From be712bbd210c61704d74a15730ed066499a163af Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Mon, 10 Mar 2025 13:47:03 -0400 Subject: [PATCH 01/17] Initial checkin of new native encryption at rest overview. --- modules/ROOT/nav.adoc | 1 + .../partials/new-features-80.adoc | 6 + .../pages/security/encryption-overview.adoc | 114 ++++++++--------- .../native-encryption-at-rest-overview.adoc | 119 ++++++++++++++++++ modules/learn/pages/views/docs_server_docker | 1 + 5 files changed, 185 insertions(+), 56 deletions(-) create mode 100644 modules/learn/pages/security/native-encryption-at-rest-overview.adoc create mode 160000 modules/learn/pages/views/docs_server_docker diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index 8133ad9abe..dcea690389 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -96,6 +96,7 @@ include::third-party:partial$nav.adoc[] ** xref:learn:security/on-the-wire-security.adoc[On-the-Wire Security] ** xref:learn:security/auditing.adoc[Auditing] ** xref:learn:security/encryption-overview.adoc[Encryption] + *** xref:learn:security/native-encryption-at-rest-overview.adoc[] .Manage * xref:manage:management-overview.adoc[Overview] diff --git a/modules/introduction/partials/new-features-80.adoc b/modules/introduction/partials/new-features-80.adoc index d875f9a19f..acb5ef58d1 100644 --- a/modules/introduction/partials/new-features-80.adoc +++ b/modules/introduction/partials/new-features-80.adoc @@ -165,3 +165,9 @@ It is now possible to change the plan used by a repository. The repository first needs to be paused, and then the plan can be changed, and the repository resumed, where it will now execute the tasks from its new plan. +=== Security + +* Couchbase Server Enterprise now supports native encryption at rest. +You can encrypt data, audits, and most logging and configuration information on a per-bucket basis. +You choose which buckets to encrypt and which remain unencrypted. +See XX for more information. \ No newline at end of file diff --git a/modules/learn/pages/security/encryption-overview.adoc b/modules/learn/pages/security/encryption-overview.adoc index 609cf7f517..81b4764d16 100644 --- a/modules/learn/pages/security/encryption-overview.adoc +++ b/modules/learn/pages/security/encryption-overview.adoc @@ -1,75 +1,77 @@ = Encryption -:description: pass:q[Couchbase Server uses _encryption_, to protect data.] +:description: pass:q[Couchbase Server lets you use encryption to protect data.] +:page-toclevels: 2 [abstract] {description} +You can configure network encryption for communications with clients, between nodes in the cluster, and with other clusters when using Cross-Datacenter Replication (XDCR). +Couchbase Server supports encrypting data stored on disk to limit data exposure. +You can also have your application store encrypted attributes in documents. +This topic provides an overview of the encryption features in Couchbase Server. -[#encryption-in-couchbase-server] -== Encryption in Couchbase Server - -By means of _encryption_, data is encoded such that it is non-readable, other than by authorized parties who possess the appropriate means of _decryption_. -Prior to decryption, therefore, encrypted data can be securely saved or transmitted. -This ensures the privacy of user-data, and the integrity of servers and their clients. - -Couchbase Server provides extensive support for data encryption and decryption. -Multiple areas of the system are affected: therefore, essential information is distributed throughout the documentation set. - -[#areas-of-encryption] -== Areas of Encryption - -The principal areas of Couchbase Server encryption-support are listed below, along with links to further information. [#encryption-on-the-wire] -=== Encryption on the Wire +== Network Encryption -This allows data to pass in encrypted form between nodes, between clusters, and between a cluster and its clients. +You can choose to encrypt client connections, intra-node connections, and cluster-to-cluster connections. +You configure each connection type separately. +For example, you can choose to encrypt client connections, but leave connections between nodes in a cluster unencrypted. -* *Node-to-Node Encryption*. -Network traffic between the individual nodes of a Couchbase-Server cluster can be encrypted, in order to optimize cluster-internal security. -See xref:learn:clusters-and-availability/node-to-node-encryption.adoc[Node-to-Node Encryption]. +Couchbase Server supports the following types of network encryption: -* *On-the-Wire Security Configuration*. -To support secure communications between nodes, clusters, and clients, Couchbase Server provides interfaces for the configuration of _TLS_ and supportive _cipher-suites_; of cluster-internal encryption-levels; and of secure UI-access. -See xref:learn:security/on-the-wire-security.adoc[On-the-Wire Security] for a conceptual overview, and xref:manage:manage-security/manage-tls.adoc[Manage On-the-Wire Security] for step-by-step configuration-instructions. +Node to Node:: +You can choose to encrypt all internal traffic between nodes in the cluster. +This configuration helps limit data leakage from network intrusions. +See xref:learn:clusters-and-availability/node-to-node-encryption.adoc[]. -* *Secure Console Access*. -Administrators can connect securely to Couchbase Web Console. -Non-secure access can be disabled, for extra security. -See xref:manage:manage-security/manage-console-access.adoc[Manage Console Access]. -* *X.509 Certificates*. -These support encrypted communications between nodes, between clusters, and between a cluster and its clients. +Client Connections:: +You can make encryption optional or required for client connections. +See xref:manage:manage-security/configure-client-certificates.adoc#enabling-client-security[Securing Client Access with TLS]. -** xref:learn:security/certificates.adoc[Certificates] provides an overview of certificates and their management. +Couchbase Server Web Console Access:: +You can configure the Web Console to require secure connections. +See xref:manage:manage-security/manage-console-access.adoc[]. -** xref:manage:manage-security/configure-server-certificates.adoc[Configure Server Certificates] explains the practical steps towards configuring certificates for Couchbase Server. -This page also provides information on working with different versions of SSL/TLS, and on supported _ciphers_. +Secure Access to Services:: +You can configure Couchbase Server services to only use secure ports. +See xref:install:install-ports.adoc[]. -** xref:manage:manage-security/configure-client-certificates.adoc[Configure Client Certificates] describes how to create a certificate to allow a client's secure access to Couchbase Server. +Secure XDCR Replication:: +You can encrypt XDCR replication between Couchbase Server clusters. +See xref:manage:manage-xdcr/enable-full-secure-replication.adoc[]. -** xref:manage:manage-security/enable-client-certificate-handling.adoc[Enable Client-Certificate Handling] explains how to configure Couchbase Server to accept communications from clients that wish to authenticate and communicate securely by means of certificates. +Couchbase Server TLS Support:: +Couchbase Server uses Transport Layer Security (TLS) with a selection of cipher-suites for network encryption. +See the following pages for more information about Couchbase Server's TLS support: ++ +* xref:learn:security/on-the-wire-security.adoc[] provides a conceptual overview of TLS in Couchbase Server. +* xref:manage:manage-security/manage-tls.adoc[] has step-by-step configuration instructions. +* xref:manage:manage-security/manage-connections-and-disks.adoc[] has a general overview of network security best practices. -** xref:manage:manage-security/rotate-server-certificates.adoc[Certificate Rotation] provides steps whereby server certificates can be _rotated_ periodically, to ensure optimal security. -** xref:manage:manage-security/handle-certificate-errors.adoc[Certificate Error Handling] explains how to handle errors related to certificate-based secure communication. - -** xref:manage:manage-xdcr/enable-full-secure-replication.adoc[Enable Fully Secure Replications] describes how certificates can be used to ensure that data is replicated securely between clusters. - -** xref:rest-api:rest-certificate-management.adoc[Certificate Management API] lists the REST API methods and URIs available for certificate management. +[#encryption-at-rest] +== Encryption at Rest -** The xref:cli:cbcli/couchbase-cli-ssl-manage.adoc[ssl-manage] CLI command supports management of SSL certificates. +Encryption at rest encrypts files stored on disk. +These files you can encrypt include those that store database data, configuration, logs, and audits. +Encrypting data at rest can help limit the exposure of confidential information from a security breach. -* *Secure Ports*. -Services are available on secure ports. -See xref:install:install-ports.adoc[Couchbase Server Ports]. +You have several options to encrypt your data at rest: -* *General Network Security*. -Best practices for ensuring the security of the network are provided in xref:manage:manage-security/manage-connections-and-disks.adoc[Network Security Recommendations]. +Use the Couchbase Server native encryption at-rest feature:: +Couchbase Server Enterprise has a built-in encryption-at-rest feature where it encrypts data as it saves it to disk. +Using the built-in encryption lets you fine-tune which data is encrypted and which it not. +For example, you can choose to encrypt sensitive customer data, while leaving less sensitive data, such as product catalog data, unencrypted. +By encrypting just the sensitive data in your database, you can limit the overhead of encrypting and decrypting data. +See xref:native-encryption-at-rest.adoc[] for more information. -[#encryption-at-rest] -=== Encryption at Rest +Use third-party tools:: +Third party tools can provide centralized encryption at rest. -Encryption _at Rest_ (meaning, on disk or other storage-device) allows passwords and data in files and directories to be encrypted. +Use OS-level disk encryption:: +You can use disk encryption such as the LUKS encrypted filesystem which is available on Linux. +See * *Data in Files and Directories*. Programs are available for the encryption of data in files and directories. @@ -80,12 +82,12 @@ Passwords, certificates, and other items essential to Couchbase-Server security See xref:manage:manage-security/manage-system-secrets.adoc[Manage System Secrets]. [#encryption-in-applications] -=== Encryption in Applications +== Encryption in Applications -* *Field Level Encryption*. -This allows fields within a document to be securely encrypted by the SDK, to support FIPS-140-2 compliance. -See xref:java-sdk:howtos:encrypting-using-sdk.adoc[Field Level Encryption], for an overview. +Applications can use the SDK to store fields in encrypted format. +See the SDK documentation for your development language for more information. +For example: -* *Field Level Encryption from the Java SDK*. -Provides directions for configuring encrypted field-level communication with Couchbase Server. -See xref:java-sdk:concept-docs:encryption.adoc[Field Level Encryption from the Java SDK]. +* Go SDK: xref:go-sdk:howtos:encrypting-using-sdk.adoc[] +* Java SDK: xref:java-sdk:howtos:encrypting-using-sdk.adoc[] +* Python SDK: xref:python-sdk:howtos:encrypting-using-sdk.adoc[] diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc new file mode 100644 index 0000000000..2cce4614b2 --- /dev/null +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -0,0 +1,119 @@ += Native Encryption at Rest Overview +:description: Couchbase Server can encrypt data, configuration, logs, and audit information it saves to disk. This encryption can help reduce the chances or severity of data breaches. +:page-toclevels: 2 +[.edition]#{enterprise}# + +[abstract] +{description} +This feature is transparent to the database's users. +Couchbase Server automatically decrypts data when read from disk and encrypts it when writing it to disk. + +== Encrypting Bucket Data + +When encrypting data in buckets, you choose which buckets to encrypt. +For example, you can decide to just encrypt buckets containing sensitive data (such as customer information). +You can also choose to leave less-sensitive data unencrypted (such as product catalog data). +Encrypting just sensitive data can help reduce the overhead of encrypting and decrypting data on your cluster. + +Each bucket can have its own encryption key. +This configuration is useful in multi-tenancy configurations where each customer can have their own encryption key. + +== Encrypting Audit, Logs, and Configuration Data + +In addition to data, you can encrypt audit, logs, and most configuration data. +Each of these types of data can have its own encryption key. + +[NOTE] +==== +Currently, some configuration data is not encrypted. +This includes: + +* Bootstrap information +* Node and internal client certificates +* Prometheus configuration, metric data, and tokens used to gather metrics +==== + + +== Encryption at Rest Keys + +To encrypt data, you must create at least one encryption key. +Couchbase Server uses the keys you create directly to generate Data Encryption Keys (DEKs) which it uses to encrypt the information it stores on disk. +This two-layer system lets Couchbase Server manage the rotation and deletion of the DEKs. +The encryption keys can be either managed by Couchbase Server, or by a Key Management Service. +See <<#kms>>. + +When you create an encryption key, you choose what Couchbase Server can encrypt with it. +You choose one or more things the key can encrypt: + +* **Other encryption keys** +Makes the key a Key Encryption Key (KEK). +You use a KEK to encrypt other encryption keys instead of relying on the database's master password. +* **Data**. +You can uae the key to encrypt all data or restrict its use to specific buckets. +* **Configuration** +* **Logs** +* **Audits** + +You can use a single Secret for encrypting all data, logs, audit, and configuration information. +This configuration is easy to configure, but is not flexible. +For more complex environments (such as multi-tenancy databases), you can choose to create multiple encryption keys. +You then choose keys to encrypt one or more buckets as well as logs, audits, and configuration data. +You can also create layers of encryption keys. +For example, you can have a master encryption key that is managed by an external key management system (see <<#kms>>). +Then you use the master key to encrypt additional encryption keys, each of which you assign to a different bucket or + +=== Encryption Key Rotation and Expiration + +Key rotation generates new encryption keys on aregular basis and retires old ones. +Frequent rotations limit the amount of data encrypted with any one key. +It can help limit the exposure of data if a data breach compromises an encryption key. + +You can choose to have Couchbase Server rotate encryption keys and DEKs automatically. +By default, Couchbase Server automatically rotates DEKs. +You choose how frequently Couchbase Server rotates DEKs and (if you enable it) encryption keys. + +When Couchbase Server generates a new encryption key or DEK during rotation, it does not delete the expired key immediately. +It uses the new key to encrypt data as it writes it to disk. +Mutating a document results in it being encrypted with the currently-active DEK. +Couchbase Server does not re-encrypt existing data unless it is mutated. +Instead, it keeps the expired keys so it can decrypt the older data. + +Couchbase Server only deletes an expired DEK when either of the following occur: + +* When no data uses the DEK for encryption. +Once the last piece of data that relies on the DEK for decryption is either mutated or deleted, Couchbase Server is free to delete the DEK. + +* The DEK's lifetime elapses. +Couchbase Server can set a maximum lifetime for a DEK. +When a DEK's lifetime elapses, Couchbase Server uses the currently-active DEK to re-encrypts any data that is still encrypted with the expired DEK. +It then deletes the expired DEK. + +You can adjust the rotation and lifetime for DEKs to suit your environment. + + +[#kms] +=== Encryption Key Management Services + +A key management service generates and stores the encryption keys Couchbase Server uses to encrypt its DEKs. +When you create a key, you choose which key management service you want to manage it. +Couchbase Server works with several key management services: + +Couchbase Server Key Auto-Generation:: +You can have Couchbase Server act as the key management system. +This method does not require any additional configuration. +However, using this method means that Couchbase Server stores your encryption keys locally, leaving them more vulnerable if there is a security breach. + +AWS Key Management Service:: +You can use the https://docs.aws.amazon.com/kms/latest/developerguide/overview.html[AWS Key Management Service] (AWS KMS) to manage keys for you. +Using this method requires some configuration. +However, this method is more secure because AWS it keeps the encryption keys secure internally. +Even if one or more nodes in your cluster suffer a security breach, the encryption keys remain secure within the AWS KMS. + +KMSs that support Key Management Interoperability Protocol (KMIP):: +https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol[KMIP] is a standards protocol implemented by key management services. +Couchbase Server can work with any KMS that implements this standard. +As with AWS KMS, using a KMIP-compliance KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. + +Because you can choose a different KMS for each encryption key, you can have some keys managed by an external KMS. +You can then use these external keys to sign other encryption keys that Couchbase Server manages. + diff --git a/modules/learn/pages/views/docs_server_docker b/modules/learn/pages/views/docs_server_docker new file mode 160000 index 0000000000..d216fef465 --- /dev/null +++ b/modules/learn/pages/views/docs_server_docker @@ -0,0 +1 @@ +Subproject commit d216fef4652009e520a1a60dc9123f38fe268270 From 685c243ed948f6de0d8e1233f0e9c03b396414ef Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 20 Mar 2025 14:24:19 -0400 Subject: [PATCH 02/17] Checkin before doing system update. Styarted on refactoring the roles page and some work to add/change roles for Morpheus. --- .../native-encryption-at-rest-overview.adoc | 53 +- modules/learn/pages/security/roles.adoc | 1002 +++++++++-------- 2 files changed, 588 insertions(+), 467 deletions(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 2cce4614b2..2f0008c5b1 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -12,7 +12,7 @@ Couchbase Server automatically decrypts data when read from disk and encrypts it When encrypting data in buckets, you choose which buckets to encrypt. For example, you can decide to just encrypt buckets containing sensitive data (such as customer information). -You can also choose to leave less-sensitive data unencrypted (such as product catalog data). +You can also choose to leave less-sensitive data unencrypted (product catalog data, for example). Encrypting just sensitive data can help reduce the overhead of encrypting and decrypting data on your cluster. Each bucket can have its own encryption key. @@ -21,11 +21,13 @@ This configuration is useful in multi-tenancy configurations where each customer == Encrypting Audit, Logs, and Configuration Data In addition to data, you can encrypt audit, logs, and most configuration data. +You can enable encrypting each type of information separately. Each of these types of data can have its own encryption key. + [NOTE] ==== -Currently, some configuration data is not encrypted. +Some configuration data is not encrypted. This includes: * Bootstrap information @@ -54,41 +56,44 @@ You can uae the key to encrypt all data or restrict its use to specific buckets. * **Logs** * **Audits** -You can use a single Secret for encrypting all data, logs, audit, and configuration information. +You can use a single encryption key for encrypting all data, logs, audit, and configuration information. This configuration is easy to configure, but is not flexible. For more complex environments (such as multi-tenancy databases), you can choose to create multiple encryption keys. You then choose keys to encrypt one or more buckets as well as logs, audits, and configuration data. You can also create layers of encryption keys. -For example, you can have a master encryption key that is managed by an external key management system (see <<#kms>>). -Then you use the master key to encrypt additional encryption keys, each of which you assign to a different bucket or +For example, you can have a primary encryption key that's managed by an external key management system (see <<#kms>>). +Then you use the primary key to encrypt additional encryption keys. +You can then use these keys to encrypt bucket, log, configuration, or audit data. + + === Encryption Key Rotation and Expiration -Key rotation generates new encryption keys on aregular basis and retires old ones. +Key rotation periodically retires old keys and generates new encryption keys to replace them. Frequent rotations limit the amount of data encrypted with any one key. -It can help limit the exposure of data if a data breach compromises an encryption key. +It helps limit the exposure of data if a data breach compromises an encryption key. You can choose to have Couchbase Server rotate encryption keys and DEKs automatically. By default, Couchbase Server automatically rotates DEKs. +It does not rotate encryption keys by default. You choose how frequently Couchbase Server rotates DEKs and (if you enable it) encryption keys. -When Couchbase Server generates a new encryption key or DEK during rotation, it does not delete the expired key immediately. -It uses the new key to encrypt data as it writes it to disk. -Mutating a document results in it being encrypted with the currently-active DEK. -Couchbase Server does not re-encrypt existing data unless it is mutated. -Instead, it keeps the expired keys so it can decrypt the older data. +When Couchbase Server generates a new encryption key or DEK during rotation, it does not immediately delete the expired key. +It uses the new key to encrypt data as it writes it to disk. -Couchbase Server only deletes an expired DEK when either of the following occur: +When rotating DEKs, Couchbase Server does not re-encrypt existing data unless it's mutated. +It keeps the expired keys so it can decrypt the older data. +Couchbase Server only deletes an expired DEK when either: -* When no data uses the DEK for encryption. -Once the last piece of data that relies on the DEK for decryption is either mutated or deleted, Couchbase Server is free to delete the DEK. +* No data uses the DEK for encryption. +Once the last piece of data that relies on the DEK for decryption is either mutated or deleted, Couchbase Server deletes the unused DEK. * The DEK's lifetime elapses. Couchbase Server can set a maximum lifetime for a DEK. -When a DEK's lifetime elapses, Couchbase Server uses the currently-active DEK to re-encrypts any data that is still encrypted with the expired DEK. +When a DEK's lifetime elapses, Couchbase Server uses the active DEK to re-encrypt any data that's still encrypted with the expired DEK. It then deletes the expired DEK. -You can adjust the rotation and lifetime for DEKs to suit your environment. +You can adjust the rotation and lifetime for encryption keys to suit your environment. [#kms] @@ -98,7 +103,7 @@ A key management service generates and stores the encryption keys Couchbase Serv When you create a key, you choose which key management service you want to manage it. Couchbase Server works with several key management services: -Couchbase Server Key Auto-Generation:: +Couchbase Server Secret Management:: You can have Couchbase Server act as the key management system. This method does not require any additional configuration. However, using this method means that Couchbase Server stores your encryption keys locally, leaving them more vulnerable if there is a security breach. @@ -106,14 +111,20 @@ However, using this method means that Couchbase Server stores your encryption ke AWS Key Management Service:: You can use the https://docs.aws.amazon.com/kms/latest/developerguide/overview.html[AWS Key Management Service] (AWS KMS) to manage keys for you. Using this method requires some configuration. -However, this method is more secure because AWS it keeps the encryption keys secure internally. +However, this method is more secure because AWS keeps the encryption keys secure internally. Even if one or more nodes in your cluster suffer a security breach, the encryption keys remain secure within the AWS KMS. +One downside of using the AWS KMS is that the cluster relies on an external source for its encryption keys. +Disruptions in AWS or the network could result in errors because the cluster cannot retrieve encryption keys to encrypt or decrypt data. KMSs that support Key Management Interoperability Protocol (KMIP):: https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol[KMIP] is a standards protocol implemented by key management services. Couchbase Server can work with any KMS that implements this standard. As with AWS KMS, using a KMIP-compliance KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. +It also has the same downside--KMS downtime or network issues can cause errors due to the cluster not being able to access the encryption keys. -Because you can choose a different KMS for each encryption key, you can have some keys managed by an external KMS. -You can then use these external keys to sign other encryption keys that Couchbase Server manages. +Couchbase Server does not limit you to a single KMS. +You free to choose a different KMS for each encryption key. +For example, you can choose to use AWS or a KMIP-compliant KMS encryption key as a primary encryption key. +You use to encrypt other encryption keys that Couchbase Server manages. +This method adds a layer of security to the encryption keys while diff --git a/modules/learn/pages/security/roles.adoc b/modules/learn/pages/security/roles.adoc index b4133f9536..69ff4dc1f2 100644 --- a/modules/learn/pages/security/roles.adoc +++ b/modules/learn/pages/security/roles.adoc @@ -1,37 +1,59 @@ = Roles -:description: pass:q[A Couchbase role permits one or more resources to be accessed according to defined privileges.] +:description: pass:q[Roles grant users access to one or more resources.] :page-aliases: security:security-roles,security:concepts-rba,security:concepts-rba-for-apps,security:rbac-ro-user,learn:security/resources-under-access-control,security:security-resources-under-access-control +:page-toclevels: 3 [abstract] {description} +Administrators assign roles to users to enable them to perform the tasks they need to carry out when using Couchbase Server. + [#roles-and-privileges] == Roles and Privileges -Couchbase roles each have a fixed association with a set of one or more privileges. -Each privilege is associated with a resource. -Privileges are actions such as *Read*, *Write*, *Execute*, *Manage*, *Flush*, and *List*; or a combination of some or all of these. +Each role grants one or more privileges to interact with a resource. +A Privilege is an action that a user can take with a resource. +They include: + +* Execute +* Flush +* List +* Manage +* Read +* Write + +Roles provide a set of privilidges for interacting with a resource. +For example, the Data Writer role grants a user the ability to write data. +This ability can be limited to specific collections, scopes, or buckets. +This role does not grant the user the ability to read data. +The Data Reader role grants that ability. + +An administrator can grant a user a set of roles to precesely tailor their privildges so they can perform their tasks in the database. -Roles are of the following kinds: -* Administative: Associated with cluster-wide privileges. -Some of these roles are for administrators; who might manage cluster-configurations; or read statistics; or enforce security. -Others are for users and user-defined applications that require access to specific, cluster-wide resources. -* Bucket: Associated with bucket administration, collection management, and application access. -Roles in this category can each be applied to one, to multiple, or to all buckets on the cluster. -* Data, Views, and XDCR: Associated with the Data Service. -This includes the reading, writing, monitoring, backing-up, and restoring of data; the administration of Views; and the administration of Cross Data-Center Replication (XDCR). +Roles fall into the following categories: -* Other Services: Roles for the administration of services other than the Data Service. -These roles are organized under the following categories: Query & Index, Search, Analytics, and Backup. +* Administative roles have cluster-wide privileges. +Some of these roles are for administrators who manage cluster-configurations, read statistics, or enforce security. +Others are for users and user-defined applications that must access cluster-wide resources. + +* Bucket: rolees have priviledges for bucket administration, collection management, and application access. +Roles in this category grant priviledges to one, multiple, or all buckets in the cluster. + +* Data, Views, and XDCR roles have priviledges associated with the Data Service. +These priviledges include reading, writing, monitoring, backing-up, and restoring data. +They also allow the administration of Views and Cross Datacenter Replication (XDCR) connections. + +* Other Services roles are for the administration of services other than the Data Service. +These roles have the following subcategories: Query & Index, Search, Analytics, and Backup. (Eventing administration is covered within the Administrative category.) -* Mobile: Associated with the administration of Sync Gateway. +* Mobile roles are associated with the administration of Sync Gateway. -When a user (meaning either an administrator or an application) attempts to access a resource, they must authenticate. -The roles and privileges associated with the user-credentials thereby presented are checked by Couchbase Server. +A user (including administrators and applications) must authneticate when they attempt to access a resource. +Couchbase Server checks the roles and privileges associated with the user's credentials. If the associated roles contain privileges that support the kind of access that is being attempted, access is granted; otherwise, it is denied. [#roles-in-relation-to-buckets] @@ -51,53 +73,62 @@ For detailed information on scopes and collections, see xref:learn:data/scopes-a [#commonly-used-roles] === Commonly Used Roles -Couchbase Server users can largely be categorized as administrators, developers, and applications. -Each user-category is supported by a different subset of roles. +Couchbase Server users can be categorized as administrators, developers, and applications. +Couchbase Server has several roles for each of these user categories. -* Administrators. -Able to log into Couchbase Web Console and perform administrative tasks; but unable to read or write data. +Administrators:: +Users with any of the administrator roles can log into Couchbase Server Web Console and perform administrative tasks. +Besides the Full Admin role, these roles do not grant the ability to read or write data. ++ +The administrative roles grant their uses the ability to carry out specific tasks. +For example, a user with the Cluster Admin role can manage of all cluster features except security. +Users with the Read-Only Admin role can only read statistics. +The Bucket Admin role allows management only of one or more buckets. +See the <<#admin-roles>> for details. + -The administrative tasks available are divided into multiple `admin` roles. -For example, the *Cluster Admin* role allows the management of all cluster features except security; while the *Read-Only Admin* role allows only the reading of statistics; and the *Bucket Admin* role allows management only of one or more buckets. -See the *Admin* roles listed below for full details. -Note that depending on the administrator's assigned roles, the content of Couchbase Web Console changes: for example, the entire *Security* screen is only visible to *Full Admin* administrators; and to administrators who possess both the *Local User Security Admin* and the *External User Security Admin* roles. - -* Applications. -Able to read or write data; but unable to log into Couchbase Web Console, or in any way modify cluster-settings. -For example, the *Data Reader* and *Data Writer* roles allows data to be respectively read and written to one or more collections, within one or more scopes, within one or more buckets. -Other application-intended roles are *Application Access*, *Data Writer*, *Data Backup & Restore*, and *Data Monitor*. -See below for details on each. - -* Developers. +NOTE: The user interface of the Couchbase Web Console changes based on the administrative role the user has. +For example, only the Full Admin role lets a user access the entire **Security** screen. +Users with either the Local User Admin or the External User Admin roles can only see the **Users & Groups** tab on this screen. + +Applications:: +Application users are can read or write data. +They cannot log into Couchbase Server Web Console or modify cluster settings. +For example, the Data Reader and Data Writer roles lets the user read and write one or more collections, within one or more scopes, within one or more buckets. +Other application roles are Application Access, Data Writer, Data Backup & Restore, and Data Monitor. +See <<#>> for details on each. + +Developers:: Can be given a selection of roles, allowing the right degree of data and console access. For example, the *Read-Only Admin* role allows the reading of cluster-statistics, while the *Data Read* and *Data Write* roles allow access to data on one or more buckets. -The following list contains all roles supported by Couchbase Server, Enterprise Edition. -Each role is explained by means of a description and (in most cases) a table: the table lists the privileges in association with resources. -The header of each table states the role's *name*, followed by its alias name in parentheses: alias names are used in commands and queries. +The following list contains all roles supported by Couchbase Server Enterprise Edition. In each table-body, where a privilege is associated with a resource, this is indicated with a check-mark. -Where a privilege is not associated with a resource (or where association would not be applicable), this is indicated with a cross. -Resources not referred to in a particular table have no privileges associated with them in the context of the role being described. Note that some roles grant access to Couchbase Web Console; while others do not. The set of features displayed within the console varies, according to role. -Note also that any authentication failure will be logged in the log file for the resource on which access was attempted. +also that any authentication failure will be logged in the log file for the resource on which access was attempted. See xref:manage:manage-logging/manage-logging.adoc[Manage Logging], for detailed information on using log files. + +[#admin-roles] +== Administrative Roles + +The following roles grant users the ability to administer some aspects of Couchbase Server. + [#full-admin] -== Full Admin +=== Full Admin -The *Full Admin* role (an Administrative role) supports full access to all Couchbase-Server features and resources, including those of security. -The role allows access to Couchbase Web Console, and allows the reading and writing of bucket-data. +The Full Admin role (an Administrative role) grants full access to all Couchbase Server features and resources, including those of security. +The role allows access to Couchbase Server Web Console, and allows the reading and writing of bucket-data. This role is also available in Couchbase Server Community Edition. [#cluster-admin] -== Cluster Admin +=== Cluster Admin -The *Cluster Admin* role (an Administrative role) allows the management of all cluster features except security. -The role allows access to Couchbase Web Console, but does not permit the writing of data. +The Cluster Admin role (an Administrative role) lets the user manage of all cluster features except security. +The role allows access to Couchbase Server Web Console, but does not permit the writing of data. [#table_cluster_admin_role,cols="15,8,8,8,8",hrows=3] |=== @@ -136,11 +167,13 @@ The role allows access to Couchbase Web Console, but does not permit the writing ^| image:introduction/no.png[] |=== + + [#local-user-security-admin] -== Local User Security Admin +=== Local User Admin -The *Local User Security Admin* role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. -The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, the *Local User Security Admin*, or the *External User Security Admin* role; and does not permit the administrator to change their own role (which therefore remains *Local User Security Admin*). +The Local User Admin role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. +The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, *Local User Admin*, or the *External User Admin* role; and does not permit the administrator to change their own role (which therefore remains *Local User Security Admin*). The role supports access to Couchbase Web Console, but does not support the reading of data. [#table_security_admin_local_role,cols="15,8,8,8,8",hrows=3] @@ -181,7 +214,7 @@ The role supports access to Couchbase Web Console, but does not support the read |=== [#external-user-security-admin] -== External User Security Admin +=== External User Admin The *External User Security Admin* role (an Administrative role) allows the management of external user roles and the reading of all cluster statistics. The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, the *Local User Security Admin*, or the *External User Security Admin* role; and does not permit the administrator to change their own role (which therefore remains *External User Security Admin*). @@ -189,7 +222,7 @@ The role supports access to Couchbase Web Console, but does not support the read [#table_security_admin_external_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: External User Security Admin (`security_admin_external`) +5+^| Role: External User Admin (`security_admin_external`) .2+^h| Resources 4+^h| Privileges @@ -225,16 +258,11 @@ The role supports access to Couchbase Web Console, but does not support the read |=== [#read-only-admin] -== Read-Only Admin +=== Read-Only Admin -The *Read-Only Admin* role (an Administrative role) supports the reading of Couchbase Server statistics. +The Read-Only Admin role (an Administrative role) grants the user the ability to read Couchbase Server statistics. This information includes registered usernames with roles and authentication domains, but excludes passwords. -ifeval::['{page-component-version}' == '7.6'] -Since Couchbase Server version 7.6.2, users with this role can also read Backup Service data to monitor backup plans and tasks. -endif::[] -ifeval::['{page-component-version}' != '7.6'] Users with this role can also read Backup Service data to monitor backup plans and tasks. -endif::[] The role allows access to Couchbase Server Web Console. This role is also available in Couchbase Server Community Edition. @@ -275,7 +303,67 @@ This role is also available in Couchbase Server Community Edition. ^| image:introduction/no.png[] ^| image:introduction/no.png[] -^| Backup Service (tasks and plans) [.status]#Couchbase Server 7.6.2# +^| Backup Service (tasks and plans) +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +|=== + + +[#security-admin] +=== Security Admin + +The Security Admin role grants the user the ability to read Couchbase Sever settings for the cluster, buckets and administrator settings. +It also grants the ability to edits other user's roles with the execption of granting or revoking the Full Admin or Security Admin roles. +This role does not grant the user the ability to edit their own roles. + +The role allows access to Couchbase Server Web Console. + +[#table_security_admin_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Security Admin (`security_admin`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Cluster +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI (except Passwords) +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Security (except Passwords) +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Data +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Backup Service (tasks and plans) +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] + +^| Roles (except user's own roles, and Full Admin or Security Admin) ^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] @@ -284,11 +372,11 @@ This role is also available in Couchbase Server Community Edition. |=== [#external-stats-reader] -== External Stats Reader +=== External Stats Reader -The *External Stats Reader* role (an Administrative role) grants access to the `/metrics` and `/prometheus_sd_config` endpoints for Prometheus integration. +The External Stats Reader role (an Administrative role) grants access to the `/metrics` and `/prometheus_sd_config` endpoints for Prometheus integration. All statistics for all services can be read. -The role does not allow access to Couchbase Web Console. +The role does not grant access to Couchbase Web Console. [#table_external_stats_reader_role,cols="15,8,8,8,8",hrows=3] |=== @@ -310,7 +398,7 @@ The role does not allow access to Couchbase Web Console. |=== [#xdcr-admin] -== XDCR Admin +=== XDCR Admin The *XDCR Admin* role (an XDCR role) allows use of XDCR features, to create cluster references and replication streams. The role allows access to Couchbase Web Console and allows the reading of data. @@ -364,8 +452,11 @@ The role allows access to Couchbase Web Console and allows the reading of data. ^| image:introduction/no.png[] |=== +[#query-roles] +== Query & Index Roles + [#query-curl-access] -== Query Curl Access +=== Query Curl Access The *Query Curl Access* role (a Query & Index role) allows the {sqlpp} CURL function to be executed by an externally authenticated user. The user can access Couchbase Web Console, but cannot read data, other than that returned by the {sqlpp} CURL function. @@ -414,7 +505,7 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Quer |=== [#query-system-catalog] -== Query System Catalog +=== Query System Catalog The *Query System Catalog* role (a Query & Index role) allows information to be looked up by means of {sqlpp} in the system catalog: this includes `system:indexes`, `system:prepareds`, and tables listing current and past queries. This role is designed for troubleshooters, who need to debug queries. @@ -470,7 +561,7 @@ The role allows access to Couchbase Web Console, but does not permit the reading |=== [#manage-global-functions] -== Manage Global Functions +=== Manage Global Functions The *Manage Global Functions* role (a Query & Index role) allows global {sqlpp} functions to be managed. The user can access Couchbase Web Console, but cannot read data. @@ -507,7 +598,7 @@ The user can access Couchbase Web Console, but cannot read data. |=== [#execute-global-functions] -== Execute Global Functions +=== Execute Global Functions The *Execute Global Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. The user can access Couchbase Web Console, but cannot read data. @@ -544,7 +635,7 @@ The user can access Couchbase Web Console, but cannot read data. |=== [#manage-scope-functions] -== Manage Scope Functions (Query and Index) +=== Manage Scope Functions (Query and Index) The *Manage Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be managed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data. @@ -580,15 +671,15 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#execute-scope-functions] -== Execute Scope Functions +[#query-select] +=== Query Select -The *Execute Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be executed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. +The *Query Select* role (which is a Query & Index role) allows the SELECT statement to be executed per collection, given corresponding specifications for bucket and scope. +This role allows access to Couchbase Web Console; it also supports the reading of data, and of bucket settings. -[#table_execute_scope_functions_role,cols="15,8,8,8,8",hrows=3] +[#table_query_select_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Execute Scope Functions (`query_execute_functions`) +5+^| Role: Query Select (`query_select`) .2+^h| Resources 4+^h| Privileges @@ -598,11 +689,23 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| Collection, Bucket, Scope: {sqlpp}, udf +^| Bucket : {sqlpp}, SELECT +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/yes.png[] +^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] + +^| Bucket Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -617,15 +720,16 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#manage-global-external-functions] -== Manage Global External Functions +[#query-update] +== Query Update -The *Manage Global External Functions* role (a Query & Index role) allows global external language functions to be managed. -The user can access Couchbase Web Console, but cannot read data. +The *Query Update* role (which is a Query & Index role) allows the UPDATE statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. +It allows the reading of bucket settings. -[#table_manage_global_external_functions_role,cols="15,8,8,8,8",hrows=3] +[#table_query_update_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Manage Global External Functions (`query_manage_global_external_functions`) +5+^| Role: Query Update (`query_update`) .2+^h| Resources 4+^h| Privileges @@ -635,11 +739,23 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| {sqlpp}, udf_external +^| Bucket : {sqlpp}, UPDATE ^| image:introduction/no.png[] ^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs ^| image:introduction/no.png[] ^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -654,15 +770,16 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#execute-global-external-functions] -== Execute Global External Functions +[#query-insert] +== Query Insert -The *Execute Global External Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. -The user can access Couchbase Web Console, but cannot read data. +The *Query Insert* role (which is a Query & Index role) allows the INSERT statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. +It allows the reading of bucket settings. -[#table_execute_global_external_functions_role,cols="15,8,8,8,8",hrows=3] +[#table_query_insert_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Execute Global External Functions (`query_execute_global_external_functions`) +5+^| Role: Query Insert (`query_insert`) .2+^h| Resources 4+^h| Privileges @@ -672,11 +789,23 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| {sqlpp}, udf_external +^| Bucket : {sqlpp}, INSERT +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/no.png[] +^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] + +^| Bucket Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -691,15 +820,16 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#manage-scope-external-functions] -== Manage Scope External Functions +[#query-delete] +== Query Delete -The *Manage Scope External Functions* role (a Query & Index role) allows external language functions to be managed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. +The *Query Delete* role (which is a Query & Index role) allows the DELETE statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Server Web Console, and allows the deletion of data. +It allows the reading of bucket settings. -[#table_manage_external_functions_role,cols="15,8,8,8,8",hrows=3] +[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Manage Scope External Functions (`query_manage_external_functions`) +5+^| Role: Query Delete (`query_delete`) .2+^h| Resources 4+^h| Privileges @@ -709,11 +839,24 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| Collection, Bucket, Scope: {sqlpp}, udf_external + +^| Bucket : {sqlpp}, DELETE +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] ^| image:introduction/no.png[] + +^| Bucket : Docs Delete ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -728,15 +871,19 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#execute-scope-external-functions] -== Execute Scope External Functions -The *Execute Scope External Functions* role (a Query & Index role) allows external language functions to be executed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. +[#query-sequential-scan] +== Query Use Sequential Scan -[#table_execute_external_functions_role,cols="15,8,8,8,8",hrows=3] +The *Query Use Sequential Scan* role, located under Query & Index in the Web Console's roles list, allows users' queries to perform a sequential scan of a keyspace. +The query planner only decides to use a sequential scan when there is no suitable index for the keyspace. +Only queries by users with this role can use a sequential scan to access data because scanning a large unindexed keyspace can be expensive. +This role does not grant the user the ability to read or mutate data or access to the Web Console. +Administrators' queries automatically have permission to perform sequential scans when necessary. + +[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Execute Scope External Functions (`query_execute_external_functions`) +5+^| Role: Query Use Sequential Scan (`query_use_sequential_scans`) .2+^h| Resources 4+^h| Privileges @@ -746,34 +893,46 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| Collection, Bucket, Scope: {sqlpp}, udf_external +^| Sequential Scans ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/yes.png[] ^| image:introduction/no.png[] +^| Bucket : Docs +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + ^| UI -^| image:introduction/yes.png[] +^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| Pools -^| image:introduction/yes.png[] +^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] |=== -[#analytics-reader] -== Analytics Reader +[#query-manage-index] +== Query Manage Index -The *Analytics Reader* role (an Analytics role) allows querying of shadow data-sets. -The role allows access to Couchbase Web Console, and permits the reading of data. +The *Query Manage Index* role (which is a Query & Index role) allows indexes to be managed per collection, given corresponding specifications for bucket and scope. +The role allows access to Couchbase Web Console, but does not permit the reading of data. -[#table_analytics_reader_role,cols="15,8,8,8,8",hrows=3] +[#table_query_manage_index_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Analytics Reader (`analytics_reader`) +5+^| Role: Query Manage Index (`query_manage_index`) .2+^h| Resources 4+^h| Privileges @@ -783,11 +942,29 @@ The role allows access to Couchbase Web Console, and permits the reading of data ^h| *Execute* ^h| *Manage* -^| Bucket : Analytics +^| Bucket : {sqlpp}, INDEX +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Statistics ^| image:introduction/yes.png[] ^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Index Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -802,15 +979,16 @@ The role allows access to Couchbase Web Console, and permits the reading of data ^| image:introduction/no.png[] |=== -[#analytics-admin] -== Analytics Admin -The *Analytics Admin* role (an Analytics role) allows management of dataverses; management of all Analytics Service links; and management of all datasets. -The role allows access to Couchbase Web Console, but does not permit the reading of data. +[#execute-scope-functions] +=== Execute Scope Functions -[#table_analytics_admin_role,cols="15,8,8,8,8",hrows=3] +The *Execute Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be executed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. + +[#table_execute_scope_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Analytics Admin (`analytics_admin`) +5+^| Role: Execute Scope Functions (`query_execute_functions`) .2+^h| Resources 4+^h| Privileges @@ -820,20 +998,244 @@ The role allows access to Couchbase Web Console, but does not permit the reading ^h| *Execute* ^h| *Manage* -^| Dataverse : Analytics -^| image:introduction/no.png[] +^| Collection, Bucket, Scope: {sqlpp}, udf ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/yes.png[] +^| image:introduction/no.png[] -^| Bucket : Analytics +^| UI +^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| Bucket : UI -^| image:introduction/no.png[] +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#manage-global-external-functions] +=== Manage Global External Functions + +The *Manage Global External Functions* role (a Query & Index role) allows global external language functions to be managed. +The user can access Couchbase Web Console, but cannot read data. + +[#table_manage_global_external_functions_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Manage Global External Functions (`query_manage_global_external_functions`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| {sqlpp}, udf_external +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#execute-global-external-functions] +=== Execute Global External Functions + +The *Execute Global External Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. +The user can access Couchbase Web Console, but cannot read data. + +[#table_execute_global_external_functions_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Execute Global External Functions (`query_execute_global_external_functions`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| {sqlpp}, udf_external +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#manage-scope-external-functions] +=== Manage Scope External Functions + +The *Manage Scope External Functions* role (a Query & Index role) allows external language functions to be managed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. + +[#table_manage_external_functions_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Manage Scope External Functions (`query_manage_external_functions`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Collection, Bucket, Scope: {sqlpp}, udf_external +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#execute-scope-external-functions] +=== Execute Scope External Functions + +The *Execute Scope External Functions* role (a Query & Index role) allows external language functions to be executed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. + +[#table_execute_external_functions_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Execute Scope External Functions (`query_execute_external_functions`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Collection, Bucket, Scope: {sqlpp}, udf_external +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +== Analytics Roles + +[#analytics-reader] +=== Analytics Reader + +The *Analytics Reader* role (an Analytics role) allows querying of shadow data-sets. +The role allows access to Couchbase Web Console, and permits the reading of data. + +[#table_analytics_reader_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Analytics Reader (`analytics_reader`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Bucket : Analytics +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#analytics-admin] +=== Analytics Admin + +The *Analytics Admin* role (an Analytics role) allows management of dataverses; management of all Analytics Service links; and management of all datasets. +The role allows access to Couchbase Web Console, but does not permit the reading of data. + +[#table_analytics_admin_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Analytics Admin (`analytics_admin`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Dataverse : Analytics +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] + +^| Bucket : Analytics +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] + +^| Bucket : UI +^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] @@ -851,8 +1253,11 @@ The role allows access to Couchbase Web Console, but does not permit the reading ^| image:introduction/no.png[] |=== +[#bucket-roles] +== Bucket Roles + [#bucket-admin] -== Bucket Admin +=== Bucket Admin The *Bucket Admin* role (which is a Bucket role) allows the management of all per bucket features (including starting and stopping XDCR). The role allows access to Couchbase Web Console, but does not permit the reading or writing of data. @@ -901,7 +1306,7 @@ The role allows access to Couchbase Web Console, but does not permit the reading |=== [#manage-scopes] -== Manage Scopes +=== Manage Scopes The *Manage Scopes* role (a Bucket role) allows the creation and deletion of scopes, and the creation and deletion of collections per scope, given the corresponding specification of bucket. The role allows no access to data, and does not permit access to Couchbase Web Console. @@ -933,7 +1338,7 @@ The role is intended for application use only. |=== [#application-access] -== Application Access +=== Application Access The *Application Access* role (a Bucket role) provides read and write access to data, per bucket. The role does not allow access to Couchbase Web Console: it is intended for applications, rather than users. @@ -1005,8 +1410,12 @@ Note that in versions of Couchbase Server prior to 5.5, this role was referred t ^| image:introduction/no.png[] |=== +== XDCR Roles + +The following roles give users access to XDCR settings and features. + [#xdcr-inbound] -== XDCR Inbound +=== XDCR Inbound The *XDCR Inbound* role (which is an XDCR role) allows the creation of inbound XDCR streams, per bucket. It does not allow access to Couchbase Web Console, and does not permit the reading of data. @@ -1050,8 +1459,12 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Repl ^| image:introduction/no.png[] |=== +== Mobile Roles + +The mobile roles give users access to Sync Gateway and related features. + [#sync-gateway] -== Sync Gateway +=== Sync Gateway The *Sync Gateway* role (which is a Mobile role) allows full access to data per bucket, as required by Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1131,7 +1544,7 @@ The user can, by means of Sync Gateway, read and write data, manage indexes and |=== [#sync-gateway-configurator] -== Sync Gateway Architect +=== Sync Gateway Architect The *Sync Gateway Architect* role (which is a Mobile role) allows management of Sync Gateway databases; and of Sync Gateway users and roles; and allows access to Sync Gateway's `/metrics` endpoint. The role does not allow access to Couchbase Web Console; and does not allow reading of application data. @@ -1175,7 +1588,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-app] -== Sync Gateway Application +=== Sync Gateway Application The *Sync Gateway Application* role (which is a Mobile role) allows management of Sync Gateway users and roles; and allows application data to be read and written through Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1213,7 +1626,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-application-read-only] -== Sync Gateway Application Read Only +=== Sync Gateway Application Read Only The *Sync Gateway Application Read Only* role (which is a Mobile role) allows reading of Sync Gateway users and roles; and allows application data to be read through Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1251,7 +1664,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-replicator] -== Sync Gateway Replicator +=== Sync Gateway Replicator The *Sync Gateway Replicator* role (which is a Mobile role) allows management of Sync Gateway replications. The role does not allow access to Couchbase Web Console. @@ -1282,7 +1695,7 @@ The role does not allow access to Couchbase Web Console. |=== [#sync-gateway-dev-ops] -== Sync Gateway Dev Ops +=== Sync Gateway Dev Ops The *Sync Gateway Dev Ops* role (which is a Mobile role) allows management of Sync Gateway node-level configuration; and allows access to Syn Gateway's `/metrics` endpoint, for Prometheus integration. The role does not allow access to Couchbase Web Console. @@ -1318,8 +1731,12 @@ The role does not allow access to Couchbase Web Console. ^| image:introduction/no.png[] |=== +== Data Roles + +These roles give users the ability to read and write data in buckets. + [#data-reader] -== Data Reader +=== Data Reader The *Data Reader* role (which is a Data role) allows data to be read per collection, given corresponding specifications for bucket and scope. Note that the role does not permit the running of {sqlpp} queries (such as SELECT) against data. @@ -1363,7 +1780,7 @@ The role does not allow access to Couchbase Web Console: it is intended to suppo |=== [#data-writer] -== Data Writer +=== Data Writer The *Data Writer* role (which is a Data role) allows data to be written per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. @@ -1400,7 +1817,7 @@ The role does not allow access to Couchbase Web Console: it is intended to suppo |=== [#data-dcp-reader] -== Data DCP Reader +=== Data DCP Reader The *Data DCP Reader* role (which is a Data role) allows DCP streams to be initiated per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. @@ -1450,7 +1867,7 @@ The role does allow the reading of data. |=== [#data-backup-and-restore] -== Data Backup & Restore +=== Data Backup & Restore The *Data Backup & Restore* role (which is a Data role) allows data to be backed up and restored, per bucket. The role supports the reading of data. @@ -1587,7 +2004,7 @@ The privileges represented in this table are, from left to right, Read, Write, E |=== [#data-monitor] -== Data Monitor +=== Data Monitor The *Data Monitor* role (which is a Data role) allows statistics to be read for a given bucket, scope, or collection. It does not allow access to Couchbase Web Console, and does not permit the reading of data. @@ -1621,7 +2038,7 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Data |=== [#views-admin] -== Views Admin +=== Views Admin The *Views Admin* role (which is a Views role) allows the management of views, per bucket. The role allows access to Couchbase Web Console. @@ -1718,313 +2135,6 @@ This role does not allow access to Couchbase Web Console, and is intended to sup ^| image:introduction/no.png[] |=== -[#query-select] -== Query Select - -The *Query Select* role (which is a Query & Index role) allows the SELECT statement to be executed per collection, given corresponding specifications for bucket and scope. -This role allows access to Couchbase Web Console; it also supports the reading of data, and of bucket settings. - -[#table_query_select_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Select (`query_select`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Bucket : {sqlpp}, SELECT -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#query-update] -== Query Update - -The *Query Update* role (which is a Query & Index role) allows the UPDATE statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. -It allows the reading of bucket settings. - -[#table_query_update_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Update (`query_update`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Bucket : {sqlpp}, UPDATE -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#query-insert] -== Query Insert - -The *Query Insert* role (which is a Query & Index role) allows the INSERT statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. -It allows the reading of bucket settings. - -[#table_query_insert_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Insert (`query_insert`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Bucket : {sqlpp}, INSERT -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#query-delete] -== Query Delete - -The *Query Delete* role (which is a Query & Index role) allows the DELETE statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Server Web Console, and allows the deletion of data. -It allows the reading of bucket settings. - -[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Delete (`query_delete`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - - -^| Bucket : {sqlpp}, DELETE -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs Delete -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - - -[#query-sequential-scan] -== Query Use Sequential Scan - -The *Query Use Sequential Scan* role, located under Query & Index in the Web Console's roles list, allows users' queries to perform a sequential scan of a keyspace. -The query planner only decides to use a sequential scan when there is no suitable index for the keyspace. -Only queries by users with this role can use a sequential scan to access data because scanning a large unindexed keyspace can be expensive. -This role does not grant the user the ability to read or mutate data or access to the Web Console. -Administrators' queries automatically have permission to perform sequential scans when necessary. - -[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Use Sequential Scan (`query_use_sequential_scans`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Sequential Scans -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#query-manage-index] -== Query Manage Index - -The *Query Manage Index* role (which is a Query & Index role) allows indexes to be managed per collection, given corresponding specifications for bucket and scope. -The role allows access to Couchbase Web Console, but does not permit the reading of data. - -[#table_query_manage_index_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Query Manage Index (`query_manage_index`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Bucket : {sqlpp}, INDEX -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Statistics -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Index Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== [#eventing-full-admin] == Eventing Full Admin From ce8c6d85fb757c85aa0e739e058d25fd1a2f7d5e Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 27 Mar 2025 10:41:16 -0400 Subject: [PATCH 03/17] Work in progress checkin --- .../learn/pages/security/authentication-domains.adoc | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/learn/pages/security/authentication-domains.adoc b/modules/learn/pages/security/authentication-domains.adoc index 4ec382aed6..97a9cc0be4 100644 --- a/modules/learn/pages/security/authentication-domains.adoc +++ b/modules/learn/pages/security/authentication-domains.adoc @@ -10,16 +10,17 @@ Couchbase Server authenticates each user by means of one of two _authentication domains_. The domains are: -* _Local_: Contains users defined locally. +[#local-domain] +* Local: Contains users defined locally. This includes: - ** The _Full Administrator_ for Couchbase Server. + ** The Full Administrator for Couchbase Server. - ** _Locally Defined Users_, which are explicitly created by a Couchbase Server administrator; and each feature a username and password unique within the Local domain. + ** Locally Defined Users, which are explicitly created by a Couchbase Server administrator; and each feature a username and password unique within the Local domain. - ** _Internal Components_ within Couchbase Server that support core functionality (for example, indexing, searching, and replicating), and run with full administrative privileges. + ** Internal Components within Couchbase Server that support core functionality (for example, indexing, searching, and replicating), and run with full administrative privileges. - ** _Generated Users_, which are created by Couchbase Server as part of the upgrade process from pre-5.0 to 5.0 and post-5.0 versions; each in correspondence with a legacy bucket. + ** Generated Users, which are created by Couchbase Server as part of the upgrade process from pre-5.0 to 5.0 and post-5.0 versions; each in correspondence with a legacy bucket. Each Generated User is assigned a _username_ that is identical to the bucket-name; and either a _password_ that is identical to the bucket's pre-5.0 password, or _no password_, if the bucket did not feature a password. Generated Users are created to ensure that legacy applications can continue to access legacy buckets after upgrade to 5.0 or post-5.0, with the same username-password combination being used for authentication. + From 6b5e43e749bdf0bfa2b403c2e57359f08e236d7d Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Wed, 16 Apr 2025 10:44:48 -0400 Subject: [PATCH 04/17] In-progress checkin. Added section on creating keys using the UI. --- modules/ROOT/nav.adoc | 1 + .../partials/new-features-80.adoc | 3 +- .../pages/security/encryption-overview.adoc | 16 +-- .../native-encryption-at-rest-overview.adoc | 29 ++-- .../manage-native-encryption-at-rest.adoc | 128 ++++++++++++++++++ 5 files changed, 154 insertions(+), 23 deletions(-) create mode 100644 modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index dcea690389..3eb040bac9 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -157,6 +157,7 @@ include::third-party:partial$nav.adoc[] **** xref:manage:manage-security/rotate-server-certificates.adoc[Certificate Rotation] **** xref:manage:manage-security/handle-certificate-errors.adoc[Certificate Error Handling] ** xref:manage:manage-security/manage-tls.adoc[Manage On-the-Wire Security] + ** xref:manage:manage-security/manage-native-encryption-at-rest.adoc[] ** xref:manage:manage-security/manage-auditing.adoc[Manage Auditing] ** xref:manage:manage-security/manage-sessions.adoc[Manage Sessions] ** xref:manage:manage-security/manage-console-access.adoc[Manage Console Access] diff --git a/modules/introduction/partials/new-features-80.adoc b/modules/introduction/partials/new-features-80.adoc index acb5ef58d1..636e53f06e 100644 --- a/modules/introduction/partials/new-features-80.adoc +++ b/modules/introduction/partials/new-features-80.adoc @@ -167,7 +167,8 @@ and the repository resumed, where it will now execute the tasks from its new pla === Security -* Couchbase Server Enterprise now supports native encryption at rest. +https://jira.issues.couchbase.com/browse/MB-16143#icft=MB-16143[MB-16143]:: +Couchbase Server Enterprise now supports native encryption at rest. You can encrypt data, audits, and most logging and configuration information on a per-bucket basis. You choose which buckets to encrypt and which remain unencrypted. See XX for more information. \ No newline at end of file diff --git a/modules/learn/pages/security/encryption-overview.adoc b/modules/learn/pages/security/encryption-overview.adoc index 81b4764d16..9b8242ee72 100644 --- a/modules/learn/pages/security/encryption-overview.adoc +++ b/modules/learn/pages/security/encryption-overview.adoc @@ -54,7 +54,7 @@ See the following pages for more information about Couchbase Server's TLS suppor == Encryption at Rest Encryption at rest encrypts files stored on disk. -These files you can encrypt include those that store database data, configuration, logs, and audits. +The files you can encrypt include those that store database data, configuration, logs, and audits. Encrypting data at rest can help limit the exposure of confidential information from a security breach. You have several options to encrypt your data at rest: @@ -64,21 +64,19 @@ Couchbase Server Enterprise has a built-in encryption-at-rest feature where it e Using the built-in encryption lets you fine-tune which data is encrypted and which it not. For example, you can choose to encrypt sensitive customer data, while leaving less sensitive data, such as product catalog data, unencrypted. By encrypting just the sensitive data in your database, you can limit the overhead of encrypting and decrypting data. -See xref:native-encryption-at-rest.adoc[] for more information. +See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information. Use third-party tools:: -Third party tools can provide centralized encryption at rest. +Third party tools such as https://cpl.thalesgroup.com/encryption/transparent-encryption[Thales CipherTrust^] (formerly known as Vormetric/Gemalto) and https://www.protegrity.com/[Protegrity^] can provide centralized encryption at rest. Use OS-level disk encryption:: You can use disk encryption such as the LUKS encrypted filesystem which is available on Linux. -See - -* *Data in Files and Directories*. -Programs are available for the encryption of data in files and directories. See xref:manage:manage-security/manage-connections-and-disks.adoc#securing-on-disk-data[Securing On-Disk Data]. -* *System Secrets*. -Passwords, certificates, and other items essential to Couchbase-Server security can be written to disk in encrypted format. + +== System Secrets + +Couchbase Server can write passwords, certificates, and other sensitive information to disk in encrypted format. See xref:manage:manage-security/manage-system-secrets.adoc[Manage System Secrets]. [#encryption-in-applications] diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 2f0008c5b1..b4eaa75e60 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -7,10 +7,11 @@ {description} This feature is transparent to the database's users. Couchbase Server automatically decrypts data when read from disk and encrypts it when writing it to disk. +For steps to take when managing this feature, see xref:manage:manage-security/manage-native-encryption-at-rest.adoc[]. == Encrypting Bucket Data -When encrypting data in buckets, you choose which buckets to encrypt. +When using native encryption-at-resty to encrypting data in buckets, you choose which buckets to encrypt. For example, you can decide to just encrypt buckets containing sensitive data (such as customer information). You can also choose to leave less-sensitive data unencrypted (product catalog data, for example). Encrypting just sensitive data can help reduce the overhead of encrypting and decrypting data on your cluster. @@ -35,7 +36,7 @@ This includes: * Prometheus configuration, metric data, and tokens used to gather metrics ==== - +[#keys] == Encryption at Rest Keys To encrypt data, you must create at least one encryption key. @@ -51,7 +52,7 @@ You choose one or more things the key can encrypt: Makes the key a Key Encryption Key (KEK). You use a KEK to encrypt other encryption keys instead of relying on the database's master password. * **Data**. -You can uae the key to encrypt all data or restrict its use to specific buckets. +You can use the key to encrypt all data or restrict its use to specific buckets. * **Configuration** * **Logs** * **Audits** @@ -63,10 +64,10 @@ You then choose keys to encrypt one or more buckets as well as logs, audits, and You can also create layers of encryption keys. For example, you can have a primary encryption key that's managed by an external key management system (see <<#kms>>). Then you use the primary key to encrypt additional encryption keys. -You can then use these keys to encrypt bucket, log, configuration, or audit data. - +You can then use these keys to encrypt bucket, log, configuration, or audit data. +[#rotation-expiration] === Encryption Key Rotation and Expiration Key rotation periodically retires old keys and generates new encryption keys to replace them. @@ -79,10 +80,10 @@ It does not rotate encryption keys by default. You choose how frequently Couchbase Server rotates DEKs and (if you enable it) encryption keys. When Couchbase Server generates a new encryption key or DEK during rotation, it does not immediately delete the expired key. +It keeps the expired keys so it can decrypt the older data. It uses the new key to encrypt data as it writes it to disk. - When rotating DEKs, Couchbase Server does not re-encrypt existing data unless it's mutated. -It keeps the expired keys so it can decrypt the older data. + Couchbase Server only deletes an expired DEK when either: * No data uses the DEK for encryption. @@ -95,7 +96,6 @@ It then deletes the expired DEK. You can adjust the rotation and lifetime for encryption keys to suit your environment. - [#kms] === Encryption Key Management Services @@ -119,12 +119,15 @@ Disruptions in AWS or the network could result in errors because the cluster can KMSs that support Key Management Interoperability Protocol (KMIP):: https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol[KMIP] is a standards protocol implemented by key management services. Couchbase Server can work with any KMS that implements this standard. -As with AWS KMS, using a KMIP-compliance KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. -It also has the same downside--KMS downtime or network issues can cause errors due to the cluster not being able to access the encryption keys. +As with AWS KMS, using a KMIP-compliant KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. +You can also have the KMS perform the encryption of data for you. +This measure improves security because the encryption key never leaves the KMS. +Using a KMIP-compatile KMS also has the same downside--Couchbase Server may report errors due to KMS downtime or network issues because it cannot download encryption keys. Couchbase Server does not limit you to a single KMS. -You free to choose a different KMS for each encryption key. +You can choose any KMS for each encryption key. For example, you can choose to use AWS or a KMIP-compliant KMS encryption key as a primary encryption key. -You use to encrypt other encryption keys that Couchbase Server manages. -This method adds a layer of security to the encryption keys while +Then you can use this key to encrypt other encryption keys managed by Couchbase Server. +This method adds a layer of security to the locally managed encryption keys while reducing the number of key retrievals from the remote KMS. +See xref:manage:manage-security/manage-native-encryption-at-rest.adoc[] to learn how to manage native encryption at test. \ No newline at end of file diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc new file mode 100644 index 0000000000..15fe6204f8 --- /dev/null +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -0,0 +1,128 @@ += Manage Native Encryption at Rest +:description: pass:q[Couchbase Server's native encryption at rest protects sensitive data by encrypting it when writing it to disk.] +:tabs: +:page-toclevels: 2 +[.edition]#{enterprise}# + +[abstract] +{description} +This feature is transparent to the database's users. +Couchbase Server automatically decrypts data when read from disk and encrypts it when writing it to disk. +For an overview of native encryption at rest, see xref:learn:security/native-encryption-at-rest-overview.adoc[]. + + + +You can only use encryption at rest on + +Enabling encryption at rest is a two step process: + +. Create at least one encryption key. +Couchbase Server uses these keys to encrypt its own encryption keys for data. +. Enable encryption for one or more types of data. +You can encrypt: ++ +* All data in a bucket +* Logs +* Configuration data +* Audit data + +The following sections explain these steps in greater detail. + +## Creating Encryption Keys + +Before encrypting data at rest, you must create at least one encryption key. +You can limit what type of data each key can encrypt or limit them to . + +### Requirements + +For each key you create, you must choose a Key Management Service (KMS) that maintains the key for you. +You have three options to choose from: + +* Amazon's AWS KMS +* Any KMS that implements the Key Management Interoperability Protocol (KMIP) +* Couchbase Server + +See xref:learn:security/native-encryption-at-rest-overview.adoc#kms[Encryption Key Management Services] for more information. + +You must decide what your encryption can encrypt. +You can create an encryption key that can encrypt any data and sign other keys. +You can also choose to limit what data the key can be use to encrypt, or configure it to only encrypt other encryption keys. +See learn:security/native-encryption-at-rest-overview.adoc#keys[Encryption at Rest Keys] for more information. + +You must have the proper privileges to create encryption keys. +Only users with the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles can create encryption keys. + +### Create an Encryption Key Using the Couchbase Server Web Console + +To create an encryption key using the Couchbase Server Web Console: + +. Select menu:Security[] on the main menu. +. Click the menu:Encryption at Rest[] tab. +. Click the btn[Add Encryption Key] button. +. In the *Add Encryption Key* dialog, enter a name for your key in the *Name* box. +. If you want to limit what your key can encrypt, click *Configure* to expand the list of uses. +Then choose what you want to your key to be able to encrypt. + ++ +If you want to limit which buckets your key can be used to encrypt, deselect *Data* and then select the buckets. + +. Under *Key Type*, choose the KMS you want to manage your key. +The option you choose changes the fields in the rest of the dialog. + +. Depending on the KMS you chose, enter the details to complete creating the encryption key: ++ +[{tabs}] +==== +AWS:: ++ +-- +[start=8] +. Enter the Amazon Resource Name (ARN) for the encryption key and the AWS Region in which the KMS is located. +. Choose whether to enable the AWS Instance Metadata Service. +Enable this option if your Couchbase Server cluster runs on AWS EC2 instances and uses IAM roles to access other AWS services. +. Enter the paths on your cluster where you have stored the AWS crendital, config, and profile files. +. Verify that your settings work by clicking the btn:[Test Encryption Key Settings] button. + +-- + +KMIP:: ++ +-- +To use a KMIP-compatible KMS: + +[start=8] +. Enter the host and port number for the KMS server, and choose a timeout for network connections. +. Choose which certificates to use when verifying the identity of the KMS, or choose to not verify. +. Enter the details for the client certificate Couchbase Server uses to authenticate with the KMS including how to encrypt the certificate passphrase. +. Choose whether you want Couchbase Server to fetch the key from the KMS and encrypt data itself, or if you want the KMS to encrypt the data for you. +-- + +Auto-Generated:: ++ +-- +This option has Couchbase Server manage the key. +To complete creating the key: + +[start=8] +. Choose whether you want to use the cluster's master password or another encryption key to encrypt your new key. +If you want to use another encryption key, you must an existing one that allows itself to be used as a Key Encryption Key (KEK). +. Decide whether you want Couchbase Server to cache the key. +This setting lets Couchbase Server keep the key unencrypted in memory so it does not have to decrypt it for each read or write. +. Decide whether you want to have the keys auto rotate. +If you choose to rotate them, enter how often, and select a date and time for the first rotation. +See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. +-- + +==== + +### Create an Encryption Key Using the REST API + +The REST API's `/settings/encryptionKey` endpoint lets you create and manage encryption keys. + +Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or Cluster Admin roles can enable encryption for rest for buckets as long as an encryption key exists that is allowed to create the bucket. + + + +// Notes: +// bucket-admin, no access to security in Web Console. Can apply encryption at rest to bucket if a suitable key exists. +// cluster-admin can enable encryption at rest for a bucket. Cannot access Secrutiy settings. \ No newline at end of file From 6b3f3bc62f0af07397bfa47371d75c51fb45c5ba Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Fri, 25 Apr 2025 14:10:11 -0400 Subject: [PATCH 05/17] Interim checkin. Mostly complete draft of overview. Partial draft of managing page. Start on REST API. --- modules/ROOT/nav.adoc | 2 + .../partials/new-features-80.adoc | 2 - .../encryption-at-rest-key-hierarchy.drawio | 192 ++++++++++++++++++ .../encryption-at-rest-key-hierarchy.svg | 4 + .../native-encryption-at-rest-overview.adoc | 164 +++++++++------ .../encryption-key-hierarhy-diagram.adoc | 80 ++++++++ .../add-encryption-key-dialog.png | Bin 0 -> 68716 bytes .../add-encryption-key-uses.png | Bin 0 -> 23119 bytes .../encryption-at-rest-page.png | Bin 0 -> 131978 bytes .../manage-native-encryption-at-rest.adoc | 123 ++++++++--- .../encryption-at-rest.adoc | 57 ++++++ .../manage-encryption-keys.adoc | 71 +++++++ 12 files changed, 609 insertions(+), 86 deletions(-) create mode 100644 modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.drawio create mode 100644 modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.svg create mode 100644 modules/learn/partials/encryption-key-hierarhy-diagram.adoc create mode 100644 modules/manage/assets/images/manage-security/add-encryption-key-dialog.png create mode 100644 modules/manage/assets/images/manage-security/add-encryption-key-uses.png create mode 100644 modules/manage/assets/images/manage-security/encryption-at-rest-page.png create mode 100644 modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc create mode 100644 modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index 3eb040bac9..dc7e1c13da 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -446,6 +446,8 @@ include::cli:partial$cbcli/nav.adoc[] ***** xref:rest-api:rest-regenerate-all-certs.adoc[Regenerate All Certificates] ***** xref:rest-api:deprecated-security-apis/deprecated-certificate-management-apis.adoc[Deprecated Certificate Management APIs] ****** xref:rest-api:deprecated-security-apis/upload-retrieve-root-cert.adoc[Upload and Retrieve the Root Certificate] + *** xref:rest-api:security/encryption-at-rest/encryption-at-rest.adoc[] + **** xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[] *** xref:rest-api:rest-authorization.adoc[Authorization API] **** xref:rest-api:rbac.adoc[Role-Based Access Control (RBAC)] diff --git a/modules/introduction/partials/new-features-80.adoc b/modules/introduction/partials/new-features-80.adoc index 636e53f06e..7e7fa204cc 100644 --- a/modules/introduction/partials/new-features-80.adoc +++ b/modules/introduction/partials/new-features-80.adoc @@ -1,8 +1,6 @@ [#section-new-feature-800-couchbase-cluster] === Couchbase Cluster - - https://jira.issues.couchbase.com/browse/MB-61457[MB-61457]:: The following settings have been added to the `/pools/default/buckets` REST APIs. + diff --git a/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.drawio b/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.drawio new file mode 100644 index 0000000000..d0beb8066d --- /dev/null +++ b/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.drawio @@ -0,0 +1,192 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.svg b/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.svg new file mode 100644 index 0000000000..378d4e92eb --- /dev/null +++ b/modules/learn/assets/images/security/encryption-at-rest-key-hierarchy.svg @@ -0,0 +1,4 @@ + + + +Couchbase Managed Keys
Bucket A Encryption Key
Bucket A Encryp...
Bucket B Encryption Key
Bucket B Encryp...
Primary Encryption
Key
Primary Encryption...
Log Encryption Key
Log Encryption...
Config Encryption Key
Config Encrypti...
Audit Encryption  Key
Audit Encryptio...
Node 1
Node 1
Audit DEK
Node 1
Audit DEK...
Config DEK
Node 1
Config DEK...
Log DEK
Node 1
Log DEK...
Bucket A DEK Node 1
Bucket A DEK No...
Bucket B DEK
Node 1
Bucket B DEK...
Node 2
Node 2
Audit DEK
Node 2
Audit DEK...
Config DEK
Node 2
Config DEK...
Log DEK
Node 2
Log DEK...
Bucket A DEK
Node 2
Bucket A DEK...
Bucket B DEK
Node 2
Bucket B DEK...AWS KMSText is not SVG - cannot display \ No newline at end of file diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index b4eaa75e60..9dff061dc0 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -1,7 +1,7 @@ = Native Encryption at Rest Overview :description: Couchbase Server can encrypt data, configuration, logs, and audit information it saves to disk. This encryption can help reduce the chances or severity of data breaches. :page-toclevels: 2 -[.edition]#{enterprise}# +:page-edition: Enterprise Edition [abstract] {description} @@ -9,9 +9,38 @@ This feature is transparent to the database's users. Couchbase Server automatically decrypts data when read from disk and encrypts it when writing it to disk. For steps to take when managing this feature, see xref:manage:manage-security/manage-native-encryption-at-rest.adoc[]. +[#keys] +== Encryption at Rest Keys + +To encrypt data at rest, you must create at least one encryption key. +Couchbase Server uses the keys you create directly to generate Data Encryption Keys (DEKs) which it uses to encrypt the information it stores on disk. +This two-layer system lets Couchbase Server manage the rotation and deletion of the DEKs. + +You have two main choices to make when creating an encryption key: + +* What system you want to manage the key. +The encryption keys can be managed by Couchbase Server, or by a Key Management Service. +See <<#kms>> for more information about choosing a KMS. + +* What data Couchbase Server can use the encryption key to encrypt. +You can restrict the key to encrypting one or more types of data: + ++ +** **Other encryption keys** +Makes the key a Key Encryption Key (KEK). +You use a KEK to encrypt other encryption keys instead of relying on the database's master password. +** **Data**. +You can use the key to encrypt all data or restrict its use to specific buckets. +** **Configuration** +** **Logs** +** **Audits** + + +The following sections explain these choices in greater detail. + == Encrypting Bucket Data -When using native encryption-at-resty to encrypting data in buckets, you choose which buckets to encrypt. +When using native encryption-at-rest to encrypting data in buckets, you choose which buckets to encrypt. For example, you can decide to just encrypt buckets containing sensitive data (such as customer information). You can also choose to leave less-sensitive data unencrypted (product catalog data, for example). Encrypting just sensitive data can help reduce the overhead of encrypting and decrypting data on your cluster. @@ -36,26 +65,6 @@ This includes: * Prometheus configuration, metric data, and tokens used to gather metrics ==== -[#keys] -== Encryption at Rest Keys - -To encrypt data, you must create at least one encryption key. -Couchbase Server uses the keys you create directly to generate Data Encryption Keys (DEKs) which it uses to encrypt the information it stores on disk. -This two-layer system lets Couchbase Server manage the rotation and deletion of the DEKs. -The encryption keys can be either managed by Couchbase Server, or by a Key Management Service. -See <<#kms>>. - -When you create an encryption key, you choose what Couchbase Server can encrypt with it. -You choose one or more things the key can encrypt: - -* **Other encryption keys** -Makes the key a Key Encryption Key (KEK). -You use a KEK to encrypt other encryption keys instead of relying on the database's master password. -* **Data**. -You can use the key to encrypt all data or restrict its use to specific buckets. -* **Configuration** -* **Logs** -* **Audits** You can use a single encryption key for encrypting all data, logs, audit, and configuration information. This configuration is easy to configure, but is not flexible. @@ -67,37 +76,9 @@ Then you use the primary key to encrypt additional encryption keys. You can then use these keys to encrypt bucket, log, configuration, or audit data. -[#rotation-expiration] -=== Encryption Key Rotation and Expiration - -Key rotation periodically retires old keys and generates new encryption keys to replace them. -Frequent rotations limit the amount of data encrypted with any one key. -It helps limit the exposure of data if a data breach compromises an encryption key. - -You can choose to have Couchbase Server rotate encryption keys and DEKs automatically. -By default, Couchbase Server automatically rotates DEKs. -It does not rotate encryption keys by default. -You choose how frequently Couchbase Server rotates DEKs and (if you enable it) encryption keys. - -When Couchbase Server generates a new encryption key or DEK during rotation, it does not immediately delete the expired key. -It keeps the expired keys so it can decrypt the older data. -It uses the new key to encrypt data as it writes it to disk. -When rotating DEKs, Couchbase Server does not re-encrypt existing data unless it's mutated. - -Couchbase Server only deletes an expired DEK when either: - -* No data uses the DEK for encryption. -Once the last piece of data that relies on the DEK for decryption is either mutated or deleted, Couchbase Server deletes the unused DEK. - -* The DEK's lifetime elapses. -Couchbase Server can set a maximum lifetime for a DEK. -When a DEK's lifetime elapses, Couchbase Server uses the active DEK to re-encrypt any data that's still encrypted with the expired DEK. -It then deletes the expired DEK. - -You can adjust the rotation and lifetime for encryption keys to suit your environment. [#kms] -=== Encryption Key Management Services +== Encryption Key Management Services A key management service generates and stores the encryption keys Couchbase Server uses to encrypt its DEKs. When you create a key, you choose which key management service you want to manage it. @@ -116,18 +97,87 @@ Even if one or more nodes in your cluster suffer a security breach, the encrypti One downside of using the AWS KMS is that the cluster relies on an external source for its encryption keys. Disruptions in AWS or the network could result in errors because the cluster cannot retrieve encryption keys to encrypt or decrypt data. ++ +[#aws-kms-caution] +[CAUTION] +==== +Do not use encryption keys managed by AWS KMS to directly encrypt data. +While retrieving individual encryption keys from AWS takes less than a second, a cluster startup could result in many synchronous key retrievals. +These key retrievals can become a bottleneck during cluster start. + +Only use the encryption keys you store in the AWS KMS as Key Encryption Keys (KEKs). +Use these keys to encrypt Couchbase Server managed encryption keys. +This method limits the number of retrievals from AWS while maintaining the security advantage of having keys managed by a remote KMS. + +==== + KMSs that support Key Management Interoperability Protocol (KMIP):: https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol[KMIP] is a standards protocol implemented by key management services. Couchbase Server can work with any KMS that implements this standard. As with AWS KMS, using a KMIP-compliant KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. -You can also have the KMS perform the encryption of data for you. -This measure improves security because the encryption key never leaves the KMS. -Using a KMIP-compatile KMS also has the same downside--Couchbase Server may report errors due to KMS downtime or network issues because it cannot download encryption keys. +If you use a MKIP KMS encryption key as a KEK, you can have the KMS decrypt the keys for you. +This measure improves security because the KMS does not have to send a copy of its encryption key to Couchbase Server. +Using a KMIP-compatile KMS also has the same downside--Couchbase Server may report errors due to KMS downtime or network issues. +Couchbase Server will report errors because it cannot decrypt data without the KMS's encryption keys. +Also, depending on the KMS implementation and its location, decrypting data could introduce performance issues due to latency. + + + +[#kms-and-keys] +== Using Multiple KMSs and Multiple Keys + +In a basic setup, you may choose to use a single encryption key managed by Couchbase Server to encrypt all data. +This configuration is easy to manage, but does not offer much flexibility. +Also, because Couchbase Server stores the encryption key locally, it does not provide a high level of security. Couchbase Server does not limit you to a single KMS. You can choose any KMS for each encryption key. -For example, you can choose to use AWS or a KMIP-compliant KMS encryption key as a primary encryption key. -Then you can use this key to encrypt other encryption keys managed by Couchbase Server. +For example, you can choose to create one or more encryption keys managed by AWS KMS or a KMIP-compliant KMS. +Use these keys as Key Encryption Keys (KEKs) to encrypt keys that Couchbase Server manages. This method adds a layer of security to the locally managed encryption keys while reducing the number of key retrievals from the remote KMS. +Remember that you should not use an AWS managed key to directly encrypt data because of the latency of fetching the key remotely. + +The following diagram shows a possible configuration of using a single primary encryption key hosted by AWS KMS. +This key encryption key encrypts five encryption keys managed by Couchbase Server. +Each of these keys are assigned to different types of data that's written to disk: Audit, Config, and Log data and the data stored in two buckets named "A" and "B." +Each node in the cluster has Data Encryption Keys (DEKs) encrypted by the intermediate encryption keys managed by Couchbase Server. +For simplicity, the diagram only shows two nodes. +However, this configuration can scale to any size cluster. + + +image::security/encryption-at-rest-key-hierarchy.svg["Diagram showing a single AWS key encrypting 5 Couchbase Server managed KEKs which in turn encrypt DEKs on each node"] + +You can have even more complex hierarchies where there are several keys hosted by AWS KMS or a KMIP KMS. + + +[#rotation-expiration] +== Encryption Key Rotation and Expiration + +Key rotation periodically retires old keys and generates new encryption keys to replace them. +Frequent rotations limit the amount of data encrypted with any one key. +It helps limit the exposure of data if a data breach compromises an encryption key. + +You can choose to have Couchbase Server rotate DEKs automatically. +You can also have it automatically rotate encryption keys that it manages. +Rotation of externally-managed encryption keys is handled by the KMSs that manage them. +By default, Couchbase Server automatically rotates DEKs but not the encryption keys it manages. +You choose how frequently Couchbase Server rotates DEKs and (if you enable it) its encryption keys. + +When Couchbase Server generates a new encryption key or DEK during rotation, it does not immediately delete the expired key. +It keeps the expired keys so it can decrypt the data encrypted with the older key. +It uses the new key to encrypt data as it writes it to disk. +When rotating DEKs, Couchbase Server does not re-encrypt existing data unless it's mutated. + +Couchbase Server only deletes an expired DEK when either: + +* No data uses the DEK for encryption. +Once the last piece of data that relies on the DEK for decryption is either mutated or deleted, Couchbase Server deletes the unused DEK. + +* The DEK's lifetime elapses. +You can set a maximum lifetime for DEKs which limits how long Couchbase Server an keep it after rotation. +When a DEK's lifetime elapses, Couchbase Server uses the active DEK to re-encrypt any data that's still encrypted with the expired DEK. +It then deletes the expired DEK. + +You can adjust the rotation and lifetime for encryption keys to suit your environment. -See xref:manage:manage-security/manage-native-encryption-at-rest.adoc[] to learn how to manage native encryption at test. \ No newline at end of file +See xref:manage:manage-security/manage-native-encryption-at-rest.adoc[] to learn how to manage native encryption at rest. diff --git a/modules/learn/partials/encryption-key-hierarhy-diagram.adoc b/modules/learn/partials/encryption-key-hierarhy-diagram.adoc new file mode 100644 index 0000000000..b445238a56 --- /dev/null +++ b/modules/learn/partials/encryption-key-hierarhy-diagram.adoc @@ -0,0 +1,80 @@ +// Note: this was redone in Darwio. Probably need to delete this later. + +[graphviz,encryption-at-rest-key-diagram,svg] +.... + +digraph kms_couchbase_keys { + rankdir=TB; + ranksep=1.0; + nodesep=0.5; + node [shape=box, style=filled, fillcolor=white, fontname="Sans"]; + + // Top-level CMK + CMK [label="AWS KMS\nPrimary Key Encryption Key"]; + + subgraph cluster_cbkeys { + label = "Couchbase Server Managed Keys"; + K_Log [label="Encryption Key\nfor Logs"]; + K_Audit [label="Encryption Key\nfor Audit"]; + K_Config [label="Encryption Key\nfor Config"]; + K_BA [label="Encryption Key\nfor Bucket A"]; + K_BB [label="Encryption Key\nfor Bucket B"]; + + { rank = same; K_Log; K_Audit; K_Config; K_BA; K_BB } +} + // CMK to KEKs + CMK -> K_Log; + CMK -> K_Audit; + CMK -> K_Config; + CMK -> K_BA; + CMK -> K_BB; + + // Node 1 cluster + subgraph cluster_node1 { + ranksep=0.5; + label = "Node 1"; + DEK_Log1 [label="DEK: Logs"]; + DEK_Audit1 [label="DEK: Audit"]; + DEK_Config1 [label="DEK: Config"]; + DEK_A1 [label="DEK: Bucket A"]; + DEK_B1 [label="DEK: Bucket B"]; + } + +DEK_Log1 -> DEK_Audit1 [style=invis]; +DEK_Audit1 -> DEK_Config1 [style=invis]; +DEK_Config1 -> DEK_A1 [style=invis]; +DEK_A1 -> DEK_B1 [style=invis]; + + // Node 2 cluster + subgraph cluster_node2 { + label = "Node 2"; + DEK_Log2 [label="DEK: Logs"]; + DEK_Audit2 [label="DEK: Audit"]; + DEK_Config2 [label="DEK: Config"]; + DEK_A2 [label="DEK: Bucket A"]; + DEK_B2 [label="DEK: Bucket B"]; + } + +DEK_Log2 -> DEK_Audit2 [style=invis]; +DEK_Audit2 -> DEK_Config2 [style=invis]; +DEK_Config2 -> DEK_A2 [style=invis]; +DEK_A2 -> DEK_B2 [style=invis]; + + // Connections to Node 1 + K_Log -> DEK_Log1; + K_Audit -> DEK_Audit1; + K_Config -> DEK_Config1; + K_BA -> DEK_A1; + K_BB -> DEK_B1; + + // Connections to Node 2 + K_Log -> DEK_Log2; + K_Audit -> DEK_Audit2; + K_Config -> DEK_Config2; + K_BA -> DEK_A2; + K_BB -> DEK_B2; + +DEK_Log1 -> DEK_Log2 [style=invis]; // Force node 1 to left + +} +.... \ No newline at end of file diff --git a/modules/manage/assets/images/manage-security/add-encryption-key-dialog.png b/modules/manage/assets/images/manage-security/add-encryption-key-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..b9fcfc77cb5b53cfd8b500aa35fc45f25cdf4bc0 GIT binary patch literal 68716 zcmeFZbx>VP^ezYl_u%gC?hXkMG(d3I-~@MfClDZb&=4GgySpR=cejJP&*tXdkeT^! zYF@p1Rln3ZaMF8s@9x#BdwuKs`VgilFNp+?2M-1Yh9oT|p#%m7;Q~r4X3H2do>wOql$rl0re8|yk5QBz>U}rw()k>?J}+Z zZe%$9ah~6dY6}`H97~d6#1|8+4`bsE*O<#Lk8l-xIRHh| zXl819tSA&-NsCAR+D$C;^Bpx|yBB})iE_V%_=0dZ`>8Ht(H z=Se~jcexJUp_vC3W3}`xS(@qz&+r;=-W58NYSnOYbJB@8Bd2}7yC$2AG?huQVje$eAVW?++ z=7msOhVv99fqn6ogopu5I~JbJ50U`_N*|L3f>Qs*G@^xw;57J!@BK2#dl<=fT01Ol zNVRr3I}}7;gCmGY|4V%We-Z%+zxT0xxd^zTSh0*ry~;L@TLefGIHg%WtNrn%@l zqNU_7`efG8p+mkH;NZwa(o=zQhZI}oym;&yv>DwS)hBNQVf zMn!ePmq(PpntlUfvZB90yr6Q%xg`qeEL@hgldl8Q7GOfE#ZU{M3%6`f?>b)zwli`S z&?U6>bLk9O;l0xKeA$B6isA#|gCrdJC>2Y-jb;Vs9SG?kTArdPJuSl{U-#Pe4GuLO zYE&pw7YkWTU7-5wd1(-ZE-5m4uXH#C`bT`)@PyZzufCCS#*f4v#4ir?_wNky4i0}p zA1FyE`p8e>B5$L3fUXf{C4WIh{V{L-e0^a(ew}~476ZOJc~x3EYh7tl8IQJr7KN60 z!~8_`#L6w>4*pv6n(Nx~r0lE2x0jz@>4*#$s4AhnEmPE^L&c25Y{KM$AH=l4jHWrG zkEH#HVU5v=!Hy||c}bU{=9wR;#-@7mZj~03ZeNkFghN97Jv4_cUQ$hPO}uk3mu&A3 zxosd&AA^bLVpyJRBs4sCv8zjvDi{AFhScQ;rks z7Fd=WScWph+=7+(v%CXSSgG>V$StHl>)f6H!=x}M7Md7e8j**)1bl`DCX zrSmiE@Xz6z6dlfxVZtHhVawq%^){?%EU}0ZEU&8asx-4OQ_i8?S_-X7hEs-A2AC3+ zV*e6Vt!l026l)%SgNvRS!KzjbesweT!|yF-ImYPkt7h}ZH=|1G8K-I{FMs&Snr5dq?2%BxCk#c)+N6$Ieg1ZEJe7qe!ctPY&L=XcV zBbfo6Auy_wp`c+}%rPl6NzZJ_9Hv$@1!IeSXtGG{g-Yy`X_%?2N4fNV32!OH`^Foh zm8$iv56olU1NDn?a8Ypl7dJDrR!og?f_U2)bqwYFp#&JXD(Gi4(*o*f^SBTpkik~) z^~4q!bnwea&%)IZfFE*$1yu zU(4h)8h&LBV~t`ZHuN$aG=f<*?PZK;#3_5p9C;|!M%_gLdV`a?#czAsv?3AGmEEOv zD!0j;;p6Ss;~xpti=~8Zk45yRgQ}ZqU+$&@ZjHmP=i^MjQ-6-O?E%&SLI!o2KX-@A zTGDA|eqCNdfdG0P92eYcB|#;6Wj*-jAkK~{b8z!>bK;+!KV1rZMni|+_fr^CnGn6C z4g2|OL4!{tqUxp#YnAL+q(sWWfnB(OJSmz>Iw?2*Cvk3o+ksoP8!>h_ z1K)S`4;Al^^C&lECK=sQ4wD`Sm4=iKewIQs`@e$<7*rpuVGc>8W-` z$wM_xHLt9pY1ZB8de_C$aLN(O0=txf;HLdCB%kb>O#1Dk=2Z2$u%S1`!*t__jm~+4 zZFkcu0_7y-CrZ6H^?BIdmDh#41&4delb4CSiPm$zb0o8NmN~sWf*au**Bj!gVqDel zSm?s(7p-;cu08X-OzyFMV(ldQeOvw(ZPB@lG@)mqWN9<$K2h__e4?c2w)|7=`7GC{ z_3-)ZIpuk#57vXHN8{r~4fI;@0AU@W8-E5Ua%Scf;WVj72e0vsv)2OStYA5{p@K_} zveBAuNwbNZUHo@*W4+auqFb*E7Y;2hTidthw7g)*QYZqCoI6umFagNUgoZ>GLROA- zrJp7>=b@_^&GD@jtckZn54ZWzTyu-YtE;C-^lzWUtj{KKwlHSX)w9&&1)U z6}mo2SpKCr)luqEuqMB>oiVrILA5O^%(6J8)0t@+!@2Zg2T;Y`Q(%qV=QJ=92mXWqxzP z+nIW8WUtZ9rT4I;DW+NPPGm)NL%bvesWtU}k!_jB&T7o;=x0u!p#llBp!Ep-7*aTPr4ix;o?qKd7c`Pi>VKWT`^u!5UIX$MGsNnx04rn^-E5Ui?+y0odB92gz&85RsY#2gF~_yi8T@qjk~bUy}z!2rL}fVV^z z#D7;IJhEQ=_xVNf(~Y9a;?mNW=DivV2Ci)=UP* zwuUB5uGV%>Rlo#X`GAksCXNOquGUsI4t%bHWdGd32Yh}iW+o%~=N3mxK{9nYMG|pa zdlM2aCKe_ZG9h>p5)uJ>V^cmQiP!&D2mU8W_TJIaj*pqy#l?lmg`LUP-i(=*mzS5B zg^ihwjS;wm(ZS8e(ZH3_#)15IBmcD{Vd7w9Z*J#kZfisG)UJV{t&^i58QIf={`~vh zPZL-3=O@`X{5vdQfXq)x0(Mb z1?(&YFTng~&V=AiMp^)G5do8y5LIyn2c^TLVRWPQM5H;4P*Ko_lTl&3eft&?>TOrC z{$zpS$V-Q|%gC(kY(p{dR~S$j4kE8!QEpN27Py^bp7Attd(^scdw>}Aj`^vaF3;}F z4ld?)zh#hZ45}RkzJ{O>`R^4Q2N{0ZaP#uB(#>*Y6OS$iTrAkXFAxYa+~(`6FSS*| zkWJobB;fzN{DvqM9WTO%nt60_|L^x6fWTbu|7y7(lIDW#`ru?%$`|tY%h??Q!-M~x zTmmz_YS37Bk{8j>G$Er=i(NWT z5phnfF{rR$Jlbym#}NF?;P0c1F1}Hu*1Dc7#te3yc4#CpYN$k8>S%CTofuy!40a&A z`d%y2wOGpeM!MhdRqKRBE-=@Mag3D@B3`)O}uEp^Q$UVt%p!pM{^SMxD@i?FNwJXb06jrEVqNop%z` zTa|AK^rkwC#WC(SEwQ2q&_YW+MbI8AK8;ybRnEZ{JqBzH~eK9{jV(2ABV$t@n*ZdY7DH1R~yLs5P@*IQGWP) zMy^SG-=>qNs8z1azqq7f*4u$4DVCi3mLCGWYt~il!?nJK*sms6Xoe!Lag`O)e06Qu z&cjt456whn$w`-p+U3MM7)8{lpySfAj8+jGzgdiM|GA!G3qLq+nGf$#jn?l7E`z=f znN+3hjWlgug?@d7#YV*3wLPByh+JwZ!vS3Ib``s4j(M$Q5GZ__6|#(q{HzUy)#20N z!>z#jw5v8aOS?l{=T}edk~D78lM#X32FyUMhliJ^6x2K6TW#H7o1V~#zc&{eD@Y<- zPQ6LnS-K=*9WB&RomzY8`{J(#q%yXi%66pIwCAAqq8D@JGgYK~UuSbPRX-vR(+xZd zX(S)LAYvL33YkhEcY>|6pRv{nRI}dZmN63WHz1zAF2tV@R}qVUyLhXBZh4S0WeVS< z_Q;zb{r#KX>)5;(S`{`Clu1oRM(4Zz!-jP=OnhfE)pD5V?sZHFsTHmPcZIq?)SN=? z9!{)3_r;u9P{_SgCnq`~v@VOcmmD)&o6Rd(c%T!o^TsiRIq>o+E$Mx{JTi~U)o8Y^ zFimRW(8=Gc9})TUX!BUD$`@hOlE#tese;S*XKkxwct~C!1 zvevk#9+P~f+TObjT-lm@aSk0q?--=m7ZIS#M!E?taS>bv1A-ea&)#R94?wwSeT0Qn zXr`l-U9StE{4TJ&OzPiuFjZfASl?mxI4!K2qV8YEqXLB@U=tdLpec9myk9azI-Jj> zX)A`(8?omlF(=1?aHH*|s35$p*B-p~ZU8e$dF~xMsq@;{%;qp%p?~qxhq*4wfwtxJ zt``SGl%Q=JJyaWoY3El~a1}FJqdNnQ0q@S6>L$J3F)ZF(SY11aT49wLLA;$%MHjiS z!MPP!NwKrVQ>CX=L;AdvGJIa?oQGyV)qnoZ4wH5C9BDwm9=?pFlihQP7D={gjc1iJ zHU$OT!?%a)V8M>N{&;wX>h86Irh)d`gZKC8aOfUag!a0&p|0?PW7%;}8oQpN3 zova+;h0CQ2D59!RjI$whT67PXJ(##tLs6@?1au=84cTo#{`Nxr>{xyikQk@X>v&^4xbjg2|3Wkw%BnQ$C-rMRNA6 zA%?uv45tS#9@5On2OsR&3aX>lLdoM5Kk``%nlIzF}BNvzv^ z?hfkIOB_Tb)MUzj9AmZ;=MYUGn9R+#hACUI!`$3PVPNpU5W^EgA%k3$a-B@Ew7ACH zP3bA8gPdrmqafwuvUqeCP10LkD}vTS-4;b zs$U=UgU#%&es%67Y09B$8Aa15s!eSxKlj{KL_|!ni5N=fWQ-Sw-s}6y4oFQ)%=233 z60;9cYR=!tu@Td#U=flz%u2rhx`5mkXCBb}7S?}LO z?30`EuO2!LbY%z!77^c}KP+B|hNE;bKWLkX``sRDjx>oKJB**hBc3muTo7FARB;+4 zkAp@G95%w(-(0n=+Uj`k_S9n5MD?eI=+5$hV$VFh62t1t17bXRgnP*0j%QT_O+0?l zS+62U(;x7~_1UGk59nL|x^?cCVZSrzncdi zUajURR+L8c4r*s8cP}ju1?{O+??DssC}1bQAf=;Sk0DDv?rxk}cj~sc0MJ0`pwx?I!h3Ib%jp zfC@*z{!wOP>a=(|xszr}67?N_0YwYTenG1^i>Ellwr!ZR;e+HqxHgs?oJV8iXE{~i zr9PqFo$b%JY5w2a+B6*tx=~Y8`H@y3GZ@V>Z7xq%I!~l92}L_$%4N3OLXyx$+S!O7 z2p;@0G8@`2a&$xV@%i1}C7SvqKa{bwDQ2<5igY=(3;j&4EO+Hl~| zwZ*%3ZoK^F)M@Vx!izR={V=+J?3K)ns{5TKfF!I|PX$aYu;b!a3;&_MXZ^elIbz%J zyAYgL)Mx(th_@?x3Z%gf=ret>W>kHxs(IGZ5@EX``yp+C+~YG}_}olAxBd8oP3)u| z0%9LLOZEKIIF;IA@E^C{JU)nnppdpY$9SwHJ!KFtg7$uI!eMY}AMB8B(}Kng{P`q~ zx*w17D{iPi?7xrB?W%IgMb@!-B&bxU^JL-E`XUA)9t+EKnCo!Re7)aFJYCIUGo+CX zn!Kj3fkRLmVLVlys*W2+6aNPL4UrwODi~KnRh?mizNn^T$r4p(jPmsJU9 zTQtMY2wnHSFlbX#5(NzYM?v)-!FvkpVb%V3G5=&0`XMhx z(!54r)W~HB7_PEio9Nmz2Uh6YkR8=Zc8VAt{6Zgsc{_H26;zMVmlA2j zh#996p4#}@PnZ-84nqLkGpu*Lzg*G@9;@r19h^g5+@56(_WO@cyv=v07iE>9+g3Qp zi0&u$7Fcjl@*t=X6rDr^PcK)CP4ZVivv1jGh z{(DNBf)1B^@k^?~?xYLXbk>>Bz1EE;-EB=SGhuRSLZ3~>s!|u4+@pW2Lh4FtJJ2Ee zPd1-kuzD3RqnVNL9SbO2d3>th4cNLj<6On8m9uoX9%M&D{*)tswD9A|!tg6WKNIRk za^-e;KBnjBH4Wiz!Bac~gUclbm-P!yl4`5)$Clyo(30ffFH}ZU{_IsO9dm`BX%V3f zs_#N{yz7s_)+F(|dnK~J=w<%`;p5>~qI@$U9pjnEb}(;QW;9b#6zL;Z?_KD*nIC(n ziI4nE)A}AD)dVlGyOh)cNbrXZ4*8$BhLBZN`c?+z1Rvq``)+jbE+1O;>*tHf=dcao z(McM4My_s-Vo7UIum}>Pn3Hy`U6F|icolB;5=6_39K*AgIO4fz=5@5mqm90OsvrF5 z6EGB-nfQ5HoB?FRDYItdP|BL|p4xdjSz=eC)-P-T8O^HUzIu830 zpB0A56kvmg$p`3fF5`v#RbTQ4nKSBNWqIfc=Vqy|`LOsg_>USS+a7>#5jqUj=4~RDq)bRmi$)Ny?53QTcoN;!pD=Zw)!1ZQI{g;>pK#c%sY^j_6%@L zn=NiBCQCugH$(j5k$N^(O;on}7R1w{QG=Gj2V7X0+uR-Hu4D7xhbw3-Ty z?ntIJKRAJk^!#-PUYxg(isP?hPOU6PuI>gi>W$Y1^0d3!#@t+Zi~j1Y@>PpZ&pv(G zu{_a<9YJW_7x=mo9?=0Ax_MssJ;^~5UlT&7mN-ip5tZX>GV~UTiJy^H^IEd`gtF73 zZk}uSC1H5wMDD{hD1%I&d*F|Rf8zoOYTsD=ZPKAiUtA_M+}E5dUppKvqZ}=2RWx%u z>)KIj6?{hd7xnMbZ?`%<(L+?97Zj9!(>>QkyCU&@3kcmv6 zb}HRFAw=4qR@{zH?MTB+=#!shOyQE41931O5BRKH9xqnflN;uQ4vm~C8^K32jAHmu z(KAg?P0^;91SQJCALye&p+@J5i9I^2-lTWPUav5S=p_Qly z7*Emlg~^f@{&nW#2!Aj&iUQF4xh!SG1#Zub5vUm{mTJ_GoKz#)mf-c#7BEXgXuL=6mXBT z=p|JkD2)M=ywvbDlPMS`>kwfaG>oT?f_J6=4T<5@LP`^M`Ft|9Om8=SitG{{AR009#|y(WPAjMD^n^QGhvaaRp{lUKlh z{98XNjeVC_>y{2Dg+s7sf+!h`VY6zMkX3 zB;0z}Lk7e{2Pbr<-dc~A{E$X&cWpk`;N}Ko6BdxVEGbNg#o8Wp?eVTa(+R>NvnOs} zggO)qWV4tRUj>GMq=8mQZB>TQ5%q&u+n88TT2X+HacK-vC1+%TwbWPZ8)}=-efE{2OWG5u z$^v=B$7NhZKIrwu^w_%yceqa||951I6|sTKb>gzIVGiDq{*N6624o1wB1)bJQ~P^t zPd`a=U==|ozxLO=|M0T0A`IZ+&FVz+zlZQdo%ltPiBu%Lt&PVP|Bu)efv5oZS3@_u zi2sOHUr4raux{Pg3-Y>%&&+KXTGn*LMmys_6Y!5s`e*=~;5zZUvHsq}pMIjs05t9Y z%8rS=RA9_04gI_S6wByYW}}krn16Lm0O;Ch7X`Oh&s_uVnm&DN7xdRKV}N09E-351 zd>-Z%U<^+TZPMQ)_LIqm$N`hNT_&hWJey1iJY0|%O6@Q6pFWv?QE&tE--!ce-&euc z@PE1mOu+wQYl*BI9yVVt#;?T)FM8{G>{lxq7O9q0uIV&7BMFYAKYM@(#1B*&B02WQ z8aA&RM_gX}-2G%01Al@KT`!e@8a@cyvprGxC9+{?l!g}$0nd&iMWP82=W*e`pw;48 zukCd{(XOLS{l`PV(P%`TE^9BbCh!|}!MdGKsBHjhOk6Y}e}ni86SvhgNv7vX*xmJ3 zW~FgITA^B5#)S3kcXQe1{&?!a+9hxL{khttoAbRvvrI43xruM@;$NT$C|)dj*wPCd z^&sMM+oZ{+^SyIka8lb@Y;IKfsz{p8XtmsA)Dsz(>GPlwj!91ij5~?I>+FZp_xEqk z?GnB1V4j^?LYlsN0+(S5RBdc4_V=3VxE0ZG)J zC2F_evgBpIUp;lxND9l`2x6PNygh79Eq8>8z@Q}?6*!Ij_4Tc|yx_SCy8Xd)N$nz? zp3i-Cm{cuFM}^sF#-wB|%AhzhuS761A)V9iFSvtEzUQ7`;6czjXq9MGy(V(sCM{IT z3m54+KU@-)r13bYFL2vEsNW*GJ{woqC@O3DcseSqS7Wn4$GzYfKa|2rFN2RFaOCT@ zmf`c@=C+fUlq;9Ywd$5}wm+vPFLZ6Zv(Q+Jh|eVp7?OHp;8Q%W!zS!5&s>vRmE+#z zaG-91d^$rSDg;XQX#{gitPE3q7v{#t=ShYq^hl>4a>@I4hHtEA4jK>PKgzQ}%98(a zD8G)^BqkYxu0#4qL!`mTtRHYjf((*5`2)&t_iLAo&$fTCS^T0APIWn6?bi44=Z_*5;uxmzzZu_o|*Y-Vmwm>sgP{%&y!Vg!S ziT@_O|AZBI{HMVaz``~bWO~mAtGzViHts{+`I#5NPf!*3wP7U~pW(q~Fp-h97tLDa ziAxA@vFQ%SY>{&89ZX`jEjqg46<>u$lqR@>tAawn3f$imdftwuJRoSXJxF|qCh5zX zei~ktHtf>z?taaw^c7WtuGD*}JXNa0Uw_<#pC=tpmAL-ni#W_@4s)eMzUj9Ojyq%b z(;7{#BS~ucvbaStuFVL{O)TF_ye=2G9fe(fr?vkC+XnPL4Ww6&P{4v}YyukN5(tl+ zzJmM23eFx##AXYFghw%)!db;G4k`bcjWS!;*cw{7K|dVF_>8QSxqx)Dn9&a9*;8|w z{SvxC-Fj?n1~7;?`i+@h7aC#2`8u^W>4X8?$jbRV_&j!5#d@ua)~{PYKXO9g1iH3K zamg3wS#0mTZQ}pQO#kVZ0g0l1hG3iT7AO#1K6a%u1Rq~k7lbHYi=z~@%?~Q?gcPq$ z_J-0GbX|&NO@+6dt0|EyJ6Vrcm<=4nFF~{>1(G)|5zc<}&Ei5#*!^BzaUhhv9g0fwvd9PJ%@o6ZXe~K!g$Bs=eNp;M{ zck7R&dy`cVlX(`^h+SHIzu{T{MB{%P$2$-`)!&( z$5DMr)U4^bm%rTP|LPhE5X_+6;74w%`>>z0mjBGc<{nQ^tp_d6sU?;Y?bglq@MwR_1x!SF8rU% zl*E9llYMV)x6ekFLU{tXABd+B{wjk5swU{0t9|;_`d3T~n(!Dt@ zqFKtLx9541d?8O>k^D56_dE~$^gNxukYvDF3v6B`E~#gi+z|(S&FcWlL+rUM4#3zE z1hn`Re>we==L%i=3;wlw``{Eouc8x>{_=#Ir*)9&(Vp?w5?TiwhD>q*`ne+{UQd2C z+N`he++`Ab!2ROLO#=Q5kRn#-$xF9%%c-BsPEHn*R z8tYOsB!8_Il&2L`j}3x*E|ZW425+Bh75lvQeue-wZ{`s$0-wwNH<`_uuY%ilQK0^6 zHDcck02*;G7-f-4HL7~dDvbL-<~BSmdK~uWCF#;Ndt4?q9=2$CKU{C+?&isSxjx+* z)G$k@1hDg`QQ^n=!$|;yG4~RA6l?q3pFaqd{yRM)RH!tog?X!DW1wDQABF%Jl*A`2 zEBtszUTrb)QSfqJ+5K#rw3omkGJ)nT8D_yq%`gz#r2&{-JOlu=Je5MFnZ(icfI8}l zBDGqXG&YlPP|NMXjPAh`qI3a}uIy(Np{q6trJ)gyMI1iIuV&i= zx6@5FhfP`YsnYaFTz0CcGGCp4!;;_pOPY+v)&8WGyOY6(Y%~$T?D^K2oqQJn(s~m|_A2-NkL;iM za`^O>_8V`m0W@cI@B0E7wy4MJU)NH650@(eTKLdQNOgAP7j94yuOKwj^m@ENAxS~# zS|X8IPyUNq9}zC>ITAjXdYNs@wP~SVYfBrx>NKJr*FYj8eH1=-4du-v0K2b~L@Ty( zmf`>LGm&7_P;F2Y0k4ux>%DX5>B%6oOqp)8r%H)dE!JHZz67MiGJp$cLkWw3gu*Q{ zh07XG8KblPXz07`k}e*n1qDuU=S99;sxgoqC9XyDk2Gu~neX!VXYpi;F zxSexbxelxCj=&zAt}xmFpi?|hbJ{NR6tO!A$%gzjV&@FclzBlqmH-8+VqNgb#^9hd zbvlNF)$XrC=awJ@Y|YlO+JR5>y$S6-KpsGeP9=*9yR+atC&%Zwt#7r8&|q+W*!rkT zr&|0T(E+c<$=Yh6;hoSeh`p9J)BC2d#E8cefL6zs3aMOjz=X-{p&uB`)mR%v=a2+G z063hvu9gS6)YX(F(sSaSnlz9cF(x957n)_bzm%WMvPCJ!O74<+!q zJ3axb4FV|Gq^$YkqmIkMJJg)(P88wkQ-25kPWE+%x}|*trsF0N7XR~?k_0Qnn&tX_ z3(SE~ZF6uvEUprgkvODJDGi6!w4%Jgao5;wmDLOzE|*pE@&l-%m&ksAwqW|u&&OZ; zJ7#gG)4zKMY8U90xtgvUr6HK$c`U_5F}#4ntH=pa!OI+7(L-P)G3G{XzTnPx4SS`h z4K9ZVNls4D0w+=m!ed6eUAEgH)f4o}`H`1bYcU=?F-0+yv%ng(mgU5x)&*9S;lLLV z6t;Hk+O^8Ih9IURtF__U`IKI*Q6s1_!bkR1OaU3gV7-d3yMpljcRhKijD)@_Kklr(<^>&m7@1f&`KAGjV1RHObva?%qd|K)KVlkRaNuhg0KWOa2l@gD|Z>*7=idv}H*ow4eE*c;Ox zdbo<34{y$i5t^NyARWHSH>`2OnHy*?!sOUGmS{D==e9Zfrc#Ke$<@csUlHQG9ORG< zKR2>GF;1$*kA-2ygZw3&4|QMO4(eKb47%C7RPIb8WN^W>V*~J80YatP3n!eV%gR** z|Ggqp-`jK2hB0i{A8BTC=s|atqH%|6@Wqh0hbKUavjk*b2uplmTYVY63`u)~S{ z4h! zEXG9ahuu!P{efaQ7Za&+CP>%$ougcm*h}S!MTs~Mx5dBjyWqs&RZQgy}EYbc0(AjR+ugo;G0JU(U!94*i5cC0ZwTx!{tSNwIQa5O&pL z{89Lqj47+n`^Un947Bt2n(Vu@r>O`%%cPU?&EKC`3JoqMc!SI;eT`b?I>f|o491aI zjp*q&U0d~B(R{l!F6yQAn|N>@OfQ#0xqkS_S_a(Q1c|EzBCJvX9D>!JEt~Z<_1f?7 z1P0gjGL%E~1svp+D5{VUSUhX!M|_*QcK_*#xsS4#g<7>XiS|q+x)WB3Mq$n(G*FDw zOcDg8uR>;uVTF8;(QSE%g|=Uo69;xh#9O_55YW3}JcYq)rc-tq-z=FwF;lR{58ByXq#%tRGva2S~o3-dfb z%$;ci2yQnp-2VF_-!wd#5F6om$?ByGZK9WLIvBR>%zJaKY~}hziC67A&59 zJBBWz7`x?pCW;-(+2A|b?R$xFVZ}{@ zsTwMevw!T5n(qkMwA&vEv=?1wKHf!@9QNtpGA)*MyG&>^Nm~!l!OA)zU#g)C>6^_UdU%T2Heqa*&TM#mK@OfB-lb%KOSRi?k@jP}Xk zD3~|>_kNhNv_n`IW>wXkiwhZy_kn&DN)!{U9_xqhcT}%#)o*3UsAI#R9vu#RgN>mr z8n3zPJ;AFAf!2{F`Dp1M>?)9CvilLu|Bi4?Kizoh?UW8SnpqlY&J< z{R!W9>sysOO(m$+wOEXV^cBtdYXF39Vc!Et;r{;ips}n~xXvF(BB?HL9hX9A? z#cK%Cnx~V6RY2@G*uXl$DcEfbS?EfC&M_XZ$oJz&I{%yyA`;)>=c0gVX+*}(qj0`U zcb?(cix4Z;vSon!-ut$088$6|LpAQ~)l~z}AgafLxKj##>%fK?b)m^MB%a)7=flFv zCXkeDIW~i-roGau)gcr4#TBQ?{wSL?c&wYVV-DK+$Q8QTtF&a94aZ?C;~h&^liSEV zYU!M_jH~iOTCl6BO8E>a;(Y-2CTtf$e7|~j&Bww)w%^f%pVm+1y^isi1!DT)aT^C^ zvV0Bzvp4(4uITtn;E9Ai)IwI9o+#IWZJ3k-*0-v{?=l22;hb%T+=6%HIr0ZaV3^kc z1nR}mm;CDsFMlvC+p>;$5A&vJ=NW18CON-&4V^&Tjq40bX|v^2DOYV4yyzVE8OY#) z3v>wZz6BjK`73t1BiNjs;s?V-`E8nXTVm4z*#kJL%j0HUEh|Z*gYV??`pfrk(6582e zRO_f+C+XgOGoC3iOZyP4CkK_`7U9J6YYC?8>soea$-_fA=Dg%kXNbA$(a^m8Aft0; z+gSAqo8u4c`;O(pqcfIFVu2Xf(l)W6ilwGO)z@Cyr`CM0kn?-M`MHr~E3L1i?Ee#| zR$<#B63{wT@UQf{6EF@sQN`VFs9;mMN7B!RxtG49n5sb&yC>_7$nm7nRlu+Y)o+uq zE!2}@oLM86T0Wq4+Tb)qWUAvjd@FPrVNQAvB?eD?av+cl!rs!WFboPS&6*DI{UDxM zDsU4-3UUol54LkeC(jXpgo4cL`Pz-)v++sIDg`aU@5mRd8-sG!tJ-@*60{=mUM3#p z?l#InpUrfBFpHA>V!oU+P~JJ1RD~MxgAS@8>gsZs$40Wj^khYsT`4=_f*6fIaj>HU z8|?NnDr;~Vt8lKRmXT~p*yF=xD;3{@cdbOIpQ%!B8nhvc>!TtT1i>gc1GjZI#}LxL zsCrsH3pVivJYK1jevCyh%$p^oWdu=N3y17oOeCdQ?ss<5D5Dfi#DaR`fLO8zru4bt z$|%-^5QedNoM4VP%7`yI+;URtUWoLo0(8*Uu3B6A2=tqWos3;}Y>CN{zL&nDyI4+rAhT zsQmPyj5RXCV4cO`5=FdQ>Z1J+P7L2a(MqeG?~gcyN`qP<`Rkd45P{$i7FmbGm;Cc;3a?)NdYe;9eTCyp+7UP>4GnRN&RR0o^c2!Z*} z+%N{M8d;zl)PT-*8RPKZDg(x(BucW8(QMm#ulfLJV7D6e_IUz8f<*h$({i%-Nx&Q6 zUh+imGzYR>s)n9uLV9#+`AFWxZ%Ao_aLrFriNwNccSPRnD7?x!o5ubGTIF2T63s$B z!MSJN7d%sBpgY5dO6M9--E#F>z2gvs5I<)){*8 z4KmNNufCd6L$pK3@-S$wwycEPa&jnf$>*`zYW6!VrT>(C+v8s|BJv~wjHJT1yNt_m z_iz8m$+McNgitU9gsXd*r}01u8*o|Aa$Ex(!th?`iZ0@*VITJ*3x{@tqdD(!7rF_+ zm_v*%5c}Mbp6^X10c3$Z9>@D-HH~KXYR~)gsT!Ro*AKV?uH_}fZtHPMwKh7qY{sEh zi%lBQyqh?M8ddpvD7V2V#5Vh-n$-id40DH7mR~3c`agJ|qu!iXWJ?o2 zutuq!#S|V@-KWs3rUNX2_ve2io^Ln6L2Rrvm6oYzXYxVr*LMCnso>Wktsf%S41u!b zG^IlwE?50(5lI>+o=UC~dilqjo@K&DfVJA6SN|3o572D$!CrBq2nq&Gq!AYYO~4&P zfF?rZePwX!ORB0E6psn8Lk&$AvzGRg8fG(GO=d@vD`rbxmr=Gqm!7Dw;l}Aa8ElzV zk(yHchoIV*iycNWf|JadNuSt9c*Gao_ZUw%S5g#sRv;}mC)D(+yFLTDa(K89K76m& z+n4XB&Vj6YW5cod&(V=sCP<}{x9Dyc%lpctYv!gFEe%=XF)fl7KeAu()<7vFBF|{1 z@0GO*<=;IC+qWwl@b10KGvl`#<`7b{*Di~0y~5lAmLoTphqkwzHe>rINd^Ea2vdCk z*qXD!9hQov8sxp%hdbAcvB%3LpC#L+l5NG3beP5FET_Z8g^NtL&Cl%%e|B3m8e>R! z0n^d2c_2X?xW8OtmipQkQ`mM|)X2l>BiRRUc(6H=ZYhZhgUvzVMB_W_*bVC4AKg3oniGA}>{c2D(4$%c#5Di{VdVP- zLdJ!$BH@br@0b>aqAMH-wF2hL7Mtm5gw2$W%Xw-tr)46C_3W=DWUY1;1{PUI&oNOL z6I%aVgit}*7&Kd{a#%cx6n4yO8_p>i3O9l4_4pHjHu&5p)_6JZ5K|o>5yoaRu--6y z1<$Be6S+hg4TY?2*AAr-Z3GjXVE!kv1SN_1MKsd{5tSP)@|lG)4@!e33YB}q#nZkp zAJ;hVYtFsH2(pMLWb$q06>NjJG?pSEI&wO)PfxEfea$e zm+voGu_hWBGX_uPLJ*ESK&@I;8a7p|0+aR$U~m^|SY>xWz)n%MqDw)Ml{O+w4TPyoIY9`6@acNv zkAm7B*E)t|W=;IqWgi2;Iu)xt3Jy(@bgy^aCzIqs6x$q;No%`4blVKy(Dqp7CJlg#&L>$cdli9o0)AT{yuGtm~2Wr^{hoTKveo>#^D{_^dIl_ZO*1 zD;+PwxxGb_0rs^wJN_Mhyf*g${2%W$7teyt50_3|l=$^h8;#9@^v2@X*EpjhzJd(5 zij!5`!HQ!7c;M*9P;kavtu6BlXvEm&i`hX7eWkVIwcbI1q%{D(Rx@^_#Mk+Y0r+Dv zU;$xR2d=t_%fV_z24QOTn7JA~yD@dC)rgYo{)jOg49q7dQ@ z$q$ef4(%>G`J1YNcPDi&Q8zLMYPPUWnSX=Hu-(hfz7~J|N0KDn;R}eiHVL(7c&d@`0hw1z! zt2F_~@doL6C;tL@Vj{kVWvKHM&T-EI)X5t_rz%@l{|i{cg9BJi%r1WV)qmy!@_Krp ztm&hX;ByfTB!Ca$+vNyy1U;3qardY|Q43Pp8T38ssDg-j*@>m&e>u#4qLK*9a;fbp>9wiHw~DrDb-Yt}`e zu+anHUUC2reuyrZ2C#_(L+9VkBtJESrgMkHJ+ChYzz%md&nr6s&S__7#~u2thEW>> zXM?;Or?efSJdeAv?QeDp27z5}^RP^(v8Hw85B>o>4-x{3>_XRd1*#rUqvV!Fw?&V- z=KxG?0-CNknX_$`j>6;21*DJ`7u3!cKuKzO$9qt>mJ48h)(N17?e%U^SuPN%sg@0q zcV7co(8&2+p;C9v-mgM(7y>(AAFGq~|BJo1jEb`D`$iQ(xU1=?3W# z32Et}1Q7{oP(gC&96(wcq&ua%oA(&+Td(U~Yk%77S!=Jo*7M;CVB(x(j`;t7b#`#N z?HWBcfL9%^4|mP(Xo%iiI{B@XfKu`GQuLF~D#t}LL=9SQqxo2;>>HpHW$BfY8NeHt zEP`_Q%?r~wKz_z6B(OJ5OxRUUf02UXXgtco zN!HAiMpq6>$d+U~)MH$NTMy@IBZ^QGy;pvf?g!=3*?*hiB;lUwUJNOxa5r%8A}PxG`xK)`wt8%NE0+5$=A$TBX1#SC(wP-}h&lBGXz3e0sSo;!V1_mmVrvC${I$G;k znbqJI&y(#E09IG8W`=h!9)ao-6K*1Rc)IiU#s*Rgj@#Mwy7Tosj-yeSAzO1WcB%JD zvXfGG@svHc)lX?0vCCI^$DK^D7WEs@V!Ry5*B*&Kb(5k^$p`HKJRb0kHDz{_BOg@Q z6(YV6S*!|ukO71s1LHYzaUiIZQogi7#7FK5SmkW7`9qbs6`D%l+`J=C=-Y zM{%)(8QRK0X$@kvvC^p`Lx|R;T(i_%QCTK;wj0pk))y|MM6)hL1?ok~`yPz|u0hg#3c3O< z?f<$Nf4AML_;T9*!EG5GpaG(ngMY_kUY^hZv3D|uqXA6(sQ=PbWzxRqEFR6*<}xIuj=3j>rz(hS z!(mf}W>(a608OX|8c!WW8PRX!q?Re}#$(z49hoRg=@Xwr>gsM$neF)VW3U1A*SL>| zk_v~2v>;_(Wk^AFxI*F3kkN3yM<&xmT)k?cuLJI46U5__=cD@lTSUo#{zYLEMJQAn zQ{kPz)w4qQ{xd?MZT=55^*7g^ewvtS31${}&|QKV*GW5Gtgy!lMtISxI-q5?6Z{C+ zj_xc?z+1k_Ka-x3!qP;=o{^(<{?3k#i8Z=r3)lt$gFL3Le~G}BpyHh-$Nniz?2nKs zv7EN61rCa)K~u|&4AYjXu<54?qrwYt1tqAq>?V}bhXKztfe_bWIb>qWW^iu4S;ZOj zy_fDc3w=R8UVziNwr^Ry0?V!f+krOU>umpLwUdSJTcFY~EpaY(I$9s*)w4r6{TFs4 zEuAjj0y*~pdv7NwKW(Pl*w;WOV@r`L3KzvTL2WJ;@i;7ctTp#bYHE_=&6M%4skd_G z-#uM8+&Qvr{1SfJ8ouE#c?pVY+t(HfAF;Z6J->ab{8{hqIpBV+(4WDIMaYH<&Dx{K zrFAgsB*t<|a~aWI&XMLsMcxBUmf6w&bulvO-&-Jp5wzIwxA(@Yd!6p~kSRZxQS*ubaHh%osiute%!N)SDD=#|50d&Trugu`Q+7uAdPp$)30U zwb&bb+D~)X)OaO$wQjoY-~H~eY-m1u8F!CGrz-OwSm3=lEpnI>Ivh!B6K0nr#N(f5A^arp>h1;un7G1hx9u-xCd+W!&*V%znz{qQZ=0l75anfHKIUVAA1qgQ#aELa z+l~>A*UGtlcVdhF#1Ro59{%8N ziM2z`8a)F0qLUXlGUprMFo@Bpe*JR%?akHaZH&o()tGWI$kD(Q%dl88_FU&HwS(Zj&>oIxmKK#zsu>2e=%HiyD& zcVNsStX5!cmw@x-a24yX{t_QgZmrhw?Zp<~+3M%0C7_G?_^T^k_YGLGj6i}OtCS)* z&gpOSW0jst*t|P|8Vp+{$5fGV01=ChI?%>g?4a8N5OOZ1z6?&N1;i#IpTkMm;t&NL zLSdxvi4!nlik`B?U!ui_kVUT!)!a7$g)mVV0MkdMEsE0Nt(<%;Be4?} zXvWO1t<<)f*J!@CRlPb3KGScfl5FLY)zDn$2O3+6Ah}_g|G>wf~AYWCe9e3|NcG z2+h-t%9y~O@yU;eQKv7diq=PAZ2yIhpMtl)GR@IybUFvm=^V;Y+iJd-i4##w=|#e# zV}?ZLe-1=iKh#J{Je3ZHjBaZpLBVp@M<8~eL_8}HMTzvTeeITc1Lf)TV*ES!^ha>S zDO?|<-TVNbdNW*iM#uQK)9J@2@ugG|FO_Rh2*o%qwvCTdS5V~xjE#*95@3`F&|2{y z-#1XZ!sk4fKUpjR7=@ip6FwGTNy=doh(JzXj~PS91*YDDdYcIF+tYv-(iZ(TwFgvp zley_pc;0mKaUYMjCP50$4jTgCg@aE|e_nsKOg8HLMgGwtyRBz8N4p%N7%hu31;YK$ zj^7*2P$;)=i^3P}008p(aNx;gouAg5yT<%L5LcUx=MQG*8>mSfC_SQY-?=LXV5|}> z9%zcw_Efbi8=_dt0Z1WwD6ZJ0$}TmUssJe7fsRhUTOf1dl_W0GT^d(#1VvfZfDc@8 z1x9ZCs!i4a+0eDmsvF&@__pKj?9H|2cEioJ-cYBv>SZbfIB4iSK+ED_HC z0C3CWJH}}_Ca`q=mFwQ3-z>(`2Vb968FRsEgTbbcq0yNEANxboX_?!=a5e zaCka4N@c7_r#arxDt*V|SiP;MOg^+7m z#!IYd8jV8G1n@c&Gb305gnr|drrE|hwY34OTk;%TSH}ZhTg%kPhZNqu1=Q|$M?=P* zO<`gUv?d+&=8lDnnN7;sx`Ey2S2tH5QCU1?vx})4rc@`R;QkTLD_8Gc;>zhcXn}_)gsvg-7Wy`%VLIf5znk` zlIj+L_PsQGc2GKaqrHeTRq8S|@RN@_yE1p={FGEMRy2U6HFhHerK;{u_^r4AUz2w4 zCoGFAPkY;=uH01;)JCV+AME6j19y{mK(Sgfi{BFb6LIjRi=#`>mFU+fRQ8r&|F+yyfCN#=Tbf?foH+;3^f z)aMT#Azb-u+A0kam=|cv>q~>*Z01|)1J;J1!{rc!oO0?ZW zq7MSsdq8P1BTpQj;W9toEHXU*Vv%s?sSKSPO(PB@L*#hup<${>S$5OF#NfQEt*kX8 z101wRw4-*J2KMJM-A-Xjt1Y}D{1=mkRds8021lw`)W%zHg2+kCGV99^jp`1ua} zKnaV9`&$M^y#?i4$~g&Hp$ACw0=T-I$uH799vB$A%=fe%E!0l|UmC|%TX2|gt>&r_ ze3$_kLQ?6?wY=ZVFcVk*w(HT*;C-^d36iuV-DzTCnn!cSt=iWrERoZv~InnG_>j+?0UPk z?0!Y`rqcrrz5!7;&3P0la>fr@bLCCACX6Zbkj7?A+)p@SNvL`aEeX&vz(Q!7Jl3z9 zBbbp)z-dK&vr>fes4h)WgZo%qFl# zV)PH1(HCId^NgzSj|<^i5E&4a z<@CP`qZTe?Y`dCv!%?|6)0E!$xlnt?H6pc+>V6^cnSJpWH%qNEN>*goCEOF*3$E@? zM(Mgc`KmoYo_sXjC!7t_{8m#fRIAiTm>AB!>%$L2g-3=oI}YYhE#nx3fMdH)$xoEJ zi+y#t`LF%p0&k+7c79rG9ce&ww?i>mkca%|u8Gm$&fVI5@TyN}bN(K{Mg^`N^7m2z~ zE_!64>nqCwibJvn#}Dse1)p}g1-wD;Q}2(VFl@71Ja5XX^LvD4a51M0)LZ&I;Vgme zM4x(gS8FLL;>ySL6^w}-ejLB!GplRHT*ew4{T>iHt3R5hOS4S?pU1{}u%N_IuBH?` zYwUKUPK8m(cE7nyiM{2x#>WVKhgO!+e-xnxN6Xr7ET!O%@M^g!K!>dS_NW4%tj)1B zL>E^H+n-t+jfFJ$cp-+ZsPF#udm+q<`D2uLJoD4Vh&cxZzXhyj8Z`QLyr{PIs%ifW zJq1<2>PGf5f3c#*jK^pg-8@jSUOe{Ge(@CcW=hA92i@~fN-U=NW@#?s1KRGUUO#W3 zZNzIvg|_L^G2W}8l$ev)BiFIKP*Ui|qK=sJ^m=c?fTfl$?)=gsArYm6O)hL;jGZYg zgAc9F>;py9gseaMGJarxv*39@fcuIv&t_ImjrfT=M5;N4{Hl2ghI_W062GNPZMVnY zN4qY1nm(*%-Q2H4WQ_KrZi*w@_f&JI7F$4)f8m7Dt$-BC1zig-5Kl;=`HaIk$r2;| z6z>j+2cGSnjjFp><{LY*wd@M*F_x)M%C@eT)0vUY6Xp|l`EGYG8Tkd$7d4&@J*3c} z>k=JJ+gu()rYsBp^6u2iTQA^L@)@Fc^z)~}1A%_o*e2K}Sd_H8{*6?dyQnXqt_rrs zy;Vl8X@s5$3ZuaCr(bn9LN}k79zT+=B~-%MNYV`LK4~Bs{Xx)}baEQbU`va2quQ<8 zAqn(edC--IwPJIYgp^~`h+poThSUZ~Xf0`MX5h3u=M1)S@z;jFV<{yd zy#G*s;D|b(Vo0i+u#jR;DFKROpoX>uf3Q%>Jx>oCc6xz(AS(IMpBOFxMsUFQn!MH9 zK5cOG+}Ewt47=g&E|!#~ID0FZ&yzX7AS)9n+laovBUe0A)aD)f1>KYkMYn0AQ%M4c z)2r4UUX!^dteL~~pd${qse;-D%-wa=i^WLOP&O(FOdB%2U7@H=i|)^%4Kk;-0V@*O zX8WZ90b79upT$ne0@%upS0pIVL`YNllKHxK`Tmo_iy}eASq$wp(Lx#|pCjWEzV)Ei zWb_uUIGp4bDjr(l9-{_*HZ?X@xj1{%MY^`T#-me8Q8X$^cI^_f`o^=pCnP4gsTl7F zF*GaJb5u@KGNaoUADxKiq&qJjD;&N?Pq*ve1)OJ*wczaR3o7{Viw#p8Qx@=Qq|};pY9H)W`pfOs zB+rK!oUffY&BQl8%HBf_x1iw{(|2{5rwFJ#X(ci2F4QWFlK8loxTn`<=w$yuYSw5E zBI}ktKM+|dos5rxRn9Mn5Q_fB_43 zSJ5y(tMU!i1i7xDMB&TL^}|QJB*c-_LYmnx_ukvZr>wDuWY4fF$Iz58Ew5eJZuQ_b z<{OyZV&qRckQXZ}9eUzQ9l7}AhN_)hlg+osIBTcBT%eY_t;h3p9%={SI{K~^XRi>1 z#`g+)o$hEz?ZcKX?e`b0`E@}wo99h6OC^qrQ5m9~Qbz&ZoSxHrM!bcS*_5ko3av8T zQ=$B+X|{T!KDqHf+D347yT;U`RGS71w2GSs-ISA_uqW)@*Pw>=<#c7XPT9ESg?Px@ z70Mi8+?U_QdQhUU2VXA}fRt3eAUcOevqV@Bw(o9!Z9%Or#szkC7-(@8u@+sBF zz4U-ep7@~Mct-FNhf4Pn;f^*vKNoIzEG+h8>4ihhmBB+Mk^=%0QGug-9tkTy@0U2b zoDSKwF%NH;YZo-8RGI4q_*8T9{y1&t3OVC+srh82s@w|CZZ7AzDDuPd?*0X39s_mj z=wKi-?s&;u-i#G4JRpw3!fasyLRCxIhtKKEad3;&=4aS!L?o%!aScwf=YvP9Yi2*& zZXZB$e^l}&yxUk@0GfO8Fwo23SEHb$CE3&2ev0UqTA3QcKK-1SVzr!fwKp{Xq9LJe zeZ0QZrSqe7uvpFMoGMI00pIKW!W}K>mwfC;7(Ajsq|1%)OI;IvrUE6$$IttD~VE|{KNnugAj zpxq0}O7|o5fpNTeRs_d++peJfQMVZCBtAF)!VAy4&`yETyN72Kx%R!vW(FQTe{e_; zl?<7i2DKbVv57$H=&XanQUrSDG!ZM2r-TkdJS2zW zM`NjeBPU}|s?)-b!YNt|;l`>o=|oX5^q*UG=EKUN;iq);4#}41?PUtvkj!FUSYRjm zk{XjhKY-g}Zmh)#ZU&M?#YaH!y@=|RrkC3%1h3hfw6mF=CV1<)T~$NKqNK`OEm^zE zGY)vzsW36K&w@-5*23ZLrfl?4XgxIqzwdr<>E7lqqIf7jzk*euf(=&Elb3R*O*?l8 z627C)Q&jV`7%e2?!4hNWn(rIa$i44itwv{N=cvVyyslqHPH6`uJq;aTTUI1NJ4@v+Jx;v|9@GqHz%I4nvf4ShX=z%`9kuN^}U(hg-r`O$oKxV1{;2D0o+w<$| zKMdThR!G`kqcNb8jeyMJzL%5xzoZx7QY?PUY5(&|od0_%zw!A0kx_X}>?wA+8$j-{ znsIyp+U(Z;YXD*`0eCnbFzX#71-hn@#-HEbT)SR^hO_TAmJn<85`oY)KsqnlZ!Qm% z1;D?)+D%rJY!udZBAkAc2*w8}TszoEDiAJ9El=QCvWsg*khl~=05U|#X0#(oh9Uus zJ+mU`|lrHFIshlG4 zNEZ4lXZiWjH(s(9081iuwil|m?>S`wEY?jXjHuX@5d(4Q019-?2k87vjmw5fBuuaR zCzD2g0>uq55^s(Hfa=P7JK0_vP`J1&UA+irz!o;8sBqR8!krk)sy`9=n=)_5@c0ZM z^buUWQ2+%d?H+FHOdX-d0|W-jXVIISPy?X)%-QWmRLaeq(@23xY~nDDWgs~0d>tY5 zcmDs37w;7IB;&Pxj{vd}u3^UK$dFP12TQrM^8z9wu?)xoc!9=w#dUHYj7}UNiYIF@ zL_)=I*a(Hy8LbgvIT|g3%`w2L?i^j9pHe43HM8uLMK35*qpceb8 z2{Wj+qbb>Ev__c`W@iGb2>5;{Q-(p!96CZ2at3^lC;U2=9K-zi|n-UnY3#=3x%7%DD=86+h+)|$jIL@kB}D+L5m)FLFW zIKsQ)2(sA=$Y~mBv`5}d+VPD8NN{OLO_>-?49$e}yd2ofnSUWPv6E2hSqcHYl&_{! ze<`*17DymATPc|eCm%qkBNA?({rB9JHoXCYo!P5=Lz6sK3oQ6{hBU=1>&-T(j;H}> zov=o!F@)IJ7%$m4wUC%e1I=X7d2A4FzI$n03j%?Vc1W=}0xeQp;`GIYQzViEU25KCwUVdV!d@;IPF=mg|XOgiy4{hy7I zK^^%yM^nC3(LFIuAmUaQF?9{2S4`CEj>izV`N+r*2Q2Z#HOPW$JqALaiQ~0hSf%5l zEKDNcuB%>aG=*WUYXL&YGMNqGXedCKWsj*1wt)C(SH1tV{e!lnqkYIYFpPEOvk;5U zfB*nOoh$f3Zz(6Bc@DT8o5+M*^Rpq`lTgt`!J)2|ST@6%<2o?KIJPXG2O5eki~nfr z&yXtE1i@V|pWr(|-JY}%OJwab;_@jW80w5Hp_u=@6<_WN9yU-iFK18w_!m@m3O!T~;jcrvf; zSbuOrFw_MPJx{|Ngd<%?O<=Bj}FMJWr5i z@HE)b+U~6UH)9y#IgmtB#TBe|n}&-a4jP~=mPG<;iN%bG5F2NX|dqj-G-cC*fdiX1N%VJHVg>$HO-y};K% zqIQpr)m&NT+gk;cENC^pBhFEYM?yQ^MluLQZ22RzV<19)k3#k-=cIFxTAdI@kZ5&{ z+<`+(?)fVunL5>LcWU|~L(>l1@oZ(v8&Zv-TC)p8cc?2_MQei>X?X#h=N%Q#;Np_T zDfX@FCMFgsi@h*05Og;g<9Dr_!=w0tTpvhf>}(Un^d*>Or3lhWmfCc!7B$-+dQeEMTBWgthUA@&5QVI(?+ zSvt)iZ}EC$VDaY{4HY;^;T>K z>2}}!_4)QXt7bO5N&@=#?+0puNKn_?ty(XbZDwwMX7@Hek%QApZ_oY+?g=kGg-^xt z+-*tSlU}N3$&)EG+Krj)VYLHzw#zs`m@8?sJ)sdATA2 zPqc)HxiXtn@JjDCC%d~D+S_A$ONb4ZS~%PqpjNR#Dt1WtLh4ZB2Gl&8ED$+={)28V zyQW3pS-tRfS#b`1VDJA6NW>;7F!X6e9e=#1c4Zz&62jYA(c(YOcxN{oD!P%k$b9YC zpDr;@d=xbeluZ7chVk%u%KwIoAi_!KsqkW1TfIE&uZ6lt<9?_oob9xLGD^9CG?I|P7_Tp>-nVS2BER6#xju}~8?TIHD!L7tC_O--4z_WfGI+^kkJ&L}QdK>@X zys@MGsxbxxhfMa)WDfHMM^4#NC{O|pzf}rB~&M#UeWl7=2yErC=b)X)bsCB|z zXkurhf`{*#H+@cEa3XfXSfHqk5oZuW6Ze#J8fonRrj5)@sJ zNnig-SVfFPE;^C&5xVR0F~=w*a2nJbZ08=_QjQ&T@hYoZ-MA>QKP?YN!YvWc$H0WXEGFulbo?l z{L>jxAw<{t3RTcQzW~9j!QvpC>?Ibl0op$e)&H|C56_)<8ywxzhKt0mtpD=*fj%hs z)-rmehew5+=`qzIdn3ExZxr@VLGXj(Hh=f->tF^HLy+3LN)=?VZOISo$4O?Y=$kMe2>D@thu?=7wAq6@Rp27%?KU3+JUvz}8^T$K==n)nUrjjP(=3wg6Fyv?Yzb6`) z77?7tw1+@P{$lm$9)LUSC}Ji4I}5=dox{X4nyXT*(S!cZpj*fok9^0N$R86+{&}3= zI+$iJve_)r|I9l)hGZ~bUwu(W`|oVMg`6t|rddjTI^CZ)7EgZ#=4(^*bLzj(`i2AM zz00|O+&@>}gidvg@#I<1KhF{b^L}^@QwQnqOaJc$VLX|r#z1&hE{c zfaWaU-I=)ujx;C;r0U6=1vyqtvSfB2Q`dpt2@AwU$&rG@+-A@+5z3MkXuN@dpXM{5 z5RB3uUfq7znY-8zh(J_YT@iSC5TK~1ae=mbV;*F@Vza?_B~LF8`kFybC&WC(Wuyp* z!l1w6bbI?^VUM?zKqDp9;B!^d5#;a|xDJeg77*7u zJTNVg{qElhC@7Uak}~os@%78MXTRcKfq$SNAxo%R_@H|pD7(;L_2<@!@=Z1%S7sj( zwjriC+6E*SJCe$iAT&zt2jyE}z|b4&xZnlB!VJ1&=1F$KcAs9x?OhTmfqqPC42=HO zU}FCP#`U?=&!>-qfaafG&vpEzalF1O`eFo^5-F#d+?aJ1Kqy#I)P%wGrTz1%u1P4Jm)i@e3WO7dQVfjo^V{F%r}K?gvJ7s@vb35O`O{lPDcCg4BJ5&WmrIiqT`TNoolRZi-P>o^?kf2b?v%r=P5Ia|n`b5|#(sfa&nlSW)Q;hqAE=5@!$W zH7_3mQmzwGyF!y1{JufRXAY!9-^TifnLF*h9!6R z5PUB)gSMx9XTW4fcp!PU2h@UHQIj-b>W6Tkm$TC673)8EI)zwE9S#jwaS$8xhhdrU zu}RQe)y>G<)Bci`2oeY<1}(rWTmmWHPi>V9O;W{`)skE&ILjYm41g)YuX+L8v(sik zgK`K5K;9EZXR=U{gAfmcJz)@|t=IB&6%iblY9DT7Jwabg(wgFqMW}l#1`$pd>dqok z2S8DtvvI%w)*a~^1Pn5p<6&AP#Jq=zAB0xZ1B81tma?oSw19g`!%C{Bmmw0P4R1t}oSRIvsZ?ACfW6|!Od@S7f+tlsw?K!`0XCU6 zNC!*BSQAQ~ur)7tVqAGY1FN|UE19{{U@4>x5s@-TCl{-nIdaeUi#tLSuABy(*@I;s zCdvjP?$R&X!IDT?9&Q64cx8>ikKp}4=2)rme!|l1sDWp}il#nqcJVUlKi`!i(pTpG z{wZN?-l4GNhK@q86YhdA#q)}5%b8S#gJUztdV}Q8*~Ar`J(Dr5XCAym8y9;~%NdW8 zyP}^!*7EGZlmNF^Fz`en^c7`eU$)uMb-E@BehC%{F0f8X6d8~2f?yp_9p=0POS&TW z5r6mHCh!K^lw^fR?w*|_B%fP$AG=qT=c>mJ;iMAO)u2gREU1?eHcwD}prAKgEN7n)uewpGbv#9!KiKz|yZ# zDeK-%#3)no9SPITjj(m7)VMqS`wyKQYp2W0Dr{JA&^?_Wn!iK=BMZ4FgPJLKs8B72 zaYEymGYrSrq3KI#`66woTQP2)6!bzB;daj z-e~9{DB1@5mjH0NP6W`^!1olq>I*_Ua6;~~Z^o+bnMCGm)582*p_F|D_H>j#%8-H|l4UlO0}ua(;l*s6v$gehJ;VC_v>ZtmbB z-2!Ur%5X(p_YK&am^nMy)z*DgZh2=$Ef?-OStX~tJbE^HL8hFue`csS6&)D8a3rOJ zY3`3YeMHP!t^iZaK4{AvQ+s9B)7KR)fX-8=FS!#Q+juSWW;8Mn>)|g;MZ`i*P_Wg*)4=>aysc-5EVg}j<`vlTQdk>S#EB8U_Rm{gY|bH z%czVXMUo18hbH~ApwBNiPQkz@2*8*HM|-L=wfv@ckq*cEG2z;pm&A8v+K)P**u^J5 z=mC`C<#C`lw(&H!- z-sCWJffFR02i!kM+*^iA86QSXfs=kGRlMM*-H0=5N_O-~*|^6K)IVM8=%fCxEe69i z@`9iMoT>jNO{4C3RsyO<*jZ72uz8QrCy^H3KWiF~Ay7QS=@`RGl_Xbs{ss4wz8Qb~ zGP#FsGlSPa75<=N>a~1>4vSvnKV9*CzLw;|BA~NGiq_ z71OS|h6B26!3J3mc>fd$zT!~O6AK0wcn1+Z+{w)=+)r@xc#+Ifvg_N8v6Wf<=I<7R z#}E#>8s?HA%)gZ%qqwhtC-EwB;-3cl7IG&IXph2~kN#kmGLGOi9$BOl5 z{eu$SlJa&d`UqKLSefL?=F`>3T15}S{?&e!MS=J{4*{uYe;8PVJa`$S^-6Sne@7<- z`OD`p2sMlPW^3?1h_n9lwW<6s5b(cH$v?B<|1Fpl6joR7eGv@IrW%W#mMDLx9cc%e z+>@uu#8%S;r8G?BytbtNFuC+0l>bh^?+jAnk}yD>1{pZao51=EE64e-;Q}k!*wg$pZLal;ZDcnf^Zqo1_yJpMa)55X5d*5BIS(Tt273psQF) za;Qfa+A3440-^(XVayj&=^TE*I?hE7Ja+H6UVTBieMK2Z`!w8{0I^#~L?G9UzqJgy ziaG{_cOdA%xe)}k;?&=>=OrOgq+ zoAHxz}!E!7_y^DoAPQ*#(F~Fv3_R&66?j4)hiyuRw@Y5D0yE-4&XyM zlv`VM1DhE;zyr99fsYLf{K-4-%tb|VAHV<(JhKRp0f@YHd(_$*0q`!C3|#T^fZ2Zh z`8;dm64))95VDQyv%a^y`dOdv(=n3h+7`0|n8Kwj>=`1v{-O!g5hTuH2+u7p2rjdq zcE!2RNekNH#~FZ>SG=mq(G8`W@wwQV2k(syzAN|7%n!Ni@{g}J3~%-+U)FgXVE_fG z?QbXu+;<5N)Rf7)QEx9z1FwO>03Zra7ST}pIuNHOk#stH@d;=)g29OvL>H$;qW}tF zMIMK+$608MkNV`eOkg?Bo~UFYl5i;}9_nmj!@6$3Cv6^hLP?SJ$vlzu(Q(VGudx~! zU}#G{UBNltRio7>v?EM{ToWZ^3e*R#Dikk>Jzth7i#=QN9>om;&P3)2-iezY21IYW$F!|JGFnfi;_l{}|zFllgmNJ$8S57ur^TmjJ>L7gQ^FRT4n7?n!S~cg-(@Oi^ z!2MV3E`Yd#fytwt(wRX1NI^KwZ2`ScY*<|_2*4-&3fu$IMyFU zFNfG_G={S))&}!)c77Garsq96=FZ;m$7DrIva8Srbg|F_jY$nMM3zB=#nO1#Nu=-~ z(0`cftbqBmk<3FU4teCRMs_7cC^gNO$i+m>1Ij}Ld{b7q*#U(uT{A%HV)#f#w5oSL7&f|+fzA#K=95jzXR(Z$vrKj+dCJwS(|l*mxw&}Sv3GS zLAmfX_j-~#*HVApV0xb)qSqj9tFT#fqA-49P;a-1z%5s~Z(raR5a1>L2UILRu z`M_!sxXtBlf3Ox;ONENO5>7)8Y*{88Uh3M018gu9edNoNC`c&w3LSmOrRhR*DK^OD z+d#+=2nmHk-PwQgev9~dU{3RRz=Z+UBX+oNeFAb%;`$~`Zonq6e|cQ=EK1*F?Q5!e z^IT|XVGDA6r7Agnf{}lVu$Gm9T{5`l&`@--h917d5_(bsvY&@uVA%#aJ$EN8SmT*| zl}5?e7jY63xuGWrtxz1Jr%xAFzBI+1H3L!V@(9my-{*}X7p9vqrow~-s!;8#$zY+F z7aH2FQQ?*6>h6l%U(OUFJiM(-d+l)T`bxpwsd!!9CRQmT0v49UZqB0OODWN;rX3fv zlI-_Q0SK9UGK@gUaL?Xw*%i%qmQgzQwR)}qld#-|4#;*P)Q5_$6YA%or?f2Be047~ z7Nh+DL`dD^q3!?y6$V3~;5=QEl|TN<%7Zd2y7SvMv4$44>f}qA3N}xByA8o2BYI^!|h#ayajG81qQnmIPu>lU?H?x6u`yt zhG~HkUf(zT=#7n~!a^r#xNr?jnukII?aC101n&A^&2r={PX@aYl3_SGzBG72^3y}b z0l=(0XNM}WyZ6Knvd%fk7MzN|UanW>KTdO3tP?%(@n{H1b8q-*D_Gf?xY9ESZVZsu zvP^RBvIR~ut9n^70@;fGc9`xJJ#}IwnBfnLQOHwmQ#)wcjwc51PT#5MfA|(-_6Bs$ zD<{^QZ>Fz|IyhUX4{UIsA~?|T_;8KA@g(_N`$W6!w7CtQ*3m}h zuzB*)XLk((RDHnF(6-(!*U7cIYsc+4V!@&kh!l3o`9Sx(U}Z0?TN45|=F|%6yHa z^1-aHUFB`*BzBb>#U}}rj;qO5`~n@;(CyiYPB5HJ#LcO8EBMrz^ke@lIT4d|!>&M~ z&h*`cCL8Q0(FZxF#WFlur}Z+U=B)e3L0X*3PC5!V^k(OL5XaPN65BQyQ0*$2l6=4Y#?n#hfSzJ|grs7zYVV7rKO9ckCAD`HD zl?+HCeSM0>$GI2tSk&M%sk;e-#AE~u$d6!^27ygeMhA89kb8D=t5(s9B1|RN%f?6i z&IC>bYU`8-=EKPv)Dg6inP~X}mO?crCP@n%Eaye@YB#sP>=Sr}IgQR3t@Ma-Ty#+gqg5aeTyG2&4tB4kO^`wbyPiB6o$hCBXmqWEH-ovdcwCLpU zprg`d}iiKZZYA zGb=STO+m`*9bD+BvpkNT+9)q8AoymLG0s9Yyv@(su3L<6kTFHr(EGDbsVyO z9dx}L+OCPdk(2NWXG@*t^Z}ww*_meZe331itono}nMx*l)NVsi3_jY_^*7#vli3fl zMxt=85(XN)-RX~R{C&F1%pb1L*c2#||1P1K{h~WdvyHj2H^v#8YDO)>N%W{%=PPPH zF{?Vg;pUSw$hLg2Fq|yf8nh8IzHldsaCFAF=(76oRXpm`%reHTDhpop`rvqo&pxU4 zYILG`?iOcgRDK;0d-D7$ZBLx8D59Ea@KAgDaBw&OToNg#)EmE#+ApK}9UygOi-;#A z4o-DSk1Hg$dYnF@>ZS=l(T~{%l`JK9TF*VwD)COppck)uOUcN$C}+EI;{&a%(yj0# z?gJM59Cxn=+fj~mJUbdQb(u(U^6(AR0E6KyN_so@qoHklmmQww2w_AYJVB$9V4-|l z?&W@D2h(u=TH~PQwpu+7O3ZMrgB_3gd$%#80Bo<+55gq-8kPyFFzrM@j}2xf+I%(U zyRw*`_0M6{DuIM02E=%47C>kd848_NzwVuvv$16$4Xrx?2hJDVw6gu~;Fio5U;6l+ zqGlXX+Z^MZ^87P50{nA1?wtC_L^vCPj)%-AX}^hY z^Tx#k!u4AflfBSYXFZ7AG-~1nAg5uD>eMMOlqb4)ZgF+RDl!Ls@P}c+1NF2 zoRzxH=xyna73RhG4+N2~6hTJj|E9H1BcK0ZvPYjaYJ-mac_A1a4-ZOOD;=D&? zthfmzOiGwtZ(p9G#jr>h@8-Q6awgl9NEizrBs}PLCq=0h#T_ti_UHg4@<1j8rJ=l% z>x+A=p)q6~g^PC}AtC+gog+q=I}w4Wi^c;=SS$MVGnIVS*1hM2)|LR=g7H)MDy0kY&iAvV@1?E6>!^cE}Qo|7e?O zn69M>)%JO1sPK+Zt4z4wPy@Y+&HiIZN}*JSfQcvy3$LGH3~WY;_wbo;q0xMpnk5n! z{ny!=daq;=3fl_o<(JQhgth$|hDS(`WgM}InUq#u)c8|QMiJb+`FeHPkklA}df`n1 z)7&FeG!ue(tr7>pIHI?Ya&HtA=qpSFiv{dLLnjU=%2d@aN@6FXvJ)$EdzLc}`-R8x z7{)o5x9s;Ev`^IFJ0JOi4RYSVEH<9QWl{!x*v(@Gw>(aM{a-cRw0itiwq}S`$WvJM z&vjA7Q~R#NXB=0IJFCLvikG98bamEDVpFjqm8=8)KhA4CdH9r_lDYZ5MR$~Ds!%5$ zvP7whC_npLvd?c7A~%EKUL|N#BkJBfWbWP@9B)5cOfO$QXWdN_RH0qeWev&+3rAJwg{k;lq;6M3z4c2`1?zsmj(dv6()RoA}#DmN;i zbcmpIDcuTOfTT1SfTSQu3kWE!DBXxiNh94Yt&}uKw;dP=9+7+Ie+swj`OAJ-aDNwM%)SSypWl3a(wgaj3B>5p#l3`)TUs4`9~9% z#OKzynynIjUJdsTXfH(GCMu){-Lj3^su>5F2Vl<|1XLYhOfD> zCI8(ZV7qxLe}KL`#P6?iZwGWwi#F86e<-OfCa9&@x&yS(|IpMlC6H9bolpOJWH}IG z+4(%4run-e;sReg(7N?k-KYH$HZkOEX)hvk^j|WeMMBZ#zB#dLe~vs)03s{xMDh<9 zzdu5y90y+$zIglZwn;e11eXZLK1=@IcR1yC0AJhr5RCQb$p1fVqHx({VMs04OO1Jo z1zMly^utL~X$nZiL$47Vm|Gq4j#<@VU&*1>&C`iSs+)^+LaI(wr||97XT?jGt_r$I zArypE1``o(nH~bKy8`HwKUXKwFe!jfR%r(zQBYf)&R_Uoelp4|2Qw)^HB%5Yzw_%5 z!0iEB)~v>YmXHUD1w>S55R^NgU`@E{1?Bv9te|$E=S3ZRYG+sk>w%yN7dHRR)Zq%gd-BCn=I(6E4HKo2sVaDE)_bzZz`p{vyok^b>p z&w-@9k4YW!)dft(0nmt}k@TTEI73+cL2uPgqOi5#XseB&-0M*7`pfoFBjj0L0rgV2 z^ON#i;W3aci6!xYKZF@c$(;l;i_4sqC#I3ZO}@_uA#|+Ut7C%lynT0ns+ItuDj8*1 z7Mouh=vl)e$(UA8-ZIUAn?dqKuMkMXj?^`=v7PO|T0>iEbSW62#`IgV^ zGy|KSnISJW0WP_*3IBsqa>6O;OHtq(qT2^1I&#NQL1(AbXELg&>`voOefhp8GU&MF zD8zfAuFK_vCy8Fmb$><=Zrsz(CPF14e4b=J02|-;mnVr~i!L9ky~~7qEM=#o5d{>gSVv$zCPM_(PKr55`eIAkxLVx-@p82B^vHj7k9RsZ z4OTO=k33LuiQskUHK5G^;T+UEZCi)HAJ5F3@@wxPA#?Jz92@3&mON3fwNSVK&iV1i ze+MW@0w#rJ6UBb;^R3ir{trbOL;fBF54l66JgO>3aJ8(i6anAsUti&RLZOlDM@))S z$|dy#a_E@2*h8kD?>z;$o{XkkS7GfvfLpRDUH6i}8Ihuu8i5y1!N!c#4h#&6d&Q9L zqlUgE;P`_enQYeuTK1(wj;VVl#W-2VF_1%T2~e2%>OuMR%ycjw zrN4i>d5jcfN3~a~^NO#Laq+I1+C$HK*9fLJ8(bja0 zU5$4g;-{#~JI_}3z_D|Bi*I-!h-8cwWKB-$@DTlw_V9dT3G+#^{8UO*IX_Q>s0bZc zBre)cAgq@6UZxh2V@O5Hb%RvlG||pjRFx&%MPbTMsuNiSE!T7`6+C|L_tUr)Tn=Xl zbS7Pa^fLLW^>EZY!Pe*ZsXX{|4m=WJSB|+7zAb>_F!Fil^>6+rmn>KykSx{}1c?si zi|>H*pxP;pcpajLIH}*_T%CaBTsx6W?<}Bh4$jHo!B-=l7V?B!oAwTb)Xngp;VDZI z!hAK%`5(M_=km_r^4c-QEtcG{&|whqABlz5#eN7o9PK_1VrIhts=v`OaD6F>P|KLL zhi)vrB?MIr^&LmiwKY0~G<+~ax7AsUYz|(-ijlEBH6ZZ9w@01#?nJKen1<$Pu6)M* zws`E_q%XKr1ruck*q(8!K8X5ZPsv>4vlaCa7+zjnr^JJ($7r30oK6%LBS*dUu5Xg} zVZ4qbS$@;$N|fxN9}R=YHpvQqcjWv8!N2OyG-;|{xn=XHSrrpSZHV$Ci2l6RH$c?Ac7BWU2If2>=RO71?DT889>Jq2@8RL_@k{yBQETZ=#+wh% zvk+|Ee%~}a+~q8S(z5G##47A;arzdGN+EoKvBZ=w#46N8*KTq0Idm1eSs7VSS&A$5 z@Gb}>MS6Ydp;x!K&hY{CxrCa|UrjP-ffU|(W}dn@1Zx`t&C4Ob#CNz=u3NPYkLYII zWcenXZIt+f?mdB`Ir~kXEGQ*fJwu8*i2*7-%kg%Jmp62J5Wv=-8-Rax*A{odwMR>3 zj2(8ftP&|NOfd^@G>I#`;ug&IL1|Wgv&;H08x=_)qaQm{Upd?i6f;@~!oYnL_}85e zO7+hB3*|1NKvycHZQ(ash{iS&1cgyt6Zc&L4)Rk@|LTXeOiHlBXvD1lW~*G^jPF1rjF!UM3L~5`Bd2p9cG*PxNLw_Gudm3x7f(d)8mTF z8<9gK8MU%Q%EEUbW@p&~#AD+rLVl1`+SfBK0B4{0gm(FVD zUqZq?zrSN^Z!j~!qNOSHvPxpX?%^F!-s&kxd1`#Rxt>tza@(u9Ns%dQkC)xa$D}6; z5Ne1ukq?RJjpoNyfFT?rUYqMXEq1)+4hb9EQRd>jX|pdc)HH_k+-!Ut*-9GN13mBi z9pgYP=}$%VSVW49mV6QvP+U4%>9L)z%{9Zte>@C)Qa*%pwGZ)}9_V#>P`8|Ke_$d0 z@uN`Eg6pVq%#=PFZ-mkCeP(~ZvZ4W^at1RjOrq>GSO1-jUosc%SE7^pN`Cl7pGBWS zRR8yD{ob;ESBoMhVSD3(28ub=zKC>cL4 zI@P5}64B37H|TdaRh8O`QdiAg_R9;VT3zQ13QL?c{mz?rXmGF_R|0Ur5<9aQHrbrCCII zDa^-YKbT53D3&I>vWWUqMDeVkZ$-qwRDa*)fk1TGasA^*aG(2pN4eT&6V5nL(bro< z@C-VOt%(#@UFz?Y#A2G zswX&aKNP1~hw7fG6Fr-|riM00H{Y-i^t&#flx$jG{=gGNU9ovA1V|BD^c~b1#oO zsqSqWWtV_|rCOdB-MW2+LOi#4EafPIU|)RvVZTX^))CWNZRdGI)QfI8qXgB;8`c>7 zC9F6e*Nn4SMBFo}+I$rl@<|l*C8w0dlo)VzX+ujJ7)}oLG%=>?T1Y&T7%DuKqGKK! z`Y9gWv&aw?_jCx|Q_i0^*c5INOrzG-Y>#@>x4!!Pu1 zM6O)jCYPpYFczv^tryR=uT7QKDU|3RE}Xa~zKr$_9UqgJ{Xi|AGt^x7T;QfX9^M-| zct|l;iZ$r}??w62{E}CGwB<$QmHuie{I@06REV4i?l@kbZFuJ%pWD0^ zMVhi6Ky6NWjEK# zSD3roO#a@cl{;hav}Jw+3ASHjH6Hm+bdKaeGW8MD12Phdj&r?D2a^es+?!>K$9Z@x zt21|^cXDPE<;6?Mo`gLp;ouR@7CkS{zanIhIF)x-Axgg{9Ulzj|fTp)QJrk2QQmP3`DO zP2~O-w_iLYtn=|n=c#zPKPMp(jv~pr)VjXz6jUVhnf5)sx5i znje=fyqgs2_f5z>Zg8FsEl{g{Kqx>V&Q?u66mm|qlI*W2bomcVNRv4`>5jyG_A(u5>7H#YiRsjrA<3BWPDnKe|eTC-!a*;Z>Q~H+IMQ4fr z;FJdv_@c`JOq=h1dy!6KTsVj3QBAJ4a)r-ay=$qK;}0G=<+h98MIN&)l}D4^b=`@; z5vwuNQ~%GQPNA*PQh7z{R4XTcWws?%!{7G@4eNp*xM^dA-KI=1<7dE-)S7rhxyWbjQ zjuyP&t|hSQCk$wo4Kf$m-TiBNqw2bf=7IC=X$C#fPh#ccPtV`D$_d17cUy z0$!pQWs-skBEx5e_wMmcz_R#Ctjq2Y;s|sH29i{;lC1Y@v~zoe@doB`w-IJ(*#xUI zBEDhcq#^|*7Ww*gu=pofBT;}8GKyo^xLC0fbo>HB+g;*%uv$7l+%W<{^FOtW5ExvM z2cnY0Nnk@LB&vH7gmxGpI(3L}-fXS|(ni(~Y%LG8gZm#gcc%B~6FcAvtU%@Cg^0#l z2uyc#IBUYt=MRDbINh zu0IQFfAnAPzS_@H@jRWeo@5{d-sAu=ZUz4=;(29A`NUG#rr+6(2hLi8J!O+J`MMYX zoWt3+{lQ6%kC4*|{)D+E-ei&$FuY-cO2^AdNB+D0Cf|tpHxop-b$z||pE}T_5Xobd zKkKTGjbneCyY~YU!pc%xBodtdnNfIiQEo0I6;bWtK-1V%CB9FNB;9a?prV63Slk^x zHP{0`sRy)T_EjZAC-P@tO+7BaS*RMDezU zZ~X!Ko?!2Voz%)_kn1Gp)p7^p*D{5p01ucY!tf^nUf^VAmuP@e_r@ov&xp?kKrD*- zJ|?#h3i}>H&#!W0CpDA&2eWLSQ);+C;KhY`YHNKzINMXp5NN5q_kS=;@v8rYSw8#8 zEDOoW0$riH#wUM+s{WnBYb~NCF_2NX z*aO^jE(Mw6BqCW{fyyI%+bbjdS|D4Tgr@`-DhBJ%!F4Gz;9Yy^Lsl6QIUbhEBzU+=JgvAZjKmbt}N zDJ_@RJnK+QymhF298A<}A~PXWVe(OH@_m&3OIhF1^$~vh#l{@Sc zI2ordK&6DDR9zsU$0%?@r!*DiLztb@fed5J^g;&WmfqnZy!Vqz2B`=nJ3~zwzB_cB z)X{^NB}7tpEDlg$UuMYH&Zmj)nQgKd*VWhOL8-AAC9-f@PYo%g(KGP$9OzTHKqp#> zZK{0lDulCiO{H#-P=O~TH3+yQYlq&}7=gACt)Fwzf^ zc|1l2Tk;qhg&+%9d`Exbu>e+lJ-cTXH>C-nUlR|iwH@7D--Z(vx9EH46f$*AB{cA| zRv7H-O;10^H^75p{L>)2M;Bqxw{99(+W zKKxem@q%Gn;oCuuhfl!8$Oz6hrE7GEd9^5mY1bB~*aal?a&)qL;MbC%kzW8E`G>gy zX9-M#6=rxF811>dmwfAxpK2DMzXyTzJf#kGZ1GxTp?7vuBUL5Qx`Otgj>Q4 zAg0pNkDZnf)3|_`xjLCuvJa+Ew!JFS@15zt8mcU(zjJV`qS(q|AV`-DRlf{H?&fB2 zf9-3=FQUuhJC)G%Q~El7mj3B4Rv6FA8p?}EZ55>Jd8Llq8>Xt!yjMDG$~+Ms|9U7m zeob!FKmpep=^1y&J#|7sM9sDj_`G0f@$m>=VR&I!gR|>m%OZR ziJkZ+SQG|4+b?a|$dMYh&t7mWuXJ;0^+WmSXcxL~f#^N-QE7srQYTy9E!iz{zz=jQHE-@S&mCYJ8PdTH=7k7SqZxVWOb88MM2BGVp zpl&sLW9tlc)WyN5$fh>jk#!@pp)U`kY7DE$c;eVK>evY1cbX5c{uiER`O@RW9`QlvKY zKK4L+ZI@E>1#9TvJ#=KH#@?lDj@lZx?_o8#C4jGk85N(~S4=?k3lLgHu&a0d1cdCm z&heHFQK4yH=p3>|`%LBU6Zuqc4N&^m zPkPOzLTba#l!miI9+zd`%=AI&ez&_jc-3N<2-D&bv5X;pi=Lo~6a z@_~**QUm=?M?N5zv*ZFfH+W!!qi>nNknobsJ88FA_S6W^_6P^-R|l#SzBXx+{JtN< zwIdQ71L6JuV2fT`neUFJro*Po`y;HD_TWB7BRr7s!Xp^2XPJD%pA}V4h zjhKvcAH=e61z+VTPz^C9e&6Q#MaVlxb*3dLB`mk#7a)9C_l|-=l9`|Qg?cQ7$Aysj zOd}1qYoT6B6w!{j`{p;!n7!>gzZi`z|857XVUy39l>hvXep6i^f$ZCT(kZ(`qcsm~ zFr$UT>+QBP__Wg$8%c8{?e14L2;30s$<){(!OwnU(N4EL-5hqR$iaTWbP^_z{0M{0 zCbqC=(Gjn^aQWZc<&TbzMeIbzcUK*62sVuHrtl1>*WoF!kH7~p`_An_e2;qNG6L+0 z#RRriKWq=ukik3hyj3^EV$0?O{Okq}RWa}}rK?P68&@*JJ5~3}o22Sm$;z|%g(6rl z>fT8)`wko0;;OY*vwY>nn0-H+4;7SH zPrq&J15Zcnc^zy&>(GB>lt!aA_&Y46kV-sfCr{%p8vN5Wc= z9qam;{61w>|9i29rG}xFn5N^vT;H)Vz#PZFYlx+_xjBwUN z_AejQ5nSeSC{N_?AY44^7Idb+Mx49{l7k(eeaBaxo{{uabnm9baNAM6)6cO*`@r#!)nqA1{^C=zIWht~`TFve|4C%YL zd0WpoX&mja@nb!fx_?cu4-Dv(BL+j23t!ZC zQ03gpJ}1${lgtdx@ z8mZXE$%T78%ws$v9Bd>ZUMiOCA!-U+3?~~w&x_2)bt)S>Ts5y>(Pc_Xu=O*Xx50!V z%_USfY;?$`IVr<~oJ@7##x?`Kk9;=W+p@N3p@c>8nE@>8su^*Yz<-zB0eHEj}CEW6Q2$rV=%GvVZ@H>Un3==tMS1gq99V_?C`|7B0xYL{~zip zGIS!wvhI;Mf#FZT?AXD%|I?0*a@u9NyG|_NpLv#Mdw3vy`Y-$ld0~6En>HD=V}r`o ze@+XcuRz|V7T_9B{JRB3fuA3)v6Z5hb>?6SX59Umy2>tc??Q8CT)Q^48%`z2ry9oa9ZsqIHUng&+H=*<)+;4U;ILJ68ftL?R&Am-?{?*esTK@>+jH?Q)nKbJtPi%gZ1Zm5w$}i z3VSXVq5nDbe^2OtZK3Tn#XH8$P%;z`GQe}zA?C>o_I+<;l?c&A zp~6)0atME|1En-RV!h3ST;!nbujRu#{@YhRo%uQ3h=$WBXAC+4a;gKd;A}0pk5luy zrO4l}#{z1z`b_QR4nsQ%9MZgcMct+`{=gt??dKD`K7kU4q$s8oVzNEpxa{WOT+{=p z++H0-zd8Q2X2V(FL8bXE4#-CJx^EQ2n^m3d@f}R9-yV|!0;;=v zM}e3`!PXd#8qS``>WLy6Sfg1;j0|j_V z^NX+n$2^JvmKA3sDSPUa2%e0@&ATy^6UV!y2%t)B@*QPba`ZK){mr?hG=4+5vyCD^ z!k+)4auF{!A2MK>1)4OuM^TcSW#zvHu#`Ug9n@XXwrk^KP>1vTH`isDrONkA-T1ag z`p`dQ-Z^^+olySkP6OA_8rY5t+c&fO#`-z6D+$GZa3U zQ_}!vWHZ6#dq*hOr-~=r8__BzQNMzW8ahO3*pc`|h~1nSdN0>m=e36XT|}5>nr}=N^{}9>wgNe5-{?PA(!IETzwe5IL`~|-2sEOcQXGu_hcqx{ z-ub3;5&llf$(V7QaQjh7o8XfmLEq5nLu*&IFz&^z#3U~6t3&K@To`0j*YD0 z=X98_>1moGW`Z%2G;Y};e7LL!OLLsz6QGFNq?yj#44hfiwlTVOg9v0JwXEETy1M89 zQJZ00T{{6lj`Ut(^I;&x9&kh0^J>vdv_T}CvKM#VL~#s6ki?d0(a8*Inq1<7NfDmPJ0Pggag;~taH2}q&s1$6?tgj1kZgwU;HJ-mSQxFHq zadd#npM9~3$jiDxv4z~(SjHzs`vE4AQgyKmVxb^n%awFtct99^67klu2;a*Zw9=hX zEXekRzF6B*u?O`+J`|VDZ}`xA47iMqvom9k8`pwhsL{-Cg5eZOsggo_35aTUVh7YZ zte&lwA+J6Adm3dyz+_0OCZ4w0VM6*OySV?!n!k`RrOUPo5=yah|K!91#*Al{9iVER ztn-xp0Yk=UVN%1XrL4k0c08nD?I(~1uXynIr!`#RayV-Zu<;AjS>R|7;)8HGi2%fl+#m~Ox7Yd^457IKqA8M?fp+MU=Yfu9du<@KGwKQTXKaH zn>+gJR^nol@n*@QKrxp(g`mUZR4~J@_iI}2efLnED z0?Dul_Ue_WDlktYR#**> zjKC_1>Mz}4be!X{R3ZW5b;HrR`t5AnAK)cTEjGO&2pIq_oSw5EAc;X|b>>TD?IVS8 z2F*)LdTJ%(j!WxEV5Qn3$mDZ0CAI29P-zWJT3Y;paYA7`GFA1fn|pGZrZ!7A=WtxP3=x3`q2@W_#maK zzv9^%m8E6>TdgND6IUS9moL)d_be)kPWd|;HtU5hQ`I4Oc2&5KQW}WJJd4-Ks~uGx z=!V;t=EO^f)s*!jNr*oaQ7YAa)Tn=uaLbwW?yqD%5`txTgXs-uKij#Nj7Z=7B#2tu zD{VQ=>MSuY_a#}L;ps=iZTQ;SblRVo3FkpSk5HzbQe=DQ*4i?q&+SN0M?W6yn3f_^ z8mwvOA7na~jXc}ex|wwJ_aLn6KJTE4mqfw^fzOyn?D#>f=C!a|0d)^uU z10Cz4Q+H-+iorkIkD^m<*kOgy^t34YFnef(P~CZ8(0=G^Q#XwrI@pyl3cdXrGK}f4 ztqpC}*Bl#HPrwWJa#57(q&AP5^64o0gJG_AJ55-gkF>m{2*1c-M&J=O!l-n&O0Cuv9k;Mkak6_l9m~c4LF>?)*QGW{vH09mGSPBd23Z1(NQwDsae-=` z3zk^cb?c!Z)i%@jX)H^p{dEM+jDfSgYU86foSU);fbyT`pPH67|9I5yu43 z`*m56{zQcZ6^X_p=PX&+KreimH7HJ%?4n83Qp!MGv-wAHzl<3ZPOeENqh@7H&bN3w_ zI2jXwCxtpN5fTUP(=xP&+({!~rOAtMrYKVv2k&}EArn}S2#TJnZ6^(?R>u5H;y!rxVsgnkX7&Ds^QYXVFl`IHEW_{5ruCH*!~hl!U?*X^J!*TlO7-J4 z1DV3Lxs|pL`uE%8-Zb5zP{mZN^3A$HXohK)J=|xyR3a~4MK;`@x4J&vty*#YmtYDH z(r?S(3@&BF)c>C6f~_QwfXSS+GzmNY^6xhR-V0F&Sf|b8zkl?5grVXy9%&FVXKI0S*CKcsJUJ$V+d1RGa6>A@lAs(@lN-yM0b$NPtj9 zGANkj+OEF%FN@5t+3$bB$$!z(UtQn-M%D#lWYDaW118jv75|;04Sn3!?!S^Lh)Vc> z8s6_nH1>v0#y98n!B08NGqkaCJMz`JX?NuH)9>2=75;QYjg#(G;%VCrMU(S1dDLhp_Y@ zP~$Q129oU6?j&hs@m>eNc4BI9UEY2%J@pevAbO|XVqxi==xzG1q#zJh6A^?*=XZ}Shl*lT6T>2ov{pZe2 z?Ps|M$$QHX1fewvL4_F$ZqT$Mh)GTl{F%8jpf`siMXPQh&rCt$WtwrYI#y9?Y`%UDI0p_Yo1mmhlg+c4ou1)iu(F(l$tDg=v}6V$ zi_BD!`6C0nuC%;PIUu>-TxQ*B6-pW7e!|85&7WCnFGPzm{kQdVY3*wc7Mb^E5e=Ij z63~y>2a&8l&AU5*;2f(#mc!o$uD;_1Ack{@(eu;E@t(-U+h@kWsCF$d6&zj(JQP@i zL`Omp%mh;9`bx|I%DN0*Uw)V5#<#-5lr+$*1mY!{B*7660%-GRNkh-r|(9E!PFnu~ST+wiA z#SzfTCy4bXsh5~2fLKz;YWsj|Nkv%=OI>!YneQiCk;Q0qLusJ};=%gl$6ih9dc1G6 zb|-(y8&Rg{K@lid7wDY&-alfp!fu3p5Rvke^alVb6ByRDD9UnH<}Jm6`lzM8QPQG?qhzR__ zU3!idpDIM)XFPw8u#-Ny8U$?d`?of~BH@3ol*nv6R$AQ1F>lE&`CNuXI~3?3L;SjV zVD~@+WI!do3X0EKgLr< zoo}h3D|Nqb@`~^k3_8sx!ev+HfkD6^poNyOlvt-LjYJdkU zi3c_0J2E_&3OgG>TGtZQ6ScNLCpf^kmQbI3>|!#g^-_Ch{y0EH46z0yFuUp6zfSF4 zg1mF0sqL;G70AYnT0%my*hje8_3m2wQ?%K8PuzqJBR4cXWt-+U)+( zAdJ+j5N*Obe9K%hKD7pLWiu#k!{-m$qF?tv#2q#Ohq59fjFlKjJMJoujF)Tcnb`;O z{501Ff*@sNs&%9(e2Q*!G?_Fv+czf1=YjQy}D=&xFHC)b{zIO*$9bUwnJ zsdrBwpq9FSM>7Z%T;{JWo6LBqLnwOeK-$UGj1-ZH7~Hbmr~w=L(K`l;p2}fw3r@Y6 zfh3--HhR8^_L0P6vsUwvTLr+6_je-I6;w4$-q#CRV*4$WTi`%N3DwS|L$Mzjhb^D>&7GY`Q_96`}whAq&hbbWt-vp$OQ^aerbs&UwVEIQDm%hQv8=696k9(yzVtocO z&^Q$=?&>b-^hoaoA7Al_+f7=ilw--4&=>EDO@0Uw3{f_p`!j_#jT1cHW#-)9m;cVV z`wyKe?`X}=N#wC^t4^ntB|0Or(WQLKts{WHMD2dy*CT{Xjh&}fdR584dB6hl&yN(h zg_F}0?nGkZpYVlz8y8yHUK;2`QCpYwbK8Cm5+XrVpnjboAy^|RHu1KBH=RPBu@?SCHUy|Y<$ec&SJDs;heo}fBB}KXo=A~Jt@gve8bSsqUh+7@&

zF|gQf;oWx+7R8YHETvko^Ll?G^j&g!c}B(Kot4!J=aa3`>b?GK0lN+-#hv{{kvS2= zm?}z!2J(x%Ld$7LKee3x;UFncs!o` zeG*xM3(29Q@K#zPeH1`OkqEEP{&26AHWTifORb*aOnxeiV3kitwq{)J_jt-}yqN0d z4*AgDBUw=^h(%cGN4nqeig@_W=Q>a;F7Nqu>RzbX3N*sarP+}dY#=-UxBvIag?U%! zj^WsEO~l_0>wO4+?1+AF;JjoEKKl^|TKY@t_HI|wf>gyJ z+#o?6+ei%W7Z~26OBiqQJEPjCdj-YQg%nPonIz-&RKxeP)*~HbJh-IN zn3wJ_cDePNJN4YWurtn703XpX&e{cD+WJde4P|arr|8*YDIKQqMa(a`2Tk0V#I==82Nq)3xTmk>pl zh_^>CIVok;iK34rn8Lu{1o`v6+HHo&=kA=()?kif&3819)SqT&z>^7OP>_9R8}~+a zm`?)Vro2G?_Ov0C=v#g@DcQnRZ!D8rUF z^RrTM8}FtR8n!&7ae}CAy4JDSw92f=N2JctJ5vWBK4~Y+`_cHF?BjRpd)zSzD+fD= zV+mhd?lAN-_-j6(7-q2e0dga|QJ${}bjD}&{LfwNr02i)5pV0Vms;q4-e?(zQje!c zRXF={>N9-2)A)F9pD>{#oWFt}6WER^M@Ou^70_|^wCLA=2ndbCFXH*(USV8`E(*BS!IS%7 zkU~i?TS#Uh)k6G%C)4fd&ILT13wH<~5bR`eO$WS4Kqbdq#D6t;Rg!~1^kW{I4oZSj zEF16J5e5Sq4MtiS?8>^3O&;AJv7w%8E3mx&T<(yd{^r+)8zhx4MGeYNpH^DOrq~HS zJN{V6`NG<#K$rEvC*O#(z4B_tCE-?!q8H$&k>z_uBorDhc;necpTSQIx}j&AVXJ;2 zm$On+)>B>YDxMH+_5u+;J;}Q%FJ@NK`iq<N5W|Wj!4ZkK3VAAA8t-r7UU7_7Vx1GC$1L2RIC#avXxW@W{c7-DVhSg_m0Fi4Ak_v{*e~ z4}L6HFHCe>y8By!v()kvm#@?*7J1WhQC)ti())SyymS2XLB9r=o9G#hh3AN4ZIQxi zhsFy16m@1^W%1&34V7se`LTgvliag5lg(l;y6#I2xSx*^5wEm=HD5n}He=oB@&*xwWX1Dr9a%&f+wYC?@}vz zuPSg=$|3s!!*Qaw*S)_C-8n9DaImjd9|)QhTs*TO&4FDvXKoZw zo>yjhyV|!H8z;;9^AYML-8#o4u@n(!oPUBdiDl!GPg6kgX+4Dpm|~oyZe%bku6nND zl2dY>W2w2=psn?r*0S7J%%yLf?-VQOb?raDG_>ekRzeLD@Qpug))HO3hW-iKYjX7d z#Eo-xhgRe$$D+7QFXK6>mmcq5t=GM3s+4b0IHVc$;0s7q*Qv@XDvm=Mkd83zTD~;n zr_C$g0u=cqm6!GQL#VzCuE8vI%dh#Y`2~>;gER2(z17n*Arhb$;1+l|Tj}xOWuET# zmHg16HmpOcqD^mto0c6MkY*$9N=qi#FnCdjt)`^=ouGLKhf%7qy}n zbED^GEeE^NL0e53w-RX_ci1kb>G*A@J?u30@xkW2ZV;Abb4h$eoa*D-Xs@>s#l5lri0sm4MDV;) zV?BDC8u%$+X3gFJ->k&D==rv;Ev3*i@Ys~&zAcB6WCZUk zBmMldt~BdL&|8H#WTcAk#kd=0#EupBeB7kYXW1(pXALKprE#kK{ew5>Z-xzcyVi4i zmol~|?wym7v!c7=Wz1}QbMgCugUrIyX})??F3+oP+Y3EEXvYe$P+zVUtys&;twg$T z?AAF&7&t64U5&{Lc<)4-q2Q><`H{hU`m6RF>Ep_;cQG=p*sActFtD)?&U;F-SCpg|+>eD_|*RpJhe_cLu{~R%h?k!&_>%6{qBxiXS7Zr9F{*eZA z{ki{%(a)ZohK?rb*EsVbwYa$W@nk{YYh5u@*fckxpl;go8DjYT zoi~zU`_i9nSj|jLj|6df!UvfL7!sWQMC}MMPCD@%j&wu2GFNxwzxavL<1zUf;o^A< z>Im&|Ip?5@UV8=8LOXoX(GC51KIa@Zv}@V$5AX4rq6Ra0IIjH~)_=CaU9{8f0y*v) zcP}9`s$V};9uP2wMQQ;}j7%$#OOU04mcuMg6#X{Ft>yPGx*z>ME$9O1aQHA~KjeacpII_q@Sxo3r1pRN0n!yP(aT8+@mj;# z*&jWTmHT_ZjMueb!Sq#KRg7-;eH%qU@aKw8<1<}FBWq+$UsQhdw`JnX;5>a>@1*SoRD&+hVe3(ilD*}|sTF9wt`u|uyT$1q+%*fwg3CT~ z%QG)h#E~|MPr{&D*U>H;ANxK+zgjH0BzTQnAQw8Cdo4wsQ~CLzD~r2i-92H6Uwb$n zCl_q1APp}Yc}gs|x>`pp_YJd*L#8a+sJ-<+jXU>!DW3UMWthLcRs;vQK@d-vo}C>g zoqL&C$sxxc4MR9b$*0OU*OXWpImqx^QEhGQkyz1m81beVlrsiWg`7TQ-aUsr*rJC7 zwGX@CPc>uT5PX=6@aw@FBX(}K6{f#kl}7mj+U7FxtHdw=(N_uRp_eBTCz=1p?d60% z_y5Yr(ypOBJ9dpcoY`W|$Y^U|TXsuwtYCLBmmVlhkxNMyv8z4xtV7zE}cjQAj zc~?c{F)`}6BS=TcA8&f@rxU(JcVm76$5OG{8~ys-Az)pOWZ(#!n=E0$Lr z(n)DH>mD9{FOhQctC6LTYiK*iucS*VQY7=*ZYO%ocW-GdYKPTtf#KXmYw@&D``7k% zH4cp(kK4M)_Wb6?{Z6vhBJEfV#KVa2PVhqzYkZJKIa9h!Kh#M*60^bgqu)#tF6T%n#eI;!V7EAFs$X9edY6KKkTvPNd5-LHI#krQo)?P_Ef{ zK|oG_CCN8=37YFVyec2;?XoFvAH}zySsH%7@j;B2rKD&guPA&_nM+)Yaxgu-PMo+n zY-w>!gd}J0(4VZgZiTzR$keg>TgC#ntw{d!=X>sTB&{*Fk*KLSJ!jDWTJH~%f|nLbdOeP`o|UHnd|lg z;|vCiW914vkE^r^bE_&6WIDtA{(tsmDGIi@(G81@EtvQz}SHl zlhpRwY9Rk)KJ*I7O=h+py?+?U2) ze7sZiadW)aOs2eUxpC9dGI#5QamqyP+g{_zOh(9y7I@)xF`&`Oa;>=uv4s460K z9rLt%z8BPYY=n*`7O1$K5h{H!Ibk*W58rg1$U*02;X!Twhi*w*wb6z7j|(pbPY68> zm(r;hI9zE`Vzm?b(eq^D=C^x;53U@sG0eI;k4FS&IZgHTt&Rk-Y+fNfq|(8Aqc*Z1 z>b_9&Pv&ynX@)fXOA{{J+R3{uw-C1x36e(Zhqrg^IG1*!-@^_jC{3cl&G9 zF0zlV9{sreY=H8uWT2JKw6^sWNk~ESFd08_|MumTT^X}d>UO!+$T^%VBLfNo2JuQu zL;U?^j;$vjlMc&z9>24AS&*Po?p?IRu(G`Ma`0i`h&p*-N{p_6wYz2J*oqb^OX1k0 zL!*Y$f{=Q5tWYZQSytgvZ+d7&OXVDC;`&s@oJDIVs}hU#-u)5Wl4zeaW<^qym6{56 z8_SADrt@+h{JCykENI+pJ|-3wAa>aX(~wcvY4EFg?iJ|N&7H+-JjI?ArrUWSy< z(Q;)sfwp5Ou14#t_d#VBgMW|D$?*>F>bV;2Wx;{9xT?&!lRhTGdk2P7r+SnhYn{%!R#v0)M++VNaf4rkF3&nV4-^{BEjdg-Hc;r>4WSg@G#_AJ+5O{*78c8JDC}5*d_Pwv7 z;;7%AX@I&d*3PfIbYEm@vuNC{JNz&)E{y6;(^MD8I1v0^HoQVkw^{rhk}xh46xejK zkuw*y&wu$VY&h9M-KkXp5zTA}iA-FVlJ2t7(HO@#!x@{r2qq5>XUp2wMjAJ6Qx4`V zO_WynZydCrj{Ytat#H*-#m&E%qecVae?C`GhbWW|d(_A(u0cXZ=|w(#*(G0F0+d5{RdYS-(gFx@5Cxb@vdwh}n{ zsj64Cp-`WgI+IZ~*;KpX7THR^a3?%92&~i?K>Dq3dWVB!J4*Y>zCK{X`R3MLE&NFH zQCV`O zu9WErGOF}*rL2MoM@Y4x;nN4ibL-QIG$Mep0=>IznyXnarkoat8xWlPXviY z-fh!*waCPAe|Y-XDrWEvUwC-7vCe#Sc{JEQzsA$`O`(Ca&QRq1TuBnI3ile|gUa=^ zG0C+HxAZtDByjZ;raB4aO4ScFKtsdDa-Bv0ZveJgaZQP7L(0x`3$BGrgU-Fs@l7>R z0B*##9?~IjAK*2(d36Y!Kc?MdbEyVOYDbU7Pzd`l>K^qYnQ4=Ds_hG92k1Jr)GsVg zuCq3{Y|(^Gi7bbGnc~dNp$L~y#O~P^Y^fm%?H1?XtBH-73LnbuQXO}U&X%|j#hcUR zB3;25vqHW+$fE^I63luzsu76vx2oH`(z2AeS@{*co+f6WrEhZu!?BulLVok*iN6C- z7W*z%#4rWUY0^J4P`5IV;hS0Vz-ZX_r#+RUW(Wm;%$1zg?3{(9_{5>0b($&4Z5x%J zWgd9{Jk7O!;zoSlMNs2rOyr2EhF}fJsZm#BKE2-`;I#@MZ{v2yTJVWuO5OhHJ-&K@ zGa|8kg63cEjEAGbJOv|Q_k_>8GE&7JgSG*%!s?mT+A_?SaA>UY_H6wWl}<9qU9-Nz zGyjm0vm!*j1zcs0Q@d5Bz1P&=YaW>(9viI_2R09Bj$pg4J@; z&S|hEi(WfTjY_eHff%ZN47$r^GM^b6EFyL*x{eggtP7JwtR&IO-f~|4EalcC@|w$# zU;)ZE1sZg%`4LR_$j)E%%LVv-U~WR6NautSZq&Z~~1>%CQesLTp zmf2SQIRhuQ;8E-2U?mwy3sE35PH`r7$+5VoP?4sAJ0LqIG_7R_ zK(%7K1f?TG#Rf|?a^-IfEAp;6c+w+=KU59oss$D#g^SdFggNxK&-+Ohmy|B`Edgy* zgbqCHwJAA3SkRBYMWmTaBJ=i)9BU5D8vVrqOvhb6q69YLxh%SXAdzP5(8cXw?Kk=3 zZ&a`_83tVq8?hjuL^q?;DDMYk%cgldnqp3>RezpW1fiTSC{4UbfZo&azs82gvtl^s zbHm`#6?yH#Z3c3_`c z^}T2btCTZ6mv|2J+&=)7emI&r4jR@#-<0U^pyi*`7% zLo7jm`i7<#y!`@mb+w%Ji=4&Ta4pQKEwbF@QLhH-8#lAvP_j-&yef_66D(+xUD0$C zF!Pbu6~De__R^nAYw*NlJvobsG*Z>UH2lY%AfLEk>dGnu_lHy~mCiTOJ<9q3%%k{z z86!^gIZ5rvlnQ^rOKK+4xM z&L=LB#y%cOdtTJiL|_HjnuNiqm7}ilstt9uD0w#7h4%1Ji1!iDCeAxs->`Ar^twx^ z!%|8#wVVGiTz~2@#A_w4+HkXJ)a@iw`$cKdXZ(9^6iJHcXyo8N`m`QT&r3DGr90$l~t(+V1O- zk6y_{<_CQPn<~lqC!TiYAQNKKght{Ci<7piuf|<@K;0(8CLQmlA{12u!?m50oy?zh zKb(mQNuXC45$faZV?RMi$Gfgsk8k~#c z!|bZqq*IMnpIGz8iP%KGO@7;Vd$%RIsVx=i^F*&tsqp0o+4e0^z2oUx54_du%j6}} zvQwPXL3YnED~DrVL|XwccELV)XJ0Y6T;13nK<2iW%J|-rQ~kpO@U)c8(3(X&nsN40 z9~-E?&=(~P!~FgyqkJSO+2WP(m$~In8_3Mjs=G?v%Lm`JDdQ5E;0;3M+%3@p&}%VI zcB$2FC&k_~WGQgwsWI7_mZeYo$LMA8K6Sp?hhwR+kQLV|^M0hBAWTdtP z)-*@M-0-@0Sk2vhT1A5t18o+`Xew)7g`9|Pg6g(Z+hQ!pUH-h|(m@}b{}v-0b3*(; z*Q&MG3}@+PDx4)_WZW)J{-U8SaC)|`axnQ3KYMP)9VII4gogv+&6>;UGzokpa{6$d|V=uNNC9 z{Uy!lBkmAD)qL03D@$)_5ZYV+=^PW)RXY2E7bFs!s;o&V1?a&KmuuDl)(U$Q??)N+ zAL25OV?ArGs55LeN9*=>w0=i9M8bz+)xd1tRv)r0u_U$#p2q{KS6MZR8>kB%u~w-q zTbv!7aWAe;fh;=mzm?L|O&*7i85JZ>GGr8pT#1Gwe1RUiQe|KPs0s{*8xS?lI3b$*cIu zz^qaK_O4*ub>{b4kWstIf~rSb1ymYwCM35^{W zF-r%X!Cfh(un9!r)fcaCo6;Pv0^HuGZSHsXTwn1&>vg$8kMZCh?Zs%-_X&(o2(nG( zVtW5)hz5Ww^+H$USKqBBtX2-+F)m4bh?deh`@&n@tnBO-Phw?fk$nSEN35nApP^iU zOUvsYq^(DV=u!2w{crouvsBtf7hiIt{!UfjXaz<;=9=@|$A({ywK4a9_E{(XKwQHT ze*7?6^Yt&1V)$VyY@4L2s(M1>izP&xKflYL`BNkwdWC~Sh*gFH&1iT)|6@k9|2931 z&D+)a3@CU>Lsy>t!>@s10yI$)&ydP~7UI8K*o(6=g`DcA!2c^#p#ET|&0!i@%fSDA zh!!JW+O36q7T@#!LErNA0^2{o^S~J>}X&=e3G~yKXl&lc_f|&rF1~=lSGzT7Pc@H1(wd#%H@+5 z2CB_ObX_z}2c6_XG>sMp{=ZMCn0K9^1`{7*XV~uN6`%W@@t2wD-1jwpE2;x%uxKo4 zhMBLJU}G42a%3;PI4)Okh%c}rV1z0`=moAFyrx>--Yg;xzHimN{htb=9=rBJ7y1L< zjTFC){@j893oFiXhK9=$yq?|9AxH zWquUx&NkR!T~qB)^J?Ou2u`mNT!h-pj7OR)vnTAJQ_PRUe$Ly+D9mS&%9xDLvJ8lK z+U1aMA~Sz3lj+f!pZYenOQM*N_Ne}7pBWHft8vP40B0s<(OD`DJw5C_`GRH>T7%U$ zwrOW+B)rUPzW-9`NvhYz#mz}4;)#@#`SM7%5NoNF!@y0nIqF44rHjQpbC+~RIRl$M za>M>&@s`sgv%I2z>pD~OIX%||kDA3V3micr*xH>%gy#~X?U3JnVvl(ymu8q>zDI%# zqhy~AbZEE3zC>2{hatSSwH6W#-O20NwkIybFFA4I3fE{s=~k{^dUNszu952}uro=p ziuK$pTt~>Sy09X8*xGdC+1DmiLJeO-->7DT_-4VOzhi)kGI=4i|HAo+lE6Z$k`OU~ z=_kUo1wk=Dd@{zQfuJ;oTtc)J5nKZQ_x1HJi8YM$0If5YK9u%=qBAn$SCdPK*x-9( zf?yH>i6HAlz7hmnQLIG9;m|cwBO09OuiJ$bGGI|8v>ITwL2?DI70@e4oMQcA(go_X zJ{8Dake|iKXYmi&W51hcAlVK5xU|oJYyL~Z1D}VC@YkM)m??B|NYfdz2iY-1c>sGW z`x5L0f=C>UETV$MH!kx{$1q=zDg1m+zws;@({ZRYx z`jG=60zV7KzRM(%AEMdA1%yHcM>b@s$S%qAD0N7A%i&Pdp~OWp4YQCXbcBMW)?`m9 z3`vpDM`fca(39|Kqf?}GC9B9dlV=jolQ$;D$B!m?C#O@(#~NxU<_ffW6ERR)8%RV zm4#}vX(_+${sqocuNQhfQb2#Cpw}rPQdxmo=xIF7sJtJlk>~FQg+e(&#o<&9ntTe>Q8o=c9PbNe^v@T zWbG96q*smfY7A=qb)QS)qvOk!vXsJRTyjwjvg*3)RNBSvL(kp9*+NFfj5S!haEpC) zeZhUzde3}&eRrOyo_;-5-|5{F<0K+xK+{5FLK{FAhj)dOhJOlI4EKtQlu{_xC}xxr zlp>B*j5Ui}#B0YFW>;l5$==Q8$Xw$t&G5~z%;w72U>V9}ot~R+%QE1Mm?oT3pSGK> z2Ytti#}bRF#qw`%XwI>UvgDjPZl};|Vz^<*W`L>Hs0pss(reZ0&2r%3H~IHtS+KcZ zhaY4Gx@hUMDmF*AZeA&y-;b;9WL#`p_!mw%GV{|h%phXj?hC?~zE`g2RV0oGl!#U& z10*BDTms7Y>3DLba3xtK52aTHKK2})34w!HkAJR)TYkSElVghI>n26hh4mQ?<_+$< zgtE=pB806Da!9%Tx#L$o+rhoUza%~XJclImB_c?GPLR%n&J*})kf*F;S;Mg)v_Q{n z#~h_yy$IukePOXd?T z6qp^8jW5*hd7ccL9T^;%C!@PNIM(~^qPVAMqUc;QTS~sT+q8l;iZzav*wo*2(hO$X za+EQq8>b$XIrc*4JM}QdsT@xB0l(8t&z3~QaM7^djp9CYUSL4bkKou(qgZO#u2@8J zgH$6_XNpgQa625%Ka!TmJ;samozAh&5%Q?(gSiL2cG7S1%Q{L^$_3Cn;JDzV)CAS& z)s5hL!#D>QZNP2rY>4NE=Df-Se@0GQk5iaaSrDPpM$JjC>+tEsG(QbvZIfMzw8{V5 zKUI}YG}lH-VHYkZPmkx4O)n{%BQ6Q?IrnMxA;unI;A;W7G+JMkQtrzyF#2R&q`yz9 zO{tyF)j{+IYkmru1WmRvN2F0RU+9`N6giJv%Dtz4(fX!UTHn>P;_LBv>}6-V=#FKJ zUB^K1H1Hl#M)pW1tNO0H*m@^y8i4V()IH;9aM$HD(zA^~xj>mpX(ZQKiXG7OSb1E2 zaiYF(pT?W!u=;hCWX0L8c=U(hUi9AMo_MwxSF0uqT{QiMgJH*`U#Y*vE7ly=QCd*d z->P`qq2tegjBM5H92b25wEedEQ(OJqklKE?!u8W(`flZp@-9CR>&@>=_xry#=$-Hh z!VW?o{=C!J<>ecMoAe(Bc-?ZI{_Bh@f(_KB%3j6lW;=$py%vhj$t^bKM%#VW&;I|s zIP|!joK$USdBKomkOkg3j~4Y{LXbQOO^IxU?A<%+QWtdBpj#Pj@Ew#Lhz}z#4*Ai% zORDEvoA0=*H$92}@auk2cmyrG%v}xcY%1^OK%dK%<>7Rn-miAYd+LA4Yy0Z~p42-tC*3|?qZhS33B5)yB3q(+ z;~%1eZSaCZ ze_opn4JSdH+28L$vJmf4YHaCEbFat}07ss)-_u+adygA^6`%$yvUOw653EttF=oc~itz?%;^bg*zYA@O#w zcXZ?P79{&m2|nQX<1#ZD$$yHt+X<3^6jeyXom?$QxR_X&SjdFnNk~WpT+J={)Fh<- zt2%HdNM`Ns?##!`?B(UfNPgV080wbT{#4baW&CKaKp~ zb|fs^%v^1p-EEv4Nj};&F?I5A7bGM5=;*)y{?Gqu;cfFjJvqAl*JA+>$oz4KnU#r! z`M=u+stSBuBroX7;sGSU&;T%YCr|mYn0?}C`f-tb%w$K*VYXn=Yfb9DMfKE)vP?f{=o+k z|COGxABF&2x5)z+9o8>gbFQ`zKv#8cTeL-dvcQ(z%A4Y42ZfG zx<3XRppRxt_wN7G6+F;->M@g34bX4L-1V1_9_hkFe$v#oZwBz6w#+L%-3!0p2&W#G zC~^OrR~DXb@P2>2m)8tDYh4UiEtU$K=H3(_a2ZD3%CyR(_0Vs}@IA=&8r0Hrz+5o! zT6YEtTTS!buelB3+0~%_Teix#&#rgpg)sLyEP3gFzklDZZQsC)Kqe-_HuAgT0Sbi-HjZFjb)D43_A(!jMcgxjL?{Z|fO`L>6G7 zcf#3lpI2l|I4Ofbr&1WJ+vlMA%m9j>k{ z*jl!-XcQX>u+1K%lB$1=0jvj6?i5K3YoVke$o3IBok{fao~&HrYadq|GH z_IGa_ll5|Of)HL=hH3O=YP}!j*rbNM-^jp=KdE~@5=$0yRggN3xDRChC%pf#l8ZZr}>b2JXM?pY7^FDBs(i;1OcU3j^E5y1U-$ZtD}8sZ+|fNLv{O}2ft&3*hec)QquEoI8H_xZeg#YkO= zw{%0?IM%pu!+GfQ)>Z^DlG_Zg704>r1OEAdIq*@wV?WCd;`QeBB2d`A=jz83fjRY| zxWN&txNom|@#4DIrhz~7L;XY~O%)BY*}fG@qK83Ei}z{c=z<2T;~LL;`~Ak3(a+p# z4d)rD+J?LnaXM}aZxN3zZ+k{>l<|c8T&_g?)bhu#&ztXtZa6|6nU-0VWds($OgyI@ zpof)?MwwPsCKIO{1$3SdZCV98$)?DzcS?Nw!TwWVK3dW*Jc2mD`( z^6g)HzoZYyc0zUYYLvJ>fS|54Q`v6d6Lt;n!X+BL?y9)nFfFkp>tgDvWA|AR&r7o> z{#%PQ(Js$4$GrJyB*eU{>Bte6k8|@*R_#~ul>~kK47Ga=bw$j;=he;QEoH$w4bM7Y zGMKBA+Eg6ldH2WKICZ!Bpv`<97ch8F8-|*?gdhGwuHRQ1y;ju)es}D9+>Zg`f~02; zP3zdJNymz7|LecWiIiG;{sI^+vGO{XOp7$t%NzJ|o!6o8&oRRcZ9z=I*Mo?=ZutmP*YP1kvI+cjfh}b4vnclK!8L2dW#NsBW z_P#xxkOywV%(>}%Z-wc+vbq0$8VGAsAIg8*ktD&A$9M;Ee3I$hOVd+I*zwhc zTQps47((Kwkpf;;kFwZhYOGoDk@?Xn%(qD*B+%JT#G=AbV*P}5~!_PP5j@2&|VN3a(4oCIH|Cv&i^ zm%D0a40SvuY@(J48;v_uPtO*RzP{fXy{GmDSwss~lWFR*8RR-xNrr>@ZhRw`Ua)xI5!nt}Q{8ZJVW#FM%s~s-)SY;b9c?p^{ zu_!UcqB)bwD9v^Gfr~I%=FO$9`#VI_d?IL*3Z%n^@!P+0+e8>X-OT$jV_W7*nzdXj zJF*7T4$%4yQG{`H#nr3P73a}Oy^XZzNDoshI z&To$g)L%?@1$v-{35!;lJN^dOY`pZ^!d&+lcm67K@;}kL0%q%%0gX@F6+|i5im%5#>dNIN+hMZYM^>nQxxyIT>HBojpWqm7fydq2-&F$DAy6m?GD*gg@zH zmrcGvMwbsTiPI|*tCy6dT=?M$FoAGnThv`Gf!9*)f7;Uj#%;pt1U&B99TzHFBlng3 zUUmqJ7kWCJ!gX8)ZNJm+>|$3-`kVd^{DEr))yUF{*QnogtVWF4N7I-!geK2W*c^dj znk}ol&{jIx!XTuGZaH`*xZU5xr=??oxk~tN&F!a(yV3T0vC>N5tSHRU)%7;wH5=Rm zs&p();Tfa4wr7)}?omoO*L%vEL}?XL#5bpLfyB3c3SOp?$ zo$&U@C7zeSeFWRZxu!ydyTIFD(hI}(QIw+ilA=d#81F^b%R!V{I5Q^eC26b?<0VSr z2|7i$t(_=yCI^OJ&PrDYz&DN92cowFP^i0~FlrgJ((giO$X09W5b%Be8UcZRvdO=u zMBI^qzByKonVRHO55gYjkVjPcPDRLG9yDS^Q94_&O{m z#!;fJ-DG8?Z5E^=9Cs->2wq4hgXU`E zTB5IiQ?Z9QMwTa7<`;-b@r*E3b2Za+C5kxiFs3GcNe#C(D(N(A_c?I#71YpRx0dnL zk4s`3l$?E^lebcDG`As_mqMK)VlR&33^Vq34OBg_t**r~zZS6y90|m|UTUeDT$xj! zRI)jGz27w2#OYx)Uz%;vbt}3~8`@?Y*xvF!`U*0)i3)BmT5ckgr@ydcsgC4slAN4W z5nB~C59CkMC95RQ?UG=%S$A#bs>#Zv$sAmCeW*t9BQ_q|&V$sVvBOz*^2hR zQVHYz`Lmly+FkvINh|m}{^e=0A8A|T_Z6>J&{_%SpT9Rrh3Ss$@7PXwruhmDOqa-r zEjiAEaJK%=L^ZTA4?iZFxz|5dYX|7fwXJR$$*KFP_7q3u#VBO4-5I#wCc(_H-0p^# zlBx@#9i{m|8uOIw%_V^$3bLzhbYap5E$bu9drevW*rbF9ulO2s4n`(e)xQA%Y{pXl@VW>z`S+r`)CLpd@yvfvf z#yAYg4OR_|S_TN$5H}2!r|24KX?H33t9jN3le%bA?f-1rY#Z)s&EPr5RTb!p0Wn{a z{fNaGVVkR{V;e>4WXshUoqAwB$4!Sy;`aFn#N(F6os6}x8WIA-2 zlRu!xChMrX|+bl@|(hCG478kV>Z2xv$jyRIY=L}C z%ttY6|2_}74yZxUKZSmAcseRyT;}O><3yD#UFb$^wolfr439zFX*!dnza^r2MFoDCt&rhtZS4{* z*FkYIE#n3e?i##ocsH^&CDpDaSnRK5>&@Sky%(M$+`JOG7?@w-8d`attZ?73Q-t6X z`Dz%Dp`%s(csNG_Z?ZS7y}|apzp9jkLPv7ejQ*3haUnZST2{(^YIj3Pkuxe&ld@TM z&VXslWZ_`{G|H<=)1&e|xsPoM2MJFI5nT}nt?2T5LZK=BmSiH5ATAcVk+nw*vQ{VwjEvE7Rb>ZEfWiPLyfGx1UzRxN>zZ*`{<1L} z`)v|;3Evh>392F;We+&}dd`GmG<4MGIb~HGG7R4D*@Tk~aX$rjKj$j`#7?#981#{- zJZi|?@?i~kSCEXqvOGAP6bkof5hwc5N063kQ8D9u1Y}<(ZMDDP z7pEROA|!Mw)w@-fmFy4vLcfhoiuU*0Yf;||x+4!H$SQlvI{ zl#U|a-GOWBiW3U-3jv@N#}A5cKa%*R>=_pTy9L+)iv1JQd%k!ItAPW+Sj=+)r!Ml@ z7y!o}j~L$Dc|y^}excN87!pw9)C2m z>OwcoD=D0~6&6D(X^hK)1Xn`WE=o8^v#C0_#-EYY+hPDL-V!0Q$H;j78IIfJGbM&f z;!oH;(q)-uj-O|u8gDc+7Vz>*d78YUVNys;YNv98y|HAqezk^k0D4!0qN{DeiI#;o z(F9R+kT3H4OpezJ`COZ~_UP_`DGwZ8@Eu4{G~1w1nHr>P%y)%ihEsUa(#M})1_Ers zEHxBgRZ9VMh^zeEmZb#zwC)fjg96po!%hNoNujML!*eLOjI7~!%Hv^i0^L>+AtY@m zs`wI@o)`_73DqzxA~~*58HS2hJSnvfH7P4eH$@r-6h;y>Zw&x9MO`EGR4H9qg0-8J z@q9kDsGtbQ^tn^2f&B0OaCVmy%CxB!W-a=LIY^&`ejg0oqQYfl?t3s@hiVKf!Dw5T zgCeWhc*394nKYbWNvSDAasSE=g^aQ-<{4DP4ITnR?8gGD*sU9q_ysnm_3U3M`K&*z z%*0|mT<6cQQAPCIH02XpKqS`r%oee-fQ? zde&9)M6V$OwJ zmWq_gK-V18DoY9azwc3)s_@#d@ZK!ENPQA1zm^)!*ykX~F&ie-#1K~K;@@a)%_g*^ z1(UM%V+Ktb7Sz^&#l0n<(ejpimExc~jaE&!VMpa>gUL`zxeCJ{njyJ$ss*DTi0j0q zpMqdQv2tSUxG3q;vh!dDp;NGN2EWH{haN#+BV$V!;G-UP%x#lR($u}tFwBsO>)Z6eJgGA>j%KGFja4AnZs5bus(UOB5C4{iYV>_LqHAziKZW253{XF zuq_!}{B+v<6KQZ$yQTX#7syUwD#5HjChegl^ikJqi(2l}fnXowi@ZwO!6zeCx)g5N zaRCRtPuImrX^w%993pCnPm4w z%^CRXj%EfPSC)sfn*FGlD>2-fpXYOq94cBfqAl8CW2pG@eAdn^@F}Q)DPDw|jKx?k zCWdo_Qps`eTKrdz$AZplQv;&JcAi3>?{Q_C++@dRRkrP&M)BrS)hX;N2(IngNhC+N zFqF?2dw;Zz2!~-Z{*Z-MiGoU-H>b5=K@L=G-&ET9HNywv^~ZK-hL*c_{6ffQKf@wc z%xy!c>MID@8BcG!Gop~ z#D#0dQT{6-l+-PUwmReXrYKzJSyW$f#U)uN^vN}yLm6&0BWJh^l}xJJ^84JOx`={& zlg+@grpg(BRkF09CJID11`r463jp@aGND;D=}?OJvL7QRTEL<(98~9`MUx=aXrR@W zEWce%^*6Nw5`?QD{w93o1Voh%F zI_(rtyx4YBmJJPOr4r%8FWw0-0+JC&P`SZjp>|N=S7=t{JR80zwVt*{d=TqlBHT(g z|5_E%Dv2b6Byrh}-Frz0_P+Gfq-g>q61`njGR+l@_&CobL$kF`qiK=3X{6VNkCh^C z0B9^^gi8lJ(_(5y{IX2eNSw&J{Zl&HFx`T6N>p%-Rju&zH=Xsa4zY}WUa%+q%aI?PMji7LAcA% zWdzd$XYA55&u4$Uiku?YZkSA-@K`5^OY3`_asbFQ7pbguS<3A-kx1HDhPIaOjCX%09y*F3d7IA^Nc72apV^VIw79 z>1*ijo7(+JP@LuMNK_bA%O8?CHnGGtpri%Fg<~SAJ5rV3;s~i_8MKeJ3x5+a2AiIfxW%(}S0ShR8XbQDf{%0h2N6`(6AjlV3 z-T#wOf8`N#|Y|GI&5IaLbje?~DVA4M8HLv5qaaU=dqXj97o>d?#Tw9fIpb@h6J zj&aG<_?9(1R}1WWjl!S^C`WckP2wSOK~zkDjWLmgh53W-<$2sq9CK1ts3dt1AkjgMGc8L+C_Har?!8Sy@*qiKEPActFBpfOQI5_AXnKk1dw_riHRpLUda~6yu!TISjo%(%ShLXMeu;c@R@~i(vATWxs6>rj`Kq>rQ z&;pPrSZ7F9c|K)^_W>evQ&XU(yNkoG(!!*JP5->D(coa3i{7S&c(R8*$8=c79LMDi4rmR z4}Ejnxc)gAf);me_~XWwcF*RpmJRpq@ai9bzx}P$WctoM68|a6-c~%DLS&IXrdAjVPkwKrGS`8Z?*llh4Scp*^pyk(aEN z=J?yQza5gIG*0%)WW!9Xnql&r9<#{>h5Bb8r$a_L$Fg<2=A}%i=58XH>-SMGkdW`e zVF*wh#-=?4fS{zqdyEl718-%DkvC4Wpow8e$reig#h{D^rz|prCjd~RbcGkG7UGgT zN`^3q^qpz(h_GmDVTim%CK1%XwIxi9Fc-_^_&RoMg`fJ)wE_AC(YFAp;W$nOHe+o=iL<$TUGYhgy4;(U_*361sy+by9x|S7cxAO7{ zn`9#(fGy^RL=cT+>dyKDOn8pwNR~EU4@EWqB*pUkT?uv?r+*)QlmWM$rc3!+7u%#gXwEP6GdpA;j5nE+Qx1YwtS34P3CS( zi|9rnUi3N0)pmQKOxG`J{$}B4ug{zl@z@U}N_AyQ0f5O2dns^^1$9LV2NrSNLV{?v z%hbP@X(bW+DWUVc1C0pb%EOW9P0e3@ntX+4!y}%X7Y1(7h-Lb z!y{(nl85>PNnYAOf(JkgpY(?ORHpKnTlY9wn}2+c-IQ!zv|wpK2R+yHw)LJiCB;A7 zZabS!u!s{TuHnGS(POHEcr0B4>Hq+GbRK@fQ)e+%&&|n=g*eM2cjL2aAydrCn8J)k z@B>!K(9}1Q8GTbSBjD-iP6~rqJ(1h^SE0u$iF)f&c318=G(q>^YKHye0UfJiIJ(~M zSq*=Nu{EUv3I^>$pCNYqJz3$oXDU{s6we}D2rZf&_dQs=XL3;+XiYmh8Tb{{0b`FB zINTeIR+2E1u2YPt`gN^bVf#{>!ZV+RmUN*4?ema8{H3XQCs)kK&Zig*TFkZ>&iY1O z6byDBu_bV3b1MC4i5fmlSIOt=)d^$c(MZhlMbop^GmG@p_LdG6$CM8-W{m>+D=h<2 z%_MWbzEzIBQ8lHD?i62P39NbOOboZdo28VfGx;o>WMIx>C^u_!>_4nMO9>y;=RdNI zF!h?bTJg98TETyoWS(3N*!~!TK6lJ2pTV9=38c`3lZh6RK0cj2#l+Kg$KkMDksc2z zv#_164O^9(Hiz(E^tf#a4*HY#wVt9}O2DyoM>yxRsM}6((`VG+452sgNs8gy&`&5+ zk+{2ye049rmh|9Q(SnBL$FfVesyHmQwa8+O2nFCx42E`915L6vmpwgwPh3Md>@4|T zR?Hc4voE<^`;6)D@|$mn6+RdyHBVSZD@wW|InN?ovOR8pYctM_v}H|{~301DI1r8%IyjI znx?ND^wP0WJo`hyudMnFojxX2!hZS_w!U$87L!j*bg~ZZp!s0I-t0-M=`U2w4IuM{6x-f(P${L0AW^{QD)A$|sg?NjJ1MS)h+ zOLR1KYY1BAQ~7_hEB}fph2#t^{r-uCb}M{uY5AcDmr|MUc744o>GyiKSpBoDg7D1V zE*$($C-8b%g@0~o!>PPYlrNkc4Vhom_pv|}0~?vFjBURGh;$1mmiFCZRwymfU&*;C zf--spuh{?Uj|N5a{u~P06Dgn#M1-3&7R?##zUce11nBR-`4TI3=M>30Py#`QSVn#> zpVg+EobIwobb?8Inu}Q;7~oIyytm=}A8v+nEbmf#nP$c*20jc6o1;Of-hYiC=+Pnc zt}ebZ3P~DDu+3Kn)oW21T>HR^X7kK-Qq>5*#QC|&y|3Q89_6%q%0zV&aOyvxmd4}i8oAl3v9n)M|2_h~489Koit5yj z+TtpMQkXZ%)rECMn5NVe>Oo?*Qn}kFdxPkt*rK%>P+Q4a%C`vm)dl;Jvb5Tb7qy!H zQ|Cr+ct~bikys>FeIJu5Lx${{v!ae7nw=U@Ghee<)7)tn!<2|+7TFo5o!C$5FT18NPbkuIwznreM1gzON=PugGENO zD1UX@!dZJ?=zB@>mPqb16`5sh41gMFqfgxv9JbwN46P5YT(b;@%*+(bIqa#0(Z$J= znXT4^0zpd-uI3+E)fHPqS082!EKzaS_AOI#mDkR5b~9Oyc4#pWHF1n7;%7`8Bo}H8 zaWSBU*N0-JpjKz!+}$@r!`QYtl~(n7@Q+3LYH-rmDtx+a^sd}Q5Ui^1KeVh4^o zXSO`tbYx;!>7R#GJ`&OQK|gSkWF%Fw_$Lpn4Ns%KaoT`5-SN!I)b;G9g=>i%lkE8?M!#9&vpdVez{{m6J9%`;T@Daxh|2&mHwAch%m$X;hpESPeCsLXiSJGGeYNYMO7B zVreo>s3O>shORiOTua7~lt|X@1adLLvb}2Rp$gf%s?>|zlOJvz%fMygmZ;cN6gl@S zp&EPqo*Z%&NhmsAflznwygtGEwdQcx0v(vdrUeYFJrdOKgF!q^%wlr5OY$ndNzZz4 zq-xj7$HB1ZO%NCaHFVBoY%Lr?e25mGSVsZlTdjubX$T8B<*_j_1z3p))hnxw17GUK z(8{*Fbb%|ZyLwUskgS|J1>%S0_1a&_YzN>@(4vO1{5W(4Ja7p`4|of|VwZwL%z;fG zt}#VDw#PgGyl0z(FroN`SenQNo9(3KI2?(pS|h#=0~fTbFxRi=*eN+FQbTep*Of2f zJor$2l626Q_(EE}q)iY+Bw{QxMP%A3LZwRKgAl{^BWj7*)5Ln0ba@ILNdyM^3`>Zc zf!6wu4OCQAMZ4o3egV%U~O=oTIsRE;D+2B)J| z^vs$5ON7DQ5GaJNKAN|BcGn)7dAYLt?=#J*)_z|yv1NI{wZj%9$1`*_z!EJ$A;V8}-+d`Rm z$JREII*Ep?6;uW;OSVRou>Sg7x)&U2<1rEypHj+_gsr;n^NAFg=olD+1$|36MSGbg zIE2Y#2_3ef$ZIwqz&tht(Bwmav88&54^;VlEKvT+^B9()!N{AEPdmoDpE0Dg2TTq% zYQ@W?%97*I*f(;>iGkf{`Z^j75aOO=*AW%{LOrDr%`tl0S`E=LR+)L+r|#Q1dC1+8 zht&dGX8IH(K;#_+AOtF`vjtBi8u?dG!1u_c7nkk^70v+hZbhc?fac;(4q#(TOPA%n z60C*2bfb*}6qsu2{xz$7e+Vp;Q#Pt$d$?RblxUwgxaPAsDmeSVt`E21AGu*&^o=fe z?V<7TEU~vCRGe*Cjg7gcH&K^8#ySlX)w<00@nf6T(DS^pCxG*${;<=TEH#)clTKZ; zV!Rw{_h&hnSpfMmXaD0s1KLTV&JT?W$V}U+%DL&|b~kFj&lGRP(x^CSX=!%`wl1vm zRE?lQVIc;F5(K6W5|rMV1Aau9i@s+^17ab+j;FfQHHODs7z8+a#EmZCiKti<6#VV9 z-uO2kl|Z(YrNIs7;UBa`?&&6A8shw$%5@X*qxFrIe#@E7U>9vJe0@*H`Bi!Nd<6HxfbW8Lb= zBN6QvfG?Da8mq4y3gm(44Hu#87kmLEtD(bR#gJ)mxY)Y>Ut}1tvC!hLKB)Xp?1@fv zolzW#DVcrlmW{u7H~sGo;&!&5$24HSeV=GfjB?Mf2jsqJ5z17o+`A7~=*>@IBX;H# zSw-d3o^Nij>l$2v9j;kFC# zT6c2omiL@v0f=oHBT`xDo6eOJq^c$8InI2*sU>$Q3Nd1ca=7+k4s{01Om~BONRM^| zb8;t-2l?7zl6~H?>1$2wjV&sm565YPDB%42EeFR1*aSHQ()70ABR8?))2PNlk{qpv5^E34mK3D$T zf*v!7$s5*)*#A~_np$|>eLjpb4Mb*)NtW+-E$a<92RQ`YRq@B@-vM2UE*ZH-kgETA z{bJB8L9h%y-R)-4=p#YI`*6a36-L|>cz?NpA>FB{OiNj8xd-G5^(w9jk&iI8d!$EIX^HV2$RTa{w2>>U~=a{^o{oUtCw;wqna!BeRXNcy_-T z*l#K($b#iUU}3`ew8tD+xoDj6VKPntVx*@hlU45g{K(gU4 zN?fXjRey_Pbb$orO^>7l@M7?=lA&s-o_Sez=hcHvAwCb@D$&;C-YNjG-o^unB_qHz zaYbulT0pZ;gnlKOfuxT8{mqTsv~W08OP6-ST%^oeIu5TinpQcLDoroPrYy4vW#qW= zCE28^ZNz$lC;wsfc54FwH%+eos=5H6ZKlI)Tq{Bh(*zd;xU#FJNv6qTv%L^xAr%Yy zwB$5YtU?-l*_FH)rY;(KJ2?akznwU4+uRm6Ag26j8vKO2X!ymUHX$U`f&c9hUojhh!0+PgmW`Q8SLca|CAcJK zQ#c#i(duqBiI^_bvuNOzOLQ}gu6*c}qDQx=?-u9S|8!jK(Tqs>2Tj*=*<#+bt8d9P zrgAT2FZ@>0W?V%pl?lGO{u&VOZ17bLsmfaB98N=+(c-0Rm`K}Nx4Q&hE{9r)FfyY4 zGy|ILN|`0(GW9nQOVGW;f`z+GKi9>CiEwM8xIR+xa zl%e_tmEc%aYoRt*vz_`fukZ)GA|nS?jed?`8|kZuC3aP9+Sj%&%$?~&zOe?dKPJAt z0>*LGd_1B2zG%chgMdxFIN?{nLtt73P8-?U0I5wGAGtS>t3Y3o(r(p0 zY`BLfx`|~?B5r|wgAp3%SjdV>}-`Iynq9pXVTNYvb$>h_uv_|Jc2}da8o`szDODJDTYjmUw zxr8Z67^#P$c^k+G43rgDBJ9msHQ$a*1R-cvp$_5C|8Nb~uxCxQtXEA?bZhmS8KBv+NV} zUt)N6X1}6P8Cb~x?SEfbt|pX@=?TS+W%P8RaJRL``#n@~pm^9q$6?6c9)AXE3Bz0H zMk)NN-gyHobMqw18-M-kLA%YeCxiW5o~KJB>@g=11=V?^oYyxJln8@gImg?yokg?Jx7&*e8RH+ zbBIwi5Bz|$*${1_0QK@Q8YU4LP$&_=%JO zZNN4eT}+w)ju((V{m_LL8;W-;U-`uaB7{1M|F6udu6it{&!u5xgQIhDINK~SqnD(@ z?sgsw`4xYA+LhgPQ>}#0hK>?A=f`Y}%JTeh8DuPfHV9>WJ2`1BxnmXmj)G$M*{)v3 zMAs*3dhXTd2s99zKsaLuE6l@Rm7SzvaI23D}G| zGLBExGo|e)hrH5$P9F6}wd5?fzy>SM+o#|4W59TRVCA`Weh%h%6?99)NrgH@MJV6r zDnN8zeZA1WfYm?(Z*QSnwAe6~E@=Odod5eWu%qgP&8dNWcJ%|VpS|5zdqL4f0HAup zBa?dx_0ZwNist$L{D&VR6~O9RdtFobr?9tNKtkx-{r-AP7&P&b5xN@efA)m(#RpQt z-u3r@yLgd3lnOsIk&3DUb0@0ZD!fAi<>{HtO8;Gx{;hEQ6ty?NY*%QBKpBCZ$rBOn zEJ%UIkR9q$q2F#K?E^(u-6C^N?S2$A>}CN)2FqrXgp>j0Bk=$9a;4!=wr@XDiDB&f zk|m9OOW6sNlHFKCMu_mBvh|QKLycX?Rx#F)T|^NxlU>%4Ja!Y3$d+yNUib5Vzr62p zykFmM9LF5@+;iX8b)LWLx18JV7@y+mf9S<(C9?JRWdX#>9^j7QM<>f!nY8sL9||xd zYs*siOnJ&w(l54QWz~QdC`Z*cyo}P#UR)1f|GV9@uQ}gjI_9TdUaAozt+~)B2xvJ8 zlR^CFtz=o@6^Vkw1iwv(*m>ixwmLmeRuEd6AgQ)%LBM+xRVp zxNwD~!ootYQ1ayow`V8PHMhTColnm2N@IMPf1xwatxLsBefGUhLOAfN;idG#?iDh{ z*q>%R8I%L%q%=4~7uP@hcBYz40F$rDIGP|5aR}&$g7MTl0(x2PL_)*;7m}eX_&B+; zrMwr51D)A@y`b0?gwA;-owX4H@$7BhOOO+UrUP~FW|q?VC9Q2&mO)pQD?usWKH#0W zokQ}ON7fv=+~EuG4z-VQm%g344Lw%2A!V_SjVZ6|JT5a81JG6c^MzTRq? zqMiMR+@j~;NQ!~#4t_7VHmKJ`fVA2Ds6_hS!Y2^zBPCq=ia4B%_(LtwtnjMI4%~gZ zrOi-o(!cAWvv}pH-dQe+2yUJy2_JF}_H?tFc>S5gn1Iv+bhFu!r3Hs>+8IgQSm7jw zq=u{0l9q36M8F$+;QinKleb2+*%0}9)?$KsB1>@x~liOZVxnXi z2xk2?j=fMEqg?b}VguPh`mi5oUXDb!lMjfT$#WtX{R643Kx8whw2)ar7@SYpisla& zF?efn&Ghc~UEwkP6IU~Pu9wxDDPsQbkL*4X?gCjDnM+eI zrDW&$M}7ZZYp^xQ5<@(wF*n|j_Yf6xaD`k17i^VZw zQU}D5^cZE`bi6Z=MmH*Y5E+3Sy>hq+%Rj`9(Pl6Bq_MdJ!fK%V22D!$^AHerk(Qh9 ztjD)jAZQ!j268(@y~!r_O#?Zog7hg#xJsYv(M3KsTvR!)6zACIY6i(0itrCy>?c>N z+FD~ozOZ0K_>Ft3wfV=<54FQk-%4CVNXbd+8_zi{T1z@FIoxS_5-*^pRB#?Z?g`o> z46M@u8@t?Ya;%u9wUm3m18nDlu!NOrc84kmRNXIB4mihU34xIZs$UAf#7p&pVXNV4gy9`Q zg(O?VYi>|kCFHU#25wFv?j8N@sM8Ver=jP0MwBqtOlZ&X{?7PzZQddH-podk2t+>- z4^f+C0c5F!&g)tIabV4uKz&RMzTK?APvW=?zxHN>-~$ z!&pHL`Oy)%%Khe}-_L>VH=S$n4M;-<;(E`iV6ms}?NgqwR%Ad~nW7yK)KQVLtef&U zbdi!{i-`q^lS7j$MUw|D11!KHe5@*1tk~NPli(7lad)Qx)>2mHYiYk-4U8#krv>Eh zz=@<;<9Kg@aaFQ~)#r6=*088#$6E{jxWwPSV*myrWL@Mf9bb3gjVBsq;A(ScN^^0Q5LU$Xtu78-zCzlk z3U45Czy2&bwY?~qrPR$|@|c14Oz5nSr-xI_{CtaElv%)V_J;YdeR_)xcej?cw~PSU z+)Cb{+c~S)+xa_gZvc3ZDk2~)j4K2uoSi1An&$GkysA|_7cf}|P7k9R{UG+kXY}#RO8BqHAz?(yP=TR$NHkq{40U(X><(&+aCtzQrtNDi?83y1 zr>9AQC%?td`oDo8@%zF&39Ax6e}4tE@m__5F>#vchjooOE!T{vpH%^MAWdB?dLifW zrSpPR9}fNDBD;`6G1)?B|Fdzn;P_0qYPs44+&)0%jBM{6tj^mo1l&d_RT41X1t08? z$hrqMm3^rq!pe<^Hk&AU*ey;nYRCXN^lPssB-Ew5d0T=u-P+;9gj0VNpEr(2s@1wa zq-vW!#tpcxbu!ogAx0YYaDmg87 ziLQ>T?s^7MaFLY|qP5}U~FO;c8G&@x_3mT(ibg(kkI)hqN+z};Ah=s$S zNtg`ZFQ}-dT?cUXqXEs)Bgyg|pji+=jp5Ive@sm8!w>pcoIZ7`O;{;lo~ZEXXwM&{ z)XQiM6!9A_!cn&WExc6K%QY{HHaIRD2tBZJjLxs-`8E~MDL4nB!;HrCE{eYzk2ZUy zgJ%I%#&s?Lnb+I==lC$)a44o|Ln3uV@EvgdJm}UbNR7QeRBqHL67`u-lh?w(SsPL*YkQ_oRSr`x567f;aB`RmE8zzQusx^ zv#d)bHC7Iu`fV6hD0Gq4+8JVORp&75D0C4)o98*2=z)(E`38F88=tQ*Eg(HO8-k0* zF%u(S*gBGHUSqK{%P)ebYn-Ug1DacXcO?~B&BgnUi!ub=Uf+aphG%K=j=0B@jTvcACf;Iryx)0Hbzq3@ie_HxnSx$zRGx zW8DvPWVvtp)ST%44n8+kk+}{uC{5aQlml4cR?t+Au~hVv3I>T9QQj%K~_TJ2%s90xgG+=~ap*8?dV*1mwt<;%rUlwFDRTHL>^5H(OvLjbfb^~u=J{g@!Ijqdau z!6ub)al2KuJyLUbbPnx{T|R59Yce66d>h6_U!5wVLWzYZtMk$){v#SLHpUY56NI!J z?tHOv4y9zw2(k5IZ|BU7Wh&lg5M0{NdA!bS!G??y6}{9;M+zKJTcXpJcP)k&^)#jc zbFf*${QKRn-ULXV0I_?&<=|%mf4VQcD%~OVi4Lt_b!r1Wvpluoe%R{GnPG1a&y{)l zZ6)ZpKj5)pZ_fZD9gJR&UNp${YZ$ZPW707fOcZ831)>4mF>$~?JZ$&IJ;T1(<2P_4 z=9%t75>wrejR;on7^E6?dn6W``LR)#myJ7$6&pPHud4IL&m3iEMOVnx4Fm-~@~w#Q zog~h+-@c#%ZkW-<^!-3L1}}qI7A#Mamy}n^Ww@c5n)vvpL;tUpFV0H3 z8>}jcAssxKQ%AkGj`6to!6zq~Rdw%ZXawm&Gy@)@8HkDQr=NL-*J`pbnfb3kd>LSn z1YfKP5R3O-3qYnh_OjP+(F$8wG40v z|KrnuJD6C1G?u9A4#n6eDz{>QuJsg@{OKRTZFddxYQguH`HY7W1S6-R-s891a;rhi z+#c#S_T$uFNf9uOwfbkpuBJJs?>9inGz>t;$YZHg+DnIrVDQ9rRjb6SL%r26S#(L)K!XISyz(R$%5z0Nq2*NTcGL#dR+J+TdkFlQyi&)?I4VHa?zIu|jyI zT@QD(0k6JE7q6Yl3}r{$;j4B~88Ur#!W3LZCGamW_Tk@1^@y>uNq^9vIeHjSnD^Va zfrGkqB_2`{+=C#BAZM3Vtvv6CXoLpJaj`PWI6e308#+B3w!M_Rq%gZGprAhXV8J%g zsw-Bs$iDr8M{m6Zkn4nntlh_?Ww59iXw&QKyGY;+^-8*1f8tEWD5&ZRR70yay+sy$*KqEya3K5a2;7iu zKryXUSR2giZU(d;M~@*Lme|cSErOq&P0tsj6$>=_md{UpC8j|9mw3p>`j$9hk-{BM zRXYXlUtBXiasxys{o-Gp2U#GBo*rC%&Fc*q>;Q3((u?Q+@hnI{4WYHNlC2n56VMm- zXGEHG_cN7h@5zWz^8S+1YT`n3bfA-b0Eo@PM>mwDkG(##uLETmQPZsOT?I|>a3`@- z$&J+rH}OgscTTtabEo3PGVq=nxT1L$4pyti=iKWS9M+=iX_33rf3HiH!!t%_j(0Eb zn9Y^kJ)a!UJd%JI0_kqr<`SA1eWR1_(n!&?Jv+ZLi{L%jSdZ=v3js zC`E5inIT|tD6+&jfdLrTU$<6G1HoARpMt4RajGN^E5vhG<+m%Xuey``>0*Rv(`_AK z?|ANt02{++4%-M$uDMft1ARUC;|Y%(*^1`xWi(1-$Mid*F!+`p6`G_p$P;OFP(R#@ zKFxIJqP`p*iDbSCS@U>5O(a*xW06{_v#eppgVQ+*FiO$^8vB=FW~7@ZPF`9bnfr8K z>3H&A7lWUd;(I=|dv4$2iD|`o@SvD@`5HuAu%Ka!R zba;ylk&H=nKcyFkDh4QCm*;duC^{1?FICzEV6Z4673E(`1_Y0CUDJc;BV{ZW8wgH$ zu{I*i06ihQbl z9>zmjH3rIyuF7!OPR|>0a#4Kfy*e*CC|wkvF1v;f=mQ|81V``P=LTG`48*&N&$1Yl zlS4&bGQ0z8_CeOMK01Rngq^h&<_|XO*+`Ls`sI350EN?L!W4N{6KqqyKcmY$qKg2_ zM)s{E-vQd!Rv(^86+5v5sx&O@807amJ#{@DxC3m!7#2oo42$Z)azUU(08l^C&z*vX z>?-Pg3U*Y+9j)GIXiGl?G9m$p>Qx5S2|b5Fkm=(b*^pu&lidV{8W}#lFXf{#Nt%B> zabaLz6$Hst0p7`8+ZQe{OiEN5jq5nbow43J#IT!w+!8)NYtC z&2$9owgrA_p+~w(fbuLidqGm3>t-6dJcC=umIKK}smoOzLs=oSIQx5U0s2N|saCM$ z<-@xil-GwuZmyY-1*S>h9C7IqHShL=KSgm<@T`k?7KhW;^H!o|M_{|3z5OZP!ec4& z;p#?c3Ia|oEHSQL0#bASgxFppTbrH6CUA|fjMKQcv3M>CJc<_^l!a_fG(xz@3Pyw2 z#vYZOhN^JcFfba4$)H}@2OJIrBEO58+ZS0ob$y^ft5=vVCQYnWM|TgJ;$_YRDzbIK ztM};J=Lub%7 literal 0 HcmV?d00001 diff --git a/modules/manage/assets/images/manage-security/encryption-at-rest-page.png b/modules/manage/assets/images/manage-security/encryption-at-rest-page.png new file mode 100644 index 0000000000000000000000000000000000000000..d854d02e81d6434bf8123b2ce1a280967f47f3c7 GIT binary patch literal 131978 zcmaHT1yo#1wl?lAjk^XKClK7-Ndk?#ySux)yNA%YOCY#wf?IHcyUWj=_wLMnb7y|m zI;*RzYJa<`_O9A;s)4kuRszZQ#t67jDFoA$Ts%8w=hV|MbfL`5Z%CH;$F9cY79Kc>=D`@mppE>ho2_Kb6!{Y%xL%E zAR+-$zzKg`h#{OES<0tx_zvfYC{GB&5G2Y0*!hkvJcerS?ySN#o-Y;Ox?uAo?%Q^P z=em4f^%N2YCpVxVLW;7-MmJ0gz41xNS`B5GA%+Bh+SSmj^LMMOl*&!PsQB`C2flmx z&^??KO`$X(F5zA@2H`KfYflXYF;uTCL>0#<>@tM?9u(y+ia7#H-)?4Vdaf)OS@({R zO436#FXM@hq+5?O$t06FR(RlJqdZ}^R65nfFW|jU+?Jn~X{fU&I<|BCM;b^>?Ds`x zHy;ETr3VVPr)n$!7qnY+Jf8_M1jbj0PlGKchQp1OIO4XjsecS3pyux46yyOV(??@7 zO?_kSwmIeMD2*RWr8_i!j3tb1lPkof-haHe&hYiM{B*>*hiD{f(pn+~H{Rzy`h;Z> z3?2gQfM`CaldB}c16q1c)F*Yi#Aov26B_G54zFPY64g$t`m=G zCJ@s4FFBq}Ua~u+7niiJ94El2X*mXjbgbT)kjUbJ=FY6bAI_kf_W7Jgc338I===EO zI>ae)ig(#T`&L^V3zSu}z|hLZN@xgdJGTSNj+k`sr1+6@0=+rKE7>lo_0a(WJx5rG zV+n{at2yTcw$T2X2*O%;>I}nK7Y4L~HU7abv{M1RQ;=}qaX^I`JW%St5WPjn5ujDb zNr4dB@ks0eFhD3+eO!7d8hz*m6iZ=&1;`u!=U?RJ@KW9H>;c*^>fH+V=qUaMXHe0B zxBA3^6@#D*`$Fy+PSYdak-$m~DI-EX0M4T8#Z$q>2i9NNyV&F08-+ zA73t-kro0wX2YxUkUe6y zX1qbUp>@T7Bn|5=|0Qp)*aD%=&y3oPqaL{&Y1N(6cfAp6Z{*IeOJWz`)*H6LbEoZ% z*-6-i?g!Xe@C`saiMl$?UDP0bgy~O zb#HZ1{YCsMW{QN4@OYV;D!NLwvK|8lZZvKO?gyk%TuaJ-yT7{%FSkv;8RE;H{uyKM=uBK_G>0c(|EC1K7q zyHwyJV7MDPSzPIBti2g*<1^z;nL6*o#!1FL zj$4gagT4b|0iscr0H6Ar`fRfZ)AwTs&D2_Tz)N5j5WeygIIvPpt5NG)rp*UFgPVax zf%+~DK9Cvcw4u|i$QawaeyQ}wZcJq>(|pt1O(;qK#H4MAPS~oI7qVC9GuPuX8fO?r zSR?`^Oeh}6Q0aO@Fs5Me6nI#Sbk_|ev!BLHZ0eX)@ zPkpanR#X;|V6*E<5<*sZV0f;y=627}w}jK8j>3_`6NxNIxuSN%FKiKPF>GXpK8B-4 z@SCQCOi}Il)tD^Nr_$f)`lyd&@w4{$>@GVt#KZau`?M|B5k`9zzK3LU3DOLkK0z-WnO7ZNpcxKb_*gGqNJ*T zD&t2zq;Dbbd*&@5Ev_xdW_oAb%KRq7$IXYSjcH9tG2cbZNUUn`YDCpP^Z_<0&xM=h zZg!7UWa5q0(ULiY%Ba#}xn$CcOJ~T6gFH?=8a>GH`hmO+ActD>^Aeg}xj80}%+s{j zQPnZklbI^0Z-Jj-gGNE4O)O!lbS$Tu1~rBD{b#bTDPC#`Y9-Ze9ZQ}r_XloPhV#w< zOS~!|@k94(SSjT_rHsm}=6vI|kfATm%R>8vtm`yH_?QLe_%tPGKiYc{$q_ueHwCeMHw!0*(6 zufM*=TJ|2G&gxmJTG`Hd&NltDn60dMtVwCUUgDax8NXh-rn%1Z1H5>9wZGmp!EJ?( zkhG9^@Z}ywFD_mpU#1P{5Vp&@`m8c73DnRTD!CPXG}_Xw{AQwHpVVMsthd=&@#u5o z#;L_+XQyKEjt2rw8lC_3{qK1#_#iY_5<^l;L2Kuhs+2j+6}Uzw3nCjO8?ycI(|tZH z_u`5ljrG^u73;2KvwWIf^7o)chne%9t#zgCJbb=)g7+86zkVvu_f&b6Z7Htr=Ps{$ z(e976*87?%-PU+2W;^k@U3HA!Q{koKEwS+GTDNc8mtWWQ?#$^9t~D_#s`FOy>Kz|t z{cwBA9BlkJ?^Bict-I6V+;o4uQ){}}_LlAjePwsm*OhK-;;`MrZSb_RBkr5tlkkSf zj#yG>GTZ?N|O_dDD2QHP!sM&e7$E=R}=7tOg+hpPdNxJ!=(0c@r|f zz=y|T?US8=#njK&02!#)h_Z)M87CNhDIo|IIY@*~6k!)sh=DJH?=k)D84lcFYjSd| zhy%d66VMl`FW_bMc=E16&fMiS+ z6d)Mh$_NmUVHOZDZzagLhw$xzfPhX6g@Awi#Cm(g^P&E1h3U`%yYs#kZA_dE z$lYzMZJl`C1t|Z~gZHicM>Pv2`9HciTM1Bt6qL!u>>N$VxtLj*St$jP$jQn19gR(S zRmCO$m;CLU0HwLJvpp{hi<_Gpvl|Dqoue5G8xIc;3oAPdJ3G@`4<;uMTW14zCR-<} z{{i_EN8H58$kD>y*}~42{103MLpv8|0ZPh082$6_f5vIzZt*Wpwod;$t+xrX{L#X~ z#>~p{PwY2R{y%DYl`Y&&tTn_fY~GgVjfWr?4=eva`v0xvUmX8J3Hlc$8#^1%UrGPc z^zWpfolG3X>}=k6It%_wH2+Kd*T(-PVH{^|5@jM)V?jWAQC^zKZPcUWV8Qy z1Oh@BLPlKVlRM;54y-rHVC#*PzNu+=@7UOwJnF|RTAR$9-8J@7`DTSKE`^z_QVi4G zJ`p+#{7lYY=_DNWOd9KtWFFhIp10WoGYQVr0;iLMd*%kNH;aoIZn+)>N2OV|UwIC} z_1WSG2#^%yFv0#97*L|Z|MyFS35@AP_V1C3uV1wl6cn^Nl~%LPU^b^*S%I{FG*0p&ib@BW6G5rbk#^gJdvaXH}6aD`W zs$Dq00}KZ1tbDOm{lAm@3y?5^JG=ZM^(@BUkt*>58m;EJS}tOEn!E9A3a|%bi1yYz z4=W4xe0Ik&P9o@X?W6Emm^~MdYroUTrMmN*jipahH?J>nv7nX6kjm8q4(eq_c)=QM z^ZkE^mk`rmtTQ?JT2bX_*LiQ+Z4yhuH>cw?{=TYqTeus~wg6l3?icj!@3K6=^TFlb z+`W2Dael=*0cm@#Idl4Q*^H{6x z7VnD1&&-#dYM0<3lNafHFC_YeKw7=YD7n)%?5D-H}-gMAOh^x z6WKf`Ic{qXvQ4Sz0>?^Xzt&%0nh$46qKLSx)9vIe1{?csin;X61r&L9aNPC_!T_F` zbnr=Q8-d6p4x*Yu30ujotrhH@P*cn*Qwqp`Q}axOfW>;Vc8|;5*3T7ct+@hTZ7M~Q zJmA(un2K19dei%bkDy!>GQkytkUIMfQTXl}&udF=hfQ%m%QD5Bm8k+T0gI4ph4oG! zood~0PxmbuF{A>#zp-qW8Z2_30>7m5xmER!C-PGKJa3%Wz3ie>%01$BJ=*vC$i-}> z9d|eo;u8g6a-@=qmH*a!$HVl@4N}SzT-}=Q^7G?%Kl}BQ;aol(8IDvRV&Wb~+v7wZ zs;aL`vqnGQaK1W^h}}5+@NEd4lm|CTnViE4IlPT0rwwGut)tBCEh8f%4Pu!le8vX@ zM0Q8tukZKr+!)oX1+z@t*#ppT{<+{D+;&P5}XF|3iV>Llou$IWSO$9s7u5lK%&` zQ2{w^2}{RW;NyJP%g&yee1pSBV|Je&M7kC&+t&WP(Us$u$J5&~HW`7fXpX1t=UBcI zdw5d!{AHWw)u-a?46|H^y*Dj`gFz35GC6Mep_ohmJ>~fMcHK=~+aZJ{2_y}}B1P(R zrSdxNSC;47wng}O(q6r6RsHRtDU1wV;3}SupSkmHv!>j*%L8pPv;7@tiyi(RvML^p zF2`B*TPxdR3pdzyYlT>~o z55p2TPl>?W*jsnq|Yk5#WM>eH173vLJBw9Xb{qD$gF& zaWTRei=K3@4kWhIm*(tvg*2Q<2&QC5rP-`1FNff&C}|3#c9$5iqiI2 z9Ks_!?@hj3=h{QyG+obOY^N4o$*p)cMBmeIw_N1CcH8U(&Kz;EyIQrUh%cY>%4o|BcxF+Jw8Y??CY$Z8k@KWtov zuy}XdjjF@hKsoO9q6^6jB%8S$)eg>inU=$IZ=kWF0OIXYi^fG0Y-Eh_MfNEYCj=j@ zl_pe~q`T-biK-7)-PVsIh-$)y5Kkvu=5_Xl*QgX9jbhSQtJ~!o5Jqwe3Pz71E$#~Mz;2QTqa`P6hVk37y@)G)} zTVz#+yea0Jb-!0$ZUtaj3xN7#gAR2HbV1|}h&->=ZH=u;FWi67qAX{3vLyOTyH#o@ z^?YLuxYs8^kQT#$SjeysVZGEt(4j8nF|cpd=XUj5Kamf}y{fgUzf;w&TF~EjE^FAW zeu?Ej_*BCP`jBEk@=d#q8yuKhTCg%w&WEteq|S^!BMrc2lmp6qw`PbBDrPu-c&OXD zPxIREc!L%VSmbn1KDje=ZKW++-4?kE?er)302HwnZo`iu=#xmInEdq!Y5@)b#A1cT z=1=LxT}cR`suVq6SZpAzO3jI=25^dT=L}T3MG*t6BS!a=-Q9@cJ+N^{b~8jjT@V)q zhT!$I$4j`+Ic#`NyJD_Su6Gb&*t)HGlr?wA^3slSElE6)CQis5$|c64E{6w&1~=g~ zh1r~m7K}^X9=B}8P75JF=!_gUniL)2!W5wa{_aPT!jLPhd0#4oSy7%y_L21j!XhWr zI|Mi4Vy(_CwD*lf%eq?Lln-7?GunqK5}=V&$UFPttV|^$|uPn{4xuQDzz0mr+Ok9kn-nu0vcFE{vEEv&mfeLemRdDZ)IuK927aK1Exa3Y2k z{Ak{<)Zq76FbK6CHB(4fv_}+z$_s1hb|c1=FK?rtg}p%Q1I+{r9X8shct2my3)BWY zlADM|(rDZoGu5}o83pD^d_bcNg4o|6=%18ZCKW)Vq+-UP<3IgEr2Ukx?I*^nkD8Lq z#5V7t(2A}u3f@65C9^YXcvcd;?`z+9JN#Tb34bA@c_UFo&*bV+m{4!T?`Y8G;5Gf> zYOS?l-zu$PZl)MW$kauH6F-HCJ|t?-2Z+NQazb&J3((He&A*?yNip(Mzo( zazs%xz$h}_mbXNQY1vB`4s|&FCD$Ikh2bYfsG67h0bZ2Z*nfMKh|d)~d9sv#+ZO+} zVFkjzzg%%(l&erw5mu$eSnN$-B>JXldNI*`gk&lBPcctq5CpaywQawscEOj=_=Cc% z20THJ6x+g?!V|)U#*O4u%M{r92#nf4?SmrWCKTHh(=jHqxLM9IfIZ|7^lAA!(|5`d zbPY2x`u&$wS_Vcio2<;BBMOj8BW!?tfq<|(HKxG|6*ay?g($dD7$c#8lR0^Ii3TJm zxz&UFfEFY|;e$9>rW15$0rCuK8mtxR;o59(#4Cr1Hq7X3#G7)?`&%Rwpp76bDuSd> zA}UWEPEUL1O`gRni_qf$Pi*h+b=D2PdfdEz!Zd8p(Mt(~OmIUX|0$zE@bRcVHh(VO z5JR^WrZ94=b|K))(59?pG@Eq3!`8q(NdKvHB4C>w;`XDGz)r5mE`gl^R$%hpS1GF% z_;O*uw?C|@5K9d;GwwEA#w|J9@L8JD5JvbYF>`6(C}q%gMRn%^Q@CjAh_^}dgD-;6 zl5@?2>{ph%Z)ZKoYrIFlg3xaWcxwwi?|0ICmJ3%mRAn{J$C6}rQf8XoysM?bxlNs4 zK4E86y5!oU`_kKsY~14b@0$8~8q z3AT?qFu(0?GphHb&u*muGqNgE1uWh*`4mr*M_>Te+r%w&$Ze$ApniXZ4-9TLp;#mO zAhzlKbUx_P9I2%TVB}N$aKD`-u;KLPTF&+(2I2RHG*u#;#09~jUgR}+ZRYr&Q6@mc zuuvbK50afmd=6I+oUBK+YQ3BkTG#Qpp0$ujS#ce*I)OxPC2yh3b>EB-yfj~!i+5|8 zdQ<85?sgQ@9=diN=b_EwB_|D+z&_iSxTZ55*SFJSp1;=7kK1kdAtj>8-lz@!-`CUv45okrf4x)@unTs)tK#ux$d1^KK@My{~1(WW6BfB9}0;79M9iq0uZ1Y6E3YRDYIlx&C1YrYzI|zRsmvdEiVELI(bzoRc2{O z^VMD@hpXeZ-3MLz9*tRD4I@mtD#rj|g`?B)E&LDl7PnHMQ^i-=#}`?2hgs?W5T^WN zp>41sl|oZK|Dx5~waWr1>M+ z{4}^HQ?$*6!Oe_t+I5E6XC5eHNu|KBt$nG!0+IEi{!O>U(1@yf02 zbZye5X+eLSLVGX!+hhAyjC;GoiniP2;bqoVU0dki?B|~;C}CtOWer_hm`}(F1~9#^ z_vKV81JHcU2q-WcuNM?SE4o>(ZbBVqnOaSG%NPsR6#Uf8D_+1tVVRwvhSSkXl2mn_0FKGuEQd5o4e4ms=}oD zX?#!eVJs=;ozx!EKgIp;a!RI!+A%Sals&hA=8gY1hl;nmK2}{I8qPoDbpW0E*S-W5B0} z4aDBeJBEHHU-9+W6Dc}0JKSv@hg0p6|F+@sk13TqU5}S&yV~uD1%6)tR$JVje|H1x zO1L_n)3xqzh*xp(r-1%7)ITSoi4bs+N$Z*rth{7aPs-%%71MRJceB4Y#QE<3Gu&qc zP74U1%?rQdvl;aCyhFCc>x()uxEbYMoA~}>OyIGRfOvALqU&)( z;78_>Z+LlA8Ky?ic$<}fs|niCbob{4ql_-_$hel~&h9ci`^oXUQJw3hOxlVtBwI2B zYs>AERIxVBeN()uFRqh*EiEE@2gP$C!fz+s$^cPq zEC+uExexRS^p4m(1kM_KEb7WgI;vCQc1u=JzFBH$@1^0$1F}Q@pR?L0Zyd$a z$hd|88W(XKziLa{24WuFBigT1JZzu9Gfk1UER#yN?_mBSLuGy#%T?+qbzL2q!K116 z6Spd|AG_7APHCT7hcDF@Wv@KBvt!_09b4!CA9eFu#(Y?PBy%|{_x;ZsJpAQNqm!d1c14#fI&9;`moQASc0V988B#S!rom%h5z}czAq&HX1P4cVr@g!aD_MTtamF7lINx8=`iRct!7pl}%hH5Z<_}a+w z_*a0;bJ+G3UoBU%l2Y$+?-1+Nmu?xFM`-hc>@ylBcg1+yp_>nW!=*oN6S=Oy=T*{O z&m1hPH3iL2DiUn0x(T{n-!(aE(KwMM?N&LWcVq~3W*bVSj1@6{p}e{f;T}{Quz61n&4#G4KTN? zek5c|%soG@-H>Zv!P)E$2sMAZb+86`JOudoEw5@hJ>o|V0UUqPZC7EqYi&+TPxLb)8g#~4&2469td z?QMQaTDhL`og~H{PwN~~_lQy-0PLG|w+e3FgCXt)7w*i zFI&y@Yi+H*{CB4ji099+@dgSScqyyS2=Op5g+&+?%_DZWbYP4jLT}(nRD0&Kx6|-w z9?*eoM;a-}>j?G{)%mfqUUzL4p?30kda_-COPwTZlb28_6Y6uyUvxNNE=<@%LL!9G z72=uX5)`rlK)nBC8Hl`-?9p0D<4Qc+s51Mqv=MZuAWi1!74SH-PDhJnaE^>QhA$UG zJp=T$)_Tb5gE|)BRZDHn%i-;L{=G7dHuH%RCNjcb+TXBH7 z$?Y`)M3L7bx4yaV&XKmDJCI}=`Z*2zU-m$_LM*@T>j=AKr9yMMVwRL z!g&|ZCtU7MU z^*-q5FZV*FQgz+0NZ(#Bm$uL_&JRvoq2uq9W}yX4HD#V4F|@KF9JM<9*7&Zbv1_<# z{4xQ~zyuYxWo-#*ONaF+ki?Xfn3!`#7LaS%LC< zwOhw^|JTo6J@(P_u=Og`Sqy>HKAZWnzKPDKn(kOunfaI;n@}1ePhJ=H>~!eUW)CGl z?J_hILDLV2p1Hn$wU71#4`)IS*$9=K^ELNV;6=R#YRA&dpTj0$XpUl@Zda0AZe3hm zwqAE^1BUT>4X?tldt{_}zqe`!&b6&zHzVHn@|(N?B~+__$ZLHpSiV8>EA^eMb9!CJ zZghI6zdbl@BA)C2W-b#xBdSZ>rohr1&Wa4$Yt z+Rm!|B*WFm{(1S*N%fG(HJCl=ATsPb9y;-Mc!tB_sM9z{)eS*^o)Uf3DFGmGM@ebI zQA*2eb#&<%syAhd%%MQQ`*FdbD#%C3d`+g>yN%OVy8ijNUM4l=(hwlkN@9DS)3)tk z1Ma@1jSBXs(THW5VY~m@bpMMPwG)e(RwNwLRV-AJFqUQa*5F1pj$mpL@1DiV+fHG^ zv?Q#3Os&^4;vMi2;cK>Bx;wFj3_KUf&&5FjqJ{byw$@BDk`Fl(W%cT<4s#odiuUN0 z4I&{6JY`2q^C8=2t9+kZy9djx6qB*qtX8Ea@tpQH*cJ?HzcH4>jwO-11lI8YcAAcHl$6wv8-4bwBB(^z~PN zYA_KANw753S&cpp*`0D^{19AKknd*Qpy|udh1K5t>VA2n$8{ zV8c@!h0fcV082_{3B5^){2(~Ev|x7Q-F>xMKC0v5yxo8-arlre@c89=6wUP6<0#f= zg+3}voJd!HGNC&{}q_rVugMrLjrtq8*lxO zDq4eIHmSV?rL3C;f1`}x9kVbiWhBn6WRTE-Uh#2r=>Q}5!4cgPyEihgaZ$`hXg-va zxt(Mt?eVv{f~jud?!^r>Yay|&F|BiM%4m~MJLhsf_(2PYCy@fV+wE>|zQZ4$VZcoQ z1ojJw)NJU7g_WxYExlazvZ6lB1(TwaDy_0>W014ZrRY`G^6UFaI+UmrB5S8qZRE`0 z9|8NrU&);7?>|*tlx9@{s6Byu9X3t_#m1(6sS-jh{U;R6IWZ7V#{^WXsioMGusJ!G zQ|HW`28OFu+8-43SikEyjBfMxAXQgkyPX{7LGr3=SGNrH2q@bPrN*bz91l5eldG3to(WLB#oEQel8He}5Tz8?E4QWIh zkuTSE21>3MUx?r0G$C$d(zB0QWsSu+0AX4&g(RFil(LjDiu;)fw?@V2=-2?5VNHj+ zUObAwXIR%2s~}weS!yO)``KeVdt!k&cj;L|@yzHXa%%)FbhT zeil50ev+Xk70CwK_0TbWy&}Uynt1(lmCN}@fWo9iD4WNFqNroAd12V(@!I6`Rlsi- zmtUSTJ;lsFA+b!RBXI?xiAmrBGKxe8;S@DO_Jmj3^0N7R8YM-+O3jhH)^ne#uZ{7K zU((9vT}xGn_rWTJ7-t>*$?&|s(xt$jk);xNRIpXtw9~_~xX0F#1i2DB|J@vvTgp2` zm54c9c3k%8riaz7(1(=h{o3T)D|nOG&v{#w3YXULZbu&9QrX(yo%WSTZmR+UXRuPt zeNrpG-WcN-U#FpyHUu0JA2Xng^?5%eeB(3lk4qgs70MQ1n6AT0R!0r({CbL4t4+&^t&4HU&TV z^QcthI;{q8Icn+)rCbe$I;j`ENzUCfuNf!3YZjjGe``eakv*@!1@P6#pU6f;DK@dw z;>@asz()ggg2i3ellQ^>p=7zN9c$@>JoNcmi(hFR3uusk-Pe;RDxq<7 zuyBI$i8gyK(V*6-?^+(pGi<>du{d7*i1RalrlkX@<}^@i&qAtt3Q;}Hn7aeRC1|b` z0e!CA7l9!H1N{nPiN9r|sB)3O=#};!f75ud;o0@$T!#vpTQhWMB^w($+r= zS89LMyOms*!v=mAe4R(kz$2W_sN%P1q3cP_6gj`zNZCaRwS|5&))_g70jnDgum;-=9 zM`jx-d5S_O-e)?K(NCdWMmgO?RV1|tG?x2yZscV;Hb31Q)UVaS%%69+Nk9CG0SG3m zx%Kx7)HjCY#K+L54mgQ=y6kU_?Y~LI;m|M7S-`Ep5_>v-For_k&&iBwx0I6h zqAT?@-O?rLxN+tvHJ-p$^lkSkW~Dn}59c81W_5l{bGYqh z&`D~Zs%IYqx(xeUb%SH!vW86n2J##b;|nO^MW}vC3pn*Xify#t}H1?8N7!OaM{iwHAmG$&jQjpC$<=z%<^!J zr&2{IsS$b@|7t+q^Mx$c$%4IS38(myJC0OSDp*AF3~k!A5^)}}c+@3S!aL+0@zk^` zOz16*^;T9BS(8*(Os{ovezdk%cef%FSKa@qMRN6xoZo0NfD5BgkahkpQqi%Lg~vc4=iQ0RmpX80Vz09&&tQb`8+Iy>_M9q$%m>U z*7)5s4+n}>l#@uhd8G!K9YK}_}~R6Sl-dMb^v?ipD#EO5Nc}L z>ovRz$l&bqdh1($W}t@5;7K zT?y9mw{IH&AlL58V%6nxjcM+UwDlnL)x?|@U-Y{4a6jlzk#rdp*bmJJ&hFx!K_z!z z2YE3p_6NlhO`xxXx~bw#-Q#hzUY3`po0`6$Xt@jTj3nBXy|p?S)hmgjB>uytb5b;=FWDSR zuer_63ahSN6q9~~i^2EaMn#ysqwUsHcgx652ee9V~}1fQRg$47m8ot&NyAerr3WJG;yz9}OHgRB}cwtNY`xDpGDBoVKm2jSPE_I!mH z6t>hca1WE=2x9DfXf;G)XMMU##&l5&YRK|i_zJ~{mVP%g;U4t3jD!x51|dkOJGa{}8Q`zUvY|G;%AQur$6WJ6>lEB~qR1bh1UNpi#BeL@HVOwWOz4N7>E z-r9y7rCJV{&`>cChb1r=YMqM`7(D_eU$Yr8awoH@-t6FmSip=5cB9NhCE+t(UlZ!Li|YJ3^a^CPGeDv@ow> zyRL6;{cY*$IERT?;aMm5u2%(bxC}p=@AZ_KLX(U}kB7fcLv&$!;X8cO zqb@y8dTG!qSiuAdhk02#INv&^Jp1FSfz9p)COh$bF;@8nzYHA>`iu{h`=GV}R0R{$ zcD#+=qEF?bA^3D6;VD1WLiGJb(x*ylpHcARGVbZ}N-=1)&9uVsxAz8`;F~jQV(hfn zUk-PNO?}>vxMg<~gQ{X1$3hF(j>R#ZmT+C^Bz!-muMZBZ$i~BND(mRLUX2$qJmW=UH!) zZDVia&+%cffO{H}vrQ-8Egp=QXD}mYfUO+KaV)9-8 zIzQ3aa!?Icj#Ys_d1C+q72wzBRPs`_&!{vXoCaAFf35_pBr0oS4w*l6+!Z1+elZA$ zj1bMtVovn{Cx_0?T&w?J`7_6=5F}g!WdxbhufdNQTl;+@%w~CcFoo&rD?Yk#Xbjh_ zNNLgeIY%Wwz^<0vtkxmN&6X zRmYv(mEIK#bzYj}(@Jqy(5>Ri4}YWA(?y<>$vv0Lg?edOFe?m+fE9=m*b``?!5^B+ z0#0}p(WU5HRm29LPKTWH6RtJC7#e?o4?@18=MN*VN|zg4#qF&P@h&RUHTNWLJH9>1 zO#Sg8!13HR|5+TCgyk!d(YNpflv~9+ypE9cW_^o0QB1LP@k8Z(yUD4aKXGioCAt=T z*^xS6v*0saj-dLvA__f97t#h+p`4=;LAY903sL+qgmRd!CCl2~_l#*?tf?S#H}p55YLS16?@479?l;JzPX z1qYIAVAj2Mu(1hI^a`g}uiOHEQ4hk1LKdFsKJty$zk|sG4vH#EVh8Kj<%$POj2fP; zje~#PaHm12-FKSLi3+uNXcV(oDtYQ7s9)f9TGj47oXFiDulrb5SPg>ukY%o= zmnG|{oY`47)`}JdeoS=NGce=#h;O-z#jbv^t)iMEmZT046OjVqo~Ih@zIodZ;3nK9 zZ>Xsf27(sW=C<$Od0W`n7LjLChgsSCLw>Eb2$#YxqJud5xs|14lCq9y#^~-Ww>puq zm59EZFq08TX21{+&XklF^B}PCma=Y)JCYgbkGdU^NILd22_#Nr=$|77Zd0O!!(sp@ zKsz1`gAl|cqYp9t>dZZynrP6kct8=D+Hfw?g~fJ{I)*e_dSsDYZ$A~CvEmx0-&rZi zKxE|f95GRYk^!e+cd8e0Cu9)?F>7e)8a#HG{<7HSr2~>kV$?pDESB5ngNxOk&IDplX0Y)cx?ZAUu< zC%gk|m|KHG9^FkJ?&n^%M2Q-Yhec8Sz2T{&dS-N`^w0 zf}{`>v7wVh34Dx9&CDPSt4Oc!(L7P&M!~R`+r^iXATu%;Q3m8`KIm7PlN{l!d~|L(b=GTM~l;zO!i zQZW)tzZA%1yv)C5q>o2~dZ{V&N^{+}E?XA26cDwTSVfr2_->8l z-Hl{;Bcj7K1-rZ9tZwi67^0ne3@<)uEwG5c9HtImW1*Yy;K`90&KK6#e~{mg68N*p+ZXuU% z!Z9JIg+~-VSF@5U3kD%Ve+G0vP)N`80gsT^of|AFC^pg!eZ<`LGtQ4)Xv@K-+LjKk zzRzc7F`Y0buXml+Cl=bkynd-K7;IT}(wwPe07VNdHJk-K>$Gy9hJN8SC8;WTuX1=5 z37=IEFqK$|{I(`D)X$r zr2l)^L8g{XSs4-K@z^NLLmf`L&91}P$PQQb;33WtWW3wnbn~ZSFh_s_3X58jkKrZm zqC76FlvQZpo6Kgsvx2Xu6)Ww>QoN7hc?n8JiW=@qvavL`ER<3(bo50FJ z8Ift9G1k05P<@NtbcVVZNH?%9*j0NwKrYCn3u_UWh7L8HGMShypE)i5(ZU2^#a9Iu zXm@tVN>`W3%ol>o;gu__fVUBJYzfI&=;6;~=2ksYL>8IG@c5ln;u|Y!Saz)7*DD8c zJ4&Wuy=y3)T+DPsTvdBrQ9>If9lB%0Mx?b-Dkv1?VNn2iwgt0+flNA|x)XOpISrX( z?9l!MGYvKxYLm96TA@9^4)u?)SCR;!lFiiTeR!;w#MKte5f-F~_jE!$ubWu1^63DA zvB{dyYToP#x8ed6j=iqwLUGizvw&VM!;eKW+Nicc2?kQ3h|i5p z8G{CYKy+6ED_D1Z-~OqDhI@Zv*3sBFMf@iiVLIvwKMm76>S{W}g+dnWk2qI6 zW6${OuU9|i^AuiIeBkc%pFr%5Tmklh4ZM9lW%?v3oJy3t#15gYW_8KC*jEkfT6Kk1 z6YE0>7(iLx9X@Ugq04SP0sh|S-ROjuMXY=>)jFoA{wQv;xyXkM2tub`4gBBw@21la zIcHlnp!SvC4|HM}ga|Cjh|^t%B>&KiEh*}CzDVp+xGE25^$UhHbj$j{uF|%FZ1iLt zs@SoBH5N_ukr}(&yKZ4+CsT~P$JcFlh!;;WyvA;oZPvs^%sQ5Lpjrf2Na=XAHUmc- zh$Gt)e3{spR`qoPXOPj?_LBx8lKd4u0;Q@o6}V8qhybl#`b~rOB!+6dOXoGJ^!C|M zmJC9Yor>v0IjddeKI2 z?Wa!5x__HEu0~af(VwsSaU$O?SELBuqwfhA14e)&;zGfG?sF@T80;*&Sfzx(Vi6o2 z6Xe^mB=Wek(qTG~nw=5kZgm}a(Q7#n*yFB9AF+!iN}qp-K?~W#DD!eL2JFhfZ&%Od z_lC|1TqvG~oh@cxkZdx?DlD+lG1%6!N^S>Ea3Z$>51yB_t+oImQuqY2TvFRr^SdUl z^Tp30#ZcWG6>N9$`3%POT}M;hYqDUros@@GK~vE9(x$?J2ckh~P^&2xgmF9lXT;J7 zi|by(FBFVZEl%GTC|he}+HK!iD+k9R$gnK1V_F@)9SUq{)HQlMTKzUjpVsdA}w)^ zkKGL0WsX&IE9qTZYd1vvT4G&#V!C7H1hCHd9q#MppkDkcDHXON_w&%egWA{$t+aJ$ zJ7hsV*I@^TYkkv$;qG+}V}2L&CbOf1dqCGismxSs`jTN4)A+=SATR8x?m)xy-fAa8 z8vEw;^2)A_;GH>SzW_rM!YG%YJpZbM`7D%^R-waZAp3xp~7#z?`YL*1S!H z^&E#XXT5RRW~Zgig+7@iHq^n3t=~?J+rJqPqdG*ICiaezYj`pF&%*%Lp*5+~>9WX5 zCQUMTMX^_B7y?uV4MrQou}*`0Gbi&keR|rCwEvEyTgHKe>X)npDrjc}ydz`6$Px-v z4aJldP_1Fy&N=YrbBq!N0WjU#zdZ#q3k?|grQB;bA{e>ZEm&Ub@=++x|HQa$hC490 z%vL+AvdnukdPt;N6`YsANu9&I78F_JUYH8``i<@0#H>DFIX1jOvz58~%?$o&>LFRgZQ&H=RXALN?YI zA~Y9ue!FQJwjLB%yv1}m+tDxgI+zJ1Agf5=w8Popf|M&+_~YZ7qe^k{H`9+4YH*>7 z`#($ZC z$c?4Y4Rs6y2fQ$lr1?AV+lKD^?H2_(7ZcW{5)= zckS)vb5msReArq+&Cs_D-Y!&eT*z7cZ4=%h>$86D^E212Bn zkU%DEWr$2Rm3!HECG8%WPkqB2Nw2e`EH%wDhJC$(pHi}?7gJJVt)nb2K+NPaO3Qf= z3yyOH^S2y`?>5l7bWsHzs^5{Bqz0@N=5jPJghL&i%`i4l>J$+Ks#L+j`Il_iKu}kq z@%2^vldfp(ha1Hi&X5UXU5>0TZV!L+wnRra98wJTF{0Lxm6+5!s}e(EWGsD+3#)c1 zC`r)AGd4ZQ301@OqeeV6lDs?Jr5e?<-AZxE2F6))8F^;}7p0pmf0D0yksl!=U=^{k zw1If|5TpbzeC+c@57Nkz;(dIJVR;2DNs`8+eO)zWPDgKq>=^Plrfeu+2Y%RUt;< zo{^=RRWny~!GwtkS<+Z^tg}1>3=GDFFGWjYwIDjB4~s~(g^uxDw;uJ7t!78+zT1oA z4&o=bpY49#e+@qDvnDqYdwGU6K3@pT9pfInEtc6WHLOCOP0z=;E6qPv}1Y1czX zFUErSQQ2b94TE35<1QO*|1T|ozw+#V!^5{Ya1D*n zqx8jFF;#M5BEtK>>kc+4LmEmVis1S$|4f9icb(6AnRelF^JFiff)a@zWwy*A?fo&7 z=C!F9_wIWy<%+p(VWN^ctxp8p$jj$`pUOc@dBULMd3Q54nH4Jw_v!Uxq4@K5d#-b> z;5R`LJ2i%71T6mm3C61-GH>tzuCHWvO~d z@j@j(1X@vO1`a(K$1#wDgEW7fGpypIBTc z3O}hb7x$L7j&<{-f}llU1qp9YYG%|kjw+uKWe9&d+Tz5;KS{t`J#P>fk<{ZmG$AU6 zb%3Gv{JDMxXSeyNG*5dAI%bD}cm7JR&NuWE{Z~UgZwKk`NC9F!L5;xfTi@$JbLV*# z3aN+J%O0<{cqin?Hp|itMC{yHoF<)%_~9>S)(NH2!h@t9^Loc&t(E*2v-b)(k(a6f&vze0lO2Fy$j^Vrtt)? zK1p_apB)P(8Vp1?q6(bR`Wq=M4&CBEC)NKGW>W~R)&`1h1lWHt1LcqL!k>;-2i>%! z-WCBcX}b@HMtd%hcY1%>mH$CJ3$=Hm_Y?gZ)b>x!j9R_=?)3qIUM>Q*9L^LLO}sGS zc_l-C(VX*%3hljt0?Qg<<5hAAV#Akj&M*{^m$P>(tv^vCqkKUt*w4%+%F-=&^F1w% z5uC)EBW~``DqPO%bRO48Wa01xTkz0@ zNPSqED1$h0BC^$N$+~cfdQPMnOc)#?A9EQZA;6JHD^G2TR>(;wT zQG*ORPamH_d#4S#qeVi$lQlkO-n2~ptL%H2D0?U z%0$#vxy25n4{oDtZM(m#)r7pqY)yQx8rufHfI(7Ot#6=fFcM4cCn;Pw@%4lSDyCb! zScEdR0ZhVc57|Ds3x`1S+NIcWY;*h6m?-XnN6ye8c?QFNy}MQa6%Ou~t*}&Qu{6OZ zsJC=$i`hJz01B}sD?6MKn!3TNn0AxEK97|-9r6ZkoSJYJG?9>3_UuX6cnkOvy8b}H zEZ*fclNa{W=O4$AlH#Q&khXDa)6W@6mDX%5%JKS5sfoSix zo~6TwNEBKyVw-U?R0K{*s!gl~cfP%NI)SidKHdAC>G*sN>CxH3>OaRR*X4H;wp5h_z$Uv4t*GxChG|mz6t73xJl9* z(5_daa*!);E!j)j8l8TCiI9C07%IIPX6@6aQy;5BK}tof`Mxw=Ze?Of$<4JSRW<21 z8fdpUqjDuo5$jX*UJN|_x!s>O8m+^h9;Zat{3K}R*0mjI(J;^&T!A9tUXW(Wtgu|8 zwnVA~J2?l=UaT_R<8#|fUHSB174q>PGq5tpZ{RR^UCp#)(JO!*+IwF z48lTo3&E}X2^19YO& zEtWE)m!ik4{E7iX-gYY?ZVm>3qr6fKaEc6BfPuT^+3fY4H#=XG*6jq@N`)YVZrpyu6kw%ew^?GNujfpOd6(-bBQjY=UCO zE)o`Ztd0CQgeyPDHsgMtf~vvw`%eBz*tlSrid)XBYMr#xi`_?qh5%GyE~v8&&MJ;5 z9#P|ICMdo>&oYoeJ#ChG?vGBxcexCdT#u4jNgG)uA3Ce2m+VrSg$eP;)JUtZ#>ROR z4#_yezT}yTd#*zY?ihuc%A~EJByky}kH|2d^7Ji7*QHT#LAD}-+F3RXDP5}M8>?~< z&RnM00H^)lt@&Me26?8Y4^inG8Yo0Mu7^A491J#OOtFoQ!jD^L&as+pR#vB+N82N9 z-e1*OeQUV2^Gn9*I%*?58!7a^BqiB{R34#9l?mw4Y+?hbaUr~WU5?-HhB&xq+ehqX zQsmjh2Pt#c&$j=zWNP;DZ*l|G1VX&<;SrRPzwlJeRKn$XlkxTR)c>j*j37?Gc~Xw3 z`?M08Q9;Dw7Vw%tUBixHBKZ5caGCQgf%4VIg_FyBxBCU=v7LZ^xlw5Xb_^j-3BDJ1 zrJGe5Max_bThOIFQ!#tQyjU};51P;J_rMi>+8CP;A+{q3m@T9;;U)Y;z?RipQPS}* zp^4Tsf#Ssm(UX+T`OhcS>CJqsLe+HZgx!I}$>dvficHf#t8ROogK{QCM;(fXBQ^K&Xs>@YVXz9@6bbR%vNQ||BrPGjPEgVpuUVzn zjU3A<`X!EE zl4=QR#B6&-#~*qDm64OkpJ3tBLNutVwOWTnB*p|E4)bZI;x&KW0?p9)7LBcy``zq0?tN?oLpdM8P9@Cl#3+T^uV zCj@|9!iOkTX%x2vth#Hc`gS1dE56a|H~?MAfiV9Q7&^0GxxOucog#a!W9h1iJOc=` zuL13ZN6`XH$Lj6FFY|M~U0M1Q=I{AFoBxw9t96C45!i^dvS~T3Pir|inawxB4ZoE0ptKehZ932QLwoe9ug6=o7Oc|h%S#Z~SSTftEKmoH|+0W3BJA1%MSa6-0IpwcM0Nn1cNKy2+%2|GGQ=gOf@MC4=dAg-_l+ zJpA=jRbe?9?bh4P=gWX8oR)RL`p&r^r~;yZ8;-@amD50J zkwd;8<-gMS8B;n!cR&17cFk?%isnC%()^~yb1+6K_mc+J>uxTSAdZF;f?LXy3`;)* zK6*Vx|FVgP9!vh4(YN7*yog#vZL@#HdmFt(w(jxoy=12jgWRrze1bfru7$NW+vIf@GiuJd{? z2`&%2q#G@sT13i8Zn2#Ifov!wO$uhzq|L~)dMrTAb=;g|u6^>Z z;8~(Ps)9F>7aW>lTzj}8i)lgJ6^Wd_@+g^F5_s_cKDc~RB?7k64AQ$f+7R}0Gsva4 zaj7cHfpLdFd@rIZUE7A+N+#s;-lJlC&|`1G8H=MSKIk$YCOHrDUmWOP$?m@`4=q8+ z!~ze*5seDxnAVy}-#?sOUfbCPEL z8BX`+8QtXFZkvP+b@cb8_Ad?p;|JPBl3@V~G)sHdn_bo0cMn}P!T;bH{yyG6>)NZV z53xj38=on@05Rd~f7bb(%IP~gYL|}tvVOYKl{VU8@QX}a=AVE znCfy;sCe|0hFUuJkov#xL?I%`#9k!rStUrOMED+l_%Gf;CaS5amG@iq{3BQM&#v_EmdPn2SF$kz6}@}3ei1%?{qN?=ps%Qs zi#IjJ>K6I0glF&-&mC%*o{qHJ1aE#nyVgeOzgErRG)tk!#Q3Lv)5t^74Ug#DE+gZd zHG?Ub;EmIR45nu>YU!P>XVk9Br_>A=5b3A6{?vl^OOg~imm3j$KbPZ*WWZ_&`Hn|<7V>c6!A<3XWnLTO2^slPO7B28qUr5 zSCJZ|Sc3q`SJl z_jIvSo8z##YMp!SskyfjcF_Lh+#p~h6eHt0Hsgqqtp*z3JA3wid>R&fo5BE<^UtvV zHhFnC0Fi7;W+nH3yoHkBPI9Sks#_CWai(C5=qwE2Y2xQPJqyO0nr(9odK!HUly=l; zl6F*YQ7kPhEnkk!_!^E6I#Jp3aT#WIjkz@i6QQKnD0!BF4`8lEWBVHYTF1{aJMTx0 z``4rIx=)R3Txa`WlBSbJqEOBpRu0K2zF%9Z^-TZFZomDtj;DoyHuC9-K!dryYuRl} z>j4H}ausfOh9z7x+dA0QrRUM9R5IB6X%S#^7EkB8#x~6#9_B1MV&o+_iQO!5cWg3I z9PrUBZA^MnFzdxGY(cjsNnR72r|S{ak2BO%wiFz2XN_z$EMNeioj2ibrNHwMmUSBUDoKfaZ| zu^9(xu5dT}-c+#39&2tH*w8+K54m^t)YRtrGLqG9ZDl5gWlhFJL^tg1X?z8@lo)}u z(iiFr_etGIkW+<{u03;6KzfAC?j*WxjfMBdK~`P8Wyn#ZCF~B*2H|%cCnpP)Fgunf za+_^~jO`xuZ!9c0ZS0oqmmXpQSJ#)QoVLebOSj7_7wtsPmzL>D4ND$C99U^kbzD>Y zd{}3!9ueWo(g6I6=5cG@bDe~S*%l(L zMD)~bLmzGrHJydA$_?%dlK^BMtdj%I>B2_LdBW&)dLNg%;S{PX@!Hs_1>(hmAeU=E zkPm;wwqV4ak`d(+#mG^|)9F^b>=7|nP1qNbbSMM0>k7r>hh|2g`kp|8q`snz7ptY3 z^qfYbMLOIns9yy1`{dRd*;D!Z80Hu&=5YiG9t-crvZ+o#(#dWZ^Jolcy*AzR@HA+B zmd}UKw}PXPqWK60ueu_&B-?_1+Wc&3;$@>oD^9k%47frn0O(E;dcMlVyUkKdH*fJ9$vatTGtK zS6_#{8t9B5)GahrywUBNcjTn$`ZnX$xHMMVS z!%681$kRThneO?U&PfDw?5TZrQ6=w8xrxC!;J7uFDSXx)a4K`Aj-LDCANA7V<7Q@M z`TI3Y6)}kzQO-71y?O5Q7%Q1lXmniFpg-!gxt4>m!}n$fK||WmfnPc*hI;fm|R_~&rM*V2C?MidVdj9@l*n1r0X2L z#Cng~e)&2q3iZ?-|EGz=*G$5~@2V#$zxFvlU=43Uiy0bVbc)%^veBDkZDrCPula@Q zciZ1n?rKrN{S_I^; z8o0jZOK$k(QO=0vn2`gu)Fx-~95#2`bowEBW_7oQ{(Xvqj=u;EOGbc&Mz{S&s!k^b zgmA*1Q1B(uV9i zJ7r_Aph;*K;t1?n^UB{thaEb+bXx*$)apQjOq=qXYs_wd*s(}D@l-|L@fWvCJ-ZFf zAW-zvp>h6GadDlVYs@+#?unVrq+Hr>RrM7XxE^D?{QZqeJ2DW-b5aJP}$?&Tfg7kgBU7uy*|5_g_L(9i%Pty|L%JbLdm;w z5gpI~Xlzl4Hf;MPu5Gbb4*Cs|4VvRM2DwS+u$i6#Kwb@fr6Xu=wlXpTP7*2mzOUchOS$&>nwT&m< zW)U~$5+C_7;W;rl$v>7BxmjyJjT|2twnEKfne_$lam@j)aW`1E>n+k4-oeS3p>=Bvd}SV6+Ecw4!Hw*1~+um$MrFLD+1{;Tl> zOYWP#V>Zgp`C0{|o#L}+6}iNgMa%82F@v!S_v>#EPP*w4nQN?O{nRVd)4})Vua1OF z-62bhQ9hlE(FEL=AF4dWl{!1@ZwxAEM19Jtj8jr(1YhQl{Q5Y1na|(tJaI}a3loz~ zXff2F)v(hO%e6BxYoM)v#GY?nfbB)OBSHD_XK!H8>p#qoxeOi^{DxO)@ zMo%b^YBkdL#nmwb zYPW1nJ23C+#ia(2`Fz`TyLUOVnsBEO(i|icfZ$J04KuK?9wv-IR=2A*wfXX zKR%^7XTqTaXl>7T{=wN060vEVe;?z_Zxa3xGGn4e@gWxG<2vV{} z;ljbD-g-B>`n+DTE31#ntwbp;>GH7)YC8ba>gb(XeI1?-m+Q}!HX_|P)G3oLcIxC56kRrnE(A)HR`?-OVHQw_>-P5A%}4SS;FsPg`SWCc zfDx#58W1BH2Z)w2SEcfK>_qCg>JP{BmmQ+fhJFfaB9>>NO6elm*zdy5;c5PX#Yq2L z7(g}niRhuJa5qr+wRpfhNc4sgO6!9k>KJ5qf?*-4*ia>!22vlcaFu|~fSwO4VN6@> zF$_@H>=q~nWcrTZVcRTUtqD!uzk+e>n#F}!MNz=)QQ#d3)i({>7brah7A&!|k|pms z#Qg2(%AH@*kQEjWpdmxU`{-3WtGNDSVd{KZ=-n|B6(%s#1YIh(f=FO;tZE1RJ|?Gl z#5|s56*$!gd&k8UJaN=#h-YBDZ5o2)q_{+p>C!2JhKa?1@OB(3ERZ#&Xazx=+-mfK zl#M74u{K;|v3Hho(4xMK#r`5Eq*9`Ze*w~~kfv7CA z`W@thb9&t5Ay2L3x-o|2URrvU6qqZZ$`&K7d7QuFK;G#l_ZHM=Es&dSs3#(rcIMh77`z{|s!Sq&Fm0%zL_N*+Um{?ny*& zEid)2!zn2NibF$YggqE1HNK}z472-;o1Qw0F%xl#jmXeHUHGB2g|r9P{1^3tc#*AL z82rLdJ%$t(6jiQ%yGO3aA_f&WVgr`-N`%JT3}fL0OL0C~A}2W)C{ou-m`GpXeI(*( z66zxniPHe+XW8nv&wW~9L298Y3?)66KzOK3mhZ@y?jf2bS(!z#{DLAK*m6E z-E9<7f~GfFzGE|+>uWQ04{;-z8US>o4Sp<#R#;zS_hETiD@OkU4r_0NQ#USAR-dn0 zn?XT$p%J>OF`qP#i*}C4JB{$-BZ`pB19AJ`BV0HcFm#MOQa?%s?&>m}Om|eG;pWHM z^JN(Km!1V5>^}-b++iV?p+!%*T97H7tx=5dQLCqMSQ(TlnE~2>7VGO&j_fy$Xo9do z(81)1KE^%kc_wWLeaPmV5yPp>D3n+xfps-_YX~M zA`t9TLRSLytHt2hxgeqNBnF-E1J!Iw0eQVJ;jl@f_81fy0VRWPDZd}MtgpHdZYu=2 zR!_|X@y*69k|eftym4S5ve4C$8Xr@P>oq1Ck8%tWZJ(+o%Np~`~C_(4~m z%xdCm5P>20!Tys~=>1b=wZ)sgA23*|H<5;JmNK@*kazy;4Xkoxce~EUY3<$9eGXQZfd*IH&Qas0Gsr%14erg=?#jlZFxp8!hlG0^UGRoj1e!MM%3g7Ua5obs^QfYHhK$R5`=R`8h*BEFNBmNmVOQ_ebs( zd`Wk#0vy$uSA3vfia~_19keutT>Tcj!g4{w(|DEWs)_a*Sv1D};jvp_{!HuJBc<6< zl=B#e@tD=j=ti<;&Q;#nDTb=@XczkG6wog{7ljX9(%MQ3syqB-bg%_&FjkbYeGLNr z7_{nSO}9C(Yx_L9)}U41Y(I`7ha9%_qIH_u z=0+vHkYiqWshLnFOP@_dDapq-&H)w-Sf?`}bAtjCcfrn?Q9-|cpnr`&tn+D;T4jE{ zX1)oH&u$ICguyay_ug}1U6Ns@3MGLZ71Gk0c{t6TUExZphj}VmVc=0qU((=_A>It) zGWhrRkQ7%)rm)^2QJ2af-N8aP!Zb<=32OLx&Dn@cZlDV#QF1*p8B>`LA~-Fh54xow z-DBVcJyAd$3~Fgj1AGV~hTNnK3Z~YuRd7rET_umCm#4m>e~FBaJ1*4JF|hy0hzEZz zk@9|@PVy-Y$8S<`Dr6rs-ig%W`YQi=XUKt@>X$FA2_fo2sQDKuM6<&gcrqoInzZ45Qe; z@)9KjUtJx^g$M~u3j0`vza+O12+QUi+#hk#+w^h>4}~Qd()89kOaCSnLLw;bwZrU| zLG?$3%x+YKqU>w_c5kGt`Gv)%vXRmq@-iVl(B)gps@^=xVGGh7-6@jE8=mp^(%E;jjltgov;*zS;L1~aO!PlLi|h7kv1SMcE5Fxs+myVg{H zRoXC_g{hJJtsf)qsR>w;{zAH3D0}q0(Ftk)Llse%5!owBKZ@*&W2&Y}fo5WmY~`RI@XNKuIY3Vtymbw- zqM8_(dqt}$=A2?pJNn);*kGkQSuG}6qL4&ywfu3-$#o}ot?ja~5Vm;g>e~+#sh_RQ z&o~=D1-j`g!`bT_nDRiiN1W|&<>NwJ+4nrovxv58Ln0h9jNtokVt40gBMCQon-3$r zed=W}gDW3?myP}2#MqH#3p%`ld)=^#$_=lol=P6sPfhf3(P&oH6b{S-F;Mf{gT&Mu z{AhA8wdR#nm#&wVje8hxrBS=GqDNa%(>vAFsb^XOt(hw7oai$nYCwm?I2nsm?zIe0v2aij?bYlmn1r5Out< zInT_Z>nNHfRvlP!7PW1DLxjga2E&m%P2HK%bgz;F!~5vrHS6alnVc`%cb*8ITt)jY z`}I^08VDi5+y?o|YnvvI-PSA5{p&FUx&D3%z$C5Aeaju>UOcTtcy4|mE^MQqh(9{b zN9$X94flsT^eNPkRBd zkDMMmvd00@KYA}-^G&?~o~R|$EvXS1`8VjDp%6yI8qD8S;aE!BQz9wjG~_Pa`eV(d zS#rCP zIC4Bge#8s_1&#Ki_KefI6k?d_x@5Lby<^e8^kDYeeK&=RX=H~%{mgcR__I9lkuK4IdW7@M6kC%G9O~p1mu7=1Y9aTSEoPK zG$Zfuc?d}k9Q7dYi=>LfedFCYg8K9=5y#%mZfF<(tqSFnd}xWNPN*saGQSNj)T<=z z03&j@Uo&RLTPLF@&;tZGg^R zNgKFN=XLUjXz#4KphU*WvK<(yY~c?XT|i|G)Fhix`uchrqDdm7eIEmj9(3O=ZjMRL zmukh5its{2L4|pRQ|2p!$?6jqon|gqUq#VX4ZUD*)M=m=nrMR!P=23OCw+C(JZd8S zR9kilXAl=jc?-SH%@kNk;OR*X^Yr?yBR?6*wv>KnDW{hSL=WJoa`}RV3{VF17mAot( z=)Lyx2q~H75={=X9gk&6#1iMig2N&50WBdA1fa9kehX6&c^X)bY&%2^+O$t?GL2_9 zZ>Fp!wSYJ$y%cfh`YE~1CQ(tc(I@_`or>}4k{+s|Vq(Ok`Q8#U$+KZ$#^v0YWs|N| zje|vBGqj*ApOLH&@nE`68r$O@3T4VIddfICjes|yXFx7w&$~(9XQ4X3nw0$Y;@&D``ZIx8Lx@JZQn9pr z3|Qb%9mYe4iGJj%1q@l%pw&+3oUIpwB2`I%8Y!p23#Np_SSCi1=7zW|wk=ZV2jU?CW=*l==jU*b+75)Lbg8LhCR%=HHE1>v*qtRxJ4uF`#}w zhBIdDTsxTD7oFRC2GVKx_B%` zAGWY*mR>L?V8I6H0z5(iNfg=mzi!+68buF~@d)r%H2IKok-Oc|oT0J=`j6&we>8ZG zVbh;^^S8YPi&4#!d*4^_mdlD6n$FDE#IJ5GKeUVTv3LKNOwKWHwKX1#6{zNszke0~5w zn6#QcYM>Gvy5=?r)fy0mF{LY}ImivWp5C>R@V^tq&0>4eAKXWRN1^pSD5=5dA;3Cz z$6}3cI5?P9KWjUwU$H51pE)%?Ir2b^Q|b7`DsX$I@|#VxPZ$4(vw1p-JnovwqO`U&epKCfGwA z<|#4JRU#<)Vunci4xr_<8DygSuk^btJYhyymlk2CJFAHr>j^6%G5`4WYnciZP$KTc zLh6CpN+4HWgXYfg?UtF}xEviy`cYhfZ<3dk8Sbp3^M;wBcR4&Zsf z-FCq{fP9$`tn8083ZFx?KF^j|CTrvn>ED|Xq{V3vD>aQ@w!XpN;yV5A`Q^})Xm|(| zb+*1zJ(MeHKGoA?ZWleUKIWQP-!53@Yl#S2TYFqpNa_O|^G}06Mk<~DHI)4}Wj2PEEfH~2w{RNMw{e@IX%G2WT9!DIr zpn-Ov+Y9vGK2D7k#v$(g!-dfKAW!ay7B!Iu51bHtUrjuYN=xQgCVKY=#B%nq;tNf- zl3d$zR*W*VAs%$b{Ly^lsWrqdhGTweUD*{dw9v;!LQdf0lo;=o; zP}kSww8BWRLZpJEBIcFJ8frKUhxFfZNjdCjoz*BffYqRIblwW~Gnu--pe0H?aG%RL z91GLZf>WcC#;uE}{s|%hu9V|UE+kU8j=f-+Z_1+kmBrz#PU!Z3H7Z1M?%_TsY3G!% zo-;1lfjYM}WGVj@?B#bC)cJX&wPjRi2_8vcy|gl$P54ar-Ap{9qX`#e> zi>=AuNdJn$0gG+x)g!fP?uGe&9QP=S{)c3+5nPI4N`Vl?Rm(qG`fF7Gz^~QXLk*Xd zl;~;(P3t#Y9+a;9qk(_No-jjw1%EzKUL{KSzoSTqNDTzy$E&3aVGpceaSyToJBDW& z9t<8TZT;~hbG6(CjO>E=*Kz&T!yJBcCF#-1y7Fdz;~dYwi;w=Ns$Z!82a5B@(h4@3 z4gVzP{BQLq_0VZ5ii@jL3@ulVUylD*Gwa{Gun7*B9mij#m$@Mm_x8-N?%tMoF}c%+ zxuOO87hR31WtV>B$BH0U*XM};ss*59oxUWfOIyUU5WOe#l3@%{j1~$3I)(T6ojv<^6(ae5}tm}KDF?7G1;bGdkLeut9!2F1$bcRjopH&U{fi~;Q^6{(lJ@VkcpRo#Z4A>D;Uw&9H5 z-P&TQN>D=J-rBSIG=W#f7ZM#;npL|#GEV5NFd||wuS{0@6v2J(q6)Lxt_Q#?J%Tkv zTlSHLB3a{O>?>50BnBzOU&RkeJjW@QP^HevX3CuLX(XLZWSlWU+pgk4sw7^8+je=K zK!Y(+o2fX3OO(afSo#~36e%NoZBtR@4H&&UP8+Aqc_KhZaJwg#sM54sFB>sTd9bT^ zS6)%9sYHi8g6H%UjhsiJVd6zn>3w7sAgHxZg_cT0F1@X=iPUiC;W*tWA^h-=-NtIu zrKcL+CeNhItO8xl)6rD$9RE``Z_v1N*Y$hMPi|J+ov{XO7DDpsoe@SRf4?3- zBNSeUw$)q@>)nc_CwF@^e)?l{6BtN02#ABEI^JlRH~VyssF`1Sdm~s|poiJC-h=92 z<8#&O!VlXqxFsts;!9+o@|EYFS-*lmfqk-+>*L|M&1tJVZmt3uH;Cs_2;0jkSdqi7 zChmHp?!-^O1b!c;8it6L?n_PJ=xVZ<`B778tYMwe)=%+MsDgUgoGOaVO*FZhZTZfQlc zTHZeR9Jk-&L)4cPbx@ij9>kuc1zIh1;bz15IgfB2w=1|Hdkf;-pU}eUm9JX9_v}bV6zrD$?p9CQSviu zpSVSBjp@2bsb1e!1>p-yb>1T-9*bo%yxDr@ty1#XQVGg%lcJdeq}lHF)zM%PYS6GoXZ;g?N+Y(dUD|g3a|?UPoqDt2>(it7iRpn~4|OjeR_$o7_|wVO zSRE{?X{Z@Zn&7lv`F;<7=6sE&ej$pwVgOI#RT@ZC0eR$?7EdyQnLX+^-*Ub$&P^WN zV}ww#$tVxe7hdSY7u_%VSQ4o}nLYrRCJ>-j5#Nh>1{pWPxHkVtnPo^H$jSz|ZF#)( zJo8^gNW^#XaE8Y7U|lbHu{oDpII!aE4yd{eGA4gWBzxHI-a1#ZH2@)d8|}h)hCvV+ zuB_wYJzHjkq!$)u|l#v0!EXsGqNQ-@?IYGtRAj*AH)6 zz|Kb!eBj;s3@mV;j6Uq2Mv6k!#jb)_FWxJ@kAJ=jwHHI#t27=wl!7 zS-EY_?)v);@z4Ce)uexHo@yq)=f`hq@{Y3%Yfg*j$O3_ttVi${XZfdh@mTB6QI;QK zu@7)Q@EtN}#IOQenuEkMVe&T?#~#UU0(U3BK#0LMdNwy%{($!VxDK4xt0udJWpu>o zbc8;; zKtMYqRtmx6zLx{y9_+qnLGE51O@!U0$7&a zyr&fH!V5oVFHD8L{KUL;DY4w8o^g@kbY2SNIYoK_{sJVTZ5p_F){5xfY!xg1aXfz& zDFVn)lunXX5ITMs)MKMY#;+``ak|4cifR2#XgcC*131@*-{);qDTcdj=FqoYW|@V} z-_T%0b>Y@D3qbC*rQ+`7YnG+kSRW zX|?Hfx77PSIY8zX#|lux;%8`)G60srbYG+_b+p8-0%*TaWmYAHW{>KiomT$1Ly~P= zzOYMzZKPi@7rd7f(g389t&{+ltO~N!8j;790Q#Qzs3S@j*0)bSf}}a04961p*l*#* zvL=P*CetjB&Y6F4NMw9&(21;Y^`uzpK@D5*@NLp-weREJvfFkaQ&4ZKdJs+APDwb6 zx8Vm0&9xP}036kB=J$pJd4onAa{yUxc|I07CcHgkSQ6cQ#e!*I54iA*If}QnXeR?n zA@o1RLipV$oyS_*Qw@%*w)Rgx>F3at>gp=C-ivf?6+MV@6SO?4sNuiY8`PpSywM{0wMO>wByg-t_siEEz1#4bc`CEf>D*;Td<5U4B6w9qMY_1zB~ zCpdZ9vzjQ+Xf1`S75onzrx1W^v}udqqNEsrcy4C%Vr$;iNR)?K$WskxmW;ge{r|_; zSBAxvbloOEpm7WC5G1&}J0S!K!97@l2JOb(-QC?93GR{vcXxMf+;7kO-I>XJ_nrH% zp3~iR&Z*k9_u6aiuBsexcoTHza*k|lE%cta}+gHuDjUVD^2Zf62@F3 z)GQ%H+y@&5y$aZ!mRveY-3>}^h!$U2C6WGzS-Hai$@ZmV{aBrHU8q*6i_a&WT_vAb zGP+)fX<a zwPl?gHN+Zm%qfx z?Co)w%n)e!Ms_jDV0S{a8*%+ZOp3|I>-7$Hy{)No0pLXg^=x+{ebN^1UbqvA99b7@ zm=eLD-Kz$PW_CV@M&y|u_C>)*R>jyyrbULtwAd97^0Tcc<#X9ntLWUHZ-2w3q%T`A zt_t#kv|@C%rs<8>c$SM`1b0`xx5^Q`|{pV*f<$QKI`;NoOZwow6J17A0Yxj&Uq_+dgqb0IR-&XD8Ai`G~aH zjH)9>5`W@iR{q`It;8>SY>O+6X{^CkBbUjMUf4bKU)pkmQv~k^-S7I{4(D>ipL z5T6{GcGJO+gUP4|Mnp8zgpROnzdxXuPnRJvjp`+1kv&a)@z}XVk3PM;gbS`(!5^UBD}NT2XP>3TT9Vjiii8Cvcod26j}^br_B0Y=qJ!#&@u6WjFVnb9!1 zv~}Mme<6mF+p7#1ApRBGD(eaZnB^~o3gX2_etA-a;)o}exchynNu7+ zbpo*QNnjg$T8^WID(DU6?xQuxV2Guey0qoqjIRLgfNJeOPhtOFPf?;J*c}qcq~e5M znCC(KSy-fbs|4H%GEBar0j`paza&s&I5R(S1};T*)sQ)v<5kkjGzA zrWd!f*Bc7telng%Bf~|JMNlR{yjlZ7cKTtteOTa&BuIb-q~HU?hAT=ls*3spu0~-< zFxj*@<7R;046Y;>N*a&WN8HX^(`J`+&;-G)Q%Vm35F|D!ULh9-3|{fgP4W5SkF+k& zLjnos4ddqdBxJbUWNxAT!TlS|iSnj+Cio7P$qG>e=JETI)czzIk9~uzQSSlrWG;j4 zYdN}Re3J2lq4?1Z3WHXmZ>dwxrA=VG(d^2#=vwK(ZjUd6+dzrrC&-9i=V&47WvHsU zjn3*_5X)rh2G?3TO*677MrX+OfOR9~>bHP;Uxq2Fqu4J3KLq$`Ccgq(L9N55xR`P< z6h;5E+rSsgn0M)VI(dcJcQm(`P;kV8kASpo4w&QKX2*ZZ=+P4U>vPRZ%Zfp1={L{(@X5r7Z<-S zI{n&P$YQ((-LxWH8m3t6MHf>z96RMpfK+c^I>~aii|+f~yS+OE-4`QcL5n`j82w7{ zEcB;?Wad9qk%OkKe03*a2WYMcat(wh3c|w1cWdP2uWrM?2Cw+z+0aoTIOwxHRnDp7 zc&H<72eU@EOa_|QPA0{VxHI;deg;rt6BE*Uv&wd2Q z2Lj-c3q9P%Zo6@Qg+Bl7)jN{ky;z3JRx!>R0#*?o8Zu~jV!XBW>yl#S)RBgH6ZHzQ zW9*fuT$QckOWp#%YTH^br3KeSszP2)*gPpD;wh|l^il^=QNK}Frm7Vj8_nTDQtzO{ zxf*$H8#lfEsiBnLz3AU^-isW7$-;9ioS^lon)GkX{TKKq_vT1?Ax^4K+N>$m!HQ+d zJir$0wt@ftRo`Q`LZbt`Gus3w)40oejJ8RNb^3Bd2bbM!SbAYS=Ayu#X7X3Ogf>K* zusXcxp36jxJ@=YEA2Z6qQC1teDgVcR{Y8oW-Y|X%6HV(7bwh5z*KGvl<9z?+IiNhEkatjTuWVlelXk%g zoq+6rwB zlyeC*@s}79j``gberrpn@qY7p{f~+Li;4V$caz5mG6*tG;2l1E^Djo~g=GL84ETS0 z70m!qIG1-Pm5lZ+bISj1F}}p=9fxClAA@*NbHNvtGkmhx$RV|0|M|avS5^@Qmqu=+ z@iky;$M*0JEpqs8n9{+73pl$@SGR+VZ6LYUl z;yCDEjr{}O%MydaP{DtHtYbLd6yqkU9kf3v>_6tv3h@DYg7}wa*y#`dcol*qQ8h=D8KMrE4xKL6oHybB@;TIB2)sN;8Te`# zgAkb(RsYi_8f1YU;OG{sC0zDyqH(n0RkO+N#nE1i`f{hCfP)#W@D8V+Vk_6~-B2}X>kzAPyoDq%GChjz+*y9Fi*GY07M5Xg_%)i_X1t$9I9*tl2KxsWmv?erpHkm>u^roVJKcwd_ z`g2f#=9gkmKNlWu^sxHt#D~V3Oai}Iq(7(1nYhCw04UvVI+7BGvf?E2P4JmSj?)u-2?gV|{M zh6X{BZIu@&u_#jof_zk)Z8X&Rc>(XyG8#Tf56w~Y=;};@fnjZzy47bN|Z=%J%~6ooW_5@)2TNxPvv`ODOtYEY-g>V;A%$ z^SBYC`H)8EdUY7RKUF$VJEO;d!=M&-d%h#@3y=E7Y&?j6=WoTN?4tH_l7G(hL=W51~ND*${s;)-D* z5|{K_u^vYQ_bt7ZZ70qLCRHJ(xArDH(TI9x7?Hxq4t2p+)`4tyl(%Ex=h#=zByr;O z=7!q9atiQtd7^ZqQQO=7y~izn>`kPd@HkzB&t*)J`nuADYC_b~hQ6Mk;0}14av$o? zi>BO_>ZM%4U~Sc7D;;sWqRMT?#kL~>2OUzfvrLpjB{9>Ac@`*7Z1ULl-R>oJ_i4aG zsECtBj@w19?ebyuXV0+jZCRC@7l$K9i4&XHybiljVfbv~(&2>E7Bdw%Zp_+sWjeq$ zf4hV7`u-ny`e_gSu?<@sBZ5>cEvG&!YL5Gp(ZcR`y|Y!Hx1c&Ec3dB00K#gM<3ay) zxwgr}&DnSh=zLx~C1f(QYfoYN1Z9)90Jv zS#oXrq52(mhvRDRSklD`+x73Tz*ZXD>!<&Hj}9Ld_GA-fjT!p!ltYtC;Ak)MaK8oO zF;w9y%EJDlP^=-C_`Uq2>b`l`{k{pL=-13Qf{Lz@dU}9@R*QN{x_WOv>V(n&)OZI3 zoYmMB8G#<8p1W5?bgwXg;ufBpUzWxl0UgX zM8bXoKR(idE)$SqIM`Ez%~-QKWd7QsGqVc%2RO_E_(0!hn-5D!T*G2fUzr zS*q(cJH;cA0!636`Zh=Rmoxg*G7-co#VYw1=I=^QV8u6P^gWqY+|I-GmoQEk)GHXr z#>P}iRNuBc?mZd~rEozuB1HlgtrD4a#VZDO8CY-L{fZ#ThxTeWp}=$NSZF?$qf(~9 z_Ex8%a6 z_Jaz)r6dhsO%!|I*-~S0hS$y7^IKf7A;YJ`uQcC`W`|+fXzs}0V5Uo(8*jxl9*xwW z^(EU$+4Z|C$lt9Rypa$343N@k+Orj8D@&^@9f+rP+gby?0#|CUXuqX0JBdR``6ZO( znR|Y^P6)Jkh22%zEc@xUqF7fFs&(gp#+-@+H89`mkuwu>EVeaXNi0IQhb1N>0@zoA zCsWa~Q_*YbOh~OY)ZXal2~IbCU%YyvcgxF<>KMzF*}6Lb^H89m-(lobv_Rfuc~8y2B|fTcanP~y!Ba0B%gI8%UbNpT1-FIFOo!1+{ydP4de#1Tm3m2F*ys%(ZFjysU=13$K}~vDc%O$3dIRhJt@<{ z#oc>HC5hdoNquRG%=z8s@L{R?{g1l!sr4Ni`68Q&3aDCpfoNz=P$$7$qgIOq-Tk>9 zjr1!t9`_rPG{z>d!#v-wJR5iUA;$37=p_re*69o9LA^54lg}K~aVyMfRvG#Gf20h< zqKNkn7#&z_w3koiwlbb5P}nx9bJ$bCZq%x`W-?26Ot8WBLlld$nUbyd*C+M-=Q|@O+MYjf)MfpVa5fY5J*qHx{NC_;58;Rd zSC?B|%iDL->?4>m_#I2iwCg`ux80ha%lhsRYh(*yU>IT?uU6H$-P+AneGaVhO4QBD zg0W$s^+P4%9<1|E)DA==u_R4Xn)#%zOKs90S7mbC{@vhcAC2qBt!?KkJU=a~fml1s zR-83K-@>(@;Y9hSLn$g?J)z8cGB}Mg=U*s0GY#K1;CA5q*MQ`1cww-pq|Sho*4>=Y z&6e|FZ0CphIxCCgo>&@%>c@4R7iNI+Vd!Q6)EL@^=BWbG$2wxiO>Cck&fYE9vm`({uyu)>eLZ)(;W)IE! zbteJ^5{02#OLi1K6^rro+=fdsAM50c9-~6$cb9J$0MW7Ox5Qn7>k|Z^sVyxWr%B5`}5QNR);t2wxQF4Rekd6 z=DsvLB$`SFNs|X!+i)Ek+TsW}OnWWBt+pbf|#P8V=aG1%#;{BC?S9~1LMC4%Xy z#`W4-Y}djdiEdiV+%GHSyvl4O1BQh^$e)+R5MwB+5P6~7_uD`M(>|r!yEGYDoBOMy z^25Po4y*l$l|V8Nx|6p13jHFM{f@?&GH4AP@;Y^o((Lt$r;R7{ELw!M*OX-f))+EN zZB+{O)=TT4F|ijv*<_Ny9O?*yEZVhSsd-s!!_p~emoN4v9^s7YBPIsrU$oo*FISTI z;+QPDgnrbLvyVd#AOX9^6|eqTfMT_yu6XpkW5o(=to)yviFZa zdz#6U7W1a#w%_tVm0M&2hb_G6o$;@fVu7*De2x5id9e<^cFdpNNOMgvnmZ;}`y`!o zqPjATZ~ZELvdwUzH#WmQ$vI)exX8E&;gw(LxQg@(JErs{XA@mLY=Pq#Zhr&0h# z=45_9z?<6Vn~lgSfNP!h6=Dgk>BZwK_eM{Vn9$kxEZci`FjG>cAZS|BDqjq#U0{_IC1 zl9r>@JzVqN)U8_ENTxc_Zg${%0E22#6rz|}rhDB3GzvQj!=a6OZ3J$FL`!ty6SGBi zccY6~u2Tsfr8$%COEYuhcL~6DyPULM>tXX!e1PhyI|MBw* zp~&!OmQmkPr}bN~I#`d!FP=`ht4`(-<2!kS@Xe}kod{6M1(olHyk8up8|2&K#_POx z2``4?!^m`i!7B!?EVHki`}jA`m3;-{^t{`JE_5kHnYR7D8mhkaRSyMj{&bOYA49-6)~JVy;>r|HjUNaI2|UwYc1E~|H1 z*0|`z(>wHQmul@TLheHzw{>xg#H@JtFx9T|oYn2_aLZ6nwS37DSZWLcl&QbGrDFAb za>Euy=*Z!rYPr}I=%x@CPZDl1yAv`Sa*$+{R?128^p z&UaMG!Hx{urLt=l0tUbeD+qfO^8^fWc<-0z*RJINE)l0>uo zDZ<#&KKqSo(CSc>RZE59);&(C>s#e8!mZ1YxlfAwS^4jXgash65d@qg-LAu<627*< zKpvq<8_I+G0BnKf_<}db^!GH8d#k>|*neW{B65lextF*5befpbU=Bt}sg!zW9#PuN zwUSsPltPBGec9Hv^LAhzj&_jNIJ^Y6a;mpD9_#+|mNyVok82f_FytB`*ZQtdvhLiG z^L>zW`@wF6H@E4s_0V;^?l1#UVk%?4yZxnvL$j=XikM&M^cZ7nozpK&%|g%bahS7p zR;geZKSmnUUMs&!Nqjqg5Nfu5?-pDn<)$LichM1!IOhPDSc}trZ;%8x1!G6lp&*xZ zq7E!IFJ?+Ou>?jy+vO4X66Hr#U_eG8{>(7I=`cj6K&e(P&cgxZYr5H z>@FWQCp!v36wGNtb3m+LC&!?Fp?H~JAXNkx1oVpVYR8YYtebDck70*^ph1B*6B-vR z+77qdgq20=l%15n*^KcaRdaig%C=y!CJkgfOZoet8o-G!iDV?e-6?JV zWCd^4!T~1^M1~7_A zhs-LM+C|`@!o@3oRGDyuDOG01B(ZiO5&%c%C#k2(_Q4C1pxEz5YBkXfJx0MSB>!&3O#r}V zFOzFD{&`jlv{~wCH-ba$@V#GFGnaBU>g@toqDH^?iufVBJkynnFZ8uN&tlpTx|hqWe$x6-3X3)=GiL8N5l(! zhXuF~rK-j20|Q&SftxoNyX2A-*Ba35!HqPKNxLp?JYU{5bU{!YA9kn~^mupaUE1|@ zcn1fTJ@G;<>JVUsYeV;5%eQ{EHjB`F*M?ld{NexdX#c~edBIhazLf9sMF_bVBno(_ zhxG_Mx9*GO5XWE-8pB&C&YBdLkw8IVvMkEbT}p|I3l6>R_wAnfqRquws7gBU@@kLM z(Bwj)2+ITp zHo4R?Qs3Ikm=9O$Laut4)ZCN1__q9s`ZaF~7W7r_w(AhN$_vETElB8lJ2H6&HmIIz zjPQ@DT_<9yzg@FItBIDfxwjy!0CKZf4!`&C5nj8~jm6l6r;p+>H=>~t5p`0sC}ie< zDtTlgRs%0YTUnRmOP!|873V;Xj=nS7#J=2#+TsW|jPUumze51U2)|32B7g!@_^_h+xcbYgC%z%) zs7^+ctso_Ay<_GQ8`72bMjJ9+YQ_q}4EO&t-nibq7r0%dUv#xj6IGkf)^mJBHrwd4 zC_h%jW_(uE)BXuASs;4NaZ&|kJhoP&H@5lI$eo?q+3}_9#<6$qnC!`vxNXzx-Docx zd}gN9P{aLpk}U!kmKE6Ox7_Jh*U+s3b`wwXc#;@43f8WM7SQUgRxf-YAQO!ld*hYt z4IjVfWlRp6R!;g#UJ+XF7o_8u%l^j8vdj^FC!M5+y78yeZ&mVw!jS+~2$WGAf)4`T zFSo`AqC%0Wkh><}`BGL91A4A5_oqT<;KCRYCDuK_VzckQ%2Fj6I*11OWV%6usjX$w zix`s3(wsfl1~Y@py1zIVv3~$c&62~h(MI^wXO7yvsXtk2t~aoS3nLC*)Kyki<_;3C zJgQU#ukox$iab?HbqY>Z3KQGQJ%4L~z2B6U`f=SC{(|xo}V87K*KceUTrHv zN?GGYIv93GM4rD#zZ7uXH=ZyM$9FpD68{xRc9IBq+Dg<<$U|#c!|J2bkK-8=l#WH& ze%$O|o%ic`TANM&$)Cm@NN+!9lBh|y22GeA?Yt>kUJLqwZ2U`*mvwsk`~|-;BMM<1 z2vl*{Hm`Wx53y`wgO;3*7r*?7dcTq^AYEfRWEYB+M(KvTkfnI+>W6yTYU?XcKBM!_ zuN{u4BmVEq<9~=t+ZZqEQN`Y7|2!yz{sB|;7!2i-=ENEFJs%y3bVuWn&5*#nz-$Ul5qRv~vE0DPBIRzopjXH| z{s>rhC7rA)6fLRD?GJWm0TZu|uN|tNb}~J~sDUoewu`Z!c_X9rQ3KMfF=C)DFHsHZ z+pHwV@+J?k_7qb%`?!&DD1+lqz2Gc1Uw6w!Vz?Ws>pI4Bex2;yKFh@ZHYNjz#y`3U z=UF~2M^6*$diu8UbMAJz-bVjiy65`kN@y@P?ffmT?P^EI(9Q3q+5d5iD(POJfP9zo zvM4xqHgD)d>Cq@=SjwHTg{(sP2u3*6Wqu5omc|B*2>20tKUMKwF)aH{qEgM8f(Iyp zK?BL7rT?C7^dqEB9!StBZw4hAs-e`Vd>Q&#Hz-6L#k;}Vcne_Wr#{!_e*b=S7it4B zDX4}Pvz3N4+XkH7&dZ=*((!&#ki(jhpQXrMi2V|N60+M+V#&%XOntOw)uB3I2B%9A z_PJ%*E2AKQE41ZnrpH}zun&L=j)52tC~=5QAS(DabH!8lpiQSV{G0Hy`o^=eGR{Y5C#awlwGsZ zgp!DU+&lcgMfd;cD^Rw5?t+2?*JfvrB!OPAMu!@Z=>v%VgxZBEo#02e-Srd8sLJU` z>zq{L_JTWz;1uFLGXl-6nJ}ab0H8E(s}#;J<2`<;ejt}~ZbKo6d#5i`{x3opVxZWd z804V`<^CriU>1!EZMzrqsi>$h*3szk-M&kZ0ml3)8!lSC!DY7qIz>1JFPY13Hc-mC zuVfzue5`ikzr(3zbFFwJgj(8xSvHuyw9RZRMAE#z(q2~BXT<-2Vg z#oFh41C(9pKfbi{;xdyYN2dH5(YfxA9=81CE*SM;EFlgQ=Dkk4H0)gWt3Y3!H^^E4!bn) z;D3c}S@L2yN+Tnqm^2iDVgW-Cw0wO+u>xbc@C>!!EQH73&r zcEqoH{@;f8CU%gY8M5GuKZwTU)D9>S{Tb9x^FE0j znzq&YZONKPifBNS1|}Ab?Sd#r7ao)T*X?NzL#aI1M9J(2Q3i_t`!PE*UtrhXoUhVi z^?rwovbXpVg5#siipQ*D9=sR&`mK@NK6sK*jQpra(W@guWyzIcG=;o9a=bMDvx+~!zN8ry zK^<+B|IKW@IbuXB;qEZ;%TcLn|50}I57n5w27A=O5Yq>9`Ja^QUqTSH5jBUXvF*lF zqGNi(_^&EqR4rnX8UByTGIy-X>%aXntIe`LWYrhF*Yo*N2Hy~4w%!?hmcsA&6+d6o z?+@XOUHIkG2jhp&y`*WB7{P9afcU)M1>!ssZ}xs2H`*G=;AXn-SrJ&;?g&#!!;A`IMx4CH@(M(Jdx$j1um1yOc=zRNuLr|>` zr10oQJ<2l)O|Y|>x%as;oT*56S$2xiwrN#>E~XsrqZKYrlDN&shlQJ z$F4Zd`RTUJaXER@dZ)a52w{3Fp?R-2dgYz5ai06(@{#adlT~TU?KXL*`D*83IFDW; zm&J5%mY5BKHWP>G19P{?vkoqc9;1NsG1QzUD=idtTc0>BCuJeqLku4a-j5xvTv%mN zu?NO6f0Q2P+aYc|s$0l2AEVPwOtVlo@I=O=XEYf|h?i%vGWf-+U1zDr19x+IfQ`2b zC4opAujUWjtd3{E?W$nCr5Pt4Uyn$_%W}ps53p{t8vUn|H(VnEiu?`@Q+Fr*jc;ci z_Qo}HzJpI%pS@4;8!oNq8z+QZ6xw(Ok$33^v76t|S^jP3y%=yvxQukv@8aST z_1wh%$k>2Z5y8RHzersrr}toq;W!8p^ANoCJ)SgiOLt%Qqmc>vV?NR* zD1m0;xUnTPU+KKE47|Ss_R2thk#VR_f*6+h>kYe#el9hY3Zy=f|a%(8uj(y-LvnMdai7 zAdB}kr78VT%txpEBPUO4AfejkL>T1Q!9ee{La{4iIZ+V))A70Okp_l@&qea-;T#QOP7mXWeexf?V-)UvE2Nq5SycUU7Lxq6;GCMaEtiewWlU4Fl`2ngx~W1em!)J z9=~->cZ){^1bL&G2cvDYeMh2!_SkxrGVOD@baJw$9sXI!?25R(t;wTV{PIAb5{i7{ zv%))3e%;si#pdsQ8nV1R)U1J9A)CEAS}6DYU|#F5`OqGWP1Ae2mTAU^wAAbz>x+PH z+UP+$Y3Tas6$&lu#p>#D{M%DR*}*7^EXlMz?aO=54D58bpO)Irnn@_UA>!J<&$4-b zL^_8>G`54m_?8obQ={$U#r=)u_k) z5y?h5dhLr0IhNLooDe1Si8-i|GX=dB_%LT8=fNn)4=vN zW`o_-*S=WV$TvIlIK5~&+q4qG+=^`oE?3_zR<&(V?V4-%23W3R@iII=1h}!QzDs02 zs%Oqd$GBT|IZ$Yn7wU!o+CFA##;Zu~w%(*&WI(Yu-P)|ZmFnXxvgNeoXq5-G*tV@= zHrSUrx(jvC`W4bkr8G)v`GkwoI;SIKEI}6QrsCF?+n+>E70YhtOfd}V%qv$=Cb-5v zPbM-$I8x8e=Je59O6pe8oyc@8Sy7mP(qte$KFA4r5Y|j6HqLJbr9L(}B0=oWy|pQ$o@kv*EP2T%7Mq!U9D7KL?_d)wxqn z7O57Gk7pUeLghf&Q3cGdKctgO!MRfO&p4YQ4B$AZK%u4i-5nZL?Y_0Ts8lLt0~c6y zn^ZCQ9rCSx5zO#42Ga#(684&EhUr-nbzJ0n-CY?Zb)k}DyjCr9Wo6}Djj8s{ryn8l zoBcn--K`+jzPGkF@Yb=TJG;B)m#TLXA$Tk_csfc8>YUjgObK7<(EH>%lv<@#`}Hh?VRZ{~ zy@G7q`EVPfzn}$P{-KgB?k}kwR9Rb;BUPSu;{CJ<+qQ6Xf6~qo$?O-CO_GWFsH*3N zi0-*8cCZ447oEc zRLnG8&W8%$HBllfA+a1cdI8;Sc3b^+?Rte7E)Yb`CWqkFlvrp?SbeI2);;MSAAL0p zi=B#nTZ;li*3xwP2)tgpUjKw_h%!I{-KQ=TW3=O7tY$=rrIpl0scC8E6U`I<+hq_j zc$^iFSitGMM3_z0!D>%%yVk5}QtDmE8tBm&<78Ct>yN@&K_6pW?)r!Y?SVyzoy8N}0qA9U+8geHJMeU7MGLKD0nO?0* z$-Xn$mi^8!Nm)Y&$1%8lyCLww|$hRKY?hFpwz0p+c?spE@ z_buXEP${r>xY5VL`e?rPv7&zYsP+7mGM#fz{mWuQ@WY*j&Ms#gwm0Qnjz6+Vw#(Vt z%~Z*!0T1<3; zP^m~gm@cnTf-v0)(G|BpLj^rmOwQw1Fjs*G-_O%tnWeE*{=91rI?1cqJat$wo!wK{ zcgHEsFzip2hLNMK{QN5-&!&gze?ZuHT*r#%b9%vLW<`H4I!W*lil=s+b>tL6{A_6o z*ZHLknS;@#DZA7B#ftmD)v*A^eJ@qy&wW&&Wdt#w(Pd|6KNN7VUDdz+=)Tnfw_tcr zk?FQyPkiunXVF$Z;l_J54FaJ(S|-I4J^e_mN-3mMBTM_tHQAeh^Hzn^X)x)V$AZm# z3$>d4)vQb0RG@sS%)Qz}bANwHVK~#rsxBMt`W5>TAs)5!+nZ^q#nGyr<7j5e$I%%s z(q3tS?V}Scsdg84+IS zFAbC{3kl-(^eES=LdZq`wXi&eZ5aaLwNcFiG%odjvM77MVwQOxe{1s?pfU7l{7X)1 zT*G~~j@_Wm^0vLrj)>bj#A>>wvAp}Nr!nkG__-^zjlFZ;-vkz+4YM>S0!$oHTyGus zWwuheZ2O^_J)Pe<_=m8q4(x#{%iDXjSIo|t*JMEvKN^EJwi66f7LQsS8*Y2{?Y3B_ z1l6lrT}6mP&*7oF0lA%9;PrpE@w6`siS!uY!ZR!rUi|q~V_UUiXS1|?8yVcE3mnB-2AG0A|)%|?lIXG8xS_a^?Aa3!jT zyy|4l30=W{75@FP>&bn8o#hlgZaYUqfXjkE=z%8NLucWPU}Xj>JofB&pP=0swYrS{ zuwJQRSiY(dJ{);0DCRXkzbWJ6cV8&Gw~;8@rv83st2=>Vm^y>UU6nm7r{13G0ohYp zIia}Q(^%($H96IuDjGAXLdIh{J9`nETw}U$m#4#H)37GJ;dQk1t=kcQr^W)^<9V^_ z70U&I=R)1dclN%mz5Nloi4IqFoUzYTr??;1_Ska%kz;VZ+*|=Y1k*CYAuTfki9}9o zXEyH+Y*^9B>Yr!y$>?q-5J<*|+>~F6tBxw8N2}~p*w$JuHBI3tOufb8FFmCYa6ZCp zeVh1As~_(kG8Ujn;tVtYANKBO&5#&3MobeV&`x1DTze^lRJXSD!R8gvbcZtDx= z8DQC#Mw_>NoYd zU6b2pj>dC1joNnwG=o>-U$^3Zt-FoM{di5_BzUgvo1MolNwPCqLIcZjrlNoj?bO++Y^VL2O!L zn|y->1ZMl&!&UE;s41aFVU1zwQ?)92)x0Pu)l}p>+2mJ(WU-VRDa^Ry&hzfvJ$zE| zOQK(`g1G$IR^+oaNZ4~j2r%f;i6SL_RUlGeQh_>(NO5r5jx-Q@wlKPlh$_( zoU0>#FN^7+dIyY$X>t)_ly=zD0z#1|y!v9B5FLB^3)xb&aw~$C7YJx>3J9sUvUR() zW>foIkbW<9tE?A(O#$rg*;z9s<=d!J#r9^Yzjn;-gbx-rkDHI9l0AnfPZl-qQ9El< zXVm?2>)Q9E2adKGh>hVh%&vDG(U&#pmltg6Lq4b>v@oQXtJpLVRoF0~7tzu;6tR|N zEPaCoz1eCC7L!mVuUmm3=E0F=;%rg}BP>-+c3TCzpa~mhCNgOsAMgmm8}@B|Au>CC zri>C*{#1>!jLMz)ccm*knzt*LDuBxM(!C%O(GUTh^wjlKrgyDlMz2;!7O)@=#70>o zzDro_lD^xMc&CL=s={hVPI_@xxC|JVK3^hF!^{Thb^G$i*i*4!&Ic`W14=u)D>wu< z$x$#U-s#;#LRlnR^&H~r(dzI)sZNKp*61|Mg=o@uA5VDa+CAID7k8J0X9eNj`e8Rl z^M0#|e54ZmLH+rcQ}Gbq_4u`8t2(r_lYGTpM2orQlv4k^YY$Jnj#Y(9y3-f9%@w}R zTEHx6R}-R`xEtiQ|H|YCEA(I^3rt9iUI6#1j-<$$3ds(lxQFdS`Wgj(a0!(BKEzgK zt=4~5*Q*v?bd_{MOC`1on*{l`yE+qCpw#$KY&D5^ zMTvST)(P18Dt|a1KiW3t0gwcgAJ21LtiC{;!n7pmx|p1x*4zDTpsAy7o32&M z|73sx_|e^1wk*NjAsPt>&jKjpncY#>+haLtJC8^M=kjwSVm=+#rLujNZn1~iL5$gU zMK!!^_<%CLXpRwd%Kl0`!sQVdsyWPYa@pxB1Yy{{^*TYfD_#?T^DS}-+)nT2;yRrV zzr0Bo)n2^yJ`vGdBxfYOy-yRGD2&|lxIfK}Ji<3@bYTv5*_i`9PJaAGsc5*%%M)|{M_Pd(CeQXV4>|&QhTM^{Gl! z;-1H9ep5Rw#cizaS?DqkL>-2ITduFia>%;q(fRRZa2>RAk4Rr&E!`)O3b@MGTf+=r~oz0jAqUjwq-KO6;bAeP49HNpEUi{p+K5acewU%-CJaYitT)^1$X{vw><+}FIfBBC19-`q15 zKU+Hx-~IXn9{v;-6<>z>xlXZal@HA*871NH+iOR8AvTmQiWYTj4gk?ANYb7XK4k;- z+eZm5F7V`=+rye{?;l-vC}Zcf>Ik#n0uZSEs{BwWbt})i?o(ImWUM(h9a`$4$^voE zC08x#<%R&94dZMDIi+RgN-!>y7F5ed@H31O-t>f`DvR)DCc#^>h*vGyYv24=kcsgC zdhHL88pN84!}=9B3sCd%F8kKV}R zF=nf6!#yL>yygw86TcIz7$Uv67#7-(W^d`W>*F0Z_j`O_x z$7|%_FM_OH(`kZ%+I8l*)tVUcEz5co$na(OJl16(%nzBuLsuti-Q8G6gxrT5p#9?K z#vg_X&$^9W{d^-ymE7ava&u^wocdY~pYHoREec()@0mJ9BxAP;?Qm}%;G>aXjYXqA zlyv46y43F15r`Y`SZaV*y6q*@Vn=HSnlXo$=s%TeY0Fy#&1&wWhAQ#sV5>~5egjaz zl8Pbv>ruWTnJIr~mg#baQAUFC5;Nn$k0w8`!`H%y{KR0P(S$Bk$;vPIWZIq5;RG_k z61hXN*)QRReBC0d&t|kOL*_v~aQpFnxn; zntEB^MO}(sCp^inQ*)|~clglbh_vI4+=r@$px2Pq4$xH?w9Rnwq}9F6)8jcKdg*HnPcivv%b4Djb(0K-Dgs7{VFoC@+8h)37&HSv;PYnZ*uokRPL{@jJLozS{X>#vqN z_Xo;MiMNMj5}O>HuC1<-HmpHQ2o*H|XwqaTrD+UsVsF`egTA>p*Ws#6)t}hos`wy~ z`pGXZKG7iiLZ-j%kT~}>RDE{5=q|<`MtF&8NP^LqX4nn{N-kF!;Nl~_E(^mx@+m)O zmRD%Qr$D6;fijs%i}oW+Il-YvV&g|FZy)y^6lp=SGT$YNFr^iUveEfZJ5Gf;*Op26 zmN2@m;)Urb8H=ROO=*g{a;e`2An0v+hp0tV!+5Bl9b&2-tEy-&#H zvQ>97Sd04DUrY+s|t;yYX?wfIWPQZtT~vW4v=moGG?*%j_`jn+nQ#$LkejYaFbnh$?}$*uC% z4kSJ)$!o`(kRaGS_q@l99qgMvWqA}q#cntK0s3dBAYx$`ar(qTrcd%~ERmBHQ4TZf zWj`YyssH@I)5_r8bxj|{XE%q zP|y^cLq+iJgZsqF7wlFk<3YK+7*_^1;x>YCkNot4YnkhO0{ZJP>nIZK0=F%EI&C8Y2%m!ciW)>?AiA$PoHqe$sN^_T74_YdCsQtcMwh*j2Lwjn=VHg|As5meU`P z&<@_?rV}BDiV6uXgkwod-@TSRaDBDYX2FXfd;Wg8`6Q+H+vU`ZAN{&En)1<@3|Wl} zX44@YslGR>Sx!z!U*$+(s)0LLkF4#H`^+1otBijtr1kvRz}wcpj!z6B9-%p*Io*1; za(U>k;1o_G$Q(383+U!T%1F3rMKaYuTWg64NgiHhdg!HUWqOaTr+8!4e4CKE^i`j< z^O4XxJ!J;xa5abD@i66;O|dBYSgY%G63wM_bI(1$`(MlDdRdOl%p3dJ z&)(nfXRA{1pMgd?7~QPxUaY67cpD5C$E22_Ek|*PJfx%I+Nb58qG!GUNp|SlmGzc*)P5j|hy*byT+_&J}J9O;NdDs!C zA8m_-??D`0fvi$6^@*i3B%EQo5v&qY&oEAiq(Jy-2daqGRnF8#5F zL~D6Jz*1HXZlI!kXO`!J{1c{%#8uw$ggk!8{1_l{%HhevIHZ-)0R4ie2F)m*82nbF1(e#rv#Lq{OaLb~|fWge>A z^4r8rbEs&aJHaALndb?SSMnQ*0N-p(N{Y=NvqLme{G;7R0`#y>l7yx%gpzGd?P&?( zQg)CrcnykqtAv6NgKlH`ieJo;@MZTebp$5(z65`0G;n^8L=yCR_ofSb5!;|(P^{W~ z%E;ZY*>wTwds-c6#@OLw&_-8_{R%(+I~c{p;ZT>u+w7bX&NZtOJ)6VRpUGnzG*ltW z0hyXI6?F`6=)tudX+bVl37Qi%F~m$pJo=!42A%FdLOJy6_;-kCUcxm!9 z$p!ae-E&?W0KIvHFR#uw^A9oI85~-9`=66Fox}jRz;lC>5Jj7|IQa)20w2ITP9v{D zd0Fm!cV@?Sbn3a8QPc-1BVWAdxTsPY0E|3(>dQYSzDxyvC?>;RM%6u7z}6qX*SEKJ zKoB(WyCMiUK{X0L6wzt*X@~&j-QxbB@q8!vJ<|E8hsd_x_66R8*eHs;h&>RN4v;Oe9d4jdJ=hEs zsAMI}?G^O;dj?Nmw|;soXfse-E}PE1som@FscXx_f_I13M|r#$IkSi4n?a9P+%aRS z2rb%ip<992;#$fb`s=A*^gjxqD-T7yAO0Et`XQ0Pi&d4r!Wq6Ho??nqeJx1(p4THR zWBaFagG7{E3SYv2aiL%%vvnKbHej20CPHfT93<#>y)92UZWoIkxlV;4U( zy)|sHcJu|pRnB5q)!_oBn^6+0<~VXVsHx){>#wcK=Y)EptG*{}bzAN$lz2_GHb#9a zA-~}hE`i#VA)%D0$qM3NG_ncBB7^1KGs^k&=_*%9F#QLfO0P3#wk${|G>{}N8|;)JtZh%4 zj@-tarhiyreB2A3%fs1*5g8aY5^ywOuEataQ5I>X`q~ve9d@6fsY2e z=+D-9Xvm*6pd}1?74@DNKulmnNqGIj`}-z53^hm1Zl?M@tgMYfnYLr}Y`)3$2k9*A zJT%Rqx!~S;gSCUv{*$$bPDsk>u&~3RU7cIG>gpln2q__jKVD zxyzQs?$M9E83U@SW~S2&Sw5z|(BN{zqZLP*v<7pg4EpyD0ylvv+(1#_JkIUH(7ivU zLR@bc7$$*^%?o-J82W?UeGbQ=uHO9sP+Pp&*Ww#95HGXoXAZ*BQQN;bY!^2lc;a>&TL zx?b`P?|wMkK|d2on%jFT2ltRuy3n$kb;IbUT%^=1@;cFja`}wUYV`Hs5xzqKyF~7J z+s5~)xF3C!!fz`xV;vWSJc{Lx&um@H+MpOzc^>`yC#Mr$->u)kTMNu)lyZaDie6?| zOi_6FQw0$;FAIj#0ukcrYm@Sv80TWQH?Pr~J^T-|aJ&2r?>U2bAC5LzjpccQ(qC^P zwZ0?f;{EzHmVPA^Hcjf#Z79d-Mg6?*tE*pn`@S8*vGni{gYb(T#(wQOdvgvWh?M&z z5e3je*=Mt%zTTqj)dBH}U{W!!r1<}i61Ny=knAiwT0t}=ieVDzgU4JRNqm<^jV*ea z?XvF@OKzFOq)}YH)RdJ%RqX?Gm6-F-YHz)W zrp<@PI~i3iS&JRgSCh~~iv6ul^ozWi+dDd&ol4*1+pXy1w@pq?x;5~)`}gG&!r}(z zd;XlELQC_>+Ol<&6rY*Bb7K`34}Q-2QFZrN^?(N;lfHA?Z}CQP_k2>20440FuKixh z8m6J|x~##7abY@bU2e`NTY2He+3NMeiyP2E*BfuZ+I05Sc1JAx(yjX`E-3NI!sm0q zt-e3bpLD3vzY|i|Sfdovob*wLOeoz$ZDwfF*ui*dJvja|80%xo1qe6u%^J{IWw~Bo zJN}uRdeY>6P|5$hKRPiLc?T1M}_Aiom;C%U6%-j*2RJN>rK7azmn=$kFjVSJWdDsT}2iX$)u>=}2 zIDQv$*(whX_pU>Cr`UuX7Xv;HqG4COn~noXfjphuJuo~V%_BQa&A`oEb`msPKVCa; z!&(w!ngt}NyG z1sVs}5-S9RE!S57$D8%HJ2@{L8?UY;&qF*^Gg|mVP*eVW&&Idob_8sT{KBfQ|4#Rz&v8NY zA?6K;*BR^_?AlZ8tZlbdazf2bYRI?sF94r4*@1sYBHGHN=lXFfI0XL6*>)G&lB=dG zO(FMv-rO|VT^giRHs|vpSk*$EfiuX6uQ=Tp%_jFAFmQN94lGFbna70i@qN|p7wJu? zY6GnL-@3jkD0VR;(S~|uNP+?-(^(3Z6N#zt6v2F`*xVk~V}Nn6VoTiSSn;+c_uGr3 z5So-bVB?lrf2M9cU1K|i%tH8+yM9Uv<9Z{_p_4fa2hF74f%8_jiyRq?Eai3L^3{1F z{h6$1)PBN;kaM5&X-n&d$ZS{XdI`#9Q!H(pW?8A?0oT<0DnPTmLtf6ZiN)&c}`+%?4|NT)0YHKHL7sY-8Yzt z-Nu}=1r$02kv(+GJ=ff_x2r1id~DCUkA=@@(;DBl8RQvRmxo85r`8d6GMRjvHl7CG zG^zD){+MR%uDTiJ-JtqeYOjj7zC`z2Q4o$6Hy8y+=JOzX(@>dIlzhOt{IFL67A)Fi zE%50|6T^0~@gcQzl<4uzvnjL6g%np0M8OfJAQ%-QhL*P6(dV4-una09_|`%2Cb&0T zgyN7f;1~Xo3WrQ_PpUGa=ks!hsB%2kpOk0RLD)u)VSRF@T2WEBLxsv&_P$b`#!&+a zDO78Y0RLh`HWWt--Yy&qJ@!yJEb+#FJz^HqMyd%GYRnZ*VkFNl6EQ__fu z*4qu)4Uhh1+?Qvn427I)Ug|b`h=uwV-KfieNyy zhA#DDcDvuc|2J;wvW^5Isi0H-qssq?Z??s|t_H~{RDfN8ffN2!HVhT9Mz_jhnoCkJ z3;+xqu@RF(Wp5layPUs2Z6<0jdHIn$0Oxyih%-q}wfxpD#>@Nb-yFKtR`GjnN*O|u zBYDtEsw}wcz)ArkE;TK!TXN^OfR@+Yz$yRoR>BmJbqAIQ zc2}1l05ybrPHfl^ONgY0bWCNA5N*p8r1TDmwSMrkfZL#;3Trk-CeldSk2y>U?4M4h zdT&=ZzrnDztjG1b{R!R}B+LVIIbA+CoGJ)sAtgmJNs67f`sQ)6gDpdCk32g#4jxHP zo1>c_WFzl~${`Y_3C`B5wlZ1yh<5?Fk+DhR(WRfgL43Bx8u;1+010fxou1f<$BG<> zk#iiT0@A6yT)9|^6&WFr2p}TO3%8daZE$5tctXSv8~@!9a%(KmdT7;k`t{0h_l{j|7q@cy~0CK$IAq~>6hvqnBrEHJp1Y(vf1D9oXSp=S_nkX-J zSwJ*94{h1N>8`Uj{74_bIT*aVJELFwz^bd3D00B>c;ZT~8~aDRc=}!f{mj3Y@-I*n z#1|xEW==H}S^t5)Ep#tBroy@*(MWqNRTzUpr{mrrhJ6+i{{Y5n@Q|*4yXgLso^8R> zRDXh`NNP*X`<)e5b32KZSjCi3QnLLk#eu~K*}>Zy6g+Dt?NI3_D|jMd5TKWx^+unF z8kGwJ`xb_bgKQ*q_|q{Lv-#c9JiIb#auVf&Sn==NNcKu*h=@dgr!gSuzx(VeSOcN; zxtMpS7m+yi55;p*77PrWz9z@6}!f;Qq^6ZKQ~$E+JZy;ErnL zEHS>$WR}fB;!4tuLVM3*rsiPCill_|f=(%`Nb4vc?F>rQYpp7aS9orat#&+AcvB#+ z`aZi0l!Q<1oXR$gVM_sL#69TnG>9Bw5lfRVLU}@q2)e6E4Vz{}#Du9ZaxHksd!Mcl z1u0D;7#((ZS~Y`vn~{gXFUJTymOB!e8fb1LqXOJhwK+TeQNi&LAt_MM1)<0dXJyf# za_F0=4g$#QoHi@|ffx$W8Duu--m54~L^dcaG;IpH|9Xh53{YUcmzs{Y|@0K$JK zRopu6R%pQS#kBx-a+Pujn-**4AY!?y^9sWNwx*oaAeE2#)UAnn@$h8JMerD-G_xB#VW$@BomCl%=C`gQhp z*q4X20UZb!(hJl+I00xONuhuj2o13wvY5fQ17?8#9JXkK#5jTRFX$SM{DaXp`1Y6E~hMNxu97zvz5qHue zVCMcObpGcd1BauyHS3O`X$ctTlSPNubRQetmFd9b8_Hh1u-2av$KiW!LpE8F8*Y5p zXJ4Ivx|AgD?q=;PIgXcBJ1KLm{7G9!<6i!gKGU#z*Pv+4Im+^0)zewJ>;6yBx?|Ob ze21pW72I?0i@~ck9Dhq9#C+Af=en1W&N_oIGbtlx_I!*59iVS|xbq@{D%>+W$Cs1A zjplYNc(g;2c@%t%EFDIIf%?OwUd#jU`yo;;=OR;J-l?kaUoJxcB-6@JcICtQ)KVv z&MuHAU403S>am=3eZ@U2anm3_7Nn0kf;~><$UbLzE+GysY{$dmnIsO}0!e~R)50Zw zNmxmt(W@y^$#jf`RdnWnK5S7A3x-ufQK*A|2`sk{Cuds|f3zHq`bH!^=Kw10UACNA zB_AUGtC{le1271VXbyBKW!qYh=%i+3r_M|La-o4o0rx$`P2&f$@W=GRpicp~M*VW@ z-n?VT?<2Md=&5q|w9i^2LW1S3=|1OBB%_AupJdv+7Q6Oo%h#&Fm_>3DHCW2KukkV3 zJm)jd*Zv|e=tHd;!%(<$M5qlb4u8F{f@hPEr8W9datyI>XC_^lrCw(#Sjj*q)v0=lQ=S<#)0TEak6)`V&

m@q7$rX94 zKzycyIla@;=Z5#sq<%oSw1(oPbd(mJj4G{h!~Wig&`rT7|a_(M8V5@0|5dXw9UV60_qV$@q&10`j-TPBpjBpZ&Yb8rvl&X z`JnW|6{Xhk>_l?3_Cu|}V@nH_9PCTJ2^@UjdI)tV>eB)lrY3J3aRg|zBx|7hS0LPL z)d8}tiQIyTDlveDk)gMpRBP+{dX^KNLSR00d!lGo&nfZG;`*O~*#{5GRnyH+MnMIW z0JV1nO$y_~hmHb}s>%xlcS0=`8PyXCQ7=$LVqPI`L|>V1)$@xg*WX&d@j*yil(OgX zGboY>@CY{I=6n<$OK_4f9}ok$QRS8_cvRIJ4SwABV&0NKOm0!$y^ENN(*)_IfCncQ z{+#>g@4?lo0>w+*JYUq1g`NxSLhz-w>JK~7MSGVgQF>#%Omsw@`s1h?B}CNViP-d# zN(=GHe6~oPdleEGyRpWwc)#oh&r|KRvxS)6fQ=weRu-~<5~5uPjsPgLniJG!l}mDt zIpw)NXPgxNagmAyb0C8~<3UKC12QF1_SpB5V^~-M0<(}?lOyD+h+=CpM$#c{=ia*p z!1eom`F+_%?5Agv}GglT|vPMKonr0G_zZ{&q z4*i*JM1Tl~rxT3bv$h8pimx^S3Humub8nL{J#x12T;a5j@*QjO*WgK|lBF<-BS(Cl zP#p{G`fim;icV5B;$@706cnzn#%+FjYvpyJU=Y_(rm3}f<`~}wRs|i6Ht{uACqcag zSvT--p@fp!z@`!UIE^O7cwnje;7G{MNB@2VDqP<3a%Q?=NpgMf?wiqI=QglWKEa)n%kS9}_ z7dA2Ar}0u~ZpFcy z=zqER_8(wnFc~6RF-MJkJ_DCLgavWQBEY|^UkG-2>5)+hI)cxQC?oMJB%fKscP@zw z6VivBhE@*)CbDf3>sE`%RBNcx^t@K<%*LAEWF)*eutp$7)OU#nCuvQN9#0XL#K(Y+ z`nLVrml2By)LwiKKxi%Xu08K62zJq^pYkXy1nSOc%3N~(ZI|GT7Pb=FIsnWzcpJ%5 zq4mouQvDy{E5C!u6bQa%mIEQ{CrZ<9s#B*u~_(YTb=1 zmU*zA^DMRA+f<~MdM$2^l_`GYHvhr=-O&qam!;7q9#9Yd%=^F?bGGeVH>8Qq_nt*t ziQ^KHrn`K3WN@iNc@5h?9qF-!Zw5rJ;f{y|jDIeO5SX*v(pEf;(;n{>qvMzI5~Gv4 z-I*3StZs@VKm;L2-*S=Je0Y2468I5-odfK%tV-(>t?35aIzLKIXf|Q9SUUG~o@fxK zKqn#FyURRYqPHt*=5vFG_~)uPkG0Z~ri|cgR5UC1CI`6EO;fha3LE@?JxO z2TWOG!=>L6i{$4UUC&a=kDV9&E(Q$UFXE3@`?fXv_5yn@>Rucu|NJ8J<{i*0SqI1x zV~g8>$lIP*R)LPp1gM21ZhY6@y3=90`JtLe`|O##;P>3+E1-GhGos2pBfgD6B1Tb-watwQ#{5>n9uX};I=16 z$@EASK5mwRq;ZR2x3 z=X`t;AjGKk<*A^a^4HC0={*1aDci4TM@u}NKOWt=$1L{MzFjB@)dI{Cte804$vTYR zzZ&W8(I^saym&mRaVVf5V2cgu{bw+T!xeBxWN$fDo33-n8cI3xZH#QaSU`k1muUX} zxgCR4xjMkoq>$ni8clKM74rQkcy}k|_%vy#nn0hNWBMJw6&|d0$`s5%DBcz>J)BGtb;dGDQPTE7Q$}@xme_6Z`x7(+^Ta z|Mhg3eQXDysE?3KT`}>xOb>1}4(m(O z(4AWC+o$1Shqn*H2CAYDz`=TBUyxn70%R_Pbs;V@*7zE2`C zA8C~ydh=xZ_VA|AL$~5A<@7*>Jx%n;<-ecgKjoYtEO?<;+&YL{2l{%|Dq(ZKa;r;b z91UuFX?0A0wbFd6)Gy#Q()n79ufg>GTp)W+M|dS+E#R|kLEPYpj*rym+ajC5J+;0r z%|%yc{13(4_eizBF7c-+(ik;qI`e(L@oXoCD(4S`Y$f96*+gk-Tc<}e6XE2$r-q58 z(>mXaQ8Ofro2_r-s|*#H6i^q2lc}%jR-FWqY3CZZL`}Aq{^I#NreCLqvQypU zeay$Wbb4@RYkgac457225k=>Ww7R?eHZ-|;;Y;d|4Q@{ZCmSW=})nQd5}$3~dttb&{v1p{W|fQ^ur+f8?SkvFU38Ovj|<>R2*C zYQRKSJ?F6+Jr1P17_*jzfV=$U5&N8wY~=Lm+ta-V%L`ObPmAj6&xS848gl~((;#AY3t3C*AYm5~S!CtePvmBK zURpn-2ue@NoC2dYR(|plz5jqx%E-aoq)zxi#Ifo(%~4it+w5zZq@itJ}=qFj7} zoh2Xt;$rfYc%?5AyT7*um3zOGL`}P4LWKr%n15($U+hF6oD!az(`ilq5oGOCd$$tF zK`SCMw|R8y^?Ic{96)DWC;~ly^KS`sSFWj*z@qg?LM^!>P>JC0P6yy5@&KLo^!96D zgU_4YUlrW$`vzHgxBE>8-Rn+-$G(|K-w?6@%j4uHbp{C6Zg)7|G4O8+fYij<07JjY z?dv|NDQQpn%LN&}|C*iw6Ooq??h2rKg}cv)KPdOQRZh83q0-4n^yk-H7b_KN{kr|Y zV3f(7B=+^W&!z=RgsSYU`D#K)=|;+a73!2;dp~W|nxVx%-X1%kW+bK?z;FZMbISdmVV__dSK74)Q1+QcR=v^~$i7z*_`?%MrujmWo-ZC&EFRn1G0 z;OrWd*>friVx1%!l*ec?2=|uHAiG{?Z)oz>{Zu5w^?VrDpYaqZofiEDFuCd@I*kZd zuls9i7HE4W6NGg67Zc^MgADYrM{EB*g*AX5vR4 z%K?DHTsU#XEhPS>Z*_Hb{k^u)Hyk38-UH>i?>oeSXU!>iH)hkVbjKGk&4lz1yRaMy z82FQZW2=E$PV^+B?(8bD_&=g;x;{L+fbJ3}2o+VZPFt)`8(q^zhmsD%6D49a_L@qs z6Fs!Qz?GZBtot+k1vKS7i({c*$_4Lk)}lT*53ww9yz+T{(vc8~FCCMKeYhSSE=Q67 zZ$XS?9^sjQ_H@hE?pL`a^tN)4 zJ@Ika1;Ars0PuR_;$2pCZ~Cx488lS7>`XGv{{mXi>K||_0KG-d!O5*KCdPKQafI5BF(ibH2@h$ zYIy^s%g2D626Y3G9)MK*SgorY#NzQ5|FuwUop=k-z$%?LmDom?Q-RmC;In#cY(C2q z^t{-J?<_C85kG_i-Am>ib@h7(pb)ie%Aal000Yt!ETS3ul2#?WZ{G63GaU0 z>!=D2gL;)n2YI-VJdBGf`FQGphN-XmQx%JQvvt2WJ%HK-fbT%E23S!^OzQN8`p(LS ztX-brBPq@r8XAqYt#0jmO*TK6@1i8*dPmaBPF7b|%(ll1u64V8+j-LGjX`t;^aDd* z7yHF4Y)hzq##+%5eXyfX!*WP!JLk}jS$j6^0d4WqWHNeX|9L`Dfxy(48=aW{zp|Po zGTc$#uHz=~Ml1uFA>PJ8GO%tT(}vI$>%BgQW@sg=?25%nd@XNHexHa<*xSFUxSH?& zo2RGu`@s7teik~F=oW5*{mUEGcCt{Fnx z2L=>_VlV*LGic~OPe(4~GP*LVt}I$G;rwc3MD!w^Rj*neVw&D27p#+de1zTU??u?_@x}Gxj|x-ov1+xQo+L|W@xZ=fPOt@_v$;(u@k3+{)6d~^gN-heblmmmTP)?^HKH9ss# zAx!A}T3^@1;<~CWk6747(NhjU_q)Wu1IfaMzTMnLiMj91Xhs@_BwAzVlmmDtJsIws zLoCTdAVp6CN}xOQ^>SdUBYSKRZwhuMCP=}95DZ>CjG~Im1RA_|qCkt=ixRN_Sa!Ge zc5h*ph^voIo;AQqj*FkxM~#YtMK;>GP;SzN$l?9Ebwlv^?5|%yqXY@=r#@@&Ww7O= zSVONnP$$@URODv2N(l2AO%B=~0JCzty4uV-yCNpKe%fM)yL+?H<`iXl~T6W+E-4x6%L=?3e*qhwOOoleE15G z0J>`&zG2olsM=TTF4DxJ|9!B}W7LueK|HP_XYJa~vdM0>RXAOy{ZhlCv8MuiPt`*6 zyrFIv_8wB7?{YGe+}oD}InFNCu!?>GmVp{8 zBorbl*qXqo1{-jP|8ro{7FYI-&_md*Xep+~rbm$IOt;3>GQ-7S-Rr6<5H#5DfZNd9hDJjHkx02~y5pln#$}Z~h4LqRO zodn2^Xz;A*AvN-9K{Nas9gVfs+=POk8iWi%NQo`~f< z`c%|k+c^ny?)jym!3*SOE`*-vOaF?usVcABna50kY1Pisy zUcRq&9l;;tXJIe>jLLzusPn?W8UiYX)j7K!6x2hV?5>nJg8EJvC3V_-4|kGssH1k=>*_X zrO32+6_&ZpQ4+%mxHiwrfh7T3K#>c1J1>GH1{{jAnp#5h*-!lsT_`up6agp5M*#X> z-#VuEdja;ZdkJrlZLzXBHb@h|+-Ld#|IukRnqMz8N@b!*nbJ0ET7t_5Bu5{2j+~4W z6ckO$4|Ihl5d%|#B?hR(Eb#>{0A&8;cSw{3hLnU)AP)xh0G_f)&IHjJ+$<%Gvx@iP zR}eTb88yF(+7LGYW&98fj;!Qnm|$2~jtjiO+K$rk#DQm!5f9^`hblXkL0TnGxjt1u zCpvsX#cJ(l3nyMvnNr8q0+S}>S}-khL?KZh1tIIBH)2Zy*MZqKYAk!3-VV}9LH--$ z9!dcA)-HD5gMA6{nG#z*vD8qY2PzesGdFB=lmh&~`4d6Z!?L<#6fJp;e8VczM zg-}eXEpMQWQDZx{knBt9I=ckw8X-!Df=c+p9alaAvr_IE9x1U4551%gAT_b0mn8fY zrNMmlgqc%AGB$b=@f```5g6W>{l-xa&Ds{e{$nMr=+1D+*>*2G<}_)5IZ8y@oPj*p|Pp8lvx zy-r{nH?DbjbHe3mw&T{2XZKX|;7b^p1~ut*=kF`h&pLOK0%;99aiy4Ub`#?P8sACG z(Z6}ndA(;bQX$b`&qX^89XLk_=Uy$74oDidP#t#tJXC*4K@3-KzsnROFsQvpTd%qc z2SYF=PG_cHdfP!Ha=NW?Fj&oV0G*B^6CC%cUWivf;ljY84PybzEX}|s(8X8Xa(dI( zGHOGPa?Xj!M2lUKk62jX#*m$*;?E!FLFA$5n@eE?MxyKs9q6gSI8U}le>)w7fBcjAo^KA%l2S`OIN%{fX-#da+-Z+nRp|}J6V_O?WSp| z{gx#^wxFD{u+I2ncc8@eaG>7Fb?zxAv#kE`Gl&uAt7XgV`aJKOwYvF}wVl+WxpxbD zSJR0SVU5P0b~e-gyU7Oww?9y3bOv)sUm1eBx>Z%~-+#31MhR0TP$Wp&|174>p;?E{ z6hR*s0m`u%+VySBBtDlWYf`Fdskf*X5&3bVNJOTGcRd;RxGR77WO`e#mGZ@ZlKtQo zY1jaz^GDzS)%kU-xA{(jPQ&Urx0ma;i<_TGkGua1zvwZfvoVTKY2QDGvdDFOB%QAI zQr%u?t}b;)UdCFzylmAAIC^(_11D&rcv3>BD<86`qHB|3^nN@FcA!i1M0FboNZ4Cz zkM-H=Kt+&=JAaChDh%zZ{8{A`A`g*-qmMu&L?*{#0sz(ij&HRj<0=$gShhIEst$w( zX;hYke8iJM_2%+BwIsrgr`}`>LFycus$W7Q5q5i9+q?h8;l{6oKH>+@@=K{Bw>i8f za7b+k9NOsWI==j#w1h#R$H}npfmIR3oRwg5IiNFl-_N@di&Ox7`7UZI(hAbH_pz)uL#$^ZU0-}9DsaC&{LaasK=p$bH3Vqr;&l0aDqJOjR+Ijg?##t1|Jkm0xgz zrB+Vbg~oM2A2_Xdfuca25Sx)m*Rw{=Y-@Yvx}F_vW_6t$pz`B3@4_?&iR?>qTUEk$ zMH6UsPGPTUGQw$GLb2-fb0323iX5|Tt)gx2@$2IR}M;)U)`JWM|m{(@&~cA!M5 za}M$6(2i_zpFn0$k?4E@;@RvVN9NiE=4?)x65D7{Jx=4e+rLAxk(frXS6!{_*n#O{ z(r^mg%?G5~((kfURgD~SW+C{7fL2c39ukbBVre&&!X@Mih9@ylme&pT-u4N>Y2_yA z0w~0J6QrtmSi|i3Y#-ROM;e#^WC0lJp(jC`JW3{(I1f?MjHW#$a)XZuT3KrYglJ0dVlvf%oH` z@K2G(7l5KTmti)!wU_*ZltN}1!3p%0w}cKS3$>8ok7h%ObLYL;!Y%Q1;{|8#ZCfyv zPlM~OFH)nOOp^lq{;NtstFM%Q%be{&ro+0PKi$@6Z<~U4D~TRp`i6V> zN@J5RM0+kXw6J*CH2stdB&f;nThwQnCrz6HL@Qelx3qn76IQw=xM9vJJU zIi9F}di<>|u|Um(K+|CtP7|8tN=80CJTV~nqZUxcCA_3l{#{)uS*|C zZMosfif0bz8cyR^J~)0)9UjPNh2^debbcNc3zdMw(-+Iebh<2@`cj7+hqn^&8$rOf zkQJ)0BTOo>Xr+uLQ3Alwr5004v>uvZJQfP6TWP&FO30;1M8sOx&+I8n@Ih1HjScdT z8HpEH8$1Fg=E{=^U1(v@LSCy;iKUpXh{$4upLufFd;0-+SivW%%IH!UWGW!g2QU^F zeZJdDX4;Pzd+2D@_Vaq^G9K*ZYV;8&(%??!aQW~aU+HHK3kJdyrzn)~+Es%q1beb2 z18>n(l{S~A`%)mcEdU_h>)yktP$^?aXBEr0{R(Le96+e{d>PU;kOl58?+BFGsemBKn1L##Lomh+F~|f|(1Yvw<>h*6+zuAl%37~&YIiJh!T0Y~ zr{rDV?+d(}A~O_eQ>$Rs+m({M8;w)ZC8$y})$j$Hww+xO-w1v*Whg~!)EYf6MD^Fx z=}>v`(n-ntyGy9Z-+M!lMV$5rqPsf>{Xw%!skMW;gR2-c1{wHi+Sg>93-iA+L>KzF zuSHz8RM-L}K>pcp)NWM3ZNOZory2W>WV|JiZV9jioVR-NK;GCk_G4+7P{v{?CC8R| zSq}_`3{U4dEVj;cAV?132Zn-IIXIESRG}eM^Vm|vHvClU*rpjTu+OICEMhtwkuR_} z;7veN0hh36(oqEPk)puP;O6SwuKoy0UIGns`3BU#tS<%t_W#$bJg}HnqF!Hf9zZD`r*LiL z^?3sWIeZ&YMM=DT+fNWBi9R(#ff<#ZRhW_^Oz&|5h-R{TQ(hFv2!k5f^fNz~t-GSe z#@26IiNF2Dxkt}~5>E(Nmb6b)mr{c2qk_@e@tpfyRR=LIkWHa(xqdP<9q0j5sR-{r zy{EtEzpiilF%ZhsC?TfC;85cH!j56+W8t3pJ3I;AwlN(jsz;k#PgS5MFJ5krJi6B`FyfmV}+~tD<6O$VhWU3;>tV9D9{*iDg_T# z1kmg+0+ZGY6qDH-ONr*x!8nIRVP*d9a8m^1XWY&Q@wMSDl9S!svfq6TX_{`9%Oj$r ze>kI>)y$O)GgYlVo03FhzVv)RiiSS`W**N_g{&@oc{@{vqCM?aBV{_4D~pu-5p_4P zKhQRPM8akbs0*ImVY!fb+%Gu|4mq12%-+tKoxU}NLy2O`vz%XWH<~p9+5&`~Co}at z!bUa2QTen*V*UQTgdI>I8 z_XQt;JQW{uDb#c|rQ8UduDITiA6QR;4&+s+M0uFWMoh>1wA76c&op(!U)fpq71&;{ z3IFE};w1LzpWw-Xj1&;Nr~~d_lAnK+z)(lVB+RXmUgkqx(}cf-g&YQJ$N*Zlv(M>4 z<;_BJF=>xIRABiK7h|tUt-3ajn=tvKTl!}w4+4h`&z`@ s_!wxX~E7}{|XrBwc! z$AAjeJR0Rw>~s7oH>dyANef8#N9VO=3_-e5Z{OZThu7)BWqx7&$N-`!CV{eKq^{aXU5~Q4r?=^|0T}2^e@=b~=AeWB?p~<}b$&JbwPOl~jNG z@_#m4*NEV$U?tTbjOhnG|51AX>qkU>7g(SKEAEQAsF;RQ4u|J+Ub8tdj8dX zmV5;XVoH$oeGml3SN!?w|9${shG)&D)Tm2K{Cnc{pI5+^=)nQo6Xb+**l?E0{}f98 z>rFbOB#K@TGO9pyHU>TaA#wTZ{2+3{WzfH{)B%gbr3?M~H&fuO6Kkv&;Y-v9m0A#jetAt4Io z1fvfY>ylT_vyQ*do21a?Kjr4A6?#ZEl=wM*BGl~{a^vIsxi7+w&euKYAG1F4{9^b2 zXeIx=>rh~EKm!f9CMS*p@Ael+5*Y_;$r8&0sIJ!mFurgcV-{QVd$GjYfqW#cE9aGT zg8$EX5QHN#Frfna2ccBY^8GOmjHcf#FyKy@{o-#jpP_UdZ%}>lN%eeJs9S`682g`R z>CgMjGQMUTDNAk{%!ONd4`ZZ;RIIwa|ZdjBm8iX`!^)bNQH0I zIWas@%JT0Y&guF~>uFK7?|yz#(a9aSB$`@MiWL4pjmbiQ6J?$#B+fz~`t( zaEipb3Ar9eesd6xYiY;X0)~#f0R^TrvJe&jL<;%MfjWW zo$KUDW_o2~{TC5LZiELVO7+YCkFKkLigH`qQc@DqNTZ-Mf^>s~lyrB9gh=<$B`Bc` z-QC?CDo9FqNw+i%_3ycP;{I!~TyWISGhgj@KN;5!Lc`bK-CHyDdaMP?S;1o^x|*yF zt9X_Z#R<;+t%tzw+XsY#yG??%U|7($94~|}Sd`j#Ve!Z;wnBtv;7nSo+b{HvOky}E zuLn}ZD7yzx9b4ceT>Nv>{(YwdAgPQ2XVws2JS-Q>e8}q!nuL1*4e(|U6BF|bmoW+FmjzMrPw45TWMiH^>?zo2830E;Z7~3@5x{jzFskKK z10C^~jsR4+B9FWqm0LAW5eig5Xti=sMmoUrRuC}^pszQur|liUJ)nRupK?WMrXV9@ zg4e%#-v_VskDsvqQebn$jzGK})Is4d4(p(7iuwJ*`jp0!h>#U37vjG3R<*9ax>Qv@ zvB)$B%Je{d%nqt@8H?AFi_QC3=BDZ@uvw5(M`xUs9!FnUtT&GN+0!p0W>pR`mw27G z(-4(B3xkF9KtV5al*pYoXGn8zsaW}`59Ua7C`>F1DQ67CL#4w|JLvF z{PHw)oY|b@QIl-AHpL({lcmdZ^o4I;rQ2S)ESW?$OYsdd&?$6*Ccw-2o z*DJ9xgO&w?9J~xIVMN0xk&Jo7Di5f3G?e+DDfbHSbDhjhit=?+yWNz-%9E8$i1kcD zaflc@((~nloy%y0^z!iV!}CpL3Y;)P%_Q;;)b=aw+yRp_t!OT{0k4 zQO{A?63{x?{g)e|Czgg2dCxXp2=6=6+fC}bTE?k5I8=f_YjwaIvjQ#TxGiOU0Z5gg zN?F)|xCGqCLN0xJ;M>%1C`#_H`aqn7To-UG$CH9frnr+Jh@RFCGL3}&0y)_nxE<3L zzE4%*9StwL&Jv_;= z>bj2DGJJ1`a1vj2oq;7dgK}zY(Ugww8%qjV+?e?1(SGHko%q6U>a}iS5Z+s--X}0W z)8al9Iu@G#Ew5cn^+{>0N*cr6m|$plZ`GvwnY)l7^ZMvRx0FTUp$AbDn}^QZ*1e+<8LrrW|#!0&EG; z$)y1|F)6NmKM&c7B$GI>85FF^!euOcprfMdB@>#8%%ntnjaq>UUCSqtD2)#uCLmOK zY{fsT04N|tR5c#YN&&*%iLqc>y?m)4jmpaw%(?uBzke@xahQI8Fc0U_>xf`lz+Kk8?G;mXVeeIdcPye>NzWI|2$5{)mAEqOFe$5fWF2 zqO~2?;IXUpzVRqfFN$rYy1m`+uKL*c4wp`$G4IvsS4V$~d;XR{d^4&~si#?@lape@ zOB@{^pP$BpmT|$?K7>7D1Rs(A^kv72{?m7ArumS77}b@=~h6Lw7kyVs(Vy zqIF6_CNW3PDA%rqUmsm(8%Ou+_ovpb+6{OXt*f)xo;JTQHysTRK6gD;QGa+%`^%p{ z7D-v@bVZH0cz5gho+cvs$}X-b*m`vZ{{X};BX}*>HedV-=Tq6h@JA0MAt;p&qt{dA zBebIz0{bwXd;TQBC$hZt)K1jYv83k{fQBso#?JeLdQdE;3U%Z<>S&`VBBA9S_3X1< z+tT?ei`Q~55N3g1MJLZS>-QCC-YnT~zwg+22)ZD~XCglV(r??;<&~ALWnH9-F&>1xt@m##P z&*~cVwCYp`ZH8Dd2n!p8$H^=^VX*U@lY}#gehiqp1lozW%LIzT1oI)HnClCEPRqkt z(mNIyD+i$HMUn7Z8_y;x2ss^oEqwXXj^%HH;bbO6ntbA5wO8L65bd0egL>R|6bbvf z4YGwZu}L&6y;?M#FZZJxkNTqSI~Yn2H7c>LJ}Hz@-ijstwv5l9!jc)~WUHn!eh~(3 zb4}^lB#2x=XXF}XuzQ!c^R$2#hW4d#%Zc^eJnbI237Xd>PeJgR0Zpi=+Hdda*{M33 zZR!$iuBxTaVZfY8HF)^0-aG2M<;!Qhh14X==0vD&KxXSl9K@0^f}X4x z5U%(GD7GEF^b{#NKWKu!T9!dkw+`+=e&+l4G#5f2K3)YI^KmAlUtVahLC{IcIH8^n zXo&wgSPNQ$w$-_!x5LCww07H5!>mTM2AalS-6sQD7=qByC4bM57t;8+UAT4`q#LB) zA5{EEqS-E4PUyVlb6nr#wlnV#B9;;LZ3OxUXBLiRR52X?r@YfU+(3u4>P+O=ptX4*b_IRgCkQn~U8nbvs}LLO?7NDOTNq>C*o zZS3`C{M(CfsThCB>N9pI<}(E*nB8aLOj$d04NIFMjLpTxhGyxVDN_c@G-WL+CSDVi zo{xxJ-&56@l*O}WvPU?j2d5t6UyZ4qejj8uyB9b4AzRI_+C}z_z~~Obnz$oI^`}p- zqcL&>=PlpJ6RL^%e4l=Nj|Rm#O=$(Q2+^Z#Fk~FDWnRc`O7z7ccJ}2bDiMRp>KzcI z+1T1VyYbb6*F{PC!9EQ#x!8pbB5N@q;FWw{QWOJTbo*U4HaHb!9wB9%Ygc9qu5{H7zKoB;*gO1UH6G ze*k-MwM1wdJt6TB>UxN}^Z*+hHE&Qz$c{SWvR;+ILUT8&Gz~~r@WRD>_%@PnxpmpV zLmI$*LN3NNYJ!-!7@vwB*s}2wAIigZbsC;04WNbzUc;=w>BAWT6!7#0}I9CWGCmI@t z)Y8T6)jQ4IJBxq>1M@ zygEOqJ4-UTC8$bTnRnF!)jtQ(_%xmhb5kEt&lCK5i2MTWJ+OKHG>PLwF(FBP zSUoa@VejWKBWC0O6Iq%Vk(Mc0&CV!epU5Ep3dI-)(nY$#rZkIXoE&~uiwnGm zy!#;aKcm~PHXlDERK=Dj8RvQbZS!j&{K!K~+UdAK$sp`}oN6v8@wY8JuOV_ZXFo62 z;3V~6xAW*&T)&|j1v|c$0$%3mwNKBc=zs8E?j-xw-lDx|{pvmpup9rb?9tr}*7ag%~W)*RpNcYveobl2C>xI0niF z26y&l^7?p8u6iEZGw-$uMoX*VB;!sJbV7UrNF5TI*`<0f^5yPZ%xE%UGd`3gq$^XF zpJczXa!-bHs>AaYgg8b^@YqjzF$XVEAH zJYYKz)eW`Kwr9hl6r9Rx0u`#SFqO4@@3B5dMrJ`CK~)&`2~CUBcS#^>Seo#s4tXJg z3?w^C+Ttt?paE;^qzi=ajd)L)lF>d26nxM6R;|KBGO~8PD=*EvkiyiCQ~W_!8@|*g z*Sp^l<5D!e#xzL9PGK8VTP=1eq{a`2IKJwS-|VrxJIHz$ zSVFBQq^P~xZ6>S@_eQ7;m7Uw=MPC-?t6(-U4Hszc$gE|KV7}Y#8q(8zC9F<64x}VS z)soP}Y~;#Wow#V1)9^kDe8mq)xm2Ns|K)|nuj{e(%=3BH*&4YR=&W5*qaul^qA&{y zpy7qY(A@DZXRGy)aO|FCp7|hk=VN z*2u%QH=ms57=N$zcapDGbc*NzefD4r*rfOq63~2X*GJA+_6mB)qm+iZ;(+mZftRB1 z2SkSLlrZ07jg5MD>3Vh5ObqKqQ&GQnYTeQsk=TTHXd(Hp@B5+uqQ7k|F=%Ndij!x| zZV?HU#qFY=x?K6-4OoTr(T6ljofR7dc0a}LeeKiz=>Th@a^8-z3aeHnm1vU+aZ7#tY8LS_nkZhmQ3G1|sjpBMMw|Al5WDtD1wng_02bP!iNhqLKGE zLhqFsQyxzGr-!}sTr!wJ+KXyLuOr6To$VUCtvu*zqXFiv@l4VYS!G@-8)csX26j!s zq5M90l3EKI5)ro1f6%jkebe4Ri|hYukluMyPya=k0V>Mgp179OvFMd-PN!gC`Nu(f z{?dLb6%BMNi$L}~jl8oI*5}zG)ZaKcS5D`dA}=2MLTQv=Q2xUGip~2rd1U|kGL4mis!MT`Zh@LUH!Ko~R;MVwA}Q;2m`PPLgDF1Ah8; zZb4ut(ZIIwW^?;x%hTeoLw|MN z(8};lnS1SwgkE4cI+L(?PxDbP6BpAMM7PnYfVC5JRhmIA!31w9O{tOc)!xug{648W|%He5+&AGHScOj^VAfhgXp2I%gkpQ||S<1GN%#qR!tRd=c8PNyTL0 zF{ydX8%^~`xD@{V5;Lxy7~1j1GhWO|v$!Ww8|b3QU6{X=fQtPz%+GF-TED-E{tKiM z7b6*?KgneKtaf1*_cgVQp2H8iMlC)omkjELHs51TR#sMhd^8&EPr$0C4IGE3*-P6U zjG<^~bhvs^6A8qKTM#=BEGl6=Y7YnyR!)>hce()`nQq#rdW(e;Bm**DRFhc!w_lyh zsZLk>3uD(`@D{f3e0ZArvy=QRt4HWNQpYGVa<}DZuJ*ffs%GVI8<4;NyX1TaX<6~A z$DnD)qTp9c!$H90YF3(Bq{Kz1Nd_tHrZB#468k}*PG9BZA__WLb_vK2-{_)@9|i9D z&5CWhmpW+8&$9olC?INxhAQ}rjoV{ADeUE6D(OJ;@Cma+3@As2?0kQ~C`W2~Od^jNn zT*MmrhvaxYKFCUTREh%GqA=OKexItr7S2qPSkD72>Hoz2!Jjs7bkPTx48GgD|DJ7n zXc6i=TCes6+)sw383N6tX>8tkB_|MOO`3Cm^ z^5z4~;HG}Q|BpI(3n-c))IZYFe>8|vzeRg%0p5-Q>)wu;e|>rW^WVZ9Llzg8kO)FK z34oCe|q|?vh#>8kB7DAO0#V9P*FU zSsA(d2rDD_-T{N0`JvC@(GD!D^4zZSNnY-&l%t>=13+N3sXQE)e%QT3z(_)C9^RB) zYvt)4fcFc7Wob<4{4a{;e|2?ESV{au(_Y?UKs%|-q_STmZrbmNwHzPhr8l;?_Y2SfU!M*Jt4VW^q2TV%7r5U1BzChyoV`QLvRbdU6%u_ms!~wS`mrdlEYYofe@jkc4 z7HUN-KtiqH0dRfwFL}`(45G5o(iEKkM&sFlyg?!y4KJsqyr$ z7%VkBZI<}i7Sz6(E>c+)cePHJkiWZH9oH@NAYVcK-%k`8{lAbOsU>8%TQN(Ysi#rs zsrf{q1ngz}j?`VXW}fuI3?oPSU|7EQeJ5r%BmwA`fh+vg9YR#0!7Ha%#n-jV`L-)D zpGgg#y_5}U5*)OL{Va5OZmIoP4=@7an+Q&{U;j2_{Nvv15ce&5_2y8~P_HUpZ@50Y zx$U7jud0p^ zBA&+&ju`QnMu}3=+^e_+X#!vB>+1zMeqD?7KTUNL2j-3^K>PAOHDwogC{M`&1#sH; zQBdF^b~2n!|L+&I9CCFD8k6h@MXbAb06#R2P&abN|8fT^SG++N-KYh5<0)>n8l)cH z`(TYjz>8K=me6^t(In}NP9{%^?wk2gO25rUp%ColKqa?xxP?xBU+3D}11zO~Q5oCS{^So#L~m^XS!H!2pm$r1c-7? zJP{dLQQEg8+s0S0)19Zr#>QJPPk{5A1IeAgMH`T(JAjm6Szsj}t?BEJ00Freux~?3 z!2ZPP$T<6#*TyOmBI_7N7H({ffOe)#{sWboW`ooUX~r1FXRd`h#@e5H3)zKDEc8AT zbtxrNF{x^>rrh=!OHGO{d%ZNN)IB4Y{X7I+DK3}&vAgim5XNB=H+=XX+vIeL>jFa= z=q!(6(j3eh0Ep9dsw*%E=y@?lBY-!d9$(7 z1&XP`-uy9#QM<2={=%YH)wn$+FX<4Qw>Lnhp1?QN1k74W-q(lHEN+9TLb~uZJQ4=| zhgS;h8An$nG$g1k8W@e)t|u(pG>uICf7o{WSE!cFmFA`2rI z-b1o9T2Gv(uWDq5Ixqds$UPculC-Cee}7Q**U0d%4TB*##b%CBH$`3!Wvxk$hxejF ztYs5^kxmlB2T(7(c49}~>d#-km;<9NOb!OJN!NfGcft|^X57fYkdQn9D#b*Aa|_OU z*Y{mZ0zXDO!+n}vAV-e^EWo9;Ed}RfKqwLof=L(PFj?&~#XkOCW3J-=UGb2Limj~q zD9pv?@-5!)eK@+@3JQtg7T%E*q(fv=SBD2V*2&T?7fJ6a6U1Xf&=D}jZ2(tMBD@s1 z3tT|A4Zc@Hf?tX>%O=F90KFlEtatOs`wyGRF$>90lo&!mh0uClo72vDK5qYDME zc8kgkRu2(~d-6$3adN*7M27I^;!{)GGTRc?1k#sHIP_cV>W^RZbudC%^Fl9Ll` zPpo1d+wz~HJm(u{xx1p#!C=h!B(9aq{${EkB-xJSD?gs!|2xmK=k$p4jeMhb7!eC2 z*bEpq-jMG3I@$nEW`>UoG*WjAy`wg6Gk{Z#5d!-^EiFHM_~768O3IBLLLum;M8vB1 z44irV)iV)hKB#v+5~I@bV%kJ9P@~(fN}Gw zOi2J)53L;A0yKYz~LxVL-=51)XC!0yB` zYmdAbKB&JBYrl@B4|`;G@qh;Z{8wR7Y46dZU&5Y1)@7pK-9PArz^*dz7VXK@n(SdE&OQmHz>A4grS4M*=G zr4G0sucIeNla!T#^q_#13_y3k1#MN8?(_goXAZ(3l-;-|VfEO%HmdYP%=kydh+d!t z>jnGVljFHeNzAr$GFtL|{Fhqn2U8VUbl*FpgLN!rzObk>LRh5hZ|z=FzcAem1#C$l zpmd#l;QKUQ;jQn3o27@mf0}iY%@KQZerXga_L6_^dEloOWYZo~0t?!sOZqiWVW@qO z+OTcZXlrmqGc#{K*0yyv>-qp@mvoiL!>!e%qL!CpsDD6teTi*tC`G0?nNa&eBT}wJ zHeq;6o4?fR)@-Y}+2b>wV>zPV6&S8vlRLq-t01z7t;zP(e8$T3j7j=q&Cq1PJm#@Q{CZD|lHp0dMxWF*7$iqrwaY_q>bL);<$hq2rSeH53 z)#JC;FeO`BS6~evNf~W$w5Y?IfG@!5FS#MC-`~-4LQpvjuk{5@zM|FP2?%{J2z+%O zh>qWHe%e%6l{4!LEwp%3qscW&{`-W@S7x_h&NM!F)lm3@G!H?;=W7_$=bcDtqjWvRAig z%a@ASV0b3nT&Iv&=6)``zjF*W(PrCY1xI75ueU6Uf!|s~RWST)Xab=|8E|gOcfQlE zIkOQF5fhNi1#&%OJLe8Ua5@BbNUPHV#bGi&QVN{BPwXMtFPIQ!WJd$Z2nM<8N5*`R zck^~;T)_-e?#&&A9R~BU+wDlXA3~Bk4b&d5@0i_^`~NDm+K6qhwj4bQuXi0>&#($; zXliNgxEY*N#U^%KhUA@#-0j&`$+Zda)!K=Y_RfK1k=@qYflvFo-R~UIY0ay){d0F)4V<5(>#r2YmmIs)GrhxVkh;ma6j^r9 zy$cWza}&II2HERPV$gDDO%304>b=e>Zcx|B(fz<|OUKl zS)BFDX>HfVCOt9!1)}rE_aJ<(@&Z=^b1&jO!ApLxX+B;A;MpRPHy1|9nrHS5&&BFA zX%nwDm0x#f$##u)tLYSs$88}^Ds6d9c-!Q^P?|R&{B}NdaMHmWl$>mwur<5rrLL1o z8CiGS!#lI9$hPvJt7dt-3N_hQR%QgUe48`{nv>VQ_x13t?s)U@b^T^87}IeiZ98~d zG=c`+O=A%(^$($MH|(*=9qjB2KuFKk04nrzu@85@MV@OtPsevpy-nSm-EGtFhigu) z(|KQC?1{ffgO(Q!-2gw-0P9U@pv;~vCxo#>!w_{+fGT?UMu^Jv7uTP*sMI{TKL^=8 zS*TCH`8~Yn_Z(~)e+5ZozrL!ZEa?N{Ay+*eDK**5{OVVcrrSGF{kK=4-jE7r#RWCU zgZN4XgA~G&6kWE{e8wQm)Y42JSbsi8keN~5Q6(q$tNoNpb$Z6h>1JnXvv0L4M|)|g zYbAVFCl-;Id|q#J^sHH+eKw5_RmL^4fY|gM*B%%mm=j#^N*tYME1^dQj|#)Ec$47-47q#^2USDIZ+ZZCk)`Ae$)?$4l17OHe?`_1fL zhHP~(+xjW(VRcXu&PuQVX;BuV-?#(SFALO_6Lm72t7Y7;@sJ={D#EdXV@l#uoHwK> zsjBszF}}qqCb>f1sY|q1AnLE5^#)s$YCAk3^A==9jM+ZFzHX=aYo1n*5EwjXO+bxb zsPfRFl4Mx0dzj|t+Isk7vk1JFg~TdD)uWu!N^ z1-UUWxt78Nvz+b>tUy%tF0>?#Lx-E?6RPz-Ar%IsPXN}%)R+YBS4C76mWR1N8(Vxh zHAcUC_cN?vZ-t`yWQMii7|!wy*FpO0Cl&orFq^Z$pu5m?ve9(Vs*5Qvb0zWI4J}EE zq{{^7j5q1L&zr(VqUVu_cXJKd-F?s`qJ`GH6gJ$3N1 z1tvo}?kzh{aXg0c4BC1w%i^CNB46Y|7KFGqHvA2jXYMOjDUYB8&0axreb@2?vUDzy+4H`}s7Nd{MPQt*AQF$U zf43~0Rhz16)TX1Yj@w7pdzi2y=`^d|Ep<^??4f84Ji z<~l6L(j@sRHC9=L%3CCf;zYqwEv>*Yr`xnMx{x~i-~GcsaEFaxQM6V9vq?gG+u+_J zUs1E?aWT%goiZEO_@R-JldQNOk-u$znu?i^UY4uXK~Ta}&n<^&zyfE{wi4`!#fmFK zbW&dXs1>bEyY9SGcYM{Bh1=i?jDs25xZ7`V5thO_xR#SSZrsj|g#}K{Bc>Ot_%%GK z8jNQ>TXD-J@e3 za)SiqBT9sNHKlO$Ei0`7T=4+Lnba(NF_uheO81xN=oXq9BRI?VBp#7?FDxs5YbSPFG3l`SMBf`Lq|SyDL8^{BzdLb2uQ0}2Uyd(MqY>kTF-oj4kNHGt z@_{2r?TP3nZ};vDL~q0#bM7r!wr;hnN`TpbH*zb9bZP?X$b}k$*YWdoSF{&)UzUaa zi8}=(IjYY4wmN~IWW2~Q(MdOt`}RyMP*O<1^QO5Kaym+3(?=~+FitO7g7NH`-utiUXs)3^gROav&Mjjpf%Pnpy{0V~w9Sq7M`Z?AD;e4k zOA=dFJaqI`#aQ|3ri@F;O8JrM_(#d|`_}g@r?Ke~q=91D)3ha}Ac__qwPt^`g;TfSQS^X}yWc^Izougdb$=ej>Qu9%=25?_ zes21G^D0zr9zZ8Ld9|Px>;M%>P|gTZ7%l`|(n5uvZLxt?q;09@4tU8+?oarOj$p<&dGaMjngXEl!D-9#U~`F84|~RWS+B&2elPC$_CC zbYInAP>tXOjb1z@j=LL4?@m$X_=of)N?>pIILQigqjez(6A%XD_Fctu+tNJbVyEsg zM)!TNv7QfM)Ul<|+_JDeMOi2rIW4YW93K3%^K5v|%7Qy4bXi03QBet=_6ZGL6d3*D zYYfM29g1{}ZP!E{n110nkjmuVhfeZjbsQ(SttvH2a>O&4%4eC%;@G*q*7}vv=sn5za2Xb*cp$ZQ?Z_pE!}gY0zv@$8BRG9%hkC}5l{6n<$9~*rQ5lSS6rv_bKwgJRZe#Z(!{tjI ze)qzl&0}?}BILx*wKqOe2QnRj5(BNj45cY!>L6#r?C8+*^DsoTGwt5sJ-Jq3=oMdQK9Kky)bJV-lS$*86L z`EL@U|9rU1lz%wDIL;T>V`5_FL}VhO{`avQfXB)zIK$W54-v)TQmKl&St11c2gq$S zhue>ciJyYGW+Yt<>BefhGKYXc<%u;#T2~buJB9mh06HrP5K&j`vVOTgAwmDVRPd{H zOS_~J{XVE1hyfZ_A_S2AwQgXiIY16j`EHi`@?`WiieeF1{Wd-{kpi<5u(+#$Uc<;k z6G|{=K>^9)vAgmAaAed77Kp5&;+Ny3+?FFx_U^;imK^;i7b1i)nOP7#Ou%L^Hxrk{ z1IoE*K+fI~3GMpt>joJ{~Y$WLVJ*h@um8M*=F}DwS1)x2{a^(ep1@c zs=EsxfeM<9tm6RMXq& zABzKlqgH@RIRgKzbq9I`ADRgmb)!LG)*xQ;&u-vmT7y?u!rcijGF(CF&l9L|DwN%jEX(kU(9KG+kHhwN)PoD71eXmkh1 z08&P}x7q#JsqU=+uM{{29bK!U616fXsdF zru39wA53AAsjKd;0%dAGXZuLPg&aF87eCCz#ouOxEGRQiRb)<)5fv8|S?lX7YtE}r zj!#zB66#OZ7%kTDlp9OxfBmjg?w6VFgq9H$_&F-|{8D5&_=njD&_rAcrMbo@cpeCz zFC08*r5a3iq`U&5sJnpTJMSoBP|ckJ=VhHX(jfh}!cS(mF`bE(dVFO=3>Gn83}3G36tIxl0M_-SY3%hbcajUT= zz5RJNx#}zfpRhPJ3+LhjjI~dZa-u_rE|~UgY_YE{&wRS9&td1qax9jA;SjP*Clayd}q{(z`BO0+)Z!kR?aAlVc9 zhHz@~xT-{=$ZfX!CQF#a+A-Wl!=scTJ$8n*qt;$qo#DqCC#R2IvZ>)vU#gd zIAU+w*wn~rYa20X#owHCI%uEVcy`!4zs9=3KGk_&aHXyHcizpQ`NU@8ix(Epew8)( zYc^7vM`CR!njy_+(LZi0e=%F!BH+r7_e<`nZA$eazdr;jG&#n?l-KiyRr`J4B#~BH z#E04zN9^~!hUSja@5_FW_nz&HaPLy0$L_awrOojjCo7~W=4^aS<#ZEqbx$48jkey= z`>v;XuD`d-vGy5Hc7V&mLX*F64|dy@nDlPvIQ-r0KFd32#f-i6)-PHsdDW*HyZ&ba zC-SxG`<@2%9E&ddUu=4NuclGRPsz6DX@-NHURQp_+87b!y4im`q#bvay0hQ(^X3-S ziQ(o3`R?G!MalV2@>>es_tz<#&9J7-#SHJdXbFS~6w*s`pU6SVh3Qg?wjSZ+iW%&M zR{hnCW~u*NdiYJS{bVV?SfR$xn>uU3xEDj!ZWF-u+$F39lfYn6>AW{Hj@sz7i-aS% zMAflDo2FT+w-sP)X=#~DX^b`OYw+n{$28fl6Ws;u0$~n6gwE$ikB*MKA}c^V-W(o2 z{>}=)fCKgo(%q=G^e&k+^ar0%)R|l*c7qjM5E{!<6Y!U3u-L`W-#Pp z^ik9KO-}6Ix{SS8HZ$>(67I@piN={|fgHCXSAF`)t}k&{Mn5ziCoa?dT*%w3Jq0Z8 z25;ka4PGC&G@j&^VEPvLB>3x3QZ04`pR(;4a>EKPYdcXQUfdoI;-xX5h7Cdk7^L1($u&_3sxsL=1wQQWkk=(>2xe+OX_jXUUl89ATRqVM8n$xyi-Q&f8S z=6rsut>(vvLzmJk;RDCE5YM5_6(ob`$uiI8UzaE@o7j8T!cdHbTdBnP^QKmpV{6O( zbB(twojF7t7qjR>eRD-u;AX*ZUdX=k?w&v2b-q2%z8CNB)KtIt%`kFnKfn<7Nq^;5 zF}c}7y6Ja2Ye#{6%lhr^{=l4tL90^~=K{$y&)ee%o~|CT3iV#)A_j{=h#kE#Pe?SR zdNBX^^2kR;XiGFx9m2*;R&(LC8hZv@JmLB-)8@kLE#SF0vWB7=yi7AZfClB>3-RaE zkrAC%WUV!Jz0Gwk?kbwsNJ!e>n?SeZ9$`@fXrw-*eXGiFVrJ@&wW_VH;p@I@2Te*{ zq4F#rz1J5@3H>*d;lwyjr26Qw%ZQL6pVkor*I9L!!UH;zx|WKsZyK3P?gUCh3X0ii z$SuM-j+lp03TZ>URy|kpM|^WY6T-gGFT}J1MMHfWlH4Hl>N~XadE_q0SJb#t!OA4v z;`9CeK=Z^b@UJlSleo7IA%3_A6UX$l7k9 z-?-0;TW@(ddZ2vXb<|CB1-aLa6Eh9eS>AVPca5dYxWxfZ#g*S^IpE|31nfM_D884z=n+P_CD84H zob9v%!j=}{MQi0iFkBA`-(HxiE-8FEc8&yNe96%0i>3ymM$r(dve3`pWC9!d9N+a9 zw0IFk`4h6}*}Yt`j|<9Cd5)6i&mnH^sPFxfhf2$HwQDVURP7RGM64w675Wi{E=)qN zVcx)2QVx2`(5^JERIaG~nz2olT3%u@+osNs)$K5>?>C0OoBBY`QVK`jf}>b!EUW3x z;qg_R`BU}N2CXYb$E!%pbq4m#_N2<17^ri5?Yliui*)KZME3DdIz!8?9FW%-ftH(| z0*;G{!WY?UmVG3rXdhrRgx+nMWm*fqt?vpqRl(;a zzR-Q$gs|S&(VWeSFPPL3!u3T=P5Oqh4fURF8r-wcW5!VylHOu9%Y4}|LK4hij_*Vz zy*v+`de;%cn^HUjP3w3FNc+Dd}@0Z|~4@p9_LG(Grn0c+69khu`V`{46cm znx>0_=Rr%|K^HJk)c0Z^&W_6)GD#2-Lhq#Kz;9@-ZCEv`it(AB0K+`ny0ky^Ma`pi z5J;f7avd*QGh6@j##BE`vwLdI{i^9>N>3#lMG>CBX_Lx9`KGWY1}%B{J2KTM77nBI zp>Z>_rjcs%QXehcdhH!qSRt8JX{jTFZ|;zkaIK>sm-&+dDs^=UbH9x{&r;0IuUAVk z9+55U{%@mA3wJzShQA!!-1d&#Gg)ojoP0h%C$^oI+y0@H=ZGJ*@mB58_&|wG;mlyh zlHAkD6()yGfxR`DBZCqC$F$g(`@aa{i)@|bUX=@F`U}GPds0-r+PG1^`e%6Can3=g zD5D99cEf8twtl~p^&DYPEn?03e!l0CV7c42+#J0zR+Arg(k+?Oy*p7?b9aL(CI|hd zs2jg02a*@OSNyFytn$R}YX=!k1-DsuEVlF2cK zMhZ>vtZHh^`=L_4)rnT^E{KeWIa}si-htnF0}n{Yd0F#*aiL875(xKTQfIg6{MQ*A zJrpie9U##5~!y=Wz5Pi4vXj_wqzTwTU_mDJmM?IoMf8$=fFdUVj!mIMx zvUceA6v-jma# zH<*(2uJ#pk&Z=B^)4Q#@;(q!A1NMFEO1*I0xYSVVWRqltCmT=eR7H0^acI(f?5uVC zoYmu*W0~nrV5QMEwvaB&dXyIXs`1DG5{ZFbRF{HidUxvQqhBGN=}xme`=OalcCcv;(bK;7ZhtqJQT1G5J}cddy;uQILr`Oujh! z0MY!>FeKN6qG-tvrkS#&QQ6!B&1P7UIWBTH*NyS9Sy#xUkphb zGS~_5WV}-4^#0VRU*!gUZnf;&?2jkV0o5zCY)Q4o%L`v4Dpqu#E8W|B$@9AS;feTc zt?p;G@dpu>DQX`2H3^R|iV^j=Ncl^9Zd_HFgf)mi7F!Kw>AS>xloh;Gn%2Hcsrc^V z{Ap95iI62r+E$G(=ZvX7+sInMTV(iHvbAjc(c?(fHnw@!XlpN`9ZnR7~WV@hpY z(AW314Y$v8k7Q65PJSL}B5s?3_JvXT+PPfMC%#ucOoW(x7(zJ zWWno6067=y3rt%7Fn_B~bfKC%4nTsH0E?}yE%OA845iE9DG#4PzKx3zjfAl)>c>pH zbsirX-sXOUN0h;epQHSGK?%$}OYC>W%xvbx>fF^B*_6YkQ{~3FA^x_E-47D4QM+qw zv=d)FcUbK)!XI+R-Q4ph#1Lk7@e9AzFC20kDIj21p(^+WjiF?GERW#3&&sYet~Bb5 z(sJfV%02w)RMWO6s&MuvTlt*Fsov zb8jqmM;WH{cPz{o3(7R!C@R-X7Tmw8kb1WsdU{z{yLC14UX0WP!{psI@7Sr2=NQ+B zrc`{ZF0{W;TD!PHQ0hz*w(Ug~AGWVbv~zq~@s4a#b8yl1jo+1iT-*E8(_V)~O|#rI zL_M5F(Grd)e5MlrV;kPbz+5UY#!kLZ9$4clu&4R zA1_O--Z}-^I;hGEnL)#Kq59KtI|H%8O;N2?dyf*+OeEvz?)>Q1M@OiBG<9i5C zJQ|mJ{qqfUdofgeayCD{Fh{u=8lVvJPuIkiM>{*;OWq8SE0ZtL&bnT5?5L`A$Iv%Z zOfVc?${7?Ksg*UNN|l)ZO$fSHrltPiEn#%pLxu zmchVUO}wAKNyYak#JpjY@4a+AZiQg)Z3GRcU8!!S72L~IBvB*+j->_ZNQ@R zJ>}0gw|W<>CA;GEsrQy~;x3_xAq~_YE9<;p4b=by1eX3SlxAuwtUILD7irl<4IR$A6rK*uhQl}^8nd*!fcK^8FHJs|ByXOan&3x)a ze+#yz#ScUlp}Rbq^Sgs}vGsQu?Wa;sOeT!HxenbMw{;_BPK7Ex zM$fY3Fa_nEAj9_?iYt54V>SB5!m{6c#cgSFjPGn_Eav!kaWT|=x@A6i_+JD@^qyZY za-t2=O|NY|!~3D$-lLoZ#`$Cr|FZ{_-fOUUt~Jj^^7DxjeayQ^ca*n`Oy=Rv6jqHs zS3g>IGhX%W8cYIA*vyJsINS5Hke7=H6?ype+;HhG+dN7i<%LnfP%fWU9)W6P>5iV! zD+JVmtYQx6!&{dFMeey08Ta)rN7}sKpKhg_T1_xyKe-g~GwPjnZu+$nLp8XY5BghM zHODF5=QbEAZb?I-*^cU51pOqAR__gAxs?h+1o=wk`!9&K1Rw_y!f2EK$JcuYQvJ98 z<535ZXdqij*+i7&AT2Ah*Rl5=ISR+BC_>7Xl^pxn$KLyx*_-TjNH{jX=Xu}v`~I}P zzkezn=QW<=dS2J#x~|8gy<))G(iuY^wD#11tv$Wt+={Z|;`+wk{;~>(L6?iXBy_7! z$t%0`DYKIbJV>1JYx`D(;^*~U{(&1W zJI5TA6b1x&>rn0vi7xWbyxWs>y09OllwL|5!swl*)El>gs;_QW>A9B%>~SjQnhHSk^;LzceiK+Lw{0{Qf~fnzNg<#?Db0A|CL) z%|+p73te;1mq!JEIvQ0;Q?uP}Lv=I8gjU3jGs;Qf{V`s2bD&bVbbQX}vp*pxnOlQN z-Q7hD#rCtBoZ+MPuj^@jH(Mz>(od*5zB{iD@v)>M>Csu*P#sc~9!Cm$sVne@<=6xz z9^dEK&*V*l&ZVv#IG-kJ*A2H4=k3T1_>3`0>MXqM-Dx(|*ZVnr4eELX?4)(=u-~f; z@sH64e?BBa1XmRc3)-fUI@$8P>q6@BCvJt17 z*{Kx8g@qQ>ojiVvoF@ps?Zv&{r8GZF7?!m&z_1$YmRTk-@#Jmg#Bj|>Q9gpW5H2>x ziTZNsQ?lFsDba2o>#h!yV4;YbiR`%_@=o#p2V|32(-Hu&1cB90R0OA@bF1S{YQ-=K z(Q4T!QT%#SFNs5vSG|0hsi~#v6SNryXR;qrcspjDzbP(cZ!NpWpZ2QHg#j!48F1ij2;yIRw9MVAF1Jwm9^2o~#kXiNV!j&bOLMc~-c-1(UN zySMz4Ozk4FIdUF}YcXw1ra27^?TcrkajVxS9I*HUkyOhsC#>>_!UhGV%~<*z=iYe$;5r zvaUJa&W)zU=j1lpIRc$Cui1pT5ETIbpBHQfIV*JNjQ`A&7!ywz*RusBssQeZFsz6s45?^MyOF#5n@UaH`a-E5No~ZW3ycb zH7qJE5$LDd+u(fDhk>-A#L#|Np@c$lHBWX*7i{qZ^mElpa)+8CHcbfcbM=Ln2BqR# z63U8C2rB6HV8(*o{o2d*&y}Y=VCs$m@5MZHJ(rgVpPl)0-6x2UzM|^2NH?l~kH*C- zs10K6xN|dtS5515^waX{Q{!R6k%UUDF1B_N48wi*RwabSnD-}4a4rLSas(OB*z?%J zR-zGAKHg2q)TR!sUeIcDtkTLq@NZc`Q2+&pUbyCJb?PlohmFJa92L<)Nbk)`z4taQ z<%RXDQIV@MT*SLpUvX~Nc(;a(Ig3_S1V##O&t6zPiaT~shI#5xL>%@h`3?2NXW46- zmH>3r!z1woqQMCkK6-`bJ}c$i+nrzI7X0RqPLud(n=nx$lvy<$I!?Woem)yyU^)=i zsEREFa+XS^%~!cgt{uyFHz$CtIIsCR4Y?>_q=ZkxZREZ47E#+8Qh`z~=4P(!CsO<{ z+}re{jcO>Kn_I#?ij&KJAobUoAPl8M+T4N9ba1#@=yh=L4E0)>M5f(U&M+;NI&i?) zi*`YX|6&CtoT$IIXGA-~2LZ$}Ea-X3Jc2oHNtQkg=DajG*+QgdGEt*$K z7BhK$5R+hUn2apleA&1zxsb~EB{5%+UyZp)N%k-xhgy_mJPgY97@6p$$A58Ci8@k- z(~M`VfJ*RX$@5>cO#dwI=nr0eAFb2LH(&B`euadnl-}+Zt8|cGTRYZITboFpRI(sa z^PVju!W}zh++R9p#Xgdr_%P*ChL&#_ZuXHyfvla&+Q2Z>IT-|1a)mZ9yBvmrGV23% zT4;bx=bLduP72lcE4jhpBMaB(chBTLEpy3{(xEjSDj;_jYzz1$D*DH=TQ`8rXKg5L zfA2}dy|Wi}hb#2B%8uJAaWT17!>{ZF5&Uu{A#_b8rrXz7pE}G+W34`_IG8-L$qqip zoU3J`x&d>zpFZ{-V^}t`xZD2~(xsN|5{QE-yKhM;(;Cm*ZVq$dWXCnE6ylZ!qJ$f_ zSYmFAwXQ-d6p|4=SHwH5{<0l7NN)zT?s&<-OS0N|#3?4Pk0%*`T60#`E$~cDcTJ)xAb?!4WB_Jilu^`D=4#`*Fs(K|m~v zP*TLkz=g*zVILp=O0jb`M75_dlYn$A$bt6b$+37;pQdR^*cY|;72NOcWcI?Q!$Ir1) z!VR*Wwj89^wHG7w7QEA3<7lU24Q%f<>mgKA|2A1Zc4KIHR9v^+Oar1f4q+`V{!r@- z-_75^wjJInfok*Ege_kX?twrzi!D?-^OU3^9peYQJ=-%%e0le1E-nvq=Vy#Gw2MUezx>QB_%cLiSki3fdAwCsalg#p-P`yU+gmn8{C)0R~iB}j=PC+&z zBL{Ch%hnE)aSJoEm5G&TKbSZlq)_Yr=GJhsLLOt4wp+}MK#Q)!tlyo^9-6aV-{6}a zSRS#AY9@R6y$v1Zqa?UYt~m2h`&z~_^U&^tqdSNG5muxJ&+;Q^Myw``qp43`S{7)0 zroed;VTmD~&=F46?K;mXvL? zCQx~$$z47C#nH4A_SC?E=VlG;5Ou}HK@&x+1=qDWk(Ee&0@M}d04Ah|x=%j3!E|)2 zhlYmW2ZIgrtK-FqrDWwE4ho4&s8{fnwx$d8T> zY6(R*zKNhpJU?vN(^@P$2Ix2)>u6&!H#*0v^3z_3|9NOpN+dXX=g7DhD8gPkVZ#npOMJW7FJQn$x?sCCH1d|`hV8Ml8;iYil5M+ z&~M~?{9_rCp>Lw-k@G2YpZ;_(B|cJuK+61R^lGK7E#Y6>xCA|>2>LEuXDm1$xG=U5MZ^m-F$f2OXB2doo9;bqQ?6_5G%Epk7BwdM&*7x z6ci~44cZf_*jmnJ5X&Pa!0ue>P6>;>nJJa5zF&Wx%NmzADzi;28Z^q$pw+Hr1hD8~ zJ4@iFMLXgK0&3CG3fBS`I5$C2kRe|zcba7y6eN2-1NqT?w0-Ra3G zbY^uOGjBea;$`fW{yFL)JLWi;EmYMo9<6>|J37oZzq=JXMgDV0j6eEfU@R*{-Z||Z z9jDKkyA!@t`e>~04X4(6v+NWuKfGLagx>ZtW)5WKD7oqu&+XNWq~WUE?cq&@&y34_-0dFYC1U zv?9ay2-`niRS7Ua`Pc}o-Ujin_XDq_%#!J05Grl^#IfVG#Ps>wYhJwQwMk+4cG)6s zb(4F0f-Jv=S9YcGsaTeB%qvd2xsIZULD8NM*m1$V!HEeS!}!BIG-i6}?Qdf)Aw~9z ziX_R~LrPFkoKQQZTK@WGfzLgfG5<@NsNF-nufc=WK@NOHwXG``8P16IXwc>HT5Z1iST)X-E%FHz=mCdvD}|NaJ^-6?^N_V3B`M~%>D@3SG9&^IRG&Dzl}^Op}$P^y@r2_ z+z7v9z7n>o(d@{l(F@dH+0KZMlwtqFzr1;kU_eyd*w{}9nf=b{f&RwnHq8(-O_2xi zogfaXC$1oA&Sf1?cv*~V;-c-^*o_qsf*egqEkJ8xwqAWYLvRYs%VwXazhw!3Xm8}KtMSC+H6(6xP28=c^+o!KPAKEo* zsGE!PY1%!)h8hBIWOzz-H~gcXb=1%-{q`fzpzYty(al#9k>^`{^-Z3fqVubkc6;{b zMPh(D&t?rj*8Rm2Czs=mjeK91Jm8nl=aj*V;Y zvvOQJXHSys$SLgzbz_ki$+XF&ZyuaA@n&>y>I{iFShkxti(z6Moj9!?Wy3Y_fl7_w zE%|RR6Z3#2GoM}bU4q7;t7jFV$L@xi=4Y&S=<^ev{14H}iPi-Kl?_?*yh( z_fFL=NrrIzybAs`@pP|&_kNWHZBmut^ZEQfSm5nWT-$|DNQd+Xy2|r1^FB|V-?x(2h}fz^5hnKXJ6lPavWoiOuB$B&nlF!)xA5Gy> z$!R2KqP$)RGoT0`SUuDlNvX;#jE~54nTXzP+`;e$xQK2ubPY47h(9dWA9QZQkr1Q?UW8Ggsh7*T<=oYQsFllQekVm zkOaHbXF9(`Ygt!HhQl<_j`Hi-(9#&bmuG@{HY7(1w|Ooo%>@iZRbrFOx62y5DBvx+pq$=?7;; zOar|@t!shZQ@9&vNE;73x@UXUysS8kb%d>{OrZ6??B?b6ygCfP=@=!{U@_Yp9WD%1| z^?eyjHRhFsd-A8M$S_x9*4Dg4AN@3--i;iT17d|%EmLfZo8?2Kl~rL@WLe2pZzede z&~q1O;t#_8aXriJxUU0fmzsj+L{-*KPj^&o&Ld)aguQxIMl%m%RG9LN+9z)EghFY{ z$hN9?@6Id(3Z9wSn?nO31UbzE@;Kj;Tp7p}!I~?2>U#ummYgUEQX$?J6yuGxnaw`? z$zE9>5`tdY!kj$1O$xUo$)ee+oF_K5VY>Ci;wW^i>veUKSBobRqHJ3Jt(VBu5_-|k z)z7Cn%86atVx`=5x%$KTu&smpr|bR4g5-#tx<~p7WB>+BAzIfPM>02cw8LN;tM^p1 zQo=ytA#Q9xU&dI3Vf-%!=P9AVz@G0{l2abyp92neUqj#^w`px}`C)6JtG2(ybYBqW zWesYtW6M0vMqCtksW|9sY#iSH@eE$orc@+NC2gOlrVR7ygt^?X3jI~GpDXxX6A*Wu zvUqgE=3Tw1wDIxKfLA}>%j{PatFiPdB@o&E|M|hcw>G%V=_Qj7fjj%t-M_mh_-MuQ@}#TpSBWZWT?YT(T;czI|DJ=xdf?8F zl4pN;1Mq#`Ngsp6Xy*2iKgShZ;HIJXd;0(1Z@c-1r3OI%9@1UorR3z~&I3ez*F0iI znf^QmfB`g3to?k2;cqSsr8zZW;_amSd7AD$qgVg(Wv|yV_$18PzkNB{PlBBnRd1d! zaktWX_57bhZ@vo3Uu(hVqn<>g;(uPf>+Y$0mb4E|H8ytgN@V{WyMz+5;y45FxzjO~ z{qdiJCn0#wUaW2^x+Tjo=Fd-05VpfuE|NApy*4!J3Hj^&6>vb0$JCFQ4Ze zQbyVS92+l*d>RreDr)U>1i7ZiQYU^gd;i`Cq|j_{w44ucLDc;}pYMHG@i7;N#nN^Q zi1`1qc=ay_a9zICNI~%LMSpt81Wl4+{YVSx7E_1(zb+1m4Qi67SBA$I^4gz2RlMn5iBlGA#x1P7@waMt$4Pfg`DAPkgs%(-G6g?{`*n;J(kSAtMrcLdt03Qrn>MUj(aG6!9tkN*6Ls_dM(8I zu4$8a_zMsaeSAX2yckH-h6+-zV7#~bnuHJE*d}#u&@thm38rQZ2 zFcux|O7y}?>%hgqBxWAF&p-p{}$6k(r90HCm%Wm zs%?<%5o>`D4Jl&BI!6uOX_3h7I%ml{dpD3he3sUba{J<+s{d|)vTOLPGY-F|<-O1GE zhIkQLnjOA}tz(5};PdJhDTMBHcswRJ!0BKg>xM2^<>0wuI=&;2odfy>Hu##G^LcG9 z=)5(TwfcCmYW>8v%zTg7nU!eci~*XV&eiDfl9g;*5F2Hb1=$}ont%I{>F##y*LO5r zIj-m%{pnI3wzP;lMw!+HbZ2Rx%eHMw*-E;5@2@GrPw@R|6TyO|96#@!^LTn1j@7sG zh%f<740$^InO$MZ(A^eNxAoRD0WKj~{nD3PF&ud+G?z+OBbm^#WY->?h1A%3vbF=Q z2o*A#DXwRdY`0#+)&#mAT95QoqcHhZy-$XElJRgWM7-pAXWJ^Rm7K+bdKqh0+!f!kFyDMMX5mhod!)fYy73(l0 z*%bR@mFTFgZW>xBCH$K=%%;~Ci%{!Tiik=+(bvaozqR@LWTsR`w^7*c7kxERnow8Z zxx=VcWcBuTH$Ldl&j^$(2^_7>HbA|EttG5l;ZbUQC6l8Y@n(Zj6rDIt!)zFI(Cj(K zC6^{`*_CfCtt-{o;l1jQ9T_aWeSEwHtGtn0*@8s7R%+D4tN>n&(Noyi{_0VOSlB7y zwa2}QnYN|rRSJ)Q9ja_9y1TULfMZV zP2N;|?(~QbR^HZ`A(1Gsekq369&o-6)9ASyBs~nw12m>~J=cc`<3I5m_~7~8!{T<2 zkJgT@K|5jkGf(BQ^&SQBA>OhTL%@NFcHech0up}86{@Rbzi!s*)32tci`?zM_;H!_ zYD9*t#Z!&C)^ET>I<-N4Orthsga>LP%f*fRhHM-gIk)J@81oTrVhQ6?*4;?=9IDsQs(;0 zL~A~if>^_Cs-T)>~@lk%#<2`kgtT1&9VL!y_JmH8%b12$`K@+2dXTCT384NXmUAxD5+|IP2`7CGnS4 z{X3PFd0F&VVpfm_+dfY=J}~cOeAGaG7s}rp<_d`7G#vaS9FK6H4eHHW~gQ5 z0sYTGAVO@=($WG7ovh8sS2nxz4zjK=J*eU}xbVjF7(;uJxknHyxY|s$OVlb4Wl&H?u*G0+#DP&fb;dXcAoKD1fc7O z(m$EMy_A~dPOWNhJ+lGWQfK$=l9Q8%K=ZYo+e)q#XgatmQd6nL(NGZ#uuRHIGXrQyi zF^lxxtb+Q=2vc3$H^gZTM2hz`7JHapNHN>hHQsXa-7Cf*#hL*9o(1Sfs$7$zdXWO! z*0aU-SMvLd>?ZQsnccs8a||YXMbZHl=b2D4kM!U^(3w4b^3jqy4v1StjAXxkB8t7~ z1~z8vTxM$kkenFo&(b!-GZY`-6aD+vh@Y#)Gjnz84pa&_{A>e6G6ZEkvS%i zdu+U1MzSdO-ERt3qon@J*i`b2+x|xOmKGCn1#SLpuZFX+oB?MZZiiB%>uoYP8K_T1 z^#*gha_i;iX5MhsgH3EZ9(IM7>^cXQ&MiDL8M1R0%Z6qb4?|xL4~joowxMAh?L+dk z<$?-@fu`QJr-9W##U14Y$wIS#`9(MQne2gQdce2 zo>w;2++^LWd-380)M)t)YtVP^6hO!~0tmeAKz10ZuQ^kE@S_#Mk_pH+DjA+enc&%o zV?hD%ETQ&Z8)%=IIw=j7OE3kU1+R$;$NMjd5(YCn6URsMCk;4_LX~HV0r`a-+k4U{ z6+i*+Ny*m;b5xg*Kpu-Cd!18(S25|JO zzmPD|xz`L6fghQCm zO7=*k(QttUG?My7d0uRP_JoEj!-^=-(L8h}T2uY;y!Q0tAHT2yNb2$u4 z75b5rOLpXsV%WnjM#IUaA*=)5J#9Mm%@nnr43Q5TWp1!t+q?c=z!L?1orNHFGBaINLC}q-A zbM|RzDYo}?oWv^qYWx@Pe^q?XeF~=&FaXHjj4;Z=LT^)K?floq$o2Y>0C1CV{qLIB*fw1~Z(1dkqi z_VFG#Q*fOjo(t}hEOH|zw5L$L3O34qK4zuYAu}rdbRwb7$aP@l_Et)p5w5T(%}FZ6 z-QRbSaJIyt%oHZ?3Efh!<($X-Nb<40?a-B(mzrX*xq;NN;gN5=+MHL`Ggi*;IX@{F zQCKzUl+(00p7(k90+p@)nJkjrg&;xpEOyD&*XAJ9=k9j=P!m9hqr`THWIQwTTK0-h z42_@Ej%eSFNGclkEdY3AW~b_iY7_ZBd4l#9=3ONWWB?_`<)OD)2lkZwMa(1Lv)}ZuW2B1jxCXtdK_P^ zv!Ha$Wvk{A+ip`ucpLMn`_0)e=GtAiWRgQ`_VK-)7t5c%9n(ABQ`asq4>{bQIL7Vw zgzRdcFvbaYW5^xj9 z%}&RMwX1yuYMBXnuTNYFR_{_E$o4##W`<_SYU*MxD);OIEsPzx;^yfsEw*=GS&L0+ zZI?(^rOBAspVNr=tSO9aGIDx>e{B$t5aw5N4R-w8UI4&|>hN6%$JG`vC)80qo5?{TY#&3M(C{cdPcdW}pff;Jf@0_70{`syHsR49 zCil%aVk}kRiOFc$9DPXhTXh?Hk=QhX3Z~pfR^I2-Rx7=tL)Tz}Uut>7_;n{Sced~; zW6Qy8RnCtveSSxfF1ppj+F!i$9))}~qe%I^TS|Ehr!pa!mCtpn@3v9=6Zo($Bc3cI zZ^QqfB$T#k@GjwA*%y{T0dK>tX);&MLW}&|FY1TM7dKsjZoz?+dU|KNiV`CIN|VU^ zCnF3cu#8PBK)HIWCKZG~oxKq2#8~!b zCpHimBAy)9e)dy~?Nv-VmS-F*4LcIcT-xs$4Vf^oM^&>v@BDo<``IW-8yd8wAhk=& zYK2#l2sOhXwO2ZmjGkFP8#0->Aqm%_BncQD=*kvFpWQ!$0sUc2QO4y)&c2u%M!xYXv`RHynAffh&$=WlYszI#dhX8BOcZf0#8NS2 zn3-^;Re^xRN0q!VeJcEtWqNjEUQIMnJ!jdIDD&5kAZLJfi4l-x2~s`5-`^#|>X(=8 z^P@*2%2KGkgS1lI#N)w)^7lgyMP%mP-!Lb9sx7QuRR@;qFh-~zP~Cq$!7IpD?XsM# zELT}I@L-1kRBtg zmD5l?=1!mkuw5ep*|_57ofZ-0n$mz7PhTp>yKxg)XKo194v@YN+q(JD#JFX?{_O=G z)}(@qBKBX6wGhhFAim!w#~#LT9w`o`LzCRPT`rs%ns998Im(Kj{s^IN{{HS?1nnQ7 z?k1Br5oeI~-4i+-gfUkVxVg9d{XJ3>D;n7%bPR!rVLFd)`5>`VkoeJaQP6vhn3N&l zf|Or5c^7QVh~rOccdREWE7Ih$UDn1cr7P87XQCGY*VbWpboA0o6RnV^CZUr3KvFHq zFx+JCE$dMv6j2(lH~+?+{e1z46sT2nLOP7t6h#qAliqJJ1sso?8Bh96b;tY&pOP|I zrUq-6NSXM9cdBA^s6XdnK!{MAelK-47w{rwuNdJu06M+;EI)~23qI;K z+C42(=fE)^l?jxcRyz{zf%oBs{-lbAkd|JvEXL+H-obTIHfg)S(HbBTR^ z^u92;dm3<94fo0&0v6-k(-*GoNKv^fO+K#4(`SDvBgqKS0512uV3kUAieGfK=XwK8 z_*1=xuyQtBlS{r@^o&EAK6w({bCxMVG6e^c-6T z4C8j3tY>6S7g{E(b!E0IvLYZmp&`lVzY2ETPU;Q@9Eg3;3o9Xym~vNEtgC(?_X5)5 zwZQgY24*q^?>-9yCe7ni+gaH#nMxqkd~^r8zarQ}`f*7cnJ@=fZ>%L>n9scUBgEMv ztKVAwT4=mF<$ugSzQ-5KHA;6%mtaQ zI8vQ}Q?{e8F_Zp!uZ%9#tTEb2)=pMh`i7XWb85j&jWZInUsMAV9z_eRTYgAm>j8Xi z>Ov-M2vXyIYO2Lzc1mNfCON5EVn;v-cR}7PhjZ_Wzb!cn@;@4YVM+aOQ8xBamF!I>VLd?eYKYe~O@eSjO)` z^w%%nua1xw{^&L<{F`_E&wECfNTl9xmHtcr4F08w2vKr*uZZ^ACj;iF|MvA!%MT7H z3k@BHz`C6qf5|D6+(ZzlUz3hC?g4FMQh#R6P7s{l5s+s8`;ea{G~i0SpLb1f6SPv` z8eO7T0f%5z#bj* zIxCt=l@=8shzfIsmIGGi3$}2p1>7`ew5`+`LM&}QOmW4(68r1bbXeq09;R2lv>y}w2R8#MOYXm@11FD;I#2*M46RsS|l3_;VaELm6qo* z!epcKZUuG*V@eoe>@xyTS19bJiQ-#Z=}JF%(F$X+`*RMwuW?S&EtHM&Z|kdEj0~$B z_i*+`PQ$9X?yyk3*aS%%t=rHJ-Q#Qd)*H2|FK`hN)Wa@hd97#&UwFx66iz<2h<9)% zeja2ECIHzCzM=r%+m0<=4_H}wG(Xr|G8+uY1cP8(Q}^waM*b2#<~Gb z;+U;b2n0gzS_#mqaa8e?KVAH^o#%dx7zloapp{5sUf>?kdjjcIp+l0U-wa%@1j~Jf zOvmJcwrF2P*Y5+A_;;9jX!EvVc;yb|owBaj2UI;du8&kUB$Lx{g$K=|q3l3NLSi_Id zh?tn=&J3q)AXMG&#O_6Xo2b+5lY?)|HaPsyTgwAYpPT@7dp}a19#1f7xSAatNXicd zSplIqnVNi;@fRtLO#_<}v@I^c(EfcGz8LjN#6Nwi-{LzNP6+EGheUQSQJ%pwxK+Me z|MV@EhuuKs?Tm$+%MV(8trh{-i&PPVdLRW5J93r1rqe8iu~6AR%I$ERLUZ=4y6-Ti z@HMpb?66u0qXu5t-tTn>wFo}WUr<>b{J;HYgmd;r7BL|q2vB-fA#;%N|t zkF(2RWq3&@YVvCm!l%J+3J@asYnnB!cI!H1J4$(%jqMl0YjXN{74sbiJk2t36`i;d zB(^cIeAw7KH1r}qLIfN$W;f=agFg>(aO@J3`=`4v^6=dqxQ$Nnrn~A!_(mafSFZsf?DbF6a7h}?&|x^aNdwk7ldH8Zmv$fy+7ofXX-ooGal z|7ZmABp_W9U0DWb_aVxmV%M*Rn!e=KMz`t7K78oAJ!+8>YdLE4)RuGp0Avgfg|J|Y z{)2uy-LF&}S_EvL7UGASAB*~OHyz(yoD%wF^(lH1ek=Y^?0CF`s!F3jmcw*+Yb>b2 zM=SI)Wb7W3FGc_YPvNojRUT@&_u7gK<=k#+Cy#8DKCYBbyN22XxF@#dFPvM0Ua(pb z$|5^Z;Ia@1py?yU1(ru`RvgSKAZFE!jtdb(qUdGSXn=D z=Mf-{BJ%q!vSd*VCbSi5as8C_R=&`t=&D|6s_GS(8%oAc=6qq^bfTy=_gk{E?uUUZ z<^JB;vsRc}bps9+cZz>JE~;>oA&Xy6&dhH1+wR8^sf+GPjUNd4Fwy=Dl5fBG80_v+wQ5tP(h6CIQoLfsL#r;~g!&jFCDQ>w#k`WD zOdUQq3__PfH;DJe=I&|0N)>!J*=`cWq_b3#Y`RCP&q1;YcEt#Ah?U_h|Cb49Pcfph zR+==&gmS>A-d^96`#O12D_JSZh7@PfR}bVQTEzhw^%gat`Y{7!yYu37cZoNwF&j0+ z%q!wZ>$G%VLNx%NK%b|+;}hCcPfI5B1xR7Mx^VoeY7_hI)n9yE z@2C;D5tzVY5}Ocf^xD~yE?TX@_HyH6w)_>D>*47(&TqcMivpNaGdhoD>yFQZ%U(?`2r z&A?9Ed8X!7&9%qO3w{Xo?oXDbse&Q$e8Omq!dTMR`k9Y+9xCnU%Hc+nfWz8S)>N3HrE(Dx)H7f;|dGO_A9}%rx_ZVnBch;OJCO z;HlcP4v$<8#4beaO*@|z!}p5g+kp2QD^Tr<{I(PWkB`OUGx@_Dm`V>DGYf~?>T+`- zy=$^Vnp%)`fI!@W)Z83@K209~;EO~QA#?7LEuw$C)WG<(KCMeeX3%W_uqkk z_6AzMQcof=iUZA{lGL6)12($v*mk0$Kdrqn?rBYB6~oxr(YkFZ#TSl9WTjr+ zUJ=@_bJ6Vj#Icoqq^H``Syh=?f5RV)$`hIiHhdo!pyIMK8{fSsv$zqMbt+4f! z#1rZ!tUDfsERrTt$$5ADDk&h8FRcrkr(Zffu$}((T=kL|gXo;PK69MQFr=Nb+9O;+ zdv*|=wU}6Z50I&N;~SlCm8v($eDvKf(hq{DHC%m{dm~b?5tS!TdX&1U7-g7yR7osW-K(O@ z8mU}!6JqB>MO~PE`K5le9&59q@(XiSDS|9*yNbSBNcGd{d&s~`H)VClPz9_QC51r|K*v7d{xff7}<`#u}4q$nOaEn7JPU@<@*d zxk$@JA5F2(M^71-i<@m2wbk2h28`-`9LO%Sl9diBLcqiY9@detlS$VkfsmrfjFH1j zNmVTpbua3P<^Al&@0LrtJqeHAe^ZSRr4_c01N0=d zH=l?Vh^7-@xz?0{D#eV%fwZy7z|%f5p}MMt&jId$d~#bUm{+K502503KCM7GaFO+q z@o9@0xTe*Eu7%epdiCUz>?SIYMEaRu5>xP!*^@Ke=I_63GIBGR(2g@CFiv^i?9a^y zSbMt6ZuB1a%6m47Gleh7QZ{)OV$9y!$h&05nJRl|T3uiL`Zd%6KkHj(l-KyTD0?ge zNUa}i5BNj#F&xgH2w5z{nZC!Ks`)~+{7beef~X`Eh=SrWLrAD zq+T9AWmuay-4vXi6Zm_*k24KP#3k(w{SZ;k$J5}sO?nfrfYO6J zDGIS(qBEEDmqLVq&V#tZd+#rAdnaT!GFmDz$Gyx}pxUC+z&-4`f9?j5SYIdqq362D z#=I~LtOFw9aYbt=x%0QzG~rnZslirM(y-}bhv}oLij5P&=?mjKE!QYXcqm=TAD{d3 zhFyO4!u&#yrD-m>>KU!^E8yVRCbffG}?cyuvgh{B<0So(!lNL#-LPVEaS7jE(n4iBJ zcYYgt1GT- zU9ei3sH&n38oPFRRC2RUOYx=cd`IjxES@|pk+%l^UooGb6lv~Kc70e4a&S**BxjvJ z^`7v>J;Md&Mv?d%+pLCL7EBopxI*L7yImE&3E!d9-!FJYzBXLeMq9TCKj=mgJ(&2$ zdrv-t*<+_hnEvYwDEDv?pH5JShYC0^sj$8o^4b4p`C*s*?2cE}#yQr9B&4fS&+-l+6q!#(o zd~&4BX1Qvh3)+ot0HL_=!Nu3#Nx}r_0j?{Q76NGdTgiMbkS?bnk#slgfYP$hK3O=1 z#GBkl72p~(K&M4`isAm_yG0TYana*0ZyX|Bx)LM>OxrGPUtCSoF0x%UW01I64nov- zUVcIb?Ua)&OOTOEHFo^se^Jzllu&86Jl#(L;RwkmY{L2dM!V7ScpqBW58CRg+6xRce%PV}>U0VnnhhpVWN4 zZhjXpmy~WdwXxat&!;2|<4T)hkU*K3nCO~b=rdI2F)DarIXwu|BFplpAy`Wg?1Msl z8o_k-5YoXNi1i=t%tLJ6Z8(nzoHiZPgwd%?%N$>0NbP=slk+6&;p z`t>+1qmdk$NAouzcUew@NKM-5kJgfq1xAvN8ajVpSJO2>mnb09HaGq#~yf;U2Wr`UG+{zKHgsQ z>&xDsMHUGP)cdy;GLj0j47TNhGV0Bi>7lx*$#L;lgM}2ivgdG~Pj2nPQ+_o0&AB_F zpJ^s5kFG^Ts>^(7u(dO|;mCXO@nV?W)j0_5Nu}gQ=`5wOVfINw#O`!Dy)CupkwQAc z>jC>$PM0NX8$O{RtTcgFi6zz&nMz^jajq}T! znGnfVrWp#cmU;5d{C6LvSPIq+F05=nH{I=+Pu_T(vrZ3t< z1f&{bX^gwH2m9}Jo85XP2z038b=?XV_r{8~)MY<0P=`O}IqL!>;0TB%EQA$ugL;HMW}pH8z>DY`~88G!S*P`w=%O1Mc+jcqBZZLsY)5JY;W%P z%F&XD_3d@DJbuZdKMjxImHh{**zoAa!Otv^APR=K_tA)B>yG1EeRE#CJ~*hN8pkuX zl1O4&)31Mwtmep?O!ofRmThcN#-q=SsQ92zlv9}4xE8q2-6O!m8AYGu$7jFJvMR^; z_R>c>G3KHMD#z1762Ml3ogBzrr1rh33`24OSr}IoMO81BQJtl%u*U<`)#>YC@Yl1! z%(i6yvpIYCEi3AmacIv~GlYU0^LOzD@2e!Yfh4Y%Y(t=aXIcFg9z!7()Z_CIwt_fq z=eV%2P%_64m9_NY50>HOYWqzE-yVd`sr#{SqxrASt`mnuA=Y9+{Y!n027`j;4`Ml5TX`GrGOLI0AZ> zJ^&Nu0=@mWa2x^x0*7m$nPJAd*ObuSOD0krMr3F_(NhVSHK};-09rPb6TtkYLi}4K znT@vS&)^1`YK!rYfCvD?b+BHX?oLzEra=5SZ5FhnMvy6*q#~b~=zyVSamIadG9U1n z*MO?~V})^FgFP75F0bpd41Y{yNz85#z$XaCY~{YGG=VlmafCRuxA|mn06~fUD?QLQ z<{QbF_n}s{?NB&kaP_N|>RQ3^YajcevP5B1W8}Utb$;b*kKiTwn1YbP>Hq*>9|KVd zz5~ouzW9qUJLs)FVOn@GHwfJ~5={~2o8X4@0DAf{Hr6QZMcNlfQ{WcpwI6yx3uZ)r z0>F90P$u9CM(XWNeHBk9v}}krC%7iHaq8AW1Xt72yl-8PJ)*ELL9c#=+=}(^aNcUZ zp?cB7#Y=-nT&aj?E6z8$Qtt*J>G|aIxQ^Y!w6O)jrtra!6P8u8CDA+iDJa_a8!YvxReN{Wv+sf@z2<&8cslvs{Cp?3u<8n>B})-ectyM%}xie&^$> zzSQ^jF{H)8ar@=q{&}QVlD{hOL#Y4>E`fnM8*}yc@~yy{F`#tV@q=u9cH{}L_TebR~2>GIcC|;X;4Jzc%Ja-#Z#M#pKgjC3F z-A;ECjf?VB__v=|%=f!nCtS!w4!~c%snEvUd9jgTNP-t7S1JvqpPB>XAW8*lQC@lJ z+-uthtHCIVQXL5nsjsZgDaQGJ8QCiZvjjs(mQ|a30xbdzkVG$rA``wyucS2d!B#+H zK`-D@F>bEpIHEv@Vn1TT!F0$Gn= zyk;LL64CiM`27>(ycdH4KSNxS{kdQvopFS!iz9@YSkKRW!sc%IgaSt^3X~86hAsf!EI&!IV`bU zCylsOw`FpkNr{-bLI9(|i2DhZ&!sE_+~uLqs<^k@RdqW(EbRcWXPA+&K^V6p->ojW ztwl?%f!{!`76JZ6V=NyCGfF1${qACuOi84j*I+Kf&ByNq5|}ycny-)w$JJQUbR@gF zdn1cf-uAn4cDsMP8HBCEzE7)B{4;?eK#-Vxyj z&?4?ZB5f&nmS^zV`pYYTD(5cz1R2qPj*@Z*SiWzr4q(nm(h%gGDA|aygZXdW;la>U64bCC?Zzc)qB1r|*z(jKvx(-a}d85A}HdOAnMojn-m14eAcxOoiUI1!< zT~O-rbyh|nszXq_%D7dJ=;rj{j^FA23y;L~XS=Q8?qQ5OJKi<$dt_7R^SgU_cdV$& zDUCvJwzLabDs|j3`A+Tl-!5H)a$vll?58B^Zv5!b*Kwk}I|eod?ES`2au&fIyAD_8 zB52L3F#MxuYRX-6PIbXW?sDGOjeEX`6TX42`@oaZHX4z)lUTp(aEOqiOL**kcjj&V zj6}#x*|y!P(|4kkV~;ogX@on*Sui)A&>XkB-sHMtkbY5fKA3F3;Ka4h;E+&XwbU}3 zrfdRjL&7*fD|6!YZ+ZkxYr5GjpCrmF%!Wu z;3@|qLc{Y&Ek|NSMoY|N^6uSAwpZ{1_d)=9A^8tzPBV4oH8zV+ex=m13z!mKepWOt z$<0a;;2b8(6HU#|%Fg!7n57+o#Y?W3t8@%n-lv2NR$ET;Yi{=6_YHF|;p~I9SYjjc z?D&%^woW@APWkb*tRmq}h1sJ;^tY8Aj}YNY2c`ezyPW~S@p;yNp0#A57eM=fXB=5m zYxj)0u);lEsPvQ8X)lAPE2Wb2`y$oyoUpVO`4NtTD@KP5rzy*ZRwYnF~0YDK*@*N>BBK`ouuZUfhwx)y}#R=h4@f75!#luk1wxhxEx13ByZS= z3siIN_#cgVp{VWmomTD_?7*qZ>$M^K`(&eHum|Mz5#X z&H88|odrDIgQU5xe*RLzL8dgzIIJIx6U}x!NZ=B-(=mPwD4B#L3y2}b63h2eVfm6i z*4DYYX0OXF+Eo`nN)*SkcV@Dm`NTb$>tIxIIa$ZbDymBrEz$Iye~#g5)USjxc13W} z+8!$Vd>s;-yBE?6$^YqE^62F>#fA!4{6_rTrs`oLI zl|(VlsK+H8QX36S+*Fu#KAA4`n`t|?2#rIC$!~eXisvxdGdoydomZfi88Ej{-SC`8 zzq#r~UQtR3ePr}tF!Dk|3Y97lx)$b{sxjd(Ggc?u@jROmHE zXqXf>m*vE-9TR2x!|Zv4&^$_VBXR8Q0_@_z*j&cYRj~|zI$ytwds6f5<&)4TM9H#W zJiq)Qa6f2j_4j-6lg12!G#YK z&;Jc>s4I_ghCS}#2Dk7h5Wm}9wiaVx>0ms7 z*Tpd)?Bd9Q$%Y8NrjEuyX~%&nLeIGp{V67!#oq+yN7&MdmF*Wefs8uw4rPln9K7M+ zz9PU*wZW9?W!_Qua2m>o%v4(@JMRmTs|7LC?C$|U?*AZF0D}2;NRcB{mmFlzO}wJ_ zsD-Sl&E-g%ySA9Va9wUhAMswZuwVYp5HfG)#x+mGA>WePJa5BJJI+c8Vr{=GI=Z|N zuuh$_Gc!RW0~gxrQk;-nt*9rNU#XnD9nl^ z8ZnRx@Hqm}+cb;U{*>=9F&6hymPjnUy_uA7|%@!A7ue6$NOAr7p%ie zJq_rwENxcflu+R${c&xB>U07}&>uL@R<1>vhUyg71r2Y18Y>;t`lyd|IXdE1r}_#pKlgW-NfS)WHoEF>PxA#nR#6Th>EiWug%r;&N|Bnl zz<=mw8QfOuu@>yNckKQ?Qt9bOwLci8bHy=6ich(&;$w)b4MP_fDLg~&wY#Z?)FcQ_JHET?V_W{0OGyjDhaSb%MxfaoZ;IgFuWMTcI(f}l6 zc1-xAJ9xsI&7=y09GX@yfCVgxmHcpkL9v}ptcxdJ> zb~idpVl~J}^l>{nqL~Oc6<(aEtaA9VEfvEDsc;}+`$CH$UxJcRF>DSf4zkP=BqlNERzyUDAq*hhH6bMA4#(arAl<;L zV^ICPHlcYO%HcEsX1{YZdb@3kTX72=HQUL)xb3VxC9&Q71d!L}6F zW;~`;wlS_KhWA_wY0sw}kUu?rA48{$;XF#8pJFfv zbdneOME*${3zk_(g5ub9?utfa2I%5Vih~rqflHyH6b|z*UVjTGrUhD19{LnUwIa3^ zvXRHf&mhcoZBZ2=GfGI>1Q--rwBOyEQx;;Ji_QpBg3yQzxanLjxANt`>wy9q9?F}u zlZl}L=F)^UqAJuCYt`QO%Hav{wulegu{$Ux0&qp29|Hl{V9K#I-7p~eV-Q03;X`|~ zd4&QLkod9U59Y86=J84<2rkK~Cs0HR9w8Etb*YDFXj~mEcUH=O`g$yd&Wn^^kce<= z({val<17BiT^tnkVOnUGJAf8@M7R7LAWw@GV{e|p{vw;Af*HaQr6kc_as+kxV{X02 zEK#BF_n)++`y-%pFexUZp9M{Vne_5*c~D;STj-L3*g%cf&1E94T#oZfW8z!lM*&)l zL%%&6aDM1nNN0gFkg8EmYSn=rkQ||?*d)f4UUd{sMBUJVZ z@VKo`9xh-cIVtnTUc}exD)N@>!N;R#%4p`WM@Q$FCTDP5uwB;MHA+Boa;kM z>amMlc76Q<$mfu!J zZMWE~4BK}5k)2z5KC6wKsI?<{({j$@W2I*%&n~5-2K7h^HEXyA5MKoU50c`-^@1gQ z-u``i0GiGp);&p!M6ry(?{Y5F-M?&xb(~a@a*l9F9^>06c(BV8kK!AF|K0g&N%$+Z zl;xL1FTwPo_A_M(B`Kb4h)R*;)iz5^UL;Ci1WFflj-iB~p@U!3yMONktb9A?P5!HN z=wyjOK{f`LkOITwr2Pi|!Rt$4bsST&o$QD8V&LFUV%hx}@ezX;@0;Rb85>KoCC$GH zs{6OKZ>NHAIJSbyjT=|$IwK}8-7myP{&05U4=@PEvJKW)AJ%y-8TlHbVHC~5rSMCe zi{Iqw1$Hs2m%Jm9#i3Qez4>9Y?biMRoioDy0e!LNe34uH9}GT4j$Ld&XzKaXxO!NVl`X|Ch>f$qc8>X0JdJ9Xpk}PmN@+`rtA! z_QBUOzl$YB8|1H(6i@U_d-SqG@j9bU6Liq?{9NO;@sOj0=>TIW8m%wzUk`R+TiOTg zOf>v6i;0SJnFqHr8D-dQWSjw|KyF(najv9ApMa&Nu^+wjmy7#Laf);Qp*Km1qiBDg+pE|Gxj7jYe#zK*w{GE7>5@x5t!pWufrw_newRvFE+=JCN z=r>i2={-a$;1r9>+QhcIScA_J4}@Bmx8pyhuPUAPD^bnI&%uy<*O{!;4wWkqGZYKu>lVK4eA zWU@fvm+qnH0=F96mTmJ>>Hgx|1M2 zxldKX=L&z=NYMfLoTQitA1^ob|3}O5K2&~I6tYNZ^CxD^2M+CFdL;a>3)MfJIvow1 z#}9^JcKM2g=T-|e|9ob+_Ar9!aj1R${Y)E#E?572V!|+AeSKK@ztajj2LImm{NGZ} zD8TVy4-@&rd4qlU`QW2vGZtw)H(#Lo=c9@8Ip-ja2E*CivIIqQbAmhx`dIk32Bagj4@YOsW&_y z&yJ|F(U{0BcA+wtN{VHcI7>kdMEu8-q*9bd?&8(t?B8UZ+VYn2+Y6Py%CWe>_7Wv5 zLG9E&L1|~!--$WvTS0d>w$aSv{H!MXc$-lp2XK}WGpzK+tzf`+91WMO470rHFNA

5*V{ZIxvFzH6!X@5wiouP?0 zL>_VB#yBP{rABqd!1H4oeZ?#I@8i8v^t>wPDuUUb>^z467it?PR#sFx&2E>T7ji!E2u;Tj)sKp5;!e>)dRs~u4c7`*A2#IFrXr25;=@>lqltuP5$ZmCy1r^GCFQ} zsGsQ+S_X*NzA@^;qqfa2>kE~Z(w>gWfuTwaoSr438h22x^?rOjqkR6>mh|MOHu4G_ z(28V!b;sb2>A)c??7k$wYvPzuKymT(ge>y(5e+b&*AJ3wqF)Wj6B;J!sMeoSc`e}y~=!aP6SAIUblLAn$OjhS6NOfDDW=Bou!=Vf%Fv) zk8_Ak%;F)i>@w}m*78`LJ|@s{hz3w=cj;o5#D_H?OXn#Z0CtV2m{)?+`%O1`rITg) zVy-|aXJsFE2B@T7V0&U9<#&hzvc=B*Ya-JWihG^-tXhSUO#SWU&ioMH3ynHR<{Nja z)q9sPxYprS*7KSMhK9zVLVexhaUmU4f%y-Qiva43Mj6?1f)3$=8+POMlFHA0J24;E zf}G=%=P6nF3O`njI+Z$GNAh=*%W+Nq5=YWU8pGMi^rRhl75(E`P47wSXX*DpVY8FQ znV4Os3!c0cZKw{5Ph@oN4IQ|;?qd7pd(O3VtqJ8abVvhTV>nijrb)uAB(;1@S0C#y zUqK+hdeku-fh)^944zUf$CG<`gd2#An`9vFiUNm54vFs|$+9FGaEH?4pM&9)9CXVK zB&KZd(G`LG=5OWQPj+gS^?-Q5?mh$t5MgV8u0o*?$SiHv1>C^_yV3trx}Uzfav6We zRY!6Mq5FHLZ@s(K(sf(P_p+R=TP0~a&LR9xtat*LNae!%5eF84KN1^=*Fh~(n zAO!A2XCY6jczw;0iCF{O56{ylU2Hk(9qsTUXb;Q#8){qbZrv$^+GP-IF|ty4qU+=?fOxZkmCA=G&*BQ{d2%d>uG)m^;4W?c#kAeZ0cx7?3%96Z67?SOl$v*(`$2B0Z+S z_8>{R)d=?;3?zi2j6P7F>sJY{&eu(5tr{a&*DIGuifs^IoAd@ELrp{D_GfDwJKjR^L>Qf|u94g) z955GUu*ST!6Ha);5JCPn$Ft)OQa(*D&tjpVREqAKc}Tz9j$DNVJDY^aZVf zkKazcD7Tue@ghij;a(&2^_V+LZ36t*B)>su?sbnzJo+;9{J5XV-k2x~6J6R~oRmEW z?I|`kcE70rm$t@z^4-NbST23{xJ*Pe|2c4XCXXL zIGJtII9}u12vs%!(TAq>1td`WM@z-n80pi=ck`@3QWl-sa7>8;rCeeVYc5;Xd|ULg z@~8qx@Df2qT(kdOlXnpf=@2vL-GYlIo~zrO+m?`Bwf0nAR;+sWG&b`DX8g2#>WwoC z8asM&n3bL&g7qAO63^k442Hy_PQ6f2r_ zCv)2T4%iC9cr8$R&3QR7{lgO+h1EBqzrTpKBbBx{g{u9_uTY(OdRl89 z$7|%%tgjuu-0rFFjGMN8)ST|64gdZ_cpMK6buW3bSdcJ^3F7?tMEZ)O-P7eyftohK`9vyMZ;9jJvrgPpX?v9JKz=lT5+ zx?vmGlkq0~q3Ku%(x-yRAYpWlCKy;x3MiM^F!_N>&yX}@^$=O=lI(q^qS)ys^4}_M zU&>eHlJ;d0*Q%&Xc$m4q1mpnPnv+`yng7dxd za#7alSsvTBua|2RCF5)O;D+RHS;w+tdzN)>)^h(!CK_aK>VOYmZE`BSLbEJVTOPLd zAUs=^?+zdlY;s-``YEQ+fisQmliY_8P}+`-X6%^_dr|1?FGXVIgQ9wR;8 z^_XL#Ax|+KbqDZ2Io?z-Te+Dqje0?-IYEXVnwm)&2uYKw8>9qub*@A30^cH%5=If6 z9vlC|>Suys-y$-flRsK|CW1osn(8o=Gpa))f5bQIGV`0T;+K-b*b6*k6{F4%N@Ykn zd3oROr3Uzc9lM8z!Plv#F0wF4hpnd|w;(P&U>9Altr$X7|W% zBX%AG_snLP$O~@V$umjdLoNc;(Q+^7_44wV<_dd(FL#AyLX_N|eGkf)OB+bL! zoDc_Lq_+jj@cQt6vVC#P#vm5}o1xiyFojQ2&M#xl(-pNYxPf&yD#TzPq+^=YN^0FP zsCZWyp2_Yu5S}+|rnz^Zqq<@=%C~^7#{_XEQ!H2(RG>Maz=Fwtyq&1eGXT^qfh2FE z6oj?k0gcl%(gV?r+<09EkV^Z^vBhGd$lNKpYKN55ENTh9o9ypuV?a-bESr1`yn1MN zA{G4L_0vN?UO16lrEEz%07kz|7xbK)r}8gGJIV3GOIWP6d0PhcvMR7W0j7hO_xiM> zwcb3FNdOZ=CutAFfRP&<1y|WLlJJ|yl<$1Z0+RIapS=A*v}ZDyVlHW5Dz)qMzG|=o ztAG(9e{!kae;xQBW5DZsM2CAsNWdAo>s8}8yxZvR_YW<1V1%$rvu1V5r=*#$058V! z8U7d*6_uPxq6~+$yV&|xtwfvN*4FklP}9-B;qbU=^7H6}R8iB?66ceVc>A(@-+EBG z;cvL3HPL#pG{7y11}cC04Ha2>^#I`$AsIHcqm;}9`f+gQD^N8}c#d&~?>k1?I)*)70 zN{Zlucpd$}G0ML@(R^5E2q=q)zp=vnVOPSoGfeuSy*F?sBP*PK0JDw}%w|-a7p2H_OQ9BcmhK3=9k&rJ{CDYgNS@Hhb0=V2&Zh zn?qk?>zQa8n^)7Z#slm>lwOz1RmC!rrmm9^|GmKc*Kh0;glnVwnXm`T;CD`YzB6B~ zje%GGRXx4iE52acDoME;R@FS##l-caby(`ElTKvt*jtcm1o=c0)dk4A*h#>&!AXz8OBF=V z(G0|fYCrEG`nQc?10(eP`)HtmehDO;xxm3@2eR7gHk%L)yCXg=cLuvBUq=8_oxV9R z=$cnf)&b*c4sg|Z-GHcGDlEzaPa@!-OYu1B1@hG3wjKRcE{m}!x07ud&_E3|?rB9W z2BQ(K0O+(c{gp)@*!T^?)@C36a96CQ7_Z+eRIhH%FcG@Rv^u_1Nq54APgfd z_pQQXkOo4TK;SI~_0l%8agNy%G&ic3}rvxw1{2zf_5 zzIW1bMr_ozpS&KnftTZkrH^c&SsQnFv_+-`SHfaL7GfPkkRuHM=>DBA0>phc>7{B9 z8FhlrtfP#JebKQ7$)iLP-1m~i&0l9%J(2{*0mksp@f`EzHD8HOzwb`S+c=VU z4|kEIV2Uyu6dX!m7o(9&z_J?#;%rK>AhhVus$VWofMoc8;kMaD-Br+kInF{JIFEr) z7e-Jd#Uxud(C1(UwJevM^-xCkfRGUySVRo*N$u{{NFf&BQ91&t;u~%lXxdFK<h@IE}V2enP# z-R+qWy;4?y$GyMeAcfa9%j4!`(u<1;sCAuO_o^q?I#5|-?-ez-w^uflLB($>B>{fX zA`0o&e)`w9gs=z|&}@jY6!_J(Nlyf*wBtLjKsIGdLQ z$9K--EYly8SmrfJu%H!a{dvo%j!IK*AG8`Upg7BzHXVV#k;i6Dug zUbeAM*3(-?5(!@%U|zGO^Vp0Mu|OZg{-rCId;I*2nAZ zH#2UmRzao@yaGFt{=J&D2|&T8DpStx%>b188sY%?n46!EnqmgfPILk8x!$oc6<45a zl0z}9^NLQn0=EWDtS$fsb_E%(08{9i?LZ~-h6L(`x+gDD2SL)na;KF~q5{F4DQ)n8 zc9mOI3oz{8x$Rs;4k!Z{3^6Sci7O;z9^f4t`{;gu=i%(c$iLZg*gq?23wx7Pr5?rY za>vIt$0ahyU+(qhLe2S8Q`1f6FVWddh1`#?>r+|{nFLuRw^c&9L_h5joJXki;yOaw zKLtvwDlw=Chjl!r`AqIS(5otEL4B!^l>QVLv-omlpaJyna3B1@6jd+q`5747=bJsz z;|M_M7&cF_f%ek_I0p3+rhA5B%K?lY=mTLfOwI0R+=UTXdVjSrv{twft+AajXA+C7Y_X>w<*Fy`0xcwbH~fbU-^^3byl*v-~h!7RT6@SR_| z^hy|BX@F58lFNJ%K*VqU!3t&oJLnFIZybTz#AXdlt#5 zG)CTOI)|9{6@>e)Zc0`hOC6<+)>k&Zbsqp89Kv#Jj8+8n#|c**GtIu6AV!EGh65=N zyuaexnh`MSc%H9;KjQ9KRv+#1Mf-YkW6 zxru!RiB9;x#sGZGn(ld;$n>^l?na>nWQk!D6DNOt7&In%ZAGDj1M|k|q11Z1_bojD zDiy>7|8xZIVeLTVU+M(KpGaLsp9zC5#gqa$-(s7Ghp<-HOagsoBc|SmhU}%N zr0l?Ttr* zYv*4&61gM}U8B68i&1+eba!po#l{;F#SrXfq05doc|XP={7VmM4kBorxr>?< z1OyQ0+#wU5fIM2D7^${YzW~ec22Q9ILtk*s2r3OFxMT6UPegdk*d<7eb&rxuY|Yk| zT5&A0*I_5~*jRVnUi&GA$KOR?c7OQWWG~@wNATrE2QC8b;oI0e8GJR0cj*(z{-fIo zpL273TP$e18cJ8IY1H2#r%zk4V;Q3zAy9_2#_h$r3+fm>*xGEFmVDFj+9KC8Ko_^TXu@x*k*X2*>)P(y>LwA*xRS z-Pyp6j^nuM#-b-yRgnNQL@p(NWsbN;r|?7kn7sfn*2hBEt3&1vTyv7L=2>>mc<$)0RHKwf#3@E&{=q zpX>9_yL{FZc3Xvt(e*_5K|jYv{{yXy;#e50vE&wkds?A6oDyUeMVn z&|Bj^x%2pBf5`YUr7BFW79G)>`6bun*Apwbv~+_Re5)z&__%U!eP=i5K%04 z6K|Pfd2;FNYq>JxTTab2(9dT#gMWrQ;kEVUCCMFLeZJTevtssVlR}J6LAx=@I1Jls zCK{Qf+2&s7@VjR7Ss7;;EVNSa2&0?-W8G;2lUnl74PoDEk}vE9!@8q8^6)YECEl9# z$xQ8-e^1Ib{}d6*6cH*P(JcSAI00lpnE3DBt;Ple2its@8t# z@iw>JtZjyQMqVra*E37Z({?+>_Q4ma$@QJ{r6@rrFZ9;Y@$lsv`J3lV@b2V@p)Uhp z*ODSKH1IP}B_6xna*wfZn0^0Zo(_lsD~!u0+pdMr`oh$CQUx#;spX3ug@Ofy-^x=u zsE|1P66)e@m=4I!N?pXlyCac@cN)X{IcY6qCR=eaTbAzMylMk@m&w3-F5}6RQQQSR zv6~qcIeUkAjavCYooA=ON$NBU$q>!ShH`fg7Wx&}W0W{^K5g7|=bY&Ji>4_`ScE*| zPJjL|u^8cmKukXjIq7Ml2HynkN6Z>8+;S<470^Tar4H6uT|v=6%N6}Y=~kg4oj_8M zY@$r)g>v4{ge^v=?{6CVjPx=P2uH{$Z9S@iS3u_OT4$8m9y_0t#k7HS7PsN2x59?u z;u73aMb%05(greGPGhD?^jTn4v0kQ7jn3o-7Fn!l$imS zJb1Q`zk=-vR~0aGtfA*PXO`f0XwA*d(vFqiz8vJWW5b~Lb5ed-=X-?hRLr255c_Oj z8&XZ-SBxj%ai9IO05!1GXqSkM?}-F99?@oc@ssUw`E8mJof(x@2A93+RK~6@g$k$U;xwafdTKgjR8XZo%+6JcCu+Q-f!OvRvRZN>RxbmbZY0 zX~B$(S+E$EB?g{!wM1$|o8$7OUYyR7JBm8tNcu8vrEe>3UC)B&na-@y!t%D5Cwq?a zQx-t&RVp*wdM#lY{spoD;0_54JN7yw@0Z?oSv8w^+Iw}8SH3zb-*%m5t|LK@hKNo% zszL!_#oGd$0_#;9xs9UXPJ0>!dzrH=I zvR2niDH0v8^R7+aNttZO+EQ=*?z__G>)B{YT5+$}7&4n#4KiY0(G^hmaGT$oh3=l~ zpJ!|^U?ZpS@$9EKjo|_2?Z43<+zW^1%7unpqAQ4`F6vc3Ax1Bin*wwYv-w^4|J?S8xQtJmlLm@0Wg@Sjk5G-3;th72D#OU<=HC_2j#@mSl9Vs{ZiO~I^8)D(N zIZR?^;tiBejd1EAeOQABwHB}jgts+OFeuBIXHKAGCe)un*{EUtoid7GdZ^lwQg-Kf z)5Ai0^ramyNc7Z{bBKY()pV<5kZG5V{gQP1h4 z$4QcSVU~e%j;-~M%j$+jc9zBxOI!kQa`V=g$x9?Y_YT%RJLMoMk~kBChbvZhACFO1 z6~0(wmr%{6!&9mQN_Kl#5|xMih2U0eirDTIl;EM^6;fxJFT0h*>$*AGNv z(Vv@+O`zhNb(?bcEr+*UddleO`sZ}&v}oXkyH z`lR#AOiSjV;&53$6V)Dbf4**<8X>Z>ie>LuRFBz@D!^#~IuV`{m(C`P}z?BEMh zFQY3CynZyV2}b}0IuH=o(5&Y8rq#1mchhG$NQaeHC_z<`UW-8!Aw^yJ$rxH@PAunp z^)vNC|H(GT5~#)-x0+YO^Q_N|CR@-PgTG4ik#_Pn!M#>i4o8Jk7dbpXKQE#$uYdE< zOWg8?y>cg$`JIjOk{t)xoFtZVR0VwbcgCVB5LJvs1IVQqU?-on(JZbv63oVO)q}fI z0xs9|Wb1p)MIS7>Q(7C}?xvpowEco}5uU_S`9xdUBvQ>pTZ`0{{nCwSQ-v?C$Zl2Q zqz@w&%#`z@=O*+?sB83wDP`?YU&K(Ub4c-2;E$k*xM#!+K7o@m@V1zR6;o^!+Eg?& z2=iSqhA=!DZHsW+>ORSj49a=@a)+OuVAI!PwJ%kSHoT)@9$_?_;VX06)qNj7aTMbY zt(UsD*tMoUvwGX|+r1$nf)TtXIBFv^mf9Ez++>jMDtz*`1Fyrb;i!~Lf?beBGYW%< zC8Kh@MCG-Cp=kcCOE;w$(#{cz{^@gZfe>?PoLnrELXtG+Iu*qa$Xgau16ZQ|_-aFw zA2RWO=s3?CZ*)aE?uNyW`oN-@>zyYDAKxdNLUA>b7D-l{)aepHy7JVFvF>3eh`GoU zata;u`w4x{TV|d$(H_W+6gZ{Cp)plowxdhs+h9@`f1iJ~|D^2}=+8KmGfI?2!WGX@ zd6J8V5Hd&jk9IxV3UlBO_PRqBqCW@oJGw+H1tQ5s_ir7eI4y%#WpvleeALSS1bGrc zALnGZ>E!r+O5uoG`G?Ou2em<$_R_HE1otUd*1Y>?BsYhify#Zv5S^zmq+S|0EvxM? zP`3G~_UpaX#fRLad>U_OO;QarH>z%amjy#ykPD3IKP&QgVz9h|ku!7^0pt{Z0B;MM|>So^oreViB?73vDP7Apg%86L+7CF_6c+Dl58|2cj=#_jd3Y6dTd}a7UOO)rCct z-53>w>%^J>fMudkCL&90Aq8D=&7+N_75|X?0L0|Y5S4jfSi~8q z9q9U!oY>l&k>%R*?`2>2SZ-tJX5rUtRXis@80c8#6qIu~knxWDtYDo!z zL4NR3EkE~n$M$<{aR$yw8UU+6(2qDq`s$`(9`wK_g1pCym>5}4MpDYBA8hH7Fn`}9DeN!zrLYV!L7*27xiN8RiRtllZ1!7`yD*h;l;v2(tATqv zbMc|*5qb7}m;SRqU``??o}e_K$w%6CyL8VQ7H_RZR89`-kj-Ez?r5qZ&x_S>Ra z+ZfEH_s;{y?I(~~7)+He$Eu(>|5l=_=57I~GQ6ggr6oLuEpU`@Qco#OrV#l%_h$~4 zF?srPnWb_{r3OTVzBPIN|28l2|G&R;f#;CitvR-N!@}927FrCu@2ju9{Cq{lvlZUw zFHZ5kefE9q-C1dJcNq=t<8 literal 0 HcmV?d00001 diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc index 15fe6204f8..fcfe75415d 100644 --- a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -1,30 +1,33 @@ = Manage Native Encryption at Rest :description: pass:q[Couchbase Server's native encryption at rest protects sensitive data by encrypting it when writing it to disk.] :tabs: -:page-toclevels: 2 -[.edition]#{enterprise}# +:page-topic-type: guide +:page-toclevels: 3 +:keywords: encryption at rest, security +:page-edition: Enterprise Edition +:page-topic-type: reference [abstract] {description} This feature is transparent to the database's users. Couchbase Server automatically decrypts data when read from disk and encrypts it when writing it to disk. -For an overview of native encryption at rest, see xref:learn:security/native-encryption-at-rest-overview.adoc[]. +You can encrypt: + +* All data in a non-ephemeral bucket +* Logs +* Configuration data +* Audit data +For an overview of native encryption at rest, see xref:learn:security/native-encryption-at-rest-overview.adoc[]. -You can only use encryption at rest on +## Enabling Encryption Enabling encryption at rest is a two step process: . Create at least one encryption key. Couchbase Server uses these keys to encrypt its own encryption keys for data. . Enable encryption for one or more types of data. -You can encrypt: -+ -* All data in a bucket -* Logs -* Configuration data -* Audit data The following sections explain these steps in greater detail. @@ -45,26 +48,44 @@ You have three options to choose from: See xref:learn:security/native-encryption-at-rest-overview.adoc#kms[Encryption Key Management Services] for more information. You must decide what your encryption can encrypt. -You can create an encryption key that can encrypt any data and sign other keys. +You can create an encryption key that can encrypt any data and other encryption keys. You can also choose to limit what data the key can be use to encrypt, or configure it to only encrypt other encryption keys. See learn:security/native-encryption-at-rest-overview.adoc#keys[Encryption at Rest Keys] for more information. You must have the proper privileges to create encryption keys. -Only users with the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles can create encryption keys. +Only users with the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles can create them. ### Create an Encryption Key Using the Couchbase Server Web Console To create an encryption key using the Couchbase Server Web Console: . Select menu:Security[] on the main menu. -. Click the menu:Encryption at Rest[] tab. -. Click the btn[Add Encryption Key] button. -. In the *Add Encryption Key* dialog, enter a name for your key in the *Name* box. +. Click the menu:Encryption at Rest[] tab. +The *Encryption at Rest* page opens. + ++ +image::manage-security/encryption-at-rest-page.png[] + +. Click the btn:[Add Encryption Key] button to open the *Add Encryption Key* dialog. + ++ +image::manage-security/add-encryption-key-dialog.png[,400] + + +. Enter a name for your key in the *Name* box. . If you want to limit what your key can encrypt, click *Configure* to expand the list of uses. Then choose what you want to your key to be able to encrypt. + -If you want to limit which buckets your key can be used to encrypt, deselect *Data* and then select the buckets. +image::manage-security/add-encryption-key-uses.png[,300] + ++ +If you want your key to only be able encrypt specific buckets, deselect *Data* and then select the buckets. + ++ +IMPORTANT: If you're creating an encryption key managed by the AWS KMS, only leave *Key Encryption Key (KEK)* selected. +Do not use AWS KMS to directly encrypt any type of data. +See xref:learn:security/native-encryption-at-rest-overview.adoc#aws-kms-caution[this caution] for more information. . Under *Key Type*, choose the KMS you want to manage your key. The option you choose changes the fields in the rest of the dialog. @@ -78,9 +99,9 @@ AWS:: -- [start=8] . Enter the Amazon Resource Name (ARN) for the encryption key and the AWS Region in which the KMS is located. -. Choose whether to enable the AWS Instance Metadata Service. -Enable this option if your Couchbase Server cluster runs on AWS EC2 instances and uses IAM roles to access other AWS services. -. Enter the paths on your cluster where you have stored the AWS crendital, config, and profile files. +. Choose whether to use the AWS Instance Metadata Service. +Enable this option if your Couchbase Server cluster runs on AWS EC2 instances to allow it to access other AWS services. +. Enter the paths on your cluster where you have stored the AWS credential, configuration, and profile files. . Verify that your settings work by clicking the btn:[Test Encryption Key Settings] button. -- @@ -91,10 +112,20 @@ KMIP:: To use a KMIP-compatible KMS: [start=8] -. Enter the host and port number for the KMS server, and choose a timeout for network connections. -. Choose which certificates to use when verifying the identity of the KMS, or choose to not verify. -. Enter the details for the client certificate Couchbase Server uses to authenticate with the KMS including how to encrypt the certificate passphrase. -. Choose whether you want Couchbase Server to fetch the key from the KMS and encrypt data itself, or if you want the KMS to encrypt the data for you. +. Enter the host and port number for the KMS server and choose a timeout for network connections. +. Choose which certificates to use when verifying the identity of the KMS. +You can choose to not verify the KMS's identity, however this is insecure. +. Enter the details for the client certificate Couchbase Server uses to authenticate with the KMS. +This information includes how to encrypt the certificate passphrase. +. In the *KMIP Encryption/Decryption Approach* field, choose how Couchbase Server interacts with the KMS: + ++ +* Select *Use KMIP Get & encrypt locally*, if you want Couchbase Server to retrieve the encryption key from the KMS and use it locally to decrypt keys and data. +* Select *Use KMIP native Encrypt/Decrypt operation* to have Couchbase Server send the encrypted DEKs to the KMS so it can decrypt them. +This method is more secure, because the encryption key does not leave the KMS. +However, this does result in more round trips to the KMS. +Depending on the KMS configuration, network latency, and other factors, these addtional KMS requests may affect performance. + -- Auto-Generated:: @@ -105,11 +136,13 @@ To complete creating the key: [start=8] . Choose whether you want to use the cluster's master password or another encryption key to encrypt your new key. -If you want to use another encryption key, you must an existing one that allows itself to be used as a Key Encryption Key (KEK). +If you want to use another encryption key, it must be configured as a Key Encryption Key (KEK). . Decide whether you want Couchbase Server to cache the key. This setting lets Couchbase Server keep the key unencrypted in memory so it does not have to decrypt it for each read or write. +Disabling this option introduces more overhead as the key needs to be decrypted for each use. +It does increase security slightly by reducing the chances that the unencrypted key could be leaked. . Decide whether you want to have the keys auto rotate. -If you choose to rotate them, enter how often, and select a date and time for the first rotation. +If you choose to rotate them, enter how often to rotate, a date and time for the first rotation. See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. -- @@ -118,11 +151,47 @@ See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expirat ### Create an Encryption Key Using the REST API The REST API's `/settings/encryptionKey` endpoint lets you create and manage encryption keys. +To create an encryption key, send a POST containing details of the key to this endpoint. +All POST calls have several common keys that they must include: + +* `name`: the name for the key. +* `type`: The type of the key. +Couchbase Server only supports AES 256 encryption keys. +Therefore, the only important part of the value is the KMS that will manage the key: + ++ +** `awskms-aes-key-256`: managed by AWS's KMS. +** `auto-generated-aes-key-256` managed by Couchbase Server. +** `kmip-aes-key-256` managed by a KMIP-compatible KMS. + +* `useage`: an array that lists what the key can encrypt. +Valid values are: + +** `audit-encryption`: can encrypt audit data +** `bucket-encryption`: can encrypt all buckets. +When a key can only encrypt specific buckets, each bucket has an entry in the list in the format `bucket-encryption-`. +See *FIXME* for more information. +** `config-encryption`: can encrypt configuration information. +** `KEK-encryption`: can encrypt other encryption keys. +** `log-encryption`: can encrypt log + +* `data`: contains KMS-specific settings. ++ +[{tabs}] +==== +AWS:: ++ +-- + + + -Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or Cluster Admin roles can enable encryption for rest for buckets as long as an encryption key exists that is allowed to create the bucket. // Notes: // bucket-admin, no access to security in Web Console. Can apply encryption at rest to bucket if a suitable key exists. -// cluster-admin can enable encryption at rest for a bucket. Cannot access Secrutiy settings. \ No newline at end of file +// cluster-admin can enable encryption at rest for a bucket. Cannot access Secrutiy settings. + + +Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or Cluster Admin roles can enable encryption for rest for buckets as long as an encryption key exists that's allowed to create the bucket. \ No newline at end of file diff --git a/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc new file mode 100644 index 0000000000..7e41811076 --- /dev/null +++ b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc @@ -0,0 +1,57 @@ += Encryption at Rest API +:description: pass:q[The encryption at rest API enables you to encrypt audit, configuration, logging, and bucket data when written to disk.] +:page-edition: Enterprise Edition +:page-topic-type: reference + +[abstract] +{description} +See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information. + +== APIs in this Section + +[cols="76,215,249"] +|=== +| HTTP Method | URI | Documented at + +| `GET` +| `/settings/encryptionKey` +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[List Encryption at Rest Keys] + +// Can get specific key w/id appended + +| `POST` +| `/settings/encryptionKey` +| xref:rest-api:rbac.adoc#check-permissions[Create Encryption at Rest Key] + +| `PUT` +| `/settings/encryptionKey/` +| xref:rest-api:rbac.adoc#check-permissions[Modify Encryption at Rest Key] + +| `DELETE` +| `/settings/encryptionKey/` +| xref:rest-api:rbac.adoc#check-permissions[Delete Encryption at Rest Key] + +| `GET` +| `/settings/security/encryptionAtRest` +| xref:rest-api:rbac.adoc#check-permissions[Get Encryption at Rest Settings for Non-Bucket Data] + +| `POST` +| `/settings/security/encryptionAtRest` +| xref:rest-api:rbac.adoc#check-permissions[Change Encryption at Rest Settings for Non-Bucket Data] + +// No? +// | `POST` +// | `/controller/dropEncryptionAtRestKeys/` +// | xref:rest-api:rbac.adoc#check-permissions[Re-encrypt Data and Rotate DEKs for Bucket] + + +// | `POST` +// | `/controller/dropEncryptionAtRestKeys/` +// | xref:rest-api:rbac.adoc#check-permissions[Check Permissions] + +| `POST` +| `/controller/rotateEncryptionKey/` +| xref:rest-api:rbac.adoc#check-permissions[Rotate Data Encryption Keys Encrypted by Key] +// Note: only for auto-generated key + +|=== diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc new file mode 100644 index 0000000000..a5a9d2ee8c --- /dev/null +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -0,0 +1,71 @@ += Manage Encryption at Rest Keys +:description: pass:q[You must create encryption at rest keys before you can have Couchbase Server encrypt data as it saves it to disk.] +:page-edition: Enterprise Edition +:page-topic-type: reference +:page-toclevels: 3 + +[abstract] +{description} + +== Description + +These APIs let you list, create, change, and delete encryption at rest keys. +See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information about encryption at rest. + +== HTTP Methods and URIs + +This API endpoint supports the following calls. + +[#list-keys] +=== List Encryption at Rest Keys + +List one or all encryption at rest keys defined in the cluster. + +.List All Keys +---- +GET /settings/encryptionKey/ +---- + +.Get details of a specific key +---- +GET /settings/encryptionKey/{KEY-ID} +---- + +.Path Parameters +[cols="2,3,2", caption=] +|=== +|Name | Description | Schema + +| `KEY-ID` +| The `id` attribute of the key you want to view. +| Integer +|=== + +==== curl Syntax + +[source,bash] +---- +curl -sS -u : \ + -X GET 'http[s]://>:[8091|18091]/settings/encryptionKeys/[key-id]' +---- + +.GET Path Parameters +`key-id`:: +*Optional* The id of the single encryption at rest key whose details you want to retrieve. + + +==== Required Privileges + +Any of the following roles: + +* Full Admin +* security_admin_local +* security_admin_external +* ro_admin + +==== Responses + +`200 OK`:: + +Returned even if user does not have permission to view keys. + From 47969664b3009a59f5b7a4cf138237633e359437 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Wed, 30 Apr 2025 11:53:09 -0400 Subject: [PATCH 06/17] Work in progress checkin --- .../native-encryption-at-rest-overview.adoc | 4 +- .../manage-encryption-keys.adoc | 317 +++++++++++++++++- 2 files changed, 312 insertions(+), 9 deletions(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 9dff061dc0..e6bf2dbec1 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -114,8 +114,8 @@ This method limits the number of retrievals from AWS while maintaining the secur KMSs that support Key Management Interoperability Protocol (KMIP):: https://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol[KMIP] is a standards protocol implemented by key management services. Couchbase Server can work with any KMS that implements this standard. -As with AWS KMS, using a KMIP-compliant KMS enhances security by ensuring that the encryption keys are not stored locally in the cluster. -If you use a MKIP KMS encryption key as a KEK, you can have the KMS decrypt the keys for you. +As with AWS KMS, using a KMIP-compliant KMS enhances security by storing the encryption keys remotely instead of locally in the cluster. +If you use a MKIP KMS encryption key as a KEK, you can have the KMS decrypt keys that the KEK encrypted for you. This measure improves security because the KMS does not have to send a copy of its encryption key to Couchbase Server. Using a KMIP-compatile KMS also has the same downside--Couchbase Server may report errors due to KMS downtime or network issues. Couchbase Server will report errors because it cannot decrypt data without the KMS's encryption keys. diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index a5a9d2ee8c..2e17504eda 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -2,6 +2,7 @@ :description: pass:q[You must create encryption at rest keys before you can have Couchbase Server encrypt data as it saves it to disk.] :page-edition: Enterprise Edition :page-topic-type: reference +:tabs: :page-toclevels: 3 [abstract] @@ -38,6 +39,7 @@ GET /settings/encryptionKey/{KEY-ID} | `KEY-ID` | The `id` attribute of the key you want to view. +See the <<#gey-keys-example,example>> for an explanation of getting this value. | Integer |=== @@ -49,23 +51,324 @@ curl -sS -u : \ -X GET 'http[s]://>:[8091|18091]/settings/encryptionKeys/[key-id]' ---- -.GET Path Parameters +.Path Parameters `key-id`:: *Optional* The id of the single encryption at rest key whose details you want to retrieve. ==== Required Privileges -Any of the following roles: +You must have at least on one of the following roles: -* Full Admin -* security_admin_local -* security_admin_external -* ro_admin +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin_local[Local User Admin] +* xref:learn:security/roles.adoc#security_admin_external[External User Admin] +* xref:learn:security/roles.adoc#read-only-admin[Read-Only Admin] ==== Responses `200 OK`:: +Returns the encryption at rest keys or a particular key if you specified the `key-id` path parameter. +See examples for an example of the keys. + ++ +NOTE: Call returns `200 OK` and an empty JSON message if user does not have permission to view keys. + +`404 Object Not Found`:: +Returned if you specified a `key-id` path parameter which does not match the ID of an encryption at rest key. + +[#gey-keys-example] +==== Examples + +The following example gets all of the encryption at rest keys defined in the system. + +[source,bash] +---- + curl -v -u Administrator:password \ + -X GET 'http://127.0.0.1:8091/settings/encryptionKeys/' | jq +---- + +An example of running the previous command: + +[source,json] +---- +[ + { + "data": { + "keys": [ + { + "id": "b3dd8518-e747-4a64-ad6b-db9c5d306a6c", + "active": true, + "creationDateTime": "2025-04-23T16:22:39Z", + "keyMaterial": "******" + } + ], + "encryptWith": "nodeSecretManager", + "canBeCached": true, + "autoRotation": false + }, + "id": 7, + "name": "data-one-buckey-key", + "type": "auto-generated-aes-key-256", + "usage": [ + "bucket-encryption-beer-sample", + "bucket-encryption-test" + ], + "creationDateTime": "2025-04-23T16:22:39Z" + }, + { + "data": { + "port": 5696, + "host": "https://kms.example.com", + "reqTimeoutMs": 1000, + "keyPath": "/scripts/certs/cb_key.pem", + "keyPassphrase": "******", + "encryptionApproach": "useGet", + "certPath": "/scripts/certs/cb_cert.pem", + "caSelection": "useSysAndCbCa", + "encryptWith": "nodeSecretManager", + "historicalKeys": [], + "activeKey": { + "id": "0788edb1-1418-4225-903b-bc1f9f59aa4d", + "kmipId": "550e8400-e29b-41d4-a716-446655440000", + "creationDateTime": "2025-04-23T14:44:20Z" + }, + "encryptWithKeyId": -1 + }, + "id": 2, + "name": "kmip-key", + "type": "kmip-aes-key-256", + "usage": [ + "KEK-encryption", + "bucket-encryption", + "config-encryption", + "log-encryption", + "audit-encryption" + ], + "creationDateTime": "2025-04-23T14:44:20Z" + }, + { + "data": { + "profile": "", + "configFile": "", + "useIMDS": true, + "region": "us-east-1", + "keyARN": "arn:aws:kms:us-east-1:000000000000:key/aaaaaaaa-bbbb-dddd-eeee-ffffffffffff", + "credentialsFile": "", + "storedKeyIds": [ + { + "id": "c1cddf80-720e-47f0-adb7-641f5cb2ce22", + "creationDateTime": "2025-04-23T16:00:22Z" + } + ] + }, + "id": 6, + "name": "Example AWS key", + "type": "awskms-aes-key-256", + "usage": [ + "KEK-encryption" + ], + "creationDateTime": "2025-04-23T16:00:22Z" + } +] +---- + +In the result, a `data` object defines each of the encryption keys. +All keys have the following fields: + +* `id`: the integer identifying the encryption key +* `name`: the friendly name assigned by the administrator who created the key. +* The `usage` field which controls what you can encrypt using the key. +* `type`: which key management system (KMS) managed the key. ++ +NOTE: The `type` also contains the encryption algorithm used for the encryption at rest key. +Currently, this is always `aes-key-256`. + +Other notable portions of the `data` field's schema depends on the type of key it contains: + +Keys managed by Couchbase Server:: + +* The `keys` list contains the current and expired encryption keys. +* The `autorotation` field indicates whether Couchbase Server automatically rotates the key. +When set to true, additional fields, such as `data.rotationIntervalInDays` and `nextRotationTime` show details of the key's rotation. + +Keys managed by a KMIP-compatible KMS:: + +* The fields configure the authentication with the KMS. + +=== Create an Encryption Key + +Create a new encryption-at-rest key or modify an existing key. + + +.Create an Encryption Key +---- +POST /settings/encryptionKey/ +---- + + + +==== curl Syntax + +[source,bash] +---- +curl -sS -u Administrator:password \ + -X POST http://>:/settings/encryptionKeys \ + --data-binary @- <", + "usage": [ + ""[.""...] + ], + "type": "", + "data": { + + } +} +EOF +---- + +.Parameters + +`host`:: +Hostname or IP address of a Couchbase Server. + +`port`:: +Port for the data service. +Defaults are 8091 for unencrypted and 18901 of encrypted. + +`keyname`:: +A name to give to the key. +This name must be different from any other encryption-at-rest key. + +`usage`:: +A comma-separated list of one or more uses for this key. +Allowed values for this list are: + ++ +* `"KEK-encryption"`: Can act as a key encryption key (KEK). +* `"bucket-encryption"`: Can encrypt any bucket in the cluster. +* `"-encryption"`: Can encrypt only the bucket named `bucket-name`. +* `"config-encryption"`: Can encrypt configuration information. +* `"log-encryption"`: Can encrypt logs. +* `"audit-encryption"`: Can encrypt audit data. + +`type`:: +Defines the encryption standard and the key management system for the key. +All keys use AES 256 encryption. +Allowed values are: + ++ +* `"awskms-aes-key-256"`: AWS KMS manages the key. +* `"kmip-aes-key-256"`: A KMIP-compatible KMS manages the key. +* `"auto-generated-aes-key-256"`: Couchbase Server manages the key. + +`KMS-specific-fields`:: +The contents of the `data` object depend on the KMS set in the `type` field because each KMS ha its unique settings. + ++ +[{tabs}] +==== +AWS:: ++ +-- + +[source,json] +---- + "data": { + "keyARN": "", + "region": "", + "useIMDS": , + ["profile": "Mprofile-name", + "configFile": "",] + } +---- + + +* `"arn"`: The https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Amazon Resource Name (ARN)^] that identifies the key. +* `"region"`: The region hosting your AWS KMS. +* `"useIMDS"`: Boolean controlling whether to use Amazon's https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[Instance Metadata Service (IMD)^] when contacting the AWS KMS. +Set this to `true` when your cluster is hosted on AWS EC2 instaces. +* `"profile"` (optional): Path to the +* `"configFile"`: + + +-- + +KMIP KMS:: ++ +-- +To use a KMIP-compatible KMS: + +[start=8] +. Enter the host and port number for the KMS server and choose a timeout for network connections. +. Choose which certificates to use when verifying the identity of the KMS. +You can choose to not verify the KMS's identity, however this is insecure. +. Enter the details for the client certificate Couchbase Server uses to authenticate with the KMS. +This information includes how to encrypt the certificate passphrase. +. In the *KMIP Encryption/Decryption Approach* field, choose how Couchbase Server interacts with the KMS: + ++ +* Select *Use KMIP Get & encrypt locally*, if you want Couchbase Server to retrieve the encryption key from the KMS and use it locally to decrypt keys and data. +* Select *Use KMIP native Encrypt/Decrypt operation* to have Couchbase Server send the encrypted DEKs to the KMS so it can decrypt them. +This method is more secure, because the encryption key does not leave the KMS. +However, this does result in more round trips to the KMS. +Depending on the KMS configuration, network latency, and other factors, these addtional KMS requests may affect performance. + +-- + +Auto-Generated:: ++ +-- +This option has Couchbase Server manage the key. +To complete creating the key: + +[start=8] +. Choose whether you want to use the cluster's master password or another encryption key to encrypt your new key. +If you want to use another encryption key, it must be configured as a Key Encryption Key (KEK). +. Decide whether you want Couchbase Server to cache the key. +This setting lets Couchbase Server keep the key unencrypted in memory so it does not have to decrypt it for each read or write. +Disabling this option introduces more overhead as the key needs to be decrypted for each use. +It does increase security slightly by reducing the chances that the unencrypted key could be leaked. +. Decide whether you want to have the keys auto rotate. +If you choose to rotate them, enter how often to rotate, a date and time for the first rotation. +See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. +-- + +==== + + + + + +==== Required Privileges + +You must have at least on one of the following roles: + +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] + + + +.Update an Encryption Key +---- +PUT /settings/encryptionKey/{KEY-ID} +---- + + +.Path Parameters +[cols="2,3,2", caption=] +|=== +|Name | Description | Schema + +| `KEY-ID` +| The `id` attribute of the key you want to update. +| Integer +|=== + +.Path Parameters + +`key-id`:: + -Returned even if user does not have permission to view keys. From 99a9359fe7253c22e69a22aba36f7c5b224c6fa6 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 1 May 2025 08:29:58 -0400 Subject: [PATCH 07/17] Work in progress checkin. More work on the reference for create keys. --- .../manage-encryption-keys.adoc | 42 +++++++++++++++---- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index 2e17504eda..beceb07398 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -273,25 +273,51 @@ AWS:: + -- +When using the AWS KMS, the `data` object has the following schema: + [source,json] ---- "data": { "keyARN": "", "region": "", "useIMDS": , - ["profile": "Mprofile-name", - "configFile": "",] + ["profile": "", + "credentiials-file": "", + "configFile": "",] } ---- -* `"arn"`: The https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Amazon Resource Name (ARN)^] that identifies the key. -* `"region"`: The region hosting your AWS KMS. +* `arn`: The https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Amazon Resource Name (ARN)^] that identifies the encryption key in the AWS KMS. +* `region`: The region hosting your AWS KMS. * `"useIMDS"`: Boolean controlling whether to use Amazon's https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[Instance Metadata Service (IMD)^] when contacting the AWS KMS. -Set this to `true` when your cluster is hosted on AWS EC2 instaces. -* `"profile"` (optional): Path to the -* `"configFile"`: +Set this to `true` when your cluster runs on AWS EC2 instances. + +You must give Couchbase Server a way to authenticate with teh AWS KMS. +See Amazon's https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html[KMS key access and permissions] for details of configuring access. + +* `credentials-file` the absolute path to a file containing the AWS credentials to use when authenticating with the AWS KMS. +When you supply this path, the file must exist on all nodes. +This file often stored at `~/.aws/credentials` on Linux systems. +If your cluster runs on AWS EC2, you should use https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html[IAM policies to authenticate with AWS KMS^] instead of using credential files. + ++ +If you choose to use , provide the credentials Couchbase Server needs to authenticate with the AWS KMS in a profile file. +For example: + ++ +[source,ini] +---- +[my-profile] +aws_access_key_id = ABCDE... +aws_secret_access_key = xyz123... +---- +* `"configFile"`: the absolute path to a file that defines one or more profiles for accessing AWS. +As with `credentials-file`, this value is optional if your cluster runs on AWS EC2. +Instead use the IAM defined for your EC2 cluster to provide the necessary configuration to the AWS KMS. +For a non-EC2-hosted cluster, supply +* `profile-path` (optional): Path to a file naming the name of the profile defined in the `credentials-file` to use when authenticating with AWS KMS. -- @@ -313,7 +339,7 @@ This information includes how to encrypt the certificate passphrase. * Select *Use KMIP native Encrypt/Decrypt operation* to have Couchbase Server send the encrypted DEKs to the KMS so it can decrypt them. This method is more secure, because the encryption key does not leave the KMS. However, this does result in more round trips to the KMS. -Depending on the KMS configuration, network latency, and other factors, these addtional KMS requests may affect performance. +Depending on the KMS configuration, network latency, and other factors, these additional KMS requests may affect performance. -- From 607d232edbcae052017a98983a069592def02eff Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Wed, 7 May 2025 15:13:43 -0400 Subject: [PATCH 08/17] * Draft of the REST API page for Encryption-a-trest keys. * Fixes/edits to other in-progress topics. --- .../native-encryption-at-rest-overview.adoc | 9 +- .../manage-native-encryption-at-rest.adoc | 2 +- .../encryption-at-rest.adoc | 24 +- .../manage-encryption-keys.adoc | 689 +++++++++++++++--- .../partials/user-pw-host-port-params.adoc | 13 + 5 files changed, 609 insertions(+), 128 deletions(-) create mode 100644 modules/rest-api/partials/user-pw-host-port-params.adoc diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index e6bf2dbec1..196c7a614e 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -10,7 +10,7 @@ Couchbase Server automatically decrypts data when read from disk and encrypts it For steps to take when managing this feature, see xref:manage:manage-security/manage-native-encryption-at-rest.adoc[]. [#keys] -== Encryption at Rest Keys +== Encryption-at-Rest Keys To encrypt data at rest, you must create at least one encryption key. Couchbase Server uses the keys you create directly to generate Data Encryption Keys (DEKs) which it uses to encrypt the information it stores on disk. @@ -40,7 +40,7 @@ The following sections explain these choices in greater detail. == Encrypting Bucket Data -When using native encryption-at-rest to encrypting data in buckets, you choose which buckets to encrypt. +When using native encryption at rest to encrypt data in buckets, you choose which buckets to encrypt. For example, you can decide to just encrypt buckets containing sensitive data (such as customer information). You can also choose to leave less-sensitive data unencrypted (product catalog data, for example). Encrypting just sensitive data can help reduce the overhead of encrypting and decrypting data on your cluster. @@ -102,13 +102,12 @@ Disruptions in AWS or the network could result in errors because the cluster can [CAUTION] ==== Do not use encryption keys managed by AWS KMS to directly encrypt data. -While retrieving individual encryption keys from AWS takes less than a second, a cluster startup could result in many synchronous key retrievals. -These key retrievals can become a bottleneck during cluster start. +While retrieving individual encryption keys from AWS can take less than a second, cluster startup could result in many synchronous key retrievals. +These key retrievals can cause delays during cluster start. Only use the encryption keys you store in the AWS KMS as Key Encryption Keys (KEKs). Use these keys to encrypt Couchbase Server managed encryption keys. This method limits the number of retrievals from AWS while maintaining the security advantage of having keys managed by a remote KMS. - ==== KMSs that support Key Management Interoperability Protocol (KMIP):: diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc index fcfe75415d..a04a0769f4 100644 --- a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -50,7 +50,7 @@ See xref:learn:security/native-encryption-at-rest-overview.adoc#kms[Encryption K You must decide what your encryption can encrypt. You can create an encryption key that can encrypt any data and other encryption keys. You can also choose to limit what data the key can be use to encrypt, or configure it to only encrypt other encryption keys. -See learn:security/native-encryption-at-rest-overview.adoc#keys[Encryption at Rest Keys] for more information. +See learn:security/native-encryption-at-rest-overview.adoc#keys[Encryption-at-Rest Keys] for more information. You must have the proper privileges to create encryption keys. Only users with the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles can create them. diff --git a/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc index 7e41811076..f75a430341 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc @@ -1,5 +1,5 @@ -= Encryption at Rest API -:description: pass:q[The encryption at rest API enables you to encrypt audit, configuration, logging, and bucket data when written to disk.] += Encryption-at-Rest API +:description: pass:q[The encryption-at-rest API lets you encrypt audit, configuration, logging, and bucket data when written to disk.] :page-edition: Enterprise Edition :page-topic-type: reference @@ -14,30 +14,32 @@ See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more infor | HTTP Method | URI | Documented at | `GET` -| `/settings/encryptionKey` -| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[List Encryption at Rest Keys] +| `/settings/encryptionKey/` +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] -// Can get specific key w/id appended +| `GET` +| `/settings/encryptionKey/{KEY_ID}` +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#list-keys[List Single Encryption-at-Rest Key] | `POST` | `/settings/encryptionKey` -| xref:rest-api:rbac.adoc#check-permissions[Create Encryption at Rest Key] +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#create-key[Create an Encryption-at-Rest Key] | `PUT` -| `/settings/encryptionKey/` -| xref:rest-api:rbac.adoc#check-permissions[Modify Encryption at Rest Key] +| `/settings/encryptionKey/{KEY_ID}` +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#create-key[Update an Encryption-at-Rest Key] | `DELETE` | `/settings/encryptionKey/` -| xref:rest-api:rbac.adoc#check-permissions[Delete Encryption at Rest Key] +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#delete-key[Delete an Encryption-at-Rest Key] | `GET` | `/settings/security/encryptionAtRest` -| xref:rest-api:rbac.adoc#check-permissions[Get Encryption at Rest Settings for Non-Bucket Data] +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[Get Encryption at Rest Settings for Non-Bucket Data] | `POST` | `/settings/security/encryptionAtRest` -| xref:rest-api:rbac.adoc#check-permissions[Change Encryption at Rest Settings for Non-Bucket Data] +| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[Change Encryption at Rest Settings for Non-Bucket Data] // No? // | `POST` diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index beceb07398..7e739674f5 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -1,5 +1,5 @@ -= Manage Encryption at Rest Keys -:description: pass:q[You must create encryption at rest keys before you can have Couchbase Server encrypt data as it saves it to disk.] += Manage Encryption-at-Rest Keys +:description: pass:q[You must create encryption-at-rest keys before you can have Couchbase Server encrypt data as it saves it to disk.] :page-edition: Enterprise Edition :page-topic-type: reference :tabs: @@ -10,77 +10,82 @@ == Description -These APIs let you list, create, change, and delete encryption at rest keys. +These APIs let you list, create, change, and delete encryption-at-rest keys. See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information about encryption at rest. -== HTTP Methods and URIs +== HTTP Methods + +This API endpoint supports the following methods: + +* <<#list-keys>> +* <<#create-key>> +* <<#delete-key>> + -This API endpoint supports the following calls. [#list-keys] -=== List Encryption at Rest Keys +== List Encryption-at-Rest Keys -List one or all encryption at rest keys defined in the cluster. +List one or all encryption-at-rest keys defined in the cluster. .List All Keys ---- -GET /settings/encryptionKey/ +GET /settings/encryptionKey/ ---- .Get details of a specific key ---- -GET /settings/encryptionKey/{KEY-ID} +GET /settings/encryptionKey/{KEY-ID} ---- .Path Parameters -[cols="2,3,2", caption=] -|=== -|Name | Description | Schema - -| `KEY-ID` -| The `id` attribute of the key you want to view. +`KEY-ID` (integer):: +The `id` attribute of the key you want to view. See the <<#gey-keys-example,example>> for an explanation of getting this value. -| Integer -|=== -==== curl Syntax +=== curl Syntax [source,bash] ---- curl -sS -u : \ - -X GET 'http[s]://>:[8091|18091]/settings/encryptionKeys/[key-id]' + -X GET 'http[s]://>:/settings/encryptionKeys/[key-id]' ---- .Path Parameters +:priv-link: get-privs +include::partial$user-pw-host-port-params.adoc[] + `key-id`:: -*Optional* The id of the single encryption at rest key whose details you want to retrieve. +*Optional* The id of the single encryption-at-rest key whose details you want to retrieve. -==== Required Privileges +[[get-privs]] +=== Required Privileges You must have at least on one of the following roles: +* xref:learn:security/roles.adoc#security_admin_external[External User Admin] * xref:learn:security/roles.adoc#admin[Full Admin] * xref:learn:security/roles.adoc#security_admin_local[Local User Admin] -* xref:learn:security/roles.adoc#security_admin_external[External User Admin] * xref:learn:security/roles.adoc#read-only-admin[Read-Only Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] -==== Responses +=== Responses `200 OK`:: -Returns the encryption at rest keys or a particular key if you specified the `key-id` path parameter. +Returns the encryption-at-rest keys or a particular key if you specified the `key-id` path parameter. See examples for an example of the keys. + NOTE: Call returns `200 OK` and an empty JSON message if user does not have permission to view keys. `404 Object Not Found`:: -Returned if you specified a `key-id` path parameter which does not match the ID of an encryption at rest key. +Returned if you specified a `key-id` path parameter which does not match the ID of an encryption-at-rest key. [#gey-keys-example] -==== Examples +=== Examples -The following example gets all of the encryption at rest keys defined in the system. +The following example gets all of the encryption-at-rest keys defined in the system. [source,bash] ---- @@ -173,32 +178,42 @@ An example of running the previous command: ] ---- -In the result, a `data` object defines each of the encryption keys. + All keys have the following fields: * `id`: the integer identifying the encryption key * `name`: the friendly name assigned by the administrator who created the key. -* The `usage` field which controls what you can encrypt using the key. -* `type`: which key management system (KMS) managed the key. +* `usage`: what the key is allowed to encrypt. +* `type`: which key management system (KMS) manages the key. + -NOTE: The `type` also contains the encryption algorithm used for the encryption at rest key. +NOTE: The `type` also contains the encryption algorithm used for the encryption-at-rest key. Currently, this is always `aes-key-256`. -Other notable portions of the `data` field's schema depends on the type of key it contains: +The `data` object defines the KMS-specific details for each encryption key. +You'll notice different fields for each type of key: Keys managed by Couchbase Server:: * The `keys` list contains the current and expired encryption keys. +The other key types have their contents stored within the remote KMS. * The `autorotation` field indicates whether Couchbase Server automatically rotates the key. -When set to true, additional fields, such as `data.rotationIntervalInDays` and `nextRotationTime` show details of the key's rotation. +When set to `true``, additional fields, such as `data.rotationIntervalInDays` and `nextRotationTime` show details of the key's rotation. +* Keys managed by a KMIP-compatible KMS:: * The fields configure the authentication with the KMS. -=== Create an Encryption Key +Keys Managed by AWS:: + +* `keyANN` is the identity of the key in the AWS KMS. +* The `profile`, `credentialsFile`, and `configFile` hold the credentials Couchbase Server uses to authenticaste with AWS KMS. +These values are empty when Couchbase Server uses IAM to authenticate with AWS instead of stored credentials. + +[[create-key]] +== Create or Update an Encryption-at-Rest Key -Create a new encryption-at-rest key or modify an existing key. +You can create or update an encryption-at-rest-key key using the REST API. .Create an Encryption Key @@ -206,14 +221,42 @@ Create a new encryption-at-rest key or modify an existing key. POST /settings/encryptionKey/ ---- +.Update a Key +---- +PUT /settings/encryptionKey/{KEY-ID} +---- + +.Path Parameters +`KEY-ID` (integer):: +The `id` attribute of the key you want to update. -==== curl Syntax +=== curl Syntax +.Create an Encryption at Rest Key [source,bash] ---- -curl -sS -u Administrator:password \ - -X POST http://>:/settings/encryptionKeys \ +curl -sS -u : \ + -X POST http://:/settings/encryptionKeys \ + --data-binary @- <", + "usage": [ + ""[.""...] + ], + "type": "", + "data": { + + } +} +EOF +---- + +.Update an Encryption at Rest Key +[source,bash] +---- +curl -sS -u : \ + -X PUT http://:/settings/encryptionKeys/ \ --data-binary @- <", @@ -228,34 +271,41 @@ curl -sS -u Administrator:password \ EOF ---- -.Parameters +NOTE: Updating a key has the same required fields as the creating a new key. +For example, you must supply the `name` field, even if you want the key's name to remain the same. +Any value you do not supply in the update call is set ot the default value (if any) or is left empty, overwriting any existing value. + + +:priv-link: create-privs +.Path Parameters +include::partial$user-pw-host-port-params.adoc[] -`host`:: -Hostname or IP address of a Couchbase Server. +`key-id` (integer):: + The `id` attribute of the key you want to update. -`port`:: -Port for the data service. -Defaults are 8091 for unencrypted and 18901 of encrypted. +.Fields -`keyname`:: +`name`:: A name to give to the key. This name must be different from any other encryption-at-rest key. +[#usage] `usage`:: -A comma-separated list of one or more uses for this key. +A comma-separated list of what this key can encrypt. Allowed values for this list are: + -* `"KEK-encryption"`: Can act as a key encryption key (KEK). +* `"KEK-encryption"`: Can encrypt other encryption-at-rest keys (KEK). * `"bucket-encryption"`: Can encrypt any bucket in the cluster. -* `"-encryption"`: Can encrypt only the bucket named `bucket-name`. -* `"config-encryption"`: Can encrypt configuration information. +* `"bucket-encryotion-"`: Can encrypt the bucket named `bucket-name`. +You can have multiple entries so the key can encrypt multiple buckets. +* `"config-encryption"`: Can encrypt onfiguration information. * `"log-encryption"`: Can encrypt logs. * `"audit-encryption"`: Can encrypt audit data. `type`:: Defines the encryption standard and the key management system for the key. -All keys use AES 256 encryption. +All encryption-at-rest keys use AES 256 encryption. Allowed values are: + @@ -263,10 +313,10 @@ Allowed values are: * `"kmip-aes-key-256"`: A KMIP-compatible KMS manages the key. * `"auto-generated-aes-key-256"`: Couchbase Server manages the key. -`KMS-specific-fields`:: -The contents of the `data` object depend on the KMS set in the `type` field because each KMS ha its unique settings. +`data`:: +The contents of the `data` object depend on the KMS set in the `type` field because each KMS has unique settings. + -+ [{tabs}] ==== AWS:: @@ -281,28 +331,38 @@ When using the AWS KMS, the `data` object has the following schema: "keyARN": "", "region": "", "useIMDS": , - ["profile": "", + "profile": "", "credentiials-file": "", - "configFile": "",] + "configFile": "" } ---- +.Fields -* `arn`: The https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Amazon Resource Name (ARN)^] that identifies the encryption key in the AWS KMS. -* `region`: The region hosting your AWS KMS. -* `"useIMDS"`: Boolean controlling whether to use Amazon's https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[Instance Metadata Service (IMD)^] when contacting the AWS KMS. +* `keyARN`: The https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Amazon Resource Name (ARN)^] that identifies the encryption key in the AWS KMS. +* `region` (optional): The region hosting your AWS KMS. +* `useIMDS` (Boolean, optional): Whether to use Amazon's https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[Instance Metadata Service (IMD)^] when contacting the AWS KMS. Set this to `true` when your cluster runs on AWS EC2 instances. +Defaults to `false`. + + +You must give Couchbase Server a way to authenticate with the AWS KMS. +See Amazon's https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html[KMS key access and permissions] for details of configuring authentication. + +You can use https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html[IAM policies^] to allow Couchbase Server to transparently connect to the AWS KMS. +If you configure IAM, you do not need any additional authentication configuration within Couchbase Server. +Always use this method if your database runs on an AWS EC2 cluster. +It's also possible to configure IAM for your cluster when it's not running in AWS. +See the AWS documentation for using https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_non-aws.html[IAM Roles Anywhere^]. + +The other authentication method is to use three optional parameters to pass Couchbase Server the necessary credentials in several files. +These files must exist on all servers in your cluster. -You must give Couchbase Server a way to authenticate with teh AWS KMS. -See Amazon's https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html[KMS key access and permissions] for details of configuring access. +Use the following parameters to tell Couchbase Server where these files are located: * `credentials-file` the absolute path to a file containing the AWS credentials to use when authenticating with the AWS KMS. When you supply this path, the file must exist on all nodes. This file often stored at `~/.aws/credentials` on Linux systems. -If your cluster runs on AWS EC2, you should use https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html[IAM policies to authenticate with AWS KMS^] instead of using credential files. - -+ -If you choose to use , provide the credentials Couchbase Server needs to authenticate with the AWS KMS in a profile file. For example: + @@ -313,61 +373,143 @@ aws_access_key_id = ABCDE... aws_secret_access_key = xyz123... ---- -* `"configFile"`: the absolute path to a file that defines one or more profiles for accessing AWS. -As with `credentials-file`, this value is optional if your cluster runs on AWS EC2. -Instead use the IAM defined for your EC2 cluster to provide the necessary configuration to the AWS KMS. -For a non-EC2-hosted cluster, supply -* `profile-path` (optional): Path to a file naming the name of the profile defined in the `credentials-file` to use when authenticating with AWS KMS. +* `configFile`: the absolute path to a file that defines one or more profiles for accessing AWS. + This file is often stored in `~/.aws/config` on Linux systems. + The format of + ++ +[source,ini] +---- +[profile profile-name] +region = us-east-1 +output = json +role_arn = arn:aws:iam::123456789012:role/RoleName +source_profile = base +---- + +* `profile`: Path to a file containing the name of the profile defined in the `credentials-file` to use when authenticating with AWS KMS. +NOTE: Couchbase Server does not verify the information you give it during key creation. +It only attempts to connect to AWS when you select the key to encrypt data or another key. -- KMIP KMS:: + -- -To use a KMIP-compatible KMS: +When using a KMIP-compatible KMS, the `data` object has the following schema: -[start=8] -. Enter the host and port number for the KMS server and choose a timeout for network connections. -. Choose which certificates to use when verifying the identity of the KMS. -You can choose to not verify the KMS's identity, however this is insecure. -. Enter the details for the client certificate Couchbase Server uses to authenticate with the KMS. -This information includes how to encrypt the certificate passphrase. -. In the *KMIP Encryption/Decryption Approach* field, choose how Couchbase Server interacts with the KMS: +[source,json] +---- +"data": { + "port": , + "host": "", + "reqTimeoutMs": , + "keyPath": "", + "keyPassphrase": "", + "encryptionApproach": "", + "certPath": "", + "caSelection": "", + "encryptWith": "", + "activeKey": { + "kmipId": "" + }, + "encryptWithKeyId": + } +---- +.Fields + +* `port`: Integer port number for the KMS server. +Most KMS servers use port 5696. +* `host`: The URL for the KMS. +* `reqTimeoutMs` (integer, optional): The timeout for network communication with the KMS in milliseconds. +Defaults to 1000. +* `keyPath`: Absolute path on each server to the private key Couchbase Server uses to authenticate with the KMS. +This key file must be in PEM format. +* `keyPassphrase` (optional): The private key's passphrase, if it has one. +* `encryptWith`: Controls which system performs the decryption of keys. +Can be one of the following values: + +** `"useGet"`: Couchbase Server retrieves the encryption key from the KMS and uses it to decrypt local DEKs and encryption keys. +** `"useEncryptDecrypt"`: Send local DEKs and encryption keys to the KMS. +The KMS decrypts the keys locally and returns the decrypted keys back to Couchbase Server. + +* `certPath`: The absolute path on all servers to the certificate to use when authenticating with the KMS. +The certificate file must be in PEM format. +* `caSelection` (optional): Where to look for certificates when verifying the identity of the KMS. +Can be one of the following values: + +** `"useSysAndCbCa"` (default): Use the certificates in both the operating system's and Couchbase Server's trust stores. +** `"useSysCa"`: Use the certificates in the operating system's trust store. +** `"useCbCa"`: Use the certificates in Couchbase Server's trust store. +** `"skipServerCertVerification"`: Skip verification of the KMS. + -* Select *Use KMIP Get & encrypt locally*, if you want Couchbase Server to retrieve the encryption key from the KMS and use it locally to decrypt keys and data. -* Select *Use KMIP native Encrypt/Decrypt operation* to have Couchbase Server send the encrypted DEKs to the KMS so it can decrypt them. -This method is more secure, because the encryption key does not leave the KMS. -However, this does result in more round trips to the KMS. -Depending on the KMS configuration, network latency, and other factors, these additional KMS requests may affect performance. +CAUTION: Not verifying the identity of the KMS is insecure. + +* `encryptWith` (optional): controls how the passphrase for the private key is encrypted for local storage. +The two options are: +** `"nodeSecretManager"` (default): Couchbase Server encrypts the passphrase using the database's master password. +** `"encryptionKey"`: Use a KEK-enabled encryption key to encrypt the passphrase. +If you choose this option, you must also supply the `encryptWithKeyId` parameter. + +* `activeKey.kmipId`: The ID of the encryption key stored in the KMS. +The format of this value depends on the KMS. +It's often in the form of a UUID or a friendly name. + +* `encryptWithKeyId` (integer): The `id` attribute of the encryption key Couchbase Server uses to encrypt the private key's passphrase when storing it locally. +See <<#list-keys>> to learn how to get an encryption key's `id`. +Required if you set `encryptWith` to `encryptionKey`. + +NOTE: Couchbase Server does not verify the information you give it during key creation. +It only attempts to connect to the KMS when you assign the key to encrypt something. -- -Auto-Generated:: +Couchbase Server:: + -- -This option has Couchbase Server manage the key. -To complete creating the key: - -[start=8] -. Choose whether you want to use the cluster's master password or another encryption key to encrypt your new key. -If you want to use another encryption key, it must be configured as a Key Encryption Key (KEK). -. Decide whether you want Couchbase Server to cache the key. -This setting lets Couchbase Server keep the key unencrypted in memory so it does not have to decrypt it for each read or write. -Disabling this option introduces more overhead as the key needs to be decrypted for each use. -It does increase security slightly by reducing the chances that the unencrypted key could be leaked. -. Decide whether you want to have the keys auto rotate. -If you choose to rotate them, enter how often to rotate, a date and time for the first rotation. -See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. --- - -==== - +When having Couchbase Server manage the key, the `data` object has the following schema: +[source,json] +---- + "data": { + "autoRotation": , + "encryptWith": "", + "encryptWithKeyId": + "canBeCached": + "nextRotationTime": " + } +---- +.Fields + +* `autoRotation` (Boolean, optional): Controls whether Couchbase Server automatically rotates the key. +See xref:learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. +Defaults to `true`, which means that the key will be automatically rotated. +In this case, you must supply both the `nextRotationTime` and `rotationIntervalInDays` fields as well. +* `encryptWith` (optional): How Couchbase Server should encrypt this key for storage. +The two options are: + +** `"nodeSecretManager"`: (default): Couchbase Server encrypts the key using the database's master password. +** `"encryptionKey"`: Couchbase Server uses a KEK-enabled encryption key to encrypt the key. +If you choose this option, you must also supply the `encryptWithKeyId` field. + +* `encryptWithKeyId` (integer): The `id` attribute of an existing encryption-at-rest key to use to encrypt this key. +The key you select must have `KEK-encryption` in its `usage` list. +* `canBeCached` (Boolean, optional): Determines if Couchbase Server is allowed to cache the decrypted key in memory. +Setting this to `true` (the default) makes using the key more efficient because Couchbase Server does not have to decrypt it each time it needs to use it. +Disabling caching by setting this value to `false` slightly increases the overhead of using encryption at rest but helps reduce the chance of in-memory key exposure attacks. +* `nextRotationTime`: A date and time string in https://en.wikipedia.org/wiki/ISO_8601[ISO 8601 format^] that sets when Couchbase Server must rotate this key. +This value is required if you set `autoRotation` to `true`. +* `rotationIntervalInDays` (integer): How often, in days, Couchbase Server rotates this key. +This field is required if you set `autoRotation` to `true`. +-- +==== -==== Required Privileges +[#create-privs] +=== Required Privileges You must have at least on one of the following roles: @@ -375,26 +517,351 @@ You must have at least on one of the following roles: * xref:learn:security/roles.adoc#security_admin[Security Admin] +=== Responses + +`200 OK`:: +Returns a JSON message containing the new encryption-at-rest key. +See <<#create-examples>> for examples of the returned JSON. + +`400 Bad Request`:: +Returned when errors occur, such as leaving out a required setting or invalid JSON. +Also returns a descriptive JSON message. +For example, if you set `encryptWith` to `encryptionKey` but do not set `encryptWithKeyID`, you receive this message: -.Update an Encryption Key ++ +[source,json] ---- -PUT /settings/encryptionKey/{KEY-ID} +{ + "errors": { + "data": { + "encryptWith": "encryptWithKeyId must be set when 'encryptionKey' is used" + } + } +} +---- + +`403 Forbidden`:: +Returned if you do not have the proper roles to call this API. +See <<#create-privs>>. + +`404 Object Not Found`:: +Returned if you specified a `encryptWithKeyId` field or a `key-id` path parameter which does not match the `id` field of an existing encryption-at-rest key. + + +[#create-examples] +=== Examples + +[#create-managed-example] +.Create a Couchbase Server Managed Key + +The following example creates an auto-generated key (one managed by Couchbase Server). +The only data it can encrypt is the travel sample bucket. +It can also encrypt the configuration and logs. + +[source,bash] +---- +curl -v -u Administrator:password \ + -X POST \ + http://127.0.0.1:8091/settings/encryptionKeys \ + --data-binary @- <>. +The update makes the key able to encrypt any bucket and sets the next rotation time to a later date. + +[source,bash] +---- +curl -v -u Administrator:password \ + -X PUT \ + http://127.0.0.1:8091/settings/encryptionKeys/13 \ + --data-binary @- <: -X DELETE \ + http://:/settings/encryptionKeys/ +---- .Path Parameters +:priv-link: del-privs +include::partial$user-pw-host-port-params.adoc[] -`key-id`:: +`key-id` (integer):: + The `id` attribute of the key you want to delete. +[[del-privs]] +=== Required Privileges + +You must have at least on one of the following roles: + +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] + +=== Responses + +`200 OK`:: +Returned when Couchbase Server was able to delete the key. +A successful call does not return any additional message. + +`400 Bad Request`:: +Returned when the key you tried to delete is in use. +In addition, you receive a JSON message that explains why Couchbase Server cannot delete the key. +For example: + ++ +[source,json] +---- +{ + "errors": { + "_": "Can't be removed because this key is configured to encrypt configuration, logs, + audit, bucket \"beer-sample\", keys \"encrypted-with-kek\", \"kmip-key\"" + } +} +---- + +`404 Object Not Found`:: +Returned if the key you tried to delete does not exist. + +=== Examples + +The following example deletes the Couchbase Server managed key named Example Auto-Generated Key shown in earlier examples. + +[source,bash] +---- + curl -v -u Administrator:password -X DELETE \ + http://127.0.0.1:8091/settings/encryptionKeys/13 | jq +---- + diff --git a/modules/rest-api/partials/user-pw-host-port-params.adoc b/modules/rest-api/partials/user-pw-host-port-params.adoc new file mode 100644 index 0000000000..639a382804 --- /dev/null +++ b/modules/rest-api/partials/user-pw-host-port-params.adoc @@ -0,0 +1,13 @@ + +`user`:: +The name of a user who has one of the roles listed in <<{priv-link}>>. + +`password`:: +The password for the `user`. + +`host`:: +Hostname or IP address of a Couchbase Server. + +`port`:: +Port for the REST API. +Defaults are 8091 for unencrypted and 18901 for encrypted connections. \ No newline at end of file From cb91c1e45f12d0a6d57d16f925670ac3f0c64915 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Fri, 9 May 2025 11:43:00 -0400 Subject: [PATCH 09/17] Rough draft of complete reference docs. --- modules/ROOT/nav.adoc | 2 + .../native-encryption-at-rest-overview.adoc | 6 +- .../encryption-at-rest.adoc | 11 +- .../manage-encryption-keys.adoc | 46 +- .../manage-system-encryption-at-rest.adoc | 442 ++++++++++++++++++ .../rotate-encryption-at-rest-key.adoc | 170 +++++++ .../partials/user-pw-host-port-params.adoc | 10 +- 7 files changed, 650 insertions(+), 37 deletions(-) create mode 100644 modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc create mode 100644 modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index dc7e1c13da..62f51f5158 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -448,6 +448,8 @@ include::cli:partial$cbcli/nav.adoc[] ****** xref:rest-api:deprecated-security-apis/upload-retrieve-root-cert.adoc[Upload and Retrieve the Root Certificate] *** xref:rest-api:security/encryption-at-rest/encryption-at-rest.adoc[] **** xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[] + **** xref:rest-api:security/encryption-at-rest/manage-system-encryption-at-rest.adoc[] + **** xref:rest-api:security/encryption-at-rest/rotate-encryption-at-rest-key.adoc[] *** xref:rest-api:rest-authorization.adoc[Authorization API] **** xref:rest-api:rbac.adoc[Role-Based Access Control (RBAC)] diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 196c7a614e..93e02e0c69 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -136,8 +136,8 @@ Use these keys as Key Encryption Keys (KEKs) to encrypt keys that Couchbase Serv This method adds a layer of security to the locally managed encryption keys while reducing the number of key retrievals from the remote KMS. Remember that you should not use an AWS managed key to directly encrypt data because of the latency of fetching the key remotely. -The following diagram shows a possible configuration of using a single primary encryption key hosted by AWS KMS. -This key encryption key encrypts five encryption keys managed by Couchbase Server. +The following diagram shows a possible configuration using a single primary encryption key hosted by AWS KMS. +This key encryption key encrypts five encryption-at-rest keys managed by Couchbase Server. Each of these keys are assigned to different types of data that's written to disk: Audit, Config, and Log data and the data stored in two buckets named "A" and "B." Each node in the cluster has Data Encryption Keys (DEKs) encrypted by the intermediate encryption keys managed by Couchbase Server. For simplicity, the diagram only shows two nodes. @@ -158,7 +158,7 @@ It helps limit the exposure of data if a data breach compromises an encryption k You can choose to have Couchbase Server rotate DEKs automatically. You can also have it automatically rotate encryption keys that it manages. -Rotation of externally-managed encryption keys is handled by the KMSs that manage them. +Rotation of an externally-managed encryption key is handled by the KMS that manage it. By default, Couchbase Server automatically rotates DEKs but not the encryption keys it manages. You choose how frequently Couchbase Server rotates DEKs and (if you enable it) its encryption keys. diff --git a/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc index f75a430341..497b02053d 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/encryption-at-rest.adoc @@ -30,16 +30,16 @@ See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more infor | xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#create-key[Update an Encryption-at-Rest Key] | `DELETE` -| `/settings/encryptionKey/` +| `/settings/encryptionKey/{KEY_ID}` | xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#delete-key[Delete an Encryption-at-Rest Key] | `GET` | `/settings/security/encryptionAtRest` -| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[Get Encryption at Rest Settings for Non-Bucket Data] +| xref:rest-api:security/encryption-at-rest/manage-system-encryption-at-rest.adoc#get-settings[Get Audit, Config, and Log Encryption-at-Rest Settings] | `POST` | `/settings/security/encryptionAtRest` -| xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc[Change Encryption at Rest Settings for Non-Bucket Data] +| xref:rest-api:security/encryption-at-rest/manage-system-encryption-at-rest.adoc#change-settings[Change Audit, Config, and Log Data Encryption-at-Rest Settings] // No? // | `POST` @@ -52,8 +52,7 @@ See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more infor // | xref:rest-api:rbac.adoc#check-permissions[Check Permissions] | `POST` -| `/controller/rotateEncryptionKey/` -| xref:rest-api:rbac.adoc#check-permissions[Rotate Data Encryption Keys Encrypted by Key] -// Note: only for auto-generated key +| `/controller/rotateEncryptionKey/{KEY_ID}` +| xref:rest-api:security/encryption-at-rest/rotate-encryption-at-rest-key.adoc[Rotate Encryption-at-Rest Key] |=== diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index 7e739674f5..f75610fe75 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -35,11 +35,11 @@ GET /settings/encryptionKey/ .Get details of a specific key ---- -GET /settings/encryptionKey/{KEY-ID} +GET /settings/encryptionKey/{KEY_ID} ---- .Path Parameters -`KEY-ID` (integer):: +`KEY_ID` (integer):: The `id` attribute of the key you want to view. See the <<#gey-keys-example,example>> for an explanation of getting this value. @@ -47,15 +47,15 @@ See the <<#gey-keys-example,example>> for an explanation of getting this value. [source,bash] ---- -curl -sS -u : \ - -X GET 'http[s]://>:/settings/encryptionKeys/[key-id]' +curl -sS -u $USER:$PASSWORD \ + -X GET 'http[s]://:{PORT}/settings/encryptionKeys/[{KEY_ID}]' ---- .Path Parameters :priv-link: get-privs include::partial$user-pw-host-port-params.adoc[] -`key-id`:: +`KEY_ID`:: *Optional* The id of the single encryption-at-rest key whose details you want to retrieve. @@ -73,14 +73,14 @@ You must have at least on one of the following roles: === Responses `200 OK`:: -Returns the encryption-at-rest keys or a particular key if you specified the `key-id` path parameter. +Returns the encryption-at-rest keys or a particular key if you specified the `KEY_ID` path parameter. See examples for an example of the keys. + NOTE: Call returns `200 OK` and an empty JSON message if user does not have permission to view keys. `404 Object Not Found`:: -Returned if you specified a `key-id` path parameter which does not match the ID of an encryption-at-rest key. +Returned if you specified a `KEY_ID` path parameter which does not match the ID of an encryption-at-rest key. [#gey-keys-example] === Examples @@ -223,11 +223,11 @@ POST /settings/encryptionKey/ .Update a Key ---- -PUT /settings/encryptionKey/{KEY-ID} +PUT /settings/encryptionKey/{KEY_ID} ---- .Path Parameters -`KEY-ID` (integer):: +`KEY_ID` (integer):: The `id` attribute of the key you want to update. @@ -236,8 +236,8 @@ The `id` attribute of the key you want to update. .Create an Encryption at Rest Key [source,bash] ---- -curl -sS -u : \ - -X POST http://:/settings/encryptionKeys \ +curl -sS -u $USER:$PASSWORD \ + -X POST http://{HOST}:{PORT}/settings/encryptionKeys \ --data-binary @- <", @@ -255,8 +255,8 @@ EOF .Update an Encryption at Rest Key [source,bash] ---- -curl -sS -u : \ - -X PUT http://:/settings/encryptionKeys/ \ +curl -sS -u $USER:$PASSWORD \ + -X PUT http://{HOST}:{PORT}/settings/encryptionKeys/ \ --data-binary @- <", @@ -280,7 +280,7 @@ Any value you do not supply in the update call is set ot the default value (if a .Path Parameters include::partial$user-pw-host-port-params.adoc[] -`key-id` (integer):: +`KEY_ID` (integer):: The `id` attribute of the key you want to update. .Fields @@ -411,9 +411,9 @@ When using a KMIP-compatible KMS, the `data` object has the following schema: "caSelection": "", "encryptWith": "", "activeKey": { - "kmipId": "" + "kmipId": "" }, - "encryptWithKeyId": + "encryptWithKeyId": } ---- @@ -476,7 +476,7 @@ When having Couchbase Server manage the key, the `data` object has the following "data": { "autoRotation": , "encryptWith": "", - "encryptWithKeyId": + "encryptWithKeyId": "canBeCached": "nextRotationTime": " @@ -545,7 +545,7 @@ Returned if you do not have the proper roles to call this API. See <<#create-privs>>. `404 Object Not Found`:: -Returned if you specified a `encryptWithKeyId` field or a `key-id` path parameter which does not match the `id` field of an existing encryption-at-rest key. +Returned if you specified a `encryptWithKeyId` field or a `KEY_ID` path parameter which does not match the `id` field of an existing encryption-at-rest key. [#create-examples] @@ -798,26 +798,26 @@ See XXX for more formation about deleting keys. .Delete an Encryption Key ---- -DELETE /settings/encryptionKeys/{KEY-ID} +DELETE /settings/encryptionKeys/{KEY_ID} ---- .Path Parameters -`KEY-ID` (integer):: +`KEY_ID` (integer):: The `id` attribute of the key you want to delete. === curl Syntax [source,bash.] ---- -curl -sS -u : -X DELETE \ - http://:/settings/encryptionKeys/ +curl -sS -u $USER:$PASSWORD -X DELETE \ + http://{HOST}:{PORT}/settings/encryptionKeys/ ---- .Path Parameters :priv-link: del-privs include::partial$user-pw-host-port-params.adoc[] -`key-id` (integer):: +`KEY_ID` (integer):: The `id` attribute of the key you want to delete. diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc new file mode 100644 index 0000000000..789097bbe0 --- /dev/null +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc @@ -0,0 +1,442 @@ += Manage Audit, Config, and Log Encryption at Rest +:description: pass:q[You can use the REST API to view and change the state of encryption at rest for non-bucket data.] +:page-edition: Enterprise Edition +:page-topic-type: reference +:tabs: +:page-toclevels: 3 + +[abstract] +{description} + +== Description + +The REST API described in this page lets you control encryption at rest for audit data, configuration settings, and logs in Couchbase Server. +See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information about encryption at rest. + +== HTTP Methods + +This API endpoint supports the following methods: + +* <<#get-settings>> +* <<#change-settings>> + + + +[#get-settings] +== Get Audit, Config, and Log Encryption-at-Rest Settings + +Use this endpoint to get the current encryption-at-rest settings for non-bucket data. + +.List All Settings +---- +GET /settings/security/encryptionAtRest +---- + +=== curl Syntax + +[source,bash] +---- + curl -s -u $USER:$PASSWORD -X GET \ + 'http://{HOST}:{PORT}/settings/security/encryptionAtRest' | jq +---- + +.Path Parameters +:priv-link: get-privs +include::partial$user-pw-host-port-params.adoc[] + + +[[get-privs]] +=== Required Privileges + +You must have at least on one of the following roles: + +* xref:learn:security/roles.adoc#security_admin_external[External User Admin] +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin_local[Local User Admin] +* xref:learn:security/roles.adoc#read-only-admin[Read-Only Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] + +=== Responses + +`200 OK`:: +Returns the encryption-at-rest settings for audit, config, and logs. +See examples for an example of the output. + +`403 Forbidden`:: +Returned if the user does not have one of the roles listed in <>. + + +[#gey-keys-example] +=== Examples + +The following example gets the current encryption-at-rest status. + +[source,bash] +---- +curl -Ss -u Administrator:password -X \ + GET 'http://127.0.0.1:8091/settings/security/encryptionAtRest' | jq +---- + +An example of running the previous command: + +[source,json] +---- +{ + "audit": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": 0, + "encryptionMethod": "encryptionKey", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:35:40Z" + } + }, + "config": { + "dekLastDropDate": "2025-04-23T18:43:23Z", + "dekLifetime": 31536000, + "dekRotationInterval": 2592000, + "encryptionKeyId": 0, + "encryptionMethod": "encryptionKey", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:43:27Z" + } + }, + "log": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": 0, + "encryptionMethod": "encryptionKey", + "info": { + "dataStatus": "partiallyEncrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:34:34Z" + } + } +} +---- + +Each type of system data that you can configure to be encrypted has its own object in the output (`audit`, `config`, `log`). +Some important fields in each of these objects are: + +* The `info.dataStatus` field shows whether the data is being encrypted. +* If Couchbase Server is encrypting the data, `encryptionMethod` indicates what it's using to encrypt it. +This value can be: +** `disabled`: not being encrypted +** `encryptionKey`: encrypted using an encryption-at-rest key. +** `nodeSecretManager`: Couchbase Server uses the master database password to encrypt the data. + + + + +[[change-settings]] +== Change Audit, Config, and Log Data Encryption-at-Rest Settings + +You can create or update an encryption-at-rest-key key using the REST API. + + +.Change Audit, Config, and Log Encryption at Rest Settings +---- +POST /settings/security/encryptionAtRest +---- + +=== curl Syntax + +.Create an Encryption at Rest Key +[source,bash] +---- +curl -sS -u $USER:$PASSWORD \ + -X POST http://{HOST}:{PORT}/settings/security/encryptionAtRest \ + [-d '.encryptionMethod='] + [-d '.encryptionKeyId='] + [-d '.dekRotationInterval='] + [-d '.dekLifetime='] +---- + +:priv-link: change-privs +.Path Parameters +include::partial$user-pw-host-port-params.adoc[] + + +.Fields + + +`type`:: +The type of the data whose encryption-at-rest-settings you want to change. +Must be one of these values: + ++ +* `audit`: change settings for encrypting audit data. +* `config`: change settings for encrypting configuration data. +* `log`: change settings for encrypting log data. + +`encryptionMethod`:: +Controls whether and how the data is encrypted. +Allowed values are: + ++ +* `disabled`: The data is not encrypted. +* `encryptionKey`: Couchbase Server encrypts the data using an encryption-at-rest key. +When you choose this option, you must also set `encryptionKeyId`. +* `nodeSecretManager`: Couchbase Server encrypts the data using the master database password. + +`encryptionKeyId` (integer):: +The `id` field value of the encryption-at-rest-key that Couchbase Server uses to encrypt the data. +See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `id` of the key you want to use. +This field is required when you set `encryptionMethod`` to `encryptionKey`. + +`dekRotationInterval` (integer):: +The duration of time, in seconds, that the data encryption key (DEK) Couchbase Server uses to encrypt the data is valid. +Once this time elapses, Couchbase Server rotates the DEK automatically. +Defaults to `2592000` (30 days). +See xref:learn:security:native-encryption-at-rest-overview.adoc[Encryption Key Rotation and Expiration] for more information about key rotation. + +`dekLifetime` (integer):: +The period of time, in seconds, that Couchbase Server keeps expired DEKs before deleting them. +Couchbase Server keeps expired DEKs until either the lifetime elapses or no data remains encrypted with the DEK. +If the DEK’s lifetime elapses while data is still encrypted with it, Couchbase Server re-encrypts the data using the active DEK and deletes the expired one. +Defaults to `31536000` (1 year). +See xref:learn:security:native-encryption-at-rest-overview.adoc[Encryption Key Rotation and Expiration] for more information about key lifetime. + + +[[change-privs]] +=== Required Privileges + +You must have at least on one of the following roles: + +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] + + +=== Responses + +`200 OK`:: +Returns a JSON message containing the settings for audit, config, and log after your changes were applied. +See <<#change-examples>> for examples of the returned JSON. + +`400 Bad Request`:: +Returned when errors occur, such as leaving out a required setting or invalid JSON. +Also returns a descriptive JSON message. +For example, if you set `config.encryptionMethod` to `encryptionKey` but do not set `encryptionKeyId`, you receive this message: + ++ +[source,json] +---- +{ + "errors": { + "config.encryptionMethod": "encryptionKeyId must be set when encryptionMethod is set to encryptionKey" + } +} +---- + +If you set `config.encryptionKeyId` to a non-existent key, you get the following message: + +[source,json] +---- +{ + "errors": { + "config.encryptionKeyId": "Key does not exist" + } +} +---- + +`403 Forbidden`:: +Returned if you do not have the proper roles to call this API. +See <>. + + + +[#create-examples] +=== Examples + +[#log-use-master] +.Encrypt Log Data Using the Master Database Password + +The following example configures logs to use the master database password to encrypt data by setting `log.encryptionMethod` to `nodeSecretManager`. + +[source,bash] +---- + curl -v -u Administrator:password \ + -X POST 'http://127.0.0.1:8091/settings/security/encryptionAtRest' \ + -d "log.encryptionMethod=nodeSecretManager" | jq +---- + +The output of running the previous example looks like this: + +[source,json] +---- +{ + "audit": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "disabled", + "info": { + "dataStatus": "unknown", + "dekNumber": 0, + "issues": [] + } + }, + "config": { + "dekLastDropDate": "2025-04-23T18:43:23Z", + "dekLifetime": 31536000, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "nodeSecretManager", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:43:27Z" + } + }, + "log": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "nodeSecretManager", + "info": { + "dataStatus": "partiallyEncrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:34:34Z" + } + } +} +---- + + + +.Encrypt Audit Data Using Encryption-at-Rest Key + + +The following example uses an encryption-at-rest key to encrypt the audit data. + +[source,bash] +---- + curl -v -u Administrator:password \ + -X POST 'http://127.0.0.1:8091/settings/security/encryptionAtRest' \ + -d "audit.encryptionMethod=encryptionKey" \ + -d "audit.encryptionKeyId=0" | jq +---- + +The output of the previous example looks like this: + +[source,json] +---- +{ + "audit": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": 0, + "encryptionMethod": "encryptionKey", + "info": { + "dataStatus": "unknown", + "dekNumber": 0, + "issues": [] + } + }, + "config": { + "dekLastDropDate": "2025-04-23T18:43:23Z", + "dekLifetime": 31536000, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "nodeSecretManager", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:43:27Z" + } + }, + "log": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "nodeSecretManager", + "info": { + "dataStatus": "partiallyEncrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:34:34Z" + } + } +} +---- + +NOTE: In the example, you may notice that `audit.info.dataStatus` indicates the data's status is `unknown`. +It reports this state because Couchbase Server was still encrypting the data when the call to the `encryptionAtRest` endpoint returned the JSON message. +Eventually, this status becomes `encrypted` once Couchbase Server finishes encryting the audit data. + + +.Disable Encryption-at-Rest for Logs and Audit + +[source,bash] +---- +curl -v -u Administrator:password \ + -X POST 'http://127.0.0.1:8091/settings/security/encryptionAtRest' \ + -d "audit.encryptionMethod=disabled" \ + -d "log.encryptionMethod=disabled" | jq +---- + +The output from the previous example looks like this: + +[source,json] +---- +{ + "audit": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "disabled", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-05-08T17:59:46Z" + } + }, + "config": { + "dekLastDropDate": "2025-04-23T18:43:23Z", + "dekLifetime": 31536000, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "nodeSecretManager", + "info": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:43:27Z" + } + }, + "log": { + "dekLastDropDate": "", + "dekLifetime": 0, + "dekRotationInterval": 2592000, + "encryptionKeyId": -1, + "encryptionMethod": "disabled", + "info": { + "dataStatus": "partiallyEncrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-04-23T18:34:34Z" + } + } +} +---- + +NOTE: As with the previous example, the values of the `audit.info.dataStatus` and `log.info.dataStatus` do not match the `encryptionMethod` setting. +It takes time for Couchbase Server to decrypt the data when you turn off encryption-at-rest. diff --git a/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc b/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc new file mode 100644 index 0000000000..e6d6874307 --- /dev/null +++ b/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc @@ -0,0 +1,170 @@ += Rotate Data Encryption Keys +:description: pass:q[You can use the REST API have Couchbase Server immediately rotate an encryption-at-rest key that it manages.] +:page-edition: Enterprise Edition +:page-topic-type: reference +:tabs: +:page-toclevels: 3 + +[abstract] +{description} + +== Description + +You may want to force the rotation of an encryption-at-rest key if you suspect the current key has been compromised. +You can have Couchbase Server rotate an encryption-at-rest key that it manages by calling a REST API endpoint. +Keys managed by an external KMS must be rotated by the KMS. +Consult your KMS's documentation to learn how to rotate its keys. +See xref:learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. + +== HTTP Methods + +This API endpoint supports the following methods: + +* <<#rotate-key>> + + + +[#rotate-key] +== Rotate an Encryption-at-Rest Key + +Use this endpoint current encryption-at-rest settings for non-bucket data + +.Rotate a Key +---- +POST /controller/rotateEncryptionKey/{KEY_ID} +---- + +.Path Parameters + +`KEY_ID` (integer, required):: +The `id` of the encryption-at-rest key to rotate. +See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `id` of the key you want to rotate. + +=== curl Syntax + +[source,bash] +---- + curl -u $USER:$PASSWORD -X GET \ + 'http://{HOST}:{PORT}//controller/rotateEncryptionKey/{KEY_ID}' | jq +---- + +.Path Parameters +:priv-link: rotate-privs +include::partial$user-pw-host-port-params.adoc[] + +`KEY_ID` (integer, required):: +The `id` of the encryption-at-rest key to rotate. +See xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `id` of the key you want to rotate. + + +[[rotate-privs]] +=== Required Privileges + +You must have at least on one of the following roles: + +* xref:learn:security/roles.adoc#admin[Full Admin] +* xref:learn:security/roles.adoc#security_admin[Security Admin] + +=== Responses + +`200 OK`:: +Does not return any other message other than the response code. + +`403 Forbidden`:: +Returned if the user does not have one of the roles listed in <>. + +`404 Object Not Found`:: +Returned if the `KEY_ID` does not match an encryption-at-rest key. + +[#gey-keys-example] +=== Examples + +The following example rotates the encryption-at-rest key for the named `Example Auto-Generated Key`: + +[source,json] +---- + { + "data": { + "keys": [ + { + "id": "5fb1ef72-b3db-47f3-b989-0c156ee6eb40", + "active": true, + "creationDateTime": "2025-05-07T14:11:53Z", + "keyMaterial": "******" + } + ], + "encryptWith": "nodeSecretManager", + "canBeCached": true, + "autoRotation": false + }, + "id": 18, + "name": "Example Auto-Generated Key", + "type": "auto-generated-aes-key-256", + "usage": [ + "KEK-encryption", + "bucket-encryption", + "config-encryption", + "log-encryption", + "audit-encryption" + ], + "creationDateTime": "2025-05-07T14:11:53Z" +} +---- + +This key's `data.id` is `18`. +The command to rotate this key is: + +[source,bash] +---- +curl -u Administrator:password \ + -X POST 'http://127.0.0.1:8091/controller/rotateEncryptionKey/18' +---- + +This command does not return output. +To see its effect, you can call the `/settings/encryptionKey/` endpoint (see xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] for details) to get the current status of the key: + +[source,bash] +---- + curl -u Administrator:password -X GET \ + http://127.0.0.1:8091/settings/encryptionKeys/18 | jq +---- + +The JSON returned by this command shows the encryption-at-rest has a new key within the `data.keys` object whose `active` attribute is `true`: + +[source,json] +---- +{ + "data": { + "keys": [ + { + "id": "3887ad84-7535-4d54-a9d2-fd9d855985b6", + "active": true, + "creationDateTime": "2025-05-09T12:49:01Z", + "keyMaterial": "******" + }, + { + "id": "5fb1ef72-b3db-47f3-b989-0c156ee6eb40", + "active": false, + "creationDateTime": "2025-05-07T14:11:53Z", + "keyMaterial": "******" + } + ], + "encryptWith": "nodeSecretManager", + "lastRotationTime": "2025-05-09T12:49:01Z", + "canBeCached": true, + "autoRotation": false + }, + "id": 18, + "name": "Example Auto-Generated Key", + "type": "auto-generated-aes-key-256", + "usage": [ + "KEK-encryption", + "bucket-encryption", + "config-encryption", + "log-encryption", + "audit-encryption" + ], + "creationDateTime": "2025-05-07T14:11:53Z" +} +---- + diff --git a/modules/rest-api/partials/user-pw-host-port-params.adoc b/modules/rest-api/partials/user-pw-host-port-params.adoc index 639a382804..ae17104e59 100644 --- a/modules/rest-api/partials/user-pw-host-port-params.adoc +++ b/modules/rest-api/partials/user-pw-host-port-params.adoc @@ -1,13 +1,13 @@ -`user`:: +`USER`:: The name of a user who has one of the roles listed in <<{priv-link}>>. -`password`:: +`PASSWORD`:: The password for the `user`. -`host`:: +`HOST`:: Hostname or IP address of a Couchbase Server. -`port`:: -Port for the REST API. +`PORT`:: +Port number for the REST API. Defaults are 8091 for unencrypted and 18901 for encrypted connections. \ No newline at end of file From 6ecb2489384d8fcbf70386b3d20002cb9da7d65f Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Fri, 9 May 2025 13:25:20 -0400 Subject: [PATCH 10/17] Minor edits --- .../manage-encryption-keys.adoc | 4 ++-- .../rotate-encryption-at-rest-key.adoc | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index f75610fe75..8b7a8418f9 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -55,8 +55,8 @@ curl -sS -u $USER:$PASSWORD \ :priv-link: get-privs include::partial$user-pw-host-port-params.adoc[] -`KEY_ID`:: -*Optional* The id of the single encryption-at-rest key whose details you want to retrieve. +`KEY_ID` (optional):: +The id of the single encryption-at-rest key whose details you want to retrieve. [[get-privs]] diff --git a/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc b/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc index e6d6874307..85c08ea75e 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/rotate-encryption-at-rest-key.adoc @@ -10,8 +10,11 @@ == Description -You may want to force the rotation of an encryption-at-rest key if you suspect the current key has been compromised. +You can manually trigger the rotation of an encryption-at-rest key that Couchbase Server manages. +You may want to manually rotate the key if you believe it's compromised. You can have Couchbase Server rotate an encryption-at-rest key that it manages by calling a REST API endpoint. + + Keys managed by an external KMS must be rotated by the KMS. Consult your KMS's documentation to learn how to rotate its keys. See xref:learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. @@ -23,11 +26,10 @@ This API endpoint supports the following methods: * <<#rotate-key>> - [#rotate-key] == Rotate an Encryption-at-Rest Key -Use this endpoint current encryption-at-rest settings for non-bucket data +Use this endpoint to rotate an encryption-at-rest key. .Rotate a Key ---- @@ -37,8 +39,8 @@ POST /controller/rotateEncryptionKey/{KEY_ID} .Path Parameters `KEY_ID` (integer, required):: -The `id` of the encryption-at-rest key to rotate. -See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `id` of the key you want to rotate. +The encryption-at-rest key to rotate identified by its `data.id` value. +See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `data.id` value of the key you want to rotate. === curl Syntax @@ -53,8 +55,8 @@ See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to include::partial$user-pw-host-port-params.adoc[] `KEY_ID` (integer, required):: -The `id` of the encryption-at-rest key to rotate. -See xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `id` of the key you want to rotate. +The encryption-at-rest key to rotate identified by its `data.id` value. +See xref:manage-encryption-keys.adoc#list-keys[List Encryption-at-Rest Keys] to learn how to get the `data.id` value of the key you want to rotate. [[rotate-privs]] From c97eea0f1572d109b7bd5d69da26f1a3174dbe8e Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Tue, 13 May 2025 16:11:51 -0400 Subject: [PATCH 11/17] Added new parameters to bucket creation. --- .../manage-native-encryption-at-rest.adoc | 114 +++-- .../bucket-encryption-examples.adoc | 39 ++ .../create-auto-generated-key-response.adoc | 29 ++ .../create-auto-generated-key.adoc | 19 + .../rest-api/pages/rest-bucket-create.adoc | 455 ++++++++++++------ .../manage-encryption-keys.adoc | 50 +- 6 files changed, 474 insertions(+), 232 deletions(-) create mode 100644 modules/rest-api/examples/encryption-at-rest/bucket-encryption-examples.adoc create mode 100644 modules/rest-api/examples/encryption-at-rest/create-auto-generated-key-response.adoc create mode 100644 modules/rest-api/examples/encryption-at-rest/create-auto-generated-key.adoc diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc index a04a0769f4..85dc5c0615 100644 --- a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -26,15 +26,18 @@ For an overview of native encryption at rest, see xref:learn:security/native-enc Enabling encryption at rest is a two step process: . Create at least one encryption key. -Couchbase Server uses these keys to encrypt its own encryption keys for data. +You must use an encryption-at-rest key to encrypt bucket data. +You can choose to use the master database password instead of an encryption-at-rest key to encrypt audit, configuration, and log data. +However, for the best security, you should use an encryption-at-rest key managed by an external Key Management Service (KMS). . Enable encryption for one or more types of data. The following sections explain these steps in greater detail. +[[create-keys]] ## Creating Encryption Keys -Before encrypting data at rest, you must create at least one encryption key. -You can limit what type of data each key can encrypt or limit them to . +Before encrypting bucket data at rest, you must create at least one encryption key. +You should also consider creating encryption-at-rest keys when encrypting audit, configuration, and log data. ### Requirements @@ -139,10 +142,10 @@ To complete creating the key: If you want to use another encryption key, it must be configured as a Key Encryption Key (KEK). . Decide whether you want Couchbase Server to cache the key. This setting lets Couchbase Server keep the key unencrypted in memory so it does not have to decrypt it for each read or write. -Disabling this option introduces more overhead as the key needs to be decrypted for each use. -It does increase security slightly by reducing the chances that the unencrypted key could be leaked. -. Decide whether you want to have the keys auto rotate. -If you choose to rotate them, enter how often to rotate, a date and time for the first rotation. +Disabling this option increases processor resource use because Couchbase Server has to decrypt the key for each use. +Disabling it does slightly improve security by reducing the chance of in-memory key exposure attacks. +. Decide whether you want to have the encryption-at-rest key auto rotate. +If you choose to rotate it, enter how often to rotate, a date and time for the first rotation. See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. -- @@ -152,41 +155,84 @@ See xref:learn:secrutiy/native-encryption-at-rest-overview.adoc#rotation-expirat The REST API's `/settings/encryptionKey` endpoint lets you create and manage encryption keys. To create an encryption key, send a POST containing details of the key to this endpoint. -All POST calls have several common keys that they must include: -* `name`: the name for the key. -* `type`: The type of the key. -Couchbase Server only supports AES 256 encryption keys. -Therefore, the only important part of the value is the KMS that will manage the key: +The following example shows how to create an encryption key managed by Couchbase Server using the REST API: +include::rest-api:example$encryption-at-rest/create-auto-generated-key.adoc[] + +Some of the parameters set in the example are: + +* `name`: the name you want to give the key. +* `type`: the KMS you want to use to manage the key and the key's encryption algprithm. +* `usage`: the type of data the key can encrypt. + +The `data` object content depends on the KMS you chose. +For keys managed by Couchbase Server, the `data` object's content mainly set key rotation options. +The example sets the `rotationIntervalInDays` to `90` and the date of the next rotation to July 1st 2025. + +The output of running the previous example looks like this: + +include::rest-api:example$encryption-at-rest/create-auto-generated-key-response.adoc[] + +See xref:rest-api:security/encryption-at-rest/manage-encryption-keys.adoc#create-key[Create or Update an Encryption-at-Rest Key] for details on how to create keys using the REST API. + +## Encrypt Data at Rest + +Once you have created an encrytion-at-rest key, you can use it to encrypt bucket data. +For audit, configuration, and log data, you can choose to use the master database password instead of an encryption-at-rest key. + +The following sections explain how to enable encryption for each type of data. + +### Encrypt Bucket Data + +To encrypt a bucket, you must have at least one encrytion-at-rest key configured to encrypt all buckets or the specific bucket you want to encrypt. +See <> for more information about creating encryption-at-rest keys. + +Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or xref:learn:security/roles.adoc#cluster-admin[Cluster Admin] roles can enable encryption for rest for buckets as long as an encryption key exists that's allowed to encrypt the bucket. + +.Encrypt a Bucket Using the Couchbase Server Web Console +. On the main menu, select menu:Buckets[]. +. You can encrypt a bucket when you create it or you can edit an existing bucket to encrypt it. + -** `awskms-aes-key-256`: managed by AWS's KMS. -** `auto-generated-aes-key-256` managed by Couchbase Server. -** `kmip-aes-key-256` managed by a KMIP-compatible KMS. - -* `useage`: an array that lists what the key can encrypt. -Valid values are: - -** `audit-encryption`: can encrypt audit data -** `bucket-encryption`: can encrypt all buckets. -When a key can only encrypt specific buckets, each bucket has an entry in the list in the format `bucket-encryption-`. -See *FIXME* for more information. -** `config-encryption`: can encrypt configuration information. -** `KEK-encryption`: can encrypt other encryption keys. -** `log-encryption`: can encrypt log - -* `data`: contains KMS-specific settings. -+ -[{tabs}] -==== -AWS:: -+ +-- +For an existing bucket: + +a. Click the name of the bucket you want to encrypt. +a. Click btn:[Edit]. + +For a new bucket: + +a. Click btn:[Add Bucket] to open the *Create Bucket* dialog. -- +. In the *Edit Bucket Settings* or *Add Data Bucket* dialog, expand the *Advanced bucket settings* section. +. Select the *Enable Encryption at Rest*. +. In the *Available Encryption Keys* list, select the encryption key you want to use to encrypt the bucket. +. Configure the *DEK Rotation Interval* and *DEK Life Time* settings to configure the data encryption key rotation. +See xref::learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about these settings. +. Click btn:[Add Bucket] or btn:[Save Changes] to save your changes. +.Encrypt a Bucket Using the REST API +To encrypt a bucket using the REST API, send a POST request to the `/pools/default/buckets` endpoint with the `encryptionType` parameter set to `full` and the `encryptionKey` parameter set to the ID of the encryption key you want to use. +When creating a bucket, you can set the `encryptionAtRestKeyId` parameter to the ID of the encryption key you want to use to encrypt the bucket: +include::rest-api:example$encryption-at-rest/bucket-encryption-examples.adoc[tag=create-bucket] + +When updating an existing bucket, you can set the `encryptionAtRestKeyId` parameter to the ID of the encryption key you want to use to encrypt the bucket: + +include::rest-api:example$encryption-at-rest/bucket-encryption-examples.adoc[tag=alter-bucket] + +If the bucket is already encrypted, Couchbase Server will re-encrypt the bucket using the new key. +If the bucket is not encrypted, Couchbase Server encrypts it. + +See xref:rest-apt:rest-bucket-create.adoc[] for more inform,ation about creating and updating buckets using the REST API. + +### Encrypt Audit, Configuration, and Log Data + +You can encrypt audit, configuration, and log data using the master database password or an encryption-at-rest key. +By default, Couchbase Server encrypts the configuration data using the master key. // Notes: @@ -194,4 +240,4 @@ AWS:: // cluster-admin can enable encryption at rest for a bucket. Cannot access Secrutiy settings. -Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or Cluster Admin roles can enable encryption for rest for buckets as long as an encryption key exists that's allowed to create the bucket. \ No newline at end of file + diff --git a/modules/rest-api/examples/encryption-at-rest/bucket-encryption-examples.adoc b/modules/rest-api/examples/encryption-at-rest/bucket-encryption-examples.adoc new file mode 100644 index 0000000000..fd373a5f0b --- /dev/null +++ b/modules/rest-api/examples/encryption-at-rest/bucket-encryption-examples.adoc @@ -0,0 +1,39 @@ + +// tag::create-bucket[] +[source,bash] +---- +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ +-u Administrator:password \ +-d name=testBucket \ +-d ramQuota=100 \ +-d encryptionAtRestKeyId=0 +---- +// end::create-bucket[] + +// tag::alter-bucket[] +[source,bash] +---- +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ +-u Administrator:password \ +-d encryptionAtRestKeyId=18 +---- +// end::alter-bucket[] + + +// tag::set-dek-rotation[] +[source,bash] +---- +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ +-u Administrator:password \ +-d encryptionAtRestDekRotationInterval=1296000 +---- +// end::set-dek-rotation[] + +// tag::set-dek-lifetime[] +[source,bash] +---- +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ +-u Administrator:password \ +-d encryptionAtRestDekLifetime=7776000 +---- +// end::set-dek-lifetime[] \ No newline at end of file diff --git a/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key-response.adoc b/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key-response.adoc new file mode 100644 index 0000000000..44784cb8cc --- /dev/null +++ b/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key-response.adoc @@ -0,0 +1,29 @@ +[source,json] +---- +{ + "data": { + "keys": [ + { + "id": "fad3d3ae-9195-4779-994e-69266c9360c9", + "active": true, + "creationDateTime": "2025-05-02T19:34:07Z", + "keyMaterial": "******" + } + ], + "encryptWith": "nodeSecretManager", + "canBeCached": true, + "nextRotationTime": "2025-07-31T19:27:19Z", + "autoRotation": true, + "rotationIntervalInDays": 90 + }, + "id": 13, + "name": "Example Auto-Generated Key", + "type": "auto-generated-aes-key-256", + "usage": [ + "bucket-encryption-travel-sample", + "config-encryption", + "log-encryption" + ], + "creationDateTime": "2025-05-02T19:34:07Z" +} +---- \ No newline at end of file diff --git a/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key.adoc b/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key.adoc new file mode 100644 index 0000000000..2d914495ec --- /dev/null +++ b/modules/rest-api/examples/encryption-at-rest/create-auto-generated-key.adoc @@ -0,0 +1,19 @@ +[source,bash] +---- +curl -u Administrator:password \ + -X POST \ + http://127.0.0.1:8091/settings/encryptionKeys \ + --data-binary @- < +.Edit an Existing Bucket +---- +POST /pools/default/buckets/{bucketName} ---- [#description] == Description -These respectively create a new bucket and edit an existing bucket. -The bucket can be of any type: Couchbase, Ephemeral, or Memcached. -(Note, however that Memcached buckets are now _deprecated_.) +These endpoints create a new bucket and edit an existing bucket. +You can create buckets of any type: Couchbase, Ephemeral, or Memcached. +(Memcached buckets are now deprecated.) -On creation, a bucket must be assigned a name that is unique among buckets defined on the cluster: this name cannot subsequently be changed. -Names cannot be longer than 100 bytes (which is to say, characters). +When you create a bucket, you must assign it a name that is unique across all buckets on the cluster. You cannot change the name after creation. +Bucket names must not exceed 100 bytes (i.e., 100 characters). -A maximum of 30 buckets can be created on a single cluster. +A single cluster can contain up to 30 buckets. -Administrators with either the Full Admin or the Cluster Admin role can create buckets and edit their configurations. -Bucket configurations can also be edited by administrators with the Bucket Admin role, provided that its privileges have been extended either to all buckets on the cluster, or to the specific bucket whose configuration is to be edited. -See xref:learn:security/roles.adoc[Roles], for information on roles and privileges. +Administrators with the Full Admin or Cluster Admin role can create and configure buckets. +Administrators with the Bucket Admin role can also edit bucket configurations, as long as their privileges apply to all buckets or specifically to the target bucket. +For details on roles and privileges, see xref:learn:security/roles.adoc[Roles]. NOTE: While migrating a bucket from one storage backend to another, you can only edit the bucket's xref:rest-api:rest-bucket-create.adoc#ramQuota[ramQuota] and xref:rest-api:rest-bucket-create.adoc#storagebackend[storageBackend] parameters. See xref:manage:manage-buckets/migrate-bucket.adoc[] for more information. @@ -37,8 +41,9 @@ NOTE: While migrating a bucket from one storage backend to another, you can only [#curl-syntax] == Curl Syntax -Note that floats and integers referred to in the following syntax-display are _non-negative_ only. +The floats and integers fields in the following syntax must be non-negative values. +[source,bash] ---- curl -X POST -u : http://:/pools/default/buckets @@ -66,84 +71,131 @@ curl -X POST -u : -d historyRetentionCollectionDefault=[ true | false ] -d historyRetentionBytes= -d historyRetentionSeconds= + -d encryptionAtRestKeyId= + -d encryptionAtRestDekRotationInterval= + -d encryptionAtRestDekLifetime= -d autoCompactionDefined=[ true | false ] - -d parallelDBAndViewCompaction=[ true | false ] - -d databaseFragmentationThreshold[percentage]= - -d databaseFragmentationThreshold[size]= - -d viewFragmentationThreshold[percentage]= - -d viewFragmentationThreshold[size]= - -d purgeInterval=[ | ] - -d allowedTimePeriod[fromHour]= - -d allowedTimePeriod[fromMinute]= - -d allowedTimePeriod[toHour]= - -d allowedTimePeriod[toMinute]= - -d allowedTimePeriod[abortOutside]=[ true | false ] + -d parallelDBAndViewCompaction=[ true | false ] + -d databaseFragmentationThreshold[percentage]= + -d databaseFragmentationThreshold[size]= + -d viewFragmentationThreshold[percentage]= + -d viewFragmentationThreshold[size]= + -d purgeInterval=[ | ] + -d allowedTimePeriod[fromHour]= + -d allowedTimePeriod[fromMinute]= + -d allowedTimePeriod[toHour]= + -d allowedTimePeriod[toMinute]= + -d allowedTimePeriod[abortOutside]=[ true | false ] + ---- All parameters are described in the following subsections. == Parameter Groups -Parameters that support the creation and editing of buckets can be considered to form two groups; which are, respectively, _General_ and _Auto-compaction_. +Parameters that support the creation and editing of buckets can be broken two groups: Genera and Auto-compaction. === General -Parameters in the _General_ group include: +This section lists the general parameters for creating a bucket. -* Parameters that _must_ be specified on bucket creation, these being: +You must supply a value for the following parameters: -** xref:rest-api:rest-bucket-create.adoc#ramQuota[ramQuota], which establishes a memory-quota for the bucket, and _can_ be edited following bucket creation. +* xref:rest-api:rest-bucket-create.adoc#ramQuota[ramQuota] +* xref:rest-api:rest-bucket-create.adoc#name[name] -** xref:rest-api:rest-bucket-create.adoc#name[name], which establishes a name for the bucket, and _cannot_ be edited following bucket creation. +All other parameters are optional and have a default value. -* Parameters that _can_ be specified on bucket creation, but if not specified, acquire a default value. -They include: +The following parameters can be edited after bucket creation: -** Parameters that _can_ be edited after bucket creation; these being xref:rest-api:rest-bucket-create.adoc#evictionpolicy[evictionPolicy], xref:rest-api:rest-bucket-create.adoc#durabilityminlevel[durabilityMinLevel], xref:rest-api:rest-bucket-create.adoc#threadsnumber[threadsNumber], xref:rest-api:rest-bucket-create.adoc#rank[rank], xref:rest-api:rest-bucket-create.adoc#replicanumber[replicaNumber], xref:rest-api:rest-bucket-create.adoc#compressionmode[compressionMode], xref:rest-api:rest-bucket-create.adoc#maxttl[maxTTL], xref:rest-api:rest-bucket-create.adoc#flushenabled[flushEnabled], xref:rest-api:rest-bucket-create.adoc#magmaseqtreedatablocksize[magmaSeqTreeDataBlockSize], -xref:rest-api:rest-bucket-create.adoc#historyretentioncollectiondefault[historyRetentionCollectionDefault], -xref:rest-api:rest-bucket-create.adoc#historyretentionbytes[historyRetentionBytes], xref:rest-api:rest-bucket-create.adoc#storagebackend[storageBackend], and -xref:rest-api:rest-bucket-create.adoc#historyretentionseconds[historyRetentionSeconds]. +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> -** Parameters that _cannot_ be edited after bucket creation; these being xref:rest-api:rest-bucket-create.adoc#buckettype[bucketType], xref:rest-api:rest-bucket-create.adoc#replicaindex[replicaIndex], and xref:rest-api:rest-bucket-create.adoc#conflictresolutiontype[conflictResolutionType]. +You cannot edit these parameters after bucket creation: -For full details and examples, see xref:rest-api:rest-bucket-create.adoc#general-parameters[General Parameters], below. +* xref:rest-api:rest-bucket-create.adoc#buckettype[bucketType] +* xref:rest-api:rest-bucket-create.adoc#replicaindex[replicaIndex] +* xref:rest-api:rest-bucket-create.adoc#conflictresolutiontype[conflictResolutionType] + +For full details and examples, see xref:rest-api:rest-bucket-create.adoc#general-parameters[General Parameters]. === Auto-Compaction -_All_ auto-compaction parameters can be edited, following bucket creation. +You can edit all auto-compaction parameters after bucket creation. + +The Auto-compaction parameter group contains the following: + +* xref:rest-api:rest-bucket-create.adoc#autocompactiondefined[autoCompactionDefined] +* xref:rest-api:rest-bucket-create.adoc#paralleldbandviewcompaction[parallelDBAndViewCompaction] +* xref:rest-api:rest-bucket-create.adoc#databasefragmentationthresholdpercentage[+databaseFragmentationThreshold[percentage]+] +* xref:rest-api:rest-bucket-create.adoc#databasefragmentationthresholdsize[+databaseFragmentationThreshold[size]+] +* xref:rest-api:rest-bucket-create.adoc#viewfragmentationthresholdpercentage[+viewFragmentationThreshold[percentage]+] +* xref:rest-api:rest-bucket-create.adoc#viewfragmentationthresholdsize[+viewFragmentationThreshold[size]+] +* xref:rest-api:rest-bucket-create.adoc#purgeinterval[purgeInterval] +* xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodfromhour[+allowedTimePeriod[fromHour]+] +* xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodfromminute[+allowedTimePeriod[fromMinute]+] +* xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodtohour[+allowedTimePeriod[toHour]+] +* xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodtominute[+allowedTimePeriod[toMinute]+] +* xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodabortoutside[+allowedTimePeriod[abortOutside]+] -The Auto-compaction parameter group contains the following: xref:rest-api:rest-bucket-create.adoc#autocompactiondefined[autoCompactionDefined], xref:rest-api:rest-bucket-create.adoc#paralleldbandviewcompaction[parallelDBAndViewCompaction], xref:rest-api:rest-bucket-create.adoc#databasefragmentationthresholdpercentage[+databaseFragmentationThreshold[percentage]+], xref:rest-api:rest-bucket-create.adoc#databasefragmentationthresholdsize[+databaseFragmentationThreshold[size]+], xref:rest-api:rest-bucket-create.adoc#viewfragmentationthresholdpercentage[+viewFragmentationThreshold[percentage]+], xref:rest-api:rest-bucket-create.adoc#viewfragmentationthresholdsize[+viewFragmentationThreshold[size]+], xref:rest-api:rest-bucket-create.adoc#purgeinterval[purgeInterval], xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodfromhour[+allowedTimePeriod[fromHour]+], xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodfromminute[+allowedTimePeriod[fromMinute]+], xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodtohour[+allowedTimePeriod[toHour]+], xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodtominute[+allowedTimePeriod[toMinute]+], and xref:rest-api:rest-bucket-create.adoc#allowedtimeperiodabortoutside[+allowedTimePeriod[abortOutside]+]. -Note that _Auto-compaction_ parameters take effect only if both of the following are true: +[NOTE] +==== +Auto-compaction parameters take effect only if both of the following are true: * Auto-compaction is enabled, by means of the xref:rest-api:rest-bucket-create.adoc#autocompactiondefined[autoCompactionDefined] parameter. * An explicit setting is made to the xref:rest-api:rest-bucket-create.adoc#paralleldbandviewcompaction[parallelDBAndViewCompaction] parameter. +==== -Note that in Couchbase Server Enterprise Edition, auto-compaction does not apply to memory-optimized index storage, and there are no settings necessary for configuring the auto-compaction of Global Secondary Indexes using standard index storage. -For information on storage, see xref:learn:buckets-memory-and-storage/storage-engines.adoc[Storage Engines]. +[NOTE] +==== +In Couchbase Server Enterprise Edition, auto-compaction does not apply to memory-optimized index storage. +There are no settings necessary for configuring the auto-compaction of Global Secondary Indexes using standard index storage. +For information about storage, see xref:learn:buckets-memory-and-storage/storage-engines.adoc[Storage Engines]. -For full details and examples, see xref:rest-api:rest-bucket-create.adoc#auto-compaction-parameters[Auto-Compaction Parameters], below. +For full details and examples, see <>. +==== [#general-parameters] == General Parameters -The parameters listed in the following subsections are all included in the _General_ group, and therefore apply equally to Couchbase Server Enterprise and Community Editions. +The parameters listed in the following subsections are all included in the General group, and therefore apply equally to Couchbase Server Enterprise and Community Editions. [#name] === name -A name for a bucket that is to be created. -The name must be unique among the bucket-names defined for the cluster, and cannot be longer than 100 characters. -Acceptable characters are `A-Z`, `a-z`, and `0-9`. -Additionally, the _underscore_, _period_, _dash_, and _percent_ characters can be used. +Provide a name for the bucket you want to create. +The name must be unique among the bucket names defined for the cluster and cannot exceed 100 characters. +Acceptable characters include `A-Z`, `a-z`, `0-9`, `_`, `.`, `-`, and `%`. -The name parameter _must_ be specified, if a bucket is being created. -If it is not, or if the intended name is improperly designed, an error-notification is returned. -For example: : `{"name":"Bucket name needs to be specified"}`. -Note that a bucket-name _cannot_ be changed after bucket-creation. -Therefore, if this parameter is specified in an attempt to edit the bucket-configuration, it is ignored. -To edit the configuration of an existing bucket, the bucket-name must be specified as the `` path-parameter; as indicated above, in xref:rest-api:rest-bucket-create.adoc#http-methods-and-uris[HTTP Methods and URIs]. +You must specify the name parameter when creating a bucket. +If you do not provide it or if the name is invalid, the system returns an error notification. +For example: + +[source,json] +---- +{"name":"Bucket name needs to be specified"} +---- + +You cannot change the bucket name after creating the bucket. +If you try to specify this parameter while editing the bucket configuration,Couchbase Server ignores it. +To edit an existing bucket's configuration, specify the bucket name as the `{bucketName}` path parameter. +Refer to xref:rest-api:rest-bucket-create.adoc#http-methods-and-uris[HTTP Methods and URIs] for more details. [#example-name-create] ==== Example: Defining a New Name, When Creating @@ -151,8 +203,9 @@ To edit the configuration of an existing bucket, the bucket-name must be specifi In the following example, a bucket named `testBucket` is created, with a RAM-size of `256` MiB. The bucket name is specified by means of the `name` parameter, with a value of `testBucket`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 @@ -163,10 +216,11 @@ If successful, the call returns a `202 Accepted` notification, with empty conten [#example-name-edit] ==== Example: Referencing the Existing Name, When Editing -To _edit_ the bucket, the same endpoint is used, but with the bucket name specified as a concluding path-parameter, as follows: +To edit the bucket, the same endpoint is used, but with the bucket name specified as a concluding path-parameter, as follows: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d ramQuota=512 ---- @@ -176,24 +230,25 @@ The value of the `ramQuota` parameter (described below), is hereby increased to [#buckettype] === bucketType -Specifies the _type_ of the bucket. +Specifies the type of the bucket. This can be `couchbase` (which is the default), `ephemeral`, or `memcached`. For a detailed explanation of bucket types, see xref:learn:buckets-memory-and-storage/buckets.adoc[Buckets]. If an invalid bucket type is specified, the error-notification `{"bucketType":"invalid bucket type"}` is returned. -This parameter _cannot_ be modified, following bucket-creation. +This parameter cannot be modified, following bucket-creation. If an attempt at modification is made, the parameter is ignored. [#example-buckettype-create] ==== Example: Defining a Bucket Type, When Creating -A bucket type can _only_ be specified when the bucket is created: the specified type _cannot_ be changed subsequently. +A bucket type can only be specified when the bucket is created: the specified type cannot be changed subsequently. -The following example creates a bucket, named `testBucket`, whose type is _ephemeral_: +The following example creates a bucket, named `testBucket`, whose type is ephemeral: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -211,7 +266,7 @@ The minimum amount is 100 MiB. The maximum amount is the total Data Service memory quota configured per node, minus the amount already assigned to other buckets. For information on per node memory configuration, see the page for xref:manage:manage-settings/general-settings.adoc[General] Settings. -A value for `ramQuota` _must_ be specified: the value _can_ be modified, following bucket-creation. +A value for `ramQuota` must be specified: the value can be modified, following bucket-creation. An incorrect memory-specification returns a notification such as `{"ramQuota":"RAM quota cannot be less than 100 MiB"}`. @@ -220,8 +275,9 @@ An incorrect memory-specification returns a notification such as `{"ramQuota":"R The following example creates a Couchbase bucket, named `testBucket` and assigns it `256` MiB of memory. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 @@ -237,8 +293,9 @@ No object is returned. The following example assigns a new memory quota, of `512` MiB, to the existing bucket `testBucket`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d ramQuota=512 ---- @@ -249,17 +306,21 @@ No object is returned. [#storagebackend] === storageBackend -The _storage backend_ to be assigned to and used by the bucket. +The storage backend to be assigned to and used by the bucket. This can be either `couchstore` (which is the default) or `magma`. For information, see xref:learn:buckets-memory-and-storage/storage-engines.adoc[Storage Engines]. -NOTE: You can edit this value after initially creating the bucket. Couchbase Server sets the new backend value globally. However, this change does not convert the bucket to the new backend storage engine. Instead, Couchbase Server adds overrides to every node containing the bucket to indicate that their vBuckets are still in the old format. You must take additional steps to complete the migration to the new storage backend. See xref:manage:manage-buckets/migrate-bucket.adoc[] for more information. +NOTE: You can edit this value after initially creating the bucket. Couchbase Server sets the new backend value globally. +However, this change does not convert the bucket to the new backend storage engine. +Instead, Couchbase Server adds overrides to every node containing the bucket to indicate that their vBuckets are still in the old format. You must take additional steps to complete the migration to the new storage backend. +See xref:manage:manage-buckets/migrate-bucket.adoc[] for more information. [#example-storage-backend] ==== Example: Specifying the Storage Backend A minimum of 1024 MiB is required if the `magma` option is used; a minimum of 100 MiB if the default `couchstore` is used. +[source,bash] ---- curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ @@ -274,14 +335,14 @@ No object is returned. [#evictionpolicy] === evictionPolicy -The _ejection policy_ to be assigned to and used by the bucket. -(Note that _eviction_ is, in the current release, referred to as _ejection_; and this revised naming will continue to be used in future releases.) +The ejection policy to be assigned to and used by the bucket. +(Note that eviction is, in the current release, referred to as ejection; and this revised naming will continue to be used in future releases.) Policy-assignment depends on bucket type. -For a _Couchbase_ bucket, the policy can be `valueOnly` (which is the default) or `fullEviction`. -For an _Ephemeral_ bucket, the policy can be `noEviction` (which is the default) or `nruEviction`. -No policy can be assigned to a _Memcached_ bucket. +For a Couchbase bucket, the policy can be `valueOnly` (which is the default) or `fullEviction`. +For an Ephemeral bucket, the policy can be `noEviction` (which is the default) or `nruEviction`. +No policy can be assigned to a Memcached bucket. -This value _can_ be modified, following bucket-creation. +This value can be modified, following bucket-creation. If such modification occurs, the bucket is restarted with the new setting: this may cause inaccessibility of data, during the bucket's warm-up period. Incorrect specification of an ejection policy returns an error-notification, such as `{"evictionPolicy":"Eviction policy must be either 'valueOnly' or 'fullEviction' for couchbase buckets"}`. @@ -294,8 +355,9 @@ For general information on memory management in the context of ejection, see xre The following example creates a new bucket, named `testBucket`, which is a Couchbase bucket by default; and assigns it the `fullEviction` policy. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket -d ramQuota=256 \ -d evictionPolicy=fullEviction @@ -309,8 +371,9 @@ No object is returned. The following example modifies the eviction policy of the existing bucket `testBucket`, specifying that it should be `valueOnly`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d evictionPolicy=valueOnly ---- @@ -321,23 +384,24 @@ No object is returned. [#durabilityminlevel] === durabilityMinLevel -A _durability level_ to be assigned to the bucket, as the minimum level at which all writes to the bucket must occur. +A durability level to be assigned to the bucket, as the minimum level at which all writes to the bucket must occur. Level-assignment depends on bucket type. -For a _Couchbase_ bucket, the level can be `none`, `majority`, `majorityAndPersistActive`, or `persistToMajority`. -For an _Ephemeral_ bucket, the level can be `none` or `majority`. -No level can be assigned to a _Memcached_ bucket. +For a Couchbase bucket, the level can be `none`, `majority`, `majorityAndPersistActive`, or `persistToMajority`. +For an Ephemeral bucket, the level can be `none` or `majority`. +No level can be assigned to a Memcached bucket. -This parameter _can_ be modified, following bucket-creation. +This parameter can be modified, following bucket-creation. -For information on durability and levels, see xref:learn:data/durability.adoc[Durability]. +For information about durability and levels, see xref:learn:data/durability.adoc[Durability]. [#example-durabilityminlevel-create] ==== Example: Specifying a Minimum Durability Level, when Creating The following example creates a new bucket, named `testBucket`, which is a Couchbase bucket by default; and assigns it the minimum durability level of `majorityAndPersistActive`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -352,8 +416,9 @@ No object is returned. The following example modifies the minimum durability level of the existing bucket `testBucket`, changing the level to `persistToMajority`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d durabilityMinLevel=persistToMajority ---- @@ -364,25 +429,26 @@ No object is returned. [#threadsnumber] === threadsNumber -The _priority_ for the bucket, as described in xref:manage:manage-buckets/create-bucket.adoc#bucket-priority[Create a Bucket]. -Priority can be established as either _Low_ or _High_. -To establish priority as _Low_ (which is the default), the value of `threadsNumber` must be `3`. -To establish priority as _High_, the value must be `8`. +The priority for the bucket, as described in xref:manage:manage-buckets/create-bucket.adoc#bucket-priority[Create a Bucket]. +Priority can be established as either Low or High. +To establish priority as Low (which is the default), the value of `threadsNumber` must be `3`. +To establish priority as High, the value must be `8`. If any other value is used, the value is ignored; and the bucket's priority remains low. If this parameter is incorrectly specified, an error-notification such as the following is returned: `{"threadsNumber":"The number of threads must be an integer between 2 and 8"}`. (Note that, as indicated above, all values other than `3` and `8` are ignored.) -This parameter _can_ be modified, following bucket-creation. +This parameter can be modified, following bucket-creation. If such modification occurs, the bucket is restarted with the new setting: this may cause inaccessibility of data, during the bucket's warm-up period. [#example-threadsnumber-create] ==== Example: Specifying a Bucket Priority, when Creating -The following example creates a new bucket, named `testBucket`, which is a Couchbase bucket by default; and assigns it a _High_ priority, by specifying `8` as the value to the `threadsNumber` parameter. +The following example creates a new bucket, named `testBucket`, which is a Couchbase bucket by default; and assigns it a High priority, by specifying `8` as the value to the `threadsNumber` parameter. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -395,10 +461,11 @@ No object is returned. [#example-threadsnumber-edit] ==== Example: Specifying a New Bucket Priority, when Editing -The following example modifies the priority of the existing bucket `testBucket`, changing the level to _Low_, by establishing `3` as the value of the `threadsNumber` parameter. +The following example modifies the priority of the existing bucket `testBucket`, changing the level to Low, by establishing `3` as the value of the `threadsNumber` parameter. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d threadsNumber=3 ---- @@ -409,7 +476,7 @@ No object is returned. [#rank] === rank -The _rank_ for the bucket: this determines the bucket's place in the order in which the _rebalance_ process handles the buckets on the cluster. +The rank for the bucket: this determines the bucket's place in the order in which the rebalance process handles the buckets on the cluster. The bucket can be either a Couchbase or an Ephemeral bucket. Rank can be established as an integer, from `0` (the default) to `1000`. The higher a bucket's assigned integer (in relation to the integers assigned other buckets), the sooner in the rebalance process the bucket is handled. @@ -422,18 +489,20 @@ This assignment of `rank` allows a cluster's most mission-critical data to be re The following establishes a new bucket named `testBucket`, and assigns it a `rank` of 100. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets -u Administrator:password -d name=testBucket -d ramQuota=125 -d rank=100 ---- If the call is successful, `202 Accepted` is returned. -Assigned the rank of `100`, `testBucket` will be handled by the rebalance process _before_ any bucket whose assignment is _less_ than `100`, and _after_ and bucket whose assignment is _greater_. +Assigned the rank of `100`, `testBucket` will be handled by the rebalance process before any bucket whose assignment is less than `100`, and after and bucket whose assignment is greater. [#example-rank-edit] ==== Example: Specifying a Bucket's Rank, when Editing The following edits the previously established value of `rank` for `testBucket`: +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets/testBucket / -u Administrator:password / @@ -445,14 +514,14 @@ Success returns `200 OK`, and changes the `rank` of `testBucket` to `200`. [#replicanumber] === replicaNumber -The number of _replicas_ for the bucket. +The number of replicas for the bucket. For information on replicas and replication, see xref:learn:clusters-and-availability/intra-cluster-replication.adoc[Intra-Cluster Replication] and xref:learn:buckets-memory-and-storage/vbuckets.adoc[vBuckets]. -The possible values are `0` (which _disables_ replication, and therefore ensures that no replicas will be maintained), `1` (which is the default), `2`, and `3`. +The possible values are `0` (which disables replication, and therefore ensures that no replicas will be maintained), `1` (which is the default), `2`, and `3`. If a number greater than `3` is specified, the following error-notification is returned: `{"replicaNumber":"Replica number larger than 3 is not supported."}`. If more replicas are requested than can be assigned to the cluster, due to an insufficient number of nodes, no notification is returned. Instead, the maximum possible number of replicas is created: additional replicas will be added subsequently, if more nodes become available. -This parameter _can_ be modified, following bucket-creation. +This parameter can be modified, following bucket-creation. Such modification may require a rebalance: for information, see xref:learn:clusters-and-availability/rebalance.adoc[Rebalance]. [#example-replicanumber-create] @@ -460,7 +529,7 @@ Such modification may require a rebalance: for information, see xref:learn:clust The following example creates a new bucket, named `testBucket`, and specifies that it should have `3` replicas. ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -475,8 +544,9 @@ No object is returned. The following example changes the replica-number of the existing bucket `testBucket`, specifying that the number be `2`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d replicaNumber=2 ---- @@ -487,11 +557,11 @@ No object is returned. [#compressionmode] === compressionMode -The _compression mode_ for the bucket. +The compression mode for the bucket. The possible values are `off`, `passive` (which is the default), and `active`. If the value is incorrectly specified, the following error-notification is returned: `{"compressionMode":"compressionMode can be set to 'off', 'passive' or 'active'"}`. -This parameter _can_ be modified following bucket-creation. +This parameter can be modified following bucket-creation. For information on compression and compression modes, see xref:learn:buckets-memory-and-storage/compression.adoc[Compression]. @@ -500,8 +570,9 @@ For information on compression and compression modes, see xref:learn:buckets-mem The following example creates a new bucket, named `testBucket`, and assigns it the `active` compression mode: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -516,8 +587,9 @@ No object is returned. The following example changes the compression mode of the existing bucket `testBucket`, specifying that the mode now be `off`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d compressionMode=off ---- @@ -528,7 +600,7 @@ No object is returned. [#maxttl] === maxTTL -Sets the bucket's _maximum time to live_. The default value is `0`, which does not automatically expire documents. +Sets the bucket's maximum time to live. The default value is `0`, which does not automatically expire documents. It also does not affect expiration values you directly set on a document. Setting this parameter to a non-zero value has two effects: @@ -549,10 +621,11 @@ For more information, see xref:learn:data/expiration.adoc[Expiration]. [#example-maxttl-create] ==== Example: Specifying a Time-to-Live Value, when Creating -The following example creates a new bucket, named `testBucket`, and assigns it a _time-to-live_ of 500,000 seconds: +The following example creates a new bucket, named `testBucket`, and assigns it a time-to-live of 500,000 seconds: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -565,10 +638,11 @@ No object is returned. [#example-maxttl-edit] ==== Example: Specifying a New Time-to-Live value, when Editing -The following example modifies the _time-to-live_ setting of the existing bucket `testBucket`, reducing it to `0`, and thereby _disabling_ expiration. +The following example modifies the time-to-live setting of the existing bucket `testBucket`, reducing it to `0`, and thereby disabling expiration. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d maxTTL=0 ---- @@ -579,25 +653,26 @@ No object is returned. [#replicaindex] === replicaIndex -Specifies whether _View Indexes_ are to be replicated. -The value can be either `0` (which is the default), specifying that they are _not_ to be replicated; or `1`, specifying that they _are_ to be replicated. +Specifies whether View Indexes are to be replicated. +The value can be either `0` (which is the default), specifying that they are not to be replicated; or `1`, specifying that they are to be replicated. Specifying any other value returns an error-notification such as the following: `{"replicaIndex":"replicaIndex can only be 1 or 0"}`. This option is valid for Couchbase buckets only. -Note that there may be, at most, _one_ replica view index. +Note that there may be, at most, one replica view index. -This parameter _cannot_ be modified, following bucket-creation. +This parameter cannot be modified, following bucket-creation. [#example-replicaindex-create] ==== Example: Specifying View Index Replication, when Creating -View index replication can _only_ be specified when a bucket is created. +View index replication can only be specified when a bucket is created. Attempts to change the value subsequently are ignored. The following example creates a new bucket, named `testBucket`, and specifies that View indexes are to be replicated: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -610,9 +685,9 @@ No object is returned. [#conflictresolutiontype] === conflictResolutionType -Specifies the _conflict resolution type_ for the bucket. -The value can be `seqno` (which is the default), specifying sequence-number based resolution; or `lww` (_last write wins_), specifying timestamp-based resolution -This parameter _cannot_ be modified, following bucket-creation. +Specifies the conflict resolution type for the bucket. +The value can be `seqno` (which is the default), specifying sequence-number based resolution; or `lww` (last write wins), specifying timestamp-based resolution +This parameter cannot be modified, following bucket-creation. If modification is attempted, the following error-notification is returned: `{"conflictResolutionType":"Conflict resolution type not allowed in update bucket"}`. For information on conflict resolution, see: xref:learn:clusters-and-availability/xdcr-conflict-resolution.adoc[XDCR Conflict Resolution]. @@ -620,12 +695,13 @@ For information on conflict resolution, see: xref:learn:clusters-and-availabilit [#example-conflictresolutiontype-create] ==== Example: Specifying a Conflict Resolution Policy, when Creating -A bucket's conflict resolution policy can _only_ be specified when the bucket is created: attempts to change the setting subsequently are ignored. +A bucket's conflict resolution policy can only be specified when the bucket is created: attempts to change the setting subsequently are ignored. The following example creates a new bucket, named `testBucket`, specifying the `lww` conflict resolution policy. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -637,20 +713,21 @@ No object is returned. [#flushenabled] === flushEnabled -Whether _flushing_ is enabled for the bucket. +Whether flushing is enabled for the bucket. The value can be either `1`, which enables flushing; or `0`, which is the default, and disables flushing. -Flushing deletes _every_ document in the bucket, and therefore should _not_ be enabled unless absolutely necessary. +Flushing deletes every document in the bucket, and therefore should not be enabled unless absolutely necessary. -This parameter _can_ be modified, following bucket-creation. +This parameter can be modified, following bucket-creation. [#example-create] ==== Example: Enable Flushing, when Creating The following example creates a new bucket, named `testBucket`, and enables flushing: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -663,10 +740,11 @@ No object is returned. [#example-edit] ==== Example: Modify Flushing Enablement-Status, when Editing -The following example modifies the flushing enablement-status of the existing bucket, `testBucket`, switching it to _disabled_, by specifying the value `0` for the parameter `flushEnabled`: +The following example modifies the flushing enablement-status of the existing bucket, `testBucket`, switching it to disabled, by specifying the value `0` for the parameter `flushEnabled`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d flushEnabled=0 ---- @@ -677,7 +755,7 @@ No object is returned. [#magmaseqtreedatablocksize] === magmaSeqTreeDataBlockSize -The block size, in bytes, for Magma _seqIndex_ blocks. +The block size, in bytes, for Magma seqIndex blocks. The minimum block size that can be specified is 4096; and the maximum is 131072. The default size is 4096. The larger the specified block size, the better may be the block compression; potentially at the cost of greater consumption of memory, CPU, and I/O bandwidth. @@ -690,8 +768,9 @@ This setting cannot be established or retrieved until the entire cluster is runn The following example creates the bucket `testBucket`, establishing the value of `magmaSeqTreeDataBlockSize` as `7000`. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=1100 \ @@ -717,8 +796,9 @@ For an overview of change history, see xref:learn:data/change-history.adoc[Chang [#example-retention-collection-create] ==== Example: Disable historyRetentionCollectionDefault, when Creating -The following example creates a bucket, specifies its storage as _magma_, and specifies that a record of changes made to collections within the bucket should _not_ be made. +The following example creates a bucket, specifies its storage as magma, and specifies that a record of changes made to collections within the bucket should not be made. +[source,bash] ---- curl -X POST http://localhost:8091/pools/default/buckets \ -u Administrator:password \ @@ -735,6 +815,7 @@ Success returns `202 Accepted`. The following example modifies the value of `historyRetentionCollectionDefault` for the existing bucket `testBucket`. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets/testBucket \ -u Administrator:password \ @@ -749,8 +830,8 @@ Note, however, that this call only results in a change history being written to Specifies the maximum size, in bytes, of the change history that is written to disk for all collections in this bucket when the value of `historyRetentionCollectionDefault` is `true`. -The minimum size for the change history is _2 GiB_ (which would be specified as `2147483648`). -The maximum is _1.8 PiB_ (which would be specified as `18446744073709551615`). +The minimum size for the change history is 2 GiB (which would be specified as `2147483648`). +The maximum is 1.8 PiB (which would be specified as `18446744073709551615`). If a positive integer outside this range is specified, an error is flagged, no file-size is established, and change history remains disabled for the bucket. Each replica configured for the bucket maintains a copy of the change history. @@ -764,9 +845,10 @@ For an overview of change history, see xref:learn:data/change-history.adoc[Chang [#example-retention-bytes-create] ==== Example: Set historyRetentionBytes, when Creating -The following example creates a bucket, specifies its storage as _magma_, accepts the default value of `true` for `historyRetentionCollectionDefault`, and specifies the maximum disk-size of the change-record as _2 GiB_. +The following example creates a bucket, specifies its storage as magma, accepts the default value of `true` for `historyRetentionCollectionDefault`, and specifies the maximum disk-size of the change-record as 2 GiB. Thus, when this size-limit is reached, the oldest key-value pairs in the current record will be successively removed, by means of compaction. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets \ -u Administrator:password \ @@ -781,8 +863,9 @@ Success returns `202 Accepted`. [#example-retention-bytes-edit] ==== Example: Modify historyRetentionBytes, when Editing -The following example modifies the value of `historyRetentionBytes` to _4 GiB_, for the existing bucket `testBucket`. +The following example modifies the value of `historyRetentionBytes` to 4 GiB, for the existing bucket `testBucket`. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets/testBucket \ -u Administrator:password \ @@ -803,9 +886,10 @@ For an overview of change history, see xref:learn:data/change-history.adoc[Chang [#example-retention-seconds-create] ==== Example: Set historyRetentionSeconds, when Creating -The following example creates a bucket, specifies its storage as _magma_, accepts the default value of `true` for `historyRetentionCollectionDefault`, and specifies the maximum number of seconds for the change-record as 13,600. +The following example creates a bucket, specifies its storage as magma, accepts the default value of `true` for `historyRetentionCollectionDefault`, and specifies the maximum number of seconds for the change-record as 13,600. Thus, key-value pairs that have been recorded prior to 13,600 seconds before the current time will be removed, by means of compaction. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets \ -u Administrator:password \ @@ -822,6 +906,7 @@ Success returns `202 Accepted`. The following example modifies the number of seconds to be covered by the change history for the existing bucket `testBucket` to 11,000. +[source,bash] ---- curl -v -X POST http://localhost:8091/pools/default/buckets/testBucket \ -u Administrator:password \ @@ -830,30 +915,95 @@ curl -v -X POST http://localhost:8091/pools/default/buckets/testBucket \ Success returns `200 OK`. + +[[encryptionAtRestKeyId]] +=== encryptionAtRestKeyId + +Sets the encryption-at-rest key ID for the bucket. +The default value, `-1`, indicates that the bucket is not encrypted. +When you set this value to the `id` for an encrytion-at-rest-key, Couchbase Server encrypts the the bucket's data at rest. +The key ID must be for an existing key and the key must be configured to encrypt either all buckets or for this bucket specifically. + +For more information about encryption at rest, see xref:learn:security/native-encryption-at-rest-overview.adoc[]. + + +==== Example: Create Bucket With Native Encryption-at-Rest Enabled + +The following example creates a new bucket, named `testBucket`, and enables encryption-at-rest for the bucket by setting `encryptionAtRestKeyId` to `0`. + +include::example$encryption-at-rest/bucket-encryption-examples.adoc[tag=create-bucket] + +==== Example: Change Encryption-at-Rest Key Used to Encrypt Bucket + +The following example changes the existing `testBucket` to use the encryption-at-rest key whose `id` is `18`. +If this bucket was already encrypted using a different key, Couchbase Server re-encrypts the data with the new key. +If the bucket was not encrypted, Couchbase Server encrypts the data. + +include::example$encryption-at-rest/bucket-encryption-examples.adoc[tag=alter-bucket] + +[[encryptionAtRestDekRotationInterval]] +=== encryptionAtRestDekRotationInterval + +Sets how often in seconds Couchbase Server rotates the bucket's data encryption keys (DEKs). +After this period elapses, Couchbase Server marks the DEK inactive and creates a new active DEK. +It keeps the inactive DEK to decrypt data that's still encrypted with it until its lifetime elapses (see <>). + +The default value is `2592000`, which means Couchbase Server rotates the DEKs every 30 days. +Set this value to 0 to turn off DEK rotation. + +For more information about key rotation, see xref:learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration]. + +The following example sets the DEK rotation interval to 15 days (1,296,000 seconds): + +include::example$encryption-at-rest/bucket-encryption-examples.adoc[tag=set-dek-rotation] + + +[[encryptionAtRestDekLifetime]] +=== encryptionAtRestDekLifetime + +Sets the lifetime of the bucket's data encryption keys (DEKs) in seconds. +Once this period passes after a DEK expires, Couchbase Server re-encrypts any data that's still encrypted the data using the active DEK. +It then deletes the expired DEK. + +This value defaults to `31536000`, which means Couchbase Server keeps expired DEKs for 365 days. +Setting this value to 0 means Couchbase Server never deletes expired DEKs. + + +If you set `encryptionAtRestDekRotationInterval` to a non-zero value and `encryptionAtRestDekLifetime` to 0, Couchbase Server keeps old DEKs forever. +Depending on how often you rotate the DEKs, this can lead to a large number of DEKs being kept. + +IMPORTANT: Setting this value too low can cause performance issues because Couchbase Server may need to re-encrypt large amounts of data. + +For more information about key lifetime, see xref:learn:security/native-encryption-at-rest-overview.adoc##rotation-expiration[Encryption Key Rotation and Expiration]. + +The following example sets the DEK lifetime to 90 days (7,776,000 seconds): +include::example$encryption-at-rest/bucket-encryption-examples.adoc[tag=set-dek-lifetime] + + [#auto-compaction-parameters] == Auto-Compaction Parameters -The parameters listed in the following subsections are all included in the _Auto-compaction_ group +The parameters listed in the following subsections are all included in the Auto-compaction group [#autocompactiondefined] === autoCompactionDefined -Specifies whether the default _auto-compaction_ settings are to be modified for this bucket. +Specifies whether the default auto-compaction settings are to be modified for this bucket. The value specified can be either `true` or `false` (which is the default). If the value is `false`, any parameter-values specified in order to modify the default auto-compaction settings are ignored. If the value is incorrectly specified, an error-notification such as the following is returned: `{"autoCompactionDefined":"autoCompactionDefined is invalid"}`. -Note that if `autoCompactionDefined` is specified as `true`: +If you set `autoCompactionDefined` to `true`: * All other auto-compaction-related parameters that need to be established should themselves be explicitly specified in the current call. -* The parameter `parallelDBAndViewCompaction` _must_ be defined. +* The parameter `parallelDBAndViewCompaction` must be defined. If it is not defined, an error-notification such as the following is returned: `{"parallelDBAndViewCompaction":"parallelDBAndViewCompaction is missing"}`. -Auto-compaction settings are unnecessary for _memory-optimized_ indexes. -For information on index storage, see xref:indexes:storage-modes.adoc[]. +Auto-compaction settings are unnecessary for memory-optimized indexes. +For information about index storage, see xref:indexes:storage-modes.adoc[]. -For further information on auto-compaction settings, see xref:manage:manage-settings/configure-compact-settings.adoc[Auto-Compaction]. +For further information about auto-compaction settings, see xref:manage:manage-settings/configure-compact-settings.adoc[Auto-Compaction]. [#example-autocompactiondefined-create] ==== Example: Enabling Auto-Compaction, when Creating @@ -861,8 +1011,9 @@ For further information on auto-compaction settings, see xref:manage:manage-sett The following example creates a new bucket, named `testBucket`, and enables auto-compaction for the bucket. Necessarily, a setting is also explicitly made for `parallelDBAndViewCompaction`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -876,10 +1027,11 @@ No object is returned. [#example-autocompactiondefined-edit] ==== Example: Modifying Auto-Compaction Enablement, when Editing -The following example changes the auto-compaction enablement of the existing bucket `testBucket`, _disabling_ auto-compaction, by specifying the value `false` to the `autoCompactionDefined` parameter: +The following example changes the auto-compaction enablement of the existing bucket `testBucket`, disabling auto-compaction, by specifying the value `false` to the `autoCompactionDefined` parameter: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d autoCompactionDefined=false ---- @@ -887,10 +1039,11 @@ curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ This disables auto-compaction for the bucket, and removes all auto-compaction-related settings. If the call is successful, a `200 OK` notification is returned, with no object. -To _enable_ auto-compaction after bucket creation, the `parallelDBAndViewCompaction` parameter must also be specified; as in the following example, which sets `parallelDBAndViewCompaction` to `false`: +To enable auto-compaction after bucket creation, the `parallelDBAndViewCompaction` parameter must also be specified; as in the following example, which sets `parallelDBAndViewCompaction` to `false`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d autoCompactionDefined=true \ -d parallelDBAndViewCompaction=false @@ -903,8 +1056,8 @@ No object is returned. === parallelDBAndViewCompaction Specifies whether compaction should occur to documents and view indexes in parallel. -This is a _global_ setting, which therefore affects _all_ buckets on the cluster. -The value can either be `true` or `false`: one value or the other _must_ be specified. +This is a global setting, which therefore affects all buckets on the cluster. +The value can either be `true` or `false`: one value or the other must be specified. If the value is incorrectly specified, the following error-notification is returned: `{"parallelDBAndViewCompaction":"parallelDBAndViewCompaction is invalid"}`. This parameter-value is ignored if `autoCompactionDefined` is `false` (which is its default value). @@ -929,8 +1082,9 @@ This parameter is ignored if `autoCompactionDefined` is `false` (which is its de The following example establishes a value for `databaseFragmentationThreshold[percentage]`, and for all other auto-compaction-related parameters, in its creation of a new bucket, named `testBucket`: +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets \ -u Administrator:password \ -d name=testBucket \ -d ramQuota=256 \ @@ -957,10 +1111,11 @@ No object is returned. ==== Example: Specifying a Data Fragmentation Threshold as a Percentage, when Editing The following example modifies the `databaseFragmentationThreshold[percentage]` setting for the existing bucket `testBucket`; establishing a new value of `47`. -Note that although other auto-compaction settings are intended to be unchanged from their previous, explicit settings, all _must be respecified_ correspondingly in the new call: otherwise, all revert to their default values. +Note that although other auto-compaction settings are intended to be unchanged from their previous, explicit settings, all must be respecified correspondingly in the new call: otherwise, all revert to their default values. +[source,bash] ---- -curl -v -X POST http://10.143.201.101:8091/pools/default/buckets/testBucket \ +curl -v -X POST http://127.0.0.1:8091/pools/default/buckets/testBucket \ -u Administrator:password \ -d autoCompactionDefined=true \ -d parallelDBAndViewCompaction=false \ @@ -1025,7 +1180,7 @@ See the examples provided above, in xref:rest-api:rest-bucket-create.adoc#exampl === purgeInterval Specifies the tombstone (or metadata) purge interval. -The value can be either an integer (indicating a number of days), or a float (indicating an interval that may be greater or less than one day, and entails a number of hours, with `0.04` indicating _one hour_). +The value can be either an integer (indicating a number of days), or a float (indicating an interval that may be greater or less than one day, and entails a number of hours, with `0.04` indicating one hour). The default value is three days. If this parameter is incorrectly specified, an error-notification such as the following is returned: `{"purgeInterval":"metadata purge interval must be a number"}`. @@ -1118,7 +1273,7 @@ Information on memory-management options for Couchbase Server is provided in For Information on auto-compaction settings is provided in xref:manage:manage-settings/configure-compact-settings.adoc[Auto-Compaction]. For an overview of change history, see xref:learn:data/change-history.adoc[Change History]. -Information on other, Couchbase-Server key concepts can be found as follows: for durability, in xref:learn:data/durability.adoc[Durability]; for expiration (_time-to-live_), in xref:learn:data/expiration.adoc[Expiration]; for ejection, in xref:learn:buckets-memory-and-storage/memory.adoc[Memory]; for replication, in xref:learn:clusters-and-availability/intra-cluster-replication.adoc[Intra-Cluster Replication]; for compression, in xref:learn:/buckets-memory-and-storage/compression.adoc[Compression]; for conflict resolution, in xref:learn:/clusters-and-availability/xdcr-conflict-resolution.adoc[XDCR Conflict Resolution]; for purging, in xref:manage:manage-settings/configure-compact-settings.adoc#tombstone-purge-interval[Tombstone Purge Interval]. +Information on other, Couchbase-Server key concepts can be found as follows: for durability, in xref:learn:data/durability.adoc[Durability]; for expiration (time-to-live), in xref:learn:data/expiration.adoc[Expiration]; for ejection, in xref:learn:buckets-memory-and-storage/memory.adoc[Memory]; for replication, in xref:learn:clusters-and-availability/intra-cluster-replication.adoc[Intra-Cluster Replication]; for compression, in xref:learn:/buckets-memory-and-storage/compression.adoc[Compression]; for conflict resolution, in xref:learn:/clusters-and-availability/xdcr-conflict-resolution.adoc[XDCR Conflict Resolution]; for purging, in xref:manage:manage-settings/configure-compact-settings.adoc#tombstone-purge-interval[Tombstone Purge Interval]. See xref:learn:security/roles.adoc[Roles], for information on roles and privileges. diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index 8b7a8418f9..b5cf94cd7e 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -558,57 +558,11 @@ The following example creates an auto-generated key (one managed by Couchbase Se The only data it can encrypt is the travel sample bucket. It can also encrypt the configuration and logs. -[source,bash] ----- -curl -v -u Administrator:password \ - -X POST \ - http://127.0.0.1:8091/settings/encryptionKeys \ - --data-binary @- < Date: Wed, 14 May 2025 16:18:00 -0400 Subject: [PATCH 12/17] Work in progress checkin. * Finished rough draft of manage topic. * Updated bucket refernce pages for new settings and new fields in output. * Updated screenshots that should show encrytion at rest field. --- .../addBucketWithMagmaOption.png | Bin 251393 -> 77267 bytes .../encryption-at-rest-details.png | Bin 0 -> 73639 bytes .../pages/manage-buckets/create-bucket.adoc | 14 +- .../manage-native-encryption-at-rest.adoc | 161 ++++++++- .../manage-key-examples.adoc | 7 + .../system-encryption-examples.adoc | 9 + .../rest-api/pages/rest-bucket-create.adoc | 1 - .../rest-api/pages/rest-buckets-summary.adoc | 26 +- .../manage-encryption-keys.adoc | 8 +- .../manage-system-encryption-at-rest.adoc | 13 +- .../partials/get_bucket_travel_sample.json | 305 +++--------------- preview/HEAD.yml | 8 + 12 files changed, 244 insertions(+), 308 deletions(-) create mode 100644 modules/manage/assets/images/manage-security/encryption-at-rest-details.png create mode 100644 modules/rest-api/examples/encryption-at-rest/manage-key-examples.adoc create mode 100644 modules/rest-api/examples/encryption-at-rest/system-encryption-examples.adoc create mode 100644 preview/HEAD.yml diff --git a/modules/manage/assets/images/manage-buckets/addBucketWithMagmaOption.png b/modules/manage/assets/images/manage-buckets/addBucketWithMagmaOption.png index ea02f571159a04eb5d99039992016f5b01a84fb3..4da723e6b80cda4b67561d1748815db2a07fa654 100644 GIT binary patch literal 77267 zcmdqIWmH#N8$C)%H%NDPw{&-RcQ;6fbP7laNJ&XccXtYcGzcOk2+|;Z7f0XozT@66 z_rw3w|BS)#ch=r($J%Q>&wS>bD@IjW1_hA-5ds1NMNU>y9RdP!2?7F|9v&97$jZxc zKtLc?+et{M%1KC&sk*yZ+c{c+12JjoaGEKjIK#WQU7nawROdK;SVdT(@;~ww;M5T0 z;Pb=L;Tg|)06~6s;+4m}Y^ltJ~ z&g1F}8=75Mh*%sMrpZ^&Ax5yba)}@9{N3d5%?SsN+ z7_}h5-cb4nzTVN4cyg5?NhzPg35ZvsJFZkv5F_=fB9w`YqAy3VxOL-v#4*O6(Y4!H zTc4;3$JWskP)hrX=Vji}68D;LrC7ZqN)R2=XjCNVmC2x-{Kj-GlDHXcU>)h{hlb^u zq(KddfyG^DbIB*fC_7ZJ^|{6l=agoXmS2kiUFg#)(NVbF5TD&ch*4(E?Zm*brhDjA7nf9zD&HC*dkL(e0!~N?U)%9WUqO^wToaOZq-^W z1N&*fXZ#M+F1!+_Yh>NQ+C*fD-*V@!%!}NhiHDb)LDUO1JM-?EVm{tlIh%=>WPRA1 zhDINUb@C$lka`k6eejI)&gvn%Lw0G|@Z5c}5+yyyjDVIc;2k8AWT>qtn<(EgRMU?a zo@3jrlR0z)FBCc?DX@!nICOtFY;rDAe4Jy7tZJ-+hQM<1-nZ{~oe_|dGlS44 zL+N}&2oNKKhgKsaVS+GBLgWa6VS;*Q`kW4m+7x;b*(~8=HE}gki}D97j*OScmo#2@wBGk4MXZ z{yLgvfQ=%tC0ti}RqlYwm>d;rST2?dE18f!HdR_*s+@v5Wishk%G%iI=-xR0_@^|i zv8vRH_%0{+eoK8`gMhw-9*v%K z+wN5R)X_Kh4)I$5n&;Z#w7OKX93xH2Nc2;QwmON^41hcwY1fnbQ08zD-A0G6n#aXsj+LDRalm$mJw;T7N6>A8Kf1D=@^wP zSNbVkguVOlu7tp(O1Dbt@WZmr%gDBBzqT9c3$F_}0z4Ft*R2F`TupY_(>`T#3!ZaZ z_BakCvmF)B95NlGY?qGDm>5(VRR!wb7AM3elqkPbj+k`I!7zIFvHhcJ zv-nl`FONu$u)z^iP4+hYLO*>!NI&(?L%&YH%^RAV>6?lRgL6{6B;*WOdf4Z%MzDpE zZIR@W&mxr~yTfAN%XeJclRO2+u+REa}T;(m!@XN5y;>lQJ z>(6BWH1nzHoe_7`C*lc>PY$1|b$f6UaKz)Pa02UV>a%TPthp!lo2d-yn9i88nBb~3 zD?_Wa4H^wP-#PKUFuNRD5~}akd!cKid(_ZnQ)r20Tfh9_%g*bnR_2AK`O8S+!O1D- z2&1U44*p2~UH3eE@H@R^u_3^O*qSfBTB?(H=CR{kT+q)s~OTe(m(lj>K8PL9|=(+ zY@$pqY_8yxQLc)fbtTul@H``{18a;<#R8lQ?vd3RZ6G>naGrUdu?h9M?K;7FRM1Tj zR5wkxS}@#W@dGV%4Wt+(A@t4CvLj3T8zF)p*ey&oFQSRC@ino|=@tcbF<0@SqF^E& z5nD;^u^AAZ(4fr@YLv{-`jqe~cozy(geB1)=yY(=0TsvMh25bD0Y!B@K)qy--*6s_JvyKhPsDXk3 zgEOTa*4*HrkfG4{XTvz^xb8S4@_jUeG>1wzeF&Reu0zR7qc2Ab4PAcW{6fm5tq$ew z^WIE9%lpt$oLVA?)q=o-AgwN>&ZuF6*crjyw_pcpcVS05(?8=~5Z_iBUR?dn0M2)c6VWDx%bf!?xg<*+)KpH963X-h9=Y_Q4>P1iVZOh78+}P} z2blyKblqxgPl~B`6y}+I-yNktj;l|o|C;#-)fuYwENonNyoojHEiLPjzFAFy>)^5c zW17GA8|~uiwvJ`Lm)HB=4(1D;2?|(Sq*p#r~_zqhS&3V9m#tU92;WsoljXm0{e#-r%wu`^&~NgU`*k z>zv)exE@s5quLN+aM{UFJy~BNRKG*M&ky9cThnwAvim&y7$OJt7*ld{Bc7jE5p9`vznY7N5!k&6ro#77Ya#(4Q&Xn{od}{vY-bQ-^V~$ ztn$lmM`t3Cs~m{1ybQOR0KsZo>B?CvDM2uR-|!HSQFah8;1?wLBLIH@=q5)(z=3}; z!Jp)NsQ(;=TzU`vpWo2*PbZ3LNXW^7e>E)Jt*o3qY+XFx@I{G%OU>J9>U!!bDGFG) zII);nx|mzB_&B*fb%7A{5dc4(tUS%ge4HGeJp_D&DE>J^0Q`PxW~Cte=M+x|Aqrh3 zRWb<|cPla;7B&_(3SmStGBQDTOKSmjN$J1c!T$+S*m`=p3b3+zdwa8ZbF#R&+px0p z^YgQ^ajpA z6Ljhgab9{T_4)bmcJlf`cJ_8rmj&v2`CRA(m$LE_Tt|<-CXef_!B(|1{iOwW;WNgNF|l`HI{W9uF!~bRJ_-;3u_y$bTAMk-vw>OKF7b zMQ4LShLq?*AEAYbAKk&K(XRZ{19ViJ&wV=b&k1CC=xj7uDn0tO|6YMz&mZ=muHb}_ z0P&s-M`1{ZL4yC>bI9@#|L?WgU``Q2#6Ma3stgUpU~Nx{JWgm`Rd<}q zlKhm#n=Y3^Gw8H@ywP9mvfkykS%>j^T80!fD%GiJhNPYJqlt`QsR*i>UKkAi^9%zN zs->9+{zsj(GNgeG@r1lAO<&!Pg6~db^tyurS6d3uTkPi;mRj5_RzE!4olVs_e{E}V zTY_J0uuD-5ZsU5nKO28qQhpVIYrM!L=eXG6duI9LbADEFJ;Xn6jfnX4%%lOwV*Hnj z7TftzBn)%`m1~9+Y(B@P*T342+%pASMn78``fNn-a||LmOcz8j={L~H2(+_5jp=(b zj71*8G|mlbjXme~!=}1^)E8T23`I@pCP8{#cc%*c=bt6ES6sT&-f=tZ&_VCSrM7?K zSsB?Y$zz#?t}<%Z_PacwzxwK(chL6pqgn2PvA>e=-LXXL_FDtX!Pw{SkM~#Om3sA- z!^GaHsKf%YCCWKPo_jOzg1+^HxDVmmjQp(bW;yCOOPDQHlTa4EwzOOLXr#N={rJFm zwdP+vL@7q<`B}_Q#lNL{Ba+ba@?c55)!nM~?sU9ZEDYAnm`X--MdO3w^zXG!|ENPW ztU<$61}*vAz)QXRSG-PLKMLadG)q&a1kV)hz#Z@|d!W%qE>~Pwck_a~BB|{?GB&z# zMefg2&VMebuyp-4w_9zgO*)!?`_HOod9L_d6hfYnQnfdier4L^zBz1KQO-lFmKNSCO4&-)P(~QWKO8=r5~-dd2&C8e5WiE*l3T{R<|AS3 zyZt;KfMCJ8a5l1(pTYJaW*YrgSf-T(>tqxoPg!j}PQ zHu@&}Ir+;qf0rC=(xBgFttUf-{g%yNy|OsQAMS6*yKa9~VEqIGz_Od|kuZODv0#Ff z!Zb1eh1h$QT!zHAXsv)C;teJFJ$NP#(;f(vs|olIC$kzV2wv(LDCM#=KT7g~^p*KG z!r2bNuvEvF2HoErvu)obWJN=-jk zRo!({&Sc!7yV7AfifQ%z++rk&T%QIx-)j7=-(k1uY0!o!-hJGHbzbiJdeE)Xa~#Up)hKk9$&eZP~1A&lfEc5%R#4Kxp!s9XEYO z-CrS}#t{1=j@TvTqjBerwORX7SG!`Kuu;zl782L~s!R8Mk;B4Afl1S6G?X$4vzF&@ zJAMmB-lIAufyME8Hb^LAq0f-QAHIT*?mn+)v-kV{WSF$e=a&0v-H>rZW%s4f^V>1G zDpI?~)BGA%^7Q@KC&w3(!p4Kj#ckKEw92Cu{A-Z<7SyiYh_E>gNq$n_^TF3J52u`mv)M}TuC$K*rcVH#%7 z>S0cW3KD94rcyH{eEWOFG~LJxfoK!?$bwZ_=wkMj@Iaxa&!e#OPx-En3v_pPhFgN3JX9kNQ6 z^jz*Tnlb@>xJa`tMvL%j?~9Bo=}ttFI}VE>UGV)ydU@CzuAu8}T&=GKk%q1A#qW0{ zW=_K!0v64pt_{*;lhkXb`FAKSh7;1}s|*z8%C)#(L(9;pFj}Rh;9!rl;!QC$29gg-mXiKXh5H-lrPT9s!+> zfY8{Q{vbPBsmGZ{^Tz(oj)qztPYUi!E=*F3=;gUDw0Qvq_OrHld}J}4(xsLf7`f}E z&1zGH1TyNY_7zoJ1`HkQX*oVy>xqkN7{Pt86rZH^I4jtNKbd+7#V?(H)KlVw}NPV|3w5sbxAzf%s9Ii)?W9b=Gnn#C{nhJTOpRbOUovC%cpw|&v zE(^D@-I>TN4;|9%Jv&?Vn2Ml@667AhBm_x5Mv}}y5$9a6P%3m_K2rzbEk}}W=7{ja z@6FFaa(u`T^e|;ucG$2HU(lPBR8}o;&u5Dja2q!_2121e>;i%KLpovD0C`Qmxtm4<~^eT^$SgwH%?{ zy9P?>_|GktCX;U&C+8~}%riLFy4V<5r`?rA=&11Ctt?!|qX5?~2_ok63lv}JJ;xvKc%K`C;NIPXEb{vsw9=GL zM-3YX8m>>xCf*?Dz;E(K|GvUSR(-*+E2m4lzbo1j-ZE!YU5}yBrVchA^OC1_(bLE8 zyVXQ^)G%$z1tc61*(AL@jbg_8+>U8MHk6D`57=ZRmKL&jam*oU_%l(&!?}udjy*Op z7M2=`uJaj%F+Q^7+Q^WNa6=H=+yG!HC){jnJ4^g*C%NHNA&H8LPHLT$fvMSZ_3@aSE6Le(E9^$gV|jX?{seh>+XQp2!jI5Pr%rgAv;p%(tw zV1zD|2ZOY_o4&lp7T`m=4R~x{8iT&!skS^ws0{R^-zV``;jf8f2zP#7Y2Nbv&1Kc_ zmUAcc)oBKPPk6BB?o}8rs!eI_($F9hGkm|Z^PkE60X~B&i$3&iw=CtWw#?3UKB3yG z=ql-xHC?Tu7k00CK}d&^0028g%;h;)=ue;?+Z*P)e+l-LvBBfNAe{NtEA}O3h&nB^ zrzP`>T$KZZjmCgu_^Y4OpN5)e0L8aI6K!Jn+ee-TYRFPyr^TQeY6TJCRsNUqLX9sX5jg*1$pN9ls zXB~Y+Hu<7zf4Q+@;vKibQ|@|-4Xd7Cluki(zy4AA2+*%FNW!$utL_T(<4sV1KNWI_ zBYDzu8iO)*>N1n=uI%84YmR{5u1o z?>wox`$2zmcQS_&*Ce2pDCqabGVJW6Z~}~>iT`0ELs~O{#UI=D88UfYjCGrg{(d$* zs6DczH*I{z5plSz^WOws?uSnk3wS2sb6U%$vlww504S$Mb2+2Hx_5uR_r+?p#jOrN z_%ZsDYzk2LsoyfjpY3G1ppKv5K4F#*{Kq}efk_Q6>&8z=B>o&AoTNmN2VJkPFLhp< z)LXxv$P+P97Cez`#9s%6A&19~qA&P}++9ZPUgAcjtzZ!RnF;q+NB;eW@F8T-`ZcCv z-x$!c&vB6nd6@V>=>TOzi-Ib2{`p%JY0&3na48|B&7$F&4*-nYWu%aCAG{Ako$()r zzj!$6enbW3z|nifOb*C}R4JjroAc@4i?=aYwDuh-#{B}xMuuKXR=qqcj#!n(o%-YJ zR_R8eG)nJa5~gX!t=;~vh)B^~^pRMqxY=mGi(%5>R8SF?&+3`Y9X6lnx^ z23)(N^b@uMDCpOD`>VY|D4lQ^LhJB$083>g_BkVrO}XXy^=_U67p9%y4ftVouvmM# zWRn+TQCa7@A+9A=ZP===`ts^vNrSl2_J#d6DC^=ZI!qaav-l#$PHGy!ZW9Q4s4}A36n@^QBn^FOiiA)6Ia~=h# zutDQ^;tT;*d|vxmPzuvVIArC(uz-1{KIFo)M1;Qd`fp$%fVY%NzPK<3AhfL!)(+i< z5|4Uq2>sR&4vnO8;iM~xEuBe^Vy;4G;RmSPN+k^%?X|7}j{k0j(4Qnq?pUY%vTEVs zXJMjnvP;*sbY@$%$lAj)SSLuNC4O%~vpxxcRIT@yD}n5n4u9gGDf||GNF~P-xQuaU zcq0D}-o8r9hXwL&;vKiF_f);W}gXEu&I^ z4r8|?q+gIvxV1_sWCg0ou4&o6qDL+*wI}iTf5XEdll7PnBH9GLE3Lh>Xt6K%=%!22s6*#@LSm{ zs4}5~5R5vdKk0QJPw(*zE_84{>#&Va;ih(&WZbLP%s2b|0xXNjt7mS#oPDiJ(h<-h z4JOjPq~Af_!=)LNWX1aiaq+~!_^c$pFwmY9x?25o=?`j)#F+*=jU`a?TLO{`NsWIy zRm1Z5Tkl374X()JU45lNGm9Mt6Aq8#ViK2w_vH)zq)RniKE_7%EZ3d zU^q9(>S!nnDrNPIQw+rDbj`gos-N%`i)0Z0^ zcDenvXIM?T42^v@p4m+oNNJDNi*rbjInmsLp!u`k@2K-?hp(BtiQgpPBtqD;<0NW| zI^7U6OY#Uz^uQ&HM4|6PdZxcHeD=#qV5H|j3AHy}DD#UGry#XhJ}nuLk(z+G(~H*E zVp9rfCHDJ~ul^Z{hD+#LOxB3C^IUx%XZCt}s3Uc>-oFolb_6U?dWlHnQHA-+Vxe!Z zpgmDX^h2~&rQwS{S*jf!fRsg#e^AxDRz8uY;k7?sm9;z6SEQDH@{QtarEaZwg3zVz z-fWo$-L&Isi`rAj%jB|4mKS^CM6-Q&GV6A8{Ua|Tg1pynlQaV`=+Qz$Sbd zDzOU4L1kaSrD-x0b#PAdQS#{Jx0a}YV2!!vu?i}J00&(49)N~6-%jDxtD1A?A>;&J zF7P1AfFyXu{~oeTzp>ojaV(9oWLhDeB@NtS zkMH<^#j9MKYFc+Rdmu09rcAzE)&+18U;Li92EpKl6A+Ex0&Y$1SIZ_U|LF*2v2mwg z7s8DKsc)9{Qk~T{AmA2+F9G|ZRV^ExJsnSjz%-2~mKr!EboE30pmjGFYZ(cvBryi3 zZT4)OwOjV~@~{z^OAlm}59aW{Og}d|=;WaF{OY_~!(uBCJWg=(JDFd@WV zi{y#|))RPv()M%Z#kwb}pvCMR8Vdf@a9K$%!43e3RhJHv+58B*9hQd*=Zc@-uf`K^ zj&{s-`d`(c2`1V~;xQgu3vai+`h1QNH6L!19YpeSR?RJMp+>ZQgc}Nf#j?x}z(@gd zDTi$|bgP<9zl&tb1U`y)R5}Z#rPA?u`Dn<&n2r^SG6}3%J3CkBlE%#7RJ^vrQI%iDF^9 zSd+gBqLBdouFj@zz6k(4ZX%1wnYtXsMqW!&!!ZahUp^?g#aXaJLdRgHuv#NL-bl~x zC?=5xp1)Bh0AQw?B|8$8xIAUsZJ4+OYqKW=+G8=qjAquT-df4Z@qF(?mNR07d8nnB z#0z!@Ha8>huP^gE7gh8Hn-wi-bA8NL**Ey5e)jYt0PxholH?OKIu#mm*?0GQ+qYV+ zP9c3W0Q5@%#Chr<}1ho=RUB4~MKrR)ZHKgM`DhsQ4@gF?dyx@7|^ z6m}TP=^`*BlkKPmK8AV-W6l}CST5nq>ythFU>pND+PEr?sm7F?*vRs?=VcZN zl$}CdSDWwI&R$-0@9tDcIDTR;kIUMsP0TG)ShT#TAdF%tI@+hjS_=s~i|WqHndcN} zK>(q7Ld6MivRyaYeUYX$=+?Jrd<5Y=>LuAW#b{rAAtvGld9ld;Y}(oG)Ph_%8%_R- zb360!e$sKDxZ;?i7kb6ly8=KfhyoB=yf`rLcC%OVa{!kxcfmh{O7U3~-w-hZy^(p} z+3s^*+s~r77J|G%ArW5B=+oJwmc(qOK`6nsm(R%d(azvHA@(^L#J#wF@w2j?OX#F@ z*X;O#AFdFPsJfXAG_hyTEJUGBr}!12cV30ZKSI5uaIE<)=$aFqH1g&y@V1Qb4Cx)7 zOSd(-XzLxTpc<(KteX<)y6-M=j$`0EpKdl zB?B1luDhj`5M;}lvX3FnP|X5LaS2^0Lig%NAZ&8uI?#0sobplOt>Z3xL`cJ@X>V{6 zlN(v*I5)<}#}_v~$GF6k`g5@`G41t#Z2wh`WRdHg>jW?DkSYYjVO^&PQHg05E+{D2 zA=^}mnEBg-u~+zH0E?ffR5i!9;I334Q4S^aq}P%h?>peC87nb?CR1_PJK9@qTI(Q{ z$+yp`?WpjU2?4(hXR9j%TQ^2V$G>t?&1?g`Z@@@B1|cB=fzg}oYQPeue+1{`pr`1m z>PnNW;ly~W^PN9-Cv0zkrCimH!_ALkjgz*|XNW<&vUCau3u6j$N=Ut~1eB}eAjaNT z2~)l%;6?<*vya#H6cJd<`~@v4RFK=Uc&%dgr^s(jm!qgc1s1T9MfAz>-jsx)3XGWS zvtHc=t52JkJVe$Wf|%%*a!R@(0z-2ChMzo_00g>3tGcq|5_LR0Os0Etx2fP9{wO!m zX9v_bJ}5P$d#f45cqe$n6O9@X>s)7w3r$C=?_H4F|7$0bpmA(}%s zgVMlO9fR>D3DM)p#G8OJK?c1vv#9Nw8@^@6?Ch?e(&Eb>(mvcF7%0`JN*nB zZ3FuODdmKero2>gfHRJn8{@iZNO)z{!e#<#kb_P0z}7in<+qf^Kmm2zx9CCg)KHfjRAox{X zTh=FQYe8|*qB36XQi4`!QtK2ym|(-rlQ)%D8Ymp-oEx*6kdwDwlX<%fnZ@X3)7{eh z5ZjI9!D5X*duvPcx-Lv~D4FR~sd{lNhkgcgg~mgGY)$E;D)DW|q;iVK+rEJ)0$c-f z1`OM~-zWT7tuM3_)x@78ND;FH2qr@Yn-ZCSFY6CzOTPPw&pZQzlyygOkXcIL_Bq7O z$2>XaYiut}9!h~B73CC_Z_u<)k1lzUq2{t$qpk5zDNJjQXCl?+ACP|)s(TubQwu4k zKa$72_c0y~;@HJcw2yZUh)GNOKBtl?TPAC)WjF zgnn9tv`A{k+BjY&W;s3GhN9U*#^@a3lSJKan%lr#h{^bNy2-~Wv&y&B#wJWm+)t6T zmXUkP_WFw-tir`zzFbyp2DYlxZxv^JPAt|6^`nzm37Ft)UGbL^e8KRuc6Yr=%9~X_ znddcg`Q=+vh;M9ws8l=n_J=>7QxJ!4&-RiSRR0&;pt8DzDrL!4}o%67xSaZJ4MFqCEuJ6Q($Lj|lVc?hphyX^#ReHPYkiqzfaIj>2 zA6Jf-W|pcOe=|rs#UD?>>(9u(P=nqRG|~rqK^cc0?TXV?YI)t`+4+t`zqwo4vRyG; zL>PyS^O5OWO@BQGH5F%(7LH8=%1d|8ypHs2){bLwt^7nnUgi4!V?E2y)H#rT1H9-zjF1hJs+&r2m)NJ-`w57z?qA2#$jzV=ssXGx@ntmI| zIkv;d6W?|ceF{80ES?$kmC6D|7JcCzsv+cR9hI_Un4v{j>AtJ+$Ly_5^DQVNHBW`oV{FdX6Uz1yC_<( zx@au@W+8}b-^7s*)6zJ@!0|!yO7WYmaIz31n*j|=wXve6cAe`(=sCHb(C8^`Tv+Q( zU1y1q;;Tn0e=9w_FL3*p`(G`$2Zw5Z7u~bHqr*UDscjm!CHUwz7Bamdi(6r=6cJqR zR$?SuyLXNf#dHG`mVi0)-exUkIVy^$?-`T~hhj=2>on(^(M2_ya+jU$#p?{d+>5*4 zq*5o0F$-Yny^2_#a8YJO{#I;W(=ffV$i}*h zR383w#?~{)GnPpt{b#9fbqZ@+bM8B((oAd4`~TrOLz2T^@e8LFO*eJ@HRw31!6+Ja zNNqHY{YMJGe3AlYYz<8QBL&bsNda`L+L?dp54k6gj~s#1&x$_{JvdTNQb5EC1Lq&+ zpH2?ma>8=yaRfu|M7WjTCr5*kFE|-3s-RwrTI4bul~mZ!Wc3iv8%X4S9}Bu!E4u-? z`387VSl6?L-GZ|Fv*_I>f7F=ub1)B`{zLSuGNF&y<{f+=j7w9a7T`>-Mi|^q5!VWXU`!+dY=X2|Y1b z*-{zNPxyP{^%uruj3}Zbz?h6RkotUsY~4y$DAKCXt^;lg>hZVQL^fj|joNvtI%+dN zsN}H#>yAkm`;tR-Cr{H@KNe~`&ollVVFOjib9RK+4qu%%mKiHxHPiVMo3Pt0j7 zM*8?nGfX8-KH@V1Kz(>-4FPQoxb4K`CmvEO^{Ecd24(nIwwggfUxJM6B9YD@RL_%Y zv0YyAF&PZZk6mC-ny1rT19W~eAQ<#OPN8jH4{EOj6!50-%@0Z^q{E^PV82+vr5#-+ zq;ba;^1n<)6aGy`KxGRLc>1Cip|c52cTgsWpUB2|uewDw6$3NC6Z_;qbdlpR$^RYA zgCOk&tB%{1I60;GQWYH-#SalFBDKn;PPE~XNXJ>0wWq1vz4g#ny=00CZ`pmQH@64 zcZ+hpAr=iG27KYYjSdT_LkYwcSJPfEhA>+svY>;6zWQvw4ykASS*20!;NOzJ4$LD+ zK)o60DO=}WlPh>K;}kE{nwaVWUX5*WX;h*kfXu4(S@fEKlc;LGc*Hj#yj)B}nmM~+ z8Uh)C;B9#)m3th_pvzb)y%=!Fg>8?g?=rAn2vkXb98yGTVEuG==7%XI|G**e$#qc$evtV-T<<cIp1~Y1KV|Y6Y^amK zTe|c?NhVaI)UkH>)E_(ohl7B7Xf5 z7~guw@!a<{8k^0o6eMM}WHXcxE96>+$q{z4W0NkEs4NgozUmB6JHkNvD{ zc8)fF2imxkf8fpO_V_r6XRMQN=>Y+srD`qM*9(6^XZ*Remt1qOV*omIW0N>=oVmHQ zZE5qDW10KeC*BH}c+Wf(@tI2`3fEo)6a><=wi3<5h&?nCL0w#STf~lCzH5zbsfeR1 zp@7P_c zQP$Tny?1;OYpr^+Oa_(j8-x(i9Y~xS?UsU#6;qqRwd(~RhEU_jk_C>nBa@PjXP(S} zb4_vKMnKQb(<0z;EVW+-B0K`A>xhznKh%SN$QWK4e|HRg7JJ-llb~y$lZqQQkT z+;NCaYoB3N*z`KWmts?t`VvqnOHjT^tn>_P)Lqu;iieVNSjzsUz{FvbEwDvR-YyQn z<6>nOE08ItS${7U7BKfm9u&lU#WefB&x$I|2c?Eh6l= zDw+Qx$w5TWFlf(L#re14|MD|JoZ_@xDmf!X3E=MleyIaO`ZdUZRv?zYd9o>%>r}J6 zIBd`$DAvRICqq0$^=O9_K7L(JBUg1tfAS|=oo4> zu1=11U>tcK@k^HweC78^6u>Is1Bmj|QQEw4BZ*Jiz>U4+)cm!t#?cU&fJ^qt7Y+Os zx$=ZdbezWc_12$~fxxCwu3c50x5)LRR+VD|7Tz0Z{(Jd>?jiea?~lvMT5*1{=2pSdK4?atnUpR$0Z8eW z^+_fypZ_;&KIvK^05%#Bd6(b-Q90JoCb(T~(jC;-qy++miq-W1(4D*AUO%D4_e9;- zOH;t1BH#mFDhy~bl$9wq4j?bzTmuh$-|@xI1-K`-ZVfOouuc3?zDJm$@a5`q{Q>wh zy16`LWYqbX3bcGVU~ixXCXP2c#=e8J^q)<5eaFBK0XpFJ&gc7()W9su2E?2Mz#O9S zQ=KAU(UhjfHRO^uY$m)Io5?%+ROk{LhVRo`~tHEqyjX9cey^_5gIkrk9>D? zXcIO@fKXfhNi_Kr+SpVOg;-(Cv6J_Nb|Z9fV zdbOhkW0Hs7=hHIdVA7TuXR;ZpfTX{s*y(#Qr!y``o3oYj<0ymOq6nB>+&_!KA^2ve zrckb}zqc0zD(!Yb91EtS1Au!%R8Gqc7zcK2PzMg^3_F}tf*Q1HI8ZXgFH^xL3gyl3 zf%z1kjM#3;$_ci#pGMe+iLjI>gx!Cwwz>l#Q4xmBFbD?KIJ>B5Iu3_<<_5q>*gQj3 zxi68xa>I+fX%29%b|YiC4lTbuQGA-eFlcU$R9gTdYQaK4ZI7FJemwCDZ4le3mB-TZ zC8El!PUa0)nN6gZjU(k20FXU*cEl)v@Zs!F+LWQkC+<_Qig!mg zU0m&B-*K7#U_!l*lG01XgFF4ROD0L@$sTMb{~1(DgJo7)`ymK^AZaH)?TUEN4t`Rj zuYvWtuckK)4ycnxTi_EWKbcM9Ju9l35I655G}iYl6PWR&JD&_ppoT31YEz%3&$3;~ zD7ZDN43S&-GRB*>j&R`QgN?FGj!rT()m9O?_sj@yBKrz1JU(aN`D(wR-_@@wBw{?I_%7uf zfv19vu0NC0CgD5Om#84H7l!|!rXRcH2}RYg_gBg!5aGYgN=L%MU^@U|OIg3k5&yf0 z)mUl=b_%6aL!K?E?pDqFlL4Uwg>z_gH_2c;LRHI<_ zjsJ%?7~zC!onstUNFSm3Npnp!TDtpqyk$C4^yc!HH-j5>ky=X4+g?dW`CdR0+wpc zvSdGrP5jrM$Rx6>i~99)3H*_3pJgWZy7NhS{-&@6Z%(=NTNZq$ed1zbLGM z2Md#=!O^2v4$;M2GaE2YnvIR=xySNSb@|Mn1Fyc8qzG@51=3RDkso~=WL#KMm(a51 zLPLh73Dv+Q)!YVa)}1TnvrSR{)BdrQaf*=30^`g5RU-VR9+YL+p;sox_G(XNJEm{w z5jrl$@YVwvswCyEf;FwuR%jZEQf!Juy@Kp4J~6|Xx*J6i`@~ajLo-+w5&P*?7HksB zJvdA_Vo$Px%G=F!+yqf39@XmM2=B))F){|6nqM~ONkH^QPzEB8oAA%db!gPEk{@eH8Y0OSi4uU>h7f`jk3gS=j_2c*KvXPCAm zcg{a3=Z3{q(U3UawablXwx=w4ZYknUxeXyFWMr$u2D)Ts)`$1Rp1;#84g`wd7y>fOi5!Rfb^9Hc~RiKJGZ=mncBA1lg>f&9m$8`t@OA+VO zg{E7-DyFq@nd51dibk995@>IV{NhD4wVJ!iCOj=wxrw!xZ7qJ{eW}enB^Mi_Q5}__ zdNOvJpfXE*&!((8dosFvg{sUqqh^zuEluu|Do=$gR1P`=wVb5 zB&EBNlm_V%RFDn@q@_zhT2iFDTe?G#Mx>+>5R{Y>X`}@NMHJ6;6qcmYfp>$xj_o(wI{KwqiGTV;6S~lHIh|e9Tr@QG9_|YKrKEwN#|Iia^1ZR{y?>=t1S#^sl!xxa{~q}N@eJJ=R{i>ByGpc+ zt$7EWG3}dg;s(S~JQ(Xjg-0`n4~_EI5Ym1*2t?=00?#}@W8D(8cQVT?-|Y%b*W**j^R4|5F)q)YK5bVx{;^c;iJM-cVQY9i*)g<8Phy2lLb;fepoPJp> zy+s*9zWzUgy%y&+#Zyp#pm<~k9v&$)qJ!nbyTV~RKh zuVk|GC~>5f!t38qwORlW{qa-#xwguIIQWK1NCnuS9gyz>wcFixA5UMQf?`6ZL6BJ7 z`+cVnyiVn=yR%vzkNEd|C*ISQX4e|zp6cO6n&I08x4LZG_jtn&K z8d%T8>HL1y6h9m*R1jI0lF~i%r9^f$|6zjZt1)WnrCC!Ix{S#FgZKy-LaDF%o}DCv zBhHYbavyi?x{T}2v<9N#m5G)Fb1PltYs8T%0RqjjS1wjIGqpwYj@?%fTg8SvQCpr= zVI$OIHiq{NoPs63F9wb>^`27-@71jzZkMLgL%Ji;2;oCzMjj3gC6nF|GzndaJ~*uj3}qkP@)E6QqpiW93>L=@Oo` z=Q%zB=DXkiI)Fw$|)7O z%;^Q+Z-!ifP9X!e--9%6@h*dqa#QfZz$_h0EjH|XVUY+Qt0r*}l#R8bAFeoj4>0+y z%St+kMH{Pcqb=1WOqsf3Uc;h0O`|BD%=9p#9sf0mIJZdJ%m)(U;%#q!I|gDyKAqnJ zRc_yAbF8R*MnDy!R<&&WvoLga&H*@7!=h?ntAT6A7!_7}%k^AXLdlX5g*~4iN zCnT9ixGow<%41Za8aUl)wh8T$dv5Jk)jda_jH5h^+5(@Y`uIK}En67C>%WzmiI9$T zm2ag6-zPTQcxz4uyAnQ`|IKc54J~G8AH@cHbMVRYgA}tNy%sAJ)3_iyA!ovee2hD& zo>ZygYx;LMPh@gV(S}V-eB^NYzdPo<$&f%D;&!I*IPwM(b$c0Ag>ZrEJ^dVYuOH)@zz{;HsK5c5MnfmlQ6 zadxa@5L2?Wc#b=hbusxT*db+kxHk zLwsf?GXar>YrK?X`;-~t_TA}Mtk~4%89TicC!WwfLVzAVoqzrD6M5H)!h0GHlaZy5 zYmQIVDo~S4Y3(XYyIZsHy{CYgZqs#cWyHKA*mpZPw*BWbRtd=Vu>36X_)TO-G&oC7<<% zt*u?#sPEdqY)-BYHn`9He_w^Wb4Uo~JW7Pob5fhLTt3}HN^bXgjm=NVt!1{Q$qfBR zMocKwXIGVCUBNmU|uQ|xbn=}BFmdrM>Dk%v%S zTV5glU8ylLB8i@$D0I%(adySRf z7Gfcj>)=L-A`9jK`&!uo?5AWi{LHPcbwKA{saHWQF^Hnn%U=RrT4!F&_V$% z1#~ai{xb@)ts~CC^-Fdi|I-hMfT@p^`UFkyy1wA_J-Z|d6l3y7Eh?5pdWc?#Y@_&f|~B?ebG=R#{#bLGp(Ga`e;PM6QLEhi(78uQX^K z44y9PPyTmkRLG%u`&2&u@6f{F&`?l6mH&5W3&^4Uf4&7A8vS?ee>O(>__J8oQ`s+?o ze~SE3=`WSGf6poMK>%J#woi%wdjJJ7V_pn+r1hT(^bvBx_755s{zbhI)1$a&!!sTb zJ~yf{4dyg#)&$=LJ>pA%Uab-|SS_GO#1ZbOlLLpDo5pCoF+h5Bk(=}585FXsa8o7& zP#bvQ_lsEu-+CNi0wV;fgd%>wyAVRqHD>TI^v~zjmFbx1)%736QV6+#a{|VZ6n3rh zH=tl=*MIcub^jjhe96$-9NL+wTLYq4K|8AV&mpR>;=g&ubO!tF8^E9Du#B-M??7sX zEN+yYz<1Eo-n~`{Ebj~(w*!TIV2;mWcpnXflz??|hI%uOutX)J*aVymvF7}wYLdrE z2ENCW2)I%Nve|heF(U(xTx-E=o2yL!<%{>E*1NL}>}`L-SNdtat;x4mfYp`F$pU+w zZQ9>l0QCui?>X}EGHNfHma)pz^8y55)qx-qHUt@i$bSG#A6YVGve&nPC}s3HOsuv+ zlqWX|?!+!slp~6XC_mtUgd*Q5bpYGVg0zK;(^7q;c0q{r;$4VUH9(0LJMf~^9*u}& zmzx5tu1}P@0qi{?solReEjlW{yH7LtS1fwM2%G_@3?b@>yF`S$um_D-7iO~fpfTOH6pgB27k*KxFk;DcWZFe39wfwz)7$G_54=y z)^&HF*Ab%+qGC{8l^+8LJj{R@zaD>wHhy!wWC)Wr6JPavsR8&^b5A<{bF0ehW-ox* zW^<;lL~&Jq1A3*2z~Mi1t!+Z|;b+T3OW&ZGI4+etD~Z^R0Q#E}9h(iog&{B+)fG4uvbZ}?}R^6?#`n14uEzo)mEsz^V14m52uc|`Fg)}6wr zi@xD^hEjP_A)V#Hcs*EJY2nj(47gSp*ISE9?A8u(pWpRsyOe}yzSPk~_4k72#CJ?I znEeVA*veH(5xKPLC}d$S)u}OEY_vwT%5u|QWU&|?Z}&apRjV>;Ln*n51LhUFOs77I zi%v=UE$+J=GgO!Qb1(I03hqFmgK;EUOwxoY;V9JK!53r*gfl~4U=f~I00y_AY+H6c@<0+BIH3@4t?T%0rpc^*3V(Qgf6M#G;jx*+M z{bt-P+)?N6&dN7-BK761y|0~tMRH7F@zw(x7tDDS*||S~GHFMBSBAokICZL}SNdaU zs6-kb@;WYd@Xqp08$-Jc6Wp2>Dl4SqCI;J6m4Z=x#+>9tFN0aWLuQe{6zxmf{IfMM1~kv8}wXSQqGXey9KChF#miCGoY+ zX{C?aNp+G&#M>o?_g{We>D8x+s@QaCO# zij*ht8gx~QvJa}iX!_0~&7BIv`E@tG5+!jPia8ScEHa64q4ce^KD@-5zTIY3>u?sq z?}P$|)coV_q?LH9+L3G59BqGel<9Vxt775CK!d+SRLX`Tdq5Q=9Q&IkC7>44=)MeA zRv8c#yjmdI8&IgAT<^zv+cEMfaYR&b6Qy(G;B^$m+X3*^AY5Ym=A>{W_K}_-eK5h*aj!hGKSwZbUL4Ek#Ob7Ayl!;9ICY+?K04_ z>!8o@dYw_STs_lGUBkO;;BrF^>ny5hUqQL@t9XVmZ%_GtvKyn zYc$kgWtE81$nlOf%jy5y++r(7kjAf}OYIP46ZFgKZtum2muDV_`l_a^7A0fH3a*Er zz!v0Ur*;s? z%XX(Wlt@d`f1j;UL_A82E%-fs$5&#hrg3ok$!TlNYgJp4{R_w7vcEQku#|SS)i12| zJA#C{PMva9qV5T(R2)%~zZWVY#H+bPR~>lTcNdn^35T8Ck9KGgCscRXcHZF6#Y`)0 z=fqCe?kxQ2f#!!u%k8}uVPfzV_0B{pRHp~g{TV*fa{Oj}IBrHL^gM!lPyte`1e4X> ztJ->g%4P?<>};_)wDb;TOC?kKdde~!bR?`CDxG)drtv{+>X|}5r3tG-rlM1C+e+*S#>Fk z14@zxfhwQcea#X}d}9Z{1FiU>l7|yxnLwFn-=Vd}#E$bO?BhboJ_q?B(;>lMpDYEF zm2WiEMVFU2*Go7S3S@m%$W2bMUA3;8}x&irkf z5HJ}!ZOu?#Zo+<9$<%Q)MWia1w4K)CbxGXK;wkzrG^6(uR~>I-UHXWYT`z*Mw5gOq zv!YRDIVK`UDUwm$M-a0@Xw+A>92P4kAVAsR_??Lwng6<{Xt1C}!s2jIUOZ?m*wg3J0A|RLgSXGq@Cy{VbuE64N4;++I z#2$`nS3iNyx1jyRC?;$9C0r5dZiP^n)VY+kNcrz)fa=g5wI0Ylz2E$eyKi6%NNDU# z;tbv#*}o|vngnlVACi1De{L&-9(3FOd64%_`>>v677Mzh(W=KWT@>h>_;W`2%|u#3 z5o3H74G;SoBM;exjnW5}mnYGT+MN{qXM8C8z%$>71{s)7}QRvkRCwqm0{-OC0X%jhsr@@}C z754uglBERjE$j8Y;^5x{!4&Yo|Lte^SL`LOX?aoyug5B_*elDXdsyUpe*)GkHV`j? zMoc~FEIr4b$Kl=WC#Dt_aJ13~x9B;PQ|>+XXkgf9S(ki${#HY^*@@@)-7z+!$oGtU zt{x9~`+FuUbY1FNTOX$u9M3DQ2R~kPCZ_7&y#o5_>?c2LB$t9$_V`V{eBA&(B?+Lk z!M5?V=LUc1pv$sa`H?E(dtSnj3cIu-dcbnhsuTV8kZj*^9acJOnbfs%VGeHncc`pC zdDr)(1BSQWC|xM|)zppY`tva1-Pj-1P#h)-#p|eL*eta#&y{L0&VV%Q)_R}$yBbFX zygK3-)e2uf;QxUHNQlSFdeHIlY=zn&j=y;uE+9nLs$(Cu9jDON^ieeM-XD<$DBx`Y zCL@0L9UZ5V_iXpDudg0-Wf3zX+UsDH{u(C%sxc&g@vEatOgoi;wfbGTq4-DOR0(Lj z64LVImzOBOxnuHI9-&uOYr-)TUDmmj2eMidd52TN-t=8xnw!a&#g^1DIsbVo#kR(? zF^(i0dG*z(y%lYy7H@)mkIwvGBkKl=Dy4G9yg6ml0H-7C7!#)%I4%7Xg^2oymT-OW zo(b3xHo53`yQ)&+&Wo1Gd~9~>Hd_i?l^1zT`YpH@Yiv#Rb` z`9h3Yg;&tke%xZOkbGn3w{-pFlz#!`dyGPR0XM6(L6FpH20z=$wSTjmz;|r^u7i>;eip5mHAY%-jzlPjFzdGZ5{VcgwI#gj&Kd zA4l^ewdq2urwiBRNkKP8!2;I0L)MS15UY)fRbZ|d-stT7PNqWuluMQN|c?lnzE-ddCI zjvV)1ZP*IE#dkO;_z=aDV4pOPqBOs(*gzT-_zj8+9{I7P)X%5UDJCEO+`>IqL5ye! z$#vxcAD5PEEY_PgTGbzmH06dw-vJTTy_Vf4fP-}f$}Q7y-0!C)C%PAbl;X#Bp{~Dw zOW^P^s9uJ#OeT_XI}K_&^GEEV7$CiPZ)>z5l;6-V(byF1yd71cUBiPaloRF5o+cdsg z2lQ8zg%zi3ef8{SdGXTZp$b?{zHg*aOsJCcVcSlUXabw1o`7Xw`SLv!OEk624e$S? z={CH=fahNb)z$@KjNJFG2*)7b+pL11 z>!EFlmv~|lKB!1K(z&ZznR}NNCrjZcc;v^!lLttsI8+U&n~gwxl~u2h^JXf_o_ycD za9|*j^`Y)`l;lUBqv7+rWLKs&Hd(Plkv@bmvFcix&1|DRRWUOzI?v8L{+OOb^I`xt zYM=ka=G=35wMN=z#pw}Z@)b(2 zl#rR!KRe1RaH_Ek^@QkM7e?(4&%*GP%FHyj4i9TWY6cD0sjm1YhRjU**6?^+A&2?W zZwn@veTtN0tftlGPt)_BywIu1N0J!I*QFq6pq{gR3QW5RB!p61My+}G!3%vry%gFL zB}R*RWwN>odxK@7q$JZhqE9r#O~>-lyhh_f8RH2m zC%d_hLP>TNCf!yWGt7a=pYqoDICPk}`M>a^ilJ%nqcf3elQ($64?+HlgsHL9A~U)>7ZNyhGeP)$c11St{oJk;*4 z9?x?qrcrK&LN9x7(&F_C)}5ei8wQeMCBRqDXDRMPQx?h6%bxl+v@0|DXtwcg6RC>G zAZi9%<>i^N+Z5AQ@q^V$rWrBJcFohwCOyUjLRT>^cLfA+DQ<{wWZP*pW@Bn@aN@@a z6a*EJkL@6KL@mtzzO#DHxK{JMZd1Ru!go&=5Rtk4nADX>F;e-Np1xFjWYB<#? zMgvk&V6`WUh>) zLL{)77-dDSU)1uR&|q)mBqjIYZrRl-C!vpJCG{m@QC24rUq|6x6^%KbI@#R)8#Ee( z(S#|)=*-^Mp@8C_F@e&bgu=Ru7PEPIwV+xIk^I~hdOOSXUfrx@`P4SgNr^s|_o3XZm)pWwE(q@FZtEn`Bm^kT)(KS&%R%?@;O@y$2O|0rx6e*vJVGgur` zknZ>&ATA#al(Z&>ZtMSmI+7qbjyh8NkAWsfDMOONu^1vDweWAI;26SMKkLvH`paTN z=p6~X<{pFje^@+3`WZ0aDnueff9g*p-mnny8nOp*{wb=Fw~dW9}qLs;$LHc7xgaUvLv}l`slyYQi$XT z3i#LA{a-pM9gSs#I;{+G*HAdLE8+lH4FZ!{2%UdK9#Ce~)@%pVN;;|i>7O&pHi2PB zBEmkwRo_RVi;AT1dO|zdCp0Vbh;a1t-_d3C@cY7pieJ@Xd|z zH)J6?SaSv)fom7m=(m{^@47ZABn(Ex^>449+k` z*#C|nhtjymL0O<5Bfck+F6vUu`{ExJeh1OvR{j6s;58cgyeZkfGpz>Y;|kp3lNSn07Pz%z%F26B%<*L5|aqZVcJ0vDezSmp4L*F0-0`e z1C%14BuLIc--~tfo((ZRcCp^TwDX`v6a$s(P}`>>iE)rUWhJAv12K>8V^)?Rh3LBa z&+)SyBHb6GhP2Y7$oX!LK=AM@C_pUWOHCDZS$_j0zE;2hi!lh;YLVV{fH^wDE4ec0 zz#{^D1!#pAbYfQRLxhoTt$8^APEhzc)kVgqGb-5EGW3TPngI3)wp$ zGv_8QxF->FY9Ul%?Dk$y?!tbzC|0DXP^dR-f2(h@LVt$4w^-)*eeIx{O9Fe{c zb^z*OMgT4~WDhw5NgaIp3k?TV;RmqFhcbx8ViOWAQ;@n036yWx(|^>ag%qzcXv&^Q zVow_DLN6#t@;4Frcpi13C67#EwwRj85-Jkt)$n^%C|61r>yBhZy&tG=hT!ES+KE^> zyi0yO4(+Fw_DV@kqhvq)%c*3+%Z3p9W`5~P+x*AUjZgSq+op9cQgd8wnMiGGoR z<~k>Lbx{DxvF!G@%>(+7(W?Vqvk=Ajv*_FlosF&u8Y}A^W1(|Zf9^6_8vm%Y9Z*=; z|DIML8igxZ)9ojeFG|4wY1)Tj2@Otw%YhzrGu8EWGk4q6p$}v%GZ-X#leY|Fvj(;G z?U|L|@Y>pW)dX>QfSRV(eOE6!K-7#ZC_FA3FM*?6sa2nW{KA?bSh@D^`F83|#{}F` zgUVSzbj%(aZ4*Y`NHz59D;nk%$QH^$`dqemkR)ddNG!{<7Z(0*%@AJ&*=V*m3f^LE z#SniL$Kzap9S)S2W84nhHMC=pG zJQWmP z1_xWE`~r)<+SwxY;KJC9%_*W7cj={cX*bEd{ea@_fg%NtcD9$WXa>a$Pra1fw zNILi&BcB;Vw`Fv(!$wRXQ)KLRxK%e-eZGwQpU$mx4RR|@Rf!}hFaT^cjr%H*_asPt zQVvsLkSOM!e6*3pPWRDa%U5e*99?Pov8lT7~ zDZf$t#^#-sBd=l97+aC8(Ptm{eY|#xOU<2jC?&mItz!%Qz6Oe^tDND{eke6zI0-gY zlIxAw^@7zgwZ^R9*1+h?C=O=(m&IWY&vmj$yp`^JaM(Gx+BK;ONu{CbNPHKPgx0L+ zV3*X+DhOE(b`XewtU0jmGDTX$V4zcmm%)p`YeeaQhQ|Yqd$f z{8&v;QmieNn)SqV6b-Jbe2oXQ)lH9tx(CnPX&gH)I{zWpA3Z!3Nk0%`qn_ZUd5`<= zGGInY*GtK|O(;@KDI%UF)-4i;@-mwB^QYH-I`tVnm%gpjxm|X?tGr0=yr}usr1i1S zVT|N$kA9j%udXFFo*1=N7o%bSjGgYrrPY-IJ~}s){Na%la8TWHG z@Hi-`lCP&(FOpm7#NOjTk8yg~I#)&6Cwfi5aSlp>(Gbt02s~W*kr68O&^l4{J!Xn6 zo!d8BSBQdJdV|Hx3HC^Z^&U(dgkKo!@*jBl(Nh^+RS&P`ON<&4qxyo6`LkOIW2q^k}+hHzz|p9)zY7^mnx;_phMEe|jmh`|AAcGRrsW+Yk%ZB61s=p3-G`bV5LOT zBQVEx|9*L%vPk@CdU2iAyQ#p7A|4rJi%0q1kMm>rjbhwfSidl3Uhwq%h0MeOvF+rg zcL=!+s={dHOc9M|V21o~uJZ$j;AuR_jJdn-*5+hwgl`1MPJ_0VT1t(2=p{&Xbs=$7 zvrnCU#nInip6Z;t-7iKlB%$P&!eLw^SG)lDw@0l$pTbT3` z`GZ?rK@DS>-s2s)ui8g~;Br2hA0ea7jAXu=--k|H&T))Lovd|4?vPv36q%1X2pB#w zP=oO)@6H8TGUz_*rH4p&GQ>5m5N!!QW+|oBp8`w~*V$#j5K|8`3ew9Djq6KymI)HL zHzfj@Rp0`gESJaFW-PUb|&s!9qinxFR*%-&3@oWE_xT&6;|>gFbF!Y znp|8QX&ol$ySTE~st3q88iKEtZND9|0ycJdbTVx{#PZJ^MxDZE0E^;oJN) zG`ZJbZOv~ss}cXua^ z`!#a3IJ)u=3Q%D@Rpjk>8L|*^=rX zzMjsTwbB!#UXh_X4uIVOKwyJ?<4hlGZmg%1Zp0*bX)S>}s`6$<0>crUwBq1q)D?|O zu5H^MFs$9!L#RaljW9c25p^A%*2B2@VbKn`(B?v0i+$@sAL;t$u{WPK<@#R3!xyjm z_Dxu7`kRY=($uDh#%6ZF&9e)QwRUViT%8#M^gYo%NuAsNE@>Gbbeyx)-`jO_E|kEc zRs(7P(LK{l)^E4ch-MI>&5E!a)Fj$(xhi!yuF|8RVQN;GJAKRxBGtF!>sE;}rdd4f znpC<#d=vtshX#+-gMx$5<$HV`|QSY@dlNfrw^N8v`!{$gZKt>pAS&{MyIR zGT(5SIlMq6;Zc2{e#_D7NPS=s+T5m~iPw2X%<}jfIt^YwZ+NRD;O+D3D70))6Wz~d zs|2MAr8Wtk;D|65-hEn!-MN>-v||q|YUIkvKcjx(-2uGkwmH@dng{C^=-98k5LKE+ zyqXJ6)^H`!fK==RDybh&YK%oUZf886HbM8}?Y_*6MwKKHk)(S0*bZjt?Cr(6xk!TN z7|9IIcx<5F19&TPMw^O*+z{&FCoc@d#i)|8KBVI6Hxg-=a<60cCEg6JAoLgApeZ7B zha?)eSlri`FK&>Ee7m``6O6eX{W@FHdlpnho3HU+VA5cSh3PCAY`=*V_0Whj;2~zP z7lRg(8ByCM*;CM?&76Gl16>!QJX^?HrbLP|Ay9>Tv!P?c+1Lly4s|1 zQd__1*j5(xc5Vb}7v8I@6v7S$&Y)vqg2`b1`*fUIpID+_zc)MiYHaxZ1jnb`W7B$CEzmrQav8z$~5RA-LY=MpF6R`_K2b_cE6&~kL@$)n^mN#sgO zvNbV%{p>P`1QkDNO(XC7K^Q~AtkZ0C=QFj(*kvlaIMhf^%QJqq>iPxac#l(Ki;X0c zOWHD+-}x=G-KKO0;B{oeE-5mn-iDpN>BZ>S6XRVTWhKcjs`a95=k+nX+S#bV$<>dD zV=g}DeX$9KVb_EsT$&^urdN=!n((DswMxmpqBKw}@S#v;!B{dhlUNQYC$#UVS8x8( zso?y^VIL@~Z9L*BTNd<@)_W)Z3mG%2wW#oShEAn~j^a2+I`mlCyb6J6@8_^UD|{jK zq;v~bwIk&GP_GOsrvwlfN`15p{-mbflTEr`2}R&lE~0&ZV~r9UJ%Wn_rMUhP{pK~) zai3}X_y-l|V@`_t zf05G#;ic%cFVbKrim0sXU`&moU~|S5e`q8WgUo6XQw#gr0Tvs|etLGY;wA%vlK~^1 z`O_v7CywzK&N{)NZ4EHsK~lAdqyEY_E76;;ObPndc5)sRzu0NIUm!@i9pL%d{FG&i z&A~84+;L@jw6wBKr(cHQhsX6>+^EG%%n=I(aCLE&#NY#-8PD@p9o7hnCI7lNS0h(7BO@z>!UuDlsV^-}=2f7WQKz~@CeX1FjqBb; z-wn%({V73fce)|XtD1MXqrasy(_FVb;}WqMtYiL;FJ*|^4ETQ!gwN)^jal!*rNq(PO2+7TjSd%Lu{EnF8*SfW+#GOue`_|q{hGC~M z5bTkh3@aMWy=iY+II80NhWg?DRg|mhhA1Q)y2MyF9FsWXvn1F)6IfO9RM1@&^5i}G za_vrOqLX}IKDkvsnQGi!M{m;kEU!8<8{%b|6cSqcQ?sra{t17D6PPNA*dR99W zk-=}QQC`+|iFSk^EQrWu4Of}BHM*1+jx?!JzmA-1MF|uDands(d%Z{6H4Dxu^LU*$ zE2I)1O44}UW0Uc=ZJ4Pu9(yQ#yafoQ1bt&Py)e-YqMW_x39$sc)U0o8xIk5|=P2mS zOKbzn1zw~VcGWEt0`w1cA9{sk?ysH8ZGXI=MUN64*5T*dPLj>bEfbJ|;elmlc>Xkx zot9Lmy2+=88{-1IWjcXR&>2A<>o4$_&mzr)SRdx-4xD*&L?`z_ftTpT3`8k~+Qk|$ z-*ka7ZnU3+^2MRLlH@sGF*yOvRnuW_k-RafMz)4}_3f19Vp=JmrW+HYEN4j^s4u?6 zNdi^yu@dVNtpUcK9XY-a@ufybl9lWinzrI4irW@90(!y{iW6^(FLfPMTR-nCe_?;? zmCFs1y80$o$JZ-Z?_R#&@~ZfebOS6W66MdNnPwI1k6?StXn!o>y!z&=Frg%hMookL z+|@BSx`)jH=Pj7&iBCj4)|8%n79dQ(fb%JZp-_ zOjpTzZ})ILcyzOK`RcIV%hTc4;Mw_Q5`Y~^C#KOLu^4VAOU`k%Hs!vePJiWm*}W3i zoq90Uyx-G19SUzzQWrv0mc!=+Y@b2j}g z3>n^b@s*6$v93E}LBqLe=Cs>u<6Im@NBC4^*4)kCKCRXA4SwSxp*9~lzj0gQNW5n-CG07N zW@?9WkJ{u*#lCz;Y$E9()81!`7rO!rGec2c@X@A7Bq_F)%kbo&bKs5J8RPD52vkdX zTED+_hhhB1P8x|er(2S<_}vh6QTu^CeKI+nr}ZUq$1&pZd~#x_IvmHz&Ld@GW{zAn zgptuD_XD*IXD^Gt;QNq#V6}H~k8CgWX2tg1#|=ZKp5q70kK=d@{G`w*DrfAZX!w|h zG7l%Wq!)V`-oz~tiLp0Dydq-;RC483F1uo*$un)w%HAY9psmyh()ciP%_*+OyjZ4K zscGZZPpLWjI8HwM*GUa2t#N7LZn+fW8QO|lC#)+&MnL4J%`n4h=& zeX=wvWf=VOlD}5NzhBZbKllEB!tZz?xmB7E1zJ|=Dw!gqNE09fG9c^$9Mys4ajv3n zM9+?_DDo)=TrTDqZ>g^N?tl=y8n(`^V&!yGV7FfnL+nNSIsD(5bKCJ$9Z;Iu zg@4b!Ed#w$BdK&W7ZutWtTN5L&Fjw|&H_TQM@)WZF!m?#7ZBeThm@Krmv?Gw^CQ2N;?~3r0EDy}et9 z2ZfCiWUE&ijsj{7McdZMM?Nhqo|qFp5mWv+5f*`0gi34rfoQZBo_7q4rV*cd@%r2g zS_l~jjxVZO!BHBLP|(gcDJ54S>^Jk;&#wgz$=Bczj;40TGJ~t+4M4ny$i2?df3VWO zv6?*Vu^N8|3M5PD;kVRJLtu^-G&dce^QlyfVXahv{eeqo?(=AYy+0ahHH=#29=CC5blD4Ln#(G#2meEdmr2EK-azd?BNTABON3KX&0#dnk&Nd z@2B)0a?OEhb{D?4m$3i!a}9u{63(H$rT9*D;Qsy3T{0fOE^+L_7j?1=U9>5>?@d}7w2_>(VaIzP=eQvv`P~Lx%C!_; ztbFLwIM5vNmN*1`kXN^~pKCnc{b{EBOke010b76K1cS>Q0OhY(yIeNT) zUHgVf91e=2`--10ASH&7>u2?s@6Bd19GVCEMUO5u)HrO)FB&0gfy_(b#2)-^4p)dbsfD^#nDii~2l8!N1EC#& z{pb=++|8S;L44CY+oC$vy4!+AADVtsyS!ccx!joY_xkii^$0Gxi#Zta!O!-mAtX!~ ztwD^?rYBtgFCU>R4ZlRpB%jtFVALw4=-FQT^yKG3zvK;_Dw`+n7J0#>iUG1IDvF1( z1Qo_rD{woi3>|Ndvu-qjpRM#!zx&;4uu%+v&Lz|5bS-uB$xL#tK_ZE^4g=;?;XW1d zb1QV=SC63ec%)Fxl4#sp(t;NJ>@C=%71T?!PvDDWlCfcyq4;qErP<~gQq62iRrH*o zVGFCgd-O?;%6`>NgO!ljn6MR7ft*JrAW{mG<{1;4@&*;BCJ#}C<&8VD$vkx`(m5rJ`KhgYV$ zhj-%exXmkW&%eZY@lG+=4Ao+j)V$)-H~xU zihffZtTPG^-u=GQ@`Vubm7nUOy%fc*I_ohm4G2zRLza^0%nr^;5x@D$rdtn*Xx~bF znS+Vd%?zG~s4@z1vF80~l6knl)m@t;Pj6}@fw<$teT`LJnX=pA5o`{rddvKXMroc# zwTG|j+8XxmqKD60hHOR)9iIDqBo7~a<~dyoNX~Sb-tm+Rrb~9@)cM?ynHK6zb6?18 z3v!ZD(ItDm*t*l~lL#2)nz~~8qc-&-{%k@&W2Lo{c7B(0v^9VfHi{M@2N*^woMgDv31>G2b8$L;H z%$+W=;2R4VQep)28+>yCO7nAXMMUglXank>YX9B!oG~1%f25_X4S%d-%KwX&zSwIXRaKRX%6oTAee7~SPj&Eb}$#~`{@TEH1q^uxO? z^Al{Gb|AM7d5M-Pa%M8Q;P%1Lh)yxph4W7gBA(ZBrVgH2$qC#n(@;e(_2=OdGy7Yy zd7?Z=wi&(WEcsL~#WJzoaGIukEaSJSF1@s^)I|FOjcN$lBsBGnY->77zVKmH(cfST z@A>jx?Iv+0`cKq#1rKA^C6bJR7jy6Xi#8 zNzA+a;A`#b3T3a}%byd_r(Zw9bvXC9#;x2ZR*)gk^1z+u18Y^Gv8T$zB|(ZZCP@df%_ve8{JJf@CMfayzbt@1?`te~RXv$UYFJ*{mHY1^ zepQ_dhauNmmdtZjQjbX(ZRrx!zvd9mvagb@0(}J$0Cj#RZS< z_$45W8#g$t5X0x!fj8;?#j=s4qMqY(eXoE2dX$r!t?N&z*9RkGub+SUwGQ(pU*)ff z@gCtNwx#}%#z<_tK5W?jg~o=ZvP$K!N+Hd)Ge+W29y{^IMC0>Aq+T!%xvKt%c}UaM zM2I|R(HkyNf%Pbhg)v}x-=$&g0SY|yypMfNulSYOpzxsaFUvK!JHOiOEmN1xwElEU z6308)G=x#s-Y>sWHD@6OEXOoxRDKA@GkS}0vx%(-ueqf55_1t@^}I8&WF%@33|e z&RZ?v2>`nm!K~qT53IzRd4(%Ds(AOGXMu4MvbkOt^}>*;6&vuuo`lajC13ZH_~gXR zg!ojEuuD;0j|;E_lXds%hXL-RS9*mRSw z9F@t*Y`Oy>y-aM+#yh1Zx<-th7)LcItjtauxxuON21$fdo&6v4Ed(ZnIqQPxdBpZ9ioe&>iVA{HGs-kGqMZ_c%hKAL~5|h zxm~sksLcZYx(FyYVHSNOjW!Ead$h#k=dzTdQ*%=nDfnn{LFBN zk5I;$HMUr2ShAtbXCf75OWrt&n?dK6o@Kg)Gcjcf^Kk(i;tH*oGw9Z_W@FBGE^usb zGIV-}__MR4&?rebF`a6?IM;lbm6*Q5#4lSA!?m?cI$gh>9nsQs*9OY1nTy7}#Xi^a zRG>hy(nFFiH=F-${I;y>H3`w&rnEh56csf{GXSb6!&e|&9*tF%A{;uCTe!h#6p*RT zuT#?$=p@M48gcU}u7hcxxkfuUc1?_~6bWmv>2@yP8mN4={>+Ad8^(B-$A@x=U_~Uq zu}Ct1BEao1BXU{g^e4uq&YhYy7`nZIT%|4uzk+Zj_GzDp7 zsZGDh^zCYzbe%C*DsFP?>ZJc!D&#Ss!&5Wn@#qkM?^k+qBeG7kp$EhUJvzB;C8e%r zM((e^FGseZ_yXwgp-#N-myh2Qq!r~xkvu_%uyrgZHOdCjn?kaq!06LZ5N1L>LEYGZuBHMItP`Z``B3w@0PG|Q^BjM_z6$I=)abWudtB@e+^P_|dOcj1ce#?ea zcWL6CIX*#9{KvLo5l04phK-0dqYP$!Yriq$sQ!z%IOy*Qmfg64Wkimf+dm?ibMnhE z9WiP|3Oz-DC*qd9Uyg`_IJokiG1JOan%#G|F5YCDv#zPd+k~#MJ9D(svp3r9nVQPv z!aX0~Ca8%Y7UjX9ORf?TH^Q&CSxvxc=xzbz=b1;6lWOPhPtq5`oBm6RHVQ3vo9ba| zV^7V-&9mgh%h&Utd#Z_eFRbn8m*SZ9v+0SEMM+){Q7H*^GU?0QZ`qf6oP0DIrx?uV z+Lr_4Y}Y;niyf=F6bUrs0Ot{WYtZkLOj*C~Avc?Y2})4)Ws3Vu7cf3J3F(y5 zhE_vcd7%2I`sXzaZB7|wpQm|Ai(`FPhw+rz8}U-;tA1$OqOE@zI>78&CQ2wWXgxif zY#eTBjCyD4X=cygH%!hyC@6RRgZ3T!Q;&=I(Y;f0il=ZzMkm9LZbwQh)c1X0dmE~``{!(Wh*c7UPzF(K;!U+^sj zfy}TD&&s6pOCcPyNp=Kuj6Zvtv{T=XBG&$w*}+lDH5%=`&PkG$_75Rx`U8X^p)be! z2Z`8jODi_wlN5#jDLTTWNf1bLF~9sTV8ZvmiCSomt)cPk|Di9pyp~j2Pm$39wZA3A zo7IDcvez=l*BvU~(+ZHR3PI@c$TaJVxh-)MhoZ%J8lb#4(Gn7>);61qFb@?#@S3L#Xa{fdy)W zAs5p_?w{Xxo}ZsRqJmizkCaA9Z>xYggDW98{m+G3IPlh=w|0X)C5aYIna=Np!mhF4bD9!#+5AEIf{JyWD_85dhi#IPmJvU+U$p zf~0L6rc*m`uPGjg!3hU~US2BzoYIy;17RSr!DBCZ$^o70Je~2Yp=?D96JZ>cNn9xc zHkR-fMSdPL46lT2ZwvQA4O&U+1iH14PzU+}Y!wij>w@k{|EWm& z3oeZ4_qP@Kv8|$1b~*mw)JL7d}M-|G=to(-`%CMFL-kBYQfsg~I7piJ)YlnRtYj9ec(%YzQh@CmlDy zb|yf1ofHc?h!JgQ`b0oBXFTE@y*psSXKP(TGTT;>nVn%o*D1p0{bKGgIQk|4EFxf| zb_ZXb4L~gRIY@`f1Y9ydaff*Ej#`c8bRSKC*jh|*0g_aAE!B42rw~i#-b>P5nepymGj@Z1sA~r z+Rw~^YyGJxlaS1%; zA_5_OPj`5Q^^((Ilw9-39!??wD*Rc z=q2lSy+575H{`6sHeJSM(>3{cPx) zQEHim4#nSH^68o4jr*+N1D)M@dD*9Vyz9-4aQ|z~S>5t@#)j&=|FhfNOpVf6TKos+`4u>BO?Onp|NFc}N!DY$%u?yFglAZ96*dy*Wm3FILK?%> zct)5r)3Hpa*S<+VFCOyMn8;J5qg(feb>?dpW16=^h|$4~pwQ{Jav$^axoIa#jc-p8 zbniosP|=KE8x0Mq_vg0|B;@?5l_6^2%{>;zXx6E$;=-b8pJU>^Z5YBNRH=d*ehK2(LZ%|jYd5PdEeCW8vEiV;F zXqC5Jj3AC|@u%sGq;9XP#`ng-OL%?zARQoZi&qYl6gf?l*L`GXZn#jzn-*lJn&NvI z9mS12x0j#CTbsH|{I&RVuab7Vhr`%F@<#<5XVY%85l9qUGq7R^O)0fvDDnKY@SG#2 zh~!tm_o$wSR1^VQVB!Ypf=<6a+ z#=tyP>_^BHM~vY@8HNacqFl4?%vzyP1ntgv^5v0KFAJ27rtjIzDa;LaN>Vzt`^h26 zFpO_+R*sN#?`svTa({(Q89zVW!BQB7sYFK15L83H@fFstBfU}UOXO)3k*#jr;n*cH z|K7}(2&y1;2Xc*aZoeXa+IsuCz&E$qp}A@pBx~<7F}Om;((W{hcHy%lvs zOXt?ipC|s|I-9 zNmE5J^b`RzO4~1$6U3wv-v$)9R*RfSsfuTZ083Gg z>4O5>@mA;eC&!0_l10|q-y-IC!%(A?*73a~r#oJ-Bo^ip@2eELeNu6OmjNFQ2rn~G zqHulro0qnxbEj`8`!OgX)kb_9A&w7wxN#ED#BsqFeg~9(_yNoG9xJ?>ZiOGJw1Wus zn40BMLF#kWp4H3YI*#V+b!u)mH8r=0j_z%)y6zOrJ)36wEOc;F-lg~}H?7#W{bP)L zkD6Ep{J$$ocU-k0Sta<~=#a=4%z9q1EnK>z8bRv%i8d>rjl42aHy}RxaB!YEIac4= z-)a-u0GKoH#he!>irZhn$Pt*B1gyO6z6imvIYrpCv z*AVpakw`4N@ihsw+x2lG3#r3Gx3zY3OI6)FsLB^J(is|^~)3xsx=j<$T=kFO{DSE0GjO}^i zXfk-D?1i?n-EG4{np4 z9;N_vA(Jb(^rK_=N(#m0Xr*`9uwL(Lbu^J9@g?JQAJ0{n9xvp3Cyzt~;S zHF{8Mb|qtc?WUdM#BXePF>xZqyT6 zJEi>Y8%nH(GycEH#RKe+i@Pe5^Kd@VR7X7byYcvY$m{-Lu4S51W0>5N7V<^C=n6?- z_hwSX>!GT2izaXanf3gNm3Z!zbf-Cw6bT`(PwTnfUHbi(XU=5_{=V9w&3G2%)#AnQ z_3#P*4y-RAY5UWnQv?^^wTvPIEpqItp6@%#QCcULuzX1vVKKhH;0+_wq~k2(J{+kP zHt%``#5HvF8jP=)&6dhh=ndud7>5d8!$r+|b{^Pt*=AespOKhvtt;?~JAq5{9ptX? zJSh0SgRpc-w9z474m?OYq?3B+d%|bgTY5y8$yU4AidSNX)?u~~T17^i2)=7CZ}$l= zvm=f!>y7DVp*dWeA1_@qZz%kIuTaVv`U&i@PkE!*HJ9PnSaGUqZ{=ylqbo7j*Lnp? zT%P>tEszq*&%c!0M9S4G5#}7aw5`yOu-LFeP-Jn-LDaVBf;;ttP`e`cGO_Zq0(m|$ zRxJqW#(|Z6IVf=L#-ov(! zDmjJmM&X7XOL>ar4w35B&Otyuu2yy1ULIbExcO}%fswA|6K-tetlupjgj>EP63tDR zk7%ja9FfYoKZjE%yN@SJ&;v?qeN6M4dT)hC5GE%)|D!{UmhDJ+2l1i0xv=piznM0+5l;u*3jfp$-P(jZn_RArAYJ# zgsr|!=Ura=^>A-}JuRK@-aq!6`Bb%Pnx!^^Hja2~`96&E{YN<0BoM9nq+G~c1#rIZ z=Ma@>3_<576IOvZhGC01?$6b1HSoKQw#csSLM;p$_-Qd}t!0q&t{caqAR)6A4%cO z-~Eb|1*>4)sjf7t_}K`(HtqZFaWFNtm-N)wK9=3M*6$AHJ4JRQ;I(gHj7EYowlNny zgir8q_eC(JTFOMu7Bs8hgPW{(;~>^h%nWj8Jzvmud(PZA$$W}{*HV%w>jIsEpD_A+ z5}@m-txJ4sb0ELjnJ`KEjoH^Wb)0wS&Psp>(y1-f?@d0ULG#ZjVSU%}+Da_0!{ge= zkOMQTSVRs$X~)T24Ik{|{Zxi~xk{a5eYXA0O-4EI0xIyW3bfsL6MB=_{k9_Npy4Fk zC|8E@AGN8B2n5ePru38pQ%i!=EBIAERT%@oc<*%r0Vxr@m<$+M*sm}17zI3hepN{~ zvJU3aH~gzO$v(1+Q06lPS&infjy?{v_ei3Rl;mc}?njN=cs}-0oecILNS>2rrDPj^Mo6o*--$61_sdBUg5WP$xP+8^Rzk$|II$x8LnV4~ zuYG$ubCaTb0bWcAdl5HI9-0z;3|JP_aYRtIS|4LF#26;AKkMQWq7l>!1t4+i-xar|vj_G>YYf`@=6<JQ_N(OBM!MV2rX%#UJo}S zAYqDgKAZTK1S{O}J&5?kD(`=pc#&s`rW;@Ik8yrGVL**SUsAsy`S6Xd3yKkj zX-0lVMk~)t<(F743%`Fcc7Ztz4)I64oEGht*B>Y?DAj?6p#2%`5?i&=Olxg^V1UyV zSn+RD+zbdyxnncgxY0a&sn{U15~cii-(JIHtuzrLH8A`B2d$q|1CsPVj2EgSs1Cz9 zN5GTjCaG+r+(md56XcZp+H&|WA=g#AAptL3jQC|T)Z9exB!W?u+ANLk_PXR>`Uy#9j|f)5Gu7PpASS9z6`AdaeeH<~HLskN zo~aV)-U_%!ExkDKd{ins;93L{WAn5 ztGuO~N{~rf*3s|r2WP{BjQkkZobRAc z;upChqLeoDjN3CE?jhEO<6}09GNZi4ZuBU%&}=f5p3^Tqc-*Wm zIoSN)z~hWSV9&BG|6}zoW3oO8%)6zm@DCFM_0Ls$<`jP!>VM;mnixV88ozn*A5HiS zFt&>qZT`M&!IC@3H;l@$L>N8fGkXQTTu89|>VGsLBhZ9m32)_3e{)GpNBHue)BQpJ zL2d}?xPyLs?eq`-fB(xt9FecUAJPi1ze>aKa-3v9s(F-11L10 zQ}57_>SPW2uOz8H%{+Kj`Y⪻Izel`*xd7^$eDX(FbfqrBn#U>0MB@kAneqW!M_% zwF0o;>>_|SB>WvlNob`Zm~<=AqXCIKIZ$?gqYc@TQn(-bf#IEa}5>xgNjce&#N>-VfVV`$dG~$7|D^S@h5Ad8A3j~5%=zuRBNIiVpY|Z zyvLOnpE&Z~+Q$2$E~jt zoF@?EBMJhpxIXD%S=un6tP-$kML+T^8?vvT3%-<;2TffO>wNGb+<;~@YT zc?!I0(U0xbQrnnb+8m1?91Ly4pfCXv=$A$s3GodGhKJNWXpUJ@NL#dEjo3Bx^Sqj^ z2B(Q<$MYlPl8oQFmSSy0ZCB^;z8iKo8%55VSCAQGW%1&a3ZhrcVD(iM4X~}>(G-C= zfOpOlV0!;ytf`%d%x3H4J*iH8$@eOUZZRLmy|uIaxq0Si^B*Yi8wYXyOz0edl4X!G z>t-pCy-;dt`~Y`pI107vMVk%rOFA$0Jq&9M|Wc>7KSzeS5r7HD?u<{RUPG7kb}w@oTmCG4j3@a%s03jtU>+dq{QkO(oKGh zjw?R^1>&YRK$~kFMxuOd8&74*RUGyl4O);^Mu$DSO0Uu#xEsC!>MIU)6d@D`Fckjz zRt@NHcq61-u$yaj^#LmPWNOajkqmN9VZgqm-Ch;k@Zm+o4G`S5Vk|(Ho6^=CyiX5B zQB?0_zYBCxYFR?i@hVW?u7S;NT9r!2;-a!bW>5}o14&(#Fcj6c$dzUlbavC8fTniO z*qpH^sLy9>#&kWnYD`ygm<({f-|&;D4g%y_YM zmSTD4vRcreQwc+~Dkx!$zEOnZt^{?*lyu0wZl`t^ztXxP%SW4od-x;pe-bB&S})n5X(V{pFpBC-sv zR|mG%eaue;ef#jd)Zc%JgVfHZV&`9GlW;J!yK$x!zsHp!ET`xubLI1~Zx6f@f4zIO zc{=Iw>qSdA7#1_u|wwRm& zgagRtcAqBVYw7-t_768rU__T`hjj6#Bs8XL+%FX^)|3sgaH#E%xictzH{w0s7izr( zw!-qenbxXo!`Ip=-nCQ<6w7>;l4>?&HvTiGc)ZMv)~oK!zh0->MQ7XsOoRWjO(rt+R2gnjqWqjj0nyCz?3NEK;|7^FAR-)WnN^@Hs1ln`&B3487X;m)*C4h`nLt2-7X#nKO@X85Pmly&>7xwf$ai2_I5vDLbDmUxOM znQ2f3^{e{OL!1sye5}&4_f#FLCTl4pb!3em8_5 zAtz6yT6Wjy4R`KGw>89aI9)uDVXx*@-B4PmrV@_VUb^(V9A`NkW#IREp`Tk{_oK&& zpw}Dhz}xmz&GKj?klwqtja*1PIu#^VqFjd)WKTY`p08MRIM^TyODGXFz250du2k|*}>jO2+k zc-=M(CtyCgT<`{k8yO}SaG2V3HOn`9C{G#etvugq=62|HTOc2J&#B85i?_1VN+hmz z)*e*t`+}y{GJ1)rB*yQl?@L~dw z^n7sXJc?U(j6^<_ZY~1j7^ur|`Z~dDJxLrR?{z~$$=A;q*Pu(V=R1W4o3HPMnalu>D&9qxh9@Z|%I^ zF`~zThtzl}BR2okUpRL<1$IR;aOXc!lvB1cy$&r!i=X#vV>x|-+f{(kE}c3H!0BYa zmteqjHjJ8$`nF@Ne77}_7rg1QjHH6g`x;Wq;J;vD_^k|91FsjKGZws%`3sRnUB+CZ zElL(z0`bi(-O#-88Q5-pPl)MpUuXrnQ9J-MU4J#=vbteRu)7Vp+ z2{B)2V2D-Ya^)c}AT6+E0JA`oo%FXf-D~5-zU>Mb`tajP54!&aHiIRF0Lkpme0Af$ zW#a7F>tnbX78L)+eH5}x2*usM^=~_1rH5_dEZ-{p2&Z7`+@@a@>1 z=IZ_Tn;^@^oZ4Ngf8Xx)Q_1><{rkW1~T^9$K%_d-`dk8s8m9X7^L!`^dXj}j)EOA#09aI6r z{~;=Vgvho@a~>`Qt4@a*{2yzg!Z67(Omcm{7NbTJ)yXAY`7C`S02)O=yacnQ@CZ|Wd~44LH@l!YQUoeR*hIa)|a zXes2qw}|ggpPK;W$vW9Ip%hl+ahT2*%X^??cJeLSs<6Tu0APo}iAJ9jJ_9xeH5^}% zFuu=1>?!X>a1%Vka!xM;1)?Ol;N#}uB%WSvYViUaj5UBXwxx)gMZkT_q!#X8o1e)i z`P*8sTp**f4Kkh}SkhiAMx??!utMy@7&ZYlTh;)$Z5)BCrw96HZ2;!Ww&SXv_6xcz z0V)OWaURtn2_krB@0X*?5gwh?8VkQ744Y3A&Uu=>;{eWCSzBNMk%S}lCFoSvx$E|r->t@#xCUH>l%O=coK;$Iq4gZ88{4pJE zDC%(t_I>{*1-8Qb5tjF#!NJGKzzs|O^>oo{$PrCQWk6#7qQ2hP)rq`>%@2FwC_D$o zpewKus(l^)ZyV+l^gU1D#hSMh{>CT-sz(ZKYgCfBn;D;vKxS20p&IE5VvKR-R#9yF zg6yeKpN7iAVP*XHX(5m{eDRXU%&G=dap!XJ!O)w#WaR&rcaKX+*U{ecIfo=ym4@sp0!BQ6krz10FIT}xcM}WV zvr&wg)zoR+CGiDq{9%=PACCrnbPazqa`$qKu@jRTdk3QC5NfC4%OjuvK9o0oEyS-q zSm#y4`gaO&rx8cTq^WR)zhFN7$u~Z+&@&%?Y77!Sclu|17vq2*dF=6Ui2d(B`-uB` zT-Vl*pE-AOdQ=fj-)y#%IXxtHJcuu~b?*g&A4K&zd`9+tFi>c@>SY%IBj7an7E31m z@8>|^#HBe-PW?j1f5(R;auN{!ceb1(ijJ|NFL|r^?=1S?``=!Vc$EZY%I7 ze{GwTIhr7P2k3krLxckpzfY-|i1??IZ4o}+KqXVHcS&l)^t$+qYxulm;HMBViT_ z05(Y>3wV?3R$;YHM{XSvm?p)f$-kyx*9#{jf>K5$Ssme0<}Dmek%Ypv@o*s?2O8y^xBz$F>s znvc-<=-voxh-Nrhhg>uGyPP(;VfTEg4Z>qDA7L6Wx9ju?E<#O^B~oA#K`S=?$$u8% z#h#>=$MkeTCf!RCAtgf+UsZL%;(|-2N6<}a5?juR961r8lJ)WIxa)w_xCGXKE?@!# z8@7;i+v)q!{{(dHz49_t5^zzcBYjlATRn1<%^dSd0-N?}TSlj-%u{D(Jy1+bx2TlT zMaQ=B{&>RAp?ftOGprNZ(dTf(=K%Xy@f8JNFA)*$EOMeAlDfPU_YOBcfmMGPE}I8n z#9WC{>)Ns;^f_fa9>rlwH!0Nr0AG(H zMl}<pm4~w-}fqD2g{SA4So4+;QdvReyRljN=;MWwZw1m z7km)A2mM;^43@D;)wn&eH!zR2D!7o7$Y(LYgyXB8PEk-|vhzht)z48CrVtiYJo2JM zBoEX}1RbOAik+_D7x>cxS;zCR=6*~xzuj2{P4AbggPX88sNxOVy-3i*2_1}bf}~N8 zEdYns=KObFa3mB_7?DLGtjTp}1Bo%9^xzAcM>&!g4r;eLO=Ps*vyR%Xxw{7l5H~Va;h|3duJqakc z<(cR(z~PjsW}(zFFVH`|(m_Q0kU;$!K><2|=Z^l>5T82g17LJ1iR!V9L+G9bPodyC z$g2lj%waGQg-I$ie8WhWB*eI?fY-K@O@^(gnjuA>usCF+W0V7loVDvl*4~MOlM)>; zT&I;6C8=&)Dr>=I`|v6>F?{}(JLq4%$=K*J&$ZNkK(J7v@HRB+tiC#BzMP+xz_mGc zywa}gmjn!--8J_TRuFCc$eEj18$eB$F|A{?`mWbNQ*EFwrAKJ+c|QyJyT`~010J5E zJrOsuRQ|P5M3w39Q?{o2w&g}^OAVaiD;fS5Z(wApJ(ca=YFNsU@}C^&)Um{*Q%`@b zC;mt(gDBLGo<+ZPW=1)V+gBcy4D!!ckMeOSrJISP;h8wAfZ}22W(X=RLTX7F7eaz{ zhjC=3lSvk9fxM(BtewQy9q~G24CbA^V3ToGdlJ7|Dy}nWBn7&CLRM155#e|U{0U(~?QVRfHKw^`nel0{11gZ3=< zj7B0;UF%}AGA35w>#wOzEEqO^@juQ=HVZ5GeVIE9iu%OTOpu0ovy_et6~a`_WOapC z!k3KZ&+q+UdsUu~zmRm3_wO0biOTSOppX3P~tFBPXWdAm}Ek*fo9f0sLUhuzfAktmTH z%ldtvxGEzs@;O>6uC^1%6!)YAIC5Q^OC?N;IJ$VdpqMg0i7t_6`ns)_XJ^HX>fePs z8Wi=usx=xGivMO{S$aiD1p&ou+~vBMR;}1z%2QAW_G4R&d(KLg4%x$Fe>Z(T0gN&e z>It%ugTIOtC4ShHF`*!=|X zfhVbgb~ZwXJZ*+aqs{XJe?}UQHTpQ2yOj!^IL5F|hZX3RvYzucIu?p3J;Ulc;Lv(E zcEt|zE(nfAip)|pv|5Q?C&rlm=Fb&1#;uX|QBvruE2|Lefyu=ak9T_iN+}Y;qiWOf z>oJT z!$|#?W}HfrFLU`nD5&v0N#$-;)&BAO;g`vE9a-w{e`t#}VOfZ1x_gz1yMM@ST_Tg!@m@ zi_}QTsH&za;US#xtZrfptH7pw{d59QjS9yvIKJ9ibZgpqN)5038-7g%nFwMykeCAd z<&SEzQZEC*inypxAlTz0Dv?Wf78=c|?(LQSSchkzhwJB#0k|NCp&zrc9f^cR9EBD& zAbIIp&*r;Y5TFvSs-rp%QDs(2x}Ut8dCucgMw25t<%p2AhonEpdf(jSh^z9`n9A4U znt;9p8`zdgH@KA*KZvg7ach-CQ1USJ&Zgth+%d<0P>=@HVb3Rt9)4?t76=rIi`ahn zq6LMHpTw(Pu4%0PL<>%kq}A^6BD|4Jmoj{G7q1-w1muLpmO@cZj?Xw z46$mpTX}l!qP?Bgq=ZjrNizT|v!XyDE1rmz_{16QnPz&PS4`dgId%J>(KMY!N!}f{ zE1jhI@sk$ak3xG~GI|^4g27f&^+$+P_#0nP#eN#ZlXq5+%sPJ*Z%sPO-Xm`VOJ`_a zwy80b+M5BwwHc;K(TX)%T0h%OayCJzoir(|7-mgKTY=Z76FA|81Eu$UufA)Kfl5CH zNrj9BkI7Ud^F8%O|+svX1UUz@PGAV*c zhrPr^`35Qjlbl9?TgSX0Hv{y>vz62b`!C0M&f z*O0kGM?CY)!{?Z$vCt~YdH_3rEKmy{SxgBD@$Jmj$o2nxe9joV5iQ^1&x%7>VA4jW z)svhAp+JdyzpNkl#i+EL>x^Y^E!f>q`{ms#+VUhEworlVCZ@Arv0HJGvZq+s7)5b# z#m4|+8kDiOf&A}S+jqd-RxxeJ`e7*g8OcAo&@ug+afl+9KuOx111Iej)8qaaZn?~< z3;G#Njj&qt&ioD(@+VnKrnarV+HB`;`Vgs5uOcxmjKQ-<)Jt6M3UZltdszi(3j^{7a<6Sn6!rCy0ZcKd-HvQ zz&?){AG*1d1XakDIZ+Ob44tBLdsQL`gl&pI#1v(tLtol5Np8xoDb_va)!DHYZ@Qol zF@W?MwLMaPk}B5f|J9_6fFw$l2C^yjOH+C)Y3?#lnN04ne`T?W9Lw4Pcb zW22C810_eQq`45#bR9XGRU84vHH&o|mbru`E*MEIuO<@Z#Mx8S^fPBzRcc?pQt-PR zo91Q_PFf?XIX1S52Y1h|Bz!iP3wCqWb;&sleF+;y9`5*_3|zu*HrIH|-C%Q-WPk>7&LInGMq(6+u_w zhuAdUMKUfY<oc8uVCgby;_~Qpf4lMHPRwef6GIOp6l1JH%ZkR zWNH}C+_syUF`n@?X^yGr=XFhVRKpJv;lZ`NI~h5XY4)y9IG<&fnEl81+_k&J9-C|A zT?sgZMtH-~EHigoHJ&|)F2i0EK$@#73?qJf2%Y$SR|(^{82E6m#XhAFuA?;%)_GB5 zta7X>L(NC7nk`8+x2b1$LtA7wr7}BuFL!Tjb5G8%gmsf&1pQ-ydeJyewc<;+?>K~$ zM%ca?LKu%((~{CFN$P?Q`PrJcZcavF&r>lr_y;bpwHj8u&*!gI)n(yA#aAyXF5wY6 zHd4&~=_n6YuYO6iHjiQ}DDmTY935{hzG%(+<5JF$GY;-Yzc$-uM$)hm3%GyUrqH{` zb7z{JzRQpYUL+S4ShF-oW0>Jf$co2LCI&{Tqc}czP&O8#%873B-T)ZpkZ#Xsed8nQHe@@%*232KEV|2vR)lrk<2P74kGBR`b#v}LZvN2=Z{x++s*BPv^ zzK$5Til4yl-)vWxE*^3v&`f5VT{#!9W2jDP%&0D?fAx9-ZTA-a{MnRvL-(AND|8R> z%|HfqXYhdMyq4vAy*`EOf$D4S?XyF}wq5GxB^yq(4JEU>xHz*tqWJ1(HcWLxpW)BW z<^=RzOna*kxGC;-Bb`cj^NF5+ewB&ym3MI)lCsrRWo01I%2D6^K)_uYhB$wUOdeK_ z8ikp<%8$Hxr{?|2TqNRg!WOgV`j7e2w3nY;?3X=1!<}XGleX`e7MCU)tz$D!7SB#o z?ig5wz0hP&6GD+e(&R0hS6;MdTGR1L_l-aci<!^|s9Iz|IN+TX!F2 z7Psyrst;(6#&b+AZ>fwEf}8lX$}n$V`XzNqtxkT{^lG*58Gi`0?qI?*X0}x)4v>6e zFXv7hN~sts89REYt~Qr)##>fiknZQ@7?sc4BGva^t1uldn&rSNME7H_h% znCf_1@ln}ouI18?83Wte(v23%^v`EQ$vx~lO?3_oOu50%p2|m?YcpQnDIZ2%LXWzj z$gXpPCyE*O2k=rmkz^yZaPN3}QJrMkyUDSzUEyUr=yB(w3Ji4)mm>~b9j$5gY%$QR z?x;2|wcNr|jQsQN8&Rct7i#$R==L6)xk&i)c~ZRDCr{R&qbHm*d(q~o2*kOSM=P*3 z_JiW}YTZ_MVy$vV*qM^)wLKN;;>JsS=m~G_h4kxjnzkZka{w4GrOk5d&ZYG(D2JI= z-^MBW!4;nG*+fyy&LD~>%`VCQ)|8QDLxQ9@lKy+I?u4zVASh7PFhrZ&=!s@JTWQ<; z53#LqsuU^b^v+`85M{Ssa zXL!GLzTzx$zQ6HUvpP{mGOo(s>GBPeJDtBnX;>s^)(Pl@L8EcwfL;On#+Ffq9tA_5 zx~}YO6rIGkWlCsS@CY7X>j)C$VwZlheP>12A&p3QDrc=*dQT~nuec!c#7*%G;Sl(H z@o%BOsP7ZBP2E}{Z5Ox~w1sHWn{WbBUNKyKAB8=>(Z9WiZjEYak69S%pHOX4)?Vgm zStgTryW_Tj_c>U0h&V&K{y_SS^dm26dnwJ9R(>3XQUAxmYfRDCP#fjgQdF3+Cd{Ju z>x(ESiMF@=nf;jK1GGfyR2bBu7HsvbY^E!nt9uFgNp6B0l0*r~MuCU*W z5}msuq)ECqZz%M;=7N@ocrp%f^TQ+*mj6( zdg`fiDwm}}HU$Hs3u zq8q1L6wdEILe1Nf3>dt=O%*m+Ckvl9zv)&cCKjGw_W#B|>vrB0X&7Kvf14D;l!^|m7CW)k4j6esR~fKjx)ZiYt7dBna+N8_RI-o`*^EbiQ7MJ z7~9N6vCWStUb>{|{$@Mu(2%N?0hN?=-UE#?PJTL#K%h>WDVvf3>S=Ljd5 z)tRu_uhh;@Hw)4oZt@gXG9Pj)ogH};V!AgY7(Vl5XWVQ#c)2cW0%#G!CSRhWdFee@ zp^?DlTN8K@$_Y*qn%i}P64kA5F3D^ueoYKqOP016x)(Y9r3ufMpL+el6RR0zET4{a z2b}=V@S`KEr-{DX*PRJHv3`%BkklLjTxnr>q9hfF6LlEdI*TvgN@PgMS{FG_Hxzt3 zb1?jnaxR5Vgt+_Bb&NplICFjS@p~2sDan0~IDNYnfYKm{BVIgAx`cV9?p8M}B?jwp0N0;%x`A?FV3c!tWgxo&O_kf>F zO$ZbdU1Jui|NcBm9=@E3*7U!WraAa-Z031l|0SL>!I#Il#r>Dk6i*TzQ<$2zi{M0v z0_uPFU!Ig>V#|>XW|dNii~NGB02pxs_!0xgKQE*0!5^$0!!%rFH}z&<63HC^98c^4 zl%?8$l;O=b&$|&rU}?$%$#p&^=zCbCfH!AJHxc21;eW3=eUts9NSH6*0d@_SSR~;|%13Dx! z{q!8ZRh7WZWyG9;c<#qQbYODwd!%s%9Ko+`s>-%NJ%NEVA8VUx{KeO%eK6lxGm4MCoDcy=B z*sb$|Dn#Pje=(g9(Z4+Jeu3t3G!)h}3ps-nXJ;7d93DVaoDF=-G9Y_%4@x7D-saCW zO|0J_`yhN5(XUz5NV6gJo{30d?g~5y8{S4j1s!6$qpgLO1$PC>%N`rM7oF{T@42_O zyY6!`5qmqFlIR^l)fOz$3#$*ni?|9x+Y)ebGWYtxP8Y6nVdN38r8`c(gTPnLt{S1A z3fSBJbNoQ8nOr9zEiXaj)0pFsM5g~El3L> zro=I*Ol-iml|AyQ4}`K+1OlT?2)kR1catYnxC>z)Lzh9iQwC-$%C6Ulk_NQsohKHX^=-ke1t3+Vn*r+ z$~FFC$7GR^#lyYTO|BJ zt|=O47!b)9d03{YJ@AIfmz2c9ZU#hSjLIWbwdw|%iE4N>u0eUhJI? zof}eP?z>IC=e#{Zo^7$&@32vx(LY#z6z@hL?6Q)CsVIzNT-yn3XG%b%vh+kWqjohmL9|O(rc~94nwom6kxcYuU;fq zeNUuWawgkQg8_4e9zxAr@SH)ju(2wABJ8~Mqv%J{v+i9WX5VF414r+2szv?!7D`Ei z<-C%`Y;}DA-E-`U8_$S9cT4$ds}<+seUJo zzGPvBh2o%3WqpRV?^5u6xf_B;^uTQv+0{Hk`qcwDAZHXSj;M2cp!ZUq6J!<%PobWF**3g5!#)!Y{Q?>b~VIbzd1}*)8Rhn=}S@- zUK=VfiAqy8PZPlG{u(P31)7X51a_MUA3UEwHnO}Gr4@-}hKRsZt5;)w?tPZk6VOgM zjfiqOPj-aMR6Y9KLbwg7HE#W+PzPdf(D7$!;9~q=N@1T4F*%=TXt_m{4jK7bwHj)J6tf=OUR~YxLa7t7}>#zns(rPbQk#Cj!o_Y+2c;fM&AI|Uh3kn z&W~{64x*jxX`ow0wRPexLKG7sfhEAu*u1c{giTbYzF&gz{Pi5t+8ypH6(W2~Dx*3$ zlzFKtF5`~9RL;jL+P4+hGz@z!zk=!=kWnFGs8|CBIDHj~yZ<_wb0H zyjPoe{{xTzGB1l5?H&X}pGE<5$#ARTe+&%-J>C|R?25+|{FTo0;_8ux*D#X&S~eY< zchWA2lAX&8t$1#j+5b8CnL^^#Eg>9DVmgxqPR6l zuroMA_dV0<24tFuo#*k4qpKg4TH?)hZ26{t7T32+9+%!AE1G(wJv_f(?LBjL_L5NA zJu+L*f?q3?9+hWOOX`dzH3U@uog4h1sMphdH{Nx3DN8mua?T$YK)6V({F3Rj>fv{; zw*?z<%>TJJnVqwAee@|Sa~A$KnNg0$tjfh<@8+-S={ck*8lr!$z5~o$Hs%Mm@2GCd zc5eN~lak&1lI*yrCG>A-Ou7vJ-PNInrRT7;PO~-dB3`dRD@7ubculxJQ$hCkyFA5K z!oxVZ!z{ufxtR1%s;8!f!O!Tsq~qW9Ptp4no0JJOx|hO;|C>0EVFF$Lq{jcBj!p`g zKde%e`acSBNfidxV|)$&fAjAD`;YG&e;)*KyvY$6@lP}XT?$uRd@hgPS3tD~SF4Gy z;g=k_TNvx>B`W##QDh}O&rRA`MW~W7h>_PXxbykf8;6T>g!*&%X5$Z^80OMjKYHkQ z04H5Xb(j3x&7jASJB6=hyant&LbjErslxNC3 zBj;%KcY)w|?%WPzl|huqYI!U~{7BdiTOGhGa(Gmj!#b0F5U+AqoWC#g{sdbu;sq=) z?M|qK+`T*vB+{JRO#KC`f(u0d?iTy}=|)W6_lR>Nu-O8~6MCb1kQKS}WaOKBleW5^ z&yjWB-nD^OIOt1cvS-QEhem7Lzo|3kQmT^}haZ!aCdx)&F&Pe_Nkmu;+b$~HlYCEK z-@1G7a!PxRdwtbv+a*yiVd}u^TZ4O5Z~atqn$xEmb2BLLwTT*&^+f3Nl1DldZVs5& zu0W@}g3gY12?B-Hx5KY~Yha6s964O)_r` z5AZK~*0{v%aJ)DG!+@y9`0iWripcH?3W2k_lgosy!=~=U^k<3fF$eTx+rqwFxOgS$ z*UXU{kziLY8(0}h>an|lhhRa3bNDpE_YKd!xx1V4A%A*9+7UhMmR{O`r;)&^w={2j z&Mpy=aukL)_-Mk6QW|`;Kv!Y{PldP@A(vQ()y_ct{r0DoGs10(E6rryULX*%N&Ky^ zo6Kt-84hg#zx^o+UxHi_8fUkHIU@jO(f5jy9ZCilymlyP!%DSIuG0CH{`q;c@j1kf zhN}4WC`X!$$*8TvqfljYNTX8tYO~)CM8NW)3LBpp%G(bQu?=BM01LKp-@7+}^TbuA1xcRoG=|P)iU-r#-cKjIJZT6iVHJ*>#Ca>uK5f zdsQxx9<~uQ>xrw-OX~&iU2ao-z1Lq_4CJ%muXlU#KuBL| zes|C{)dM7rza-w07KXB7IkDt3&)?*6Ub?UNpx&e6CHbV9Rofs%l;`Cu#+~*Q+1}Nt zwAU4Liz!~B-tslfSYO*f#qM82v$-l;cw2R9VfM)_FRgaU`)@qnk}{4vOY~QP?AG0K zu7*jKtY8FSk&`M`N7a#Xu?`&P(@ZToYWrk5FeyBFaX#1m{qEvP`>p6!P@R2WR2;95 zi6L&pj|}s`67}}2&+#o}&Bm^@pRnABGhp$MVZlykb^F9YG_8Brlun&pbIK3viqj6a zoABa|L?`feis?n|ge|`6iu5cwu|K=~p|fk@Rg=t#F;07iek@vBiSaBky>A@OE1Lbd z7r3hRq?6G=Vr{TBh1w6iR%gU%C@az`)=#K_I${fG60~XM7l!>*yUwljH3oOst&v4c z=c^uPBkgTknQJWuui?E%f`H>4d@l6_YArTnt(rjHfEgLXTYk!nxvfpT=R8WuH<&Zq zF!4kegq~89Xp-x0mJAy@1II4mN1|IN)ofQSdynjw1voDJC?-UFDb8@}RX07qFb2wB zhSBf))1x0^KWE>5&_wos+I!EaroQM~R3MQi(m_B3kzNG_l#bGo-a_w)^xl*X(vc2| zbWl2>1OiAG5D<_SdY2--2q^XL=+FO`H^zJ4-ne&+>&TawkdvHq_S$RBHRoJG>GV$f z?X#Z%V=~;8-sr+asPv^2S)Mq$YtF@lJV$%DO})0A!JX+As;tV|yVW`shL84e<9{O^ zS6R~Gh>k~csS+`2RW`};z;ebc7K?IGD#%^R0O@>2Fq5u|hwe5P2Jug3FB~(-l_EM~ zXawJJAb{PAAGuw}EVbq%zt!59$Y_kSXhFY+biTr*22DyBXdcmHiNWZpimj2VltSlg-4MKwR{Sz$JPMq#Jjjw8~(;|pNlTFe*$dl)KU z;8w=gC>G4-upJ>5>%fP7B53f{1Sj?W=^o&mhWm)Ny9HXx2SDWLxdW;5ES8V&%U?&$ zqEkxz+CX<~Ah_1)9dp@?=I+o{+sO5hzw`uJb4cCK!bbP7ncg7U-o@i4*FZz+^P_odU~o+c?zbCom+56h+dl| zUeparPvob?Q)Nb{J}{JgZdKrQLSU3IYxse5E9F#2$0M|?9{;_I~J}=)SYG( zpkJPZn+A)1#!BIsV5p)R>P1#Orj^{g6;$VR37qfok>6*(v*^wTxz7qF63sxJ9n1uA+b$Pnx_Arz#O?;juyz%Q@KuI2&eOQ1 zJuo^}JQ#V=%r`NJ<8Oh0(c!YS@ZR@F}n1GNn`o-O|WVbv9^MFmt%^;)_?hUx|7K20ZS@_)Rs9P&$ zy0%CHX{?uDGw=$+k7Qx?%B{CHzj)C@8IXBUwOZ9-RxAgvJuEVTBu}9rew}BGMEx{e zY4r5D)D&Edy7Rf4%YwOsyt-}3N{8sndnB}V4yH7lhcH>?*-l5CYEyX^{p3o%$iBkyYWLw}R+DVo?-VMpwhH!6vzAmB zH4bvGSHc8$9l3hdXPqXW{$obf3kXA=N^y($mLwj;37-HZTZtlw;!jB@wSBkaw?y{Nf*2iF z=mXj5B|M$UB`g!se+3@bFx@B*MbIz(d6hweNnhGzlJn0&ui>ip9Nhjt{WS|x4BWWZ z0Y#JTDFmP6oQN&}4J@pz6oBe3AL!!LTl_9EJXN=_y_F+1 z)1h5Wme#Ty4k`u~D^jOqv`38#APV*YtcIfcS=wjd0igClDV-TeK3@x@6 zU`i@!dj;|w_kx-=>Y`!~!!sr(rUQ`LP}PA^bg+Zh1T+vjIj{vW3JXt@?Ewsu3sChF zFE7sY?_7bqQWFaU88wm&Y;!QmS6#9ITSa`9*&L-|xmH9H^ET`=FcHzEdktJ)>z=U# zQTItp6G+QN%|sfyR{GyRevrH&oF8rUOcbH{>HYiLEm=NlN8pH7XIEntewIJLfZ(E< zOA(-VnM+_&WG@pP|AuyC&A{=3LZRF}%{ry9#UlJsVNkX*409ZYvESJRytm@7%w=W8 zHskJYJ2Uljz_DZD!AL~;$HZq>d8jfDn-?GxKGd!-+WzPq43RVGCMis6{Rs9qO|-_+ zKk^%}JMw?|e9{ZReJenya6ifmD08X+EZ%$m`>>x22p$Kid2eXRxBzgb2b777{=fT- zzXN^A1N0Z0L$sHQv}C65s&+5mD}gM~i1;SCV)$TBOxXWdhM@6?X#Hx2NIs#deJ z6(0W|AGMCJ-_j1%)M_lR*sE%7Oh`|+m7kag#Bsyg+hCN~W&Jf384z}%?j}R(;J)z? z2~^Ncw4ZH2`~>5ju8{a*+}F?u+Bx7tc;xJie0*a7xK;-MHa)%9*)R+;H3p!th(;67 zJWPF8-#$NoRTrO{%7XlLlZsCYz5`(j#&;G8qap>^1|cqqzdEdAAqQOc4GKFm_=?1Na;i`xhWL?vKTIBWD&PL$>fToiGb*(EIlg3=fZrMYe1{yu{5XI-7k-dF2*j3MvAxlEhtwfrRg(RI*9 z;TQ15m`AHnXU5m30c81Ot&KLy^)~?6lF=E#07q$9kY${`TjTmP&{wH=gLP;L$hUmf z-{=Dssnpt(DL7&D{ui6ZD6>%DCx$;} z>Z{pU-0gdSlMM^npigQXJ>x?ywNN(=EXxGY9@4t})h&*$mL7qXvH~tVg*$HV-LTtc z)A09ZxTOey21GQ}Ln+I=FjqF1A?t%^jg@qc2*_JKG;XD_nkbQZ!#G}>%jU%UpuQc{ ztOxM&F!Mz(iTEeD9ehC&LneHIQNKX5z%-H6$-{m_J;17%ANC-2buL}lJ+iO%3a7?^e4s#PfhfAZKpe%cSN9dpR5_w5b9 zy?^zrV>8$9LoC%mY-dzeg0L@T#MUvFP}i8&)f~_B+Uo@b`4ocdFaoR@YmA35~($8POMj}(t?j{GCfilmf z&pj@_;pb(BFjdFG-O!F$00k zn%-4wPlTRQ$}xzKRN{yQQADl?!3P)Vb4P?+St&b>xDt8M$3X2&_Iu*nKp%#1v62q+UJ{9lJYS}}g3p5yfbjXE+kLQZ=(5to@&%z5AJR{t5$Getd*I|C zsa_9a?!&=Z%xxa=0rS?fhP9T^pSu9VSUlPo>+`!u zyG)p=0fuLvpew?bS58>(_x&l!GV*Sp?ibmC^vJ9BbRUPekTB!psH^(L_$PhSM`zp1?oqX^`` zBa&)Zzu*Z}rC&9chxf!6HWog0i9PRsXE|v?Ncatm{#cEaeRa?0(YnXDqI5{35Hci4 z1i874ARoH#kKQYB0~J6;XR7;+2s3PNXwpyWd2n3rV z_bAe^6L;nXktb=hVt1XZw0V;Y@C2(SG>CQLU4HRsXz3K6(uq%v<8x9F$C|-%xwu@| zaI4-u?wL5_^Cik$ZDc(Ku_ko9NZ(UA>3K4i|2LJ=mB%`+^c^U8)VSS{Qz<7KGSOOpfcNY}Zp(h9Fl z?;aUBV+v*{Q!L?5+h^Y%oV^CH-Jj#CIPooaL01y-jHh1&iNnTUfo1xvGP~bI(|N+2 zswv%T884;7=K-^GTYyM3rEM*8Ubv7f_(*+L+3hlqAew5e6{rO*1Dzu{Raos{zt?G) zT`EssUo5Ic{W5N^jOKr#gxKYj1+j=1Gdb4+G`2Ycr8gjyrc$yW7~mm$3m7nU`1KqK zGs8#UC@>`#{G_r+0hY;uCVUy*HiXAa)6I+{t#ee6t@KEl@lgos;Ob)js^08U5Yx^n zFc=!zN(W(IT#6J5zaQ!n&7zuy8q3)}h!-=ds zK3VVsVgx>vK=3hUdG>85-q6l)lN@VFvWKUy!%d}BJIti$6G&mx$O}A52P7{sE7bX7 z1R;4w;CVk5eML`gM%#d2IN-=F@&`(_vy=p*mY+X(>DbrsdfhC zx0{{MooT2`<&lTZ%_cO7qEcWmCcPPrZvZ}3ALAb5g4eo`^H;;=+rcJJLaM@Dx-Ia^ z&E8jA%Z?{;y`wT<17*vYTsA{r3r_2|^3*eAm>RN`r78SZqvRgRMj^-Gu%@owx0r!u zu3u8grD3NVPkwIFdr6Upd>qQkWalBY+^5IVf@ya_3m|kdfdM2Lo%-HeD&!%epW7TC zc69;%fGD^QbcK18tSYlvem(2i6sduJ3mC*3%(Xr^cHV%0U{L$<rD2i zDm)=6S*(MO^zgtiwL*ryZ#Pd1QJ+4N;;A??RjP9@d=ZVt#E@v%vBl6>_>hRB!sSsC z)ykqJ(?u8f%$g9x(hDBikaW?sL0toVd)JtSEhX0EF611^drzfIStVKOtKYAf&dJt& zX_}34ZXJfn%4m0kgcy#7n~zLIb{-XVt}hz61*%pK@VaS^JBVhep8Cc*2%ZY!q0Kcs zVohnznt(@_-Bz*nwpUQF4D_Wml&FYPJ5+2@L;_AaK>BA*k`{h5CqFV% zeUYoshH6~Wt#puut1k3L8Lhee9-3#3k|6o|b6NNLko&?$XH%$Gp8T!0W)rRM#(g>z z6w_v5ASy-5d&qLuF&h6i36!F~3hv^h;_&lbZeJKvq&d+i?2(m4ni*b!=Zg&@qM=+w z*hb-+Zz4))j)gPK-`W`r`L=pFakk$%TlY}EARz3pZt_*gE9!q5upDB-GxH!y1d?08 z@JQ^}y!?uRT!CoHT?~@K+nD?^J=z0K6L`2=1`v2iKo4PV+AQP{?S6OUDN^&K>4ETg zz=S?XzHl%#tB4={3Wj)aVu~giQfN^^F7B!Pw?0n?ABbAb>#K|hh&k8}I55~JZ8`@t68}6MwE|xa@q69H?(d(E zDFi6g>g~I({e6mfdo9_{Uaa9Z&0jD8K~lJ<@3ki~y|J2`?lq!R zQv*uWnU^o}`tnZ!?_;<2#Bqt&eg8X{dXfyZCQkOAAkSU}h(@0Y9BgoRyz{_zw)?I8`}v?mYF z8{L42|9&x1g2a>p#h^~-@`4FQmrqIbCiWa_&|2kEMoEN}@ucOhfs*EH@BiKme?Tnv zQi-AhD_Bu5J_w4FBsuA3IaTxGxPiy_q)1fG7bMyTKzI8Ebbij6_uuh+%BIDmRCug_m0B~UX00D{XwB5FCs<=6S%82l_$IvBc^xRc_4Lo7)uY`w{i32Xc zrGuJ(TM#stM?Mv#O7E6l=QaZs?Kxi?fv;Ms!SrSvteGXNZ-+T&=qzi`bp-25jd zVXTvyLc^f%*VEg35Y^5n3M>Y<1W}rx%|rEL3Q=<50F1SpiXfZyIHkop6`5>?I#fK& zbijdR14C_rc?Reb-Y$FVI+|580DgYI=MRB4*ZGMoF=+%P` zONatWZB_8^4Z??B6tT3z+IltCizk#6MTs&o)W7j4UI2gSDo$20%BCBkkNyM9>p$kC z)!9ul6ypDwZLF&>*{9*@lhJ%ws`pVY{w5lq$d?Shz8b`>NUU399sd;!1SBG$z46WE z_c`-_sF5}LXiK4EfC3(|lXc-R0XO~Xmg)tlHeWz}uzj5FcX29jW%VJNn!nd_S`cLs zjA=_5bTnfSLClO$!hg-inW<^D-51`0@DXx2FZJYXd6>Z~x+35|~9qa>5O_ zPz(%CiMYMlc6@;^JptHq$&wOERYFjT@Bmt_jl2E;E;s;F1d=&~EPKfm!=i3E7)!Bs z@VQgi!`p#K+OFU8b2u@ddDo4;CmCR>3wD(ApT-SX{UjuE1_T3B+<|CCo4V^{K4ulNWvN7a_U<0 zefmDtjLlH|Bj|3Q)-Ty#78&?hGAD6*tH7^l?-rD_kXM)} z)f;+;ZYK4Oy8L)1_bl6DUs!#w&C)NYS16@`qb1?oQ~78*2BG$F6PNA$^cbd_oUm$d z$Q?RAb65XLSQSs~QX>$ z!MteRdv%UqTRv=FSE&p}-)VgC#E_Z_+OLcXSfkdWlS!HicW~G)_r2N9mk3upw0@1* ztBah>uMB$@gd}u2hTSRGN#HTMWN$IDq*biQm&pE3q7X0kQlCXui>b4^+lEeCF2md? zai-b7@+u~QX}QG4Q){lg&ho9?3;Fg7NM90X1}hW3krFKPEu*SFZho1?gAGJ-^y`=F zH{8!Q=RaX0mQVv^Jw+9$89}iJjw2-1X4O+S_C|`$?m6z=>X}G-9}vvLjhbklK&%+Pvsa?DIJ5`e=oPSUExMSuE`pjL-SD$iu^ zboI!HfDIVwDDFslGUt4@BPq;)u>TxBE)@uqW1EpM9C#=MK05BJ)k{UIJO}lIk+X!! zgVriHt+}EpIiFsa@+fOQYwbj-;X&ITGWZ_F_y%Rah>k?_1O8wSs=uu%0fxl($0l@L>C6t zA1>1^m8B!>jk^`C5=F~IE|bd7^&-a(*bN^j@ohXDPrA|9NAnA=mp}M6ox`y;IECUo zILdM$lTu;G^F(frc$u?geY%n97HAlfS!-hp!w#!R-wpq9Y-)3F%mcyDZUEB}y zazVvM6<3A~lSic@m#y}1o4VzDos9vGP}$V)oe)1FSA`(dwZG0j`id>{Bsb~&yhv`J zqG!fF+h{^XbG5A0r>A{fV<{EP8nc*WT)C*UcxcU{yB(WSI(yxIH^_%IaxHq~;#KJx z=Qr~i9Ty+N9Q(DYea`a@Z5sWy?v^T{`m>mC9#f7LE%qgDos{bN+j4DsJ$7R{d>gVU z5n?HwhepHZIp!J;Z~KqqIcfE+mdjCkxraS?7AqV38QkDDv!+W`v^w-%>D7EaI9IqmG$Z1>`d@3 z+jJRs8(IIa#v}4>u8-XX0@@Z`XDwg8*c+7V|C;B>yi%YlL0vF?WQkRYO~x9x=)RTW zzd!Tbo$r4CElUKg-G#^1bL%e}n=R{`E#Y;3wRh%k`rI@iKYWzOIUveeX5ra#P5j88 zIaJKffVDGfE^atWd`SK!R?Ah|jFrHS)%G4C?$!;+aIFRJBiIKfj@k-@2^hJZI(F>D zrX4jPUzE~w16B#5gGNC^s@|&>?FyG1vR7`&95&of4e0U2P*K@NNLL?%#ON8Bh5_Me z6k@@r&%r<1=sawrbK@@C`LR(8_bFz{B<^KBKC@9aC0~>3hIA{(4D0V@6~S@ZUXz$x zwidT!=Oq2B@iRY0^41N;yh}G-`4oe%`tXCrNrO5I#(a8vAjj?HUex6iIJe>b%ZE+v zWE)V!k)Kc0?*CZgTM5A|&R)>&{1qI8FH9!MDVhFz_kAv9sk_JG*I|4QnLEtaiBwLm z$}G11LXH>l($C3!^*#1w9E#6Dz%pQAtY&KL?p!Tut!z6jOl%*Nm5XPOEfol6EE$m( zFzwCqinrRNA$6|`SZ1JlD}+)1Ma+_vQm1i?#whlcWqkaIYLyno!XwC8q(J)CsC0YGw6PU8txP)kOYBtS#!7SL4b{>$WslTq zw;<;S>@UX7zShSh zv>(#mtJ#@c(Z|i*j8Xm*c11bl`{Zpq&lRJtkaG_T*SJT8G=HI*=G<)I-PSF0mxUkS zSsFJV3$(Fj9;vMCzn;G?fai{xp3_a!jb(Y*otlwK99nzPS|8>*B7Y#}Ww{nsn^lsi zy4U{s?#H#2grd0zpip=Q`Dv5fY*D*Wq2P=d81)}bY)RA;r%UN?9&2xX_w2`OZ<{s` zfm9cVdEs-~m7mRX^8@ykEp}S?rEW3obM~n8I_Ku^g)ea_$K-mFKDFf?VWw-PlwQq% zwHD4va)ggEKNe6FR(yWM6lGKwP{xS}aF%Qjxke{f+kiNje#k<~d|~xa(gB@WovMsf#kl#SBw_@!|UByx&bgi+Tghd;_t zW2TNH_2(=0DNgrMn!ptTIqi~Qi_H?OuTk-n2iL}P{FH-Jxv}2|EAwoOKqK zV0}fkw_1pOeU7x7QG@H{v(*{Lnh5z2oze@D?-llbVm>T*#Oe0e^yJ=~u-6b99FXDYvXUXg z`Yog7^bsNt(zgqq_I<-&yz8?V3U$k8Gy5u&(dr&TCBQ(oC@>aj!(Z+;iMp9&QZo@c z%LeQJ8o*a~I>c0WC3E#^sDX+=IQ631#_Y9TDwB_z`;vWH#m>ydPxkj~2?>53q6X(3 zw;JzTd5RD6yg~eUZ@$MX&ukbe(lRcG8)7TKd*)Ue9iwtq05rZ~tkXR|C- zp!rLB?+NYwxlg0Vx(yB=^ahk_GVUDH_}?G;V%Pkpe%e&}BSV1=TgNZ~9{1LO4gLpn znw|9^Lhd@>))kllTkl>JlW5i`*A^Kkd)ru+T1&<@k6uqo`CC&8y`e4V>FN2Z8qQY2 zZURLLwFI{-wH5P=5Mkkajm556 zMCxRZ<8Ue!re{6D6s8G0(20(_2Y1&s9RDnCy0?^yI3qHQ@_u?H|87HE*752IVM+d8 z;$kg#(&Q^~cW9A&{rB1MCcS`gqfdEI1>Vwyc5;=f<43yVzH>?Eb)(zGJC6f@eVa4y9q-cf&x8oK_sO*J<>K&xP<~y= zL_nQ|MN;(v*mMI@rIS|8o=ubAK8=qb|B4E%%t%;2b$%>(P|M!|J6c>Ue7S@zAclP6 zyx1?iC13qjT_}sMPvza$vKo>KAvIS`6CFOC2`lH!!)UOw0#{uLjkR66l{i zdJ?oI#5d~75UR)!$#@>0P54&HrOGu zp8zuM25COxiEP_P$_r1}-yP^^88ylxPa>@@HO3E=Q)aLnt8-Nch_y>?O|V}*wd_m+7D^{*|~;h_7BLKr1Cy* zeQo5@N;9!U$Wdu&Y`5&{3sK~Q!<)@2!Czt#pNf&v5EM45u+m}O;LSo9J@f5dz9CD$ zMqkBl%7W-Ra#fD1vhTF7Ca+zix0RQY)SR<9LO?&&KZIm6kr5EFyIy2jZmuJh*q_hO z+c+5<9O9mE-&4ib7W}MX86v>|s~$=if@@5M5O03q#jMTk`&f0gE(EKNZSL$pZrs?! zNwur@kteYef!B<6khyI$7g59;=5DSqakL~gusr+u#u+#0P44HNM1t!?HcihAZ3-W@ z`P3?pR$3WS6v8h3ONWm;U(03V;ja6?>|`uixh!V%7Z_J(&NZmR&Aqqyj!R9E7*$S+ zZ@@ZbK}iMKGuc-6M{d!c+Fxkv+&aZer9;I9V{$;_dw$?>yD%w=v*J^$7icsrDY6YA z#MaaYzD>Wc(xbCOQO$J2bMZgU6h#W~5wRm3OL5yb>dsWP>T?D?#B=omk*)2g0bb!> zL+~3Dpu|haI0~i4maj44h~5{3Z}G{Amx!Vm#^oVhG%8iX8D`4?E?t$f-_oQxx{Csi zPPYwuxoedrKlq4|7tv58VzEw}5u^n(WfTxk3}M!>%xr{$LVHK$WvfCoc15;B@fqO` zcII`d>O3B0llr#KHzs0@#31J}!{tksi5IgHMN9 z{=_g_gDOkU#5+u^TvB1&Heh1NCOUP!On#ebcTdf)l@eG5aW{s_autgp+4F*;?(4SN zbNwdedAQ@z7Z=6C}kqzd=OqEoAL zqCKPCmwmfR;PY&7NPL~IeSfN@!DkDvmmwHyt+FJs_tH@JBnBZpW0rh1W#V2fpjqM^ zbnGZtpgdZGd%vZYOQ!jzDwddQzq*h z7jXW)lZS=!ZvnyOqjGwGK-&EmXZr^UBtH@QbPh_r~p?{|tu zwpouYJszC6@OFQFKFy3_G(>@aTqH+ns$|j1bVJbehGamLlB&8@4n<_cWFHDR4hxTS zI()<_U#|bDaHSnZ)7xEd(uW}2yxk4sNpOblIF~*U_Vk_!vZS&!=V)P$o=F;D5nZKt z7R>)$6Jq`_Q%|hz9q&7Z7guU$A($aj70KzL__eSOmEZ5f9Sq9Uj$$YF+YY2)7#!{; zjn==t#`*@H?nR3bE+?xn(ULxd%&csQ&Rk_ls%o`0epJjz6dU9H5dyF00lTcz& zbygJUC;s4Ls#N_ue@tO)B?O-vr5qeYkKbgG!c-WdPap1mhnE&4x~Y#!UGY3m zi+Xg@+7i;xRPN(5*pwi_7--{4DeIAU>bLkqpnzH_LV{2v6q}Ge+?~hb=qTF`JHM?SA?f8UNq> z&m}x!e)Qa2{{kFREddT(W!iC_jg2iHjA51o#GC@aKM^+Boq_)OZLQ@pCaK;p&VcWM z#p>6$A7Go~6+DxZlK{k~K-12^z&wNNgm*aW>+2h*_Sd}rqG!c%t=x;;mw;~nHAr-$ zFb^#ys&f0Gj)q&=#sOD4{dH%RD*&;#9;gy#RdCsP z#4D)hid*r3YwWd6v81q<;O%r*Z_ef*dNMM@e8lEol|7^TjdfhX;XCrHqds zKXw5_hk5`r^j6L9}mw0Sc#|hD%S&*4;QY(9B^Fz za3)PZX-C%jks;TcuK5SW{;TWKcUn*!M1 zlC=N&9GchByau=d+Ar@a*nLV(tjXrX(Tq$`LfrGJB7tBiDicMMaiNJ~pTM*^ zk9l?jB%1urnh+mPye~XQnACyA3g0;c>i4v&*PYuC)Gpw0u>odh0^o>A-F*B#E?k05 zCwBfH(0wzIw%7t~!L_*@PJHiK#8Pe6)y1yAU(3FoDTFr$G)z9IWO3sp1^r=el6qj( zZK7pAXvQUIx^U~zQfvVhr2Wv4liL4$;VK+Wg$0e`j5fUuU_s3UhVLby)$u{t5(^#~ zXa}!%0V}wD$7n^)H73?3bRTDLu|s24`m2j-4Y)~55ix}pujpY|GT9^OfnnU%>{d^o zG5&YGh#7)cAVEol=oFC%kUS`aO7JCAf&rs@R$)WJfF6zDwt?>7>qN+4J# zkxi!8|AZtEj~Ot9-IQu6oR?MqEp;{k=I4jQ{zCf!kYNy!)9(nP82&qEK4@JgGMN2+ z2E+(&Kmhldfkpj?{U?xQCn!aRL;ro6D2VqzoXxrZYfH$1-lYH=1I0hy@K3NkeCUor z{CoTVSozT+1WlOiOE$&)??N*&#MLsT7Y?n93?Akt zs$Vv}`t4E=WLPV}r7snPMtx=R3pagz+6PwAK<&~wC3yxYg`pBu9>AG9X&J3~0^ZWc zC&8!q6r6Ej0-rhsw}EveP2?#UNPO4_5#$C#)B=Oh>xBos!T@P;4wV_N{4cU-;%pHy zr7Oq+bry%NuCAXN>;rJHet*&RZUYGZ?*VrU#5|y2Cjv3;AS##`7Mfb|^oLMe-vTfO zFypZr9N?y52!f*(io1EB;mHRq>gz%K5vuK=iWU*#`JhU5hnrq{_UScxl+6I=@+V9* zjGgv>Pq`GtCOQEqrAljnOnaAuQ=KJ-n*V^DbJ*u-!%|oE6}Jx+o^yK$Zk5-*nXAfE zUdPEQX;n(Fk2o5)Eu8>iem`HR)+QO-@ZI@WhcRfjw81w^Hijq)t^~l{#LdkK#?a%= z`WHutl(M^6Cjpo7Gr=nx(Cu_mUi zJ+N`Ix^Ilei}{}Z(wz_kvw}+P#p7xIg{Af2_a0BT}oO7dZRJW!L53RxEpC`U2 z^Cg<<0VlpY7?pgRv+M6^2C+bnzWz8$qY3yv)GFhy;7C(%CT3;v0LEx#`23^(UqFQ> zXg@W2b%Rc9W>B#}@t2tM*_nhlU@_jqa>4LbcCGN=iwM2}+bU@HrncA@--i zfPv|5#dZ_$Hk1pEpabVW{mB39y=oA?pU0^+yA_h~A;9V4fptVP!TB29ewf*&bN32r z*Y_%PlnJyg6v4I`ZWSYu6NKTBTFhzMs;VY+dmxyr-@o&3$I4g8exe{SmI1&0-@4g~ zgbaI7?nc5NS^XEnaGrt?c7rR0>AwX{1OnpIRx`E#`||%iEg-)Cf8GvNK$}RL`zQ*X zwf=eJE6{gn$RqCe{bm1v|IAko*jXCYtz`V~9U(w@LxV?&|2Mmjlh^>aoW}Fcgnzqw zB-n#l4LG0umx~sWf;~8cT=BmnNU(xEILE2-{=efXgB#dgn^XS3x95O8_;q_{`@di# z1QLM%*MnDS@bvyUw(1$K$jPJ))#1JZ8|NzNbK9#SW&4o&Nh+7c))W_ytJNYcoTOYP znt(PX^y?IaWILfzSQwy3p-8f!`nH7jq1RJ(yd|0R?{1a;`yu;) z7uEH= zs{}S(hXH#0z43vwG`)AY4jCWh*-7a(?9YrD7AS$49hZpmF86ASmyvubJE4q7Oq)4y zO4_9JHG>u=$M;KD;Zr<{d!M0omL1y;Phqu={&mU}<=k8rih5aBn~Pgo$_t8d0S zqiZNz47f@JDD>wRMQNmwvVuiSCyu_#ds~*jwRhtj2)>VErB5EWYe5g*H-x5^aU_W9 zeeZ!{>C26r3ZJa7%aXG{^5geUj3M@qRP1Hu;m&DPwuzmri*U2cWPx*vzpYjiyK+u^ zSd_}t5mpS?ZbJfq#68x1PZ+h=ordb<2 z;(5IRoP56Ua3=2_&Af8m5SlDp(@`QS??Hv+wTi__5Zt}5$dj<0zS7(5v#89dnolr> zDSQ=|vU>1odo1hwbFJ_=gw1~QUZ+j{NtvaOY5Bd6$M#l~sC46r9TKi#{Hrl@iZ7$k z^leP5cYOsrz6UTCcFD(0#t$ZoBcYhmt{Lo0FQV$clo(g=ck(YG zYulDC1(J>(rgmtGqZ4{|{VLOwidnFDl&wpTc7z(6AhcgZr%=h0Q{zL$M6Q~qa~?Lr zE%L0b4^H`0=Zm1?j?&GaN)>1mD_b&$=6D{!4AZBl=hF=VBy3PB0+ZBHdkM11RsjaECK60_{?$OI22 z{?Y?Pt=KQq;P>vTllls92cN?T`-@t=Vra0t7%LI$b6DGEEm_})&X(=~RCFg%Yq-MI zxBh%jyY|go@t%sGQ|+t#ZNf?0GrxfpKNi9dRA~e@Sn2L%9^o~UdA2}Jk`(B~nl3c1^(&x()^BxkA;>%SzA8pS_?EKnQ z;WI3=i!VE9JDE0|M@jHsa0!-r~H@kzezaTV-I;D_4Or@(&hzxy!F zGja5@omvw`JGO%FtU$5z`9f%v=c9>Q7gQH|FMM;ws&|P$^vhfkRBfuo&njoDKmo6O zpG9+0{?_pGz$@n{{D8T2+${VRq(OR$}{cnkTmqzaUMnwlM0! z95u(m0z;=gw=#TI-mnNEZB^JQxco8eD_`i@F9O6IQPahOH!WBy{H%k6s}B6*MKljk zW-Oai%qW9OZSQ=&Bd7Q$8xG5&#^e)St?#xC9qqIVkiHkA2!v+x9WtSy_wbzzxopU? zyf}ivQ7!ctLh!y_y<=25-BRMD3gNAT-Tff`Tv3$L^ZndF>HM%gwf}b-#WDr<<#q^^ zw0XpB_#mK*q?PH45@DC9bO)4`e20Y=9Er@+41pQ%TLWJ{jB9CWG!WBFoz4+u7{8kN zHkVneOl@t_Z>(&)R?#miVCo&RveDah*43adQg?^*ErYNB^KVSF6&V?#zEcTYR)MwO z09OA;gEi_iSKLT(kzN~>a7QfIz4YT7IEe>lQ)n=Qb)*! zva7txYbr)lx-9-jD>R0?6}Smr4Z5U0U&O%Hy>%ZGZbww;Qg@we(QLc)7LtZ|3lhjd zN-6!xnAE{M$<@2agA9)>P@U&hrHsiBGHca1SL`eoi3h)7$=zoUP>O*&SQt-nR&iy< zJ~U*#(;O(vX;;FRTo_^s)|*1MQI?;4dViy*f8ag`X*3ZIIhhpmvKR{gdTkOebMt6>m$W@R?cJ1knEh(JbkY#lrZzX-#`09>eszNz?s7MpMLo@=LazPt^Cde5zzXqeb`7P@7zHjT3pAE*j zH_Z(9Q5qgP_}2B(1-V;l4PC#|%{>w&eT2VEag}WqDW5c5RI?|jyB5s3dxRm?>LZS| zG!Cdy{Ym2Qk&O>^@ZCxpOiU|%bISY0?V=hkv$>u3cZyz9=gvG z!lKb~I*vK5e7r^;bFHhXg~w=mb|BHegg^2c@;;{YY>s#NZ0`4>524ey>xg5#{NiU< z6YUIAZ%3{#-EN{S=FGgdS!G@QLGJa<;%GaiAH-+q{K*`rH8KQ2wwXeT{7qzl)mOrR zX^CZvbD}7N&tPHtyRCgnjqm$_u2w_Ib)ggy%hesym^muc-Tghn=LIrrEN28yNl^3* zpER11q20tP$C$frWSFsot3f2y42efPX@rUw&Bh){ika`9pUK=A2om2A+RfDp4Ptro zSpFgR_Z&j4?QO5CuFP^_Hvf?XB`R|Kgw}G|Yvnyc(^-S;z>QWrJ!Lg ztduYhMyJWqEko$+>^cb;Gmb` zw!xr<@;dJeFFMa{RhGNPedtP;USeD2?Xi0wrEWYDW{kwv*a~^dK5ofA=^~f*m)s1$ zhr8gByO3Dn@x8gk$M{p|$70-S-@nH)Ou3f4#r<;qu@k6RU=Vg{F4_{M58LOEVNsq! z3(rgQL1J()O@=^?!ES^+IAAYfnmBqxhxPQS^ILdz=Qtj|uutAnO_Rc8gm01nzJ4&Lar3KjXlr~o<2Rr6zK}m1O!B+NejIwh#&%r(tGc{gpPnxr9+S|U8IB_dJ&Kk=@5GF zHS`cd;KuX5=Nymcf4|&M_qq4wd6L=8n#}B3Yp?#B345jdoaiRaO)M-dA_aL_RV*yL z`&d{v@CdG9_Vgc3*J3ug^{8MFQQ7lZly{LO#1xSz5Ado*U>XPiHe#=HL+_s{W- zpJ%|T76D$l@DhBB9Pv}#vyxcl&AXpxk&dZ7)cikzVZEw z5E_mZ5c;J|mHi)A_<6yz8>FH8Z;Yt_MUZ{=PFnV@X5sCBP5A{Pj8~)E5!Cb}<2k-vHTg~8q5nhuql9Js~fAnw8NMUZ$?-8fWKe&ZqUceUu($LVG z9EtaTJq5E@%{a>dc z<2_>Yw-xmCSakM~ZUnMB?~$L=OsS`sSq&o;2w&tiTCdy3yt^4F`H?z?dzO!eM^VkK zR@gPV#5qfk7e_%e;_t}adZ?|OZ0RC8&KoHEZNzi=k(*jA`KdX}>bLfK03MV2nnur2rd^b2<)@O$alHG)3<*qK(L1-X)Kts$E|2HV z-@ zh4X6H0B5|l9f^S2x!We=yjXEW<%^Q2PLGAzlRo>Ax4zy>4NVV7o%TL)^JN1U$_Q}1 z5Zh0+%8a%%%BG4Cyj2#@MHIbtc5Jl@BImTA(ABYI{3)yl56dh4`bzv)Vs25-f;X{Z z4e0X{tNCo6)ioZN1^6`73_JW&SzGlV?62f1@tGUeyN)fMHwm^HO3-Jd(=-Ev`Xrs& z!z4O`%{7q&Kc21!R2(ryU0HxX3FcU=pYkX?_P_3`j}ATeB4ZZxX_7SnL3!wsiOKi zs}>;J!~-0Q*!|loY~gcWEf~zr54IXf(4PZ_g3edaVnX6&1`TGZ;$k8`gV|Zb!XA|x zc=sRN0>e|5*4>VqljBBfB+r)-5>Rcq&n3ifX@mr1F1@t;sb?+LGZ!E~UcZMq_qXY- zi0)RH`aj=niV5xXs`v4KIW8-HQY&Gx2d!-qpu790T_#1~jDQk)bLlB4HB~}rm3J1s ze@t2_9Ojs8F}#@CxeGEewoxj9*B{h8-U~6;%w0KK45(uQB)wIH{5WSjN-o?rEnbWM z)EJt~>VCTBbvn{lQSPDBZcZ;&P04uERuSGjG|j7ym%^;?i={C^K3^@Z z_L_1J69wHUx~cj=5`bbj8h44SXLtI=`Y21!3zfJa*B1;z@uk3Y4uP;Oh)pkb{^GN+ zAr#ER;CpD?>|a*;2FL!!6`&Ve^nF8o4eN^eN2+7Q=P+Pj{Y{ z(@}UUhM}Z8E=5VKfp(+~W=#*aQPMoEtjjbQfj_<`;HZUviYon}&s2Rp#z zJCD8&bBm{M$!(Ag;p7|6Lw8i6X9lbHrCm00=cl^HmzRh7%eA~3ewp{^XCaN>UopOh zL+{2_+WcwEKC9jI$!+J)=P87L$VeVmE}e^|<$lH>uP>Cvt1=Tb1^6;i!=_!t)kTMf zq3r33uo((HZ#0_KU%L;oFD2imHj=qsJV9}O(9Y*(9>O)J#_T8ckWGttwBQG7CBJ)N zCMqsvMxD~(OTvfkn%=;Z#C}pdLQ>n4x>`Gyii_JJmgshY+6? zAHVrD0Ihju1qf}Uh{5FyAD`_55=MpBuFzix%Wq7)9=zVb(?8Zo;NI6{cGXRfc+*f;H$5Q4(Xd! z7994iB5No&(Sy3>Gh8*kSN1*qY2SV8Sroyx4Qp-{dBt)y2^vsH(WBM)51m{9X2ob_ z`jx=)lQ&d#T@by3yy{$u#i%+HRh@O=>#p#JxF_>CVsp3Y^Gy+vD8%B0@w(6gY!fjx zjL4gp{3Wu9(ZnIKUh1{*LX2O59N3maEPAiIM63)x*^JAvd&F^-s>8{D{A6`beMyv* zSGfT2a(8gTqvGJGQUfN`DmniBKtwdJKqqSaJxECqFnbbcFd+F@$B$2vjfLu4+f-|f z6h|i4qeQ6-VESz}f%&tWr7b}ZsOq%hBj|+gKOT5yVYQB@8a13u!r5(vq|v{)Zx9YN zVrWBs{JuU(!-;(AolQq0@NyXy;%>!9>a?=(k{T>yVSAGX_<|aK;5NFQT2e<6Y`uOn z6@N**DWAvxH6wV#HOsF_rhkxHoLjUp6&~}kd5RR$vT&HF?6L`Ts5&mkhYO`-LIqMw z`^an+WM@@}JDOaI*R(c^m!UI+ASNv?qIB=o8Ty_ZKSE zJ0ptBT33BlOoF(qlgLQDd?c6tIO9?dgPp6;e4d6P%muv0Q=Y6pV~iMVa@ckddbwcw z`5OJ6IP(CanYwfYe>yXf;p6TjlI<%Bf~1IiR=6T!;@3#q(8a1+T*RvKLGcf_$A0eC zDt1z1SHLET8E;#mD_T+YZ;>Szn)FX7P}K{8kRQX>R%>=oOsFL1VxNto{R|PN?{7s3y$B2D`3^q~6+&>eCV9t2$Xk=%Y~>$wtl*^HSQ(M|^H!`f=CqDxNI5uX3d ziS}W$>-Nf>Ut)L)kM-@RyUz@+=AnAk7Io9a9%txC)p|j{>1ZXrrdlFd*KvCkY-~;^ z-)CHy|NFN{9W$j@*&P&thYB7LB0v8OfUC+~>Iua*y@IL=b&wT#mt96{5RptR`Z#0n z5n0paPQpFoX=EaiD4mf~8(_V#2Gu0tc{!Igxz|qKyqDfiHg*THzx}f<+XA@`W@XBlZPkh| zwXRU+-`NDYPV411GL{6#rGrbeK`o!t-j)Gw_tZ&Dz$DO}6(Q+S^&R@Qk9>|B) z@iL;Np0GHM7-hx{)uOkbQ#$k*lu7kmYU*@cwp*<405pocBa|WhFcmO^q)x>qs zFZlRn?0{>jPRn5(w?PSZQuZNDvT%X?5q5&*GIyEA2Wnk!-O@C^ujSW23X%?t84mfv zO9{W6E_EddXWHprO+$!pob}Tzk!(}!%PT4}=;Wei(@##vP+P@86{{1UFYZ;rwa!oyw`moD zhxK{ck|yO`4n3&hSrYIsnOQ9k40b~4y&&;&+UN+T=0yb;gf9a~dG&G0=J^*dD$|gfvjeBrD(7%aiqa~%bEA~?d*f;*$72Ad^BnI7Dfp#Gq`Q@TGHz&7D?A@ zuYpajMO$MnlG=T8AIW%ZznM<27vUjZGr9se{7k%lK-q_U=w?%uaVu$tX2LByjAE-QYwx625z;`ed%63K^m5snaq~s=4a+m zevgPU=9WhP$l_C2ULV(~*wrkpjah%n;35-;KfXel_c!y8bxU99>Qn|I z0{_mwrK|8c!IQ`*66?EJNF~v#tFJ9Q^Q$3VLy~*>ThSL}{%@+Q_JQq3s)7xEhRm+R zjf3`VP{OaK$o#MGniv?`_CHphggHARQvtfR4+vX~B{(zED|&=Hv**t}wRTrYmHIch z0NWiSZvfs@_>B;xp+PE{@JA-Y55mZ@=EnjgPt0GKa%u4K>5;jshf+MEBxIb;m=d%Box<*NwGwf+8e39m0&4cbZt4^Gb4sVhKhX?5pOx zrpvWjzvVyK&6BWn7GSq7R-E5i3BHHBSKbJgak6!f265g|J86k7aurogZSK}Fx6TNY zYOJp5d1rK0N}pC3jRQHlf^;@0@3)ZDSv#~pefW#M$i8VMFDB_L%IxWzD!Iyt1vmB3 zTBKHHoHdD8et&kPsa>&GODL<^{LV=Rm-g<6KzWv!j@*8a$~kwL4TQCaw#8wgj2I4p zy(8e}cYD+>-@8Plbe&^HbVfw)r#?mIuJx)bMOh))m+DM6_unn3Hb+D%d4HSd%4yOh zA%}Lx76ybYWVa(tRF{www>s|UfFK>_cRkm-a819J?ISKSuzo;^(RzJ@i*LEKzPb@a zpD0(jR8y-onw1iloR4kWr0#-1>qpVY+Pkaq=_#Wt23CW|nQJXVmqBpBWr;s?rgzdl zgs$T?!+Fog)(wls4m$jYGFkw|6TzoC!~Pr~9k^VdRV^fOP~Gg~z(QzSvav~76RXEp zWjN4A(4sBdO~;I3VCQz1jbGS!%hZxy$)c}vK`Rr(>4#L|3ZuNo4mAnSPF=@&NMqq6 z@vRO*A2RSf{N}s7l8ML&xLHM^@-ChE>Js|2F%qubO3HHA*R7gQJS>}KuL@nn=~MCD z`n@fkurP~wBX=alT|tFBwdN=nUD*+AQ_HFq51w<^R^xJ2AanWu1WQ z-GRNG7F} zMytX;6uW!iEyEw;ly_}kkshih=qv*C!!c3vbU|#kB+%<%hzi!@TIFr6 zr%(Pa?=WWI^NH5P+eAC~Y@B^sd%tf}dASbds<3_I%X7nqP}fBl;UQV_&LpDf9$A;w zxbJrG9JyIzf8{wu<*7w|_jo~XTPF|v$-e06B;Ve1)#9RB$OO9^jCVul{$2N2N&(JJ z9hKsFAZ(KNbaRMz;c;=Bh_{+0_q+CMX5E4mIQ|4Rd&jJKd``;cJ~?k#uU&WNW=LYD z`nXH}s%7UBE0g7-z3<0$lj&rN%7s3sCnGc3hrJ-qNl`kM+A6CYD!wnaH_!DZCFWU6 zd^_4R0>9dvET=nQs2Uwjm=Tl{cGX)R2%0Le(a!yr7nzROcW4wWjeG#iVu z?G$UE-~L*P(fX z%n=U5b7jJp7qVAFe#bfAIlr~J6(8Kdc=zmQV)uL6wvVX)4&wtP*dNyezova@FDrR# zMY0?sMQ}A=Q_~Nz;aCZB2w#1V-hPg!E5)SYcYMrOXuCMqQv(KZ##R^WI7b_8O+lWA z9}gu{G_LMWeh{TJuLQoHKm@sn_BKgvQ0$`*m_;FsZ?oA{*5qALOF=Di0UoQWcmB7h$>@p1^TTZ-AOUPGjnamy&-GZpt|Xa$V7 z_(^e%$b6Sr^N<7}?lSxC7KTX$DH?t9p|2L5eh<+kNtb`2Y`!7k;K>;XJhylNIx2OLE=pZcfzx?Y-LItbdo zbPy)uaR3q*L~N&)9+qb_qdt?b$j|4&ZC%F@6+o|1&`4)69}qsH&n;4sDt_rSg8gwp z^z?YWwug+@NY+yMdc;n`MwMsmMW417cbke>7qN2u@#n?cpbZo6S2;UheE9{j^(~is zy?Jl-R>aAv0+7e`!cT(k_uWa&$n#gWT&}3w%|+csszrwQH^X-eGV-{nt&G+0@sopk)na{9(k`h&HX}$ zSB`_H>p}u1O)Al$BX0f6Anqd=;2NNqt)JntLA^NXJ!Hn~#XuSIzB&r;zVbd2(xo%s z-#9;pa<({atN%M1D0zc%#SLL%qf_@*ngRUBS>X9(Dyvkam6GBDsFJwX**w)ns%zQC z(1us;`Gh{R6y>dbN}H8_gZYV#eLt!_bS^R=(pa$y`0`Z~?A50l;l~9}eB)XMr9**I zn4;YKyXC$no{8c8SuFj_~Ev8+H?u=hv-dI@cT{t87Q) z4vYA4ax~mYE)Gz>xnLEOY3^@zQ+XFvxE1$jpS^`u?i8a=UXl^s)b%rsa`$FnO!~M@ z!>50Kq`9&U8+L;CA(Cr+`bdbi?n!$io=JX`f- z_k4yZrsPoF;oabGtDcOD%J1QEy9pH=*q~P3JycSwc=%(Vfp7;uiNQ+p1GiPycn8h? zcodwwi}>hD0&mo0klCgN9K=& zMCsafFl?SP+e3v&YBI#79X{ASFnN;=&?rs{UCp|i-xBX=rm+WgbStO(%cx;`JQM!g zIwY=$tm6g)n^#6`A;LP_+eT=(E(Fmcaa;WP^rr*ur#ei$!m2Gs)C@?xJ1JsS)l(8a z0q(Q+QpP9b@4`4bH^a)lkC5toiL6dmgsvp)4_Wib&i?SAAmmmxg{Y{@u5>t8+hTEKzuUJuqO**369<0!{^WiF= z@@thuIU6PGe%-CNc8Mx&RC1E+=4i@DP>YhT3R3AetDZ{gynVDuqgkGHcQWPSF(93~ ztrsIEL?iH2kgKkw(XTxwrcX6~THvDn_F*3PL+})Li<5 zFdX~vpwU<>Yvjv=ZHLd`HO0GG<6Oc95%ZEkNxt=Evi(}|^o~k9z>~^1-o14puCaON z4LU_FGO2m_4VRR*4E8)A;0dClsIznve$}9y(b(9+&)r|brrS(_0xr!P-0pt%+|^CP zEv{_N)tMyub6aR#5p>KXHNl!nC{-}G2)$Xxo~m8D9;L73qVWMmN1!Hb!Yu-ydB^W??hQ;H z0g`aCokQ>b@NT%?gfL~9o@(-(pWg1IwI!UhufEK%%~)LUhT@pP3`sOH2B{zIWJC*) zA|^s;R}kxn8w3QJvuKyN^cF|dy zF?asR)gx^F+}nAQMrj{0h@xEyiROuXNMO`;T5|f*Qvnx0HlbwNdKKYN9B(B``|ZbS zfZk5()Lg!Tul)_$n*%c|%SR&bJD=Ebn}aAsKSMV22?1a#j5&X_R<<5p8OsB+8>lX}& zv<-#j8PDE<|0i%?U{Z`%N3MaGEhn;-jVcyP9I*43T1V zkw|Sz_BU0;!ZyHYPctXyzX$=AKaps`kKFz>=XV&jA~2w&{1-u5;3pDICQMvjD`50SpLQR|B2=Q2ihX7D)4A_ zOf-aqfm={ekSLXe7VuKv_e9NVBwwk$!qGwBAMIAR93@86e7RKwW)T#uUgUT9-7iZs zp5i#&3DvB1G{R`Iq!enW(s|M>NsvQLRrP*Nv(DDm)(qs|7EwBlpaVVlaoWB?>E_Lw zOYbAv{~cM(l7*tAW&Qk`H6I85()atX?s~UK&s@8&s;WxkdUc6tfhMrOp^-fLJ0bgN z0_9l(xXc9k9F+2GxeJwZN9J~2O2(K_Yc-Z=*lcOUO>JeyQfFBYmF?4Mha~U4x-KnK zxcOR}o%~pF8jU{-zPIuVR=O^(&#G>-&2>86| ztjl_TVzte<==Q|9UW2>aoW|R?-9M7~&8DiXRMpg0N6qGe@HvTGNvI94@3|}T;%LAO zb-K&vv2RE%Xr1u!F7JKQSx3Sh@n+PXSTeswln-hb5|^IN1zK@g>5d&PP|0*m{iT?I zxwq5%0qle?Ru@Txx>=vQ#z#bdaq#YdF0LoRy2UCZR%#cMSWezdpxA*+cjOvhUskr3! z^|YC;!wSay-Yjfv5%?sSaxX&~ZT-^PHWDg3jn0bq#t9cdGmXYUxvqBna<$u8qxK8xC|sNEg6d({or4%ThBPc;AiUxwq7z(>3d`~op8DP2+cSKrMXX8DP?r=4~Q=x zN0l)Wi@I(wGWZ_HzDyA)G@3=sd8JPaZXmLeT9s74m^40 z!IC3@b#O6;%dDF^MoJnsE&U#!zIeuKyQH7=8Z^kTljaoMbefXp(l64#o{r9J_C@t# z#LXE(@BZm{V~E-C=wP`Ex>=CPEfYeVSfaBXpRB18yoN(&&l)Xx{zccNPjK(~`UzFb z*#}J(Vu&VbwnT%Q0TU?s(&88sJbtVGQHRppGS3GN-X+I{S*oG@O z)@|LU-FJ`U-cM_E)@Uni4yxamij$A_7>7k*7;_R@X555-c|P89O`zLO^V|Cy6fDfl zCQ1G0n8iulkdFT-N@VR*@XT#ON=|}?Qba^fl;|TC0;72yl@BO*i@_rf4qA1{1;rfW zd(;PfuEv1SI~?k@27-;+_TfsY070Lcg%BZvML(k_M6`iR_gaV)m`E45eifkf2#%SK zjoI*pG4i;9T&vnF)s`I`TeadotP#(f;cr<($IHT>8)(p6BR5_W=iM^?yxuJM!6ZcP zFj0jk{zsGo24?J=zPpaesn_#uK_WI=3>|aG!$($-oP$}erluKGP%GZ?Zq;iYRV|Kz zZNQOhYF=s)i(p;Jt&J2;sk_r^#56IK&bl?N=UR~BV%@Zsd{~g9>*}E~*#f>A zBoTvX6i^9|_lk3R@UjR!Q=V$6{79=kZ$647x&O$07VPg==c-`CgU}_J_<{aeH2N zJ3dmMbT}P+tDmWF0TL;1zfRioGSHr7i{9cy*Rx({=)H%cLqCRbXY|(CP1Dp=$u$ek z%^J58ak9x&g#&BCxO8elPo7$qY8uP87`Oca7P+ILyNI6HpYyV;t#p`p+9Lg)sN7Kz zVn3UfLBD4Kx0$Z7!)?~7b<9H8%>B}Td?!tT1MYhm)8bS1MBRqexFv(#IUHa;Qr#wH zK)cxD<6Cl}LhIRP<~sz?%8QgtCmn!jE)O;v=uAw&Fgtc_iG)pEZP#r_IK;HBxhpzd zp1a<#d#L@iJGClHTmhFwYg55F8z6VxDrgvo8e&7*4zDeC@?US!5L-8i9F9#HG5S`f z9G5n#{`2_=4av%v=GFCtt%BS36CiYvMB};T*Io zGdK_SJn>qlUQ((%JX14Vx*W51+O6bRQ6l=}I(m<)U@sF>*jG-(xAxmsqt1kAJa^?r>y zgx>#&)iQEQ^o_v7{Yw9mgh`s)Wrp7hrzRL?#gu+rF%w~NX===G&*{up(zw>4#>SLM zjjK{J#49RU3TKP>A>CsG+)3XKTYX1u!SfI;-$T8^3vGDkGn&@N1x&MIFCfY%*m*5} zwXgTQf$1iE;yhz@{@1sBEA%5T`E4RJmE$x)gJl|=(fMJ%^T2su<2n+~$A+C5r_&UE z&~n30XYQSs#zQ|hxDQ~e$CHF zMa)Hm4Bj%}(LVuxE)KmT^X?C$SgKSJD1jzVopsdodX7Mj;;_mq?a zkSUTP3=oz48Rr+JBQotx>TusToCurtqp)b9p7M4++~C-Y?IWCI47~h1@sF4*pjY&} zUCFWUJHGJZ5jm8or*dY#MecjRRAzdk763FVEFnR>Gk^D;BVrd}eKO-_J`e+jSsJcy zweTeMvnxzh<|?)#{Jnrd#Y0%FCtd4+;)}eN zQvzhrsqALT&_oAXH>Ba>G_ty)uczTP!^VvXBSL=wyX&ZASKFOUq=wyPak9HP?2&kSoB?$9KRuo&SJ3xdP3#9v z3;wWFxN8@#;(hM$#@;IepXTC)kx|x!EjeJuWOF#rujoA|p+*w0b8i;6Va21Ra@i$9 zX?`+KaUpWa&jLK>)&$-4RZ~l(c?nx|^>eqJe&T|Np5onuzpkInCek`|pjX}>7&uyGTXuP>Y_a&g zuGq|5ybdpl2@lrIfx45DYfyRK7|~&x$X4~L>eVY)Q#)SBoVcgnMMKVa`N*ppF314P28gC6Wr%Q zt}3vlv%o$9F>BXq#1j+n$1c%V7&dWdcx|x*t3!i*1;*mDva)A=Mk*~-3f4os_dsIH zZPyt-)~Y+~MT80&Kl{Z-k-u#<2bJv|flx*{0IvuRYtvM29UV=2{@A^Ytm|#p7m16? z8gJM;xzHca49R@c+w<)kW5QK9ADwgN)XWj|So`o~ig9k1&j9y6k2U;*ehTB!)@QtE zb%=MGi=e_P!y#=D(Vibi%~)pqxL?reX<1x>TQG+nKTe3udmS(Bg4@3Ufn(W-%pj7+%p5*gk zEz&jre5KR}bMGVBGJPuIUB2{ z_I6nT0_>~xng6XV6)kaW4)(j^Di-?iA>|sl$G4e@ndq067UPH_L4LRO6vtG>ZQAX0 zx3yr$&R`r@nAZ{XtC`~DX^aupq}N=-8(RWslLOezJf?QJsxc;+vDlt=%eeEJ6k zp!+s0>`tK=Y{e5Y>r|&qWYq~aqIS>u%+uIKcANmn-X{s5zVN z8|-@)l}MnGJaE`zz4UC`&IuVS!q+i!7g1`B(tGpJc^-l4Ubq)Y((u8&>`i6$iSN~=_my2)~OVst8EeI z*I3XW4U@R)!><^#C}*ERH9#QH0}_ejSJIs=s989Uy+!TCx@@=$l zXwEMF1fCc`AeO`5FD#=hg+30BCnOdS@F`!8WGy_VgkmqQX=9S?TXa-OUgST(~nw1K0VOSHqcsE@}EN0rn zm-gF&hO_(2fwPm|R#m+d^q=nn2>HBMU#ULIX6h>CZ6LNofOQ)rl)f_9pu_@43{BD$ z4+(ibDV!LM^jnqj)wVZl`8;{=0ydj$=FSaZEf9R~AXRN4zjwny549&Rhuj;V;=2DW zZo00C|IQ}4l3^X-C6-D5qbnOSdn(Z22)X=}M44`72>JB#Wn_zYUbb2QPpR#vn*gLnY{&cUBoQZ3p}CsI z&mErj4oF?;Iy*b3wYFD}>vMF`xqRej?h3!dVcH$T6#JGs-i^~}-6UFq^08hazM2@_bJ#h&-xlsT4XBJYh`gvmiqr{tTCL(k>DB2crQSFH`(>1cg#UHf*|?8U80*>H5j1L!#B*<{Sa zEzSHA37dl;92IaJu~&Nkm`i0odYQq2T#AG|x`@cm;<&`s@Em?S&3 z{dh_5d)0_tx;)te@G z$9bEOV|5|GYFHn24jyFecz&d4IuqlXT)KRO4p-twHlM!qaFYwL9iC*AJ5fr^4&QZt z@`;@Wy+r`oc|=cRD06#mcZ!yZO-uwy!fhu4tIKxQRLFh19KRG2C#OO zL9~wGMQ0qB{peA7BW+urj(J>KE==7vKSW1)i%H7gE%JfdOtFOU3sVp9Tcxx~{hQTn z0ey@I)%{-%MwVSx6NXNvC)_Oxk-7Mte0BW3F zkgf3dr?ck$Uth45nT@yUM8P^@`33fm1Lia|(7tsp#l8*hgS)P^VGpR$azT6mMJRNf zmQBD&2KRkscRZk6knR*g8yc9ycxn2rd*TyT6Vn)Mw3mD%rX)zT-7%diLn86k zd?16XQIWdcY!LjY?799GJ6%L%H7`?HD_fXy1 z@O~|w_+!1&(cHkR!8t4je~q1sJS&G_5P__w%muRI?W5If*qlxdU*8Cm1gm_L3 zo9GWlOHPQI6M<{0FY)%2Rvafy<) zp3hvm{?;zFM;ahuDOT|un!{il(=$b}nmMvH&}W_~j9B14YXI}g4SK-N6~ zT}-p3(v*InJ{`Ho(<0iCL{}V;CM40d2J`-^9E&W!mc|*n%7t4M@-@VnYgP#24~`oKnlq+*2G z|5B%;Nml@VkFE#;`WZ93WaQqt8*_%T%9(!{F#gUCnFHe)P8J! zc(vvDSH0)HOY>?4!?t0n#Z9WkLJB0iT*h_WDIC>aq=4HwUmE2stZbK$H_8kZSUUG0 zf>ZJBULme9=@;Gp1SGtJY za=NA@x1c}~u{Vop+pwCi!@keDq*Ef$89vpF9m9EwH>7tITu(pzom2iC#gySt#@rQl zH2e`r#tSDil3*&Pl66-Ht(1}x(i^E<=oU-8Fk@Wjiiogug^4g1? z->?ykv3N5zkZH>3&blsfQnHA6^UU8)M!-l)ixF|Tlf|zOQvR`~SaLB~fcK3%X#&5P zt3Q5T{_|};w7}DUG&L|3>8BWwfP6Q!U*Xr{=g(>X?;`(W*FP2Qf2-?%dh(ks`u~zy z3H4;mwwpee`BGRI7K!EkOD^??>t%fMr(w3j80OfFjJ-6(`N?)Cei%L;>UV_MXF)>E z)aj`?^_dzE&VEQ_!-y!?9!dhKt)<1Tn8ckpH8mwsr}Miz`e}_d9YQfB=ogs3m;F*} zm?YbVP|kLy_H}P>FM)i=3c&Dp-%_I2ibD#c$o59;@e)4$j37yzAonoVEwuZ8kI+=dIr zH}SUM(f!x;{e8+XW=#0uR4QokFCX*+0|xB4Aa}(2`{4hKSfVigEWH+1t;3OL+&`{b z?b@Sk+xeBCiaQ{s57`g@?A0C&b2Co+M?-suETHy=?C9+~FHWYavHf8Su_-AMIAlG_ zUp2rWICrfqOme?KUfqHoPdiWgAcR4*CFq;boMqyAm%=Z&;CIrl_;J}fzAM$>hAZsJ zi*uc3S{5_6xQ~k{g`~><1m)#u3Wf00_EQP{e}e_zVNg2N8%XD^jCxAkB z&bZz@#XQGefpzdSHJf7QJX$|jiS~-$npH7r-ZkD;WLKa^{B%OySuRbk@kWC0WwNc; zo+tJG+46zAN*QRZz|OMZe`qjn96$tE988jR6sk6)k9(|gS=b%p^ z30LQ|aR6&m;|y_&$iL(l^9si)o;h3OryN{y!Ni8Q z3&s`J&JM8W>loB$Jwp=u3>bqL{4}Q!d#l{`9$cA{dH~6*#ENV7FFQ!+Bhs*sL zHuEI}>h*n`+PxO%YQp?;+{OzQm8N((BW(zY)ry7zoN!{*E{lPxnLH_e_X6FtXSzhSIE z&nN4Jd2)n(C^sPCc%o;wb>EHl7^@?*$>GVtQ9O zOsBv5C~PG#vE!aA?wKW>PkA9A&k)tCyO6xMh;cw(j_Jp_|BJo93X7{**Kpx@0)zw! z;lm*~1a}A;tZ{Fg;K74C9b5tgm&V;2cj*KI1P?Ba1a}(O2KL}vbItk9{MWw^_t82E zS77w$s!`*8pZBS%y9}Dry%S7G9ZRdrvt8#Cn2@b3dDUipr&SJ{Q}y*uxAX2X*Zvr} z^3C5Q%RE1+1Dm?%j8(YLbf%lk(x}#*6T`315?fMi6LQl9XUE@oj{lba-glcICI~+a zl+DdA)SSsH*sh(D@<44!#rT{rVxDL&jWOA^(Mzc2_fDvnIM3m1MvY30NIp+YpVVa{ z3Eo3gz*;Mpbv>2`Vmy0ZQg4TIm>ex+L@)KI=I$VnKL|JIy$^E{eCD$F0+Xk^59^pb z)=9L^>I+PMd!Nauoas*Q@4r_$9JgNAXX_pleRy&X`&fmq)N$SXAxo`nfvQK)fy#No zoBAxQkIH#$i8yN9{nZ*SG{kSi$XQKzeMY{ zuiN&bgY&EhdH4e?8=ZF23M4yn3nqr!z{pQ2GShKARhyjKKk)Z;V%)1TZ3B_70JDYin25LlP#_)&0r^|jTk0>rw}PCvZggb*MBU1*ztbg zsZO5lwJ0XV>kPkskXur3ZBJ-}sQpd`Q!CR!ma6LDUaEOtXWYKsPQM7gsrMuT5xkRb zO63(R#=xjO5Kt_}KyO!{u4t)i(M_;io+tc$z1P4+{!BR!^OAZdX{yO7&m^3XVs1!y zvZ#8addT#l=+2Fl7E`uQ2k0V(Zed>)~dDe&) zt(aPhmMz7XpeAng>PSHu#_|b~pKqu4hrqe#N1Ij1?Q#&2jkHIf8Ky_6`wnO`3L!so zMn=C|U7hQ;#Yvxb9dR@F_TkOBPR~dS-u%*Dxj%RQgwRC|_mU(iF;?-{6O_5i`GE=j z$Zjy|1lxw(hq2@qRl&VOqUS^n=L!K6+YS!8bB(N%Vb?6CL{Go517d+ndip z?*8>pa?xqp3gC_W-Oa|xc@<8ZrZ`B!_tbH#yvbeHpD`un(S+CDI!a7=b_VNBGu}$< z#tF|MXY!z}k=lcbSx=EOtwK?eW(d2~*Qn!a#l$dE*}U^F1Pa&Qwr%=NdM=ICX(YFG zn1uI+zkzy=wPH*}Wrj{ZmT(ggmcC6o7w&=V3XcfLksI~>a830rJZhkPFj#x=+b#It ziSx4vG5Q81yt}5fWgFJSaz>;DM%`RdbXT@kW!oNoVHxx0^SW*71nVjn=%qcJ&^m&g z@gr>Amm@x}&cFP^-1tMwe7h=dzSB7`mR6u|U4b_XX0*q1f5E1_v=pJQGE!l^ogFyX zBwOCrWSA^8>=fA(>Aj4r$obZF;ce5gig^ku@n)6TLBF0^N1tcC(0Hqj&|67wyjT7H zLK$R#XpsBy?SJ0ro zytKj1-k!^@0MYdEtC9&N%p-zZ=!D0-Su5v7X$sfj z=cW-wVH=eGLcAPw#mnvqzqi#l*VBvbju+)A-up>W+u5U1{D=YJ>+mQ~icFlLU}p%7 zN6+hG)p`6PMR4IGo=)A^_{7+wwm5{QjBDx5tL*nO4%#`-_Y?#X zm#=x)pI*)Jt&gkQS+=}z87gZ<3avM*pUp0p!FtY!NPVWJ0VIm+*tl(prKYQ=1!!)m zkJ+(}(d()#X!W$q6IBAaPWkLv=&{?>WT(j6Gd;M6pq|vtnanv@_zca?ZlV^x0lsO| zQ_^RJlb$cVTyHL%H4^Kmu5ZUhgL%(H_pcZAyW?HwHs^l08>s5)o{issIyoS;@{9ip z^D5rGAbpKEmgM0-W-WZ(@IMmSu|)$E80pvgpB5wG7$)-|+P>6|uQ4c|TgLaKo(*jX zds+E~B1JK<@OkF@Ur3k$wdr}ty%*bW<~1^uf*83^5kbaNxZCMqeHuRD8~bm?roezy zln^-GrPdp~)&J(&bA1IGVg$;XVjCktZ0)8M{qxq(Sx+<|DPwAz4yc1c7(-hLvVCu^ zTo6-n@=>zQjE618F7?PoTx=RMikq{&>hdanmQ0_H{tD9yB~z|^I=voJV?*hTD9%G@ z6@V@qzOAGXNRcu1w0iJ9QD@ZPv@Jn$3toqhy-Jixj8%Bn$jptRu|g>;lt(YUyv46b zTL|95Br@qZx^?n+ehf#peJhx1^2Jm|BPEPsH_FZ3A(}es@`y6Y@QSJa(o5Zka#?-5 z?Y+%3l4S?~jNElx6FqrP#eg3$gXrBIQO&D=QDjllA<>dI8cNICtzRZcZCPWk_JbyLFlycXfP`40m&J`8*gO8+=b7H_e)Oe2^G82r;;q!b2Yn3I7+6cjq8>yF_kmR zVxFcON@R9gN59?=cF)SPB;?vgw4&{#_th>E^VfVBwX%~Q=#rlw@LE7rM4b$^{+=}! ztd&wpIVB;Suu4g%aQ7f7E%jdN30j@!0i|(JBNI{{=0B`k6w>Pc`0@=S)GGVyrIwzp z#bi;eNrqGQQKiH18&~_ER>%}!rSbH2hUenTnr_K5Yp=EBD4TYsj|Cl~r3KxmRp|7W zzx|`e8Q^J*@qHSWU*im8-ZfOZ%Ki*{`;Wzvk7HgwO5- z!vMHqdUH>=)(P~5q%h(Zrdc7*f4W7$YTMjMGB!Py_4-G{m96=?=$^#F8Hx4>z6YgF z)qBTv@=Bn&;ejSE`|GIK%yQRl<8`!?`@z3u*qw;m;u!{fu`DVp4>xnR{GXexf%!?e zm`y5y)iL-%@p2^0zk&bY@6xjV{=km@@>q4<7%0q+0Woja@w!xv+4jb#@Z6(rO3>uJ zUva1RZttIVMUdV z-m-Jabd8oH^sRFcRc=I)>+|`kLu}3YpsL2By!>ysGmq_XH`f)6U!Dl+BZRKvR8uW` z&4z3X2lvvd_>MTGWS}ObuDTr#XAzHYMuM&OB4+qWddE=COetKdb%|gZbHT_{cXwMZ z%<_cp4u{sMPw7p?#X+lkDGI@)OOMuPhxV+xA{VLX{V%W98h`TU&No@M($cNimX^Et zEW)G`N#0w@z^$DQtO-wTCLITz+xj5O5mCt+9eRxUc z3~xrFC$~9z+DC6hVQO6`N>SbJhO%$4Kw`ovw}{4?9o-NUFc)s*RC&2wCb{n1Zq4_a z%}`pCBOTmYU$=^tIsMx)KDX<#lI?Alt1ZUq;vRPYzSBc=^JuO(?WUTc%{?8{=Kjkd z*on$MBR7XgW2Alg$cn2vze}r`Y}ROq)w?cj_&}~6&n*>{du=XkwRxZMv}Q8Q)$G2k zkY=N0*{RA$#tUGjyb(mybi0^qFot0u@Rx3pwkq6KiewqiArTxb-FZv^McJpR*-g=n z=TTcKXBdkwE45KKO2Lp0IvY<2wm1v?4A9I?wrQOAR;*P@T0hOItj@!|uNuC183=5h z>2R%o=dMNnY4N++Wd%cEWhFqb@%lxu4b;DbX%AVZr(IlnaZ*0ldA~e?YP^?Qes)H; z(sN9vR-aZ@a$Dz^G^Uuppl!w1|A7XYD{7bBb+%g2<54Nn=VOZ2f^i;qza8B)E!~nW zLa02^(ZFszoyjHR>9LRl_|RQ`{83pER3O`A&APIMVY2U+3}HibDG%vEr(zhDz4GK9Pj$eA75X~S@bMDkwR^8GBT>Cr&9vY zA-|$wdb`+o233rySttKcT%&Fa3oGTIy}U+VVM5ZQ>PeHOSewF#;cIz34BkDN%4D;4 zJfa6Cw&RZjjW~AC2lR1m5vfOm33%{}oL4tzm_4nFlIC0kjakk%(J)&1Un1bqbzGQ! z!awFdDheK-hKU4xi4k(K_6A!Gs4L}&2Bamo4F`E?S}a@qu0b5cHRd<`n3E7M=WaEh zR~H`9!oA!qeIY#g4!geR7vz@l!`nu6lL!@}=GGxq#q%c&Z)T>MVI~}(ffdO`Pr$;5 z4M$_nzprm;i=L7Z@7K6Q4@Q2d_6xwc+1a^)@^h~@eY6d&qc5tu9qW-VBOG=GrQHg9 zuHUDXh(28u>+zGulE7m7@PLh$^>dik_ta{itxz|QbhPTizlKKzmXjS{JAO+&k^7uU z_a-bXGsHycssv(qa(aB+f4tXUQN5!IU$AurgVn*pV%p5C0>Xn#M{&Leeg zM;k;+AxJKvFS?1Xpi}$FLf3reb;(UPG^eaj7c3plb|*{_=PdHiwnf=S#+~*A#iSlGm(8pZ(F@o4 zE&|J4mo+q|HaVIRY3%Jf(m~c#Cx7ZxH#=NbOfrom+n66RxH-X!#V>SQ zFD4pF#l-JW}ndNI>qb`Z-9 z%Z}HU9^z4|Fwc)4z!fPjx`X`dDbc+ahFLzGn>8(r>?~UwY*Kmd1`&>8&jOY77Gq@D z1F(t@Jsa8$+&YE2sbv!8YOKISeznobM|$xKA-P@a*UoMB>v%B=le~(CU`J}?QBIFT zU!Vlxttlag=j^1RKAS*WE8nv0s6Lx_=tNpd_i%p0Pc75fND>u`BXLCh@~q3mP)`eJ zqJF>=sRgI49$;Z<+iBlrHVmwxdM5Ip?is^-;4Fj1wjKL5t+y>3gHyY$m$~hr3Ip{L zWwv_}JFo>Gw-2?ib~p6fbzy#t#e)Ve+W% zwe^`d+kAniDl7PGWQC)|o_^u7T?#|lrnxYOA78Od@NF2Z{e{UC>jt&6Iat3wSAEx9 z+RZenhp4^n%lZ1sJI%}rwl|Y>cDcYPI>@6}DZ3zvRL)H!yDu0@`8&$iI1L+F$9>oJYUBKH85~95!oY#EDP075+#UC}s+c4Rt52lP~4+6fh zut88UWhx|g<;917f)bpXn^m%9WP$l+?W>JW$p<$A2h6PftCyViE4RZCnd4 znC5fIJ$8-G1c>b$j?~!~M`X)-Z^y#doKU;eiH$9*w?1NB0>(SlEM(-i{R^JLIr=jX z1Hspe!nZvhumbo&(1mG(UXk6xM9to$u(g6Vci-(1*`8Z_Aij3Nm*sZH;WT#$nt!%C z=t^Egx94s3S^D6ZVLRV?l5m0I5VKjg$9zCwdGv8d?Jc)QeU3#WCgO6L#I?EfREqeu zpef<)>Tib`PcoD7FR!i50#k5=wW(3NTJO2m_YC^tYN7x4)HuYMx zz7yE12AeOfteB;o97_$JQ720{@gDqu4>C{HOw|-nfm> z>mwDEOUweB>9Y8c+oALZiA}oF>=OuF4~qs30*JeN*z^(|huDn23ViqS9B^J+$Jb|- zh1J8HBd6yBY16I-c-AIeg<18Uq?yg^G?Kr|n9;8SvsAl%d2Mznl>w~`CbONft}jcW ztDkqdvb^XFIpdhDqzTzQo9{rmA?8j=2RX~?_l!GiVTO$mJHbO?(^t--H#j~%X5SfH zVJjm2VE;KP*cnDCFw-TYgVPUgxYZIBbr+iv&f6tK);=vm1TA8M~65ByoUjZ5E8a-TLF z9H#B8Tlx_97NktWi-6FtPU~%wiQ8Sc9^4> zG;}&US+m#LXi+yJGoicql4A(kDtG(){WiH%q}KN8UbLruq{83i$k^IZhwXhX z{g;S!6V=h&qreZf(WBmMlNC@k%$sn`ibi%Jf+%+2x z+{BxcX1%J42%iDYKGFu)grOwKi2#X{6_iWA&(o=c4ZCSBo`F&b&V^NIe%@-$A?iy6 zrtwqAeg(S;s2<{G)HkhVwT45>#yd(c z&MD27RuhvA4BR^|joetRCC(;1`Ud2VYMX-HXS7=MbgB>W5|iu(1&2e&_2v}-`|>%u-<%{^j<4?N>>u{_^nE)MQ}EfcY`;x!OV#)-?)+&?{j`)R!u7S`{j?PM^@dBs?h z6ClNCU>}(LA;(P4dy|Vt8T`GguZAN{QK+Y8&dz{RDtvU_r~Vf;{*3zx==x?6UY|s^ z*I@qLdG~0f)RDG&>9?bN%AAYrP9M9}bq3y+oV}PY*^Or~8jPODb3WG z>xlnLfihgZ`h%)n`Sn8pOq>$c=@gkp!+NI;E31EThNwx zbB&?+tRgKY;RYJ2CjTBjcM53)jdP!*MuFUF;VK;|hmH7f5Z`jN&>2lK;Bll!wc2ALLH%mEq^|g#!+lTpg z9JkGO5tTHw5oKo5&KIjqiAF~x7zmaNw~tdzWm+v|rsiCHme4gts0pnDhx{^L(~7lJ z@yQX50w*SdMYW9e3)ik{<%zC%P*3at*#uQisP`!mr(Jq6D0!j3+WMrWdA;q4u79Ir z8k+cWWSWWrIBoQZ8<}#zoh$VofBb!x#}^R$P?CAt5c5P!Ag)TDsZu|e_gtefoR#tl zX_~NA8;WPkj1^=l=LEsjsdIQBX~4a3`f~e`)BFlZp+we)YYEgZv|AnFi9g|E+7OK^ zi}OEv@_*jDEgauZ32lYX-fZD`U83KA_Ll!q3%S^uafv2oghQUikdSd3s@uYB(?-)w0&&zuyGuLE$O}B9{|ISDvIQRL~)7%E&b47VC-?0`wbN{z|1#Va9_5g34 zGJ7d>SoH3-uN4uYQ4Q;2^F-C>%P$D!PebP{v+#9s{v&zsJ?O+0!BT$rUi(f2D{((C zeknNCUyCiWrjWV<8}^FFlV3j?WJH{N{Og|=tiSz`|0@_NnLXewdCTzu8vHNu{l7u# zZj^=H8)PWata$p5*!8a;MUv6TL+JkhUgj6V@Onq|A0PFfyFGi;`#fol;!fxP_wNhe z0Bs3-?D@}r{8vQ~mweAJg#BT@`=8eUzb}499#UxZo%Em2>R$~sz3ZL+&laTr?6Uv) zcwdGG&)yXOU(^26Gr+_Czo+(}?f}N-{|(6h>W=^K-!+krV!hK|`41DNT5A{U882C? zXDmySxh6Cz-1)?^(dD!`LT!!e=NRI|*Zm~w*8k%F zCq{fwrd3iV#GY$*<$>Scc)mV*f=QU9QKp>?@L^`|Fge#JyNJo-&C%`+;-XWumcw4g zwIt(6`eI5F0T<4W;Fm1Lm<<1@Q2q{SBBr>7bfQ1jGa%`7A<|;J0Q6)OSl!O?;oH5V zA;=8}kSplXq|cA$To)QgaGr2lj?tM86dM7%YB>qvMkBM0j$eut^!^NWg%2NX)l~PQ z;nF0jD)4pcIt@!W-*aAdv7f3iH0uP)REPmUI9hdyOaC+OilqJBNM$In5r!3D)L10t z;hpuw(xzZjN+vxeb^Eq^73=>5lN~@7l}&%}$MkxQu*7OWwp|q~^EYnrZRoshg(Jcypz+Mv>utntXKyP?6*TDujIS3zGgWB0K99uj+h|O#~qqL+N~#sqAP8 zxO|_tiNm<-c>(=l4{b&g3mi2fv9>W$mZIgkTO09+zj1^Nf-+=o-eJ$F$QA-+a`>R! zARBc$cCF44C`l8}n57Sw$D3;dJPXfddqp?%Q)~%IX?Fo~Quj~ge8rLCDX*h}xy2u$ zxFq-_(n?hm+E$GyU@OWfus5?yS|qzntWYLJa;SUh3(H<_?#0=tqA&s5WX9=uWWzT9 z0F+C1^pWX5(>Rb$#{?cYt6*g*Ya0gQu|Kh@?5vv8ljg1Lcp(t53Tr*pcAT~E4(vW4 zLF3W)I*>@5%a*{%3AKlDy6k8=Ze#^R0YnZX7`uM!_IOk=C0;|D-aI)M7yYPl+AJmT z1yu^Sjb*y~T5@SNRLQ`hhk6abx+pju7WGuL`=`4th0+YJM@x~~x2FQTuioU$-O*i^ zHJ`GFT1>+9G<=FUoHBxm9YRvZN_J`Fp-G@vn#K_NM%c+ptfJYo+(_P~5GAav%CW!b zL77>VG4BU<>lcJ%r?S~`$nPLHgW#Y@$2@@El?-gznVE&$UWZEXJ8zlTwj6YYo3m7s zC;uTDwkUjeraeh~Sv`(7!qWln)fPeb>bnMD9H-Wa3Q+{WSVSdtKd2NM2;ZFNjQ-eH zew&+2k?~in=hymSDU#don1JNM&V@kyp5ZR#h#Pz;K=jJVet zA!-uaygL;g?aXvxUBEV@SHSa~^+dK3Ob=fU3z4?X4@Izz`9KK4#Y)GKCAj|(97kyK!PcT>uYSM%a)<6r}4+}qVegZUGl zOJrp?spIvT`~33`vhI399<=D77bMWdBQd|nm1jbHD?Ce!!DNH17fL!{18--#fL{k` zuJg%@nT}tW>OOTJ@+<~|aQ^bX+$`ARQz!YO)xMVsnMU#)oYBIkQ^p-|V0Ca4o_8|6 z^fL;w7tqgEwZaxv`jNigr_<&GR^_d)xm$tw3uP>CVV8ZD^`HdSRIKGPZQ4-<5}02R zJsX8XAV&ZWET}X0d*+p*%%SOGYz;m$9CfJlZ1JcTTJ8le7PgyjdA=CP0uI%=FxUsR z``*CzEYdMS&_7h92Fg$>my*`vC!iuwpKa#SDAobm&6kE>fY1XL1s}va~do3A;j_%Y7K`oO>=xMaS zqE7zwoJ{DQ^)>+ZvX7+d2>%(m$3>_mM)RbRlVydIZ7WACcBv@}ScGk!O~?#DU|coo zAs4HO;Zd1kpR%t85~(U;9`@(vN)v@a7gg0bB-}?VqgdN%PuRd=DZyiSdyRX+UVo(0 zJgO)QMWx<^FV?aplVP^MV`+X@Ehp}ax?Ho5M+N!aHA2>mEF=azzQwWf^nJT@C*mGi)%S!PX z&!aec+{S{v7l^N2wn$X8v&RVRGg}n~jPqk3hTS`Aor~9J}%*+R(ltq`eRoN=B zhNL&EG~*Hwr3&evf)#xL;{C^~GM)NCFy}a5GBFBJZv>{RN-B~3j(J||4&w(GJ}Sts zjP4~HWWyhE4{;Z@Kpbnpd-kFkSjTY%1(*&&-Hk4<4ZIF?3v_+@5|}s!Wf4CLF5Bl8 zSakk)oU3n?DhaUzZ8b}Nqj#SJ@VLfoXl^8_;LI!Slfg+?yWeFTr$ypRKY+#7{6;lj z&K}no`Fv!uWKSd3IB*>}d_3aP+<#7jo9tC?+jDYE5lr7>g1xk zVGipXVTgJXN*utDEiuL-O<4V$Yw5kynh_QWBtG;qHN-KI=1YysNG`X{OfJ17!5`o9 z#7`s*PyD0Pk^&)yJZDMHK@{hucHUVQGmy+&b3(0j(}aukVeimXIkVzf!Ua#KI({O3 zW8@SD`PPZ?sj2jNNVOdSL1C8WJQ0eoLlx;d=M2Vo|AFxgNXi7XAxbN+GFCn~?q}QX;xomAwol0qeCnSjiw7e10CM4JDiQI5pdnvO4r3t92lZu?E(>WoP*DBD?(s zn*7Ss?DDPK+MQo}^B#8ibWdm{A4Ui}o8*S?6xMwF70NR)wAay$4p+!nY5aN+mKm1b^ zZ$48iB{w?VnPxW0extsji2D-|)Cf9lzc;eP0QrT$m5%nSw&+)y>9woEr@i2xo!|YR znm?m7F|wbrC`jhS=HXuOa;zRz5C}{>2V`Mt(YHwh2+5j-6s|VfQx`zo-A&%LdYrHW z&_sPrxtlkq3y|ASOS_769s&LQUi<)qF^!xW#34q!s%i+xV9+aQDNxX~5!AN=gI|6O zl=Fzawum|_Dn*|zvn>@!2!;^T5gcbt!t|e&IhVybN}0pC`$e>APAW;%_lE(jAt|Yq z6omvJ!e>|&hX!5`|CXvE-qgRoEi|O%KK6mv z)j@YG{J?WHz~83uEO?F5<(j?2Bw(kqQlZBU*_&$?;DVG{dd5EIYdVf*OVBhz0|a@v zo1-M*GoX_B2~F(-i+4wo3;?LX@G}W=n}^5+5lnjGT$%}?G(f4Y`C%~c2ir0lwsRw_ zW3lm!er1Yk-Mj%HmHbEb@N1?V7|m)E%gK9OLjbAqnX>vJH5&EOFtwTj4ehXJys9i; z;9b}n0OX9ViQh=GtKFoe{0#{NbwCh%&Su<|)G!q2wJU>RbT;QY#PCKc@31VI5mbo7 zH5c_H5WjeXAgU|8i-TX%(rQTXj1xzJiWTCb`k@iqI5@8WU=FJ=M50Eeh`to0xqm8X5@j~puVApvd>gN znSHys4RFXH$QdDEIQfp>>-qU5eX?!b2+apjlBok>i$w+Lgd5XeCgu5o`={F2Kltrwppy?Vm>&ahH3?a zVvj{^jZS-5`24qjM7!+e;V?$+$Km$Chw9>yR1w(m@fN*6F`BeGtGYgxIP*f7K9;C5 zk|w!Sjfc1h512_1)y6#V#1XbA)HIX`;`p_}RaYsUWE^bU&O{+T8!QfW=~ccf zzXn;2qjN?8_9qWAZz-QZQTVzB*XTm#a5qc1giUqKEwuiTn1*8q+vL7;X3kg_i^2e3**pj2{O91j=X;1# zs0uVrLUcP`MkHFH1xw8P9pH^H)Rr7${C7XxdxVY!c-!}|3ak>pgN{Sn@o5VGh@9-xj?oc$^pEq;%zn4$oY@E8~%#y-m zXFJHh{Z`CyV!PmT%6}W;ukjvy6o1P=*%&e_b$fGtm#$Au%4$yba zs7C((1krzea;82u@T>Bml$1Z7>zx_EeE$)4ZC^&oAEhM_i?@JdrLq6-X8%r0|L@)C z%TF8f%Z9Of^OltT|5y{353GWzA$2M5Og`9NQE>R%ON zS9mT~K&D><#vcbz$+lep*|Hyi4i5mP(c&OW<4R1v_tmLcUc3f7@Glo*X@!{PR}x^x z<@gcRv%3O(puv8*-wu9lX4ao%=mSVZ*DOF*B)?|T{@b1eKqk{pJ5!a%B$*PxRk@Gc z3S`4#|2?rI4a)RoF^7ad@`2;j0g{*PtME+&u9);+(KKa%7h;yE=fXy0+h7P?ile`O zKVld#IMY}Qfl$k3t89z{@I}p+0AZ~t<>y2L8$&|s=K#o^ZFT{uj()(wQmtJ8JhD44 zmY_B93zNorT)D~|WuS~~CNt#421z4;ULlDBz|IS$m0g5+fvQUrZUwQv6RYN|7m-_v z%*J3y7gPWkvac~8;L(Si1LCTmYf^VvL&wU`9T05nQpENF!{|1Ru{5UI6bbo~|1#?2 zwkOK^yr;t~;8v5cHGs3s`IN*d>JH;>Ia?lzOA7@U+l`k1<^?hU6yo~Jb%mPR4@SJ) zfXJB!iqp3JmFcTxmTWrf2D-}9sy5s6172Zv00_^4OC!gML*+5O1`yJ0>ZXh^s(;|f z#?=|u)cwRR?8|uQadXY#1Js-;cU3E%fKbb5V{ksRuzw@6*eBI+XRDjnF%j$Yx9sW75_U-_Yxu5duI~)b0r9v(=ZOfv(aG&GVL)-)4^ZCXP06_J0vh5E9-KiT;Bd!6? zphL->4`r<3c*)iTNU@aGvw6f$%h6!I`_Y<~>Cew1dgSC;?J0I`7HdNp$RtQFsl^)%DU{#zq3(WP=|en900>CYTCAWw|$vY zK$|ZXlqe_b6@&G708`O_H(Mr?xn(qP3IK|4u7z_9(y4_X{qL)x#_Ah}BYwx8%JT4u zOV&^W%v_!7VM!vs@9lTSq=MDbJ`nwq0f{s({iVJ9+t$kY!SX;LzW&Fc=L9&gDM>_W zPa6%36q$DouzX(NNFy;Jp#S;t86bL+^jkevnT9~m)ZX|4ZXlohvsN%B5jQ81b%n2% z^SHXIvpN(9r>iG*8St)L#NMMlbDc7LO6e=X20|LDef|W{p1?X-6pIouSd~dW%J>iB z6*6H!LwMJ;1L)Mg{-+Hue8aHC!-@Gu?rcK>6V3}hKo87Oy@z5Q)Q32 zoJ5}~8!xGq%0Gba^npqPupH2v2e=VbmZB@$IrCZ;Qa@MLfd2TTEysQ^Wl@kO2RLs> z>hjJCk(R69Tmb8S@Kr8gK* z8Ljs;81vSK16-3%+7CPHSVXgkQy9E~;gPl6XEYQ4Nt{MUrhe8zb}QdYOM+Y4$}*yR2Ilda)qS7b}%Q7-o_ zV9z$P2g)g$Fu$SAlmS@ha4p-$RR@bmOW%MFBGQ>R3zMx_kTfzl)`=f_K-^KTb~n)aP|Y4rVT zDR!iiQz2@yv)91I19w#a)WkboKDe1JXZA|t@bkkLbQ{9rmREpzkT}fH)bAMgLy_T! zLsVgpbsH7!*QE>i?e)-IRV_JG(4~3v+GI~DbQ4fru5&Ro{^^}6)N|Ec?~!@1${w1O zSK~D^%1(F@$bt+X%j47y!iyLoJ6rg*3s^i~{f6U>0SN?_Z(KAKb$2Mi#q{~r!tEY3 z78E*fco8-1ShOzv?ie5M!xq%TR!w10_+*;WHxgwh-A5%~yeYuMttfaBN5pt?kZ9n; z288;SVb8*$k7$V_xq$p0JTb_iy;N1vOWxh!pa2Wpa7dtzwF-t_T|7`xd*e-d0!-Ig z12Y2_O~2=_j27NoJnQ)(y-cyooBV)Yt)@#f%mkp7$+My5cbyI5xd;dMQ3OgQ^GP#veT`luZ0q$)(9GH@M zTM=1^b7e%k`#sq_oj?SOc!%2Ver*c(n0VD0f9EehB&uSo5bkxHs26_o;OZe|PMdH=Y<$H$5NJsYSx%*7 zlJIx^8|DCXUYq5T#$+Y7?1O{QiHJP}n$m|HKB@_D{z*S6r_Btfxp%E8t+;PmCRJV5 zK{ak)>PZ=Tm2rY*V*>l`3P**Z=0gFkm!%z(F=y=xA-V{Ua);LSKxWIwypfx?*9*6e z+$hIv^9rS^8!BBr#vSz1C??)JJNckeEG%{W3qjvTwGB9buG%ILbJ00xC^v26DMPu5 z_v|BJx>oV6IV9w%#xq>a>bO+ziBM?EsK#$BV&^esUoI}$mbyzupNUt@$Xe$S^bdzV zgIbGLU4r6TS{b6gX~$3dn47H!eRi6WZN7M#Yr9fx#_L3Nz_}8PBK^}ZiM~@*#Flff3TbU?edDO zVih_^JS#JijMZq2A)fAO1kUad#D6`$6_=`PiKo^^L8bLIA2?frpVsAdZ67IzS$H+I zqNRW~OB-%e|YZiI(B~jW;sj{cGr(j_q~3kSr&)vhX8r7a{^Jpo=*Gx5jUnK77LUPZ z??$$wj7Nbvte+7DEv>Su;%8@5#$Ox9)h&LAgTF7^F!dW3ecDbNX3&7eZy8PtxjtNn9(YM#;nxsHg^ausHo096WDI&G+~O`tWd*0+Z64d4sezEG;hg zzQani6u*$Ztiqx}+2{VU;$qBJsgcaXHSPl!88(-ZcC3eU)k2E7ox=dy`D`$fkgM05 zWm7=fy2hd8sw7t}aeh%Cg{enH8obY9^sP}Sg zTs5!?3(Fkro%?LpL&abWJ5`+MCpS)ev(tQMkH9MS2sePawIxzE7u@s*Qb#6Gc zqa_v{`K$1u#yD3AnLcH^(2cM9>Pzcq6Q%6EyvUZL_NzMF+*0=8_~*5zf#kkvA5G$` z{UW~IgxK3mgFa@qt;9AghzvmtD+sp71K)c)kN7YiA9VwQ9HjIuy;N8AlqsxR3`$q$o1y2^i1kmWgLEh0_{&+tgYeevs zq;h^mt;f`e#t4yxxfeK#Mnr4G$Ht_)mopg#eg#Q9VEl-Q>{Ot`sePS0kTt&jF|4}E zFX|iAQT$7Tw*`fkZ$xvDrk0_oMzTtH8ey%E^sMu-yYXW(tx4cqA`NnRA#d9YxXegM zp)Asgp7RaolS@>sSaWG*jATOFvRW590}h;wVV5BM%-qn+CvIsj^i+p1-N>h(t$SrW zpt`O70nz5$iuUZ%O4T5}=jaP;jB!61a9e2zv9;WO-r2B9_K$X4JN(pi1gi(BIRYMo zgnx0_N1(roIfVe{GL`B?ZGEaK9rG$l;UuUC@Ppongy}05Z%lBH*P3_uNGh7{>c9yW z@%Qd*73a1%zh}u!8>C#I5*WXa8kQkAvFdV@gL5;AJ^)s|;B$4c^NHyCeir)#>AQFM z3(8u;S#cgd^06n7-!HY-b;F<3^AAbE5nxGp9@q__Z1 zB`Qwe#eQkMo&1yfbF|2JIOWz5Fwc$;58OXrxV>?mvP;JNp~{AIYAMS#MspwU2BvFF z(k7ajyZG%o-qJV>6d!{naF&P9yix5tX>`QcRJWU%6WxUs9ErUL;{ltyjzxJeb#c% z$I?$GI?al9;)PlRWt{U zVqKwyE((GtV=V(VKD>2|ef{JHVc*+7yz^-~cCa+atEAm>XS{Zv1zB09#t@3d{ko8E4sWcPfCQ1G+ z?$Fy4&8^mioUvS!K&!!5?HQ_%GIi;<#5sN7c^(ChdO8<3bHnDj#50ny?bKJUx{(`} zgpZ}R5SM-NV^5O>=`Xe=`Vx$GN?Gnt=E}vFzKr>JL~upe48PvBBXEy*_`OgKR1(`- zBc4#CVwT4dHD6A+fN*%i`=;K9u?$@8saBZfACONg#?QzNa+;ry2L}Gr?X=?zJ-JocW zxD`fmmpm@ep+|Y{#=YTOP_gx7{EDm*AmTAwuci7{XA+0d^1Nc{(h_$|6z5A?g<)l7 z_&CzMDzKFdQ%ISLu9O&OZGrhk9m2NHQbp*m6;*NEUSNp{=e8FtT;*$Cd)AuljZ~eG z-HI_aSQ{`k+EowM;c7@HH{Sq~+r14n)HSwwM%abifuHPx#>j-!J(){6`p&5y+Ta+} z>Q6YRjS9jRpM>(%z@N8}h>RIZ^nz&gv9Xw4;L*jc1WWYrD>(@TJH(dsirHSU5N6Om4RuJ3 zW3&)k2Up~nj%jdGqcLW$FJC##&`^Y=Zgql5mQ6>AJ<-}y+wh<@C4#pdlf}`^cyKXc zv5{j6eVV42jdFaJ*tIDPg2VWec4C(EpXw8eT@GpBwv5jo4FP&|W~6>2nxU!*8p;5Rp!1#fT(M?deJ8Brc^78GdQV2a=QVNNBw$$LOj}G8mst zjH-?<*=g^ctS(vsEBD#!E!4p^=wVs$>_mY-_*mk|#T4YOkMd7jxdVK#3fwi+3y6)A zxB13T;!xFvL&b&UPT!}CZ-+g<2uU$07rSa3KFn}iLaRUgC?7m~m4j#1D&Ww*6^pDE zKAlWl?#dl9HGuu%9^iFPKfs{e@-!F*j zzb{YXMjww~24`?~4I^`p1f%9(@n2keGEM#U`0rUaU^C@d6Zsq1E;-1{tG%r7@nKClOMzQVlSK^ZGbbZT zd~~u1MlN-UGj6htkUmX3l9ORD%ssLvwQx}5?9~V)+`T?Hypg8(#$)C+luELXx&OKer7#(w3Uz&Z zNm9xd34xq%Pn-gpYO&s8Pu}#)1&Xe-dHHI)UU^=K#iC@$LgERCT|I8!U;z=9ko)TP z|6%Vfqq5qF!SHeCU+!4wY^Yq$Q*U>F)0C4oM{hr9*h=2G4wUoOiqT z8RPr?jq(0t;Bc|lnsd#0-&f5=8S5y4KU+LoxLT%=4>`InWE{9Ag9+)%s@<%bK*VI zCoPpOst!v>a2+Vi>xz#rht`Xr$FjUer^PmHdpUM-MvH5G!3$IHYKvG`isNxN29~{} zif^&!<%?fW$f%!aH&I{Oe@;(R-sPAMT#Tc;0qo%32v>mXi@k<{xQ|(I7pYyfjc(~?(v$`d`T9v5p?k;v; zp3fg%(+0&u-_4h7f8B07NhSS}gsa_m{ph`a1x!$moZO>0?PeFNenP#U|m&cJm(fj4K1$(uh;4zQ( zaoADm1^+c9gs>s`YFj27*$Yi|*L+zXGj5 z_~{Zc-{@5B$%Dc2S=*{XsT~Ct8q#PPmICkVS#~XF+;>g;uOg6i7 zAfV6v^m=12p^N>cbh7~+nWZ%35E`|kU#xVgBJeJ-OgZuxrFq$^y`Hjy zUw|0MC%0ULIT{UiuBlpX?BRrA_gv;m1-U7k@nnSHIqg~v*0>12}$v`{|!?YmFJZ^)wl~82~uCIFD9QO13fpf&Z zmBQmKrC5Sqe4v17Ghu~J2xW4JW>!Nm`!MhgiBXb9j~O3DW)ziSQ(`ie6?MTAdBfh^ zym=Wbu;Io-0QFbd2o%VRKF+nIx|G-DOp#{b+$W@yn@!y|*Ucb;S1b+>Khe{MuaEIV ze=5kLuOTQk4kglqSIP|#@z11tfJoR{3eLG3>fD4W7o3X7j&`p2^@u_O+k}`}PbQVv z>F;ipQ+IP{b;2xIMx7yg=0@lIqvv(-(!Rg0mu0<+YyQ;m)k?!&a+9yT!qwT{CqL0K z{L?_1Pf#GQG2O;s>qIee`FkKXr* z^{TRcr>MBe>$YMt%CLOCK<-rHb^$Om$9$_QT9wB_@EoDB-zCm7JyleG>HA!oIfA2n zpYd8VxW=3f0jPAlEFY;|Q9Fs4cSryyH5VfuPqnmO4t>_=*K==-0G*$P6=2FVn( zLW$&(g=f}Y!0KnKy zo~T)SFT2{(CV=d_sm$^*unugbyws?F&89bTO%|^$A9RxDDIc>_7hl)XCwcoa23`D1 zZ1-ex4p@shz4Keo;!_^VO7InJl(ELSe4HOU-FNHrI6rAD9!D)LgB;-3etW5g<38{b zKG`7`)FXsNkY||`5s$oG#5q4xWK1Eq)Ciwk>JSlAtT#b*_htiKwMF3r1(;57IY-|w zm&4o3EE8)BeBP`g>!P9b_U&1qJ8QriH>~t7khu-~_S#$0%}yB!nmyKc%5Qpc@I%sQ z@zh&Ijv_X>BI8f%3j;jdS$ErP?5V=@uc79KoX;?S{mfynFi`2_-AsAf492_GX&;&ZSDE70PY0EcAK-@=9rGuTf9q|M=+|8-X@jQJQYVrPxaj7rO5++B-C=7msUi?*J6|- z)k0+7yv;aG*=@g$R;0|=7`4OEKSs3eiDfbHu6%0hYFjJImR#ADQIWE<5Wmti}{@1Ae^34D}Jt{i1m@i*Uh^n zpX)v0a}64;3K(9R94OthpvYa z$^Nq4<ocz?WD`R;L zd;yPt29O*;vzHQcOlzm$UO>~z>#oAz3;voF6w0=C)-24LadX_$@w1WSzsvYqsmkx- zK)BUR?LmCUK4|@<(d%3O%$0pQ2AxIV=Qb4V`qDL5z9F9FHqPjg@A%%YN4`J0c{4E|1H++);AFQkQ)r-}N z=ndesD<`ZYIY@q*&d=3fKRY<&aJqjSz1YeojlWhdozeJz~n1W1*@|Z_NCQ zN=Al0dr~@j_FYP)bxM2<=FfDUUWsKu_o1PF1z~@v@H|(J&w@92WDzSwe!?4_;iKJ!(Vo zrGN5}wRt}$mAtC()eL{dE+RzK4gDwy&@TY?N365Z+s|iPrF5Sj<3id3!J?Ti6#)F zdnG4cnTtVGyH}ZIrES7{Ma`-@vx#oWIWkoNbZmo4rjKtwl!nrV`Yh7JC-{)aqOba1 z@%x(Q0 z2UAlUyb30n8n;zAXY`jfiMk7X=)AG^x3*p058JT;D42+OGMHZn5<>%IXV%m5Zs!?P zar>*9pfz%=rb9X7G~Rh`M%wa?yDt(l)S!{SN3@AkZ54o}QIK^l>#57v?Jt5t6QsdE!SN_xw~azNa!_ z%gq0+3nwA=3tW{ZH9+I}m)0NVMi6c#1$OGC$DG{2JpXU+wl}a-Tl+rVy8mC5+7fz! zsvz0UXu+H8zl9|^WEr3TXtC&FtyJi2&}q=d-dPy5$6!(K}mC3w02 z`)L33X8w27{xLiL`0;-yaqU_}+fPB5?F&4Ow_XJ}vb1U`b5^a-~+oREgRSV5EJ8`r_pC!P#@qpR7Pa)PC?0 z2u=TCFU#;jFW`v?0Sd%!U?L&fxY{k}HtCP#1WwW?Qd!QsvyxAnQ(fih#sXU;626Z=tyzXcdwLy|137lK;nw{*7Eo**^rx zQNIFln&1XZ4naYi8E}`g)pUoGP~(>Mxmfq_xi1=u^}!Rfs#5UI_R@~2 zmE-3Y5YLXnRKNh}8+m{x@cry|P~_diBmfJ}+E#Qv6nxM4@9k5K2PR*H1 zOw7$ct5|fi6fCoLvT-i_VMcd_b_{DV1vaS&{PnvW_e^z#{ug_Nx@ z+lC)OlB5LjSaEAW0L?}0b>OE=fqq%W19Mb2Zna+?Z+-#@*tnIiG>W(_#Yb?m`}VGo_fp-33BTJyiE-qyZDO~9QNm6h7=_M`*(9ojSP;Ct)KHOkV${5F0@ee(bUi~ z!#*$BN}J?+IMbYcE;)Vy&T7@Yjo_Le2#IJ2QRh&%%t*7uo%_8|8IlqH!EZx<3+#5t zMEG}FrNP#&>p-iFTJna>mV92{Yq{u(x=zUJ;-EvJ#IddtjP)Z8Rr1QR@tPk<-B(~9 ze;TfX3+zx>1b&cyWGpZ2`r6p~4nD)jB^4yux;0QBpnVK;#dPqkj1&;OxB$|m5LDs{eo{RO60l>Zv)psC?p(mmO8l)JJ` zkj`bNo#Apws@VpZ^?{|tDO0h`-oqy&CuBHf8h-P&l_jfs1UjtRsSw4GRZ=_U> z5YQ1@83sP`<9v@?B22b=b$7?L-pUYUfq7UB&UgHxW^C$5(y{=~;1vme)6fe4>B z(apGtUpoTv_@mpa)8Ph}$yUzSO9B=6vWHB8{eXASMfdiNov)Z@=mbLQRC`8v3{uhG zmVTvjM2?Eshlx&KeA>C{T;S3%!lufy@cEVPeMl!yEVe#pZU7r0J4ju~VwX8^#@bM( zLYl}4K~esN343Zi9%%!~AA)Aj$Y5=PP`I%@eT5aw@ zu0@)A-s@RA>^rrh1DDC2$Wj--Mu4)WY`7-Q}EXBcR8{IfQp?fQF&ImS1xS9 z-T-1=oi~QR7LZC%66abyUCEE(o7rB!0`2TUi`vCrz>8XZU(JdAka~+^L7mdrt?f6< z)?*(5{?EZt3t%1#m#PuA;Q+H61zNWv#w57`icNs&9>^0URob>)Zj7x7Pw1OQ9?$B$ z=ABA%U2>;p$R|pgbeke!4NErIisxVZAT|Qb`FOLuK-)eFtO~@>uTxbb!1Qgiv%~i5 zLv9G4*?D8mqfy)kOds3~RbY|&1eCi%Ao7H+dJ;mP1dAuINCN2!vp>PJ^dWbQ03n5y zzQ;DD#Xc6!g^d)n9=ofjnm6b#ug;(Q?GB3HJWl)9LG8~V8zmfD)rtnT3wDA}^iz{( zeyWSMB!LRvc;ZiSwu;!>ipUz)m=Wd@JMW-Se>oa8?zAj?jI%lWJqY~|u=}Hx?0L7i z^;M3@{tRFuA1Cg))D#I4!hSW*vl@ON2x1aa8p6B*z7$|KEks{{xO+`R{~5{D{QLE5 z1UA1@((j7FI=dVk4B1ta8U-?8*5U&#eaP-z?Y_6W27cHL@GfM8n)emlUVKZJQ##5u zb}!lkcgo+Aw?A=Z_ePuPaQ6#crQ@K98jTr`g-t+Eb?h|<~PL%3Cj4nxkQ zzSQ^-z!3ye`3!bkEg@#DlF5_MI}Om~SB5RUllxE-6&LO>OD$oDz=XH1_9!Ccu^i!V zb;%NX#jzhkA?E&9$uYzP;G-x(dcSA%8PFhxKsfK`MY1M4gDu`OY_sx-elC6|ylqgN zJPkx5s^~FG%o_z0b?wT!VJh-NTO8e%teJWgn@!{~v#Ds3ANR*T`Gj9be&$juq~Aj{ z+%7!*v!|?xI)Oe8FZE!@hJ;H?2@_BK*U%J(G?{SVZt-FP*Ax{(l|)T$6{wS6tN*R z9dw~|o1ZMgnn!NUW|;G`N4sTYxyEGIcsZ~rAW6$vG=}I=m zf>$jzT5Cb*X^u>6mxoPhtwsaXRqacD0;5hcsaViOcS-5hRxCWcwEnd{X&#!jT%46_~&x(>%-b=bixtp{3s)0D(MzW`!EtKMty zRi1+c0PB}u;-^NFscd$lf55ZPN2Z7lT^4*n|9or@;*5gFM6%6fJK5>(DJ@J?M(NY< zwO!SG(f16Dpt17g-9~#>HwS`xXvhLjVDM)- z-`;^fWltkEI~n;drMB2r8L>oF#6*k+Um|iK9%doo4n4;wm`(J5Pm+a*Hp!sWO$~?s zcNV~jKPY~gOPH#oL9Y?eKd(&O(m}l{KJ<=eJWgE&H}^b7W^J-H4WTq z%pnKQY8{wkBS0I_a1cFIkBV};jcy0wYs zL%{ii&75$|v*Su?kx8a7AQjwYIF#=n6F`+M6@`j`k-IhrilOi{2u%g>;hC+?tO-*| zz(N*KqG&rK;H8mUlXH}n#tuV*ZAsCGQ4C2DgQk|cfv_T#d1TVsO-7qatL_k zy>cj(rUuKYE+^kqM5F6^DqBP`k^eBL30FJK_V*81L8yl9q-oR&S228{ zS>_5da%*A%e|w1j+FdiUvdnYvP~}IwCVQA(Iw2b5DVZXaUR+b8-}8anKhDyT7hlis z$XD0U>V?j_5k%c1a}1>*4PYX%h?s~oeMs6Le8f*e8bDRA9XQ(-@GRZyD0C`rfHL5~ zZdmc1;?YYC?6!-W`9+8)NphAC4`h&?DZ~wYN7;#`XKg9G9=-(q#J(->;Z_Nvmr-~v z0jrn{<=FgfW%Tn9h0(8Jg36Yh>Z^yqACp{=dRtUnmb|{jyuZE7 z&o#oC2DGP&Zjh(fpsgnph=juYUYUdbV|&18d`LDUm_RGSA<-=%d5qoWG+m%PQPSgm zN%-Nr$Tsn>i{Pm@mf&~BbGk{l*XL-8G9So;Kg7qZy*=(m6MEcC{^UaeNmiTyb{iYr zmP$Zm!-L@pa$1*_JdUQsf(Ik-nVJS*aVJ`g>N{@I3sgHl)u`AS128Z{z5%nG*16=v z-?~SoUx;b}B%-L)*d8j8PhYnjO4d6N*HR}E-;3 za{disjy+i+4X$7+h(Q{&2;d+E835aNIqDd$Y+J+ErCxF;J2S(?e2)^36o1HTc0F~G z5&(_4Gw!IUIYuv4QnY0i^cR-C`X0#Oy3I3a_t_XAj~ZzRxWb=_p`}zzdYb}R!5^m_ zOh*fu7OX`PSzcDM15im0LR(GN{z$^;CD8U~J`A6q=IIY~sO5dm+w|OA>XJs)zt!!d zR+4Fm{N(XduAbi`2EohuDx*|Nx%-&4qNn<<1oy53nFfx3Vua7)76)F#lcacj)4$^SO3M{AXTlAb?IFe?IGYJJcgvp-)GiOD`+2bWO7Wk(Sm z&L*Q9PmQWk@l;d(eF;~bQ6R3CobAWKj$~)}Sucu;;*(BE0z0g)11LXE9av>rgelmq zyc|#YlL6kb`v~}2LTj+#b2kdlUTPWz9z4H2Eqxu`A?aklSz-`;&@zKOu%(#Dq}Sy* zJ80g=>uV^_*2QMMoQ#5?(eOjD*{-k;)JZRvFDF5T6FhRF_LbE*< zHy4Mz&9>@`Pj@e`!1sq=H9-Z}ESg%Mwxcr@1*;i(%k}iY@0$Ref};O2w#mTflG1WA zM@ExN20at01pe`z{**0HO8lZ)ikcBeESVGAsl!Pi5q0d4X&C}0PUUA9>$w(_e2JszO{5_M_{MDi zTmzJt5x+Ke`Kx_$waI=6&lQ(5r9Du~R|Y7Z4x6Ja^{-wso28*rB%^Siu6Vv&M?pG! zibb#02OjLAkt&lI5gj9FNC+w!9Oot@l1-;^zCg5X7zl5(?y?(|gxftQ)g_HW##`|Z z$xrj33sK;3hED$cywiHOl1!EsQG1H!1eLMcUu^W#_z5^A`h~W%x}8Kc7-C*WDV^ouF_y zeJO}tvJs%X_K25L?P9zEEi|XeWpcaApN^woMwmsTb+JcGl4^#YOHqu3_}LLV33aGL zSHW(+4DuIRUtDXkG1^CupMC#%w72$!=$dN{Dtd>zHa%%AdSScy&IsCijv5u~(j(!0 z4eId`6##5ICrlg?S- zWN8a;cd516Q*v?<<@cCIzbmnf6%fDh$lD6428RPJP?^B>`Z%EbGWvsL7b+C%qzi?4 z&^GXwl#BuM1$kVc2pU2eAAPqqs(?|4x=b*c&5#Aj196#p=(l?$i(5{}s#7 zBKdFoKkOefL}8Ep!7qd0zc+Fv3W@=UkM;@A@i`BnSLqVJ0}=yUTnSyE2jRuli6J9$$kmXs+7g6X- zDC|~~6tGCx?DLmh-LRlw0QG-@C32t=@qH}QYfd&FO=g^AXyEh2grQ z$)%EEwr8a0$ltn+-!q!SLS~v=p|9p^tW*nlHh-I!5u<~`A5G?+gdmaLJ2BMuytskHHO z96mRPQs-^3v|BwLI3y(0mpXQ}F(-kNzfCK@A&^U)ho>?GqW1nu%&=ZT%w1`nR*~gx zKGyXigW+l1ey~W3)NRR@2;(Rzfcd{_+NN>@D|Az+dP^&1f@T*?T5Aq|!3Ch6>QCXl z!*5dLzJtb+69jqYHvR}ANTF3|Q3GX(T)WS$90>0jP0)F@t#-F+#-q;z594b9Lj5Ek zA(I}KR|g|vV64aJoFA~0PQWDE8vy!p>_SP>Y6TtVs}c~Ls`^E8YzSNxgj$Tr4dd#8 zwP^&5<_?&_nx|=3rv|Xy@pfyVay(;rm(Mqvm=sC4&lS!)$2(IP^Ia{qZ zYAt5T`r?etY24;at-rP$3}zsVYar;|G9O$an|C! zqD8860xxJ0Zb^U7V$487+HqCx>qdSA(>+D0$H;y((g!(EL|O3echscSn^ z6h9HR2{cq28WU!Y&*g<~4&K3pu~}N2ONp0(RNDH8q@}?i12q{WTaK3g911rCQ8%v~ zxGX=DY_f|`k-e`%&+21&N@rc-vS7ze9RNzWP&^jHw~k6hGCLrt*;w%QL=`9mSzwXJ zNg%E-8RWnUDT6Ro1d#B{G}l1w6we?ly!s;$eYdQ+>?xLp6e4Mehc7H)WRqI7f3-h~ z8zjw5yqYKknZuG}w(%gaA;G$qS|lL={pu$A4Ey(NY8pnrFqYBJLt8KmKXW1jse?8@ z#Talz@oKImgWD3gdTUe}+SsQuMf2l=*Cp)n2ktZ9Al|y>I92anY6A)(bt5RnL{b&x zT+@J28xzU>W^ z?0_U1ncPg(sq6gTPEP=up|H;(AN~mDklFq5cQD5qmLmPOJ%MwQ*TskQHe2VqD%?b2 zF)I+R<;1o3YkVoG-EMyGlG?vuXaUEn3Y=mG2 zpCHz9PJ=Ew$ST)#QT`Ro6;(_c9uIG(k2vDqe%}vp9(@Xfry#kH1QuD$4{zZqShV3# zUSat8e+Ry2%SLd9%Um9eLehymZF&lMOsHO!g&?{KC(%VRMFG-u>hh-e`1Aps>C`#x zr#t`@*_vK^HU{*X&Tk88HT?|jD$nL^^0yJ3@6cA7aKTqCvYE;P@)0cv%f8(mCAP~c z2=flc1%W=Vjf?P+R@gBp{p2o56~TzxAh&}&ODw=GyH{=`+syXmvWG5$kibEQwNJ}8 z<|<#`++akxiQ}L44VnfNQ*}+_24I|t1Yn#3RHp2b!TY>*$XTrU&{l1SJ`bTzrMUR~E0^iiA`x*#8@EQR5 zIJHB5LG``qVrWZEA)aAmfeDIPf}zoD7#OaM2;qNbgwa|37S8Z%jTU~K1B{}cItj;Z zzv$Jg_UOa2$Whle9IuHk5Nnd4Ae`k9x*Svt1791HJhkyUdWxe;`stDGahd%szs>Efeg7eQDX?9JMv-6`6xA?1MtcHx-Y&rJme5DvhmBVD&0HvPWu}p7pIV9PLFKMSg6y%V7qPy&NIc%^*bIZ;lc;JV|0g(`~ z`wF5rOOvR!6UR2JyPf&nKoQJ6#HQd2g65>^zrRSQhUTV+n$O!ud`(E5mz+zo`=rln zN7>7W&1~1*6FOOFc+6)OOpZD}moO9|Ip=2?6w$J_031~%l={5RRDsJN$d4dbC|GiC z!iu2%X9L&Jn2+quSK4?iTK&08+c=^mp2ev;H4hF5rSihAT)Wz-JWwe|D~-?Sz*{(pSz4$CoR)qUbEjOvCS5L-6^ilN?f~=5&IqEcCY6E z`d3ZMBBMWd2&GJ`?z(|A+!!v4KwM$GK6U_U?`1b4c=w1KY3yi=OgmI zi~EKYc>MtZ{rG_xmJE1pS2N{#6WajYr~LMSzDZ3g@A#xLrvrlEOD5nNE^NZtQQZV$ z3D-p4t0c`jc|r6m-x_KoXa5i&;E`p(w(M1wB2te-u1IJ=X?*G<@NAE`wj;sGJ*WZI zj5XXa^u&8&iOXS_s4qHWuLUP3l!=+EDpoFI*08WZ48@wK3rd=H*Cl?q@d8GKNoE|9e+Qm1xRZ));J}N8}l8o1NtlkkCS+fcn)Uk z+iKmHb0DZNs z$~tA~8izZ}>Wqnl5vN|*W66RXo~y`D%m04#njtlL%)JakogYypmfXcMsZX~!Psv%{ z?|vuSA2mp3tm{tqa!h(V5xK)}pRqoKgfT}qg0gaLZl5C8Hwg>Xh9W2B)dWMn3l2s= zHy^xgG+*ZmRS6|T;#&%dK=5H%;?P^(Okw%H!s#Mi?x|B3e{pb zOK~A)vJkZ4s3HW+>&|eC^xgVchb!f5HMQ9^L7uYIo<9J^Tj z!%qhv5MOjS?E@fKp1hrhxYxD20O3r48!>x!+^vs&Ll@3~Bn9O?*8ct7AQw@sAF2V$ zwk3o+@D}0Wk>uk(XVp_%&ZmvWaj9k&TI+tBO=I=qdh@G-eXX&+0qZvXq|r>{Zzj6$Y7x8Hb$@SZimA48Qqz7ND~-+zY~c?zKqs#D%p zGl7d_*~?IPa~2XSljlOh;2S3DKlV7xe{w!+4x{Y-@_6N>kQnma$9@4SMx=S#S2U<^ zgf9yfy^B;o8-pfF0rlYmLRTfFf-nXa!5;ka^_G{5YEP}K$#nlQHihJRMQw7wz_%NZ znK!pTSDmVA>SUA^__lNA3rgbrs-^Q-Z9%16YxMBNvq;xM#Rf?xp2^3BWoJ+O=Ok|( zL07dNym=!TS_=}eMtGk;5@qcWgxaVh;rtkIj6)cT5ux0_wGg_V%aD1d_-9E5TLlas zf*pV?i(~V3XEO6D9(7Yh&(kvN+YVN~s>YM%6spwC4+`{};vZk>NScZrAbpna>c3Cq zrxfD!ehTUy2giCejJS~@+TW<1FjLc|poRhfTOC=dNKJ}n|NP-7vkTceE9vwM@_m)oPW zo21;Udy2oTzWb<4Bj0$MmVQ2W&|VVPDtwjZ)ko#d2FY+_wkMf7`KdfV&_5{9AU}|V zN-;J%i|W4qU=t9Nsk*4N5wMc2sww$uI9?Gs#nQO46X!j=WB}_s3;ajJ_NZh|C0Ql` z+g{wXFA=0=tsHKZ45xcVth!WkQz_i0CQ#l7yZq?J3;`z~ybhvGcloll$umVYz`Y(^ z3pajPK$+Lp!4{{K-SBXV9i~H5+ZW)!oJ?$4;GvQ*)|PDlVhR}p@}N%%hU>hvw`CN& zkB0VL+pqQ58;d4UdhwwMP#)xlB2`tgE{Z(%AMkatad%XFsjrlqoITGxy$xiS`K>M$ z_LGDN&De5j(sbC=TA`6iCprK4o<^Q(zL5|QZ$hw=3@;|yf5N?3L6h1^sko29RQD0> zi#$?CRTkgTQaPEw&36Jgi5`&pbKJ1ju^^qDsKAdq$dBAp>VU^XuGKT3dg`I|Ax`#bJu zVi=u6aGKsHbWS@s+FNqQjBha?Q7)4}RqH(sXC9hPLn5Vwt|od_)32tpoXE6UUXZ^O zuZVI$$i3%-b%k-H!)GiHsV+)S{vPkzRSe;Yla)g-%8i@cex=<=cEj@lje*qdtZ-OK zzbZ_Ex{%JEKagnl=$)0?T2efFQStkX7BPG51l^hI{W#|Ff6ggEKZKX!pG6F<2GCO| zR}MY|*)ol^_DkK9b;~j}oQJpHR+^50t1>m+|A`v=OMzQf7XW^UY!A4Rqvq*W>=UMbubKo| z#NUur%GrJMmePJj`B%XSIzgNla42OV9Rfs8Z&>2?v$tW|L!OF8%QatccLQPE( zm|Zsk%0f8^;tpw^=lAX$g)X{`eZqdF55^eEOwgn_iZ>FZ?O3v@wEiC-R+iZJS18`a;R@`hWVn1tGgjD_?vmfZ2S!cBuHd-<0RBO_7Qnx)}G*fcCJaQH}802?A@Zai|jrp;R0$;46+Av$q{Q@}97VCPfSEy7AxfuQSHF)FqROR!OjUf+H z*P&jU{N#-YdEkr}Ml2U{nT8l?x%Q6w2gu{FXuiOZ!l&`y?OZFH!p1J}ZAvD%2%!e` z>n{&$-vIQM+N>MU?;m%%jBdGWMn5AetjR{YG`V8AWrjTKG?N$o#}*ufC>KBmcdVa+ zw&5?)14_K9YB3>6v`WnklOzZk1QC1jH_7_-BznYzf!=rp`VvqG&o6E@EnvW?+= z!4VFM5JoRH7}(oN72TCd6T+7{~CZ1fYPGHZDC<4VWh4&Z7#Im@(diGqWgKPv`qA^ zJ2yR(Q*xgO{x|s8SA1JWyl(?LLB3?X7j}gyF%hV0G+95hisAV)BbD$Kb#3uo8jEu# zWRCC?UyywTxKpyd{h3C+=`x5Z{v_}-R?zXA5P&Esf?e%j9QiW`Cbs@G(|eilR?ms) z8LQ-Bm$&$4%1vbp>GNxQOkQgvN+h{EdpB1AUgSIU1jBvFA5n(<7>H6w1EB*gPVO5c ztF{$%7ka`4z?M@8fZ-sYe62sdF+<)7n2~`BiH%;DhqvOG_3_SNlDC46GREagXxt zQ~bzWfoLT)Sgx-O?TpP0B5neN=WDKk)cd)^NgJt&draEH$BjY5X>DB1`Z|7 z!}|W`o;fqdN@eTgZ`MrO>epB`_*YUpge3Ph6Ps4u$36A=miCr5`Jwv%tRK4&L%d1XcK2u zXldIw?i&|2W}ebu{;jU&nUyX$GsAuQr1{G^OFQc24n=OR^pI*HR?^cF-NRhUc7bM? z4kTMmfivp3EfKO%W1#(JRHpmEKR&YeOn#x2Av6TvtfrGDge2E@HR24NQlgK*321Z? z&+2tvVIIGd-06blj!lo%e|zIDF0Sn(EVAA_rohi@&- z#57g;^?vbB4zAQlNzD?%3NAxDr4mMT$*QC;W6oL_{_1=_7v01-70+`Gt?YqcAm56W zr(>-xiK?sRs)`SiXq=2RJlp4#rmXLaW%Wbc8BjCyU4GOF?3$0fexMjgkCTqGLutmj zafHJ!5|PVIXGHOOuiu-Y6wg22>CavE{P7}E-HB`7GW(?Ld#E+kW%^b za6XHOU_8y6`c}5Q@3n}#J=vIVf*nb+(2Lh=&sV+pV2boY2jID?Qk9>`a`)%u$VEEe zO~R$)e@jRfM|#`k?-^ty_o6`7bGpBQYB+iY9eeq~%@c?5?6H^S+wmF*GDc5}-=AQj zwaM9MWee_gd9zdcohMm5LNMVLk?B(-iwk!8c}SqDy;c*^r$*Y9`L(lg9UT5S$@SAK zP54m8dlZW+4nm`f{mu&@DlKv(*=3{mNbV8NDP`DCqwhH$lvTq7$XCGka~jpR9c-k!$X&E&R^h$F?V?Rj=lv%3VMZd zKPg^xY9=0+{hw|TR-~k#Ec8K0M&ei#`xglU;UionBQ{Oqd?xXdgplNr@0aj&#k@Pm z9>&MQq#<#$cvN|o6z56cEch|`U54(K1d_tzzC+d+dqH+X$GGNi3$b?tGaPNBaLER!ID; z$PS3d-%iEZ9Mi!%`XQu%SgpLuiV^Ba`d#>9%oL%v?+DD&`CmXqOO}9IiUMW*=bMz{ z^9w!4VBNkqnhr`*KM^FDZNe&$cxAQVNNe0f!=WgwS|=rc#c>rzW|MNC3$uh`{+oU~-U{~ja2lAtu71(*cu=JedYKi13KYwFDtSV?=oVRSgu<3SJ z`kxv|7;Z{bSfZyUF77h!ExdVh2WT!ocnRNJeQ9TcvE?->%svzsyE94aau1F+{)VqX zH(?(1HY_BG7V=vBpBMX+ak_+e(%`)`Ge!MJ_wm<%Wfuc~Z3HWqo9rJ?@aK;oz2NA` zsM^CvGXJMS{|hlUG)F85`IwY-BKeOy`0K}5MR3Kn#Ase{|Nr{ek;nJ3G1yh(mO}ph zFJQ!xz!h)U*ny$F-V zexEi!|F3lbLm88uQ(`^hw_E*RKi*3RBlDh>+5z@w7ZZXmHqV1KVgA|TGB#-Oe}ndS zfBOD!(EekR{BNcG$IAYDrA^ZL&YiDvcL79*-ZUtAdUkWw{^ynx{saaTPUFfhP zig^nJdI>N9-Se&h)Z`kH&8pGIT%k~AuND9q^!xxMP_YXb4}P{ENc~J<3rf#8_y&$D zc0josPs_kb!*26UO&+nH=?mIWfX`@}uhRwil~6$ct2-{cIxYKLYq|YfqzfIYt?^je zOnU~;=ZSaSGpmnkdjwWtRB5~6pkYH7lOdhcZti9khym`J;u4D%sGlqD#eAj7r zij6LcTn>tj3{n6XO<)EQJBs5~usGmZ3Q4fw%MN?#YmM z^D($Tru*@4s6;W4?S@D>qHNXC)9!%ot?0_~EySC<*m4eojICWjW#6a-B<;IyknQ*^ zGd_$GID|omwka@-vZ~XI$Aox`dXWnKgGK;bvFMO~HeK~_!Xq;28lEYzV?G!YY@zNp zvByf%LV(O*+^#Nbjfi-=dy^Mu3b{u#~?9odLt}y+jHB!3lP>-A@9*HYVwm_(|6;V zj1K@rBWv_s@kyIALL_l=sL!Y($%9gmK3f;Gou8E1JEMpKA&(X3F#wMk>f5&6TsK_* zx(yNn>uD7nNT2|&5DErrt3t1#30Q^d!BvJlRyp0DQ@!Xy^%54<)VJ&EEFSfoIch#q zNZ^1_CU(FtD7WBPiwC&mg#l#(wpdxczH>RFQ`P-RfAFr6g0x=Xeex|hsrU~Hm6#Ls z?cYznnSpfDx}v~TQWxZz=zQhBx3CQ=^N+1lczXALfUvYUa1OZS94rD!i6{!o2H+eu zej1TcqCBvZV#d4YeRbsB1@MMOkPYe0A=*)aAj~{fJ8!6h7cA3VONum~f?G_1V>6}z zE~RYVh|R}ctayN3{LJ1D zkK-AsxH=N|SBU{E=Hk^^?%Te|-G0n&N#4rYJLD%J)}Py+V&tX93!=WVGdf?y&o_RQ zUs3`1#avNRx=;JjjIzJoc@W13n8L(I^%G529i;%F6QNo-eCNy7?IV2#W~1;fu~V_DaxPC>EL8N<;}ys6DD1@+4Y8A!c5~8=B2EZD-sn=Fi#kzA5RA}$*_&ElYF*(F6J)>O?%n~or8e)j z-WDvk_LyxMIkCuAAF1m6?v$^db05OUNLqT1z?kFQBFt+AkxA@2F<;oRI*F#s5bGmg zeHEPt?%XolMuqX)SRAe@1&eVtIfO1}yFTkwO zPZ42=*b}Ve(vBUv4Ym?%f3w_H9G_<=6xZ7qi+xl~JaETkK7VE+P-sI~cw^)FWOoi2 z!$^EaE=7G+LZ5a}Vu1_lGwDx;9CmWz6d68&ESVqX`g4S+N>1IUz}Uo+rqQ65XRts3 z4}tGnxtPjxza`r#(+|7R!TdB4C@XaK#qsAZ=YsnKoNBKsj2QS9Ehdr9h5~&tC2V z?okHunn;%9xuU!X$patWkAf6n0uB^q_<(XBb{+K~xC)Zar>$U35Rr!`)QXdXl|8*2c^>vr5rwg;DR;>_1!VgW5WRs@l z-l&2h*m5Us77J(^kRll7IsvHE^V{i{Kk{o}Pry=6$A!VVnE}V$efK5c|GN^#!{p6G z)|GWxapq1x)x1(u1OyZOJS(>Qu!m6H0u7!_*5MeA(HHx}zRD}Ny~+37QI0|n^&=kD1K8V@y+-|D@e8|&ft7{tD;NE)%Wqrys;94=zE@d zd}^gRkNm-Ao>4qXv}9V1R`cFVhrJjj%Xzo+mkEe>hKs?tPRKBns&%+?A1GuFtzFi zda#r7QI2vq#r!R*8RWmfE}n38B%qX7MOO{IB{?zEI~w>T@zAQL3>=R2YK2et3q|B5 zh-!8kIaAHzRT;?F8l_xM_2bwsWLr*_i7vV+m712B!Aqm$B!ISptG=N(be#2Zz4poz zin%h}q8!q*q#Ual*eh>3Ckr^Eu%lufhYLnJPwkN$65BNIPtsrc$2;UqYuVBtRxm8?GJU+GLA+E}x&6)*Kn?+8w)$>R~cO7Z^0qD@?>Lb>? zwQl^{8@j^z<_aS*(zD6xfba)IbxJN~4k(u))jQ!sTYAch_fP(r-= zLmp^i$`2LH;^R@0^l)59F7~h5-}dGiG#%r}`SDq~yhvQbb|YjQY4E$>xS{*^mn8U_ z9hyf+0PVC0T;t!6J=^LC%H{0uwuE;(0n%c_>dEo$Zj^VUt99f{lvJMa(P}Hqj~^<` z46?>~w8g{qWV=NAX(2lf-TZiM1!G@qP3qhc2HuH>3?E=QKMY15BnJz8Gr6fKR*@jG znEZq|^TP{ZOT?{%Uh&lGlHY-(KUvi^K99(R6u~{O(DxQR(LQIbv;yIv~697pP!s3ZRK-Di5(7V@kp7999H(A*}5D(FPk}oaf3##t!e*RKVLgH zdw~6Bev0dwai??8T5Rpye!y zRB8Xd{^8QS~a z#L+&==MwlU$CM<2fc>2sVct+-heNhjrTlNH zJ3V@F?slH{v84-7j|-jC$!8p1sr(!TfP$-OJ{*R+K(Y+C_Tx0B0V`ICQ6n|iGh(1NS~(> z=K1|tdQCNwb3>Lc#yRANGLtQHX$K0=F|ROvh<&Ug>gY=sK^3I&lSPVc7;$oJAeNsZ zJ*mP-E_EHiw&x7WctwqImzesN5$%ac-R?psRdCq}j*Tl6X=J5zjNRGBDqhYg$Ptqd zuCID(rNSYZGFfSVD^zwCH9lEhBkOG#2Qsa~@r?zN9u@nKmZjM7*I{Jy?N+>{iGg81M55zLZv=^k7Z@LlDC6!OCquZiXnnxHg&$* zrC#brSG@J*8tg&LAdT0ex9BbUd>rS8-nKS$^YwDyHJ_nb%+ASvCj3G~D$N;_7UfY_ zpVSzsQ~Q~L?q)81j0fWbz{32om7TQIRCp>7%2mMW;_cG1?3VE--=KgyU+7}pF)8SQ>}|;zQR5Ft4oIKK#$y(FCZ4@^o=3ta zee--_Gg51b%~U|qB!GuWqE@kHFVjI$>H*v){5VooI&tv&iRp6OBY8rnmAb5o6jT&H z6_jj$7}eKntIdXAmyMmodcrKQEs~p1EV0(U+jzTg2xCXpFM%GH9ikwWM4ZFrb%zr= z#;#XobM?Lq8lzv18)PTVaFH|)9=~SyRegc=UVtJisVrQlZV^pl10ZwL;Ot|_j#l;} z?9yu(WMd*o6Pf<Hb?v`AYZkHVemmGe5ZW#sW`Vzgwi1lsV*wAS zk8)1;$js?~W3+g&aME^4X`{3wueSOIa~Utna*!pha9LXgJdl#X!HQR2nc(FoYvZFiQvj)aL7;4a<}^cO>n3Q@7)l zHMvmtI6wX#b2D!0#xcKwS1>}=={EQ`ze1jh`eNJA_{>XbcNYe9pFNK4uH)M%I&0w#}?SwRS&q|v~B>K79 z?V^SKi=tRx2mUqo@to3qsidSsoK*41kI4S`q@U{>N9ePtJI>OD3a)ii;y}=jHp`8%jW0GrN(B2T#{-UyPGpl@{9iCgNM)>LJcbrsMo&8M> z))R|mQjxmro6k4~`GYFyOL?hP?4tXE61-L+)|@c zW-(Qm9Gr?e-?46Ju8QoPE7Kn2ZMmu?(~H;AW*bM=B#<88pl^TfUP_e$%85TSm|3Dw zh`D@I*x$Du*<+)|7ZFhAMN}J%fHgm@i)zH4X9Mov=sZ z?g|(;WmrCn^hO=*H}t(N$|zENQy5g%ph;#vxtF=$-w?|vPH?mPgdzc<4(pDD>a!EI z37O)48=;;l`md&-fdADi*C3y5>&?u4*R`1QS8ZvEXnDI%SSF@&1aP^eInGnE)a(#q zFZ}|WjQ|URm22ynI3`uEBHh!x4ER&#-^D3YtderUhaLUwa9%|z##!JX@S~@0L~guW zOm3%1wZwB06+kj-&kCUMlwV2S^DPU3QcUmN0tfXpWONe^XDVtZ>K!um`*Gc3Y~ZQ# z3PmW{Q__5w{*7^C2HF%0*VqRR>7xk7%T`TNT*YO&-bRhz9Iadw5Gm}$A4)L9Hw~9> zYgCBPF&WVYVvat$L^7q}HYi^u&#O+&(Z$oa9Itg0-N!WwVkRePG6^DU=eo73I6>d{ z^>MhKTLscOH~L3HOMLWP(K4)0nDHX1>uxz>QY>0P)guPNjda6e~Z?Ab&C8EK$F-Vn5@%zX%zYE)^Ut1SW z^!{j>ZH7Btq{5cE#<~qN74f~gwP81zQ66w(RJWi9z?Bt>XS`tX8-v02)N2?g=2nIc zHn%Kex8ds#F5a-9^(0C9Kf*eSz`}ik+iU{6wc8cPS4?6-R##^4I{Q#3B$i2Xr$Y(p z)3p;mY}fUg6#tHlMk+7<{)#zk;z61Q1Mb1Kp=X^DYk6C`PHQgB$CrEjPQ~0C8?*JB zF7p4X*|KdS=1F4uit!Sy4J77uhtfs}?Yrbn+|4D8s zQf0DHO-jcMAszLutt1j5z4(TtJT<>;Xi=cVJF^aHUh2o}++;nWj(vNIQaL>dyhnBF z7p6c*iu>;TbI~=bM8%SJCf@e7lEujqo9t148E2=@1=V0Q^)JL<|B6@_1)S)#kuF`QvvG`p&5nM>$qxc z3u!}!lMbt+S|DOJ@nuCVK}*uQYY#*X+2t$$6(v`i!`J!ONwGZYRmBn|63l-%E@=|1M2n_u@ z(N}Ep*ZdrpJ|hJp_9$&q(DN<9!jyhXD^UaO=`w((QP+Oq(`!X+<&PS8IKz0{- z_5NB~S;O36izpjBobxRP(dBoN4v8e0FC)mk#BMGJgHq)C=OgbQkse~C*uC4tkV^8Z zNh0on3&Y zo@=5XHx<14tjV{%^N6qqV>NXxb&O{)0n=78R7|;ajG12VK5rx%kR_}czvTqe-eWuO z=AX-5xm;Sxe7z$3lKf2D@}o?f-6p75CF2k_MwL`5Yru9>hA}0+CS@J>&Y4B_a2j~# z@dPhtpI^cE(y!S2`cn?|U4-fs<;B9R-|Z*&SRV1k-}EmJx zS@?|4E~Jp2H~4EocU7~M+kQn9)h*gPYP$0w?Z^`Hy|w$j`ytp;c^}%MUh zynyxbZaopKhK&`>b;M@R++X?}vd$L}R_M69HQx1xPl^vAkn?-6GJK-z;IC4NFv1lj z+x<|a%9OIS7;eGa6+sjNlKB9q$?A2l%?Pm>X5V9O7s-5YD_pk%aUut45YGYiy5zfc zBn@H{ZQA8?f;toAw<@TqB>Z8)Bpy3$3XF&YgUR*m;n9M{Ld$-BH`mPaQ|x8;BzzZr z2Z>kSdvY%Jxb4^3Zht2!SQ+e1;%*JRun!&zhd0FKjKLOkVG+5B0XCH6p z8KiSvC1*byX;z3?%(;9dK<+AjB5u&eDNNdW7S$!MA*nMsUe!}Up5O(0)voj808SFj z-RD28YPsTl_SQ!xbw{8#@nW!JKq`4%(2&WarmD_ z^6uCPz-Okt`AoR@w)q#=(<~4Z!eJc=7B|w^bthSvBbUOKL5j`#mdV(iel&RFG^%T! zNcd7SM%q5VB8i0@9rxn8Z=6ThoygG>spJ4!gj5eEm9JG}$#&RjYjMuLZ1PgQfoP6= zQpv77@saVK8s)IoN*{~NXB)UfZ0(LnC4@URF+xf)hT&+OR)+6NDDO~jG-9U!>hO|P zM+Qbe-((}F$s5dx7uMyaEHwmcU#vHIhTATCr37P3)Qd=Z9kg$>7Aaou5g3o~sOcB0 zS%Ou=Cg8|nvFFWe)KL}UOtOseGW=&__!@*cDaDopM}lg+b>wNj8#s3l%}&L~YjB)k zns6AE{q6qcbc;|+t`ldj7S?8DkE5NoQAOUMJ)5Z#mVNghzeYG7F|S(+k^4gd$K5-U z&0>$s4@L;XcR+N=6^{;*a8Im+ZOK><<>`9!anzR-Mg+619QjSKBP$>4b6QiThl-@F zpBv};@E+F&pxtrJ{Fu;RKFYCIm1O1Hg6u)2-v45d)LSESY3SU6i3E;J>Yy3j%WOoD zD%lo?dL&Jd)>1CqJG9oK@{GbZsyv))ZFLeeEpiknTugCcM=n)JR8#?&U~UVKWH5Ka zy9l$VD$1nxy_A+k!X#^kwtLB_ihQnRwTbZOu9G@fA7pRAZoA|I)^U1Hd=6(fpTt^x zB(GEF6;Km;pwfv$!t_Y_*{a_GW&#rIT6wLgt1R7%depT-fc<@{dMkscLqFv-WQQj) z9P@%-zzf?uJK}+?8j&(hry~rmBwryyIIbwtADb{nxKR7<8BWTR9Wt}_Atbg-j$YOy zzjeMo-GE4vHJxX%>-O^OBJ`3{X^Qx+CV`R4=O*jd$u;pPhxGlAe7KZh(O!Z#Sq*af zg%a2wSxMPubV#4DZy5AkzZ|=MoY>X|>m!LD7(-tU0v)^p-wsgi82`(wb!U20&Qi#w5;fzAm}vX+Ha200b=rHVxuW-S&$?gQoU<;6A_30c99niQ%Zf;LY!Imz z*4H29@${rIMQo|QXj0FD^zO!Ocf>^ElYZ1Dd%1sX-Aay}fT!J4jy|L zj>fc2G@pi?IiETVnG25xMmV`m<9MeIe^2ZFf(2Z7HZubo(8F-g=EDHJ*=%ccYfcvv3Cd+NL_&TTRME8Jq5c1e-FExk!Rk1;}5+-*Xh912y|GQQ{Gyj5MG)LPMt^kydfQ| zRwX)9S(xxW`FaMAnbp0%BDe&iWoGSS9VN@bb(A+4C6UG{d_Ca~zj#YwRK8t{dHsW5 zrf2n1^gF9FT7M9wV}uWXgk|ox!9GNBSyy`mg=VTtw^S+gzhbti(IjLBJ8biC4%jvEg8c{I7fos z@=4Ari>iA{i_f~0){z~xza4OB+kfMD&*$LAHg+neWXyW}il~8aAQ~xd2|@vDk?6_% zoy17GQ1uZMN>9lJdQ`ZKW5OwJnnRizj-u<-_YsqoJ0+$&a(<(o&qUWy={%;rVLBU& z#>j14h&T+6wUeKakK|t^y*GOqv{*7{fhoiaGe%=!ZgfeA@!}PqC8!7@SIYuSL@u;U zL30%Jlv=!_89CRO#FIWV)}xsxyhpL0YCDv-+afI@wv8JsDp|%MQ=vmAUs> zc4p?A7SOxi{kmYbwjgooHLmpNN(3l%^&%PbwigJA-iSoAHMnj45Whqwgm;IhCr5<9 z9`I-p-4<| zw{-5)_jUbF13t%A77)4`u(%9OdK`@9_xjOE--)KEt-}+iT}Vl3FrX&aw(?)DKCPaaolpHn zTK&L#oMXX$t6yVjBO#;;EHaBnHm<5;X2b=?2}ru>yt{terEXuGKRVc~A+VlZleU#l zz>5(B{?M_VfY56SpqZ6F@6~gP`ru0K$cWOVk5lhZ`gO?Spf{o(Beq`MMpMMk+K=KC z&GVlpdC8wi0#Xd5an$b#=@D$i{sGP!_d)p9N`%){-zsx-8dlhJ0LyGx6qON~O@qeB zI*>mzMH#bVIG6KcqUSTkAcGx3A4dd_Q>P`BTxMzW>4s&UWWx1_maTypB*u$k*QHA3 zW7-|AU|Ip%A?}N>N=OhaQVbY=d)HA3VT+fe8iv@3dI{f)BlkEK>pwjBf&;Ofq|nc> zojJ{=|9QB7A+oy_0nBz1bLjA9IRoT$F>0S5ey0rRjC4WV0+NLfhpFz)zkS8eAK8$= zfcYzPM*b%l4&-xgVA_s{`<4^R{O318SZL541Ocz?{sYeoWq}An0J`=6&%d=U-smE- z%K?SaCJ16T3O{lNAoLJ5Zr-2SrP?nuTbk1VJj4w4v^s#ROThRy)G%Int6$kGU#vwy z-C|Z3W}4)j52U34!erM_UH}PRiASAO>Z`Lwf4^uF*H76UT1459+e}T4yYs>PIock( zH-|=YUdEh2U^X@`Ur5{Q_=5sBZcEF-r-#1PKyC&-HSgbGm&O+! z2*C@;OY$b6{_JHK@=r`YL_l8zGAwby|1{Pbjs-eB`{t%K#ET}t_03H*tgi)7xx~u^ zAYr!%WKh5Jt;@00({_pa$f-TR-`vO+O*G zKsUXzE0S+ZyYZ_8E5nvulzUamX7zq9t7qXP&?-|c2Z*vaF5|_98pMw#H_?e(9;lIl zNrLB!Fy;-xFYQKT=nis2gs(&R3jSU9VSh69bAWTR?%(sdfd&Kdo;z*vt?JZe!1GZ2 zgozn+npRZ?;Ew=2c`UvgW^_(<;WfLTrsc7zH^-o9=(>Wmq503OFa`ooRaA=`#bt{3 znoT|qKjx~>x;FqQ<*SRpsYcO+{Nk$=esM{qY^CY(=OHi6^B?&_3j2vFPa#Ze*UZ+Z zFW>NpwtACZV+UsDWO{OdVwedszEPSEkHuTVUpLC1!-7f*8R`Yy?)tg@V zAw(g4FPdo}KEe-x$y2G%c$-1EjF0ZpdP6s|Ymg5>_e=rZlr>V|a1tSK4`N9#24E|O zjQ+aEK`S0Fx^;ko3W)xcc#0 z1w1^iQlrDl#CIuWUqpC)G;U@4Jt?V>giz3*Zp!rpHC>kPelZ`w2IyugrFlq7Nfm3J z8ey{%=quOL-7|Sn4Kz7$xTkH!l=)0|lY_ zb2GvFWb^6!DQh^|+K#a%WkOHS6K2ME|zPl@ZMqG3`ddVX>C(?d5yh zNj?OupD&9*U`B5!x)emqIL`s4+=iHL(7^lR0LXJ8=Q$V?c>w$oT{3buY@MdV(0lSY zb#E0Mc*Y;^`Rw=ZSo<#-cyKw!l?S=>simp%ud+wcPw^IpJ3V0@`me^9@E0w}EsakD<02`zf&F5G+_(0^@3S|#Kvf|qPys9)xD!8zb4^KZEFsEyZUJ(^2O-V(^SS`~Z&(5R#_^2KrY1%h zNXM4YJ?3wmNq^4xyGw)-mT1`C7MtHeu?9C8>1Nu;)21U00CR^AnMG9qEmGW)q&E9h za2xX6I~snruK1}^=y={=4R3O>EK7^<@U)|Q`+j;*99Xsn2#^RF5Cqr5DUsd<*kc|A zkq-8UEG3b=B$Iob?%7X0vKh$!6!Jp5Fq0Vuxg#Yvf1iPq5ca$@t3Tm>Oq>l+g(1kj_Dy^jrs zj-4uukaa?y-X>t=qBmIK?}vcOritPPZs8Bs&S7X7IFj!%y~l=zJhvRwW-iu*u6T9I zO^|&>P2&>?vU?jW|9&K2iDYmCcr{{ya_jCCgnI940zl=(KvoZvSEeG$@)1V+uO@JS z>L06>DP9-QDAX!HpJpg7QEj|DC@Z@=`hA{lg6_M?l5>Ch8gwh+Kl?nyq6x&~5vlTw z5pm%cKn6ouyR%N^*&Mi0(&n;=EY(a$^Fgy=3Zs?b8*Z741pI7W$-BNa#s+D0QW+7#m3M&@z#b2O z*_U9!ADNb~3}B+l3Gf{?r_yV34| zOlPIb>1ev4zQ=A?mkeF1`ZsW!vixkuL=$btTlnq1cYq#H$9&zET%Gs#bh(bq#1F21 zI)nkH#^BhJYo@GJV-~XWl3Y4;pF1<$1)K=}R5LP;J#deDTMN-ew-v8yHT7*G?thXF z4VffgKGlB$ZM~a6V+|+7q*EU%=oTlZ)}cIj3FsoMWP8!UG_+3)Qcm~}!MIeq)&*7% zJ~rX_TigF+fm$wqG(rt?C`v}kPDnzjuHCK3l2i+T&65>59 z<^NT1hhhQWn>65S{iA3R{7zW*;yIKrJ;CirhwkNC2Tgh4kJVT|1Cw;Kr?6ps5U| z>Bb9Kw+Gt6HnQGe$AUqm?h1qcfZy)?Zgd%M`@+WoTwdcRX$FEnLT6N|K~~&4dJ43= zh25Xfe=D5H#_)3kBOmun0+DC=V@#x6G3~eoZd0JuMamZd5$hFho4ljA)V3$|7GPR> zk=q@Y_9JJJ)%!%QucxAi>`Ppw%eUmie~uVogg`vZ&tk11g#9)n1?HB60OJg&CxVtd z&IS;=hS`e0M2#U3tIx zTOd>gxM0tTb33}r3{_J75G;7dP)>1X<&f4m{~uRs3v2_WOrfJKR|!(=Y|&-48CDcfs^ zjB8%!ruAowFQ68w!n)*tQ<3^>shh`vW8pKC*7kpCF$N099#$mL{}WvN6+N~-h2pQ* zD;oxXwsqpR!5}i*Iik<&U zi_%b}S*bk`|7RCJfV%jD{XyxUEn>?+a(&JXUs@_{A)Yu5#m}cT)VV)X#ts zB9seJqpa8&3g89H#XR~N3KA0~xKr}J#NgC!o{jzc-IMMiU}uIT-7{X*_@}L3(+A9E zrrM~GwztpZ|LA@n#JmVFY?h4d`+rPhtRz#=$$7Oq1NDD@5wvQd1#CP8B~7ZaI9vXl zb@cbZtP4dQD*1O3A@qm;`?7yu8~^LZ|Cm1iZ%h!T=3zpwZTx2&yr{*3E-%tLi2f8w zpzu9Jd|>2Wcu3ddA{iFK-hSWmzpOr8uva}^SxEb1fe9m+L7R8Dt-^1+!`~}f6D&+! z*V?~$3%?d6^l>WzXpw+gKQ7^qLqs~`C0Od3WLtmk-85{Hpv7*aiJaeVA-}fI$Fvz# zSuca#|6{12kHcd?i~oDI-+Jc%qERc?{`Nrj#oX_Ssb51H-O2+lGwf(Zd4DExqlKBl zW#gST|DU27(7%D%bz5Wf&y=xrMgo`%x=c`_@b9nrby|>s8%4N(k>zjqvR@&GvYfDl zI5Xbwn#I39Vnc%_rN}tff0>j8(4@o*yZv82BDf8ne<{Q2)o;V{>&G#0+fWJX^8fYw zudjmUGL$N}Q@*e8UzVvASX2dFiz5H!qi!fM&r|R!?~k_@MtBEad(3n<gFY-lJaBxd8W{$u;cGvw=n7JJ_H7qX{3jQICjyfq&qBZ=B$zZ= z#@&0<806M3-yMUm6_Eb%BEkXW6>$I@S;}f>_WQFpx8z9jIiU=3mNsyt34N($SO+q% zWWxuBmmt-g6Le|gwf}mNJ<3(S0$BVwMu_~+scTT{j~ z>OvFM7Kl}^vig|Y%P$Vfyi*6G7MBw9H*JuCmXXQE0f@j@o8~}vZ>85}U#sO*V;4{f z@&HddO&KJp$O&9ev!#KVCkt#AWP9*|*@WJ1kyeuxj!YzTgyLLuEzF6<$)?Qd{tawk zbmM6U^ttkR7~fQ>&Y=))JiY9l697s1MPGCeuj^k z8Pw_PdO=i$YPHg%pcKtUa((td31peO_S23U{ovFz8>17=hwnhjdYdHp_AJ^|&#P@4 zrR7zHe4T!olY=wxW^&3TtfE4`5Dw-S^F@1PCa_qkCKBwma z6f~G0X9Nx}qx^$N2}*;Ws>%i$o>DITqh5dD-u_<2RRU1Jw{+zi6@({*8j{P$)88N#VmH z2x{ec@{C>n$D*@V3a9$HokZTk9z-1*7a)FCYqB96xv87SN8|OXy8^2d2UZUF)I(JsV$$0n_2dS^YWFHfw!O_AV%kF}QQ@)Wkk04@axt1p z`4_+%_T3~1J;SsBo#?}U>c-`{-e~yFHaRF;J=_I}U---@NCZu1*+OL~LlS_)>O$lD zrrfx2*QP+y$q3;Fwo9A&5CIPh=8)iaR_3CT)x(X5I7N6N5TLspR(ox$x^1R@atd0~ zRrb#G5J8TUYq36H1w8*k!T!;ZIT#_?>2NUKYwK#AT|g=mdiP?9MDO%Y{CgM?nAYw2=(1Nn#|XsH2auOj;I^xlh;JyTKaYp zp&h+seRm}(9okU*9Jn-jj{vNP(^64I)&rP$ut2%N91<5$V~Ur0aw$1_22!yVlfcb0 zOi@>d3MwJV_905<+uxLC_``qAhUFT#ba%iM}Su4u2E8EzV- zB_KNBsCv)LU_wDz6xf1ac0r5l$9G|waML5uZ+4JJaefO>K&<8gu0E(Z*ECMR)Jwej54Q%lQ=1n58aVk%R_PC(Y5uFmeKmY$^n z1*?;_bfe)6qMD54hkafBhKH5rOQBCxV}#aalo)_i!)va-^tBuPHzb{vS&ZQkPU5{F z0TmaI0nEcZc3ZB_T0W@AOQwPPYty2Fjhh-ETsBfWbyK71;Sj?pKLI1xhoRx7h;8-r zK(0+jjaKk{0UaOO%SU%Ngos>VOrQ={Mq~Z-z@yn46l?Ph7BQL`9NpM9H))cV*%fH< z^PUd#KC)|eD_x_dPq@(p zLn*4WJi1FsA{z>lNlZHTAfXyr(i=G6QkQ{%w~DGLMjE|6EE%(zTstQ-=NN1g(IXx} z4r3}7=aZFu%?TLvcqSY)!Q=U5ha%eH7U$z;NowA~Bh{mQ1vj9KK&tXeFMid1yUDpN zWZ~ZHr?K(tDLEApek4Ms9{7U*l4DNd4Q?3ObUp}vmocg|xz|1g-qDsaKuHw&veAY! z=MTdx@>8NN?TUxz@sF&cx0xPWD!JC*0zCy1C3dtKs=1f7QHhUas(#eG*fiS9=F;~yfGB-UT>(w|n=l{vuE;aCSHacoY3)_`wr8?2( zMntcT)-u~)pt|wr$UhovWOWztt1^? z&e*7v7u6ou*-1neP2Owumat>##i;HpkRhK{stkJBI)+j3mW|YD)pbbf;QQD38pG|t zLkGc1rON_*DcYv7x$mV1Q0BSS6m#yO24fi*jPIqmJ-auhUXvDn@+bKM{Prg014K2$ zLez1tPJ8_OJtVo-J@nUeN`M?t7tmpjSsh!Rty~{l8eoU(4+w=TQWmn`zWw$PgGi^5 zCS3O;MQcB!`A!n^NBYj?CW9p(+wiTu1@Q(aP@&8>Hl(%NNRi=~xCA945e|_~N?htm zF5BVgU0-v<$E1JmF-5pfxN?mHT(UXI zCcJPP=pfvuBW4TU1Ty?H56$2A52bi(_I!On{<5>ch2W%ZIqpQovD3k~qet+t;%7_coiGV zJ&@E!t&*Ofm5Z?T^aWZZtwmTAD;C_TW63K@8lZyRbJ?OdOFJvFCFf#N5yz-`#$^T7 z4g^W(y@5&RSe{tDw(X9u2)*zmd_iZ8aN%Mpd0ngEM;%>SzrJzMOGMXsgK!jH^d)e) zLiIJ=EUG1+HQNx{;FfH%o0pZsNN1NvoxdnU$?iQyo!50Wv%xtq(nnpPa6*_v%d=L& z-+hy<*p@f|DNG|xO^+0=3f!9`wysjyce%XbeZQp7H<{tUlVxlI=6k}z8R%1wu)<1e z(M&q#JQH9;O?~Ns4$1LUyZCM&e2Jib((LX*jwxB$o=FutHEp46;8pJ_mJ}84M3UeX zZ^Rn00T58M21P}^5t}`B%}#ambH4D@y-s`yjm*?w>mzp@Cm~C%O|QsZg}edS5u4>| zEtRh&tv!|k9O4Guo|F-CuI0ED zW7HQ=Ry=TSIJQfv53;$dsXu<%N@0B~xZ(y4A0P+n(^e~h_nv&V1i z$gP1AiJ?(M;x^~ZwG|9jTzLl*^^izrTpR}jyG2oI!s82FfQ)2A96FG*QfW@D!UTI^cbRS=uZ~UW)usAkknGQgqQBzid$W?sfbhtLKvy;RCHI@FpWZw0j% zI7bPLFN^F7HdUswaEb)6tGvHH+K?yDR%7+ml_)@#}#a_WJP`~OfVCljOccCsAkVP~egR7j4&P4E*J@maz!tis^Z zaqH zW0baVi|RbMO+(0h7#8NBkvB;e!_!Q7WEO7_$p`2FCnbx3Xun&>wfpz zH(5S?O8EYbJGbBcY-fJ=rUZ?KCvN%(s1g~8^$bJA2PAi8;|q45siJcf4M}4)8$Ygf zic=Z)wj-4^SEf+IUz5ATc^VX_Giynd=(O#S^KmG_Mi9lUc?NPkd)uZ!G#02LRV^2{ z&EbFDgYLLAPLbupqk)ipIqEbN?OMdD*OtSujda@FhE3YtsRvb_E}F`<#wst8S?9!X z_^ad|qpo0$Ui=^S-ZHGJwQc`ZM7p~X5SWyt#H0l2?hqtJ8U-dPA>Clmof8Fw38Dg0 z5~6_A1QAraQMz;A!}Y9Zx!$$*|I7aL-^cr99UMy?j5+2#?zpb={GCRC)OWJcc!K2J z7}m~82%&CPG?bIjeh__;yu!_;Ovm-ieP8VemFyF~L+9FZvFVgox1t}&;e zo~3=WI-AfNy=QU#f)oa@ln?xr0kWZ?F?Fy)8fkp%WRm4#o&1wWI9caw6#RYjn|ktN zvUL6eA?$ehWgXe#wR`P&c3lrznbo9}bR7eP#$)UVyX)Z7eltlvbR~~jLlh$}6m^I& z6us*X+?LG#9{Dj)jH&3^dD-Yx;HMOl>@J~1fBFda?oC}Bzb-uzPYa}e$1}@f%|*EJ zovzIn2lC;IgZ$#!#fxw5ahECR3?<>uz<^|KyG^;-ZvSn-Ep-)&HPJT2lL1g&QP( z#eF*u=x>=sf2$Yn_goJQSV;VkcE2I?l0?Kf#n@n zhdRAHON2+RyVVD%XxA1M-TqWvHvDR&$NK&bfXJB9xah%t&|ba!h(htEzU3W*6*)>$ z#TcQ?)~J-U%H@z~zq$Ek+WDx0yweqR#?f#O4CjY6C>N?wtf~rvXaSLdNB6lYyKLj` zR*$#FdY-zp(;8mqE&6gGn{WML$(ug(Iv!c}ag4Bq6J2s|)x4rTlfW_$J|SDO6fAJ1 z`{9NI_u!Qx_BCT0gPg$vr?FjnWe0^c(5!y1q<`Doz-=xCOL(HEN4}ln`OyX}s^DTD zb}UL)aNqNGhpE_N1w*hy&dp_#MVe}xTD%^L09g&=^iX-bK4#uS%^;ltt5;!#1*$XO zqm$(H#go*nSV$epMl&jv7*zv5?xWIbb+Tx}Z!@!ZCjPm8NR9Z9Y%KJ)Be zPG}GsADQ>8wj4D|@^r}7M5U&=STZr+maTmOLn z`KqhRoEM3w0R;|BK!ELi?B%Dt+~s8o-x`0IG!Cl@#G|~d%epq~<=Sa1=^R)F@u2AD z`VhlX@iL44^>j(<{u{T`R|ISO(lgzOmCDNqm(yiPQ_Oe$gJ#o0l&;3U@l8FhzqVkb z{H38zBGMxPQDDlEM9S1cEA__JPetE+es;LTBu*!-P-MX@j9ioJlVLNXqVignWKM*OP{@IX`qa8z046QWwWPxUh ztCY>;^4l$meRct6+nni3ia_H24ksgW%qUwQaU8!kvn(n%}Ov3;_rB&iP~zo0!PFT6KrCYXb73$9qB5YZ#<^W z3APQ9xI0gDIK0r&sk2i>p{fFu)C;A8+@?h2^A@*Nix@a~FSGJ4+O*`YHZ<{cT&7nN zbeE#&vyezkqNLjvZ2MR(dU>7zPm$uf6tzab)h(?Y4DR%87Q?Fo*Dwp$KnNc6Jv%P# zHBBE!#c(IU&-_PZ=Y3aK5Ojkdu1wOm>F0Hb5wmmZW3(Ysw^=qn(e8a^+}wG|xI;gr zogHr7d|eF(cs{qH3^7wvdC@1SZyMQoSanpAjc4TRFIhGlS|6D;b51Iq$#3*A2eHq5 zL7C;cBIEL1+6AwpRnt988EH^!%&Dl+1lEg47Qv=$Z^j(;BhK1I-#$ldmJxpv#Y?d` z6vPG5Q%#+>;zbQc773}8U>v%YTQa)X+qr@`G-1z19uTxUr8jm2HUxg1F(00E*Zlta z*ITahIdxr3B}=j`wd&q@sdn@T9Pf^ilC?mhsLywV#1O!3Aj+a0SmF3xMfc@B4Sm!t z1mF$@kDlS9S50^hQRI6WpZ)GRgS@E zLiI2=Yd@+FJpEjR6&t>0O_6wUHOg!gSKTYkgLDVI9uTioIyYdWg>@9Bsxt=B1I5Bg zVlsG|qp#f=@G0R$nhW1Hd6j5u-L+>QwLT+v&~qYwy0-i|c>aNR`LUzMcC!uTpr*BM zBLCj3bkd{?TcX=OZ&Xs?_yv*og5Nu-FK*x0RWi0~m|SxT_#UKuI?@kjW2q6(fF6>S zH63{c8aT7~3#9N(`QKw7#gg#bA(e&5C{!Ee^xm`TEY5BbJN!x zqe$za?!5r!siib;mU5fq)r0#F&3+QQ=xJ~j&H9}kF51UkO{RhwJ7#TLq_szBGiaRC z-nPf{GL50vI_?=IXm|b6*wOT?zh^mi)}^SD|BYYIV$ZSb=SkhJ;lQX!*YY&N6J#$)`{?w2x19n1r7rxw zC(HK*z0PPdeIxn8E$3T_kMCQzQI2+qB0CX0VL0?=bS2`m3WpEtd2gBaUN35kxxcyf zNklo9O=;o~_DED@I6cSv>Cz*g)e}!?HM(RH7>0nD;@7dO-{|d;C?fKgP9~`xH@ls& zXWxW4&zkSj1$EVLd3jBXE76G50H3=m`5EhYX6hhfQk;odapEf+cVUq0IsPmN$jFz) zXde!qPk$SDPrS=Oh|XwOm!*30Q`z&iEaBe$$Ol8uy6Qzhq_!B{CQPziC~I;psD))j z#QRv&9+R^bBYdGO3T;jIwJe-L9He4stj@E@62J0g15|?wTDmNRR(}v zcP}-D)NDn3h!snZm04{&8?o+r=P^l_?lqe+h3~X7q$rE|qx<#5^w5k+;H%^O>_C%Lxn+8CGTB=f9_P%jQ*_ zNpM{NA0Ed+f#NzRp*j6>t0%u_oZvjZaI42R;p$-E2U&Dj4Jg?d#NU4FwvA`cdiyLEYrSxZQ)ggNdFw&e1U`n=k86Cdt#k_hje?k zB%wrbt=O?b0^r_YbeY*=wzqI7C4X~Q zdQga>;z*KCMdYB!g^@d6nQZIZlZfp$*TUOoP3%8SO*#-yRt{IztykBbq)v!Z2{=Bh z);`V}V(RK~-EHt)N!)Z%Fl%l=z^2(WJ#Q12MT4MGO_FUq!MAs$H&&va&i4ukmXg*0 zRJRuQx`|V~pP}`P5Lc^65LAWo8;+d=204s}^a& zL%#89*ZaC&`!n#dI2IPr<&5L>yzX-r?{d7LyUe0V=_6x$Vtb96(XM;1th_R|J%>*% z8l(%$N^W_>Zd^I%2kN^!B&#=7OK}Q&VKSSI2rd=n_@&hQ$%`{&z z3Cr_vydf|<=CN|X&8bgm#FmD(mS81Fe3!R;Mcm+KVIhAPF8KtblF6#f)I16lc7}0x z%F6Gup1KYPk07iw%}x{b(v$+5L7Kc~!_{UnalUJ##+a;3$(UZD^0rSkML*(MA&qqG zlOv8QwL)}>Zk`?j9=@QZ*{cqEuxxti#_Oc6kJe7E(hnhSSIzd4DqF_|M>}OjJ69hR zvBWV)ubeEN?oY}Fv!Q6LRV8?5?yBqD?X*((z8@*o`Q~+B*N{sI`dG!P0dvV@`wXpA z^3$AZr5!$LGA}@I!3H<33a5hQk;!HS!?l%?hO^eo)aC>AuLC~iAEQ6v@3+IlDbd|+ zQyv;0-xu;>@%LDl9k+j;9PvHSJpCZ8i!&Uk4`$lY@8tpUayq>GDF6HnpLnj1Jey-c^%oY0%W4f_8kiW_CJfxT!=DM?my)Z|e1P^KSguLy6Iick}E@_({eN zB5`O^CW`<@2vgkWcP#6ojTgQtiHVwSkWu9Jc zU8BgE?eU)Tatgjhz27w*hfVsQ0x1_pBMZwI?7f)ntwe_F5)mm8TV2HjJmE+suW-&u z7%oXSwjIXugzKB{TQEwtoAD$=I<|0mka)c|w{6$r5Dn>Q=7J^P z_g*fCxn0SED~c=DEAYh4CYu3ZBJhS;3fbiy#jmsM(#PKFEqd+~dFrhn+0lt0t{`-{ zsZ*MgBdMjT;GX|gtoT}hY?ltlM$_VhPd=nC@1-u!X7xVAFoFeaAM_bS-1~$Z5hl_s z2n8$1hbWji0&iO1qz+swVDy76>}R?A&QTyR25PQcDDY)%zAvNoJrO-qHlS-g5F-}} zcaCxL4OX`@z!iAbegj|qi~hOJy&)rIx#$+`@e++$MV2pD&9$2%v}r0bSCOZB{ER?Q zP;c=KI8r33s)w_NFYjEwk0-;J;b!rH$BW=pU?}cM=0*MFhQ@8g`{SRSgl55`^UUmg z`wMT|d}94;dD~x)un{Gz43Dsw6zXE@RTb*kqY{Eh!zc}DQ@l5ZlMVIZ>Mdz!r=#}E zTDxzi*;^0E5_qz8A|&u5-W;uzFZRh0W|j>swOUg$vch}CQx$ZWG>l2*q!7i=?+Ccx zk)WbrXF;?&G>-To69wAc{9<(R@(;up(rw}Tf;4uZ;koNsLd~H(|6ss9f-Uv}9skKY zDp^8t5C+-eScc1HP$3i2&Zu!)x8{n2nxCJe)gD>x+jzZ#UModHI>hv)hqf@o55z{~ zA_g~~b*#WYB4z|#Z-$V1hQx%S489=zX#@H3mlauFf(CFZvDg|paW@gNWMC>j@j7(} zjG58-tU*=$NxXo;dyxuSyJEp4A;O;$cCn$)`)-9T9=2X0?qy2bTqaRtqamAQiDD4i zFc&fztXl}g`Q%^h-e5*?)vmx=13Pl@5iuF_!?Ju-tNf+s$4f@-$7UF(BnPv^oTHac z&Cz$$-MkF5_G9YC%g$M4lnRz~wxvtfVz|g*6VK7rw<_>r2;R2G6mdw=BKg zP+s(j<9q!f>;b`wm%c)NW64=@vmNTix3l=#4L6&|>R+?_M1sFPh3_mCC27GwehUHc2Coh33=ug8`n%Yi8GEiRKy%5KpQ1JCsKwrFp!=u;b^InS5If z|K}BD$Skkvp00tph?f-^Rx!Kngc0OATk?JdDL*)1m<|eqj~6qh?1)1M?UFd2;5|He zR*X%m6mOG~(7>*O9aDadx5z{aoy^7yNo99=hQ)5lyUD;jX9P4J!Q=Ca>WR2n_zX5pqJ+U9p*z60nXy(3t+K*W$ z?6z$d3-Iy(s1bY<)q90FfakD}upNg7XXc$=VvVA;h=x>?iAWCTDU1shUObCsrijr_ zMpM!tyFySAr%Ob1>wLH8p(x9`K$uV1>(%2XWqQA9vm2+X@UK>aDyO$UaZairtp=2> zP_OzdZ<-6cm`PWz`@~`7$+=NHM$53Kpb-7?Nk3}M<=dwRp!NR>(}89)%1)8D%Yc3$49)uRxv&~e?`IQy zGst{~BEdNzT(*cc!4&GmR3}It_~X*7t;v!|LSfAWM>JHA-lLBEIdlYX%+vC=O=j`NQv3bzN0aC7k#zvG@GUfy2Fo{Cy^Qpx@VnIestf( z@8_=0uXHbaSOOpD0cQGp`M2azJ>LVodqr>qK24u6cOgd%uh<_=Xl_bgFN%rp`WIcL zL(W4g(id#k<^M$mnF(~E4y?28|MEw-fSIe%t61q@1+Mhb(|GWhMm%M3lubGNS z``{r!f+-0dJ~W^VwsD}Nv_CzYK;^a~dggb~+SQa}Y!3cS}+ptOM)TGRQa4 zoLdE&WJh)_HpjG9$j7+@6rylxAb-<_qzi8!(`WrYADwBoKBpBvfk9x+Wk~-E`Zpy* zP#6zwbJigAe$(W(0&HLA9talNfdpKqK>f`m!&>$G)OCXzOd}1g8EelWS@tq?LK+kp z^4lbr9v!bcif&jXqL{oI^Y9NSH zTBkK@v9{cdH7;)28|P^PG!|8evhV-i`NHpu1p$5nC8tdGd|V!F@R&qGI;iy01{#251<~|komV1$Wg@t!L!z8K4`@r0x7m* zJ||E*(pDJ_q;R#NOazPrerb^Gr3vYZ8-S)D>%8po;HK41n%0k1%k!hg7m-}&XW*xC z!A%PwMVE|yigVMVc{AZ&F=X3c1{rMHP)O1cFjHqi%#@w%MJdiw&Nibrusi8#Et~J@ z7i&GwfQi0udncnj7)Z(&*}0jIzjPrX$jCAj>~=kNe3IAI4-ib}>Y||$st(x((4eA{ znR|Y+Sjs8Atomxy{gI&(N-Km*J+BfN2poaeppPesx4MHYVKhaXK>ynO>hbraohkdd zuajrqN5FEBhEBL-koy9Pl(@aE<_86eb-#H4Uc}rqKi3AaxWz^w&F?SG18VL0y0;OX z>lf_sgOl$8<-hqY$C8wxg{*tIkPEu6wiqd1*5yYeyBVWB=d%bo62<{&!&!L&n@{#j z;DT_TD&&FK=7S{PrGO^lG4ylP)IMhi(#$knSXA5 z8p&P*y?I;}oF?<(La-i<#-7GEU`|-vQsV~tm)kRb!M(OjPmR}}-LlgW+t5h1Yp~Nv z> zK4Y{lg31F9-kCMk(axm8*+*4;3-j6(vB@zYa%t`y?fS|9EBL%#V(I7^P(h}m>(9@QwJAJLIAaq%Y#Sgh zNKB!=8T~vYf9~^wQl4DX#Z?X!4)xYFJwWKC7R4DZ+1YcHBDF&*J2h26Q8^E9z5 zN#0aI7bf75-Ki!_o@VZ$n!Vx@#nn<+1c#_970$O*#rhYoY(Yw5@`#xd=SD^4<~@ly z83Ep8m4wlIpzcTxbdby(?9X)+yjC6yt*!(WFl5kNb@>+V!#~5FjNxAQGC{~?_4c(B zGYtx~9DG0iftV{kyDcZ*4~;hj9EuCSqmoS71fEclDk{tHvvlED({F(}R3@oLX6hob z16xC`yVc=CPw_ioQ1qECShN5}k{T2&NRAec?Yl2Cv6J-JP^rNdS9*_@r~Zhf#G zR8@x(JiTH2KrZjACc@idj5r`?>y5{}2WTStZOOzWSnmoi;78S%dyN?S)us))@edt&T59HO? zh1uwg*~LJOzd#uU~YWsqeZKV!r^mQI2mMIC5rlIHiol zAo2$qq~_&9E3m3{Bwq^(k5x!%0?HPgTikyIQu~Sz@<3*l#?kkm*!|dvjMWZPv_WG% z7O5}7Pz-HCa{%=aRLJZ5+De~tA_AaK{l@5`<^waD73+l>&Vg4&tOdU`$NN?g{{|oV zy10=Fq-^&@01wMs{etw5{Q~QDrYNjX+ZOAd(Y=?G@88DHUrrQ!EdM-n0+;i&VzyPy&-f9`r^&068QRcZ#G2 zw8(EhRW2_5h7#B5lFbb(Q^a&%L$wo0^w~sY#0d9^7hUU)5$&$hk(ocH$T=H-u=4<= zlR4+>tL2NmQk)JK(S^N6X3x|Y1{F2pvA^#C&H!O{0y{$dwiB?_?k8_E;HZZJbCK7p z#UAWq!mm||n9DQwzW8Ja@gq@l;;7K)Pi?wYOJ!PZ%DK^8VNT{}znNFlZ)316Ury5X z3%Fd%Zo&%1wYn;fUS~RCq`-?};HY4k!QdrCUA@sD@#4;~^un^RO}~ScSEYzMWY!sL zdw2?uIVNW=D%Wg-39{9znClb8F^9_6>q$=L>5iTs=AD0hN6UCO(MOC6`MCHdkwo$5 zs>|x6Hi97nWfq*gJkgggs}~B*#NUg8b0K{-;JqiOfVc%`ez2W2Db=|WMs62Jq!a+< zf@;JTz3|AOaLkjX;k!Fr$9=yQyA^ExGPJA5<&y2LyU@2((^-czNq`a|S*n zN8-<>{fRNXi#?ZlJvZ*@q=1J^w}=R`H4NM6-69&s4YDdU?_Tt)+*oauOyJLu7u1)@ z+2>l#@gC<|51wOV{z#>&kMU_UWVx~DfbU%!_Pd7XTBz7IZQRfZ4MU_p)=1q6-(P24 zfw!1SdZZUI78g3IcHTj`%rJ&U$2G^BkT zUr+8X_q(<2#Bsbcy`nGiDBWL|TC~p^FDc_NUoTgF(Alx0ElqB8$rgSYj}e)YeEI25 z6`ub0MF7&awOn}&V-a{ziZ+R_5Q{A7HF2V>2bBuW2)+f>*q>SpN*NZ*@zOi#ZgXuvUt`F0iulzo?~;O`1Kz+L$-8 z%sKCyUKs**ndc4$y(#VeduND=`E(DZ%#6grt1xU*B-+3ZZl{ybGx^^)8>AVlTiu}~ zwaRZ7XS7p*vCuf?5OT$v!c&R9y1dl}rv3Kzp!gf9v#nwn!74e|6(n5HLDM)W&$2S9rR;-!tv4yWI5m(t@!E4FwKF~q zo0;n?Lr!y9NyGrDl4+I_N}`|pYQ@pRsjLEC*A#V$zMwtbI^LJPLbteG+Ex z6bWUx-p^hU`M8cqojJhl%E9T=qy7Cpxc&Czgn9LAMW>7R~cmg@RnRyIGVi?L&l zqC6B-c1`1FJ?nG&Kp|Q5YCuBA`j%+li0K!NQiAUN`=Ijk-`Q;s_oVc?`0@VQYNDY3 zr=1YFJFinnieGHF4`gIM)W4o>^jTGW*VbQY#3^(`{OwJFpG2Hqhc`aSDy=UUQ%&qT z_aO}qVpIT+?dx_;Uc~uBuFn^&tsk=WyY*cb+_&e(RKp*NDgr{sJDCcmhXchFEbiiu zDpqxp$t{fNB8FJ{(nhD*QPS$^%W5PrBI){;SE zm$XdoE(LF#@3YG;|4OAbNk>VVVsR(*kOO(rpdCq>2Ta!rgKO2$;-_>u$m2QecqM~$f8%# zQ9y+Ejx2OpDT3|00dGhqUR1Wb(~x(%P&!43>~AN-h45Ao0&;@`KG4L=wxEVP=vtFx0i= zHeD?f^$znC;Fi2z!}8hQsYu`5Ly*~;Ho3({S}ga9EpJs-Y*^JINUY&lqXH%QmU%4k zN2w)0J-E8QyPg9q;EFdquc#=N3}e|&@#&@OC#&97%NzWYiO<=j#1LNqC5U)&o=))P zIdo)s@vz(4wk2UJu5SEWVf55@dE8$tOUb;BnTx^Hu*3UHrnweIccW(wQ#XDnccb%; zaAncf$m45Io5{7rS$J-m4$+igs_8TM%y@<^^SGEkNxN?tp(POrbFN^u{ej zwl?Z2JS0lammUs;6g>W2dk*mhmdQENv zlhbvHt0syCPO3wEGTHZS7Bo4lP26hD2HtzRrm4>+aC4S53vrij_j{zP*x#PITpSTznE~$@_|Ga05%s3uyCs?ObW{mj z!VHmprQoZFiK6SCCPakCysuN%>f`MJ&gugdDU7Tc*e)0S3GhjgYa11=z+7(XSO?%^ zdnvs^J^5812(JFNCKX}c?TWLFGrd8p%VZt@Y!Ohg>1=LcsgF;ali0g_KTB6n%vU%V zA8k(EpS46>-AtW)VXNYsd_nV!g;fR~G#xiHtgrnks(uYhJD=!EQpl;91;*R}#ng-yNEBMaVhty4eM~!hI)i!rxc%C_G4J}Fr*3UiartS76v5=%j5T27*%RSOIID4fVlmfG#;|#i;e(nBpNg4;QLwb;& zMOm7y;ET(v#qLxqc&S&Ea6^jpPLihXMg9b4-xQPABDrtm#CN&FXiJ3~ZqZLoV%x4< zzPkw(qTt6rUcU6YfENw61JCz{Ol*>LznKixT$@s)zHQ)Bw`*&11G2(PSSaOSKem^e zrIirZckmZ8*w~*nd zrkwPQPFvZcfh%cdMy~Dsb>XI_nOL4J1XVI2?{xQ0R{GiS`=+-ka`c<@zr%euFc(T# zLw^*;LxIar89N0RTM{IC+HK-VwHfLPD3+BsWFL-+hAJxf`Cmp~ZM&026 zC1uEATDy?xypWF&%}7gt!o|lz+0LJx#QBXOiZiq4t7G5mDl;0^d)y5g(gh*xH$CR! z(;-Xt+Od*JzQP$XFnJarsd^Racd|m-iDetBXL|#VVA{!QhMc7)SHfH3++>WF24-Fs zX9*m)vo9X>;uqy%a5Wn*1 zE9DwttsM`prH~-fZ5l4cMgR%&$V|*KEsVlOL9%TshFMN7L=WQ}YjC-}IKvPNiXcS* z-_`EVY=H_^$cEZi6XMQ0S+SK={}spcJ8skvOSl$AQF@kJgQHC+7P6o>@(0NGX6*73 zAG&kc0hyR>DdnTEIJ14n_>;cqUn>xp7AKN)ziMLf>Y*dP$?GZnS<`<1&&4N76L$;E zS=W$!`aDZ6Zs4fvhbfJ05%9w9p&IIz@gq>wl(;sLl-`G!j-b9PT1~(?ts^9;iS3Nt z=FOwdOKsvtE=SsN>;r@Z3&)=Ei2SQ<${0MVJ3NTwo4BD#DP?xLX7k1t4V0YK^IRO8 zLAy`yPDmrIHncicnB5saQ$6@mt?XU*L2%`H%_HMVMXT_VPoNrGBqRD0aC6@l z3a2Mgb8L}E*fi8bSJJ+>o1#YJ*waDeMDGIPB?AEb$GMa}zBvIRdvZoxFj z9=}t^l_H|;ZXpVmu@gjYDR|qtFkNXdCd)S2HHQK(2{-q<3U+@xzsncP;0~CY5>q;rmEeQJq01Ah9hzrS zkdoS07j|PZc5J;=%~Y`zOt33NB}eD`(dT?|i;ZrBv&pV^=xdCn4;@}D1YgT2HCh&# zEZy(f(&nkf)MF=?IeQOe@nphylaMg#@=fZqTOLw|?6>CfJVHF5QlRPKYOQr*Ujfjx zNdMY0=MNVy*4SkjIRrI$`6Qxon}C|ij=XcY@MOQ+xLHUR#7Ybip>4VcJNVvw8~SK$ zW;YNs!1#M@lntda=P06!g!I)jDzc z-mn-bpxIT;;rWw!Gg|ph9`$r~)o5quQc!bhS8)A&YR@P&W06IgS6{zkeMcFFMvS#- zPoeNPRc%?x{coPyxlgvrEl;^$+LW~-!X4on?pEFSiP)Q}q*{ul!2nC&9))fiGEezJ?7oB+OgY85@AGuy)b!S5XCJzN6OWB|I| zPW&~pQ4evZzEQ~44Z3ycB8rxc)olZ(wXEfhP8$@m(bJn_3&$Nze@@)yO>B zkP6@_at@f-T2?j~K1#pnD_8aoJTAy1#g`5S!-%h+$pj z5{Nb=YFcq2G}H#LhCUdPc6wC4n*JSIC2$T=3WM$L#zOy;mj*-ZJ3@c&;wETZh*neZ z%3PhPvb0ad$BLx=3k7T|4?cN1MeW${4Yfb2g7Fv^a|{#Zxze%z`$_*)68!xp|9lRA z{Atk*a79>hsNkSKVTXk4VK}_zI%Ub+W#^C z;HR{*KCX_Dx0(FeOZEi_YSEzNJ5c`-YLGI4cC~lV%Wa73-2_hU+7JnT2m+gX1LBkF z;^}WV-2cpV=}DMM-K-GM&87i31d#X55rc~8tsee7h!I^24thwh&!(KNz`=+=9y_(s zPOO~=n#;m*5RBRtpwJvM>{2t@-e3A{efs0akV6HlVhU1|i^E*37mh$t*OzRx3nVox zLy27Dpv6ue8ymp^1(0y6gDc9Sf$9LsT6nYLw_U{_i%@zM=E94Y-GB@(^AntGmZ!pq zbE|&5MLqy)d=J$Xn5j2Nr>Y%yD)%B>SN-Q?9&kmV28pSG_64}16xuUThfx=s4Dj4b zYehsrWhBPe$_(xb{-7V70b-%b`>G>Q+kng?DOr00xH3;5!Z~j^ZwB^1u6%>eRI#I- zX%BU4z6}DJ@5CB6vO;vT9~6@i>S-L6b730+1rR5xMf=_I<}mwf=laL0v4R_4!CEL& z&jm5t)PdYY4-{-(4goJjP8fvJcfp&G=qtRUvDmuF7Q8?4;9lFx46e4Xygw+C=Pm7s zeT1M(pf`02%X@FV00`qL`!Tcjvd5-JeLl@k-*jvPg4*>LAgcxKUHtL1?%oF~GnYZ( zK5%bI%OFlf_3SM;WpAl5h#y{+21me`4Ho?#h4&9Z(JqBg5d7WhTEOBfg&-+V-6!yH z`e7F!OXcwy2LTRTDc~TN&)%WHE-JqH*NXd}FMpFmV4Z@LVichH9;aM{Bp=tBpuS{` zmM^-DO#EE{)FBK45gWs)dsy@?j}m3i4t5}L-`)ur(`gVUEMSec-}l#kVtXqSs8sA4 zrX%T*=3#|1kTghqn88S9BZPRzd`5Vt8Fb`^&W_jfwn@6mz5+;zXdptV(ges)Aj5pp?X zp;jis5JY_$MBS`W8S*UZT(KGpVJ*pm*oE5A>8bb%gw#VjgGh{>7xx0ob#dQahQd3> zf!LozGm1-j2h=ykpvKbe6q4|BAUDcCO3XCehPtIE+1c}n%S!rN1`C7G=U6i}%elQ)i$i*byQ7jCF2$e$A^}~SgEf99m zFZ0spOB$;X)ea4HezKX6aRbxJsDUq#QKF{kJ2G(id(osVjO>?1LQw_BaS~Maw?%%X z6`69$%VY@Y87lCCS9{s8%HI&a_r=ze>HdK#4eu3bTaEzVZOKz@8HqwIz~MJucnMNH zyb?iFgyu2?8(Z85{InczQ1YnwV(Rgc9Ss$(b^y17KXA9)Qq#l=H5Bt_F5rK+6SL}8 z6I`sQ@Gl^uk~}tyB$?1_3mA3WpOAqWtTJ8XG&F@Pz3kyG#wJvU_Zz>#zlxDe0!nV$ zM-UQkql6^XG8}qSO%GcIPn02Sm>R#|M|D<}azG*Czi{9%g*2+&=FTy7HU%?CPENJf#5;AQLG0nI+4yt{L` zDQpcAnH`pG5P@@i$>x@V24l>KsM96w*{Km@%N*m9XqY#^{f7$`y83}MED*+6W=Vi7 zO}-pVs&RND1Om3d3F!V!hV!432{ijEys7bnP=XUcoOL(&k|tgVB<;w7rF*n;Q`u*` zD=nJ%Ekab)^IjesguVi*!cNQ-3_3{}-i_G-SH&c^O@ySerYC=i=9@ZkWw@?TemF32 z;U)`d7<1vPBT_H3_bJi4CNo-iFvyY|ycgdYxQT|c!gU@Yw(E8OrVje!wtyU4$%r(B zOIH7i{1VCR4bnsKbW$Kynb<9M6681C(rq9H#P+P?2kNgN^!0CGsh!-F>J#pfUu<@C z9Q3G@+v|y?sx-5Xpv0r}@D>H^qH$dV2kJxpHv@ z{&gPTUsIyhrij%t&R*IaG4I2^l$BoT^ z5R7B8?}6wH&Lv(Rj|%5jkDvLb|F3sKMLJ?*3dC?|5S%mUjumq+8gMSTnt=GS66;fo zsUA5yR$EODwPk?&#QLJ;2*3Pprb*#Tf2p8JP%EjZ`NvEWPaEP_6rFEwa(x!x@<866OAY>-H_dc0Yzm~RnKyuh6c6{A z^9$IqO-O^e*1(e@^rU9lXPPDo`tLJN@Gd86yZU8hR=4bfwP2_i9WGaYA1E6~;Mk{N zCozOO+D~*QZbFpY0`*##ffy&S0W?zJY0Z$1lA9GS{_TG}Hvw-cU(eU~N*d^XBhXL^PEe*_M;-24W% zS}}&I@;c)p5^v*2WLaIR9C=6+`P|!_fWL8>LCJck2V0pF^(%Jgzvp!DJWx|Oy*!GT zJ3e44-l;8>exXkS$>oM57PHZZjFO852WZu<1ftOKXB$!Xfz1KY zCk-TTYd_x9Z_jbc`VG~Tn8X?|nuvZUR>W+kmtON;4 z?Kl5(`zvr4b0H-u8kSWmHP1E1H6z%?@RWG)G1#t6O4%7=CFXc^b1g^GyM35W=V)Ca zbgrzw`)gD8;=;z_2GET*kVmFm^~X)5g(T2O5TPYGeIAl{U7w~*iyMkh3#hW#BzzDA zh0Q?;dgO=7b?3+|w@hfaI#(j(UiQ%dCsk4rid}4+XQpCPX7n;x+{d@r2o1kEkRUn^ zdxvSHQD6erS1{F=O~%zdS{7tJ{GhzW%$rUY_9Vp9dSOENJ=ZFbJ=yK(*o33n$oNs^KXetj?)w`|H8M zgio#(XR!r^#rf<2Xz{TEyt{2E&BP`jU_-2tb|AV=8xl^!f1uiHuD2D&X^rqbM*1|) zGLHGP4TYs#>W+mJyZXEoAIM`VD9BBI#WcqDAYE{wtAVxpmScClI11zo&XpMHX8t|N z>ev1*WRo4Ga;J%gG%xxzqLDpIqqCJ0lj?GX)4QQu4R(hoqH*7ucqj8fg$mosqm`Vb_L{v@O=ys;pj>v;GX^3vktgTB^=a4sHbt5`1Qe-_E3 zFL&@3)bPk-3n-1v1<$W@1^X*G{Y}*k6~avJV@*XI_ zB!hYLvVH~{;k_fq3O>ctH$mM>Pi&OS{rjR2a{R;vCRepOP~R& zmAQ?j3;oZD;8ANR8!%11qkK;L&s3fGYoPj8WG0FP!t%ei#eeLtraOkT4T#TM$sUX1>x*!bq|9_o5$k6)aYiN_Z~p>fZN%@$7&^$}3aD@frC} z+5hvGgU|ba;MDg*;j+SVBjUf6YyZ5-{{t029T%fAQ;^&sK_7#Uv<@`)(V#5qS*)fes)cIc-_;+melqyp1dNJZm z@nScF8p6=0mgCz;;5cu`lM0aUeyRFXKmYtl&=(^h3)Pc@lAk_jxQU_Bb;CfuH>pio zSHYA;*L$079{IOO*_R+tpyS8Zo*UUx){TSk0kXn-cRZN{y1BdE`pEBK{O!7-(73TG zNWc2eaU%}`25bsaD-Qo<+*|?Q0GkPn`L^GI_@C-2D6R`C}}zsel{9p^8=g z=M{MkfMJ8m>0>7UKW_vFL>35!M%X<0=N0jxK#z!9H4Ey0J@Y?H@c-9;wAR9+)aqaU z6)34~;G;j7pEIc}12zk)n4|EattkSG)VT^bpbdw{ECc+j>-*~n*2ceCKcIJOfiUE; zt^$f>Af|Ed2 zDr@1VIw~R0?cX{ae|)3od95liR&WOFF9A4+7b!w=F`HmPlI80Pm^!rh{RiWQpkh=l*Z~uC?m#ibZr^@s$nj#J z$b@AGY@WCZc0>0IN$Y^YgqUI<6b&UFv4%#zf)3RAgcwkCLj#yiwv%5*NzJj`E-GGw z!qpy0zJ}>2-v)sN`&U<7DyAb}Y%5DA&F>VD$O8O+4H+w_-fSjmulsgM&MY>5nE>1M zWl+p;E<@%lCdoxWv|>lFBGJ`1o`3>Ix9bJ?o{2VV(FsA&@z+T$&g}d0ObULWZYJd+ zrApHM1Pl=7`tRQ0;OBD{E$&j7&T#_v%F=IWfllVox@Z&r>$P&YBCr@6E!;09tf`?f zM_L_5EK~RDJ&aA%4lo}VWgxH25VXh}uq}ggQxIf5q1QQE+<=L;o;`){gZ;~)!W1x5 zX+W!YuKX_86bg9hD-8^e13bRx=^o%-*~!>>zAH`X8^;EfrX47k6U68Fk2xi7`2($g zwbd4+L*(U2VFDW`B-EW}OW{YdFagHDOc7r+(>Hg{Uk4i75QiY{mWA;q&g!dx&X4e{fw0f&jcXJo881@Q+^>~Auw zO^TtBs<@8TlCWbbVklM^fH zZ2;DHUn85&`PFf=!tiVk;4Hd{Q+~Ua#VeI$-WM9prJuwm8v`6F_S>brDp=yJ7ijA{ zthv~J9vI5WmBx!+L}mp7FW1M|;X$qE&&%01Kp6HlW{VGJ0;tdLoH(;tM%~lnY$3nJ z5u}jIJ^f+Nsrln8-$kSW6ta3qzXgU&!}kx1;-VBg&{5d`y>PBz7uV(OM|y|&|xuKjh88i<3z#738NTPhgry5}A{z^M>;w2C$r2H@W(LIZ2$zo`Uk6^_ckFioN-MZ_|=3-7S$Oz3;DgDns;c0In`1} z4X0%tjQbrjPd-UIQo{33<#VEnLd&{Ogzq->iC5k~?6Fx@ZMovf3#v7-{qw8@oH>r4 z+&3E#_M3Ifqx1vCi!mbLi)DuG_3)jQA4yWvJvUyJ*Iu{R${{Pz4mB!(@S$P|e+Zr0 ztsooMr&Hl~o9DVL-fyaRLD!5~T$Cs@ZS+}C{JF?gza^y%1ipZ(5vu;8FhLg*r)rt- zj>oF9zQBaCS2`n!A2hrJfwUAa@t5uZYN9>*cpcLD>4UX%bw>3o4LrpxtB zYg1gjX8wNMuz&Fc?&SH;q70`2va}PZQ%W&p^uToQIE6aoR369+I6v`%X-t7O=`-v@ z<=Kz8FG01+{uF?r_8@*{TLfD$be*dAco)nspFKB0b*S5F*3uayv?D|*+{Txqe4Ugo z_ye*{W+&x9B+U7G{HiNhe-)uFE|rf;L>wQ+I41~Wx!izmB^{Fn66C8)%%%66<63`# zRoK;NV++(DM)%o2W&%u{^>eYSzx@3&LB|C}qvJQ4I-m3V00eJKFg^hOIt#J^J>Otu z)#Va~`egh+%Xh+^oqk#sU6Hrg`c3@Yvoo=3ycs_ufD(z^ZIkSAx+;fH|y zTT{s^fF*Ux3(oaY6KsSKU=p6ZYX`U~Eb0nMP)h&Id;e}BKh;C+UK9Fe<3fI?!McaV zM8*tSR{-cqK2h&dHw3L__`|Kj6_DFME0@`i!{8Bf&DuE^`82Mkx6B7l60i+`qH}M10dSg&*O- zn=^Mhew>xaO6haYum{C~5KgbxIAqckm~_w0kf#{`U4%+6=-vmjTSi+t1L&3znQ6g9 zY(AhlxVy5JM#*TbB$ONHIp&g;kOj`L1Pkc0*tb5ftfLH^zGsM;d; zr2>lUN8r5Fg>a9n7R<%gOVBCz4fg@4tr}usOd$Xel_sC9RU*v{^yoOroFxxL;m778 zALnaT5#BEN=_Cw=SROGBrh2l;p$8EJ30j#P-OI0$p@ZWb|LqU{U~7~>k+LBE!c|rR z7(O>-QSxO3kMm3=d!uj}GZD!1ePbY$!P))C;x7Pnq(N5R`Bw$pkLcbE2p82Bq-?`; zb@${~m>XQH%#$J);P=%99mBsw!lq8t$JDY)#ATgsasT3T-Wul}C%gg~J`c{I7VUis zk8aSY6c+_ntq2x?QvTO*1kQ{)lbr#MYkBPJDO@$5!n3?UyEJ1u!Z_R2{ET9 zMEsDvt0yo1KsqVFuyswZ)TQJHB;+}=%Rj-v%)(D*FQoKpyp#={$dv$vcU@kvCBjSP z#61XG%0^$sKz?YT(^RPR%HE$f%nwE4$7K9BOX_IZEJV^HyP{FkID~i?^B@5gMWH9R zYL_{hEufs`by@sq6nwl2f$!f!5)M4G<~+wA>*(4Xi&hf}!O#-re%4_9;Q#u9mm#wI z&Z28|TZ72zs#F$wCE4l1+FMV?@Zme={UV`tuy50RF*QBu)=V|I{cG7C9Co0=nQ)*JVXcT(_5bd(I#S?0ko|JSv?t=svWY$V|$_3vrY4 zLq&9fdCyd{3HV%l=MdzwT{XAR!Y3l~5Fh0e_M>LvYu{I!yDy1)0?`f%_hn1*h1oH+ zwnQiIna_CR<(hRhB`-r&{lJ@dY*+0c%dbu%-qa8(p502QB5|B6Jlh&SIxm1udN=S z4z)OAp7kJtXe_RX?t@Zxx`1 z;wkTMn}8N`l1lCm8c40bZs@_IN?PF|WHe^a44Wf~{^#DFxY!}!mG3Xp6RkM9^Kh@F>cAD@xu?3Xl3sdLQ1>fek^lA+upuG1?3dSKaFb`}hA#Ui z)aGt`_C*dqOF*FO!Ky8+8I5?}BtcHI@Eq{#!}-2iz!Y?7TFf11qCGNXm^tx!3BbA{ znL#$BVgCn#C$Wf zSReCmXk1Z7`=V#OKloir(`Hk>KBex5Jj*q{$M#t>d)mJ$d)P6Tujj?vNgcMF)Nc>c z9}co6;?1Yv(9sp4MQM}If*U5y{IJ!<6Q#JBucDd^vbIBW?I8r(*|8`*sj5(;Po9>l z@LeIv#UK_11KRZcozO8#g$XHem27-HB-^@UpFVD3qt`}6m3E5Yowt~~5+lp$0keQ$ zSgAy2rXuJ2dVW1FHr9J+p$MpjcOL#Uzr9+9`=uHNLf!fic3}!=d8Kt&E7u?e6ff?8 zXb@j^+Xr1qRmrK-h=emlJY=3?BnLdRnXa|!IPFKi9RwNg90u*KJk%g?@PEfp<~2qK8wghN)$>_Y5*TbhD(tWgv<1w^^GLksFEZRzJcC?+KaY zmO-$?Bb6rOhABj_V9L&>HQhjGpIO%qZ+}MrHOe~s(}r@%k`snUhM_%h{gUNxG?k4L zbi9cYfs*b;kDO$S5!x?7r9repTcI)47yNp?6WitP2qT|A@3{mBHxv|SY&z?*iEoLX zP+@K+Zk$Zd9wb}HM&oLaVk)qaB_Ii%I(574YGt*yAk z@>z0yP3YlHzO-@~@DeJZtrl{B{=POo6J>H~bZra)BxoSAZi*o1>^D#~190Zu-wYjHeXP95_f zvl_il%F{LFX2`K8*P)6xjhDHf@9oFLL$+a8OCQO_M7L95FD=@W+b4-HWl0*%Lr;Fp z6ke7;mSIUx*&UUm0y|S)xN0@S*WqNvAmVf-L0{@C=eRW*d^;7RMd-U#o|n2>#q#?6 zi}tt`(5f17YL*+sLs?pPS+?jg zVaZk53FHmOnwVKnriKLsI(+aM8;|D0oF(Ee=8mZ>^s(&_irno1lkuK|?1%4kon$D} ziYMdH{hza(ijFw@8!jJjq_QH>L^3@bgs)hN{k~ja2N*FqrrHc7Qlez`U=+h@d?o(1 zCOt=>D~{+wg`Z|lr7$SALNk}v$kj~38|{BFwJ*>==}JkBz9L!2tW>q8<+5mVS&JKH zgw0-mJepuW6EBp;r=E%;Wrlq}LB0ytKvzX`TJ4r9mT_P0^CeR_`#}o3u#jJ7Lwvs>n`1V0yTEt8Dr< z&Ldi6EJ-e9`}E!nxAH|_aQ<+bX@Z-!#t*@}RLe%62fT!B?G*Z+#u9QUMF%0OP^Tl^ z-8fJbGGK~=4L*}dR8;=NhF|%WU-z^u)s!5UZcy~=I_7uyM4E!S$7xy~zf|Q-#by*& zg~~ARY{JHAoYu@DnNbSRI|^P`AI)nm^?KT;!)o^zDFMXZ@yYAr= z7CK2L6ZxfuPK9tVuiYyno`0rx(h1M*HHwHY?n)U%#*L~xKWgh;CWIBHj%jqHT>ma# zg@ayeNW+OHqASB9iXKLO?{Ou3va5ON*(jSJfiWd33;+Ypb$nI6?^?OMl86lCwjaY( zANW?`qx8s;CQ8Oc^&i+6d|Wb@kru=%3oE@|ctTgSFC70khayPWyw6wb;j1UYR!UxZ zPKsjT$CY18j0N~JFu#`?xye>}h6%;bdTHEGa*=n9Fw34a|GA>MxwY9PcKd*tv(=CU zW43mxp2If=1$S z2Dup1J#CJR{1x5!Fm!FCn28CvXQwnpo|+U7KVDYnY%y%e5>l`DGsw!J#k;U3Uwz+< zPZB0V2T;1IESGUgr<$A6tivL=Td{afT)xW`AFlWg)lN8LE~22$lwG};tjdVO{8p-x z<&U`>uflxvCDM=ft#{4Yr{Wv*G$=zT<*r8MMKR`0N2)1)4LwQwMYB!!f~m@dK3!%jK-WRqV^oeqb#Iu5B1ZiIYi&YBq`Ki7qO7U_T-c|m2H86o*bxh6YXW9@v)tyR?L#{=Y+XG9IYoj z$vUQNJj&`Vwby6cZa(b6oL&FHc%XUv5;x|!O&@*gO6Z@@*p1-kAalFJVdGMFBg`Ft z>WNReZ^iGg_nS!2Yi((`CY52;u*L7bLc6|8miAV<9@QN_3F>ek0%D$N$vuCEl_#Yo zW^_x%>R=MY9nm)kQUn0>B*pOnmh;KQLlw1-H^(}Xv5u0&*nrDnsO8gVc06<-hMP)%|RuB6T zr^(saQv7lR&0;*3a0i!P8=L`N=Zb-Zn?*PeKA|a3FYa9OwthI3Er10~)I*sjv$ZRr z7V!T8#34c(&KV*Du05*KpT&xG5mxV%8k?SygTf8fDR^Fahm=n&hpP$+gIK8cil_;b+ zmE);lYut(r@pik}wfpq0mt}nWLjBFJH>yZ~v2U=(abUKj*DKv_FtQsSIbP79D!BS)QUWbF$A7b@*mXK9Y^GN~Lm} zQS%ZP!F~kdpR7{g4#=_Hw41C!(AGM`HYkx4q2Q6Ms!mW@ZKyqCt4Q^DGPn%Lckk&9 zUUy1DJ7IT0W(zke@-?EG#8ga+w1C6 zQ%6$8<(6yyR#8HjbEePlz!;4yPYzsQh8*(QYnJx8d;?=xc~f z^}B&gQRkWs`v;c#tza}gr>IX~{Hr_3A2-Ol;Y|S?f3@5;NeMWzVYm>{Ul%DgG{%^c&nc!gvs-3WmOz$>O2nO`z-Z_yI8bHGwi??d#mP?Dj zJ62&ek;E|dXf3YY=?3D$=7-QY*Q~azv3PKa?@<*Lv*6zuOg|38#gw(jBj;wKSEb=@ z2t9sIj!suASWmC)b}@V>ezr5U?g^b=QRr(KVVC(eU=PeL{TidyUZ-Y1jSS;MkQLh| znp~k~FeS@du6Idx>)b&exBVIS`+-#5Mi2IiX%htPhTP|F|Gzb@rA)2!R(TjC);&qN$A z)g>BDc*FNJ%||}GA!S=UmYMH%AvB(d4hhYo!|s86B=72;djJtajCcb(6SXQI*Ho~2 z@N0oY?wA}CC&>^3@zL+*iAcQj_6TyKdr%i6y~#j2B_-Fis_4hAXc(zLwkZr#;4Z$j&?X=2iDL=zN*KA{(nzZJxpwSq~CPc6HJmQ38$ z+s8fhV8)cm_ln}dipYe6StL;wQ5%wde_}cUX ziz@d48Z6btlnUbS`%8OYl*A=^+c#a`Jz^^M|4Fi(9_Egie|sbD;S~Sn{2JmzJRDMe zW#+u?P`#FP)e5q;WV{!qPktZ05rTwtq)k*}T-b#>Ak80jXyaVaaL+IWNa(}2)(iUBhP?CXv#{X24<`A&NZ zQ|`6_rDXFt(r#%rsg7&4teO7rpn(abHINiQVEUN$E^rAYLn^s5WufxKzykqN@8?ln z0NSCsivQ8Y7g1;$ldPNgh!TblTXEkU;8It+C=rP?ctfEN!|XI{9&fS`Qt2tUej#rY-5iX zRd-JHH_TKBzA68f#+a<5$Ar=%C|J!L%~$@uS4c{7fBBY<=Rp9L%7FJU@??iNs` zu$>a{2mH^K{`vDDd=P#7EEJ=+;GgID&lO3aq+iVUp&zpUzL8L%W+Kh);ri1P`mc)z zy##5*eGfTJPwxMIMSuR6r1yX-MYe=X>2EpK|ErIdqqHo3arLWe6X+x~#CLDe2qS8v zYAIF<-tzrx&i!kAN6EkgyM!%LDCUR+fv)sCsLfX%or;s)dmylU^9`K&Z+(zU+TDXc zGO%cZ)POXO{zcxaFVIFcDi#F%K_Z4gV+^HwW?uKD26v#FVAt%tD=T71*3CPx#riY2 zI>-rn0T~Kk+s8x@nCR?*^Vk*S1ipJkdNlP2K8T?Y;Mc_j&-zAS>wmoSQFiD~N0!>4 z0M~zJ$G?6Yhzb;^9eCIL;g4XDf2NN;&=RFSyG$@CrLD?#Q-T%4?ploP?wk^A@W_rui$#&?uG;Nb6Ma#B`s!TUo_5+x$8Il@jppNxT*!xx_@9<^N;b@nXRv91zb!eB`mFHK`VFt$RTJ5h)1O?J)hw z`w4RiEJ>!2G9l#(G_Jr=mHr9pRSc+(O$A{+y}+i#|H&!l^Y?T-U1Ol>2|Bon6WJ#% zdTaCU2qq$M3v38Hlumv4+p{|OuS@?+(%m&gu!SjuRQKj$DIj3H@)T&!F(ErxFCd!k zKoP~JpG9s?r^6wyCgP6N$`K@(@>BKR10*{i=ic9vj!H)O^>P8$7 z57L0}cK{ynn7D-~@l8sbj*DGTlD+!G@?YE2saViaWrU>Ot0X)S^XNmq3*>4C${|U) z6Fvaf=mF8d1gR^QhbO>&iu;vk_3X2;Lumv}<}J`q@0FH8)}}XJ7e|BC)Ib5>n(NwG z1#1VPWHJHZrjtM$MfZK6@?MA4fy(DhqX}gpWwOhA;*J(epfi_Zr?_HEz&{7Ge=RjZ zuNk-&iSaKj>45N0QP=P6V|aPsP-?Y$4hNDs(%A(}#tZ~&V1S**$DV~N2Np%7)E;T) z1dJYq5L2zQPEjEOg%5fHpHHt6?*}4rAdb7(Fn<9mY50C(d$D{yS;X%vhlW{Cx5>EQLbLB72sIh`dax5R4h1<>I|sW zIp&)Db{oxZ##+CAw@NtxWwDjVoXekU?yD}OhbHZuOOdR|JOFDsC-Q0$M}Uv3$CE>l z_!W8o*0`V(SdHachtWH3p>HkNlIDM_#`9ylJewj&?Yid9E`Vo3^|waDV*3CLp}Sr} z(g1j&)R1;rvU=>IeN)WZBA~P|83XuSWbO1;)iYeD9uN1J0V&VpDid}rkhFwCAdO_3 zs)e#dDL6WR9v=es89AA--`jjlXcG(aQ6TPPn7>r7gzKMznyfnR)(jTWS5ikO*0MEz zdDcJ~xqSpG(0erjNBwttdoVdOzBp8Oqp*Kv{rq%ckYOF5Igf`Sr|L4<7Cj^vBcRr% zn+20p(!#4>x5 z&;<&FgKofE%-%ov^whyHrGi;ZqKUq;ZcG?nC$@I|`=-|oF!v^@+yH5$^2i8*=Xq}U zU5wv>I9vi~5e|%X!%bHBfgQrZ4?u6b1d);2WFyx)ZP81OM$Oaf*-LqJJd1 zzLFeA>to;@jE3}C*y12YSLw;ucn-2sqaBL?K_0N=RcBe50Y&bP?pe9-&wsK2lnn~$ zHexw18@$#ebMQl0i+pFE-t>J$CU-LVQY)I_d@K0Hp-)Pm4#z6G-ZyTKNJD8dV#J}b zJiHIGpUboenvlP$n!Ykv9-we|(HEqlrqhD!C4qD6a$f%)Xwb=>mX{(hQs^?2K{tWUdj!u+X7V~fx3*5hPptb&gbRFHX3HoilXn*#D> z+FYly-T+sy@wKlEvK}1^GkN%3Zz~(Kozmj5etmn?kxT{8Z`-VX@%H-c-x;`BU*MRBs6X#o;-w| zz^#L9v6}XJ9*9q;Uiea)gaZ>RJKpIr*m2}}n{~CgY@gnD%1J6mST(udpPw3Vd)2F{ zp`64hzU;Z9u4S3+ z=Z+y8CDR3Dw^z<*ra%+^LfC>o&7?$^Yl5+EA89$1QyW>$lsJ{!qLI=z#9n8Grg2z- zwSp**hY^{DfrjqvGkUkunt*WTw?!;j6=0RE&#<8^2@_h25hB5vcPUq>Y(Iwaodkeo zI=p24@i?B_v_zK7em@Wj-&uw0Fi#j=v<$kY@|b_EyI$Y^ek1wmL-%3`t#@%AZ!Gt8 znUF$7t_-<`c_4o$&9W^Q@#H`wh(^ZR7CC5l8EKRN?zbWz*yD1xYWHsPVA~Mf&m%Vu zmVSw>cQHI*$D=M(piRJMjZSEpAo+B+#lBHj@zAGBK}0wG`9)=hWyzjKmL)dk8$boH z_~Fh1$G~=UZAym&IEqCr} zvFU+Au@VJvtSFq8wZs;>oM~|OHL}c;^@`SB__QFDtC)0!r+s(tiIKQUHgumYdXc%0 zT=(rXvsQPsuiI0@E2{!>lgdcIlIg*QW~&en%azqUVf=gz5Y4Lx@GIz~(D5`*|{rpm@o?e#?0vk+fhe3N?`NhNHLH-`z6q_Nq;-w`A! z$3o^ZnGWITh!w|T<#LL=5hWYckwR$mQZ|ITOh$|Mk@6~U3X-s$}QoG{Gxy=ZC zscvv~pZYfw@lSQ$6+sYjQ1XkFZcZT`HW)=49Q5L}L51@M%jOn*z_`seDCDo*c|LRk zV?AodIJ#4^z=m0MIE9=Z3{iL|>WBeWoPNHx8^DbgSyu`Ezb(GYJ=eP~E&61Qimpx4JQIGKzp z{J1?=5615?eo!!ck(;_ZU1SX%%Jb-C^3r%Fd)3;RVXy|K9y{&1MS&q3-#h*(gBd!b z9rONmLIMHK2HxJF?mZcAFU#gVxw2eMiG4|j_9NLAn?KW1>A4osVlK3JR~0Wy@Dawr zk;SVYmDfq>s0o-h@lc)a=?fwm5I71&IANg}d*oInuw6fW=*&zMEbV2L=|kC3pt4&YF%dx zEOZa+V@lZDK59QD9%&~Kt$rFA@@1V->K6Lwa_y6nN2B2~>OWTCq4AAn6z_7M%kZo? zXe9?03whG-vo+__G#5DHbOZT`=rr0mp*;_pJ&V@Veen;0NNRxWWZ@%NdEU%}Cppp$~#)M$E!YTLKKcf^im$6}4E*vG69^FP5*x3Em_LIWcQzv)XybFBgoEMz@Xo7-p$9OaYx}vv<&a& zui<>PQ(Ifj;15^(N#C|m5F<^bMgjJa5~~uC?6HjW0tRaf=i~#rgQ82)eyMrWvm`bU z)8fBq*TS$bUH{X{E3R+FnNugGmY^T;VGQ9jH#~`#y3CX0jLclq!&BKt_2W@oeN&PV z#rTK?DB5ZN5&->Ewu_^Kbp`Jf{RQcVfpi7DpEx7PC=q)WlzMl$D;HnG2&!MfIk~+- zz09Z@Q%D(EmvRxRXoUo_)$&o?R8w!FWqP>WVZ4(Ir}>qoR<+s52L%qkP>sb0Eb2&& z@@>oUZfD8UF2;HY1m@Brk>WqMT}AdQU;$8cNYFjz@D0Qu`jLlR!=iAb3em?`?$<59 z)~^5x`b9hKO*Z%O)ExvKS|&1GlmwH6S>aIEtVh952vmu_lOZtVwXc$Mv>)~qEhp57dIihbCsvYM-Tq2qky2u5XaR)V0CBvcq2~sjkct=hOYZgl*sCtV=y_#^-cW zu2{nQO_Iwj*F)eZh!_X$+6z}lQK2Lb=^$=>+^FOd*kdrb%T4*B7;JX!l z^>kxtQ4TRvkMko+cw0DeS@Om`m#1TA(ylc4#|@gwibYBDKZtVK=@g~AY@}_fAP#Du zEr7yh<<%pc$M$UH2x=s3gt}^>@Vx3&FOpB(>$0!O%~+Ad7vx3u-8R&?`e@><9phI^ zeFIX@WF1ZQKoh2&cUEae{_f8XyOX{28Ir5uWsq0}b6lH&0C&18k!O}2@glbUAtnh2 z6RoO#j_5FJvH{pfOVfaB+vN)^SNrCJb<2BS(NsGX)LgRbDzq)I3M1G##W4@QpaKeHat;MqD?0xiT~z=1A2%($wCea%@4l}Qf3I^YnfV)ur<3>vzZF0-yPLH@!&1t7=N`HWYLh7 zOPNx2pL6qzofv=;b;x6;1q_HBts_~b3Z#TT5vNgy(4qA8Qqka31dBU6sFJ(U>7rq2 zZ*g9b2w)_tdp%b3y{X}lRJFi9_lA}0xxX=IZ^KWn7$wlzmXAV7CA=S;=E&v+wK_^f z*2!lBi9ag(QN%JR_KXnmC|T3PQ#>ROn$HBxt_H1jqwSOE)zY$3H_bKLmfe{jv0MG* z4ANWfJl6eL{bCnX_qqj19^SL!3V7w5pp8q_OVV~eW_ne5rzcKirpyLx4Rbe(iPzsc z{=s;l+Aa(V1a#c$uf-yX6FnXZT#^Vn?l`M(C`=o)X>jry;e-27cMZH}1`kGZ;@cvx z0?QsHH;bAtQk}blLX>$YC-yj}Nl>j0krkyc6|luP>Dp5tBx|)=Y{2^KoH8UGX?!W8EW^qm+g%-Ii8ZX#k->@|qaKYa-resFE`Zr1@!60gXSM3R zZ=(R~rE>gkeMYtAc72MBOaZTah3A>5OWb!$qcQ{zwx&1sAco=PgR15s)@%i#*Oy|v%&Je^iT-D;7?yQ&sefR zQCW?Yfm+``z|u3szt|aQKOhe3hp^`_t0A!LH3_`W=+eU8dWI(oV=~akTPbd9zv;Mxl}+cEuFwUb%{VAEUr z5=wT&KjiMT2wYHb_C-MnWIGcwFqKUr+Y|NzO{EYOV`$mdboifEu}<3wli-2s(+}p~ zgMQ!jDH}Ux8gJ9nnm~B9`^cyxCbYU?^%`8y_c=Q*pYgmL-;3`{hWGvUJBYJ|Z=EJy z?=klmcQu*~T@7(p580qeK)JY7?2pnK*d*@KCy5}&fQP!jCX*NG zOgCo0zq;!I3h<7l(!~-ytG=M+>Ycc{Td0eLjQ3(>(Ynl);Fj|BY9+^I|m>Q zV?UN5Jd`y^%M;A@SXIE0$s)~_xPRxX%4WV-03FVYXyJ3v@LRV2)T%FSNmEWUkuUFo zWXP>d*~>(dB(B&r%PgU!$RHL9?h-S)foP_=0$(haw6Q@g7)F2FnI=^;-C9*Wm zs^N9xq<+EMLcus#d}8=@-w8SD6!!j=YQfL>f#piXcU#|nxZJBuxIKhImzTw0Of7zC?rl?l>`G0}JbPs7d0&c5f$%wZ*opg|P z*(>5h3Djc7-C8B^wLX0HJ+kggtl;;B2;OuVpod(2;ok7pb>8~$^R{SGUn+8JGm^>V zT|ZOR6x6B~he>0JhT-h3=*2_{lnGl11dAoJNX?axuN#Ub)#ax8%uL%n&SdLM@uD=` zHm>_l^!YJPNR2badVDfQEO4(@mf}q15BqcQ7wkR6WS`O81X$O6W0t+HoKCQ-;l}q3 zBi>h|<5uFIcYbWcMRjI`v%|uKBR}0y_EN*c)`E?L_A|6wW>}>9Ovo)Nm!lHDekxx` zRGLghbdya#Xw;C#O1cK>vCeu&0{BFpD4^}^ z_K&#TU3aUESoW^zh=9MD8j*m7L6&EBZZ6xqDXNrQCh;Em-CY?$n4c)2kzVe{dO(8e zG&@oRkE)Hz%_v33L8VubC%6xldg40L)KJGs{%1K|j0|X>3D(s4z`#b!o+gaXPLn9U zvO-y$u@scMlQIDHhCE(RI}nyZN*k&J^`yYZM{N}-u0jD=IH@Q`>t+6`FQj>|8t2tF zg?|bGFLqRG%b3a(yY0?B&T-ww2xeo%kdbB{IXV=%7qj$rtL6+~Wfc3wW30l)stJw` z%^9Lwc2_M_Kz}7XPDm^B24 z8~5EGYAO+JuQ`V|6HoTv>+k#xp~7G6RKE0=k$D*9BZ>7=&@A(r6;@#<(q8Djk>H+U z3gZhalsipj%nRxLiI7BbfB`4?JQA=3B{(ZH~%&EUp8J0Y4hl_Bm@F0|r`EGj~lntmj6YRg4dHD z3@BSQr}W)|zc2X$Z!6s-$qaFG$haTmEK)ko?jpD8d=jO6-ZYnsBW>F=8`dkt=)##84#pJj01xovbl?m7U&Ga{W~`>hZ1(z89Hl`Uh&=8;*VvSlni{ovSDQnzc&y`T=aI(%yk9u`Z!M{Zd^4gpvp^~ryUUA z*cvKA=90y6=>q^tyL$`zSBHT_*b3%f0Nb3b2J!mgk@xwf)d@-eb8}sS&K{Sa_PWx~F^1s*Y z0Wq*Vt-TVebJa0))0(8^bpbnJfYWZ=?-AuAyaY^ImcM`t7Fr@I5S$Js5KFs^oy*0G z|FCKXPlT9EJOtbocOfF0NG{Ls@%SGb=IPtO#?tqUb4B7tB?17(T6H;}wQL&RV@7wC zTLwXxxKJ{$E4<^FYb>nIBxl-H{^2=P=9puQP zdC@HaijvdD{V5CanbRrBK*s}>B8Uw^C^@7tQK0@=BKMFqa9XA5;i66bwf%^S{FN%X-=3|p zqW?ZtM+ayX{X{$BW%p+X9J?doO{*$$$E1kS=zNg=sU+s-VQdMC8hi1;XsW>Tpi*^QrGy@fhB zIfC--&STMEkl4j3!{goS+fGmqgn>h(2=*6J6J@JlGJmRRh$v9zkb)e+QN@!{_^iw^ z7G#R!@Fbc)ztJ^6cXe^_JaONB}hZ?I8#ze&k5E zyx2&%N(pg}%$QMFt3d`pQ?nNp^VX%g;{_0evtM6>1)<|HzLcuCw)VDc5tu;swXwsZ z2}(SV*)>oKHonl027f-H#&jHjxx6y8Yi^3>XtmO5vH5)18|;RncW^E?==%jtJ!^^v#CBz-`{D3KQlU{Hv3^5jc)U#0M% zadttH5r)C8NAr)kzHdBw5lUv6!M(ipAut@y^%3!o_i_+w)GD;F^E}}oP!IvBW8Sqy zpqIB#57ZpAONqKJqP?q$;*>D*7WBJj3hq{8z{tFx<(a4HBhNdu(D6lpI0hAJ6^~(n zt`j_*2{a|9fTbz5uoV^u%J(SvewMOwo-I8Ez*D1-*Jbvlr-Fb4f|Mt|tAwUN{bOqr zkI2RWL4L3DPZAmdgN~ZjpdGyJA!I_YO@Y)+!BVVk=bG*g1TILG_}yY5h1erKLdP@) zK0;j7QXJ@PQH7JBO>sh^muS<+?}5084NwbdvF{*;G#r7Iv@5}~?kU+$-JIRc`_aL= zL*R@lIJmbYlV!}-aOt?0X@KlKn_|E7&Id>JOR`z`VP=N+PU%F(K=3DK*dbM&9UKpuHkE6YO3xqR8&zOMLNU6jAE`i54Ajh!$ zal_GOyDs{t-az)1q;D?e0Rif-FH6NwC<7b!o={qmcrk;{*1i^!w}NGhiJQQMLH(*Y z1CJP2=JqnrNc@3`1d5<-Uy#jfiHo-O*t*$RQkPsN3e-#GD~R=7HSh}e<#yD6EieXH z6TlEVC)ZOOf1#KZE>QcXZ7(qv#}DlXd_y`(0QnjP8UHdA8_pkZwg@!X7tfnVU*GQ4 z4BnLy$=qip9t?7R{R_0Xw>AS~%@!y0Sz#5f1bh&q zvB4lCy4Fad4Ib)7C-Wd#1B}{|`z*!eP7QC9y}VR70XanLurTJB^|4jB?eQ-t3wq`N z#37faKZ`ASZqsMdtZY6KlSf23Z+p7785}>#L`;?_#X~INSBoab0e|y9}GfeS?^`(c!ymMm^F-*C7VZItdL@ zZjmsXUZkhb8U49}t9X)0y@;a)(d42@~z3$5o@>W(Q{m_tw%x}eITb*chtS{9bq(%0TJHlD2Vc#e%9Ejb(pQc)=L2I}fO9JK)goNb+xhOTPvLeXgHxQL(Np#?K~&41Cf z1==MA^?c^R#>d_UtE(MmOb=bUJ#V_lLa+Wa={Ux_1#g_WjBp;9tTxt*ZdSz0l#^l) z;aM#q)OTAXqCq3mq^2Hd2#ZZxMwc(@UI4}Aa1ZOn5s0ml0pw;s`zn}#EMrg{9Af!B zD21>7xy=Hvw5dOJWF*fQQa;@e&$kEW!jgF2UC<0h4V~40{l>rAIi+gfW=J;v=L#3! zRpR==q$ayKFO^Z@1ELPSK~c?7PFxVrTa9^wJf)SPsz z0sPUo=q9A>2q*@GAq*%{da9aT%XHLN@?G<{P|#m90NRag(U3cP)dJg)NZ?3hw&?^r#7M7e~5-p|sg1YuB*|>Sx{u&)%@e8sA zy$<1O@loew#06JW)RUS|&0dF#WA`Vv>RZk}K=eSQ*S8?rV*^y;N7{a;7!B3+XxE}OqeC1k0%})3BxIf6%Y2Rn*+GwwZb{fxP z;H53f=MSjU*CnJjJIv#@taoArBkcN`DU`jq)8Y{)7)erxbP7|(Z5sCN<51V$;v<&w zujVv17mYwYqxTR26hx` zHTvrtUJ*6iZ;xgBm7KCHb3QuA)|Xg0li6;5o6+rMW;d)#$~cl7?nVjME!=OqQ`0C{Iv zms6Vhkng)O{Q#AP!{hPpRkZr>uRYBq7SgYQeEXf%4?u2kmWxOAHTRxb+TvA4lX-@c zUD+cEkg(Chcr!Mf)gnK-a^U2^ilhB5lS4iMVW|WL)N`imx!6D$)3K@D5%4;83f@%~ z0UJ4)QaCh7TVyA2G9Mm4h8 z=Z4ZWpP*B_;8MH@B)F&z9QG^I7h88lI41xriMHWJS0Pg0DC^v-@WO$Os9?P0k5xXBcH!pKLXSMz@qX;|^lnM>G^B*f!qedLVM8ScKOd&%ZV z6v9pyv5DXtV{fln&Z@3zD7;!rO8?`B1|Fud9-bn%qQ2%wiDsJX3`fqhPBkAmuRzuG zoag(vUE{GvJn!2pSLgI0#2ljqVcG0qtLKw-YT{oMC`)z|Msk_#+Jo(8Ubva?3XTSwJfDcY?X z%b`;PIGm+gnahuKOv7K?p0K>pcYkrJQA;jquD^YNyV)k;&%glm=4zAO%?}MpYif>d z?JTrpJH(Ulk5N}%j15!M{hUtUwId5)W+@MzxEJu_iHiz#4~iRlnliT$2SkN;wwuL9 zrmhf=len?uy_Rw=nFubtEi6ewXv2ak%?Sn5PSIhAFC6y@N3~gem)eQsT9ek%*!ISy zyUoXIdmuZHh9TpBcvw0$?eh4Rk(l|D(0gS!(l*U((`_c3CVpT#Wr;Gl$QfuEPALlk z9rfzZ)`#$uPsC&S8XJmP{N?3pCEu!9uDF?fn0|s9_5QlPHN%>;#F)D-yN(M!3mKnq zZyjXEs7_|wWYQM8rZ47CH;7>IYkShFm2$sI?)p2p+nXfDA95meXVVL+fkD8xu-vg8 zrO(FZN|oyJ77N;867g}{!lV6G^#wbw4y?ujqTX4KQscrFO)4xt%j&}#|4)~)IuM_T zH;m+ACFTUM%47nrSY(u+_fvX5U}C_06rXgcdi!Qsx2`{dTD2(Jtjptgr;@gLGmjA= z_C;&q8TH`iFYGqp!`TFGbi^*JgPaw3Zt3H-bSrXU6u6AL_@D8QB1qMj6LQoMB->kT zoDPO-OO#ef-Fi5~0>~Yj$d_}_td%yut71x6a&6bdoM#X!V8Qo=@) zB+4WcPWPa}Ba%1hB|khlKc1iW_}*eac8XC=AQ`g}ehGJ8(vWpstVZH3U%+s3D7Iht zzjB}pm%ldt!I^iY5J&tH1VurF(B6FBi7SNG%J}%qeN5FsjD2QdZ>`>hX3Yaw zC1fS{QMZUwu&vv*e{6F6wB=TW@DU2Cc&5!`^9Ic;HJR6@AtqN}))>fH5T{Q9v`j}3 z2q82D_;^Q%O%!|K#%ZgQbj!D?V(yZW)bKFy|v#LgQ{8qtw};Nnvn4y~RHPT#se zn-CiQPN)l{b^k0K1Vh5>w?LuEI+N>|9Vkh=Cos2L_kGKtpdF86JO6D!DW{%BMRR&m z5bof~;Mtn^w_N|$-P5_PM<(Sy%tt5ZRh|z_iOAQ`fMqk);RE*Fpe>yo$0la(nPbq- z6!8$Ckrnz%QTC(-BHyZ@2;aE4>QRPlPp!*e!kZKE}^@Su+kZ#f}Xc|sNs1@(dDURJ2#azZD)HE)*+ z$6ByQ&&Q6;_T-Kds@yv;=2b~1ynB_`e9uqT-}0$kQ)^#wf42Gl4jT5iErVZRVncKs zlkfU~a(ww(u;+?`)@V2VEu&|=`ZxRBCs`2-AVL}=8Eh~DQiCt1basfV&bl)e zRjp+&<3#in2%))1c59y(Mj8H;_Uqs0t`gRIPN3uoOko`2J?xd)o}cVaT(`9U$@K?) zd8}%Fui17rdQ@QhByG{n=4G=cXnO_L-m0JBaSVk{!D~vVI|3Tf@D!mjpd~!Z;KyMM zL+B>pN;^t@AI3{j@6wK01vRoELhDYsRu{kNOgou{r{8KmIJI&0WuTX&AO0HK^c#AB-A-wM zQ6fIH*4tNKYTeNly)be3fYR+h^SKn0?q4stL^L!-%Jj}4Axyuj-{-}e)>j#iQd1pS z$`!viKb(I0{nD(fmX+6$ln}eq%D)qZ#6zQ zF>15mkDqC5x06fXwksNk*j2~eI4PB?DiLDNEGF`f-e0w`eH zH?I$-;GV!b)$m0(kpB9wS;koedQT`j=V_gi#d*(`@PjA@C%#uXI@mer%#Fj`^HRsQ zl$d1GwX!MK#fE)Kc5FL+5bMRI`HLsp1zvb52Br5WHU*{@)9`jqT8F!c`e#o=*IP#O zB7ef-nR(R70?(iUb>W)oSCRUup@ddot*Ii?v>gzLufK`5bc9PzlvE(nD?dZ}CZ;E^ zb1){2_(a(54XGYiDG!EDs^29c*+V({Yc0L6<>Y0UOh=J-prVXvbg*tG$kUBN%ghsD zFUKOy)XQWqw{WrS|ILf%#|vfGq0?o4w^)k%<^8E=R95nW%Q(2P_7+;1R_$C9c+IyJ zo6zvZEB!@x`w$vdK*`}e=mYFa@%nuLaZGS6x6K}BA+jbb_IAJ047pyhy(>-AGi`Q0 zWHyD~3qC-!C->{8vJ$@iR9d!!v-oQjc@m0fp@<&lpqPIGLwr7!_%4Cn2g z&(?J#{&(h_UrcN0OlM_>x_>TyPvc5cTL&fwsWo-;&&U*G-Hno>->F?~)AV0>VWZ5% z;hb?Or&pBX<(1LD?{bgzR$iW9!0|PO?MRns;bR{8?UFoyFiJRR{Rbw4k5FD#T`eZf z8?)l;7{pC`Ur)r?VBzH@{YZ2o4vJJFIl1#EjVt zo3!r@`H0%qC!}G2DUht>$CPP_1gSIZr2yuTce6E5FIzvYt`O)H7>fTHJ?!kA_HhAp z?{9C|S$!t-*o`Nd7Z`LV@bv_m$Ln_!hplyf0M#JJV4t)?B--L~8qIC@XG7FOl$F%% zeI@$fymSLLrpai+kE)GGv|PqUwsLBHmD)iu+00yh^m@B!P;16vE=nuU0BE~YoSh~YyVo6Lt_OL2{!n28jH-%UqR;h<5~kw zG#2VxcTKG41N#_NURc-F#IaLoVlPy5Xu0UI*aja2h@^49vu-rf4W)S|*Isrh^#mz| zX!9DepEg;RG8b*#Yuyl&qP8r44}3*3K&(l|CN&uWi4ayJ3pPx;X!~ z+I6^y05*Rf*z!FE@CKCB@*s4^v9@ycMnS~ zDWi*?Y5&|?Ba;?cny%|vvduizJOVKcX({JcDM@QPgKn_Lch|KB3G(B~ zA8@fBltEe`R8H~()K9U#NT1Hdb`thV zO%CzHx$XdXAL*U!qWjX}%lCojz9+#Ps$_c^gqlWSqudC5bj*FfVE(?g|G08bL4OkxM&2&E$E>kZ5Q?~IIV#mCqAhbHw@O8UX$Nlv!0y`Ld5POmJ(UbrE zSs()-s+jGC{kqf${P$b6D}b<}c13tr_0p*0zd!qi3$WQ=?l*QW#m@h>mq4Wl2rz2n zfN9>JPWHb)Lz)2s{6?yn#b5Cf|KP?GUjdsW?oj_hbZN=>FNpdJgs023&tsqcOKk8J zu*tM5F4d|3OIg|=M@{^ustD~QuQxVm?8TNKE%}4?U*7hD*R76ZTC1_6I^>AeNmz6I z4|&0Y5CM3So*~WNH~)Ay;6-%EHMvq#-xlrXg{Bh{OuO0uTdl{@8GjTsN zkL)yelm9-|8#f_#&UWB?D(n~$)Y)xS)kr=cr&gpA{hgT;5%NoxD^hmgH$?^b|MwDt zg9I)cd5ZL9|9h*^BSyh(;c07q?f0Sn4Ri;?9?F61^i0Yy_V3;Kb6aIWJf7ix>i@Y1 z0n`ea*3cqqum8&?MS<7NM0&i)rN8p~+YLf+$4H<$2>r_@Jz2p42rzkEI+?$}9cKc^ z{SY?k__4`|-BE(<9%Afwdo!=rnaBq*Ng98|i8UEkfGfwIm zbjuSemHZ!piqNN#0tjVMJIV%;bAVhvhQ@OJu^NCjVlk?i>0vKpa!3sETFZdYU^|?bKHfUna z(;l>)Jk}l4=k^DJim=`KIUbWwFP=$?a>>ix+`eAY(#rFHp8w+@)PUT`W02cMu?JS0 zi~VWdBU8YNH~{-ADGu@oEdazzYwOIQ25^TZKs(T!`ECsK-4?)kaZ9wF@_(OXVw`^% zEL20AG*5~$l3?D-w*dK^Mm=NjbkW+&=sFu6yW1#UnWJOZOf!_u?O54%TpgvL$P*d;8C%^lBIRGgI@=<`2FeleW`G>eH z0PIcogC4a3Z%al?K`W@jSP-I#RDw4|QS;m{1EB4n%leTCE-V@<0LWy3r7=|(V4s+= z;oJan>0lX;x@kBr*z>c8<59ZchWMql2og1}E&Ti}43O<%0w~fUa3}9?nkDioblAQC z)xLWKmiKH6PKLo55#TY(D&GUBCf7d!YD_k)@+XLlAi~-!23uT7?SMch*QIcB3=AeH zSkD)zt8+xd+?RnE5(|RqyP%L9K_$v|i8`-;Tsfo)WY^$YAO*c~92XvY8JF*ajp=EU z5O!~A<&fDD6e*bt5(2i8a2NQ)LU*(CcbmU_bye2DqS5<0U`|#)1_59j(?7 z99&Xbtx*bY*$Fw~2(Bm2WT-f~j8IMU(G=I4%c}6X(@EcR$-i!lWCZ zWpvR8jxPY9b%rP`l|ThrkgWEK6i`6+u`#J#r4Em5%;KfQP({jzLE*EIAJ%UZNn8bp zTd4UWq6*_!7m^ z`MR}yUh(hz&loQ7c4QiAcITSFQpic&Be%0by*47K z-H!kbk^oe~J6wt290HhIvj0I<(lLm(p&bP@c_>d(&_uHV6KWifK@ec7sk?(6Q2gNI zF@keCJ7rcXY912a2go_&&UK$Nu3#U;tT*zr4Q#=N=t&4m2fKY7As>w)$7a~+(+<$@ z#RUePtJ6x{VJpYWYw6E9ghTpZFd7kND4_mM1H}YDR86=+=kjX zk||2n+axgkjxRwDkaLaKDnH)mlZ&n+KxfLvY1FlxR`4$ZNUEp-+ggjCDzCx04|1b7 z1e-;iELb0w$NLi`bW=b>rpjUdp;bn8qYo`0$UUKs)>#ACODKzIm^+={WLSNPv+&5W zpBKC1C`VjJQ^M=?jD#M(<-_OstY_Mc}5-2N+r_6#vcu|gUF)kqLozABU zz#`fVk4Y8$aR-nT@>A;y)xMZRx?Ta<7IQeJK131eh7|6uK%RM{A=as)^%e+lzdp?o zWpxTXbdAEGzZ#5-F&Lv6c$nzGtC-c&a@7|8R6*;xwG%FCKsGSQP%oj}0k8BWqlHuW zZ4l)>8O_AQRjQGvgd{}(8W}f>CRm7^(X>awyleAy==215yN{tPB*MKiSP_Br!O`9;v17{S9cBR!1X3a$iM)(MDi=Qe)$~1xgQ+3IM`SAT=6$hqiT6_*$9v!@r1Z;AlCj|6*p*`o%eA$$ z@#qiW*r2$;zgd99Xqtl{9M#7_aKX?1(O{CQMEnEuIWF9vjn&XVL~9>`NlT&cok8m9 zdLio&QhfmcSyj%RQjiI({_ETCq7&h!2`N?61d1za?)Fb})lJ>C0G3B%5oqvZ&G`HCz?RGWTanv+t>|7v&f zQzz~hz=%uVviOX*)@Ke=#Wb}vm=5-SrOLt28O|7@d(Bt7CtO~>#~e#j-_I{4jykjY zJXLNXFXy~)K*Q2tt!DRp~!jrgr8 z?2YoR*0J@ED)hwtD(FdgSS|`grDv4R*+3F z)XN~gC_*>S`>&RfMslz5&tLDt1SY(@b~MS<3?n!|S)#-7!GWM2kSOb&L&&FgqK5{l zLkW}UkExk}49|ZquZ6&_lV2uYiW4zGz>n#9J+~Ma}b@uH>tEc|X!WH4O_5p^{F-}`^gJT889GACds!}LqF7Z8P9Ex7|* zcf7Gif!88lPi%S`2&`0C%na1LwT%x@Rj=@)rZ8j;YrRgV86+dDmCg~JPCqlQ-=No! z%g!BLADRQ}L)~pT#KcxXbN}KfOcVLm$0`JqIapgY*cZEps9BQ7D+agg2AG(V`*7RPx!D9jclXp%}eR9WwSA?dErHq5r(%-{xWjms@2a-#$!vtDVnAWG_!Y z)_=(5o$!-7Ibc#O`AZ9|R~QB3Jz)4AC5rVxVSVsd=5#`U(N&HI$3Q7nrzLC3W?p9PcCDXW?hF5*4Fa&-lI8wIVC8 zlT>l?G_5AMf|q;&{=3JpsPdY8`)T~QzdMvm$0Q)nEl{V-tRR0a?a2T)r&B3#adV&) zG_9=`IfXolt)u1~FxWDh8yxuM>BiQ-?&wOoG>il=;Gehc+BOV+uQf`k${hQJ{Y(lj zXU!rDDi2Mbw>%Z=%;TD{<6Ub5RXBGuct}x8u&b8Qa7>m3t)r{NJM8Lnl2e*V1N+>J zq!1Iz)$+!sRfW2NNz_wsE;8Ua(Ha*Kue?5QJFdg!=?(LBKj!DUE{4ivPRnYknNRdP zGD6hRI^}1-`vHnR&`ZTwEp|Ix^T8eVCN!-~V=2kl-L>sadl9^Ba|hktzei6B*}shUTr_KOe+{ zTCf(*-l1yoqiXkC!VjVNOnw> zk(v@&m#Gk<4K&mq$&NLYnTS$rtB$9S(BECvSM%gFXp*9i(g+E^PKHrht6j8ct9vcK z)PL{ZgV$f#TCqD$K;Y~&#}MY(9UIU(a3?K&WLup3KK8d=8eR^lE|vtS?Sueb5l!9* zYX7RtK1y3mltH0=_8H$nDC9NJZ#fO>m>SkP=U#}3fB|&=+T?BPfRpo8J%AkhNC`Vv`sz=~-gDYP13 zNt5d<9j}pL@G^~4?n_9x5~sAE_Ab+j(hx#e3_aFGx8iSd;J1{HG_R2jYwU5On3cl% zL!wkU^apj!tbBBlB%jKFMY~T*-C_x9H^{Ypy=mhL8tSW%s$NKS&MM^bFHpx}LB@Fe zXn+L~+6`IX)!T@(BQ#+8qxe1yKi5DK>qG~#fNPj+eX)3##Cwf@PZbQWsDT$5d-k<4 z9v%`lSfodXK&(8f8)7gdgBAxpaOgkOX;6M~y}|2xc$45u)OEek~r}$Xq4nM z4mCBM7*zSq1~gH}0%xokA9F^0V7FP4tZ23jpZJv^%!syz7^%cg?3X79b z&}~a{uN$<&1COfo#Q^2`uB&QF`Eb`o2zWCK(UHvo6FyPuz~dzpbaWKzn!~5&i3SsK z0$*RN#i^as8Pk0fsh-9dwB=gBI)BdzEC5(9qOXCMRB!?2P@1W0C;BGIo&iK>>Ns5n z74o~_3lAvFN(FFzx7~FehP<3Xoy~s5{w?<3(ie)GFxJ7cUc`Mcksji{DTJ5lr)-W9 zMxL>Rlj;s~kqgs_f7%HHC5(mcfVo7*OK%-Q9K>Pt0%&1L>%qMKUQ&9QcZrO-=yS9< zKKcdF%RGNR4_eo|tNWS#-@k+ma*@3wfC)1pDbdcMsm%`Hoo>qWtlMRrb;nFX21$7} z0z*ARtT&U>I#WV(oNFf(UXH>i#yw1?jC`Egk0F4t8xUrp=Fk^Cp(z&&lzv9}B zZhLzY_n*H%Y1(@;O@O%uM(OIGm&H|~D&|#+4fe_Ti?sJ(R`A;NWdV6W^;7Irsfrvo zl3KR6#|Ift#T4K~K6%6Y!tLunZ>|Zy&PaZ0|IDf5E@M#Y)`z8|=M-G`Pc)7gZ`+s{ ziDd12?wK`|!y6Mi@KdE&G0Zz3g#R{=kqRQ9*e4?#Zdsfe#6_#g7&iAl>zc-45Xi$D z^r%!AzSozqxE0*Q1xNQA@vhe=H_tn3-4D2#p6&hBy>XDEB;S5#I2)o>57d$qzvHS6 zMMW8kTx#jyV~TJ`DR=`#tEyS^@$nelM`}r9SAiw&^XHE$$doHJc|f}5_dLsHJelcK zAg+s=N;TI7ldCS)R|a+E$(2FOK;jcTxK`#1E!voI+Mzo>Og|rN7Tm4MxOH-oXw~hR zm?O?+-mKl_X_RyFd%XsPK+A{pqqk$oqp^4*f+N#R`8nUJcBW<;TvV|guP$?hEMJMn z`uWH&ox0q7I#{R&$hO4uQx{!66z!*>5=+IVbC8hY(Z1Hs_S9+jJB^mAu!}Cy>(eA3 zyd8#^b4{|HZk9-q5{4<9QtlVxfBrLCeDOrejE(V%f>s&eMG2>Gtsh^LMNtlWfYE@< zRoQVnr;bu3h?@yfrO_e%LBGA*G-s@F?7y>lP|#CQBfjiCkAEF~Xr8>mf&7<2Cm5sS zEu;kPRDT)#eXPIdqu}!!e9%A^!_n(^lY40kQ(%s(J=QDmFF*R01{Nz?w7S32v@dNB ze7gmv#>I9kl>eA-{ndLsgl4tR5QbU5-*J~V{T;2f$L0Q0@DD@k_Fuzkl=$ntJnTl_dT-%fAm02~7YV z-pc-S_5MBpBvc=LqbQ!f#LxbHF10}0DkniT2L3HU52+0c3_k&OIqj4!DG?a{pEQk* z`2~F+{q+0y!ITR~^78KNN4F+)q%rV<@kN1?A9x|j(ALJLM}L)JwMP{nt7tuSwB!XI zZ<^y=Exv!BZC(o03o%_vRlz*GLgat2d{5a$V4j8zyjK|8`94|;KZ7aIpp-J$0wx#8 zC`f$T+%{+N=i`!K_)S4K<*b8BOo5U_s4oX;4LO)uD<9oSxk-)=OCbQGiaM3ZD*qR) zw|;-@A+U~@8;dv0{gXU$sAv!T%*UB;RB$~jDRG>?DR^ULy(@g zFx~b!FX%49p@xo~ZE*dcW?K66yxMJ%$1?Lj6*4vdvK2=#5FZ2mV`36Mq_^${<)`9|#G!f_B^nEc8v!*DO~#8M+BYbQfFG2{5}^4%xNDA#lwv?w%KX1<2Z5b= z1wmWUy!9#s)r}P5s4x5a@BZA>48j2lV#NvZcley8l`>HmTFl<>Pk_LV3czI9pgqJ7 z+Yu3le%4$MkHT;IGf)FE;hQhV@1faL7ib;R zlQ8vfa>2gwW0|(Pb;TGktwP&*|+em@WMC004+t23esu0!eB} zAuqK9pqLeeG(Jny>fpEc8dsiAiqiP6ahhSL8oMj&+%m@f zOLOgaZ~;3WX$F{J)WS<$xB&}L>eC%x;3Z3NiB|ecX;s!&d!{)QrcdtAL7tmhg%Ti( zN}13I-f{2McddWi^6JP3q=XRa51AEbrZhRpA3!*wruY}RQ)Foxm_m0$qjlhzE>Jt@ z@*D<%kPC9T59dAIN$A9Z2|j}K`k>4eIW8%R9d9O>hB$D9!YDoLI8u9gBN!FS8;g(T z13LqjIdsm+k^{cIpi}3gj|!U{1rf~GQ-GB(BmgeD_km#%d{Dz+aIO6ExmLhLw0Q`! zJ_Jb7#R-4_#ilqI40BDuNxCOfi)v*kZ4M0HH9Aq1^&MXpbOFbIcqY}h*l@nUi%(^7 zKD?^x-bVZSqepl(n~t3S_Y$+KP`vu{#Un}xx@T1|x?d%K42a2hTl_tU z5?3L20|<3o0#B40Vm?x-LJ3KQN}TWrWg-4PcIOt+&DL*s6^9r?m`uU68Ji^v5A_j| zzc#o~;a$+2oPQX|$(&92-MJxPxeI7QHyIV=grl%hu9#TI%iqN#SXPBR&@I4U@7MjO z4{$O4xL#Bw=pxG;9zOsX3^+yE4;_u-hS|y+m!q7&x+Vm>rt#O1(9&6|9mtGf7GO;5 z&JBR7F%`Z;k6)7ji<70m<9!_nE++>3`yw@65{qu9=NS-@sD@&l%D#qOY}d}yckWj& zh@gq)|Hud>I#GNo`8v630X%`@_RUbUv)Fh@Nc=s)8gH95z zWEM(r3O+11os36FPL>b3a*!@K*gkIelP_ZFZbh4rj#%$4l5LoUBQ3{h*OXvWXvO6I!RBh=$s~UkpW1~vtv%vR z`+@QH>1AFlGw(8NS#{Sp87v|-gg2{?A?uLX+pasxIpqMeQlK^`@k*VuxYPDtcp2H~ zY?SkB$1eKN?K>hV)tOq3WOMByK*T;O#2|AH-=L_hKsgIc*JO-77wmy2q^kZG1x-5} zxm}@78w4!I-lkxm^q8ytkM66!oMN$tO}5n_Z(Eh=c@+72@qUcJXn#?(bIkjN$f%G) z|0d^pKBQ@=`0gr5Y_J~&BdR(tEluOS$}gb%ejp{}rZpD{=dYV*r@}0b1&>B8A!fSz zn$?x5!doj*1nTQUnA+Nti{}bv7lr(5PQQ9?NKQnCuDVyDoUJ_~*W0p}L%+8YZT8c0 zw}yaJHum-+t=5=1(K~&s*u1g%82~}OxcxLL{Hg96Urzb+MoV?3a<0479_3kb=&DQ{ zB+)-@O#O1c^4ZG2cARV~Zgg@KOSK!?m%W!J*r>U-zbJXO^S1ue#^iLQO3#P$H>8T! zwL53(pTckWeLiVB@B_ROBO3>mXq5@ZARghgGeDS0EjqkU`e)?>g~%<`0Ai+Pz4lXG zYO|m1J)Js+*Zw26_ESA-Xv>p)XPxCcRNUcl~H6NuMxluf?!JNzQ}RxQ!n2KN&_}ZJ!FE7g3$<5)`;_onl=aPx3{b4FB3qz_fAb(8bWe3M~U~ zRAGW7d}$On;EP)%%^50}bd}9#upGaX?EutH5^L-DtY6$PMA><;IwDlDSdZ}}EgloS z z6$_{2cFLnO0Nyn(q^Qx1pNeARJOfUMEy{>495Bgmq|aT9ge$U-b9oWk6Bek|GGk3N zTS$F3zB5?NwaV}beNPeML%F*x(arlLb|FFoo2N@RQ_W=qmbEgd}}R|kM#L) z!Aj|FWiv^@6qOs&Xo}LVij$_h`H={eKOQw35?1l%v)FS`)h z)h2FBi3ELmhLf4MR~%-)8Azy?Z_l6jOttd!vO_d`K+{Muo12IW_qqxa0A{ z$*7Ney*0Kga0Vvr^Adx_TEA=O(8pe#9rSmBC<&}fC$}G@FWppasCm(7N?>2bVRky1 z+T~bM24^OY#PB)hD$*u5#@^1dBsnC6YdN z@wpBA!dG|EBf2(S_S8Ni#Oyh|OHCY3BO6cg=*7$TP)g1?2OA5VSpSN3XBWCtjD`$S zDI^$Z zYFI^!QM?l}7*tLBT-)qijz1LV#?VB=_2T%SX2|L=jHjY~vik-?^cg?jiu0g+d@eWR zC4AQ8A&Eha$A-2AdwUAGmEMk3_P)W6-#Fy=I=21BJJsG$f0@JUm{#amOH4C@EFjhCq!vitG4OYPc_9Y1AZpiad`F z&odE;&~0(oQNPDEHXX4}N@V5XX_#Iz!-(p8BFSTGzd%bRuz&46k#H`TpGd#^2lJz^ z!K80U!HLl#(k&1__yk-QqV4kD{_1otqE-!EZ{72=43FeT8LaKcxFeUogs)d#wQ-Zi|wD34Gmzc{Kvmm&a%TB ziM?b#QH$RkGo4vup@Hv~qnCtL-$Rp38LQGf_nwi-J~Yqi`~aZ(v=C|ca*pXvfzYP= zSsfkO>AT{*Jr%ULD9fh2NMAjI#p46pl)psF&ePD<9(Z>Yspm~}|k+v2*@&W58MJgwa1jQTi_O*(#7 zc@PIB@VsFM1=!7)uR`pmpWV^Pn5)ZlJC=ZeVXI^`QNSqs}n#YMo@nAMtkZ0$(_dQOkcY; z(J{F9u;Z0(lM9Bs%^GS77#2*F5gb==wFBFYw;b0RA6ZKq$YeE+@q)CbaYx?AbJ%1g zjqmbH@CPX6&D?8mgMN)Rtqv=l8 zkD(|mRB56q0nYN}>dH4>J+}$juQ(N*9-ef%m$-9#$cpHCzkDS*)-=+xyV@m>R1fjA zWuSL#K;hBm&An$|BtH24klMO{WX$7+JZwRg#LQ+%7~d%lJ{BlKSJDj8{MoVP3x5Mk z|Do$lC?Ibd3k1XKu5Sn?E?g6=3HM8R?*EZZQ2%=#m!GSF2Iqc*4o}io-4*$yv8y)i zZ_Sfu=c?V&3RJ`#itZ1r4XR{izT2($r(+9c4EMzWPE5u^ro#z@JJtik)>!%anDJh%<4*wmk`qgLSDDRjIzDN<<9K}={^_rJ5 z6x&tKe+Za)^-fFwN*!_bk@o`MDct+aQBSYLV|u+omv(YP@hM9Pi#*=7c{PZt_TyRJU|+Yet$7<` z>sPt(a?dn-jCIz_i=ToAzhw}CvOVaj5+Q#rvtQ~-fz0b%WS3 z)HJ}u*3`D;?Jps)7HCe2V1b2r;ke-FGc39!+5j@yz-tp{BR8k@J)QIN38{1{vTL)| z!5*{DPkzBe#Pq~cS-Cj0^leh9LXd~Uo}6Xb3(eKyscc#fxWX0GJ2kq2r5eY0@JiYN zm0OJ#ZUw)G?-250UQ4(^B`>GDDMb>9k(vg^P@R+lWt2jufJ9yUD&f^Mz=m)7s^2vTpVm-wt! z_wd>mME0*!GFLNp0q=j3<;m!QI;K8KFiU&XRRIDYwaD27XS6@TKVBIelM^xf)R&Yk z?VsY#+n@RFfl-K7H9wZXFTCe~i~l)zTix61$&kmjhr#0dF1qD5E_kJWZPnFzr{a2k zclE?d(31%Cuda3^;w=xs8KzGkd&Cg2TiG8I-z#^= zMWqkfVgiXC6%SDe>=_dKT4#VkrhLj`eWkCf4>qm-{6`zan~Mh2G>)vCVS2T7qAupv z8on)O$6L$(I0j|)Z>ok4>bDedeI??omH`Lk$-Cy~nXhopk1%^HZ?8UX!M>G{tt%;E zVwYY)<#cC8R$KtKMA?cxg#2`Dy5iGJr%$db;qpajD8Oj@da*DkUSDj5Sqx9zR`lHL z@F9@SrmUhcgt7gYawu%`rEB5h67GSV7re@P*J`;?8R`Fg+1${&E(@c@N|{(d@)66F zGS8keF2wwN&TAQU7L*M*^z6Dg>mQsdvh-?6wg)QWSQ?9SK!DHytN68tVu`TiGC-lW zfD@ObSqIh4FO?a;SWr7@1Wl0cE}15-K^?;%npn7m7w;_{jfs zRpwYVvk&!MU7^rOX}&Bc_84#Hdmo6{o^$YQpNdmwKO>X6N)IiY%}@F6mkox}-mvjp zu#CMAe7p}7Y^*1-3>zTmQaP}QJSxnf6xg{9xKJDd2cwErpAzzZG|QTh@gJZW8k-(^ zd$;21RA^sZxOGooaYIFYbTC%r-(OOc*h#$vDAe-@fJreLM(hH`ia+T#3VC^bS3VQ9 z@l880`()T$s6!T7=gx_ zw}Hf6TK&;ddE$xSwb0;#5y)w@oxybuQ~-8&!~6+lBd)32iYVXu>4VU|AEN?M<)>Lc zv;rn7Jlw1YT?tOP&XESnnvyP<*0*$_Py^lSFsHEXF6(imbiMv@##d^k`dfZ=W#~%vFS?V^5}R`g}SD8dMvMNc0Mpxly1{ zrN6WSEMqJkOG69yd-;j#?m4~NPzDL@3{fsK1qZiv|JKmy=abHiF&5+P6gASFy3Im~gQ#EY~U^8v4}4aHzV!@=XY1r%9A>?0)=Wwn40?`y#{ zo7H9So}3bv3Z=?2SVXCQ$S|lGdQG>m7ebcF{e)^PkFPk~d*0=L3niYl4V|TSt zlyK2osBT<8Hpv*8n00bLfh(=6?&1kVJ9bIGAfN^KTc}$IePYJtu8r$nK`9KAd+%j& zM#v~bR}}ukf^8AZkXwNgsX6qTXg@aqV{-A+L{Mc}#?ZRxmYwdH&>eLFJcUx6bjKiA zdK;iHo?ry%!|QF)v3&Zb-?k>F6u=#uuW&AU4?0^1J@91lk8T`cZ1Yu46MuNZaN`>L zifA{M_Pd`#-$#|__K9vdwl&4!K(1cDmK-$P)Dnc&@HNA))!ShyDl3xENSOF_z5z zMB*&GSUoy1mZi<$1STvG*M@$Ha!O#ga2f#fC1P=!1J|m}n|$VRJ_yYcbSu_RbjIZK zFDP_;G2HeE3_B%;Z|!l$6wa&q`Yjf821wIJzi$lbjQvSWp~Z6f-N-n;3sWI|Zo#Xa zPg&KYPPdPx@UfVnPSij=3qWQpeS`VIKWm?%3NlJYo08|2fHi1NBfn;!WIBfBmHLt|E6^Q_sSL-!QO`Wa7`ziQMQfiTAoQdB<3IH4aIg&Fd#)LLmsSp4+L} zA5zcKwyDrio7khS(e(3roXG(f_w`YmkZ@07|yOLF=Fijh+ z(<74I_ltK&aR~VnzHTMN41P9~ZJ2rUd}k;oX12j@nUB9S`K70w0KreB^qA=vu6seu z)!JKp+%Ig#6%h<6S*edqr=oH8MsE>4BYMm@rsO&set@1t3@c#H7786F!sB*b^gm4c zR_PIa;X1JBqS4-wNN6gq>d2l35>WX_`0+R!%U8O_Zj3b&3TJt+dT0MqhDBNqwi)B^ zMrN)1GMiaj=X_<#XLinvoGV(pxDk9rG{0fhqSN>^W0&rfa*XPyAqkKo2BW0Fe4IN{!rZKJ|7qF6eHvX*r}ag>QwI}-ilw73(nnLLejH`nHb z9!jJH4C^AzIzhRsNJ3Go>>qcamJ4dZFrl`KwPV($HS5pfRRgn*v`@+WL40}pzrVLn z3&tb7%JlZyKQ{S$@gE_IW5_db|DgH%wea`*0oo@ER2BFvZ*|)Oh!2Hh>FBy!7fL7n zSvCLcK?BkFx2%sJJRBSTWd}VOP{M6JEs9+ebdr58h<(Ibsrvfs!0XO%(lFw@J*k$XRX{?AJ1uRQ=N^v97dyCQW) z|8m&Pao~iRymxS{{uX|v<@uEoSz3x;x9swa$9|0Y67Zk@L-))pn)kc6K*SJVL)R!y( zfNOgIhf|Bmh49fX4|`x6?*=%Vi5VcOJxu+dR~CtZsJfpKG*SNEowAMZb_*!ymfp}= z$q}XlgyAE#$M6#5NzV92)!;KA0eD#T#<)Rh*?9m8Zvx{r9$`=yV#wcc;Z*=2nQvDs zkPKSfOL6yy0P)^8DpkWx5MHnc)@tP#rMl}sfP!fJDy{hYGEkDb07Y_z?!7rVWEt$> z-4gA}_0Q?|Cqkld^P5? z0h+kOJJ_$Z0wY#i>;;*75pK&s*_vvV^y_BOi7G{bAQ8xliZ%iQUK$+d*WtW`B&02Z zys)1@jp(u!*XReCX6ykP$u(0{Hx}Sb@&ZbdPt*m~d=ccTPMvAF^qwy8*y62ozbe%7b_1$Clh5P81^;`8n{06}1*bSQ?9!BEHh zt78!$5Q^S+&$ZWg55n^HfLUvJ_ZecHpi5v8Sk)`~Ui%`>pTR>bsmfh<&(}6Q#QC)Q zOT2B4gtH^Om<)|Mn_0YK@O_(i_Uo<74|o3!Em2w6rz_A1e$rBb6vTF-MBFu01^hpg zBVhW4SrF_FrTEUrF~~mjC7OEmVxvBuNwFCeq?pfQ0VE}$El%+ZipTy4N`#enCO#$& zpy4Gin*a7|>VAq9gkZSBhKk*O2VeB7W_7sur-R{2xrffwl& z)B=7vNNE7kU2r8rAAN=F^A+f$y{7?<=fM$>QZzwNnnfxgQNJ&%9^{bLzGsRs-o+S1n6yD->Cu| zsm}u(`oq0Dk)8m7YJ@zsv`$>uYXQ{N2o=+ALGeYQ;+zSNs8G^2jj5t>D#c3(M2`zC zY`%AX^GCNT&I&z-Y>Wg29^cb?!*?JKzz3k55sov4PTYW@GgEg;kp6v%U1o!Vfz40G zo<_th4)RL#^E=xT@$2UfiKe!M82N8J-Kt1e34j zz@A~<>AaWK)Opn1nEZqYo6yl=jeN#@Bc6Fx4DiwXYW00uXW$|uki2@ zS|~;slU(4i8Xi3g_k{-10t5dx;Q&ok%7QZgcbn=C*tIZ`QY*wM*r)=D14X}IR(#u9 z6;+Tf1>0!>8#JpAaF`5xvDzYmt|vnb4B!HZZa>6$Q_jbWI+tm~d zUMWOSlc#eb{7g4kod~w3K^%qa{UzC5T9oU96@o)m^~OI1i>WCQM=;ZJl>cQ`2P9y3 zc|KfImh6tg5;2V2zJI9fU7IAwFj9gUWKHCXoo{5>QLAW}6G~q0LJNi@ATn^OAyNeh zaqP?(372lReev_@dVCfPoF;6o!W|Gqp!|69{P{vz>tcse1$Nd4-=*hjr|rO_pPFER zEQ=#A_NV#_@7WzU>xFzzNeU*JK;!lpBIG+G^95~YHbe6na zKvgmGb@zcVdI%MSZzce{Qq#1Rk15_NMxLVlE!|l+Pue7$R3TxH`sL764fz=x)jAN{ zuSSY~d!H>VBGt7FtVH=#Nsu- z`?bfR5^C)9Nkwc*NJ;8kkvg+^Wxim?k)_$ROV0ub;A6NNQR29gF!en3mrx;6hI4nI zwf8_tOR(6P4)NLquw;vjxegu9z2ptKoiHZ$!H|OP_*OO!FDpV6OP7hyJ_hjt;)

    hVd+O5EJl0KAJUs83K#;e4hAp?hf$ zaUVF-`<}g{#*+r>19Hh3x&1!7INgU_s5~00(&poW)6b#dC&};O9V%Vy#{>2ax@EDV z`3qb-DQn+~54GCaXnp4+Uw1X1$ak$@VXgVL_tRT7yS!UYNDJ33ixVC7U5`K`FO@o) zoX}})?KxQAQTH{uT>`%~;DNnh;!*?;F8%8Fy%9`ibhdj4ooI0{&LF=mXTV92_+>3G z`oZ`*&#A_{a3TI+Uq65mA9H-gXCW`OXLrx7M~wo>B|ln4U5VDW(_ps?gxL_UPdwej z4BMsMubh6=w3k0IHd^a^WTvWYJikahZe?7mocSe?@MR&qL*MbS3tovNgU-V}%<|W3 z95f55^Fds#}OD}HxO0LCZX^>a=F*3&A zjfTSr!)r{lFElNzV^CtWIDYQM2c`l-(1Lzj=6yiJ$mNXlXJN_63>3UH z%N9>W`K9a)l?^JLp;Uj1(xxH0)7OK^MdPlTQ8lq*M`5y;Y+m!uANRiBV#k~(gbz5=E$O%2 z3sJmDFL{&hnT9YMHpd=63o;TTtvvZeuIWy*YAP?#7;D_57iZ1x?H$IG%tE7)6RpPS{?Yi)oQIjT7PPm&n~hUJB?U78{5%!CXvB2 z?kwh70m}udI_C<(mYz+pgArP;QBd%?`w)$1CC7}mw_jggnG`k3{74kQ9NDf*A^q|o zYgXA!15ZP0R0e{k@*pweE|Ok+nh)QMyPWycbEL{PMZ7{B5dJMt#5uWQfr+$;BWS># zN4?QyxBr%!!iXS10+kFw5R(=OI%@ zw%MXYroiwo2YwI($o9Rq)7YHPWA`sNI@pWC zS7}x>i{1)PT1qI}a6u0q0U)Lb=1HQ&X%G(V%$v z`h!H`KwpEHG67%v62eBz-AC`;@h7X5Bwn6Aw_(UVmEV1*Lc^pNl}9))j+HLDc{{iR z^NRSl@y7;MKqL*bl0irn3wKAD!JG%T;o~1P!4nE+dFm0*CuW4^9To5tQZ1~+?~HB_ zK$y*68ozfCXQ@Vl@Y8nn!EMPqNhQ3#O?CDH1BmU#$WQiE$iwA=sOz|dk%#54#+~NT z^f5UEpipw=KD1Zi+c#OJ$2r@umJXZ{-!vxeDN>(Z?380Z7nK?GEXOw-{Le#lxYI>Y;Ytnx$XxJoa@!yEN0kyU$(Aglsh-T zD%{1`=8im3NL)O72G$kg0es{%jYpXeN%WOGkWwk#IpQ_DVPcGclVtJl<3?NFfM3m1 z)hELB)iVPkD$0$W3Pam^@=>HMr`ET7 zs2GeK%6e>)Gae7Ei`11KcTLeQ62H9f+lopg3{rR=N3OM2q{ z+BLCU7)xb|Gd~J)U9VU4spw4%E=V@V-730G&G#;4F9?45j3Ielk%t9iT^MlKS@WI> zXtQ#OR+$ck@Joc6vq~`8pS}!z5$w@5vnRatTw%Y78B3_rh9q6=4G~`Bs*dy^N37$` ziPuz)A6w0>z8e^t2HbEJ59fHr7jsFgq+e3~8S>ljA8=hQV?~5nLsj#Oy# z=D~5Tz|kHBs#|@GEN*atyIh?XEKNQ(!CZF@ol=f1L?7S@B`(HT26Ojx(@t+yUWT&5 zy&P=34Mrwz-q~r!Un`eTW_b0Jtp}ZNt$fD2A?@l|03ER@Ru6>Z{E?yP^fwT2M*R?S zg?Cd)h#U@W&>=rmk_dMRNIq-YR9^A|SY88@Y>2SrjC`_04AIT~r}m(GHEXUe9(Kyb z?RrB;NDwb8kfDNtPHpq6U;Z-s5Cs&}?Oy{Ym%OpTb8NdVI2;G^gOSE{ego`aby7Mz$TJz;C zaddeAjqL+2HHkHP1}u}ZE-!8%YlE9$RfchjS-{4*1UOu+4Z&Q@yTtCS=keeRkRu^{ z?Q?)W8A)ZJ7pjZ7go{$^C!D<4#$_iHl3}`xFAEUC;bd@?T`Y*?@=m zQwRnU_v@In7YQzNnE@c4cT`;Qbww{2{qXoWbKLZ!i72{hf7`%m2=kN3z>D#jmE|X9 zX37xZRAM~bug0<@iW1cr9l>vzYZS2*)3_;y!qu<^K16H8d6+*7!^eS%aaXZA9KLJz zAb9I{p1-0c*Y8?P{-m(~pCPc6KRfC~RJo;sm!;EGBw%dB)kVgvP|KrJ7jw=h2Roj$ zFndNb6s{mnt)yymhId}cgqEx7_9O($ParTI;5@r@Kt#U-1i*OVnElu1@l_i`_tVI; zoLrW_ytI6fclOIL{Fl|!`|Y@|iF3#0h!q2vVF6UCO0;2tpRg)#zfL2>(cuZYrp3lz z5kVZ7a#v|zsTqZ(LWV)VSy^bUPuFve7=9(>}?R{{-4;z0OWQ9em!s);{OKPfgA@vFkp7F~Dj znJ7&svJXYX7vIDS{JT=7M^(Js`*wcG>s-Kfkl9B#guFkTfK+ zs`Z7#*Q*$zQKjcC6_?$lnChglIj+s+X`T-Rr>*gbU^7Hbj^?sb!wpcsl+bG`qTQti zu7i9%7&oql6&dj99PW@W;ung5`9$oA&hh*2=1(6e|qEypP* z;L-Q=%(l8ZuUE*65v6d`AgkSnv0&Wb7BQLqS!NL-2^S?w4?ugFhlTel5x*3m}4C#Warx}AQMK!@4DJsFj}_G!?jIa%n7FAP-Y0}fPa8Z6jk)L zfvOO82c68M4$IK$Gx2kt-=_1QsnFG%t{^S>VA z5RiG3C{?Uv48V33l5De1Xwnt)g@+xL44FC8-H@^X1sj&uZE6<85tF-lozesYLm_XX zgJr4(--<#y(Yq0vTTwo@Ij+K}B=#c{Oq@*cK7JpNfY!*pS%tI;D?OBERp+y$S-OYi zC4hBrQ?M;M&lbi$0a;B&ia&>##<(%it0B#q;X18zFZzu&DfhKgC3l(f)^0Z9XK z!Ei5!E47FSl?E%3$>ln5ICvHl;wK>g?!n8@&`w~6py@^yNi5or3Qk-S<|z6uM1;tv z8PzgbmU)0CH(>HO3cVZGl_B~EW8#?ZV{ujsvw#q?w_zJAav>&r1F}1RV0Ki zm&GJr!w^D4v&QQRbIdN1RNNFKv~0xq~VrNFoyJ(FwtQS~E-v3|SIiTN%ST2I8iBy%Qs0 z$(~e8Vi5?2H9B-c`X(Xx@d6lDFkwViAg&Fw>$lhI*Y*9p_`zUZ*vFaY{?D<-h_=S6 zfg_7y3$MTDX-Eb$aeW!%BnMw&|B#x$rNphwEy(iJi?>pKi_MHW%W)7VAW+7&YAxxp zL>-JYDXP6I6yg|*Pe3PnH$Ia)oQoy)E1U6Q@|+Pt?e1n45&owel)q4%S-2u}+tOe| zY_@1G&{X9<31)X7zhl2k(}&U|?5?uT5Y{=%L%|PfBDE-clA_XtU80JxJ0Q}75lKz?=0@kYGAEiGKai>!M{KiC^5wN)f_Ji; zOxQ`!H8?Ovdh{{69q%T>=X>pfpCf2!JnBY#;z}_rr~`Fz1+=nDyO<-ok`-Ll&%@RU zuim69R4R$bql`yoG;?blI^V0bYq%OSQcM&3ok~Lb2j6#J^^5mZ+hLlvzk}jHBOIn* z*j5@whb2*&EK@n#`-`c?I5i3BfN{14nFYn@JpTipGtGU3b0g?UdF*q25%w{YW3i-_ z*VReVZx7z-Aj^2tVQn&J!2A13^+W4(j`I&Fs`}+z9c7voE%@=;xz#Q zHK?mE5O}a(#J>ORDpeMnugG_93TN5NcwiOg8p@7S3Gb{p8aKR|6Ms}bLXlK%)h^3j z^um2t;MQD!cFSf5F^dA?L#bdcae6>OhGyH=85(n?S3C5-RYT}!L+!8t-FPdDT3tm zSkR;&qB|%9YwCUpv8-BCY2rV_T`3HM`x$rXiPI=}qu|ipaoD37nDADL_W3xEMGf9 z@ZCDcxzHf{);^ z=u0x`>)xQp5905;dSMn?MiIYJMa*21*Xvp&>{@b!B>M95om$JvQR`XC9#%&@6%%y! zbE)7v<7^&ZW6U*%A<}_RsZY3g8mtdlh0xAe;1a{0+!kNjG-Rm+WEQWtDft&8a*sX@ zz^H5$1?Z&_uDi(gPiblfebxO3#BlNs-Xh)e-KQgxlce>;6g9t4eCs)A6N(F&FXp zWYuNNW@b~6o22cfOTApoY2ZardMc=k(DNQw8%9W*wrgJYa{dY2Uqwl6;uG_^g5QSa zbaDOxtkUGvLT0W~RT!P+48rPs#r7C+Ug3T2lu=7odL4!Z&Df)5<}3LVJ&?*Fb`UE8yX+LT)bB>iho`Z2w@B8TU}c6@109-_P;Cm?_K}F8~kY24jBM zztAwkr0lQ&GlV*_K>lC9_!?ko;7C0r{%s=u*EJCZj1vLg$UR!^SO5CO*8zuv>_s;7 z?+57LpNp9QtHe&YfZ|`j7!BMG$2Dd7f9~)%HjRNS;GB#*KjQiO%YOfG1Kf`0wb<}~ z`l{bnMpX!S62(jJ4gU3uaZtB&jg|cOG0@+0XIp&mBn&zLDJ?R^1ub<%bsfc?qxyER_GsF-JvI%#T2$q(`3bm|CTw_ zEW5xb_xHZ=0=e{o3_2cCD<3i?CQS`YT@oHnh5nRFe2@+Hr z73sY?n}PC3+abliqAxJUED)Q`8I^6;F@8U}8_*Os0pVBt1eF_-@N2BpZw(Wldev_i zJ!dB$EsNpzt?()mb(sQC4|a0SUvz9-T|@@f=r647eDoE zGlOTN{0_5nspWo20HW_p&rWs!bFEr{U^g%Ti-`wgd2jw+IH(U9gBT6{M0-H9jF^0? zK##)dpmZiFOB4<>0L$3+08Te2z&azp=T2v0T);0tWOqZk_E)@d?~LyW%rpn!{0@i^ z@C3dv)ic1dWcj1PjyW2j@71INx0N`7NdT_`J7l_~%R8g(K;!-$Wz1{JAp%(ch115l z9)dFzuHw!^=1@5(77qYB>c`A1SEqs(x1pbeS5_07QGh?nvZd?|)jd?u(QL)^Uwh$y zA0{vz{4(mv{|yd=rwxF=(F!7y?-S_Srp^W>c~yMOx@HfI8y!Ke1_AHc+&D2ZummK@ z^?BvYMDg^Cn+M?D_7(a zSg|hwIk9yu@DHs6?4~+J{bG)r*YViETcTK(jv{QG0N&&58|QZHHCv-s1_7S2R7`9s zmLz~Sb1+tP7DD6b3>zToF9ok={Td$(y3HPfix+2f;=}sq(s+v%KThNV`muV@4Ufj) z-MJ63vTT4!K)8A}qS#weKJ-P)ImWf1CD5i~+CA0-6oXl?@EA^jG^P>7baI~2G*$g@ zb!@1}-{b*dwoSb?*`f5gNUWhcVG47(jMVV$5nzLOHv*!<_+CVe%!nUa#G$7>ced5u zy{VsxHNUVRGJJB3s?GI)>NSD?cG2YS%OnTmOYwR5Na0ld+7kVJ)9Q5^*@7%y?Wyk*8UUQM4i>5!Cnk#Q|rK zKvrH86*v%h(h8ypw^2c!i_#j;78Lp;0G9a?IQA^bzH9yv4Q10DW2Lvi?`JUK zUG0K0#Ru7~0j#=8``nQa$2E_H<7Bn&`_C-lX;$g~jLM<6n@Kn!SC z<^XSw#3(xs&A7reJmg+d{;%g;tJ;hN&BpDvyMTr?Qt}NLmhc_2euDwOL7AV|#ZG}; z%Sxo=Pk4{W{b|{Zsh>L$(#7I7BNqlKxd%XzXZJoVI{Te~fkug~zTFxs?y3DFRw?r{ zafALV=az+uJJORmeVs$WV3m9%_R^riUGAC2VHR1a7^6`Oi z5(J^vk1;K>WP<~+FmZd@u4auYun7V6lyVkq+MB!1tvRpHZME!S%0jyrKUzwumu$qg z8-W30+&hG1woSK^pfz`=gXO{JOxdk;N_w)+%me8qro7HaS`Wy{-hyXZ_>BW#?J1rUi$(v?~x3|qKp5(Tm{J(Bp$r{U-m>o0yKr^Z%;LDzB1{C0* z{EiR5y86u3F3%6b!X5)3mB(zU;jGcD*@3qumTYDAKY^IPKELtHuMi0HV#k3DX6@^` zD$U<|mkb(gIJ%VL8ekCT!yWs2dLHUFEic3h&H>&Bx#WS|Lr)*t#O4aEdT`rM>FvPS z^8T?TFhi1^LY*`FAPz`apJ8H4QI!it!;BL3)l=?LFW0XW*NIXePx8`% z2^xmYDAAd?R6G#>;H&VnA8QEA^}`g$K7-d(8}mY8?uj6qB1= zFDaOVjrB8(|1x9_S_dzy#*@wZF2~T3r=TwmR91N6$~pVef>hS zo3@jVRD0(eAMSE+5j`g3!3$52@r^#f54Ud=216<`5|Zi@V>&E31@iuWBH zkY?FQF~4AD@u`|V*5+Y~ya)ZHI5O|AjfQm3Uw83pVh23ox#$^2lc9K@c_Lz0k^Xav-sWoe3PqsEk_4Z?b z0lJ2knL!tDUE{xFQmwj!o$K2*%6xyf$<$k14X#h5gAnsIP*UjMkT7GdMr;E>pv9tp zfM2QcB9#>hH;taT^@BbT-Kei?F~Tpn?C|S+k>`s^mUm(7_$GH)tL%^cb}?UPEAN%Z zB^dnO0HQtw+_|Ok`ZE$-RUyt2@YvEiYD{6^@br5mJeA-a0M1c94xc)ativuATS1}W_@GT*nHewW3hHr6Jj5EA=9>~oW;ISmIeP|<8^p8!INzm6 zu6DG(neUA1oG~Bx(7gU~29yxM%$d9CS{8c0h#4D#2$Y3v%DruX^hz9yKsmNXI^&UA z3ztL54Jo-aYD%;h_PANTq>v}>f%2r$tRo~CiqoHgMe+mjQ|#tRw~aF{x|QX9$cuKO`dZ=#aMTw63=tX8oWc4fp7P^xgA{*ZCn z`S{FubD=z@LWzT5C>3P%Ko4!2oEqkv7F;+K1TNOc3jbVd8q{cSj@NdvISOa{eIM4D z-0SOE(Y*|_e7FwSt%+2AONz~0CfF+d<%1udyqs(C%?sX_(6sJ~`m9TS#CJkoI>~;d zInMP%+v zYcqV?D)6En0H~o<^s$radpJuv9se2IU^~~Pvi^_ic>7nBBNO6R<1^j@B@2lnLb&C& zte0V1L&tWkcLA_EuXH@{oK3&+@OP++5p7N(gDjH@dCZ6N6dZGaiT^}0^&C~_$+}9- zOmPL9u}=HV)ank(CI?@!c`axv(pgEmwYX%R;8-m4nckpsIoZ277Vr_+H^yWl{)&pe zylVyAWC%td$G(U1AZJf%2uIv0u0GldGsrL}_aA^l2eKDKC4*?z2{a{p?T=*E+7T7 zPWX&zdq~X0=ewivad$*P?qlG+*fx;;H0M{q1P1*rHi^fIyQUQjUJKg|LMxwB4VGBF zwx2%p^+6iEbfPKNUHg61ESE8gg0UC{V41{hsu2_RM%7~h%yxmXb-)y5dWe3Z&bMb2 zzq|i=RQoUEa^Og~>VT8Uu%}?H#1WL;L5)RoI}3_?gMsW4%!|2JiNg-=X2gRc>p`Y! z!xf^@6bbEnjq{~O)1Mo{qKZ{r?o2&S92*#LyJV){+E*Y>wn&MDI#wtSD}=G#N_8@d z==D#I)zdJ1iNotmlwL9=;d-K8PTk$te(;b9ak-^Xxo`BGPIcRh4~d@`jWrCuxl$49 zMu{H0w^z6S_j_TDCLY=@_Sqn|Ap*b`W-1Q|h7QA;$#dK9GTm$k1(v;}w@;RHY-(G) zvH8&!wwBb_mxKcO({d#*_?4y^11lCBWPTF3+GkVEcx5-MCs&MyKArqp;Pm6eqa!gv zIaAu!-4_$D`anUoh_b~r{nAdPy+s{XDtXLaE62l>B*kqMv?{RawA?`>qedZC`rL>@ z&osa^zUsrb)#g3{9Cd1>=IRv$1}}S~@Kwl!Z#t ztDfEdUuB(K23ZJJY{j0rqY9?u9_#x;E7!$^$He;?aavs`Zhr>~N$~N)U<7Y>jar}fG)uw^OJ?nO5Z<(6dhOneFtIBV5NNbwq z#_9Q_U+<|VVux9=5&Io5)iVneLoZ|vMnb|)&sCDvJfAnt;p$s8dKqUKY5c5L<9U>W zmEis0sB!5xAiIrpkx?@+co!YQ&zADFM28}cxj<$FCmy}VT&{xtQE$-pzZfQJy~ zj1VrLB1ItD8JLFu${+xuDzgqkl2a&zG%C8ylVn)O(U>Ry&U)f)B~->JI)r&nUu}oq4TZM zAH8lw>(gNo?D55(_}0e$-zU_}zBHHSXx^zJ6toU2`(d!{xZb=;nildI2S$VC&U~Vn zt{LEAv&No3=22sI$=r#>#4A6oL@u}y_2+%?1w5o;Hjivt6|xIU1`@B80usvgf`ojA zub3a7?rT94tax7LjTdT{sLm*b^>W+^?77KOVkJqqypQU3P!>nQ9$CF4{L+Cv+{!02 zV8U`?+S|*SYLa9#%eZulp`;I-7xTuz*H=4h7L^~Np#Vfl?b-cBc4gze9zIu^eIN!g z`pZ~J@M-cB7S+bcl&+ll@?{T-rIAl|uVD<&W7!v(MT zfLuUnas0k@XFuV%L>+PaVkSyl7aSfauhGmQuY;q&Ot!zn2umBSt ztj3jktL|p&tyd>3{uuSQh+q}Fn6ZD%nx*_%Q05ZAG(!caeDy!38BHm#M=-kh)Z}cp zwlBcY0v~(zyU@a>&R2AGKXuT zDHlOY=YdKO94pyV<=Hz@%rtbY&nd7!?*VEAgX)45J1CuFhx;3Lj;7T{=xx#a51cM& zf>^X>U!x`)+I?IO&AzpPug1m-oc0Spw|w=IZULC$Omj)PO?Ioh(oRJnB4cfNJBfG#&uh>BMFtmPOD_zsY8rB;JqC9d`s0=`3dl2q%bPihMnu056 zzR**X>Y!gSYGhLc@{+!)egd*xKpU25-(H8(II*@kpd5mq?Y%!k@qI16qH)d4{5W(c zQJ?60?=?#RyS*Q;y-y!)(T*T`{U75Cil1sUyeK7CfzfRjd63ro@KOMz16`!TsQH9o zI3>UjprB@wP$qQQ&UU=tyfM>U z=bLSc51Jm!!+T%|IJAxG&A?xM(9hQ(21ZVtEH`j|0Daoq_)T?OpkT^2v`Wy9)nXRm zU}Z`E>XLn{wiyO@)+)HJVI4^4}d=zvQ3>WeG9Y=>hkylqEhptSYMosC|YC zFrvWvvLXa4$kO~79K}Sib_Dq+Or31{!%H{Pc_A!=0)a#kAfk5I%;+{JTpG~1MX}?S z&)3o)1@^zg&{q4i(?c5PDhQ0x-T48`K1#enQ52h79!VHj(e-`>bZ-gvHUTO4=1g(o zD*Irer^Ch4zz!z8*(shz=|@(rciqyTgr&QZq0{|1bj>14ToB?usQ1E9goy^xm2sIN zH#La4Iqdw&AINH4Sfi`ze2;CuUW?C*lKd%*XeHVo?#J-!ezRikW15JAkpl=#wFKDc zE4Q_jxs^?@1;|kLQI1{Yx_I{+l2OeyO{S&lA_{ z241!M$8GQ+U94^PlUC5arXeh$AFb?X?|Xz(Ob;)liB(3MMoWDFu&k-`EFjy=q1-r1 zSn%$8L_7@9SDehVZ$Ikfri07vaxWR7a(O?SxJEiRN2{ZCkSK`uJO79#MQkzo{Zs`Z zv`ZiIg*sHGAn(QhYza9~2ZZe<@Yf~6!>C&VldX!LGd<>7dK!M6#raQ4!Ya2__ygbV z0=3f#N5n`3{D1A1S8!~rT1-*O^nL`dWh!f7 zHZOLuviDt6M7wh3)ms@*egu=Psi^)a`OL!I8PMd$f8m3884`( zS17BlPGp5HU_b3BF!KIgmchE$0?co3t;)ChzKvO)beQYsf7;i34@Y*ou)Y7V)(M6w z{Mcyuz&gA&tYh$&KAIEq`sQj_ycLG96ZK$G!)yH{HKQ|NiB+Nq$EN2)2t(J{)?Za5 z-+~9ATrGBh&a`+MNxTA-28C2OFBIEAw$dh~d1$3qNmyBT?^ADsLSKZ8(oGRoj-;-t z0yB3%;KeJvgNi0S6F?;-7mQR{f!EGW^+`A%w$n{quJ@eD=ffpGyCHjE1bKsyXqpc9 zM9l2r>h-p*kTrhX37UCb(3-13bEk`_tEZ7SG17%$EAU7w@s+3BrGF?HnSl>McSVSI z?NT^T(q5{j=W;$(m!dw4J}uLAd6Uy^ALq5&VY7;nxF{LN&v)v+WvP-T4Q)u^c%&~o za-Xr4)3dZ9AQ@q12&HwhumR8KXF##*TH3U)(tFmrA-djsHhv&wnw{>PKqzs_h`?wI z-3{mN&}nw-Yz)j!Sj~Mwjv2+={o?tNwZnQM+aVe+5t0NEb*M1qVB=5v?iwXbeuH$M zH#>q%|0KrXPu%CfUv-5-qpxzg-2V+C*YE?NaePbE7n$F# z<}c`dLkQ*dAY`0R`bP=<-#-r6Cj~h6rEfOH@1%&oz{3_4@ZPei^5);z0P%0Z6|MbX zsn+;yoBiuv&QS>X`2*c=a{qFx8J8$T$DbiT_+K8=XD1ZLz^UOO`=6lFfB)(lJGi2= z3nd=1zi#iJnM;5l3hehAO%VMz1_Fm9xT5|A#iyBnlosQzP&+`f( zAUy>GggF%Q*;D)H_4Z4de&@gYPKV|vn6}mf(Bd;{ZngtjdS`IjWP-E#NBbR+_g0>Y zvTgud#6}1K-M3tD-WzB?`A<7@=#BQ+_bA~4L?f*J1WDeFye*d_dw9SG8fYl%QRv)% z>?lBXMM5fY5t{|h0SiC8HZXpFsQrqj+;*}4n#Cx?2uYMn1vsWLSul7<_8EdOHiHtijVYoJh=(!?cWY;sG9829S?-UsX{>b1g`IYhbwAQ2hAa#FIgR z8o*N@HGZM&DRPs|afFU1b3E_ldz*0n2QmfYc()diL)^Zk5J|gPGimrpYfUYTldId{5HAWN9nrvXwIlmrA=fOG)7&xGk2 zi?O0W%VY2Dd!8W8paBrb=a*3Jub0%wqFs0qzBtvX*K^w)Fp{Nu@QFr#b|GFDR?JqCAyAxga=Fuj=t z+(TMC+~bGmK-=AM1=15dP)->gub3n6c!A1k7BGpIB7upCNsshfPy{)GpGw(PtJA?E zWd$WaSULcpRs%@R<2IISK`pP091QqQwB*en*D-z+p;As(U%dBZMCL(M_f!CBU6D4^ z8SbUI{_sAJw$sVr_G;Ef1QYZ83Haf#dRl{mj*bV1V7u20&QPHxes|(d`meQ@YLWl7 z1KBbKj6j&f96kVhl0vnJnEHjwub{DN`RT4yrBglpAAg})RLLWOd<|Ic$~!2}kcZ!a zwYn$J0VK|VVlvh};?AORIrt&LVt>g8k}DS)K$U&FQ)h)r8YcL1Ng;}U8`weW)B+-^ z&~vN=l=vzj1RFHJxG#y(qKd%EZCnzChwQ^Tq6Y*Z=y!%h_P6hHqELwhzRBaBXsFNW z?yeiaZ0m=50m#zf;nH$3_XB00vaX|Vm9YE99@2_?SxUuksdVc93>4dhrX-^7e;p?% zhziVGU^HqXYw-n1dhNWxNz4hA-a@$y`*?S>4wZ=wp@%F9cmb$q4upy90Jg5Y;n-)P zB?vIN@DCgg8h(Fz!}r}wHk>T2IvJL${7$ubj|()JfnOdt4lTr1TXJXkYO%cGpe1>*n1+Y9u7jxtxa_qr=?cUeT zYH+Q)Y=c!{d!0<1cP>-3gX}W2-G!zl8r642X8@$;{oQe9TjE`*t?gC6GtVO5jSA7CAWr;UHSo=fp!5h*?SW_Lqh3<09<}LmnH`fLm9C! zX>z31AERcG&W~M+1+=g**+|b{!{m?sV=d_YFZXIhd;}cab>^|~bY_!Qe=W-TyM8bd z`X1-$KYi7D-~#k}xIG|thEPV0q)u}p5cdw`v_09b2jLz4>%llBWW&pPB|&e%HgQMm zTNdxxWBG;l2=6Exv|n5Y>2u=*zJGgpJ;T0UTIDWx`AVUSOS8`g41P*aDI*7KPALoe zL4>{Do)-(JgqP(SXu*q5DRT!a{Jzy@t9?7+>-mqr0N)q#h2Vrt+0bz=1J6d?Z(Kif zc)lpU*^D}Acz>Gha&K!7$JGkhGi;TYj=6(b3*u@5WQ}Tcx0D^f9|~>SQtL< z0^{O1+JP3mTp{+B=Jv;Xyratcc7zMG>lr}=1*b$w**;BDk2ODery<5n+Dc9-_XZm- zsEu)*NTIGza9PrNZ|5{oW7IXzz!!Zq@(HUubD!-&(%GfJR>9eItK4jzPzVxnoys zj_q^-_)41TmO4Kg2ayefuHS1x_U)sMQ0~3GojyNswpw)2^l+LCtB-f}9QB*6ftPcr zAor=U(@trf`1}j~JuO3>CYi}Bag*!CqSoww@E~ogFYh(U>#7avO6xx4FVJKdJQU|H zmOKHcri}Zv?{Y*)%9?}NNz7Z3?B$4wKECgI#|}esocp6Px=s6U^gTetK`|WN@#~&_ zju4ve<(JPX7jCc}8YkPTW$_QqnzhS$-k;{)ik`l;m`D+#|0?n7`{n7^4-sALz9n#3 z>5nUL3%Ra!p>WUpi7OXvG>RQpn-TaaN5hKoicK+j{NOdQN(^dzn=5pv>zZNPcK&7E zvS8OfziWyngR|=X-{tt{W(?6C;UJ7;%h@>d^AnqaKB#D z5+iH$p)skBz|(<8o_k7KMiNdbF~$Joj$!ag_wQgALYh0!(W1~v zVwb7fxq09W(U36(oRzCrcihC`7MjTf6s5!p9wO|eRl#;IwgTY3PRY0|FFroUB6o;N zVA`0h5OBxW0*^5@3V*@69h$wOzFxB(9(m%-d$JMcswn zFgK%{5TZw)-I@q{GMn5=nQCC(6b zQv^Kn`HIvo!qkH-y^l6@Jwx|6XaaJT&OUES~hzy zbt_O`|J2{o7X|qt)^Aj5tYQBe-Q&)D16}>uk+sb8R*9TY2-b7jEr1q2J&Ac3t4HNQKhG4FPym*hALq; zyZpP3Bbi8lml7yi$}N-Io8{A7EM}6^s05dj-GU%7xbRwykl_a(n$0Ix{7mnTa)n~wFD2?4L#)9& z6P`CQYwv};r(bI_%UULn(V(1Y)}4GF|D@}RytYUEF;!%bt@rr7@vQ5O;ehPiL(iH*eIXNzqy6iov@5SfkpjV8@ze4|_6K|GUE$pq*N z`HZzsw>u_fsM0;>H)gW%CQ6045&W~MhuYlpyD9cT%892>?sLs2$5ewYHZg>U=j#gYvRT^POVKsb2IM1CS!?pI7>TreMc>2V@};Sd0?a&n zl`#!IXj}AnQ#XHzim_cN{oN8Z#7Xs3cJir^1_eCk;nanFe&Px@$R z{V0@5JWR36+YI;v5oQS>)uwta=Ree>KiP)7+2_@bB+e|Ny@_N5aGJGQ65yrYLn_Vu z1kiS94|)ZVHiyLI@3Nc+<=r?Ub(+-;%tJ3N#^4qV6 zGKM|$n&InE3yrB@Z(8--s$K5#b^Hk~dLj6DxdadLv*8XUjC7>^{V(8BMyzwO+q!r= z;Z6shy2so>)7J)M*ADuQ!*uK|I9iUIfn`ErZRC2HPQ?=JxoUE(n~56eYkf6N5c77)iu(dIt&s@i?RUc%c=AZ4*wbHeN~ub`+Xvp@>RygTSDq>HN@=Z#&+0KgAc-nBZGwv z5qgWy%a=AMSL@Ps?i`@uqGt=OQ`Fw3+oE-{5Yb_+zXW#!#TJ$j z-3geqmx{Nfh9F&dj8#!@p@5xuKe<-=-qI~nPi>?Aly683U*u_YG;$bD`spJcvuds0 z)|vqQ=7Xq*DHl(Q!e;nJ7QULNnJj!;C|5+&q91=QEreMW;5Lxj9kFU%jYu+%OQzh~ za5_ihvtqpD*zNfgEFl;b+B7$KEpSUTT{wdN)$=_gK6&vU!quPdIlY}PDWx1IZB(J$ zE_^1LGh-XB`rP+Y>_cunWzn1BhL&ZEly$A967B)SgU>giU51&7CmNLw-IGDi5s5r^ zZ~3Z0R4Ur*ii`?NbiE~_4oT!GuK}Y9GBAvzmwaf9$-vm+}Mq9U`hvflPAJ0V*NStVqz%!uq{&+M7)d%mvw8oBT5_wVno z&wn0yd-s~p=XoB-aUKW%&LGQ>=|NFOp|4ChQPe$(eu7RetuZrs{aN#027Ooh29FLr z1#QD~i{z5;QObNocH1?%YVV66rjvXj zZ^hP(M~f9de=@@okHZx0`@yX+=e*4s*W!C^5Uu)ihb$uZo=>vqAaA^+X#AltAcyr z_;cym%YQd-(aFfQ3YFj^e}Vfgn0O}KF^4?~D7$<@EmxDfcc%Q@sZ?9f7nXqpA&TPi zPm8@u1Fl)e1NmwfC9`YRu%4nz%*8Z;< z@ySUFBd*r;{O@x6AybSz>J+U_xSH=q^+p#D8>)t0W9UQT3OBZ z-R8~g4Pc7un*7aQHc4ea)c)M`k7cSOc2n_ur^;XCW@69N{OLA|LXuDG1pGN<15a72 zddj3f&hXgbW|$J6#QLT1;-p0U!W2XP5Hxyx;?Tb73&R{&C{LR*E|(kCotZ_f1n`Mz zd^FGV%MvMch9rfF3MN#eC|VJCBH)EWpGa}{O>*4{@gUN;HNJtxvgzK@Iajj|kBU1& zOpaWke3P!PvSbBr+Y?}pE?!K;^BWwSG5&`2b$hi4elR|LK z@;%%cZ9T3PSNCI*U-GB^>P@@4jq;iHYR>6ST3g#-$j|Nj=dpQSbBwVp)^kNZ9;Y&J z8t~QJw{}rud?0wbTG7)O#Jt8Y9N1D##9nyGA-+Omd?;S+ zq0$W=t)bwaZz?bKh}AnW?yM~$rMq2|^=pqD(rZ}U3B@c+1d&`;sl=<<(^qR9Bkg8z z@lyR76QLJpe9V&n@b)_)HD6u5?oy^Ewvfs)j%1i=k#n4Prdnun^=Eg;%vcF}CM02r zHm;)oep-*1jQ{nLY%_h7P979!gN2`_zsvAZUIpkP>sI%}_0>2N2N0RqD7`w&Bq{$4 zlSyVmmOXDiCZ21zmVcf5bV%lm)rI-?W)stI5ko6GeP!HQ#kv$F;N|%pgXfRno7~;pX_*8d_QpeQv)Dw6T+ zi1Og+S|i2AmDBlT`0_Z+eK2Zq-)69CNQ#<=BSm8gbOJ4HmX(tm-8S~U9F!@JUIS8aoJ@=%QLn{QQ^ zZ?&c9O=&ml-YH|`afm||HdkS$;&);zr?o$7%xls~E~jEJB@`3$r=sH(NT_Z8IOudx z&EEO`3}H4T6n}BNF#QW$K9^R9nn~&+c-)w$g3e!gsHemG?w{)=f?TgVvU3eE8;+0FZb+9ISp?bT)o0DG)eFC@6 zWf7PHMwR-awt7mx6=X&S_a;@$LIx6BGk@>(aY$5EH&-<4-YhVDZ@xc&B~Dloqli`t z#Kb4C&gFT4*D@EFI{QglLlnWp?v`KvFmY7$>C=3|{(y|Y+|wj_!}KtmPG0$@L5focV#1IH~GD z8H*>+&<4$zXhV%W1gZad=%8l%zY)H>yCUoxQ`Wu`-W<2IxrzZm|70+y7o3! zZd;D-wGd0;0ng(*8B!vwDE6l5QHop z9|s%f>2~;2@2_ZDca`meGc7Ur)mIlA=Tx7015Y6Fflys=kLjv6J+;$?=0`CX1b0`( zP5bbYL^ys>3V#uEqR&0x<;+I8cm33$kpBWg4WD%@t1|KXMbUp{_L<$;;SGz&XF0bN{?a3) zEM~i@xtjhLpKu^99*AvjdIw2xHt3i zUfz%&&AHbMCaY3GO=6}H5cB3D#qrqiD&<(CClVjVBpiK9jF8Oub-??G5@*lYAYu!D z;*a0h$grJLyjJH4pf0@7J}Z{HQBL5_ndNz7(T9mG5;P&oZiLa2WX@czG(W z#s|Y3?Q?YF8sh0L)OyeR+$(5_IW9ZI78v(N&N#=8AD&jH`XV~4FIw@ZaAVWE zM(<<3=lrqfsM@Wraa(!YJV-)Y#kl$5fwS@$u2%^<_tSS|@-@zHXMNg)TZQnRCjF9$ zFym(mB1Sj&*1Ti0{hT$wAh z`QyLrj*Fh4(2U= zAfCoPb?Q{|LN>ME0?`bm+gy%CX2~zz_f1PZ9?p&7-&l2m7mEG%Nqr1$h5NB=dunv6r3iC9UvuljC}QW0$ceHGX4Y*HIls%4P}sQ9FyEC-$o+MOjy}KtKOm5lI)*qu zF8Lb@uCI^O-<=RHp|*+dTQm7>7i$UrUElt$+S$ZJv^+j)Jr{oe*FS%jDnaBrw_L9; z{i}dTDkaB3b`x{N-2rbhlwU0lJIn|2L`v14z4iI)3*KYF(5+TUGgFALMcqH5>rGFL z%;c)~$4;n@f73%@pM^9Y{KTrhm;a`-YC-~c*0?k<|L%$Z`QgqO9I@%xW^sr1U+dam zA}jcis2WI~o;jh;|D`eehkyo7JpdG1m|6KxUjP2DfByW{9xl`4iZeZEe_`f-=@~## zMJWslElOeccl>{=9DdVTJwr5OlSV1n|8jwAYCtpAP&04!>g`|8$#0%2j}zgDXjd=< ze>;W0PZh2a6%)4F?FE(JB|(4w8XONm#pX=$2K`^og~tvwW4v~I2KO$WuuS;RM`;nw zSW~$a!9S<)_o<>#h-M7+tzT5@UoOL(FdUKS$SKR;PT}u!#;1V`_rlDu$o(#@_K7J1-NSQu_mUd3iac z9Ls5DW&dFGZT_dM@~nHWv$D#6dF1Dmc;LpMvjenwJ*edM9*4mY_*Fa-nCLK%1409HG#=~k zcv*;3{wj`DWM2QwTd=c$CJ26mGR2^G-_&%5VflJ+nxq0z_lpUin;xnXyHlFsalqqj zM!%_Rx%SsFAcu3G430xSVp|lB<2g=Bgal|D*P{BBackqC2d_tl^y_&)Q<{Z(l{5el zKnlX|%GI?ddI}@ku^N;KI4=-D)oI-2;rZLi!H;3ADMVd*BgU#2By-s4>ypDDJsbyW z_DcuIJ>J%VV2%U?gTW7Pml0s$igQ5kQWlPdFB^!Ysj7g`a$3zk`Q*u>Vc-!HcrCKB zXoR7W&OmX0!HN%n*8s4TxL1AaLHedKSh0e&3=gh7|U5M~!FBKSA&8z!-wyg|>TzQ?S%K__1in$Gj*j2?H{ zftF?anHp)*kL6$ezRmk?ic=DZjH##-^c=mj{fjwgqDR_*BI=q{M&{*T;-DxR5G^6n zn%M*q8PaqH!QeW7uvj3Gv%*)QATGh*9|^^jHLUn-%g+!RWr|y6z>8>b#vx$kqNN8o zh58~4`SMfHq17XJ95z0sM$hXQ&ky^DYY$OoGB*pidN1`z{$1GvwSo|f$m0UONXG_*BPHeyw<7l4Bdd+62e0ei7y z!Vxm~AMM&%*C6|#={hxnQ|P&G^LuPK=9Xqyh*U`%VSsOJvn$n9+@OBh~bSdn>)pm*b-h~)TTwDt=oEOb96gVW=u z36U-FRT$H0`bEVU>KklejRj9|lviLNBgv)Wo*U$HI75b@wj2iun;E|fUki)Lt0#Ry z-=~ji)4j8)4`|&1JsO9H^!YAZYw?r+dX9v!hPVXGkl9;lmbD%XTZlOZ`xifg z+l{}z#Y@&jm>xAcTTH%^-#^he0Er0NHG1{22|8P~eMEm)I-zs`XyO-}yPKYHI#zTRIX`ZH5z=xf+375TMG&XBz{sqZXDv@jYoUCG!?YF|$v^!Ukj zqvyY-%KDz5T^^#M!&7pe5MgF|Vh-qu%}lR`TH+-qi5Q_I_w7NBJ4DzSM4Hbc_y4{; z$O7$F2uO(<1T1mUMW#mk|N3*9%N~ z)31=L`;!N-vjB1(Jw_D>xsh|{ofn1ZydrlnO7bWL$>{shhwTF2ROE8%u9j89oF%8) zCuDkvlDhK{EREdO=*mAy>ajf!gEw1H`CQO~_~gBtR5m!+(XVJkAK%9hyYMN<_<-Ry z)=iB_qFSuuX6EO)qSB3|jP##tWsA#YusElEaqMjE5N$X!cPXMMytxv1BN2)9>GO9= z-7F(<;ISL4$yN1WK2~w2r*|GhIUlo_`mTX2R%26bs`K549|=w=A37m7&L2#zSlGy? z>6~YV2`AY)l}2s^%6Z%_w*DM6K3F4mGbBPGjUAWW<(c>-B2zB(_IDAtOtq%|{XOl8 zkTR+Jx}pPeP0iBG9esF!o(d#^jSJs`PZgdL1Lw9@oY&)rVE84s^lfXG3kQc5^o#C| z8ylzbNWTn7czSr0k2QYPB$5-w%c-RGlXam53n6QTBaaR1jqf1WazEmu{ZUr!-R9E7 z*LF#3?Ff&w=^5m@t;ij|IO2$oZ0`VgY-@77ZmJ@kA^h(C#$;xvjH0SSYOwSJUBP3n zXr1;wE^VnfXP|||#$Mz-0tJ=!QpmlCp>q`%MDcEt6pb#MA=r0mmHxrOorAlACL ztu$Zb{f4Mbw!12F+@>R2G;hW)$VM2pT7IYX>$3&b=lVAtW|Lv{HG#dG+u$X)bwEk& zS+PZ;m55eaqe0j^DXyO3aNh-+nP_XZWJIMj0RBs@bSukhJ4HW@iC!0JZH$~9>=>4p zxHO3ft#yWY`!g2V=q~#OJ>pRLcukP5pwSGw|EPi%jH$+91fpXlyVPi@?A+02I(sL; zd$+dTo*~llwO7g}_|xb6HfR}a>yd!I(H{=|OeOV@l}U0Ivcl+e-=aLTJv2j{Fszj~ z>@p0Ar$6g`;`SuS?z?|-bu+{HV02&p@<3e8!-86D#xfNDg<-_#%Qx{xNa+NBYFaxz zxP&z|n)$j!4=J&~A_Lp|4{1L@WA3ctui(-JNcv?momET|ic_}!1J7h#qEqiq#Hcqb zd3O*94HvxO9v&&Tg6tXX9WZ`NZX9|f!AkT}Q4O*Ud3(Gy&|Becy3C+x2tGh-PMMyi zr+ukHTUk~a+9yG}{5-b?J_TvC~5CaTfH)wFtqmg!T z=9My)Pr>z~!^`LPNpwoOqJMi)cse@BNRCX2?m;cb1O2?VFwea=BApp zW-K}n7{%GS{mI0sMPmXJ0j4Wjh_*qn=CwiMpQ{kKdC@reB9HI=sYYC9ev8kVmRlaD znXdR;Ji}&CAWi<%8$%VBSvU9qHH{8<$PgFt8UxSD#cIb4&?tKxWlFusK{~< z`}>xHi7W6KJ$>)yI@b?BH!NC2H=pf+=PjLe)(Y217}9luhuiE|xCDo*&SXlycl5jK z_^OToFY4Q~7Pf>-R@d}o%0S`Iq0%jiS9h(;9FKHyakwshnIo5jf|mPNdh9;uRC@Cs zYsNU#81p?hrG4i)aG3PP@@~gzJ6XOU{E|YD>`mFF+3cy=^D$g2)of>VT<(xuoH=-? zXOEdazIF?51edme3x`nu7_OAj;PP1VXMIIS%I{>pu@C8+TKz1D95sj@6gm1Oo~HF{ z<$RSV&7u4=+17Ah`7-@^nFPclFH<$x%vUJ9k{r_70CU2)mcm(H2ng_=$w)3qP96 zYld}B|5exUV#Qw(z*NW3(amvBa-ImPGt7GW`KP<|ShHFh4cqd5rhIQ0OapU#SG8~_ z*_>VqWPXN&7`c74f+vgPI|UsD5|Q|vk{cIGx^K#eWkpPF(x*S9VTb{1e3d>fZNVg5?WTBSe%* z>_+<1xj{kKwZz1Y*b?pPHu?8Q;JL*hr-+=+f3e*=nc$l^U7>_0a;**-{WtRVP0iF< zaq(b`x4j|f{BHLcw!y^(tMAqS)G1zA z^5z(-oU)s}*J{mad71Q!Nm70JrwDkNY~My=?#HF@D=pgAyGz=tByv)jkmK;S5E*=m zMb`giR;)zJ&XuQ!t}zWSDMxT_IffzzEJaaH&4#tW&u=HjKk%>>>l zDu;ScrxNq}Eyw=ry7L!0^>BLOb{bq(J*~|CYB$J{F*JR~!RKvt)ee^tY7q?<}_cVx+$vtFxsW5E)eQNbLGz?CGjEkJUURz0r*2VSvfl!)eg^dM?wY8B)i{VX|>w*>}B^-6lup@rccd z%e8(#OLv)+2Yxtg0!B9#=5Qk_oNIPj_H%j_HRA9~mfd3TBZaQ`OtYt|s42zif4Sat z2u1=o$(bNzCf@SL)`K0~s;Da@8-6Od(p`PgRtM?=zt6Iu~t4yvQ%DtVJ2xe;* zn3CNJh6Z<)D0BKsJ+g2gdaUcddtN0Wuc+*hsi4iEojQE?a+nVdrVBFnw=OAW?KHhS zGVd$8q6Z%BX)jJ=U?t&0Yw9up1x`KmMK6pVRBrX1`Jp7yd{Hv0Kf1>OrcFXvZ@oWT zJ`e|GL;3x#%KF|U-OE>D{i~@*-OW*Ys1)_<`Xqw@hHYxnd1L%g`c$+Pnj>RQmq3QJ z7-fO)y~Qpa(dQdWh3ZuQYvHrUk{4lQs-D2JVADHusX(eE2o|&fRE9TVup%x*|GI0b zKM6@tx2$UrDgpJ;t3=|Ap&j_7{BR=)Z6~h zdEkO<)Ev z`!%7?#)cyV?oNB2v*tIcfDFeXckN3YTa+zluXKHeq9!tI26Ad~klDsqhA473lADhG z>no>RWUrr!U*3LUd;9rp{7Qb#l4~{Qt`kP#>+{r+3fq0nD_+e3nu8PY)Gb-R7~I8q zG`~W|Yd`ljb&yx+_YQ^u^_hrr+BXnT3W|4o$n@4Ll9AqEiQBzCO76wi&rI*#Efz^m z9|we>MdoU2alScy3$?wFI#L;#GoF5Mdk+DW-YZecD|a0f zH(5R~CTn?1D1=f*Yz_Vh6ZrVp*tQ|BN5QFT;qYuOIF=4h<5~$%M{5@Cj_Fjr?|Q)$;1 zREzTP#fW5xq(>E{Y9}z9gUP4D+;DCffqnH^=Aj5iJyI+#QqrA+sLX29+uB5wA`Xzd z@B^j~-#b1qgQ-MR+}7PdOeDFLVG)zUfvp(Eoo+M#8ogr*Xk6cU!6%Lups> zK*6QHJHtoi%0?=ipwSz8>e>t39K6v`Y(j3Ri7Q|CTc_)Q zy!XOHmKCf{0np3lm04shs0wt+uDP46hcITZ*<7yLndqAIoed6LgNCB`TiMo-W~Y@YDPGR?MnrhK!$*PQv{h8#+7KDk9bGzH|AvCl95=`t^g1>}|}(rzkvPq>Cdv zUpfNz95j+Y%C4B8s|X;fm0SZf&KVra;sN8QOXQ^7uY)en7Puzqd@av5)m%RB`?SDR zy%e3Zg|hc*99q`S&SN^xPDDZj{tQ>U^I~_5O@mlXB|@|reWic(P&55l1sa&5%o^-0 z?M=UUu=T3kg|xqCFc#{y;3<(f1`luZr{=V}%yJ=14Pw7-5)UUAgTSM(Fa+tih9So<#Ss} zKB9CnjmdK-V$Zu!^Z`~e_sQ5b6qk8~-Zvon{OoiTM=V|bb^?}9G{;>T!#r`u$*C%O zunzK~j5Hj}*&0-78cR|)Xjw^$cDPi@UU4pNZsMJn6Mm|ACN`(e&z6{Q!rA7MTL5F# z)B5rFIdnb`dL)5<_o%|v1~z*J0Utb8-<4?Bj#VyAKJr5BPQs(JKOY3*BSU_hz6`!N z_17@QiENW|@~cGsyER1o9P$Dg)g^ZCvdOI4Xqb{qUn5RSQvY1_`+E76A46ZKz7Ee? zq4U%Iy!RZ_&Tv}hK6R{50Y7Z^(EZL}h)(fnxYb@kA(3H?f%N4vC1=T|Phna}TMy_SAdfg>N;gZID2|~@=3JfKj`BI(fxTE;{2*T%SKrj z7R-#j+Ob-ngn*CC5x@QS|M@X=0&D1^0Q1#0XqUwk0VN0~!VNqLW+ER%u`zz_rXxlw zd+>@mQwQrfiSnLiWMp?Bn1K;uV&mT@X*hfBM0xiIAc}&4bicsIq#nvAF7F>3{nztY zLwo}1f?vh1pLk19@t@KR;4#!LLGH zJBP)7@16g1s+-h6hFazIVJ6BooKgV&W z2Y$u-^Xj7&z5hA!ueMlZOnU^C6#si1p|0>N`O16CwEufe_QJemWUEtu)&1{rXg){S zs$cDuX8&`sq^gNE!1iR*_3=WQoDjxkcG<^|ANzJn>|b&_KKylv z{pF1E9c{){sMK~#u4IcpTshHs5HRsr_~dTonMWkAr7K-h59GTRcZQVCSgnvMvQ%k)~{}mBO6al~L0dIM%;EL8xG?_#1)F zUv?Sb0QB))yV+MxpY7N`fmEogt_Fo!4}VHuNe>udg>wwl>TGUsq1P&} zv8a54`cI82*2r;?rxuH}$3)=EH#yzT(dxz-7oBIa|6IA0EgXTH_pzfA0D}`Y1c-Q0 zHjC^6X(oVk0zACg(d>v8F=Tlf)J=h@)S2!*>rcT4DI}+Xzf=5?Gs04cuv)!Ge2tOu zE47~h!@rfHkH?A+Lo+>ROb=wJ8O;!&?xeALra?s`^x)3zLdK3wNJn!j2rx}gek9dBG?Y_ zjVEb!*$WqQa!J6I<-DICaG1;=P5feee6 zmr$q_Ou*+17qKc+#bi-$0AJv9exHy?Og!&EPuKxnr3&W4i2dbkf(_n9QtB`4emvPi zo>xzK;ETg{fOvxtqq8X@HYoLglbo+S6MXiZ2M;5Js`*X8Eg!)Jd%1_2&2?}=DAa%$ zD}d)SHfd;j1tjp77J(Df9G231b2G4X`O`ujGA%IR>9Dl2Zh9qL3KKU2t00hw#mxw~ zk~UXqZEBJvC1(YqI(vB96bM;m#KCFhwjXRDL$vLm4pVBLFq= zA{g$VDhTg(DHy)7z@Y>1*yv%TY-sm3NKcgwud;niB0>2^s{nqDPKYm~5!kyD1RR$7 zOU`}3W`3A+w1Dp-3@O3x47ow9u&0a+5-6Ik!N$#8EDNR%PhxzO7YTj zxH7o?wfz28mkVkzOyJ_>8(fSW#yCEhl}w*)g++xXU-c#q3FrC&hz7bSJNQAQ3H>5x z!_g;xsXb93CnhgM2fj0(PPX#{x>GpmJs1ak)(BiSd_Mvyv}=t6tV#Gh?_R8pz>Gur zn(Z^Ip7X8R`3v6&J=HHXwIifCk>W)vlMArsKNdG^8&%Hq80J3l#y(D#sy;)^;(Gu- zAVm?AY*nzl->u%D_Emy|JPvYUh)Y4tv%}j`KRh1uLdP^6-Uq%q=2eHw4{|2O3Iz;_ zy)v+vF{3#E>!jo@{ZA-8)VPk?_VEp7mzfJ$i6qD_(tU017hE)oD?|6w?Vyw{8V+;7#?%8xas(LU=%RIQ zfzM;8(s?BNb9E|8J=XF2ywI)^ksb8&!hOl|nJ=}s$%&a*-QP9E;mE}UUY$PXV<)#9 z>pB%Y*D(OfdB4S7X5YuGvKda(u;47OuVji%7Q8!AXK1{Vst&Nw7~!+c)qassa{x|B zcu13Wr#NQEkwi0+<$2HuB(y}XFxe1NU&-aDWsQnlYSjVJ|2g zLwncMSWWTHL@*97u#*L#hYkQ~fH*>gp^x7IhtNYW^9|Ma;Hq;;z&+&<*bL|+f7Y?ea5y_5O1sLG!0k~)pX!9`I&x4CSc_lMZ#wR|V z@)y9iBXW`^Ls~Eey+ekge2T|h3fo-zYS+!%yOUtkSLqIZMC$>f){@|Xsp&gb1I9Lk z^Umo`4DBFoMbos79QkIC8TG?i=bn0(ST4-9+A3-JILz%!$ zfCR~k#~i(!A~h|9?Mz_})0Rv&>A~xlY{B$_=qipmgJ3{NRj;-xKQ_oC-(j}6`8?~) zXa4EK>|SSMrMse_yUb4V|Al=8##EYS4U6qD&%Q2-o8polcw3^$MxoAn$tY)}zd-Wj zqO^r8@QMiKrD19G&Wpd0#mw_<%=XQTuF)U4eCG=FZi*d5R~ zgvOw?s$w*Oer5GV^#QA+YFs1iTL#N~1cL!7ML3OeK7fmb~&@_=qJ`9Aq|K<&2&c!&i1`6r1%dH3x>tR@S)#UGU2Ic0lf+OGUw z>rx8Bl1sD(rr75q*txI0jljz10`u}>gs$N*DOP6I0s36NP1+%9a0q9!u3npJxxF@5;b4&VwFz2@f|Uo z!iU6JI>Z2;Q!r$|<+O~j606UXcmXHfO{H-v7HL-L2O`Yl7OhPMz%9pEb+5Wl1=bK% z?zKh+M(6c@TOg`y7`;(UI4<^I(k)l4pDW2fRI%@_bUvjDw=4Lt$l8L{5_tQ|^-B8t z$}v6_5f2O4{R1$Q&iZN>v{u5r4*8QPovOjzgwcc7b9zo5Q!8TcjGbl=T#Fkg(dr*D zs~&J}U2VJczM&upkYf@5*N=65$1Cn?6U?_NN+@}2jRYVWQ4<;QcO#9cQpF6b&!uvX zQZO|^&sYDxQ-T_&Q&Hw-l`39ajgL1C#g{uuEOSbE(FRSO{I%W1mRIvX&@vIyvG;~n zQ$$u<{(djQrL2hOoES0C8M$SNBqEZ-eWJR(R3td5qQ-BmoF0nxH;pFcytwspv~wyx zM&Ch518*I4NzbRRXe9srlNm+}uFiDPs@YLkQEut{4>C z>}~3;6WzgYnN00I^^GN|DAPGJ!`IJOk0?o_Ly_qvi9A~;VRk0N^(W?UJ%#x?98xJZ zQFc8stX&!1!a1*=>ox%UHp@}R5WISp&5SQe{2sEZ8>_c!RaYMR^TMc*pXH>YdzRHr zt6NKy7#*-_=)P0JC(ItI@i}>>S|o6$X&)Xl<*a2!wISiev8PnV30)#fUqmUUpkW|Ch-_fxalHQ?ikw(_ic8wQzF&D!%;2v zKXXb(l>!;a{4%18&zs5?jUFyL>92Qu;C7FC!;edR;Zk}Z4W0`M^+UTE}-ab+B7cTF1K0Yp1lA6^vfjo{?cO)jc5U8OVDv=7%QTfsfzC9i(rs zKzgM0^K!56wa1FTKbQA!VO-^0(NLht4J37q5L!Q@oxo8*VyxtwlI(dfNzZtj5mOy! zon*7GnKXjU29fo&Ya+(sjW#)c=D;)177|3ghi$%Mg2x!@xzc!709yMkjDS8Hk5l^($f-zPF$D4akd z(W34%z1d{5e^A*JztO=;xT*m>k|sPo|wJ9rAL(I{n3Bp zEC{Y6i|pEW@;?q)%JmX93)=N)Dv+}l=1!;bxZIP`iyv?RNFcur?=l^cl7MueBIl^@ z`CJIlB@c+x32q7Tx}(v;u{)q;HjyC1toU003t~qeY(ko-FsDdjh!`bW8g1=S4tE!; z!AM&6;kb2pwx&i|8r7wk@Cvx8X$noiQP2eVomN}lzVC1Uns@cAI(%}CeOK~2XIqBj zkKH4v<%%5gr)K6B4rpRNUjZ1yBH+^=wG>bH?|3Ey>WJ|xnM?!p=a@FjF7?dbJb?yL ztdVA8V9^xf!m@r?fFTat#zCI3b=HkA1lo6e2XdTpOYCE9O;n4fM5>twgYVNsP$29Y z{TNZ(WkpgMnVyHcDL7w4GExxP;00BsWr9VhMFtuzpoE481GB;RBAYa|Hr;pq$dOvn}mK(WC7W z6Qu6>et1YYatdG*dz#OI#LP@D&@r)nA-E)`IzVS_uYfHVYacY1b-;MhK6?2$k2%X#iL_E6S)r>AdjC}|L*uNmq?&2DDeHFEH7tN*I2(eHKH2TYWQ zy3Wf0MF&Z?6i~X|_HcTu`s6hd6KK(??n>6D}L_6-OR@- z#RsolF-Nd)&LeWk0Z0s*kd3$-U3$2oB)=5_J-@`^!(iJAmp6$K6(Y^7kvcO8re5aQ zywEW#j0ZSHR2|p;R4kIZCTQya;duk9c>ebv> zxt_<=&e*&r6cShp07gT`tHY}n`M>vxD9tdbZ_cu4Nw{B;u2tD6_SUfuF--W0|@;cczW~^@9JNzZx`s3Nw(z1V z{q-;php<+ZGD%``nB&h?;)8|sbG7Db3?CDu{Z%(AZ_RG@0}itAH6czN&;2M_9C3!`wQgNcs|UHo9$IN+T_h2xYQduf z6pq3JL#(pfhd*`Kju7d&M%$>=yZ+)=C%Zl|RM(Afbqz(#)-=1xGS*sI>!wc?%q;=|@d58gX46TSdh;p@ROahAag^iP&lyn4!a3_L@5DzttPwB=RE1<4)*7E<$eqO>4b`qj zGYm2_O5%91Jm@{KP{RaAtdue?ab=}`=L@My+;DzGCKZ+>I#p7`EOQd91FEAH;Q5R1 z*8;IFk}%-=WIWR*XG}zYj-G9yfiC+mACAv&j?BUw zBc}bFr-ak@Pu-UJm#^cH-8uU&r}>o!87sNA^FL|BGVJ6R&3qE-qZp@oV;qB=?_S z;1EJesEsq29@hbTcm5R4_Ox}P{byWc6N&@nTOBBP)1)FKmp`6Z7QQB7$t#!KjAJ3| zBTQ^g5`Oy9lU2DQtHq4w*y)P^4GFaYNb-w?_Ss-77Eul`bg#_dclEauv2M<7<_o{z{OL3AogZ)h%n2ARc z(5?hz#u{9l@oaW@zKy01`&hb$kPzv=>5StFj zd^`KGy+#5~VimsOGqW@IrJ`mgO>qWXbEnWp6hKWC0A_nnglXq#%Nd#<^PL}0tiVzm zB=@tkk!`5OuzaIAke?kz%bAh;ah(eMW}pWr$7uR6!}JH*42XRGw-jd`&64ve-h!r&BxIDG*OX{O|6)stzd5JM(Im>qPLr)A^+ zn4_u$2lVze@#B+f2!muPEnMPU(=5u3ysvb?8`|@ggN3RuP~nw1Gj#bfXfrGX4RMOk z1pD-E8aTPnK@u3Ac-wVH5bs(9KpuIuFJO6>S7}}*_O(gCm|QMrBs1cBu6jXss;R|G z+4G)|=D-d-mGv;nM=rwHx>dq>CE_s&bJjIMVsETiU85&AuiUMRY)04Ya6XO&gwqbV zyQX@>0N)qLBxc#n^2zeUAXG{@z@h>OWD`(Q;vjBBAtttY<3)So2wd0+81K;6+HsHP zl!Y)t*t_)!C=RVe$|wQ*kjo$M4_(9`7E+?+tvin-Ck4}hiGAZvD56dbwm$!43|`0P z2F`2~o^4Bi%IK2r(Ot8L>M(GH{+tRwbrArvXWx&QPwYD%Bv7x{1DhukfuY7&-fFS? zX3@O|G*O) zJo6x^4DIV}@#_sgBY$@AvRR;hX< zd`$G=#WeuNcO#(9hF`?AIG(VKSn+e2kBhz8+$N-XXmqmA*Y+THaCCz-4Aufwe0}=W9E+J(Tf+``TXWXn;>xB!^jGmr} zJOUehf;N$ z`(*DrAYKjEeh_2tBuspxH4|@%@~#eAHq006FFZ-EeI>-gIaA5zfT26|YXle(S1D%dO(<3*s9vvJ+=ue19eM;ny6 zXIgjLR-g(V|M)QaU$3wr?&D7NPfE)XEqk{?2>ei>Gy}%T`vzC4h8eIj3WD4DJRPa( zPALuq%z1ffto8+R9jU~X6&jAaPNw0PT5hgDY>Bf{J1t2SbN)^X|Fj61xF%mM_PBqL=p={p z+YBvH_YE6_^Bf24yw`md8MU>(ZNr1=3?YIS zNjY~}^Zb5?u(IxcPFP6G514;Wn!c8Dne*p#t3grstJ^I{FjGjcSE!zJW-4+AsB79z zRi(2nr=+RcqRmkDW{7x$oiQz^0%NT~^x#@?AfhT-cmT42cR!`;?w%t=4^`s7dGphP zeWX!t0eVygP9cP1_(MgLu6WmrFlt|>Sw@`PHbACSnZvhts{H2%&|oMuxkt}T4Th6q zn7kG9KaEX4vUP)ziMwHXe;6P*j1`XD0!zREilZU2@8amqM(YN&+`j$svdHAjEE!p2 zXN|x&J9^^3x1Xq3M$l4Yk-F$qbLuk&Tx+kp9r)up?$O2KoLLVNtP$Xi^j{!)8sV8Z zv!c;m0-e6{A{H8+E+kAnM5k!&&YQ=_EI(EJe_@bL_UI0Eviv{x-aDMj{*50Fp9+z^ z$=)NRNXXthTXvzcvqwfY*(+Ho%FN!BQC4;$D>J05j3WA-SNACQeLuhdp5u6)0DL4I;gS=3}I8-Y_V| z4P%GW+4?6TV-okw1W#=+)EDx%lEzN{HvayQ)O{^C&8h3tcPA=$9lDBy9sOe4#+{kQ zG6+#Zpj{KYt3tMt2-9Zgxr;CMfn$5E;aN}`>$26b{oxL;h$5xgvT$gW_di4{l~~U9 zVO3$PiJg}U-f4x)b5{6>HZ*i!8W{tftfxz-z(dBsIY9b)_QoKCG1rcNgwIJl_nL_dT)B2dLxiGPN39^tMEHxn)7vcXZ)RhLq;Z) z?vHEWmZu`qe9WG##WBv&xR!%^S?IlT%Er=-$C$Cj(I@4mkQKD(`^pwYDCr+Z66clM z!}EN|OGzwx5I9~L6L(LrXG+)E;nl4ZAHCPZFa?U_P@HcNhOj;Ot z$Hi)T%EwGn$LTKBs!|1Elgo(4l4T2C=wymV>5P0aBQ300)cvTm|Kuv$ZboG1JoHOX zy5qXn8xp&fj4#2aa{iGt3r_xmk^JJ7JtxS+6fS#xzxPCZO7mjR_onX`uAl!B+^%|f z@S4`*K}@7gr(6j4i{Sdk9RlfwQ%U)F=ZNj0s>rKj(+PH(&~sW zmH~@SNlJ+W7d<-MQ!fvHKpVYta85b9K)>;o{%6YJD0*vV`fT+(=YvBFOJ7lL5KGc* z&f;TfDy=;;c;B!qa#orru(V-BrS?llfkrBAfOOtG=CWca9iJ`X6hcmQnyf#9bP!te zp>tEDHlvclh>eLl*TYR+ss!IAKJaMz0s7fO!Q}A8IQf|GxE_oTnZkrQ^(!qBdlmM- zOcC5LVQj*xoxa_I#oE?@QWoEscSjoIfRl%MIcBq-7w6&QeME9HX!*UEcq)!^rZG;C zWp}vHc&^a(-p%$4z&#U>>$vu9Jra_$rl-V~ZY}&v(IUhMQ}h!h9&^_lopMEHG0x9@ zyFt4|vMpWEYjy#z_IF(c8de3Hf9`hZQaEdTA)*4h3VtA^>_mIu;wy%jBp9U|YzP%R z>+Dh)>#U8@adqTgOs&*8Eq{=7=Uj8P$Rfmq6nK2iIi46fBwvQn2R(8M`sVZKE}C(_ zH3>WPe4z9w$!o>#!Qik`1kteO178pUdwhWIYlGzm17E~+kBO{bVu@K8FfZq zIXB#B<_0i|knk8qTu98xfCpeg=Rb#!waq6`KZ8O+#>Ub2Kp zpI?b;m#V#E3FaR*fe+d~{Zlns3Od z$NRT}*C0KpvL-hQDoQw`c3nL}_(mD+x5tU0_zk+=UwWAzO<1Y1e067JK1!;aVge~?`(28 z-C1deJ9i{?$4t1N=e5NUoetm=kdoxi6#5j{(kGIu_>nVoj480hgzX* z>0Fu&1Qv*)NP00h{(43t~C4s{O4+Anef<>3D>-ajKo})7_W|r;GHP#anIt znPC1aGxxDK+8^U2>3KCQ@d($d8N9Bb4~>*h$0RggI?2}HT$GO^$Uf)1)W22U_k2T7 ze(L1a!b`J63Y_uuk};#_-yuX4Xj+(h$93PUi~R{sUMl7pNf0Z0X(;sDx#R6f2>nT@m274w zzClVR2qG$Djv~r@{(a%>!=!L3$b*%?4nMn-Xp~Ius`FMZiu(R%i@V{+LNW3bB?g)~ zF8`#hf(pozJLQ-?)Pf#5AO8+|Z#G5g8j!n5)8`0mFw-<|02|;G(^)RERL#_5>%eK` zNmXX(NHD%kWg1}*|10*6rev=P!g$gk42PHo#(9QLF9LO*L~5LS72j_&*h`A_Va!d7 z@>qdbBAS7$eSNPpIsCI-T$j@U<6%w%bHZ|4c_7o{g}?@<#l>BMkIqo72+jp|^HeJssDPnB@_TB1mhDt>0>?kF3jbRsQeV!BA} zri}Eb#@?HN$pGO^mtP3QMU;Tltzg!IPNa+?(mBxAm;!sxxwgtQ^`DL6uvpW0S0eUj z&af?Gjvxejb;}AG+>LPQhn@0GH2?~=h2tZAxRvEQr7xM}$Ge?yd^+&zb`KSn%C~wt z1t!U3eFbSbj}w>mx?KFN<@mcj$uZ63V28J2n5ClDUlZ^f8|AhU`q=q%_ z);~B)UdV#UCVh>GuAGa{!ofUY5ujSz*T6S(ExYaUg9iLSc?4UZ0q*8&LC*S~wuIXR zXEtRqUqaGIt=KL3Vf;;5&&RVlq+b?jyB8uxfgO`gcG8%(Q%|D_I%J|7<3`3}(JTDO zr;vOJX^PPsR3FyFR|3sC;pakI4J#~OUZ&NIkJ{cAL?`Lv zuy;Sj=dtL+!^)pi1t)%mJm=1IgN4zQ z_5~kB9R~dA?LX)iZ!9XwpZNo$m_3*W(Gm>cHjF)vdeWo#8EOke>s6*Lz0yE>iuwu- zPPOXlbKh$@i!19Pbjl|u<|G`D#)nc(V;G!!O!X5GbfISuMKZ3jx4c|;H65lUJ5V&o zeaMbU3(j9w8hR%dZ#OoKHaEHQPx(Uu=4?`l$nxWOhW76Vr3`93$I0jP2Tf$7FsCf0 zzERoLJhUdqL`xVdycTMOd3-)eUMIRF@{R7^2m83)C7=g{kz98t%eywDeg1*-A&N*D zU%uqs@O$T*Yt={dhE%9CxAG`c3J<#0-?<&pHbQh)wWArNfFtbBq}5hwo?$y-(OoO) zQVx|{{^+8%_j&bVq0klC4JZ{y5lKo4VV0AF$IH!+*v)sfKSH_gJl!6h5m?Lr104WF)P2nw@>yz_)5j~Iklub3=jyR&j6kfG z^G8E!ar6U;tekl5os+!J*!^`FkQCSw3Rf(BK@8HIq7v=D8`}BrFlNa~?~7hpvnFP7 zfRgpAE)p&EhYTH3c%lgdbW8z?Y)tRp9QiVUw<4AALxwdM=KhnYj^h$bGI_BMU!ad4 zCXxs))BFBI`DD$8CUuT7d^|z{oYH__E-VxJ%3?SC=uL1O-BViY*qj|!1%tou!HUTY z(zhGL8)hlcsMVbOgfTu+CFPuovN)=_8jAtAkxERs-x0UH~vO zTX_IBacT3b{|(bw>j1Ravv-X;`N*n6^0O>lfJrK5q_&g({lp$cc%pu0)*Oc*BPOexd*;JkipJKT7G}ZygNq$=Lcs zPo;l9(Gqd@D^z>s_-_dG|2~ey45{0lLOe&VDFpl!ry>Njvo+)+_rIT*nke3lMLb5zjVY zemz=8SeRyr#gAEjUM_ZdukbB$z#&qAk)3+rO8uTqdKy7M&NgmoBHblhkUG43GQl9& zc~tO1Q8@&;zL0>~49fO+u$rdWq+b~(9sy**Fy&FsgR{ypaI~EBhMTs12DCik3@D-+ z0~ga)w+N~Q?uD0%h(IT7j?(n!)_{KC~l2pZets{mPprBw#TMF`4-R3)D zXW$~aXJG*EGxxY5@5E?CGhLD>P;NFT-fUW(hZhS0>NcNP0cbQE$aL*8uZ({?u+Drk zpZ+`Son>`Yh8FAPWQb52N8y*I+HFq8d*yAXA$40DC`8S`Cj02z1=eHn}b4oG)-$b=72jCBU?em zLxN~U+&xfO(gJ~xECml`Jw`w@RPOG(ea61NiFW(LHQ(P?o3#wO3Q217M{r>@q2>XI z$A&={o1}UN5v08u)9oU1gmPC9ViXlg&c_gJm#{N1`5wR`{jWd`7fyermvU`3ELIGO z?^2+&e5vwtH;n^AshUHj@D;((I^qB>=#7JmI2-P7ZtfV-K_TjLAlyl;o)X8d0r-Ry z!Br-YI4W{%-bWxy=n!xQajX3L3G<>Sc-~oH4iYMH5$r#8cfth;!?Ztnne-Kw9Ynl_ zYZc^<2k?NKjTd6zi1ghY@}ROQk$72QRJYQ0tkjQ)QD(I@b&f5gyP8k&r?i;S6GYu&((w8I{ z918i~JxX(@^Iyfcrlb!@*^A(*dusiukmFpQF(@%D0-k5z4Wf-#=2y@|WNjh+fe;{E zKtL+}a;V9iO#|ONGe~`UcD5}o5bKjmt2GvHkFRbcI!$*FGtGr`vf1rGwcq!r(ijeT z$|PgY8&`ILn!$!7jz3WyvM*3;YGTkmMUT!^Y+|CJi}Ndx!{9lz+(Qq zqwbNsaaBTn&K`~ao^+x6n7{)9Nhe4_0-%@ma=W6JdT7Nj4%o@YWDnY&z!-)#Wp^F41gu&=@iu@1+^ONVH%c@TY#5YV`; zgP{<&7te0c`UbddyqcTO7y9`0QCU@CZgMwS^Zfl=u@QcFi8S(Q@-I(xW%5(-SXHQ8 z6hUz9B{cP7n*DWaAvhoB%v!Ft$34<1gELwbVa@X;pE5qf80{3A2rhsY*W(!G`pyPotnqD(O zWG$=pYiHaTx$wi)JMoD%$3eJF#xT!}l`ef*Ij z{8{`YeEJmUFI*2g5jQ}#l-T&kY52|Wmk>h}wzgqmyEyM8B8IQ~VsLr2tU(Hn5G!0i z+JS^Oe9geP;p3YQnxn_w5I!QRc(a{GjkA!if@s&m8KfE7QM4mIEK|zG1hktMY(`5E zXx_?$HAVW|z}XQuu%NIl|JeO_4;)P*!?+a8_3cQ=ql4hE6*MLtxwEP0z!R?~!u}MS zAGp= zfb*mV(Q0byHuz{NOck2h-Q{n<)B?e(!IQRh-*4R}=K3awy&ErPCeJ`pWM81O|Y*`*Qv@jLhR4sa|BCBnoT1@*V4 zj`;K)e0_X@n#(#qKQ^MFajvV|-3g4EZrw7_;+>_2;`2bnJYafjWc1mCqp7x+&s-Fd zDijcSYHXo$FsmYkd3wRd>t=)CJW<|DPfqU%$gel}r9w_~6Vh*vOhF|PT@saXx#5=k zq85LCFd~%nFDcTLvXS;?WasjIKhLLtZhFJ;AE``_MAqWD2g3J$0P4;CG4E<#%RIWt zo09pH0T?{v9-N;GwhX>i`IM$hvMya(Ad(+>sM&#}+`hBl)H^MC5)PSwaq4S?#h$O!hoI z`bJ?IX6&jJ=+zY-@FnDpxs(Un{T?Gi<|m8DFC{1#_+DTX{5HDPE-Mf2Q@we=9(!<#(H=Y|0tvM-sOd|!(9E}gc>%=!2Sc zR?h9WbXd%?s+b~Y^7S_{B}PrNhsWnb6EI)a2XvhP=U`do;EwtDLw3gSh1=R%RO3%Q zBTKNzV>!`Xhjl)Ab%n0uMWPBCRmv1Ej(al<-L#l(r1Q9@c2DFilPI$qs>S?<7~!6b zo{|pFS!Ll@ZpPLfYii>jW>Jg(G>TC{LSM#mA-OABwHGePPC-i>f-}!v$K;l ztl~KZj}BlBgO!Agg|Z}S0h1QehHQ)BJM)cP`IVe*pOCKG-~@avjVbAjRd)Bha3Y3_ zq^{!AuYwGyM5=XaiS>^WZYzi-0omtMv5&smecZnV?Rqf5d(@KdA{UmXLas32pr07D ztiHh^OX<4?F4v{0vaThsWe+F#LnfJzY`6+?|2t$1>%=usjyY$etcmEuRQ0zyL)AJj z=UbI@DO!5>=6Fii<{w9#sV?N@enHZYq@ve6Z~X2N-;t2%pVus z4$k_1Bfmmo3ag76v1u>^EkZPB?+ua2FTj%eSSg1xM*nQ59J4{!d^gJ=>TZTpmPz4R z>8OmTyreJSo79BFOsIS_^>3(X<~Eszr0GQI8sv7wwlLbhzw5q~U(}9}1^-^l{vTM8 zMPr7A*dmvwp_mdHz$*bX?uF{o(VKUaZNAb;mndG%o2QMR2EiBNTcqLZb1;XLkgf~X zo+c_E?9|$fF+K0|Fo^VH<%&<`zS(9qB7$%6WFKT{Lpv@>?PV2*|(CX5s1c}LKvh? z2CI+I7z6~7b@HNo>}Elbcb+7RIbzwRLD+4;%kR+yEE0Kw&1( z$Oj6a9QL`cb=jrzlnS5#tj zXO9|%2;d^YduXNFLyRz-GXzKhvL}rCIZTWL1m-VA2=nlo9BvhAV0X4*l>2;VH9G*E9GVH=by+AQy~P)GTYHG z2XWQ#DLvyYMAYszq@9_e)N~ICY>n@3=4;U}-_y9kybvrt&zAh-vEYH=#|fq`#OUH) z-Q$se5Dx>zuV50CFgTkdBCFAqHr~9;NSsh0Jar;R*5(kNNn_EgRG>CJ*aR`Z7VaF| z=VxQ~Eu?Hp9U)HHO!uX&#ii+Y(M#8W*Qor-ypuT@hY7-~{e?YdWpiN3MKIHCj3KVl z<|(rISN$(tA{s|rT|TP*iY_ z_GFy9x^BH>mvX{`cwK(xYUE-GESd|=liN0!AfLwB$#xiZat13z z>%*;%)`^Pb;X-{WRx^$`nzIx&KpGqFY30-x(twXJNfED4oeQxwUz}c{eA_|^-l0mb zK3H9?2M!*3=FMQTHpnW@Ao+;Rrb(XYuD_myVGAo_|Mt}kJt|a^u+6(Tc+qYFkne;<&~Qvb*MFh+}-qlXNGi8YCm#Ebc!Id`_1`7^7^DW3A@bW6IyX}1{ zsA@=##PeT73SaK$rw8tmYe&doco5;!4c05Kh5^!0+`aqc+3J%s2N{qt&p_!X(zn|C z3%ga|EgLwNHyT+p!~a1y{^^p#)~Vor?E1y~#H@XOTjao5=A>uVQr=g3?s&tBaC}7J zaEZ3sn@}xx4QQ;4NZY;~sr;{0YiJzU)7$jA{{zMR6?$j$c+eF@_WqV(;@XEd~GoAC=xTSZ&3Hx^)_Ma(jMV>(*b&N{%lrW6x| zB`J4qk|+Km%Lk+!5UVR*$;VH?(q`6ke&mxDPx+Wfk8@<$J17;>2BEW*dglizIlFxd zy%^{<-RK7w)rp)OnOmQU2m-2@j{gB zn+K1QZ)%0|FE}`ge|T8rBx3P?WA3=EUQ}pxC{oSbKZ3%frN78_MuhzngRhDR6I)+c z`>_m`&!!W2yDAIh4fb{XZLd@=ykojBClV-lwD4qYj}+N7PM_!7DJmyExrZ@-maCn5t*Yk z*s)CUA#e_sd(p-n#5uoP&+Tu?`l4P*HMXhOa4?e^^B%(h$2XCi>=ugG2^2@np+01N zC1iYyRrlHNqy>Lh#(sf?OXIkOyNsX%Jmx_!uM|K>jfFmWn;DCyq~S>paX9{W2q zGYEnw7KpI7AIu(9eZQg^)H?(9GfviKqyeb<05TSzC!&_*k3#* z1$wf#Lha~`B`^wk!DGwi=G^IDTi1V;sN?Wi{v*@L%aiB+++;;k$DV~CtTSj*$_bIz zou?ktp@f)(fXnETTctVP6zdEA`+JC^rvtL-Y&m=8=R>Wf(2*W#HQ>UC7!9XPPJ(QQ z1aPW4UMOb;f!W;Ia2#;7%iaK2sSpH8_zqc;zL(^MpZ14fglM@x@oNPVE+L+ts~csN zKX-BkIU4mL!kIg*l2vdWb43&MHo;od4giRLQ(n^4$BE1$`DD^v|;*i$M z3XMg{@!)d+G@6@X_;E^thm<;?UdoTIdGf%#Ip8=hDW?DQX|jO&`uY#Eu8zrc2g8P) z%g=J3)XTZLx>@eHWmr`g)zy70TFofFvY3|tz>k=~<&mZ&0r@BjaWdIT;M$BH*Wpt-mFp1O3E}3FqiBgwkKJx0uzmDz!`Nv zSy(_9A!jH(8;nL@Mhel!iMhjVbsxbU0b#jtjmJgyoY6 z8-F6YbJ~jQd(F5{YN$)Tag$N2Zy8hlDRg1`)QwGKOKwqW}IJEC#7y_bOAb)+5pNn+< z8y55Sh3!4$`~x;sO7ZRo#X_csIN;ZHpO~N#tAS|^%$M67-;-d8Az+M;XG(7;$Qa0F zH>qeeRL%`3(&1k|`KiNhB!XS++1oFH`l4&(#J)(|*T&?fN@tXG_!lYi5VOCR)ve#Hsb6_*}-EFv8+8*8Kc;LwRU8+CksH zQ%vDK-3T*uQKs*`3s`W>({{X5l5>J@ip6LGh)3jbNK{_?-^43>T+_y6&8_vvigHbG=_Gy z3)B){c`;B2-jX46c~F~o<{uBh@Y_Wss0K6FHl zf^_)1D-+|gMA<#_Ja5G(1F4jS-ynZbo7B5Zjc$1(K51oUG$FM`mcV+($EYyQGA?(0ouutxWPt66(d%3M&X#~YN-Xs55K=Y5Ce21 z)wXqF!-w0uO%ZEgFU}zCHE`mtPdirZzGL{}HR*Q4T&eN{V1wS(^!FM^*GziIVEh`|(BR*(Qs+5W zE_;7pPTyFVQlOvZ;X-{=}(>7`8=PjR_04cmz4WzE~PPWLhN#e1wp+ zul&C^C z&BKAATl(y?a#sG!>uika8s0TXJN5}WM|(P zHG_2z70(x_sfAF`hF*^&S=B!k*u}RRk$uda+Nw^nyau^1F;49~aL7!(gxT=)Io9qF zu%Aha<(@<=hU_zNIwxVqC_eUm>!?OKKS{Er%qPlVtM@DtievQb*I!8nx?UsR6MX(n zrRKt}>P}PCm)zGAi!6v_@xiq?1)K8K>)#6Q7f>Z!3xJLWT^3-znRSZ*!EZJ zU^e>c%h`KI-mI9H!`Bz@s!uZ69>VFl5d;VcQ^a;=VCQq$d(uhw5{JxXsw@5UmbKHoy!oO?rQFr+g= z-6fUR4IfY_K&|cznKSu@KcUHFsZo}LiCJR z=@8H-Cb6%^vvQt8BC}OvKNcWS`sQ*}7r_1Iq)I zy7Zp4x|L$3=y!^uH)gGZZngKt>ryit^Tis9aX#TjYU^!%S(>p`OO0j=7R#5uEnl2? zZrn*k%VYE$ieQ7c+2x9Muj*SiB-fD5?st5A6}Pwm=sND&Ga=g5N}+UJmX{#~ZyRU% zHWWj)sK+jH_9QX)vfi;LZhSDewNa-#$}EC0<-###RHJ$+X6g`*4r<}werp5S*gTq+1%xNC^bxD63!kfFuB z^Jza~c(^jxCN4h1EV;7pjCDEJnhTq>V`&d!n~zZeYT#HJ+Lgd)MCR2vvf&F5Is-8quFI=tSziPT+qO z^}5hJ;JgGQBimYTw|vo#Hr=);rgfe4?7c$yYd4X1pgvZ&u39MGaejX= zgXfERh1ux_y1yA|^f%{>Ym@v-{iHrIi|Hn7Vq)_uU)S4*(aw1WPz=^yxQMDOB$P9ax2FuE;)F?kwClKayzKIXHy?UH85of&X|f;p6_>v)3~B=FZf?*yq!zCQoTH6g?Uqk@HgX_P!@@ujp%(h0GWdd7sYdo^tKUikwmt z-8kG^KCkZ|zxG`xA-dvDS7RIJLyp0{=!3TXRo%zi>C52)+jatTsS;Buwp8{>9=UUk z%c%q=CA48uh>ktERwlBcW4v6SSQ znY1flvd_A@IIT3xO)u3zQhxZ`<4CBNA+XjDDn7nb$2_GcDvXzagVP`#sgDI;&*6PFKK- z=2G9pvCnl?CQ82!5`2GeblZZ^61+=dtB&WyLu+Fe?aw^8`rtmVWmO|HVwZ0AR(~Y6 z=8>kmCe6t*+V8H|cBfLt+sj^(8n!)H7N(JY;Bzu zr|fiCWo~#`Ja?mF$N3=l&ivu+Pm?aQM$4WTY)wXv-y+Lh6)+p?^u(BZcTv=cF!S-J zrjBmf%dQDHsFZ8p5I*WCkVC9UI`d4p+3Wj++&W_Dm$%ZcCc6_LemF%o9c z>WK#C!*1w(k)Cu6Cql@9>9hRn1ctE0Q>6?6TY55I^=Vu3 zrnaAQTsX1(St!hu_;O|umlB&a-r>9QP{OeN2fM2Gv*vqGkiAO9eJNR#rx(U)M(VC9 zouKiS@7H?x`UAD;yRFYC^bUM}s6((@=gg3?-Vd*U-PclE937t~PO zQ!#}Bj7`D!4a=kVl3jLYD;&@GR2u67NA z`3TW{UeSzXf0;XdOCz;xXC}?&4&4x7-Fs-w8$eK&wn_01hfoxRv*hi zc}HF<)*lIO;<){G_9KL&x4#cFBJ@<5GTaNJbTuOSFN_kJ9AkP5>t(BY;gw~YQ%A-5 z$~z$T(nQ8Ri+ zq2I?IR@ZX&OChlbh-uE$nKT8%V($iK3WtLhhKjpKMH#8C z&}VRCEHJ)BJD?ZiwH`|D;dl^Q)M~@a!sau#&+OX$Vvo_Queyv&C)hGs@5+4=)LZjP zF7MDw@vQH>gdUv8xz~8g{S1}I^Xp#*tA2~Qn9ym=2%1lxxpE!pQ}EFCD;*0P^N_|^ z`&rry=PFOby<1F8&x;Kso~R7T*V(kQtWCHU$rNoH=;BjRkZ0@Cp(q^x4v*+Lj(7>l2k@Lcv~pAOO0%RBw*@{PNXMzR4Zo?}{I6Pwzl zt9MhF5XzYWv9PETSE+QJQHAEKvT7luTip#ucQFUPj)?2)P~*&5{%F+6L0PtVeI)@m z^uEgbsByM4DGSHx@fp)XcI}J3GnEWVktxBGtM*69o^|4MhD;g>Y9#`MxbDNh< zTU}kNh<5~A_%m$%ZW}ho9rJW_XfE>$hd!9-$tpQ#A|e|oY`8E2DiGy=)iNf}*od9f z^2^&gA6@P?FSJ}$ces+J$|k9@G+GSWxvF=IN|tu?^3SkrHM?<}2S0E-o_hz2Ye)() z%&Zxi)0c8cEH{n0A^99$vCTuUT($n4GTlU)6z&Q%@1*MW`xSx>ElyEraDUlAx1PqyP z8PFWlLqB2lkyvT%owSru?$>&zWl(q=z4@H0Ttbukt8GzBe`mDZk1#bNPQ8*hA3qUYe~Pa(8Tp>%TQ3a{_V z0`X^uwx*z9m#1_>!s61v*pvHpE7ZTv8fy~&C=F?KGqF9D*%xkQ!Mq%zCj2c_C$B!j z_?cNcn=VhULS1teTx^!V9Utd9sXT}!)=qnlk@r>$+DU4B^SJ)|y{aBalbsOu!_9pE z8}3}r`1Wherru285LTTla)ln$2*_N9my<>Nyn5m|_t3&r7V4%vD;$%^qw!b?Di{q2Yo$YH1 zuOEOXXW<7E5hHFs@sx#D#ANq28`c-uA2;l|I@ODbYq1^QzuF*F71@yP7FIU8N*eKG z_`1T`iMu2p%}J?it{{|NC$0ws8NRFb56m!>G6DRozF!Da_IIp|V~tKj#2BE{!e9>8 zQZC@wa(&D?rS%nd_?DkeDoY8J`*obD@kG|e-M}oj4#+N(1TR*Bwy9R6kut_Zbt-H5 zRCRM0BnW0kIi_{0!qzAaZbEm2Xm^7(Q*~OAvxvCRO&x#QM72HmG<|tX|NUz^DLU9A zmmokH;?nRmEmpOPQ$3seoy{bL#?Pud;CU`+ubdqHp&A0!KqH%6trY0bD#qMkwR+%KX1a$bbXOkKQfSJ>sIWmRncDd|fk z%6aX=K|;)y$7QX)LS?`KDBM0BVf!|)nDHbO*%|q0mxP9R^h(s-+HzTNsqXutiUi!~ zx%`#Y8xm@9w`KJ|jrH(gb#>kjXC@*&!{%6WbA|%x`La@G-HeU?@)|W2su%&$*`qDH z3%~rf)5fu!6Bq&rjD^pG1)A{~j}mvKR*%QjP@6$s#Iba8y!bCK8qdl2^iKyUw@^4EGM4ty0Gtps6s=cEIwrr z?tg3FFF*d0!yHJ8Pe)a(8jY?&t>;uJm%FP5DT8zBT-0sG>yX#DO!Cx!isRrGO3o?- z=tH5$#=s~km8_5vE&RgNm1wcOr(V!sxrG7|!_?T{-$0FEo7ds%qQ5-e6^PSyB;(zI%7;!}L{;I4CyQuavTlu97=c8I!pAsU zdmgorG`A&?S}Ss+O-oR<2i%H#X&Ab@SOgJ-$2Y-pyi;eUboDUw{nP@I5QM0C55p}T z3fHgssEBxk1ScG%O0t@yLF*lsU6S$P~WzAgOeXHLzWZfxnUy0C+5XuG^vPbfM3AuEP zW$!arq(f`K1^O6fM}n>drPrtLQpMGt&#It*D}L$Jbs4PSdORBIvB3M>T_4{WZr^xP zrbknIa{4Yq_NPU><0tH>*+}NTUQCKk`gP;eq2D8lVaRs06qZ6soB9z5LAxSObO&>d z5@_#sniqRg-^jcIAEV{aq5H+=sTG1l^%siY#?oz{8HD-$IsaRW6oK8Blb<*|_Ml@)}-9J5x$EW6I3 z$xd&8si*(s;^4E+XVK6-2uJzUFabSc^(eQS&lwT>b+G`Tf~0azJspeL zjmY@K5F)mXlR&8DV3t;t=KOuk82Uxf^rZ#*RILD0a;8ADR2Bk-UTZ>>^2JW#0=OqK z4Z+lHLY^__SvOBXWj^DtIz2qbM~UvBZ0E~URv)h$Mk>E@t6yi0X%<1utyki=9EWxP zdVpB){FpR={ah)fkh6A$;1FZ9Q&Vcdhq zVidj9HaR*fKOej#hyG}5u5w7p7tUD(9b83#Be)fm>P-F`ntpDSEYPY2VJPY$*MEHv z;HybZ?qOJ2e^n7ES^C$8+_D47#k^~X@o@#yRsZanlIcTQc)V^|Y0KjlkbS zF^0_I=TQ!h`2UzFXLgvVx(YLG?!QLjx2d+4L)Vn9uqb${{2#xyKL?il(qOQ5<=?;Q z*AH3XC{8dCRg}&D`xg5%co0t}gp)vtN@tkxw_oO`bW8x-|dpjo-c zZu3dn8i*rvPzr|+p={9G2wsuM3GfZ;%MBo*bT818T{+$cT!asAAvLN7 ztyDc^9#2X<;4HRsgRXP6NbMSdym=JjVi5aO7ht<2j{_HQ0&uukuREOGh^<5&Sb+{t z0@s5iJO*HiF5B9LBs;M6?cu)rCl7#_XcR#c5WEB7gv?4`l*@&Lw!N0{w=L)Y0rPv8 z>ZQ?$qTPi-E*xlcUzT)r2lV5(NqC5=c&R26SOcq2u64S563-R!7gd)v)m{fudo75V zUlf6{h~0c_0j?B$Mzk7C1Z#m|)9C}85IgX=a{(t`N8s?+A$>6>fH6WqOzj<`3dfoD zb$jiL;1euW4Ul9#sKlLB zs{18R)oSbLGmGYu{IP(>Q0i=1dQaQ=vq=;~$Cx#-f6d9#9rWScV@8@*v*I?8wb=pa zSg03zGt6u4^i_A-cai@^MJG~t=6MF z-t<1{T=sz9t)TlKe})4%;^-b-nC$c?rtf8OK#26mMX)98Uwn^1!X|{j^hMMKqTrkZ z1PJC;th#l)UmER&%M=(#?1IIrAt_0>Ww(T>BDyw1+f&5&kYn?nVBzW4pXmPxeXTS6 z*cqdsUKN8?Zc(E4+bb~i3!@tqgj(;k4ha9C%P9 zW05Oh`{*QMeo~LLNlx1VL|VYJZt(A+`aA6o6$d^u1H%wkTNLlg-IKK5ytgZ$FXVYR zwH8attzGYRoueG51pi*4hdLK2yS4Lv#SnjmM$%b7Fy#qiTkpIi(Z%rsteVH_obEi+ zZJ>F%jy3|Li&*u`eK+IA{R?2$9kT`Ji3?(O(fEWt{XYVT3T_A>oKh{}*t?C88W{EF zPha{pjg;rYwLo>7ju3+;!7G3?cWnY{Se#MSH!VOvbQ?*1JEA&10~IN!m4+z^7Uh8G z`U{Lza5oEeyJht2!1z0?7>n}@(EcEBYLx;K&=jfW_08_H^`L(Jx%usK?^`+{E87cb zS~Nr6gzaWvU1|sAm%h%N^YuH>&czL+y*2H$z7sTHjl2rj4c^Gy7|^g{srbwTE%Mbq z)V+rT+VHlQ1QjjXAVriqO*I^TZhxBa~`wFn@n!wz%(`wxEqVT%-2iDyLNCdt2_i$?I20YW|! z!q0z(fJgty5;p{)Tcr96oWD+{Uwcwr1}24rX^j5A{<7Z?2~oMry8bJ|?c?e!bye%MboU8_5^=HamWBx2Rn{(9#zAYsCER82-o_R9vnY z{q_>Z=m*82;ss@r1)9HuSEf(i6u7~)G>8H z8~9p$Akxy5-`b^lxbnwwwuOyGjISrD3~F{w$t`TN>l}a0T|YZ&Op;)Ly+lj(KSw8n zU}=|}K$Nqo_wO9)*Vv&EEHS~*I&0p_EBueq>z_f^!ukoVjsH3k5!eOxf(%%?x6#Uwi zfA1M*Ay{F;4QSfl|1lE(dr@S9|2Lz^Qp)=O=hFS0A%6TXFM$82{VKb>zFF|~=T!5f z1IwvsA1e1y>$*4p3R;c{g1b@$m;LpBlnK^N;1F0ssy*Z-D3BGO+l9WFwFHc^sN-$m z9CfwXJV8Si3p)(S)o{;B<+>|xIZAyj{TI-7J-ye;R{SEPlIU~CUz)zWS6Yo zG-u`mSwbD)t-~tNgx)3dN#H+DoJ2Tmp3XmnqKZEc%R0E6w@*S-*;N3@ik~hZ{)P!S zP$5pD0!CKrLI~rb1$43~Fq|B0gqVyy6olcUh=TL>MBM-EN{m8{Ps1OUV|Qi0XN&~sp+ zAP7dMaUYDm*Px*&hule}!ATU5$W#!u zK|O1RdrLY*&a03bt=3^bGOY)eyi~(U4ng2e9ajnkFy(x8v7RtKUclvY&kh!(Bl>4V z_aOMWVklS&Q3{vDb>t5HhUy~+xVYH=VehQps@%G8tw^Itr*wCSfOMlYBHb<0(k&(3 zog%5y-3_9ofTA=kK$^v(5s))q_ZQoJedqiI=eqo1$*MQznsdxCp64Ec4Y?gjCeA>$ zCmE`G3hw$IsF!OFytNAW1Qzb(pON>=jnzwvI|tJ|=7D8Ags*y86RZzlW01p}an zn9g&t^ZLqB08~2qR7pRA?D53KP@{z42e=BY;8Xie8BA00LYX%Iv$p-~fvs&+I7pLdGSif` zkBXie=4Eez!pcJ$s5>bf|y|%|a44ko))tZ4^7+mY$Y;E^(6Q{7L^1*ar7< zfL-Kf1=PLA@Y_EEVF{kV1}z!xNJn1JeG~mVR;#~r!1LeOKrsE-*tlkM`woTBmmHA& zCtM!`fQ3D1yDzZlTYCW^0G~nQZyOtI&;>x%H?$7wj@18fX5%)Jwt=&(Gy=2A{~T-p z=0V6N8eiH6!r10LJhOtIe#)qjnWHx(M@mE=r_%vK$R?rJ~jd6Hk9-KCX|L^ zkHFi34LJ{1z%9n6Yb|za+H2XK1KhyO%)~|aS$mo($zrkgj>iL5AP1xDH%jVUWWE?1 zQFEcO{*vrbz|2LxN$_k+aL!!Q;B{|&H3!3Y3XJH~Q6aSf1t zG~R>&gFeR`#E#Dt7z_j2={mkUXr_{7v5=SS64$(EOY#zX_-besl!x6QrO>0GsFyKX z_{1TbxRBx;hdasq64&598&qCyqJm(3YLpd`5L$=D@NcGIV;$=2)j*p1WkBZxyI^=JF2yGAX1V*o9VB;XC+y_WGx+kP zFc(}dcin^+aq23`IOxs>HDxbU4}>3UJL(OYgQ*OIM-y6p!jK-gf2-pAS5o0W@!cxU zKHaiC!vY~4qW^Y)ScfEYmNru1h41RmJ`Wkip&emU8}9=lu*v|feZO?(f`>orgg5>P zJ!eu1hvR1O4Xx~G`~I+ zGkFHHzWw&2ctw)-TY8B7{M8E)3ycPQqEwvdij_AMP6xao(@Ml$S`q+>mxq;PDP2Bu zbI?0D$vKPXzZgSXQ5sv;Tj*gx(9L{$F~pI!7gxC*?9SK`{CcF=Y}P|837Fl-BH(@N zKTOZhGl=jO$14N{9DB1)nZOUq%f@Jdl?hR>zkCG2ymbMMP;pY96rw{OCGud!!hzy` zv$`#1;rS^@3cTHK-d6~r=X5b@J~;6MX^jYNtykhyt`E2#_lr$jbTw^0%=Q7fxTl3I zv-|hsLR`img*%(%VB%K#AA$63Po(ZdOb>{I_iC92nLv+?6&)z>nIq^mbmDf{~x;wpi!ThctDp+Xb!&r4uvEc2EK=t zOP4Pt4MnZwQRog}(_m}gxEysJ;5L=RbYZLVTiEK>>P;LK&QZgkxWL`Xb2Y(~-IBJx zw@l_=C*Jh%GmX7g4aKBR#H3wr!1cu$0jIOl+3`-_5JHRfh#1y9X#6$>wyd z0D3gj851h8);)p*UeC-8w3d9qrmDm3szxPjB8UxhkF_}5 zN_ zW|k77>q}D75{h%WO;ltlXBq1=ZH-XC_V<4e(Ceb?!%y{9Aye;{;d}U(IzW=sca#o~ zW`rz|zD;KBDHWut2r!W(87Knb3DKx9HN3CF8(klAYLKj~GzrjQ&7yb586nQvRMCHdZRY%pT#i&$ByqzSA~4jg~WzYCB+V zH(EF}gdeA<{1FGDA_X?MjGTSz{I%BB*#Hl_(w+kDNc}sC!*v{q?T&dS`Nj!(Bm8Z! z{CpYYfbwBRveYqL7js0W?LW&k1}1rxs%hW4f<{&bWHWqmHd1ir=Z#gfUqMvKTK> z;>OvnaH{i((rIBKZx7=KQJJlo1=T;=@$U0S(tsSdsr1or@8e5P&AdX^d2G@=PCPNY z8~Y$8u2P+l`bB;O;|n96C+f27Vq1hrKA8l~e%}#V>=>6e6G~3X!rFhAf`iQsI`WJP zZeTzsMo!hvFySznM9J3>otw<`GwS>0an`#!774PL!llWt1qrIZ^F<>%yr&{;P436W z=jz_djJShiJTzzeJ&aUn@Fne=$=!0jiQeNcy=c}-lLKsL3)b^A=~r~BO#-l3AJIs3 z17RnukN85#&Se-dbPGasul2RvUS+yeyXkaUhCOaakovVZU09sm%`NfeRbgf^BL%gE zHr*Bn9`Z*7E*zro(9l+FL4M^{{NDxMGA0r@&q_&f&pr%P-`QWZCL1Zc1pb&uD>psA zMRQxy&>?miUHR4J(wDv&GrC5qlcbw5>>d5gpvd;1Viw7XO;a8U?-X{%Pk(}MTGw9E z^E8K1sgy(?^Si%3EJ>9e$&8fRS(IJbU6AHWvvP+38 z$F?&b=hZ^pH~PdHRI@&P^v1b$|MHCVaZvtXSrzz0L;rDCV)3&rBgKDJbN(G|1DDm; z_Dg?ysl0Z<7os^2;p@hlv~ri`G|w!BS!rP^_tyG(-zce3a_2ib5IUpz18mgjfF`pD z#o91LQ;waq$q%+)U)hohYf|!3ORpC1dR7_7lfd{+^Df>8n`d0fx2o%1_mw31#7e(L7u$t_jEw-!i(`^h+e_gb> zZE0NRLmFV9mr0n*fRqbU=w;``Vy}|0(Q2YNZ^9$AQKQAXmu&rMK<1qwkz-z!iPb&i zM$*5lv!Kn-!@!0oGJOuD1X(QP=cNoX-^GDoFL+3zyv}l9Bq)zvnQowl==L!)(uPO| zZBJ^9!Q_P51CvPf6CR<(9rk-lgrpwX+vQ;?p$u*;8ZyZz8jjGHtn#Ar`)Q-hEraS~b)O{bo&b~mAMRmV?s)XN7}_8mOr@M}(Vsu{nwfw_ z=lPGLqkH6EE#&7AD)@X&iFaO-tQ#k5W?O;sf@;!oO~QJy8AeU&4c$|e;y61k-0?|o zwG+E+G`2>L+O@{3_V&VBLq=zx_}EQpbDC7?vXHK?CQzlIo6mf05LoARoCB=P-7OAf zBfc)?%&0he6!Z1hBMqVM1t2vLu@I`=_<)dr@pJ0S^BjZRKnOi^`Am0WQCZvHjk#cD z*_Ft%C%|pe?yCVyo90L=4wd!l0kE$>@^JR&kd@(x3fp<>n(39qrd#_91n-S}Omj>i z^{~x%r-5+JYf5kF6-4OsaIWrMY&du zWwhZFK_a%N;kr)1mS0%HO&Vrws;P~lYA5L_6$^k3~<|cRffFXTU6v+vk0x~!wG5n zN==@2=tfwx(&To7BC$a_VfM1kM3T1-WqZ9ZD3mBzYeG9VR!#~wTD!V=yfP4HG%KLT zT9^CP5DDnY%AB;g$H=8xo?5k^yLz|YKYXRU7U6@(Nmh=x=bSY`)L5Wvl~JUr%SQD_ zJhky0$^K1v-X!7JP8GPi-%vywUUtbt=GjU?uGyQAst?PMQw5X^BVB4KWQEi3yeG+8 z(N2&|R z8WWQyE+A|xnw?GoRoZH)WxV^qs|mLcBK@FH)g&_P8W=PbLUOA*We{wR&BK7wyoX0j z!umnOLPXrO5XBE2=U4e0%PJ0#OGa_uxnFOie6<1TI(Ith8K9&l(o$8`S$U z6y;9H>PNpi|8c4$8&Jv~IHHL|{E4H~DrY&S

    ?tscLK==;92Yv#@ya~V`okCE#x{YD zr6WA%AsEL{(_Xe@f<7gv=?nW~eNK;QOX4(59G>7F@Y~Q)Uw9)OrZwj{{f8I+#YDd_`bzheXhJ^>piD1o8rj=y`ffyWJk;+ zfjZ$SOnx`cDeb1QJc&NT0`+Cm765yb8pgmZtK!8Y)I}hUw+qEKKmjMFUq) zgEm_P)+;^^@cTOT_KgL_7t@K0Yns#mLL(!n7^?PoK|B$LyNZsYY6-b6P>9(V_l0r6 zj}GBX&Ki56VuO^X^${poay@IWBQKjfuDmRjnQQH54?qI3qNVNbnfAC=;c@ph-r^@k zBCrnj>6;dw>xubKCB66kzMMi&Xyb>*B|stEZXA$F+50&#_|4u z_8OoAIhDq`2Vg0` zo_kdGy?Z+ZHb^AIrOR%W1`2IopTbhYmf;}ztK8-$Gk<8s4pla*UQG2%7cYP68DTpB9o@C@iMoETvnJm@;_1l6+J9m7v-xNOMriSyfAgb1?q^G8(mt zooJNR$!O2D@LoJ*#b}Xkd+N$zFB|YOfBEdF?}L3FxfJ(vMZkC^tR`~8ZvxWTIlw-R zPt%;;5eB-430@dw-!m`%UnrbnbzF>Rx(~sgk98)+=cZiKG}O#DkOM*W@f#a*O^LQ$ zlK3}-LQdqB&M@~K22K=2`;&x?0CG_N_HBB-Vm`MH&dj)KYQHk?`~0=**KJl!*BLQijM(dqo`%IPZ8VKv?D878+fEv;RB;awh2%n2JBw%}=s9V0B}pZ%DP*xMBT-KAhA&y@az2!O3dnBA za68Keb|ab_8vr=EvJv0U$&t$BHV~5Yb6NW}6VS{jLyDwqD$z={M>=|r_IL*3YE?^O zpZ9{iegT_190&rg->Wd}hF{#J7|-XYF<~8OXOPm=%#bw)!Y7PKvOO%Tpmz*?c}*ZG zoYT09QNiuCE3=;FgEFPN>|g9c(K@a}ws&nMJPNKIGoCg;c7%~fv7nA{V5DI=zJsa7 z;t7PjZ0<`zq~g3wjL8u6^ly_*>CKV*hqmB%se#}&i(R{Z+EZL(Ki}=mWG{jEIc%@? z;{o}(EUVV#-mox199RBY|DRr7xL@MO?O|vp4<$-?O0z!-SEgK$G+VE}#x)M2hsi^+ zmcZ)v=mz%`!zE9qsz{_eJiFU3{;rUX)Ld9Wtk59;JP3&h%q%~fj*VI*FtX}&=OY!* z5$h~-ui2=Ex_d*y{B|jF=T2^l=c1VR<<1_axx?B3-Bnml%A{jBx;f2zQ{Ae@nF+{tK+_uOGDa(tfrP9PK{G^WttPp zfQzY^IxI!^U;X;;%Kx)Ff$DlmF)yG$2aeL4D1?3QFTHP@|KtxfjD$4~R1D4ud|X8E z`)z-(1cS%VP(YDHPg33MAHVd!{`&=z4YY8xB>a&v`qxV(*q~}KX5`@iRt9h)VQT3T zGcs%uAr1Ri0n=CESJOfDe}utMB)o|G`6$P4Ku`N0zmea0;geZ@a&j=zuZR&E#b zuG|us%iTe((tfg^44{SP-WJ5p9GweQUtvH^PWFJCz*$52L5lv1PYkmiT>x6uIR|Fi zHIM~EZ3J@HMn5ld78Bz}*+hD%KZy&dSho297tkCq*sWRtftCPR+8gIxt^p3N6`-ue zmkdB1aSrf7=F#>LWQ0S*Bg(0&@nz2^o1>sBy-d?^Qs zusvXS-c>j9b3V8R{HA6o&$kyBa9IG-v4=lliGJ=e9d=P*m+{RWL~?te!}+`Si-5?q z=MP?}y$c_s0AKkAqJc@_zPd|ANuYkEOKGT&j7ocxpxf7YfA2Hg;=?m-EB`| zz8aF3LKQkdVzr3HUaRy!E)9&7I(7)UF-8)}l$=5r!AvD{wWi!JQx;wIeUkY?olZWai~q$$oQEx6y!B8QSJN;1DQ z2Buo>mzHia7}by!7t-spZ95!)c>?W|%pfg~gszD~I7>-3Z`;cO;5OYK$04p;I0lsy z&bB4ez*V{s6@^lEI_7O6eY<6D`7!)5T9Wf0jv$dBsp|}gD$M|O!^L&}awhBrdUsGr z!b=A=84)m|-iU#?a_Qysp7? z841b-^b0Feun}!(cCcZnpWs4Pd%*#Kb=a~2893rUs(P_q^zG|4No1H6OU;k*-=>K_ zoXSdt2LsmpD5AUy2#voQr(-{U2s&9cE&e)b?0$X%s^T7i=T>+DE=6zGFc5Dpje@Ih z!lRJQHy17jEcMv$G9rHq4n}~2Dhl1G4_$JdJI5|%DJ@PDSku9WDiSnCObd_ z!R~`l@5kP+yC4}jCodT94M(Em7Ytk-NPCPBWzIPWTWn&)ZF|XTGc#Y{U~Y+s*@h!f z?(AC@)c(X3BCG4^f94evljx>f8NORJQy^E zO4wo?waOw_5PSrkxuz#F`_FNa-!TP^QIgq)Pz{2>j1p@e;RRrG^-ySmK7yq~uRpl@8wiqGx7kJ)#m zFJD_MSM={3M4e05w2hDR3*q);_#H|(fYt&;xVzZtU6Ft$W5CR)MU?J2#RkA{MNn)# z2bBFku)$stN0O=$A2}2ifd`m#TP;C)`NI-fv1Pzs9b01&nn6$LwTdgx^m3EKnZdL# zmpY)@jM0aZF>qKb$cDax=OeHh+_UoRdLNQbG5iSH{)d_CghNVDn$cdc|0FtDKJ^63 zTjXzq>B@ZLGTkpMpgQG1#^%d(%qE~a7~wZH9`6Jb7t?U0q$szBMd}?TGGcwZYNru7 zm?Ga$;afZAdcdmp{Y^5Yk2bgmGRuUY)-!E68-Y*y>5h4?n8ZFB!$LP`EI}ez`}&=z zsqCy?%lq5B!g_{{N++hZDfZniPGIl|1x@0~hx(*nxIpO0zOYaDdy1D<%h5~E2@gLI zvT+&p0rdn$g)F!3ukcjh6_^b3u>sZw4hy9jAOYbuh`PvOF^dXO5AYG-j?{E4!x`=U ziuDa837VE+q?WEYhjVhF>o^`fdt6&RwdizW4$H$XPwA1>=&-T(xR7T#@QWGNelbYE z!E^%9*EaLaT&L(%%YE2nK;6+R+H*gYMeLhxk($xvH!lHaQ5YtV&_jUkM%M0z&<&vq z>$%Ba7vAW6g$Cjqg}D_GM`%y;tQEMG1?Dv7v`<n6UJJYrV5eX!48K7%Dp7v~w%_XGVwD!AWPZ~N^mIsbu!3Pm47 z5E?A&GNIGDt(|6h5Unxn4TCi@)#Leh`EwI&={=@FX+tmh)hmDJCv=zOj};gC26?tI zI%;dG>ksyf_Xv@a4&{9i!U{^Bdq*3-OAb;j;J&uu0K}@ zGA-;o@GKiFE@QQVd$jnztxbwSG_;|n?JDdUOn5!wdgJlwG|!^C${0d?X}Re-UGdaX z`|_?MO#JivgX+u6Fbk74I>j(Pqwd5J+W9?}B))=Y{Q<7@3uQG`zFI0&0<=PGkE1J3 z1C-kqtzlQjScm%*A$Ls2%tGuGO>k;TVkR)QE28TG>ZXN2NZG zS1-nRrhXN4z(gu#9{HkG9NispGF;fxwb3Z*C6b%nPOq1=Xg^y<%6nr7Ud~b z^QQBny29yfeT^bqHM_XdBb0aF*YdE&zH$k3jQCVF_pC`^*?_8)3GUP{1|Oi9m=LQz zDs)(Q&W=zR>pAc#l7Jb`!-kHZ<+QcEDA@OQidytR^n2?~ol$HFt3_x_&>Kz1>l4j< z@uzCfXGY{~&biicb>f36djKrIc>4r<0dN!X7BM)kM)n6ILtYR@XbaMJ)TVp(zi`ks z8E~A%mA|K+EZg$B#Ya}xRBW~1F+$syutR!>(t1;P-DZKuT6|WsMZ6UzeDDc)dNg%V zw_qvo=}FdxUD2`Q<&~71q37q4L24zDx5>UYft(UvB{$nJ6*ee+dEVLct6X9gSsdfT z^Dl+bKIrL8sB@3WKP{qYyhvNrUTBBJHm2w8v@|rGyaT^Y4-ihj!ev*&0#uP19P)yMX@$?fT<#1;0w~mNx_fmu>8g;~ z3zZNXdCuW!<)9us^sFq#h&QrlLxj#4YHFB0%#)bGg#3UZp0ywh7_;q2{47GE6AHj{ zbkQoNYgHhl{HkGyd}OP~fJ z>1%gW(V~rb^oB$okgj!_!bq3REdbB8Ie>JTcAr=a9i)|Ps~Wng(h~N)%T-~vN3J;s zTtGKvN-$QIjV-wJGLpLD3|D|PdX<-VFkGzQV>D)OnBaq71tN1EN(u5Jlm-Ld(wXJt z@W*>7A^fK~JtpJ*_j_Ao5}uTykW^c4S?tB+qH7TYB)(o1G96XW-TO~sLNnoQuY8bm zMWS?V+;pom={9KL1_wWKj|W3cNTm#IG>S{sa-?4xl`BKx^(Id@!ORr^ZZEyIb{ccL(Izm}5uPv;J zxwj+iGNKyJ?E}%)`Y}T;n}|sW2Y7=P`P1>!(@*)d&@JJ2W^Q9W65P)Xqw6$B_~iPY z=PsR&%5_Bzrp=E5aWhO=4t+=I+%P25@4Y~Ah zh^3N$frBhOwiaIUq`zZz+50qcxAy|}4ZigaEaF6&+JQ5arj7z5=jc1)+HT$yaw5$RT6XjU0mzIUwK->Tm#d)1#So)n3md$-_v_ZEJ0WKb*Rgr> zV1UG0aZI`6C7QQGX2)B7w%MM50U0E7G2CsYkzu=F3Sr> zSf$yjuL&kkg@+`fW3>{3Aeh$R*AX$nT{m2MKNwn+B1*Tw!I>7<9^6dn<#k%~emx-? za7)`6*9jtCn{gu)qUL&aNcKfsIQ+E_`aCl67ss(|+VBcKKj*5X*byMyj^&MbxUMVX z#O2v9%Y2InwIf(Jg<=eQit009;($jr2vTOLn;%Y5r+J@3AwMx_`*v`w2d|NkHaWF>n{ckZZD$>pC(TmC>ZOd8U zCNDm79nB&f9uQq)ofH#)j(2jnqG9!7NB)_VkoZqRCA{)`*}Y*bUTGO!AH?_lWxlAW zrXkP>s5WGa+ufxuod@duhS7wdHr2%~iO3>TDf@~frBN-j4hP@z@8d3{v(Kf?*Hlu# zTE5F)8op2G6{_1ie{uTi=lL13=H}0QhjKeCv9samdmfpz2)fr8Ip#A2rzs-UDq5iW zxX_FcQ!3sy=NdbzPa?#17CoH0Vz&Odv)cUpIE)r)t%!;Pd+neg&8uJK^t|bY&AGWi zBcEgr+ro3|k&?F>8EKkqLu8%O%~V$#UJDGtQr!y}B2*Cf&Oyli=h8=;b~9~i;qHa* z)fJ9yJC8lQN#6;C!GSM79dq)hU=`b3PsMjm*(#NdA3iERX{ua^bsB!C3NqCyL@d~4 zIKH>ks2mY#XJ;x6!iFC@3oJVa!2Q&}U%39Q6(+wY{qU06zrCbz^X#ewd(LG6kAD8O zVYLs6M@ySylJ|L%W4p}?JX!D5aT<>CjZZeP5#792%GWo)>jw6ZSiOX$0CN71u=4o# z*r$be-t!&`U*5L0$vE3xZ`Amm4Zam9VM`ZqF5n{&L1n1C{^A2)r7q8;)-WT6jwQ@* zDLA5}bNpT)>;SnDUFjLv?yZ>E4-W=DWU%se?rO3VOLv$#Dnb@y!w=%to2hYi9}ch( z9JcVGO|LOyjNGZ4R4LL;$++iY=E%*$p>_++nRuTfqUZinYy`X1Qd!xN?7ZGI5i&7d zI!VxlO2WQf#yh|Ai(2M5@6!uUf^NgWBjn+GkMOdX8x`lTHf*_@ODF*IPH*O3Q=XUQ z<43{GuC+lIq(RLh6*$KVjwvbLrh2(dO_)nRO%mO1)n2ii-}kK)3BRjZKESD_iFSo8 zjz{Tk{wwaC&waB~@;!?t&Hf;awq{!%**8~mA8dY_&F`TUqf}U8#${o^gn!sb%(n5K z9ErY8vu=y4q5VOIPgPpK$6+Uh7gPmH)Sz#&rEWrB=KStZ18k@%M4y5VU==bFUv-AB zlKd?93XG}=RC-bFvq3)`qo%;`a5|076*=O7b<0WH-`MRI$c4jDPI^s}$No$!aLuhgU8s_u=nav7-^(^odF zJzfT6ujz~Q;~GcQ*we5tk+;lzS;(Es%&Pe)7^=Y(4G_Ht6) z5WHR3x0vIsR}SUrB?R!!;FZq>rpi#ytWFOK!Zi;H>^Cd;f!sfsOI%_;FQzmkC*@c8Yscn6W7b2atasH6pLNUc3YMX& z`QrF;tLlx=!^uYWqQqk(531sDE*`~A9?Q;q7jUTE%jlOjcVr3iTMlr#+$%i= zA;DQcNl`D#GJI9*;k`F@KHN2*(7AhBvrWpv*9iHy&c3~`vEm9vYEmjIKjUDn)vEPC z^IB^c-yw_sKA?a!``Qo>Jt?-d9lvH^`qdgpH<6b`?dbOY47?aAn|oyKW?OHWZvk7tDYm=8s6;o2qikBC_0pY=4;IW54qe9Byt%1+8^dxu6 z-nw;Z^)p?BMxUK~h=9bod8dPmRn-{IkMqz0xLKH8X_8sZ9M8 z$%B?3#q0aoVyD$C^=R-h@aHn^(CYjESb|K^vfrxq4R6Q`^2|&w@62;;r9ijZW#kLj zXc+TG`u1Vq%Ly7SW^O#m5EtZ7S*C9QqNj$kM;^bFz)!+m_1gtygs@k(Z6x~4y-1-6~W2knqI5%u0Rlxc4g_(SD=9U5*kM|~Lm5PW8Ts%;@B<`;dmX(> zRUus{n4yA$>Qp#iu{GJVY=Q-E5tK0Z`kH90n@9GA)p0^{&|9y-4D=wAOg7{-zVIdU zc;F{JzAu8J(Im@sQL8MpBssLNf?uaC7=q089!T^nkAxx!Wi~|ClGQB(_2D7hK}CYUkO?24Kp@v4?5^k+T$K-eDr1d@SM6z2kS&~ zB(6YKY|Led`mX;a4#;Lcsc?EiepP$dkk<9v)*QlFe>GJyr6u&S(IJRRz-;b`9d166 z^#bH7i^pz^86@B#)#?+_h5N-1tVPP-vDFo+dw-wOxHIDz++M{$h-Z5 zW^m-zx_L*}smNrU!kBX_c%u#tK}oIcQ9qt+NX*GMjaL9&$9%`(yGkUwdA|wD9ukB% z^t?ta98V_AELV-qnb`3c94+0@U-s`~NQJX^AgaP8B?k@wO4!~1`8p0&nL2wtSTy6d zdBeX<>JGp}>VMAwIS@*VjN`*Vg|g+VPq`>@WzKqnN-`D~O>z<4@=giqHOs(LgsEYb zAr*9&|Il$Xw-wYELJg5oR`haM5p^#0Taqu!cjWC2;2mZ?;g~&d<&0SZ{|d(qkcV4- z_f^b#x3-N)wnMmvO=G>OVovh3I02qUX2mT}EgxF@)O&{4RLIgr+nl~uw|dDHY;SQEy$`nHYNj+QtR|LFbr}1| zs!ubOLmzo3KXngC7PW3G7%GOXJ-nYrDu*B^Z0+@Ck{9X|q41hIjTT|mK*+?haP!}trntX}{oba#(kN5rXerC6h| z&EW@`rTu3me<69OI@XdR@r{*sP^dJ9pV37ti`6e6dF)$&0}5elaCbJp6)WF>d?AzEEm*$gwZr`v%J?Z z=BdVJE7*o$FY3;EEuCCjQ-cjl9VNr)m?E^vr>T8F*D*!xnh#M?Cuo;e960HT4PDhu z^@Jq)3O6FYi^@=bGjLI!)YYBebR|GZ?M?m#{Dz$EuVS7Q7}To6+wh?_2zl%y!d4es z<>YjAP$ow34%KOX16?;z&k@PtAaKRE-WKdUxx=Ln%wke$mC5Td99y$4UjYlZhw~7t^fL-g}P=hPo%Yq=_NPO&6p35 zs}=a6Y+q`CBNqp{;F!NimKs~7{ufmD7(fr1+68cR(<#!~lHU}Y+k8;PlDjcX>zYKz z-`DBn>7+6#={qKL;v7>XX-+_6dP67W>hC{%zA_LKw+Zr@{Dm|eImnldwkUKx2WFv! zTIi=#R9MkM2i-BRtrNI^+EB?y@9+qSP^CNb*$EjpIV=f`GGkLDx)bCF(D@>-yqDU+ z+NREX3X}H%gb^&d>ggq$<-Y5yZ8k>44kL4p*`yJhhe3r_*{SBd-dCb8qyiXnVm8vn z8MDC3C1pKnRk0MDo+0EZch*&MYcl#XPgR1OSXG8(cSUzS;8MB|eB>OHo8Dm%aZwt1 zHRpFaPh;kN?_+H2FF^YxE%v3eFX*;iX?gROrwC1Q95xz27x}anyNm1I(EBseFfJv? zxCj|KQ&ZDkHfd1?89%w!QFHBim9Si69q&T+j{F?=GR}igi%%zb`XZ~XX%AFONs!KK zMuf*N7p5JaHr)j-hbt#CiX{kPq?Ds%OCarZy*_L|ihz|lsLto|s>oQoU0PQgI4>7>0( z0riw!xBO~-aYoUH61<-62*NAce1mRpe44k<*g-Hxyu9!MX%CcBE0^TCpCoU)CVEjG z7UKSjDI96la@<+*`{*~4hn8yLTg#&p0?QUBnDV{pCWKu(mu(wRec?sqL`S-`lRtu$guVwQmP@`!O)u|& zZ}Fr0mQN{$W|zf9CVj64^obWM_?@#5*QSrQG@9GQ4dX1}qiikTPsYSN6 zA<>iaT0HW;-jDX4{MF|nA|-UaoH0Uc=fjrP$3`*P)&y^>mw<`GCfDcUFqsxaX%LJ} zG&xk|m4i{X)56`VIofX76bmz~%F=oj(ixvRjSv){`aF_Z4>Ew50`EF7$5Zz4cU8YO zUM@t=Sk*4a(-*a;6l0OTo?)IS)-Xbp&0heA%8D2as#5+XJMn1VcYq0@Wxe^}85QIsRm8?1OfpqSND(W&L?;#3yR;cEfpaCwz&iZM_CG<6)af%w3<=k1kxl zxZxY2{j+GSQJc}S7GqXSOR{Nkw}sscK5$BYVH9w69C_#$)|!9Ys5#L|c>&*_^&6kP zXm&e{1u+$6Gu=#i+I|(@7j_vh?D`2!-z`p#nXui{O5l2f4?wvf6EO5ii#rb63a}lMGk9Ce02=t2NgcsP^Q2?t;R2!<#lQ3e8qZ%<(hn zEZ*^M$xT=ZG4`j+aNCb1O1R_C=GzE$VDhx3LT^N_nbmxi(Adm|QWx-;nDsV3llr92 z6+r%igFbxKRin}pXn@T;mqo_ZSOtrpYTL0cEI7N^twdBkWFE*snvWZD#5f{vGv2Idmd+4j!-|30q4tbZ%A#Ll#ZP-~DCOd@jE?EMyz;G4 zpgNFv-0u^+UhrsZ*>Qa;siBepcftDsqQY=lRC*pLf;Ri~br}}!@L%%0l$lo#nepov zT?%g0bL$bXRh{iZ<@IdLpG*2JZDF~h2st4Ls5PE>E6sENl^C>n$N*N@ATW<|b1JQvG3(aV7xx*x&t zr`j25-?EtYD4Ja2U&AeqXZV8CU*dnCVv~@f4_Giv4-{ZsT}gRpYK3!ok(Hs_Q}OsB zo>=TG-6@MahoaJB`q_Nb;!=zv>Y8-}$#u06d@WNU%m-;tv+0JD_=`my?*5wF7X@XO zYb?S)ICOj1F^%4(jeeBz-g924{}Sq957uB^|9icJy=>RL&2zP)S2@e4$%~u|xR(xy zVcn|U{F={JZ2{+Ze(0X&e8?|!+a0hE^+2=CQ)%L>FX)OqMRAVw{7{_v{Jqm6|6%q) zS$Dik^R?IBb7uj@f2l|Y8Q{Df80S`WYAh9X3qOnY@tW4+W8v{Yi$CHe>mWOmTX(a< z6?ySPc|08TukwuyW=5fe%xj+E*~JAiMf;SflcEw!9Ie={^BzFGaUEWai)ToJ8E zfe8ow9daVhgz)vLN1{*j{bmn^AEUz~Ib#JQF-2beJNJq<&B$2$l&8X*C92RYC7BFa=OxogvTgSMZ47(DNp9NaD%5^CG*yt zz8k*%SOL9M;`e*V)bqY5@arMF6$-o~|$wCp`8# z$!%b3Ooh%(h=V$OgD->PKL_5x7g*`HYs;c4o6Xs>k#E+}Ai}ZFn1*w|YSl(mBUh#M z8DT=n{do&=Ea)wH+emlr+sb|8lD+fSxl23T`L1XC%bVqnezx_>>~x}+qu?L0E@K61FK>YjE+@ND5ed_k# zq4N6~343r#_T;wze%ZgC4io~%xOMxz(C<4ONrkpBGFY zoYL$EvVVTcC{j?kQ1JWMe_k*!DBk}6%l`i_`~Mp4+P!G&$GoGI@D^sQ)pBN?eQrh%jtG%PWplpMT5{tl&qMLgu&Q7JUu%Dk*vB z@*}y@cdp5K6Ubr}0Yli{OShgF_mK=%Brxg!KkZ&LkFBo7xxrTe_4$I%os*ojZGqYT|#)0(OB&%7iioKwh_L2=~@L=f6B@ z>{N#4`XM+uqQ4br3Xck?uHO1S$GzRRLojbx(fR8qpU=q-jC&jt288?ybn>xtWxW;p zjhqk%XKf1i789@45{N+4HGr;PtFbXRIlh;W3wXf8B+(V5QhjpcyJkO+ zHv3P;cVWto-Wp%IY5Bhca7mN{4d!*DNUN~rz z9;`?Sh&;RQ13I-<%B0LE`mOHv=YI9XGvTo zE#Q2}IFgfWvRGLW40>z*R-HdrJikYIrorLqyD*@rhD$f*UvNFpV=go9>=0Co-o!EF zm|+|5p(#F$#xs1VP);#3!)3MLx$!1!qQ-LQiEAUSOkI)XA1lSrREb_x+<7kp1tG>Q9_rZ#i%hgkXhmFgFcXd(X4yUOhMgZ+4sPeK0Te! z<_WG$Ux)MDM$MaltnI;??g(q@;&&pzXfk`728J^xc45c!^_l+N)dIN~1@ZGwsuQHv z+3F8M!o97A)73+6LN3F$U8e|ch7aN46H^bLYLOVSu`1p+X!btd8kButtW8-!@bb&t zcg#QLj17>?tdNyyhwof0oOaYb|N8z#Jwoim)9=73J_$6-hS4cFZ@SBLYbOT8PO1;w zzZwnaiVC*_=q{JmE@+LsNm%JAI|CAUQTxk)!m9-CA`AQ^Le-ZR@(w&GnP7KpLdaUa z{XAYl;Y=~!p8sNT>Uhdq+~Q;W0js1;Mi18C59i1Wgf7JX$oVO~Kn<^6LDQmfxr8Rp z+{xAcf7<)bu%@;yOa&Aaq$o&{u7Gq=r1z@QRGNT*!lg-*-a$kqbd@SC2-2HCXrZYz zr6)-5y|)kuJ+pJ~=T(@QpYuF3&wT#Mb0jDG?6dYN?^^3!xMA19moEuix?_+om_I9h zP%r%nv|6Mz#$7~gU2XaRIn9x#3YC%^0nH#dpVczA1qFYIdH;yK#Mt>0XvCGWS{<%T zpi*cMF!2tm$Z%Qeb(wx%cFYCymtyYvEZYFOMdGD4KXk%8h(~uj+%hahyA0UQn&k0- zBBRGML#QQpW@*6T*Sa?3=>T|;KNWhO$?lAjV(7a#9*RF zM7iYO!kO-XDJ_4<)n~mFmtl+R8!gl^Njx zjN7`+Ka&kP0ZWvjLjfZFuZ_t@tLg9WY;|x`25gI^^q(pSzr&5Bigbx4Ht$H(s}75y zSz*X@lrB8?$5YCrRGy&|f}RiuxTLq^<&81*35;X~);U``e}fy{*RIwXNyUZR|TlO+)rG{WP^{YfE1~ zCNx`c3O7Ek(xhsd1O79^e9$K7@vng^)8r5>mt^j^h@K^37Etd!F;OR9P zZS@85Hp@zsE69IfK_< z+CKyO$SpT&GshY{)ZzuRMQog_Dga&NlIwY#xfED=7Bye&*g&EDGvAKtSd1j&M1-zn zHbG7Q;9Y&JTB(;0Op%nK`^0NrozkA$X^n5F>~Rf0!EV{g867qbU%2eU0g;`f%Io=5 zid#=@I!d*5aMYilK=(mqbry@O9vVXDS>oA@79yE{Ck7`ce^Tqbj0-7;x_ zm~{OBOl&MZTe-%(yal_GjMJuz9lhOdF|IVyzTODO)S3lxl_5+62KcI!ywa12rtD$! z;eThKEfdm7=>`lBR=DUNdCJtV` z&~r~UVz(&5hsS4Lp6OmbVM|__j|P9pTNZstg9wE{*L03{?nBsHci?)36mEBL05{Ci z0ZhG*ZcehaXIeV0U)Ih?W%_^5$1_?EA)$~{a0}fDre)J7Gaq;mIUh_>qNLFJGA@i2 z4`RtcZpd5~Rcto`M+2{l+Fv0w5}`vY;r=}SrrEvV`yAg$ULSilB4>q^PC^O>*~O3{ z1>sPd{ih(XQT%+-za3bPU>&mhKr#)4S=!a9J7`7mKGkDF^}j_Fy5=(0@=Bop6CR>Y zM8qoQZ>IUD`2|NL#Tvx%1-k5XR zK!p^9l%@*;LkV+T86@okV}<%Y0fSgpKQ#3A*vg2|RQ^U}tgJlOUz1V;hq z=1T%9L~^)^zRIe8rT0#yfA}h ziGYUX5S3&}FIR!r<|H}0Aj-`Egh(tazzi*f*?XG?_tGQ?Io z;o-Nd;Lgt2Lrf;H37_yuMN&lGtnzG;>k$6wOVSz3kR$Lh*Uis>(I8GpKuDxbK=F6T zgF_ZzAf8bRKZ?NaL@WUB*nJOl{u|x8vjfHMLebHM-s$csW1n7z5wnI?fDYZE3%6Mz zxYz;70q&qB`hAw)cOxVg_MtnaT0nV1QIATRjlJ7@Pxy1_cA3?0q*A z8d3WArnt!?ibNDFazBeecMcUV%WNkUS^&IRXJG8p!B5?)!PKm&;c}MkGFSNyZ$Woe z_r8+(zQwVtf5 zI?nmLtc+c@kWL5}nS@Y|2u*H{9j%OIfRW9m{p_O$?PCXO!9@(X$QRZwGz5EuUC{6o z^I6n{-oy21huB@g^*?*|x8X)}+`}}N?pe7|0M<#CBNbaI^A2A@n z#wy5JS_bi#;s?W^1RbZpqd2`+ouDelJKw00fHmPh0Tbdin>ojWW9lJA6o6+*6@?r3 zjdP>rvg1LR{kMJRsu`Ky?=Ld#j_^gN34$T4YQ1WSB1QA58H9NHg3@g23FW1g zK~E-Lh8TY1#!hRE0QB(vW|iB{l$N;)DIU)1s9gx zbI!Nqz6NpWk%K%;qWCMS1!mO^u$goW!y)5@90`G_+v+eHq+el`Ltdks$vG?vR+%)9 zZ{fY4SE9(LO{G#&Zhgp@!1D&3S^A`lQoW{R(ONuG%UL?CBK|IRT7 z!2k#IU&8R~b0~28|Gk9V1|ACA=s3wVt;q>Lr&cg!-hhCjHHO!^BpAny*1iQ|#OnY| zIL&Qp9^Mf}B-@*(r@8Eio9t9+-M0OJ3vrXRDgFNOcd`or+N6q10i|z%i?2UOQfR~( z`RQ%~U*4mKqG#p7gXcEb(3cN8s>BPJDtQ7{vk)C(#0A!~38Av=X$pOTW%po-mW2u- zkn0YiBAMHZJU!IBV)xjZg8D)FTg6^@x7K}Q5>-regMh+}l>g7)?$QFD3uA54R8!az ziUP-Tiv}tzEsi$L#Y~`L2Dnhj!BXoG?UmQG09BU-^dSK*U=WJw8kH)ly$P`_ zR8cYWq4;!M<98+gedEGtUPht0E@?om*@|!8q!lMn(sYg^@oj3lqVp0B@ai6{0DTw* ztlxm$(rZgugpnTH*~%jlK*LeS<(O1wz9K_a?7+KT>Y^1~_xc#+am^xkTDIY`vu0XV zBcar~|72(c2xy#FO8a{0EpO`cJAZ0;5wjAFd_;waHwDv}R&0%oj76uE+hR6Qv31qe z9mjAK^7#ZjgRS<~(VK;PVETdjQePpz`VqJB?!ET=PY|g9wGQt8TvI?>V&49YI!$m> z3HD`PbpWWYmIP@)nKjdQJQ(;J`L>b8905#~3yQN22EHSEiUgM#c%=^)G=_$q0TRCe z=8N%{Whd&x+LMF|hC%0eH@IS4jcb}lF81V#7bn>M`MzXQg3iPXfjwvY663DHomqh^ zf66tI3*B7@@KNd_{2B387%t4s&F9kB^agP72j)d$ z`r6(LD#kgb*)zvXb(b=Mr%xy(ZsO@cv00<8WP4i2b%CD0EShdxF43Fpwcr${t?k1+ zaWLNw87E*mI8sn@r6DTDL6V}_8vxj9V|%^jNI)KwaF>KF>bjrH%q1SOitKN0TZw zh+wTZ$sgzvkO=TDxYg~CID=7#RJZIJ)CF7{fX|ZPdoaaB?NYsDxOT6~x!781*&S33 zW?~OIv8uu&&YHpZr+}BlhZkgtpun)f;~P}z1*oh@ENSP^V8}w9NXBshIc1l?QxZZW z?rK9J2Z|i8T7l+ojSWsuz*e6X3l|8byPd=5(jp}g+Ub`aRBR%nYo=``@jf&)=I zQIhv0s)aR!3P=%(SK*=(p#E#7(9)3nmX$XMI@JJujx*w3YRwXk@IwbO(Y1 zN;x8!p#e1-ZKl+g0&Uf_Nr1gSbAH6r@c&wfpXGe^yOFn}vgqCHWxWd7Sl*~VArE{RblYvpzx zPv7)A640?ihzed4gZH#nS7(`HOgHw_i6)SQ_Myb^D$rCjv{!^O8TXI5bzon&s4e4| zQ;%XZl#Xc>5X>P6;G;2hh=T9CC%`1Iv#ZMtrQ`U zJpR4|Iu4k+<}3!tpZ5d)Cb_~6?Vr^Ixc~N41qg=ePf~?rAs7LGTn|W2T4G5Yf-3Ng z@Pq{gag^`b3SaQ$MLH`r?I4%1Mdd$%Q z>q%+GmDMP%$eg&x3+8W~C!UtM%M=$4rMWVn*fbgP35yd?OFl0E(2|G;;^ZfOkQuUm z>;J^|l3b_YdGt92jdVM)xEC_zM3xi?-aM|8_;t=XG&ireKrGUF>;!~;8gGOpMNz>m zD<|^A9%ONWnzj}bmJ?6a#Q=6@^}aU8iR<^ZLB(8jquhx#rHF$~ANiQ0e)4(_kTb53 zrZ@m9$?btt27MX5h2`M)-_(9q3LP2IsdbD+)@ZlC*2G7Uv$@+_Y z4u-lu^+ym;?h2UR!jT$3$y&opNQ4hd&x--qEvggBTPp4yaI7n zD{Ab;=(7m$cAFA%pZ%7#Fm`e>M(e%;H8;tcYJ_?_h!DC0@G#SLr#H$|gufBtU{1@x z-%6=#2rr%4q?C`g#)q38DpPn~p`1rnp>PzBkmKK@+$BtKPgY^9LSOgp3mF3-Xl2fM ze^kn**x}V6D68x^3PE(S$lhh(N9^35HN>k$apJ^uB?EDhWI3L914$(~P-%-w*(YKX znG{JNE?#oI$BMeZrn&%a`7`XH;>i=^1y;8GD)0BY|9OB#pop`sqz9i+nEu<~oUWYH zJD$V^#n)=!SPS1fp0@_Sx&jtCc&Rw~_gnq@>9P{QGucIP{oc`kesvHm62|e@@nQ;4 zmn;mPY2>>0NecqwxRFwG;g7X<#h#hv)sJM1uSsPVdDgNn=>E17wTJ4IUl`oSEX5j? zu6>_e`B}-`tx2pCt>dz{?|SuYhP*4I{<7OXEZu4&*d?hTZNQaA;z_Rau+i1vR=D46 zups7jPrGZ7&z>g%h0or0mHR((lTt{;qgN!=Zd@$JYkX)zCvGD{Ct2+`=$S&e7(R>* zoXfjoyxYEP(%mX0C~C_OnI|$Rw7>P)uTJnuuCLX~9(8xT3xDsS_t^{cu^k>G4XL9{ z2V*6M=UFpCuRJbTTJuFmF|+1|(;(|?P(5R96be5NIV#+^DHYHKb!oreE?kkBv1--N z(*r(RtGKYu5%Y=4y4T(@Q9$&qh-(DJLVt~N#-SU1Jc_XTynhD8&gzicT`yJo#EcHT z4^oZ`nrcplrF_%6(EeM5{0RkyN%C>jF@-82G5KmCI(cejv%P2fB+)NFn`&~Yc-{wE zE})-O@jr%b{+z#s@uNt-ot|a%_u&g8=bkY*J@vh@+f&n-xx}QG$cOztE%=k;ur!Nj z>>B}l#1Nc_WfFEZ6oS!^sMp@?E9N*Kkups$8R@x$o#& z-EfsU>{6;Tf+_iKf>Knz_4?6x(wp?xDt(_asTUa^7DCU;D%4!-`Bg(|dCI?TR)?HI zu7LykfZgua^_pjOwn)3Fa`njaD~U=ZBV2BXM+wP4rWl7e8j#NQX(8PS5j5PdEMIud zQ7&>kU-VB4Y3ZG@quqGUxW-?-`eBbD#orpfvca~nSe48Vefk*t{o`Tx{6~BwOBIP) z;IbHxVtI5oDXk$aYR`97C-vuL8ff#{PSb!mRR;B8k^KQlPjA*3ovgwkPtPyGo!9n1 zBl=_~)41cFijE!4{OYTk^1Doa?K^@tOGmsN+@ovNE4>S5k%5^JwVvLdMMooZ2K1d* z@FY3OO@$LbuL(7>6vCaJdbYMUU0%aZVQ15OtP`+-K1Y+K3#*y2+H7^Gjx$z$MFyGn zH9m8!i9`vxN5waIzvrh#E#hssJMo7 zwO5utm+?^?Y51D~334fV1V)v8-vzzbbvVyj)-1>DS~cdlH13-^#S*Yl1w4DBlD%AX z_!g-$mP)+l zV1R9YhK+^G=WIttz^A^Vk3O^_FYWeg%x>VB%)T9Qbc+_*<{Ppdc~?JVPE79J-egDX zHZvAT^J%M7gHNM*O_J5ElP3Boj?ik^GHBr{S?dT*hAPc_S0>@>HE;cV8C$0cBqY2% zK&7km{=8+-hi8CB@zJ2uw{bzMwiLnr-JS)6#EiuOPp3gKd;Zdd`P~S~P2`S%`0Qq7 zP0#DZD1)d_S}A6%Z@wB9V>x6_s7@EZJ^J*{`Ec%|;uLK)-Z9eFsjdch;*I^w#`T04 z4Pw+-T;;%2xRr{KHGM>V@zV5$z(u7NzucG%tKBuZrHdt*^odw0)gMQi>^4cgg=?`H zl2tb)lh?i`bqgPi*wko{%z8Dkm?C8>kFG~<*4nr7-r;Ipsk{>EaFt6@>`0#+;lOS1 z%b3#XjK7f>|0}y%noL30whNBj3-|WplFq`;XUw7Mzarzw?#2#F-0)eveF-^HWk2Zb zF_5#hAbliQDDrcoGUWSaYwxE{Ls4$YSSEN*v}s1@9jJuaK1^-3)hJgXaug;XFJs3C2;5$U*on_C)Prt3;``-aa%+g+=2iF|W2(cKpp z45fTs_rIaXggaEMH$y2AIa&FR4F&bx7RJ&=G&hQ2BNJDQ^IBwo^!eTrZv0Xtsi!o3 zDn-krEv|PaRKA%qzNN;bYYW4GX5*LW(!Kb;up=Z(~)HSDn8J;Ttd&xMK^Z z%2b%D{_?B}Sk_rRKpm9Nh1e%*9n@6K6s0e;47Y!Bp@qt~Y-&KGwg*4X)JX7QRTY8+ zZXX%jsg+qazTvYivZOx8;TAbRkGFRdkl8YH+xwgT@#46Uwg}h>YX7h+|k+@Bs97% z_uB8r*Dro`ei*@=uu~J%mCz&mRlT_0X&=+!U_;anC4%m$5#x)K}RtMH^@s| z6TJo-axxh-Nt6A0+8p~Leb}2ae+G2B?y^i(Hd-TpdaG-0awImdlrEHF`8rA0lg6Yq z3AhB@EmU>kPIkA8nFBAn&Ga&2+8-zLRnAnVMmJD*41ZkQ;2pk6klG_3H5Z%DEeCUF zfWB|uw-mj!ROcr@6mVq~yHgMN5N_gpge4FhtEtZZbF zxgafh=53NNOh!Mlxy}7aFUnKLu(Uv!NlM6P{FTFNdHT(ddfbk=8PQgai^Jczu!N!rdBXGl=3zrV_(f1sh%mGsc~R*95}=iR!^DLkRhGIjFQ0Ohodwy&2uxsK>SJbS;xq^dzIAhZLcF>=^u`OS7JG7^l9kWW0gnp@)7eIXe45Sb0DK zWWQ!B2SWbiHFe#<6Sy-o83vtQ5h(Ow02iGs1Kjk?@%LP`?m^5q#7w-<+l>I_Sqs+Ss7)phY_2>gi)p#nhzZwE3X7U znXGq|GgjK}ZM1K8vz1H5+9kt9Mnr8Ba(E^5nOgUoEwH=1TVX9j~3qsEacmt5q$wl&>+Tt!fVoDaVfruX-my>R7s){}U$NFV_ew3Jj zTmA}1D1Fpuq=C4CY1)9O^T9*L`{nwWptzp2G&3lDsPBeaWbljeqv4tv=#hmE#a~*h zOe~9IP?!&eT$}!9IML0kXzy$u)jr7^5}DG&zSM|O!Um2cRsMQU!_?7w~L@FA5S1$K708F+_Pj3x!2(>Z8nwJ+Or*`L#>J8 zXpWfEptj)YhiSMj`AB_`rm|y@YY-B+KTD|5UqHkEgv;Yi^oVkJX^y|@ft#}oJ|AzAxG%_b z^7}2U^{c1|`%rzHjU6l2M7&%ql9+9q^Ajkk;K(lz<$JnOe(h!3x;?F&P5)kJWoa7| z)1yRnspkpKO&`;``PcO0W@j$z+`|z6JZfJ!G8M=B6*b8)5O8IVCdBQ3!DtPzx!FUQ zSOzCU;uDqz?MV z+>ZIed4(|B+j+ai#2nI6;&pSZk0$PU%XUCF=kCW69r6cs_$EHSo`+kKrA){)#YX#0 z`2+DydDnbLRFe+rhLtx-qF$~31rSQ<(ZJM;qvaHqE;|Zk5cbwaL$Zg{J5V8NqVC=-}9N#gT2F z>86aI+)gjLbOy{GuLPzdeTQZ>Vx}&&zScfll2}wEy4AYLF_1*7>S*WN#dZ7ZSY{8i zQ~Fd)t+Mpi!w)sjwG+PHwGtn@qWolEVp}C!|WsIM`xU?ApC0MN|j(E4V5kSjY0{Q%7vKKe7bAqoz9$)^OA3+ zcGnk}JSmrPOlF$*!1NE!v(FD_u^p?uGOXX~kvoL~*QaM=wrHPg*%_jG%2yw^%~DKs zSom#&)OOF}2xr6u#ms~RyRw0qda_5RmdRO)bPF8pH?{n$+`-@OQh)6vi>F=m}w|_T{+M)93s@3-RQaOi$hexd_!LZPMWPQut&*HVC)Ztgv=%Bd@ zq4=-5;t`c0MvFI5H4^F#DMDwd9_wsmKZCVc=AKb5HP!2_!b5~z_kEK}>)Y0kDwc?p zUn>5q@eQ<(s6<`#i56VYZOF>7$+l!-mbo#t4@joh0JeT0v9! zd|NU2L9Ime+Uq_^O_$9$7It`s_k4pxz4h7-5 zMIytm3f(SSybUW~=W7rRLuj@p`9{O7T;z<0SlbSzli@*UU1~#p+qeYzSp2YV?NzqD z40}6|jMUwoeu;TQi+g6m5%Z1+L~%|)Uk_r>rmqHXW78ekWJkVhwl}M6#fI=N%Td*|tk_SY#5y~H%xr|m8U&T9Nv%cH4c z@rAR#qU);jqw7~%`haxMpK(fWY{bxX6>FWH9_!q`XW&v=zBZc|;lRn*rfJC-Q+2uzYo1db}R@yl?7UVz5@|-+c~j+i!EjL@x*7@8xeDoO0yB~rZI^XyWQ@- z0vfN&ZF=A)8A0}SK65bnFyC%#&vESXC9e2;%EIqDqV9U!Xn#m6l;yW-SG3EX?&)nW z;ompwe>Sb5;`G}7M5Jx<6Yt5x$Ov`yddDx9LAy=>q~F1ak^f1#!(n&-#ELY#?NF0Y zr&g#q`H0{kH-ji>&~$b^Y@=5Kij0>e^^9z(o}}1Ai_r21xoz1r-(4TuAt<{|?9?mw zv&}r>#{kthsgP@XiTU!o=DnToxlMC*F5JkU5|(C5H*YZse@m(;yH3_&=amS#V6a=x zab_@L&J$%r|I7Q5c~U~4E^XuNQO7j8ZnNuRVJwlrlrn3RXvCkvlt(3}P*Z{mP<4y7 z^bs(hN{K7EY_s|Zt1l5j}{ljIO=^ZR}D);<%Pqt%F+iKu`66~ zG0D0-vz!X9h#%x;>tD8qZk6`XrQd|aX#3s;ck~fpoAh9R%E`W zcrRt;)>mi&5w+`R*|y)f@prYjO#8(4R2POV-#X>whx{#J5xjTvnc@b;dUqt&pDc9G z8;_RWXnf&z&*@y^`-BBdr)FbbD_K^ld8?&QBetqY)K9hV5uHIQtQ{s{pcEBU`C4WH zlMO4_!d!J_>h*jOg3*{QAb2q8b}J*(HkZEEddQ`;6o_|70gacf&F#_~5rGKL@n(+@ zA(7A_kxk`%Qw5q53%jKIxosU=3YO$EFnOh(!92}Y)8$xutestv20=Phs&p@oIep-! zQB2jUvzbt6&y}iy(3RJpvovoQ^f%dJm293;PdWbzsC@Ls@i{{IjgMk|Ma2zWHxDLH z=U0Em=TBYp&Te~rzlwIN&QO?NIMO$p$=eFLx^vWFTE=^J>Ty!Qs}OtdGE2vicT)|^ zL`-5&9~Uj;4QuVA45*#|5+1T)!P{VVdYF93+5*kwRU;mvktpuBoRW^1aX4#oqxX8@ z4_PI%pfAs6nrO8;TJWzm$;9=v#686iE@0^CjgC274!bLb?3EWk4ou7Oew~Eosv@vGXoeJlOv3qE0mC`3rx&MPjyodB|hm@m@hwEE4t{=pc zZrhpVouFS)$nLqA%hX{`nXN_4$WH$xdZ|h{l+0n-=qmCG>A+7+pm3XtHEQE(*4}<3 zJLS|9=UJL`Ta{ZB3}vmKg)BxnZP&bTnKA~aVygf6UMUl2OddlpjN%3E?!kx+{vRcH z-iyr|nYnA8Qir!S7Rucl;gc*O+qD3+z=4Va33zbqkd?h)~&MDGqoRe5VQn*9-8eVzcphmdTGXMD!lZQ`48kzVO5m&`J#^btHRlRc)BX9=m^?r)4d=bO&Hc)Ssye?6 z#>~8MMsksB(ljv{p#Hd!-+2*ISLIhPzpOrFm$W_hw7yeW>+^Mujol?Lp}dfdOSPyN zhVE^u5y458qpT6-Pir;SeU!4gu!bz{qeO7O5fP!U;t?Z!HER_cRt@8^=5K@Sl*R-Gzo zkf}B4yIfxX7VSUPobHDmGE@mM@P@_&_)JG2;0xcbzwPMcZN)f>q1vNy1ZTVi6ch3x-LPuQOI3h|Oi6h9$#l2`p09VK z{8NcL)t|j>J?NS`YhAm|2j`LmIDLc(`GhqL6DKEb)J~o@(ej-Sy3f9s6x+hRJwGnt zm(Jk5cH3W*Z14u(J!jsEtL2b+)ykufjSB&lrK)WrPK&Z>Nc@u6Shu?6-rYtTisltb z*3LWu9>eX45zV%Y&w>&A5sfCkjO1=r!-_0t_d`)tb$l%oV<@3a)i9lNb8`SrSl?qn0whV@-glsX zl3PDn;fa0@_u_t|u@C{_2E69tmeG3dhXv`;8f&`uogBWM(%u`Ijbr)9+SpOlV+xv@ znVB@r&<74*6WFP8Cyy>L{w%D(rrVl=1lSBmrDAigQ|kw!@X`03hZh3FetezF5p=Y~ zqKD}950^Xj^|hU>?LUxb{*iYwi2EWH`Q{V04SG~_RhTzIgARB0ZgR;(Xb4czUbd00 zOk*h7#VpRN$hvBeW>|NV9>=8g0f=?a#1`s9U0eMdL@PD6$Dk4{5s$GCUm!*l5Y>m9 zyRuVGnJf3bkylt02#7lENmy8)1hG$7&CZVHw`M&(>;@naOHwS;tL^VggfoF(+|j`q z2kGRjcww53B^$zJh*z~PHKUkh8Iqf{0cuJ?{v=cWWw+Sm$`Y7H$c+@bk6HpJfcMBu z2H9Dw+cv|M za|I%b08XP=!v2HlnQl#q9px0HAzJ}UIOcwG@n*!p(lE5`&fI~G5`|8$*sR|e+GcNV zxY4>}^9tOuac!KhGQIKbfea&Wj_w8`mq9iPJ58r~_eb7bW|;6?T`IFL@;dOv_JwUCoB4gLe6TNJE~c?^g!Uh|FnLK-Q<3k!{pg$mFArZy6U z%Xp`XJ59AwTy^Z8c3)?VWO~zrrOk6Vz44rqj8%R!Gf;e%ob~9^C=pwHL$h-j1$$_V ze~W8nw!6f2mrr?}*p;N3=W4+kZptK#Zw-{t8flxl-pCQ^7P!l9_hGt9_mw)~O#a7q zv4sMRF&uM*>x!c2;4e?QxA7UI6-bidnxul})1I^Z`I2W9Ddee-{|m_mgQnlC}RVVDYEMM7oCww*#L$s%uOSa z!hiJQd_HrkX_13{wg}%Z4B;2P?;yQ_Q#5oqh@7oepfU z`jufIBG1bF;ycAgv4z&6_UBc5Qg^NfBP>H+lzs>kG5)=4hLrPtg~pyEzWB&5qh6#7 zlT`glr~C_u6s#eAE8@(JV=qUq1CRE;o9gfH)La9pebBsdrz&Dh%m+0eMM_gHbpfr_ zrQ%lq^c*@*=2gUoI5y~@ipdXu(q7j76$QTMb}>WP?~JwoDCPAt6kvuY$eccoWDnC% z2Gl%}y@keO37Iqf1Vrc;Uvvy?wO^6R2a?|10Lw<;&y&jjTmF+$NDTPWz%2O7lsI0O zT-`#xmk`j7UsSkR;ftrnOm<7_K_A>ToC}v1mb|b>;#MJh$&VBnWO4ZlM zv0D*^rPh5hbrPi2(^FLb=2X|uyrYl-yf2S>yVJcJ4g!_Q5#4*?e@Hs@nMsNibWcd; zL>E|TiVOi+dLg5PO^EzCR{iJhzmliF>R+5QUu-y3Y3h#rYvKR-AVUli@WiC{zgP3O z$osESg1VZ_0{AcA`9ELtzYGq}W%|)yG4!vmjc|g>3w1-6U)k$l*LlHl@Jy>ewS`YA2|2LHm-SbEOWfa^kRpEONIJF@f9RYz!-G@c-(5v@ Kg#x)JFaHOmH<}v& diff --git a/modules/manage/assets/images/manage-security/encryption-at-rest-details.png b/modules/manage/assets/images/manage-security/encryption-at-rest-details.png new file mode 100644 index 0000000000000000000000000000000000000000..8cad2a502c1d146b7e1085e5fc7068b792ce5a8f GIT binary patch literal 73639 zcmeGDWmFx@8#NAM!QI{6gS!NG4esvl?gWS6?jGDNSkT}uL4vzG1pdvvxxe?FnNKsH z=d5+s=~LZRUDe(7)ZY8q9ib>MfdGpO3jzXyASEfP3<3f=3<3fM0SyV1WE+2P1p$Gr zu@n(eloAmkR&=sAv$Qb<0g;SIPK8oU9KjsgfBx=*3Pyf|>4jE=CM123F9W3nBL$rw zf(%V-WbXJu4IRaDG_pF9x|LRJA(C1R9q;Y~3dU`lMy;VIkppzc^NQzv*2v4mc=p>b zUUSNQNRUWO3Hpfu43J^;U1`#nE^Nn382A@xArJz^K(sukR&FCT4-aM`Td&v3uI>+c z5s&S=Aq(ApZ~AfxLzBP3Ktc<%#(w@bEAYW4AZjy`Vgwl$n6s~?R_E(gS1OU2f>83~ z>kXoL<`v~O758UcWd8AA_~#*(6C+KR(DQTY z#nXPqW|;ZK+V8N*)RUS#mq>PM&W4RNWMeKJ7dM1w3`n1#45z?u(uT}F4A zCbFr2@XBPqk6z;FFUa3WcS~&i z9K_Lg`T%k&22!?`eTicS9-sv+q>ZIcJCb>2NGVVo5b{bn705FM3fY6MQIO6JroIW| zBTNhpu0%{o526zf%Mu7d5B9+TgBpy&0DKAFN{D|6^e*7fCb0#SL@$j4rVfO9ubcxC ze1PEvSai_60e%oMpJ<>(JWmlEjxc6C!;g?(B>L3YkpWxzmAH1+hgK5|#=7P;Zg4?v=B4P|#?EmZl z-ic%vtk8?~JM#kM1&mMxgfzU2*y{^LpJ-5z9BZYOf(%O2wKc4yDG7~WsLDeEBL3Zlcuh|q$r9=RH6-JAX6_IH?ru?L?XfqkHR zfB0|i2OS@j@3`Ga{$TzHg3)i1@ni?6HZXo65J6vRGZdwkWVqy8#XY34sc4a7zA*k^ zCXH(i(GdS7bwaL3f`~RG6-kcv6^|w|NnA^;f|NaRBK|CKeRO2x@F(}r@np2os-()V zyu|MEc8X_cnh`egca&6Li+65!)^-wicz0URVF%K-q@?n8lowQRX-a93Xoz+#uhgz= zJab-PAGIDi9<8rx%0w$rlErj|#!JQ`x0iJg|Ln7f9x*Lbx*iQl^2Lg8W~ILEZ%MzJ+pW=(sPOD($0?^t146V7#3 zey~or7PDZOU&(isvX<4BSk>45rd#E!^;{eq8Cxo!As;&7n2n;FQQc9k*z)N<16q%LG(SbG>r*oQE= zF!z`*;AyIO)4bBmGC9)Lnfuc}j?auY zXXvtrj}wfkj9ZV_X!KylVt$IM!t`yZZOAf@Fk>G(Y9ZIIr@yApq=%|f{T5WErro67 zm0`=pYj`)f%-_(h$*WlN@wSc;Zd4GMLJOd~6BE*k_jFZTL%;B5V z%~8-a`^L5)ut3LT%@m&Cb#A&&<%>+@pKFw>r%$nAv4Oi0?)T&e)=k;1j-?-b!D~`vo5zM-}acdWla1^%o9UI7FBYY#WgkIxVa% z61d?>t(+lJpIl!Y1g+ShV>Oga93 zfrCNOABHfMv79gorTZucC{N{{`e3%%90tEGkGPH$>e!!Qp26i%)dX?&xo@Xl=a#e< zCzbM{wZd?~h%56e)2Zmgc7?L{En0$F-dYmP^v}4L`cHltw-_Nep)@5#p^2CgThrvx zjB0rLfw@I`Dby@;w|Al>6>p-Bn8YerN|qYSA(dKGGDB1p?0M$dsF=>R3~LJ<1}>!ElD*Xu)QW4` zJ6F71ACKIvjTT)nt+1-;@t=C%!b?aWNu`wDv=*Cg1&#dBUza*2>~wG2?FTxy;3yU- zk}341+lsOL>L1IGO3#l~7VcBHQ*2iQR*6>}tP6(*`FA6CA9qDEKXEjDW~Pm#TesC~ zee@~zHT{D*gL#+|Sg~0VYt?^*Ft2Z=Y;CvTHQzjEIbT)zT$|i-yTUPPJAS)zOL3d) zkNN83-SKwU47nXPO3+H+$(wT$y}W!4cbz(@i`yaX=DWtQ!e2{eq~KntV!W+a)nzK@ zkl1KxqQCXM^4a&!olTp=-d@R)h8qM?5{d7P{cuqmDj3m?z=+UFz{aJuI(b3s7i1HI zC7!K&O9pv`llzEv+ge$Lrp4+zSX&1z26-#%?`%DYfrb>-BaBm{n}gebEDdxIPUOt zA3CqD^eAX(4F~bon@2D!Dh<*Vy19d;y$cZgo$vU@0CU8A>^v)s{Cwr z(7bsvHufP#$5-I|@dEBL>M~XAP4Puyjc!&w{O#gpd&c6|!G-n6@wvV9Mn(79pNUu9 zMU980{`>UvAwhJ1)wkAtv}={g{iR8TAuQis|MDlRyQXXHsg~yr)^2|+XY#BOH4tH_ ztgm1_nQI`5TcCOQzTB4Us`mVrQ*&>DQebZprBCNl&JYF?f*?vVpwQppgT-uEW*KbzQ-ifaE>17SPr?XD~LdsXm!^MypKxZ6Cx76kpp0t?AW z`>YBeST$1(DKj}a5L#dx8U!@l5(EO+0tLRfz!wAr{A(Bp6!41*d`0uX{@V*WoCp5j zHrRU&5MdP&DJkGr#n{Qz)Xv$$-USA>2_I-`!BSPjMMF-O$JpMM(a^-+$du8;*5SPh z2%iTJuxV@RVo2;^Yh&lkc1_HQHqwIgckZ0uy|;9_ZSNBrKdp^?3-3qL98`-%Sd`L~~@9+v;-Om@zH zhXo9f>3t8=M@D9*|FsQN<$EvXQMB|hwb2x{v;{5?a1H_Xj~sme9RL5Z=l`7X|Ej6+ ze`>O^|G(7yzxMpU*Zk~k>Lg-s3!KtL;Q!p2zo-4bcmA!&$Min(|LaQpdzt?!1+KFI zEFaVV?wJ5AebD6_2#64fl&G+(2k43J2Oo5GG$Pp0EoGhHjt*W3ILu#bT|TYoz`c0? zFr6vqS>*R{zQJ^y=$?H=wuBkG==gQk;QPE`ydTqMPHU~7rB_xDX1g_X9`M+*KmUsW# zz5gG2kR*I$|30#RhU5?c^cO16BH?f6N%P>9{lWj&4RDAgVIB~%sDF-quVNbig!jMB z;}hq>&wx^E75y`Apalq6$j7@=ZLh0`I-i`^M=IZ!hv|*nUuU|!BUK@E*?f+_Hii~J zG5+m37!jDCS-dufZ9#XA;C%~kx9c$_0gp$IS!eoesZv(j^bQ)G7dk8!Ekv<=PSRj3 zq3P@d6BQC6Umimy=WMRO!0jzFRV-0qrTW{2tN&@)zn!=^CElch^gLhJrQKEwvisF~ zX7A4Cu?d39;}PF~`E*Al8I{6Vs^|NpG?gb@?%To9=(#N(Zu=J1$HQ(t_0(kj7A14c z{GWtLu;1a*p)~dKiuUW3+>8{mjLBgQb8qgOGrx0_rSWK-{sGREu zKIXUVypw0M?2MdD>J&kgTcKVqip8Xt*C!S=^T+$XOrnKRwKVo%9IL}t9V>#Bqnr1j^PQH^!Mr=dVL6=A$G^I!>tx7Y~f2c{yqSK@SyrK z@#YG-`4Vx2Bd0+ykk60iPlr@-zbn)#gmih`ixl%eO?SATmr3wYR;K3jx=es{ViQmI~5WXJDUDzD3zX4Eu_VfipcGFRuU&eK1GbrQ{w zca#6-dSVj%tL)>pXpn3sBS8#-;B*Nhm8ncB>frT$A{9ENEcQyRCtk5^@`?(t`G>-E zl#Mp$%#w*TvCkE1&P(vJ-&Mlz*u3}PGq}wOF=&-VS7Pv3Gwjwog)>`D^Rn8UqIU2F z?dWlTd?g!osG(D*r@Dv5DA$ZiK^$86^l!ik>rZf4V}&@gCCc|XU81MfY`}SHm-x-c(-_Clc1eQ5 zk((-}#k>E`kMBefFWJJMFkm8)1;E4%@QA3*t97nmuo$zL%LqE|XXZu{MVlh4Feqf& zreDNlLO`XUsQgEh81@Z=cb*_)a8;h>Xe>vIBII$%o5M9=tmdckMO3hxsdx$>o%g?- zI-{(jYByRjoKD{jM0K0^p)4<0DRR5J!=jLeI9B}kkZz!W`5DF6wgeIr;3jcNp>oS6 zau77xtxixkKSCy2Ew>}E+pY&`HCc$ymdc|HrQG1Kz@mA*O{QMj@My_zie4YiQYobu za2Y`$nZb7y2m@1(4RLohlpv^f1I3%bkwJpZ@Jcn3fS02UlaU%xAhAR~)hq&)%CNLB zd+P+8W+?~X&~QV1^1rZ#^xmC#c;Q4UdE_{GkL(mDI=RcOwlAgBC!P)kZSMDk+5FyN zD~-=`_+|^=^u*en_KVX#8c)fj90`>)j_BnB^NIAN<|P8hAu#AeF`@rLjrLF4@hF$< z&rKIWA9}4Z&>6g3Mw7UsmOu^3eEu9IFYy;&UFYJSe1N zBDb2eFftD5YP3J!pmAUKQ7trMu$pPa5$;+k&{Q!z8%d-}ZR^R0b{jGoQBf??_b&#X zXT_9nnqu`gg1^)V(Y{oR{>@*brqE@3Nwkw^Q)NZ|4J$+EOP2=|hp}f)PDHDl9M%k83 zFMfNx@Rem7=}xkb%nes23y0OTz!MHjCEM#Z#_DLLDm+@H)Xep0IF@5vySZS8MmgiQ z&Et5W6($k-ne%wDTx>jpjnszQQIvq!-Ho=Fq9SC4*|#VLi^68|O>jXxz7Pycf-5}O77OtRw3 zVAwH?w;qeiEsd_=rg8%6dvlR5*%;55{C5cjqXK*FBL?5EI{x9VXZ#Rq?6-Cv)cv{2yfg;2-U+tqOcQn6j|eGC z70Oay?|X=c8v&mOAz(o(Y4PuN^{S$Z%e~OKB{qnrRExq!6m=e~i z_dwzIyZJIxJSl{L%U+`I_b7H0OTbTxs&}1IH74MGzMc=WJ*ZqG@Mo-E1PW=YzF6kq zESncyP#DZ=_Kp+w(ldIoMt}B;p~&IP09;a3jc$Rcl;MK-{$_9RY_SZM<;1u2n}gpX zqX~4JpKFv7gCJl?b5AT)zA3M{)}gGTC8QT_dTGI%ZdVUtmx$f zEO!5F--m0<=LH7zNGzuLip8mcz=&wVf3W=~KB#`BMmEx+68IjM(*rY)|Jk=?m%$rL zw#;;)mk^k=-@2*W_?oP0gk()ImvG4zoewTk{7dA zswpkV;vD=AhEnb}zqixsc4HtAbQ|joyES&0MJQo-k;3H+A}$Yri6sFL{6);{vG7m3l5qiA+E0F4xh*w!77QNtL9u$K&d3 z6c*FLR_OJZM&gos`o6&yfuA+iSA*@6@uE({ZAx?iPi2gZb^7&-n`xUvVHeK6t^CAR zqd_~(pZEY8wc>g->NxVX_y;2Fszu|$bTPaIBrOyjmMS3Bb}@wG&Pp0cMa?!=NqJ>z+TudSrfFAs+edrKP7@VHZxiRiXB z)AoO-9})yuwD2e03{HIkEoOVd+mm?-azf@%!tVR#UIG2UpgqstPobg0IlSI#dN&er z`1!Sl{Yo7R4C5TNwtAfo!V@HpIBtp!z5Bs&^qPS*+uPA+YaKF*se7hjCdDt0a8teD z&%Qs1-%+po*{^0LORb?k#|4|^u>xomGT2#O->1eAVzNI^l_Nb<%)VjK^~_xEcUg^M z%a_IyhdU8yE^)?XB)F!ouNx4XWTtUF>Rkz)h^Z7XN z?^ui>z+{7d?B<9?e)Rp|(uj;0t#Fn=4DH8B6C+7_8au+**peS5%}r1Jr- zmj4W8bzu`8Tq32WxIj$T@>kll$z)QDBeOtOq}%zrSn)4uyaAi@)n0k#wq1Prj~8K0 zGgaCxV=7}9@JPl<2DjyL5uY0%`AzV4R$J`lhKRY=dU9|$?Q|TGSH8Q_Wp{aKp2QtA zIR4=&tb9ahq8Et5Vjy24_?bed;II_f)eO)|6)kq&ga1a53Jp;P0aKy|z`P6r+X@f! zg|g2>vnB?G_$(HATqp1ci|R$PoNgSTy(Lh4svY9&EA6IH9+vV(acUkZK^)ck3d=0! z=(mOFOMecRJK{Vh7Ao|Tdt8KS;c|F9gK8Dfq7l{$j3wgGnFfUdjeuuq`nr- z#dLXoq(UxI{1yE5?_FDbA9IAvqTvv(jblJjC{{B+yWLEZcpNSXJo+lH*+ja8Qh|7~ z*)1-c3Hvr3E}sQRmBx43QKNxKxob?uuiH_bwqRptgE4qUEe%9?R+Hcou}YPg~-ueS;)o8*-6Z%ellgsNDM1~+Rc$oD{SL;Ok`x?TR`Q(3ZqT;$1@@hEi zZL|lsS6O1uMj@Y4KcT?AY+#tzsf4F;Pu$8{o2B?FI)&m=VQX6SEtD29Ztl%c5$5O5C< zf4F@5?*0Az`@KM+0Pe#^>o>uS4g-|6R_9#l6sPMDcK}XV{0fmuBK<6_;Hvd5%?V0wiUylMongdDjjdy83$B;he z2)f6L&IZlqyjLIrD(rN-f_o7Fx9-6Ynfgd8y4h(9+#2ySzWqvTprX0Lg|pDf7Jz*s z&D+>x2!ecx7il}!hT;fBFh-M6?61*=;-rY<3D?>sagO54dZfRo&8LugBr|@_%HXuM zLEBiuzK;{EmZU$hN~W8EUmp#FK*;84Y(XT`9%K$5$KzZ{I+of5G)9w64|yILvCVLy zJT9o!fG)?!`r^Gmq+zUCQzv8=fl7wf7+;AEc<0)j_sb-EUnp6~KFE zi+~z+_!Q=R!}_e%qq1HJfiU>+MBo8vrZ^rs$rGw54`(O=kr?GG@$2JxkJo$B=!_mt z+AvD>$RH-KeFGs~!@Tz=XbLyN;LqBb5mt9w$<}QC)2J{=JD!XD@C5&IJQZ7mIfJCP4J5nM3ljhgK`6U4ys^q zixl4=XaW5bvSO$>@iWACdx+YNmQTgBsBN$j5Y@UJ(olEjg`=M<;b!aC`DfaDS6vsP z5AlZ!3E6Gu0zN??kZjYd^l5@dJe49qb(AekT8-?&vy(oB2Rqe@XXDj zhW3tj6Ww0Bqo%X7m%fJEut&@^8`Lq2Ex&5tGyz z4RJ);G$#oiiS!_lyR@K!MF$|u{mg5$oW%*>Yf(UDON+VP%#D1_cm`A*QWGtyP%Vy3UmxfBEt;ilk42?YqfuT@4$-pkc!v!t0s#0PFuhA!Qx@9T?UV21D+jGz0715E|P9a+%PaEXA5FRg1 zNdutykhu130)s-yxq4f8RkG6+P=F+YN>Ss#^&)$aLIb?&UKQiC?fvHwO@r`iBjBkwSK5&lb3)CS- zZ}H1QRp!mpt+m29ptX{0Z?2+r?F*jh zdwF!`IE?vr+F8L_D{5dV5wbbkvjY7ohJ&}+p3}cnoPWh&19!`umgZf+FnAZ`BV3rp zQ_eM}3l&=xNvK_~irCz4sEvID{reBPK0N+@^*K7Oi+?*kniuRm$))`4)RwyRu|PS5 znS@3P3=5Ynue(3htSV!k+OqFqu2fw?!I;#7g?S{My`hu`eP=vf_sIGhTMvZ=yA@#C zFk1sD2vbUAp;U`~AILo#)c^Qs@1sS3H?v{xLah#^(cFSiZE<6eK0pn(S}ZebVCM2U zARdUri>mlsAz7|MnHVsuX11^E``ldhLB?SB%Sxja$?b3%NMAv*NgZi@YcKa`pkoEP z6pdq$2fDxwQ_yY3e5GR5`|2ae1@>A$UTFUo_^w8_yIdBCF4%8WBTz_vO@hT@c#`YU zE;U1_*r-Kex1OH)`B)^Mn9}ZYET77x`_;#Vzr(%w3ksQXuz1Y4-NPcuya#n|agB#up`1lPX!h7J#G{k}q(onwToIj~&K^&)`@kG!? zR6c>nvahu+1fo^a5uII&tuWmWiW%(wYz<+P?%*P_XOV1^37*9}7C(u>8?iuHl<{&~ z<(4*?d>0;jXM%v&Vm(W9F5ekTI-WRx40#5&-h&emY-dWYB?ZAT7RwR{e`oh3v6zq0 z)*+qR!!S+g@psI!#wJ7Wg`^U0k;`W>=Tz%=i$|bRlq}e;DrIpwihbZobM7Z8Y(=U3 zNL5-@en|dDcCJimIEED_U^IzN!cv*Muu7X_m040m3x~}FJDKU2a;)CsT!qNW%YX*X^=Crf>;5b|I&=VROT3^9Ft9Q2jb%{K z>J`D!>dYleCp#5h7Dh!D@MlAmBy(T&1=~-|IY@!q3ZZ=1M84nhntI ztAoIJWGrV~0hce#lIKUoXm2#TY8hehxI)8ch(7Q^E?>~a6f{ijkX844s$~|>LIRfV z&^hh+j+WZ!VsJlZ#Xm{n6!Cuob&uUh0N_Uz$tD#><)86@5nG*Z`N)JDbeD*9w0bW= zuLs46%l*CaOl7y@6p2^%r5hG=NeS?$TMTw=J^A-!%&Iohg)-qs8|q~GL&`A}t5%)m zh8erqBcyWI@rut$>?)96!xhWV_vh20*ZalZK)x;XBS~wW!T|y+;!+Wi7h7V>W%b6~ z-Fk5{kTfuIHk)iLAA-^Q0r1ADuVPWM-dNbY*k-1PoiAt3MrsNKZ6ITW9CcRgR%v6? z7V6(bVIn7HcJ6Ffiw=PFQPB3`Y-uzl3&(|k(?h(bT5$nylUa#p1jV-C^1@273Y6L+ zW>TAH==3z1geU?IuRMOb4BX&%^Ef*e#xqAyRv#aqPw`o)47#6oN7du^)EV`+29$VU zQOUn7^ZSOu8`VIZt_rj!0WO$cyFF>i%OE^N%esHhmZO5<9GQUMihS+g{163B`=b4d zG?1BWISkYI0)Vs9Wmfa4#`K1A#RO7iBz9`2q0@DL#i9y~%Ed4J13zH4MU779iYptP zYZMa(V{vgm#bagJtrl1^NjgBVH9{kkcL&b&>PUO_ zLWkefysq~UTFONwAKC%QsT@ot*sIxTzCw=&RJY6P^Ge4L1p|T^K5>wpQ+-r-0@cR8>8dEh1^uoAHTglekhk^4iQ&>mBl{>p- z*-CCF2TI&7uD6Q4TM#o$MUs*m$y`CGdpDMs9HAw|(sN}Y@JD(m zMIGWX8IdaR)uD}|f1nUcK83U3enL04~{l7VXg|mz2bH_$CyYMnR`G z3WpL)IRVY2N7oxj=5jEF9(JlaVe$Hl`$}2whv!B#1CjwI*I?ArFmjPay$;rg8FXvCm@yk@0?tcWW^?#8iOF5wv8cDLm&?(n7&e(Uq5(;DSaD6$ z)@i|QVH*O5k6gk8qLzvoc}cUuY}`!WG-uT~$}{*I&P<``-Ei#d%!nF#;}8cr*LQyvpfk$+v^)!r5E}+ga4#_|b@yQypH% zrfLas=ZR2@y?53&wwn}PTWjl=)9K2tSdZQb?b?aK_MU*zh})A z%GGoI*bJtSuY*&wry)1uk9?#}eV#RNKI*j8lck{u`81e`h8vw5;~`p?8>O^H|}b83*eRG zlQ&`DK8d>o-<{oZ$){1*q2qi_!6*b!LWHwQ#~p#i%-mr;$d&XJ`{3OXujAJu7Rr^L zSLnk9p1u5FD46^6L@!H|N0mY~hCbFHSi)utF6+mzfDf2fu{ovogR=s_6hihuxxj*K z^IOx>>ryD)SPlgDUJ<(Z27zHZDIxjc0{&N{A^7d_Z02Ar4uk7pE^cm@G#-1Ig2o?( zT%J%K_m^BHh7F~{tMxvewt=6>W8ksWd3y}n5#uP{C(U-tq!ToWONAKP^g<(FOXC?( z9FUiXqJJMG^edmO<>r%#M+8e8V-k*eAnG%j499P2!ZCf`4i>G*Ys;OlS#YciCFa&A z`dVsTx3y=~yE6ESJ>$?F82m#CYC-~Fy=aFG+Ntt$Wq!JdAv*C#b5&Gp1$F2tG|rgi zP}d=_?WPTs93p+rY@U%xY(@`?j*7j`M+%o-{&~KOq$+bnTxGyFiTsF2%xve;zU3bH0Rxk$6>{!YpgdJP zMessvBApKF&!9Ki@2qXSzAfvE9?&gn)n9O~-S&eE|6Je)WZ(ivq)I1--CE+ZHUlti zx-&EiMzcw{HdVO2AFei98%FcDf?325>9!>Te?Vp+t(vbw!eEZ-8NL9+ibfO$BfiR$^VysQRu00}OH_R*2+F^yOxdOZciBuvF5aO4*W z`W5azXpUVq+m#u!JIXNii;84A(Oa8nINsAFDrGYnfNpxybX{MkOYzj#foi4e zO@+xUYr`HmXR2?`ImYP<+eFoDljKS#6<^SDwnWja@hsKn2$|;TYVSb(lzG}6dk12~ zCxI=@4&Pzc>hSx7iDtb+kW~Z>%}rFX#n>>!v95G#`4_W$89M?L#dBR}WsCh^ZR-IF z?2R_~CJyGU%vgv&h5_vhe1qjrj#Ak(i2;do?SI(Wn>gU+@+ZR$*zO(l3hvUFEmp8c z%clZiDi`@DZ*tKOn6R$GeQ&(Bf!X=4H0hCSGRgDk=?WeH=feu@`2vUmJr8p(6Mv5Z zjRguo!Zn!wy2g;P0n&(rotrVC`8Q+S^IouteEi|ROf=bhN_kslmixaPGuL|ozERg- zC!3IgD4+=$_*n6n|0^m6f=B=b0V3b9{-!;lqXFItAFUv_{|)Hodo0;}FL3yB`=9?U z5apc~UzQ(c{g;-;2MRzD>-7Fw(1@9V(XucLuxB^?GuB9?IY`sx^Ei{0tG=B^aPvMO zKWK=TG2*w^XM3yZZ!i>6o1aF|sES(a3RI4Eq%5y~zGK%@SFM0 z&aVovmMRo-eJmWI@=B7tv3_9QQLD!Wbn_Jz{a@}Yb2RUix6!g6QsLH8nIhG3rP=PV z{0y)n?733L6783-Q}?j9yPwJ`k%pnkvKC2+C6I*_@5$l)lv%Ub*WUmQJOzwuJ9=n8 zqU08k(!M6A04Voz`$rKl8#SU1#|~9gTZIIqQzwo|wKU*S8*}`IKG5#diXf&@y`?;NsLMDe#XiBHUjD5aJg;i*f z1M+mflt?aJAkk{RT!y#BzO>%1_+YKWUA)Q1m@r-%6@V`Pumo25z7QA@x)i4CIrr(l z4>v!Vy0OQz{5Z?BGXWwb`5wNKD;KAq3+@n zicbInH0tG>pS27S=kozqkXOc&%3!P8nwQJz9s!Tr5qwN0SA?H&804U(B9I$|iHZOm zZ@6N6_up_>spVE&_P7zf?v6yr#N(Q1z^m^G1@ea`^`>(EKpm2?-f7KOE;ml2y-T`v z$QNkAS^U-|%mIvRUQ_XgWMx9VL8<_tc|yPzZM)ua{X(v12juJ<%8&neBOT3FmTHD2 zKMU#o?nq^jJ6&l6Q13oWBDaTu;O+Tr=6a`}9N->Ij?3o>mPVUVTb`jP_SsnH-}8__ zBq}J0!HYzPI|R3lCFHhQSS8vS&CaY)tCa5-k1l}4phGE&m%(CMVgpwJ9Blma-*m&_ z%`9gF6m+66uqfM2uPHMt0G(A?Y0-$o^o}YViJ*ug3QH-ye%E4UY+1F{LTNOUi3kCg zC0eW5PQ=^oykNdkO}ZtU*KL?zzw0TSdn{smsOV%TV%rShWRqp;lV_^mzv0bSeHIzy zr0wd%dc(+n!|JfjlTX;iUzv9g34AV$po772%Tqg7-U z7=mJ&=ze{Qsy81IWz`Tn+Ct5p$mW$0gWW3ygmvlFICN?@4K%7n*d0mQmbCi$L6S_ZOy1J*%p}Fq*v=FBxtXBg3> z;TvIWsx`u73b(FD^QrZxtIeaFX`GmJ25OLNot`SAK!l?Zt1UMhNz=n5tc4;1+^$w? zm84OyYz|=zM?F&jR+B1ME-tYiW9uFX z`Tfr2;;HjvZ)5eYw+?!PpOg5#5gQISZ1$^^DmkhEdi$+;8#up`s98H;UtnL|GB{sf zd%^o!2mBYk|=3JhV zabbi{e+d+f%T$10-x3K8gMk@1We$zAS!VMcRTvw#ps>#~ZMq;Pq&S`e0zP{5o*1M< zcDF@DnGH$XXL|jVcfaW^9tWxUk`c89lmkC*@_$J)1YPC6WAlcXZd;&-o$Z$LDl9qi&=<6bvPSQ|qRMg-069VXZ z{>nGXw;ykvg%nYkb!xxA(7R1!^NYx3u$TTW9Q0U}`-i#lioYwm{FTl4+~N-(YT$8L zm84Ttz1+@eD_`yic$D({Lc8!$kCY`n8_Z;}l5ugvp$UT+SIWhD4?2xw53I`qNTdQB zg{mwmnEP8DwX)akJlS+@Npd}g9 zT2txoqqM)3&P_(Ik;8ZIFx*=JR%=1k`<~0nP9-HV-EMY|K_mGsCod(8?Onjp#9v~Y`zN3pB3~p%&W9Ffdf%Tt zEf=EFvIJjjt=D-oAz-tGRO@!pYKsyddKCM4Uv4oO#>ZcgibhlCzUM^3vw6QIElgSpd0eDZimNufWt#JX6y}GmQIq`k=(L{{_uCVud^Crc!E7WW29q&OqBhEi zPIk9qo!6gSGF~yP-RbbB8-(#mWo`?vke9Rg-6}lH+? zY)YDV3^t=IH{dbSA4nUIx&+1in8tdxL5ES=6z2$UUV5g>GkbK4M-2#n;&tQhZC7Wc zRa=ij3_8)aJ%G8e)^huVTzo8zr3KI#B1a7Rc4*iPe`x^X#l(|U8vvMmaslsP5WP+- zH6Y*R048}c0v^{plurqy;svWMcA2(@DxJW}P0_p*krx?42CH`C01FD<7lm6P+i4z;qnX;w`$C~Io7I-hRP+SGjTm}N6VL3&t#UT>6qa}v$TigeJmX#tHroH37AQzQun?8oFAv9;Np?y+Uz>NTsx z@DR~0tTJjJ3wX_xS>ieU4XC0wMFvCjiN{@^^u4t@923iwvk~Gpsw74_XZE)jOi$;7p3$$b6K)g}J?UpdG&jTA^&4PbMUOP7Vz* z47S`>=@OUg%jvY$=Epbxwm2Yzhk9{kDpMYbR3vdDmqS`y1{)}1xgG^G2>*V zDNAJP`-H$;JnHbfAMMVL)Ci&3$iTXPr@R>+P8$o8QIjzhQXD{kCG?v0wX+jO&iE2b zMwt=Tms|DFqq$UAj>bp7nmRn;Y8Cp-%-7_N)UJ8~epNAM+08dIFF3U@dx)}0} z1Ev7Ur(r@KYkx_scu7P3;L!_jlFiUl(l1&eJ)q8eOfDY&Jp&!7Jj}4Yfv}&L{bGkv znwO-5Hz8wlu*iP^Z=CSlN)Hr3Y4c4jPC;xN{_cyKQW+{vkXYR*>h}00#*?C9Ewc^hVsMPl89< z0$l7Lnzg4Mfz&ZT1*wr0VOSLTD6@+Im6j|Ib?5$%5BTxg4!j3-jy&V_ zm+2Crg2oIyi3qrLS&D70eloax;a-<7`;>gN-aHK%8Q>3)))~R+xjKML_bfv5MQANq zZs-%)xoMSRL<$MLTe0)v=N;cA*Gw^k@uSZ`a+R(^qg*;*;$vP-@MXgC&>uR~y61g_ zZqMtC>mJCa5r!zf?++oc7^4!YPIH9Y-=Cke`(F+FL!HyS?*K;YGd_h5*yu9-u$Xl6 zH0q3%(wGg4Uk0MEZZ7+wq+SVGOe7V!?exF<^xj{?k<`?&Na9i7{sVM5Aq0G%M1glQ zN_R$7(pub(_YgjzUIdf`d`BGg2i_j2vFk@+)MuUA@PCt=r&TZd{s&6=3Z16-m`J@^ z5zsQJ4f{mr!hd#=nV$~D;K*60KWf8V|Jl#=w-`8by|LaIR(1s}vbd~P5ZS!mVK}$2;QvO4q``3y0=HJ!HWDZqgTBirsAz7fJ5B&Ala7EIfbigp?#9ZwnU z^{%S~Vg%Z1w@giwg&%GY#U%kcBdx}8e~#yE936z^&UAk`8xZwj@i^$`tF;yEu1jlXJ*@vpS;-FtPnlZp2k>%Ai5CLyG@zRu z>|AcER?6!FFN1BA2+HSG^kW0b`=s{HM_9$MXq;W_qfUUjD<_(b(`eK()oe?l4XV5Y zQ6PIT1NcJS8;u^7fxI*62L#-ttG%BJ+)jI6d5(!XPg?BOMcJ(vQNk`adwsRqY;b<# zMJ)VmQ;&b->fgnXDFje-$@WkztlEgi(L^>C(*0wfg9CpV&HhA=l<}Yf8`Im%GAk~- z8yEp!t^QLchCJf;=0Baw4dqTvOtD%3e9Q+6g-!oT$_Nf0V{W43wzk5a#G%X6=3hAW z@Vc9-PiUUIll+@>wegF@5!Wl&o#5wXRY@&3q1Y}$*gjAd1i5XQDt?i62X!6 zd|xZ~FFmZci-;qQob9{X0X??Y;iBCnxjK}9kl%O9USA69%RgRqo~x*dsSL9I!H8oW3t)8NAyjJpVFv`TZ2~V1YbK>k zUj)?abTh+E&T1`(3FN?XVaJ;6{M_n1hLJuq@Sj8e^&5`COgy=Io7GVHd`a@LtBH)& zxhn0Savb{8RR%A=jxRMdYSRccvn$pHVHq?UPLWgQlL4u182B1shm|pz#X(9j-p7gN zN1;?KUcJ+o^Bs4&;{fbA^*#t5C*Nc;OAg3}81Aaj>eTEyr<5pHZk;7m4K;hcwahwI zId5a^jU}vF#wA>QEKL)7DO69Sb4RRPMh)Phb2{u#NWDSA>Q|(%klo*~oI(PZNg^)V z*EDt`hRT+|vh|qE%a@n~lRGa)e*jBL4yZ2}p)df6s!rGf&(Fn-60vFcSCf$h+H5%6 z4H=)W|4b{0L=?TE|IFuL^`O#f z3*M(urK0ux?a@0y2k4Z--$#r?tkKFmmnOTWm1rlp?@zqI43VYs2eta|RCcr6!lxz4 z3HzE%;?Fk4^zmKV7(LazJrs1c)d}icosh&x0%>LZ_@=YrU&)kWfrASBOlEg@3WXZ< zt&9W;N6et6)1`)pz$nZevDk*rb*aRL?dHB(TKKA)W(Q+=2q!^?{8L5~>6=_qY@uL; z={6F&COtiWwHjl_lhf~2x+y%)@a=}(`{(~S=Bg!F6i)s$*zNQiyzE+Z(u?lowm;wI zC0FZ*VCn(pp5j6|az?Z5aGZ1W^m^q6807bYhR*tr$&{Tnw%THmMVhkIVagBJS2vv% z9mK~N#LIEzNSK4k8wm!`{-~@jfB0C;d|Xy*R(V%UxSUYG)cI^dOBs!3%i{DN?x6k$ zz}5*jcY8fV)M|B`=N#mdQyzB}8J1ttCY1vGp$_+t^;+aZ)3O^*w57W;hx&$>w1VLc z;9p`3#1(RSgvLv1Jw8;KBn^CevZr!-hq(UmvFDaBn_sF@510Q|Q_~fUKpmH3loJ^U zdAXny<=laxs=hzr8A^vCI+ST+t)6+RH8BI6w(WWMfPzu27kKqjt4OV|1cZ7@RB4mR zbUmvsSYMJV)hnbK_;9pim&uyiaXM~};eL68U)mXpMsIYARPk#`mBB+`e=%_3O68~ zY*<0|t4xEG{TcE*uB^G&V*-T=A~`DM7+bCJG*E&SjF4|CqD-LJ6W)5_L4o3V23iwg zo*>r4DYb@sxFQ(7&%i`@0GUu&@_44a^$mF!`*;sdqhV%00?Q1z)xoct<^Xpcm#9BB zejsfICI~J}U!jru_6cJ01W}5o|4y9~)n(idv-gam(H@yN-TvVk$quKA*y1uNXu8rY zD};{{@Q2bGJ_dtGb*L^d!p}+!%L0FwLNQ=N{8V; zy6~Z?6Tj@Zc>(jJe@5rY1!6^V%?t&m%&ibX#!3H-%1T)*eSx|H;#a7DtX{0t$wzmm z)8p8{)tNZgC_@|bCx;({DVwMLW6%J1(%01i8rNhFm`&+D4sfQ|&)R=#33TvS5{UuY zJ|4>kOJ0gDP%dT5C}#vBT6eSFWlQd9(qjIN!Zs8T^W|$4id0;{K+bSYpD+EV4W0kT0=S?f1C%oXEBe9xhLFoN&!2j8MAwgv%N!j} zM}z)Ifo=hCmILcGk=(uzBPf%mKBIlGdaAjFPgj|UIgfD#U7Gs-=4#SmN$%lvT?mCj zsRrYh^jeettQOtI)64Q-KNeCw*J^N)3P8|`O1uW*fjq(Z`6nSHt0#n>kL@alL89QG z7MVO$Y%|vb6&6g+->esUY63uI+bCp4*(QtFLYduV7u{;DCvaCf&Xum=JhtF#m1+aGX9-|1G@QRQ5k z1kiUdXd25U+qp<$X1_~b#D87l2oZ3;VfS6{Z>r4hiQ?|H`mOd)NIqhyhR!-7F<6%d zT@;5@l`DAlnQWe^?;h8J$xNC>TM!UQ$G?l^gSCD{@^q`!gZh@Jd_o~Qw7|2=F~`CH zyS-H*;oJG`WRQ0s4x8;Ioolz=K2Rmso19SG)gF*iG*d7cyS@*+jPzCf6}%y!M3IOl z_WhTD9bXKKL96_&{r}lv%Prd!z)hc3(=@ao1K?#C-?Ry6dVTX#}26s zid8D1Cf?yD7slyaJw8L%RVRgm!n?l|7&n)EL#Aqa3Z%0LaJ&XH9r0@1d{yVodWTs28^GjNh_}c zsy&(d%%w^>Kv63AA3}s~?N~fF^&3#L0*A~_98at9av|XIyiz|6Ubyjtgpan^0-cNE zGSOSDL;5}E>R^mUOH8N!r@?IYt8e@Dz?pl^AQUA$-PG18D!e-x=X!(X205kdiK_O` z9g%=`f#d#T6mj)JC;(3vjc_$#S0_7=P|dtqn9Y+S?<-^CX9qm5?gVZL9nE$uI4wyd z_BMJxp09ah*)`O1hNSbW5x~!5yrMlJzER}&oumk~FaL^K{g*Iv*!VV2K03D~|V@e&0bd)0;jY!FMT^Dfdx-Z=08!o?hL z{!CD6ju@i{L_X${Rjlss`9VV9np^MB3x{Wor*JJdwYo|`h(8xqO{gx60St$}jIQBc z*&NUD4866Xn7qdjwr#hj2FCqhH#*uP_;v!iqe`PlblRE9PIkk{qS`?Shs#K|T%Go> zaQ)4QB_>%2=>ed=Y}+fzj7+{=Q?z4<2IZ;^g83q%Mep1Fp?rM7r?L@BiNUIJ)$&G& zg*oWKEW2wjRMu z@}><2v9xagYajeU1gXX0uw!`Z@oDcQ1vL;f{2ATJAPO7YRewohH506Y_5wdd0Tyn0 znf)bqL=cNE18A3TP2~?rrOucxO!vk?S+6oK`;9==8ve4kr!#t%G+(RgSV98I6}_dw zbf=!m!J3-e4j?NHOr9%>a(l*;F$&mro08z5H=JIl$%1`zT(Vg%)$zIHvovr6i^8pY#T#*5(dc!t}d<@5vWXw%T{KsfvP6}YzHdZ2%k#UT80 z(xZF{6wcwSE#I3+WOSbfF6$D%s0@5kFfX$2gT8){zjqvi=!dZ4;Ae!y8^s5Ur9vVfYbPKo ziGg9tz&(kPpTW@b?0Bs_sFnnN)W)vLj?V87LHI}NL&Qs9*I~3Kjw?-j?nbL~+)`bz z09VwkI=&rULsz@OKnR^vutPUyKJ1Cj#t7aUocPaAFwi>;_<-$hMIg56u0<>ilj&Ta!qV`E{`tGB z6p?EtvqPXEiTy7cg3ztm`oW7CBKvr<*gYs%SpTLuPxm)zHix~$Kl>JHxk5eL1(Yf< zjQr~w-~u`g_7VPVHx)Pr`Y=C{unEZ|0Q*7CaHgfclo$&ppVtqYD-9>Tmc4^4$tc+H#&uhKWISLvzxohlbHks{qw+!>c+e(e=k5ytW zdF&i`SHuW#=%MnZ98ZmE72_S-cz|`pBrT|YS(js>OLMBoWP%0pA2GI_s<00#&J2Eryb8*xvvNLHR7Ou<2^s71`t6!t>WJlq{KO6o^R> z`3gSK9LLi`#GSc~4yFEM8`)#t&v~#70f|_GX76nq0=Ny&cn^-CpM#5GZH(u{M2`T)$$KwH5DRE)i1jTf&P+@T#$%rO4(}SY_ z?l3UL&znDCNikSr0ll$UZGm96nvS)%V}L-&*In8Uw?L!R_BB^57o=pH)Q?biBvQiN z)&~0_0^HU^Q8*f;n2}g*mfK=d4lss8SPhp%f$X67`zr?Usid2POY8PTYqpoNtmJ8( zvf6>~jJL`1A-PYbDpBq|@y6apR^j>l+9c*UU2As_Vs|<+zDe&gM3i|!T;ZtFRUxR?Io_cn)7&q>Mm_)|}`yfid zd;1~vQv&!}dqi|CTJBvA3q>DHiMyn55Qt*e?o$JBu3t0Y4buSGNW2C~t(IN&1%JOb zA$uVJ`F4L?!uyySl%R(nc z|Lo8DbzHs?UG}p-e_#O)5W8in%@j(8mGVmx^pN@QwGS)(u7G+A=yq4KY5x_8zZ{AF zOYpRyYIT1oW!5ZG{G}sVr)177AN^Rd?=BM%#;d==(lV>NpPKQ=1H5B_3?OVr##H<$vr8si=zK;6Le5{|M2&Nw_~p?LRP zw;$n91e> z7MCQP_Ck%e6TTHgM)H4!fI*e~)O0JKnywl3SUjFW$k}=$Cm>xD2dCL~1?U#XvYupf zV_bOqKQB~u=Z=ZfPzCV8S+XKvOwgc1f|Jx*9_cqkac768PvQ9I-$|g-BJcY-j6HF= zHye*;f)%bWNDz+VindWM89xWwiDlvY6%3dJb=?3=gPIHoSZtUd2#TeuyQ*CFp1*Pz z%N2cZF>%Y4J})S2A0W{*JG3QW1{75l+l{HQS~Fz+!e7i_C=^Z&%HR^WNc;Lj3;8-M zG3vY5YIqAkrXb@y`)AGqHHjndeqFrh&Zdnwib#H?p)ozbg4hCYvMzP{N|e6N>Bip0?{D58A%AT1%4E%-~3!e5!Rs zVySb*T8pL+^&6OFuNH{2_n&L)I6jCl_@uZ?k=JQW}_2qz#=t+EUR6gmPi%emk>Ya^=-0xO} z)sgN$kBJ>t;HgYyG6k-s5ZIa>ko>xk;9=;jhRK~9kqn~VL5h%ypCi4^RUwcGs?P$= ze9^|aq~|Y2K}6qu5Dl)^w0OQ}mR$Bsz?1{hpk2;Be>z>N3EIbixfiI`iio+pUPc81V}YmxqC&2If&JNTP_8u0OXdDF_fbfy>eFbD=9`guL@PTSJEPqKg==-`>>;AC# z`$|cp$tlT}T5=ePG#jX;%JC<$esUCKusl4Oo1Febn%jgF0@6A)N@2#aI0aaR(rS%% zFpj5dO50~|m~8ghzO@e*Ttpo@*{O9#HA`z6<-*i0b}u+*Jiq-X(mRQSEt+B||5KaH zhI)km!gJ=w>3xrFw2#+4&YDd_rt|)qXS_gURo2?-!*1|!1_<-7zRxT!0SdTMZD== zCtYh~{yhsMSk2zs*k*9>bEB7LGZ7N>KZ!sY52*OD-X{%bWYXzPGq9>uMrBSHD}eK> zVL2xh|4xn#>q;upJGf4A!aPm?OJu1?{Va?E4VF>k{`59^zEAwWbKMSsE*T_4pm0L$ z`{@B=YkN}J_?F97go~OiVTZ1n6@<2q?5q9e9YNZqquf!Box1MzmIt<0$@__N0qRpdNT~r33xCq zYpS?#_S5Z@`Q0);J8%G@h}eHNRjHKB;xDX!*-CapxrV&XgybJngeq@%%qg8*h-AP3M9G@kWK?5R7dz4%+I`- zTyEEOme~==G)$k^p8AU^IU@EY<+NWm-Eu_2Lu9={@Q5UAo(tF|ip}5lhEudqVUjA> z5kkJFB`Od}Nb0fC?Ce>vCx9Rrc*v{8piEZ57r($@1L>z4YXUa>l71B9%;4wu*C(A=Y-DJD7Kb{IDPm)7 z*;i6PnEq*NdMV2#d=n3d#7VHfmMmFC9Z*Ym3*i>WTW=&XQ=$w|O&l=`nL6+y0Jp z$rOfVO-zUHSii9A4a5*#!hwilG6TOBeys33&|X zQpY-^aD?JH?h-lR^YC_aFlkkSkTN**Vyd9W#>Z3F{W5X6nN*$06*uLY`1e;(@VWt9 zPbA1`Bimy$Uoh2e`d}9%{^KdM%l41tAsJXCme8(_D$2}e+YoWvg~I@teThF>ghJnl z3IL4I2qd}u6sjFWIr!16c$Jv%7JkFFxpWD%qX8TZ7{-n;6mB;*3&4M5s9=UgVlZDV zEQtA%{z^VRtkiwmRoAtKSn(|!$B?chIHto=Fal|rkepP0N>>AdQzy^v8!9FKTPUAy zUvvpQDcE-p0Sf9qI|#n2xCyN)(cB{ziBLa94;gdBh`2sZ%F^@F=X=eSr@60ZNFIMmU)K_(}XQe?zzej z-xRQL6(gi%?#vhSD=goOWgF`9{c7%eIZRIvW71h$(C^NdGrTU=BLx0&#gSZklc|+K z!LZJcJ!IC?j`0$!fhl)Rpy@;vgrQBBVa$#h69&QM)mYM$YUXe@Qu9OH>?7%I0&C;U z{_gOPwNB;i75Kw?7o+u-2S}HzBqODx73R_-?#{Vd@5p-`5=-<~*b1-9mETvv8iJV3Iv{t<^Dx5EdF>tm4V?8kUSW%-@z zzBq&;`Y9}_T1KkI;NzPXO-}FQ&QQx{^CxLV7vFr`+02%280i0yMC?luf`RV1qP78Ya+J{4^te z)PjBgqXu)q!%7f|L!bU8&@vUid;{f*ZQ`Fs!7qaW?}&yzvIX?a27_jY5I6l<)-Gt}z%utW`O!vRJTTYX1}A^Kh{$VYfYiVxt_-_m2aJ zhfv&S^rC)e z`{Rmqe(^IU{V1eVYAe!Z06@@c0b7H92^x9Nj{SP3K<^ej(A;vP%Nx@pd#1h+7<X)eJ)~bfrv8q(`Cd8Sw9-JP zb%hJ@1%{{eMY^6Hqj@7*WZ9f8Eg})2&xa~m?0Ho^`{o<`(On}VD!+>RJEeLr+wT35 z`3E)#9Y9cEh&-|qgg@K{m!H8O})+tu;#8R1RYopxr-3GsMVpGw7{zoze6ujiu9BgwvkL=mOdfgx< z+tp^1tRj+3E>DVX=LoOIOdxcR-bpBORpqIE5-m~zVEbavA)Nw?EMb@j>KbMZgf`s; zK_;xeqEKkY|2W3U_bgKa%ExyEoSSguwyTNMZ6B;LqAZ8A_3koxrF7UV+D({dwPW8% zA=mE$z{dTDXNe#Q1BasN8JR8C{*+WN40Ge(0GJf0U+v8>sA*?g?(|`ejooX8GSSvK zS2ajP`xs?T0e-S;O;@JpuR{CoP#0-gOJjcho`PNnUG#K-dB$Wv=E63}DjPn|t zY|1FH8;JQE?!|{!!SvBkwbINxTyPpeIlCkvwb3IWbgtp;W6anEav=1l2DZO#hE0aY zI9@r+*MIdY;Idu1uW7muu)%iisiYMlQH(V-AnEmdY{|)lpvsY#;Eaxa*b($olcjEX z831E(0}IrpT42P-gd|;hz5OLEWA%L4ik|>&rWv8j`qc+t*F#k19u`Rw;sTz|!EcjwM|8$*1jf`QZlF5uu*w_L zJ*!fuQ@l{M^wvGfdanH7A~ySx{)Jm}i)(F1RoCYmMsjzG$<1Fl#cFw!o!D!w+Zf0-WTUk6tINoTU^%}z{1TV|i5P=>_q0VSH{{04#hmfkXBgyaV)<4YeOk8*uD zSe8NuKnntR>#h<t3 z4f-KxYyiCQSy~P1NqPM8>LngVPc_u9#dk1B2`o`>JWJZqINB^ToqpdI-W>kA3}SQl z5uNO8Q5R9d`Vcf^HkUEFwyagsTT1r_0}f2fT$E+BJcT4{B(d?9pF}Q~2>QO)!!93= zSl%&sA17&3CqTlKcT>2lkq=}O9GyW?bbXLhe(akpSfm~#v!B;H8!O7bXSc1Fj~Wpg z$0a)L3jp61&%poJ71Lk%a_cdJ_Dgi>4p#Up;}1|Typm)tzO&$aUFk?B(S>`!2SuYs z&8KsD<;ZI~ZF2U@Amy`F=O>e){MR|CF@#M8<)wFnF*j?m{O$(0N9+6#LeI7L55x45 zQn~}t=Wu42$9nFxYFXiTI(2f;*PXmtmBoP0e)k2L3&rK}h;JVPfRaDvHwBbq)Qeq0 zM z;J^vp&m zxp?nuQ?uRMbJw=VOn(#P==w?g6=EN}3Hp4Q=2c>*grU_o)@YJhn9k3xn?j#d2hBE9 zA8kMF2F)2ZS(!_sq$1nuzgbLrZL!*uaY!Q!xcVS*rdH`HI)x8B(!P=x%)8eI2)0oE zf*>Il3CFi->qQMsiWxS06!Uc^ST7L!?-TMTF)6LRGwTQv2skYt+-5UH9m-FipigQH z4qcoeF5w$%AYNCmUN049Y(7EDr}l6lzp4^>XVg=qgX{8$n2=RH(*SISq3IBrI{2bN z9d=lpH0{c$pr|(2S&6!CzzJ5aUe7NK->D!mJSLM_p5FzO3CRYQWO+o)g-380-Qqc) zFa6wRV*^KyI}+5XH${rXVt${j%j!t%d+EKNkEbz8Jn{h#Me*VZ6r+9Qvk5-?PtQ1M zRb50kXk^)yvoBf6_xe&70S-?NP^{q6@Zd`;RAH$if(5CXJqQ7=qoxHS9Pg&(fuj+gpIx-nB;D?B;>zp#4$jOqTS*(; z-VdqXi#7ouk4kFE5REuQKNK!2K@$c4CFqX;aMk}9dFuVn^PUZ-#~C%VM;s{cyyg_9 zT@xsn_5b@)kk%z#GxfH!IIh1UW zHciyj|GyuBzlk8~4vy_7`ND3?_J6N|_xTDuc8 z-thUd8GO)4zQ4WVc53$jIWW9Wok$n`P+cWh64>Xde;zjoiuG#>JY~Pp@c-U~^JNfk zwgX-h{(r~)NwA4-$XRfb zH1F4|pjVIGU{6Zh$RwZM5hGb5Hs~gN@(lAFEZ2z)z^n-!u=AinfVe+)Cqu!&4vKf4ZgtzR-E}|``rK*U&e#;hF7U` zP}W_~O>ttNj$nI>^Sn{n?>jpkd#5Jzgo^n|o8!6lj-U6~!gZ(fDtt~>eIY$I6YKFSj++a+pD z5&#oRta*l*SSM4$2*@K2i$4Pp5X=Xjk7q`;i{>uiGvwVD##6%f{pWC@+D%@ZGh;Mz zIJ;+49zQG1F}@agJT=Bx|T3NgGvRZMrSIvuTq1 zMNyY&uYv;C1%mdUXceane0$69klTw@4S27#=P^3Ar^~={rNYSju!nuD(S(OPL6cH{ zpOCRE78RVIJl!wishWg$^JU6H;t4d=?)N{VEzz`#ZmtGSDkYNAIG`srf^5I0kzhE5 zumfLJ40s!4LuxHB3wU1%05yJa`62?;?k0B7+^H!^ISx10YS{P6JHS+cl z8N(AFr;-=yA?x~s#sB!RgWh>G@@#dFeJ`d}s8rehY0q`c;Oz4D>MCl)eI)M@;y@?+ zW+T_Aw97#{8c345@oiZAYsk2lwT3)gEKIt#&D02tY8&k+&nQA##8#q7p0p_=Zly$$m9 z=z5HCGJc?>gHqd53d!cED2V*T${7~F1!Vef#Za1zdFdB_Lg0$t+~vh1L9rkT)>dm% z)z-OJ$3urL2Jj;9`DU5d=5@l8uih9V9(^n_aU#3J5dZChX}w)PT<7%X~(} zrAKNXwFm_kbRuXV9=_DJU!vo(3 zrB<)vy+2!}bUa>&BNTy`NU*4cj~@oQs72ck=T9S=$2&7B+VCZft2RHWz85p#XE5rT z&uxC?8iIBkZczp3C3WVrB*AQ{gL8xLZ!fzF%-KE*l{%DQFLz2-Thio;MOEpQUr~T> zUE=)UU(hjk?3>+Y{_}Q|I*$_cPJG*JPs7PfvVzo?^Fv@6H?#(q7xMKVUM`tyhlD3S zYVvwHW5IBEAS+gGZ)t0IrH(KsFQ5Qg4V`6jH`>4+KGD<85mOoOL0KMuIViB)*vkOE z-f$HnAsEGi&3t->lxT!RQX7Hi^Iei%RODh5j=N#HacmJ}#0Z>0T5%Lmda@Bum$3l$ z2%wU?ka~U4q2^n*OLf?X)o3uMRv?j@b8r>q7R3zecoL=`asvH9hg@6+kX_;%7t0a} zd2nNf6$;Z9K?f<6N=M=*$EGB2av;wao7yV#`{fHphXjq{!3|QmE{Lfiy7M)dZ76nd zJq26t4vX!u9;WkO~f|Lh)_Zo~5IAaYQvU6pLKy6KVA7 z0CqXT$i&lY04=2NKl{})pBv@!)k8MUuL7_Hu@a^*f2C5WR(Y0)ff3+LWp6zCkYcf$ zW>4MD+jbc3u3LZl+hJMlL~IyMhpHJqcM_6H;v64Y@50#y#LAIgLAPq%C2_G_t+6a} z+v4HC!1e1GM$g*gUGy5}r;pbH3Es4?4FX z5yhsRc*DbiF2B(tzoN9VS-GN#pfVQI#A1FEyP&7-zD4{Qr$kF&I)2{&j$@%c$BQ?Y z=>~x5oX;(_y`29V@3WYfj;Dyp*FzTdC^GCm@73Zc_?=Rd%7*k20F+msuJ`tKqL7Fw z&hfC7b zfeH-@lqEjG2Hk3PEpVLds+z1Y@W<&Y=HA}yZT4wvR^}~;?tSMezn}}v)tl2 zSHY;%Pouei2Dcn@4ujGeZ@w+=pLaMCVLWnD2|m3T%-4Oqv!XGiV28O^c>wo*OBgxE zhf1xi>Fm^5%GM0*D6~>Ze3H&4Lbe(Za^>J97a7JnRGCSPN%EcZ#^7-6Auq99V{}#= zg7f|zvfl8jOJFA!JWO$ch}Om0aMX?SW4-MyZzR~?aB_8DRuYV#;ax?no65aO5QA>{ z_cMmcQWD~%oI>t^k?W{Ofw1+z2CF}2-fwqa#Tuo5cWG65DO4&bR1&F(Z75)NcBgng zNN6CoGl1gLCBc{oxA(dXTTAO+)%a5#X#V6NKhU&|k#K_K-0`x10e(K%;5;-33h zP%#GUKt)*`d3j#&pPmaEa!6aL5 zpb_`OX>BByfRK12uaB>KL6hJ(N(G=eV*j2)w_Tsk$_%rOm_O_hSDFd;VqZtE@=tDQ zM>CiH8u=!eEe&ith1N7yIm537pIGGI?ys)pzhT!y7v{RyD!lQ7Nfi(L*c!G_k_+3L z@^Ng;6LLe!FcaNJZ`c31(JAAkeq;e_LW=`aB|Il6jcStHcv1Psplm`;&trMD#Hv6!Tk&&Fzw=)+m=~3So6iX0Z#6i&RX@ z$Gh^Z#kfx0OmN7!J)GtwX@x5-RH^RghW1nZ;9oI_(0!m`fwmBNxj)9|A@?IrOJz38 zPfA&OXgfeZLE!NV+a|7n<(w!jlfmetQ`NiqL;6>0UYOnoBs1z)w4Zw~5!=!`8f zw|l#*Hy?^s(S|N+rF%X6*O-;4TID3f-!+2V!yDjSjcN3jwjACi4OYJsyO=0;wcT$t zH?+0FjuK)%O(~IZ{441v)8Cs!@lgMjl2`v+Q6sB`+-mLr9hEh3>k~{lCJd=j@o&5 z8&&uW2~qp#jV2AmHOae^r8moP4HSn5WWVLR#3RtV9HI=k*2#$|w?1E?MgY&tc?v@v zU2oSB1At+~i~Y+5{L3>vZMJ0k=XVh(rTN*Z68!{hCXtr08tp-Mm$^wvhkH1{<*?6f zeu61J4s&CKxBH)^`U!z`@1Zk_q@p@lV0ko=3cqMkxl#)knS+9dU3={84RtB)Ky6+# zooi8;NEDB%m=31bkD!4j+L8|YYJy9RPkN}BT%xFkV40q0XwA|d+Uy0k{?zx0gNL6X zD8_}Ji0Z~mZ4Q&K)5Oc}>7PMGlw)Ad%tMF3KYCqgG#m>BDoKZ;W&?DSy4!a3uYy`> zcNNneXf)UZhJ8;{O(MMz4wHb;@{tVX)kG&cWx-C+)5GFv>A$nMC(qZJ6?DIqLXI&JD%qvlnuHPcEZ zuxb%~uG9m9cr>sK2K-z0XaCiu@IE_GeM0?ioNmth|L?EDLjW0yQM<1Bxq^KPV!R1J zQDT_<(YpQ5AG`3Q=|6R;!9v<-{eL85Pe}_%~Jhusu*2Djuy}_s09VlZ-viR>|gBgKy8^F*- zYya=r8%l!9C-8aQ&Eq`1w_a@f_5tl=7canbpaX?`V)HNDcfI1~YQJbdrG5ptgpy``<)CYngAfqL!A ziTirH6Lk&rPWu=`U=bfGJKrgIK3;2Ww4<=OsXktBqAqIZTAn5v%4YzK;9TfL{|>^? zEmR)>@OnO>J=$n&M4re}2}Pm6bEO$4Ck{i2AuW`VP`cE1cP##Wv?lldeqb}4$ZUd`|1b=e_(&}!3}z+v4gWZZt~p?Gw@+NjcCxsLqHvhrMO?|LoiP$#nNKeXsQtayIgnYpy z&)7*r6U3`dc-g7Sa0&cB507WCL(PZ*k+ysqtCv30HMYkjtd zH3y@2-~Q{)590Cr{v=HT4xVR0n)cfoqKoH$E|1-iyHhM1Lu*N>&s^|p9A|a2h6`&? z*MNSk*)C@>8eo(er4|3?;@n|$j8m=TdPtu!3nAHO#&@rIAJ=@)U9HhCQO&dAstxC@EXgfKh*47G2HI+Ji;r&KJ zV(zFLH}Fr^y)?umZA8~Sp7M=K7v#@NuGwKr=9Nm7j~&>Pa{EI^H#KZ#7x%wkakAcX z7prvoFj*~VZv2h&Iu1Fiu|8XEF(B!n(P|w&sici_bvPLMRIp0YXj&fCYaI7qeke^{ z%_+zv2($cJcmSy0G%BdnRFukXD9B%roVFxx_6mD>!~(vljQ-*C+dHkDT+ow!>Zoz4 zw)|J42Ixr@3dJ_{RAw7|pgP{-^$z$2qdgFzUvQs=fgPyu!65(T7VKn$M{1R+wX2H_ zO%6xv^%8r(gFe&DYy+I>{3!j;?H*%-aNBga-yaE6I7}MaKGxxj6$?s!AA7_}W-{?j zu%B2qE3{jXX|Aj`SjU)Ty2;}J?xX8#wa9M!PmbLd@q_|EsK=5{qOga;oh%L$?%>2$ zf9E6uc#q7}$2&GfKccW>A}Oqr2^F(>`8?}Bq9>KU$)Jn8!2bk0^QD`^O@*o&b?8S) zJ)-s8LusxS`!SqA+1U0n@rxSq4vUTsVb2FlXS9wyZZFe)@auU_q&IL|#+O-KY~|ar z!2#w4e5p(pBmhP#w%$TnLQg4jKq`%7nDU}htzFzp$=rEG?!(9LH}a>mC4J%dun{+U zvm3+h`4Uvdqm9n=sGP#8*EZ&IkI{T&?Cog6w5NW5Txx&rdN88n{YD*z+K~?#WwlzL z^r@pHQ9gUM`M^}>S!2jSp#jA>b7^&N#&onp#7q&>SXzkWZhMDKU^t$SGu zH*pkcbDb5=pveHeN`YU?M?4nA_I`Z|(zFv==S5&&N*qsx`spx{-n?5af|Cerqj=gN+RLY`q*8pL#{LJ6}iVKGjvK5QXLp*hcnH`Ze`>&+z9z-LcYLUDPWLQ?|muCy3?_W^Y@49xGlOYlew*c ztX5tI?@SQ>+tWeTj9`6?yCRO{lXGbe!&G&M3BX~8-CU_RBL<+r36v6vv0KjYF+n&@ z8=MPZA^TF8Cli_7eSis&uiwnjPcg(0SX=FE*FUKQ>jSBlTWy>KIdvQ52)9%w(lSH|_%e*a6oa zhHI!yzPyD>K_AHgun()tW&whFosDw{?i=Z3C-R3KlaB*5JJqhfi*7mPlqL* zN=f}2swDd%wD^=3@Lga4?fmd$!Y|;N-y$Llp*ww1Dpit@g~i_*ZPz)m-FSB);uEuk z{?yWofFUR<`$&vTp~$)wMA&)kPPte%|A2$}V2XD>qEtdcHh|njGI>lWV>;g=CCl0P zk6uuRG9fo|=P!-c53iS#jqC>(6~|3zaRy2IjRAhKTxrAnEaM9gTP8p4AhU2$@Xu&oUuMp4cZ4hC%?NS;W z(~IAEu2u11%_yL0bGGLf58a2wG{hXgyplmW3Sst%bu5;xMqiHNdP5c%jWq3LoIwY` zpotBoP^$E3aN18dXiyZj5g{BhuHMI065dPw`TB1nVqZmFwxEu3Et^Y0%}MtWON(Njdmv~b zFj^JMwY7>tCTHaE>3Lh7yt1RnpA7O-10$?q<#CBwXy!Zs0?#ZG84{R7qVV4Ha$%Nf zX&<487b>h<_C>-xrGMQZr)~(P#K>W*@Zrx6PnjPU`F|34qxy}@~YzBBCQOk>tPK87oSE1;-mZ9sfd>LTf((#g92^FV&(FE?vZ-r|k+*6=ooje+v;#Lw_MD&P@xq-)xme9PH0ql#P?Ba*l8<3UH#j)e444q?2fh#2CtD^qP~B) z=ht7Q?B5O_q2(KH6BxYLHMugPiFlD&#FNN>6k+)Sy$#8Vj(t{PU_-_!SCde%JJ#Ph z47QAW`>8ex{~uRx9TnC7whz-G4JzH;Lw6$#-O@O8hlDiJC7nZeOSg1)gVKm}OSk?u z=X=icuJ!&a$~b%N{n__@B?g4&v?SZvM$@CwW=_U7#$zL1ih_$8J28^S@sE$5l37K8 zU5%<-uV$SgbfU9T=#9hE#SweJ<5C?d)>erm213-ucIpS*i31lV+aEgNlUu*5KMz;M ziY;75Ua}@_tdD&=du~H zTVg{WHHtYFxDwW$o&e#Ok|ipP$O-9xUpz!acd%QP2H_I<9G!6PX3q$=vDo_e7aBaHmvRGH-)p z=bln~PI$P}coo_-L=Gyv6if8GV@?J}HN9qQ%fMh^PHdvveUHj@Ge(@l-%deFZ3c9+ zmy==}nMg57JS16e7QZOwgY$epOJFf5E?OhykcFcsLHZIJd+31>2)I%usaF z6a;ob*`g|SBzWRRgh8GLzcoQt*4guZ+qLaCo|gv=- z*d*cFz30K!D^)?O)42f*jWsbCrl`2&SV3-icTFb-JOy^%X6@o!ynoMX+5?H8 z6*7WzO!*DE3q+OBAtm0O_DOZ-s>##`S*l`|OW5iBGHh(w4EJUvYXrsaIxxo9P3x%0#mFXDOlOZ5f$B~x(BB(pzYrVjXgr#8Q zsk_{4UsM#n?)&g)QR1-Xr5BhE`oqx!=XTs-n&fuapIZa2DxE1s{;H@;a$1yBcoH3C z%S+Z$+^f||ObD?Geuevn=L*=4tb&MnVk@+~Y#j6|RCMu2xWXGVN_q1Rd2C-X^?t+> z$*t|bLxLyGh~t+FlR)Zkixs=EqCip1O-$Gy6nhAVKoL18xHjQo`!Y2v)THKx3!>Do zQKU+Qbpj;&m9opQ3gsGTbudj0-m)rX3TqLo_a z=o(&npBtf3%xK-v0cjk=lo&rT-VAp=lr4qR?Sx4jg1ZJ(3fm(kIT)`Z5d>TpQAAQ- zTmfl!cXzpayHu^#8MnvOV{#Cb55CvQzWO7PXab z`#fWkHKjiAMZW4wy+TM`(SkqaM^p?&pYNHToR;5NUUKD?;Ua3|-GJOyiG zip~IR4i~fe+E?mHKAvpJFZ62YXyE;qDLg_yZtL84t!ICbLku&}-)XSn@wN`pDPHcT zOed6zhP04vK6RaQ<*bm#{?RvusfLc@HKlItDq>KEYQJ7@pA81%rKR6BOnp&|6(7F2 z(1-V5{q%`Zm(Dq?C=?msVx?>5#M*nBSyeMNjI>N1Hg4uKd+A}WwlUl&_E#%QuR zispCFRoi*sysDq?W?pV@al#C^iWD#B9KO;6r&f;#i8COjdCKq0{{p~|LVN@h_1fZ8 z$rhg%g~9)Tn#LFGqY=mLeBe#M5S=0}ivg*?%MSxQsDEmHJ(pP=_&?kP7nWYaV%Wwd z?LT}5_$vfv?Kq##{{vD&r2%{fUDuv%?mv9S@dcmZ>t*x%51)y9!DlEdCd~g2pNR(W zng8GC0QihqW2@qSzqbA5|G19QcK07XBSnRsC^n3zYqFJdCS80m`#)s^JsR9*CQ&8} zfyY=H8)2bo=(>&b|9~QjPL#XrHhQ5sMQ!xi>cC!J)E&Cf_;oc`y*%s9zVj(q{gK1<&+toFS6NS(H zfBzyO0A`$n5|)=>wTGzKnxL4RtMKfmEhlQ5OM05yG)@j`ifxK+5h>RTcfwIcXwXOq z=aMS-&((~(L7DcXdlehd?vX~PIDOS+6zTyKifNk1eei9RofLQ^83C3;*zRX#^q&Ei zZ(W4{jGH8UcX^Jv6~tEaQ5jwVme@j>%4PKitJ*s{ivhp8lAP@*fG)0|6de0DMnEay z_q2&Tl1(i;{e0zG`+39Y{^+c$2%rfL81>oMF#{6GU?<46$n&Ko(7tTp78%FDMyQ7@ zP*(oFk}w*yewVVTV)_aC1oYsJ*f*mm?2M(107n)#g=;805=IJ8Sw{=I&kwKYt zn*~hThw=iq?U!Z)ht0GKDJ%iq8=r5pUbDq%`|)4c&PM}2kxOT{yv_GwYF*?dwQNz0c~bE^N!QtKhJyQx*c9cuUS(xdoMU!wthq?&KMjO90J*N z2y5`?rnj*{pEIR!MH}}s95Ll9-YS_dtQ-~gC)2t$fNfSjwbQq{7&0Y2OXJ=X{@tf` zK00wnNZ|4OX+`An(>OeFFDHYsgqd!oUS$KDQr+)y&An;FG&U-6&vF7)n$xG>@ZxOd zvkJda0D21^a8FS9i~FJn8Ebq)hwVux93dB&DX^t` zuvU-})neO#PRzkcBTVkwpq~xp)e`;t#MSzAA?!RiVYpphF>0F<WpzZhi0J-2c8} zmYlHozRG|S|ATXcYfEd}S7E0JyFV9L<Vy5QWGabwCN=4Ai6C-(9kcsKk8uUZJ7!GQg03zA1XaKA*~= zTfl2!4AI8O@e#RgdqpaYJE(u(eBvS6`Qe~s4BqrC(H_6yN5Y?T=xW-(Uo;a10UK%W zdUDG+CREOu2LG@WYlwDee2~U8J?KeRmp)yfS2elmc}=Asty>qANlQcR+Xolsd0;9T-lJgvIe zouUU?&!^S%$k_;DpB~S;5>6y(%gLz;a&>{)@#-$FE8_)bMxgtpiY@s}(8 zzXx#~CjzeKU!~7k4E-cr>FAM6@mkBxxP8m+oHw3|nWf5E-<+@Z)n1e{?5|3)y~>jq z^_6+;R|(7pT8y8)I*QrdPZi*C3(LZT|H6nc{_aF=$@uSx$4B@hG)MyP>ymI}I#T|a zmJGaPJ{`?y6su%WxyKSQ+Tp5Jd?Kx^Uw_^VQ}2+$C@a(~<8wcu6Zy8zaJY zP^4fKj|D_T`oSZ;LZ7EI#EBHJFlj&e1!P&iNYvsSaKL6!ES5rA*CPx%&wPmfB1G4= z-&hr2alOS0>d&>9_=e$C0JHnrQuwmLXxOL*LRn@|R6eN=fO?ITSn3vI7D^4WSB>vU8anOuB{rSV9=kgA>ALCHNcwYu9i+a7G zhw-!nJ8!+|9)31)uIHfe&iU5oL&0;SNs^&G){cXg|6>Z+;aE0=uIDuxim}?_G?E6f zD#@SS6UcQ11{pk4bQ$PSXVKu$p8C{&W#^^5S^!5rKt0GUthpAP&RZ@2yQJg@xQ`}< zGDQYj!c!?UTZtwQUwAxley}8pL#i**u*K%xTFaN#3{f zUF1b@`SO~?3-aHM8G5ixrh2Xy3-S9!F1odtqJ6)td79rC!2g}GDp-{7&1B5mRq zpFJe>`8--oiO@{l$~b0IhUpxU+Ti$eg|8)6Mf6gKSkvqnxWW6@;eID|OaEzr`K%Oj zbG$_T`6-~SF6vzipCwtdZ-FP|=bGmk7a0D&69MzaO z-_7Y7bMuCuH`3_G-SP6%oO?WZ2&$VHUQc}am~iiAe$NdC_Cti@Z|-mRDHmD-HuDS} zdEc@^fRI-CR_C2#{e#_1@Z=_;ePk*B$$8VAABH#b|w zk1eSh$N^g&m*@4;ICPg^-O$74QBC7EIpgmXwfqf{<3I3kQUWQqEbN_kzfe{9icmW* zMwtOZkPc^#0QPQ0*UiI9|s&hSCQfbSn{+XK?06u;v(`9nzUSe5zD~hWybUC)kY$U0asZ8 zh&(}%i*^UT4fU6|thh8hg_(oV#79@_evkG6x;vxE3Y}`oWeQ0Qlx|1glYtpw-|5|# zw+rX_f_?`@soZ#D={yzlWg4=3OEg6Gt%@Er)quR%dUsd^S{q*@_IS+Y`E)+i=o*^j z`R9I5q1j=rVF>>Mjm@?0hk;A9f%}@9^KP1@e5rG{Sq~qOUQA~l5KqPW!EHh70VoA4 zSY{wkHUwmbNnEEDz~BTYDVptjqf02@T&PTqE%BOuenZzXtLSJH;j?zDE0ErsGq}Eb zDJ1%QH8;ATZ=QvJ`P3Z%PxN`dZoMNy3Fr{9=1O|QbE-1xMsk9Dya+doeO>FcDH#oW zz0&UK65VsWR9^%bKLMFz4$4Wg2mcw+{xc0@GnT^outukpK8&X#Ov$(An)sXTU~eKr zd%4NJqK|rKj`#E3CUT_&h3{dCpiFwUkb9L6@ZL+%Xzj3_D~<+qXlrI_6$KHOfMoYA zQeKflDyFaty>+brX(Bu+7d?I070QLRAaYuYmWn0F_rcZkr13|faC9NJ3h<5a=Tkxc z%vCLtj~yh!9!_!P`*~qx3CLs~;#{+lZn781w~3Dvb58{GxCl_=L54#X+{vsCIdK!}F_*}@{1C1xAZ z6!3kCc!BVjG&0VVJ-}fzTw~lvRXpLNUZR`@x4DlVCykyKUw3f4kD$soD{#)1KvXU( zGh&pVNGjshz-jEevc4Hp&e|L_3^>da4Pj zfE1x^lrC!pva#YrWK|@)B9AQ=6GV9|ta=U8&A{pR(7lxoyu+sK<(Pl}UPM*Tvxgwy zjpT@R@#)l6W$@aUr@_jo?`64X`=tt!@;gC>JqBaR*;PcYHGc~1w4M(VU-Rg}6XX*< z82|z`PUBvLgSED1znFemU(nwpS&($0g2t2;9b|DE&jjY82bmlJ$#B)Q238{&IwTWW z5*@^TEo?d%mHUlWv{3#u5!1c^AXgvsAx?uX4FncH#g~TNk5EtY-KaQeHMJQ5qDGoCs*vd=g8aEXGNv)BaAmBrKDwH`xrS7p zVCK~4Dqp{drS-Ht^1F+u2 zv1LheA1)MnMxDkiB}8DtZeerX;!do%I)FV0)TVVkQ!R2$r0TeX`-240`bbbL>}L6l zkExl!yCrs#&c8_YIcsw=E}hQPK_qFnfsA?OL6FXyw(T5Gw(lL30~#`C;yu+Q=m_mP zRM*Q0Ta=xy^HgR}N1X&x4CsY48*hZHHap{r-nDY(%lz?`6uVm-3AyOCBy#yJ8I}GQ2inQF?1%? zOU`Hinb#W#ZdSw*X&$RHlyPrSNPbKey*sqdEIt4gOdydrX`c*c=IXx3W+M}n5!`7z z>(qCTa}@?V-DKu(JVrIt`h@gwrkdg<5T55o7P&~6P<&0(&c8HHlMX_{xVnI=E{xJt z$R_iR;YbcES$A4 zp}>Qbohy8o3_pSfv=bu*ByzBArYqw|#A6cgekpgp`@JbVi=J+dsG~yHjM2TXD<5zO zZRsI#vvYpil&HdM+ifF&>veNbK z`40@@Y^ZSfXJ%&7sLlx`nF#nCGMgl&6KIsZvxkDW!nghB75DHW3Dy$HtNXE;d|DpC z_~3?Z`XmnYSyF<<1g0~H2X5rkXuuT;HD+>58hrg8wCA-J_u)nouKk;lNg*r(B_EcV zZt&iM_6H@-{fOP??NG{U$WfLU`Wvi!$zS!Xa`6VWkarmY{joGeOrl6MkgZAu&0h^# zry94s@v?<#XB5+zTazj*aF3W|>esI6RTXoZzFFm+^%@H>VcY~8A4guSNwy2ElP zA6Hk$!iN&|0u?J>aS^|gP87|0lU0*L1dSmJEDJG-5sodM;~2w4A!jCRv~KZuBKXoQ zb=`TU9Rm(R?{YprAM7O=!Osf*K-lhi(w_QRddS^N*x@o{3lar?n2Lb)gx zMgFfg3*6cHG#cj7n-mk&e@F8wwNdwv`yWlm}@4q z?gMcWb2|j+52@?1Op=tZ2N7{7B}y5^KM?AL;ybn(M0VzO1}L4VaKd#5A`f?(^pQrK zi@cV)KIcq&2f!hkcjxxZc34(ZEHGga2BeeQBqyp35Gf&Yb%ip;+_ULpSg)IRP<;P< z6X<<8PC7>qS2_@Xlcu8V2v4?~lU6-hk>XdAJ*(hT@pWXtpSftvsr}=(qpN6tjanuQ zXBL+@A8yj+rj%5C_JnocN4aOD=V@20*-%1k~p#d@>j2I12d*1diXWw*HIz@FV<+7FWbI%gJ8bX$2UQpYCEv zHz`*Z9+$<@&VAR7jUgIYM@Qu%Anh^7(ZF*cfC@pz3!IjR&zkgsRk6$9&%+~o2MHuZ zuPtPB=syU$5Ccv*FiI`ZtbPmFFIi|@3iV{8NviOXKR=Z%lWSIb_a1j@M&xrIPYQ7d zacjkz?>$WDUz1FoN`3_#}+%8FYiY-5G6N+VN`~L$ryL9meKX$A)?O-I9M00#0SfG88=j6zL^NdK4AEFJ z5k2p}kUsNp9#dc~(wNS-$t0*3EB#@PHEF!mH!D13T)m`*j1&%U`5lTgsc=jvzqps} z&1S{S-(=J$g7fG<=weIH`-d);J^@-`LH&uh%A!ky7uoVm_vzz9<(yEwr;GIqn?jEa z$H4(^O4O@&2wG==04N~mR$9rmUkCIE^V8w4TOW14Xue-p<^{v%GTQ78A{M4(jv!=PKlkKxnN^|2`piJaEj{#|GOL07&?A*lil&Ofav^* z=W#DH7X$(zk|C|xLbVqr1f%9$@83(;PyE71rj125|F*O|^zrlFk4txK2aOaj`aWXC zi9SD!VU;J+3(sO6O3X)lXx#nzJryu98c}MIwJg|q^%UkS1$3mbdtPkM%#tUNpmPgI zm&BHYyli(|BTi?%41+PG%sfeEF<}T|y+Kbgq(TiPsF#_f?oNmyVTdT~ZyRkE5`Z;) z#QUtHg!D(+Ph z;bA0W@VY*vecAGTP^gqN{sJz?uTdldoFk_!+sLu_p)G^dDC!L_ZnkdVw89Rz#+=RQ z`I7udB{-`Z{88CUt>V|WSK1nP!G#6NjGNz3KZk%5M<{3eFsC^ z2|T1`-S(hIDgqjGLKzeeY-k>D_aF~$xy@=&EeB60`8mAR6K{IUQ_T1jP_X&KzH$#a zrtQU&-H#Xmr5$eBW}1vYU2WA+@CEZ?tEc`rGjgu;M;I2)QUc^_=tSsI1RPXWr*=^&su-5H*x3<73!tHF!a0M(L1cxsm*UK(rU>8u#lhWc=JV} z0?rtw1F&pS#0zYf!QhfmkW8;oyOKxgt$Lwz!8aLsdJHIN)*=j(w0-7Zq&4mkrLa7b zXTb%(1f||`itIHPu7-RXHI6R;)977W$?AP`wPqFBgw4+R0YQ#<6M@pZ<<)>dU7_Dx zb<^UIN$i~(wfJ!f9@b?e1OHU^V!)EiyLSsK&eixzC$o3Id*%tse!SixBmp1n#oLMy z1A32ySn3w9x0VpQoxk7v!b~zs{47kO03Z%_peW<}X+Gp_ZK-yeMjxvd;ATyX7E?rI z)}f&ykZ%yZgG%-LBU+B~ZjumKn9uRqRIkiaj9TGUHN`>VGvg)C>BGM*2;J3eL|l_- z@y-gGzcMdVUl$NV@i7B{1>834wQ_)*7zu}a#K%~2-oo?qA#!A+AtL+( z94$9_ni+BF)Bb7kH@q@X~fw7UTfkufTpUg!iv*$cL*3hWr!5Izi~)B$I$5skS%Nm@E?Ui`0@u_ z-^-a3|D96$UrY}iQu|c@1qF=11O=qkzBf$!4}Z6K$r6AKKIV#q|G+zaQvirWbe)1p zVjKV1INqpPbDIkE~tN*rK=p2;BLx zorJxPqp5a_WHq-^zuBf_=6qDD;rtg|w9jVuax9ey-`QPqnj?JvxEa9 zNM4)*`oq_j^FEfgETU(&*Yh!vb9m>}o%3ZxulP|6MH818T6x~88g}`0#H8$N!LeY$(Pno}8jhi_=+fE)wd`U}KS)w=aEB}%e=qE&nwKJ^U_Yl7HpjVb`1Uq;HB z;j!VlN9qaS>5a0uF6=z9hTmLKJxn*fAzgYwroh|sYVgR8rpx2pWCXBz+R$ZvZTVg2 zykg&sidp-SB4%;FPJ_{y+|HWB%eB)(>!uId!OcG z(fd|s^DJ$jSV{dRyLh3qcCO#{wIgE0=Uc)QuV*Bht!5;5JrQD-zoPuX$aNo`X-IPAm&2V2-*q4M)?bD>ZsZ8^25+wu0ST*Y`#=Y zu9xLQr$P7KAhF~8WZh!_RN^t3}8)5lj_2rW0qdcGwBFeC`a^*ZeI`z%fiU1d*+ zmHjDlPA+#In%-PagHd!G-Hy1pIb2BK(pJ7dD9I_5U$EhXOtS_&5IL_vmdcPSeV9WB zMek|=p)jpW+U^jPU>lHfj{Fu18_sZK`GJAG5eY;eu-EU7CmxsM6>}LinuGwFK8bXE z?(gW+2W~(zqIXGm5RxBu9tJV*KGN7FFjowuE7ooNRpn6^Bw3XSDR?|>Q~3=exmWLg zX55VEQOZAq>9K50q8L**WUeI8{Z2D{uDhA9;O!7BbgJe8`nIPl9PZ94drS>v; zY~SOtEW{?o#{h&#Q9#Rq-N#N6b}xW&fK%)92XOD=6@{P0f_ax*Cxe}z^Ct-xXIew^ z!BZV)lp{YE1{`hyqGG;>0A^-n1wp0-)W?&ax*vD`wl5cB7nQ5OgAiVo05PT&I5t0> zc)xD8A@{wCzbQ&*|IkSj(|Xdf0dOB{e1@Nv%)g0DW40r36|-)2uUa&LsAo&a(cW3W zfc=0eiiio?snY4PJ5H$fP;@f=o`K!79`!`C(DnE?qloN9wXd&XnQleQTQ5=d=kb$f z%mg5c!b$>V`p7kE<_=o;mb_0qDy@uDB%G;yK`fpi1wXjei&@91* zTZ&@9{J5V|g6yPL{p?PDS;N z)h>AQgW)&nhuafYWK3W3+rWOI0ANnumvO2l(pn;q|M)1qB^%k0lP28rdY>fD=1x4F z&oR5-94}#EwbiBZFa>14+lscNk|p59`rL(1021eVpUF#~8i(oOI9n+9ZSKN5CjcRVn!NFx#rd$T1gW)KukBN1 ziu_0Gcl^VW@uN;Fcv&<9u~ZlmzvF;8&sjc?LmOUquB>e z7VD9P?c@iF*mkLspuzw=Ta;pDqPuT2AG{F0K7|^&Oz;GN=(4S1K=uY{YP^L&8lOLI znMnwdG?f<6BJsgg%BxUGWUknbQOrOnj|E-y;p!lfMxj0I2A(7W%X*?1Jk=B1gf&;8 zRuK9=kCTB#yDD?CnG}DoC8QoT`jvgml{MP>-DnDH#dCf788Tf&FxpmdsSr0?iy=I| z-_KC#^$u@$p|V^TBsst$Gs7P!cK;hw9g+?i;v1xx#r|W$tW{o^mfX50a$!F!N>~UK z94$ZcJ4FZG*snAlJSE0DB{6HWt;K>MR;w)^DHvu&4$VP@6GVY&J>!Jjzn_0@ycLcg zpFUO<1%ZMuT^^{BsC{CAKu4pbqgj7fWW2FTgD2mPzqS(;&5ob7Aqg)=nyyLrxqL0+ zwC7)F=@J*L>+?mn6o+W@{&#@8$2^B9lUUGayT)wdZC5~@9DPcGn4sEVi}#N(bwI#B z+x!=%tV%Rp-?2-IPEr2pH?QL|!|jHU%pX-3oR@HyuD)`qFao7j?syQ1^6TS#N{DBk}(P)!i3JD$!9dXGPid}y>C?Tq*M!380JIOPd1q4VHXjw<4R15Q_OH&ok8FMQk_YXx)DN6bL zbcJz+xY~iEuyuY_;Qi2n^u{WuDhFWxz|O*o3Wh~i$C^_8+%rtk+h?VgBLx|Q_+!%3 zN_Rq2c`xIWh(q5ImT6o_?5TJGyiN_zbA2(X%6`S-Jb21^#k9?n&F$a*R7 zMR8lqpA-iblg{2>0@X`TvpLnB*1fY;l#V{DT;uUBy}#-vz!|$M`62{xe4Rq`^?v;n zs2D21uv?^@CFli$qrSqOHP4d_35HFh+?BB2Yqb5r+w2p&o%Tt3rO59Ir8o)+xnzF^ zJLrvODSDD!el$^XwQmmNTPV8+XriYX()s4_0I=6I2OTvj-%D}~<#rFT4ddBpQlD%d zw?p!JVUgr(sNO}6X0vxqI~+g#y3=dSOBib4Z|M2(n$0r%W3dl@Z%Q9~44yAL9co=M z(b{C1h{9Vo4>`b)hLdz#SzgcQV)s`gI$Rlw89lOkR8^HL8t1Dn)zPKIk$r!;JBl2H zG*+`2aY#-xB;i*aZkF)MZd`%1k7HL@&TYI9L10uHlSru&*6f!Qz;@VMZMF5onL-we`# zorT~*5NN!V#cdwkQ&1)Cj3)cj?t+AkCjYJjjZ^ls(#U3Vec)oM}Dhch6;Wq6(kyG(~6ya!lcKG$L&@mZz&;HG}l#j-D~Nx<3BbKp zA?t&atX|m#63+P%e4U<*+x1MnL79t4hQufuzSi`Ghpz@pKgW?HMOblm1Ay*2VWB4> z{mEL&A|ZqeM*1-T-ep%go)g0;DOzA*dm0Gn83y?J1HYJCND7@O-jwHFPD!I3NR&n< zqp4J4Ui-s|8WGg?`lRbkpNI;^aohT;oU+>Ay3Fi%Kx7UZP$U0-j(zD^d+th@4oTpy zX~n$guwAIZo)swbidQQ*LmlV4AqJ_g8`bN@Jo!k|DW$z7(262;i8Z0|-nrLxDKsu1 z-YF%jZPq?h0bm)yPn~i+qY7J?DAXKn)Onj6f3YVi*{39RfIvm*+@R&@$VqnY>w(kqFJ&TQ*@Kx6zD;4G^s(zSckFX?T{CBI%Z&e0IrXp$A`pK%Eug192q! zjMj`x)dcJfoCyqBji|h~9CD zdLT$T(krVo5|;7K$a#d;%d7v)un@fKPRMesrnvC)T?U+GgDN_@)dsqQYM+e4Kai{Z z!1H3iT!6N+(8)Z_BF$53X@uZFLDPW0%W;SMSZUi?vdg?XMphXTr9vuc>Ta!N>sfZ2 z`Dzf>aL26}0hqp01(2S-Wzy7X`dp(hCGjVhsn~OlcxP9cGy%pE|6=Xr%<8BU@D?4d zaG&Zm9_`CK1eCYqNvtcsev?b?QhzBadw>1o!%8#UUg^Xg3Sp5~M9dQ)hr#@&WH~v7 zO^!{Da1RnIls0_=IDABrAChEoUU!5CtNrl_)aa?0i`iRL)gZY`(|KFGS=LKcYMH2M z8)}*(RcXI?Bx)RLvyAQ_0gNC-SrEuYsWe|rq7sl9a3Ki7%uz0$2Mfv?A{bBD;^F2; zGb=6^ZxJ_S4oHpFuE(;Q~@LoKomUb|gFsHp_JJ>--qk#73sx7Qt*O-8PW;^Gdj7gM4_@ygxb?#nk)15H#ir2gO{TGmcwJ*!mp{fP=y@QALQuYF z50~1HKYIWrTaML5STY)}>hbdx+wgAqhZys=;}J{2c`#YQthDKSrECY>ko@9tFt`Z; z&GZ?tU`wTk;o&R7AxW%z1G$^2rqcnSZtw_0YAmM0_oPp7QFZr=J(xU&8^~eu7-fM^ z34g6nh4&3qf*!Ki2DXZEoLFb4y)oj_#-r%71 zcpOMv^`2=++#XCz-&FfJH)tP?aOiSqd9^=-lNd+{QbBgPVk-k(9)SakC;9gtFEGu( z;Vo9kKJ`s+gMA=AeeHSL7t)btj3_}|NQORBGo{i}Z=xKtC4xHsyp4ifC}uzcj+(hg z`(^bDKL@tX@aoR~qAix1F638qXg~vcI*QVLAvPw+Q%kkZ1WSue2HN}I^ zF3Evbb#VbIy5&ZV3&w~AY@kCt0N!kxwfTUSY}c=J%Tc~g_$~NTc%lru#CNJzpqWzQxJ-hy zT7+KkyHbWUe3LZz+YWLP^Plhm0w8)BdgY3vaqZx{gp$i*c#Cdxh2?R5&f$Rj#qDUUEy6;I z`N@Wl^Ivym^^I!~xy&%3H)DKZc^V95uOcuOL}rOYMRsL73XEjYHfeY7tqVZaNth%j z{ML^ky2mh@G4U|((1VpTkE#36ILTTPUU)kp^aOVMtg}dJ^u&i6RAENGAgu=sE?M+B zbHDl68X~}wZ|%HSgX5))J@HD63!7EF0czkgGQjD0YL~^#iIuX`6?=Qb|V@fBs$(?Kw1rUL(V#1b)N;R5z_sP&?!;Uc@);K#SASUW z49XZC!P-pEZw|;?l@b{0k{+s}c)D_?6dv)yFO<>7KiS)V2S)Jjhr=QV3%&s&_9<*Q zs<&my?w9(*wq<=hSUO9#%qV`6TKN;IGu>UCZHWE;n8zmdj#z$Y5XL_?%^a~bY}^@z zMs2t7MYood7buf8^vkXfJVGDDg9KBWPnhZ7l}a$}&u6Pod5GG6$)qIiRRlf>=9M(0 zb?;du$? z5HG$`b#D+^Mv}2Jk_DkRQD_WIjg@nZ@pO#Ckv@eItWwN8;B2r?IS?+2?SK3OhqxV4lD%+y+HnT^;;A=U z4qzR@z#x*}DxSFF`Yz>Hfuv=6O7`YT6n|{pAaA~2)~tV;(u-p9_RsCcUk2EUR@akt zF1fpg_K%}ypUIVQWKC#hn%vMlRibq;8Oye*csR>6_Ph>&=tQG4$vjMwI{*qlWjNA& zH+|sfXW7P!XjCb>z43}8<)9^R#ZG@InML;x{a?~&b~VHj!LNV+2r;GZp!3?*&H*Zzf5KfU zu|?oYy9qT3lyKptxLHcS+7DU`5wHdY*QVuoiivOvB{px9XoN_FDqvfnEXnp!l+k=L zy{p>cYrr$LY@O|02QNsPABc_|TJ~ z`i)v!^xSxa{2YJ{%4w(d>pwQA03f_~`I&iD=yd5Lg1UX$&^g1}e_jN@y)XKL5kCpK z(*6hd@>2lbED~`ywSNpuFHt@(sjm!2aflCJmo|serA(8FcaG?32!zrWy(6;Yq~~<0 z>|S-Vv0~dYM2q$4)Q`OPHzJR$9Zbu-UD6tKyv6?o39`8%QDWSTjE;>sF+F!dJs zPAsEPwxnF3G#By(6Ufym=#zUSF*9a;l&*6la`1T3ZMx${a7K#P%}l_?pDNgf4Q$+wYhp%McXR0g=@~ zNC9R`lQGdhNolFNEv76sM#iI1?PEXfFg#QLynW7LIpKc(p*%|>h?Mp^vGlYC-+ZB5 ztFf!K?ev?1kOuF%@M3*}FT)a13`T@*Q2$#OkQQ&^?w|2AE;qqDGBa<6CREcPbK#PD zZN_ybN&C+-t9Ga3r_ZH7oP_!AdI1=d2 zFUcPHh+d^)&5yQ!NeTrjoR(AL`JXQ$%2S_t;(c^7$GuoC1~G|UaqSjk_;7hcExMGQ zAk}K4eMlE1jL47Hq00wB(RAGbI0DdG^OTP7Xy~d6by&2)2!o;-cJh;C%^(#6l6dl) z9PCM3`c;1^GY<24&zq|22L~O+v<88zDKGsTm8*tME;q<#j-El{BS zp8;q({k(>Q3xgDSByaU|Eg_%c8zecBVrtVwi-P4IQ&=Fn!EgUJgd(%P9*LBHJZv(v zvIO#p?(^n_#1ja2y{P`@7SGus%2zS)f-4I|Dhw3~B$Fy*qFwN%TBbvM)=d;=OU;? zKyPmTvyV&cm6oWW!Y;-UJ@=5wuKA&=2qJK++SOi|x&WLAsk zOM9h$AJ>r5>S|_$6eFXL`RtbqMI;x2*&}VsY`Whc(~$>IP+N+JIR3i&j(%kWVh!|XHoYk`RP~!5_vnDAnh3%DPMI?Z8*4)iBIYY* zT^!E70TXk+J|yOwdX7n2IeTngVLS^!Jjs^Oiom74Qs!?^+WkRja5-^Fx@>a|CgAuf zKgI|rCd}C@LN8G)$x3Oz=(n}FHI2Q_`_1jBn3y-=EjbZs7%Rtg#N6+Dl(?GT^F39M zKEW~%9OoZtFnLKPD}+@R&lipP!)CDQ$8o4)K{QdEQB$I#l7iY$B!}SMouHT$oYM1U zAe&Q(w0eX5Vt5K$aRVfE+LOEQ1d$AN`Z^}$apF$^0fuoYE|co=*QvVwLnH<9{)B3e z_v6%Tg1%5{b*hXaF3DTm1d;?6%?>ZOlSV{~UA{w1ZP7vo8bWHu9-6q_XnI5g@kW5K z`JD-iz~tU;M!`sBxD_4jLGgPdRFk(S!)yS46^RR8(EEP$F_!TDRq>=jug-{MKa2FRoM zO5vI~dR)(dfov~ID6u@AY01%K&nx4 z1w_6n{_<_EEuhx8fesUjf}4E8j>q__Y;la@_IRm)*0hf#BB(Be%IEhv2`cgeV-R-r zmTe)06iBVN;Nr$KE*MQqbQH0keghIC4RiS}Axv(Dt-CJ?PmXLbfJWjQ$XU=)3WWVj z4s%KU^$8-KVn>Kc+$WFOJPnxv%f#kRRW0J=0#syb{TfI>r!=t%Ahw9I)Cnq3-p;fP z4(M&Hv|2_yq1M|4d&OTUuU#l*SmUkNGPZ8CJUejjwajq!yTUvNtchA<4YIRtQW=|7 zm?*WM5)i_cm_$dZ^<#5u&Z%)RS-8s4ix*^#>Ek{sjGxVstANNFX?;)badp z1oxM3vEIU_KVd>_^=BH;9M@e7jsHlG3T?pIf5&Q0^4T)3`}N4sy5Yc0a8I}G@c(%G z#>cp#E#3x=Z5xf%*q$_2V^3_`_QXcxw6UEub{ey>ZR1Vvz3=@A@9Si8&YpAjUVE># zeh8E7kpUTPMZThOl2ZEbyyDWK4N8T>vT+;k=eFzz7dqF#!$2mPVx37h5zGiYL=Oqb z9ee4kvItW4Hq&`fO+JD6{Zx62K!T5eEe?@;L2$dRwf+qI=&i8QAE$@z*3KlEtL6^ za4njP3>B0xo#9OlH}k`U+8|^PPCU}gmnPK<;99ohkrw#bv;h{cgou@wih1AJ69vRg(f z;nn+TWc=xxspn9+uRx!3L#m}ICEIOl!ldj3;7PlI)cZJS$?sD?I7v3cO+qh!{^I+w z)hqqNh#_^$)I@I7aFu(yl?|N{gY#+D3QYeoL-L`Di5QB(r}V6p@!4;#;RCabO3z!g z3d2Gy;Ra_~98D^7f&DRoP^8Gm!V7BGqBEAP+azGF&mW?K$Y4r(0X20S?EuFpwvw7Y zs)ua$&@tGbVugHRk*x8%wDYXbQV9JRi3%8DLAA&;W;_MrVOnxoT=MP!Rw1cDP2kE+ zN&j!oC8HEX4hRmUOtA@kbQTOIC^Wc{)WBGIfJ+5+aecTW3K0)0>t$`9q)r!@US`cO z3|8)5tv+#KoBN#~aUbA?gbaN%hUOZH%^=0m07WIU9YyPU_(!x^*a6a=%3K(JaS}=n zHAVO=N0ibwsA=L;51Jh4H~QHe8U}4JzV|!3?&>#%c2-LXKB-ZDD162d{7*^lFu{Nv zO;73P!M@_NhqrJ<(zAL1p3&t{N0YLpG~vYv$t15_oGPN>Iof;-KDl?&Z%v5uo_4NS zlp~ZycUP>aO=!S(qq4dmZ$>_Ih1RU(LvP&g-l@=mtZ~ z6fq$`hwhNHB(W5x?vbbvAO*#d3`X|%5b08ZVPQgA})0%WiJ?nDp22gxf=)YA=!J zqBUz@r&2NzlGv8Q8X!&y{1=C)fHbOVzed5I3(1>t)Ivau6z0VU9*w$Mg$qnforT2+ zF+TF?hK75A$$9$+uzw?kH;Fvpc7#u4Ur#wFtF>9~yPO75c#lk=$WPYcBh}L33S0va za#r(b5q$humVF0vHIqLB{U>e)>!zDRC38va48&bD00d+iTLuRTEvGaglNF6EY z4cHY!AyWRq56N~Y(Pr7>!OTnDjGz9D7hkMLqm%b24laJi27|F`Kc@10pXrX~JFR=1 z&{|j{4p)DLlerR%7D!!c@_;3kRlQs~we;0#M!?!e{}NU&S1RkzLheO1%`%Xw*@>5~paF8h2{-Q6mdn{kyLW$*oS{PSmu_*rl?* z;qhw@C?gBgQAyq%Ne@HAcD__u5k?$yWuJzAuMvDJ?rhBnPXCe$Kk01+yDsCA_y@gu zM`*kRVc}j8lnJEZZ{6(a-gCdwEb18p6h{J*AD3*y8v4*JH>s&HB%`J-TIrm>U6axY zpSOyW4LE};=6Cv*3fu(gG;2Wm9}VhfKb0#y;5+}|ahNUGH(IVL{F68EQy~T5xOSd4 zY7~Q&Gc)1qP>{p~b;^{CI(dkkciBgy#l2{861@2tn-&WC;!~DH!{sYG2?0X{_6-+1 zk&qg~VXOjRK(JISLGke`L6+yv7|5+B5#HzT7U_&VrDGEAOGJAmK$hI1@D$0U$*X?j zfT&sY)Cx0d37)p~2?1Nf>7t(P^I0S^%F_4v%C{xxzp{*GLu7DkOJIW<(*ypm&aXBx zJ#h?ZJoTD+@{DkOB7vV@o6-<4<2MpQ4{Y3eq)_^&YfYp#CXfuRY`R1Y96sKDFwIjA z;2!gu_Nji(I*?v@8mcBb&lM*F!xPOwiVAr&%_t;z5&Y5%H$juIC|#20{+C8aOXc-) zV4cc;@Obm`&%-fp{AJ!;Io0U}@?h*wJp0ggfos2(GK{%X zDGX`r*KwU3%YQ#>NS4=H#~ZZrxt~|K8`t7qy@bk63c3;YmXb1ey~33)nsKf7)kOY5p#M1a2~XRn5}M^Vcs}j7Tj0#t>PP-BCp~^ie*j z)8c^My1#M~q{i2hDr(G**ueHY0w>{j7Mpn{u%i$zpZU~s)N*M%%%$kkf;NM>+O%aH zRXKK8w7e4S{z#5bjt>f3{uzTjp)5L+@w)|d7{kvnQ@CRy%iW}JvLVTbqNWHCak+kc z5U2mq2aH#~#*T9!2d>GniG_=@Cm!gfvZHaYMr=*zJex2uH{}*Gx_|D3Hf&T2`sZ{^Heu_)&TlII9r)NgSS%2E;s zQbVKMJE6evn(@Mn=iM&dPo&CqJ{j|ij1FI;)%%j15I-pk11eY%xagZZl+CD|(kc6KLRo1$(gLc7x=0e9+e&HrPTDOyp?#n;HVJG69-p0qSo?@h%jh&H)(`RU(Vci5LYrQ$ z3Oy4kl1dFAxH`x~tSB<%Ye z^!@r~0P%p#i~G~{gm@PfD!TI$r-AFHk1AY(5SUi~4_2&CqM`5yyZ3<1Z7zm~N&v>F z$nhYZOhgUzWPnI=K7}{x?nYrMngl~9-x z9~x>A(oj9m#j4>n^eoB(rq^<>zW;rkO>kgkg>MVmDKI(eZ#K)954ogi)Kx9Y{uO`G zn! zo3R_kCYu38N=KrJXaIqsp1}+dfO(RRV@1d$&K?JWm6GqQDJE5YV@$OT?Ju z@gkm7$P9w}n}5+u#@G9lO9_jSA13i_a9aNZ*au_wD*d?5QxfNQ`0;YHh`%chwRKta zk*~eSTQIhn>p&zCdRO^jO+0PNpADy|re6TAU!nf_o{OqGPX~DZ8_}1cgg*jO-XT zC-G0Q(VMBYry{Ha-)B9>-WyEB{!Hv4=dHCi0t^xiOiU;^JQW8j0AGx)W_U1}G9iai z03%r%kmw`^jNKlGh8h()zUCJu2{FH0el?}pd8k%ybKmcR|K^9gKPooxE&W5VM*o-= zAuW|*>R6*XF%JG48pNe~I#34UG$Wb%1oW5?=GXucBmo(-{@y2e@)K|?xBUkrU#8~= zj=6lMUynP^U+D(hq9+!8&mtKtMS_}w_!^%CMx0&MQn-F`G7WTKN7#NbPYePX7!cg1 zMTz}xQOmrG`j@webq)j~+6WA>AtNi|hf#qMKWLHGmZT5;dOz@~=f*Gr4x+Vijx{PE z-|OMrw)opZa{=)N8;~O43SowM15s{4R17dtrb+Hcn?jwH=Q6EXlE|H7sjOI-2+QAH zLjIi?AmMj}VO*$axVg)XB(5Spa3Z8a^h*FY4r2CltFLl}Kf@Jpe7z{m+X36O^hkU` zQV9n{hJU6FDFay2{bQcHJs=(;gN2&Jgs56I7b{&2)L_yxlgd~b25z|l7bk-pFe$r}zmBcT(UkxG5j=v@f}BAd5F&4*fTRQaGw;k)}yw`4Wux9>;eEKfhO_ z&_}2-)|svKO3_q?oY$@j;7TpaOwD=!CZ;TP)N#tP3*(Fk=YU(}p)2QtC!9EjQ}98T zhmZy>hJHs=OXIgDPAXX&0I^N1k##f&YcCp{lf?BtRiPS@?XKPJH zfs>-Lrwk8ZG1JxM6U)$%R)tyQe)k&0{e8W-Pwj9*8-9&R0_9a1Fc?O}Y!1(R7sjb5 z=V~R0DuyZ~lSj*`NN%A4B=t9waVm;_1wR->gDp+y48=QRHn-EUs<{gw*ai(N%ZnNM z!Qy~ql{PL*Wd{{M#^`xf{Jz7}MGz&?v6Klt<4TE&I*u6TTVe%j!j(beBjO`ZaX}LE zxzu1l1aFC>3hvrQ14;}dQaG8YVCIr+t_*XK3M4zzazq6)o}Fb0%wH3Ah6S59w^stc z#)_gH&wC^(r|DOZQ08M4MPLB0-y~H_B0hxy0J3Eg_4H@PWFhEq(BMsZA^#W)LelVp zG9S7ey7j?3V<8`GoEjxUA|V2=vPgDg*gQ`I_I(YY$cNj7hHRUlluWJ_*aI+(&(0cA zB^cjX%EWPgnfh@&D#ugHxEJxYDWpaZOd007e-vPJSQhK~PJB;(&NPHWa-UrCjI7k; z_2-@p3Y$^ws1PsMXbo$ub|Cnx-%uvYiTC?#;Oo`MGhOhR5?<=(#ssG|t;+MmE)P>$ z@J8y>QOBu(9w8+H&rXnl_wb62%Hh4V)HCIUH%R$U7ARNH+sxCKNlM)k*{o;N+4x=1 zn22~#zah)6jjqylZ?AVLX*9tCt&rn>Gf9ppsz-m|l;E={1`z`Km{o?V+aus^R#7+y zBc@~3#TS5IX9^{p1kD(>90loFHy_g3TF!?Q1A~NTSedy5;Ikj`p`GS~gan-Mk{Vpl*SSC!5$`YI7vfGq2#M6I3}uDj1FKujuCCUM zlLXOF(-SRp?Fvk-!)^Ko8`?E5Bax=lD+$ie?3q3pet-tgBFTN@6&;Jh@o$7w@r^eq zPFspxi0r}z5AO3X!a7QG{s7z#LMrq7?@nt3R+5u&d-%VjJi6$HOY3+vvzl02doa>a z1vtpJKS9MINDQF-c$(rs?hOvi+S&Z#4#udb+VIAwP(r?;7(;SAJk?9MKHZe`P1T#Y z3IK=EP|ep}8O0tJN4z&x?frswJw4q@Q(>$X^u<)d$({(eJpY!9B!?G8eeWZN=~=WR z(~sMh{dd0c_nxl?N5B9QED)6n(jTPb*DDy_IDeDDaYF=rurF%WB%6nr1RA#gEz(T3 zD}g+fjn}>lF%gH&WCs-!^oYJ#1lj?NeOz0x!*U2I)sYAZ8s)L!q~w638@++|P^(k= zK)r$_U&M9o5J^34(xm_h_n{0TCwh?!=G&;Fu$tR>y)GK-4C7DHNleM!y<+A{p^q4CRYWA^Az!XasIGyEpW`B&*wr7Wg%nb#6Hlns7oWT|*3Kp7y z!oWi*PrK*m)YiLs`!;zCH0~Kn&7oYA$(B>#`L#f-2xC^E(;Cl7spahP2@{Vtu+^z2 zLI&PI)bXcak%>^&-LiR}))BUi5{p=q9mek!!X%<_!i&#N5~Euoq#w-$J6jOwsxZER z*W|GhC>W9I8U-C%vC{NzGy3eN`P5{nDDs~$z9f+l`9@O1(U|!S@i8X})3Eo$R-RxC zwhz<_9W4ZdcLROjBMQHdo3f9M_y7!G;zhc!?t&SJKq-x)Hor;&d$=d|8xkizbUL@i*fD@Rm5XM3AGBe@lF}%rIHXHX(~0 z4CAT!%pLLfqAUqhQ|W?crw957)iP}a{Q?DJfI3>5{SHK&f`Y&df3!WZH5;m@MM|*Q1{s;R0yVPOuB(*n$P} zXs`LZu})AG=Pwq%>vfUM`s1d_t>RT^PKgD%so*~;TejUvX^=bsTK!-lUUCS(!Wa6j z91Ou&&iWz`(DB9YXNA|u3WXt;Pi z!~Had8jJCV0h;ocwiXS zr^_MY)UGv1=c$o>-da0Nz6?TvQ#PscXTs7RiM`BlT(DECI9g{_ETJyR@ zoOq-tLI&D*su4eu_y{lDlu7%u+9D&=<{usr&@`sZ_J59b>~nOGbzTW@XkB z#xGuly$DWac##I?6<=~*wqBO6w{NCeR|Om;&w@o`lcZSZM58uQ^Mvipt|~H&iVwSr zCJ8W3zD5$!tIyT%48=FsJ8-A75}N0G?8I`P5}@wYEc68=Mu~5mhFz@Wep}bH#B7Xh z{E}NLo5q~mHl7k%6ljDYCANv6Y$TCX@iWP(hk&sLMbayntOjN9l5&MjG+$wEyR0W8 z#DVP7vG%CULaVJHvtZF!f9OLB9P0HYNp@fg1LXpzzTUJasOWEavhrB)=P8(FBckNf z@MP=7D%(hsoiERb{Zd*L(X+W8Reo>J>zVbkLpM&tpDrRE#y61s!g-TqkAaba?qYfs z;vA8V(DGhQpv`|zXuVOkI!c5d4k#N$^ggO|y_fQOc$r`C8x}&u^E6o9n&s zQ|)^dGD`=l?-MmX*R84L>^%a1y<&0g3q6znCK|R5iV~_(ze=Sx=gSZ6(*2!T3B2Rm zquHU!80Gd{*99#%e(4T34y78d$h|KHp6+pcN=HVFefk1w`4u;YaJyz}%(fj2ClP>l zFgv3O3TH!eyh?VCt4Nwg5$}m7{5P6)3tlrB{*7*#IzG{|@ivS?n$S9SIhu{W*AX>C zu}Bb_B$(zZ7_IF8Ze7(nSW+z5Av1b(D$KnQNMmr(M~WyrYDwr{jgj$_}DxVcUQA|;5p;H z$9q46ZPO8@j}Ar3VGO~>cZ--Wd>UJ&i}Fcgk2=bI?^qojfD>rrJF)X*o|mv{-#LKM z`_}n9%+zdVcWKI6?V`rJYzOlVhFThgHZ+PoR{W}reagtm;>(I3i5D6AJ3*9pnC&L) z6PZdg34Stj3Tu(@v1x45ZypAeHGF9DaF@2z24o5m?TAoQ_A_W)7=s!aHIz3r?A#=! zL^@$U7z%>-t$m-HZ-G8dE=UeB89-6nAL-+GpnU zD|gITIu%-@XX21<7z5-q z959P4pxI%K_&J|I!C$aWYNE)G>mLu6^(&Ek~aY7Mtj+67W^1jx$h){0$fI ztCMr2sIeC_v^cF;)EZ2LAC=a9{bS}I?k@&tZRONfPw5yexjs+`9@Bj+?=w0d-k0W-IhH<}Hx-E~CKCA3 zB4{Mf*%G%7i2VHd(gp`k)X|6e;ehui9kctV&0lRXs8kGoMYANhOLv(dJ0DYf4w~MR zipnZMJK+Rc%sBTS&<<%bQB(^1SGW*V!R^982U)W5eC2N7{%Z>$6rHJANNcP;Yj3zS zmC1oNfwwwODAE$ul!fHzhrLdbQcQ_liz3r-rd z;W%v46akiXvy=P)AjuLTTsm(Sl3jj{M!h7k8Q%OCVAnn^naNd?eZZPPl1v)y^0~Hr z;;B_E;M7-s7i`RV7l|0y+WFj$(?&+e<1LhZ15pEL0t_#QTK9!Mxq|hFvoyTh-)+*`IQE59>pm$`-7f3NB}--s9eu;rBop~p_BaYJh+cNC7>yx4$fg8W2DMi0bqHuN2BX)8*i5};5r2Dcc#n92xMbH(d z6Dpi5i$%&}Zx=1QDl`lvMY>$;*?EExfL6|g7{&^TXZc#8+4+5KQAn(vLy`XX+7R+PyufKUp--E{6@uA5LiToPvb_e~Rqg%7O23Npj?@0w&r`He!e21i}Dzu)fr z;D+=#UQ2SvN$?d2)m+Uo^OrgZQ+J^8kyD6?#shwHV)?0VrI`wSt=sUEnixe~wT1rs zhWrvb-bt>qAUV@5rR}v6F$v^wcW{6!+!R>sV+TVVeK6E@y z83C6buem`S0XGW2d)9~9`mF7)&h>?Bb@9wla)WzPF_jJR51b^KB{X~a*bP1^rTHVN zhDoHYUmR7RhC69ovr&^m76+y6OzdzyymK-c@*F;f0UpamZd#IPqFX>s5ghk9Z9B5^ zdH2UTD>s4vFb3sk(K57rx==R8Q$$>wj}4A~+;V+MGG<6LDrO(#7ckVRORvT1OuGYK zW`-u}c`9MYt3E`;V8~{j&}Uq5@*P=XZ&pW=>;x|41^cOzWvBb{Geyyq>8sr|Pyj)0=u0i+8~}_W4QkIsm$*Op1VPDJp#N9cB)^VI zMtNgHUJ|B)MJV4rH0kaFyn*)wL_>-;hxMukHZB}xZ z(DB8uxp({XYVRDfLIYBk0c8`k8ly%lDP|b74J07}2e!geG-*&34CWz%n`~uN(k^oaB>9l*2_x^!5Grf1(h^y3sTt>1 zOMZ8>L*;Wf1qd0s7YrmDzBR)r%7YdhnJ)E;t>P`qg9(*97?XYA6$1tA!w~C3?(U;T ze@Y32(jf{icneL+V#GHUiMc;BLoc>_&q#4aOo-B@8$;O%Wx{JV&^Bqm=O>BgIT=ZPTGpk-;2hO3_rdPM8 zd$Uau4&$<~AGQU5rs(QNQ=KDz&x&T!0*WThq#abPhVZppkxJsNc)`03*0<(hK+BkMOTE<{ADycvJRRu6(E3mPx=oXQ`$C!e#Ji09a6PruMyI+dexi%1 z>TS1Uz9Z3)j16g!=2y>&F4Qo{l>B&=&74M zM(TUfd-Lp?he`FRO?3DI6`|gcf4hPEIgg^|0elyb^*)PSGKnZbfy+!GB_I_!JeK8@)KsfG3?fc=(OcZON z(?o+xqr`}ziQksTh6olbT=9oxgM=g*W}rjb*lBPE8-4?Rp<vGG#0w=sp7A-?PM4Nd58qX|Fd7dDg%~Br+PTN9hB* zpEM&)gpQWQW6`0C0$Do##f;Bzzd#up_-jv8Y zsV>^F-E8=sFwHb*A(rcvDvW=ln~3`h~)GaO_%NUjn#bZ|46{DYBbFPke?wQ+n{mRUuj^rN6X(J^pM~lC7~r z#Cw<@41DjUR(bs+PWcnT%0L3r*?Dw?c39ing3ILGPo>F*_sHSzos)EY`>C(Xv)Tpu z?dXrs`=#p+!l7t?+o-JOS=qv>$(ONLsA11Z-)|@s_v5vDAF8@MrnYAe)zOz0 z;a+iHESunFI%{A_j%n571sDE)YgARZdM)=@LxiImRYUkjVf$iT)dbv5lMu?iwcMAs zOZq~|FQe~&rp|jkd=2izJK;Y~t~$NN=1@c-f`434OjeRY70mqeznZNrpMB(i*p^zd{WcS&m3rrb=f zZGQOoI--AY#@-f)b#}u!H-=fP&Bvb4PGW)G;s`{VO5d=VDN9NGn$+mE=dGK&-~9aD zR?D8S16?RD4KDI5$%nzb^pWL*?DnDdBiD~kHyQ)5iHYY)?4r%j#aGb2t~Sz~)4n2H$JU@5&;mG`pi>+xAdEz4gkbfu$nbOtgT;V;pu zt3Qsxwz$zEI2!uCv19`-M{f1w*=*uM?}y^Na{zO0x2_SihjOrz1CFOn59Rf$efKE8 zeLRTN|54v+j!&_Q{VCVeD+23_l9Jb&Z~Oye5{(aI;kviR_X=I|AyWS!m-g27WO}`o zL4OYCu#W3%+3One;NOY@%o|g=Oa}{Pbhrjy<;g7m$r@4(2c$RhqJXQ>Usb6Fe(y45 zveKZd6K6!DM1DUf=IY=LM}TB4PDO^ zjk#>z?%@_T6Qu96du0gNr!Q?~^8?rC!|seilF?Wxgw-cx;TiQ(q^B=69k1Jn*8?9y zX=(cSb{pXuN*K9dJ$%3h>?jRs2&-UbQy>JUrS?$j&NnEG9$+}NzI zDSfgj*V_qg!XLM)_}q3e$kx+!DcJ_?O}OzxAK{&@C*M8am(5Sxh3b4fkLFsVA5di4 zCw(>&+`A3meRx|}=t@}f#4kxEQ{a`i-4|1IQb*dI4N{2Pn`M7PAJX6Cl($|=Nq=typ})>6A)FB%G*Yrhz!DctT&@E_h3ow@9NzMc-> zISbG|zErth`PH}A=`Ot@8imVixee{<`p8PBRtD1hpy-+?PD}s&2$2PoV$ivAFhc78 z%FKW~{l;e=$Mo^Zd3Q0;tP*QGpXfMP>FUPYYuM0oxuaZ;mC948D|om3x8i6$X!-ScuMB}pD zZk#fJ@jK9clFhxXt1yK<^5DI|Or8nS_E?8RrG8z2)uN($>Ovfa>fw{5<_054fR;g;qa$ay=e> zDO^t(WA5ZBU<9NKAQNz=M#8-Os+W{1 zg|a~e*S!T(cE@Q8OGi0E>tgM8AMq!@3Arb?JGG<@EaUgyI0h~GQ7k%^!VizxGJW?I zCq4Wsxz6YLKgS!3Z@=Fm4*e-~-j}gQkL~{?iPuQO;Tt1h)2Z~oyfu3MVyd^AHxUmD z5!?6>7+S|vSSgvvTzyeL;R*qpz7Vm`7!Ow{pG~7&t9B*eh!Zy3G+$*ky<^gAoDVDA z)lXf`82F47lZ$`)fo;7I{;u0GzRz|n%Q6K^D&Jrv1!i{3W$})!3-dXEG+^+Q^0e&h zjjC)*bNr+%-b$FbY_1n)ZMv-aT^b&$yRK3@xiPd3FV6UFH7{UE>Wt>l5f`Q8Gef|Z zEY>%SdbNDOVOp0}Vt212lSY;{0ZP$uutmn>AC9R`v|~5fhd2zTi>a!%S4U+x)f`%Fp#(z@dDyanykPhqh`b0;D*-=G5I>vTTd|u zz2D3E+8e%kE;a$*D<|Q{S~Sb*d!6Sh3X5QRt2qhJ;RuK=@p}8q&iae@in;sVK-;8F zGudrF_nWvZcNGHDN)6-O!AZMV9`ozhIqT6J^zH*Q)Y^;ZF-e0k{imzYKVi136vxr( zU18?FHY%rB?Jl>0a=waOW{77i?jQtgdN1n7`BJk#siP^smUyU=Fk=z!4)Xl!9suZ? zf(yS4Hoo!bLkKBO8xIsYr&WFDqr@wZe;Z~KAo^$~4S#c}=nXIv0tiFoCi+G;Jve1+E7&jvjK z>jFRb?{~-RwrrT@G>DM;lbP;d%H((Xj$yzdA=j&E@glV>j=X|rWT~_DT+Q(# z7@*>PF{;jL^8A&~bIIu1VFOkVw9E1K=Ps1AE02jYhG6mHr-ra}*l^N&zR1UTO443` zVyVp4D>ZPa%0H&2rCUy)oz15Fcubl7W2?zO`};8wgBJ73SA#e%>%@QH2Qqg`5DxaQ zgw2X&K^T@-B~sp@PlxV)*J~|o72lZj`0lx2Dd*4F4jZjE)=@xZoXQ#nH0{^NZtqsR zh8yPLWcy;Fh*>T=lr#P9qHhrl`T{d;4Zz4mx2!;6`zzy&sY8Due}V(jtA(u8@g)_N z_V36qFXyXTbv{q*?N$3T)ZU>zu|VePPTpROXX%|GZ!K~H-P(eIkcXaXsfkSEB6h^c$H`H-lA0_#29AqH|tG%Y_{ z2i?@+*aBkoIJ`7%Uph6Qu>y4?M6{`fD}*#cqp)ojMv}TgI(D5*N5&u?g3LR*1;nv8 z%}IiOi3`sgST&6P?4i_38mZ;uC+<1^DSW4b?=GY$`Azq23! zSGSkA;fnTH?x0KzIc|$_J2${$%86bCjDqA%inQ{Ht8E*M0AbB4zo!9Q_#5|*bC@T$ z1@7ze+NF-`<6jRT_8Jt^`2Chzlig>OGh0tv=I&noc)@cIYtBg5Z%ZQc{1=7<2a;1{zgAs!X&mxQgU0g7b)g6*jP143m+h{*1veVaqCRF|J z!r4jB%7S7fd2-nnYPoqUEz-|-DQyRfbt>)1aF3`*gm(=e;Hbb_W;_rT^b>2S$gHRD zjp8dth~k@96z5#8muHo7sEN#4iS6TGj0<-SLQC|-y{7~kWyu?orJYD?UoAq>AoFOX zaOQlkflrKD8ogzTEWc(%yL8z_rQY6uV)2%x>#95vv|jC!s5}hQ)OpN8;y=$~I{kro zN+C-6tUgNz*$N%lfVR66FG#P)w{iHk|N1IB6F=k@cw@ELWcGn;FsGZ#xyp-IhS7>h z@U_NTBP)jB3ZY()Vnxpvybifsf9kr)Fx0n8r}8bXZazExi*2L96T?49~$xy$z*C^`SBmTt$DwxWU1GbKme|NQtAT zr6tlBs7k5}J9QWI7B*zG-$*TFAOa_1+7os=o|ixT-l=lCRf-Gu{yq$iMo$UTVvnVz zs8C1A%nl-h;q^DR1T%r=&G1dB)(RAVU#65qO)In^PloD*6EE!$x_q9aJ#1dt2l=w;psw~`}QR>!!R_OzC z^>%CeP&Rh3a99$if~g#~Yt>Iv!{GCL_6H21Rkw!O@4sdUq24#H(jkyK0Sq&2AT&Fz zQaIlu^bf8PzLG37gUnd(hh@@iUJ@;n`kF(u#9gJNnMo7zj`zip6h!0tAeTyqzoX8O zN1oX-F2Mu`ruqx=x7h;9I=JWhM|hgt{`kej6pWeH1t9p^3u~~S&3y%f-a!0lOQqHz zKRCPwEgiYRAH61hyjFE-;i1KKhdv+zW(&R1Vo4R})Ffuc!%?yh7MMxkD(>9=VU5S5 z@zxkisxvGl8mi1bG|ts}mNo4lcR5cfAId0{(SE=4=lM#b|J(t6m=ijKQJ{jlRw0tg z@E(QW*Erx#r*6*ztV@Ef^sfy@Mgr*>N0!xSK`sq8w`+_sk_FukX)uisde+0%YIhtg z@ch4TGDEhSA+y^taH{VnuD`xb@smP&64O}mce7RSO0op!DoORzX*Vx#o}^q?s>D;C0tYH(gMue0BXoih4U zcivl$z{e>Ex{>!y*aNE6YmXz?(~Rxc%LbSuaa4a|cj8yC^quixO85huW+0n%Eowf! zZe7HCDLxB51_%S*{=ID&=sI~2SjjA{irY1jK81eRF(p3r+EjK-W=K5+H_x9Lc|ukZ z9jwWlEX!;~ZYoPkQ=01%l+3K9YnAPr>La+vp!0jKx;r(4!>p*Z@T5Tg( zuGjQ@D#qQr*RfBS$l@+-T+<8%%SfulF{*x3;Hiot^0zUi(>g_4C4~{Vt~p(*?Hd~e z7Fre}o_XIw)*t>bsMM?#Fgpipc#Y5|(Tp^mts0leVAWnu35Sk^{hJE_7RY4^fZ5Wb zzHc!SCzRezD$`zYJk97~?M|^)G>+4$<4|#Pu@)n8WD}T0%>FdSvU~1*o+Oj^rWn@! zUXtz53%~Dfj3XPHcLvVhhI^!8`xTQzm&R6f?VMx19{xtG)pupk`M3&*1HpY8)Gc^D1_P@;_a5%>J8<9a_-@Nh!-{;ICiab*(2~Y9-d`?ep8+~ z?0wGd_ZTJ*A5Pr+wOdw5zbj(hfB+u-a3vg3dQMp9{jmdo3#-Gr^TwOLGA@_R;nN1I z3M`fD9p~9@q$t$hs@BHvu(Ao2|NATZ)lR(WoHwQEz$muU>lN+rMDrRwSZA`yGh@2@ z;T-UE9sM!#?0T|0UjI`TO7$F`HWz6AQoG#|#UbGS*Ry>*i(7-n@40oZ!ZjDySNT`8 zpnn5w`Tj8F*x1Bh`?~^?(^=X3ReRxhDk1Px%=mg`@~ckpY1c}naNkqqBM33%!1v$` zU8Mn_-1@`BoA>mxZ|{d+{F0O3(-W=dd#gE92C=i8Y3ts?s*Rw8AGk_`1jeIy9%mfv zwwmXr$|TVY`#wA*g3sTx)_ruPxiny}nA(=L=^bVkB1VVG)rMM)A`G=OL-)-<*l&G< z^1I;jO_O7p+b#Ni=O23#kFq?MBcDPdM+yAahxgp3IFAo( zdNsggwVn>R{8z5Vf5qc@6ne1tOvu0de&^5~zPtY7wbI0np8eG*$mjj3^ct-Gyy`wv zrfjmRaa6h^jAvd816#AJQDZ1tZMFWpMk8#rp}G_<3Av_9?Z|>fXeAgXsEJX(0pM}) zuWHtp(jffy7~H|tYElBY70QLn8(m2(a03-OAc zEo`^AY%)kAypy8)6+<5?8W;C3$Wpa*1!6)mZrZZoLb~gw$>({bKVs9-WM~w2XK=ZO zxBHcGf`A*8hrC7Xd&@?1Mr#HlvflAnx7BH0aU)G<$=l@+UK_`sE#BvyH@(I+0Hn~X z??I{R-*G4;fpfx@N8#8^o25T#dzlQY+OGSV^VUUR`%#LWq#TdD4^ZHK`hj>;{ys?+O;Y zI8Y!-{Ca8;kAxYtGZI2Axm1`!O5TiC-)(WyiN2Kr|q&}sDY%>4MPL#APiLXP}wA8YZ>FZ|B3jkBs}700+5LmdE9keFP%*aF)2eEUP2LOf&9m&yIa{=6 z5_A4OSs{NN$HKSPnx=D8%qZ&*X=jQ{cHoWgO5#}kSIO#@tG>Jy_cWAT=rP95C8(Ea zbgi)7c^k9p$BE3>+22ZU!)3+wOZ zr9(GckjHln`evjI#BDBR^qf4wP1dBvJs{K<4UaPc{mdBj<}N@6l1ba)jc8`r!q~V^ z4s7EX#$=a54k$v`CmDREYc+&Zh_pTPav4-p*_XsyE{n*81wA?1{O4QCX~tGq_6y?l zZX`~r+8Q2_y2BaA!f2tig7uy79yvH%5{3;TSGT*PG)Oyrj}Oy|_2OP=Y^lhu9WxxS zN1=8buLFTgk82%px-qZ=x$F$AxQV_Ag)LeDzcsdVxM%^X+8kh21bPn$e?{om*a*yA zQ16tnW1nXcDG>ZDI%f`4Ou)4?p>5ieo5_S8pf9L5yx2&WZzb8ax`n_4owPy(h^>qe z59t~EL;MfxRoatWrj`eJ2WMu5i^UZzyPlH?23^paG>6E7^Ri7T`Q(1(fNml1e7#+B zPs(`E%gbjpe8&=j*7i_ce8rSKZ}1x9%6UZo?TP?!=i}dE*uWO=6}|@)J?Z;>NVA1pQ~^hpD6f+D>Vn^d%BsHQ7BZHZH?+Y`$7ROzMllC_S6_@* zM7hPdT7&mwfJDUd+jZ=RLV(6DeZNecMETeic9hYke!_|?xZ1&=M5B#{x z$)BhXT)%V)aJO*k0Y!MWk&gzeBtVD1VnE%SgE^Y^^*j>jjhOJ&jZV(j@JM9?N}~Yk zNYkl2>LbBjKg%rV*yVR?0xrM%Z06No(n4Q)t&YNQ_PFh6MB{Ad^)pKA##vV+-d8@% zzK^p-{Ud*uFj_9j)q2Tl!2>?93I3vzFE|In!mQo%lw~Vl{ONi}aHk4lK@ci8BI}?x zox75=uA8db@JC8nRxJ((fS-5cI5M6(btb_;B2Nv&;gE&ku_r3K?FWa)!BRwXYxoO( zMI*2Aa_8}SgZ40?YU?2kn_4pwSf}&Q`HWQ1J*9ne_8(Ydqdfw|{GcTu}r2Dx%Xb!6%G{CV1p#7%Z?GY#jCs5^7@fje_fyR3>GtuFo{(ytU= zPNj<_iKL6XV+vXI-(A~2{n+QjQG2+CCr^TJ*T7dF+G#8K7$OCYwY!63b3n*2bz;vgSe1t(~4;>92>bUXOp|QSxj~blCmL2n5^95l;1=6 zKydQ!+m6nzxPvYAd4%!|d$B18+QRxC!R<(fh|6~Hcm29r8RHxe1jX&T^#`@KkTJyQ z&un&n{E-14Z^-RPG!Y2U67wkV`s|g2bOe^9pUGO8l+gQG&uBgHc6R)XA%=}9?)QWO zoQ@C-ROctpd~i7Sug|msZd152bAv8G1*6Ws(x#J_CyHTz#n?1BJYSNfnaikmyA}rP zu!|m|qf;2Xp*X>Qt8BpDXE=_3S=zPtm0~RGQg_kwq*LXmXTNkN!5N+$kwf3t+){|u zlFn07x>wx5E3XcoSc+AYp3>ynDYDOS>#x*R@%Z74;VMbIvG<3qVk=+;uMjiW%OP2U z4PBa4a_#^u?Z3BLQtp^6CvJ9VshO){v86m8f3?ZDA%9`9TG@s+gJt}?Adsvs=ab_q zMtdi0MHk)gamxI81bHEw6!pp6H`GGXbG?1&O|C|4SH841*ZsG%ot6!^CTo9ItQ5a` z-v00`al~Vr@X@ifX0-ky{1Q);BhEP$bgtkl-WlBYmLrIO&A^!C;UZEUS;9~CS=W<3 zc1=`*ao2kD)m#&Ygh!dB%xHnrCJ?8UvRYhk}_P#J*H4<-Bl*$s)VJn`V^K`$zVdgjK-K=Aw zE{%I(AQU<8PLgxmj~nj4gxA_L-w>{Hz;7isc3ut>k92z-Ivpp_L*}c_glx}1<-mxY z!wJ^aP0C2=)Zk-wsX`c@69WSdjrD^mdk>?-Sx3rD;8Qnd$Lvb)7*1`sp#w5|?@?j| zomGL-*f02f7}64KeXg$*g5*_~$!#&iL=^>IfEoo$N~>2GbXiR z{a%w^rv5tL*RaX8k zGPy^M?C;0~N+|$GHCCEE$MVeAMIF92Z4YSDZ($v^+J_v(SQ%>^!As7pV)H!@F09RV zg3A{8YXw=M8QKfrCC7qz!>Fk#PQF2kl{Os1O$<$wPctu`o5X2zL4A7aM4Is~8y3_+ zi!ME*9E80)Q|1-FBKO1rGrr0}ilLgCN%K002LzEpy>Ck9(J+FS~y!pqh( zVgl+np=elNr8T?q_|I*M)5|2zrQz$7v}G>iPAfp^3UGg(OC4=+Hx>=yEzsLI{=Q(x zQTWN#JhO&l+H64TW^FAG=O_!7=DYSO?cYO=38o^5&2aYi9450g3XnolR=dqq{OP z%RCiFFO@F)vwG#nO3)mgJ~ez*`;e1r#Ca z7f_Qvhk|)k*#N(-Ee-(0?41p*QtqSw_~tw<-zd<-&42&(2}BuA0T4>_xiQjz*yfOf z-UTW!kEWpxrw7b+0*0snazkaVU~n=7W}`d_XS-2Y`O_4F1l2}V+c0Yt=4%E{XgYDjW7TJ literal 0 HcmV?d00001 diff --git a/modules/manage/pages/manage-buckets/create-bucket.adoc b/modules/manage/pages/manage-buckets/create-bucket.adoc index 7290327995..e010f09127 100644 --- a/modules/manage/pages/manage-buckets/create-bucket.adoc +++ b/modules/manage/pages/manage-buckets/create-bucket.adoc @@ -2,6 +2,7 @@ :description: pass:q[_Full_ and _Cluster_ Administrators can use Couchbase Web Console, the CLI, or the REST API to create a bucket.] :page-aliases: clustersetup:create-bucket :page-topic-type: guide +:page-toclevels: 3 [abstract] {description} @@ -92,7 +93,12 @@ The available advanced settings for your bucket change based on your selected *B * <> [#couchbase-bucket-settings] -==== Couchbase Bucket Settings +==== Couchbase Bucket Advanced Settings + +The Couchbase Bucket advanced settings let you set options such as replication, compression, and flushing. + +[#add-data-bucket-dialog-expanded] +image::manage-buckets/addBucketWithMagmaOption.png[,400,align=center, alt="An image that displays the Add Data Bucket dialog's Advanced bucket settings with the default selections for a Couchbase bucket."] To configure advanced settings for a Couchbase bucket: @@ -168,12 +174,14 @@ For more information about durability, see xref:learn:data/durability.adoc[]. + For more information about how to configure Auto-Compaction, see xref:manage:manage-settings/configure-compact-settings.adoc[]. +. To enable xref:learn:security/native-encryption-at-rest-overview.adoc[native encryption at rest], select the *Enable Encryption at Rest*, then select a key from the *Encryption Key* list. +For more details about enabling encryption at rest, see xref:manage:manage-security/manage-native-encryption-at-rest.adoc[]. + . To enable flushing for the bucket, under *Flush*, select the *Enable* checkbox. + For more information about flushing, see xref:manage-buckets/flush-bucket.adoc[Flush a Bucket]. -[#add-data-bucket-dialog-expanded] -image::manage-buckets/addBucketWithMagmaOption.png[,400,align=center, alt="An image that displays the Add Data Bucket dialog, with a Couchbase Bucket Type and CouchStore Storage Backend selected. The Advanced bucket settings are expanded and to show the default selections for a Couchbase and Couchstore bucket."] + [#memcached-bucket-settings] ==== Memcached Bucket Settings diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc index 85dc5c0615..0dbbb7791d 100644 --- a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -190,7 +190,7 @@ See <> for more information about creating encryption-at-rest keys. Users with xref:learn:security/roles.adoc#bucket-admin[Bucket Admin] or xref:learn:security/roles.adoc#cluster-admin[Cluster Admin] roles can enable encryption for rest for buckets as long as an encryption key exists that's allowed to encrypt the bucket. -.Encrypt a Bucket Using the Couchbase Server Web Console +#### Encrypt a Bucket Using the Couchbase Server Web Console . On the main menu, select menu:Buckets[]. . You can encrypt a bucket when you create it or you can edit an existing bucket to encrypt it. + @@ -212,10 +212,7 @@ a. Click btn:[Add Bucket] to open the *Create Bucket* dialog. See xref::learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about these settings. . Click btn:[Add Bucket] or btn:[Save Changes] to save your changes. -.Encrypt a Bucket Using the REST API -To encrypt a bucket using the REST API, send a POST request to the `/pools/default/buckets` endpoint with the `encryptionType` parameter set to `full` and the `encryptionKey` parameter set to the ID of the encryption key you want to use. - - +#### Encrypt a Bucket Using the REST API When creating a bucket, you can set the `encryptionAtRestKeyId` parameter to the ID of the encryption key you want to use to encrypt the bucket: include::rest-api:example$encryption-at-rest/bucket-encryption-examples.adoc[tag=create-bucket] @@ -224,20 +221,162 @@ When updating an existing bucket, you can set the `encryptionAtRestKeyId` parame include::rest-api:example$encryption-at-rest/bucket-encryption-examples.adoc[tag=alter-bucket] -If the bucket is already encrypted, Couchbase Server will re-encrypt the bucket using the new key. +If the bucket is already encrypted, Couchbase Server re-encrypts the bucket using the new key. If the bucket is not encrypted, Couchbase Server encrypts it. -See xref:rest-apt:rest-bucket-create.adoc[] for more inform,ation about creating and updating buckets using the REST API. +See xref:rest-api:rest-bucket-create.adoc[] for more inform,ation about creating and updating buckets using the REST API. ### Encrypt Audit, Configuration, and Log Data You can encrypt audit, configuration, and log data using the master database password or an encryption-at-rest key. -By default, Couchbase Server encrypts the configuration data using the master key. +By default, Couchbase Server encrypts the configuration data using the master password. + +To make changes to the encryption settings for audit, configuration, and log data, you must have the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles. + +#### Change Non-Bucket Encryption Settings via the Web Console +To change the settings for audit, configuration, and log data via the Couchbase Server Web Console: + +. Click menu:Security[] on the main menu. +. Click the menu:Encryption at Rest[] tab. +. Click the btn:[Edit] button under *Configuration Encryption*, *Logs Encryption*, or *Audit Encryption* depending on the type of data whose encryption settings you want to change. +. In the *Encryption at Rest* dialog, change the encryption-at-rest settings: + ++ +-- +To Disable Encryption:: +Select *Disabled* + +To Use the Master Password:: +Select *Master Password* + +To Use an Encryption-at-Rest Key:: +a. Select *Encryption Key*. + +a. Under *Available Encryption Keys*, select the encryption key you want to use. +This key must be configured to encrypt the type of data you selected. +a. Optionally change the *DEK Rotation Interval* and *DEK Life Time* settings to configure the data encryption key rotation. +See xref::learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about these settings. +-- +. Click btn:[Save Changes] to save your changes. + + +#### Change Non-Bucket Encryption Settings via the REST API + +The REST API's `/settings/security/encryptionAtRest` endpoint lets you change the settings for audit, configuration, and log data encryption. +To change the settings, send a POST request to this endpoint with settings for each type of data you whose encryption you want to change. +The following example shows how to enabled encryption at rest for audit data using an encryption-at-rest key whose `id` is `0`: + +include::rest-api:example$encryption-at-rest/system-encryption-examples.adoc[tag=encrypt-data-with-key] + +For more information about managing encryption at rest settings for audit, configuration, and log data, see xref:rest-api:security/encryption-at-rest/manage-system-encryption-at-rest.adoc[]. + +## Viewing Encryption Status + +You can view the status of encryption at rest for a bucket, audit, configuration, and log data using the Couchbase Server Web Console or the REST API. + +### Viewing Encryption Status Using the Couchbase Server Web Console + + +To view the status of encryption at rest for a bucket using the Couchbase Server Web Console: + +. Click menu:Buckets[] on the main menu. +. Click the name of the bucket whose encryption status you want to view. +. The encryption status appears next to the *Encryption At Rest* label under the bucket's name. +. For more details, hover over the eye icon next to the *Encryption At Rest* label. + ++ +image::manage-security/encryption-at-rest-details.png[alt=An image of a popup showing that the buceket is fully encrypted and details of the data encryption keys (DEKS)"] + +To view the status of encryption at rest for audit, configuration, and log data using the Couchbase Server Web Console: + +. Click menu:Security[] on the main menu. +. Click the menu:Encryption at Rest[] tab. +. The encryption status appears next to the *Configuration Encryption*, *Logs Encryption*, and *Audit Encryption* labels. +. To view details about the encryption status, hover over the eye icon next to the label. + +### Viewing Encryption Status Using the REST API + +To view the encryption status of buckets using the REST API, send a GET request to the `/pools/default/buckets` endpoint. +View the `encryptionAtRestKeyId` field in the response to see the encryption status of each bucket. +If it's set to `-1`, the bucket is not encrypted. +If it's set to any other value, the bucket is encrypted and the value is the ID of the encryption key Couchbase Server uses to encrypt it. +Additional details, such as the encrypted status of the data, are in the `encryptionAtRestInfo` object. +See xref:rest-api:rest-bucket-summary.adoc[] for more information about the `/pools/default/buckets` endpoint. + +The following example shows how to view the encryption status of the bucket bucket named `testBucket`. +It pipes the REST API result through the `jq` command to format and filter the output to show just the `encryptionAtRestKeyId` and `encryptionAtRestInfo` fields: + +[source,bash] +---- +curl -X GET -u Administrator:password \ + http://localhost:8091/pools/default/buckets/testBucket \ + | jq '{encryptionAtRestInfo, encryptionAtRestKeyId}' +---- + +Ther esult of running this command looks like this: + +[source, json] +---- +{ + "encryptionAtRestInfo": { + "dataStatus": "encrypted", + "dekNumber": 3, + "issues": [], + "oldestDekCreationDatetime": "2025-05-14T15:57:20Z" + }, + "encryptionAtRestKeyId": 18 +} +---- + +To view the encryption status of audit, configuration, and log data using the REST API, send a GET request to the `/settings/security/encryptionAtRest` endpoint. +See xref:rest-api:security/encryption-at-rest/manage-system-encryption-at-rest.adoc#get-settings[Get Audit, Config, and Log Encryption-at-Rest Settings] for more information. + +## Manually Rotating Keys + +You can manually rotate encryption-at-rest keys that Couchbase Server manages. +You can also manually rotate data encryption keys (DEKs) that the nodes maintain to perform actual data encryption. +You may choose to manually rotate a key if you believe it has been compromised or if you your security requirements have changed. + +To manually rotate either type of key, you must have the xref:learn:security/roles.adoc#full-admin[Full Admin] or xref:learn:security/roles.adoc#security-admin[Security Admin] roles. + +To manually rotate an encryption-at-rest key using the Couchbase Server Web Console: + +. Click menu:Security[] on the main menu. +. Click the menu:Encryption at Rest[] tab. +. Click the btn:[Rotate] button next to the key you want to rotate. + +To manually rotate DEKs for a bucket using the Couchbase Server Web Console: + +. Click menu:Buckets[] on the main menu. +. Click the name of the bucket whose DEKs you want to rotate. +. Click the btn:[Re-encrypt] button. +. In the *Confirm Rotate DEKs & Re-encrypt Data* dialog, click btn:[Rotate DEKs & Re-encrypt] to confirm you want to rotate the DEKs and re-encrypt the data. + +See xref:rest-api:security/encryption-at-rest/rotate-encryption-at-rest-key.adoc[] for more information about manually rotating encryption-at-rest keys using the REST API. + + + +## Deleting Encryption Keys + +You can delete an encryption key using the Couchbase Server Web Console or the REST API. +You can only delete an encryption key if it's not used to encrypt data. +If you want to delete a that's in use, you must change any data or key that's encrypted by it to a different key. + +### Delete an Encryption Key Using the Couchbase Server Web Console + +To delete an encryption key using the Couchbase Server Web Console: + +. Click menu:Security[] on the main menu. +. Click the menu:Encryption at Rest[] tab. +. Click the encryption key you want to delete. +. Click the btn:[Delete] button next to the key you want to delete. +. In the *Confirm Delete dialog*, click btn:[Delete Encryption Key] to confirm you want to delete the key. +### Delete an Encryption Key Using the REST API -// Notes: -// bucket-admin, no access to security in Web Console. Can apply encryption at rest to bucket if a suitable key exists. -// cluster-admin can enable encryption at rest for a bucket. Cannot access Secrutiy settings. +To delete an encryption key using the REST API, send a DELETE request to the `/settings/encryptionKey/{KEY_ID}` endpoint. +The following example shows how to delete the encryption key with the `id` `13` using the REST API: +include::rest-api:example$encryption-at-rest/manage-key-examples.adoc[tag=delete-key] diff --git a/modules/rest-api/examples/encryption-at-rest/manage-key-examples.adoc b/modules/rest-api/examples/encryption-at-rest/manage-key-examples.adoc new file mode 100644 index 0000000000..93157b7d8f --- /dev/null +++ b/modules/rest-api/examples/encryption-at-rest/manage-key-examples.adoc @@ -0,0 +1,7 @@ +// tag::delete-key[] +[source,bash] +---- + curl -v -u Administrator:password -X DELETE \ + http://127.0.0.1:8091/settings/encryptionKeys/13 | jq +---- +// end::delete-key[] diff --git a/modules/rest-api/examples/encryption-at-rest/system-encryption-examples.adoc b/modules/rest-api/examples/encryption-at-rest/system-encryption-examples.adoc new file mode 100644 index 0000000000..5bc30552bb --- /dev/null +++ b/modules/rest-api/examples/encryption-at-rest/system-encryption-examples.adoc @@ -0,0 +1,9 @@ +// tag::encrypt-data-with-key[] +[source,bash] +---- + curl -v -u Administrator:password \ + -X POST 'http://127.0.0.1:8091/settings/security/encryptionAtRest' \ + -d "audit.encryptionMethod=encryptionKey" \ + -d "audit.encryptionKeyId=0" | jq +---- +// end::encrypt-data-with-key[] diff --git a/modules/rest-api/pages/rest-bucket-create.adoc b/modules/rest-api/pages/rest-bucket-create.adoc index eabc8ae00d..86b87e638c 100644 --- a/modules/rest-api/pages/rest-bucket-create.adoc +++ b/modules/rest-api/pages/rest-bucket-create.adoc @@ -968,7 +968,6 @@ It then deletes the expired DEK. This value defaults to `31536000`, which means Couchbase Server keeps expired DEKs for 365 days. Setting this value to 0 means Couchbase Server never deletes expired DEKs. - If you set `encryptionAtRestDekRotationInterval` to a non-zero value and `encryptionAtRestDekLifetime` to 0, Couchbase Server keeps old DEKs forever. Depending on how often you rotate the DEKs, this can lead to a large number of DEKs being kept. diff --git a/modules/rest-api/pages/rest-buckets-summary.adoc b/modules/rest-api/pages/rest-buckets-summary.adoc index ffc8c71160..dab280645e 100644 --- a/modules/rest-api/pages/rest-buckets-summary.adoc +++ b/modules/rest-api/pages/rest-buckets-summary.adoc @@ -32,7 +32,7 @@ curl -X GET http://:8091/pools/default/buckets/" }, "localRandomKeyUri": "/pools/default/buckets/travel-sample/localRandomKey", "controllers": { @@ -67,235 +49,7 @@ "purgeDeletes": "/pools/default/buckets/travel-sample/controller/unsafePurgeBucket", "startRecovery": "/pools/default/buckets/travel-sample/controller/startRecovery" }, - "nodes": [ - { - "couchApiBaseHTTPS": "https://node3.:18092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "couchApiBase": "http://node3.:8092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "clusterMembership": "active", - "recoveryType": "none", - "status": "healthy", - "otpNode": "ns_1@node3.", - "hostname": "node3.:8091", - "nodeUUID": "d6bfd3cccf28f3e648bca46cb30ac271", - "clusterCompatibility": 524288, - "version": "8.0.0-1649-enterprise", - "os": "aarch64-unknown-linux-gnu", - "cpuCount": 4, - "ports": { - "direct": 11210, - "httpsMgmt": 18091, - "httpsCAPI": 18092, - "distTCP": 21100, - "distTLS": 21150 - }, - "services": [ - "backup", - "index", - "kv", - "n1ql" - ], - "nodeEncryption": false, - "nodeEncryptionClientCertVerification": false, - "addressFamilyOnly": false, - "configuredHostname": "node3.:8091", - "addressFamily": "inet", - "externalListeners": [ - { - "afamily": "inet", - "nodeEncryption": false - } - ], - "serverGroup": "Group 1", - "replication": 1, - "nodeHash": 48264202, - "systemStats": { - "cpu_utilization_rate": 10.20000000018626, - "cpu_stolen_rate": 0, - "swap_total": 2147479552, - "swap_used": 396525568, - "mem_total": 8327258112, - "mem_free": 1855406080, - "mem_limit": 8327258112, - "cpu_cores_available": 4, - "allocstall": 37181 - }, - "interestingStats": { - "cmd_get": 0, - "couch_docs_actual_disk_size": 48142369, - "couch_docs_data_size": 32943627, - "couch_spatial_data_size": 0, - "couch_spatial_disk_size": 0, - "couch_views_actual_disk_size": 0, - "couch_views_data_size": 0, - "curr_items": 21189, - "curr_items_tot": 42289, - "ep_bg_fetched": 0, - "get_hits": 0, - "index_data_size": 37010997, - "index_disk_size": 16332886, - "mem_used": 63213008, - "ops": 0, - "vb_active_num_non_resident": 0, - "vb_replica_curr_items": 21100 - }, - "uptime": "788913", - "memoryTotal": 8327258112, - "memoryFree": 1855406080, - "mcdMemoryReserved": 6353, - "mcdMemoryAllocated": 6353 - }, - { - "couchApiBaseHTTPS": "https://node2.:18092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "couchApiBase": "http://node2.:8092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "clusterMembership": "active", - "recoveryType": "none", - "status": "healthy", - "otpNode": "ns_1@node2.", - "hostname": "node2.:8091", - "nodeUUID": "b737df3d566f6c6ccb2bcafec61e85a2", - "clusterCompatibility": 524288, - "version": "8.0.0-1649-enterprise", - "os": "aarch64-unknown-linux-gnu", - "cpuCount": 4, - "ports": { - "direct": 11210, - "httpsMgmt": 18091, - "httpsCAPI": 18092, - "distTCP": 21100, - "distTLS": 21150 - }, - "services": [ - "eventing", - "fts", - "kv", - "n1ql" - ], - "nodeEncryption": false, - "nodeEncryptionClientCertVerification": false, - "addressFamilyOnly": false, - "configuredHostname": "node2.:8091", - "addressFamily": "inet", - "externalListeners": [ - { - "afamily": "inet", - "nodeEncryption": false - } - ], - "serverGroup": "Group 1", - "replication": 1, - "nodeHash": 34469021, - "systemStats": { - "cpu_utilization_rate": 10.23397660196727, - "cpu_stolen_rate": 0, - "swap_total": 2147479552, - "swap_used": 396525568, - "mem_total": 8327258112, - "mem_free": 1855901696, - "mem_limit": 8327258112, - "cpu_cores_available": 4, - "allocstall": 37181 - }, - "interestingStats": { - "cmd_get": 0, - "couch_docs_actual_disk_size": 56100897, - "couch_docs_data_size": 32866921, - "couch_spatial_data_size": 0, - "couch_spatial_disk_size": 0, - "couch_views_actual_disk_size": 0, - "couch_views_data_size": 0, - "curr_items": 21118, - "curr_items_tot": 42167, - "ep_bg_fetched": 0, - "get_hits": 0, - "mem_used": 63213888, - "ops": 0, - "vb_active_num_non_resident": 0, - "vb_replica_curr_items": 21049 - }, - "uptime": "788913", - "memoryTotal": 8327258112, - "memoryFree": 1855901696, - "mcdMemoryReserved": 6353, - "mcdMemoryAllocated": 6353 - }, - { - "couchApiBaseHTTPS": "https://node1.:18092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "couchApiBase": "http://node1.:8092/travel-sample%2B85ff541d1f4cfbc9e67cda3db698cac6", - "clusterMembership": "active", - "recoveryType": "none", - "status": "healthy", - "otpNode": "ns_1@node1.", - "thisNode": true, - "hostname": "node1.:8091", - "nodeUUID": "87a797d06f374f8006cc4a3a683db4e1", - "clusterCompatibility": 524288, - "version": "8.0.0-1649-enterprise", - "os": "aarch64-unknown-linux-gnu", - "cpuCount": 4, - "ports": { - "direct": 11210, - "httpsMgmt": 18091, - "httpsCAPI": 18092, - "distTCP": 21100, - "distTLS": 21150 - }, - "services": [ - "cbas", - "index", - "kv", - "n1ql" - ], - "nodeEncryption": false, - "nodeEncryptionClientCertVerification": false, - "addressFamilyOnly": false, - "configuredHostname": "node1.:8091", - "addressFamily": "inet", - "externalListeners": [ - { - "afamily": "inet", - "nodeEncryption": false - } - ], - "serverGroup": "Group 1", - "replication": 1, - "nodeHash": 72627629, - "systemStats": { - "cpu_utilization_rate": 10.24295140934561, - "cpu_stolen_rate": 0, - "swap_total": 2147479552, - "swap_used": 396525568, - "mem_total": 8327258112, - "mem_free": 1854889984, - "mem_limit": 8327258112, - "cpu_cores_available": 4, - "allocstall": 37181 - }, - "interestingStats": { - "cmd_get": 0, - "couch_docs_actual_disk_size": 44320702, - "couch_docs_data_size": 32823159, - "couch_spatial_data_size": 0, - "couch_spatial_disk_size": 0, - "couch_views_actual_disk_size": 0, - "couch_views_data_size": 0, - "curr_items": 21036, - "curr_items_tot": 42230, - "ep_bg_fetched": 0, - "get_hits": 0, - "index_data_size": 38186104, - "index_disk_size": 23976600, - "mem_used": 62882016, - "ops": 0, - "vb_active_num_non_resident": 0, - "vb_replica_curr_items": 21194 - }, - "uptime": "788913", - "memoryTotal": 8327258112, - "memoryFree": 1854889984, - "mcdMemoryReserved": 6353, - "mcdMemoryAllocated": 6353 - } - ], + "nodes": "", "stats": { "uri": "/pools/default/buckets/travel-sample/stats", "directoryURI": "/pools/default/buckets/travel-sample/stats/Directory", @@ -303,7 +57,6 @@ }, "authType": "sasl", "autoCompactionSettings": false, - "replicaIndex": false, "rank": 0, "enableCrossClusterVersioning": false, "versionPruningWindowHrs": 720, @@ -314,22 +67,44 @@ "rawRAM": 209715200 }, "basicStats": { - "quotaPercentUsed": 30.08984120686849, + "quotaPercentUsed": 21.78021494547526, "opsPerSec": 0, "diskFetches": 0, - "itemCount": 63343, - "diskUsed": 148563968, - "dataUsed": 98633707, - "memUsed": 189308912, + "itemCount": 63321, + "diskUsed": 128995011, + "dataUsed": 128995011, + "memUsed": 137029264, "vbActiveNumNonResident": 0 }, "evictionPolicy": "fullEviction", "durabilityMinLevel": "none", - "pitrEnabled": false, - "pitrGranularity": 600, - "pitrMaxHistoryAge": 86400, + "storageQuotaPercentage": 50, + "historyRetentionSeconds": 0, + "historyRetentionBytes": 0, + "historyRetentionCollectionDefault": true, + "magmaKeyTreeDataBlockSize": 4096, + "magmaSeqTreeDataBlockSize": 4096, + "continuousBackupEnabled": false, + "continuousBackupInterval": 2, + "continuousBackupLocation": "", "conflictResolutionType": "seqno", "maxTTL": 0, "compressionMode": "passive", - "accessScannerEnabled": false + "expiryPagerSleepTime": 600, + "memoryLowWatermark": 75, + "memoryHighWatermark": 85, + "durabilityImpossibleFallback": "disabled", + "warmupBehavior": "background", + "invalidHlcStrategy": "error", + "hlcMaxFutureThreshold": 3900, + "dcpConnectionsBetweenNodes": 1, + "accessScannerEnabled": true, + "encryptionAtRestInfo": { + "dataStatus": "unencrypted", + "dekNumber": 0, + "issues": [] + }, + "encryptionAtRestKeyId": -1, + "encryptionAtRestDekRotationInterval": 2592000, + "encryptionAtRestDekLifetime": 31536000 } \ No newline at end of file diff --git a/preview/HEAD.yml b/preview/HEAD.yml new file mode 100644 index 0000000000..017c256160 --- /dev/null +++ b/preview/HEAD.yml @@ -0,0 +1,8 @@ +override: + asciidoc: + attributes: + kroki-server-url: http://127.0.0.1:8000 + kroki-fetch-diagram: true + + + From d470b9b308107eafb3e1d95ce727f3e51663d613 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 15 May 2025 13:50:29 -0400 Subject: [PATCH 13/17] Minor fix --- .../pages/security/native-encryption-at-rest-overview.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 93e02e0c69..99d64e64e7 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -117,7 +117,7 @@ As with AWS KMS, using a KMIP-compliant KMS enhances security by storing the enc If you use a MKIP KMS encryption key as a KEK, you can have the KMS decrypt keys that the KEK encrypted for you. This measure improves security because the KMS does not have to send a copy of its encryption key to Couchbase Server. Using a KMIP-compatile KMS also has the same downside--Couchbase Server may report errors due to KMS downtime or network issues. -Couchbase Server will report errors because it cannot decrypt data without the KMS's encryption keys. +Couchbase Server cannot decrypt data without the KMS's encryption keys. Also, depending on the KMS implementation and its location, decrypting data could introduce performance issues due to latency. From 500c034041416f2f4833b290bb69df4d5708d303 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 15 May 2025 16:09:31 -0400 Subject: [PATCH 14/17] Minor edits and fixes --- .../native-encryption-at-rest-overview.adoc | 28 ++++++------------- .../manage-native-encryption-at-rest.adoc | 6 ++-- .../manage-encryption-keys.adoc | 8 +++--- .../manage-system-encryption-at-rest.adoc | 1 + 4 files changed, 16 insertions(+), 27 deletions(-) diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 99d64e64e7..86876ecfa5 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -12,8 +12,8 @@ For steps to take when managing this feature, see xref:manage:manage-security/ma [#keys] == Encryption-at-Rest Keys -To encrypt data at rest, you must create at least one encryption key. -Couchbase Server uses the keys you create directly to generate Data Encryption Keys (DEKs) which it uses to encrypt the information it stores on disk. +To encrypt data in a bucket at rest, you must create at least one encryption key. +Couchbase Server uses the keys you create directly to encrypt Data Encryption Keys (DEKs) which it creates and uses to encrypt the information it stores on disk. This two-layer system lets Couchbase Server manage the rotation and deletion of the DEKs. You have two main choices to make when creating an encryption key: @@ -52,12 +52,12 @@ This configuration is useful in multi-tenancy configurations where each customer In addition to data, you can encrypt audit, logs, and most configuration data. You can enable encrypting each type of information separately. -Each of these types of data can have its own encryption key. - +You can choose to use an encryption-at-rest key or the database's master password to encrypt the data. +By default, Couchbase Server uses the database's master password to configuration data. [NOTE] ==== -Some configuration data is not encrypted. +Some configuration cannot be encrypted. This includes: * Bootstrap information @@ -65,18 +65,6 @@ This includes: * Prometheus configuration, metric data, and tokens used to gather metrics ==== - -You can use a single encryption key for encrypting all data, logs, audit, and configuration information. -This configuration is easy to configure, but is not flexible. -For more complex environments (such as multi-tenancy databases), you can choose to create multiple encryption keys. -You then choose keys to encrypt one or more buckets as well as logs, audits, and configuration data. -You can also create layers of encryption keys. -For example, you can have a primary encryption key that's managed by an external key management system (see <<#kms>>). -Then you use the primary key to encrypt additional encryption keys. -You can then use these keys to encrypt bucket, log, configuration, or audit data. - - - [#kms] == Encryption Key Management Services @@ -132,13 +120,13 @@ Also, because Couchbase Server stores the encryption key locally, it does not pr Couchbase Server does not limit you to a single KMS. You can choose any KMS for each encryption key. For example, you can choose to create one or more encryption keys managed by AWS KMS or a KMIP-compliant KMS. -Use these keys as Key Encryption Keys (KEKs) to encrypt keys that Couchbase Server manages. +Then use these keys as Key Encryption Keys (KEKs) to encrypt keys that Couchbase Server manages. This method adds a layer of security to the locally managed encryption keys while reducing the number of key retrievals from the remote KMS. -Remember that you should not use an AWS managed key to directly encrypt data because of the latency of fetching the key remotely. +Remember that you should not use an AWS managed key to directly encrypt data because of the latency of fetching keys from a remote KMS. The following diagram shows a possible configuration using a single primary encryption key hosted by AWS KMS. This key encryption key encrypts five encryption-at-rest keys managed by Couchbase Server. -Each of these keys are assigned to different types of data that's written to disk: Audit, Config, and Log data and the data stored in two buckets named "A" and "B." +Each of these keys are assigned to different types of data that's written to disk: audit, configuration, and log data and the data stored in two buckets named A and B. Each node in the cluster has Data Encryption Keys (DEKs) encrypted by the intermediate encryption keys managed by Couchbase Server. For simplicity, the diagram only shows two nodes. However, this configuration can scale to any size cluster. diff --git a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc index 0dbbb7791d..691fb50bde 100644 --- a/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc +++ b/modules/manage/pages/manage-security/manage-native-encryption-at-rest.adoc @@ -103,7 +103,7 @@ AWS:: [start=8] . Enter the Amazon Resource Name (ARN) for the encryption key and the AWS Region in which the KMS is located. . Choose whether to use the AWS Instance Metadata Service. -Enable this option if your Couchbase Server cluster runs on AWS EC2 instances to allow it to access other AWS services. +Enable this option if your Couchbase Server cluster runs on AWS EC2 instances to allow it to connect to other AWS services. . Enter the paths on your cluster where you have stored the AWS credential, configuration, and profile files. . Verify that your settings work by clicking the btn:[Test Encryption Key Settings] button. @@ -313,7 +313,7 @@ curl -X GET -u Administrator:password \ | jq '{encryptionAtRestInfo, encryptionAtRestKeyId}' ---- -Ther esult of running this command looks like this: +The result of running this command looks like this: [source, json] ---- @@ -370,7 +370,7 @@ To delete an encryption key using the Couchbase Server Web Console: . Click the menu:Encryption at Rest[] tab. . Click the encryption key you want to delete. . Click the btn:[Delete] button next to the key you want to delete. -. In the *Confirm Delete dialog*, click btn:[Delete Encryption Key] to confirm you want to delete the key. +. In the *Confirm Delete* dialog, click btn:[Delete Encryption Key] to confirm you want to delete the key. ### Delete an Encryption Key Using the REST API diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc index b8a016414b..373278ca58 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-encryption-keys.adoc @@ -207,7 +207,7 @@ Keys managed by a KMIP-compatible KMS:: Keys Managed by AWS:: * `keyANN` is the identity of the key in the AWS KMS. -* The `profile`, `credentialsFile`, and `configFile` hold the credentials Couchbase Server uses to authenticaste with AWS KMS. +* The `profile`, `credentialsFile`, and `configFile` hold the credentials Couchbase Server uses to authenticate with AWS KMS. These values are empty when Couchbase Server uses IAM to authenticate with AWS instead of stored credentials. [[create-key]] @@ -273,7 +273,7 @@ EOF NOTE: Updating a key has the same required fields as the creating a new key. For example, you must supply the `name` field, even if you want the key's name to remain the same. -Any value you do not supply in the update call is set ot the default value (if any) or is left empty, overwriting any existing value. +Couchbase Server sets any value you do not supply in the update call to the default value (if any) or is left empty, overwriting any existing value. :priv-link: create-privs @@ -299,7 +299,7 @@ Allowed values for this list are: * `"bucket-encryption"`: Can encrypt any bucket in the cluster. * `"bucket-encryotion-"`: Can encrypt the bucket named `bucket-name`. You can have multiple entries so the key can encrypt multiple buckets. -* `"config-encryption"`: Can encrypt onfiguration information. +* `"config-encryption"`: Can encrypt configuration information. * `"log-encryption"`: Can encrypt logs. * `"audit-encryption"`: Can encrypt audit data. @@ -487,7 +487,7 @@ When having Couchbase Server manage the key, the `data` object has the following * `autoRotation` (Boolean, optional): Controls whether Couchbase Server automatically rotates the key. See xref:learn:security/native-encryption-at-rest-overview.adoc#rotation-expiration[Encryption Key Rotation and Expiration] for more information about key rotation. -Defaults to `true`, which means that the key will be automatically rotated. +Defaults to `true`, which means that Couchbase Server automatically rotates the key. In this case, you must supply both the `nextRotationTime` and `rotationIntervalInDays` fields as well. * `encryptWith` (optional): How Couchbase Server should encrypt this key for storage. The two options are: diff --git a/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc b/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc index c163b404c4..06599577a1 100644 --- a/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc +++ b/modules/rest-api/pages/security/encryption-at-rest/manage-system-encryption-at-rest.adoc @@ -431,3 +431,4 @@ The output from the previous example looks like this: NOTE: As with the previous example, the values of the `audit.info.dataStatus` and `log.info.dataStatus` do not match the `encryptionMethod` setting. It takes time for Couchbase Server to decrypt the data when you turn off encryption-at-rest. + From f731c1ce70cd701e4f1e1ad457d52df3fba1793d Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 15 May 2025 16:13:04 -0400 Subject: [PATCH 15/17] Standards compliance --- modules/rest-api/pages/rest-buckets-summary.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/rest-api/pages/rest-buckets-summary.adoc b/modules/rest-api/pages/rest-buckets-summary.adoc index dab280645e..da6c488e07 100644 --- a/modules/rest-api/pages/rest-buckets-summary.adoc +++ b/modules/rest-api/pages/rest-buckets-summary.adoc @@ -1,5 +1,5 @@ = Getting Bucket Information -:description: Information on buckets defined on the cluster can be retrieved, by means of the REST API. +:description: information about buckets defined on the cluster can be retrieved, by means of the REST API. :page-topic-type: reference :page-aliases: rest-bucket-info @@ -18,8 +18,8 @@ GET /pools/default/buckets/ [#description] == Description -`GET /pools/default/buckets` retrieves information on all buckets defined on the cluster. -If the `` path-parameter is added, only information on the specified bucket is retrieved. +`GET /pools/default/buckets` retrieves information about all buckets defined on the cluster. +If the `` path-parameter is added, only information about the specified bucket is retrieved. [#curl-syntax] From 6c59b20b06ce3fd4fac98ab553355b910285c07a Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Thu, 15 May 2025 16:45:42 -0400 Subject: [PATCH 16/17] Fixed link in the What's New page. Other misc edits. --- .../partials/new-features-80.adoc | 6 +++--- .../native-encryption-at-rest-overview.adoc | 19 ++++++++++++------- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/modules/introduction/partials/new-features-80.adoc b/modules/introduction/partials/new-features-80.adoc index 7e7fa204cc..cf63221f86 100644 --- a/modules/introduction/partials/new-features-80.adoc +++ b/modules/introduction/partials/new-features-80.adoc @@ -165,8 +165,8 @@ and the repository resumed, where it will now execute the tasks from its new pla === Security -https://jira.issues.couchbase.com/browse/MB-16143#icft=MB-16143[MB-16143]:: +https://jira.issues.couchbase.com/browse/MB-16143[MB-16143]:: Couchbase Server Enterprise now supports native encryption at rest. -You can encrypt data, audits, and most logging and configuration information on a per-bucket basis. +You can encrypt bucket data, audits, and most logging and configuration information. You choose which buckets to encrypt and which remain unencrypted. -See XX for more information. \ No newline at end of file +See xref:learn:security/native-encryption-at-rest-overview.adoc[] for more information. diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc index 86876ecfa5..b943b80a2f 100644 --- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc +++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc @@ -27,13 +27,18 @@ You can restrict the key to encrypting one or more types of data: + ** **Other encryption keys** -Makes the key a Key Encryption Key (KEK). -You use a KEK to encrypt other encryption keys instead of relying on the database's master password. -** **Data**. -You can use the key to encrypt all data or restrict its use to specific buckets. -** **Configuration** +Enabling a key to encrypt other encryption-at-rest keys makes it a Key Encryption Key (KEK). +You use a KEK to encrypt other encryption keys instead of encrypting them with the database's master password. +** **Buckets** +You can enable a key to encrypt all buckets or restrict it to specific buckets. +** **Configuration** +By default, Couchbase Server uses the database's master password to encrypt configuration data. +You can choose to use an encryption-at-rest key instead. ** **Logs** +You can choose to use an encryption-at-rest key to encrypt logs. +You can also use the database's master password instead. ** **Audits** +As with configuration and log data, you can choose to use an encryption-at-rest key or the database master password to encrypt audit data. The following sections explain these choices in greater detail. @@ -51,8 +56,8 @@ This configuration is useful in multi-tenancy configurations where each customer == Encrypting Audit, Logs, and Configuration Data In addition to data, you can encrypt audit, logs, and most configuration data. -You can enable encrypting each type of information separately. -You can choose to use an encryption-at-rest key or the database's master password to encrypt the data. +You enable encrypting each type of information separately. +You can use either an encryption-at-rest key or the database's master password to encrypt data. By default, Couchbase Server uses the database's master password to configuration data. [NOTE] From c66c2f31ef1ba0d6c3ec0107a2352bb697e69606 Mon Sep 17 00:00:00 2001 From: Gary Gray <137797428+ggray-cb@users.noreply.github.com> Date: Fri, 16 May 2025 09:23:56 -0400 Subject: [PATCH 17/17] Reverting changes to Roles page. Update to roles are in another branch. --- modules/learn/pages/security/roles.adoc | 1000 ++++++++++------------- 1 file changed, 445 insertions(+), 555 deletions(-) diff --git a/modules/learn/pages/security/roles.adoc b/modules/learn/pages/security/roles.adoc index 69ff4dc1f2..b4133f9536 100644 --- a/modules/learn/pages/security/roles.adoc +++ b/modules/learn/pages/security/roles.adoc @@ -1,59 +1,37 @@ = Roles -:description: pass:q[Roles grant users access to one or more resources.] +:description: pass:q[A Couchbase role permits one or more resources to be accessed according to defined privileges.] :page-aliases: security:security-roles,security:concepts-rba,security:concepts-rba-for-apps,security:rbac-ro-user,learn:security/resources-under-access-control,security:security-resources-under-access-control -:page-toclevels: 3 [abstract] {description} -Administrators assign roles to users to enable them to perform the tasks they need to carry out when using Couchbase Server. - [#roles-and-privileges] == Roles and Privileges -Each role grants one or more privileges to interact with a resource. -A Privilege is an action that a user can take with a resource. -They include: - -* Execute -* Flush -* List -* Manage -* Read -* Write - -Roles provide a set of privilidges for interacting with a resource. -For example, the Data Writer role grants a user the ability to write data. -This ability can be limited to specific collections, scopes, or buckets. -This role does not grant the user the ability to read data. -The Data Reader role grants that ability. - -An administrator can grant a user a set of roles to precesely tailor their privildges so they can perform their tasks in the database. +Couchbase roles each have a fixed association with a set of one or more privileges. +Each privilege is associated with a resource. +Privileges are actions such as *Read*, *Write*, *Execute*, *Manage*, *Flush*, and *List*; or a combination of some or all of these. +Roles are of the following kinds: +* Administative: Associated with cluster-wide privileges. +Some of these roles are for administrators; who might manage cluster-configurations; or read statistics; or enforce security. +Others are for users and user-defined applications that require access to specific, cluster-wide resources. +* Bucket: Associated with bucket administration, collection management, and application access. +Roles in this category can each be applied to one, to multiple, or to all buckets on the cluster. -Roles fall into the following categories: +* Data, Views, and XDCR: Associated with the Data Service. +This includes the reading, writing, monitoring, backing-up, and restoring of data; the administration of Views; and the administration of Cross Data-Center Replication (XDCR). -* Administative roles have cluster-wide privileges. -Some of these roles are for administrators who manage cluster-configurations, read statistics, or enforce security. -Others are for users and user-defined applications that must access cluster-wide resources. - -* Bucket: rolees have priviledges for bucket administration, collection management, and application access. -Roles in this category grant priviledges to one, multiple, or all buckets in the cluster. - -* Data, Views, and XDCR roles have priviledges associated with the Data Service. -These priviledges include reading, writing, monitoring, backing-up, and restoring data. -They also allow the administration of Views and Cross Datacenter Replication (XDCR) connections. - -* Other Services roles are for the administration of services other than the Data Service. -These roles have the following subcategories: Query & Index, Search, Analytics, and Backup. +* Other Services: Roles for the administration of services other than the Data Service. +These roles are organized under the following categories: Query & Index, Search, Analytics, and Backup. (Eventing administration is covered within the Administrative category.) -* Mobile roles are associated with the administration of Sync Gateway. +* Mobile: Associated with the administration of Sync Gateway. -A user (including administrators and applications) must authneticate when they attempt to access a resource. -Couchbase Server checks the roles and privileges associated with the user's credentials. +When a user (meaning either an administrator or an application) attempts to access a resource, they must authenticate. +The roles and privileges associated with the user-credentials thereby presented are checked by Couchbase Server. If the associated roles contain privileges that support the kind of access that is being attempted, access is granted; otherwise, it is denied. [#roles-in-relation-to-buckets] @@ -73,62 +51,53 @@ For detailed information on scopes and collections, see xref:learn:data/scopes-a [#commonly-used-roles] === Commonly Used Roles -Couchbase Server users can be categorized as administrators, developers, and applications. -Couchbase Server has several roles for each of these user categories. +Couchbase Server users can largely be categorized as administrators, developers, and applications. +Each user-category is supported by a different subset of roles. -Administrators:: -Users with any of the administrator roles can log into Couchbase Server Web Console and perform administrative tasks. -Besides the Full Admin role, these roles do not grant the ability to read or write data. -+ -The administrative roles grant their uses the ability to carry out specific tasks. -For example, a user with the Cluster Admin role can manage of all cluster features except security. -Users with the Read-Only Admin role can only read statistics. -The Bucket Admin role allows management only of one or more buckets. -See the <<#admin-roles>> for details. +* Administrators. +Able to log into Couchbase Web Console and perform administrative tasks; but unable to read or write data. + -NOTE: The user interface of the Couchbase Web Console changes based on the administrative role the user has. -For example, only the Full Admin role lets a user access the entire **Security** screen. -Users with either the Local User Admin or the External User Admin roles can only see the **Users & Groups** tab on this screen. - -Applications:: -Application users are can read or write data. -They cannot log into Couchbase Server Web Console or modify cluster settings. -For example, the Data Reader and Data Writer roles lets the user read and write one or more collections, within one or more scopes, within one or more buckets. -Other application roles are Application Access, Data Writer, Data Backup & Restore, and Data Monitor. -See <<#>> for details on each. - -Developers:: +The administrative tasks available are divided into multiple `admin` roles. +For example, the *Cluster Admin* role allows the management of all cluster features except security; while the *Read-Only Admin* role allows only the reading of statistics; and the *Bucket Admin* role allows management only of one or more buckets. +See the *Admin* roles listed below for full details. +Note that depending on the administrator's assigned roles, the content of Couchbase Web Console changes: for example, the entire *Security* screen is only visible to *Full Admin* administrators; and to administrators who possess both the *Local User Security Admin* and the *External User Security Admin* roles. + +* Applications. +Able to read or write data; but unable to log into Couchbase Web Console, or in any way modify cluster-settings. +For example, the *Data Reader* and *Data Writer* roles allows data to be respectively read and written to one or more collections, within one or more scopes, within one or more buckets. +Other application-intended roles are *Application Access*, *Data Writer*, *Data Backup & Restore*, and *Data Monitor*. +See below for details on each. + +* Developers. Can be given a selection of roles, allowing the right degree of data and console access. For example, the *Read-Only Admin* role allows the reading of cluster-statistics, while the *Data Read* and *Data Write* roles allow access to data on one or more buckets. -The following list contains all roles supported by Couchbase Server Enterprise Edition. +The following list contains all roles supported by Couchbase Server, Enterprise Edition. +Each role is explained by means of a description and (in most cases) a table: the table lists the privileges in association with resources. +The header of each table states the role's *name*, followed by its alias name in parentheses: alias names are used in commands and queries. In each table-body, where a privilege is associated with a resource, this is indicated with a check-mark. +Where a privilege is not associated with a resource (or where association would not be applicable), this is indicated with a cross. +Resources not referred to in a particular table have no privileges associated with them in the context of the role being described. Note that some roles grant access to Couchbase Web Console; while others do not. The set of features displayed within the console varies, according to role. -also that any authentication failure will be logged in the log file for the resource on which access was attempted. +Note also that any authentication failure will be logged in the log file for the resource on which access was attempted. See xref:manage:manage-logging/manage-logging.adoc[Manage Logging], for detailed information on using log files. - -[#admin-roles] -== Administrative Roles - -The following roles grant users the ability to administer some aspects of Couchbase Server. - [#full-admin] -=== Full Admin +== Full Admin -The Full Admin role (an Administrative role) grants full access to all Couchbase Server features and resources, including those of security. -The role allows access to Couchbase Server Web Console, and allows the reading and writing of bucket-data. +The *Full Admin* role (an Administrative role) supports full access to all Couchbase-Server features and resources, including those of security. +The role allows access to Couchbase Web Console, and allows the reading and writing of bucket-data. This role is also available in Couchbase Server Community Edition. [#cluster-admin] -=== Cluster Admin +== Cluster Admin -The Cluster Admin role (an Administrative role) lets the user manage of all cluster features except security. -The role allows access to Couchbase Server Web Console, but does not permit the writing of data. +The *Cluster Admin* role (an Administrative role) allows the management of all cluster features except security. +The role allows access to Couchbase Web Console, but does not permit the writing of data. [#table_cluster_admin_role,cols="15,8,8,8,8",hrows=3] |=== @@ -167,13 +136,11 @@ The role allows access to Couchbase Server Web Console, but does not permit the ^| image:introduction/no.png[] |=== - - [#local-user-security-admin] -=== Local User Admin +== Local User Security Admin -The Local User Admin role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. -The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, *Local User Admin*, or the *External User Admin* role; and does not permit the administrator to change their own role (which therefore remains *Local User Security Admin*). +The *Local User Security Admin* role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. +The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, the *Local User Security Admin*, or the *External User Security Admin* role; and does not permit the administrator to change their own role (which therefore remains *Local User Security Admin*). The role supports access to Couchbase Web Console, but does not support the reading of data. [#table_security_admin_local_role,cols="15,8,8,8,8",hrows=3] @@ -214,7 +181,7 @@ The role supports access to Couchbase Web Console, but does not support the read |=== [#external-user-security-admin] -=== External User Admin +== External User Security Admin The *External User Security Admin* role (an Administrative role) allows the management of external user roles and the reading of all cluster statistics. The role does not permit the granting of the *Full Admin*, the *Read-Only Admin*, the *Local User Security Admin*, or the *External User Security Admin* role; and does not permit the administrator to change their own role (which therefore remains *External User Security Admin*). @@ -222,7 +189,7 @@ The role supports access to Couchbase Web Console, but does not support the read [#table_security_admin_external_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: External User Admin (`security_admin_external`) +5+^| Role: External User Security Admin (`security_admin_external`) .2+^h| Resources 4+^h| Privileges @@ -258,11 +225,16 @@ The role supports access to Couchbase Web Console, but does not support the read |=== [#read-only-admin] -=== Read-Only Admin +== Read-Only Admin -The Read-Only Admin role (an Administrative role) grants the user the ability to read Couchbase Server statistics. +The *Read-Only Admin* role (an Administrative role) supports the reading of Couchbase Server statistics. This information includes registered usernames with roles and authentication domains, but excludes passwords. +ifeval::['{page-component-version}' == '7.6'] +Since Couchbase Server version 7.6.2, users with this role can also read Backup Service data to monitor backup plans and tasks. +endif::[] +ifeval::['{page-component-version}' != '7.6'] Users with this role can also read Backup Service data to monitor backup plans and tasks. +endif::[] The role allows access to Couchbase Server Web Console. This role is also available in Couchbase Server Community Edition. @@ -303,67 +275,7 @@ This role is also available in Couchbase Server Community Edition. ^| image:introduction/no.png[] ^| image:introduction/no.png[] -^| Backup Service (tasks and plans) -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -|=== - - -[#security-admin] -=== Security Admin - -The Security Admin role grants the user the ability to read Couchbase Sever settings for the cluster, buckets and administrator settings. -It also grants the ability to edits other user's roles with the execption of granting or revoking the Full Admin or Security Admin roles. -This role does not grant the user the ability to edit their own roles. - -The role allows access to Couchbase Server Web Console. - -[#table_security_admin_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Security Admin (`security_admin`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Cluster -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| UI (except Passwords) -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Security (except Passwords) -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Data -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Backup Service (tasks and plans) -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] - -^| Roles (except user's own roles, and Full Admin or Security Admin) +^| Backup Service (tasks and plans) [.status]#Couchbase Server 7.6.2# ^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] @@ -372,11 +284,11 @@ The role allows access to Couchbase Server Web Console. |=== [#external-stats-reader] -=== External Stats Reader +== External Stats Reader -The External Stats Reader role (an Administrative role) grants access to the `/metrics` and `/prometheus_sd_config` endpoints for Prometheus integration. +The *External Stats Reader* role (an Administrative role) grants access to the `/metrics` and `/prometheus_sd_config` endpoints for Prometheus integration. All statistics for all services can be read. -The role does not grant access to Couchbase Web Console. +The role does not allow access to Couchbase Web Console. [#table_external_stats_reader_role,cols="15,8,8,8,8",hrows=3] |=== @@ -398,7 +310,7 @@ The role does not grant access to Couchbase Web Console. |=== [#xdcr-admin] -=== XDCR Admin +== XDCR Admin The *XDCR Admin* role (an XDCR role) allows use of XDCR features, to create cluster references and replication streams. The role allows access to Couchbase Web Console and allows the reading of data. @@ -452,11 +364,8 @@ The role allows access to Couchbase Web Console and allows the reading of data. ^| image:introduction/no.png[] |=== -[#query-roles] -== Query & Index Roles - [#query-curl-access] -=== Query Curl Access +== Query Curl Access The *Query Curl Access* role (a Query & Index role) allows the {sqlpp} CURL function to be executed by an externally authenticated user. The user can access Couchbase Web Console, but cannot read data, other than that returned by the {sqlpp} CURL function. @@ -505,7 +414,7 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Quer |=== [#query-system-catalog] -=== Query System Catalog +== Query System Catalog The *Query System Catalog* role (a Query & Index role) allows information to be looked up by means of {sqlpp} in the system catalog: this includes `system:indexes`, `system:prepareds`, and tables listing current and past queries. This role is designed for troubleshooters, who need to debug queries. @@ -561,7 +470,7 @@ The role allows access to Couchbase Web Console, but does not permit the reading |=== [#manage-global-functions] -=== Manage Global Functions +== Manage Global Functions The *Manage Global Functions* role (a Query & Index role) allows global {sqlpp} functions to be managed. The user can access Couchbase Web Console, but cannot read data. @@ -598,7 +507,7 @@ The user can access Couchbase Web Console, but cannot read data. |=== [#execute-global-functions] -=== Execute Global Functions +== Execute Global Functions The *Execute Global Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. The user can access Couchbase Web Console, but cannot read data. @@ -635,7 +544,7 @@ The user can access Couchbase Web Console, but cannot read data. |=== [#manage-scope-functions] -=== Manage Scope Functions (Query and Index) +== Manage Scope Functions (Query and Index) The *Manage Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be managed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data. @@ -671,15 +580,15 @@ The user can access Couchbase Web Console, but cannot read data. ^| image:introduction/no.png[] |=== -[#query-select] -=== Query Select +[#execute-scope-functions] +== Execute Scope Functions -The *Query Select* role (which is a Query & Index role) allows the SELECT statement to be executed per collection, given corresponding specifications for bucket and scope. -This role allows access to Couchbase Web Console; it also supports the reading of data, and of bucket settings. +The *Execute Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be executed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. -[#table_query_select_role,cols="15,8,8,8,8",hrows=3] +[#table_execute_scope_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Select (`query_select`) +5+^| Role: Execute Scope Functions (`query_execute_functions`) .2+^h| Resources 4+^h| Privileges @@ -689,23 +598,11 @@ This role allows access to Couchbase Web Console; it also supports the reading o ^h| *Execute* ^h| *Manage* -^| Bucket : {sqlpp}, SELECT -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/yes.png[] -^| image:introduction/no.png[] +^| Collection, Bucket, Scope: {sqlpp}, udf ^| image:introduction/no.png[] ^| image:introduction/no.png[] - -^| Bucket Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -720,16 +617,15 @@ This role allows access to Couchbase Web Console; it also supports the reading o ^| image:introduction/no.png[] |=== -[#query-update] -== Query Update +[#manage-global-external-functions] +== Manage Global External Functions -The *Query Update* role (which is a Query & Index role) allows the UPDATE statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. -It allows the reading of bucket settings. +The *Manage Global External Functions* role (a Query & Index role) allows global external language functions to be managed. +The user can access Couchbase Web Console, but cannot read data. -[#table_query_update_role,cols="15,8,8,8,8",hrows=3] +[#table_manage_global_external_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Update (`query_update`) +5+^| Role: Manage Global External Functions (`query_manage_global_external_functions`) .2+^h| Resources 4+^h| Privileges @@ -739,23 +635,11 @@ It allows the reading of bucket settings. ^h| *Execute* ^h| *Manage* -^| Bucket : {sqlpp}, UPDATE -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs +^| {sqlpp}, udf_external ^| image:introduction/no.png[] -^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] - -^| Bucket Settings ^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -770,16 +654,15 @@ It allows the reading of bucket settings. ^| image:introduction/no.png[] |=== -[#query-insert] -== Query Insert +[#execute-global-external-functions] +== Execute Global External Functions -The *Query Insert* role (which is a Query & Index role) allows the INSERT statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. -It allows the reading of bucket settings. +The *Execute Global External Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. +The user can access Couchbase Web Console, but cannot read data. -[#table_query_insert_role,cols="15,8,8,8,8",hrows=3] +[#table_execute_global_external_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Insert (`query_insert`) +5+^| Role: Execute Global External Functions (`query_execute_global_external_functions`) .2+^h| Resources 4+^h| Privileges @@ -789,23 +672,11 @@ It allows the reading of bucket settings. ^h| *Execute* ^h| *Manage* -^| Bucket : {sqlpp}, INSERT -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs -^| image:introduction/no.png[] -^| image:introduction/yes.png[] +^| {sqlpp}, udf_external ^| image:introduction/no.png[] ^| image:introduction/no.png[] - -^| Bucket Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -820,16 +691,15 @@ It allows the reading of bucket settings. ^| image:introduction/no.png[] |=== -[#query-delete] -== Query Delete +[#manage-scope-external-functions] +== Manage Scope External Functions -The *Query Delete* role (which is a Query & Index role) allows the DELETE statement to be executed per collection, given corresponding specifications for bucket and scope. -The role supports access to Couchbase Server Web Console, and allows the deletion of data. -It allows the reading of bucket settings. +The *Manage Scope External Functions* role (a Query & Index role) allows external language functions to be managed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. -[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] +[#table_manage_external_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Delete (`query_delete`) +5+^| Role: Manage Scope External Functions (`query_manage_external_functions`) .2+^h| Resources 4+^h| Privileges @@ -839,24 +709,11 @@ It allows the reading of bucket settings. ^h| *Execute* ^h| *Manage* - -^| Bucket : {sqlpp}, DELETE -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| Bucket : Docs Delete +^| Collection, Bucket, Scope: {sqlpp}, udf_external ^| image:introduction/no.png[] ^| image:introduction/no.png[] -^| image:introduction/yes.png[] ^| image:introduction/no.png[] - -^| Bucket Settings ^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -871,19 +728,15 @@ It allows the reading of bucket settings. ^| image:introduction/no.png[] |=== +[#execute-scope-external-functions] +== Execute Scope External Functions -[#query-sequential-scan] -== Query Use Sequential Scan - -The *Query Use Sequential Scan* role, located under Query & Index in the Web Console's roles list, allows users' queries to perform a sequential scan of a keyspace. -The query planner only decides to use a sequential scan when there is no suitable index for the keyspace. -Only queries by users with this role can use a sequential scan to access data because scanning a large unindexed keyspace can be expensive. -This role does not grant the user the ability to read or mutate data or access to the Web Console. -Administrators' queries automatically have permission to perform sequential scans when necessary. +The *Execute Scope External Functions* role (a Query & Index role) allows external language functions to be executed for a given scope, given corresponding specification of bucket. +The user can access Couchbase Web Console, but cannot read data. -[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] +[#table_execute_external_functions_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Use Sequential Scan (`query_use_sequential_scans`) +5+^| Role: Execute Scope External Functions (`query_execute_external_functions`) .2+^h| Resources 4+^h| Privileges @@ -893,46 +746,34 @@ Administrators' queries automatically have permission to perform sequential scan ^h| *Execute* ^h| *Manage* -^| Sequential Scans +^| Collection, Bucket, Scope: {sqlpp}, udf_external ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/yes.png[] ^| image:introduction/no.png[] -^| Bucket : Docs -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Settings -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - ^| UI -^| image:introduction/no.png[] +^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| Pools -^| image:introduction/no.png[] +^| image:introduction/yes.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] |=== -[#query-manage-index] -== Query Manage Index +[#analytics-reader] +== Analytics Reader -The *Query Manage Index* role (which is a Query & Index role) allows indexes to be managed per collection, given corresponding specifications for bucket and scope. -The role allows access to Couchbase Web Console, but does not permit the reading of data. +The *Analytics Reader* role (an Analytics role) allows querying of shadow data-sets. +The role allows access to Couchbase Web Console, and permits the reading of data. -[#table_query_manage_index_role,cols="15,8,8,8,8",hrows=3] +[#table_analytics_reader_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Query Manage Index (`query_manage_index`) +5+^| Role: Analytics Reader (`analytics_reader`) .2+^h| Resources 4+^h| Privileges @@ -942,29 +783,11 @@ The role allows access to Couchbase Web Console, but does not permit the reading ^h| *Execute* ^h| *Manage* -^| Bucket : {sqlpp}, INDEX -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] -^| image:introduction/yes.png[] - -^| Bucket Settings -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Bucket Statistics +^| Bucket : Analytics ^| image:introduction/yes.png[] ^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Index Settings ^| image:introduction/yes.png[] ^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] ^| UI ^| image:introduction/yes.png[] @@ -979,16 +802,15 @@ The role allows access to Couchbase Web Console, but does not permit the reading ^| image:introduction/no.png[] |=== +[#analytics-admin] +== Analytics Admin -[#execute-scope-functions] -=== Execute Scope Functions - -The *Execute Scope Functions* role (a Query & Index role) allows {sqlpp} and user defined functions to be executed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. +The *Analytics Admin* role (an Analytics role) allows management of dataverses; management of all Analytics Service links; and management of all datasets. +The role allows access to Couchbase Web Console, but does not permit the reading of data. -[#table_execute_scope_functions_role,cols="15,8,8,8,8",hrows=3] +[#table_analytics_admin_role,cols="15,8,8,8,8",hrows=3] |=== -5+^| Role: Execute Scope Functions (`query_execute_functions`) +5+^| Role: Analytics Admin (`analytics_admin`) .2+^h| Resources 4+^h| Privileges @@ -998,243 +820,19 @@ The user can access Couchbase Web Console, but cannot read data. ^h| *Execute* ^h| *Manage* -^| Collection, Bucket, Scope: {sqlpp}, udf +^| Dataverse : Analytics ^| image:introduction/no.png[] ^| image:introduction/no.png[] -^| image:introduction/yes.png[] ^| image:introduction/no.png[] - -^| UI ^| image:introduction/yes.png[] + +^| Bucket : Analytics ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] - -^| Pools ^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#manage-global-external-functions] -=== Manage Global External Functions - -The *Manage Global External Functions* role (a Query & Index role) allows global external language functions to be managed. -The user can access Couchbase Web Console, but cannot read data. - -[#table_manage_global_external_functions_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Manage Global External Functions (`query_manage_global_external_functions`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| {sqlpp}, udf_external -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#execute-global-external-functions] -=== Execute Global External Functions - -The *Execute Global External Functions* role (a Query & Index role) allows global {sqlpp} functions to be executed. -The user can access Couchbase Web Console, but cannot read data. - -[#table_execute_global_external_functions_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Execute Global External Functions (`query_execute_global_external_functions`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| {sqlpp}, udf_external -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#manage-scope-external-functions] -=== Manage Scope External Functions - -The *Manage Scope External Functions* role (a Query & Index role) allows external language functions to be managed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. - -[#table_manage_external_functions_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Manage Scope External Functions (`query_manage_external_functions`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Collection, Bucket, Scope: {sqlpp}, udf_external -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#execute-scope-external-functions] -=== Execute Scope External Functions - -The *Execute Scope External Functions* role (a Query & Index role) allows external language functions to be executed for a given scope, given corresponding specification of bucket. -The user can access Couchbase Web Console, but cannot read data. - -[#table_execute_external_functions_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Execute Scope External Functions (`query_execute_external_functions`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Collection, Bucket, Scope: {sqlpp}, udf_external -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -== Analytics Roles - -[#analytics-reader] -=== Analytics Reader - -The *Analytics Reader* role (an Analytics role) allows querying of shadow data-sets. -The role allows access to Couchbase Web Console, and permits the reading of data. - -[#table_analytics_reader_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Analytics Reader (`analytics_reader`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Bucket : Analytics -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] -^| image:introduction/no.png[] - -^| UI -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] - -^| Pools -^| image:introduction/yes.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -|=== - -[#analytics-admin] -=== Analytics Admin - -The *Analytics Admin* role (an Analytics role) allows management of dataverses; management of all Analytics Service links; and management of all datasets. -The role allows access to Couchbase Web Console, but does not permit the reading of data. - -[#table_analytics_admin_role,cols="15,8,8,8,8",hrows=3] -|=== -5+^| Role: Analytics Admin (`analytics_admin`) - -.2+^h| Resources -4+^h| Privileges - -^h| *Read* -^h| *Write* -^h| *Execute* -^h| *Manage* - -^| Dataverse : Analytics -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] - -^| Bucket : Analytics -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/no.png[] -^| image:introduction/yes.png[] - -^| Bucket : UI + +^| Bucket : UI ^| image:introduction/no.png[] ^| image:introduction/no.png[] ^| image:introduction/no.png[] @@ -1253,11 +851,8 @@ The role allows access to Couchbase Web Console, but does not permit the reading ^| image:introduction/no.png[] |=== -[#bucket-roles] -== Bucket Roles - [#bucket-admin] -=== Bucket Admin +== Bucket Admin The *Bucket Admin* role (which is a Bucket role) allows the management of all per bucket features (including starting and stopping XDCR). The role allows access to Couchbase Web Console, but does not permit the reading or writing of data. @@ -1306,7 +901,7 @@ The role allows access to Couchbase Web Console, but does not permit the reading |=== [#manage-scopes] -=== Manage Scopes +== Manage Scopes The *Manage Scopes* role (a Bucket role) allows the creation and deletion of scopes, and the creation and deletion of collections per scope, given the corresponding specification of bucket. The role allows no access to data, and does not permit access to Couchbase Web Console. @@ -1338,7 +933,7 @@ The role is intended for application use only. |=== [#application-access] -=== Application Access +== Application Access The *Application Access* role (a Bucket role) provides read and write access to data, per bucket. The role does not allow access to Couchbase Web Console: it is intended for applications, rather than users. @@ -1410,12 +1005,8 @@ Note that in versions of Couchbase Server prior to 5.5, this role was referred t ^| image:introduction/no.png[] |=== -== XDCR Roles - -The following roles give users access to XDCR settings and features. - [#xdcr-inbound] -=== XDCR Inbound +== XDCR Inbound The *XDCR Inbound* role (which is an XDCR role) allows the creation of inbound XDCR streams, per bucket. It does not allow access to Couchbase Web Console, and does not permit the reading of data. @@ -1459,12 +1050,8 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Repl ^| image:introduction/no.png[] |=== -== Mobile Roles - -The mobile roles give users access to Sync Gateway and related features. - [#sync-gateway] -=== Sync Gateway +== Sync Gateway The *Sync Gateway* role (which is a Mobile role) allows full access to data per bucket, as required by Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1544,7 +1131,7 @@ The user can, by means of Sync Gateway, read and write data, manage indexes and |=== [#sync-gateway-configurator] -=== Sync Gateway Architect +== Sync Gateway Architect The *Sync Gateway Architect* role (which is a Mobile role) allows management of Sync Gateway databases; and of Sync Gateway users and roles; and allows access to Sync Gateway's `/metrics` endpoint. The role does not allow access to Couchbase Web Console; and does not allow reading of application data. @@ -1588,7 +1175,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-app] -=== Sync Gateway Application +== Sync Gateway Application The *Sync Gateway Application* role (which is a Mobile role) allows management of Sync Gateway users and roles; and allows application data to be read and written through Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1626,7 +1213,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-application-read-only] -=== Sync Gateway Application Read Only +== Sync Gateway Application Read Only The *Sync Gateway Application Read Only* role (which is a Mobile role) allows reading of Sync Gateway users and roles; and allows application data to be read through Sync Gateway. The role does not allow access to Couchbase Web Console. @@ -1664,7 +1251,7 @@ For information on Sync Gateway users and roles, see http://docs.couchbase.com/s |=== [#sync-gateway-replicator] -=== Sync Gateway Replicator +== Sync Gateway Replicator The *Sync Gateway Replicator* role (which is a Mobile role) allows management of Sync Gateway replications. The role does not allow access to Couchbase Web Console. @@ -1695,7 +1282,7 @@ The role does not allow access to Couchbase Web Console. |=== [#sync-gateway-dev-ops] -=== Sync Gateway Dev Ops +== Sync Gateway Dev Ops The *Sync Gateway Dev Ops* role (which is a Mobile role) allows management of Sync Gateway node-level configuration; and allows access to Syn Gateway's `/metrics` endpoint, for Prometheus integration. The role does not allow access to Couchbase Web Console. @@ -1731,12 +1318,8 @@ The role does not allow access to Couchbase Web Console. ^| image:introduction/no.png[] |=== -== Data Roles - -These roles give users the ability to read and write data in buckets. - [#data-reader] -=== Data Reader +== Data Reader The *Data Reader* role (which is a Data role) allows data to be read per collection, given corresponding specifications for bucket and scope. Note that the role does not permit the running of {sqlpp} queries (such as SELECT) against data. @@ -1780,7 +1363,7 @@ The role does not allow access to Couchbase Web Console: it is intended to suppo |=== [#data-writer] -=== Data Writer +== Data Writer The *Data Writer* role (which is a Data role) allows data to be written per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. @@ -1817,7 +1400,7 @@ The role does not allow access to Couchbase Web Console: it is intended to suppo |=== [#data-dcp-reader] -=== Data DCP Reader +== Data DCP Reader The *Data DCP Reader* role (which is a Data role) allows DCP streams to be initiated per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. @@ -1867,7 +1450,7 @@ The role does allow the reading of data. |=== [#data-backup-and-restore] -=== Data Backup & Restore +== Data Backup & Restore The *Data Backup & Restore* role (which is a Data role) allows data to be backed up and restored, per bucket. The role supports the reading of data. @@ -2004,7 +1587,7 @@ The privileges represented in this table are, from left to right, Read, Write, E |=== [#data-monitor] -=== Data Monitor +== Data Monitor The *Data Monitor* role (which is a Data role) allows statistics to be read for a given bucket, scope, or collection. It does not allow access to Couchbase Web Console, and does not permit the reading of data. @@ -2038,7 +1621,7 @@ In versions of Couchbase Server prior to 5.5, this role was referred to as *Data |=== [#views-admin] -=== Views Admin +== Views Admin The *Views Admin* role (which is a Views role) allows the management of views, per bucket. The role allows access to Couchbase Web Console. @@ -2135,6 +1718,313 @@ This role does not allow access to Couchbase Web Console, and is intended to sup ^| image:introduction/no.png[] |=== +[#query-select] +== Query Select + +The *Query Select* role (which is a Query & Index role) allows the SELECT statement to be executed per collection, given corresponding specifications for bucket and scope. +This role allows access to Couchbase Web Console; it also supports the reading of data, and of bucket settings. + +[#table_query_select_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Select (`query_select`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Bucket : {sqlpp}, SELECT +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#query-update] +== Query Update + +The *Query Update* role (which is a Query & Index role) allows the UPDATE statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. +It allows the reading of bucket settings. + +[#table_query_update_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Update (`query_update`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Bucket : {sqlpp}, UPDATE +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#query-insert] +== Query Insert + +The *Query Insert* role (which is a Query & Index role) allows the INSERT statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Web Console, and allows the writing (but not the reading) of data. +It allows the reading of bucket settings. + +[#table_query_insert_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Insert (`query_insert`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Bucket : {sqlpp}, INSERT +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#query-delete] +== Query Delete + +The *Query Delete* role (which is a Query & Index role) allows the DELETE statement to be executed per collection, given corresponding specifications for bucket and scope. +The role supports access to Couchbase Server Web Console, and allows the deletion of data. +It allows the reading of bucket settings. + +[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Delete (`query_delete`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + + +^| Bucket : {sqlpp}, DELETE +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs Delete +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + + +[#query-sequential-scan] +== Query Use Sequential Scan + +The *Query Use Sequential Scan* role, located under Query & Index in the Web Console's roles list, allows users' queries to perform a sequential scan of a keyspace. +The query planner only decides to use a sequential scan when there is no suitable index for the keyspace. +Only queries by users with this role can use a sequential scan to access data because scanning a large unindexed keyspace can be expensive. +This role does not grant the user the ability to read or mutate data or access to the Web Console. +Administrators' queries automatically have permission to perform sequential scans when necessary. + +[#table_query_delete_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Use Sequential Scan (`query_use_sequential_scans`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Sequential Scans +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/yes.png[] +^| image:introduction/no.png[] + +^| Bucket : Docs +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Settings +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== + +[#query-manage-index] +== Query Manage Index + +The *Query Manage Index* role (which is a Query & Index role) allows indexes to be managed per collection, given corresponding specifications for bucket and scope. +The role allows access to Couchbase Web Console, but does not permit the reading of data. + +[#table_query_manage_index_role,cols="15,8,8,8,8",hrows=3] +|=== +5+^| Role: Query Manage Index (`query_manage_index`) + +.2+^h| Resources +4+^h| Privileges + +^h| *Read* +^h| *Write* +^h| *Execute* +^h| *Manage* + +^| Bucket : {sqlpp}, INDEX +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] +^| image:introduction/yes.png[] + +^| Bucket Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Bucket Statistics +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Index Settings +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| UI +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] + +^| Pools +^| image:introduction/yes.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +^| image:introduction/no.png[] +|=== [#eventing-full-admin] == Eventing Full Admin