOCF#dzU!EMQ>Jmsb(5t zqBLS$FPM%swlx>_`I2~d@w`9P}lO0$Q-5B0P!Gylq%)HX&t59*!-!Cco|5kDwa*9s@S$DRrLjsQdM00P^yY$ zQ>iM>4JhBbnNdOpW6CYLx*Yqta_tt@oFIDJw*|-hQ0~lRmK+Wibi}biF`BKnOk&kS zR!^FT&DiJ-HAbRbcQ;}rCaU4vQ=3)ag(z8pRMoDQ&N)GV*+ss z%KEpu(XTjhL^y$+1V*5Q!MUi|2n=D@Zi2u1)95%Xzs?RNr{}88k#<@7MXnw3)Zv~g zoqDpO+$zjiDaJK2#t-4~_0(#Sq1@!FXn}^`L5eA|z0#IF*D0HQa?4TYzt2n&qZZcT z#D&zj15?dR9A6LnKtnmC>WMhXrcdF-Hd=M*A*Fh?mCKH{e^w9aG05rG2^Dk+^~h}M zk$G&n)#Mj7h}oV3eVNU+GYF)L>+L|NiaNXpNGZWhHmb7`TW_TpIWMeuN1?cWE%LaU zq5R--o05DvP_szp8pgN6<0~fH1#wbKxmXXRT-*!v3vuxvkn-b?KuSqB+Gg(peI`=c zfRvQ)fRq#-ZBbQ>6MYATHylXu&ID3CQ)60*+fCM6dvDC*Wpr+gsYN=VQkCORn%r&+ zfSqMh0?guI*3%X#A{3!2F{ga(d`A{u-rNUvD#?xpQjr(|q#}_Iq>_wF8!E|W0I4Lq z!Zuq5q};}URN}FXRZ`+j-^UMRuNsklk!Z80d2>ed=FH~J-sa6&&6|5Qk8X5#`AF9V znk!MlGd1=A76=*#v_#PPKnn%=Z8LT?m8}l6NNmGEWr9k8t`am0Xt5xkQt|_}!9-)S zsZ&b6ElnM*@%>q=##`ry?@e6-Gxr@(ZFalM00YeKSF+ICNm*{cT!O+N&k@8R&lSWV zUm=J=E)_HzXr7=sK-~42sl~1vh^{=`^oTC=fS9EtXBBeaz-1o6Z)v_xLLsKyP1{7SBE_z7iW~=Obs@L zV4}6vxAqR0hetIP6R!p4=%ySekNbpWryzR8g@3Lnu#TYlwhYuenqcHxTaN&9_u?o# z!oNrOh*9?%?Dl~D$~QxXk1g9g_N&xBY4)b`rO(1n2{wq9t>4RN>&D)Y@qW1QvxLEf*VMSu<23V}Jpnz(w`KaE|w&xjy^uljV#gC@ooEIb2LVfhQSEM#`lXZB(Xmp)QyV)U$7C^ zFJNkGN^A|Og9K4xIcE*o`p2+=)LTP_{_ zKx;6&buSV!<#G~iZ^4AiMON1meVr!ZT-@ix* zt^!iNtpHNK-2}8tY;OZn;o|^H`LPK|_2OEArb^6TvJnUM%Ipmr?FO1Ay!ULxL6_qF z-8N%kRA!&p$e!ygNjMZ)SHX3C`pC>LB;LHU?e9*BQ|=2#zr3ssH% zR*l2h=F~&=b)ex4Nbl6zZB(0kkr!I`YGpKBq){u6!lkJ!A`|Sup9^xA@(h+;o&%fv za!p;;yl1rpYJM5)aWITQh@Ce$`aTp@Lk=DoxjwR0G7#JE=~PfDUR`u}uSTbOg@&^2 zJBXz)+4$L@)ER$$!B%z}c$I{t1V@E-e5M`VlY&%FaO+GP^(#)yjr+GR2QxC*EzEL3 zU;gbI82=hL5&sWd(%TnZ>WcG1 zSOgq}tCbIC`flC<3*1!evHRS~KqhwX`PMR1V&k>Q@i;G?8Op@2i`JDpRIky`cE(yV zk)yDI%y2^XUh!;VI8n<@SvvaHhFbn>#q`Ny>40LL1(f348 zLp{qQ3u0;r0u6pR#_o=W3H(1I&~P6Adj%TK!M~ZZwrp#u#7^;7I(41Zhqk;EpHw%s zGr~t9U4A0jod=|{`&=NE-M#FB#ATm(!s9+zRg}j9sjlS;pt)ij15#2rx>23cJAstE z-vTKYVdFhH%fVMpJB#?9mj8#M5}jXv%kKBQq9bDe99@q5^Aj zD>DjS^9}U-@h!m#xp|?&FMMmqTJCq~9B8o}ElyPI4kyQ)9ZFoEQ=C{jBviQ17v~gi zIC%!*i+h#*T3MNWfmDb?EwezfbMC9VfM@5+nqGnTD*Kqy`DWRMS)ifsFgcDoVyhSO zpsYBg%awADWhSmLMz8SI;o?N4#W=*eLx}1|W~@c}JW;GM`*F;{x|bQc58D905LzpZ z7n&C*&nYWxiTJu)%G|D}hRjhi0u6%^Iu$b3Nh=h|OFZ#|gDY^_Vp6&Bvhi_QVvX)+ z+T47QhxH4;^;L6H)>gU4LrVAUojGc=gv(Dfi-!R<~4I_HeLpYI8|p0&w_BK zsw3=H6W>|1+wa1#p|b~ZvNKTBG*%!`4bV{iVTAQ8k8N_UPU2ivlvt?y3mV&I%2B&4 zIE9wVa2u4)T4uFYG6qHiYz+oeWBA?B!^DvJBE`iiv&+~L;*tpBPqV3ep9T65rQ55q zpQlsaWA*XN+$st#ucjW4s^pslx4qa(bm$%e>itVls!VldS{AMryH5?$PpV;tf>J;2ZsfJ?k0m3Ob z>4o0d$6IWnETwSEI3DpG*Xb!2&+O9IezI;r`@XCw?A2NBy3oQ&%!=b)Ej0K`$Kh@* zzkRnBE(>Z7BV6i8$4`JhLS}ijG9YzsV?EHHWDxWVAhYP%yk;Qf_9YvQZBj^!jW2MqCgx)$*RYvGMN=};Zp>rw7?&aaXvf9@ky9=< zyk`}uD>p{S6&&Hb+<@_xH3!(4PT5Gbct`Ha9qcR3>#}q#OFldXUfO&LME_Zm!4IS& z6#{xy%(%k&qM*2K%VC1DmGa5ExztU}`C)^5A-*g&>bSoklzjYY3|lbE8tET0p5-h%Ly#mL~#K?{9slT`=44u$p>!D##}xxatb8Y)&lE= z?Y^6Nej0aHk4E3bx3(M)xPG8>)eiH#ZJe@>AM71H8rM>aI}KM2KEStpwCxeAUcPE> zj)))3_SLYC>c+t03T{v4L{K*J1F zF;l~s4SmWgzS_6Rftp%!<2Ak*#?1>f`~=RhgOzh&h>XNn)_Lqm8y8_->gNodp2c8? zFqKWcYc;ZM+`8UAsBdPyBS0H)Z~v;bFABu-bHiLCT$8ORvbp!2H4-ysLpq`4Y( z+yb+o32zh78&cEiY!^*Hsz!2{I#PH?;8)4xdtDwBdFKKtdA9*QBxZL5t;ZLgDg2uI zKG`wgAO+f4Z2;jsklL(=B@$rSNH$(}f853eS6qk3)mE(~&_5G@+|I-i9!hX&8=m2| z%VT^s?l`JG3NDn0Vv10C6KJ@0kX>b@;HFNytL~;u$5vv&KeifEB&T3QLS{5KwmKVI z<0h3y`?tjAAb}X1_P#B#c_vP&_r{CZyg>WC44YLXF&29fgN;j74NW2xU23RZgiTX! zz6mruOB$_ADOR^#By;-3ig#y+e*>IIoI0yzK}Q#=a*Tb3k!Khft14Ov^c)2+_#(jS z;&+iC{@UfPw0SDnYA?!MpzkHWD}hdsGEf7g$_giRR7tuY=xgD<3#6t_*vaNJt5@D) zs9aE?oFr0)0jbi(EtDg~>|7wl9E`AQABtHS9+@eg5 zgUSiS>)DalZkQ1;VvB*WR{QPdg#dr>#2Y=4UO#Mqb#L@wM*u4{+s6lTZamE{UAIDQ zSP9B}>nvTex;YNY;JI;9X3vKQk4QM#&Z#iX22vqj45ZRg8gz4yAFdq>mE(e&&JA~5 z?CA1bTJAWsYLILlyTwumW?8zrf!Qq6taJ08;-ox7ZeN6HFTSX5yY!?%%M`gehsv<; z+`$OV+$lE_i0isujoqTYf*Ah+f>?TT1aT>$zo050a`9^*<>DzI<$~#?t`}$D zl!t3_F$bb9wr4LfENKT|UH)P2jR+?eV1v+;yCEoK9AU=Kh~ZJNdH;vf3@wx7{*U(F zc-aFT@W71mXK5qW>&X}$`Eqb2bwbcUf6SK?TJIaEulMBy9>i?QgLvMI=goL-#B(E_ zcj0*#p7-E+51zlk^A|csRnf;Ni(?wO7~eNggKZ9MbHL68I~ULSc+SVOAJ2X~m*BYs z&-3s+FPwOY0Vz(L5*}Yx9{I6z?JJ>XNv^VP$d_|5vQjk>xjDn!$F>)W0`EgJlgoIX z3D))|nsEK!^?;?+9$;W4bP)ZtzK#@)1+q{el2 zOw^)rWf{?Hb>mkmOa6n~I(ZqbH5ITQF987S+TNmn+NXt#b2u0~vU8nmmkn{xXI63I z)OK|KFZFZ=inow*s%R;si8N)c>PisMBaSFoEp3O=iqp)o)n zDWH>WG}A`&fYhAsna~<)m5K-G)auhLpp(QcXP=c6DkjDI6Od{s{|2O1y1ig4#94w2 zam#Qh7XhHoBNemdFbA7fDhm{NYbDg$3}o#BG7P4$s}j!?xLj^gQ?bv5Lly4Mbnx3| z#Xu_d>Uaa@7z-MG1JQoI&56Z8PM|)5r~&2Tiz3Y88$i*;TyO#_=<%jC5-PL0DbLTN zP_+JD%`e)JbD740aOQSI5ho+$N&RD z<4)>dzVZh-ZkDi2=^_;wcm>L&!KRs2snvhMr+Q+OOw1-Wje}Q-P5U7qX6$X@PX=d+ zrImmjeUv3O<>0SoU-WqMIw|g{;!RVSiw1|Y8dm8p0k&-YwVV8SOl+#fFL=_!Ol)Eg zQ|RnyW0OXlJyBT45C%(3EyIHTv7%dQ}#=78nh##TJ@9` z&%W+z1^oLTU3WFljN{UI2unTE1&I!woN@_OVpFSlziAi$cqEmjP_`_|mIGEzDKf*6 z1ggK652UtSvYb8#cc|MyoSO7%Oe$61TWs_J5XTW-jip5G8vGBCDxI7JQD(;iDKqvE zmDyz5jLUnfwEx~V<7h{@;8qufb^)ofL_^h+@pH1X3;lqOv%M7u5iZED)r{N zhB=4Hiv#Oa39pk9UZ+ZUohspV`4F!sR-uH~sS;k70~0i3DB4>o4H>{jDRp}EPe`x z4olSWneH7W9ClqwJZ?TsY-R~J%ZVH>q4quo?p2|{t`@UUoC>50#Z5q}Q2e)zb^xhD z@fMKE?2mv{Htn;`I0RN^#{(%ITW4h^U4PyqSj_i=ZnyFey>+=niwo|~W!YRFdO~J@ z$xVYJbn~PIW{%As3hv3_aXnQL>dp?l5P8UASI6@ah3acW7M6EwN*L{FgLYf1cRHX;tg8XnvbOl@g@oO z0S-7S$nL{e5bKl@+L&BBL)LDFcj>Ca%#@BjR2pfAs|qNC*qhgCrmUi~D(t|<3roCo zBXbdRRV#F${gOhnfYe1r*8{0q@m~N|tq7FYmSm_>o>J!Z2&4E%Mu$ls={TR>DBp?4K-KD9;(EjomQL`TZ|p4uM(=G(!QGK zH}hl(<2` zPBbRxn6;WyXMu)xX0n<&v$iO7svSGlekOty0y$5l?w^6gJt|odsvQ~+aHkUCMv34= zXLA|ib)pnQwt{yE;$Y@6K`aBRLbE`ABh~n6AXRza2YOa`sIU*>0cYD2RT}}qi3CfP zl)@nZs_lhd&xKyMU#xB~;-Z;^V#K-3xA7W_2~5Xm;rI++4d-QI*Y&~N#{>w$o%hek zQFUuhu>gawwhmTJ%j8^`v|m1f3(dZomtZqKBii{ElnZEkPSttzz*qAatSQ_n^&(3B zO{&z3VPXcMb6*B@spKCvesFA!LQ^@8A=GX|TWN)7E@fQ_YeOseRIaN=%+{h~!lOBmt?8-AbW;_#{TGdmd`jbut zMjq;k&cK|<6iIBFt^Uf@U#0qs;jjIig2wjI&%`*WwUTyPXQoK{vu$HKbtV#)Nl@-l zOHy8KiV|M{KUJ9y0KG3|nsY3B1W|K*BQF@GkzeWJ*;YCv9IohsskR( zYeddZR&^Zg=y;?9JB}h}RUPnV11QSbM*!wk$C4HdNeR z()rHO!(1ae3`wN+dglREqn>7JcLLQ2y4Obc+vq_X{nkbsZKP(3%=HbmPZ_#5d$UK) z{#eR&FC1v!?#6p2v5dw!DIcD>n_FF7tPs;BhdMWjGfjJrx zP=##-kSc8XK&qf#3#3NmH9%^e!kXmE;E0B^Wqu?<5HATid z7!O^-xiUZ22XH}3MAy~TBdNPSaG|iV3tO~zHGP~dhg`B&9jW82TO1N`M(V|m4}*p8 zM2^Od!jpV;MFBrAT6s}5klE-zVF?iz?j5Fp=0c1rpdp}(q*zu0O%}AqMll;z+o;w? zOb6vc;>VdsY%zM98*+_bL%9KBl$2*DfE)GsP zBh&LSM`&M9%0j^HDj57jIpWnNjHD@#nf0-h^6@~Q3Q{$O%D)x*#V)tW&b13H((D0U zmFMIX-2(HZ>PVB1wLVjE9S<~A1fOOjD&T%%7O;`>R(fNvMMmQVSAzqEO*i3wtcgbl z3LDqtTH|13JFa!GdQK6%2wqiK85=4{&7t}+jNfD85ij=7oypxrNb2%pV=p#^!82S* zgBkw7;zUWM2rB2c5!3~~hRo8BiAQAvkQ$)j5F3?Hmc3GHJTko~#1+mJ$88{iP#=z_;#D0Tz zkukK~8ZQPKo`5WIF9EA3r>&2dfqgpfL3nF=sv8mt9zk5p6`^^0;r^(%0N15(Kg%h0 z&~A4I4e5&FVRjkNiN~4C`d-}j(h=!{>oGYvX-AI^S7g=i1{Fqo#6`92>XP@8Pgxv> z{);zB+4OT!Y8;2hcmqSCm0Uz=1h%(PL#pJJ?nl~J1pUp5t>lFjE^{}p`97j&v|BoG z$;}TCEeoi4&E{fcfTRx>ZvFv_fG&oK@C46g6iCANb6x$JT_gx>{Bo^_aHEJ1+NwCl)Ji7P9wM>yb0$ac*BuV&6h@L&@caNpRF%|A?`u))!lhJ4CPAnNzzA0 zfj$B|iRFqr$ZTyNq;?W(2pJyHmE+y%aDcb-;nMU7)K(w^X(o4@e`aUTch2l#$+D6G z9xblYp{6_+b!BUvjV}oq->~TOYGS_{*m~?(C`#?QL{YyeQ2X1sy1rT!Nby zEr4xC^bA|{iH8&YYzzm15SESz_H9gBZ0MD~tsiDrWCb>#-9BeulQ#l%TKfzb_M_pb z_Q`<#6+9o%r{LLuISQV#ugODKXS5IB*OWnYdi$V#P1*8}jzB%{Wa5H zG!VjoY0zBO3^NYMWTo00CL=DA1MS1?_=R9*F~p9IzNrAPTXsD>~ab6~0(c1~tQ`>^M<5J)xRoaL$%Gj;`(*{^|Ch}nMwDYuQb?O%Yd7u%0*+wXx? zM}b#dsR@(wfmRBy^Ib=m!%X?XN%tR#{(l2V`SC8$jpE`fASI9eY1OD72c&v?=L4M} zZn^il0)A&|+<>IeyFgVUg=;5D@&k6D&_34uxIs_qtFG^*VVV7%8@}kV*#JPHMTJJKf!{S_RSz>ZV@*+8*1nBkG zuIi;5cQII|cfsRHr$E!aFwnPU(jX4|D(>(s$nJeg`p6`jCOMz^+&{2zRL^l99 z3S6}dKF}QRw!};cUcY7E_pj!t=?r~1X&0I4Id)Vq72RHbZePx zMR}l}@#7%?gyb<5s!uUBWc1dJjVfTDMsC!N<-&>jPACG~Kp?-r5G~uNMxBS1I9ZLC zcXCD|l$?#A{8?{m%L&x>hv}b93z%dFYQq|~B?vK48__aQn6SV_cerAD2!DUd7-=h)J z9a=x*QXI_`kIZi5E4aj0p3QvaXyX;+$7w<=+_r>IZ~+kU6((kS7R z&OAcsz9AckfUBCwamu6FRK;U}RGqvSNGWtq6ipXp#`TZKg;x!v+};hOTs#D%M!&hp z5oLQS&>zGF_Z4nH)_b-0fK+V{;#s-41n42Lor7QHmW|L*aa#kVnyn{oTTT}}CAMz? zsSx}Fh#f7jya-j9@mdQN=0QM8avqSf0U%GbDAv>w?Ho;XBCiqKk}D(u0=t?xh{$LYkHI z!@;$R4KG5a*CHrJFDkNJ%aPQj+fm>Ls=h*|wY|R<_>&JuUub;a4e>qk)tZ_Hvan z;qhA)f|)>n!WaE^{3_m3pg!V997yr*0qQSizqNT=fRw-HrWJc(C*?dBCb&K{J9i;t zuUY5$ntP^ipy981c8W{mja!iRGNHnS-}~0G74&4ckA!jXwk@+Mp& z`Z+obzUm~%JecdNi34FsEq##d&?)rQW#fW%U-euhim&c?5ldgKBf(}^ppVcBevNQQ zkR%lLI~Ryw~ zQyLrPb_dLqUf2+CkaMI98(0WoI~&_PiVF$dxhlq5khix@z}yrx}q&Ka|qF|0XQP!M`| zx{b`Z(v{T_Pg>!}(M(!dqs`2g%#}u8{sa3RtBHh~BLM!9cO|1bz>N%!(Vix@&xUre zVU0b}MU!5HHgjQiu;4wsC~rJ`MB%KrnP{IKoOLnu#x7k9Dok%o(xhP%TP*JSbfsn) zs$Z4@E$y9#F9A{$uP;}FrFx1A1_Exj8roe;Gj54*7>?lBTi~6Bed{T-i;TL4eC@3- zN!CxO&f@Xof&uKPAad554iCS^cYk^2r4PhR--<#2Q&Ve&c@=B{!G)?{>YWqp1c_R@E;m*THz|GZTm=nBA!;=>`BV?V#onfz$-);rzDnU)?z z8JM$nX8Z&enekyAwG=$>=kVlXqF6E*a(>kVQnI6t zM!4a{O+K3RqaMf~lt(ulMnR_ITLp(v!^9?6jaWU!f0QF8yXE_KQjUioqiV=++Gz^P z3J)9SA1i))PpnVm z6p02;Ow}p&SCx5KPcNO__FhITywVEs=?GE#sm@{IiRFx8oUi<03l4#;ZE{5` z03nSk2!Vpwl7hhKqphM-TGXu3H`j%Z8FkFKZeXoXH8C7!4NH3g=p_vxlD2l);)f4@ z@GYS2K_xe1yN9N>AUesM{g_@CKd9xD3@0_ElI7BE33A(er{4V(>ev*8RT0%hnn)2HSdP+NK(4CsBUmWi12F!iM#_+lh9#)NCL_(5}(9SaCHj68AltNZzrV@&HlwWwCALxZVHqQ`;cUcbpx0i zbp!aJtA(KWp({G{&N*^GIWXL3P%juoBMiRdqYtQD=C&7aJ_SkBgPi&XiZ52EVEM=$ z-6K$ZW+D(2pVb%+Y9W&{9u)5zv(E_~<8L~#f zCc5KnqC3tey5nr3JI*G$2f+5lvb+$_CDM5|f2>#VFNlaUPS}!(rjKVCKO-&Dyc3qu z3Fgz?PV%=yS{Z%P-He@&TSAGIcJ#<1$H7rz$#wQYRL8%KMRk5GFr#^K*jigQV{no>{__aSX%YdsJP>w%pv7}%+HyOsz| zb87<+_F1F`j28nu+E43$u@iA0tpZ#L9aO=yF{q7fYGK;#UMbo04rMc954 z+SW#UN}AHe;)Xj)o=UALn@ysf4bC)F#daFL7v9yMU1i3;vo&=R#gD!)cm~rZMZ4h} z_PCib?ic*1(}xn~ou*;>e$v%Ok%#+&$HBz$Y)r#fV*zkY4aXLhrfyl(R(doaW3HM= z!xN9@ZB!EnGHfQLh$XuVe$$72PN26;^`sxBaZ(O{Px)*)Os%2$F%}yy<@x+Sy;2UF zdnJGVk&pT^xgl`a`>nx5K04OtZ~_4>MkP3sc6nv^nCaI+Ix&E?!gL?h#mmwO@Q;{) zO1GhTKAM*CP7862-A_|!bhls9L7E(MJE%Z)aoa-^Gj4ko^xj9;^}6k+iL@*QK@QMl zT80~oa4-DDhZeDuXBuUpm-1wO4tDSy#{biK_4m+}$6hjdc~#+(jsIuz%He%Xwfk(I zEr{dze=e_(YWE3T_lFO*g{E~x|LUlDdKaYgq&YfnbLq5fR*TYh z(p80R`?*!vq#7#$6@HeapL`TSBWJh0qsZ{k2v{6-NDFOD!LVva>#F*f+V!IRkcJ^N zt&KcDQA>ju=_F_RbY>jWVz^;KwZKe1Go(x~KMs}_gMKQP|GzJ@Q9l0Lg8`6uhK_0# zKTb&lbl$SiY#gU(^unnyP<)^~3KVaP=78d}Gh1cqcbTG=l<%r`m#MCx_^7F$Oi|~G z?yfTzVnES6oVh@4ZyiR_{5zLIizt3d|WP4A)Wrl~54n@`iz2t&8q-$Vx(mzCldh850G6~Rqx_y>7q(0P-+zAE2t0As(!@cv_^@~(OyzboCpMs#j)$OGgBz~z%Ri1LBLR8E z?yDZmKJ}!f(K?ou*6DJDPr`_ckl3Ufph+K%1|&Zr(HrNlI=9TG`5boNHw>Pgmy!?B zAi9UnLUtA{Vzy^25Vh(?7Q!cLQ4wgIZsv9f;Pg$KA%Ct`O8-EXLf| zIz#TZcatuP%$7^*qoSrX&}{}}+Z*#n)22g9+HR;6KLsxJ=ujDhVMKFrW=dl&p0(pYDB7XwWd+A9>auJ56z!IJ2Ve@|KMf+<@eM{0r;DSrJc7f3BR zl6FV(lNvqLNR$Lm8d}M|)N7EUFznx>pjRVU2dY4|s0_*bEy?K7v>G>hw4}?;ng$f# zZZ}iLEtYZA^l;ok8An6eLrmUQP+ZdjCpe+0;rR?P zXu3%dO+7*C!f+Qt>&pRCs8%lWGrci%t@W>ink_Xt^hZ5F1Vkly{b&+t0xKz8jWRuH0{mgwijW9l7*dP>AtZ0~G%}#$ zlt7xy6%3`|3R%7g$-a-{3RJ!ybR6>$2_`>NvN^fRr6tcyB+DpeDf zVs0t4NGIPoozYc;)oZssC{9$;hm{$K&*Yc^gt_Vf?g^Bh-(!@4v{(#1!*1}dcAe8O zr|ypgV$1T8XUdcZ_L{Vk>1VLt*1|LWWM2K0?`8?s4PmlRdVPBDUHd`u0cHWo%6G~z zZ=^{pteO~zAJ`m#jk=f#VtZiEV>f{tu5{dc0?9&hT*calWua!QTs`0@?JuHki>`EG zVyP)d-N%usFk4NAc)_$-d>u2)F-7I!7!D#4$;S>%%;aMNNQ7be!bkdnX%vD2@9o&T z^TdaVIBZo_lTiwKe;j#KgKJZ|9}pQ`o8=9|*(FTfAaMPFO^4Glqv#M84U!FZ9y$w9 zF9QD%a5FjJaEgYP@+w70d5t-Hr_Zf{{OpX=oCB$fBx%IUTv{GUw8Rt*lAKpk=f(`R zhsxurCVi^oIC#44rF!H|m8;=p59F;g#iE8L!wn{A8r>Jd@*3L>=!{v$bmEb9B%uuQ z3r4nVRlsj zT_=KqBN4Ia(EKZZZ9V>y;HQenDq(9ujmho)Zdqg@#I)kNY@-M?)DuAU5*VO!Kp8=s z>p|B5z^<|04T53{&FiYcz1%XFYT|FAS8sR)=)7_#kh^4ca{sOJ@274;UN0HE>*wHF zH2ozrO#L^8ebgpM`pe^u-Rxp70)MF&L8?XlBza##@^R`&u`Of$X|EGjb;a!vYe6}n z2AK<#Cw4`MqD64tx4i?3_g?Ad1ghrdLbyz^g&VYa=E79CRbae}L2-_4p!md&Zj;yz zxK&~}-6k=b26A9-B%g;{3lx_^d&l__PO$8o2+EOhOa;Z4n6hNtIT?2!RCR{?DC0^h z1)&ymYXgdh<_T(|C8dKt>dD6tgFw{>m$@)h#*GG5m+?}cpT}>R>`PNBLz$HGpm?mV zfpTUX-(;LQbesD+fZ{Qz0jeRxwU&LCf#P>eZHn zQU!)v52`K0U6I|M$!?{PPxcH~8&o@nYb(3;l-&|R(cV~dVTMdC2F3Gb11O%hgP?fY z&dRA6QSZK5jnDdg}@-nBgEzCmeN*I)wyzfuiuOr=_ukM)92;W!xf_Z(c z6Bh!LCfy95T;+?*=vLr>3|lAep&I`bN>3}y8GU-7^KFL<-*NM-LRB37a9gk9s^VSg zW?BdQrkiOS;5Xe&>xSO}>2BSyyxk#*Njv79HVo5GyT_qUVgVYToSM!AyDLBmLJbBIuHw+^Yqg-0j)hPe)Xf_NN-2BP}A?=u}rzk$hZ$t=DEU7v20MWaMUuKL< zIi|!xhu7>ruJD4 z#>jD%RGGL%6>H&X(#TnPvZs>jC#GH7SovXnuEo#0=?-n@tJoHNt)tIV% z2UUep#gLJFlB5hMK1q@cigT<3#Vak1Q?MUFQc2wwGE66+S3$c{NiE~B#^r`R17hN^ zQuBR4TnkJL*rh6=V6<+l;8!DeDvsZ@e(S)mM()%AzXR~wE!{1N_E&U+lpfycLt^Rk z5aylJhuV5&48_6v55tutc z|6rzrO0yZwsG(d(u{)}8)$y?dhzT!~QvXysv{L}aq7{tA8JiXc!@B9$^lRm$o6H@{qBB5vFr%TXi}=E%C>~LnN=UuBHYtZW zhye3Zx{5l9WXY^%qk8DY3Mr$H@};rsvo$UM9@UH#p}s+!#t}P4Be?k*w>;)mkZ;kJ z&4j$4rC`yr`8GP(!VC2=C|>!f_ru*rfZ}d+&`4JyZP}JR%v`Yorz%J{OQ%r=p;pqd z5X|kFH~g4agv@y?h>8iSCylAU!+ z?O-m33(^8(OBM$fHIep8e+iXh)yGb%H5pr|CNgzmm50SGMz#ASYB!r@WOd4nE*b~V zJW4z}DJs>^d#qiVoFfa7>#DmY)|Lx#8SXgIDp&I2ozu}}$4v^bv^Fe$a_P~~+LekB z4F?TkQF=Hc_?u!G^KP;YgK|^{>-1ec{*2c^U-`9ZYT}L@onjjU!r%*_doaHe= z?-IyMaUKOjKIs6Lbd)e<9FoPSAovMBa|rWDKdL*#2kU!M93F{s=(~q!k+tHzO8y8z z3{E#^#Bv+7j&Y=e;(f9upzN6&bqP4HxLBF|JO@sOv%^c7%LK<7$d2?|-svkHn}MR8 z&uSV)yJBgR_C;a^&%;r};w&~wI3q$vL!9Fsj+oKZEVFNPAH`0`izFFW&78ttnnpg1 zzf1sKKS6bt86g^p(ZVJsYp}(o4b63=!(K_(u6U!3Lnx(Kg!YqtVj^-cQY0}R#b-6p zsXD+u^yQt=3Ulw$Rt7&uSFensZBc<32cIqC=@L6?d^(9Xvd~eR>NKxf!$$`mGy`__f8c*H{AnffA>Dp&l)O}-Ofs3y>UlY-o@kR4qz%bB8fK-zF#_~tF2>_lML+sHnYih<3}*d! zq?MPvl)r0~ydb>N^XUNJ`0s4NQ;Is9N{}Y%yrBEXx;#(+uK=G0G6i|EwNVhKVcIq4m zzUhKGo!kgwi;_r{Kv@=J^{^f&KGyOERhqd4gQBBb_}nn4vW!|K`_eUq-1oBV`&{;= z?L^$y9~2LFm`qVk=CN7`ijTUs$rNqjv?(5ECeY4$rJv##z_RS}PM^aj z(7n?ycw_n!RsJM7r6S4LmPSs^*zP`Z90x~oab|P>Y@Us0IqY2kwJPD%=fn2e<38L{ z^L8a1Z21&1SOkNquEqWd2`7N>RaFsNh>RwoE{2XUG(~(@T7cpwFR1#BmUo zQI?>nAEFc#7?hU^u@Xw*6kn-EpnYv)iD@(vDm_**H>ZgE9OqUQ5>z49f~t{~po+6* zoMeQh$6Ds(6meeRoESY9axr5ujg;W{TU6%Y6mi@#;ux#PQB3CG6mi_=99HInRih$; zm2V*yGyNQ~k-0cUT#uNWgN2!35kkLpc}TxFjyeULvIWICNbWWKmmX8H^SErPoc~ES z$^9V-#$Qvi--xm~OiCq{Hb)!Ap2wMF(imQPOv(MkLB1SEImju>LC!%avRKk%N;d6oR0q1=IO9C7i`}b5iA~( zn~sZehhr&sI8_Q1=OWqV^wMHVKFk2iC;WkY;XlbI*=+Iw;m~7BKFwcJIq*kHEgVHO zrHAuTT6nxk=Io!uyE>DrU>2n?ED9`(3%4k2M8<;?O2|3NDGH5_HKFwEtOPq)GCNo@ zJ6JM1mr}1wy#gc^3TrjtVoFWMgxddhlVFUdN!xk12O1W_EiNq#8rDSeS5qI-{ zjQLrK4S!3^oSY)gw*MM#k{&l5PvWuW6mffUZf4~Q305xL%7y81(WXhx#VO*V0}#k9 z#$`peF@P9S^h(E0=He7_bz@x2HYPx;^f<_u9q&} z;Fliyv@%Zvrzku+_$H-6XW!}G8tEx7b8(8ef^}&SZLq{az8pts;1s2Sa}bKwFr>$n z>&S?)N?*M$z7$0`HNd>}&TsK;4J zPBEt_wAnmHtaYQEqdE@q{VR0rMY1F5GgJYcf;J^`9fO2^Mzy|*3*CP4}oG1Qm$?gBX? zd=8N`fS5Siuw;3>N#>QG$lcB4ax1H|&2^=y;BRGF!#G7D9b{bP>R1bvLK+B_8aWG< z6g7kruWfT|E*6coW?G81MdX`3(6qY)|L|1TD2Z)# z$teou8jp!y?^EI+Uyh?xa*9&PIS55#cj+-D`;I{>CApMJUHG~XxLlG+H!4VvDY<|0 zRO+>Tog_H^R*_T5DN4r^&VhylExt2>2hvM?s>&RkB90d#2aSf%;>YoR!f1&Fe;s8m zP7&8T&Q-FIP;!Z%;WVIYprq=NwFdU3l;%LJVxLlIyq^D)3bySirQmCAw)X+T)=>4+MiVa39#V}eaDwLWf&fHKm#b*g5ac)i#w;Sg! zFlsn1vEXkfIZRFwR|m#bZoaiJ->)LVt0a_Clo5)(w$3SXxNvNt0M5P?e+*lumyjhr z-m+Xyk=)KaHlCJ(C;H?nKg=UFg5LV_k>6{*obZvkIYr#v_0m#QwruaD0P&aZcH}w0 zDdOtGxE!$QrZwiSED$C=5*O(>$C8e7itH2TBGgj7SecUV&*f98LB8;xNGx8^L2Q#_l%27K}Ot6~8+X+|5AUV3;#&W&%_mK0K zQxx_PCWrTZbfdFuJ+7WI7pI7880TV^3!0!e{!fIj^z@QBIYpeKIVa8DwBtBhRFj_G zG6$!KBZYI=S_-yEsjY9(*H$^Y862ABk)A#>H>Zf3_E{N@SDQ(2{Ov1qaEdsla}GT_ zzDSn%T^aH5A&A3g&tR|%*83<`jv4xlr|Sihm;g7{m?q%k+`T7 zIhHh=Q>59Pi%@hmu=JRczl_VLeq=%^CRgI1&^d=;D4c^(4nL8-hRY_q^u8$O#fq`m zNL+?eb#WKDAbTzHLwZcbeG`{2Kn)>ZKSuu)cP^XcB2w~WO7;#>HqSvR&cwvgh9Pjd zB(oIwq{o!py|P^W()lO3Jg-Tn^H1bv$#N-lNk9HcF4qr|8SoRiCzxE`G8xaKeU_4n zze8p1pzl%=_Om2f$C57Sfga{zIt43njBiloqyTu5QF zfwpL0RcK#r1iM+f_I0VACML-eI7Jd}a0z;Sa!-dF?Z&8cZm&u$IG0YBF=I=U2QCd zHdk$h76~fB1*-z)AvTOp;-;2>^VrE0_2oD>p=jk+dQ62=S)#oWyVdD;L;33;BrZ3YvjB1n97?5 zOfFyDD2ComQ9(6}+cVlRFFh%c!h5TnqR^Uh&I0}Q0Eq>ESIAtPBCgh)OV5Vs&nv8y zIXFce?s_pq54;ijU}7(von{fkTP1UHia5PEr=?P`9B=;G>@bH0i5&E2wampS;_Aw{ z9H@tbjolVvNlIK)ejH2X$0^cK&PAxr_%A)Cp4YQ&$%g#%6jEvDx7{i93b`OlE!c}rIk~ZCN7s`cKC_hKv6Cv(Z=`xls_bU*-zw$ ziSiLEZMN(#RDXax6fflSdS}?R^vkY4>x&!ja`?)NGQ-s|AKgZyO%*`p{KB9}k10GNS{`_+cUdb{zMaXO(gMV51 z?+h;Kq1hx}`kW#O=ePtDb3g;|pPV0!Vg?;!4eYReB?`1Ad5!Wro z<$y+`-+QbJVK&qvq!00w1wAg^?uHY3T;F9bP7#*_=VErEIOYT}FVG0{0yHNej=tXM z)u|t{1Wu8J>P!L~(>~68rgHVl0y~M|q?7CdGh>+wGlP-K+2wX17 z%>0SmhD>g`$`~;!?1e%X%@6Y(B$&a5Y>K1K)`#Mk^w1_(URs=@6gKB^M5|l%p`B16 zp&aIB%A>X9{SS$oEEeY>i^VDGIdX17-NS$BF%?c*9uCbgzAr22b5JZe2jw%TC=Hy0 zv#jbI))+>ON~>MnqFK2)v-8T`CpU*#b1TY#VO(%z|#|KB?P1W z7>M?xPlAo$6=WEhwH7B=^ZrWXJHFW)`LdEDWp+ddPO$b+eAU^~%Z& z(s&Ky6osG2BnaVw(IN5SfrGW`_=La&Z40$ih`NSTd`)%THWDegx9Hy^UKCojrX!c=qqq$){JB{@z`BclYSz@7LAW*RzXX|Hz1-{vm-0fx(a+t&Qv- z92-k+`c5I**!ccYLE4an$awOL3yd4yKR!OvKPnOM%WaB3d0B6CD~6hI07-A1Mb|U0^+O+L5MUEe5S9DFmwbv?EU;sPSf2fb9XG z)<7XR<6VhS&G2?$lq=qjjMCs;ol!n`*J4y}yz4S50B_<~2;q1)WK=BPv^7H^sZQwUq}?!u@&cz0veVZ8kqbqeoZ zjJk+-Uq;=;djO+y@D52oL!P?3Uw)@ zhvgpK|L2Ck*kTi1|_kkfERP-e;Z2PLTA4o>V%jWb!5yibtqyUrwxvY z3xP((2D0`-2xfIdZr|dCJ~4^vsKodL*1YJKA(dc4M3gqpKR5^_PtquCp>-Q5h1gCC zty=5-fX}cvL|YwBRS#kFN~SNA`TNWK{!#H^B*PRNq{V5YwP7&{5mfW^rO5om`%fS= z;c*GjL`ej6O7Mz~fV4W@o7FE>v&54E1Y==1vOC!CisRg565TFV;n5FtKrC=w)AV?q22?Sb+HhEOqw z#%Z;b!|X5EU^r_yIX6nG19h%RF%3zKjbwH)L>-u*hO3o8wLg|uf2P7g{_zoE{(+IO zHsOH=93(G78*ji8q74m9j7<37c*r`q{NDs-!1zB0DJfu7h<_+E-Ucce8yFX_mE!FW zyC|Ud7S9zSHZg%|0ofs^cmZ`%8$nr*oQV!3T~Z@|Vo-C!qgtq8l9LF z;s-~>n(#p&qm*67K2ngpI}#XzmVlZ<$`xa<*eddRjoKonNd7HpkmNu; z6G8p~TMpF}nC{4qR9EzLN^&=7K2bh_v5B!Q)bK^CB-vZJc{AmYs1)=^$mnXRL(sn= z6Ca-t1Ct`wKY?izNoEQtH*p};1{KCgsH~oH)LA8vf5i`rz+jG~qRAjNkj1IvW3|Do z&Ld}nViFM)YXn*EOdA`6A>c69#iZoR)rblz6xJ#n-43eBs5CkimP3`bKz1RGmVU_U zESIw6Bj`1guzH~}EPhTr$3iKNB0|qIk!2_Ml+-B-{Wh6fAK)GnJDf(g=toB*L#RJ1 zX9)ToVrPKH#$BbRpMJo;>G#fbeLr<;)>fdLVxoB8kzs?-4<9V&8QLOr(-LFJ3pO7k zh{QT-^g3iZVyH|;1qO?>%+B*f6d|Qh=Ln%Dps2ec)Wh+QiV4vQKH4}kxoVNSZcrfg zlDM(v{df!+LL$O2+M>Y&AC7g>8$U_GQc|eL7B2@0m&8~oj#l6S>KZWWPw@6quhA3G zQ`AA!@u(6}T6I6CqydzX@#t>+vu_uZts}ZCTIdfAQMk$AvF{QHxvVv#ewiFy*7M=L z0A>&Uqk&^R0rH8Dj_@aSkA=yTlC0whjEs%uP;N@&F?Oh<7L!e$dg0YBq_D6ktW*dh zVWvL>0{?I4hi4c<^uvUXN-u~1g2n8Fl8lLXdQBVgbq9Lkj z?43wWoGuIFYcgFy`{M3Kty@I2;GlNbYZO^nQYP}DvXgVOq<_vcjzRqjj1#IB4lP~1 zd{+6y5;wlM^|zQ_Z}!35LQA4@uNRwhqhH@msU60bv^!eu&*#Cm_v_qi;%Jpnqs93S z3B9k)Sl@ZCwqbO9qJ5DU*TyxPyEJ`sZe#Ps^8#1er8+%Y7yh~V{X?CP{3!NjR-@3w zUEyUuTzuJi(6oCi&v%(ncfiA?uY4B%*gj^)-DaiQhAyvv=B}%Ho$Jdnk;U^~RL{4# zb^c1d>Har<-|p9Ryydfv=F?8BjsGyj|MKG!)6aaK+2%KO^HI-sp1E9QLBDztgXgU) zQ#B#IgJxB>3rM?gP=&GGCk8!MWk)A1QX7AJ+Kg(8hx$ zz9oIIbUV~}Tjt`z3rqM1?3y)iWNtm{ET`{PmUaAcx&E!C-$wU1GN|S1)+JxpZPqTU z{?i5R8eVQ@JHJEl`JD#`3<(+MTjk=WsD583_deCVT9p!US5gX<+cjaG%kZ)X_gl2t zd3aXZ-4SmKm9goT_h+?MBeP0|40<`?!|10ak5)W4CwXn&#T`et@AqHR#bW1{*;enH zuFfmIY?4D?rzQjA2PIb+a{8L))T@%q_g%lfd42DBYa`m;TXOV#y=k|aRJor0ebBYv z+mE=DJ3lz5!lFM%KJVq3n7r&+_-DP_l7Q0z2axTRDC&^`rD&bWgk0M{pPoIcJoFb$BcgF^W=|aN!9ASAGEe{u}dDM z5_^ZYY%#le|3a(omZ_h*{m7e#iS?KE?Yv6Z66-SNxcjSCZAyRp@~ z{I>1md9ktSeRlW$QE7a`n3R>7FAfZ8ef-Jb5mi368oDy}t9Rof_FXPLtKj=GHKl7G zkLID>YK@s(eAS!0l{5Z&G(|c6QCddZVU7!xIemxL`z27D95kTj`W6}chYV3)UG{eU z;Y)A3Z#-4$+;;!D?XPuv+`f64DJLekzje@0quxC1rsbJm??m{GuI2irXp# zVNuYY0QdDndVXAacU?-cFH6czyH%r1yGtSU_KnOwdpxjkt=ZjMy|Xz~_teV=9UI%# zKX|54rTkl0KOQ*o`OeG_HQHWjQ+ht3t zN`+loUE-_!8J`O5** ze*Adza(!;Gs~6AI+I03*(7AU*N-uYd@BDCe;%m2gl`WL<^X}{mF1ub~mhy0Io$dPu z{g_z0sgE+E+5~mKHeb(cF4(1YI@kN#^g>PYA8trK@6lL2$nsC;)j@xnM;|_79b&Wb z$j}j44=1?%s5GHs=cI@$GczXT586I|#Fl;bL96Gt?_bEd*SoTF2V0L>>w0U+@}~_a zHX9g{{kiR#W7XF@+Whfx>CSr`);t-w?fT_~zbyaili$E2J>TV~+0)xuUcc6>IKD?E zpZ3;S!y4D?)%!)|_ElY#6Lx-l^xLEMHOtrheyVH0XR|MTeaFDrll z+bOC3n^jdjm!4|c#OZ0qhR^5L*HRyOy{ztmqQB?Xamwv9akbOuZYN{xKDk*fwkuJ0 z*u7rU!hYo4zPP;bs`zqAN5AbImf3nu&+}ESgBw?0v!%<$S~r5u=Ipgj+~46u?#%B~ z4@@~T)+VdhjIC9_*xPNNcp$0R(|b943O}kCGUDCHrmGfA&O6wp!4I_}XWa3YONZC= ztMDWHYSoO=ZT2|~STOwMdz)ukx z*C+S|J-6s`@N=gkNxrMAjGjI!t=i62#Rpc}US@b+Vt%cenPt07zcH~}V1+gd+WKjy z+286A@creT3MZ=jc9^(*s(H1ccfL-4aVdP`{NZmVKF@M`I_Fc@OI2dGl`34cuw&M= zmYZ6HRlYXaU;0~Zal+?-;Ff(R9=7_}@^s@(dyZ^$yZ2)2S4G1EBh$*azP5X>m%GFC zlq$0-f7>^5Ovkm6P4{_h-gDLY<6oAmhn!e#(P%+aXZr_-eNKj{8q9vN!EwQ&*TW9> zCG8REcmKMc?(WL)>7T>n-v}zVuC6 zw$QQPqvB`Av@+Y&aqh^x<-MzyK61a1wSD;&hZbFMoAb+t`sdH}cyyq>->Cl9uDP|V z-?gk2cC1(Mg^O3M(pH4EzpT3PE_BY@@zK6MIlHghN%HoWe0*|U%HcX`14H`1eLA>@ zg!gv7^1konOGhRD@r`XS99XV6-rTdlqxY4o_fFlP+qz!Z1IyPNpD)?8Fwwtg%_b?| zLM!yV9d_*RocHdIJ>ESHT(_lcPboi3wOqNWS@O`8Qhxq<^V9y$(|ZiA{JmMpb6F?R}7TSU~w28#~AUvaD!S-NZ6g zDm))K;ZX3Hh~YEGT|aH}DcW{s<_6ce4<8&dV;pDIzmq+A!?Dy?Wp+F-zhKd_Dgk}{ z`v;cW{v|hN%;Qo{!L>K{yl(NR%|ZWb_xAMOyi^nD=v})`?LJWfE0?wX`Z~Kx^_}yb zz6L#5w0leQSm}3ehZ3`U9_TYNslq$!;$HFD3a(?cuXjGq2%cjI4IRjzq&-=*}h1(v^R%2mJiVD6b` z^>)m;Q2D0)^yUHYVpe7k8nR$j*FSsMxhJ}AdwsNAu9V-3=)v=`BVb7hQtlPiN7e`_1pir!>6&0?kMu@I&KecAKbusS()#r9;BV`8gD*e_T0|B>!yaiuJLa1 z2X(KGL+zi|o4oN|<63X_sx+5Z)cbqQr&Y=(-7c1hOY4KV{VUN!qdEj9%nbZeXtMR| z%5S?TFSTsYU`~g7{m|sAnA9XS9R*`NPhMBlgrX2b)G$6Ki9Kv%h7{hwv_VA@9d>$mpy?! zCvQ3LQKER!uYCqQuzq@QR*qDDSNa{#`fcZr9a4Tq*^gYc$o}#{m#7QvoDP)SRe#0H zB4yv+^$j|nxgl@c+soPgB5i|hMyU3_7`J1?Gv|$KYZP8o^Vgv%R<4z^kG}ic%=Y4M zqYivqmF%~r^!G8h?nZ7t;c#V2%+zbDjh2_Rjh5~1H?&#zYvb$}ZEC%^`^z)Q7y6d^ z{^VWH*5)l5e;*ls{qC<>m+3YIHxYh&kFe^jEvEW%sA; zxHW#OV|AMn*OZsX_MOqW@*OEXl~(mBWD_#JqGaDBdn?JCT=Dk>-MXBwAlaYI*_WG5 zc(kmPRR3dd)L&Jn*dO<#-@eby@*Sg&YPx=XQbhAa2)dtqBsk;F%MhD2B_})^e(usA zEqdowJ2}M0qUiSb$Gm2a9QWFJ{fJ7v)tB;TceuN6*@Qch_dj*nSf*|CHuJ5+Dzz-0 z^6Q{C!pqpnm9sOy`K@g|rg`?a1ApBd8(HZ5#Jh)u0kfx+w|w8{nfI|t&0f^XQ1!as z>c`zPU#m8lye;%j`Ei+lg^g@KYL;!r)fHbJOlUE%W4mG6m5sJ1IJW2^>7!)-r2LTT z=dA(HNB9g{u6@3y)TNWZ?0>!H$iB8i?v-(B<5d0T9}%0r^qd)Cm3$%geuL6owl6lH zFtl|_k9KorrEgQM9dmU>bc-APpKp2iY;EL(rd!=!SH2UHv$}Y2pT2YVjhYvE&Hc6K z>%_ftZ$23He(mA(+Y#LZX8HXg{T8b3+~H9vb$L6_zbo{5HDKjM52rHaU%hg>Q#$Tm zgC<4p3B!U_?L9SrOXXqVm^Q0!#jL)P{z~nWPg;>{FG6!%%sh5{J)TzfxcAm)s__lZ z_P7*#ao*sfGqeCYjb+}h$3x5TNoJiOiLvUka= z8>)P%pHt9(nqrHGTW+f{lE2j6U9UOl#)w6L%6U5)$| zyXM|`KfRvq)9i`G9PRe6IC=U-`TLKS*m_pn^1-@!vm0xgH+%U0@q>5w->pub*!jCs zn;LX^{(I}HgPptI>N9rL{YG)KyZ8=$-MX3miJ8C7+5N#`?15)XUr6CKFB52ylC2feKQ4*!r4H>4!D^H+Qf3Bw~A5ev^;sUW-ng*&i1= z%hq=O`ZKQH2QHir8{)FGY~R~0=GXbncYodd`yp5B|Iu<{FxmgPVH+3%(Dp5lo%7;$ojYZ9V6yjt!P{M?_Ki;MU!0OsW#8{>6Z7(R$og$Ie=pj;>&*9= z-D;8NpWA8emIDm}-#-k*ORb+)pY=6R{~^20ax>^}W;^y&pScli%KmDX!` ze1~#bQFBvk*E=?R@XD|$%L|xD?Z?9WiZ!pO5 z%M5K!ps;-9`7OoW77pJuJh1J~b}#$RPD<-s>O^||HAkv#s51N)Wrf)xX0yFq<6@rm ze_AMW%&Mdtt}o)sH2!h5>&uX3wr&5gvRZT0|A9-jYu1lS&%LobCv)_LzG(v%_C2{F za(Y(&=ivM;3nCWZ8T^ZK_T4A8uUtH5joBTfy=v3Rsph#==Npy?ZD7AE^Iq^F$6;4C z2Kmn^TRkTKz@#Bg!&A!iEK7rSRfDzU~uRI@YMx`Pr+ETP8M|?6aV7+j;Scf#+rn+i6y#*1=&Lm9Zy2 zo3E)gZt9Zj*TZ{eKGk$ww`0twA|pSXzcT2{en-cu&%eL9VPEXZ()xWH-U}|Qxo^Mn z_jTXTI5oL!pC#12-}r??>q+aok6yj-Y~HIbjkZ4@{Jxr9sg%%^3Kt!gXI$R!;bF+7 zQ!6}QgrB>*dSVsVViogjPTffOv-IRGqc3%=AG$NZCwuwMV^fOE9x!qD$hzrgK0VH^ zQYW%|(<$X$@lciZT3%Cn@6;+*f<^RbmOPg(cwVQFsje)eSd8FOFE3;TW|qwV#! zw;OmiY47W@XT^xrplL(07CFV)T^(6?sq-&z)@Prqyi+eeazgf1gd+0eQN8gdFv$o~W zFZHAS*YaoUY7g%GY<4TK_P&@n`|01x2354#JI(#hjaav?lk@C%SE_w?PrtAR6;D0* z-Cr?Fh+6C1*sR~u^KZroX+eMNGq*gh$hs7pV3ynZ${ zdgZzKJBL{MZOXr0edm|hF|HBQW}bf1qG?o_E_Et~C*AfbeKa$v#GJS(2( zw4h!MbIq8EdxvI4Tqt~F`|+!_in-r!7hI>*G>=7J7T-(QQQP5{Dn8@NHfYn`rceF6 zrlTs9yX2U4J*`Ba&284N`H~oVZa~dfr#zRXS5!|4ogH*^eXC~Oyrz9xl46pc~J4_^_gwQE=xMrPq^@*LX{mSs+Im8HKdjQscFr|hHNV{?8S)StKM4+ zg&i5@UpMu^qLF-XCdQt!}A$W?QYQ`=45P zqWxW)B|}{LR&TodmTK+{zZp+8{YRNczwNWRh~=*9$LGDRa_OSo&Ei+E<&8bAwCGYV zBIMUJb47kW?QwMt)dnWib9SDgP>d5@hQ>tJiwc1s_FXefy%4O6CJfb*2yCDelnQ=F z8U2=?dLi1N#4yM1^qaO#D-{PMFZpl1IJU&cev@>iVh*5mx@L37LG3&sqZ*!KBWAhXEOgI5XLYpOSmW%#YO*sA)gX- zTb4P(NhFo-;j#5GH^n4xPCQHXfpC6%zFos;X zCkI^QPEY8J3N%M*}z4qup>`ARk{^-)^SO9+Y-i*i%LqzmD;{Wkd7-$42v*^T(*ph zN`#(cxr=;sTzMiFVGOybe091pC~MI-9T%>iVGm&pxoAhPQbBo3&#C-%KuWn$T_gx& z$W;<9N(H^?sgiFKt>f|(xyaX$i?m&-ApNAru~g$c9ap5tMHoXa(mttALoNzMSC@aE=`l~o zMdzjHA&encIk+el<;fGz$48In=(wtoal%6wLoUMWYRbi%IootxJ|Y)k47q4$woW&y zxI3QIaY^?=5yp^xms$VC`Kt}2X+;y}*||Db#w*GQ3zFos-J;iAjKnXCV7r{mfzauJ3r z7u`lmj+9M2tKQ%zvm&yK3QZ8xQ`v=X&TD4CrGbmaz$FAO0R}FU;DY8uFD$xuXq17= zQMgPnaJd7Q83ryd;o=Hg#^bEt3Of=`ZVPr?jd>-d6JL~|CJ_%|40Fs0E=mQZnVuQl ze%Ybpsv>d`#*nKTTy$ZzzTewJ$JJisB8(vywK%%4)YEtCwL3u~7hw#!Y8ZsITv+sn zF04r+7hw#!Y8r42m_O*ej%&HdMHoY_T8vA|jVzzIt2(YjA{Su{xoR7P)x6Zs6FRO3 zA{Su{x#}2jot)}^UB~r9dQK*VMRK%0rXhTkibRGGgsq*UHyL9ZG0bPY$(DV% z*nPS&rZK~ykzn!Je8(fi7(=IPlnQUW=~)mI0yU)A>&K@lek&DpdnH+6o7Rm{nF?Z< zHBltNpL|ZNICsVv)11jM$D5uj%ZeW~#( z6;fD57yCpQV_Gwe8gF{$^q;6P#!yM=G~van+vsi-OnX~~p*{~ie+|5VEH8+0g^#Xp z?B>_*u`$MtVbB#|z5kx8l1=1KJBFDkVv5~3{?J&CJHtpiA3D1OY*fMccrc8VKXZG8 z9yZ2!8pv7QID3yVrai+9!<(KK!^2k@V>-Y`R~Dt3`n)y9AnWxo-Huf^q0e3hm>VIZ zZyC$!$S_h_T*|xm$r#g#VQlcG=fmbIP}_p}Lp4IFpc+k2%K7jZV+^uYFV3@OSgkb1 zbYYm{Bm|Fp?5sD&n6B{A>4xLJp~%jH@$q38D-wdI#<^xD>Q^`T=ycWW?(vz%a(o%4 zDBcu8pY?~T8DqLL42^8agj?J@)5{p+$1p0q>FMQpc&9O@2YhsW{ztjJo*H9%GK{2$ zmi<~4GsYlzJvk4}*VHw}^kx`qyy+P;IoSlJ4}5g_T&Mm96M5K|VGs%S)EqlJ(>Sbt z2AJ0$8*MVipbLwz%5X7)@@t8BW6S`Ck#u#~gCTz!V+JyeWb4v5TA&dws2lzaQ$!5Q z-nzC4{RvDfPI^fvR{Y!-U-!#4vRCaV=2i8uvbLEN3voP^>6EqcU?$ z=mxq42aZ3s)!v3X_x zLW5Qi6U#7^Zt~eu%fdu`AHpzbAlZ|7YY8f4K{;^@(^SNatF+EUx{w`+54GUL{n>9a zGOVDS1OrTD@b5@yK};gUP;Y^JK16n_VvIpCBdk#Xs6n}`{AfadP@RB5<}x|k?l&K2 zEC;Fp3?D}e!kPUOpqK^YGn`@Q*1zJQViV6Gf(0=n7zPT;e2QInzhI0R$uM{EcEbPm zPul!2#*AW^@_5suo*n~JT`;WC@KGwhGX#9c$CDdL{-hy(*GE8}L z#^aF{pJt312Op)PBlMYU(0R+V8;mi@3=@DiiJE0q7SS&l)_8{Lh&MekK94{a#H7GS zsTf4gcz$HBK4XlT03W4-Y8k=O?;WjXjG4$Vk_~rWe`~cdW)j0t4v?Jk$<GukTZv+&W2P{SJ>K-(|GcA%F(w^8C=0w{ zT7_d(wJ?noGyOjQREDuad6C}V_V0`8=4BcE-9n>Aa72Aw4^BIQjXIFzN9J}bTF=he7(4C&t|C@enT97ej zA;Yvr`$cU^!>n~zjWNG6jHF|=iq|-5jDh+hU34!Xg*9Sc+y2IwMGQkX5L$zJ-+j;@ z#+bznvm5V1_l(Cv|A$I3q0g+KUVp!3TZhHL`a zsBLZbz>pNgEN7VGc$1FJ|J($bS`f2>Vd%DMicjLV4oE~n%u0qCh&R=XTT#8x9Vm!d z#W0=lCZEtvtxzNdF{>G-7MzQKy5ex+t1*UZ1n-9vx96I@e;H%eGE7axxiqM?=T|}z z3Wl|gVd$P|D$^6m?WY=J)-y~6yovkLrfFx4F);mz&vm>h?KKa^pa2VowUJ>Y+dHde zFBfAB%njr;!W+>RruHoYrh;-dGYoy1l;ZrtvFdGO%oc_re|m}?J#M0{+zKDvyhM7j z+kwV%P%VKui#Mg~>xbrl8)LRJjMUfKS9w=+W6TbQA-hY@=la!QJ`1L6Cwz3P6{~mp zoi@hoVi?jv;?9cL?P!e2WEdC=HXG}DV_v8+hH9U#e|YS#Oqij9@!7*L^j*=ypu#6d zz|a=N>}43T8{|`_b6i7X%sz%8U8X0oixnEif^zo52W<)po%%^JYdfOC6~r817}6rj zYyXPdp-QAB`fc1nhG~X3`Api}zlE`!LkvUV(6iOq=YlaN3qDH4E4;~$U0&(h*%)(} zVP@b>@v*p84Mx3SoR2UJ3Y*2J%<{Ft#+aiF<4H2`zhbvCsA>h}9Ag-=8U{pA;Rv#z9H=>L z6fouRCZCoamzijrE*fBb*VC=I1?5~~7`hvf^01>vgbAB)nPCdyO;6k(b4;|kSKy-O1W8grFl=x$68P^D)ag|R6ZA1Vca)!4OK!o(p9uh`G)%AMr-Ch1jl7VMq#M zZZHhpirWp;7UiNR#+aK7LwCLw1{L=pb-Xd=7Q@i(n4}vHRh2Nb1;aw~fH>0)mZbBw z`k2)>#@t~Tx+9a~d~aLq2V=}#hLLRV`}K!lLJEe3tVdW9W>Lr0Dr3w&hVjLl;%xTh zL^ET|eTF%KH?l}*@Uo@}+nd8MbnhVP*~6quChY2;43msEh4tuSMH79t2L_mGLIMJ( zbkXVCm|zg>Q9}Z|Pe5`I$c3I{DjxPoE(=AM1~O*15hmNfh213;%B7r^x$YZa$oI36 zOA#`@?2$ruFmh>WYq>;;LBbS**E-Q>&b{V;38@c2dxqLEmu_0A3NU4*N zOG_h{K1ME4MlR!xT;?0O>@jjVW#n?($mOMxOHr$WsiMeJFy0hLCJXB+V3x6$C|$h+=Q3*c*05Y#<8u$BJFC zH|#trqVk?|=G>WkcJBuN@BOf3bMEhZ&dl6tclKuX{4C4ES(cZwET3jse$BG%x@%?% z56rR@W?B4MmSeLljailp*>bV2^Ea^NF>QH(Ew^gR%WMg2%U5iv)Rvui@>`-Uu;Du$ zRoVg@w$pK(wnW(C)|M05a+kI=vt^~WoWqud+OnK2=V;3#YTHDk5$^T zA6stGmSVQtp)Cov9HT9DY?-btm$Bt&ZMl;zM{3LSY&k+(K4Z%`ZTXumEvwivR$Ja-OQW{@#+GT?l8=)=ID*=e zWXnu#X<}@wPhn)nzZE?wzO+Y zcbH47!y562vSpsujAP50+A@bNXKTwcww$Xicd+GrZCS&XrP}g7TdvoZU)f@E+8b{| z;HcM{fo!SOmZR8Gqb(EJGDBPH*^<_l#cZk8mK)e|v$m{e%T3zy23yu@%U5iv)0Xad zgF%N?st09Rj>xi%%d(u5WjQO$a!r=y3AW7A>3NSWv$bU_TNY@`{=A@ay0*C4vPN4@ zW{bHx=d)#r*4&zNo*<7mQ&bLs4dsB;csbS0A+Omi(qqXH0wiIj2lWbX}E#I)E zO=Tb8rM)VeiUmQS-R|FGpo?PqUXT7%;ZZ8?T5 zPixC@Y`H;OPGO6QeqoknWtQdTEX((7xlMcCb$^wf+qLCzwwPF{EK7ZsrJXGoX+Nvk z@|3o`$ChSo`7O&&uK_AOCi)>+mj7f~=Cb8E?fG)HT%|1!v1P8dyvLTu!J=CCHnxn> zn!X39^qi$FC2X0mE#+)kr!Di?a;3JcV9RCN@&sF+)s}bIa*DQWWy_t~vTuH7`IKZ? zCa`6Wrdrr?sG9q8i28fE&h z%YU_H3R_;%mN{(sR9hCY0o9s0KElqPXEU>+t-2yu$ z!+wKyOF=9#+WP%@c+=Gdmf|sNdd#wnEM&_{Z5hRug_fmoBwNn0EJc=Om1P+YH?$eeMwjfS9)qZALmXU>w&C?bur{`Lh z(N=oSw=AQqG%wW_EAQ7^mLjVR>n+R3LdI$>i{+Sh`==C+9L4ELTN+)?xY$P;D}kq3eY;#aJ-S%Y+5fe1))JnwJX;rWvoN@iQ8J!**jV zSkU(h3#R#DVZk&%ZnqR+nx7UHEa&I!7EH416}yFM0$OLoi>`7ZdY%KXHSnVPQ;6vq z#}?91jRFH{6oo0oV+p*Z=0eM&>+=fBqFd8RmZg}|yc2w{B3LN;NG!31@Is67j5%#% z4Ozxmtw3u=V|x5~>bsZ859JhV)OyQLAr=RISB(cy;i&0$vnrl+`LXSQabm z^vxbhg9IKJfh@W=zRt2>q0;dL{7)L{pTqFmCGaw7#>os?lplCQpGRs7C2*)+L!L2} zT0<#Bv$jw>J=$)e=%c{03|=NWPVLZQq916tQ1k-3g`yv9w@~y$?G}nY%xa0Ssqni4GW$#%3Q-w|zTs82Y}ZlTh^I*%Gf!5de| zZlRpwNUk;b#&xINLV5VmZlO$UwOc5KeIf7K5A|aw2n*(GuCUX#8rkTM9829`oVFwT^y=Cp#_67^{X~X<4XG zK-p!MWwfQi&ykfM%QMynvQUkJUufi08qC)`c%2F_)e7JZ{hb(ENJDN0!*AMxkZZWz zf`vif^rSUZ>u}bjEm#<^f^M@=txE_CUcqC91@m>Hu;3M}78cAH&WLm@DvVjeVrBkX zu$sKXFRp8}#VWDo+Je)9uc0@76D+DNW3}54t{_^JAMBEL>uS@C#n%0rT{9N*^}euR z62B4_%oqOkul76^)BLBfU{>Ap|A)VSgIAtwIPRTZK?c|7XrWy)^5ET|Ew{gKsQZ{AjmsYE3!?fc7p~{`-)HV) zI@VK6kw(P&QpBpc^o8pU^)6GS5wX4^swc->>uV8fQuF8M8)}aN z<%~2U);C0T<5)M|_U@L2I@Tdfkw(P&R>a!!kbjY(B21A+#QH8P);T&>4O65Mu{MiX zM=fY-Gt^?HNF!o>uPJ!rdiB9~u34pH-OdzgM64e)l?U&zZW!u$rbr`V{YVtn4Wxd) zYWM&{ea#eUM692P+Ks7&KlSTks9gqu84l8jSU-bR?eKuHPI%$(;|+BvQ=}2Gej!T7 z^8Yj3P*J8xBVzqZ6xKtG_56T;rW>k`Dbk2oTSTn$3p}>cSi%%(M6CZ2W!1x?Z@Qdy zi@shfnIesd^_z&bXyDa18|uGIkw(P&oha*iee&0UL5BK~Dbk2oe~4H!^AEqyP`w7j zNjOL&Vr>PhxnA+RUal}y5mTfQvHm2=x?XSI^@7V#6PY57h_#Ih=L-oL$9XwDYVs#?QidES2-d7AYj49HH zSUZVWC!F(ct)Ze!kw(PIBg$%DU!|_?ZKztNNF!o(7O}qZUvjje7BNK{5vz-ih1tG! ze)9W=_4T@$Dbk2oT}7-f4|^(LsArfWjfk}~QCNm}B>!0!_vl!kGDR8@tDA_0b;D5I zhA3a85wUh53fnRsi+q(^ygJq}rbr`Vbr-RoY=6JMp~f>s8WC$(qO3ZPWq6;CHHRtE zh*-OcSQS%VI@nNGGDR8@Yxk^tjn%OpWr{Q+)*d3(pz|I&(@>uh*)^HY5pn!=TYbC zeC>w|DR7WR#M(>5dhGh|UNzKFOp!*!+FMiT73VhR>sV8mB8`aEPg7Wiv!3|z8$-=y ziZmkDK15k%xZ;hP!whv9Q=}2G_7$<>LI2`BVzR@%IXiVnzSlqs5hA+jfl0M zh~?eme?J=PSEfiKV(m{_)=Yly@x6*X+*36BG&3x(wz)d%oJ%vtOGQK ze%od&oOHd8HHj(Gh*oTTDBVrvSVkJwb zj55?cOp!*!8c38iRzALL@ymwVz!YgjtO611=i5HWH`FIgkw(NCM3hxGZhULEC5GC@ z6lp}P!6McRT|en>sJ@4(t4taZ>tG!V6)nZ1POQ~scsNs}5wV7dSQou@=m0~dm?Djc zbqG;b`+DSmTSpkGi7C>ESci&Oy^i_j2tzGniZmkDP!X&D&4;!c>OrPRBVyqiqM1ki zmYn&Cp*Au_8WC$)2eJNOiZmkDa1ra$jtQ=}2GMv7Pio~-C^sCi70M#L%&)+iC{_mBU$&rn}6MH&&SSW{TWI0vZFb-w#>w7FcQ5wS*V3j3%>%R`h^hR3}h+{IA0GDR8@%PV4C_UV+z4D}pSq!F=vL|J8sbGDmx z8GgeQX+$i)i1pY-N7%$2ycL(ui0=5o^mQcexD}Wr{Q+ zR!CErn&tC49kf=*n#mMtM69r;uq}HQP8?&XMNE-K#EKBrQ)S!r*QB@3sME1lFhv>> zt4zfD^Y|4$L%qxtX+*3jQC2_SeEWO*8tQkZNF!p!M6BKWjCsyb192f64$_ENaS^NY zTd%bmD#;XSM685}HM4o@o`yP=Dbk2oNusa}vE=u<_kVvH>Q<&mBVwgQtZ#mOsEeWA zV2U&%)_;hy>ilaZ&-R$Duh({_NF!p66R`@%o&lSJb-{vzV=ylL!$BGmYrKfH`%Zs< zv_?}grbr`VO%SnuesJF5hB})m(ui0SiNZ3(WBxTqc$er{PcTIq5$jkH>!I}4*@oK0 z6lp}PNkr-XaP?`w8)_%~*aHsIh**PS zOp!*!svrvM1|I)>Ij!;n9cw02q!F>Ei&)tA8tP)ENF!oZY6@fFoNa}UwVEl?h*(vc z!rtcP$mV|x^&wNF5wX%lS#!1?hkkSHNjlbcrbr`VRf|}!47>kULmj{$Pm)H&nn6?_ z%oH5!*Zef-avkd!rbr`V)reS?UAEL1s){Mnh*-6n!dMF`CvRD=V=ZQiG$PhXn!+-? zeb3KNHq<>#kw(OtNt88yt?XJg(NJ$PMH&&SPQ>!OuyzkaZDWcwB38YKb-_)Owi)Um z_=Fb^(ui0MB34PyN#hL_VTv>&RwGeXzY*B_z;lLbVu~~(R+EVJ`=qvYhPs?7(ui0m z6NPmH-nf=G-?Z@xeZ8J!iZmitvxxQ1&%d8(s85(8jfmBvDJ(5qXWO7-<^h*(Ka=t4t1#}sKqthq#4ZTYV8D;~X0$NGgS(ui26h*%E~9UnJT z|FL*A;CWEgh*+l*W#tR!^H1nlKBh<`Vx1;pJr^Ewtf4BIB8`Z3x`>5yn_?a7ET%{! zVx1vkm28~4uc1~jMH&(7Oif|Ff4{%q7tiQeYndXAh&4}BSPvgc?%u~xUo%A-5orzHPjyT%nQt}P$OcUC1NdlKCg?RMl(ek5o-ZaST``%k)bue8R|r)NF!n` z6tV8_{m4K=ox>DqM69!kvhwxi@xOm*sFh5SM#MTt#QJsR@!buzktx!MSc^oy2EBC0 zeTMpnDbk2o=ZaWIU32+ah8lbX6c8Mw5wR8%W%a!${;}yQLnW9Zjfi!gh;?cE!9N*l z7E`1VvD!tfnFA+0Zm8uSCryBVt`il)Y};rei(E6lp}Pt3<2`HMg8>s85(8jfizMQPvy)KVQCG z$Le~tDnrtUSl5VH=YH^GA43%~MH&(7TB5A$g`a<2q+^}H6lp}PwKZ#qsQ&q?J6DXc&11rV%;HP?eT2yTMadjDbk2ocM_Ekad5uz%G9y%80u!G zNF!q1C1O=qyu8RzFEK?L5$kRdYseed9b~9qnIesdwNk{IKl$+=4YjWu5)B7wM67#= zvg-Vrdl!CWD36;U7imPSdqu1vTYm5us)i}jh*=F-_t54Xcm&;W8bom?_eT zSdVK8%W(azuPigvWTr?XVm(2WHJ|sko%fTWPGO2PBG!{4)*(BuJk?OknIesd^%PP0 zkUC7^ieJy!V5p~=B8`Z(M#L&k4z=a$OQuL8Vyz|0YG2QOzx8PotGf@v!$BGm>uC{d z_xfQ+7-~3Eq!F>!5oMKO5e@Va5f z*<%fL6;q@UvDS-N(@$8o#!yc&MH&%nLkF=wXNoi;)^j3O-1AA)#M;G=5wTtsvGBQNLlrYc8WHO?qO7^ih-VHiyH>}V!W3yltk*@XblFvZ8fqR> zq!F>+5U~~x*{|m{I@V20kw(ONQ^eZ*$F@>KJ;xMjM69<&tS?)hSg>5j`i?2mh*%p% ztS3J%`oK`VgR107BVxU+W5FBOhMIFWzpZ19Wr{Q+);l8By(8Z0XQ&gHB8`akE>Tt= zRsF)&E{2-V6lp}P_e8As&${<>L*2?0X+*5|iL%=A)c4N1!B8(VMH&(70}*TQdl&z0 zs9%{PjfnLjQPzDWeopj>F2j97s^m!{VtpiH`Om)SIzx?MiZmkD$2wo|##MLrSx>*D zV+ENajfk~L#5(HjEABVcOr}U9VtqoCJzt;dSWB5AjfnNBh=utw)GbVrM#TDzD7;?q z#MHJ=>5A1tC(y_cukw(P&TEu#6OWxjws$z;XBGxyW!dL?$>HIf!Ec^yK zJV+yAeXA)P&5vAh;b=o$&lG7ytnY}zz89&Lf1LE7p;j|R8WC%=h}Agzh{cB5$P{Tr ztnWpviyC|z4D}0Bq!F=x5V1b!{L6Mj?Gb@Q!$BGm>qnxjKI*d>_uX%(LzyCti1m|* zb>oBS-i8V?MH&(7XQHe=YQzsW2MslyDbk2ozld1HyKj2TP-iej8WHPP5$o;nhNXtO ziYd~FSX)G_%l7CVGStINkw(P&pN@rPjCKA6T@PPpiZmkDZz9&5Ie#Y%^#fC+5wU*P z6vo1Py#^g?mol`$r!1%uvHs8$)?Uxb8zvZPC{v^nv9=Or^&1l(dF|(@5o?=>wRphn%J+4w#Y~Y##QICbdit8W!whvBQ=}2G{wB)m=W)&a zJsoR3Q=}2G{t>bEkDc1nQ25VK?bjbe&4BGyit!n!d&5-c>-1g1zMV&xHK)s0WD8T;aE zI#vr)q!Fkw(PoDq{UO@ZyUN^(0fI z5wUhA%Ic%u`E1HoL%qWkX+*4UBG%2%pZ$)Zeqo9Oqusy$%iCQ*Ws2m?Djc z)l6%NvfSbapSNt1j2XsE$Vkw(Pot10w4_?F54eM`p*GesH^YcEaVRo-vb z{#^}K#}sKqti6dU00OCv&)01;)KaEMBVzRvvD$b2_B=y9$P{TrtbIhRTQ_X}&`|F( zMH&%nUlD7k**{%qsDGFujfmBsD67uzGWgp(Lk&zoR^cFxh_#=H_1EX$9A~I7Q=}2G z_9x1!8$WjW{Mr}w^{QuzG$Pgj5v%)~{!aojdaAmd%_BGUGrcfiP!-%qGjIpoJgRFyzj?>Sm@;BdOs;S^0|m*1p0}&oG4=NgYnqo}8x1bFa9}P~S3z8cB^H z%8E64!HCNZ)oYw`h8jtY6x8j9UjLn;Ml*#PNfi>c3#ag|vZ5;uHI*sUNUDe^s}*z| zxD94gV4`C-Q>c;DD59*D(w|4)*kGuOm_m)Diiz5Xy+8Qr6Neh=1Ex?TsnJC3#gs4d zVlPAGk5^{YNNNmGJ2SPcLc>ORs&%P_vjq4g7=SDzJPFKUK@M zx6=~xW0lX*r>w8F82B~__JbN3{RpCVC*LlYJNe$JhT6;&Y9w_eQC8c@?;r1Ks6G>v zGt@}xD53^(tggEr`?sNvVG1>pI-02dOa;%If1IICV+u8rI)+Sh(+<1IP{%Tb8cBJH z8phPH>yB7psHIGyMp8ba4q|HCOUD%&>UpM6BPl;okQq9(Q$8c9WnvU;t_!%l@KC&5I=CZTL!u-1%2Sy~q@5B$X1>_@zB;J;2XQp+-{wA!=_<;qwO{bBBr5Z?ZC@ zMpEO5%4e$O=)fL^iZO*6NsSk=PMB5<)dWm*%wq~QlA1u2RS#>X_FrYF2bn^Rq$U!z z7kl5Y$CrZ*^&wNJk<_sw)|3_VPdC)gP@Z_8MpBcA%BQoi3fj~YI#e*xF@h=7NNO@s z*4()H=3Q;QXcbeak<@WS!PJe8kNS4`$;7&nDbz^nc%rN^<^9p)uQSvOOrb_nQ;4!g zhl7guJKRt^9j{V=8c9tR)R*IK@fxaxDbz^n1fr~Z_+i7H=NPJqDbz^nM53%w@0~-2 zz`zbBI<933HIgbP%IX0UU2ePHP_HtD8c9tf>LB*M|95}AYp9*4C^Kp#RY4Rq4?5nt zX8->gs+1|zNNPG!)|j&5wxcdLR0UJ0kyIs7R^J=^@E8i}$-y;GXLw6*0Am_m)DnuxMm|b^I);_2pQw@4Y@)2W z&9oo)8Dl6PQ>c;D9HOjo`5t%YPYqSW6lx?jmnfJb(-EvVd6uD;F@+jQokG<9Ol?|q z+u4SClqu9m>Qthv6khY>a@#7zw@jf%Ql|-OuzTWrCf1(QR1#1lsndzFTIKmyZM(ow zM>B;QNu42L^?mZc2Nh*tkL1XTlas_P){?3 z8cEG3%F5Rn!yg@MsE?UKjik;Z${HQsI=1u!L+w_f5{?>4Eg-6|I_)YNb>Xvy@-u}R zNi8I5U#2EswedMawK0VnNu5oUHNt-Kz{pPwbr(~pk<>Xv9muh!l+@Vz!`GNXjieS4 zW#wzepP$+00DYz_XQ+|XxkOo4xyS#8jW8(;FohaPEhY*s5*>SAdfYpPYGDdBk~)tl z>yCcSpF?bQ<8G!ww$8EP-MKf(hwl3GHP zRT`f*Zk}YQqnJXCq%I)JD*4O5JU3*hlbAw{q?Qt8)u_M1uh{POu4W1~lDd#6D}_Be z|2f>mdYviMNa`Y@tQ4*rvTe4Z{$UC=l3GTTReOK9viIMHI=o7iA!;Obv7k2Wd9dxy zcLGzWk<=wbSt*<|;hAepthr2~MpBoGSYJJK!jp!&lPT0l>M{}Q?&j9F4fQHhsFBp= zL|HZJ!N|mc;D)kInC>#ZMuhH)QEbZle_HIll9s6ni|>+~76k*IsMGNVRP*Aiu= z@WrJMeQ#oUnL>@EmJ?;oduxw)d4-{xnL>@Et|Q8tvyHDm$ySEfGld#ST~AaY=j+j3 z&b`6JTFVq_By|H();hq?HO+l8;PLx)Ieh}$wsD(_SMp8EuWwpvlql(Tm)cs7MMpCzkSd&K1UuCEdnL>@E zZYAm@E?jy=d;ppfkhZ<@PQ>c;D{Y1e4NykM;|N4NTzF-P9l6rtBtIjV> zthdEFS3ZhOntDq zt*fE#WePQtdW0ye-$*oX9BHVpm_m)DRtf6C4S1&pCOUSXseYnHQjZcfm~~%liM^3A6QpDR=DxQ3lslM0jieqY%IX2SuY6*qiM5$2 z)JWY9#d(QP%8h?HexWIl)B7 zxlEx(Qfr8^QuzKQ_Y5)AT}+`yQfrAC$ljlSWN^Yz?=yuONj*)}E=(Q%NdGeo)u&#W zQ6s5!g4+D~=!u33F@+jQJwsG6$J+DEGa<2HqT>{%P$Q{liGqqwM`-@n&4#*{Dbz@6 zJyAoMdVk20h@rk@3N@12AYvs_2mE2E{Tq}s)JW<%qO97x_jOnN$58MPF&(Ip)bm7H z{o#wfQpX$W9HvkssTYWXn}0gKm~+j^hPsm})JW<@qO7_Rd^>C#m%nBTHIjOXD696~ zv2{y#6YHQxl>*dA>Sdy=e&fJid2kWHL`Q@v)JW5t6J+?%BRn5O_w(|SEZZFtJ1CM%GSna zS7~Xv&s{zu;f_aw0Z%;Sb+zG6;!b#ujx`gB8UIecI2jMf^hOSu!CXgr!sft%Kf*0z@N=Jd&J z>6TWl@Os?=Uosp{`F!q{wx*`W=GJso`Hbeqwx$*%3c6FCs3(vLgP+dJI; zYi%{c>GIavddOx)y-9#K;ts`qsZb!5a97sVVrdCrZj-HiBW{1v8w&e_VXOReYRAN* za3RZrL3dL{RaI@n44p(M{Xonc@P~cwCMd6#nu=yf<;?V4t%$kHLJ4oon~1rgQ0nHE z;{#p#tk>@j#8PGPvY7qaKxJrw!ZC$DI#L!5`2*3QyRxxyX00t3P^^(MUnCZDH?_>f zz~$*Vl{FO&Gt%Ytja6ym0?H;CEDHpEe!ttE(TcX#8ob7}Hf`J;4aEH^PcrOotgR}q zuB~f@6q!T^+@WwNnF_{|?xx0;)^dnf1zDd76$ZQ+UDO>9q=M0aKjv7c=;CN~Nieiq6JE# zyd_=PoHlhkjGN_WtxJ?LcHxLhu^TZqx zuR9z_d83hppOJuPTOOq2HFSa16>W8`+_wIqDqruOkbgYY?u5 zLOK_x1kBNeK(eYgbYYhc6&`9!Wlec&#q_$gWvXn0E}D91wsS9ElJa|@f zh@F?3lDIb+DGU3c)0LY-EYZt~co|^MrkI>zoZ69rngjz94joa|(-# zN0#Vv92JYjWBx=m;hr;U)L6G3d{0R?H)1P--Uo)qblO#3Ue{Pz0adxRs9zN!x{6lpIm$VVK2hIPtHN26 z05mj1Qz@Tb+fdOw*9fc1Ya6N?LEKnh-U@?{JX70h|D7_RJz^VdZELa%D(e~>gohc> z;;ITcXFDcyws$g9E7q=6 zKai_*^jTX8u}zkWF~X3M=^Q&G97itm} zICVZ*n#!7Vr5fhjS}I^MIEO$FSU8mCP(m#*6;LNaRKu#8dbmb585*F0L7kuxP=`l5 zme{O{x;B$2vq`j_X_7L<-QBGqu>e;e5NXP39gUv_pvL!W)&CHIGoUp_WVy!s$6! zqSzj@PLm6|%c^K-#U2)VWYcQ(1ylE76;;?((R@mz17qNfdq#6bJv6?`nJ{}70*YcL zuuhp2d8w>`HYhw`2+nDST~)NY#tM14tYT@Ym?b??AY1)59l6de&TEPs=J_Hr`;k$V z5$>PxZVRULPN6Hx;ohOPA=??%E?~3Iz-@;xVrkU0lxLbLI^Lo<)f4CypkIUw1OupW zMwC8lADnc7U?)>w+W=@Q+!<%nG;wn%NS^Uo9jNw)lf;^emKvC#I-aBHsr?LP8190y z`XX$VP!cT-wZan@kYkDRxk{(&z~`zO%4=X=BU8uca(6?SiJ*e5sB3D_x8Bkrrd^yC zSs)s3{mbiT)~ZgwT;FtME2)K&9PjgCkp%CMxDv{+Mu|Dn&V@@%n$h8cL2IpAOMo67 z?mmQ=Qi{tbd`s%nnq+RtVJGN;K@E~^%>li zW(!oukZ!l{gIpEzGVf z(+-`K)HT7hs4+uDv!Eszsxy0YtQ=|(!+BI@ZNRg(?iFwKXl@RTU*su6mvzpmz97T5 z_AsWwOaUr+7KqmvhEPk`R53Sea6msOgKEj{a;enFp4llQ?=%|eAxeBFN^Q%+;;eF=>#SncZGT2@u0Y3AxGGbR zi#Lv$hgEi*I$<7K8#|QLR5j<6;B=FV5o(tjphd=L{DbO7SEjZyYto7pkOqh*S@~`D ztO^RN2~cNwT&b0nw;nrAK8LkjBt}(xTq;sBaT2FPbW_ZOTfNhOsMaX4|H^2~YSn;F z3$NHfaaBZtW);Z61@#q`O=@XZ51cuK%B;!&mH;)B6R7=z^*gXwFS1~bA(f3y^2QWP3zuHZXEAX5 z3|(D$q2NttmNh(K&j5+9N!Qgi!ca_~=m{2U1l@THtLji-?m%l8u+;8w7AGK%r`3uc zO;8-qTiLaOI2VRGi%pk4+Y<@E{t%|8JadD_kU4w7Gv(EAzh38Xl4kvC832j|3Lwk3 z`VdO>&rqY%&>^;z>rxhST4b|La-61XP(5K51S4F=QVERNFjnDIAZw)I>XK#0t6ya6 zo^y>unYvt~k?LA`gv{#bRiB*eEY?mlGEwnVHrF=E;mp@Q|qT3o)i&)S86Gip9R&ruX~FPk|WsxovuMMcCn^;TmM zfvvWH&9KJl?w2UcE8#k)>nrP<=(9W&!RK|2O>OYW34A=SuREN;88v>U3m-6% z);^Zu>C98soB?}H>!i&MdErU2@*M8Okrc~*VBJhI>2Okci9lF9#HFoHVL=LVf(bgE?;6~hC1);06+cEpK>@? z4=GW($;ylr<)|c5#O0D%wo;@#$@T&HlA_#Mvp1NGqCpq-mgblxJKuqzgRIy+IA%i$ z9I{|d4e5r?;nK+S9XPNj!CnZKgPbYgTP>#^RiAQ*o8u!ahb-h$I+bTGty2xjrB#0A z959zw`TciV#Zd(r(Pvf;o!vnVWmS_#AydSYdOd%84e-`SG?>Bi)H+0 zLQbw6L{2r)LFQB$9b``R$U&yO$*SZaQ{H6f>a25c z$R(Qbq=|#a9KxI~_46k=eHn$i)N;j2#WNaJYdY5CuFjc$oT|Lh4BK9OZ)JzcO(XA*w+&?6%J0U zu~>dssFGxN<*ajXh@F604x^`(94fby%E4L2V@r-7PiAX&?8s?I%J8EfB(ax*(uhZ; z95Uym;xt*$oYey>1ATL8(&uwv*GOf1Kpr^sC zl>_@DU$)Z7t;vpx&tGLnCF_o&+EC|*k>E+SOh;%KPbDyR<{A6N&OB$o#F^(5H;O7r<~hYVpHtlE4mjs?iW}1b=X_3aV>{rS z&)Ety^N~B-mB>29n7wzv6?F4JD8n5HY>{O(vOm(3U5&&8J=W=rhx}|QN7tEWGa{SQ zP8B%wtPQqmc4mU5-3F);Nj^|$ORM8)8!kUURkaUGK-yJJ7(q2bo>7F;8O4mu$vBnr2!|7jD9%MVoKVE*T!h03`}M%*HF<#vv&D~j z+OBBk!@icn=0we`Y=7jz4}{vhMlf%^>IFv!&%pwH3~I*rg6O4{?`{giVY(*fPiME^(LWXO8t2A^exy))NZ3 z1!~(RYrne@zCL zW55LLRu&A#eTk4eK!39RZ{m$f_(G|&K-}w2&TgP|>7@9B?lNClC=g18+>~CmOQ0&G zw$kFN#&k<*aYJKkX)$eXg|yqHGiBe{${2C~8@bz6-0e*zB9RDOI3N9GLm2-)Nv8r% z$NhmY><;K2PdCc)H0*+w4EbP3s$k4bXU3&lo9B+p-mcIW4}`->*d!{Eo;_aeMK&R0 zL$!b#HiPp-;{GHQAZ_86t_t8bZF1v0*vZbH45U(tq}yjc6VwTY6#1i}R6LZ5af+kq zxdGll(Fm_L*Xq~Z~~m#l>Q+_2YH%%6 zOJ?uBl)Eeu^M=Yiaks5blgRC|-IUpDG;h`Bh4Kjn%3vEz*entMR=c#=2B=bqjF^LE zF`^KEltApOFAq|6L zX>kqB9<@gw)Ty91>W?Sg70`q#Ask*J=-#l)fsP#hYnxtL!gCjhR9#W4X{bE0xF_HX zd!lapfQ`zMwl?=1r8r zuALKVpg$ZxK2}-`X@cjp+L~$C4dn#}{*mBNM+6SGY>OqzQsEtgg*Fg&rwse!-b5&v zv-998CF=9h0>UxLT+=*q$#C zjwGTUcSB=o@wh~&v>1lQS+%fHq|rp&sc0||2_!w@ItNdIP8m0k2$`AWPLhlBeS#Yrn^*N{tA=uf| z=Sjh~wA6u6eU4DQu-Ex9QRo^y385@ijuR)iutBs@(_;MEy-WjTA;v|J;&0C*pnHR2IIOK(k=d-z^yBg>PaJE z7q}6+SOZ02+f8pM7=WE5!`WK>hu|83zBmM1&z2fRJerbSM@K?ex{Stfr;-dTyO17$8z*(L^Lr7GO1$5KfJ#>xT|k zclH{As^<&(U|4}ZM+NW%JTUXMeJlf+vp9qKU^C#bFC2l%(K!45KUU+TPHQ@p4ed>& zxg<{g%e+zO7;)tQikpWzt$_YD0v)V3?uo#*$MnEFb{g1cRG1!iOe*RR!+>G0(YOes z-HZu`g9+%aY}HeohrSjPl1zo6j$tBUO3H(AaKxxNr6b@M?5$~R#=@>@Q@dAVl64Rm zwgT~J+y~u=o9-UfNSv|pEY@A{V5k6W${S4va2Hj)c~wy6X1GKd2Bv1I0Pb831qTq0 zyn2^h8P70LXrw_e1cDukGZ`69GcZw&M5BptG~&_C6*i_&tF%UygegCC`F@x&+B;Zv z&ujbC)(~ZG*o!>~q(V;{(2K!O1=S(b>z^-k7!8wh`w1H*1cptw68DGP@EFi6{$ZFEZEt}z(!LB9ew zR5~c`T*8Aml?qIN*uUnA65b$8J3=0qc~@&IjO<xd5=)QygNGKSFyK1cF*weScU!tq5ny3jF+dTe=4~pB?8nXUwT>~k1 zD&`CLB6u%kjr)!X0HH5j7Q>rTlT<85n6hQu29~*D-5?fL_9OjRkOTvmMOoMnw<1)kJVB=+CI=9Og}Fq+QwH|~ z<}#>S(h(MM!_MRZKTamBtYQaY+j7g~0B&&0U=HU~-4fpobmSbS_{m@hZtDX2F2?%E z(|Gl`l+?_dJM1-ZGdG=DsPH~-I2j7VM2@!l zg~m|}?UH7(EwFG76ImYkGy{z*2m?6mcn{Mn>WVN2s>3t)AMg&Y3Ur5>gS5fYN-7zP zmD!3hD{DrNtChYoPZYjO#9VmpU95|x)v%@=^(B+gy{eHsO91!C@clEMNHiF6x6H1E zuRNe6;|!a+2>mcB#J}4%>qUQm{UkgbB3|HZP+O z6JSyci=vQTTIADLUqkS1Jc%US5(eOs>N{Kbu)!vXL_^Sn!dJK?^*yXz0BiNhu(!+` z^W%5Cn579&eSJy@(G{#1cKp!t^D9m@nI_%ErPWk_*xZzJQ@k25BO9C`zgGZZ8#TzyZcO2 z?JTxvA5iVe0{#Si{ffCzs+ME~gN6m)n~@5{;hxyKqDBbewM*zz1HmYKaS(J@*-H2n zl)j~iHsR6?+ymhaU=sRmcPibCJ96m}y|iR{1uc1~DKjkWY7ClKw9F6FU$`PxD7X)# zRU6v~b;M_?yLGID#)OvvssE7fhrgK4<_? zpUm`s2NZl(6iB9Gu)-8{Ps9sotwfdJn23L4Xm?J!8SSGX#tR@qovhij=u&TCVOOOnFbiu&NI)Ew?I zpxj~fp?hh_9{vFtSj=Z%Fj&TY&JgVX11mEX@ zAh_9=&I0rbfw%`s3nsk~*$bN7mk0NzGbG&ABw(sg2EFqR7#Q5#uwPiD9v*z~LSHBL z4x`Q2T-^^JJ+>s@c8nY|wxneAh!JCiH9vpkh!LYlkIv68fzwJpt$Wouhq;zsckfBB zz<0-9;Zn!&Dp;&)g}=w+<8b)7rK|ND|Loq=HJtW+E*Ni}c^uvh+}Zj~{dBu}dWSdT zI>woaVqYJ#8bgLll!Mj18F`;ne z%E$X~?r+e%vj@p?`m2M}-FvuPv*3k?PTw3^&hU-MuJc$!Lio?!6Uvz$;IS-F9`JTK z=J4#;|G*dHm4*5L=H0NaM z9P)b;XjWzF9QRCbNbd!hgBSuL*Rg z?Z6+_m#aXtGE?V}zL!ArPNps+edzBu&~)#uQrA&_hk#~Orq03NIM7sQ>KxLy5HuHN z>Ky#71kKZ#ItPE7K(jeh=ismVo-Wq_c;V4eevbl8I8&G559>=cXl7;V9MX3QXs*xH zW%$GH@k!QT`tZnAU)F=}^&R-b>-!UEI^!ESu;0z)Zx7Jy%Q{^y8R^4*Xe?{cA0D~< z`9YV;^k@4LTx6#~f*LaXxu8#nvF~s{e3CgaHX#=A9&r%-=ZjA`NE%_^r*RID&DnDrDyb}(j$6P=?T55vBc!@{%HAxoC{Vi(UF>ytcBrv8A!PHGjysL-O${N!Xem7DMuV@CgDun9&T^ zBz*Sst%r{fFW8(PZhtqtU~RvzAsepnlJ*PX2fbh24azCp{-Qdu;F>#(BZ*E@Hn z|JA#p@cVvbD|+3t3Yl-?cavme}?q*SlEgY7d#4IHtlltSXfQJZ9AyPSySO1C8Pb1v)A-EI|9FYdOQ;B zS-tkTZn4FW7vK!V-{X-#B1=LCg^zrv$JzUWqVVF~^V=6Kq>hVwo; zGOxA&KTps5bEoF7W91!E&ij_n*?>@OG*Z+`_1Lp-anx+0#BrKMBddce`HYqxLj zarQ#6n$QI14&}PDCf8RQ6 z-swAaYCAaGek~S-x?)4u&FK<8a{U>5X=f^<-|h93Yw7mwmKD5rSw)5=Qwyd=+NZc9 z?K8uX_Rl;gdQR|6EkAKx7+f9(ug%+Zt;R^$Raa_KTmrrnP6F-QCTz z_Umq*1)F+!)^6$=S@37)=0vz1E=G7spJ%~?%hSFleB`UmC7wsobEN$Z%I(=}+73H+ zIff{DzI|%Jj~A{bK<%= zz~sZLGtGJTrFWdGI?PpTLBC1dWFqZ9dD@?cx~tr`{}G0ox$t^G{Ozf3f%X?X^FMJx zdOY*Dx~92Yt@)nz7nB7I^T5!<)Bf}zR2+>xNL#IE{--XO7YZJ8!vE^sqwo$JduP`M{Z6!PXxSbto@rRMAWv{{-i<7&foA?w4BPnD z$Of9-Q&Yz#ZJK%lev2KsuE(Nd(A>T*GIULN!5`4_hr{obulDD#<@bkQdpx`dN(~z3 zv7KX!Z=$xZ8eMGWra9sEg$1kNtfxJ8RL{lTJnfy2THH0%#4CMXW|f;cfy+tX-Xl3%PweL|?QNInzBP`$1Q<7E@CVy-_6ZrRv4O zp4SRdu5i&amKSfdpvu2pl|SUM+_Ej1P>>&PrxTu4`2cQz6;8W5>=jhg41uUb8E=mr&@FuA+S7Im4_yoI;d-rY9=IBc6t3cnhhB^|_FVd3 zwLIu=%4wXWUyGo&gJB)^ttw4Z;GJr0o%(ch^{Il_gq>Y|Ms;=dDeTzrDKQk3#sVJg9f*!AG_OyY1xa_Kcb^S_Ga| zy501|2Gm(u`$m@@7)6a)~}^pi>Yl zB{PxyW|Zirp0Dn)#wyWrrtwD+snLUahh>I!0&ySE^#9}={T^&9Q77Ls{y%-A-@p!h*Z+U|M!(B;;JfAj(>MCPZU?^SvTyhS zhjkt0HBn`WS5#d`^tpBie$NDTo~u*$om|}uyJBZRt7Z5Tk5TYa?Nq(PdUH0}_SvVi ztNW-uT-}#-Z32VK4KIv53|@Kga=G58|J8rkGbumn9r|e}Tc_^mrz=J$KXnSA{|_St z=25*v>LRiY+_}2%!TUb7Z{-`oWdBz`+4SI^TTb8ehr_>Iz5KI&oBIBK?JIW=oB!RX zP5+Jk{MhPmL+S0uJp0nkUo6_M{^r6b9{HlIqTBKJ?meWwe$GCN7oKonpW^p_{^aU6 zZuxoR$PXUd^UL+OFIaQfzJDIQ$~A1|%Hq!tcxmQ**N3stQ9~{+KjfZX?;m~iQ~u~F zQ-=k7zPy?ZlP+)n`0ZuwcfWey0|(@HUVh}NGiDqcn6>$_mZN(wzu~t(-kx&t_|11d z;(ul1+|Ku1o_FhI7fet8miOH=v5|WYp8MQ?yy@RQ_nb3e+~k&lJW`Gx})>DJ*?kP{BNfN?^^KT1^w1M zH|f-+=cNDhzy~MwTJ}Mx{rembw%4iG@3wLA)G0>< z3Q7V~3u14)`BCu|$DUO-AiWj}mku|64mP~D>gvUvJK-cI&*iR8SF{cvG2+5bo#wG+ zR%6|8_#Q62+R9>I@5O4D*9mXvtYz;0}=XJt1gdUG8`}*5# z4Ng(>Iz0{lV=8N(x#)*%4c6SePB;Q%)au_GeAybj0nY1$qXMS+jLu&S%+}ySa$YBF zS?DKx@vyhEHM^1q+YzRxAa?jIN<-h4H5%J79{F?@e_DrSp-zB|mIX&obyybcp{3)(x^0V;_%4S9$@3(>6M=hIVxgx2=Wk29~@|ebi~!B46c}Zd7l`z)gxY zF8fM8wurn=$_}%_lGPs>>OiJQBVyr44JOw4J%V5DtYdkYB8`Xz_pi2CW$p!I4OPh$ zX+*4^MD>IJ@mSuv*t?64wU8;&h*-TqYw~r}f~Gb@-OLneM6BLKVHx7pKlHZ~D-884 zQ=}2G_7t(cyKvc!hWd&r(ui0Tg{~LI+SIzazoB+fmCvP8V!vK}MXXN`8??kwLzyCt zh_x3{s+3?!u=e1W3>9aJG$LPni&(#Z^JtTy8kr)Eh=o@wuakAXN;|(WxU0Ti7coT| z5o;e2>!eS*o^Po8nIesdg?B@$9-`##;-wP|^*U3e5wZG&7T)=p zSTi0udbpwX;=zeDA{H)~n0h$<%CSQXHI^yTh*-FGnk&}vOp!*!IzYra@6cfM zMH&(7P))%b*Pxe=8?>vA^$}B~5wU32ug8=v5BV1v>Tjkr!j|t zHLue&%%(Vo0bxCyg@09A-q;L(pa45Gw88@jjpjRv>*3olYwOK-5I4a$_2GkH<)@^Z z8{yk{wG)2q3_q3OZ*hdZ05Z?wQ?8jddVJ2o2v4tNS}WRGYv5bp>5uot*EVu+I$s5U z2Q#;cwiDAlJ>{gf1%TZvD&#l1^2531v>lCACgzi%>~9t4zX6vCw*k$KSzp`C2tAc5 zQpG3eaV@74RAM&Yuzv?`H|w&Qc)KUCw!kwg|Hm)9bI7mC7w@Bz`#f(m;vnGs=k{O; za=TCkmD>ZKSKF`1&HF@Avxklp%7@&M&&fwe3gtuY#pmRsBSr4QP?aNhVet753PX5s zEDYhpF{{EyM+%h=xh=M+=A4s`6v~I($kfS4M+)UbZvW`yqa%g#A-@*L$wxCa~o4QD&KZk&$*2qVKc&8>p8cPql!w# z5P{FR9kSDf@SNL*DV<#Fd7QGZd*HBys~)EvD+VZdc*XfSw>vX*xt?>IF-iJ!yRx5i zbHklQE$D7PPHAx_?(`hlX<%P^yvw!g6s5xf*h%MuarS7?%$wS=?n0O$-wzt^G^N8i zuam#`!G3%NtT0YjI$X_g(#?UmSAwQjmD1szl9LXT^4G_QcvrY&smrwjUU)#UJNhdD`(2>5ADBXeZ!^vL=>|>WhU4R!Jxyt2qIJX!yU9Te<&4Zo%T>%cpg67rhl@4d>PCCr* z6*nl2^}myD5-bqi4Z6;^D^)4{aMHa7*W;8s;aSytl@90SPP%1KED2CPTf-U+Z$sS*N@WfFDlj!~XuJXW)6qXO%8j{VRnGz6Y9pUQ{|~bB2j^P*tFDKo>U|;zLD$L=edju-dTmM4mg9dT_TQJ6bp!|)6A5Q-E1b^E< za=ChMQo3CA^dvaFA85|mf$k+J=L`2F-{s zN#@FxKJ3Si0L|PT=#GH~wg5D1H!FWf!VjnPH9(*qKe}9}|D<$q869ZUO=T5H0U6f9ji|w-mWz1O}R;9hgE5JPc3e(d+Y0%kxzP1nQa*oXWBV9NZs9Q@7#<}yDn2fsKlOZ_+> zKj!x_VE*pM<>2>EVE*gJ<>1%1e_m)meE7Gw{FVW8svqa$cMy172+Z{kj$C^xk2o+( zd*Mg#*?92Ki0p~ zfH~if%Td191JmHg<>2>wU{?5XIrzN-%-epPk00BA8koZd^j=>~V5v3!>} z7^cg=p6bi5fqSSIew6RIfc#zo?(JUqvAv}O^6Oui7aEEW|9a9N^LrdHReoF!{apgg zHGW(U{Uw3(z?0q*Wz_))&U1mu?j?zvw0aeVP^Kz?5X*MIQd^~d}k4$L?|E=PHs1I#6U zT#oXsb1+~ne?67QoxuH1FZ`I_)dBgv4BT72@MHh+Z9skl_CY_55C3|qf3$yPz?|d9 z<M+K+0cF<#8Br$2!=a^2_>C4a~)U zTn_ne2FCW|eDcvA{0W$pAD4sQYrwqg$NBhCzPuuo8$SH=@{xmI88D~%aXx;<;Bg@^ ziyR!e_N2chz}(#nKg#zP2Ln?6dgAvSa9eue$NKzfKz?5X*MEplFTVVe-{B5MrRzDr z#{oA!0KfAC^7|QZ^LpXO`f_JLe!m0mv0nHwzt0Ec_Zo2T_QH?$K5yS(?QH;X`#D&z zp8Cq;Xz(io<|02XM}1xdOu~=z@uU780%nCDmxJFcz`X6p`S@}Ekp|{KIvnt~xAt*3 zFvmH#p7P7~aV9XA_;ESps{)`fQUw#M7W4-WW`92TKyM9~_`SOP6g$CopKd;<;^09nNfhqUn za_~D3n9KY)A3w?$2jIIV4m~ieEcZiyTE+m$K~KRWJF%*V0`%JV*PAKT^mz+B_U<){ZqVD9tdeDbkg ztpKLgkITXDKfrwE$NB0N{fEZ>TK7Qe-vLxJ(M0i`qdrrASNm{1mB%f>-R@7R}VzmtKP;m7&-F~2cj>ixJJ@;v~|<9?ivAML>l4uDu;m7>;IVdl5 z06zTNTYkp^Q|ZU~xE%TY1u)C~xE%bR0cNWomxJF9V7~F=eEe7*2OOLi zItm~D?Jd6+Fw^|F9Q@`2bBiCBL%!v}JnF~g;I|Q&H~hF9{5pXNf6tc>A3yeQ-*+&Q zVSM#eUycIqgkJcue5VEEHygNE0DgA?^G81}M}F4Vc16F~TM}7~=TXlm2D_H@6plERQ<^@>>SngT3%$e%A!#w-vZI1MvGMAiqJy zd7+W`@UJKRQN9x#i~#Y~ll~?FcXluQSpVh#Q}4&+DBlNwdEAfll`rLc0hoXJaXI+y z0jA%fd(SV+x5UAKl)s+xdo*xkd*R3Y&Iriw=fKVHg&*zxFMxT}kIRwYjljI>$K}x9 zm%xO-@6$^Te%}Y?7(dR(kNS%`7*QU+deYxC;AZy1kNLd`n0x%V9P<4Ym}WoDCm;E} z3CvDEE(gD1hvkKe@!?-j?SuSI0cM6DmxEsnm|8zBhkU;Qrpb@X!S5fyZ1>}G@cRy! z;U&I&|Xe>eJl>h?{?sR)eAq$w-T5a{J0$D z@gXof{kRH@0Q0yXmxJF6z-;&9a`5{O zn1Mg=<-^C1^?4L9WBs@s{AK|2Q$NmkZzxl%buiQ)|0;@#DzeX=^BLD?>bl`7y5Z&m z_lIt{Dcx{Gfg3SO^9oY_DvG-EyA~lwb;EV%$Mdwm?uP5mkAAp61;CNta{+L)r!NP@ zbp*gszWgJ5*9-kuhXlYK0o?ciI0Lv#0^kk@Zf*eF4}rTk0PYar)&;;F1>Cy4xiGU$`Ikv;a8TwP^uxtoO46;D!UYFaVDA;LZRz?hE{L09-L} z9|piN9|KGMdhV`2?zcTS0PZZ{tZumO?VS6<@9T!^o-WJd@c_6Hz^w^@quqTy0FL&c zJphjFE$`^w^+#M$036%fApvmQmm3X$I~cfm0dO+E41gN|e#-*jih=uG0GtV2OE+Bi z`oi|x=ZC%PnK&Z=?m*xU3V`Fj^%Dc&4h7B%fMfl;JOGaM<@$iQ#sE0>`}YRG(T=YU zfTJCMBLI$i4jlg0LOazNkCk9bnoTHc78xW+_(TZjwjCzfa5q~Q2-qE_izB*{=lUI z;F#a70dTA@p9R2;0&dW8z3X`_aAN}C*epo7L4BR1O{Q2#UBfrZ7;MmR| z>4xh*PbmcMxJWptGeO3r+XxD z4+Ow*ob!AD+;PCY834z5nQ?+YAKm4{F~iUgy5YL(nf<~s-EiIcv45)$fMb1`8vsYU z_NxFmo>N>I0Cy;GTLa)YAN(Q!j`QxK6MNV57~o0*;ADId0LT7lQ2-proy!8?xSwWq zH(d96U;)?C4cFanOapGfSifGn<2atYup6#>y`ue#1;DX99teOd2d*gqj`DpL0CzfY z1><_pFYU(EZn*CGWxa0t3J70C!LT z9OoZX0^m4~xHtfg?daA3xN*S!H2{v~@o@kg$Ik=D`}NmdFHHBe0Jt-NtL=vC-hZ3~ z+@@~0?&;DmP;g4`^3iYcy#P4c`?7Ah?(#9eH+92xmu~@ZE4tyj^LqriV^8(xqdRU1 zaBl>_vA$ef;pf*~KHfWE2f!T-++zW7^pC$D07pCdP5>Os_p1On_P>Q@@A+jvQxOn% zK>!@by9)x~MgzAz0FLr)4uD$(+(+GT-RleaT|S|Ay|CYJ2!Lb1|H}Y4j$^;Bi-%bdCD+X>_0Nf1v%Y*5z>W1syE}7qL0dQ=WUkAV) z58Mwbd)Ev7&*ufe6$7_40FL90KL^0k4!s-z$8qde0dTDMMpf_mrF^9UaI`~b2EcJ# za#;Wz`PB!&F(1DQfGY;BDFBZAUJZ!*JOGaNV4q37>zR5vA^?tlkg5PU>TiAk9P@iy z09+Yx4+p@F1@4~#a3*j=PxI@gyFK9iV_G*{ZhLT7037@MzXiY*1NT+{9NSwu0FLwc z{VjifyXS-U{!SR%<+Y=_JC@l}2T| zW$zQoe=dqwDURkV3dahR?*go-G@7>SFMGH=s48og-}W}XN^&8RiQ3QMy_uH1DeL(q zlKj&pqws&kel2RZb`9r%tIA%t>QD#}abjBbqa|E8waULWmOPDsC>|8!!7RLjwjRGJ z^{XO8R!Y117%wrL=?~a0cy8wjMU#~XclGp=Wpgqcij+NPm2KwxW{a(|EmdWB59vm0 z*BjQBc5Bz`R^i475^HHc)k-^WWi0=8-pELD*s119$OKU``K`ImO1Dz%#pkE_PFSi@ zM9RiY?GmHPvZs}dt)}X-_#9hpuVb>=&kpoI7?=sp$}?Wpcw5PG3g*7Av2Go!hbeEX zSyu(zd&n!^=!sYV;MK$%V&B7?J}XEc8E-@RX^U*-n}Oud zvM-vmGrkQWc`>|8H2wi72Wr`y!DqW02`?WlYc_@m)=DT)BJc1b^Hob-B6s>D6N|_K zl*k2$qA8E`M=rtx5!X$bSVR_}L@xFskM>6%<&R7(A`4JnJ}htir0-%WKH<>M@qLF- z4|&vk9(5>`s-b*qEMBJ_D=FsNwE1Gv3JX@V7EmiGl_g@gBY0Fb-boCLSRA$AiE4nE zny?S1pkYGo-C7bF!k1c)miJeC(20Obd3uU0Cj<=n7^fCyvL9uIK+CIccq#Iu9Zt+pdgAb(DxE;3*1Nd9_%f=KMB(l4Ai@lVE^sY{q@tYma0HJ{`ERABze%Z3?Xy`0Eu^j)&i*bMGss2jv=u!1$&F!41 zSho8D;XMb<8z^rEZs!I#%f7#)5iF6MQB(y1k)AOmKbi~={oE+3F5*kiYZ3mrG34|j z6wk=UiFil%#DmsP9GpL^b>jZt;r-c$m8cgGq-4#^k}`&*@ZR$Fwet8jc||kdX`@{YeHBKDfIB}oMgM!A1BN`_fMpNF=`y=hfiABbWyjk%N z2J;=uvl0^vSJwU#Z#llq)5aNl(}vMh?WzhIA8V%00vc~^UN1E$yRt-49`;L_@{=me zSM<(|;x*Z`E%cADbFq>IcwcV?`lkynT1&4^37SJ#-njdmbRU!P>~Va;p|kM)0}1^p zC=I;<)DsfA1m8zVC_4fT{Ua!i+YcqB&$t=8OmJMD)6nxkogmLRVo`qAfzlXBP~#-@ zPoOl$Do`iOvsXcBj6P@&yf--oq5T?m+Y8O*1|`~t5S-+>g|;$Ow&VuyN+b^(-C+Tehfl2ZiNz~y0( zp8?2wn#Zm!0_<9JBw=}5x~hfFI91CGCLy6L=<9^K6O`gOD!Db_ceyFW@GRI?x6h>juK>e{90wA#jWZ+%Q8FS&{RSc1!?(5LB)9ISNt3&st(_V31 z17%iKpIV9^!aP0 z(&PUlz_Lwbpd&(Mr~;)jxG5va4MzRnn0$O($f)PymRnEJ%~Y7FJtOgiRnAF#70ivA zfcV0K18BHS+91 z57z|B(c1K>Gcbyqj&WS_%9536?DQ99H}ndwGj-%h`NT+G3SY z9A(^6#UF{MOO~;YB>q~$Rk&z!OlJPpX*5k7ebQn+HyQ>5U1>L4$$Pj;VuT z`*S#F;^};&;Q^E~XYSUxNd-pzVq^#@kFw&O1@mTEtr)Kr;E|asfvT9JQC=pqDhilm z%B>b>W$o=KDBBSc17M0`+0~=7CXv)7I_V3|3x0C`g=?+&#NvX8{aqx!zQBq%V{kli zR7bvLe{I=kPz|G?hIxltiD=1aGlf?Pc9)}l9vcO8l${q=KxP4auhpysA-0$5bUFWH=VP@!a-j*{9QLI~g7w$=^gBxCP**ChW3u zQdu%PYM+i#;qBX*TYKuL>e5Zo{L_mf`EX2BmP|p03n-@*1-FW*aS({^k7=lG9hX#Sm*#2N?j zjQYzmnln>3;fKo_$rPLRD=se`t^OG-lBcEPoq6-!(Yl#hk6BxGED@w@yz3R zp=5a9XnC`73k?VA)krJdV&!j)vVr{xkK*Y*Mnf}es++qOpIFily9uDdK*RJ99VxX9 zbNNY_&#jd@#7sD4*>mOj2j%Fo@+8l|xE6JEdYe}UM#DJ}PxErdOgM0|LfH2Jyv#zp ztj9;l<1UYe@)3l0RVP&}54vQH=)H<%M`Z*vmCv}zs%5>^>eEpK)0d&{jYK^b8Knnw zwapp4D--qCr8q5n2DDwh>{*%?&0lN#eP6R;X@FKP31Oot+bVUO-jp32<6Ogf?^YdY zLuTq|C(p(0CuT8H!P2o*U7Beb_3SI0VnT~Rb3D+E=SbT{P}KK6;70FS@(jo0X`fNR znljtUJH0rX5AP`}jJD0vNd?t58nrY$wOkb3X@G7mk_LDja?q^-{v5J&Z-5YD(H`ms zDldI)$+A_)3P?U35YtuXu9#Zv>E?4ucn`sJSVRM-3t_*USs9I<|)}atTTGp zb}O-{5mq+cYHyC(uSZMYS{Y&uD{qU!{bfvQiI#4TmTxiQABiohX{@yO7>87{9%uX0 zs>?PyU2ApO+W+tTX%mg6@bRu^7Sfl&ZG}D<@@eW;*?LR7ZWhuPubTy_>9Knqt~$En z3b%+K4z9cOM#mjz9kx0CPF^&BPqch0I^;6;Je+uPu8t|_w30bddr_^Mf|DNehZzl0 zE^DP2Wm_zJjW~ws>$3{iILxV0RFKGF-&m!s?8&McJ~kS-HQFk5EDn5L(#1))RozC5 zW1O=AwnzFNV@Op9pCWwVIH+ER&%^kvbc$^v>JX;fF#Kav6o=I>IZSPTGj-s;pkk|v!EbX_3VhK@vMe1h?XosTM?T^29{k_ zn_)~_0SVCjs+VcIY>xGJ##~Ns;xvCJb7BiZ3QZdgUw*@qk@Aj~Z^yuDS6b?HR(m)e z6830yv^^Y;Samnu7{>Uz=5Uq`77kE-_$^AmH&sZWRYFod?i3PO_M{_32 zb`DUL3yLHM^^1K>Ae<+Fd5tpa7lOlXx1)i-=!u=_^vV#dQTrc3QF&(SN%kI4*;wEl z`=J@78pR}JXG>Jleu?nG9IgE)|g?lKSeTTnwK?g~&EV>2i%g@1dvPeG|v2cX;AE?h1FrFEBmr&2MGy4|Bz zc+`s?^@c~i?NJlac9qLykDBIDTR>?E9)a1`dm_P!pftayfQm{!W`NRs+zjd+!QBB$ zHU4W*n#SXxRJ*G^YNHpr9hB|i&5->vWPgVg-=YzU zmBA@ejFyg(`E@^tU{Ni;yJFr*^+CS8Jz^)g{A(T7hCceh=C$Gtfg^;zkVGBh;Xfka zQTqQhE(Fhji#+u?PPEV+XSxEQNC(Me*2@tKtz45dp~zJNp8VtO3tZ>*}VDoZ;C9n0XA z7?#X7Q~wK7lkw+R4LfTxqr%4!mZJyIQM&d3hoCLd?I2!XtoYQwi;5K;x3I{le;pLY zn#Jhw)L+rY2d=+@6}58g!qG;GWW-IF=bTNWVKiQ~|g2DdN5$nUy;X;akDn ziR^TC7=ydR8SyiYsSTMq9 zTFfoLR&wESjT52ddwz;vV4+VPCkdT2SwdkR^+`r3&b>#e+m~Xwdl{(47>2W)KTI8^ zLZzD_4P=5ekg2Ocbe2M({i#RjZWQ&$p&RDW#uDCc5-q=aWY&^l5n6bbOzsrStp@jC z;D8kZg zFj7{8f63!6k2dfTXEi|UMDhiv_W0(rXHZP24)a;)B->@81ueD8i7M0gJFI++H8C`c zmR>!Qa~=4-WZ5Na%*H`g0a)%LDNzTeQ9x~gZY zAszdb!+>RPrhek&px7x8x1OqkTHCJ!2bjF%j8SwGpv_~DTnks1gnNFjdKOKxx?Y|_ zW4>}@dFxBUXlVY7F4ojxj(|57B~I-&98L!;&C`5%i3L7QG6 zEG>DF*?tcdfU-ikNVEqg~Dz#r*+B!#al- zpTJgQ5TMluGxFW6OuNLOvs>q^+-aeluK@Ltgf0T5X*|hih#wBU3rgpcpMcUBA>{T`iNRe=%5Nel zjX^KL=Ms7gD2?$8P|EpfP#+8DO`vq{{eefNLFwFkUvSX5_h?WmK{+VpcOIy(@Ck>m zz_&_p2PmE4Jq=1F*Z@jn{1cQ)z!1fK3#tJ>4m-t>N^Sj*bD80+M{uYfl|-Q5uh~gabD;|P+`Ohho*y4>Hi4o zccQF_UM}Sg(+ybfmZUQw}B>1g|d(^`{ z?@MSd|HEAfeP3$WZ@svG0j0Ub7Io~Nuq^vS*F2+%si8AdS3@nXWwKxY00G$GuyAas zW*q*j2-O_##4%IXW+A<9#@%e-?k}*gr5U?jSCUO>yp8|$U1Z|B{Db)!RxC3&(Oy{P zb6?L)j&5hOH=e^CR9xYa1%nEsp&UxVZd#pLV}}NJEkghqT4CKAJv!P0SKx2mdzv)C zFF}QzdM6}$%*vkpAfwVXn5nxnjIvw;wk?^p@1`VCM}Yh-A24yNHO{9(YDhHsBl*RR zOIeD*)a5teuDcwN$zoT%UXDJvuFy<92uwS#)22{xl4l0Ak0T_DpAH2?26aSyjFOk1 zh?P+dXC7T*N&T>Or^>UTWl+s(h-=xawOm)X;TJcxEErx$SmptN4ryaVyslZ4vAnT9g-UjYcmp=sedr8RtXWxjVm!Zl2*BxIm<3I z>Q9u?JRM`6g>$OxI%c%8ypEIGxf%Vv?q`Z%FN-The=!PSzlOM%f{IO;WwzF>0<&-O zTxsn7X6j3XiA2VVMuxhIxZDvmN_$a}pOfixzsO}&YXXNJ74@-R|r0P|YBo4n?f z_`*T?HDkRXZhJZ=7pwLjSapnF8M+r+VozvDFZj&51miksoM!3=u%?b6+Fr6s)lIGp z-W8e(8-{~hQD$?gab^@0cTzdFil(CH_Q-BS`R8np&l&M+WeKy*sh-i~;mCW)IHUrf zdXiB3S61l`G+}lZtlQ-Y=35YtJ`p}SKhTaT6DBHW~zwFV==h(pC(lu17>On0y!Xd zgpsD^;-vb)-!jW+oXJ@Y3Z#7fb%$7aYH=OAXSZ49&l$JmLo@AX69(>XbIIatrVerB zP($VBSZ$Swh%0Nk)&4|KgQ2gpr2{MhrQIV3$=b!4pr%Xc8D8j2FZ4E0=St{(UMTnP zY1|Mrrh^4~*_87kpd8Mi&X>3|yin>`LpfaD15V-4J)r1z3Wpx>aL;tk% zC=ERml!jgoN_8~{lP*iV+69C2VwZdPk8MWJWioKvS@iKjQW9yUsVRjlYp$G>;$R3xoCLJkI|pijvZEWcI|2l z%FQ$FkIiR5ger_*JcqrIgRsS(($q}gD!*r4(J0U#_QwD@quh+RUm>_-NQPsT{gtqD zdPC%>aVsDYV3>7DTTLY%)KA8PsC`<2WsiWJu7wC6UiFhL@3CI)K z+OL-16QRd*u-C4?6<_lux4qiSDS5U1O?7E!B;NXEq;wY+^9C8Wya;^F0B&||SOYSe zy!OjT`Ob)O+Rkd!j|o=!=dtnFOi>^b@Z65;6{8WxQ7L9SWBQ$5v&-nhHry&>-_5+h zx5Y@@%{mCGv-1*tj1^`WnKywnj`~zdt`rL)g)3Q>F;IRwR)Y7Qtq%jHbLp9`g?M@{h$n>Hfz!|8`LNGghTJ)`%i*nhpR@K7vL(FlRzo% zLQowNBLPb1(1mDnZ^<)ypq#j%=z+mOS5V3&;)QMp^=AqF5R}f{Ig3($3qUn%8laRP z{Yg(s4DLTsQ%}#5O2uxYMPmHNqYR*5l4tDh|0Z$S87jXYfl{f&OjmejcT8@x>&?eU zhq4Yha1TV6VuVgSOXg0*D>x6gmmvt5UNrWP-tp&O-Y=4!k=6{2J5iJ-LN zP6wqGcOED@KEt6}FO;q<4gDji1_^x<)Gb17^l%(0D=yRAdEcQntO2Nr%9$s~HC>K^ zHO5#_jlz#^W(_^x3w4jf)#PI{3x+5maK*uhkH$vrIu--A(?(0{w6fh<3o+1r))bi7 ziNaHHQTtXttHwAiYTA*4mi9sMw~csvpVovOR(6ifA#PAXuu{Vl&ma-B#>hY9jBP_0F&ExO! zOf}$`3>+@CUzbyCVe#Y6eRH$7$TX zXWL{J-#yG|(7o<)suG)Z@?s}QBQ{glfV-2FlSucTO*UL=I_STdg3(k|yC)B4>85$z zxS6T}tBzH0Rmi!>pV<=&a2ZDIqIl<^*pK0Uoa5#~6R@AJ`M#IOnEw&2<dHBa7O1bycO^+N`p2$!??2cS8nY1?){90gBa5m-MDcumB-Q^ z?VOpqhe@j(?Qe1Zt2!`Kzea%3WaU8{PPk(rsTRk~xq0#wS5UjVPt7=^slxRYX(A6~ z5^?pDrI6Z2SK!*+c}4@9BRSMJXLTeG?>);)Tn;B+T2tfc>CbzMTUqIJ6biDMEeZ;re-|jbj>9LXQNcT%w>V<=J^2jyrQT zv<}p15_-EAy4(xh3~I83{@V-v)C)Dx9N2w^LtE#fGep3lbXu`q^>bVTS?%_;AF2R2cHSFLwJ}SyIG-#7N%jfUf8>`$Nb2 z**Bpyw>kT|2(EA%6r$inJNMACR*%+MMy3Pgtifyka*{o9H8@?VK0b`u*G;)-?LiRX zZz9H#9`z$o&mh0y&=gRsg}NA&YEi_ckgmH5?y&uG8U`Jkxh+q0;z&-P+wwei)oyu)JSyq2~H-pdGsZE|U67r-!z$jQejKo^gc& z_16piF{qzPjLSjk5Mwc@%j6lCiL}HY2BlS%*Xhib(0_QLLy*xcBk2iB z{w0LaXE7i^U)6wbZ1Oc%at6-s(z5$i8da^4^5%K6!K&Mw^Y=jds*l?(PceTYmk(iE zE(;`@e2RIpl2?p0n#?{%(^+{|%R2>D;b#2IcSxLnj3kD4VEy1P0@g0gsq);JS_@8Q z>M^Fux)+6ShgA-qh=|>fZFMX}?lK?H+LhIe;|mvrVwY9w`k|TnD|qR;njPOx?xk(^ z-4xg?Z8mW-%CQExwaI?X?MHKZ36iU+$!KyR4(|P)(sQxuyQuwbwf%n79?H$MjbvMU z!vOS^6%Zfu0!heNQ4z+#-^#1PS3giw2F$`$9ma}I&=q}J-YzI?Gx5z|`Ouj@z>ofw z2*CdZ40Y&%g`4@P5V*q4mE{|ZC4WGLH%m9*h}V)|flN*wWR>q@ETIKAYsW$st|mjQ z0+8H(AU!GQ{g4OrrlFdf>7aJa&%4WU2!n%U#f*=-1JefyQk=!_1GXfERHFn5~WuzdE`y;abCkVB(CtSOE1Wfrou3b5y=({#ZS0=qcFM zDvC?hY^J_u5?!)!HaJ$=b+uq&CM(kAoi#Uj3FODFu0+dlJDaST9sHBfPh zSqa@l?BS94bLauqL`s_@$*cNC@;``{w?%L`t_mIH0B1LT$9`7%nyC7BoktO)52$}YX{1I0Eu@O65 zVsA7PBaqa*Ga18`mxF#M#Y}f?rhb}L0wTmCZD41$q5`?odrn8%ck^k&0L0X=XhM*Z zIxjM++nr8h-Q-8P_c6>xGHwNCJCJCajo*^99p8rk%$2O|vsyM3n5i2OL$>zKN))6( z10zESKq;YVRJFO4F(2Fevt2)ab-{5Tu?Lk8w1dp}<6Yk_&@l9%p(laT z(6d2(BB8v|MMI~chJPu~W`R=NJWv|C2-N%F84kS(>QkXU0o4zh42Ql3r7;F0I~s#0 z<8}$ZQcxN?-V415)E)_~@j^3a*E$P)U_mgt1^<~)enN|CBfzD~cIzB%Z)n6XaN3$Pl5Bq2?RSf6aT}@GT z@J>`wX)V~MD{<`3@gdwO7CROAafQ?ePm{u?C5Vlh)Ip)#jdNUxG@n!PyK z^uhBKnC8x;XLq(Z|4#3FlQQTZ+WWh~|GOLSt@FBW2i z(NIl7c09?T7t=qM%8e6T#f_`vK6po*YfOt% z&FzA6Zu$MFC{qWVEx+;AY%Q3yy$Urro8iiKI$PR|Lr?|dI_cMjN6Xa)Jnuwn;F2tE zOu{7ahg}A@G8SLCuhd`JUX~fYwcm@#m}1jt(t&XeS~Oc%w6r;jOKkBJ*J|WRdoxzp zI(J7mOIA84O>G0;Ss0YM!%;L(gh@<}Awe@XWzXx%Nw7>gs zoP=F>it8Uc2+ZjGwZ_RFx9hT&>SO!6W&!;y$K={g?3MM+ZP~IEdKk70_1rbIw$Bm0iJr{V6Hw4zj2O2& zS7h+I)>_z00<^E{ro=tAZ$La;abq-WAtAlT!a0j#*rOCfadPv-^C)4hHR7~MZ)TSl zJ3H4X7umZ{n+XrbFEKywLAMyeIH09J&@1D|R@tosl-*$syt!n1av{t4vbS1>B$JaN8+9hO5Mfv~kR%FLHO>=~aBZ zLa*VU+;KN)P8s&FDjGjP>K>po=Gb+tY6%_D?WG$3g!Cpk^4iu>f(K z-vO{C6{L^Mx->koT7nVf|8QYABkw@Udgpg2lZM_lzV{2m8JSmz{lB^}oRN#Y$fNx! zkHQ1BnwXQqsTDx_T`{B%#1(N z32Jyv2|}3`_XNTKO`5}PQMxjL(XyorEqtDNR?)a%us%Nu5!nXAq2oR3K9AxqhC3v* zKg3gt&U>ZmJnBJEI#!|m(Yo9UDyyIFy1ex2fSl%Nx9H5hDAwNQS}b=U_XeV67K}X{ zHa~bPO7zhDk2J{xK&dE4gHlmwmNwuM4vqIhD?u%n7#DzYM7D=S?K^2ws_iv&kVmkK zCTdinr><+mQ$DIrTKP2tvCXwmw!;kMP5j9zeXDKw?&>xJWF_w0j{l;GM6>*=+a~|r z$xLGV1r{^vra(z17dB$pd{cKWeqjSARt|O7MsiBN1l9}%D+Zb?#Q~L^QrOW?eN++b zx=6@w4?uMD&YjXFqIDvI&j?h&6W@usxzY4FM=|xqk|1w(9WGRA8U72!hEbnWbQcXK z!xzz@W;%!Whvg_cEjX`2kM1(-{4Zii-ByR6GbVslpor3AwaNxjER3PbKaZ0`cOU>Z zGgQ&YQ4L|JvN|?$>V&)AD5sLm)Tc~Blh-bgy{ZUh%X(v0ZZh{le~w6*>Lh4RedvU9muvKDrD^>$ku{SI8=@AYM7vK=*OV6zFiJV>(Lxg^uL5dH+!KR25RUgP|f&+ zL$Bal<9-TCci+LNI~@)u1-uC~9O4xm8rOVc)RTRrU=WbK?CcnOciV(zpEU>WaVQhz zj-xYRkhq1rBrWs@_8mew#WpSb1`#dL`09tj9atQAT1jloT^`lJQx8^42Yo0x#^#EP zy&OcP-70PcXEent!DYZo!!?viWDHlFi^JmbVat{sp7N*&Y*bGtfzr+PECJQYY*1>3 zZt`&4cd4OhZq4{%CC*xaGf#;kx&P6S~(6k=5ynY+zT_AFq)9HQep9QvL|{Q%T2;iAo%2-2EmyY>k5ah&0^BCJ1}(&9-zbB zp*e=T5`_)e>-8o;V%2d3l#bLc2BqV;dqBO95AsA~yahtH;iqiNDx!5?S%{zF^Y1`+ zkYIPfGwq=i24*2x-bj9%mAFMs{jJ;aESk8r8UNv-n)+L*cGP3+xLkwFrDj6?PwZ3$*Ex#EfLq)D0!HFtJ=H7qPE3_@GP$8ACiL#P(XorRq51k_y9}$!D1LUXfcGM_)9->& zgjK$4{v>xkg$=P>!_j6<|E%i+L^8t3OpSM?kyiCAZy9g@tFZdaim%o_6f~#nLhS+ zPDagC9U$&_iwe_@(al6_M_;E8l-}`5?yuz$W$6t$(rS|a=}1t1qjnCSeTh#vG}{Zk z29!F+mVnacct5Cz@d<|>!?$vwR@E`~0w~4(6VyZagk_@lgrv)Y)EI-H5XJHKho>a; zBv2a4buH};IE`!(E{na;B&c^}B=`qV%H<_c>JIxCsAh@rF(~E7v#Z)$b3&;xxQi_% z>Cz#mxD!A*y%5c3*TL}D!*XigX>&UKLCw&*04$GIvvS~HXniOTyNsMIM%v8m=PPa9 za^xE-Ia{;B7-l)8o@tj-nRKXB;mjDc1>j;R;C-Vc*V0O#JQ!lkko@Kvai5FOCVaH? zpAqUBe5+m(pw5%H%Rs6A9tCxQJZk}!(Hi#B;blqAd*`UZ3Tzf)bEv{q`dH;orl=Il zKGw;0rTvbXdUv2Jy!|>h^NqFQABVlR?G6zuZJT|oiKU9zBzzCcIwt-h7<6eC0D1;Q z&umtq%2-KTQcpfbi8`?A|580X zcUF%GtNyD(6<}GuWr#KaEzo;jl zAlHlh-O`SOOxUQ`ucC2wzLNu^LAuA%5mtOp!92ZP?@JD9T>E;ZXJ5_KD2gJsr>l}_ zU;l{~n>&i_JfIvl8Y2ZVhWR3z^!qs)qMsXX+RgPCuOXl0y$s z+Zt)6w}{s-XIEBuZqRk0GnLheaqZ1GKvT@wU8WHQchiR zEssR&I2|Vfv$!PsQ9WREh3q16Qq8J`ILT25hFzF=t`EJll1amH42M+IOB6XUQ&U`Z zI`tKpcG?lAIB>6~lNGqS@v@30nP@iR)fKIi(BTn>b!Gbw^@(l85yQk2q&tc&dos?( zZHNu!sdh}3;99}4^ET!KS2xeag>W1NLKpW!^z6)Z={P;q1(35xlpaHa92ektDE4^N zf-$>RtVQ8{7Z?3xE#7b7macU253>YacCH}jxT=tn@$ju34{#i>26qZ5Uecq}RW+_L zJX2q2ormLiMMKwmp=`;@nUQ&6iV-Iy2p4^Yp@v+W+P z(+j0vb`R1Chn@kYoSy@wqj+xU*6xA_Wo_Y-xpetRJW~lWzExhGbi3d#0riA%p37%K z)q%QGLhlEqsr?C*a^a|7aW8qeS3MlB;Zz(=_fp~aEvR+EFLOS;1iw}0@t|~2aSy0p z2#yB}HC-N{Q+`i_+9;tLywHDop}cdhSyJQX4~=^Ws8)$_A}CFbGq#b_aYZcdhGiK# z7o1yV^7<)quT+SQT0iJ4J)Td|l_=2rQ#C6P{ zTy#@kLT-4X$wHcF$xM?6<7#rqym{8Ht&Z7{_qWb!*@#}@`B~^mFOS$;8!PeR!^XeL zHmrzkV*g7-b|x2#+39&&^h6JhwVihsM92MAWXu|e{LODakaOfgExvZsFQ82rO^}Cg z{JRsu81U5V{xI9-EK!ePJNEFeu3o5Us9eiMW*yk+hHGy`#igrR!YEiP|2rvFO!hTR z%xW5cj1;Y9R(YqfA@p+X9wJW~4S@&6UD3 zQxSS{$5{!jhe;DPBKsgDUk9?E(R7PW$KjsM=WR(;o0YWW9HcEj5~5@4 z;77yjHLU?F3C01Zh*7m3@2ANc5_ashlGJkjlQSnd9JLVyUlg$h|3hb@E>_p;bKX?5 z3!HO|T3S1P%vIYsd8qo;FPJw-OU4@?P-Hh1uTLBVlvkoC=`KAd9XVjqHN7WZUWNk?#r%6ZWmdA6mw?d?xEn6xrOjWF`*czI%c&R zl$zx0knjum6%KK5rbc%usLc|C%a3Ywp9Q5I;|m_{O;F0E2>Q?tfD4Qt3cp{0dRe$M zfl|)Rpfm<=4b*2m$Nj3{c7f84>^&Hb*X7w~pcI#n-x`-2FFGU*ZoJUYQ$YO-pKxdf zzE$SSLA@o z*=*KzvYT-Gh|1FDS>~?Icy}z`4O*GV6Q}G*T9M*&I81s2olqpcyI?LZecz1()REH8 zXV{P;r8}za&Dgau*&ehn7f~W*11Bd2ji^qZT`)O0Xn3T2!~FNEc_Mam1TS!so*Y~y)eY~}3_`n(ubYXH?FBq?ult!Di(uj9bkv<^6YxSf{N(r# zn-jTj@mw?YGWRAxvr{rw-i~uH5$_y^J4xU;h<9R=dKCzCIy7r8JNuE*C}m@XP6wmO znlIVs87sEfjWaRiFW)i`*UY^S_U+9~a8K#(cse|HbkfW>Q=j8842rt}ADz}{SR1Yj zVArJAOSSJp?PlNP8bgGesZPXoP@aWqg~lURGF(w*hu2jnk6vf)Y{s^d@1e!G7#trl z?U#(oO=f)iw8#CQRY;F~Ko@iMKXwvGPA$NxnF}fQt-`#a}>qoWPAm zUN9XS%`nKyvT&y&vZ=tewIz@xlWIGSjc56f?Gk3$^X9l3%k~HS5sDKI+A*MZAW2U@ zmc0<$4P@HCG;6EDk_wcib>tFiMmn`<;#meuUaZo^e2)BFx34G6<1BJcHF!eOl`$(< zW@=SeL7d)__W)HGO}OCPl%j;iSW~+@JnzVz{qwK{VV_oH9eIl+XP<+%ai(5QT@DtnrZfY>0RAPeDe#?6)9u%8T_F?abli=2CwOH#23q1?QlIzo;1=>CBuzlBmKE zax*8(g-DZ=a_%~eB(6f9ZQ|Ygbm(cp8$awS`f2EKiP+U>lU>{`X1qF-7s-26YP-3! zDip@W&|v4Vazv@NFDo!pb0MHqmq>iwAh>J#8%@{tGn%d+V70uD!+krfmjA*FfFYj# z1Ub+u#0xOZLWWRTg`JLS^j0crF;k7bvowRoU}a_yw&_adO}jd@v!#zwe={11DVN%x zo;-Stz23Cj(6mb1%fQ2~>nuqREDiLV7q*`1`hbhv7|fk@8pP zet@gR8=7GkO`NroVL#4F#kYT5*w!&nUhLBGc6>v4XG>VDrTUJva;sL%)Xl8HMpgFd z8@3X!(r3!L<7lsqyoNTCt=CMoH`mvfaPyPfUd_~PzB0(d+O6EXey+UfR0>A>JGy)t z@tfWCluYk98jpC~0~h;%(&5-_P&(kc-Fx;1sBMD#%nQv!QU6n(9RNyWoC4}oAav)P z@~g))9j5XwKgDJC%YB1qZwePKZ)oU9P;bk#%snM#c(z`iodQZZ|HO;27}QcpmnT0r z2<~Z6F9_8NN@KhQO4Ha6_K5?5aHtZL;^@Co9QVP!Cvoorr7<1^^^!dMyN4rMLtg;( zUkT*};>zV?FLV#6+a1Ut?AA9QGL&OhCjwhy5Ae zFYESaM@xTJ3X7W;!;9>yG9B7<*zxKv9aZ+o2Yx#F`n>ZS@c$lU*{#|(9X~rS7 zNH}D#Pvgci4toYw*lSIrD7=Y3)7X#`#?GW6;q{;6VRTaw{u>fqUxc`GpO1eXo_B$v;0b$i&sJfzR{8+VhuyzyCu_pF*0?9A7Nh<@;Ef*~ zW*ha}@FQw3WeOJF4smYOUcxIhxI%8<+eV7RKg(V+g|TD|SfLL`;UUG$7*8PGQK7xf zOue`d0@cPkvwYlH1wlnFy#5`>we-Fg&*W}F3@;m*uFTz~Dl)j?C(D4)@;ZsQO<2KZ!>WyR5jXj;v&v7wYc-Si%cRO^T^eDS)=!|wRUgPbf>gj@WbXvY5@Z1{Ij7;MF&KBFP14V4s$L^7 zr-owiAOjmo@M4LIg2p_fsehxHhtNJ9xI+_j1UJCMJro15>dLVESuL9+Hcpnq33K*w zSSP?(5woZZ(9sK5mm*4?fPF3aUf z9#%?Fap>?h8rT@PACq%$xqaQTpAZ4;m7LAm4_o-g4j^}Heceb#7*|J=Yb@! zNH{XP)C<;2)yxXH@5Tvqtnl;YAK)B-8~JEN&Y0!)dP?esjqVZ#4Yf%=oVOmh>o4V< zS?^mPV}|GkaGp+)#M1Y604c5XyPemQY80eIMvUPnR6N9|CMv_d(~h* zOpZaj%$J>dqT?zo-fF_SCgWVSK*Qf{P5E9Vlj${aK=5RdQcglelTnPO+-v)lBW^B+ z>#@lkz!4aY$;l{Fnzgz;JO*Vn{0OvVpCYq88pGNfODy=P_6Hdqw}K^YG;rgRWiRCb z&@Df_82VhtHPB*}Z=Qc5C3Rg;o)5-MT`Wa24LPx&&-7TLy7s?88HSd;nfe)k>1KgQ z#-VL3-b|shah~f601%uBv&kNhr|9wjDWv#|2B83ED!mV|f*nSt5R50-tl;dvz9+y^96#eduJA68|!s33AMi;fQLPBXQY z3Q$G4%_gHT%-|bd=b=-|Zl?YvWua&1G)l*TPF;3b;1?@6_9g+ErRlCFTrS^h=W85J z&Z`+O%psw)`*Nv>^X7TY;!8gxm|c{ZR!;85U?Bvq{ojFGm)g&Hqa!q5;#iT*%BX)) z(i%Fx7Pp`n4KLxcUcFH0K|Gh6d++N z>Sj;s60AR~5m)W-=JAzURibiN6j6^eeo<^11S!HOpD zFJZ?JvCqeQ-LAmP+TP{$9cxG8nJz-HTjsS6SY`sHo$S6tj{=B?<1Xdn-}^I zP<`dud)_mi-_dzKPr_^5BS0xX-bbn(;aQ;mi&!`Z45~o5Tn0*GaPdoH{1(*Hf_oGc zU$qntJ?-JRX)-e``;Xu(G+E`s>q819#%-XKAJ5e7BhUWsJ>%6q8slS7LnJh_b@$7i5G(+_9nZ@#^9O5ml*ZuBK9%np zP{k5@qZi8EBpS*CN2-ng1*O{HBt*Hq2uf4qbu6EYRO3*#hY3FpS`~LLDCIW`)DaST zvlq&9l^XgGs7Hkh@9bBq6_n=u`-rCtab2gp7^&`F9jb8cu)Sg#3dt&8YZ()^S>8sc8+x;n~ zkZj`7(j_zbpS`peg7ePVY1Q_fN^gzLGwsO*d%u5nO2i((`)4P^KWw`9&ziL zTzmOv+x-hZxF8eX{}iei(rK&Xo+vHlQ$cAtx`WR9SQ2~D`5W^KMGPHlmc9%v%cyf7 zFCF1D+BR`;>-F&*bQ=vHBhbs^GXG=&5T`%33-QVt;AxJy1xBvgGgqRb@@k`Ioc|sT z>2N@s{B%97axCz*{H+}v-rtmqziUU)hlAW%F{DrI&{YQ^T5Ft#jqy)KNbyxSHr|cB zZZuW|U6v2!Vkt^0+u(vzyq3cKF`he;jHNV8mW^$EH{vY{O=lI_<}Z0YF77S$B* zEsM*tv$WZtKIP5I5@vi%UB;G`yE%eIf|>_h`CEgHp-!4HyvGrZlRed2{|BDe7lmRs z##e8HB@ET{tG&K36uU~cEEOV${aYsvVv)+*hX!W!>&ok1h!caqYfjeS#*?h?h_3Di zXQZ5+D-UY`+hy3ol--ofCoX*w18*ljwv*I^QC?m3<5p%A_W_6+7en_0P})FF0HqD& z22hJ7bcq*wpBI_})r1dBJiZfxdjphmX$PfTs!?)$vmdrRg3{0{L22mkKrNNf$Gy;I zFZ3X&n>@pzF`zVVIjFlN##B&h*nbANIOWAoV5XTm6AKtJX7vV1xJX9^v(l#UUI<)5ZPd?z zq_~J$XEF9-o~?E+#^8k#Sfo7|spHXj{`YWRY}~_PhoQZgYv?F>>`K~%_vT4@SS80y zfKx2{B}puEErq?f0C=!CsaF;lXZ6IRSb3c2`k)2(kI; zP+t5Ct}`Hz*xFEcZg6 z^g`EzS|Mp{0i~-w+{!XYkPD3`x^p)Z1ZSVFlkTSGfQJtEI|`JX;J0bRvfc{UN0a-I%KLs{)d zPCv(-?q1{r->UfxHXepdF6v>nv^!#dptsAh->ovLzKSF#^}!yX6`>&?*^pE?KbudKFfn~@|Jh-TLA-oNJj>iiu{ z3p+>VovdkH79cIRC)DJ)#EM-5g;kB_Xlx`qPTEz+prrYcdD3&n626uNKGD>bvojh(+M-mWa)e$zN) z*ryD+)(rc(A-$M_uJhy&?=ofINiQ$#{ZrIJBzams-(!Gr98Ue<=NXvzX3m(v%A2YG z5q@VD%i7CCV?~$;AZN*~!Ohs};@)aW+uLP3#c8gi#b`Pc+c$pah&2``9w@16S>gCX zCz7?31^a2RzV^kI6S#c`HyTa$+WA9Z)uo+7`|O}Z>v}0PS~*rop;gPi zzoeGIX!7(8n-^Y$9@HMHu8f(8X{_ka+(5BABB%pnCLm2wU3U$$x|yjpu7cepJ8Z{8 zR$0Cyb}ipg<(7;Z(ia%Pv67Cc8C&f{O*bR5vuD>eja&TrM5WH;Q!W)ADvo*FM|}#b z6*P_et+y9gg>Cp5wp!kH$i5j8r@7px{T;IQ1|t-k4%cTft8w|p>mpX^798uUm^T=M z-BEmK{C@MivS2Z}TQaEOQ9H1sPkl;;92 zm(Y=(#XJtwmGbNqP|AgSyEHC6AJ<6eKfKV7ywE~S@y?OZVo)0QC{P-gwm54YgNH5g z-j}TA1b4!RcvNJj1{I;?S%r1k)h#@{)Gss8n7V+kZmZ|Dk##rRD9b_vYZnz@!{&u} zgb`LvLDWXq>&zQ?W!6<>=_csb^+S=C)*&)?@fd|IPp50fh_`rns0O>1kTK49&GZw=bDV03GCHDN|mHQsVEJa#fVfQP@S=?gk*FaI@u(NV`T&06gA0T8^ZY-@Df z^if6wr$~6o3unPKr`GNs5j#n@#X8xiHq8`fkv-cO?WCSVI_daWe8*SwJO8H4J9ZZD zRVMmV+ZQ8BW#Vqel;XhEHjCt>gDGbm-0f`$i`W}7CmuHP!~@(H@n&QrIXPV$&eKB= z*uN+jKU5o48>`D(vJ|v@@51n~16#J+r#ssVbQKnhH8@IfR-ep`|1g8@<^M2)E(tT} zk}!ip;zl0W!OO7#rgm`4d>qpKe~5bzxG0jY?Yj{aL_rY~#z93f0OpK2=NwTSV1SV@ zI5P+sc8#m(nzODsuW8M?t7~@6Ip;OI=Co%0&N)@pH6^%v-_P^C?^{0^d#bPhxvHxx zbx+!jA1oUBwvIK|7C3O|4s1M3rLpp1O?r`oWu3m!Wat6>%?TPXxgdX&(ud%84(r(9 zVcB;Y{K4xJ|9IrsG{g(P(fGn|0?lf8f7u7h#(H{9*h-|{-xRif zfj<{51s?HI+C>`$k4!fKwvtJQFaEBfy}RJCKjj^REvCBxTWsXepaNJP-gEwrboiPV z+Z&|sZ3SC{X>TvsVkH;=Tf-<1zh99>!OJDa9@X>kgA^l3_e|f5FZPe3yn?XB*dW+q z>}=S=LBU1)S>KEAL1TNTL8lo{d+~i_jNPP7e$qGd^dY)H6QBy5My5CuM^Nn394m>&+=8NP}-gO;%aoJvT7z`abDRo{X> z!wFR3sz9XlV*AS2x1A}jAifow5vXbmtVrp_F2Q1h#IYpmvB}c2xEOQAzr@9R%upZP zTGYk2;77`5^;qIcj zTQfa#xsjnP0>kiuCw!+e^I=;^H7AN%l--kbg225@hb@Y2VT)n}s?NcmNa@AKSJv?C zKui6vVq@Ggz>1V!?9ME9A$P6NnM_*ly{?*9gol>31C;eEFMO4PMJS+e8DNVY2l^zj zt^|2PiD!>7SPS^Q#Ilu%`cXAZjWxyMVobc3AX0kAfFJC|xbB(;$DqM6P}$))G&~MS z!t0-p0eyC3ad=A4%ltn$28?;~U*cLQu2W7oEoVelEoX-;TF#2@T25>B1T0J!hZ?|H zlC?gzg*BVV=xmv^Y!O+Yueod4tZXdA^DB~*PO>c|`!h0A1}#%N*3yd#IsA`znV1*b zLSiuGv6ha{;nhfbgx7rGf2PA)XIt3P8G)+F@F!Awu}84j)YAW(*ckT@5g7hYFZLK7 zo5@6(@w70tT6$JyjES#}ij-blyw?UJ4BR4fFQ19VipD|?|Kpn)Sq-u+beX{jI@g|X zu07yf!#SVG&h(7E$FTleC4L)y`4?V zw%1d0w|i(Aq3>c65pcX=9FCc6%K%#}0;&qY+EJwRybdxi9NWN411}A{H1N{?D=+lf z2ZN(X>3JPzwUOIh%iSTnmb+p$Ew?qtv+O54cVgCEv%WdthBhU zy3J-mLEv7d!x~~+*iIOMs=E#&WO}hLv)I635^+_3>A>PrOotjyFYcc_E)22%Rhc!2 zTl-&P-=o+*Gc#*5?S-}M6%AT;r+ixG8*&Y_6OIL2$=~qD8mpf}O#Dm+Ykh1BYw~;T!0w1wx-Jc{{UK?2NlscyAUhhdsOI9+3^M zDp>0mkqqcVk&5YC{(2--868@GdY*V?D%VaTE<&a4*wg3E38o z0E|G@HTV-Lz1Vn74zaymH19LMn%mwYnj@t~WjvOhQ5YLPH6>Dd@$qf_td1SyVg)j_ zdIT&k#{BhP;^NEx^4y8~_*Pt29~cuq$0bsF<;Bury1VQKJ96;L19U9{}C{h|F;AibcleK0MSl5JspMxm-T#1tvL_+5Ej zFpY?d=TVk{ZJ`&7i!o#WB`*Fx0G>yP1m)KLt8!!PKOO2hy>grW2j#|?UibnkPwB;t zp}57gUanEDeOyPoZgAb_ddT&>>owOpZjIgAx=qjgN9M0*ns5;i{>S%|vhjm$;W@-N z!N3^qa6J;@K;+U1wuMALNt9>fx8wRdw@$DvB=Ey=VxGu^tM&x6s1Hh!^5_)XLh1)j z$#p*7s}d=%POvQ`@I9(BXH+aWz-3(j9z?!v&~Q9?j!fmK&K*xbAekV3>zE{K;iY9RNkT z4IAvlvMoH^`4qUUQ%$EvPEKBKnpef_nwOQwPGGl$3=XH@jvj+;VGO(h%PVv*EQBEm z0{1cJ-3Xhg)u|2UZJX%Jf${+qjN-zE;7N3Rz_?<~&$x+FOFV#{i)1ASko*%s3H8aE&1Ua_7h2;9qb*k0Hcwn|2z%II(`Y(E}9+j4^~ z{K`u?Vu-k^hN;nk#l@I$z=@PzT|6lOO2)2a;ew+im)45=bcc_hrI?1+> zEaE`oOB8VXv^=}@)EoAS^awVXC)+~OpONsn6Hgd3Jj=u4^#)r;j1d_8|5zv47LtKP z(xRXuyqE_`5V)7=u8@{kDaV`w+J)%|Cvs+EusxrFj6xN@SyQC+ z;`e0nu?^tuLh!)!pT)=6;V_bklwSOZ|3!R^jf;1Y(u?2we-R&J@^x`M{FXCft zeB+f!>BaBM<1>w@cWh})jctH!;kjn#6=NRxm$=v(p{3<;({e!H%2Cln%VG7rA#T&2 zgS{fXfDP8_*cLhtA=;-zW-V8T0$Q$$`L$f|(yZj!9G(}Ha(!PblZeQEI*-MCNzpOp zNLHep_yQJOH^6EnC#XS>&??d^_mcl% zY>bQFRUuM(u~+igOe5-AJtvIAT4!~QG3mWqJaBq(*HK(8+87^Ui#EoX3^u#bZmMqZ zi!k{6*-9D$YKcv)e)W)!Hj~vBVvdirgtSbwnZrX`Hf-0pVMz1lZ92CKY0;`n`v%QJ zJG5@su3@VVA+hGLkO-sQ7!I-HO|c>22??0zm=$44u!Y2hnIi15Hr!`5T2n%7w%E`( zvn@O@TC}he$!f4$uo!W+|EqC;nj*B|S_WR;P%LM7v?)9$ z)M^U1SR*v{pCK$UGSXz#aCd^yYBTZOq0uH|1mrv75vFi!N`gHU5UpnLw~n`nqL$Htm%rf?gU+!RlC zSVAq{Vz66{@wP~dHO`P=we&Sdm?DtkA}UjuF~Y!)%4WBMb)wbuZLtYrnFL?m0A)#l z;v^VTVlBo9tsPa8A>0ygH^tixe*F@`&0>f(TBA&53~|O}b6jE^W^47EHqh!(B}y*{ zEh0lPd70uZcE-alOJY>C7H)|HOAy2v!}W@eiwKQ|=b_2T$y(D+hD00e_cuc+tntR! zk}`{`BhG9GzNBW1h%jSC8)FUFU>SvlsN1k^11;>ULyfaV#hT&`!C3q<26KFPY+{5t zKFUzmKxfEciG*r^i1AT+slv?((I#ssoYm-1QRSv&yJn1pf{8<|Zm=7pv{n{Fn|7@l z%gS&#OS~qmP}$~q(|=qrtbM&`P$|&+>5S-k-zYA%AI%nRNsNs!#GCp;QKO9s38r`r zMgurt(ZcM}P#t&@TGp*!0#1j?ZVbSB)S5tsA>0@no)~MSh8$@$$3nk?)-PCWozPf$ z-=N0&ukFyWBk_~rkH=WjP!qdutU26l4>k7<#j}JvN*Xi=8LFV79d`0|qIIa-m`;7V zr%jmRY5OV~G-rQOuccq+&q}b{x2HU=A}|{GlGLrap-#8??SCLmc*h>MnK|^9_+^yG@IS+7bQL9B;50 z9{o(9u5%( z$9Nc8{33YI3WLGV5+9pF9V^KMRl^ZBjYP&K+M@X&iKjt%E?NV$nJ9ZS)elrwqFvUI zI5sL|WGMdkZ)ISen@R$5J9aWW(8ySGRJ1*mx-lFtZ*A-;91jdOOraU!u)`gO3E6ei zhOxz%6AZQ_V}ikyUYwMeTmDh?_Ho3Nh^1~jo05_RG4muP@xP-01kCX>!=o@6!K z#ccoebpCa@;jl=a)=f;5`s7&MU^DkKVZE!T(gL|VaH16;=8*WL&Y2A=S(^Hbwm_Wseg2BpaiZjA_kB@>i z8LdY`VYtDe3dbR>y&aZGP$J%QjeTKKGKR&PU>G!nCt9s&tcx8RDRtUVc8qw+SuOFZ zNZXL`oWkU3<-=MU0o4!A6MQA%P*u@3JzwJ^HZ^7(es0|IL-SAj59zBhDdXM?m4j6{|z+jbV@YiRsvL!XB4wJbr zlr}Pv7LaKQjq4*I6QSLh4DpFj!Bz@Fa|d=iJ%Z?wkyc9_Ed6YD-s_>=ur`1t;Ef9| zWUTg3OC%rQC|8THS`rel&A>SeutWyvww#AEkS36REZAtZNN8kmD16L-qe{OYYPQ5M z7Tm7cEU_jrQfbNvBf{_z-Y+pQ5NZ#q11H4xw9JYx0kuz~adnva4OR;rIdp$Fj+hkl zW+)~t44~|Z8Z^dGbA+buX1$HZJ?dLu?Z(xT(GX>^L>TH*TW*5Ww`PEZ-3!99DGE2l zQA4Z2bqQJG6`o!cn>hm4kf_B8L4)U5eBQjVQHsGyEh9S=1!Y*v@o zV|a|M3@oLweK0eu2)NP?r%OOHT)(6!s}~Z5;-z*d)MGR(VOTi0%8sY26{?s{CaXCz zr5#_~a6_{VuPV(EWuUlFFVtx0LJn5Gl%t8!5!)_Q5G-1-2h(^L2c^ZP7;S-T2I?&Q zjInV?A^taUSk-WuPG=p@9ZsKO0)q7dt*EO*LxF2kn40uX z4@-Ge(}Gxp;3KAE-akxjWt07qznDQ<*3V z)VDDL4#N&hpa^-;ff_$r8Viij3E*mzHT3H8*ziC>$C@v!nYH?scxcj~6f}$sFnqxM z3@9puOo%n6$bOw*fmIexlYEjuh&4cR#lB7J{REit)C#2iqO0I?LtIPYlEEAmZ$Upp zB1{1MLJ02(@G{Y)$S#w`rHenmAoq(X2_tC)_u@0XLD8ny8bHtH#C|5LC4e_yK1xw@ zp`dz2!33m9n3&{q(Uo6z}#W+MsITwg}u{ zF!eQC5^ZqJLZ&6d^3N`t{q>1***i%NRbuizO7lj%XS$ z+P$#9 zaQ_KL1RO9UttOLBiBi~TC^bT>10!}tr!QBvhIAXuU`sH8_ls$u)|Hr37) z2MY=ql^mN%QyeAWs*kk}8N~3722zGsB_3arIX=RYgf$p|V|zU@!a0=X+hN$+0AU9Z zDub6qG%m;y*KPcQ#FQLvf`)~|BHpNk`(6Qffssx)mT+Q<3plmSd)ezmSqcay~w#OM0O8);= zXLy&w9fn_ap8zhTWfLv~4crcQc=?D=7hPH-zOv{29PXgAr2#Y*R{eBu82b?yio00i zqD_g0LqUqk4!0ZmHL9Nt&wZ@PZW80bSB)K~;KaE9a&@j>-r~GO_t*6mg1F724%fWj zvzD*V=rnTC+$@G{8YKd?Ms(4mpJhfv4Zwm|Q9>or&Hi+UIK>mYq3kq{gAr!`AMQDP z*kcF4y!Bx~uMB14q}z{h&j9a=;t0hS(`?;C6EUrOvWo=T)q=HC$fD8RNz3(Z z>);5yR%ZugjD>}@n0Xxz3ojDj2KQIHakW)l+{x15nhB~7*7LEd&fpJM%`mx^WQy=u z3#`0gn1HJ;;l%df#l9)t1YTzLQVH3~`f_MsbrbL<4pQM21a*15A*>XTuJd?SEWC6R zi&wFHSi&n^?6YYh{r(=lj0>+%u-C0%iD8njuwjQ__Y3v*fwu-QBD*1$4hwPV)ls;1 z{l~aCABvSO-F8YN7smiMd(H6D1r98*ZizP~IlRD$#iiRE=J+rg%CHYCc8eo=7rt7x)@5}1{vJ=hm}6rzzeG3FyMp0VYJW@>fEfyvpx&0Q4FJc=T67! zt9vy3+@%S@BBy5zw~<6Up;1H>9@=Uctqpm(;T4K>?C~NJYnLB~#>XsiA;Xq2aK2z{ zjKF#kZP$cK)^Fj;$ewo4fu(d(d#o-?dMHaJv?^d}*H*8oODVmcknw_G#>rO8wv!DcmN(`{2B*io5KZSR}F6 z>EV4GP<&be`|DK@Q4%IG_UgY>%h$c|MjPA=72}XTsOULxY;p)y%7w#OC>@iiLY-Ej zqOOs-O61#-FS@uj*XJxw^)`6F8tDBb=x&cuXAa&zx_n~dvNDwiJiVIhb=9|v-GZYV zbvV+m-~s!eYn;MP^lDP5Mo{Mh?{|)K%3H5|mG_ZeQkU0p(up3}4&e zWu1^k&$DiP?vik7)ROy#`$Ntxj~a2earo&=Z(G;!x;OV!==Im#>y5fwVe`mQNfmCj z(!94dy)dF!{+zFlHK=6h?e=HcXQv1#$pqHRY%{_*JgtK&Y8sa3LL|BuzTJUN|YeYofJtX)@H{Sj{%w?0RK zz*<@B94~$2)0o65zBgR1x}C4*n{<6}eD8**7iXLtoA2$c$sdZGUsP%Bwq0`~zbiO! z-8fU9@Qoib)_GI;!Y|GG{dFRyccaXvKEtAmEi``rY{T&r?|+=MBPjg(vQ?FOjz5&K zis$cx&yJ0E{`oui7uD-GSZ7-^ZH4FP@$+s>JAOIW#|IGs0Y0x6|5&H#>+2rpt529* z-6O8&xQS=I2L5=gf1z6IOAapGsBgi9yK7F?ee`+c#F|5nE;wv^eY{eSv(@5udbjke z6&F^v-Tt13XNNRyU(cV9TZw$F!Z8A~oZVEVCb;JI2^&!vWR zuimhjcpg`v|KiyNPHp$z-uB+3CWcX?UQVsp-zRgqcRPR7qVHYEY#H-n)Seoh3mi=B zP`FW+ZbqMn6%Kn&?eywh*Dcp_od4^OOP|*5InuA0m*v#dusWkRRlZVvsCoRMpf9&w z^3BT}clDM3^2PJ=Wa}F!N}_qJ0x?Hp{$Z-JlXpzgYI%@8$P$ z!HQnLx`i*U(B;#!h%7r&UxnGtr{nv^H4bl9;PGMGki{uW-)^q^xURLDJ!WQuOVx^Q z{HfxHT9f_mxo!Ws|Gl6(3o`cpvF)28txpt;>w3M==`Yo<^}9Yc+2wpJc^H{)~XhK&iz#P5#4L($$oVH~5#_MI< z-QEkI1h_VB^|9$CiwFHwCVc#Xg1_dnQZQcJq z|L7GlMdCL5( zaRG_Bi=3!#tljczk-g&i*616b`gCc#O+2sNU|WmZ5!S2X`2IS3EHtQTj!9zwpobkB zWy)^*d3UD?ZQ4!ma4f@sxN$*&-?wO4d+zp_cWz&LuGT%=u^<%?!!Ch-kyWG3j z%Aea_-}tb$mR$2q+_4$^zl;g~z4@)0p8IRZT3lMj^gp<4^~gUH&R2Xsvz)JU)5%*F zhV}N{`Qzv7#X_1@N?m?^;Yuc0oV;@;~wxY!>}w%+lX`RP8===*->Q8gv_# zKg-~h9kZeqT=1EDs%);qMPID*sNQ2&jribhbMNoCem?)Ti|+2z8=Vgj`xCR2-qC7N z{jhiA=alHt{d1_OhwVSOya_A6Xt`*Y4@!IQd3v)*+lM2X1$6FI)gsziwT2HW z)SJ1NQ-9pvxVH~8$M|jKkM`J z=VQuu%{T6o^PvOrH{3?|UVrB8V2@*MxBEBr-*PqQ?K~kzlEz>BbbofYDdih1i1*sO z{YL$s9WS{)9r3zLfv9drLoP}s>G>2hR)6U7PuccqVxR|KjuI7HXuXD_vhA3{__|A_m?WeO!j!}+oO~773j8o zUDmU!PJ|8pW6>|idoS+)sZ{&PzpoqhuFuqcZI|u;shsb*t|5zFtajah>2OfaMJeN^ zmD${6?ycdgPiiY4yZ!3@L%*YN{N1t2g$8)9 z7@oV&)U!S3zaAPger=uisrheux~)viRX*lss=m5j_3%n1UE%2&fx%U@SKU`{M z^1g4r^k+u<>Y%qxlO_fC`DxJI^R27Ad@{J%=Sx$D6l!o)w1?fc)=wH2UUK5^k^$?F zAI-5Xhb^JwoJ*ZIk1|~iZL?|a_{wM9yIUGfK2Y#M*fk&Lfg1|ntW>JvjaSEfJ8T`d z^2%>*g@3gceY!0#*J?2Ihi;4iEz`zkPbQAZ(!f2?wO`!r!4q>o^v`UrH+u7-QY(%$zgT<3 z59h0WcA8Sc_$sn~rz&M?G^k=~f1u@xr5$U;pIWtM%fNYgIyN0Aj&DzJ_@%+&1@HZ~ zW8U+X=jt!HbN4~?!v{Yc8M5kNp5*1-vox77xn})VdDe^P?}jg*^`qPV?Be;`0Tph} znVNLD!-&6c=WkZ|{^Xb6e?Q8+zI=SeEI)l&-*3A6!rF!3Z=BxSoM-G7@3-|2bLDZ##Fs=P|f_g&`lZKh2!5E-~-up;hO!TQg(h{hgjCyv{wG zQF2esttHR5KU~aIJ9XokFL7G%;^5+q7e={!++F&L%`)|eu`;!<`C^fc<$UQ>}4}|{`9PH?cguA`_>^jGbgf@#)E+4lTOH4V(EkTlglf-7GA4;a{c?->mOTgeLuE;trAO)&F%6y zXI$y&FM-pZ^(RfMr3?q9M=~kga;eyGt!UkV%=9cBBZqv7S zYvZyq`R9#A_l_L;SBcc9GV@k=HuGFlv&ia_9qzXEwc9Vcg?88#*fRfu)D@*39P~Fl zxcKvz+j(4fC$?T(zqfV%$D;ezj-OV^cX7U=rNd62yLj+v%g0;aXPIgW^xNF6?ez0L z>kBq0f8N*rA@)FI*=B+Fr*=5gyYWcdjTf~Kx3_uMs$3;*Qog8?{_Pj8%4=J-KI7|t zcS?qYj>+)L)!(*WIgqu;`;T)rMy%X$`p>K$*S?fFo4fMnF-Nx~WSeIBd-bkalP@*S z_*3sEpRdhY{9%^Y;Wl&L?jCUb@SRqZ+8H}}Pt5+)IBQP#VmFd{U2S^h)Qyd8C(hWh zdsb2pw=G#SojP0f>ezv|emK6d(Tib^H}89H88d79$hna_TbIpSzUYvrr3YrSCbl?z z>|m8yvQ!-}DV53+;XN(x=R< z8Pjux54v9WY^z@L=C)bVIk`an+!vAzSL?Rt>tppI0>a(vE14?-uua?z5}!-@BL9zi}<_ zmop0=9S&)?Xw!=Pt>@Og9P$3Ue47r}f1|Ca?p!l))yq+Sd++xR*;8am)${!lhEGcU zZN7WU8Ruv0>USaNVUNq38#X)Evr(V>HT_iw*?iK#lJe=_ib>wE;;7j7&yhX<+FEd@?AIm zP&C|S&Y2U5PqtMXxBoAn?`l@=+N|T0S{ZL9tq*YD{d1QBZ+c~K*63r%=3v93b7OZ8 z>Cx+GFVAwvvc}bZyDU?UKk|mwsMTW0!CI?U_h}R|$$jefLY{|aRNH@LUCC0HtJZro z>gW4oKPLP&)1%VpyPL;M{n74n(ckD=DSAw)%vpy#IpbcX(ZN!)_w=86GTHp%@x<$c zXEmvKZtd_ckIjFtyw?2V_A2W?-#!uXa9cvJ^F7XPD^Y01!J3~kZHgQIu#i&@_X1r< z`Io+R)a0@2y8{-dFI8KePMOo*C)RIF;d^;v498FJ*m!A-%hP3^ISb$R(T@Hwqf~N}|V=;~fQ=6n3fe0OMT^Q6fQHnwtDdh115Ie_v~KEAivy>q*D` zYBh}M(Kgfg%3WVRc|Chcy=z;7c4lsQ)3Bpej(itX`uV~KONyOMI##U1`MIW(dt)B_d?h-u zR)w0z>3_7&Jfij^?^3CqQ*4cWcEnvBTDV+L@ir%~4EJ51bI9e)v;C}j&-8a)c_{kV z=)X(NnY4e+{N|Ppd9s$Rl%e~)W6!_K;s4UJ?1EAs=bk$Jed89c@Aj=-I(O)tnRiw` ziLG3}u+!U?@7p*xd$+g7_e1ZVUFCLmPo6-kS%PoHqf`ImX+#cj~CvL~&Z9Sh&ahaBqe62={kj6gU z3m*NuM1jVuUQYch=G2nAms^PsF4e);wgSx&vr=80zQETvI%{-%v%GzzDbxXYXsmDER3uXQv?CR8nAsDJ(InSbNOGPf9sEZBzE+lRzuo z)unul?(8H!Q#G}$YZ7JC1Ab@<6KS+SJG_oxEG`~%aF4T79l-G8>k}^TFThIVsL4p0 z0q}@hyW~t9( z@q?p#ht8OtR)Zg6c6LezFK^h|(8#rHS`E_9P9gXRe;apXg>RL>nszKRe%Xw((@q|4PhZOL=|5Jv;r=Gtq z4-^qJo4IE0=A-c40AFkHV};I6_&rA!*c#w_AT_N9U7VfpyZ0Kw*3$|0^Jz6XNRta5 z(IIF^hI45(Si8Vt_Z%5#K9W{bf;2bb5xR!f<;o9_ z(rWxkBl;=)DhxdT+N-3Z(H6!U(`xW6IXi{pBmB*tKDb_5O=;5LBc^-4T@Izylz~0Y zPL1Ia+u@5kw^ygtK$io}N_d3kp-q_j6Evu=%N$6Wp74n2uO(N~>4QPA$Jq%66iU8d zd@H4m14Aun@Y{j0MFzV(fG-jM+N&IC#JGC!+}{tG@Jh_e}s38~7oSg2<>0A((y49{Wya%EqD;}Jd@ zy5iTzRfRP85${Y(`u@crZ+sI#@cAuv$PrrLQvXcx|SWlO6;7g$TcBhu?SE`#RybsXI5?1UfD#*z9}Sm=qgn!2QE0*{zJ95*GU z)zpJM&QACxF*t&>I}^1ft)@O{@GG2(z*fMdo$JzS8juFRz5qwhnIlg5rqwhgO?fyJ zJa+4pjl7=mP3e|!$f9I`Hid5v6VEjbb1)g`k!`UYYyp@m!9K8tgdQvjO7vA3CtgVO z$ls;Ofhn3N5oeyr&?y+sc@mlfB16|)N|OVFB~OC-EHZQozax(&p(&Flr(T*I{PlU2 zib<0*I!(?Bo|9Pp6CwQ&P{t z-x6U-9M@`|lMgg(^BB)5u2XM#PF_7H5A-oi1@)YoJSRZU>BVyj>p96h$4k!{&vQ!a zIlu6n@_No0o|8k*dChYw=sBL)Q6c5hb4u`>{CZ9co>NZG>BDm>>N%r%jzP~^#B)mM zIs18zuby+C=M>R%KJc8JdJg`!Hzp4~rxMS}rss6vIob7`Se}zr&l$#ZWcyjnb4ux& z-*}F@o^zV#6xDN{^Bj01IUlvM!(51|n4S~FbAt4o);veL$MGB=T{D*F6wq^4@ElJ) z=U|#RZ`0)D#Y;mp4SsPHjDB3D2pe=N#cVRrQ>^ zJg0`9Opql1alHT$N(N z6G=JcMNS@(Q?4v7fgu%wKhjhX8r-4A@zZl~4T=fxIgkbylaz3UPdSxwy^9G~Ml4P_ zT;4*$D@2yVGc;WDQ%+Ukj_VhuDa&KyRSe}+;YHR^%P4W|=t(&hMVwqBr<^DvUgz@2 zu!RX%_$)`1r-aCe-ue0+Z!Ev__EQ?1W{&wBXk2nU!eGhtJ&b)IlPR7KqkyA?@U@ZaB{h^&q*1(D zDqbi1_??l|bWV{*@oJ@b4ak^(t)y0QiZqH>YsKqI{?+RwwVP9E8AhS z-bvjhRh?6$QM@`3<>-}1_v+3m(kNaX6|ZXNLh?y!7^g_1c)>+JFClDbyN{o#TuAp? z$tlt(UY&IcTa;mRpYxL1$0^b%UR{V1{mY|Vr`3|W$|=$)UR@P0m(uGOO6m=#NTYal zQ@rLIhyNuhFAvxWi8P8A+{SV^U-KUY{U)i>oFa|l6+%=oe1yL`3BJ!I)sR!9QM`I6 zUOqc_JeE`_r%0oC;Wa2557Fz0v3R_sQaD8##Vb_tI^XaYm@D}LSewKt(kNcNh!V%u zCgILzNv+}(X%sIUf@Pb}^Le*LQU^Fi8pSJ&C^1H<$90QSq*1)W6|bM7elIV*K68pR zidO_t*bXr*H?DYAR<8{oPnJs>#S2$2^0>Oa3-OXv1x}Gh@roo0j|0T{3 zMHTU=QDWQ}8t%C*i|#dpQ>0P6%!=1W)4L=|{mLoQC|TWO;x%ON@pY0a1b4kKkw)=~gIrmM zE#LfFSWI+_j<@F(kNaw#jEbHj#VV(%^Njo z6fe7ST;YE8hvn71s&k4oidUlIb)!nP?2-!O6loN%zC_{r9MkgxbLJJ)y;3TV0$d&8f z2Kl=W4$zOQ7NVyM*{nnmQ+Vhkw)jp8*Da^>3QOL#3$Nj2dVX%w$iqC}eyc;B?4q!Kwr z8pUfAQR28FvnCIc)B;YCM)4Z0cvajz0P6 zCg~J<8T(XiASstz7)jGeqj*h*Ts8vWemt%cx>s3Fkw)>FqEqNqpvdc8lIq4O(kNb2 ziQ0P6X6O_iSMQBa znoH_Ar%0oC%_K^!ZHlgclq;w1l_fXqghU#}YZm0nvDb2AcQHu?af&pG*H1*1!AJPJ zx1n?sNwwn?X%w&7ir2N9k@qB(#3|A!UUP`T^MzhR-KWf!)K8oujp8*|@#=7`b%3OH zaf&pG*F2&Mz$1X?^#VbdKvGpW1 zl2fEnyp|9p&ew@$V>U}_Ij2aYcr8`D;$Hj!zlADB(LQX zujPu@u*!A2ODZd$>a*8yH*DpljZal8@Kdsp*sb`!bjpDUd@ruq_xVEIcd|)Re(kNc*AXlz!+BHw! zC8_e9B8}p;o+#13oSHUUAgT78B8}p;fhciY&ja1sNy^SC(kNaV6|c9$uDD8S3a3b; zcy0QJ{N)hHLcByj~N&h3L1Db zFQqN;2J23ErE+~amfm5VWytct!IqRj~P0b*w_M9S(a$MVq5?%|JU3}%Eds#U}8pZ2( z#S8BqNNN_RNTYb|&?(r^{El|@%cOhl;S^~Uubn!Db@=Nslar+Ga*8yH*Dj*Oap7GN zZ{5o+KkS4=8pUfjX?AqQuB{Xl?(Kl4{H;(kNbg6|dq=M;wq; zG^a?TcKLsi%CyCwA#r%0oC zog_-M!x|-ctJ;c< zk}?#8osdYQc%6k@XD2c1wM-r6Q1f*;MHd~y zQ>0P6E+}5bi*50eUW+(I8pZ3PPQiv&YyZuWRrEH$k5i;kye{b!j=klpe%Du0_c%ow z#p^Orq7Hj>T$vy#H$L%_M)A6$c#R+E-A+=aIYk=9>nc%V>@8l<`JJR%af&pG*EPlK z*qvNWB-Mvgq*1)CD_+|VSHB{u$($mM;&nsu`tf|N>5_t%!YGkO@%ob}(Kd=?tM^<| zmpDZl#p@dPiq|d0YrwPy4<%(N3_Br_M)A50xpJ<2pIZ2ar0R2u zG>X?9qQr4sJ5}Xl2fEnyzVPr zC+j{AkG;l>Cy*<>+O+xJO;R%q$Y>gA6tAa{>+EEJM@;*hzpGeTufuHy%G5}s9M?10A-x8D z*cc|M^PD1$;`N*;$F@;h_j=AL(kNap6tBm-XP1;zL0{Mji8PAWOUPAUg{h@`HQ^L# z6t7oAiM|}XHFvnA`f`diiq~t!Yw6(DkE`ll3pqs^#p`dy%eJj_T}kcZ6loN%H;UJm zxp}hI(7o<*iZqJXTg5BO_*w@fm8}TughU#}>mB6EHb3h_P$5ZG;S^~UulGcWI{anU zn!1uQa*8yH*9W4+7+m|K zNTYatR=hTZ&NWKv4W~$>czq#Cj8VHImRxhyy*!J;PDrFtyl@#W`&W*m-WerTgHxnY zyqt&#tazPnFfv+FD>+3P#mims+Isxz8cCht6loN%EdSv3 zic_Rfys|1@O=hiGCB5?cv6?51;^pxVUNt#I8pX>~@w(qOUq9ST*&pAaJ#S1?f zC$E>=%ou#Kf!^kG7iTq38pSK8;+4rX^SPv|af&pG7k<*n*~tJwVMFUb;=FIL?$w=B zq*1(bD_)8AX)h&}#3|A!UU`TT0P6@+n?7gC9(nRE82zL6AtJc;(lR%Nh2k9Leee+HP{oPjL$kJdiBBt3u;fva{f`=zDnXQ$ z>%P3m6)LIjoI(wYG==A&T#e&TalCn)$;V$06%4$N#3|IMR7s-xa4P(}RkI{@ic_dj zsZvCF3TpIxxDhChG)pO#jT)6IO;iC+WyxMNpQHjfg&LJAqj(*@GI^q;A~=N_l?osV zR|S|(-`(Os{lF>Is8parwR&9(ZY+u8TE{8Ws8kS9;<(Q4%&<&S*Eoe5l`2aVzulm< z&u_L!DpzS%Zq%q$IimPbsGaFQ#7$DIIE5OODo<247F27V_d|0@jp7t)RH_0|e8SUq zk2b?CSWz1rIE5OOsz_7-_d4HU<}gV;;uLCBsuEF!Id!4i#r%>gR)%GxMx`nf#j9Ae zd-Pc^sqUOYjY?G^%7uH)KKvz2Qqwtw8kMR_RAo+GI}9)8fP$sfoI;ICRU^uS>wGr$ zZ!f94oI;ICRVPZ!xmT-rrb^0{S1oE(ss>SF1ZY@w=S4{caSAmmRgJr79sdmA-#ep($3Nn*)za|$&o zRiCI_oZ4}rV2q@$atbvn)qp6`HVpY&W|CBN%iCuYE-H*QDW>pSGDqFNe$-|YE-HTQQ4T4mVDPZR#NLZg&LJ=s!+X7 zfB#ZaS2=|mm1;&5Z*bbjxrJ&<3cpVY6KYhdIZ=EGr8TrZf%#Fi-ddbOjY_p3svrxh z4N5rDSyDqdg&LJ=NfZq3lrH?ys;{Juatbvn)rzRhoQmtdt+}M`a|$&o)tV>+r!GbQ z0tY3I%cUI4MvY3fA*wE?{xBCFE~%=VLXAqbCCY-UI>af|s8k1{yf~HN_@FzI`ot;Js8mOyd^zRoQVOO`QHMp! zvuxC;R41acb1IALPN*0`_2U$3RH`#kqNlVExC4`tpyqH2H7eCbpPD29%_kQ*n?q8?E3m^wjY@SVO3db0x_XV5R1Z#}Mx{cC z5@-3`*4nO;n#L*As8kQ4L>>OIW7}g%o#GT~RH`RYa4?j-#@}>UtHT?ODWOKCLWvS% zZ|}QhI!Ui$6&ZyZmFh)QZnj$+cyrG0lIqAQ)Toq^C^2rl8#-^fq*6JB8kGtoN*tGI zSB=AxTF5EXs8l#n-n@iuH{p)W|p+=>869wI#(we4D7U|`~vr(f`F+}C!)bV~r9a|KqP@__@ zM2Y@Yzgz8O={1y7s8OjnqC}g|m^yohq&9L2H7XTPlqlh>4Q(9O0Czcs8kMpTB}VK# zexVK{Tkb0Ca8aXD2}FsSzq@S{1Q0DMm{X`xsXj#I=5_efxyer@)q_*0Q7NlJ?I^pz z;o5vGr%alXyFwK!T-Bj%z{~!WP@__bM8Tv*$<;4;o%9N< z%5qVoQhkXMtK|tXN5Ui(#VORNR1#6*eEGht=`h32=M-vGDw!y_=%Vx}bjfeh>km$$ zMx|1S5_R}yiR*1iz2X#VRH`3QqRlVs=g~q^fz?am?fkcUs?Sjj)agw^iDb%RccSMPC{&mLb*(9Y^XXQqXN_|h1 zIA2R+a@UenaZaH|r3Mit>d@=Qb0;L#j8mvlslh~v;|d6Bb6-+JIE5OO8lq5DR{j2~ zq*ikZH7Yffs9=7+D%L##n_>hw#VORN)G(q7acbWCtq#{j-ZfY@YE)`CQDPnS*;sp# z^lHi})Tq=CM2WjSxqaRLlGI>Mp+==f5GAf|79A=M)hUi^Bd1WKQX`4-;m2jJkDuri z)N@XuMx|1T66b5*nTDMuRS>SKFrh}JMiJ%9c5A&>Kh7_yrkp~JN{uE;^pw3di#v>L z!#RZ-mHLq=ah4PF6fPjW_Hqg}Dm8{EQ5$|`PS=*yM^2$erN$B^`j<9(aHOP4^CF-| zrN${1=Wum1f>WqbsR=~Y<28S^g8u~RwTDxvQK^YU zHRIH(V#!c3qHVnA6lzpzlHzshMqik01yvr#5KO31smVl%QS|2Tovuo%H>XgeQd5Y^ z!h&kq4jpor)O=2%Mx~|_m621AP9zMI)DBLeMx~|^<;JN&%ilbg)HzO}Mx~|`C9ZDl z(XWKUg{qf#@7>cYLYAN^ssq$)z2#Dp4^nn@I2K5BLIRT?2F3#U+{QnQGHMLea{ zY@PQ?Y8j_cqf$Q+C9VScw`=ZD!n>S8jY`cXsvP(FP-DVk>E&66Wur!=<`9*aQ#&^G zEhMQ%oI;IC%_Ryh3n|S$y58X|_vaL9RB9ekg*i3h*K#K5HJMYWQK|Vv`Ee?L;VBMn z{s^Z~qf!fq5^etT*e92zSEjlw7;02%AyH5Tl+H}}4O)@tUoAL=8kJf^R6b74JNUY+ zq{eXyH7d23C|^$9uXg8QH9bZT)16-M6LXAqTBq|fzt!;bqDMnJ&IfWXPT18Y7P95HQX}F}? zaSAmmwVJ37oceY2-vcEzmQ$!vsWn8wsijn{&6rk_I>af|sMIe+iTTU)Q_2`gec%*o zRBA0zqHXlCt-CI%Y7JNkP@_`oh~kSFt)TI{Ns@cRB9tpV#Lnk8SJnk@@U8?)Tq=ZqQnRgl{D*t^lHQ@)Tq>E zqQshQTInnftCaqnLXApoAxf+&A3r+wT6)dn6lzpzD^X&!$y~HftfVe*3NufEOB^AIa)Tq=pqQtzMEpS4#q`GqoH7d28C|F8T zI{tX_07*^d6lzrJccMh=eS9R=p?@9V6lzpz2T^|9Yo5)=Lwdd76lzpzCs8mZP;z?_ zd_+>E8nax~sMIc^ig9X-Wz=Iy899X-mD){|SOYBbuDDN9GdP7BmD)oTT!K<^KG)Pm zQoA{Y8kO2hl&HhIqnE%SC)&m%PN7Dn_7P>^UTrV6+b^k{e3(RyO6?~~)JEYhCE*^F z@M^*-)Tq=SM2TKG;g5n2ZGHf!P@_@@h!V9?*8lV_>9v+qs8OkdM2Q*p){-M1Bz2in zs8OjyL>1+=(V*7);gZVHlx3qvr4AD%Rz#`wf9)ix7MwzjN*y686ZhIuBh*(?LpX&R zl{!ikEaE8*Kh)b(QZqS)8kIUmR7FmCw)wMzq&9I1H7a$SC~<#d>zd))B=v+-s8OjC zM3v-TS}*@IlFHSLWur!=P7)J(AcxL2T4jj7UW6sJ(5Qm2U$ zZR19Au9=eB&neWX)ET0Jx!3dWoUTghGpA6aQfG-0B}^Hbv$v!w^T`l3Ds_%1ST0a1 z&}gbd|BB}nYEDqC_3O?-uJOsU%LJMy0M01ydcRie-jA zmDCzep+=>y619R;We0bCAgTMDLXApYBWeVv8lAqfR8qbzSvG1^>N-)SIF+I~y^>Tn zPN7DnZV*+3Q%!;vZM#Oi;ms2@ zDs_t}G3zB9*yu3!`g003Ds`JE(GGjhZ3LTQPHE36)Tq=QqQv^}X`z^ok{ZS-)Tq>5 zqQojibIA)v!fQLHP@_`!6zayY{SL?Vj8mvlsry9v^E%WF!%WhvL~E9f8kKrL6kLK* z>RKtoC`pBK3NI)OJpxMx~w;B~}jA%awDOzus^PH7fOjC_nC1F}cPU=~b>R z%SMe#y(CJkqjL8WqbsV_u{ z(Wb^95yvG}3|5$!P@_`t6h5ONjw^mddzfBCJM6+K%up#OqQvZw#kIx>NsZ+cYE&u% zQDS9YWcKg-B(;lEs8K0r#moOsk8P52hWP~(YE;UFC{Y{hN^gHCsmh!}jY?%C%0MwS z%@*9yQ&I_>LXApgQoLe6{N&IM7jX(TD&?wBdG}ZxdgV1vp+=?Lh!SIOHkbE-vV?g% zv4W#Ur7{yGYQDh4mJX}s2Ao2TO1TqNj@QOtpT|y=Ui~?R8kNdIlxQ2z7lxjc)Ot># zMy0Y6CC=A=?^X*Wb%Rr=Q7I3iD)16kf3wt~f8~R@3=?Wp%9E(7Y`1px$aHV%)s9oB zQK@W1)#a2={`C&$E0t5IQK{@iiTfKPS8n%`UOPF38kO=QN{qb;FMolP09lmYa0)dl zm4hg;f<4rs(=kZ}c40JXRLYwu1KX`V@&3V~HljF%8kNdPlo+Fa``nfkEXW*Ap+=>0 z5d}?_(z>?CZpacI zp3Y7N3<+szLU!mhkVPq(Q*3?e_`9w?M2Qj}F7@cTq*ihYHL6!WqTuq0(vIStAb{|? z#VORN6#f>Lvy-U#kcyT6l$1+177H~hRe&hbD+^@1>)=(MQ>am?f<%croHXOc4CxiZ zDb%P`A)-XDToo`gNmAoEg&LJAta$Zk+1}wSAK(;fRLVe9L0*R*^9v7#EU8MILXAolA*uxTS{!v}h@?7k3Na?{5Y?q_Hha|DuurX>g*(_Km2?KOX@DCP@_`Ci4tw&vfX@NQf?uv1gKG|5=4nP zW!Il`zeuVEr%^65ux;pfC5T(5GBMK?U5F1 zTqsxTbX-KJIo@n{e69q6{qS2xi3yH^@K{T{$uT3!WDm7L8NSZ5rz9wOHoMVkw>hd3 z@rP{`O(Yb@7VW5sjx&abrWI25H`G=W{s5Dxh;Va4G}N4OTs$w_nv#%4XiT(6hnnJP zUnu-|_1A%De}pORew!^eG(6fA9uo>bxDBUE2jz|gQ+$LuK1$hx)rV);7HaHkG{>gd z$AUpg5{&USvn4)_AkLT^YDu(n*U$uGO031Gx<^CvutghVWL;yKtfqKVl*Mj#JO?cQ zD?G_+b~sHavB80a8e>gXduW`=W-~^qk)e&)Orh}*J2FKtFa5@NXoA%o50Fh(f@8kb z;lw%Shb2bpanK(t4URbh4jT_Y(rSzfjWwxtW4A(uQL|UhJuAK)8h)515spHaDF)Dj z(BK~>cBnX8sLd{WBgWS28oLhc{knFk>LTF>ogAf+aOM-OY9(TzSd*yVP^CMeQG(T! zV6>VX4AW_Mtmimrut15j7h)i*$rzDdn~gNt!=s^|pqACT!H(<@((zP67@A%)ATp0s`PfS zvl?rTinfP_TjCO8VW3v~ARJ2H(8zyQU=*deTu*H@&S9X&Dx|pq+CZ!^g^fE3>A3f+ z;S*soz~?dUN$m`5JWQKULo_t4&;$z% z2T;*U*?FV=)@}ylkoQmYH}~6Mz=ClUjsiO<*el+=*YS~>jd6+q_k^gG0$J$_; zK@rE)I7@^H2us{Iii8>{FZB4(cw?L#ufpx2i8!u1%ma|cel9W8EXVHukGn5{kE*)c zzF`6c1QHMxwAP?Oupop$fC!p=S}_zs zi=|4Bp#=qt|2t}tFSYgcOfb)WUGWj1b6IVBs-eBDZV^u!^1rDQ+P|%x4Qpx_wx9x- z*+vZB>R4T@Yi?SE7F*ZWwxp?ng~vVNPSu8jL7eJ%RE!=)&uDn1Ni>P1oM=T<83SV* zE10@;2OO=D1o`NVh-wNS9iXLl+PVxWl?v6Utbgn9(U1uaoeikVO=(@188I&FYF*aU zT3=?=3L4gyvF{;@PSEI0t!3q+BgbVqa^wUjWR@dGRyZNE9655L6Ee#&D>+s+>II&a zwp{73QT!z&?DfdMLm(df#Av4VR1n+qr zvLhSeAjBFeSd$0`Nsh2Q;#?Uf(vREGJ{PUV>&?GWjFGa-k3 z$P0B4Yo9zhh!VUV==M3516}au88%7KOag%CQ4atvVe-Kw^Z;;30-sV@b%6$lG`Mj{ zPF^UFn5Yx-f_XAsg1KZ-ksd^{OE8x#>Y#&2b_vd#$@!ZZ57_W`5FkvO9g0TucMyzu~2LP8Kmb-(59smwSXXo4sx7v4g#$O8@Bx9ASxT-AVk+}`6LM5yg)<^Apo2-gaF_Y z#Cj(HoGPXO$Vvj%df38NR^m-(9Zu5`r*$u#me<=zabAFt;=BMO#d!fnit_@vgo?7f z04|{i0GBZFU=n%&a0!zRCZPuamr!{y2|WO8MQPP*`%wY+SM z$9b+$YjF0r32Li37sTB*+~*b!_K?Yz8i6PE{I6Vc;7fK5`*I9`C|tU~vU1!o;@>;h2z;bRwvO%7d#JFJm5cW9nx;#eSmJh*IeyqO1oK? z`LmJp0Bj=kDMS7(LYuUMV|fnqygN9W*CDrPE}QqPZe_bgbJ={L<5sp?G?&c>E^cMJ zMRVD_^|+Po5?x)L^2w?4a$h_d_bRGSmL=WE7m(vxP)TT!xJ-ev6K&O%?1)wM#OliG zGGDNs{TC){Cms>}Syf%;Pnf=@G)VS_{Ygbjcx4~x6|*{V4yC%HskO1Kx+2!q*;I%B z0y9E^>WXMIIVUcgd+eC1(Md`pUS7W(4Jp24Lb(rE?jmHiRTn+(U@ zhN`DNAt!=~pb`&iGFuF&uEdeRrjCYsQ?xfGhl0^qB{Pf>_v?99P5fKse^7 z2*+5YEA1?$l}l@zyBaKVGvu~3HJjX|9P-E2L?Fnbs^_h~LdG)8MEZiVHxy76 zEf|qoQ3uTJzUoRG+F06D-+)R=m4mY_UR>7ViJ(6gj>!vZfiX%0Ck&A^91j!(m^^P% z4##~-B@$8P1r0dx2%Hfyv_idCV8S33j`9Hnvi{Azv=1^$#K7$3`XKH*~<EHuPTXnP!7+o zuI%b0NzemfcFL@^wwZK-1rNzdpBjm(p;#8&SP-X}2n;0HAMhvqk)VtNJ55yKAheQB z1R24xbSeSGmM@wdONPA31d7U`gs@?Tv#S(Ov{|ObkoCy!CNrWwMGnSd(1uaJnST9* zWA<@nlS5i581*H+swUSq;*6b{`J^jxfXPJqG&!us626cZ<%jZ4&WMNX1!vV&cKpZW z1-)`29M{63;D44XZ%~d06QP7Jre&v!ovttCwDGt>uN@!wl?4xW_9JF z+IFl?T1Zun1p|R#(Cd?-!CMzviLOj9qD&U56|yxLOlpysPmU?R>Zw%i8c>o|RGyYl zsK2lhR^m!TRtZ;GSKD0Ig+ujB-O$-xn-)%@GYG`J=n-r>&1jFLSxvb~>dySWq#CxV zYh6!fsg$@JMEy~tXyN~cX7H(?CH!h65|yn==3~7hwQjwGB+W~mNpn+O6AnZ!rIXZV zB+-{d{UJ3Fg*J1L!Mj){0aZ$`#%2i2*Az7+5sUZ}Y9L`YHq&cr&=-hmia#dLR8aS* z-I{)={0S6kEEW!DSCj0s_$DXdl|!m89`XjDFwEv9#*6hhs1M6YKcKZOrPz}dV+Z68 z#l74V7?=J2fExE|0a-uNhU^n66Y>eI4Q&EBi34>xDom3@k$@5pCsEn?p*Y5e?r3Z1 zM15|9j&7;NiEA@VuNUexqQtxb#Y}jP%JX^Us1l9Dyy%$nr_>juR2hk+g10A={`PY1 zV+F3r-b6T{`J+}pt}juWm?R*vNZcFHY*pQ{0;5r&Z;RRLIXk$32+`?sQy@lop?EM9 zQ(^(xOBKC~UM)Z$)`+~(--e+92#vB9Sn82_z<|%MdgB^~FzjqHYx*s$FXXy8jS*vY zWn)v?8j7I@3~OO;I1vxaGzqeL+$KOfalVx+b~@@w`nb)Er&p5`J}v4Epkd)WXmdkj z+8BUx)!n)vwXC+)=4eurP*4~s`r}Dko;hX)R9H+^LMUCoG2&ZPi<*)%>{FpfRKGtS z_sWfQK65GCEuujU6g`zY8_QVfhMG@A0^w*Z1a;ck%m>JvNfpCn+dIA~e!m)rB1p2R zK(?76L^FugB)xIfJ}TG8RTj)I$Kr{wFJ@IIDoMV_ZK6<{Rn4n=%J)9 zfu1sIFFHr8&o67CxK9fOf>vvXep#4aWE2XoD9A~(`j{cb(9I;3a9EAl%ZCmFm=FxL zqQPK1u0`W0bn^N)5{-U098fgYYW0yUWwO3$#d=gLB-Hf?f=Q|hRH>o3IEM0<1_zvI z#?7nBeqYQN^l1sX7VitxnS&am7_z!d3r` zI3tag!465A@rcQhU?dg}sv+6YAMHSc-iU-Tgk{=~%@gf?uW4vj`9V#sui6sKDkOmEdab|6EQz!Hh$0OV6<))S<_9lZ#!ptKS z35L*BW1eQq5nf8XlJFOASnt$e5z#pXH4MUoNtxcIq7&szgOc`u%CXJ1c@;33tdH`= zl5sRx8;YONw@?u|8jpmc2}I1EUG`H;7C0%Z7`7&Z8XFfm%nI{nnkGk4nlw$bWj71N zAq}?VhoQo}5vt_oRLC~-ffl9r8_imbt^lJ3Grs;Xx@n&;regZypQ+V21w|#G&!kKq z^a)BhrqLRQe&Uc#cRRbRc@~swL{(${U_fOvZ$0JNP1Gxgl~4%F0}SMxtD5W&VzlWE zvc&;CR}Y>yh-FekM+Y65o2S_ma|QXI#Izg>G}L)vn5p*1(RPy<@+af6F*VgE zy2xjYVCX$J%4%aS#HK<^t-`|WUyGo(*Pw>81XQAmL%)+sYHdg_YwK8I28)q}->Zgv zv3P)33-Q_!<_4xdtHY~+Y>Kpu&n_%p2$O3JM}om9OOm+XBy0;=94zfX^I$ZXlxxyW z&6pojJHmil?}gZlp0x{_kxm+E;JpWvizSVa7SVjPv|$_Y*iYwKSVay56mLjDugnIs zEYI{J%_U7INmLvk%13TPN@ zph{==Jw}9#Jmy0v-nJ&0GJ;4+$gg4GjONEy3tFqEBAfV90dZ+nuA_}IkW@vBHLk}{ z5{n?gh);von4my>q9>? z5mwzzS%r&^gQn6!CE^h8&Zc@=_OMBSHIbt?qH;({gu+-0m%(5KWHe~jAalAMuN=VA zRWgQ&VouKUGRPaOnS3n4Brw3hG{uMYQC4nLGkOddOJ?B!DhgCVZoo{Jn&SOfT*c(g z?+Yi{dbJS*7P*=i)YdKOq`7Y$X3x}!C=n(TC7K8+(Lf-S5PBJEGV(Bxn` z5yMzNf!P5zOW1V?)s-r#-Pw3wweg%8eEx3YF_Q|QWks>PVMMG6m7I46h!}gzmbXq? zy*7E3zF{Ns_%pKUMQh)6n3ahD;Efi7f z#r+L>C8bibR4mFL8&YAfie+fF#$pAQ)o=PSXhsnx{phGfB*f<*kJ*MSs_YF$Ll_~F z_F9a!FQzLSTH4d-c(YU(mWo1ARg0^bl==17Xx(N%v@?n=9u6g=)Ft9&MQZ1y#%rNI zaLI?E1`u&tgfp`eEgz#7MGN^bGHb&v8hC%$h?%a``HmMNZjlsJlt40qp$kHzx9lA> zG6cqAniuP2AsMf@b~dp=oiRF~NV2zUjd)tZqq091^kY04$jWp*McIl3!*H)xP0*48 z8;3e>r-fx-K=t{f=tY|rwzkph-&jJ!(w4CxY2T~?NcCex6H%zxcy98sx4v6oF65!N z3e&cQ75f+l(^@DPj~J2H2f`=`zSE#{Ee6z4JP<;spLDMMCX#xI5H^wgsF&ubk9J$D ztBeL}4uTL}ljq0IOd=YJMk66gj-edex=_+61$w(UjiDE62GvWGhIxUC?MI(4LbV^e zPb|;O5c19osLNKs3qpIc5ur)pu`~ln%Dz}A=!-({@y>;M6?!YosDLICO;!tsV~J!0 z+sK$bWgWmUaaa%cDN$8b(6sGy1R4xvy}f5~0QMP%7!<%j{UyZ(S-r0b@+Zy@kw<4g~H4Cf6F(rUqv>4`et)`yhEuY#p6PKN! z%1|=o!_+z;H+D5QTNS6u>%$TSriLBo7Dj$m};b?#qvBXn&-07oK0WE zCs53SaFhWmFBr0E2+ACuKI81HnL4bNs!6OV25H|OS8Obx&djmyqO(oL<4KWFm+ zbg!u5<}E6$H>PVvxVq*e4=Zvwh!F@x0#LeHjX~5DSv2%Esz0J8d}zUzS~Es9EWh|b zk#`JcaDD|RAJm{4!GJ!<7d4Voo8S1j3KjOCJAmA3UZwdxCUY=Z^x|#0y2j!9)}r z&^WnP<cqHrBQnqK)MS9QEI1DCv0m?$XcHdeFr8)*7!P` zijrhaRHs|1jma_8D4!SGQ`X|557A!O;A1zg)nKXtW!9DMv|{VWk|Z4=31Uc(g42iQ z=8`14*%CdNA;k<0dz=x!n(%w$7_jNxmx;o3kB3G1!{)~(4`mXF1vH-ut!UO5cGrp3 z<>k*G%<=sSmK=OCn_JVVfm|+|D6!lLYGR`U&*x8Qp$Lv$(Lx2*wAf`~IZ~)#!kAz4 z5;7z2#V|tkM&n6rO6q)eDG3`?VSU6*g2jl*Sm)5NABvughsYK<%{!UcDJ7N$lY?mw zj*LWOnE2ZY(%vwYb~+EljyRbt=OJSls=^pWa&MgMZwN*!0(ItqxN{}8zVTnjM|EB zh}Bmb7}{5~u*Z+%s}U9ZC3bDdx75t$NlUr*&~S9luliN{xd1nzp&JP$6G{NZXUk7^ zx|UYjdWa`hbXBY!plMh~gGeLOOp9sa4ofAXtp>0w!cGYB%?k&~W&xPV!eX;OnZW)M zh7_I9esxfpsH}W*Z5b@a^_p2(NRbsYO=RvmCOB*zO2oS{=a_ou#4a&Nin$$)rJ7;oP1N zyEQl%(Xgxrr$eA?W;WF=p~0yk$b@4>(;ExWB8{%kSqgH9P|cK$7A+(PHS8F9(WUG8 zOA{|cJky_HHpXMi$TMtXbxd*tIN%ivCJw^n8xE=!CNd_aY7gtSSpp8u?avfW7jsQ28F7Zb?u&o z4q@3C9hlc)b%?z%VIr~87VyOqm<#YqMtO_%Bd0fVOb%LIR8dtN7p8S}TP{#}u!DD~ zT1X^2XJw!LV5a~xtr!kz*_I~Rm`Cp&nVovNE}Es90b=hX9L92whJAacyo3hBkM?D& z|0&pwjCf;c4VFp~aunxclNc6&r>HUPgt2KHuF%x?WM1?8*I#&sbn*3fE}nV3B+V|6m>E}(CZ1l}!2gn@ z@vvxvjKB2%`Vj`WD4jFpP&bM6Pega%cDIPZClrMxksniC7)d@%A z$$A$!>awnIfunr6(* zxGP=YsH)uM61UF;hK-+>yuPVKYwUF$w;f3*0Hdt#XNb&;?G0ynp53k~!m8 z!c8~683;QWxdb@dXS2xdUKWlfFPKt}_XmQ?ENv##%}>Yr zYmP0YY1*gw?Z9u1R4^F-NxqZj&7#{N=Fw#k^VnSw^Vn4o^Vm%g^R)Qf8hC&eXz7ZlJ-f5N@JyKx+U}fSW{g`TW4Eix^(o66G{{9 zc*m}31s2gteRyjgFClkO+}C{5XIWgW+o5h`^UKVJ3&>UVJbvIUbt8>Mq@Dli{}&TG zpP}JUO#w}NX`Vb4KaWHzTV`&ge0l7A#aq^*Qc2Q(XQut9nSC%`V~?dlsra`{K`&2X?>>Et`t?6#z>xpn&A>s$C4*_6 z#49XSQx!jtG!oA+vr+Gx!mp53I5bDt6g(T4jWAT*3Z+x=T*7Rp;Yo{2g;Fh^XER$9 zo>cJ)+26~U?HoK;FxzT8&u2C?a%mN_U4rKtX8Q%67c$#sJPA=K{T9y+%yt)^o0x4I zo|iJ)4m_`5w#V>{;OCK^z%$Bh`|#A5?Rh+7%=R*#)X+TAU+_#Y+nabMneA_QQu;j7 zyLirEwh!>6r8bZB37#{V?Q=ZoOTQlJYdopBdZd5hIfvP#0!f<7Y=y8SUjsEce0gYaqHLj(I z*bEJQAHlCsnu6!U%tktts#l>D!t-ioTZAViy-;e$^BQJbj^}1(TZQL!%tq*2nC*Hz zc~$*AY`h zW}`~RLmLX40ymE|3^p&b{RlQ6vz5Z;XSOof0?bA=hk7NCG!`~Wvj=_b(Z%cg;Lrav z{p`W2-v6uq7bA22ub5(l%4^Qyunou0BOQz9Ui=Crns7bEY!!Gu!)!Empt@Da>cC6P zMhf%K%toq?bU-0fQg1Tb0zBVlw#9h&tA9!`7eKo`r27vr&9WaTZE{ zh3!ygdk?n5nTV@Yq%to?~Wws%Ba{WoI;z(dU41E-{QL7-m>XE2b z9L;RhDyZA!t%9_OM=FO~DYH$2Z3MGTh3!~on-1G?%qGKD#%zArsLS<8Ds0Cy8;t`; zFQwU$8628ksk9%?XZS+r;uI z72Iu7dDUcYn>=CCByO9E*h#bS8faopTtn>zt6nRx|<<9T1}EfS{#@x_Xc( zaV%m6(Q;<-Bxj;q&MZ0POhQ<=ot-KC-(X0{b~8h_;aCLfdD0u|DeVTU9VmMm@Tcx% zm!mtGQ81D|!HDRh+6fYNz8fTZ85tABR85VRQgK`-k(v=WbylEerr_hleHHPU93Xhq z1ZK<*%*gNI3(S}q4u*Zo%zzUw8aOQ#nCrvqt0B?f#&e92J=~NZN5cf^dUS0Y>!kFpk=b#Vq71Pq~r%pv6V7QCnutIL!bF zVFlv88K)&@2K*@DnSnTkDaI6s(o>0GDxl2JPD}ZfnTkNqEyGj~W#OwyDZ!ak4!lA- zW||=qU~eFpm=Q=-APNVo+c={t%4P|7jH`)sFY{ozXccDy$rnOJvz?Hdm^w(A=0&Ag z9Wqp8YPO=y5?c|%V->|vqIOkb_%Z1fLbL?0iGmj?n&gaNDxTe74G&aYQe*azY+j_e z?OwQ*5Y=aH5;Z>Mz|8W_X7lEsOw5>>qEu9*VoD9KLB1JT?IH_`OxFvT*WH?c3kHWG zwg`~bQx_bg8ktRc<_skWZHij%f^D?s|BS7Ntt4?qAL^TFjQ=3?9{9)gZ9Ht$kq;fY zVq5!>1&N2QUHSB;+F#BbCY8@V@{8`!AJXq1{qW_Pd#~KE?4fA`es|9MW1ju++P{Bz z_9N{lW*(eYb=HzThdea$`(rmpzDdphuS>5wcmKEtV|Q)2uJ130-1es-|62YLkOC>aq3%*UvGTl)Y}I4zqs$HZ!X_{^R2^o zHvZ$Gqb}Jy{=L~hnp2aS_rcRU8mDHCTYJyK*%ki3f3U&3b#v|h?k88A*7uQremLiu z8zvN={(R6k?dl=#&tA8G>xfr|PP$mVb9(o#vH#UEX>m=#n8%*kxOq>}l}m1jN4~A^ zK5J#$s&o7An$y+2C0YLS`x3FFQZp z{v>Xg>UZt^qf;Re>&!#>W+%%lJ^ce z>7~D3cI5-hUa9OoZT5v14r_V;;>TZq_vyR$M{eA;r2pID+m8Q!%J3J)AA9G^9c5?K z#Nw0AiXA)tx5Hk2a&q*^_0bW*^trdDelhefv%tRwi0_^Em%syU zEly{~>yjr|r$s^x&uPu!JaNAcaceQ7VR-Sp!qTk#!{Ic?N(aE=rpEdP`%MKZO z_kB~(`SlN0Ma`&e#eGgwYJN*2Z zlm8We;fN#8pLFle!?xTtx9aRS_TIHDeD&9V+;(PW-%DToZp3zF?4TRIYd_-B=&m1P zHJ6`!^}|2idBpP%UbFjehg?7KqU4<|*Z%g18y?^N;l)2W_32lBxoO`MG$&w&-6cD& zss5Vo!h!<_XuvKvHq@ram6u;!P_RmOS=!b-uB9G+lEhu?r_M0KmOKSCc@T~L#91$R zc?$N40Q_Y?MMly+1+*YC7{8;gI$gmuFAG!1Fm%?8COSn6uXMolW*C~d5V~%Z@3~w# zSWrS(G!>&MTjj&g&CSL1WtfYBsfO*uL9;Lq&5lnI!>D+Y#6M4e2rD0iAw!{)=_{2= zlzya%Jte8P=`vk+DKcGXU672&bXm$B5P~7+65XYcxs++~i8SdNRzP796D~9}lW4+8 zE`7*_W@v26Xu1%IP5Mk1nz6BIo9Qx@TqymfOBK0<>@E{%x|k4LDEH?GE;M~i2`)5c zTPV0tq}v1+iu5wUg(AIDaG^-A7hEXPn*^^GkvY#rX}vh2s1VyURq1^T&b<#rZ42h2nfbaG^NU(nw$Y z&uYR1a+!x8YjI|6q1s6KzCuag(l#p99CO=b{AG#qIQ=G z%CVt{A#0Tsp9z$%XYeBz9%o9|D}oE9;w{02%7PY}EEY-rRB)kWd?UC}GH5x;WL1!4 ziVxE^6rT!`Ov|mN3puc*6LPU~jHH_`EXPi2Wu7mD;x1sBSn3k4U7^v?wsiu9F&3q|@m!G$9I8@mf@Uw;r>D9&31 z7yKbTXu8->*!F{~r=ULpV19jZGZZM-p*Wqv9VNo_lI$$PTddQIt{H5xp3qr@5m|=_ ztVcKaUbI-${>TtUWDS6e6;{>Id$9vx#L$DfLxwOSi}o-q)|po?e#&Ceaw8eSh^#?y zu~;`s*J9Px2y2?oB8e!j)psj~MX*DEVkrrw#wJ%#%$?2 zUuO|UWU+q5tQ*gNzb|2h^$VRv7?H)6()l?P_&u=bmSZi}JvxgpB8x4%o2;TAzPQ0+ z(McFGgb`UkhKt8!y>{|pf3aBK>ny^EtYa99N`%b#%jdmgv5ut<5QZ=!s}wGt0)sW7 z?u_#+R!nCRMr4f;SVvAf1)Z!OF=@HZB8H7z1DU&iyZq-CE2gsuBeF)r#bWiY{t1-25yQ03B8E!H(Ui!dUKZP^r%PA2ndWE{FUBdmvY7GXpdvJ7ES4@Ksy*X~9l4A$Rt z7GXrzSh!f4?XEd%QB@6AFJ0jgMr5&VqXKHxeiv7UQ&8HOB24AVM`Fe0m*v8dgVdGVrqkzodFv(6%n$fB`{r=S#1 zGJoB>3(ehNJ+HF}BeH1BWwHJ^`Hf#%tRlU75=LZAWGvDrWG=q{#;YyXbe%;Qku?b} zo&qCX9m-cfvskS|NQYAwzj-kXAwqZO%}pBV|o8Gt*~CuS%eW;QyA-b zJjuNB)TGNTR*~NE5=LZAg^Q<<=epUxtT$ePZ=qP~XAqRstm+U5tHMHrEF zGF+@uzT=jEon?hJURRTZ5m~1&7PUJvm-&~yY_S&TEW(JaYPeW+CCl=7utPx{zmmDBJa zhA<)vRRLicx$(xHf4pe1>U9=jM3$eiNS}~-^}jBB&SG7yvj`)y0&wvZkWMD^@GIw! zvRF^(EW(JaAY3fg-0QzvW3kwah43eg$O~H$BZ${z-N4i6B z#`pQsZFOzUDgCZp0g!IS8IO*}6y5!kOI^}%P6`*T;sSjJ5SVo0zq4r}-nw6yO1I^B zwc<-d^{Is&ZC&k#xBkt?Dlc8nfSX=$caDC}M>f7XS%nK$BFVVl@amXgdBt$qCq7k` zWPa=@kmZM);ql!|+@#IU)X?D|o1f2{RB(GI_oL%NmR}5?gTlQybZfJI7RU0#UMRle zh;L(&A9jxIGLwF9G~mbWh~&pk<(RxF_-ciMqd`$wKXzpKcq6!OKZvjA=m(K3p9F57 zh-xdYS4n0|Z(O@`=GYx+3N5`NnKU~HZj^Uma?neisOus2{ zeAzROYg1)?m*4d9;#)TXO~oDJxYH%;_>>(K2_=F_1&I+rC<{9XAFc`d{kVfy0O5F& z1;TxbNE_}w4#?JFD*MqZJ2dIVqlNI{3WhRIl$i+Jr0I`EadWR(fH-7k`cA@Kwvk{Gx2e;y zGt(J&%;2MBAqd7t$MPLTv(WgQPaqNx(#33cv~f;?&ac_QVdN~XrN*U3Hqpkh2oapb z$7ln-xE6^xfo&(rO!>I&4R@t^q3>`NU#@)n=`uS<#r-h&{EirmO}=rK%H-gJz!2`> z!QJJ!LN_-Yet?LMz*!7@9}o2tx3A)sa2rFueW4s%H@pi!iR;4B!ehJ0bU|mr21Ld+ z%o&`Zvq2Xa44~VzN5a6f$k+xK_|$|Cm;2%t@%-?KR&0FNB+Z!leYi0>5yaJmViV2c&{;`~6Oi#a9bA%z`?~EJ zo6E7PG`_EZ@1`i|n8l*b<=Dc(ow{+&=ZoT-^*x7EW5x}`pRf-ff(+s+!k#%+IN;!> zzBmq`iYg~JZU`rp3b){+vR=H3E%hHiwR|ex7dOqp?kuaEFm)ma)175Uush54U?qp< z!DQ^G$LMcbb-T?&Hk)y{v+MzQznX<(ca~+{;YIV`s|szhV3j4@C6jfx*;{b`1#l~R zb8H{{=X7`2NVsnS=2aa>@||$BuJkc5{Yel^0e((6irP>eLpU-{xD9Y02Hed$mi}|X zT?zL$;kmRgEHL@vhlLvHXTY3+)dn)AyyfB@XykpBj$uGN^Tlr{$ax{kJ*vg%e<9o+lxbcGq2pw z>6%W@?0moXR%z3L18PPqo2yQIf{9Sq?3$lC>x`YWSWIi9h3p;t6PRrko}-!VQaq_% z6|&Qdv`Sqly?`gJ&=yKabNZMXWKXG@d4);6zZ4#7X0H)M=@~m|eUTzm$PTu05wbwq z?He|oXlr%>P8E(cWTDi3>ad**m=rT#j%6NGGY=z3%A(S6W{QOc+jw^Lrpw!BK7v6BSzoSF*Tk@yv|`weLKu27nf zC+%DnN}YJ}WL^N9o>SfP%8JzP=CTsCJ6$%6s#JM6^JzHqGOIoNDJSQk=A>t6nO@qo zoy&Y`W@mWJb`^D~V~SqtYNlAr>@9vw%k1thP%}@enIqJV-a@szubT0f&1Y4L#Pc+~ zKVYkLCF+b(_VbXQOmms4X3}Lz^IxWr#pT0FSmpT#9wS@}PU2Zu|L#HroNFm+AeA5Gj&iMyO94rvq%EAy+eizt*e zyOOE1&SW=|@?xV!`w{pRvP&0ele|z`j3>993tK63`xBnL*b4gelKNEiDu;u4ESv0O z@$-Of*ot7A$lQh>2F9hFA;X1ye!_h4VAoC1|71?YkIUdTLRK-ig8sdv{uO;#s3YNG zm~pUh2DcG|wq89_!O$XUXnlWa=*)i7&`Ge*C}}4ab@_&&;S*3jhm&I))>s01uyhzjjv!@PS_{NHR?>+SM^AG)K{NE3&dUpSXKYeFqpxJ-ICnvRC z{r#^Nl@yoX>8ah```q9$w@m$c>y?Y|?05Bte}4PamKDGMpk?g7)BBvX{rQXEUmrPf z&g`jecO5otKL6Z3BS*dZR`sfZEvLQlm6^$ zet*lXX|2!R{?^N1{V}#_){--ySo`+nXV;$n)VfnE@891t;>L_QuIIhqQnD6pyvPfW3Due@z6dlGgp@PU8Y;{AJtqk3?sZ=K|Y=WDsLM0oxE!l zv{?ac_CYcAgq{MbnI!$E+pahx7ej2mp-k)_4|?^aTnvpvJ#=pfGYwl#J3kjgHNsOs z-6=`@cEwaUEt4C=rN(eDF?BgE)D>`Ju+|z5ChM9Um%DRZ_T;#{p}SbGdwiw4STBi`P)5O6 zua=D0U94A2Lb^*oGd}Zm7yjA^@z2p+tlY@xF8#rxI)r;laxk|EF2>6ygryST$Ms2r zkfBm$E>qZ_cu*ZME>v^+NaJkNh(q9F9TmRm)>l67!z963+NH;bVI=z` zg>;>#fIVS5|HNlTSggP4EbeO$i*`~y1*F>u^7D43qsR=)qc=N-5yGO;kQLSy7hjJ1 zYbdQ`%5)aP2dh;$#4tiwhYMj{u=KviE!NRGi(!Dn zjS{*G*|8~an@}AA7f-=f@(@fA3}Z8$zG$CfU+}@5c4^$#-e&EnH4ml@?~6T}i* z#uh~Kd*`R~Jju`3{qqZ8nUkN-z4Oy~9_Huk{`m#)yv{E`_typ3GLDsi&dYYTmjf>W ztUXTB*AlTh0dugm#|e`sR!wF|T6>(t)*f#;9&ZrnjnirE5#wsn-VaG$%7Hw2OV z2}Kmf%om5XTeTE-6XHk4#ATH)Ri}FN5FXrG&7I z?C^b!4tRf5YGKGG)BUzt@@UFCe?&G;&cUSt*_4CJl}GXO9D8ti)NV$(z|m^b92Ynm zYMku?N9}FB3mlrRbd3w#XyCTEz|o}ebr(36f5!oAGfw48@f+m=M}vB=3mgsbVlHsB zT(Q6fj@so07dWa?H@m=%0qzkOIBMRXxWG~V6;o#0j8i^);s28yTyDLm`q!L;%WX%c zz+K=1M|$^07dT4lgD!BShu(65qjY@ggtHCV0g-Mf!1S3awcTJX0YiuX_xC`WoA7Di z|AsvfS`yA$yvEY-rjZHSY%J?!71B*fxz`>u|V(d1+cMgVJt^yzFxPzc-;ng(XNbqcLD9y zEEj!S;j3n5!g=G`vQ-eGVPzUA-oRF!HP6FLyvR9;aXfHbwY*g`y< zUqd&Dung2A#(4yQvl`3qd$H*=#Z1?INEgdY%1J$ejK%T0DPLJuDrcq6 z+NldcD%UQCXtoK(%gPk^00i=2NursKEJ0f4UKV?XjAb4bVmHJTwj09spNXw2HREds zOdG@VjAfvfQHLo9o}o-n|5(4dmtv&SwwSW*32+ho{!xs+p==dp1-3|Qiq-PEvPc3y>_zwod`(4I{HR zv+6O7-zf{=UrI&KQf21mm%thlsBp4kf`ZQMrdGp>npENM@GE4^rY!$F^ z-zwPdWNxRLxTUZi%iJ!6?H*>^2HO^9`wBMd3=5_4Xgl0(Hf$r9TN7+NR-0fO$K0-m zjfeImY!jH<^RR7Wwzo{*&tT(uAlJ}7+*CDl4iwHS>be76d{+rsI5l;~PBo*nYu)u_ z^H)uk((_lZETnSn0_CAq5Gkc&yl}>>e-nQ#AClR0G5%MZo_Uvwf7-)8J<%+;ZxEzV zZa`4g<^oWI9>qQ7=MJDsGgQsgw5JO*1@8}8b&{0sn+X+m7rfs`&3H00)I@VxQhA`1 z*x2Wr3nkp`g~s%dR_QvN)x|YileDg0yzVJNZR~_V)X>aFtCm;6kupOA6$$<{F!4(b znxlMmm50@_;E9xQ}lJvm>fnM0x* zhn^D4?23&++fk6iVfny5ErY-^?`qKPi_qdHka#0kc(YKp(Hrp&%IA^&$D=-E`e>QZ zu#+jaU2=G%{0VkPOO_Q=&UN*pWTK$D1_dT=-%1dFm2W`TaI>_qarn?hh@_MrgowT0 z?_?^?Sh0VXHZ3$P9oM=;!(xb40FhTW&Vk-DqMi8!&f}aS+w2_KN8dlsC|g|_bj?>Y z(e_nUQhJUG4bo4oT2HO%eU#W$WKnTxdWo8OjAbAIh1lSnYSx|$5R8#el>Iz^^xDHV z_TN85&FoW+4jB21nt__4Wl(wb%B&z58vGVYb$DLKZ0&gR7IOh?yiE*8KGWo(kloOI z4YMh5<2Y))97k=IyKRJRGsFEFHm(CEqJD5+>iKSFzB6FszGuNUmbqOD+hk_j4BIWt z_6OKFcROr6v}a*Ek@>PC6KeO&vXYwFxL$J>dim8KP{Y$Qwe5k4AJQRb5QSg3=|DxNNb@ew)mk%Kf z*?`zii1UjGK~}ZO@MJ{4WYn4PGdy^1gR9=jdkOdo~S zNz{wtEy;eop{&{2i!ojW!eo>dU$7T{E5#*i%cwoFo}v^X7;O;4E2GsE5B4bA-bJSK zHdtJ;p=>TFVSQLtJUCingjC8xI-A8Mh{pevI%cn$N#eMPw?Lh?qj>#ncwKa;dSGWP zL;ici8ap9?o3O0{7!|h2CB?&vz&v4XRc3;~}dUl~A}z zjijCeJ_;v11|2IE=Q#YGsS0mQ^`e39{BY*Obq9*qQq65FKE@9}J_<%ILh0@cWa2{+ zZ!Pm?AR`yCNTYezhco;PPCqtqgha{}e_4^TEsfG79b3+Gn5#t^-WjQ9GFV~W43%qE z8^r8#{N1?Y>7vH&X)0AM2u!L69?49<6){{_k3kgagSmmK)&X6rsa)0~KwG|-vT%)Z zW8qBC3TG^ZgK^yf9?D*WJw_{=uWX}heDF;eCZ=)6V@2vS`&l7EWTS$ED*E_`^cb%i zW8OdkP+qDmzn?;Lv*-7N_`6Zr-M0Y8sdo1YpxMz7i9v75f?kHd5lndF%3eH|GB1ZS zk5F!^>bh5p*ZvyWY=)0kq->)B2J6xEG>D1UHLRA|u2M~)y&ZMqB6Kup+`H9j?-s8g zL6P%!k5@Lzy;)*6Ci*pYhmiNr!O25T__Gl8bUWGo7q#`l-+fu^Chno$T;-XNiMRJ# zO$nn?Q&rE`;mnh$l$3L-R&}dNnY#7^EB?y1RrtfmdCE*N>J;C#)P8te*L>Zl_<}V4 zZrt5hDp5D4`cRF}+(2@}nZh!3O6eM2e~n&9&AiJ>{}d+WMRlWEppJP?o%VR~`Y~{l zFB*e<31^0uL1h@d9jn9PHM@#b&ui4r-J_0qV_ON!V-#=Wn)mxO?%0bQNfj2~hh#Rc zdACr{B3@u&TQ(r!#anb;>-k1r`(b)KP03UZDayQLR8X3&ZDxt+qk7IOQ@@l;`=t9Q ze?kl;fAN-^nKs7+NDi$1Te@i7tLZ{z&65RzbswgoRS<FzX z1<}2_dXt=3o`}%Rii|=aF5jQon@9fplr0oxl0TWt@0~u;?7ob&Iz;VGgQ{lU2#jB@7r<70-%e^_qbaxbN<)oN*>*RTE^m@X1!9@O z+mF#!=arRH|7LVM%C>unmRsxeCbaG(lrxoi zIEwfv{wTwbe|Ka9v(dbQj|S)(PTGyY=YL?MC4fSSzB9mmX`yBlbGysLy7{Ador!}tWYHO#jF4WExpBCuV^+~&Z>aZRT0 z6{g$6u+jXgP4G+eFQch=VxG}#XWq30{zF? z%vKB==Z=7lbL(N_+^b>Z+?QeFTsne2igD+|R>5qS!8V%Nw!=otFNM-~u+freq2xzD z&BK@l+ZD`hA#8d~VY`~Stu%30!Nzl(>R{=tIT*IhR%qrWW9HQ!$b1u~Nx@$=IzxLP z4gI=u5zWQ=W4f$nwn`{E6-WB0rkL70jcGiuoyxXf2^x@MTJ)_E1?Z=Vud+r&y5^MP`-&U!nVWR+MrD5^h7n8q z;Ljg-6*I)T?d*_hao}YNm6F>yW(QD(+&TDi0J$>4CgLM__SZ%5p(ITipxkQJX|p-!aAa@yRDjq}pJEt> z-YbM|@|X2uWr?nH2akC{7)TO=p&=b(avB;k!QnBVZ^H^L02BG&X0L)-m7$Gzb)jWO zXeIN!sH~)*jOL}z-06n^+6yXVU+>}-p8n?5{4v;;G2a*QA7 z5aEHm)ur_zo#*`f`NUcfs+PF1266OX5aQc^WiAbuCigK!or!{ zMofjd6)YGaEqJ~}iq#iOgK_+GaL2$;4tcZRc1TGQoA!teLn?+#;Wm;IVr~V$8Yunh z^J3|$bcwWS=3snkXNWZ9&60hCwhx$p2xT1%?MfSl7OJ=;ZX-!C=2ozypR}X?5NXTI z{?h1O1EjtSJnj5oE58NTkU+~{TmrX|gc{~HqNGqNp`&Ae8_2+4u_r$i%dsVJ;kKc$ zaTcLgqSOq-{h_CIB*{MwKMz~PB9tLl#Bd%4gSuRjN&EJOagv*Yr$@pkGwbmol_d?O z>`so8N=Me0jvm>0Lg|U87}o!e&vD`to%Szu);F|w&ePAn(C0flYCFzhALeXn>Z}{L zNUCG|5T*D)XLH-w(%SlZ`pPE02#R|_O6j_e(uU>fhStuewpK*A^M5jeJZ9tSoTFIV z+}>)%%^B0#)lS!x7*~#T+VBh8(xs+%DZ7zm^vLo_%TJKvbVo^ut|*}dmyRwSxx5sv zZ5&iuyR^2cxpqNw!#JtN5YN5r;&XDfw63Xr5x#)h)s$|4T!b{1vQy9RKrA_vzG)H< zgc38u{M!fNcrcNw@zu=EN*l#|9%xjvz1Y$%?+&!(~A)06XtO5L1}O5 zXs91sTHn-3S%`YZqlV*XT`l;?Yg?-{!xr^Y{d2Jt`$lAY15(g|i|u(8HBx1GscoHU zR%21KTWZsFi%QdrtRT`X3OxlqPCEINQg&vl)Lwk%Su{H6#Jp2xOHQ?PE)@J5o0}Fc z!o4^sfXXEOfL`2M>e z|K)X;{PMoLqieUm`q=zC|M2eK-G^TC&fF z>;Linrqiyupm6C6cRe}OH|38d%9q~vAN}sqzuXYIa?Q1W+<(-SMPDxbwCuX7`@i|@ zvW=U!?7wo;_6;ut?tJZU{de9_^g;ids*m~hzph@~bi~iM9{RQK@jKg_e>kyx<1Oa} zZvE=mcl!Rb&y>L5zk9d$kj2GU+hz(zZdmxI!VjLWKJJ%~zc!$_ z*YvZBzip_yH`)|VT{NtrJ^0bxoBY~ek3He9!`|+_>W`(fUg**|I6F?>jJ z_1G~hCq8=T$VBYD3h(WY*94F5`q@=&(?8k&*i%~;f80IioX*hjhgziW1+U#-ShQ=v z%CibzuRP-9?uBD-`2C>BpkL0LH0hq?Z%YleFW2G2#Q#H|V0gd?)coImpoT^T|LL0r zG#J73Lt6iri=Lx1vQBRn(6HlZ_(aPVR`b)k_O}l(6+!6KAyU_S$(qk$qh8mJp>cwz zfQAb+a`^Jb2Qf0w#!z?cDWJj05ZKOrEVZ6v+`bW@k4eBa&h{r^=f-eZWH^|ZRXHv+ zU*g7KZ8aQB)=N1q1(Y0S3>GavkSPRn=rL zaqIWG3%zH-t;1RCVXZy%#Az1mR-MH#LRd85wk~YEdHvpT*834p=`4m3!Wtxm_1Sw{=Uc2V zbQZ%1VHGo0DV}8dWiH#=*L)-3D9Umeh7rP|e6Z5>+L?!4Zn3I$7Q+Z(u{S0PhB2A= zLhk(|%B*)x7U(R75yB$PWQA38^dG*kSZj0^!w6v=%2*T@)y9&I@0???Zqiu{BZNiT z)C%j+O+((cSdZu|h7rO#jInrn@rjeKzR@h!KXewu2w~A`n-!M#%{!mBSp7)B!!V5S z;f5pN>M1B=zWBh(Z-&Pu)`O747@b8J@j6774+R}M>%cz`!(7QwAjlYI2qUs+a_uP? z&%LD|-oNi37V93JMHrDqD~6tew9fj=sPnO?XN2{E&LWJ+qUpPpuEQQ(_$!NbJauI- zgb`V^GKY^7ktfW=J1(uWSZC=h!iX&DS3Tx6#WyZoiv>s{hF9t=!iX%kSWrMELgx5} z8Q)o~r*#%#L>8SYv2@h_BV(sntp3#f!VpGemBPikinhD&jUy~prOqOZ$N~tg(Rh-X z_}8y5v{;Qgi!dVVSh(;v8HrW$;m4@RMsD1ovj`)yj$AivsfKEi!dUK&Qo~`s8*A?y>>Y&f|0HpbrxYnRs~%6 zJCekDx$xFa7VAZwMHrDqqaG_a7X8e#&|-b7vj_v0?YQnF#=4;Z{|V+q3^I&2vwC{N zuBDTW{7o!->&RMC;V;->g~O0l->{%-Auh3PYQ-C5wn@6(y`#Z;WzFuspsUf8lO0YM zmMl^Yb%OuGhBPk3)mO<@%8kYcNC#IfGvqk!_<)oU#`;Egg4 z5&~dv1op5f;jm~yVGA<&dxAX($+LQ4bciqt87W(Vbg@NWUJV6YZY>qOX?ZQ{{$_gx;LXi!3RrqH3)@_4<+THC2o=!s zwnr$npsoHK=7-E|uSJI1eI=*&Ih|UF!)uL>Fo)M89df}zniI}Qd)7QL&PxZ;TBRr{S39sw} zy~; z@^yX0ifyD+SEAvVMBr5o_sa$&|8|f8IpRx%HGeXHh_o+KUCG*@8KPg2LkZj->kmfq z6Rj3%@^Ck%imMZSp-@uBwgZx5)aL3+wq=66Wtoia49aGU7?Ptg+zP7U%1&!P#VDOl zy>wVnEoXn&sJPfL5mMDeM3dufMmUw`woCOSD-_(d81Uhu+gMOG_hNJg!Z7uaN$`bn z_j5w?DQes?AF3;D3ZG(YF>!ma7W0PUVNEv5Hs7X=MGDBFs4wbOgTdV3SbkCkUD0I( zOZjV(>0(u1D3T zo{DHRA$=REx{~&hjH=UY1%)d_{hFp|3KGWmmncqbgNa(8zQsgMkmZFLs5dFAzChF$ zg8tx}O?p0}<}|c6bYOd_4K0Z8H(4xPSegunBas9Wrtd+SvMHZ)7y+N0j42`9?C+C} zt*PotV{Zz{TGU_@khVe!$-!8{@ACx%GIUm)>n+w#AX8Y!tt%Rn;!|X31qChDE8F{H z-np1ck_N&i$BPSaV-ZdD`@;e!YkXzmeSSIaRg^IGS*$T;OQ3oNHJs<1OWdGpdupBaBrW__xx}6661UnV?$<7G)IRpO#J%SNcQoW3 zBI98*PW9jz_>Y!tAXuGnBroIwNAfUW6^xTST6$jN5_g*m9M$I+T;jfSfus11Q1Gys zeCdd|z?DKyr%T*rE^+s`#69N%N9FsOOI(T9mMO40xI>oOH{vW!KN4UWOn=n|Nc%0 zNS{t~fg^o7(*=&?wYk8Nyo+4mMgn(}OWb2FaUZ(G4N(!e%{b*VwaY0kac8*1t#paI z$pvl%;xXWGOX#RGeOWa>w;HZ5JjN)N4PU$7w1eds3E^+6$ zz)}0S)+O#i7q}B3?+ur@BF&a5usY=n$(!I3ce)E4rFV@>+|4d=kGRDB-35;Hecu=! zHsh2pgd6J;cdAR=QWrSNziV9L9&m|!%_Z&!7dX-z$HZ-!2dh*55iZ~ox5Opx5*N5p z2=_jhxYu3cdM6H^UJ7@tOI(dh+zJ;sYQLLZ;vRR2`^+WoN6CZd%Vu=T^G0lq<7$q?0hN7`Su>I3k(9T zT*ng6=^pBta6bu{pX<0@d2m#(ZUpA>gUF+zeIA&y8dzWs!OtmN(z}=H7{ZZp!V%;i zJo->XVe-YV3VufdQ={WN_}fVy<;&SR23BUAaP#4F8E~KJ*a7(433oBvm(0SR1%71u z;>U1V_dFNDU71Y?%jCOvI}F?`9ZTtOy2pDc+&h6;pN(_4H~QDW+?9>XieCxjJq^qo z**FJz-viTc4o^qE_)&h1(lH#Vr^7+sMBu6qB9HR#OqcQ+fIIsj@+f|rT*|u!xLdO2 zE$Hkt(nbH@Nfk58tdf%3?XUllH>Kl|oN#5?ejt}{Q~OBLlUX>aKkC+hc7N^`h+O_Z z_6}|Bzs2u&_>J8THHY8zNaOAFKYnHSjmB?@ zgwKWI|DpJiins&+--O?K{4)5Rk6$N#%kbMJVF?4jGhwgAuLi#`elh$4_>IADJbu?n zxQ3nn$L~1&M&Y+mLX*J%hvGL8_CMhN8}Yjkzn|fE9)2D8EyeFa3G(op_rHjH5BMmG zH*WlnOGqe^Pz7lb0t9J+5J+gbetXH?x`xkk9-6KfnKcGMi_g{eI_}KC`p4w~$A`_lK9@ zJ@9t;myxDd;MW^a?Qot3|2pIz_`eYU7vldi_^095!%u>r0zVdhoxxyu3IBV-Z-ShP z|I|e-!2hSZuU5ngdr_q8s*Ci2P@ zWuo?=b#-dUdTJwD*Ou$4-Dn;3)hHZlUs~tocxq!>=dEEfnBb`0X`Q!56w^~%)H*MI ze}(Xrzgp+55zX{e&$Z55BbMo@?rWVFFSb!QRK{B8tr5fYH7d1Q)YE7=J~egv7_O%_ zt98*l{vCAsI$WQq)5p}5!|$lm$8-HFI(-rkXG5sI8l~%HoxUx{zZ$A%_#&OY0mm2X z^o@9Y9@6QXbNs_PeM^q7uhU24BTp1h>O-|IhU?qu^wGSYbkXVSaD9?aA5&8fKUt@b z=lXke`UX6lsXBclj(Zt z^$wlB0gvZAoxTy*KTs)NXwJi#uG6>V`AlPv*2Uw8whv*OPvfB0CGl`*?9)2vS$@*Ergd#Op2jk*gP!4OY}2|19ABwb zLT<$M7M;EUk0*`4TGxo{Y5df><~$r4x3#V%&*wTieROmUmj7`&eGJ#P*Xg5c$aosl zwXP1=-=@>Y)RghvbozL%r}19v8t`yvo}qP(IG*MRTGyQ8X>Ou*Ejd0)r;m=V$uFx2bq#npr8<2hj-RK~H|O|r zoxUZSX<2UH^F&sZ%r;m=7!>Q2eW4NB?Sz4E*#3xkG z+RKYNeOr!S6RKx;nv-c=1CD=Er*FjL|ENyioZ}zU>05IAI&I*P>+t!>dYwKVKN3m( z*e0Dmn&V&B>0>ya=IdG)9W95mP^*L-!}Y5x#S2MFd_wgse_qn*+j9K6P(8!beS_9D z;P|I?`bJ9pb^7KUzfh-d$?-jP`e;56Ow;LO@aj9|XR1yg9WCp7==3pMzf`Ahz{6jr z(>LPbzibd)9X`)|MN}K&Ys&M_H+A}Gj;DJOt&8FKC$vh)(a~}^PwMnBT)((dywHG$ zPxm)k*NBI|NT+Yk@sI2DEjj*no!-pH1-ft3x}IE5_g-4pkB={OAEtGwTwkEmo4MV5 zoxUg6PuA)C@%WF^=~KCWf=+Md?Ue4>w5})DkJst@@%BDir%&a2x}ViLGapB?b^4xM zPxq%<*N=}!KAk?5>qqMJWhwLip4JSst{^|VHyb!I+JW$E-ixt{L%wXPo@?=p4zRIVSO)0_D` z)1lM%nG~;{dj*kMyF5ZdP4*kYr@h$t{Dvp zkm8w?2B|)i{E!+kX&j^`OqvO)8Iu-6YRROHkXkWmKcqHHIt3|-Nmn3sU=n`GldVV? z4M~u?GMyPxcP0&n)RRetka{s`9weHB8x1QUnVGZ|l8s4+Avu|J29lde^rJx@CN+kX z&7@>V{h1^|x`Rn0APr{HG)P04v;fj@Car-ql1Y`2Ml*?ishRH6jD`!4#xp6lI@ZdV zlmMxaNwmyb%p^agdzds1(!ETY3F!eQErv9MNgE-}X3~C0bD4As(mW0c(TfP}>2Z!07dlMX|w&ZIMt zFfr-G!9ZalV(Ed!=%NKGMKaxl9fsOAvu_I z3KD&iz-YJviGG3KXoyEw;bT$~q}!QfhBS~#gCX6?q(Vq{F=-y8yP32C(g-GPg_O&r z!;r=>=?tWNCK>8rC7DT$Ar&ww8B!6GBuJ%98Ubk10wntE8}bj*<4p2HdWuQoAT43iOi0f#X)&bdn6wen3ryM% zX%&-BL0ZG4E0ESRDIOi{t4vCQ^cs`QkltX@U`Sh-R0xSaEMzpygY*uQRzRv`(pE^j zm~*3Rp0z zgsytH{sCE4wq7+X*{&LrQeHKroKu?AQwdTz*{n9oQ7R;!ojMQ|^9@0oka*dJ4=l81 zgvV)&^12lnC)UBpIMllvq!JY~Ei#0q@p@r!K%_8i7O%tOaa*+69x=0m;HuOLy{2$ zX`&k$qzOq(Q@CIvASeu7>4!#{Vxud08spW;P^8XVL}(JlVsqUvlw^ko>7pD8(%8~= z+@TS=Zn}aQsmbc_5ep)3XgG)rll5Xcf=CK8Ts#3+CYTXRK!?#pPb~u-CQ@RP8AU0BoXrda#hAETa>{uxbUG50itHRgyh9P`@UCCDA zx+afUK?@f(nG)e5@7Y3G!QN1~#H@wm@C&>*403|msEH;bB}OI)(nL2Ttw9il6e+`l zpfI^kgIzFQ5lSuuQ`K;EB^WjwT`7iOG+D&*Cj_9$p6dX3>4awoOEu&&FTn5t^NX6< zPcSEgS+0pbA{rV_5U5FpQp!SXfK&?4Fk~x z6b>S!^7_#VLN!4uIY)zduq-0f>JUtr{0hNnQV2LpK?tU*@!`q4VIZM^VA5|CognZ= zaS8&%)Gi@`L12X3Vyi=z{Ea{;!sJURKo=Jg5GEd>09_oYDQc#FN}9vXImAK;Q**+E6(&j%P+{VwSyzlyVscMX zrI_hMix9PNu&{9xvo=C@Xa`ZsTQV9pG$cf*<6&xpoYrta9-`9Ag$G7VuRg>GainFv zszfm?E=&wVa1kOH7N^TY8ofd*fvysV2kBxK3JMdg@Srep3auky;uH!B6DJWAAx@zn zO`L+?P^E3}aV^b;-bYGq3iumKWtENR9xc6?Qn?GysOeQ0Lliz$IxI1kzKEM3RWyeN z-*5d(ntPxmA+F_2`7|pQ->0T$iw1nEyAeM5+_JyaAkYt=aC`m!d6O`iKyuDu8+2|4+j3qbGA-3#qV~GjTmE-;Y zO~waIH_CVZJzY&*sIRFD{4=?`s6=9eCnyz76={V;(MMmS*n20kBqy(0NqtILonXqa zFTudmN5yw-f7z89Q`=pq^k{bj7zmw}WE}0VsG7q=OPzo-ny!>STlR zHOwAqzjX6ho@$$1XT(!)jF`E&LHh}(|NUTN)7uw){PNV*BVu>FGU(0>U*|19f4%M9 zjdkqjUH0Ag9ei=-l`$O~jhNZi`R$-?pO@$OFZr7;y!(-&!&h7O+j8^5_*cG6e&WNY zmo)2IY|Hth?Nigf9D8Su>Cl_47Y(_bKO_Ij!TM)6B)V3;S?l#}CZ z(ihT)Y#CdywQi5{b}LS-wkG{L?$+3sS5*$4BgOn&{UdkOPsdAgHw>Owv+0N?#VMwr zx@V7_G|_R_B+I|P%GbV{u%y7+&3aO=j~aVxv zIDQyVcI9H7nx9?6%+gWYK z&aEm|x0v(Fb1#0^sq~_|W&JspSZ~tZwH7saYxwJ%7UynFn?7K%ZA-n*DMce*Z0#HU z;p0%hWA~&`1&7PM~?r#?V$4?k4>m?)23@*%(*klJ;?U` z_>|?-8c+FsR|j{!$@9i1crEqgyPk_(d|}+mgv-axi@saiVfmrqtG@qvzstC3 z)A3nDy7!v!glBp8Zpq(`GUXrZ*zUnsOZL`TZ|wHZt1+3&u02`q?lJr2{q>$(y?3;G z(t#tMKaZUoGPlmKg$w4c?D}_xec$&5pY;9apU0hF48Q1Ec*oNtJdeKf=RYeNWS2{e z{&}eAU*quS554i`rG&eF9K1^KFA(@4ox}Mb9_cR?|1Jf4}+u?zJy}SG0ZB3k&S?wtd|3 zZ1>C=#?6xoTWw2x&|BVYo;1Gp18Ig!e?FUEf6&>amyXnF`$D@}(=v;HdG=!S=N`QB zVBdFoe(-*cJAa(=(fDDL$Lv2kcila29QAygP7x%d|1`V#ix>aCeTeVm!LieRo$&9MuczGe z)Ke3mw{L1?%NgG2>Zmp)H~)3HTi%beYksx2=(o*})%bVAkbSw!>n)Gle&T8C-i-Z= zE~mW{?~Z%pU}3xYN$Uo`P&)tn?|%QF@y|Q9KlWS0UtgZlX7jfxvnKVwzi51$cFCz7 zN7}}o^f&2$>9=+Jq@~|fYia3v;-=D8pRF5YZTIi`#4fjfdHdDm^g%5?tmXRk*xW$p z%jqMxlr%rusm_r7n`6qBFKs*a-7UL^W^}%|ptRsb-}*0A-@1HiwF|kqpS-pA0qN5X zo9h1lO5F$kGPHQQMfxA#&NBUR^2a-Nm-RgQ-n;EPjs9P+hJSqpo&(;K?Ca~+J{pL+iErbZ^~FQ31%Evn7hC4Kg7NgsFekslN1ywN)2!iB&7 zJ2&>0Pam9kw{v>Wgz5G(C->ENCARE;=jGmKAA9@J*V7%t5QSnXFI?8lhxE| z-q;ICzb*e`R(|R`xjECjE7t=>IhWpF_0f1`F!2m6OPu||16P&v|K(SDcPmDN|Fy5_ z)9r=HNIww29@0Nud#($@Fei~6!!WTa9dRmawBZm|{bFF#+BMzsyT3$8p#vOY#BX@f zTuEiUG^mb4WsM;U9AQKj&7)LSVw=zYP+3ce0!J8;g^i?OHKU7g4{cucsLDDhE7=cP zh%6fOO~wR%-9LTkttzV;&GO&~BeG~lXEM?}j@*%_9FofF#aVmXAwqZVap|0w-E&{rq^vNRo2U#MHrDqvp$otEm7do&-Q*&Wqr?Cgb`UZX;#zq z&rJ(HS6MAEGa^SAkwx==HHNo6f32&^x|6dABeLiwP-VTdyT>k-wScn-BeG}?tA4BT zXxfnmVqCU@LR9KyVUZ&}7 zoSa1%kwyKC%6g~7Ia#$egR=-DvS?XHWf?kKN2#o>oJAOsMfZ?u&VTjV`D~SSk+TRR zvgrO@Wwmh9{$VBOJ5u)vM;MWn0FByjT-|W4mC72+S%eW;RF_oNv5DO_tE?9|i!dS! zL2FpfKYm5msKoF~&LWJ+qFSNa8rP%8TPmwD4FYh45m|}QsNW2I`0IYJtE>T>MHrFQ zMqu@t+v{DGHJ`HxBeL2GthLR4M8HbA_HY(qL{>Y2)xdcg9go8LkFy9PvZ!}bzZ(3^ zZqqcC)iV|s;RqwL+C!tVZe1QzqOyuOi!dUK#vqjyclTGPRn{wT9n5m_|0s{Kacno>kZ$&J=Dw89ZaWKkeVa_6q$V!Grwe`{PVZW&?yduUNVMG=NRIn6V?V7Fl zPi2`oi!dUq8)LP{k({;1i$_(~eVj!Yk(C0C$*8ch{=S3-Hznua;4H$3tnQ3OwVK>N z?+!hovVP$#!icO?Xws)S8S;IMtFe1y$Sc%E?cprKh%75(QU6aaQR=WyW&O=rgb`UbXw(^Or#aI#^{{Q2y; zP-NMmH5ps6t9aw4!_T>@t;w847?FjBp<&hdVpeOFMQmVOJyzKEW(Ja zOvX~m>)4RCD^=D9oJAOsl_jvQF1?0sOz97+$KxU#VMLY(8Z{5cnObd7Sr*PBjL7l| zENA6abS;Xl2RMr`BFo2Ex8X=`=K4;@RMr;GB8r>U**M36*t`vj`)y`~vIM zalfO2D>3Xqw@`3|5m~oGquQ$9?E<2su<|&IFe0lzV`1{dT=j>n=$;kUbDTvOku?As zb(XSsO6RF6>jY;JMq~|Stadn(JN$iP92Hyj>oFyJMj^89zy*_0Vg1*3=hG_7%UOgG zS%U=Dq<5R4=TvMx%vppHS$7I7+XH)+sjQuxMHrDan6WzINN&`nH@{I?S2>F?B5MdV z>N>#JYc~C?vbxu&kPHUGh^)JyQCXg@1^1||Nt{I(ku_9cU7RrCK9#kKvj`)y(7C`? z0*>VB^@)01Wqrw6gb`VHL!+`bjG>=dRC5021{4zB8if~G!=X`GeXe~OrLu14EW(Ja z9Dy}!)d|dX6Iht4@)_VFd{2oVBJ6VG%C2l+Q3`>VzER9Qc97GXrz1ZdR$ zuyk;(-YP5cW(rCEWl@ne5n7e?!_H4vsH_~$B8!ZaN%=PbgAtoxx+S@SO(K#?jj+|5~p5m^r~RtFr(W#xBxLuFm#EW(Ja>CmXF zSeH|}Y*krlsLA9ABeEWZMs3T-qNx@sF`U9#gb`UY1lG8mKQ-;^WzHgu$eJmzuI|0< zG1b;A4TGz%p+{@^Uah^$8h z)|oX+zfoCTTHqoaVMJB{8nu-7POxdpE1$CnBeLc*mNEy(FwE?#+FHq3gb`U40;}$> zAup+{uQ-b^BI{9sHT$kPeN|Qy-jNeVWT9aoT}ljJUUK(3l{JvF2qUri}mFMr17#SZn@{OH)~<1YCq8jL3Q%8nwJ0O8<0&%Iced zi*SSySx-Qt_Sgl+`!w}%Y63385k_P^3609Kyth(Q4>u*?A{=2v)>F`^tfNC8)YQYD z6L1lZFe2+|XjIlei&tyvVG=J8!icQJjMWZDa)Wku($vFT&LWJ+S^|xFUpcMX@0xn} zEN2l$WGxj~=a#kC)Wgp>i!dToJAOswVbh(zSlT-K&;Aoo3jWbvYr!IU6wrpg<|V6XAwqZtq@pm zSGzMxWp!zdi*PI8Mb`7ssPm{rJ0C>_S8U~T7GXrz3yhV7Be`K8ypE(RtQRB_4MUTzZx*cWud?ppEW(Ja^#beAfWkd0>ov|IjL5=`lg8Gt_g@*V zvd(iBVMNv|0;{M-$pMwst}QOY5k_Ra3XREVq>DkPg;(?Fb8|v5uQ3eOXA0-#;y?02F`F31k7F(Pem%ebDirfN z!`zA^xtWh{2Z=(|#^(*3n~Vc+r1(T%`L|CfW;4U2(-FSoC!YeU59dvWp|q15mC`Xf z6te|aOvVv7)`m|%v8zcaW-G(ccpU@(!{&Q;$rzj%N_oy33<)f@7&W9aw-x%zLaiUL20jUfTkyBhxyrQxiQsaPQ7{S(dXidfjbcEl( ztGh7)G%5Zjc4R(B{J-Z8iq;@KerW7{OL$kVU!C=iiA(R8}=UeP9^D)=tKX#gW{R z^gVH}1#NZWEQS$my$7sXUZ?MU{5F-9%UKK~*h2H>EV4!EdLw9SF=sK1U~6}fMd@nu z``VK#>s`)b7(-{xhn)5>R=7_&;g>2oi(!Dn6MJZ0u7*`$Vi~kMKlhR*SfBlt3RHOj znX7f1{GTwgt_|0a9^*ysxCzBQSi@w$z-cnlZ3G9DBOPyYW~Ae_zl?PG zXZp-qiqq<|N-mF%g4g?03iw(|mecESIkGduQSkd}%!)wqn*CN=mfe?WiAaGp`6vH^ zhHMtISIWxv;ivypmh$6%8R^O|0fzFtX1gOZ+v2w~UPd~57d0atFK1??(+k=e=|U)~ z!EAF@w$o{K_*gW9ME25Y7^+IlGJD(}MAc%am}aEo<;=+ThICblF0&jcS(J=gx9j?H*R_ zJb6_iI?b7Ww>R7A;6xr(Ay-)~WmV2*RpaV3`~2A!tId5QCad3CrrYeu^x6DwCu<4e zOESDox7n9%@z_0*Tgcc5v31$h*utjM=gP8Wv!-+%n_*(>vswHutC!b;h&jZVTANmL zrY+O!vN~>*PT8g=wsy0}lj(KXGOL!i8m85pZTDo`Go3d|r(B*Irrm6_IxKFN%UYGZ zwP~0>v)7Vs@%g>iDHY}CA2QN44GctYw!`gI8d$ijRf*ly()5{~l0DPv&Av{~szkw} z(_{BJT-VDUm8h|Z63NW=pa&N%YPv0LjkRfe1H0Lu>6Wsy<&HmC_4HI;@dT<1wKm)5 z^>`$qO!QRVHg!~=&5rWaRiUs{Hu$Ky3#*ygnVD8g)^)9hkFYP>ZgJXdjvG^TRy}5q z!{K&&bUl$K!fL@F!D@6tbUVC0t3RSmm54ZNi8fRshuak~cU7X!qRpS_wAy?TGe{*0 z79HknpCiki>EX3VKNN+`2h_-dYIS7$>=xdz!%|sA;8O`LRdQuYR*Q}IV3Dc#H2@m1 zwN#7_R-f1AmCG|MRjmkGs@0t3^}Ad?d4do+?CRQ!NX_XIg#?_3kXUN1g*kh^(AWnnJ0yj|^hKc362G3TsbppQ1e%hChej#kbja)#jCM$kf}+H2WMDzdOs$hrk=ybg8ig({1tiENE(hq8@Ho2)TuYW%72ZXWCHnEKWBsPd!u4 zQMpA6Ow?HyO4ETVUj>`NsDftmc_fcJI|5BGsM1g#7O&M~@$fz*d_1+S!(+~JSUuSu z51)!eVrUzNHPf7B&9-N|vm%f}8==Q+&-O|-zcS+J%_t158T6r6uf^$gd-&X5L((?` zmi57W05j9(v|AiX=O31-$wQTCGvlt&?r~c~bMOW>ZRSj$#qaR@uEz{((`j~ld|rzu zGc-GOHs$d~jV+jx58aG1W<*Y>o@p~nxZ8EuG`CH{otl2gP;J`G4$0$l+q17rjgU|Y zy`nGE!J83HLaS)iY0mchtkx`-=9V-9Ri9L+S#nssZo8k~l!mt&A;Q^qpVMLS`P4a9 zs8vSQTg@_ivpqh^t8|SaR&_)sY&xAT zOSV%P>Z)$jVa~FlzwszlP-fz&t}+O9NsTS0SvHqs_h$136N#ymjLMWS5wJS5v9zHr zma5p4%-L?Q*XFZn?!4G-Lb%wXNClgAtJUN1Xckk#F~h|++u?OfQf5`sDcJO)OL6&J z=#3(#Q(K~HWI?pLGVNA-WRohfTdJ0r<-x2uD{{uFysnyiHm}*`vG_4|Rw1HVdls|g z^jlGBd9&86qo}n;Zd&X+7-~$x%=A0GUO#V|dZwmPvM+LInb|g*8}*&{LVBh=7KIti zu@IM?ZSz|EKHih)nM&ESr8w=R1>?EZl8HMR4{w=zreHG|RnVLkto&q45om%zm4=Bc z-BMletui&0Q?*GwDVCG{+1gvNusOsVgh0)9*sM+`Z?|k7uBU2@3b&nhC#_3* zc~=pZs;!<{tM*LfkxSy;Q&_4ddo@dZt`!RgYjmuRA@GUb$NnLfKU%kK4S*F3^9 znN7`2AZ}Ou)@+x{p}jQ^%Vah+Oqbb(Clr!XGm*rT1`SmmJy@rp#@2;r8&(UJ&eV}A z3{$N?D${QEI1Z9cH)BljU&xd1u0IDm3=gtPRr-xp6aTwK;f82}_mB zQhq$9wTj8T9XCSSo1m~(`5n4Ib-8dm@;p|Jt<~)JdmVm@Sgw4!r4_UotK02zDl7RREKM?L;;kCBnr$v88o9Ct6rQQ%ugJuL1BNx_AwURI zlSsNv5Nu{)R^(M4ScGRPHnmKb*_|bMT~3>3pb+k*H6_FPLDi_sZ1rWKp;;oX8tAI9 zmWoFtSgOd>3~XVns_E5Iu{>h+dzF=A`F1*d^=AoIsgl`|jrNbHCBmQ>!c~e^%k*Vp zF*Y-cS0p~jglEF4mg&Hwt4xbs91=sAN>a5Rm~&h|wo3KYGF@J$CtHkbNR^O# zPBE@tm)l}>iUvc7p$0R}nVCqn8|5hymebu*mcxmM2sdEz`lDsyW)eGauCu5j$CekT%5>sxoaQ!m?X*0k!YYjf zivU`xSMp*VM|s@Arefi#a%ZHaI=xmG`dnTv;i){CwC6}m^?I;C;!z%zT!$KJ)s5#Q z$SG}FLu!14v|6+ADBZ49di}IhQy0Qmb-L}2ETs;Hr$$Jt)#gMGrquiEP<2+5Z9Xh5 z)7_ofFlkiY=#q)WIr7G{oczgS3UbC26->%0xwkMcc(u5AV$Q_;;t~!kF3m5&8w(1T zu4*@~F+TRZ=1(4beN6u7h}XyFDaLXp7TqBa*p^Ei=hjlB^l zcihPQ$%)A~g2`ds5GIG#wQ8Z=5Edqx+WgQ~mN1Ep2)#kDYO!hS&kYPjAcZldBIU}5 zx)mnuFsS0v!oq^0lDyH{7E^3c)wH)$>GXSI)z*UDVJ2mNUpOG_H2An^ zd;%Pv9BtxFi1&}s<6eM%6)-NoMK%(y5pa3BZM5OS`xChPfh&rE07vG-;Vv2R>JKna z)nG6~%?LPp_2O@ik&)rUBV05EqH)ZwW|KT!Y78H*!Nx*gISjrcM z(}mXn`u2YDg8wSicJx-T@l+O=w4A~_YsXP_|xBLd-QF*)#%wat)O#FTU=5IYt7e7jG zV?;8EA_^DGmoVWuf$6WuX*Q!1|1f+Z$Iv-*C>!(@UF;60`zTUa=3RB8Ui(Zjr$r{Jc)^XUAd zVg2(a=Ar)^#^xQs=5;O@HQvz6(5J3p6s4vysNl5D7J|VlX zB!5!=eVCji*a{{U=1~Jdf;m*FvBbb zvXbfB7&WB8fV4A|z-KlU3I3mZt@K0rBPiwlq(Dhx8a|7`K1oC3K6EqeqZ!bo zLb@3~%3#H@36nB$q^^yB2uCWPm>5s-Yka3=kcG$bFK^(llmqU-8BgF6H{DVST#)9T zEJ+K@h~*#3K_X%UA9bkJ`_POgo`5aM-TO>wyi_qD)*bkWvGDbrc2Z!d8NAY?TW8L? zc8y|Xl&S>FKqXn8z+XsF$^lQ{TV}!==!rDB17CUPUXGiy z67XRrLCkT>N_>$;JN>B)RxK<(|X@seE8!{D3&N=A?1KK zaD}DV9k|<&a?O!)St_?DCZt?W`I%}%DwX@Sz24qeN}EvBrcv=rfe(2m#m!lZK%~Gq zC9e)k0kA17Vt2Fzys@b7)sfRXXFNcyB3erCJ-xaV=xHzbEK9b5!DMuNlui>d{*Gf@N z0}~6ik-dV*#?8sTcI}!6VHEN(kSTI|30y#0YPrj#VsY%iBx7T+`ZLzyI)yilsO_(nj0*;uRVl751eq;M z#O}&;#wIllO-9!;G#QBh-D?<{bZdB_{;9f^xM=822kxlDkwcIr3ZW;{-5OoZ5M4s& zDud2s91U->6c0&eP`D@H6&Eh-zPM;I+{z(JOep=Tebs^-E`|9gXVAZJ;o6`#8Q8~v zM#ls{{zK)bxFiU2N@a=C;$}LQQhYLqoWh{1GLBLzOO#TXL8vkCij%KXDr6}ZQZ~Gr zQYBmwBcsWJ94>`94PJ5K!o33*O~DTc&F=D7y_24y`?q{!Ivac6yTwKAdp^2g%*2)x z=bt&cXxbx3cQzcj_K#JmpVVGmynamOw8sACM<+fsV%O@lWwWOKwzsmu?8*K8r?!0B z_-sz?oedh-=>PPEb(eQP^15O9#3L7v^mxJCY}oJjUVSw6$U}?jKf300k>UM^nn(BF z?Pz5fwDkPaucse#e%fSn{i8J#UVQnc_g#Gp8ZTb+*zt9%zn&Vu@Xht+qCftaw{uiY z$GO^n%y_NorHlt>*0^QKv(L90aaYb4{aP2dSaM;vlG6X>hb`#-N_5&gCYt@3j8qCF zIp%aY6#9BKm7>W=?U*pqvS~d+F?3gCQhpWA@Z0KQbVk&4wYI3vnT%Ao30-f8?Z;3| z48u^X#}v|V{LUAug<`0_nT&jzYnb5pbY&=}hJY!Uxow|}$sIXyVnHr0GDk0Nk15K_ zQ_eAKg@zoZS$3q!!K5#bzksP?nk$eX3mL| z=bGw4jZ&Fv1U27sOl(kt?|d<5Vwy>LlXNeVlcw-qPGcCn0NyQ~D<}`xYuY`jmnBD~ z!!+H~*g2hXP4M+|sw3j7+*Fb#BaKYtvj1D;jbb%`&YJQVGK}!LE|stPYVgHVFPmS3ptBn1Y2=}tq$3%kE^UroW(GLE$WTcSJXG|untjKM>&gO1Y2|$rRHJZYd<}p zvVP|*h7oMlV=Or|e5r5Mg^?<&k=#5C3?ta8FWBl_Z#%{qYUkwAIE!HfTXc6T$B=M6 z|2+JmDag8uvlvFOMdOQ_uI!AV-Bs4ToW(GLEt(grdD#BcS8u4Sr#XvZ1Y0)?whpIc z%vM=jIE!HfTU0AdMkNnd9;;oUvOeQ1h7oKv5o~>E`+Td)`jfL5MtCKhZkJ5P!#IlW zW;8`*efYk-qJsSU@^VH_9*q@x^mxjJ!ighG#uOAy%HfFM1-d`RYIHGP70;PiFj8D> zS1uHf#Dbp^RPc@(4+5|Z8LGyLW*BX8SZz_>q=K+v1J1hRg3<_qo*?L- zGSJ<=oceIf=eg`M#WBoctma~v1zq_nB_tx1U5rTOsg1~1u7_KymyIh3wu+-$%oh>i z7U)HU9EP|yFCro)gw?Hx$&jx`PK1^%K4_55Yx&`#r{zbyUb9PjYKpv)Egx^R^4&G1 zYfpLUn^wM)*vhvn(O`ItH@9#r-veo2)VeS$-&=9LOowAD-$k^FrIP2N8|_U)uf~}T zezSINMVDw^vK~Dt`-bU<`_AK;nNWf+`TOfh6h{9D4KVLO9wqNc?p=m zIF4po45wS+rSbCS1ROLj(h78k1dO`y>87b(0XTsxLvF#HQoj>X0=Oj{8!0?0k1fC);y5GDBZYSYnD03*Qh4af45n6CX@Dme z#D#exfO}!X?RuQ9{!x1?0A_|B7bd)Cfmy4^>H0tF2KI3b#gCjh-fY(XybkH8UVT#q z9QBibQ~_5FxPL=%c(SI8ABA@<1c&(Po|KqTP%*6m);e^u7=`|Co|L?dU?%@ho|KFm zncB76|NCPSs;3$^a#XJ7?0+D_Ab$R6>^S}}Up~tp&y@M&C(t$go5=r7lFuehX39yE z3+NjD74m;mhq6}yl>k< zOR@Xa1WVU?Km6@0U;E$-HJAVLL)IN1FTHiqlH1y4?_ASkTc6e||2y{%-sEUKy3d(9 zw=F%8y~^|AbB{i`tn~BK^*^8g`=3b-{%Mf$*wlOXo_lV_^F>QuedW!03$QqtwA^j@ z^ShL$OTOB@+16{{$L)W4^UJmahd=fG(1){rs_|oEsc-Ec^GEwSTlc-)@QvI@TP}XB zcY-}>P`5Rv4Qq?feHC}f{_uk@)%0w%b^LznuBPV<&kXD6Uf0?8%BGuNnP0iA)vHOL zE$;G&^~1bhTQ9WtoYJMY_xz!&m7Cu_Sw3sk$<05dZI*r;`re@QCWoWnyjb_*kY(9T zHoQ1HV^QN-lRiH-yxDqdHPgz)>tc@YC@6FohnCfwzv(;Qj=5bEzkTD{v0c+^-%(J0 z|D}?cQu0Cze+0Fr=X4Po2uXduj5zIVG8&T(!LO#oCR-HV>#<_W8WO z?pgo!m|yze-fwYyw>LUX+S_$a#;sQu?{8S&k{Vz7WckiY@SN^r5!+@gGm!?hG`^?C; zXFuxK?){keDsSDl^`Rpz&Yk-3)9Ig|opxmMFEg^I|FNy$=Aw0DFI0bN@%|U~OwX