From af2c350be4987fbd6f0960e140dbfee4da81213f Mon Sep 17 00:00:00 2001 From: wrongerror Date: Sat, 23 Sep 2023 18:45:54 +0800 Subject: [PATCH] Update CRDs Signed-off-by: wrongerror --- docs/index.yaml | 42 +- docs/openfunction-v1.2.0-v0.7.0.tgz | Bin 549235 -> 795987 bytes openfunction/crds/builder.yaml | 195 + openfunction/crds/clustereventbus.yaml | 413 +- openfunction/crds/eventbus.yaml | 413 +- openfunction/crds/eventsource.yaml | 840 +- openfunction/crds/function.yaml | 10314 ++++++++++++++++++++++- openfunction/crds/gateway.yaml | 238 + openfunction/crds/serving.yaml | 8895 ++++++++++++++++++- openfunction/crds/trigger.yaml | 328 +- 10 files changed, 20829 insertions(+), 849 deletions(-) diff --git a/docs/index.yaml b/docs/index.yaml index bfe9b12..b3a43e2 100644 --- a/docs/index.yaml +++ b/docs/index.yaml @@ -3,7 +3,7 @@ entries: knative-serving: - apiVersion: v2 appVersion: 1.3.2 - created: "2023-09-22T18:37:06.127807+08:00" + created: "2023-09-23T18:45:37.65325+08:00" description: A Helm chart for Knative Serving on Kubernetes digest: 134c3b538f96c25862bf85e72e9bbf0fe12dc3497f1e7f47383ccb902a1abd56 keywords: @@ -22,7 +22,7 @@ entries: version: 1.3.2 - apiVersion: v2 appVersion: 1.0.1 - created: "2023-09-22T18:37:06.126423+08:00" + created: "2023-09-23T18:45:37.651213+08:00" description: A Helm chart for Knative Serving on Kubernetes digest: c3c6dd47616c498ffe87d94812c35a6423ef974fa65daddc22d196986e15284a keywords: @@ -41,7 +41,7 @@ entries: openfunction: - apiVersion: v2 appVersion: 1.2.0 - created: "2023-09-22T18:37:06.279303+08:00" + created: "2023-09-23T18:45:37.893457+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -68,7 +68,7 @@ entries: repository: file://contour version: 10.2.2 description: A Helm chart for OpenFunction on Kubernetes - digest: 200c54fcae037a08b19b77a094beab58ff91c86da7c31259ce87081c48ce08bd + digest: f30e28c34b209587a05a661ce9c9b636f32ac18c67c7cc8ce2923ddc015add40 keywords: - faas - Serverless @@ -86,7 +86,7 @@ entries: version: 0.7.0 - apiVersion: v2 appVersion: 1.2.0-rc.0 - created: "2023-09-22T18:37:06.26496+08:00" + created: "2023-09-23T18:45:37.86594+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -131,7 +131,7 @@ entries: version: 0.7.0-rc.0 - apiVersion: v2 appVersion: 1.1.1 - created: "2023-09-22T18:37:06.250949+08:00" + created: "2023-09-23T18:45:37.845913+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -176,7 +176,7 @@ entries: version: 0.6.1 - apiVersion: v2 appVersion: 1.1.0 - created: "2023-09-22T18:37:06.239079+08:00" + created: "2023-09-23T18:45:37.82856+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -221,7 +221,7 @@ entries: version: 0.6.0 - apiVersion: v2 appVersion: 1.0.0 - created: "2023-09-22T18:37:06.227649+08:00" + created: "2023-09-23T18:45:37.812632+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -266,7 +266,7 @@ entries: version: 0.5.0 - apiVersion: v2 appVersion: 1.0.0-rc.0 - created: "2023-09-22T18:37:06.216095+08:00" + created: "2023-09-23T18:45:37.796909+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -311,7 +311,7 @@ entries: version: 0.5.0-rc.0 - apiVersion: v2 appVersion: 0.8.1 - created: "2023-09-22T18:37:06.205003+08:00" + created: "2023-09-23T18:45:37.779977+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -356,7 +356,7 @@ entries: version: 0.4.0 - apiVersion: v2 appVersion: 0.8.1-rc.0 - created: "2023-09-22T18:37:06.192978+08:00" + created: "2023-09-23T18:45:37.761659+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -401,7 +401,7 @@ entries: version: 0.4.0-rc.0 - apiVersion: v2 appVersion: 0.8.0 - created: "2023-09-22T18:37:06.181388+08:00" + created: "2023-09-23T18:45:37.740003+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -446,7 +446,7 @@ entries: version: 0.3.1 - apiVersion: v2 appVersion: 0.8.0 - created: "2023-09-22T18:37:06.170404+08:00" + created: "2023-09-23T18:45:37.718627+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -491,7 +491,7 @@ entries: version: 0.3.0 - apiVersion: v2 appVersion: 0.8.0-rc.0 - created: "2023-09-22T18:37:06.159678+08:00" + created: "2023-09-23T18:45:37.700434+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -536,7 +536,7 @@ entries: version: 0.3.0-rc.0 - apiVersion: v2 appVersion: 0.7.0 - created: "2023-09-22T18:37:06.148501+08:00" + created: "2023-09-23T18:45:37.683599+08:00" dependencies: - condition: global.Dapr.enabled name: dapr @@ -581,7 +581,7 @@ entries: version: 0.2.0 - apiVersion: v2 appVersion: 0.6.0 - created: "2023-09-22T18:37:06.136888+08:00" + created: "2023-09-23T18:45:37.666931+08:00" dependencies: - condition: Dapr.enabled name: dapr @@ -627,7 +627,7 @@ entries: shipwright-build: - apiVersion: v2 appVersion: 0.10.0 - created: "2023-09-22T18:37:06.281447+08:00" + created: "2023-09-23T18:45:37.89649+08:00" description: A Helm chart for Shipwright Build on Kubernetes digest: 06820ce8fe0088b3f95086ce38c5aff3069b691d2d5f1210e5bf77e9632a8611 keywords: @@ -648,7 +648,7 @@ entries: version: 0.10.0 - apiVersion: v2 appVersion: 0.6.1 - created: "2023-09-22T18:37:06.28227+08:00" + created: "2023-09-23T18:45:37.897529+08:00" description: A Helm chart for Shipwright Build on Kubernetes digest: 366ca24ad2651910695ac50e165be4fa7c8c635ec2aec5f53a6baca17f3efed0 keywords: @@ -669,7 +669,7 @@ entries: tekton-pipelines: - apiVersion: v2 appVersion: 0.37.2 - created: "2023-09-22T18:37:06.283429+08:00" + created: "2023-09-23T18:45:37.899074+08:00" description: A Helm chart for Tekton Pipelines on Kubernetes digest: 90fe5c147a410aa1c26812435704cbcf1891ce2446a8e5f8a3ff62449f736360 keywords: @@ -690,7 +690,7 @@ entries: version: 0.37.2 - apiVersion: v2 appVersion: 0.30.0 - created: "2023-09-22T18:37:06.28284+08:00" + created: "2023-09-23T18:45:37.898316+08:00" description: A Helm chart for Tekton Pipelines on Kubernetes digest: 4939ec89841370813aa5c00cea5db82733470fb165326d2b75c3f9324d170bac keywords: @@ -708,4 +708,4 @@ entries: urls: - https://openfunction.github.io/charts/tekton-pipelines-0.30.0.tgz version: 0.30.0 -generated: "2023-09-22T18:37:06.122203+08:00" +generated: "2023-09-23T18:45:37.64621+08:00" diff --git a/docs/openfunction-v1.2.0-v0.7.0.tgz b/docs/openfunction-v1.2.0-v0.7.0.tgz index e6ea683a1c0a938df97cf45eb57ab66d2a1d2ea0..e16f118b6cbcfc2368e185f032cec43f8a2a2f9c 100644 GIT binary patch literal 795987 zcmaf(Q*<3%)UIQrv8^VJ+1R$79h;49H@4B(jh)7}ZF|Ss`+WcT@6OFxV_vN5HP)Ep zo%4CfViB+*{^x+{A%2+1sIi*KC~_-!^KzMTXtA2BbJ^&r^KvU|X>luR+uNErntN-g zItj{H*gHU6_4xW8v^SCafeeMh(Kx!Y@;Tr(MHWl~vjl@75D}GFTM-|pp2u4M#n(IJ z*m?F9eEBm18v3cJOBT2LBxgAmMbqUl@)I+1AZl66>jW)#(5P%3_~hA1t4cmy}Tkax6(GAXJam8 zHjKz`*3q#^rTADac*Z_cJliVEvntMQS>i@&k`$!0rW$-z#vwQCkP^Nyo<8CmV>?Ui zUgOmgT{TG**LCkH_K0lGldsA!|5Flo%s!clz!8&h+!@(Dl!eWF!^+a5?IQhLH$_o4 zDdf}swL0NPT@q}k$f@~}T)Zv3Vs5B>36Ti!2@hWvt-U2_9c7uYLBUxNBgu>sy@MB( z$ugbF%!E|*>;z#C8UL5t(YtW6Bpqc;=`l)0HmQcGldZ>~f zg>l3>G-``O+(Q2y&M;ZpK3P>GdS{GNI6n;dQ#x%eV$PUSBWB6vov>;k_df7ew;JHDE#5#Uw zLQI!!c;SOiD-PLykya9>%Vua3Xhs#{AAVbVBGQc z88`oyRs9zGC53Cdvy978VOPaF6G_Hs4G;GV=g3_?q|>y+$X%!a9#-I|2Nk}MoaQ$Q zsVNO*3NeKNOg@9xpoV>tBQIwKO-L=lC5BkEChJ_9f%~;v&sRh7SO#aSTg35S#3k@j zPIrjfRUzF7hHeI+=_lf4;t!l1%|+ezy)I$yiTNzpb5C!;kih7I`;l8A;wa>?AAbQ( zQCJq%UO6G6MvA&?j7@;#07enEv*YpuLuPXL3oJXl8cseme@l%F6k7VD=(bk}2D=oO z1`7x_$XvOqP%K$0*NhyRN0VYap776|O~_W9kA{{YU&RS|w~9-3&;W9cajoVmU0q}@ z@+3e_E7SvIhPk$=p+y6`>U zk8CVAzVLT$L_B7*((#DgciC={yxiP)nV4b~3fX7lJE84X7H*qF`qL(P7h4ugsCpoW;_2835K@qbCOQE`15+b;pzGBCMpz#C@|4OSig zh@rmD$?$6@JDQ*@R3PV=QDmmRdXdog@7@>KK3WyND*<(~Z)RrSAq*4eIiZwgA{2%o zR$tS;ExNm)!}2H}W9cRxkf*&R+eAL!P>Jjoo^fdj%FN526ocdNt25I*eNCNUear(1S3gAfDDa*VsiSy3p#cCJ>RrqMlOp+&(f^%iu9=XRQ`XlNB>2 zs>dRtyXTzi0#oiyC=(D2F+SpxfJQ*o01crz1SL0?W)|lTczHiAUWCF(V4{A`s8#(B zH{rt6TK@je4M!i@HfBG^l^7?_18O}3CqH#4eeJE$cc#HS02}J_q2_7#vX>E76;23g zwUN%>LDy3QDu`AxXR`xQbd2^>lVQSHgRLt>t=!kk(FQs2XN+CL2V}13vbd7tc9Pz7 zrgzU{c3|F1R}(J;^|*`cI>QJ+8b(WM_dcn61Njqa14SHp|F@=-aJ$(ul?F#Txw+5G zK&ytUa>I|G6fld8FQL|Y9?8nVp6zTewP1gn9Ed2fpm`q)<*{dpRq^Yz65!M?&Sm1s zsza-rRS7~ZYTTP4^(R9}`A)7RL)`~PdAd9FfwY$PoouRnAq<=7vSAEE-ZW*&=#WSH za3$r^!-a8r8ZotEWpdqg8(nIX4vCDfZVayCan&pVA%bvcL)deEv+vb)!tIHdn3Qhw z+)EM{IyJdbXQ_O&6q1Y966w1cax~|!JqR|9P^#Wx-@PdFWfs_Kq8>jM7bn>K<)~aV z>SPw+Z2gy~MrIOoLyF|$kM*d~oy^x(PdX9BodA%tRH(7qUmlWy(K28 zs0%b0sAZF>Is_QfQayQzOK+Zy~VDrW^Q0?`zsYw4*pMx4p_dW_H z;1ui|8a_L5e)!K=3)khT!>)MkFYeBHCreE>5vlk!e>@q>L5O+7c z8bP`2LCm&$-eL(N7uh?4A}e-EN`nJwTVH;m)?l-{%bWyA)oMCnw1_F z=D;hPy$7ng^qdxx#=u4mQ{IT*(J+|`I|`fjN5eATjCH~|x^xOfOjGrYRjsJHF4%6G zbI!YC5uS0Ut}={80v`4WaJp}kUhVl;pp&~L=;=F<|74rNcQ_hG)^)WeCDyU4jcS+G zAB3oxofQ!nNN8%o8SbeW+O-zy4ZA6^MdZ8AX*^ZtakGb_CM*X?i$yzr18%!;A@P66@(qzeS>uss;Dh99WC0mFw( z4`!HBjeAt3Q4(w=UEg(?9`}O81fx%%syrw{Fu59V8tF$3WAwc9aJdU31D%}VH(Jfs zLYfN``TXh~ul|MWG{Am%OtXeYNg@gx?vx*7{}e?#@=@djdivEmWE~L_&j17sLQ}adf zGSlHT7F`*=DJcjP6qJ__p-ROnMMAPJ=mmzLYA{|u3G~@Eogn~y zP#Ch#2gMMLw()<--@aDnpr|LSXkWD}Re-0_(Km1S5D37ka|$aMnlO6yM%uDm_%Rno zz)8R4u=EoL|?6Z0qYzOd#W9)h?f-Z3oiM58Yl4()AGub2dVd_^~Z zNFl|-x_Ax1?IyQWZ{p=22yW)vH>Ot-7qjgfJvcd^I+qM-h6M|}*G1l)RPjdPTW=8K zLr(j@qjqDT09^oHCwKA=&M)m=p=As=@y_8UZD$OU(@N6J%FY|R00GZ~w{dBqp=Xy1 zDI$+7`NyYifreIu-Pc~^c`VXPfD3$;RhO%KxS2u>giJ8%8TL}#oq~lB7Oy>YoCqke za|rDAVAl{L<(cvKN?1KP!?;pdt9YHD6H;HC08#E-MdDq(W?1sUCWm>xfVwiYk81G{ zxmWCvh~N!85&Aj$`2df_O$^1kO*e;v1nb2h!-G_Zxy4jx>dVmR+0?0pK)9fxDXF%-T!Xd$Xf3EcIeR=@;rD4YmUNy zwRsqXti*q~%u86U3a4S@#`78d1qRASD{KaGY8Fkxf7~*uJ@34yf0GEV(uMu4M}mg# z$D`7QBXi8ToO(Ezj4#6StweH0gfz7%5}gh1f(g4O*GcWI!&HTI-A57fuSs|bZ~kRuVYsBUIjGnvcFZEp_N}JU zYW<_6NfL*(Iv*M;9|5W8tr-s?smc{g`P(IIW=%1Gu4E{ICHe;rGY}$}7Pmo@D6X*T z6q76v(sRxQ?4pCiV>ZAygVAc`0KJ;% zaQ>d-s#QHnf00R+fAUlvXT4>1vl@_ zxU9f3ri$urANutPPvp0tNJt+Tv@6nzDak573+yXne%wc9qGHLIP?O$+9s|D<@Ez8B zJA1$ZVK9IU=pfK;@33_lgMiZ8HbOTCh9@YJ{Hcl=znN!7e0|*D?egtaUCkpZ#e0&qlbO8w=mI)w;Hxk15@4%W?Z4dFrH+&7uP%ivFh;9cMLr+t3JTIijhE=#~zQWFb z5zHPZg-ORSt6atNN!G$!RceN;Ayv>C9L`t~u19=e>9x$)-#M=rFYF@qul(GM?0ngr zN{!UEB{w2#A~gk)D`UxWm|QSTd6h(K6taIsKohxQhH3pnPvt#Nl&;J2TT5$aDfU_4 z9p2%V{(XwLEoWObP**SioO)taukOFI3q#D3jeU>IF{6Vw=PA$!{q)F;_2Ks_i|W`pr8Fn^sT`{ zpD(+BhrN1iK{d-F<)9|UDtirJVc$T)#?C7-GyJ0M55tOvlb)>hiN(AZ`Rf(W&B(TR zE$0UUsMsU6p`#X79LKWQ%DF zQ~Gw(*$P*>iwORwZ?%Dw1PmpKl!Fwl1^}A2jXpn^5CE`!jzoR0s6Q778qD3&7 z{)ZOxwIpK8b7@yU?Q#6VJ&r}E-B{~0Q)5^Y=-$YM9Q|mgSco#g<8OTsPyjww+B$d% z>@v(89mr1X_?b;CZz;fp;N_2V!e+jG&B9>nY*tu5! z((b-AA!rbH3D)2vxm-3xpbO^7wX8Uc2WbdmtDt`J@Br~Zl#}eLbJ1(@YJ1p_2q835 z^`6kwM_v~)!*oK7@H%C^5c8rxoyT1~KioNJE)wPmcXj&1? z`i0HpBTw36UN*V|J^nGX%|LBq4`-kNg%tM&W_7PGZ#uzEm!JYTMa?E7T*CM02Y^LP zRn09pEgt!kk`SNl{|k5rz6bHH->g@wZn+<~5iE488)q$SU@ z7oxWMb%|u&FV^zw*{1TE8S57Z&rRHpeA|Oq94r3piu4l9epaf_<9^*GRbgQrff6{A zHCe2UI#X{Fc_}NjpDl`O!tNtYY&&jXt zCV>h(&!H7*ih-vN(>|sN+OL2D{JiLmT@he`lN;#*dWuIY7-0PY9$h>I%asB*zRzIVD+tXs!cZ^q!A=XJ#4k=qI#QpX>FgNdzG$;|WU>9pV6c~p zz{B3!_E0#3%I)H-HUHrs$=4_Z@@4fz=y<5pfqAljzwYA3h6K~F%c6PUM$@@gR8^Z| zOzssqp)2S)9lqQ2Gv@6CZ$B2)ax-f#4)0@fcybMPQO$b$4nT{;t%|gs)xultllhK|Y??xawZ1>ZE$cw(IY>hvtVooeP z*G2;@CQGHvDm(55a{_As37|s5CyHNs z_x@^Bg?I`I>J7fog@D?`vs)dc;;FM)&$q3R2k4>bqZ)nQ%bS*0(ZeGB6K#k8aW&YG zD@y%u2+3X=FXZ~QTVnQ}WKYa9`ZehE9ff(T?Ge|!hLCzVJ8M%5#r{A#pHjB*0?bli z;AUTU7Kk6~f#<1w<`Bo*w(!vP_qv5dOvr!njcGJ{trC6n>aj#LpVW;Ut*0aFmi+r} z_B-VpXcf17#?H&yXb&HW?q*s~w$9|oo}rXsjU2n4LAiv+;Z3gKtzY+X2Y)^?+#MCF z@X1fvkjrhLy&%HIZu@CIMEkaX3e0$3Q!U)f{mn_P-A-ekv~iuH? z>!F8psX%GLc)g?$35Y0)SF)ODyzGDgMf~1)oHy^7Oa8A-hS=A7x8o}C10q87#g8D} zpBjQcchDr8O;vQaWsF1isUiNxb!{G5VBU1Qr+)@4U*(Z#CNw-lhC%zg?ECBi!0&kf z1uSn@lrl8FSFBC|X@#Xu_T@e_DN!3+u^GD%-+uI{LpcfC2t~7o9hmB;)Endwng7qe z)7ZD#Q%)+K_H|phsiSp;o9-tVTcP_#)=2@2jva2eK8}BMO8Q2x@~q-q&<_SpD+6gC zHe3g@rb>0dUP}^I`GAoy1TD<^D#yst_=>pkBFZioMC8mhq8$M>SLJIi*9Vy`#?luG)2 zIJ|~0$m78H(Q;(V?`v_RgUouZ6Dw0oOy58L{EG7+6N&NILs4jpI;vV41>tzUss5B- z_N%#KnytmDR~ttnqHJGZaZ4EK6%sp&jpEG4kuVqeCmxaKy~C53ib1}WnkmpZz$Deo zLd%Ba`_xjQOU46qf$t6Yd}@nk5x*@KhA^qg9r?zW{L26>-Fx_tCkVz6pXJ`r|19Y3 z*O9W7yUHU9k@bohm9qo=W%(GnPFydSJcTPlozMX!KJ$5_v~h8GgXh|l|6>u~Uxyw^sMFm zO{km@j&KUi@6RYkXfMQ~c2^nvgpi{?S`y7x4>>zm=!o`C(Wu-$&!wT5RvumK$W6Sp zDUhz+lSs&ta(_Llhww+j2n$#@w;jzR;`KyofCBTCw^$cK_zXf2wmvDgox?j(`F;Jf z0P-CK;Fz4hgBBhZ5iVa{2p)c=Gywg z+?*K53njgGR^Ta1`(}Xhi7ynz$OHGBmOI>wN$kYAHslg|mlM1SuFDEZ5uNjf()K48r~u z*b&3a>Z3G~)$l_h23e2^e-?PaJKF!tePK@NV#&$j*3Z4q`fI>Va${rVyO7jfDUeJP zdjH%GCz}q?-xVy9S8SshdHtI)x(+uvX&W}G?fO>`|1C+Okbf=bo` z>Km4(&?f%v{HP1iOyKcPJtW0UGAHG~iDKo&5QwnQPYX?rUi?o+uk@l(cj$1@J*!wP z4Kt^ENL5GYwgIAoaks=v{psrBp3Ca41p7au+l|%5t)XRATrR8QNj-RbRD5i!lZ^r? zv|CszE0MwGF_MNP6gCv+72n^G7zLa=2eppO`1OijO>dXY4$UW5G**;Wl=*z}1@Ga6 zsn3E@l74^2z8R0F!vlhj>UEC)d}5GGxsBWoU0fjFeS=c2h2WqW9(~c3WA_$$qF)gl zPJFB+F?BaLj*u|0I~-BKR^lY?eBD95V^lDkG^n*gM*N)u&9|-K6-Bp<6e~5>&og(Q z1Z8C!@#AQZVupIpD^&*pKu z->el=k#7cZJD&*5uxeFUsF+C44ntt zT2Pe+rTN{7q8(uD`mYvyv_A{zl_x^443+Xlbp${jUv3?iKPw@jDJgZ-F zdjpP!xlDp6j6}%(e~PFF1j*+XRp|ZytG7-JPV{~jjw-N5KZ|Gk9j@bU#QkT?ez?ui z5W2HwxkhjRAnN&mtmE??I&1@m#Y@#@b+R?5pRzH8Mr^UUoBUh4$v74Xj^!K|Qs$Io zx1^PiRkFp}9F+ky-@Nt48ucdKqt)+ODTFyj<~q0u9|0Lt4!vW$A&?(u^Vy{H8vmV@ zLZdbs#JdKP1oPM1H;laRpfooOa;0WA_@2uXNtLZ1eXkB^%n5% zfryCgE+Oq4Mam<;%#Ui~F%(Ct2&~128#&tuZxuGtVrbDR8KrB#%Kj9mU)E-na$NeL zrE0i#+aBZ1~$h?GwNzjh)obhtyTnARC)Puc&b*-7A+ilap zK$xqC#CVh=-dI1BeSzH6YXmiO#5a{C)v!$A+Q^^SrVOxLS`YSP$r4@nbjTZmM+*PV zR^EPU2KR_O1+&_jOLTQs1ph+K1ad@qz2*e1g|it=fX2Zrahl)8soB&8!(}qy`!V^Aea9o#@ItV?{p2=2RDbCN8qru zkOX?>n$F%33}1o8!YY@?dQBt94HY$&{$C@K>&aWi|0U{fK7fSfya(fKGUK-55(V|> zukBY94=8UjQ57jPP((F`dR6=UL!6LC(?IeYO;o!Kn`W@H12t?}fpBPaCkqnvMAF~X+~9pn7LMRF*$S<4s;AbZIL8SjSJdmi1!77_ZXq%P_qOVs(co^IjOh4mDulDQq&o-r@yRO$hduLV(qp8;q!KdSp!RAh z9H6qjx|DEnR4&4yI?p+zGw!gGfGu0)XR9RoAKBk8Rt+wz`M~vU=-z?J`0huL+B1Mw za=j-gO_GrGz8rlxweED1Gi9sz(#x?oeC|6oii{+#)T^Z`xP1kMKtz4#<-huKJ6)CH zv1`ua|50!25VU}8-t;KjD*A%S#!v$uE^={VC?6axMfc=4XzR0Z2ptL{OFc4(Z>|)` z#LPv9>n%l83T+675;w^63WJKE-_H8HxLHrShr`p<6m^RO1+<#<+>1j!yckf7QJd$& z;>Avbqc5;7A~kqixMB=@d*s5!?MV7KimdZilWsvd^7_RWFXKQ-8DmQItkK98^SAe z3Ly+i4i_mPBYqA&C_)`?CkCKgR|MyvJSK=Q@({-?%OH-RAfy+`x_L;Rm45F@cr=w* zt{6AAvpsHD^Mj+wy!8v!k_fAJLBy}vYP#?R3Z^j-F`T%u#R$ksH|zs?0%z_coirEveRgtMO)iHtm2 z1L};iJHaB2jM!ujrT2i@Tt$S49u}cAJzlNX6dnydd>Vn8^)WqlicvV~Tm#D79K2O; z;Q|*R!>{*Ftp0Udykq4ft9L_-aA_)szr!x<7e`W0rfxG7GDKr?|I(0;@0&l$&Y(+? z^!lL18U2~u!T)>sKl4DY8DobI(bAwBNinQ!7>)KSssgGmAY*MktnuA`;%-7-6eJ{mQl>)9 z4$nZp`maEY1hh?=eB=7?`t2~nt~&`-TL?K;6gy2mnxt*&Lp&@em!cviWP+DFbDY#s zlBCibmynw|Y2_qSC-$$mGK(KsV*r6f` zLMI!;-3n1>1W;lb!-l{O?J$Rzj|Psh;GfMn?SW~|C&u4j=_Vsz0K3$J+@Qg8;3gBe zK)A4vrvr4okbW;5L7Lq!`N%?XKIh(-1WsUFynGOrOh^9^c1mtM6n;%_;c{sm_D3i! zHl}0|_>U;(iABbg;9%E$ETj}kl@w-isT(KQ1e7{uvf>v$1yQruk4m%VssCnu4SZ%j za6AkwSPWE703RY{k%E`TWjoyP!A?m#=AXiRk65D;3!x8BO9MZPA~M~lLwh8NoRk>y zt)xHxrC-8kN%!FmxJJQ_v&U=Et%{8v(2Q=EKBJf=a6MO2WVO&50mY=YUY4d~lFSG+ z|Ks^ih3WbD;PKfZ`Luql!~c{h?iKLygbDaoaUpgj&~&TZlZiV-#6cTE|1jW|Yr*1* zq87@|94>>cq~x@j@QZOz{7;9mz3aRd(d#EK_|3I{^&6lMccAa?4kZ9iq&Hx?d=`0a zPQB4Mj4PIHtev#(#16j(y}@&jkg19s-GP7q>FJz+F~?kNDAIlqW2{(Jq|)8+y`3A? z?&ZL+n`^smAz)>U+V2x#`7zOKU|F2{heam1C$aeC!p*TvY)d6tKkb0KB~#|j~IBd^swb2aLMKTwGg~Z-6I2zol8kwmQ8A< zvHb2ua6TrUG@r=*xRMIKNVoi%2t-IR5Gs?z z>o}yz=J)o3X{&m()nfNg88i#eM`t)|LMcQ-1Vp7|yxJQ4Ta{90wu0y&M5hWbY9;6U zGx|r%lqDB|QAu2E$47Plaa*=y$)r(&=8dS?ji^{Z1sSa#V$p9bxLkf;mSprz2Djvv zv)CLQ-nD_(iD~s>rU6@U2`=SIE!}ZJS&roT!k^}!BnxH_eN34e;M6fykZeSu+;#XqT@!BaS#<>DJkQW6~!)~H;jdf8EX`Md& zND>HLp?@#~=)0l!4_j>{7k6ztPQnNCsF{*v`R=!oY1e2Yhun%>tYTfKuGJh7=_{^d z_Db%x#=Pg8fk#ikU&;Y6=i^@mz)o<6KpEPtaIdV-`ddQz@}p-~$I8>n4T&C6%I<{b zeTb638OVtMJl=&yr zYCjJV3h{+7zdyH|Cs9UuB|7p!3PZd@iQl;(JCliGh*x|}OitSWOTG7ORu+!;0H9rO z&76o%{(0m)5oc&XK;E+T#Ps{}dFYn`{HOn<(GmM0=Qa)mIGm{Lyp}n-^Yf#C7OZAvI`W;y`QFtk)%KceUw-6kj`7uZ zKB$J6^Tg+SHoDIqB1J+YI~BBEgCqOjbN4p#KTb;Jk%{n>Y+4>0|? zPYZNVnMLFN(NGgl(L{`d_hI7pOW9{aQtNN3qbf7Ozz(sqfnx{>`>2VvT$&oKkg5u z&mq!SO*%B~ANe`0XMq4q|7eBB-tS5Zx`AIWWZ#pS>-)e;>iASQUjCP!II zQ_|hEPmqoi-R%s#EWoc1=+4-{$Tn>Hrq+S9L+wN0+j|WO=CKD6T@g8Qm^USaluWN* zv$wZYqChj{Y_G%JwBq({3LY3PyO@9VjvVi47ck_vz_;z%cl|N>*j{DYd|b`z^F|Y`Jzl6-W9MtPXvc*G!Rg-Fx||G~7E|CboUZ z_o%*|cCQdEkNf@Qd2bKnF48v>lU6S&s5}{y!(NY4BwU)%E2oX2CT-j5?d=a|C++jA z8re9^G_mu5hfqd3Ao%ty}@wZ`=^XSyY@gx%|g?B<$ zP^;8&iE2SF1_2Qwp|uAUIgHQx;oImLr|L+;gr$^=$UeB=*$`LmZnSZ>9%XLJq?dJ# z99?a%LvS|y63AM+%u}rHc^0beG`dEc+QdRT&YnkODb^XEUOgOSE}(X;F8n6>Z-)uOF5+c&aYE30)D z;E+VEpTAarqR>6}Y@r>zKZLdVPGVA-anb2N`$(^-gH#ZKx}Fx-y1kG8J@MJ?&RH|5 z`7Ma!1ijdC_T4}~(PrKJgKzQJHp4I`s|kCNRDcyVAMe7jh~DiDZvC*nZe6}3ViIVi zNbL^R7jJKiTuo)aB3LoF$?N>hmfMK^=a~rUhy~xG;#@ppA*aTN@2Ew+O&-xa1J_o( zQ|;D}b7E==G-Q`LfXuhbbCSobUCo9XFq1r}Z%OZW@HWw+vcN!6REvu0IioU&xw+(< zxZ<#bpD_$y#$>cn=e6$MS^C_v<<#|Qu~}hfpMn>GWn}iVRr$V=Uh{oqxw(G*rN?*M zly}5fMmMQhv_soeK7_S9Qr>c$$<9rh%IeG4grTj|^-c67Ty66#X`1k8bafj({5%O& zZ!hx@jn`=F*`QIJjZoZB)934D@kTA{F?+y5`Y>-MT+2khlQIiw@-BpSA!fuz%#iX2 zy6L2c&yk85v(B}Tr7JM`8nJf5rM%MMsp5Hg`XKc(QLfGGPCctpFumG_a+{n$uRX)P z2oCSoDzU(q#8u_OPNQd*$7aUbNJP9nO`a>l+nUIIunw_I0X;06A>|!slW-*>gB|&e zoymwHevDrGOMV+?%-hV1BGcfH%`d;MmE&XOfgZzCuBsiIv6gspYkPT1*hWJP|SvmV^na+m%b(1^;orIdV&+r!MP7j9pwfCQ16Zdfh^6a@olLqyHE#^7X zmfB`=P`fp3sEjF3LZcddUq2evh21aVbTPwQLz~rYjT@))$5Gz>19LCd&aaoFwpuXWM8 zsaF3P>84>JI_?j>t6c3YHdlJ7qwl{mK#3$#5~{nLGPwF7FEauCO1|~T>#))%T!8Am zdBkGp{~X+L$&^+d5K9sjG9!x)9K7x^#Qne=Ze9a&t>?*GTE%!pUkEnap$t3w+4yZ2 z*`A>4>c+ebo(J79AD0<+mPH`%Ea9qsHPh^%PbOw`wPlbrF4nm7=iZUq4aS>$$h1w(R>hp$avz=(s&Mi{Yhw7Z!ss{_9&3`+{a{rWz%XT#*_| zKcTQnnHc-6E?Z^!kasJ}vmI&WyTDzud%;~&PgB}oj0{w^{ys(`-tog6n2M%2*E$T) z-Ys)6ncYqHBU)kgLMfF2xU(8Klu8zk^Qmg} zDG@Z5q4H!Hb;UersUgl*i96VG7)6 z?H$Oi)RsZgJrh}H9ZceMm`Ixb|9kB=mi?wwS>J^G^DEF8?`{uUKnDUIdCwSe~x_M-K*M=_P>W)#;Y{!7sQr@-k%OqPj(X z>_aAidV{5)@-Eo%`>H);(!MUDwQYLthTHIulHhHw@WZ-!p&P)N)~%YAqfGq_=QX|U z3ie8-odTc$L=E>0ZM){z=0t~Le++y!iWpG4yMXhZeRPN`J$?K)cS17JdrMGmdnyWW zRy@|SXG`hTCGv19;w(9)J*w0zrvTiQp3o>?*hZS`raP^AiB`Dtwr(%4sl6C=K2JW6 zoh+5p%{FPTmg)t{AgvJV(}0*a%0$WOy7wO!xz%-j<%CcQgg3bOKG(%;#S=er)!(-=0y z3e`LJAh$xtJvWZ}wwcP~vzIu!afznnh{w#+BzsqEFS|R;V-YR}_dgQkQ|tN!{77b` z+MT2}V9)qUzcI?dE~}oFjj+l-`(=QkHzjB_mABt`zQvvMURY23&@C9L=R4x87rD)!RsxF4STE>KjM)fz3G=l^&x+8R_}ppX|H8d|{z#=E(nhWv5^{Squ~;iM zsMsWS74|c(q*&%*@YkJ7@77i4M`z^HVgF|9n!rI&yZe3iy>lV`<9c$lR}fq7UD8nh zJVKK!g5ij8vX>bU`?!4Y+`E0w!*CN+CsJ9-6z1E}kNobQAQUcGFk@ai@*p<48frfY zFb5cVdOPfJ!IqYLGWZ7scu!u2k}C5F8sXp3bWuL^C=%WwE=@4KzgEXPu}-$SR^n>opTiA%Lt zh(-|4NM;jy&=+~@2lgH5r7m}9ykm|U?5Hd>OLHq`*{*hNs7PlU-CX7&QT>+hUh#lc zZ1vgDEOpXb&1L&88?pM0Id$D(kvp>Vc`(r_bzR zP}KTSFO>;jG5=WCZcIJIpb>Ad({uUsSUEJyfik5Op4xZUrp4D^(fWmD!!d)*=#eES zjv>A0ny&3~NXK8*G{v75I|?srnM*Z?XaE<2tO9M=oh11Ms4)JN zJgM+neGGrmrxBMTasT`v*4U=8)7TPP#l9#LB6uXo?nz`|T+WRp^xeIkL@DXfA3_z3 zxY3yN@0!{9AwSX}ENiKL%e48VWOwD3u?;KEj;GQFPZ_9pZaC3nRJ~1>`Pt${zcr4! za){D14lrQS72o4+6vWb-CR{j?ud~@LUiqD>H&{An{R@Sup+Qs-#XVr0ko(H+-2qU~ z<;!Htr?bKg_qDiCXm>eSHqgYBXYy*9f>k%R18e8fy(N0Goa)4y$g`0>#N&&?lx889 zFQccAfqI;-kCxz_Z}|9n;#}dw)o*SEz0-Tu7UAih0$`=tB%NdA>aHO{r}tgqIic~W z{N6LkeMK1aPtZ-yZ?L+FlY>C*_wu}j)LcpF64|2Q`_j#P`HPzPxy#6hTwi~yd95qz z_=tv2#rB|-MezHTb9?G$1I?vh^|)MyeNG>lRwwP^?fmwzyDYDiPt!Dawta?^v|~H+ zT4vgMz;W`WciN5`X%vU=zcUZ=oy1KpgSTNV4k z-X7)_0@0`V`ix)ltU9RA$D$c4bYHR0#k&<1Jo5QBnNaG1KLKvpjT8plxZ>Bg^r{1S zG7Lv|MgH?ePn9B*9HJ@$Sv4relf5^WE%8fpADFl4$B}v&cI<>Dm88-wu=k=2h0I+vPnh=w@&%Wc zZE|$stSs>tudfsqst$zS*^r}Le$^f8(`_{@_hMSl;>u5H-iq}e$Xc>`eX~>mfBC5- zCzQfl&b&PF+1-^g-!2UJKg6FN{YWC6!xZ)t`I^Z6!^cUrmNB?;UQ&nbx#gcjoPD*8 zN@J~Jht?(Uy>U6~grDD;PI&bD$NF}WP+>%B@ngltFKdSUr6upWW9BXp%62kt$WCvv zbt^2(F^x39(3R=gr|_H$@-tSJ1)-gmS=de|4_3aq>EC~_Nk&DE<5~NC7*82S^|Ns zgpv(v=x${-Plx&hJ^T~WDu+cq16;an3$&aQVT(5m5Y-V{nivjgor|&EDo;S755;>z zgV=kq>KI?!C#1PH`rNS=SjqlyqL0G$Zvlu=a2c1>z7V#W4^^+_|<9Ajcs^y&#pCf z&shrK-YV6wEjW($C3Pj7K{|+z@lT9BHIHnsYs>Udbc9J7u_)sb8+nGcE8Yg6x`sJ# z6mCZKF1EH$GY(n4A!O-rl+x91<1%L!`45TE#>m3AAZ_Q=TQscNtkVA(DKZAxx~v1e z{7@mLGH;1xzNP>iH%6OVqQAZYssvm2mqm7&wok1v2D={M?44Wf#o^8?PQs#vif&l} z6OR`Lj;mqB=Et>RG@{1ZFWLi%nk`giB|_5HJi111F#AN0yt_$@;g&6S+o+e>vCLY9 zZHPwbia&TeRbMA1+*WLm+c@#r!{JKE*VJVxA!coo8jn)lks$^si(GD>C6H&*sU*z@ z^L3tX@EG*FdNXl%D3tXvCU9rm{uFn~>ImvoCrH@$C}H7%1Q2Ck?5!^?{+2-{gp4Du z&)GW8?iXTU-Bb=~OXONQ(3c>_f6Q^>B)3PYvA9h+NV5+OC^fn--Ie^8jT*4$zJ_m* zTK(G1$df|7Y`?T0XvMcsb1clF2=%IYvfRaxSf2~7L)b4pgnen(xdF_6|M8~2<z@x!C49#J z#_nrhCE57fOf*w<_!*9Bf#}!@_Y5Iu_mw6O{uSeVLUc(Z06{~agzkj=_W}iJ0gp@uk20 z1U4bY+4zGaLzeT8%A0^)9q%YyBG$=|^(<>#UwlQ^tDkCMCn)3X~@1w#^@Q^^0rb8nd3eH+#;9)kxKSG72f58X%z0CbT?{=`@h2G zSB77BbwXfzXj(JB!lG75KQD9;fQE{$VHAk&VCZh`jo@lw%^Gk;a!pa)MRLC)LRg-= zX1R8R}x@_tHTyXHmeO z_SWCjF_Ze?`d|u#zLBX(x6$ya^ulc7eAZdHW~3 z3RD%8?k7Ghj4>VP!f094Qsc_<0pyd4s;y5pF$1_(!3XPYJuj9uTsIH`Z<{T{Kr+Mq z;E`>B&_Hniyi|*zHX%*`a`~^B8wjuO@?3@p&&H&;3YJSTK_bx| z0D|OxKEv|%6&%{ml2L0JA`7lXwtD!Ti=MZ`8N_8`iw*$MpL@9-368pkWez*%pZ&bd zz<;tbL703)$vUsd!+PJjGoWE?61EMns_H%or*6@bd7*|RKVjSKTN@mfbD% zODUGp2$ouWB`xbulz#hrX%O|nsh&E47huZv4nJc;idzGruC_HkO(iYHmQ8$)_d#bG zQ8cDriBG4%bT`>H&S=K9Hj#y|-e53=a$X8|b{4Z#=JfA~#5jS49PuZCw$_3>H)zcM zQv>$1CjqoDGYF`^7S0Ck2ZLDlMPA%)KvdBnUB+gmPZkMt^V999IhWwc{^P-s2#ti0 zpi>AqNmwytmP2goxPjbsIYFj4|5*lWF&V2Udb(#hx<#>SC+mvf5_V2PjPzmzk<#Zq zg~d2#L%K>Y#*fR`nu6{F4wUI7IMq@(SRkB2*i z2$O$y*#68=HN80Y(Cx=(NAD(DKwP>4C-H;BVQ^na{b5Zb<&E za0Xgv$7y^ppY{8wJA8of)aBriQdCYO|Pzd0*@_q9`ZP)5UHRekL=H}`Sj(WIy3gHS5Gj{DI=J8if)pY77o5Sdi1U#UM5mr z;vyZ(`n20!Sn!f8IA2WIHo|bSyja_xV`6@Tw7&vOkIhfA*?q9<4!G2##_XhDgU90k zbH|aWjfdc|hep)cuCU2-^OH&Og|3E{wDJQB2Y)$8=f7G;Z_!UZw}IWz7bGYfyMP5I z_|vEZ-^CaIOTg34%FyD6O+LZMU&?n6I&{xTP~|`<>UXGuGtm7`M)}XOp6UGlZTIKw z&k3wuZ=?~pfg!Jm%~e0~`kbAF+8?hkt(Eaf|5Y<$IxqfT-skQA@;>hcdJJ9w#=x;t z@0c7NV0>Spo9oKycj2uhTS`j4CNIFwo3yV6^%YmbvNXGJjrY#6@=0t4 zQMfttae0BSqgXx7j0{)bK7t$pEY4L%H*PYrg`kdI4M$rcNo%KpuN$?%@jO%;3;qNh zwMKYir{8O!V&J2$GFzrF(*EXri+O#B^FGuQHUV5Vc=-u5;9Y|F`7P#NUvavd=oz6G za|&#({yu0d?+(=PRPyGqXZVwK3wTC=;QOy_OSm@ev1^x5d$|UDMu4`CS87PpF9XM2ieL+P0UJdg)Nb#pp6s( zS8@x&Q*qz<^aX`gMnnURkLEmUw9aQu;8|L1pUHGYQn|FEE+igHavD{D+ErXCh1mZO znQPz*cH)sF9tSGd$C0NO`VCO7+g6gEG3L->1vjy!BRT@4IEXJk5sRII{Zk0dCzwb< z;~Y`L{HCUZfANIoB?9mWmqlQgp>qy~Y8)~uz`r;oH;w2=#$HqAc%{#5m1EK4(y6o3 zJ(_!C3Y6TcGh|kFHC~}h4C$aAuE+1#>cd^J0wWQj7$TSae1i0332^?rf{i*M$=D|Wr0 zQ3L5asR6*}KlkLHKzWNcxO}+8nJ7_VmuEi7Y3wOn@>>`5Q5qDH%u#kLp9?BnSUtQ) zX^Z8)W(W_9P*7XyX{yA{ZO{Ai7HW;cewAj8_{})tSL3!-E-!Da6r5n7)IL$UPNG;M zZXkc+(9A7=Vsr>2!W#v91%!K~B5@7QsI$C?;r{RHVhZT`zbb!U(>wo3_2`}d3c$!L znfe8K8DI0bKIq{tGD#l|_59G-p}}mMtu}!S#7RWFc*Wi=`OoPS>X$*MK<`LgRSx-h z@6G^lGM}Mn)PJ%?h0kY>kzMGS)pm$khlij8DlZg@`56+X6)!{zr%;KcQ9h6Jf8}f} z?--Ie$rI=lKrD7WqCn=vBKPyAWJ4m0@6S>ZjIL?R%C0U6q2GHX59wzThCGKsw3T5F z72ZB49DuH_o4ZKH$}sF7xOe?5vinp^Mkz*pI91FGmRhhVfaug%Lga6bXr7R%% zzBus#Iy@6*QR%@slv|mntI*qc zNBgf4(fQ68aY<@AYgs7Vu9868ACIB(*WMpLj129r^(D8&N)r3`QgH(b5)TAovA)_} zze-MT+WfipJ_rTMTC6r0dUxLTPe+``CH^3TUG>;(BDSbQ>n1iu6~?rwn&?*lt#pQH zRx(f>(P=7VaawuyA?<|!_y%csT!jC#onsI5Vz$dxZWHEPP>xftp&%|5;r}V~5>F8= zj%ExT<^M@vPrz?RTqq98=3Dq(>LdJoBKi2sL!jYX;64@LnU_w79=mbr2@^M50OqTG zr>D6Mvtq{R#)0cy5t%#pdDJM5zHM_@?Cb@b-Fp+{`<9is=PlH! z=XcuZev-(^>I5a7k48Ad*WNy!H-BIZ<4WdJ&6@f&rWp!#k>)tnS^elW- zKbqT1{c*{N&dQYWqJDS^m=22iixvYRg89G-&qk1K#IqfMZt?YEVkQ=_aJAMIo$Xn8 z7oWW}q-CBAO$FQ^9YNM&L1>iP#U;C4RAR~Q|1G)1`t~`e$zah0+XI$p@UbOT(^r}; z?Lbb!VhGEB91#`ubCf6$oC1}_(KmKFZsh@UAxHc|Kg1+x^tXO1TH^AE8tsMvRlS5k zK51qk>b)vi7p6lz$xS-%()eK3E*#dh5;gl<(C=4ZiP|#wZ4a{#{<|TC3K#n6t3)d0 zt)^QXXW?wm*O+x!o^zMB(#oa~xFDbuxA23hD6u+PMBOV_uZp8toR2>psZ$SLjK{ve zDRlLG-!=b%G$H>0$p|df@-Pge8Ck@SEd&@(}_9@e1Qp8`vu~E3DOpU-q7#b@|@Rktz-}B9y61Aw*(CXvgsd ziFH8F&o}p#uXRzw$;ld0FLr33>EyTEj$a}O@X{9RGUnE}xR__x6=*)C_S%n<;n@KyZ4QT%;_|zWBbqh&jUB4C3_;&*XQvZe^O`;jWF}|~2AEkr!Vv@O0Bfh^0^&Qt`+2^~H`Q<)0r+Q&xfiP+&P9hnHd%4WxkzUPb)X$H=yUtjw(R zqu=LN$M$C#m{`QtqCxpbUf2YAMdMGz0G@5y^ofIpWX#uX*S5~b?FLjUs}YbUA0HDb zFfV0h+zO;woujRy41!Pbx_fbVc7W9fX>Pq5oF%^{gK;*2*V`i#9)V>M_A%@Y;xzQ=)4UxO*LDwG~P*+V(J{@Wr<4KuFPGuB;Fj6k)H4=_ALY zt&@rtp(@W+{Ef$skGYG0w$-cIp48mePS^DduS=NN$Ab^&c7oLGkbTczdQ8*wm;mTd-YA9MI|d8T(u>Jz!swN8N~I+F(8LcZry*}2M~lliW# z%Ca9vGFH!Z0VZ=bSAJ7sCEJ496@_Yc!n7iS&1ZWR23F523&S7DCE>xY<&Qv8X`PwE z8)xl+uQ^YxM!zDsU}j|Ch*Y9WgK#rj=TzaMk%!Z+O1kLAxw1J?nD_EQ;JQGB-_a=B zf!9g!;Wal-zd8rGyZl0VKIh@};+rjR?A!MuVR|6S)zOq^jfl|$PQ%iUlt}g2;qqfG zJ836UU<^Td6|>`%b`3J@54V?VZ@2PEAgOQk(MX-6FtT3@WK%goZoyXf)nfG(!^M$u zQNY{visSuT$m>TwU+Wdm_~z$S$#j!`;ml+1T5Dx;4;PHd)LhB9{esbsRnyy?Ba8He za#0mBA;(IO{fx9*z(V!$RNSM>0ua!6#Sn5E;Gs&WrE<18F)a5s_C5#HvHS?$B4o}p zcZ`7v!Me@=WY*ysv$f?GBe!F!`yxluBP_{N`=ckRhv(Xq#-qyT_QCL2FOiI1W1Ru z3{4!g+e@&q;VQt1kYd-OwUCPS4z(Y%eyo;Vj#_0gN2xw%MNI_6*-dlrOUEaL*@10; z&r<}N#I(L$F$;Y3&6mDz05X6CAz}s+Q;$b;6TKIk*`FOBFaR&(vTamSW&V%#&ww6{ zv!{{?a{;0Cvmjn)jB@zE(fXFhg;;gQKrqO|4o_ruBMsXJ@wx^{<1)9Z4q)z=V}4(Vg_w|N|?h`;EVkZuxk zGHI^1Tl~!5Jm%!DTI&3m1rBNfn8Pk6Z*tlc{K~^!(#(`J2FqF z#lIijk2HRmHZsc;YO4rUoLwB+T0%8|7Nd^@C4d|?DVz@8{dB2uvmEi*?N?7)4 z3J)Y6KBXM8Mu7B%TH6^lDX$|HH_LPI=M_(0%T=xwdL2#=F!87U3+gf2ZS#0B{8Pap zhchPYh({x)&**{lK+Rzd4MMJLovPDFE_z^2T+9p2^iy`%%g24U;4uopt5(Z)H8MfK z_?^i19^hdpbZRnLG|>Ae17o?M$P7Bb_u~8dukkg)0vg5R$>}~n>VHHko-YtJA!!7@ z|9&o`47)(3rEY^|=&x|ih*jS2n^;}3jv1Q&OZ)t7*L+9!er7dgxy|FT{L_~#Cv!6Q z`-BZF+!z|Q`6JC#MmvAwJ5L~FuXb(ZwAgxf&nqF=#3*ANn5I@auINW}5k5-&sje69 zoSyL7%CmTSsfEC-%S94j$m1&pFoeaf2gC0+XB|*>JPP2R^H>hVmbN0dmN}ld_E-W; zOCQrId>ax^VAN1CAX^Vcbc1{wa(An=Wd(nnt!I};sl48{{}G16s%um4!`!`r6xU$~ z027sJHnS;~;1cQ939^K=3Ip>aP^^^#Ew8if{F_knjyG75Oe-W8h`|j?kjH-sxX5-I z?Okyb{kBGBMtbxHU*^vZrV_+4Z*NMToGKq=7alw94v`Oj{fthh4DWuDo2As;Qc>}~ z!`Ca0kVmi<9ls8PQcSv75MpnIOtaYqv(Sfe%FGWntJ()q9TYmM6J+=6dQRpX!}>cS z_*BM@8ydT@&=38-=ukWB=~JPuirL}n5T>`Ts5DuClifU}H66#4Sk#{Wu@GkyCBOSX z0l|y-hgFa7ZFW=L@TK5RU4$k-nx_~os?Z2Ru0rj`K25!Ju5=4*C%9@-<$O?e;Pr1} zw4aRGmWl~OvT|KuP&DkCS&b5)@RLV7SqHDqSt9WOZ6*TVR;bfi)>_D6xK?UD3|sgO zynGZ~*%}GLi(Dj&rVGmY#(%%yvgNW_YMY|p#~P9`=tfi=mL=u)p~^;=80$yiJ1A)= z8Ob1I`Fo(A6Sv>Li)fAU19Z}>9v@FnBp-LJh5Y8t z?-_>zqpFtR5dK1MQoVz~;OJ{J2$9Db@iFo0Qqp8dry{i#ld}SeiS*Qn>Cf=>O7}Y25!V9uv>b(~j-{?fp(gmN z)q#~n9-b0H456a|a`>oxnaGlUOTir8d7;fXnS;oZIrll<2`#o4tTFo$R~cD6!t7;H z#_}N})F;0newFa+^VD>F-2M+nCZT|wr*CVtWFaguhIT~_828c*dY_UBnH4I5eTW<> zfd%7UG2YVE-zN(gJqo);*0ik9SZH=4Q*lIQS`M~?3l8iV7CHq}{uf1kuC}NtRLa%% z`ZKBRl<#ajb}Z*PeONIEDucQ!)qpO{r_fyX@@Mpl#01AU?W@ekkrv|g_7pBYycJr< zyx_AmB?!LJ`l6Y#NG6)Q(R(<|p)`pM<9s^rM>g-j?zu5K9BJOlRr4Mhrgq@DZok(_ zbuhzaIYB33{ZQhI$iJk=)h!L92^dot09UVg-EMhtF=dv6u1A%HCjygFaaPNeY7t`z zO@+R3AQ@OpeT`trKowCWh)WC}$Hcl2sCg=v_e2-=Y0fWIRo#_dff z=7`sX2cuWvl3iidmte3ZzhgU78#&3|^4Vq0y9m!PCjvol{BN;G-PN&`g=H0G$6eAx z6Os~XQ!Dluc33&kZ0iwhNrLf(RNoQn`53|CnnhP)h2jVm7R+a)?TeuOmvAm2dZ9g$ z$06Z|cPyw-vO92ycuPj0g(!zSFycc-JT<409?6{S6;8-7t=Nkhrr^t<+?`af;3Hhj zeG@#g^q?F0=hgpB4ad4H{Jyg9lfmHXT)EnEE{bsLlgLk1g@1S6jmm+wSK8+AM^O~c z6j*<~*YJ7jPO7$Zob+!gr(RLzna5TllbyO~+d5;&HC>LPL0dP=G?3JWhj!ntU&|Et zi*mtygjhuxN1}5RZ9QMFgGT=02}i^$1oenSf&uZd4f+6VeVcw^!fiN$g_T47!HjT6 z;IYZ((HgC|3$b#Up?~=6oS>n&heL2X*fOIUGS6~UoV-SJEz;CB*AkMLVSy*pi@v%D zalW_7z5Sh^`|pdK^6o!Tn)Qg{CkBhdJO)VGS=9vPFF9%>#$_<4Hp+mQUI>Gmfv;~F zV^FNuU&m;ySW`QPAcYTaB`O0?KW!#bnQI&gjKI8q5~fl&*}Kh12t$-3pDApq`h?E%-9UvWF%6y6Yr zC-1;+egTX{|CX?ET}VyB&o3IQT4Ny?XW-P2*-+6!g=5wy&M2#g=UC8KWxjG)k4)2e zkgt5Rk6Xr@xXd3rxlq2-Uft9aP3t2`X30pgxEt zKNOo1yV)vVne#Y~kPJHp2z=lB7B4H=Wf3M{?~89tikkSfslUM_!w-A%u@oU_^O#>GW|j5um=l=WMh4h zRXsXlowqDP%$oT;Z}TpEZ4`WER!1_P3nIX%Avl=Wcdk;YQ5Rr?#~ETLRwns_tWgRK zT@`Vv%{doe`JP~~QeWs^UvqD_XEy-@E^ZHcxahnjAyKW5COW4V4uexp+k->Lt|EYLFRj?bBK znXv7`6j6DOFF!W0lXSDLh6yTU*H+;93G|GN1@8G9uB^_d?Zn}Sw;ep-L+{3KOGy*G zM`!Q~`^Hb|eGAAIIP>IRJ#>lP=S!$MxX`Jth)ko8C~N{Z81yi@diR@)2#HaW8zE>R zwwTh)#`RaAXizQ|x+;tl&5F2!#h7316S|qK(Cwa^TvM@Ik zM>)TkGL@b5O`nqgm}8|l)(NT^9#=C+ratE|BxA`vQhRFK6iI|>E@fmSV){%HA^tUPvcKz&JA_eq^n3oad!i3Z=JJ5+P15r7;q{w zt=eik`udY1p$6Xo1WbnTO>LME$gF~6=Gcgu2Pa_@U!_45ma9`BLGIzy(eU?=>PBGjVbAA!#dt+22dp#6N{N;^pOzz8y3}4Z<9v96#oFSUR+1thkr8O&|%k zN6_WSi$CFv)c& zCt)s<&j*vwuJuwcf-V3Ov+xrkC=rKwAH2C!=gjNka7yd!U-T2VYGNdkFHEbM%s!28 zoKmSiVRZ&#PA}0nX)0JWy(JavgCYR5UHt_4kD-*I7&^vAFQNSNQBfEf3nmVr96S&? zp1}=cH9DnL)GS=XIl#Vr``|nA`P5G*EPrzu3Hs+Sux;H#-ZH+p(j9s>neIVn+QPaQ zXs9j{EF#q~W!$^6YD-0r{R+>x9<)Z~-%b;j+jrskI9x9IUL#_gcdE-bn4l1Fv__p? zmh;reOuGooWf!K?%Q~avVne2gKKXz{eBQy#vYhf!(-wrn_lV$MXc71~C{o}dUGPva zZ|I2r$NzFNf)gT4YazuF-4e{iDJ@g@BxS0}qoUAZDEbHe*fswA8e!m-`tFg?hmtA| z1MMXH>n9IZ=WfX@4ESPlA2ZhM_4BVK4R3mz0vnQuuhnoO^l&m)62(EMEFX*dbaaZF zFj-%U8wjP1kp2XFqkFj1m@216BGDNo>en3{7W|P^zfYp`=N;y>L%Qpq$OE&VS-B8Y>?LcA!Qlk-;)_ci*@)l`BOis`as8ERjM=Gu~)fm`lJUT+N1}KZeyx5 zKksOZ4+=ezpsxZURo}hi?Uh_f`pLwgBf?6U|C?-H%+{~VX{HbSgS3VX^}__3P;sbk zrf>W6lkkmK{X<)9#|f})1L~Rjj7R8*6;-g{HDBHmBOSf}j2|hnI=Iybji4UvHT(wc z+4UN~ic~w0TcjV0TnuU_bna^PYp^lZJg4e~bgH^#{={$W)_*&bMy!mznd=#T=vSZh z<*01(3MtloFJvRG>y$@T<*_novDMEu5FZO~Qo~6ljT%RlItVu@xef91ZBP(-KFYD* z<*mjQ&Du2=9l7Mk`H47{VaZST$_?Rgykfz&!T?r{FQA%98Pc{vmkhoadt(tB38r}{ zQOYO8q!&N6AdYRnatWcwlisFQD!ZIE+CGbUC4v{lHq8I?rW!AG4>q=Y7+>}8cX!`UnS(&{*_U*4uomcu98R5)1fK6w^ zmeqLbad~{Oy|}XUdPfBQw`H^j1P|sRqQvxfNk*oR1%k;W(_c6I8BW@%F^hes1^C1k zr&$mVre=%67J6G~MClX#x(<@(J`__US=C*&Nl+?T1^;NSwHXR92tO6Gr@2#CEXdZ* z%z}})^!G%=n>YDikq2^BEs6BP@5}@?aHVsA(Hw&<= zpF^=V(@#g=#pXi4JMV%KCmsyJ+%{kJHYuS#t5f z;tkQ7(#|iUNVPW2s{7SWJuHO>cTg%tKF<2_J>Yw?Uf!#XNh)Z5HGOUT|5c^?58u2#mKFPVrA=E3v>?FnD6NdGHTsa%9!=cQxja zmXRO*v!QL@!SuwqP7-M^!Cmv(V8=@hz`N{>O_&zL<5x1TpiKS3=i`JPJZHLKWnL z?SY(9WrT8&d?c(w5?2|Ae@I0`N1672MfmqYT)IMhW*w_CLujF%uhd7EZ(<=yqg0pb> zCq@T;DV!Hdb|R%QVR$i@@)fVH*6;cw->4oH?&WZ{wSu{G`?bv8LgsMqw(CBJii{nNUWEj!|1{)F&%FG%d@4XE-u|af1`&+hx#M{#Qba*?#UQY zZ>b7Va-f8Tw|^EN)3DQ0l7L3){3o_hV?~zxP9*QY0X36>$P7SfW%AlF*;4(6P94aA z!vYHYM{zE2^rn(DnG4B%*W;D(JVnj`dTZ3zn*a$5(cSi#z&<8{x<&@Ce#Kl3YB~iI zUBzNuO>H>7hQVX|B6cj_U&eG^QWSK^9y4RKNB{bt>Q)7|K9xHz{3e^~e-BdPUWv2B zqUar+@KWcl=pBZG%(!(EY*&sgHBl=E6rODnMmXMO5k|@(|5MNOMeiUIHyC8*c%B$y z{<8CB;J=>tAFu2GDtKRRx8Q|X0vFm(r_L({wauJE5&3of%T;%=R&`VQ>HdlBV#x)T z$R5YN$S2MkQMrd7=~B6mh$qf=!F*Y}h5NtH8b?9*{~kP0Np=)uX?q)|-aCKSGb5an zlUI2F0BR|VV7+YDfWJ+E4p-~m#=x%B_wSdRsGJ|up9P(Tsb0fZ6rDdytf^Zs0u-q5 z1uM1ZC)W6vHbc?XtKxeLV`EunGjl^Q^q`x?=k8USdsv-i>mPNlI&~X|di-H2q@L+Hm-XrM*U1pJC+U;a9wWkt*~(d;0C z0Evd+f}yYr3qIi!Ts1RWdkbo=M@BdM*9|cP)l}dRl=n!m(qNyi%A@ydh3IDc`3|kF zlw97lVs_$8kt2C3bkDc;oPWjGzOhpYE0_B_UWsPpmral2q)D48T;Hn?xfWh+rIrDx2F}_RFd9NDxU#x^W-O5tux2GEA%w95DvZMdEPdtI4yk=LC_flEI1nXW zSK;2DU1Bu@0?+h^BRfAoHs!ka-7q-fF)asy_tXo>%XSo+@+Gg8OwvI;czAlxtG%Y( zpL$yXA5vDd+|+1Ulb~SA$)$s1%D=wxB!&oZXoARuIg2FarFEOB4?4X2@xMfXz3bcR z&$2n2Eq_O%r7w!W@bZ=jvlG8u_7GX;*9J}IV*-l&zxy)`bDH{(kI$XZnG791D*eP= zzgnbiz6Ob5O%4pb+=#dx2Z5VWFehMGBN=-;+zC8S{teH`TuSiI^znMBBZynWIho<9 z^R@_BKN7=Tt9M6XHlR4Bb^u>Z1^YstoE#^ zEjvxzJnPZ=Oyvx0;5{M?3GW)jcb^uA#|kL=qz8SEJY#gEwV zo&^4aQmH(L5J>p)tFVzzB0r+@0cu!*xYIFnAY}V;x_-`p5E6R7p-mhJW0n2CfR^{` z{|9LG{|}&5R6St8yfcG}@|OfFI{!Pfl9!^Bs$_{fxcyhC+r3^$@JHV6D+=d;JMlHA z1P%hE3?M|3@~U;7Z^Ph2k9>H4VrGDs5bhYmT; zqO=q}`c(~1ouXV&)hYT_4@I4(lG&;{9J@#4lR>7pNmJyLaW1dQ1N;fXkYBZ0XAk|* zTe(JOi~NvZnO07VxLn>}K|jW6O5;2l(zPVhU=q3WKt9qs456eIH|+Z{t-n?Psenhl zC98^l;q{cq)%MnST^}Hkb!O$dN-(f1^(*Xgn~dndYX_KM7g=ADTdiJD*)kI`I|y{W zYH&dOwAZ?&@tOk)rG2dG>;i>SKVRCi`JKS?9TdP07$H(>kW??lMST>&FDmg=KV3!r z7~!alF=W%^3AyE_e~Y&HtT`e;UQ}?-Zbd^zro$#ljBiiUqfv!&ra_LR!X@>$>nYO~ z$R=Pd{rO5i`tkD*T1hGv0xm+5c$U5rHc}Hi@ z_{3XTSEs|nLH`uxuV&{v3(?)fM86j2J1j>MKH3dI7hMFNcswk}JhZRE`E?;QyTtj< zTNaT=W%uw!q0NWN1g(maX>6HFx=xGB=EnDLzd1%J-3NkJ(UXaeZ}#|K_N4~d)6?!V zg`*l)rlzYQlw?+MHDo@H0}byh%&{}(gjBsJZEu`^*p)xLD`;7;tAv;Yi6dX<-!kH5 zu}=j(O22Uz?I2B13cp2dh7!KG^5-c>=Fg82CeHXC^jprVdRP!cXlAALiXD(` ztq7Hp5d93kpD| z%l6ukdNz)B1TTAWN3SJ$=_O2jl)FP@rM-|oQnsbZlCexYCjO7etxZZ6b(u%@ZE5{|A-pV^k*HTP?a(XhANtgd7g{89%U@eS2oPFSkeV45?RRP8=tn`^1 zQ+rHMJQfs7==mQ{DRrzL-}eq394K8KRtMbRyZhmG1>$l#5dc~G&`EdJR?KGq!K zqO|H|thnay=7hxAeTi)36haRBmyC+yWD+r9z|rjAKx;RR(Fdb6`u!{}Z1tN=(Vew_ z9L`qy=Cs{pX29VEj$H1i?s)Mq^v^@)gh{aO*@Li`&2v6yr1A47G_rw0&u?^%&Tg z-Sc@oVa2$f?odeWu_7AM@pHe4m0Xp7)5e2Wp8 z^s;GhNj2#ssjP6yk)wHHfU1W$l`o)u+!hmDLYicxnPT8HhyCGZR%#RGm`3!Od2Kd1 zlPN^_;&i!kMS(q;Osac*1yXDDO!@f*tOfQIZgK)9k3rtIyREOgjh#!NoBRF!KgXbF zg4*=Y_${1z1%zf*MGcuX5K@>u!P+R&8Gn6T@hI)oCfjX$WdfTwrD2*vs(jf$o_LGg z8;JCnHIqxtwJCEnV&kGmCK*Vek=}=2_=3jy>=s4Ru6zs2UtI+V zG_wyJ4<2Q#czu6P87MG$@eg#r_!zP|?LHjW@i=+%f0U>^`8E`%<&x&^jywiP^>klx z!R7|u=~l%_SH0xFU$0ch*Er_xnrjd~spOHsjF+te0`ZK5;)e(H9(HdYrMhgZV8Vn+ zQGo!Y2W1C$C*v}frunVe$|i!;;eom}>DQgs<*VNC&*N4PhvwbRn}stke%m%z?&tDm z0VTJkvzGMIUCzt!)Ynpf{!Spzde^7>qQRto2<}H~b+*a+z_|Z4`!kzuX>)rkmq8ad zQOeZ8z}{3DJ0S3wDUWod{e|;<6J?>?);-Mkty`y~yQUE+kotHrVBRrzg?joFa=6pI zP3!f>1LR+}jTK(^vi(|-d@kYnbIAbd8`Qjlfs24lgD(DZjU|Ni zafw}V362K;eFVgHZvRo|G-Q98-?<7(-V9)^w=qQ~L znEEu`e>}P{w$eSR2y^8(++YlMyR&<$h!f~~{B5LdHU7T)$8Up=1WDRtSK+PbNxh=^ z@StROxlg^T9iUCR___1!Img6fS1a=24&t@*nutBkUlz7YEve|JHgeQjyYoCaY!rAm z_W`lHbxien*lo4wr{B#_*9mLH=#^}ePL3?DcJh!eq~4zFJ&!lGAIx!)K?u6W4;i9czYH^}=+%zX2&HiEscjYSwtF zEo!ynm2|4uRbR$KyH*iGkT7@O{&#C{V@*pW4#s7)=@sW9_E<8duMvh&QFX2bn;tnf_+dci@85kI`Y=kdTr1yDcCBH zUMlIRnD5JXG`RR&I5pwP`x>J7$S@< zk`lQFX681$Rwv56wTB?K~E|yVXqyXi(!rz8Ymmt z0gHSun%w~Hn5F+i*gFQ<(llM5W81cE+qP}nwryKyY}+_vTW4%rci!iVxN-m8AGISh zySlofcSc5c$670qo>HY=?pjxBo4vmd&i<&Cn)%S>_r~l#b)tHIs4-i|HG=lk%`V6yYD#KRl|$gqo<${o zd09~0`0^meZK^-W+A-w1zYO+hpZUJehc|axmp%AJTqx7 zgKY1*vF~_vX7mb^4VNVn-*SGB3cfj#|ZV@-sAnQRbI0=h&HZ*0Z&S?Lf^{ z45Hd=n}$uZGCom94&+9RzH!(HXuoA}^nuNSX%oQ#*@Rfvd!#9U1|@&-DtOpyc_R)B znX#d|7?vCcF!yKpB`#&lZ4Ilv-=~$Dt%mpaq1k(UE>HiotSG2>A-LLQnmcTvi>` zqCz0txFoo3*Pq_ke+)>h$X`nAasw`)EV2M}l)8YEZGl{Gx+l_X9Zpz*$obZ?zY~{~ z=*!JOOJd&U@rvM-4v?6H2$^6MP__W>{xl#ec^X?PjNz?cTTA11a{%N3$tw(6S)3G< zz8AL}cnxS5u3PjqO~Di4)%Benti5-sx+3AUu`$s1hnI&+DAOLy!ZQg$Redy`&5#?~Z$t4+L5E z&uaN2Sjr#Us{rkfq#&39bR{+|fuVVnm6$-dpdEPZ$2XXKmPTBLFgB$~L8L?Lptc;( zK5m#)GTX`-Z#74k-K@f|X%AN-w>{WP@QkF9Qfc9G zOQL8D-7`63;PAB6R&K{~_(VIg?a@cT-j|@W5)d#3kD~LKP#Y{GBLInSTce@psM^hO z2e^((Ai2r0GtOCMzmU|UJZ3*li&m!ybi(C z%b(6CO{JKAQ50=5mNNn{-CtJ?bu^}{z?o)#pCKmv?K5OqpBA2szc5TIwz`_jmpa7$ zN!%K$&8CpIbL#sWhCfR-e($eI5KrQdMjNlkFJe;d!yDhmnkMDESV?xR!7}q=0x8;_G&B(;ro2+b zCc|m7k06d08z7X_qT;1bip(v>fdzugIu-!@9Xbf?vo`$zyxC}t#1H1qMr4Umuplgo z)p^De#259q3x=0Sr~g11*UKBPMN{9Ti6eNL1F8|wZnhjTeB#cznR--tAcPFz0pC^= zYiU`6;w-P?K*^D10iR*AME*e;k#0;cg`%4QCl*;E?$921BL3vb%@Tifu6-;O?bExDC)2<3Dx?tgKxg^ z^0T2%+=QA(Dj$%*OSL4NT6a!4+a0d!gxEDrs58H2>B^qs65)Mxndk_Qs_7Fc9p!+y zfkq%BogC%5{TCA3-4nT66na+OzWjcjfS7a-YEQ@VG?ipaM{%jP8`5v|lm3%>{kA=- z6(5{~i#UQM9%|UsTVWPHBjaN+l=w-^YJI&OovAA!RIpK= z5CTVS^%1UARCVC7eUU@fo323rQWCk zp~0L6;Q9Q6^VAX7fY9b>6d3M}P%uo2{#_!c!qvqn!(#C|`+ns-@C`YJ^2d#DsS059 zGUAXo-1yBdOue3sv_*TR*Uao0=dvB=f<1V5CfBPQL)Z%YT`brdTaPm?)5KDs^gaoP zkTagJw4Dr+T@U~p4pbhhUsjw4|olVP&Sc9L|X3-4bbCP;3aN6R*7B*LZzX%pQZjHvx~xcj2-QcRg47qgZs{ zSBQ^@I5CN&To!a~sDipHS%MQ{ogG<>&@O&%@_&wg$-C@*KW+Bnr9W@+_Os?kKTkj3 zUwsqn>@ZGRoG=*y+i9+F8hxV<4`O~_Il#;jCpnvmUnQS+`WdxixFIEb#ICkT-x5g@ZyST_qB7M+`uR@j|rZjZ;-Sy|_4GvONd(;QqV8uIj1SXBTVE9ifBNO)}V$@8Ct%WzjfT7{b`A>xkx&&3fH4 zbt^uM+Fbe}Gs&NhP;t<@e?8#CdE6g+2rJA5?2J+AVr3|FutKGa9V}7kVh2kH3LGpY z1oszygP8iC(48#zyRB_3lY^T(jm#wb-BLd*Iv95wS6m|)OM7&Iap+m_w0BRX>)<*i zpqR*1jksA{;jzLDZn*@uf*6eSjW8i{a)EarxK!c&j@w;)$pOO<_t;TE4{FjI=sN`4J<>4m;GE`$2hiUyT8;_tSN#|NU`mPB*8cTwh%o~!SgfEG z4JK-+I8h6XF8?d6p5hu1@wcqBHaATT_5K5>n;l&)xIE-G~5j6otunlg3!hO@Q`d~Gaz z>b$otILEt2$A$5^wC7!)OG$|z0zdfC)-_)$i!zW$^fsVZ^fsV|_+_ANK7dF3G2pgI zp6~1%ulQ~7(bSDv(W)~!b*^?-@2QTc|0spU_y<%yiEXhA&Uqs1Nl4Rh<_gt2QQx!3 zhClIcfa2Vseu0C%*0W5#~oN_@$qWGpnf=xpwiz>GMwY~uDb!yk0~QLh1CV# zpP{E#o5uyQ34KLfcqFPz!XiE$7Wtfs=x^Ecya(7iwhYhenbwFBy$d64CU^?(m{EL z;bapUf+NmCsODS|xpCuoTI-=+2@gB;zGt}ga=lmt)`By|I8kasa-cc`AGrCSKVyG9 z;mEyt>jdPgW^zD0?KPcr01rDUC(_9|(q7z;`*cnTRGSir2EvW%(0N#}(P92wzsElE z9^b29J$*7)c)t}y!D1Jje0VN5^VPxpW6S$|;z|@0oO%Rmyx4n7X^%V5e^J_9HlK=e z_nAfZKDUqk_vxU%LXZn)B&m)uTAZf1ksj!qb2c?JIhmVRGx1@Z7bRS z>#H|$`z6_`XVK3wt9w4EJS+8xH~jFagTzembRO+c<~ysGC~Ep@|mt;S0?iQC(9 zb>_dbS)?L~NO9f{*F0`q-!NeY+p3!P3I=q4&$5fhNjIqlExrJq9}j+{P<}?u*>bw` zSESz_cib&R-8!aX_#g2YKvr2VRUq_^Z3^Zfy1tzUbi8ns7M+y%e4%ZVHsN%^dwZyc zynJ0f7VUt9bPzN#ZxQxY&MNJrnCaYgCKheah%7*66Ydo=R#eE38^S!gB`xEfDydrs zWGZJ)k#K*N^B5Y#8=0e{W8uXG>W4?JmEKVzTFpIFBxLcISpaeV>QBhg6CW)imyD^+ zJyO$Yi#>R0L4cOl_Kj-*8ql~xz4ZWPm)r{)#@owI2U_N~L;go9yXKoSG$^PP?D9ui z$O@yLr`I2#v~h(7)Aat>fe&Dg+R#s^)j^IcOuvN~O2R!PO=T?9VobjZJ^;&t*nD&X zxsH~v3)VTvP=9#~PIFOr(!VAPwEN0q)WdBP4pKf>N6;8{Y$UC^rpM~`aQe~^2QV8K zB2>^!;drldYoG4(T-|tcP}56x?`RdLuU7%66o-OnoX_^JG$T2Pt>JIrPS@Zwt`;52 zLeh9xBT{#e2PH-{g$AbOYb835ggVgh(X}MVeSQK(A(Qc1C9OPmO>A-|=H1n&|BP8W&jh;3iC@#QF~_AD2iRx(lfQOM+^ zP-5YakdtPqx*$i11WSYkFNFkvtIe8%6-ENUf`oecV}Jg%03P6Hb|D{7AvX~U$pI?- z3ZO2@AT-mE^U9Ddh=Y`VU=Nk_I@OfeIY#6=2WgP`U?GE1l!{WjjMHs&!SxCF_$Akt zC`~`9QxQmb4tt5{vzPR{lJq&1^o-|}_vd&y1yOK>(-)z2H_CQvSt#V2hrIZ#0*bcX z$~qZD;~tC@tdNu?z2tP6u9^-bKU(vfRky!&7xc#doIRH5$4)Onle|fFry2Lnni+e& z<6{ub6g3$BeF)Kw2}SdGm~$HL zF%ESFx9kWCX^uaD4yRs{p#!5hN#5Zd^QC0wW6ot(5?!U={+Po8%U7Y z6kFrcqoiVCWt;|JkemO$2FuWbc>2cxj)de9vp)FE4t-2-L zUl0pC<5ByCa7OXi=5I%W{4oehkXjRL$HuU|&x%?kgK0TjW;$4f5x>kbtXb4~jSBZ; z^@WVdfZld?3wF7Cb3RO)rMD$yi5D{Bo)F4$X7@I8$r8;B##xyjOyJ_r8#78}oDNx)DjI_WCj>>6hMh z{!7wzbGHCy&VhV_TLA zg}|Mjqk_)ipQQ=X*DeWgvFMGO32DAa8~YufeYaja!A>=tJ)`cX2)vYyeOrp3ZIH)m zXQ!!~6|x9+r9tlno^8@%oNEy zsV;|l!4ik+OKHM)HPOKbC4HW*29K7zHk7B36o! zMW>XDH2S5UXryhW=r&tTyAC{KrR@=tC_BhURP7s7vdUXh7nJBLB(ezRrt~%ICvfCT znAV*uX`LFmGsv{H6KR*rc{_uy>)RIoYyxm(U(gle`5x&?`}E-kg!8o{+%w&4hdS&I zf|*M?-H#SWXy+CNb>l(?_0ZqJOEI;KfO2eg&I0AkiU;NVG;3IU+>woZgG0K>{I|~% z8Pn6Pt^Acv!RSEl6ghS4M-sqRC!C_&NgHN6YL+4eCr+6sYM+jm3@~U~I zPST|uQa3k=i*=$v_F@qEdYu^l0J#Z zU1X$gLP*28bM%xI;7J54S6rk=j?@zF;(u4sE$t1n4f+bR4e0l?4YGlT`K#i8!PX+J z?(=B6(T7EXM>#~?mntc3pki{uPWHZ$PPX8h=*K&q2uFOroD&J&EhSyBk|_|0nEqzr zg-=R^NaF`y&?D(EiNaZGIwTahM1jt2qGCJ=G;BnHn&spPD&Q9N*>(c_sgTztFY>j( zwAvA#`ni4~UY~RDQiap!*T|H5M4_B5a}#cp3A(o=`gNCEJwEpUlgfTA6Y@PP`r&x|9KG%^z|$>bQWPo+e?{s??j-;_Z`hB`<=_ z)*{WwAq4j&GhC9s;={VW9VYMAr21dga9j%udSVOEFO&P(q6k;t?0PcsIW1r0UMg<$ zRV49SQ>4tLN2R|~I2ZoJ%Wq=cX9E|G^nIJtwI1o0JBd|lwCkHRjQO}u)R}92%-sC&lWJ}CqhoihzRWdeh z7>R&m>^z8;CPV?-HzZ9DaEwkphQmYwrd@*~=#mz*r7ywj8WeyzM7ahlP&$z~9VvJW z4L!Odz`96XeZy|9i2Yc*FQirZ(c=>lZa#>oheSp~VctCv&kl(FzYTOqyS$?TW(rt- z>^@q@U2PD#JDGa4RwyVb0+KqLOWgDkwPGdw(Gq*9fi!|0i1y>Ch0J50OcGC9i2kCx zZJLVeEUuR|N#*5Hy>(VdyeKBlC7VVCLtXaftKy`L(3zuwn|At+;=~0&=4OtA85w^7 z<*uVc%Ql+_s(S#w<_&r6k~EQvgklE71gZ-9J$bF--Zwnn=ka}G{Jro(N3 zwK=t5qYiwZjsR=naF~(qGSW3S(g(2=5mUl_|9H9i=DTMTOt^i@BbC3U;ymjj9>>)t zipJS=I9_XfzajwpYW&-q5S0OwIE(+@3jpqH43qL>W5KrE|cy7ipAb@AvRXW z{S_k29k+>Pa@k*^%_n?Q`0tK8bKTuxzPE%h+$5oJfo+dlzr?w|+V5mdIkAyG8PV@# zQcQiMYku1Xdq2Evt~ezM8`~f(zZ`6;DaQvjf!68tRdJrQ;57y@lY3dTEMhGrubI8R zZC?Yyk;NjQsj9jdu;-~j#V~jnY+Y#=4sKvkM%k>nx9VV(dx=RiXKFX?0*@PfEjk^dvnlIC%P=9fuzLaxAx^sz;+qdSg zdp{J4v~xn~fNROY=q+=6^a@i({S^YCU~n!w4P7fTTrg(_pP-VX*MvWnQ$kBYS(#bA)0Q9Y z>e5x>2>z)ncCns)7{H3^V5nw6Qy(-c^c`OO#xHkQ=l7Z9;%$Cmjs>w~IYQHjq%g^D zW)Fii3&@oZ{aozz=c9q~=YaR?>l+Ge38*mALsEjwTf(D++58c`U2pg z$PBlbY>!kLEk#D+e*?r!#8et^yrfgY!l?`*%`i-AjmK(cZdkUqg$-pSgqGr@Dn(dn zEg;_!qY`8CHaa@ik!WwXy|t#T7KQgSZUskc*j{1BBC4?ZW8?iD)gCYGimA6g*scts zgd}|`y|@YRrkbrx?q5MeK-i^#Yu<$ll@PXOhR5_9^6s|A-lcHH&(}bL!sVard$?BX z<>fBN-jb`unoc`X5oWt<66Wh{5tYnBZEi>{7)a*~9-pC~jxjd+z@@>6-D-Dnh{(cK z0k)$G3JFg4oXAd$Q~yXYOct}4C+UaNR1n1aP8OgCP0|JtsTt0YQZRQA~4?Fez=_(Gux3 z{uN!#uVhaNy<4&HOT}zFRbM(@d`k7Ow_hBbeFUf%VK3`x0-;n_KGTgf(PRYRntt!_ z56REVlUfns6skNnh{iLvF7o)(E)wVRN|8P+EKkc4n)X-4u+JGB=5$nI;vPFRQE5W} zcdDT9d`YGs?bU5gbVd>Ppd+joS0d$bTr-YXz5NaEufrh(8#*kK!Jc>sOJ1SK$3q50 zut3#6AijUC$oY3(mx!Ap*@=XEw7B=&m;+5|*^oPKb4$yG%LcGkEH>T6@s^rq9vEy6 z0SP<8>0uaIK)OkT2%S{A_8vmoCU5F%`q!Q8`Xe3F>0W;Ti8{(E!CdQV(nrevv0frx z)E*SCAkK5rfc&E5T$b!F%P*9~Ht%wAyLSuSYi7df2H*|{L)MN`raBDL4Xi&5^Z)2J zuFdQ~T^-UiCb#v=(S6hObT?W;D@j5#jku5?vVLad_7I)7Suk4@Hva-^IU)3I%NgHuib6gjP0a2@1pO??s8MVJ<~fWqT`CA zNAG!mvNI+Pa4-lkC=v7kQBnj6as=5i7|cvsvOLG%VLh>S2&Hg~0Ic#maNjxtwIZ4r z@uBV3{wsQnS`Ge5ceD2eh@EccO)4ES{HOXwYLx2M7D%%4YL=!T9myoM{BM#4G)|Zp zjTL%?Cg=y0aQY%${2^sytPoWVy(DGvHytwP5rLjNEVts>x5lnMr&omP-{s^lnuHXz zmm$%WbLi%Rj2GTUj+cS1i^{3^JwEKn^Vj{0i!7;ky&6i_yaCX=_ z_bWsi|Ig*{z3YENa((X_#V2(hFNt1HgmTJ!PFRr*ZoonxVcv!`&7h1bIB$b3Tj}(^ zKZ>-z6u8n`0o`TtjSd90_=!BMyF#kF?W>9k_6bgMR$)O#-I3OpCFE$Nvjn$1W?m>G zxQ~dl#+~Ad$5e(x4;g2QD7&_a1rvkC8DQS`6xTuXC;RnC=Q{gpGU0ul+Kl4wWB3)b zk<|(P;-IHV-=$0TYvWqKNWM6z#3uitVd$fJFd?ewpk^Il0S3od1!?Ly#5K4meWzK` zzl&`FY=FC6m!&sL(8Xtt-2~EArJlwzd!$#C<&6OX<^G5YiJ)?RCXsYOfVY=Se2V3j zf^(14xMC5pHj$&yEHgrci(waRUTJy?N$w}{RN;JmbLezptuZgSXVSA?3jA=tt4AGGge`O8yTv)Z`)IQ+e ztR*K@p|q=oBGxegF1|ovQK#nra^q~dPIdQO4*0&hpIDGq%3Zb${p4jI&L(ES{l4D4 z3|2atK>+l;#8yp{(m6l17ZyX-c~sVmSlz zV~ST7jCDwG^vHzO07!;R5SHnfbuodwR4D}XAkZa(a^GVroeN`PPKxi8x6RY8miSZj z#e%_9%r*P?60fC2+Ko@qTZNr*Me@)yWs#{Zh>-6z3NV1QFg2zKz{n>Jc+xQw-O zgP}{8pE*=BpE(%T!GOBx49%ncYRi$!(h4s`GrIU6YIf{6a$yoMs}!uxE!S4*gm-x zq7N%mwj!+1u{%YoX~T%Z@LX`=y?ZbQVF{)Im6blokf{c;05+jvg~o<84itazeOC2X}d*4 z=leG(jss4_XLPNz9T=XG{VtToc>{n;^>@@5s3)vFZ#Mu3YmzmFrSeq}22#F6JP0?i z0}$6XQzn-97*tX>JtfwdT0z|1%*tbE^q-3`eS<{^=7Q|reY+)iI~lETfXlQ*#oFN= z&M8+$OmJFZ_AB*qI17oAu1LysVpgR@WR!5H!a1$nlCLQuQieb*VM`tB=D^CY=)zpc zKWWph^l?`Vjs6ojCRf=&*GsbwZ#`oHvXzPFc19c%+QRP#a1%l;(`Z(S6tpeeXSU3= zvg(YDX{u;W1?CLSvndeh38TFkb2lV4g3H$wLy^r>L=+;FGgN+vo>N>jp`yC_XvLe2R`t@4y=MPYRGDPm= zt7|60+JSv1FU>kiU{P08P>olSRXQXW_`LA&$d?v%rYograFW|m^W+;7n`Z?NVB zP5d4(su7 z&8-EE=`wKP<48-xT@4_6>r{E=hn3CxzEjlNa5WVL{FA`b0LGV70=p$MfBwhj?hE__ zyR#tJ#4oj9dZTDFMJV8{iBK*5`y%4>?;eq!38-Urr5s~QxarH)Tq>7D%M8|&0^%=H zRoFE`uvGV}Cl1ZmC)SQlPL}0kLAl8#92oTU9#o%Bv8jNo^D^HdDCB@+2aHXLfiP$* z@c)S1cgP-9sS1%VG|OeoCfvUQR(doEg~!5|nz>xfxJ)|Py6o+2N~Lai zYep}CW(yWlwd|{Gh2asN0It(+%6X{Bp2@< zr2ivz3u^6Q9PzUCUo11ku|OAahRS1gVF9n|)A_)1yxmjdc2`5IHvM9QBJ_4FN0H98 z@|F`+*oP2MNxqjnn*17}oeDwwS7Iuz6@wOYYOi1}DkEmuAlG`75|ZtOv<7oA9~#5s z2H3>ojRn%emg!8@IufgQvBMpY=SgHJ!d z@DS00icE=_T zx%`bEX~@RiK0u^su2Y%=GMlVHUrxQJ_k^SN!6ji%UnL|<=F~Cuk9G}$zQj^Vqh_{{ zK{OxFlI2(xa?Z(7${6rK{Rc?uaBz9h{CyUmWV7(Zg(F%jV@DGt3wNN8CV!;|KB02+ zx;lcZrzj!S5eBCxfwKP`fI5okzE&r^bPG)g?KtMs$yR4L8|SV<;cUx|A1qUk-@&^U z^l!O;kYL@67e?FhB7&2%1Zy6xQ#&NfzB97@!Qz>xfBnL0$XR=cAHpMwsYHdl?X?Nnc9^_jn> z?I;MYuMNEc|53fQRwoit8=-9o-3H~$>ypY%_NI2-_uLDN+^Z*1xoYb4vZ@>t(QjO7_Du}Y_xut+{|AC2c+-H6JseXh4qj*cZ$rzYFI>y z3iYpvH=_%ag_BUs;*Dyc=t`bIiEiW;UC))J_}zmR-@0&qm*Az7p(!>kT3xt zW&&BNU6BS=)?!NZbM~m&r=6t=JV_B+hTU*IM`_UQMYR$uDM6zK7WlRVs)EpzFdGjH z41YJ3(}9m#3=Xy+)T^`2XRI~eZtXoDSk-6%OIXWE^haGV+{rqwv8k~%ItzuWNnLue zpw{gYqhzeDoMv=z<&S0xKM!bX(Q`5ugUFGI?8+`f7R9!Z?T-`7RkE|yr(!DUTD4QI z)#E~2g(V-Kps4CVDAI$7bucbS|Fkdq?oYGuC`~RS_Ee6eNa-==;GWNssVdNx=q*Sz z)bdwjTP@t?W6w%BibiMKs4V?+Chd-}QGJ$7EBpFsc%hrJ-O?z!)fco>$}fSHTxaH1 z=I&L_UXXGsilS|zA?=_f&j#!gL{i@tkO!8{boTxEQ0D-67i?Vvmz_^E$JTB^o;VL) z9q{D8NiewbN=1(-&aByH@m_VmxY&8{HO-TpM#W|u-%EiwBC zK8h|~q%*>B`8VWmI{@gxMGn&sYDU&m&8mO&12NN>#9oPg-op2 zzd2_hk`YJthuGjflHnHm<^!(8=YhbC;J9;W!Tfd_YaH~|1%BQjDJrEN9z z#s4{4e%nXFknUeB@m=BGba4f8H^FIt5=^!65ms`DXRx;@&rSEyh8oZSlC@0v?MQtR zlie(rh8XX^@|*Pyt%h<3UVI*hgaOUIjDGJ{umU&T{3a)<0LyB=))2aW^fhoCvEBah z`(BGQ(yg4b&r3&%Z><-;^cR>I@i1FuXO^+QlvYaRq&MfTTYNd1=y^RuXvMB~?K*CK z7$QTFbt4g561Lwb=fvt-vE!vC=VDf`4f-(~Z5zGm>^;4^7epW6`!-Q922#Ni^cs@0 z?p9+hsO?h!22eY~)=1nRee>ncSlFbWtXdO{VD4u^bPl3??c%0ew5Av?Y7W5UhV6rY zx$}Q?@7wm!{ST_e-3IgGOLPvCY6a@sAX(*jZrq_(jE-TQ5?GRtWHvvEsTiIU$HsCM z(JnhX2>CUIh|xYoXwNT z7k3J`zh=NdHdj~J?`2H2E;=wxHl`WJn;F0|TYX`eu8uKGHe!E$*tK98?(t^cQG!Lc z*jcK@=d5Z(?v#aUd8uEq)fbkOACn$9R&d_6Ew4eDj%0^)XH}Haj${Zb21`pb z`9#4^voR)9l4Ko=+1n|#j6O=IL9%GbNN8-p7-?jh#tbVruF7zzQZbIHeg7%M4iAD> zBO!E_vk1KV;2MvT$u%;IzcVedvYaA0H)Os-5BspFV|=j_#VZiD1_u-A^Q8O8{X6bA zcOA=tgTrOpg%U^-UZCMG&uBt5+z6_NxZ`Y5C4pybe8eEtobeCY(&+vY*Cu4h9U7}Q zb1heLO(bjY!jV*Fa&;^m9!-IG!FBGpPuEz%x-g>#=+^kbx;D-*ZVj=FYa>|o;9YA5 z=ogG&T^g$xK0R(Qy*su4fB(!6X75h@NSGSPx>H0!PsC~Q+6ls(vMJLJGcH&1U7U@D zLzb%@Thf7umE)|USmzT z&4quc%>}7yD?#+dkP@kWaRHmKvlYq$!u!v1mUnE>$H%dG_Sip!^&CG~#H+Vqy8g(K z#pAfd&y|f(17nsrO&O-N_+PFO(+QE?Iz3V|x9#C1+)RO;U7NXr0B>vI08-zQk5&Dq z2ckK@F^NXNw_?4I>|xYVYVM#iBZ*}Vm;|^^Vg%JB*icH$w_C#(5&Zb^zD-aSR^pR_ z?%@`$Yt?|eJ7MLRc<_yiA?d!_YA=;8H5+dvVa8s}z!weBHrW0SSX41s*6IV1j_<`Q;4!@g?W(j-EWDjARMk#jL#!i4X?V^0^v3T{O zH!IerX<@JSJ@3wO;Z&oE|02!$ERS?v+0&NaSHts#?8>Z;^fTjnk}r4E6F)tI;;sOJ z^{ZoO8;S+Kx8YRlux*>MX zpa`b4!6+KqpwNP(_ic5Smje51=o(Uu59c+Y$^`V`?eI^=g|1`(?uW_JRj6bftXpFb zQ=s@jLQ7+yMB`lAJ&dRy(r)9(R42xqe*3t*{OnJ;EZ?qZW|6dvz&+;-Jxg+`B@UG3KPi32fth@>)ha2 zxh&l?ke=)HmOimJc|zw*ouWWM9pq$NcZNjRS!zY8adhn!F3a!IE( zp%W}BN1^bo{WDr%&U6n$L~w;Vg>|U&J(H%YQySGSZhR=|$U6s2oy5$U&c;bv4+2m( zJ2W1zHOFRo9n9971G>INynjM~$tV;)utx6_z=-@L1WFx90t(&1%I_f92iFjyttE)# zV8&3WHUMo2-PZdBbg)#C2wy1Eye@r1oCJTBJ>t6-+Ey#2+kCsNv~mC zn6|$VZO^qI1=x8<_lcE#lzZA=3|`MYkK9<;=jU|yk|Y|rSsg~`^Fp8 z%z_Q+=SK$njfOh)Z%&o-_2*%AyeHlwkXD|J?48G*`0`>idHQx*>#rPEZ!hn;a3a>L ze0WhSyq|jY{SiLByFa%PFQZ|=-h=Sxpg%Bp4mmH`Ajza5C)l5Bg$DT>7uy%GUv{9` z&*NJC<}{DeAZwX5^=B1uPEyx@Ro4FULIiwTqz$_52vRJi!GwzIt^n4vHzB(nVuJ|S znvh-QS~F-6CK%TX@$i9BgTxF#H8{hlMI2*PBgEHQ*9#e>@oEsZjv9oXVg;iDF@jMK z&oF8b_DWET>|Q5uA6yD64>T}72QJVO_4f89?lr8vuUNbRv~M~-$(y-(@RaqM_k?`k zJq}!Uqp!o6%lG^{xodc6=`T(=nMY;cjR}E28m?h{&{n+lRcI&G>*ZadJY;YK5w#8B z2F;{s`*(;R?*kvOi9{S9;RO%L7WDf1do%W4Q1F&;ItznEDZpDG5wiG2s{-CXw$9P# zI=Hbtq}7wgNT{1zQxC>b7M9E`d~TJPrW1tS+WO8DfDI z6xy<&39!NU;EL9D3c4Htpw88t18YYC1zGHnUGc|2akggQfNQpaZ^0X?hWg!J0C?nh zb_@%Oy#bIi+qhw1wt>U00fk=z3cdRkZ0T%ZmXFVk%h_H|F)F7+V+uELeuvK9uao*4 zUA6x`9A@Qg_-nJPWLx74w{%=Fy1-*}g8!~_+w@;WS!4zCo+19NJs`0IdBR}ca<9MD z2HP6%lGE?E)C}YyGk|%+8U31Zzhw!*_!N)fzXf=h{%;>#mxbN}w*TL4tyo;)%|-0} z+-pNDwIK(o3F8MA#s`FQJtCfl@IE5m8lMu+v4!ygwJ@sOUSJ4=@-wO2TE`Ry>5pMh zy@tjX2JI>g*q86Ee!nRU+}y#3L-`4V_WefFH3#fZi5VUdG2S6wf3t$?H%$nFQHy@F zL}ctYfee4M>Nl4Lpyt2d3_?9VhX$a2XZ@zoug=5oDKNeuzZYFb|8G0}bK(W2pBFEP z0$-T4%`&EhkF=BOJVqyqCVrjCFE-{e&Wk>6z!3XH$A}o?cxf{9+(omLifCYkXb|%N zrA2)8MnkED9%yCTu@uiZW=do+QQ|){koq*clB3w0eg{k!mGToYq)IdaK$7zPWQRqc z!MWb?0Or~Q_7tNV`EV|-90SLbqZmn?ON|~Xl5NccWXLd@hm4U zX)f8Bg=XByVp(73hhq;fecL&GJzSuw0lrh^3>>NyvlNp@c*HQtGSwb*q3iq_^%R;N zs-B;@j1kPTYBa5Xl{&Jn59(#IqO0e6!@x?2F;GzFlcGX7!=*Jd-g@7mR98vN9T7DZ zGre*?tqzTSVT%=85ksOZ!epT;@vF3;W%+v>9dE?-m%q=(*})RcAaex*Yc_Pr=aLBt z#a%6solIB8|80P}1GSvt*o-*U|LM5EPt2jUz$2FtR0=4bmZKCc!lb4R5ISdb655fH zfXkRvH>q$f)630O{ksz~*`y(ME~D&PH`C6LV}+wEJI0#jXf{&iNV1p`nL93aB<8F+r<^hkybo;qg!^@&7eyU8a0`j#{BEQW5e41V?55a^c(8uF@&bJ8g zj_Oja@vd4dpUW`+SS6Ov6$rLKFP_ge0QY!t$3HqpPo@^wJSjcXGN!eIC7~K+d1+h~ zc^!yUgL}GYeYq!9?N=f@TWhfmC#C8lP;H@S1&wjV&H^GZmtv^8Ga6=Zq2>BwwSE%P zO$!uLBIZhn-lwatx4os?*W2qAulf{>>dR36xN+|Y-Un4)xjNX=m{ZeEqtZwRE79UC zI#`1ji=0ahXJ@RsQp(o@?od(?57IRu*R@89WJ9gIJ;IXc;NGyJTa66)jR^Ju0W1o% zJz<7#Tr9EHm1#R6L%*Jb2FV2?EA8aMa(3)`UFVG$xY{A&4r7fFq`f(0Pxl}`p)Vi- zUtKy-nX_Oo+b3rQ7xjDBAkZWkPompcKJsdIn>-^Piaa?Cz}*sM4fNS?rh?$^?4DrF zE)d6Cm#t^fG9AgT<{aX7@Lm!0wmKgVxRl-Ob+rpw5p4cMU`rx4$W$?RFnxyb=J1Yx z?u=K9&EjZNH*o>0Ppsqb`2(dpyjQpYPm=`BM7L3c{4-$74`Bi#G z%85N6y1U!$?R$UYkB|5N@*bD2+5^yU3ao@R*z?YXz+@I~6*3qKuiV!LLO{qgGkSh#DXarxZEMM0n85}5YBb1~3Jh2YuQ?3-w>2h-r#dE4 zMB~KAv;qXejj*ap4>SdTAt-b1OYMpK3vhd4va2?6I}~rx)VlNbm{onL>r-ZYCM|oy zd;8D5w4&E!;)1-S##G%d9KLh`2M8x>Hw{!(Vo>>7>Yz(+H!5dMU#_Scf>8XrDy5W3 zKmIeGM!RvTJjA%vR1V!nMGl2a@GUpDsNwX=Q%J}==3Mu!4tLDx&b+YVh<4|aRz01J zgSt4qZn``mFhHG&QmIU=RK@}p%E(kj{ArzJA)~GxYSyyQ=!@=jVx93?(Z2rbLr?IU zR*1!Y`=4oHlTa5@)IL#jlb_#I3D7|leVNKh?0`bNo{_AmpNWcfTD1CMpS<7O`{L_k zc5*U2{iy%f(?zmA*)9H$+xzqx`OnbmpFiZ}_`UugSKE*0>VEHM!4wPLAB%sI;V;kC zNfH(p?R%kgEP{a@3dfl6H>rI^UGOw;R`6f^=r`N^{8bqPmEc}w;v48Mo}s^$INFR9 zXC4=|(`j_Nz00w%?|SqT94liwLTX;pbxt~D$U$^iS3sMB#0254d7)?Euw(Rt@2rh+ zre0m4HMlf--DY!0mm9jmU_=ET2J@0YyyA zRBW6`)!0&lliKU|1=Bj(W`Y1dID>VkkR9yiw5FiPNp@0#yrxa3gBFql2R;?-^6>_kHi&S+my6nh%*f_Ks&q ze9Fwo9lv68-e0mbhXO2Dm} zFeytTKe=XJV&;U{=bX{Qlq>x%x>NtTwS>-@*If9Hi({A`ekS4%=Rgvu>rF0Bl%@Vk zL6Nn0k|js^=!M9mJ;%=p|3i3IhbK;`Nf%2_q>e6?zifCT4^Wf*t(HY$JuE{*O4MLfwqnHqZC{4zHP(gW&id1KU=<)Ijn-5S^MbO7GhIQPT z#P5y))>NV-R&azz%uWYaP!zMNG4hzz%5YJoIs|ZUQ1BM%ZGEPmQ1H=b3v=Xh_kIdp@n;kqez&Z;4NyJN>{L;FeJa zCk20`$4HuP6qze5u5u8t@+j1#pzk|3XX|CvobSza&N<-I9N-U!$V}e=%jX$poSf!r#0K}GH zsT>gl<4y%_l(%3Rb$QHJzthKXnr&khE=LeJo1D2#qW~$5^4Fg7R=i}97Kno_B7^eh zQOiJot$)?jr{V|dI|wCu5NyLaX}Cv{cI)f+o`ny@$JG#57`GEAd}CA#zc7Xi7jOQ5ZB^95xE;P#6-7`rt+DfALcWg>d7zA+Q-OnTd8AP$n?ND#yp~)$h%S zSEV1Wnvj-|O~h$r8^GQHK-5KVSY?(RNrrDi9WUm=ZiS!kpewClSA$6N$Y!}7f{xD} z;3YFLldQl3__#iQ@{-6(6z>a#nZPHr691k%W&^xhE!RPT(WOit84=b4By=fla)v}P z)-a57)()5TH8Za+nbwm-DVzvx;QEParB}e@nj}1x`!vZ)aS}&e)#c~dNPGV^Ulo4 zhOxaLG(gm75@RH6`ySlH0^@z>HsTheIHz?jsvCkO66UEA!31e<&r!20CH%n!KVG@k zu;X7l-hR{zTcySot_xafJ9~3xWB_fw7JOuwC5^OT^Z#CSt;g_`zI?AD-C6PN&M`=@<*-W;}~7N!$9$dfOwGJ z70H<-?B~!ejS%hfE{y!$nza)?2Sy95#%XbgAg;&lT+Xn;=lhYshr4mIK1LMmA4BH7 z*Z0Hs=5<0wB6L2u>Z~6KSjrh7)W-A6KtL0vSgr$9e)3T;lveT{%*=Z8B~}DG7H;m| zlBZaT4>8W2QFS`ln@>sSj9N+cBRE5s3`H18N?G<>n`+qPz&b_ZCGLBZLfc%V=}MEA zT17IrJrUwhh^&bIc%!WOY13|fcJUxdEX!fr5KC)$A>`Lwi63rg!ca1m)n!hwr_^+ta)VR_f#~dEDHg8a9|ePkigKyR z6hSd7#d+^{Ic=&A4G%BQ;!L%USPe)HIWw4mxPR4p^>p@O>p13ap!ehOG59tADX&vL z1au&l`|m@g(ETK%^*EfeXmBD3HrkW#+wcVztCTsvz1e7ca8oqIm2gvrqDsN42UOXG zjB#PI?tYoJa=U)=p{?Na_x$=Im`gnI@;kIs-4+N&p-P!~`y(#n#Wmbp`ZhmFs^ zqYj?42buq=IsXvqA@p?ESfI+t)k;vgR=XZ4D~}A$CEwAGo{>LRBPPgRKge*z;5Uta zI0c{`|RUbaUI8ejj5C(HrGihovnY!!NgWAkny#;1CzWlVPip2W?SC?`<{Rw>V;jZTD(iCixx&zw^ zc~_)pM=LlFV`?OH`5?H=t#60uTpluC{Udy?SNBAcqs=7(61w=Ub;ff^6qmGdY{TbEfZ8dDsHeL^|Cfq$J~M&kGM>RMde>5KSRjTFOH z>JAn^XT(LD(xLBddpppG1=I7&M(k(ubEX%Ob5$x4rS7vQZ{^@?u=dUvrI}%e*RBx1 zMLu>4XrhNTPZ8*wYOpM%y*`neDp5>Hekk72ls!{0tGO!(wKH$PEH41TMg0*^NI>gZ}MqJwx2Kjq>X; zI%z;m9$$%Okm>0@CLJSU@NqB+yFDhGn=#H*E=)E|TTwhVKNIt}%#!SeYw&v$`rbGq zDk1q_H(Pxuqm|r#T@j~<5h%6>E5|%0;xNXES{!*Ot#)2Bwe@0aZI)r(L*#67%|#z6 z)a}7Piq6yV19I%d&9XXoT?cu8(A<>slU1LSs_2+mM4|KZM$XsZeGSG*o@|D@e)3-@y1Y7JVhYZawHP#bo3h}eab^J9k6koY z2{FcWD*-sW@Lc{T5bUA-Q|5snqHy@N5$dG%9;p!LW33ln2K@-mBxJEjD>_hB%ZAMQ z7-<8yLOGd|ZrOCekY{>l4 zxrjMt0(9;T6~YIOL5paLg||HCTQbYe?#p zCS+d+v-2rPEVgHknoa7&sZw)Tg4l!uSaIgEd~&IiG*Ra1@QGiKp`}Hrx7vqfgXkR0 ztRqMuq#9eyOBfkS$VIQd&V?{VQ~F)c(E^{?=wf%PIO^)i3J?<3@U*4f&>c<2>!r@M zk|5h6(M5@id7h09<yo;l_h&LE|*eWd4e+ZzxpfC4Sgay@72n~l1AN(!8z(RLwj z_}6|-wK?j0{2>9!T|M*b9-cpP)&g<9(W!sRX5ZkL+I@P7%AeGWbPuK0gKpBEu25^Z znJb@3K(Z>+^VcHW=JU^5>d*L$Lgzta+Evd`*@4u3@vi+%y&2?G4-ty3m_Hn*f8kTz z{!?s>AVzf<8Ng+}36|yM`F;&x{Zr%!mhEWb`*&b`h3`KRYr`>rLa?UUh&)CHJPDMq zV*Wfaq7ZPJ{%wpTM!mXWGX3lNUHERz23v%Jz?fH~_wFTB|35w1{i`RNga4fJk*e|d zO}~ln=C+y+V=_;|OpbUW=Ah})UHqjX^EUs=8IcU*GT>zQHh)u#9^Z_#>CDXLCSjJQ z8s^SRn+3tVCf~19y8%J^P-DO=9(MC>iIs;-yv<&R7H8+)tntm^VKD`$-64!J=H-n9 z%#i6c&6=Ve$JwXL8B~GGx$h&N@JgAQ2321BVRwtSGt{rJ(z9lg!(o#m?W@{u9KOA# zuHykwOti-YAXEGl6r{v7rPD5YQ88PLx z60)dPlArC^jDj4ITZF%_QQm0OdgKeWQB8JWgyPgw%EIEck)nWiihNS+?#GW2ni|g1 zbH7Fy__)Q9T=99eph2>POK_H5Ys6-KM4p)6S;n%wIkCAqF}oNoS)#+N9`Vh7zkMja zIpO$z>YyL-^?J5U*)6*x@Og2cKCkc@Qmvq%AkXjh^|;=CvRM6oKM$!?@bp-$KuNf= zSS?9ZT)gcSq`MQZX_VGCh1>F^ofDcXK>Y!AODShY?5F^WqFS+`>g`3>}6@!;VmxJ!(QcQ%Ft*my< zgnl<4W0Iy58R~pJ;F?uNa|{ri%=N2}%Nk_HteZ|6>3TR!Ol<1mRTyTHpM;l4uA|+~ z=dyv|Ag}zQ8yVVn(>oK_)ikM2(s<;V7A%Da_zi7-$p;F=ghP>wGClmhNzmr3o`WqF_T*e7BywHkaRwrTvUh5luB)} z?K0K--dEBA?UtjLz=wt9ujMpvZus15Maq_Qgxb8oFHKH(O<)5eR`(nmwHIXT#JC08 z+gmh!n8C_UT^ZR=HyC7A%%k~jd*7~)i}%}$2l&?5G%aD>QVXgcB`XeQN)Q|HNTo99 zl5E{rNCxAVoEQW>naPPoCe`$%P;<0b_WXm?%AQ4Ts2w6FFN`DR`gNx+60+uMN$+`U zZG{$~jZ}^zF=2y!)#EWPB_n_h5#MTyWW@=7!;N1#uc9DGt}=iW}KA-gl4Q0tln5dC|oaiZy?IZKmur z`(S55Qr8YP9E0d`x^8kNRAnBmtqPzp`2%JWH?z2f{7T$+DXrpW3qRc#+LYIq+9}^_ z6O6FZUl5w5DdzB8`L$@40v_TIbHOY{s+;vIpMB8rh2yw%+diwm-IRB{sfonb{N%3t zu=v`WpV7(uzzq!qnFw*ZQAb}p6JA}lO7b8nK1~}#;EORs%h1fRAvef)UpzJ=#$oQ* z3E!_6se<^QJCKe}*L5)@eLBdmeLTIP0kw`yg2G2OR3&@7Jh^rDh0pIhdF7`LOg|<9 zVw!)-S>_c87#&5ftM+Dk0~vVRQam`1^BQKovEM5>?kK83C5Kl^v2r%oWr)$4gJh3w zi(|IUAQFP20t!N+eSjOfV*6s^2tvK}f|Xi9%j+SpBM!kaRQ!&isD}h4VZP@i#IYMU z((=0)&FPqmzeht!@&(5t*o)H{I`oz#N|QGTEhAGfhC zoJ7Qo0y`LpkGGyq07A5JPi6oi!VuDFUX!~-hs6X#6;BRd2ar zHKGl!5^P^h>G85zI-Z5`iv>(+qG-!a^JmQ+Z<0clD?la5zEXsBCqvf@UHaTXtY9|$ zelFPFx>{Nt+UmW(J2>wY9OpH4xf0j4zQo^;XEeL=hcFn-lPp?gO?HX$rqS7$1HNJK zakxA~wzr2I(Uyy0tv=XMv`dxLv|jtt*lQFVX2-6{9+!Xs`;jd>^m%7NZvSA2$(#qx zN(m(dUH1ng-Ozefc4v>H8}@cH!Ra0i&TY$)(R9LEhy;lp59n#iybDM)yU%PNlrR-} z`3U;vLQ-S;(QZ|;7Y`AY2@|%4Fj{gdE{2s!Sxun5Sv}aqP1`5;a}YpSg?RS6Jds2z znR$Cd+2>oI;QAIGgIs5)+u^S^CZ(8nf;@fi;Bz;MhlJBG4C@f>I45BGe$yhKdOiLj z7ITX=+TsCI2^A%9AVC1)?w|(aa6ka5*6hCUN13550|9=X;S3Vk&E}DZLfF2acKTIo zFi6}{_&etg@6{3K5*E?-J&jCf`Cj%c@%|Izu0n7lgD}X5i|Tw{5s8+_?G?r zL;wKKupNJWLqM8&_7{xK(Znv4j!X453_Z(>X5Z{vIZVfrqD4p{9`wgrII3IG{n;a6WW$jJl>PcFPkE3VeyldG#@xC@UV-* zfkHH92^UNjbDI(R7!U#kMPb})px_W4o!%lSz~=Qr001+DUTz6PdI~ zm}$yR!$#MZB@Vvst>p>@p{-QrYg|W&*A{;@g#DQvM0L=Vs|N@L<*ZGh8rYYj+E;$8 zmTXuq8cm|B;KzQMv>-fSGiMrlgO6B2Z{Y!tpj9E0sHL(MI8sc^#U(wDV@aD| z2vrDcp-rm=Z*FXt9&)#BAl5)EdUFL{KTIp|s%=mRQ7p+6^TLz=erm3l`DbDjbh7hV*#G;G?>6uB)aWY;`=RE zV)GH}zb6D_`Bi3ce5XiztuR^B68AX&=>qpVs=4v@pNN088=-oUld_&d z8a8Bd%GD;CRF(s8Y*BB_Z^4D+r8%lzqOJDXc1uCJ6VRP{f}D`tKphn=w^Me_JHrOy zm`LmVaOo;@BelP|!whaXcm+m*w;KyNiAK_*C86J=a(OzqzZMY=26v)#%>~u zl*)7zRV?aMD|k?)QfbwYk+KNm%caH;@)kMAm0vnNFGXDjlA?u>tHh8X!@oW(kY5O~E~RY$p! zTo`>sKi1z}nCZ3DHznWWm%bduFTL;oj3B_6NXj*d?izH)Uf>=kv~q6BafjE(KLOtN z*{kk^MH{TIW}q>og|4}@1c4mw(TjY2Zjeef zzqehOCYTr(*qR2J>ueyiVA9E4y!6c&87wILux*Y(GXz+>BQfvJa$ie5qtu&H6IP&X z1`H>;7!Tm&x0;C=&-3UflYjr*H@Qsd7_bKSjXTFpM#->;Z7}Mz(Xm@34%e7#=rxV3 z0y>JMnDb{pGQCJKPcvJ_Tv9on;uTfP%o^whI_+fD)t%yCN%t&*9w$Au5eR_SFsPKH zQaxlO*%04GXhni$?gx+c4l@^*OHLK`qZvOx1kMA=m?^(*KyHNB&B^Y{rGDlkxPudOsD{~?5pkM zMIKLLmTWuN@9DwO^`Jfopp|UQ{GQLDto@MK7|%}pC=wZ;%k4iT(DNlVWGK{9KRiFU z2QHji;(&8Nv8DiDjmNEG<$VX9~X za(hl1bV;6jZ$)GB#N|kc)V&UHfO9XCIpV|86aaZJX?&vaX6~kjPWYf*F!Ld(0~I=)eE{bP{k_hg4gikytdJk_D}O912o@;vOi zJR}3MAW=guPC@XTZB4Q=Zp=!gUQk3#dgd1Zvqx$0eDpYrRQGyCT1LHv^H;^Mn4XYhdTmWP>~XeK?*rEe{{9upOB z4{93aj%HUQ4`sbDDup_4GKraRJo+S8CV0Z^B(~}gCYUu1N`b8IkmGC>jkdu|`CMD% zI-eCa9etJcYEl@VPCrGTufxOM>)q-83Lg5OM(wmd5plvdi@C=}C8l~~dec}Buksa6)Js$C=ZzufQKGiDgp4* z$)vibtjG==ip~!=6j)ba%4Qp_Nw`>X=F5XgyH2vW#X>V);`!TTo@Qk=XFDAot&K|$dQX4U{3jk($g1V_N>`EE8q!ns{7!lU zh?iA__c$S^vl30)JB8KEuII?X21`neAJCVk5C);k<4Kamk{r)ING~HF|OH6{=HYO!Eps1lKX4nG6*^|J-Nl5 za=%l{9oRZIy$1C>pc)I1+G4y@wNwTRP3A$JXhU!07>27N%A_OoNIc2mDW)OCR^>*nn4+Y7szdJK_o9cK{_icMog(()^UToj{5pgyAEK7L5KpvWr5E>XN9!8p1jtd^EdXZ z&nxuDDI*zp+mgLel zl_eL{Rws|JYvd{!uP8*l`PF^C=DHX*Z}sxbbk)XymbccoU3EQ+%W(O-%g-EdZgHtO za*1(ic_Jt>d6T|yE|soc9D?C9x|8zS+_b68QVw|=cwPr-VFU*&^HgC$+Y&~t zj?wJrv~yfap~4tgvL2+OFXztE7CL-jeOayTsB+SL0Zn~WR{%#;QSy&dC7~wHeAmbR z^6p#TMpWpt!Ksrqjiw_I5JrAy@XHk0p@)f0;aV@z@L2Z==aIm06VB)h zmk{4d`7+qYl8C-qDF*U^HMSCC^MYoQZM`A*-tO<=&6HRW3g&~KoHVNpOX|E=q--_h zpOqM%K;}cov|=Cx>3;vTP>_+DzvA{A^f$J9V`{iVpq1!x&+}`QSOBsj_ zFe#)o4scU#u+U|mD|*my)q68u$YmY)*+=0djUSv9KzfOH&AWMqojl?z$&6e2OD+kg zZ0}w^Yk>D-HVI5&d`zD?iHEQxR2E_oDg~p-j;|W9tT(p(dp%5QgYN9N@6pbclV76lM8UTeA z0G_wn+xwPe)yLb(003S_U8!u5i%uwhHJ&sPaD3)r+_=mfvC z0z=|2psL~=6%Pw>1)zrq22tD|7CRYc0-Mouc zLS5&plqBE5!IY@nF_+)_EZon9A@IO^CxXc`+i3gaOT<55e=3*b5Ik$9+21!d)|~B! z>27Xxe!0J1z8+p8mjRd<_~aW23Z*j*kyXnRX?E!l+Dn$$)%tqQ^Rz2fOHqFWSYPBx zbHaYGFP`RnN9mMe1kkv4H`*aAmu z7(bA*^;smbfIDZ$I=l@Da1u4SUknnH5_n2@ZZ4FKHeAfBhYCw52ud71 z8Yf8BY@RoaGQ=9*$SyL;k!=Lls`K<=(V-m6AM7x(hXXow#Hdp340{MfjdI6*9!No| zT~Z%Oz?zo|{_6d(+h-(lgj01rX zrZI}$_1({^tek%73q+un*=l}$4%^! z*(RPVm40Le{oFWJ`{|wk%TT($cHXB!)*TQG+R}zd&sP;%DhEP6&M{OSN|RHdG17iJ zsh11+S@M!UW;r0fe|5l!%5C!J)zRy{`KsFIb9!&j;EUjPj)t>mS@6LQq~4yB*u;E9 z9m@83X0-N5i3~Ou7$DP_O;AUZdR9V2wVfI7twY|AC_qx) ztlD*PcfzK%+Wss%JeQm{<+(F>C9TrwdGmlew=^f!wra@(#hz6F7IUhFj z{}6tKZ>|*$6DJ^Xi|3-bs0rJv)HvZ=S;gxYYVi3U5@PoIGo}|@7-h$@Y_D?*w;280 zZR@k5i8N^-ruVmv*yulyYGlp`5}9+^s6rE!@MFao`Bib90_+J*t}|=UgWjb~oza zxi{(_hr~eV=|^35E?YiN+@p+(UdxP2&tuFg4J&fY00#In-K%ioyz+|FRRu4S(b7$Z z$0$)|uJb=V)crxVUuN~X7szMhfw=V=Iw&hT!4|0aP5PRGZwHJIbleB{NfAnv&*-3P zvRPIJd4Z20DhE6KWdF)hmn_Q?H%Ls;DnLNoi40cHHDeQb*pKQRz|gwW79hwF#xki= z^}&d$4?qLGw?m6SA_HEbg*w4<`1=sI&O!>07LUo#?~#9cgc81m6KG8xzME8I`Y_Oh z<3*>=cum4IDJ0osA?kvtynUKQeWXM zXd?EbnQF^_v%Bcqf7spF#N--02GXv}?U-e-^!JX%IheaPaibkfLTXWUr10gaj@7X5 zfeI4@gge6HQwF_bEpJnh8p1#|u1AfBTLP|w8L~9qHmaNacAG_?CYDzs@qobxet+Q1 zA665<54+X;IR%%^7)d7Oi7iNC-tdDdk1fzk1@(Z zm~a!6=?GqEjwQa;)|*jD|C7*Zc0r<-bI&EVaI?=WYE^3Czk>`X_Jh+r#)|R1aT|D> zDph(ma$zrbY0K0o>|}y|yptc_4@)#V8WBG;03#6ngn)jUYy*?tHqY_5T$K_YgYc)Fi2krQQeN)&B5$r=?!FC#tE|>fylAN9thlu`5=Z`& zCejDsRl9%STx9F~;7&6{!BjYu&PfHoe3SrwG}QbowR_B8&3{wcqe@F1LN`e@&7?X^tCxn@m|}$B}%2oH79b zG?R7fr5IjFO4~n{m+enw+ez#x z9hpUpY|FDUX~Us(H8l{lS!IWS2UX)R0C|GFF1TjvWUs)kk9`8MiRURg2Tn1)G<;bJ zv@+eE>?7}n^4D+cy<(cd)8ppNNe+q}4z7F~p==oiXPri@AW?94c2#&hJ7~=urCjrE zmbSvRJ7e0%_b&6teN09eI4L8%$NRyw@8^6r z<*yTdFiNU`p@_4)^t_?y6 zl!WTQ{VzJFma1Z}`g8k}1gItwB&=?3Nwe8iz~!KLskvPa5ysP@E>%%uKA`U}D`e6t zcN*P%?O4Zo0$0sM)r~3L9T)ST9>ltgP3zQ$+szdP!kdkW6+GNZc|zCv0dSW^kLluN zp&`mu$HJ8#at37_yR;N3$`(6*)Xe3g`8{n*2c$0cbV2c0YOCy3FWm2OCnfD}RfKF& z-=Ee^Cwopm$pn=~K++CX$vNqARqodU24(ecL4$o(V=@!2WG4TPJ5Bx_{oM%q7RAdj zyITDa*d4pSWfjw$#8>^+*PI{}u=t~4S*>^2b{UXmyu=xRR^Roiih(K*%C?I=A%8o( zT`A(69D@mzwx*ztBi$LmSNy^0!poDQ;qPal^$$-;jiNi?HG-(mw_!yPaMUvKdCNbH z0oxBGYk#SQ@H%sY;_fd_NaBI@WiP7y=zV2+nDs98ul+ zeSwC4wL#J3`$FMvoe)?uJww($t1ksdBQ@#K2g&N*RJ z#&ihB>8kMI`>-nOukC)giTyBN+A{}FH%9F`tEEm<_ zFaPooZDGn_Y<4$i;W+1E5tKwLYdLn(nSYySi$m6iQ?;5s6)A2Ybifzl##xG z_ZfeF%MKsheP4uP1EZqkz?Y2JPxB)o1QhwFJGQ5oN{^S6+0TPH6Ff&Kg*_dFB$*q2 zv*r{*na$77{jRS4&Tt2TAjH;Y_^RZq=aY}2?ACYRYv_=-Kb|k4{U7~CUArPLL7ut> zDK&VuE0+!nmsT@FZ@!!UkaVTvF`G!YpgWg8jGx$K1Y)JQ7Xrf{x42J8W{4Z3j~-!@ zJX&|s=J(^se|nFTP#cpuY?RPycY&DsbJEJVHP({5noUK18r2JRaBVYr)l9Ct=7+hZ zBd17R6WzUu&S_?v&3$&$MCT+48ZHOApb>2Cn8ee)8vOlz>p#+J9+2UTEPCJ$Hj)?Y}H)v^O z9d&TQsXfVhUl-8+o|AADEkzsNm>03v{(-TMsZ-P>OmfsA8OKJ=OpRybjKF=4zeTUb z(!Yp(yRIHlJ#T|MYufsgmz@#t<9x=bD))P*K7jKyD<^3((jexcCOjqJUOlU>OhAFH zGS!6PE_52D!n(WQk3+KvRqK(|UyAe?ouW$jZRc507~axZ85*xEIgC{7Jb;pt>9336 z?rO8xw?-3(X&yZ3E(SN|TZxSc*DZ0&eY`F^T~lJRdM=RA0uF}ySt1+eL!aBlru z`(W#~;Ael*B&8&k|NW!di?IOZFanLoQX_=-iyaq@$kB-3(b0BFKek-`@@Zy&;7m zd`2S3Bs8`TYh2?lxVC&cZ%EwtW{}-CbjjM{D4Q=6s|dZ1Ye#Lx_WYdGxS^+&8v?rW z5)gEs4`Ue{`WtfTe{W|u2k(yskI>hiT6>F`UPp}9^6gemP^ws29oj8y5_*ukVx9hI z@+FybB+XUqt!K=pAWDgeD9^^IvXY_0ONli`2N&cKms)zl{nzDHCNgy5p?@M;zl)6* zR+2P0aba1eAOGCA@VzvFWWcSeHuL-RUlVZ!dA_ld#l)p0cHfOeM}HS={%K8V94jvD zf6c?ih5frHlkYkmTEhQ%dW>EA?JT!AAQ2}0-LJYm`vgUWtF*g7LDR-2Sl!vI;#hF1 zjg*hi{DrQRyL?YmMyPV}&cdvRV0C+v$#$hRkU^2Y)GpDBN8O@ZVin*r|IN!(*E5I} zv#^c0R&OEbE9^N0aPSvBBF4Hq7UfZG=<^+%veFldT6TuVemqUq+6!uWsv& z>UhXblm#7Fsr;i4fBjH6D z*_2biOkHewX+I3gIzRiZ%bfqwWl*;NO_!Db)e2NTc|Xqe3uz|`+=%A$blTAieFJ}q zulcw~T&J8tAUj9_D6v?co1_%?Rx`~U&M*I+AK!{ss?=i8kNx6*IXF|;n|F|x=kLJ! zdRVSj@Ja3QeP2J}D9(OIH26*)oZrr|RCpEc;H#;@FEf0$zc@jwNS?s!-Y1A@)-i52(uTQQKzC zLp$c=QPL6V!?5<41bvp82MdyB3;3>8QcVIhJfq7wz-0j}XVOP2foLZhJv=Pq>>&s( z&0F+Ykig|_gB_UbL!wpE=FK6q$ILt)KtLZ|`>!Mwzifzmpw{R|^rrt9uW928jeuFX zy0mTyTNZ!*BhEr8RfIAE7E2M(cI#l~Vf^UjT)O^3>(tPq&w^c-N1GkLBWpUYwaO+S zPfgPH-Jm#N2cPeO9|RN}_Wpy*CJy~AScfy{YKKwP3W>f~d^6xOYH6J9t3M(AN0(6z z|4Wy7{7aYF{#%!Qr~#`{{#%y;m$|oii0Nm6$g6CujW-VLM;9XjyEyTGTs$7FZ%;99 z>u<;4mZp;DCprg#;3*LoJpN0Uc`KAbQ$_zTU8W@y{x4l-Gx)8`JSy`FV=H^+xuJ5t z{+BKzAgiuQ9mi3h_UHrKnd)GoM|mYF7S@;wf+5wNUmhJ2GnPBbk%81b@CSjh+~Ame z;*HYUI1+t|6z;xOsVaxzH+{W)eD!_Ofp=2asd)_M7wS6{yYI++qDw5_^~q9Vw;Q#1 z8_4ct6wSo`gTop(mLfN@&|WcHHOU>}0bQGc3@T|UA8(3JVzruEIGJC){Aq=B$R($m zX`hF`QwV=sdSXrm$*Mf8lVAPNGIpzj!b02_-#rPF+!-6B@{}^bY%4o-FEWOAVe!-aWL#wT#*Zv~eJA@K^ z3l+q;0KNr`Fl;u?Gu%K3L=)%{e4#M+hUYs+qfDtmau9`w;a>%H&lN{4{}O4VB&Qy^ zzWD0p&X$TF4tKp@p8?9pfzz-~Rb7*2{`N|VeOpwnrRuT~zpVvK1&O;V@(Q(sDvaF zgs?JIQXu(!$-&Z(dv7L_KV05fWKA$cVj9TI+jj{JSh;OpwAv^XssCOPSZo%@JStnhiZLy8Bs&x?XKzPkaTx29AL?!dSmmMhp6W$-o zQ8PS&ZcrX4M`!c{L%Y8KH@np&Z-woaC|2z`y|Btu2t9Pq98- z`2#s0%qrQ^o+?c{m$RuC&5RBM3Qu})JJR?Ej~Vz%ngm){Mq>D zvL2Hk+)R=RPyv;nzQBA&zK zyiR1pCN$TPBqGviMq*TI_GJ*c41&LI+T+7;)sJY%pBnLTG%dYx+RI=nids@n7=U7m zO3&WAP#4=X?BIjB-%g#sLydLav8z9lve?H(bj$&CnK`Ko9Lf(qJ_5;b8a(*mF6_lK zx0vs(^9c51xL4cY&^V;<&^|)-wT^TpZA->nqz;jv(^(4L#|u~ zN>>I^$M-zVS~wAzF*Bi@<(dYHl^u)OHxlT?!~fHz;9wIv+CECxL@`-urc4{_>0v6ICe+{a}fx93x8Jt-eUkMiEiX$V6zC&OMc4g{}_$aQk9)#P@@(j)v}Kh29I6kVnd zz4_SvY306`U1RmA0evjCFVmyH#QY9~%??KIMon=9NHCOCwiL7%Q^msEp%DK9j$+VO zCQi{fX@yW(iC_{k9m?RzLKz$cNt}^sEShyTR;PVGPzAocE_{oue?f^)96%`slNwFhBR_Gn&tqM>%p9c{9cK=^(_or_1=y~1+~uC4`@fb82^ zw6IB9kZY+%BmKyD_Hx%Ks|9G<4{VYQk*E^nnj{dx*ca9d5!J!|6$WzvUn#J@ebFgG z)2pE#6FdHJkFIK&lO_m1*J&1YMdI{gs+NJhBj`8D`yjN^OhBp zy)opf4|SYt7SakBhH+P4sDysk}|jCeZo>J)N?(&g6@M1Qyg*%=7Q(50go4? zq0+h_qvnJ@Xp#4vv>MKvfd|VZ`Nvg7m$;fQiLckq)t3<=SuEE}G-eD(&?y<*0D1v! zRj9O89G1FXGbmPpl_#&l>#v{3EbhXK&zF}LJ14rdNfQ$6C-n_p_<=bd=Txkw*ROlf zF=5&2dU~S;lB?u8H`n4@kq(`Ue7i7Yp;{#Qo+#_S1D)?$tH#_7N%-6q_p=WiAkr#n zX5z2@a4#ABITL&j@crokVHu%8WZ{q6U(6Xb``slM-LD%4`Ve1sDsKU&jLT+Qbx)o} z%zWG^vBpMWxX7<;>5d|u9kFFD0C@@e_jmerB(Z|)$$L{uuL!UozSbrdbe=j?Ii$n6 z#G6k=RHM}EgoE^&#TQHvWp>El-dhh;ULsffTsfsNoA76#IC7U3wepxfv<~Q6Cxt_b zO*G4v;p!+vae|B81Lpj2Kl2P+ix%htebbR+>_?@YJyY97H9zw$d4~Bqy`*r2TMYnn z?i%pJo?wY*j*YO3R_F?Lr3_>LdSv8=r2o+`v!^d}e9~)oXCZxg{Vq2jU4*5!-UEAS z28-?2UiFK0wg>GO9Sbh%|H0Zj2FbQ`i`s3Qt5@5$?e5jKZQC|h+qP}nwr$(S?Y-Z7 z&UfOw5%<@P$cR~$HO9z4RZ%l$KI6%DdOv+o60esa%wVd`5sJi9LzZamod%alN_$xWKTs+qpRI(MbVAdp3Rt7<5Sztm{gkzoc-+L zc)k7L2HDD78~Xd@2xU|`@>x^f)KP?=8%6f=2qf_OnVt@w9>xn_f7LJ(boul`FAg=R z5|S5^E8s!??1{+GP8senifChz?xbO^?5|N!zbxS5t)MsMLsmH{@N`$ z#A!f;Xs-2s8dE5#X<5~5Fqz`5D;aZ6o)M`A_5#^1Sz2i#w0n~KOJ}lamaTFVJaGAS zEC?(v_WHxcD3+Qdo)YXmdLIilGfcTWfQ&aQ*j^}nvZ%RuBLf}|02`_X-TEBz?-;Uz z|M@9s8Wh&|&IjXB|Gt5+E1Ht_HDu{V&t}nM9ppXDHMX>3HTNZ+zewQc2$zCNVsC0p z4|eS6FZFciFj?E*V}j+lq3~U`14y2XJaI(vZXv!~c!0VY&$APaEUt}#9n!=QK56sk z<6nPbZ(maJ2I0%{gNLso`IP3qIBTUzRPMGuVbpl!k(cAUV4A8!E-&;Ym3Z$X7b7R8 z?+E}OD(x{0Efsj3dkT!mSZ$@+^0;ar(+>CJOZAIOL{PR~4#@b8jq$-rbLh=qg*?tmTcBPd> ze9B(r+9-Fl><`HJX$0wp?F_c;Y8a$NJWI~R&%rz{Zd<0#*Wxm5af|KJ%=W+I#^Hjd z$Kc+|Rxi8su+~8x^FNxCvosHF7&O|)kTeE6TmT-OLabDmE2CTN{gh?yTiPY$d8h1 zfh||Q7@s)o^HV+wf)Sb?gebOOKLc6M9H#GvR2poJ4#lF87EIjP45nw8w2_B_7L36Q?wP9)l>r2U1(?XQTKwVu{AF2 zqzkpmya!2z)`TWpAT$d5j%b6S9iXOD6N!U0CcM9CKe|K{qwAbmn+bx8s&fntI;@TD z0U?g?p)el#XA5vehK9IUqs&?3TnmM~i~wsbpVSCueQ4&MnYPVDr=9m0%Yp+98bh%; zWF#D{`-QLC`he=z(>P`y@As6vJuS=`( z6JI{;o5}T5%`Ny^>iR)KD#OjdOh2jq0+UYQ8dmi5y|7+(s)BmCH*psPFAFuO5MBPK zPDf{j3C=R*{aeL73ppZnsj4rAIGS-+b=Mi5*%#d&K^^?sF>hRT2Jpx-J7`}4L7HA>%AHeO1U+`2D9Pa8?3U6Tk7ffO1(@<;H{3m6mx4*fnOjq%%-o zbCVLnp5W`FHO&qyB(3nR{@fLmwy_TUh$r?_%sHxNBN)r)qO?rH>7A;p^E6C+Y>7FC z8a^nk6){dWXQ*Spw%`C9krPNT+REC9dZ}iZ>X0D08!rOSI5an`JeXkh+S*z@zV9D4 zA1AdUdGP7n&_CS+d7K1y}i61zjSYX_#em9v6=#O zatmZQ)mxO4>QR$}#FvcvBi338c9o-zIcKy6bSLdHrJewzP#$7+Sy#=_+lBnCjLOU8gD$)hI=Z(8R{eR4z@}XAOKg=D+ zV%yPK#Tfagk{%b~aB-?gv)}oAYTpoJSK;cj;NjyxrM{1 z^o_ktMs7zhiL@WccU7LE=YQQ|@{givn$G@jpq!HwX3-9nOwm(>h-rieVQrqWla^wxmmRde049RE=?C+T~WcrdQF5Di4BWr{aXCkdqodiJU6 zoBX^Re8-EHS=lp6x3|EWx_dUO#d#1wNQ*H1DC&}&5ul;5V=nUhxL5)z{=tY>Vx8jA zdF*#B6%(DZ`jI0bMy+$+4CL7L1xlo_&Gft#UsbSNC*^a~zG_LH+Tw|XLVitM_~Z{E zHwR*3^k0M=r38JM0B&y%p0bFOkTOw~hz-H-dsGz$h+eVmBQ)m+8@t($u3-_E;Jr2u zRhAVx&A_bpvKLv{M$dQHtzR&YCq{olG{~@J^5$-Rt}R@!q|69;Y`V5Yd8r z77ec?JH3PYkY}umpz?M)jrI+;hm`3VoJbrVLo-MxYK`fge-bad(J1INfN9dPSS|K; znwW;?1%OLdy8Nt&Dr!tOJNQVHNLqSwbh>TOsikt(4 zz8>rE#xam19cNa@hL`yXk%ynx`5`HZi_9FNPJsppRQ;~uP8d0yRXk5$EqThRWr(*LGu|OTne^ zPVAZln01i2qEJyC)xaOjdJB!n6_8T}QUlo8miomJinkyGaYhXAi0FNz%}d2yEkdhT z9Gx>S__3n%Fk;VgjO)>PbFa?8@GlvMVK`;PKAsXPXvrQkZ}_LxU{(o0NNVwoYSvmg zem&%3)A}R@coNfe>&gxx?Rdr(&(*6KhKw(9PT02TO_)&$B=* zws`W-(_YwIt{Sw^edyM%p1$oJ?7-GGfn+aU#7|0?2NYgE*tV zn#DBcTqMnD=J$IxsY61zARV)H-lEl23{9cnD3y4rlj9`UATjF>CnIbGtd@g!)^(2D z-LdZGjlsrVGXE;=j2sOL{}w^dz}yz%8f~TIl)bIT&dox$=mf#0lvY&x+1`R`ny#)h z-B3(hfw?c%<_6z4*~4^kBbb(H#$=RALJg)3wvYdq?7Ax)qw587P*>^12;;>CmA$f? zS{1(O6L@mO`u5y$k9?)~8_Ygz3kyiP7Sk&uWocV{m7FP4jE0@I_hwODN}yZqo-h)m8bfx}a<}|hylwuEu+DtacNd+lluR?n2v;o- zJ&=V$s=lPaW2r@-Qj{-?y;C%q?CQK)fHaS%EeIOA*Co{sAh%xeUtisl#cM*c>7}PM z6ucAD3rGLIt~y7?#Q(VJVp`DW^s_ck9$Zu=k)eK_xtqvVqzV6TO`YYw6dSJOdfA)r zMIWME+)2jJhM4?~2C)2bkkM~HU6~);ZrwZkzddzLLgRq;BCQgB3*^Ld$&-yJ3=>;Yn_5 z^!2Yut6Qu>4A>JhzW;;0YyB_w&intz-VMqA%idZ4uyh4man6rO%yi)25@}xxxuqCz{T;VL^mD;5)weot6H|!Q$*g$Ff)DvBi%pRx?VKP z0FGbEKtZA=<0sx|=ILS;`j?{BHG7}_Vb2ic)};Y4$Z`dYNh*-)Zldg`O|uYBrm zpj%qaHCAlgM8*2OBN72PKCk!L-w(%swc6nQpu+yI(z-L$fJ`h@={a-a@pKWXdjQ`4 z@pD1>Vc)Wlgmb5a&9RfNW<#IRAKAbXowEylV@<@J{7iAtI0F-H}nLH%DJ{fVvTtLurc?Al0wX%iA#N||#d zkk%tMcgo>~tc&zTD$#b}gVpZ93J_FeK{NI|=Q3rXibm5&G+c}Gk%lrbKmtSv(}b3` z;G~E}oHqxMl=T;sIakdff_PD!z?#wiS~?m4gw|?IH3A@vQ&^+*(dp+FypUOd8+ujV z@9#UCT~4xByOOAqQgv-#b@gSTGnTsIf0I)gQ{Je+g3Y=aIvfgG{3V&(y*D4RS}MV*`bU^z7l+xI$3j0EHJE zBdB`bu!EqnW(n%vBB*kKp#6kB{>&EeX8%oo_;=>^=kw++`+pNOvITYNxxPEACjO1b z`Vi>DeK*}`WM)$+C#%L+#%E+wp-vuJwEyEe=lpqExCM0kvPOd*DEKDJ%~FCqx9|Qp ziNnT#P)-&k^1*vIndI$sHl{cGA zC1P|XeMCagN`&)8m`(w;U8v*3AdUP*0>WX=0JS`%Oct4OZHTLIorZl(RP33RSVx|w z_0YR8@q_@nklRcwXmw%SxG|*E%4KbG)v&t)(FEu_~OB*}QFPq3`az!&#^qk{CF7a>_ros+g-%}vBq zozIqCYmu&CE&YD?DKKr zGwvo?^sJkZIn{XL$8Qr@k7@x$^Luq|NiMC4qXFE~X(~ydN2MAMggeOcWGz(JfJ{=} zLrp@_mVv39pL{B)ac}z&zbE5XBg_0H;^KEpbogM0{{Yywm@~u9Zixf53mIOM9phG~ zEe@a9-b=)Rhl@*s`(*xmFObg$`$3be4yKZnn^Oki^@Sl7Sb}eQ?&i+yh9ZJ@HDxC)e) z9p0EFlvam~-Tw=V+Af>TVG*W3m?mFNMxI|f(i{E^Jxjge6!l?6Skw>Cm`%KQwNfTG zrX3RHP&rUbL8xnbe;{Bm6p^uR)X0jjcsW*Ry3W&>-MF1{N)bQrZ@xzBy4%i1KV@ws z*AgwY5?M0a8QpA}i>kG-0A1xNp%S}FYZ$asMs9cU-m?yUBYkXMgPOmQgh zK;+$_0hZkB`5~cv$8rgi8qFOs`k7=!X=?Ai2Cy%L%!=@9o8{`X{l;Bq7pRt>!?1+% zh7B=5RJUz5wfBZOdRMJ}6I}K4sQ&qVOp;YAg2As?LvZ+W0D#x;Lj{^3>od}tx@&X> zjfPVDhS~8#I!RWGsOaOUha;TW5+0c$f)~)VHOOZ!YWteO+LkD8#Ju*DOrP7MqwDRA z@7Fs_C z^CEo1#mrX8blt4@EnWT>=nIXxj=Ou8hp-8138;M=d{W#$o}^jHpu$u2YMGT*b$mCj zxw#sFG<9E&{8Fa|o(G=?OQ3I;0oN>*r4;y5Uo9+j^)J>mG<$U+=u)9b44-PJt0iz6 z^H3Yvc7?RIy~dRB2x?(w^oj$gCS8dx{nVYrE<){yeegnAXKtWF-ju;a}6k6eA=jIHQ#mipdlz_D@Dv%B$H zob5+T;#xVF)i*A(qdL?>H4GBnK?oNZ&+FjjOX&R!} zI@-A0v+jjW`PUosC>~E{Z9i1LTjdutH?hrNSb=SUj3L%9i=G)E+zb+*MoQiwc z6t_)W|6?{}Iu|MW28-erF46UhU2)GUeg5C*=Hy%4e<#F*pJCaFG-(S`qauHxoT&Leb zhQ4md@YgYB-FXh3axj_UKEhEOg+tJYl3Q;m8gbYNyj_!pIUCJCg)jz1@#5mB-F31S zjE~HNrU6N^gabcUfx@}+9-i$(!{k8C}4=nG=@g-f^Fc&Eul>xOdw`b_}zN7SzUlv4jF7UyBc17MAjk6IkwZgk{Gn)p(Avijm4AwJOD zVSD=3`P3ObP5W=3VWtnKZ|ADr5h_Q81KHbUGFum*XAHUgZv>Pf?>zURCGb-(zmuzv z+E|wkgfeH8)T?T|4zO=|$%HXHX4YnEmr%RX`y`C1kGS6GfnoRSV0ul<<;0HoppJpWBz{W_2dYH*PmPm~u8CLu=E#4XRAgD?Ob(u6ENZMUjL; zf5eVJJ-nevgXV{DhT`gJrSSuf4qqR)ZNBc0u8+~HtG8-c+tA2DHSQyX*r2@$+X?8D zYkoDR`o5CGwkK08KL`Js5jHb!mX29#Fzz^*X-=(}wj`<=BH95Py|3?>BbFW>3=3`c zqC9KYo^RO!ay40crHXy)*ekORK&BRL0h^0&j4Wu|>isRVGDa%?XXkZ>VfUU3{WS*F z%M$Hf;(JsH+GC(8Y*GaR!03E#%vl&J`D_w7cUPU6pE9Qq)|+;+(nW2Dmyy{^0{-L$KoeybQ< z4mj;m*P-zltZ8G^^3on=P2#Rr5_F+O@%TC-z=>iZqX;XBT87nTYc>p6=O-vxM>UvoP{fDGa1}-==2leHksf#Z=Zwj7nrfH|( z3IA(`7SVY`IRu^m3Ds`8(FS?-0qpotTUv#Vc?IaP!CD#}ha94gr&-FvBQI!MULizc zpL1!bma-Me=VNRY22c!+|)Azn@o5jPYH z)giY;CF-)ElU_=8aW~^aY{YoB-uC5@Q2Ff&`nkOWaB)8#k%W+UG460Pnxbv8zf?P~(ZbG481 z*^=+MfJuk%5ePX|@6xJ%rljH|2)*}veZh*8!43ekJEDxl7q3m_L~!60KQABD+#eIc9*t^nQ!8!kav4uZ+5beR{OyF#*m$lwnh`}%3=A8tdG^JK%y_+OzlWfGN zlWeJPS}#uu6lCnQ%lMm1Fp}(UkyZ~PW5fq7s%DF`rqIIrsI8tZ#i6qjH|_$g`-XXY zIcyPwq(znkBi+2CFmvjN8x$yCXiK82Z`Z|VPRw-~>-^x$f)|L-RzYqALvVAx&2uk--Y?3~&0?K!wM6g;kW4ZI^ zxNI~6$m{C(3czz&NZ?w_K_R8nvBSf+92F$p(sn$2sg*j8=5G!byDbINn8ZIzD~zPZ zjIn@asuRH{tlY5&>d>ASPKQth7qbpOO~H5h*lv=%m~~!VoI}n6#mGZdiey@Og5vx$ z3`M67Wftvbb}k(4Gvxb`9|uc+%F_(Rgrd)C+3KDlW?>L{MEe+ORPfhBb^4$z2f$o} zKj);jB7f=0Jkah!53qro7m2y|DFkw;>bDU3S-R^UlzzsO6HA6Nv6X17Nh^jHNaXLSL(DB?SQl=A4Wp!#6KT zu$ud@Kp|UkR&#V%8XY1&W5-_styi#F5T*gVV}PtyvYvTP8;RPN$SfSegxb56bJO9<= z^}POE*8fQe`Ki#>^`Dy7<3E)|U3pXn@9*V0f0F+*mi~#0jQz3gVgEb4M2ei{r>tlo zb8b<%L{&!SfYuOSIh+4BjLLMCediv76!7O8o^f8lp=(k z%D32ZnTV9JmpW%IGf$%-bE+S*7FQnH^3ppIzsxP4Qn5na)6G6Osl9>I>ylBpG!=vG4j%8XB1=p&~8t|6<;Y?m-uQ z0xPgex2H7T@GrrtsIFs40p9dR;uXnBli0VkWYq6?^2c5os|Ke_>Mq%R2kE;iH2otd z5y%qTi3(iruW+H@LnmtIq+NjAUgfBT&z}PgQ#z2ztwMl&2X`@4$)HzFfIr8p4Q=qE zsTrSV1K%ox2e52SRHFmfh4Lcyy~61>sD+(QZ5POI(p7D!75;UY2$oxlpU?%@VZe)Y zOw?|4LVU*aW5`pYR*YirQ0Og6L}6r!kFkV-Y#|)zBw7f!9c-b`>&r?rwS04vS$VeJ zb6PBkXuiaD9|b}Q%&2820#Grf`+QpU`N)z|QI-HC?pk7|?IS=Jn1nohlBRM71nPt1 zN9NH?Io8>bMjq=lpPaI{b3wcOZkf3sO?s;Txf}6EHXrw!37Sy;E7~VGQ5V!DO6U%a zyFV!=XHjve%mSL^(gB4)6p5J5e5@hEB;0p?6Z;q?ks^E*QmKWSem|yAWgJ4YuBhLq zeVdnZck$HuB{Ds!;iRV2b~aVKQy@QXIa{J(DTyYV@vw3BVx;hX#I1pr#rGR9ETUbq zleFM7>V-^0G??%ZivO+0f&7yzTk53U>Fr za6Jn8o^;Xk!&S$5XIK!Etoe@<&3WAZgZT15MzH%-QI*4fZ6jd+nrMRBO)WUBGi*D4 zV%4?JmIRQI9P${Cc`Fb%pIqWA()8={-1}bq#fC~t++RLQFIB+HTot+_+W%h-Pzi(eRfz?qlq6A$>uRP>I zET*Z-_ALoEcUUJv6d-}nZ<8RYUnDv!nU2|b^W5HcABGGt=+$$?*`!R}ni~C11oS1* z%wRju55A3p?4afZqQ(9;GKcagA84^3Y%c)Xn5Np#o`bH1n2DUzYPL>Y+UX;hl_x6l zC(GM|u>L*aiWjd3ul3W{6#lhUTEaGcN`WSyqav53N8;wOp zFF?p~4ETB2pHe5Htl4RKlMELwn0sc?I;2I z9b#s%r?W64pGhmLQwNo;VpkJolk}V@10hIO_&wQ>ZfAA}Tx2VNZ|*4<(?bZbM6~Da zI#qtA$erwi2H)K`bHYc#cjGv3j2BtgwC@d9m_~GXP`IU(seyMMqvxt}T1G*Ov1wSm z;9nlu0C@7zbLZb|{2d^H zGM~eBImX|7QE>LX;wb9R1O1+fxIe@sffBm1YDr=dx^!A}M(*UYZYsPx^+AKAvogC8 z3KX?ig?(ci(9uG&W+v36DG~5DIN;slqx;7A!Az4|EEi{Kn8vH}a*v@h$18L5Af1{? z4u0#{nmlq`2x) z0G8P59{Gb|q}vVXFAcgQ%{QPOiF~e<)4Z8y*;GHBi{6Qbqkwo^XO;{WcoM&>C_#WOpBc_p!>xJ*+fd3j%Nb2ZBQ9~A zb3$cxQmF2A5<#m?+SH>u+c>XIkhuF@A;o@nV{mI80Q{p_WuEYAi^R~#h*1mx%NXb1Ibt5oKr(rBufW#_Nc#)O`?QnJ{R;kC2t<8zAB8@GJ zYcJ=?)2{rqnBJsk4;A}x{5+6Zec}CjN{@#}eu>t}{yKdi{f^$w_~|kIxLID->F)0O zNay-I1z)7Hxz*v#{J^9679p~Ce=GJ`XRi=Vh^Z`mY2`LZB%{>BlI?~VQd?297&wIy zUvxnT8NkqK9^f}>ECM!ha3f8)mVc<*8FJKzc(x~XK31gLTHqj(pw||yV|HNlJ* z@~#WET>^J%XpmUC>n(<({z7tg=SR@wdCkJ}Uc2<`cFb@#FNcxaf)yOu*uiJxR!@y>|ZE*IB`-nq8> zWi(w~TzT~L=h~S&0D|m+`#?s*DzOaGqnt0mjqpl{`A+9!=xf&L1ylZ@U`b<}1XV0H zunU*b?X{*h2NTTpBG7A?vJ`XQv7rT0d_MjJn;dv&%nl=L7dTgPZP@7(>Y~6Mr(kfr zQeXlntPaV=J2X+oVc42t;KvuUPLbMiz%rYCT>zE+>=3|c$*lj;Cotu;3RS_%LB5uK z)iuN2ed$~h3sr5(A==6V&0yi=0Xc99KtJ$R1B52p*q3xNhcvzdwH0?Qj5Y5V|eHChQE;y1Pb%i%8y`$pT!qt=%WbH=TV$zEkK#CBb^X(f(Qi9Ck0ckUb<>CUl&rQfXo5ZT zc9rNvKynXR-Uv2Rr7-SIRCXNpH+s&uxkjSaLayDC?oIZw^GrY+zs4 zzRiAN7c#prp=Gwz<_t3sFii4m+nOX5)XHAibp%V9aHV7Km_IVKEQ0J%yJM4Pe*+w* zSTY>D!pr>xt5!IQx(B-aruAT%DDo-xF^L}5OdM}U$pL^m5-`f}^$oLf6XIW3-7wkE znS9TdKLhM|?2#)Pk5GUxBEK?Dbh-C&2Y0iyuJT3w12aFzDyM!Gui_${-2;dK)(|z{ z-?lfha#|-#L)0XTZ5Hualev$tbj(SeCPp@m^;6QX#JCrO0CNL>)^6^Cq{3cd&7Rq{ zHp)*(PXt*di!YMhyz7(6s!)l?@lXt8n3NNm4>(KobvmGp5I=^t$3tx$Dxx{DMmwRd|knJW4;ey{yNA{Wh_YHCBU0or7y=4SLo{sh(q|YElz>n zckSu^z5#dlBx(Vre&wc4QM_jg`I?n_79MtJJNUt`8v@5g&dkIp@(*3YfgoTnSJcmW z_Lw>98w01hJ~q*(d#$#s&j z8m^>!K?J5?$F?jayR%t4&J=8otn$2GTRZ=Bwd#$Nopg7ARCL}b_xIG49RG*7Wr*H0ZQbnrLv;%~v^yrdQ z4AzB1Q|v}%(mB`HvlnRvxL)M=xg%Z+6=%`wrDCYrE`R>vwxV(4CAWDw;TkyKzi?e> zm6h5tQXA3!z@xNoqhRsX^fe7JM^P!XNFEwAf}n5dW>JvS^+s1uNwIRa;jM`w4ujMN z-`lwdtnUu7Jx6iXqxC&L!JB)I33+*36mIFe)ah*Nt@EcP8=V(fa7e8uM;lXPz7hKC z0YYmB*NkA%mERNm5({Dzj5$UAjwGrTHfAy-S&4F-sB5#0{Y(v5q`ehg{(kGq<($Zz z(~?K9zsz&eERi{`rZZ8{&bu=W(GOho^N(@Ft!Lv%O=dNjPgG0=(7jR^WC$=awQRh{ zrG`)0Io&41-&JG+Z9|?bHh!?J9I*fM`zWRM-CX58=?2DKgYg+`%iq^8PEjM|Nm_fz z!bi_;U3wKUrvbizq-4)Y;Nf}q()_E8vxNOJXsBQv*-4ie&)jtu#M@$T2}9vKCplqE z5Kty6M>8O=*l_|yHvf>s>Tut;#g@oTo3hk)K>P&juR)NE+H*eM;+hw7G^_C_eg4+S zq#J{yH-_4V8r7tR_2uHFaj2)-_g8{V;j`iM@45mkPz%8n_=d6aZ}na54j^Th>T;#h z!ZOw{a&mq)Q{>(*r%mP_j;CkW5j>;nR|*iUh!b##n6S!HhLcR&(k+0p)~a(^S+A;G z1HO;75-Il!V~)yCt!}Uhn;<{Dtf+-su=1GYM!z8EHCZrAbvHUS)#| zimQKl0mq)+xm^Q&3ps7PU2vKrp3A|Y2Icb(BG1;;f5CrJ_1peleu3-Q={r{7^b*o? z7^8GRNJwca?)Bgn0iDR%Ov_CZXni_A%DzUmUHD=!5a$&Z&m}Uv`z-%YbX|%R*&jj5m-U z02iePSyQfnzFZBchUeui(s&dR`_4o+j4Hq)dsH`;{TgjQ4)t+K+p1OVnB=G1)XAqI z^WM8X+J)aeUjpOiNNRB5_;j^p2aoy#c;u2>kUm1zvw>VBNhZzF$5P#)T_-(}2pPWG z*;&1Rb1SR$M7Lk0IN!Jqt`S4mlN@Gb+$fc<){usv`SGr#l!}GjWpa5BJCG1kAjW%! zK=LpzHipYU(ncm|Oa_lRB5`Ha9PBA!d1oFK?kjamveprX0sP0MTRE>aBC>rkCvmp zzn%5rkFXDai)9GdLrI-!TH2E*DMWxh#BcX_o!~_WQ|*WxMcc|$U^-|YYm4d?*u$AR= zAX50g5Qnby6H*u4MEONPQBxCeBoT+i`T}>LNQWaNLdG-7trRn#AZ)78UgdOEhl06C z5a#AidR|5)47R#{w2%w!f$PwVnMmziCq{e9z49Q$vRe0sKQX>qS&~4eI!f7vGE*9j zr6o>@ozE(^l2$PId0d0es^?1883CQa4-EFVbCP$GOu=_-v}S)_TPWYPfXLOp4CZvN zibSJwd;gr;w?U>t-68$yeNDajOu4yKC53hU3}GS43EsUK@|$+N^VPA+qsL>TSeRGm z_g5W~Ebc^jy1e1&(aLhQ%~U%PpMb&Yr9jWMn634t18os>rOoOnn&c?i=*9d?%obc*F9=9> ztjxs&Hiem2fcMF*xvcO*D|l55p#1I>Wb^NPrJZFQ-65IgNkw?jo!&Hp*vM4q>QvrvAOBnvWDO>1jc5cJDxYl?nk8xwL36 zmlM-;a9D2=L6pTq2N8I1VBMu3zC~Coe5lg3B5usQYju0f^amE0UW2`} z?!I}eRITm)c)a8N{+e7*KHmQLe0&}6*6eKkxY<48wb}X+GT-bHH~qFHt7pyoy6Me? zx!>)7uShryfnVN&Tnc}%K*zL(7D9qwEzdc}1Mcxe-)K+*XiugtySld06jMNNdJ+^v zpoI>_rz2eKK=_i5=1VNf>q3VkRJayb-MF9{SVnZy1XTcM%SCtH+&$P7vx}D9vafR8 z6{WyZq}!{ByF=G!Dv&?^1-b^IWfffb26m1`xI!U*aPfBL&z+rf=H}!l1>ek4eda4c`|$WXxb>))W3{6JK~!@D>RwYeK*V(~hCt6;i=kCBY@;lY+cexIZa>n*Wl<~wxiB@@ zRxZEbev>vW?eI-Iv+W9+I|~LYrP14n{>)dahoKg!sS-NksBt7S@UnuFC?l%biV!gb zLT@z_W%zaRv%h>fxsn{;8y!W zI|6gpbE;({NcmoMv@eOxx0Im8T->rp&nYO;+8NrvlH@#j`eP1>f7NA3&kS)z9UaIe z$-AvNFB&U7WvL3XfIy(*`4jC@x&wY2V7;P>y(dPM+`s#DGVj2A@Phk{PQf5Bqb<$| ze?_HPpIJc2OR?}Pw8hjb_(GuJW^^T6T;+oDTgPVu{Rt$BoF2*JZ(^?2g{LOi&(XUU zSlojh-5`H(6sxu1C-Y8X7^OGG&lb-&UF8(2Sl4p>AWW0#k(J(&2y*S-Rm4^tp~?moOwX%n%M-vuTWH1Ol-Bi z6N*^Af#LOwk`+j+AQS9dvj%kot>)=oNMW3^F%LqrTO@2gEAmBTH=?dqT0j&kCj_p{ z1u(!covzK0@ngB{S*yq@dJ7j7$W3Uw=x>N+M1ZurJNAP*<#M@AV@*C0*e6~qHIWhb z-O=)EQ&-2Q{w^iePgo;Q@Ma`-lo>6dbm%KzO*l2y?}uu%fL!abv4CKsW?voFeSNtD z(-nio7KJYsW%f@YPC6UF|TCFP%&(e?_BUEr$*>o#+$)=o6Q&zJ@sbWe4 zR=}`YyVzm_&m2HNWv5mRWR|RmRr!^*#H)F6=zUi!72~(AMq~o) zsuJ=()*7hWj1*5;5gxr*j$WT?qL%np)g~!u{fQ%Ea)OrE`c2Bp(d!@66p_q_WbuU_ zSfEOLWV?0yadq2pjmS~9R7msS>7=0Se@xrR-~?(Pxpj4h4~3}tCa}#IrB>-xH6(u= zd}`d)Q}o1_@Uy`OP!OGMUj@K;JJZI!0bWe}FdRbb%XpDhy>WV^kP3~Ay7?k@vDN6{ z0n5ea<58R0-MXSxm}LpVb<>)oyJsHKc)r_~Q`}#6Q|SDqXE}Xx+(a9RP0>jP``j$~ zk^Z6u?}~)?!g-$q;W?sa1&f;;43lV@d)l?h2a&uJB0vEyJVOPdFlkRw*0W%GIc^RM z?G{=3yvYGz?D9IReHa{f8X{wIxGbhiH}lg?yc{9KZKwdWwm;xxY~~}t$$lv~F|x_f zc>hQp9qczRnW5Uev&Aks0l{qIXbHSh)b0VXqIwyix;+FMrOXF&I-f+I=yZd>>T)@+ zwzdAhSUaaSK>}^bmTj}kc2$>c+qP}nwr$(CZQHhW``k10GSBlP^2^K}D^{#53_9Pa zd5lX=cA)7Fc!ooczs z2+8GoH#k%Rqiep+iN>f^IkpE>qB2;7gXGa{8loC@I$otHi)cz>``w%CLM&>+;v5>E zz9pG=-Ylt{sTm%O;>i|Tuk54kMJVSB^l$L%i0|?jz8S3z!>epwGN5H@L0Q(SOSrIq zluei#HAT=}V7k~OD^>x>txtx6^u1mWdXo_N=KBJ2p2@@a^AXvKe=51X6qH;WmevLf zjd=Y`0G>Geg{-;xos^)Zz^8l5`sDML>IZc>h+V&R`charxA5~B{gC5aaJIG@y2;ni z?$$8BBYhJajQMv@G;1O_jj36Z#}14w29I}|^TAJkgCNJ@)|r+(I4I)1$-|*@Kj({a zuTEtwRFkV4_q`6*G`YNb>v(KfWwSJ8YLY;nZr%S&i5Jc|*RoAylLC>#W1Cpz7O(&6 zHSy3ZT8zv(ov9PN(kgwf4zj>=)ml99l;FZONZtQ=@aA?k5as3ol-ee9P>-9|MXjb@ zX=*K60FF-C54%chJQnw0>4(W$*O~WrqJgV8!xJ?NosgEMi}q`M`kqzi2&BA>B5bDV zPm06AvR~AZHnf$q-O)MsO)bz92i~-q51AWUHxWMib~s(#Cd<`3T6^C-wi?V1@hE|x z1AeDu8|#Gwc;xU`VhgepyZtZR@m8tT_n{BLQtQN>Mn?M4qQKWL-4nL9C*2zF2eZ$U z_2Kc8JZ&b)z|~5Mvm^T>H-&eM`sK)3@l|b!T?x+ZN>_%UN{^%Co2RkP8O3dFk(z{Y zXm~4l&!I1x$-xii7fn#H4mP<~y#sA&u$@m@v&$A_Wt|8_kq4kRAG%iks)DxL?J<=n z67PetI)VY-Uj3KDmuxkNBZUgl$@=W^{c;93-aDyb$bw2zbGmEx;~%ct5O4dJ;q^!K zm5+WmGS;B^6;0R6_n_~gE0~A5jTkD0QZ4oZ?e5`eQ{G`1)Xy-eIv3cNNyI zxQExAhCcFywr&q7WA#M9EmXOi>ccVX9YJ#mgoz{Wib&|DGsB}u2qu7`pP zt?HZi3p}2+6VwRyVkoGOA6142Jfm(uulPSP=)4^U4LNm{A8B&bQ-Rwj7LS#2BNrch9^R#T_fb+q!tI zGO{)#7M(!f2Im^51OWr|K>-X(gFHCS$IGEaVHGcnPUsoHI`$cPz20GI|DfW32(NR@;)V7A+)r&9I~fuHc?yd1!6izTd53 zn~ZIHteJ3b^7yppuoMqQ(&e4ZIKH4^(vBq@MF+5PyqJ|`&215qt zs6IcPd7pDb(BiM}2f?Zu9^p2s7Ar|;uf4a4G5snxzuV%SP^EFTO%y}qU8tt*-S)N6S^pu6R6#}v~Lb21t+xP;|?W?^mA6`uQw9fmtELv zx2xm@J&tf(W3Ba^;UDY40j)kFZXCG6=UQ2_dDh1fD-5REs_u>a1PkhDA358RJqGx! zR+ASsl)Qgd(!WLbl-o)Nlx5@|31~JiQDwX^^io?H_72m&g{ic=0W1UUN>2uwRKErX zhp7MvR>@tCG71c;+U-DXiqPSGi*?~E3`|j$ZjSbSpxo>-@oq_?vMULLiF`=%g!S-GU{2o5aV z6=L@Ge(N3d6V-RgR%!DF!Q(aPG;G2XJec~y`Par^(EVi_r>H^xj2OesPk*63f=#^! ziqqVP5)P0@%+7c|JV!VC?n4BXNd0?mhlsjFez?&SZMfs!G3Iq!+2LbeI{A31n^;M_ z(`xG>dRpyQ1-1tm1tg^hDmI@F3ZI;Wq2e%+^_L)B45&_F1lq#{xMYmKu{H*1J*b_0H%LaabDa=5cr zbBO`LgRE+oqCv0$V`xwcGaApuf$CerK_OxlkAKavbEwdP*HaC*SyKlkxLf|&BFKP? zoxg}{(h80p5y&F`50C%D2}JFMVdJ^wR_WCGT}KI6Gt2bvO*UM6UC>%I6;m^--X^pZ zE?(=7Is&p=VyjQW&oGATH_X*gCVLf{u>SyKTVP+c{H4$0f?{HGw|!^MMRky3*oS~F z1WPqg!cUlVX2$e!wleBm{kE;um6Mm@zwwTU1Z6^7MvZDHEUMG`Rw#?j03+TD`XR*f zR}@ukX0aK*BEB-=nY1?K<%r}B3@LbK0z^2Ol5 z*1CLLmy?SuJ1dfplZ|vUIk{`i9|ub{8YtqQ247!Gq7y*ItV97O$fFB2Nx)3)tI9VO zK{!l(Q3%M{dpOCGwZ(h&wj|@-VD%6L{OXOmbj~C`xZm9UuUdGvovI&#in4Q`JMHtH zzcr+~3y0H^)~DFH;*Q=IAd4leMP$4zyd|p6xW0!IoLiAKRe*&9lB&o|+VgkbB?B8v z7$p|+hvopL=_={umX0PC+V|~jj=&qkYvs(!yZWYQGATTLj~_Yne>lPwYWEl1+`!(j z>%_8o;1MrIdnPL0y4$JS%8g%61x#C6n`;uBd#wL*P!+7bzp`ElWcaAfNMLL$rQ0%X z2AA&TKpJUy%NN9NYQHGU7!ZlMVf|Jw>XUICqt81%T@r(>AI z!0f!4Ow%a2G&%+CLd>($%Z*iE7|Ue%E4s{NmeoTIoj#tir);_hoEu*8tcpJ`?YG#c zKwR)?z_~EG)7$O#2^3YY)#zzP=|ZM--5;49W!@Srgo5P8)J;v*oiri{+Htt2n_ z!t*BSHx8Z^ao50$F%NI|(>5hUyW>M#ViNTi=< z+TO;=#O})zuus@qvvM*E%jx0sSD)2^0$K;P2*?GkT3u*zL;dHU)70H%NCsguTxf|B zHux@VHD4aQ2tOAIMJWX*(qCO1$J#go?r77GyR( znd^qPx7Mf|JGIFhiO$h;t!(bia`C11gQ7P)t_jeKr*sYXt*z5nYl_OSl9Vl%wwBx06EyiIfs=~rAc((X-$o+JP3GHTae{jQwasJkI!{d{N>;E3he z4hYrI{q*n!Haoud>8k z@+XJz_rCSE=A}lxn~+(2cd6>iQR za_1Dd=91(pXJ!zC>$P6X_w(#s^B0Z}3RqpTMPUL)T^}%LbTQleKkY*Q`flIAZ1h=` z2QaNSSKG($!i z6Mm*Rhk3*u$t%w$o(1ZPC~cC?Btzsy?MU;vE-m&Jxw55-Ej4p91=eP1#1q+;=`Q;> z+ua{Y;6`iH(u+T9BQs65uCFJgKkV!h0N{lyaU3vry8j?-&%w0N_4G0(wTi}(FpB^| zeD6ckb*PRD0AzPElR?&l>@@35@Gl1G0*Kg^{U__4C1|O=ksX4vxZr34IA*IHLGRBY z&UiR^@msrDmKVYorjF;TL_@$R4EQ6{%?#S9$U8F|qRafaKbHnqQsiLpROxv!yI@k@nTxx-ED zt`ijl#f)0pUh!_*d^KY9coTJc;cwRy-)0h&-@B=ODqecvv+KJf^HkgJbm6(6rsFf@72+`+kRCm+?gZRx^Ae<1X@t0ZeA#pV+y z&arZ3;JytU0_&PzEpC@oQzk1(3b5HA*=@8%+m;a4j<+~N7Oq**l;m7i4bGSW2%-nx}ZhvRO z#E!F$2@@x!4fxJoXLDuOd~Bo9h zRk}!acuVDe|FrgI*FmfEJL45!MYUI`>k0Hj-(%yYuys?u?S8=4U`85FwgXRGt_Sn$mU05hK04X&4v(LaW2k zBNbfP_2K#9f%dJ|GT_CQXS4qMW(174;MB?znxlR$zk=8nO(~pfu zZ@h&BGCQ^=;Bv)Nzrs2UxZ(Ik4IVh6eE$ixmQqJ-)fZWk4j&9gLga)$D~G4*JzA!5 zXZVu-tH0`^F2IC*W#$;l@JXWEkCGJ~Prr9KeuM#R3t zFjpl8Tp`+RXOLb+>Dc$f6hlXH{BP zV2@O$kd&`7FODyz5YD$P{^!~Uwa}~$`(l0>2D{Q_qoh<$*dC2))ZX@2yy%ozuGm~i zW>b8>j{8#hjZ1@bfJ|G|AyHx}=`P`Qvh z($zR$dazUkT{>H21FoFp=%z;{@m1UFOf}t?Yy6A{gd2>mLdgSo=w-3BsewvJ89ApV z8+Cg=?ZoJdJu6i9fUSrV7MY!fjeS9Nw-*b_;1+%0SR>pBSWITF6&Y z!D=tDxnd$p>bV1RTt)}%3@W$4v)Dp@+Kp6($QDQ6Sg0LAQhr_AA&E<1D4=p{pTnd8 zsGfpnr9go=`|x-gb&|@RjB-%s2PSPY>`V+ojD+KPk4iA2XHVESyj)DFDUeK49N^dt zeQM}uGW^)FQgRQpenC1I6HKV1#~JmBY{mkIn6(PY(egnB(TA=8k6RpY(GYrOsH@8=^prNP8d6fZx92ZtD@YXgQI96Ej=G%1;St7b&wfvs`oZ zYb+s&RAT}QM4#u9>_yk7GDMS%HP>Ec<1dy;H+c-xjl5VoC5 z{GzH$_g+jIg!|RdHU%|U8t>Ye3^INcH*v69e#>EQTV^oc5Da(%Q<^!WA!)DjfhXU1 ztAr*=+CM?PkMh~eis(>%@Q|vI;hg~k$P`sa{eV2!z)=C&;3!^rUmh17w%d~p3NWbW0~X0ZpqO@0?1F?>lo?Z;GqSpzr; zLzjXCEd~gf_xDc~i%GTgEdrLsp+bK);*%jU?a1kK*fc!nCtUv~tpLI;Tyxbu$-OmY zA+N{%V2PPG@e(&cKaGPi^JvfSq9GD>u#s9dy%RtNNoE_4Qi9QJ)mbl+H(9Ip$lzT? zCnVAne;Ja9$r&UJs0yZ__F%xIH@&Vf1jdK7zDczpNW%TTPt-gxb7#!+EYMe$tO5a2 z3pf9jnia{;`Yh}`HTq5V1q(h;Hyykj8pGApt+-^7J5{59I+E2TT$bMB?+^044^JWC zMj7E_&Vk*FG&)4f9nENaBmP^!F_B;|UTgzQg|7fth0*i=uS92XA!Lt7k;Xt&tv*EsnnmXgFx{ybhd8 zW`>O?M=FNloc5goG@PdC)LYuj<%|2e} zP`b`~0%6){*h#F&?Xj~P+4%YYvuK^dHWw2@tIWN!jM4f8x;IJ||2X;Gmbk66Z~cpA zTk2gf$hOq<0Q_UDrXuJ-!JB$D267N*WJi#g&-vxKEikJ=EvbEPG3;>KL<-{q{7DD& z>*>S_ieXAy>0RhbElitvjE}(Y#-!8gdB%N_0aBb7#Hm2LzofvmG=qNiMFsB}6!T+brf^$zpdFFAejmWWqxokMaX#66((ly2LXy zAGa?0G$k^ovq;DtWIdYMh7|hiu=`ktb!v6PtFY#a1#|GIYH7%8l5|Hi>SCY)ZS>Ud zX=%0dCMdB!^ZOfwML+pVk;^DLZo@8evul9O(br{7bW*AD0xAl=7({dyE0sd6g_n@3 zU7rGMqKf;j`1iTSuk^~?SQQRM8{gcEY`1T`X7+>ZPu?4?)sx8Ag`64;_-T!9r@MBx zTfv>AMd$`)kuVJn3KGt1aC@~eD>+5ZmfzV=?s9iDMTWsF@ghh#JXPncNP#7}Kh#Q_ z5*u|A)X%sicn^UFyI85^|K9Z&ywR0`#r(MuNQ9$=M*%A=8*qgdNtpHL<+JUs+ecJ) z%AGg)dur7|+W-@|fYE1B2gT}VSY6ItN9k3nRW)udmUOOS+(4XIQ_y(ZMSmd>%u$_8gG-`4E8GZIW&^z=ZEg@!A0U%@%ZeNgYjxavZq~5}< zaRiaLPxC)pmtP5hOw>V$hex((4&`1Y%R0QPZ8j?c{a0_fB$%ddH2!$gr5N{L5{SEt z?uzc$k#7%4{Hb|hp!=JTUgKTU>v?|hBA?^*;J5oJDZnlq;pB7OsGNb1f2VY0$J>VK zw|l39NCP@5xw_kp!@!P+{9DU6qwCO|BY6HN+@dTvxDaeHCQy{&+t*9kBBRHW;>-R^ zd8zI(_P5T});QeBH-Z#8ol?iz#pt(fRy-U8n%TuNS#p!T6pI5NsdNh^$n8k3uomKWa}x+fW@GB1)m|j{a6KyoRmibcrT`n zw=Q@~Im;b&)@Q>3-MSA>d}#)AWq(y-wHI!5%5*%irUbKhF+rropQTO3jv{QbnY+J~ zswJu9q}5=+rmEuPVbClDsKRz`8Y_c8B8#~q1vIMRJ4HJOg*jG#Im4W>k})Y6<5NmQ z)ci0a4au`|?;v_0U&HQcH;Fwil=}#3m|wF=uyFfgUca=k2DpKSEMnx6{(g16|+(Psxl+ATljvtV!EI z9ic{(g*>Pog?ZL}8XV1}`y~IpM^ZiLI9dTS@j=+lX!TrSq)Y*S63s_?kr1z;#p^~v zr0xVt3P%U!L+6Oz=ykiuEkdwo0{bqkB^8u=R-Z3#=;8p__0l_YE4A5}wytB-Dmcjr zR#Kx(Lxm6w*D-UAoXe^$I~-FeFHC(VEpnr&8QN`8li{{$cxgU>@-n?YuhlATe2HgF zNu*PA`{M7DKJ4VbyI^u}t#eLB%bYW^sL=+cVpS|l!cH91A7o ze3P;iLI_T9cLANruj596GlC+JY~e{;^zLF0FW}m3LK;1W6o&BgHdP2HhHc#v@RC~i zE*v~mG(=l+baeqS@nW(Ec^4i(F&@SHXtT{ItI90=%?UQQe60cQol7vPv)6hh0?6zi z@0CIST#2XxO-SkCl3t-g3?*UD@@@bsj8o#Jc2%gJf#MER@%UNwU5oj=B9;d|@f_YS z?lX0A6CB+-D1jL{yqjis@*G?&-VpP$pP9oRec}U8Fa+6!(bxQfb0m^C8{sS< z+Tf)VjRinXdlRe8LyH{aJ4kdMI5Z&!qgpmgrKX`J;6%ROFxVJV!7c|zM~Mmz0YvvK zIxxi4?M}sVm?;M@fYQg1d0yIW%mQBL@?y1T6aZ7zuePD5pfV<*m}5bE3rTc`;M*c_ z+jfgi*V7rKC zfL>lB5?S27+n|Tum#j$YOh#Q@zQ$$=tAkI@;WHNv=R2g9^?`!fIp}u=3t0P~-#fLU!qf3Atj1T9rybkfs*bSkzdgOsWHTIhKWEw@a~Ql4mS6kb&fz>7 z$so04RgD{O7kHyK_i6*Oj7)^cJxZpPL>JP|iCIwrRRFB)6e{R4yDX;RoC-!lttA*A zVjifQ5Z|z=mTq)ZBKtIAkb--leujV#E<7dY$M1JYMQ1SyC~G$lc+m{ZM7`OOi|ldj z#Tco~wzL|MnTd4hm$e5OSEx#^2ZS%4wD9>eo}{a?k;aO8@+$~;}yy~fzkf-TN8$b|h`%;H*@DG(f<8$5yx1#;gD+?HmwwqN&Cb0nj zxhxF7{etMJX~TN3Ha!uQo71sy=Q|XwR=Td22JH+*>oNML$1v3ty|!`{yn z=XDTgAy9RccT`VPfp(XbuDa&YbSl~Y7>u*!suIHe>i@w!gNMTakGKur~{u((LCgw^mVvRImty7m%*W-mR-c7+IiD3UPhn9yuDx6olFg``Eo zgO3Fkw-KaTZY4$s{qwG*0y2gFUj3W_X{UzaM-u&SNxqaN5`KKl^{L*|_}%8fHyBUS zv4uVt$6|evM5WLgN5X*YN-%>e(tWiB#1*u4Rr)CKk5S16xJ;!eQ#aq~CnxLcW5Jv{ zmO+K@!K4WjaK`v?LwR)?J}K1bY+e&f%Z%{t!FM#4Buw69A397iR*JV5h3F}Ccnq^w z2;N_>kaV~=D=Y+jT!M>4oH#W+6gJUAW-4c%b%!f3-y!s`vn}O|rE$o&%|9SCT@90V zmxw=u*F*mrKh(1Dq;$#g?R_FIGEy)_&k)d&+yat=rhXg2vwM16*jc_2vSewtx2R!f zyAjKIfvk2vnSp&2G~?M9UxD;6=Yqac$T4u)`etTU@L^_G^<`#PkD@kbJf5KNhS(zG ztPtn^yjdKM1Nq5COlo}g<4^xwR*2~oGh$+?Zs8wxrL{Bb2~<4jhxAeQ&>9XY5sok9 zfG7RL@TD(y7I?lEyY6R;&5oRX@qHdM*LMhjZ1`Jj#rhr;ml|&y2X=6a(sb&sd=J?m zfnQ|Qq-c1P0wxVIQXhK#WPm%W5bax%z%zeq{yCP`7BGn?*@}g&zS_F7eL>4v?u3QX zr9kzsaR6ionCbTwf)zwk zOBusxP5;4X4#Cq?4cPE_eANE>Xmz)-wveSxX_q{)&K6rx293khrH$Dxq_i)gpBW4J zKHv9oPS-9#)c6q5x#J@q9$vP-e*Ce~z^$tj)JBl0W(IU|H-)A-RO_yC zGgqN74TkjVRLuXLO6%WKBzkhcU%DoGTPIlF_jMMG($3Ut=WpIDNB217VO{{*OGGd| zPOahW-PrvfhQS(?#pGT1FsuDOJXWLJ6lCMQ8~dpkYp3P?j3ph)ZL*vflbdTItt>Ib zf}c26ygkCUZDpNEcLjIJSM>-BxN7Q#q8+SzrZ?Kr(|OYy`jLrY$J>>qc2 z@N4oKh3}&xJNE+k1}LghdCkywy_PLQ2;I*<`LGwM1QKpeR4Sr{qZ9g)XA-#0G+7)C zi3Bmd%O9nb&P^8|ZJ&?_Rt;{pvV7IyE?9XW9#;#SY;hFO`U576o$7$uc z4Qq`ErY4ru@<~!x2p#LjC03;>s>~jY(6g1;sHc$Moity@4wsPbPsdgxN&ugP8|O9a z+w!*Pl>%YdR0CBg)E|l|4Gh<87x2iUN%mt+LGYVra%LN7Z9b^jt3f>5_awpzFRlb9 zWm-5SwI8kg(@3+_%~iub*6M;ow&JV^l+R%EyuitU&e5LhbCnlx#F!p;Xz9&&J67R) z&fzDkl1b#`>L#3F$q(AcPxQBSw}7u9Sf1H2 zmujE~C_WI_XZHR>hvRNON3S>G?`OMfBEED^oZ8F>WvKfVH@p&YXvS4tG8FfIbWQ?O z5OuC-a}`IoZOP8*jgCgccs4j5#VBL*V1k0B=dH)n7lK^=H%^MY*`2cgJ?BtKKm54MgyBW zyeXY!3s*=eU7p4|Zp%<%nbC{o*#9p0F6TgL)sU^TuI6R0)!ZQd*%Eche~dojbhS+q z?3ojmam0*>bsoN6u4@9~nagIVDLY`FZ`$s~O8sS3IgA>kluxW*U*SsoIll22;U)c` z%nBv-!vF-;Exhzv!)FL$OxQBwwRuspRBdg@o`wFF+t962jG7P_{mjdE1RbhEaix=}O2q`ky+P}A~{*sEZvkta?138B~6 zVb}u2ipiC~T`pmq3;D^E8kj8u4wmr6L~2>lV+OYTV)nbXbhr2B#QfV=r!GH849?;n zsgsiaAuq?WuJf6?^Uke?Kqqbpz*-tD6#y|qYgAl(rwmDs1nZ7%Z+8bqPu+{PEl!`W zD|)I0`kTPE$iHA2ksUtITu)6#)cLnE-mc{|-3*uwePOG_#cUUUj{8oxx6A0I6odd> znCMRoa~1BlPQzt?7~9g_TFLFBR8#+!R>r2ctM9JpoxwKab2j7oT0QUJ?^>6`WI-feSM-}T45oC=h?+3?(6K2Uq)%e-hip7bKY;s7Lu9EQs zOG|kI^-Vl8B1`RRj9N&5e*C|UC3`Dx!(nql+FCljonG!gKMx0>pBvudBO>y>4v#!H zw>ZgT9U+zaRYb1qcEhyQZryR;2~b$74#PD`Rk~mUYDp?)$53H3&gkcr0X+KoC4N=}rcH(j~X zab)wzKinLoz{~3+91#I5wyU?{=x=7WjgKJ>ZM{L6mg`APFT>h+GT^FLx4Kw*g-LGh z7BbAa09O}0X>V~ze-edCHu~Z8lEnDjPWwA;b4-%lKER{rA>mjDr07!DK3x$vDnh17 zY}DdxK65QMa1;70C|)64>~au6rZ=PybhRFXgYY=Hf`2OirVZeSPY0+DC{W5q#%kB->L-pf;B9)lVFkA7z%&M52J5!C?DVHpq6a2V&04tUNHxP-iV$9{ zpl%D;6?s2?ws?9{R1^z z(NQtLX}g*x0DPBLim^M!r^q~Xz4{#LqEa~^bt{$;12jA8JhI*ExdMNhUQ&)%3+_3T#xT$TOn zDGt%@IJn`J)vc)>+fnNkWxd%hCV_C@if3xlOkLE0%b@Owc-waZ+Sr>XAYV8=8F_ZI z1?GwG&OjCXX z+v^^)G1;4?%e1q$Tw@G0<6;3-m^%uqa>{E!f)m_b6Q)T zgVA+mW`5eAn_*rI;)LUal-vAeA4Z?bThZ(WMmzp%;pPwhb5fplwJnXq_yPyW8|}g* z9xue|L=}u3xXo)1dJ#co_@0NI&FwP&XDR5P;*d%<*XTP$nE*XHVp%Nf(sS#>RsfaJ zx-S=BA82MDVYc3r$xfJS*76PalN7M#mfNiPF5|D1UVZ6ue{FhA8ujnYW0!~i@4&MP z*}^cZl-c^2GWj$|xhjcEp~*jg@Sv{3p`Y*DH`Cm9@7KZWY}nN6dy+TLL}6#IR&<1xo;&gGyshe*vZ^QNMql4eKB5N%?(~KLy2j7y59|^#6jqfoKBH0y#W8 zrGr&KEQ`kqv38Q0-(=fxGN;CIJPH9LD^!ey-Qmp+*;ia?VrOCbtg3UU{X&QPNLE(g z-;=M|)NgS@msYKx(qy`s1ssKLzEsuk1VVobC6A9F4aqFItLe(jI3|9&(%p2Xdo|PM z48)alWD)s-6Exh>SZ$7fm9dJDUy77qZxI6DPM$WCCVj=gZ+_#V1aG#r-=NFff((_x zIpLUl>DuIt#K?jAhSZ|&Kf(Dl3CN|0qP{s>A0YjteRx6aw~q!?t9jV@mj)G0I}#wj zk0Yc z5>MN<>TV;^s}focZj3*(v%O4Li96!^5+6RDy#tXZHER zL#GHnW6P^xPu`IiT?o!FJ!`Ilk&x7@?3z7NKmUBxg*#QdsYsbJ)772AWk!7HKn(wf z5U~$4{a-{RZ`YQVv7NZ>`d*y~yvgVF>mTrb`hIDPG215rvSjqd6Hjf$4maewXY~7c za*gdPF|}bEZbV}mGM!!*$zt7mxOn;u^rB#X0rj{JBMV?Qvfu`JVZoc?(Br46K)H7% zkkAR_Z-{It`==2_l6x<5A1u^7T8+SV{H*WfQi9cZGrAmU1gip5)urfdJSA~FPg6EG z?O0#3@La|2rd<0@uESeL6<~95h+hS&_`u#L65nL8tmVgH#T41Km|laL7ghS1VWB z+i3`7)-3Mv-jPbhFlm|uJPlm$4Z4#YA}cG72A8*=B1>~{vATJ-1LiAJiltA^jZNYZ z25L20Cja$sy3G~^`y!N-q3fHr=W8W~xITh6m9UTvuOW*nkO@neRi=yOEm0{LGv$W{ zqdEqz6NBH7IT21C+ADXOqCPm`0(3h6cq+-QnP&}j6r+_lt|W#$Ys@nK`escqeaQHe zNZO0Y$#V4_{a#mEon_}({wXkv5NQDGDEu4nTLmzk0h#^3Z;3*K{eBU!s~m7LaW7}R z(v=vqe>6&9wrRDt**a)|z);-!$6*pp4oZ4h?&vcu-d6ipe$TND_f|RHiu`LltbOXZ zH^}!Qtcw50Dxi2PFQyP%i(ktc%b<$+e%#+e;+z({# zjr@>)66}CW*$Vx(pSi`hmE0O%ssRVgDvTzghjpetfaZ{vnHwZbvE~)zmkkPBa)kG# zvx0Kmr76CK+SW4$dcajX4}A3@)yE;CJ?1$NyhQ|`Fo&SoLfYL?rv$tW(VVR6CGS7; zygp{HZ%vFqUS-1|ztMQ5aN{yJ)LVi*$$NR!Zam{XrSZXQcF9)y5w>!}U!_cBei zklGBMp8oPT(Hzt%vdz|tz{=aN39%bKAHAP;Rg?*FI331n+h8gfEf&jJEetCF8$5-GK}TdRsC}&C z#(tNwuYWvGpFv!RpgiLd5TfvK5_=IOvwQX89%qsln6LcAU7OZR_Y~#R5IHofg%OXF zRpfa_`8@aRvGsFbTyP}xttD}ods9d?!;b5?`@uVK*SFhUNC&-1E;YzK2!~ZF3N)}v zObcb;#^$#l3-dF+3%jMK8VO(rZu3jAQ7+d+1YO2^T$aqJ9`YU)auSju`05-G#Tn8`ti zOtO9nwcdQ~-)^*KKsMdKk@CS1Ey$Grs?K(2#hzZuT~?10$B722cbLOy_2| z+*WneUGpY!)dx-kcVGjC5#KZi*RHG=oB6|Kb2U2K(@2*r^<^|e*i_WZoIRy~I&t=EU!UAkt+1Bspc`=fD3yXL$&shk1bun{tcfW)Ih z;5fO3E=MWCgx?uFQ$wHRJ#5O*)p0~-@h)7Q$;FZ6mqlx!TgMD3(BrdV>TueI`qMa# z^^*0h|HE21RkLk~8%(J+H0AZ;7D3}?LllaJwbN+H@}A>xVv_A%Z$sPum{x`>&CXSe z{p_yaDYVVOOi=6H1N&eiwC$mPlF>~aj81Yrr0s#AW~&y~{x~NV&i+_XtKIT5nu--H zy!q@w$D)y0JSqS9HzNL6!FDe!OB8W7z2g*~m>k1#nzEH2Isza`r6UisTH}cY($_5! zcg9dct?js%MKngNc?c;|T+0j5CX*gV_FO$Z&yiS6h)E)iF|O&3{pw0@0!_uTcotmT zpl=3rZD0((iq9!&togW53*JHT%;5E)Ccnew1pEy_1L`lpoH08Ft9%_=b&7mE|5?OA& zc)!GQQ~fLlF(p|I(CBY%SHmvOCKS~Te7GA@=K+PUM*t&X0gnSuZvQm2FcFFd`pBLUemqoVA7qh5pFfpZISFj7FVfNXAFQiB$Bs6Pmm#VwxiZlv~; zyxV74hi3BD)Y5e;>0QnYG%#m|{lrqo2)0jis?qh0euOW+&X#N^^vbLUL}Y(#P?;Uz z&~MJ;xkNC~_eSXjMDOpUj~b2kA;aIkf^BLY#g&@#B1BTo8PHj7|0N5*w7-Y zoIdT0lkkFcSCtA*)mj{Ns(htNu)~G^Q*l)6FDu0=SV9;XtzHCus5=ens$%itrP!WZ80M3)x*=jFaDl6EdVq$zfhhRzVdmsuuk~po&N)9&qgn;FNPoEVB!MgpFN&E}p+1|@Z=fm9 zE~*ZXxMdoH#>NM8`*>_*f6~)NOlxaq=ybKD7uNsd5TM zVLm#mrvq-xUtqKu(xD%*dx7WXNTxY5FPf4_P`kuZjnStZxHlE6(Q1)k@`D3DQL>N~ zdpRfARM5T^2kVjSYs2I?*SU?+7`Nxt0UONZllgJ9Dht;{uh&3Mg`3IRNhT z^jCm$40wQeu5W27KgYV-`fky_?5p0`QjMgz4VQpRkNvCg`+7%*) zc4>YtGAHp!5RHrJDd#ce=hcN8hSR+zZ;9^9rJN=(m9?G#t$AH$u^@>L#0}~f-(j@l ztmF}HwfArI8lNbXUuM~E6$?JqcvVdS?!wuB30goYoAnmeD4!J9OTejYE+sDCw0nf# zvrh~H9I7R*OGo_#E7nB<$ZwT)p95N6^y@T~2iWau(1Iwi-aX^3Bf?frpi{iKnK-Pa z42DvLAh3|nX<>P76!$NpNby`ALpf^(11!7-&4F%cjwohu@#98#gGNAx-H_p+bI#qN zLDDW=VL{H#nc2Y_#jgqdWj(Zs*<>g_gK87#9f8G`bb6f%W_YS$83!QSeK5`J>tvUs z;apz^B}o3U{FFYrRw_eoSBGr47d2=!Wj7Xeg<~iNTtWCOqY+#OJPv8z4I0Ng%Pp?0 ziQC0Fhg`kgBD+`xq2&ZrZH!RUB(e<8Fr}KceX2zDI%Zs6bFHAlM&cIzV?cRRXI$vS zA}b{i<0(^H2&uo#5+*l<8mS4+!xOfLYZBt?j%7D0ewRIAOM(gX;shu~NcZKzHoD&K z{Ko0%7DG>nAO5oxj$W~wZIl(GavP2UG+)9L%X7@MffHt05 z#QvE8dldYy&{*7CDKS<yM8;_xxnyXm!YKQo*G zf)8N_gcV@aN5x`@fnxS)>HrL_vmhAZo%{|Bih)2lTnK{-@k!*4jqY*$nc7#eUMqV$ zy%hTN5&h_+gC5u1p*LQiaE1LgM5PPV^f=)TkwJA-ZI9depli9Yf2j0O;c9o$43c+i zzge`xDsCYQ7mZA`p)r|q*8u?caxiBfKs<-`l+o(vgOCqKnZMUu`}%B{`(rC9jpZ)V9x>h%wsse0jk1x70~g#AKv=v zRwCR8yGo+oUqAPM8z8hSBkZc+ZrS#?7=T$#{=O1!D)4T}=J9#~-UHNH0SBx&0|%&t zhaJ18Hy@Z-ALzO3#!F+!)10XSQre&k^=9}$ha?$~?Sur$9hLEv_xqE}e~yM+B-f!t03Qeb zppZkZ@7PvX)%)+F@GXnNTm)|%k-+%pA#ZJdM+ha~*g%LxV@MJx!E$agH6-Lx8y#oG z;kKBDk2Pf<6E1!f;5|zM!b<;M4Y5`bqJqu|OP7hzyb19aS^I~=DHZ%7=c`r|>VNX6 zyS~F&q~FTRvswx)Ne(F(0nr;)5@OR;w;Vkv{KoO-p7tF*UW^`*{q^q@G;9!>IPj0K zr2Xxu<|cot3R;_$%54j6TQ$=5b#FzZRrI=AV!{SKWEdlmI3W@q2Qle#JL&SOU_iM? z5Ulrv39efHwJUMdiv-;HAHu#dN|RvOwr#toZQHi(Y1_7KOxw1Nugz&2)3$B<^*#5V z-|t6eRYv5BthH*dtg48p9n$VJG7Vax_KQ zF5$f&D!pk`vi@1igPcj60*UNbZ%7JuM*7@~!0SVEM4@e*jXN-aq2`!jKz1UOF=G&n z+mgO6tqN-@IbbNxhK=7Xg!BcP^-=XfUPigw&c;-E+PTF;%nahSd32~Dm?}_?x^T9_3GxB@)iDQqmbQskWO z@H)VE4D)kS*(c=uP_?$_O9kLMwdn{VhvtKh=BO8l#5iCV% zFBvlQQF-e#Wz$qvFD(lKuI@T>z%>jun3y$<*NPUi@ERD>ZG;W*uclF%cD8((7)nF$meya6C}p}WwIRp1I#aWM-ag(Zkxml48i3IuaM0o z464pcpz^RB4%(WZ+s``F$BWV66mU#hM9y%vE_a+B_!l*?JXF^HOP9fKU4{$$xWqml zY2@cXl~as1ude8vg{0N8YvhnPHp?SBn3{v?=ITKAskLVuKY9c0R@uVUO>FODirmIM zUG_~dM5oh3VxrhiTGZDXdf7X6mo^YPs_HF%<9gA#7W8%eCL7Yc?T5{FMXA9ZTefeh zZ1CZxYTfGWm731&=Au3}98`f}QmEoscRkQz$m`|`^6TLeZt3Uub}sfV6~NHBwdD7H zIrnK1}N|?1hX3olk-D;D#$!{$x^<>c41=0dvJDc7ZNAe zxcP7pxbb6r%2~eAhb@=*V>V0L2sW~T)^9+8U>e-8>lZUdxhVR&G!Sq_M@r_8YO3Dl zfSWl-e75DHvnvdvd(D~`PvnC*l9i|flhALKwa4uuJdyRK5FJVo~!{N%bVlOm2H7c98@6kg;)!EQP;tKE-KUGvp zj_Uiq`hVOiyr)x@N%~gV^BS}OCjnk>I&`h}F7T2(Z?mRr%owtruKA6$DZzQ0JWI`$ zwyBdXKe>oWL_3M=Gr0>f*SE08VE8_rLQ37*+3jPNueasd!`E+>sps+}tc?p$PUZT| z>-Vjl5>S?c@FwMc2n2I8waYgfX>h*H%hU75}MlrUHc#Z0HMdHoi-#(^2cq)TucFO+f^=9Zx& zCm>~{?R|+Jj+D{62K2$rvYMdy$5R`*{I8A9?r!Tq@yNRW>$_P#-v5S;`@Ve|{MsLT zndyzm?f&e#J6>O?6Ih3ou?5&Hu4}zWtLale%|aD}@QXYXQ;IUt4)cm4eD- z#7~-fzxubKEkC7>J2Y5A=)Ud6I@P9#Mg0Y|o|E((L7i-s5(t!eC^dPoP^Rzanx+6R zyLPXdljG-m_l!${)Z-qka>uJywnaR*AmDWul(c*_*vse12l#&5@O6269LthAe=f^A zw^M%^U0>c$jFjE-^LukW>|EfhM-!NtFHM}^jQ}YCJaQa$*nCE=azZ|umArhit!T}% zM{<-*ei^O1&f>YN$*j-5u^-s+#;d_n*yF8}3oS&VabV)=I#hhX*>9if2W7zQk_vGu zbII>`CMEQnpLD*zuWRsXXs>F-Kc4Z(bd1_fCYgjrC0RKl$nbX8m|!c#>F^5b!-|d8 zgN?>}`vtNpFfyaM4%s^}0ct{oV!o84aq=4yp0!@VWXQe#&MrWA^rVnUt0mq@)WG<2 z2_0`X*HorLGZ$Us&69}7u||^68YS;gNzIOR&QM&-!}nJCx8yj~YA{YfVOVqst4bwK z>ZD9#qbp;Bpz?(o!E;_P=?Frx3ev<&CVUPGOY2a)mJCHd zd;8*{nySP>3G=2fumM+3XVMBw!LjjcwlUlCYsW?5$IS?9^ZxKx?P`M~uQwyxuX}&0 z^OO0pO>)B9q^fw;E_UjLtnU%g-E+32DWRxa^WdB0HM^n+;u(fVU~jX3Ge(*j1@Lgl4Xz5g8Z!R2 z^b-Z><5O4x4=Up=oUVh=?AW3=ZiP~bd)XpE%Y4^p$sQHAr`VBa(9q&LoDNKO4!~N` zj~d6N`d%ZqsnWk=ZpydZ9*+pDyaROl1G5Li7N~P+k-EC(^Q#(3?=O6!z4u+olDj0T ztiT}pzcmUR4TC9=9AqhXcJP8231&%Ml!RpJ!w>0UydQ#6(ajZ0ei5b|Y*paqP1ZRl z8n%Zk^oP;1=%LQmNsFw8;`gPDBU*W%;MAT#0(aLA_I5g*!rIaF*p;~pk3YjTw2QXs9aX$#7cPu_G6$}$L`ont##k-P`h$(09;Bw^0(+;-LH>fRToA#*g=FDE#B0j> zRt$Spe)S9v5%_txHcItYV^utB0^amaF^O@BzmiuN9?n=!fsa_cPi5`|eA6c0b|N*` zazIvie48SyN9v$**B%pei0nQ#**!DyC}NXkQ#5|+Rm3FsmWE3V5=PxZC%xat-{xV; za$g0q$d3IA4vE#%IdC`dR9^^l~l*) z1Q<4s>3h-l5NTKeo7rT;D%LCC4Of{{@D;-!>psXR>$hlgablBFDzafcNIJF0U~Ztu zVzO$3tBFu_U!p$KCju~QVtbZB=&L|;`EH0{YZZ zeenqAV$>N&7$Ok$?Kr3% z6*!|lnaX52w$j4F=b>ZaxhTozOoSWx=TS}1I}<>L1jc+VU$6~y<}Ti6vf{+OgBdZR zEhK2DQbVztEZPfbR=REUGI+$|k~W4!LWzUc8Mj9ZH7GtrGyJo(Bus@YGzn{3`+T%G zD$d6qnogIWCMadFJqFDbIC%#MLD&&{ysLKC3}(R17|tfd`1WjI?l1~&w3uYfMx*uA zacVLKM$uq4*<|!^*5~=u^)c35iU4=F9~ z2c&PlkZ*@R;m&e~oA>)mA;2Rm>y!^|Tj&;15YP+fl9fU#Qb0PhD6Gr$63GKt&SV>* z3^Bl{$xU8cl1NUF&-FDph?GWUw?Mqw zBy%#mVCyfLO}lNjp$8a#XDz#<1{pDgmXXjcE0dTT3oWdll}4|x3*EX$n5D3hfz=&P zWH8hS4nO8?m5x*;JN0HfKkXc;NH0IZ5-R=k) z@mptS&^%9P0#ud?z!m59W*ZK6L+@|tbfEq2vv{Ix^~gtH^>hrUr9Bponje$yhbdS~dQRK6FeU@npS%JYM$|^Gx z8;TMJnP;{6UKT-}e_NN=mBx&)s+w+9 zy@PRGX`=p;DCetQ;7G8yZ&hLQYyMBgEbi_Aa=lm9r43W5d{m%hYS_K!hZA3Wt{Sxp z79kX!$S_l1j&MPZ&(dX$+ms%q`f>B)8Z}qM$;*3H@7H0|cTZ=BhpX%Ngu=1FhsUEp z574|$+X#c+7H{v@)6i>8QGih*GKBfC-o7IDRX4?vKcRZQyK4$5IFI{-Brx8;tirgSrn)7&=hz_(|??e(*|g7tqcU@a4OjKnKZqQy7Q|-!%%@ zhG4jZS`n6`=s8wGOc#poLR)IdlQoKUgu{ve{hszryRIJjD+uIFl!+nbP0mrV(4}t6 zmjAs7((gXzwy@Yd zZ7=nW0>^>T&^xcFsREtW)46RsC#&!TvDpO&!RgE%|Z-k<>E}W52mlWPdhu87Kl=1%>Ffcw~kzh$}HqR zb1R)kO@Cw_RyvTwsr=3-D3`yQRd>!Qq~v~sxh5$L75P!wQ}C%(Bj)cq;$0A+wv8C~ z$=RTPf^@4-iNsQ&y>Y711%QWJZTT}ud|b&*Y^GV z{pG*r7$C1Rd^4xCj@V5;0cN^&xKJx?+D^`UM!kH>)~rJ+WStxhmP)Z(6Uy-HG=v^G>^9FiFzUN;={W6~E8)mNvl^jM4^8N*BQ6JKIAJGgX^< zyP>qV({lNe$X^B3!J`QC!L+4TKW0Z-QO;ms9m>EuQH6O40tf$opndVf*nf-018=W0 zC@EBEGG)(~qcq}WDc~ZpB}3f)QindhT(N0z4rIa7D1xlWgovDb0<+KEP-Akb;&d7zP)?NFG+8nAs;Rv@(38XguVBlQqV2e3jT&XBw&I$LUY$z$b1%RQ^G zOBlD|Uc4g&kRHAgN&Oj2E~zM%kd-_d^NKSr4C*fFDI66v)>}A&``wEYhp?Nr-3w$A z-O?;Lt|AtW{jjIOYz1By6GxwPTv=t&<)()(ENC-74}$ybNlp zX}eFVT`vEgjO<{8)~llpvbb5f3XI~<8ECkU<7KuFgO;HAQs_~maiBA)!a8XFK2WJU z>0V2M)V++Mc>4fxxkqUY6ZA_*fCf?g-I|k&v~0D0mEyU^tsL`_M@oM%dD3Df)LE&r z9*a}r7NnPH)HK4d>MWb26Tgql-9scp91EN@c{tNH^Hht8Meco^AiKy(VJ1ihm34E zP6A!@bp}L7GKDJE6w=p1egH0C$a~9*`0P_M_1t}UE2adw{A{|_M#%Smlt*%!si3}x zpbImfJZ^EJaOniq#rVvix9bt9c~Ew@Btm`}EDlqr+SP=HC-SJ}mvrh6rIQAZ`9Sby zCT-{GV;5>kEL-Po%Iv=^-jEG>-SqoumbNjp@YbgXk@;^j?MM3u^{mE(IR_Gin z%J~w1g@C)|9g~%xqD-Lw)PGkv)9p9lwhQ;_^LYl5MsfzDfU9KA`n!}Yv$sl&8+}E{ zpM=Ox-e9`)Fs4is=az;HeM0dx2?mwSZ>9`iC&-{cUh+2oy%M31s9a96&YDH8{L5ml zlTn<4f1u>cfNHsU#?D^=y4zl|&V@$QFi3HtQxI}ux)bxj$3B{}o14mJyq_Q?>RCK2 z5#H0u$3VJssn_;&bcbz3{o~gF(Gwj{2otzbj*dYujC0|8g83ZTxpYdkq zlF2M8^Y^*~%kg;>)er7>7hHX#e1QLiR=;hXU73k>bL0fdt38BRS@?WuzSI#DXVb3# zPJR~dtZXF|ES*|X?C%)GeRSpEXk}*M)G}bFNF`FK;7X$^=m32@tsDR)KheV5YyLWl zQ|4Uy-TmjhRo0#wFSq|G+;{U=79G}R^{JzOutxWy&YD*BV{qfj5~-9VnnAt3z3Wh& zaPfRB z{)%LEeZGS%F%&)AEn!{IsMfltu~CW`AwHpSIpwA;U&@p07`yT}vC&r>n_78|ZJv_* z%mbm7eQC!@Sttqx_EUa4m5f!8{^w7jXe~P38z1k`Mu0k>FS~lPABgwmI+H=ouYI{( zJ`shOP%x&RqHgdf+evJ$oPTuNnKVvQ%h6DOjI`LM|TcKmeF>{w)wMa2p@ zF^Lw8(ocmf)N~hW~O0)B=H~FaS7#A#- zdWEk+KFAk&OmK&~ONg0!Jfp-}++dCqe2ntl_AxN> ztIoZ`1CDR6uoE<6L7|GEJ#MF#;2`s(B+F^T%{{vMLn@~1QWB(V1TQI$qI%gUYI^^u z6T-xuT?K9!C0-Ae%Sa~&+5+p7TQx+(EP`Doi=Hm)hB0l;aBm`Fiq|GiUE4z`TcUR5 zgN<8<&w5)bb8weMgq-0Y|RpZ6JQi$V_)l8u%T_b;Z{dyBbcE0{>(>Z_|K?JOtVj{DkApo-VarwqKIId_{yflPTll zJol9f8R;(=)IGwlANtE4_TGE2Qp>{?eFgswILOMlNb1O-McJOpE#fgM_{i9Id~v3i zo2RP+;gg@8FTMkXojPoH3y71$EZBMd9t$2&MhMM_e2UEaX*rQzD>8_{)@KBJJ7w%( z7tRbiQ-qmcNN2fGfoaOKe_A4+BF3&j$Ds>#(34PgX`uYVyv^R%J!@`)3+~zoYr7i0 zybHl=0cS~ie-%lmP^v$u)3(+L))mT@IDrfwTJ92%+m?+P`RwsbfU_Y-sKl?chu(5J z7k~K3fvu+n>F+QE7Yhr|S<51wfUOkc)1gMa@+;L1`no64uvet9en@P%^Gh5DSJi6| zoh^+5X4`)fmncc_6DX}sIb)au_BPaJ48*b{f~OU3VJf`_va}E(IkaPL(+P!8igu}D zuh1|EDLc>92otJ{F$AWXe-q{-K#su#Sl4^Z$`}OD{GkP9Ej~bA*w2j};oictbTCT#{EX(OZ2L0tAJzseUb$$ zD^k0+$Pf!2s!)RGJo7UXv-R-e5#<(6+#rU;8eVvhKC&8GMgOw5mn-U#c=NR5w2UBu zoOjsaZ;Ww+iM>t8*B7eos(KEn3Y+eJNi{@a3~rtXBV{-Wez0!qq!@p2%phY8P~0_d zkRq7N_TsLeOI`Om*}qa^09UA5yEY?Bv9wfP9KhJCiWb{p@V4Nrq?e|4Vw1=easfC#IuUwU|0%gw^G zGOBNJlNRN!j35Fw3pJuxYHib`_t&uPHEDhfM#DhtU?-!$ZsKQC3&Rw}t0k2?|GkEi zZdj1lJ&&WU(axMK*f{!IX#BIVE|FMjWN^-xwz}--x0cu+ zmiBzjI_O4#9p{r3j_{W;8Dag_XW*zUS@Vw-w%lc4%>w5$G@h>E+tPX_5i?x_oX=6x!t zA)PB2*JRW@h!T`NAS2G##Jh8OJm{1o1qmXC1cgTx;zIDo`(TOaMk0z!C?nPK&BY#) zHv}&!;N6_+X$ArQo;5|Gy$1Ki;+l8b&lxo6(s_UKRn$~#-|Cmi+9UgD^DIOLpdFt1 z(hJ9At>tITwiYbQGuq6zM!4YCf=IpaHA7n{fLx#!>UW_tB3g@iEWO8xn3D=vNU@jfr~ zvM*k)XX?D2LZAyB3g+2j3c52m3)h5uxS*JJpz;Wzi0U?tl^H+lTnaTSRS1-6Z_-QR z(Jrq#j&$QthnR3l0tI-Za_{Z3!u+5SpGhH73e6QW7azuvCRBdZgkQ+fZlLh8W^XF>X64@^DN;iZ4D<~B>4C=XCIIk4YE(GpYmIzeKm7r>ZGhr5G;+j0i zEjE$Kqfhp>&f1HJ%M45I&1+>x71 z0MptoSl6Z--mRg9ePzh18M1T50P}nfqVu-~j!$X-Si&RT z(i6R|STRNE(oebd7;!m?8KGO9-C;e)wHX|NZp|fLq}2ATA40Zswop z-4`dg$t`y!n(Jn^1HZZ?0(gwK{hW!n?e3cgYFsIdHoa@XT=cS#4;8Tz|F-|rzO3gW zVCM(mr*$JaU#+tdWf5qAcObsC^&QN8u4#bn?{mOS!ZH<&nR+_55ZByb)Ki#u1Mn%h zIY7Ajw($jnR5rl3(A>6WD!{wpQ0!fp#el)iZaWjJM=(TEUZTZDdp0gL2D%86Mb)z| z8>A=BZPNp^4}i7uvR$1_7kBY1Ve?ii>{wp_ph~v(E#75tG|;UbPim*X+!yrV`bTH5 zHfD%tZIP~Q2UeyiW1bYRTgx1=Y8cGHdz$J|pNpem-tT&BhAarkl-wJziylv@0ST0F zquu6JV>dcj3EnE3c0Nm8MI5W}psW|)o3^vwzjwX>Ce1xvOM6oNZOg5*WtKP?r>^Ht z_T%vCr9#| z0?u@6LnhH~bOamzJ%Xa2z#y7`%dFG1m=*yGv8%~#Qw}i~X?wEH6W>dFzi>~!Pe~LE zsf*P=tJlkfr!<*q7_M$XHf5+2wpwMfkxFs-YnjSVkgLy8d=HjJz|+Kgnk~*y@c7~v z=PWe%tD$w9NJxdDAc{kX1vOEV^&NQOpJKxDM$yR%Xe5kzn0emsA_WSov4 zRX1@;QRm=Ya0T<3*B^Vd_UG=)IM*M8we;trE zU*`4YHpwXe9zs%FY8h74pn18YnxDXxyRS2=k}qc)SqbQ<<}Oe@FU2r!pc;^b$&yE` zGytyDie#_0FVJq;3@Adx{V>|+E5H=8gkEdD1e-e}2pE5%&aMM0ZNJc2o z-Xui!nSxGyohjTdKpn~af>(AH{U*q&OzyHru;VAO)A;0Y^}P5Ad2D16*h^q}-)jpR z^5!;xGr+o`92CxAi3Y>74+OU!NPrL{|5+!UXA}o*HrfsvcLfF}!Vgg5%vS^Of-Uwe zv`{x|kX|?({JmwyURFNb{~?ddF~(#ajy;n46Uut_3e;w_L{~Z#&!hml zE}`oUtsYo}7+MJvNjI6CFW2Z}`vTP1BB2q-e3)!PNaP(z;1hJpQEq-+Br7XREZ+O| z88|#9wmvS|qnEj#4#uKs8vdC1xw#OHzJw1Kb4db%4<0?9$3QXUaeR|f*A`*^)Wx|F zh~4+i&zbq+*B@bNzGb6et8l9ef4eN#YV}?ffGf-wQ1!k3xksR^+*s6kFL)CaB24D$ zx!}CL5ixmtdCx+|XC96GbeD)vAbJ=3=-c5EUC(x$^%NiZdN+tWz|Z%7MFxO_-B$UHgwXGMnu@6QESu+T=unk5p+=8GPT=Iighsv` z{+p=dM|ETIqiTUykJv6oFSK_ZUE+M7Rdv|LdKWxhBI)VrO)${5@ilJt0ot5ud+W}? z1C0E89+WvDP$2Nhc{W<#T~?`k@%&zSmEKVry*-J_s*@N9-x~bGbdRHS;|p*Q>GE+d zR~a>F1{13ZE{}Z^NBS7sro@=|m>)jNsYZ~S^cm;fmHmhN+ zRO9dTQUEltPRj9j+A}z4;NTWP!_I(39s>%z`U2Q7mmr$kt#D?K003ZH`eJws=h+`Y zAA9~3x~*W=`SQ=;M_&CS2VK)~{+Y+VuE=Llj?buyc;o;6pRGjqXDhL>4CbRKhkwFl zU2z^*H<-~pzc-k1{87L?We2dYIPQPH;4#c;LqwJ z@5gl{JC7{cG`V-#6+FbLti;Dk#os@F$Q823naU7~yb*VW(ER+UIt&(O4z^U5`QJ+?2yeH|6JcxA0n}Z#S*4lM_TOxMiMx%9kSJu7t74_rxfR@{>f(!sl0S zVA$N;?ey+0O*qY}nYcnJBWB-G_E%><*|gmW>sNeiek)}(M*7qvug;xL?{(8mmxCNw zm(G+p9n@{Ho)ci34yH}IHicP7 zsX3~KsY_TIW9hYaSNfliPlu0FzM%r17YFQLEujLg%8xtx=N}bWW%UYHzrfK!d^5dnpB33v|pastws3c`TWC zU&c2texyl)9>00A@^P}Efq8<(Atn10;R|&o^gS(&A+O+`6ToKZEM?|tB!e!GG<~8V zDmfkuT7*v-EkRj!yWDdz)Uri0!GgNfuyD2&SY@TQ4;UJQK`7k?Q6zhicLx~LxIJVh z(>uSJon!K${o?w^@?b7-;$N@fzFRUv#=?f+;SFHH7Z72dVWtlX>QE`HUy`7B6O29c z50Y>W*+M4>YEtUq=l^=XuKRlXVY|2A4$W>(MA)zsN+c*tDG$#1xbrI^=_H(mhJ}04CuxR%LQr!!d)_jyW~+NBGg~OAlg=oN`8!ytfey4f1R}$wY%ZCol5_B z@4&P3ZPSc)3q_Oyw0LLKQfXidu;_)g&yU|@WEg8X8B5MKv1A`lD(WgmTi|HKz`Vo0 z&JU(Adt()P`MG`=={}BI^|QM&`ULm|KHnZRo<}gt$|xx6di`%NKQ9-xz245PQ_B#K z>hu-#lB!yBMdcNGzi8`=T5tlG*^Z2CQXjCDiIH%ZHia)%8F^ac=?aQrBpuvV z3_gCv=v!YJ4A=3jlms7E)wmOcE<^Tk+wc$fQFj&L@OmSoZSEX%TE#dxoE7X*?rY{6 zEM5rQ8DgE&Z$)S zF$gedGZ>b|a6eXWW#gb@dTZ*wujvHbi+Y_tGlN8WWybOgqq@SFE5MgV|x0N#t^HL z!Q}~|+MzJz3oS2bI@XWQA(UewbnFF5W+H_`1K~C=%k5zmTC{%gYgM>lc z8b3#sEnJc_cGs{!DFiAKlmJ%hFrl9XbSlAJcN;8Y5j6ty@4#6pv)%{x}GlY1dhtbbV(zK|c;GNU4rnd?2V z>iB>Ee$ZDM6qBr>s4VvG;{9~s(|DTp0t&^vwHzpdjC3lsFoKwV1^By$*cYZHs| zkB#=_T>5vodOcpZ11eBKsgqB3E%gu8>hO#&lKMnMQ6GMq?jU0ylA%a(+pj2I^k0og z8zUMnbvaoC%D7~k{YGgc@py4hh&9gC%4;$D3`zXO*lpbiiKwbe6h0S^dc7p7%S?-2aJ~0s)Nx=4Hq$Hbfp6+;M5PJ%2G*?( zHX%f{4ZSnrZq>8uDwg8ZY;NBbTNkz=T@&5dYS4}-ov_j>P(f7F?N4+yo_~rq#~+Y6 z#g|Mpwc1PO3)|`E?(hFjr(}Jhyx@{xLv%(UfsM>UKQH3E0-gp;B92pZq#RgkYDzCo z-2FTOR6NV49Plsyd>#6YX6CW2)FZPRC~c^84?>x5ev^0pL$Pke9c)DFagH{02T^Gn zOKrPz!ZcN8NTseeI5Hg1%9I_1 zVKg8!ncXa`s#VoNbdY}K$k#|lF^TS9?AQtp@8;~etvl5DCt`_$rCam*Z#Q7XE4KT6 zy`qo4*?vt2t-of0|I%tumK}{F)*VXxyr7Z`BorQ>UiJyTZWam1OV7a_bR@x&?3Rx? zj(aygU4Sc24BxHd9Q)$;&_()!ySPT{>Itj0Ka#+2W`BKfYu_BCSq3rT< z`~!_4vJaA3=n8Gd>(y?uNSl{Kh53F8qfdL2)=}Q(G4g)>oNyntu3cF+y?U}Jl!cp_ z_z;`Z;BJy~PS51=G9H$B{$5-;JyI#-vN&8Q{WZQE%8rhqF$D)yG3wH#mMcJ!v|a}( zk{6Y1%=-*xdGqe&r7c^_*LfN|7HT{qpI1Eonc!ZcSA~JcE`4`QE)sv zU&9bfGBxm4N383>+|5ti`o4g{rZ;2uJP)+owV_jox78{epP{jZigyefhzYYk&lq>%XDGC+H-rxDXVct8p^BWg8 zI@s9JffgZFtd5-%qZQEK&^8A#viDz2H+-zv_fzC=DaikkvD!M&vhy=@VnB`<8ROta zi@h&*F#kt$@hR9Bm&0+TPLo}rncTWlm7k!bVGS+di#!rnkc7dn7T*&lH;dIGYGSzr~b2CO&sg@_9dd zDs)ORIHE@xPvs5#sR6zuC=Dx)3TiLZqQ^xBqw$Z8##TxcE0_F>M{9vzG+LX45UJWp zXco6BSl8XqN^(6m5FZBxI0h9CaEyk(%Kag) zS8gSd+US4HHIAZ#aUR_Af{^|^6eNmR7Xu2DBe|#WFEY)!664hc<@Q0AK;+(kAw*$D znHC*cYp=O=igVt+$cA5PU*((3`!8IFux4x<7)IbNXImQ8TsA$>R$gj()&jch#2~>a z--{j0A^?Q7rjLepv>X3K>sezxc;jsMgJ!bOg;ArU3}=&jI5=csQ|E-wq)M;W*}m0t z7YZ>wSt^pa?K+o(iW422@)@8kO)M7Q=jpQ|JEY zB?4WPb0D1x^&pe?125zhROD179kUyefNLtn7|bEIc}jkajt39J6=rd6n>GBa9N$wo zfjGVN;8p{%xvYM;+p$$_k(hYj>~MeNFq9Pc@IEoSjq%3XC?(Gg|btA5oc+c z4D@XYi#L_^gEwU&fSRw>^3$AJ*tdrg$`L5k=%5avZ-+BnOJ6gIu3CH(O$jIdcU}@zIp1H&21XuD;uOP+y^TE>fis0Ao3lBosyp%6@9i9JFeMfsheq z^SWRxkzH3}P=cGE>T2L2(r*Rq^E6P_%rURk$ATdcTKYsdvQ z*eT6@ZB5~2(Whc41ULk`avj zmEMLS7-?Bn=WR2EO4+U0(-5?mK}xVPi_>`tz5H;lrTZii1eOSE9I0%FUNPVV)zcHJI)mT4>TaWaVl3|*+3B6b2_y_bUVKZTtORv*(- z)wrmc7@Ee+Cp=_qvfr;VqLO7 zrV^yb0e|Pzt9`;b;?85SJSmso@zAv<>lM7NqPm7J7TLbI;S1vMt$gC^MpU=eYeee6j*{GG{!(!sd$;nc-hpRn3;CEZi9e9NonS#h&Hd;6I3u-ZsnXfoF zic0jl%KA0=_d^nC9?JKewU+E1miMttC|r*=2mA`YrZW%wC+vb-jH^79nxB|XaW5#)9@kSe4@zrC?JG|ZNv&#eR{&e zAFHtX2VH576UdF_s*HnCmven+rH{0LqQY=l5?* z=KqKqtACewJse*UgU)o!TDI;oR(+fU*crcLisAds*xm2()&yeAkR$ zEP7BbA%hdeI}!>Bas!h{vvZ4!?UicuwxYTQj>nY4b6PpNKMpRd-GIHKyIQ&g*|m}T z!=)d_qwH0dWA38`^aPFe9l=g1l8@u-e)CJohgI#EdY*)U8STvlW7*Wp-&nmzBOMZiN z=2Y_lJC7IT)g=GETAs0B@FrzRdBB*Kqjhxq=o$mCP_g%^A(TKhjNB#FP~B(O+rwt} zcvkHxz%k0&5dpjuHG_B77+$8^g>L$5p1S9!WrsXii=J^o4}g2W_VZ8HXOG*QoOxZ1vOyQN3S|;K#i% zm^gvVqYiD31_z+TdZV-N)vbG+L4WSSOXWiA?w@P>(zsuG5ZJ+VZ0YKO8I9W@d{;Jv z^ygZvN2NYXiJXdKYb*1_0Pm;$?irv4Ly^#q-L%=_g1){A{XR2Xr2Ug^9Q?J#PKf{# z8ZlX*CCR2kB*2LVm6Vv#;Is5y);rhg?Pa(J!e+K#yt}8VYe%L&0U!6R4JN-170`*_ z!%XeCl?f&j1|&3zB}fzZ;1n)68pXcyWhaPC@yViqXNGqwhTq?@3_1nYP)|nghBKtW zx38<@{zk}z~ z>l;iM*+1=U47@Tqm}Jw35^diKXIm^f@JzMn(c@(I+QFBa0mClH_QtNM7Kna261U(c zFJ7o~n@jg@Zjd4h`>{0V#2F^AkioSerV6n0ZB-Z3iuGkEePp$;qr{qML$rq{V#AGX z!uI>%R1(?>{;Z-k{!tAOYo@2W-bI9O<;zUy~+u}c_(T8%2=IV z5C#vhy}OcIA~$M0MC2nI-*i#mzQy3-pRhl^sW!2>GJL$d4rO_b@tFIZYigIp;q51G z{aptC)|DWFEMKqHYc~H>V!fV{67F=v?W7lH?=&Z{Se7`Dmk<<`+$z$iH23+H+>Y_Q z{0e!#c|Z&fMwcBue0c*rvr`A1YZwZJ3_@e+oClj)xuS##2tMBrjbB$q;rYY*Jx-xs zLqG)AZ<_NcaW5AXmmdbT1KK3e65E zMEE}HS0D`AH)xA*M8IZiV=mfxjcL?T8+WDcysPBp6RanAg7^3xTb+&EH!fQY(Oe5? zSTkqeLwF>*zV)q;RNNzB`>|9xl7C%x8I=4MW1))^+Jkz^KKKa@+Q~#6QtucSG;Pzw zr5GuPS$$Vz(e^+R|*cW&Icm)L%70ACTs{OPM=YXV~9ad9hOSPr@ z&~f3Aw4`ezZ(O+eOxw2T;cYG5tvt9`oS@B00=Iq=RIoAlOS=BH>Eu9Y!Zd?&mTMg3 zL46Z4-LHy9;g)9C3)%pR{;_-6AqPW>n+`3q{q~)aTdp)IiTPfl2!4`aTGHyKp|-%u z!!&L~J?@lc+a`%j)S2eD#&2q+Z0BJ`m1tW3GF@9O?qM+p8@Ytiz_f8&NB!hd54-WNWq9eOLvx* z;#g4k;jaA_y*e#kRa7Ra;i3C{4H|oE3Nkv5y}mcs8Jo7ib+F0pZ4e3;P^6lsNBnXb z70^X|l^^*is-VBH%1R#0haMyr!2SwB?0hT)vg+eQ#BYz8hQsuR#EiMfRTK6oc?k;r zuGu_Q|8k)%caRqis1T@A%I0KBkB3nhEL)pimX$AYs|vArZL5P-dOcpr)1mUI_R=jR zc+lWe!^=;bK7q)!0u<1_2ulUb)k)0_s?ch_KESJauzLsNZFc*!yT5Wq8{?2t{ODT<0NcO=HSWhF z32TxMEnvVd=+#~Ldr3V77>5?^82K4D(?^n@C!!_;KqN^1>@Q_41RHFTl)W1y3Nu$z zo}m`g#FWo4V4Xk#gAq(-m;bS@M6n_DQm@E3UDx*qQW-C|`$P-69U)Dw4iWUWiLkmD z#28L19C?}!%?(2bZ4Nt!$@vOq?f?Nk!}3OwxLrhB5O-zJNIKAu&DeA^O5vo(eMDhnB4M6TF| z?koSlQLN3mVwvJ^D$*ectfze6O5I8npX9+ZfKDq*VC02Oi6U^B`!8-N5ckeJyKMXA zBpfKZ^bZOUw-T6u&6DpxDfx(0xhW6Xitux8_}pXJ;tL@fZm?EZvM0hpLXmh^U{q;# zs-^AfpmnaNj*zRpVNzR()#$U?{pCHYV)TkY?w`r-V8xf~1Y|kN zTr=~6rLz-ZYT+4NX26)mGNk0ufAvYX_j0aiD z6fV>rz!)50aa+@{6V%kMi+;O$BD5wbb1qdv$we@xU+JOk<$EpV{+(~>sw+y~q7$vFr=GthAkY*|oGA zdB(&hC5r@~_M)gzDDiZ!WRX+ao7{!ik*}u|BiS@JEji!y15S-eRNdOpy%<6kl8l)p z|GPB;XbVY@*GW8mAa%k%SD;uSN0v{ER@JNG<51rwy}(wsKk z^L#jX=ymIK9Y#gs+ijiF2Tdz)`PAw~QzszPa*jA8i#R-6j`*)zy+^BpxAXY2AiN4S z#iBBJfA<+fMxth0Ve^kA(`?Q$+~5~{6Nqm}Ev*kux+1!=uo$U{=;HHCqZ3dBlU3 zPX8hI*-*lc2Pb`m$JX5V)#%@fW~LEePjQ`}%B6+JkRjP41J}n1^T3{#`T{F`8S(dd zY-Q|7?{9;!7r;=m>XUa5b4j&0RHM8=7H5G%CutJ@#_cj6Vlz_smTX@$l2@73 z5iebhFT!cD3x%7#&6fF0=J$6G{KNl8rDC}LQ3xjR|RZ2?z$5qJwII53GF)+LbK$6<&pa;;^VVb zRcB>w(ZdRYilr(ZrRuEin!}j9S7dX3eYM~?e8_JSH1tuV+5XGrjqz{^e=TI|uZvEp z1k*7P{YmalHlMRhwC$JSqya4)uC!X}`V7}GyT`{cnOKp-+kmQ|Q#POAAeZ~bL*d8x28}fYJW6SUyt{W+? zger;d2oVTMGs<(v`|%K}0PC)Up0*iu`8fgT;+`;?a=*mL_CaCx0A*fUtn>_(_=){= zdsqb*VeD*yFF$Q_V{oP*g~lkL|MMJ1WIU!4MQH?<1Z+U*gR6OVBi>Y*HYNzD_%o@# zw6-{>201%sl+eNDQs^mo+-F-P4q5~)45hP0{9_o5$4e~X;t?)+WIIF}rl+KabO9f5 zIC(}+YX+xts38>dR4i2kaS{mkSBGLinFg`;)3c8M654X3PApI&i+1c50Wem>Jk3eo z9?|QnR}mvzT~!^mg~(c2M;A<$E5G~tCr7RAh_fW*F(lLY$XSwbd>}ADt3nkQC44?m zT1!*tij$T${h|Oq{}Dgy$W@~mRA+M?o6VHVE&#)LkNOqDkb`aUWsRXdqI;+XP_eF! z2ThfV`)lxr2&X{74ev~XKJw4D;eUFAEjEJ=J$LJ+8w7h6-usC!=C&HBZq|_+V)X4B76=whj zV+i|p#c%)nz0-bv<;I%tUBmgWYQqP1(lF`?40(E*!IO(lbCB%qUkoA@!GL2O2k z=R^X~ZZQ5#1`>)7^_Z*rk*diU2#j{^&wwLS&gf*L!P42FD)4e_FWN?h-qe@H1Gy)} z_DX#fUi7_4DaDv9Wr~7O88aMjJM((2dX2Vy)XSW@oW@>%39ol~lec3>-L)syCxC4= zh|SuPd77qU*+k$6jsHv?B~4s}fGw#M;)v&B^U`q{P7w=&TyMbq{B99po(%YFBy8En z^rte8v1ELw#WXw$xF;+q%IJ68gh!a&SlVeGFLj>1OoFsvZ5;wrw&lrB%nJrv{3kWM z%kzw6t=&AFnuvH}iy=r1nyGuwU*W9nb6R5Zay}S6f~9sjuVMicH3gcs)~W7nz?=KI zSZLib4#)b1DlFKZ@Ng#y!L%cF{i5(g47N{mlYWtjL#jY^t%$acO7vh_P`TPqi0fan zl(gZ*uTfGe=RU*u4F^N|j-v@;e~~k6)`F2IO@<4&S}X*FV#0y+XAI?|yZ{jFmv3`R zc`J97EVyk-w%4(h8(r%44;Kw4@W)it0EELfE7YX3=~#%v>OFl%B-PE>sX-ojSzbgE zfmHiXa&5Er%^^LQ8e_=KJ zt?0>jcX$;g8hHE`^*@&vRy8%{=Wse3>)o$s7h`AXZ$Gt1hg%vlt!xgYGL3m#03>R+ z^&AZjm9ka)!u3&Btd50pefZktF*Gk4$Ly^DXth()wUI`i7NsYRwS7$;?a@6HoECr< zi8b~}EnH_ak-q-7op~d5bo&G(jBEG76n=xB-ll;Pzup?W*VsRMQ5XlU=n=7Rmbq8Y ziUP^!Smc7fAK>wVqG!_kwsv*2wRZdZ`aGQK=W+@@7d?0_>~-B1tPxt71=3PYnbc8( zG=7{LKJ>N<*JB6$ZD?zD6l>K9XV)vh#Vn*)xjbv|)$vSt=vKKXJdu3TS1Y$Lz^tH{ z0UYSBv7Sk`>xfd)t@ZfxhWFiuew+?NWWi@W8bY`Y73^v=$ez;^+9SLwwU<>W=ztxW zpYTp3xuyN)8(AO+Ie?t(q9|7*h1s#5kWc<4vE_FhP!T=#(ie{yKz0??^&!v^7fGp+*r;_AV&JO2T8@bdqp z`{h2ilGgJu_Fg*%+Kc%S3qb*B7A^wn+=Cr){4V0C%{8x*5Adr>iWa};HI+H6?HWU( zK+PejqPVsN)z%q`S4+auG)1}!So#qXp*MR5R8<>57jfWfU5MW#iETRTS6}u?$4Q%7 zCJ4Yi4?SZia0+;aWYDOsqg!sro%;Pn5I6pZ^#>FIKzVt6e%|T^{z&|O5On)sI?hUQ z*;fagYEhW3+eZ(J)K`9Az0OHCn#vD9k^zNHx8(ny#6R#F@i#q9GWN9yQFR>A_=;XlO7XGc&AJk+&a{*9Zzjd1fjQpX@`u*wn7+?w z*qw#n;D-EZ32SQ`H zqklKlb#s_a&c>9ZR1wOLZ8d$$lV;Ee^D&EM%l!j_Z8V=se!<2F2K;P1J&sUUZ`zdk zhx_L-4JGc=Q!RUj6rkhRH7uZY$3q(%9bpcSnQMl~ia9+SS+CcQ8&rzV`>j+zRA!Li z{~P1aiyG4CPx|GCTob&||3&konJy{~BRDxsAw?0n*lIIAer*r?YbtaPcW}gRoIzdo zyKnkUx{A41IgA1nNc9s5)@nl{&0%P?2)eOi@U3hN!tTD*Pen|rZrb!g(elhUje`0~BT+VOD7qll!n;%}py zxE9Tv@QfIuqSwxY|D-mY&j}%N#sus0V{=&a_1b*Jp`rmTg4fVShs3B!;$aFn_0;ul z`XxH&{NG7_;Xk2>z<-Z8LtYP9pGbKO(2*dvDD7$SjQEb|WBNc;;5MM#fiXoe7rJMf zBINRV13dp96u*$|ntNp6b{1m2fRS(x&|v;Q49?#LOR~SuOM{$}ygz$=c)z^-BmTo6 zZmadu_pByJRZ2s3Vmq1El0CY)+sN+Y z1c7yJ{sW!Fl2X49u%V4{4_~_T^)2>+qT&`t%LF|g{!op}LxX>DnEuAES}879B&6y{ zRQp;^DN3Y*vp0s!qXA0eM%*Ur4Ae>;|R+bMq@46^@ktlooeBar^qmq3XQGVdSgXc_x^t z6Wm86`FUjvvdLE=k6y>Z0_5qq&N&q6z;{p|2HpGE^k$e@nnXWe z0CFaS$I^3X;9F67oIXv}tW46hSKl;q8#haOY)%(syxrntqDU&0YK6+G8gu_Z`Wy5v z(NQElWQ#l-_%rFQzn@*8tvF3(wMO0@ageev65XO}fz{;cyb?QwU_I9}q%8F?jmmDm z1k|Go-y3B@j#r}&_EJ~d>~?kzG<4{o^vFS+o7@hW(zOoQ55Z#u6oPaY$fT|bfuo$< z>`{w=+E`m8!4>1AHwUl*|3!3eE*{S4(RO|A^&s5LKUJ$&11L}PJFbaO z!Cxw>JItkq<8e?CN41>R+Dm>-tY_S-AMCIUwPpo#_t_u9OVfENQ}wLv2Y)??426B6 zU4KKT5UhSY1Flt)pwuI`k?ohPpNSB=ya)^c=~7452jt(iFmU-UWhS@RU-NF1&_;~c zG5J81m)nF}q%yOJU}dKv2UXa(NniSaPgTi%dM#b_$MlL)aEyAh=fqa)m)bVhXuETofvd#mf>O=V zqx<_y6g}UUVW{vE6^9}=%OfYhkJszn0TO*K8rP*ZuRcC?(z1x-Kvgv^%(80jVK^&D zCO-PqY{sLpOIwxJjBby-{at9yJk^hd;rX-jf|mKw2mOi9WJ;;{9HaBo1IXFBp}93T zH5*akfuvSdOB~Go=E+f0*?KEQl^7)b$;2})-5~`zXWeV5NfYvNR`usXe-wm5##&S@ zON#-kNWy3(9A1h|7dTy-aa9d_3t8u_PvSrZQ&2L|Ju3vC4f*wF*jLx9x}e?5^h=C+ zNPvQN)*&U68=p@6iHOOH^WPt$rdxOV#CKG15hIw9O4@)nEVTAswX5*;@xj19m6KNp z^#zUg=AFfuM~aga8?c4?e~Q9RC-!3$`hKIr^vpxz%#hYqxx5TirH>epk=r!JSal(G zqp8j!Wu0XU7z$9xG-u#~5~d`rSLBd!M3g;K(kxAXf%T5|BOZ?>Pz0jqC2^T3xMiJc zt^Ul2DpVP=VGMj|s|T4Ox4`ip!uBEv>)pfpT~#j9{61beWo*PNaUEQP;`&vqqv6!n zC+EC2CQQ7h(U-3YnxjX})FnoE6{5nE_=Qr)>3YM9vck*QvvI>~NI5qMQX7`<_fw6N4kd5!dMCe09NZGi&^1lrhtoGmZW0iv&W zA{_<)&h0WoVYqcM{d>eep=?uMwDFw(n%kJfpUdKVbQQhWYijt>D#M-pJ}0=m*4J1> zLGHfzc+}xAsP4ml0}&VBkQ?N_uoyeod20H12*`HbLZMu_-i$B|xoK;rW(b-GWF>N@ zMhWt#*>^x9gZNXf&*L-RkhYiO9=E=s4At63Na$WBU{wJM8E7(*Uj)N2JL07dU2Lo4 zYnOC4VdNK|aV0Y7IB+tdXA=@jL0AmwnA_K)q>`)$?P$3fToPd7#qMR{8V0A#CQ8yx zS*9$4zbj+1)J^e6EhD!UL5SvGsn*Ld?mTb&8IAQb|GCFk7f=t;wJR3)5-34!>iim6k8QzK%$dtu>VlmPDcI%iEofXEbl~!A19rJ<@Zi zN)?adMBSU93;a=-u}QzkBhZY4W<)-mnjY>jK+Gd!&8bOWIGnVhPt5D`6i0y+L$-zM z{YGRs669kaWH^jO!2UUK{WU}LgMb1bjU+Y>X?QS{fQF7o|7|zvzo|!YB4THi1CUEe_SIMC&y`d$tx?+wp$U0y7@8^i9OpuV1rTr7nTTi;StO3oQab zrO0Nx9m&?*Lx_B25+RPO8+DU(|>@x9GgdL16xP5c~K{`0(x&4R6#Dd4~P?FE27`p{L z#>1Syh~!NnRz}=b(M-pToQosOohiF{WNgYHdLna=+N7!^M(X***3MW?N)6W5QQ^^3 zJi=<=C$DoXAFpyZMSq{>2XgRLnhqm%7P1Cf{_e^X58eU|W#W6$end-4@%v+HN}Qd08eFl}{O1Z!iTdiHL${6kZCY5jA^QHYo4)lYh8a_TwB8;VQ{zq07@uK^&jYDV++ z2r~%qc}1h!`{uepJ#jcoRl93MCRHvqVB&rzel}nN{bCM{@Z`SKRuY@#cAwbEUZ+*ERy? zN%6GM9OO&o*m-Euy)Lk~4V>g8gye@cD%N`B)^gBMS3pd@faJBsiG$j*V{kCdxorD) zlZes9yGHq35JbEde6OlyjY|bsBXWcOCr;s=N3N-ROPx_~)YC7^1+KS z;kaxJT8*9_5#OTI@Qu%HpJfo=BjeE=*SAgP58R(-ohVkxo$&0D22OSG&`{JdkC{7L zDtGGPyu8{Hb6RSgsK}wbyzRn&ja6UZ_&?Lv*in%%Q|c-#80f8LwA8Dt#s7Ldf8E51 ziW(`-TmmPFdE{A}ooJ~&aWt>gRqpK)PJq!Do4+Q!*1uu~@x6tIki9HT{H*ZeiPFvjr1uT zRjH$FP$+kA7$)j>jv7p8-eC7`Qa=p#>>Z0Ygw=rk1SJMbf~?mchf&9CSSNSbr#IO9 zS5)q*5lWrTVc74(1hL&*pMzi5!+U%A`2^iwcM}VP zEAqF`sRXK-dVBKSKRzfYeTh*x`94pd20;1335v>BxaZsl?7=5oS#W$9x&j_K~qI=+4F*#?dAZnPmy61QLZ zT;C#`YNp#s_B+$jSmyItgZ2Oa(R>C9^^ z8XYq#mF7jbjGT|i^_M_w#oQ(2B$;Udd)OIo@bih^;%%r|puLG^B<8jYTm*^`zySan zUKpjcIU++lm?r5Cbz~K8c6^VhS+iO=8Lc{b@iT7}M@FCvUcRT?gk%M(FU?8Uc2>kHiWN<3=tL6RWej)v?`Mk0UqHbof zg&0|`MXBwU2FwW3OFkVND{i(%t5nIyDjZZ}U)1#sqO{Sl4<4}-FuFPd*tL)Vd-nU2 zRZvK0&qcQ=oU{3W zA>@?I2>U4L^$_&Sv^O&VOtW$?rf~_%+T@N-Is_;{+kF88!e2TMo1Y#?JDzem0(?Sl zMGsPVqh-I-E&pv(_(vUE-#LbVWq|px0$i4*XlxK>ho%9S;p9Z4#0{ognzhj4cJpI@ zS6)3B0W2sh3Mw5@sA1)P@2Of67>2_uvAu=+tDMQ%lct&;y8tS<-0s$l=Q4~&K-u3N znmJ&*ZyJJK-409n&BKtd2lT>ac)i8bd2i*@Ka_FJXq$GEdZ0!XI*4&)e_e75%e1x0 z0ZTUDvafVpRopR2=18%;`j?{3#NNIdwTioW^>j9Lv}%T|Cq?~ zQuR0k|JU_N8#oK!=ppx1oz$o&f|*=SnzR74 z3w%;ahNag~em`rB(b zD&8citw*5Bn=a)N&2G@ExZ>kDww%f33URQ^qqcZ7cn*jTB)4|U-97L2g)b>B5HRL3 z%s;q!K#6Sc_ql{94@40s`hUmhMF?amzng^3JZDoiY$=#Zs4rtsE1hhHLX`C4(HPvE z*NAR=xSDXzPHIEH;+YtTAq*q&2ySZIs6?XT;L=y zYX`AGQ=ttS*#$9n3Qcz=R~Gt*_^3ATKIOr2~A`?&{8BZ{GXIJhbmW_8a5 zBp2O+Kd_VgI`}Ac;Z_1x+GbubMqUaHpsPPp5^Bf!8<)9yYS}2h<%2CL6;?Tp(tS^B z;K$q~*lF-9Sx&SVNjvWU$WgD4wqDf@$%M}6`s=0*@rW-AcXf~@mOHnOEn)$+;T~R04QQ;>}ya^(8{!m$y5Ick;4dOpU>kb{^;-VilJBawq7RocN2?ZEy*k$ zjQLPdYxvWbi35w&@8)b(k>Wr>-I5gxx|n#)S}jIB3!jNt*X4r<`)|kP>m@-w@YLN zJ!zDB!A5zsRhZcD9#~Z#Upfpkn*GCC3YawHVg|ef@4?IsCe%-;J`qzGc|0)t*te0L z8l^_tT(bEfxtRx}e~4?7S*sonq0rlB6z)4mB3YHxLs5ZH-EhU9JQnA=PxN6t^7wLz(GH6@g~hEV zyMv5}0vDJLD+v+}MHcS2m4>gIy2kmKP$n14mcAW;{W%63twP# z@KNa_KNhYX@3%@f>y8JzKqx+7=tDFR>>sz!)V~=T_kcLaS;b}Ue0U50C!-AyFjr-K zTuk%-N=spEDNaUQl;B?=3)(IoLahBT)CE|o^IMYfs)8-?K3&f& z8BJBvHF;-64>}vB5TgzZX6(_pL?bEs{cYLqsHLfR`TJo5?BykU5jEtL&yCQeWQ~L? zM>IttTj+rcV3Zj3(rFx~q_a<`*EGPQn0h2NyMe?tafv8{mV=a>rHq)qjI};Jk+bD< zR)uzyv?PeZ62iovUakV7z$V?1#&kWf1g)Yvj|m}RdQE10{-tw6*pvH>|OUWPA&JNF0TZ^q`gkzBJ0n-U3g%*;l)~aE_1O=kao-nzk_DPCV zXw!eAC6R)MQo6*w6-_l!U97zL_>eNBl1K=?QwLuicImm&?_Sp7xM~xfLpLmA?Ol+5 z=G)^r_0W&2(8FLz`CtR_BTRaV^WAs!!{^7@g{Vr~z$1A2pVyP?Ga>n@&frJ52=pL4 z_D0?2Xr9O4m;E@JUf7pGWUVkwEvM@<_ZIQF=8YwJg?b!z&kpcZjD%~`!q-G2#Y;4V zC@2Nd*Qw2dM2u5`yVy4)uO%U0UvLc&^djMvoL}jlh#^X}#GubP!SzVqL+kJbH+`0% zOgLj}IQN>g8z(&mc*V$+;hto)OhIeZs}aIbZ8LH|8b7dlBt83k~YAT*Y!{%L%{=8ac?RI=5cWC!O3 z*LXMPiHHda^QhvY%n}X)W94uCW9ZG-JhgG`_1q3;Gt5tviy}L8ulE{?nMdEnHb+PG zuU6DOL_)H?8I8b*1Jq`;!Dixy&90* zhuHVKq)6UuUcbltf*;W?!hbt$3Vv)ph~qZeEwPyI+hrUToD4yPqPN`ds5KWx3pkr= z(GdiQ*?h|cSvhDiYWP)(lI-NY3+f@m>&MV_goUZyG$e^peS-IgmzDu1ym74S8~jw6TX9f<-jijj&1r^5aO=FflH%KUB}+HHk;8uvG1x=xVlu>#GZ~6MjVYRWU;7|8m%JqX1)*dW|Vz|mWXYS zSrSg?k@6T117y-8d*Vk!FFf3>XAI%1rEW$yjxQx#8ehEdP3KAP^)f%Q02v-1DgqPd zh}RRd%FA(NYu3GNozL&4dU=M%k8yS}_F8`WQ-oMMt+5AYZ*_P*02|9^&r*8oyZjko zA+t3QfeZH875M7t2=F>%%zb0}JDs+VNtc?e4OZinBQ+`ATkWD#o6e=2x9^lDNhA2A zfX*(IE5DjhC;ZL9&1A*G^(uz~&-kHBRW>7Jzf5?iu_&nP#I^m3WB3ty!~g4XHBtBz zc(E2vSq8h?6rSHhG}2ruoN95503bQFzG*w?xChWBBzkSYpTTE}t+MM(z?;9|p4)Pp zVb%TiJpU=teq}brivzOEis_P~6Ip=v*3YDK>DqO3sN?B z<^iNxQ8MLZV3YSXRMU);$rW4)KRT-Y?Z4qu=@k9qrvJ%2(*S^V0wrt`eC#qwue&3Y zC}gg@3@=qils4oa4irPgXTvP~h%86*l|j)dLbMeJ$RdLl@n5!ws__~1JIYqEiNjOd zrMb$L${ zoVI+UN31)9Kl?oVTU-k+|BMOwYUU&LZG8NqaOa?F2k@>*c^|bh5#Suq7JL_9A)*;_DC+zCH(|(igspD3(vm_>+ z>xtI+4(&I#mko5S8t>2kp>^Cdvzpv2_}Ussb{cbM^SELBKfP~N%xX%hDa}SxxLHL2 z%j62Q)~?#-U%R4@n|od<(yOp?;CMSkkYA^R zy0e)Qndn%u9E|2XX4P)4d$qyoGxzk+mQPCPE(a>Xixh#>9x$wfEdwh`l;;KC6+)x(VsNQevt2_spM(@ewdSfIRdTok?zY+Be*Y= zQ}P5ik27~Qz${cCr-7zm>ovt#8J{vczkPW_`*I|FGLlT4qsVlR`^#^Og&<`q;j8&7 z4`MLVc&2`~M|wX#KbObH)AzHx`lq;*FU%0V&Ey*1+sFc+-Fjh5^um_-Hnx>Ei{Ho< zH1W1x7EP!ds&Jb>mR9!p1|lN);?IjXE>KfN>bOHr`En%-+T|NAQ8Ptu-C&lvAt>XI zbs4=8)`MaMI8bO0$gBrwnAa&ySCfR@C-v7gFHOxf+|h#aIbeu`F}? zT0Jet2Q3;DqcEGhW>4ZgUBcH<7^6u(s=+e25O}swCD_Z@m%SluY7iWDEnOO7^tSce zq^F}xVnzSZz~(sNs~s!F3&J3)>St*er%16vo>O#EP)^<<8n^^Ed*JK1uQ4h5Ei>1{ zTuje%EkE9Qi&ts(C?wa$-?m=%W$BxC(>gL97Z#@H>-HGejgS9%ugAz?u%=12*HCpjT77@xVyW%1=rvZ+}+(hxVyW%yVJ<-_j||pAA9d}F3vbNJ!)0e znyYWRR&~wa^GqZbJg$CJjh`pV>P=X}c)HFW=hTBmenEiOuK4tW46XB;qYg)fYF!$+1B(tn|x&Ab2qP?hR)J4f$Js$u5e%v!tXl zyeVHcD$Bp@Ey7=^l3wp650ewKA<`l8phT8CX)v!03Ya{Nn6okx=8(ISY#-v#an zeezh2FRt#n|EvwAZQ8i6{iH)TR|S4KDE*0lZuoRUm^cU>!sX$#RssL*=W>st^y<90 zJyi*w6&E^M*qRw5hRi_}E7z%CJ@EwnHO}U49`M62>{4dH<%fET^|xvv01pjcPA$oXU^_pt~6b@2HGiL*G3;ehdBC+#e6z7@98AN5O8 zC085Bb>HEB>i7*eQx9({pR=nb!T8?m0&k6 z92c15N1Vw%K-l=ww2#2Xv#O3o)QKR~x|>h1z@rjH`!elzZ;s$3;xXA~qEOoezM|)SUX-!C ztWU-3LO(mH@)UhXIgUZO-GCo2k^+uVVqObG9b9i$8uL9>_%tKA`5y>Yk(XTY_ma22 z|F47`Qh2NhjWRj5qQHT+Lby-~>tHe@n@mz7H`)e;094T;<%p}W)Fq$wm1Ex^{;$p9 zyGQ<*-n(@se4Nc`IWaK#11}t%%8xoN8i=Lmk87xoz~j7YcKpAyDf3}irR2gvXv&bD z7Khq5a^BNSAeaye;muVG@Ju=%XZW44<|JHGQ zC@LqM2ZnO5Zo7Rsr3w5_2&UPCP%&nDg;}$vbUggSz-}Ol3b-=+vRhfjFl~9f>q$aP zfqfp_7$q}613K6IgZy4HHVLaazm*jit=rp&%Dydy)Coh}k6oK9V>dTk$uod(-()0g ze~8BUdy^23PNh_xS~@ooP3QX3G|2pkL*j`Q0JZWbYK|4bhNh&9XqNq{x9iI^EYFw- z?xR8UG3#XeBnm7!+g;@*DjqSEb`EYk{Y24To88TEH-Tn1H2MSsm9QsJkO$VxjKx1d z1pl=-B`1Af5@aWN{C9XedP6w8fxtK2=||)I#Lww3-+Tn;!gsMWZxqO!Ma>~CG|7;* zgpUwN#04@ryC{S)QKHmh5f!d7dZh}s+sA(dOl#2av0qAR2-9VoV$4h(HC!(X1P7w34F|mv#Y z_ktO^I{w{v$gME==iqz`E>FZ%E3`~a4SOrpGEhe|jW3>l@NKRF^*|{3#mH$nksXc2 zwB5n@*QE;sIlAZL8dSkD%dEbB{apkOFr*4xGZe(%ZP&FZu1l2tZ}=T%kCQaHyNDbl z`x`3kR!0nDxlEx`lOskby%aK$8-0M2~-gQf$7lC zppEx}-V+i{6|$aO91d%JTllpDL>DI^Ur44e9WU#o@l18@oL-M|(8E5ftzV=9^qJtn z(yNhD54!2X|H1D#Nyl)TB5+Y_kn9=dA%mqt7~8Ug*1o1$ssqjBHE-VI!mnZ#|3bp% z8kbETn@69@A$&h{Lmd(o4lVFM^c}?TZI#m8|9AH8=fCV7GPD+lf%2kN==|_A)|DwO<8M*mhq;QN^gEvM{b>p{ubD z5$IdSyCEZZqexwJ10}xI0nf%mb!eGV!zKM{7wv@EC)AV0nv8ggA;@Qpm+F? z5&yyK;bzvT{EchUoLOmYp|Q-{TGSu?0@=ha3CYN^*|q>JN}uPe&m}p{BMA3 zL^R*?dn0ofGoLA@(-_P_!R}UI@DDPd6vnrgFcpI^uScR zQqn+`i}W@S8Q@NuIDUqoRFNa#C(lL@f-^NOGLZQ`!B2K`);rIF2K*r zTXFFpR`28GUslh~r=EzpNgtf|f%_mfZyk zo#Rap6y-Ise&ilS>*q=}A%uQ*|4v{dX&=XpmiO3w9(p*z&x5C%AHxq(58Z5PqqFWG zm^|RN!)?PB_8_kV=%L^0=Z%)8Rm?Exg}{cmzt##ows;*1Pg-HYT&plW%)^ z*oC}4OmEi~{^`-5!l#cCd_kcZC*qdS^}-u$5CvKzw8o8%Pj6Aafo@(H61t zQoX7B@%DOeXI4!e0*s_AM?Dl}LjK1VFMJDbP~)G&7iZBIQnH~&R&z1 zl>+olmsI0bxZ~%B+za%>rzZHSYGNR?iw%{I`@`iq`Y2sEx`Ay@QC10KulZr`taIg( z*|~CMERU{*g*t@{xj^R3JeMZXE5AE?;3u~}kBpSnI7g|U4nDT#2S?gh$1G^XQjuUB zUpwd1MOY}devXn2Y8jPVNjj5WM+F9GTKB{X^~oi=850fcQq zBsBGoTg6bF5gdBZzj`HHB}Av&w-r4;U_gTC-3YE~6OPD>lS=lW59)Sp{8l< zlYzk8sOxm#YICFGRC?>Bkkvw2wlT}?TkjTZa&nTLGZJ7`n!YW24+j|MZLAkC0yHZ_ zU?;nw*?g**E#m6>)^O_!BEmcE)GBAK88Xqx_*C;6%FMNQ0(}}_{9XUVxORUR5aHL4 zuw`D{!)F4f+BKGLwnc26&||6b!{(3qpMjEyCTB&KfEt5R(}pbZXMKt%$vByDIVWPn zTTZScu+M zIj?B$tdLZ>-slIzagbz3ExKJrKOXJPpyc2GHeGp)$T!u)I8=9|65XF86WxQ%{xfBr zMRoTgZSFrKyu;5!|GDD{)CtNCr=jwy?*5ZVuILAH{6xX0y>aCQMcJ5A4_kTyg#fjq zK~YF~OEMBluX+J{_9LmroOWFkn=!G&N@RLTGe)U<}l~J=8FQoN~|f9U6fgiq!Xyb z%I6>)elh%H0_&_LtZcJ@6jD?y<@57Hp#4NGi~yA=_r?yh!?sw?PyGwF(NW~ZS0$Ap`&Sw3CUB^uV!;mCD)DW~eD ztkqMYA9RMF%4^0Q{?kZk4|4qK8O&Ju+Cg89&;#to#|4SbmamT%>l-V~D0$)eDj&}S z&N%i=Gt=xI%lsD0@S4(f8G4~d&&SIlt7|aZhx1h-<6VTz(d%vDDh$#K6(Fs)@(T$_NEWXC z5q}qx<9n;U6z-e3l6HbDr8Td2%s(_?D~_^*PA;=JM%kyFFatoLMM; zqeg4*)_cN|C-g~775Ogm5MYBm3xt^2c$w1Nyp}E*RWNSr3b=-NlOk3)1ut!BwUrA= z`O0O3(if)3{G9l#&f8+}CEy}2frA-C%E1&ps|TK7SA(k~@awrjDT~p9rzeWV?67B2 zuCeDxA;dkV>NCnWX9caV3fGFLE2(a3`AA$#TuuvKD{TbDXPYJWQb?-bnNtzh}r1`L!;d>NOsSguqq?PTlsV{l|?cL|s;V%vcZ>6|e3 zHl=l7BLhb#laZTM#Qs5mO-mvPOj>a3C^G1Q&d3x!suwvOiz_cfl5L>uW&4w5V@|MXC_bOMVwM^=Ib9wvriHwKjq_*wA`&BqD@*?V6 z3-^@{+Gh)YOcQ@>lM$&|$bNN4wF-7qb>X06W;jm!HL;zeIcovh_UpAGqm+b7oY@N3 z^j66vOO(qqvA$vm6Tsb6sPiXs4u|e|$YFXd`m`m1UBv*0K5e?222Da$27{eASdLPm z?6-{+V}m9aaXy?c9-iP-QCk6spWc?&M7t@CXr|3z)-uxEzZI{QX&v!9wigiQaGY$b zM8mu6M~yLVVWygi9H!E%gO zzZ%H?@Y8u$9x;e^VNsk0&K9dsLWBmhBf%G2@0i=?9zUf-`1N@OU|+FiX`(UW7wElN zpwJ49H~=XkHkRh0=yyU@S=23INh*0QrcsZ-p|G{!6uYvJtnqs~EF)6Lcq^Gx4`HzU zuu3@%-sE)Frny4BEI15|O~ecg`06sXc_+wEZ;R@%US)sa(4C`G6GC3 z^#mQ~B#3%KIulggcRHS;gLYscS^(^~*In3_y@;W$Pd@|S>I4xPS|>*yJ{4-GFRMRl z+3F*qi)w@i*iPMk-Y#`@3kGG@c$KhlLAzebIS=c;-%6%Xu)TQ+rTv}xLuf=Ot&?x& z;mtrWT6JL=zo9Hperf9f2h|{~tI9syUBMU~b&w=Q@K1@$CTDK^Mv>%~mUfL$=-CX2!-a4j?~L|#pd12;?x#2W2n`ML8$+eF7)`9E+nfUrd9{h zg;XE^(1q*&zv)80{;Lgd5dLuku2U`*mn?{cTrD5kpIG!>EwBhdw1(OJp~c7Y{r^G> zb2tUZWA)RA4CAHcC!m;ofbAvAGV$V5J^n`oPm;wX66pR7J8*4k>MszO-tfr_C|;&w zxIUB=P5A^_7wJW@0Xl@ails^0{8=@M#!M!L6{7s@Vt_tkZF+urU!z^@rQ(P78Oy{< zyi7a)3_V=e>s32y9Iy|ih)PI&E2mjT8hd(`Q=05^h}fS%r=52+Szt&wf9mgyFurw^ zaJI4Gq6?MfU)?9=UPGe#S2G3Ix|bH1Z4;S-38o;eoZ)5>g2 zA2QBPJnBFK@viKFS2wa^ov3paFULC3DCl^^#2$xQL#5gQDkV5g>L-ViI`QbuNhb3D}GZ*|Dw$eI^cC2-}GE2$q^KOmV zak_xA4cjH|Arl810J>{WE$pEJ`Sl}vR}_ul*~)3NZ0tj!Ia)-6XQIQ!^s&2kx9YqZ zhQV);C*GQ(erb1_3wUWU57$R;j;LS?A<|B%FxaL85huRt`6B&7Q1~o$n-858bo51I zf1+v|nG`l~d`Vs_2TL1&J1FHE%=2tty+$5M-BZ~q@_RYNcc!wUCDO?=RaIJZM6}?i zrJsv_E>yw(>P?1ubS@{ij^5L>2sQKY5)v3q;+bpN$TBHU^Q^<+WLD>y7!kn|U@CMx zzmGY1C9f2drh0f=91W5SO}f3u%D0m;Qe3dpr}lbSUeO60H@JYujx;^IK5{=TX(5 z@bIrXOj@2^$}a%B#Riy!S@kqAkRzV8+PQfmvsHxIW^EdFDp*j?_81FF^Sl&?xi7l~ z#j2~ilYSY-XF6;gUx}WS0E)&G6XkmwVa-k!5$(MIZh!E}TxFc0> z=5d=DZ8~y8H@1MgX-#2dl%h{p|K%jCu>;3owGfByNkcvq$~m6ks!8eO^Q7c=SAZG3 zoa!Ikek`do^j8>_fa0^#Qg@RHa|N!gbUh+T%cN^BTu<9xba@d}BF(k{2|nzA#@2rr&G5p32!$$hM;ZWM2tBX zY`^0^8L2F#c)?XolT~5r+AwM-t2MUcV^pSiy}op^pAiIR8q(*kXlbObYnDjIyu&vX z>BlTw5oYr>#kDM8_RmjlLylhrAWJ-9L!o?{+dNGU&Yb{yV+)!jWAu5!Z*03U-Pn|> z5VK7(tynC!g31VsY6>{x{sNTy$eF;IS zAokb}6Uc~2rE?`;CQ1Vr-5iYeDrX%E!5l(#P z4uavG8wY&;VA}1m_HWGBh23_qLz^SCm#52gLul+=cQ(}JlJ|gWRyY}?+cts6^FSKwCX_YOcC$0pLmU0Z(V3N6T0aT zt>CCQk89P6ilruXWeaTV6jt&X_p_(ZqB<{!yxd>21aQH_BQc6L zF=l@p~OJiI#MYPkrqtko44$MrH_gqzQQVpGzFbZBnu{X@AWc_8J8S=a*&CSrnjO3d648c@tCjiYxPK*Me zb_RqU$YFE2R0rOJKX@kJ${5Jyy7CG5AsNZ@H#lA0QUcR|3-0K}vfs_skbm3MuY!6T zMrtU(a*vND9MFY#1A`F3H4C2jMxnQy>74z2j@QfK*_`JKcJ(~8o)~M_x_X}s32{jb z8_f3B3Aj}V$PZ5>To!sOYqXH+nV#gu;Trre`}AMim$VzjB^sBk`oV=4QzH_)#=MAv zB0XPh4mb#aV(n4=(NtCzRY0w6XkK#^Rd4%;dH&-?EKJl}l#?CnMojlBco)grX;T84 z$$?G$KB>HCB^&zpQhYZ$L}rydm?$|Ou;|hwl))$by@0Vr_qyGMTH*Q-Xfenwi*X|T%-IsPVi5rXGyAqX(m!mM7!`26rjS>Yc-ZX2kSwLuNCUOqwi zz0~;F7brvoz^CH(ZNJ-ozCJS;%3M;3+Q8zc(6HH`FuLhepJ^pQPhj+7r z>G1ZIFW9s7o&UG@2uTf2BKjqlm;)IvPf;tzQvRMXj83Sy4K@Y?`U-?Re2Ca54~g zqGoPU1-f?kA>Ez_m=~kP9EjmcGvcr7?fD9g9M83Q#0l|M#OSN0PbC z^9cV=y<2WUYt!>#r>?y9|K%k`=GeMmE1EdZm69vD!H0=Vz_5+fF0;s;D}A3F>D)%W z>2#g7chZ&KfUa_8i09s#^OWm_85b`8^RaR8RW}b_TLUQjR5+>gQH+pAn*SaQpI%rK zg5pSK5>Y%I&vw{@t#2L0bTo?%ric5|BV?A^89e&s%@D=32#aXf>A0Z^&7<>$||&}(mnCq;+uZSgE1W!4xUGU&hmx@Sg*f) z{9$~3Jbix-$@XZ9f0b~!+y!;q@A`qXB%)EaBo3r21<6?oIdR3eY+q=FP zv4{}lw}TS0FL~^7mEUN=1ewm-)_`YTiiQNnDoY(|AMq-KhgUO5<(64boJY;b$04lL zP;vRqaD$A<`*P>RcpZN>a>Dvu=hTnn{id@(RfB_Cy)v1Pz;5>oaVA!7SEHPaOI_tX z7eLGHWE`8@!osQk+BROSyOHVY9F}G9H;9a5?;S@aZW5D0nA@w4j`s0le~-!jaKATz`Me1M_4wZKzui1PgD{Y*O)n=GhsSuH zj{|X)qowCLfH;46eRilwbWGRl`=-H0evmckz|;i}t*8RRp5LpeQ3hMOWz>&MfznsP z-9JC}&XRtVR4h7gTT|Nw-Rgwvny#nFe%VpI9JtIt96Xcc7*UK=6Qo5QrggzV-oakw zUlCrdOHwp4j8YPHn}hp6XAaGY?a@_}u6J&Y33ss{(tyzL+$?ch@z@!9+RP{Db3B=P zjJtdls7{8>c^4dIP0!MJFhu$tq?0u{J6uD%(pg&ulId4A9}5*Pa;4QAf_a1_Ol46x zU&BKor>U5LD1zDt%^&kWQGtI{wk-Objh7Db9s4!C7JS1LuPTrdgqZajS(|G)^peDmEsO7|Q5#evgAuwH_WUcr zGmG-Vj#;42R5t{(H{#2jqE?~h;3oC7{$@Cyg6tc%-Wq?K`NwZe&eHqI=AWX9WJOm) z(z<-sbjQEJDP0GBwhQMQ9k?`?p$ad5-XkY~+aI)i890QLNo|NZd&OFodT7}B3UFg) z@}v$|Tz@7`;+r67FGUrP{9;XMcAK#V<=dG||9bGrO*~58#b_&UUD_tzp6uVC5>t)STj(~)FBC-;c%;1C12+B zj=q6CVvy-?!5?k}9)7DNA{So|B~VEDs4tp(JoI=ugk)@U4sNv1m!cC{{K&qV7^+xL zlKgfT#ml@;>bA`5gpY|J4j-<&MgnF4(2L=N>lH4hkHX;&))Q!qUZBeX+wc)n?MD_m zzHGS4>hwOK#hfl<++e3J8Fm%hDt>RtaKD*KGedRgps{jbl-@Q9%#8I)CnZh*-a@XcWj{#oU_`?r({Suy49;I^i!h?`%8| zedzlG;I0?^{7#m;i(XvWrn9RogkchWfb6FOm@*Lt?OMibP%_zA8%~0ZU-z~0 z5=))Fso9!*kqkj8gC>z*mav1x>>;c}lJL*GDsS9vm41`VGVOG_g8}mgp7J4|_i-^# zosG(R0KPnapTw|sOCccTyDb=9l%}2G#qh4GR4F|>2zP+-^@aybF1I$mDD}Aq?vc?Z zOf|-RRsdtE$UyZCcO5nyU%U&oo#nO-HwH`?#N>4$#VsnWC2 z|KsA??A!0~vPn=SZ3kRR?E}i-rq4hTx=_CFIU5yg3)cT!fCB%O4kZJrFhD4%(z zSvWiqT0&i^miH4nfZx%w;?y1&7@LwTkXf+PwD}g^nB76L4 zH+b~koeXNI`F*IuPG1kLlB9&~_}s!$6(kr%tr?&QMYF>@h~!s}{prkwb;9)R@!BF1 z2U|PQs6|Pwvu!q}*&ralBp(#5O4A`M?}T4PvX_X`y9|PM)QIw^@`LTpuA!jqW)xMf z@Fb>B+Dj2$tdP}}P}y3e`ja_H$KE&*Dxout0biN-p)OXK{lTvuxmT)^`KSE~j#q0gFf2pjRG0K`^?}3$JIN zy@}|xLJWv=-U3^t?;MyNCe|9KZP%k>S_eCc->fA%k^}v-{6Cg2?Qye^F7anh9ZDM& z$92bpb%Y8lu%5k{FiWJqlKmtyHXMn60B197C*9fPL^O_mCw7RWe}>Xm_OmLS!U<8W zalm*aG>zF04x>Hb?M>2qJBTQi`|B^b3AAUYK74`;b#@)637N&Lxym79^=(O>VB2fy z>+*eq_3$EVfu?_f)nqJ9azK6$9J`FT96t&8tOsc}wb>Qrq!e-Jy0kC_%*}@uHJ^Gk z@`;*~rbmwSydLq_4==7XQ9R@n?}|um)57p#*{WEu9~wgTg^Dj;SsCuVFB_)cAG@O) zE@gY5(lYS&JFruHx+;FH6mO4?f~*ceB2zD?zQ>%L&)Y9Gk7--z_Z&b%kmN$QFEbE< z9^s4dC+;Tjvqy46?37MtqUF4ESd~kv$7=hsoO0Y4TyIZ1HM-tq)i$@GCo~-j#wpE$buAYL8-oo`E}0(k zXvnB~WV;XrddWbFUYp?g620&h|egPP6EI8CEjaQ%%A=-Fc z{fU^;K6a*MO9p=oI>48gB-(uMR0>liTqJlNFm|$y>M*4d$2%&+{@7k8Fp>vPFg2`2 zg;(YcHzapdxUCq=k>1eS9G^g>b&&MbW2|I5f__ATppG3y-+nMr=a~_{+s^c;c6kuP zWt2c+JV4k$fNiHk{#+(-MgRPt8^Sm31*X#g&OfP|^-!8G2BwD`vqiu~cei zexq1ZKi-97{_1J5fA=nu06ah<@Nw06%et43?v3(1!Q+ITj}7*3C2JmavqP z>KPT!&24z&{Qb91sGK_okV0li*|Ll@zxDblraM@edt5i@vTVm1E5 zD@xZH{{8I5&W>AVpl;jykuhb=B|i@oVP~NDQ+1!x?#>4D#c`k4FPLi5zmG$ssj24J z#cN4+{BxXF_?;sJNNn09kT}4WeVT=rMf1u67&+mZu^oqE!jmm7Ew6AIDd{xq=a#%1 zDZM~5>9j-joboUFnuc%O&(^z5is<-xy+?(U5+fQL^K6-%e@Xd&N*#_&){>An+TG^5 z)G~?NGxIHQEJcUO~W1g`Z?wL%f~kN0PYOku zvs8?2Z)AREwcKOXWdSP}_(=%XZX<{MN?lzjsiW0vPYl=JQF_`SaYcRKoRJIxfib~c zL+yXO=y1th29@TXqB9vj<&w6UTUWHNitCe;-hAi@Z6*&M{bv@>SNuDE1vPmGV0VAI zR-!neUKabiR*i~+(0;?uRll4pc%_O{69|1iHv+&> zL%a1VHA)xTZ4xW7zDHDp(+cq6PFuCrc_H=D-ik@5w4jY1WLED0Dt;5I#4S);!}SP) zPsB<;l+)7p!=O7Lxftn(mUQ%pu197IDB%R56FBYi~#IGm`(c$8rt2-v5bDpab!M!ZormJ=?l@_$shUscO?A1N643)N(0ao2MOLvvGm594dnCSPS}WKG^i)S>oO1q=SVKrLGRA3J$EJF-uh{8d*MWT2=W14nL(Bw`93o9PfDWM z$kNPF`W{CBL%eCBXby$l!W0tEPX&%_R@TQBFtQekxg_D*+z~uqx0+@17jh_}0hN0R z?cD^W6Kpcu7;EoX!*{I{&owwMLYBp%ZeUFN0Dd36Mp!D7^EM>+ecGZ&5iC&F7V9gP%NRvAkP&-mTJL^@w^<{6{P@};)r z(x7E+dC$toT7VGQGrF*QXqnvGW%zgDLe>4;`#+c)p5xzgH&n)N}Lj#8-d0k#>|_!T&7l#iK8cT1X^uytxcW#)>pUV zL064GrXxYYz@fOm)j!&6zldHlutZ5^@#nzl=UqCCj{GvvAOFz>HN=q~>K_{cjaLTO2Bde>oD17FZI zP)4xBOq|@nGv#%~`pTm0sC2S*eXXFSn8HWFY$ffz{t)MsADgT2hGr@TrSsnRV`(LM zBJ_jHDkn~V<%5fbW8_>a1pjYx4QWmNz6qjRj|TIz>{SYJ zIP3*UuC4d7D)lnEh1#>u>AjI|e~mLW(|F`%XgUm9{k67kbKQt_spZKw;ocMXc6M}! zP}HQ2o9>PVZ~n-yIWR`$LMo9Vlv99&qmab&_L||9K!31<|Gk;n} z4%8V_ILX{|mN+yT%jmF-D*r%@NIxp7Y8D@S#A@b@-``U8G)bs{n?LC2A+%1UwIV}Vmxeo9}nyHEFOF?xw z*3%uuGC?A@?rjdD21t_?S(2@ux&7VAJUH;~?;syB)jT23X*!u#V#ky_tyT(>!3R1q zBbM6U$=bz7F#57c zBr@3LGTh0j1TI?N&VrAck+kyc2b*k^u*BL^w1sL;TM~WfeRJ`Px+*(%e;C;OfUaR) zZ`l}df%O{{|MNoUOl>PN60L}&JP;*a1|k$cwOnxXXmyXoR0Y1T=Oi~om1NbDe#f`m zAL4VBK0|s*X|?Ic&n9@`B~b83I3ApFEJF;#V3XOvtzwAU!^_kcjBkn*`hIHu!4XuT zPMu`Gb@RcuZR0C&Tq23hH8=KPqJWUqIX|jQe$D35UfxaxWq(5JJ@&)2@v#*bF%!24 zBwJ2jg;W@fSA_h-=QG+0F+MJQ_L#xfLNDX%^$hW&&-P_?!XdD!czfhr7{m zd-6rA$MyAb;e+PEoOC;SiVcCH%C+8=x43F%&OpVzD%1Dd8p~@dZ^9sQqHe-(AUDMa zm)8+T& z_M?Q~rz;`#UCoFpsW=j(`MtPkyM96h`tt?0w40Kh%CM8?@J?!*B|UO9q|fp7N3Ihn zac`{O>VNw&F&yTCc$wMPFD>sRHpK2{!?hyZJ!nbP|H{r_-vDDMk=-O+D-KH(=e@+2 zdC*}?&#QeDU5MS$P+@f=`WHL(PbA8Qy=C^~{X<`>e2+3~#wb{!OY={cDk@1SAjqP; zH7zJI zF_I!2snrD^T3#r_kM>xOwP#sQ*C>lr!Lmya5YRxy7T|9ZLtp)`p-(de1;O4UTS#wY zwm3q*)<&$geL==L@SFrUx&O4#-uML2wiNjN-F7;Kd?1F#UWVs4?V7uhQYbD5eop>adkbNP~R&?Que!7-7po4UBOV6Ukl5%k<4V@%luNR1f1${Zqv(UgxCi5kjk%>x9fr@ zo5fW!r|gu@YE?A{J|tSErIdl9w!y9Wl)?EEjTmts{KD0I{D`5#ahL7G{TID0>DAQ^ zo)`VKive` zXp(xuc~xC7Tv*p9a^ipWyv4@iz|a2iwO7&Z3#Leg_UJE)3?kEf0=Iq|YgCA;EJ31a zEVc6}OOq$$*KXZnC0+yLsJJgDrvmg&lE<#XH^p#Q{6Iw zo9?*eAd4lsBHhsW&`mEY1=rTTYKXpC& zE(5GBIjGgckK&Ps&dJm47YtWg+M#ZdLSPD4!X}~V2FyOWi}-^pQdFa7??_W_nc9Pw zg(j<+;vCYH*{067WB9W9t^geKWm1=7md78*s@umeH`Y!+JuG|{b(q!TCM~<^S~UBL zV~HNnH+rgh%DGg|v^qZkMAml*196Jb(B7Y8s4pmWx_(^}C_@oMIxHF!%fDPCsJSDN81sCLvWXSS>!W%HVA)7w4&EI8&e=Tv}Yq|HjVW&TUi^TXNS z?n42v5XEq=>!r=j+j>xPfpA}6h?vQahWVQqGcp(VaVKZ2nh#$2+g4dIOrT(yi(e~I1CC)a z3`3It@aqMQX7MsWrVkBIk#3r=Sryg}GJumkv3VcAuYdcG9rRU<3t;1JAlhr5JtcI5 z;G8^AbNlh*K?<$ew zJxpOzHAR%!3X_+#Jk6-13cZ$&co*B2%pgR&|sggp<|rJw_93PkLuI zk@sZL`AThv3_>+M{%`rord2ztUc#-RD6C^U;u@kR0U<(@-lJ`g*BU&Xz_uJ_S&1lelbdqm8xxC z;EOPVMMb?0Bp;VMd2j;5Y~cj0xh3DM7%~F!P6jsgPL={kr*WVgxh+Vuad}!UVxG_k zCsq7~(8HICj1)7RHVO-RU0c{ek}est^|dI9Smoof?b{W=a=fQ)v0Z_xyYrRP1~_>B zCxiI&@;QT!VDId8IZkI6&~SHvl;BskdiyWdk^o@^v%I4_r8_oAMkvJRQc zY9gm_^bKyrcCFTGe(STQbm)=c+l$t^a$N%H*wMrCZ3RD*BT8~$aF!lz@b5O)MERaN z%g&lz+uwe@Gqg$WmU+){b5%ndvvuQiQ+0n)^}{64yeW!9?~{~GjW7C15eHV0a2=Vo z;z#W`O;sflY{kI!@K*+b80ZO1PI!iuQ&k7a>|bc}hzQ2d_BECH_%wuO^cB>sCt0e{ z(OX7Tb#)7GoFwqX!X=_)7C>1gX^t^H8l@F9Vr2RDFU6@d7-L^=Ffd2gCM}**fOcO# zxl9BF3JHTPDbdel7k-Ba5A*9h%7$Tuub`uAvPWMFVt4f>V-iX0KfpU*Xt+s`O^RQw z2Evq=EBaw0@X36)hFzLIj-E|}v<=e74celV-z41m;mk~5d~@6&ahTaSDT*6z9XIikgPxa7 zLnCbMLHUXdUw9t-Rj9^d!9m?24j61z5?XcYS+3lLvYc8+ zT#xdcrpldj*i1+Vfm7ZA6*Z(dM15*h%UDDTTai}NV0IXFyim4&%VBC7uenQD9t=h+ zy9%NoR_|bcW4SPeJB&TwRn|UAbkouWTYZM+jwq+(vYxiqyk{B^pS##44?mK32iAMQ zaEY{z4rPv83Hi#L&2lbSLe0E=)(6)>i=fZ#%E%pQyJ|MUnhGL`MYc>f5l})ycx56q zXC4T3dM@3t!MxcVBCK2?tuF|842=+wf8?FM=&W#=u;pyC+7_EyPNdVVsc#Zx3_GkM z)^N$SfZFk5t654hla|@|UjT+cdB1jL%j^vGG4p~Qh>z8u4kqm2I{6~3sJWI3M9G>aM~Ox648e`cBGG8y?gcU1sG$gX1CB(>_(`{gBLp<({2li zC?xPEIxk9{OXHye-SzCh4Jy7zy!w#Mw%-E&OWyZ^lRKU)H zH4A82JIj9*JSEQ#*b!nok%(HQArl_)x@pt_DagkJ1(p4O?7e$;>Il_3%;EV0 z|CKZJ>f38G(W6f$>>oj@#&xQ(s~u=31{Kuczt$B|nqs69>YiIwJk`(9ODr+ypIV}Z zIA0rBUQiwac}Ee7 zKVDtfZ&m-vr_E=Y4+#9)$NtP@qouJ~UauGjjdJxSyck)T)N5u&A2x<>WsLXR7tVGF zB)-eSc#QqJqb#uQxGi^})2##Y^m0o9Avr%oi@K1s4D59bT&b8DQlBkyonZEHgzqse@PrmrE|q3>G`2QCaGP>K z1kWEu=5|n9o!06D=>cptI#j9^qiaR|b-!#>+d#4{1^5wk)i`a* z-c!MU{NvR{@0!)?peE_-nw5HPqhza)U`*Zs}eG03Ll=Eq9S(sTI^MaIf^!mCbcmh5PM3XKCRG%kw4Cg?gf=1GIno=vM<&rhjPL#k4h-X} zIM!QteD&)5<(pUIMgF@ve;7$Vss$NQ8K%iZA@oF}y2K&WlvvKwT+DK=7Qbon@uSd% zGT<54anK;T73XrjJ<+r-3cX9RB4p^&Tm#XccD8Y9#>dks8&_y+(bhD~Aj++4Iqbsi z-M#vl2PEz04%7b7+RijjxA*4S|9Nnf01k%akU9+TUsGN|dqbax(J_%3EY)!>NHx|| z2ztjS*@|%00Y2o4Ow%{wicB}{gZ^=tL?ITf!|2<%mUErJt$T-Ph0JYC;8fk_8PvCr zyc6*dmEj%k(b``4enzvNGCCH30^1-mQdD;HkD5 zVSZ);+%_j^FJWx`8i0agvzOYrOF?3Cu@t`+BRz{znK!%mTS+u>j{C4H+<=@0y6uB# zI@f-1YETf_4etH!j{C>u2=s~c`aZm8kK#LvR^@wH{8;V151p~Oi=bDyu#nKf%C(le z*8c|88LkDZgJQ}!W4awy5Y2ZbVb>C8cY(3xCq3^;&)YD%>Uq5+9@!(H>tRiDT||l= zWk%Qdcyj1BlN+R4d%wYDtY6qZx1!Uz9~(z6uY(YfOI`wCtEqes+uJyqWp2vUL?G|+ zw$NXwpG>IKqB=MRO{9kUG(9{xLz#j70rkuSi-}b47~+|X;SYa6 zfk@>TvwM(Tpsh=Ai@^) zm{-k~wELKzeEsE@WAu_%P~8_&c7{yVtgR8jat=utfHnyDYF25cuAh6@b^-drg3jjB zROqXdQ_xK6f<%3-aD$T(9K^$>Wu`F}U?GO6pmzjK#dj62%LYhXgTRGFF?5}go>ar{ zg2>M%UpOMV(K^@g+=@M6%F7+{b>MwmV(O}iAURS4O|{jWjO6Hr6_SC3ExuM+@&D2+ z2N(%nb~xYWj@K!gV8V_7K9P)ew2w&V4PY<1QR4I#}5AX<}LgBJEyxw5oPgC~L)wTvUJrqmEJcVDB)+b%xgSD77_q<0^J9-}X+Sb7O!`|(>^sTB%U z6CSsnRk))u&dK;GoQIF%I1G0hMsk{Sa>TE`ebg1iKFo>9wIb055U-GusG#Co^;W~R z1^Qc}VgnzoRaGWvtk+FYbojzSSJ)KY3noc5#ThyBym0|5L&`Z>kV@^6p=1#v=9uLM z*D)g%h)wcAl8OcC951dfP+rk{QVDeUEnqHdM8|-DRHRc6-jY)E1rORwjCrD>nS8L7 z1W=A@!G!O>94kIox`e(Umb|WXhCv`*+qw$+6K7IS5(`w3nKF4R55HHVA3aI|Q`dsC zrn+oB0j;>TZI3>q`j@jI0a#Xg661hW2O629_*Ol zu+cWt&f7JJlrGAGNaB9=w)v*Ngh!2Zrips?M^^ezqYM{?Fs6<6@p%D(P-l=LZo!E( z4^ze7cD=G%ugZa4Wny_ zxsMt&>;KSl4(B7NI@Q6W12~VjB+sDUBO}Nmh2}&m^4Ek$JRz_sNX@T*`(b|`deAkB3D!@U! zod=el7CsH9$Qn z*S4M6I(@J=N*shCVTY0+PKk*MU!^Q7ywMplanG${25TDD;uG1NEHM1%YqiRk;n9p{ zP=S=1E{O)PB-KJ7J{`7l?g#g$!Tu{dlEU=Jvf*W9XyaCot|qP?-4ZpnC1@CpFXp6gNzfR&*o;;5(z7YHCTO6T zj64Ln1p5;-qG$V*pz)NT5&lshKS9G&H!e-CMk`q(=CrHl{rH&8*O(A%7DfRFB8XLJ zF=28#)B*RCGY$^M;{%;^7;}eMGqaY{(H{|E8P7F?t2tLff@&MDZnYC!K*X)2e(3qe zuu{@hXK{01cUDFl71Uwzn$2}>5n_mgE@~+WRL}(lI5XW~mk24)q5k1GE9-DiH8P~e z3$ozVa_Gn@GA;V%FODKL-K?%E!ep`h$U3iE<#4#GX0*4mNd|ymiPvu?(2>#%Q`A0e zayQgnMA$vL$JNdTADc$9lAF_eDtHtFBDj*5@1l-`9-~C@y!w2?hpuepwTnThgUD-H z*3#TL(X%qA**4~IXR~FyL{lA{?(fCf9wnBNRO}4>$Kmbo|28`M=J4?6lhMEY^83Tv zG5p7~qi>G>X8-Z~qoc#apa1;kyPL~bztE$<{mkmco&ML~4u2-EehDOUbo9+XMNYJ( zp;IPDyc+2(Jp=ssC~|hWyPfRj3UB(iSUc?_9mZ7C%1-#VVOgc*QhqMkkrBip$>1f8 zhVHP>wF^BZS(LoO)e_~#X&o@xHS9kR{I7F21(;_}tG>}Y79^+jA_+tgp7hu40eX*` zCP6VM;f9onbWLz}r|oXH_*&16#H$+&OqSDvVCF(mkPydnqISm;)bEcD_vpkHlNQ}{ z1?3fb0}7ko^f15lM_>$;06j+kN`6pUYG9B(MoUT4O%gPc6>tmtNj5uDatMhTxX&px zOAYgE*tAk#E7gqq%1RZRD52O_y*Y?(VW)=+p_A%p27NKXdjhOwSymAaJ7V|)UDOLy z3pHcT+H{%;>(-_L?In?MXe=lL!fh9q`pval>9`6=z-h7W5K)6sYi4VVFFr-MD8kwS zHpBMSTNNgV(V{IWK#m12tlO-bnWXJCS-<&2*Md}|SxxiQv;3K>pPiM?nA_i`dPiRW zgCzaJ=y|gDwgk7^%D;;bu&W+2PGI~L_%mSj8N=ngI`$0V|&1_IpJ5vA8 z`aMJQEGA^Cb0#%SaQK+2&A$;Ul2UDSa zDvXd^7aFX0EeZ#qX)0oQ14JGp|e6`AP@7Ulf=w(4im%y|PC}|K>W(7SfLYs+A6HQT+}0 zlln<>e*`Fb_LM4(Q?1O#Ngs_ZJ8t~--k0zSQi_ew;hwOZH%WWw{PIEvHT=%C`x#l! z1Rg9noB1HkPBOqP$DkShJVcvqKjE632bVA8MH#4$ml=iGJwR{B0fz!Zysq*(iQ#WO) zXHdEqMAg;8!cl|I_Jc=0{rCS`@-Tf@QTWs7U%iH%e|oR(-bxW^|5TeS!Bq9tre^m3 zlIPbY$;Nt_#e406L4-+Vr(On5^&S^A*M}9pvm*ax)81hFU6>`qlCa=>PYcz;xYVzJ z!;fJ-55Y~ZQOt%&at;zRFt=Pu1BS>4DgfM3?+-Xr zNRp$PNm{@xn|G<@iBa>Au38gyrc{QqA|sngYbdQ<5tG2)DthsT?oiFK_TQ8_kcU0Q zOpAl2XeW$zqepX=H3~2=i5R1|pi34uwKNps&4qm#$%qiRS`N{qmP#`>Wl*NX1(fOq zX0>`r5aEhsoC#Ug8SFYnlZxLF=ISC9m$$050;$?U5Xh$ED4Sz8BMp+#0_VVYe|A<} z%=)Tb!&7AkQ3=~OQEHtFsoyf!cqA-h>LSx>iD?mV-J+xr=7LC^V~GKHGnL@xR#!Sr__WgU4{)aB?;D=SrY*GH z#2%TZ%2d}!3mV>#)1MP0XNeY0nhto(@jZ!%71$9UGidCXk!uqTQyan5MyGL+*QjKA zJCYL$;$T(mP_q0wAzr-#kLswHOV%XaMPh(y6fgrBLZ}kIXXsf=MKxxS@kT|_HZ{?Q z)|E9j+iszM+oWT%iO|XQxv6T#N z=)J1r_d`VE78tHXXFxOZ;Iwlrbh`$dWEO}}(hQr}ziFOh^pkbOp0lN1?3a!qqh4d2 zrf8-T-NmT1&Q`UtRzi8;+g9KjQQI5VA?Y zCY@+Pl&ETeX(8L(zAb_HDpL$sPVAp)fG2T%*s1~xcEc+IWhSr=WAqvXV$6+a2RDFJ zw8}>%uH;gCL5Kc|Cy;fx9nsHrNF@yKGwzQTpQ-I}A%Byjl90(|$0~Py%+-hk4zZ)P z8h$rf>%sg@u0~oC9{>i%pVtwrRf5(Uo%z>SRn^KJ*N+Z-MW!C6NGu|zQB%QSHNgVz zqZ>puzpw*5f@+3CM5jtQ<7{NGvs}>GSZ;BGOBWDn4<2UA*6h94MA3BO9UU^xw8+PdyZK_b6IN5V~+2`k}v!Lt|9}TuN0IC&h8#?l?y;8!;(&@T7Z~Z7^Iz< zzS7JN4m@>BDM)RbB93ploZH1X^j3MzE{U^Xtvw=$w4U!~aS*O0UtmeIU|+u-bn0at zEL?+Bmlmg$yGRAjF@TW^n=O>k7HD>?7<%5?+ASo(eZA~hT}PHXJ=uJ~&74HK%P?d+ zRfHhAD0w9@lPITC2l!@EPZGaiwYaA(6z-;gb(wIm!%1! zE{=vPs{*Nj)qNyUTr~C4iXCQzkqS#lGBJ%XlyVZcTPvU0I;!J7SxhGfS(fVHp)m9e zB?u%a?y|y0j5TU*oS^+t=*@C>ud7Ax-7lu&)y6e8Mu+D`ImbtO2GLTik+BXBrOj&g zJEAGSsJIYsE&0{Yx1SV6cEjgCd6S;JN$AO&^yE!i8UH=KNvM(6JuHdSty>pC%Hf-C z7eweSmn0mhu06o!!dpWX7;c0Iyc{zk4fwB(CSKVYd{<$X@@`}1dr;6;YFR+zPHQH) zRz#XyKcI9VOxBqCJ%HpS-wfva$LN~aX3`y(WF2xfClb>_G+M|_Xku-9Y|xo@>kldK z*ser9`Gf69^anePgDxK22E@cGcJgZYA{W{c+m_IBF-2D-1s3sSZ7)*`(OHWS0iR>M3CvoHo;S<#NuAEB6|tjIm(wXl_uwba^~kj7^; zr?b$!^A=%Oo>Y;HS9v2hg~YNJQE-uZSa=*ra!ajL-;iA7c;sVQ5%2}kPp#HWfWtxn zEU9;Q$2zrEPQc$ZG-%<4T82A|@b7LXe2;0NcsiLpWrF5JH?lWkB9T@H3k!A7 z()37ByYxs7#-rr?Q$1S2e08rtME{N~lMY_u_peVvf6^kjQ=J_eh9Q3HU7B#T=%k^c zp&k&?P*+qm^!Xz?&F!w%t!E0v0_ z(JxG{T^!@5+jL-hz4}mAM8n^Abfc`2YkIw;ML_f-yM_0Cb>T2*?a}i0;fkR1w=Yu! zO+Oxk^BtdVHd|aDt?g7_Vq$-KUt>DduMP`I*K8-i0)o)^L^eEfJKxK4IW~&w@x6HfgB}P2 zZqJ#R(-JPx$X+1r!Kaoh(O;mP*-jZ`M>5$9Hbif^RR8k|FerfkUveVeatS~AWE-qM zx0mfT{XdLzImwA)2Y}03gaOzNQ*meaBi%nH&;>)hvikv%Ej{sWQ?_Y2UIuQDb2edoiR{lheSx`}b0GO6f=N9S2G3y$){v56QEpVx%<^NXd8XV~VljQcG zl^COQBq*B|#HVHh&)$m@UZ7^FjOJf!dXEdD5u-3eL|eN6|GQ#Kr0A^=b1t-g>7s;# zJF*-MyUJlj=z{0_)_ZF8MI4 zwER@Pl>CWnk6x41X0YP2SOlSH$McRv41kx7g?C95O!}SSO{DGE&@>$yx>=xO*Igiz z+m+hxYCt#diqhw!U7~!7UekhzrI5Npi!PK!W?+*Umx!{gsPkwS9c6l2I#1-|ZCS_T z)DW@f$kvL+0rYua!#84aLAjx;21z(qNvjks`C=8Z5$t!+A4kn4;*X~RKx(Z$pJr{` z^w)G!5%gk?86$<)*(WSJS?MfN;%u%lO)yf@t|0P2pgD)!kZeww>kYtc2dDtj4eH~5 zR*7>UO~s8`;GlhLUqAXudswE8EP;Xo$q@uaBD<2T(Q&=stjJSK8AMa7MCzbvdSmqJ z!x#<72l?e-hz1{~Lj4buQ!yB$i$zq(gR&{9D!tDWVu&I-MK$xP+iu>ye0PTC{2^?0 zIeH+FcB!;RsJ9bVL-ke#O7}CqC@a38!8Ki4%?18@luj!}9oQkd%|k`a6azKwZ(qMa z5?3=K6-C7A#e@X5lX(1A@fE@OJ5~g`S66eF^|S4-ed&earnnGcH_V|TcKlFLNsh+o z%2I|rE-2`p@+z|_{rZ8H0T-S-cg zr?>IX1Fwqwf#%_G(*hkTf=6NB8|7$;zOv(-0uK)~Pg+KJu)Tan*@Wdo!RtqJ!lV*= zl|Y9;^$5KJgg`wx-9>gWp)5RKR+%NuHmh4x$pq`n6GUo=VgM5h#g!0rQ5O<3!fR11 z16lj?+3FZ&s30HoF^*M=+=Ff92+F~m&Kwa1ayGA^!7Ry-ou=eK!^sDd87RWCsAn_) zb~jGd(Ty1rj!DxrLard@o8Rc(Y=I2ox@?*51CMbXCu?RC;{*2 zP7!9I;yKc^?O%<{|Blr-L9&X-U~IM(52k&%y`KJ$1AP_7L*qb z5V$DJ-)nEZ`hKsKTYCipoBl;hs<aS8|3WIIPz|B{H$1FV)BKxoZ+fCi z8{us17G8;QRgR3#)~~9~v%3(@az)REr&c_W=7&bfwpwzSi*TFAQA;OZn^6bCyefdS zK`}={F?fUFP_v+}e342zmRJxO?#yp%>dn(ij{4`{{0bs)!7&XiTt^i&`jb)pS&N=h z=k2aVwA(=%09&Wa5&%ie6(eN9U8f>XrJ3)KKVG~{Us(0DH4fmv+lw1&7uZ7Gn$cft z;yDkXX`ow9L$&|ah&bD`j5Gn9msH%vc4%KC&_3|ry?BMxPXmOU7me5+Ygjq@d&#Z_ zBm7W9*QW2Yj5NXAoQk`?yTA7lyjZnNZKup|Y+2ZlC9lzgX&0t#WOPHzGxUmyx*|;i zZ1cKcwg!!GlfArd2?x=9rMuCIv;Dyk7w8C^?58TN|R;DlG5ZowJH}M$#Xs$q`l4yoe>*f9;(t7-e zn-wWkdhvrjnzw2_HX6}l?4zHPIImfpy{h@VSDlv1D^dn9@QNm@A6tnEQK^2w1(m#7 zA}j*{fp>tY6K~{g_uij}OLB6n!v02nVTA zigV!rYR#?POwjMn-Dc%6Lhoz^bEspDPFE3eZ8RNPubJ;!e^)4ZgOgTI{0}fKy=U~^ zVB$YYWU85L0;6~W!a5JGet4W&>eHVzMDK?Z#@!(i ztQK>R=nl@)070{Ilh_AWd?D_~22WxCRq9M(ki=q+E21csT5J|{N+exuh6^xF*@Z=f zH7dZdo80l$tMiv{UX2%d-$IwLyyTRHqM5W8&pm88)&8LA2p>oluvxuTm%QW!pDnvC z*Y9+b$q^o@eRv#$SkBXIVL7+U)_k|K<>WkB$^5LA=h0Mqw`M_v&AMv05FBaS{J!bl zUXp4-byZZDl-yz$e1h$G9ChCv?=a&42PD2lh;$`OFM|$On``WIZGm1^WaPT;PH6!2 zAFn*+%tTsR$@A9xt^cZ61}D)Qh1x?HwNVJ&=cFi>8jDn2_JQ6&JcAGAm5I-m6}_hg znUNgHIb|~sg*O7@R~S6*b_nl{`d5Qfqfh4BcQ=TUkguOp(blsG)MKC@Jefs}8Vs_U~yx$Q=vR ziWp%o*Y>aKwxrj;-v9}*aV!0?NyBi`Zt%x^Z^8~41ghEkkn->?}-Pr?wJ<6RZ z6C*_sfl)Hydn@8h8lZO(1(6*LKI8R?bV>Dm>rjyi8hhoyL#_LUp^NJm*B8h{Sp(g_ zQSnq4FWpNvFrKDx|WgRT7kF^SqRS2kWuPA#VFrFTKL#<9}e>^=b zbm6kkgX8I;hGjr;;YWx=feiY4inCKjCB>3gi80C6^Ujf23&|JeRA1P?2$ThHAqsvm zT_@f2S_6w3_UeKu+cv!6P`esxh!}Y=^Q4v%`d8!Bhn}OwpU(a@s_Qbt3-TxDW!IK= z?)<44XN*9{;YaaV(_d4BIsKKb#544g{CkZHz2I*j%gNr}#FV+W2-wePHZv%aXr`{D za4mHAPrU-N!b~VWXh&xcOtMF4Lh+%@%A-eFzqBgkqGrAtslW9`Z~YIh3OQ`TA0c4^ z&S8q@*gWaD!vD@o_#OHo0%( zs8wtP9psc|eXWaT)QtoOB6Pd;u~8i5Zsrs%{iz=2sUBv-=n6Nc*;5Pkgrnj=4$x5R zS4GS%arxi*mUu)r8~rszh>Vm16ZCifw)W}13lm9gQRF9UnnHN5T>RzR>;L@W{M%Ri zlSI^Rnfy;BUyP-hQoRr^ul7rd2&Q21=@V=vae|?@udiLsM0h#<&YX#^&T2LdSf`H| zMe&+jv>ZQb=>)0nLpA)5u`K8_3i+$`(Q6hq?a*MqQyD|aZV&c9;`+y^rd1lc$bo*+ zYNhJrYT;O^OHy5rM1(Dp5vLwUf1cd>2*D=6AB1o2^I|Jkpc|pSu@3MWx}@&cX){If!t30=U%vH+*xLL^|3r7T?LCU6sHWDBxQADPeYPxWpznUe z!XqrKR$`LFqw#+}{m!6|dMCLn>8H*93hRjo4XJJMS3I7tB2LCRUhGwR&AH^PQ}yyD z673YPOZbZy8X=$v^I$r1y0Xdz-jyzIH3!aY2wsF@Lxq++f211Y|8`JXkzvfhK;~lz zo-$7YIZ%(;{knK*EC!2BAPlPqetUBwR{8yt>r?r~%U;C{ujB)-(!d7W53gj8n%{+& z{RT;r&rVKUgPia_eS^FRbxYei>M(H;917fqH?S@)eoJDa5B+2f`>l=Z7PtgK=x<*1 zC6H`O=Xn&XS0BwJX=@)f?z>{?%UTRhV|DriKQ#u!;PGUu{ia^!YsJ-Hg-oF>TJ3W> zkg5B|7KPG>;YFfI=|c>Ig2bz)dwrQ5l6c;wRsxS z?;&$Y{bNF<(0TrWX}b{g^gUPVLUD;KO1LV$%e+tfumkBT@yrmCjc~KDy#%GwI2&Qo5L+h z8E|$%gS!HOV^hbTEM}=L^?*0J8yr4shzfcaj1DZmt9V^D-IyvOl%bkore>;N*>G|& z=+@&WrWkRO5}7xxvTeIjDx}x;#>g?X#$hg)n6!=7JTBdv^ky2U&PI^pf=9Gm@pz%Fq$jyu(+Dc5eQ}c-BDRz2 z;QDOqqeDb+76v)*k2|s)Y1v$2fO!Chf2kHl11CphOZ&q)g>z+inzgoBmyUm<$vPMc z3r8u8L1DVlG3`B#rt5b~&Nu_p*c^V--u=QyQb?k&qzK8?YsC6Wz?UVFZPISlePq<2 znt5-FCJVEJE(VY|ErLU)u;{&Z&Sg?_V-Lv2% zk&h;JYHf+8H@FnK^Q^K96}v!CC@^HUI*hV~qaqXj=+?VDxpVopzU5{;%&AZ7sN1n2 z?jpL6pdIaC6=-}dkaYEvB*MN0w86GXTcx={()5yeTBc3fO#3p2+9Sv~N}I4VsJ5C) zNp!cESI%%s<^#BAlu+CVTa?JRjpc3cUBzv_&6UUvzMZzg0!!rFKCHI(2(jUk2)FIN zxOS*+a?yt1>WDQAS4Vgn*Xn5dw>&JDWW}JFkCyEKGPQI7QJboqAaB%j(xJ~&&cJv#J{ zPwgHbS4N;mXfZ*oBK!y`x{*@|FD!^83}pzB0tHG+nGkyPqv158FVAP&;|bo6B&ypzp5VPq6!`@iIz@JKGDi~O?HzHE!JWb5NquI6jkz@~R!P zJs6J<4lLqmc)H!%OlvtE{SgtC@mwEP_3f3AV9ce>blUPp>$P3jbx4aZBNt>T=nwsGy5fl|czJbrBIE1v=D(##vbp4bky} zEO-^zG;DQP!ir$)O@``G+LSATvbw4Wlg08gunpb5gjZ>98g15T`tPK8v72FacF-zJ zedN%&K9k8RYJ}aRdt3$9Rc;zRn1VUIr-BF8q;DFSE#D;`c0ER&ug+CUofc$;k*b`2Eq*;o;AJe)HYU<*Q%l(cgY%_2N$d>u-lYlUKh45;;2h z=AV+M+_Fn4lOtY@G!vX5StXi6&6U=dOlnlKsJ?@nhVznqLgCTfozZC-J~MAdw@~tL zBP5*kLR}b?9Lv&=Zw_ObU&ckVeuELL-&S_HflKT$p?Y^}dD48JQp@f5M5*PPONL3C zw>Pi6$rF#Jy)Uoa=7~oW-k(V_Vr2n5E{%6xo5{lTw6ZL#B|t`V@0Dq5Y&xvie+a~j+%`}7 z;|VHBm8IzUdwoP74#m!>sMYDPqvxd^Dohy*OeIiZKh7)XVGNA#cO>@5)}js ziB3<@g0fmEhmiz5v-j&Slf*@e!JA_0ZZ&dC-M8Pkz!QTP8g{hgl*v_#H~wmG$Qtfp zl7A#woMzoc+h+;NV)P?1CR_yZUu!;D%2=RZ^Hdw*_utJA{nj-Bp9Wa8>&K&oC&=VKfgNf>5< znJ?|$dhj6P56pJ7p3!^4+@3{+NR0LMEza%;%h8X*o|k;d@WM2~D=U6a)qx4#k@j4~ z(1f-$fU0dXpcU!ISle18HBwTK?US~lYAA#-D|(+1tJEv%kMXhhfw1{#Gk&(NeK&!6 zxD#ErjzGcwD_kf6yL7n5Z3a*~&K{@dbsW5Qga{ag9;67(r<%lKa355Yye-qOaLxt# zw&2+vdP%@+Tm)IoUSq%Ajr*b+x?1lz`G6N?LB#m(kKi9SC;zyb zw{J>rnQ*YXw@O5so7Fhff-ZTD9x&MNrZ)?^q2(ER#YA1{zX>}48>Xa0=cYa_O-qF! z(oNe1y{y zk6e~JvV;WxgoQDWwtO3sLs$rYKILJz_|>;Be-xx@I)zbzj)}~UGg8iv&0CU>#OJcm z3(lzIRSIbPfqhnMAQ>+TgPqQ&=mja~j(Bp1yGL84&#AM2$$3hP?gRB)TL8dM^!bnR zEl{Bpn~kkPKNmKAwC1+9wNBXO>)P*ZZYC&Jy3~Gt0yw6dZB`K(TF6xo!BC~Mw{*bzeov~3=0w;_BTU+OQk~J_<1&AI;5sg;CN!NU z;@(1m>f9qF(uAkb=%kon!g0wniMK$6yS{58NTS!|0Nf_6iv)g>bdlhELD^?~mBhIl zK%)-&ORMVi>1_}hF382ZNRNYgs_k^RHb3+_QFiXB_-Dtgi19omaQf7D)s3jWtI>fX z-H7oq6tNkWGXVdhD{%f0PwZ*M2VrGejhetChu(?lPqhit{AHfUb*1*U=NbgLcs zS|nB*jmLlVrK5-pNu?MW0F)`6)fLH+@u_^aEi>2D<-f0%nO#)tMzi+3{3egB(Ub!} z)!qtl-MdUZBnT4}QbD|oPo;E++RJk)nz~S}rVr5%d`6j-d)(w-O))LP7WqkMe$tsY zjIKJf5XCEoCq-z!Px~;shtcZ-&k%us9OqQ1|3%l=KR{HwW-<1z35T1T&0))GLHRiH zNM9F;jaI#<5oNjhR3dz|c>5O-VSDU~z;y!fgrJ)_&F(InKsMr)`Wf?n6qya8L{t)m zNUk=Yf0^dy^PaZagB9D?`d3K(E;xfj@Qh-YRRbRKMy1F>rFfiG05vyd0kp=wL31)o zgCYVvki+6>N|f2ve3XyYTpW&kwjsR#wt>NLAMcKbiP{H#x{d8yj0VF-)})zZI1&wu z#E2`n^X;Jp*q=|HD_{(cpucr$RoGvLF<2MkGh{|q2(7M=wpw%E^1zu)5akJKOu!671O&C!-(61s)TpyFBU(Bm8 zq^mY^Rq!%z#<$vrR~4$vIGDF0Kx8P7kKqsVk)8Bz1Wdw4t zBOw+!Dy1|y5+$mCY^bDyrC1!O5cH==O~}lCYiEr${H6%1A!<+(YEzIh1d2}dZ2MJ- zyy>nfMjJ7fVyJ3y)-$qFm@Z`WoEQ%4StHV;vtFb}D*91c321Ej=U#jxAE_vUF4}}@ zv;&_ginM9)um_bW0R?C$7Ev_41hE}oV;YAW6jhD-sAZ+Gs4)>(F`fz+s%v#@KAINj zOLYGoG*54IeujUzJv6#Xq-h=~xsvi9&C`Qo&q|E{OwWl2sC%2d>+h~t(q-I_t$Aj0 zU;;k!DNE)PWywTVyad*~e6BeZ`BM%>_Z$k*>i=O~=O7j%qLqANdg$sK$;poM%L|lM z1ki=x)Sw%Ptvcnu5Kjh08uuKM(x+Z?PabdV?9BY3JSH_2sv3jua1qBk|(pYKmIK zMRn~@^zGxom8>jiqSmuU<53s&k&s)gvT_;hi{7B8T&}_p>NGTq$QpX*w?!zrU*vcF ze{fv-S@V7UT|uEU80}Y^1K+vd*SmjCqoxV$w*A~Y8%Y<0*IP5>TAX#G|JJy6g~9On zKo|7_VS_X{HE5;aLay$2ZNJH)llTsAYXAIYpav0m+JabA3*cx7MASnBPn1L>EC;~W-U-hM&Pf=mNEF>rhg1~Nvf`3wVcGd{ zrp0cdl}I=I8XCC`4*1gmM@#TM6|zmiU(9iN4Pfj&Q4CwZy$cew7!uER9)eFPLqjfZ zBV~8|g%zL47kfo#vmK&h<;K&0?7GaEr{Vs4T{Ea+>2mGmxZKHR0m*RTvYoQB4vY@B zUF$DNS&>YcNM{HFG*e!|J%J^i(1OZknCWzXIw2CD?srBlhI=$`!@XjenMGJ*-X42qW5Jz5%uK#5b+AV7ZOV%-iLVbd4(`T;L%c= zmz&jo^D1HqB`;~Ve+^?O2Dxn7o8kqBJxoP^U+5Ikko_>pw}QwaSOOI<3Q}p;-i$~@ zCBn7j3oJEWZI6rjIT}nlqScGK$!3)8-PqQ)elKN-rbbdKYX!_8O=xIOj({lW-d(t3 zI(3X!=#J#L2~$e$en+Qv@B2~*l!hJk$v2SuQUScY&IX5s2fGH=!%W#d-=DS}ljawm z+E?*5PzEUxy22qkeyLb9to*j?quF*q>x-qR8vdo9KWafG}0b;l2Io z6lq!pXRAlU$kg`*<^Z%-?>qNs3r1m1);=&0Ivny@&6hr4rqePeP2La+YhMu?p^u5r zw-#VqR#_9MzX;Evg@+spMN_1@x|X3yDGU7J2f}7@eukcZ^+o7Il-Y+)Lw&}vp>-A) zmff)CHcskRO8;PW^@ErGr#WHmswYUeZ|_LKGh8%p3np%6rDaL{-hKUuTURQfRk1Vl zA3x*KUr$E=^2_1RBlBO+?2nGV`KQO>gt+wGAk*6a)6iXt%Ji6XA%S?bu>9UW=^UyU zGz30%M8k_4jWczDWj056hA9)e)KT3!@G9dw()A=oXc7zdt}R`CqjCS6o@XH(oLYc5 zuxsSfDeIzGqF-xV=rjintPm_@wESd5KJe-eR@s(fsC6?})z#}4==Ah?*eQdpqZXYP zH#-N}@6VNz2I)5BLq>FwM%XgkGITmd7nho$Rn8dqf z?tED7`F5bJb1KN~ps7B@(JY`o-uBIuq*_p>GhuTs*V!Y8>>(M?#^`o1<$P?=7{?i3 z+zyVE3V%DWi+MX3>WK$Y^*&Bde0BRw6Ptvs(i49F%%82=`CEqGa%n*Ou|Q>D<;>OV z7pEs*dc3B)e=$TDJ%hJB)0~lUCa8cVR(u>rIKzSIJE2hO#-Xa3<9) z%qw&-Iv6&6=b-E)OscUQ5th4#ots}VMsImU@Apz!KD9O-)aIGQHdd%(n4;J!M2BDJq#9dPzHDE&FOA!HGQXG2(rLT(##Y*st<_hQpNOln|mKk zAU%RZMWXh$3v_5M(xahO6~gILi4M(59_dp(<<$eOa%(Kx7ehuLI={RKB&;<#bU4w? zoUX`J1SaywXLftX-H{qf|VW9(Q%Kn!)l z@gGnA+5f4&mS;pF9JRR0cp*3kh2&bN9-g5WydogBn&jhPqL$GcVzrQbp)v8;(o`Y@ zJKyYRrU#Vt9_g8e-TEjN2Lf%9^WQp|;{^SjKlr9w1a)UhnlrpA_G2n|Qya;fQy=%x zsu+E3M28Jm!GWRz737}8AOxUhNhZW*DdqZ1rDDn++m8=Wc(o{DNXLaEsf5&GP)EK<#lvJdp&%0h*!<6R?sQQmRUi@t6vk} zCLF;{ydao?F$nQlNtjUfjc!K`S$mK~l|Z~%RkJ$a$Ur$~0CVwOFv{TSplWp&gh{Nm zY;?^R>fq`&35c?+sPp(n?`Y$KFL+L;28MRnygF@H+g)6g&4eYHQ6h#&{nx0V3#v%R zx9it-RDDx)CPCY6Y;$5K6Wf~Dwr$(S#O52@ww+9D+qV7Z|IYc=S?8u!byZhg_3G|j z&&J=%8)r#o(xcX3a;@W3Omo$J7-oro4#O@tks{gwley8QE-8JIaohpr7|eCFWAiom zytoCBnEll;PdX1{1(4mqM-0CdpB$4%#6)?g0O1r0tj|-Ie`?+?doe^+jDq*<;CUzd zaM+qhF7@kz|5f_Ptf4T>LwvaE^SDM7Rf$C+dvHV1E!)N}*>=6&zCm>PxEWa;5$o@) zlPJAWb7Z5vY8z=#^=-5lCW`A>AB8r$T)H~SYpXrW6yPa@(z0!R-;iHsjA$}EvDV=F zx#pfT=U(+Q|EdW=;-2CE`A4LSM!YmH)qpm38v)PjPu3{HLr=n1)g_2_yUY1%=6+jA zHFKO7?~kyGsMa%LU3k?N+x-M zCcm^kznP2mPm6tz->ki!_;I>2f8*gJ>JjkXXyK*}o~`_ljSDJ27xs!Ui%&YWZh=fL z8P7=X#0bR`2xO1K%uk}87+ja1<9co&;Hqary(Q=!|uDUM*2LmsU1am3!h0RZv?6v&*X9QgoaLp;9;DN zqw1bL*q%xQPh@Kj=H!?C>2<;9{Wen2_VOCZiV!d50 z!gFOiB7BwY&pWg;=+cOJ+M0>ac9@)iD_dr}7%|WuPxVT&(zoKBgvd~Ma;NEw9Hr#B zHCfXNGs$%LSHRAGFsDC­7L=TkRhS;=b9=JMLdA`E75JUzo31?k{}n)QU#AA@KK z;;#~9`#B`|TD~DQdpge}KblMF%Bft4FHa{vu@#f3fQo>fLbVOghRe9Gu=SF$5OHyb zGc7OGjEhz{xXXkInIvXn8cK&}#(1!DXOD|GXv;7U$@iePS1p`G-rfsisxc=SXXlIP zh?iFi^c&mX$6gK)k5Sn?<6{PEOcp_^&eoYGDwGyyppe}Bl>xaYU!Q#v;7hb8HtQ%0_ATZ0`cS}8#9)VUv>UOKckYDdcM?bUTYDx zy<=pk&%&+=!cc8~dqI(f8(%v5MaIzC`A@02B$^GW~5GMV$$(ktt@-bNuvZ^Uh z1l;-n^&08aNeDYv))gg z{yT^GepkM1wq@Ns!KD9PI0@W%q6yYDoOTL-u+23=Eu-`>Pmc3otASt^YHHD ze7+{@@Xmx{{7|7wqJ&yE={RfSH+&ZT)C}17qLY$~J!Su?2)`Fy`TTm{jGKm!1NTeO z_*=DSnWy&7v02Va&%!v_SGu+aabd@0^DM^xvanz~r!&_{v4v(yixcrc*UVzR_50y+ z$lEcc+*0R!R`Uh>WtOiab&0}HLoszZTJ>?DittO$_K>3GE>UZh;6FXbxrgkHG0OeX zs!pz-&ijbjk?Ix2_&q#J>=|Q+5^5tB;HTVW<^s@FvoN+v|M;b|8tCB?4hr$-Z{+|4 zH4%j%NGGzH5KEZ}sC1n03ddpH1N1-=w}rlM_#L$p&SROP63$CZcc-PUgD+@!x-<^E ziZdcmih)-Zr>P``jk=w+H9Nl-f4X^Sx`is=A!`Fe#3Z25D=2uN!Tv=KHSjJX)dcc# zc_>TzwGIJ|b!Y5UO#$Ats5E-~&edK7jQ$Gx&yX_%8173BrJ4}IR zt&?;yP*UO!p`?viy_7ro5C=i(FGnG-ajb{>FJd%%XQKxcX06S9)ry(Ep87)<_y6yWLG*q z0T{goO6gu=YZW4Q#S2|lnYqt`9t&!9JZCle=ss*B_oe)psx5mS2RTY4t8d(uzO25_ z?!Bs{5ix~bo?qGJcM5jNucdM=r()$ZVxNp|&-SlID(3}!)K3aMOx5h6rw*6}?JCyz z=N^dhlV9wy(eMmWz%w>d?2m&CG7MZ4@vUEYSD_*;r^PwgGItk20Cw4v`8o@E#7Ngx zTMf5-8~X@&I_fIz*d|%!OOK}|4aZCTlYizb1s;S*e)^lBz8vG?ls*DU@r>={n@d2r zz?WHqoYR(OudexgAvb|cZ=OJ=wIq1CeKFHtV^o6DZxDl$(y|x z;FJg!&E|F+Ah}(j8Lb!jTC-jW?2J)UvpBro6Ye|Ey%(3mNQ{?Xu88ygUvNI3i)wn_ ziz*Wqiaw?3M3>NR(R_}aT;x#BQ++2fuB@jRlou3ayAcPC#2R}xwTzT~3Eq{BV0b6f z^Ctk(f2zo0K_E30*|@aoArIfm@xJSSDrz{sB}?j!%Vo~luZU5}ZRgu`k@J7^+r!g; zZkZOk!gZ}>q6E3ae68C$5VU|zk?h9ZEjl_!C_eUjoiKxveX!VMu|?yvT-$28y^CvR zDgA^wo^Ch2{&p2H-gHJ=7o$pV^g|OE;VGOSc5qlw39HQhr(3yY+oo6gLph*`u7|X# zN0dQP4*nUk$~8s&$wYPYtOS6caP3Y%upq0_w`&kMQFegoum(6Qb^kpVr}!Z%d6b|U zgCyu>7Qz-K8=Vv{s%(N4ZP}SF;f_5V2pmy{e4c7=zTQSA(xrTs&O^AS9^yr7xOYOr zKACEu2>%d^L&;?i`PMOq0aduW^)x9)&UAa&C~ra?XFo;g#zaZDT~>(a!d}6`7Q*PzXcmr`aZERHt}aY?evg=>bkZW4wCbW)Q;qBK6U$mHwOx4O zB@P1^?PVqG^Q%qK?V;o@@7iA2il>R<>ci(S)6NwgbQ!I6sZ;+Bh_lI_3g?B``>Ms~ z|HK`-R@Z(=DC?9Id-Xe3lY93`n|W!dh3lAWr!H{%F-W`0m17;GDIEbgia4=|F1yMO z^f>=Yun?FlRASbhPg##nR{XYV4N!Y?cRM!^jj|`e;j>(`cHtj7^AgFL+}wH%2QQVi zW-H}&tol;nQV-gyuzK&3@Q}@i+q57G`D$LAzHkL1NbHM0@9%EEG4H4pe>6G2w<2%t z@4+MGVc}Q)FpVIVF1DyYtFJ1`u}W9I>3O>_459GC>g4B>xVt_&Tr}ei%^7+MQoH)pGov8U6MrOOryB6Oj=7|dRdi}D@AVj z7wNPB1B$dkN^-7ms`0zpYwL8-btPMtIxWe+hxf2Mi;Y0Sm2A}4Dc_q^M!aG>8+*I3 zMQlz-CiI#!&&LYpJ(T4^-IY<|d>wUK=FXjFvq|}0=5((v^N1q#IhimUh3}O{*v>9| zYm}J8q|L3+u7+G+Y`b2!-!+zUSu3&fljYRB++C>6T`qi9ODRulbmI0X=6mR~klsy# z_B2U8AyYH~-`<nRc! zOD`L2Czu#ctn5BfQEo{4x^)xqt3UJUWm0s8@LY(+VIe7(uBp8CScI`M(8jOxqkdLo zTt?B*c^X}WpZY6hK63()BiQPnN5RXy&7MqD836L6)4?)VyYk(`!61mEgDMTOSz&h;6oi@J)I-10vWs9%|HXE|Ov7b=BU^vd6SX6F7}O$oI~ zQ%D89gXpQQNYbm|on2~`!aiESYxcT9t>pV_k9z-$Bg1MXa7U%`=x8^+1nSVA)Vevb z66nI@sYDnw_yczpp*{+uS?nY-b4c53CNv4KZsIb)_>`v22FB`qVTdFwz|#X*RGLKu z(1g57xQa-!F%?9?vl6V+(TzLbz=_ZFE9wZ-BurlQ69Y&ZIptWR7+-(%Sfn*!$Y=V+ z2a@ka6F(L)_YK&~-U8NzLMIyqon_Xy7}U0mgo@c%6DI5e9BfUQ72gwklNdzQG^0^e z12X>y8HXXb{Q1#YS2B8TJWG|;*L-}h~mr@QfHu10S-h-rgn|pM~Lvx!QXhu)mE)=vzHKv z0bb-!0XbWtQrdf2nXpYNUo*gA8ZWx#nMqYz-wTBTX=`D~U5I@TY|JXB>kWC5AGMT% zjp=Hp|78|{d2Ou~MV#qTaerB6;NVtR!l#h!8KkXiC*3)x$&v0@L3T^Rg8udIGMJqm zrMb#KakQGX@DTt+f%*u5v^(+6kZxYQXf7G$Jvv$<_UmSIXgrg0dl`XBC>SwW|;iI+O zqKzuP{SszvItSEHwKO}H4c6Y>&-#ST>fG!FKPC5WOK~Faj&1c{0CiIJ1E8+n{sW+{ z-c0hZ+6TUDX{P7VR4rGlr>B!B*FN51AFq3gCzk;aq2sgD*$%#*+~NY{x4*rAK-5sf z$!0yNypEoD7aYMV@wGdnkKiqhc!HD(cwmh9;I+h~yn;pj!_Oo6PZOcyuJ&?L>UORY zx)1)i9uq?QF_H{PCBu-{0_W3E;@EC6ajAv-W)!*EuUjsrR%d?{8G|Dm*Wjm5A-0l8 za`7``z{A=96#JjcN<=aBWp6xqkY%at81lmiI_qH>(o^_X&OggV$6<9L*^yJg0_u>2DYPshFJ4O)=)Q^ymY4x_!;X=3xbF<9<$G_xs>wdlHmTdm_M##`+v#YaF(=kZKSb4-wKLDD5u88nV0cX#g~Fyk;3hXI77~ zuHIQMnSHpf;Sj=WgXmwW2>2Ydt5Fff{d#h(rkrIkrCnB-@rCWhB@kc0ov-pZ9F|CV z8v+tqXcIHc8K}<_Ac6tjbKwBDFxl(dcxxx5g1I*YT}sM1sHp;sb|NN~!~hJw$>#8Zc@rz?GJi<|CpPJtM>ak8Yv;Qgq&6wpNQG0c?z4DW}s&Cq1hs(sb zbIs}wVXT#5N?ad9$klZ7WW^icL$V&VbbQJ(tXdPwY(**`&s*oZNm*ad;EuJDFtw(&d zcMuqDy0W!y1C&ZOMA3Eopk+zh!F5`rF*C)zaK`LQnj>=#!546{Yw@zcwNiDfyzE0e zgxA-0+G#s?A6CAwWpA;s>^*n9L3JHq{eIpEJ*`8o7en;2dM4+Zo54mK0$375{I2(B zc|)%B@Xg#U%U5f0Oz%^O*4F?>UpeWhI`~SYQi4){f^D|F+6C!qQffiOl$dAnSSE7>R$^ z;o$BnJAraM5_b8UPD9*1vOgAn`xk}&_|ft_MQL}A0rqEXLLw4!FkgOz7g z3v?Zh^TeB>_UxpBF{^qOj{tZc}`@MpcUoBI$Z5mNM4}KHE9nMjV>+M3t62O7rv&QOv5=A zUE9u~&k;Su;ador#}Y!42KjhBmEh zgwGO718%Iwot`Eu>@GFT#rK0y*<$Vm8`#cI*W9{6rG%efiRJLc2h``L3V#v>PEM%%#rTm)wggQ}>L3Ad*B9PdTKeZ2he5GqeZw zOD>rP{JiKfK`uO>`yzh3tY>I6Z-KbNYB8<2vd#X5b7K70%#M)LyYW(6gEhmLmoH?h zy37%#mah~kn&VXT^f|=%Se(qY{V>G)s#=y=CUyn=ZI|H0qfTbES4sg zYPtayMxO}q6y+0N%a+Q`X2Ct~d9xTy@ZWzOq@;wkAVJP=Ki{8YS_-gc3~&j~*W5u5 zFNJzG5+%dS!%z^!9=={Ldu2zx7C)Wto1d=-HZx6W>+bm^ZGZLOrR@jUll0^jPl~Lx zlX<#0+<#V3FY`SFc$E-)+w{3AY{y7)EMdsKcfGwmpL|?OmA)w?B4T)Nqza-cK)t`7 z$W}6$iH`?Q1ESW2kf-3#Z=K*>vA1hEa6MbATYc+$q2Q`p zv9rh_A<97!? z40%UT8W+%+4a7!2Zo{v+Z(ZsmT89wKD+eto7(&4WjF2m1BwtUp4-$aT->pVGp}{&@ z<7o*++Fok0^s9k0z`w__=1?KqBd}ZI*l_%FM_IT0`iNf@S#)7>?g}yRIxhn^Dzs98 zd6Nah@`{=ANlrXO38t+KR>0L`elDC-eq5p7U-LG?S))gre}%+80~dcwsg7zegg%Db za^w;;rwJqqF8Aow#F4aO^%0)=30=Y*x9P_SIjPjBbd4gj*iv_s@QB*hmy^(zMa`(o z>)Ea*&$23G<|4o_-({3&2D_BO2`*9xVq>JrPNpFiCpaL2Bp+Rnh>Q{-(&8VX*;eVx zDM7_o+nn}AL(R~5RvX1G2$&UoZ~pAf{~-?+$knuLM3VtDZQF3f(8{?IPxw$mPs9ch zH>2^^&;bq6I54SN1=+w*<|wQ1zX5ze<|vcNH|G#H)1>vT0xckZR)h(FBWMX#&(^)Bie>t#%rGx^ z_g`xB*20cd9^i)608`bm=;VL*BAXmlot4DQ+J|d1!TvOjTW(%k0=-zBWGiagxtyjR zz@eUdOIrxl;kaEpA2A8*0>m*kh`*Y%#+?YTI+~3fY$ewU@#%t|7a=o)dD+3KZ z9n-24+yl~*D_tjRN81IdpONtTj|p6U3(O0dCFc!LGgZK9cfI8vq%nc8S^%hQmQIM| zyn4bTOW2KKLMF#=Q7S_5=6fIhF*recrCwLle{B=BdpkVByuPSgT!_{&u>|i0Nz%g- z+v=defw9uT=09vk=x3=c=mrRThq(5_D&|FvtKlTF>C}!hkwz>$2s>w4CQwm3myg5H z`@w{-0v~!I_PcS#$xfea`4D=!b+dEZD5c)rAMD*Lqg^A2oa4=O%*S`U3t!4=UUbj= zn6FKFu*6m#Py7KT9oNm+V0`^M(q(fLZdTNqd4?`-!-zS)U%v)k_WjK3RmOJ&Er z-qNMu@o;kaA~vZ`J!YrxmP65lUKWy+G#0!n!pC!>M6IWMG%p}Guu2Q^mqeI2{V@)w zCZ<09^%WMAa=gTRVa2ZaWFWwRpeTzR9A!!mDvbCSbR-!0s>-0BT&3_x&C zub`fnLu|t-;#_OyOe4y-6(bp!zTk{^bbji+za<#fBRxX&Mo=g&VVHSaL4}Y+t@(#p z*X4pPkg+Gu{jhYff^LGfiiE0(JT2#tSJEnf;2r_%Q|*wKU2}OwK3>v&l^rM)VE4(5 zfZ!60@M3hsTt|(^StpJUl_Rsm6ZjQXU!TJLO417l-_q`=4Z*S!-LThR)tpk>W1(fn zz?yU`GK!T8ZJvpJKm8|L(Q|GvPeJ2j@);FIUw`itsf+$Ryp-blucTXGcerpT;^Sga zdx$mSxT&i_i$vj0N@tq1-)WiO1pwr- zFRHYLffOe#%fkTqBw zFrgeTkqy_B^?zRM)~#|-csenGhffb zJEJo`C;dH3DbvFh>~1VFwrMG-1KbL1NZRrDlL%v;cj>m&M_J^($8s-i(KQTj*d!m` zg%d9Fjt0Pqi@uLggSqKcaZD#8x4bUdOdf1}kpb?BmzC`0tke;-9wL8a5}%kcGHh|% zc_tUj5UzT^&r`$NI3}W6V4r{tx@LYB1 z69E`F6pgV&JAJ7bSd=o2B+B|kHC8)Y7CPGLFIYpJgAu^`pVKhh1!1XDf$Ei^ zVuZW2cx@8-ki^UWB8YbfXzO!QmBtB|p}Z}x4_@ILwcycNwAXNlfzBTxH4;xj_1Ch! zgZOLc2vD%Pc?jt)zaE0OJ62tY7Q`d0{Wu`D8(=RD?BHchXA6O2n1G$8$P() z;OfJMO-%qH>%Q!p&9fJ_tmHI5a^G2*2hwkLEKw!;e3W%chl3 zUs#p?@be*@JC-9Z-rO9^-l}oyeMp-Kbkuwm&a~NY0oBMp5~k=&P(OaeC(mRls~_-X zrU%o;uXfxH44XN6<1kW8T3_peypa5AxTTG;ep)+opF8k$&nS;E2h%+?VS~>l`=O6p z->L1WwvdxtaIb=O4wR|fac`OpJRNwwJa&+!k9B4(psdV~`w>!nWhG`UL8FQ&j68U% zg}79S58D9tZG>hc_YJ1US?mx!lAD6>1|v@ad_otIZRKAup`0D7hQ}-gF5b%o%~Rly zIQ~*hSK#*^@12e@DIsD?Aid%wMNrJu2B!~{&8040rR~Fstm6_YH1OmZ$=ps8rlbTU zS#S|qYM?ZSKDK1gGQn9EV0sr@$6RD9ss75LF%4%g7f+!pY(ktV#)T&kt;A1n(odyw zo{h~bJb41|M~@)PP%!1M>^(;QW{ulAMk3tVH=3~1rX!QZbT@OwN~QZ|d=}4&9+qF2 z)899bw%0B@k{VX>mc@4HESm`G%4pd?=W)HjwQRO9R3d`-R})v`XZ3ear;B9(mxTD zFK8UyMVK07LlYK=4sxJ`wq*TN*d}-9n?wT3URH_hWmtK<#;zG8o{bz*{4>9$)Wcsj zLNIrXY~Fg5cmFD?%>!v{el4#jgBp;wxk=MgXD_dQbz^w1Jp`IJYZOG4DcKSxj6yaI zk-G6oG}C|Cp?1Q%_<21UagO$H(miW7pY$4OI;(%k{4 z)YTUVBu$dQm`@FOa|aDXWTI1Vy@XeXge+bzfAizC9((_Ga(^0UzRvOTvV)9Rn7nFx zGH3K!*LCD!X-u1ASCI)lVWk_?U1%Y|(mw7; z%9XeBumSp)*f+6n)hd<*&d4S@#<3r1^!)AvR})pmo<^(Sq+xz;_^3=(pr|>hu-xK> z=wg4)EhMZbkD6dmJ6jH&j9#764O}r0;Z?d6D18os2O~I>cAHtb?ItD!N?kT-E&dZ< zkb&WB_eX2s-;Japd6RnCzbNlN%AWsDP8iJg9v)sXmmf)wVWn5kLwNXp9GjQ1G2_%f zG3fuDhiqgCA6E!_2_EZ?EXH)HF0$})-i=Qeh=xV^dAL4AKX(-13rmV$*fsWvuf86O zmTkVWzqN0?QUDxWzeZ&vSqYn4`Spwh(q(d1PUY6oGo(kuR$p!Eu;`rVn$6TI!FWT^ zc8UWX!7@j&F%hb<=ujZX*CL-So5CL(=_1G+DbPqdUqvURk^R+@{M^5$>BMpnzUtS5 zcu~Gwc{Z$*8EkPtMMOz3L z#2X0B)U;aUt?dgx`Z(myN>9Vp2rha)hVL4N<~EIz^8ykSVc;&-o89Ly%iX|D1=7Ens2EG*YzE&}5Sx#?5gq!=~_AnS~e(m702%Jo*b(ZIrpi`54rTdzxxsPjFA98Rk zru=)P_yQ7O2Tb`AkUR*?IuQTZ!>AjUI~_e|hk7_S<@N_GYce~51aO;#Ymn_%c>uM) zzLJ6CTJ=3O4p$LY3QLKkA%E%#d725L=xN$FEOAdcc8Z4WA=$XuQ@?My$k~%Bv~uN1Ujfz3e#koK#jxD#IGopPhi$- z;c49+;d1nW$O^xRC9O%qUVPKwb;t`p5|S2%{k;CZkCm~PqHs6o?|NP59=l^^nJJdm zSU{(n;O|-xe7L9oF4dF0>p9_qc-iH*#_A-USaQKNQ=yA7;|jM6mg3Ug6REo#y>W1K zbi8{^)$9Mx&dhB5dVXCl(ev}Td*sjbeO(;I)bsi2k1l`PJH9=R{_F{y+=sE>!5_hRIPzTbU5X`#v%J*rzWO_o?HP0>h0*o~ zo@IV7A;w-q^&|UWf7pb-xHI50M}f130_oR7=3C&D=7hWUl8D2{$7`w{u)%#s-7P?o zt$}%oYN7Ph&V}i#plp5hOP*~cDt-@+37QH92sDICv)F1o+GfoyR2@Eqt{tl;FAZHC zig;K{?0I6FtLHge=!f_Hvxa4 zS-XY~PqZgO*E^O8A$z$_zIla5$)$|=4bV&0P-wVgoz6(cgX1Ogt8#Y$PaZ5bY%eCq zsZ~mcJpO9>@{r8j@ds z(0UFP=W2rew2@14`LKkJG*;NUCttC|C(M>k777Lp}$ zy|bLe4|Eba*42FCI$UZdvprSH;B)Jn4XvW-Y=Tf{K_nQ zMOu_-UUlSxyW{Gny65YugIy2mGzRPG%svoUIZ;G)hUYyz`73cYMtM1wx>n07`x1YY z%v5ACsdD_^5!9gRY#e(w#t7__q{h_FvPlXvkv#y$j$E^1o{CIlQ9{hob=t8DON-r) z@7ce|$%Q7yHM9mvTrpyevRJXcURjbct0cc5NN2X8|BSY9k%?@%U!T(D!K**gOLeK% z>?-1dLZ(Aep+PXg8klT=Q+EcJ9`Asb8mg{Guw2SucEG=i(t}!^jvB+}Q?A0myU8-5 zatn80HD@vdkhT%uE**%*HBsHf4n&v|tu}%}5)?BI1fF4<%sah$%%tLKF;hJs3 z{injTd+cnC?wFgbMgaLQr~$3>UuQ|Ws@hI7JqW0otgy0ZJ*f4V72m$(GFlbO>oJ`g zjkz^0%8L3q*(qD-WQ4Lfx0RlK0;gHQC0TPUX z9_LIeE>`O}e`Zm+48Upm=`;;ptwE5@MjA#R=)aG9zMp!09PQm7_O?g9U(YslCMri} z7h$YAN<32L{*0BzFgGI2*C%Hh#uijs4@L;mEL5lkAD^<0x6E@}UtJp6j`tEurPM_0 zZg3{vzJO;59o@993~TC}VT;&9L^B<=y;<3fQ@=Z)-I4`a6$cw=I7?;DYnn;7wugAR z$8U~O>uANxxNFo~P6GRsCeofK@d|^#o1yPoHD;*HqDUzgX6`m8Tqytru%t8xnO8*C z?yot;{jp2|fLPl9>7MmI%`G>DuIPjv@Q&Z?Dmt$dmb^pnPGU&c^m3d6VU8p;$U<4@ zBHwWqA7bw{sV|03^vf6vY`&^M=ImWd_yfCzcIs}WgFwZEqk~b4Iw{OK&)IQ0wU&Uc z>ZH}I(_S(l(sUgGy(y91wbf09Dp#HesXNbk;K=3Ohoit~C0hN};>V-f_y#iTX$P&{ zp6SGtBuSyWVu0;?oDmY%+VuqN%=p@n84@{~^CGTj_3%;F1DYWK>{C6TxPq@$7>!{N;X6qxYfQX0AlmLKl;A}In(ZK=k*Rz?MdVwm;w{U~z5k++zrO_^HebZO+6d_9(I{D6pT za}qtI=Mu)3==v$i)B|A{n{_3t9{bLVa=ITl7<3DZ!Xi7K&%KHDgL_1%bopKvg$P%O`tfR_MmDza{y7;~B)aeFkbBDYAND77OEV3cvj<9;o z^8?I@O--PHChr5MFQ9msADE}1x$dp~nL+zZ_xw$X|CkyAnZEU!WTUDdasDyM2A4lt z?KRE@6*r|oN?%#13J9-=1&;|w3h?n~KMt9sJY#Fwi3`Jr8tpbR6XE z!PlCKm#0gbCgp!q%|L$ztGnon5tb_Mo~nn}IF3pRD?HHlAkg;E+xqaQ6^u~UvmT?r zmUcI4DNmnfOLsV^)?IX8w-h>arU$wkZ>&`vDxmCZCDl>jX?FA*Q;ecwM>p(6MXEdY za&zSA%E;@vuIqhe%g6efui1@Yz2m>bF6;kqR@eOJjw_an|K4o-GuKS8J@OP9)$rei z>$d;@E|+i?KfA40{&$gX$K`*PS2f38vc?X|%<(lZTmE;+vl{yPJ99yqROK;UHrIy- zQ~HM~V$LV&&1w(Gj`hnphG{b*9XC*t4*!mwPN6kuLKS_=97X?Vcf&{0mHLD1im~%A zE}8iR74!;U_uG9mgfrST%$I+33!4I0YIBuPp=}v|A$(p=K{j&`FxMf&;RPVtVS6;i ztx-3tb)Xt&Qs`8*;+q=DT_iC3Ike`8Cp##-RcRz6u5=meUqdID;mSQgxrnG|okCTt zFb?h_%%2+3r+v(?_*h!HAl_#-^vuk!;!3r<7T-y}=@tqs9S(d_d~7&2Vfvin&~dD$ zQXcsB$$mvsYBdn6K*Md4MoAH!U8&TX4r#ahgw{lGg58}!D0L+T{m4R~q){>4lun#U zmT4DU)o!Y_+joseYpkhH1JPY5Tek%iWl?ndWFEa`8Lv{2nFmg+>P>pEV}dFjA4U!E z>(9g|53L6?+Q;T>sphOn8;lNSe@+9BW$Ll|SkTEfE7HJksblFhI)$~RM5Y$*1+sLOw;ROHQcaVSA}!DJO&$txz$d9J z_sPW3sXA3kR9X!D4IUP_PndNkp&6AnN1qF^s~EuJOQf^YO%cpA9TFb4jJQ-2N_WC? z^=u;qZ%GSIDK@po9`DEehD8`?98KS3obl~cD3P^l|E)EZ+o7%$!1snan)u$8LzMz zC|M`AWSlqLCrEq+bYp04{~afH!+-Ml%C>EW*-|oKu@!tTY3v#Bv9;BBZ1+3VoulD-4`x~tYIk>ZiZa8{R8qAruTZB$NElOdCu9fLL1wo9O~kU$l0 z(Hi^wNr$>iXjQ_cEx!%_d>Z?HMpnm_m>Vw;1gQf@eJo4Vdi}Y zO`HB@*yZ0CLLuKGfaN+>Ge4-x=o^iB!f(f=gNuk6HZX?iInFw zRPux@N;g1?TArrRaF4NV&m>xRtRi8VXSZ#H?^Q{az9?t!JR^hpA1hkBbv(oE8SyyQ zR{ONZ6u||eYOozeI|@ii=gWgaxG@9i=%-jHU+4Q(KX#SUq&wEkJqRtQ?*d;)RteueR1e;&Tv*<- z<1s~`2|T@{>^MrMN-g@u1giK)g?>8-nUNz_5<+zjo|3JCIa8;OZx__OUOEJ_y%>$p zl@|v(p<#9s=T?rEc{{tWw+7Z5nb6)k;936pad2Q=&F@g zpCoZfHA|^sX$QZVO z-yB+!Aseg?cL15g0BwTK5RHZ7kbq{Y#)mq z_2O8_zVjT-=pZBf#Z_G^qjV<~X15Y$+Oc~X&!ADk$Ymbfta9fr18H7==GBUX!%UxJc8OlO>p`LL*&a21M8Y1r23FN|^#~r?pJ; zTG<2AA%Cb}j*K_EYk|lVRcKXW+QQ zQww=V2`BYg9qXubmnoVcFNOwInn9lZ!8uu019mWWeShATz{sASm@0~h8`TG%ZPi5J z{XQqHPGWdsDB=g2GmhRt+k;6zITLmwZUY(KS~-&Iwv^iso%xq}pq_^vTV=cJ_!SJD z_0Rcn%`Y1BKdm#^KF8Few+vb=9x=+X#!*49!O8ik{_DSAC1nLBRrCkcy>@5Sgsn2H zzgOlHYL+={pwKN6AQNQF{xa6N_7@UH($sXF%8R;%PHtnDg#Y^`C7^oxVU>2?D-yiW z^aw?!r`pthq(<(JD~a9Q`pyjn4wDmeS#XVWD>(8SWD$R^FfLm`E-1L^STg%XA2P6c zd_5jJV!y=S0K0G%%`|)vre^680<&4=xV!T44IPeKcd?H9m9x39#nM_gv>8Iv-kh?B(p|qtNtwSwQUeTiD z>8#@MspN%q@aAyGCuzoW$|%hUfX!=-p?j~CZZlYRuv80GQ-Tp^+I?Hw)uMz(v?zw- z-Ywn-##5tzx}*j=n~h7lR`&@A%k=`C3n}MaJjW^OS3lt)w6gyCu*C6AkiY3yg$&+4 zh4XVK^;>-kNN=C3ia&AP&0Hf}h1qF?gG_(Y)&U7gvFSqeFe>M-Y2#M&*O>apvEnNc83gb6#!o<11T>L|W7j$?Cuj zY$sRo_cr;m3QlKaT|T2;LlrRE733vqYrB{pzW4{uL$+Gi9V}K@INsFx$P_vy^9LS- zSvvm-tnOuRiD zVeNGQ&!1VVipE{2(_n~io3EbsAub-TTSO&K;fh&K&& zGRIu;F&oiOix;lSYqD=3lZt{SBUpjh=QZbNt{}$%Smu+BH&H$W7!YLhRV34yASOH@)!d3CiQ$EMaD+Et~B>LAjafikmcXw!98mDo0cX#(qUR8+Uhi zcXxLhXE3?Y~nih_Jz+4a`7BkvuB%0wC z8SU6DqRyt2602N6#jp1#ym?%dQcPAzyd`H#bMjzwxj(`QgoB8&N*+IjQi65nuH5zx zfjR5K;lv z?hYD^MAmGJ&x}NyW6m^xAlT|k-6H5sV8TC-589BEpJ=kgjJP0mOhcfxS*#I#LaTRv z>kH26cnr}N@P_Py#sg?YAX;}ve1@$<9?xHHzgH|T)D+oX4u^0yWmED$hoQoIMW5#q za37RDC6S+LUpx?kaL-ObsI5_IBinrBaqnGY&oAU87Uu7x@yVso;`B zxs0sXRp-o{9@wIOS*t}UKmXC3@d#^@0n;g#rpRd|Z5lx1P8yM#EyR*BIsMivsW@SW znEYP-j0E&I^7G?H4RYxA^Y3_V`#6v@`r6W6l*RfE{1k$OjP{uv(=26ZFy*FL7uee9 zXdO~a+tg#h={XVZ7F3Q4|}C7~6y{K#CcgQ^)WPV!h_ zvDL_*&qPM&hiiB0-wR!)8R(|o_2zIFm_%t(liKoPc?ufw_@-rW)zMrK|JQOv3V3lk z-Y0fetq6?9^-8|gLZsn21uyn$4MmoLkMt;r=?O8Kcqg1obRw1#at%k_zm@qyEzDwn zm^!9#!wl``CPS6j`0B<$t_63EDA&|hq}XXkye2)e!n-vLiaOK9Bf7@P$XU9*{vC~< zTUmhl+o=FfW60?(4>2k&JdOiFStq^mCbM{tf3N_?;{kIFiFxw74o0EA?fh%lAP*|i zRo;bPXN9;qR)afdyp9M?=EM6?VMo#GoBynDqnFiy+9qsAOB%B+z3JHl8q4)ZsD-&r z_Q;7L8Y*0HbK1AcyAj+EZmn#ZNkRS+mZ@PofgqR%rxM(ar4j<%O; ztdlO3{O~QH|3yuk2bjMU7C6J;BNHT}w%9(clO#@F6;O`O4e9wIapr*rD)#YR1B^&Zs3y4%aDiJH$%tiI>lzFrsho=` zJmsVaLuNKC*(d`AsdL75%lP+Y8Sfu%0_DJ(sN!F=b&1zgijm~V89QaU)@}b=BGy6}#-CBQv(I-6LlIDXA!5(1&#lhB)% zl4L|cdLiBDQh61%GdyNMO$-qs21jS`%UAlL#|lPSIm39p95SoNqs~`|<6dBtH8xq2 z1gCVZsW6)Kp8eMT6NyE&SzyZvhR=!QS?#E67=w*j&`G${c10gKH>;>>H% zk6sfuE~+V5uIFoE7%r+TiYENn-cCwa)c~B_V(}bHGis2W?Dt;1e@ee?q5%M63+vfq zmpA2C*UDa;%5S@swNoS>RNP?buF%^QN^!Vq3!^GARIOHg$+TSV2Y7fk7)adm*A2Z+ zT_vkLy#aA}U%h3W=BpH=GLBTA8m(@ROQQe9S$hW=4gZf$_%xxzvW$3{QAEmzY%^+Y z^tnaecB?wiUt6P#8E55*Nv+ERU=3*a&*c5v3r!8edC_Vaux$~PElPI%@2@&3bT<;C zH6T>LGw7x`er)wBqRHg<+8^IbG^e*1@Z^tFOk7)`y4nf329biy z&*InYSorc9TEip^xYX_2bEW0iM`=Ot%I(UMkVNoOr=OHfdmE!appi!$nJA#Y zpY+4`0VwfPh@UXQyF8$v&i~z>2o_dS;B4p59hb)38B@+uYsg}3@2kPrqquQn_l>ze zQ*|}cyF(H5_mcB?QahH{mHdTFHkg{F46vdg@tomKCbm6b+8d4m@(|o{aV2)D;X76z z@_!0WkWvLBA?^LC2*8+(ZSIqKi=x5H!`?Y{ugDhmWv6&KReogQ4*(FfLYuhUxZv6n zk}@D(c*VJ50;_2tnKhN=w0D>4Uj9JN5_8f#A5-S^=n3B`|E`3(8>KuzPJUYeHb0ZT zUrxNP9}jqv3201*9|RWA>)sHOCse*-MgMX9AyC_$TU@1N%fTogqmr}1EUotO=ETDN z(SI#RL0OWJFrSf-;PkwmvsoTvTEjn!zz_kcm5M5n-JhZ=wB2nepELCmNi*@ObDOvG z!`29{Z>YS}+aP^o-VQREIm0i~D0W(wriQUbO}bg|#P#ibDlXM_buTIGBiamxAce%DF(K z^cw?9=~%XunHV{Fa+H*YZdF6o%X2c@MxQK^`68dJfhWIzE~x+O0<3a}88q_3w7-~F zx^i@~%hpHD+mJf{1C%*Ce1C+9apBSUatM?qWN>_j0j2Dy|lWGfTGku zVC@5fJf#!aX?&o1$Wt~v80H({F}Ins)gQP8cH}DqZ^mmgsF2fG)7AsG!v)n!+0gliiJe{(~9#PAbiokq(a&z>S z-oh>A>^V$>FBn(ma0W+Z;N&k|Yr0WJ?q76!KyAd{@t+ME>(20y2av(nNM0nY!W6Wd z6)>*oNGR=u?;G7+`|Uic-du55-^2aR{ql}7*UL}?c{+R#b^qRj8Ui{sXB$8Jwc3^- z=*w>VV`x?9-{#9cGZHQ?^@1WZq9#^`y~$ggb?i(@=gu}?tRX&>0BQkTIZ*@4d>(~6 zi5VOb_p9bzWg2Y1@l&k%Fri;*?-y53RDo}|wSjPu6y+oQovdCH7{h5OC1iHp=Eyh| zI5g{2o$O4NE7DnLwP})F{yq^K!96NW>ey-eG}F9+w3?yQ9HL`m-t#neR1d9t(M3xB z<{l@QRPHi6=Kjbt$T~`+U}9w~Spxby#mR(z7i`E8hFZ^v>?X7&4W?*<_sq%B+ync` z3Zg#*vp4HB1bxwEh@(`$f@7Bqiqs@@zL5vLm0g)i5_}2MaD=KgAQAuV?&4qfJ$UP% z3Ai!-X{N#=jqx40_}-VC z8s@Di-eYO&hnw3P~D{!%YU1(h*yyh{fltY7*o-@3>!wm+sDX00|W*NJ`F~d zdsX54x60-4h@?k#grzhWB8zC=WzsH>1ac49bZXz(D%Go7%rWT$q)(QGQIg_T=&O7p1a%zm~}i7Lv3m)67L;JXwWye1i=` zi#2cIyg!_oh2DLvNiLO?m%bE&98Bp~oTzU9?8vI+q?7>!t@A&gr#Rzc5?j@{{)SRn zxoKTp4kv_?H%k>lLLcAf=HMe_zT4=k6}5`BYuS2?C;{~JAlN7Ie`zP#jq`wa1H-15 zhvA=paPG7{U6}K2^44}Ec?Kq4e`X-wsMduEDKy3KgX5cog8*|iwu|9jf1&_;*G_2R1z$j3+{Bi8|2w5t| z37Un}%{1Cu)kEK`Cq52<3dy~CacY6A>y3ECU=#cXcXb1Xc&=Q zPmCnRHgN2$HFkBq({W*@*z9z#p_6(y&cnsxHOh@1jpats#92bo1hY)hg!O@y(%>3~Dy?x|IyR#eU%;CDTJFeiT|M ztH_3Hb6pe`gs%1+IX@c2OzOs0TIYjeH!pqTuteye^BJuK5*jlzw?)@Ul(~aA?Gd{UmI$?JVj<(@=3+RCVu>QUT~J2TiRPX@KAf;aUmY3diob zdeFQe7KO~MG5jzz@PdF3&}O)4w_i(BJ^=cigDW+PQ$={n`(767)*(h;ZZ^w*M$Re< zBlNNwD(qjW`-@uEG=aezn1ffbnzPr(MFsnWfi&zahG4+AY@y3O9fC;_7-)j@C`w^z z(ZL+1R__G13|R(TmPaOFz7Rp>xO~q&K^6zYK1v9Y1@WU33Lshjg)5~h9X0@uNB~hz zmZBIYM56(OW`X;yMyc;XY!z~n=gX>twFNR?Mi_U099S5&v|*HMo|RiCS$@f_*9jBZ zj-4Je9N=RZBs(!%EvR=ELuRfw=Sg_ZX6adDycW`YUpxGF=>1IJfVbbFdIaL&)6UPx?ctlGRcYLkB<38s<8qgM4?Xd;C&^m#Au^Nn^{oZ7v z)BJ&oB@n=;*lZJ+vRN#SNUoB#{MsFinYUFXp4*!0h$^=A$mHjL&)Gq9e;gaL#>W5P z+??yUt(Yn-{`_Gz?5@aC9@$o2T=DqSqUnkkFN^q%tiIbeW^5`XwUWu!qLY%hY_tqj z4BY^a&6nOR7rSk0fjC)bhyBeu{dzisgto#6(PROIoDN!ydP4=pj&WN_3gtZyC<|lN z2Y9kWsZb7Fvfkee-jZNCX4|BF8|)CFY}w$<=3ydc{X*i-+{t5UbF<){J5>=-fv$-d zU?YtywnbA~Jrlt6M7mu!(WiuBoiff-Z7LO=QAnPOT&}iUV-pB<&{DivbWFYnMVV18 zm5ql?x^qvREJDIEUdO?M&KJ28W<6L}IR zDxWe06N;Hl#_x>%l`*%=N>uTq`K%``9~m@IeQZT?wW~>tT~Wtb($y0cTn*q^@|w&`1<4tzARdrg!0Aj+nFzf`{xM11Z8;374CPf_DBAIb9>t6w zQ=TrVS}`-lVhp!ltq$HNs<6F2VEUoqQh4OZz9*w&LVbR4G$m$qI@(vzFNmRF*9ITy z2OqWK%%Lu+O99nz>k^9AvOq%#EeJwb)HBH?Gn#p{XH4rNLu!aHJVkt@$)Fn_4nKEe z2_GkhA2Z`3(2a>2dTxleQ8-Rpy9EG{7_ z`7Po{#w#==a3GyH-lgP{Y*BFOJewpO?<+{D~lNPxjXoKsDe5l zeN~?Y3t=`4c7T3C9IHCP%6wisE9#5vB;3X02+RxlN}~98CtzF>Tr6yCQ>Au;A%x|* zCr5ceL)7eRk^i#~&Onhbklcg1aailDiEk_ZbdJETjBkf;>-*m#rnzBQ>(%5onc(~E zeJ}|wISg#%vTy5u(0h6jZO@}FvjVg9!2G9C%Dw6lzh|@OW-vyIkCQBV`^_~a{cPdm z&;a|X>$kMdu?H`p#`bW`#6NZvC=RT}qs za}}V9v*+qOMboaeAD`KowqW|Zw#D8LehTFil6 zwCv&|F`)c~lkF@_sA;XL0>pU7h_U1#-!Z=zR3crtv(n*>DlV}U??{3C1P zt7ameeCgVf{LlG{fw(hmi*d-+^zQ+&e_IDYxa*Kwv%d|v>J*#jg)czyXSin+T2jfB zX3X*xnUo1|Y9m8dE)C;5Oo11bA|6yD%9)479QYO=o}4CBXg0K5GxyrTZVf^AG;UE? zy;zKDqIK9um_u_6eDGu(__)~AT)QIBYN>3P#sM~1rzYg#8R6s-SbC+-a!*7TsBnWL zm4xNhHC?t6X%*NP`%w}o#AA^1p8FvYY8-Yf9`~V=n?%-%z@cBboyiV2vFRIQeCCk5 zW9p#I46|Co4pdO!1{GX#Npw=~pekg7Wmh!G1oH==9qIf({ zb3N@5{DeV9er7PxZ=fNzP`#XGYKKTJxiTPMGBnw;FtbH6-Y6DPf+#Iz)yEM5JF9KK z&g%ZQ^Z&xphU^|U8>L->OdG;x#~`|-URoQ|X5%c{dMS1ATUVoK0xlwoQhA?8h3s+ubM z&%)hOlclDVPJQ(|D7AxR!~O{j%8~TsmD~K6v2p{clb{HBE&#?MaxTr2p6D%%SEQT2 zAovHtmz|r3izhAf-N5mV@H-azesJ-AaA-|7_1b=sjj{CZX>sq>8?DL+<#Rc&ksJF3 zPdvTL01RF<ZXeC6(?f9{0CH=+5g!|K_JI57}Pa2Pb^oYbgBq{nW zbLPSLL~2$w?R~k;Os*Ookm!f@g=>pqywiSVF+jtPl89anL7Pt*;%Y{sM_{ep@4wZ$ zTa!__8ze+SNMjx5cFVAI1>mP*1kWeM z=f%a1ETaCox;i9IQ31_n|2O~^06ZbpXjwl^(#u_N$qyU5s9qq-f36R1j z28rWd#&3u019fEftWE2RcsqVk0OL%Pb>PE^T0Z?n4o^!3Qac2~Uu6}jj7*jyW=I0g zzk}`&-HIYdxNLm%r-Wo{0G0uG&C~~7h6R=;H5-7F9&f;D&z2yLVnO3$n3}ahstyAc)#Hjfy7V0kSoi;JyxUbs%5gS6rncYH_O; zuRYV7r&+2MYjSTBX9v6<68QAnpR2L3f2j4A%y&-`2|0(gaE}X-&z*F#^w}eb-aP}| z>kK!ImW}T|0&`OUY)F1=AaFBK{*tk0_Xi?l|BT?EVUKuF^ft3YI28jgp3x!bNNQdg z6Z(tFqRNeo$$ijC`6|nHgB_NJ8bDAipYWHPrg!uiHNr8d*6wmC80R9k=bhA#YzIDm zo-1P4-LN)Gkx@0(-I+8i_l!~hQ>Ww2zld2=y)bPTZw=CQdzBf>luW_Oe54QV98tqi zn(C#8-3WFUSw>lfQTTty(hVdB|0he&2_n{LS|>6RVq<&b`Jute{JemY%(8=RVu};VLC=NZq}% z)Fw?ma`B6yIiWOv@!6U-qk(GJeOQWPb})UK&WxzDOjb4|BLxfzRX0Z{@c)&i_sBpQ zSI?zyn!tiKm<@Om^ce>j|8B~9W?5Qj(CWAau8D{Tfyz}B#dwpiz1wyp^O(vbZ^3{P zwvw=u_06DJ+|by57Zy~Mja1RS%>X}#e=&XW8%-;wCoLvwkKAx(_}{T<5k`>Fc+R)M zijdj%&0HenQR3UssiO1sAhvS)HA3;c_OKV+CTD&p`UTNF+sokJk~e17ew^HpKHET8 zZq*<*B(QLXE<^Kez`f|rHj0qtvFULo&_VlB>=9#}p=WRw7G$ousr}Q?;9%v*(`NhA zbhoYQ=yXoH&nFO-px(nqfhKH@sH?u3qUfue-+Btc&=9!*x2joA$oH?2ni0uzP{Onn z%Rg6opsb*{Hid3u3g*MfsBgHT(t>>Y2p3ImsDHQ(c6O#fkr~IXYPy$cu9@RCLvVm2 za>b8?{hFcV01`qoger}rgLUxUc(fElE8j@<2E41wQ$iQ;ap`8)CI5}o`-aLw?TD3$ z+_meqWjRtMbLTBSj(9}m|81^}o;&QIKiUAywsj11fZrp@fzX|-yIFTMjHB4}PG2bL zcZC|np~Ry9&eS>r^Ts(tNifjnV6DKy@Mms*!LlpW$5Vs~Rx^Csg6fFdwQ8ZSIF5&V z+@MZgBGX3#`VhOAdDLB{Lv+e@m9g-DhH94*rUG|~exTO=T{y%KlstzM!5XSjOeH>q zQ(a;-ayD`Nzr*V1@$_{u#n}nbyCMbuZk`4oo?x;APt{ZC4t(?duIA`4SN|NaV5_zn zHpnmU$A1jaZFbctWZHcY|3udNdks3gy<`Z!ew`24bM1X`e&hH$V`H-}(|Wrlj;=f& z{o$KG(3ic>T^fSKRsNQ1br`k+067uiK~p}wi})h3x|3oMduGq=#6l*l#Qfi)b<7*O z;C6jjahM#qzG*QAW9^RyjE~SD7TGGTJr3fG7;Tyia~Qp1}j{H@*@_caqqeh?5|)e00C{sW=Alf=U>;` zo}}*khWd&U@kc0QARHXtTY6HXypH+gMShZE-*!ikcE?^g0h zBU)U4a(uiG7vmLEv~IejP*yT|U?6CzLx;E_)K8d9jC6zA|7WVs@UHaVR2^=xjZ!x; z!LDImkQ=&u3Lou)+Um^HGByHxlx}F9vTWI|pw8B^( zM9^muDglxVlfVl%y>c*o?Q$vGS~0}vw3IJnnT{HJ&v#PH-|V~8G|Cm_3WuCF|6fhE z9#sY64XgrEEZyTM5oXR)(}A)+T@4eze>HQV@Rzg~@7Uy4a%-+*q z4JTMdc`Z(uv3_7UHIzk_d-)C?bL2i${-6bY(@b9EAa@@ah#-^1Jdyt%afN)MU6?$T zU8%ztSDB?|VFSWAmsPdaRD$(bvEy}r7+y@endY1_n;v%g`tgr6EbJn$t?uLI!Gs!c z4lA+9YmfBXeeUY~f=q@@aIz4P4oyajzo%B7zA6Gzv6i%+o!p*h0yii~Us{~E4?}E& zcRj-{4lb+0N_`uqqVXJlsHuyp4~Oc5h+{y&yXiJxK;K(OoASY;C^eiA^)VUp0YGe{ z_frA7Nm#m$M6Hg87)f%eh}u}<$7mC4LLKTW$L4Q{Lfu(mRFU}jr!0mFbi*`6kwYp^ zsy?i*weVlo*F&|=W!T4_KSV1;m7{hX*3O5XZ_*&HbP3xtOl__vJ9El}O& z3y5j5ptv4rsAB8QoC<|1uW_vS!(=EVVi$=#Y#;*34EwhCpL#Ni^0gC0(ZO}$l2$cJ zIGWP=SVWehMR-Vs_32NHnLlQaC)nuAiPCgqj#nVSOI&W~dSVMwzUTs`5K za;r;d%S|#M@x81cM}nfy0T4#L5gc!5uv9a2j&MythVx>?ND>V%Z}k;l>z&VOx}=Wd zQO499jE>OeZeA+>ijrqnZHP1`vVFz+Pq6-@B1Te@%lb- z+IS3&s4A+UICv0}9YI=@`bys&WBPj^PkM8N$JEp~1LUBSg4aTyU)gsd`Q=h#Y6kP@ zvnk5@$zq|^;+0+VgN->)UMM|#Dbi{#Sp{=#$Z#BeKw@>9n32^xKIzdw?b-736mq+( zl z$0De~Wm6nDo)esjo?+?C8ag;=<;V#F{r(BFuY9J@+!ay??Jk!C;oP*?Wpz0SU9DH5 z1FQlvaiAtB{CqFMdc@Y}&-`KBY@}1?Ph}66ngMK@9?FC(M_614BoQe6K~Gtv(ioNY zdO#rr!)7wMoE(8SXmmbE5R&SzU9GyipUSoh|KCu%Fzgy)UWJG2vhky7M?%FixuBWpVX~aFol+nXKc2XdKWZ%Z zbDXzqas&57iOZD%n{kcr3V;t)2($`zP z*5fR~6J>g@Nv%G-63M93^PJ?#n;OE|JXemwV1764?{C$ujr1`O49KCKfveEv&6zBm%#mAJrOp# zzzesXWcv75!&RBY?7@rO%{|=*L0->74rRiq-3fOBfREBS3se%Dmo(_{_T$v*N<)x>SF zmRE$rISao!gO~p|&l|dxheu4xzK2pFSH?z#!Df#1myze(y<%OVXz!iVjbt*mIfCI{ ze7u6msS2A;Y;LQT0?v%s*fFjFmHK{u> z*VVcK%6{Fjx?kVptMW3No(G(9KebH;brR<1UIm$C`XH^WIL(PEuQA|1pm>ahIfW)C zmU-<|T>}RK-y8P^F)*M98*~;I)$W7tLE>*^$F(>b-DB zV6vV7EC3FdjK!n@RSeDB6>vr+7F^hSeRfOgtv;yxG=RUg*R??atC<1xonw*VJ;vlh zRa$iPsLgBg;PR5AWf-33IPX9ITJ-E8hcPL9nH*Npsd7n}Mqa5p?(J0Hm5QUWaaQ4u zMWc>JICOABR5~8 z8XO$hrdgtPN2@2tAc!A5n%vI_MQxHJ>8-bM$7xInqwVwu$sC)Cs?ig}zbJ2&IP#bZ z;WO*}q^SK3aP-ItBwK=bc^M)x*Kz z!vj?hHs&sS43Sw6@{-Ar6wK3zhUf6e?hb>ur?FjBR@%g<=H(*Zl(7QPS!&lqH4Na3`9B3-BnRuaIx-#<)pc!kk{Wl^9*9RU=D*I-r+6JLbc}w#u?URxLu7`}!W(EQtuwaV z{3~?W)#0+ISl6O7!AK-!mbX3=zycd8ZhZD-Vz2P*zJO8*ol6g&wLHb2gfkOmk$(vM zO$#GAhyf3B>|an?B)FtqR;Ed5n1tr19bCM7NW*laRy}%px+(=Pk7MM)_Cyjo@{9P3 zuV!1_0z~FgLr}Kl;I4eG%e(Y}B=y!>l7TK$3L!=*bq=ZS4#Iupjy2Cj(vjPYi>t$j zxs$JNeQ!#xG+#Oj%c6y`YJ94<^EBDvNo!@|=Yj{xQGj zMV&>*xn5-nwU7$0PqsPxDu|m%3Ut=bkOszRLMcd<+HrfKgB-J1XXMdbCnwIJsWDejJIA&ca_z}=)nPu z7ID#9BX{xk=U$K%7&gqp;%k%HV&9Wj1rd1(QDL+FduryF$OGR5FWXc_`WrPF5W54K%Z=X z_Zml!tv?YueWCIVIP7HL1(LP)C&el!X#>=nN;lqTW_+ z3w&&NM^MJEpN3=TXfXMW$$YkDg`g9^=L)Ad&R8o!7n^-!k=87w6@!z?5xmS(@&n5E z25Z%obc=zBH#+_y?%8$a$@2vj=Ts$Zh53HVYd)IWrBd2uGoaphRMr}TJqCPcewdNl z7@b*BpH=XXpZ8dwAJb{|0;Rx2pw;_c2$N=C@4Q4vi4Ll&(+jBm%in}?K3;q(hLeg& z3`Fy%#-eFM>U7?1WPBWI+M$yZM#%%VsDy@{@zW}bz=V8uT2~g5OfsI}LH%ESG7V*x zMw$;;sGd`Yhke!!3>xt&UDh2TCdqWOtNM%~jvRunadcxOsZ@t98;Wtl0&Ce(+H}Q)~s7sfeCcZK%U0BOmDZ~-Tkck_YwSr*>ZbH+B(yso$~pFl$^g0XkWki zytpV5J3!7DA1Z~DJjOikAyIgh41*Yvu|?|*O_EnYfE{Ge3E)cD+7}0PPknPWB#R8f z9HZ18!-ps}w&8`g&UbNp20vDO05`IB2;mrs@2oYzzwR)0;$x)x8p}l3+x4P>DTk8$ zRwNsV|AYqz3E469H!I#)%*e6Jp7ybC1c-Agt&HU8pMaPC^<@|JQap;Xz5cZgbyi!Z zNw;4896NV#{OR_!Y8$muLRqS$*isqtnhZyhHTP`i;P}f;mUFIZNG75AV24UsMWw@f z`xxg-A^7Nr1uZ#+I&>3YyePE9Lelj5$^}881A#Opk#w_pB$PIT<+hKUt!{^p5F);P zH^gCWs9pMKUMb#BCc&%d?Rr$2H?2rbC%!0SAr={#BvXtZ ze*OpfYuRKT^x^d-6xyX?s(j{F@tab1B!`8P#z_%_JMvwz2)36rv4HwGd6~=v%`zI> zTsWF8-Ueh_V#-=^B1QeU!;8?486!^bahjB>9e0}zI6dryWe=rAU`Gc_{X~SfQ(%CT zX}q?!4o#5Yc5`$1)8BrT+9X&w`TBjL)htFB zBZPZdd`8fA@xY~N3R|MSd@8(&t~zmr-w)@S1S~E@n7Z_l@C z@rYI3(Tz*Y!r&76`pO56EoMl#Ze{T4avJsPM55cc?6YZ>c6T|m2Z7c(JV|vw2e?k! zEaDt)Z&)FO!q|QaPr%VJ8E^L*F-FM5mK}(OkW+(!KW2vsviH>D1PR8dc-qk{VaM!A zE_c8|f;N-bon12Dv$QKgWpzECju86 zI(}_A@(o{(ybdR8u$;A{Z*f-;GQ|wk(lJgYAzc@iMbP4x8BU3=+ewvj&rA0NDvx`? z^sf=RM4Vh#Velz3Ix0fwoHD1!O=EQ{gsSqKh{>jJc_^iqbRLvLh8Mhr37X{!|m(Z7eZd0#5utoV=MPf!s&IWco(LxX0&!}I} z1i&y*uubaYn)&Nd&g%DC&^7xJmqGPm-M0D-&?+K7xRuL`SU||lro_zs%aI79985aN z7KOAtL7amUR?XQ-LfBuY6mq&TGN#XI__0zO=mO~>3w|Z8;@G%wEnU-;iHzj z$?8PtkAZ5Ok?N&;Mr`|L%Y3jtj?)!6jo{@bTgpIu_EPV58rzK8;k!_rBv7($7jGrV zuh!xCunLToNd)ft&-s+x?rK8XC)UtjfqV05t}f4v;>Wj=3UEC5O{N;D@?BQPZL zO9sD9j?J_UYZ@p(AvIwY%-a~g{-jxYxWGx5V|Ff4YBGC}GYXarZ^tRn4NsosogsU) zo1#}@TVq1Bl{2a-Cnfo$a$mb&sMz5la1n*0tryt@3f zFk7#6N$d8B&-8CBhl;4$zQdC8m4{*^HUfspex=6e`kCMV86%$-fI@kxFKx|EKUkzLe z@z3BIFq2XI_o@~eH`uOh%(#3vH!*j@6y65jW|XLD?8_?)^J=2ZgDlcDzHdQ`?-e0U zJ5c2B*b>m%&^bx3YKnM?aMw&72u7KacW ziUuu&^pfx&B@h2BxkXT&p?E<60ui)R z#Vit*3jh4gVr7kKKtl1;?)PM~YIO`k1${6^EpL^wW_f?~SaI9^iqw||LD9%$m7tHY zFY}^cCDPD$Ry5OuZCn+AkBUn6>;2?b{%}O${Pp6W$@NM}ip6t_P-*psEE4|Rnk@KO z>oPREg!~HBWf1QTc~H)R*_AoF)Ezr`%qD0l=ff?(sZ7ddO!~3B-!_c-JxEQIpG5xV z`uE$#p&2ngEa7>5Qond#Qk?7TiDk0ig*#GdzS*YlTRZgKhN3J(d)Sj^X{5wk!KYC{ zR@@B9va5aC7!`=ruGyg8$-qq9T$U24dspMM&SfOea8*BN|Nbp}!4Bu!@ILtkZix}E zDi-O*mu}iZ^tUUE)w<^=RbksnA)ohNSWFz6wWxrJ3a-=-zRR_T!8jnC?-O+V#bg1Qa86d+>p@HdB}UugBCLDtu- z4%e>$Tg}gcr!-L)7^WGF)1iXiftr!%XBFJ&$n+k*>>kl;4_uG=8XjBz-{%-wA^pvkiD-DSBZ-L$I}N!!0g=tBfy~o z{_7d~^fwh10p9lyl&{cbDG&16<@4nH*POo^Qdqs&p77K(r^Mb$bK8bbTBx0GG@4=Y zz+Uo9;EMENCQ?RpW@Py>lj{su7Mv?zJR#(g&trII13zSp`&vS?`{0}EJBVso_U%Ilh=|K>$yfqPCmk0I`^3`(f4>X>KE+0(3Z@Dl z?$~a}qy9)meb2L+o^tgew(ZAduhqMf?JI!5aDbt0_FIhyeb$m2-n}g-xQyxV)VD)g z^z!i%ccJ0}nbLPO(})@s>LU{pL);qUE1s#Cn!wDl&3jO`7LDMRViFesr+Q^*w4suq zZCydv=1qhx|6_#P!(1_%hc_2Dje{brb947Mxr`bwh|r$}P`R_f1ttI&b}C_W@dK&B ze4wrQbG&0NT~y+%hWm_20SZAgjL4*XOO2-Rh&KIDX7s@Z4K)5+pD6zVqU#scl|LA~ z@?qWo8KJQhqtH{-hddrz^5H0`JHrbgM!04%+KXL#4J<6M8wcMd>Ur@P3|cJ4>QqVX z>B~Xqv83zPO>wRriSH>&WeS%GZXhCg*6F*Yq-zgp$XUPM((wj3yd3RyZ+Uyr;zRb{ z>isItBbaEpY_Q524c5XfNBbQJ@~QR!4yJ5?WEWDWiGInKmqpok^|KYV%As5eD|DtZ zqb~N7dN2mmDR~Li4RVLIXZ9ghrA`_Y3^^0V93vk_Y)Eix^2aq3O#X+)H#K)VT0t;}_bevG454Hcom1bn+&> z6?Pq%yBa2sx2w<+P+D33w{5Y#PIQ+{y~`i-yXyD9s<9DLR_**6CdB&IUQ&L--Lp?^ zUsIxDz?EyaJ?_Ux`*G@ZFBglr0d?Helizw%HEnndr+qZ3jJQs+*>SsYG7T<@{Gu92 z)TPiWVOZ1+W-86PDr{q`oqbUOFpkNrALKaoLB{9ar2R0B{;?{?Q$*o#lz+e*9%Gf) z)gR^XwC1s%PV>B|njSk2K=4biw|`oq4$GTrBM8VK4`4q}b%9lD|MiA%ktb5~S;_EG%o2gjTA~73*dsR}1 zA~Q)lIhi#v=kY3)%l|79x z`FE%&&B_4!5p}K*nfghurcjSA+UKr@tq}Jj{~NX=izuEAWLhO|d?kjQRTwjU_PM9N z#D~AAwj53~QL4D|9;~at*fQbzxTF~4zs-|k1h~L;&3Z$l0zqsLhboG_hM$?mEZg}f zlC?PGt-{Q>t_elXf>3LNa1C8>0-7wz#Nqj_Gq9w@v1*3R2HH}F<7R1?8qiXdTq0;! z5Z^+>wM=n?t|pfxx-J79ikP^7y@7a3H_H|7YKGTC!J=;IH?9c3G)x_&iH6iZ{bDYu zz}8=jUE$pO$_dsYVmNm8WU9J{3`qKU#Erwi=Dmv8w5P(y5$SaUjD88dO-z+?=N5q# zhl&f<$ADw1s^|<0G<2Lw|I)&xD zY{89LM2(TVOi^;&Q;S%iupV8=0{Tl#Y;%L=-C;Tzx1@-I2v&^haV7R|^&8%vfr|)I zUYjDT$v41PY|C|>sE6#sWcKhtmZn+7S;N7bJh@#%Zoyti!lDtX2&crpY+ja`Cu&2L zCJcx)g>0o;lJSxKd_F|v(zUOWsvM9CnS`*&M!Wq45>@9hU2)OHZb%*HE{s8g9~!hH zLec4F&pYy#@K1{Efp4=vCb)Xil@0%+oda@I4g&JqTbwHQu=)g0_z{RCN0v?51kHvO z@fTRm*$+O{s-b7!KUT*Rh~ai`vLb9&;zH?Zcsz+@m`^Q9P;SAl8Rw`8Iy-+#Too5A znGcGqDkDgaZr4+Db(l)05SMXHS6B?4K`PT|E>+-3Vq|qTNMU4&rn?pIW_?$O78>Kq zmne|dz0yNS?lval2}2#one_*u+2M$siDc%n=Y*7+!9Fnq5>>!H)nMg)Hz#O`lOi;y z`wH4ECi^g--UQ0^Sh;UiYsLm@{tp13Kw!U0R&Stk3VdrIRk=O@fIAz3Y?zI{!he@h zk)G~m<{;91Hm#+7y6{nhFYls*VzZ2Zi^-qSZ2RrM{kQ-A$-#?%pG~I!`!BPPzdQNI z|M~IX;|&08JD363@Kk$@==&bzycB&X^!Z}=@j=WH(w2O?FYTu%fA|^KcE=?cYHMH{ zU>2BHU~vY#Gti*G)&o2o`jWp;wW|#++U#xvCo;akv#*tG#qW2uzen%kZKtge3_tHS zK>(DEfRS*c_H#5wI6jcA=7Q@*&nbXqz_e=5LKUsE9G)c*oK4sw8g&QojJD2BLiraIVY0t0R^C=DfI87_-Q>&~s;NGdS%y@m-PV;w(rKZb5k|1YyBwqdirPEz!|%8R#MC{ZOW+yY0nfWN_HKZ!ws!;U-2mA3 zZh*ZTpzr0q8({AS*lv3_0JOauAk=ods(qW4C4bBnEfUzenvFinI#;tm&6Gc%lJ_dO z9zxY)PjZ#5sH1o+oWe0wVpYM7RlJh}>!(^6{E#o8N}?)obraDQMKl=o)rsf=*F}6+ zWqG}BY$)JhKp8AmbEO9l&u+Lth=01BS<#M|3hj;p;7)YwI>FHv)fpaVlc91w5+l+uEr#T>Xt$^ zAK(ImLijTEOMRhIg`T1F*5{(Bnr^8=v37ir*lB{(=Zq|P6T%|tw$7OCI!@H8Gmw^i zy&kY?+aO*yh<;j^JkJ%@5G$%CkioXyS4L)|_pIXiJ%gOM*~ltiDg&E+wQ=1|mNv~Q z1*?CHe>o?zo-bA^hGLA1>~2_hvr6YaNIBLNDJ%00WNWqyF%9y3E+h&yxP!gG#_>Ic ztg9C)2IYlH09DXMR*lkVn)3~z9W>{$g1~)pCU`6tc$a@{qH4rP7w>p|#mZGy*DM|2 z&?*_N#97(pB^QrG6ZP{FdiYdvLM9|`G*wf7>n-9ds93~Xd(Ll7DeU;IrgLx`iNY$; zy%A?2Wi`!m%<3G(4eOH6bGCAyyRk`a-8LY}ZGfZHMkrI~Ydjb2=6)L(s!r^x8KYsA z|1*ZUlV=KbC(+^V1BseiFgu03lig!^$uAcAPIkA`hlRisn@Rg%hutr`%Do8YG_qp2 z2CN3+48+&r^;R*UVf-*F$QL;13JU<4qC$Xg19*svi3gJw60#bP$=T`T z?6cp0dV+8w98&fX+cx9Hzzc+Ka{2Yw-+uSz3&DhZ+@h(5)x| zcL}2IBRuw!wt4p`s$Ne2Oqg7@M|2fB+Unh~6Lq&l8uA!d>oX4zZC)f0a6wPXm zJla&uu6Qa@tOwFmV9u3m(z zMb?mTzS>_`!qsAGO>DPa?#BmS>h5&UJq$V8*G~-*`?jfSL?P4QQp&?O++9u#7W842 z{lpFd+ZCKWM*xFKKKTUkUI!#369ow>`*m<|L_P=POrV6=nTUz&2E^U!;oxNJc|Y)- z-3DK_<7M+xBu2X^Jws-+g#Ot%HTtr$_J8qg!q72H3j+{B7?B*t-Gt zZUAU|H-Kt;H-Pt*y&GV={kqem;qe{rXKyxZMzWL@wTbG%h+S2iC$6`g(DgdsOv!~j zs4(W_;_4D(ImEHMS))xJMKQ@~RjK-SaMYBH*+Je|GO0QjO2Z_IpucBD z%0&+^F?4Rx)J+-5vAT5Sl0V2@bkE8=2DOa}Q@xWy8f+9vZ43B70d`Qgp|})O49W_# zG^*Clwup(_0=OO~6QRwz3tnRKi=3mlj@nf~n@ZIPYZVQ`NI7yV1i8PyqTQ70FSBT8 zt49*>1HsE!~**f%XJTao*vUl46O)%127-A$$ z;tIHDq(jHkWr<-J=AfZ&fXsB0Mp1S ze!qQ14i22%Iyg9r2`3#ojrxd*oJ?^(xa-|m^E+$`fBVF9`06?4&>6`3w7j^pFmo}Z zi`cH*=%V#pQ@I;II!QhWLq5qozIv8~MK4Ay0~*~IRfi%aZJJnaPR!Xq8i>(ML{ z82zgqMnAx%8t+KmU8S=YBBU_145T%S%oM=cg!w`;hl??>=FWZmA59?(=qPHz{=Zid zzWvr91E^h=xKB4XfQ80vqzf2lbNeR?{607&Hit;O7JdiZ(D~ zfPV%;{R{&4QGh*t!%rqe^#2elJ~&*`CQ zz;&JuFlQh{j)A@DV}LLyP9MtP>=r5BQ~rrU~tSDyWxOa2E$)ON4xM!nyb%TKWWe8^GmB zKw08oSfZd+einJLGhj;ezKH=v832P~<9GCX)_uSyekhZO3jhsu@?_v8k#Hp)0Fo%O zZh#U$`ItH}~1efyFy6Lx-X(dO0d{{Lr(HWZO@=q1n28^#D^{7{y6wF!h zV)7F!xx_OVOFVC(?FvnouNYzLD$9jH?N6{0<7FRdQrmN<0$YG^%GL~{kR(3#x@1XK z^#>x+qI+L1HQs7UP@kb`Mbi{a0Pkav#Fb;TtUlDr(@Vg))0;pW=o*$T@OPA&PuXtKQ8d z`7Yr_%|6z$SVU8?v^RWuCuwug7=uqCPDwQalh+7v3mH zcrf%)l$*NWK`o<`{4>}-z*NATj6yOOA65(N35M|D&KG-o!B{E; z8%di|#gx%}y`-cP2ZH}hl&Nvj^)tcfI0BisS%txJb|j+tVo1qsM;l`}FS&U0rWJ*1 zg4V2{MK4KL5g}MDt_q*+31gJ~)+##9(xS1s{R z11;=M5Gu64xv~Q^k5pr!9KbbRk~3Q7eoj#KE-rtbtuj@1aSc{-IsFC z9}FtJzTz7)u@3FQR=_F*@D1?_^k$c~uYJ@Gl%e7Z5Kaan3Wlv}wyye7fz@@cn1GxK zF0{m&N>{dG5lNmcSh7j-9(>VG4{@1Sj25*pHmHmouFyiwiW+I-TQM! zQlSiIg(|`nzsp6t1|#JEXYcLX+_;T=(f{{Tz)aRNqmUfEINq#IbbM!JIo1AR8R^s@Y(=n=_)L>}S6ZssJ>)iEb2nIC6ZKeV((CIb=0ZC=?3y@+%B-l$hU~ z_$QBuc?)bT*Gtn5K#i1dtCjlaLf+`yRktDauL!6Aiehap^G%vxO`A&Y z+|9mD%jQYaOIO>h<}`8CP|we(RlshTKF+_|NEk>#ZY2DTXYDObZBkRqoxVQLMmW>i z$Vp+237T5Z$ZWLU6-wqU!8F%_&e_O`r)s*>TvW4B@DknNft$$;y@i%0@m?uTbC`y% z8Fd*&IBudF9g;}G5fsznFmxe`sWT^c{}~cMCuIVVI`-_j`bng{eR_s>-ie0x|I}S} zqO!KB9d#NDZ-V8)E;gj~8GZZq?JGF%Mry50xSQ1WCKgvcvUc|1T`r>5hKl%b@IDsN zA|A=s2rkg83MROn3Ev~(Et86F$ps4DQ$he89{h&{`!j@a58#gv!iP+^1@+Sh z-b1G8fc*5s_K+!Bc%M4}>=^{rGZ3U_5QNJe0P_sMgNX#=A;R#)>YKL48M0te&^v=x zESkOX-8dqUVPe2_A~9eh0d?Y_bZ!fxLuS%#fOF``xlx$8#AHzGwNbdW z#O+K%taXrR2_%V^#5j27Zj{BW1F~GjvyI<7>9RiYQ}87 zt!z?IX)d|EY82jtp<3r(ASrkDQxH%Ti6&H#ZJlUN$X%;H|n+wM0nQ&7#k;#yW zC7l#p%=xE)bVhd%jWHqX7O(L)pt{hdP7W^t&`@XkK-MEErmR>bk~;0#h#xHai}s%> zBn|$Gl3}O=0pP?k&9Aa%EuF{{NUb9fwaGb+DxWb+0dZEDo!4-ht>g_`^PHmC%-eCw z`WDjhBI^CGnFZiLf-L1Whnm?2S(!79TL!1|3MohNTV4B6$SgCs zTp};G`o=pOz1A?6uf?(?#U1O^SDmJZpu;-FwXUeS#7`*lj%l$lXT?I3yeg1|wyFqU zx6Kn#WINh9-_$K8iy4c)z!?W=*b`gGOCV|YAjY8CJrjezX9|r$yP4{&ER#1R(|Eqy zt6U!2(w+U~qn!Po1@2rwQaAn9(lV3JY-8=}b<3BsdL@c=T2(|KX9HdFY1ThyB83`N z#5J|0v+M-(k4+e`M;au(~y?6DcFPh)tTT&IaZlnkuoMlcUkoH@_LIwpsN znRHE4pSE8>Ov$+R-eqW0J2YZUS#OA(Kqjhkn$N zlu7pn#U*dDA=z#07f9k{LvD%GWKI^3mQ?>N0yT+9Gnhu&Ku;nPZDK5iP?YFIy;w^g zG$kU%Am&mFRf$NJjJ?EyHzM;yVlYvu$~(bgGEXEX6OpP#ZVF>FMQrs>1g8U?d+PBZ zImKZ$nI|^!nhkT69XtV>4biJH!IXn1W3!=0)&O=7;tUD<$vlx5P(-R0EP;dtMI_on zj3Qw|QTg0Jjv`}25vlJZNOfaG(bcpcNy>*6MWh)-lxku|5vkq^S;{=Wh;|!{IAxyb z-Alcfu>nX_^uQ&eJJAuT$dnCo6$zP&9=mBEScMR(BH7SJvg$#qiix!O5v{rrtH`v6 zAzPUz2D8OHQAk(zM^wZs^U#s6@QI7hkpoYW(YD*PKshwxi+Sz{`NcfZ2rzn75oKj_ zs#827*yn@Jj*a?x5x?8vzW_})IJj32rVIB66olPHQ0iC|Mxc2t3OnZh9drMVxqrvp zzhmy-G53%9vt#Zb>D$NLzhhC@u_)|V6lR`dQCQb=EDAdoh54W3#qfAB+KJB~n1~#c&lg zuW7=GJNDIV6ai?65X2DF-tfhHekI0COs}R;HQ<3_45y}Ec*@6g7NQ!qh5g18TmL0M z(`{8SMLwF~+deOmTVaZEytFS2#(V<&#FDPrXi960fKN<&1Yl1`0%b@fzG*k?FuYKF zb$dfF3;%pA@UKwMH?O(3sjb4FkQCvX{Pnuht?GRhAV}rF)ePxULMqzOM z7TFf?ztg;CuR+n?-`G>lHENb>Q`nS|3JJ`HBaKE)Ta9B+=|t-EO&3`*WtU1#Ue=vG zuuf>!fJ_exGoXhzx@TbE)e+r&;S4HsXb_{xwpwc8HU_MJ#d%$A6|AjNni~{(2j;tj z+^)N3kaIksda}U-JZ#*4<5+Suc3|-XL|vHn@_oA5s0+dKysQLI#;qPWH&D2=;z7^l zT!`HCKfqlIzt@9?R~BL+(rdvunwU^-70e>R6bay5NM1y~T~pFc{D~c;A9_wD`tMNt z629;55|X78G-;{*umX*TKUF_0-QB^9>1@kj^E6{AEr(gtgRP?rF^8R36<>~WafcjPt<{*B=Ga z_+q6Sl|nTgHkcN9)t%swPQ|qDYHIxy+I6o~*S&i@-`%?hJ)CtAQuCmjXvs=mr6o2o zo#jo0gNnb`O<84@q0>bZYjSa3J|htC6mXd76{_#(>X6pHvMCr?%hrE zS`;NL*~1=k)9Z)uW<4ctc;Brlq+SoRbe7f7+7dmFz^Wa4_WbR)&t8WrF{>NtNRjsC zni43vv=hI0`89yUsMk_*gDz_ZTzV<0xzBQ2J4h=QRPt>dt*{rE%mJIpX-a9mX2_~~ zc71G}3pGXX@?42(Rd*rHr4^?}zs_+lTU*W_SQs3RxE95(vD4s9uL}8L$9jyG?<7yy zfAEaw3sJB_ZmWF<@0G|!0ksE^Xl6OpJ#!e?rbuOxR_V`(n^rdZ?>gIRQKXe9Qa%Pr zNb_xPbK;y;sVJxHg($9UW`Neo(6n+csv9A4XPDrPwf)3;T(7SRu@DJ3RgD`E6KqV8 z2Pz+3f06OxN|dI~uY1Hx5dVAZ>53P8flkZZMB3F9a+yzV(kxlocuajga zCFjSTU+SbHl1O?|DSJ{RNhI58lm||aysOm6=(NZIDUs31bq7v` zjLg%cByr(mA^G6^ir>bN{8b+fT5~n7`y`^QnQ>X))oF>7v_LmLlZd%utomx3@#5Ks zO(DvXiV76DVi8HJgoM>0dUR02>X2mB=)Dxh%9sRIa^591F*PD7H6kIEo{V~%L{t(p zh9;nDTRFz=d;vdkbW7_lpiS*_BpsZdHc+RCZf#J5OpM6|K+7_Vu^FTaAmlKB(z&*T z_D+m}MdKXXGq3*Q>H;LPr`}nc`5JwdjFB;%mgBwPOVZz`@(C$cv?MxOnCPL!H zsrB*vpVP0>v)S~kANl0xpWea$1uRdE3GaS%cJH^8tz+QxK5KFB( z8cZ!4W@?*ieRqltS46zpyJ?QR!Y?)fSMb+03M@O_mRp`>JJV&U^a-x5S@K~Ef~R_H z%EL@&Bm-2g{^+3yzt;V&pd^JaR(fz6gd6ipFa%mv9MT^kf`;GnB>=VB2kCYQIlnTo zJDfb|0G=e^RfP(9@P&F?0s-GF4zNQUy~d?5cpNy;JTc91wwr`|XRf}DZ{;Q98@1Gh z;;4f*476mybmJ7Yf*MuR>&aniYFv*VTEaF*%wltRtrAmwh*Q1D^+gOMWG#5^3c`w)nolA(;_IWSAv{foGoQiQ z6OC%@ciO&463;=xgMn2gB?28*_k|dcRjwqf3*yILYy?OPG#RzVo&Rkbk}rh zuJ=r+F(tRDTnlds2%VISU-LBM^EB%Vh$zjPm6DZP-3hHh8nNxoK;77SPf@axCXtIm z|IBIOh6{XB>LqwBmaaRk`+8yFVfCdZORu5Q6d^ij_ZI#X!$d++={{>0&>TP{vr$J!x9)_{O0qQ9IU6@Cp?jpb zI~8}SeuGlHg;49+b2pjq+?B?|?`E~rYQ`zTZpH)Md2~zFlJS;L#$A5Qk4wv1bDMg^ z?u(Zdc4&4g)IqNPzk!{XO9%s&*jjUs<9*AeSHkVxBPy0)d@9pX52-4 zWYcDMk0#k}%_jw(8UUP*`-fHXaA{3-$3B}qqdQ%|VXK6Vqmq<;)eT--*4hZKZQq5- zWP+`A%c|J+x+#EVPV2rTEz~HsB>-Hh6G&O-Os^0+`!~Et*)ulP3bfX{(^g-)8CFEI zZ=}=*CXVy(Jyg%n+3Om>OASWO)s?rlcQ{*0sT8BjpgvdZ`8oS@t_}*%h+%xZfE1() zJdrXn8;#j)^s10o;91JA`r-aCApftqcDE5v)_h|>c)>T8taE_>_--vKe*Iu-KkFfW`Cp~XAJ0ZLH^y?U zEqc5#%ew{6MH-xsWJ3c;%^FB$@zBqcs82vDp8Ifj0>?DtIhkQe)nty zDe~v%8qEZeOnS)v;}98M885511&7QGnZHfLxjBvfzW;L*TULL8JXE8ag3EzVWvQ72 zZ>2M|g#)&t#Kd*n_HYvl5}i9&pSs(rbGR&4JiijjR5u}pZnHtEN{_x*`$}6N7VZJ( zZQp2dY0PVal$F&7XQSGTp&*OtP@*n_6ZK}2UzgwlHjb?rfzZD}kHBiXhMt2wf!^Zw zZ)hq}++XJGsN1&I@}WgQ*#+vZm^YerhM4ArgC0Hnw=cULL->$+hPqlLf5IY#-ijPE zMTdR+KX=g_)%>SQ!6m%n(<}R(@TPJs4=wRG9Q#UR^7wY6_^HmWG%qWjF9`(;MSnr^Xa?KG|qjjMvM*Sty>H9}W79jM;W8aNgR8|R8$ zqmxpf3iTEal73alWV=v?xLnq#MfI{{I=j*Vx>!(r*!174%wrOXAy^5C!)4vs3)Ho_ zbJ_bGnPwv?k#Tmlq=mxgLQYj8K4tcz8q( z)?Oy#yVE+Q@u%_QclVtCBy^4=t6o}n{Kgh&dU&i6Cmxsg46E=eJQNF21cqoQPL;o3+KSyilj#R_x1C^8d0ySO8^|}3fSXrps;0vDb zSbfCc{ieMy;Uce#zJgTiKt`6n7tCIg@L-#Z1&2#yF;A<47duKRrg;`T*DdXr+YCYE zr@2hT{z-W@*40S;?n3iak|kmx^JSJ|m(6s&kwwMx3YAYGuEYnHR<`PsVD6qKdHLYM z!$)tn^F*$Bnt!vd&dtFO{cBX<2ilYld3{ z)vlS$uSCIeu~6Et@W(RoAvPl?nYF|Y$l()cc3vMbv-8u10H{N(iP-tWf$ z>&fH3;vT|*voS$CqMoUPe9l(awP4O4b)mMpd-Xc(xyI?(4-%u#yDPZbEtE7LCbVkp zKVWUrtyU*WwdgH4eg6lwQ3F436mF~c880Wie6M5vev9{B`m<5zxMrhfi}$zE1T1?g z0@m%ttLJ)rrvOpQOWjjpHqr^$vk?Yk&A`w4$B8pHs8!;_CQBD-mF;S9+S!Pmx?Z@m zV3U`K*5|}M%^F+ww;yl2Yx_+>q9Lf*Oq5Z5WJXBjpVb2948~W#Matx-;oWIJZbXX@WW{Ie+VvU9VZFaLt7b}KHJN1C(a+@c-02HOC>Ti?! zZ*_`cFJUz-$nwKPYlMzObJ97bc$Uc<4Sz4!q6+3;Ys;sRWMNYO)PW3_FgbNY{xtQy z;<)Y?I3k@N<@lUmn|c4K;CZFA+;y6Sn1H}o>4HH9mSiG_s2k6BT9=vgVbSDrAg-WC zg7{r_p)oYe4StVg+-mT&|40DiPicgjuZpF!(MG%aXCus;D#u!4pcM$^@U(zoD4LL! z1>&X7j2s(jnUUxH6rDxKee}k_QT4JRutGJ9)RjJ6;x6Cg#6srfcI|SapDw0Fm!dU) zyDbz0Q_Q55+iH&^{bys5UZpt(cT8i?z4a@dB)K3W1uiPa)^tKnBFYM0B6G)0VOK0< zxzvoUcyT2vkw8w5bBS>i-0tY;xtp`S(=a{AsUBuQE8kxkN9NGNy9&^7Zhm?R0%g6= zE93iCGEi&^STwsMvRxCMPX`VHd}~;&u*&~wQZQP7M4y^TtqiCuHD8<))GeFz*;4;Y zZ48+=p@aGdiVWkG$?VwQB;a7--T(5C|Rd{W@ zRO@%iws{6=e}PM6eHpdwH{9kXpu=#97j4<^xQcmrQOp5@F7C4T)mzX?ezO zRVwSE1A`vic8G%p`!E1>YqboVklk@FLq;u-JZ6 zQr?`WOJ)?aqfITM9*ESoP`eD0D8TU+vM6*#iF!XI^wil5GLIfpxF5^a-2AEm%Y}iGPbtTxPgKL=3do&WdQXmDf>@X2dPo_t9)twHG~nH zBmWk|OazXsW`e0B==Yd9#rmeRTe!cGlcM$LVaTk*1g$TB|NBS357~A2Rf<0$oXJ(z z8a2i+a}{yR>%t994Z9j#EIdCPL+W`OBH1dev3mma-=!P6$=nz$NnL%R7ymK)PD@`e z&6ltdf5B5Kql~h)3%X7!>->C-Q-FDeJwGvX{-?8dYR?kt6|3{$+D`J?a#N=UzFBpO zsKL6dU@t_uvS&F5FL^-!RZgEoh?ZFIi9SMohD9&U+URf%3*W3;9_PRf%I2wCjKwiJ zsJuo5K*bE(thI6K_!?Vro^kks0u`{EEnq%23S}r|K;b4iHvn zrhb#WHeZ@XOMm=q?`WkMEg@4?88nebOE1ZXF(yF6XbIm>$3u*k&^Gur8ZEy}P~%{k z3ETUAYQApJDsh2_+~_HjoUF2&&ODEfw)BG zqe>QlW8;3do!j%M9)`}eW`F<3ztl?_$K{}!CvQ^)OM{Zb&kaO^@D%GH$8ng2Q+d1STJ2`-5dR5vKHNHvDH`^>bfB5hVyfSoV zb)3()d6J1q4Jm(r`iJTLz>gLyp64Qa+%RzzFLl?4x2EZXWhn%0VGbBZn0DvCsDoXx z1G8y*6J_#xffu|ISF&(2bSBK#3DrbK#36UGx1HJ-gHz^r*Hv+df&hnTScDrNqPD-AjY-6l6G)j60s?S;(K%RnvYYN|0geUxKcrt$ph%*@z8KZnaGys zH8Md>wE-Pbqn51I?m(X}HUVdaP?nSpSwmgREBt7?fl6Ryom@Ydi;6!mCnHYL49X~( z#Y(Jsy&Q5Q@{3o`|MKWf>ksWt19l!JK+3oYej@S$bV;sTeL-HUsrqlIPBfu6I=#Ne zRJ4sX<~wUfjiD}ltnsG7!us1*6g#Dp`MPNXn2zjqqJQExajHerG=9cpO|dDb>_7P8 zy~qf6di zUsa!6DzhEWq$ynZoZM6FCyz0Vt33VL(yr4Qc(va`40g9-CfqVHl)mOWjkUqHxkJxf zL|@24uryybmA%!ua=qT>X|+2COCg*(OmkgLnx*^x>2fxD&e^ zJaub6tz{Ku)33qyBGHZNQAr!+r!}3=6o&hxZWp%~yipf1Y%c*`8E~WMBFdh)tG>YR zjqzrcW`b=*v6Kb0h2$3AIAN!JuJ(ifs;piP85Il2uQ3g606h&);AX?RGaUL-7B{>| zx*R2%%r-YLY(~?~@fZLv%wHhCNmsKiW#P3(>^O@?FS7ZLz5eDYd+^}lBV7E{q+4*i z_L$}QkSPm!p84)W;)AmCZ5PD{Q}+B-sT21rlVUYx52x&+rmEw!n?fwp58hSMS?9Lx zT*l`jW2cw*rk7_}vDW&N2{{X1u(>bxl2)b2me$b>PV$(QQf zbPFsm4Ue4V>grTlcP%t6+pYx@DflfLu=ub^tVTgE6uBhA>EpLhA`Gd2@$OwU8Jp0FK@hLpqsHAJrV;{{xft?7?{B{S z35Nl<4GY-!s8-Qsz2bQ?W|vJCEAkD}xv08HD_&~Sv%FSoH7ux69&J_OW2&P(;J2;F z6GsfW59Wn$f#Vup(Ys9MY*_9KpdP;y;PEiqdx~_if2?uLt0qT{-hy}d!|i_M)D}c% zTPm4#zSnb@z&a$dUMIh3?)QNTh-#`7u_aRva!-T}_G>-dzEj_)<-7vf-W%$(uEY~< z!8V(3)s3~9%hRzKz5}3VdDO

%NPo+ERC;#O9P8FtvG$UAl9Lans?c+Unp7=U2f~ zZ-NZZ*@;2yJE=jp%!aJ76fOaf;L@00b#pI!j*PpZdFc2AH<*6@RZz&}-eEIv6ye!q?i{ zj|rM$pvmGF=pt(;b3(g6y`&YtECf}3TGMQ7FGXv253;hoBwLnuw4LoI+OWL?mbT@& zc7e@CN-WZ{3o;L*pia#@vrMxPU~r|ul=MVaw58HJA9@J72g7W1ri``O$V_}T8t)In zOBM#!W^I|~SJ~cm1z+Ae)H;g18+A9lRCiP*RS)hz`aKqheDhQZ*qCv452)Y67178h zUYc^rl*|;6CxFeJ^X(d{MVz(-vS25Z6YV!sB+H6p;)Iu|$P?Q-(ob^AUP_xjkuR#P zMF=x8>=yz;@G}_nbdW=4_h!?xukIw~8HjZb?hD|QbCYrSp&+G!$}WbX@axd`4bQQq zbn_Crhi7fxnCLNk=vpsiE<}Pjj!FQub5UP>onSq_bRpGV@nf4RyVA^LtPKQ;x?ngBpO zG+ghjdBgPBdRw-}K4u0*K}kd@HoV|fea-Vxlnyns;%axfzek9C_nS_op@$~U)!ih9 zRJQA#xrUkPQu?NbMrIk`lpVc0S{eGKT(_@~KKhDuodF3j%AneL1yeAbv7EFm-KQqY z(P#9x@*Zvb8Lh^eUQ_k%dee4-Eo(pmRBX%;hkNY>@ef~ObimFNO zJQI7xpsNx&SZ(a%Yk&PQrN-DtwOw@_Us>F-xdzk|-^wpx>1yR|p?9G%fjX9Tq~6%@ zUYfR`_00BTYPl;-V=E^^L!0FR!i6p_J(N{+OS{NR5p1Q~SVmo!@wcY!!~omKOS6-2 z7TL~Oa^q0cy58@Jz+?=V*8jo_5I{AltqRE^hDaf<)FE5cgV(?EQnhHvPS(D(W9hiM zhe5jnfL*r$>$*#zu0bGO0L0ZvatJ^du52gCXmGAD5JG>dIx$WC(*SZ263_dAxX2(} zLjkyy-s~hg0DP;~ot;#p?wanGx)(G4#;K*OljOkww`hPI18^S)gKQCmvL9UQE`YTT zvZ+a2Bu+m7qBR&m3p9Ku*?90Q$L#AqDh2>&q3zm9au{e-eC{PyT zog@c>WI5N$zICVG!ble!d?=Sr{}r=)p{Q5S_C@m$Q};S$1G7KOHB?g^dKvAc*aL(W zxRQ2nPA>=+>0;WuJ@)~y=tsd}&(i_GRul~6-cxTlm=$~8ZMzHrvg&qi<1+xns)7B} zE&N0Ps}7K=9@z?kSM>r^^=T?Ea8($bs+$Eq(5e_EAVrVR zby5XkJSY&=KoBYl)I|gUm6ubUgh}92T>w)-bEab)k)VI%^>13bZ^xL$W#m_L!TXR2Y3v3fW>eJI1B?Z82TW|BSE8RfKf!S zC<0Iv1tf|D5H%Pasv|n6hc^%yst}c*F0$;PyITnnH59?c;u+v?EIt>MM0sw#>6Cx7KDTqB859H*6 zHT5W&C=jRpW32b?M@5}%83bW>LI`nk@0bl(CLy%R-V>K#qP37Fi3UOU>Dw|CA`F6F zHSQP+1H2&rJnf`z;V20MBXw33+!fdnYd6>f*R+e%vp-1FpxiZz)Sjs?Z*$kD0gcA$ zv}!*Ri2FQL#30$w&8n8|6v2+)7u!rcW+$b{mQ$W(r<(_3R{zJtG21+tV)*yT6SjG% z|NZ&r>T{(bykzmK;Az2c!Xb{I!aqO%oSmxw_t}b)5 zP?;bWwJU#;xfrZ37*%JS#%K)Ir!@|uGnm;dXAL1F>J0Yz=iTQoNpGCBm=ct0)~z>g ztu@-rU>!T#_XgUAuf@duahnOZQdG>Nto#aQPY2-N0t1JypPlW$9O8oh8Y;~8=~5V2 z)!FT3nE()2KTJ0oJg<1QdIg1oy8X z^XcqRsphE>b`1QLc~K?XS+p8bN2&IX8q9DOqeFx0hx?EECk+%RO$vLSxUgE#V?Z(y8`0OvS?1tOSo3_x+;KMCM!;qJHAL3HT+qId!1E=$$FuC7 z?IN7!d#})RY*@c1Zw16YE2X+#8YypdrNKNNxF@QuKh|%r3cg&X-92pa_Fk8AD5Y@KGwe!r#V9#BfR~j7!ATGcQc9WI@Atw=^Q14Dt z3}(Qt`aEQ|v}tYt5?j7ah&)T}^E9*SbqT2LE(=p6P$SpXGpGj-b5S$s-km)&3yD)G zwq|`)=@N4A{XD>gQSrAe&)AJfuU1vB(=9=qs)h)#jVKnTRsgq-h6i!S-m_4xK&4Xz zwt~W6Ub$~cO9!j0mkSM-4M?KXjNPQi_!@-tg?T(Qp0B}9aVfRZQB734mvHT4wtmM} zqgh;_kPE8kq{e6Oyl!h8Q3B^(NWRWOxW*g+woV`F7N4)@N3_1(%xLfaFSQR*gQ$vA z0@N_j)tR^!S$!S`Xo?SF0h=^kYWdH0It|j=4Qa{d08<1l zpHsE}=Y<5EK$}0XG;AERZHdQ?VG-m>28gD4)3%$Q^~2H=1Q8#<`G`Za^4JEw4N^75 zs`|Qa00I)0Y>T$t2WM2dk$Irq7d~0K6pP&=6Vvu+QMaxI&mk>{=gdNo6X+-K6ko72ZzS8+GRC1H$?&9Ci?B8iqCCEXVb$z`Wm9D=g9O4Z74% zSrxnzS5N}0{x!+cb*e~db5EZx<%)08{A#L9bpq9^EiZUp332WgHl(#?*h{=45Y<6Y z+*1AR99V>=!^euvYq6w!zpeV7IlqT|tDMOV)|ri4(m>TIt$`U8HX9)aW+Quzm@;~! z6Z6z3-e|o8tH_c~b6xs08#(n<4hq|B)NwUyKMk&cb@lT5w-#($9k2_8j7@Ci9*M42 zt5aJ7h#xedysar(rGD7F{ilsGpe%pV=@8P(_{2#h3zy@ypN2>hO6UQ7Kg2G=?$cji*M1tp)L%vS4e9(c zj}{{~vS;~7t-PtLj1VDuhv&wxs4aQi=RgH#?PtI$_7|kJpT;T%>(lOfs|;d&G><6l zi`-{|N`w6E-hfW~%e`Ha+$Y#EsrhKr@mqiCNb9p0 z4QQliI}T_l^|IGB=ROf#xy%!P%<^QYUL0K{iTb%dWdT?er+8YPu~TSCLZ%EMhBIU5 zSzo+ZBBYYg!Ghj`m%XWNz_*MJuN@+U+O`xW<7FuqDeucEY(EwWRion9xTN`JTRmof zdiIu`FQtU5+WCVieWR~;6Quc=so&3X_7t%CAHxFaz4RCiR{g~e01Mxv<2SR>oEPIc z|9Li2FZh029dyuRO`Se2;+4IA_Ac+ZbDd5hfgq3n`LNRf8uv8K5<7PKBUU+NSfHl!uHvi8}RyMibroScI1C-MjbB&OY>4)sjBo^Oxfuh zA#6{UO3JL9rlML-WpQ=Bs@BGPnPaaJl60dIcgJB|joidRk(_StWK`>&s$-22^ZGW|b4%|3j2|KoqZ`yKrPfX{$y06uuC-A48O z1@ydDeW>(x#zG`j=GT0~m-dVM|NaTrcHk1k-Zk)vxE9nufyIgVP2`0Fp8zOw-~=$$PPjI{PCTx&Kle`kGU3f7oqt=xyOO{Mvh0=uM4pKPGXZ?~?G= z>}N7nxnz2PP%zxcUUCm>`krorQM)wo>}Z}+^pT#Hj@^^+idO|+ycb1n{UmZ>Eue>A zKKRmFKwm^zKt0!*+VXz@rhoj6;o)O8=SBVBkJNwv?A&|EB(+qsADz3=gV|{8-jyEB zM(?P%ZuN9tjoK5q!@JHPrTh!3Fg;#D)wiYSLBwc3?ZVLt+Hl+yX=U-`Q5keLvG6@@ zU8J2B#u-s77P`wpDTu=piAHm+yQsHHI97UV{mNUzc%VPS+Q-~wr$(C zZQHiFVmnzYwr$(y$@A>}f6v};)j3tOt9r~iyZcjj58S_N{8YvtpMbG<0N!wP0RFUQ z;^J)mi?H;+f0{c#kGEWdf;BV?g^~4O^MpQK^HlHTX2C}O>MKw_lUf;Do`WhSIY%W4 zi$-^BXc6l)OGGrOjwE2MOwLcheC@smn$77qLWD=NP#0sL?&Pf_Q5>Pg>hCp=JpWlh znht5cbO6=7_Z=Vt)^lHj!G$a_KQ)BAjzY^5pT$vkHv#*$%I5|dx$U;T@oN?xvsa3?@Aisoa#mBeaTHe%{Nj-9tHQt6c>7kggiWg< zGfcq1B@PZ-%FJ#2eg{s9){0OxS^=8aH!A2rSR|%)a)Q0%>4+w$g57;1@_9@+^XXcX zLB|lLovLiu&(AHfnDey!8~-Ptv1W~k{3(!U5oB!(;u1(ZB?>95@*)L4%&mB3u9KAg zR%V=hjlD&kdsyka$JK_gr2@?v=c{S7T#!nmGkKImK5wcNM%0$QQ$zzo+^=&G2dw&0?B9W??K-~B{&ZpWu*`AZ7dKR@VBb*IkyL6c=CUWn< zAhog9VUC2AtP%?s@CjC*1(P6_w3^v8;U1cMw)9IA(lTi zU19_6#`sSj`k;k!o;bD@YzNQl2wz&Pf-AZbiCBkrevmcF$yw-Hi8~iifh39!M{smEni}Al?4upj2=lw02BZ@=OrDMO&F~7e69Na0?tRMC=l22B-J@t z*9B-y8OLbLGr*oeuekx7q`8AIk3c&Yrb79?7<;4D!+-8BJ!2U=XhPOwREVs_=9sIw zFHk!fcyupFqi**0{_^y3bkOl@F2Sa2P3Trx+6;F36?%oh0>8JlAs%gU-2ntq(L1Uhycj%8lmNn~cotf{OnUL^Aw5!oAzKZmSzX6isXTZ@AkP6ZOiMCb0zp>VVK+EL%2W zSQPtVdUwSZC~qUjVdptM*ol`NK8cv7Qx|&XulMS&ZVqN>o(ZHvF`}`xuOPB+|Ndyh=1P-X$DCwGa8qKpYKkiLRJq+7SpO zwkM1{f?vw);?u^c3t{{oi&O{NK9D;j802>P(7u#wx6kl&x)oS_*n$5}+oW@EZkwEo(Y;ovN~2qQhS%(pLAUJs)W@rxIU8I}F)hiOmAwLTnif5l zqL?mVC!J~s1&hhG;PEUja~ihrXFR(74UhOy_wK)t3kutmdeUO@*|M!HKjvZNMN!)lt(5BK z|7vV9bmBgxou<>ESg6pD017R7@5`9Cw^Rj{V`_#$UTnfvrJIfSV>(IH$-RHwbBzA> z^2IoIlLw0BlODKJj3S$6Y>fZA;Eyrqt+luj0*7=Tt1WtVrE#^cWf74P2i3lHLz!dd zz$JD4J+8S%XSK0}rY>|ZgrT)BU)IEIaZ0X}(}yL}yvhwY=K`f*%e4NhJ>wo(q!U@i z#NUptFNr3RvtV>*e3(M;!n-GppLH-rc=MBTiTP#3J_DWcp(x?k{jFH3L;qf+S08+4 z+w`!+wjV2RxMvba`Ga-7b7OAy+~t+^zW8}i!8gt=v4)j@uG>IkzC_~dmV;JL%hv9c z5xd@|!&YqVl%FMO6F81iWo@oTlcWh2C3V~TL@0)|>M07|F zo_+Ni(&7MIv;1W51ssnjS{?6RkdQ~-Sq}(b=OD~!HK*Zb%TN6t?Y>>X+8J%>1!2Ea zyjcfb517{RFBH%t!$wi_@15n=jrpHV4*FTtal(`1{G$5`SwS-5UKfKIpQ@6xJ2>gJm7aL%)2YY zdvRL75gRef^4RWZYI#*eM6Dz)3$Db_uPuh-Yu$e6s4E16?@fo#hS~1aR{P#4n*&3G zXg!O$4*G-Q=C3CFY>$nW7JhU=ADcw7izgr|xz1n-Nv%ACnpg7n~WdQOXtnqf%O zLmPH<1u-HK2PWFNs#JBQPWgSUC0{WRh@5*;d=!BRyDN}woQ%;T3GD;7EJ@V+aV3Y=IZEI$nzkZCIjU z;B3$u7^qJj_jykPw&x1naVs=Ji#9chAqzX+^jc!!yLN7+z|2hf%mUk#x(%AEEzC-0 z#wRM&tD}sjNg-s^?PKGluB>SN6=MUGb|5{Px>gZZ&yhN{(%_>PhdP*#?qch36m;AXXzzvpBX==<^nTZR{n z!|VPH8%KZj{BfpCbYagp%G2xh3>#N>iY>#xvWpNDGwKn$3>0@YjQmHsutlSb z0Y&H0AL|1Ca>qOQDjzS~)|9)AU_(b}3n%N(e;>0uappHY$Khap!a;n6{f$JJ-X|P| z{YrU6m>;!BFkdUkSN}O+^Nf_(ubr$R-K-&(-GBPkMOgXo|JB1T!UD)G!s_D|W8*)T z`?>OYoYzT#-Az2N6q!LvSZhhGq!bg8pt@#GvY#c>lGOm^BTvxs=O<#8{R??it5^r66!YHr)YneJrf(zdp?lHxB%f1pG57s zqd<+Av*p}+fnPN%Cf#Dbc{l3$BNDv^Wxk5y;W_|Ijme)EOJ;S@H;5fkX9Sf2{}syR z{!fVL%zu}0_Z2;q@sfrV(qbma;SO71q*BjOy(V4kwzSe?2Y!W%q~bCJ_(z{K-Y_O zZ@I_&&q~_urErqX1G+)D4u%*o;jG=_Zkf*`Ppb4(VT1*|b?CyLN20?8WR*x!6%rvb|a_38tn z3>Y~#Q!#PlIj3M@)@cO9SBMDjU}0WCLOg1mOpl!&>1;#GlSkKx8+^e;7na*YFyB)jH$$5>u3WxV z^B52_g>0FEI`k*5FhD;J&%xel>maZB^N&&mt2_8>soF#37!_9;P{dT>3QC!WHt(!r z6wh%FrUWSu!V_TjB>OQ5cv6$Sq7q!^<^+4?lf-TKNXz*dCCsERetrmNk|4Fm>`4x6 zg11mUNjI0{!|{ZA0IH{|A5c+TM_pwR>|;@Vgy}#$aZ_1;SU)g4aiN{~HSQAebWviw zl3OQMV_t7w^^d?GQ-eKqlXoyP=8iwKYCq-!TZ4Pvk=p#TA9+~?_URP; zdKW7>vWcSOFEF%Wm*#^M4EIbr5rL7N=*q3~aXR1k+ZrnRk=glY3tVS!Ee3a@$a7}( z&5enb7pF`zQPeMM8I1C`4OA#VV0}j8K37P%teA&#=RXh2>??^X1;seWY3NuA>&uY{ z@JguqKjX)`Ldg$TazKy%`wqM5`7|`T-1=I*9)l3|5yIKSa;qLA4Nsc%4ONrOVD?J4 zX~OkX$$9=Y&xpZ!`J-Igv{S<@mGnJ08vGY+TcIb>%*LOgwc@OsWfx$rPmN#?im;aCp+VUtiljZPzwo$icm5SMp}NAec}kX)Ni1SE{x= zDnXnqz0AL`(shhGidYT_io{ zS)!zTJ+G>P&nqVj{s}!h<&Up=93e>Y0(mbq)wX>hwEg)h0q1ifi^DUAop}98Dg~8k zy&ErfGad$-!OA?hK`*Z?f?nr4whM_@FsP$%SUu?gM#dyCk1^_E6$kR6aMwDstNM%! zd;fZyO+Y)ANipUgKY*DU@byLH#5$0PJq8MkW=iXt>$C$&HDv+E)%@sgvHxePAZ4Bh z^jWTej%{exgS6-_Oe7~z7l>Vk=zW%6PC zmRD@~bg{A!c{~Gla$K+`i)&6ZA#^kR6R|~MM25de(=QRrcaBSG6Jn60Aq3ac;lB7q z4u320Lxy1Su6RXkqOW{rf;TDk!n}DPmsOpiyjZ!0ZT;pmJ{{$v zd!Gxk-}+rNPn%z!eGQ+UVM*>pwZ|-ovm%`gRm&a;^R8+wbbJ>jNNx0?kKb>wyV{|^ z3dou(?lY8{6Hv5BwPto+HYK+P=xeGNvkD?tW&aaxcA+{?Jbb5J92nq8=G)?)KMmkl z6uL>^Ji|2{_*+vR=ukrAn}SCvF91Vo1@FmW(SZVMcl|!@Wn8N)qg{xu9IPv|x8%O7SFJ}fInVM(ERM$;cqBNVN{ z;s871jI&V8N;u&=riEelYjyaLf}f3MNQh|=E^7fx%(qv}j9C*D5ImE0yq|S|MduBz zI!B^&h+lalj~51`Ho$kBW=Odzu8QPc1?5|IzBwiSxK5G0CADhn>;#j;^zCmUCp!+q z8|JZRL^>i_)itP;SSes4<(nR`P77-=-Wnv8L^X|dyk;IrbnKw8Lc7i(EcDSfOwgj< zJpC1=raZ8YTh&E7FH)1b3F&V~!P{B0ieJsfk7R@^pH<{3tsi1>@J@zm&!u7r33A(Z zJzLj<1%A{|NPptcv=B9N2#bLJ$siYobspKqMv_P^Q^bPUTAwwjo+YtQ;?#@^o`N-| z6R`HpF<(;u?gmbWQd)DZi1pQ3Un=@#l`c(fV3bxGY*T9&4AJ}l8 zU#NjvCvwm>;gQ_rXiva0ZJ1YHR z3CIDh=f>risFv~Sk+`q2P?F2*ly9|I<$m-$wR~U8_KqdJe8oVanvhYBya#1dELDuh zYVS8ZeoD=S7f7&bpI7_*F`PNE7Q-8;N&Bq2*&Am))yOkiLFTo=P0WbMo~lk|ofIZT z`=R`Tz-jBKA4c^oiH+s6hj1ZuBCsKLTHSG&C;(Dz&%;&84B%lFaqpL|phe;Z(^}D) zITa-Vu+T5aOlZ_!ipu@@BAO&1+4*PkU;=DDlKcHowRmMDfb=gz*aCcT`mSMTla|bk zr#llgsgN@9L}*3nt^4=-ncy(5jO(q02IY9nPm*8|ZpB+f?E`cRIQlQ8Uvd$({wzaG zN{;7>r*kLHMVN32Z}MUyD>Rrh@FFys;e zlG(JM4Q1rS>g26O-?kRcm6!iT^=rlMapni^3B)p`zn)|~;D|AiHP zU58AB8%o_SXi#)qm~l{URrB^n21Vi$ISl^FqWHurM!a<0vS4KyIYD~fB6npQHbHu} zMW!oAG(1QXAJ*E}T?_hIh=m*5zX^HuAbw?wUUj>PWhx#t%F=?}e6Vm83(62>(Sfei z!hm=|#klBC8)`_ajjZ?&W`v1&wsk$LT4noq-KZfmg%m()U4U!!SlzjOlY+c2sY3+~ z#MbpkrALXZfN9Ns5pecM0-xS)Bm4eWt-Hz(G@`Ij=0k|~G~oAg7({m&@eO)AK!z~^ z*9Y&Sb%8`a?V<3!H~X`U!q zIy?|3E3UGvjAO1W8&bMG$SIt^IB%uU2x!!F z{3&~riQ&YnlpM1utAco((L;za=D4$)^1PmgX-$uJZ1q}WXX;UkV!gY$X)+c2=>O%B z2niyR16E&{&-1Xn8LXM?#=Tdes7VOp7nh%<(puAG|04Z%X&g4KOO4%iaLgeELg1-8 z!wwLWCOG9rI#0(&G@WCSq1p7UXCk3Wyg{W8wb zP7>uC(-$Po_zhQ4K}3;s1rsT?Wi0e=>vu*h%X*M1E^}mjJ0klyO$eVG&KzV>3{y-- zI7^DF3~?JFyATC+DBw$|2)!rN44)rvJj$*>?N0PVBIzQhRCXb4klzdMi6K;ICRfnM zDi5e$3ukf8w3p$+ohf72BzqVl)vnU3t@b0;t-^O>B1v<&GqPfN8pG&6<4?ugS56>B zsEHI?2H=RdsR$R+I8!0|qNGg2BvUcQq9nZWuBou)qUgxHE7W?osS0NbJXDePpd_4C z%hyfZN13?(D)5jW`HDsYJmr(%dJ#$0s|3xbU8`<1KKPI6Nrr#DQX1#%( zTk29VWTyuYGHHs+jm@mw9f>s{8bz_M_XF2n_{3r4zuokq>-Tay} zRahP;(A|l610mqQTIxwPr`UJm$s$_`sDNDkDv$UPsy20++B`^n$emoUto1 zEs44EcQOY-K&Sn5D<>6PL$DT3ik2t?Pi^R_cmo(K5FL*EQo5doDMgQ!sY&@s}~@r*ccs zUkt+NI}$Jo)H2PpUH#O%Xw~zy^dfwWua5fnu!+!mTcyvoR#I zeJEr>(0m9&z33Y@z=R&Px3p77XQKg=WMrg^mCKRV*Bg8~Gt=dTJDBfbI*UCR_xLLy zJW+C-#CUw2r#rLJKj<*sh#LmamWEX`kWlX0m@~#yN!5j7JfnfY3SJOv#8RjX^5=jZ z6}1?i{0MP)LE21ElhgW_-}2*G@u*SdpPvc&fqy3C1I$NQkw}^{+lF)LE~y}t2@ENn zAIFOk`fi|;PI$WzG*|_ypnWfeJenRHK#;ATW2PPsG+K-rXDcgN8xu5L+(+@Q&K2DN zg#7vB2}#e&^t^A)HJ8I!hE&)>1C0SBS*@&|jLzqf+sSW2G`E~}&`r+Lo2v%B*0fE{ z5Y9n~F$8g>tOIU(oy24YQO{)Ae;Cav^g^+0xrrlg3!5oVEPkb5k%R#;j{VRgLhwph zi=cu!IQVCNKeO?Rk<7A6qN(AM$X5Ow?Xn!u^+!eoRPFH?M6c0{a@#v=f~vC^?-9qN za`c=u_wz%-5X@X-EVYa1K^UKAH4U#cci|x&|RH$%PmG6>~1@#^W+h|<^ zCZM2fY((&NiQ_#LOwkZu~}Wy4g%M)Jc# z%H8V6T+7`;T)|)zO`O9fK~%pHxKm`(LZa zH_*)cfX0{i7$pu1aEI_u@9c3?>sWQMK|OL{EqRVf!1t^aq;Ul0vNb% zXMHsH9)rn07)XVMRcRqVE;E^5%r6d4z|1=^y1aBSow=$3Z7{EZD34Yu1NLA!S}fTK z9dQvj;=;4Vgr|rIj}a1*Ua%23B(`~f&TFw?|9hk#uT&PC|8sMT)(dj{ghD8;uu3J(dS1T_|B{|ZkA1>Dh>A23g0j_wD{R z;>gQ?0Yx(Hn?#I`THr#zt5*F?!Y?HKI|(n(5n#V#^b~_j(nGYu+pQVVqz|QGZjB)> zH_yI`&f{`XwMt$%`C>f)4fYjEw{=g&U~1^e0!nQs7xZ9{@)}ZB0W9nX!%vQnw9jbJ zMx)$qv1k2m4aG!Cu7=yPist&Wh~m6tO~8mHbIvTPkS`tKP0$M3`$xUURK~xi&VGyb zz5`wwrd3dY^TrUMwE8GyuPVlaY6?B_Lh~SkdTiz+?_65490@CHw!yLFp3=mZCXxzZ zR?aDk3?6?Bu&S3;+{Z`g>9QAKmRZkuUGXxHxptKbDtY#khkKE`b9sXppumd# zfXs0XQ$0neK+J2ix}`h2YX$RO2{3oe7)~3$tAr|OUiu! zR(oRRkEkL*ZzWP;F|$^o_fRdJkqVa$-3SIFjmh1YRC0B#V7}nz6hhD!*uQyj_-xNd zv0auG)9{sdY(nDBSo2=5k4i(m8wtLd>_p(`!lfJDFyQmQM7_17nOl7Rl*E#QaREr1 zCVrPvx^Hs+1~#q=s%P?YI8VkT&bwF$ud^o%|AHJTDcnr@>kQeq96GqLFG22Kr`vuq z)f^dhc)EVinEk#GdajEEqrN2C$}J+L;P7UHOTc{mNeoHTP2eHLvpe%2XKAuFoY+hF zx=A?)PKvapQA{P|n61AQ*Uivq3K_}IpTYsqJw4$8I0&)KgKLQZbf29-`nZ60Z~$*& z0o=s^x`+U_5CEHsY^HxnRyz0l0%q?St~(z8kNLAxRs}@jac1x%|0W=XnMm& zeo(;gwc&>G%53^p<6X13aWTp&-l#nlehIupHQn+Eq0uG(m-hb;6|k9+7ri&z7$VMC zL^`#(36-M1P)TdI_W7WEOXnpdNT!|D6?;-}0)ZoV=yvLP6!6%pQv%mHAwq*8XWZI% zyK&}-3Ou{Rt$y?uZEeK z#lu93UUCBfoK zQn%t+UF~(xtoZO2gf6JHbT(Zy{I4d_lU|{0nSxQ*k%HS{vThEK7>dXAwjY;p*|IxG zf+g;gONW3e#uW1+j(`l;0aKRsYICA*6=Z6ME3C{Zu)`&$pY1XSmt+%B#UO_X@uee_ z?Ibpat;mVa**2*Hm|+%Ua{&D&UPi%t`%tq!?UpL{$V7$B)^%2IjKXUOjVh-xDV2H> zsUE?D@DA7f$eFSfU6jgNQBp^^3iiwE*}bRJEpBw<58%n*DXC^dqMAiTtU`E-4-piZ zPDC#n&2Nt+z$J3@Gu<|gDOx(Z>ge>4ngTLs#~iR`=LE_ckpkG+TupqbgSTDl0|K8< zc_lTW87HW+cvVHZXbqupC$?dDD9`{GuBVIFb-TRotK#zI!j6PkqiGy5WnrU6UlnU?3K*4yAEZ4lkks-iDv;XQ*l=kE}`T z@(JN#!fc6#7y1d5a%?~a4m%Jp_70chAv{3!Kf2>7rqig?RFORh)+R-p#sr*+Cxf;? z+L|*Kt(|$XVqC_~BZzt zL8%T}*60$t5!=Z<7uow{S4k-9!!4DH8^o&~%sMYuv#AzIv|xxj1|=yz2@j3n>zKDI z>nrri3bPxasI3n)LSxjhfxF1yr`WQnb#6RL|E?dZ(~Jlb%d1*gdkD|ZTI9E(Q~Bl` z@xZgqOc=6yJ_XQKu8JSa;|GVnVaJ6J;n{ncbhVwWf3M^V(L5OrLiO~W{qed8DOY8z z(7VN%tLWX9P_UElCg0j_=(S1VwsG%Yenj(X>66lk81~0FvPbg&ThoF;m+P~FTo@cU z>-p8D)-es_7gIJ;^>WKW)VfbT`-s3|$~fV{scG@MSj^hR z4S$e4gT&`N*2T_sm>RM`if_J|oT_I_ng!>B@JC7z4Hp@cEi=x!Ik)DPb zYx{;}C&%i6|7H*K`!-^AY~Pfa*8wG&Kg02;hU?JSlu)qg4?Iq(NJYNLI5zGZX(cPO2fek~efwCd1!dr*_oA%})u~IbCf+txqDpb(!=pU;3pyquzolt|7PXK% zZJm0ZL01JEnvf?BhE7=bvB|=I&DLB?#$vg?LgaJr3k`4V&zv zf)NR3nIU>rK=a_zP9vJlyu-v&;IV}-3n{ai#mc>=VFUCz=x>iAGq|Ig5%PWj02E~} z4rUrcFkSGkoLS_vI41?otZY_sQ#Np1pH9t9FV)C8K?jp?=aFkS zcd^iJV&GmTVDT`?`vEssS3u{qK*zC5MWF}`SC$tY=&qr+m)aYgXJ* zHei|6Qh+rooDkXafZ>Qk0)RCKFg9-0bBb}W2%IQM-ylCZwDk(9{11RYC|CeQiKZ8X zFpn%!05>Cm^wo2_T;3L~tD_@RO=>ixgyIxx{dJV_kX09@X3))Qwvwh?1+zgE)eS6W zB&EK}*Ep%d`MLlBwV=(x|r|YfMx*sZ6m)ZqQnIVi^~}1RW;QO&{X#$c2sP zYRF|7XiWehIP`+Wf@&16GM22s9xD7KX&^cNq-(643Bd{lbV_Rc*;gB|LR8LGJK#x^ zQgijwCPZvM;D?5T=B-(prUQLdsPn1O%<&9UGs@lEjAK9+#1~qx!zmWY%a=%7?#kkLxXpXKO1`L%BGRzB++J2-n#z+jr_Wg-Y zh2I$LiS;Lr2_h;nsHS)J6&6T<4IqeFYEiI`rm!I(vQ#7xBZAZ?%ojbSFKP`yCt)xm zZ#u!`9&%8ZS{vW!V5-I0Zsg?uV$$ZC2@fadg1&OUEH7{fW5<61>>wpo+>Ujy|C@=d zwA=UfKpm~kW3bKJc@mqksOR;_0|@T*NB5Keb!mCJ$Lr|{V>e2!*YEXiRS9zRTCdyZ z>vNnf*sjON=QjE7N)62}&sS>A9wbEQ*CLYP*Ok^NgO8x{Hgw;r3XOMRs?^M{c=$-W zy!F^YLMiDhZD9HV5WFIIN9Sl;=Ne#DiwatdWeY^!WWz36WvaEc83ZaPHq)j-*8t$& zc~@L6qLP&k;OY~hXR#72@S2$w(y7@;^pL?YO+~p)L3d(5>#?{t%|Z z=mLMK{Bx-3o7`nyvX7&ur7|jra9@CDMo{P~ztD5uv$N0N)M7G#wZCsch#!n6WG!#G zJjC$Jnb_pc4_27X_;SrX$@Y=bc1F3hd?Aps43&@g<}F=39UXlg5x3?RIAy}Z`gr`I z``lr>!DVU#S`wMKn zma;zgqwJ4adJK8KPRrVeKch31_mAZv@&vLa{&ZPBk}BWD><%JPmK$2n7%{@ACt5m$ zY|C4TxWayyr`vsiwx~}55vZilKf;e7OT9^EW3oZN?62u@1*85IFgA9_c9FOrNwF&4vb!NeU8N+FcnR#Z; z%o*JzZ<)`U%OxjS4?*+?3Q>IEE{7M%A`ux647?5XRxo9iZAean zW*HIVW)`V5{oE{-XkNNqP9PJ}kmgYzk+36?BEWRM^nte&8_p*`1Ia%Tt_Yj=%i`s9 zuT-XH^Zk5PwCxtqc9L&pD7Vl&P_!~7P7rTtOwBwwv>0VwHzbluxKt-iZECl3+9b7} zkQBENpCfTrtyKR*HN}cCokF>@Je3z70glBh*N9wY*ptGxhpAXd5Otu@JssA$IWFREJpnVgju?Cgt)B4 zd9naeGL2tlPe_Hay*l|KE8#mrZ7=j1ATGJ%+>d+_@Zo6v+VADc%G@j@vy<`#k#S8r z2E0Ohi90s>@9vLJ2YL|nTPi`P3Q3)AUR0H^w!B?W^a-`_;m490My7v09|*e1V*&kb zLOsA5QnCIgJ)1$2I7)a0>GEt8oG8IsL!Z>{LiO*(IM)3^aDut(ag57h@azcK-B2cn z0ka3^QOxNv?A=gyw?y{2Kkt%|{8-$m(S@J-9eM-}i_q81YYseFAYEjPY8ar}Z@FgM z$S~L_`QM&XXxAdSU8v)>UW;wn)S5~6L?Bj@eyF*l z(d{@);2WUJ;5|>tGN1Fn5|9j@2C;m6E$_P-)? za+dSHT1Z z*NJ}rb>sJ=xvVt>|Dbev|At%e+Syw25jyS4I_VLsu4SuvwS#XM1Xa+mhWbe>>#a+D zTj7Zd>3PH68h0({xl)c z5{Aq`W?Qm0M1BhO69gkIUkw!&6(N6gz*}Ama-sI4QSq?91ho_V7B1-@nRE_E=hN{ zGJtcjx>C}j?G_Z#B8wii;!~+tQeb(COKcX-?{Aqii&sHgWPM&%LQbenTxk$lw<*9t z)*~cz>>O{;JT~_yT0EF?7LoHxX?iU!e9sFi%W2$W5hh|bteFOZgj?nijWZK5`nm1K zYx3H;;FUM00W!O3Njlo;l1asv*PAhyi^5XtXe6ETfw-IIH*(HIrs`e^#78u5Hc*05 z=veZEZ4nB*_fvN67m02=WW5^TGB0Nqqa3ESHjVCJGT#%|HM^$n*ZzaXURyw$p|GDM z<%GE?MetPjXLOV*Idv}sIFufUFE-8gY9et`VDuhYgeolA!sX8W)}YX64BX(3c$N#0WB2K8-pm7ykQDA&goafk zvc^g_fWIZa+Gto2buA6wC(Do`P0UkP8LngL0H&VSHDE?O{pQD8M3luh$zifplow77 zejAl*2C9C%N@kh;Fy#z-!=iW$h}i$|f?K?IdRjyO9o3Q?&Q_i$?sV#Jb{6~U7mvw-e-3(5AAaQ5!>=EjRkB)f{g%gR%ApP)mW(mDSb@vtenY{muGb7fupJf$L!=@}!t zf*mPn?5_Z){n97|h)=8sh~F(%xk9!O`bO)$1r@>(>sgIK(}$=mPBeI=LTb-vtZ5|K z>fsi$k$;N9zMo9o>@n~dr{&e6KooY~u)xzPI4{<}J$#G?d{|T4#JTwIM6x7Ajw)z1^=yRo4V|m=ebL{m`yvnBI@U~>0%cNIv zzj=Rf;*j5xF5INr+w+>w_4pcb{RGr}<(>4CRdhlabmz=+%j=Iuu6e|+W47&($a2Ut za6FPrH)PE@LyH9tDmRarYNvrE5hGNRWTLy1{%2-}hz^0V(o$kM>6GwWaEt>ar{jia4#r7R0MamS&0IA>;`n{2 zRPG~_SvdNs+`HzH+&e{doG?iEIMicL5KnqRKt#tT!iL7DJG1SarHCfJ7`)!jcWAum+^qlq76CBlLdj(&t3C`H? z(5?TJ7!1CyP0g-N80Ddf(zU{2+jbN2*C~gfWyAEM2{};4DI@$d>CXCh7Suy0)Fd!R z6I2FWqq9N0or%J2m*AmNIMr=HNs3LT0KJ=BQkVA+X;s9w?m@WBJ=v?Fc5J4X^JO#6 z1cBXkV0Amm32}RxsoPII{4-Ac3g_J4JdH#8to1r7YOIwto8Riq+f)*AVV>nGTevGb z?esF!vkBE+0qR_s_azcHZD>El+vNjOST z8{jci*1m+>p4JT->&44_tmdBb2gj{uoden2G5`)~b7~W6g*L`ojLr@+TGk&41{g?R zmD)G}p$3;M7-r_D^iKvc1FQCCJ~|EE+&wh2yXdvLbFb+n;$yHq);q(4SY`)e@513L&HP zjyoah&YQr=C5>+Su$jC@$-&8&DC+rVc&+e}wbMc|9We81x8vto$!Eq<1v=0)$T%wl z-U7D)$0h=4+OE4QTSzN{ql499nw&Z(GIiz6lJ1UXnFF1BHJl6?y_Y!>1qh$Y>;ZMtV^x@B#z-qO&HzW& z|2INQVXMsL{Vzgmq)EJb3Z?KA#Ni1M-G8Z69FLY9v-%@us1~|^jm2NK+L`2DZV)O# zs{}5Wneun2&A$#g!x4{PrhOVpJvA`L75@}?H~&=Qd|4i%sKvd8g#Dw}>hsK&R6r1$qcWR$R(gm0qPLR_yF)kpWa-iF6NIzNmL83IgCP3Ajwb~PtQsxJ z?v-kwfr5C4(k8q#S->Y~f1D8r-Ay)X2}+(bKrmkbM`uO}wqwO+I#7X)Futm1Ct#zZ zMdxo;OJ*bbo`d|4_ySmA@QH7Tet4PF#Pp9o-x>YZjye?$u@TD7-?fBaCD_;JLn zhe(r-V_|72^*2$_o&%x~;IEc=kvs;;-Mc!=hA`8LaI=TLA65^X^sWhHX|e9yEg+mJQF~fwmi$$r_Aav3$OdL3M=Fzb=DB9TEbo&1 zS$Kn8|EO{yy@3p&^WDIF=;EgL{3C>NdG3)hTMRq9Zw)O# z5Ae+LEp`Fj;P#2m^4T6AZ8Yd9AgmtP`F*4K#+#x~Nk%QBWYbT(*XwjvydmA`1*X+j zXiq57|375ib8w{37clyXvvD@b#@X1mZQHhO+qRvJHyhi@#V50hy;VI` zQ)l}5bDr)#-RILn<|hZSXdMarR#SQ%Ry6|i#Z}alqAo2ZWhb8XcL7nN!6b>U_-xk& zXZ0MF<(uw?wT4!fL;Y-39qu2yba7ivpW76N{-9!9UeF7%IOBwFGkY%4xs&>~<5U%3 zFx?-EhMZ?^2L=ThoS`^NwH2#~r6EB`YsqGM1eftB4bh<@DwaKy)i`~iccKwxE27dP z-9*<36w=f9(E{$jwu4VfVT7|PxnKWEOrv27v%To4lW=>e!Mpw(;pjcWdgfSq&f<>J z?~-1v9qGF@As^9FEoYrXO;#g|we20VQZ3+ltQhxWY^aV(U2JD5H}DcS4g4Ez+so3a z(gI?v#d+VL_>rgnp2xW*%Q({{w1k#6kW4!R<4d1|9OgQ9|O7xkLg+}WwAy>&1i$>Nea)q_Y1B{ zUyo#&{jMY$Gcv(Cc)>Dd_hQ~gjSL%i-HP!R!mY-}hzswWr9Rq`Ot}%JAg3SzH|Bc0 zO=h2u99TLc8B#e453=TQBUur)uVw#_k8LIFCUfhY=m?zT7A^rfOpBk8d5pVT&Ow1` zL3A`|A;P=Lnb+|yR&xHyDak3~&XVu)V&YairNlW`>dgy>ZWDv~%7!7xEe3rl@+83z z&++pn#-(v=l^y!V{S_oNi;hF`@Oyfu`{|PhzSor>w|m>Ty8KoCg<<0IuoVtCsV@sZ zl$hlHoJr|!=$k-amB=Nmq+%&bN^yqxL9vZ?^H+tAjwh(uY&qDzYB0dUAQIr%b$NaA02(LrDjRnXH)Crj>-R?HZ3k)|Rpl2lBQMCS1PO13@ zo9AUFAu_$WFVYk*O?jM+w*P#)bAJn7Z>Q-ud&wk9#rU+6aHsjl&?4Ft01H{OddmFE zul1}bYb)@h#K^;v2%8$EzG;YZaY&ihF~D$JIk3G}t&y#Bx;4*r2tT@`YyJeHpnV#y z@J1f;Zad_Hk^V(7H_Ntex#Tc`Nhf}5zreihS1>q!;U64p`WVlrKN8Wxz1S?Bk2K^* zDL>j`OG`Tl(-5)wUVg{r3h+f^)iUv3-4Dg7BepPbBg$~;&!I!ah2dIKb66!or^{*f z<9Y$1o0)^eyOYT+?>7_#Fiq69-T7v6)tUFELK9X}pv)=-lvznC+a;uQDQD|vBUxY_ z%0k4nl%La2p%LAiO+-q=!yW|uu5s-Chc$mJb#JVMk}g0H)I&8=+;w~22Z{;rd2n_ zM*TS-Wf&0ID+ltd!5IU0m4&TKD{@kf#WO>()c*0C@vL<3-xDk88c$7_Ox~fkWp82Y zzU!GPMyW9>pr1R*5^OD~(@-DHyX@aGWa-L$>o!#pV8ec4D^gD%YcS?IE3-DjVgU*+QqamX(v!gMQRxZR;ukYWi6l{PJBuMqjl?OC~Arr zYl}50^e5gYiqZ_!0agX8B`1-M@>%(DQ{H(QRQoy}99NZTyM*`t*vlhOw|P|G1;}<47QOm5pyUpLTmU2ZdKUPZvl5tToMGas{TaQ`M zjV)P+ae;j94H8bM|)PDmtEa=HjwTK{b(mL78WceoWL_|=s9bQ!WPH9 z4SB${rJkVMACCugrUf%Z9itFx%rT@SSz3UJwlccj&`tPH9s5?bclH>?nt38jDu~{E z9;+?WGb@@Y(=^)Izzql*X|6DZf`!^27l>Zur{rGCa;Lk{1nXVJfE+8!IZp2m;iw?P z)y#+#wHPNMcKc`BL}7FtF6_yMOzv3K*cerc7>267;O;~-4sahX*oAKz1Sl#bYKm+2 z0nghkWZSm4r-ixe=!2d5UE)LYY)-h;ICg@OrBfXSNxV<#%N*o6bHA*+&LI8NV8G@; z0xffBn^^$Z?7i%ZE+wsd1g+Q*)G1PEu2C6giejwDv<=D_mav-6Qb{ag@ga%!!*zmz zc#fic698*3g)O4TjMru~TOO)PnOqrPRer$EjL5)CWL0rm z&p^sdAK>72QL-`H@?jt_mn zSZOayyrtrr8rU?MPEo-e&%VED_)!5r+rX};eF72SL2*Fk3uF_8dP40@xg)7t{I4wN@xb|Lu0pzH< zpXA59{DF^k3;<|wn-$rJ0f4_V!z;)xenY9# zZ9A_ZpD)-o5eNEtPn+uPkmvEo50~EFA5JItdJOGkl#iz?UFMfY$GSz<`uA_Gp_GwA zbVWI+Ui?0wYO|LUClL1$ZRwA;Q#$l{&qey(M<;;zTnz4|e~v3XqQ^`%&~ZIDVYM;B z1`N;jFr4VVC+KtI`g8GEQGpN4!8Xm2m3QEC8|3HM{&)tsEAqQ?Qn2;7eFt&%gxK~) zIqx5N;EDR3L`nU(Gw>7+d_F>AO%5=3<5-boj~XwFt}ZK&b02v89N^f;-0rm1&hPlz z;BR}K-4%Uz$ubR*jRF-rC$V%k5kAgvwOIk*lb!s2%geKk=QwsnQ1g!GI0|)`^wdj5 z2D&{Euq6z-CG5XB0N4}`*nopBtDf1*Q9Em}E+GKR#8>lV8g`t6drYQ3H)vxm7#{red{oLBL z=2ojY|3V4Ys?|8~-6kgqxIp-gGRsW_3z0t{!sN) z_DZ1RdRcf|*I!bUP5}DPaa~cST|#+KP;ZmVOB9=s>m|zZ;c?SblIA5H%H5&-8`AcY zarujQ;h3ZgG4D;<2SF`6j4X#~$$k8;*6GOTC??KBVpKL8fAc#BhsB}bK6>G6*RB~Ybj=y|WC9}GeWP^xuEu~*nrR33_kH81y>0aSBYA@c zxwM|1s!3a_F>wE$SAsBw9S@na1uJpXb03V$3Ay3&=9*ZMqnI0KMU+Pb0Ne6`Wb}w4 zNSweUq9>Bi(&RFdN>ULOpUs~jaILwzNpy_y?R~laJDolt<65OR{==GdDDo&?$>w_c zHWR1v##wbOX-^rNtErgRx9sqOToa<4NW@DF!IV96rU2P0?9J^>5)48zq3;!*wn}Si z!VBtB=6E@;#$4B$%5>cjT-?;U|FvTF_Iva0+k5D3G9nPKxs(b3_z|)qbI!Ce5Sm|S-E+ZVz;ue<9B5Bh++<0U=I@gqK zC4^~RTdY*AdvC2;w|t+D6GA!FudAq}pw_hh!a)b&)@EVaCSKT!O}#XcvV8`lTU!ms zuvz@28TI6h4hU)Q$%78ky-${~vQ{U(00$uaKh{6$gx;)3! zFy{#Iw)!iYLPr3(H3bHTVdA$j8@T@G-BRTVYlCs1+>#ok&R{|C2xfax;Tqp|%Zs$) zpv*b3M>YOg%Ib-#)&9?@XX`ZmN{^&7jMUjRhF)zDFI!yLU)ZwGt^9cyu?5`=-M+=Y z*5|R+g&FJu1SrZ=5-~PM9kx<9r2cob#Cm3g+D32ytx^P+psA%hMQwP)!V8l=U2sCGO@5IMcEK)x`V1;}Ft-sqgQ zXQ@l@h5F@}#~=vV^Z+6?3-*vP)pg4Zbs+l)V5YiDq zvi#Io#YJZc0D?Kvq@r~d#3X6$j!CW)Ts@p-?a)rX+_0gQTx}&P1r1wBVhV`hjSI4Y zp-Dk`G*Dug!Klx2&mvIPS2n@1t{zyU@SvLFcHzg!3h9r9&dfA`XCJHmKrMS(^9-R_ z?UY4d6V{o@)DeKGdS5CYUXnM|EB88eMy6^T8LKQ;ULY#dwXqNx%dAymt0iboG$6aC z4J>mE+)X_V`$hIG5g|*1we#U{V-eM7D(8t{vx3+=$isAR(K0-RqB_KgRXt|1z%4kZSzxo(~sXU`;fL%MgNpO-Y^TB7c9cR7wI3 z=L0gXF_fA|K*n`rQ4}*i({KI+DRFFhR+ac$>0YCjk%VaRvIvSTgo#V(T8yIkWlQS; z8;;o1^8AM!zGq38jpJvbo-Db-PE(v(_LfZon!?5p+SRM3zlNt%g>RIn@3S&AM2w6; z#dWe{vQk=I@Mggh+ioxw-C+%nYQEj3hdPvMslA#Zs`tI&ZId!cJ#V}yU6I;0D}OrN zw{59l&bOs`H)<_#K`&FLJXQ~k`9*4gq$bpy*3LUv8`_in63LBPD71kyN+Ceh^VhC_ zpdxzbFOFssWsF&xkMxoi`BwI}VaAs>&VPt&m^-!XFheqN#4kA7P?YK;Of7CL!s72r zlYyJTX*mTpJx$S&HCn>ZEWlfK3Iwl3WZw*7)+X=^D3!gVq%>`t9#C#ekFJJK5}jHq za&l$%*j`^<1DW%XUOuacrvQ~--=yPLrR4YxR1jSO>d%?CTjQcmnlVTBr7PmT+iNzR zOR{lj56`|Lx+^wotsQ%lE|frhnEUgwF-K;4sMZtA<+rtb5q`ws&&i)p>I80DuakqR zuEd5>qwBK85h2vlIWet}HB-Ob?;(A}K1~Tv%k+uqLOK)|URbgc_nMjbKQQTNV)?DksD4 z+$bXOezaNP%qFH{5Rc6P2svU)`GGClBSFc7I#%r#CpKK#b3g-`;)kPEV&H*d#&SvG zQnS1$WLJu~$^@eS-J~c!wrNq#^_Ge9f;Gs4sE$LUp zQqz?02VJ*^{rz=w{mA{-C;Qv=n;75M6JmEvH$WfT9=<2EbX7-qOOJn&Y9>rjPlTFS zk;Hd|&D)aC@4lONcO4-+aK0U~DcCB&2ZEGrCuaZ_qUoRDn$|`b_EC*2r@dd8TXkZ3 zo4Y}p^AQof{z2~QBV%Oeho*IRR`7H+gYCWsG+g0h?AUNyrrjjmOP`#WRl0~Pg5v4d z!-0nD*)z`uc#*5c_R0)*$*z|tHBKj45lb~yoBI@H<%hAi0dxM{R^G>^Ie#9R1<-KC zs(i@{IL-4lV)qj~Y^eMCQ2%_Ao9raZEY?if_d2q5X2p)#XrJ9%ISyOaYPQZ%D|!T6 z-uz|~C-)OX{`ER$cu=j+6OM7QD2r2F05>F)vIHrI7b0MW3=6ykkI$KXVAC{y~_4wO%-Tdaz(!-gFRPV8fLjjGrqV z;#o(#L0o@`1=}aNQM;ahVlgl;k&UwnZ+F2+&M`;AqVON#N}W~#hAz^P z049~m`2d2i!@oqc5%U^Jcp3+H7XIov*f|)(*;XO>)wstCQUoUHeBwzDQpMZ60}doy zZ4C$KvBmuK@Eo%gSnj({g*)2uTMVw-T$L=;dvH=$f{{AS0~qKQ@=&PBBclUI{of;J z@sSK=<=}YD+iMy7`HkwQ9e0Q|Vk8h))JrUL^+A(7vnL;C^^n@In4C9Xw3$`bXmpsC zVh|I#WYAW1Zf$Ol!Xtj+Rc*btGWP%%`@+`1hvHHjNqr* zpG54JRHivTjIdRR_}aV&&z7n*k6b3|z=Ko=%i_&Uyl7q)#hGU=8;d0cD*Ga&CD+X> znpl^m27IS$!_$CHq7B8_bG7NLZ8HpkDnT3(r0`$MO!V~0j0P-Lv^;d{3qCh356hWg z9}b6p#(3*Hv!=nCLW9HR0eP2Q)q9K*AmPd|p0lo023#h&0sp{f^KdX8Wc@}SBV@2X zWc^ns76jJ=I{y)_V_k~Ojt-n0)gxGc@WR=Uwt|TlccJm>AkkvuN0lc98 zU_B7ZlG2cvs?35??+Erw5UOr{9~YHC&FgG)f64ZKIi=xGRm=Dj;U(fb0ll?II5q2D z3G!KMiqPi_tzw{@i~r)7LDwXbS%7Vsw|fI84tk4fx_~uCyh_~4?AsN@i5Id>uV0c0 z+XfU|ClO@#$)6YVJ`P^?-)CM{_TSz7p5KuL!|jKc#nv~n(;^UpT_<1GYPvrzv*-wZ zN*|52NfAXfiIQxDz!MKa)-sP!N%m+5qJbc_d5L6MJrP%=%B7LxK4c5i=L71HPj7OUE?dp=Eh zmKY*|XPF3uVu17Sw9^U&Q}zD$^#Bm8nG7st{0^bW7DwBzA9>@&Yh-EDV3wdStNfTr zle?krAoi}E1oB;Qwfn1G@s91edsrJVhpI*@&}$LQE)q}={bi|=aGxe&c=f^AFIl(0^ z>|!h!*kL@s0qUey--j0Jt{aD6e{8Dtv(S0d{6hF^i@p0(&iNGK)~U2W)9qodXQ^vF z5=&qhE-<<2x+H5XVz8X|$BW!KhP_$uvJ)s$&VDc0K%tDdI4Ra|<%hH5<6v))vRwXe z4m`*;ONhX0s{8ki&pa@0CT;q&FYMG))vS>{%-uIGG6%YFE{`Fngt>azNL-~MK8%JM z;6ID@#m_XMgg(0UDxV$-3Qi2N=5 z6uF(;V`T8DRc|BLJkE|DvY_v zG4Oh7q4x9%x5+C>kNt!gCG+z~{T{sEA7t{U{PcY0<>==gXIaZXzSW|$Wo$lX^IX1u zF3s8tT4s|Jj%CwUeTa(L%fhoH_vBY|Qd`e@{men>>l0X7v6wH^$r^q`m!Y_%}7p(qp!88ihj| z?wEF>x$%JZJ^jQknOnhiN^)y+6hf32xalHv=B-q~Zq~8~(XpY3vp?L1`H8tA(QUQ%Lru!|zovm4PP~1)$#Q%Hx3^57b+A zJbs>af!A#8gx<^I)!J&{a66@)G|QK`s3|!n>~M&~s-WuyRL@cWfY5C2AWo)ke)u8T zfffy8ga+Jm>pQ-SsNk+<5ieY0P>yvHP;b>KwFtRb$0wu4R1|VOH!%#X(95&t+6ITb~ix%I9ICh+!##TWM>>nB> z@Dk|0mtk$`TRmIY3R)vD6?kO^ap{0>64%x9@C?rryr1FSq7PiNF6^{%!Mg2k{r+~Z zyHs?S!$T{PW(l)G=c-yFbi(`NaC?X9x2LI<-&j4vV|&f?-(uohMjF}519c?^dHuD- zFH!Js2RAW5y)}1d9*+GC^KbERqS05TK&l0*iaE&ij5{4Cu?1B_Xv4lpuU%rSA$b`k z*Q>nif;TiFdirQxcK#V{M9C-ZSoiv$!gT*wi9)9}lltX7*0Ya~A_#Rbe2GWI8C1Tn_nUcBAvTXphtSqas?7LqnKf^0>>@6z3`(CI zXuguVd>7l0Rc@s##c)JZBpEroCB|^N*pLfsx8jyYP9@>p)=U#s-(zx-js_eH276|D z{sC*z@SORq^FZ^qa^u>-l8%-UDs16LoUN*KSvHFWooG_89Hrym2X=#2UE2@}57Jw^ zbs_A7myXjHk3=-}KMP7N#bkVf z(@Y>kpS)cj3aTr5IuDl&VJNCJ7zE*3_>`gnLf zSP9_dKruRUVPmyfE`z$((78ew%KZebCsPEpDuvhN!Z=@r3sRQPpUO;?Z1vS8d{gSyZn7r?)2Qg(HSz=>OAO_cRjeRU%H~eh%i5(R{P! ztt_E8Ct1!i&xC#P-Md`u5GWa11i!exz{T^UcU|88;Nli&-Ky<&ySSb=qA?5;OIojO zce}a<&zVdBN9N)#sHb32tzqy29ehtO^42H$ck>4A(3IfmDggd?MmtlS#R%ri!+cJX4PRE5j z>ZLsD@0tJR*7@zY;{Yh8o?bY>g+Amo@N?{apbxoh^R+Cpv#Z3&Q=abecXZV-O68QG;5D7rbAg$##Po5qrsr%@V(0N>n)JY;(NJ(;4Z! zRCls~divB8Q+dLl7xQc1u$f;QRVVz%3{Y?Nxa*7fr?=h&Td9iBEs48Ys*23m)G4`5 z^egJCp^j+O0}72xzM+|+X~w9xZm&h^iagGy?h=hBUt7>Of|c;uj_q=nX`;$A3DU5R z*rC7^d88@Hs6#q}5t(h*jxz*xg$)hr)@=S{4LIwylnb zF+(vXtw$8>`+vW4?U@)Q2VPe6uEXgh-~6w zC4`vae!`PCHx8WagTm=|O1*V|4N((3bWu_9F6Ui`U!F{o6SnTgftsv&xLmM9LT3ZX z%dy(rc{_zS@tmBTz$))@YiTrV#jN|ssRKJKSiUtT#Jo)?#Lj%xH=U@UJ#Fu(88Pc) z%lnx&I#mR%INd}qjd-t}y*aO)B9!I*-@;Q^Q99Z1<>^R_3l#qoTrtBC&ojQUKC<%u zteMH<8D*q{%H@s8Z!^O?QD>b}jM%WufihRj);=^52G zt!xN!G1FaH?(2lfA0QvyfG~MGK;cP!=Y`rt;yek+_fp5oDe`SARbV1hcBw(h#Q|&Q zIALG z3&)Y@&W5(kfPqh_cA71=5;uWbzA_?06Pso<+pyFSVjuq}SDml-FG8I94ph@7+dsmU zvKjg=l$H8B4LS#)Q-ra4^R=dvOex`OAa-vw<$Y}~od5hUzL%}u6N}`P%4u%c$=t!E z%Z~}HuB8AD3cM!{QZwueH+D6&EnC5`a0**`7!Dk4-B&(|RZcT7UgNVu{!4wTRW|m* z88p?_%+#u`orSlKj?AvFqVz-WV#k+Drn-1+dO2R-U3a|cO zdhcUXPdNd|7d$?BX#)Mt8jyAxE;&&3Sy{-~ev@O;H6eW1Dv))&%?p77P|%1Je{!P2 z#ziaCDD_{Z&a3cU$jyg5P<)6S-!e_W2Z|xpQyKtO2 zOXZ^AteYc{aJ@~P7PLPuOSBB6)krU=43c~Vk0<#5tRfSdaTJk0E7}Ef0#MAQlQS3f zq1&=rAEaGR)w|2VSn1ou)x@lRhsEQ&mb>*}HSl3LWLVte6Q|(b+`q*;OAeD;9VP(r zRwaq@s1ZLbfs#+3+rdp@6=^~Pp?hciVGWKtxt-jeu43dUc%5Q+?D)HF7Psr?pxvHq z+Rb`K_qIkkRTZivI`f@r=eRNZ*c=&ms01loLB;6afo)x;Ef{(0`{IPu8&M*(_wquM z>h;=Nii?|=__#?=hc0C&!KlEkZSnCdv4Z-5tz>sv`EYip5vkU4;cm(K|i%F;+Cgo%t10i9#9^fO|W|N{Su7%yjQng zig(pSJtZ^nul~d>?>3MEi3k+1QKX$rOiRjBA5;P2ZW)m$&z8MQ(SKrwVJYPM^{*W} z&cSr%X|I?cQIRH>LkR}bBoWt?trMc`#~EqdfP`y)6oo>4X$MHMwR&TGoKA>qa^O#* z$jZ#3UxltC_IN9L%?$gcDiE3y?jf)*W zV@$++i&)az3U4Qg_;zSJw}od`X@}4~k7bj0h$wF0Tn1uckaCzxVMQ;&jA^}#3iw6f zx$D)`9S?JNQ@MvZ9A!XmTxI*!F)TM|+%@VE^SxCnWIeZNJ`3jdk;KEq=E2bDp{+R% zgL{|Nt~}RdPh=T=L38z@uy3?QU`3>lc`oIjui{z&0V&RsNqCY9BUMeGj7e=~T6<_fj!8(vnyxX>oxF;>1Sh`Lhs(MpKhs9vLSg`seOo zQ!>9Zph@q7sI^76=6}4V+F^X z2{w2PnV{+mLMGS5;&$>}C3HGRbpI)Vtn=cwD8ZF)0xN-EXT;yuTKCQ6HWfVrjHJ!| zhjIwScVcM=x(^QRFBm!(IM}X0wLDrHvkpZNE(EFDm7mV3?_{#GjzZ{7 z9WVj~S2ef)1XmTag!DR&%!TODT^dM6YT)r(yvx&e4wzIzy`yE6mfDfAOnEW~T~6)2 zlw^2MMj>nea*I=qbT24+bk4>LMZ6En=4!F;n(5Ng21IF`AvRRk(*X*#!!&2hw+$Gj*xxL>2kk5Szd5>O_;LWd?=6bS5wh97M)3 zM~ZiI)Ar?#E!L2gJDIooLcZZLf`XVaeQh(Gxq=A4efa(Y1JE^8tKH_oxY1UV2 zZ?5lmlm4miNfQGjFIR0W%>s@WtOxhyur66qhviFBY9~vt`%c6bQ&zR=2DbT%nKUiP zj4AzXJJ`~$wst2H#N>54Zl@J|*gN88L{a2YiZ~sABbl(P?WkH0;d?ujWmi^)Z$2p7 z<`Ng`6|VcXwgX_PVO?(1V7_63mo7pHsu4ngKI7^RIYavwtZ^0|NMHyHu?%(0a0%fR zPan`g#L!X_`@=auiiyx*JQop%`Jr0iqW*y@<--JBduGV_B4+X7B!%{GAk*b~Oabd& z6Zy%)N942_v#)Kj^iJ-;7-$Qdh>+W==0+xwlcoMX-`U1H5>Jvlya-M^U}i3B&n3o9 zmS!_xgghu+n8ec=;c0Qy%Evkj#fVb}^0pJwI2pR#B7<(|Zx|iKaKK)u(I$QKf8&*7OZ6kj@cExFUs9OkoKq z#gaF57#W)=m;Ncr2K6%-67Btall_SrGQOg=Si3M&TZk>hTA**_T`sD^MHNZ;?T3Xl zc}F?|zBhXK#qT7-9EjrP9>XGIL*~Ia4NZqH5wxOF3Iu|6CGiFt|di8gd-zX!h+WjLn=23I_K)h$*?e!MxW;@+VOpft(H)xAz` z*gcP697yU?F@v&s_n`q1*L)@o2NeV$;@U%RtDSd;S#6;+Gw7wdGRM0I>$IEq^?Cku zIPk@NI}oRsKE;phB6Th%pF20&b@Ti!V=hlSMzb2}wzEhkZ$gv-h`7cK)z2U%j5=GF zK2@2K!F0w^b1GjE?qWi~ZhDPOy84b;_SI-Wj^XkQ0(yV{;I%zNwAX<>1GhGu+bZANApL?s z@U%$~ju1@5gq{oIZ$%!?VE@<~sEBfeNu?cAIIviJeS%rUtNkzh;0Oem@2`ncXQGMn zE#O@oe3xtp{kjeWGlp#6S$=UpWg~Oar2|Rc47ddK^>65Z-@%a!=E%}0q!kE`NNY(y zAdQn8t?{`QX;l(~WwEN@hL0zgubal}tI`~vg zku=c-P}5Ynh%BTX$*<@ZCau^fRNq6ZEHH_d@0T2gPk+qb6fD2#F~Rf%P;1=Ue0%AH zuX8vo=m=hinyzDZs*ki|wH?ikq>AQ<+$!fzi9`?i%g(YufsqljSr)ltx2!1qf@^bJ z2{YF(2~Rn&VET3329He4K>gz{+ybrgHKovxOgQrQ^`>!km3vWlE*zWT)bci8{Xi^? zJ^Vy(!^Bu3aaO6OwEcod0ls;O8T<`rQVoUcEb;|+-}WRE9##v{_BnK?M=#PAr_bB; zi_OecQwfBR)&nZtZqo(M8mm+h8VdOO8;8U0`Da6Q)6L?S#I$rtQ~_0;Ejpb|T}}u& z`lSh+tX^%-z@ZVBTn6F$o+>AByqSpNyTEECL-BBgrTJFp_K`^jg#=_hkdR^2+qomf z@$u43gTj7FiSN6KK14JaOs}4^Wn!3c!_lN?LYAk{qtVTfB@lLr1uo5eu1I8~Z%Z{fSn_SXrW0ogxI2m=%I}rL5`|0$EpxN=rmN?a#y-D zT!?kv?r4h4!WHVV+*A{mZ+?T2YL+A1fGjdPN$v15x-u~aSgLmHeNQOcovAORuu85b zN3C|>k^!@!3jUQc9LjpCiddl1>BP2#zBscPlieazgpfg%}WJ7UgKq4v$fC`D{`^qy!(Y8i8%{n+d6wp8-I5RKjye=PJn13UoIZEv*3Z! zr(EDb4~$BXs?8LzS5S49?ufYu1^yxUU5N@l-|+TUQjQAJwGwWUx(SKb)_>O7tXE1w zZB67tZ$e15M%NWv1q_o{WRO@+l8Pi&YMXcbu6lGd2uSve9Hc7Z{8ST4Cer}H4oE>D zry8#*q^An7eEe(W4=qKc_dm%sfVT(S;qmzW?yW8HJQW4cRAafCXgxbqypa63oy-*M zo?(^x(e-j%|7%=0$c+6OGnE;mQ!Xt#&k(w)uW<-ZOs>rsM~_mHGB@!%qFYfcG3W?f zDKM3vh&!t*M%43X4EVi|mQ4L%LpfQy?3iyo2rHd*qL7&F&dSWufP|`wS7zgUbXh{M zzdAh;c76O5YQ8+?Q)PcfD~nD-;HU~oQ)W3Ij`B8h+)g1kPxpK8K85lfxrS^5w;e{| zY2;yuc15Btt@ZnYKT8D{%PW|LM=47e_`YrZaB9j?S*E0!?GSfmupuSm^|Ityse_bX2>jf zvxp*#@}_k`vj~C8s*S?g!eX>qcrm5Aj#WG}yuuMUk-0zrvweq49ol}uAq)wSa^*`} zqDVx`uxI6|5(dN8}FC#IXyA$-TE}eFkiU(Mb+Pg|Gx)p2s~6-tyzz!h zb&TeDs_Bkky)+DIdA2B>K0j~JGuK*~FFg*8evVBXgtqS%0x?&fRI}P&*QrSYA|mM+ z;AcaY?&XBgVsEwd1SElmBeil9_N2un>#5gnDK&U3?rL;hkhT#S@K9b(kMj6(SKt4Lc3T^eLqmo~nA*hnT1#hE8Ke2iSF@#{ z|6p>CUR4?MTFo{!`+fl~N+F1=WbJ?5?cjwQMKh0UFI``S%Yb_2z&o3DSJudJ!RlZ5 zogok$xE`26Wf6e0Nk)hEZ~@eO-AqI-RF?UkGS@{fRB3{ZkGRMdM5V@|)w~3v6OWow z>-j`E!77N5?Tcxe@(EteXXdd&eix{BDzlqV=OK!~UuRqVogf^~ViY2C%6X-PQ&jGt zI>MkTaid~UtJ2aAh0lOl4p6mwugPIzG&Q~ASrl@a90>DAX)=SU^+bk#tW4D|7$_Ez}`9+ z@)bMs6}?;k&D`uuacM)tq71gI{+rJoTZBawlzxEHhR&QvO8DFqckE+QS;4~R*XuT< zh5gIR3nbsel58?e-R(ZWM(4*vp%!=hZ&Q~cVPt2g2{hYvR$w>@@cfsT2T4J(hvFsB zE7#p+3p|)RLmQ*2+fM0A4Y+0wNs8H266?;4`92ywB`R#RZTBxLZ)nu_OHHZg_7PPa z(JVpFJ(AP^NewI*l#xLerEN`cC2Mu6X{?FfDDZ5wpY^Vn_7FULGLuBuw5S~3$QbQ6 zg(~fHQ=!`Nm|E4hX%ooFH4|O*!16=YVF@TzxSj@;j(BetUb_)YnFQ^6#=R8in6Hq? z;$ZID+DjT_Dm1kbVD+00NVu;q7Iy$Z0Y?2pmEd6ker4ecRQS$O!8&A}&%IpoR_n|1m2&TvU`cpAcW$7oo3%zA0irsPWR zpz6H$hPvTL6q{w3MO}3|;`%U)T8A10VxR(*qIA&w>%SIq;?rS;ww{Eh9L71hoaNnHkTMb69H z#Q>qMw%XUz!R}M{Wl!D?>^DCLlITBQ*lIb*P;URr$1lqb^#5j$p4B6wrCh6!#}%J5 zv>AGmHqkxuhbE0AOxLqx*i3j zkBv=`&r?28V`8K}E-z*0c_!s&V^Zg_u+-x#j48wBBc#| z&2Ebc8#>QDo1xYzxMFp}f5Xp(cHM{Goa6Rb7KooXM-mhma^|YGt}@I&hVjBKbIy+e zc|Ou^LoIoiX6vkt&T~oBk}{ z`-kU@39fv9E^={}5J+Y~ol}K=MBcTQ4c<6Pzd{gsT<3>bB9{NnJ=ZBgczeCXj4m;u2p2^!epJf?^gml%k{Q z>-89h0bv3C4H}Qn-HoNGEoVh#CxtD0GnH~`Df^Wv6m6B;fc z=o&9I_=jx&^}S94Q#&9MccZ|hKC#2Z8hr&j)tBmbWSa4y9X=5fT9_?~*wOz$S6P#+ zZ>~3|QqaL2p!A=*!^!AUijMWD7K5vUqRGQR&~-3q6VTF#2LxR?v13$*&msxKF#F2y zN>TvlnJUdd&{ZJcs&Pv4wr%&PZHeJMd@1IOo947*FQwv*O=lLN*Px{8L!^U$4x`;E=Zhcx!MfOx97#~< zGgeG^53!{aMpNhE!jF2IfXu755KTwlbw}tnae*p#Mb10O`TQ;ibpcW(Y1b$1-Gypt zE>zXo=I8keXpQ?sF2FRsUj~5CzWSrV^AmWS9OPS(>-+ya*VsZ?nJN&KlGGst@~I19 zpy%qjIUu$w2M7 zTkMh)sEw-2V)ABvkugm(DaPA{C^ow-4Z(aToTHMy%%mXp06RB3@5YnG=!|7_&ZDLA zar9_3(BD$Og(E+85mkIZg$xLXY0%aN1HaX-{}`kxaFG!pP~2Odj!bcp%YZCB51m~o zcE&x^o}c>Zv&lcVMAc;Y&_t=Rh$4?N&}>N(#}cQ`CU31&3(Vhgl19O`+B&i9Yh z($}R;5Up&B-6PrHO&V24GZLvEcqV6}53bL&tultcUKV7~?NB=~gR+l!%`1F#;uSin zUSprf&F*IQL?K1w(n;vTrZCFSRa{0H*_{{@*JPch6}jb{?9$7kOdak zrA2kg!-U2lWML70bM5v7=7SFJwd7wPMd%Y3?>1xacB5Y-3|1FlzmBrG;iJDnvb{dI zP)3k|;r64QHYCTun+v^}*7Z@qpzs$=2E8bs;R1iBi;=%o2^=VqGN3S69?74|7p1vf zwN<`TC|Gu6pRaeKiQM*pB;LckZiz6zL`q^hf>tMH%BYYLqiV_$F7er*KbL4DsO`ULDUSe z`hh$EF-v{)9IY0OBc!$ms<@HHh158F6N`zT>q^_a@EfyNf!&{v3M=h>g+vu+yn;aG z6?&dyUfiap+vjcf3p;6PYLlBxQ8B}Lnz~dGEwX4h%`s}s0mT%O_SZg3@l<@|%y<&0 zBdS=3g<^Fpi${K)h5fj48WEeXWaeLD12KI=Q7h#2p)Of}VwoVKn0`$H^LOz;LR?Ux zOlq5?<@ChW?=fYVupF83fFuA579x`;diV^vDO|`8ouEN>cq<8w3@x|AMkB9OsA0cg zCnzjD`Lsbv34QxDAGQ0=liUGHz1X@U z^wLiJVzlYj6jcd&E@VvliTbN9eIuHDkK00N9g`JUd_(3FmW9oT` z$o1Y=h}Yj+e46wY)2WSvhm(bi6V&2pnO!^}xQojNn#&u4o%MW=A074bKh)JsCDCv} z^cQtS`$b(x4i{-NmGI(Jdf0Wo{nbc3e(up%h zis-|W(&XTa7h=ZBb(l)7!{lH(Beaj`Qh=qKUJKplb~)bOP5^DuI*b#a6Y&xZsMhfUd$RAjgzRth(i{x$7xy=qMZR*v#fwYt866!(HM^M(kN%pGa$q-B$!B%RVyRK zs3KoOZcNPg)#mgGhvr(Hb<;jfMR{QE(OZE>gppH(qio*2U)GhO1&F5eEohC$mP53{dMKC;|Xz8DQmxiq9q`dF?|;*p0YHhc3|78 zWn~6(hi}mrZsGQ)!fgFEJ;}-PGDX`1iu4n{U?2X^F%PaA{C7dHZ&PB>Vm@6nRb(_q z#GRoq!n13K`+i^kzh)*n99HKN>*t{;H~s#6Q|FN=r=h^1IGDjGW`q9y~LshWFI$VEwZ*W|qAHzNaIm60#PcdxplbAta_aC9(1_R?cWJa6 zwX`n132QHP_tIZBQxXQ~uYGgBKQ_emDgA2M1TM-@Y+ZiZb10EOtH}8|0TZdkxN6&G9EYI2b3)Di=WxH;IWo z!P-&L_v2Rq-eRoxHATXn$0ner1I+L9397y@NOyd3ZE3<=u+)eCIv?RHe5RfQW%-r7c-*0zRt9wHX$0$nESQ4o|ShllgCb z=U!U*<{vot8$S-=-vCR`iMhaE!02&nw}Rb}1p6q^i*AFN;2HOJ@w$GVc6 zy28_s!ZVwc&6!e=zBa4V@kh7lOGNA|Z?ttGLH#pp)DML0Lt}4M-c@AGR;t8<1SP<3 zWnfjtK`Gk33Loo&I#NZ~s#H9o>ll^7l#k_rlmN}SzY^DFpuGr31F2B#a#5eBjM5JX z0E-i7faa3lWl(tP<0AI6LAP2Uj>cu}LpEEQV_3-kRb30V<9=0F&m>3zR{L_wF}V+v z!XZlgB2Bn9x*&HimTZwYCdR(uQaIiY_$+_46)K_!jWJ(ccKYgjDH`pbTIOlVG*&G& zse7~a`U=Re>X7on=3EkYI#$mHYGNq(HSsEZtwc%M$%W_jC&m|4)ber@fFbP^?5RyO zdBnquEA{7#yEX#L_<8J70Jy78#}IcpL@IA^O2aABGnzmYlyI3!rcl}LZ~NM}@@!YB z67D&$Df`p=f!33#%egzyDKD|#zj5Mrbt$Rd-hs=z+rkuF0EzuLHa*ZzKA5d$TU@=T zTKz)tJ7g|XiP>tgMmaDVIB$iCc6MUjsxKkF2|hEF8XJLnUey0KV_x4yEwQX#Ln*Ez zEU8ky27`$O=EIqI5xG-Og0-M>V-O}iRB^SD2uY7NX-CQLAWiF=hnA5q?feOQ1Azlk zuG+0mi{?QX*4M;047B3jLS zl y*_F+*RtYCHp;Dk9on6`M!ZHfa3WU8qmxgvFebAxQzsdbLqA%s@i0TRca^TC1 z(VX00p$aGaMY&Wr0l+K~Udr(?nrotnrS&>xB%_~D}(8qHbp@hM2EhhBF`>P@y`hvJz2m{!ET z3u}=ty7&U?B-i;k^|GIfzLd?Q&JsM+w~M~1@SD7a#~(ni4IsQQzMB8#eOy<^heYK5 zJ@e@x_Rv^32C|;JX2*{i`rE1JS2uTUqv)pDQ%+=)O+YTnq1gTryULWs@$V0(Qk3y7 z2QE$OP?#5b$S4CpuVGUGBYl3b;Z~H98N;d~-en&=@mE?=-pMl@YeW9ebmej=DLI^x z6uSY%*+B|7d zRIJ0E)GHsw-NLe38w-CM5FV9&s==NOS>nA;hbT7{JC7f(?#C>ddaBaUbD}7lF(#%y z7QO#xx-KXjWrvWgqBTCgc=_U@DlXnoK$7WpdZvU7{AaqpI9)j>`v7XHQK$Pa_*Jni z9*R`GVj2d|+w!R#hGs==@W85BTx)tY8x5E5D-Ri%={4map-dE0ylCOV?zz&Fi{_oz z&-2Zi{+h1#o5vCIhIxE)IS}&6>c6I|J!7!vH9UnpFTp(nTbxd`J+>&@bW<9Q5r3)6 zEMe_>wHZVmfp3)6cW}9U$B`;@hC@&U&y=@Nq7!2P|_%AAdzPjPgYD(56)u{Gjv z$PEd`_!+ttl7<#Y+&ApPaR*QT=BO31v}GM&05yd}*PSi>aETU3-B; zCzi{=2uA@UfelOD?-D@IN|WBfk$AC8x5YO0@gm%0BS>+utu2x!(`@7sha5;z3JIqa ztFY2Rd|c8b%+w=RglEo$#vv!7cn!F>5MET`H{}ei@5!Gq(pvcn6d7;gI2CT9NJo7j z3$Q=8uNlJ!OA6i_ie43XTAB5_h8Jyxe-(4^mzT@&`ynKORzRZnwsn^=%UI zUV3D1%o)~>oaB<0q_06<&?H@7*`}QKh}NN2xFVt*x9lHm(5l-Q7*SG}kgL*kDbh&o z>NZ3nUmuj{owSn@RuxC~+$ysfxTG$c*R=t`#MvY|dFjZK_WiokWA|&i%8wJmW=1)$ z3y))596B_&j~6(7mm)qNZdI)4$|#}qY5k>N@9fB|*ot774t7(zyDI+iWiGQ9&-^!+ z-@N0VHUqCd)QUWS%O~Qxe{Bp%IFgk*y0w3cIX9adb zI~+2!dj8U%48du0*SCQUCQ$O&g)XI)<#3r2A9{J?di5v2%XzH+S*;@-@M- zK0ePC|C{+PL%kU~+rfPSolouOu z(jTnS<{*7Zv&VX*E_WOny|3 zM;Y8-)%8GOtRqgvpG6XHrm(I(QQ%R0%BIb4gtUru~YQ!~%>?jU z(>2H6I*2#weQSGqN#?ahU=ZUq;BXAlrP+-+|B>UM`iXe?@+F+J|c847KmV$evi_KXd1F8nl26b&?>`fUe!CO^BCc{vt$0ZP+CS%-5=vOsi+0o zo>6e68JB|g6GEk&8PO}eYAvpqxt_AOMTPw2NyhH*Bxq;Jbj{e7hQo|yC(1b)Tgo-GkL^_@&pEwb{q;? z)2ETRHq}^~;fb3*uiY+jl;+RE$TvLcow{U_L`sq4z9#N*a|x$x%vIwf zazf6FdjC#CeWPi6NacIq&kCHzHX|S!8Js+xq5PC$B@WG@e%ABkA$HpU2D@{il?U7c zzwrtofX;*3Df1+Sk>%ChE7BoT3(y^N8|FMFI(>jgRqMGID^J;u5dk9Ju+7fz5ria%OK#(ow(J zi_5-OWF$;906b`ste|dsvmt6H9%BK@P8r~Ly@TyebrTmh4VM?En03UKg1_DZ3C@xs zCsvYEe49vL3R9F+A^V@rSs4Zs-a;UT2|Zt5Dl9A-Cwu`&&^aI{Y#4jqtH>MSsOP*{ zhTihl5&J5yZpmLkO8swc3~8U?*7i>qNCK?v2`hhq>xX2+e_xn&_ENH~gr` zCnYAO7S^a{XX+1|pn$|!-+*hGs?}Jmgxt94Prp^%y4I%&EY~1Vkl&K%;w&8#a;%$$ z?cBY;*|(`U0(hlQHW(;Z57pr=-sc`;7DWA0P$|`uD_!Sj1Bq!VMVuVVe%V(8Rmg5F z4<;R@#>$~aPGu1qtTCj>&NG;D@+&G@)2V9LBcTV$&;eu<5~ePlTQKs~pUby`&c95_ zQWnU!tabZJSCy>LQCiv<=Y+I?Q!QWZn$}P>tU-2b#yy0G>a^WD1k~w!ghfLakdMVC zovYPa0O1gCw0#pRis7aij7^M0)7pdVZKi>*``?aqItcYL%<$>d$vDl(gDCuM-C?RlJQgeN}U*$fSBe8kxSZQHM5- zBr2JhT>0(m;h0woQddjo{oecQa?9yU!4sAP5uSdz5Hn?q-|0ZLZ-D0?6ezO}7D+b6hy9h35@`TtbNN^DlMGjn$k4RD;UMm|o@Uq;u;8)NFZb-pQ74)x zm9ov?FvfG~EPB#ZodGDqF*ECD{MzkB$fI=-GRAm^c?HRy5yOc&nrJijyk)gMI(2%dQ_}2bw zVE#Mi9T0lvLN!(7P+g_9sz9}AaVq$hJ04LThl++ci^H<;72wP&mMfC!f#hqvF3CK+ zxHdg=_7Q}(=BV?xMWAN<^RM8B2=`q2)#m-4WpX`yr0nPpbC;4V*Z-j3taFkY^sxye zg)zo5Qg-ET2eZ@l+Bz0@B!bU-HdY&;1_6s3L2(9J8sMXVm5)J?@q&PX`wo3U*U0* z);HN5Y*;PlRyi<`Y{An5AB#)H{2UV*k%t{V#itDzrFC+?l*RnL0w`p_{L#{zG_}Sk zMAA7SYfAjw>D9iUN5bBhW>kbE(O^H#6~OB3-Uu@brd1gK4o z8CMW8Aa8^FIcS{pt!h`E$Y_`?|^2~vIMuE&`)7&UJp)>3L3Gu%Kv8Mqg zmGl*EgKLOrb5p6p4iQNg>MWz4pM17Mgd~JE`3eL6?gSWP^Rey~maBPvHeaG)SRAO< zxahCln6d+B;SNGSpFMG0@Wv7fv?xZ46%fBgr3kPSb&OwJAt~||Gjf!xd)I&;GX`VU ziarxc+F$2?nz}G4h2gy{G|hDz6TH7p`#NE@dE)K)K=g@H@8-S>0h-?gJwX<#+zZWp z>jQl7f*?O5)a&8GfuF!QG+rHq*{^%3k*9I|uHzNrTED!Ky1$uuyq>tLc2kXW8__V2 zRN_N6e4tLRTWn5xanoUaS44Are@{ZID0el5Rn*2T53i~4Og+~}L4lk5P|(6eawH0Q zH<={^WKtwCpRIQIC(6dc>QgfDnLBe?f0#S->k8R>iI_o`7C6Q$4e9A4WBpCLH-^KU z`r$hwvhNFWKv%f$)El1LzR`z5n>J_cQyy-(Ey*6pAj^Taj+jrmTEU5}mGKRfDJk^C zL@Au1?WugVcD*xXrOq!n38Qf(lgamS^t$~Y=>66>Eq1jA;ccgXOz zYd(LqYtGS{4qIKE4U4TQ1*Wpl$8=yc*2h$^`ZOlR2&ST7z~h~_oE=bc_J1z?{g^xR z>2UFTa-na@(U$r5SG9QI#-6zhUA_tHIWLAl^N4x%v`f0(`ej%O6n;7rCd}TUd)A4i zzCL)}-H){$u%?={0{Rfk{j}!*pRd;}49=8Cf>w-60lqh4Aq?VgT1iqm+w+u=xRv;E z#BmHp4kN+B#v>W|=wsoEv7;ThUWTp@+&vcpGER3%Ia1COsNJcd3iiGVdjMCAlkq3Ab!_Q%W#mNFf`_uf)Yyh%5Sg*@*U)gjT$iocprr=vp3$7PrEVQHG=H&sD! zc`D;t*72TY7g>1${ur>Y`T)$X0FSZ_D`>e5`g?x3hN1I^o5fyic4{58X!6lwcV`f7 z39n2CGgg5vd9b1iS^H#^U*=Ja>2b6s>P!nb0Zfhx;Z}sN2SdeGG@8iLcq*2GL1@|0 zhT?A1KRE%tts?`8k-zTcohJgU8KlMV4{=)p#<+O8HB0eQ(*+zBhCPyE$mpeJi zUk)|u-ZPL)-b$|OjtQ%VBUTC2#ZnhLtENZyLT(e3nrYqCy8ehy%fBlO$h*l4GjL)J zBURdbj@Cqxy+C}Rd3*#ci=JF;XVmVok5zGeP(qQ&M>H*BWLDUq)lg9%Kh(WT?l zb?B*dYHmL~m9J6r@zP)4cy9d3 zHvzXElflHO&geU1L)NEp)5(uGp-*djghFoM!BMYHsU`t&k^U2KIS1b6BV?Ii;b!i* zYX6MnwqtcgP?W8UoTROGK)0J)0$-TEzOL)25f!@!$C!6yi?~lkMo%&4$`5N{+bMgg z^lw0H7L#C4oQs$Ihu|7ivB}j#Od&@hUYtudsJIm+gMq7*TlRN1=5wA4Ylr7jZV5Bq z%PXzV%WjQIG$hy*8&@zMwa4bhKY8CEY_IF7{)D69+p1xj1d__vQM!#PH$R+H(<&XH zItYOM3b>-&E!?lpU@3W>Gl+=+<1+qmZ3&05^9g`piuP+`wqZFwG%wDEZew{xBt@H- z#2mSmg-KaiiV4^0*MeIKY2F8l6_p8x+u~y1GA@2MWrl~^EKlB^b1&H5t9XLxnyB+~ zAMG*WfFuMi@-gXFs_diNt*L#iqt|8I9vGu}B=`_l#O$@71rAl08853Es*50C8k0o} zK0}w;rK=StANg%Dc^*;qeseb`nB`=!U6Ic6m*jWot?|w_(l%}*r4eQ~&zsa&ue{{X z9E#<3u4y9o`5G=5viWrzjZs#7Zo?u<9oIv6YUyQoCYo>k|2K0>rM2qd+DZcR zqTPIpEB-4fwe{x}LFUCv#X!cX7SpLJv3CjOX$04bjshzNN8bkL|7`}-5a&Kh7Jz5@ z8)!~`gWUi)MXV^=_A(eHJEzW^NQB~lz0gubMob3WrN1eM{G2)1Cc`+|_1@S2rjtbi za#InRV~Iy9Jq({(ymeTxC0(5cAM1QXCTu^mI7L)a;i5Q?O z$XcG>A_&a6UDFKWArK8rnXI6WJd)8sU-x6jLz>Y*-tLpbLz3a}bOQ!=c#{R;{7R;( zek;Z{c&GAu5&(9n`hC-Yg7W)?vlw1XxBG(_Z>PPJ9I+36vAfgX1NfAn>H(G7wdTn{ zB_|HG(_XTZI|1+BdsqT-qhGmDhl$YAdUGQ5$&3;8^6BMuwD2d zzL&fKEknTRl>NMFU>rjLm+P$8x5!vj0;+=lMY`ie6sJTK3**0$>1Qtj>wyiU{q9ZU z{w!dWJ8;S#-?ccv*A~8!y}N{jt(X8Ex>UiZVOO{^2oj%{OJ;3bemiPLfjP93j@}_q zk8?%3H*SX+3uK`|^xBHg^rYFBJah^N4Mw_U`NKpEOX5ay`H_90@ZoR*6@j1%0x8)d zZ*gJheR^#wtQKkQG@)37$ga}|5IOmK`#<`1b_o{5-+Z--V^Y!uY-g+&mjA=)fLWOy zN_W!i zgw<4lj4&%OVl94NPg%WS^+r0NQ!3=UW^Fk)X6JqcI90U6)91Wt`3}@Upw|1A<{l1t zO0Md>idEsF&@5s}Xo{3aQ=hq>5SyLx8}g~d91nmVtav+W!ny4MG*+S+v8;z|A`|4V zaFg`61(VLtMy&R0%l9OjQQ2kf+6N3bOF^+}0NGW#drLJ3(dAqaik%W0G$xhREF8gA zelzBFNaAG=!*TeZA|@*ZdwFr|t6iZGZWFWBOXs!CU21As|0Uf|A;cr&mRJAO&8k?e7xeX`6Gu2l*x`LE`-&8{fo_aINDZSR^!Zou zN@8TFff9(edv`*$PY_W#Qi+;!X+?~{=z;Y;kT@&9BGqgjgZ2c({^{t_7Ez_#1^V+F z@uE)bz~@`$!TQ1yW zDhtkt|7!GYMv8cm&jVT?zuOfM;sr2G{Rx~M*_!xGm5&8I9e|l}7|iPnoUvZ#4BNg6 za?uAK3dIS3RicE`Z6BSgZ##~0ZLUNry)|L^8KLj58)0X@)DSOrlt9E)>fM|bw4 zBKZVKtpVx(zr}$R)_>Y(T+UY75egrv3T31F78V)Ehpd8?L+%Y%5ube`L6~1>b*lm> zWd9Qf09v#p^y4BpN~Ok!)b8!?kt$jt@#lRpDB>|^MOH-)gOE$Tw7o6i6Yu?K%u`(2 z0nq-_29nZ{e!9z63DLZYxrYK+=)#v>hZ0NI7FPfL4q6HFyrgI>P!xfZ(_F%yViS}n z8E`ZF&tA^tc1O0W?orjxMx#x$plEEd4~;4(mU{vT{$ zR!&meo0ud!ZyRD~znR^kUH6bDx4$K7_Mp|z$ z0j`Om+6Lreyt>6Iwvo#Nm|9so7&r1)9I!>Q3FL^@gz<8UDrgKl#tIO?Qw3um#QS7T~Kx*AQ?d`*)?X=;QVE$J5|3HdAn-aw3HJ=++uweMIt&u z9=)08u`x9!r8ctb{-U9jg!>RCJAUd|(%67x(wD3^E1cMFhVq@({zNAtGlJxSvA*bp zWQQ*NZeu~htCCx=^`W9le8Ds2zX%n~Iicy@bQ9B=M_J2Pvq@mi+HCOa0%%|R^N0)B zUKTi~s4s`RcaXprb3wwX$m~+c;!9(!G8b+|k|q#TGdE(k!3Pq%^UX1<>0hp|ON_ zg!`~0($S?A9oT6h9DVnad#eBSXq?(XovwP7-KOcnIfL7pn9R>_J-zzn5rD$7co_!v zF+PZ#*ix-{fG(oT6P34sNK-=KKnT>BY5&)`#f?iwu13FsVkIv%e=50%(eKzMd+{@~u4&=uj&j=3;APT4#AxB9wWn#|N6se| zOah)PrY7?}#IYnM;Fs7q0BMsWrS^pU1l&eJ7Mt|J48snRobI*(ErAuUV{Vm>!CeF* z$vjpjuslc+V_-#!B7ZP}`jvzWC8Mb5+u>C4zX=eS5kgv49yPiYJEe;*H&itMWjX*t z!CZcY3^I$*dsS|N9)a8h3M710n_12Ct|lbYpDLLZKu8~NEx6^s%@t98V`6S+JF%V*?o4&-og-b(ZY_xI*3=P-HX zMVoK`uilHiC;g{*C6&vW%V%=W;m^fgewbc!*-vhh7zRr>ec@KmU){(c*BpYZVKC9~Hv4C_cdUlAdSSbpL~b@8 z19#-u>fWmy2_J%y(iO1-!)0@RT5zO{ni1hYID3v$CEteIb$B7Jia#0;E-m`KbsnYp zJCYZnrcV6XNDfmcvYH>#8~yT@m6no&v`fZ{G|&~4`_Fab5*qY}Ap zGf6~_jJZiXw9uJnS?9W3VIeqRiIZ^5f{?ORlyDMDlrL%DNx!{<`n+&GQA>h(MDM_niow$mEU$yE@0HWp5k#)qSW@>kKGhXWf6EWDnTZ-=xo>?hcVb0zgZ zMsP9dN*4FBT$1+9BF<*99H#>Z@R5KTBMo#pYnWpHLMm@lHUz9~i5h2)r04pLoY*#3 zi#tdbGmD#;&1tAQ_e?UX+4ukr41OEwfBL0EE*EZ-ku{*RZOShYEu6>z%+-rf{UUpN z425vwZ4I#M=z|0e8SWbbNn6sfrn?Ww*1IFPdYM+O(cLV)OFRQVvZl1iYN!Ztu|)TT zcMS+L;Ec$bCS~78NS1s(c1zSuL=L7&I+(BFl5aB6!llyYNFP7? ziB>?dEh-+7af@t+p7hhDNYDyy_3}5?WD8Wq%&SFcYmol`Lv|wzfQd9g{{}+NCi5z$ z63dZw^=kl1DaifxW1EN~oKY#fhf^y)b%T1#cQpVn)!aN}5dygDAATiY^X}+rbK#p- zaX+Cv+&aEJO1~9};I*}g`GNibHZ)@zUzDfp1CvlDNihubZ#@w{Xk?8R;Cng~R-tOU zUvrX4Bz1EAaRP=?h68^32K+G@mEwdGqvr=!%n!FVC+FSuZk6_=n;05pfm|X9KV^Vg z;6jkLKsAo#O%$FtjJL78CS+&*3{)g#vK#;`Ai(BI$^kAY*K;seh7UqYj*X3KdzLsi zNOS!nnX{Yr7(#W}=DczA`RMt1dii_qZ!$oPlZsT8Vg5*nDen>_#h?Ji3cOT@mn9H!iUX zLNa#Sq%Bmcifl+R3UhLbMq1TYaKX!@8ytrcTqg%T!L^>Fh7EFoau`A{T2|U(za2{L z=@=ZHO=lb?!|EeLJBXr()Xwx;BvV%9nK+6eaM_Kecj?dPVn}ZF$8s_YlO5t1NEXyr z*M$1zp-EWory7lImqbU!fwu>#4U#SPvg+<8QeQ+k5ze_rA_Fi-H_7Fyk|+KgmQL)r zUz^zI)PgSCebl@3?SC?f)OoBCVl)57veYW6UCpU}3tBLChvoFFjmaa!el^2nOM^xW zqiP1qek?p0?%S9X;!eknQcG*}Jk|x9W zLB8e~E{q1Uj5|?ovlnf)n`}0d8D==YtB#jpOK}#5{nR!aD%2pPQ?In2;wb0pli{+U zPS$Xz!;!My?F_V1PEl!y_wBkYYcBR?e;|FL0<*wg){0M(ha=UDwaGMt=hWq0rgS%l ze--bCsH(8h|6r@rG^I5;4rx3&miyEb6-GRhrP216=*Jy*^V@c`#>Xv0Gh46B*_|)5 zbBrD!;%dxp7H@ACZ?95W$ysT#Ay1-(f2dPpLN?+4!nKKN=ttYR}ESJ6TU5j3a?8a=ujp4mPicI7nExtl> z@eVG%9mZpt`03OcXRWaZjk`%iwUjM}uXA2U_>2OR5aM&-vNaWI%a)`s$UQJ68{-#7 ze3C~X_7=|hOo*CqP-qh(){psoyUHFKPhgsY`|owZW2cPH*~R{4g8wN)c}SoG+h+ZC zKhCNpUh=+n~2V&Ng9sO9MDyLJ4`F7L7kgkh4JMDcTlI9iDyMuBaio zT9#3St);1pX$rON$ehd1RV2?|ctD;px4$Jf*+1pt@i!)h!lxAXPl!Tsd->tH^j8|5 ztS?fMEnjLUjpuFrWx-+VG@+e&9@2S;*|0F0>tHz?of@)!1^FKq9pFn5Z8rdGrsyEG@ZO8he<)D1wH%+F=4aou@ET z1;f51%%YnWsWP*4#PZVPd0FnmgRqyR*^I%#!(#ZzrgC=`VP7W@dxTk=-0kcBH8F_; zY|%Xw2|8>#h%Z`k=QsjBMivu<0S0h0Uoe(P@tIP6>@h*9Y_5eXiPr0Q0Y!K6^r`#V z8EcQ)v-bk7i1@~nI!e?>d7t^bG1qew%giH)3p*<)DY!aGuj4PlD>^01IuVZonu~HS zSO%x?@j~;;arrH3iFH_)=-{FFa`p@G(cOI226XUktJuE3^$taIWMjIwpQx`7)!R&X zQ=e4SsTTF663xhyi2J;5ySe1$hSwhGy&hYBLi8tov#iT+VCTIvgCYxT_M-GyDap|z z^1b8KzB7TOmO!4QGUBkaCbUOY13=cbi6eqx;+!k__9Bdhv4A{%AzmWm!1ff_so zxzpIjteftF6Bk^>0W@nKDdC-0l18hqdCOq*61!6~?=#s;%nn@=ED@-ovf7!oP(LC9 zy>j+fVB4t`Kfckbe9F9DJ716B;%Vl@%GSwqVj@W1($5WvAZX)25a<@R1)EOi=%$Jv z;{S>YG#qX0_`@MGEyUShkTos6h%E-k>9}$o`ySw>!&SyP)SH@25O~b|Kj$+P$7KJ= zTo}*kp6<(d!p&Y>^DIdzT{2qL+S-pLhe5!tGE9QmD2I_3NE^CpRB}8j-dcJo%Dzsc@OtdKS);yD~Tn9|#h?*lANbXd)tM5XiTBv!2*bJovgZ2vi(`C(eyzSiA~TsH_EwCASpIAD9X6dI8Rz>dv+XHopQ3v+D!KY zNFu8QpQ;Noe%SoCXqNhH0MruXsmyv6D9o(3Z$foPo>y=hPVUKCWkHes*1$4&WfyN+m0NaiFI8+}vqr^zlq>Ty-n{^L34LCtj#ia8Mn_ivE?^{jb3 zc|G-u0>${4gdQK8(}_MkFv2N|7)fg{-SWN z0pc;^KUZ8CGl3C|+(6<(y^}n)8v8gi5&CBp%EX}iiUH6#EqnMfa9y@(dk}k~6WcFh z+uI$DuV?kUkGGeTEm7W`h>h+2>Xu!@jPg3Dc5@Xnv(YjdK&XZx-$LQXdQ@!WsLIvzM?8k(B96Kk9RLW6J5tXxwtb5t-0T=E*n5fPz_1cNZ=-(|_s!yb z6(Z(1>lBt<^FZOK5zuuiI+{dsq$&gMh{iOA*ULx#6Nm$Z89mjscecbFR>SjVSISkQ z*LM$3o3Es8L#Cz!n%+^ZR7Ns;5)} zEgo5l>I(Px?lbD7vviL~$S;3_nuLvXq7Bp_J}WlH3Q3CvEiT=+e+gkI#g& z`MEoi1M)V%%U#TcrvLibPpBGd==UMSl8+C9VnUu)(!-=TLAZ|l)e!sdV5Z)_{g-TJ&C|#~>c*vY-ZaeEz{qCWiE6m3ZySmTT) zS#CkklPqoltv1Tsh~+uskI8(nCSfqRmd;JsDCGLN&jBF#tjMc;5PlVMd@aO|A+xgg zonn<@l$HWXwn#ZOjHnCebtH(xF{~@&OBizl{4})g7*n_=umPxOvz(!YCx!=g4g1DC z{lfi)?l{|_bb6g(rkx?`Q0$(2gWTz#SNfo9%f$8b%CenBuGA};O#Ni$a7|3(NDZmC zKeI+q2ZL;q;*30#Ub+KRMsl1_`3EN&wz{apzJM@0WX;^)5ysEVHYiZKJ-JuwWcKu% zXa;@D{eMS~^Rzj(C-PNko6N{usY4&~aVVt@uH7LWICgiB>`yCs^;zH&FXkHDXEldQ zRyd5Pb$T)lN@H73^%~{!0Vjs+iLJCVo7iZi!4wYeGe>Ogb|8~Ga%g;~_WvB1Z9bun z7!Y_&HBbCerJAa?>O}3;BkxmTlJORWP6o|H8Q84ft3jt%mP{{4^%#n-ncoC)YNfQQ zRl+1mp;J-cFGok&wZAC8VqOXsTOmUsJ&>-i~D_geq%ah+wi1N?6RY<3kuRQM! z&61Ca(N9^^yx$Cr(y#xMPOl&tG(6>y3qd;sgH$AEZN)TD*VyV-mTW7(o`{lh>FYs8 z-W_7U??FbQT^qR?SiXVyG6?f9h;TCqcrgfaG6->CsOO19gglqON=mvLDr_r7g^uSl zA1xPfHJ1oLB{B~)G5E9^?YN7y!n`A%|>FJr8o^~KS)MziObmZr=`{IHRFcXg_08(v+ zBdFgU7jK}#8vdG24r@cSRRXBVF09^^Uu$zY;zR=-5A#%cUYbt0dg~bvW*NXGsb)J@ z#9xaExBTx8@4|u@*OC77V?l;k8|~-&n)91;1-?oDPWiTRH>)=6pyqbwrkkkZ)5j-g z-jNyiccmzGmayYp!HV|%(IfUGLUXq_5CVti$CcRhi|EfNd0Uz@j{A!$i&;&)Mwsg; zP$KqtRgW!&K=_=@tP%*Pm^KV861*3dU%_fcpGGd$W2}r~IKDZ05o<##yp-hp>-nT; zEvl=!csIyTP#H6yIth<%V1Br%Pt#N^OM2z%yuR6YVmmN@FSI)pZ&~WJ)bdz!KQn3~ zbR)tgD1>!;ELB&DNhzow75sV0{9;en*Osfr;+>k`$&aP3qz$c@R<$ai4;8bZ5;lQv zQ^idp%`2G3-|<@M{NXr@5>1k>o3@y*WWBCrF3;k}RCeCN+C=rFmwF7T$g=$_ENq^r z)a9SH0Qkx(F|hY68gr}zYsYT^vy>N(E1x9JM>5C`OV`r zjRY@{T3inFaofCthj!)WOvKS`n75+Hue{KlbTULl;t5Xx>30N}z@LkNF&+HJNf^M@ zRuKB0{+UL+L^_vxm?}_dvWsrWpA4d)7RbELF`g3To3CCGojf#kv3C*_jDQD`UV$~L_Ho)`g{7(hz>4alR(6o*Awo`tz{BNn#uV5cXeGW7py_!5EUh zsxr8&i-;Zz#Jg0=@{itGTLXnfE%gEb4=dUeCV)Mg~2Shm0z-;&NCvu%p?6tvpOOm?dXm5I6YlHBzaNhNNN9}n z+dL;%*!t4M@$gMAo&J0(2Tsoj^{{A4+n64~!moLP;jqhtu^@PXM9F?%(X{Gvwto16 zBG8HrTbMIrrXN%|L?uC74$}xztAeaj7EXT*qfnl?hab*VOBFI1jYhO~Fa5#yu`!B} z03>|;oT10@6cg#4ysDTujLDkb&Wrj<{kW9fun)dVKiOP{OH#}chk>sIDLYC2su)7? zDKzh(dS3TTlZu5X#%K{vo=71FYpWD#uQWNhL!aoFc8WPA(8i=w&zrf#vu3g++Cd6} zMzKQGak5e=OymjMJ|YtJwOJ=&W+9DZENDR?1C*wcQi^@e^VK3TNK(1ZOJ?D4&f$^& z&eFg@0V@oS+~_4Bo+1wyBHsoWK9Eu9-2a3|YYwdxsu`B$#bxxl55aJaSX&+04fGp@ zNG`jm+vGwnEhso_%M`FAADV@~=`5zr3rM(yDM~;n<2FG%HbCb!_jSpDjk*QX+l5Q~iS4O${8!h0M=WA)L7-Y2H^n#wiPs6r1*vW<)`X zP0WsELO_ck$`v_GBDCh(;q)3x1;rr=pAelC^aJ~AbYai%;-3s< z=fBPte*YJ9_ZS`N*C%>E=-9SxTOHeW(y?u;W7{3u>Nx3G9ox3;C+Yv_zVA6RbIvn! z)_GO0YSpS$SJk>|fA;scJKL4E=1|jyW!5z0dFG&BjVSL?SLctyaa`4xO?IKE*5&}6 zX385-)#dGt^c6@QoO1$hO=1`Huv*l7VV`Q|cr6=&tio1IiCESA8@p}lku?2peMr1& z@G%U-oeanV%c(I2KMtW4C8#NNH(JpD<;hwbvjfkKw?i>4$-0{(W_(eyJQ-$_ z_mIN4RM2q%NdWzky84L41+qegSmQUd#+i_Y&=as0jpK6o2v;8kc-5$d-1E)K7v`L)87k8PYaW%8rhvv^}Q5I4Gb?#jxQ;+0Zjem>1?cjd)M{ z@A3 zh#Dm2f_Q{qi+jmbOq{osh#HFokcpV&;uFcX)0q!K1aJe9n^aO_fr3c!2HDWO#>-m%|t(GMWy}3!W!=kMO2OPK!qnTD2qr{&MhR7hIK@6%kw)% z>yXe5zARSkdzb}*6~{r(ZYiA=Tg#Co8ZRytQ8X|aoX+W#VOUcc_=9&AembAW6~G_nLPrgeg>)Z0@KWx&&=@v6?#N^oHl-q2*ZsH^%;j0t*Mj?|2s@6jzd_%Yi zup@}4#ezRIE0(+=l74;{!zMqNlU0l4Rlm45Qqo(;qR?E=fDa4WL>#rny`hcouf`rg zY+sm>(tfm3ajx|_Y)b!YZ)-?QpNXQiWt(=i@)}*Ck-}Cy#Dwp5sZ54W#`8NPr`Y+132G{Llo0*ai#*h1t6TMIAX2F6Wl)+( zh5&tl<_fQFA@bD%iXQJ+SP|x~`4m2x_7-num6+$tbz&}A0gEM-XLtyn`r)L5ReVe*2YT_ki&*VQ%U$LXeew zLM4oHpMW2g;%|NP1PW;=?GUY!lm`Ns#rfd+sA=aGbqJofcJ4j-@@94_h6=wD*$w(+5y^XfkK?n_pYVQ1Lb-d8wraNKUYkL$U%Qr5Ex?4<`09q1*k34y9QPqx^qv6^Z+9+5%Z}`!3!G( z)4Ei`O}gmO2t2{7dOu!-8#!W{nH}}$rm>V;tZ1=$vx_u9>gfEjomuR05-w54O?-_c ztjg+-vs)7wcHhICx4A$t|GTr;3cATPq zDiH9y>W=?Q5}B0sA(50O<J4Kcz~vPC=2;5(czUT> zZgi(JB+Ja}!)so4Lnn_$oPvEM<2YX43Q$i{t1VIEieU*%PdfEuzl{C`;l`4s6&=x; zWGUc%mu%hdi2h7TXNwg)>U9n}5I1@(Mp)7d6h$o%$ZuWX-mrH=O8$w)!*L< zMT>bjt&+6m7Lw8DI*I*-Y9txdpefw9VJUt6ypT zL65O|Zcb@Nb}f^~D2n;VqC9k%MeTOTK$h}!E#HO`$16Q@nM-<}tB6cH-0_R=;U4$| zt(V-y!XOB%@s%AFB_9Frdz`ic)M-T;<%?gWSra;W1-<2?-=(1w~f z$?_R<^s!*kVKz5PUWl9gX`47~QU1;!H+}vye~d}^dw&FEw*2%*mY@INk6-1OKKzli zgdiMo_Ah@NGXLX`NOS*=KgPl|1E)rQ_#?zGM**x4e?%z$@W(*?Pk+2IcH3e72Y<|G z>y_~Q8-I-7{L3HVw?6z)h+{Ghd4L>ik`;}p|I;6JX8-sj$smCX{?MmC3UPe;Bb!Ai zL;r_A_Dp^F<7LB#KO!F07Z!i`g9DMrY^f7m6)Tcjk=zjX+N!8!` z;}`Bf{z%OImp_KMe)!|QupROCr#}`C_{9v6&kD^=iw%GJUfBor? zTezw~fVJeIz90Swg!k!>#Jq-fgm@qRC_xNz`RR`&3QRfCAO1Mxy&~rI>5rSykqZMK z{uuw3GUWB?kEK4T8$}=fNcLXRck|(o!~mrmPoMq>AqTO%{^5^8UqAiPVA-tq;nN?H zfYj3$r63JI{Be^RGt}>I{n3zrhc=M^(;t}!KmCyqmT}k-fBDlNC00Z;2A|Ev13&!{ ziS&;@!o$qML#BTCV{Hy(NzA7|+J>ya9l|$@ZV}jnT@n1{k6(m7{BfVc5}%;8`?nM$5oJbm~i-W1$m3)AENAWG?976oJtx~sukHJIa+>pF;Aej9h!d)aFr;q z7aLGy&FgE;O9}e8Qbmr)m^P|}l=yC#1;h|rc zGxhD9;97yJF2q;yQ5fsUuP$Z39F&7qRr62*$v{hg(_-t^OAXs0>(qSVxr(27&oxBj zcTcO~$U`>%CI-ySq_5{Hg5oBIYksv;W3EeRoa`8<05fTs6zuK19N;yMx2v9z&l9a( z^CS5w9#*7}K&=!$*tgoN@st%hF0si~Zj zYlQ<771VXiPVmPa>TO)#*9+?aV$N86s#8{R_5ji1uI&59!bj6R6El9^IAQJDf|w|H z{~=&Jart8V^&SA&9oQXn4!FRMrZGObU_MeuukAscK1(ePPFzXAN|jmJIU3EaK%O}v zKP50eP`d|2bQDc!PbsyRd1fJ@zF2>dYrO?3dR`D~Ga}`Tv`PX4ozejQXOM>kXOZsY zC?fBq@?gh}VChE^3m|VPKtb_DZ8yzbcqO6+*qq=pET^bm#Y)E!rB62j-RYL>^}MkB zTHi$L^R=)56$9VND-=v@(u^rd#)2cs(FV@DBTIIYxCtG`N=?KQ?oP%Rg^*?)CeKX+)2SqIxXUW$HH8^XCir;5OOCAb@2y_ zLc_}h$(}E5!lSyO3v9aGme7~fAvOP$A~ZKp7WlMvnbfd9bOHuFE?7%O=$MiZ`UQIm zLqt&Cnx~Mzjuns-y6a~oJ^>WSTuAyZ|K0!~5$=Y4B-7#V(r3>INaT^)sXG?J_<_d= zF?A`V%GGuBkVYcuG;F($mYaP945>~<$?DSB(DhO}L<-1*nY2zVrFmuwuT)NW5WvW3 z(7|64dWdq_US&`z;k4MDzPP}pnZ_3owI)ikanxz_y{rhoS21&xU8)3Dk-4jR0?fr{<-KqC&=R&A!Ip;AQL^bz3XtQ=Hk{lvOS(`IKMm(+F zj8{qZ#ttk;mjczkMv4{04M=Ox^9t6~yHV5eIOOC@ZReXOhAsXi!z|)g1S(`1s;$%= zGfSo|Npw;u8%jDwqQpX-2Qo`=;YXqwb;)T%*#h6FxwKNpKFo*FrTRDs0ha=ODXddx z>(N})O+QKV3mIXNwYthA&S|bjs2u$#&uRQ)Cl+gzsKsbP%MJ27-x~b;i93U2W5xvAZ!o)skAY!!7NO=qTP_ru*n>E5 zY%lCN9Ov*D(!qvr57c=~X}6~>GHa8nbbm7_iD})?FOg5my_;~vvC{osTH-4TD6w<< zJ^$Kl12VEIi&nhv;OEV7<{mzO5!-IOY~=UUZamMb12uD&D3O&$)@iV+BWRVSZ@p-K z7vbbaDy^(pWl}X{apvEm(aw778W|_)Z~)ndr&`H7`nWbB8b#%$%7jX{51 zwndFsAAWT!l4a1H!*Y2aV-3n8mWvh`QiX!vxhXvJc?XJMP7uGI(l#f*t_R(qE|~B= zY!spgkD5XIqSvfz?A*x)Ce=@4@|@VS>TJr@OpD$kA;QkV=Z)ItRwYVc^2X7 zO}B0)*oX~gaFy+DOo}%HugG3tLtHYxSD`JZ%k%S&?M??6c`8&J5Lu`-h;;Th$oH2s zuG-=E`+Ev$)ouR!ru78g$I~Wvht1CSbR`?1z3czKOak8G>PaEBn(a;adR4ZO)ZbWn z933j7LsG_)O~v_pZnSg6*j~OsW$XH)r89hfGotJ;zCV^~Rpq+Y>D1`BAbB=yC(885o91LI;_|VWMjw;4_8bA; z#-?n4zE0*nCJSm!Xb3tL=LRbk#NpX=BDH;mxXP1{=$pma(2D0VqCoe_=G+(F4B{IC zvBKZ;m42Z@6<9_i@kLY4mqsyUvC?$Y;Z~qDMaqSbh#`UY==*LCVC0{BgEUy$1N|H1 zsRXIGk{(JQ#eq($<_9C7life-NJ(1%jPG7{qMIC*lalS|hJklbA4*J&dat4M0F8GF zDwl8e@Y`{m%L^XHWgNMT-E{0s#QbQsRGkl7wth~v%3UJ7n5S|~s2`Kb z&oeZc^@arsTuAz?@t`J#AU(|(`t2T^6zM?8Z)hUXLez?KPn)`9RHG9>FI8~`5^<@% zw7}q^#U`DrVI}!3*iJ+1;nmL&u7*(-nU5PGBehtDSlG-&jSV?4nI`)97>v1 zK(lj|sog2(N-b&J6&i#^pkjVhiHA-33r@*IfXKNB~JG{f!-tv0MP;N*Dj6F=Y2Cnxsxi&VTreWpPt; z-xuu2S=ItHl|U~A{5T=8qUL`fjBboSgfWk)GrJS;ZwTX!93~-RXJJR>6tcGT+gJY} zsO!Qnuk?pGa((1Z}_BNAV z6&(wHD}`QZE!=2oy>pk#Ga81%FmXXqVWW#duyfhM-vX=-z5#L`3}`%8FGAK+*ylwq z=s_%jc23GzhPpl^-t_rLVA9M*W-8|m_ZDv(QBdP3cR_JUrHqTfD!r%+T_qf{L|n-c zD=y7k3SL=j7?nbR4@F&rX~iOJ7YXmIQ7S%@mXHQ|<-ME1u)YH&EQwPunI!H6G(6&F zUdGd6EG{3_^ma};R4N4@WTp7K&lb+F*bQnD#Bv$Lw&ukm9m3f*Ojyy;o+B6Gw=rHn zLNH1g?zT7Y|b-sgVV&TEsCn}l9Osbgo`ecBLKyu59n{a6%RQiBi4R#5uwE#bJX zzfqJro3<0r6!GgfT9Oc;}1f&l{* z56w1@%))}K^l$D-FlBONv&%wlLJ`?qg4h%i1Ml>pB&|zjgvqj6(e{v>;+ReL+I0ua z82--l>Z)^XJtI|Q##KqRj9~&S%77_KN*yx<4#1CbF>d$su7U{x@<6zR5y@%pbAGw% z3^?~YMS_AgTFv7uS#fLN3%R;Pg)IDsUZ}=HR06|6u3$5 z3)InaEiX*Y@enTVS+#}kPg@#dny^o{%}0{Uk(EzViRbI!7AImw>#R2UuC0&|=lf>g zI~@MiE*b~^vWs?*54!+&{IrV@+7G)(Ap2*#n51__-PT9nuY|LYR{;9Gp?)pxO>Scz z1&yxgq(KZc+t{<>-}mFkaTsp8JPrzcop+)gPHd_sT;LzRAi?M2?BOglwI2SlgU$XG zN^c+#A+2z7p(wShMHmb4`gq2f7-J}$Z%!<*$mk}_M!}IACGvRqion`PP)TqHgb+3F zXW8#nYGopUSV=r>F|u-{TfYWP-1Skp?h!G~NU;Mpv#sM_bT7nXV#CA=q^!(0hTxzC z(pZ?GHoG3Cqrse;JQ{5vM#7=J^qWNN;oLVSb7IteW-|a5U$emXiLiY=4+6?SLmDv; z5l>C7S8?NH!8v9WopYmEmp#2=T^mIxlUYH*J2sMfvpFux#cH62ZgWh8I|Xt{a{4k_sukkBmb$Au}~K;C`~^$s7B>N z*>V(Yam%0DP1}aXP5?_$6Y0SIp7o8Q6IPOdJxXmJMt}^C7ZjsM;&M$ZiujFveM`( zM4@ovpBO`c{6At0CGJ=EH$tAWkhFJt~oqwuq6nzH`tlHm94(T8i*7VLv@nlqi)F zt!SMqClcxy?nG$xi@yn~F#eOE3i|&rs7m?_s;2)gsG9V-Qu|i)KN?h_|1X28uHkzwfEemH)1%V*l^%sV;5*Gtc-D^!J|O*Y>BU68U#}s)f&< z%GiqFWApW2p0TL;$1|9I{yUyg_t8_ee)d!tb&lUZdn$&o56^)9(^G*MyIKBYPeuLF zQ+@dxG9%QNVEKYOa~i8PXro@$c}%^>X4Gi?6qsf;2BT=XJ8J!6#N(=*h~LIwWx zRGJ^2fspdy8H}U#dzPO))$3|6>4#_Nr`0eFe|pC4A$QrIo=RNq(=#0Zp{I&q{^J?t z%zt@CirI%}kU`oR7JYg~bH88CXHTUwJ*e>M8KCLzg`Yi@aScV??5AgtVyOy!^i-vv zJ(b9xo~oSH(9Za?r;5T4a{KfQQ8}ib&z@@0W<|~V(=&jhA`d@%s=AGoMe9$`81+iM z{OqYrdP+c=KRm;*w*+AI(=(`KAWlAes!{e&&&bO*`_lgD8B9B$JyqOiPxav$srG;C z87CY&w9tQgD&app)wijSo=PwKPfukinz3+VuI}{d8BE}RJcIsxhW_NUr@G689Qo5z z`F-?MP#--N=|@k+`cFMo#Ai=Mc4ndXq0PX^2C|yQe|oCOf9k1*|MXP*A3fF7M^9Dp zuRYZ$@85Wadf>nH47>lPo~rPFyr=Shh^3pe`&B&pD8~6 zLG8)zrpZ9mpK^kT+Rj&qkuDUPWHe2nVbFk}AYbCrM#HYz-0!7*uWH?$4C;6$xlwh< zEWv0+tG9F{j7^YY@)u#;+Pz&lVqZR%=9a7h3smm3x%%c72VVz+o+HwmHRj@HA1=V- zTzzbXa7nNj&&@EiR;xGi2d+~e?&vGX>#o_5Rt3iFRisSz;>@bWpjpG|qh9fBa=Cga zz6w6Ntek2Rwvy2>v@}hH%%LYq#Q1Rx0a71N(rjo%o^BKrt4gOO;!EkJ5C*bIu0Kq+ zYb?DB6*lTJ2_U~yIFuiE0*)zxh`M2)@nn~5S?Wh46z}rQSULZgktc{Ng^_zDL?>n) zO}qF<4yY}WMe31%AtfcX-^)ctW5zAossd$6P|442Q?5%t)`@*v5WB#C z3fr0-{W_GBRKoewTWv7>)ms7cfAm(@0h}AxU{U$#F4^*ZxpBd1+-~Np$-X-ziF9l! zcFgI!IoYdsUF8>|Zm1+?;|8kK2L*5Wg7KF#;|uH~NORlI5X?Ni0xzlea1Fzy2WF9| z%Gx^WZrFzQ=!s_AYA%H>ny9BZXV@^|*V1EVGQNapyTyNi1Y0=PhkERrxNQL0Ojovx zanTF$sJ1QOqT_|0KpG$na3#}6QRdxSmU{Rpn4gFk|+jn!V`)qf4Hz5=W4mdxI2 z#TrXw?+O|QyDaYltII4W9@Q>r=xuI@OadI_xx&uCDq4~$aP}gNtA3w+lt6QV{z8uw zqQ;_tfGkOzXI@lCjkvqfw(xR*ndx25=3xh2M$`*gnzZt5ci#KCCRBafB)8yGwR54y-Q9PB8iIR0{HX6P^usPr<2(`Ldhj$7S zZuSUelsFDkzG%g(nm0tI4z9;1_YnNji#s2(EqmBcCwi0(jXz{&fo|r7N=Ts2=sc$9 z!$wp>laXO@a(muwT;bKmw=svvpZVdA`EI`P^;C_#?+u$;Q=oRxnglv8EK=^|EbN!5 zQomajR1(%HP)FUYCTI|j9FYV6$PYuX85S0eQCjkHU(B3)Q?vw;gEXIGi|ToR95{y< ztUVH%snFrFP6poFF}0NQIGcX|gG%Rqpgr+a!aJx`2;sKZ_wM#JJJ-`)j#=L-0x2Rh zWZ^f0mN&+`Fps_-oQB|5!5Ck`Fo?mF+nzM<;u5afTo=?^XXrMjxg36*pm<=wgNbGI|J9`l~3 z`}WT7b5Z33^Tz6WRsa5Q82?uHR@Zq8COeLo6kFGE|Bt_OOip#GCV6pvzMf=%HdLMF+(E5E;n#R&{Mw4R&HEUEv@!u z{+!Rb8;=i9r&n`t#@Gm~G`_N%>aFeR9S~qnmahVv@o2S@`)MJw=eZm0*Sco=S(bl+ zeYOU(+SA9lY+rjYXr>{6EbLo}wo}deW6k<9ZqW5yZC#cn5|s*`17%$+{VPsz#uKZr z6QwRD5C<@JCQYGIjWb&Yu`T#9HVoAyiZmoZb3sb%FFh@kJT-0UL&2CZH{T6{O&)SP zl>~zhPTfs&6%3%D1nB9iEv}w|m6nsrlE*fgC-DcRj8L4W<#_^2h=-GZ4AK(I7nHn| zkoQg$psJ6U5%31?Qg46Ptd^wk&uuMpnX}LpOKGr6G3I2tPj;-!*5hBjDRbmXt*jYeoQflnrSk3(#=!qiiXP# zUSOr%e{D^1_c^FU+)?CJKiBj5u$xcJOK1fXz-`-5dhr6hgTL&1E zM)7gF;KUPL2cuMBy`qr#3_@jb08oP!MU3UsP)zX_z?hXG4*eyn#X1<#N^?fZFI3DO8(3ka`OTfIe+(QGy2cGvsZQ z3;fcpy#Ck+AW99q8=`2aT)_+w#tOUzuDcmB<|GMXuuT}|PLx&*%PdjhOw0QsjKZn6 zMExyVA13g`=em4?8Rn#1Vi7qz2SMI>NXHa(pR{&Gsa}{+TKZSWGDVs1+W?s_z}Nc# z0CK%@d{Q(wc;v5=Xy(p-zsc3C0%hS_fxjMXWbZx3B!xVi6^7G3bxY>5_g4ydTIWgi zIWbgzE2HP7^8A5#6APg(fjtJ`HS6TXcePJGd}aPg14f z!K&6?4C;w1_TF+maX;QbArecKgzRwfB8k)Db~Y`Df`GCvB;uu74Pojama0c4h*7nw zip;D!w_39P>n|>~-EW!kOWlyeTn(lMW`gEI4Kah4EgY{kKjGWHZpL2Y7B?#2&atQU zF<*=NWu}NHDgq*Jp|b%lPB9jzzA=E}>br@@W8jn&qn0M@gPfM8OsJH6g{KB$Wc)@P zfYQXEN#w0kK*x)me;j;5*kGBQFI1i`JZP)*lWkV5)S62dK>}@HBSxFO4d_sGiB@|{ zfRn1q&E1}57SbG=#$}>6yh4|8J5r@w`T3Vcp2vkfKs8+@m%!q&|4p8kK@tg}G3T(Q zpSqluE?imr&kTyn9issox=Mv{)&hCjr7F|}`BMy+epWXc1m(7$8qN(^261f>9JkjM z)$qteBSFQ*)C*D~fvQ+|zImE{KU<;19CAcU%_J(6pe@z9^6gj*h>ZFE_dt~b;B%Tvi}Bs8b!SRB2c=KW{aOq6f}SYIPF@OC*%`;2WsMw zguh|nXNyYWG)C3F1UW`l)ueA*)=&k?-ugmGmb1H8&sGt_1VW;N!<+K^e%Q{=r_1T7 zX+?C$w5772F(o$xBG`|`VRg3%ge3~uy@L<{#fejO=+ zScs(G&7T^$`I~eg91dZ^_@p`Ikh#L*<#Kqsl1WE?qNX=m!B_yow>cn@QO{1XYF9Fr zxCuiWr|@s8JMsf@eygMkG*whw;$)Jd!-Cweed&W#R_|biYqU}`d)oE<6{lJv$a;&nEFLmX z(rR`8wP3_8ypIFuIqMz2L|p@NZVz8U@GI#zNrH-TxvRK5`=T>B!LrHi9w9s1MI|~M zb?_eTkKZ}cUs-CaV@}DIgmda=K^8ms!w>JLD-UMhvwoe16oAQtc6v4dc8#|v-a{3@ z235H}@ta=GSy3!a3yUeLKv!g6Wim<#bv7iWOS3Gq#O7Qf5a}a3#}KcAhO82+*yN%A zCZ~wpLrkYigG{d(5qEg|6>;qwl`7hX{Y^TCK$?m5a=@@Z4q|)Y{j&a)*s?u(qv2x3 z%3*7+%Gn#l&FQCz*<)Y^CJnB|ZYDY3Od(!Zgj)|=G%8V{>QCz0YZ~UM>p3)5ESM?` zkoz5@@n*M z3e}mfr5&4SboX8JMyqTBUg+XmDJKW1_=fB;k=@?ZcL3&o%Q{n1eoqzD`xdtH6WXnt zz^{yEhz2ICf5Xss51_j++Q`K7kpcTLvF`8aRNDt6;JDl z*qC}?G8`^WD#@??aX}(&#Tv%z{&@E=);Ov%97Ev?h1bCWRM1O;HqG#(DP`xdnq6d+ z$PrnaL6cjBh=VOm*@}yEp{LQzOW~&V2!P{#)ItE%Zoliv&EsQMh@W^tw{Q+L$0N{{lGVQEALCt|<9O}C4^Zdnf zo}c*VZZ+0XM|H?=&rxOPZTH8<`%*6#;|1k?qs}jtUB~Slaa6JI4%k6xZ^W__F|pO4 z)}ekzf|@NtUv!;G;v?7XI)M5!NoJ`e203gindL|(P*$x5(=OP;a@d3dhulG$Ax;pdh^^hLdCkD z98P5jwW#d2bT1*ChpZWflamI%{QeaO=2w7$1LAEy-kh^*=RZkhO9Jnrh${*0^t>y% zpr%2fZPr3rq~3h3{gian?$O&1G2#o_8MeeGT49c2y{)R)@U=puQt7r{LqB3ea=lyiJV9vOXLoV6`@D7PolxY^TK%lK#c2gti}dhluW=wW7k~kVNe4{ zXg)VZR`Car_H1ZFIKIQYXU|MGwhkdvb{~&(k+C*uebQk$B`pI5aBWrv<36*Cw2Gq} zPrYQM^+H0O7_yUjL!L^_)VwE6Nxn(!fP@*j;NVIThOT`XA;g%Lq);I4wIX64P%Tm| zU!_;~clM$%r#7GD#3W$K=~M9L!BD6mss4(UP-1wis@AWN-ZPpDXi%;oks%@9QKTvgCBITV zZn6*ZROY-=&tgFJl?P@Nia8caj(%NG{McT(LuCknGMg*s4z#ns9_5CF0Q(~avKz|P-~1djI^|vxsDsivW1VT6u$ySDZTFus#=k&6CPG&7X!KejBza_+-T?q zQyB_0@{8aM-$`UsXo%&$>vfYoJkK;1^CBUW7;5aywylN3FSlw{B{}^d8xkr+_-9RFi7_J= zZ8TLb^dHY!Vo;9v0z3x#XcW3M%_7(ZQ3nrkK|0c6EwJ<}@}`MMKlG@H|oqoH{ zVzT<H|f!kV{sii4DxzQ+qQIx)(We{O#2cu&nIS!Kmfm_GtF_lK4&v++p8QYFt zsfoP)Xi)9^`G(w34=^kB*s_nvK{h`Ai^P6Bi@k8@r(x;kcBzLGwtVnnQb&)MH{~3^ z{db!v$nmI~61a72_1(ghAz^^JIP*IOfob1PI(@Mwcbr(Y1f|7iwk!0)K*zAEUSg;< zl}8O8&NJb8{WOw@B@4wb)=^R~QwZ_9t=#^pyVf&%LZE0}>-eOm8cvsCim+^Vk7Ypx zHZHse2kO6iCP{Fvq6*DerE@(QGmkNzDcDKCY=WQe!~Dv=di)l0Z=>N41V4{I8DW6I zGwwAo;LBoU$p(jw!FO`vq`V?)(reSH#Sa;bD4@tBSM-OXfk&gvLT|MxOLHU@bl@kMv>xtL?DNcV*^jm zE46dXk6h6b{Ovw2jlkHM_gvJd{`0dr67{&~Ols#baJQ-Vny3V$v(R5(4!O=}qV5FT z_C3M_LiLzR{ZHdo?`%;8oa<@I!ny>4HwftkT}Lgzr3HBn7nKdqyW^q-hZE?T2p56Y z$R=(>15lN}3J8(!FyAw60WZfWi1rRd2^jT14~FFOKUG%$i-z~vYf5; z^haJ>0M)xT# z@YsUjH2K(fOH{BG>MA!i9C_TgeZEy-P6MBpNtAbgB=$El1;m$2(L@)&`hbi5!T?AY zssWvCG8RkhY3lGz{$fuzZQaV!j_`iFCiKusyjx@De55@mb35qau4>^|^IjUNR1h^{ z&XMykGz5oW<^#6H(B$fuupDEEI3+^5ayjr%LXEIk+yujlTP$P32CDtc>5XYP-(+rP z4Am_~F79cKSW_0(ZL3Ni1HO~I{y39%s>cuOthf{;IbvQ>=d2ecs_9(u!xG|Wn}>;~ zS}t|1_+dF!tP*RE>W$n;0U!?)eC`zqqiVWpG^08HA z)-I?CMT?j*U7Ry9mtHa#AO28{%d`QbaY{De%>CZ(eyE7$%B=dWr@!C#-NJeKay!cO znoQ91mQLh{x{*W~q;3Myv|+!gQY@(Onw}20?ieUX0q+izt>jPi-tTaID?ecD;f;bV zv4afwOzT^NfJg>5jnK8(G7~O=qx%*2c5iDbn-hf%btsuKeB6Klzvn9MV6&N)U&plV zSxqC5k4A<=V8aT7DF)bx**7Ro;M)st6WK{S>={t zzDKQ2JnVC%bzfz>0iQP}99KV%g2gok$M&l_D)2^Ec}9owQgc)Iukn)* zvf=_a7&?<{M5tS-9AzfOjo#Ex5+`W?C1aQqs;ib6Fxq6MnuhXjfZAo7#ra+|W%iPp5xmXlU0z`v?(9r`OH!^}91HaV@rn zm-0F}KqWnxrS3sRDRuC14eph+z%~x3H^e{u3|v;62|WUY|Iig z0w9R64CLGM{`1D7#ZJaUc{DV{Jc zI)*|lbQ}+jAMrcCMDAAiMC6MQXLJF+{z1CvidF)k5rkZrUB}cHb~qwq^0Js+WDm3u z3E#(YxdwduoXIM+Y2C5dlt*S0jvGn~&8$1gt;lAew3=Mg&a}>v7Fjx9AG$iRNGyJ= z6%SR-Zi@Y<-w$^qy$v>rE{`lo$(b~$$wIrko3l;goffgqO*7ORB+DkKFOOBmbc^HH zyVn}qR((SSm#6`Pjf#tH=gz%VV>DWK7@eCIE2q8R$4eeDwo$N%B@^(N#&W-C1wPq4 zip>_IR3ue)yuV!jV4o9n!~!SWY_HxiDv`k6fq?1tF%MR_IvxOfu;0tn!vuMGU~9V( zQ@6=*HH&7;Jl^ z2b*S2`W%!=%rF$D!tv_~s0C0rhnev;Y?wya=yp}X_s6@bvsPeDreEXfy0@c@76u@p#X9aCFx^(SKX>M*BZJIX)cqYTp0qncmoVy?7kC z4+u!_>FzFr%Z77~ik59$%Rb3!<6Aq#!#Qu~^*rPW_K2?A&-3njZ*;hl^t^MY=iy2d zW?P$#KI}d@IkL6g$Ugh{6Li;obHd2Zh5n^A_$}IGAepc59E|Ms{`ljjX)fCu$LgG$ z<7bo)UkA2Sw5huxgUBSsM7H$s+!tPt}@n44sIPFGkLt+?Y_8hv^@#h zE-I>PFPk2DNY2ysKd^PB=Q{A1zT6Ea6OD$$%g)Gn73jqF#PD|O=wiAM$>#QE;W|3!EgFdbSd*89i+bWZChG|>d43%_UCyiT-^qOqu zUGH&a|9-{3xZdIE{=l9R)pNMneL1vi>gCSS#=VGnpY4s?9ulATwz%7Ux4CFsn& zzL$%K8~bV}_qJBvj8p6B#Uah}%jh*7Ip9WzO!?65#-`J z<>5R{zN=6ZW)Y0LNmFB2?!yxo0ZZ`=HC^nQ0@_wsUbrOXcf`!4D^ zV72FM^E%!sn$N?@)zjXq(c9r=^UBQC-hQKQHGs`TSLSN-S&he|jVP-f+p?YS^DH81aKU&52H&BI9W=GkQMNILJbo4pf!$NSY?-^LX_w1Bg_ zgZHJQSlQ;tK3?1ScDH(UtINZKrI#o7D&NYbj$7U9yp1k5567ZJe89H2{fqtn z_YUq>eKNA>!{pWN$;9%9uC>Xx-RSXg=K#2E?P%OK=#Gq2+&Ax=ExqHOr=g9L z%iy=gWL3JgEaOh>*DLd`#%!CK%yhK1>#0=TRL}_cFTJ-sqWMdM-`Qua|YV z$nvHyH#Yh<Q&f&6xZJuO1BfL3UpQ_*9!ke)8 zym{DLd0^>m1~mCP&|mHE0&zXg*E?3u&(C>%I{COCPqefCT(_IQhZZ-_#QSM&yg5>g zI5Y_JFXjBUe;CqA#b&^ubqH}9m2$N$1J}fEhK!1}M$me-*uXe| zi_Ch2!biCIm^yQowRPG8;u^S2^YZI-e*US-##8=*21clvV>|2kvq}toN?i`y4q2|F z)C|pbuauBJ{TQVH*k|`K4^{n9@v}yReaZAztlnyfl<8!>4(LgP*R%b?VZ@xF&4BF?o6 ziKHEJl^FCiZsxR9RgUR|wZ|AXsU3}D2(@nysbn1@@(vXHrrJ-usGK27-VeA*`EifR z)RF!#3d1r+arm~bO3{(@ivpN>VIf_tKbn9Ve0Oq4WouzhB*`aW#Jr@~+}lI5#erS0 z$Bf+$OqzHG=l@rpo>#N(R~W2D#c=(WBV#+O)FA>Ulv!2C4Lijl*tbo1E$`IiXp48| zo2~#9Fe(ZqTw;dcO#|xhf;H0)xzI?Q7K#X&e=uLVOerw!$$VX>B$yM{VhD9a?Yl#{ zCkb?rK7^WCqZeLyvK9=eAkDdv;)DzSdcgSpRU0#py_GpCL#<&Wd0sVUKmp)c9wVY< zik8*@)IfefVSm$>POFx^ACofG5%v^ey3VaCZ-+6<v?P5}5f)Fq*2S)k}t?g*QAe zCI}52Ir4x-W`rkCuM zqm)3#K%Pvp%Rjp?G?+tyMA%%Jz^EG)fS!aQ(XVyLmB4a0C(?J-ilFV+*u9lLL&9=rm-Rpm(cG%ee(4HoW0$n|g=p)~{K%Cs(V zIKjw>TM*y3XCIsAhj@9Z8@qCe;PXXXkMf#@g+ktMmzby1C4GxD^$qz3GHdf-$18D- zu&4wuz7n<|Wz)mJG1@b_zl{OfFuf=9*il;W8>3?DO@c6NG@Qzd!?9nx-a4GPJ!cO5 zZK=I!Y&oMRJ=T4s_)@aUhw2>dPQBkBz@w0xAjYE|-e%$HMe0fRTauR0(1{El@^oMt zET~lteTHR&0$TevjULATN7O$?iPAG|!|>R)ZQIym+qP}nw(Xfcwr$(C%{_eQI`8jU z-&*NZx{&(OonGnGk(3mJ0GunTI%hYh+p%)f5ShACe?>N^ia z!&f#iY?##}pPM&JO_rT`b3BdrA!8)a7~_D~L$x_DzK%U=(xXh|6s^FC>SoFSrP7dC zGU*NfaPW@6?%ZTZuBAAxL;)c*KWb^c4gG5*a(u^RyXtFop!p z1DiM4GRYcFkublBZsaMThrS_6$MHIbzwW3ys%X2KQ?fInrtKH}oRW7%R(+k4)oScw zAM9csAD^cczW*z}W@7DkN89}}bTdP;rjnRB3T@t?jvXk$G=?4!PuNtwRid8EJ#t~% zp)8NJ7hcUm6#P@{zGj2^Wky(at<(C|PWWEMy#A_d$)JqmO5+mgqsECJc+dpsMH1iu zEpoXcpI?3Ajs@$kM7;&BOV*o%q>oszaB0<`Tti-{%NxEnAorJn?-VpX=VcnnTRrz? zJt1^0uxWp}Unx<3a2h!7MxCiAWMX4Ktc7tvz1v;~qDj@328KNKV#L)m=ShUbzf`ez z3HiqP2l0s+d0~Mt;|7Se*hHL0JD!IVR!QxIIDGiMv2PUl$B#GOZ2>sXo=_&v2ziXr^!wc*V7XR2CQlO=TBov7#UQ4w|&?R2YG0uR6yz9sLa` z>C8-unXIEm{^A|br$Zg`65xB3P*;4nA!Ia z(H0|`2oKSfAKIYIut2;aLM$r8wiTiwsiCyH; z2^GUDY7hR#z7-HAX*LddNIVJqy7!Vm&8V^|K;&5efY!mU_&fZtzm%UH46d3GDrsQO zl>6WTn^01#BR;KJY%&wbv*`Gj$I^%x|MBje&=4{6qlns0TvsmL)Gg2#Ym&r$_#`$s zpa{OdjlqA?D|6%s(RYwl`lh*TN`NU__%WGKs_IXf(mYKFKLW}ye_uGm9j$KQdra`0 zW{99=>wrwV`E9*dOpqiA&N-1}ARSN)O4pwoto8HKm6hQFrJ?3YZqX1wxCc#3a?d37J;Dtb&=CK_ zI#WJrWuY>qCvP9<8FyR1kWwP(2px%fNJ;czNz-|}LQkPxGc7S-9=c{v_di_3629TId^Ie&Ntu{HqGS6nc8gcN=MLe3_7u zN7%K4%cbMYwmxaOIv<$$@8Sc$ooB;AFtt`zqm`bd9|(KnQ{QVcv&q4fh4~w1{Xz6 zV0T@Uqy40^P?$XH7#wGhe2GPgH{B7L8(G+Q%kBde4w}z_3VdpkhA8*7OKyr zIG$ZRU+$FzMoO8}N5+W=q1O^A?lq|Q8Czd70KG*g9buE=Vbq<{w9dTiXAng;&jp*x z2aAr|dII`(6#7PL@T;wX-I~z(cV{KDG@myP{VXEc6DCJW8{a0uE;2t3d30&??4Cw) zT?^PI@?C~QQ3#KcQ>3?C7X?13^kN>ZaiEo%?wNo|OgnQovb55(=Jci=TrFB)FK3tb z?&tLW^Ys3)yN{Fm_~k6$yq}YMM$NDI{|Z{1uao<--Y$-A>?(U0`oELAzwJGoUB6|+ zTB;h~q1u@^s`Qwvh1B3r8e{Yh+4m5<#ayXu00&xgi|sl`BoJTNz4uFR+b^1^;$v5r zg9th)6z+6X5{>4Fip)d(uc02XdJ13R=Y8|UioDShhCV;`2g^ES@$*LHMJ`3dh zw5*sy?sQty@L!61)*k6V1a{cSW@u=ixiwZg=3TzSW}b}??}Ymxz>a^|s`u;=p>_x` zy95|FR8QC-LQd4Z0t`#L4(P)ly?B9u5$HGmeev}gICE2gfdX6QXJ1N?VJZdk03Dbo zE~LNFWb0K|fIJhteivu^pp9xW<%MTj^Sk z(=LV1A0@i61~Nemn0|X_iW=q3!c@oiQUj?sZtW2r)`LmAQa zO55oGMGy}BX?O#VuJKcgA_FU;GuUA>p2Mjqy$Z0P_uXkXINU1f^M&IT@y^m-e&eDs z8shigXs}yHe9D-!qn!SH0$Pr|5OE!JJ3z^Kn#mwaOvh)tW@VaS?lF7=!jmhaIDW(h zgWmBv7VE<_c~uUM7KY4C5h~s(T!U3{wKRxk%_1gy^==Z(%w_KMMlvWu@924S!pLulKLKyI| zyuHZ2<`8{Me--R(yPg=|EbM9 ztKhmU*0KZ3^R(g;-9|NhQEv?EFxEB>UK6DyA9xU~4a&i~!knJiio+?m>>Fup`*GFg zp=Zjqzjk%Kp4xv0d2-}T1)Vr`77$i>ECkLW5q!rZDDRj_M=mlJ_B#-qjMRi2kk%h2{f@vnd!QiN~o0#L%k;f8mXE_A#dW1tk z)+0fXmJ`o+h}}#wnE3qC!dHwrcV!!tUx8)Yijjz2G3%$(b2del_(77%g_!k|gHZ4M zjn`(wiX_TP^A^-e06tEm2HIen4*?!o`91m zM8gT2-)3r}z_d+VlS?&t(v9oCg=w(Hl>^LxCU<{xh zyVdOPAaP;jM~K7=w9qi-?WWxmhfH^%=;0|~a2I{`*C%q)tu|o2Ku_g4+{1PO+n8Gm z?8El=FAef$|6k>n|CM{xc@{T>D!*;JLbN_8|K8oqV5crx?QYo(i9I5Bl#N+%vm$}w zrtj@yAW2H{-i^`g{*BZ6b13w52=r*=ddX2IS%lYmxp4h7c#D3ex^?Qt71+AC4c`n* zy~KePR_w;%3b*qwTN2CwiE}adBDE;+w93^%%aq>uHG2jt&04a!w%GLL_-GG;3(_uT zE`|Wm8;*85?TfaQEgfgOIVW${1x94H-$bHBKRcN`m6_jHp09$N+FF7(A`c z;AclTWQ(Do8q4HLaJ75k<-ZW1TpUJNh9q3M;c|{F9AKA48;B>@Nx7Gck&U_GdfXz? z{=+)v-JZc?d{OQBEKU0qlXycg+u>_lu{UJMsZzHy4Ses*XifUo=QQ1|u7NUDEJ?S9 z_zdl;!DdHL(#L^+S^f09N-$o7T&*9|BWM^r)@^L+`e4vg`T>|U3}GApkswghx;`B9 zUUKNEJp=5cPJtfmBW~sY*D(L@5$t2<{q=tB=e2%=8#yYn!|Ybr!C$KTfWvr>5G;)o zhoUj|Bp{#T;zi<|F&2E@-^AIX56uP_$ZvnXj~?qS)+ZiIW2yq@VFXaL!Q)pk1AkNr z%^n~uvmc}URCa<&s{tw(li$rU#IUCv)c#R>6|i7J;CBrzSU<8w&dh*eOT@Li5M)>9 zvWY`-NYnTLh6ydDl#=M5sNe2LoN5<$i$)Yc%j(3;0AIt?g+H}CL$}r8&C&=Ewk-6#3d_RxSu#m<_?{Lht8b6I}^PlLZG z{2=kVb_)Q0l}*rcZH(1|aw3H<_X(Md}} zLz>7!Q>x9Q5WO)!H|e^zsM+0tzVb$$=1V3@uQqP#IW?n_~3QLPtE`sj5_ zqv4K0A-7vIZR0K+vo8HW9K%<__X+>Q+XBtkrOZ?9IiejLiH}U+5#ut)`!sC0TP5?&s{A!V)o1eJ!0)24)es&>`VYM-TS1qyD6FIDw|`=5J}7<+iLK`- zD&vQP2s2p|w5BT<@ZzIP26rkwFHK1UoB_Dc-?2uo7GE~cV(#PhW_MH2aoSupsR~7$ zzJg65Gz#8L#DGnua=%~;-iMOW%*hBLO=VD-wfkjN>eP)jn4gq%ky@Vz1WnwrW|uAY zY>qdd==ftA&6GVwcQ2Vm0dfhkBT<&>`a;gl5+I$F<+mXjPEqj7)=m9Ti1WXk88&so{{$R=Q48&`#LIg>fS&Bdk)LYOBXQ?vC z;BrU8d0A^V3W*&Vj8Ck<*o!E#od%W!Qz@zn4(SXjzP(9!9j-md-H>QiW0?}m`a`Yo zLgWK2dDpfIX z$KuH!nXF-NpYKP^<**q(__FWG&L<=T4=noMISU7qzZD%{;ayaCnX$4q-pR}5C<{?g zu$S!8V`e`j_A8#KlzPk`MOGk2+MCh}Ii)4c!4wK5wgqlcQZFA{9~EK z2~J|iTwenJW~sAJ z5;nKE_@+*8RGZ=}czclKftI&c8U8|{iEogs(lVK){sB(BEfe?rn`_MxW8#oJ?0|WcQBd`aJO-q4g{#bb*zScE^u5%7Y-Kj<{g@v zZKI#{4UNomM6u5?cyahUiK)=I@xhn(z7XrxRXr(^&_#$Z4x&v99nyrHpDvX|d-!CQ ztb~WGFh(PbW20Pc0$Jybxrub#hHFPKW?eyDu3~hCnWMiDYq}3qi(LJ*;!pP0xC+_+g=TnX-DXFdrb~N;sfJt{y=T)f)x{( z11rw;vk`zcZ~CJ&wdw&YB9w0avQ)9-13NbSQG)-U{EI9h5UlF}u-3hg`sH_UJO2)D z0WfOeN?6tK*x&Jeu<_rx4?;D3z5K0yqJFD7K^WEW-BMJ;K5D$XNbs(MlbHYPe{bBH z0BhSSVcmzHxqGd;4pede+0GrzB(xIxCFBq1DD##xLN#$vIlnWoJ?b7E$acUsIN&%s zkQ>BVh=4!bls2Squ!pK`wn_|qot0VJ9fMhYBlP=r0`mDXcZ;wHH>B@R<)DHLlc)^-(04^8x0yQUhni&CD<0~ktX|M8MNCCHP9!`be2vqtKhC{9?!rIf|#FSeZMZ1(l%8Y7t%aovw zwC}%%h2?OK43pM2;q~jDL>h|q3`TyW)Q{D(d_f7xG}TDdScaI-^WdQ2xk@@Sfx zq)m6fxzSQIp=EY^gWr~el=FPhx?ZM)BBd5ty<*nqjs0J;6U_D(!zlGKdg@u!&Cy+_ zRjWWYqqQawDc1v2Ek=?r5;u71n6^yciZY}9|M**hCOHy3WJS12Z;WFut3AHS-Rk2kzEIGOxKyQ5 zO~}JOLJ{5O(RputU3{Vq$kkY1>z2rmL@m(^ZWP7*7yHBE?Q*uK!nC)yx<3rwU*1n_ z;qy4fp9tVD_L#%Wo)F+KPMC9=+#d5~`JB=-u8sx3|4Ezaz24^wd6y=g3E(xw&Egbq z3e&hPmzR{|?W8*bnydP;VnkTxZoV_T+bcK0Av-kNW2 zlDWbKw1IOiQ|=X|tpSd->BM};D*R{ycNKUj#TkvZksZl|NIS6~@U?#)zb`LOZ$JNr zs%{x9ZIctB$pX#@bBDGtAr4}mG?T4|O-dSEY+lydyAg%i-Fk#jwY<8W*bSy&MxiIu zO@#DJZaM_#qPyqf5dp+{S28ifySEUG6%1Y7hY8JZkX!WXIjfl}h4{SKIK2nk6vXgX z>7^q6Zq0Kww6?I#Xs3E%E=EKp_pdJmMh!&du5_I_YqNlP{a z54w3V^dn^~M zp$okE`=^U1)CpEPwKHkw@MiOmJ?w~kiwujqh@s^~Z?!bOBC*V|VIzUx_?Pg6D6{YteHNNu#O2yl@kNCY_8 zrdk)&O}eOaH=krbmfpF2aL8(C$m$8A&4U*P`J$({%Sf63%x))ap(Rrt3so)l}2 z%`6kE+S(9qrTmNdty}cS??NwdP~ywo@gdHx#`kSDDJky<+{+RR%l>o?p%abpu3aWr zI>Uflz2h#?(t~=>#XeijvLRVgPwo;QIzv}(zA4BJMG}F4mp&yF`kC+K=Bo}wPj){~ zFO!z3gbS<-jK>Y0bQKGSACBhFjM&K#`@#H$h%$yaJs8L9_AM{#i3vabOV<)QgKQ1F z=-dOWo^oDe=7N1XO++yJ-_(pQ?;L6{4uMC(rTMK~!8p{$D~|G4{%j(bg| zM8#Oe*D(nt6%Dn6-4RXNvFDMW@o?g?s00=@tyG78(K|8Y(4`yAKUK5V-T>HchIhZi zW#?8Xsk~(Pl}eXKiuPtU5{-YYe7yNw)yAsF4klk+Fs7(B^-LG3o{r=6$J8|kM28jX zy(0L8n@1Lvp>*!@={CxO7U#GKjewlsz-`7`Bje1}3d3iZGx!-ToS+zH%YW$CldVVM> zzIJ}^&rf2m&&-Kq>+9%wBF+uNA?6YqIEdYVrrgW;E*FA?z4 zdDIJT4@y0Rs8W)paaNS|EZrWchG<37Q27|%2coH5maw6kw*wTuO!Ovvg!)&lp`WPJ z?iUt2jTFIe{r=1t_VLw={!UhI`81GmG&;=cc6ifC#C#F>9~iM*6KXMUOdD$3*WqjD zwJ#S5sm1XkDGJ@A=&OwRw5u&)9oJ5z=o+GJbywJ9UaQ*URk}jv zYI+rQ{s|`pw(q3vM3Re&Lix;n0vnrXi28s@@xMBB}}O3`~Vl*+Rm zS*;ejn5mR4kvV`bm0=RL&<4R_af9hG94TF+liDFZUR}D8y`fdw>D@Qh2*#VOs==0m zDaQq)bKTq(ic0gBh8VPqhtLj`p(pAppk_IIs}7Y~?8wuX_<2ckD2zUdVQU(R&|6j) zh%1pSlkQLJJ>6_V#&i6ez((IQUfafRWZM(^8e2Hv2bk)~-Ybb-2kM(38a_CFu0_ zXEI5{(=u9{>bKnXLkWMB{W)l5?|Cp;qcquTq_W_nZ88T&Rq`uIf=5Dsh5JxJ#SdqV z+rpZ>+Nq!AH%RYUD(wLX_e(A*Z$3!PP9sU*fd2%k{Q^N}(hhNu_Td+NxpIB?c2AR? zmp7YOw6S(yfa|#tBAXgra{GZM_PDJVd0Ap|n!heWknB-WxX%xPik_s5tlW&;Obd*Y zg1DtqF5~2z_l6BGY2>L$OQ;5igjn$Cn~}D`^h)*Ep`O3V0!LQ0>_ z2w}VDY;%+%bJYpw73U-^qzcI)wQG+t%i?5u4xl@QV)W0jB&0>e!2DbF>RS}bJFMSV z?xk0VvgBko zjZWF7g}*KMuzT*b?^C-VDK$-y{SrTlWYu|44(jU%=AIVmzI+i*M$1~dj5eZcxap+u zztoR|))CL+ak|P(+{VQu#F^gd7ml&nLsxup-}LWSP`l{deTS!VJ_KhYL{yk=T&U_2 z1s4K~nFbUNp2(ESo2AWZUol!eLPn|*yZQd;FCk1XFs7R^OuC5j2Tba$z#HhrtlqEZTEBmnL$2*$q)12a2PX$#f7e9<(x!$$`Lw^^|^u<%MuRMNguk7x74c1H1#8y zos$(MM#|w?t!^?PoQ~m3;o!C16$e&kPmB}eywuLsy))*HKYyfXmW5A1m%T@rZ4Hur z=4Ax@9I4VkDDAg+oi@$g<;Z^j*g!y>Q2MMq7t_)HH5Y9uC2VTUYXg_LiJwQ z+CCg-fE-V|7=>G+Pxf}sV$I7FOV}MDf4@cP7nK840ew!Di7`_=bvUA{)4mtkpv*jE zd!z%-hSlkS_+Ud~>A5%eb{znTiGN9fyC7e3KMd)WGIFz7l!i@O(Y+KFf)fH$v`ayl z^pyS)j78J7$@^AJwSHx0QbRWC;_X`t?lj-AYJ18OVZ$AqfT-Jo?X>yE*+XyUfjBcJv7NTe?Ii)}C}Ha%5n%gv}} z9e<8tHDX%OW7saORB0-cQ1;r2h0h@9Y~_} zF{YG`>t15bRDg;~A_LfRweCLbh-PB1^u^A~GK{WsZ53!X2;ddHpXdyath!dR2o3(v z#c#e98em!;>{CP1#uVChJ3K+@2t-ygHd1V;(%JM<5Lm`ZyQ<7bbC$PTaUl$In0Eiwew`r-sq4^ds$P_qM}j_LQP@ z@Vds)4NEVL3omtZd?}X<6HHRN`ffXn)eT~GV`b3q6H8-WX6zqoNvf7Ro8J>p}1gvBUK<|;j&O5h1S zpGwG7)7bPjm9eaEX+(!5IEOyd@(C>$kC?1mS0?~Dj_VFa6o9rVXn<2Zs~aXf*}HMH zlyS%l?TE4;9R~yE(HUE=DbBYQ+q+)qphMFjew^ z7-AX@CTmIoDtjA{Mnc7)$3L27tyeNA^Z(XPh0HUtYADXAE%GOj8t0v5T1|m$H`%~S zsMb%EsQ0JLA3(=5f}EkwFpiG=Tj#^}di5KVynQTYQ)ORn^9XfVSQ*ZSvs){r=^hA) z?0)8`DXP=M^Hu|GrixUoafd>4@b8H)fR|1n^EkZE7!#l&n5P39>0bc-vLy~~Z-PKXpp38NiXbX~!1U1YzX6b9vYcJ z&FlN=&~9Xrkt#Y{sTjmI2Nit+Ey$j2(6aAS{d*qlO(~V=MQ0FOiCARo#=VZcg7}?8t-|Q?eelok zcYjR|BCMS5UPXieBQ-9Hd!g^jHQt}(yHa6?`muqWEfdlx>W3v~mX1D2r%U(aSzLZh zEh7iG18_^j&KWCW2=~sjqV$t97o5OWK7t$;i@~=qhI>xP2dM zh7&Y4n;4HFe2s#~lPXUA8_+2_ZJ9Z2!&~Mkk8!U$t0yVKIs7#L@TcFW9kaLS>igZC z?&f;botsk})1=Q4?YE4CzkY`2L<_tdt_^MY)y|rS8f-fJU@r_@dN5MioX;uuY1%%< zl%XzBjJhH3hdsJ3L;l#c;GD`B?1ph&XIZ_`Y42+T!;Ea&E7cEy+@YOSl0NaYQYCt6 zkxWdx@`G~dwZZ1hUjMI}A=s0~{1y@&!Meu?+SA60N{N_J@LV&No=d+qv-6egXv6sx zZ;0S;R!5Jsh==J4Z{c9pxxPBLQ!y3RX`3K-wdWFiA7|eCsHWIcuO0|%zyc`etz;kx zo56&Lp=^TR`lvtpgJQ`f;#&bO_1J@SKRP##=t-^3vpKnnw~w+7 zH#i_4Tf40K%jLa;s0o~_nI+}!-dLf}PTN!yN3s+oA@Vj>6GcL^K^%Y1V{r8SP=ilJ zz?#?gi(`Ds@z1Q~6mY%<^DK{oB1u)opWhXsrgz-b_clK+TE6}+;v`2=Hv17HHyn52}%Qz}C;ob=x)N^jcBBFrhT`fgukx0-1f?eJ6g6k;NG6o3&qfBeq5zvq>= z*}45=Vrq2bp10(XKO?(W#gq{CfihFQhnZXS)u;+EuX@xg$A|H_>U2w{k`e2t*9Eg3 z%>YRuQH=%K>o9;r$ZM+VmvLSLQ%!BU#+#DZ&a9a!nbRPXtFyk_vE&55iPi?`Ppl%R zm^XYR+`0c6dQL(vsyn^PAc%UfbY;)|{#mOSZNl9NEJ-~az{mos6n~4h>b{>cHxx%| z>q`5zf9=1dMXA}<*p0<3O)<@v?&WJhS$&+Hlt^##1&)v|gDA7ti~*xpc*{eSouOVG}FUShkY^H`5+m!(pJpv z{6VVepx)tFZ`V(!TRo|oA?0pp%q;a$1f^d{E~#&PO+VX}`l)aM1{Ex|v#b4a^QI5q zT#+jp9|d#B#N9Ch-DwZrGJu8avVY3%e&30T;q+9CU<+3kia262L1v1%TW{Hgx2HEB z4<{sIDbr|yGbYPE#d@&N0w5v;&RLYUx#s}ckFmOh;GsKFWorG#E}|8o)A+)Z$cWz< zA3K=@=un&p_D2fM(!lTD=wMHV1-wf`QuFO7``&~&SV32%EOphBjIlKB(PPS#43Gq* zE7#p%Xw3fWmAawF5oT$#0A5-BJO95C_xk8YJl6)mbq9-<_55=rAkTMjBN%8j_f$Q$ za$CHlw{m`xz_OF1@y5N0!3Ou$|oIC4xR4&L0p0fkgbeL~pL-K%{%=)gQ~T~`i$5+Lhd z6v}Chxb@Hl_vwI)+<0kEuMvybRD}=$-1b7Ueqn?x1-0?=U53>tgR@W+(UtX5A-9l} zn5PU{w7kZxH8mJgCB;^vovgx`6$q@fHqzVcE0Tx2thCpxj<{g2JC)7VL&+-_Id+|} z6q~`G!&x{rwL2y}URY(EscPj`8YrFEmiVL}bT0cKmN}CDs8ja7hdENa{zj?GM>K9W zuUDn&sz0~a2k8X|s_MkM$!yg2KHDNwF$NN;HF`Vg&BzWWQ2%yw3Y&R655!CDiWPm? z3mbN8)ZfJm6h!>M48s+YHZocZ1W$Si8nS4lR;$ylNvw|@2W~Lh1^|{>kQDXzkC4k6 z1!QG_I~SqxP+^GC%n-pmcPl@w{x@+9hV8(gtXJvY&r$$Ek|O5R_BV#LG4+pF<~C8V znW50>u_`&mbM6dAY@{o2D+r$hqma?VQA_2A7xn(&dyBYcK?xLNrz%kdi#Svge>smT z#1XOK#NPyTP06Cew+{TAKs()+(~7(UytwpsNkt~VvB_qW2fl*6pQywW|5s~Ww{LFR z+PZ@4?>lTneWLYtX>%}w`85;rEU8`zqOm@JpPGNT8~FM{bO5**=A1_L@s!Yk0M-~} zbgaQ^oPd^m%R^gzJ0H0%Jq4uw1UDZqrC<$gN&~_Z!$4Q*#EK15r44OLzILpq$TUt6 zTxW8D_@VI1uI-)r-9i@mL)4&7lO^p$v$`M0LVzE>5u{m z&q=DQ8g&m$#`yOvM|AY#a)C>W0YrSZEgY7Qh2bmMpE;;~-6<|zT6|)%H6{DpogS$@ zsCB#2Kcm6~0=q5d|JuLK%FQWu^@g_3+U)$cuf3%Ds1YJKLo=g7pq|*XW0xIouN3z_ zV_#H+5sX_?a$QIE@->^4E2qYMM|&dB+Y8f5&bv-nI%yf?=Zv96pQf)xvLMFb=nez= zcN1PgWSnYH)H&9zDUW$Md4DHHRd0ehok2`&MVvyu5m8mKh#*Pc?))-*m-OH0^#uTA6 z3?GYs-KPS<0oyZP4urBgw@NT@vU<~ZEC$5kAZ@$o@K3~^23(T*JJD+hUoghcoDIZw z8$)%a1=ckrmqeLA%^+u$nbm++wfPvFEYf_TIPL_EC6@|A2xDa_^`AJUVnE_Z@N8MW zNOIXAtm{04a#GYFNX$5hScacFh;v7mIkX*h{&=$y9$~4C7fTFaWHcf!JTjJSNc+f> zf=i&2u{HHzxs(op3?+%{!9#xW@@9~}`D|U9ZhF*PmElA5dV3vsvlsDieiJ-hx9+oE zJV5TB-!vrhYbFxo3uY2`l61tG;|`L^s&`eLZBVuLdj%|LeLR#gh1lnSeN++;OcXrb z`+4klD$*xKCo)Fh7=db&X-@TZ8ag>PrV2(uDCwy2#q@cxgA-x_iP0gE<&OqOzjYrtbKPEAoY9TU>W&&Ly6Rc5!(7bR4JGgSM8lJ)1Zi zHUWjTFf^>!bSMnGAoZ_{yl_Qc6gDV`;Xz254-FTdckqcraTI{A&*;T zA>@)>z$Lr(%S->|t>3@>GM88RDdOM%Gia>+HMsbd{9ix6YMZlg|8?QD`Kw^|(G=YA z>+L4?S8YrlmpnW4Ki_5BzncHkIBiwH6+2IM>w7Uo=+pk=4Y0*fdGa`;V}il*q)&ZS z21vF2MBgB5o{%`dL`r*22xq+^aJZ6ijH_I`NKM+iGm&#jrf;UCRL~G(o5X4A!<%Iu5*_{ zhbi;p?K|7?gHSL@(KYhSBgH~@370TZATpu*@DeiQtd?xa+xTa}#8b()k7;NCgwzLw z;NGKP)dhu`*h!a4CNbJ=P;FyJb4~wj62g`OqN3F)e~Tm>#W_WgI`9vGC6`gBfMQMd zNQG#y<*cQF)7!KE^}I{O2K3U)R1bnLjenA@pe^}!z91VfNm0~0Ma%$C_MZvo6o=0Q z(QD&1#lY&R2z^NAKseM+xjO|od;7&+1Ic;NEZ2AE7fjf`>O~q1>)NT(q>o*k;!R=M zmJ*f3&D>?C3!(95(>g=|ye1=Z`+7(whlSW_61z`utbvnKBnxm8E6=Qy?CJ4rAr4Xy z(pVZntmaa}5_JnJOO58qxKjq`_Z?W(v=ni3fC$)%C2v_YguAok7(c)7*WQHnjja#x z3ak)0DVau3MP@QI(`|nj8A*W^@g8e4*C zDsHyMDffohwHZ9&c$(uN6+*YGL9U3J$tt=is>a+9`pc&e$@*)W*_^VvD8%u1;H(rP zYvZch8fOo>8M^4b%x0fGsZ0~*%&pz=RmXyz$jXLf6E7T0R`#(5B%O6-d4@4J#w2KB zSoD;aaoA2WEWj)UJDRoxpAWw^AyH$A z??X=E(#ixAyS_&5M^Y8p#wqjaeL}`8qtybAiHteMO?+CC-R&>``1p2JnyfhM6V>X; z+&&ezgEn%K1<*7t^z}o?TIviHPOo8Ao|+NUOI|zp$u=PQVGXh*ufz_1*O9R40nd1I z3=(C8#T~xZfiy==6c;o(3H&Pn1WhJ+CNt1ls`PQTHshFCf%AyDXFi z;Lk*s4D;u;>uqyWgg4+3YqVp6J}~QMQ98Kfq~c=zl7k6tp56Xf|AqMSefE>}LpWr+ zVSMn)NOufGRn&}+HB>Ycc+C8!(YvGy>Fr8;?6n3X?%Td5?&kU_~_N z02=pZM)WKYK?*2hn!#O%8;LMO@MLw(peO&`4bJQ@7Oes}k!8~-zB$%{k}6@YdNv$8 zPhvZ^-y^(1W9@YwTPOppeZfb(>BgeQqfYa{F2lZU>b|owpEn!bpK{+HVCK7hjNt#s z`viC;yS$|+jA$t3BQz_Q5#V8+^ZbG5*i15=rf9WcTv@)w#{R}9qJOSmG- zjx?JctMEaRKqEMb>j~Lf(&?s`4==_(p9V#(sLXb>$4d~@{TSKikNX);bqOrq-2AU@jPsOvRbA$<#cdIQS0}19w0-gA*T+l_2Tio?$QCPwwD= z^}!as3FFIS`s}aQnK#capnE={s_2<#oN`cU^jMAo*_evTCjq!g0q-Ot~DIbRAMK>tluLwk}f< z6ppOdc~3`sv+J6VRS4qA^wZ{1d=QdfXRx773S&1I=~^Pes*>Ph69|7y(j^z-H*E_! z2k2*0dO;X3^a6<}}xS8$j)!4rE`H$s27F+0dvfD1)N;`(2} zEVz^2b$9SEAhd1IZ{C&Dop$(>R{{+(XA9Y-lddGU(ot0Fmv zf11JB{!?tiO2WF|>Bwamv`NSN6+HGwSC=FyE0}y~q-PsO`Vkq)uPXD$Y%sECvUF#B z2GCe7aR&xFt(WO76+VUDbxs~i1#lnuo9tYRFL+^UnKTIP6^%NkDGODfiD}^X6SPh2 zR~FcJo=81!ysJ{+!R}0!KjWWQd~Lhb)KZR)#Gu?6)=>DYW>uUsrP2-z3oEghrGM&S z0?lZ9;n^l~fb&`OUSKpBWz5Oot0?6)*!JSkvc?WfB+2or2T9HMBH{iyyvSbml$>w* zqa7^?*ma#8_}<3aiWzF#bgu%%wdV5DS#RaG1D{E&esClOy~+n%Ob-9lUjnwA4-oZS zFX+Dl?F48{P?uQJviQK$NRqu)kz|}d1hW8=(prx<7@PY#S2S=wwLccg_1rEkskbPm#lZxHlw^DmBIB+ zgXfi4uhOJxQ|ADLrV9r6=oBsUR&V$k@KR)gR)SXRiTQUxn4?{qI%RF+!qnRn#v{Vk z@u7*JQCj7ka%KS6a*FxAk(=|y^*2tkj_{VXS${)?mH9zd~|65zEKEH zf2Z7dd;tn*0Ub3Y@k@FcFu)3Z#FSkeS6j`@@G8w|%?qxCY+vF}O4Gha3j+6&Y7O!8 zO=cjG>B7sR_Pwx|;iFF$O@WKYX@#@73naJwR-5Xya{CxWU)rZcI<)1FFJ1;KkNb~{ zwH89(rdAR7WrdpA=+@0B&49#nllD+K`TxLm6SNbpTL2U-moO{%PTSf&9xiJM>&AG& z^{af~CW1YiEe)Y)OF={2)s@&MDvmZRq<++RB-?jNWzn1{e>>82C5{Tqo09P4*`g## zq^QvJ-_ues|C#0Wi%X`eMx-2EuAR+_LTI%Q?gmJPQWb>ch0P(@(7&by%dG|Te9*it z8t~BQ0$ZN!Lr5tD{3$-!G?^9!9JY;Ya{<)KheMUMJUbza?K=o|EpGzUYVT)T3hLD75D$y6#CJPCAqZRbgLmtAk(eMTa zlGR8D@w-#atN#!M#(0mVZ?H#uQ z!ZD(dla=Ps?0}-knHCY~If%>;x_;L!NGLwC?>1kJ37+?{9ZlA)tTVUkFXXUrf9QHh zIw*2aHU@ano@wY9pu#v2(B{}r_NKSc>Rm<_u9?tXBBO|Qk1<{?t=+v6@~GjV%OF$F zS$V=R?hlw!V$%Su{ExNR#2)d|xB*>W$XWq6T^AHhokfN}fQ}|@TwWY*`+`PAYBAMi zQaM851OJ1$5%GDyzASI19TCas2v`KaBmc%%!0=JQd8MOSxXtwOohg^4<#dq0uvO(rJfp0&J!Pjz>Cq5!IP z1`wt!8eTaA(>ldgCP04F(%*7hr02mx*AjLvqzS74KnC#=_dH=LtK&BN{cj^f_@~^L z6h&*TFAwLxQFb-{&(rbo*`FX@R#@0Jr$7I!kQ-(&36)IO;8N+jj*9!END@-!?mDDI zb7)EyRu|t#1xr_zSg!YQLxvJA-6~kL%U>DYZdXl^5=kd%%jeQeqwP~>-=%+R;{Yl>3*JGf2ESu{ps&x_~VsHQp?BDi1?gwo?sQf2c(t7w|1i@3~$$!Wj7EyM%biXPaB|1xb-+u#d6?nErMJAFM zvHpev$if}o!|`@5uCF*Nb2DO}a^-U)o~vuy)LF66-_H9X&lmfa2^%Xr@vwb3N4g(Q zffq-Mc!xqgbRp`)o7AyfVEvRA8+0T8z&Fw#`|;{E3hTcGqnoy)a94U$9YcKe3xaMA z8*Q9cLVR15a(1J5&cUmgqiw(!)06hdUaseJ_&;4d9|uoQW2T3FK40$VbI5OEe0W~> zF4R8zkIl>g6wdqp=x6)s;`H0aGJ$B)_Ii#t-+P?SdnBo&>*JsqQWh_WOsCCXRh3Ijs8(#-%> zAT5RYDQ!-FB;@yL_7R_OvPFXp;|?4IuJJkR&c+&^d97`J(=Yu_cUHORXJZ+JlaT3i zW5dON5jO=Wh^67t=EJqei*_pW6|iM>cjD{E4%=7lQE+9PCV*|@SjAJVCdyLLDJ8Tv zflwpyXzsx!3PtME?rv5nJSx=KR(v8|*vV|1SOd~fDl#_gw>^hzh;)_p&!ERFDSo1* zJ+=d`(h?;pBUCdC@*^oBeZXR29NN@-MihiHz2`1bM~nb!_C~3dLOnNybKF`PXiugQ z%Pr&6k=V77j<=wFh?<1)JHuL+L#DDE2*V-}|K0m)3dlq#b^{{t2BUVn|0+a_D|+5atU z)9JQ0O6&Ox+mNTZ{^b851P!8`%6q3d^>yEx)5;NazQ1~CC%?hZWB39fTgF{iTcFf zZ?Ef=y|JZZOqKD3)M^&>kWbQB*SN-mptdz*jqyPj7w7DZml6lG`=kqgUj*q7Dx=2I z?KG2=&zYSFrkN=vGaun}a_AVuO`2sYF=0O8KB1mYNik45prM?31ALniH|H2UccAuw6b}i1U(jBA=4h=y zvjw*nNg@6uzIfvl<7T~uYRTkK@mfyKn-2@AIDzGka4;;`0-_^aib+{gep~x^sm{O6 z$MwaE6Q-XatiswQRT%ov14?dW(WA;M3kZ8 zcWT{`YG&ysD=~tCjtZMg;`#$f4M9nE?(wAqKbXse=IpeXp+H=F;QJ4@0xB9bTxT(b zMkJl#Jr2{G&Mq~HqK1jlIhVGqmLpgB$m)d)@tjS?x;|zo@ptGi4@+q^^>aela(#JX zty|W+&>5CQ7l<~q?NHQS9jApM1Zfv_psP&nm{Ni5mh}&j=;0C${cZ$WjBilyF>b!d z6~gxSNh=BuH`znmhKOQlNL}rC9a<@QkKo0-H|jlr)t(}sxwi}Do^?KV+OzZAcc&-+|X7l^3RT zSj7*Zr^RTMgjIzoZe=7X1}kN*JVraK)fMUnu&u7>OOm4%h-|mE*qEkAh!jci7szX> zvu1}WDV{238b7!TM&Ci{YL!vaFqH4HrdxCaTs4`YrqJht3pC{UPVI$jOtQn~Gc4y} zFm1K90ZwcJS4|IZQH+-qTs7NS_{(KcPA)g%LM$M6JYwXEPmM?>z0j3rB*#9n^369P#C1$FE{K&40tg=zZ zPkcK3G%ONY=nlI-TG+x4bQ*VevJN8oyxMXAawY$koT}yX7lZv-qN6ZGPN0Mrn7I6N4tL()v{T9??*0 zV)LThMhJKWYaSnK&B)KOK3slxQJ&rTykm#T@!N6aS-G*X;KM8fR!2pff_}#W&SMz( z#82?RM@8H_!t3}4A!r0qa@&Nsktnfr|A1?O7H5^=;=rSQ&8Kh$WXdsczhYDdRq!BmBKZ=xd5o{n?@ z^y_^IK)=+=5*W!Jp9Pbj(hAGC84BO!P~33?ao4+?+g-D#a1HuvUg?&W@BBtuP5m<+ zcbCs;5sz?q5KVu!?;C9S+-@YiE=+Lfhbo?>CbNhG`sOU+mbxZ3_i1cpgKJZ|tf>hM zxpog&`NU-OWF|&_h=~G^$YS4L)`d(i7q9;-2fNW57HxXG)%nZ8UP}LigBch9zi=>X z2n*H!;9w;PYa6J4IhZ!xf8k(NG|L32DZsTdOnJ~YhmllWj0qy(L*tOpX5VTQR;Y3X zQcU{HR?}%MjsPo*7*n+#YaF#P6E(|dk<_8d03K3f1Xq4uQ>5*6CrgM_P(W*%KFZb^ zFaPD0y)blEyu&=rD7)6CJG~3Pu8gnNvQplRpX-eJC|#wlakrr1c6t4850)jX<(m6{ z@L-W&k-*)11Rt-%*O62I!-EYxssKD#mHYpt2LsvtpFEg?mMj57afU7>@z1E-HH>I$ z0dNXtv`3EoXyWS~TdPNefV8AiR}ph?QO)-AwpcZe=I)NJ=jxx!SN0L|*yUiKW`j_Z zMGByGjBphZ22Q;$H=H%T&-ToPh%ll#MnYQ?_u}E-BdWLNL25Qe5LubkGX^}0wfs0~rHx|;=8{m3r ziGa}Wu604bE@TdYX<*wQSvDrJXF4}M3QClMM{$RUQZ>qumY0Xshxyqsx=NN@@i5Y` z(@tw?b$hYlVa1d9!|}Iuc4RaSj+?oqC@J^8hqi{5$*;7*wjcc3Pv%>#VKC9Qpd4`g zZ`i6x5P+>bCFD=ch5dy#gTaDaagb4S;h|xK{rh5bYi5JNz~SPE1PvtQpTB|svtLLY zFr;lQHrLkzFerLB1T08Z?=!d7`kyJ)fXOa^5rA|3owwrcDj|=FjQZFF`0?-UD!{wj zFyO?@q?Cd4jHHxs&@h+mq?8vnfD_n}2==C|MTFJ*9B*?e?w}K?@oWJL$5BsEj2#7N zjGDIve<2V3nk44RuX>>#uMq9v)c{z<=mveXWiILqX1?uNZB)l}eL_PV8l2BJe zjUmJ?gNAm?WB!nrM!`;*R2@oi5}6Z6n`A@kd98Zv$`S?J2K8&D$YYE3iA}Jd&HjjI zwYgpt+CA=TwcwpqY)NHt7v7osdMKXT{`{IttloE-@!HKZP(H zP^}}BMfNvT%~MpqTsUN&m-*Z{h`ZavK-~IXaaw>=NJlvh-y+x>oV^VgY~ z_v3j?{@C@UTzB@zNR_u3G8f>xD~rf6zKxl=bYQiCO#mWLKZoOQ{6dcO@v$ZMZ^pX% z{z<~nz#?&yF~}88UG`_st(ELNRin`XFqNCkIs<+#asT0};{Ld*oV}Qq>~s>44;sW%63F zH9hhB3aPkj%F!7#?){j9rZ*c2eYwTCvC9>@VdIZyi_}pFzdYPKeC6cy`I0a)~&(^2q{cvwF;~dA4gsq;ohKkKJSxDj=A~_8U?2PzK zN@2S1-XNO$4sp^KnBAHBw*gv|^9jLk=7M>a*izgpFu!2+AicASk1eQRdBBd1dQx|B z=H#Y%(si8D&!5<6Rk6r-?mltzU=ObCQt+ht6c0u5!oP+UuH)1ljBw1j0GXvNR6vBL;F*Rg&Da zq-u?B{I-j%LTNRA@E|o2vZPo}X8;YBph5wmMzuBdITxI!uCLXK9OR#|A7{R7lrw$l@u z9Gb8>xZH)815Kq251jVyOI<0G1}xf+rdi5TGAwDC-}E!?D4{OQ88=%_Zh_(H=>He<#8{W*3VD(5cOHMBn%Kd4qQ8`Kvg#m0wb|Ij8u&VDyYF`d%o#Vsjju; z*BQF%beEaZvWPEG_El-JjZN1Z2Oc~3LM=XAEyXkDmCw;pEt4iyh*kIeQi-#x){8qn zSork>=SrH`wlp_{XJ)W^g#;0y|Z5E4BySJ#Y$6kkfM5e)c#DhcE?VAH^Zd6S{E z;UIP!;<-$<~-nQq2V{vtm1}xk{ob;j^LKGNIK3)TBI$RKHG&Mjt!`mvzU_=uPa=5|n6MJ5ni4!NPNJ_cX!+!9Aa z17(mzpPi+)DGQlQp*C$#G#4@1xHWb-&*77*6MrvrNN&IfU=7h{Mxzur*d?As2&oQ5 z#%Aqwn!AfeJ$_W#%aAtJ?A4D&o>9%b>sAS!;-EA{R1E=(Etl&9lM&oKixC~&_#CjZ z5>Qdk4Qq#mBT=MEj%OYkUk{q|@6DdkncC9*Zm##VUNrjMX&*6RUqPB|X78L{XOSl5 zyShW$XC1ab+SZ?veboq&o#5CoV9`$OIPrcSZmkyeyx{RMm_#c>|G`vE+y4hl#W-aQ z3-Z4(mEM2HRGWV7n1PAZUGm3Qxsj9RQ?Yt`#6S0c_b3xOXW1HX%f$Z>sX>*fL+9Nd zoU@jT4C>>^*ps~Kygcj>ENOA3J&jrq7A%KV-Cbb;m|`Dn^RF~m`lS&{WrcL+^3PWMX_Y;!)Yxo z=2Sb3Kp6G(*6PA;8DI%Y!q@pcc+Vq5lAHM|Y?*feO$B5H&{S)T|D&cd`Oli_Zt;(% z+5;DX{BN3SX2A=+G`XuvY|4R6jj)`fuv0--N`h(Y{kR^QXt|{i_Z!UMNM=-Qb_~^` z=~+NNgG3u+ZQjFTDGM2SW|qkB9}*|mr=zsJ*ZaC0>r)XrJnvth57$wS+p*qPA0hMX zy5Xx8QskiI+)|R>X5(>R5a)1L$!5Jo&N109dkuBq0S`yc2{0$ZU`YkR6$v3U%aJ*| zQ=-ky1}hQ?m&FR(P@(}2S~TY=OUwXveZ%=XtdBhrrnezac?9qeo+43Y*N31&5nux_ z!3!`!5ioj0p4#~D)KzcSf8N&t(|OiQ$QA$}>FQ=pi6#WtvC9hhP{8{o;DoDxMs!Ch z5=oVGfI^~ymK_jB2FN^Xu;sX2QTONOL24NYz~Ai``_#e~EE$To(#G-)_r$CtAwofkOT9qUy|*@yNAr%d60H zEl|#KCaD!grgK5V%Ju$SicxiHEJ_%ha%$l=(%=g~n$lN0oIf+Fl3bDcZRny7n#>+PyeM0j z;4leyB3@Zuvw!<1J; z+}bQgOd|QNH(k~hfTwV($FoQQcnZIf;hgsafTx^i0eI>hB>4f7{R$fc>8hPZ2e3kD z2w`E+8vP^LWF6MGtLp=+R(ZQY6^*evzUWBoQ45W*ss`FpK*KI|G-wtiLh3af0)VId zx)orZWT9aH;3>Nq=3~UW=ZnEKz@x+s{}Y}vHZBF=DZ-!5&SPnF6t@-Py^c&%i!9+SxhWUs{7!c3eM)2hn&R%x2{9D>-j zuHAX;htM`o{yck5>f&<|8Ic)eLNxnbs&uEb)5|vK^00w2(jKI>jLfSB^s9P^Z#72d{^_tPVT<-3U&gdo-d5PdUgs_e_6NBV_h}8WfJFcMn z#5lBL`0~si8-7rNn4uBdH}lpeqNpmAiQ@Pt=`)I|#98VIrOn0(95|pYaUkL?Riz%w ziZ{I+L*VXA?zeCAEeg3lI2>c&yb4zSkyJ?kl2my99;n}+lV)!s)3E(- zNd^2kiAKkjd(E0Or!XME^M1957s!;gx+m!^Mt!(z*M|h2GZ4ggxz1?I@_d`R2Lg5?&oWSzrjZtf~4;dZ-Esb{p=NnE)RfZhG4sOG@6zlPgPp=}d81 zv!7GS{mvRW?tqRFe?M3^u45+b&%q1jH&0U%K~dMK|0q6eNwU;x6%=*j6z5R>7}22B zntkOSx`>337-!lT)*suTFukmFzPZi=)NQH#MiBaGxqyumVIrwR^&L z3KRwFj72o~eHBOq>&(L?4WY>R$vU=ZLQxN4Q&YxNMu3rgvcetXvI;wklyYmcbB)6VZiO8sjT03m~~?%w=^* z_Z|QA7l3eC(^Ap-0)_9Q{N>Kw!f;Q5hrQ;71w56CWbOe+jnD zP8{a3s28P_CN}cR1`FaO@Zq?TG*Mmnabc zj@@O#cODfppnH2#k$`<{5nwipdC??6Fdj53j@DN&m3bbtXUJB-rPk#2M&BQ(Kilnh zU^18#<%=o=G9nVIziZCIaf6@5!bapHgl=ZPb%2_1F$1-8^&Y!M`qT+)IMrhI+sU|X zm=7sNo~~FIlZ@QU6YtVV7+t@m{|L^9LaEcFH6S!WV6m4-P9ZhIwtvr5+X!~$DlbF% zE%Y|{nEky%X4__b6KeO1Z2ft0_5gjBcCF*!YJV%r{7~>{^rieFSLEfJoQ@?TksBb7 z6r}kw)p2!=*l(~HIOFd#ECrt0^Q2u!qIml&f@As*qml6| zE!QES@R~3Th~ObDJ-@HSizB-1r2~g%*JedPN|%0LF5lYfnE^ zxfNb@eA&2Rp=S4h&NobJ?o;jz)Pw$*?&L~kO$m;(Qw4M{PBW`^w*n11AJfR`RWvW# zMYfqpp4l+rN$%R<*BF`KyBgh(uhiJv%8aE{P5QPpKobp)U(pq&++;#lvC_9#3@X`7 z$9nO!l4|xw3>J-ZD0GrEn@wmLD6Tedb4Mb6;M( zmMEXI*Nv!ynb4r zluY{P0RGpUO6Tw79l||Cd%#W#&~$ISfl5V7Li0}y&^gYWf!TipZI5k~MW^Y~e*Uw@ z+QNvF^*5*eiPbXOJ))Nw+!JnTY|?;llUg&(lNC{SgtH-pSrxjxkJ&VpnRLb&PQdJr zE0ODih5&;WoQIia`5!U1v&|I)_n0ys4ft!W&je{tg8AQ6wj$m=E&R0iUT`QZFiV}2 zvQ_E7H^1V+@Ur!(O`g)0KN|*f^1hl=# zP+V^EmL^Q&nv#3C&j|9*uP%G>o*?F&lKzN=yxeDjEOY%6WIH0X9sApE>7CnR4OLOHnbps73ugM`@tHGEvk@-E^)Z{S&ZwoeS0S<*F|Zo@Ud&cEnnD;daDZtfrsC;30Nh#NrK>Lv z%p={u-C0D0+xg|%E5%ujaPj8f#u_|tLY(uxPyx)yK)(C>NY#J1vvM5|X7wRtr~6os zrY54vlx$k`@un{@FMPs-?AI6dvmi2dySf~k!>)xm*em><_3zx9eB=*tg*y+3WVMmDB6-GA z#BGu1V3LTPHZm--t(HLP&0~8UC=X`O38J<&rCQ3pbv@UFVb9pl>6@Xf2N1Q{siyzW zuEy7g%HrpBME)gW9c~}lFd!mt|AmOLXWz9XBTLsOHKLj*0uAnh-ZX|HE{aRh~CFyhe2IU5dK-L=L?(2{7YKf)iJdor6oV9#kp zMZrio&V7T>fDOdjOKVkc8KCo6CkCO_N4Au|)HJn$k(Vzr20`1h&Q2A#yU0B&h8-$9 z<$E?kNoI~?R7=fQxk!U?BvVagCQd9&g5RmZxV&QU3?&4sch6Fy4Hfm(>ShPQG$_en z8gVy5xz?=0^ecXJCJJh%lPs=X;9#c#!*;V4kSr{{JuNO}rDN9smt+?+4@Ji`3<`ph z`{HlMPN&HkiUvnqeL1YNDmr@f=Jo5P9ZC_#eJt?EX^L>Xm{Ow`Y$Xm$)DRj=^|Y#e zNCB@DT@IVXm@Tt<zT<me8WG1t*MLi`!~sgTp~CaZBR~I%mkHkTK8rS6 zBT=l>KGB{kOuwA*N&8bT`Wl;#D_cQRK%05SJPG6~4nDfR&UIbhp5rlt${8y0Q*2u22Hq**rUS@cE;+N1 zq>cmF<5*;+#yA29+-cA8T1-STUpn29!lK7+zgRsb$!NcXqC2}qQ}c^rrg`cSbZfml zV`|??SL;-z3HVnf*O!P$3T-p1ofr{S^xtQQ*!%c>D2@-=R(fn=Q=?8=XVd-y3gAgs z(!#xt+ZdiQQnuFL>6@90>$6x zcoQoEiM3{g`_Y-Z@u6)8ZQ`XimaVTl@IH9*wV|s83^H~fkIUU3ht(+S zCUP+_j$RH4|C}zXBCd@hkc6q=Jq^ZRGY}ATAuOfrkozCHWo6b$TmZ8ln-leX)ZJ-TA_mzvOe*zJ6Dh)bwxloq6D$6(hbb_O zJ)8e?v#ij=a@`4NnYf}}^n10NgnHe$tR%-_E|80rlq?M}pPYu+GW!Tpc;~%Ots>D_ z^5DOlWlfA(K5o~XEyQF6|Gz}bNRBIc(WRZ|cHRjJH-OlldEt*0EpYj6TNz`1_Nk0C z)W$;|IsDYeHx>R~98n)ZuuhKeMkTV^motTcZve^>4;*iq_|DT{NpkA8+SN?ArmnCb zyXg_ah9l`(J^5NghC}niW~CiT)w-h;bFGcQsyCY1S#*1n>9_a5;m+Ic|Blx}m~)Tx z?^G@g)xKpp^aHYGV5vvx;rT9;@*@b&i(M*7q>)8}VcwBo`D8ESg;zE@lRKhMW12mZ zh&>;7W(O1dfsLXX19!L8Ti+N!`DKI5_O&aFo9coNCxt_)nDT=wV-QU0Mk6i0;9U6` zwrYr$y4q6Wv^^~HidL1;{E$UgCU}qUjo7j=N=DLKKS~CuHBs0nAu51cL)H=YL;Vl6 z26O@nv24_qz1fz|eI;Yajwjy3abZOm9l6Z zKk~MLi}9MHL2h=;rIMZ`hVS&|k%>vIO-t?`9=gYPNnzj=l5v-HiG9IV*b|9$6@ZHP z9adl*&dJ}2PjnNSsSRAQI<$p-Mt15uB*m5s)-c@-dpM^X*%k%PZuy4&*S$fVjtpi+ zkT6#{{xqw*Tia1e$;;D?xEL4FM+aek7>>uxDQxNS4T=TBCW-jQp?Dtnc zYS>}tD`zlcn+p&TT_cI%q?F>bH;F=}n%eYyXLIL_WEG3^2t zPE;Ij$mEJ2X3XMJyr;Ixn68kdTXKEO2PX9b_WC)Eh(_gr#f}3TnEO_n!bohMN2k0b z2!q$eIe@#NBU?#zH81amboJcwb(6p9S)f7QjW^|$K(O?+#ZWdj<3U9-;WMYx=h}9E z=q_lt+P^6KLFz0tG0XYM*z=BD+Gf-u>p8#n;2@1+$~i!VFiZhWo+_8LUT(_G2mKL3 zo>I3QD7PEa#}={8!V-ql*>;VM#t$?M>c^qomh8ZH$DMZSQWb^8 zyXa$mq?l_4bcexo)a+>}Dlz{_N+_9RwtoER+z2nhr>c=W#UNssx%2?zBcA97g#fnb zTrX16IK=W5sH)oJr;b_Dl&8J#ojG)-C6x~Ye)pHAmx|mWT3|Nzqm?M-4qG10QknM0 z<-;68wNStmh`&C5g>1t7=rFFEKqYtQn(KP65cAsIW0 zbGxYl#M67NxwP6V*I{e>kE^Rcf8Sk9V=#mqefXQ+BgUyC!f3;CE@o~q2}zPXS4Tah z;k%CoT#XKtHcEt{jQQ9pEI_ZVuHcnnD!Z%4(H`n=5>){EGQki|3n4zdWJFj&{i?F8 z_}f3@>oDsJ9yHflbCQ`F0Lj<`ta^c}Z2^%VloXsL{j@WR`GMm&ImcTam4B`jk}?Am zc>*iMm4n*5098zcZt44*CT*R|4;Iz>N*$0tOSfd-$D-2UGb+sI&Pa%-mmoiHD}(qa zf0o)2%SMHl!Z^Gbs<3>XbwPIy^*Neknab_;`{116lM{3H<^()@4HLC~PSB6y%oOkG zs|d6m;Q9Z0;*C*Z)w%{^IUDf=*oubcXr+&f+XO)uSx0xYlIK18CP#@@<>op|5<}S$ zlsovBuU%opR;axKgA(Co!1NaB9O(CQ*}FM#B}_J>hiK|EEhCi!RT?%8kWxFgSR)T*RiR^DsncQ*SKO+_CDRj+3hRj97%@&wn3r}U z)HBOTs1Nvv^OBw7rvPlve_l8_E;)Mu_WlNJ{SdF29$h^?0Bk~J|1+kM<25t0^v|@v zN36Xcxwrs(;HQt#x>^CdegVe*vkNd@Yz=Ve?>vgKMScp3;FZ6hA`BRC1vqWs`{v(s zvkSat;(q@qa&pwJok)~P=s&Kjz@8k@T3&%gGOqh7hK`m0c>`1@6Hb-0YV`~CoHzQd zR7}ujKu0vj1pJU`DyHhoGgpH@T*?wGoC8N!J;l^Hm&BR`Y;b=|vBVo#fyYE6oF|C` z9n^0pK0pHveX&Czp9s)Edl8z6H?ytJL<^dbM?MW?e|8&oaGf8mvu4dgrS0Rvy{tK_ zSX;OEW(rP&uHP=w4}{iXm{8OneOs##J6=|ZZczSI3ct2koY@>Ya_d8UQ_t_D(EeKU zl1_KhP)U=96NV(UeD|CW+Ol}j$w8h{+}=zGp|H91P~?_~VY-RJ-I0laZe=E`EIN;? zHY@v+?hJB(E2k-@QTF816=?xX3M0{z5;|VLFEMJMLyB7gdMVPz8f!E;GTd^~@;37A zY4(-D8wbzF&H2}T!mQ8R-Qesi)7$>j@HXD((Z}=N^Yh8cF@dg^kCV$SEFi9KHk;V| zylf{fP#>X39EMBa^JIsVi1>7+h@HhC& z<-;j14|ME%Z<}X4y3`puHpIO4C|89SaV3}aD`M2oDxl5N$fho(w_ErdCW`luL(^TI z3Ny1Xyf->aomk6M*sG0!&rsh~A@ z!QCqs*T&>JNU}jJM$rHkJD|T-2~H;Py{QmD_4W6R3xjbDRb&F1b9BUrF%% zsi0Z^Q$brJxf7A!+Pw+~8_s>fQJ~$DD${#*z8}bXM3LH;mc>AXr0Os*R)s?_Td=s- zxaQBCmpN$be}yjLxVl-2;#AsRt_y1+Q3D&hW|;OXV`Ik_Ir#zXi$-(e>p+j8jK7tZ z(B#~tsm9|jiV=t|H8gTOaA;VmU=+5PGr5dXc04}jU<}nyeV9PVSqLtAU>Jb`sGupc zjjKYnd zVYaNoYRAXd?h|iP@eJF5K|_SajiW9u1ED096DIpD-)Xu1U;w(OK|X#~o-8)Fz2{vAmg%vaR@4Ob)X>o(9la#j1iUzMpd-}#$sm~yx>fJF z+4|(%(HGqGzDFS9D`|YpTmbGXGEC2-q5IneSr7u^*=^En_5%p6706jX*Cc9C=!g~y zq=#{$WdYIO31mULJgn6(>xu8WLs%L)pyfJS4S!@!1{#G6gQdnOJ2o9Hb<9xih0by+ zq;`VnB$o%;7L#6n_2|m~fnExfOqME@IOQlDx5IfH1N`E(wkiqqB4=CDJgDoCxOo-Z zR49L>P4eCaU0yf%f+Ra+;}FZ8Av7nNa<9NOLfmGHGT%F(TNHRhLqq)h@P1@e6uYW^ z-0U>V_ucfj05LK0FPos`jCHx_aP-4h=@uNir%heAS7>NXaAKBWc_$_%zYp{hBbN=H zb5zde0v)tCsJfq0avVnX)tWBKKl?_!+q=Tdit?we=G`YP9CQZ13MQao&Z;e&=@1k0 ztVBXWY>RK9urjnN>hBsSv?ewmlr}GnOWdY$H$s{ii#g%Gkki8ukU$lKQfPq8a4vsNY`^Ssq^$$hl{s9sixe!ILA-)#CJ8VGfE_fsc^DSl%g#XK5b@_O1imw*y*k+xas3BU|HO+VoFv>wwEJzz>; zI0qY5r-57-5mr>0*pOgn-Gkl#nrK9%vCT<)VU_j)v`PhyrL>5_h@&RU^yjI@Bf;?h zWYE5o;WdU{u)Fu;qH2W}9{f9lR@-uL-p!AX;)n&vpndD(WHKWuJT{bSO#7WHB}=N4 zx-#?Iav_bIoG_d8uiRUW*YMvSW(UZRUd@wQ`do;owc7>ujY=}aE$UxKDH0ClxFaM*H;Zy1ev1;DX2VO*7Ba#2ZjiRHO z+CMh+8QK3}bq(iTYsow#h~+Rzr5DJE&MxG3!Vp_cm$1;Pbr>J33C z9Y-zXWI2jt3*jGnNMj&CCx2S!69+F8u@HI0ZeaoH zpg)g}y)2&mMZWX(WP`yn2~D9PQkoX$x7AFT-psaf zHn4D6OcW8-32q}Q1?>qKvC<{hj4xSLIfSRs7A`kfOip zs938##X}8a4Flaea^yolEQKfKZZe4GGaNyaiO|U@Pbq+q^;CcC7N}#T-Dz6Hqj_R> zA$vsB^vLgWC5a7~FIM;v!ZH*|UEW~oWKk{%1v}t&TEF6RK z5e_Gi0d}WwJ$C(;u@td51l9Q{W==9S1VtjPi8-2QPJsujDN*0;NTenbOE4t-f#N#_ zBxlR19#hdtqz?RVXZF7-GUPH({w-Y%9yWwZozLX@Bp! zfJGM)X6&zq!qjXz@mOHInkM^S(@c8nMf+S`3H^=fuN8u{>%Vv* zZ^mlqsDAUy4#MDn?^3X48+W>-!Zj3`>(*~o1QQ!-yOPQ{HoWXZ(w<+3)Sbysow;}v z>q=yK5Yt|0tZ3h-ENvA$iozT#_V*X8iU`WYvS_hvkhWFlm_@3=`T(ryt#E_z=*Kg- zl_@OIEu0`u6jI?-WjAKy#j>f#|I)wweI&GEbXks&StpCo12mg2m7z>Z6IIL#{!7>@ z?m5Ds>{Oua>c_0m-Q=W?sKkgijjD_sqtp0#U5Nc6p5_&Fm~-zTyNIh>-+2~odVE$r zPqwO2{ruEwKTH*nvV-EtMe@Ppc<*zKr1}?TYzQjqPz$3Ro?U6OO6r_Jz(Pd0Ujvij z5+_zcDq_s_3sB`Cx{TEcHCVQq%CvG}KB6Rvw0!mA*-<8A@cw~(h7+ce2>vU+l~W_4 za$J&9)T%U96NC387f_V&SZr@gyzT1-Lt3}uz2#zWoWvE>OivD!v@m}gCh=49-qyowhZILB)ABcJ0TB-^)?jT7Xc)jB20Y72bV6(tXU{tz zkk7EHPFPw%boH9ayj-5HEl#@r3G(CNQ^c^kbd!V3eu&|HP~$gVnI3cbE5KyQ9N14xf-cI(I^M=Xp-PJ-FdIs7lY z>H@#)!XCOGD+s3draaEZSV*59(eQn9e}lMDp5Md)GH6=4jFx55UwK*Q+va2c` zu{liKa*ss4YvZ^&a(`pVm~S8X?lmZ_JJSZVyu%iqEQ9?mwPn8%l?)|)V>TVM?VHv( zZ}@XJ-uw4Q^ga4$x>&!gI5Doj9W%R;D7RwA+*h$L64Nv6-aN*QD*iypb^ zcVV^bFa@=KkYUbHZR9qjrVW7u(dlzhyrK7^vQ~%YKxY@0ZwtpD?y#r86~8vrsm%{d z!2dq5Kdgqc-xe%mOvr7zv_=fL&fu-nvbUXWE87yl7%!1MX&NE|76SLilT74fC-fw3(_oau);(EZZu*nW*-RRZh%F5qMEvH5reLEuM|t zT{<{R7%t8kjR~BG$fSG(3LQ+x&r2kJSAtg&UG|$S1pahqtF}dV3&v16Eh5jOi0aV@ z2BWZ7!97s{2MI-W8U4$ekA7MlTIg>|c~wpsdrJP_ElRLEn@p(26$uh`Qd=Hc8W2!b z86BX_P%zT(@tPPRIPE=PQ9y)hk`2HSeC0v6M)d_vYcfkxTy1KKaoc*#pIB$iEBx+gA)MCe0qjQmA!ED#eW?4o_-#Jky0j!X`Q$!c}Bth^&Y8SKMyEyC!5xVqgsDcN6$!4>BFqW*(`A2=~2dh%h&N3-y8 z?hP>)mVp|mWlDw2n9WnAk$bgyV|cEXpu?^OE#toSm@ek9LVg3_p=Q_qCJJX=&S%Dq z?h5w=effD$skfHxVsQ`>ebCLPdF!(5dVW|AZa-beQ^Si2&b}9b8pDKjm8Wpn6oX|@ zR41{@Jc?wa1!!MmSIV24c8peQYm&=Nd;6d9A|p+WWx(Nribz}_C25N2MZMko(ZiyMkl-Rjy|_wr0Gm0PYl^QYKCLyM%nJ(QI+ zX;RJlO4rC%x;8^`5BnyOr4+8~3rfh}3B>@AX133?bl^o|J3!)8k4<0cnLXg}YxY)7 zl7I{~`|WDJIz}D1&FpSIH^zC2EV6>t>=5r;0B) z0P7ypQ7oN|Gjkdj?);8+ZbdVJXzB!H@z-o)6C8UGnvT*l+ZzW|1g{LQ-`PEbckT{5M>AKIul+YBn_J%hfqwHta34|43V z;~=*{A-0;9)CuoY#EXgmfIos7dSRP`x$w{G>HT)&)^q7~Z%B*)Kav^bx99~?DysjX zQQ&8@Ufh~^8(V}CkDy+jr;O>^{%Q_O=E=u+$M&~nz)16g-Ov<{3xPt3trHHc0%dpV z8kjB?&>rWz>4b#JlXp_cX5ufha|{alp9sTDM7SpmmY{>{0%=JL3In&@xGxP&afTzT zMPj#Nv+IfG2Y0?H2UJ+T%V#( z#qVAscn78MH+>i+oZbSlf?Q()o?GrRP;fg9U{uni@lo`P5CM@Qs3RwJ-wF98qd4^SmqcZfcErN8CUJ7J5Dzx_r(N#>I?W8%A2&{v5 zByS2}%K`LYGs?aWWYCI^sA|@xSjF-P>T&Az5scw%08QxQe_$jXGdE!|?Qwn|uthlGq-Q zf&(1>SdLCoyZHHCg1BFwp{MQVj&C*6kZh8(4?#!>wgiJQe$OyjktOXab@>M0Q~PN` z9oi+c00JkW-4L|&KVCuNXO5xWA$-xi0zMS)lP5P8 zK4TVJNq&3BwzOgFaQK?e=quj@)URd>evhr4q!;tDw$`Rxlzhfep-;>T;8s_39xi=L8r9M0$ z4^z}h&}OjJA4h&QDs^DF16&7xFq^Rfug%c?Cy)4X;}WGa^In;n#n6+wh$||8fJrI6 z!3Gu;=k&KwdzF1sr%d7po2_QkiT{+Xu;#LO778K)cTP4y*M-EGvXcE0jndda-L})> ztX9xj(Vj6$c-%HM(8x=J)1xD_EEjoEoiwfO9i5Yo`qN)}L+g7eb_p(vRaESy^-Hmj zfsqP$1VQj^3eRaS#D^`>#~B#4S14xecJMT5vfh1_cVop0WL4(g;1b>;uH@ zZE%hXm$$NMZph%J|2ie#2ytky%Z%)y|CJG(1X!s{43sDp)<_Dfvzn1sTFhT(iCTD> zzWQzZfiYaw7NLUC0E^Fhz#(N8hgIL^Xbb>@v9Oyw%uq!0{F?h zM_HdiLQanY6c+Qmb4hooL)9=-E?f+V&o4X`Bn~V?8oTKWKhT+4j`H$|+%36;zS;*L>6RAuyr38gJjLAZO zvd{q5X_0LjG~!234zPLA?njB*HBA!ePZw}BFJOn?nEoi-u}U#k6koAdu}^?XuhPZU zItgmh14BW^bx4=BYChGblSr49nDTM6rB+qH$)I|;dC2C(5s&q}nEMDz7@6~G|0&Pm zdeDK617$@;dNrb7H?f-tZm-~%m$f*qs^*pZ!j4WEtsa}aau zI)y7-J!E}wL$fDK``;pb$x-Gd$d{DOvHD}BG4*>-^QFe@Cthn%tRL~4g z^&vNcwtBOod#M!>kf_ztdJjfjJE87GH!wPsy0^=`2@oO3K3w7ZFP9Q`gPvUXHQ|y;pC)UOWOK}nTv4dVBYFBfkN{<%3O0B-)6x?FUn3?_&?e|r z;oLxq6Y$wf4gNaTCyhzr1WW>}kmqzD&q!QH3INhFnokjf02+FWq5>~JA%f-Lt@qg^ zZG~7^_K{?3ZH4Y#^s__$OpBSmqa*q&3MQ=D(O$8Ze~{cLID8$u@9{jg@1&?LG$bj^ zR=JAmg5xup8P$tnT9~>v#;|cy$ftrAF!TM9WTj(r;4=KXrCKbIZIE&T%tjuu2 zm^TpjPytdLYu%8_w3OzHn%l?s!`1WnQHvi5WlYLe{2U9ohx3 zGGA|7Cv7!o)&(jzm5>H)aLxSw40ZlWV@3qI=wg=%ZClm#90{aKXhMOfks@)2Hgn>) zn$^!$E9h4hLR?Cb=vz&--x8gZo@?_PD8X->153MF*gFv&QN4cW|7pl|{WIz-_RV-C zJc!r8B85TVaV<2Pl^n@ei+OZBf6!s5k&tlzRe9NH>$I1U_ReN@_eJn2_p#MDu05gU z*aXH;12L!QT_SrugO`r@BwDyP2%02GL@ipYP0q{@m1Z4fjJINlo+IRjr7Iq~OCGv;)X8dRv4!`w7+W!<+DXb?PHr0`vAgT4~BwV}*hw6`w!9zJq9phgxoRUFqWdh-i7^%vI%uvJcoHreS{200(5BXHB4!&HWU z0bmVs*6E7QnFP~mCuB^WHkBGMY-ZjAA2i$baIhg@34YB=_eeKnxHSN08WiskOXnsW zU$DZ=h7F|o3jdg5$?W8pR_l=1Oz>mqhA9u-!;4EM73*Ie1fOK*|K0SjQ}vLWqKDB# zO$@-v)myw`A#&RT34p3xH0_8T^n770yimbfnfs1!5T;IIr3+i0I z78ubKe)U|q$o8nz8*yOYBNkyk07RS=w!?t=6{!1+GP|ajG$6(+tesB5gjlBNxoH;q zk%rkZM*E{>Rph*u*m_Of*pvsYnwE#T3R6#?ovfYjv!tMA)Zd?0`e<~&b@py7{fgJB zieiTeo2)8qwcK67%BjBH!E!ePVkn+X02;d8Mw<40Ow-IRhW&DSW2U1XNLvwgt!*RR zZHR{qu4bXcflju`i%MF0NJULm86rzi9Z`-_absam!QFPnDy~Hx0xRX2sFeLVNB5Fv zLQg+-@i`6M0$D|HIIX-lk$50FY?)-Rs;5rZG$zaN7q&B|+ZLKbewgVUvv(wxG1I&k zwOR=L-u4fAzuzCG9~)Esd|aMC=~HXzcY1rjYcDhZs@?ALi>Dd?J#?FX`gn0&t$ew) zYl!@Ps>k^#MQ>V=u06+wsJARW9$@VM7xpkqX?X3W2HJqpz!PtyglU@!+ni3O$^3!P8cr~4a!zzwXZquogKKPEsW+K9A__OSh=|Cb zR&`n)+im`zlb*QGghIn%#Cbugz5*m{laR_urw8XKpv_}WG%`)-{99#Tr|!Zk1mk;a z0z4AQL(_A!*zV5a^rMC%ZzI8;fT(#3B^2lfD`Ds)q8j6!<78~N_u%*-yDhn1T)#uF zhwE2tr-IL#57(-jhI@9j%=k6@f3Irb3vyqS#VKe{$$_7}E`b*EeD5C_rdN^6I3UcF z4{gp$t!E^y6sM-ZR3v-g1Q?SF=FR`PtISHU>v$-lfqeg{GE3O+4Fr~Rq#e{Zmp%{X zA1Ro8`RFYG5e=Dzy|cxKBra5||8l%~29v&AkR}mwp zp?ovF{SN`^jMPX7d4p2cmVES{21Z3>W@Axf7f{%R>M}|$5;T3WfK~x-hIb9ju%tE4 z5Dkh2q77aGAS$wC;5*&RlQ5GNN_|)Kbs3pG88NO2o7Zx%hlLh8v=ZG-arI;xzanm? z1g`XmYnLM&yAg^#hs~T?Q%NF+Jqw`sJS4BsP;d&@^!`$43ry#+LjNdJtA#^QTOUQG z$L8|oAHs89qI#{+FO~A8)($^IA^J<=u2e_AM+F@hBg{srzG(0BP4SaV)S-B~<=iQrvj<3FQrqkzvM2t-?eF8r< zn0(k4ZGPRTwo!d^03Rj|yfE_?s?lu%eJlmAbkbEhcL1!W`9;semQF(+ z<8bhI8x2De4EJE@xndJ z42yhz_^%6kl?#|{_~EmuMSEY`=lWnXO!m}D9o)ZK8^3G9rpdL2)bgrz+{$qUzNTpy zQP)vsA0D!wT158#nHyt8FLR%iE_y0Pfq#&kKn3|to>yJojH0)0_}j>csP$w-1%pir z6nYz6&+oB&YpDi|R5Zj9rJaedM}zo>7%jE%5Bz)K1gx3;?Zb_2K}wy!`$Sr5jj{EE zjtb1_T&a9#*e$Y}wBeE!K#42u9b`+RTTcQ}>U3(N%ypc}N+3a@Mop??Zi{7gR@c3d z8RdQZ#P{-`fRh}$E68Hx9A;FIwa%GBCELR(Yww75)fwGfyO>%Tq)7Iz9cV+2M&BAk zW3@C;%|BLQLqw9cS@6k*gi1zbC|4N)JusW?Al~p)Tjw8fT3|%Cn*F7KN#-Vf%;f46rnHFc^bL{^v& zLS6DOQ!skZ?=^^{b)bl>xc#anO2DY!-0(|9UJEXH6YwS1p7t-QTxWaH^e|;miE842 z`pDHlMT$>lqKjjqMDo_7%!-Wv33Ld(0uY#3vlqNE^NoAa(T%kF7!oJnW2PtKzDc!$ z68Yj`cH?|=n0nhw2JxUU9$FkrrFJ5>3so|KxWeDAB>+8d{@jx-|430ygc%myb2`ne z)-}681=BO#o~f%FhEf2&qBV9&!>1PG7Zyo{v^ugtaT0>JT07V`4A8^T4GUgsU1xcd zD~TY4?TrDO``j_aQ+c|H{nQ2FYAj3$i7V1d<-l6t)y45Y0jVV%S3g%Q&Ph6NOzc$W zAsJK&LymaRqo5GDNX(-Ojm&K5qiY(gzqpuZ*vXd-hB#135gywpwbKIBcmj|irPEX+ zF$ zFAhusGaN!73wi{R5`zU?5{H%+L49OI&9sQ zlyY<)K`n)Zf*3;Z;$CuE6&~sB@qT>1XeRbozz$OdO~%&cIro`<-EJuAqWtS8_4!9H zes|0+SUa8?>3jDx_EStO6L9e!GW6%EX!4qgN)ram3vRC_VD%^Do-F&)#<3G>1=^s~gPyTtxNps+T0h1Mg9I%ahvY?+A zXVgqYaxv4A2<}_@2DsPxn^}<|QV{b_g-dBFisb4VEfgssn0o!TXH^P?R#nx4*1F3z zi^XjT9;^GCen#NSrZmo>)Y?uc%60dWY+n>IoxMLHQ|s#}P_ne4_iw4k{;Sm0z#jT^ zx8vP1vVk@me(nU?tXDJTZ-ckOZQx%nmZCCl*~2(4pqu+L5J+r9e(^#pv+|bgwMy42 z?e)}OjyQEE2q0y|AZ3i0@lp&yJYHkiU4)>H;EsOePhIZe9&SRb+-m8y&2>n8>?kYX zi&oH2(VKy?_A4n9ob4R$UKH;dFe3qJ+in)2Rc$D3Un@AXw!R)eZ;?%3X_&nM0EyQz z(rd1lz(I4t7z2x594mPK`Lt*_a9etO<9IvnLgs}17*@7$kBF1^VZxu28F{MGAx?cP z=EMWCT-=@##IUhRnMvV650Y@8&;N37mD|3ag%zb=WHu)-muxY&?(0&_1@Q*UzzTt* zk?b1F=C0?^GTj7m)gO5aMG2(f<5&}TW;LQ)vLG*)CY}j3j>u2^AUQpOl?mGcx$kKY zJaD8lu2L*cb1Mkj%Pd*a=K>?AaOw<@DIg7Vnud%8i=cT$wCQtALg{S}lfWgM@|(^f zL)lw}`Kgn57=PnMJw^*SgizZxy8O;r-H|AZOlj=b)vKK|C_G_1gg2;7JmfNZA5NW} zVDN1khg1Z21{64;MjO|P>7CXUZ7oOYH2Qd8XR*7D{B*UWzSi648Hhe`@>g5=mOwXn zyX4{=oeP(gY90G9)J)w-Eh81d>zxb)T#5UxmtE@`!}jV2LO6J>PJA58qnPSvTacC* zv@NNhF~|pz#sUG?6)gNHqGA&(pFM$YtIez2OI8u#Ksp)tEhy+%c%HmE){Lpw?Dp`& zsUmaFoW=tFy9!f}M1xfM2M%Z(qB!uww+lft2XGexihOJ+cyB0hoFR8U(yN$dXhq3l zf6#u>!1noLdF4QQJOEF|sHO5GaMe;CfRB_bh97ibA+HJ*68mx(trs@)o9c+e%Ei)B zIW=h<#2#c8Kka_M>e!*LAIA<$POOE->sKyvs*z|WV|0JS0P(}h!@kUi<@3~1x!9@K zULH1P#8;sn9Nuei%SK-$x#gII@;N1-dE2-HKl)1?Cj`S!bA~@dnXE{n=Qpp&95Fgx z$N6}!PxdmtdJ`F6e0i)pN9AX3OjmW!6|5D{-(uoAfrZP^#)q~11`4Zb{X_7i&2Thm z4}T}YIla##MU9BD)uVel7sR&ZfX+^2qRa=P$iinr&@|ZLJV#Rp)HGL|M`Ufx*lgyK zs-p1gD-6h8F`x%FJ;UHYhKdQFY{B>8G{m<(gjKE}uAG+@FG5l-aWSTg<2=3YUWyHO@-!A$V!%kiY~^ zi(6>b1{Vg4wjrb3e4l4mf@j|3+@^NY1>6(D*&z&B&7~Sl) zs8YSAL$MLjgHw&|=4EbSm%X#ysPF~NK+?=rXOyc;uiJ~M3S>0&QC zEAxU{p#1434YcEllcOvvs0Up8UR-}Is4mFI0LX)DfDhQgS`0}kOikT7bvpT9IYA}2 zV}P}PPM=vxp=2Jk!vfK0k6k7#MR3&>j6-m??{r)s~%u2eN_~c{zj9N5tONkQ%iA^r;$3#R%b(8dYF^T zyG(v!6D4z9krd_NVPn?v5JS!%G3rx#LNl1}xDRG@lysKhgDHAacc`e&relD)#h7?bb7b8O~Q+?+a28-X+94|^*tvQK1Q3B3G%y;5a#bs zk)$x&sn1+9BO$@9jDJ9Fc4;v!`JLCi!Q8&fpx5DPs9W5tDQa92-tIx`$b;VxB+no? zc9{;HuC{Aq1N%lu4$k!{_SjVwJh+eg3b2jhMN>KHbLD;*>-8W@y0VbVa?Q#f-nWqPcN^^XHjsw zWz6nh%3_OLHuC-=xQ^w!c2Hw>{-({eWk0uDcizt0j0N0Di@@V?*)>Yyu_!#n;EOCf zrP!*{36}WGi{-eqATV)I(HNiT3S*<;?&Vs)qPvY6=(~}-HSw7owsxNV=N(KG&J{ug zQ`#H!Bl-_P$JNZkme>VrxI`wPp21SueAv&pIWX-}iwBtbWOJ&;bsm4@~z|;PIR9kLCv~*aQhy9`; z<$Df4wy5XDAp!mP3ALs_^{5?eQV-ETYghopmgZ^=Kxf>UtDHEEsI$UX)r~TJ!gEcN z@=}lE!IuzK#0PP}tbyekPxh1&rh-HQ%8+|tL_W*NV`qu!t{RDWsn_F)#i%I+L+tR9)g0w_j_}amy|uetw(&R} zyMa5lC2sDY+Vsh0z7M7Rp9a!19zC!nd` zY^!XiOIOc<;&l=dP(m&Av|E5#@RrcB8vW>CenL>blVi$0dXptsJzzM_In@=mkDzxZ z*SadwehU~w5>hUwFhZH6>1!n_Eo(Wb$BcP{uH*vtDf9~1;oz8)<4&_(G;DuBwkuM8 zeiNVuub@qECUXN7n{VsOl*qixhQeqBQ-e2Nz8iNLoAy9zTvQey1|_%;6Peph#od#o zvcxhaSqb7ga6lhuMI$?KEznh_{B?TN*?`N8{Fgy_)*vOkMlp$ztj zix2fs!d(T)LgvoIPr{VIkn3ljH*1v5PM_&$26a9yAMf*Z-;)#phB9jKQq*!?>jZK` zL%{ouVik3$9Z+nx)r6|j;Urkp(lAROSA5)Ply{P-G(_X?%NTYP2-X_X1bAYKaMWYZ zV@Ls22$JrnNT7V3Nz`|eiF9|8@r-v7kCKOroS8F>(LpURI37<+a^@rkfv6;v{*(qj zCTi%~2wVyc<}5u#JvGCXtgVpF3xv;up!>dPGH5q>1Rl7x{%w;Za2(MQe7cm86c#`8 z6Y@jpReW|%Di!5a3oyxb!bbu&AF#~l8E-80ADoSdL;+P8YFQ)p>pLd-9OtRD+u1QsYsb+51r5T0~91dF=y38uSjOdiUNqMELBhu z_o*N+35{oJG9>$#KRu<$7rBry7|y3D9GZ(GUYx7%*(k|Sz|SYQe8o(U#MAceBHy)Vc42> zgeqJ&k2B3s;#i2uH0_sp>Ku%IX=kcDqISmd+YTJwt(mu5)uwYn~Nf zw`_e($ZpL-8U8s|-W0HkNSrC+eZS5C--r{A1J$@k?6MVL|ARVII%&KK!X?5fTI#l^ zS8H4pv5MvpazLg|us?+UghDrqLUI#nN&`f?#rypp>#AHNOBk?lEgKwb*BBKWe!V?a zZawn{>c`u_^oeSwW}8nNk+{h+G*7>Z4mEx;QI_VWe|wQaD$=WkLcykWO(jq-ltyk^ zWfaz^MNKQ76)J`lLy&w7P#tXMgIG>DV=%~njzdQKg=85vH;lsm)%q3&KQ343jUpqY zN%jueuKhM5S;{`t79nQ^LOfoCSfnf_JgH?K4204OJNh_ZSoW^Qi#x$G3b~6Id$?w$ z4y2icP!#F=)GZJk{XO|#SS{BOF=SW|f;#w=OTA^xvSpU=mgk_+tj9KNDHl#GJY!yk zN(vS)u8&OG*pa?Y`g40g&&r=5`?ULe_!`#&&;k=C3}o<{_On)k8rLg zI8^|@W^wmFCW)9)P$=3X1*gEGIT=Y(J%ZrJF;hXtPB+v_s!IBIFqFtd!qs$5|IT>4 zIeHeTp|mP}W_TZ8B*tIppih3isMD}w0WJ0jptA#94Yzc7#kUh{yTR-req-K^2;{xp zn4FgO$X#RnbV6iLProB#=j1J>RkwKD5&^8GSz~3_$`e5GM2dn9j{h!Vx&QLlTQP}C;>O37shwe zy`}Q&GUl|KFy_e1v!=Ep9w;l)DE*e)PDC-;PDFz}DFxA#}T4`PuL z3vuHWh>M#_*MJm<`A9K786^P3E?Hk`OJMZ?6`B>-)J}lF8~mBk#X6@Qn8);LEZseg zXnj@8XvPlw`?`SS>g1iAJ`;fVj4Dv9fPHEr*F=54j~2=@02Xm@k4<(Fd-}e(PN5oW z3On1%nVMTq@j?Jd_q^glSVr0GzuC4t(`|LFBgI(N?Mx0WM5WJ&$Fb)nbZ<@n&gC zhO@V3sewdlUVH-FB1=*AD^$4zooAi4m2t9%7iO1}aJ6P89w^2+7@;L!eAHxXP`X~Ehf z^^!&}LiiNwhR#N&J_rI#T{npiU}Oc1#qFR{+W~~+)>VvtT7R`KZq_?mk{CY-f5;k? zW1HIOq8J90>kIB~QQyv@3eE;4*EdL_Yrt{!rXE{W6?C~=@DDgYsBIzvLZ3Y()dM2! z)JXUH{aYOh-Dcx%gjtsb^<0P0t=NRNTZ2(BfvT)JocHE4j^63y==(-Tc4ZPhTq4CbfCr8^;u>f&2pw!B-`5B$@qh7cFp-03n? zA}XbRL3oJrc%GE2kT*^suK89^W;%2 z5pxZBu0%;fhMX3`C!kHXyGA7>DCu-zZq=4dPC9C=*qnefiW;Vy{o1fv&)WuRN=?Gb zoN=N53I_0Yk5J&4B}%x>ueh+NcjJdHFuc|oN}k@Y)x;N1CQ4Wd=X4r%MM31r(uy!8`ypAvEq<7 zW}@aP;Tja~VWn6aijdsW`Ox!dze!#OWib?{!f9KOtn;cc$v9Pj{vGW7Gmrl?8{U<%}75IiuaI#ns_X06|{yR3L9+TK1T|LkO z$2xJ5W35MTbqrT*H5tfhU}M2Ex67K!-lsC>drS+JVRfoU_YKa|X_2Tjw%L14rK#Fz zv+OjS95gSau*M9dxb}_GwlxD)tD)O-Q$$c>O0JI~I3%XrkdFwB)*9y=XzEr7ZzY&B z_cQP-+_yO@8R!wbin=hk#ZAth<4RSCoaLZkyHFp-dOHZ6tw40JdScyr{DlK_omGX~ zbAJVR!PxQ2KFibws(VDaIyMbTU63~omn$~gs+%%9dcm!qt$=4lOS!A(j1Zq;VQ!JS z>_h7`HX`O2Q#=*u(Xo^H)fH|5A4D%!N98DC=Z~9JXC5j~7U(ypAG~^qLeD7jP$eA- z<6lRxpArH`@fV2HdC?y$hV;$T`GZSm&<$|_hC=7&`58SVGQ;IWfXd!@)Sb^spv!oe zKIsz);S zcfXH=Y^p8^jSTS@p^Gy921}y+`RNCsczF&wOJWs}GcEJw>H=w$FZ9o*GEG%i>6%$lsVI#Nx&W$L5R*3-H!#@>r?ri-fFVtkSIW!aD29(WRhJi6 zAv|?Kd)}5`+I(pkC!jV;tXRSz7?Ezo8Wo)-dOBLsWFtNuCe}!8$NcZH9#HaBMzTp7 z_|-q4I>vPNkzHADOA!o8F|_jGPT1<2g9N&MIuv?TOuBGG@+U6u5VN!+2?;=H7KJ3< zk*PS?Z}L~j2`NZ7XY&-O8W{35hxp7!bGn?Mey<;v{7=r;_jl zfUX)A+Q^k9OZHHZ^>t4gr6EXiPd5V9Dwi&*GFCxZ?0ADMCb_oVz=s`N7f5SWDB1>Z zDBto|qxp^GPqLs+-+`jS`gF6P8 zu6;udL$FaCIGT(r1%^s$q?h{CJk&)>ta7&#gKt!uCYtgSO!eS5mb-r=`n2tkb%ZW- zYY?Dhaedc7nm%UKj6HUSL7W37;cA5G^!?Z~;?%+$1!hO4Ge{g*A@1=Ri~~}I1&aBS zGo^4SW8Al!G2{&U#WHtMpE;i(hy?vCd2ihmM?Rmbi!TeC>{>tdpjVvdJuE$)bKq@U zQ)~eHSduvyJNC1Y1E2i79Yo&N_@kGmfwLfi)%GT^OBP!~@r7L}DkeHw$M*};1Uarg z=#WOnr$c6>8OK?S{gxG&NoisXHf?>a*N&%cRoN(*O4CedH5x)u6WYDFTXt8i_oteB zGxjio(TJ&cX*o7d< zaLLjBjJv=%!c^OJF;i*U%xWnNS)sOj#s}C_KJm;l9=}E}FTY(LfgW@29X~1ZPKP^> zaCf2aVcHPBSU0T?-AsFY5=M}APDtbn2ph*IJ=t-slyPp=!;$t^d4>Eo6nYAJ#g=H~ z2TgE-CEA;j6Z6u8VJWB_`i*IYjq$p>#Lybpof=EmQ4?gpV48QSLIp0x4Nc|~Z#Fj( zoj-y?e#{!Dw6jVX7h*1i%}fw;5t9s#a-Kwc83fS1_;^}3p@?M7>M@mIsM>%c+V-uX zLSje+Kn`a=raDu2INVIH1<1X{3E?dPS=!B%mNv>n;KdnOuDK$u&HA1pFtW*uFEjHX zA1g8YRSXvn56vi4rdC9h9vW;LILG08LwAyJ!! zj@e?&_iCw=dv=iS!Y+Sr4LX$An#(00bNi@Pg1TZhp_U}yJ4qCayY&gsKP{0VgQbUj ztlqfZWv$ln-f=A$w-=KR7^KnV%x8GglCqaKE&jW>SmzX+M*$L?M}+2_M~^eQH+~$c_L8p2-U2n<0I-`Bz__Apl=Yd97_kw71Rc-8bN3VyLc14yBLq+-95{J^M~1c}hDx9XO~ zU$Jnu6rilt^{twAP?b_-)i^zDRr>HQBNyd^e+vjj>n>u!BT@F)bkg6jGe%Q$Q6k~$3SA2+v!eWfKB zuJ~#y%?Wx@$ba9$6F>C0plo@G&W|jq5?v`+WxjWzgC-t#Oq-)b)|?eq9Rh?sRUgZb z<3_trw*5%$|0*^wTKGhp23Hl(+g68gt;~+q&&#&38g8l{qubAjVdDxEuLP`j-$KT< zQaxZ2Nx$eeDF|G++=OLjfV&x_3Y*qhRW~v|crN5k>?u4`q^RoFZJXnk%~Km`koy}_ z0c3A)kUpmy4jTgGWpx>q)hsH@zgfska$wrH=VDPakDFY?m zavZ2QNCj12EC1WbBC}J{xIy>i6m)nm(Z&cj<(wuYX;^M3t3B{kpc0m^frC4D>Ku+C zfHDqDivh!1O*>xnrHT>>DnuWLzyv&m6G^ku=XC`26>)&>D5*=LybO2lxOiTfrl~kC z!#*B0I=bCIH81Svp8OLKyO(s&wQCam@#co*?=%+)h6M9N{FMe2-4t45!q8tukxay@ z(>?gYUHrGfa{y_%)*GJ{6)wFy$?362PSikDK^wrP9=NCwOPNMaFlhzDSK0ojd?F`E z-5=|j5OEc>9^WB-uoU2f%P)elnkiuWEyTEIVBecveaVcoJ{V(WkvuV44DWJ$lL@m z5Dg}EJ#V^ONxE^~ApI5$C7h#63i4f0WP-Cig_G?0YGo4qqK$HO*&VJ51W{ngR3!~F zItk2PoShZ*`<1I?{A-(Ch-xB7dqt{(L#FSi#ml9Rx-gqb8Lva#6;WS& zjzEwivzFJrcuKaJ$<33U)6!px<(NuvpJ6&^T1BMk2si*dazzhtmh(Z1En&@IRslfv zhN^zLSb8at@q>W@kwL39=|2%DUV+UHMF1#(WMGF`06YTGH~ehq^I$m$k+! zu01}q#31<1`(W)06Lir&&p|H!2o9o^E-gb)R4RgB3{w^W0?;?MO^d0tgXdO;f_T!S ze=(5pKB}x>8{Zf1Cw)a&*;dYR`!q(Y z#9p{4GaS`zt^ku>)?wcMo0|jMGObAe7;H;7A@9m3Yh*boGHuGlm8%4mR)S>yaDvIC zuQ{k9xe6R)Q6{ZMiV+A>;Ck0HE3h%GE46~@V9WYqG=lKoY=S988Pr9Gk)0Zm%@&qV z8lKE&>bpV_P)WsO#_jPlEo!{KaMk5iUl;l*W?3}nfnOK^rpKoBjb$AukmQrk_uHM5 zkJn`LP0m0ppPk(C^N7&$$I(9<9A%_-<+%hf#MS>FQSThxNfT{>Mibk1 zCbn&BV%xSev2EL!n7`PzZQI7n{qDQ({ZZXj)m3Zts;=tOU1y)Yoo413-5SmjgPM6b z3B~I}*v*vV0yHE>)p-s5+ZJz!O$!ec@aR>#g40~Wssbu`S@3nUhxd^k3~a|3J%v@Wn+4!+BOfiJB&}{<`EZVik_HvD*_22rr=Cv#F2x$)2=lvM2t z@qLq*68&Uz8k*{nT|THQS;X7fW4TnK)iLndOz@gd42D@zzo3L28)^NJP=BjT=>F|4 zX2BxDaHw1d4RNFfSeb~;a9>-}rVZEcgXnS2D5B}o@v<=d`Hm`zt|MN?BHA{2W+-mk zNS&#d>_M!pa6;+(=kXNorp_^A4a36@0KILB;_i@B$!0Wd z&ak*`t~y`rBU~vctYP?kyO?xa_xFk^U8EoSr28YSx*67M#|9cgf_f#%=fm5_GRhyDbb6|ZtbNY&x z5`{e*pZ>f_72=swjdBLaEOGr;%?7l1KhktRV z!-+v+JuC2vOWlqMi8@sc*@4_jpm#q5ns) ze-yU!pvtA&$jT)}qv#J!z>c0CAstA^nEyP{la~U`8pz~Qf~c9gS#>jCd&QAkhkiq^ z=e_m>i1!fU>uf=Vs}6t7gdVMsFuenZNzL{KVlV6{ry7DPqO2J>`=mJwh|R9peE@<{l$Hs{gSx@8A_uE-)IjvIODMY8pO41q$d&Yxy2s9) z4+dR$_@^qT4ROq|n~;1F+OdGh^=9`yWz7*iu?Y;@(&Z@l)Jco$61@99j7z9xD zn@OzCNF!FZC@PjLT-fzR{_a-^hT@B`ey3#0oW8Am!O#{MM~}~sxB7E695JI8QlBPS z48ADKXGIUT(nXEJ<6~{$R{IL~ra8V5DI$kLqo??Bo%ko_sDM}Zso5_3FZ|o-3+lrFE4ikBEjPR_Yo5ZY zg^e_{#{lQO`XZp!GNmb(HcaxZFBzLzl38C1RXa@vfbJ&)tJXiUomSJbi#; zToq5F;9eb&v{mjF6|LdhP9C_&%L&N1KZA#PGfeD zG=hreh|``9Z?JWDpyo|RytMLw`c9;|b0c}sS6JMiz)|}cK5n&Bl1Z0;GpeP>vjm3J zhQDp{ke0N&&vH&fS{mTzuL6tC6wlb*STXY1+Xh&Y<%Qw?K{R9gJzl z<7Uj}7!SoX?%mBCF)au7R@5orH5cEjFwhUH{wC`{rR7-V7U`5fhohrCCE;4B<4)9i z?L4|B>=fZ!`Nl4(KFCmH-8|b+pm9xIsV-bE$}PK!V40tEjJw|r{QJxHL#b3WH93!A zctKKj#DpeMz~<3*9;ao#SK=S}Enm>4e=txe42u-X1aTDne;|{)z*0vZ)#A|*~ z_`mLr?D_bAeLM1QKp|8XzYfk=wO@=k2_7S>%27i%WGDtbuF`Bw$GPCbL?kyVLgMEB z=lRUa(s>--ApKz-ABqXQxGHgNq9qzYFCd;EK&h^)pc7jkvQO*LHB4)C+rR-gO-uf( zrvEFtoPm~E7Di1s`_yX)%;W9=O0zuov#4USl9uiaoa&Kt}?t?)>g<;s8ngA zr8&esY9Tahtk?Q>6&F1OW~J$u2(c40(hhI!i9I7bNRYL#?}scTC?C z9Q$6H3C(dJ3nG%;wLqOYXbM+CQ(_}FSxa6P<9{{gXptG)(b3LT!i`))6&G_Ej#2jVOKQY~(H0j1h-F zAPnydcXTY1_K^SCEP&StMf<^a^l4g(>G{9KBKP1tY(!v5HbUjkJ{{exb|D|Bx-hV- z^fvCdlrnYFZGcL(Crd86Zp^zd`>`wldp_PNFdYiq>7|_04%o-H4w2F{5V1u(jbqIBTY9~Gn1?&l1oTVJ0uq^*YMc`QA^3Kwjmq&e8#X0lK#7CG$^fZOq*Y( zKRz&gu!ye4!Z(t4A~ISqi=O~A3efU~sn^wWGl56C96|!8)Q73Zrx?=RD<=-R+-O!? zZdMU(DW}9n`#bx$`5#%EEZOV}kb(DHUl0nUZ-Aen_g;SlN|+FkqmVr#pVp-r`I}v5 zM2ugkuXA_`o({PzUU@ixTEND+09q+JUFD;S(I1@ z!{k@gB?)EQO?6pN=3%MVbcf3`E5J0^;3>$K5q@q=FL@$YaMVaBI1bxXD?1JZTDa5- zPd|qF&J}T46+-u#mh|Y7e3R$0s!6BwdFnw+%Jxc`&Fs+LCFc=gft7*U%_R8jJ;Q1e zQ6qiv&=u`@vMtA%=Mch89-+BB{(DF9S&6+BPv%1fh%RvHv`jzBB{slm--w|TZb_Td zt+gvxzpc6E%I?6De^HAHUJLb{oVx<=Do00sW=VajXDXhL`ZJ{g1@SPU{7Gx7gN!CS z(XKJ;S4ypMMY}_(TQ27D8ykAE?zl$1RY2oacyvm`3N*>4nH&Dw70P+d_83=tuj3QY z`9pW!Ar0cj#^3F_f?{dW5UI4n6Ict{qoEXVpL3xHa2AU9v%h+yEC@fdxnI~Uq=Cx5 zu(YrS3MGA_g;_ZB_6IC5Hn*mOZx~OrxgzX~|G@jVl1~8D{?>xtwTPk7GC-Ux(SgBx zJQl*V@l6OvQtc+;ycM};JQe_!HWz_Q6z`zQN}jUQYFzve<5YVbiFLp)_!S{;uWnXy zZg_iv6{StxTgYapMo=4nzOA&Kmq(XxjlUDO4ehkNrlmkm(y_VTqH*s-(eyq=7dOh4uf_{D<-;d2(yQ^6G znAq4DpRe7;XLdD=?wkGX9~6{Fr0=Ke19STeS;ENet=o6AiW_$uDuyTNITGCqbHVvQ z7@hY9(?x)Ma+pLt_5bsj$iHZy_(yXl&t%7d=Lme&j?Z%ja?+wTA{O-Frw z0v|?`sv?Ah-xxTYz##=MgKga5T!tZN4P-@l~Yb9+;F&sKle zf9mLfK;G{+sB-mejV%LP?nx9lf6atGbCjdztPtLdj+1fzIDoY!E8q4V4`1+;IhgYj ztSq!x@^AUvxP-_dNNp%%(BLb1UkSdc@(S$=bl$aJQ3 zi!Z5u;|vp|)0bHBO14QC>?A+jt1tdeIH`%wqH%@>%eR>w#Q&il*oFT0(c`Wvo!ZiR z*D1SySffFk35l6Gg_$4SAjN_3;|l(zfB+xEMm3@=QG^btCHVEv4zDjqtJj=hYJaCa zahRf9sR2uk3(#6@wX}H_5s9T5N|z~gPc>$8YWiG7Vqy1QtBVV#&53%;o-2y(53+q3 ze~w@vWCXmo7KVmaRjyYclR~C4d@>iACqu+Ht2)l?Y%x0}ji}T-ep!{C_rt}Ur$r8q zjpRYE{i_eF+sM#DFOgzC*W%MGW0NU9(QQmt=LZ7OD5_JTx#iH%sd2T1D7ZYlo$nPG z2)AkwUBCet_pnxWlmwYK4!ai3F&eb=No6FT!X9h?(TD+az8bsP_zfwCy&=HY27LCz z-oa3hDY&)EKxb1w3i2;Jw`d@iJ1dYsO8+6ANrYFj7l`*CxkqYYS1~~OU^;lhc9av8 zY-AMaa}!2-*_uW^QP~ubbI?v--$4&}m)CM^$${14{fdXVN^wrzkQ?MQ&F;qt>*-fD(Tw!-0wr+?Ssv_e6*>NJ_>-@ZbrnH9HFfm=+f6h! zmAy}hoQ~5WSFUAEIM}Jl3af>=R5fYTPqjm4(Oxg8JkVW72&58I7+WvV)aHMIlL(p! z)mDAy(spoZ1);G!OEkHiVw4rW<{hux~-@vn*GT z;ZG$yL?YrJcQN3aOpW9$fx8=1B1y?YB3bJLm7R1nWPP2k2%C$re~Hx=vCu-QPbLJd z{3o4iS={$>38YpWi$EL!HQ0NKH;~|O50#FTc8I#~R9A2UBQlb77v^2u zY2BI%7bsr7Cp068gpxkP%hE;Up)iAGa5HQ%mHf&N=<@U+(N@|f?u7p zeFbCMqlLEqMGJ)iz`|C-(^h|v#H{%-0DwLWOk@s&A5Ut-dS%Zlxz&9-Bwqv-<6;Eb zk1~$ykKI*infBQjhb)O=g(c6(Y+=Oh4E-91h1oW>7mf5j%U75 zj+4NEBvKA`{DonA5^ShGM<|EAh} zb8T447*@z@Q0D7(TxY;54z+9}i))Q*5$jZjK^fRw7NAjBR z>!J2$7vH`?8ajaQnhieR@o$ceZ}gC0LA+m5cH^pGK_(CdLDFxWWc2o|BQ74FE^9j9 z{{Yz=YE=#^A5HlgMj};1f@_r$@$JGsQ9_KO0TlU7(;fcuZWgSPkhhnTw2kO5hGb48 zhDyX|iD+6uo^{r%0#LJ&NQorE*{0DtkRqp>Yd$ISD2h18EEbZ=6z@Qg=7ED5$_$L) zD<)8FayA72h!}qxUF)RbwAAt5)&!hMR$byqUge~7yVzYXl<+hsx+l7xZ@VUBOF5#1 z1(9ke0)+w{E?Gadf5Sik5g?1=&p5Uv5|vQRrwj=5AWYr6Rgh~%o8gDob+MJPTEV6SuJEffNcsmpblR=C8Kr@vLIp;~*cx&JdXwm>MIVWj;@E zdaRCDC|jkNmPw%$qIfzBEw3Tz$et4y8(OwPwB~0Q`8h(?byC}l;pWzYfT}wYt+pb5 z5Ku%nvjim}4>P}>_&x2cHq_6+Z-*PB|G^u8g0t;8l<`DYLIHpX`afo944S|L-q5m3 zVyu&mGf3}{oRHyq+sX`|!m;WCX*C!U?s!rG_Y_N^K@XQ!g*6Qu6@`GvSAfx)4dqIs zCNh=v+3zc^XTg&h-|0{cYgu+}bU<+pna6Hd--6VR^vL{uP6WtY`|-{IAM zT)DW%Tl&E%6Wj0IpPwpAbK~g0Yuiy3Q5B52iQNj?lmqO_Gs&#z*;|v}Pe&6M^tI?) z+LuE*3-k)_8SDGMi?3xSfx->0U(GUeNRId4anRL-nhtYvuZ0*_cd%knOL^M+wjVQD zd^om%ZUvba-E*d1811rM^=87JowdN)-x;dLyqh*#vh9|6OzO>}cP%dByxzIZUXM*p@0 za8U2xTYEPn%zCXW%rXZ=th?@|xlCZ@Sf&)?4h8@>16#SMy0$vJiw2n18<##7Xz>1H z1I7r}?KYB*oKY29amJYAcdXNAq{H^d22 z63u3YUn;}co-5K9lj~YxAc24FHj&fyF7)X8hT=Y})eTQ8y~++E)Q7lLIo4P=Q+z&D za-oIOuKvPoYwwxk_qI%<;0o+6{aiar`e@PSv4H1tLktkeUm+_ibPaT|{_@#(+s@BP zfw2GIkRQ#D+AEI_ z(fmV!Am=xyjNx^@wDF?4&=#o2R>Tbe;yA%91A?%?IBUD=w3byl|9!FH^Hso2Xtaan zH2vF7W*}Hixze&IG!$ zEy4QaY#Hkr>cMh!5RD4W7*tirsq638?r#LXjGtdTn8`co!oKh|5~aIsDd<18qZ54m zfuAbprB#wV+pmo-9X1F0pHCy3m)>jgQ}^{)D^vhfF)zi8l2!cM$VI->R?pne*`vh( zi!-AvPGTPJ2cHu6I9-7w41-}7KdJ0WX)&jo@ zU>Z;7=qks|7hDbV=fl+EBlNE0!t(+ie}k>6002+8xWM?^#@v*1a|`9;>g}pawcf20 zVrMt0Qc9o#y-x;bMM~$uoKC5fcMv@RXKoXvt46fk5EyND{On4s6wr8f6%bDx*?S;w z3kE2nl%_lN56d#53rx3RWmSsQ3lp{++@)rKl-Zov2n$Xb&b{!HIIO}l50WU2j< z`VJ0mNTY1Ev^2!V)76j_@4@DYeGcUPy8OzNH+@iX9g$kHh2u)d@KwRzW?-U)`h|W0drP$jgROCU`28xKzF}q9 zE0BWgw_|(3zUOsa<>H8LnNp`6VJuW36Nby~OKMj_9Ft{pOVRFxalh~2GST-0N5mPM zZsp)U3#xX}%iPu!l(q<(K8-V_Lj^%3_c>{4cQhM#aSg*)0V-Bk2saf2EaT(v?Q5F5 zmM@xPp+3XYsYhyZMUDz!M}bnmR~=;1VJyoLjHBJBW4%uNBs*gTO?Nc-8XY^Ob0uAF z)~*3Hbx#8^o4JP&EniOE9Zu}H1Ch2ZH!8I=`L4L`cl8n3mw%5Zr$FIGd~?xZ-)CRl zRCrlhKEc?m1zc%3$BXtfkE(7g|9aJ*D}G`IS_t=>aSI!Hxtbz$!@#)9o&+@6WgIIE z9I=#A&WkyuN((KjiX0)jY;4-vsegr*r80H^bfiNoP=|g9Ydh(ZXb-wSDg- zg)Z{y%fhK0eU(+i^@%2-9x>gfO0~mgp~0v$dT8bx(6Xnl8pMPqCcQT?F!jhw3X$%p z(oR)E7EhQdBeizYn?yK}Jx4TuCU`T47?JN&+g=1oDk)#4W2dH_A#ZemJT#Qa!BGUI_?o|MIF~)0wR5Ef*?-FOZ`P8z?w)R^G`35zg9(w~PE9 zWU4GdU4xfeZ%U^HpA!PYtotwhuA^Y*!TKyw<%Snl{|o#E`N^KLBbXff&L$-MrH-!( zZhnweC0gb#vl$$*a`u~M4{%Eh>qkqPCZnEIc-sR0L^VcU;Bu1G@aP~(>uPdS(SRRmTuPPIi$)+Wd ztg*0@90rt9!f1jSJ@u=zaopIB;=)(vBY%l! zXXCtDQwxb&J~0Z3o}ogty}bAbqbe0-jvC2&v*^Vf` zGn=*vp~aS65EkIyMEe%~CRYYu^J~vuAO>T|VRh5g+3bUk_^K!HNu=*F-VM^Lt z0yXXZC%^(Ydd?Y+_bV*qt%LU z9a2N_OBnFb&0Ro#of648 zPV$?j;-5tx>E(D$e^Y#=bcTp%00SDlyNc=Rwf0b|qWULp@MgdeI^0lDf8oD)M>~8E z%^7SzsvesbnuJ(?EC_9pVH8pGj(p-Xwb_i_perKk;3dUeTvkOX2fXm)-5+*J)3|$I z?5ms!6YpIxv6S^3{ij(u4k3spOYJfz#m5P{gmG3;9-N4}b3akUK~S51*jKw4Qbq>1GN{W+wgkF#dlfp)cZVRFHj`0IK6wWLJ=p6l8E2%iySU!6uv&13_obGEbme zP%Z*%pBaTlQc8?#^^}`1DiS?P8pkS|9m;|Od3rtML1Ie6J5Plp?gViv9au``&n;;3^Wa8;zV`h#`G)Jg;Q$(13`?h zJTl#^rk(iI{LP4oo6SuOCTktrrlEb6G#3|mfKT9_wK1=+2>=aY4(q9Qs*|JtQ?X(f zS8ni{1M$spZ-W5>0lmDm;n~I!;7DsWxrIP_HGKrFKLG1h9Pp8Nh)j1ERKA-i_$!{% z;G4qS@G4X7`}U5E^Ycf0^A^lurvlEOWBXKvVaH?qUVht+kIMi;{}AfEn$jOOb4%c_ zV@rMq+hr9a=Tf-RkbA%<7NHBcT&#A2x$IyBAaNwQ>LQQUcn#(ErYsv^w(8iN(8TG@ zCvlhr*12o7M0SfWOeoa1^u5=9G$RO;8J;(Sd5}e`A7BpFhq$t0szhUeG}qX^?&_CD zEi}Ai`IN?1(}~>NSb`T^vr^3_x;69MHJs1m#L!|*A+_z_!SJWRV(57juLy@~zO4XQ zv`t^1?vI>6MG+RsFK|VhGslYN+IZB6VVaiWvH%lZ-$yhoR3}H@!8~aK8#&FxqBeJC zKPxXNtK5~`FGFLpLZK>?cnE1}7np!Z+4WvRU)d6W7JfIUaf$fO-}F_c@_2vexgu?~xBQnTEb_`1EE_XPV_bKVSHuTS zxJjLadbBV24A}e>-|Tuev)GdWMH{xZ4bi(Ri~BD`d^p_|_E_+m*_~kP!rt)~gsRz} zQZ*ZPhgjgU`3H^<~_|&(lHzzYIgUt8p7_O;NVLyDNoUFL{a5;K`FMWFEThnJfeA*8&3L zr7ADB_WDQ*!@8|+70GtU0*??hxmwfME~q8JD>}vg&R{8FAJG#As*qqDOGrNn2`J;J z#EEgxV@FF#f?dBAH4(UZ%WV&~GzVKiW#55TPt^XCv$^92Bh(%>I%~L5BdGW7D872g zS!m~y%mKW3pN2D%C!+HGWbYy*_jDNA`e;^222wo;WK(DQptaGiAl}`g2VBbT$IUsJ zB<5r=oKqeQ3CyJdmob^dSKH~4$CZ5|8`evyCw1%USY%j7^v$T6XIh^ zfjg%e2&U;%^to)*lI#S;1MlKVcr!2!Y~MwRjWNiR!!t+i6yFI@Q?4=c0|~>j(sb+P z29b!x1e1w@*jNn*Irek4`_*@QR3D5WS))EJ;>-IL|ctzm?PoshUF@-T(ycr#d z4iOmL2rsOnuMXtUf(D9&|B*y~o`A&T2OXoci_ST}Xfw4)!KENxWzlFOXp_f~BMP=( z6Vsrj5F9bI3Zdx@(;PO95tQ+HN*T}nlvUtU30`(5vCs|EEcO@eO?-OPROhaE6`XLq zxlR2upwe+qw_^`#(fXHjFHK^0OyiA?3c40XEouk~gbj;~z(4Brku}X@VY;rCxaK0ENZv4c5G=k7N;dvo z|6qZp-yKUG;PNexh#Te#`k(EnDoPAlgL;Om|;i0@MQ5tiIf94&$l0s}-EDu(LO zLoQPHMFbf~S|w=S+Wv5rYU9$R#l$;K6zDuWSl76z9XbTFK9f{F(}jkaxfQzNbeWjR zz^E#ZcW6993-w=*Rd4uJ@AGv%CEN7*J@)Luf_;`x@dVO#12r$&RmL-z#dK3v035H< z9nn|4NSG*a{szGNgC7kfCx?+6D*#OZID2L_rA(f}11T~m0 zx0$^Z$LSQJDpb>Bu_EUSidVwEK7^YwijQrl0b&9s;zXUzK9s`CZ~Se=VPq>OHU6RTr!snkq-1s z9{&NM;X~E$cQI6{q{4m|F;ZC3UmSE%%&tZz-I$C{c|nybi(4Jpt?-ypCHm!=b_1%1 zzWAjJO3(hK+5)h6N}^6NUDU!>jTZ6GP)6d*5x5_Dp`@8Rt1cJTa%O4dKSz+(fUJ46 z-iKo%OEvmPsyCDcyN_Rf|};kaXoG=HH`;2l?RhYT;Ricvm8#LzVK8YDT6UKR?s#J z9E$*ukJfMYE)c0x4& z@;R%pgh0g4Fhtdlyt9!{^Jfj|>i7G1J29n0Xdz^tLbf9%;??jM2RGwq!bslVRMULf zun&bhjzywcPTsb9c5!-9;!5fneQIUgv|i8!9f8evBB3}^H@$XS6*g8v0TN_3rQm$0 zMliU%syuJhWOwf*

PAQxASY3Kg)K&#pj@c0nfVdewwr@nWE5YcwYP=rj!Uu@Yl;y;2Dy9%xEXLQxvFk-t?koW;UUp$N@{ew1}?vEHs)to0CCoVV^q;^0G(8yQUafD{gyqV?s=q+>?}g6f#NY8uvSqd$RC#jUu^d3A+j?tQJTF`K*eIvxAenzT&v6Cm zcRP{VkVJrZN{c-j2!dtOWwX!R=vOQIVB=p^h)S)SGvZrods6~XHDp-1GZ#R}5b;}S z-OW$YkCsJcYT;1Y@+9lYtouoHrmmS%DR;vx{L(L8RsP(Z!w(B=I&*_`Zr(Knw$-sY zJ6I2!OWruGq}y%p`muskpXkuGN+9>h0k!P;w19qugPG2AKm0@JauBOZU4N6Nx2?HJ zBMO=8oG>Of2iGEGxx`$Whne*+SudVGz-G4 zsV@dIVeWtWGsrL#CkFrTuyZT_U&g%9n|;jfk(^KU^-Arzc9$D7DY4V)LCnMVPd`4F z{sJ`<7C#XsL!yJYT%L=kh-1b`*ctu>VZSIWXY7rD()oURoUc^x?>KrBbp&_Aytjzg z*K)4&2{kMy=;5qB#?l+3NlNYZxu-6cnO@X>>{O?CM~rDG7N`tOeEtvK&HQk-{dZwef833Uv#Az zJ2fI@RTB69@&q)PR{#cD2u@=U)opCRp%yVaP0fSFv{ZoT7=QoAi2Z2*vW}P``e~*2;>70IrZr zUT-{49n%I-Kgp_2Gxm$dJUFKxgT)GMu6`(~JncB^0=}ecY3auA*Bl4O8L&mTj8M3w zKneD!jCZjyL3GJ^?B+>5FQU*@%F!z(u0RZk!nv45$C;v+!?QYVcs`ML^tO;kN5svP zF8o@3{Fe2p2#?tCD{Ct+({6O;Ey6x|hR^ujBmTRGjKF@FayWWb3|n|oVcCEKN|U3I zNw_dKJz+wfl?7N)m+k92zs*|u{52x=SIXk_UB~a`FkX9xZ@n^WA&=@P?1PC9R;jH3 zRWA!dhk5Smu+>>~Vr5D$`xE%MUsCj%#P$%-kMayv5PT2HPMi)BkyM39++AyygNitryW7b1C&lvk zLX}pIHdxPaCjFp{;~W;$biV>YUn*q zPNU!3w0|IK6ik-GLW}6QaeYHkne}9(HfRJXOX=kK?Eb#~*Z4V0TJGZ5C={g{_H-4c z3b~OfPAy`EQ-xTFX4oin(KriTH!nslBJfjFW%FONS!f4k>VX-SxVEpKD378)7=hw> z6~88QH}ws^T~^SM1eymeXN@8ul@B_z^O2^NG>I);qk-DIp7K{`C*X^rjIQxqB1M1} zdDnlvt?rzABd)`D=QNJ*e^ZI9uR|#~_NJ=XOfy+B|1Ra5DB&k8vt)vZivY*Ue{C#M z`L&%#Oi;Nb&}acRpHx?PQafCs!tE@Czf5B{0i;H1D*YpMUPkOeB(fq(6C9h{$R1Or zb|_cBSYg1{2UfP$wk-5RniZwYaRNnYZLb5QbN>&)<>3OT;K7~q2@4S7q;oDLQ5#=X zD4Zz57ox4vdrYaEmJN3cOjwY> zMZ_-K+sRy~@X8{I8s1cEw2_&~!0Q`8a10 z*U-Z*qf9(f&eb2LDYw}ZZYxJ99CwMdsyRpkw)z(snh4#XTA7?9zI*BF>e~g?eLnV`zU+SGb@8E?~KH~az|J{{xT9nK@%?; z!(LvCbKLO@WX>EyB#wj3^$D|w7?SQRxd#V7Dg1y!XU6p5tcW}FsH`~{oClly@1aP} zk$W*uo-`8NzWgVz0Ab7%3-5|lhZ!mULbuyhp2+D76%jAgs#t~*s`X=8n$JN0tCCVr zqtw8?6aCwKBBpIlQL5ew&2|tDnU9KWAg{sud;troC)(v8vYM%tBQj%fW7|DtC$O z!Y_4A?==#xnC6A(I(!*x*s6JRP`tv;+Xh;Nx|P=xQA8|RCsCZy#fcAiTMI)CGAB{|WA;<bF=d;7QuR;bwHYvnKAR4kWie#gCBS3M5Q{4LX)<8$xd%$(cpIk8LyQrtS!ea% z^Db1iUN1v4`k5cgBQctFr9V@ETRuwDL7H8>%6%ci_lG9?e>;o}{$F1LBtYvkdE*RI za`22B&Gt>0j!69Lxh`LA;BAbok{kqZpXdY$Lk3SZmOd=bCZ>;@z4ih!AvT3F53r}D zEgNK4pc?)bkn08vC5o8nxm}iD-(8?gBjZF(c3rh+6pcFZ;F#zdrz;al>fsOMh@k+4 zLplCf=ENAL5EN0NR=miu->}t;h+*c;UO6#HVIIQ4{cLOsD@SA$_svMJS)Xp?b|>jk zn}Yj^oBXqH5#Rr@@X2)tPD>+B+;VWG!(0z+9hN-+J`;-Pg*$6E>ZmeDtBx@)G16N_ z{dJC(7=>$FD5@OI#nLHb4vqV?4ne02z{FGWC*%jmt~cCJuWjpYo${oW;nXG(<=1Y^ ziSm~&QeLjR)BSn=axn9p88LA6Jqo%(4_YNSuiZ8$i=uBJwHx9biVctb?_gU*mge|&hdKDZao0hzY6_u*#g<3ts_1ggorsUKfaeV=ii&ur$ z@84euj2M3PGjmi0>A9hA%H>rv51&?HdY46Sdx>jC^gKnaEIJL#X?U_A=F?Cf3g0g5 zhgS3K=*#G9!8#3a^D=48?CnuG7+0bBE}$KSI_-F6(vVcE+*7ev!rA zvP+s~XOFKQ#VZr7Jh3K4Q>-coXIU^#nKDKdr;V;((^Wl8(Z(5yNb=>}8uN};Ip4iH z7fPC65s{SH6|B+;iC0|)13C|)vF&;~1i~w$E~C6Ok63`@HPN#61*9EkhP|t*`6=&_ z$IH+5?&=bOCv=?j+MY`{E2(gjVRs@3okj1d;T5@VF7N=Y+{1vX_G zmJe^5)?LN2cA4gQAP)Q|Dy4q0x`q&#d#FSJHdV4h@i!eQlF<8%RO_L?K5IsAXMpBwi_Z}h(0@S*iwPfVLSscCY zM4KHZ``OO^n+KgjGB>vP)6~+C#@Gj;5tlWTY^_)u2STk*#(RIl;M=c|plh&@tBb|jx)4n>8MxbgxVvmayC370 zvrr@Grt6|}0YkV!L@1^xLNkA+Z40Yr7JD4avz~{Rl*Iy_X+fD~XR40K z6;5c!DH95dx!<+cd6#JMMzv>uhl75>nl`yBJ=NEgsVlwEVmU{FLeLMkLz#+>?ywf+9_v5c=xC~ zF7EJiaQtfn2Dg1P_z_}#(ZPSu0=w%s-sAF3=siO|>+3`6qplj~e6CXwquz(Or(E)s z7*x6ueB73i6p^)tV5Xp|uMzG=Y*Ieag7Qs1zC^<+HK%NmK981}L=Q!z%V#vo&ei@6 zZ+#Lx`%PU_(ypTZ@z1+fyK0?$w5phBbgcXE6nN2sB#{`7`uy00q0&4uTA^j3LE49L z+a3)aOMdW)_6>5C4NfG^(uo%0Q~!R)W~fEcY++%qTd}!ZJ%~(2Lb@9O5!;wmu1}qb$pW#hBj>cFSE2bp?Ch%pHDfKkU zuWlRrj-6$2q@^=Gq{+l0twV8ldwas)_W!x#%#LyUuMfb7G_OTRQLXf?|Dtp{> zH6Tl)Gi0W#OVI$BWKwYBQQA>7sRR%rVCEOt*g{L(1M)jRD2m2pi3!RKp=wFY=UFZw zlMb`A1YsvNT75!ffH1sCe-W2HYEGhh5PWNf9f6e28Yr~We0}@I3XCXi@;uA1Ngb^9 zQJMtk;QA?t5Ae@=@9#Jo@k~+=%1q~nfiJ&8C+Y%M*04$U` z@k7x`Bz?B9qk;*`iou2*?ckhp!59^|BA_dXZViC`{zEN7@7v*3wH_B zcN69dTzHL}*)pc$DSxSFsMeYU4?u-`Sqhte^uO1!iy z({RKt(i&hqNfcSNymj}~N4&b^($pHqbW1Rrkn)@_QG{Bj;8EUfnb_SNaQr+(qky46sg_U#S>@)O!mNU zjgLtIN48%P#Od#rFxu4LD&5|v)5O}IO^e$uLW!cpg%G09`5ydIxUi~Y5Xhq}(mTpL zyE94OSt;BWmSvUq{K|U05TEs;Y5K!k4dy^eJ&#`Ki?s}Sj!;=FBUeQTBZSNL-=I_~ z7y2#qm-G0!lSm{`81{KOZ|Z)N$uK6>twUn<>szDcq(_{27(sa`uM~#c{1S_)iiz`y z_lXU>{o05LYYF5NOnkYnT5{og7Ae*S=yH2dyF_1@7%5p8ebeFNotcPa;Zx-ha@226yn1FJ1ks37ehoSzS_Ka5?ni82 zf1&Q(8ogQ~lcBDT?p)vA2l#uY2XAe7d_Oj$SH+`Kr`xtBp00 zH8fkK`Y*B*5J39$$hL{WP<>vcvDO|uMad}4{ahRnJe~elw=s(;ARut+#0h$C6oeD}07d8swzX(Vln#EVX=F{_0kkhqb)Zl0 zzqF+K=^=17{&JcD1Dv)niE+f7?Cl=JSx{%!Z~$ORXSgztKVkF&I{?wC-=_HL(1qt_ z{3cTYSokP6hz4BssuS1*-~-}mIbXNeZ9oNC6|A5gP)|AUhV)KYxmn6egC^Y=Udi)e z@ll7`LtspLMz0hj0adMke99-^KL;rEWf)OOl3KwHtR z7F)*g_6m7jILSVfDk-hxMlFc)jv1v-mcTjb0C`Y9#(PnN9|G$BC}|5j$Z6ceX#%}0 zhnEAsY+0a?^=OG;Q@GH}+!-PIDu0%jr7cv`ho>#nb?pQnds8@c{RE#&@mc&C5o=TU z6YpC`Ye(#P<^!*i-%}2$NWYgr%*FNP>l)i%1qALlJ7a=KXjR6w7?oN;P%q!rs;gF zGu&2-5RGAc`MBNu;5H?|CCUY#ZrW9FBztC_y6onL!?AT-ZqTjR;x7d=Tw6$Ss6DP$ zJCIbZJ4@ADocWjhKYycI!L{OM@_+bbF*hYc?GLiaUf|HVX%?CeP&+cb7CY5dC@zCP zh0GBa(!#)KVe4~J%Bf%0gRD3i!BXFtAB7%k%n(aJ`@Kz%t)k#8facRjSX^fAhD{tZ2M6#t==- zjTn??bDF4dkJerwEodLb(opbzkOHUoV2{!e^Rh|TQe~(?r`?1p8V%SaYhMOaL`|!e z5d&t&2FgXi-1Iy1*t6_@!)dFAdU4>EXi-j{EpNt|d`;=qr(dD*a68e~E(xzwe9^S; zqC;&p>NF#QKT}UHtqKPklolIX8vN5Zn5|~$;ZMlP0Ktf3|XlM|C9RKbC1>%pM zE@XmLIBOIkJlXeow3)uo2k(rr7mWb3h_@g9Ck6dH`o!Un8sa%$WvbG|)EiL=QU?DX z{3Arnpr|Y!F{S8t-#}0!#&|QeHpf`jW}0|osc`9VQ?f#tre8Vw(VA%<;Ky^x*{VXC z$x@yfgr~O48;+IFvubYbHq)e*L}^{L)6_R=Gi))f?y8k1&>6X8G-m zifByfzAL%k&P41gtwmgqCXGy~$^fSP(r-l5?@n3}sGwlnJae4AHBR*Got-p%UXIN! z#~{02pQ`j6Ts1yVtzEjR6?4E<_B;`AQ?6MRPLqOzA0Udmqo*~vv|LE>8X0RywHof< zd#KKQX#lFTfpM{o#;9B_FCwVvNSo$9VB@{Gj!kTy11(7sNQLfir8VKHV~#u_ZohnO zHgMUfDu>IlbFGy!&%KG**hjiTro7>Pvq{CVH?0;!A7}^(R6=(8c{DSE_TV;doEK9W z##im$2#>fRLysCaBpZ24E$)))f4@hRJjy(NJj&g=lfGrhurakQJ`ZngVlzp^rmX_DO{2 z0nr(xx6mGc=NZ_+k~PXEWp}L2wMXI((`nc=$9nl`?fx*&Q*1O-Z*QGE4_EE)KuiGM z}7bEK?f@oVGp6Owf#y0eH;2`q8mo>|IdI2zaw(Gqi z?_CsYw+6m$8lEuhJOjF?Mp1BM!kC-s5bna*YJ&>(N$x3rY*6M^X`{mcA8QGtkSc;s ztAlJC9F?xMHwCt(V8FCNvJ@?G7?syyAWSV{2;JFc7li2$xS2=BJGSdK|NO!>9fE}e*fNPQWRf4#)(4E&2K4lk3m}n&EDc9bGTiy`2$U~o10tK2;G0Q#yCTb}>hi5E7$ z72fP01EfXJ9~gz5^ic7ufs`0woCsVBK+BPY&5`<2Vq#6EZEiAO7Y`wFzG>Ose=QVD zocVseoSh*szl`)`dAmGC{5e=?XjoXd>G8N90u+}K_j#Il&X@Rpsn?U~GgIv=g3QVN zeu*M-l5K5a4vnNYu)gg74R%N3%rkb!oC-#(g0sFJygzc!1PRjm#V;Ndio2H1#c1=W zXF})N@b2lUZ9!?=ds}KbD`1`P*%eNmb^Q6KsPTA{DI*nr&ho%pn=Pt|137BEP-!#k z(Olk16NkWA6t2E6T40F=aMS8up^SIw_fzW`1>DaS{-x3HROo1&D;rXjES@_?zwE9n zI*tou9p&kY7k$J@KH9ZD)&#9-G>9jy0yRomvA{%Tu5d ztt-CTu;qllNLCNzj%~teP}Y4V-MGsQJ!YVkG#n9R5XIbCIx}Yv<7`z-HmdgmN>>h- zurh(mC0?U_x*lT8jAhW;I#d5RJwJEk&{c15ZpLesrJ3Zb^a(bgEb48FLQPRE$@32*y7c?r4tjqdyzoq$n1<|rpkgZdjHPER zcYCOFUdEUlBw=>g$Ob)u$G??#>_;^$gAF*fv6wy5t;J<6vEav3xgm|vz-M)pi2Tug zQ?sF_KxFdubiMcO_Y~Z0_Q99oV+mcjyal4ZohChu22_ISopXE|_oQbzKGh*iCs0Hq zjUP{)8s+IV+wkfR_7rp!gGI{Yl!>>IG3|G+Cd_FDB2YBTl}az=#SbCqbhN?yH4?P> z<9ONEsIjP*lsbo)5k-+3YpoMYK+ORQNxuIl^F@Ig&U0`*;kPfv{c*YH%^n=V%{RdM zneuy)a+&GzCucz&YANb&y5qm`o>L^#0l_eFSEYW zJbWC4;A?0H3{K?~7ZcY>m?ZgB?0b>mGXOZR~jkbP`FPO<6G?$3N#t+YqoV8`?@ zYwphPKRxV2*y#s@-iT7b_MM)2X_@3}-fGHK??$ zkKweFvM3-E=b+?7EaeX)m+)uQU?|qOCK(w+4)7gG(sC36iyj*G!mw~?0A7OAm=c|D z>)PJua;z&guiOtY^_q4j_2WMEUb!iOceRd{FI4f6h-N5FJ-3$8o7j?fy3g$f*m&)4DU=4l0 zYgY0)jU-a5{DXRvGk0)*Vuv~bQF~&S9mKl=rs~L--eAKO1b2VJi%XO*ZrAT?Q~@ zTp*qL{{DbIvC$Rx^e#3g2MRVDaRQ-a(T#DxwM6arO2UV@7&ISzKGlMF_7P~Z$QaK` zupjvZ9Y(DF5{{JwKwgtZa14A@=%P$h$89WBUw-dnNVnHIcFEX?*Jp0-3Aj^MYv9US zWH%_#U*fSW5S?bv?e{kpZb5K1&qH=1eo)3IO!-iLB1S1$mvoqbB`j2goZ28LG=e1?8^uTr=jHU%gBzwpSGV{f5X#4f!pu2u#?6%r6H3U(y8i? zWX5KavLy{=-9c1v=IEyhR|R~LycoO)n51;TEORG<|L9b#ZPZSuzT3Cz@uJY*(Yw%e zH+WaOCb0_g*(GvW!!{L?H~uV4az?N0gk2Nosdh|RIfM`#KNCR8QPsk2a#s+Ufcu(; z-rXMOvPqeVOR%zdnZC|0vID(jU-(0bBr)5^p^K7JJ)_Z2^fZ4tFp+8pd_nEw>Z3Jv5lKTi8-D5Fr!ss z98-`14N`~9Iu$;l6c>pGEWWaeZP(D^iF|k&o*`pj=ex2g zgrM&FA~qZB00{nhA#;7Q(D5pd#XeC*k>9{K?aB691Gp_4#f(hkZj7z7^cY;^EoTk> z@#vGd3syhJ8V!MS##q_Y@n~K%=*|@XTEO1d2=j+&l#CLyYOu;yZ-e6nnonGZZL2s+ zl`zCm7Pb<9+7uclWR7?@?}|0*vqm9f*D;*q+*TnH$`Q0O!r~F<^+z}C5UK62$F;~< z9BtABDkvkvX|b&A7|JEnb1M~xSSJI+i)FQf>BCe%H{{a`LTBF@0aGZS@6WAkF1nYN zk05&~Hv*YAwhv|t-vhfpT{^|Q`3QNo*r;C3x9i0=q&q3;r;x!hahmW| z7|5CoX}0i(n8;fyK@JE$$qsvd{Z6cV!%wOFp1lo{Cy1*dA__HBQPlE1K9!!(OtYif zl%=E$iN3u?t_2sSc^`eLxHD2VQgwG0o$M+7AidD5sX2Srw%(6M*h^XjuzIb65jHtS zJf%c@F>4M-h^ZXgI+~~JZ_2VQn{*w~%b*$Bfbq(SRdEoxWIue)VdR`y$2F~vchU+uJO=UE*>WD>i9hYnspsSosbp$YbaYG#sVgV39%m2ONfaUFt9=ee4?-5)}K#ux< zg8#|(WjFG7;s8LZg>^o+Ad5`1`I?! z5L{L_6?I5gqi>k zem73u5R!5(Nad&Y&tdbN1!XZea+EFfL@eVbHKEz)VaFP4NcotBm}}hKnew4uLG%lL;1 zs*N=gL4xL%GdJUq9FJRMS_+juRid+n=pn4)d#99k3E0eBf;^@y?G{$VZfNkA#>yZ_ zo|g0cNbtayl^J(Rvj2z^yE0x?^tYJ|(???Vhex|2f1!YAby?^!_%Vl;@%-ilj|JCT zr9_KqT{Bpm@Gi%7rW%(ZW06$YY*rNcmg-oAWew^FakU1eed#Zq$zsGjhV#ciytb`O zWK(!8eH)$AOsf76Q5H%t3?(8~tja=yGI=9iQ}ycZ;LKETr>*b26A`IO&`_9)RWBY5 zl!wdYV21wBJ-u-q>$4BJO2Mr~nT4XPW&hxKB~ER1*5SItaNeriALGuqgMoa?-OLed zM_sK63nI0KM- z#_hbBw|u=`PyW<~M2=>Dj7Wt_tD#J6`*h0SSRgbZ3oHw)V*GUo|5^J_|U z14_yX2_0+J8FSX9X%*3V0;_F>9c0H!sC8_ZH*R6tf6h()?#Nwopkcj>_H2l zVT48EOI&teMj>b|UI^wJ#L5dwL%eT7>iw`tPSW7v^lk(ZFdq{b%cSjn69B;pa$~xb zdIO73{;eAG1~$IC!$xWR?S-_AX>Po3qhoH8;1(isjb>EP4{p^mQrjspp^(I=ZGT*w zXQw~fZ$7qkPwjZ^03O9|C}&v}?YEJLx{Cg_k)C=Yud&}ee!tu?lS@p$js8S*6J!

BO`P_;e7in=$IjL zO;ji1$jNKuqNk-UNe-C`sEzw7vf5Tj*v&}P@qvj&ab-_ZI@yESVEc@|n2}2STdQaGH!=wroz)*dZVC$Jy&SFa(TEI^ z>-)ti_1h;Oska?vUFy#(hIXX9Axeaq->X)>w)UGj6->Idd1HIi#Av`pddRc`-ZxQN zzkNS;k0eR`oNHJQb-vcxQ!kam{F7(PQZSEW;iT5$%K8FdayI5BcDxkwnablAt7h3m zqn8x=W;_HsA*jw=W4U-m3RB*@=M;Orbd}XKfUij%$zWH!Ll)xn<6{aryhvsE0XtD& z%71ebD(V3DgGILbLiD9&HG3EJcEK=M_eR4edw2T`uPq~&NUF8z_ez+GAA@{IZ3MWG z@4z|?Ql!L_u%An%@N}Xy8``Rq%~wU#3MXpqY4ZI|9UsE9w~Y_?7*n33W4_BtRwpwr zoqj_K{Q(a6^=nHg*EBjvjsIeEwGB+twE1-!UL<&v3F1VTl|gHJSHtCyODoNft!ARn zV6O>XF5i%qS^M^BSqoV;y{_lFZ=67BHlf9#oga+kvW)5C7uRK%91c(R$Wj-udgHiG zSCqAbBI6-M7mhf~vgXtnPBpb)a2eut8P8343uH|(i3m@0b~MT@f9l)|m~C$C-3rHn z<2txDOcW`m?q=M#!_;i^x(wtt{8kd)0(R`XTm(YN6OPr6?VkGwbT!fv60|5+$E?*} zC^(JA>|IR4rzNzwO;dq~kRh|1KDwI~uJOJB#JkyOxP=hPT3xY#iOw&6O>3fv6v`~O z#wvP2Ftx>_5l)V(kmO=l5Y1R6h_2tP7zhxqPRz&$9ye{^Zk>;p_67$}lXwCc^&Ep~ zxSb*8W!>5zEjkFbGG^$%t7HOrA>ANMDQgnT0b+``mI8~nHj|`yf>{wPk)@XO-XAX# z`Lt!R)_O`Yd7%(EOjPE4B|0K`W~G3b1~Mh!o%!Tp{m=QXZP`H6eAUR_5isuJO&jon zJK2H9mv){yA8i9FLVPiN_e4ncptVA!s&-|j9~g!Z+2hV%i9eYtpF!{L=|mx6Sml0p5~0>1ynAyr#{%N*%+U zY}|LTh08Y4bVN>!e9fl`4|y!o^rEy$i|#4}QyBypkYK_z8v`;UvqeX&fvnk0*xJ*K z>-1gP_q}!-b`ZcS$jcfbUMf44W<#r=--C)^o-x0YiNNl1P~94wBKS&D8fM55?o+mK zndA#;?vM3b9<5M3OX`$3k7pG@BxZ{c3tP8B-nyea8T7gO&Up##Nuo?;xqFpR4+n?1n()PZuL(Rq z!;WeFPsWw0ql^k$anmGs`IxRJP73C`tL~>fr-mZ7ZEE#+rDX0?Jpdx&)^oxh$q* z`OjUIT8rLu05QayP*Sa-k`3A*Yq)m3hdYs7|I2D=$!@iq%CPZCYL` zg}`$aT~A6+T)BQhr2JqnI;v?+ou|w-brDz32mS`ky2EG11}ICaHb@Jz3hZ3^Q&EUr z%^nn;yivTUsxIkbCo}>*k0cOT@DkCOF_BwG`ey#Rq=A>kHzqwv$~D`nCTa zV3@mA>N~_);l_jxynU=}`R8U)R=|V9Q(TABM|7CXH#5q|PBv#3hz5AP!iP&i^%cW= zT2_CpWM;6tggBTDukmY$u3?$o?35X#AXbX}qvqg%SvI-|8Gi>>;h_GB9NX$@yBj;c zo;DxX2L^B!O`UsLm^Nm_!3r(XiM8MfA<_-x#71XN;?V1n9;kwCYbn%K)&5bU62cU9 z-)3U_AIh^T!MSUsbl=-&5sl-791k>wr+XDd%{KhO%t5DwQ}mgyLBYPG_-OObm|%Mu z-&A5>%RJb4{uv}B+7+_4#0Wy+rA~z)-YHHK1DXrT_tzBv!b$fYYQDk5#xonSi>n>o zl;pJBv5F<7ZykTt)HnLeVs#$leFStuGLLx3A~p6Kh+j5k{#NMKcXDj%>xh&<(8l zAU~^-+;9KoF9&A~nsZt4!d76WEl=P~vu=|eW(1*3U8`K&afW3W_z`VrzT{M&1 ze_r@nGHyOdc6f3pOwm%)&CmIIp|;}tM~|GG|0|N06%DS{QQ*}Ixqcdp(8zQZKADc^ zu&^(JB0gyLwpB_jtEy<8{r+x7dYIjjC$yXKJ{w!ZtyajsVn){ z0l_a?IfPPKx+6xB&3mR)mByjrQZ2~B@^UysFMxa_ox@29^p9F+gLP-+MMa<*nxQnJ&N`E?SLll{dI z;QO($W@gs&!q3Oc&CUDyRl%;eIaA|%Xx8IJAO6ty^*C|%eEB9$64%f$!v}SGh@^jR zbFakqarpXe?f;p%RUR!9-`|GLgpU4PtvUq3))@CNU|4j(0RNp}LZ_5N2^Z{DnsaTz z$6%Z$wjuU^LO1jaGIObzTjee-GP&1Ri0p$e~bK`v)Tth#NMKT`A+p4OsgLi7>dIL z8%<7Z#!=OxBQ?%bufbyFU^3*M)ZO|i+Yc0*xD~6Vb(3v^ZOM*66i=b_;k}`k06D)* ze0%$GY&^m9JkQ~fSV6yh$Iiy1dVH7(!h|0?SYR}bv*VlmkhfnflIokKlSWe94{A$R zrT(#c!Z|zZQsaPpf7l5&$cOZt z$p=b;t=VZPRn3{345pqfB{d)AaI|k7!cCfYs@+I=vWQW?3;2k&U0$U)pa;H((O5gD zRtMgJ1ezVb@vd~s`f10fG>^hHRLTfOt=zK~gz1J{!Zs)hg_qGb0BV;P{BoViy_9=o z8^u6WJ?2xFX8m}Ck+#sNSCe`D^7#@iXr-xjsAB#uIUhrLlQ9tEMyDH6!zA@&1t3qI zl{QmE4Tm@Ne(}~$an@tRfG1wNE(UryD9&Br<4-9uqhxB1)5v^F;`ZnuyUF$UU|qtX zc_vb;l{3@*^bJA6ZpDW0-Y!zpOcMmSk7hiJo@V{iKR_&a$`M#cA5CH8R+V84Ld+w! z!Q`>_WynE3MhmCljYlpGDUhzqx7ZjoDF}w(cD$|oZiyfGH-UcC!uM^73yHJ#dSd%T z2x6)Tyj=U-+G+%^W26QT7y(h|Br)$_cqI_-xef%}fCq0k8MhsaBo2u|tbCH?HT8g; zc5~T&+BtNFazfT4>`KXKQSw+1n+7@+Y;uGRmff$ufiz>4m8Nx=M~^aRN68llR|d-V zr^QFtb7S$s#(UPNCpU~@TV2ziBu6U{+U{(tG0uzS&DHEreD&K?2wQl>nq%%WKqt6EyXvp)P{S>Y>$qrk{_^|+uX{)V07=Jg2tEPvy zB*r6xrJC&|T(cp?57@=1Dts4finw20$^b&$_3gV3o31Q(NpoY?-8z-2y>~|PX z_!s-+25#C0eVA_VOTSN_zU2Aai9Yb>R(*Js--bR)*uusG=I{mvpL}i*p{ciUDAHw) z3`-bkD!|^qC&JPolKW5J*5t5EZpJC?_eH5skEFwc4V9v)(RSHKXDl&frhOFm^= znS{;IB3f1Xn9?7q$P$Y&m7dEHs4*wU_|vS0!yKhR=OS+XM~Q`50hAabp|+6Z-%6~| z*HQ~QcYtdnpYRC2Y{jQeXd)XqBb>N_R`b~3FR!p8Kw?G> z)&TYee$bAE31DC9op!*(+fzEh`{?)d0QN;}-*SdQU2%ySie#$SX|2Kz&%bntV~hpe zJt>5G_|5hlcl7xpv#d!Pk-XVnbLVH@0ud{YZd$+?dy$-`iirVS&LHI0JlZn57IrMg zU-oPMZ24dNMG@l?)KY8tkNpB(?m5@fh@gZ-p2+zM&2-OnY8Y>j=ldG!cr}TNQTo?@ zok{&=zfwEaR5k*EV_}MUnHoock4(|>`T_gLPm|sI91qj!u$DxpN5jtx^qAZY*9WQ& z0U1p9fP#Crna&MxpP+E5L?-EeqODvQGDaAC*hWWu&Je{#+$T~^-QBB;Mf=JT3kO9k z(L^B`AQXQRSl8RAa8@Ok*}R>yFx2Y@zY~CgZu?0v4P2HgXxIt53WYL6qYi>p!!@cg zY!Zh)KL**ubSi#7-WlL#1o86Z#^>&Ajd;EQ`$5q6)oFHr#Jd%PK~lz>^XIy(yMxfD zgIq9xZ%L1R)F0)tgu6QCS`8QtK7EWKN4u7vZW1Hpd4M+rf$pdKEs;^Ig=4CQqo3q` zo0pAXvGg5u$9=TLFpobJ^I!}5xmv?E)8QcOec5O5p|I8if14rH)^?plIHtY$Rc=F4 zho%PbH2iF&jP5g0E%N>^JMGF=_UHBq^vjm!9`4p3U4e{sBY^!O5+qSe?qpZK<)a6h zqjgtOJys{LlSpi^o~wr5l;6X&Ey+eHF?_nFE&IJpAo{JHU3n(&YjiyvzGu9G!z%p1 zTW~m*z#nirmY|I&wBTzXYm(nstAKXALwl&=5mp`?EGoRDLG-^1(e3|6@2gZw)Ah#N z%rS@yAgooC*9Y>hNM9GVqsxTd7rqvG*KU00zF>LR1L2%a#>Mmw*mbWc*Ydu%655B0 zjPZ&Ozr`gO(23n$lB~fkR40fen+rz^&5PmJH&I`p0M#JdH1+Xq&MZg^P1+h;u>7m3 zSM;dqKn&9ig;3TL9O8mYQkCF69wCan)LdL~oiw=L0hh2V8HZt34$}wr%yv3y1fB9PH%4)t87&8k*Rq9hk1tl9vH$Wgh zUGG+Zt`5z^{6z$P=V!IngJUbDzr2ho_^vELMA%$|sJ-DZbs_Xu6|n{vejL-1CXfBz zSC^gk#O=M{TsXQmw!HOe&lA-?DA#TQH$qflNDfxP8+u>9>f8|}G8k`TnZ@LVk%+Tm zjPOxI^3tayVs7a^DCwZjsM3OeIamX-id3L#m4ubA4u*rX=kvk}hHuB$I-adUN-%Wa z9|Z;>C5uJBLVWP$k=nN1_9sVupuIg~2}0CxzL3Dqw4Lvi`?Q@NQfS`#gL|5f=s!Rg zOs%v8u@rJrkcWn-%A`iTpWTh9f?kd5SPjuT*@PN6L8YGXrkFWw2~f z{zy@&LqxfY|48a2_Z5v}rRvpVU=lJn7fzivp>~FtxplQF-_vklhS-3@s7qL4nTYZV zi_uOJujw%0dZNJ@A#>W?9WP)LB9zyH5Phn#y}&ehk}7+s;%=2m{Wy=JTpHD+gu7-S zwwt_Lele%{WwypK$SU3zo&z9O-gW;HD>PgSWQ?B3%!$eVXoQMjmJsV>! zT=0LeRq&C!)y2QqYPaBTY}M%nz*gdDn+T~HvCu(L9kp_@{I+Wec<+k+Nx?!i2-X{( zVIj_5nzqTk*Q>t@8>!)_%vg?%{DtIjP*BI&$S7DgQggrANXuiQpbmouWdVBhLnEP} zjr{xVsQ%OMv7VYcyD|(4CJl(u^x*>p0p3?(PXOiuW`+Pp<(nA=4gSsXxfA_&d>>%E zu{lPn6cDw}4QRwN3g+>_0Wt&9SpzPAP559#M)fM|ip6|){YoPSvqf^)x`V|GS2op+ zQ=^x55IdmlWDo)^SFXRWGaShebcnntI0NbqERpC>s`lzdbXJPC+4s)wDvYYse~Iv2 zM9x`V#b?&*WkuKWEXuuy=*`e_&=53_uj)9!Vle;wM^f=R8emM15=Qj~-)(Vp+j6B9 z2Ng#I5_%1oyQ*C9g}gQic1fq|Q2b9vwP~KWU4l5X(4E!+t!fAQm!o=@ZS}iftOx6= zW=*M!!^pcN9RW$+s5-Xo!fIpO^8Q8`dR|UOu_d3K>Wpw&TOow;6V)0NXsdQ-{~JKX9zi8 zOuX-x4-fAt3x7U-FD!gFy^Zk&0I5riKO-e(e?74JJ|0KBzdpu%T&CQJ#__H8_;7w^ z>--5Nad3HBBM+VCU7MawgzO1!stWps*&R3kOwcu_jNUwLMX~^kQmLJSD1e#=0vtik=5D(y^c};r7FdVgX4*!u=M1RXF#s5=Qt+M<_RyEhV{mCwecy!#NINg_} zSezW@K>VLp9g4w#{9V?sLZI{-xQ*W?Y=`cvAe8xY~uf^d_0Vvh6>%Wxh`fo~Q4D;V86)z9Vw|^*A zbddvdwcs;|_)H7+P1mejo@-F49&)}|SRs=sGZVsX3tLXjz}{gbCXtY1I>|=5Q@}l! zFr76BLcz2^3X6g#54@n;$vPKs3`|?nWYwSHQ?6f9s(j*xWQ8scRqo9Cp@&RFxk7uU z%i`H=*Kj6V&;KW-s{4mhQL6rjQax<_MX8YfrBuRF0X(bP|4=He9RQ{B-|4NkV;TRK zQiVMV{BKGX{x79s`tOvgPB+-_|D94vz~|lDkhL{kvra=#8yF^q*iA}qaB3xGWOn9h z389cO-f{kRSEl_zYM);H>OuJEp%x_?{QXiXdl8tMN}8Pxyi*_`f@DHt(2y+u`s#=c zA-sUs#FJMK7ub4Oi*nKcVKbWDq&GYxldAyyCUpsuu>x9<<);!x_z_z*1%0Z{N=-PJ z)FcvXcx{Dh)ZKk0)*ht}qmXl3M-vI45{IkQIBOUw^&B;Wx5{Bg2K8NhX8KolUv!}2 zispLjfzFk?B!_88s%>xY-Yim@))O0{5VDHMg-4dH8FDYKJ7 z$TWq+(3{-vFDza@-!HK`uWz1T#~Q1SI{K_91)SV25hcqQAG-TS72vud9E3yVOcGSS4kdK(?K8WMHH&#Q*KRuT$?M?d3?AJFO1|am_y{cd`BXWQoyGA|IO2A!NNpX+C}jzVsF$XV{o=7G5-s}+H?^N9^+lr&pSWyw(H?h)XL2`E z?T+-H5)lHRjVJThw$I&AQ;HqE-mTNto1a@(+)};Nh;f|3=@CigXLcNT6?@wjO1mG? zy2nhS<$>=%Yr%ZjG<|REEeeP96{JlqiHL- z8^7GQ;r_1OLfe$~5wqvSHr`kjwx(dXfm^>2uCvI>qF7G0k+jxUbIM(YZx{`9*6PBp z8H;2kf!m_4?Z?C+B+e14D)!^z)hpjByG(&B1_ZeBsJWjqDQ|V5`|q@m>GJ2e<*bvl z+R$tFpMuil8Xg=+)oMhGmC@)4xK=Zvo3-mlC3YqDAFE7j3KyVdw#}KCDP+R2EyOEaCdDE|fB&NXTnLgT|B$eP;PjcSBT>kR_l? zu?a9=ovLsf5Rl523~llH3TVx(_$nx${XKFhk0TY7_)jpFR8VA*(33BBGBn^Lt~DUl z@{>K3GvN9Z4M_M`BEX-#zwi6k4d9yrDeMZAL+2T9`UHmrsM;V8G|4{l)#*H4lMH5O z1G;K+pkM7*dR9Xetm+E1(MN&ydyDaw&9TZigdg9oPH0=@LRn7{fP-|q(Y&XRKw##A zwRe|^e-s*qDr0iX%%wy3b+%8ielwxPL=iEac9yr`Pe#?*(U`p+csZb#T|vrc^Dik z;=PfNk?Ht%P%NLoI#lIs)AZ07Y;Zi#cDlnx%uJ(;nuQ%i$l%;P5Vckfg4j;@~Q z@PsKTKO>haxX+g3!*p^^iqv73!q!_$;u5*bl7Bvnpb^w@IToxbt9m#+qgQ;pGM1Aw zc!}2JQy0yC|5+bTp%OA6L+}WJGAX065STAitTaT$N zyJh%vJ4J(nZv)cYAWlqT^=d9dPWxUvIeg(rK2|AFDSma&6w@Pb&9Bq=i29_{Tkq93 zt#d%s@9kP7m1_Tm7}zMkKEzidSr1qP?fTHHUevPBI$^SlCe9Oc(8S26r-eBOf2AXH zFlp?qobApR+z=tYW&dF?4Q0^eTKl|-(>Tc)$iwGpPgXxeb@g8SvCO{kIg;Z0h2S|F zIyvUs85jx6T6YO&oU}bCl{8Oc;C>&QIyL7)5$!b{>bl=bZhW{D*v?l!qO{J&M5*X9#Ku!OYkI(G2O-<)kK-LTdirbddSbhERJ4nR z1X~UYt<$x3CaSh8(KHQ7mVlkLB*x_%n zck$4sOS-FyYsZQw$w_nSd(O8&W+t)#k}4IYmJ}eVMip1G7 ziREN)I1+@9&7qPbLVwWAo%P!7=e`k7^$E*D&#cWR&&QWux z!led}hn)9o=rL8@hv%>nEQuVexe?n6dI;b-mOH50S~p zv8az5{-5DxrvPbR1)d|QDU{pBowd1m(L5*=oNOterzyB8&fFX2q!Olp1x1Q(PPQ0mByA~; zy@Et7Jj6k?8%}a=0<@+58$!v+AFcvv((4zpmURa?rA(iV_$dc8bRt$?gKCRpns6hwx7Ys}%zVj3nX1btGu7 zU>ByTHX#dEuKh1s;zCS%O+N}@?+RLG{Y2|*xcXSp>-D^X5##X(5F>wWodNCC5#hy> z8LXCE4{uop>2JHTzmm4nvaT*M&FWtINUd*sT0OnU__D@5!EZ879`(sLC=Tc~w}&N} z_-0`%E-s$w_i=^vDZjDzTV4u6URprt>GVXdca7XsscmmMc~wHz)U%;;657;OSJAHt zVLYzc*ryqgvaLqX`G-Ju_F2vu}2<(G=Yt>EI(nvt+0<-L)N+ zZ)Izhak*Aa48oGA%GWMfK@U!CJ}wQ}!s!0~z|g*ZE-zv0_TBXpSYf}j0cptffybZz zf?EPnMA?XPK18wXkVM=F!T1?TjOuh?rqwd_^|7tu()7790>06t2?Ak@6`*s4 zNrb!;$P6Y$g(8ORDbeX0_w89=aIoW8nTUM!P&`*3PQUuhRKKn3U1qNly}b&Ww$zwC z6lUCaHY3VmC+k!Tgg2f>2{)MaRqmEz*<6bLKyYY=yi}aQZ(N=#2$@4; zH(D_4^3=MWYdV+*CDd678~1k_G=a!&@i1OPS$O_PlABEzLI3yf$x6 z5t3%ZY@4Qt{V2Jqe5exu{>Z^3fSPY8u8cL@24=7(ggJRi+V!X+=KVFH`6YEf^=@S)DJQE_y!xEd&v-y!X z<)HwJca*tYXASSXtei3{S4(H5iZ9}3vi7GMs14=oxS|ltTKm>mWI0$P6BA6gOpxtO z(&=n)qDy=m;8b8U_x;$t@rJild%}AsK^KoNBA=ajTQO z-Dgz1_igt%$XX0Hl?AWdZ!f%@mHXnsCol&vcklXmd-(J5-vXHzM;8&b=nR#?4k~#l zcix7%WRwC4$a#$Uop3l!HfEEmfQo-~h2M)7+}cXhee8Jfr>m&-jA5vbcX{HX+?Q*7 z;p`L}I>&y3v|AQ^rTqi~iU@`17d2^gxJQ&t(u9`b?CS&Ea0HDiH`epY-<>Vc4g{61oY&!H&kF~}O3 zjzH{ft5ujtOv%{{G<>dXm~+Vq_wo-j%gr$Qgs1e?w57?+T8;JId+M8>eZd{buyfD! zvs7zpf&Ny<{$c&q4%}j1pHhXFyJSe|_GkFL*q$)m&Sv-f#p6Z=dyCegH2s_|77Kyd zn^~hAINU^<;ChD1Y;NWm2AP(Ld`%`6?gbmxBDooO*wc8fjYDzDc`WRC0&`a&gz>E4 zbfvcRCiy6)8MW>Bhx$-@)O4`do%M{A{U2V|@tVi^4T00(L$vpRz6Yq-0{R@HEyt3@ zw%L>Vvo1s>8h@%j)hhZwF3$F^$4}==OGh1DCsLvXlP+>CiOj_QZWUdstQ{xy3PbY& zVRpthkogy3%|sBsLBe)B5*+m#j`{Vt4c2qwX}r}$=EeBtaZvT1{LAZD61FIvDFQ#g$X4b6vELr==Kp&ay>KaQ83cFR@ht}5GEs8Bc)lcB`D|9?G)ko{y^r#Xo zRi5&IUo;t4?3LG;zV^-CH zO&jg2Gj~T2k}e{IzNjW1`esBxcIB~(PIPaHBf$#l`l7FzegX;dj;1QYZ+A^bfNpq0 zMBNYuBCWvjE;cTn{N;0kU%sM@C6wQIG1iM|v5kFO6qKGpzSdQq@LT#36LI+#Ouza8 z8iQBJ%b+Nlva#)cYgs8h?})HGCLwRPFE15#jNfmi`}?_H1RYkIIQB>SS?wZFb%5ZB zbY$K-=Us{l_#C4_P}`QF2h@rFdp}i{p7xj${Eb4ATRk^kWlieFdybap_b2hyz+@Djt5^4#hpgQCbGv0=b?yF#8=mVyX?MdLDFW4?z->wyi$G@2x7f8 zD@^XRAy5yO8U|i>36!%Q-)H|*W0_{91^!%hh|uO%&LdT@eq*movKL3+>EtL=?F1N< zm}Ogq-Ayl4y-Lo2S&~+Lnq`F>>&N=EA^+s#=bL}&k9^gI_`2we8H;=1uQiE?J)a)l zZ;xYRvD3rfuk&{D0>5?$d$>Q}9?YIc?BwO;<$OP$9ywcip^*waWSsRm7&V;1~k0gZsfzfG3vBwC>I_s zpp%0N^d7rd=(o5&T;8&Ff4^uEdMsXTJq3FHqnCrv1*zIB%0SHi|qH}i?@vO z8f}w0d4hGsTwEnn5e+PKd=6CGs_xi7K)GR@yS3oeXtgEBK4IeXwuge^s1pTSt^UZWO6Ml*6WWvav6E(_B z%QMzl!r$v^5}8Q15Z}LPqG)e_URJ2A1yV7my1wMxGYgivN|O0^G5O zoLO=icg$^J{kNha&x635sZy(m+Vz5T-1X$x`!(JKkZLK!GQhE@*)JF2)LlA4SRg&r zjPOprb$N46&wRoS`~;E`Oa7t_N(R%TF#2Tm5)G}agHeY|_<)?Kn3%ZVus_c}qAlzn z?(F%n0Wr-)3C&0g^lZH9AV8u8Tgxd2Rzgk+f;RD|stXsH{7<#TR8<~NZW%JRJV&(*+LVMax+fy$&f!>CEq=-PU=y&#?6Tb(y+)b%K(Of_Eu znx~w1kC|x@@5b<`*H2GxnR1anNQatg42)*21K}Mss?)~&D_p%_TpCM5&uf&K@!tgN z#)LJt6+U-rt3YfJKWRU)ym@I95=Z&e(0JOto!=p|cmYI7rflURjri(3MiA5Mk5Cp# zDdZX}0Jm`6J$CB2KQ`gD_F_Ac=WVudOc+!gsdMnvAYgg!}YAZUPQUvHd)`(g#D;)a;~uD)0?wPfM}L zipj}DYD$GkxscE%^Cbf&gJ#0yX|QRrjTGByxzinI)^n+j#t(zFIP`^@Qt8`6w@_zmcRd zP!1HA@8LMZ+@n=Vu|+l3orz1#PjFbZ4xpdK%N1}zjrc>BDjLqjP2G4;yD%%uHA1H{ z)>D@yN79h&wzitF58`Viqdj*FmcI@_C#=e8PAY_!_+Q-DF}^>O zCX3=zd3iVPA&f!L6?l)ci0k*+!fuA`#e+aKTTU{}Xo44?*YvC=I8+L0CISMUk!((H2%MK@?5t2$)l1?uKXf4;> zBse7m90j+MgCb<6yDW6)KT7uny5i!=o`8k%e)5>_OES{xZc(Lcl(t?eLMMb->@ zL%B~8_Y))np5QQq-TeP`*KYPj+|3XF@5tpcF<)cpE@8jO0TKZY!AnmgZf1!2(6qyDegNNX1ai5N?s9bOxF7kERob`%)WveAIDE@|4SiVL=L>a2vr>`I z+cIt7mi8_<97S^wo^w_P1j`{62_EO~9}ixSgx<#w~B1@BFKE<;xL0y#0~*H8i2!S0kRa ziFi6=W=;`Zx%ONu?k|@Grk2E!;rQ#TRW)rpCQ8D%3JuJ!U5IrR&C{*Oe#{(Ttw(Dy z1>I&;%8+Ze+vQ^{!*_XNeo+twqLcQJEwHH^}@DABj!<~2R$DXslDAVbtCtUl!Gcg=J zRTYahY#x|tdq&dp`-i-LoKYHhM{h*6uB|rPtCxLO#NZ_plDU%L0d6-96IOD2!tzpP z!Vxye7HVX8xU+z%2Ou-=6Bb#`!FQ^;{^VQc)nJ7~X&@He&1gg=3QMA~-7!j7SpfmM z^rA9;9j?2&{863$xY+(^AL|zf$}nZe6^9<;5&2-QY_>!T;^BiELrrsLfyx&&;-SIA zKWf;Cd`%r57H&5)0xBm=W2`bcBaT}FUG-i!qb0#GN&~@IACXyUo5I20K@TDftw)Wm z`rtZSwZ9_x_M$WcuI{y~;`|>$ot3IEgKj#5xxQ;lM z65C0cD!f~U-Xgt;981!PD79N3dEk>?mk`kg&Ro6H-g5<=4g@%#;kgQu)=G~j5;nrl zClWH)#g=_S8Jd*0SMM?69=M|>uZd|K4QZ`aF{lFX7`uX@rC@c6=P0S+UiL_icAgH| z+xG+zoj6JGa#Q|x$WVQ4YnH9+jec$e%HB;Dv+_93Gc!yt-jL1yuDg@jSz3bsQS;fr zK#4kxXX&WQ4l1wHP(qWLQ&x1QC9Ye5@I`4@^ghLImEeqORGBN++_S&{wAcnSp)_3b zfm!~~`9>X}-AmD(`$xrtYPOqQ=>n6>P%XQec0ZcpFucyt|T*e;UjCYv~dSOvR0F@+t zoHDHEG!*%d1Y&MI@i3@F04GmjS|w(gHS^^aRw8GgJGmJj0Z0vFpHxJ6!tW;lN-G3< zqa*vR*V)w>AbMRs%pe`N54t_zRAQ|j-CV^_d7w>qtGe;SK@0rhpf%O5)xw?<@MrdZ zhYB~aOqNIw`i7WK4R9ORG-* zSih$*ii%_s#@cPm0gDTrw2RKdx?>qha?)v+mJ5F~Cjn2Y&cWXY((J#o`Td?o7<~oP zW^WGQbJp+9z+Epoa7Oa9>|V&ajA4wV@kX;2N1NEW&2Tr9iPTC*@@aZ zBiP-eL#l|>YHzBlHsTZEe588uu?H1Y^}|RXB2gu289NE49!9L+2iRYIk~mI`ZS4?< zIGAmVE9@1~$;i1e^v_!vBXAc|SdbM-)q6ZtZYYKY>OVnQYAG&JQuml;54ar;9sJ~L zlquqGV!y8>!=OEEQd&Y-iQ9tt2q(mKZvF-bl$vaSECSJ zDzoI~Wf(!E^VUUp%Asx2x5qu=doXg|l&wZ<7(dUH*&HhyDc(AtD$W*QuvrkQHZ8Cu z{*I2VbOa{YTOjXho(|CHJNR|%@rg;m@$VS-!og4ftwuz4D%60`(sAjhCwGne zGlsy<9hQ+5aITQ(^mj~ya5A5Q@{H$y)ju=q|1HR;FdKjLD7GW8bZpl7sr}#3u|i@) z@>4#=&+%uSRQu0*RFRASoe+m*;JM*jI`-fGtoVO6LD2qQV&|^bFqJMIyOq&UjW#{V z?pUQoHf|RMV5Ap(zkt>MioniYH+q13=ZpE&iVoTefB#1?4)f0_kZ=?0My3^(MthBl z>0tAvFGhR8DXwuABP!UTh2$35^f}E4`#^k86DjK0lbaTbzFf>tT;$hCbYyWJ`7~Zb z7G}tV0_tfI$BWsBlq>6Ky)|1l1|10x9)9gv?{1g0Ob}RpHu$B5RK= znm{sjCKFcXnnYLSKu#k}J@I$hp z^YSZA1bri;ig!1Dr+F~Kx>!#;2ogM@W%iz9@XQ98+JFcXUV-&}snH(jryI_D zHZfChd;zj7LKWsNj9`ndwsi`sVRyFrteL$429@)5gd4yD?A-^NE3nF-pwSA$=Ux)s zUlPXYns3+p<;z54B!lB?9!X#z z)qgCszJkptRWwgZ@l#BzvB2F+qTBlqx*C&^8vT7V=4x-ojE=3Jh(f#!3%b_@GP!|W-pXEHtvE0Bpd8#M-G<}ou7#{Zx9F2V$)+SpY9|ijWoYL0t54u7 z@G5L((cq&-s+52!G|aY8&ou;pNh%?;Mg=PthQOPDbxn}isg5-1O5aU&DJZEE+Y*ix zMa?|*9xVRV3oNAi!9$ak8Y*ptQK zG{Dt=b@ekeq!#hVZ$WVt9vOUY*4lTshHWg4dpK#bW%GhY{p+N>lyji|c^y^ex5-Q;8LAU$!NbW)#H5k@%7rJKFcs`$InUZkYZ0Xs1?sM2}hC4mV z(r1RVI?CpM9G!s#YZ^5Ger|gp^}0|5EKEnh{%+T*1+7;Fd{g4Gvy^$hag?u|HvJL= zYl`~&syBbKXPqUULNwEE zi#SZfD(dR(KgzC^F=%l1!Q~mlC=C_K!GOf}-<87~MePQy)!Q6Os%i9=a0crQ0yK(^ z`oXErQ&5XJ|FiFvH2>K5#>nrXu$YZh4n7ybJ;dcE+~osE^LM*a(mFaV`KO^`cad1( z+#Ob&MVF|y#6=|wGOUqZ&s!J*(&%Hb?~y>v-EMmcqPGt+U2mKDaoP+AI^2C?uk-|Z z)GD_Cd_8_Bw|F#_rhd+5kQ$xF8Ar+^WPb|v-N?SWu!BUypIvtGS;uli+|@3488Twi z;5#Eh&yP@`;wC1U?4hg514%*Te=Wg6Hw@SCY;dj>?BGIUl14EHgkl#bL};g2fpS2A zobTYvhwr{n?J;}p<<0Q5iPY#n)4>ecqeHB1m<=DM{h-hSN5v|EYGF=B=E?m_`_cFv@9T;=BTE)jm`4><;cSc>7=E4`6jn;BJxs=<$cbQ zQ(l>A*84#Gt&cL)Hen7-G+Q?=r<&@UEUFLye5-S>;mil5!~lekWv*dX7sm~o0K^2( zTFn-`lLf@CW@#v=kLfebJ3W&yNOaY4-UM0ypL=g=2=60}RIvd>M&p8^M`Zk!OO*=@ z)S0)hD^y0gxv68PE3#hb4=ao*RdE}M#CF?ZB*@dJ^2k5rm}w^z&;0AwQJbdF^f;<| z+d1!C@P*X;xA5b9XAgh?)LtoR#7nEmE!9yp$r<(sKF!Y5IL}sPu7n)JoPCharpz_? zO(yntTKEqNja}2$*3Ut?@$ZUW|EhWM^;PpaqGT^NQu^wTd9MxTqJ;~$0(EQExR*P| zRY#O$v>KOxGomlZVv)HDrttmpoh&CcqPuc(hrM)279A8^c1d4UZ#&EFkN=fEEdiD{ zp@-Z|=Ye!USfVVZ;#Pd(mMWvs(DB)XZBm^_=KLt7!|xY7fIT|YB`n8;ztqt-R0>G~ zohxo_8{0W*P!}ki65m)`OLvxCL8LK6%0sltK%P3q(#{G?p{j}>jyqrhj$M825t|-pM zI-9L7eNnO36o@*M_{X~El>wHxzw1>9i9a}+Kcn;h_4`EtQJWDc%c~DXIyS%=aQt$` zu7uQu7QEP0X(L_;o1>qd!;N9Mc-ju1v6@5nuQigW_*GnD{#2#%$puIq zN0QT@+@>uxqp1aE=vy-8C6Rvj>6m_$J%K0J0av-pH7v*oy>5Ds?uymiO?QQd(-stV zoCxTl`OO1zzeWlPfe;P}4h!d=JU6;#dyw1u1h0w>uxD`bn%G0ValAPf&5N1c7k>Lb*m6Fv+<%>);^6=K6D}t) z4ZFu-S6tb3Uzs3fg#Vke?m*ad`1qM}`hQ!)*ZTk6t?Fmh)bRPe;@M9L2jayHe%OC| z&D;O4^2cPn>CmkEv)wmq`#x3nJ@Crb4-YL9i4chMSLUj9Tt$?BC~{@-XQNPY#jO|z z6#b7bwO&w6KM44xWv-p8At3a4cUb|?WP)tPl+^%N=uI0MIIe|Zh&mIh6I&SnlwBULng)xXUS0&3UM+9;%+EUla>O)?N89XI96; zvfngEM*G6#O&)_`5M)3{%9T%4OmHl;Duu+oLh}>L1p@pR9}XetKwBeHDH>`~ZUMxp z^%3X^i%0YpXefRces=(b>y+crl?9F__>dSp`@M<{=G-2He%^K1L5n9MF`yW%gOfMV zWP*xE*?OzbYqhse>N|s4?D)cysia}j0>~iSwa>o`hK|xL_hHV4m9k@vhT6ecSHkCS z+Y%fW@D2cyDZ>#ksgKoBv>_qNM<-lcam&@bGoc=P}`^v&Gb>Zu#)eyyASnyk+0u zMkQ`|b@HC3;Qq{onLA64p9AM54VM{rhal{dqxR^lv4~ZhuM6p1ReeCZNne8r2rn-Z zpgs=KT-bI;L{F6SKs8lGN#A%knX$(XO{?Z^qZKv`EdBve{Sqx8z0S6EZmCVZ$3A%B z;VVF`k*b8Pqa%5Htj&{_;aqcR^O@=|Hvl6VtGpyI6kr=3l7(y2YS~C@yTUe$T#Nms z&=B_f2JR`IcVO#6gsMj*Rf0II)5+HQUtM?l6=TllRcz~6c;y&jF2J-MC*K`3onM`? zOj;9d*b<)ek3o!VrXi!3aA~byV}iHW`!W=Ky46s`Dim!?C%qS(#AaP`j)Ej6o~?-S zb7|++cmee)c*n5?KL_tKx1V|+x<8E^Z2D&WhA(#-AqV_BKzx8mjGWm9--*(vtVrds z!rk&G>Ilhz9F)AF1?ZdkU8Y{u$^tq4+>1Pe!*ceh^?c#0$GR0Mh@i^8H-c=T@~0_Q z#Nv1B7*H|4SdRAi#uiK|a5MgTUSr7uDmekgDahgblTOFop!Xg)%$KEoU5;v0Z=7oa z36bE%PJ6qU`H`p%q4o}tU!NueD(rtKv;@i##+YXY8G95tErrUbW+n6OX3_5N8qhwU9sUI!{KrTA$#BUP(^8$ zqbeXqyAtFpl-|3dH)E!g>;>*VMR=!D?b6;dJ)3kk5;wQe1h^ zi;V?SJU1Ts+s;3+#FBiSCtgo)1Ga|Bz*%Zp=cphVQM-TNjJEPc+rSy6_jSc;@W(Ab zU7sZ8Svv=1CkdE}6~26SnyYU8-iMLteVBUTBGGyw`i zrS(7lnm`RWlyp=JIOsC~W=nUVKZb=GDiFl>ge<1cA2NeG#rIP@-MtY-7$Qa%E!z4-y>kvQ%5oMRlzO zJ(BhY0$`WLFzT#7-vzHJ(xoAQz|!|6a=)sSr`H9tY*^BFt-3)Btl8>m)b~=ES^#rq zZ&_h|ZGzJf(A$1KigbhgUq-G`R z(~m`wcW2{8oC2F)uIqo8nMhcMjY)wdI@_VXJJ%u%kv>kkSgZ^M)qSFE3*#?)V0O3O z3EMoc;k-)Vy+0iRA+RFFvuZNQrv>}~t%La- z$>%tFy_dcVmq)L+oPzLlir=hZR3Wg~Zt|ici&Q+B@2F3VvVuc-x8@5_&Ft)c6IxAG z-1`)Lw@ZblbNAaEGr?Fb+i~Z{he^7S2~ALQKv)zti7EniYYX?Hn+pgf9utPv3V|h%Uffs6>mX;L(US_BT#|FjT5|8Fg71b!w_2(YOk&s@2v@iR) z9Hglj7bQ5FP#}DBGHT_RJ-w5WUR1al%Q1xmcTTr93DVso*m4BXaA-udE+xm(L-E+st~;M2@rb(1!K=WenWPT!^O^jB#-d zcq%ZXk%Jn79>jmF_8Kdlbn+Xi?Cnt5e*5>p24cObZ4AM1g=*{_ZXy*r2%k6w@2+~Els|4O>ua*`3{Mz=+-b-o~g)xS)48D#~ z(-;57*K{0$KR^ofvlg}QqcGMDW}?tsT8zbv*k+#?6mlMe221AyH|h?9DxD}7Hzk{| z88}CzJBS@i?0E~ zx2M)Bn+fNz2pmojjbcSTl=Yl%7?BsEZqn*$-nPl!wv>$^lz%|*(oKoxsA)uxVbfp$i^MdhLwbrgZC4NEEx#`mD4i%s zne+xw1?X+{%Az`&&~0cVpT$eI4lC6me-OgcrUZ*XmTLHQXfRpw?!(va)pLC%gA^;q&zZklOU|4pHv zr2zks=^R{9y)PAoS)q@hJ;;TdHD*tlgG53DwZm1AXzvHS2mI?S(87$v`7oKDN^L-B zSYI0m-+4J?HUXZkG|C%YiB5m?!{Q@3RpRD(^lCRbmYxu9PMbfELO1~!DjTp9O3Gc%;ko8K(eE0S)hA+q5hgtqN*{cQoqBw-O?(pt zeAV$lWpMO~Kzw&hkqJ6y&LJiip9f;3|`2n9u% zsMK^DLV=|3FZf%+zKvVl~+eVLKas1it z#ez~(S0159mQsvF7CBnMW)kO|GT8rh7s;@=nlq;t{ zb;dihF|TtrkFXFog}odXD}+AI|C+p3p(Du^GHIbg*-H+aH4qk)Y`8TLg*a1TrUNjM4=bkkLJbg zT&N5U-85W*o0(=RDT>5IV8%;!Dl?HB2j1$3`d7Dcb4lZ1|Bq|y6}NBilR+teW6z+2a;0lJoD!)?^zO&gX5CPK8R78b zfIA<-`h~B;=i9&TewCZ4K*b~PX6vUHJ^8w&UJqUB#$ z!S=+F>g8iXm-uP|)6LWWqQ&r|$MZJg?g(?kI(JP88J*})fP}|B^1gqqHRD~iHhh>E znWeq<3aEmHdvZY7)89WPiT&N;Kmmf$=6!en`>WEn;J4MRzb=K^DpPk=h8 zZ4U=4wPI~L!A=cTfl+D9PTwBXKxM-i^-=Tw3{>)&+}Iy%5_iH~16+{irq~s`72&3M zwyYiCu{7cr_ZDdSG)qyn>9Z`1^x`wup=0Ex&?--m&JI8P?6KEoXq=2(wuQlwQC*#y zd>~w!|KOf?@jR^R{FKiN@L|CBkWGb>I7C(S8mp#4&@b)~RRvPfTBMsu&;?a>e7UuU zbpQ2ragb7(u=Ef^t++^M#4U;y_R&ZrKY#)Bj$V(?{61DhSG$S}?M0U{TOAn89=W$* zX_wcI`&EealSZU1vwE#=mn4%`twW-B?BDnsLK!8`IbGqp=|qoJDosIl(%Z$FL1X!pMIjq4G>21d!nd@c1!~2U;DlnYois^fUOqe$QL1a{D@h}GzG?@ zFo2|)`LwK9n}3)QG$NBwJFHs7ETarNgdx1vyqx~N*TeBu1JjBeB@;v%g+>$Ss*YJrC{3mad<_BZCnI{u|V2z#GDEa4QxqkXl+jpqYmnv-{#0&5Ctgo zCDT4k-Z3Y%0h(K`9(5df8j-#hG^)x+$oAo4tsme^q+Tme?B7W@3wcQyMF?q3^Y z$ASr)jtshP9*|Ywb{`Gyt2s(SxnO6L`!|O-f{3*+4S1p2Dt-N;Lc9@+J!WaFTzJ{; zDvwW4%vj<$fDGJ5wE1N5#&b-7ANJ>OAwtu_gP6rY^r9a*7W-kzK`xN^TGMz;60h=p zSQPz?An21EGE{U6-#0X!)U5^A<%jn4mQ;Koy=ndHJF)v%7 z&o~!>vsAb`=$f#C?AxN$<-!b&P=uQek67kD7&u{B;9|m~>|{IxphG}!OOry5jlJF3 z&3(Ovpok)~jRDt982oKf1IeKy=^-J)f&mm=8b()N8 ze6$Thfy>AL}RpV)vtJLkDUYgi{l0WXx^U(?~fd`0LVQ%&z4i<&5blDO-j-1`F25 zAHzrf=@pNZF>z5-13jjD8s&zM5+}}KHOCi>aVYb?va>O}v#r?0E_#>nwaTa&md3d# z+v#iq1|y9^>`cFIft1I@p7#nHqrsPP%~y3i;f|8C>JT$Ch4Q@?vzs=bS>~ZSIHBg} zsWguI>CU4z&qqJK&OcRAcl0gDy4D7N+^t9l4K8Y6BtVWXQ7bAG+-@cpHEme>@uqTd&+(3`1O=`kaeQH>bd?lpR!i)Nsth-Z32T zV)$$66!6(MFVWTlShykXL@wi3{6*KBdBL;D>t+MH%WU!%ph3oJoJ{Y`sjAV~iqs5Y zAW~{pcx0Q(_ngH~bU~d9s|hwa1&oY5d$Yt#@%NHXd2E9-K@VEF5}brb5`0D3u%g=D z#|4lhuVB#8-a9OcOZ<>MW*6hOfF4MbLq8ZqVqu)(d%H4DKgpI#eyD|e2d^A8l~JIc z;K$Y|M8Btbq@&T6JYO1x=X2=$RywBUOXip1ZQ`1A+%71);KT9y&yW@6y)ftHOz5?2 zyLe$PuugI2+l_$Q$zUgMdbN7zLLJoQy5@Vvq@VKDF@SD+|Bg#~5y-bY!w|4f5`m)w4k z789~2U}Tp|;cNDEvg3ifXG50@(JuERG(`^b+B)QRV+~*S>uCgZWR$o+{$lU;llc%g0vz9d;la zoM))pDvv~nsVXvhpGqq3~y2gZJgxrCbgmG z1--e#u2`4X_v?vICDd3t@#*zIDa57xb<{F3ki74OySS!S(^z?RhZv>}Iyd#2qS0j} zbEpNhvD<(QW9(mR#uohzxem#86uRPe zsmo*rFE9fcpEmP~0z65(K#-PVW39xI*n$to{%I$hFA)^{}sH*G^Z|H52Qh@n1_9Ig1Bmgodml@tgO*a^*(9trlc&8hEo8Y&G@BuQR3L z6nwrsLhy}@@=jwd9%4i0;N}LC>-}bw z)%)}b_`(H2E;4mmX=%lLuC;mwVk|k20ikrnAqKB) zbP!0+N*_gxns)a-l?%nqRHjJ30yJ4wW%1neom99sihR#@@;vfnIz&#Bj(>qeKiS@3 zC9U(YY7rX7B;RvluHRcFChgJ3K1X0pRpwS;ZK9h7q|Ch$*GVOKO^;aCDU>lUz_<=X z`eJS!!`$%ywKuyEF~A<}v_kjGq=QB$>n5+%D4K8`T&{=Dk-(EKpe}{$CC1}D1>b*^ zPRv6$-Nb}q>6|^3aH=fN=cDZ8Y3TIi4Gq+uGIEQ7piZ>C)@R!3mk)Il_7Xclv31YB zUo?Ry*uDhD1GH)N+TjCR276NS$O0ow=D`0pujP^oQKN|}v4bMMOdCGGtqfSsTb$R; zF6*?qB+QzR`AlSsKC-N6+-u*WESBFxH&bm?J9aTC3PAqsUwO;~$MVR8kD+BIu`B9E z8Tf7G2F~#>#P}?F;btsRmJY$M)WW5U1X*MHFD{3_si+~}{C*Pvw*y6V$@NP!`4_zF z-L>vi_>Jtc7n@*0@5Am{CE~Oo1|haAI!kpNNH3)txN-5ZY;;vjlz851mRXVUqfnc$ zJ1~*S1yjKxtL_*dX6pXBZe996_vp!~n2%zkfbd)iQ^qjC7!N_NA^>4T+HK=gamBzN z?R*z}kgzZ_YboIOOFysFvu|SbLlN#d_w0@xEB6+7m|#Sf=@WN#L*3sXH}t9=>B!ZV zg2R%jF!G1yXpX`$S1WhsjTDSA)q}rrwJtBbOO-^C!VX4BTi;I{XjItT#J_8U@HOWC z2}>x_%jCdo5Y)zPKY^$vsHl2vw#`~NubpjG6`<@^iog$xF`}^%xk%2U3lC4N8)Ir3 zuROb$XW0EN8whcrkRd+QQR2q%SKtRi{qrkjDIA*!)(%1!ay-}Qfq&7Ak=|7013rWX*b8J%N^AbLAER` ziv`0SSC-Iuu5YTr_pNQUs-3s)vl7WghyvsTkq~2jMw_(xU?h|GDXtbXR&Sp^KpxU) z;y%LwpZ5m#MxLALf|@j1|9N7NrlxdeVpT`#2T>P+6L&>WD_6t}>GPiG=4IbWfIjU}q>`-&4yuFj$qCGJD~~CRI>g~-SzDVc zc7wK|L13<)25X5qk#XcZ3Dg%o^NfWgX2`lbDdpgGw22%#BV0Jat8>OlS5&N<>wWLy z71l^hzcGp?lA=Z6efmB1!pv~%tnKp}^QlKKA$M##SUb@Q)bemv!wQi7EM*@`k4L0Qh5_ybG7+$nbz~ z9-e+8Pre&ZP>@{FS!&Y>`ZMDqGn-HFGFO#VY?sZu&H#sp6{xVZKyM?h&pMS}t}-j~ z5LD;O#~6H6zo{l=hsT9J1T=|iR1wId7axp7z+URbf7Q1*HWnQWdZxQBSw#T+YHNru zXQ12NR79?e%_grK(~+%uv(D#s)LriMP`IDjX+b&>A#J>!>=&}S0Jc-&;JsqiyqdHA zWmRiWgQo>8{CW!kz%}oFCoz*4vdad#W;Cp@n(xitICz=WPFp<2s?fz3v-hRp`wF>u_1@ay*1%8LZQv27h zpWTnqjJl#Uuw87tFhe$B(VULg*YayEy!iV1ZBjczZQ0}GMAHI&>R*=#555ITDYFo7ps6aL_Bf_}+0ZYCW2wf!aIM@Do zKR&5s-vz%zCRShJaOCL2ZeP_N{W-1NAm4h01>zvJvcRm@dOV19*zu;)UkC1qvx2_3 zn#xOfrwp6hL0sK&1B0W-^orshVHegW_m#brZSkdh2p|i%!GO=GfGvfG4`4Qk7zysd zt|bH30yc7?`4I_Fwz3xM zzE@As(lUV8Z--v4Rxw_0>&15yvhKIU>DRBPKwocq3=pvqm)tzq#zf=lhYtl#27DYw zUhMuM6^4bLQg?Dpi&c*i#7ody0&hB^(FQ63WFm8%*+0aI;n-4hQX}IYVy>cbE%|ln z?7m#C7iC?oKQSCDbQswW4`>!ZdVtumr{SANxoe4q7=$&icFLUf=3HabgXnnrSI!=I zOj$l0{?aH_YnC4)5oG$7`8$i72QviE6)s4eGcwyac9rIOTZR)6SuUPPP5*av0s_}H zAc5#uN`?+Yw4F(K@bON?^ks)b-ou{_Q#vzV-_z;+>^LNWl(Zf1l|A(c$N(!8A0_nt z!eAn;d8iTKJ$Watc8ld1IJ!Le6fER-TCqxlO5jp4r~}xURp5b|Xx>%U>ay!#n{8a;y^rT!PiKK}AbY)Ywp@lh;YBoKcQ`5#pVn})N)f)QU#EkO1U9sAJY(6^G ze7(H-o7o_VxCf{cS(L4t559m}FUQB>>0_|-8?)4uB2ax4bN~2L$c961uWYTwm?kPo zs2MluMR1g71SdF+3#XHOZxScEz}f5rs@Z5+&!aL7lwUh>JE`8Z2ijb=S&Zf_2+r%G z%QCyXt7rCi*pB-r(CXW{UTvAx#Q0#3v?Zas^#P_DqT@%l6-G4Y>Y!!RW-`aQFOCqW z9jd63DIEZgp>ed`VTQLGy?d^{#L3kZvLPCvRL;^pQXQJTVPFkq_m0nlgrpWaGvccx zZVs_{_J06%K#IRGDIHAfpg#Vwg&FigT^3Ynp8dIy+1-scMs0$gwCVoN3Tcldw%zox;aa!2oBHMj7K4bCG+UtFKOmadO2LaX;vnI{9wuOe|5_On}%+(|IQUC5}M2+`hed`vQ!PTpE+Ns@Xjg+JQ@2SrDxFtR864MZm{UR<$g-gEw$n zs-KHVT8=Q-`M{uw-0W|33>|zR_QA?mGa@njs|$+4qgn_75yQMzunWMx^Xv*?N&D4V z&hF1tPM;4~c9>xzuPs;JnJRMh{AfaMc*zS|7t2w~9JF+dt>Fd)7XGs%a)PKNa1a-a z-pApqda!Xwm^>X&@JLc5i6lgm2%H@>e=CZJ3a2iUx%*swaNSr}_)ON;j&wg6r0gKv zxUg!#Yr`Vy7dU805=g02;jS)HXV2XSSy6)jqhaLg!W}dfs})x|CL=%R>aIQhIqC~1 z=Oz886y);HH+F!h;ZzP1{nS&vR}_6Wvk^AaV0u3NXHzqyeI+P${+?Au&U{WTsHULL zp%ff)__e@`;9ri}@(dpVN;b1kJCI(h`ryQ5*~`zmec;D(Kvh136Dh{1Y}x9Mu!_dJBImy{EjOQ(kbr zG@8)q#Oc#f+B9Ib=6jWoJF0|UBMgzz0bG=vnD5RWj3^(-R>$j|BL%%cR@6%WrWM=*U>Ln57hvm>XW*bp7)$S+yXqZtQ*!M8UwjVEK-D9fdyqV?_!+V}lTO z37|ewa4qXpFrQ<0pW%^rZWYPv;8RL6SrjZAED|A@vH_Fi$!_py*kH4o-2D*@ZEI4W z;S!y_yF9;meK{%fUoGUrSj%yv*qH0#6F(YXA_=!39&@3hdXetB)C)7o9=@EsSH3-h zk8{;hMsz4yZIm!;iULnl?2^wR5P&9a(#I(LEJI zr=O0)x)E7hh4#+wI^1+Vk8<-GX4Vpt839;kCTnO-)a5;WPNUeY zDKHmCO$e>{_pDZsbAHFgKzWn98lHbWJn3Y&(=ZaQXjiNk7{6i>sBGQEg^pxg**2;6 zFs+^TThm-ZN%k--lUcjYcA2o-S z(lne_B!$cL=;nDuozdk|{i7J;2*y?3uGHt8nBkqc!-Cru$nM{TyOwS-?8Y6|+&86L z#H3T~X;sN5)^{K4mw95Z%%_;>6s`8L`c-=#Ko3mifHtEPPn3nuI|NC&m1M zwpqs8iisOdv%82G-a+R%=sdyo=;R8=j#x!z6N7v@=^$0y&Yz8-{bh0>uu0`>TBZ03 z-90P%jsMs>03&*6SF!@=J6qQ|oU;`#L+q)uOTt5NYgeF_=94Mc5m-mWAqQ#%Q?uyd zQjpAoM1ZOizzsyks;5xVCo}D;COt0OvuDqqA;!^v{KtO~SwqX(jF)t{)A$M@pz{0Y z&nM)s=dZtmWa~;RY(a=m9@1KIQsLnq7X1IZdHbeCa_D{wcDtG0;rHiyr9JbrKm6`@ z6LP_8sI=j>Jlf@f(}5y1VypO}zc(P}IAxLh?xVIYxa9MNwl$}Q+Y25cBB3Y<#lEy~ z2e3b=Z8&8WUwHWuDfk^DGxbd^n`-zNaL{?StGcZhz=yTGs+j&oa}Xmv)tx;E_pIo| zwyd(n_N*w60UfrS0LfXtMQxxSWGp8yz3{TwC=qn4TK+e(3sm<8rw>%n!m8T(*)}W{ zLDyAB8zs!b@_T&T$%fu?1y?#MX#`-V9QMnG(YLL>&8|_Ss9jD-BX9%(eG5`!PY2rt z*8=9pH&G`Rp1`6bS!!-Q{gQomsTxDPrjObB&$FuVSi=U7hDiJRkCO_J|e!a#p?~H z2@KL9_QL_;eils@&Y+-p9gl#x!^XaFnh<@uRuoa%{*$$#h;vze-tMYYS5>4NDuF}f zKyUjkGwE*gWnvEtW-~+rT`{gXjgfAk%sS*vgwlzy_@lkOPu@ZzQ#{3|qc}Nv>5Hgc zvfq`^te(+~od&+1fmvYHf|aZ`D`Ba)y5$8GxrJEFSPdeKeblTrtM>AyKWCPZyyo|; zR^;T*fDMU=Sp(sN1a}coPc5r}o7}-6g01}W=E{8=+4c-4M}?lSiQ!u~fk8M!e{_t^ z+C~u(WTD4irg3mok($kou~rATgouH$*Rp}flykJT8{4ZUB3|68a8)hudG0hgY+>Q? z<0`6x;&-Z)%s7p+rGo`VBNcQ!-xaY_IGa!gj&!IlFGA1y_rk9fM4p zNMORGccaAhmL@*ZwISN1m{1(FFLU}Cosk>kM#56X&ED$vlTgoHFxyPneD$V%m+#~1 zgo$mpp0oF&3hyKtEed6odfy@09Y!$FU0@vsa(0HYrBS?)xeaSaniwx$ihVxW_ zuq}ln1AXb;)BIY-Og62V-9p36dIes z?PE)u(re4lwQc3|SvIa)9V2LTOj*%7wu_Jjn>%JW;H&VWV_jsoY7b~U_~CI3>0D-w zF@&i{bZGN`VtZ*uZ-Ip3F?fT0m;r4hYr5!m5?<4S}U6U};@xI{&q%}GIFbQ=xQObZG}`f<}dxM>mR z*q|_aWd~^{1%+MEcUbHmg2JCkQ1}Xi!eImUjtsN@`6yrQZc(y}R+6InzglV=SS@kd znY3HKUGu;iatN}ZD?UNg4d_Ohf_Qa>Y+FEwD5n_o4&v*TjCAqZCa%!j1RErbd_zy+ z>P$i7u4u+0P{Q5ikN@aEMd}n1Xx;8q`1pHP@e%QUH*+dmu#&<*Uzr)bj`M4`7gxk6 zt(qYy7^_P~GxPp(`-Fm#LZv_UzF zBpRVYbyTD@MjKG1tZy_{h7JY6yW#Cfsxd+Ej&2mYTEiODiiQ+P_+LK=9vtY`HXgnn z5RW7r#zJ5nu-3(zIo7Ii0dX4*kKN~WH=XKuGC9VCs@7O)^lbb`!bBzq`^vP}EsV8R z8kEDmmHvI zu$dcET9Fg{aFSI`Y-WnRqhzJ5mm^Qgkm%61zv#!5Z!cpDW=&l)p^N1w(i;7Y#(|x* zS9i(Upe;Df19W*0v^vm_vwQhCy1Ac;dvZ_ftq|awuAS7xoZoXLqnV4qxx9QE&E|NG zcMzwm_a?sB%5vR!zqQ#^ve8we?YTf?f3NG+3*wm;zT5A!6%GISFpP71Ra9$Mix=d- zPCoqh=ke*+CnrBX8~^7|zdiXdfq(qw^y|}~-5cNNFt}FU;jE`kR6?s3q6+g7?N)Br;-RY80-&)KaLN2%A*89-xd7LdX z3pzGb6W2nn;&71RpmJ^Od#<-$7BXcs%=a3I$jcnv8Cda0a#k>NJM=O3O$-&OSt;)g ze}53<{QyuMh%-KWLFj3xEMM8~-i+n&1RnHBtQ#?4sZLK_-mmRDT7!?%_RIn&U(L*f z0~}i|OQHm=)MCKb361qDnsL1(x~AEkxgEm8Fw7CjPHkmGxRgWExRqpjQOjn&fbu$| zkQG$9+1^CEpD?;76v>x@mOOKl3#qP(OB*_L&%E~iCNO0AvY@njyHQEVqldc&l_6cd4zikvY>!8pD*fSrzR;K{Sbsrf6(4aGAQG`$$6XCC^EtVr)1gTm(dM+HRB6B`LYm^o~u)jZuBV zY?}xx3wkF)Dn$9o zvzry5Gacch;2M@{YE&d2F8v@pT=}StK~9;mO9zfLk{q5YnWj0_bcX_r*VMOSwFz7> zl|f=xN-W>oGqU0#P6^1Hg_|D${nLi?Vk47qzF_?YsQI)g41iySM zz~h3>iB5K-x9+eiw{6-})~3e8Om5PdQ{v@JXkN1rs>Uu>BXD!H%N9x1EH0cLbEZ|B z7mcT^Ie4wMWu0R&jUDiE3vRtYo6QAe2PJVOBPkmlB5u;saQX0w(@ul>P8`K)rFcm9cYbqcr)db+esnSrn``Qyf39=)qaZM}>BL z7^59|cODAB_$^8Vd+=H=RR|pI5_rI+=~9dnV7TxK#y259IOpKGSmNYf1Wbocx@gLC zWA_>ZQ_yK)RGff;{kY?S+3>Olk(L3qcWh?8ZsAA%8PT*?G?UIVP&Mg1VB&Mv3d>p-?`dZXwxsNE8wAb}oIGt;tpIx_G4`U*%m+k6gx#N#A{ zmrv)IG9yY_m_S&B;7N&eH$Y0YyZ>8gt%gzHM7j>h!JNG3*H`%N6X>)}#nS4#dco^_ zT+v#`o1iMcTDTIGjN@%Hhh@b2oo zeb^DrCFTB)dHeJgE7{4z?opJ;2qo3of+?aT z0Iw@ei=uV4TE>u|JKKn5iaOy`?+(O@^^R8swJyk6BQnfe<_YIp(B8XaE`iTVp+}a_ zATAZZEn2^lXEHeJmw37xE7`}SqN!T&Uvs2SX?FKO>s$e@4b>c*3y)Cm+(pwA$H!sf z4Hv5#GX&=F#iGfc1hcxPai4k(S}~nsk@{dB)?d*^%aUrIfk&9nf>>`1){>h5n^NbJ zjZk3%4csoEwRd(>ww7&O?g% zi5K1GY91k)BI(M50Gxu<_qQxUJu;$?00U^6>8;=mktP{Hxi5|8>eM+vAL zE1Lmhz6UslRJvgwnF+aJt}S6W4c)}a#3z{ZB4?WN!YCQ`{JwpJe$fuR|CCM+v6w%|S}VhCz;5+>9U+7{@)nvr)bllQDf#<~1hQK7gLuP854*v2V& zZ2%DZ7I$-Vv@`MIH3cshEpwE1GA#V0p=*=3tD4<&*~D)li~iDR)Q*(4-i!sGFC0-< zQjjp-OxAfT^OUB#QC&!_3=(wWDvaEfUI@4$$-?u)Q|sOEhDmp<=2e3Ut^gt~I9o#{ zBMA_JIP`zBE`|pujto9%IgW+ieks;Lq8NpxEerZ>o7S2=s{0$s50 z>^qzn#yn0wmO{g9Lnb9J%SM~69Fd$DUdbsrWOeo5g=-VQSraKz4>FsYZI<1oc6X>p zAX0X(-8KYX=_)r~>xwr>Eb!U;&9MVraGp!S+BvFZKH0E6cBKvJi88kt`rU{~3eZ&d zx-zeR=Zbm!2|@2EFQ8tQ3&o@RI(07^Y~vjW>}ZXU9kn045>*V!{? zT!$Fy9a|=Eq#fRO{o(i;C5`Db=q@ZtP8;s7fZrV&=_onmkw`h@F=#pD^R8a*UV8(h zA!~~KcUZ!XA5N_rZmagwn8>3OWU{Op%>vclD%XknBuUaKJDB`uB^7ke#(oInwmAPR z1v6)7A>;tU4m&aCI_yM*c>=h)mA#l~P?LeZ7&duHBI?J-6_F*^nzj%&+4ec>y=lKhU<(9jTPZGQz>2_-pxh=bLR46 zRWpPPeuVpAl~f0BK2a*+g!)Mi{ZLrG6n>I=oYah*zqv>?gdT5UpZC00^63PV>nVYN z@g+(=(;%7Z9b1lU;UO{XL_Kk=&yDTGzD5;@#&(kFUXL;U6S`xE*S1dCxPH)@Hoh3M zdtnzcyKDeA1+}i9*zP5Mbss%Fo=rO7KX+^y)p%(ALfBv_)Ph&oN?kEH`7QU5?-L3P zyO$d(I>@iYh`f>7{O1yCuoD_-cdrY{)ElXR$|qk)oR&u~qs@G>&eOW4O9TSkX-w_7 zeD#fI6RyaWAhNb|zw;)t1ID4c)V((Ea5pE{`dBS%$hx!2dmgsWI84q$!3(KD^cOOF zUGX(QqSREgc|z)Nc$KW41Aupy&~3ZDb~-chdeolS-C_1Pmtbta?e1NU-9B$;BB*!Y z0W`s%{LP{ z8voJods;9=GNHmZt(UVkojX-7JuIZcUi&^oaCFC(N266am`L~NN*uNAB04h9YpF>Y zsg^8II$AdYc2(*>m9@E_LM9t!epygVKG`+bVU^BGN?H6wESPI}4z$|jBa5^1iv`^Q zCNKrkUk_jTZ1sMa)FV8Rq7M(z|$A1ktu z5cSU%TzFJv;rmAnR$w_GzTTh3yEw4be=6KN-sPCS?W&KWMoR+j^Xxjx_ z!2{EV3PcPqBdrO!{5T;;?4$nO(TE&p9bg8WBx7Wf1_`PuJLV$Ij-*zO{Mh?bbSy4^r)PEGO?ARmh@&qRW}A zGnb@{Uk+Cet47G7xuWla~p3w$hycMVlsO$S@6UV zI~{(%XxG3FZTMqM+lL39Cr=mL)SV_*v2Uh{n0X>RXF?khQx98BCqVI(TylhN1^UpZ zt(ReX3hry4->k+1DtdsOScf$VNFqh zPHj7|%%a>=0W$fpGLgV7J83xnWnR#mUNNCKG)7J7d9Nj@sPeGLcy!pk ztUBO67L$Vy`|*Ta8D$qmz(&J5KZ)2P*1cO|2NfzH*&T_D00;s9jXqoRPH}eJhPRGr z=aVF5;!6d({PQL_HeJ1Cazd57XZ1a24`;S6bo{{eVr=0R&Oo_7`xX2rYJ_Oqp69u( z7`I5^h($9AI`5C5m@h7H(D3~0IG^ecs$e98?e0jAb$^XxddWnqr82u4(#lqJQn+Kq zvt>WD3aQg7hZNH7o-8Xd0u8}1uYJq_S&Q9DlwsJmdb$x}Xt5KNS*odGI?mbK)o9y0 zjXVqYru_=yC{an0RC!EyGX9fQk41;pOxAvNu*x$|mvqT~3;?rov)EZwUy6jCWykpb z{nf>8lW6XA3N-w?JCV^D3()0_|Dy?wV`%5&r_NH`-`hv-&w0jL2mS?DcPafw*KY1^ z+HYQ768mX{{phU6&3@=1M|3}F+4h5ZWQWUn#@cXO&eh$%`j|e}vAt@UxxQ6#F*KO` zrEJK9Z5U#0!&_dxAeTZlHETN;CfH!wj&8tC46H!tDHEZs#5>75PVix8&x(_L-~2K- zfGuA6ey@9s<@WSm`HI#W%-d8p_BT3V8+;)4!N*rKSK%}t(SUX~gw$h{q-3!km;7^4@lH zvnm2Ig_#@wi-ZmtpJ-7Mgu|o#I(;4(=V6JN?2ZR!Jx=yZ@OHeHC*Fob{@ja>$n`r` z4KUq`W{9_}L>0I;A4tWa2R+qd=K++{c5{(czGAV>To_#X`e4P21z~_86kox5wLByo?=-Sy-q&wpTt2RR9_t&)Pv5X=pDM(@PRhjyXMDwDKEEG2JkPOY)QFDcxNlZ5%ohGSVYbl2 zRD7$h4M4MnV_fwYI2;cm3RlO-#iul7xIJ}Q*P@Q;ilxg4b1F(Qa<`h+C__K=&~H|J zHe0n@(54+l9vs=PPG=^gCtdyGq%})U%sKF@p*kT4rb^udMqeTdTIrB8B+g z3jQ?(;vB%MG&mh%zsK=?QJ`5_vgjP^%%#d_w@RbiC}#7{dh<~-x9}NlTpV!*2Zm zM%mNZI@zM03uuQhC#Q+j)!fP`lrt@Mp~5uwFVa-Ve<~v})C`M%cle*qS-%NgvfmX2 zl|f?+jSVm0Ny4DA-$w1B(cgTTYxK9IVh_h5`0t#?IJh4+ZL}>$7g*s7zc@>2BIG=my>8pe8NW?-vS9UMqa)#;Cm836EpTDaFLC1DnLNSnPClT! z8g`1W?NPmD=F|SJGx&|XbA)fY1ep(BiG(Wg50dGbRNbT1UuYPnhbS@3l!WLeH3?JR zi6$mSV<)>`sXC39$7euGkZ;~hKvsQu@Mhw$WF9-)uBXLsv%YU9@ApOpw7wY$rOX4U zHzOs<3k<}U99}ULSiTP5Emw*;-Fzj|rx^OD7<#)QSairTJ(sopDu9ZtGhxVfa~Pd7 zZ~p5BV)Q`#_W_JD(cikZ?noZyozK{lvI!$kHv=edd^>DRrH)!S6K_9U{N>%zwch-5TZj&rw6?!KF%UATgoW51^wa()eYJn2x6-w4u z>7z&};py9rFaVxrcRck6pDMptiC|N|c_#dS@q7FN_IRbj^7>wPSV5@tdID0q7=UVg z%ayJErEl?}r~VpdP#F`*;Y*!RgBnqRHmc3x2J+^4`ZZ-%k`rBUJPPJVYkxil|I$6& z2oFoSe4?w_GW*i+pmPZ;r^T_HO`h2G*%aJQmvtNqiY@6%AaH!h?~*&3hUDn1J?6$E zu?rWr8)SDmwX1j<n)_LjGeKWmr`gqitO{jAbv8Oxif^B?FVpO0{KKL0u|L^B|+K zF0anAJH`?+nM}}1J^A|UuL)GP3t12?^@C1glp+OmUhnUZ$)AqizaumN{RR;wv2B<% zB=102*Qok`EYsAU8FwbR2pV0 znlE5tq6AiL43Wr@90>3pD0DcN69GcDp+Dv%gb&^&adgATOnjg6d{tCZNSVlEmqixP zMD`FnRIF6N96a0)=ek!c!PgtA7>O>zg%#yYDh%==rxAB{gO}PrGcDkRDVVi_0n(T| z!nIqgq!3Wlhsc3+Sv0=&(2%jdrz=;~{Bmrhe%nT?BXr91Ovf4F?~cR~l?dSMaQqzK z>r(~JyZlf&5D1R7vYfU{7!4NWhTV@`IjHps6q2Z6*xt%PKmf|J(>q|HRHZz}l;}*2 z(z-OM(prlUN>KKr3pHXA%Pyzu`2{=y6;9p8LZV)@PuH@ABG|`m9BE5e1NrAxSH`dbOAZvFnuBVP9(M10cLa zKxwz7SG65|mE8;=4V8dijeO)y*^>OLa=n5Wjy>m?*kv}7MzP+TW{Vo2347CYQwn-a zm#qXes0iLvYgG!#w5Y~g8GTB1I?2o}N2#e^ZhflnZyOekdlbmrVDp)Y_F?rwPh{g*U z6rBnl=b3>dKyvyN??Kk+>$=P#qTOi1AO-XwYk*?ZA?_=9gySFiP~MgQKjs0kSON1bR{(slgQ zk(9`@0@OyWieMV2kNn}|SSY{awRMKq0@cRxqqEaqRvqj82D^^+#4paWbBdN7snTg< z;@jeLfAlT8NqlW8L)Fo>&VDBkcgFy=n(kN&Amhp*Q3wr1=?YJ}I?4(d+hx6o&TKI=~z!L?h>$XObn*6!OA1&7U%a7hO2*de<@d+ zq3)?T^eEO(HdH%YUz@O?)mYBJ&fz~Q?Uu7$5aqn7wp-4OCCs0bH(JgtOPDv+&A8Lc zmy2_~k42@`a^~%tAccFP(Q@WmVWfO*&O=|mT>bUEtg{W4vjNuWe?!ZeCAjJHzGOx7 zmx?46J4aC)(hAIto(6v9LNo?6DEn%BU*0sgx5wk{ZEc2ADsZ07M&A&Y1U&3#hL+!( ziVRei!tOG}BDvJxZu|3~@BT}5fGD8j)4tn~!ceFQ29=Dv!SGct1I(!Og(8wJj+Rm8 zRsy(s$wPpNOpqNUG7eVxt|B;IvL#RN{kfJVDv1FLGdGap3#pU%e}A5)EXm^gN7QD_ z9Ju8%)m`P~VesaKx`NEqElf;(hR)?GBY z|JY*_;x!s{>{O}r9)QZEUntQC{Wv_&R(T)K1u970UAZK;g zie?#0lSA@1#LJYJ;f zh2MaZr!dpC>lYMedZCJRdjP=NmrIOk5jW~Zx;w_SSH#IvjOp6-6l3}nWBL?h`V?dO z6l3bpsh_i@{3*utDaI79rx??x7*nU~XBlIPs&6II)LTnX*vmzj>AypisgMgZU`Ii~ z^CY|EH_SP>t76kxqXY22g^kB~^lV$uI?>N(@S%AavBb~jTN)Ehz%DS5ge){acr8)I ztui?ZV{$}N7DTH^o@@Z02lxGhX-p;dC=)E6sT$Eq0fmzGG(sqQgBb(6`zYdZU31va z0twAaIr380b3`gGN4x{6#;Wi4ubcq03>ic;7v7cAgO*x%r| zMyU`4!GY^Jonel|0F{BpQ5a?SCUz6Isnpx#KJ^@PT+X7HN_A}SQ;qaAy2z3@-zfyoWxR_kf-I$?qR8+gI8q1^HhxA_S}#A@ID#=wKXFn zF{2_Q`xCN^l3WU09%Le~t{peh{>IhEI7BA6OhVy@_N>L@K{ z(c3uwz+#ZEJOwYW$6Zw$N1}hr`Sd>Xfgn_Gl(7f@TislPmGAhT_0r`9u6*mO z?()|><+%flP3arq9c`7+9;zT<0-_!?9IaE3X~L13 z4`E4$1&C8AR;*}B%@hTExuoI+y7U|^YkLHb{d>OCb|LY zqtI9~G8aK!<1khh+4LT)iH}m^M{mx~2OSu_qYRNweK0_`(`i`dsOL1~f_xkE;D)?q zpaf|-qP=@|>6*s!G+t$v(`mT*BFj%DcYm=ZchhON)#K+}aCb@P-U}CAGR7g;+jt9j zqK{9+YqvgM@VimQN4a35$RUQ+V;FAOJp}uD4upEGq;Y2)9071&icja?zWsx6u>%%L z2iap;uotk^Vo$ZupT#}kpe=b4Wjyr-Zr#@J;VB*PI952Sd`6DhYGDZXs=M+aqw?65 zQdgY&mQ~!A@02$w+`&ESq2Z>}dM^6d%kM$TpLrLvaVQ@9nFsG-i_mVDs?gdgke&r( zMNzj_vq*9}L%l0xA>p?yO{0(rVtAk$+U_|KB#GkBH||fhaGz@7+Wq&}%C|u+FEMMl zhmfCYU6|7A)nbl*A9-e|5k*dl5k=vFJY^wKn*0}4L}^Vp{5cm<>MKGP z5~O97)#*}&ROr4O;HWh5K}4`bMBwzcV#z?bgv#hL z9P*W(WWy)f(7J?(PZBzfT_O|8o5s9IzKiLcF!;w_7zz1ba&hqvJb!uOs(-1#bahr3 z)H-BKo8=S8hQ${WqQE+o+Is14j?FsIcXVDA6Og(T~KH*`q>s@#1=gZ0+Io_IK*sU$sQEm<~l=g|$dv z2{<|2O*L&*x$9AUr%KfBe9nj{-A{HeB3Cuk0Un{w6jupe!F$SK3S4f*S9wf3;uq|4 z=R+^2i5Gw2QY};!zb`o_2q%5V)b`os@pd6GY>y#E-O>^!3 z{-|m$pS*eXYTQ<>vD^IBP|eYyR%0jab)?A6AwN1HJv!#2K3t(jM=w|nipgm!iU~xw zIUFMH*d@KtI~oy7no&qxPSiS_l6LG7C&{Z3Z>1G+#DR2ye&U2P;v8t`iY{UyhB#1l zz!Yh~32_np){#UufDY2H-e@-xh!?hpZ+e>tj>l%vJG_JceULhw@i{c!h9lipRE{;2 z4M(CIFXK$SOF26atDnH&NVW@Sx&{ryk@7ma^oB4nHZCdPwMlsauRf?1{s~S#$xUv! z6n18kBVp2lMp26`;Y{~^%~{cmDB(=jI$?U^NO&?)zw9Y@qzLC6s|QJ#^1%=AKn<|O z7>6$#Qj*HwIn%?Ov|YSeYdq6PjNQG(`Zn9!!YW6Tamiypi-m#stb11*4fca~2u*dC z*N+#KZ~=2$s~ai~petP9DN5ksqXcTA&|SEe6{lW}L;sSz(BYF8+V(<=5+b)YpaP?E z6i)e6)k4Fw!0ha!vr`hJ4A3EHEXJf4>YMh=DS27Tsx-^ka^+NM;>ij9?!02^1K>nhVLsc@q82NuxD}5F>FskdF>%_Z~fzg(`d} z;46>nAWCRZA8bZavlvU{@&pCW77P`aGsx91=#+J2RFY{N^E;QFC<)r4id-l1ixq6i zl#ykWraV<1Mf;N+efycz*IA0{XsTjnh#Ieg5E|v zPmzAc$(H)brB*^TgFHR$smLL{%Z#$9nNhQ1+yzJ$+y(46ykfD&^a25b}r7oeg8tPFR&J#zOBYx*oP=K^I@||>6M}BAu+7I z|6s$j;e333!n&1EtvTn$XYjy2(-+G^9tDzYCw!%N~Q~;8XC2x`w-s z&ncbHTXNKC7)EHFJ##pR9d<|O@?!1ryWO@66<6MvBjzGduupJkx8|9-3MK$Fz=TVc zZfEYok`RF7Hb!v4Xvn&A&7JAF7&)AYtx}%xpgShlU5IXGBt7W4vHFpjw2sF*)F-EN zplkS@zKqk=1%Rv$q|`k=tsmX_!5N)5F5J(}zq$@T#oZcy)vU|=U`(U=ykYxRP7r+1 z)HhLY!g=yto4?N26qwJNVnmCeyc4e+{HSe@MV&K7)F{%N5O{ zX%t7uHpP zQ8E|TyX1P6Penex-X%OG*CL}C6W3iBID7u8gmupnbetDRnCU z<$h`XS3!WTrTjl(a#7Mwo+CoCL0j&Ro07xkF+#W z-<#J;iMk86_CXHdpb-CtUkw;_LRt3=`aw4&w2v3l)rVR7;HH?D!kKxhkR;ulk18O$ zNXM#YYR1<1qx7iYjp`^njqM*7 zEGg#{K!7dIjvo1#2Q)5Paw4pHgM7eme%?I5^c01(f1;zmPe#A}^UhBr_19PWmRs3t zuLu*@0KiUl(0c!N4&~F*z8--Ju&kR93d9L%rmNW|%gwAP{2n_9& zCjm60Y!;Y37PCMyKyyrVb4-YoM`Yfj21nP5?31FirN_hsZsl=&PyUwE7&AODrPpnu zfzKr@yW{B%jHnK$mgA(3kMr-2$^QPqOPqqpDP0}tni&G6=s*fV5O%;m1q=hN56M+R z_Q&M(48jMx85+;fiOs?>IT(|pqKzfJSJ^MK=#%!iP$}hv0ZqGCMogzHCOg+(jjvx| zl@I-@`U%26>1xGjN~XG;PA6HagX>a}A)&GSW;2IM(!AP|nq?%|)s|z14xlkwQw<-i z>ndd|T}BCFy@ot1O>-w@@F?!E@qA3Kwq~4<6&BSv;LEG67gE%{+R}q_wYA%~!_}!$ zKUYijaLhrfpda{+x3~M;X~s zqxJ%K-i)VrG!3;Ps2hd&BZvxhE*-No#WDrwY$hB+bNwPcE!sT-KDWwQy^z|FK&3CT zW8`orvXmq|!B8cZWQCp#S#1}pY!|$_Y<*s`L!#R^8xEu>9tTP(Ip?-k@P>1B0rx5UM1u8m` z)eE#Bl#7fn5pgKFR|lq9)K_lBvJ^F-g7bkrbcr$a$T22$eD_r;$V?atn{)V97;+grOUV3S0G#O&5Vj4ZAKY)VCEgt$*a3~r8Q_8H+p zHxi0hsKHeZvjsC7&%X+-UF`Fa*H9%F^Q5O&O=r=WS(@FJd9=vR&TfHBvkS8!#povB1>t;<`EOS zME*63qh%z?q70d(bT*3uA{KPj5Ifa&Nhx!l)08F|V|xKdw}+}NtXbOBG3?U5RP8_8 zC5cCm*C^LL^64%iX`Pg*dXcyax}OX(CD-3mR6ht1V>_lFLev5l_wQ`NR#kWPDmh+UH&NnIV%NS(YxMUKYKf9uKX>5zWvx!KWdx%wDFFn3V8aid_(8McUlhBzMm=Q$fQN~kk)z5lIwoqCFVEWC_N8=%AHZ+>9>ji^QZCi2 zEMlJ55!DK&H*HEpuwYB7@T^gSQCbz!_NS>;Bo$-7ZWa67vJVY6ajI+`g`p%RtYX3V zi96y&FY-HbL8{`uFSN16coZPzrr)k!Fy%^t5F@%;u_P2aU0DaV_9Cr7BkD2-aV&aK z#kxdS2{}zxd3H#?Ke;4(GtR*Rv9~|&$K00pBka>5k+iN7ats+nhp-^XsCQQnLCaCZ zueNYdM=LIVgZ5!;>w1;PLh(4Gnr zULP=a1|74gxKA0xGz=gbC8ns$nCx6IX0T*3&SNo-ST-B;biTL9mhoOX3*^*47g&;D z^m2UQglg1uNj^6tYsL2!4%`63QXaddF-uIW7=)(n4iIq(m^D(7K{xMBz(>*40K%|S z&6M&)L?KJj8Z&?@#pN<47x`4k!!*hC7!RPj{^3IoJiJQZAI%euT#eq>`3qzZhYM@SoDWi3 z|3OR3|L^&)|KtC^{nc--M&tkUm#a^2Cjb0@|NNVN`ZZnywQRgloY~Yt^CQ3v+i>Lr zC=(N4wCQukS}w09zx@K%%Lb-$h=Pt+Po24VeaM6l(7f^T2$5^+feRFD{Z&F$izAT% zwAu~3?=1xmn2`0(;O8xAA2UqKmi%@TCb_M1ptLcidY1BKA&!={>E42n)}}8t50iXI zbvzP;_99ven6wYrF+>LURQ*-#l}!&%*s?^>kNl3XWaW@%G)rl4!_q=x4tZdt=7Tr; zZ;aIZs<+hKVizd%+Wiga#s{Dr7yo|QkLHyA-8MF;okD)Hj0XExTmAe_7LAuzTYs*z z8}y>PKA;DWWhoeZ@I5ly7hP4inyxZiykHpwPy&js=o!;hT*gdi^VqTlvfpAakbyLl zEbZ4`M4QZC%8u8IrrwTndekvmvE%hOh#K491MbHs!<{SDC&QiV^<=p7x}FSo>UuKV zJsIwv40lh4JD=;xaOZwK8Sb78cWs^NZ@3#C&Ga6C^*0p7gv1K$3~#E<(Mv$tWD0s` ze-Lu669VNi2f2-F6;VSbGJrAQiN85#nrBuLr7~O6%qHp|&Xrp7h#huyqGH-Vcj#4- z61)kUh?PiKKuGm7=oT3ZcaW@W>P6@U(~qoLDr2Q9*pbI1poveJKKq(7GUIuoVTr79 zfVgwWkL}lCjq5OFBux2gC8c<6L05@X{Z8jgL~PaofzSv`M6QfQS6k;y@c5QNx_D3H zi%GWESwsj3rgEF3esicm^{$c1A^DERf?dN%sbY+?XrA{D&5J~l$c&xNlaQtHJs@3| zl12KP%XJDmV44Ie7h>cGTUEWxc2l4OU+E~quZEoSh+!{m*c>vwCzPD)<`B=npRGLm z3@h-eX$@kL_Q>eb0oT^L{H^*}$&t#c)lI^{n<|Atpsz;|?pNW3uEaBO%LZxAYpkK+#tK`=Wu^A7|%p;pg)*)X+h923Bg`$6^9#q&4%l>*AsdCCQo@V8e!o&QE+N6yYACi1IMJHfB zC>{hV^&(Kag22a)Z-Q44;EZK{0roUcJiq!&iGL_vmepc0L`_>8>SZ)vpm~?2(e0q| zFot0>9u~Cb5Rd61Qm}3P1s~TMAnli`ns`XwyngL~!`w(FN|4M@;i;=uN!vBli9En# zImiJ#3|69WI6Z=I^qhrJ%7Pv|xYj$W$vp(R19~1qf0`AT0v%qZvMsQ~y{x>CjS``e z`ZwXItd>B~wEOx4v?W=|uOedqJz%hz24<<9;xXL-wLxh>OG!Fp@GZ{OAWeABL@VmgLL+((@wA z`ns*~<$mhrKz5FS2gf|@y~34i=jEgygQ#o~(;dA{q@dZ)DQ{IgC~p|Eq#scp8MfA5 zPWoz^quvuWjE@dbwz>=7)?MXwh1GCFmSo1h1$4d18YFtK*sfOb{g@mHREyB8b98p< zO%;qGVi&rk(zjzO1V)`k3Fu&H4@0nx+YNOGu)^607Ve>f(C;;u0zt+XECM8DrCwtF zWDG6pXJEEc`L4D~`wXF_vqg_EzZDH`=$!2mRYa^7Q}L>YYxXFPtFZH`Y?dm&5%j_I zvvH+I=1kMmg~RV}8~BXVrMnDM=D)lak!YGS3?T0_RR))vrMSab67W2wa}3z>uStQI z1`n@H8pc8CDeGZ%fhuunQS4k!pXwtHw+0sXCVk72kjsvqCaPRxmZxmDC`Yv5cYS1u zfG4*sokP%Qlo+IWLLna2q)~d)t?n;fCwgEWA{2N4RQ)I^W>Mq9Ta442GBVn+n)?FB zf7ni&@sx->SeSXT-LF_Ry2mPGC18DJlqc8nxV(0)VOqV4LgiPb0tr`Jh`SG4V-Qnp z*~@+Go4ChR$13ZsC%1)KCvr`xsALt}24X@(orfOdtZO-72so`oZ4Vo1tk8iu401|S z6))Q_Nm$Rt4|RMm9b;hO@qQ;Q^pcqHKxasnBF5ryVEHPSai#D zNi~Q_?$KeTc=+oKef5PAsTFpHP{K2K2nFrv=tW~tC6M0Qa$hgi$Y0IqsVenMqU@78 z=^aqrFNC_g5Xpcjy3X<=!-AdL!<+jCDfjkbJXRobul?p5Y&;;m*u9R3TrgfMV3XBD z`o=}|bXh%EcyF)e;OnGysQ}W8Y4qNGJ*T1fXnBXwwg=6Yf?s|5Uk#JpWVma4fU6y- z>POTLX>ATo^`NOGht^8*gAekh3Wq(~GPXy1C&1%+`?0VZ%@jvTO;J^dhdu(>pk_ucN-Vd%l-bzMl(8 zm9Oq25c+hkdOf#3PV$&Mr&_J zzq6F9@<2Y88^kG46?_Gh++B$%mM4ndLhKU_ zvVLQ&t>w^2$W{z}94b?Pm9iiLlP~olS}_PJE4&yJwMI0c0a>v$kdJv~rYpY;QS+td ziiDgY*@WS0VSmf1PY(J1WTFj&P$!%x%&w?kn2!Ch;i8NzsAS66Q8G^%RY9f+ne57D z|HD5SQx_|a*0u=E3K8;D509rrhsNm1E=jmm7Fnn4n+E;ZEp8A1TZEpKL|ZjDiVykh zyo{55TTCjN!aC=-6fh`#D=(`Z5bz{ppE8Ak12H!~64>BVW`6=#pL53Nr9S73zk$yy zVBXuP=WWjOGvq0Eird$gk49a1U%5?+3f{uFEuE;+)hdo~pO-E9fD)(#%RI(PahHz# zgw19w$b@7;JeAU!Wd9b3t9F{GD2qIm!dmQR`n0zA7|-5-CL~zUWX`m9hu&0={V7jA z#zM*Dtit|;#;XM-LLMe#jV`Yok|T65x{Yy$;|Q;m9LmtcYBhG8N4G@*e(s}p@6fcV zSAa%IE%~bHdYFWpm@{&8+xykDEr!~jWgDEclXuNy+Fs;K*qs7s^VKTI-qjk`RK|bV=K)>6v~;D zjbkPkqP4qx!>oB~e0L;{W-Pc5BwwoZ92e-4Q4g?XDN7|*iT@Rk5P6V&TBS_bqX6IK zOjwE7p_KcgL}RRjE~r5CL|8=d+5?1zWHADHw`kC39%-H}&dhoEX> zoUrU_>&3XQ1KN&#fJo$-4mOf1;94A+Pj4-T-Eg4!Ncnx!>UzO!J*bbDIQx0M$y#Ua zrlG6`09Xyma(hg$s@`!KeSoRloxVd>+eRF}WFRQUfSkn##dzvH-+eN6AIu?4hHkk5 z)6;VV`^7Phda$w)Y$?xIJd>t-g-WG$0df7srrP+r9x41S$@?f#GtnbG6qES|dS3fV z1T-ARo41a_P!bUvs1{i&eO5&^=v^*S*FZbX2wkmMBD=}~`cwlZD<6q3T_Jc7QK_~X zC}69!i&b>ZlWWVPAbZtX>se*3yS|#A zcS>K)mDQ{YX+7u;s;M>%p<`3%95qLNFRJae(?GK5MYpzUTB-I~FS4JpURrylw4p`F z)@r1!RXXcMwp=8vp~hJ+%6Nirwz^qkU9+O+z35gdnr*l)SzARiU01B%R|&g0R~hI>t8Eu zlU2fc4fduggY_%s|3GE@y9)Sg9m|t!Q|bOv8GcWi>qYzP3-J4DPBrEFKX>W zQEp$A&i5qRRcOCjH2*>L%>&<|_yCsDtYg__*?8Y*3Q_Z(do(b(sVtUUd;7mdTF|zOfRMD$@HSHC)10^^<;YSy`D@j zmFvm$;@IlHvFT+McN8J_ zq+-w&9oK^`bwgKVIV=|D@ygO}$Xw4D0-7F^OehB3Iu;0yz&dhks2 zF1PK98Q6n#U5V`yz)GKiT1OkKVhHx2+Kf6_#uDs7x&?i3NU__Eq7drK1&y!=*>V}| zI#j|w>$ZwxSc^{BgK*zsKws2hvC%@;gP2p_X?Q67L%Uy{IEcL{S4&y1<01AUTftDQ z!A0zOYSv*XTKI^4eWDx2RMb~*Y(;$yErvL_6yl&lh(pSE^>=Oc^0oAIPW4S~?Nvg0 zh$p8{*=VPN(VOw+=u**@BuNjNjYXm#B@4B0p=Y-e&;E65AEb1rL($G2LReQp=K&H^ zA8F~aa_t|xaC2`ts?Wr9mTA@t*w-D>y4=+Q?nkqJx$82^zK*e`qRjTH_oO+vKKGIjNGpza&Jc2zYOw# z0?00GD_PuLg4ly{sU~M@@nH|58a@93$__gf9PWuB*i>rxGYxZ5GE=2(B&p>p`=&IB-+3UmyEGxh!x;nO_gWCS|3&z^|t{;~`4>Iu-Tx ztcui8&UdXmuh*=t7xHZ>%FklgFznqkGTsLu~EiJ&u84&^qK)6lm5u zo7Qax77WUJ5IUz(A~Jbw^QAoZY#MNSufAtlVQBp=0wJ6}^rdcGgF345l3}J3UDKmPb>ZtHIMlnkhFUc3qg*mRT zug#j(3#`cI-@`mm1r6#(v;cOzWvOH_Hax)X!PQo!8MmHp?cE-z-pDTF*ugo9_N$Dm zVlZlrI4&$T*Si)aRFYtt?#apNKM-sv~FC<6ca_<9p}L#S^mNcc2HU1al+C z<3w3(!8v835KoUjyag?5&awqFa#h03c7Ti`zo;sV`2d!Tp%6HhIIh@fp2($mwY5v` z7LnsfEGW(z794^aLmEqf-Lmw)#KoLl24^Y%bT3tvcbtagTN+C>B_%1(Go^f4+QytE zETx%i)ti(riz!!?dRA$~(6YI&K0Do#tz`LO&7()D;8%7ugpPi7Yc zDN~wfv}7Wq%a!XoxHQ>QbhTm>N)I7+hMdiKwV+d$MFEZR+nlI^!R$XxoaOKK;P2mE zZ8goH6IHpHB0Jp+v^UA$K(WIeSj?gu*KM2rITYM6HBezx{D^`iw`43c<GxQ(cvW}RlF;|(Vk3}e4+D4B0d=;Cu2x~rY{)Wi(yb6@ z1zedo-DY^R3RIalWeeI&uDU;BikA+x6(nUV=B$6)msA0g(owc6C5fn7C$^7Q3a`R1 z3&#Z*Z5EMGy+*jpK9l%8*c{^cepm9zPq6XOe1lq9FJ3jzqYy$vOv=akcgKf@mE7Ik zjni2$Vqui=6xc~R3p6(wOV(nul(BzuM#|f@&=@g`36_vW#acvK2dKhwAu)*LRM9# zQh(7;UfM0P7I}(`u~))sDW-|+z$d>bCuM-k+MDpsIh*G(O;50Dal{iO8_8Y0_M5*j zQ%IXI#0x5FN>}^u&uZvNKob+-bN2D#^ndS?v*YsE( z>nvtc_DUIrxU9-oY>Tp~-+v48!a#=#hzTuHpVEU}^$P<uvxy>WSIe zjn~;nA0lQC4aMpliqkph-03|XeG?dar7!lu<_+gyghk$a_J{SjL7lF4vzWqBpx;*~Do8@@2Zr{Kt&&VsgXT74SJmaZ!CvAKRsue_FDiv3S{C=TRrBT-uH#wSDEjH`~EFhLWNuWapYp&KO<8fwssxAe8P_R;o?uGe$6A5Pt~l|2|u z5dGHkhDH3Sri`4^JZXnujtt08fHd zInn^k*~DDRod4;VvR)A zV|poNDepy%*OY-%O`cqe7ipiJx4-mY{Pp-{50B|%`U;*5`ub`#=vTI2FOT?|eqLwY z_a>}RwcD)w-Za-}kqVQ%bk7qit_F`l)xz&hx4|P&vhe$_u?~-bvheqCV?KEVTHk!~ z2-sKifj8uY=^>~;xdj@oC%1rC!@h2T0cob+I6dz(q8^>`m|wRZIJDjQNR+JdtZ~je zlqokoBBZO1U}|@L#7+MwG2hFIo*}zK0=``F1Tsw#V?h1WVSPy1Vp`yRs2q&zX$0^p z;(C`{ukxwLr`Nku-hkRWOkBH!Ie>UVbQPnbSKXZ5gPCT06$Ra6=tI#-;xA7MfFhN_ zkV+G=i^2X5gQm^oEZeoKEP+36&N32ZgytDvQpnqh?>9J@t|yTLlXT)E&KtgobF>oB zIS@7PmFDidJORa4zaX~&A{~-Ax?$vYe>@pa8e4A|*E^ox#GHng4U4I4q(O}?%{4v_ z_Gp*fB>XP1k^;zEwu7_{8 z#T&{i(h&2SXnfXj%5-e|(zqW9!GlN+tN~PSUL_6t4JO9>bMrLr+#b3r*Mi5PiX%{W z;2_kwYcvR$uzpYGo-4iK^J;G6T0DfjGkq)Lsa#y8d->FiXYrM~#Nj{w^{m(uSfYZ3 zP{IVCg^EYI5Z5ZsQyQy(+8_Ww{rMR-&cYv&fx*pRJzdThU$I2<+`S+T#a@<1^Epe$ z_jDO=rj5yDGI{gr75sNHnNtF4^dOdmh`qkvkzjPAN-0;Hq(6j zm5Yp~znTngtNL+2lZ&pRA9cbcT}4a-7ztHUZtr&g8E!^2MV_lY{Z^h&un(UtSw=&e zQMq$5*-fP+mdwzT(UP)Iw^c+L?_kksC4K=NygG+9_P!%;%OuDSHY7r$QB*TPs7jt zwgeiB19P(eLoH7(lLSUNE*RfWqy0aRD_~AY|DuXjTSFb6yxoTscx~&!ss+V2$+ zJN@zHMdgR8@Q-7u<$ruym1ALM0?5(XsYRhlPO;Wvo1nBUJEr7STTD_jC*>sU2A}Do zFe=}s&iKk_Qc=SbZVbn*0$a@EP+=`*BxM1gC(+*xZBv^emKtGIAb@p}&={rHU950S z?@7v_epH@V^iaSZllMGjBuZwyNV}Owncjr~UoP_`%I^0-FN&sl##6BuvRfAKiD*8e zX|RYg7G!zK_UI}aLDv&lFXLtS+?>VRwFiHVOi)*JusjdC93a(hHMEDC;nvsy=O+L_ zhaG?^sm=k`)iN)NVj|?QL5VOGPNnmcSQ4&yl%O*wh@*9dU*ywelnFbbe@u=IreD4a zX@)?2-r0I%7$XEjWefq?Zt`(r5zM90cDSjo?-Lb z;%d_~H0$dWY&9#yl4pY4^V~)?q6LJid9oQkUSVtlqN27xY$*kBi}0lGtya;z*_P(6 zgmjz2V6d7k4(sE!Ys_EpYKL{9)$9QTE?`Ug^Z?%|`eEH1(i?|Dh-;At@cgb-Kd;=K z!UB+Sr(%eW>)qo^y39zU)`=V0v(lp2Hkyq}V{{5@xU|86JW(eBp<43|3p}Uh5om2X z=JR)w33hJ#OQ-@lpUblWAbs_AwY!Fynk-dl(p&pm^(NP?gRNb%^>PdA{Uf<32~tJ{ ze4gc`Gq+2Ip{@N|@bA`X7WouIi0V-_%G!JJY-t`W8g;W!`?1Y4(_-51=0QfRbliDG zrE@9e{WTBg3UMvTnw|R&93W&ge8;kkr590h$|+2S1f z{cu-m4L3qN2L6yn+B&+Rw~Q>J`GTby!mZW4v!F>q%aqVm)SAuMZr+r%-dyHOhO~;{ z>sQ%|c6Mrv$ljHqJscEnrLfnlRzGB)dU&!vlxliCP@fzt3)dg457;|*UrVtZJ0Fz` zqw}H7_-+Wv)2O}kPGjNFSiu!9+kJfw4GKTL3R>&i5?2N{j5ayr8EqeBEhBQbz(TEX z_}wSLBIOCs1qo;zt9-a8CiuhzpP1m<^~40b!W_!_g?zTcy41Z*@Gk1hyf&aQ8VS9R zM%Wxg(B|8&F<|ST&@xiQ36<|QpZwN@(G>tylr2i<(&eu7f+g5mc#aJ_T$%l!zD0E`GRo(nDN~fB&H&B z>Q`4>^2pZJbOg(B+64qQA}49eQ+O~+<}QY-wwH9nt{puU=ZuDJN}_Jdh8XXD{E~kc zCE>}ZNMtqMrG}TjSHR`R4#9GjS1tk?v+!fr;V>d+45H|c6@atrm*@@e#F{J9(`CMc zTzh=ReLBjtou<9=Y}eX!k=<)KWpS0IcVw0(4o~gDU0pllGR@g8`Hsed?UFwv5NI`s zO&Dx$S5BdyU+d$bUbMz8uE#9$nM1qX%*dJZxa^kJXVg@+FFi;SffeiYTt~;-H^~Ns zo7U>8EhUS3i#<<)PNl0H|FfWJCcwAJ^K|c6{&NFyK<)8All|9|mzDURH*a2l{S^Q6 zIWF*rQzHTgG-Gp~-XD_FWR_Bqr8)SrpAiyA0ZRlEhvaBQg9RHMj3>|R@S)p-XLPkP z|J)xRyd1xLrVBv@AS>%CMgdhEWSWONQa z9T9bJWM~=W_k;1L@uz21w}o8O5U!9wc#HNm{odrTkSLj_Ob9#nTovU@Zv>f2RuV!e zu_+Fj-12+CVZA3*K>oe#1k<;Yki?vZWUA`OjGryI{Cq34V3AMlFVuT5OBvf+(kLl@ zz%O_f1@e0|1$&UF5G)gWBBQ}gv5TYST>m|SpGF4lr z*@!UtUC%)Egf?YIG8!e|^U`zpt(lWNjUB$}nVx#2X;|i{?$uSwB`ek+p+t2P>2JTDzG1Jw*{A#aU%#2orr)qvVK9AWDsCN;t%J$I%hBXuH2LOo z|F?&e*M~0;#=ku{c>U^|{e##4v-R`dm!Iou+y5#waj*c`y8riIzuDif?*Fg%51#h_ zXStp~C;v;Kn~?8gKBch*Mf2?WbA9tI4{lhBNl%q05G!GqBwUxSf>2G!+T*t@O{0)0 zP=xZ!yI3eZMB`?`hjvYwJ+#(qLoG;mqcp*O$X-K)c^l?fReg2%B zj3J}w`SZ0wJH*>kB46I?7k|(0@#hcdYn?52_sQrTkkzpq5z3k{5bYt7Z<#jK+esbx0G_Q+=%do$+Gns`_b}aY(9E#Tt}c0Ts_DmeA?h6~ zBdfUgj~`Cft88X>obVMU5tQ~1q6?tM=sjJLi&7Y*j?o4n0?bH>??)Q#pm<9iu_|7+ zT;g^|7p+<5Sq}V^eG1}SM7OF4>@_}rn#57UuH}wLmHHvGN6i==tfwceHTXs2cwyEF)0*eD|w6+K`2Vl zlAC6I?&UP;%23arV~{DtIy4zF_Cg+rJxpNQD|Z7bTN$a!T6)jyZyF-Qb(_-hc&x$9w0s_kf;#~;2f%HtOY7|&S>TOPKsUxazAh5=G@*TEEY^o z6g+-9`@pj^OqJW#1XDIEOf&^9liBCFVCiU{MsSwdTDXKxQc&Ij9 z*LVj!3D_zV<-=o74!dr3v`QIU!b*|r4R1ob`Wx2zSLmFTFA>3lg?Y?U_zF9C^yV8u z%&%kzt3E-_h067L;r2nefM~dk5~(DoBPr=*EVb5@u6j8#?TJ18DWwiJenzG}^gQ`K zrGY#;BOYF`fG43Kr-@{G^3Poet3bntU4!3s2V6_5G+{$iCf8XogRWU17<1-Vqe5d4YQze#aKel9Lm zBa!#~tdZ`-NI+APN9d+-E+LfdRwF&?V%s6Q_>9i32cqed)YgCgoam4)U7(z&nOO55 z#$cBb1nlnXBWD=dnS6WvDHP;_WkmiLuu&r@vT3gl7cxthrBQ&S^xtjdFfPHOfUNP8 zobqob6ND2`gy7DkwigR7vZFYHG(Dr0g`uT#5%~zA_>B8(D{ve!N?0amK1$|$Gz>?o zBSa4N7Y7|902Na`@~=Sa0>cC*#TVkRr!fl1^SSxPe|m#+Rp8!fp?Gnd@km#G#D zw{S;;a~B}41k3iGBk_^IW+P@cXSrWW&aRQ6KV>OBvQ^^~u)5H64q&xXQWPp=TCW5% z{YJRfL`v(u{A`i^Z?f^hHy$mc%yC>S`6b}XRSw6u@*(flkXToD;AOF=-x^`->fJvw zk_(hWQWo&#k|iOiuU1aFP8>Du5@o)K8NF4aHLwWDP=bi(>eGS+k1*K}Hog23g=kJ= z!L5wdU_p}r|0_8}nkR%OQX7g=p5TOl&K*Zt7Bl_Psx!Mp=dQnrvVsj|`Z9+lCQE%~id@$)pkCsTPM z2tsEWOUZT-9<@Dg5PdZ87S2gk885o4mJGRDM8U$?6mX3x^gzH9z%?uKAYh25+t#RA zlg-VVN9r0jr?6PjyF%-%M1?(nPEJ12bV-6$en?(TCQIwyk}W|kIe7ie z`^XkE)$6#s?FI^xy5DPU>^HShZo<6Z#6r-ZaeV$(koT6MM`_@@Bwx)_8ZuZWA&Xh2 za-%ehkZ+n1D~PqI>R=pDuxLf1&RWV2JZ8YsGP%v<+RtDco~l3}q06)HKm3 z(^Q`>iKd(EMq>|D;10(99)%$g)&GU66<{6E%_+DQg)2l(!SYr$>s1@ShACXT4MTHn zx?I(8!NNsy`S|5^Y!Drbu zz_u=E8eV&zzDkytsxiBb&^?agCkPM;582*x!1;lH>;8;r5{_t+MdpstbE+TPIxI;R zwGEBkz(&XC{87he?W+%o>}As^DSwXP+9i!#rOT)zCF2_DwrY@{vKdbq;0wd)Dl(d8`O56T zGU>(+VX209Qn6%0oTYrqi193HK_^x}qo2qq0PC-IG;_{q7`3#M>fh@cD!<&((glu2 zLpy4$>RPd1EZX?M<)J+8KUBS`O?1F}x<*9aEqO*8 zU)RghaB4lyRW7||;c?z(WfSDu2J1L~$OoRW!}T+IxBgf{t*2(i7)QDC#F4uNOGuP$ z!%{PYrQT`eWs>j(R2t)HF=)jKUpw8r$Ia5Ff%jltGdXnjcF=uj>}bYgma5nXy&*5H zdk-|d@{r76DvJ*674|sOe&dRSSuMgg%n+A_Ec3udWe1DyUP<^VhlJExz)|i#3Id)d z*;skSF#(NGQvTUU6oO7;F#;Vj^@2#s?v&do|w4 zp&uas$iFU1_b>SkOURM_(Wq8bbuokA^|wO~S6Y3@sriNwA4$1FZcI+NJR|3M0=7|}kd*Um&0pfUO3W9Vb)xR6c3Mnhv8|I;0s!|^qz;VT zyLH8`ofcqy)A%im>AiMU!auY=T2>Vy7ztj%1miC9tCA1&2YyHREJK&)ilsB2BIvJc zZ?kC0c%Er`5R_%!$82?i7#dxaW;BZPlwB@TCKfyn!M484;c>aHv*?x)^-!V5t9GEG zn|v?|nG^=)bMlA)y?sG%aA=-PR9_sFndT^G<t0#tGne%IwY@EoLG6l4+$37s(yM?xI6Yf7hczGg?+!R@X~852+O3^wh`8?Vy%=qH$jPB z_ZBD-AG`rd)P^ko5~0Ul{H4x3%F?%cP+9mor0o$`zL5o4n$1lFwy{pB+s43F74Pup zji}ci^golL?a`x$Rk?jS^0}06V@a)3z-v_SiW2UuhSw?LZR24@$-j$c3?c!)Hxq9C z3jQAWc_&IpNbkjq(s$JmIwUXOyskIr#o|Qe6=3*k*_B=X2{}nFAX7DJ81U?!9zz|IFZAtp$<;ful7Mu(9#FS-s zj3wkhUrr{I$>`<5*KfZ5o!x&!y7Uc&qo$!pfu51IK~i%?ipgT*`PeK1^Wq`-pevK; z&074_*?!Dv_^pDKsp-T!PD7%9x4N>KH7^(CNcKPj+mynRNv*0F#YIbOn*~5ZJsPF34@aw%-%25AG>cMpN8@L+=dr3!Q036ScT{7Q60WqWDiDWi~@`P+P4*1 z;O!r!6B;j5I-5m7B^613n0|_6_*jvcNT`#FZ~cZ@|zS~BH{RA7TGc$EBc<)zx-Ea;eml%gpWBX5A;8jen^bl94 zuwX(&JTY$L3;cK4k8I_rtM_(wh3_rNX}1VZ$<{HDLmnxLTkF*N#D5Q~X{U@u2R56wM~TsC?$Q$lo>@1zAReg;lW&6jVFY+lp&1 zV#L1VDPcvV?(^rQOy2^$KxN>b=c&ppE7CndABMa`>-Wk}XI6?G<^UFPl%*D%{Mb^7 z4`^CWqOiVK{a*Rxiq@(=`=s>An(~8xEGfy5>fc3k@|SWugj8}+4$1z(%U4F`)*Wve zGhjRjej+Nc6AHcop(k$fky4t2dd-FQd#MJtHn7Aeb`qX0A@KlIRnYwH#$MF)0ExGE z<0QHLv9vUx2WsS?W)t*+CAZ|3rmDK0>>e`!7HclH#vNj}sOM2n;rl=R<>bSUfBEs~ z+)N_GEkU05Uv6po7ew^2KU0%(`NHG(R@(d~zOT}W-_~PFEmr?|fPPff+xj4I z5TMYuWGn9m+7bl7jFXh-kPe>me7?Zkl_Jlm-U?Z2L0QNCxL}xVX+Royig_~&rUTAV z=+x;D-K2GZ*?XGa)YBkTm@qVXIt4~ff>C?^oV-0bJ3l!-x;%M%2sSoKmUN{{MB*cV z;yK6%8eU5N|8`x6w$ZR84Bn0cQ;?G+kp$QiE ztF(7bAjV{uER}6r{z*T35KpsUI*#d4=qA1QFH8dzN^qcT36d0>|%{qTevgjh8 zjuq}fz?XZe!99hx_cA)y`EaE^RnRf)uC*X!l;1V@7gMU zK6nDdfCityFg(C8sw?^D4^e^N@iPagz>oO%L}(}p9?+xuoi$UkdZf3?XkC#k^i z+SV3x&2p|;(DstHTGH+8zgcgmV_n}wNk~o;k;EB zmN8uBoP#3w2Y5vNlG^tQU&E4qy2#TxlkD<8?7M$R3<7HL+d8(A6{J(sYH2{1Q3CbU zbUdn*VYPj$SUw8=4dxp+KP3sfvvfj8cUtf~4yDSNsuFF8pi*w)kW6aV?`VrLEM|y|&XM)OSWanhQ>^WEiYmra#bK!pag=9V1XK=FdCAtD zB*n8;Fl*~4f zM}Nniy<%y=lFXR*Iw-vdwyBA!f3?tiM(nX|4D_{z5m_1R80*%)vJ`$M5lxJ#gxpa6NGH zJ`bu#V^40_z1@*Ph#rlNRPa33+Iv7WkIx9np%`>K5{B{={oCVU6l{DMo*9v^(6aOiwMmy5N%z=xweF{;jqCzC?=KRCtA zLQ(gggV&}ARI&Xwsw;K%2C%C|*C>wOALgFYX=LA|d8)eDq zCJu3YmsTw&`EeDpXodrykgB@|n@-nE60l^4K{VC&tuxbKr>~)kj|Iu-~>+b9tiC1lM2%zQY?N zGk5%nuE7Ib;EhhAKO3wUZN=UM(n~F^&EdS%lJ5<2QA@24$VDxo#{#*i?aa>(-=%i> zzpP#T`wgq#4c^$HO{2YE_bWy&<^S-R8ZoQ92xbz^&aR+n&J8O}1cNI?>Y7JL{G9m{D*G~5B% ziDpFPE4lVD?S?o5f;6{Yf&1AoW^hi3{L0lZ+Vn5 zbJOlmnR;huXq|hiYUw#?+Szq57A2ITre+cR2+YY-#mt|KRKK zWIP$~+ugHo4lIpa@efxg!Hm2vW?aPKkR8iWZM@GA>6|A@z6WoSa*=4B(O!x71)s&LBzEPyMAsBw6XN8wN;Pqx=}~ zNLD8{0FG1%e|dChr1h`s4~$g%ZQZa)>s=TCisaGnmQn_GxLOy(d`r&_@?$-pMY48?!&>y@dnMcW|8t|4% zhbt&9)iG*8a%muBAYJN76+EepOh)Go?^h91YF}4iE%g*W50Xo5zbr_X(^fE-#<#1e zE?WP`C1Bt>6u1i_gn-bXa7WD9*bnUm7L~GIBihT$@k<-+!@Vd8r)@})vjBE1JLpgUe}}Ly%~;{=hwnIv{>6_ zC`TYSr=Ine;0!>jF(&LiHys#3tD@c7(JODOm5Tg=?^#x?nlqX$c2QQAdr$-mwk&p7 z&sH{-Cf3@>fPAr5x`PtOS}70CAZw-m;HhLySpl_K2QO<=Y*f}keI7x5HbUo-R*LZd z0=IE%>RTm?$%BsPPVU`~-(K$BOy_RyP1#{T_onT*qkGeL+|xDmofG7m@;YmGb?v5p z-DgiX7|{kN%C!;PRK{Fe8@*HK+KBeap=+b}Sjlv4eR|5OYs#vtYMwReb>Z~}3FSvBk9A^Y9~o~-&6Kl@T9RfhWWu4z*Fn)bxlQhp-tMz%%2BQf{Qq;)L*oeRCxFrPAj??!zb5SA&x1PL-I*KK2t4e90_@&U1%mh&2R>YN zthb{Om)ZNq%wHQpChp?fyG}d`af>_G#XuC}8v5OE#+x1dfe^=Q5<@rE@n=~){`kjL zd#}M5DG~$PgkT$bXr_O+12T4JWbF6_T)>Gk2 z8HBaKe`h>=8;LXrwc^`6oHMMsTpMFn7kN>tRwmKJp7t5EX2c4+ml{S6&AE z9$^A-fKGjwlc@W}!&}^}mMorUc zl%+Jihc&0Vwxsu9Agf~}dKmL0WU6q0JcZ;MQ|rVI*@tC*^zK{pT3{E~0^}hnU_v|? zjbX-N#uhXQp-$Mv#XFKRMEi(%Q8lsnqQ-@h#R3*W=@?Rd?3L10!!$=~nSIb(ANTR- zj!j2dY=zRp9;}4Yo5#l?mxDMCxLIaU{h)b$$;kpVIlV}bm1yBsv5-rUBTx0Jf&oy7 z=Rxy2ksJ@p+{FsA%UUm*&k5sdy9Ga+!n0Z1XKLKubCHoax?wRwAsO~cr~H9IEiHKD zGR9Go>#Qv506_ZSF%yjShp^F7({r;5b)U_cRF~waX?$vzI6h()xgNL6xOvos+H_b3 zc{|nTj@;+>JWmO~OG;dLm#i??7t$#d=mzLe3sz>=RH$C6kG)~{2&Z2>q{U|N*x}fZ z365cN0%pXmv9w-X+3j(aYW9}Pk%hRJR!e7`4jwNNu{u!RU?r4 zn6I!IDwl{#NRubxEKlKJR$=DWc;KOAON7N5&lA1ssUVR$Ka_HW3Z*&k?s*QGxtT6~ zYZ*RddvG5jWmjB?2!bgz2qg>~HoiX0JkKDF2AoNeAPW{RF}7A|oj6^BF>-!#^!EM9 zco`PQeU!|2y0mn(GB<75r8XbEVWwoL-Lb>saIQ~ZE$!QL5S6TaRg|6F_NK2ryKQT# zKSt2L+N7pXYSGowhCS3rYk7+*lYo7`lw?S}rX_#`eOaal>#oLIRn3jWZBTt+#nWu< zE&ZMXNi8@7ev6!$66nKwmZecp)idQIXDMH@Y{7CtKCYxNX4Q#U@+8VQJget;iG;Kn z<~=?!HYd2raF1rT0Y+0Qki{Uy2t)wMZAci+W-OJ5P(f;E8q?%PJu2`?Kp-m~p(^P7 zMRymq-fVS{R=T&|J22as5gKtdLgVh{{>rD|+%I7hnwu(l%?hijHqqSzIB0HZxdjoV zbS0U9`b}%ossc+0&1!wEXjZ*{q=vYY*chuh) zPE`~-*W)kM#*l>$q_tW7;d&o8RG+iz@u){7(@{hY3v;ac5zT34ZyN_tO^le{M~7sK zu2$pn*&r!wsZcUprH0hn8Z>~6Y0W)rr0m8^lVwPYvZJ7cpHlD+Ja~wkul_IZCXybe> z4$9OzBc%{aR}p05Rkbax8k1@bES*-LnClMc8&XFq87yFuiZAP5@oLJm zg|;SvRE9uJQd}$~yCjOqwKh3Pk!a46YYQb)C=1T>=g;aZW&P^u`uSaa#gbW`pi>ZY z+xFBV*wfBBu{W8Ff;1H4d%BGM+n7uylQ*wk!G9-{N%g;zgZ)>(+JE(W^78eo$(zZW zUri1sU%xr{6`4H52Uo9LYH`1s3~sCXaX*vmAODcz)A&aS92o2Ek6PRD`CCE$^{;3D z_y<+N3jO zWJNQ;;=Wr%D*Fajo|HtUOzJ~MH~s3XXV3oekCEh2>~Drm)f7b8vQh7W`|OX2oQHayCJ>zP7hS3mmnIDoB+pESNTe)00bep=+}&eE<4-&X zpz=GYkFPR|vRshqJxTKW2^u5Dx@zYZ8NVR^l)`WlkT);k&uDp(&t}mlvNe+9K}JQXSlLEBLG#EK z8N*9=s;?iD|Bt||PciuO4KbCy!?qobq<{Zb}+3lIW_}K33?3K)F z!z3gjrU(rI+18Ht`Rr$*0FWRFlAuJ%-8*8|N?Rmug-fAOsQOhv(6?`Xxq5T);pAQa z?EG6LH=>BeBa)zR|Id`fA&p1>@vWP@knkX(H{{Es@ez#@GEMJ49udC3Mc@7b4Mg7@ z{qx&i?{JWT3_)aErNZMVU`aywlmY2-T39!1nYz#T%?pO$xM^;{DkmfwvRSM`F$pq7 z2e1ax{nBSSnCJytR+eok`fp2Fe;Z;LR1{E%m$0+bI?v9|j$VNVC5dv4zXaNjSceOb zB6crdD8wfH8qjzqI2hA7U6^1!)d%k4QN64?&Bp!nano0TIGHD4j3sX(u~PbzaF8za zA&o=CW+KI&(ndIjm%)|n%{(p1%?D~$O5?IvbmsT$X|<|3{^8^6H=obW_u${RA1|+R zmBP%-+Nz|_I~>sv3!;Whx3!QGsJh3A>_ti=$MeS@d(Y7wogAzCL>dvffBZ0!-4cw+ zF?znI*6H5!o~5d@!;$A>?crQh@*ZTDD^DBrY-x;e`Tu+v>JPxo`q_3>T*&UY>wV4a z|M(---)}D@TkN>^h+HIgdw+0LyrusrvXHu>;xMJz{9W7IMvdp&->F7V{kx7n*O^=P zdPS9s^}A1D3-)|p>qZwHfm4!*zmmA+K1l zpp*uQB`9X1aZpTpbAy^2i&ShjjW6lHchELV@@Y&3uC#VK9kI2PY6qnq33nWJ_clyl z13pX=!EJc>#$JHY;C+>45a;IPH-!s^;~&z|t?ZWO&d7>~5w{98ZIeyfD%EbXWs`hM z7vb&`jpgUxBRaaziu$8s&}(`Fa&*%d73?jI5tc!4D~>j(oi{3J9se5A(OC>;OcrPG zIn+2=O4^0G6SCGe^K~|v(ue>;w-Nk}Z3c(vmS{pa$0MQ~!~&Uch-p;Q1I4pSI)b_+ zE=LipADv(DbSm4Jz1wa$4e6Y4&of+%lQ)cSd8h^;^7UCGDr@ zvSF6iWJc*M`z`+YJJpFWnXs4>nMT&8 z8+DAbL@=YzVnvXZSKYFcaG?6dbP7(0T`a=71iL+h%x+GkeFcSX_xti)R?QDv4-XFy zTRROyQ^73qM(B!7RF6c_y4;$K_9wViDxTi$@7btH3eGs%Qc-HR3gx&YkW?uB##JP6 z8LQk0o-ST!wMeAXH}rWb))YEDwS0&6P_Fwq)Iv^8|MRoL2)tG~7afRx+mXnNFh-`T z?(H44UGCByM{$l$eCi|hSM~Vmf3$SG_dB~;zy_d6|MQ}x|2f=0e6i90tmAR)f|&@c z_ra1#Qh8_^fZpGBWxT;681LO3^yFGUM*qofdJ`gWhy_0G84KV1b#x_?jT zXe?x=1J~z}L`0CjiWRnXtdRu!@D0xUl*PO7E5*dq8&g5@mXz7foaqKu)`N>_q{NIt zLgJ7lTWA}FG!SSDUT@Wux}`DSx6n68jzdi2ki-JLuIe(FpZzzy*#&oP=r+ zO2w6pAp_~N42dQscXd4bb&I_3xv^9#@4UV#YRKM*`dzDd8p%%-5YNUw^pca0E zTQRnddaN#kTwVsh+bdR4+dh4pyBm_z@n zZZ|8}qQyZRQJySyOs+gT`em*J6Zyw_rM(3U6hdU5Vk(O}WpDd^$<|6Qp<}opN$Cr_ zBguV2MLCc5`RXg*vL7Ua#DOR!OQnP#zS%zg_~Gi~r;E=YPTs${JU=;ovr|fLd6xm+ zx1ba9gQMq+FlD8Gr<3P9k;He!u2B=E)R`j@ZluKW+>~gUTbEF{uy|{j4>!#bGP=y+@Co zzAv`Bk5av>bI4MmdI^!n*^az$6FwFqox5_2ED440_lQ9WTQdasEGa~Dx%aSwcw44GDp->l(kHB zQZemQ=Tj{^!pcs6st~W>lhx%K{gHyX@Mftlwp7==1`-w#EoYl)cC0+9@l1?aLjR#4 zuWrAWCG`-pnDP3?mCsb12DKhk6Y@e}uj*{jN`Cw^$%5_VKP{+hi$`BcutEMiJUlAi z|GhYTb+D2D*74Nb|J9qEE+qk`_ko4w>)b6CKL#$h4Q%8PTPphkHpQ<*ey!I0xEB;& zxc#+?EsxqNG^H-G0LWMtkY8?B?3TpNi-4-?Ys&ev?Y&>ZDSTCfUxZ3Y-m z{-ublxD_vCtZT7_uc-_{u?WWRnkSx>Eyr2UWa|0J#>wSc889k z<}h6--LhBc;_zH3z1alOX*tm#T$^OUm;|?cHqpnc9D~}{FhqkZ6FKci%n8J3*s3^| zZSBA;;A4FF@)e&=+BULsc-E#@sqfd)i}hJZdrZnar|v?wEtI@ir+Muw>)BiC8v1ou zotLA0r#Tz}wjKLUxqzIsQ911$Z5cBzP9lmqv4+ul*^NE6UCY0&`MZYwDl{dXt5&p8 zcl&e}DG5(m$kXPD`Ltq>$;TVrN;%G!)6XG(-bM4$~C&$ibT$o!|2i>=N zvNDK$H~m`Gf~=PZ%gzvzOlS;)_tyjmhmI$ZUms!#ZhV~&Wc}U3;#zIVei_o!WT*UzTOJCo}y9?F0SNS4ypt`l? zl?kmZ(AmP&C8-fhMGfU-F-49D+b=Il-%fN-jraC*T?71cz9}ygqqz^(gWpUq_TBmgQ0WEvX zlaSoZMy@8n2jBK)3M`e+HGi@+uU&QO_Lc4XYEXm*B{w;HN&{YztH-L)p`3l@?^~EK zCekVCTx>E$HuIgUtiF&1oE=X}dtryZuO}@w!!|yQU#+J(K+3x$uyhx4Tdg&2$L6l` zA>@Vk(}W2Yu;>_Fot`gSbHy%hYS*7VTcD?<4Lj;1R#wdBhz?0G460B^{JynhNI37gza2Q-6NVOCO3PeNcLAEimui= z_UoA7NR0nc{J7j?22~%9UXuvV>rVZ7!W_AZ1y36l3Hc(YZZ(2>bd*Z}(()OK#eqRH z=U3x|@G*-*j{=KXibW1Fjb;gHQ)DsAvJ2>f;E-0Vpd|OL%OzB(wSzU3Z>xI|73ld| zR#AbpPL@%j%w^Y6p|}nfQlZ37R#KtNu9woKz=@bm9SezDU%FgIxf(lIM0PtXP%Ugq zzLo`)Bde3;lPhuA#gi+ngQb%zuakw7D{;YPvl?s?`P{K+HX-lXEG{1$aw_(K6jVzH zfk%siNKz`L!gt9sKE}~JjaOV*xYjwFcYmah0RW~1==hSt> zUlm*+$_f1Ou}n+PKfZ=mK5+w`ZTs=;>ch$Vv(K;J{P^jwt_G@gMv@pObF?L=+ZNh_ z$l+TM1;c$#SL&_$)8|h4UR6DHQ+R_bw!szK;EH{XxMEc%8Z;z9VMTYc6Qu<&WX&7K z+$bYY)m`9EG~q@NXo+A}G5g&-4NWG;PlOXkO@ z^8OH|#~f#pW-*RC*hGiYTYH1vjl12K|FrY}(^qwHq37=b*yR6x@ba*T|FXZo@&8-P z^T!`c$KY|q%E=Ptqqu17n1BAWgf|uwanF)l8jm!{R2DPBzIFCQh^f3%&UqL)n`jIZ zG)v3P_`G`v<$ax4-Ebf4(@^h^^`qIP?r!pT!lH;IId{rw!hR=#Nc)HF{r~u$hmWOg z$gtyOnUUxFn=RlAf723O|=1b?Z_p3 zdDiUVQ@475y070?dr_3r)bG^?=yXIx`nLu>ZCxRW!zrV&8(7t@Afi0`agRkXZeLku zpSF(LY7k?)uL`su9oAKn9;>Rh#kr?!z|+>fr;Lm{T{KoJ9{N^0pcE{~J)RG|TdFhI z!(_eAUW|p9CTu3GG$JUyiFo17EG(u;$dDu?4hTRJQrDMJf;(OKE9@|PeC>WKzR$X^ z_$BSd(g)L-#Sdwp)=aMY8B{u>)UbU}Far0VX(z$%24=Z-tYU3>w}?Cl5=#lIdltKR z8=kaBl%KQ6or28<=4 z_J?l}5W$^q!P=iXHi+b&{{m}pWkELn9Nd3%m9UDZo&H~o^ewLd8t#9;+dnGl|G#^= z(f_aIsWK~Z>-mduJ2n8|Pb@f<5HqWc>h!{0Jk~^mZJne1rK4tidBHu>i2d_v1x%Fg z2Y?~7MO&7jZSp_$>9^i79R7$S90w%X+VRNnfraFpC1OjPladE8%#N-SJRH)X#(Ub7 zmQY31apI zjz@&=XbP&n*Ai5f>51t(J9kmlFgW?7)f80a=Y-4M<|GFWS$J970A~S9v_QqXaJJ(# zMeJSP*`U7m`dB?}*Qh;4%4DncTq;eAQ)L9@IWtm2u|nf5;D&y+XP+r?T83#*Vu%Q) z{S2bP1&knYG9p6ZF=QzX`UxyAFQ#qr;I@6}w;*F(0noX#V|fmkFST8i%U-bO)()I4 z*tDzicos!=sf~fKtj#CE(6*L)yVp9hN^cS9%0gkUlPxPj*V~Dgg$~jls)mI3ET)3x zr17FI#!n)5C{=V-{{ngy@6OIkZ|R)QOC29rOx8RJ3QW(1@Z!k`OCHWmjL+1vG1>f+ zJ`3r8I*$K(uwRP*dUWvJM*p*pr&(4k#C=^*Q?yWo*RMRZ>zA%Ps&+}Pi5c4Bj_zyG z>NHELD-PA#O^DXqkJj;8H*s43l+Qx@|3sfly4n9<9K9^Ye|>TEYJao;uj6s-{|$#w zPXR#B5gLyM0ZRx2CcRe_3v}U6YKfCV5&O8nHFQ#(M?!u&IisR|QFnqzeGQ#l{(Mnl z(pO=eWK#?i=HuZ}flbc?#=S5A=^}oWF=L;Dx#OXSlE`kle9= z+)6(F*A$PRNVqMJt1~)zVG%Y4DKDgN9jm-Pf4!|q+lb+Xx>ge-yuOmOsO45neI;E* z4BrIf_G6D;vtZ$9*Paugo_%ftbUOod7rL>FINgOJR~sU`rn2SZ))wd3qJhU7%V{0a zwoqaRp}gHQwyK^lDx|k#FQ|!{U6N?m9pT%xb=3#@UaZNT1^g~F*e~vPb0%l_@8)dF zMFDq|-%&7duLaa`Q1C+OtBnm_Q`z#ttILa`HP|u~nFG;oEVLd)yRP~5H~av|pEk1| zoLYrwwWDNu0#g^LYaLv@Hvh6a($j@n_ijk%leY7~>x-4&vejz|!(Lx!*U{Lkjwqc( z)O1PA9R${N6>G=WbOz_BAK9Sem;|21FCChonXXj@qOYi^!^oFKfqDfY+Fez28mV2T zN^m?P=$l(I-$ma*18nT-q9VIC0`JfiQ25wK{r(?+Kpp6x|NKGz=}hNtbTNN9i+8w> zmSehx2(9%su5P+k$NVAjU8f{168oo)plT&(MF60hREx#|s;{^-dsiI}sJ=NJLx=Ga zt#ubCxxU~oS6k;%lbthu9l?{EEADQgtuB=Ex))h@(Ua>6?r4E^6-&9U*e(~>vXPZ7 z|8w&gO_pOy1a?^Mx@HCW_}j9mB9(3zb=0`rvxv@xO~;A`-DK$E6BXLyKv5k;ITuoT z*^B#S!zue79vXD~T}S7vD!&^eit6#oQD92SJ1vYP;ysS> zh@|EZ`C3K9`#6xZLx)#%aQ=$2J9gK172C>G`l~=gFcyA)ls$t@2NXvcfX~$El-H=q z#Aj0wGwpDmX4Ps2dR54meSO??&?P@q zsP9|MCfTYhWh+)vmrwP#%IdFDl-33^5Yl^)oAH}6vyDovOKo_g7~%GkJKIiL9-s}P zEjj!JLp*zU>R6DvJ9Q58TgJ0vj6E$EnuFH(8#nu{y)D%F;D1v;_-Wl|lW9aIBvy>^ za!LX^q=9bGS2P{I>2x|&afyp8d{8$#r&a2rz&7@M>b7fh5)lXF&N@M(_>Gfjcu7Yw z33qnfjlMF{nTYZ`$_kp0Uwt|2qE`EZy2||EkgP?-%Y#$glUhuatBz#XQlagU8aA%K zt)9is|5Fx*lqa*P%yu&iN2JaXxC#I7@YQ#P^Z%>wjyCZh*77*GScMLt%A`5GvBLVd z(GozY&3ToQ;GBi8(<$~NOtC+y!eHYn{FJW34PFA_&0s>~lRHc!xlB|s_M2KaENAYz zE^`%tA3nvn(16^##wIvQ_``{a4MV!LyY!1pL}@j*H+y>b&tm(3yEsry`~Qoh!=nCQ ziUgbee+|z<`v2CT^P7$NtJs*UO_W{nomy<;tI&P7-|-hv(0g=42d(y~Wl?oWWyGqA zIo|J7SE z&wcLq`xOCg8g%y6I(d`%n@p#Uj(=#SQitpTmf1!mK0QHOEM%-7;4O6Y>SdOKBtoZA zRiDZil?BH%D&Xl9lk7n8vgSorp-u1?A#{Ji<}+WDdaKPkEH=>W{1Icfv#E8xDPM2p zri?;l+0vzDKr%mTmLg~S0A_ejz%8xuZknL}ay8+<$lTF_0C(62sxU|W*xdo^xyJ!1rn(5RQ zi&as$8VFWr+3kHsoHNB)_6Bfub%3iGzw+c+>)~51$2Ofd-NL{Yi(OzMb`PqW+T#N@ zRKBTQAgrpARtv0Ju48$)LOocE!l+hdZ;e%_3hDqfwWjC3OsLe1dDp;=YDsY2xTw~~ zQV)mPrhT1(psLpSVV_o}bwZw2rd|%|G%L0vfYX}E-Z8AHDs;7IrsX;oXtzIm z!BKME4@BIv~gU>v5&Y=%*y9H z5PA7Qzbbm)I8PKcB`z!jx}YeX<#8}`<=Ft3xe`iJu;rg$iBDJdcUdxW@CrfdTvb@;bgs{f z!qQb#Rq(l4Jsw>}J30WO^X;vbBhb|}WHr!pitnrekTMmR7`Bh@%jR}s#_#efOVAb>e{=e<#J~ROcxf{F` zbdbBqML~nyr7Zy$E^S*F*2P#Sb3@o*alyfmNzTLD_vAPH0@1 zd4P|9uI6U(yOU2f0QxMc)vBsv2?!s@t6aA<5xhDi>wNi3G2#k=)J34*cC-r6Ypdi= zv919|Iw-u@Q=*W%m>vAiSzOG~*A|%lAewPO67BkROA3t4u{&4dC&E@&Y>6@L( zO!7F5zS(~B;pdNk|9t-OHRLHLkJzXmkvkHV&s-53y@N0Hf|0c(D&e`88j!4L&rxY3 z>vV8>v2?OkXP2ThR(E)@it|0Xn1#9wRDZ7jl39GhKXH;cT2@(2n#rTvOGhcg@=7zj zupht-DIZ7VGo&O6okBN41*@rY0?4fP8FTHH-7Y&@nqOH@+)S@s(RrxtY=y4o3|p?i zI>DAdE_!}-RC zSbwR|y*5?m7}NSzoSnPdaCTnNg0u71^;g1)Rsn!6*#9LCwbB8osBL{C(53;|5b(vv z;QRgkLua`UQmr8L&o6Lf+T=p}aH50#Yv84{7p)X?FUylwR{oJfso% zLGiUc)!U%IpJd* z&5w~tW^N_iW=~wdF4bRE+SpkZcfw{o!(%TVpS~n4 z=7ZD^>T=t*pj}0_HxXbgd97}bAd{(>zoyAC`lI6Fy}ai&=PB%RYR2ZLYXQ@@6o5gi zMdf~|5n2Wgsjg`Qb3ns)w{I;fStkU-Tp6+GB)Z3Q{^vvN>Go;m|4pV5n@>pG(gD1| z|NFb|4vYTZM+YxA{@-hP{#e-mJDm(=2k<83Uuz;&p#Q#3Q*6A(H(ulG@fwerC>nFk z1mgjYXgta*`VumYXn@_9F7WA8N*SdZWzIV)XZu^q1xx1d=!Cj18C}Vo9bE0=&O3H) zpV0V%;IQTY{mtfT;vRX zi>8=4!|pDePhEAkbs zIx&LVn89t#;5IlI8yt)c4#wAkgV6^60ovY=DDM>iVSoSN)ypFO!~V;o4gSMA9yx6i z9NVsv;ZX!hb2)W;zftR)G*Br?f=A?&pb`BCOtglcDUpUMZZ%Xw`&6X5z^cmDrFYkk z>@4E==`n2Y$%G~I1xIcInZNA8%MxV@o<#y}cP^joxK*W4%GWG}=c$Q06ULq8 zwi3#_JTG((HEEv(?6z*lM9#F3JXG`qwuOH4@`eap7(0B=`w_!o{{}}m4oK2h@KBFP zuuGB9c!YM)Rvg`IrLw~_bTy{jY8sl(1V>^_(8=E}(VKTaA{q;ZwysXkx6p)z1aXGM z7z;!N3K`)jWz{^V%us9}xq5=!3LKaWL5gDXyAt+?`F{dFx zY>0$x8&%Co$V5*3vvZ_vB4h#_MY(eCX%y+Q@N`OWf&@c11PY+BAW4iPJHKwk09_JU zbHMke3456L!Ge7-33XYL2pSJrGEqd~8#WUNxQ^^pS<3mv$6x-QTD~I|rvwUy5)!aG z?K%AnKCpz2sBBD$EYlZ%lMRZ$6^Ij|IzqN0j&63*lq67y-uIy4DqE|`af5?f5{LcF zTwerJZ#mgDIXmY8xEXM=6(exqWUlv6?mU*)_Ahx*)AlOC!yyf9yAkK7>MOd6qHP_mn}3XAfcmBWZ5 zrBXb{Sk+i=w&mX0FZ&`+-M)T#qsY9&qsy^P=`AW82UD8UM8zVluH9xyW4C=^A(6#w z?X>LS9kkuZ$75Z%YU7TjU@~87NX%z0*q3NOkA@bXnmu95RdYPkvR!Gb?>oF4y+@a? zV0ii0Fur`L0p@ER;ierc!O*hq1yHN(R`MsWg*0sfjc<28S8CYm$tinYt4pmu)E5{g z*?SgK!E$~P{eFJ|bxKi-($^JrblbBQore+3RnMlAHZR(KU@@r+#!%~VGM(K-l#f3! z0TBpJ)Y(sp58CMY$!3#d)69E$mmKDr*d`?HN^ie_{ugW0L~k{4gZ;v)<(QDcW1Bm|3MJONKVu`a{S-&)$Jew`ZLFG+1$HpO=v9$QM77DgFgi>|0i z3UYNr*V2%yj@C9a`p0Um%r{rV|EkXd`~O6Xwq5Q2FJ2xM?Z02_AHCS@|Lb@h`+vhp z#!CdybA-mDLBJBifL-qu1p{65TJ1Fbj%}$3;gUMq<;~mvEGNI@xc~CPj9*_YbRq5D zv+HYUyMO=7$YNiW(d+N*259wJ3MOrS7C&)FK;L=K3&C}kk^7peXeIWg{Nb|Pk@B#V zdhhiY;V~o*r;Ns#(n2XH3Q7wN-XXAnJN^j~V>07zKg|l_!GPcnTkyu_jnC97=WcQr ztr~+M!BcXj5Ph=Dxz|1oswii{R*hNAl47_*>!nYNoMkN79`*Wyz+$Aa4KrQ(g!i5g`2Do^d~kzrd(Q`AGVMM8e|yi+&p4rM#?jg9H@r8PChT_-h~9vP1n;SI z3H!Y_xZ?o}$==tn@by!-{x9B~yng>?FbS8eqjvotzIeI6Ux@#I@aphjnU7%bisVc}%4rAvS1N-e8jrv_ zR8FddMG@FqVu9{ia?53L$_dWceZG-GIs&UvggL?}A$KI<#Jq|_Fl#}^>T=NQ{rd4v z?$zWTv7u@3e{aL3`tjc0h>G#-2GkFF*_!FC|J~{Jt`Z!Q2~KYLvF31WDDH7WP(-)HoQ?$uyEZF^7=Bkv0rwiIh56!U^~j=D;!vPw&|?boK7vUtjck*Voqpi#dx( z?;9kydz6qVLpTi4WZs9rO-Cx`Fu2jA%MR6lo2)eE0!NX`84=8hDa7=(tgk1lKa-Oo zoB`YE^>lY4RfV!~mIcb53UES(vnZM)5|3z1NJ7G0grU2lIhtUq&{;z0FquPk>Ho}V za7(y=mjrVv|Gvj_xyh*sXT^3zEJoO#vnJjPOjKDU0G-ObV;qMOOh(;!n8$KP@3*|IhD4FM{A`bnkmdCkV3t3_J_xDO02WtchdyUD2 z#heI5+pigMS+?9kc_$@$#?4y%RSrUyUXJmAk9W*UKstccpfrF1j?oQ~vsdr#P(Pkd z3$@EPgOJ?q?ZB9ad2&_p@RJSIgg8~@)7Z3D_WHAD=sY0_`JWl(R1n_l_3gnt7##fD z|L*lw0Y`(w!M^-;5~Gh(l3;oGmUUlimE;weDA=|@*C?X51pWG+2pqlp(aBl#LNFVs zNC?@JGc)}#k(r~L9X*FU{#8+d& ziNSK@_M(zog0|OptSQY6jhB!@2b!r!y^5dydX5u3A#!y8d;8fm{jr0%@=E}&th^Yq zuWGUCnP*BRAqr=}bTwJ3nqKce(DUb4bo%`HF?vTOn}{OQ#ayp|Yv>MH)wN`<`X@*I zK8~V(sz2e1p?!*}b5xJ-aT3#bbX-i4a*BHzMF>Znf$zc{L8lk5`2bzWA2O-@sS-VZ zu2aa?LSb=0!0&>JZ#g;z?C8{ymOpEtS><~&wNQNDUKwU7z%S=ANsF*%d%8ts zvrztghW@GoNlmTSj|f7PJD*4Nn(!c@Q=r1s&jv)0<$j(*(s*Dq}jOVg2cKT&j592Igf1wbE|3 zlZ}iXb5laG5q1NVNLXEYitg(<1i1#J%)QWp+6K6k>n-L$t^pP@!F4{_PfVV#lsTZi zz22$RXj^SwAne#+2gat76S3pb01E`H(0~(Iqil#E31T-=j^&nIT@qQmdjM9wZh(EM zmY;-Lp)HhvBmapaT{j8S_OyQ<(e)qyEH=QpDof{peSOwtD+&z=DIUd)3mUvmCUQIkMV;E=>SvH?RJ$(_^H0G(4d z;8YhPShfJP>!>+WrD9$x();y*JqHR6z{!Z~tqOusc3pd+0cMjh3J||-->;TcZ6&Q5 zVRoIu`#R~P-FEVXPgNrfcT;MeQv>*W-Kyg*rzD_5$yDVegYAY5rTk)?^`dz{BtuY2 zq*ci2I^#r2I@;GbJNKY%m7?-mq#z3w*9=w z$kUVmTV7~xNE0dB&*eJ%`^o!vNV#&it*WjOh7}gxYw|S2tLBL9N;WInQm%k;Gn_xy z^E{$!k<7|tlOs=I+b6b+?o)EAlx>vXSN2HO4Z{9_vfSS7B5%q#70i>sB6;yre0ag< z5nZSH9@QFsA}Nz6@TeVY$&)AWXk}E?G~)VTaCkI0>WAcp;<$fs&`-Ma1pJo=iY1ymw4a zax-hO`cko4&rO+I$<=FoG6}r!-Xg78p~#00Nz&27BMQ}OuU$%8229Kx$N z)A)#t-9T#Q7U>ey{cPK&F7mV>?}Ffv`qSqiFEJ&ojlLG-U0Sj6y@aw7d3uViZ}9xc zi&;qWY!krA>S@e4=LaT*usqiUh_2PMPOpu@LEbHCI`Tw!xk5?TTuCNd7lmHr2^NtgXSL>4@>Q1Y3CU}ooN!_& z+T}HuoIf#SHhgP*yhhK7yytNsQV4yx5DYq%t=FKf_R_T!$cw%75s&B-S9+uZb*Z%} z*H%j*7=`R2tc*h_M=C`zySWYl0xX8-%kggKf{)keImjFGzb0%}X91}$z#Jrg%aJJ!87g&g zt03>d|9-E{7(QyB<220wx|Ec?zI7dQBocuQC3RoHN36qth#B z$tXvv9Jwv5l)Qt(^3{4Bc~c*&7FqIJc8}OlC^MERNro($D0`%Js*+sP)sZI@h*cAP zkLYh>5?kcRd>paaIv3$1x_;ScQl4Iw{S7j(Uv2l~-R!x4DphMAxrck_WYLz8HBrb2EK9 z;cyn^X;gIk66j?SnB?@+o~+Z!IoGYH_Troc^88q5fpZoKTMz4$qvu+Db>#W6&M$>? z9yD^!0(pL{^XuW91@in@=a<4ckJ^&w$2z|r&dIH-FK>S-C+A%E6_}SLe2zR%k+aA- z^MtKQ_XO28ik@G9!oB>J1h{Wxb@n4S; zzJk1ZW&GEpgs&j4UK#)ODB-Kft5wE-JxX{(o&^Z?jt+_B^mUW-ujv%CGJ>TUcoc2Z z7=?JwcUI`-Eji~a$JUU)osIY#4M3pWFa2x{bJn=I{F+hDI6*W{Sxn~A0We@x82k8` zMy0;KE+K}vda2C?n1?A+uH;K&T0Ebw-=*6$;yR5@Xt&%+-n4~>ly&)R)?Df?wZ6y8 zMJi98pNG_!L|%i7R5|#n#|Ub}51BU-Gzz%`AlOD>L{UIplEePp&G zFCUQH+al1A_m1HZnf&V^a$)l9faVp)*?RH}y5p+JYc|`d3^nd&@aQH_!TzoIX*GHV z1n4Tk!yygo0VK-gne0fY{A)mv$o9SKX7c-SOt0B zMpssVYA-Wp<)#5UgJ6g}Oc^JL#j7XEZbXZ<#|h_@#V20ool+=+olSy7H8*M%abPy_1o49a}N0PELe?;4ax2FIUu(RMe5zJUL|x zQu7plgU1sga4<$Vqf!=R0OajH>&8IoInsbxd1ilyDAoDDOl|q zHU!*fIp~OL)}kPtb%?2@0iB-;#<^qU=BL7IZh&aEql^2lEh{=wiZ`=@0Vvg5!weN2 zt+0IabgU1@w-&ZHPlp$1ubU2&b)|F|d|qhvbrl_+=)5jE1RkMnI+@IbvXH_ft^l&g>hJiZKzhxYLE>*=xBws z`BVs-9(1$b-OuVF?P; zFuyB!Y6X$~RM6NS zbWCV`L2y{>$77XuH72Q|G@DyGpa2YyTJIRe7EGJhx8XeBX%pAHux z6?CYWrl;qhs_k{IRM^wg^G|3dXhi>^cHnF{pog05KE5h9s}jHq(?N*_`$u9_`1Y375k%=$1*N+&=5n>^*~K1@_0bB1_7R<_1SkYRF#En>m88|;&ARAl zfc|c=H;TJ0nFE+{Gpwfq7xWm9RyeFrg}>?}@3sM4eJY^UT5MGZ9ZkrpPsp#D_--o*)hFav zP4ZPMtkf@rIDeAls)3VC!?wNsu2tU`oK`Sggvpz112zUm*LV0(Bp4!<@l!Il59CpMK zWH+vnjsTYyv4f7t#~9!dDVqTUY9tsEq_AdI@wAv%Ubvu-=q%PFpc-$+!4R<`#LO1! z+)R*IkFQG4e1-()sVE{cvM1@7U$Kv07+Yn2c7jUDLVflE$NmTnZfA?xORA3`z2Oh9h_Zmx34Me`Yix*~_)i;RQBYzE^v*a-NIY z@m+s2cm5Muts4$TcO83n5U!BFV#iI z>bF9VeNasduhGcUA!iee#u}m~fSt^DgZ;t&Ag8acpu;1KN0|=320}dO$QuSX42z~C zTND)T1S~HQv~5`-r>4c=L_CZ2p&ks(s<(&BNBY6Ww?7`*xN1JZ=cYfz7GaBxfFumgl%gq{GTw+fyY zEsW6nBp|&tHL97X@0Nd5qvZ?Ln}LI*m(ymvZ?I%#EJh#xdiLR$4#&fNJTWV%K!+z( z?_+7Yt{SMf3ZA!tjs~dSDmqqoxog4m#v>X(T>H?`2-RCfM;?l{V>%87hev}W8=m*@ z@Vb_cMyTE@I#vhNTg8@Z>1c%NeMDzp2t02i9ko!s8Hk)(eEoERE394xW)Fvu7-5ie zmZ!rhwp7sJ38|Wo#HL{)BN`J6UR5waSe5@O7Q7U`YL%LS3DLCd!snf%C*qYGG?4kv6*)BaIED&_GARt#&@ay&dCjn)rl)YW+8A&u4# zX4G;#JVR_Ku$DBjLEJZkQ$6XHp`*=y?ipgk&;dzEXi>B(Qd;X7yr53j4|39SUghbK zOY*O-qwOO)$6~yzgk8CKc`zoE3=*$<@|GHpN}uBOgSCJg*rIe)`V_Aptfk70*o%%z zpW^j{wN$wgd(lzpQ@nn#mMS-5FFGoHiq{X;(o){_gltLqZa#gdEicj0Za>e_QN?(h z_-^;)wcgLYpl9m%?rMgp3P#nBjw;6M;tlyj6U6b(B=W zWBJih#dxdu?n>!s!*@NQXVwoo)6y=(6MAO-pfgo)Gd^@wL(i-qbf%@8=m|Zue$bhg z{K^x0X8oWuE#*W{=$Z9{&a~uLp3pOmpfkIOiqzPJ=PssLOwcxQL#Mqzt8d_ruLouXGAYOyUHej&!!A6&epU500f z@%0B6Z%KzIG?P3Jnxn@qZ011FNb=q)1Ar+Dv*4!pp*H#m=tP?t1 zq1Yb3nDA>Aba;khD+FQ7GpCxs0gFE^_jAusY~>(qt0tu-9iE}s%0bxHKu0UPK0heA z#}sx=CS0^_ZJsRbObMExj*bQhos5okK;~#VoNxgRbTmL3<>ht@Ne&=2Rsm?#R&Eb( z8sg{ZQuRF!L^Yy3nJEvvA7|l6Sy@|l`CZY`MxQ9@n9%s-4%0|Bw9+mk9|U^OiqOl3 zWuHZP8WCfh1_(;X1k*Sb_C3^&ZSBY;9r)o>jB6<=27z7+9ku&8jYkRL+}Ck1E%i+0 zD@-9>ieDkEo~C(a=)hC@Gf6mQu@5Pa=qHv0B&Fu${0!Zx>}XrNuh0OD+(RNrAe5A% z<1{UDJoFupfF$BQj`4^zhg41N!V9_vSw?@N3R$43O?3E;hj$=ST9Gz$uFZHcR-5?Ev=b_^zQNnMH&fWoIKn8NY&jnfv9+o+dfb(7{PGyaZL6AHO

f!j$-T|yUd3< zG(tp_rLrG8ZC>1bXeN{^l;jk!9y$O{isK&0PRxBmqaOTl)u%xv$`yjkGbyaF#Lxww zBIjNmdunB*kB05n+R^f#RG4{nomanSI*q3z0ca%jeEgFKdOpgjkn>g+qpE@ovcZI@ z;W8drMo0$$C`}?a#{0i!^ZGDX{Xr1Qg>8yw1G+xtjKG${PIQ!R!Pm3P)v9cfT(b{ zAm@x;c2OJ8kbCWRkxfh50XAEgI5RU3k$PTtzHAaQ9}U95Bgj{0B0Vt2*}QBe$9{lK zV}m?bc)JTBRL}}vp|mASd#{ooFZD7dOufH}k3YmJ40*cLN@Jt*lMO*rWh zF-{$%_}39rp?D(9vphM;v9oNHPH3eXRjYYGn-yBc1nHj=nk46$qt7Dle%tPPKKbuV zC&iAyj1)>s;`ZRoM`&{H}a&)y6w}#`8vN&cCNUWH) zw}CY#Whb7PXydlk@;DPu;3I}#Z}!|&)LL1KMHJji7y zrbLX+8qPM6!E|zolw%F(vIHS0>mvE6WdEjM?u%Cns&$lXKm zuc2OMrVbyMz?t%znUKD*=%qZBRr0?WZ;0tQ)3&`gtm>$VmZx)j%ZnP}*)sV(hqTv> zH?>!@6+MUiwexd@;kC7+jcMQ~=AfHND;Irj56)?8XV-~W)2_=UYDQNy(3Z94t|q?e z6r>}U%0@Z>n|8uqs>sIBt2Rfsuk(5VyE3A+x8nyVUS2U(=-C54I=&XrvbB54zp#HQ z@k8{VJl6QMfD--32*~{gP2El*H%{2j+92xISSRYPwF`a}ki40LIP*=|hWyV>qglwy z-R6a%`{i5-;$)sUD2h z;t+a#bQ;qM3{ZR=@EZ}gs-<9k2?Kj}q-0a1eMU*b{KfhQGs_w1f9PU8%kCtnnYl-$ zP2waM+(g<_&+!(*h$I&}%Ja`4rBZk1Af#3o=wXx8#>P=OGTezIEWYl-Ag9wyB2QpI zTFoF?3>nP~*dp@lybNPB*h?}LQ}u|yscwJ?Xq!CVbI3x*oBy*;ZvY z@6ooe)?d0{|Gr(q-E9bXlVW(Bk!9OCCIlRD%iu7_|71pl2HPs&al~6W{z1Zh0S7EgnXlczGG&7RdUm3*?8&}D7-A_rN{Z#4h(WTNyO`&|EEM*i+2v`<-+aF8?HS4z zO1U$pFg`?mVS{DXd*5SEpsTgviKe@&YG$*x6a@laz*RY?fLNHjbjb`FEKD6yMN=1L zpX+17g;zUKxXW$#wVEyU;bi2#ci?rhT1$7eG40cni&KkwV8q!=v1C))Nhlx-qI}yh^sjiI}XDde55DrqT zQ?GfNCg`y(nxCb;EjjTDP`f^J)8F&zkWIUAacWfTN65kPYCN^ZTU zRfL!IFiEsE^>lRM)1JZ2VTjVD;Qg|BawbBTd#tG)p<2=suc+I7&Xk(B_Z*(Wu_@>4>_jQrRtrLSuO{pz*_A7Peg2Wlh zCBo3jG0c&!h^(OM+qdVBVXV`)$i<_N5%E+wR25O(rtQ-vh85{gL~fB37VF4_jb;Qi z^J(P$QHws$KgQMHz!>{q(F}(E=O`yVF$I*vFYRkFUI>k8eRbyYJ6XKbXF7NDgvxIf z92N3058fjBJH)j&khwqcYeaMGDf(+iUCt*S^`QOq9Gez_G*CVYZjQl*B0|QlcA*>- z#i(PWFTsWNN=b`Va?aQ0P%vHa`8D=p(N}L`}xFXfqib!Sg#CVEp=V>Yf)VyBq zY-R<6P(sBZ$b#sp%fy@>oc0(Bn`PqGU0mcIZKtshWAstgBVu)oy*JXoEB2dNr;-kR zAdQ>(GMYU$sB3sYkEWz#pOghYhm-ujR><;j0vCNxrI|uQ$Hf+nb(D4-Uzm+w;>w(( zN<@6l$#J&S$+jR9DLeW}#l2fSc2Ib_jONS`Mb@u81~%o7JD&TW9H+3AS3R3Hr1acn z1Zds&YVYq(x;y#50T?@g-2B;!=J#R`$-L#2(_|;uTyjEb2;Pk>Q~HyrOv>@AqcBj$ zB%Nn)t0&OcoWlm2=g+y9rEO8YyLT*B55e<(At%%g2&iP7~~#=#*SE-%D)wJ+b=r;DWTg`HPOlWTzb)kfCOh zO1y%KE;EVn2paqHZrV&~T1~Hxj3ttC7zIfC#n}le8hrGl@Z)o+iXLX|>3NkDODe_) z_(YXfBxv?iua1qpi#zM!n$iUbz1azlQ!fZTg>v|gT%lFgQ!ia0xQ^T!4M@G&ybEj> z{@|L?@~7w+$B3wTC5A7Ykkp8D-Gc-0dQzN`RRigk6OYCkZi9}j=jAkcFWZJEH8sC$AdgbE7g%fbc(07BI z-B@&l0I{LSTJ6m^d8q7wfiDa5EpM1os`aNbz3Te|ciWiMW_k6gg4mM70>@(-cr8Jd=qgvXJM zMe>VlP^9A$XhT!gQx%=SwP>4`w1mgwC(FIZ@d1i7%)u$H06gLfYniy8)Cgn2&H|rY zBBEqHNd=$WU6@`?M_Wr`+=S!GT1Et)yc6CPFkxF(*wpZo>DWlXZAKg-<~;vNvCD}$ ztyOTH3a#fv?3SK64#n}E3K80s-kbhMmsl0CQ{DMr^;_>p)_5$>k`m52)lWaVKeN-L z&Cd+h3g012NC%;pzu5Ux!rjlKy$G&OgSD!LyJWRE#|c?x<89x;Y%8XgS|_W+w~T3D2{h*VAN|%1r^1sT*0Q94otCjy{`q4_E)q|z~ ziIHEB^uYTg&VM^9N1gcT?F!N{^&Wgy(@QAH1}CAAD8XOvo^}CQK~eor4Nx!@tQC+| zirq0;j{As@AsHH42s#!3Bs(Y>c;$X`RH;dH&T(}`>4ABVkAzmG#PTkI41ZL_>fda$ zs8Ux91=;>@h>sXtiq+=!_~=#8sencEpS@cgdZQ&pVK5g5SU)-81a_Wc`9jt{>L{pG z4;E!2npbjh3qHI;ljWn3Q=&iwmz=n{s5reHTR}P)!FLNI5ImdlMtPjJej0eeB<9^T zCb00cCnekwi``diMQN~;;fedKs z*YXbGF#8ec-jaOUgAa`V969%N%}5GiqW<$~bg@zRz{wb|pZz-+KCCO6IhmIpwI+tW zIh+ES;xdyWd%PX!3P*gk#G<(|r%xWrLtkQ*OjTn5&&GL51;e6z78!_G)G4~rFz&A` z$~ z)hef4J3E7tT6p6-oTy?ejc^vn5Hn9=ThiP%Rs$wwLX2)Q*kh8{#bsW|lmm*ms9;{) z@%tM~4Mz~FY0`xXwnCOBn%7S-N{b1^c|JK4$F@!#UCmLzO&A|iCpCtKaT<#!PMmP| ze&TSjTZ$$p%s=BmEv|vgD2dn9AEa_<4)V;Og5Mz$#_|QH`Gbml40yT5vGI?2jxQF! zDY*$%_+#f~a?i`y@aN94+@p}Ev_kPQs;&=@j$VJw>gV)yxlCs@B++s>@==ymwj0MD zv|k-F)M)N|%w)ThYy95zkPp~sH-;T`4(f=at=adu?&_XF*Wt=V9mA+;%RJx~vfGQA z#+!X=!fP{rb>ys(Tx;f(U_on}z!}k^Q=5Ff%`Bl?IL43CIA2Gs7j4UgbQSjGaa5l0TEi zeSZNn`n&&d8~7+yexWLRCJFvw0Q|zUJU{X*4|vzwe&aQGcIv8HR#ZQRu_d~7f7KeK z9lZJAtoFfL4+=Pj=*D~B6uk~;3>Ye3J6gSGBjN1)ae$M=($pmq59raq44Suo0sdG7 zO`Fu1)yFR=WD>>GRHPVVi+15YXC7ewOeG6)S{a3XjcRa!G-Lai%7M;k8PR^w%rgiUT4@f zK`gxJH`TrMEQ&G8Ck3vZfHwL5powxR|Ef^O|Gw~d0}m`cboe41@%w&y{MYyM?H;1N zdzHbSsH)vkv4jsKO0waUhonBp*KH}4*8MJ|LD_%c56Iyr7EA}=|zb)4}PWQBwj<4_|i-dZj3kdHx7bRKLK1JwdYc$S9YIUYi#mbvWTyr zwISIZBIi+5l@vVA^VPk%#|IVVAVgCD_RWWEulw%B$IM`RV46t7pu$^RzMWq)p$o>~ zfl3FdK3S$gI&h%os91Bek`8~thURT3)TqVhNNPZ`UFm7;RolPULQ`T8JfMQaKElE( z`w5y?W!&Bw{=PFER*^D8)RA8>b>`BSGb?S&IJ<<*DE!nwXXpDYZT{IpN2m5h{QF_> zPfHKsVE8XP|CZ0_*8_!(jUPg<=iSlK-*H5j_q0_y9o_O?zrS8`@_r6r4c(uA3A>c& za~J@{q`5Im`ve7S<389OKSz|Pzc#a{hk+Zzh8*L`wlvC^20z+NVT6K0irn)9RTB7D za zjYcD7JAWA(7*_zL1R;UsvJbY5wS`(>R|iEqn{G3pEOnSd%++565{X7h4K^((>_hHp zDZ^+cHsD>WBTBHZUCCUqA0=vCGWNHSb68_{7&#%KEyd8B5PbTc_OJHXRp{eSE=j3{c?#P}1sGFu!aXh6bV0@T;c;8ex9ITpoOKz|n(J*h(^0jmi>Iu1J^s%MkiAhd|nrH%~o9P|pEzwnzl5+tjhlRl8 z^JgQ+1^w0K9eCXC!42#of!9$}{IuZGfF(WBUrxrfB&qJeQMht?80F?a+hySZT1sQK zQr7m$A8QH;eH2f>o?(~;O~2wqEI-&Cn9~~tTa{Q$d%g^IQWx1i7Z?z9JV_E1+B|Jg zZX(ydOwM3<=qbr?`5`POnd^hhU4e1m8(nk(E5Ur9l&g;ZlZxgAS2PJ4Xauv@aDW)0 z7^laXhnbI5jZ{Ohd?}-+SBV{)8Kwz1+&nc;NLN8z2HY*2UHizeu|!SIR^)ycr)mN( zg01z=E+SA8pT^QoYtImJPLd(E=ogtUS^%X+V#HVhq*~>yRf|h5SeuSYn5rY6T5KKB zA3Pb#guE9dev@P$^0f5mN0Q-4=kaBh(Cmy=WWZSz2?|MvWsv!@KjdOw&lue8Pk_G`JH-u*gOfD2y$pM<{ zG#dX1PD{ogydyaRQUk<{t~fCh><0tYhv^8$b_&=2i~596;#Gh^if-sSc%Sm$fEvjK zseZCM*=bJR*&#l3m8`j9EZXVL>LK0PhX6{lH(2~eHQT8P_~4<{3Q>184zgL_j0+G? zfvn_SUX$FXt>V3_?};F>9MQ`XOT6)X8_8;&ODB1DspZAq_25QIvm*xS?O|kiOC0*WOF=#vH5Sb5^C|FcB8BaF z)puSQ^A5;PgB(&Q8S2N(%Ngjng?4`k&9TbSzo(Q*4wA@&Y(?JE1-)TM%?3Ds^;ds+ zcKArWr8#_`-``)#B&n}8hn(9glY=~~$R<%MbV2nn?&Lb}u{){a@?%nO{y1G6mn0h9 zoi((D4DYJc{dESjXvLVtyz z$Z)S?doME*z&NKH$l|t_S| z1-!5?S6^>k54?covzfK;0*%8UQICSOSjFR)AN%?9YF5f8n!kcH`@s5SD6< zh#@av6q`^9Hq&7#q)80aB((f`sa`MOV(`|FZha6B`-G9TqMJErbJn0|GX({LUw)4s zaHlU}QP@2EUY?J~`x_>bsQaChcI+j0@bQ@k8Dcm z5ZVUhC34KMeIQBo0EUR?4LD=_YW{`otdW{0CEX3e9u_~4V%#pyGab&a7Tm7d(Ju$0 zTFWC)Ey5uh2v@EI-*tL|F~altgHP$~glNDhKYiu-5&KmID$5acIgUC#sAW2`n(YMk z;rw5#8r`FoL>1o4Xu5P2%paJ@-k@>CQ8}-Sk1)DPk|Kk`cT6#H zuaTv&IRLt`2t}h?VpHuQ+d#;SB}c|9W=2Nq(IvsHj~@$~@$YfviW?HVp@Ava{aWiQ z0=pRGf=>2AbxePR2+CeDOkKJ%1WldjZ<~v5R>f!_p6VAr+7zAFqZJxHpcR5&ss%&+ zKKzJ(`swp5gLV3LF__xG;p~8ebp&m2H$fm;fnGTNThaW#-`VaoyfmTLZQ|aJuV&>_f2bnlD|PcJFq(* zV!g-?b9z>&v-;HWZ$ahxO?jD>2^Ztka}CowM*2*3BE@{jT5S89fl+i*OoH_A!2ppj zA`Ib0VdK&KWaiq5<%N-$OC3>=*xao3x)Fa8T*)_OCjB*%PC$F$_R_dzT__^+g{5L4(!9(Q2Wq^PZ%z*nWBDNqz5cqw7wpU(%O zQ|#1T^Q>$X9TZd`&CB!h`#jg^=F+GOMEgyLiRvpXQV1cwM|DB`DWA-~pT*y_6N}Lm zt*{L4i62+4iK}!b;Ic5b?w&wz`bHBKs<}nzN1Jfwg3AsM$q7$e1u_vY0e>wT^Yn2c ztjw66D#4XAr>0@`D77b1R^TV&&uo~eB^*P7eJG5~dO#q2`6&CB+gZxra=e2Qbn$ZL zU2^3{fDJCCgOt9rM12}M`$)(m0g6vr%rK_$fa#HFhYfojpIOxzQkobl!{XPZg9T|I z#ynIKPXfqZ4cgYG?1Fj);A{fQ#G9?@i|u1yL(h%^u8w>x=k9l@qpP5W@YUDzy6jDP zCvre-*Uqt%ac6=@|8E!0vjc$znV$1Aj{QTH{b^8*j_60n?^EJpw+`P!dA!`HBK5R* z0R+6y98SA@ZMkLX+D%5UwT%sYj=rY?$RP|1_{pmR$hnHbkv9fR8!9*N4(%%aKG#jC z>-w+s)?`sa$jICoWM4c|pB$3w0pfuj?1I&XcYV#SEBa4c`tB<__r1qCTZ6#L)Y7%C z^_B(LeIB&rp_dYUm3sFJx^s;Wh&wB3to4Gas*4ua z*vHkx<3o!4%Ny*xcI8Fv0wq5`OKCa94H(Dw4lDS7&wxdoUAAbnaxbJ4b~D!MO@@cr z&w{zh9?V>BR}%~p{9e6P7k|s>t1A$7j0@+q+KmM>1A;$W?KIx>Px8^;N!+9Sh<7@U zayUaKTh{~NR!H$%!v}~mOijjLy|NC1Gb^bSaA$=~GIi#T?RBSxUI5VS z^{%otgph@km+yxVQK!frxsI^nGs}^bAmu#DwBsQv2-K4lb4P(v(L7EeY!VGy@T)|t$c#aM}vsiLzhGXd#)G)8`8!LOEszg7=Bv(dW z&9(xYFghe74-_eF@Y=D-5%@iXKf7!)P?>uGHt9C&Ejx=1rF=O|6#%nPHn@n4kKg^- zR^+UUkVoov0W1m9EKO9tFZ{O1{9Ii_FXmBjTGO8Op0(nRdL!YH z0Bj9{I~KpU=iTw^{Ek9y{5&+mvD-RJ7}KrNZltr%)rc7L1lFf}3BOE>)4vV=3mZ?V zha_wsWMva#4-Xx0aVMd?AS*Fz_spQQ_V+PmCpox)`D`*Ues5Q&K>eN$QOAO$R&H+{ z5V$@|VKUWF6E1Oy-{pQ_NofEKr9_ltulIRQRF!xKXM4DBTN1pm$gYkDh(W#v&m98-hm5n3m7A-jH{DM8`anVH^pdF)HK;gWa7aCpav$^dfGRO+-Qt#p7dF z;~UKO()GHDSN!-$lYTc}=6UDBO+oW^Xk0|eOgUpc*6;BqqM67KT@g}DLU-n#3x5~V z#zV4|!%8f`8fOHVQbpSYkVR@l;f))mju`zlNq*e@L9nV2IK=NCX= zgI-A31;33pvi`Zvn>=7Gv+{BD@l@~mvehT}W4paK^?K$fVW!o0hu_Fy$FjGDE?P@9 zRa}Q4woyB_Acb*H*uA=TF;?DB@8G`O8?u|Qt@N*|#9;KQ=nji>WS-$4JM^;I5G0L} z(NsBFDlUk_d*t2C4xtHDpR14`R3AQwLpabTF_1^a=aXSKF#nhcgX z$YC{2Tp_unErAK+{^CPMahQW}1Sc);mxtE1jQd?0AOGrV1|rq(;qBe)TC~a&x3Vq! z(Zz_7!Dl8tiFsJ|5@pp0^%K2 zLujtI#i+!QjLxsCmEDB-!rX~f1oy(A><+l!u9qxyFAhUhqT(Pz&P^qTZ^k#W(ZF-^ z&()eWF1^*Emf`lOa!qCjE~br}vjZ$-!Z6vGHZG{5Ja*l87+_Z*G{|RUiZG+;hLgtz zAC6Q*`JFK6k2uiD*u^EfYqPtt`0=xF#PBrb(F3H?$po*_KZP|j>5d4v5B5SgDahLh zFpvFuWWW4mU7fqphkjd*z>*|^jbKwBlN|501)6{4OZ&`tP$?XStcis_!B4H8oT?%` z!esM1YU8c`!&#KH+ZRyc8Ji*A4_9PNY3SWZD4kTi*)JBb`*k4}O|qj@jrtwgm(Y@D z$L(P{m>;>!b0M^xs~+3K5u1w zA!IG2R1n+vsaP-oy~#H=)Y5W77c3Ms`#m9H=be{s0+Ebm2j4Lr`Av2 z3iuK$Q^Hz+9;aN?uv)#z7}c>+y^!1VW533so)_gg7?;{CikBQI3n?W@AM)j- zhGks=bUYtjnlniT$iPSwjQc)ziR{sNv>c^?xy(3=a-eZGQtB~>j;qNZ2ZFN@n8Z%| z9_%zJgn@s!;&$7TmtdLV9_F%jGe}3Sz30u!dFveg0=oJHMo4BkR(s&PHy$~rbj1k}Q@@i}j$ZbNj%qqcW^PZg zX-kJ0cJsjz`5#{`+U<3)qf!=8D8a@hG^HI6iT%)6DosxkZlxv>nu$o=gCXLE!bc-N zXN{;?yA#rm^e6xH#tIL3RM@kjz)GHF-r6;mTAh#Bg~q4MNalZR_{1C0Ozr0$rB|r# zW)K;7o3yoE$oxhP5~&j#=E|v*j0DHfAmHHlP>TNBj*TFT3GpPuUAvxi+@npu3EuIjbcS^xgjeRQo~)j3pf#CdXt;lA9g!~MeT9Y~$2D8Mo@J0o6G z@xBd!Eq{ZV5?36usHzP^5+CefSxPXukakPE9nZfV9 z<0zYHcXN2(5q^Z>Xx0l;s`>rkFRC7wnR^Z`^1g2nh z#puSOv*T=E`~_B>NyyQn3`5Rej;5sUZR?r@i=f%4B3ukP*&)S))DxFAL2sA09Q}!9 zU%IhXYmq=(LC^R3a)~pJNPQJt&k3F=Mm#X_Vyqk^yV2WAmKpwq-8oLwB-w}BLA^$n zZ)-atqV9KV-CghL*k2XocaA#P7Nam7^b6~y%LSK`y)g;}ZrWo5?~{ZyxVcjeh` zQQ8PO^iLWH?>KNrPCtDl+ICr+AG`V8mO%8`)7XB0FBLTdvGXNmr2UHdyr}(GUQE1$K1y)OKU=ym-z&ms*y^nU<>Eu?KjP`gTb2lMmy{7 zy?TSW{#gl6Kh)j#JwS0`a6uMgBnoTRAHpqe^!c+I#R6qO-W4&9^42TqRj`i?JAhu0 zxc-i=Ys~mmw=+mD56fY{+64(wuq_2=u8I(A{&CwXV|Y!(fOtfuzOqam7i9=0wfLre zF8XgLu3u&QjM2apTrL5!{YR8H8(cyWuvSc}FvE68pr4t=;|*dq!)6rDNP6VOrk&9U z8s~=EVhML;qf(wUXoWptIOmDweInshL4v%eNSyu^ca5T_h#bq7^V=?5K4Lj$^($3Z zc2G9$EDTMDPhbz4-52=%Lu^=_rdf!$hl}wA5(jY8*RJt|xAnsfUb^0?aS9$L{c%TZ z_V367l!h&nviHn*8`;qA(M$;IRy!%Cp_&VepE)bhC;jKUvE_}EQZh41pST0&_R7Vs zG9)-#CfnNCE)xFR&3a)RV0W1&=13W-T9&sLjc0=6I1X;6ffw<|j^6tW2cte%EwO5I zgnfNWq*3skkw5dRUb(WATBY_n;yk+cjupsC*F%BDuI8EprVjjRJnEmrwB7<^tjiHq zH#9eJTDPZPJU;kPeoM`yUGJFgXQn`mrPG)V0_A1vM28QC9B3ee1Q8CrV+9)p2%Ts~e`vP!` zNzk(;4mrCF@v7A@lcjvV*>LDq`0+qXb-_&9px<{GO_Sx+K!R_RE_M%*C@nEUS)4&r z_TpSx9PHd7&ptNI{WX}7OJM!RN^N92gDA!bOI3K~IsPUB${3kF%d?IFa6v~-81I(= zk|=&)HPRklybkK#BV3S;QCs-S{*#ri6K1438U0fiUCI*kFX{QfL9^>tU7C^jOFShX z7zAeezB#nV>$QwGY7Z`lQ5NwM2?KCZGul~HJ_eP1U_nJ-8YVK4b=KglwKf`mTgI$J z4NM)dRa12|+NA}o8M{p-%IG(3f>v-b1y53e3+o-ly|fR4x@B@r`Xt?4mRj*<7Xiod zGP4dNEUb?g(i3J%6~m83nhG;>w7w?gTTO0b$LoetYO&f(dzE^fY87e7ELH{gwz znbP$LU@(M>9-lJ=RCxm??D#m?$v2oipTDC3WrvI`)H@QVimlRs1$yRm^Z~I)Kn$?( z4ksW)1(1Ca^&)C z2=uQH!+bA0;2-Bi#v8BH+gDZG`bknBu?Z|S*k5?K{vRChrBTqtG$|T|dL6_`X7tD4 zB#W3Cbi*#g#8yg~jz>O;$B;}Bb4*6($w{45NEuY+tW+2Mw-xUC*b)$DQ}oQw>i|R8&ls4mFFmO0ZPdcWGk*W9HH@o@>poT? z^Uk;}Y9^;C)D{(BuD|Wbvb>QHzx*pLB=7EuIN&qD2rCIRIsZ)^ZpKnwb|#leK3|eE z36o)xA1dXI+gcszqsep(6Y097PnfjJl+3Fk?y$L5;$&t3MHAqsj`g`4j#Qp5{PolBfc?^zJovfsq<(0 z6S#_K76n!CAJJGr0wA`C1;DHOaJYErPmLa_d>Nht-Z~R@*^MhD)fJWk$*v z^pEG2C3=e0>ZK8)8RBVIy99{2_qAvF2Cr~2b~#10tOtc;GRls(Xx<``29k}Lmai() zkDm55N(PgKf49J!ksakDaaNw2%9|-p@QISiNliN0#_an<^E{EFI zuOfB~EP_|0&1-2ge&A(|HwN4@anMi)F?CwE7{huoZ!ZJj8R zQy-}=KZh4CGVsK4lm?0j%rlqu%Z2B3^S&+1nx-pEK+7&%x38@}=1OlPTo>Fnz~s>y zlViX+t?#1KhX&WflLH6rKM8C-p~={sMaYp^#(Odt+98opc5A+0N>QnWJq{|bAd*Z?lhM70L@TF z4McBu)J-7Nz!nrvrmB!6jR^v6xe$Oflt-S}Ow7;yas2?AH~RBYM=PABC!-l&1na;# zOy|Q7lC~;<7hJsjI5((0wYl6JSlPItVA<<6Z4=EBU}wHTVMP7HC2Z?9zok`~x`>Z0 zTS6xfwpY67)7R|0hRq2*NEjLwU=;0?_7G?}JTB$PnGmWmeOpRuCP`5>n4v`LYqR|{N9bJ=p0^5B(7>QCT zZcuL48%CI`uU=WaA(AblYH@EO;+VToJ0Y9Tco0nkaaU z0R0t~yF8>#g5jg{LO!!OwOuTuvP&8@gPhc!gtat<5#b8JJ0- zrD^vos?8t`A74GK|J^^H)3`6BMkOpSTr7OxuEkPbBQ`#}X?uu)8Y>2UnJfZfn4y$^ zrYY(wue1jlabb|;R9vK8UK@fp@hf@_w|^WoOoYu2usXHip5(xT#J3uE4v1J_Oq!0+ zz$xk8r_RqsZ%TJyAA3ba*dOURG1-f3Cct(5KGVzHxapNW_Y)U^r!UrnJa8tf-aGms zwkhP4x_Td3puVR-yGxLu{@UzR{CIToNe(^Vd8oF zyZlQ)g-&e@m2O=WFHFY$;^>zUnW$eoaT}F3hreZ(ZK3?U@@Z*5c&{;^LpI`Og%SSI ziqM6hyy8)BDZ~XtPHLk$Z>}TbjwdSyP{$nkb^O|@dE7@b)v<=ZABW6K1}_l+KrOjx>c(&=0r)SmWvmYrseGgruc3c=V4@*Fq|#=;*k)6$M@VI zw60Fu$*(p8Kcee)Y(0E3W~Tjh=qsa`DS8|AckgBa#uf}^$1Zz!yNYAyvku9zW^%@B zBfr`^LL_thr)!z4aEud(;I1jg*XfBJ;qT`bvw;{)LF6HLL|%B7I9N+Gc6<1dJH^kg zZMf&{1C!-G=o18z7?93mGs7*`Tjn>o0G=f=qF`b zIs{{`LS;n5)w~$ROdS+H6T|!c#?w2DYZ_{@DKETX?KuZ-=gYYd*r6J^Kd2Vsh>L;J&ebT#xs0MIu3n)-201aV0}& zUC>Aw{T>yP~^6TVQ+RF z&2@XmU|s*VlSXK|?csURUyPZ;K3_Rc6EW^*EsTohv@OtT0n`RYzx4)(y?aLx>H1s>=JN=PP=SQaKT z3Fqa56r*q{R*{Sd1{UoNWspvZZxD^4-`3aMQziX z!CI^16ji|$#H;u4!NBW0#Hf7hRU*JChuV{PsMSr5YdQ?5z%$sPhaIfLJlsIp4yEPLI$!o(=v z#@X@+9!H;jJLyLlN3yn%{0s=u3lxOsc30*!&Eed zXP^xC32Z0!2EQq4W$DBcW}Y}T7ExPh?AKP462S(n=jNxpDvRN&=Tpy*@POay`Mx|H zFB|;RzAra{fw|w$9B-;|VR|*L-(c@VXcNPN$Ct>*2>c$_uPhTrbZ{S_Dbz_lm<&a1 z7>NhBhGc&qb6G0J@4dlvCSI?{M0t|!-12b1hdrPM_&$<(Lx`0BQ1z1Jy@?WBGnj5! zEHk9kB5!GDr$3r5H3E9ST1ILpJ^j};=w)?vwrI~w zhw6n!pDQ7cHth+qHZ162X%bq0bIHKth1;tvjpS^$85Jwh(7rz) zu;)L-vnkARl3I79_DOmCUX-mU{|(!-;f7H&(e@Y8xVeGLsUGH@vHqtr_uJoR6H^9) zUM4d}Ha$}o_Et#PhLSplR=Z8JhG~D|lx51_HSOy$o={2sZeqK6-dI0wU+3ob_F})?o*y3%KTLfdE@BJlZ8v3m@V`c%Q_%Cd&(| z;_!et%ELwdBXN$b zco?CZ1o9Hw#GHCvcL1vKU*EG43%#Z+FZ+ZzQ)Al z(KAc9n;g#L^8F+i?7MS)lv2_1Q5+9_<{8$j>-fS;H*i{kR}f{G z>hf|o0~$lN5u*cDlUZlL#2qRmk|Kasnql(nZvCA64kjm zCRrbmk9#DFEZPWO=UWQ~uwh%)5|;B~>MCv&z8R6u=KUAxe7o!7FlTUlP6Xjl%`mSyOFIseD3aUB4;z`*`h7aSyBr zs%UJ}kPO8bK0L&?5zrk7RCaqms0<62`Ox}|PgI6x^5XG0_RXh8zaW@QH)% z<}t5HR*Ir68#_6h!ZYxZ(SV4qU&899Nf;h~C@E|+lUc7WycE3OtQw^&a2r64%D8|c zXEzNI`N+_mrV-afHP;<}zdLy%{1?v`B zKzl3kJ;fVi4(U~cF;8IY9Bbj${DxzLvpD@heN|}t0UJMz8`})i`itZt{El=k=P3a8 zIKu81b(1aY0&mGnTbQ?3;iXNY`re78f~M23kc9c@Uf)>XT!>JM*mtj+mKgJa9C>Ge z#xyPWXe>0lw~3{3V5J{e<+J+us4(^YvoG>cuP3_hW>y-+84q(X!H}`{_ zK&@UW55(rs?h&guk~DGK!5?eK#*dc%)*4NGnavhmSZE5jQRpAKe}H;Y-N{Q4$)?VFGd=7xIoI1r_-cg2f-9#Sbh8CeR>K! zwJKT23ojlem9uFp?xi0OhlpVoNfE}9V}THEho~q`V!0ddJf!k}zsCCF4?K7(76)i$ z>EwJlJZ@nn)%4~xKn|@5C6Ht=xE}oe)n60C8e^&ezV!zo@BzECnXIG6%QHInl7$5x@M};bdbLIYVZBV`u;`8X;aT=t_Oy~f{iBoCjW)syanv=c=GRkz8mo36 zq<Rg~tk;3KpXoacK60g@x+j-Jdk->%k5+zW^%H-0BEV(;ZyIEEx6TE{5 zqB~`b?kyRL^aTo3^zzxZrrn|+PdOTQOXaAfTJiy#=bR5b3PiBE0l8zC7elN;{BYAiux2Abu$X$l zptO2^;Ba+**@piP4~)Ga5Nf@{|C4bV{1KLX=Jc!HuAG8a!VZ?11Q)oB`{j>8K)TEYbhfk)6j za=#s-%0MvwbI|U79CpNQ_FgMxR!HKmYsmJ#9JU7IDzb|vY~fy0;T2IU9T5xa+N0gZ z(=Aqn5voNejZ=uCzBc4V=YR=ignihRzMu&&&jPP9NY@4gofyyNnMZz_&M0wut&`h0 zH@%yB>XV201oBHmpL}s^J^41xxt`kehz<0878MOICBx;lP+ttVwt;Yub`1FWHFc2n(k7A2~)&*uG58Q$=)XU=+I&t(o;iJ{X5-EH?j{Ql4* zrBiW~+>BvLR0NnzN%l{Bfx^96^)+N7(9?$}dS=u^=(C-e$jgqT)5=~3+kZ3D9X=El zt^agRn3$Z1kT=;G9rDsT7Hc!SOSB6PY=f`(r8G6}liFG&FI+l#&jYS;V1=*i9&G3J_ol_(Ar80b9qR9e5%6VzVCX z=fJnHyp-3!c!XDj@r76B;Gak6HV3%ZQEKg;A+{;dzk{NSXT<~gC2_c^#sd^U$E2dl_DLv%7WbO9*Kv3M0dJhP}@Zs=o z$27^c>;}y5LeQL?hnT4DjeZzci+VZ6Hjy0s(fOPQ!&qz`t4A-K*n{1}tMw5m8lK{- ze~rW$#jVjSw}Fvx^j45~=C_7WP3ky0PQq64!G6w=((9Zl@gcDd&%z=fCBo3xjU{GA zz9F%$$t=D6F?-glsHPxCx+N%ifv z;CAa0oN8>}QaT)@5U};=$lWk0v{%w@?(UP}O=5U|v${X6x%6yzbS(xLNm-?*`6Mv%cWDy0E`iNh8u1M5CZ`(?35Pjh4)$b zV-BBIEv90(7(2RF8GahFR36v6W;^LBmAy>iL?0%OH`sJ%k?!`wOVZv9536R@*}azgH6UF^o#huk7Q#@ z`Ti!1t@A|e?78$cHsv%GS(4u+m=j;Hj?B`?;_sQQHZ*=yO+zNN#AENR?{_a*0r7+2tmWZ(6dBfFIoMQCq;iITU zF@ew`$aMJPv=x<#Nk3ohZ90vEawsnjq$Br5{jn$)ZS>B86%0Q%&>3Wt$zsF~oJS8=jWGrUjui1s4&1r5Ar zINNL?fU1s-{u8&ZCGBzD{|sy47og2gGL{s%Y1te?rIk$F6C1mJxBUB29hVEEqCL%7 z-#l{!zSCzTHrsoST_IBn)sWCq-SrMm%A!Fe6;fXd?&dN+yhx1R|AdS5J%D5~yR?&% z<52QsbF+B{GfiTo7?gNr;;u~2fK0xu+A)J}ci~0t2MB8wb?=nUf|A5Ay9r^8^hDfHopP zTJjgT*qXBBwP#frokufYzmp&>rFp!H2b`%0gbN7{B_7M=X0Qceu2dM>W(+3pJtg!d ziLXW5?c4afDL#;crs)-*Bz`5HqrS~hz)Tq}>x{7-CVK)gXpifBg|zbAP@zGg04rl;+Now0nL{B>H{gEs+|B^$dGIJVO+$w=lx|lQr(Pi-^p!*a=Jw@#5H%BoXjg@lGm$3{{-W zQ=Jlq$AYk?k%-@ljkR)$vvi8JP*%n$9lmnt3-9~(u`)N88XC&qjr;j{GK1iYJ>dKC zbvjX~JAjZ&fQN_w^%Cok^lq3M^Z+$Tv6w|OOBC*HfoG+g^jG?8QDc=lx_AQgJqPuXFe!omQtZiV#=Uy~9nzBo^(B#tEh9VWLE@Hm; z$a3h718xKokuTEa69zZ8j0t#lD53?Eh-Fo6;qUeGYYjcP*cOnm+5MCnC!AllJ426_ z_vfQIZ%*+A63nGpAA3-Kb*80>x-~v+Z$}SPosm)wR6homD8sDeXH@>sfF8pQ*De|+ zZGpT0B2I1PT64d4%jdkLR5D5NuW{R^Ev^pLh7X7snVaR z!)mbOGu?uoMnfx!-aqhPs6Y=9BCE8McCq0P33Q5;==uy-dTWa^+wL)#G|y@5YHTUf z8~&U}oawhLBqU7l>gjm#6}OdnzOAX?OP80G>kUNoEcCcpf>aqls?(fl*_13KdH`+o zEfb+d6%me2ViI#Zp!mU7Ek#CuUWr-nOAJ>EF8CS7B1WR!M_$WqMG9RUN@A9uOF%I^ zp<)!q#}X39bi}=(%4$~P#Y7q2%j5*HlP(cmCeEo-W1>+ z*`14NL+8w`Ib;SOUlfrMJmExH-Yp<}xGPX=!Y;r9#S>JnyW#w3U-uAbv1FM_0D{Ds zvg2;C02;=wgLwZd?~BnQ`ALuVJ5_w-kzv6 z4#_yxJ=&ND1@C)KEwW;${7YkuOWku-?zX4f4V1R?=~hpFu_6H%*D>s9!-CZ3!hiiv z`?qe7Upwi|X~eAHL>&bmSm$vP;UTeif6k;*#!yJ>2vds8+nHGay7DGSNZYDgbUr&2 zZ?yugAt%b3PI#C`VCXKLET~Ixp$}ECvG^bOcagw?Cn*d9b*1UZKQz5vL8v5pVgL@I z%RzK$vi;~wURK?IPR32X4Q6+d!xop}EDOmZ1ILI|U(k>=@vkyYg48m4Sy6_U=Uqq_ zX{gJ!nBBH%QYq+2v=ddx#aD*98yYRR*7gHOy2Ipq8kB@nHeJ7l9ToONk8GyM5e-5Y z$uV9mO?dZ`^dq|P4qpLbgtyF74RL2BVrtAGJ-`fpsytuk7r0<`TK~CgXRMLeVnR7N zzJ$`a+Ijq?{i1k)|8tSX>OvUv)V71XuM=bG*Y#SZBO$0Mz6&sBwvZdi{OX~H!{>b{&~elc8ECzU|fj=KVw* zPjypS{>%G8{KNZwdHuutdHsLq{U-Nt%kZ~jBW7FYowF&Gt&tr(f@V1OP?=J`Y39BC zHy+V8^;Phk!n^~&LuHqTmZjjvqR?l>;9TQI-}E&o7Rg--uL%j|cV8)Og9D^kz_f#e zi8t^N%ctskT%iB_Vm@rryy_?Em!k?K%|Rn&7Q~5gmDyqL6qi0+rFKGNjWjG!+iSSw zW$&=}Nd>iIeNMM(OW*q|gdLq*KVvMAz~VP?mvB0?VTXw5o&JSa@HaTq{(!^LJ{u?I zGL6_2ClZ^7Yg@se3ASw8mGn5Pc1$*aB~nuK3QZuS`KIkRV4QPWISXVC5-c)kIxf9+ zL3U~QMN@V9_Tx*X_Z4GwfuC5=CLinRY%MukY!__yEijetxp}U~)hHl8Roz9eE$xEO z#iNzx#zkmrC(6lFV~pugw;CreyPswZwX>$O&rOFt2evYhzhs(;ft6SB$q}w}NI7}? zG0Ms*(%sd0oebP#C4gujanLrSSj0@np}MbjrUaJCc62Yr1W$fD;QtbT2x@&IU?P4w zV|)jQMq z!Q!shh&53q5?p{q;6jmsu+b8hzYGrYA*PkDWr?5iQTRFk@`KR;$^BO_YT;E;%y5ua z7`Y+R3TC`31!eW1Lo`F#qblj=4mU~U4a zP#l@nc7OjT`%h%?pA>V*lfBP>#5RCo0Fe9^#liitmAvv#@oA0M2_RG&1$d%wkOz;G z>Ti62RNL^h1~A9(ph*NIX0_Xk`JGg4a{dvsWh02M+Ds>U$Q32=Jic=0BP+~5%QID* zGMD@c>$PIbOSN8l8{8MgBL!z3kqcJttWjj0i_*B)jXd=H+v^WQu zeE%a3x^uZ&MQ0gdK9_)|@Ggw4HfSXftheni&;~rR2RQO(G^BviSW5HnpQ@jN(fMlz zR;IN5qRrvt*X-s#goT)NLLLed?U~5==?NN%4fJre85kw;MsW*g3JIB0Ks>gY?GBrh zT;U~}HQric6l|8m(T5*nT9o?m?fl+b{y2yzYDy63NKeO%9qvbqjZUnI zG91p*^CImT1^j5U?w2WdKV;cJX58bZh&BiLjD1%*1ClB}I}>fXXuA2!a2fCH(b8jO z&XOs(o}Xr$x9-)nCLt78s&Oj#4+IV1&S0;{&`hfC z=rM`u6pFbuEHno`a#NYt#*T5KUs(qDThAI}0j4w$Lomt?c7^cxp=no)#q;7wjm@@@G8rs>&S#E67Gn-(~m zK?hY=?e^50_u!xrXOs|3W$dm4yvCt-RnKge@%wCWi@Fs`D&q<4%->!NfgJ^D)^z>dhfZAP3HHcb0auX6pFbPuNZfo6CSF%sAjjaYf zlyHnyxT6}=oz>^@zI|NorG*vCV@)W8tNX4@7fXZX>0{n?8)3;w59|ObfaSJQa|neF zf!)Y2I!>q#rHTqextGf#nh8vvWFZ>PYPlw z(oH}aI4qau`4cmtnMj(pJpqImGR~2U4pZK07!_q%`1A6%a{&PeY$(YpV0l`f)eRM z6)#JUw5Bm_(9^tDHMd7pu-OWL?b|ZkrvtEkUqTA^ul+9%3C(5%zc&Ib;$m+kqKtDL`_K)@^i!8sdTniXeCLl&fs9 zP!0`zTUxY*-ic~L`ks=V1o$aiGeCfLT8`gqz=r82SwU`_jiCAWo ziIH*kLVk^7!L=Ss&~^HcA3NuZrzFXe=ie8~hbFnF#fq_UE#@CYs?J#=lVVc-G2$=PM|A&R?gC z1NiAktr7D2$`L!LtCCd(WG~TgIkxR0vxrOET$I3Mi2}p++A)echriMAp?X`>@a$SP zKx5_kog4%IL8R<+CN7cUM>*<(G^sOIjZyaxJBX?Z?g_*9zg6_eUUSyNa)~h_nTHT@ zS56Y{dv7pJkLXWw+PS~|Mo|-vpDYv{29or^sf=|nrY*Zd57*8PQ!5E-eB7VErdn-h zK$}vVLyyzsh*#;lH2o|R+8e4pp&-K{yNDjx?P9P_M*qS}NZPz)k-rRSZh2K;{)q?N z*Vut5Jx9gRmV6XMmu`my`p(9E|8 z@hPP#uWwuv33$U|87ONEu5>@Z(p#(`R_b=O8>9(c+GsV$M}M)4GU%ac(i|+(9GO9Z zIv)@|HgDO=P+qYJ{YAIw;yX!YPgE8UiFKX-gNlZ#K)-ex4hCJHJF}nZ9n(Vl7at~CWu5(PF_$2#9p3F=Od$Jvv+lO# zvNVg8kw~+PI6l2Y_o2HCY#M|j9aKt5((02|C7icUorDA(B&Yq(2lul%4gE36OLTTh z?zeaZ65iUtYi|p76R{V9$8BicfPcGre^Av4>?gIgE5^l{XX;80G!ABQ9?PHX)A?}I==cHqeEn&?5?G(59Bw)SXQUc z_wlEtL&gbT6M9ieGTwg?CP%86d@2)-pz7n-RD`H!VGd~SBOpnQ=q@@Fqp?QFpX+VA z*3)1Sh24)igt`ym-xJ_kB-wi7FjU9T6GWO*CxUhhb2PoM@Y?9Tu$0R1?bKcjn$dxc zF7zow!<@`1Tldo&K%^b)D->qs@IaX7JD6wd1i{2tzn|6Q;xRnQNT-+p7YsM!uCa{q z!h>AiW)OzawHAYzWLLfW2h@)LeiNyCu;}|%XBLz)ADYpzwJwc4TIWl40uKSB?caz~ zJ)fAl)LuZCq&~FftuefB(agJ8^%+U7JUsAijs@506oyu>jPkalUuSAUeu%^jq(coH zCVO||cB8ur0ahzkv8!kRFp+V43ux)~@u7NC0W%oymeigIeb9tf+KGTu5*cFyGBFBU zgy>0j;!-f)ZGK{kDB~a;G(s!JdfOMJhBy7)%?nQK3+%$q8N$!MfZm27S4N}G!BY(g zjvj@MxZO;e8|H@|%L?6Xj!KCmk{#Ls7yO-l_L%NBea^}kwemDEIjkGSt`AKuw^eLR zBv(C$MtVtDSk|!GQBD{V$T{a(#5~{QXH~dg)fAk3SeMq>vxm~~PCDA`N|~`uZFJ@EppMuIkT&lbx;`iln5HPBPUv;BHo~VsV<=ny+*=%G zplkp~bF>2=2lNCQXLc{pCN3tmKUk8Y`4@7733F?2eoX#0ZGyo?!J%29(LWto35s1y z>w2N}_y~Rn?7VX;=h|g=fq=6EMR@&}ngrTofh6IaJi9k2{eP&*o4cN9==R*c6)^yRiSD+s9zX}%nMT8t@;$RC5p>^@|3Hw{uyoQ?u9l28|oBxRiz~f zD}lCS$U<@=P>bq}r~QYQgv1=4=;K8FE1&WiBz2Vzj(@Gcn!;cc*!-(9vwya_V@qcB`ZC=;{6I7}h>`ux1;11OO#6@cH@U$x^pgu@*6#b=R$$5<*Qv5%6G6Kd zX%g>3kx_`oySo*`rTw#5=&X>!*G`DAKxx%1KR)iq6~PJr$8%rb%(o}*CylspsOi}U z^pg;EN_6n#8rdX)&%^qCc_dUnzh1fET|vE&EI}v%O?vHjk$g7gHOZ~Uw5u%JetFOU zC|>8!Wg*O`z1mAgxM0zYdvg#AipRY#hvlo6JA+s1xviyibzc=;SOTXRkr389n#*eo zgXYF-y9fzT6Idu_2d;KPsn%H8HXd(x=f<*J^bz>_uUh;hM|P+He7Z4`wh_zF{2z;6 zR6nC1=;F}N^2YK>7^f@VRugejtCB2&jdQ>DN}|TZamr6|8}_#*cFA}t&MB6ZZbNsh zyI>DsiMI(B1F*Ziq-kkZW4=Ck2hhi^Vy^8iH&dsl&1`HC(2ZpDb!ku9f{z10MQE$# zv$RsX@t*Z&IdvWAkkW7U^Ke+&=XzumpI>zdJSpmM<*DkpagAF3B^^;+{x9kHy7T`t z=~$`sAJWkms(~}0>~V!7=T`DrnY!Q9M}sR^Xo^1sa#~*WT2nLj`d90(C)w#>4C!<} zsb9FXYnJQGWE1wd=z$N9I?toiL(?{PH1IY zE`Qcb|2VN0X$SkuL2nWR9)1ab6dMRNzn4Y=9Q<36rnT_rsJT2My%spydje^N3_gb= zx)r5JgHeAI=ax7}tL^gi&}OMB_tb!xN4wbuUVc?r%O9d84U^fkEoD*L^Y(W#Nzn&v z4^YaOs3U2k$yPC|XVZ>=Cw7DM1odkOGWV-q% zH9_(@e*&N}D#AI6vqif+RtL-FsqaH{Rwo?+-eiZA+&aKgGJC?6Pv0&>7jsE9-7u=M z#+A7Rk7o57@02Q^NfkN~(?XP-$p*|{^%NK!(UQ=&S=4N(kea!Eb-OfIg0f>PjdloQNECO$E#ejBcyl4zL5y$8*Vab1wh_9^%H zrY95)ouboQ90tb23tu)2p!sWv>Y&LKXetPt)X3+@%d{((XXM;mU>TY(90dd^nG)t1 z$^R^t=(ELiAE*$lk<5LMOQaEsK7v)9EZS3$Yi%okSZIXJpm_!*vlc(9r0l}zEs)LM zvB$pYFp?^X85_D($OvyV>p(OVi@L>fx32yiyoL#x?i;s`q?cH7m(a}oj91LOE*k(% z%An?v@K;?#Xa6%Ym+5(KA=!i%Q1HG>tw>g#QacCV!ipixs4bDNUTP!GJwckV`+T~= z3tri-q<~WvHdnj!Ny-BsENv!Vmv!4<#911Gb~Y`sLYwK*iSnM{ny+0^8<>DU=Mt>O z)`=g==Ptu-tUF8Q-NG$d-J}Hq=IvRKKxNBP7Z9Vvb-vRTcOPQZPzBQ#IF|ITd(=|t z>lh>Eg8oKo@q*AJzBKw)wsJ`_@l$eDgC97BHEX^-QA-BPYIJSeQQD~7whAep2S2vi z;p!KOlhR+(Ir-=SSUpodVBQM0Wqd_1xN*L2d7O62y-164zp)m;->x zSJVFjlQ_w>wY3zw%#Fh}bjnWR$?ew~Xo}3`au|U7CUwN4-y9nLT(i>!LQtuh^Z?K3 z8Tx5bvbi#1B@!6@D4sb*&Cdx&st_?fh`l4+>aW>*bFa&;=KrDX9-||R+I`W79otUFw%I|& zwr$%^I!?#7ZQJVDwr%U?#olM{bM78@+&jkow5n=7bB(GGwW`*dzxjW%qpE}O3@-mu zO!h2-5%nv$+0p+?Od^8)TTJf#hnW0cfm5eB%y(VmDXtelPl6OZ%mL4kS*#o4qemV9 z`s_q-_Egw8qu~8O>zA01(#kg1qGc~n5w%T|qeC;7*y77Hsx|6Fu7ugCKysN(XkUFF zN~>&-isZ~`TqYg0u|}`wXl3OV^wb7+YZmu&dEeR$Fqjdm`Y7%Da+m$}e8ec#&8|!} zGI(-uLa(}&DUgbIPU$(F@k5LPaCcx6i6ADt@EUlz86qH3Dcbf$5;Ux=pp)JEq)ujPl_=N3^V z^b|OEkc04##6qBm$u2(@;8&n@F*Z_w5Us;fcShJ^uHrIgE?xG}V}v1dU9JWr13qe2Z(61a-M?NJbF6t5sN zYDEC;qPAbm^wG}nf3r%loyQS^Z&pd#L46uB*QGsn*G}y7%_^O)_4B-WGfsIMu{wsK zXhC=t&i)5h>F;Om88LU!BZAs`?MFJ|SfmDj|BWguWB(IXI<-biU;PtRey02zRepk? z?)(c?F1Y_ssM6f?8&$IEw^b>Xj;A@=z*BE~wCu1L*=n9E?jo_g;iAu;^&nos9=7NZ zW)6DUAG`^BY7^Df*hy{0GsY=_PoyOVWxo8tyk7}0W+%`RLnD7;F^uBk`oBY!#;i*8 z)FP?g#29z>sRTQJ24(vecy_r;K;%>D-?TTO{D`=Wla9oDIz<`_FOZ`c;p{xbh$=3E z>(-`0V4wivLAgP8-fabfLUOOyTonk^P%g6^xizn!bR*)hKLuviq1jJB2~G-iAA+Jt z1VpBJu4P)p2%bd|Xr1ZL^MUON@x-}*5_kjQe)QrXOjnxlN?dJY@a|r;1LFX79t+q* zs1XNf-xIdM&$saJ@8bX2$dZd_XTRoS2p~V_5B?#34=i>MCVCGnq9=e94IJ7N_|wCh zdr?ndSo3vQ!(&(-AN0P4zYC-YUBSAGyJPD@T#dR!x>_NzW5f%^kY517qk*zfR-XIBWX zk@(gnt;-E>wg(({$^CH#0r*zPHxJa*ST_Q5#|@f9ReI2wq3>pPj2!&g>53@pO&a_i zwyP*U97hf09OW>s%1FtMql4?*&F$}Z%4^35Xck!$7ez$me7>G@b06z$IB>vcWe;%s zXSrT0OQ!LnuEtwqo%NtusQVlWq5P06=5o;=Zm^KEIrzop!&8!sk>9=gR9Fn-JuOjo zPUAaN=IdKT)CXGdFGw*W4=xwkopExQdMoI{6D7ewYLlhrLwxWmK*RupFoZz6rkPTV zuWc%5RSEYBS_^_|jNxJnFu0RtUDLL|T_l*z_?pKedINtshoF@ROl(qC#H9^{!pz`(f>So zVh`%X#uK{U<*<11IRgBm37sOGQ!(}+c-_YxzJj-onJsPV)c>!1(zE@4;FBdO5x89a z|KyYEKmQw_?0Ncce6kqB;a_~xrRI0u|KgJ+BmZCcdmCcCNOMsR9lDO(v)hNZk(H{;y6#mZ?Nm?X)-!4t^8Fmr0=AIU)_Y-pKyC zuJ~5XLY8220QNvdMsQ(NUhsswh(yt0q|&?*jKVD1Xn}&WK_7+}FRPPOS6q04zoVg>tgmeTd>8da|7)H}7)sJ$rQ@wP^o{A-wqHecOHF7o3y_ zU-9JDkDO3%9$J{viNS&+IIcT8UexF(W=gqH(QSP+{k%tHTUfgvpPiWeW|OJ0E`%%6ri-)u{k za-VZn4|UJd#nqnWG|`Rm{f)+mZgJq)x+*D$A>l)LB$Foh>Igozgm)~j5Sn|$X_A=z zeXSe)`ZzJ#8cluj+2$KQlfkd>TG8DdHat3I*ufgzlpvYJZ3rfm7}gQDPBo^9Z1+}r z^X0=c6yul9^zswfRjdaO*)9Z3i$54_{Xd?f49EDj`@%xC2!UKCF_LWCME(SB#u5Ut zImJY_YmWXd8~%Qv_>U@6SgapD|E#RS`7Xfx9$||L%1yFe^^Y>Ko=(T_os@=RJs;6> z(IH^#``?GV#Qv^|@%t`{`)7^y2?A8h1j;{#&b|1}vZ2ns>sk@PWK~Y593V)IX&9?y zfnX^BXF>*tiAA)#s%(WEE9RYd8G%oGj|q865UkO4d?!gxjtgX9Zg@qIc(Jq(igsLPo$bAG$9jQ-;1tpNTOKCrnl{8v)ApbLzg?R zBWL3{kd2kGRrK3!oN^~JBL!oxd_CEQB#ATbIoc*?CMZpF;;?RUSSX^&;uE70Q&Y%_ zmOBZAnqJc=L7VA^0^!&eW&6B=G)!V=s5rxttV{mU{>*ATte{GfTDY?4Fys$YDMb%L zUkD(=skT)uzX0h_htjyE!L6Rli@}=Qyrf#xuae1Zj;9-2oi_LX)uq+aAW9jY$Xk?_ zis*EIM1?gN3dUxwY_G?y4MK+U2qK~M2!kS0d5)Dj^8Ob;9$q`BcO79YXqeGD_$;5~ z(9Tp2HLO!lp~i)lDmA)!9g9bqJ3DN=Qdot?hU%P_f#&eI&*vDcsQb^KE*_run}g$OeqW#GIn2+!CsAGe4{V?3_v7R1>tWxH zw^t8`PiFqt2T}QC_RC^j1Ye^gesW|^uGic8eM&yL{hadB&fh4AzBGU?s zM7&%elsz&xmZ&HY_aDvWmIVl)*P#bHKJO4)2-&gq_Chg0sIKu%TQP($Jw@;#_Fbe*Bx%BKUjKDtT0i^0M@I-7O` z7Xk3#xE8=SysA)PsVqVZ3ZPM#73&Y9!PChR*B|wVk{UI_oC^w>zx+tZGCa&+7uYYt z^uH(0E`T|q#vr;42qyAdP=1xkpz7WROsup{ngNqH>#FTLL9i~%lfnq^JM_{h60!uT z^pa&M(rHz8QFVZ!G&Ruln<>Z-2ALZ)O&VlNs6Pil1Gw1uy;LdSiT3FOHa-nZi$^PR z?hpf{i_9iIoaZID7qnp_cWzaJkTkw87;HeV<-z4X(mJ^6o@lix%xA|b$$dFM2rvF) z+Kkit?s7LyOQPS76`shF&C<)o#aVAsk57_UMBOGvl*GZkJU;X4Px@+qFY=hJaYNqs zLbk}+rdU@L6kz@2Bl6Zbw84oj6=>bZp#Sh;C1?_8=4L_Xrj2$xAKUukozYmgsZaC zc=ZP`@L!O%>}5|n-q&b_!5bb~2O8LLxdfP>LbPqhwVECU37mb|{N^>*+Ent=l4bwN zKh2y~#wK&OgV#WYN8?*A-4VD`c?ghGHI!83fqk)uRaDXjSm-AX!)E2c~lnYbc%TeuRoCH0wFrn zHiC8tosf!rtd|xi5w2O^XKiWdJU&{j&2v*H}4ut3IGEczUYBJ*?arJHC2qeWY{7tds&w{V&L z+4tE<+p2RQX50)|df5<b(A(Sm;}jkQ89XbRNtdEUSZEp`M#A=;$=M3~VVR5w z%OWJxu|NkR2)X1yoQ6gs)V7%}J;(7c{^{}`{PX_*;GaZ)zWHbHf8(FhmH!+6Z21TO zTy-*aPJ&J_|HTSV!g%B*?SovPuEb+HNgxqhDpu?)QI_k5N7zMU-ybiQ~Q0u97&RpI} zuxSm}*_V0t;$#}beJ2}es> z(9BO$r2nNqF%&U>F@7HlZlk600Kx?(l8fG+f;Ue~c`tQI}P zPKH9S+|~z7=CY;Rr#??`tvl4mu-2{b1vo>tFUU!O@&FKvzB>${42VMhe$@a*Nd*Pk z(m}QGBkye6>!?NaHkb{qXDxyL>b z3fKomQ;2Me=fXyD_?ea=s$~e+%+wpPVQ_hSb!L1TJl;(SX0=z|2z=8gY9;w|xG72V zOKAzEc9@@{Z^W>Mm8gSwHiD=l%YQlwmK{lVJ?kO@-jK0;U@)tBu+HO0sJKTA=ETRN zW@(t@roYEDDbqtqd_W`UuIN#fT9Ai_M#YO z99Pn7+F(ZonEnW$H=6Q*LJzJztUu|{h4S5JdrjM77SSYTofn=|xba`0i>pRszi-dt z579~&>C9xX(4>=Thyw|-_q~1$T0~}h0MKYFiBg)NeJqQuCbb`xh%XT;z)xU);&Y?< z7i(98y>3u`A%x&hVnj58l5hAXJ4hZ z`c8%9`+n`ahWk6;k;nLZ*cb8qUaq|R?f0Rsu>ZF=K>P8%=WgJ8aPx`RFQR3~toc8r zg|F4J#xQ{1xUT3pbKZ1Da6vGWdf-kg91fDjms3K@6wcs)fz?7`TVDXOy6z3EMtZ}G z?$K5EszMcqd$vNoo8IOX0Q=cw*u+|0vD;L9EBo8BW-$HVSXN6^Db*n4iNOxNAZ(%f z!R1M{pePH+s&(7h_g^B68o^SXaSrUHg3P3iWX9TA-HAY++|D zsm{pK%~HZc-|+$;4zL^JfB#mbc||m=vFu6U#G&D$Dm`^$%{}in&<2e? zxVJYz1qz5%o!-G^8t_Cul!N+R9MH~KUw%jmj3G%gGpOG3JMmP7>+hAiZUf- zjd^>SMtZ%F;)Y$#V)|x@cE6l|UFxP&M8=_sCv0-EB<9Zg;zbdaJweiTtT7IJO652L zO(H%1cZYLTz(jhCOGO$8Xkx`_U!jio0;*LR>zUGw7z)%sjOec7w-HsM$?ip(jK6O* z@oFe2wSe!+t2UFDGIw#L-TK?=LqC})5$W#K)t;kbKxbjU_nO7l__)7LTre9nV6{ZX zNw*B?L?2+!9#|7?N04DTjDcszj>s*Gr(4C}@ji!f$%Rrnf#OgqSN?Ln1 zPp{0fc}1w{VwU$glll4VA%|@I;Q>Lf+b&<7k=uoHCkkQ@DComK9@_jzWZ8-$CYq%B zJgH}Y5|3nrpmS2qozwL^x|R^tS3``thH=n3N@!2kS>>lf7cQ{w#tRzWwuN{(6>li0 zdq?_R2U05)ghc_wxGx(Qw8&8~gf&MrVFN>`u}+Oad6Sw+X>x%oK+6boBS}iuy7ES8wUNq(k!5XtH@J{O)B#*U~Cx7QX2){PMukDiC}eT>bVm+vIE z+*Rf0MiI}sudn;6ZO~*{;MZe*9!kLrBsMRqD2bnzG^Qg8M@coqyrb|!hn#r4`r$4y zOSP=FQ2bme8Lo|gAu<~}JdMEEpPu2dGZsQL@8JDYqPu(-jrQGdNJBj}JfORFwe4@H zvDwq!rLss&j=d1il?`W$+&Gs`V#BvBhA9+I@-eI4B`PeQOPdJj{8cI+cCX zkgZG~AXKcP%?N7y1J(M)TnfVu_?ZZTYro&hHN`-b3-9p^Pjzgpv^ix`D)VXd1o7<# z*1tt8--4vTbwiHfWZTj$AL3Sp_C^~>!wKILR_WbTtE&(@c&DWY-K4|@sHipvk1Rtt zt=eoWrs+B0mC*>cR+2p)<7DJ-U&OgN1rM!!ttaSam-u&c6!;2pb{kg$4p>n~4!C;n zlNS*StvNloF*q!9I}$Mc-&QgUetB;#zA7m1OgS^-Jn>zhFSFyJlsRj2HMK4!>;{jw z_@{iY3mxh!(pYSR;7)NWeCY1)-9p**c zMh18W`gwTCs9@>uhD*Esd9Ke9E^pyp6z4hjizTxYkQ@b??+w}Kje!ID*K_5j?(N*y z%d4pCTF~WZdCQD?H~WMZ!3*z~S5ppAP^qWSjD%^C8Naar+MRNJrPCbRgolrSV#Dhs zzu(j`=R;c=G$L;U5YvQegX;b8)>nrq%G_pWG?7pLRZ+@JxQu&mr5tg-cbyM^=eE+z zKQ7Mf_4o&*s0Wif^c<6lKX?<`Q-eY#okb!N-eU$@N5)@<<3Bq%a}jPXA6d4v^QbqR zvkosc=ag1O2r^+=bRSj6#ku65p$iu!81*a2)P?>6-6<<&OoQBjFu~0{Up2_D^Nh3? zOlJ|DKCzYqpCR-yjc%|S3q!v(RyU*h#iOBITxPoASQ)uCDk4vs)9*2TX)DVy$Cu%P zH+s#_SRtD@{g{@(^U|XG7z%F(M|1BbdRU-01ChQCr51rJ{cVt%0YgEw&koiQTcrPE z!Sex+U056StyXC?%`q)CS#O`TEYM+eK46CT>dcUagfx2>Sw>#``zJ7%@+R$lYDYHv zi|hNw%=e9(_m>@6!{_KN0&n+w%jccD{QUlYg0Gv)?~J0CsrTb00)X~rOSTX1 zdu--chS>h`@z~U()VWSrx+S7gx2JHe1mgwHY|Ua1>{`2Rbwd(XLWA9}@)%Mvfs>{o zL{i5tBcl6HZtCMttLC$ougI$yHJlZ{8%S39H<}(n*{2iz$Fp5dVKABqg<1dFjyBw{ zgD%o#L5Ld5=_+!5oA36ilj5CotCJTbpdIFRPHwO#j|eM5ENNLGFKg6Y7o?leI@6sS zw!emcU*-Q+c2$|=X-jc79Yx9%%Pj#>+pqi%q;Ryv!jC^Z4$j{hPYnv=D#ZxnHdUb- zbRx~Yu`vDnMwDS46rL`#3x+9DIqm1M8spz`wQkG!dbA#C+XWPn9R`k;diRpCUL%oh z#^?IuQ@86Gq~fCnjhtXocB_M%Ao(RQ<%%imnnwh=2@GBZ>{C-l1eXv z<}|~}9K|JGAM$$2A|eMkb%0&RUBlVERf=3~)^6Vo>XgCx+Fu$xNtpt!_&83?|CD;j zHh!{(_Ag%ep|Gz)nID?#0!Cn5+5DxWm)@M$@V02l=2@pY zW=mU%)MIlk#}+>xbACP!dG-ndz$Jx4Fr2gJ7P5<`Id6@@&&nskO`HwD-<|niJ(@p> zuTHQ#SJ^bUnJ!&#@t!il_{siifaX{!6Ep(w*!i{AtI6V+!w1uD_siduAY_vBe!=$@ zy+w!l$H!2iFuCN4*eG%^H8=&rH%v1)ZApkHgIqKuUguhy=!rXu9LL@EJwzuC(ClyC zFLMkc^0CGXE|HE`H_VQSXJ!j)wis=x{|;_*MW?CV`ZOUm8?CRYE4Hb9+zPVEjbo@L zJ02XXV{-w1Y;ZUpEzUDUG%Q~hO-nTZ7zrL#(;?N%)n(B`l3w4Tz0aj+VG7=9p`-=B zFwUN?<&gekPRnF4-0qlULs+f7T3SlS{Pn8IJEW7YPYvIq#68FN2;7sBJ>sasV%ol9 zH&zZ5zrR_Lu`?Zz(p*h!+lwWR%N?Q8&f1{SQe%v=KXI@?Z!7!d^ZD3&_q8rH1G6oo zp8yX0ab*a~bh5`yPIRzVK3YExj8wi-Ydm`*KWF)d^>YuJl~T5 z<{`rzwwK3|I_=f+wcjlu4$!Fk!vClYQ|p-;{zFWvsO8!5AmajfeMVjg07KsLs{f7$ z+GW*yT&FkJ83QnvEm^>Atp`W;0eh0p@MuHVdWrywNXCL zwEH?Jrm+PSUlZ88fvTu@#`A)#%@pqAM`TR`zz3YP)k-;G=g=rygW2lk2KlRDaA($) zS)6|7W)A<|6d!T=qaj#K;O7!&`I@%CEzxS^o_|L+w>}@`eJ4|*$SV7o+W;yRMb=%9 zqINRwVcSrJ2mD%WBv2LreHdZNI$00r61QFsM+uL#{Bji8suMwsp@jqFxLLD+e?g_+ zlwPn=AmM?rJf55;2$2lW*8(BFAQImZSVqj;+)n2{C8$seayo<;X{Hgcc{Q@!Fr+7^)khADjtj zAEq1VGva;soYpL>u-y=HAw`+`)EJK{@(byX^_oZ&=hFewDwkE1ef2&DakXh-5KrB*4jayGslgv5M79xboyEhaPuLk`G zCykRY2{JnHr4cJa!^YQE*ae6q`=60A`ZgYdqRnO;2>Z#PhN5GQbQBYX)M|N6rux5| zO1>Qb<+ys|Y`jG^%;j+FQMPTcn9QdM_>0p^a0!DsK}ezdlZd8TU5q`Xx2 zG`?3s^aU<}I!jo5bVM zSsz{koM6xkX(WM1hyP}eq*kg08YvlVsy~J>fv$vL4nEC@tv-dKW?+T8K)}@YFx6o? zB4xrU+snmf_^PwC@i3`MBsYsoa7Cq+v`dK4#pqrSsq&Ya0XfALgM=eWJ`}-yRp#FL(bgIKbuKQ~dl@3jM zoHCgXmU3ICW#oSXLq0qA1rj!(}$&1eQXbl49Gb7>u7SPCD54t zI7}`r=L9w(f}wjsJaZpRsi5+mTrm(luy7jGxkR_q>?|aLxZ#%S)zc2vbY%%e&TkK@ z+XT`Qwc(Ln++J7hAOO(*#2A8_wA!@b;jvM z29p<#N2TG6w!`(|tkaQ$KBMvi#mRwxVMK!g^Ziig!=#$aNe#YMQU@*-A!cQbz6HsrvH zpbI~Vd2Xg2J+9x*2kSCc>+KpOTr|)s8fed9T4Q`HU9h{Bm6}11IBCSluQ3KIWps4B zDY!+%*OB2e;yKf{4l8w+A?TvDXwM4g1UbRB@5ac*dKHAiUgL(+kg3qM89%hllYnB; zNnn3hB=%7-<^kD4xOjm{7!pM%V9^5op>?4Xcjap*(fE$OyC(y&DbGFIL8n-Bj+4ff zAwMKz>qB?ksWqk3>|6g0M`(G57t7KJcD%x<^t0z4hM5$$A49V2h#X9i;YCF*5?#Cm zElT1_9|x%aYO!I|sZ_2hd67FhZv<7HKy`oHve^rQ0HvC*=kp~q=y4T?&OsA?MM`X6 zxMkt#nt`H~OS5DTxFLK}=~)Mn-`Z&2>TVMbw;g!V$`Ql=;IDENvY@}}*$h{E&RLDG zItk!>mL0^U7>I}Sr)ud7=O37A=~cy>=jG6Sr)rET=nVbc1INq2Xp_+3F zDEH|l%0_s)(k@7rsu=5K_GSq*zupx!+*&D=AnZ~?AN)LN z9>zPM4^^&7%iv22pD`K8cH=&iY#RUISi_c)a4uKvKTOFfyadF!7pJ=`uV=?~GUkUV z^HjGtaxdtwtg&NSnmx;{G!BBiV>c%jt@${`eqf`_h7Je0i54@2GDC_yr{OD?E?iA+ zFOyX|(;7y1(fyuozMAExg&inaaX2baDlu^?PQ5uUc3Q~V4KA^1_~{DMCG5x1ZK?qn zd{yyAVjxs0eLtKZG#T=EwR9CFyo52%F#+we@z9zz zD{&kaZLM4ceU<(q_&1z4xy`fIHlYv?Em9+!azArO^${cug9zSuYqFWZ0J2qK?J&&j zwd<_>uwM_#&+cL%*P$Sd7)-CdD@Z5ur#5OwwZ6M|%?AdoLpLdV70FzrVyDgwsA%ni z{FRD#S+OU_PJ@phkEV#rQ&&j0HoCf82y@Rw^~fA&QcY&Y*U%e_bD6;=A}{n6v9FrW zYDo^ONn#^jM8N#eO)Fk|AbDw+*fwzez4U192Syqa%vVd#A;pRj4-bo=2eeXSJ3vnl zZ9AMM`Lj8{zl}}336VZFLSF;2BDd2`BmRzO5KKw~ifAria%kTJJOJ4STm1~|Ogg=w zA6yP`-k5rx+Ngz2kc8`G9rQLM{UyV|VN@ST_{fnOSqy|Ec>lIK;D*1JhPvF<}Lp zC`2_>Eu>;WM)V3l#S>uj;m#;;_qx{oWBHXT+77U|r5}boS@PFzLktvcRX4Me`WL+0syD@-%W3oL z@mCX-UOA*dr5B_XpCf^ZN=<1ir!HzlQQuINVQCHM8e4(Kr>7RizS`U}lfW-8ks_8k zn+rN7v7!^UhK$%gIDVonK=Mk@ylXLpn+Q70|E=B9D0xzdA=`$oo50YuNtnfb{c^OO7wfad}Y*KnE6|X^kH_!OXsb#FJ`%DuQDa~KmYACUa zX1mQ@n;FQG&zXNk@FAFXRJY6HX6x(jA^qq`_iL*B?#Q>*>tpxrs`~5gbt6J`>-&ER z%%|G;y=77N*Jc*!!^hKAU0m{(ukQhDsOH@oDGk)RJf!y-QNH|PUla&4Q!&tKB#{n@ zn2!Qv7pq*ihG&u#qYz3;R&RbO1sY3`Ih{yz)WY@dOHlUstTamUi<8oen3l{Dc*41&;H z8=ZcEITs*AT3r=pLse>n0vt(1vi{Kanqm7*HYuFM(4)`5FhfmAZ7kuz7bwKcbEIl| zk&O^u{S^kN_1Lt_JLus}1Cz_I$Q8l0p*!Z|Jx;yEUjG2lZ>{qbju)dJ8jalR;z+osxK}SUJ3j%0uLXapUGYW#-oH)vISvkEM@!s0!n&288H+Yu|a`!P1MQj|(FllIqps z`tBZwMI3Dnqv+k96~o$N0Xtm9cE5G*3xyVnn%oIbC>XAAISSR2T|aqqj4h;rEhzi2 ztUMuGFeD8wO(RaM?Fa2#l{;uKU;5!Rv-C)@QBOZx5_t$sK;U%AfX-C@hQIfIoJBu{ zaRl;8K2~)1RGik}!^wn5xBR)U=;s*T2lq?N>k(LFV)$o`8v}Sr3 zHY0R+q7uu!i53GVp5OCYs6@rI_8sVD=#jTC(x|kJc8+1Rv|^dId_h` zM#)!@+E4tQzYbX}EfG!S8`{!7LSJ(ka1vB(pg#V^UsVE|%la`DJ%|5lD z3#qqbC`sv-X3WrVQ^(pXhoB-yk`!q$sm@k#=|I4ZpeCrG2F}*mwiT zIzS_XT%F8cKr^p1N?Xzf)S0E6HmftmTj-{Ab*=7<;N=t-J7yyq7_N|(qSFnlMSISt ze>c2>Ck40=cgRM8)Dc$anp^{=9-TeT!S9YFH`?ciaV?q*uw}K$&s>N1Nl72*2oawt z`K>{>@AZ35->A@&Rovp>Rig3G&65isUEv0MC+z#XyWMO;qEOK#p=#F1XcHY*IoDn@ zbjKQr*Tb_pU~K1W!!;hp9~(2#?mDs2a<$=VvL8{bOI6Z|Dhg9v1&iR|^`ynlL;d}{ z88nyU1J*O~6arDN(8=u(K`$rJ@9!GG&=cRtSSE7bE&`Wym^15dVUxj;Au{i;;)ynE z*d<{a^?zJeNEj*tpCeo?;Ao|#|64u9H?iCcVhlw_BuCs@oTM)o74$t0s@i&{2^{qf~bQq@$-e&oB zyI?Fij}l)iJdkXWcw0axII!mx^qCGBIzY`WstPiLY?Um_Zy+1u`2j{l?ijQtx$H5H&)z_f95gQ3Xy?PS9q2FD6c{feMt0$X5NJCsMMamM`MBXmG(yB)U4> z;I3SzKSnC6lZN%r18MD{1&Q7t_TqkhluWHPX}o{XV0B#_qjx8CpRMW}8QwVL_R>eg znzlXWqUm*8TqN?%Uj3x_3;C|Ac~Q{8`PgPg%Agh1rQNau0btzcdjtK_=+@})=a_r& ziAK{zFq-qMe?o<#kTidxHneMn_j82%q*$`WXWLs2MelJO3C{!cjW{d#!O?-8CV^oZ zE?ZOe!|gw4`cltJh3gfDcs$~R#~diDjPNzKwbJBJ0VU}H&rwxWlk(*}f1;nF{H?_i zpMIdpMxxm*DpQ1+++0=LE^9N{@_YS8XgZ(3Y-B0N9JiNpXR+#WvGVTLsL?cO(w|JM z)Z6V7|I(LPW*3y7SV%|*yiLKpXjqt9e~M-V`Rh=jdTrhTI?XJg<1%Em0S_%4YF4@a zj4a2id*$Y=fjngE?K4`?n9e`R8wg?Oq+G3ARIk-5Xu$HDqOFb@ARWAh$YXcV&7fFm z!1K?FGO_FjGQJ3HGEpgWm_9S0Z^I*C&O8a};m$l{F^qc=PeOR`J}3ZIwC<1~ygzN; zR-cV%N8?dcBUM`CI$}2|+w?NmmS1F1U+(Yc=E$cagQJm}ZGNuk=Y>$8DH#&Jy zSDnYwlKEw7B3BLXD-hsQ+0EsF_nG_^U9=lK1U1X<;pBDf{lVr(lh*^-_V#@}>Ga&f z$dZJUOMI^f_A?r(G&B@%gIyvwy0$Ff>ntdiw<0fEUM@1Pw(1r)NNvp8xCwb2!KOJ zF4u-6-_;PU7e?bTPV6xu7`SrnL#pvmB5^G6W1r!>aw!#nRHv0kb%z0sP}pJPsE6o2 zX`g3&fmrT3+hp9-BN*Apx#^5tFZ2#r`;ki%eppPNxzYf#aa4Y*)v=);&+~LrUxkQH z>6ME*PaU-K)pa*anY8qjl{XcghQ%5DJnk=r>W7=g(OQdPgto*QB^ru&K3OEwh@Qth zx_O99?#vB*GB6U+paM%MV*#|soIav1nuX6xnokjDI(%pZZG=`6yGm4n)N3`FpQTDu zm25JI79?VTmn~;@&X_ciim3`qWkz#jxoJodM!a5j=cyYU_wiTjyBU-hH0gYDtuk@(HBrPuO-HDndR&0Dk-*XJWp+3( zG4U-1rO^XyBkLUNLg-J+c09>$&^T;JoxdgG$$GV3E(Er9O|qd71NK%Izff0HbMHI3?BtS8*G=?KoKtq1}jc00htC{CZ@V+rE*%(>#OZ`KYqD|b3Tcy z$ksbt5jr_03#}K`+#&s7agfsfCGWZ+AK6~z@yGIrV)wG~m%6$yCrXbrfJ9kf`aPj&2AFf`Rz+cdLl+8Fev3yWVd&5r_6^B%k|9bhtvo{fHntchqCP!R@XU!kXc#nTR1SE<>6K7aV+R@Pdw(A8oWc zx4_**_Q2W2Ogj4&;g((#7!3qrge$JPcN8RLA#L)$2ub&J*z>D+CIgMMR87Zp8IZ6& zsacQjS);-JSD+>p{+CQX(T4g!aZk>#usy{-8}&w#LM7;BO0DuxQPj-yZApTF#vdj< zShVmJ3%fuSeM~RdT1PF~re6`t#jm){XPI@i&12u^(PCK@SZ{x%E9lQ9H@OR6L;7I+ zqFw9cUdk?8(evW%BQNZuBd{Ha_gYz5eqL_}qr-zaLuMgb`qN@sdJAM{ZjT}m{?o!9 zSXl@1@^zDlp!l7&vu;hGBN6vQ!OQ@*B02Uoey?B)7 zEW9!YMBSRe+L~|H2GYeqcIAeZ-E=Eh(q;fhAzy4sn9<^(IwM@^4dVi3VuLwkxWhC8 zlkj7K*`a6iYzltYQ5b$xcA*!F6Vam#erVr89-U`zHMG~@Z`qJVU{L;vi{7-WQA8&W zQycx&rdEghk5gm1QM?4}PGiCLU5F%8)-hCROeR#ORtoCYZQ5VV90QC;zhOrmK;DpW z0|btS_%Hv+oCPiueJ{|N){+SuaNB;qSpH$P{}+XMZL3Qf=x^)R^-Mz4tdV%e;rXM| z!Tl(d6OQW%Q$~bYn^J5bIfS9Z1V%@WaxIVflr(emT#ympl0XenCSDBjfH0VTq27HG zCxa*jBf2#DE$W|qFbk%hEvY!~Nw9tUv~DDT6S`MR>c$+rX>l2C&WnUwbHzClU8kpsye3FmeJ_XmSDFRrpe_vPFC^O0IQEs~8!iMtZTJwp5b zdV}C%nxaQAulcC^gW1*AuFXWF?A8bvQ&}9I8m#>6cQdQ@MrFhwwN)vxw(;OrUq%#4 z@s4+#tvRuboWFouyDCfI1*4I|$o(QgbsNEUc}EJdw07!MnFuH{njl*&(Iqr^i*HK! zifE+}Ml30pq1?yJWMD(;zTT^LJ#diS=i&xo9Z~mSUYy8!c+Y=)wJBE%6>BK2I@7@X}RI`mHCr2JX~VRHNX5u__GU`lDU!$u6_Rlzy159ux3 z=L@iq(P6O>+7|o?>tNKy-N~#fA0YR*h!g}} z64e9mb!9DzD7%yH-_u2&$|)`5$gY1M{r&k`F;XY(PV|{F-Ro3~n01Av>u9M_sTT*^ zte<|qZcGV`5+FbWvn4Cj)@60^U<1N>H1+VEr zMn}h^6&)R2PpzQTBWu6XaXhzD!M0+N`+QFPcRQkO4VC_1@(3GqCLx{9XEHh~vU{Ad z0Rc0BUZ!Lz==kGN_QQ0y(XBLhtI$a7t#^D_-o*mPa2TK0$HAAua*RE|=UQtAjyY!; z8jd|4wLfXzJX{ZxPr)N!jiv@U#WSwjk}Hc?uUGyf2_wnd35n>wlIAZs~T#^~}SL@O082a4xC zR@6>2rpb1pnb=ITc?`l(44*xM9cNy7^nU@JKw`g`;D9yO(!|S^<@D8mdOhF!U6&z1 z)FMIDBr7Y^w(i=Q)rsyhlH@Xzw??64cc*uAI)H%! z=Xq|UCTqo}b%Ak+YD{R!zh#w5sOFFDhKu}!)I9%F>=Ke)B!(mq*xhg~2~=`p(b(PL zwt-suToKt8J1WaFqi3q3xl~w}->i6W1ZlqD;^UPe_o`nl;$`tPeTj=aZpAw;F?cRi znCxdbt5K8YW9+E283D4Bi?&li99^7L6TzStOZ7uB!rqR`yjk~u&7im@h9|-?6HWDB zFof-1_X+ucn#-@tUipAak*;^#k9^zQiKUD#`bY5WQri>D(Vg8BQd)dDe*mjXp_)k{ zu-qwmQ!;U_X?7DGeefugKFXvID3jh(P@BVZ#N793S^z?mV1Z2Nqr5;qj+nDdiYcGH zqESKip%vae*^w*#$I-=*Y-z+&mVmi#kuYKf(^URu@7v)4W-S8Yb+M3n{2rZf-Jq5# zrV+x~);W`cWEQdvgufI)&vvgRKnfx=O>M2>BvfeA&d$!x5Uuogzxy4L6`>?&8DDe> zlC$^#50R74pFA0p|2}{9HKa6^S|JiX_SF2qz9jz8+X7~Py?*n$!4wO+ieNIy%M{kZ zKl|dd&&K3}SCEm*E!<6F{61JEX~huz6|gK_oE0X}>c|qH*Z|XI!Dn-AQ9jHmEO@3d znHaAxnEcZ#$Vdo58JQIrPk1S3; z$=?+43V5=k%~<$}wDK9m*1>TBiWk(^BnSnqjOFCHW5Lm+9nN4`$$#Qj1l*NYHU(gn zOjGRd7SW{T3U_!mMkr>&W7uQ0@MyZ1({|~7sK3XR=`sM$u8br>)3GD=)ZvsW%*?Mv z>n&;XYKw5#I}(y}sH+L$-<2?}JexZlR7=zC3cv6tL&PP;bX{VXAwA2CnJHxfwimRz zN$94#702YtOrnQf#VUWdm}j}5OEZjUqE?%Nu^x`chsZ`{MUD|Nia$y~7}E393xN=7*Wg!E^3smip0Wq2gSbc#*m^pDxUlltn?PQJJ12=M*(9~u z+Vn-jN@CkAtbq`gNHIcWOQd)fCAcLL4F$9{;#(rkj<9EixXURP_V<@ZBGuMy*j54D zjbnC2>Z-@cZHXkUl($WKOQhPC_14L7i6n}m#f@H?Z1*yKD2Q4O=DV}a8Rh%3>_b@#!^!-w3R!wQfj$8KA zs5xTgoGn;o*38m!C^&N}a*N2Du?kcr_Fl6}L`qQ4uP;en@mp3Ya`a~?dx%K9QEtd& zLoB>$Sh^=X>Mm5#Vmr+c((GI~b*gQ99-I9SQVv`_OIgR$#ON1SJ2aD3W#lmEC{?6l zGp;nCC??tsErQ(M5*Bw)N^Jrd?jzrGYRw$-mgmmggEc=LQg(v*Ots*gs8TZHU}0~z zOhUm&;;cJ4(?$gpEC5hxhiphf%d&{BVV}HaLgwtMo)lcouXl2T_YuN00dHJP@mhnd zw$2-_m{8nE!3p*`l=``Z0=i~7-CJ5K2;TBVSumXjL1IX}ZpLrH+l;njKK(|N?a$*4 zRW*35LQA!;nk~~X|q74^FwJJ|Z;fS3Onh*eQ z`{s8JW-sF*j6DjEp$m_p3lA8&a6kE{&c1|vljb8SigM%;XLD8y|Cgf z7)}^9a;SayP?20_^@0iA?3eWDP&AjO?TYB5nV7O4E4nB3BA0jKj#l~kRTR2RsA@FN zwgX+<$K?Df1~Y&VI+3;Z0P!~A^j8)4(&IQW`?*#uHs98?Ag-l9UZru-L{n{gv^}II zo^!76;$uk7V@S zp4e($scvFnu}t6}s-zhMuH?nCL|5mqNj9xf@=~AdBH1GqH(M&3vqe0NVAIUQFU=}l zS#PLOM>G=$A; zgJJ~Mg(i7nHkJQw5PiK!n@ICM1z>D3VsI+g*b? z@4NM(NrOZE{uhKMwS*~mF9%^ti8BUjSlc7(VwEP$Dd2-*BW)D5k5ZCVI~+KX;^E*?tCgo#Y%Ln8UiNGqj5O=w&Q!$Z9mZq)7IX6Sd?h8%c#J0$p*_aLq} zLb}J7#|cWD5?}1dO6!iAA_ZS?fX7U|D-AnmN-J`NB*s};pICC^1zX5!naYP8Nka;l zlK%kd9Y>dlZdz7X6%)ExegHkf&w2_dV$;H{&;-JOqs~i+14P}aFDs%>nm8u&DHFHk zmR4IzdiAv(6oH)IawVhVS(--0@=fCLB3Kq~;Dr%BKWMO>Wxe)3FT?d@t;@*j?_tBc z(=kt1fXkoq)PqPGt2gR~PvQ|MTq~*8tP;=2|2z8rKYkt^|LN%HZ)cz54Rq)r-ILctKI_4Co+*o(hM5;;Ep)4wNoHPB+X z&?8xmaB-hOb(Ul{hSR?5iEqS zWf@(K-!vEfYROq|>V#%DXzTDxk>d0TYM>n)*mTPUqry8oA>>r%EVjHPX+f!CUjs)X z26Wk^24CwunzF3OD-bImbi0s2Ae8(^_O+3$qr*Z{B%@*S&>$(O10Ljt<>HaG1bY*N z!N#xS6iUH2LETL)W(We}ioCGAC(*|>hHY(niFyq<&kBWMsXU7)h1@i-TfuhoTlpQ- zU3||M^@7yO^jr%2n|Sv<9$_~?TeN+GXKld+5KqgNcXmWW;o7fIV-N?FENe1~XE`;f z_I3uW(kZ8e7DcOgaY|4(#lo^3#v^zUa-LWy6=K~iexYk&(=Q&JJ$&?%^F7GRX+np~ z+enr=4w{sYKnsdkZ+U?!{U+m4n1z? z1#^XlDZy9{Zvxw=eN|P9NELQ+>=JK)y9lEe7ruBp*vKnp77g&MD;ZZdR|#6Gxzu1f zr6tX{UJ_l=?8cCR$QkJN3CWJ5xnj6=0!Ry@=asByb3jRmFQt|hR9VoC{MaUZ2Jf&I zFh%mEplPsVm`S3z6j(9X_3z4;%f#r6=LO|)lX|2WBQM6+%tr{KxE#Cpdk1*zxBT$&%L+0CTrF=Va@j=8lJl!e)wa{cD@C?|DLhBW|Xt+(Jwm=2pBIma}uW5l7t{wRE>q~qEpUw5?j+y_&aXgUK8oulfC-0`A0d@+b zk&+<#Nic@dOv4>rLcJE7T@(cSMh+ex#IE%1NSKOqU{G0Pl($iWz_Dt!AaJPFc`(N} zu?Vey6up9qnoVx>;25i2s{VT0?DKbQQ5IAWi;6w?uH|EG#bX(sM@2rOg%t7f<<+;( zEvyQ1sUZ0Oox8F`VxAf*54}7Ju<|D?hubQpzJ-;|<(*)aJN;MRK0hIR%*O7oWRmWR z)^dhf$Uf;G4lPW9h%cfN$tP#*pfJ{@GELV5ZW z&Eg+dGQTcaHpb;q|3JeRVL}_#{z^g-NS?>vBE)4VR_ve7(+=Bb>TZ{eY9>IkN}5xP zJq6tXmO^2EkHGVSpqeK{O9^~C0l?VsAwk%Ct^l1H*9?}Q+SFN_=NwJZbkpomSHTp< z4|DQ~kopsUY*Pxvd#P3udMkNOY6aqxAhiH@FUwOv)d_+&F1XV4hKt z*k5@qI{pwzzv6UiG*GT#=_f|Wbx|Uw>&|%;@A_M`f<*)`qJ#%B&_BLln&wo~!TF}I z=+Z~AV6-tzb}I@w&4~meqtlvY$=g7Vz)$CipkJ^SP_#;q$!lq&sW6QcR7P49@-ESR zZ-(f4iI)@0NnV3C+gx%f5jcaqXGTjIymIfF=-MpI)$G-!(!z-haV9jcSQ{(TE@&NyC~MK;U-hk${R-VN}0@|VJ|c@ zT>X{I)8l1A??8)ClU|=5`UGUb9e@NOqEWSNPk1XOlbzGs;hx4u!y7p>F?MeR-5Whg zb=N26*toVsBugqfmTQLZUk?h9=%9&vI`)djxYgt-@Oh6G$BA*ns-KZh+Cp_QRjVv| z%OS!<963|s*lq-ep&$M{-ihhjCo3AjQNQIXnX-k&@S3&JS}SnBrT`?hn>oytEDBb^ zl3A-{n0AqV$f>3T!$(fM3EZ0$1iMS7Xt~3LDy-IIbw3R*gh5f5q-El5^><9ZbB6VE zvBbr?@S8jN9o7I&W@hMI5hm!QVEIYw;0;k3%6JUQoLlxA1c$eLm z+;6T$4;q!O`plUV%R!09upuoytjr*aR%!(MtLf!swjNp^>;)rt39CR3Qj61fu5CNz3#zmEfW4|DRAp0|7KL|{xQ!}}MwYHHVGKxHu?z4P2g#ciD+_Af z1=Ct&m|Dd3(#^;YItX?Pth@@mFXm){H@&f{4iJ#-<_DR3iIUZv-ZJk=Pv2Njl?Mc> z3C(WqXq78~)})$GxS5Rf%?jE}1B=0xI6Q2}WDXDnL%l7S$fF%rX+@tq_Bx|tdPo9` z4{5+OcUo(?pqgjk?cr0B5+>jp?#6|$c<)o7(M&%;T=g5t@~QS>?O@j6qPtKnoffx2 zIx~TFSee&GuSlk72mTI2gCWweVvO)bDJxBdCOMxvG}C0_E`+N!@Rd!LE|q>lzJnOU z7FEQtDGGU~h`vkTs6KehNB3AX(vz^W>1PW2WYjaW&06>DiQ$EJYyhXGs{eL&eNI=o zdS;Z*1mZz*HN@RTnu;_>c_quzy7w2yyUr+t0#~<8K>)ggsW97W#ssTqic8itDs1&H z5crxQrvq-g*0L|H*{(yk5(eSj@AkCRzvY&9Vq5GfcV|e3Rx(Q(mY>zG`e#yKsIy2AgG~VSNro%C=ne=$Q!HV9$gH zw%N^-(4b(ol0%1x)-KVyA$VWmWtUU(mSysmRk%4{yf3LxT#A>J7emB#w>_J{5K=2v z4Ub7B7B|yIPx*VnZoh?{)Pyu_*G!L0e{2F7hmh-QX+XL3>2y73JRy9}(JmaHNK zH4;x3RL~h4`L2u_LFhCcEp$ib=AfP*&+_A0zR$D#*1?qf(>&O*<*Ym_r+FtYL#G6> z>+dlAND;ZGv3rH;As^JsD({6ZRfLLvbR8k^EO-*@GWNIO=q~_uyPRBDS6#ov?!Z zP_qQ&OxNTs^C(+b1RXRL#C)>R!Ko{~i;4_-?2Gqh#jpa=&IYtD!J+52DI18>?U$f! z=^b_^-pxDqVp=hB{`z8=&*Z)gGUuIv4%Am$1H;|wCvK2c9Gg#w_pxi_hAq>|Uxtke zVm2*x9m5hVI|#qT^ax_=(#j-TJcxr8pt4r8fV00k}&$9B_eix>N z&E|yrP0SU!6hl&Vnr3$cc$ab5Lydv1xq!b`{=(%juVvHPBeok?R>AHY=3K+p9sJ;| zg{JxZ1@34EG3ky}SMX zh7Eh~$ZzdmoAn=*fUf~4?ZaBwcHBR!nhg#LCF>zB1cGk0pN#knY~>eHQeLSsIVXyX zSwfA6c5BnKp&_mA4zwmi;J4ZPx3pl09Z3aYX!IC5@~(b(Lhj~LvB8JLC+8mAu;sx? z_YNFH^Wah(ocJWYfcra5XxQ*Yu_OmT?_j*5h7MDccTrtGggxdy)BJ4=(({61Smkc< zd0lE&`AVMGc2U*q7R})`6fG+5y$5Omgnv5t+hC@O?|qeAeY-1ydosRU#oZ9whRdCA zFb{l4bs{#dYj%acg^)oxB`KLmrejM@xX6myM*qR9Fp}(Hmv85T z){t@L4Quxt;Kl0z2zPT#(@&bMvVn1Q>4>0%XLkTUO%+Q=uv;R3oY}8 zj@dk^Cda9IXC^yx9m6XQpLNG>+Hfbce$l&CO9DR0R(ZTGt)~2OG*x@a!Stg5XAUCL z9FrIC$K-&$*Pk84EAt2Mr|RH@90)yC2V-)%@SZ>}rmU)PsV2-4j;70}q!z7g>344~ z-aI37c}H?d?ihrQ8+jS>v*X1&E4R015+HLjxhN~S;6BgS?#;cG|0`-SYcxabmoFPq$3H!EqGB|EBZ_F#emC<2pAKi|!uq;X&fSz2 zijgBj@bs?YnjMeHTSpy2G?RdIrn1UhGL^9G@*?rN|aVM)HzvH+BaQqPIvi@MNMFj=c&8NKyCwhfRblojkf9{6e!bS78-R$=}7kak64W)qr zsVj3?)46i~+fcS268- zCm?>yF0k@2?oKV<$>@&j`N%@Foq{rT`rGtGYBa2z=eY&Sv=!J8H*`#B$-iZl5f0M= zJZ`wiPe{%4Kc#p+28-)Sr(##WsuD80iIavqdIUVzvGm#x6O@P;%dX{R zDN>g$%Hld?>&g&iwtj<5REtPBA?w3%{Xr4Emx6LE$SMm3OmQdkJ`O11^ z^hc|@h(Q#M(&8r8mTiPWA{ZQx@5;@#$Y{JUpL}9%ufO@`@?w`MHqSfd2L7E0%wfrl zJq$xF_z!j4jAAJIqmfE?KeLy_A!ZqCTy+;*-6Zph!xa)C+xYVNi>PthCp%V$ehv}| zfz@>&t#uB?-^l6Se&^z!Wvp@h=Um;yTzMbHCDqm46HkpRw{MnkDQj|P%iUTV!8=|) zBQJzXK{4_n^WCl)$<V{-B0>g|i?=kH!z zJR@J?+u}s(wn8~3?_}d@Y$F+9X)PK>(v9oHUV2oJ7lvhD@CxgCQ$a2T*UugCxbO&b zJ!gd!7U$Ev!FoVvT-)NE_`+B*H0+gy_&PjnBM0t7O~`o#iKoL@ihtTekz;6)|2)aK zYMq8cdK)v56;Ya28khWVJU$!~av3iyAC3>5Vob(sBtPX0&6@{OJ)wiWwaA3c$C+)%Nxutn)s}$|cN7;0F(DrH`_okb-U+=H4$Y}=l z)Uqkt&rB{BT$4Ff^CT%XtjFLv>VC$Yc8eu#zqFgIsFh~bG>T<)?lSji$I|3K1}2i0T-`-lXfqaPX_hgBR{2_hfjPlocDX_gv}dC_G*;Be^y*SNm>pUWgO` zHKbH5yB>>1H}HNbtX@|{D)N9)J~dJ{TGHtZ1}!V=-7hPC%L_I$ubgu+i|ek3KzH@; zv?R(_2nij&ucV5*og0)hJm0V1yd#2Px75xS9Mh@Dtw_jdGy?PY(Las;mlwz6J7)W0 zlxoBEGEMI0l4Oy=Pqni1((D*uI~YH0DV=6iM2AhI?itYJMwU^ei5lCBKDpzK=bYbt zCnuiI+OQ>ehf<=Ji-L=r6T-E-9&9x-L2M<&PplA6FU=3O09fNoVKj1@ zu}*&C2@&irv9H|I`h#_&K<)hEkI(+liqrUGvbO?l1i3FtoJk>AruS!8CWQYm?5f~D zh>j--nf-s&v`AZ`*ZXv9giAkcq~Y$dgZ5h>X`INrYsEnJ!x_^R70T?N@gQ;i&;|@0 zk|Uj!$9tQ}p|}P`E!rY4j`W5kB?X!MAwddsuzKfokues8g z8Hq#zcn%Z9jfQbWWJP%SKQzy)XXY0vcdfQmp< z_g|cW*75YyFV3Pj?#GrUzN1C_V~_NC=={JSJrJt?8m-|P)7nz}vzEEyfik^@S3@NKA%@kABEg+?UqhzkocYiFa74HvSS^*USR{cyDyK9aOW#E?K4 z(Fu_en1`UOVk8zkB&)=-xy+E5!0wyePG{}GoG{eK@yUg=mb%#x@FbQ_NT}R zA|F|(M#@a#EPt>djlHf$nqXWFML9aeXPr!J&NedJ%3Q(b@?|Ok{ATLb@Z;abdvW%S z?6~jy+AKQ&x==zo{RZeIga5pa_Yek=F#%EvT|xSVH$<9@G4hpKBd029HvHW6plUZC z;U@qiyq8M^C=bt;@{f1H$99=svTlkARZar3=?i+EfY0y6v5#P#$b;Wy{wn)!&-Ru5 z+E&tdq2HhP&gJG(OR*yYK_8KjWnIB9o+D035o?k41R=k$36C)Pgp)m_aDfu(kOX_+ zLyu5^k?nz8%KKtrWj+uX#XRWN`0~PPFAmKl{tmzcMVb@UJuM%F1eagNBpRnNELrJ0 zSq%kf4Il4B9NX`rrq23?xACNpncrLkziCauz<3ACpR8HqSHO1mhYa#@OH6rJ#}3gf zqer}odbt73GDTDlFtM=_SxFAB3$q+m@U{{&a2Iw4rteL+iwh0St#C+=vKlk=;XsG;OkZ#;A< zrJllM@8)?(?toY_^T&j11(_uAj9Nn3+?IXLTva|$$*^m~a_t)vQr#TO7er>77FZ{a zOqjl7Opvp)GxXn_{qA?ai#Kdlgp!NI69weYa5FXFzq9zx@w*GskDzZ}l7J~VAqBr-WU9WbWL>6}N=JXWGU|9n zh3PGJt~mjUMeo#y2_&*iX;{PrKI@B}+q(ZQ0TuaS!m1<&*aUsK@^8bXwP44dDJMAU zX(7d|y|)_3I2TjBEE7(~u-f#<_+Qb4C~dM5Rqtp7n9_72>*TVL7!zu#0dlC8Zg!Js z4X@NcuqbgDQVCacsCEyjGRq8E1U} zO%Qh5r=S6jNs{E+jVh}w+4`@dWrrSC3)b9fnG|3Qu!LY%ArgD1RdQU3<)&+Dbv_2r z^fTB%aG3kfif6UJ_YEN2^w3t-om2XH19BSH?Ssq_qsA2^Ln0>H;&}CAUp{BKgcMiwn zLlk-fD53#W0lX;rxxv-i1J?M8mI`aob1^g9Eyar4ZWQOj3WPMVo=v+AzbmlauxJ}Z zw*^yUCSxZShpo9WhgRm_xvc(TKn-8lLMJ51wCzF~gQq3b4}0{!!IVK5v zxKU0V8a&-?NDkN%T9O4V2bE!W4TX;}d4=McW!iM2WKrwgy4nzJNpQOjo)v6ibQeUP zd^K34#MXkc1T6!_v0;KCwjG6r)N1+klLT?!)ovS4~Szx4{;XbTeQI z_7nA4sfJT72G}vu z9h~8l1CH+QDNop(Ywi5%atE7hi^{!NUEB12y>{12w7V)oy_?{o8Q8Z&jgdy+_(0~8 zmF~YB(iakjOLs~?qO)@lQ7?`)r6_$AZ(23grtNBuf%hh)=XP6oU%qv63Atv4xvU0@ zTr@Pkmok4wAUA{xAvLVV4*G3DC#+B>Xec*2j*qM!-r=ehpEOvj*>yRgC;kQ>PNTE1 zmL8GuK}~%Pgy(F|78I-hnH9boCR8?!D{@zHt(gETII9+l$m#ICL7I>Yh;ur)eR42V z%qRC@A0+OW#)6}+YoT+t(Gho=Dm zZr@3b!ggO$S<~*%cHIz25`lN84l z3GCiz!cD49(QO^$cY~%kT#WEFjtuL!W^co8tunV0CpbJDj}H%>G2GrSwVsZCKbR~N znaq(Hn0cs_1|@qJ5q@=z7IseV!?KQZF!X5cEaJIX@R#?h5L-1Ea;_8boco&H(jHLX z>ceRbyYE; z6Vi9P?c>ni{raZlqW86MBc|2KTi3v+;&maAj%)__Zu+)2yc>#4+>%>bMQ4xqwR=&z zbAHQ}jK=8bYg8=X3}z(+k)3wF@Iy*FPD*EEU0YFD?X307T9>u9GLqwV7JYsv!k$B( zwCy@Okvw=3pHIBnN~$%h#53~$j=ukopGU`kIy(B>+35fL{XdSrAHzRBIsVh}&+d=^ zI6gi)`rB8pzI=D};_v+U=f8=1af5&TeDpW=;_s0}j*tKJ?>lrlupMxrN3t5>R(eKs zRS#c#w>)!5Ys|own*tR|}L)zU0wWAF35n7;j3xxPJ1vCtNDJCuM;5$VE_u@9S zq<*~~(_deviiOG@Xja;krb6ftjbl@qN>W;1(;m}QesyUoxGNuXR339w+U+q%Wlej` zQCZuk#~hVMf8V3O@6q4)=zz@8D4o2Y!9W)ezZ8&1GHWq+M(Q>6$f1{Asuaq>9*BPoLxR`|1o5xWRbf9aKAqzC95){Dak3w zCz=n64Aqhp{1#$1I~~N=4O)FF$fuu?xvVQSZdV|B0-p_GEFy0*3^XYiRhm3GBMUBS zBZw!HY#AZG_-r7v8fJbNW_Va@a)5vDV0W;Vs@Dbqa|S@;zoZyjMP6}2K2qKVR$)0$$H4JcWQ(Ktu`olNK? z%x%a6XC*=rFF$0DMB9E~`gBxhBV^hzCv)g%w^iMKSDiu}2d*$ug1hRsJ! zZ@V;dMA_rGHS6(>u=jLP7EFzAeh=Oe%R^49Nq+kF#regn7vn{~k3y9@6l^-&SRpR@ zKm@r${+c3#~VT9PXf4=xev8t(= z$`v_fIy=o+IX|^;`j?sZg%n)NYFKHPL-#aFHJL05TU|v?$#Yi5+jAVDUKX>*`AQ5p z9$*wp4aF#>jCRO(%5qCtglqyn0WLAbE>cbUIsV7AeRs009BwqO+I?(##(LG>Tl?51U%u35K+_wWh!F8<+^0$2plF z>)J!xdtLk1O^BtZ_a)rTsAhL`m~3aCbxQ=ZLG!#~N~Hi!K`5%-;pbPEXn5wRWM8ytMd=*#5t>wD@i! zek0*GehwG+g5M<>XWVuKp~6RZ62*k#kPF?4NseEk%PD48`fPGk7f#66a>j+@qEe(K z$4x1Z&hmbg?;qv+2bAxXDqaXWDdMBF!b9yJCoc;+BMkmH&ABrFjh?UT>#rdap%zxp zM<2SqV?8z>62H@u7n7qf3YPq@gpwFxbAoRx|Qwlu7(;oThBX*#$5;3_*L|b01c{?%y<(N1D=CM%*jE_+23q{ zKt60DP(KKzI-6seHV>8(RV^vbNEUWp_cnOk+bMXGJ)sn@TVOqI5@>44>TVo`!-KIK z%c){>nr5|F*;-ur0}X&@A4Oz_Rg$89>jk;EU&s1n(+n5U&|!UM=1$Nber7{443CX; z&y;n6xdnbnclL{8U-l82(L#0@X3uLwL$onc(rO}X!bBlb_|pg0j}%LX?cORR%0T3i z00LzLlnFVD=P+xbOI9IBqKR6ll8ulf9y%mxnL>Bf*%zOEHYOLmVwsi|H-Zg-Atl)m zz#UI32FexUZm=BfR2bN(lRWBOY>|7x2w9H_vWo4IG_bXQRGdQb$d88)8gI_$uHB)}B2L~A1N5C1O?^$*^XHm~cj z{sQE_glSzx_*;+Hm*S?c%lk*^+m6kbT$f=3B3}}WN@9@9RxG^`7cap)l8&G^EI~gR zEpG!x-e9b|feCc!xOQ96?3&vqi7MG7uQgb7i8MEhX&`>ge{Jw zpS3h=C-zK6iN1ZFk~i0#P%Zy)g39z5q4n#F(Aro2*S_3A_Y<#^KgR2jdyLmn?K)bi zu{y}KK{b&RBUrgSyM_myUtN-{Vt{-`3pFO>GCnjd)Np*HfYpecu0pkDi!!0c=3^Mn zV;If@hT+`18+=|bs2CZpmlTN84k73Y31edU7D?L_v|?Bev=;n_nl(inRqk&k$W8Ho_)Q)bi;j07=vsO2(<#WObf+6)93TB0OFSeF)viM?DriTV7u57CDJDoV1V{Er`#P zKU2kW@`?&NL!;->_0^wW9h=rhHDsNDIhVp{1>@D}sD*NYKBfxGTVqc_7SrlB%E`?^*ZJ!%&IO$3jg{*se8}O93 z_$%wBb9a74HJc$E>ObYgky_=6n`M3TEuDd4i()}PkK1z1x!w$Tc*AzFL%Lo|d;?*X zQL||4pABaCI{bD2Ov|bJUE&;PwbF87pZ%|z)$D5~W_o_X@)}Zr`loHz)7yFR+gb=N zW`C8FE37H77AJ1YVmo|bNL{Jab6R9|LD!FC3%QbsoQv6&%%4kAIUdLqOmRC|N)}xigm|||Y*eI(96ZRDst?+eB0<+>2EG^n0#&H11TJ}%yCcQ99 zCEDi9iXgI0SJX-(jCx0_*=q9P$g|krM7&&Ss_V`it@7La zuX1t?zYL@eIf2?*IZ$Cv=73)Z1lO~TD{8n_lCYF*xOjt}H#amyIGUMlY}?2|wFG+< z^I}5Jsx@Q=-dLVM^E!(VV?T!38*oQ0m{J??bHkeny`aQ-LEXbHIUf~RO?jcP4&la| zLst}_Mb`7yt;e)tRIL-jI(>f!mxK9v8(s$|?@*C~Dt#Y4>N^T+dSuUny|{d5PKXq6 z4Bk~WJ0UM=q1XxeM%)N_H@sh)xM4U?%M#x1`!no~n;9R@(%#t~fn`01nr!cQ-(BKF z(41;E>aEAKcAULETKN!p+cTmoo1te-*X>X0iIZCV#P#K#G^=v>zY)lJxeaC+FX^I)d&k+?+1VGLeFpzM zJ3H(A_p>LTe|q+BPd@wn?CIy9oqcik#lM|>`t<2%Xa7dd?s=@etyY>=|8} zl{B-p_>_#lh1jmKS?e(uO4Fhszx?u>CbH-mp(SVUH4|99$l*dh`3(r_b=S1VtA?cy5BqONGsc`vf8xvU^K-O?Wsg<-#ni&)r`WjPMoXj-tShJc}TWo zS)1rvHXXMVsujYoo9`kBckHzR(N{h_X4UG^Ln$;Whm`311WHcG|Jx^jAGa=EB=s)T z03wFiCbweySe?pV3&xh$;L11R```X_^#6md|L1=myk#_B9vuID9EcbAF8FTuSD-Ah z<{kLu?k{;si(*2vn>DX-U+?}RRGikl2EUAYiR1EP2xj6^7-36kx+uf>nT3;+JBBEgTfdRYwAMqui#fs@bU!v)uq-= zxL(OUG(E&$1q!ZZb4J63-lN3NRY#BPNS<;EnY_@=F}a5F)5<}XWm4R-%5*=IGr@oK zw7roKq_?i53~W`nRM``sL2rw2*P=xaE$V0-F#AOS*g>U-Lm3T z@!5!0*_>;Z>AGU4wB#e`x`3@XUgW>^lJ8-UaJ?dRubKtJ6#z?My9^j6EBlFdq4IBE zT)%5fg=R6jv+uTti(+e*z)To~H(9@DB^TE4nPZ(<(B_Jss_?3wfJ@v~&sJcRd=5eo z7@5nQqDxhf=XAk}=T!9rAl>Hzn3+~1GqG_?&~GJNXBe`w$(r?QAI0mEWj?&e{5$5f zl8puqn%`29_35CYRm1-5IpDOl!jbLs&a<`__-3<-WiBiJqZFDJS291ZwM2_KzAYlY z;xC(?Z}ql$&l-&#p0j9ly+7G*n76^Y8vyKMy8dTNr9sBqRv^=@fP23)nrM*22p5PT z@J$IU?LyuOk^`{P7NDXd=#YI3{teG!YK7TuC9?(HHzYa5g_e5in?sORQQ@IST=_XD zF_z675BJf<2Fs9Z4!gibd<1ztaPTCCq=SJGwn{GVw&g`>*@{C@q?EZjL0=FhPtVSX zf=C;pG@bB*{}@wp<1mg=BhyP(ahcl?wqYRlZ3>?``- z^=kXsPdN2~Aov~JHPJU&2OwoFB@dWVFD6l^K~Alls#^CL+~c9dsp8R$C%~E%&lx0S z&Uw+Ok#$L0vU?sOyPI~se!PA6W6ZEy*Py#i*W8j%zlZ{lJ2Il@p%R?OZWZm(R!<>IFo|a4VTL&!vdNqG%H})Bg-q6(o%DuWicF5)oG|l}C|6irH}l zDp?x8kLUD}EYoVh30mo)Q<^s`rQejhtE5i(GYbDR@(JN0s~Fu{u|i0)zz7*C$Y-FH znoEp)(X7rVB$qX0Zp3m5P|;Qiz3$nGz&1Cp{G*cjsATqc{ZYy6wnruNQOWFf`BBMy zR5Blx%+>a&WIigHk4omFlG$k=RLP9^(dOi+$V|tzZ>Sh#OuUnCDn8?a7Ml~N$=1Z4 z4e!gOEX;bNba|gik5e1>wI!Uvg@>&KQ@G~`#xYDOFY1cD09Zh$znfP~8EJc8DZG_+ zChv#-rUd`)2z!3wI+wB|cwVr*fdD+>3xwZ=;kyw@@b<@`Kw1gEoe(UWBv%`4(zEH_ z^fR8#=V@I`VK~aQOpl4%YY2vV?!aNz!z^tfwLaN)%Y*B=_QnS{ox$D&)(wa2F%$eT z6Z|m~e5L)XWr8mt4SN$LV^~@Xe-8W_5*kDMqqaGYNEJ88`tAc2mSebdqXSz!ssqUJ zIXEE)=eMk)Gv@x@fVq0`jrOAdI>h*`v-X%AzwV9qlpG(55}hyikREU2pfM}h10BL& zyT?L5CcL}$nDG9X@cyrx@Xp?2iVw2pR*Gi3tv!Jes84+_oikeW!J5X(385nuh()r& zLuFq+fDxeS_RaJqs{L#CaE$G2yTvTwoU~`aK}l2Ld5#g)r>-8>#>5Gn8aI1fkvT2P zB>`Iy-{7I!vehHDX788tlJ@JU8{W4^00*NH#h3$kuya5P<-Vvp3E)AGdP^w!^4qW8 zZV@J+8getwKc^GFuifyB?vP4+dffz#pm<|N9-fr9= z!u0-T1sbNmOUO4@Fk-ANXViWQf9g?Vdg{V=Ij~xx?aLG(Y&w zn#-sMJqBv|d85(aKKXkOf=s*KUj$7iZhPsx5V!F}=2Xr3b6J(&(z?)Q+gD75fFJP9 zdGN&w;d?^r=yyOk(2TjfBh+mL2srNbK|DfrJVJFmLUn9dg8PK(=smH3*%6!{T5(w` zaz~eHqwjD7XvdFr#lB)o;6~e!JKDcp=d-ls;NZ99tKPcm@O+~7m=&^KqXceuYf`Xi zTmVFctd=kAe%#52c4OzkNnzi-{d#ww+;9S$J(L@wcenTgTXk)R&OV;_%MEVji0MHh zc$cpy6qk1atnXzd7n`FM0*&?0^n zRiZOGmOQS1qhLul{xs^%F;%DhuH14=Hoi(TL3ccB+c=3k&KtkJUSDK;jzMXL8I+B8Z(($4#h zE zH=DB;*2_#A`npjm+f^a6s#nkSL?~mMH}p0oY|G}^tbFZ5@fs`$uT{1-MT>;awOvHt z>yXqIxu(Bnb&w@SZSMvMw;TA^uUVw+=TQ$S>VBXYpeyg6pOEtD>U? z6@1E6Tp6g%@jqv0PtHE?#{Zl>{q!;Z=ONlpKaq-x8S{ZEu)Y{s4M8)b(dain{X}$G zkRum3b4>o-eD%{$HXPNLa5QKOb56o1=({=fM2^X~b7diLb= z$MgRXtrI&}O=yNCd{{U9556*zk*sXq;%W>a?vS^#U|Yie%xfV_I3j3oB}A|t!?zlz z_Yp+tZK7D!g^>bBgq9pa*=_LJ!NG5u;BfmH7ROl7Qg!}3^~ppd!fu%W)##R06Z_!d zCx>xwaJfS8N9n9nc2lq){4fBpOkw1wA5z7PT$pJa@~6tI*=(IybFZ2~%wTh4E3F=AD*2szmb%5LEqsGYROdBK)t*x3)R)MKInon5whqOA%1O-AnUqy-T{LTFzhG2#C%%_j z6Kve&Vt6a8jT7GTi-y+??g18}w6oIw^K{AuE%=W(+rc;Y_130lX6KXsce^ilfBlB} zPMqjI8G+7b6`N7b-bst3VQzh|G3-rnzzf#=@r>nMcdq#Luk!sJX*n_+Q9L6DMtMI- zdC%V{Y^y!mF{r@4_zV!b;;|_T=1FSOx z$bwl1mgC7Arua85ZLfVd#=J(=$dL{2w-w-nxQjj_VPr;Y4!Z02$eMrsErI_x>TsI* zcMJc2^2HaQ{jS6RKmFpfvq%2_5G_pbE>*+KFZ^<^F!627@}pt&+qrri@8AEO;d1Xh z^l>lks)Zxt2OrF9UCt_+vuj;Z&1OsgDE3I%kCW#WV_;m>=Y^5dziv%+)MPu3Vrg_T z6N`XcD(+n9%ugvvXF)zxAcfFn+8n_MNP53Q2Qs&~DF%`N8!hwcF?eRTj9?H9#^x?`K4_;Bcc-S}vf_IAyr4?G4vyK% zSK+Q-dGKfQLoGF1+lwCl$QN|RuIi$|@UPaSbiaAlJ6Zh`vhvX+3HY(UHEB>?9(L&B z%NO>Cebh2m=~2#u&IImXU=UYS&-l2AomX#Yy`|~;auN z5mv_Jrfy_;=L)Uvd0(M`P~Qp&uy{KDIqQdJ)e2?nDOYQ0x*zoQZRL8D3#R9+ZuO)` z9KuuKx@LsLk&Una&u77%xk{~+l@3YuG6(Y^h6euo4O^a&e@AqdXa5<73Z7T9Rrv;c z_tQ`CDEZ|VGZ*&x?JxEhu`PH;R#;EzzYL!&_$?DmsjEs(Ix*36t;;W0VHzM+gPbBt z>W|$oWu>2y-=F>dN$>>#o6+Ke6?Ex}ijhx0Z~dlXH0OglVxC;?)Q@)kEc0N8llsf^ z$`K6BZ&Q zySMFHnbY9P=c#Z}Cb(sHFQ|4+NO&xmL)KHOfedGt$3MJ2egD(x>G}KP*Jr;}5IT4E zL{)69$m!eo)YYMRae8@madvX`{_^zX;`HkM@yW^Q9y<$tpwQiNxtk5EHDkx9~ze-2hV)?dPx~;LS zX{iaxs>R5&HCirVdp;l5AQ3Q+TxJXs;>l|E86P2^2Fb@NMW79&N>|lV*;k|1p1NV# z>5bxfZ+cAxqSI^QXsJ&hO;wGYY|+%N*~{?+f-hT#BmJgar&(FQy8D7r+4|yN>Y)c>r;JhZ$=L2-AgA6jV0ev>ynx2T@! zy!g?GL1xY<95U~ku_ysiz@q_;?6$E)g}ail22NQYTEei-Ch0L#;|Y>T(%MJMmU6QhAc5E zq0Gy*HWv|?PBfUBp|)O)AiPUD*=w^NnGw4z?(msJKWe3J1%XHYEVKWcSq9e$+Y13r z_rDJMdH?^tqru*G|KG&3&i&uKyMXzzq7aaQvK0i@F9_s@Y17g`uK5*3f~j?jxgBlQ z9cXK_TZTwJiNLyOn~H!1CLWtR8y>9Ib_@QSy;NP!fOGty zXYpe6w5{Sv?mQVEm3Ahmy5b6>e3fU)yaBZvrkuub*s7q<=VeL zm!MojcXA7AAu#2dvwVQ=fOL~{Q4JeCtQLH&i;#CfYTZ}`-n}_NExli?$@ttx{>#Ko z*-g`Nv=srH^gsRKAbk8Zsf_v|13+$lFDYs=Vz;Gh8j%;t4e1U%WG`Ima8S9;|G>qJ)>uW&(F9dXor>#86dM_IF>I8n zmt8C+dJ4^7#fKl`I8>ycO0!ON?-!{i7rLbDoU6!*Z)ia0$$W$c{eD_pf0eHvnjvkU zjXulo|I4R=Y_k9N`-S_zd)xazn|VHM^FP)xam{NDH;*6=<@y!sl`T~{cvbHLO_>aJ zO0TWSef!*v|F`r8YtsMk9}V;QzmNJ`{r^Uu`{Ms!l?#`{Z+T4Sj_AGP5uZ%O*L&Cm z%G+6Et{~aKDA&NfdUvgm0r2aaKtS+&lO3|qZ7L;Wq9)Z^Tm*&C5r|<-Pqj`q!JkIs zu}!J3mNm^n?6@q5Bj)=gDu|KyFx#41+)Qe-N`blc%uDkwJ0bI&H1l%x8v6Rg=H=zT z<=2fO|G-eCmU;W#D7e*w2*Fe z%r6$I^S8?3Ty)THy^w0AYvZb}soQdCf7+&w`;t<}+0(9hdeqkb(o)FP?D}_0Dpy6* zik{b2fAq=a^1^3RqPar(<&w@lvUE~)ZXVK4H&0!JxH}_aYW{e2b)L=dQknzm-cwO+ zxDOAUWa>dPJ#Eu6J!D#@jEJ@2)J(N)Kic$6#oV2{36FMt=3;+$Oao9ZI#^1GnR1RJ zc*yr{W!+4xqBd+;qyVH9gMtjBY#K8jdnAg!&n0)VQ!VNgk2>38jkq8aobZL)vz<1j zn)?NtV=C6l$lQWV+j4zM0_p!r{py67b`q;y7x&yK&H;*jF7t1;hZFm}0#F#y1&)bx zO>UQjcTH~dJzOTgX|C>~EVF86g6K4_o$O?7o6WNN2y~~smW6DLCHWXv*;xaVvXSR^ z>x!(6^$oXQcBsq|wyt_H|5F{BnN)9?G1z8!OTK^%Zw0}9^=xk~K;3iZwQmc>I>cH!QlYshDu`V_Gn+ z{m7HUWjnEA-n0rJUv9d#Oot4BZOXR$f0p(3JK)c@57DAYTygm zkvIFSwEr&|0<3BO-yi1Vf9?h ze@p0q8sxwI{_r3l|D}Jh&HuQO=N|Mwk1!7WRu9xt5A-0>;p;HChY0a?&8;y?d|fje zixgjn#KT65ua$%DM%Vif6<>$L{c8L+6EeQ8$>qYvw}e!xKdj-icMl!k0-RTBaj$4Q#Z_#p(%~RW@7)Z zK8UUB$y;=1jiaw_+flDNa!xtiy7SHwc*Z2aZSa)k+T&^9*5g^#oVn;ICz=zpYZ5r* zV@Rc6bXzP$wNq2;4n)f@h$X7v#G@o|O{?UZ_wXG5!2(glW%FHKqPkZFSa;JKlr$qm+ z$Gb{%zgn131GRcBKbT6s3DI`lX?3b8t+)J@jnc572DTj$v|L4;4+yHON{lua2(*M8 zcMJPjO5gS)c$ZOZJ(3NmHl^#{?czy~7hcME1%M!AYUR#tuVK@9D^wk~*~ zDYsnELYK|wIPh|jv{dXY6(Y>hu&qMH@LOHS`2&ZJ&!!H9MJfxPWRTQ>le%RfNZ>M$ zM701WESlrE3PMchM1rBgv=)vid8!JQL0c+*RH3$v&*+2^8xv%SsVf= zD$}wJF}E5_t+FU(-C~fleEB@+!j!awkyYYu89HkaYW5RJgJPAh>N|wPdc1KtYX&}3 zwKQ<$aFfwD?}n)z!KVFN6PzLA8qYzuYih#nt;|hw%D0aEV*S z{`S_`Y%?c?s|!qUz9p?T_;^enai8$C*t_=LB10%_R)2M0%a z|BwB_aGU>iBhPaCf5kP?LXBF@n|XHuvuMQ_VHqf2?;d|ge-X6oZP3bL+RRnZ%H~(R z2Re;d5@zB;G|?7VTPAkZGDPx81WGddGT5Wuqn6?S%SV2aPt*DDU_YP#d$>2)`u}a@ zS;7Br$uLnRUPdi;j^!gMRdePgHm+=zva*s@VTLsSSYwo-yqRqqVdxgz6$Ni~l=$>N!R5iC;yq^|OjHYE{v3?qm`ikQG zv@?)cGU+n%-vay8!!Zq}E(<1fnn>@8MnSMq|8tbL{~sJ2ZR5Xe>WJ=+x zpqK>L&tXOy3GEj%S^gp6o!E0`X`NBV*-iX-g9AJ*iAuSw+-5Pu#x`vEt3|ab2}p!v za&oL|!nK9D`b^m_4SpxCO!OVGx$ORKUDz%ccTkBlV?A6)c^ekMS7Pqs%Yr{)vl3_H zL1Z3*mL_{8r(`ngc19g1T{#zILCK9;QA%c73_1wO*fMgd$gZd@OYZ?~FL4#ulqKpY zMot{Sp3j`c0Q=z#4;=1dpLlF6rcVc<38sD$k&+u4>5U(|h;|-`-I=a)`mcm8uup>6 z&}?D1(z_n_C@bAA(I){-7R$Xc_9-pa+Ky4~ZI?KMoPr1PC&nFkB z$5*H7$Is_4^pBh;vxDqT2&s`%kDN{>;@1ehWdRX_y_Cnym5V|Dv1x`X_y69E_;Wf9 zSVZpHM#KK!KiJFV{}>$Z^|$(;jXY1#IgVoz1suf;$?--vGZLV2LVdV?7h?AsPYLgJ zo}jB4<%lOCsF@L;5#L8spN-|3r@?dw1n8J92rwJ#Jr2Ci6BLlCjJ)$SjL3w3B%YMo z|CeVy^e*sk5euNEKnaB;LOu;huhV;R`TjCy5$QZZCu}}v0s7_S5_vS@o!*qjyYPRB zey2D7Bie=k>ld@>uK1t+$rr(H3TTYo>m)=I>J#4iw#RS6&bPfWzV3Y6i|1kI+yA@s z1pR^|$`X#wUYzodI9dRM>`{;4U0E(-zjt~I?lO;vH&YhRL;q1M@!F?y{a>6Ozj$-n zn|pU}qkjD#?HwKN<<|ef{{D9TZ{+z~h_Fwm!S`L41Tl%afBzeuPZ5vY@4JvfW3;;) z;Ty5KX303=Byw30lOP6tte7b-i-?>ub4-I>xVkClkmIu{bK(dGJj9Wx69&^Rx}jb? z`@Xx^?{|0q{x3I$a2< z>_tQuBtXYW%*4)2gX!OP#}a(!r_&e52>U*};b_7lG@$`O(+Jamco0lL)j&_B@F)I^ z*{+bC(H|sY&!858c0AcmiUrc4^LP&-XbA%9a)dd;b~%-x4yoj^;>e|N5@ZGb>k&ZB zMhPSxlyLDkMjr7%T=#6iZo*?WHxi130^)Q}_1(n*ijn{cZpY#oif075K1)2nLi{4$ zl&Y5S%fkeRh(F}7G zFho8I#*TgDk&p;++NEM+={SzlDNe=CKM2ARK^UC?vTxC|eB2Jd*B})QN?I$O1 zPhLI~(t9$NZxomAbvo;r(lDFdz@7B?V%kMBLZ`F%`|gpLr+@FrnI`(tdGZ8Zz5dS^ z7oEaORVa5T{T?LWZ#CA>9hn2c{ zko2KE4S0-wAKsu$myqLRDNs2Bvp-eAxh3ap_MXF(h>FM++G(}ArYa6)6oVsY>f zxt#Dcm_(SzQR2o)M8qu1Onlc*cuXQSiD9w`9F<&w^trXuIp!!7@Yw{#GaTp))f`L=pvX-cdscv@=}j0n_J^th1rsuh=<0v&}U8N^fLOd9&`C`PqoC5?}7Nbn{YfO zyB40iPXI0rrjGU2F;L5RZoeF7~0F5_!dgnhIFt@t$HkWz!f04{;cnk$6U;bYD8T zc)`&OFEsWF2Jysl4OrZh@JX-`V8os$!2bH1nly^fBN8lV!~$4u3mj3+xv-Lu#$sdS z;yAMD=#RQOg8C2E%LTMv-orQ!d)I`7$39($&qK~Q5#30qW*ZHtr zxiLTXZ}6?;>Sv-PvI2bR9+xt$eBj9<<9e&sf?fxbj4^{IWT-KofBS;D*Cf&(p&>g= zNZBs_mU+bZX_U#tPjj1e)(8n(w95jQgfZVut2tyrr3MyrA^tca^BjT8?lVQ%OfY*l zrVH`{L=_g@nv4x)TuE0FlJoH&;&6TpwUMcAPdQmabV>jd4)khpY0t$q8~<9}SD zv*S1Df{6`Q;HP{|k-BHk(Nlr(vviQfutIyX-=Ib!*L)Y;XX0HUlTQ=skzI=CP9)$u z6Bgy8{PW%{p8L;)P%9+`?RAim6Y7#bRBlUh1CT6CZ5YQFZ^fTDfX)g4Ql7%-hK$qU z4LKjU8IOS(xtL3ic~4!>Wuve*isy&>a;K;ozg#P7U8Siokf*(~){lN^Hk@+qBhanj zJ10;vv*RW4Otj%jtYALM%DOef&w52pE3N)H9-9TZ`vh=zw8q}i^SqSJmL(x7=OSv1 zq69V2CAzLtDKH_YUPE ze4*BoU=LjSa)5-D#B7cQ2EKnQ*PhzoKa!v-Q=bO-x|vaT2FJD=miQj>={2#ZuJB~wDvk;I)qwSC zh2n@zNF*e}U3qMA#MBDl|9|WX{C1zDkQ}9;0a5CivYWzL3f`cn3rcQw5b;$MzvbjMo_MVbhK*U=qR%4mb~;O<_4&z#W@*R zTi|KCppfXJgzO+JflzLg*q&t+og}_5)tpL?Eb+C%7#7dHS61M|dpM4YDHuCA@SGG2 zb0*D(CobbdS}AJjR*k_ECMJLYCAf=yuyxSL_NUNhI4Gw~krsqMrB&~p8mfD?<)yLE zrE#@X$*=Xbz-TpM>1swenkMs{W&_|^i3D<_oX%WO@MmntmKH@%%o2-~1wO{pQb7(t z#CTeO&_nM+*_j<_Q9?KjjdqSrEaS46(ZCzWw}ur%`#P?_fhqF?F&mNk${ zBw);N?+jL8sUe;+?2gcf-?hD1M7s0?hAp>cAO0l+6A>@#cChp$e-gg=N zMRBBaEHw86^wb|n$lRIe!kqd(<>IdZ2hb_X+4IBxK>VqileAVppqRwmV0<@|a&8h{ z;cLQC7!g$tGv0(KGc5|<#4 z-2^Zty(E$@Y!ggDlwVLcY*;T^e?vojv&Kwnc z5QgKKmeNV2?p;_nY9b;gh8rteWT~8cp~`3@$=2J9SFRhxv6^lcMxHMByQ zMO~uQ-=ks{!pS0qge0inOd~3JSRJ;?holL?jE7 z#z5sMY+Qde4COCe#CmP`W^S6-5>eX^?~8%6+1 zhCqnxS>@SAR-#8~EW%o+5*4m+^SHI*MTKVX#E`1uN#2zW+?_ZLp;nfjUvfsvTL>D> zY`mN`VA*B_3yt1o04t(xl%8qzW`bj-+0~0YRS8Kh<{6ERIgX`B{rCUp|5wICRXW|J z)Ookp8eJVorVQQxrbEt1#{y~Kl;#__fg*ldUe=Z}MXRA?C$;1c%un6Q_??Y4D5Y3b zr05BGEHgZpA#s0e-Jx8#m?E1w&jp!*Yd{kcaXn+Tu0QS0hjZqAkp64n^{upajU2ip zkW7xwIxJ%T$fpSiv1h=~$5?_vBQ4fd54}m^M45QRVS_G|t=x(@(-yaT+w8N8zU^}F zp>sq6fqvP-3NlYTO0%1xiRsmC~gu(3O zSzngLXqicC)RMp#M@|ZF;7`yX85Tzat8E|d&6>Jx`x@6SB%Zi?OmVFY0SH$PhB@mx}(8PcTVOky6uj-gMPpNhIT*ibR+Vwgm9~v_%`om z%Zj2P7f63}^sBiFsH&s?70K3qD=Lc32|AyQ_pYb-qH#-&1}mz?m8GL9v6PKUc6NfU z;7V0QR-L+@=Cj|gq*r+XzR=*1t>Brw`BJx;Rg>r(YM{z0=Zn(Wi9E-Yn|%6 zwC!5p4REUlM|;gNiIW40B=A&xy9#-wyaEaBJOGm@p7>?|5~NadxZC2cMy?Jf?f zq)L?)rt1Dv1sbhwGex-Tw9-ht6kKC0QRnM^xsfD$sky{T(*FSEXfR^nprS+WR~OHGdEh8O0v`M zytSz$)6P20C1r}Pm2}Eg7;eI3Qq}hIW|Mm-$0|D0dq-+R8kM!;yqXE+zDQYWMu8h) zVYw}3o;ew`F{Tt+Eb&~mb#!U#f%aZqSL=^j+g^w1rZnz#I6P9VdmYMOtmeJ0Q;$IV zUXR|xYvAkf`!cogEqe4NYvSv=_cdzc>-zf$H1f^pec4+1nq%YxYvyZCZ+R8{I*yZ- zYI+-ZUR7U`qODYND!GTE52^CVthEVxAILx#wgCncw!)*V<%GhH0;YUOlY z19wzRH{qUFN!OsA*GiXyUaLkLS0PiKM6ga3T?Mnf|9&RlXNmr+&W*TT!__U`i$ie< zQg`)GZAf!o+!mW%i#Lho#+;0slh!YxFu!*)J!%DLLzd8WDL$3~v&Uuv9}ykHjh)t?B!}d2|9xEd~WSh(4C$`|tH&$}Sn) z5u~lmZv-Xt2_5?o;a{c_+d&xp^Z3ncNVO>Cac<(cnFzOO>`Xjni%h;B7YCg&(Lsql zA&UAYqk=?f~J7wM@fJnlUm?JjL9f-5KA*B28{%ofNoB<8g-C4 zw8%`hu3r9>m`w9t#6tbIgN|RnmdSK|pWU2CbU}SGC8ylQG6T;@W?@lja!6GY`aZBNTysJJAu_n@ zO+-~LEjufXOT^p~lIY9h|6N{Xq1;WlwnWM8nfE00HB%!^CH=U^ty45H6sKL31jqa> z3q*sanc{et7RwT%qzJ50XQ`)ioWv{*%Lx2TniNgGEV+&RDj0~9jjO1V_PK1n8?fkx zG4JASJd#xfh{3;RmeE)HpL?md}H1r80SJ+YHB$UL#T81yoDbZQh8?dXu% z&39$?tu&cdN^lNCUsQNM2o17`WOGuN=6{v~o1ft~PKGlv72jID@G;nx&fA&NaEc zVUfp29Y^_j`GoV1lPQyoiD~kizkk0N^oE08-|2tT5mQ|)Cjo)XG4)621_#qyIwACb z6IFRQBN6FQ)~GiqCLU=H5`wgl)LEj$Zl$SI;xuHO(xQ9j2a>7*eH=)=3`c0H z{0h}%QrUma?CN=Bp;y_iJNI@CTz#~_(-B(8MJ8dJl`9L#jeBG?7H*h~P zUS|M=aJmwF#|H7d-+x{L!o0RYa+9c;y>)=I7~eeMl4p`By>` za!Ebn;^-`$3U`?Z0J4*x0jhCG*s4)^DNQB@wO6kG>nD~(H0{G{2$Oy4tDL|3t#n@1 zKb00+|9m$VNGZL!et8vPS65NTX3^p7uQe`;6!3OY)GmtrY?hgQ-{3HW;Xky`hQ_3N>{zA*Dz0{k@Sz+tKbso`W*-9DGd^ISYd4s3sxo z@9&iXkgxMAAysyq*y*xID3c+(6OdTRhbQ;P+5!@T28AV26MO3~F)Q|0Tr~Stizd5Q zDvOKWdl34ajn}{_9=<#+tC^F?*c+tZ@EobN<)) zsQB)C+vwDb!*=?B`t$!_Fc==@&i{Ldhlktq|0bSKpLV}R3pyV`(y|HliC7@t&jnfB z85yB(cRzpbbVRYv1&Na=u$>+)FHEHt>p=NWpB(LK+jZG|&VpWM=2%LPHa4XN^AEt6x~22;?Z!+xZ1qxjnUUjUz97*Fn};|esQb4;Z#Z!J zUG$U&uAg{q=0We70T@O!h*4KIxw{yQNsI^GELp3{cGpHL<$z zGNs@Pxa|C^th+uk{wSt43u5fUg}l^u)sm{S5HBH-?%kc73PEtW7z!E=8)%rR(4KHI z9l7X-pdj4c1h*a?QHOH0*W3G#UgsFyV0kHIM%?R)(l_9b9wQpW5%UrkZjr{+HwE^3 zd%eEAt&u(Z3NVTuJL+1ga-ib~2Pln9fV!VPf9@j0<0x_CBqF`e)r@k57Ug!^m?MlL zG9@41Kyq;!@R(o^u?hP038a`R9MI>_XslfC0kXabCi;C%ZjoJ<2Iy~ly*;r{Bz`O~ zKp1u5#{LAm1Sm3LN#J!6gy89QzWw%!*;lr1W<*Y57suFV({DJM(}2#Cplme0{kEm} zn}ndRwQ$YMT#GW@Pfr)W_MPv3d-mJh;nx3iGY@PFryoPC?y3jY4MusB zs>pY8^8+qPrc5T)b3%2v5~+`cqU5^;i6ZI|!CRsvaM9r&{7L7R$z(!5qOQ|L*#nT= zyiVX!KfO!~;eI~o^)rC>l_VcSSxQ8r6t z>ol%E8oK6=;)U;R=x*t){{np&ecygyQydL7B#_>PB$ceI@yxtj5;>5BCaC*Y?);T^ zbFgHi?WbA!pP9*LjjC8NdXL6w)IqawWXOsZqYI_GS>ev=l1**-x0XTv1Us~lHoE`O zMcwz^<(Cvl5GuGvGp4efM0G~|d5_QJo-qR1O3S_#9qdUIs>{iML@au(n(0|HNp=0$ z_@|3+I1GE)+Zx6>`_reADu1GXB`hX6QWT-cdmWxLzLkLVtWt-pQc_+j~? z6`edOi-^5`6c#J;|K;|7;|yzE25a^UZ`l72_6Nh<{(rDP*xG+L^4Rx3lw!JbO#^R) zQcuo~z5zK>mn`6Nbn#||zJXzTa?8~q{S%6_+hy~R1tf^Gl@QX4#P+UG`>f?h0lcA# zoA`!{{D}e@cqE9?zE~+@=N1U*1t^i5i!;${3tPZ9j~7A_^GW_~EgnU#mf~|L&s2JW zDNHPCgKJ0zsS31~qHa|`+Ee~cy?(9@@5m0gYWc88=Nu>X`ObBW;|XzM=8y$-;}Pn@ zHD>9!61{r&>cqT6^0xm7br1UeZlUb?yBF`@9=|!wmwy?t z`N(>Sq&#^+CfT>@{W*?jBQw+>Kb1BG9!hs_h{rficrRq01yHwh`OnL%(>Kto%k$%t zd*~W4j6%C7@7}&Vd-eYHyH~Hy-o7fO>PW>;a8wB5Dj4s6xIDf1<@krQ*JoG%tcS#G z&+P)dH>Xz@XD65MU%Y#BeD<~o#9kJl?Fq2In=-&Gu%CYZ;q>C|>DB4w`;*r{UtXPF zRKgXzyXE##;*yyz8siaDWf*UEF|lBkAp7R*?fYL&FD}pCRbW~LKaZo5P3%`v52(6o z*pKxWc;MN!q)Q&On>ys7&!0!)O^l}vjrw#!0>U{246-MzibQlZiwK`F-y5O9(E2=! zmtkjF@psSXiTyHg82CMlDI7J z_y`RStP&xKD8yS(-}>fTaW_sI;x-pFjPgA1#F>K0dV7}CvivsFT6q`G(t4Q=r_P;& z+B$p1Izu&1nGGzlyL+&a)&w z{Bk7r^**bf|7Ia>eIdBv{5R+y?B~vZ`~Cj@_WZYr$3Fkrx|ucxQP9uG!(wV{J!f8O zY5hu1j&uC+!rTBE_D$d-z}7KbTC+XbH#bZ&w-T%a-GW4TN`8*1uY57UTi<+_R~D?# zo%HR6YD?figNw`^P8b6jPuIxmW#@hIzHsJ8MFHZW=j!%Z|FbIp554ia_<#T4Xs^is zxB9=0Jj?L^k{bZl7I0onhqE&KcS3Lc$hQC*9Lv=HJ`wW!Uzb-XKJ?JTv+DZSS?}8L zfTs0-v{#V-j{4j9FB^F>@t?HnU)i}7y+qP|V zb=kIU+dO}Lf6QFXL}p%`jL4fjk$Y$E_gQPD+51-THLB8@Qc0ty#eD;5;vJoFcCJJF zXlrtJ)Aw1E#{3zlHvkUlm4rt5O&L$<$meIv{4HJUN4!RF{L7{pfP3`i2L~4mw(-;x zaiVwW=UScn?B&kZKSP%41O4{dFUjJO4!AWcsgfuMtN8ml3ZE zs9fa4fW7EGl+zwMo%{h23uk|9&MD2Ag>m~r$Np5l{JVHBAw=QI7?ta*?tuNIPJZd` z`XuV0s>#jnAq0z%b+1^UPxriG=1}+Ce+Z(JYNy%^c6Ek~X+u$UM3RQtTyUD^JSs^$ zSaqMK8rEd(Z)K%a3g}BYPs)slO4dZ@qWyz+C}B~742$GQ_xO6rJ%|`p#RE8F$>yr~ zV9_18hp~KX_%Vk{N4tzZBzgG2>XBoUW$^JUTFlT$JQ92ZiI`2{Mo9LS<00x0$a_Sl z&i(LidN>{gkiaqpMe6<^iHm7_hLqs(-8t#7kbLOIeEWW$Iq*1Sw0239gx)SyPO&D= z$KzMx9CD|W4#fpeBOy^CLSWbq4gqEycRrnDlK^SY=apv0E#Q=^bP+m8BL{;LoT*jV zO!8|P^J->^a_?A%e4gR6UqZ>HcwASqUi%_(3$dkLlvhky`GWXNl;CDE;iwye+s)C$ z5Zd|3;rT_)+I|gBPjXc9b{C` zr^5}VfokVX`!Nv=^O!Yw3@1^WC4-*=)z;7~{d1q)W_Q^|TvBh!n#DcKcesTBUq9Qd zBA^Z|qe`=|AH`rN7o?FlXW0`fjg&Zp+k5unCcL&}Z~?e1(Rt#c9*SQ0)lI#Om@}gq z&Lf%vj5Py6{ehBNx`K7mv)}x+1j-OmGwA056wwhvHvxaeg#OeX>M@`*Nz6~}2O)us ze6$FiJfPAq0-^ExF=Vff*dIkbDjvisxK`}3b_%%1EKMy;GxP15OFvu=B6N3E6##+4 zE}TA$?HH$pZxD4B^G1ad{>`kczJo)r*(aG#ucTdbiufI7u@xWf4dZh@zuMDsp7!h| zj)X%N45a!`w?c`WfM;LSsS-84UM1;qi8H^mwK>v-9gB0SS3I zfmju1+tAh>weWyspYc>zmr%_lL|P8ue@f7Z(BcZ;^^1m4dFodSf-{xohep(=H82x2qFPNs!|mJ0v`*LnnVO4Q|j1Yv|37ecyD49<*H_%|ku z=tK<_kbgWlxv| zkFD-QXd+<9%Dc7}yA9Y|A<`cuYf1r}OnDTcRc!i@y$Pn`@F@*`R!zx=x66PcE>|)vr2xxiAo~j@?lpnZCi)RLUMrY)@`oo?|qU+&$YB`r-Nx zf=A41%7VIx;o|xFc*KBNZ&6CfCf&lw_|%NTC-*D-2PYAS z#LBV7AuIeDW9p@y)fX9tPzrSkv3kF=QH8yk7z_20KnMa7AfpJ*HN|9pzsf&#m%>LT zsvtV7dCP%lFMgEe?qSG|#%zBP1eREVfw{=N!j$ag=N-i@gNi~-Ias39TF+gsI93feM=!`BODAVMHa2*si-3BJ|1ek_yHA2*ica!31X!o{ ztUvs()Nc%Njp!r_aG+;ePpZ&_!1}S1)wHZ24Xnl`$Z9)<556W?DZ<#TwVE2U`;cfP zNlvjMy38*HUJ`tg1_+A3r-A7U$(mFKtrUrFp+gZ^!Oe|^^jXBji!EaM$r5eCBTtMc z9Zt>5$>Cx(ImnTjDG|mE;mAA8C%#;Qzo8BOTD$AXR|Bz?Imqy6`xG!YnG5R|mGS4` z^D|qes`&i`StBj}JodQzxg~b>vW=R&EiPumo^3K|p3!eDyp{Ng{=@hnOohs#KIsMv z_?B2|j4@UP=D8jACR%Kj62zS5WL+pg&M$<@u%nk+=oBt$V8*%8oDqUohOw3+XFi{l zQ5HN|#0?rIgNbw3KdBnL09Uu0H@~?gfbmT8*Y!|m88pw3@z0usIWY?PZ$)a2HHKjl zdvhn6CMZ_b2aItot1(H(Yh0_dQ2Q8V#VFIm^$D`QZ%l7Qi}|xd}APOp5rP@ z>bX9>p8^>I6ralZ7Oj~EqMmD%`*gCwxHX%|PPAL{RSL2l>yML)w z4|KLVIAN*8R`SVLO(L69ZPNtTv!#|pSiUtlNoUB+cw8HWc43INvkssQl9AV#bz6en z<6d9YUO31#Bquz8l;YCQ0^x;Zyg-NfnyCq4Ho{mMUaT8*GRnLh4NLwWNbXx($qJxD z*TQgPn*RIyL^5NoMBiqxD7+t2H~1SR@z=*4ZQ;5%6Z$KL;i{=qMW<8?2&N1u>fyGf z9fZ}Qn?l|V0T(J*f$O9zGELE8#E*l8 zEZoE~XuYe=Go(36^v}pB@FS`4OQ|F#zS3JcU3QQ}Xs4`Fd9|H)Jb<}aJmBEbh8kWo zHT+Jd5i!=@o_a=ro8r%uz;qtR9;?iLn5)7D-^+XTC7?p*OQri*3x5_2aMQKt%lAF9 zw{3p`=t?+IwzO4Ex#%QEm7tP(=H-a2Tx*I>D^DT8f!gTkWokqt$#+UFB~MgmcP=s8 zng1T|F3E&4f{yRjTo-?QEQ&_=bhRZ~90yK~$?R|gLXY<)x3y6!obba%qDkkOtc-H3 z%ZU1F@&C;HrYU$1iWUiGVX4gI7(BEbyREQsGqeACbrj1Uk9)7xCDj{^nbJ=*T0wfX zPD88k-_+T;dUMA{iN@76P3I@&23HsI5*&3CUeihP8ETxu$n=}gKZnwnr99=?(5MC% z8e>cKvMi>M++DNpv)YI1U)3~#3e`z%onO^y05Grr^t^5i9P7h=8>3G2Mmf3I6QeF2 z;azd(&+ymsqwYJro7>-OKl|bpevPnWGeWuSF6Nr}g=7qUkQ!%Y|2a_XvYloAj(@=N zoGaSWpj_n?b!Nt{FshOP;L=TW3Yeu#5DD3q`e5CK%*&;snAxcP!M9#De?tq+rY?a@ zBejIq+MC^X#(#NXz*nF6i-!AmOH^rtu;mOX=-jGz_g+Z+(LO{0P^xvm!~=oOLx4w_ zfuy)*BZ74#*z_Pc^*_bw*gnPOq&}`cTl!PCc$Is&j}HgdR2_y!W-4j|@W``5RP>e& zFdStI1iENgU~ROC6v8+DB_hmCOy&V}`0%`*{0Mnlzl0$tsmzcMXtkH&m7my_WTku1 z`p7vWK)c81GqnlPk`d3ZUp}1j^?TarT_(s+_>0P3v5LOB2`X-sPYyp%%t0%s$FfD+ zj)GHmx=Gf}yqv)A&3;P`oMN*Ie^|(sx_d**bs&qD02xYh5IZ3m?(8u}-6kh5tfB~4 zrkhGkBKvqaUW8OfY)5WR>Bf&mk?_LZKhAzpX!p$P&DVPtDAcmqu*Mk#X2@+ioLK>n z=GUoT6X-VXn?|u}3r)_Wex#pSx*c6ls4BaZlb_fh4QUB&x=O36>10k{=v8E*h=WJ| z98VW4UHyd9TCse|+LQ~j^%BH4ru1bc-#bA4av|Ia_i#z-6RKQ6dcD+!w$n8+@hfAb?MbEDnO*oUme=nND*%x%3npE-8A#Ixkv)zP4NTk|Sh zqfkD9DtwzVHQ83m81u3Alg17nbzf9UU~s69i7U2&s(E7Sm=sNj5iLU#>hb5iIud5bqTQ z9JpA!pYsPS_>jJw=^yI|d%0WI?;3R| z5=oL1!m6WMDtjk%28@82xd~&%S;c9?4tlYh;yTY5bzFq)GT(dY*($Qa$8%D}!nZ&) z$px$jnuH5LMQoL{EU=hM^s*W8vIrqHi%(7V%lgo=u@LmA%xEgF@_RmCukX*l);ic` z!qS6ewFd?aF&Y>Og_!(9r>C9n)?Q)Ryij$3M;Id$1#Dostp<|NJ@-Z_eKb*Xcx8@h zb_dttHZha66li!UGQ?-sJW?4(TJMZaBvo7Yfn)DtbGe8YRbO~q!o+uQece{4@Yc!K z@fwZmFi;MxJ#r-VJjCRUsU-q(KaH6NpvMcdiGJDQQQCPo?3p+r>oiy^1V~Et*D!I8 zK9k71SB4L)BWAl>^nIGhEy^+;T~RyCpPMW}B~E<;9nE!s{Gw}Px)q_?kB%5_0e=`I zW-R5~5zI!wm0@jPCaIfS8BEu|P&P+GZ1?`77W$+|O;A7R{33ZBf(*TgyQWIcQf}T7 zaZ@Wdw-h&`etJIAB<<`P5xY~k0N~>9;_z~Me?EU@T^AjxoAKijqnD4X^X=xiVv$R= zEhG7e65*DuTMqj9?4!A+kp)tA-%5uv1I=4ongPV;nB%_jzdS?T?YzLhw0`Gddt9G< z!aE&UbAIsus8eCOzTGdrI(Xmh&QAe__5j^GZQ9P)I~bS*u3DU8c$6{+lm-$q9WOHh zZ{$FaONx#SQN?}aK};q-a?9B~nS8{--fj}?R9FkAQlg-Eogt#pS#~4Fn%5;@5?}y3K+(=!sl6jO`yUCn2#V^O(Ig)U8P}9 zio3S2u|bp>BUENhY|q~f;=Np6Ram=&t-m&Q5rwuQClb$m3T|9bz)J2LO0T06L$Vuj zW+I@fi@va4qqppRZmeSKBwb-1DEiVXHw+o>VD=7|C@gg0qyFCI;rkBPoT=a*QY2w;#MMxNf za9LVw)7DdORFPF4L*JmMZ$SVRHt%k_3+3DE|4b>PJtit zX#Jeg*?q=PBY9K$J5T$XJ?va+grmfX^xlTW# z4=^P>FtT6O{QL!sQOAul{A%#xG zU4_v|)&*B)#aP?O+*jMpknyYy7aFWUV`Bx@I9^v*n=l&#vY$Xt`|5d9jlwLwgxr$Yyx)^gz>_JC4p!@+N6Mlf@sPsu$lj5Y&dd!AO zAhS`v(*or;LlWsxZvCTMl^jF(E(K)wVt36bEow#TVP)}t=U=791J&;ut-Vkz$muYq z1iW#B<6Wev;+Ykszl$+Lm0v12$Q~4ivj-?3%MhPsWZqz|#sw`NbfCaDmkg=`%Iz&h z_OESDE6*rAiMaQFt*VK{j|(*=$Z7=3ofvw51d1)!E}M;~TWQ8WF_+dVjRnS+v=f&* zUd+u0Sr$aCd3BnC&$De+`77;o{goo!n%Hij-6DhPl1A;x49#cIYe<8gJ@?uuy;q{T zIo_5olc=x^8Po0!pqC6lL%67zMe9|P@)nNZUh`9H1;}oxb?XC^qdxS(2ZFM{>~2nP zEvx|>gHH6%Jry4<8sC3Ez(2ygOaS?vPv7fUlh->2r7osdc&hKHvBU0Cvk@911||xI zbgxvqD!3AXB9qA<%f;!(j^o9Rg{L?p`j%wNE|$lf<_U@Mb&W0sk={7JHMVbKaS(m@9w1EAQ6444HF(sS ziRx$!^*xMB6Vq~=B3yN)3x7344C|B0OgR=T#IXSbEpz4}$L**0!i1p0I2Fg+E@YCZ z9wsB2&KsfT%%E0f3Sv5R{&V)_La9=D);>$Fg@jc7+r@&ZFH@YzC;r>EF6pRV5ADyQ zK#yQgg&!2b>tQ#S2Tyt%E%5M=j+l#Ldp~B(x5f)e2XS#sCRVEd z8MYd1Z8iXXr)y992THc6yJoFP(U7_kDTHR-EfSubf9P#jW6ig)Xo-q0-D9U*vA`NA zx6YeVOs%>{ugrDnw`XpnwW3K};h8Sm+FJ{yXr^gr4L=vayGZj;=K*{wj6vNH2s@X5 zYSy*i6@2L1r~JpjpU<=yo)^dOnW>+4g~_mnj}J=*F0QTGtA<)nxucnW9$Pk7be|YA z6G&%g z>2!phjcNpBJvE(7i8VSkmp;fI3<4o^QJf^QeRl$g2z3+V9-=`fFwbsZAz|}ZE)e&d zJ())kXT&Lfa7AfSxS&_{VDEQ){o3<-0898b4}P|X9r$nZ(=n!p z-Ob~~$nV2nW4T@&n6@F^HM4D$1vkM{Co~k2HW5BMuSA`b#Kx1PhTpw})m)gZ9zr$N zcX?c%w$46{1itE}@TOZik3r;o^$IW|ZovfJbx$dz4(Wp@9JzPb5MS#@4I_!|A6crw zB8XAjs1pekkgCn|_? zXe5Pqe_Dfg6)XLVRiB%pLO_b3M)B8xoccL)tq{)DTOod?Rk-4-OC|H@oHmvMa=@~Y ziMiQQRwzA@*V_1$<}>ggK{lAQS?WLuTTT2~b$Q(H`mEUcO_V^%2-@)!g}DxH9u=j< zdk6C%$ir_I4w;st8T3<}gf4XvVTrS?{;S&^u0G1jpyfz~dCSREh72ZLifJ>Y{&w^! z(ofklzAJ=RRo%c~{sM1qM>g8Ob;|Ck06fqR$`A49nId;M;2JfT>(}A;$s@@vKWpQ) zXcK(RGL1fLFF#|aDg`3zc)*7^xab?;)_@vdxBv4}rau)!y6|2#$|8;Pn+@Z8V+;F- zZaYT!btNYw(Ni%qyn0iSyvci|4JE6H2|TI@+0Yqz^St<>=OL48OO~y_w@S$Or1!&< zZ&M=`U5k8LE*Dd+Pd#Rcy z=-(xr0g(-E@N;pHp#Jr5p&f_iqptIFDAkPnwsTjQ1Z?9!w_W%l&vaG$v9hOXzFDS- zw;umkFAns5?``ib1AABf{^tj4fTnN7aQ-bgV2w5UG4mT*0-bk>bD)?Kx^qQ@M(<5E z?q&wPjxdn-$AqpVUMN@uL@h^Y#2#rdBm0a?Qy;4i-xjCRb#T@qyBG}Vn=T@mj{mXP zNGSCE1~rJ&w~Zg;azFl>F0_+pP|)f}^3dQ6&%-2FYB9}&+n}=r819bC&&2|*Z44?_ zkAJG}f@M5(NJ185fPMw?m%V1%dgYAJK^pvNQw!b9?x|CXVh0C-T}@{bXl{6$bTEyXUwVW*gu#1F+nO_y9n=wu`;I;rJT z4fmsA#)~Mvz>qFX5e4o$6-in*6b#)^4~CSe4tF#{xWZfkL!fCiv>?>Gx30qH!f{Z| z!=7E9)lbX!qd;V+@E`?R*6_b)50YkP`=i1pC-uPXvfFX_OUM%@K8JIO;Ob{0F^|V# zg{AxbaDVCfFM8E`vB9)BB62vzr)oRzz@3fh@FK%Q$3h*- z;zqy6>*@URirRvI$2mgsAIfkiKAk+hFX#8(<~rxx)xlPQ zto>&e3~=;x@OZ8TTA+IMz=_$X^+_4qR~$!}CtWPEB!YjNRiosgLSz81{=^EA*?%r% zxH!%hy@T*s0o2+h2=!+qaTLHk4yuVkv2EMv# zey}cc(l_`}eDeQAeLd{EeBt&5D}@q20fBEOniUK$+v|m?4P>USt*9oWj;t!f8gxws zbyT)u5%jAGLG}`+`66?S;^xOpW<<*kYcwc`}HOG!iUo_@(h*eF61mw_*Q& zf%%aYlmU{{bZhui^aQAWhUidhsNa7BdhoKP|Kxpmrk(&C-*2d%WCy*ON_R(9ItW?r z07XTkxl*tWMGw)^VoWxx2MZn$f@vg9CM`Fi7qqw?lKP}5%H4sNp2E-rqnXI5eegb7|gt}CM9TyK~6t2*nH{=@=vAL^K##dG{)lT|~RrI~A-+}|q z2^{yAk4(f{kt~T@os+=h2cNiB9U$cmfJC(m_TAIdlXe0C5Bs|Miu>v01-?13`SB?Et!-tJzgefX!rb&tKf#Xng&%C=10Vh= z`Q5LQ_?YYH8%W#R#ysGaZSp!6jU8oY+?yxzOH0#TZMwp<=$HCE5z#H?SA~bWmQQ&0 zQu2eFE`TGU#;d>|S<3k%z7sKOnpr19%j5Eif4G5L8r2^V6O*R~#mO@(a%s7^b4*~qUSuK_2+XS) z<*OCK?9)%FaMChc`6oyaNNV?+=fU$om1~Or_G~ng=(Z_km=fe*U;`TOtgZ_uB4Vez z_q6x$}wyOMs6Zum!i)$^Q)XzBABu^=8LB^=9%-WJ5JBu{n`YJP>5hT6$6>_7%{VxSY^z<*xsc zi8~fMa=hTjGG+&KJSHX@?;zOe0K_{U0NeI;Jx_r3(FgmLzuKG64@fUuP2)9OYfZa8 zdJmQDWxDfbccpA5YRAiYojk)1{mKw@W8V_ci(40=UTYT^fR<_iCv0|RJc8^6AU_^( zV&QJzto!4wjpz7_Kuifd_` zgdZjf|I&=#^m6IhpLWQ-C(O}unKt-~jff|{7!#2uD$=q6r6pCc1qoX(4h< z_|$0)qeX&WFu%!M0qw~b^i0XrOCS?1*^r_i->S^LpEBy_?AVZI>Nv?* zEp83O`8&EVr#zeAJz#G$w=Q);sEY&u*!Ka$>reL8jh%D9pMtLVO&#g}mXUz`Qn|rw zE=+FLcpe1pSF_laIH8#>_>aQh$}E?*L z#)bjc1^{Asvi1Q+X4S*rqEqzAA8Anm6_;fo{a0WOK6vMv^Z= zb8LVIv)swA87yJ7aUfsDpl^82WAY4;9%|F*>$5ZE?nfd4G4cfo}u5hn1o*sNAW?&7-?U^Q;2m}%0}Nx3wJq-DO2M*9dTdrj}=&(B5} zh_cJnX>groZN*Uo{7_nHND$HNXEWeDfzmpwKLSjD2T}=Qk9_-la%Biefj*{!27)o>Ag2zd4Vngwh+EtaRd2cQRNVnwjsdur zFJU2{@Lxec#f5n0YYU*>MwOGy?kj8fE3zwynD)W?9pHZlG(M+GYa^gcz5&0IBhmOg z3#7)=UB}%ju#`V$p5eiDA)9(IHm00ntZwSaqPf7yHep8vkq`8T%#JCjYzpMEd9 zFB^w8?+lc`CcMQfnSL+77|3G&RwN@f!1SCT1KZ>Spv_o)`l0PV9rc^y-Ud@|I%niXzJ0r@z6y0NabBF?6v9fCnmP zf*v4O2jHX$vZhY*FwjJMCSVkXq$H{PwS-PnZNXHo#P!{+wH<3fDxR*^pSCMoVCE!A zw@Rkf1eXfp7OWl|?G z+4K!g3#8!7(wDr(BchM@`BMRd|J|hF@m_5Csc#h$!fCkt1SNTs0WO+m{(kPa|XlNL?eUv}xQGrZJK{7v6GGu^M%Re*QfT=-eQOv*{e_E`M6&ufqF zx7a)&Z8Hq;K`%Do^S}>KlzsK(RKPE56O9E+Mr^q&6WKb#_LF*lbv=-ez{~0hDISR7 z{{pbL&RWw{P@r&ebE;xX(hb#-EMY@VL2S28mAtwTXOyd$nD`y|^lXC3Cw=(2csk$T zvtXKAPd9vi^K*Y*K4iSc4fJ@=jrrXiuVo%gvVC8a^&$p_KTW_5CiCy?lpPoriY3>> zX!P?J`?^Tmf!B&Y-DOe`|qX*GvL|qI%n@p?yG9hMt2nM zBvE=s!GHD@u{8LuAH#2<)V@8;@v} zv@$`vMeW$aDp}bd|*eZqx&TZ66TK`$c&mxJ9s8o?m zMV(WG(Sl= z@sba*VfK9nY!i)70d~AyZkGgu|LjRQnJ0*@|CwTvz&ce zEvBf|-)($LVE-=GJ>0HU*5=V^nQwt+U2rwc4uI*R(L62;>9!16&%Nv5)ih05#F%Pz zoz94hX&dgEJ=6~CwB&5;)tU(}8b%ESVLrAPl@CE&)<^bc#x@x!LN71kc`ZHahPGK{ z)(vYk<*e^jW^PZ^tH?eqy;`;^BTuRbcAvP=4`gAFlz~C%!s9cQ{iu|h3voG(iU>M4=F6>waV0)$}3)w zQx(?TiN_*2ScF%TMut&kiTa{|1o{N*9&=$i^_k9lBvtNO4pQn)T9X&_W_?NRs;|s0 zAd8RrBl8Mh&%-oD$UNJoz@<9VF@!2c9aR`RRyAC;x9UjM%$PPA$yrYa>4a@_)+%eA z`GW|!Ah!igKV8^3i7F~+X!yw!R&cYLgp2K&6PJ;)ty9^Elb~T+0R?pN_cp?s32{v! zlQcISN!v7MJ5l$vxTatb`kVGd4EnQf1r!xnyM3Uu+ol=5KdW`FPt=|4g%-kO@9Cr? zf!2zn!SCh9j(-eyIb!Z zcC{BsEbJ?;q-LGk*cnq#I?+AHnYALCZhz`k{tN|+8`q)Pe%9iyG&3ms2ya`M0>E%) z_Zc(qIbp>##-?l@wRo|`L(qi#BL*`~EC@nghHmjj%N5KD^TdK8r(OmK?Y~_8;Nf&>^T@vSD<+fqKWY1Y2bvZE7g0St+^-WhpF4Z# zerG>H6k|;xv7&q_&K&cnYkf_?&dfx8NoVD=#Dq)3%fo1%g3A4ZBWK~S z`p@z7e;#N!1-MK5Nv;Qq(!ck6Rkx!rG_}nQ67>t z+7xtS^K5Ji@V5{O>tLZH6shhhk%HQB`?1iXb#RfLW^S&pkzlH1gK@5zHa5St(!`hyE&t?A>;3|O&aW|tf@X}5OHpzV zsDh=CSf0A}XYwjz)YPz?j&W9}01B5s0?+{01o(?RX+4_`J%u&Zc@aH%&*e| z9P4)5bT;qslB1PTU-xN>mhB#u`Y(9Usxh2c^+|3bcWt=9#U}_v^#PS2ZK`K%$RC-} zAg1Js{61X|{6A)lUpM@A{r>!R*Wdf=Q|f;@i8MNBjN zPsb$wkRsWdA{>Lu8OUZ;OW08h9}zLnwpwbRQ#yRLp3G^I9<~I|9s@%WC$p{8z*VHU z>;VNr=NacO6S8s(zd0~e57|dyMv@znW-1S&ha#LB-!jdtD^SW8Yw+}@Kp*ndQDa+| zS;+=gAq&2gEbuVJ?1bL6?huC1o70?eTaDnGm2`eOHS2cpNFeQ2w5$2Uv4hJ9*mJ&L zKc1Q_7)Zh}`fC&-s^+&N10M?3B0WkWR>Z@~2xM=j^k9-ey)M9j-+|msZfros+X1C} zEOg7W%e7(#`pYuU`eNZ+HSuwZ*!8uBF)(y+VToa-Pr)btn(C8@5c{;qi}?P=P_`x3 znzVX>CCyZDOp9)+f#O@!n~FbCIt;DKtdYY+Odfw}vYY;=H!^M#nu^eA873`pe1;v* zRypowt>5C2wpl|Jz(DzMyeNS}!<=p{R2-l~6^gSTf-}bq6Ou6;u>9cJI!-Z|0(3zf zfr*aFgJo#6V40sLge3Bo59KOPr_6|lo_$`?@{RE=EYXse0BQIU3FoCzN?a*f2`%~T zAm>%DVM}?$u>r+l?*--!U7JfxEN%G3dz68iliiQ z3Z{?@?=Q(HQ;K4Y5pqj|o*eXegoKB2$XB|~~LHIncA3j zyLJ3T5W9~fg;DzI&sS~o@ySK%wgVm%rkp4BokDd2Ps~qt@9c5Q)R%=ZRB}c zRoLc+P*ej&dv~qMziz}flUN^3h}t63AcAq`sstf7VxV{6%Y|+N8*Cz2THKp?a#vN2 z1r%mBQ3jSVw16fMOMM722K`k!flH0s=J>>0=XLj_5!M{uK)31*jGYAs##Yv8LXl2( zgZzheNgwhq?Z#i62}hY`Gs=Mq;qS9RU7YSekwPrE1&n<<1uR-2#%G1)z5^E+(?E-q zBu(D96cYIeT;mc_%xzW|6bhKL%9RwArlhy9)~NkFH|^Ig9{`b`d6(J z2{|=6;TuB=>YVOH>0%*goH#tKZvV*@Fm*d7C`1HvKGbFb(r;P?R76EWs}?{{%0q`r`Ow-X$n$)_p}) zMySN@;d8YsWm~vEGq?Q?-$_2yUN6x!As)*E*A`Fx)>}J?peM=jUL4JZ|H8cD>n+u6 zwVch>wwyj#+OPhHw0jJaC1~44J+^JzHrCj-ZQHZPwr$(CZQHiJ&b;rpckI}4&cE{~ zyR$2!Iyx$%qbl=y?!3>VUZeYLV{Pp=D&3b{Zzey}HW$8;fC3BlV+MeFZoPT>I=L8~ zjBI?&ym@d*y@mI9hsbT}a?eQ*hjVhL{&R~m|5FFX&}__mV8g>?P36UToVcn!qG>T@ z#U7#!JShdrX7h}vSx54sL8~zw%L>e5zLB+CKTB25>J z>gf0Dt}+`JE6MVNuV-3({v>v+sJ5&Qy|-4~ zupL+QQQTH)CW(UZLoMs_cft-UaG{I-yD?X|QEWFFG`^3xog^U*Dko8+Qa5_T{kJg( zk=gSliNZcy;Zy4lzN4L^-5m}S5;QMQFkYZPP6dcO9@Q28D$uJeZ+%rJel~EQ(y=n~ zFM@QfKqp7F{<{5o-?t<+2fePq@z}m*rgkw;wvY94!RRQNtG1kyQ#_~D-*m$I=^8E& zrAYm*&a7aUKkWJgvhqWMf*;Z7AQG^rMyupB7M}!h|MP!&HC&yvZQ%D4u zJ}MLiP?XWdCEjUy_*1uN*xYP6jx2O(C7i^*fnG7Y>@@VMl0_(9$$5{y@*DKns)hHo zVK$WGQO@ygS#<`r-{l(nl(}n+3=>e5#0_f|zESWhhX!zQiDaf*_c-D>>4C(^WA8-7 zH(w9fiA^oSWML4r6dyP)l<$dDD(`hg`7KMw#HBP=3dt@MlF%=%K2!@i0c#hSR@v{w zcmV$9qHQI>mM=t8d7S%sd;ap&f#Wzk^rRqXei-QpCt(a&MlqrCYy(YB z;SVs0HgG9L8o~aJi}G*|`OgT?;3;)P&!ss(~O;Dnym8UEgXV%8Iu8w zYBANv(0)<%6!aKEHG*s%d-nLTYq&WTyw0*@!Z-Pi{q1w9Dcu!R={7>b;AicRgUjv^ z)-{hS6E83%hk#ehorM)CwcdA#YY+a&yr1t1fHP-7_61ADDBmlm-wEPWOc_`_o8+kE z6%6)A?5L3F1kCP{d=B5>X-v-;1W)7|0$J(rda?6>5~Y;HS_a{~Y0Zor*ho39B%xdM zu2ece9!_P`A}Br5sf8TC2KGS5gJZZ%S(_l)JBiLCmk66%Lz;eJOHoedGGUvE`y;mG zKk4@^K|6d%W3XWLQho9o>?p$ROl@^UbDHN%^EycikgP^hrK0>Pm|9Tz^D{3$FE?4@ zJvN0Q)q_RJvx|-j5iw3|!7kQjUSXDYpYfotm5x1(UgD5Nq%Sw?HFMa8aqWrgl4{y=`K;y!^RDc|b%8y1x3{!?rJi7Bm<~Po&Et~8SfoDm z<5tDXLNZ01u+bzpF~n%66!t_#7Yt{a9jG3}Ma@znjjE|E}o&D|}xW-bJ8}6}6pLX(fFNS?w2}^h?*yg@?JF!nK6P zfAz_w2vWeZ+aLtKB2EV zZai)U{mQtUt;eel2d1mX^H0hw*`qV2=hp_&68w;Gz!>6g_482i_^pRLfKHtlGI*dU z7@7;Cf@Ih78sO#4NS@@W!8(F8aKC`IY%RUnJRNScGfGXu9lGaIL0*L5#ztm*nCc4) z&~0<(K-50C%HRWVK;pZWWoCIAzfuy=2{-fgurqsghALN3X4hkw1<4 zEf4B{4P7f}M~lp|def^%RB)aaCdd!?U1vKtFH>SvKp-Oc9MfUjyn0tiPBiU)5WEje z>H`NQsx|a}^!1TTAM@kzK_pPhfjb@2ks$;{mW7yu5Tww5ZWr8~l9xT__6mrH6+Odj z%%!)e1pdKAo56si3$abl>nJ-dhc+y*;Q|4Qw-Bym&?bJtbPW_ykwv`aw$ASJFx2-) zu%;8DD456+{uz3X;3OfYzQ{U)igeNDD%(eDah)_8OW zzH^>NK+N0nH~1)u%D9eUzhnr?{ z8o4?vfrKwk5sEGrz=Ws4Iz;pnFqDks;WK|UzdYxUXTKz1CosX}Cz;{xPNUS{9waMj z+}XBVK{Gg`>wMrRcIViike;`%N4Z|}Q}TH*_*S!4JcK0|wlJH-4j|x|nV6Z_ACK=3 zi~$$FcV~>%c8HKCFu$s4qK30Qy8e}LQgDB>5I5sEv50oo2iUNrm905=1*K?Kr)rNx zZ75pB`L)x$3LE=u1MU?3=c~`k#7W*k=*wvh!I<53R1c{QZ0d2&Yg&$>Paq3&aB$3S%=H87-& zD7y;gP`8u2jneyWbKlAEL^8eR>85}%*8#)h}`yx|$ zeze1`Igs}S-Q@*q{TPi53y0{px(46j9@yv0;N{nXyZYCPiDuT?Rn8ImJTnp))rLYL zKDSDbR(p7@*Yw3*YGExQ)M^!9~WQgd%N3tzJqUizQfTEwLZ_UXXK8aQbPi-ZhXHb20;z^y3OMc z%Ue_0o3BN2M-)rsCBAImc8feRCQ-OyF#Z3>wN*#F(OqAW5We9l2K}hc zL7Ikm(R*nJfMB~>rc!L`kuNZRsiuQ%+ClaZy?%TF*mhi ziP$nLw-@ayh{RGAV*iG(OG_pLh9Ws#ueZK!PX=J`ya(1-rP0<>%Ik271-T#M*TwIx z(K~5&Y~)WyUjA-d&I!HP<&!b`N_sC5&{AUGt z7J^}J)YaXM66PLXzeE%F>I5^v_;(|CYLTOi)bHi>@LE=->J_Hjh%Bl2fKwUoZD_)#N< zdBzXkR5LUJU?N&?C>73$K)H5-VV1K_q?xBM#1=l`Ur7T7h@~pvSNkyn0X_Xu&kmkm z#JXYm9ebsUP#QYWMbpw^puO4SgTx`?C|vYSuXI(L3|pwgz%fp|u+KXa3S+#m5?qX8 zLsNFMzsMjWcKUZku%{^$0W!RY2jDOBu_ekM3xJ9^ETfUIDm;4Nv(lJBt|FVWt+`W_KG)*GOngRB&6`QFl#ioV zxJu zbuV46k~AIJDp9rPVr<%NzJt+I+N*c}7Oq}*CCixu`xo*RS!qpo@&u-YLhD2~m(Rml zSLSI$n0O~yTtn3fN~l>$v`%DL_beemP{>IE;rqvvQ`)+ofUA&xY?`CNB zJ~GDhMNn{=w{T^h&N;eL9ZnLiBZ-5(wsmDs(GUw1ODiZ~jR(+}m}hR! z#qBMaGTQ*wH>T%=_zWog=${lQ6*5WhQC?te5|_ZVz=ARw=2ms-!+0aOQ{3$-1_rDa zvzuV~vyodcp}UBpKqkIBNzSnk)Mc-+Y(lex zP!piFs2=6OzSY^ynu>(9BCPlq8$7nh#U_L_M&&h!b4-hFN%Qu5wVBQAOaMQuk$UNc zp)^A4*VYKiFt)lo!3#6usL&;#g&}HLnP68gYsiM)4js?IKZ=vg+IgOr}&v8mKF zFH8rHa+4U(c!o>13Ro#bXFbNFfQBi-$oVkr;g)P*TKH5(F>nzsq&`Pp*g`Ln3r)n6 za0Vj$;EK4T0Zlg#1p>;r0aA;>oZ=0bOutY`Az7Z*fLs_Qo4OG>JrDkL(#ox zw*NT0Y`>(W>RJ%q$6a+=?DC4b9k{X<0}PpPlW_~10t=70Ynsa69m|(2H(}$U#Rj%# zPMpCOU7rXOETLP>E_G%gp!$`V6eD6EfnOOHRTS!$c;uES{!R==ROR<|i*xg#VG8(E z;If|zhB*?ADpT(Df{2wvn}IYZbBfu1l+A#M5iO^2ev0ItaSL*Aad2<|6z})z{XC$9 zaL^J{;?A-MspjJ2k)4eerqb`tooH%Im*TFolsT(y0u;}!`fdbcFw^|`;)d@6a}E{*Nfoz0W`xd1FrixJT&j0!e!#nm$9Q)a6}`L97u0SZZnW6sZU zX9||nO+VC##tzmj_cQ8Gs%bo-Oc)7F;BBu)Q$Be;*}QZ^Hp%A80E9*N^YuCVZfm_1 zn;WM2F`c~1^8QwruUg|8s_?Muvp_JfhS2I7m1CXHl71&u9PgUEl3X+E0f-h_q_%SS zica#&u#XlPSPXXJSjKY;Y0}1uaru(ezdK5!?w^JI*s#U2GTOiNAPjt5Hn$jjrif6n7oF^* zCodKr3YnSFe3B|NSO`{XqE^)xvzFDKnl@Dmm*%%s5M9?1?4vF>f+1rj2V-+z3&#=ZkRK&nplAg2SZAMw#wk*hQUvQH!xH>uCzQG%*e{m#U+-O^U z2@I_c^Y~c2=F~;L&+IAzSHa2dv_q0rPy&kMBGUH;-t(ikcNH*a&^~$| z%KM7>3T?~ZfOmHlg)OGvnr28EZ97s{Y97m!2An0+if6eHab7eo8Th&*O1xLPvR*Xk z*AsmR^2#4ex zL?U4!8!p2bc>Vf(I0LMcpvSxKRM{Rb zmNxBxEprJr%4w5{u)}9X4CI)rgbln%<#rvA>cYjH@z;t@GQ`+qEE;1C>u+4O4T2t3 zkWg8IPjLkZ<$wnrsH~WaGc}h^dEd7LBhm@7k?*cvaWEjz?&2} zOHP-4%6SA=6=#IM^5S(>t^O8P~{1hHF}TP zsOY?(<%q=U7S8T|BT48T9@RY;h?=oRmZ>2WzAO6)CxzSFl)$oN3{p2K>nQliSxPxB zj$vFOe5(hLx4KF`E7}7>LQ2$x46@gLzxy5voS@jq;ll(3fHYFcj0gBAC)LRYPzv#T z4~b`OpJk8JpJkWqYB~XAx;UfVv0@@;#T;*#QpyawYul&hOaf><83>kb7Y{<0JBx6~ z(a)H%B?d4Oog($n?!%-Y>WoF1Dv2#;7gYSzT0=`T3QmI`xt=oJeR`VpB*4$n@eqnb z4#KN-0tR}EVKDzI36L8@iT)OdbfirOgcd0x29_u9#E4l#+1G-iJvfGh8|Sv|RVFMj zga5XqD;9Y^iBl9U%ADWBkyu>UwkVi$Q#Wn?$VAOje+)}z`}j1fYLW>pBE3e}{Qq7Svd7~9pu{xO z^2}I7Y0T-q>3$$vF04p%UQlD;BK{HsHsoH*!j1wqE`+D!4ylXm_yG zbj)oaankvg7TQ!bqFQJ?`BQU<(^tXKCYv;$OVqr4$p=w)5qnFBE z4@2^(p&iV4g5g1Ha<(YI9{7fcj$k~o7ubXPq*sP*jEX!do|&J9sW%nzm>>ic%CMh8Q|4$ z87w>qPJY^UhEl^Z)kJR*(q-}9==EL9;#LB)P&WxT;M8ybbAwDSaQ8-ZFHdhTO6=}46E?bAd@G|$Xu@dtt{jYS&371 ze{#PHuEON z)_Z^2Q)oXYS{@Tky3+3q7%KEy#&4cId;YHGs~;&rj{esy{K?DN4zeV}2R}WN?e&G2Y4g zNJ=&EzWYnN3@J8t@$G_Bkdx#M>;4>n`!|yC!}$IP?eV&kvo;0oh%N~?;}*O2Jgi>N zs5b50wIC%m%xqRTV+oH*T8zqpqOl^M^pr#@PUF!E-WmyUB5Yvk$1k!7e&i{y0J|Ei z36+t!p!@RP4BwqUF?g_eutv^kr@JruOkfB=^@w33SD0)Qp=!iq<-s$WoiB+$U}vAg zW|+kJz1^CfzsPQXZtH%=Ng@kPJ0|u%v+WY$MwRhb@>A}m{$NFQ#N8JA_Y-TE5;KO8 z3M(x8Hh;W+DOYRet4`r$4O#*!gyb4jOyM4q^v4avB*4yUXgeCKPB1#oh=AH?&82T2 zR45%7G@z?$=|gS^w<0^d-K|2Mpg{xUwiCS*{`Xp{h1PF0CcA>MsG_mlOl<~w1A)J< z;TXR$ngtJ4y<}|`ioVzBtFJWsfl;m)Lx5@jBl6rg|71q-rI<~{^(G;qxGw0iNU=?G zqnpZfj=X^o5u@O97BsjW#yD+9EKkHj`Q|Qxe(ux|hW-#{CjynPD#E1=QwjIei2=z_# zT!svEp-?Um$anOlXVA1KaS0+J2UZR0PXFe_(YqBOMyyWkQ2o1|X0w=lv96npj%}M& zW5;GN69vIgaotbO!xSEfS$k8<6M&)~@$tpe2U%G??V659*g|q0NDCm!F|b}ZOWI$E z*{Vkph+-I=N|pIgpramNE_L%$=$$;~n3(&tI-{<>q}Q~(5FT+};GUDdnDI&PP^|2Z z(bdS^85dba`X4i4z*+hFMisgzqB5T5=>Dt1P>+)+m}h{>W=fhCvZpwbKs3`o5|+?e zYJKe z)SvmsdjlOlep_1fhg|kETVWCby9xTON;mB;BQ+X2N8;{qzP0-uKX_C5*z{Z}DUP)1 z9{AI~%h)Ydoq7FmC3_bob*1CiOApsJ%zX9oe=i%UMof$E^tHnI;Z8fu#8Wbr3DYkj z^J)Bth32lsn*5OLs zxtM{haSFK1+T$W`OD}Z_c$7N@S=BGjM%F$Bc_opx$1lWQx~hd%Z=ER7)#<+LgoqHR zFvWNZrjGRc%x|}M7A=_>YXVuxjxT3sa`{hZ2{WCGSjo(|LC(zhB1-yyAAt84yNZ&Y zAN$|^|17^w6xCN$|0!jw8)F9F1Yt?pl2mx_?;5wtkyfCZzc5ca8=Zf z%S7cJXN-Im^zrnF35ngDp0N&t9s1N~KKP>|9}6~-PE9D?>R@Q@C17(w?O&JzcT+q2 zV4M&wULi<}rI-3ejjfTuPx_36;lWz2hPC+N=CK3SIwPdmDMy;XQ$NQTthTuV_9mbR z&^w6I*3Xsj;!~bzBvwx`q&IN@5F954dKL#zy5|)DNI~;L%UEJJ46!pmg&T0L||Z#qpSHN@|x}Wmu2<4 z^RIdp@>ht?{T}mX%F#H6&h8s}H7lG(hpSDVJ_?5+2;e!pvJDdO)y zJFt+l%?1Nn7d_aVb6~U0gihDz{@2?<@T+zCQjUKON?C3ZkFgpKIgwMB_Tg7gr_3LZ zQt`N;XUa=wDs9u|i`4vl%H=(Mcxi`s>|gJli`}{ECdTr;m?Vn(O3cv5Q)f)}x?{EM_DZRw2-gY4Ixt@L!D1 zLvY#+h8#mamP6PmS{RZF9LVL8A%ZZNfF2yS&AHe3c;5d8ljLH4UPliOo|LfuVxt9LEygT9H{?;vfl*rKgX_I5pEPvX-RO337G}FGH{ba0Bj^9aKS1+0) zLcJ=H9bXb+=wyY^ZkEK`zX-=BnyxNktWMrFdro)CHf@lKy6443H^P>dViNYS>-$sm zKWr$ceT&Nbx(=_Y$67Z)mPq4gx*uB%e*^^h5;lqhaO)uT@eM8G4Yn$V7!Q%2ES=sH zMlKvih~$iP4XXEIl8-{fhJLWLNWrZtGb#kVbA$!Y;l5BPb9jq^<1g}8q%;r zV=41;!olnCk-X2DM2I_yM7|$^m=a3H)l65PCvnlY%fcqEf+pX8oW@p{(CU*x8UAP; zqTlo16laMjQZjT+nS~vQ7z1(xB~Y}0-27i!SQB;bKQF-I!}BJgZ@4C*?#_v)f`Y9n z$4;2_PND{-09DhjbB`l88G5N$DpKLL%?i!dR&8pj$OAEc?u<8DlBAG(?+a}g4llqK zbEUIfiS}klH_`*y5^c?eaRV3f|{DwE6b-*ir6aRT=uD4UgbelI+jejs`UmANW z&}yshJAp9DCek+>p&(kxE9Q>pw<3Wp#hB)_Be`{f`YbIl6@J>>Rcx0g;My-x-Qs<- z2M6$H4ElHb`9&?RIAcL-QA2CHm<9d9bqw!>;v5b~XC?>@{B5@2*d%Gb`EcN32wh>P z&!Vu>=D!K0uhu^-HvLadbH6t~-pxKUbeywDqk5;X?~R}qeQ{^9@DGms-2Wt?f={xP01akoq^9BxL>bZtULp+ zKVeL~>(AY{*~jzZoLZ7Jp|UY$7IZsWBL&4srmUSW6LxwU;}se4kVyOqVq=9;PZjG9uEp(c6hiZlS zd!N~62BQ6>oP!BSJ6++QnvoAhJ5sQ>Q4b_$Vac~0rq!TH!LPZnZiP)e$P33r*#a9M zl5%tMT1~u-VU=MxQUVd8i*~qy9)LJ?IfdT~u9r|eLlO@iF6JGNAG%7#6`Cjy4pd&g zU>wDi5Fjg-s?m4|*uA96MaS0zRKycQE$}aZN-W$5eTiK9E?>@-pNIloL$QarEXe?1 z&u^wL70E0eG2p-Y4UByI&zEx#JsW1@)zRP@mZ$bsmY#01 zgDUk_fmFOVThBj4*TfWwQV`RX?3unodAg% zY^YSKI*x{OvaSTP#ecF$pttOLDgSafu^notM(ApfAc%$JP|7PrcZ;zUCR;g8qc||l*TS=VxNWI+Gdo|VZM<1Q^JiV>=_B$6mxAVMpcx$aPXLjs zWdP>1cc)fE0@hop5KOPykbb3gk5<)O2T9+R(3>%5sWLSY7j-u0zxFZ0r(VL+?6=G! zph#UROB!&t8g#KaM58cAuUdV8SqZ5G=yIWcvob4-ohh0`IaEa~DOgnD{@yi1q0tmY zT~h>m>@BCSN`vbs_6qvZa{vUaM!$5b3RK7NhKCz?Z5t()t|-1QYnc3g1bm$y6km#Ur2_AF{}(mXOW6J?1O5wb#8>>5~lZU-qQM5hKW z%ax~A2P*F8eytk8f2~?tBqAW4BsBhsahjx)JjwJ})hiAI-N_w;eDrrn|z&B!EbJ$Rv^oTqhF0!)$aB0l{ORH^{ zQ9=JNt!A?54soS}Nla#J0^ntGQ&w?YiuYB~s!!tNbA1X9m@*H!FI+A~`4K&POB%0i z%);tkD@Qd$V9+=AkJvEBpZq07?%)HS!Q_JR&#_#|#%%ES|7F!&NY_*eeoQHHw`RGE zY5l7>vk+bf*Ox-yFgaj@+6R;1iC-)2e~_F#|fY`~Lr^mM>A3d*M zVr}U0Rgb|0q8!mNVNP6y+Y2zup|n*!9i3rKlm&ItEl?^fM;jzSgG9MEKQ}v_hz?t# zr5a*1RDGoE2(~{J)Uv~?>b~ti=UwK5(Sn)#g=(Wolx?}6 z!~yAeGW%5y{a*iw6#dkI+t$rMTyYp9Iv zz9D#z`KMH&{N!lfl-(tCAdTOQ8#{aIE)s8`)D*{#9Fj30(KONyry?d~vmx^%Hj-p# zoOGGMFzjvZur6uIX8G?1MJ7NFAt%p=e3@Wwd?G9xEJ8L|K?Z&Ixc%t{UQ<3~?%@eV zP%)y`b}YVHUy$?m=0|91E`|2=4F0KCHl3msz*Bo4U8P?9ZV=Z$+pj*@V~BP$I z$F5Q-RlR?W2B1zO+bH)!$m@8js!Q2HW(C$JkfPZeLsYxs8$}yU*g%aZT~5?vHFx@@ zst7+pWR>jY>Qdq1C@7{U%qhI5mEW!N_fwTIr?4)G;rt#qD5`k5(R)US!LZ(07#v*MssO$cfB zG=L<+a8y>aETk`+3JfrcCYMk?L9arJnmY#Xupf5#?5pHfd#o*M zuDL}PvEm{toQVz1(hVzlES{xN5JS&y5w2FhWO%cPdveyc&hfSu*$Kphu-P~}`hL%% zi~Zy9iO*BYiZKb25=((x*Czbw6Blsz0O=4!Y!3YZHIH(X z7*$tfiv}N@8cAAfWz5!D7#}`o@|{K6XK$H{Ety15Wur$k(xuy-N3(A$%n$U z7AF{tG?M7<`1?rU|Br2&jxbz$&bZhKOM7y8gJc9R!}j)e-HpIJlRkK9nQQ6i7~oIU zYv{AH>~5fyFIMfN!x!Sj{RZbH_!X2N}V7`)RK4{M5}R2t1pa*b0Ou2lh}4j?OxqA*uO4c9~j$42ZRe>`l0S?@ zQ#8V%H%Csg<-;c6w^tXS2$la)C_HsGpdkZhITEw9Tw`{~X1FfTKU5UmG(EPd} zEoC)Cn}nJ4YEvdbU)6yg%-V&Vj62|H#?g#weo$c-Q_w&!x z-5u?mA3?X>pP|V6>hCAlQ*y@-sX+l(x85J);Q@wRU6wJGc`FlFs!jHTN$Rjf$8F>W zGwvGUR6cl{Ok~evr`4G(h0vFjY=ytCgtN*Rp;ROz%Gev0m5(A3E9rvjH?Dr7_<^D< zii#uk3Vdi2D?!xd&9n|zfy+8Ig*PM4>?PyTjM{BQo}M&qWUo?fRTshSHLjH;L$5*| zYZ9!Nq{uW3eC_nwxFSu>0&N{-hJL2xko`$<7niL8vJA{ymg|Q|B-L$7ok0mdSaCV~ zaud$+zEXFn?W?yT3nd(_DjjM&(VWM!Tc~#;Dc5F-M{I*3QofibIW4Hk7U3VC^EIp7wco6V{OJ_x#24_G67Vn(znow2&Ir zrCZjeS7i4C!oCzA3jy-c6y8;SkP<@J(9&DLxRF@>p%d5G4zdlW9xbfOv;AM zBD}3osdy$O1!l?9R|i*m#ZwgFavV>qQv|z(x{>Mh)q(uzrisgo?0C%76eM&JR_t_GhI|J=Tmonud{=aaRw8-iw3M#rgmR$T?MXj)L{w=;V{3nN4d zo`JsZPP$-&aT^%pI@FdE!i{xAag-BUpqoPUx9qnMIk;Ex=E=eJekta)78idy27K$L zNDV|++*J%-!Vo%MoM2?~^R?!`4A&n{>tac5DK|Y=G_Jv}nt;k?UG4VV{Jn^GmyW5Z zM$A>X-bLULovJ1?ZLj-uFw{)!#v+|!6K}XBR;Q?zw)RKx*vB0)kP*BjhzobDf!cIZ z6o^Kh1=pvWu_rVe8^mo-PIyMwXtze>U-j-y%N{q4%TRh;6`D+`U={+5_HPq&@<`{p zu715N5M&2^u9as+fY2Lc-)U4I@O=`^c1=cFwp#ps?M%AQpV}WE zS*!byIs@jbp%m7Y9;qU8WK&BywaJRDDhQ53o^B?ZodL@72NRkE)rtg}ass!KgnVS@ z?f}G695>7d6A9gUU#>2Q71xXHe5|ZfCq^z^=swQ+)~s-|`6on~lsSrI7~73!eWm@a z<+rf1_U~P38lnM`IUNOAaiHZUXDPd7ac>i*^i}}rjp=wbS*BwUBihc&Nv8NbBicq@ z%1QmMgaS@i%n9gG{?RF+Aj5R5>iGv$M?{@75*bq>Y6v0&#y?*t7*O3pI@eLM=BoN& z$cUVU^l&3D^;${+J%}OK110Oa9OvqQ4K1whFI7g(K2kMlwf>&!;3*-~$AWy4o;6GX zlVoR1*bdCkAh-KDoJP>_142^C-3XMX=zYH0!5av+@h94mh8z{zFtiB7E#8>O<)^)a z=VRU`6Jy^Uo?JOqZ5okdBfDO{L&aw*Do|`W^nMdnC0;GDZndX~MHSUwtniWq71rj9 zMrQ?+x7)6sH8sZ7ik_4_s$OWy?d_6I@L+ah(^=0D$v2WK1*n{}M3hhn&=@%%`l;N~ z&CCh!s+b1Of<^SDNXy_TWpW`f8R`PtkNcQhbmmf_&PNyR`dQ5a3UL6cbVDhc?O z!L%Sd9mNFM6s;d&?+lv+pCbKMx|fT&H8sfV4+$L!x1Y8frGrJXUzH&Vg5J4CTtY$k zSKd*jCP7tly}Z>Sa-Y1lp^R$dQBp;H%VTUu&9*aB9XKPX0L3ODR@hlU)~ZDt`8j5P z(Mu@YtaKx+g8|yask#1#p}8GuUpoCVv~{9`fKaT1yd8$yZ5ixip%d|S|4QE%E3Pc)$}cAV{&q9I2u)3iyjF^;LO2(iaQ&2s}StkW@(H<8smtHTnRVu?+$P_-!qht@sTSR~>r zF<{IQL2ccdx7AImGWav)PHIu1p{4~?Y-4*T`8^DuOSF7BxYZp);Uxn5l8>D87RKUI zW|{a6#0sZZ!FdU|tC7T3mgYa&xA+ciQ2h#LWfWtt2dQel+5E*Qn!-TgQ1jtODAWky zBI-hqU_61{6ah=@rxmu-?usdri}X(^NSV)uyLqj{S&pm-Luc?v>J;B~ zg7sRdMf*;J53q{hdsFxKi-p4FDqn1#IYsUYC&$&I^6#?sayHh1TTMtB@1JQ@q~k?d zRs}wpWR&B_`ZDT?(#qa%uj<}!dzH~E+YObIza%9a$x*i)7o0I0sL@o_u(cEhv=@T1Ffu;0%)uUghEu@mlF zKyc78Sz(?uLl4JXUc4Q{eqIVcq)K6>k^i?aQ}Fv0W>0hf5oTEb5oTdyF1w5C%Aj#P zy|!3V3s%7{}_2MO%*G zbE9!IV^#S+dlLbWb_M-;oyFXmvf138EI~S`xI_3TNHmY{fIU16SLzot+5MUs8$8id zaq@xVXl}kQm{{S06-611bKYjdM6)v%LlCN1xOjPt$HBTfpT(Za8x9213o1i$*fmCc z6N}kIdoVzc`?is=gtbR__f=s+d5q5OXtD00s^@AaNRpTvDh~c`lF2GRxA3suYYmTG ziAl2A_&%p%y+=_#FuqUO1GjD^cb7b8YRwlsXXrJRO0C~B%Qo5I-(Gile@Xc7IfG{p zxx)+l#_6F__3Cya9A_OKily3KNn#rfc{uT7b6CD7GH`8FTQvG+im0;X1OL?80JSPd zje@#iYQpe{;GYCEpmFtWy$W(CJ5DPyh#qNgT%7#OwTl!mzw-$njT&(8Nitidd7F6vBt)npwB%xMse>$9p`7k2u zkpVyuL)jj82Monh7_Ih3np5aN23@~hY_=mxT6h5yMF)) z9edxTSAkGk6Y9l+F*pxxmqauXMnd;OGtdL31_$mAB5+MsWWv*ag69(X~; zeW{ZcQ%+PyPq;eFdfDT#2T)|1X?bEPr8MP@tn?%mEE{c(jr-d_({y(lydJC8xDP|^ zL(HfKaDctR0d_I0Ek>U#NG4s`)+D~t&4;V`DcBQ$oEw6i@CLk?l83*iShzZH#}l5P44%}R*4L@IjaRi4BLfar$aH*Iw@W@Ws zXhPYTo66u{o{U65vby1H#lDtIXqj~lH_YY)ZsMp$DiJbKxot+^%LZ$!ceNA%g|)_J zgEut;+|mh}8>i0o0rJye7{~f_IX97lc}WgvQH0OhiKRw?h!%9RC-vRV<8iJXLFyrU z8f8PMu7>TEKxH5qEc_4-!D=Q)QBQrQO@h*ydkgd(l{llNLWC46x-3~VRXguc+`s2g5z3K|Yu!9NgZrYjtD9?rqeQuqbC&$v z9A8j(0jUbHP`pTrHr6)Q`RFX9TUAAS=}PK&#~iqb|0eMqZ(Pqb9Q|CS17%(pPj2+s zTL_XXT3yx~fM?wGg$aIfoFe}J;5ds*FbTHb{Pu24!6$+D$X^||r*ybMSY^;Zh8oMR z_`JQX6JXFB9yjP?s#WogZZ=wax?0+8HV*jYVPfO%04kmZe9c$@HRz__jv;xl_#mhP zHxcS39`4^WnD8486h%dys+M=0DyC8lXznt1GSAA@xg-3Kql2$==l3V^XKj1C-Cuxx z+dI3sIQu%edPdXL%-s*akFQU!55Kc^yn*3n{|oEk=jLA*3JSmwzk!|h3xHhei#G-{ zUky@5+bhO&Q&1dYz()f!gB=bMC&;PK27k0RnoKdZ&q(>NkJI|iC@>r*D;td72LjJ_ zkX0mb3P$UGICw2J4_e&x$u#dY}R_DW-Thb)mM8bLecj>tgy7Fw03zVv1+&ik<`ytLUmX;PxM~R)d2_`+{If z^L2gl8(6bf9v`P46ZZcwb&t`NbX^;$!yR{Q+qUhbla6iM?%1|%J007$ZQDM1pYM!u zPW{Pwu*P3@-^G!+^QJD&si~Bh^$O@DYLUp8mo-ud?qy1|?F^qesDQL>w9aFso<2^%J09{( zGJ+m*{At|@$I`kudl0@d3aF*P*H~aD{3k$eNGB;V&|VIv9dVl}JIJu@5|6}4o%44k z`XoLwu|w1ctHX$=*$YQ?GgG%x_3RW8^Lz1@Z0yLW*-CK5)ctD3$tJUIM+ruqzs$V$ zwDDl+YR|n;HZht3AL*F1U`Xf$u_bh^<1v4R!igqN6f%*hVp(ooy7QW@K~+}K2F??p z(woKq6EXIs`*-|n4F{ql^g8OKm+5`&AE#0@au|#{*McCETy}>)jT+8KV{_OwBHeRPadbcDz4O=xm z(9Ab>s-pN*S8qbSJ3{h`#qW^?hCE~!81z5!L9$Z9UioR?8qQin9pf(HsLT`d_r7LF zYqx3zhsU@0a&64m-$qJ+Qodxt)!muJ))U-n+CyQA8Zx3lt-;|244vfCjW^6>3Hz|3 z`#cSh<_m0^5D{((L%rBkY7|T!D(zygC|*2QlH<{G5hcCajr9UDKlg>{HD&7l)w>X( zIQ4kHtIT%SAs9;8PTx~zl{!UnZnn%MBVN+YIz{1CXSQmz&tRg|S zAy*;?7x!-Jar{*L*rWscuOvr@5HND6`Xl#qB5Bk;dGD#kt-$7%DxqCbO=l_1X@zan zGm}%0C9o$x;{nT9yZukTk@#JGvk*%wKoqw-+b}mvojFD6PQ^@%6h$?HNYEl=K}(8? zvFzBG(2g8NBhS~OS&Il%eF(7(ce}tbf^n+52n6a$5J;eps8UGszdm#nsch>B@N2;k zWjoy~r9%Uq^dT{=HiWc#I%MDZD1!mJii0}}LxA0u?hMkJ8v>H}Hdt*N)x+P2fQtyQ zo|GDC6EpaBBN9#<79CnOk8rOBRK^F%O=2eyJ}O5-Y!(goR)6+(FHl2m<8?;<=VT_^8;b}@zynW>uv z9p!uQT3~tfL7JH*`LcZBBmvEenVfLs3Ox8*xvdYn+Vk(BBE0PXyLG zY^!tH4#`!2y>uljtTiw7%+_gZ3G9WK#Nj%B^({F8YS2A3ssyAWz3PJJx2S&Gk7DY0 zfO3(KPmR_))?Z}Om}XCn&hcj@7zZS|{7%kFI85MB_m2Ga^WBxEg(|g;Mi=BibPoSw z)L++dE5)INe+NYW7`m7SqSGTQ9Zc1m)pI}JYlvhXgN@h6JN%yG_2kuaYG6D6BVPmU zWapCD-@W;}X}!#ad(q}|{Yt4l%c5EF(xv>T*gkc~y?8}j=8^*B_$!h$02*(z=N5CU zdjzH@-cxSSq}Q`JE2NcEfw&UKBHqw&qb&wJL`4BBPaaqTXh=< zYYpS#+}TeHl;)w90G89gIH&QZqDCX^IeR{Key16wRwu*!6Z%K>J`L|pIoWZL=Xl`Q zzwj3C<27~exQn<9?9QdvW6P&xfY+pPf!0TMgw=EHOo)P)=2402O~IIs+fEiJv{}A} z5gyHXnwr3`wV^$DMnzG*+aujMKanNeu5<96X8@>w8bq z&z?NF)E?Tmzfv$Ym{xs}&H$q(Z!KZ_H*~I<$q4&U-cr*zV9ruJZeYQxR|Lnh?l|Nf zuigz>aa{lRe_1^O{0?X*R7Ng>Qx;<|hc=D5!f+=eHrpWPWb(6JG2$=NmOAsA@Dhm&uDYPsebWa z{k))NXYS8_@}fgU&l5FX-42>@D`BYou&d1!kAiZ7uy$-}To(m*`QxXpv{SA*M?y8D z!wLB-6546NhR~S7{^E2G{`*g0R0qo+`xHtyBdY2~c~rS$&Pr&pat9&v8FE(0_bCJx zaiz=_`Fnrk&k#Ke;N4Xj%2cSW#iO9(bv0<(xZS#3=sLySB%^Y&B7 zkEDFNQE-*=;dn|ia+lQsST z1=g<+Il?wo=Zi(QyVX5=Q`#g zwvtm~9Dz&$Q7mk?&EIEK;M3DjP1&}MFKc)4AN+jiGIzJM^kHX0)Od!GAw$IU=Q%+4a~V*&I5zxo9(sh|V^@e==89Zi`nN~A-Ih>SFYtTa=Zw!X)|uz`uE53;WEbr)ppzz7pUNf z)MnrGPpc-loek)p#;KxPIcyK5_6Mn5=@4Y zqrC%=dO&L>au88~KPR#(Qd;|S55j-BuuYU#9*pcssjO;WbM4!CyVd-+lB%&By0wEd z|I)?bWZb`AR!q7qtmSEIgsH=V42vL5z?;4`KS?k&hyP20&83#VmIzDWa|@+c41M6$ z&VpY09}2$|VnV1>*KvAL#%-64gS zbRc9M%>>0i7;Na>Q_c&e()`T0%Zt!!URkNTO)RkQWtqgh#oma>zpnc)3I;Y_sBE*k z^!#hve{}x(w|g- zGo56+`?H~z9mpR^RG~hrklA3_f(B~9@aO7wof`Vs6yxy8O#VH}V^FqdSiMZ-RDwy8 zj)1{XPMMbXUNrDg*5o`gx_RiUyLcP9KHtf^x#>PA=h)Z_+giPNzrd`Y4w7qm^*;>F z_AEh#*_6{F53JmMG*OPlSIcfJRZd18+Ac~;?OS!y$Z}xJT}gk(4kKI0$&<$H0GwX} z=^p!NP*ZOOgam+xev7JDA0XudhvL7gg<|goJWF4f?IEA>uo3j&gsOd4`%;TyXR zvP9e_To|K?nS)!0=UkifV$-5z4lrU_xCDVHR4KzZ%S5WidYab1?wi?Zxa+^12SuR> zB2s9R*}sN<`!jRev>ExG#!a(tolT+7Nz5QSon>$*SjdgaeV`nKR;uJ^ixhEMy;Own z`R>R-H+5HwqQ1SMyP=sR{#x&WmrEw!3okh#o@bPR83V?ZL9VLq^FY+X)Y!`qAR=_d z@grq*Ek-Hn1d>VE9QXe+ie4jbj*StK<0n`KQ2=giN=wfh*l4E}PsG~owER*67^5~tWLDzGt3pGr z2p!aJj2J9Gnd@Q63$-CJmFm_qWp3lz^Vl<|R{!^PmgHT0DRz6-hic}1{qb=yMuv8V zW;5q80H7Xr=pm&Gdz&6!EVUaU=iDnqRcT)xC>EqNE+GX=6;>H#9+0UE7TY9T0FOK9 zc$`d~M)Y@6Sr?fMuDY8Mi*W>o2DJb;QTu7t_w#vZJ<(fu3W|v}p}LJWEealpv$7^2 zIoXdX&9#f6ts!s$694`aa&K7JXEqoEg$xKjIs9TQ#d6^6;azRkwxv!U$peCmnd zuU|%%pt{xN;8yQjeR6_Q^Jxvt3*2$eAJ)xSfR;S?sfw%%s9y;FFOXsv4|%NMGCuaq zH`F62$1XwxssZ%v-6mzBfep>R$sH2dE zDI_iiZdv7F=2B5nVdm~8Gz7Zf&?&)W{?a&8r!WZUqvZPKOtGEp5I-}sXb}wu73#+o zVZM1|vZy%c>4Rdxwp7R7O@?KgFF#t$Iq3GN+%y}H99^@qUoE$;&dXV{;sbG;M zFHtogV6c-H`>e_t#s!4RQQ!-MjF1$k94BFK1CMyJ-?L^h46p4{jv^Gf{yMve>U6aQ zw?Hyr2y#Mva?`+A{@xKP@Wm-{{FpUjO%PGk2e{M1Mc7Qreg*)2ov#yR7nv|?)kCJz ze5HO43d~o2!aOe8t3<)XRY=9gud@K5c&U}8qpo$zC*v8T-N1(HR0tCb3VCwyI8{YZ<`uk+@s}# zRdDeBxO-`?U?)eY2AwF$YZ(%qDPjjQh+<`t8nDh?0@i_uHVx*zW0LTD7LGm&p6!tN z^)5d}sZN&&DQcP%Q2wvC19n`{d!hciMvfkkJ_^=wy*TGH9l zgI(;rTSvEfWB~Q*EMX3}#TMd~%_*DXn`zL=nmj4CvMxnVB-P;EL+Ho!)%N#?e#`Uc z)fGKN|M$n^bh{7yPE5^H*Y>*}|A)J+t?P42j?RbMU;8KO?e`mL4HEX3)BY>^i;Lyx ztc%OP-zCw=g{L2jSe)6x*lC*M&r9)^RA8AU78G}cE;DIX>s}ujdT&LOhuyyC!5?h9 zZAFZ+wsVjDq=-Eb;|0@*}46=QJbzcJM^DaZjj-b*2akF>!BG zUHL7g$GE#;a;5(?;vW+A!zz=VHmlASjGescSdb+s6!lB~Ry1B^_qo0&TI{$-H&maM z-jdI4V~K|R>g(1c?hVU2>TqfzMz5)!`rZbin`n5P=kcZsqc>&oNE*7ACR|`P#oOMI z__(MqeCY$2K?|}X!1XeNz&>>0Zs9=xeT^}vSr)pu!i>Ko;!Un09cSmcsF{|tu1d3L zN;XzKpg|{e+j<%9j723k&Q1rT{nwIpkjizYp1yJn*-`B>b7}Y&4o%P4e>)lFRUmdx?{|Z{_A;)+Jx-w;)FNW5(wHOs!(T zKw+uI`%yQ@C<+xVJm?lKk@ihd6Yyt*m32r6pK1Rt3r!WtHrYH!~MToti)!QWfrklw`nqIUq^6BGn6)>m_ z8qWlHVX?ptFr)Sn;cTl19U0?l<{Eg=-JR)T*_boYPA7%%@E8g6<<;{lUG+EpcPq^> z8Aca27Cosw^{-o`=Oh*T9$rEZiUWlPUw=+$8F3ATWGk3T zE>cj2fS4D_s|?>E%18E!>(ZWEi&3)qyHp(qx@QnhdG?GfHPioxo+0Rxa*K1rA0>9# z7YbqK#K{|@85@q#r1P#+(l&R_PUvFLUGETyj-pCc?b={|xP_Kh~YasK*G;CDF zx3a2T$0pxGps+?E4i*;wt0oA(PDnzv zhvkDTqrTDmk33^Fw(w&!)UQQx9wKoJQ16&-6ak&c-CD>D=JQO{mmo?AJsDfpO#49-Z_kvohno?byn%2Pwk)J9<4Iv4I#7wh~9WgUT`pc52zv6Y5K)LeuK-8N( zROwswM?4G59RCr|QfOy18Uty%Ec*i$;Qbd>lC3z3a8fXYJn;X8-+4Av=9S%VnKhn( zm0bNNp53K`$2d!bMn1+T+60*WdCa_*q=QB%G2m+M^=(e1HY{waB0{^z9Jf~Iueth1 zK+LvFIjW8(4EbGcWPSiLsr-A`5bp|D`3YkRIPX95Y|rBOAIM{uR0DQgE4Rg(6U^_W zC;x~l6&n`Yn)R-uycDSer@p7j+MMisZ2R_f1)#lpxP(ih24EtntQ1TXE6zlB*300a z!B6?CY94l8{k!Qg_HXq`*E0C70hu+h*VhE?}MRbnnMZ>c6N3^QvCt8 z-Ji)ovJq+{35UTmXXpL>z8}xG5y!rbY4N461KG|2W8)42U)PHjDQM>heKi8Yn|I}V zN4@NFIe>$OP&*vxgk(wh9=%v*gtHU3NTI+(M^Z(#c}Qn86|;Rxz26hUL1XeAm(r@h z7VlKD2p$fgGKKuf{73mCfZzS;%w=Wuc@`_`t*Y^5(N`7l*Fc@YpDv8tqK9Jji!#BX zn3#vrLRku;vI4)89Ot#n-J?6HCsICm{!ct>RwRU@HoUsT4t}#PXm8fV{w^Xd1Kh9E zpbVE|wz3?Wcf^Axm>Zs26HlA|co0f3!FzN%L4Hi_zmi*B7ptfbbpfbF1d2hxa1_Un zE3u9cDycIcVvbK~laNk%(wYwMx;J4C-YS4YM)%20I z-Aq=~fmv;ms{QbFA&`zTUWt<=0~`2sB(8WOI+QMruM=eJlf*Ox!rX=GH1WR9x2w%E zPCiS#g)5T+A4%mY0D@*s2D{P!>*#sUe`_*FJ zpncrAN3Gcsq_TMI8-NKfDGpeSl$U|XMu@pTN^Fm zBPpcf!1uP6mjH#8afr>dii??>Ej9Pgy6U1f3Ag;Gpyu(fzW=lDzSjt%pD5YC-!vZk zBR0g+zJJaWohVuCkvlrtcEDCBlHsHF3$za7T_xJ+;X^**~^~qCh z!u}l2lB)z$mz|J@4;vZeiEbYQv_a)+4K>60-%7?ND>7++KGT6%WZe+HktOzfNVq(D zd7vhhbSzT3ack~wqNMHB$e7s}F7shzmp$VT)X#hq-St29tlrO&8qo2?6|j7Zr}VlJ zSmLI=Q~9#;O%N7JoH2da4m!yf48UhqR>HZ*AAXZsPIP!2kI9KIqj11fa{N5Ime*>$ zC?R4jP>AaXjlXG>-?V&G{$s`*ZQjWu^3?#9(ui|uQwz(1IZTtL7);4W#aTjgZUor` z|EUxP!Q-j@s4fi!|Cpr#<;N&h`R^sA9U#x!XU}Ij)@zM3$rgPCV=wWxVb7uoeu1w9 z+#Z!{?)eXq(?4iS6(LSQ2O<8u(Tl&%Q94WK6*)(h6_6~tr!eZ7E@*p zdT|s#YvygM*ScT&5+pWS}J%hr@Gxo=$m>-ENwx-LVdmxMkFkHIoE z5RNKie~E%a1X%FEuAlDr%m!Ba8UkOnz_c;y7r#b)JuM?InUbZNRc5#oBzO~nn52ka8v12|X*grpHLC2lB)S4roA2RZm5p9~`U*9cC}%>Gm+B%~ zza9waOxPG-j*QCVhJay)zF+qmJCe7$`BD7fi3ZwaIxM&<+{H7 zzaWzOYC!rXqhj3H(sxr5t)KiXCb0sE)h(+$#x~RBg&l83@>{w~V1Syc@=(gcS<54J8??3<0h`mE4 zLC*)|pHMoq;@4qDJd@_Yn&bU$HOQlK_$SBA2j(U5XHF(x+#=h2*D#dCS}nWJ<10^j z&QkF=Jlw6;>;0IJ@+FgzOi|mEITi50atE{Go!6Sq@7Rv-IZW65@jLB?lXLt9z-A{GO->P073$^@w!`i+nbH2Q2 z*PbdOZ8s6ZZfPJ@OE@jeRKox-cDZz?9owfS!$~BRRKSLfVatI01jGJ^UR*p8ve>Ge zsa7bR^WU#B5v)W8P^GkJp_EJ~)s12#0F_H0$-u#0DT1?Hx_6>kJsz$>`WJa~f#{v` z#soYvJ7c@_j*ctLlFSoH1W zXY_fllSMm)3+dk?b|9*E|FyTZAJBg-Fst7bKOB@EuJwfXh!=OvV^k*gLKHQT9?gtp zp@QLqiGb`Vi3b5;gq})$ujq6A{eUN^P1|0hma*){bvEC_6!hhjZZ*eZR0NTBN^-(W z^ljaSKpgNVZv-dAat*OuukWqSV_|)L-M7yQG*0fx(2DXoCnqPfvx5tp@7J%LtmTsx zE9X>sMzV1OJdk;uc}=^9%!7$~V)?oBk_6y5gGw9oDUTQ)o|`=5l91s+Rv=!!Q+(aH z`wG6--Iucuiy2Q5Z@%uY^@`=?gX8`2@%@zLV^h_GMN&@p$GeA*w~xhf>bo;cPVd+4 zgOdA{63{*lim#P+SQ!qY=H(c`8meIul-g%f!5pJ3c~BPvIhMBK-wCf0rF5}QakcK1 zlcf|i)CUjaiA%&hOw(%=>D|wrBW^p=4BRIhH!R$^1R<(8wfRv>?0XcE(`;Jq8hFA1 zk_;|SL5Vyz{apGMo+5j@07xtmtEG9b>*Yjst`7ze z6y9@Q8vBZOsPf^XwB~{<1VpSZ#-^f}8LrY%8lu2Rqs)og>Jf8L&ZQu=KQ&VIF}PYN`K( z8;Bc(u}l>`%(w(z|Lw_|W`b30qY|eCx02L}p-XIODu6$O(qe~377e2x+h%Lge$*=P z{XIZQLxE00N{=9l3PsW2ix6om=t+c9HrW^Y{WBO-^{vOfN6=3X2^1QH31S#S_&exq zTqeg}y^>*nN9+=tXCoxp;hP`+@A6I)FUDU@oZOzU(1-!{vei%Ox~d~Fiteuv6v~AW zQs9lF(7$$uAHz?t`}}W4Q4uH~f1dj(CzCdG3F6)n3Y%@IPQi)oHXNw0VO5V>wXx4Xyr0NY<(uQ36`G2PxCFZc&Lz{{7}LR9JB!@XI<8d@9p z2kr}Z7+>axhFF=O-TUb1)6*=vcNZVS%PGU@?6=q~Pcv*GTf`^;@j6J`O8f9&F`C8` z>HTuC-;Q#`iU^q0pLc2v!>w>s^tb@3>qop+3FJyB1T=(Apdwel)s7;^l1T=Id5R@i z{I>aHv6wp*9%Xh?Xvuc{LU6|X%4^eWs$ zII$2z^VA$@CmRYc4l4NV3@=&yQrY*f$eYI&QSCX~gQ{a99`WjOJ4(HlIUt*AsYQ|8 zxIJW@mUrX^T=q2Z@GCS5yP2hdf8&VuvKR66{5lxQpXdgQ<+3Q@D5RMuS}0vy_(ZH8 zLukCSs_38<&8_-^K38qtfLu|-LOM@|2foBOr<&p;aVnL}$OIBUz#~RpoUpeD-1V|4 z(2Ze69y?V(5=LHbMv9b=z&oc>wRpjyD5^gh zp{ZxW<6D#pY`p}+Bo^sfX7zw-Id?=V&ygyPagyTIxPynoq_P4h?LF)3I96+kIiGL7 z8HL;77{6B-Wt*E@6tcHlLwvb$Y^?jx39~8I)WRr~M)tal%E8W*+)JmwzaXDVUeP&r z#5&J7{{m*#24_4NtJ!>zva~YvS+>baD-lnJ^{(+KDlO&QnC{hzIRh%q@dqFv_wf z&*j4zo({eR%uv*ek*ai}x)z#a#5(dC6JkP@86i2x)v`p9^7!L8xaI0^reorGw)0!9 zd;$ZD`Vg6*&1#Kr5%(z!Iu^ewTfR1h>cOh)DnT+kjoE0Q{L8jsOe?oX+&5x~RXqKo zz(TjGZ6pz1P$p32=)o0=M)5E`9G$7hgG>67MB7c2m)!cbjfHdA%8OlF+$bXZqBvjk zd<_au$nU*yxz!DipwI8!*t;~<2MyjVxI6rPTHd=aCL8EVHZ;_)6?4msV;1*&kCTIm z97>wlpM@K-#X^sWPq%x&Jwy8ao`sYz$} z?JkKOZL&Yr@Zy)0tOt^+n`!b6vp@HWt6DNM0~iGF<~7535K>-fjKp>&W^R@xS*^Tq z%D?GUZp05LIl}$m_oNb$^a&q5RTea74rCbb2xVeoJ?fU{Jfge@x;yO>|E)c*Xo+ti zvT}CBO|g)r1v8327>d~v=lp7TsmNBrC?{apc?ckpqkXG&bY<J8tvhiiJs%026+Fmq0PBkz8yf&Rry~#55DA%8A{L z>vI*O67IZYA~FgpxBTTuMbBmv8X8F!563h;`~+C5*+oEVd0{B3Dos%t5lz;uRw0yL zLEK#=XTMc%{sjbky_iNhX~*37KsSzHyK$EULf7~V7@fD?3N(Swk)8sj=!hTEF>$rS zB(Xudj&y_j&r_Te1|s&%TSZb4xf*vh>M{+=AK8tvA$1`U3GH{m2>h@{XiK;nS_J1j zh51AWS(}8k0sDlNCK-`rtj>U=-0kt@#cNPt3;X0SiOg@rB-lFUUy4DOMrK5JC!xby zlec}sMK}lhNGpGROEl2J031dwbw-!atPeJppI#2N#Bp$7`>h3g9&!2*+;mc>zrrnojjCg|p~##r>cJi+M!oME;lCi{r#H3EF>EFMuJeb(pxAI`e{W zGIe9M?O5&TVW}FY2;zhZCt8*~MYh;#J}-e*^MC~-SLW56^4wvIDw(k|b!H}EC3SQD z@vS;jWq|i-)hkJ;=;;6nIHE=$u{lzMfUs#ACVW9NNJ055Mi)bvfS3e*5}&tLc|Pg_ zY4enSB^_-f;;sp7xuC2@w9F-J;?-dDwzrjqEd-B)b)uR%8UYnEo-YJG`@JFHW@Ikx zyR|N-Op`+H1j8_i!N$P(H#AVNlA=(kW8#Jy*jaHE#y|K$oT?u3@h#1b{L+ft*D4&l z9yl^|af|?u5@RVgACZw4A272jWvjIcW(S{Vw`=@YBf*e%Md6STu8E#nROFJ;$a#Vp ziM6&H3|T-tw~X@#KZ-jt6DOe(W02=z^_+BmP1MwN#Kd8uf(u2}hog zv5`5r33LgjR@SiK>-635nR@427*s)F^5KcU+5M?E=jzD^St&}yj+WjR?ftvAcXt`) z>6?5T56|lIJ7;fo?YsHu8}RN!LxxNXhGpU?cCSxECQKiag^vom;i5;EW3N@KBubJ` zgGf0*p)MQ!)jlGx5)?i16?ybtmx^$eY%7%^h#wn;fXp zI2dFfHtB$fI`k(eDa#Lf_KHg`1&O&G!T1KH!>KKCs1<|m#LQ=#7Qq$83#_~Ox`U7Z z^Jj>8H;<>IxAWK8q3usA_y@vX7X6iWA_5jm(v4o}Thx`Ixoy-Vt4Sh655p!~E`eg9 z2OCJherym(g=z*B`8bXr4T)*aOAl{-b8+oHKi-c9k^z=5@1DBgKH&MZLKnsr%$OIHYG#&s5akbdS)WeDB zN1oJEq)-4327pmL`coQa3rTIM-A;Ikuu6zIhKA4GsfhWF)hgK!_NKC?gXZj&_!J`3 zFvp6C(Web+(b9v+)70%B%0yh%gGrhTuyL9T+%U1sQkdc7F^`jJWGE`ltqmT~7}b5h33~_R3k!E>xbAQ zp40VDYgjYoIXmZu4H+>ILEUameI0L#{;Vgz=xgbj_2(GmiXuyV!gULjlbt-@M`Y_+ zwjW(aR&+sJI^mVKhrZXrYQ1yH(CPtRQj7ck`h5IeN;4`KhBsTU$?upZtCW&W>|x1q zb`sX)%<%D+*ePgR>5VDs!F461izAw~Nh5pR@;xC-g9wFt`V1}4hch~VV*)0++ZwY4 z2Ki~kh0TO>{QS)yzcz`JA)x3G)N(@3hfb$d5s zxo!E^H}=4HuN+P8HouvU|oOnPiJ z5--mU4_jqJrU@{4*~sHeMa{W~u?MyIpVm^?dlm_zLA1H8)mY-*YQgSPX7V|+ zq71aIMl1}E!*rx#2fQ&ok$&uCv3|%#5D9&T%q|NU@ymaIqueGZ6(Z%r8yQvA>5z(x zD`S;~f2@&#nn0SQAXpDLWX?OT+heO`BR=@^CHbt*P4s&J2Y52f%zVwdGIm1y4I2gl zgQdo4#D3z4IJGKYskUp#AWa|P_+aYrp~^DFfkq;$;vgg)cVyVv#v5tWCd{;7pIhf_{zquwWKvP%F93DFrD>%nl}u+P zFzBrTS!@}cipIEdGxz=TYG;R=+CUwfgTv}Th{6+0R`nz}E&ek!Dtz?k7>NIb)_*=L zVY(`Eg)ir$Z2o(ca@vLv$&G``4d*iFp$Ln)40sM2jci#5jTesZZ z%WPZ2FmJl?)xMye8v@P)+TFuv)F2cGJW*Y%LyM62OiMoHvfNZun`{43vxXM$8C-8s zXh{&ogEiJqpZPdq+oUelQoV|uq{NDhX%$<=gIa7t*7msOo0S_D4<7*0ACRRZ#OXFs zi!)>Zb$E-|T6AhOH5~c<{ZPS_QJ)E})lzHl>tY|9EKBiJ zbS8rq=)uv}{qWT3>o$Ko6{s=uyT89AB;xpcJ;1j4_*;?3ctm)x>U6|I47?7~e1rNA z$nV#%aU|CTViHr|i@Q*qCrEX(@VH?FHmiVG$7HC{q>*EBBc>k&G@`AbF)*Z`i8Jd| za&{CkEzPm0`{nlItvNxJz9wc`H(UG5(NPyF%c`)AEaB)Pa=Cgy#rIpC-p2`<@gEP6!s z{pXhQXj8wAFC$|A`bh08KbWkXDu=k-?#53qC7=5_Ar56JC5Rp#c^sYT=ouz)3&7>R`0K; zsaleIa$E0s%w?l{+7-N$KHZ#8=pXUi)ukMyW-+Cpd7IpN*=u;7qQZ4Vp)Hs!Kc|<6 z1Y*=lCifa&5dLm^#PKPkF`s=!|1p|RN1#z~EoYEe>rN1kr@J~t#R{K054$QZ7T{Pf zw!kX<7yfG=J6z6AbgGV^wUVxOIv)-`duO+{>~b%We%6!8&1+8_ggXbU^LY&dE051F z0e1)YHB?`Hyei=C_JXbOg~Y5A*UOA&h^GAr$9<)FL>HF*r=TkWo)&n7BP;(u3Fmv; zW3Jcmkv{XKv|$OfP)xaTf?r0z&OuZ}a^VsfT}eUvb^Dve!5Coz+X;L!~Tg~e_cSUgbKU=SE) zf0F(>vjgzh=!OS*4M&RMmM^-$U+Ux{Bd`aI^&3%SU^eVGS5VF?WmnqKV}(OX6d17( z8Og4ncs(kMKP|fzxj9zpRYRnGy>G7m z7Y=m3uF(BD-mlU9`|(o3w_4>J;zb~(m6x%BS1#?u@5?8<^3>X-v0ifCQ2pgPwikJr zrQChfxbmHi!=v8#&ClufHmUOcPKnooHnnB^FF8b)0%j)fsy^_Vk$TNevK@-wU%VO> z;5@F%oP5kQC}m$bXSgz7n8{mdqNE4$aZm61vanhZKr%AlU$` z==$hwvcle|>H)^9cpA#JVDzZ8lv*>yF?kHjoZ)FK=@M0vGHMNKj>&{}1>SjI7vbAe zDD<=@Gz>XWBtO)SGN&UG8v!tF2U{96L_Zl)rtlPM`J4rI5d_hF>x9|ib$-mzLlpmB z{A)VS$z`WU-b>mCz1?(Q>D4-W&{m-EnS%;;@A5kbJmqwqgs}c_HW#%Jue`|!qR+#5CjrP-LC&-afuGtwvjv*dU4*V{256*S?fwqL1^aLRdXk0e&H13uc< zw%+TqoD{$j797mhzU{~?ze5zZP=hS zIf)D|;C#4Xm=|MP@LML`ynx*qe1x|=_VNJ{Edu6uiYdVtf$mwBtL*;Eg z-kc}=RcR7(%%<~`U+RqIol=5aDVgg6Hd6X6zT+PwhMyS@_zxmg3&NNh-P|WQhKuAl z7CjScd`#A4GQHi5DKEoSXeY~f772`c;XRDKIjPdvUlSYGsm<2?r(TE+BM}c>yQdlPs?V#zo*nU1d|FLq z->zQ?onw9`uzt&Re|pS*Kaa9Q=-Qrsm$;QLV)ZhP#=gxnVVx6F{v|CgD7?c~u+;Rg zgOzmu-ZH0F1=NB4<4kYS!i8?J&J`GPynd^zs8s(M{F&mcclgoW+dIBM!_WfZE>ym( zH!gFlw+^KsdnGE6^JO&2XUg%&;|B(d6{ zMKT`bB1r5rI^<01w#!~Au0}cSe=2cSeA|D1e_VpFEq(y ze;tZx{{9Hn5{9r4+-?^$c$x~6TBP=J-cL90&-K;uef;d4PZ#&6`@^5D%r>Par{-j~ z*!ae0ZX}!!q^iVuHzfvNb;^veyv&;|UFiP-t3Xu0)HDvt*eCMwCicZLi88n59 zt)5ELTQzfPY~C=r`q;A7)2eS@Gocj?8>Uhpg0^}p_3dk>vZ7(bRDOE>!`bD_v+J{~ z-%g&tzS3`>zIt(d{&MAP{^Un%)I?HNN5VKrSOxr9Gim(3W{#d}zWg%gGnO(bFLE(j zsM9}HD*KVCMIw;_ZP>S&K^A@#xjM3WKZg2Kr2!OZrtv9@>HG?lQ5})5D@`(%a}l{8 z4-dRw8*eK+yj;9a+`V%Fll$(;cTW~(js32ebK{m+9de(qNsSf#w__iHpZkaRAg z*$PF(vYL0P+fYDN1s`ZZV8kh ze^(R3{+OpU=Ko~*!tkp$zjMc!^zZ&UeMqh1gFxW{K=7~{*85Z#D|Vwq8boZiJdUFB zW>fQ)!S~X<)rmS~VpH^~>kW%J++&BU=sxt-aZ13SQRL6=YB;n+Rr7a6W;q-4cPv7y&;QyB$g4D-6OqE3 zdP*c?IhNb#1*ccPT`7@cg6z>WSuQji z(F=IQ=sq^j#Xow%Ook$2`+o!v`cCKn^6dEZ#aWOI zo9*?UiJT<*8j6^rJeCB)?aj;jLef1B$S*mg7_$l^L?V>s2HOZW{q6oXraA?YNSN&UHQI8&xH!SDlxg8L5 zVfXZpwk+O+DUyl0u6wqR*C}5{tZM;P?%?}H~Ru*x{{(UplyaRA$+pgSgAoJ5EB;Np*CSZ+Md-TAY76FLJ`weGPw~ z%j@b;)OnqL>gs!+(0#7F-BGCXnlZukJx=02*SX|M)OlGADb_ciNZZnS!?m8?aiPS7 zr7Wk4MNqiM+=x~&MGC2h`b87?p}z9T>~MkO^Z1=qAeai-lAoxiqHFQ#J;k zT%=3t;Ui-&52_Y#>q8WV;4Cj@H!E3k)&oaLsBV#a}CASCLB2MvgWU5 zKY#F?8UGk|^!lW!KPSj0PcfBx0@2f7;gIQdm55pYZFxlO>Nv48H)wo;~gLE%~G zTA7HGK(XEIkjB}R9^x4arz~+1C;EaozBqsL4{$GEl;sv^fbn$9 z%*g}}Q1{8wC=(n@^OG>vQnKQlL-$Db)|$v@Bl^ zMp_;iD!h*MmYOpI0)zGNx2S^J7$ro!h$93}l;n}6+EA$#Q3?uy-@;iPVIL}3dVTdO z^aFSSl%e)#QehREIwGq#a|L*g%b^iOEDg=(czIC02@)k%3_N0}S!bYpc2KTuy#k5s z6Xq<^h)d%Y%dD*7q-^c4fs!lm*&}L7m6s~7Y`qGCg3vHzQhKOjk_OM0x0bYSFR}OC zir*GVn_pJktVh)nhiY~$kSIfuhAdNZU(8rOL2VBt5E-1`*)V7cj<^pZ6Z;7pSdu$rB}FONiB{pPVo)R zJ^l#fyPEkC(}3_r1{WU+HCJIOb*Hb5hBi^q%7lILSvSvsyeK5FVU(Qwc7A&H^7{PQ z`PpSXN$7A|F(|Xk)OOxjSb3-UPrGl9F%EhU(!nywipwI@F0Lk~P`#VYxF}>iH*8h3 z0&|SbZZ$60N6QH`om=1X`tAa9J|?u>_z?Jmm3>0;aVg@NElOUJWHT?GW`(khyvtsj zhEtkOShQ+m2sssn9{*2&0>I@AQ?cv&8#FTdC!66NO0-Kj)J%pnYXhynD{`JH`tFGE zfCZ%gC-0{|&Njm=@cPA-oto9fT(O+Sr0@32?MAV8Tni&2C#k66QXN>)x(HWFzaOl+(7PRs`cwk=R1Sx68L*k}>o9Le zVxLx)Y61-01AJ`cLXO1(Sdys~JX{wpj+m&87c~2c%~xbXs9zjpz0geQ4V#0+uc;w+ zwR$7E%}GBuY~I{}EbD#rOq4KbN17%!j17Mnc4l)?fPgtY#d`XV@~o7TExwrVJ(asUlx_ zFyUQ`hna|uN{7=*Mw3A!P?nRg49HveC9>+j?CkvIr?db5>(0)vZ~b3AF}u>FaX?TE zry^qd7!B~_a^(KN7!87{km~%xeau93e$g_3*HW&$49FV9YL$+4`Kj!c)wr51GAdU6 z=QEppM$`G*oGZne&=DWad$2swx8=ZQo5w3}cG$l+a#-fYS!b!R7PC&oOGl_J&m`f< zuNL*n=lJ5>YNqdLS>4XFTl!s3wN>9fyTj>rDqve=!m`3gM5OV&jIC^h5R__=z$H7? z?k;{Agjq2#4T6LvBA>gDESs`KvwcIUL{29yG{km|UAj-$X=U)`p7)whUd~8ZgXqh(IRGaZ8oQ9iFJJ~|A}$gp2kvHUMR;KH)0t))<-Og@5ub4>YShiu zhoUgC6iSO(=v(Y0ee(l)F-ro0rYMI!(VaZPpd8&pYA0mj4pwd*!5k+vUhv%1;Zh96eOV{rS zQM-|5JN#WKGe*VVT^7QA?A4ZuXh)Lz>~+=Wp~WN1Y8XR;yMxEMNCEO!`akMFnp;NLt1hS5jI5<<7DANR9Nx!b15Uqe&Jsvh&l~ zfB)B?-d~-aT%KM3_U8Ec>$8tLx^wfx$*Y&o&VPJyd|`iU)(x+maimBzI}2#k}5 z&|%1)d{B~86CTjC;Zx1_l+H6WC5*~BaS>aVl^GYR$Wfn(W`%}MAY@y6R|mGxWq(es3+TY(;BzmW4nEtnx;?8k&-SdgETEB}!sl*Wl|P#n2z53| z)L96~C$>oBOkvzzi^A)~@@8JfFG5EG3>Bse1mZHI)J)XIl*cT3&J(_ZnpNiUtZZG0 z&r9e#o)ig5i)6%dy{p)7rF=o%<3%c<({Vj5NqDOJKO%<>I?B~f5+=C3`#P^GFSIPx z^}b?_4hElSwMxauW5sgZtPZQazJBh#P`lcw$f;95^3{@;=I^UJ-(kJxGIfJ&qKUVQ zc00Gmy4^c>UAn`BPrLdC;7t0^w+-Fz<}4928WXBpd-J=c5)Y7+<06jdBrD?B=2L1`1zKC|UO@hylJhZya2Rii z0YL)pJkiVog4O|Qdr6hHw)f9yd(YX7uXfF^Qm0GP)_grOS1jH!=BHg2Oo9O!i307rjg@UD6nZ*YKHIfOQgJF*Cp$e4#^0uKCkV3Ovf6HxX-HW>^lrn%x{ z8mc<14n>m1kh_=W5MK7?YTt(#H}J`r7LkdE6%%<+&W#JizfBvc_xqtnZPxdi>d?g_`OX z=wr5L_2OjCYFWnn4S^bLUP(4;2*)CJTX)3` z2mh2B5bMX%Mt`ik%YxI>LMk_*FGUbPFhx)89=Z6FRgPaRzL_mSX;qbP8B(>#L~L@G zEGN6F9d#)I9pP!D$%}!S?#52XFX%U4b?rJA`-q4#!8fEXToHBOvXIp@s-64#Ka1Q~ zJ@ZvamJcTdkJvs30<6!lL@ukID{7o`ldD_pk!Uy&D~V+-nXFSv&_ooevMP!4D6G!< zp^2zI8Aw}eu)b9f(EuJ3deyR^H`uD={P8vNYR2-MN35Eu(&BH;TFh`-z6q&5@KY_- zYUz|3ffY3n0y~aaYI1o%1fLncpE-I5*(y1!lM9u+ZeUWD!TpTKOwOfZiO-Ex5NIw6a!XfSG9E|(!2)v4 zvm;{aVZi$sPh1_QtgO@$gEE@K`>;=X^%RmUVpjnxn(K`Oxy7tJELE5U*X7>v zz>cZJMUv$r;f+ath|xfsW6@;k?PNvEG%s0im@1ztR$ikW4_~v3sl&-;^&_!3c|Im0 z;Y!(LKvov#(jl(KG&6#}f}2sN#JguMSeWcbY_=~WdN_dTNfWQ7{IxXpN+szZqFl&h zn#c2jzwQzqW0AYT$Wm_6>eD~ylUiWUx_S@ z{c=hAV;W2S{wKT2(8%v}(dd1`-Z z?si6bOh-KCYOe41y`W-sl>ml26NI(d5I;pBT=ryF_pyJg3DjQTI1n;rE!;cWkOXFj zFIgA8R>0~7?xY>%%Yt0hJ#s;r1&+l~YJ*&;Ti_h}4r(4%vd+>uP+l|C!C3uW) z>BHT8|2{Zmy{Ol^LiNN_bA`$}dp+*xRR>aI^2*_jtoQP#4%sAHC;$+WwH5>vm^7S} zj$^l<$P(JCo7m}ZdMZPfO~>8hhfY{FeRfqjkMJFNcICLw@~r7iZiYHInLx^&n2%Y5 zFI<;Xn23}skvDqUuS$ya!n})$(@?}Q3$2SDEYNn|h@CZ}jPaf?i%X%{vX4M7>r6kI zirb+Q!$PtlZ_LQl5|Bl@JAOBNE#s55D#kDs!m`1T7nqyqlbqRZ_Yh2Itt69+0J~&k!aWZ;%imP}K^j44 zz)}lA%whd$K-M*KYMX_u_F3x+XbH#B$7RDiAa^NpXe6NC946Wvbk(QQDBPQ0FWm8~mFMoitZmRbu32L}hh`W$@w?Y9K7&O|Ka$zmr2 zTYY_a7?A%ye(}7`+M#I&83{EtGtw_tI+g?Sf3IG>w3sLDuZ#?fzJkKu2yZtGYd=6RVXE4^jg(Es0A4iS`XTW#mwIY9Y%Z5)+=6pPo8fu{yq1V5 zMY_~8mOO6eagh9)vT}Nz`aHP)U7>W{Ras=PHIJOzl#1_`WU4URgjMQ`6l$h%P_862 zziEMh&GiyMl@{qrCgm)qiqDv&~5eo#oN|IdRA#xhhEJI_qeFCn51OU!qwX5D~HbmT(J0TaLsn; zwe2Ftr|Wf$&pNeg+ALN0ES+{oJF`mRD=g}p05jeN0gz|}B4#|YQWscm%Ywv}YV9qck|N}wn(_7z->2g6GQ_ z0T05Yp)^Ay1Bc!zX}PMkNb1g=N7qb``>bI;A{HGkI_bK}az#O3#jR1HtSjBYQdmBvh15$&_5jQ6rdTGx zr;R)BVn-b^`Qi+A184Ew8tk?PyMIH2op-4LE#s0HQ20i?R{bwN3%0%yvn;pau&o)- z+VDi%f=HPP5_;a*34)y+Yx^@Nw@~BZcZ8*(h!D-XOm)n2setV%l}i4K6FcA1AlStU z2=i-4fi+0B%?9&qL#Cxv&PADw$oTVzBKOj%!;L;YsTs{j?B+iBfYEF0O0;M%k zHC;eLJQE?j%hDN{(R@W}%*AI-HYnmVE=8kRs(ffVf7JmM3Gfl?kg)1IohQFil?lb2 z3Y8Vgmh)=K3tW9n#=;Ww7kJXc)fEc-C!U&jn98P(FcbxgoctR{Cv!yAxGnw2mXc);iQk;MJJu^}gnrcMD19s?p`J8f10(-F?8 zq7X&Xq;WFcH4XQ)pz{JQ=Cy-V?sKz9=TLC|Pu5Ub44>9pt@~Zp`374^&?!L3bD5)K z5z^RUOofqX#T9oDt+xjh-sJye$ee-BFqY^qz(YEU8H$3itBpNdEV=fwT^CZ%P^9L4 zi`{M#w<~g9m(K{%)l^nn5T5lfS9T9QZAoi7A1m9*0yup$JHx+>+>oz>i2X5l+*)Bwr3G+pzea$SB$}r*;i1b%oC~bB)L22)%mYyF z!X=PJTg*vJc|vw2W5gjg{&LmK%%UbRXT*ePTgR%hlyGX2IF)3%&FpLf{|zOso$8)L zvD%+kqef0dTBcTKX(T)+i{p!P=}X*reoV66Mi9gzotS(|hKk$Mie>(Js%7P}wp{Hpyq_IZ3i#I22S<>B6_I;+{CIAwf8m0jb(RwG9pwWya zBNhR5H8Tcv$8Cy5Z}o?ZHz%g{rTGL++xRehB`7gLM{^et0SFIE@Ewu6_WSlPdg1!b zzYhQ6WrhFiTYdZFx%Oy!AA`MHn2sT{?vB83hLh zLBc6bCoKj^S44+KfImMuX~4orLmbP{as{9twRvPYo73M@VpWTS(x9Wk#N&q2vfb?k z2~#wpimv6!{DQjjM#k?00Ot9Fl=X#L)sC9;7a2E^=_M`J`wVb^{5(oyl(A=`gK}%f zexW8kJ-bmz5SgoHR1(uRXNArhQq94w1<~s=f<3IdDcACo?OqkSLzXI@GcQ2j0=h^M zv8y0&R}kwxoiHU!H$=R%H1RVWic!(Ph1PMKjK-o~1i(#{0(S{?C2fme$5e*(eqV^F zn_X?89##2r8LWT-FA{WI*n21Se*(Suc>$1OPU&oOeR0X54qason9>l28y9)wPDy)rRb)D>vp)0#qm=DZW z*lb4C=6f3q2z*z)3~It?x|#DVU$6P>9F*iXl2D^^F5;Nw04^iscSC?mA`VFLFHP}Y ztLSlpNXl+I^=UaXs`soE;}s~ltlwT`%ud~!x~Vqw=s2AtC{G=tS;Y>SG-X=yA1%(L zbQGhXpx@E=&$g8=+0!MCVe>*a!^@Ujj0 zoWKWrr*$?-+GoTx>X!*_VB7pLs_tH$`>o;*lrXizr?THz{T27x8VQ{x9CmMwMcQ3{s8x1} z+_O(jCF^Ps^B20x?j8b=gMp`A=CQIWbNysHIn(-Adnezp`T}syQ3fwyU`&l_O0=iT ztIWOR!9Xt7(;E;z)>oEDhbCy+83+uo*X>B6|0v3{nmV8g)t|FJ$niyU^sjx8xbCJR zMRJAx?V%&@dirSp!EOTb^OU9jb>>?W2JU+1P_wpE$8aBlm@SJiWXvh0{4%2@S?-8N z`bnq?r%VzlY{~gJE|oh54FqsJ#$>TBvs8(NHu|+JrbYoWF47R4-MH%Fjp+PMeXaw# z26$d1dk6ESW9Bw z>bQ$@fQ(0g1{#5HndW`voym|4YSvHqB*o}tF0G~qBLX`0yc^{r%ZwH`*;`&e*wOPD zli*@uVih_g^@OD?hhq3zx`Nz(aEmNX797?|$6VfS?#FR9rF-PH#Q8g#{8J8|_#PhH6o&8+j>q;3FP4D@b zT(VHiSdN7I>|I7v&3ZngJT6)s1?^+Wcd3tpA}g|D5-HW6o%(dhXSO>r05JJIbf3oG zB+J>1i=rDGjEiKUkQz#5SidQs*n(iCH&o6-kw+cz*icoes48SN$Tm6AJpCL<1-D$XHcvnQ zp()`>hS`PTY!8j^zttF(bfR;ge+YWAR&xyR>lSZX6j8S9Tf{oFgh2H!(?_*xwoRx3bt}Mkf1O@aQ^(GBi=K_Nvdi zD2Gp{Dh>Wq0ko;v0iN#wamd7OLYmg<*26dmGJ_-9eeq-yr2#&6C++|Sx0#iYpc^)C z38h?qFtdb6<&gD zBCqV=y-n2_V7Tn)KvsRg*%$0~&J7f*&``xDJR}LrCy+%YoUVs-Yu*lKm78JedJc5< zSw~xkPkV`mYHN!I-Bsi3%6#ju99WR&;Hvy-1jP;ZbeU(u2_w6d&`i^j_xf6gBk^$! zv5@C7Ajd@VbP_Ya5342fhU?s|o{<(ielPfp#tb78XzHqxi18BV*Zursy)k`lJEw#G z4V(7|OO&R6p0*^x_aAHWtxy%mJ%O#X55ILx)JKf3^&<1R9#i?CQVOaqPhu)%*K|Ou z^Oj$Ey_LcI4dKL`sp)TqD}pWSD@@e z@C|6r#n>+v(NTubvOTxq(y35{r(s+~SoQ+C2Mt0O?A-vQ8zJEv_o`*=jnrEy$IuxI z7u^xSwZ&P|!)`GaYpuTHneB2t4`Fv28gv+|waIv8086z}$w^hXc*aLLBPUaurY!c7 zAsHQ&tv$bT@*rE7it{_wlJk~!r!J*c8H0A0S~h>2g7U#Sl6til-ubj8)xOAE`?|Jn8i`oOQhj(+5Br)= zCxGD2&^9TnKYxKDk0zeIQ#sW{EYal3Ce`L+LeplV^DxDy{za~0xpt{MZ{d|vd7rRQ z9#X^(2f-GzTUoTu&cKgyY37O7C|>6msB5`Xbvs#8Ity3oR@0a+Z(GUk%cx}c(DlT| zkaVV7a@%Lvc0p=4UmA|ZF&|nQU%B*pDczhe@1lZgDrNu^Ti!r?@)@@t&Ll6=h7@w0 z_#CRJWU5W&wCs9q*&BQxtKdOImQ9#KhJS5$Q8uf$y=eBxLc-?EWzOFN`;YX#gj97X zYTSaFX4KcO&;LL6-nF@r+sYr_*ZCAE#Z{6LlB3Cbo$UN~<42Y>j@EP0jx^&++1?oJ z21P{8M!SKQhFR}-e+uUSXf!VkfTT3CBfLmFRQG9I56=B}8a;OX@WR;5f@+@b!&ty)Y51@Oth>h~c(o2;} zviE#%L@xP^7ql)gL)fKByZO-fmHk-Ax3qV(M-D^{J<4cF3T88n4J(A*VCy9Hwi|POXj6d3$GS zQ6FAb#XrS__3PYW^#J$X#$pjy?^w0=CRq@M@ZklECRh3gAvvI4P(>)RiL5DTpEm>T znIm#~cJc1)B=3f#qX=v~LBh!XoWC96k5Jn8Lb{yWQDmBSPNV>;GAifTu3{ z^Cx09!&0VGmuTPSw!2fmUBALyv7NY$IU|;Wovb}>3%t=jzMvqwpAG0q>GX(xUW33v zkpMxa&a$+n1kH8y%#GpMyR+ld*Jq-n~m@ms7oIHW^8%iHT1{rHsKnX!13dP3TfIXN33Ak!4RPd4x!3w4XL z5fXpL3=fyBR^66r_KLSAxL-E_Aln?E+edJ zHgttb0YX*OtrW1{x7hMaXB@MpG<>_5FUEYevea6#)@+G&c#2|j?k_rR~FVBjjc*6`Q*Uv1*zTEcKX-n_j6C>L;|Z>^~4j`U*i z4TnRp?;QMH%e;AUNWNv}`vTx;Y5*>t3Wt{gV+*e+994`WF>gQ96tu93S7e6{XHeX< z^^k5QA8){+t-;%gfZmRD**8HnLkQEC^I5^mo3`HVMCcuYsc5{svHQ1Xw7?r6l|gN? z1GeV=D#_4$HLoxh#IXqzCgZc`y*(IRK%4)>Bacwcx8S*4W|GG--1Ezm%kvJmEeZbC zaZOmhxpvf>xhBl6U4Q1*xF*(JrZDi`$gA0uR>zH+o^lCgbK(V*yD0+080P@tb~=#` zIr+=+1)+_e2W6`AZ+XYJy}iVQm@WHisN73WpPW0tNaqfmtY3>mhnHM&szeaRylb6k zq!Kf8M9wVWwg+q%! zzvw_mEdnF<(zIrn7T|7cyA=N^o+O>Rl~spZk1!=w0XuEx`;|*k=4Jg;BiU1;QU_;2aTVA9fhUwdgDsCi||1Yez8 z5X7_m(-%h|1O4kCzBuY#-iOT|NVdT|s9$Yskt03w6a*iPIRy@APBiW{y?~C_$BRc# zQIn4(YSLx}A#Y|2QhRagpf9Bw5HgAdo-b?AhlV8M*I8oJTO zR#2nR%8F)jr6aej2-5z9zd$*Mt(YfJNDKWtv9ByP3ovvMjeAY3JEmZ%41e=mGw z>$xWP#<#ys%#(}J^>?G!gjt2#T^lomsZgTaAoby5#fx1IfKQw_NXYf_MT>?H(W%bS zpoLp|6^hcj9J&sNEso}|I}Lb;#XI7{Tk?ctq4QHCBHDx?X|@Y#_lvhLddD5eL)gug zoS&a=e8fbp?nIqZ9^j($%0i@s`P*W~-FkK6ah;+|aPcl6VJ!M)?AhvF_*KU)>S*;+ zU2*L2XoZhd|DCzp3&)Wq_w^#h)?F4RyyW96+`c z=3%?PF$1Xu!p=wWj&sFk5^Kd5gP z>^W|~P*J?jP@oLnm@C<$ZZqX;!J3~%xwtfc(7eF(!n?9dA~Hn_izZ{>^p1{>j)E1i zkN)__KO$0Q&N4n*CIa*KZ_l5P$X}0NzXDA6Do~&wir`?6VDf#!azOs;^6i@zr>*VZGLe8xHgI)0YbHY;8-wAFop95kJO6M_um~8b&LObH z?rrEVGK0YMML3tb0*9lD^KNQfIL_Npt~HuBUuaxquG?)u=x<#QAK%dL1n`R zPW41|V6R#rI4z*#d_~fg48N6!iP#D!eQy&NV=tGAh7@g2JqhgY!FAzC+Vn* z7<4IhcW>BS_Km{PjwG#_tVFieluO@$N@$E2={U9u@c9I*^Do4m0E)E%o-`Cmpw>-y z3fy9Mva=*pO@-Y>aMGqMn2as|%wc_Iw7y}s^b##blzf+Kami^iDu|H;L*lWaH(Y#>vV_M7wfz zpX?lqs6`Tl>7^lVgoYP#T`#sJer4|=bBRpc^ro$k0LTO77~qJ!Hn$b(pmZ!n(Wo@4 zCJS)IwFjNGU<&cKm~ED1dtn+pRJfy3>21KcQ;|kea7KFltBWleUnC7(Bp&1WafgFp zOAQK(BpVYthAnZYS=n=g6}U8ob8K=&M^=W|uV^4f5dE##Yp@a%MjNu7cAt*g$=2d` zd~v=L4cns!I(Ee9S`qQF=-6OY?Vt~yw!?}jrrWmY+hcR3VySB{wLsANT%x)6Lfurf zwYDOLS8Fu|9j_8Oa)oS=M#bAPsw$$!yAIbOWSCLSE{Xu|*T^ zYOWN+s%)&DNg^f#2bG&lS_!gu`#b^F$-K5HHrvDwWvi*Z=m@NO+k*e3h(}6mn++mz zmL<)~Z*lD&Xj;<2=d`HjrZQPxO~RD>B^Vk8PRMvNG&~s^o(v6ZhxqV@22a$mH<+1_ zBqMm+lTO)4SR)KmF}`xNIVMrHrV3-HKnNJm&b~hy?e9larC4m%_}Qq*@K1!5naFXo z>wec#fe^fjz|}R}%xu9r&!mBUPT5i$U0pWx;^o!?X)A`hnhj=&U6GhHi2>x%HZ-K* zGj2++Xcoz&lH>q?9A#CLcBsvJGd2_TeBcObLY*&|C;HKc7MqrLv!}`^)_`AGc}s3--5XZDs%<51M z^LJ%4yTO0`eDEDR`yrCZ;o+B`C3f`Vur+cHd8vk?9^#U|AgXTCE>An%+nww7I&X{X zSl#P^4&r9&QV^zKUH_7_rF855W3kvL5XU&no!CzeJdg=bdTfT#2Ms#3 zJW4UcJw+a2yRXQjO9OZH6n4}*rl+u@RqZM4h&+WIb$k3|4Scc&{xYnAPhm$-VMkA4 zM^9l#*n(k4MkT_Sql69ls6vhmc;|7JiKbLn;)X@U6-24dOLQX!dcT@BZE~))*$vkJ z*t}}hOnonvIm;c*cu$FbUFrE4kz-P`j8|N9ZKyH=zvBk6*kRF1mSn}m;476L-lwM< zn#;m=Ig+wrJJ2;$VTA?wv4E&G`@4}uV&?$If93VYx3c0C$3d1Zb(B`zlpMMb9>P9W zyoSww$ud#qn^#GLWT63!ZZ|cM&}Xm6zfPG*cc)_*k}UPH0ut zf@V`Dz0sq6z?3wIq-ql>5e*x}YM`v;tzu4Up=^ws>3pm)pff~NJF#Q<5fp1wJ%@0) zSXIvJ4$cFg`2UbZ6uGS=_@|>-6`a+XIqmw=fEsg3kU~qG`XcFmB6j1q9r?rOWGb3k zj{Kqn&*3+;nZ&!FwVD(Ktxxr$&tDDz0?Pf8(>= znl1Ln)%76PcD@7h)s}-?^L&gHa;^38=+tx2-mMmCP3Bp~B%J5d7NE8iNIAF+yDnf*X){0m4xAkFLXDV$U5eYT$7q?raFW0e4*3c_{Jrj_oU&-LNtTJYSrgd|uL-DKGBOOy zaVAx)&tYpJq2ROaOf@p0lIMG=C4+uGBGE@)^V^IWQL1-nx&zw|;2PG8#rG;i4{Th=A#9Q1b0aaixm(-+gu3=eJXFH&kNSNH*lXp-)j`xnXmN>xv%DH~2zF)lveSA@IAF9Nv9(s;{TG zvaVc`XG~?!GFDBWneIHA>6wX=D^VxF?;ev(6oo1LBqrp9RZ~aiA;$HvASjg(@n8_% zQPA(1li+QHdYsOLKE<}!aUuI%W4}Du>DfJo%>Jc)1(aaVJJyAaF{FEE%4bF7e1al> z&T=AdSzYs-N#gj8uX*!gXE?7F+})x5 z1xue7pYE%58z9nh$NhbFIfH#yQfPm8Y*gJbWk}95A=@8*L6-zfq%81NTJfVn(QyHK zN*`^Co)wOXG(G^$lS_`DM8a0xch+GNOpa2%vXsKZ8pkrD#PeHfBq7ws@4LQ(wYQrl z81sE(DMNYRe-Qf|&9QFYe2-}dfjR0w%Nhn|v3 z5rGdv5Ct#9_)o>CPm9(=pzF-A$E@@4{g@s05qJnDY9d0(*EFhJbUyUl7BidUei;mjl_~n-(g8(Jm-!+_O>RAy<}1s@@S^%t z*e%~ziOR?=a0BJs-b$5dSnV)TGCf_Iw%2VrIi2o3jI;aX&kEbR8qWzAilYtS^m**S zq4N5cXQL2K`A>iFbTShvjbn4fVAzSM3;z(S4yj64ZU`soH;6ylM3Y}H6x{My=^}sc zXxABsn=us}%H{~&2)Y@6Z^hBrKOxnz|N7IW%N&48G)UozGc_NE zU9YoR*s2rf>yNJuWmOuOBCM>S`9499;rO<dVjQ0vAr+xPEwd;4R=0X3DHwDv;0cEOjIt=sL=xnNgr zAC>fRNrmU(6U>Vr8^9!tHj?G^*XFLNOYF5VeLJGzxIHuvN1as=LYr%&jmhhj7iSHi z+Gcp;t^1Fr%4}oG5eLrb89kg-*Le`W$|BP5v$FhfEtj$C(+EXH78uK#245YP&QbbZ zN&|F;!2l!Wq^ zYOF;~@iPaBDlSdSaKQ#$ML9-JbUA%K%Tnxxu%bNF93BlKT4^am%}|E$%C(W<@=P0wv;;jb{} zxk$JKsHb_Tl=Z6+Gl1?t*hYUzW0wtHWbG1{yiNNrd}m-OFqedzd;5tJI9H6ybtH*s zeuywJexfeh5pMEg!%ZJ^^vZ6tm@ZPcDsDS^dmEv#O(bu)#GOkCS8++RlI*X4hPVZ$ ztVr>nKPgQOGv=vPDqyil^fXCcvb{N_6Ym!c30FPtzX?U~7rjs0i&AbS9I5NHGF$*b zy>_6IhWZ%>&P1vIe&0-i_}&&}`u_fy;r?fReFJe{nCE+c{q>c>q9SX9(SdPA*B*+> zspWb6jk>_A;1j8_fS$5j-N&h7HATq83DdK;;($}rx(7&0RRR;loGXNHq^J8Cd|Jvu zZ}*qk;wcekDVnhx`88bFHOTVJ)BX4RrY0pTM`bMiI(LRoKc zpKtYFGK=jn?dDScF~{GjAjiuH2bk1TiOwU_(+0oK`iAqjf1Fx>h;w`=A@pZMH3g~! z%=TrN%wHR~i=3bY%@g~K3b$L0Xl>nbYqFV zEFQ{y4Kvc87?H}SmY_GonOfRzJMebxOE+xK->%VrR1#EP#+Vvx4TBP za~mNR%M;mviEyJV;smC#b5guIBcavhiZI)DmG*vR&+THJwuT1vsZ+M6ARw0xCw&dq zWnrE9@f48c$VctU+Uv7#+N+wS>I#v1ch}9EOl}M6YVilTswc9?C$}yo!zii35u#rf zUTuwY$-&=AUeg*@RUb3MG%NDJTad$wX;u1TdE7v#%SNvB&p}Ht@9+}sj{F@`Es2Oj z9NUoeq%&z@reFw&^-Zw-OFP||#91tIF?vkR5aC^0{>Ly;3|A`@3wqBRjhiQilG16< zc0CPVIuO(>RptH#yW3U0>nTJZS=j>}^mqd}3u5mgC9-L7{J(HY*HGq5ws~1KdZw(X zH54qn7}%!Gemke}8i%}cw@&OsV+6NI=OQbzJp&~#E(Nf53`;Y~s`pGI;fZX#%eXD- z@FTcOvpd&$M0&W_W`Jy6)1OcqA`xUoTm&znXb);0lw9o&jjP34&VQkim&93^7!#R$ zT<2Zl&qwbNVJ+MZPpAKz@2c}AZ7Oc^h5&E=MQuZDyi?g}<(A(XiA?KfPp1hnH z4YQA^v!GHS6ZMEHj^eew)ebM=d-%I^0{J)Sy9!tu|@pc%80=E+@QvNj}?Yb{hUxO~&58LHd5}Jue-#Xl`X^ zkx;)r(FY20UvHkM6cfM~mF|_emYBQ}J3)ud-In78j-uAkId(JJdN!N`7wh$a%;LxE z>qEn&zE<|6B0eo4%-c=iIVfUy&2%mEDcXik&*w4~LQd7H&q6zzEn_A${qWpJV)`tR z>ON+zR%J4LRp^IaZJLEqEE$O}`n$;$F^@Q`RE$!QjoQ(shV7l`3$d$G*wgxx)Ep5} zpy_DzS|R~zm6LI%J+F;Ar;#+~@!C?kZ0nA_&M!0d>^og~yVeaf^j!e6a>(juv_^7( zx9&h-4V7}1F^(YY9C-yX=Px)B0TclNy5$*z#N+A}m?;&yF_qc00zt8V8I^TSx@A(S z-YIud^q(YudNdd=B#?RZD0X0rEcdTx4e;5qfoh?z{^1!hlV{vhIIJzstdYJ6Rs!C3 zd^xvQYoBl4Zua-{oabksm$~l>lim|9=Koxdb$3j*QJ#n?<$!8Hd#uXYAoes){_VM z_j|0}hj90%?17_I63?l;vaAVIb`s#apJfluHj(#770^C$jB31Z+x$KoLKcPsaWNG& zF5y-&w95h?Yb~J<&faq<|BxKs6qS76(l;f!BU$8c0;eE%tsF|lN(mMqE0x~bK;l_B z=nhb9X>(}kjmUYf2w469@ft?h@oK*|DK4Z_QBV%SZoCU1y@1 zINId1nYv@|BXz13r^}YTW?jPGoupi!4XiT>jI1d&3KH`yUm6$l9*BN^zFn`Yz1>RY z?3g#FDvYrf&B;4D_47SsUn2XxxHvbBo47ESmBj^F=oItMYiW$RA zmc_oE?(v-RVdwvTbFF0ZAP{ifW#`hTdH5P_20v}{a*{C(G;E>TH{ddO1zVzbF@tY2 z?42!!Y0~VmLRO)QSFsagTvgtKaNwTo@@$%IYoL&{rCl`Bu{J69JE@|U&Gm-?{R_s3 z@^$8T7@@ni(_xQ2Pb`M;A5UuWR4h*;$>O9dCe;eUNXdqwA1`9CoM^JQf zag8_0DL_Us%hb z5_dtO^)lrRi+}Fc8_DY`$Wv`94^Ac@H~?-tJIm+338|Ka54||$ z4?NrFsCEns_wD3uo7py15bI1Rw!Pms@0cv5qHC~#X%c2j858d^?yT1mrk;nz>KRX2 z_`&8b=96a{{U>K-u1^K`QuE?J)ZG1$Zu&-&2pjRUbwDFYgaIgB>a#FRvrva%6FRq8 z*SndU{ZW@VS&C0spQ9#Ik%?25ljdD8vCcCBZ9j`~CK*JLRc9KEI~TXz__HA_CqIGt z=95{(u-=W1i+XPk1um0ESV6?mMo@;#HD^b$THDlork`8#S$2)cDlo{=tdd|9=w$hME8^O8aBy@P$;Engoadf+X z?klrmT3yM`&P_z+=2EGdU00Ny6p9^ft_6B_&`zF+Oza)>0~>4Ge(b{~f%~69K25hdR*^fn}DCkhye{Mhi|{ z6tVE!dBP0EYf)Vd0IgPfK>YV?+wUV(hCZoHl#I2s=I3i|TFKO}p^KSn$vQBU(0EV% z{C{*(R}nO>%gc}bIuNa>>IZuGQd#Y{VoALAqf)pH~WzH z+rBR`A)xZ-%Jbndbhqsi55i@s=fS64{sST~l%rCVSIZF@it*e`b{@p`V|}2_B?zCt zHOD=qv@U?dD{&DCBqQ|UACH6^w5PW3S5JSl=SHQU`RIKd<=qEPuBpepdWZjOU5}`| zhysl?;`1CHZ1-J8^J?us9#ho<8F}k?aXHbqztN1<|3-xj|XkMW_^|A zfhp<_s3Yw7oG;NK6^P{o?n?J=gH)P>HK=p3ur|JI$(>x!*cJ(Cb33KneeE-T zclIlLHF8Om$>f_rtvNL(xqWf69b; zSHUHH4BMLPQ(M?{+Vf!!)TXU-#xi;E`Phoa=%f0KZAL0tPLE3k@BNpDJa=aJ-!=dK zife^G&AY<8j02GqoMBXt_n*@^3SpV9^Ip@dT@;4q@b*j!#Y0e0>W2am*h|1G6sM^9(6(Vn2E}FGk6!_N5;}r4R{1* za`QU*5vu3Ji#wEOPGqcdK+2*hMnFJ}Fuftj#W&Q@Y+UY=XSU)6xd7VW)FFP&(Ldlz zO*I0c(I(*m*w9HCJ~`Qo!u|PzH)>tPB^R+a*4`4M+Jtc*i^}jId9XG_S89Z_DLy}h zT`obl$(TMl+=#_lfkgP2$$P(Ht%qzZs#Rn0M0CR5a0eAX)WTcuoK7_9(K0C<*rQ<> znlbG=E>7QFj>qu4zOO!ZIokYmI|cu$1D3J`=i@zsib%!MxVpe;EH?{Wp6c||%s*dJ z6rjP}jHU8il~SW}T|`=;#lU={AV0*H1rQVziK0&z__X0DhAIB|z0 zBxU(PF3>2PU-y!Kb7uO2nNeAL1Pdp%Qm-&>?g(CQXI&qtd$%>8aW@}YsP)v{sR#3F zrl+sRoEU!{Z#u9l5WQlrWYJ8q(5VbX?S$)yXvGDlzLij5oiu%s)!)g0{sRV2;^NzR zAhDfCenWC;2P~cVOv0N1P_paHIl^Ytxb&7D4vjEob-qQkwbKJmv(|idX9qW13+cseTRBJ6jg_JlG9Pa;P*7!lVzr0XXZj0c4cHdmP$1V?DRMOMV`&wn$ zvw|ojA-99~DFw~m?cf2WABH)Rd6&ZZRkc15^h1yO;!3QH_RTL9>Ia^U%< z_ndv#G&`6u@Ywz$KWQek#JWEM8Lt@ozu1IPtjdHxoy*E7__vfRI~AEb)+mt&5)$VC zJVl9hY541!hFmTlqk+-WpA^u)soJdQSN`>Z;V-vbg!2t)v}rDtRGaR4KhXG38pHmFu#CP^bgt1!_V=kv0(%qLNsDn$q73!L5aJxwLo zP82c>M?c|#na5>v8c`Mdud~t%?fEdm`xO_OE*swvIYX28)R(JU0_frP;UV(j_Wp#n zN2MkmQ!On!P5Y7zX~m8GZufjAv&8JxqQTe#pIVZ#!Jxf6iJ0L<*v>2IG)_ZiAt7;K zX|hFElp+*pMGc=F1O1FA2o&ZsNyG6Hs(w(;ygjF+L8RByz~EB2p&hWStCdZq!UesE zh*%HkLlEt=!Au*iv6xc?Nj2)!GK>^RoI}pf$z!_IPLlM>*R7`5H)nh7BL3Mh_y5*T zTx^Bi@B+jtaD*BhYp*loNS{-a;2NsUZ(UY#kyw%U|23S&GeZNn1-Lre-e4X+1y2>g z;}j~SjCUJDi)G1#vS9$J_ZDsSuvz}zGL|5=@VF}Ne~oQjNJlP%fI6?iSyT<=XSvwo zdp~1vIQ1fi&6beOS~-BF#bMk-FGu;NNHZ`0Gh1VgNKi2{Tu6dz>?(4OQ`NLCWY3q8 z0N-6;45swK+7GUBWGHexYn36A%h~qR6d>M5Vu=f14wg9C7L25s$Dd=kW7JHnYIRypR$vcuFyOGlBav;!TlO?Mo{5trls??q+H=` zR@~^qv>|UMmDYQ$(<@7G{*^?))J`{KRyGoS8aZk)&~%G9UxzAOa07A`Q|EBa;C(_c zQ0aB>bR}`g5<9CkFlTTDcRycJC8ZivCzW81GTc6&FyX<=0hr=mJWpHqUA0jvlAGu@t62 zD?sC_}rt%78kM~&-=ai18&MvB6^guJ;R3749{mJ%|U_J`Fgk!rT`f#M`-bwAol z&9>Xxp(ds}t82b&{dwEYygGQpt<#9c zsSby($$uKVAP4XtcD#~*G1NeoHa6T_7zj5|AjVWByeR*0t|Q4a}bbmu0PJgnZmj!w5c!)m~RZl1dEzW<*Yz#qLQ| ze>BqAlI-lYH*TJUqj3s_@Btgp_&b@!X-Zsa5}z;Jp#e+bG0zHS&1jkz+SrmD3dn~| z&9&}coNI--b7ow_UgA8vekQ^Sq>uKvMKk<_w#a7t6)+kl#kVeIl)m{K58kkh3YVJ_ zRgP_>Ckw*z)B)EST~z>@`*=CoJ%R9kymr*5ZSM4V^Snf7eIkk-+}upeOmdau2%MS5430qt=5zbVjuB3*|bX8CV<8ECMi0mBQYV4PXBIpsP43mx0lIUw0C%S7|T7SOrBax&IK25Z!98fvNSjISBhs zzM{D@AcAM}lDTyPTyF^?MB~MOb}rNc-BC4{W-woVNw%|Kgv-Lny5J!T5;D>oPGDH> zJtc7VE{DP7o_^rNf{E7dqazz=xr&VN7trz-VJUB37E&V!=f|~|J*&BgyM4cAJjSqq5GiEAcv)1!vgP`8({H-CSZ--b; zuAM4EgLzT8yCa&~tnXLJyHc@0uF=CyO{3#pe0+KZcuT*O>sz+z@@7<0d7>!Y2Wuf2G_-EMKG{E_j zHl(J~77_Rs7bQ2&wBEhMwji!3bmcwo{AUNGlN*Ja+Jp-CIw)5qC&|x>VM`tM1#u#v z|FtiUi|o$+Fj`7X+`F<2<>*XA66#}Sy)WeE@pIwEnp1h#EK}CZV7A%$0k#xD>s)K4!1o5hlJ1cqA3% zRz@WVmq(hP$Fp>ZMlhEBKJQR%vrd=Y43RBR9t=z2eK;oIXBZ3L=% z9@KF4AEN=z*IIRIO0r4l1`W?u#}+r8>*-OmjQH~cHfs?GRW100Cz4d;ozCjfb_r>#%KY?wF+x5wB@^@ zyedlHSd^PW)2X61Tv+(%$u}G|FJBY(z;?Ss&^T?n)(c_&6N{F&k0~y)66~vQ)Xp1S zoM>%G37Q5}69$rHF2_rmxlI|u^!;;K)!6>~IWqp}4t63WoO;{lUxaP3JNAm*Lm$R+ z0S)W^2C%~wUJa} zQuxXwJ-ZLq!rm08m2(B%V4&U50WYdL|KS9#w(MZ?1paO_UM4U>Bu@N$-RwH-# zQfx!58{$ubAp>BW*a9uVGX_~IadG9%Ry#~lQyeW)_e&EbC0j(Rc^#FKpfM4Q1E}XG zeT>yNSzy?ZTF&P8Sx>F3q4T;TLS}7NVp3L1P-H~p!>vX!vpLg_nUp_)b3g{_ZPF zSWG$JqNQ%A?k{4}c!;dl7*(aOImHwS znJaN9)~?KeGT4C2#1u6mEy3%C{+uE8=FQt%7c#LNI`LGRR_(cA)h*}qn;2_h+ltqY zli4vbl$v;-Uw{o>jdtaPop$%?A~0E^_HZ3Zjfy$Ox? ze%fVJ?v;YKd=`#5Ssh=RZKETBZ8+ptjiCk{ztMdd{v$W==N52r;Cl&_l@GUv%$_yv zufiE0?PBeLwSr8a$c5sTtMy}W$1`8UV5blcqk%IU7O_Nz?bWGDCn!UDbvEB1zvXTU zhK=#knDa|%Hq|)?8DP&d+jSspVK@a+t3Fm@G$o0O1x4AL`0fx5M)3?Q0 z>IavmXsN3ovYomk%pGk7PIP&-5K6dnWDu!UemOBI_g!`8axMoof+k|X%$I*BU~h*w zBeC}7_xj7*{h5M z)5mMlVx5X@e-qT%-_bQswmb{0>L~`bKHN`#R=AcpRHVt{1%TbA70Rz@D$Nv+fI_?x zY%tIsPrzw5c{6q4R;9yuYw5#5&_$8bUz&>A$FAg;M;`h(w{l@1Qp#_OpfeEu^`Ki3 zqd#S#R+B<=rIiX&Yu#kMWF~1uL~z>QX)P^&i0w@I3qNt4Ki1A%;rj%kt~E}|Ype|H zDL<0ESV!(e)689F(BthiY1D67{4;JJW~R+tfZ?9e`$3!MwET4snZlUk3rzyi=SCL2&RnRk@3RQ@j+Pj|ht_?3zigsV(N zye|FvxQN_T7XMam308K;8RD`wd6C*f zA{HB|RA{+gi%fnfcgHrBbcubv>&IA7=?LmS))A=bo4cBS+mX$_R)qP#mRg4&f+h0MP1*t=R}k2MuIlw zI@#NGv}|)6zU}S91M&+{_0bLZYV@+N)37$M6`PhIGH2Sy`Hiulc2Qi#zv4d4n%kbA zW6TuV-cZkZS?};bioI1wNL#BLaJ?EFOdS1N>4Kw=eX|*>q9*UR3aeDk7~B<~rN+hg zgRKfc{<3j(FSoGWW;H75qEd9Zlq~}eaa^0rM#oSK{dyAo5Mo29)_ zn6|YJz5A{{A|HwTb{FldCNw0X}RE-!1 z`%^i`4+{51GQf1h`1SBQywa~d6zq5e2Jat5smDr7Z>Z}kTyEplD1k`9*y=vB7l!E# z_=84&4_K{8_K=BoDkC1fNH#DmfZ3L7fwygqhSA9I8T&tT@ztSn zE_z5Hhg(85&t;W6OOnh-)jD0s3Jh0@yAHV+DR+gd_E8IREz%28{FTT|Ni((je(KH; z<)JMG*&%)DFmla4f&FLR!mGi(*3Nm%}V&Yk<+g1{SP z1-pOt{6Cn*r}6|LA|hE;<38}3lsQs%wB%&D`ebWk+qrSdMJ2Ar9O%SD4RzqxT_A~J^;NW4DAtw;6z*gF|0U=XpbXMs4AVCK&wh(F;8c(W43uO|l z$n+41rQBsqwXmPFnFH|r@b8(U! zmY{r6lqi~`KC6eaWU?!spY|B9hG^%pp0Yd zCl5@Ng&n3mEPy?cxi--^8{%lXF^eck8!I@CN^Y8C)WdHiB-~Xz{)_d2)RwR239K@s zv#R`o3tTk`qJGbCzn7YqV;x9JbfR+v$UxE#OkQ~NbNB@1`)xq3uV#e8H{KG1u!>k) z!pB||gVKROLX@Rzzp*>R@C{J=1robns^{vp{W3=Vhc?FA?{Ns_^rGU+@$s`X35CK7 zT_^F2l&43RmVp=BY!X`ObAHwRJd_=<1qRb<`x2*}Uwj4;=kC$;$|h*$y-madNSCzeB+~JcxAoc(|gZKR?vn`Fp@)O1XG(hn@In1@zFQ$%)Z08#c>OWz#`|!2dk5=_=_bPSWZXzv$mFJBRZy8a~b^bYUi1 zu2gcUc762EOsX$a(}?q~zoDd!Q!OGBb%KVR%L_ot+^tag66t2$U znEdPyM9}4BusmdTuC-s(y(n_vbuvuY${&U5OCviISa36|fa_Jw)}TnThT+fDV(O#H z>f>1s1q=AQr%1e!p%G!N*=3+)<1`882dAT2tLRYVgBTAYkD(MugfpJ*AIzm~TJk$? zp&`P>gnUHBq=Y{76Z$#m390Q)eB}AP1fYqdz`6ctr@P8dt06={0V*M3uWf&r`+FeY zSUGgw5Z`QkxZ8Vb2?$K$BlfG|Q=WdR+5XR7N*m#Wx={WSN5p%QBTdb0$Z~$|?&i^~ zp%v0$Xa=~i7A*6*X(O*cB;a$d8x1^yw9w#vj=-#^-^YbM8q&?eAtP5=CF22A@9^%- zt0`5Ax_fWFAj3|)1kSLRrN@X=`r_w=f2lri-ed9a;cK&E(+OP0QeH)R&@y;vsHB?6 zQA2FdE^70EA$q?#p`B%ADE}&9i@2lL<&qi(y8eBwkTIEG4f%m$M@P&z4BU->U7+m< z+w*An?qYN8_Vm1Aj%FLIL;pX4Ab7zSV~6C@!aFp*Xvv=&6v1Q~^)Tq+NF_`hb|EzW=@1~>YfPP9;*3xaL>>$iauG{>CazfY zj(jkSQdRDK%;C*A@c_jYiK=JL(+*_S&9EyBi}yaOg4K#6TMR#tIj!%WRJQiXrt-Df zqz7q{Hr;41d+{N#rSxv^5JW;-c=f>CG(2hRv;n8EhC#BHco?4azRpTf@uK zx9|M5LM$^Cw6#5!Og}i-z)dU8`&_HO(ZUR&OwOhN)V_5Ax=~eVe>T$y(C=*jg1)cz zZ8ueBV}u-N7{3t!<<}gg5xFSr&UWiY+Eu{*!_5*CCc~q2DaEfRq*WE_CsaJPW3DMg>mAOlW`m^h6E&_fno56wc@Ay zXaR4a3*Or1M#09Ggu0%5;?5Xk&|dq|!#=4GKon70AFsj?<_qem0~Y#ry^&$%L#SJ6 zv@zd_!^e?h=p*mjaJ06+w=d?qSG8gauhzKrS9YU7b}UJhvxonWJwWbR>}6-Z-D>?j z<~LrRTXMHGA7P7VOsn12m@n&dH5LQq!8Mh*jMWQy)&Qd0Jb7Jp^u?X zdbqT0n!Q4Q1D}nVRti3~if&(A^wXsfav=_dm!U~_5ifCpG?YWLtNEa z-)A8wN&sub26!K=L9^ck_Rm30p1!_Aqu=9?aHmH&;}@C`7C=(qKnHNgYv_g1^Lx2P zAu8v4(WNl>4gB)6qemW~4le*AO)O3cC3Un9NrRYv(>-;;*=S^xWJ?934BB}wU7&dWUP)p{*A_8l}qL^L; zM=e_$CQAbbyXEm%p%?mZTQM0(|rnuMAWGUI+A^V9nj&LC=piFue}SYu1cv z_MF&a87nsRnP6dN7 zr2xL|?Boe|iePE0AmX3HVO*r5^wsmIwc`>vv}tPx+u!~uXwwTx^8SUm(R!ZL6iMrP z?U`gZITxD!UnDN$kr%ej#-dHLKG)xxDN)p{385GAsP0`tr~4zR_Lw04v1Cl@VB=5b z%8CEO2H4rV|84^V7?KB5^UJgH__3B4RFDN>2!Ui@lYytGqt2NuF=jtR?$H-;WFjfT zMp0>LoU?#QcsMvX!vB;X9h}7Yd=Tp=9MkMK7zx}g{@>^pZ`_0+&^Q-FSB~)lizZw~ z6Moc3tJ`Zo)^wo7;n-@Go{6)I*#2w?e9MmIaQDSaALJU*UjvCFt#?}ZYpUpwu-Ox~ zCtHND`VRTY92huGQwDgo(2Acp5+=x|t%73jZfwmL^+#z_`fIl=12H!&x{G(P6TqQJq>j+qpZIk(PC&>|d@8)0F348RQ`ZbX!OwCj?Z zg@$7NWu`4``NhnKevnx6L$TVgXzinE<^RwFIMIHnc~l~(O0j&Cn!;VN@EkwV{cM*L z2lAZnpLD4)xC{ip9-)Q7@TcV+dvUZ&fA{9vR&~lgc1Z$jl)H8A<9M7ZN4hAAbOAKz zwUq3>F@G?ld{8vNN93vjRN@SIMCsDoV7;afA6*QYUppv$h=!695oe|cfjE%#~JZZUX*C7m}5@plWDidtRfL;F--yj zDgrH3t|*H`N2Wj#D2OVy0-(xUfbdmWqh_#g(lSX4XRl%M7$^Jk*VbQa*Y&CWi&RMPaR5 zO@1lsz^h;dq47#NCsq2T8r|v+gj;o6HM^utCX;Ut zV&&Vx<(m$<9VQB;Y8l}dcjQiz;+r1XT-1o9i^599=>vQc6qsDZhw91Br+X~)Agm9A zZGp55V_wcZV^NRT&OXa>OBX4{r`BQ3Uua+=Wvsv|F@!h*K2-A$&G=Gg{-Lc3CvtcT$(FE3nTSo2v}1-|^X#k>AVedoUvKzmqc}xDh3G`Ar4pk5RZ?^$s3j z@HaabFf_ywpPFnY;VsdOt49K5PX7$!nqB=TUc4_~872;hNCo>4RZa?Zi}BXzb~Y*I z{%HhuaSGlPQ)jxCFp3>jUtOA?%*d`$cukT?! ziav!d2o9oazJ5gN(Q>Y|Tns}otiy&jq6rNR4?>hTzc4C8DC^d(l@DNFQ7T_arxW|l z{_^$Ai-6F>_4nn<^yQlO<7?*~>0{&?zK82$?Q8!zB;+Sn^tyjLuZU>Cf7zYcPMW#^ z|9-shbGf((5hV%<(eZBPH{pfXD0qrZF{d~qq`Qa7KPxOHvUGlHIR>jzolmv_h#Y(E z40N}tzTG{Ub;XR`O@CTdfJs`2W7zZsnJ24RUb=~$=cmHnkMj~~8e$#HKa3;Da!cVH$ODKy5aY3=6Cbw>Zl z#%|xW)o+WhOvPNBm=}!O7FA$N$;UG+IX6{BMAv2zmihV108M{d85!WFtsSB9%=P`fkRo&!PH=P9FiG zYT4tVOe)=MqqAO%N1&n{ojHT?bV_L43E2O4@{V2E-Ot%uLQ%xGJ(-3$yt1(heOzRi z4t8bR>8PPBnF00o2Q6rK?El7`hLS<^nX-rvC2B$Q`*tjJx}UU#tU993HpEcyM^z_U zSy>yr);ebLdC8O%R+yMO6(PT7?~Gz)(AX7>^Oq|dy(ebeH!2uPGtJM2ei%9q8)21t z6;tp?Hej4OtwiLXHsu|SKrTjvVIh=16qt={!v-WtG{S5XuShIlAs2p=tdZ^R{#_yn z-;s&JoKf<8t^XcA?r@s8h>>W@_86&y-C0j|zj9+xwr;N$Mxhy)!@^P3tQ@x1qW>`q zT<5IR#vqC1DR0i@CR}xfy4@vc0cakewz+Z%s0DJ1|Ct4m7*X_2Y>hu=fxgl7k6A#~ ze{XEEh{Vj+ga9hUjSn^i?M0tIt`%^9+xrw$D^G}OPzB~6zPv~)L1xTEg)qm9RwzN} z4yV@BonfKgYWA=n?c5aiqZVL2D7j48-9RI`6b(fR)ZSjflOe(Xrihklz)?Or=xRhs zo{`{S!UTm+%Q;N;jxCRv6ky_6uC8~2lzRXyU9d3LA-{N(9p-y`qdUoyR=ipbSI(Ak z)>rUvf=`&x!A&GiA8eWVcMP)c0(<(Rrwa!SSw{FY)#eS~YwfL#^f&C!oqJJ?))!oT zy5s7Q*?w=TlxTguL>~#n*FeW@#wvhAhjqP!sPF(-Ts?lo0vOs?P^Xs)KaR?gUCP&@ zUwG3ePE^U)iE-HQbe)kGR{I4{fU;H`Dh5juoI71v{fAcTRor~m1d%7W?nOEMBp^Z7 zk80917oDuL^FQ65Tqy@w3Tq9KN(&~%8Zp-G#`!<%xXp@ipJT+x!uwHGQBmys%gcz9 z4j$V^*k2rTos$sF_%ycW=C9Ke4y_8^EfEs}2Hdzb&VK`WUx5Iw`DG41^+2z5)>jBh zXYYr}_`lX>TvUIv=j56vG-QTqD6ept#Q)89#tvI9<{XX)Nxvn3=+^;r*Q=jDV^H|K zVq_|MjZEqJ^YZ|2>0$jA`2}fL)f+jJdhLD79Mujf&-T)<%b4GMl7ZZIc%GANSFv&O z2cO!>&Xb?S^v+((w3-`H&j^_+NU6JxRl3_k@BBYp z-2;=PUBIR5vTd7PUAAr8c6HgdZChQoZQHhO<5a)j%$$kI$cX$0Ph{ra_qsIf{fLF? z6zp$O-1UVC9Qj|^k3s{bKScPjV^#OkQ<6C$klE<+xKb}~N$5X+k&sbF)W=6h)CjhD z*rB5Av0`+*|2|gu=56ip1eM7vj$9<@p*C2lr{W2cGITk{a5G@27Md01L)DoRpIA8P;xhO$Nk^+NiLAO6o7sB>uzrZ%Kws&G~DmYM+9y9r&3|Pp5+vQ~1{;O=n zfZlnxQtFRf33~DtI0^F&9sJoVgM!I5+XCt@a?t{R!{?tEQ2<}V>-5s&8gb6sapCuD`k;gdciue75x_yy$4VV z+6jKmfuo1w@Bcbyx4>mX(r{H?3DrPqd(`mdrc%e+QU~Z#Tm78PF{Rd$h30p^)9^cA z5+%-?KNx|mLM=nRV69(&sIV)lRS|aoXvl`gu*V%u7$g!BhSHRpo9u z&i=8UZ*3sizZFT+cE66Nd5{&O{t(B6u4YK#!V_;X#tgsgdSP+-RX5x;m=r_JJAb{bUiuBqT1s$Xml5p>p_SS*XT|?AEAmkc+)w$`JT-dgHuQ1}1gL zTVg=Y+zV&Er(8tyc<4$dff@##nt+9Y;$05W4-2yFqWZz@>g#(I>=5iL3B5sxtnAq7 z<^Y}H*Y;W;*(2yAQ5I5K3?p0!J+ft0>PS_cXCM|KurZkGqJDg|{4Nl)m`IMn$guB3 zZL!~a7lK>}JIk)YYs_4x*9f`P@-uIc|8L#^NG-C))X)O4X6j~?K4b3Zm<_9xivMXM zr*E<47340cVz<+e35m7cevqS08_Aq^I;ar?ZdH_K5lOr`FisA=9YxT_xaj&8zIUPL z%Is$dpuD0saJ{n?$8-YU+A>}k-&r3SRQBYw?7R>oI!&G~nXde({at$U z1C|vkcnZ31C(l9zu5$M4hhxzG=BDXO9BcbHhc<@CT~X)$>@{7^(v}&0uH*Qi3>`$D ziduZc#jbPm_C;}qT`&BlT$5pDUN!7HO#{IvPsZFEE&MW}A~fIwXf2DwQpZ=R}u5_T**TLi^{}MYFxO){^|_5>&6X{jl5B^ zj{13)#>F1EhD%kIz414f?Dkk={s7@j1&3{3d#UW_nd8cGi^}7Ccbv?Z^AAmaboO!h zy4vofMc`V&_ZoS&_65$Vsxxu@|2MykzLZ24hQfIucw%aQWbubO>8U424Xmk?|2Rj} zV^wWKH<<$pN~SdxE=$-C(O#hO05dH&GW9}J3ETbQ=Cr0fd*A* zB*|a0cb;x|W8?Pt(pYNGI|^0qyw%kZheF;<4bG#(V=kF%w&*|k ztC6LXScGHhx76Fu?Pj`C>eTt)zt&+h3?YgHwYGyG+54Qjr_5s@csLXM3?__X)`gNS z@FEzzgr~QsHgtLNyB~c)hqF}-S(hMi$?cz>X(hyCdbxGMQ&z&LfD7#ld?XkQ!;h3^ zAYb^Vy;AmIKKbi$`?F*%dJp1qwK%RS0o?st6r07<%3^-aU@P9Z<=<4 zmntqt7ldbro653yIL+Mm1YqSmd2m}iZixi2(Y-j$oG zDFH$T#VG(SYPpe=Bp6BbYAR0$Q^kgI5t-f%Hlky)YcYIi2>5$itqRK#NyFG>|97NS zZ;>O);PRA4CtNKMc7q!;M?j4=Sr;f}skH0r8;+JP$7+*6Wo6q3?SM@eE33Sor@Or& z75I9_;Do1B8Ezd9liupR4LZC_Cq@dbQ3Fm0RWcW5L-=jQPtT89`y1T*tDPkn%ZO~C z!p%e>t~mQ%Z2e-Ck_w$+KJeL&`x(&(RL{m^M}uZ5tpIlaKV2Q0y%!FxRb;DzRr$+F~sxDW|V9BsdYyTN!iq($_7iTq}`}-#{KpH+@Ntn2;->7Yu)zW z9RMOD981nP#~SXe#lQ7!`9B{$0PcsBmh0lm-ZnstD3@bus;PT~+?dRY6-re5`E6iU zR2kHUL!3x#VdMS^yo!otY}phl-G!c3mD^Wq+MRbgbX~vAcZzuK)EUnSjGuQ({OLlK zdgK*Yi>T!x?Z(Sj!>OGOdF#Sfm*C#&Mj3|g3hmlmnsD131MwUmxH%iKg)vs*Q?f$P zKP)Tp`;fF_BBOWTHc(FI$^s&iW}YRf!_m}oB_~YaD(cP|gkJ`fA_E9+1|0M^{pqKI z!aOvPBqW@h+1ObIaM9XKN0&G~mUa2{WoN%NA5bctQJCWw`_F@qFVrL6X=jNWH0)Pg zbM*D(%>s56h0t)cnRQQB`*p!xUm7U#AICK$l};>+8uyUXD+jcu1JR;PDwG<6#a`fl zREC{l#NZjAU3_>*p(E=PkefC!3l`+?R=6}gs+*`;0VsRL@b>tb#j?xnw8DSKjRdoo zr%5XTW<8z7G*7v)#Xp@X)JUz1mh@v%&9NJks^}kF$JVbTVvThKQ2jskZCd;|1&wj-z?|{PU-RJ z@9&%W=uHbIm@sB6MCPP-m49|;IY(_<47q=9=QirK$#>Q3twz1`yLQn!9#6(*Sy@Hv z%#}KE8r&MXG{U;`)**H{fOoa}u8%RJ4nkSxzC*@PPFDAFcsKIek;*k`^?FhlgCl3Eh zItNkmpz@Da;!9ZCN{dgmQl}Zq;;47Pt0j))!r}5B(FIHzv6bWDDEyb_+QL-m z6e^LkV%M4Was8^=SyRgujn*T}a+BEpsa7BsO)=xiUV`x6W(g%+HAvm8^X^lCZ_omq z&=hv_Ad&Du@2d~3&2HfX{f!h&5+>sBA#H4T9Ol>jdK!2x&Hdb0Y0d@pAt>&>KNW?w zC)*iGq(o|PC8j_f29o9kW;pXRoNY)@reW3hO`}Pg;WhA2r)lGKX}*Qvb9wq#^@m~x z--qKrs&jUilI#8ap_sWmDA0U!88r?8dB&8(6k76A5G#f_x^_gC{=7;Hz3KY`0}zX2 zA=v88IVccyeqXWtu=3{$EiY9gcIR9!u`@wz=zXUK6u4 zFM*FQjfOJ2|0SAuo4w=tK2}@8{pLUaO62y0L&D7WbUzy*e>vcJ%1i#S2$T_iLH?3qdeyy$DU=f z(vp)HLxth-O~woaO>)LmDlFT7t5wI02fOfH+83D9^qfW|rGeExDWy-lzM8?AtLZ_H zKQFd?PCFOTd-@?st}b#3&QICP!2P!b(G}iaKuOgwe@KBGi}!tyLKyl}M_W1a;SB za9EVTIw>RZ#l5*lwJxJ?8t>(EgtXhL>4V(O`OH1n!IUypa47YBJ?)^LYo~&e^0eC7 zwmFT*6;OUXyT7o{a%B}!z630~6}V~{5=t!*(I2>6-(@WwB2cr^=@|3VRwDJ*03LB1 zT!seq=m0fek#=CctaW3=biI7sBeEYdk0+M228=8S_NUzTu!o`5ov)} z4G_FNT4Zd1^}S+>kT_>N91;W3%AzU6oT*SJpoz{#vt{yNL+r z1m%5B4THU9T6sk{z=VjrTVYEQVIy-vc-L^(3uc9h02S0QDHWI%88g}CN0|h|@aQeN z!t$k{ePpXSj%4na5A^yOgl0NKG7h}EO0kRm#KJ-1mcb{iktSp?vjULeH0R#t+foE~(&wooYh(^YZ8u8ao6z1^bi{DE*jYCf9I^l2Wn{%!l`Z!S+%1#_2Vs9rs!aZ|Fh?i`~)LoF$VOD3$FiyWMKBM=msn-;a4oXIex%l^8Dc`4&< z;+;j+Tw=U~50~1I8N!~1P~C^4`jxtzl>H_Akpd1`L|L&OmEC_O|2ObW(aQ{(>xKnf zk&DHe^*)7ND4}v6CaZ}1^^bS_VNH|1<{Dy&##Ojr{7cI#P(sl-ZPAK!p~CC|UK8Bq z>bKGovbtBEqMiYcHuIqG<5<8!+&8HkK5G1*&1az)3Iv&^3 zI8ko6Eo~^jRwsX4eT0dYEqkXFOM18ZEdv-3HT&Fb>{fLlHP&j_zrNA%MOmdGoWH2t z($2n>ref}4B@;)#3^sM_#$CSSE8{_ydj3>*J059?5wQi(bDU#q&Gy>L{iD_ z;<$LPkawTn;L!X%M&=S|ZoIeO_-jzxP4xWZ#lXs5z8U-Sz6cG9=^fJ@-|q zvF?)Ly*gzc=3YE@nJ%&VVLp*8UM+ddN`h#`d>bD9rz5&9@4`Gv;w#j&sk>5;ZU`FU6WYcP zBsmMHCfZ6c^)YmpJ@-_p=87p| zBuW4g|3a-Wf2pA)u+nuG^5(0N?c>NPD=IW=h}!Uzncq^a6=-ubHJT&t`c>|7?Pdl9 z4&cz$Gl2k5bkv1wOG^|1p{-2T-3U$_@ z*(pp70zH9!6aF0(hQP|-Xnqv!1hSEb9xm4s)U0J&dUEp83;S9z$6svU;2uTB@jA5f zCn^!$@j3Qg??W90^$Vw-~U>Ccx}&RGCvPu}mm*2|c*etN2IOFpd)e@@gT{SQ4WtjV!s zAEd7%KYo$zTskA+qqr7%4Mx;ZXLiP;Z}yvx-?xQXOCVb&IcoTyz*7z%$d3_VOW^HN zjR%JaZ>s+sQQlq^9jXpp3dKHZsgj+HW~rZ-cG~MWIHVchPb}>1=#8G;KIcK=wCO{S zI0y&7`Ba1rzBLV5`UB#B@(9gXNN0;qK@}4)_h&MG(udNeg=tpG`{>3$&$VE9hw*b|hM6gp*gFO8%Q!WvbHmr=deFyQ*|GuFA{(o64KK0yuuOzt$WdL|U3aJK_X zHSbJS;KyJ312&c){fe6QY&$*paTBy+?KCPawR3v$LxBk|uSJ$o_ z4C!0yhU`3eQJQTB|{B zEIwgO;KKVeTNlx8XX7FAm>53Ox-yZ4v{LbpYr-%+Ln7Af>O<%g*#FwZ|FQ(L-uf6n z`S}_6(*2=loioHW^Nkvi4L&NsyMsi>{kp4=tjbI^gf?;j9x)X8B7C4AkcdpXpKYEx z7yLQ@imo@>aoCWX4%uR-t?@S&OB`N7IMjqu7d!zD_#xDc((jspmJ1QW%HWDMb3K*5 z2gmay3|U3WWkTjANk!^gU#c5b;d{yI+RU``fe^AYMXnVf)(ONMG<8D#)VeBzJgCUK)OhpX+W8&OyM__$wPhkpch# zB!h|J>!E^k0Vgv^Pt)kQSb15*jQfrTBoRZPTSp-uJt_$pr6HK=jmxlrj zAE1oI=Hkqg;YQxV+#PXI@4k@Gd;A=pc_pi}VqbMfER3D|gC<$}c)2_=ESzI+jP!i$ z5^NwA44V$nK`?P{Oa;+tL;k4o)P*AcwlC-w>xMj>tzh#n2 zz4&zz?WUwHrQHZr%2i%(U*Jsq=o?cG@*Id@ICJiO@^UaMkmGIyW2Okv)B1sHkU0)P z^;n~Ln2HpCp1HrEDt?nOB9=dUbiD-v-_0-q5tB8N)GD_7GK@uK;jxXgxC)2O*xNFt zPnq$I*Sn<`oc~IrGGL7HFz7)b+XBODMWPw{S^g|8X`Jn=;pO<)nz zy@QBoMG#4vJWamdgb<};25+?bdy=FMt#hsjFDsN?<}hvBY^p}kI^^ej>tqR||CSPl z-2p3ZWQGd7W7Q6q2QGbB34S?s=7!S^Y{m{c(jK@yF$6&sl0n2=w$AT)A2&eS_QYw; zmyq`PchHH!eYJaRv(FoIO2xx~=;;p5xZ zs9r95#uY9i54~zK3h_^Vjtio)B*__%!5jWou?uG=0Q-*PeQ;pU_P)$)R0S>oWuz*0 zjR5R+e=(~s$Y6LknHYA%0o@5H`sIG)tDYf*aV02MudIm@=~kcw!MIj?IACS87I|hc zh9W-)=%cD^x>38%=RaVmjn>+yK#RV%wtN<@0X$NO3JTV4mxUB{vM()I3M>}DQ#k`R zKyLO|MyVw990Uz5IK#d0d8Z*R&8ZUPv@BIg8*Fj&3Ap&n#K!+I0eNpIq(pnqRsy!SN zGCe*~6JTCC;`g%3)mW@*4Bp*lp!$SX`((Tc2(h1YMV7j%N>rDhw9osdfc065KQw4k zS!`>eS*j-3;s$MX?H?)Zj0UtMZa{6b{hUyiJtuhA*!Sg;ec(X3Y{o3UAUHX^_A?ZG zUueNqibWOjTxd~YAzLQW?WL#OKiqR%j%nk$Cx)Pl3ij@{)~X>gJ?BABXro4WtsW5h z{-G@$gvhO{pwk$~$G?p8esv)aP?zsc6F2pdCNyuu)4svT3E0#Xl4rgzeHOgwuv$DB z0Qbv{-pY&W^q#xSFTDS^a6a5sh(@HYR*G zKJc(5Bl{x?ll_Ro@rEPASl_EQoFjsSk{!pAFpq=yHWik~`N^krQ>O+A$Z}g6lm1$4 zH<+L#{Puhf&X2; z0=r|uV(IV>EJ@J`CBDy&--pz2Rkjk)yksv zIUw-&gv=Ye7M0)7lTI-vyPyk~WYoasx$8dqCkgvtS`gYSq-G)v4q6QgU`dRxA7S7Mlu$nDCD9~g<>N%DS&vYJ#`;XBs23?F%jN@ki|3kZepgiN-2dT0$w z%I;8Y26U66oe{Gvxy!#yApgQwmgKKLG#5^ipayT~vVK+OtCT##7bCxVe5bdpjx9<@ z8_RT}xTeOlm8k3%M(pW6OUT0SyTgpLoUggv`W?dfg7*8^9?4&r3>u17a+-tP1 zLgkczCfMZ3X>d93kKVikL=Ut!tCbx*xX>uX!a_s_Cv}SskszD z<(*EgnPs@YAv&tK&c_w=%^k)Y2>FCK+w}vO#ho?T-jBnQySYoaWnNjgJ7lV{y6h+M zj1-gLI|gzgh2daE`}4j?%`DYp$@)1)`+;d$ar2=iSOiJvL?Sw-0Pms2;7w7o93}!; zWd+g@+1q#XsmgcI0o5v3zg4#J3d>T5w6w*fliVdxavGD0{YO=l?|UzAdH(WxA1hzr zT3|0cplM=(Wqv18U{`Jmz6&yS5K;VRliu_0x6fP zX~pjEf$fWvLnyx2TeBA&D1Ilvw{Kd9NU74t% zQdP>3g+T3>I=1Wi>rJRyI~F_!4Yn09<`Ki^HiC!@=MP-339WJLj$qOXGd_U1<3z}( zeIUa;U5YxR&ZfYd-fQnBE9Q(39=~b0A10l9BBf!sp7L_xzhv#xfE0nw6Uox$d{W-% z=+WgL0X3s^0d8si3UF_J)f!<-CQSt?5D<@}N)Z-x z4+th+p5USq z$H03hSy4+~auy8F4p{eh3hrdAx|$o~_VIS#@~QM;xGgs?ctt27Q96h{jr^mOgbA8mZ){{>fqu7n(JnQunLaWKi} zag>^wrQ5~M%iYSu>%qVAQ{P@hk2b=DPgX5+c*3+)YMj118?92IY7cr-*ocC*B4~Mt z73kkqmK4??RtJ|gc5m5x1@>Wi4}7#fCjsV1Y7u>fT)$~la*G$)y!UGMZ_Av>T-=>$Mk zd-L_C)JIXX|Lv=*xiU&4UegK5iCwAm=VXHsv9kwxwdh>tF1+hh!UPtvL^9#fqc!S_3~@MX1SV8^@7aWa4NJ&kNi)}I*^TH3@t_ImnpP6Q3oFV#2*AU z3PggDC3Tgm#N5v4>{og&4+n4ir!!A3s%Cv!sl>(u1GYSCK$_7`q~K#V4u0|Dc=Iu0 zz~D_S3-xh{t*Pd$$ZfsBUPRn9^(~!YjG@05(~p=UthD9|xKY*#Z(SfRY2cng#nW2`J&xB~qO}ijJU4%fF3{=2GC8iOT^+3~9qosfN`e>7 zY3ALRqcwS(qx70~=g&0F{d6^#w7wn};%YQSjhqH|_aW58NpW;JykZC#!z|#y_ERB_ zg9jV(l)xqvyoSoL?nB(|$0sOcgQkn}qB{z1FZ-*H-&vftb>5V4xHK(CO5+rfZrdEQ zzo<>0LbceCc9ufMJ4BhC3tUWK9CdRWcizPv?U zorl~4G(SXea}Gu+aNFia?eOo^sho;1#N&@{O^w~m&aEJ?3f|*UZTs`-ym7(54gCv`TP?(YYD=#RTg#1rDmJu>UBUvqycU>@~{dFWQkPml6+LTGo5 z??_eG^8T5>>M+sz-9-fGDI(hYkGy8;EVMT?4R`Dx-FL=xrM6qk{ORECI_nI*%YRcq zZhwD2gc!#9{oMEWVZ+nfdd}dEwF+>n_HL{cj{X=?MDV0LLSf70o^4s40CLyKp~2%8 zmi8u*PoSZKa2sOz08^hl1S%&4)|_pSR+H|L2@b09RH;X{O8RcGo*;IBuKd(&LCUab z7X&x40yr|Iu9jd(Jx0jFh&$VM`@FN@A7ttN&F&;{Jn1g%FU%vPb)?gvmYy_RBSZczZ(kw%3%&TauN%)bL&PrsLi}?LJ^v zE=s>9xRK$|wgW7rv*n!UWNK}UhOKUYB{6QPyar{CZ9@Vh7@?~5dL~S;*B{f4*|8v^ zGFK%}nVEV{LeyFvvG5(z$Il*4lU_DA7X8iTOh2ldhl#>_;CEUK~l#&`z=N z7}U+e*Nsxb+pc;T6Dst5S<&xXcXHhRn7>s2+x*>F#nSp`{+^n_{*U=P7_)HmpZV)G zS@h5RWnhcn_+REP=EY&9SML#S`r{b}?Bg&M-aqqqx9!LLH7DttBEOA>o-~2_GpL%R z4o%r-@xa3U5&EC`3ob#0wIn|Ve#@6(51`0E`GnJ~TS1{?Lm>xt9sFl8&zcd}qBl5) zw6z7shpwaNiKwLxG%lz(Nid<-)_wTrH4C*e?DMgYk4RZ>1e!yQ?DzUUeLOvUa7|v_ z1tRs#q42-WU%|e!(2wr&Y8@9gtIuwcEKf$(EJJ&=0a1d9)3TxjYptDeSpHMw%Ki=aNL~!pzFs1r zCp^Q~;%K6Qvj!4ZE1rQDCBe7!GfCxWN~b=@>r`zgHvod$S6cA z+`lS-U8#CbUqLO%e6>wI3CToZ3vH*ee!3Sr&dCOCm9^~_rrM~1!fJNuZJiQ`QxPev`esrodRD(n?RR?QN#LSg``O!dgPxT6~E@fmu z)@JKX%$I8>8!&p5%0n{`PQoU!LL*Cb(FCxnnpP?O`yaj5W^>BNNY&exqNd0FOGKo zhyKF;Lw_$ID@^{OzY?Mn=jqTycgdvvW7l?MpF=z8HKkBbX#Yh1a^gs2NiS7SZe;@z1`pfnIsK5F8 zqALH?-$>Y3`5+wio2i8S*vgsZyJ*q@RFZ${FEZF$%a8giY2ENo{T=8!Taa>~4U138 zHfj4i&`~w%8954RuGag1V$R$Hdfauv=I zR$1*7z#E6aqW{aBG;V>t=T;ZI6SA^`ZO}ZnND{Y*xtTNsFCe7Gh1o{0Ubj{t+#Y#+ z@|6g-xxC^J*=mJclNeYXius^q)iF>0aQ>YFm!I<(GGtDP^(18FxyYQsm=c|P1N=%n zSeTMF5ox}DfEsLKREP4UIB{cyU451;GuT6Ls0Fz*46naIl=Tq;O-k7q=w`3mPQnd- z_(+*!63Dk>W|@C|an0XNEi5@h8A%1quz4+#PuW82k1FEs??fr%^%6TZ#~t>MV3q{O z=XyjX=28shbS_>pMj8!b6_QR|h)mZYySkJTwXeXn}Fj9pO_3hkTIC-^?UD80b+2f!>yflUje1tY2+Bn{?|3KU>=H4%Vig z`MTQdWB+8!#tB$Q@nmPZ!>zT?6J?EdP^9|bdoBSkK!qh1jMtp!lLe5XZ&tLUJm@FC zW6;T)-`V$Dx6Y|!c)tkvBv8^=BeI$=siZF_<@oj5c^Eu3K~KIg)gUTXU<58&7FcHi zZ-bLD^*t~h2~?U3exjh;vlN`oxI>#EhD|mKpHECK&Wy=wVtm$If-OkN(VsM)XZ%Bd z@wFg2K>r8*g^Rvq)Yzbx2g;_Ekzq%7G#QWZa8y*GnZcvj66g>|J$Go)5Tkgp-;=WQgyj!J2(d!VJdR#Xr~(U6CaMS~B z5g*1&0&5&MLr_cg&aA5k-MuV1c?ZUCJL=%(sGiY*yC})&Fr3S<%~hqw{cXbexF9V% z4Ml654A}cQ5T&lna+jQ)@NY%7JHxf1)-^gvQ8EKA3=tdD5w{1Df7Hyz0b?F~Ew!`O zi1+de?e*ou1)iYE_gE*8gzXOQx!{o6TmU0#9g#gfe_Xc_Y20&#x$7v(?FZRHhg&0K z<{qr+GvwpZkNP{RFa`u>y7i;}He}kxX~TYf*0+FMU=jaQf7}15ze@a6&bP|(V-7*n zPmOrbhH?;I{d-foF9CdkzyC-51^-{_@0P+Op4l6<$7S#WIKyqm?!leEXY@bycS|fv zVJj_DJ{xcfBUd&stNr0e{bhPqRr;s?R?c2j{8N89G5)E)GCYt{N;Iw={ay9tSj^2% z)-L&}ayVQn{5wIQT%s4Aksl(2KV`2srA@0Xxu!$)%kNQiYoCWQ!2+Ilh zo+2!4Gx?wT8&7qwYwz?($_A>jOLA2Q8m&&A1pbU6)ux z)Gll68=92Ld*(hC(LUbuM2mf&0pWe7Z4}|Np4_@trF&E|x!g-_XB=V;fl!wC+x7S( z%uT3`Ga}J;(2^G?7K5eheM3NlFr;jUCxWuqS)>UM$U5gYTj@ETZ(;(~tmy71!jeIn zJt7k&Z8>;+UC|W&W`;g#b)(Po^U)i5u+d!02k%e%KW0#~(=xbS@eU-gYN6hY zihHv`v+HE#XCAV>Jv3Ph+0rkUK5lR}wiA3oM^I;n2XFNRU8GL)B&4K~leL~@A`Q2R zX6W8r^*9yoy7f`Lq5rk^Hmf6+Gb0rhdvi?NZ2Zbzzn(#_e`CqaCgfgc*{A_dK|AXb zYuXUkq({2CLWV?^96g;RyEHx3FCDKaC()|SDcW2l)mVe)bYH7_W$7@wY7$&JxAnYz zQDJi@SehUs?KUknC^qpJ^T?WP#xt-SbsY@d5@@kOYO3R7GL!DA0paQaW|H8XLI0uO zEv?*v8hNB@Y6xelMv5RKIUsFfWzJxDUp*Nz?vN82O?G^He0uG^+5W&JlJxvAHU3_& zRIt57SzUXJHh9hHF_bu7t$paSo3kjX(5k=1B1Sjqk8tpp!2Z0hHg(JM$F!_Yr!L0H zZNj^`Sxwfv_~Wkw_J9Ms>D*^l~5rB zXi~2M|DXCRy6?5tL-MuMy*Gg}?<_JnlKG?lf|`8y{!@SH?fx(I_vy{T@&8qSgR~;0 zV*aVWIaDrkz;1b_?6Zn!(#VN$W-V(kvl?0p>S9z4lwB-;W5@r2$l0d~*;Uk1ycAU=XL2;F$R=6V+yQw~JIn^W?g?m|5Pv%Kh2+ z?1=t^s_>%ZhlX63$s-8Ullr@f-T9zziUBfZ^c)Cv3Li6Rto&|u$l$eHzrv)>2RtgUO6|k0uAp@DKCY5(CUX=C)$%EUidyE3Rf4yBd

UMOn`P6rE$(FP9Gd?a&8uqaAu)BKP9pP8Y>SW>nY&CS2mr@YNwdoP}7A)3y z&}b@8W=&g7(nywE?mZ)?0+rkpIjbb#7z)L`Khv4Vy3-|#j-G7=NjRkhIL+G0H?M)t z3hg4pyd(VF>d*|OOQ}rTkmd0Uvs7C}b2aju%#)3d^@2faJYwS`RRFErR0^RgIue+7 zp@qP&r(b<1d6}p4jw;_XZ9_wYt!goWtsK!2Gnbm0db+7oG#R=qBqr9H zEv~SaqSj>1%k==6aCRuck32F%=x&E zL=^o}NF`+CZTj;hAZsjYQ-uO={RGV*=PRdX`-_vlhMQq%+aY=rJ;-)|;wc?SqlPXM zT*6No^jliM@D z+2v-tDJ-Cez{~~)%pOFl%k5I!?M&HeOCTdap5ru3J>?=qt>R2$Jn*kR0=od|6sK3_Z)tiq$-s~nOw4xMci`m{BKSi+f#g>6g+t6mF`l;*(3 z7A!NN4}dvYFlt%w3|+8PTTr4{05zL04AX`6Nry0flNU_2hSf|5R&LXDofFmn44Ww! z&BQl^aVbEj5#`$kd%Z67whrca zh?wU_#)}B?g~^=~IfW;$*!j%ZQGbP^J@eKRAk{`hg9x{SL*hP>xsL;PDla|>FD z|3B}a^$_=)Y(aR7wV72-F)#5Je45F5s5tmvReUM!hWDl?OSL%t3}5;s27?U|9I1xn zsV09cY>M00Xg|$rVxYYo4jnBC0bgF+s}4AfvsC*mDl5#K%q$%PP z)pf4VvylP7&!twZK{#z|R|n2f1)2a7Bh1K=zi57ask4JT*OWuw zDX=&EN0fYq(j=?b7*C$G{+sd?qDoY3Y&;L zGL9|QR3%%NN~f&UTq;8^=Fe# zY)wg|dx^m-_cI~8TV3dG+wB@n0NDG_U_(YzNrI8PH|C<7<|2<#sd$f?dipv%jZ-?> zJTPRKKH%mwG7_z=!v2|{;adZS1|1cZJ}+Zh!y)}2Oj9fMx`SYvnB`~}fM5{~)X;cq zrP`fVIQY8zCT_}iX>nAj9t@qy4y>xW8|MFG?VbYTY}-Z+H@5A@wvEP(Z95aIv8~2- zW7}$MtFdi+P2czX*8i{lHM_Gtc&__CuR~9Z8_d*NQFgEG=JvmsW=?oNxBUY1`cTt# ze@pmPc?LJuM`!ObwqvGD+woQVLEnUAP%i?6VWo7{G4R*n&=2A(#!_9{zm{g;e=JSk zxrjO=0W}tfM#0l=prsj4)*voyrS3u6S$+Y1JKzI2_8Q-3U0Da_TD?ip;} zC3T!rP?QM;rDE^o2Yq9z8d=zsi-DdSctV!0WYLvby3Up4xeHQTK%l=^%UVDG?Y)4p z6F7;$R2&3jo8iAazR}?QelQjc!`i+4zLG-SWB@7^FE4#JoHXIBh{4!KBmZ=Y!Vrw& zzRWv;D@>bszj&9ykuGnMhtYFv?BeuCsO)TYj@I$25Bo2tiS#e0DILoI)AoH_tTgR1 z&dzG-WNzIt09|Db^+96T?`$f4__8WSfbvzQ+zL^3%cLF1 zX~O;GG>`h^i9FCxJV@WH6Bq2hQf+*u4=Pd5@ zrY`K1I^+$+#vnZYNT$X5O#1z)Q?e{#Ps~vET0kFa1O5T>u{0)t58ELVRx2mjao!Hu zhCU-^Xp!MLHB2>PWzJ-*Z?A}YACyIJA%?j46-|GnOC2Yk zN~Q7~CsF{9i(}EsB$aDx5_D7F$uS-v5qDgFTnH1`kJ?u@7X`SUsRqznAi-~}zFLP^ z3c^8q&NHEXF)2Xk>w(qhTf$6dNULGbgse*?_?lXP;DMjInJJ<*Tx3|5d}JH>$f|r( zCzdKq-IM_4Z7=pq*TIwllADsak!~VCU9RoMykbLyFdylpBVYPY?$p+<|YDI#oF8Um$N%Ahk0-ZVD2Y3NS&E8mq)Fl6= z)_9#o2A5lBGxN)B#zJ(agFf~oVGaSYj!={T!6`wm?&;;4^&RzYxvjnS#cCu>9BWl0 zEs478@XiHsJsR3qqA=Psg0qQ~t|L%)wYpdHvR_lNxf!DeDMeq4T#Px=?||Eo-NiDj ze9$L_A9eUZ_ZgGc2?nxJ|lJulyjh&7)FpOOs2 zzSK1!>XRam52PW%GruH)0@mWo+vopUoAY5%P?W4MjMT%==7>QDS735$F~8f_*TgHq z;*PLhs+$bO{iKse<<{^b<5Qmr?30DRezWD`BIh`PzW_Lm+P3t8!2CmPLaa$PGhf{o z=3RVFIG>|$iic_5Xu-OINBLpP`F-N8M{Kg`)Kl@wbfHdgOO`&>qdQ=nOc!d>a49}G zc9iZ#2X-u*%6I!X#jVd&Z|Zb(%h`U#zC1KB;O@DGiEVLB2b&AsTWh)2DZ z$C*^!;WDFOS{g%0{PpQ7uyPf?48?*$H(yZlsWPW2d*8EP1|;_FPV=(sf5 z-Wtbb*tUDKVKGfmyq%}tjSKmo95}2m-qF!ShI=yg-C-kt@KL)gJf%f+{uA|5wLa^N%{PT1$I=YD{hV#c8^s789$Tf)%Z_^h#ZaJj^1K@j1vYcPeA z4IqokDeFSHo>BYB2lKOw{{z2xEJ|CFt#NNr_9QZ5^*6Ncfqn$s8m6psA?C#DZ-tq7 zFI85DLQ98cWwH=TYU3JjNor$O!G_M^AIFbB5eTwE718+C!vCnU?M1a_ zSt)d)`1{}#lO5Agfxf+Yy31@_2VyfU@DNqy5P|#qSa8%+@X3H6P0=b3;+-`v_;7kH zb0KsnPWH^fq(vn|9RBn{V(6uXh8TOdd`)k7{P+=m+xaZC3?=X~mA46B9kKM>pd-w! zXH*>d3#muw0Y;_Gv0Z_;hKXv1p`B*lclxl~nGPO6hAJf77lZQyuf#gj`k-+6r=e)nEpBi7ViOywKHaFQse5sI&{(hM?i`m_@m4i^k zqrhar>do)d_+$+#iil^J$(pFO^Ha$U!NhsV@h;J`uj|gx8g0=5Fjw&>sI=}G=~ z>-+%4D%<2NMCGgjuzbNL%#OrKzmS_|cA&tw-s9jRjL0*uiuX&5A;@eZ2=k1I$qPQF zcX#52OC@EMt1!PpL6BYp%xfS8fx8noLWb-Y;ECTFo%<;YXCPE@oujYm++++!VG`~( zP(71}G+@rm3o1s)ZF<@X-u9&z|I6{0N%U zg?4MUdu9b50ImH(jOE{dQt)E6bv)6^kr_aKZ~n3uje)MDd9198km^`Ms1GG?V$bPN z?1r|R7xy_rWXlBgk3(NrdlA!lUYm~`)Ad{BZg83tl5enmk}cnD=foOjI+LGOs-$9= zy+_=mE}|R4(>xVI$?Otc?GRiV^J+j75W46gdfW~AuGye4F;VS?g%*(fvq3fTVzxgB z`{=Q0$EgLk)aXw0F;?#!3$@dKR)KLp@JFt!yCZjM%krhtquf!4^RHYMbTy;ctQoE3 z&XWy6DE*?!@y4U{s8<5@RtBm5AGpneZi5Rdc9uGj8pfssbvZ@tx}Dza1CF?dSN^8# zGiJDM!So)=${mFc$L75m>09)&SDKYybE7{u}Wm)l#0z?Wz}8QBVi4b-OWH8bYkX5IW3I!Z&jmu4;VOMsMGR$*f~#)E2_3zn z<)rpO3}(j~GYy_Fc2=>yy^<8)PPb1l#s#9p^B-ik%DNPu{KG5{ra znT69h+a1H4e)A&7}&O~?+GXu;^T9X({HK_XK={_cj8l}dwR<0{(1XqQ8w|~%n36;_{PN*~< zc@23{0}0gAZcE83n(i9(^Q?iA z=Eh%1lMyIsHf#PUy_E+2D{1!gw-!$btsD+C`ERM+cvhL*B(pSMzLod?l{808)88NK z{v&BtR%xFbD3G#0yaFZ7CXXt?eyp`bfTxe?`sh-ri>Yj+eKWn>SCNr@7|*to7|~AD*Y=EZ-bSprl!yL*{n9 zUgDG))iO=G5@ipRG}p<1l4k2)Nz(<(P#t^a7$Wuuog>7{9#GO$&z=HGnoQS{Qb0+Q zJM14xvuj4adIq327Q*4Aqy>~T86qEOhQa?MY0|jY|CKap-Fe4=k|x-FiA|+77Esd6 z6#EFl?1LDBso|_@gCPif!$`JYufIlM6%S_3rTjDoBG(G-GnsPu%GkH2Mj$hyZ z$F&}2oJrE?)~6B5o+?0!({kfI&BdAlJuf-;!h!jcWPVIi;^(78;h&+;cZJ z>`#NCO7y|DtAGvB=qB(aGYyySgeoxfaJ95-=^0-N=>@kt5P5hl6MEG10L|XF{n1Lh zL`U<`08y*r{W45v+|}>2NngyRAzOzb3Jzp z@FHj}@RPb8ffGUU)SQJ~F!PrjKvJ$rTb5_53@dTs3}wK?h-qLN72lr$N}3BytbZlV zIM#gd$^|x~w*&-g3t70T!|BHmOt%nFF2=lKiCnsIqfRPUa0!5+!m^Mc%owiF=KI*%Q|j@C`?HwROC>tUilSWFxw7kDq)JKZMCT*O@Tq9!&t z{i}(utnfHQ#JKa5R_aph_CSj;hMqo z0AOm08NBvEOALfGTO)zu^gocM1Q62Hi1dmFb$Nc6pZnOJGD96-^~HH#xgmL4LOLJ> zjDz7=F!(;_rBrPRclov??yF8j)CRM>5)%`Tu=RtJr=ae<{s_m%c-g4&+BQqTlBT-Xf%NY@7eLriIWb+8Yg%Fg%hJ z>4Xx308>F$i&wMI>s?)U8&3=}S`hPEDr;h55nZo|L%X3%A`e-gP+b$fK^0QAwt>#k4GNtAPBhlCk4sch939 z)Hxq*{7I)zX&rle3e|xNxFU z+v(~lPu+nbJM0##GAE;guxtiF3Xro}PgR-@3}9P#))x&K!xu0@-Hx#={$W`USQZzV z&5u z6I6o-&{=sSv$Kje+a9tpL}-iYGDLfmHrgAbsAWX%gRgZvwxjDC0s|=)+xRW0g!cOT zfd7?q96zoKfJ0|~l|@&EjJt@Gc=o{NH?itBPgh1D&Jnn5gnf^_rBIrxeJmsIt{h|a z=g3)4JhSnrgtJ}%fs0bZG@&I8eZIct{sGkJaaX|p;;7;$^b)39k8vyy`{Qz>kD8al z)1;W@2fTO|)+*?N{SOf-!N(d&4EuVp)o(MT+)a+`&Q(Y-eE@gl#ktXk=dLlPm6@?r zgIK0@J`yhxDio!t9<+3s7N>8TtxNkUc?iAsIBa?5upCT-x!(w0N&cp_mXfUOMhOOA zKCBkNrJ_eTl}`nvE=yTWz|U605p@y|Dtg{Cz!i_uts(=M?Y!VYcG|6poutiGu#}6! z;uUl?Ewxm$942j%U}n=?0&Gau?#pB}JgsyUtsBxC@_T+NX4j6K4Szd^9uBPhmWL24 zzw;4Y1Hl2)J+iftwJXc(GQ2uM!{qRs_oH`XdgtPAU;CR-#Yr@S?>7M9&8sbwC~7^b zjnbFE<2!7wWwEB2B-MuDJhV+?rs4!#&E2)sR%c{rVavf+8?Ps5SR8|-raAbcU6k_oLeGD2Y5CKs^mnoOJmMUo;;n}6UirB zTF5z43@&}D697n=t6}^gD6>7UM*ngSKvT-Ds#C8W#G?JysMgI*Ob7{-De37Stq=3i zF(;5Xk_m4k6tsZ)L#M3q_zjj`+_GM4OWN_@=S`Ny#CgHsC3sMjs{Dnad)C3b_HV!l zQNBLH!Z&weU*`t+Z_!WwWI2K7;a5yy6Q#>pN_EV$OzMP6EvEo8eV7@%h#hNcH)+G< zAK(9`wpe}7?dh4EQe+hWY~B+f z>Z9tcGy`d_f1|h!i>okREMI*Dh(mOml5Peorc@yZ%Oh$(sD3+>9hsj?(_Z>mpIXC9 znd`DYVJU<`<#sVNU8KwJ^3_4%-qm8o8aR@lL6I7sI-U|r@dvmgYH%?F;yRsTmScOWSO1jYr`t#&GR3 z@9{&lxZ-kpIr}&eEPWosZQiw3LYgWl>TLyJ6@8)l?xY436TBRPb^ZyM_e*g=M>EML zi3CxbuGRz44Rkc$)t&x2nvwr?G~@LIsR2Moli?pnbND}wruJV)(=JkvW|ts?@;{Cy zEc<@rx4q!k)eFoU4sM~kO&w0fzHVfRy~g>$_XwMjDN>Ox4|OP6bVo+cfh z(;r(~h<-i76@oRwzHI`}%kRm@jG!L@}(9bWn- zHmcGOJX>Q^UfMeLlL<4hpgKlk?w$Al$I-Oz>-<;>`^V8#K0b)XO+d?UX{pqZ99j_% zlsAjx;AfRyi>2=_#^_t4rs3O3&!ig}a>s|d){f@d`DXh7yyt&u5!Y?1xZaNJsVg=_ z$aw2$s&<5k48h|$mj7b5^XNJAIxXa_rC8`FJzhD)-3m+P;giT`m0^RWvF~PV6G{Ve z41=%|irt-{^t##DRkNf2I6y`CyG|;cy1oiRZYvna8_oxl8^*7~vE(K#?!ZP0j+lKr zzeMZQ$Y0)1m%=5*j%xzXZoc`$rTDBxga1-;0;XLf=@0_MKtSM^K+9w!26u`&&KdBAT^3sro4u!VF?0m-1O?>R(2s8oA5zogju@-yi|fw4#l-U=0f_0`INQ$Sbi2z>+7 z;y-GqG7K6#&Al|6e6oJxv&Pj)!ZU+G-2lspB_a=MP9KF*lD_%Ebo3~W=U{QC+*C^}$d%6-lKj-lt3|!`%4r&0?i9r7;IZoo&g$Er-_)v(0|8|> z{wdfDzlQyZJ+V)%^B2<*hA@|U2?>9+PSof|1mJM^JKV;@*vR>cG`500y%BRCYAgZa z9$LRC+m>9y%~3{$c+2rjTJvoM8RG$PD%h|0iBtmCw6YKhm1PGrHg|c+6z2j}%e;K( z$B%Wsg}#3oO?5?D>fwo2@b>y~heaVXr3%7#pj=X)Asu8B|T!&{q_FBiRVBN`f za7jV@ym~%%|6KUUdwsjhT-Ikz%vo3*Np)v&jrVq$qW6ckgdUfF$N6@{BI3Hl1BaI!zBC-2B;7O!g1$jDI&qSYcRuERiw0^DGhJ#DCs+vGjau7Pn zPggMcCZ;`;Is|t ztFAD1j}~Y^3`V%*h^07-#G zGc?0kxwuHl!>Co|Zm5T@H0;m{@V9l295)2Rx9mU4Z1rEnK(tqxRz76dit2YiJGy1{ zqGc>3DRXBSI$W1lL$9l%Uh5chdduv#tpBo|aH%bMHMtsQxYB(b4G1{%Z7Pi-q4^#_ z2=PV>$23F2NTp7-q!&2#rtv=qPVENjf1_TKY{-r;l*f8--{$cv5zmM{xV{%rSF12} zYc1BrH<$ZEvr-&#YACyjN|-IW6@MQ<8GdEmM;@90cPY5z0r&GPegYM!3;zMW?d0I9 z)c=4N0yS%>?rea-Zf%C&*W#&UnRwz+dhbB#tqxi)IMZiz&eURq>dB6O!Q%M!<@A&D zRXnG45drTxe&b6SV}@vHzgD#;q=b34DC`1XSmYgho#F-_+4*?CMkVmuhTtHI{c>8H zu5n#MU2*-&Q?GV4HQH%(z(ygOqQc48zv+cAO8r1TTr%0dNYB>=fyouQqP7v#j0bH% zgfLp%fQa|0IBsF=&x5>*)B)u9W*E6n0ac`STWa)V?H3x?!)tDT~dQT>T}T++25-4(gwD_ZiGN za|uWBrCVB=pjF{+`a+5G`vj*8tliAOxu@?g!w$Xd#abLIda-kAmfZCcC%@zTe**Dl zkHlRX(=c`T6EvCEV5U)c`el)xClr)3Vmb7eLH=mL)qfbx_kA%Wt2s^dUF#kDo{I3Y zzJD3b)S<(Qe;7^rN_#^6OCY1EA6s$J%D=O?-3YY>!1&8(I)4jhi9{2e%j0Ua({28n z^SaC{KU*A&aY46Z>c2GPYxolW!)Q(=F5>l&BY)L*EF_R)eCtUPJB+A`iyL5wmL5Iz zovs7uZ4vO*vM7S3*V69E1mE^Z91|Y7+rVAw=jfsK0~t-C7-5dr*v-#vt~Lk(ouVo6 zrn1Ki%Jnqt2F*PVXfy131f4}ksI?Tcxc7C`%|Py*b>+ls#;>Exrl=&Jf093mPut)2 zYr3+m-rk1tNZDC9kG3}ZlKw0@BJ=*V21^mNc2|wJ$X1^156A!9I89N9D}uZIel&lI z@7AZ|8m(-nJs}|jc?uA$Yh|Hw`7;*8ngCuxsW@U~y}-xiRDv`F& z7G5wSE4AJo;Ff7VpUDlsZw-&ed6q$)q?F`r=;p)MZb$jB8b`3y6xF5|+>$uSt`5qf z39S#+u=V3)>ukn{VvDDN7whm_WuDMNLzv`ndwI|Ndr-HKWo8zWX>KCXiN}ea_V|__ zt2gzZ;hQ_2qcyEI_=hN!OC;XUy_w4(JC<8}WgF`Dh4)#Fn9X2q)}+#TB|vJtbL-B& zkH!}Phm+ps(0u}V=z``>;}PiN3)tk}t*I}FMFjZgzB#Cnysj9(LiLi;Mtrf%)iPaR zd`4}lXU|IwHboDKi6tzW^M&0Vn(k4OqJ4hK+Lk7cZCJz2@I2UQ;gw4 z>({l8nDO%-h`ra!!2MjKW_9daNhfBXee-^D^5&>oks+@8u9|iqPtqS-yU!E@Es{QN zK|sA~t)WOw)DLDO?da%U3)W;zA5JZ%>iI2@rHoUD7M?!nix7bpBz$#4)l`da&lO&u zHoy*)`JV$^?lT@ZNiX0l(?ErOz}!-w~ABjlaMX^xk|To|wgwxmoLyGhA#g-G1Oo|gb~rn9%H z!%es|I&`&aiMm6BRijP|9kyo%+e2{?MY_9rt>Xo_mDa8CU7LjV*~%W<;h40ngvw@>CSyJS!FolS@L`BXOiqo$vqSt)r$cR3bv`iGrPpuc1H;QL_AC-cLA|>&2`oTFF6~oOA$Y<<5qa_}!<9W+)OxzA%}mP-p2|+vZH!}rCDIk-9D2R zZICT94agU1Dap!3WmR*eHep>HT9G-2wW|@(E^~_%5bYOu7rkjCA zf%VyBSyG7=aUH_LtQ}}#$AGfF{AR4m`eTalofVbnBSMskddn*GeJs&?Kt5dl`v5q$ z<)_}rW$8rlB^$RdK^j3Lu~On33<-wjJyZaa_ZO69>zw~u+GiWqxeYKg23%EDjegUMcHQA zfly-2P7o=c&S8d(e`oA183+JRPdXzve%~lw%=;tKhLo<(i>z*bOB&!#oQzZO{-rl{ zdG;F%YnaHDnWF(k6T(AP!W^egH?20|M4|0HTU=r~t1c@EHkFf{>hM5=TyxFirlbJT z_tA#|H!3b8HOx7*=9(QTym+Ej9|p;Vq2QQIH8-4o!2m**z8 zi**JooYn#$y8N}I6o#*QMdau}Xo;+ai37y+yd5GgCIk2)6&Ps^9F@Nk2dj)+*(aj_C<|7n3gr#+GjbgQRJ&VuU#73 zQa^vyv1fMCgn?W1^hvQBsT3cc)Z?KEArGkG;RxTI3E?O}{(#uxQ~V%LD9DksCQE@0 z$8?GyHT5^i@T9GCpU$4-hvuWH1VW@ECh3>rTeEyX`s?fN^+#7dujYQuLc&ZAG+Hnn z=kXzXRI?&3ddTD#l+?|esb6@WN09+thqg1()s|RmcaD@Io|I*;qkMSjWZp0=wDoSn z8W=eaS&)h?%kZn_(zK3#qJv`Vgqi`nI2j{m*;B>%ir?T-W50fR5&-XU(=MZjI?uHVK06Yp^J;o~GoCEd(oc zaS)DcZy-+4u3?BA?4)6sykSTce=yF$<2&{E)kw_SKa?i$A~jQ=%Q^M9eGTxvqFG;9 zRv9b7O{QJOKWRH3cPSWQwZx~`jr&h=7PQCNkvI?9v$kT@qJT_}@P*MX)hGrg24nWIyd?C*_xf!kO45tXKB+#DO{ zo9w<-3p6JT0k;2@08f&kA*kdEdZoJqZWD9(8qK*W=CUVoQT8ex0z0UTVQUr8NK_fX zCzi`=wOeJ{uSgv``Lc+=y-da1un@{ABg8|0ERSZi$}#FcY(9B)+orublrG+GaV3N3 zv@1=4F&2%=Hb(;rOu0Oa!6GB)ma|R^sZv21+h}Ri3`9{;yR#djVpY$qYv${;Yh%A4 zvRTF}u|ZO`{{4+9X7lCOl~D_>{DSp!9--Sso6NwR$U05Y@}M z)q_@&Cd`|)>0Z8}PqMQThBdGR&YZU7`O9cZ{KIG_Pww^pWi)yJGMZ{3Vgmz!(7%kP z?Lm8gy?n6wPyy$YLZT_<`s;+OM_SK2XHM4r^Dds2w3tA-iG#!>HWk^$MXb&enVzt{#gRpFHn(QEOI$-G$eG9Zhf#!=_nW zCgt0|j^=(;WDX9mY(Ej3t@sWOZ|Blh~$OkVSwE062@e;JzBo5Z3b&Pf=VR95pspC?oYCz&#N|DuJqR!6) zVNd_ugYvfrek&B#K!Mgp_KD#paX{!3UJG6bI#=}{pJn`J}I=6UsD#EEFu{0}u zkw;uiGA_x=uNO8O@FfJ&C1t%eUC1t?mDEkqE9K<)hNp`v>~4Ys(<=8Jo|c)aGZh?? zAR2PGi>y#7!iI}%a&n#Uc058!VeR!*TT%^>n6fQGIcAP!%|9zY?P<;W;`JW=B(n|? z-!(V%lQifC={piE>0$4G&xZQ_!X!NC^ysQc1l};~ehtlu7}>XcQDiIiNV+#84*TL; zU&Ua+(O9t>A>J`c%yHI4hQE_rtsPf~wLVT@rp`j4zDC(ZQ^1&>hedwM z-0sNKny<2CvPEy`2r>I{O(gKn)_YouI$(`mNZX6q3OiuEs?s(;-x{pa(lTXhTBf6P zvbx*jOztkkQbrKO4!?s(qPJ@hsPoyFgs`|oD|yveRbtMhQ}|UFQcpXikXn_#ZZkoVELgb`+@V&o;62*ONnZFQVyi70k)JIg;#$>7mwqE{(3fE5@t9 z2Z7|A-Rz9Dxa{S)!~sIHLQ1*WKWq2wtw*I!-9KvyCxoVsY+X0pF#~0$u%yQ5uebKSDRGV*Dw07RARl5^{FkF4?Ka6=F6h&Uq^E< z7kX|J=xC~|!&Mo6)}!53F1anUzwM!HWJ&xO>TQv~7yM(eC2Fq? z;~q|YC+2JI_$t=-wK!AFN+#Kwf!spw2)b^zI03125uipnFXDS6_d(K;fY-*h@v@Ye zW%g&X1UpR`(MS69Qu0QaeuKey$1%Xbu*U$VG`w<4kRsKuv+AU!S>egbP@N#@JCjS0JlV4QM# zdHcTMD9&g=#UTy8Tq1|)A@+MBdr1I0hsJKiv3;bKR7nqb4Z7jfz&wdT)_wvfK>D&3 zfcLA4e5KwuLVfoDZ5Ycjz%67F4j814YMb#^99o)HCI-If zN{RR~TQhoXP$Md8D01E{QDTg6F1_u2ZY=F#CjG3JKSU;-ur&8VY4dLTv67Y z7UiC1(Qdk?jP)=Tj$pr&5q@a8Nek4o(mRuuN3hdi-$h^TZ95D{`6DWsStNQ_@?I5z|$sgU;F3y7pGua zn{&i2T8SEjy&xS!1*l&8bJi%D4A!j(w;8(;<5cMAjUB4-E zEce&qM_pN^epl8nEya14X#`%%Js4&7dQ2~C=RChL!_A(QHqv=J(bPQQr{nqXFlH2x z$kTS_q&5LAC#t-)9Z>BbR!U%#az2lz>?A^ghpNt^a?_l;=Uk7W`npnCGmE;ZJ=@8M zmF+fbfURcxX(i`IAH2g!n?xYA=Q$LiRsfPs>pMHN$7?9tYXE!dhy<&pT0tf~nVMad zO&;d-WIN^ho62GHoIc|xNuwhPb5t=`<~ry@;;w<{qE8X?RXb$i(IGujUrok?g)H!v?cYmc1s3^n?8$lWA)P9N>%c_#<}NwdCz^f)0V}x+*g@6&dxE0;KC10 zDZ_-K*Lt|90o6*sfV7^T*=O zmJdZGT${VF#l#Bl1bA|_tBZg3C$8IrWqCtpXYJ5#1)86^%v`+H)-Cikp)JPbe9NkW zF@vv-T&X)|WPHL0QJmvm`>0|*|bhn?941PfV7vUd>~&^Wthd@zXJ0xp!4RmF=e0& z2VY>}Hf-6FMT;2m+n@BWK3wHAEZFX18WaK)>VD5VvXH^(j}^=;KZxxhK2wU%Wq(?H z(ag0>92Rd`izChPH@&vjLYeOS(w*e*)U4CaYGf^a^vr6%d6l6yCeBa0!e5?E?ZcZd z%eb3jC&2>9#VgaMQlZ>{1~o@8mgkpsra4sNKSc-VL@3h$XvDNrkd3}E zfO8kJs%6cxZ|}D2d|{olGNItGff31We!7asKfvAqu0zbaFHgtlbW&y+sC7hL_^QiL z|7~fJ){yfFv0S~x+%hC=3Lj#VTiWW6g&b`|m|vC_liKfXYpvQU_|E3tfH-820}iq) za&7uyn3TmeC6y+D2XCy34xW>P(M`&d9mDZtLsEd+=`)U7(wj}1?I9PdS3Ul?{oA;k zq~^GF$)D&Gwyb+8E?4|JH*&>(f|EH*v5|CGp)kxBz}%1xpKd*(U%}l5j)|SzlFhQr z#y1LjG?Q7iq^aP6pOkde8dWo{@9#6Zr9mMuZ8|^8yLEM9Vq$$iUsaW{>rtlL12unJ!N@ zOc`D_T04it)~(!NmicRvt!N{tF`5-NC7R3{a=buEEr1IhuyYP(gao+jD8Hf(!}@$t zo&FQepURQ{|L$|xu-9^3mz*nP>a5&JXKx_!Bu--H=G-(ht+BTbHzMI_H;+!!Yz9dD zGHh<3rqym^l(}<+6Z>lA%x}7q`rdF8{~d04NoBp%Tqo7j)TAm4rSf!ivBo0=-W}Y6 zG9O>jlTF+wga1`_4z_pTJnW^o1$!ngy{=3Pi;qZ(M82u6VydIwTZ;Gk@WYREfZ3hC z@t)abdn&Of)eowo+4jL5jN2Dj4_~I}>vnX-)CDxMk|&eMNt?vz&u#!=mLqvr2?tuJbR<8ib0+G$fKI*KV@WZvHI$fMR|K z6ouh_9~xMBK0S?0!8)`HDab|(3>Pk#z#jEM^o@Zp+TC#JyJ!Wdvb&|NT637;KhmsK zf2~vAHk?yKV^3&5??~5<$7XPiX z-PtLb6_Z(TUl$j5l0f?#y@RIHs{4XgJDO&Yh9?;S!Hh&G&1 z55PfKw^dJ7h~x`ru~I&A8tE7r5{@9J%7boH+{azBa;$Yv%{R0*Q_8agCmC*mZ3bkR zNmFn%?aj1(W!jgOD0bEY*B6?-AIF=5v7?mBEGwh^F0O&pEoVu~EbSZmLZuj-wJyo~ z31e`F!f!od6%-@oslB?HXczm7I)m-EZTR?j>`214FiwZwaldx9N?8Adxh)cG#qQ?Y z#-4%wJMVO~J%_8vu1iB{kl+A69QOSJ^Xf}{oXCpj?3gBS;>NLAo$iLS!Fx#H)1{0W zRePT@OZ&=^m^(&x_O(Pg7?Bb$7nl4ZnyHFV43_$tU%jt4Lig|3^EW1?KqqyvxWS{G zPV<2)+q@^ZTtjRO36xYpMC)b0Qyv>N|>1q$QvC%)HXdyaUhFF$aJ z;g380&CiRicILM!JETvKr-av`OGG3j#IE<9g~O$k!_C{ioGy&>GsMsPx!&fpw^vb; z&`{rZvQp1W;9ggOe+QnWNT8=785y~B-CjhqV{Fj$wu1UBlCcSFG27R!QsE$hPT@Gv;T{(&1*BW#9nh1iMAWk=0Z7vfV!! zV@zXGbZ~Hwmu~9l!Lg2wwi6WzIwQVAe2JRn=f+R8+eyr`Lq`H!wuXbdo>uPTR^ytZ3pS8H}37*G|r(yQQ9yfRLyT^4z3;#zQoc( z)&|i7Wi`O4CyDgpq7wtI_sUXVSxx8vVd|ZNLbh;(l>E@}Vm$t2&}P>Y;OGt_4Ds4nUP+Nr;;8FpkiYfB>Xu1- z^tA;u%(t}FIP#T4cl^hQC2T_y8nY9I@XPAq(f{=j6xTUIohh5DV_=&a28ob|Vh+&| zV>D}KQXcuzA0?$CA-D!_wM&1VjC-QItQr%-AZ>C0l!07VY@L#D84``sT&uo5ZXy^~ zVLaa_k^fG!q+^Rx{xKM1Yf;$032`Cj9CNy~GBP0Pb~Vi_P`Ge9QnX!(?2yG%Zwaz3 zr#t0+*d^jzO9vgp9{?gZA+^~ktE552eg~Jrny;%mUz+eV z)$O|czze#6PDT&LMmyEBzpLM%cvppQWS(7EFf6?ro$FhuH7VF+>P~7>?C@OFFZmD= zcR0qNy{3&LH0X0DsC&IPu&e77k3h72+l=) zEdwm7SVx>L9MFYZm`s;4{ngZq5QN>}Aaz}x>+i9muoNpCFmzNdNYumP6fvq|AcNw( z5}+Mi(yZ1-kl`RP^&=6hnP(M<58$g^;3y2v5hRizEJFVZR7PYZ4f-NIYDM%!O4vKz zTojQ7zDx~C@SfZGNUPKtqPw}a>DKcIHbNJh=7;4ZsVJ$BAbf>iXGr}Lj%J-vp^Ofe zj5CBbqb1YK89$`b8PC$%i5lB6vNqw(Pc#t6Et{of{ORqy?%i~6z|&>ScnL4vqhE=h zE4ua!oFz>gu`7T^K^Vox(;efjHO&_3gPCrPJBdhMU0Unkx+~TgP}cI68;(z))>11# z1Fl#xoUHBz#XuHw!i9B2PT;R*svmpxw`_RVP_Tt&0|Q4RHl`|)WvxnlS#FSiL5XiQ zE%{n_Ooy`zOXN@D>k2&#k$6KK|0WO4R>L6VP(nE$n^ey>-j`3R*Uh#k;z%)ZBc9r2 z&ww2hL_v5m=r1R|ZknGGA>9kma!lwFiJMM1f}llV645EzOC`?ze4FuoXL^n>&$0;6 z%Kaq`dVB7G9{m#ISRxDU`5Sb4`$ty}CIl3A4*R9~JpV#7Vc1W=F`WMb=fIIt9s@Ao zQo>_F-JPo8!~b4Wam_>On$`wB0Krk$*AcBTB;WqB_|Wp-tdIE=pomkqsj;H7fk4BD zsD^$dX!%BK`5KMl{Fgy*<4(Bx)W?Q;gBFbx;LGCI zzoAV|{U!5qg-(v}hxt>Lyy5zT_yX3oUFQd=n>)6U~qR-j? z>-_?*@A&oYt^OzSKT)x8sja`WJ^Fir`6X+Z9hYJDeYFGA=uHG71h&l#&+Bjp4O?cq zmrXb&R(AE)409lieiy~&$>K(9?~m8VD2k5ikK1+2UmioCx{J_()leG9d~V?R_iTXT zhJ!L}fLUx1kSG~>B+XMe=?mbFLrU4kQT%A(6G8_&xx+po-H&IH-HA}`C*NnWbK242 zObz8y|MGP^+u9(^$WdZ~9PaQV!7t@N`4}f#@wTq5`n-XQ$WNHzTWDrfgCIF6V3dFt zn0WQdx@!MLowpkpi9E@SdPLN&vAUo$R97|6=-t$^8%PR8Znv-?R3pp~&Xg2DiHo2a za8cd6y_L8$+-YiVdI-katG;MRDxgw0hg{n9#`r)MT^UT*f3PjH*cG8eZ-`7?jIk$1 zDh8gv`X&m<$e<~it6;1RDJ;vIM`(cK@kntc@ZUe=V@3dQM_4oo-2Kl5BkKMYY# z-VfJh=!ZA53rECA%!(Uv_H8|ISLZBtWEJ4Rx!e%{l2?f2<}NQPP8RAZR!qwkiiB}X2wLA{e)$(Ku-_;Hagp(O5y ztW`mix>qQIln_sB(pPNaM{eq=MsC%f%Ky{Y|CJ(_Z{5(?%Q5nobgbe|)HE)YJPJ$< z$uno9p;hNkZJ|yiyeYn?LUG`xrSw`n&$v3B;83oH^%QaszLhf-YrKTq#ABbZme9By zToiSwUNo>enuYyQ;6>zEl8Pgu-ORxQ-#0a+I29F&Y(5@CGyOCB@vD+VpTB5RNrt+* zFiD0w+DN-jip*S5v>~g*ywt4I>%|?S7>|U7*4_Pvkalyamw;VqEkDMkWSElH5$Pk( zWm4qMnr!iJdRRYZ*w+Aov@idaj=aB<%LH%m$5(zXYRhUUcykHgU0dF>xC>wxe#?3L zdaIdq1&HxaiL*SlxVFUHbOL{r^#@?6`!+AAKyjVUPW`U<`X9hI~lt z;y`jrhCcB0JdHGa!*@48A`s;Z5LbG5V0vNNkB0Om)?i zDyK&97+BW;#mitXV&ZuC043<^I_>q&W#ZJ>eYee5lF^{EUaC20$1OuZnTU?)(B#V; z{7fN{%^e-)uyD5OB^?^%3lsn#`IE%hT-x(n(8OPsG2EakBH+8kk#nzckK)LEXlRE* zyY2}fGrXb#Be=x@e1aW~YK^O1QJ9OhAw8s4* zMlVR3_V5wQ8#v7Z#(CFc2E5QOu#gkgvGSrv2}~1P^N%iH>!Hp>coggrTaL zfz1apShK;ecdcN4E}l!~xND-kE)S$t<~5@yp%9sKk^3mtdAvqw{$a_ss{5?Euj5f# z!MGrXvFuBmWo2t|b*C@;oiD}Z_A~0O>dwaS&8u;-mUu;CS zrWP%Ud|vO9&MPpRKT&9VYkcNwO1gQBy`p%=BS4ElYs6fy)hGHFOWPj8al8$&uYuCA z@yat~Jm3t6cc@XqxvKTP3h>rq4`G3ahj%7zilJ@EA5t*Bc-qrk6^_2hAAXSEdn32u zeULk}ApH0KjW@yzPgsU`u(iw^+5H9Pe=$vUv4lIK@wV@0yb)QKg`=8=c*5QPb=?$> zwyec_BmZZe_3w=5u&r#++HWZ4|8KkNk^k=cyMl~DYl>xCJTi;7GcK}zIjYk>_7|>t z^skVsb?XL5l8T_nRR?p9z%df>p()J!7*{Nih3ekjVmJa3OtjAHmo6aA#+UnpKn4zx zNV1fnyif9WQ;5g+?(Fn=Ha7=nTKMyMR#=EPavRHs?d$Pb@o`XiaPaHs_IMiFnp%?m zd|km4>S`V7@!@&**ZxX^IDCCw*m;q;fDF*ZV(ST6fU^1wv7tWIY<+Yhu(YC2B7hPN z>k_oRRqR9qAt@6mbMCyndt?jvw;bLTQua$SA6XUyALw_s(}xldT^&7YQM8EfTEGVo zagp+{uuT)jScJKe@)lOwOF^4Gxkjfa7|YR34sG@U>S}cOx!;?^xA}qk6>gxeZQs=y zC(zK64Hm*Gv)PPS&kw|!I_e{86n6EKhk1hx3!IftI~lDA{KmC+z&&#+<(%PoRuMeg90|Kg6) zr$3t2aJ7;MbZ?0h!*eGvP?iJ4AN7bx*;kApk#3G3NQq=5z zJZ&<~%uc|}lH~n9x?Lva{@x3fy)QSI>G;sw)J%(S$Jg8E{nC@=ua0Dh5zQ%e+}kES zN*!wN=3m1^3m6xU>QN%JHZP^FW{D!=NHIh$#%~8$qpF?6(u72XUKTj-FpXaPCZXVi+wWH=NvQ@PX-p&ri`)p{qBS3&1rzrsA%c z-DSdDXr2E2sEnqD4hL8D2m^MvMuO43X_mNX84Cq!A@?CEapkkN;7|=%g8MAR!RP-N zDK4v1Px;c1v9{mF%>c(n_Hyw#kQ6k><~m^+`KZznl&I*93SGmc&%;b%d*!glPR6ZI zqkXB+&kaz;oBI2;A8=~S(%4j^junt4!@L#b8!iLNJyQ;1tBhAPE$TMvv-h*tpiNU) z3Z$h3)9IO?Frz8s$(ra1Nq2}1C7C;7k9Wch-b5t6+Ggg&hqG>~gw~t4{L_R0pCM#` z9Rd}wR&-d?5PNK9e%mmsHI*YBpM*&+9%(O+dA;ntA&W|zs|oTeNQ@3(Ee)?gk8G=$ zXgZOiVRJhRBn6;J6pa*US<4MnewcJ+i*jlxedZ>b|2!1k5rU!!w~8%OOwB&#P$;NS z8*(76eF&y*aS8%d=}79+nlKt@d(x$8`-su^t(dUjLgBWM<5i+m%pR#N!N^`zc=SUx z{MKw~S+Xpiy#-98=dbJQM+q_JpO51ruMnqJieD5)czJq@Pmji@A26`H{7ZVFO4Kl5 zpDC|qbKcdbupLJc$wN$0ew*_BUd!wE<%HdeQj+ObA+KHs7&qPt?QagIkZgP?&jH)}#jDjhv4 zK)XFBj;@_BV}-*h!J>D>7u;rg)5h?CdhR7W5>UB_NGF@5-joN1P?&|Jvda%k7z2zA zC+F(5k{dHnEBe7wr;kduk7UH>EoJG03$27y>RZnEEB_t0tR(7ovz`IdU{eFhejM6R zLM)hMpiYW*Bux@s&JhN_DvCvhaa>X>hSYLr-YCC@e zp+g+7guWYvhkMu&hwYJ0P;E&~wZr6^U=!3)p`1mc^z%2!GBtmM#OLL$LK_zdhzp%_ z`gs{1D9j>6+Td)ARog6X24Rg66pq(*oWDiGi;fBVz**6J?l7+%Cxk71eu1dh75oK< z-~{E|aJKi7_l5XAdq&9igNU6l1e7KD8p!8Z$i&&jR*SZn(%b&ZQ9mjGxasb(VR1eT zQ#YGBT?>pL2)bg3HMLGwSl)Y{UW1~)9k?By*V3_t^p~rX95`hDpy0K2$wbw6H zEdgx@0$-$kJpEh>LGS#_p!Lbc+^CaU=j|GeqvstJu#=h1J^(t5=OIPk6 z_PhV&*jB7c-g0KW`jR7t*wXGsNgXL}#^yoN_EHp|Bc3 zon|D8A1jDqaoezWA^Vkw_z3M4IR2TQpMTJ!qQw+-IDLqGIMO@>A$amQ^su>bZt>fb zpe#8j$AvOUY38CCDL=U z92c~G%;!z$;mD+xi$Om@+GNtz1ScFE*O2hj&!DNL56K_#m?xHvabzEfH@@dIhNV83 z{*^DQbvXDWQoshz~yvQs??G;pz3k5rn}Snlb0P_~oJ0R`%OJp+^M z(ASUqm0V3#XLmSI_y908Y?C)F&gEZm16q8R?7vCjQyFv$b78a)aVmorw|*0BLI$or zj}*JoFj;age%5{#_1iVb%)v z6K36*q>^=VrpkI&&<40{y@sX~sE_&n{~48`u7=zH*@MWHB=pUH%{9u~eDBx3>*#1U zS)Pl7b6E%e>(S@>9lR6=clb8Y(R^lBr8Uvfbn^bsw=&$_XgBkE6;A)Vd*<)p_W!e5 zy#IS7F%2%oN%qi#f<@daaWMXri-PRGO2&!PW#viDl>nHGdxHucv=Z68Nl37BI8e(6 zzkD$qk${XHE$@dncJhFENaV=E$7@^NOM=NWthp zh-n0<2Z1kHj}BlE216)R9Y*ni#5xwicbZd?msAebm8eDSfpVoTgK&SgtI%V%+h*^o zo(p$b=DPgeC6@~pwOAoiU6%Z0G~&;qqn5CqwzTBA4F5v(;lliBh{BljtKQ=F+FSnZ z)J?2OQ*au#@u)o3mY_tR&XfjkB&YYD^_>?I#BoWClq=ER_3G4mR>HK?$UdOC&q+riVqG)qy0mFSh%vRbXFgKZpT%q@^;%#?U*;H3vh{uejee6-|)&(>N)4ZO#B^o1kWhGK$CJiYUm&sn^ zJlJpFKGxHGNwm{VYu~*cFQw2TUyk=DTIU}jl|wpHc(ihvxLfq~HPMl!094S5^)Q=1 zZk>SsEyKFmA?0I)`&(N(9!G-JC{!h6X=S@CHG+DSp(*YB7NZ_09aV3mfz;=q9Y%26 zO>-g_kftmYtpN%Wi2^1s#4Wo0NnEMW>lsTmg)H!d1n}8RR-k;;X6l$YsQb%Q?_mp9 zODg~&eXgTbGUQ8fCYmC>-qfB0?HQq)&8fGxFeJE2qY=#M$Uf1dl9RZ7uve8xhL zZ*D0EK)|+*S_e|f8#$~b(MO2F_1uU+)XzMmX6?EK))a_#Gqsn4j_{q&5d zDq=$@`b0(pZ~C%u)a}gmYdb0Q07#f-=Z;zDq3F`Kp3osV2!mAWQQMk8+#V(>lEr&c zfIx^<8%Z$V&K=_CPRBvr8GP)YdBv#Gd{xCREM+zBwl9rzs!wnH+Pdm3^c5FUJIeEJ z^#41m!DV*U~{Dj3HBdvum9y7W67KsJ}>aNj*2u!tIM7rBnuP4f2m!v{(7vg3=s zP6&dE%f`#y4jwd5^mu5Blm}E1S0(?#*Nn|*@(d+Yx$Q6eOsxOlVCL)H_$zXpe>FY&S?D*Db6Z)`2>6^$9 zjGA#BKAV-XbTn6ze^_mtwy=)w>pK7?8YYYg`wgdt#WMvS`;U++~|izJBi6aE?lbVd&L8i?CqTL@ZV}f7&%^|HQMB z;;nFx7c2(0Dp^!!%hs6LQc{5hxxo@4ukZKmEVF(hd?j!zXH$gTJeL;5PISNGCDx9Z zu$!@pWfRIWA=$t*)k0pn4cD{7LkUxuOBZrV0x3WvV%bw#P+8FX2kUGLUsze8Ao2;t z({P1E$u^iQyJ5StKEJG(Y1_qpey(YKCsc+UTFx~wFEWI^OVyz`1;fYf7s$ch$9IXu ziw=QsqHd;NTkHCls>-E@CLiS9!Llqvxt<_pa9s26XD1}2aCLO%Flai!6s7U?IL9t{ zh*EolaQ*Ri3ut;l?0I>f#KUF7@5yV?Pzetfo$l$;_N+gv0jVx{xUn50QGMwiFot6r ziAh@Si5U9uBAF5l_P7WzaimRCR1c2-Q+y8TX-g;w4&F>fL&a(M4;9Zx6c1(KD1c_s zYbr;f-JtxMFqm~?W2-Uvj>aE|1>o71!g7@K5{_J4Qt2nY=@0^4~&-Q5qoa}J-N-6yZf=4-izjy^&SKB|5qJr|K zUr6slIm!jCIWYjNi>~eC_&zgLuVswHJxHSwPK2dCd9X4K!-~tyDP1cmS<4QkY8mP) zeotfY16f2VCP5_w?jprK^b-`1$a<+UII&JnIWloYapk-@n|}(}@xthATaVnA@0{7~ zrLA()aQ9T1!`mKcL2yu=QzzW=ELZ}C!_A(av_(dc7jk9mGBiGSbHaeY9o!WB5CT}3 zf08Dx0@So@3^6-;qzmx6Lt0v_POeI+u-?->uOb7-4^UhML%|ASKAq`)Sm0{wPmdX` zKqM=s8GsvE{bT=81h${_#cs9(NP-oa;OR>0ndf)aZqH(rmad2YOoy)+uEUNRM6>>i z=n3>Y9L4C8X^RWx$c=fSN4WANC*%FcDpmZm8t*CJc?8BDi8v;wYmZK{-{i?*f<;6? z+!ge;_n(~53@oNSLR*h-4)J410a36lgJ+3jU}8A2*|uJ?e7Zx)|1g3Bp{1u~TK&9v z53xv^rDEv|f|(kkpsy&52(m!$p94J52xcHV2vDnB8@TLrx8W`;olQMG$Xez7ZKITB zbWP;qc%BrIh>{2}Bm;ha7)bGAR|E4px7mL9CbYStayYu@t=v0wk%6_hAk^H; zn;Lt81|%622IPd#Ft&RbBN>3G`7DMWewytEe}VcZ%OHyB;(L9bdP-c~KH>5HyS#=w2yJ8Fc^gdi0Ww(Z=oz5WGc)k^?Q93Z zd8;G^XOOS|3C|mIp6TpM?pe?RS#-RafVn$*OxIbJpRT!73AAD{&vz*^#PF^KV#eVh#?g4ICL@4n4btojEnl4UgnG_+3XMg zmCO6CSFoObAHL#qH_jDyv>=TP(C_ca+6Th9)w$fv8>hDWiO6Vj!xC{Jb)2TsY|_l4zL-YpKNN8z^R z#KujOD>6|yzjM9H8re*T`R1IkO4O@ZX`rDulnw`_d~&H!n7QgBk02>Ld@kUi5Q>*` zBV4eo4FFTRdQ)Xc2GfvCR%aEhE1Gxj?gzFN+56KFk_`qk(B5Bf+1xyWem2uY?>$Uw z?(*a;nsf7TwjfWFtv`p6YQGLCd?`fTUKKLhKL2>PGwfuqnGXTJPAgD^Quicd;4-nU;l_mDbpW+y+B#M;%lzr!FS^&xJ$42#x72h zG#jeZpY8}*r8b%#4Y~+XA}Ej06@5=w66CaXBpPhGCdNcqY`r1+n7)&1Z}%vwDM1_~JL ztuSmiMaho-ti}VoZZMk?z(Fi%hoE!f6L!g{m3$0LSHw zxyKVGw<>r=i#jk2MT&Q0Y~mhzd8ms+O261&IY7juuPUB8o!W0XjXKSUvvph~kkfPy zreZ7Ea?q-4A})NIE*!!8jQgh>uS7Swhtv9GC(O)?JvXl~5CIjnG6>tox6asNveo>J zv*1Q0>2v=z3wY^)MJBY-O*-+S7Uovd_|K6h@ojah5mayOGmI;Syn=JWejT<+GgB#4 z@K;lIleiH#s@oZmw2tFi)N@oXRzRzdH)WfS6v7mxnPoCxFoi`4{z+6z=`$~hoWQ>Q z)qp9|ztIc^*n%D+uxFUb%QXfA)-S)R*t?C&zLtRfZcsq@bG^7NtiiER0%Q`XO(MHf zsVU54eoy^aROrNAK+4a4Kn~HMcZeUQgJvDx?v(nHmY$4^naFR#YpJ#p^H|wMt*nNu zp>QkPwT_yC^Wt1*L_AXc!MsJ35I( zxptQUs-sP_l^OF7muyurR~Ku=`TG^{}_O$)&SiVwY>_7W(m z_=j7ulqF1NyGXeC79;=m-#r;>P_UHgpo*KRqjpspCbDXeW^FAd22{LV=@q_Rz`_~g z&t?$ez@B|cte3}U|I&=NG>yrB*LmkpF|d!KwP@=ny9_@ci|t%)>Xz$$vr;UMIvp?A z3S;EdW8E`^`qE6YmIvCv>?Q9IO_*8r0t0HlN8LDN#GHu$IckTVB$MYbUp3$H_h) z?O{(hRlgQ3f1!&yt^|CNA_yYI8VJ&~n26v9(i>Aujh^?a+es2uu9p^lZ-Y8b30R@C z-`afAE2vPUs#`zi9CKska$DTqC7um+2IaY>oiy(sCXP!4nZI@+bL*4}@Blb)`*FfF*QWDu6gF#bluaP!&vD zsX4~|c56TpF(9tH5T-EZ%hnMH4<-E7W?aQ{7J%Z^59Z`Q+TJA|%_EsYXI*u`=Iq1f zuHUEjRbV&#UhsbXdP$^|`$zRB#)N_NS@+ zXH&0f)h9hMXe|f0n$Q=6Tw}t72}hx&vAJfdb{*%lzHq3BJxl#D;INt7e9!rL2m#H`1}twY_57h8D}oz{MHHTonF!05)#SNNDKvi>a+m z)xW|Xcv8l6qKslGlno(_x_=Cm!Bje}Z>)d%km>Lz>0*F@#hNR?9^O&}B#Fvj+Ziix zP;>%>5^A}@`&hZorO?#lVNTw*xHou>*;dmXwEr zXj5j$k>0$+jp^A8Ng@Y7YI`To+-c=BGL;kSNr>$b`WvLUf9pA)p0TWk|1yxDz-f(% z)mgG7U{V~QFUz!jN!=fENvF$E;(a{gZ#Avvwth7m=m)-0F`h+U6K3s^mn~N!(vA7z zeZ9`r6duUN#`v&feVxeS;e4@&_Lnxwa@-Y&o}=05YPA1 z#T?w_`9C52k&)bQUULuG)8)&MjXdjX$$FJ7pMRPQ2(-*?+ z;g6oBE9Mt|?Y$r%`;zYqm$;7!K15QAo?q44ws*U|%F?DvZot$+Fr!&dO$5Zzdn?mr z#_+-`MX-!K^?cl{5z|z9lYxm!F79f?94J{of!@|e2|9H0Q5D4x^+tc174ncW$P_f+ z3?-n_`8z}h(^BvehERMFv>QYF&>P^$v;3!O<4i@&^`+V>fTof#=u2IY!XKK2J_%{)2Oplzol!J-yOiz#3IJB>OAR3f- zMxgDfwRr}hT}_;fKfFg*2g5dFI%%@%rfAezFju(qUS@d3F^;Arh-MkL-PRK4INKfh zY@2B48*i$BsKa&C^UHoubIM+2zhr2dfK?3=lt%`VRE+F|lG>$#6(AU~M@{~4AVoe{ zORpjW^S*nB$;8J>~&FOXy^+e(GN7>mt;v@uPu&BVLtGH^i-X@ z?2ZKp9Dp)$6R0=Ddcexj;_?=rp;DhYj&q*V)uf^-b-?OGs8-fP8A}bIbvwR5P`&r3 zqV;SD-{J;1vSEFKBNmNd*hj$XX}dx*nL|`#Fi>pN)=PezQVycoUyM6S+gKz0)|BY9 zFCW1jV)faI#zcuPps1P_q7B54e8{v!vDkF;wW{0NrXep%Yr7s68``pF`4oVsjjGOC zY3x;aa=G`uGXY4MIrexQ?FEX6+DfG06YoY{TN^lnZJAr14|%pTQ~jGNcQQE)*Syc8 zHMZ0Z5d{DTMC@mrGjKFj3b2PbIlr1BAcI8cu!RXr2qGN&H8RSC!a}?v_O9LT91-+A zyE}uUnFP9Yh5!q`1MYIs%V$o@gYp)J3U+1F-4UiN{-Vkem0qvSgD7!osJ zKH$WDhS|z|=zHW1ZFjWuh`BHWa<`SXN>MC2&okek1;0U8RBvt|=nJW!7^FS0@m34| zIfbgU+TRn42`nuVj>*11B0Z)LMAv+15^wntoZtx$+e4J>q8Lv6H1M#xA(H?QNa}d9 zNsWb0!>;(uo0$G~83Hfg5l>cKZ^IxZQNv89w`Gd!KQCenjILHo)*9SPLB;A&h^Qf6 zs|sPtC+o@6bsxc7M!sv<$DrGsU55*gVZ&FeTZ}TE&~lKF-HC;?hJT+z>k>u-A}Gql z2_l7|*sO`$f7?f^4eqfjkNrK2nA%wb-mH zmNvA|<#Wmi?BKDKsZ<3i41#+Kfscwn9Vw=sS@?(%4Qi$`0JjjyT~eku39ARJ6IzF(_E7>&folSTS> zrls3zvDfr2+{i+Lc7lym8vj>GFD$m^Ys?^OcST_|mo7gvzy<65mKzn=T~uvAqnQX3 zZ>VHbBVuIE10`N^QL@1mDIm#JQ&NaAG$jvAp?A3yn?-*!G8;&S)K$y~2IMFIp*^Vi<0dqcme!k2(-y zrq|_hW-DewH(8%#@{#*m#+i?;>I;krV?ZOmtlxkl4$2~ zSgJ0$t|YvjVjj~~^5+ZdXxwSRZ&`!3^cX`e{FV8(p4w~9<3rT-E2 ziyTrHog-ZUZm>*}Q+7l3A_A&b&stR{fiLc+50JyocP=M*>Sl_$%XO@S$LjudEW%9u zQZf8rYfv^M#B4bKuBeHT?voK?(J)hOaaBQ8Klp<&ZXZO%2}X z=@PIayn((WNb3J^m45Fp`M_Vr1Q5J5ZEz0!H0&%Y7TK*C- zKO765rD=1-l+My>1twN%iz*9ibXWNt?v47=EyL}=QWP7nJ#knKRNxo)Wxj^U#JndD ziLDwbo?39w$GNq5Fai(Xzs^!3{{S2I`>oZ&ys-$2HX+OhQ$(p)ujf`Y7ho%IIN*ih z%p?@g-Fle~a4bS~%c2ko%{kj?(`o`WBv|D-DHV4@T+Q-w=A|YJG7i&S!L@wlt=un1 zJ5iWNsba!`iNVGk8QBN|P151Gs|3T*P|Tk-T&__;0?Wn|OPHr2I5L%HNBN1yo|&`r zI7PW_i>UxDc1a{K-EbA-V#Qwpu6sREX*ma5!)`km!V_Y#_Klrb->r|k;UnAXP56m) zS9?K?rt{AaFo;EmzNTh(xJJko@Da7N*ics<3~IG$daa1AC!Ru}4{S5gSgks>B3<@U zd@p$eXZ_XdSJhDKam@{wlw-W1QltPnHI+lu*K?qOjAi76I1#a0Q zRIu#ID;8m8EJ{y5{-^UQ1h;(FA(i$?$~c!YywwOJY6s74M8T0}Ggthyc_I0=sE6My zXvDRj9mKrzbtWo9PzwC%wy}O=he<~O=4{I^DSzl+l;+rM;K=yMD<8Z&D9_(2_9HuD zXLATq%R=j!KVe>>IH3}kti|T=s{jZ1V=&cb@B3q{BEZB8c zYU%<|EGNYmxZo`-2EcE$n5>&!0*jJ0Ly*4>k#937gK-70T8vK`7O#idR$R2FkeN1; z^LF$f28XOhlYg>Anb7bG_hS>O9B9HSFMVKx&bjW$xp+)NVYsnY7HIrJ9vVc+E0!Uz zt;)9n2b2u})II;!(!E}Jp_4o1=Vwg0iJ(?y@S`MK@xq*eIe>SJU(q|O0c2wdRywoq z(_pUmxR}M+VB(cO!0K{@;p+;P-gn3&x3Dibr$drO?av3Kgv5N}4J_|TeC_~R5Y#ND zWg-0s%q4&^C4tsSg;|~)Eyd|s{PahKVL~ju)fPW=lD?Ph`B}A{thL5-va_2>0VlIe zI^NX~ir5VuX!Fuk8j_UVrQ-3sL4u$?CUE z{P0qQ)N=fV-K;vQAPsGd>qLQP#kZTJ;afrI=etP8#TRnKM7UP6w_BzC$Mu%0HfzFs zm6}jKl)jzE^=w|iqF-2Lk)yc_;8u@ctZ$p9*@=qybDHlQ#Ixe5d7XjSaLx`c$?g8cXT z@jg#;HRd7oD&--@1zLB$e2m{yf-ZAMM)2*<)0QNbhUoY{{xE@?@%9Nr2X2pMTpVfY zoS~EPhniY#@4;(R-xSNlkvuLnOvg{cGIUA4JE&)5SoZM8=gbB-JkU>u1vw4rY8yax0R6$|BEvYTYIc`#`cwdA zq{lEdw(Ew%Rp8;eE7nIzd{(kl+5{EQZV*aEU)6m;aEr!K*MNw-7y=S)fThXG zTI2K-{-ncMYB)G^4K&uGuv__C_WCR*wCcI)f+nr)&e-+9snN^k*I6w>$*~q=IZ_6usN6#L(}ryg zUE+$3PiMW0XPz8j(vL!@hUm}wKR^R@HCauCN8CxqW%Os-wsu*nm(QUg<&V1Oqu2fY zh*eplHsT7E>Sh)ylj-w@@V9njS!xmP2{l83nYMOc3COd5nA2KI19?Jc3d@J_A^}gB zb6+v3bYsbK&O;dyO$*5@=rY$qPdcp({J7^?WvNtOsoA63bVM-B{l#FbS0Lcu>eN0Y zRm?Y*<>IVKA^KB>HVm2YjK^BF5biv`vT(3Nc(#~DADgLwB>y-( z+5d-2ISN}jwWjElD#Zt)fg3tZpmpXc`(yO;O0VC9?x|iIGwjUwtpRc*piGh%1|Uxw zV`?hY3+aEnZq3oxJ3d&Y!zB>^=@E`uD`#?FLl0`DpEQ>0j$XQ5n77yFHfgZcv2)P}hLY1zb0#~p< z_26g87bC52&-31fX*7))J6f8`tcZN*sF+9{?D7xozfRj6%UiW-S>7}3wO*3oYeACK zDKn#d7If#L9BtZNZ(%-1+o>0T!n(7_)A+cEx(+5S#WHVC0oXBrPj6F*sqZg1??Qud`Lg5Y#ST0=u=6?vsqA-NfAD_%gjR&Q z5V&@Mo*54EI;cm>1Cs2>*OfpAO~HmCj@N2GBhEd| zGy&b|KC>K1V+ZVX9;@kziv&$!%>EGiAZ^*&dH**>C4-U~y^+CaK(T6m;;fk;eSJa& zRq(UQ%7dU2d-{)Mm7TnfKd!2wQj3CrB1Yy5Q)WjiTerI%lkWas92)7pg2P;{T+2M| z7!P8|2|GK#_(_)eI1ymTl#Ye^xWIIZ>{ir{{!kwRPP(>Fd(7NUZhaS1HD2*roQbi{ zbO>tP0CLw$^DPdvb43RNk}nwyU228OR+7aZ&J&x2XAi(0#YvBH_)}YxmbBF^I~oZn z*rxLf{4L%Mx~rOvpxVmSQ8db6)be_ZB0rlQ13|hj`^ohA+cSeU%!j2>g>1d-HN=Zs z(p?*6%;*7S zW?GwEpH=8IalkMnavOTRiDf;wMyFkxDd^DqV?nTqkYf*hfR(fbQ#~iiWTnTld2L$8 z5&sZ2e~bAyE>N3LK=>@%NU^srwVqt6AtRf%T&o9I=7yy7_d4QL8#riYEO~kkp~jDk zpvhw$tzZnZfrC1(gxC-FCmyf_EF0j~RgQcKV{J`5BOw`Nvnqn`shPI8TzwL!aaz@X zsQ=*5wjL`@m|;CMI~S;E&|adnx#0I!!A*98vJB5*HGq}k)OM}(lLIjuQu$Yt3Dt^v z*#=d#o%~n~q~zO~-RaV4Ru!sX5k2=inWUBUZ6#hQe5N|R8%amCp8Rx_fL^a%Xs?c} zd**PHxPIHz=z4MqRn?M`eG8~6kvjr>rE(){|EbcviNijtzL*KP%cQ0kx!*WaWno4%jKHLSawt|cC=_$rvVH43lIGSOesYo4#uJZcxqtXpS ziZcDN4*eiTC#gyLdc7Z_$2ZaAaQ^$C~DPuIgDo%D{b(41yQM z0SaYi%eRz{fnVV6o^r7RHxOvItgI3BE;MkOf&S5_D1bz!W{(Q&%>+LEc!kSmz@jPfc(?-~H zsq8^XGbYVN1D@lkz-u72z=wbT%{I9+_P6zBo4^K1`%pr(J9%X`s!5x!HkA zJFjc8(^w6E=(j0Btn9Ysz18LEhyR%`1!>e)sii&CX`Q7er|NWZia}&lOeQQ`GX=o+ ze!pw`C2D2{=?}cq#TS`~i7U1a)QPzHhkTA5%THTFrmI>aF^vToUL3Hqw>gP!>PZoG zdmNZ9Q0J+(D{+?rTY`v>ciR(6VzN)tQd~JWTa~B^(BDhfitwNb{BEg3bgYO%TQG+pW=7-W1E@{J=W9=IyedS8;OwP2|jfk0V%w{I^7L$ zt4!N~gY-kDE60=0iW15$WU zh+xk~j|$z2l(!csnJ9{I=jc=}YMPKsui5rASf&Qk|0H_~&LnWVhVY_m=$RtaTJal| znD1pAuG0FO{$6wa+y8|`{bBz)rrZs2!msxHA0o=qSWZXe4W8EwHx0qc2U00B`qTb( z?7ZMp{bl|0XB6svXTT+9%orZ^dGu-10#YQu*_(zXe}O_z`^PJ_lykM?hLZ1gZL>+6 z$xY>N6c(E#uw!)<(L5ay|0~{PUju|%KP1I}@K8|L6&bI#xrnkfqVckQddMCellz5QS@5n+-=0 zWAfte7TIQ!V6;;rjqUC%UsqB8kF|dak|qAuMeW(MZQHhOyL+~6+qP}nwr$(CZM*yQ zf33Z~Z=bUx&ef@liuz?`X5C~|M&x+MGkl{zlE4;(Rhe3W&<*%^5tNhz2f_!#Y=w34 z?7R>yaeZFutP1V9vA3lV48)VtuDLbJyOms5!*ZeHl*F3N>z-lAZihpYq7@=Ab!6(! zdL`JPnNFI&n5cyi$oCeu|N5*}6*3MvYVAALotRTY6w6nrJFw;amRZv($b=*4+vqp; zBW4U3149%I|6qsEXp}h{_lF$Z;oCE(xTXjUZ2BT~7Vf~5i|-`cnU>Ykbi-%mg#-sq z%5b-2vcps0Gv!@sur;4yFw~lear%yJD^hPUW5~byR6u-349?GEo?tF+s#i+n1M0?0 z%U4{HXx7RiVFNYFSZbk4gZlkLFyL3*(jS(qbB3E_DO93=ac{Sx)SJJ?#W1DKMn;q3 zb8~@P)EXVWV3bZs0tK*|Sn{fOFfX8E;7irk*jJYR*2j5UsuQWf!mXDwJa2JXeG@x9 z%;g5aN>EAG$b*siPbn4$WQl~;TGxY4ZH15^E23?Wj|FO>*$o(n8EG3O(8Clk3I9sL zeQUVFz;+{1Pg-GKL&axR&YCTFxSiNvIxKX69&RD?vTX=_bKRYf#-xy#Qcz68-bWnn zD{Iw4gAYd4YSMZA+X;b$Gh*j$>ggZT+TFoZY8PD=E75l5WKo?qG}&#F)(61gok4dB6evpu8P36J%uSaF80an$3R%$Z}3$5k#`RBKu^I)U#}ahgOykdXkeueRSHkymeV4 zARbX5JLU^zkJVP`ge) z&5J&+8V?}Zh zi9-=blD*60bMo=C$;D$zS8 zFSrkTkZ*@HOWTx5<)nU={1eqfW$dSMa;hv&nZQO56|SDWJDe?qv2@qWi}_mk6JYSidogWfqyL_5+ag*q=<;a+K+p{HwO`8qGgHFUX z$CRGAMdoJU({QhwVlXy59ZZ+xRh5(~hlyvGOa@1vi~mjn*0TSTGc@N@*>i{=%dZW} zIZV{7wZHD`jBx7O*rq8;JmaSEuh7kIV8!PPG-t>J>w;}uwe$McYH4&cX)$@JvV*bN zBFqH>-L7*c#e!^iDG`ttsxBeBKcRAQI!GhP-VRJ>rFCBRcAMDRVtshiO@D)uAOHK; zBwK^jmPyB!z7^xMgVYY3+AWf5;jPNRb)%eV$RW5Hj%Xas4uBk?cro9QX*( z{U68{Y5&-kt1l2f#y9ekS?!{+6%%KL-PMFHsN`0c@BApKU)VTs3@i25Wtqs7Rn*3R z@;;z3N^q`vAFU2cLf!>%3qFiJ$&56cQ_0K3oJC*pQ`+aRx`i-B;gtNO!aaz!Q&bQf zjG?2uZ3~%{4?6Z9AIxmP=6ggZrmLOAaXj4BE&K@LJr-g)AW4)q?tDRaYA6WGhA(AM zaCHa|qFYmL&OV5%-$q6}h<&2eBF*nx3Skvl?^AG1Z#26IEzV~kfAS>8B3Y+%Qbh~* z)QCV)9v+W;2Wy#c96-&2u*&~>qbT@aMRU1QN_?NA`}n zHrwsJ*S(9#H!r?5craETF1>Y~WNh`ECWs&0``DE4kVN!_AE59yTtk8xQ5vbCHjX%S zEZ1CsSH0hU$=EqqE^Ow}P8l&f6`|s1;J^iZa6R^4O`D(1D4qdh7}r5vJ?^ zU1fXS-;HE&@Cpq*M`_^`WZ~)q)sX@hkyaI=n(L^9S}lkz3M}NBp>tsbIA*L>#?qi$1u8X5%N)384GFX>39>CQF$Gae0k623nb^#< zNc-dLz+&tZZ1i`v5o^-0KN*D+XQo~%lxjz<)>Zv``?ivMCW$bUKDm;0Fp;a0+Q}5P ziK1fSV@S567{^Wsp@MVsyF)=;90Oxm$-}ea5(#}BG^*$O*mHH>3b|4=VnXB zE5d41rd$bs2EDT|4+u|UEUbzUcPT7=!qMA7x;~uWn}m8X)iSofQa4GT-Oe6$DVe=raW&7g`Njy{M4O z1Yl_wv;pYd(D#YWs@dF@sun301w*DdfBfh-(JnBm9uN3|T-#n$*|pak9h~*CrHDCw>GVKM7T4yOTm|njL3q|_;c*f@ zfn4ZqOn=Rv6r2Nd+WVvRDx{I=(Hd0aUGequ@>eTo^RxBc*zQfC`WF{{yrRn zL-6b4^!d0!W#pKzKq<4Dmi29X3-cDZCMTP?xqg`+$}yy3i@!U=z_Biw{DS=TbkG@@ zXYqW=TlMf|=Bm@WxEtHgjvQ8>Sj*m z$DN*)k*}=jXpY=d<(gT>!c|NayNE{cu8B%-uHvY|H=NVIuir?n!RyW1n%YN?kN4eO zgv|G&4K2_2!&=Vw=iM5qNzUiS8t%{MT?FqpCc6hJrYxm&g%794eTOpY3nn^$17pE$ zeM>qx73iKlmi8wnLQsUdS(~c?`9x8kJs<41S0B?rLV zEcx7vt$5=<=1QPVkag!Zas1GVQq*#(yA~E-CJeAb=~E1zDnFe`pOYCDEBLgBsm?V} z6NAEHn9f(Ifa}K)CMgQHD}OVX&h?FYTYVd(!a6pD_!~4HvUeFPH**tQ zhMO(Zi73Ag$;i!$*nde2+yHd~w28fYrKVH+&kt=O-AMm5_CTO^LqvwuA|;5OG~{NX zVZj63)yl*jckcic%#EKUh<=nJZEbrM*AeBjKMAQ(tkWI=_B;=W@+^uF5H7iXaWw0A znK|^SHzK*J#x>9-DC`vwrEM(?CYYLf(xyr(c^#XZtCO3AL^jioN_9b=zI?PKzkm@0 zZgmg}{ABJVCzN2e57TCn>{4~S+sDz<)am7AjL&9c5d8vNm9g2siGc@mW!m0mBXVxU zcJ;qUeH6iMlhJkRNdU!W<6AVW@BH8>%hq*H&jubrI)8l+BKQ9FaB9i>mEg-FldZ4%n&F#} z(!0IHUsI#T`fdVhVBR~55|fw|ASkU+H5N)-${|#*G!djWQ{{oF_sKsE7n#MgFFeS+-7*!0*8z z62d%%u9nc;m^i<*lpy@klx(#BX_1TWBnf2u?=J+sVO44 zq@FO}a^)cNV+Mde&3uQj!c(ca+5Wsb&bU}{k^8j^7zGIA#rR1ttr6f!fwTBL#Do%& z90`S4!^8-Hw;HbS;Li$k5g$3i&_p2GSq-v;F2(sl$#wVf!=TWLb}qeai9c~DQHd?( zHfY;FE>~joIN~U=E{$J5HU$F1ui`%pZMl!_94Y1u0lnf8&ME~oh;LRcD*A8 z|7m`DdbvHlU%x+GRIq;4rH09&(DYM~!wG_(8a zPi&?c3$1-56!HM3yo<-OZadz0TISV$ACowWupU*783dG)qb<4rA=vyky7LtRoK-9E zW$XI7Qd9l?tP>K#`^61x{J`?aj6!p`P z`1T}?u(|s}fsbgR+fV?*tFmGWx~I02BFVvTlJa(P0s`RfZ>$Wea#**oE{F@2uhv9o zZc$EYv&DXO`+*%HZ7K3W)>UtF0FGrH zj7=#2zi?ihNV@85VTiFeK$ZHIXcNX#Rqq7feW2@&TjSz_Ju4>GP+=MezUB7Hrl}+8 zu^Lkl4-E<6@VqWL%Epf&euUh3^C^nE_|KQQ7~C%oj_=3Q(~yQapYO-Hxfp}j5!`5A z?(e0qyScl&UwKHU>wW+F_?*=H^8z+sd-Fi22j{D|+FJt1-t+V9CZYJnd2#fFkmgZL znQ-$R&#}&@6?*-+yVI_bGt|&_^B7&$3#`Hxah&*) zA%?XeK{E^_l@#`Zau1$Mo*UpiL%;&c`rnf7=N?OwmyNr_{I3gmF$pf_E$RPLHgniE z2YNJUNbPmjF_rwD3fpX_$gW@9$(wg)L1?2P#7#r31IbPc(GQH!pbTFgzJ^2={#_Qr zBf3~1Z3FcmMOPSxtl+up4d*SqN!DSHv)xJHNgh7EH6q4?ymH-IO&QMY zisGWMt+YEDPF_78=B(c?p`U@xvg47ge#cWzody9_jR|3Batux$^&AhEc9RhrTX&xp zE}#YF?#<)C_%A`X!UXMq3A$p6TWz#lWy3?o;UoX2pxd;4ZEKa-{wwIVZ}dOyC7`-4 zk{eGsR$szMLf8Mbr{(%T30)c9>utI-NYc@A@@BaIKcO2QBuS};RN25ANge4jHZDMe z$|6Qi+LCS_u-_u((xH@p3dz`B7V%f1>i_QO68hp~qQ*Fu{TsD-?kz{O=k}t0lCB&z z`yWL&6;6mLtLfY&GqnpEz@;Bp;C6IL1pIbv^oi5ga1`ac>j@sobG+V2xo|7tfvWV^ zmd5f@@2u+3RjB5Jx(+igPo*f5)eW$aU7P_~f@0=#|EI_Pi<&K;5}Y~hS#J`8Kr^T# zQIUGq>9);rhZE;1Oi>7AFh9!k01lu4+l^5=P~7_~%_0n%vr%t}H<(TCUIDAojdpa()F>?P8 zOjnfkf5&voNQCN!0)8=F{p3D;ky$Y@&l4irTlN%E^S)Sr$kuQcDW0*$!JzsjPmD!A zpk@N(F)Q|Gqej1Y%)QK9=%U1QEbMF?oSHR07$wa0{ME8OtFv zK`T1)sY;qD>7X_sQX%nt%5Y%>Q@qJJuZ&VC%UQ3F-K=9oFcZx+AIV65a6TF ziRAiVCJrtZ6)_U<<~#$TWekV>TzbGm0nM(X^-7}bi{t|1ba>JqQ)&W(`o6l0E};jK5sL!HPkIDhD}qg{})e}f@9%nO`^z) zyhaKFKq=X1LLtp_NHQ(qB7^=dqjGAJ)KQ))@1`YUl9#TAlg?%PawH}4*o(lNZPLl0 zu|+vPXAG_p{FpxTRA3K?VPr(59`;hLM2;?ik>;>XpO^)t&ep}VY}poB#fCSBFWL%) zhH5Ut54f7nSY_8A3WA6uCYT*!3~vQ}ZFLAvCF)(h#zoHw3Wi2(Tv;rK>W@eFTJcA? z*e2t`x7qt7DBIu|-gu5WhnK+~HF!``V*l`8s5q>17GaLMkl)UbaQWv7Mr)#xd8n8| zbS%*Ze7919d~GS!rNJ)c_O($W%~*?n^($cWYV}xsMf$^|5lo-)hY7qtZ!$i^2ysyg z(y2qf_^=I8jUNa>W zMSSr(;W#3UiW>JC^FPbZLh`IVy_~ zS(1V=iZUcIA4tb6G~_Y-KeNKA1R0HqID+_;$}F#;kp0P>AcE)Gg@}Pp)wJpm8|<5X zm9h$lOx8(kZ~rWy2cH5d!ntp*QmfIIJ`YrtrZb8i8QSFGCIEN_Xo+t=qlNQSm=24L zQP4oAlm<;78T61^|IXGSbD=W+cm3I$Kao_EK~G}SpAPbMiByosxVGuq0bB8GW%*$| zU0EzV=z2u|zewGFYkPPf7ycBqC&nXxluz7B`H|l^Gc%{_&+_xeD7a(0!w&Gn4e+`; zX5wJL`KHVr=~dME)c=pkjqZ~3vQc#THFj?>Jqp|ne+^xa0*?RQ`r~^^^SkZ8f!*J| zUJeF`uRRLhZB|QhzQP)$cF+KLs7by-sQkGaL@e2@h7<`~?G$ht9RQ@KOCpGxi_eGI zy6H(UFJrP~7p~%I==rmf5q@gwBtVYE6s_991R?q&*6>|S0;Gt0!kR~@FQdzpTNE=6 z%DL$w*w(hu))5M17c8T+oCjNVSM^LH*Wn6cSvSx;u0rnCtQ%>c*I^V`*w&g;P5+|z zKFv3d6V+RKxw|}sm$gy-=8P}AyY~HQ&x80?jH(fQZeawDZ2ra%hh|y-WwU`ppkR{I zPF?WZjAQrmRnB)xrU%g?qCt%E@xk~&f1fX*eg6kxf#{ceU&1Tm!b~zfSRa^OpUqHy z5gv!W#EE}F-fz6IsyEo$yv`HQHLxE_4NvX9vn+x27Y#6N=Xd=fU2@q3hCoV`h_1tF4#J8odN1 zSvW*4@2Keik6;1(I{U=#sc`!U>B_a%gS1R)ld;ViVT)r-)5Dk3q?HnMn$!AeZ8|D} ztOv?@r||8j*>MZXVZ%~Qz|zBIiVtz*59?I5Cew`aEUj6LycPrCCVg3TDiZ6YwHDo& zMiv1bvD$I4+7XD_AxMY%Ww3Az#}Yz|zEMQ~)-uEk5u|3i#ZlTOg`gG%ZYC2@SCX0C z7({!gQ5upPZIVt|?17!!UV-w8rKrwy8TAxOm{9#*-gK<#8e%K2ZSqE9<7!x0%%x`8 z(CT;|=68`Nk$rg@o~ULkH!sZK%&`1yOel)gR08cZR_;s1ae$sc*_NsdRc%R{3{|X| zR--hTsj_%WPN!+PRhRFZD^v*qDGQCK*8?Hl&RQQ4yXr=Myi4gY6}=1USHAP4*n=g- z(!Z>z0j#K>K>{g%!8;wL?6;)Ehzfz!W%L#|(5zjsQY3^_PlD*VVcP|Y}9s5n&i#B1jIYATI0Q&=p_ zYoL-<$Tu-D0(_t{6itJUMz<<)8r-3~);q~q@C84WeAMIik-wQpE|{>t(~kIA!XjIH zx=i5^Z8R&o)XA19{{ZDrlj8DfE$%^*SadORgK3C@?32bUy(KjkKUfd)qOc&RsNQ%>lfq$g|I2cM`BW2|w zza_1>#YAzA>mp3gfG}%#(2_cHeKvB-?^f@i4S)*uWgT6ZH7~|Jmq;(=68G^m?S^rw zoSKU;%&r^Cp~^8X>97+1;X&kyE+a}|Rz41+lPjh!Sd<2G;3r`0(~pPKnhr%6y&|YP zBF3z2<2DN!6{__gv8uGdfvYRWGKc#i+;Usa1U^{>TQx9}oal$a;$!cIBWap}%m*`D zalmf&t)YFdTuB$WX`{cbj$~98wqT?o6Pfam`zthhyhdyMW6id0_^f?s)Umjk3 zl zFS^V0znyL~=D+FPU$R%eHQk~!0fpVm6(7~83f=7h=V21{3{WLc_s$c5EDcG4rvd65 ziE}jaQ(c7rC8i$jEG9pk9i?ug& z3G(VI^p@&ui|yH&!1AgtnIKX$oJYv^Ziy=`n1py9)R z1R=9?>b^LEdf!q7^#J;`f%#RPorui}*s_T4MaQs>bm5wSXCOd}aH{d4OAfv1puYk0xky>SuD8ABX`j>8?Kx|18DC4G$vk%e5rQvYQ zyak%EL2Co^0LrB?>5yvk{@mY|+l8Zzxs0;p z1|&K|kLr03B3oDMiKXEA<>+}sgjy6D**(BH6)A^9^t&udg9A4z``@lm(}};WsW~=3 z&L0nNM->+W70sNe^LIlGr7S1D89xE?>-+pSTTVFxER zJrI=)9~PVjWA{Z{X1or@%XM4mHt+jQTVvUzV%owG1(fp66~K)d9?+QLr$!bO_0e3RL_2g!t=W`!!AJC3R&NgIi1hq; zscmQx_wDt^W*#C19q;zeKYyIx7#I@jw{UyTZ*>C~CoczABokokjxWCeYZ|hKer9hO zjD|FCGeOetVxeY*k5jDdpg3)g=fN`D&Yeieqx0J;Y{X#7Af~+WSUcvBwGFVsjLCn8 zDlkKQc}#dVxpXTi`@Yy3+T_O4(L^1Wc7vqlfWyYJP&$r^7@$5Z##vhULJx&|Qcwxf z*4OwKR8J9-OK7xGcPF4@oKJxF;hW51>E{SlXgCKCL4!XH3^!!BnL9NZEeu)=L0%*) zl}l#?F%YaTRZvmPaF@{$u0LYltj(uyg$%$_rR&(!>=?3hY%`vC6vUx;x#W`QdQ~7X-H0ij5oNBvlOoanQYF+iAOCgpYgO!kYI`__k z9VccND-uUtRcz(XF@We_+t^SmErdWaKL~}CM0Q9db20GOi;GuSu(52t6&SR`Kq@0j ze9VbWW^EZ$<9-%d6)u!iz15O%*;9;WUiUmXwxOhuE zpX#tdr2j~S!YE}|_Z%lxd2%uu^WHr{C#isxprsI)rZAGScw4rrRuGygZ&#q|xX`>oj4#GQ!Ir z`{C_zYyzHG4DMFVGtSn?+<6^vvf>RtZCY9_Qo=0Z+eiQ{T3ZSZD_OmCU99ydr{o`C zd~RpjDlO9V5|Wa`!5E9P4g44&766Ibhi~3}Zjz4k-#>Nc0H4M%K^mmgy~=%N10|E-zL{yLEagj%kn8ZZ$@Cn9CTc#VA zz*4Foa-4+H3mW19$^z_+)PO%xOQgf<%W{71HdlWdb)~oq$*#|q4GC)izpcq2rRj7_ zqD@R=)gJ=jlrY*U-@v{`WtZ(1ZP-JF-RWBu=4{HFY?-WB_MmM)|=bUb+v+~*Z&AP{8XN(oAH6)CFG6+l1;&zV6tOgNz zz?PXVDkDQHdc44!nnO}fxO=uDL8cKlvMbo=((FC_8OVGj|4P$x5$g;{JanFPCk$94 z>re6NSksV}K>?$n>a~0MO#h5NZ`o$ck=64D@Ra9iul=iMQ@r7}g;x*0=#ul3xMixs zt~pForc((S%VW;-4Yf|i`kCAj#Gexf1p4cKD?pbT)1ATUz%3psR`9$mA1oGsJ2=Ro=ECF&-V6ekD36Fx(W4FKqpER;S1Z_=o4#hq zMFL=&d<`_W?~VB9RlSTN&Z<9W$&l5whVfmzX})MZuLxze`u(X2K;VQ5Qh8gsVb!fZ zYmCHPiUNf*b|9U%#+?!p#rB)B>+C!( zUv$glFRkn5M(25zP{n7;i=&Qmf>szLqEZ_@?iA-dj%y|29;fe;HoFa*h^q6wYo8!A zPaN^R=u@2t2w1?k@zRnewy`E?a7QQ-$Rm@`_;BS|ZH(mGkoL z@Tk(CMdnnDjZ+;woO&`3Q>Cj6^^_7}7Q_}DRFQM1_aNC!YOizL*s zdUv5xWJ3DO@l(x#sDF*XjW*md^AM&^4a<`p1M#(#N(v>S38F7jAS!jUb2&376N`NV z$gyAzg8P{OawWxW*=``iiWrQ=^gSWMVVevCg5n`8O!t@@Z!y$c9jo$!R%ZMEYi-M1 zu>3zCr<#IMv;`qqb$-8Tw}7Vh>_MsiuRV{|1tDwlf-Z8@1R;OS;2VCAh*-f;cZH_z zwEaC7W;JgPL_;u2b^HIE>i1XJI{s%tcOM}NVMgtm4GR(`E^j+;DSGBAg|HOmt|9E@ zgg=TGf=Zdw4%Y@vN6I1FL#dVk3WevyfuP9k@VqzG3&3AST;3;#@wS2F0cQ2ydk(u` zo~oH-s_%*|q?t-4FWlLD)Q7|zC`CR~RaHYOl~Ab^knZvL(wbon)Vm$*@iC#Zm=xsnA&Y>sdla=^;y zlw(U_1^VV8c+p%p4A9&?0;_w>z3q7x#vyxk7;uU_>-bw6g#p)Tgo;l%lnoYLx`m`8 z^aSYaD~{>FL*=1w`^Oh>HQoK#KMpwwfU;vFKx*8w;vk|QGSBF!39@)nzv4v&yGl_} ztN(E>T#Y@}cLYj^>*4{NLPp1rmvu@HZlP7WB)k4oyaJ|LgqI}r7Xc?WU@DfVS@sis zdVs!FsdZ)q<3}*czQ@i**(qG5zcJPb7{9t(!-vplw~4A3RZW zpUgm6XjLc*I5hhG30{~6F6)TSx6cCP@_H*WyuA0Hn6*ph-I-`7{@Sh~zC^wCf;ICA zWieTdDcwtYA&MoK^jj876os*BHU-)PTU2ga6Sqf!F^eq~^M@GzPpLh(U(8~xb$oEO zajwCZC1P6`GOKnUlm*!30xMg%2wQ90vCW&1r>=?kd@c{tI*uN3R|$E?obBfG1AGpd z72UrgXmn?HWy$qsWm3+Ksebh$cBlKW0a54GJQ*&QXWJK4qH_ET#@|JK{uP>dbcl;!Op#!U|vRE~3T3rP< zy+X{wV5aLj0d$O!J1$#*^NGqi6TJ3~T2w!;&VXjvGyf$#@>MI&mi{WnTAwE-Z zzfvnb{8zo;1J$)!xR&f)&aF)m4`|cUH<-3199d}ZZX@Ydvx(|cmG5{X52&BzyumEr zO4)4jxF@+A;&9PgfedI@853&{RnfeV-Cf|FaVW_GAJr0C5qfbTWC=qbP(n`xy>%$d z#Gu6?>Sz;1=0QWu zp`i30_fLl;mK&}u`wh6vsQF~i9p02!iB-wnY;iZ&sIjA=p%IS%fc#0zgI%X0jJnTn z=(tuFh=%J2mr*n20!aHf(kh#~VFv^r^KWhx>0Z|~ymBmpx`J^Ik-=B*`_e$Dx?!9v zUzw6vH{$oR16`zERL|1>Q`6z2)$9 zVN^}(khHbMGBWvr?B9E3UlYRelt2qa#N8C=?*Y?t_Ptip3XEKt*ob0KyLP~$-B?aP z^i`IPs*^z8O&psnOqj`37=ba4rFGVwCr1IV*TS@CDUvGG!j>1imjgGNr`Ue2!_vdq z9mu%D0tc0)Z~mSGkzsoC-2bM^6MA)3g{Hp&%FKg@XqBT#X7qoK{r(?Yb$uJc@!LPkydQ@zSuEq*ZgZ~8qM(4jdOq1OqzN22wcj*nwy z9F&u9Pb_${A%mzu{OW3-o5Punp>Ov;Go-)sel*33AsNwAV_T`D>_L~7stS8y-y=rm zvk|-eY-QES80kw&f}6z;7(A}j;R-1x#lsodY;H2iPSdMo<=4=2eO{?&?)?FRtfTI@G3ks-d<)h8h|W21YG8C6(C%3ko*8n zCO8?TsoCF#Ugc@)upV@DT~=QqZiJ8^^N1(>hItEhqOnQC?K;Y`{;q8d@>6JQaFY6u z)NtNukm41ZNm2z+QGCWjT#dFc@1VpKSF7fA#yu^8sr@edRQ&?;yBDFLtSa%O*}a4# zJ37>zX)7xJ1^EXzHM8W%tZG3M!CRUtg-jG#LHc z52LfwepdqbKr*AzX|OuGocxY1eW>Nu2_JkakwZ?9v&L~-ZfdEOM6m`Se}0a+f-L)u zj}~03Ku*(#MNcQme{^G*w`OGhgdpnVt=51aHhXkqMOJ~<7DgLnTv0@Yu<~%;h+y3} zN?**V7JpK)B2aGUAJl@Y`PNd2#GM1n!l?7ns%R`nOfZ1B6j;)iQ6`jkGVmgnNR+i_P@@H3yZa zv%B#$7giy=cUZd^gn zCN;&jY{N~T=_-GE&t+;Z3a1Hi3fXednGD@$15{fiOQnuQT^Bx`%iE8Y7 z@bi&G%uht6wK`qp(OULhyg5aZtVG6FK<)I#s^?a$N`*Jl(|(vSXLyn2_`6C@a^t$n z|KJOhh4@9X7{n!T!%nzS8ylxScAT?As)!I{-$uO=o8Djr771B)P@M*B=S24~70eX= z3YMnU7QXD&$#tWwcy|A}hq)}5M|F|VrkyIdccLy{!OOUUpuybdw*-*!GT`sMss`Fg z%W7lF7^-0xmbummd%)I~u1}nKKdOvo%6va1!3Sk0M~4ju^H=rlH1QOy=5`e1z<6;J zHJuqn@)BEd2{xwDQ?Py1`*dyOv zU6ILo*VWP@)(p>7LcP(YcCiWKpqvK9vb!>Cv&CHFquDsf-~bSpcIKw(s>`etu)g(* zzf*Uq8I+ak5)mv#{h6)E8`t>c)xdT)1|0tXjZRf3+tdh%FR z(w@(R{F#O>1RL_=f8kycM=1=7@b}7obQ8sUW7V?#X?L@?nC&!|CQjyEIU&b>PTUI^ z_5G-ZhW-!FL|w#^jlZcd*%eITOg}~fqs9-9@njf z;TTQ5UkT3UO3s75%}&-zGAx5Dli&@Xv$7>A^b}e=1}5QTEHzA`Vh@7W zS0~KUYTdP803W!L?ljwVE9Lf z-9QEcHuA_B4@Tya2Q^}qIDd;v`Iq2MAltNpd947;NF9>Ne2eG`p_ zuLBx{6f?qV_L8$j!1sMs20o4$RvOwG0vA-OYi2Uzm zDIFbvk2)ha+s#?de|kZP5-(87QXm6|Sl)M3aJNs+29B)>^+;)03{2?V3|(Dq>G(=W z^0N@;vh_pk570@4QZ56=eU!`Q{*aoRFzqT<*36J3(mJ4M2*Wf+1qQqLY5=xcib@4BSo(u_ZnR+O=oc>tQ_)yLRAX z1o!eWHwt4K?OGo(*szFZ1%?-@TG~xyGHyq9^5mqi2+SlVQp+xvAx&{aqx8(mLVXqX z=hZNBLLnr&Ek~*nu35@L)M@ySE<*jny=5$j_)^m4=>M$M*?OZovH9-PM{jTH3GQ@{ z_uTN$8mp>kK>|?K`EG>>kxSsgxFccM7pC&;VSS=8~iJ`5< zB)<;?2y3P+SBT%w=NZFQK!ujnCZ5&j@{_FU-~AuZ%Na*Eo|RX5xlOCxLzop)R!z7^ zQFdr=njy*cwOyOl?n?@Ulm5^{YE;M^DLleqR(2<^8grL6TMfRS%QKcsE|K-PBO_OE zCuFGuMMJ)7Fv<>lk@%uuv=3K_?+rlh#qG*bFyDO^!%yKDG9E<<0mWGU0|JQvoaF5U}mCfbC5LT0^USv9|5W!LoR9d(1$#5J#n_@oAgt#mv1 z5<560k&0Ov>lKVtx&lt^*YwVo^oXQ)R(t&#B-ESDjpB_jrsFJv^}GEBwyS(B{gfcwVktUEac4fI zv^8$82p8BMxcv9?vL?zCUi_167j7|$T{&ezdkkFIz+-656C%Q=Msr-AR3$;mcJ9C^ z=2~_+l(USuTNo)7Bx^mPmMr5GvE}lf!dBmfEWHSnTf<59&&{edG-~(#rRsVen9TQ` zR|-Hy)6MABrzz|o?^&`!GJ?`#@(a#32!wN0s!rhmO`B2~k-ePbF{{N2nM493LPF_Z zN);-F!6%T`8(eOGT2Saw*x zhw?O?H*j()^{F+`Q|lD>b%PtZOIfN9H|$lb4rG{>Uu+Yw0xN#EVd0>6$-!vnn~Ad%&U;Jx=G}BCz|NKAr1bfA&{eQpUL552cW5uORo7XL|XB z5P1`+3q>1u_S*9?s6S7M?`-!o`7FPo22(1lBn5R_dHmjZA|(ZupUD0kw`3m@7ksh( zQVlu0e6IA@0bb~W)kCkYh%r~%N2QpgNSAi5g{h?<2~wfBKx*VMY$>9Vr`d$=bd5ZU zxN|VD^|a*-u((CNxu>dsCZT|9O09-tM8dFpz}u1>G{hM-awqWRy0&&u;?q)9ru`lE z&G1S)0|152%GsR#%A~iZB|7iJe%$NJ0QqT%bHMnfYbgV*!pI^!auA?I}Y1Xq=#W6sBG`_nJ;>rmX#;sV#_ z&U~A@oOxq{!8GkD-iALdbiDBtH1%9daaWmWQXi6wNq1*7dL&}Qlo%*Pp*wVsc6xGQ zNY+!_m|n(~VP?I+OGc`BN zF!r0R6`-SV4Lrf1MhEo{#e+K{{U6-~RxKQTui(65Fx*kJ&O))jpdzkxI^Kfx!)`Kz z<96ThCcC&%Qb16rLf@IqVb#1ihD_MHGxJZ^qz5P^fTO^jkYz0IFxfspqQ@d*ajsb7 zbdn|hx+yHP0TOPbJqXW$*r_W32HzGa9k8AvCi#Y%J+x_YPA-gt`NZGzm#fQZ47(Cz zw}u}bnH9CX+6LzAr7TL$;OLe@|pIk(3;|gF3;aEP$%at#Erdhz`h+?qXl5~M$hGQ}1Qf*5Cj&VTc9C(-D;HF6c z!+{mFa2o|%Cg#^2xnlZ?oF+V-Od;!{8Cxreu&@lSq-zXVfxicZO6_g@!v?|%BF5* zQ>^lK{nSVhXF0SwVIg;dERHYEg==x^^<%(x8(9!>HnG)>wG_9jRqYoHQKoF=FvXFE zsyB^qiZ=tYbTXCwI|3e1y|HIvDr+QNi0o|G<<)K@ji*if!=YROo&(OAi61P)dsxWT zrU(pY9ypT#x_JzXH^2;(OK?l;vJ`ym5s_>As3w8~dYt{N_e_D6$W@wtoo(%-q2K27 z=bFso2uuHnhTiv%-`Y8!REr+7u#Y1(?JmAMX+ufRma-c&WvY5Wl&r0aMn%V!iu9ow znT<#Y($$voo)X0G7)k6%Uwn76jp%?3>|gL`n;vGj1j#2l&^$|sfC&#>a08Kj>HhLJ z)p7Oa-}`@aP~rdni`sn>^+54g9rWBt7TS>&O#J17hgUHP2AYlH7gG+0FsY0tC^%Dx18F_Zb}3&aG4WZ zVpV-;Muo&TErEeoO8IaP_w^_X{&r|rzqlNln6+d`SXwewE1 ziDn%;XwrnV$u({vxEa6+eigV{%C;?!Ojk0RI z34wS<=z(7}qq^R}qM93xMNVlF_G6sLx%M_}yRG*onkCG6zR@`Xp{)jqdlkkTSZBuC z9uj6J;V^m~I%!Awp?c|)xo5A%%BrO#=4aYV{|EuVV4%#W9WAxJ%Z>F4rggV=uh_8a z0&rQNjNX9Vg8jT5F0at`Tn7WYST%1O(XraHIP06F>Fj{O=z4xjQpb;KdsayY?Lu|i z?0)3}jEWKyo9G*%|n}cU;LWN!lF*Im09Xgzmb=k>qj(|e1;_rz)M8O&MC_*1Fg>v z)?t(O)$lU5f~lM6^cH!?5uGVL8AA=ku}wPnGR7+&u@*KrEaK;fp+iC*e5vBWzdy644sOUeU6Q;A1sj!}&+xpV_ zOU>7Mj76R6hCzf~C_Twm? z;w|)1==NtaDa)m-v1+`iyOxjfGaJKZZECDdjmqw=O^vE+ZE6&+CpI;*82IjH#$}c` z;>1_E!G0O-u2x3D(|bNfmn7h~B+-KV>{E=HQa#^b8l^3Pg7&iFJNHLHkrh!m63N}4 zUNp1GXNG%b7+~-{6ipLv5+~%A^3;zHCPXroS{e#zRKF>m*n(hrG*m(Yo`jzB*hp0& zu}noV$vJ>Clofi_v$21O-BAa6`bv@RFfoO<{gYzQl8G^Bx#Sr1T;o5B*9!7b(1PrF zt3!SDk0Ybo*{EgQT<5fW@i7>0sU%J=oRJBgmqYtg_;=13`fd4w<2QxY`vloo0_8Q-gqsn%8Z0EgIYciJ&P>Q z3u@@VfOb2IDfU#A)ph*-)ZftU5DtOr#=WW&U1SM@>RpCLv1+yj)PTAb5WC-nDl>KL zELk17SgiNaj<8p}x=uNLc~xm}uL7e@%?^ls2aW?0yGd#4MAn&ckYol+)W7p+8K;51 z>`2^$4cTB8Qi5*Cyd{-#@zTf=oQWxoZS^=wBo}(sQA~_QvWhlwh;Q^0twLUVgO<*ZjDmf_{ z7jNh&A?Rd^86%MchGcwHw)T8&d=@8sMn&5)(W(fH_Pyb9qO=hZxDKB6%?Xk? znGmT6AePQXq!E*3wZPeb&T9GhFKVw@{{8pw{ZYd!$Lx+LQFuo~9W)`(rXso3)IJZ3 zty4*pW}D>hj)u#2(FP@}E+Xiosk~01<`mjC(Jn9u^VNct4=eXI&=W$D_J z3Q0_uTD;7eea)*ASa5G{8_4RXFHq#j#IsK_!AgkDl(@2>+H{OCYZf{WQ+(>*WGfb( zOXWEoFOzpty{K}MDZOhNs>w}&X3-die4J+hpzn7Jg2 z_t5l1H7)^`9z~5?rl$Go$B*Zy-hEdOm-=o76c9k^uc>QwH1~b%Oe{m|eqCx^2a|y0 zj=fVVZv5b$zd1Q8zE)fu-<+Hw^J_~kN!iO)^k%iWvzmNj8E)AR zkiM_u%%UDT5T$dTqC4CYte30q*EBvtXH29C$q{SErO&9H+$!shblVhpz&R5~rTWWO zWpCCIIy&Ke1MF5Z2mW0=elboYZ7QmXDxhIV{+jJf)r4$2Trd;zd~5?fw+#|dhOlgB zt(s;ILSXZ}$tT^L3+xh5TDf~R4m)WQFFxuWvw$;snmdFj zQ=7{GeQd+SOLaqUi0Qik-yC66YR>IW_;RK36wVJ#+tG{Q}%8QPyYK&NLHmuDx(*Jr0k$bNyk z%I*MNa|dj;-s;F=zzu3;*0yaUUNOrN`vKk#Gjz_V%t{(Ht8YQXnTdE+RE__2Lgltr z*7Qfz?ZQ_Yh!S+6>wjcTueI8}Od4B1!+UvM>$8!(Y6Ipx<%Gub8y zrX#nptw^J++%#LW5HM($+XMrGtvn(u>pxKUgvOerw zo*kdQI~&Zx`-m69!kAOmoKROPmtdM?`Q-4Q9FD{E#okKM{m2<1K zy+*>1IHl9`7}m%857$u21rE{gZK$Y*G}hqj_xs@A+5DH%dBbQ6eNW8y zIh3bKpm6b&XZ13mZ|x%rOI1gan74Nn1*L52EwVs|5&$>NPe|{jA1@)Ht;0K00i79{ zW#6<`GlVdGF`q@0-Q;+;W3Fb1PDP{a#?Ie_;7IQPT?N!KGvMCRUv_fzUe9A43zCTm z6DH$|=Uxwb*J8~-anC(W^Lxl#Dgr_M1n&9O$<=v5+A^enD;!N&xmnxm<&GxItgT;j zHAfS5n<;dBHTr5W#qn_}r>9f^Y>vNzayQk5Va(wGqL!VS4m$bg@dd)E;)67({P*1B z^VVMJgqVA_)lhkmmaY$X{*;G1u(JML4s~6!u$dRA zw(aP-TLa7vVDC9oh5!yoDbRHrF>J?4{(n*&X`a1bg@3HbbMGeE@wdEwpZOtDp)oo26EeX}r~znR&a_|EcrUpmz zxg|sA7s_0t@y|F6lOw$s8vPvpEixEP%&L%MJp zI*gv^)I#-Kb3+?=jXhuPyyD3@+P+ICT~fzhT*3496ilrj9S)T!0joqS5w?z3W4Ft* z?n!6Xz5IfG(~o5ZsZs$F8sbspCr{5=sMH=?KO7(qj6>Gc!!r~^0x^*F!8ckO^F;sS zGG!GrxUpAFlPj(&5#cAeE2~SmRj7;SRP7aR!8=-AkC#J#C-RObT~H4$ z3a^v`K+L^zB4NFi^t@Kl6`Wj`3Vf80ob1|a9Qdkb=e4vNsa7mIy|mhwRP&y>+U3@H zoAb?=2cxX9CtdU9?`;n0nchLXd}m%T>6B``azTT$<<%Y+w-VuDo4>RGNw}`2?`Mff zG7}mCKZ?{?aOQ&So2>V3q;cS9IBr0URH7r~ckB))VMD1*uaJ5@{o1hp3S9wozY&!p zFD6c;Yuqb&=5=zXfZx92k6uZ3%jFo zYODlhP@B4z65;U}W?gf8=h}2IYu_S2(8<)6T~qTcf*3cdx(4oCgCo+cBSH8dv?1Ff zpbOh5qBjJM1r%J{&frE9BH9k3tSJtS$k?G8|9EG69@Vi5i@;*|+lXc@3|iRdab{Lj zI5Mi5?*_UflROAVoK4!(Hjv?Mz5(0dlzH4TL;W%Awd8t-J!%;iPc0m56FlOnw5R!+ zny#hq1#oHj()wgKT>cKg)S-E^s0G5O$bxLJ3rS~!$TZf? z)iqaB77^i#YE5B$W;nSa7EuaE19YL-l7Y|bVhFdslL2fTJTIi$sRq9o3|{D6%_iRY z$S`|B3ZB=qoiOQ(Iu4G7#>H2vGt|)FkohU6W@q-KiV*gIeRHp6s)lr|8Bz>jGAmVb zyNtR3|1X8$Kl6l^u57P^xiu?mq8(_WDy`L26OM?higqH}q_!@qrkzN8sj;A{F45vv zwYC$@BBipLdp=&alrSpR4|S}UY%5SRLF>DnsIEdcUTmqKuH1=eQLk>&oqY?1p$^LQ zLKl}R^4E4EU%nRPmEDKTCNj?0+iiR}RC17+034uqX1CHdC>{wOrLr4UliXOb?LlL0 zjR^l;%wCpczG0d&udqjTrMHCO?pi>lOZk+>W8?DGxok?eqAC8RtDkq2o4&fnx_OfI ziHOrz$C+kz&m~6S%HRRnoRNaA3?Xga^(8^|w`#8`0okFqZNAgu(_S;#di;(r&R1e# zJM_TD_UK)%B0d)z8@#H8qKc<^w>&U{^UHhpSl*~uXxba45aeer-qO1S2djOpxr*UH z$aX3E7xPd{g$FcLfPPDybNO1Vcng~lx`OhA+DoCGBAxZfn1@HY^bux^>w>RhTUSmL z+rEYP^GhjbPB=&6oOyLp$Cj%ci5y|xwGvzLphnZMdzlEPWQLb0Ac@c$H8K_p;x3_5 z>Od<=l9@n!yq#45?o3*8)Vtm7P^`+lwrt6{vF*yeSbI@WSk<(J^OMNG09=0AAfn8( zq(u3x9=k_kOZS?3O4Z9)*;!xhR4VV!;Aq&+l#I2bVeM#GI~r=c`1pFJ5?nZImzT{7mJz{}m!E;Gv%E zs@;i@pad_Ya1|XlGmFFLxHNQ|yG*I2wk{ib@#fwNX|9H5P!wi}Gwhpg8UyH~d1y#P zXVf6dC=p476lhcbI0)jj+oCq_&B%-=^X-hFB2@T-d7`uP0T+wy%&h^x5_XGjancx8U3D$3yoU6aimnya)gCba z&}nHPoin$Tur9v6RN3$fZxA(*raYB#D$V}Wc____wxBTC>dftzu1cZ0db`cRiHlc^ zr6dVELjP~`$G?8=Z~bF)^M_&o^-q7@{BZ#P_;TwXTc7P8f8E;J-2CC&ci&uJoc%<% zKL5bd*^U0|^X3oa>?cnmTU-D5OUH(O>gP_*K4r4clfE9(BP5fw+vaK6eZO^`Z|6B? zkhQ%YX(29WF11!)sB2#*YpJ_;|G9YVI}q1#mMig}nyN=8Jn6YPMjti!$lwsPVjbsK zm&l_oZn$;ik-i=(^61J`@mhx+HTG#8c2sq(!;a88?5Nn{wKs6>4g7O>1J_|k>#(DB z*wH%dNMEgCN5&-5F-ILH`LJ$j2Pv zI8HbYrbIZs*Zu(mY2ZoKCQ|Am-=J0lWuFc%_8?9s$co(%L$oKAv={O)Grh#nV@W<%R$Z3NYXgUIMCSdjF{Q&TsJ;; ze8gBI25FGq)?=N`tPO-oU41A~8)}RboUu6Ivl$j!=Cl9@EwQ-CHw+vX zbyfwqK(hl%z%#~?5*^JJlL^EtPn6Mo73EHSs(R|BQ~N+8FjDJ&nT-6Pie6lPeOi=Z zmpJ4CeI4=O2AvYH9Nay#mM>+<=zG@tOh(~qDkrTg{QM~^{3N4hHvF0D`^@m9OIbN( z|HC4L7i}5qC6~?@Q-0T%yq^lvr;VXcUVXVCbBOEm?#;LQg@UOiIUI(-?@DvH{Q6XF zPkykjRG=LqgPnlH(;d^CXTzQuXH@c}Lsj8p6!0iAz)yUPPDnh>$UH{B9=Enj%(;J! z3uh^)_smLgCPFgmE`*+9TC5nKf7K;z9&PokzBJB@EBgu3jr}6*89oV@aWDw*XYjo-DW3P zk~{3b%U;_q73;HPli~Q{9DSo{-XEJi;ZkdPr+kKKhnka4^$E9e7a2jMDXRUe)uz!< zo2jzwjK#Hv!FIa3dIcrdPaGGO4Ia-+`k7H}b+_fm?nn?OD4bY1ffuHZI~954w^m}B zSLRzjq0FvqZjNNfxLLDVYaP!<>kuM3V|Wxb9|9IPiwIBDL?rOuPDq9NKf1bl3x@(J zvzl{j*t`*uS$bS!fh6R=*0g-;1XrHdfO6xr3?+@oo~1HC#7f(F)b*4GHy4iYpC{@! z=KNIH$jbNbD_l*}FS?k`*Um0+WxB2iAS?tAXny$9b|RARStx`p=KkFQjbZ7%&km$f zaNAS$9Kv`keKrECda(+D@5+%DAXx<{!#{r&qKb1YNb zp()L!oVwCDA@dp#o$EX_(yh;GY0gw>BRi6^;xvd`LXRY zxs*HWnHAeQmGjV+)#bu=%7ArqTU%S(ocCIj(b`D0I@`59kF{9e1NT0UrTJT9#s7@IlJX=b_wJ53*q+9&~&mcJ$m1qmsy=_=|Q$S8?!mX(u1sD z4yLzY^NSsC&$9H0EMHl$xL^KW_pH5aS8mxE+miLVxRSe-rFQ+I#$>g5zdF<|$0Kgh z#L}8$|J50-$Zs09oA&yvyjEo>4zzyy!&T{cFZ+3Ys`qbJ^mu*z)YRGh_(>EH@~p#) zD@g#V6dxHJ`Bs}KUrfgr=O{=BW55RwA53Id1>Po|Gl~0NES?U@kb#AcaWRA_T<)g@WfqPDy*d%mrk`(|W+^bRvT(f0S|)y3EE zw$y;OqBxzOR-KjGFX#`vzkilksjrqwq>5Sdz*73Z6E841FzJ-D1+9vZ8tqZzyGn3cS^gHNeKI&ep2bVN2sR}wc{vF zaAf`rI14FwT942VKW*p_lhA0$@Z*21ujg~|n6PomAj)VbnBqi=9Z7B^XZ@JQBvNy9 z=S2NJnB!Tr)HjC1;qdU_0RBH54$J=^zC7IhkKKcp!~K^B!^7d>e+>7A2Z#IrfrcyZ zZN-%eiIe{r-uqkS&izR)r-~W6-P^!%oc%c*?7tf9Z4}|R&_78uLoiW5{lA8}f-dY_ zDLU&mZpi$OC!sjn=%W+PBxNZF;TO?clFZA$#u1;Z?Q^4#PRT8g#YVqCEgg}pc`yF{ zpSQb%z1_jEKYXz4eXtb+Y&pUdcaGU*ZSA~p``^t%lbb&+&?U@ z|5y8a>-GN_mk!{3OK?b%Gm{6a_V|ckK~4><*%3M%iVdY{F>-fGaHyum5jrqG%4B{) z63W9Pv^x|Vh9sX%Or~aGb8Yd7<(mO&w^n?s~DtkX=4?v*GhsCEzlDJQ?fQPzOy?+VLdc`}I z0mVj3IwRkbxq3$m$C}h^F?TeJoSRC-*?YiS_hx|AxR~4e5BK(r2!SW|^_iHsH-*H( zjZAQ0@8>@h8b=v9W45yk%|6rpE#Fgpb#76?zd9W5x=&c}y&3|#Gww}0mK*xNK|U=v z5K^YR(Q^A{mr#jd!c0g=%mtM^ znIEA^kPIldTSP)YPKd@$aVMCCJ2{iH=1q>!t=Sa8rbtIbi;nLTDoJv_>L%nLfTO0` zhD@kj`L`!j_LZoq`zB#BnFEa7%0HcxuKPIS@yfr-cwF~6m|G#85FyV#f#+=XW9@u{ zm~YfICtm&6<1~s4glOZao3p8qChDn`H={_tcDjpH(x~m@6Rvh@_*f9}G!)^D)>$z)$8369tL}_ z@bDnq3r9nIu)lYpejD$O_lDzx;o&Qtx*(<`YG~_JH#Vd~2^%8B&L|c05&zWMy4}~~ z;ojb>!_oMwa1@4zd*k8Z>(T4Iz47iaIDENxxEBQb2cuWJLqhQ0;duOd@2lOt*Z9@` z;fTC?y<2MC_j!h?+rU|n3}!S)xZq<6%#8URN#MOBh8fp@xvi}o9fmK*Dv~W-7wH?P4 zsy>P%B&7NwyK|BX$!FJC+=#{3v{m^bpkJpf)No4K6UN>54V717s?XQIW&Do)lM7jV zFlCIg$vHb?w>05QX@%cYIX!1OUiylLB*2M!M^i)6N2ggMdk=5_ zdD;Jx%;E@3B6fZbaEwPZqLLCZkg=CPpxOT4-QC?Q+y4i{gM+pG{}|WrzwdmBZt3g@ zBI3t1B5LjZ=S;CBn35y(<<1{}Y;353w!mLa7E35g!0(JB6h0y_^_&A|h5+^(f{IxL;Ln@LK{JEnvoDezi8?zWr zItMwu!pI3SyCum9pT#&KsQ0(s!QO6v*h8C?1yLIM%!9#JMlen&lc=XZxpTWaA`fxB?)4mhy zYTjHO*N!jFuXH5}Pu}5}+86v;I9vq_4UB&G`B(ey>e%>CHMKdDI6@aZM8~P*fK!=x za&;Qx4jSqH{n=?6NZDlPc2DteuZ4$&7yKC~APCUbxPpv$i0UyWJfZ^a5BC2$*f>Ua z7&7{UDG6?Bp1#8x;ej%l@GuQXh*BnLls&LN*dGja6mQY?Rb;Z%8I2ZU@_Tg^iBLxp z;t2JA|KpDyLP92KAk%~lHXyx0H;W4Q+W^IpkO}$pPO0sPG9d{Do4rhA5Z{Gee?7#kL>&qYh z-yc7H`NtoB>7mU6d(dYj`IW|<*wXG2MF*x&(`T=@?m!1SJdEc?K>jjZ8@e4-Tt`i(Gc>aeFgkY{?j3xbMSw$8-G`=)}=~`j2eh z#*7`B$ly}*O22E{S@?0O#`#aB>VFm{m@{%}S=fyj8}uME74%aP9+Ajr1mW>sQH2|$ z-v1Q+|0#M!j_Q9~P2)41jVhg@_tzfk{oL!mZa`1aO%)zZ)eq{nPDwNyh^gKhjzER7 zDsEjD2f7gr4+;_i0^eKnp@B1DOz)4gKy-Bv$MK+;?VX*d|NgtfOU26GZLfmJXY^~z zB`LCJk?agIxWfKu4wSQ*Y0Rri_FkFZ_%pcN|9)j#^f7uPBeh5vRQE+`zL*8%D8m3) zd?v<;?DMhitTP9T{e0?8YJEM})lvV$lSx7*Sdu-?Wb zx!nApCZFJjPWdw-IhQ;l8#5wth$TMSa1!S$a%gO_jk%FeAreAVq86JvD5ky%`D>E* zp)QLPx8?n!`lRz7>^Zg4HOjW9&xlbL5+>1sl7~qe>6{=OQ^10Q*7r>h2O+uLCfDGJ0k|a=1G=1wrpg+p|J$upCO4z;h%Y#Gx%`=#hChlD7sUG;@QDoqUZ-7k0k5_iT)y*;aG!NeUbH*2!bH{zSOL&K{GrDC_Elh5+a^T#K-o#inJMd!!cd3 zLQjzl3(ep#tI47t%iEo?Hke{IA%!}O+H|zTVy10h(i!2Y?9V7mB@y`{27JOCg0OTp zB1zs-`>=!QdX2@+Wy+w%Hr4tvW!s335#y|g`lz{9(}W|`I~?}ZXAXzQ zw~yP}CcqvPk|4siu!~k3oZE_fAtze*AfGaXQA52vGK=N>lqP^5xFGC5 z^=DWn^ix0Jvk_&`8_{prs%H2TouxCg(OMm5jNJFpIN>vd(K{gRvp+R9(4+==r zGd#;SQU&{d6Y$udKWnDR$t%byh4iGbtA#XN&7Kqh@iX+DRFR+9I9baNO5ms{Ozq)z%U!VcI_R%GcNO z>t7cw(5Yhc``CZ`hr@FG=i$NLdi_7j^)TzdFgMnRfa^oRKhYte!Cf4TaB!n6z>o-O zyo5SKtXvFEmy$BCA?NYT$t-P+D1iut6QelcGa{!X6=>7(d2X3X^1)4*&|8wYzVjpW zQBXEPSNUz7RYqBmCT_O065|tlxYW>{Bc~bV-aC!xn|khj8dfsEZIF2souBH$-G-`u zjf%WRKl*-3n6>W_XXu-gvu(FclYKs}(+ax;yb6TGU7-Y^DB5NDu zy+a{)-6%s%*K*U&^&;!4d2xh#f1C5PFkbmL!oT;*EQMlxeV3T=@Yv>47OKt@k=04o z=Ogf9cJKg4BTlC!FN^>bxkEh-f7i>xl69#v#Vq~NLfhab)X#&0Wtuw?h5~>(cp3#f zjY6c8C&?$7VE3c;paSNdE^gSgij1^#2yE+bW@AAoj3?z`Xyc!Y{hGgJ!mkIQ!yTcX z`n&oGYg6_$`e<)Th2)b2&x(&bLE9No`&<2!^~9fc|6gAJ%Wn568}lXwu+9G4-(QIT zJUCqEe?Q8#V*Rf;DORcZxe1@vzAE4>4{nR8p3l+S`uwit*S~@9nfC+IQXH&p{qG%= z@qZ8ZU#`#p9_4x%`>!xJ)&bzp`0Bp?jX!P2DApc{z%A?laCgD~d${{*z5XBNdc?fW zMkIqA;ADXQ_@kfCv%Z~Y+8a^I16_>%4EQYOj4%npD6cuR;@r<(Z!zaH=3yyAvzVE= zYzC>}z=Nff_K|tIDYw+gEp`%woiyV-fq2Qzsz&ULDZ>%{jUWT^tgQhKxd4Hj>bGJTp8oinkydN*VvSr}xh(Z@k&Pd*S#=|U=B>y$bga}X5 zgtEz1FePCcQ8qc(N7(x3vri;QZE5}dQZy}k=ru`ZqIkQnC&<~SI3WV6O%(5|CvM36 z2o;&l#YQHV1%TTMk@>{ktcm?_F zRu#p(1a}SLQu*%+`sF98KErriL*G{Tt{|Mf6On{IB1CFWl7pD$|C_(KV#=YSfFA zoqMf>`*)Nz5dWUCCi?1j#U}{6EekuXJ6!$O)%DrCpWh$9JG;6#J~=DNB#=~Z5^5dpPs!r{`mI#3K~?^mMYAfT54}UeDlru`)}Hb z{X&#(Whonkp8x0del<@NcS>%LbxCL_nju*YD1*FV9b|em?#1?)dzD zH5o@Wvuaf(t#3bmeRlc&?E38L=aaV|uddH78_E9uJNk=T?zW=1dQqNc)qv}Yg8rqw zzHW(NMbqD%zyJBWv&*aV4^8c^`%qPj4U&5Pqpo3|Z=H4ff6NiL$dgb^Vw5PQ%exg`)zvgYHhJNwwa>@PL z_rI$C`U1xjf1FZ$?PW`Ht z5?AzB?ftd+bsqG}!C19as~!{uPxAZwxp#7g6zs>qhMSeF(vp4wfv z@@skjuYUoEw*0??VLAW*;N|W*|Nl|0j%R+47|ZdTqc;jc4ISdW3bd3kEzonMSijC} z>(^Udi?_7h)L$@s`t^oOzfLxKa$rK_Vz*-+(O_QP^@>?j5h`PJ0U$(4>6@uoD*oZ| z53c_tN7bu1qkaab(tnOQVb)+JRLZ~O6e)?EXE0BmdJBHiYkB>z1oV3k{HOg_y9@YF zuMXDw-(y^r`9Gxv_;0y6J~iW?$#w7be}DX^-QlYR{HMKx_4Wy->P6Eyu5ji8)^Z#qKm)l`T7}F#?Hrf6R3t4 zeFI&-3lC-=)(Blk>J7pqKrDr8r+~gX%Kwu0#%~vBv;SWnR@8rcxt9NraXmNr{{YC* zbz4Eec@kQvzD$6WOps|j_W@bv8U4KTrKN=Z+E|p|D&$;`hSe8KAP@j zf7nBt*?J53Y{uEZ4WI8fav+2#hD@d5(Bj6#W$lu0@xwnVBwHS>Z)t(ur1 zLBMBmP76oz)T?PB4{jiN4~T6qP28uY)(g@etTi^VRq%a{4xsG6MM^)LFu^DAY zXjea(M&t;+ONG2l*|C}jQ!eEB#Ys+C{qUa1JD%JWf4n$9&3}k(OjAo>$r9ru3&m)`;Wt9}1J*dLbn|Ca{`YyJOGu4fAAW9HdC zkU|WF)te1CrsR_(3=%RI?S?9!QV|BGi0xFqSM?j9NR@wd5vHnMs3Nog9<@L;!v$-E zuF=5D_Q#MwT5N_UR(rP*nyMXMsD<+$ZR-%Khr=0#q+1gR*K8)vQl&bwiJ5f;WO>b$ zTO84_@tM^(&Y6qmql1dWuh`9l#shu!IkP>8C#{!meT=4+kDq(-z{yq!LAGblBTHk5JYDVpTTv((1_@n(G zrHdXjNvk*!CuB^LrC0$vuBE9sQEm#%!mGlXaj%N?<6fO+W7BJt35l7Kbgp~6?JX?= zyL>0ciR|-nr9gEr$zvYz$^6^JSuo{7st*_5xFd8jl}BiIXtS{w@tgWZBo+@8mKp?> zI`kDkSF8C-u*eIPqLHqzgx&W6nf|gi9-=BT`&krBI{aJPO{N${LMymi{ zBzJPT2>oKHWhOuYP^1-1!~;mA3y4S##L)piqy;;q6Lg3-Y>3lRAH;a+Oc^XIkfFwUZX@`V1T_M_;6hsUYpN;r~a?K!IS9L?~j%glMCwlZ76 zHmeJw_9(ke7&M|dHGfN-Ox&Fs-;xAR$VW*d)qxVT}#S;dqSM0o%c7~ZM(&_s1al$qW2PYbYYMX zAqYW~Ai9L;b<`QX1f!EgFAp&UQKB1BgNPoz6TKU4%J=o0v);AN@8^HG*LAPG_vhMI z9vS`nGKPkz@0T}$A@3Cm)gl{I|L+K*zwg~e7z`6V`h6RB5wNa1A9^T!m^Hk6$U5ot za~I4u*P`XA)t|FnPkrm9jc|;BwLWyqp-ZnKF2!#Kq^(uJR!v$UUZVGzmi0k!#G)0G z|B2>EQg%Y0J89ga*E4J{ydS;9iK%4;_BSjTft#p*<$u1B%?!Xx?4JV^*@+pwgV~H$ z5PRKsr0b^rwb96C4e`vT**{0+(%tjpRiFEGD1LvxL3gCDLBGNStp;#cB|Y4P1GucH zLXk4Sk+F>lo4A4>^u+i5z{>+`9+ga3evNh0v5$l2=xFc3uTPeYyhPe=j2N4aS%Ud2I^Vl|wzDbJ52`u7B_BHS>TIE(p3;#^h7=?S zT}CxuF^7-3_20ox;lVk3Uw~=l9+A0ziUfD})LsW|ZZ4U2mY5d5wZR|cOU^-$k|fb? zxg-6(nE;R=HUgC^fY5JY&$OLyuSN)2w}|I+{!q9+jsTo&-GzwQQgRYX*~}9Mop6@_ z?R48{A8o}$E%)~`amrmQ|EuPER$-`PW!O(|)qT1vN04U{!q<1pS%TI;vye6|itY}- zT_0p&iiX%5DiLmoD1wteO8f~&a0_Err|$9FQQ;EVD}Ou*vn7``qWK>5L~#kqc5&6~ z!2;cVh7WVom61V={+s<*yN`V2-(qTv6&04fQS5WtqqEbOt5j!q46-6yz8y2R^+|>) z71c79&|SwX@zGtk9y6jbIHfV576@571ZVx){`m5Y5hsFKgFm#_={877BHVzh=h0o? zW^V}tGkABZ)_gnWz0TU`_;1{w5lH*?>LWZ_R?G*9i3dNFkvUOfDX{!M90B%LuHrkD zRRI-G&5_vEp59(YkfVxJ;Fszd%QM-#TmvK7rLkQMRBvUbr~SG>QU+NsHF!$sz~I2w zF6tjvWv)3nmOVEz9qIZA)>FqrrV2$Ry?xFW3?jjt3KQZBmpU@KE z6rYkm5kp~#fMM7(x!cKFgfqj2sr6%ZPkFl%$MUA9neR1TX!$?F+wd{SYD;G8YghOy zHHhC=P}wilbfcI5UQL*O?J9B@Fi#2U5`qzvBzBCvZ`cj*`BPkI#}btasE7 z8QL11EOf}Zp`|3zNaCJM8i++kKbB|=99MN<)QaT3PezybbUouK|Lf8G)pE_K?`=*H zO1v08$`-Ag;$Yi$xq7H95dqsH++Yt>-%{s5+q#(nY{(`5iuKRURApIzGdgPJ3Y`mK zWP;=tq$@?RIo3N3`@{PErjQICap**X@@>xC0l7&1J(U|9y)QS3Q+Fe=E$Q#&C5|6JmsvIAx#62(phx;oA zDLTU-D=B0ULD<3ddf}Cjyvtr;SA(z94a`*|8|2wA|E(&jtBQ%e>b>=;R-mEC#KUcB zkvTKx8Dnba>2lZC8_bM*2IteRlePgx{b}9izIVt|`yqeR`cEZ-R0~p5IrQYCX1@J; z#?Lg_oMUzWVEs&paeWCKt7S8lo$Je^P(U*=N|7GS+nnh#jJ)R8f6o0vq8P+wmyG=X zK?~)_il&pDmlVcXQegQQKc){y&pg?-m9M#4oBB!zA#bI2o;ee)+VL9j1Kxe@qlUj( zI7&)?&G7TaYMg+Ddah{2*-Z@%jJqkpjE{$}lnQ8iqp?EJqx5tsPc;@R2<)SdB%9b= z8oiGQEPo|_TtM^ZO|zAj3(4_&GFtPEuX7y-yT|Tshm$J~SVK9=uCBJ@qa*YddU4SY z`hcZQ9H4kWe}Ik_^+wquN~4tg>_X%w`x4$s$B1~vuEF525%V3YcZp9=GK z-^(Y;XL(Ty;7AEj9W=3N+&MY!md?qS)3@$V_jrC&I3hT5XCiTnW(Z#~gD}6?1P3a} zv6Rh@TF$QUzuGb7*vRtdY4E~t9JS}R?!R+cF!=5S*)))#2#Y(mQfm2_YNbKMQQO~r z3K8R2vyx&Pdd84?r4~}kU~tsd!R+Vt0P(JN##@4KJlt`@Z<2a@fB{F3zLg1i85KH( zrHd#F>Ibjg?Jhx|ubt!8IbrLop*6P(RH|~;Dqc1uW}F#uPP=|JW!91A zG;F6jRyn6g_hT#Zcv4kdtZ!{(rD*$ddZDwPfXnTHiyr9XcEF1z#&Vy~xpY`l?ce(T z5AM+$;m&hq(vHC2ag`0rY~YTWTG^hfs@g+2pUCu155vU<#rs{mteX%c1$);93>27k z2*D*)en|<2vo^iZhPX`@;wg=Ik^H$AZnMP+Ca=GC*o@G|)kO+INc|zd1HLZr3F-$C z-X<}6{F1}(WJvNDqnbRy8f>o8xI=fKRmXTnX0bHbKCtoklgIJTM^{)r5j>xLbmL-q z=Cb1PNkK9YEfy1$Iw(7Nddo4H)He^f7!m4$GwQZr;QWNL`DTw$MxuR)QI6CQ5BQBC zm~IXigBJ761@~9UF9*zpY)4ySpC24vX7e6aFjtRZ7HtA!54;%SS8=i)Wg>wz#(uPi zG;ziPCWq7N1xd;?$@=QOr`DQRBt*0W>WE@Kemz zAOGz6t{TzN?Jlvl_)h^&gn#Q6;-f zl=fn@PZxepdYPl@b(M#8eu&Llhv)hCU=M4pGl6X$_j^~Csh4#i{8H`_Ja2d?;Vfpcba=HSpa;&GCBYza$Th0ndoSv!&5O3+vm!2~K7#{a|oU)CW=k6gQgsi_d z#xSlXrbpkoKXPDyUa{`}wsL*g@49BoUTd3+0G4)!w1>1)ka#2E{hiwNUnQLTW*%e1 z-Ccbs?4|MP4@_wutT7>oJ%r$DWwNxf7=+^vhG%3Zoh$4bG~W%e|NL;m7kyL5ucsU! zW&o8MB4#c!_j{kES;c9@-D(=0FD_c|`v#31S@$xOGtF60Km!B@;@nm-EmeTmrPH^t6V$pF(&P) z;CY+hgePV|c*dSmn%IUK=Rei})u<|ecvpT{r?-&lUt}hr_?1qEj50^jn5Do?e z6i1=19r~^iv|kALLyvgU_hQ@L#!f-_z?Ub>fPMH+ zu1M`#vbIWxGcO*)U;0Y#l&GI{o9KOi9Cob*YUNfhIO%0?Y=3(y_4k~Dmc?>TAQ*1lD8>*g3dloL=OQ$!*Lb|b<^4;SU&upQ^Roq z6+su?e&++#-5pPBv7Ar?2Os(H~ZfE(>8b3>;1Lb}Y8Jkw~`(1Q0_F~jj z#r0q(WB61uy4ERkXL&8;6`3mXw8Edpx` z{A%a*ufIVaL%G7HwsK;hhvRK!Ps5KTZZUo9@ufakX8mIyv=sNsXI2%VveSFJ2hjtS8JSu)AFZE_*yiLQ|`%&)+FT_UnT# z2Wr}hzV1DRf*fFkOd^jz-5d2+d79ltSjJm98_MRoP>Y?0AkRo KjRX&@3H}4*3s?~V literal 549235 zcmaf(Q*lc6Myr?6_mwww)cD9ox2@egAXs(|Niz)WH7m5wS8m!gISm%OH}wUNE4mzuJJ zfV7#d9oS`$kI#O46RGdFzF;T{dsjv-JIsdgKcj#Qfgmt=cmb0-xNTSCaZMvL zrvZJ~UTLP$pFAV75gVWa-6?!*YD%FhSz1iqmPrw4n$dW^2Vt^>QDD#>*s3Z_jpasp z0>)AhR4E+RngrP=(t1>xd&E#_SbSct!w?22tup^vsWkD&*G^P1r;ymWw327rQVdZL z)BaYVt7BR;GF29ux5)^_D%Whgg6p3;W(NVI&nusi6m(#n{ z4f{*fl}rvC*CRXd^UU#Eo{|;f2UyyqO){~j?J|~>gN%#Fy+iRd??mEPD> z`8)>Y6vf|dfTb4f!~9_DVZRvQN$`%$RhCOlBn5Pc+#UZ$4NkPlk}9>aNaJ7QMyU!C z9tWc$y1>?&DvTi>c*#7hu}zZ$Au-TJYH?3xtk-YQ!eQ9AkYEAoJBaaLr}s`}4@JVG z5VmNCT1{cFYe?V045PXAlSTPC+7t@@2anFLKb=Wz{;|Qxd)LJlZI$y8mESbu&Pu_J z;Gc3w@9F!0Nnw@{3(qs=lo}A=K{G0)=RZ1fcU+`3W2-0{k?3j4MsL-Utz79;D9(y~ z*?6hQ61Sr%3lG_}$J>^C??5^A->_dG z99ou{N**v@_H7Vu;GAd`#B4@BAy}_``;qK~@GMi4xvT}QPLo#?VknO3@@Tec1_icB zeu-n{!6$X__K*k@ChbfDFSVr6u_O^N*+z`kWm{C$)H|rc9bR5rY9_TJynTi*GcOxzYNS1bzdglamNtDZJ;Nf7k@&E2C-y<%YY* zu+dOj`B&6g632Rb35UJhrjlnSoP@y=7RDL-&`mbD)40RHO)w7@n*WzO#Sg*X>S$z= zQ)-H2qH+Tmyn3&J^?O8zo{nSlbsza9aX4ACi85#bmFn?qDEU9mu{O|sEA-1#GoWd z46bV~t;Qf59kr2qpx$rQp*Im4SRa*G5BEwU)|Vg?5d&1)dhy?qhRSBWzjkz2W6|OZ z8v=GthF&??Pz7cn-*b!^gs1DO76|_Q>2;3ftx@i?>|ZPMW@7RaOh0~}1428DXYPW3mDrmaB>)B*Jfg=(S&Fd$57 z*}3Q2jhbsoE`NWa24YBpJ*{!9vI$Rgq10VYz$5&LcuLZ7{YYCWg+;fXwOA-gluw(e z8Vif;o^z}XNV+p3kAu@k|AOx}4}yfVGl1n(T|9qPL$I4dc)1ZC=7_WWQdF*8c{5M%mPVfM<&=i7D7`CFo42 zd-XhK2IRbSHSvH^jyt)m(TxD4pfn_R?h?A!5kC>uk;D-9{;E3&wVNzasIjM#ntIO+ zw5qu%*3FfklW0&U>3Fjy;R7h+U-=-%mMnED=st z9#~wjh~sNe;#?1@KIwzYc5)`@Yd+WwB-Ku}(xx=(5KsH+M&~RXSI*!U#0z!Qhd$#o`B_yf)E<93^)%5sx1W3lpq9f_?V|M+_8_#NZ*PRS|c6J3KsWS4oY73~g<#^vl8Xk4_GK z=)&pL$DC_k#r#O$LbGLmJHvIXy;z=t=4!Mh0-uFg#^Q;kquA|dRg&scor4%l^*Ri~ z;}8Ij4N3TO1-24hVGUn=IdvmLYi!53=pqaJ>Drb2(*kE%MZ4^0V=Fe$*<}Q8Cg!Gp zIf8W21D|R0yvZC$D!h9LK~m_DkOK3qX?gL5T#eptub2Jt<(O~5)7NT>L^|QQI4diC*~W3rpr3-H?#OA(a5E#q#MX1ullGF>%teCNiXw1`BlLSNtgx~wH)=E3;--b< zbLg8{Vt&--14#3@_c^;!JewB{45_eI3yS9VZ64-!n?cHBNDQvrec4~B>&ON$jFLO- zr+eZc5`rR|obR&3CIi0Z!0=+!FyFlUSQwh(G0KPfJNZcm5YFMS{_H}D*3%>R`VSv4 zKA2!gHttfCM2NE%cm336eB2Eb6^J}}s&pp{#^9{SZloR6kJ9nV!Qsje4{&gVU2ip6 zi$xFs-JAw83;wXuZLIE`fg;JqqPhR!6}shVZW5!Z)i3KbBQb)-<2G4e5F-2yPzx%B zV?*^lzc;(?^BZGJN1?BJE@tcNWO&CLreI|^6D*a_+L9U3y%QS=Dhdnhq=)I_(2S8Ep42A2eEy0S`(gHE%?x!f_gg z=dm)VKkbVs5-c*kS$*c*zMUR}+UJkz&9_0;4gwwxEf4P#$V~_3&f-4>#C9%)c3_be z_=lYrsRY4a7%&7izMiDDEtuV@@(;&m^LM@rVeQMFY#w*1cG?67j z+_Gjxv3Gd8Y@43oZ;^JKejBXwyu?3fb+ z;Mo6!fs}lgbTE?~Zwd=5q8>`1T=#$i_eW&~J|=rK0T9$%^v2h47dZ`8OFJ&FL=Adt zJA+O9_4ToJL-KvI0t^7XKdtb;GD;BNLVId3|APHua!h-5tbgUFw%ggLa+B^VwfhD@ zpK&=qyMOIJ4t>pH$f($S@0h$7``&_jB?cBmP3*-~M<&Mpz}&l0X~@0u-j;65IQaS1k1XM~ou;Ev@#M9i9_PoQJ*LH^7Vv)45WS+i5 z_+|?06IJwXx7q#mC0mgKx7FKz(7ol`AL-m`K}vqqJ79`aE1qP!EpzFn4L1$ge)!Zr z=5`7icj|xqZ0u!nwWI8zKdkljtE4y$bB(sB+a>3nQ59fOb=z9`^t>K=NQ(1~xH?#j z;ksl?JH6=gGPFbQz4OB@q~Tu%?xU#9x}TgQjHY9O$3qaz(UueJWlZ=|JFmjv2YrHE zBSB}!D~8Z9*GwjB0i~48{VD;~;!W(XkgZ{C7|H(%A|A`MqN9%&xbzE!WK>`Sq)JC| zeM3jM+3rCpuy1j1C#cl6zo0BT74z}15N_4t?XmQz+I97YpVdrn%-w3xIC@Lsqg^Sz zQe7~)l%%BwHglJArl9+|2Ex_I&1mzh}OJo}1x!Ub1 zG4~X{=N;YR%bq7jvIq$ECWId?yoAKB z_WAbo@e@{+w4>ovtbqok($U#L{6ED|NsN&eb$@E{>=fU-4CnJVuGDhDV8F{~)YH@^ z@>;_Ce@%y>aBPak06RM(6xx8Yd0@RtIpQ*!4UxD0ttQ$AYReM;hLn3Gw%7zXUNoet zZKZN5dGTp#i(p~XkRUVfD+$4)3axP@ejLE%G-Q1$NJo+YFf{4(4#6Sh84Rnq@I};T zsRX|vuJaGb1LviPoi`7mW570=#8Yi$@SPQcLdu(ub?fj@i#p#nf(z#vj>as z_Y&z4p8Qaq`11?s7ddLm%|n(V6>0+UJoN zwL7osAgFe=XtrR)edL;n2tW|NQ?;|EuYE=!`iQ=^UEubYy{m<@C;mFU~XjH8r30dxCy%j zA?sgGiBL?!*V>2|QOx_dtCw^dLaD=+o9|L1os7AC$JMjm;c?$B-IxU$+hM%RHbQE<)ytYC$YPRw(vX_w@f-EmttIz)V!|DEFr@EVs)OLh za1dJgS=mB;VMs9#2dRca&skDekXj)?P*T8e9DBTdD!6R|NHh0H(KYK6$ z&Nk_XLVB#z8$j@9&8p*H6%E0Nzg|593gXFs7xQzC_!57f;Eh?Ziv<(Et^o1dsy_{POAkZv{!+4_<)}WXYN_ABUB+WJefQX7Yc~wU{1lL zX7`v~(q4YhP`A>e>5N6j9(n{`a6IB6RpV`D2cJe2atz&XFB448lkBZ9sf zpLDE^gpl65ovgnwXB=K7`H{o#Hi%%E_EYctyL6#Rz7_V`C5Tnh-y^7-xeX4}fBu>c zq~H6f0{e~8%U+L)Vzb{I1S41^QaxiS9xlse@RX`W(V%&^D#t%NJ0%e*X$sQKE>{T$<_DUQg|`N;&w9&WutMSioXbc*VY(qN zLm2zT?xn)bV1=( zuw9Le1TF1hk6edt-vcFgnA#6NWzqsohon(n6kgT z!>BD?mx<;*GE~^evryE|nZMq+Ze?^9SQ^5mpK<30btN=qUv0*_JR~<;gLe)ic8j0wb}MJl}o0yIw^|`(S{1*2EE+eAOLYgb^?@#DSQpl z(b#^yPx3L+M4 zWIqFT^qQJUEyz1>L}~+%gmFMh9IPTYn9vdH7jEn~SZauaIQ4Z!F^haR>#x@8hS;b~ zb);yALOfyl0xK~YMDw#pl*>|(ZHrSyCKF0pdPf!BHc@0NB2sy#G6fz#LvbXIcqzHB z09PX+1wk6Ax4IgP&j^|Ut2gvqGhyKIT)mqbv{a|H!m-5ZkI|zdh*LRN#TGX#O}8K@ zd7$%aW-Q@bYY08rYVZf7tOfO$&;Sq_FC@O|0xp(3GTt`c%2l;#V zaFa7a6o(U`sW+{(|6Th@DqgO6pYW}Rg>h$=DGHgLZb2L){O{kT6fDfU2(S1~eXEYe z%d;10F%adjP>;xJvk+*jy;@zw#2rrZlh0~m`tSdYSFLaN;{X_Z>hiQoU?>9uT1F&c zM@Z!0)Eb6-ooKeBCsf|CH(y(Mj=CQGEW%Tt@J#)gY#wP z!$K1m3DBTcb62~MsDsT^M@sHaj9uLo+WlG9j04Z|kb>W;c^M7z{bN3))9LiIFRaMh z@*?i|3$XQa|S(MV(*>;@maUR?!dJm~r{17g7>l-k)*WLbp+t$9_ z?ZyOd*QwLDLBpin$4_>`bq+!Z$gLi3|7l%*G7>F}k>{N}RU`%eohDdA}};tC|_eFZ4| zy)v6+!s0g9pEvh)FU&dkPY;#kcC|eQoha#U9$t~(p6@Dx6{Vm==Yyo5bpn<2`*iS4 z05IhsP=?n(Fs;FENIh%rd{RTB^bnaAs(nm5`P9n#ngcHAw0=JT2*#_#OFzkM!KvL; ztU?dKadA$0;k*dczGtTvuTLDKmV)@M1Il1Z!9wj-b~<2UaFdcS>gU(sU`*ojC$r$m48cAsxlZ#6Hq7g-}ov1$GQQ)z~@Fzl3|)GQHvu4|u+8_=#i zHZgPXvaj(>`K_^v)<4}^>cjE;gia0+FP^U^C5MC{X1knv=nX3V3$|A}bU2S~&sylm z8mYWmRVOk1-kuQ0cl&fu2bA~4^Tz!Ghch|i2%AetK5(v|q9^WopgA4zjJ!D)gPlsF z2;i*>DYRG>ZXzZKvXRvml7Q*Aeyq_($PjaULPza$lt~kSz-0W>Ggy05gt`=IM^X0v zk^pM6pT6C>i6Y=2jaLkN`#6Xb#Qub~zxz3*S0?|B{=BoNr0K*!$^J_sX<71s0UJBJ zO4o|{_QK)yaEH#qk3J|T-6k8(pd7qL_xU;XftIz^w}@v-dXEUFr}ygz{v0iKj`cVo zf2<0R#g5B=Iz&iBS#qI}XZ~r*>-wyN^1NIC-EB!-!_F=}0Pqk^q4^+*$=t^zs_74+-|ye`=@eilHHWZie~SQBEp=edgw zUGK_+NMM8Swx-n!)klS|RR1MFB|$2;1M_j{tq!xX@%bB4o+J(BMyOln{rW@5#vuiE z&!y5RzyGq2+nbQ}6p_WR#l}1T@}TtyO?zMqkzAGC()WnSyBf>CX`9M)$*a-w@;ZW= zIw07mZO?=nBR6KXs^Q-9^FD7l^1{#}!oi-BkUS`lA`|*H1Z7V37QZ8cFA4UoIByz+ zmwyA|Y$8M!x>ZGbbn#{+(vk}ZCceM@BHL&axf7FQs+V(otlC*rKL18@XMhZberrGQ zt?T#i?(}SPZfjlD{hpbf2;mPycVMDS%~d||h@~Q1dD;j+CU+s3mCv6ugvuMRcr!M| ze#M$BE5I1atI}1L8p|fG(LhzdwSl96u(E7C2OEHSTS`kATom}YB0=K3&IL&SvhcYP zMSM%6aD_`1~m>U2*)qI4LNfcxwi zaf)vqX8Gvvq=*O8dcGS3S$XV^z)X4FuyuSic33qH*WQH>gm zRr#nX=8o8pkVa@kOz0gSZJ$Ag0-~DXor4ih_}3UfL*gj9e>T_x&s&dM=?9d5tEB|z zGY$#b5sU|Y_g#h@Y)9`>H{E(yZ|BDtm-i-P7o9bqWu*?LM-Jhd54d0?r1E0|73DR$F~yb{VJShYOkEmb6$ zymc}SDHwC(|^J}Rch)j{}B2@5|Pk4 zQk%Dnq7d)PLBvX(Ehu%gytYRsAY@^}rKCk#B?GsxKfo4&&{{agsV6YQ~qy0+I3M^bP~7q9c%2n7AsmcQLet~og#_!+1fS6IduL0ZSejXr2 zO0763Fahy7{{LN@r%$MJ1!7Rs|KD1P$@hZu&rtpYsnI!f& zgUywRrVIYt`lBX*6Z~LRdx=N&cz0W@%ZGNO6_6!xLE}-w{al0EH6bLr-UuRK@IbPZ z3h3p3Us$*a$g>>^pgMCtst0}G(01hT#kAS8PV&votk!M46JDKHoI||6r@#%F?_ho@ zZ;%|^^7Q-Hng0h0kPk@A{AWbJGV1vbRU+Km?A&KyLp(;H{}=hf=QY#@f9kj^y`;sH zV$wwLVZNI(NJ-9||Cl$e&J5!EFGO^yx|?af%D22H9dKS;ci^S7?%4L$=54Ay5tiW` zt-; zqMnTj=QfRvqRkA-ti_T_q{gF45J^P5EqF(Wk(H__nQ+dAF~~F%1T^MviOpc~sK<}e z3}fdxKD_yc%J}Vjr-JkU8fn5y4uRbYc`h2qphm@c{ig+;Acw)eq#EJsg+^HLFb<=M znFl+n#>s+KVMf!wF#c~#oJiD} zVI^kPkS3l63(D+p*P$JswIqr_VCPhflb#_15F8PWrHT!=BB^5d{>GkOu4^3ls^dRL z8vDa=jFtFHg=kS!&$|MFUfi6D7J)5ahc!Qa9$!bTAOEC}IlZjbSl$&c9A{&B=ZD-6 zCMsr8T%xo9L}our%e&glnE~jXuLkAV83ySC*@-S%;B4N3iSS-F$?^sC5(L#M5`Cz{ z^8xIVpZr(3f~oe|W@qYKHhS7-E$G|zSgSKOJI)A_1k)K$TWnmR#u{yA=rOGxT9c^jzfdHL zw>bit8_G>FlKS+2$KI-tY(r%Ennp`%G#NsHVFqx4*o{V|PvBszxQ%^#7`(aq1iS;T z(JTswy=c=Mn}@S-Z7C)R+IgG?n{pWYyo{e#Dk;Y7@|#(hWPQQyIp6G*?_9pV05sSk zZ)Fp*Vh9wJdkSyf)(cR*q6FSrXA4XGSE~&02)oE>(@)@{pL=-eap9HTU5r$!e z82=8X(l+wh=v*v*`?xUZ7l+?qfmTei;Z&d@UZ%K(<{yKoe;?A!l4>!TNUfzBDACgv zO2Kb4+?EpJulQ+!K@$R1y)-+j6^#YP3b;k5Nf6qkh{=FlxfE1tbO?&v{Gnsw4V{Qc zQZpE#o?{#2R4d1r?a_DSodf*K(ddntH+4zF$v^y7nCLvz_wfYVUhVacQ|EP6?dF1e zPL}OgZ0W{Q^?o^E@mfffRcKQ#75BVo_j>*$p5UGE&U6yxly0?z=w`sVtWu6SUgNhzPdmX5)@~HN&L`4`UG1+~(MZHvH>z#V1YLrQ}B^ z92`7PZdbpk5O+ccf(rYqajxYfqiid5^wn#**G}{QuZ3Pus@f7bN;(#lzf)3$3zP}OWQ&3)n zb|}r>1H8ej087_2%ZI0SE8zVN5r-Ipebkp$;NkgWEZ;9;7pz5{gdDh)W1v0AwP0Px zs3TcZh-%@vz}1bC+s9YbH)zPMH{?$sr9O`~3CQ&5_WL5McyuJ-m%e}35$FN-@r8N? zsK3tkJvt}G-X8HyMM>0o&3z9_F!T2NE*rZy0-eaKxPQX#G`3RDw6>!bsA0(+hK{U{S*PnBkuhN)n~CEOL$6-pN?oGRVL-FQlACs)H!klt zXLkX5WD5s*ygamdgd_jiDcpFVIFzp;)`Z7hUx5}Dg>o`;{Rcyb`H`%osFSsM!TKX_ zk>mNB&|AX)VY`Z!##`nZJjb0pDg*{sO=A44rOj(1)4Jo)Uj*Emj1RRWv9mAU3Cc@o zMgs2H?^MighhEF*QevJ0I-FNQK1q*-cX>Zv&h(>WNR>9Q`$M^Ye$~fye)sGM+s^a6Kk7{4km} zMq;ZCuX@9Wxq!SRYL|?r8xz}5@bvTZhMAPZO+_A6)P8#C4E= zscFvRWP>LW66F*)Om}=j8~=@W9Kc*$-ocxbRe{E>wy#mrF3(7feSqUS|HUP4 zAK=;L9R01yAWJW(weKGWNY9-Ext@7meUiB8@d}=TxMi6Cfyf^z&D>Oq?IQ6I3?zB) zl}tH`k$X6gfSo0HD8=2uu0^|aS||^{%K6ayHa_L1;(0Z?eX$Se-~P^$5p%_cRsKpAfB!q88cw01YnE76 zcLR*9tSenKe(m^;ZTa57j(lMV7f-4fkB+g;Xq#7qS;Ee}3oneuUhZw9?0Rc<+i<2j z-^_1pDlf;=L4QsfAm^og=mb;4wco_GPfmiFsLm{fHWV#^3;?c4O)#wRMXa$8Pstfv z0QgLgs^Zg0+WJj4D^wXBC=5#p#+Ffq@B+dgS3hqel)RB4cPrjN?P@xCAo|6A(8GU& z+lCdmH>AoSrEeVC;(SpY^4^%5+rmeP+}z`Kbv@x)BAgR>y|D)s*cwGr<5;yTCJ6Fi za*H?=^EYcga8Nyr_!aQC`;&xJ=z)e1gc{&<2qM_s2XQu-{rEIH5Djpc(wHqWl;<>C zBD6sJS7ywT7SPI_di+_I-=cD4He;d(IZT;hb-d@py+cx5!;=+F=Zl<_|101k((Kk=`IX+g7}8)$~GU;6VS9yn@N zka|LC>D$CH24o9K5`V97$KH~x>LFB$&mN+avLxT;xqk`}UJy*nrXG#$-QA`LG=#;) z=12DmFliUVkrNkZDfFQR_V%IqZbEEIDGi~W_uk*L5wMtj5?w9C6>X)7@wGL1&E5YL zhJaCThD<40Ezt^kX@yB*zGbvMPeUy`w+gq-(|692X3GpcsCW^DUd^g!BWco z<|=93udlKmnmc>x9}mtHIMFMZ9uhK3h7- z4E4Xz+%ql$rv>xk9tmlY#`|B}F)X|+)%He;uS z`F+8kP9(ZdC+`o(gIb|0dgdddK7FD7vNFf2VV<8mM`QUy>iAjYhH?)D2&PIz0P#lm zVE}nXY|S}RI;jkUty7Q1oahIu|Ab&}g59pIIn&mXJXt>nce^Ma1~Jpy6VsGav<5oJ~bfEPWQ&kevpdy&!d>*_3$bPE?JF#*8MiLh$J{wkQW+x zynff-4Sc^(A7e4W7J5Th2xNHeUp{ z*98lWC*Kxz75vXvVK<}NYw0r_;~(;+GN&VK+O3)Pxk@U zi2E`;7m{4fL<9Qm#B3NV_6?D#Tl+0Qxs5W3fSfiH)rzvwXB&>M!!`RW7wHFv2Zfe| z+RU*nL~ztW@=Lf?`yY?SMZIAF-yPVHB?vOlGe2&mTsW2n)k%UoyWH-qgf=4a^3n?t z{n^ezVCTMK_0C(*4Wq_Ok%LQ7 zC#8(n?t4(=zmC;mpC#|D+s;Lj=Mc7KpEqFC@(r81 zs){l247hURyJK_^u)kXezPE&HPki+r4+0)W%JiQaLINg5R;qOqGtx&rsDMJt8{=IM zBL8rA>U@b18D!-ew0hNQgSjIOMsgi|`asB8AefJ^4WzZpB2p_C_bw!RJGw#PNpp|Z zpst$X8}~R*O*cYqV4V}s>rz>i#Z~_m_r|s5s{f1IB-d994M|ffnNQVXUZ5Xe&u3R! z&prOvhVNpUcfU=~#?O~c`<~N+?Gw&BK|Few(f`a=5-eN(Y`nv(Zxsi%Z=Sj*NjEmY zWsD$Gf&A%m`rJI$nMEZ}BZdT*aS}{R<8nnLdE_W#Tb+Yr!QWBlyvl~>U*@apTjDE4 z?ZsWf4F~sDhPot|TlXwiMRCveUODb*;XWijo!s~faqLDPh+T?qR0k0 zX4>vWRNLE=O2V?Kbpl6>K#@~uLpn}Pxr&p4re`Mb~S;dP@OsRjlR*Zru zZG8q9IX~gYGt%F_04~b;v=?I)!Td0BU?6|?GhiJknEQazZ%8`tcXC8ZyO`@bUZJ!U5 zkXU}dhSQ=v&PUC_b@=21Z74~MO2Qem0Ag}Fl#S<06@tBYvByHuIRkSWPm6m$f?e+@ z>V|&fc+)Gv*%D{v*1?)?LBF2s$H8#CZK}6#7Z;^l&<(p=?-7y5dD$T&ckz*#&(Ase zMyVE|hOa#&u8ml^M%%nL2k{B}!O1MO#qvnaaCanhgTO4#W7P z|q<^6pqfL%|sIob-SwT7`BXlbC+wt6kzlc^a(6$isECnPtn9g(o4eRw_FE2Y6y2?kPtpg`3cJTKbL9Jji|deq$1xa2$0?_9LS}m( zrnQ0}F$J}BJ>MTz9u;!l@_UU%cM2z>RrOT*338!ko+6l55(gXwObIEl4Q6}-&gHDQ z)$RgKJYM6^e>9HT7u0IK)jrP6ohIC*OEy?vE9BOQCzm)9?BkIbHzzxlLZV;T$7XwC zd44`|R&JkUaaeFL=aX$tl;98YH^+1utw5=k!ivhL$b3cFA=?bfW`z1?;4ouL9VSPVq+v{E%etkojM^gkifa+IWABGf!z z#bdMwRX7Uh6pF|EQJ3RK-da%RB?#b=Yd_TI-;TEmGcvG8jkn-N+iAHpqkV z2Sbm`%gJeC(}2TL(u9dOjWZKB9cIIjk0=K3R<>v0N#G=`)^qCvpJvV*8UbN4;a|2u z8}3)w=7nWhi;*gcv^*YL+Pm|rsnC;-oS!h_Vm$|G_@w(q>&@27^#)dF`I559c4Au0 z{jSLCqK&>XTba*FvY|Uu*dPiG$%>mf({lV!IQ7)4yr$M!Ara)zpjU7}n3iFlne%=lL?NAI-~=R;UE!|=zR ztFT9!^8%B;>L9d(HDZPTI>t@7+1TXP#w5y`)p941f@ge-krW#r^HW6a2`k&HnTRuA9bFRN{{*PlPnyS*3&=ExK1cHAYa4l+qFnN|djr zeEInuq5Tk_9<&V>vFCcH;_KM<+Qe$aWLWwxAT=iY@J=3LaczWW1uo#$19v`-(?i}H zc23=F@kdPkBoRw$B#O(o(Tvd4TR0Dh<%Hz;b1<7^OWn(OB5nZTyPVyhT=;O3`V%f` z@Gv0#6Ez8BbT1_L9X<})F}eqY_KdTD{}1u^ySx9T92rfbW_=jSlYCvFlnl+Vsg5c> z!mZf|-uLDzg+x%G0mS_u!FAIG`MUU(7xMzL%H$Wk1og;xe}CtpMGw*6fZ0#18=>CT zQ~qLrN0AL4Ox*pyTZ4K^xU$8SHR$Ybp?XA5M+9Pqzz}H1dN356zJ7?;mqsvyS;k)i z?a&~t;BvXswsAmeXzI0D0e( zFwcDq+V?T zch>@r;v?$A3Y{`Cz-`GfmEyT|xT$uk!-}U!xf@UG*3zoVi$Uk}5RN^xN(M54L0Un^M*+(x<>}@0 zZKFnqKwHLu;fp8t45l8u$gB`%jwOtuK$7D~c zt+2t*r<-t(`@!~2_G8AkLV+u5gkgjAClP>Fqq(X@$3tSVy0u;;YuAY91jqUdk%?ev za?O?j(r-u?&lQ4=qZvpbTFXM`YM#%Rq^d-Xs=mEfTJ^RT%Cv$uC3M8QXpaAQv-}JRwgd@M&7e|A{Lc|Y{iG+OYst8^Yo<}8Te*rK-Rme(yL7U! zJxi#QdXd~^+|6Oby5|l%QKuF4@2y8T9>Y)K=zADjYE$)1YNLWV>j>=Pe9CDDRLa^* z3nS&XLej)qOxO+$*RG2MFCrNU?q!3BmZ%wF8WW$}Eqq@%7tbHbR0Nuc6+?oqk49#zg?i;1gf2q9h81K> z+;o20bE)0hs(h#noLX#X)-G}Ecr`meXWu*jrG8vZZuAOZ{eG9w*F6hUCkdlF#GmYC z0z^M9?LYT!opIA$2i6K#R51SW>F7s%cZ(AY708=0Eg5+b9bE~rodlQy^gX=nwmG3o z$~@@&{QbQqFG7eFc?Ar9+){OsKkp>TRhT2nPMu^z5PKhsoW zHXD`9E?Mps3RrY$9Hp8Z4@w^SdosTqPTFS_gt=^=Dul|0T|GlLxl|y9fAP%T2Md+j z42JhNuC(hs6F}-vZomYLTgR7O^VQsSTcDVaC2zflOtCd{kT{D;wwH^95za_t;=9up zckURN)1&{@f5 z{V5Z+g2t4*X1Bl^XR@=+(5@rQiw zk+#j4YOr1-?qH|K(#erxNQNDGQVA@j&yH1#kDt8d3-h{t8i~Opb5;y--6kueMo*97 zG2xc&L>j`@LdtNUajCNj|B-w@+RrT04-8ttpLstTMYiKrO1?>b&xL-9#@Qqff0Qm2 zXoav|mB^j{PFtDq(5Kg`za3!I-C+a9&dv;EXp2QNvb)655Sa9?*&}8Gn%oBwblR~R zGl=WBOC+1FY_f>QUscq_o)$XtFKU=d)Q6}5=K?JJZCIT|xp~M?e&pQAuo^(R2GnWz z#c-S=dP21=DjT&;!4<6YQbD{&yv&|>I)} zdLbEe)f>i*Ck2~J*R(BYF*aPKHdyiioiqK39)qealJw6OPuk6K;*0!VKD>cHt%+TI!+%(YhJBoCYY~< zfB7~SgQWvaj5$WH=1G{fW82U+PTiX#$4ki$Eb-jynM2$@NQ^0FzjLK^bkUKIQgu<{ zymIv)UymKjy*c|$Eg-jhFWbUA+>!t+R2#%|44mE7M5wer%iPCQ?iD|KCb=&0qxu9~ zfBOzrHF2=xsr+4bX&}9qjF4YQYnEimgj? zmSxdGem)XOTc-JnelFZ8FXxucy-tTv4fq9c&1@voF1~7ybZIv0mwGWQXK`ew)Ne$4_hrmkJkiYMKwrK}iE$;c<})u(yf(Kb zOgH}q{2pRY4(St!=P-nPg})}Ui+DLGR?`NT&x&giJvRNa2s1CYkf|({Y*4ynz1A;g z9e(6?rs5y|rC-}B5X=utE_^IscebRHyx*7mwqMF~)~H%z zj#@SN5#&drvqJsp`v7*~RK01xJLY4)&YtC!Zd~^o{Ty&igLp1z4uve#x5?l0&uUs* zF1hYF@6`1vjGm?~#!NV}O4hsdq-CwIsHAKTQ|ejBj)BMAW3-1)Td><lFgv=dGA>d6RKNin~hq%P3J?)iZOwGy>;w-(Xe>^igpvT z6ASZf$1S|fXSkII+)=i4_d>=SiwX9lhEpSFBLUY+Sk@9bbibyKy-R758ukTYo!O*` z1}0si4N}q`ugwE0AK4C4i~t5E*Bpblt)_W$t~Eox&WpinpWwF1L5i&<>k@z-6g3S5P(V zV*So6^%>^>6(a%LhOnE{WYWBDxlUa&TB--Ia@@>!_eKVr&b%iO2Oa^K&a{^I_zPaX z3b;Fu*QM5(Rxj;P+WW4cOx-)3W#JBM_Iv`xGR|4Plh0S$cI#mT#%B#-lmdEcZ)$^y zDs5zy<-B4R>>9exP)GRB9Q#Sj;bv{tyU5qsvA%8wDlv`l|Gv%)*pEL*DN_5Y*+5X1Y*@n7#=CXi%O$tNuaa&}*Av1<=FdC;+SNmusMCa`7P z2MIZ5bp>=Q;U*lpmeVtX`{QR{9d52H7l|X|fyWUvP;nR71HpYhSl zK)kD*ulCR+Hsyk<;|+)nV_aKzZ{=ryntmwlxh5TE*%p$Y1?_O?Hk%PPO4c;zv^6MV zSp1KK8HI2A==}QSdB`XK5dn}--9z^Jf^_E}N9Dx(Eq-3&atr7Y^`b3#AvAwmIWp6y zG(=xw!0wD}_cG)r8Gr#g(1w`{`!WrCNLO|Gj_9u-mmfO(jR3`c zA=RlLCRY4+`I8#Pt9@zJTF6dU)JD3JV-FY#D%@K$$t0IYd`@?UAFXXYR!xK2;Wtsy3^w}xg!2;C*KpbbH{R}|=el9nC0G9wmZfg{rSVhYI z;@zLS-mwe+bIGX>i)Rq9>9pi{4P5OdW~U} z)tQV}WPI#QZIhIa@NaVTow2}$eRkUNaD7)ECjaPh`_8AHA3ZYs>=S*5BqJwI|CmK? z|;w*8ZAod*pPw_v0KY z0sYM5|9Jo@`3cm3B%r5v>d^NCC8!W9%y90Yf7R^T%NW6$V<@N!u6cyKjYH}M>Tgu1 ze0uXj?gEPeI4q;^t|2P7ke@W)ce~$NqyN|U#}{lbM6CgY_ve(9ZFya1^^R_LDw>En}^H-BV(2#y6%Ia=V46)tOhl3O)pH+3APz35Gcmky2lZ-`0#@GI?U+L}mFqt`U zG&BlhxilV%sRehaLY7MPnRb>)1jlR8F1+p`t7^e7qM3_&)(G4r5}x$!=uyFNI=P>8%Bfoq%RwSy6hqkIvCIPMlRBYmt%C@wB>a zW_&pe6rJ{Mf}9|!3qpZTQV?uJm2r3?KHsPL{tZ_rfUCApX~SRR>%?U)R;+*Iu8eTU zE;Mufzuzd+i{S$vYR5xaLE&CammP#f6N|vw&rXWJS z^G7&*95FR|b3d}}pS95F8=7~0tv_K0L^Vc@9UzX>cO1UqEiwS5_ z&@$VB1tT%*4$y{A`!oR=FZhlVJ_u-Z%p!KHMHBJaQXW4gmxXG|!l3erEey+i zdr&{BESByGQBb!M6P#LCP0CoDo@F(zGhF`PQ$ zc|-n&ldZRcy!h_{d=VxwcK2NsO-jZjMc|2i`N(k~Wdnf5fN%cc}?#H-*=hI2K$DeumgqN>){rPR7GoDAnbWmpZdBaQ9sE=+NOd^ueY_?v68!{tb_AP=yS%%QW7jm;MIHYrb9mRi;n2DGVXY z`9kTCU?_`j4!R1Dp?&>TaUCfquZp#GE%?>q04L5&-Ah+)w2317?Yp(LAxMS|5X z%a5OY{}nkWI(oc2U}yDz6+g-UpW*Wk z^6#MTqBS#TXOV<}9)Ffz@_7HBO`usa=AXz2 z4OFQ$P&EZ#yqdj#Kz$lil{OqbKjr_F=N!BVG6?|oFzWa<)1 z91ZT`&b=Ae1xB1(p1G2_F9IjKO4-eug85_W7d1O$OG3@XRBi&`Bd_{Nn`hd)sepx6YHn z&7OY3b$86>TA$)@m0(gnbIy*Z{!)sTl{&DRzniiIqiYhiff9&XFuAt(M+Utn3#ft; zP;^{QANuK4dvUSRX*C8rs~~|hZay^wH5hUPk-(Ico}X7f_i(`wVj?MlH?F;FS559BKY3QMO;K8)>^aR3uai=}E64Yh z-^beWSqh;?dVGl>JmF%V;;$YQ`&p*(GEu&;9?8^Wo7!Phyq4CAF)ql4OT!951KgSb zp?iE+K07R5o1dN|O^dl!5J~=gJ5k+N9(o`5_VK3ZNvBP*OyUO++k8o@_dN{DXvMIC zv|suI3DYqB)`?~oY=Jpe79DSM{IA=&8@UJqP6HOb%eVPN`1Zd%6v=>Y3e*xl^T6Kr zZkZ&~qE560?@1u<`}ac=V>lk5KxzWXb<}RlL$LF@ z=|z4^SPdOf#Vqj?n$-8`pCn5DMIucmpFd3txQQ#h93JCmD|3%FNvhL_(8C@l)4c)H zgZnQ-(ZdI3=E#~Po?4%`Q%o5QySy6PN3a36L8~r5IH&W6Ux+BmUJ4CoQ#xY5@WzeQY|aCFlqDKb58NR|a7gz*Y89nse3 znsAL7jA4!|CzcZox!D0oH4vn!J*M+!KRy23-Ah148>YA^Vm_mc8`fkm{GJ%#BjFT7 zAZ;$A{YReEmT$^rJpo)UTL=5}jJnKZGXh$-%=K|uD%DsyPiVSOQ^>OQHnz||TsZIG zBM;e3TD_)Q;5)T@RuW{OaS*&ij@p}LFzGeN;Kr3N7e4#eS3=<$J-!+!>R8t>l9Vf0 zgn*qMjAVy2u?fS{m~QbV=Tf95cS)gGB23S;$-pKh;d`L8E!lgE?m~F=P!44vUFas- zP)+I*s<`_hdIhbin1qfDPY^NFNa4w^xK-x%h1=}x<~`?J&;LCiZ}j3`+0cqI>%@Vb ziF^qziT^tfkgKN%V)!Dl!nxS4yx^(8Xmy_7s9aid;spGK^K@61*OFdoDBs$UU*3cY z|E^y6X}Pqw{k=})ncjY_gEwB7RMy4pM)LDc_fPj%&$zX%>cvIu62F((X{Do#6Reka zRouTCoS!El!GxFZ%O?qKlAI8NSr;mQ7?1x{j3Ry=Dx#2`)i z=FT+^Gln}(=IK`AyPLV!|C*;CY5^542A3{UxJnoH; z{w-AqSZ9#-y60WgRZ1yLAV~tpYT{jb!js0bI)%5tN`_DMofc*W$URjxPP^;=1I9a|v+W{kjXj4PboineX`xC-5 z$at#RVTmGK174^tN>Xg$C{Nx)J)F=zIj2eYlbrwaMc8HEEvH@z#)Y&>yE^q@36S%O`^$imTBx{yL9Pw@nh) zurO|?%EKfbl-)TDlHXpAWL?7YXF%4${GnY6o-yROT|NPRAHd^Q`$d44<7|fr-+zwJ zWf_e7Rbh{aui^&T|3l%dsoU!oZ<5FoT8n))4hcDq!oQ1ti|FVk{{F_l3&03t;Gcl+ zoiQliRHZFEy$qFSdd>+T;#4nQWpwt?BrB%P*Km{lx%%I#LGypd+D_hih@6AbCZ%(o zF3$KX*!0mRK@a{$u2TI&fEsBCOGeM-@8V~3{AQYHqvhtd&|0wY zL3Z_hzrBD43e+%x;9n{rT2;d>({^$C^lC8VnpdsyVxx$)^eI6|(ptDP@9m1%d?w!BWGH@C&( zGLy$MXX0rU>HDUMpB9|phR-bfGGxWry|EbGYTSUt`5rW~a~rI^GjWl2Sye35J#?Te*xvs0C5Ff!sJ_z|M2#? z;g5{GLqzngy?^F$@85R}#G*Ez{nx!;0DCFE-2Gz1Gq0()HlKsW6|5Jjfc2tb0(FfO z@zC|4cwRfX@8e#)&+A^amHOfVd2mB3qSS-AC)#4RX&C2`8%nR5hN*nB)7L}!C?lp| zf0Z&amie)qSTY9w4mNel-KsRsETpf+5TGZ&5YfjxKI%nWm~Z`ZcB$LQqKeMFGOVMH zj4xS56}OAN{?`hhy3?N7C!xlbr8?Y$$C{N+tCj5B>P?>x%?JNU?_t6Hs+}6$HmT+2 zO}CrMWO|~NZ1wWo?j5Vv>fw`)mtLjMgg!eLq(7(Ca+d`;^;mVis~frEYQ0W>d}>$h zHuAe5KcaM92yug*YFB(dU8>XNTe@F*R=yQ_=+3a(Vx6j2Xo;+#bLC9uCU$vMqPHJt z>c12)w@>B|b)|V%vJSgu-r5&!Uy!c}>+)J2CX^?aptql2y|wFe-GGXmS8tE)^R4nU zr9$V|3e`?Mu4@)6Yr4(O8XXPQHVR%gEY_@a`X0OQMXJ`OUAq=);@wB7cAKF_l>S@2 z1S!?AW;d0Fk2JOBUkw$T`c+p01y5V=J5-i+W;*MsVyP|n&u7>B_ZkE-H@G9Oh1Hw! zS0k#@+;dY}+VwkZa`bla%Z{}QJ)PbaX<5^1cde>++icQrUJv)mS3=xReYRfZ+ueL` zwM*|t?tB>Uxt)fwE$`56RxV;KLaKkHeOGv@pSi(%lLPN5ao1sT zg|{^6nL~GOvv`SbhhM0^47hb+war}ZFH_d~9<$Nc#T*o<*|l;Fo)m0Uw7|FCs^{a)mP4lsem8!VvM$Wnk8T97*bwO9 zJo&t(uzKg)5xp;a^}5VisqCuX_mp3DX4j)v1zYXkx9@!Wx_oRAtxVQNPZXT1%s`E{ z2=~-yeQC9<Ro^l6YXxiSM&)Zqdws>8BzWSDK_0?e2{pRQQ zwNSbL+KigVw}jlRW|adP^(pmw&Ak_$*D60hevn$n^+b8PuMwh0U75WV7^ci-%y+IJ z$yYCj(-d2*mD4G6w_E4J(bem(%y5_I!q<*ui9>Hk_b%E#(r;pQZcfBY=QgLU|4N+} zd$@RPt@O3`ZH%54EYzT~EKgOlR^VQ>s{K@LRPFqDg&8l*NWwC-mM_2 z2)!;~sNhl0;|hPaG+4*8jD7-?F$8$Y#l1#i|{j8|?UC=U~&SrP@EaJezyE z(%@)4yU8ZK*cvQ!*Xrx8Vy(w&pWU)(*353jA|2o2(^AORBG%*krbClH*%o|ZSgpxd zo92^6+lse*DD}alPvz$jE%x28+3EDUC%ivXlX_|PRJU!%x63;5)YZ>1D=l7J<@w>` ztB0*3yM1)!SpBrcY1cNY9vi*LeI-ce@_280)!nQPrw>Y4AmXms$r0uSIKBsaB<0B|??^wE0*2{BzDM^yto2 z`l8sS0KZwSUu~lLXbaj$rS8H-YJd2moMxZ$ByP3d*=(-UmG@V-RyVf=23NTI+swoA zo9pI>62M7y&%9hz4>#X>wzRk_eC6f+%~a6(Y^PjkvL?rsD>dx7w?ch%+YOL;+`|1l z_r7I^K)9(dN60O^X``3ZYK^>{{q78C^406QY<&!SFW}YjZ;bD>ZBgK@C-9xvjZw!Ma}jfgZkyFw=lfJS<6)idPuBW$*!f!EG?Kk~ zelJR@Pm#B$iCqb1J5y00{Xy?s2enCi^#Lk2CKH;nX#~ z{?Tt?GpD*$L*RD4V(yrbMh0+F+J3fk`XE1n9juO9vy@w{v@J>(8tp2o0d(3aNMO~r0`7$B>TGH$!3xMi4gu+|a?g-8DOvoW)8wycQNCB2;8%z;y|?jSfcyx)LcW?VQoj z&b%qXF6Gw@h)xmMP%3{MZPStkVF}1;7MSLUoNL;>NYW{ll)+jha#wG~&&|oX`R2XO zUV-pl@t-qVB3%wuaK&X?|6~F~arNtlB3M`En%nBh;y{8ESUj6hW()sxxtwJ@x=Mj+ZaZ<3;jW!_Mwp7?~INKZ{3JbZ)6FTRal1 zVVU2rnVd-8QlSsw2yMr+evhTkig!8tHYauFoM`hRcgYMh-yHvDXjW+{m`x8S`~kD_ za5(&WW3PATMF_4bV`B~y;dBajl@WG~Gt@vFehx4)_}st+ zDS!(ksDls}rT)Vc`>T{I9LWg+BRSg}L;mmhZ6wJZ#NZnPBvAr4x9|54(A)lFJ;5%J zJb{#bL#TwSn04I0J_lw(zgt^S$A-mzw~`ZM;T70I{bqBosM>P934i}hi{Vcip4YFd zKJrf}PT=*=IBGlW5sVC%sT0JvLEPWtzTr1eEG$rERXcB;>bg;Dz-KccUQ?hIAivB6 zUUuN8((Cs@g`H#lfZ}+3*(S5&Z`%t{4yJ7J8IrB%c2V|##{T-QchKR`@&~+Vf1d^H z0ItB8JOOQTLf?S)LS)eLSpuQnjr%>r_lqtTO9w6lJtkU0zM8MjI}jsVw{QE)8)B!Z ziPd~To7QZ;@C>B(XUw1M?n=zt*Yd)T>b^^bgcn!oS{d$KApl#e4-z7~7pd@u8QFN3 zS4118*;;QT^DqYQ>>Td*3$u%Y>5x?vLv__D)>5r9ZkBduPl{!o!%l3+QxW9(mY@^e z$py|$Gr^43`g`&5XW?+yr^vdqs<;NqauOY%NX_W}k#sXnWan_9p%;#QU&!U=8U!b9 z{_`r$58CAw)y$dtukEDN_)IpVGF;Q!fXE!*Nz_^32lh3xAQzT*JUgxF-$~2=7oxL! zR_v!7%sPZ4}>P9dR`R7X1>2!AZmK89GxpK+ju_}W;ApWoO`^Cez<|AiyH z)LJ55ZlLlSGWCqu>Q>ZPAj&2na_h)~&jus*_(kxOfMEBq`4>Oq727+w-CHU?g*TVjKf;hDYmYpzLrn{E4Gmt8 zCW0Ks;NFAN>p3XDq}M33ubE7qA~Q|Tkp&2Jy0)K=gZ&*BJ3gj<(m^f;i-7E+LwC5w@7>RSukY33LE(GA zH5k(!!0hA|@$NOO)63YW8}Ijy?5>?f6}Qt(l6U%6*N1A5U$XpIEm2AVS`-bKF_H=pbCd{QHUoXXU4olvueS1f`Hn zAkx4hi4Y2m1S(8vaLOF?+E=?tAOj5onIUmSc|=Jd)tXaS+;35=v7Ljsok>Hj-j3vn_@mMQzwA;v_umH$I!sVum~iqnQjb3^BhZ0=AJ`HAWXU z2LD!~O;;T9O6ZQ_I*5PAv97iMIEv!&y&ve%#-+l>7&fi*8`OE3cQQ)DPo+xg@LD{U z3%Vc-(BQ|OjE{c_9u*>scpHS&`Fr?%8;C!)#@``<>H`uj0u$|nB0a#6W&(;QDWrK6 zr1>MHSpw=$_ZHH4NDCRPO(KkKBCK5^f_)+^(DkKbVo4LrfX>mlY}njfhJYyikHKxI zA&0{NY&#P)qxOgX?`s6CJI>cd2*$9vU&4DfMx==QI$S%yqKFwK1W66dsZ_Q=?N0t- z7|L{`JDki(h`pW%=3;8#|8zjz(-``rj!Kjm5ibdmj31%(H!;%E9+4x4;VMwrD0QVv zQbiC31s3M7{E-YA4tIKOfHr>y?yC|@*oE2+GtnJgM4U$C-S(zXlI6OPs@hSU&mFd_ z)6;SXo<1MdMV5+dzbyT}2!*Z>T>U?+UE!%oX929;+L-Bfq?ZhdhIvUjlGdCK|x zia#@BR)T`{+Z6mv;x*5Fu%X^MqbD=h|eTZ7RJuY%qU`2)mE|JZ!XN}>F(o-8T${B241ZLlw@c&>n}zx?tcNA!n^boq5|E(U zp>0@dbYG|a$k`uierz%|K2jK!z^4;idW_Mn`=ME{bZ6RIh*~E?FWQ%0j`}DX&TL=3 zz-4>Dk#^`$HnroW!&}yGBQSRKdmGnWE5p`@EsRJBl^~7d>yKe-Xl3fiz|)G+sW5Ji zb29hTq3C1-U2=Fg+16`!9aFCLsv>4lj?bz-4um*4lKu+hEQRpDl->s5`c&VK!JaIIg{2o858-b^$4itCJ5oGwp!m76={%YIis5T} zN9gx_8asOX@WI*cwyHNEZ{|q!*x~`-_h+a*{Ps?MKQ%%8?AzE7Ky;b?rFcgavApWH zQI%_Rxh`I~4u9T7_({F(&2W=>p>X)JY2H^f_J%Gtnn;nSs!LEJ+dMe@c*Xn5nVdiW!W3@ z9Eg7&3$)|VZzbSYLD@6ohWp`T?xR;d*_9DTvVdH7IC5f*_XnlL!K{`J;{76(p?!63qtgQAxUh(LMBgsFW^1(b4B3h=^2) zy;fs;%>^nV1d3{2Qbh|K+o`K}y~rYy5Y3DOJj{(9)KH|oz$}5u?~5_{Cw9sSXfHBV z5~s!c9V}76A!srmhE6nB1s62C2YsqF)g7 zOCn8E?GJF@ImvmNVbW{$_T4$2s7O>0@z||2xsfHj-!?d=LI>!w(&Wq*QM%?-`cu$ zkDXCS-%(#n-7&og$kvM89hDSF2%pX%ApYbg zo4CUkrO*fC2TJN=uOyvZT|u1xlmeX)ILjdJ(68NU;=7A&|Id9dtQ^a&N{y^`tof{e z)MJg5WhC+WBCXM6Z@*0>cmptkkh@|@xf94gK+-ZsBS2 z*Qx&(r(Ztc65#tm8D|JVJkAD|Fcs6-R4V?4Oy5urn?{$eFWjI1Da!0qhj4C#Lp;xH zC8ARl3mfAcY?#hX@zS2X7tn6PA?Zm||lx zBs%sf*(SV)gpf*p(oLcv*|4|ALL$v}!NAxMAvS*E+Emic-ScX`Jxsh{ROB+#n!CW4TmKxcuTRB+W00v)lUlSm|UZNY4@S1?4Br5n=~kjJeFx<>bnM3-J76c81x0g1r;P#7S* z*7G}3q!&yx^s6CBPS{BjN-zX#rb>us%m(Yb6WE}CO#|PxZ^%YOUrG03AYqF@t_Clj z+EtRekxGGWW*ZNKniUWsH;f6FD+h@HZHxqjAtblzmr&K|-mBbfmJu zCRh;=0wxWi8H@BegYXB;a#Y1^GmemwTG5{nKP7Jmts}}saW@qXVgw%zs!_zfOOZ)}oI~2GzF{Au zsUKsZ5JM>tgQ?e{n0g2fOPba=L4U;1`h;ztu1S`8Ui zSqPGX(A=*PQFs_}FDk6sex4R0cgyJ+)hS#jK{c~mzFmfT|HE5vMkp3opmJ4xVt(1R z^!3Nl*L|d=gH&`0j-piE>|dW>B*4f?ET=CbmQyIG@vrT2Isnk@2ehE{kybQx=NYHf zgb_7O;c9fiz!!&F1{AdQI@ z)Fs{sU-N8>lzHlh5viz=_dDG{N)LJd>}SIDbLm$aD7p7GiiR_o8|nxk9nDB%-Utij zP@9oiyw{MJzCNequE$uw@I%~9F@xxu7McBnf4zzsM{;WL{vW3@`k-O}U5~W47b=50 zRFz8$kJZ*0`_W4LP9wb<>4opE!snq0E$?rDcv?haURzL#D^pxQk%NYbDx2Zc9v=T0 z20Ea5;GNP4-d&7`9U;o?^cr%N)xEOQg`<1PnR+c1m);1B%KT4HYnF(90^;O!roxdp zV{iPH&5ESm(wcmTC325V@@aLNp*98k;{MH@59Hds$;EeSo|OH3=n&Xn-LZ=Oe(~96 zn?}Voc_WE6&WvKd`)Y|1Fp7Hzv!dqT$n^jIc=u1^dbymP&FzQ#$cEePQqyb<)^Yz! zs{4abLX%kc2dsof6y#iLtoPflGl`jn7u8Rx*cXG-)PPAorl@L)@nu|v)Eukvux`S| z&sH3libTf#Z_5}w=mf{tn}xdCS#I=|LZ*6TZ&PQ1R6Y$|V&Y7DgK}`J_0~%0MAQm{ z+}X}>h>i4W==#ItdAx=R!OFJG*nZt8{>{ijC|swcV_V+@#bhlwoc=5b4M>IXYIBSi z!`xK@vge*5_u+;@thyy8F`9FHe3*WwovlR{kZY;AjdxwK^$6mcr5--g&A->He=xET zm4*|sY=G?fTz@q$e~L;*&Pbl(@u$MA+a4dKJ7!O<{h43p!N_1EB9mHXX1GtnX{g!M zOQx^!PjaF8TeL$|nkRj0C)y&m3z+VXIcXqO3WG8gV@u>M)HJozDpRY4T(W6Xe(+4_IPDJ!4)Ad+DNu=36*vQZH>F-FC6Er)g`{i9 z+Xjm6Mw#tW5Hck*8@ADOB_$v5gc;QkpAKJO1SB`!6^u@gXWLC%L#q{Iu#<$8jO2ty z7N{@ylE^wgk=4;lb1xTP2!T~-T_P9XF$0AnoX*HW%6BGvjn%j_*yMAK=-eQOWyxu! z7FykA!f8AJLf;>`zHl{J;fxQ~!XD;kKCKynwu}`Jy)l?pNJO^)AGW7Zk!cj7c2FI7 ziy-)gczpCI8SEceM?KAg#_WSn8Cbn{=<`~KiAo!!7;SS>TX zOEw8@XeFBGehjlL76tS#aq0AN&ORqi{@HmiLWEwnY&POXo4eZ)hUQNVlmU2T|oi{3t zIZ*C-9|hgTWt3yWQiMv_35wt36ar$NOcR3vG51F#vCu{%Loty! z#lSFjJ5-%tWSw7); zSoSE}{dHN*$pY2i_wDtNn%)b_?fLN>?@vtGnS`U0p*Q2?)E_1I_E+6dY{J{`kNM)% zyNU7Q-E2TfFe~x7KpiaClM>W1g2D!pjLEFbVW#wB1UQYeMq{}6#oib`ZYFpzh4JS8 zi&0MIHI{?!fPoqI)Y&UMxXKt|W3pd7yRdG!8kopqZM1hCUnQ5p2*-O9-D6ev{3 zUSxWFM^=kCvW=m3*cb9}QhVb^o_W5r$WYQ&*b5yNW7y9=$K)p+hq7UfRCdEtJ1rbo zRmox9&O^my4!Xb}yI#zhRSn#3nj02q$z*Ug@DtVM#HMo+W-}57Qxfw+dsV)1yeZr< zhPehzlU;w6uR2SSzQx)==lM{c6NwWMZNgW1Cn*}y!N}5}1`{+ok;u|Uz#>bt59gM< zp~%w2rlNqze*V8V$)_ce2MV%Whl2r|aE`L({cfo7*rZpD98U_cXEAdq4nD8_b&mco~zl7*RO zG+`~s4U3hq6xLP<4VN;YiRlCD0L9ZJR1 z|Hxd|T+XFVho&XREHM>kMzVX(X0y;Flpfp*w;hlf1@B z$DoQ|@|jC7|HKJ8Ot7}FeZ2>iQNCdjeh@C@P{PTjVC32Cp5hSVfy3l4!`Eisee-no z%upG*&fPvy^Y`yLH`-YxItQE5k^e3#eAKZAvTV)+P}cPcG$Gq2XssP??q>r}PEgIx z;NK8j?ysRoCu7MOS`7@r>x{MpGc1B91GNGtLQGg z%A%CcBqsPwSl6itq9+5`9=Y8X{@9S2@Z{#9Yp0qEkP4u`ra)IhNr>Hq$ql)Ljw(}l zla(l)ZWd!p1{lbih#b--f+d8%jnk`z#XaOjCm&z29l{Siuohh}??zBb3m*vSJE#|N zSPc2TYx{s*8yu08YFYBmK!REtDc{dxEqF7l1jTkoE z2mV+q`&VhEsbg}v=j+6SC-WPrA0SMly=*mx3H%t>V|p}KX_*?oVAgS7JpQ|7yH3A; zoFB@Gum6Fg)I@_fAda8tD|(>AjY$?P5d`{4p^3x*p&YsdBEfdzq}qb;G17Pq>0(ZP zHlUPw%{|R{_{%#|Fj8ep-i_k^y_kXZa(?<%<^>@ggP_iF5lyCkGedp!$J!=7Qo57! zNGTdh*@SM0N>C4K%CR=dA-O5VmiN?M7@OxSy8#io%KhyqsOM{Q0r&l_Z~)JzwE&^t z{cUpiF7*BF&1A{gATrp2=+XWz2yk50Vit%;9YY#a-=sBKk)=VWZc!MVyY9+iLl8?u z@*mTP$7BU>!gl_(kr-NEi(6(s#cRELsc?fn1~_w zlOD3z*HAQO@hVBtWf8IsFBLJ|9U`FS;E@NqecvXEi?icvC6nH zCEy(tD)SlCxHsCoI#m{*8;lwAcfcY2t19!@;0sKUd_u|>BV`MY$^{FKnz2%)hpnKg zahoeyQlp_@sd1zm`q0z_Z6H+^F(5yrgAFBUb)kPq8wU<8Ogo-g>4E={COr`~qMGM} z01_wisY#W256EAEu;dJ|kT_|gurfjh$oXo@V9A^cU}!`oEco4S!mu*G0wa-A{+j4h z00#&NbVvNiumK@whjs45G^g2X+eDoa_^ zh+{*3wLsr>QPhaaJckoRl?6WdkJBt_++bV<(ZeYy;Fe_?#Z%*kBZy+emcFZw4fdI@ zSl-_T11Hua`~QNB^<_njK`B+#mi9I;asMo-uZBPSk(VG{`eurfIc zOdu(|h9ZAw;7yAv(N%HbEYjEI{A3oHr_cETK}-S0<1%5<)lDTPi!_o(L7>{fUij+5 z)z!fxU0%#Vh`jOaIh@j|FJkV_lIO$}h%PCfF;FZuK_ZZvqObQ|BsHNz;|N=!c7R`z zWNVW z8VUF#6Bv(>+SyoXvW;G0qN`S{G~Q_|Kz`ZUQkLXe2rNWAuLer3&;?Lakp>Jc7-0X9 zUIpTW263Z{Gk#~*DzGiWGf_k84|1R{nFQc0>Bp;d76yS>S|D96L)pu1S0fCIe52U6V4H)VGPFVn@BFWhd3f#o9 zwg0wPSdrYc(hmbjhB95Vcs~D|7%P(J6NMNVfSVAW&+~b-{}Raa`N2d5M4A8(R3JSA z(yzvg$Lh)wnbbJoXUip5>|Ev24WV+*L0GZCSmF2#bOPr`+JUPT&OsW zMCo9qBh0d`eDUWGi$r3T4W!es8~V8PIzews?g1x}KN^Ut9R?M7u^LO6mt_N;C-UjD znQenXH)y5H{LF|7e}$m1rY8{GTn{<6+)2wt{AcDKL;4p=6jn?4K$S?zj`Sf|T}+VC-JS;aM(YfsotMnZo7%r`Fk5bpNlr1L zu#3Of$<f%>w=T5&5bw}(>;7al*_zVP={z zGcz+YGt*?kq|MXzZ!7*4aofN zIMHtL=b30f;ovcIu)HFFa;{aYAAb(gqxSny!Um{b1kSRRB((4OVwI#!uw`^gpWBku0?5SoLO% z$VM2_X+!_kOt?nm60F}qARJZpEQkMMe3yoyb@@SMi|G=AMS|%EE~pL*eOrl-*-WR* zBF`FvMeG!X+%+XX8~N-NhGU5CQo&$1^$GjJ#}oX0%&CFv$_;_D4*8k_MtX@)koGf}<3ut*1|MSc z{L}#!1DW-2G}mR~#%`)WEbhU1Uv9dsXU4>j@X;*5(i`+bxc%{Xg*$;SJr>-X59bZLmDr)% zmw>BAxKZXnbHSCIa#TslE$EMu9ed2D2!^R?g!39%If0X&kwC@N>k*8Nvu#^UB{|w` zgwDZpgi^1y&`RO7HmR$&MI!%^g#(L?y;3x0IteQzU_Wi`9T|FgQ9LOxMRTJG!ltt2e94(@-Zm*O z5xkC_i!jH-WqSpiVgPcgw3CHXbo)H`bA2zLaMW<1JRnvwRfGsmI-ojn-+1BxbD3L>2< zLHruD3_ZiJg3)mpFmBb86!eX|2?4eQ+oME627J5(Oo6!|XJ;o{Gqkc0zwqu=rcz~M zF;a~@LTEn##s!iB7DE}v3HKlpU6sTMHz`9x<26xLFBM}^gR&B?`n)%x6RxtVDT*(Z z?gT7lLZ}2ABry-;RGQPJ|LQqSIFDuG_mvJ5jjOOU`zc7mF7iaewba;eL^)TmXRhE0 zlGtVtv>AQ%i|oJ}O)L;bA(K|h+lyURijLu=bL>~&J=PLeSgN9o+&jY=Cr#uu5Jp?2 zdld`ZTt~Z(kiiQ}S4+N~XsixSWW`ome(a&qCy?N+t)a)igTx2Qd80W*Piq%{>3ooH zp1&1fetWc7%Rn!_bDXdc#Yici45l#foy7S~5Wwz13F`3#?7GeSw-vF(cj5}L=R9uP zn&0k$HTv@lYNXNW#%JqeU6uQnJiWE0;r5@;OdJ{}R?Zh(TW_?f2o4V1F#M?C7bO{L z(@ivbA_qn0p1S5=GS00m(k1R9a-a9to0Okw+iS|MRmAOg)Zc|SB!{+`;Y^ zQ%eYLu5JEQK_y4LDMN47^c%bshM#PE2F6lyiJF$stx3kWsc|qB?#QG{4XlJ69%T?K zK3eSynz^vMn2y2 zVfz6syA`1BC5ZJ{A3rt0Z;oWJyuI1Rh4-=g{6g%`Kghz?Ev|Qw!PwUudvss&Y zrfV%0IQ=NQn>f=L8uyyqkEhQ*TXCb0uSUOl0p_R2sI0T&9DKm9QQh=@n>N)UVV=yb z<5GN%)!TDKwjPagbWSd-qLADA+_}ld?8i@{xBAH zS*l?pE`reRSZMXo?-xzr=wogusQ-=U*Z=8ri%g|&<~7RXezmsRZ75dbez4|yd98t+ zAc#%sS}0(K#?#9wF>(NcEHlCPPK==iMa6Q003zKRXfm>Gb>lqFAW}L&kKEXN6VhL6 zR56PmEjfewn+TZ;Vq`47p?Ew@KR-K9$@fc(J~}+#UsJ+o@@&E--}y3+@hY>MTX1JwP@t$DZj(O-)BLP;??p z^ZtA^e-(V$2>*JGkKgvwdOdFMfJPE(vF)|e0Hsp=+;9kcKYpGWmvaZ*=J?kFT)$CC z=1+(1xh9GzQsxVxVTFmvkyYYe32Fk%N#$0!Z&!e)rH*$n)>AiA%u$_5hnGRWbDZo*pLhueLrDuUkThK|pSp9EiQT z_LXed>ho)TP-e=GXx9+$Ub&EZvG*}>+^r@-+(32`k`-;bxfU~5vR2TEpesyQXbwl zTDahyRC~MeqbJE$W*9`-0?eL`^6yKyYF>@vR4uH{S(-S*Jr*kU2DU(cE7?sGgvL7< zCqJ*`x+``PRHifcCvaPGOI6B*)5~x*EE;L z%a`UBwEuSM0>J*EHNVa7wJopQmapW>>$=+Is=qrO=j?H{{$%8&QqomWFF@|e`RsC8 zaO-{BJ=q*s=y=Aj%{2K`5Ey5++hoR#@jzo2jpe>0>{cb5Hm6NEV;S5!?`e;O`5BnI zQ>ZIo(JMja~%{rMPfsU{7U+kSIh6?I+~5=mJ)s zK=F<`5QDr!odbBQ(iFjS;pYbpx#ILE_L z5ej-zqre5PwOXSbj1xHd8=nv>qBf}6y%cV*V+d z3pt>f@bY`0^B@Ty`>_V1gRp1kt`6)P!SzUAO40KPlVt%$37L2lXfc3T=Y>f&NNZG= zEC5;yHUFN$CSmN*;?2Gc9p0l2lh6R%aOE2dch4o8tSWXC(i5*B~Pe_k<7}5)C(<5S#);LQwGe*;U!jGj2frh15D> zNG(DK7Qm^n29O``W)`|-y@HhLdB2_d2U4q6Lz}FbeMF~OW6AKei`m;x?G`3Yo_QUX z2bd4s-yEW?t=<%^XG=Zxw+O%3?Dr2Ozl40arS49&K{*r(9`ntoQW(s0wq)V-u{_RTFQv z6b_htW^^(yHoVP5bHl;ODI<6C8A;*~6m%~%l^C9_o#gcLO&CjHN$IPqC5+(-0%+49 zxKizK6%~#0E9tp%`U@_hEhXNOb09_d;nYh};4Te2ZAZ^tAyM|gn)gu&OzrUu(t~xQ zT_V^sJ&5fLa#LP%eFRBp&SvbNI&%AbUbrG_~r9Wm)m?(vn1i z)ojQgTJ& z4;+v{OHwF@UUQTwK$Nmgv+HFL7#0U&Aq7NIoPYW`EtDpq_qDM5ft?^PSX?vo9>)!~ zHt&Woo>}MHh;GO1Y=15YrjO_niWHlpw0XTBVoauI&(bD36@Tl&IIH{+C$cX2sW@(w zIP@d1yV)XP3WV5Fc!NNl! z&BDP>Bp2?vsZ)nAuAz(AA;Wk+TEV|mV=q(JTddu?-lW9=*$~k)17*?uTeg*_fFR4e z$kLmxtM%4@2{Z_RSBe4wy34gss9k{|K?(=VgxxuDw9?N;^URijHyLSiLvFzD)NzP|D<;ZS z!m<){`&^1ePOFUOjodPd&gGPne!%V9VgB_@VrAI?skH41D@9R8hzMv`ApqfWP3~|g zreA0>BZGxyUz5a~ek#V@NFZ?wmnZ6)eto`nYk`{nE+wmcl4puxCeerCCP8Nz&)*|l zwv4u`WLj=I&4I+55oat9ADU^`HW9Uc9;Fry4tY#I$udQ#o-zyby4o-)?Lou_%MefY1XS!GYpaF6_Gs6To{PVzA!(aT1eFD|ibsUS{h=I=i* zN*9%~J&D{W86FdPq-=U4xTj=>rNJf4M8>&o*D8 z)+u8Q5Sj0%N^l`rK5$J1**SutYO*N1nWTJ;f%iNw7z^7dOyps$BKnm0d$D%ydlW{nc%iv*ZDs4})cYADDl%Rk>99(Rp^6ix9fV z{dAp1sow(m7_RKG!4d-CGs-+hQhkvxT6p>VmaR&HV2Ako_a1J9Z&;)gjCBr*XjVNm zWszX8Bq~?LAVYD;?#yFIzTTE87Aw!G-xpTy>6_?!BcE(*Ut=m>uZ8I5TLpU**XkrJ ze$8)@Iuy5L`IV!!%|iI)3EatP#Ao!Aja}@dY;r|o>;3@*^U)Sp?gfZU_;#>=AQuj# zDI-E4znbZoE;sbQY(oU4TLCk7GBm+)Ot(XW705YEc3f|ZfZ*JeF(n7nINw4VTL`j% z8CnxNEMNsOHRKc~v0UX*P9}Hkw<1>(+#ryE^y!fyk|Dmt>(wC_dPB-zxW56l!?KJ z5vM)cj;hct%|b-=TW-TH)X9HTnrrE6oox6z@gvE7M(9Pdu`6ykkK%zzQ+NYr^OgUw zQdiG7Ov$H%JGYzlnx^|>9Xa@1SV#ftY+;BU#U3#uoi8*K5XfMmuCq;f`cULBRlrGB zfrG|>SkLiCyRc_-Qw!i_&AP7GM`Mc5DWND;90gZ1$Ijvh7HcHA_SrVsbk$utM&uQl zf7_Yp6UrLeJ9F!f%j2di2xZW^qpH9@N+_k-hsLC*WI9~2jN-2WiE@B%iV|Ru82Vs$ zCg>8#nL%%_>wzR1FsMl6M+~HaOvz-(f-n)-iQ)d>V}r!i3N~OnodcS9?~L{G5oLj= zZjpGj8?IXMgK+aC3iD~C^NJ!Do;#n0_-sx0h5a+nVx8WAa?LD3aJf_x_T-6cSJX$! z8ROPIC?=h9QWCW7%%>#wJ#2-^6tN&wf(di}5DmXxOUGUOVZ?w&h+l(tWgZ!i26*d+ zimD^jZVKM@dwu_SYZ<@UKvx8=M}*rE8a#HINa2^{+E1_@BeSql7M@*wJK4ZArvr46 zoZG?YZ2C9M`e64mm~-q&XUGSX!vEqr_7%KcIUQAeJb!r6z=1Mov2A+XV6b!ilaMTb zh!KQ$M(H$P(Hp!F;OZE>C;P#^g`_t3e0WF?#Iqdm=>gVQ(}A>j<-Gsw0RsZ%tvn!4 z1#YPal4u1h<|L$pEG2Q1D$8#B2Zzd{8=Fx>iP3yoJZJ+|aT5fo35;hL`AYn3nNj&b znNc$iS|E6aQscGLv7sfzhEwB>v-BsdaM=K>C}IJVqDKrPZFC`&qK}0{ljRyMtoB3% zKF+|7EERi00sc6pFf*x&?_(A~P^I)yV3=xR0U2~4zmK*&tlW_htej86yu!2RunlRNafg6St3{iF+Cf804<(H6h9D2vts;UPy4Guiu{$Q zRSpQP5|9CNJxf!3aa)GN!Goid<)U`D6|%Q* zdVX|EpBuO5!DqRCjH&w94>fml&SM+^p+Z4u1Q$*MFo0AjnPmzmpP5fKtMt z(|@D{mH$Wy|IqjUmJ)!_UYZ9eC6xR}N}vHs36zIGDM4oZA1Q$bC?%w({9j55K(5UT zylhXoW2Y+g zwm>{c$?AI!eorsAeizh5=>^OL>YOo$+99w!D5tTqMO`-BS(c!lfW;OPe2-#^`qw18 z5GXvZE;}9D%AeSMhwa!Lv=1K91#~FIcpP0|sJ@WssyO@s3OPI!ZJM7x4avke@NVUF zXIOx(5RNy;uHP|ewFVI#6DIwoKQUmH9uE5{T$!f7(eK+IFud*XzZiI^VZg;`IE$k2 zA6(rZX-4i6>#n{2)EJ$NW4Hux;Wk8L<0?CN6HKK&;bm?i}aBpvlD~u9Yin;Mgc@@|{ zzC+!wvR7S*{n#g}0tr1lyi`f*{S80yKxJ_`#IT+BW8XVQG-=%eDZj{%RdU&U?vm56 zeX!0Pmwt^DM!UJ?49n}HkC9+zzH`u6OR9>Nqqp~%mZS#6QD2B-5A{PnZNS*J)gUYSN0?ADIn5W>K{R)SeOFH7N%@lH0Vvu&V>ALMoLs`xduO=D0rInj zZ5NB1aF)3j6;6E8k_X=l5SzGcj1Q^6shQbqPR5wiq7TlqRj2gQ&M!5C0yj6kp76> z_zmxjN#k*3!ZwP2osoM^p5v&@y@Hbyz{@zJzk$b|EtPei$B#_tN3|imc3;lg$~37z zJl{krBHsc2yr3C54P?x6uhZ9tND%kCw7em7zre%3gR`{+3)(F)stPihB{YM(>o*-5 zF=`MJ*-+_R5z7(xyFemlQg9a<AGlQE6>R}V7NlF@rR!a=( z{jovb#{QkHp_!58rQi(@THwb3zN$mLfAbF^mP%XJ1EglQl)qNkWl&mcTM<{kxH$w7 zw7zOn!T+#ciPsN+09G74a7ZB75+dO5?2RC}`n-t)bU)Ggh`{%FZVTOzFQfdssN88{(wWsaPn-;h2#%ntHWor;XT$>FITRyvDntUJXEb?0LqW zAen%DVK?+5k(SI23&L9wX-;{u6K59ZZh*wtQs{&P#MnAAb<_oR2EB8m8@5?Gj*53* z<_4CidUx?n2Cs&YkDC`|&7d{P4Pbw;F{aSfHH;=p zW}yao>E@}vpv3BGk7wl~Egdoeos{yN>0GzXT4m+JMYJ<;VHG>xX!uR7xqtqJ@mn23oo(%Fc?EW2XVgy9ES=d;AhPGF06xA*_Dr3!;#+YScb|KSebfq#3s?;j6Bw(@NWV4tF6iQ;GV`d4| z3UYyCW>Us@dZ&^Ku0K?i3{p#IYnr}9j%Z7&#%XWW>I&eM7{L?uLBzaNN~l+7A$#|A zpgc$DpL*2gpgEIGO*z?rbA42D49tN%47Wwc0~98Eb)bfW-bu z8*2}rNZ7%WZ8A7{ikwJTqRfaecAF07pD^Or1nX!Jo|DZra~bK}MMG*Y{!@4pz@)vi z#>e-k>RuOxcpDtS%Nu>Y8reTV((|9WYi-)A>#zBT_KO453s&;2OcY|KM;Y=Fm6h^X zk&}ELSWNDnK<0N+A$B%_T{o$()u<7^BlG83hc*A^Oh7dJ(C5Ruu2!7`znzy>cm8MM z*44VUIYhG{Q+lv?nN09Nwd1JOtkk`{0viv};+ElkbVw zhV+*!3m3uGa_KZq-u6{xg;CYaXI1@;l@zLQ>RRL_laoPJFmb( zltyLqSEqyOl=~o;J@15kh-Y3>u3Y=9A+woU+*)xtx4%u3B@4tt%lY+eKM)=mW>^jC z|46R~)6*nNmqejY+z>HPle>>r%Y)swPe+-2Upk;0!_fbja8+Y>JhER#eThgyEEx+^ zksdLijLt}oOP9sD4E5FS0a=wif|tS*jP~{D5okInql~mqjh$pLV6PA zXNFB<6-~t?6*EvkyipN59lX>og-n^gmQc{K7--2&g=K5G82;@z5e{U+D_b#$=|UU5 zA#z8Hm`XY%h4DO~*o?{w^&%T)McWrG4H`@dVz{datzU~53%+pwG=1A zM&(IA+uV7o%&{_MgA=E}k2z-g?Q>J3oo&RF6Fn{4Y$ zfIaCtg`s1%2}82%il4j#H;8?bE3OYofG%FO0!e#|glF<*V_-yK5x=z8i9&Z zEP$jCLTU5p#)JP=V>^l$nK7`ZbTmBLcIa`V&WgaM#$b}BgX4sy9PX1QOa2h|mSaU= z9x3qv|NBxocP;Kvi*~Xo;Fo;yOrvS9!*sV)8rU<25)bHP7pWy!{fe<0;k`A^3c2l< zF&9J&F437dQBe9pVZtw4FGMjPmcv0*gGrp4`=2Kf`b6?)acTrc4j!)*c;P_nuE_Cm@yHo zt<>Oud}@;7m2VI^KPRX1mcJ?p2#7`SVV##M0$9^Y5n!nltPHdOZwS~;9=zA7hk19M z$lJgOi2T=8`fC18;HTw2`Upf+#bt_)Ew|<~n6@V{`~8wDN)-#NI-bCYw>^O@?)P%H zxh_bS`1xPKZ%7HO6=p2Xp8Ixrnr>)vWb+8OFt5KJgX{Fa*&|#6EF=U_%-?aZRYFM`CZ^^`Rnab(X$Lkh}OP3RjaZCW6m+< zt3mQv$|^glX&MC0p-~)Lpa<C3)nv$9ix}kLhY887B12A40y0E(RBlP*Fez;OI{MS z24*x-el{iNfvKkYHbVLsOvVyd4eJU+fL8D;ry@TkhJAcX6EF2%(~dQ|xGAR8D}jrg zL5-5xh}LS$?mMd)?ddLi=Rx{jq%ipYQwx zdQ9kJjfg5cVE}F;UR`ENqztep+2A`MHKrzYwL=Pw-)R?}j!%-?04*6hc9ROE)rcjfOL0Tl1YFY{z8%N$T)YNoa{XC291@{jhJNXqfq(tE{ghsfw`9A!psd@ z_DNMc>X%Hw0ye;$7Z-1n85EJK!Ek(yp%g*!wyaDnXihdOxujBQ#584ADn)EvfyBw& z`ZaOOA6HlaHI-_mUo1L>b>SScvc%jcaZ3=ll`N7qQ7SY+o#5cGT9VPr_a13#700cp z()K6mRq*+dG5)w+o$ZooNvX69ZDNw-brQ@gZvQk9H-#sA!VnVW1(KYthnH2l9+{QF z5`X$4f8wk{dgl!NT-ms`2zs*dfS!DVrDv@&XN3W4j=}gYNo_$HT6ca3gACL;H4LlV zrJU4UA_?)Ilt;SKngJNqhG8lMLOD9i>#JJ{nm|!DX-z{BQM&=9K2zZUtMD&ra?+^; z!Iy*=hz%~%k6sc?DX8HEd2udGjFU2LsIJPBG8Gjiy92QKWae#C;S=dqzoNdo1JdJ4 z2$|n4Q!>)Qpj5C7iZm5`vEMc^?2>as5~xQs(5z@Ms}zmORaZmAc6Ys{ohqS&ske?P zjN+{z_{-34Gq`tHtb8l|8<9cRBDquO z-GTjMH0M$=0vcSdB;;Rd$Q<%0)(pg^xe-lCkm}S3l?qLBO-74Npo`KG%30eJA+i%c zt+h$#rGtx;!^NrLBGUL|n@AC(CyprD}T3&o8Aaevb=Qy?m{DKV6Q*(h2)~K9*NF zxG_|Us>HYDiaC4z#_Rlf*0H%{1(;rCdBesGEQ(-{Fb)V>bV>R+?^S(Tf;TKwDp>q! zFTs&%!U414wb|vmy}Yr_w7oz`u0({D-t67$@nd6&hrys{nZwgB_K$x+;wcM)9P-G8 z0n4j}q@%xv$^4g&qiDPh-^Sm0ut-zP2ot_Xgd(yVaYv@*-S`%R_{DbQ~S8qdgXG@Y1#aD`M(*z!|fGe2jhE zCGgeY*X3?2()7nI@nE{L=;Ie6l}m(GmJHOSe-HS5Sw3@!qWX~4-`#1lO^2e4nytC} z+{%I*wxRp`oS50UtYxiBLZ$7kgBCOm*QACj?Zp>-^_wm^&A!5JcTe@2s*{U4Y7IuF z+V^s{Tj!jC_Ljek{^H=CW4vl7iof5Ug51&-{a`-mR`r&|LEdH|zs+i_GF0=nh9Ki< zYXDAq94Wi|;GS|RD#8t-OzaM~r4(BRia!>1@oOIzS=j$|GbMk2T$1b87!o ztM$ROztBFDMX7ecB#6zG0Q+{C!BYG^n1=3(W^wQSBO2 zY;cE8xV!-dwAdiKVH}QO1G>IEA)qO`hl;zs@HL&XzRT<@&-mniTZ)jGSU zR!_C@z2RM0FcZ(3KZbmR<@E`)t+$Z&MT(55&^W$j4zaVl7>X<6`8*<^UqDFvn_a$G z2Q}*SM<=|Fp>=$HdFHZs7Id5?0j6B=Eos{*Z)&?%L2<|Kw5&G8#PaXgzf!d6*MDfy zEm}1n55aICuC1j7r=!9!pW+J$&lVl7YQFwH&)(rcuBej96bDyBFi|$z@Bt?>_v5Z8 zhG4jT^7k_~W6YwkWzeL(k^Bw6`^;P4&s#5>RqfAf4R?FDuGrw5_8Ed_;uhp35awusgmOcw-WHJKtuGyi(rpr8Xe&zgeBb{&IU? zJ(iqN?0FuXyAyn0pS!`9oQeO8CEy={c+=K{)&5+c3x2a!y!=X(Sk4@HR25mylupu- z2Nto)GJn6md`9OJJa(mgmT6`)XcSlPn|m=GhLEoWagvG-g8%#N^Mp5h_Mz**ojzB) z(I)Fg6+x7bpRaprs3}hoy@%HYqM7#BPm=xJuIanM=eY<3qrT+B?(=%mY?iP#2({W7+;`kFDg{JN@q zzZ{O9%j^=6fVMB!!NWLL?`5q}^_42qfoVnTEqoK6rNN|cP@<_$V%3Q*GmO~jx&3To zWYae{URdPvI7)1C1yJB|+FN~a?+@o&X-O$Z>N4SWelL6Rl2*L`MDMZOA=a9Yn#83e z=nLUJb-HTiqjoM!!YHGlgQ1MpUM%%VW7B4VRi($}`PH3~BvH_8;Cjs#9!-`_kDou6mW>X*RAapo=~5!<<==&X(^vqQq&TnqENSWDrU z2SJ8@Q@)l?JqeNt)04*TK|?~Ws?1b90baN%Dn+g-r$$OkW+(}cEbSU&+of+hGb9I% z7MfzkI#;#7fSA96rZa834u^p@L|lGZOZ-U9Z%YWHbC!hb^oM;72tpWYVl55;qO%-R z0hTLOs>*AEmdpd*7#xNPww5-}^m;QZ&1D#Zj!r~Y0*+D0uAu$eX8a1iGw zJ*!xYLr8_^yR@4FDi5IfN0>>ztY>Zt`;_&HAcwhoAD>;fs#7D$s&y_~hd@AEf++wv zes5^r$ZsBEqcI^jBWE4+>)|6_W7#P?IcJV_J0XR-^}I$n_6R>i)0rYb(Owhh%Z%|d`$XDYEw>s{RF*5(#|4g@S*j&!cst` zJ#SL;_q6OmZbA;r8iNg2kGiy-#R3lRBoZ3hEEzX=^Ko`Fv&tf44`$H)Wy z$ih&xp0Wg8xx5Bzz!_hv(<~t!WKQNf+1qem9mWM&Qj*$F8kEbMprZ9FKKXBv!rTC1YvY>{>^XO3ET%v>|Z#RY1b)?pcv&8RfVu7X7Y zx&yQDLL;ZNAMT=pPu;AQl1h)1Ha3^R2SpThN)J5K!;I}d6w4=56V*1sunm+K`~iR3 ziPhc651Pz|gHk(Eqm$}EsOaW7X5c7(Nar;c{f7O)Z(vq5kL!I9ClBCZ-g6+Wp}a~^ z0Ei1upGF-Xs~JB*Z$Wjg{SjmQ`7Y7nH1r595KlX-;(odDCyO$+IJt?Ij?(E2zE)UG zyFg^Eipt`zJHPX4*xkq*TIPWRg-ucY4|r6-D%Ncu+Fa09*K!cgTO?JqoKg9wQDP(C zpQkWr3Q8J-xf&9i2C=?Ssx+Zb{hsoqwfv;jh~4}oFZ|5OI1f(i`dr&)uuAqgp}Dmm z3;~p2mwhBOI<>=4uiaJ42|*D#ck?#$mmC!j8S`WdgAY10=HW{jeBX2A%luz@zwX?> z_7{GC1Y7hHe~m_~`bYT1_tY6>br*Z4%?Dt|He%){o0TPGBDl z!w=luM;)$r%Icn9h}uc^k;taiGZ<`iCEvV4=8>BPnZGP0lGm~a3COBAKr*l`8Ch5o zO~^jEQruALG$didHrOsw9;@|{mTK*O&-#nN)U=N0>!>TixoZZfYE9uj)a!5eFx(dD z+Xc`LEPvxlwvARP$=PjG(bgAFXsX1i%8JG3-%h^I&u8jv5zF0HBDMt zg`e(OSe`AcQ&hOb48zOf!y(w0p2-8DFcdFJ6+GOob~EZ>42gx-I)PEzxknQLH>?=* zbCpg=1NXmt+{)}>yd~cVpcDZo&x-!sSp~g#LR!{>pmUzD7 zPVVx3;$r@LzLM)YqJAYEVnmoctHwQb*8?tx%_WSx`i~P94&_`AinT~PhP5wUP{ZY2 ziJroid0afo#Z)9u6ZBeW-9f_kX|32}yX_Qp^6SxCaj%T?kYi0q7N@SCQm}o4cH(bed4INZk1emW_ODzb~5(lPiJdK^q*m5_8%qH{W zKrUuSiGg#S6inR3)xmW_H%k}C34$m^N?jHc%!7!oLyrbWrjDs1!UjIGp;(*D6u{|Xw+jKn^avJ+K9twvaINg^ug)q~C-DGE)2kaFs{ z-!VF~*bH$*4bzjF<+L*GDJq-5Xx7r_X@mhdDKQ27AaFZ9g)N{uHVc z29QBY_3&Zo@tq}D*5LTx_k61v;jC&`K5VYhD0nEKsi2y&7tf+>NyeX7O8h&|Q=iJP zcwWWXHXpmepCg?JW#jJQX?_je9Yg}6N6&DnuE(RxL z=~}n!G)(a@6D2bX)*>BUxM>;|cZ~1k!%F4c%0Sc}|72gjzJM_JxzNE8UPI=z{{q&4 z!;wQdSgmpTBBH_67Urur)AO|vvj0qG{A|4U^lJQsry0zolNTbR;-fSFCn}1bRBId# zbhT$62|MZxM1@V&{P2lZ+%b3GP3yKrK@&I1YY*P|PrNyPzdj^2<}j)QxNJzH4yUeK z8?gKk8J!*7geRErQ1z!DU}qX_jWamyF$DWZTGRXl)|mw0r@X8-%!tapdm|Q+H>r}% z>RBn{5Xbl!ESDTJix>^gE(>$QX`xXjDn$bmL33cAwy7?A;?Ec)ba*GdC0jX?EvFjs z{7dmOc&w<1>zK&P^Z4@^%`%4yHIu{^p?xLc(Kfk&AlW>xs@gDE148X}XG^MN*q1yk zd}9Fn?b?O2DlDLKq2!>BnK&TF;tGeQhF2fnIZX*gW!#fWM%#`6pqP#KH;TbJpH#g4 zBZ`HU!DGD5J_Ed);e>C3tugUQcpOci{+9lf`TB2K?NT=eMr%qE%vRGA1v>B3?{2rp zg(6-70Z+dlGjl<24>ANqKAm6fSw~4DLD28ZbdD&)mJlK?{?5Cd@hEpFgh}hzaqH+& z>*!(lFsc`@Juu;0Vc^?gP>XJHtO5ybCY+zKS$&8f(${B7J7Xefavu#$P9c1r)L(+< zxiz`o{rejBFUj^-|DUbiO0nnn|8BE+KHlpS*9Yrw|F(5I;GU`Fd>?Pofz|(h8~bMd zmq&sBqqUXYAFTgcuj2dfZCw|D_9sAl`yBAyF6bPifxFLIsJFNN)3#IWuOt=V>Ye!8 z7X}9R0j9SA)z@=L>HH6TsT@SbHYaoU(g`Grajd6jo$sn`@<~4tWKYQt0X?qwDSig` zY3rsf_+2!@Z+Fe@3vQ)qhbVFN=U|&x2Y!`9Q3ct*e65s5EXGXOKv7Aq{P&WSH;v9kduODyg_kWy`i7;}b2<(&$5PLgTO~ z(Aa@@aGeleZ{IDG@H@HL8n64H;XjTkx+7}@ZCmza&+C|xl&gYB;J~tUxq`vWhl@jE2ZOX zAO!!VMrmDCSf^8Ea5r(5@H;4a4NB>dAF@=dlx0wM)cWP_pFsVI)rjSy@p-pz^R^{LCX0V|19^{K8-Mqo6hY4sH7rD`S4i(X{w3KcC(yf< zu?(ltMgc5=_fPT219FaT&FK!83WmpTi)v*j+x5CBFw+ZmRrwLz<3@fd)qR`AY&~Dl z)eBMO7uqJXIi`ZaMkk2&z+ah7Jm9v}XU(!Jp~#f36REt`bL$ATkU5;1P)S;-$@pd< z@A)pKuGzj24N21xOwnSh%`!2si6QVN=zv@1I=vAH`m}KB`Zu*KIw;j7@@4fWD5?@9 zXr{HE`HoD``4DFs*V}b~gaMPM{2ZUX6U}*CDn9=an|m@_Vc6aSyIlt|cxZu@jOE0H zCh_KU@L$ji-pU@I`pNg^Aig1uLJmP{^CnB(MUuYCKn7XPx1)y4Mvs`v8pX zoH1rrRGhDpDYm@*1B7b_%d^epQqrL=O3(}1{%q2(-$|n z0K|%l@rMT0QxrOiiy8La0){I@=+Z>O23zW9ErHNg$w=^4)({+4IqC>^Rdo=%;yrUv z<{S1&^j6a7FfFUl;LeFBfFv6;rU^75v(h+fdZ8kDp+e{kl0 zII-jLFRe%v&k0k*(%UShy-WEwo`Z6Rk_Os@>003vpR;n0TKJ#!bsoVj@NJimnux^b z4s#k_Ser<_0_*HPooZpj$vi=0YM)W_31 zg_ec?kqoTfNxOwx&kFBS@8nW&FezE;ED_kky3iY`%)*Kr2C-mjRTe9AWM_ne;wycH zQwX;zJ)q%C2{|6SD8)yW-i=XF+D+fN13UBmAX(7DxbhxjTi?Jyq^9t|EII_Bh^;j} z`&Yn%r`P>^4a_!@3nhe|=jx5N>&ESLpwxlHN}MsGrq^E!$hdOmT-Dpr;>OHr8l)$& zug6u3nRP+^)fd;X-sSo_D1{Zd8LqorD%-N-z?G~Ng3FqK_H4Qh9MgWtq7?fWm+31_ z?*MIf$P_*s_}2ogJ`hRgEFap!Si%g=rXUKwnbR)glL~t>ii^leICcip;aaZlwH!js zigi5oaR@pMncYfu8pi85{?WiO%#2vH9&Odcz~+}0lOy)}j#sH`9S8n1C7mo-ordWE z3SP{1S~7+yELzhg)72Yd#bs}Q9ca=2McF$=XBM{WnsLQR#j4n@*tTukwq3Dp+xTMJ zwr$&;HU7POHFu9bo@1WPG2iEXt{W<=mkOy>R^@^nr%;)Bz)eA&{7q^AprmkvM|7^~ zSMUB^%tQ&Ewt*m#gA`0ZkW!QPE1Ixg=LM!(1q(5Ewa%*xtVbw3pakPJ?wRJonbk!r zV*V+S<(h+>5TP;kOsP0ZSC>P73(k^c?pfU3aHZy6KGW%vgUUM*c_6X$gdi2GjSdME z;&PL&eC$5eG`rGn^w+-(l70Q>6Fu`Xay$MycERwMIh=?OeZDO06@AD08+H65a2>R- z+R6E+sGn}gT_9dy^RX)K*!ki853^jk3?>`_3BtvdKpHjW3vsq?G^t45(yqWwwiTAc z1>5+*79r@GFBzyoDP<{%H{j~G&>LBCF*D&R?DTwPb;M9%k2>=>H*E)DMv`6;^rkTG zaGR#?=`#$>?G{fnY;_t&I*Y9%OIOwI=9J1>P#Ee5g}bgT)W$7@h>uNu5+Oi{FI*)wVa{;7_IxAz}M-I z3h6p@@fASpJZ146Msb@4LG$m5u}pUXzQXDu)^oDpt^}ILOh>6g9(u!^m9r=~aU5h@ z)$ZP0pfF*%Nv+nIKI0Ft;S0EJ%(&wTEty5YqYA(8w(l-wLhtTTQK`3M<4LF$MHQTx zNVci8qjBu|6h_46vPQ&g;|=N+1naqQ1k#{XOi)_-5^|zsqGh5%kz`u2a|auuXlb{A3xK z24iqWNG)56^e!64CHbQ!!-{t4%&{Z$Eg+&kO+s-b`u<_#N4YFI!L>6qMa#sSGC$Rn z(qi)3P03w*p`K2nMTU<%OkK$Qb2eiXZ1<97cRW=T98J11j_s+}v`W)X(~?;AMAcT8 zVv#~M5BwD`eIE3;)m5PoKY|)PYgaDWHKcz#wd8RGgGxXp?Zr~<+>b!ucFiONnvN=O z@zeE{AzO7`ItsN_J+xl z6`koOZh<<%coYObWfmdg7?-3HB?C>$T9Ubap69MNLjXVT0_h$g+DGlV5$oAxn0ZF`8oqcxK5eHcwg3UchNPr$`{SjDF9QQ%-HUcqa6Q)$N zZ8GuJmc{z;i0csmlBmr(kIT&F{zzy(@s7Z9B`vu8)+h3I4InC>c?1BKTr(wTrira6 z-*oITtJY+jsDP^-XRFYxq{kspO<+q)v-*orQw3>RmPWJ;LIhdfjW6fSdA0$q4O`zt zAz@MpW-R4K&`M{S*&jN=>fw&Hzzf;SbNf`W@ct}eHB~v=S}0vZxdVTx%3gB zQ!>K-7_h~1r*l^hvREE*gR87|=3^u*YmIz&fR%9cRMoIm=r{t)^1K-AE4k=c3~Cz7ya{(< za6oWIm$77I&`eOe^WG{{&DYX6A`^_}ovt_R3<@O$oJ?$PZEn<+S??PgF1J~|c+cCy zDZ>4(=KUbq3wPBVU1FD3lbCB8aF9ejlAAyRp+NcTzlTVSEp%UZ8I)3&U%b8-Y`RGr zPYLU$Y3qGJHoNC~AGpE}8h9gt^fL0t{+=DSGY;ZlzxQQy)XD%;q@9vecP zxoVj@f5D;gGV}JfaS8ePjW!3UXtPD@s)MDof)8%LD8*6GIzr^OrQF^zW(ntgq{&Ns zyMm+=6|tqc{gb-o;*OODXM+i)S#bV{(BBkG)}ZH+2fVCH-V-C~GB;LTbzeqYUR9dt zaEw%!1-EC=356Ix24cnN0%SrDs}b!k5AVMu(>=2sV52^>P>Nl$$&nmgBtxd)oF`b8 zWMax9@~mJ(=rcro@xquKFF-NdEaZMPKf0jQ;t&b672Vf30!|o zHk?iZcR-ET(W;Amf(=?#c+`z-5hYVJ&xyck3h}l|uug9@Ca`YOqVMSXZvzi)L%REI z+RF3VH|%(|eQG{mErLWZM7_Tu4lex*L+~l=>B~On82Ja^THZc})C9}?UPu6{85>y3T#o*q7V#1i1QuE;>(X~vQONv5!ajVX*vup|ZT5d7XQAi%&%H7xw zQ!E4iTxJu(>O+*Zu{td)upZUg(Eajpf1L9VfUSET(FtF&vb5~+;L_OXuEA-Dq3AB~ zFyz!XB(;p_U(jLa%7f9Hgylh>NP%bnJ!X60J5dRNFrkMp(C6d$O)Og?lkm}?&a80E z%MetJY^F#|Z#<@Sqdspa*`+TK#zC-#SWrgEUBf5^RsB(Gl`?75hM?8(zG_DO&i0Qt zw;Qj!O(`VDlI&S2ly?tiGyr5MyFo#0DHz(stKNDn<6Ko$EnMNL#^5WG%rFs|p35vY15OLC3!`U%O>iRFtqI3_DD~ZZ0}>o|(ITjC3oo zZ+Oc}SD$9J65kf~sEP8+BpCV0f}7?oQas)0>*Z~6yn>1ZB*13z;Xzs)Ca)c_6MJLvS9C z6_V-s<*Z9TVp&V8-XRGpvdXc;K9HF^thu^mhf>_%?hfA!uA$liC8%|;Oy)S$24{JP zMkbg`;C&4J9H?;AjzN6ACvcCaA~w-BZbl@@#C=35?Fe7$xRP@WxpXDc6wl`1rP3YH zbjGH-{)~{OhGi_W<$KgTnve*}YAJ#hHiaOpBkalUtfWi&9_yw|ZSKEoY2w`^D2Zs% z@7c-WW+i&_Tju*$%k4yO6RI=cu(ON%EU02p>tr}_4S}Q{DbDqH-4nKw{P&7!P8R?1 zdq>C2PE#HVR9?O#NaL%j#vG zTh+Z+`26I%Q+bWQL@e_|ii&NicfBiH1G|AFpS0zP4e1s^CJtvwSB?rpHWAR%baca$N~N?bKX z@r6u_-q@wL>IlObtX5N#$_etKV?N{@7^y}qX%lCFBk7&})K?+ZirJQT_ai;cjiF1NRz0lGwx>f2E-i?+Y}9{{H*RY_BWDp**Af;B7H!G0$xB z{;{G0e*&7j3KFFxAHF6WN{BB|#bAoXetJ}6@cltz=H%>e9it!_G`q-VktL?=tG9eu z{H(GX)8K{V+TU@b(3;Sh&&K;T+4m+${9CHRinTF$5^b>%?DMo3SD z2YJJJ_R8;O>goP+F>Pn{O>d;!s0!P2-bN%cY9lJLGO42eL{Ao`9%9;Q&kc3r$bg=IOsC@uiai`A)+O!2$Xk z>LDE3#%o;tHnZUET4P&;9Q6_&k%Sk6PAtwy+*AABmWmw1$sF zA!cITHW0bLKnEb$HV&<3Ip@TF3r8!hIru6(eR2E(Ueyx-VYem?QNQg%)Sg(T60WQl zAUk^gcw1@m;Y`NwTDo3Z7aRi)-S`&<$Lo4`kIPnn5jDE?^F?+x|M8rY$;*im=V6|b z{|U6(QuHGx25Ndv_7YEST$?T-yyjyTs{Q&I%?2j5rc$1rcGH~8qxmd=M&R6~B& zU2?m5w_Gq|mcF}P}c8Hia`%M0b?B>|tS78chI^*>aGiJ!gA`LbhT=g7wSql@<^tMB`3 zeEJOo?45D4M~!;6FInuY#mk)J^-~h!@wDUmr0;?k?HbzW8ok&qY)a{+zx(K-BdKCk z1y0#-S?+|y8H(dNMn{-=dZr<;}t|1)>8D@ zgw$|WCbOsFS)O3_??H*Ij(xX;BTUvADd&usXHopa`J6ap^-gbX@|R;%`)!kbrZtW& zc5nN)`M)b$Zf6h@e*#7!k83ldv+fT*Ly!sm3tNXzOExJ@kTa4cfwC2^H6bkUSCu>|U+0}4-|13T}Tn529 zIkVGEb!u6ClbCE+>K*a!lLqFRRwhIW|F+GqLJpPWoR4NsiPS$wvnj}pO`Z>)S}|=y zszk*MlW4{q27mQEabRzbc=K{8l?eccQQl3z>VZ{p>2X>Bqu3St_bycg%%dj-L_aSYzZQoHdm@5 z;t4B47BF|~OPtfsSCr9a-D{MtX?mzG4xMK13->qkN<@46-2J0#Lv9tVgr4I~_UVTX z@qvqjY5dH~2v(eOq=XWa0MFV=cMVW0JLw)A_6(ONJ(*LeNpb`q-T9JTNj3U!V482p zoAxjK`{V1<$unJl#TTpjC{~#RP1E3S$a*4djZRS}taj&0CQNGD>T^y;B_c4LLV{KP zIvg44YLJ2Bel3Kq3lU&B{5_9Q(&|AS)3s&B6pPQ|nXlo_Gbz7i%D$c2U4!h4A-e50 zcv5%a=$ub8l46y999&Y`q)Sig7$vn7b7S5B5_a2a*gpH-foB(~Y z#WO1nU>(Lk-m%T#mAy)h&e{CHKNeXF30 z`!_6yuV^e^H^~G50;FPGm2nb_x0a7aH}<^VQBzPr&%n-2E zcO6tT-r_~f4XtGw7c@7`e0Ot>bO?<}xz#&qLRu%hE*An6j}4^=xlg1TA!J3n$b{orFFnTPf{ zTq|c0SC*qOr}lD=Qw-kJ`gd6Tg|$!+#afyfah`soDgVjSox?QpC>Db61KvV%JF-hR$@>m*HLs6y-MREcuj$Ohzi4#K$H@{Zm@!&PWT_q zV>xl1H^yLL$mhwKICHZa2?^kY89TprLGdHjLX!F8Ph!fa*qN%0j~r_8nLC-V37r~3 z|L=mS0ko2Z0kpie0knQzgL6ekgLUcE)o#2aJ_Kd=rvMhp*}U*+oe`D4SXEzH&zSy z{yy)~+B015L2f2rc#q2LO))o$RSliOUBc3D4^%Fx?6B*4!YEoEyTz9=GqQS###I%! zJmm7z&4u8pj3RY>_MqQOKzr@@1DAJ7X`3XnGmsJKY^3x zf>-fesPR1(-y7*t*B<;10q4`ONE$+e5pZ9kYQgVnZ5wrQ9uNohqW_g+m^woQ3FZ$w zKiZFv?@wI}AzW!{L#y6OOsQ*jLpVdy$|Q+mFlxXYD}U-J4Wwc^wnpG(=E|a-x&<^_ z#!GZOEG3RT**aX9|45p&sARqTcsAM7l9Bs*<5e3oF*C~iMsp+inGGgQWPNPeDIhIN zn|5?~>3yj$Zs_A^uFp}tza0lP^C=skTab>z$aEqakb?Ny5Q|>qqc$BiV&OUK&*eJ| zGMpfi&Q&VuHg)fDsF6o@P=iWGTgDZsSc-!=@&I%}Z@vtEhg(6amFOfb_dY$nC9^Ic z4C%>v$AZ;XVE^Ut?HeewGYCUgZ|rpA(l+RBShJN|{1qK#z(s+%D4*jbn?#$s9xVLr zz`8sYH6lKrrkys;DC`(BD2{!L4l%Jtp`%qCY2!RULOl2Uf^34mISXVUZ8|%%aZKpA zI9P7=RIOZP%nczm>>U;^bxmFw5?}SMC5hAqn5Y4aLcPy6;sPDCea>gD)u?qXA3m13GMBtYF-_JGRj1W0P5b}2XKa$RR z&SbnFwilE<%76^(aui$L00rC0=lK0!l1`kp-s~*b+!$@MtH2|K(l;&h=1B)j%=1af zokZu;SnFdHW%+)>(oM)#tJo>cvJ+<>Sd~J{Y>GIT`E7uo%A;3O*jSm^V95avgLJ@~ zHBF2r2MKyK%Uz%?s2VLPKDLl;P%-7@=%-Fe1b>3)+m1x<00-G|ZyZBk(Lc@Jn ztae`k+L+x|x#2KT3~GMj$~ExnNFf9BxjE(2DyoQJoaFnX6PI4oql~m;j`A-L8dD;j z2uewHDi&83EGlU`7~#B_@E9`8|j49Ay?8 z$vC<(GQE1W$h< zXoZ+(HJB{j8fY@2NVK=*gQIlxcL>R;cH32ao4FWZk7szh@fk|9lqx44OVb8#);Sam zdo77^5<7(#UNN(zB|+yxAp)wD8yz6tPF!%65X@Lb&n2_=p6wZEACEN@M9NCMBrl&5 zZAalxDYg|H`($5}v+roQ4>di;njg-OG(GqTEd;9@8>Ey1He7xNBrej26?H4nrD{OJ z@09G9ORI+gznK}HPbD52pxczyUfN zOJ8u_f6cXA_Fa`wbywL1E6fj&FTV<1-|8#)_(@I zbeR0El%wGjGha&^tHO+6zl)O_>tH1LcZxFNu?8yr=pjR+#m${h^yj1!tK!_GXbFq~ z9d2~a%!J)uccvLv@9XF1k`7ZaJO6{)M>98$W*&ZQUDn=drq!8w#Bsc~W!N;zsi=49 zB@3-5%6wM#+@cgaN_@F7vCOj%?q;8C|9B|e--oF>V@UVi zXI4{%)YT7h*~%KJqoOIPGoc?0pmIQuNt&R#aTr>n(x6mDA&LJM&%X-fb8dj?)zNP5 zho`Ddh@c!;+I&d9nTQpp_Kd=nS{tYkl-AjsF2bg)nzU7cd;SNnHwgrdW%}o#xqqab zk1x-BkGhH2H5MfJ**W6dJrPf`bZr49ioLB5=|t5c@b76_8x#A}G@*gg3wP)bw$VZl z<;fPJ%qu5Ykf*=hRE_|e%6=8LGm7Y?3=I2FUKO)}G?MHpn0niCYgB!xlJT-8WNLP;E zPm7vL!s7}eWi>#+l4%)J?U|N*Sdzm@5A?5H%q&SyCh72_jPFru{;77DJ-{80)&OS` zid0$aBhW{q=J(u>*5D|`#YyNPh#f)CprF~jF7LLOgOp68HT)_$(8?$A0_cqMlj(3FTP9>}cj#(K^vqm^w3S!WdM#(VYa zHx9#9i7FUX4VC7`J?MUEc5On*`*h_89AYcf2N|DUJ)rnVI+|pi`8^SN1D9^TW!?!O4M%{cZl>BBPu;pEkd`1)=AA{uq-&86?i z73oiwJnY$JgL-c4H>3D;FB+*{vwAct=j!&^Mf6c6qM>QrEHX~Lw5hRPFiC%0O^VZ0 z?n$UXu(x9Xe4Rp^G{mw__!Tg#i%IY6Zf0`V;DB&Hx(`%&)byR!DZ?(JdbIdtE0wI2 zF2?ajYvau9z$3zNSK_L)>g{IDOL%VxL?{euDW~q=aw@$eb^&fV9(Vu@*%bhr)NOHR z2W&YS&afbu)gKCe<*T)XM7PF%RZV`;21TddJd2+6nKqD^Oq~{_cbKJ7zsr1T-oq#o zm7qcj*ZluRpbW0M$H^X6Dd8EM9deue<)gS$t1rZEAHIYyxK32YaS< zN^D!LCb6qq6Iw=HR74#S5$gC~^`id^j&D%e5JaT?zmWL!SkyM1V?>hymwr_+J8CuPoms#LyzjtjzYBB z1f3A<3B5v;*{`E=2oOT^PMNds2Xoo581R!r28QNiheOKm>mx^^uYKZ(ZR}XM6-g*7~}Hm{tK&5crZ4SA9FC`@AuYV#=VNr$p*gt@_*Wf zy$wP`>qLivi@MzWQ{N=0JN~EEGw=+zX=~}6DQ4WI!TO-{KpDJTIRi&MXucjki6x7NNR{3|=cy(u-9n{h2Ckx%_)EechLX(*1`a0Q%7^?eYTj0A z3{Or=g9&bm2TfKSr8?fsm0KKc`c4kb>^*xcrzOR()&t1BCO@tK^}x2aM|S})MuC?F zG-iBs0w^;IpHk>`Fkg63I8G=C_gd%0OAbSfBbPF0Dy zZ&0DWrZwFL=CJ5!6eeyZE+PHT@UX?0Pzz~T`L$DzA>@Ba6FUqu>Lhj%;gnSA1anEo zqsSkk^N2d2e-1h}Sm)ZGmGMi8<~Wt8`CQ_db236BT@O(1)LlU0bRUH}U>#pyfVK0D zQ+C@*mk8wtBwr}Eq}?&mG*l0;{!z5g=XS>5m&HIew%mLybzS@ar0OB&|Ibt%rfuXu zR2?hjndch(I zY2-PiH7yuxg*Z73K-L)wPq&Fc&vwobE2rPF?)CA{ZRQ!uC;#?-02TNQcos zh+uU@tare|qpqf+f^V*FA3nm4d{3{mCz=>DlbDWiPX*^XPs*6a@g16BCG$-TNMn>| z^*$C3Mh(X2d)CH|!>riV7Pwk5V%g5N&I;D8o;0@Ro={bVqB$@)R{K%C8-OtkjhC`J$gT|R7`(Pi3B%AD3^-S9~ZQ7o0kZ#b(?%#Jn?c4c2 zdq3xj(|hyPW(7D-8TRudL3kAcGTw)ne=zs5b1cFi2j%CYYGqb~Z*V=3%Sy#0S-P)^ zi_w}^Onpl}N5&pr4cm~ryQFQ|(dRYrg`mD*ZXT-Pa}PKIUFE2>6ck|xr0M*2m}Eb& z=Q6#w)sd*kiX1@xb)DQ0dXDec$Nh}UzNL5F@~#Bdn?}r5G=Nps(iGP4%mn5tC@Po= zA4JrB_sWYtfQtD+k6e*w?<;A0G`9!ovh-6fz0!csth{?S}%zzBtE;A`pzwZB?uETu)hptZlKJ9TU1M6^0d*!K}!B(ca`8xMKecUy%a07pT?J{o&#be znCZ^6^eX>wk;^45E5g1mrv>dvs^mo2d!I=WBvTWj%Te|y6=+1%`FLvf8a|a-+KrO} zqTgEsQ9=Z4=Ar|qeLCvK$k+NszjXmMwaHd0v8)jHwb=V1>8LU*6_1T4jHKrAulwh! zbT!q9kdST4^Yg4EG(k(@&>CAF^FV7RoTBz*)32T3+YTo=@i0kLN^V;x`P(=#@(@5? zmkAX*r>t3E4rdu`4o;3{Z~GAbN4UD1tX8+_5t1s^4E}Y_(X3a_cmtO(igrnbd~EKB zjUnpjim-iJw@M|BLafo2H)tgSxOv`(5zc<#Kmnt~)}RRC@09`yUBUu+9eJbg)8Zs% zadQk($C(X3RRQ%B8RZQKtPWmFTL2Ih&F?%!$Kq_PU|8kL^J4v}wx#*L^S?Q8vl$s)V2 zR<=;-(D^H0F(1Q=7&>7h(j@j+!8q&6vEi-OAE>~GuEs3Jw`myUAzvPi0U3nl3|0)o zTGKwC@BD^{gd)TRks~Je;c)V?T4O_%@{k}7 zo;$(O$x8g1Ryl!R^nDA!CdNd1X?t81Ttp5-9VGEW?I%nqdcvS3TBl*ytE92IlV5<>wYtj!T%7-nd#V44akhUTDoVvD$V|1ZehBiwe_Jyx8bftD!(6Ir% zNn4pjwXU}MpYSCv-R?H%zRH>Ta3f(-In*M@0|AiVGr38r4bmHq^(wbKok&b=9#R(* zGhqVJ@~)>ELyA7SO8G`ksA$rE-{V~-7%=y!2%UH@JD%o!Xh6h1pij#I4oc$a@w-Dz zmZ_D1e+O2lxWz^SwC2iT#-r!!hffwpsP3PF&4-FCrqLD&8lx<#W8Pk?8Ef0>3K|zs z@%6--6$8d>)GM%kTcF+xD^Bp|-!$X*wUi1)l8df6U}pPg>u(5E15hxlW8xC%QU7b^ z9-F`8#`{?alY+5~qWl?u=d`r9c^aX;uPb;om$CLnJ#jJ4TM~VX18)=TURk37JYn^--~;PlNl640$1H&;=As zIkek`0^Uc|K9}n6f>KS!y)K(A3EoQSdJ(edvp?%NgdzT>e~;|)yq_WGg{eM5lyCU0 zQVve%kug5~LQ0VR$nSX{iYR^g57Dy9Nu-40+*F)N6T2Ry{?!qCHSK|?7C4Pn^X!w% z-ny4+k2tB|%BNUKRI}%~;z-QcKx$7mtaBh|+{%>eV1y}9V78Mk8RuXO(;a>l#}u7I zJGZP!$!T--CU_tZE#s~00n18+C`0M1Zr4S4%4KN63p z;mKWYj4MsXEz&_N#AH!1YoO{$iEI}B zv`og}XZ!a*dAnD6!pr%RIBdgVZ(|0+k%jBNvu}JDH*yfz|g2Nr`Y5T z>!U+)zFhsit71%^QA@BSK{w;XHUv`<7Vp9d2y@CiwA1K7WSH}G`7p{S(0=YRXR9Y* zi*L%CAEt)adN3}>*}>T#rN`09LDtRw7gU@ZF!)q2y~8jvM~$O~i&8EtRVmr8ImFtN z?NMpRhCsn9_>2H2mbsBrxP%0{74593onCB_`N@g%eys7&_0MK~sWCXndkVD38H-6I zMOi)qk&;Yv)Gxw)LP4QtUMowhyHWb@ zUU`ayZNTdFo=6REPjb|Mk)!A(agjCr_HdmR(XCsLFZM(IdHp%I_uMnAeYZ$^C{~8`}?l@#Xb09LmF$i+Q?3&-RPbe8bAm#0Niny&)`dEmbSQe zAGcD4U=SqbgPbgS&jHlwtlz`Lw!UVJOe!Fh>tNWU0;l+p|mOlN7OZvsCirO5< zO>#}m57p&S^X$VBA-2AWIPV_^2)a&W4l!z|g}(n4Gz9yJMTl%oiAunz+Q>i6sC`sou> zf9*Gu%_KpE6E$GK0JfO|Q>Rmc9kb1&jvbwzvEiDRRhq5k;2K8A`IC=VfT=oZGDAwyI!z8Cqc=e{< zpcV+LY^bo@;6W1VJU&Yn!vHwgFS6bSfO`@*mKqC#^{5xGY&EQ!(LqR#od)k5HR^QE z=0-pX$SNbNQwy0w$p7GFfz{c_?ZGSgbZ$0l)OJV8Zu2;PVLE+9+sif4H zq%-^I`D=9HFB?w|VZ?GRF=#*MKT_zD84&}AYy^`UfprFNLrJFCzlwRFwEUPXiju4o z$(t}BQMB$BY(Odn?>!-ziyCjaX;=p0%@3N^kBgCZ3bPV7%8v0kp4^|JfA^Q~H_@9y zffE#En&uZ83zjPzU;UVt&*V-XeFibo(724(Sto$E(3D6>K;#+ag?0M3Mpi8*B`Ltp zFRq#|xJRvoH!2C=&E@~#<#2VEAD_rP|F>6phx<0YdS#hvwo1kkGs+J=JpuW`|BR8H z>$vd0lAmH;A1)gL>9V%raqUjtAFJ1`ymFQr?_E1`IebM5Pd?P0UPp!7{a#=Cho5fG zFb)y%==OVOEJ*;uTgqWp(n(QtVRxy2M{zm+TxO#1u2r5B@d{cJQZ)r4eJq@0Dp66! z=(CY13Mm^Vr5AKp)}4E8zm!fk!qA$@gnKX#YZWpTY78DNp@NNbrEXVnh^r~nSkMQ$ zCM$;T>Vvv38elBcMsG9-%(f|3A;IWSc_Uv+Z`QUO)ckYYy1P74y$%k>i`lEu9YqIP zt@t`uc?8cDAqVb+?xr8CxrF8l*3KuDG^u{Bg_gF2Jpo@&!?II%BI0m^3~y;TrOAqvQgHwDfREPHoEN ztm>fUA6>i@B8L^D4I)T8y~7o(I4dMQpG#G=lF z2S}ny-~m_u(DlPICA@TmqCOggy@Mx6G>BF;y>7epRk?#opnLx+4dOIm#xk2L5$aWl zLYmVA%yeBaiTq^b zy2sAqj*qg#GScB3)4aV`>Tk%!AoDR~38Q3AS!E?9LDh^S3J}-i2HtM2A5c$D@MU$4 z{LfSgR_Dl7>LK=PnRaXvZBwMNC|}V<^CHGU|IMon)TjA_cdXQtHdX$eA*IbYyR=l_ zf7~1#FjgKex_9DCofA&39>~a^|DSWh_^H%Qdj5_COG=0|6{Yz1Qhg>d`sL;uN8By%CiK*}!roTYJaL>8tYj zKLDR$vTi%Na!|Y{^p(3>>f_VoVQX1eA+n4Bc;pchHKzE<+U-?8mUOYryx0ChBY18+ zm~q(Ga(Ebtt=(9;$K`GqWdbLOt|>d%j)pWknyO-x;ibslLoTReHRE$p~UAw`mKa+F4)qa==kk`K%rkfC9zY=-GvkNNMeRm8aP`qe`SCag251DgZLwURq&2+rf0X8SR>#~=9noBsVNi?gBzk!&Xi=d5D7I$c~ zlb*qE8!7Q>IhtKzf7B2vpn=5$0&Pc`Gv=0}TsmMc2QF?GS7>OEP2)tVUkqXH!f%+33Dz%r(3ljN zcWJ_tDiyyEXGNa`Uf1Dib?IV`*p~U_=4iP79^PK2s$@;pZAhXrg?7=2zkHlxa z!dYDN^8WsA-YP~)Jqbov($T?9jUM*#&Fl5GI@?{*HlJ`jzaI!>!seI37LW?8sFs3B z*Skt&dP+m|9{BHO)!&oJMTCLQg4xxPEnYY;ne&Yt=X{X*7h!d4!=6KhM#Pp}sFOK5 z&Q!x-46Ds7xBFr_3c!YkVlZ@M9jID=-^C2YlLrBO0;);^CXQ;fB!zV6w_qFie~Uqc zxKdICG!K9QqFWJq?FuAGCnBg)gwDG?g7-^_UNsf@tSx%|k#~#bvr$9nHXN|{Xe zQ~5~etPb_zR1S+WRk<0?rm&alSTpV1uSIH}w~Eq&CutIH!!o7;f*LHjQnAEXF!O9^ zSdn#>f9Y@;C7{8h6nueY>M~M0!Wuu-J_X0>5tVrfl6cF9L_!hpjSDT3>!lZ)2} zBew|)JYs8}^8kbcC+sdG0je9IvoW!Tc=1>XcO7JjIM7{|OyS$vI}_OJL@^S1C$Xq% z2@J@U6Xbc0KEsKKOKLa>TCNHjtyeWx;pmo`lO2WX;P6+T8VBnQf9c*THB^VN5#Ma2 zCe`-o_qsv#X;T`Ff_pGXJjM4du5$jQQVuA{^p|wNRtFiKX0<1g zg=q)7Iz=U1d>{J*xCylfUPv~RhV(qI&*|B=@w2E5`KNaFzXviI2Ej7TvaDm)DM^4D zo|%5Xifk8y)c?#LMY&Z&#Kvl6WBETNF&?=VS~%m}hsI+PNnMhAh|`KHP)%ILZP6+k zg5=O_L{;^1oKZ;3l7@ZQSiiRnNbe|rUkc8_#JxsdY47YhX?Ca zuvyJlcc9&}A_aXERU_$1NEOjB+5Z~=#6Ua0e-6}7{(XG%d`u{L2GE}wt3#D_l=J2b zB5|g~3SU4nih9M$EO8UC@{;UL_H1Qvd6G-fnU;nXsZkmFK~BkQuC9P}T_mD5!ABa0 zJCfb^JMZ-Rpg2y+kCT=);1AL1lJbDGtZSf*Z`dM2%W`SnwH|I-`=R~f_v;FB-D`W9 zw~~xv`|%FArx4H9ma(S}dJ4DTY^uiWZ`=2PFL$j4uyiFK=E4@C7Uo+l+2OR)fN z#7dG7TMHQ3Xh|Y5pvp@lOH`<+MO(3|T|G{nU1gpC&rg^>1W{M=jCRAdyWwoBn!~hR zCRkxE*A%J7Qrw}LxfxwKFrjgpz|q$Vp~GA!`Tq0Th|^nhE{xyaTzBWYHN ztVje=;)ZYfj!OX?%huR!@m_I-T`uk;9^o^<5*hUNRg(hQ7rLgSV9@@@$POy*88IBP>Q|w(Q$%{+BpkONG z1~at9r^4cOkmVn#bY+`*zxvI9G2Wi zxlaOoaI!A_rBjby!-6qjT~XfJc)evy#q^(HU!9s^CsMa{g*fg}5S^YS+D!@ztCB8F zgCWUD*V4iEIUA-*!*_f~N(56|^1S7rO&skFQx??IoXMft_U+u#T#_gqdfE3m+j zYlFv87MmbaDMN=tDFPGiyc2_HfOEABgPE(+-c+nLAB~m1b(IVP9z|Y@?K$%@yVU}n zG5j{y-Uqd^clH=gCvJmQEy4YjGD-fZqhfMu$$ ziRy=(NAg-$hI7rsdtsX5N(Z`_bJ5h>5~}Ys>oB3%@*cpj_Xq7F`nz*Q59Euy5P?^E z2xrtKj9=@FRy*)UUYMQhra4b{%XJAvMe92Xw1IB~OzS^T05TCn;JcxLl>Wka+h&j`Y{e?rbMWz0nRI07KzqHkysdzMFmL zpike5txM~wI*bdm`Zxhr5%EFcpeloV;o_)mOw;~RZqSv*v9>hX2{e+P`e|n;)IqYQ z`%?F24wpC;mUV)Jw1c1# zBUOfE#||$LY&%Pk-CNz*iGDeiSaS?MD7Qw@K2~UlP%^{@HkvsfC~db)r=d|7NXa ze1S{14|Q14JKHYkfn3QwH1w1#;j0y#i4did^2?3fs~a8C=4_Z8`6+y_Pu6PZ1Ye3Hp^Y% z+4h#>H^XftJh5z_{2oTCNChsn6EqZ-5gj*8yJ|W_C4h9DPyrdQbm*yzj9Y7~6Xge# zIYc>XZY|rsD{~yQS8+&snD8pX!_JlJ1njJ!FaF9}LA0t!IY-2i14)OvgZr$jT{VEj zsGLX;%O@ELp44C6wq?#t7%XmnJp6f@q}# z8_)$xsxAlVPM>u6$EXE%JfO0wnM)5f?MCWX*Ol+$?ga0@(9KMp8MQQ0}gQ7=j2E&1Dqg8G`QHx5X$7U5T?(OaE z9RNIpb<%_cOJ~`()oUUA1t1!~C5drUca(C4LXx z{Z4g<80T4&&Yf$#=IQLj>FlJ@nHQuS!~v#PBnJoWbQ{7`XO*b_ z!V9)Dy&$nPV}A(6AR(&pC^UoU!*b9-!bqAyKK-=&{*9s=2dzcv#cR?{Hy%ti+KWLt zPPVUyxC3v|#QnIv2oEAu#6zt71ZIl{;BP$xhu04dwmS#AU~df78)H4B#+4ir&R}q7 zS&hj;rAdT{8nntiq|mF0%$8j@vh-AJMGKK7=p z)j=y0Wk8@+8Ki90`%1gid`+{wE}5}55dfL8H4Bvw;04I&D_U%bJI-d>f4R!$H41sD z(8V&OX}?&IXEe{BNx{3!n7pL6x=?V8wLIVs0+^pyTuN;k(Hn&cocxpWM2%JNqNIyO zmIRDqQYf|&(h`Woca@GmVc8vo{oMTc`s}B(i&tm=`Re73QWON|f5n(d^m`=b-a~27C|MHi5{BkoUSePAsBbLQY-4Y1*L9z^m(cM@NKR( zI|Dm-Q)r?4qy}adMy+l=hRs3HPSqmrdB;k02lLCu{#MhR+_UUvHrRnk^fljlb%4w1QY%D%|m8m6HKuTU!Dc`kj&2yKOGYW5xZx<=1J< z!wscuuj$eOiM}?l(0#g`VRbot)P+^BUT)4gbw`FPG||RQ{TO9A6rmneC1RwrJ?pyl zx~fsm?sVQb@E~VN-Cv?HTPU>7H_DCBFbG*i<_x^3aB)n6wjPlB80+!LYik;VK0R>v z<*}ZZ98w1w`};yK;uy+|%L(WO0zbpP`4>$-ZhFvHF!h3w6;Ex(aoZKJ@wHfDh;z_rVOxde z%^`$T{x!+7RVG0xzD`{l)sn8E;ON=qMFdn+?)1BzSzxQeVsQSOk>hTBvr zU7&$(u>!-dLLx2Y%Mb<8DCne+5Qr;r+c2ypvE{RDi>!lXf*hg&w;Z3kL)yHV!n)d) zDOvX67?a0{L2+bBw_81J6IU1g@u1RQwtdVZV75h<1G6orFqm!L5@G&GwXdV@INcN) zk&($aIFdWBV;2XY(2&|=&R6kO$ZUJmdStfku#4fKuXc+nRXUs??08gmTKd6j6j#U1 zwh0oA=(l_7zcpVD6i#clsIqakDfaSP$Y}mOaE+|og}Zs<1LS61hk6EaS2si+4j0eG>lC7z&LD7sFuMGjqpsB=A5n5F|$!Nd4ZktJ>tCH!XlhLdo7sa|3 zr{tTL*W_@)xhb_0PaQTBgn3Hj_p^eWLt)%g*dTS5PJyXaF9yoPwi`@Xemtk;cus$r zjbsNu)Z$SGJyy`;#}z5o+t$E8Ib1xsPH_w=pvWHv043yGyPLqXW2p}6h;*tuYpk2{y+lU*$8OEZ1gq$T}F9&`kP&YNb%XW2KVX9j~e`V z7akOwBLtjH{tLyn-~Idl_@AHdJ^TG^GX4MlGJF5U(Let0+uz3v0N8dA1F+$(_7Kwd z6VQ1@`jF`J#qjHc*ej$-`F7vh&yN1|5%+e-Ef^|mU>hJ7*iT?{27EJ6pupCXcsSHk zccE%u8(Os4-v%yZe1Ye#R`Pyxk-KU^W6m!nHon(NOt# z3Wzn9^FIdGf4IbOa!Tg3wEuoC|NV<2_e6tKSV?|%WTWHRXza>L&u63mpS`#5j@w4^ zM*rVWf%MEolBc_6DVdk`jyG59I1`L8Y7*Popy2(KaAkyBU55Hj&kgPkPN#Fs@0S~)1 zMl(RGjb?z+41jGk1B_+>-@~IBU^D}?+h_)WHktwY+Avq`i#X4-`?zS4K+82tKFS)d zS)f*xKcBPLI=CJ})u|`B&Q>&0JQhyj6e_Xm;KqV(6{$h_!_*!M24}O0G{RtHv(Vzg z%D9@c7^+)J)jYri28Hld>X&{)p$k1j=dIU~saD<6g<|daAi2}zN?!`L&h~v+B+b?s zvt7rDTXhDaJlpL8W~~k4^%l`j%REaGjWs0FV&9X&*6yodi^*$IWXX+yoVdlrDqpGs zo4ab`x|=F(8W$Q?{|Y~O!c;w9tW*re7}xQ2Sa;*Xfaghyn~+x!{F7E1PS{wMNK9yVnw0_;hhXAtf%EYE^&h1>!5{Si~!v=T}uJ zZ2DF+IkI_;9yF6PaV(UJ4sYz|k7Leo?U?{Z_%Jlh4Uq!>r zZ-Jre%&wX-3A_0}V3<35pip;44tEbETGfIX6!Ol7$MUkDE%coYzo&k z!V3-AhMe%qBKmmCQi+qcv2&+W8Fn+#;S{X@^!GM)&Uhp;CHC6g-C`ZA! z{_L;MXXlU4&t~Vp`@`pt5l$q7lzqgujk7e+fzV7YfAjUX-+l8X?pOYxE(7sknY$!2pe#%ndjY-XRNG$uw7^Co}2xvrFg!b$48Cpo|G;aZS7c0J`1~C|`zH za;v_ubiZBV8r>Jdu6U|YtOIH4av5fe-Re3jW|IY2aj|jxl3_|dUn&E%F~Hno^s$DW zLnDUu72Pt7O{%T{7lEY$BqhAfG$7DJ>Dn$N1ni8jH)v`Wd3@u8eRj9nv>2=fy#xUL zC2am_^&(u2SVO}3sK2g+t5IrAwA&E>c%V~vke@pYIl8N#1|s&wz9ZQ^b1>NJwTH5>)l;=;(xf0mzv^39&N~6W0xh+v;I( zvh~srd}p^{XFEEZ50Mz{qVxcn(F*!!aBB2JJAcRY=rKKdOphMpqQ|&sR~zG^$GGS* zE}D&T(Y`juMN``t7yZkOiyqUX$MoniJ$g)!#x|x$JKLBZJ*G$3+GqwC%>dnPGy{xg zfYA&9Z8QVuHktuC9~sR6?e@=|9t}Sq;Gcbaw-YRmL|Rr+Js7d8YxB^0n=!uIC3kan zp$;mHIk|XsiLo5=*uC4~ot#8*mGGj__3z-Q$%U|kys>0b@kA;OGZM*XSuUQa0zx&-RWa+MpNiBRD3x+^g%Z{(!@oS>HR?M&GkjdtN7GF%}?4q42 zO`@wJ#pN)o8d{(a=ooUS7@(>%*WzD&0@EMbyC4Wtb zxyWgZl{$(@SJ^)2*O)Y?87fSMTUD2ZL~_;@=>EhM$^z3Dq*NexXkASs-8tl^3823b zX_UzxUSjCndSC8y;)*q;D>vD#+C?`azZOv2D6Oh@a!7+Eku-OKE>M60>NXUYf{HF zln2I}0mea%b9j_i3IDlD%caMRDmr#)sN!9`+sTXmWm=SiM^k^P(poPYWlN!0sjBOS zvH*S&aQN3texhjt5}8d{7I2g%o<+Lf(!=1~;bj4jJI>b7r}4xfKV|Q>08Nm1T?n}( z%xHz>f;7?l#DZEepsI$Qvp$Ofx=3ScW=CABj0c-iK_v`d0V=BWlVcP2>Fn)^2{0vA z@%!W{J34Z9>*(l&5>6V*MsvgvnJLc)cfA{nzhNx=Ts3LnutDyp>{#q31X%IaufK4WRBNUX7SE_{GZGr3+RM2VSjo`ueg#)F_=t%3+5|f+eB@5rskzh1G8E0~_jw5Au?2R?`g!3<^Rc_?VzTpr$O6LY&St*HX+~$0nYD(Le!8Y6(vmTpujUh!aaa}K_eys z$WS3;nlLaPvQCf~AMlHZW)<3fD5w`IxQhd@g&-fDa4y{tEj~eB2XHwEC<_gSg#@kg zQRKy7z!dVnp@5tfBi}Tt6xP2E-dHf0t(vOOmDXxFGr=mD-0s;hI#7 zD$p^gO(0ikw%zUhcV%9v(Vrd{`>pH@PZIS}!P@I?|H(`9zQ0W>z8XR3Xr9u0@Su+ z9pp>nl5Mz@Vfac9$?IJ3QfuCir?Mlz(Hcydb9v{HudtV%ccOS%EyqhebPIp{v6Og* zIznc9hyv)p?t+o~5QYx#s3}mSfkzg~?3sOvSL8v?u^SFiNlQRSuYhg5kCq$vbCYvMcovt^SIi+VA zN;4^UM5BO{(hLlLJE`u|L=*)R?{`VOisjmj(jGAW{nh6sT_bCZ6SyGkQ$Hv4 zbV1Rin(ngV@?Hm(I4@^h*iLwU0Qeh=pCp+#Wf(D3Ph9(wkXA}@S_52cdleWBIGKx#F|c5 zwqg-k60gPTZk2fOMH@ZDY2FH+mh!T}RpfAiH`F*SF)VeL3r}RTH9}+FUkVmUWjIcC z5hnUBm+cK)LeR-kV0?4r9y}uEt+23MFHO?{*;BqRH}an=b+0IMUW)5j-iGAAX0Wrs zKgK;Mij}&|cX4_>uM4?TJNh~<>L*DrU8S??)5H=(J&#edfNeK@n0>VtFc8DK$>2Ml zG`BRhNKLiw)b)8W!I3T|RtR&5)6`f-7L)B=F4w#v7^lk7xtLh~R7H25igGdWUZQI} zup^nFw$NG!-b=x$4^!VYqe`Rj`%P4#LlQ|ifKj4~VmEJTMCQWy^;s>}-}6aWwu4h<9r3Pgef8o&b93j|by_90XJm=HjR2mc|# z{tO}91Nh^D@FCM}K>hTA_mF8?AV2-EJ!Fao-sb@Tdj>)E3ZkWy^hOf`STt$>n7&@x~9;YR(T8V?mCh@Up;;v9PYVki6iC?!1i? zU+UjdFuqKL9lD83hDfZ;3c<}#djG3O0a%bA>ujGw&TNe=%{&yRkWT|> zooEcwO=o8%Np?$8jhA<=%;l*`-DyuBXEC|J@dLk?s zlYBj~19<%bnPjpq^rMcTOu98FEO?U*iEd**Ll7q$a!aHJbFy%>r0TH%)FdKJZy0F} zJ&8!Pj*B_dfe_7d~nh;$3YV4_mZ9t4X?w?IrLB2|Oj zTLw6Zj30pn06ycxv-*$G`)yYb<8Lt z)q5dJ>Grcox50>0x&`lE>b;B&K%$~ME)m^{jz~qOtdXlo$W(OSO%1`yhfo#Bh9;6# z4^mZ#r_GIM)s0w1racVVO1BWq7Tto7uFOMJ#4FwC$XD3H{BvZ-Q=qr)J|$2NjrgM5 z10lcY7K{L+dKHjXwxk-x1Dt&>=HhQ3w4H;kd@z-`KOiCOA)HcUQW$~e zm=rd~{*AGJW9;7;`!~k^jj?~!$Hv${(yzzZzcDFnObQ#5!gL#x!n)d+6gDP>x!ZU# z9505gHeL+Ji(%hmIJNlh3UR|PZR~}GzJAGG6cu`ZC`Ny1>V+eHOhqBe zZX4KdJh9a`9-4Nkf;sY0JKx&8L~i*hhVjz8(ChQ@@Do$I7Lz%xFaoxa@(945jsQyE zlK84wutW1g^3|>l!3_NKjYy*`_ty8kv}!2gcZioF^|yS=gJifhy;)%s$SN-6{}YmU?kHSHCSJ*5(-X$bW$E(s(>tT5c4}YwBSgN{%6VutG!KQJ-VpDD@`b{GEOU_-7{N=vd355q%99OrnS9%8(9?VtnAaKPE$o?yE_uKBfzA8NSu z*$wFaJtwzktWSf+dZ3Dx!_*#&$$dv|P2t}O?kk#%`~r?3f#da*S=@0SqbGBSA@{|F z|LJM3&9ye99w~qLF*ybI{Rf3cZE`Kr7x;5?)zl~uMO72axZ?U03^`uLuX&snCDt&M zPh7u#^~^$!dd^oHRj3rQ>9D}GNXza3hj=dLRaH}Cr%r_?J5`i5OA<7?D1vp1L^q2UDZ9G5GE)JItlVVL6P*hLe)Rd0 z=Q^7Hi3<1brgHFFWUy*Ymtf^at|QT%y6oELl4o$$Gf+N1ap)o%h(&RTMe$Co1$sE#ls)zn5#6Ggg#RZbNEI%M^`M zGp*jVGjq|u${=I06!{kH?s1Cstxe6%d#y4xac?(*Wl1FG8eK7FA+K_w%&_rR6eZv8 zx*36VkO1H91P7!)jOma}PIeo<6lJ{Pi5deqRQ}uKRsZ7@{{4?WpHc_6ty+=T0WfrK zc!4%hSmd2FtC?_4PqkH`W@@B23yiEsgH?oJPi=)LP3iAtb|cJm^#oFcRrsAW1ia3P zLu4v}C8G&gS14{Pi*v@f5)wMf?nV8eFpkk4qV+Rks`VXB0`wgrbpzQ)$=`f00IRTv zX1oSyN=ui6gQiF0(eLXax)e!vi~Ug=L+#8#{KR<8;<7M@b6l{ib(VD(fQIo)MWdz( zR7d^I*%i}4eGR3`qtl~)gcqUb@A;~%bR`}3V^pu1Hxh0!QC-qei}I5*j9I+8y6Us_ zQ^WFfZ$kY0D2WRz^}aSG8(UEO9gnQJesu<7-c)6#P<|S#EPILS-dHM&T%9$*SUq~s zxW8-Y_9D(CyWl(Z<%R#9+uGgBf%ez_EdQ4MLGWM-G(>2X&{KgUcFW+*JklOEtn z3+{wI2LxL+0z3O7B}o+Bk%h%n!MD~!B}o(=F^fH6k|dIjP|BVVNfOCs80CS(BOfX> zGB_-9KuBb8aNU7JAp_&|C_!A<3?v_%U*X#rg1@SxK}oLKb)Q6()gvyeyE-j!lIG~f zHVYUl`l_$@3D2Lu-{qnxsHi}JGZqlEN(fjTB1Z=WtPTlQ4c<#ZtPBZICC6P-15*Qn zQUd}~>A|S?2}C6^V`u=X(v?H>&KK~AC0iPI0i|l6B5CjNl!7`(bZd+}S@SO8D=0ZO(te?7!#A=z5$_CX=v1O(v5Q|I!SeG9{1vGgi$8Y3{U1 z;Kv{IKVTsL40EG4fSww4iqvMNqw|NE1CorYu1{nWI9 zH&`IZb{(zuIe^H@r$N;+ZlPP+-~dzS#35xzkma z3fIClIZG~VL9kR$b$XbtjHH3e<(CeM@U*IL1t}?fwNaf@Alw*Nf-caq zUY)|eF2tTyF6pk}R9x>FP;E$dQMm@*6c9Qp7{B3h!k2N<=Ma&SH7PPy>{TVS8fnC~ z*B!Ne>pe-yay5xmbwOHHcwC?MLfrnMy!m+A^(?SK)m|YGy$`>!c zgkN>itVU=_#0}JoS+C<&EVn6Ntwe!nBq_erJk?3pqK1KlqEvO(E}%Goh!&HMif-Kj zp=HM6RK;xEZiK3lV((PkrRoh*@a96!XV2Yad1ucw9)7o*J0)hUB<#9B&>lzks#-JN zu*uldkMVJFQAuu{kJx?jGK(FGoeFu7%m3G~^Vu5QfCZM;Y;nAAy3|bAwR=R#BJ?jN zeDzKh{L#~T6BjY=s-6jhf`aKP*+UfrWkwp;RL0#6M9PRISj%It7qO;yD{6Fs9UUBF>07aK<* zne}BiICWX0BfK_s7iO~=mewuGeBW!P0G3&$`=U6Pz1SB3a3xP5shu-5Lul;Z@g8B% z*jx$FO76}Zb?FwE5zW5JGId~LKmWUj>gg$aT>*H>&SXn@<*oD`&emBb1*6TNK2z-J zDf>$*4+=+*p?^Gw5Tpw{krJ_(Oxa@cD$lOLvXox;!~LN{{!4M4bAVWoFZ}IJUIJf; z{961)+&zWYn2+C-IWNWa-P5i7zQ5666-`l>(I1ADTV$UgLD;_vdT%$EE0lf`6t zSBheKHqFIuDmU-b>fMV8gvg(sDl`*BGU*}vk3&RwCA=u#<{Tn3vh;22kIkv=_x9u3 zw=BPbI8-f~ywicLG}Lr}x0D%5!vS3}!@zai_HYyO5?xwXpQ_rab-1iHJiQjtTooaP zYO`LdQjWfp`$}mb2JQjJZQf{bY4mHnl%>`OXQSMVJ|~N=P$DmbGx=tcU6)`2)`qQ+ z1)-ini@;{Tg_?srg4*KdJ5-e@<}ZDARApPM^`Vx4)C=TYF|8Hr^fAqH2Yq(_hu?P_ zhOm)&hO$~jf5s$*-i#bQM2mgx$89u6IsUm6a1k&0{M!7+zo{(EL#_B*j&-FmcznN; z{FG-`oE9ZdSA?1q@!HuLIrZvfO77U%Iabq$uD4E~@8AD0Zx5NWJ^ppt7?0Gn_F#XC zxVon`?qgoE4uwM)eo%K|oR+`$c^6HopU0$SM=9}x^)iFjnkunr^fWFHjq99mx4ev3 z6+)Lk9H`pR3OE)BYvYQUqoYEd3e^_&l75wE(S9Wr@oZh87FE-Z;p|cdsANI$e%F7m z(oF{vgR>F>hl{GR7l>GR<00BIE3O&mkK@MDj4OVXf&07-!G;RwU1OA+(G` z0fn(9mO z+k7vkSd-l^55G%68SpWlim@}1FZa8bXKVufqx@3!@K6j7hW^tif0oovtyK-D4`fcN z3)Fm-ZBNbjeqkYRgD-e`$EqU+?>EhT2^V>l^yQ^mIWm&?onYpYga_MFtTZ=T~?TdwzsV&GVx} zpjuJfu-iD*e$>IPS~fVa)iciUVAjea_p&$ZrDa32p2DjX?zqz(FE?u0X&WY*oqN*0 z8~HL#@8xZd-U%?Gp+f-FiV9=1o3?S#)(5Iok}TC$;b#di(9!T5C3_D{!9)xHRFtR6 zJvpoBFDBZ=tW@qE42=R#VHUv{T2MD z2kIRQ9Vl)TDz{yGH?2rzFhAVpF{tHgW;==66qR>bq{Tj0Mr)lYRAyRb(r@f$kzN~d z&Ke6EQF#SV;o@oRB1 z+5E@<`OPQ4{`BbhcC?_RwId#-Rg z+D>A$d3QNiyB8(Rh6$xw`wv(XbgRUP6fJ5C&fon}ZdA|XwZv`tK5gZMm$xeBw@bYD z(qBwE`?Z+VOT53$w8OHOB4FKKyt-8VI|hhaUZ|Q1i-`)rUQEy#t2=(u-%lL5My(R> zcS*d8%jB*Cr(I0gv2BGr@fLXrD1A=c)2y~-fBoUUyS85yBr1ZE&BQgTj?91+`4>5d z+OghRi?%$S`!gBx+-Zym_Ye^9|d=5PR8zyTl18}!;+ z48jkZT96Dn81xIltE9{&UXLQcAg-IPx(8fwAHhg9xmQ zi4?qUJiSx0OrH;{I+s0u1=SP8?=lmOu34_}dosq21dscV1W^8@M5y>GS-P0)l&OC) z!MLens#Xk?0-+q91~3elCPZby@{(spiiNav&(nU2)}-S;dZXc}dfDKap^8QFN*}Lr zm$x{v%F<%LwK>sG7sH|p(HOtk7LtK6M$%^cvc-}9voVja;}o4cy0B+!{t7Ed&WlKa zlZw7I6_68&qJ)=Zsb!`xGv?D=D#n&PzZRv4Ag0H<#Ml9D4|McA%-P%R*_p_i8 z?=O`jeQ4ob1!!0|KQ#rOwBE~7+rH%*$agtRn%NP_T^*fIISxF0t7)t-%YV}$7>zH{ zrlvzHJ>p7^7smv7%Q}3vQ2&w}BTMVhLH!*?hVfEI_Ur7{;t?QO(5*gbBU}jqo(|ZUEBm@7*086J4h+*7lB57 zfI;(uWxHL5FlQ=+G3F3iihde@9u#$~$P?i|`6Y*+p z)K^IZdTg?+6L2$E(bT{MA7B~7ZdF`F&y;Vm(xl(Cu~-|tR_cuUalb2dCsr*s9@}@U z6Bk##G%HL|4_Dzs$x+X|m#a+=N1M4KFE0Lnw%TNwr)Z~Dp9vMG=4H5@g;JHs>OV{| zk^o{BT$gMx=B^UK^W@He#rCU`+3jh(W?C>?($pa8!IIkNa+g661sL9Z8imRzk?)6q zo+_H5*hAFtdY{PMn`G&=I{!nYvkGr3SPbbzWz3W0Ze9EXyrK)5|qGlk7YX>?aP~X0Oqzw5}~Bt|#Gu*;h4J z8bCEmQvXxgL9*BVB0n?s8bXitk$;bFMgn_QF+t}M^jl1=WPM%P&0pWh3eo!P+^5!I zfY$GS_q)%2=hN%(rxbgFKa#7cBx;CaW((qm)rD)C3U<{yS$KX}iqvHjBH0M6seJiRhP&t(dfQlKmSu5q#vNbmRJX8M#1u|fbIZ5Xz$CyZ~ zBu!gg>EEoV%23r6E9=eU4iH9W#%`6oQeWyyOTYiDb+l5H7N4pr6`DY$rI+M+hzd|s zTKxCZ=@6yGw+()YO3TmV)Hqlq!vTy>l+ZX2#Gp6o%=eC2BW|hlXC}15`3o{Oh*RtA z4rlA`zV1;|;&$}J@iFFHATE*qsLXP}v9UkfFU@&Wbwfp3v;Y3bzf?ijI=LCVTlib> zdb0^G^j)&gd7}Qbi?O8pB>5M7y@>vbkmma1*=+VNd>8*!W3TgFY^qijDn{b;=Imea zP0ygrtIiJnQmo??lg@OS3iLBgv(kpA;=6bTAQ?9zn%Ba&o-iHNbsd+R{SxAltr)-} zzAj9N8sEjIyM2p`t6*56ZwFVtgp_Xjr?m(L_76E6ukeZZnSwmjSEBt7` zgG^wlo!p!)Maj?f$%sSLozg;PwGmrhO-Hs9>BXzdzkc?n@kO)JfEkB&kTR~FpNPBw zRg$YxUl7--v;J$M6IJM)3a_s)6-{A{<(*NZrjQptRd~~&Vf}qC@;fP$`L?bD=!)!B zpnqf+ajKT4F8qwanqpVX*?;iWJCR0iEP4!Ft;&|@eyZTjrNW-5X-{48be4c^oF_GQ zAIUjUtH{QjQY%a9Z!ljbRo`STy0ZGRwN%^jOq#=m&x$?8dh+PQxK87r4DBkcftT$P zVz9d2~r_UU53+{R^L*QA-VX9gPz zL93u#dX@U~;L`vm_ZdXDktf1d8rl!IAluX#+BtJ?c4AfAI*}-1xcKOdQzOzs;M&Y# z-bG&Xz9UOI#KrSsOz$ zK;Z>{y=KFkLU=H&yX*IySlnt^}tN*pr;sVbcqpFJ0{zEU=&r zA$mdRF4P0h9F)PNeo=K9n0zJAO*_HzO7qB?uC7X@Rn{%1y!D-Hf5KtFO~C^8Es9k%S#Nk6P1#kQ#gcrDbSlbj(vp{o z^dhaqS_KQLg-26VxR`1Q4|ulWdE$s6_g=s7EpS}HD>|o1pAGBw0#yCC96SzYJ5P}= z_D>a#d0FSEmRs-+x4YdfoSF;K+Lm(7TEFW#Okf_OtePkH(rnj(@+{R@3SvX1>SSvP zYwXvmyM3p=OUgMHWOHxG&$nY{d{sFOZQw6qD$!r*@{eXv1Ps=Lxvt_bS5Y>kBK-=?PUqr`V4MeuTl$` zfFDhz2XNWs0=y=XF{q+HIB;$!QD%;Hr9!!+T_)Z8MAP9}{mcJJ+m7nq>&pF{sYp9! zqFJZov~|^Nxr#xd-2PIs03wsC3m~h$koPvTRHM@SJ*<1E>5O?@h<+Lvc&4dROUZNZ zFdAuxVFF3dA>oHqj-4~wmHd{;BWSDQZdpAW0HGGu~^sT1RV1lj1Yk!q0U z3*t|M7*rsxA(>9yc$*uP>RXCNn zsoGz^653GQFXQrjTfSuE+$%S8@Rh|ji}raT$v_RX-YH0}Ox6Cu*$=C4f9Uil&>FRz zRxqhPe>t`;T{2E|n8~hJQl%i43jdg#(~RK<8eeSHNT(potkqH{49tXl_3W$=k_M0F zn0%KTN_O$!B4-P|PvV5^-|gUl1RUyitf1a%?agMMfw-A_X><5V%|A>^-Y!$DszWLv zF!p%+Urq0n`}+?NAmj{&uNAhwE>2NMROQiq;vH8TbzYea&d$ZAYs02D0VD z-j;iX7Kt-heOz)+R_;l{c>#?Im5dB*Mzy(3qj3Fm3_qNHaycuCcctuPu@9CRot!=k z0s@=`G#f@c6v?E%Gh%xvz&RxzyfwA!`zc`sAe8}6Ri59@K$=FJ3tM*ym!mS0M+)J9 zgVwU8BKX2iV^B5%6P-8&y5%MyV86n28`y`cTysPr@bfkWhTudiqD;ieVuqIws zvHhetA|^GagM47JED%`ykqI1+_h7E~H%{E(IhV;plJO$Qx~OQXKkdSb*|S#qu@*X3 zCET69vX zW|+xE@uw+%uo;G{brtAy|6`prR-2R??vW0q3}Lj%e(54tM|_c_IWN16s&~26-cBmg7&4n@EG5g-JVcU0R4lkMbFKO81U6x`OTA|YfcIDb&z4_SYZm_ zeOkCAkwA}nQ_o4U5hnJbg^rMc6hWoG@dW6Fw%qwqFtG!yC_$1F(lbS%eQbes_3@Td zI$vCaN8_MPj(O@+Qg_B~Ivm15khQ@cLahMNW#p=Rlx|JvMq@kl(uE ztvTG13Ll)m1HgUi6J5v>nf~FHanDU4GQ3q z*hUIxy$8;+C{O0=-KTl_r!vJfCXbLE5rOEzx?CVSc`Ao+pUV^@hpoZKEKB?l}e$j)XklnKy;$7Wnic-;~@p(2*#76Jqgr>Y-*w6#NIx?z7XodBH&*ktwTjKlq$*K5=mL;r;S;p8qG^{)?V0AfEOEotExNnxp?( z`RTAYyUytOceb^geFt~?=Tm+x1^>s9Dkh(o{`hyPF!8Ssg#fZeCcAl$VOGLv~ ztkJ<)s#okSt6Ut%gKBa*@{i{Uh8QA%bjAG4Ad06V=d!`9;us}QaIOEuvNru9+P#u` zn|yZN;JsRpJlCs-4S!LJ*H{#OA28z9`4(+mRw_#ielqwY*5R**bU%lt=zPCDGBL}ldSYF#V(&;Y~HS!P`W zM*l>9#6OqcTwt!0p9iREC0r`pkT~a|km=}`YjNbw0;M?R0&DWOtM9@`DzHV%37ref zFNb>W#F;c%N?ck#O9)DH1*nwNZ~KFsPg~uaw>IGLUvB}?@!s?iS`nbb5@#ZMWQVkn zM!iYJu45Nw_S*5L6-e4rY(|9efXVY4`l7m6dn4jLN*W!)Q4=3g!he!50Ni%DVBqp)mQVzV2)pDm;(t#TqSqQ`eAZA zmw&uVDpj3pqaR9 zBcW5Q8OFZMQrhRsPCwHM*5ZuL6SDr86>7;rT}fJlNcwRz^GjM=UEQQpyCl_GpGKxtkqN{)lWPu178`tsvDE3#r_NtiI$9AnIUXbY;OGl7SB*rOq2I*V@k zefC-@qeMP?Kcp612$(R2+elk2lz#ScF32AU~JdX`a zIHBB(FpJ!2+xlC<_oS>El-kyL@v}6IXxS+(24H4IS=A{HA)(uyMwoQx7aN~?_WTA44Dgg320UO2vOeZiYjp_PVa(Et_Dfcy-P>FyNE0uL*|0<^^ z$s~`n09Jb701}w&cnwa*euD>~HZsGfuIQZ=(oiH4BgOTF1)m!U^v+h62PCu@B z5bRVcC7m-)TCb=hs-(^wrC=C@!#e0QF)fC0=3{bAS8`pGuX0a?AuMwMOXb5u6Xi{E zYv{=F)#^>l?I9b=lQ+9q^;d6vbcl?tjhP=MoD$VD)6oUqa-jBqs!TJx^c^&6eSsn@ zKMH1hD3WUfDe^<{$%$CBY;2y9MyGiP<^|C>+jLG1(lhvP z`an%|&K~S<4%5DjmPpS@_S>a9V0$uBGp&go?)7C zgEr7o99B)B^-I|?3)YPqcL&A1cdFR^FZu+EBbduSgM|FwPIZIjZU;Moac2jWDJr&7 z&Tlw5!+M1D?tCJS?&rkD!c)Tb&?~hF*fS@zVvsn;sbS!7Qk_Sv zBLl;t=);5aRPfz-9R0gH0r?HCzo~xaEKBE95C+4I~szTz*m`ZIxbL% z<`N1iu^7Uv0k>T#y{11TO5gy0ddXy6UvFSvZ*QB=oH9-9fZV+4v+OSqHbE@ejL&bx zCX*oLpRh79E7I};20;EZkQzJI{XZHqNj%x~&tJcXS5NcnO-^PO^~v2Y)ao;!mClC! zp=P2Gj~s#PYg?M^)L^X#cypDtLOx;0!S@ON(^{b>t*40r3>Q*E5)&KfnSLRRqKUss z{)^&{JRY50B(6VDojXuy<>1{5sdsUi%m!@(7+Ez&Xr;s4X-DpPMyuu7_t`kd7ilx3u>l}^5R$A_7I}ZQbo2a9kmqk$PY;S&|JiS~O7Z9A-jyZH_tqzQBp#M-TFUHtAHu-Ea;oAM6WFGL7DNb>3{ez+a{d_g^Q z*+LK4V6B1FhA$J>cL2+R?NHFa^&x)jETwT+TDQFJm()(Er`sIg2yM@)=Z}d!Pc~d^ z&hU8cvkVuug|FVWIMm5yXX#pY+7j9%+pgT0G%j0CD@79OwWISG=BqgNY(on)&&0_9zDa!Xp8G(z>9M_K98cvCSTIOJO~H zdvZCsx5=;ZNWd)FNWJ{HuzqCCl)B|360|0LOcTyV!hroQ6sdbkH=-l&J}F5fZfzL~e0 z4vTB_vBJ-lX6XIKsv3@xXfXO zmT)syker;F9MIa#O#^{1)!2`)SojKg(u@Ar`d=PV3Yc1r)lh(=8Q#0F`%rmAS?(i{ zW@jC$=iYyjHC?I?>>#8>3T8SS1M61E8(&{g(HMaRbWg1S$`{4agYqe7oO}ibJaSwp z9G+&_a>THthZ=Ybf|fG3>(um5e!ZOOf9Ka(9skX*tK_abH(mBgS~UGlImc06EAvI! zU$((ywEF2&+Z-~cd7u$zjz=1c@tRf8=%NRyC8HZoENuf(&_hQKBrZVGyePvuv!RZp zq-WXt1pK-QDD~)2m&1Y+t=c`Ux%eA6Y^C7vwa-N?e?cf%uS-fjbknK|v#gJF0ijd$ zh#pr(aEz58&UL8VN3C(MJj{~p8o?e@RE(4LxD~$DRi5McQVdjy^g4bqQSJKn%tkMb z3W?R=&;#$T%C;D16&VxiQcVVg(*($&EA7OUsy6oM5#9zdP|BPCc1hY7C z7N-LA)RzPNTGp)-SVC#dORMxihSb)*BLeIp>D~aX5bF%_my`}oE#?80cFWx+MJ=~Q zG|eac>O8L7;Wp9b^$bNgdRtQR?J@32tj1ao!yf&w7UESjt0PKLz5+mOANE`I;^earmyF_M!=~h3xnH=d-u# z=jF3E*WXWXOhO^XF}2Yx?e89?sd9`%zn3e*)N zf|mkhdYJDWz1AH3TU=@o4e*_di_1U{q>MsANL#-D)Y<>O$pb6Hy7P`?WBF%F{d;4` zj&?;zaM0{}l_cKCc9hLki8=XGP=8cu&hN97rk<~k7Zy6F`X!%_R`(rzEG)bcXnCF_ zVN#zg22xw>PvpW=`Q=kjZ29Ac34U!XJ|-@jr#FgFPQRDh6lW@eBsHMZ1H~mKwik&#-wGc%0}_ zbh;sD1MbK`UVKW+9k`dmxQju_Vp#yZjLizeF9sbsI!GZRefqd49uVmPfi_1S!${P#)q6PlD*bBY|24y>Dsg>;j zq!?dS-FZ~8HO_oufnC(9-vmlFvnA)T3YGXn(e5L7uGKqJ&<#~k2e zN{l&Wk{4`%S4_frdH|zcCN2X@W9jlrA)GUL#RWBX%#ci2uNDIOBO?@t5()DkvF7rB zbfeR&t2-c53jJvJPPu>AcqKfNeaTVE_njNJv{PzY%||4uL<;(F4Tv|6MB>^&o$%w5 zJn$IweqM14=8f9+YJ7F)@6!BDP0qrNA6Le(nkQKO?5EsUXjfNR_(H)=c(y4#Xqyx> zFO2!lNLBROD~HUXHttKk6P#A^!hT)_eF?T8?o~r`X|$faRqMGHvoS)lKp*aJcER}F8mhgnS@$@jfvvEed9{5!J-okQ ztq44)Zt{%}S>7L$|MzV+!>(=FH@0qn6GP5(xXIt@^Vw)53hgR+HY?i6tnb8Qu%7Jc5LOY*9}#l8Y8$ zKU5PKV~Z&UVu0XBKIRF>Jp?YqENH|THw%h0p{pd~dy}?X>O#cA3z=w4OgUrrE4e1` zvo{k+ta9OxhD&hoa4 z%sH5Yy$_MRN^6>#RK!kIVv1z^P6@=ino$i{95`5nhHNDLawoDbJuK@Ab?QAzx@&uh zh{T>zw(LU1=`1Joal;$^cx_tO?2{wbiDWYKKfL`%F?P_~M+Mneqj@5K1!R@sv$`Vk zjhU(9zNPC;9SP#CG3Xnpj~#ZqO@h{D3GeVI)**;Bu!y6(Ib2msLBp(9As2$P80o2q zpKj|A%>Yaqv}GkE!_~*a_D&mN5SD7Akc6#I#?K!A zIMw)Ft$oMPM!|?1oqga5uSxHnR>8ppRsr~Ok*BF_#@=n$abP#YJjoHV4h&aI#_A)B){z+9>nAJ)_J)I@0(a1((zIc4 zSF*@<#7ME&rKK-_C++XRzDhku*RoSVJpJX=GHDf>^N-O6o(5&bn*W1FLDcxkWY8wF z_6#MW-XU+Iz5}y zajZdK5+!ae!4ycSV9DJf7B7$e4;H0gSGDjdg^|q5Qs!LXxcH|=1~f1n%u=jmfc*Jq zo&jmKU)k$g2+N2uG6PVAYmZ0Xc~YZR@%mW9gXG4FdBr?KRYDZ+#0yB>S)NDqlZb`Y z3ZuB(SZ@dtPz+eD&(M7=qLV!cTLfYU+DQ_=Le2BCd_V6epuvU4s6XQew4vwvEGH%` ztEn1LCu%jPETM<8!7VS(cTv{={MkdGFT8~_-;Zl=N=ZK=GmaZco?tLa1pj?9r6vC^ zP}f_;9VA&!SMbCz^e>Lul}x`!;M{&%`H0a=FRatn#{G>}iznc6XI*Y%iD5PmJwyF- zDj}&q09hTv2ekv8*yIZf6`ChtArKYTz@7Y`aG$x650`agi1fFCsFqWIQ7t}!0uzA* zGFIOhECXyT;dhkl*+)T27}%%`reZ#{s|K1Z#=CvDn_#{|)QsUt@5h()MVJzaU!+e8 zFdZ@%w<69KLqBtIV$cTCVET?Cwyb>>%RH3rrGTe=hVMJV`D*!0#sUsX;D{A{V4%-VXkwF$$U?FO`x-_F0eKb z8X(}Sm~ajWydNd=puP#lbCW#^fc7KMw{VJjIrbH!t5BHtmvgg2u=X4|?`kDq|21HM z&A8W4>**L$dWro$3!0BCF;`G*hV%zd6Ybh>6SxJ!6hLo1;sE_%DYJ*|Kx(qCqCcqb z6QW%@8ez=Ord(i3K|iwN#%tp2DXR?Q340pqj8<`O*9-T3`DM!byq&Uqjd%=q1(sNo z-T}lT+!&|RS$6rIy}zQzX(|-+5*`!3|NCAI9p8 zeJD$oewl1>1PedBZw7iu0c5c?>l>wuF4UAX;AM;Ljh4yw zKQaN;0UhY0JP`v|W17DtoK#@`N|GE>;=V5bzq_XrwZvk9kM zlg=lV1o)m>LR-*;S9RTYFI&Hb)f2r znVaRwHs&mwc=PprQ32`bG2HmqL%85tFip(bj`})KogWkK1C{teiuqQcR@4TFlQu?N zf82SIyk;ldP=9XciJwI?!e>Iv7gBz8Qm-SMCw5%X|C^&-xa`vWxEbx9EB4z%`>Z*} zC5`kXzZXR79a`x(-2x;joX7ux3mU-eOBxQ0s-~~2)HhW7a(kEjVszuwz0RtZN_WNa zgo6<`q(Iq`E(|_*s11YvJ;p4r)lEq`70#(#U)%xuU$h`d{=fgwf@DR{|0gVHY;II3 zUv~~P^Iukw8>nc@J`FEvwPTNTr8|GtNYtB{6{E?-ex`U=udc^N=#EJv9>e`qC1u~B z(hl}X2>$+8I#d-iVhwso+f7{7ml% zw-#eb{TIPSt8?Y*PBW$KDa9CqTkqn$5hWJg8YddGESj_((JYV$rEO9Ka<^KB|3|>1 zkpdYhJ<54CRH6CCQnB$utRkvMf{xd%ETY(~zSZhbL?)>_?tr7su4ohJ6K%t=T-i_b z5jmIfE6&&o^=>6)1DpbrLpFIH zWs2J$=^dap`MOu+KQy6l@K9RYFm*eXxeI>S|;k#PUqM|A@gA4p_?W4IS8uz>MwI%{d z^&VqGINbIbD(lJu!C!-8TJ)6{G^t+mBtLtE=r(gR4&7WUeK*0f3_~FMv>Nk)g?%?Q z=?O}K@KmDaieWn2!Mf9+ba7wMt@gfeJvjYeowAK3J21-IfioltsgcmviLB#VJ+n%> z5iNcWbXRQn#bkK_7Y>SdoAVW@IBNY$H4@Yp_9Gt=SxrefCxy>Y^fE^=R48_A4#))c zHfjP5o0n!>AXh@K4kVwgO0GG~hlMRs`{S}7R#4pVUhZrDahjzMUYNy;w{01Gjkz|v zdB0BXXMit_e9yF!E4NqxnlU65xO&J%p&~fdZif z6CxyCqX7+>Cf8Q&+aUc6>f$p)!{=Xsb$9BKfqu{J>g#T(q(H7`tH1yRKjl;KE}B?K z&^L@~BQA*Ush@b$H>7uYxoJilN11%cahEq3eq!Qqu=?Pc?*%20;J?xLt|(#`1VN$g zUh0WzBEQc*PYTTzQwf4pa9*#}R^vUb(|gRk$&9(P$2u13+{SkgU$xPxbGRJ{u4mFZ z*_1q$LOXlc5lQpJRDx>fn3+%5aijgBNT%C13os<#GnO~Y(_M1Eh>CRbMR>LDwsAA4 ztS92ISr0tQm9S?F!V~9#OO}ier;J0!m}sj~mx~op257TXMNIToC6n#8XG)O3Q5&R! zI^p$?N)@Uaq+jI?sWNHzFv0XEn2}8-kmMz~lB$X|!f}sK*ji1<6pLG59+ef?jjs2#^Fc z;b*20ywU@A2*qMT6IC>W@R_P%0Jkp4L4gMa3?TSgo6E>qyN? zl!wkj*=#!U1nJQGezWjlWD%3JmH$E_&2tO!7!h?m>MpEI*oq9-;l}!#)t9Uj-6KW| z%qBscoRl#XMUBf++X!`#YQiT8G_=3`b_M`QYH2pVx`(F-AgZRId zb>rtbW}gBys!%eb0|FH(o9n!!W}$}@3@H9CGW7u$hkRf%RTA!R5(JKywY^jQ8B#mvE|I3Nm7z|Gat z@7!^f9=?aN_)T$vDQc^ZM-)(n=XU&2;kMmkSv7999#sz0pS2w%D%X-23@>^7hZ7suN#><0HI|H9k5k#**P$8pu$+llnHA@J z#YbD?{LN(2&R*1{8z=n7=D$$C64FwA)?OLU@~mB0NvZ4>U1yL*-%y9jPG1wpS82+( zU=P|-jb_uO2d_9=PP`6w zomZk#58V?vLx;j2CNZBQ^K4%L*5pC4GUq$NyNp+&Y|x_A76_$VZ%|a{53OHMTsoR&2~40(|sYBLA0%Mj1i(HT43peFVO-N$wPFa`SuHtILVqo!yE;O^}szZ!<`JH zFIq2Aqt~V(mSuPW;%|mY-0M=Rx4qNO{AA=xvgv70_FymqSExUVk`~F!%QuUqvPz)) z7KX9zsw}*ElWPH4mmAtP?_UPkv2e_{bRxryJYscEV_|bCm=<<~NgPuA~ zQl4u^7&3Y1bcYskV1c*5%rYLZpVKfjym%r>SHMaJV5oWAHLr!koC~1z(Ya4Y=z*zd2CsrChIb8f=7SDVFG=C(T$l~>U8nZ{k%!Sch!~T0QBl`G zdHY`GRDD2HuEx-wS>}sSy)!_IBt>JAB)vs6b{jb|;?J@zCb}P_Boke3FcM$k6WJ{V zod7sci%UuDX7xPAA?%$Qf<|?KwbM|@L1q-p;N|;#%dH|kcj)b-g+J%&y)PyDCMvke z%fy`%J#9L-+REzx{zDjQvS#ZC^^E=`wZD`U1MIs4pnP@H~+bW zVa%A_%f|)9GSRs+3m8KC+gE+&-~-%{6Agt2ya#(KfX@bKBw zYY{=wWMWr@9w^B`U-ncEYNg`Zps!Z!)!LS}^IN_eq)+l4HPo3sO1*PiXh+iU3U~bP z9D};$Ad7d?*7T8-qWlj8ZifmlC0a1>oRYmN$k@SUVB!65CxH!`S@%0Sxdz41d{l<29OQ1FN7I2a3`mH^xfTrG`*O+PRt&A6(2fHYv;|D>VI}$4G%X0hJ^XMCP%q1l- zX#NV%wU)ZnU}&}R`|RgleuG)I2IZkBsF&ulTN80eWJ8fJb`@!&UNyouo` zS+7HMs>W$xRC9mb;lo9= zuHm5>&Thlszn81Hf(ZLCP!ga$AN{Mw-}G6&m%#}OGJ=q$H8Q=FGFgPF>^%uJZm8&D znH*s?mM1-S@Qp8!s-j6K1#lHDfo%UadQ1zWo5Qyo%P+xZ5_#nKemw3zx0Er@=9Bjg zT@Va+-_If}jWCF91U{gH%V+WP$%SMDu{4`2lJ;BSP&0_51DfNJ;lLmdO+7G)F>YL) z?*-}*BQH#D>0dp5qm-4u8Zkhi-m%1XOdX$u2;~CTYEc5lcwF5eer4hnWzgI_185fk zRPX|-TLUgGKqX|vsD0*fKP@w36H>je)RE^o(Qr55mUBWR3UUK+ObhHNwScgh74&;l zL;+Q2;TDM}V6oZ0ifu1h(YYoH<49blaZjfhm?!A0GW?wj7$b2uOGaKv7+}LmbbpOZ zax;)3;bL{+;T10olg<@R;m#3oNJoyKQn9y$Am0)o_V5j@1s8ZniSwS6VBNEMi-wMZ z8h%vId_$hFO+4s|%Z^7ElIB`y_&|E4@Fg~2hoT63b=@UwH;WlpzGU4Ax>@FiHb9wj zA-M*Djf6v34*mKHNZrYhaDI_Mn2?bH$lrg65$V5rbm$<5f^e<3MVdi$qQiiC6WR7nZ8iL?Q6`1Gy!&sZ=-x#D`0>53R z9J*hhd?TUU1BE58G`o{efEu{Rx=}M!Y-VFQtRFGO>=yYldDv zgI?`lVKpoc+jMswn4&Z-J_>wwCXiXx>o1JnQwNzDi>M394CN^N<`V;ulx#0l*4g$; zc(+gdS9k}Rj#l=k*diJME&rn=q2nyP@{%2Fo>3L&P4p*He^!dRt-nsmakfn0#%CNp4_FO+_nc!(N`e|8jpi~Wn6mVxd(Tzr)L0D zqi@IV{!F(fALe>(L(%v-+CT{zT?FLCh{y}1TC=N8b)XWVwjHEVL~oJbcAvL!Goe={ z?m~^o=Ys_x^QcfMN>yQzZi?L+o3-sk^N@Px$F~_qciiMqFqe{CgwzyYdfSZRsJ*YG*Yl)XZuJ5GQ+aqn8F5`xiFcLX1;X-u8RxHo|pe8RXS)Z6gGpikyrA zo7*T zd3jti!ErY|Fveq}*e_(seSrmG{{t43{0A&p-1sk8P)e#Jw_p{awP8s#`&lQE9@`(+ zSviTjM$8b)J%x6xEj#!=O3orgX@chg(D!TLxrH+P3pscXFZPA2;#KjKn13+7q;6bV zblofoG`fUf;N>EZ!t@A%z~Ob;B$7K&FkUsAdYYZxNasFE;dRGl~4mevVH-w)Rcb0Pthyxz&&T=pk~k z(~&{NI(`CtdIKBSk98H}tmL)1uUVITZADNlssXTRn$`>B^!x%D0_xE)Y2`?2(JV-3 z2+R+@P=-fhqp}K8i6S(}AL7w&9*;+;qe|e=IpoFZ<~?w_e*<~Mdek0(Nm|=dZ<*%$ zF~1mSZUHYQ9WtVjEyi;@LN2+YdCM`g+xjK@ABL zZjQ^p-HIt)XaXyCNQ8CyLL$NhbU-nF=nf@(waNKWkM2&NHXxQTB;7-2_!@gY>PM?~+*l2Y^Tc$p0VwL#nz(Vt{)!7W5L; z4>Cw{#q%4E(Ou?`VQbH(JtZfTNI%r|Q7O20o&#ldefzd#?|Avayp(!)8S6bszd$uw z$c{nO3D(vh*I$f74D8QFwmEHuVf#wn-j@64GhQbgvO-N`GxiD*jYprJ68X z-h6c6J$IXEo=5g<>K?5?mk0SVwnGjQtaFK$#sB-ys3<6G{``}DwNp0a1)gYTnmSmS z6je07LRNZcRi@K@Lwcvty}Ey{`hf6Gf{FXwFmmc4Pgaw*+2SjYfQRHc<98eQTUUh znhyyUH6u2ZIZ`X&cEZ&`lj*1tzDk8j~th!$1VmIpVA&uYzF0COu00t@z z{rQ4kpZp{NvP{mDNmR;5ivLrDO z3ioKPvdu+dC#twJjMw~z7OpE|k-R}GjO0KmY)W_Chk;slCuWRf=lju__6aBZ6pD8r zTQM@IV<&+~_2P3{a(1(jqpt}y|LADBlX4MxI06i|=rgN0%U_Y1lN04v1-GKtik!@1 z2M$uL!e#wEzE4odC@h*R2gH-6FzCcH7mCJ5>W+z2Ev zB7xb(f0=U^$>~)tQF4`;pC|3=W#hQrVaGQ5dLh96((!I7|rW=k3{ zoJ$rW{QBt#PedW?edk6w`9>XjqH@a{d{kbykwoZR)|kPkECwC48pmOhdO_co?KE%9 zlGSS&%Y#&ojT8(`S*-fgmI)6D2^3Ui{z(N?qekHn)V`eq|~d$ z@bx+Lkch(#p+>r`7igL$4udDk`WqFs$*esQS>V+B;QNMRM~YsdymEoWu^>bx1U2?f zJ)uH~azO;KsINfPGLbe0MwCbf;vq`-!1~}6_C;(!8z%He(})8 zkMds+Ct6@g4-uU&Q8(ob*}re!&K-M^v%Oz$_HWJ5<2JiIJfF`;*#q>tyuGg@ZZ6a? zZL_^)SL`5sh3)6jygnYZhWWhx)bw1tSAd9Kc|np>4lyWkwhXcZhOr`CE>%!id706I zFq|Xe?3_TP@|Kw7h%buHcPS!O%rcChPDehe?pUlV`t9Amo2A_Hm03zo>%N+Ixu^Lv zfI5vO6@>Xszd5A33)3Vt$dcaNgJldpb%gOi5yiFMYf!Kh)Eo%JNsy+zZiU_X3&$+x zF4{T~g6r<@K4SD=6YTZq%*CnfMh{?$WcU6`qMj?R?4m;VC;vMP1aR-b9)O2ieD+Er zdTH)qjK=fQQ}DgF``{??Sxeg{DmqFoI_ga;Ev?w%8l?p~2J~psK)kqoq2^m6%CeUOr)E6h|0iAFk-yr z*e(N!To`j|Sv^Yp227F=%hAXS;a(JyprQ(>K##A|;Vu6dKetyA{dzqZ%>#0*G%lWajswBz_VHO%o64qYC;)~ zVHAY*-yuI@~vTtmqpzydS<%y2{bs1NdCO$eOIV+3ko;r|f3Hjahi?$F`A z)+dcaM3fnfTrW@ewl|7OVf;3J(NbHL!ib|GzoyPh9?_Kbw}ok*fY4@aCB45Esl=0uCSQBFX_;c#r$M~J9)lW5U%IlL=m1G zbMKqz%Dn`a-0?+$L$cfKGD4}k7{hE*9-jVXW zAp5?TcGay>^Yen~4F_#%YV5$tGC5D1TRw+3n4!b6>Z@ffzJJteOL=a<-j6BO+5J-2@0NMCP@KJlIT_P9+4#3sr}g2M9;lZgf1+`|e-Gi31leWWER(|}u}4cT zITDOf6_d}Blg?#<;e}`{e&x6KMyX>eiyb3w%x87X~*AM4Ruq>0!P~`$VGcnWq=8u zMi3HS`HkL6SYt`{It&vFb%f0TnO~0^wdls3;5TOiHc zrX;NA{1)6^p;(~0UpW7QuVz#Fq7m5QEIV%htpM0qZak^Vsyd*B)KwYDTMU3(T=R*~ zTc~v(om>?}QY7+LLj2LmxTXhTR&~Om7RuTfoO)-09V<7`o2%*!t=|}?r?hf?03joa zX-l0D)sW77MLlr)Kp&8fMpYpDOFV8GjxLtcwAUIvhISn2299x_Fhzfl=ds@VRC|dK z1=!oI7Be$eb#ZWg%u#u{hUlMeA7oN;O~Q%UDvj$yiwE_U@-jNoTmLs2$V3mTS%d=@ z3GYXphEAoqVl0<4)rHrC%yRHt*5PmArabtq$|H#!ZX5=1w^u~c2J|N_p&daJDb6Xo z3MuVI>4tJs9$W%#`VM59PPOA;O#o`6t#ej4=z+ObeG~PN9$SNKk&pq}?dnINvH;9u?wP$di9!{u zTaML6?I{=l%%oK2@{f-XpK+WXy=NxK-s9{D25cTi>(7%`Y&-m#(E|wZU#~~J9?iRq z;#XXY1w7?BvTED{zaQMEt-akGsswNd{a;t3F%T?BhGLlvV7+#ibikI`Nc=c)1~iwC zt&M*!Fog?s56X?(@H?O*SQNjunlHcXw3}u(u64&xby<)A-S7*f?|UH*6qb|*;DS6b zmaBc1l>~zPiQ&i;_yuU$^$4gNoH<|!q^VX-_TajyWMgYolIexWC8EP^K;tsD_}hvg zvXZ5vkzXdMmFZx{pQfx%qfM*Do!WAJ;COQ!1I-7cmtG1UEKd_CgmJ&(fJzOE7VR6G z-qi56XN#IWkKq!bn)pV9ls*vU>7uyDN$6O&<;ny?6cB}w6qK7c-o2Wg zjzxN2R;6rDS#j-L+P!t4p1eyy4v=e9pd*K2#~Dy?ayJuG6FEpUki?i702*V=lYLFw z>Wa^GG(6!cpH;ZtmG>ye{UK@nwlWnUv{DZ|Wh=YO-Tp_?hJ;x8hh7cVRP;TVb=Lrh zbvVu=4($`xpu5aYsq!cb3A|Hk_7#5TijNdF(w=(DozoI&O+<5-u#h*hH-oJM4^DIx zt)7%5l?Sg6>Mt%p2>)3nGY9_6OqDMqbq9 zeyq2ZlP5kM-ww5T)O`E;Jf$+kvTHte^8MQ`Zvo%H$EQ;>aij8AVYijdTj++Fix5CJ zgnPjxfPrK~W_YIHmLG%qgK;OvH7LTwORCW^VqZh9x2E0IP=YN_;MA5m0lUPyf9~?> z(bt67HgMd$hU_xD_gU7(uusg8&Er{_B`BWPVUb zUgedExn1vkLe^({O{}ugM2QxZ?tQerE0)vhL< z%%Vw_>S@dulV)#9as|VV+s~N?q0ie;2v%AyBA91C9!W|qF^rn?FXc&#Qm9tE7)a>6 z&2C8(@&TY&y4%NPtiS%mdB64rSeRhJrKW)6a^j#h!!EIqk6GBcX-U|8DxqIQb*&Z* z!192^Bd~x&;{KB#p9w#As=6 zZ$TtyiE^-3z`(MSSE$79a|}#~WkyzOo`e;pCd*Sz3zffze-K+n{uYrhqcffTNrSyeQ~#7B z7yr_KpK?+$+J&Y*8G(FmfKWjQbc&k5ifpPE^<$BRe@zs1gc8AY{*S^YmT42dsFF!a z*ju2HAb;}bpu+2eO9AuZoo^N-Q`uFjF~*(iaO_%35#?8Gzl)%?vDOf^aC9y&P$q~lZvZJJB+OQn_b7T{W z_U(mv7aj|rdL!=ymF?MJ`QARpxTV4{53~ZK?TufZY^uNQf#Q{vj`+! zxJ=wKys*r>S^+zO;X*U9FJNDjh`~k@%tfJ^#kuDP53bLBN(0#^Q4w@SMxcGqS)~C1 zp;>#uc8huv0N0;xd8M}Ok1Qo0Ff*zgFJo^H4nZ~243ELgyo0vMc*5}rZ5gt$ni*q2 zh*0LBT{rq$={L&l;UltzE~AeqXmmGBvi=UO5Tg~A@7p`$jj5)N~- z9}H@2u&iqaG~<73yfj3eZxbNbAGw?u5Mop&>)x~~tLO$cgs%cQT=n9(rU_7P#)tC| zNfpyY7*7v)843}2x#0e=juaTkA6LVQ#Wu-Uk8c0#Rv1m*egi^p@#EEoFR}1)Hn7p@ zGNcS*Z&LK%=yjH6FU1Narz~SQ-x4HUmp=Sj@CC-XCCO9v8l$A^-p@;x<`Ez`KsD6& zpH-O3`98hC`>Q3~Q{;xPyBX5ms=8bm0__Rt&m&czhmO6$Q26}=&|Jh_~~i8V{<>?HTf}XsSR6r zq?RcyG$m=+rt3PGyS3(1pxHEPsyGxl1Fdp1JLH^AdYfa@_FvX#=CO^NUu4yc=0vgS zLP)PiGl1xdM*;-!u1%U>S_jH4n|*T%{tPfc%2a4_ zc5i+U9rke5&V0GHe(hHyxv|;LN^XUcZ|A^|);F?(Iw>qkurUC4LpCTaMNI4F>-?i* zCdvNzBv@|5W0V(+BW%UsQ->H!y374_kkW&$ zq}P;`^1I4)va0NSdIpwW8!Jt6BY3NyL2o-7kX03{K}OSBX3p1(?4KzgBhXaIPxb>6Qa!>HN_6OV16A! zuF0R7sj09Wk{^T>nnhbjGHPsEeXwnC1YGbi1;D47Vie)^VMx-A` z>0>T1#2bDN5IOVSe7I;H1HYDA;K( zY;aRmGcz98gYlKN^bq(;R|oLH!6?D^GOCgyM=e_o3awo60c)!(rcuvZ--^(Y)u!Yx zxz?F%yJqjYVT33};fe2sLu&|YA+jTiB&8?jGU?Yhu3BuynpaeKWd{%SF{ zoRG?OP<6>Y^T;VG>cINKwdG z@VV@8eNvj7Xq8&;C)7e=Jgkt~L~iY6t3#SOquheEcyuck`+{w@ul)qzIZf!ovHH`{eyw;pfbmnkX*ZUlzCOcgTE=rcuzIB zt8uY;wOFww-+YwtcX#I!Rgj{HCB-}^Wr)wsAlwhZN;M# zgpbq#P2B3tSVIDG%Owfk8^x6wOGcDR+xGCT<_dMV+`xYfR$=qn>tDF!4e(SP=ZENW zmv8g6{k%n4&|)>?8A3lj4}*=YLwMYedfGEo3EMqH{O7PmGO(@n&^kU|-snSaKybA2 zYnWkYCzjNs6E)^$;?TMGG!!~EsTf9UsYcN;gDOKREx%Zzjy0rMEE@9B4@C>(b1{L4 zT8QNIUdT{245$|;RVUgJ`g0F3Ov%17plS5aM3)<8xx;idOsF(hDs4`WRM_?8q5F)@ zss-W*-ypi*uRQD;(uVNop+v zLCJ-^qh&<2rpUio!{|Jj=2=)EB?Nw*%Mgyy7fxt~wTCsqZPAYZY>uE7ucy+s1^$m} z{Z);5ql@SLkjp7l&u!P>jn`kOnDh2j3?g{Ky4teVWVjR!GU-ZBVKu<;tK3BXoDpYJ zN@;W3M{8X^32%~TW5ylDZhZ$|M(19)v)`PA2wiI#@;eL(ui8J|vdoH;qP%}GrY1pFp_KGma)W}e8MO~|L%A=0vJA)cf^CCPwJevl#mYJ7DhxIyM=J1MGalgU4OW!)`{BnJYe@R z$VDA< zlJK<}9MO0B%L>z_JZ(z*3oQ1j#yC5-&5bzQuT>J#9ixU34Ocuw{Ycx@;G&?S>B2~0 zJcgviu`3!xwYHM#-0>Ef4?fAtM!h!2JSTTBXt6DZ^z9^Txgkw$)ydV`Hbts3*NBhe zLpkRt;lU2NDz!6i$w~G^+G$kCnFCf6GoASoon|&PwuVL5 zl89*uIqTUbnN1=gEZDK4NjMnZd4pdL*p{bKEiT&TE#u6h)y(3;q={MiKoW1VF zyPT%+9&t;1T^9%%wkmgp5qtz|T59{np^CXxS3H0sLZ)pY!Mf&>?I_g`^$BE5$Z0%h zA9GQj%c9F#<;lSk!<<_(OL^MKLCDe+>G-QO+nJ~9Dh3HWn|pdoFXfaQtlKQBr!>Qm zk6Y3@HRqv`zW1WR%@eoopL4zRq)=gWRs97Y3gk#Zebs^v*XhBzBb}LKPf3h*TQGC4 zbd!b4r4o)8NndCgO=?>>5_p1}6YZpAPt$%btDDnK<`vzdlSUOepL%#W>m*;Oj25K_ zW%Wt8dtx&2nlwk_?>G9t4yd7D_^pY_<_x>6(&;US6NQv+J)0;&-tIaf+AlgV?**&7qK*-FUfOPAnAFNgR+xX8e zXKBh~5-+BwB4&F(KBl`5Cr^RK3WN(A^10K*AFVGrpu*hgbss>nIMH!N)D-X4ncsjC6g zI|lW`*?Ny9zVVrSd5y(WL`S%E^t-;e4;6gin`d3g=MUFS?}>1ZL?>MO__V#p(sH32>N z7jom&A_z8+0>ZRB-5J)G0@=_)5g5OJj-3c9|q&O4n7s$D>yFO)tPG7tsa2RY&kInV<+*bO<+Lj?g12ze$n%Sf8f|)pXCmtijj;^5X7_ogEzH{{*h$$N%l14)w+3CrpK2-g<2B6i-b3B&`eAhgV&kA%+hZzKrZ8N|`Q~bOve$3YG>$%`vH~tG8mWAN_ z9OUD%;h3Cyr=;PIYq*Yg6XKm$H0I%k;iNR8@HOEh(+D{U=HfftKk(eoWx~3%hcZI0 z1boCEoAtr<4{?vZpDg2tD$Zvab*4EE8Tpk)Fv_(`2iN;<`QxjF!(5&VUCy=jT>9?2 z-s_($lR2a#gfoZ^Q8~G8w|qCys_1fwpS4B=5-JzeFcmG;{{O%?bqo>|bDgk@nZ^=U zI3s5WtpPbLp^Sa4$%?ZSVkX?IlcF%c3KD!c_$@2A_1ghnH2HVe8#m$Kt6rveBK< z4wynz`(yX+mR}(5jSi2<4w*Ysd%?3UVIJEIGDMU4xXrKL!vEG?3N=@Jv zZh2lZd;?(8VHf(hf3pf$6$(lzuk{UtyWzBZUHA8>Q9mD3P2ZK7a?^?jnoh9WR?yHf z^k+7djijypwe5%voP4v1tO@EU5FrY(fOU@e_lmcT#75(;Pjq_H@Flnd6X~b#+Bo+1?sRauo#G5j{F9ztr_~f{reWOoxqqbx?v`-V{DY_D zul}||gkUl0V%Ejj+>gt}&~%aOrEZCPKPez%n9j&?ckK zVMdf|Aq@d}wb7h*LJ8yqtlw~6gIqKY6Qw}uQBDn^VyGd4&#bq>ssR**w@WUX*YV(0 zrS+>5Y}oy{lp2|F%*`Ca{Du*ODdcOLi;*Rt^VQg9Ln4)q5OQ}KR2I`Lz{XO(PODY- zM=fYWb*j=P7G$rHRjmcG$Ad;Nj`uSxuYY^O;STwUnj)SrpHMTt!`|V zj(1|?!GyWzwB!xB`lgf4byY=M#wWG)o!Yowv&xEsJ#-QJm9zA6k+Z57J4C(L{cC(x z2WmA7w0~t>MDOqYuMf%^NG7EXpBI^J5mln9gA^b(I9IosI!*f-5d^uXJhBEUKv>GR zFU=xh%XWgA=?oz(oYtO|k{EZOpLgg1Yxa(0+zl7ndw{-kKlIWoDD21|CM#-Qd(;?0 zg&(n%W}|ic!4}h)M-cJWDLbB%l`dZIKe1JpR>5?7Xxo?%*{9e zT&7iOrfhq@$X<^{TTmO3t^uS1JDM{?qNvn)aK}Mfz2%=R#!eX&8s-ufWWN0VWlA@? zMIJ9<^X#Cp1d!ZF1A5NUS~twpdzrpb)RW=d2(OynLKa;inEHoJl7)?BBf~VGSEnjX z=XmsyYQ`C`YWgoaDF&B#!#>4Wj_{T6CKhvIH9q!ZVR@EX8BAt9q0g(j?%#{dL22~-oQc(AaO(h1y}+mD{YwH-ugdB?t8b4$ zqPe0WA7M3T*B^wZXd}MQs_(No)T%xD%4+Vl6rW1mv}E=!QPWFJ1B*y_f7@E855|tc zSOD@u(Luncrl`-Q=d)RTUMJsuQ^$;9MdF^a1TE%MR?!M9z=yG5@$=4b6yyEYJ-|v} z!Sw^ZU_76M-m4@2=x#!6EW9A%AH2~hv#R7I0P~k+NjVR^B;}*^9Gisz5?=TcO2E{D zt3eNEr=-fQi`N851Eu_JGdD^3ToP#pb13FaN^ZH|t!+?(v@8TH1gyS$Su5}^Gk14u zBx2R3vg-e;_S`8dYksWARiYyt?Ij~+l>|u+dEG?EurvEr?*0zgz4NP^&ka!Q8$_NA+d#T&JJn0@= z9qQ$X3JIg1zBcM87fu&Dg0(a_50sHbucPk>5Zwt~3Li5g6jzeN6cx@qN#yKJbAIgq zV7mEp59ZHf@j3`{l_Y4yn~IP%s<^w1Rh-|ln6{Hk|MAwBVO3+O=+nh49E)XE+V%}Pfz_!A4vnG{c!C49A zwK)xtL|LQWu1#a^M>rHL^TdqHS9$@@0yJ_Ic{&*0iwllg)c@{spFsk(uItMB;ZcXSnA)MdvZ9^2d zTJ5dR^Op`vcx!99D@faDr?YyEN}GI^@Xn*peKK78RniqO6www0*~B(}TnC*J1emmc zCrnvceZ2?0TpQH*C@@Mse@+8`-k9D`u*>|j6G^+I zqA_6Z!hit@EeclHC0T|SDz8%Kb0P!22U3mH6z-V+@K*OqYNtjR4`)Lem1+T?6xfR1 z(k?9nA<^wjBR(wyhIT-Q(yXG{d7u3bg`ulp4E-{~pO9q>fp)>j=}sL@Cbxg{yXv7^ zs;ZYh1})4xc8IzHo_f!TW}5xDX<5ODWX=5<$9JVueUhjb#*I1kLXa z#3Q06be39XXj-vS5PX_pR`~lMDDF8`Ps$DzsvPE+-H)AyRpy#i7InDNE$_qzLpjYZZF(JStw6Jxdy(P}?kFNzQx zIGMtdsm)ufOlzNG%tbZI3E$~2<08cGx5hk1mZ%+LX--4a)OxFgkD4kaHB)Vh1?%?6 zXh*NQlA*Sakk7&N5%H+ebypR*DLhsGR0gQEK2<`jX4*pC6Us(me(+XdM-{3Qy|2dc zDkKKI?!8AD^*TVOxmBo0wP`c5g_%a0E;F)hvq73EjpaILB6KW{?D7MIPuv;;HOB42 zzt>VLGrZnq*L6D*BxABWPGiB6nli1pqa3A$2C7$H3!CST%}Nzm@{6jd&3ce=-m8gL zN2-n4PxQ z;B2Pf03v>0Pni+6L-UBc9T{iPUN3FYj=Z^6rS}SZaJ8mQ5k~HuO*@w5GjdChlQ3^Mgb1PKw;N1Y&59r1T{?_j#U)>sgk_-y29rZ=tJ+PC8k?i`$`NT z3k@8Q$4UM?T^4j@)^n~2OBJRroNCdvxROe3uM;}=TJP=?IrROJkqGWU7gK}48fN$m zoGJY(YpapX0GMaEza+96fx-Rk5W&bh=G-?Ijjor7$iY$OlW3h;TA6yUKYFWzjTUQM zF!GPy8m05yppRZh(a;xmU;dScQAbgN@aGDk;LFQg(WQ~Y1Hatqkb~X(uldF#!I5_|~i6jGb%V zR}$TT{LkRadd;j#tumau73I1UM6^8$p2+Bu6)UP^$o=FeSAW!1w>Xw_U|10iV2yn#BSpJyIZYwNFE zpWcaLuLy($!9viA!2hXvG^8}JN_C4GM_osAR_zreVVZ+ zG4>;=gEgv=$v=KRVdR|s>h^a0W}#e0pJ`LQ3evpi5edVJ>0urjmUx7(g@zhR5Eiv7 z^Q6}nxME*Rf6V8~1@PLFoRsMoK;PGpyYQaU&oW4j3|DI11HnnW2eFhNE!D_m9U0?5 zRcW;t^oYuQEf>%@d&wV1z%C;voIIEwuM%2i7eEnY8%-0{`EFKYbwe{? zMm#oWkSbddA3%nTL0i`j30D~P`N56#HoF3;2U} z$ra+nQ-T+EgEZA0G2Ci`~zO<_Frs=!40afIc3?!0$T*M%zYBCg^q zA{X(g&*ZpXYz(_F#yQn&g_l9USt5L~;+iVCjHrzJ$G#p(u1x8p2MbBWgN`6|14 zpIF9QizZpb$H*E7h;As-8r2Hh-XNr*!!uY#y@v6}voIMW3f>3d+HJ1HG(BIm23PrZ z3aHYw3W*it=gYRNft%Mz@W9BHaDFu@DltrgQmvLYwlR z?-5)J@X;mU=v=);zjAMk)usJ?3oB<0BO=dzPJkY&62HBI4kc1iFLM{_izcKt3c<4& z4~ueO!h{lD&e_f)x+h1<(={0)yB!hmsqz(Vx$_4?*F$4p{A1HCXs3$z$8Rl=+)y18l(6PKubKMdIAhBSY6x!$IJG_~W{ixQ zrX0f)`smUtqL@Bi0B?R^tW>bg=7>qdsNAE8MYqbGw)yBHFG64IjCghD&Xl;~2SxaM zc^7g6gkaJXK`@p7?MO&vWw`x4>k*udh6Zbqf42K8`-;4WI^+5qH?qI9x={57OovyQ zyb_dxdBsNJ4nGr=LtNPG^OLNT&0|_*s0*81?3bcew5Ju9lJ%bHEErM`7LkXtT@!54 z$)BVV__Tuq@;cjubrIVcXTIn0d(r78j-pcjBEqDQZ!_D# zwM%auc0rD3G5F@(9kgOSB?(w7VQJ|RV>MDeT20fzI5$^IV-t&C2JO%V(JV|J{^i8N z=UWNAY5#(RtO@ho4|^{CVz_`i^*f1Xb#hwM@VVnx>9*wOcevt5>2!0nSspz%ja^fP zx;P8Ur!URA3XNmky5xYkSl%G_p^<#rmlAs7y|7DV%?jT_y7rHyBtXwssp;U^@$f!r!mjNPka~Pvee&=QmH}9W z`r+d-ZDnU%y3suyIm&*TCR(NsVk=LoAh!%7EFq7JTwy==Oj-W+;0$iFA8t2NZT;Wz z1GPp%Tzkh^-bk>%{0OdGMFa17B-p+uE}|jdtn+*Ea{F=r-?-so4|CxkEpz-Cwf}c^ z{g(f~x%SUIdylIVc*(^T^x^C91Y*tat0Q|bEZvk_nhB7C)-u4Xww!@!^$UlN!WA&y zrs7P5Ks~J9?)eJm(mvb>YnI8%C`CPPrAAaFt=_Ms!fY<(j;w^B>}*z_eG@G@>7E;_J!TC+QnKr0XZ4au58BuMDXSF*AZ)d7 z06(l-O4GaJ41>@Ag#3Xg0r zLiAeK;@7BcCGNjuTD(1Cc9tsavGU1W8AP*$1EX+@$3C9b$w=uNe-nqnPn=L#F2_v zQNw6^Z05O}t!Kxa+Rbi}U2ZMP;}F*wRXes1MgSi+!4&|jL2 zEvaWazjgqV7qwQ;sH!Wo?j@_o83e!8rT+osQGce_x*m!14k)U^`gIXdp(A5F00{+b z2sVpFGgfv8T}{0NF`$+Bv?ra`a1o6Z%@1)hv@+2SSG1Pw;n!e0sWaC6d#nkLju39D z;rCQwZ|uiuHX-UTsf2vwVqVls3r#-b(~sdg`Xx=o3Hg0BsKDm_A-M zb(HYbL6-r|rBnlIgqe$#!(*7zw5zHfn&n2&5O7;KUpi8nM+z~6c;-v zLTu^X!I@L@fO!5xT4N^=y_gtQhJ=JvNAs0ar3EX@tS!Ji7&UuVo^HTtj(d@=6*TOa z1@#AVO-=?NMn##K)EJ|zl(_h^2mIB1S^t4tPuTwlxz^BLA5e?bBRZnIV0Bdg`?0*I%k~Ec{8iMp=WHsKL&P&d?ATqh;F8l@NJou<8(|j^b(#8Fw)O?~koC zjKRg_*G+@xFDu43S*aSCZJiytjkkL0CDQ1;*JW>bhLMuYMp1}hvN|)K6Z5dW~*eV}|;9$A;e=HnK!7H^o z>cIS}|KQwEw}t*giwKggRi6jHXHipEj7kJzKKv^nkh#_8^SyKUMey}9qG!SLAL1Gi z!TpP3PMfl$W(U=^%lW(!bE)#JRC=xdf_NFPmJWem><4iTVms+&++$wE4pN}eIXjif zcaN^1v{_Bmll>xYSsFQH&{i4`$oF$<WXNTvO)bgK`#+$5rl-Xkf7Zvm8$DvPDJEILq=~s@^QMO%U7OfE z!K_bJ66_$Yy~K=5(_2d13;Z^pgmEs%M!`D!$~Ge!;D5k_^WqkC3=;O6CA)jBs~#)O zyan<~=Og!LF`(KiO=A%c{8^!p!Mipq#40)gUZR!`lrKRiEa~9dO`TAowzceQOd!HP zHG@9`i^oD*wb+czmwA$mFrfe(v7vyDL^=;2Ig`8^$ds{$!ns%H1~cihyK0(V^H94g zS`3(F1PF$IlRJwgtzP8~<$;b9>~KWAre14hrc&y!E@@VcpudA*da{r^yqU2D$HP;j zUN#omib+2(6Lr;am+@L)!_UXQR_1cHx_mhHbOT!ZrTO$N?~8t&km_eGn~Kp`4$|qL z5_QmG)utZ#dC)@K@t6%Pk)e6u-@@oTbi<0-ki^X{E!ENvbqW8q`XAxSZLxybyz@W8 zbuthp%hS59;V{oH8t1Oycnl5vC;RQu#7MG3##0IKZ0MWXq|h--xhA8t(*>(g(fi=X zq-qdedgnz%4Z8UJ6f?aB99lN`^(b0j$GZ^w_24MZ{j4y+0p&01Xq=lU5kIDPSqw=5 z`*K9)mmjh_VS^@eZ_xw+-uGd|0A05-JMaWthWJeynFU?0O&ItyF98@`&i#Q=X_+5X zw{f&qQbT(3PqvU!KmPQcj%JmyjQtf- z>k7uy5W~9~1K#b|XCxJygU7fj*U0bPf+>eOL+69AsvkCG4z3jHg@{d;YJx4Ji!v#Z zdGn|nNrl_p)w($M)r3h288cimt0cpM9it;_D(Ngf34B%6#YLUQt7E~5+};>9sZFME zP}9)ZznP#za zQ!3w!JJ-5bh<=?g;PUfx{SLqiOn*Z5FE<(&ONXKx&Xbg*V5w9s)c|rw5&BBdbiu$} zC|yI!12F#quB2YAhU4txkSWZKw}g4xlilXc6(b{&(v+((4vSh!B+@5krpq^a(^-Y^ zVpCXBVf%S#hd95RFDa{pvg-E-LxD44fGt#>4;#K}< zTBnAm!9zhq#vd)ynhBB*TBuqS8#st4800 zw<(t~C*brB7$0Ay<$(ng<8&lze6B-TaN}T!Y9XWSE$ip3TlUa}P1yu%5rs4X64BmM zUCY6%El94z`bI!;G|}G<8Ay?tDdo)&Ug|{A!ESK6<0?^s^$Cx zC3`1z;IQ=+rGeI2)(BEs3ijiRK)!@Z)Rg;ygTG7(*8U)1eNZ$WEfPrqm2}-uH!y&{ zd=kACJYt>R+mo(Hhy9aCjM@LCli+zX6%x)Pb+Hk8P>#>~AoYZFE7>aUNYpLt61>T^ z=Ob(j+KWCnMcTf$s8xaCk=NxyqDMHyPtbs)ueoju6}JgbJUkJ~F+R?Vom}@(X>btINGyJgV%L|V6 zXffsvw2^A6qdggAVTpF+R4ZPH$!vf)Eeq9-%)jAewkrUhs1mUv6i#Fs=Ap5!$vCs^{7W-Y z*jf)r3ANf@Y$3yRZpR=aSHm%@_JvJrkyx~`vh8om5nai#SmAS@JNkc$>z*9&V-H=E z(N$qh;09zv6ROK%k^{T@c-|BZ99Q)27xcd+OlYou*ZG`x^#fbN(ev z_AQEu1C?ymX~j5kXQmbC=m93*j!_xiO7xFS=mAE#kvO-UUj z=1$ELBj$lvc`r)pNGb%0Zh9*650^U@$?H-=-l-7&=eR-wQzzIm%A?-yL@uF3VW3H; z?!wrocoW|igH&3lPzl7T4y#{_WpmGUP~bzJsp8h9cpIbCkNej(g-{qK`#o68G9K-X zubJ+W*dVxHk7N?&P(O+usDUdl_rnXds|AVjoTv-Es1^F!7wUrl)dW}G73(@11;A)5 z+Aq;y)Tt5vN4etcQYW0nDmEZNKoM@g!?er8rGdDq6t9$MtCsqv31A?h&QfdiN zYj4)%VC^O&%FxEc>CaYxs?=pmrek}T`Q|OzoK=y`%(YNOqo%+$+o50vX81NL+ zG7P-x$bzV!!gT_nWJvrY6J!D>gJJv-Fot`&p8MKsX~yk&_CI-HyZk~oWl$th(fqy# zZ3Fquv%_{~YSD1@GYxOxVEKmGA^jHU{ zN9wwzuHyWox%vmPx3u=%(R$k4gO8u)9Hla&uvdiK)sWxQo!$Q*vhFE5vaSsjb!;aU z+qP}nwrzK8JL%ZA-LY+V)UoZHeE;72>Woo!v1-;DbysW77tebyqs-(4v&<`*j#@IS z6Ib3@tVJ)XHaAI~?B5a|QyHj!c$YnsJjwL+{YqxYIsPrVUPvHO{h3cV&%62(>upkr zF{Nh6?c1_jc3M)b?tkV(eBUxPT^_lNyr`1hO~0w=*uE6s}9N6ynJE zEv-Ld$#1$7E8TbK&i-u0XUT z2tMBrzcR4v&pDBQ@2qCc_k&_QZcXuuOs;6WyXUW);LjH%!B^dT(lA7x^DhE-{gH2U zf5fu2+)c)Rf=Pdp?sL`&5^TRMXL$sm%mOW%-;=gUT%EGqxjzgUCO=|1W0o%0AmqU| z#WsTa(}H4&rc=Es#tK0VJs6I-q_ zC`HI~U12GPWoHtKmsdHZZ$Rbop8qYW`9MOu78pOwikY;(G*i!LuYE-|KGx02|HvHZ z3)rmssT1p_$aBw8Y9sxRbR{-s=Sxq~^8daGGDoD3^ND-p3~68Aswbn5uol=9@j^d? zxdy{BRS%gFVsxrjPoWNQbi{>)RR*C%#~odg{~=wOZK3_sAJ2r6M^!^hmC=WSj=BDX zSxP21!D!2E5zV5%0f1GBj3-PVCyN1nj&LkW6;pNmuS7(fxn?zud_!CQ`y|8kG?==$>|f$TSr*5^C14# zOB+P;>cyB>KP_RgV3BCy+z5K9OVg~Y&V%d%ZbK$Dl*g1j02Xk&Oh|Z*X#v}K#iRhb zoK8FD>4c^pKa>86TM|J|g=EcO@aV*!|&M;ohE*6Ytk5_x|@1 z;u}?m|25m7HrSvR{LZBh7mqQRbNs(OT)3b6|MqZkKbNk&d40o-8G1w|3~@>6v}R&< z`M|2n(NTAf!W>y!(Mf(p%RDPy`rW=^SZMnJL3bF6*<3Z$vhp)94r^`tsWI#Mxug~v zw4)&t&>^4%NoCF{F9;6r58lI#Nu=E=Ys?9`9KB3QvGcqrpA&PCntbDRTxU9t5lceJflfu zKl&4h-zvND;j;8J8%IggV-lXv4T*!quO!lvuEqV&bycx5y>!()Emx zQ+pci zxAvAt0+j23{r_&O`@{vldCScL*#)PbVQjfnTMcyBRN&KrWk|G@*7#6{6;1p{3hOc< zE0NJJf)4EhV1H&MhA_t=*J&#|{N>re=Ti;EDp&(xa%^)jOB)&B@6m0HqJo!Z*w0r5|jq}=JFmF zU)KXJW}dbu#%QcWr`E3QCr@2iYgBR_9I2!T0*JDssNXeF` z!~7KO3!F}e=7k21m=$~+)MHo@QIH(u&TAwK70bp;7t4>)qWS5_lc*t~R3igA?XaKHaC0$r=e6_UOsCr}6Hrznl`Ja^R)6HG&6S$Fe7 z>Iu(Ef2IbOVNFoMS7;XC@a|4|GD6!Dl#eL+oV2_oR`sVN)+qvE3B-z6bXT@01ixmANnCNnLvysW_8Nd0>+^Gshz3xTELWAm%1qK#w2;j*m@ff)e zZjvs{QB#VMhOzIERG!TUL z`M-y49}fBC&ekQ5{)1g#eqh%X0!N>J&AJGe{O=sa5UN#vS(p5eR}k5OeufWIVo z_n-Pv&cPF6PG4ysHOP0(1!Q_z3<$P?7~STG!2ic}rOV1rQ~0mAT&TbNx4>2ES5u!} zQMoj#ji6e^a0BRwOWRyadabs5k4H5!4I^5Wm!vw9e(50Y<%0kglFmAwBxBU^>0GDD zcGeD))VS%XMXR}*+-g=uaj-#g7JQLrWO6E~X;aXDorEsx7SPlGw(?`%uLFV`3!vXe zxjx+V_xPDW1x`C<0#Iz^W%uEB zw*TDzE7f5sbul=}Hel+}XVj2vr*BuKI{O8xx(p2$8=2qQY@HOMwp=)VPgme3*H4&q zzc!ZycofWnsJaYmUJh}`tI}R#xbmA9UerL*Y3!teO+z4E^1Q9#9yYloS&>KEOrf1d z(f;9%h*srl=qXeyHNeH6x_^<{d_({jUJiOy$0(HosuCoOyp*c(Y9_;kR-S>TZGkN! z&5-+~_zmMKpW%^mnz9WJJc|LV5c(mq54J*$ok?V%Y;@-Zyiaj*;*Fhlep>FUe9O2; zdyKnT?2$q|cyq++W;{*v%Y34)UESTdZ{C)B8Q4Fl>vEXY;9t#UiJDZ)oG8C)hy{R7 z=&ZiG+$fV4i?->oGwxh=iP@}7~gBios;s2|;hSu_9%Bp%0RW&chW3njPZ6ob!7Xf^p=43HaUZ{q|C@ zB(DrmyCX;!Ej0rDE=R-x z%LC9Y=%PO+ub;40QN(lkr#GxqG8*_GQVv=wc7uvwikmxxr|X^gY42jM9Rvh&!<)2> ziM0GfgWCeB-WEjyFW#QHWn#eM3M~jDE8Y;e5?UfIIGZ8I6WE>6bHc(jl?4ut#MPxEv2gQ>_85ye0x{u@M|$T9ZEi3}jp(EpT#jeD zTYYEufnFK>F9m6ci7yy`OpBth2|VM#U7wT6jED}rgWV?^Wn37@r)g9H=f{wrf7wC- zbMxM(yKo@f3uv!bld-m5zq`+54h4|jmzQu1hFo3*qSwJmj#)p?TkhQ~2Yo$W1h41G zXpZ0X23f5vd(`EZQdj!LBwu@imEIYn?vY^Wj(V z*!Br>`)S4o?{pIvP_5g|oS{H!oKw7;gOCGrfMTRUI(!1cpr66cb6@YIo2e9Q~X4<1;%#5G>jM-<^&=hd(w<`#WH#0ef_=o%s1X9ZHtTJ-0ACNVj1#q`TB~1-$*@j-k(#R@3WZe@gdmhtSyf*&(CL5 z*Em%6r%mWX#RQE;*^W@Qj37xZkG0G`Qi-lRTIhf&L5wFo9ZKHqg;ZjGpZoQ3m2a2c z9TGq%ivokXjH>yqo=e5`NZz+T`_1=xwx@uK7sHeH_3=0FbMu&@%)-M@;L9K$|4YEZ z|MS$t!M~H|)q`70S2nlz^ZnC5`}6DXfUr=26!>o=f^!5y7j=cndCMghmA|SIMe|0* zcndBD3rTOuZX5Cm->V<>=SwZhe!mI$434EjkA+?-&uA;^X(=)5W-&_4O~_=l#ua^D zBcA0FnXCV7vsTP-`(b-26Gc-&!g8JFm{N%bv+qEXyZ=ljg)9fYV(g~UFp)$>?XR079 zA(}>?)2bk+s-apxY(}aK(AV;Zk>y>R^GdVO1l-g8G1o{yf!9*?kWRaK#75i9apat& zCoiRqK0_~LQfLVLY-UzCT-f!`c&%y-L&;{1ZWMu~~`yBsQ^|KI_0C{|(f5Tw|VJl|XN5wM_zr3db8cxjf#`_w|8v7eFSkGKB)>+#jK0!P5_&)4Ij&oUwg2Z5N|-A!Gj35#C`Us2h)*!{_I z(=2!EB+d#@NyrSZWqDV^?bCcDf=je3o9l&ojTViF9m{Qj4kjKNcpo z?|z>;m2P%d%vc90EXEnMDF1O&1T3Lw8-lqEa>&tZ28^jI2dSzslVu$1t-G;!zy?vj zV+l5`f=h5bht7emcWOmD@wL}MpBJ*iQuhh*&|FmLqk&}+1cg*%(b)=V&P(4#0O|r@~``7 zwxzC_fX*y&;0-`#tX9fM@sW?RGHiqpgto}O;pBBNmrb>uv#9+3i7Ibi`_eD>m zEchEc1~&^!8(V42cbOJlD+zcP%dk+0vZv4E%;0gMrCf*{9g(CV-9=MSci>2pW5%Xpa*w#`I4GD$U$*v0V8s|P#gK6Byo^1GMZk7VFk+uYikHSG;Sl|WN0(2*= zGyi$6!59^llS1Y*L~f=nvk%aC@hXg)GWYY=RMKblpTN}1hNTWm7F&S7m8&~~K%ZwT zrUnh%Ev+i}Q3J~7yHpm$@3Y3?&dRbUK~YCvpMfiX2-Q?(lpEar`>0fnk(~n5{tm?$ z_TVsLm!B1$6OwaGrkMCNpk9wa3gsE|BBs8{JF`e6!KV2H9n}83Uh~PM(tLs0+3{r{exM+4ihj=Rn`5mzm2C zXFIC??1CS6bpQtZ8SyY2lV0?@-ikJ;N*nPvNA{qG%Gu?ip9N#MV9(I3q*dP?+Mla? zyXnf?9;b13lLjw>-yXB#K)b*E=m+l!gG8iczB$28jO44{|dv3FJd@Cs33k6A*K&T zy*%I!ciG7|XTK|8b~UTBchee( ze9bT~q2z7<9%XnBo_qnjhjU|-K?b*PcM8ZX9PZuD%fcbKs;W?Qq^db}t@v~BS2gV) z5!qL!ah|p;nk{=!-u}fzRAtx@$)5!J>|o#oBi`S4bR8Z9JbQg}9`bp4JAZPnAR8J+&;vTJ2X5$F~U^P~9gNRCtwy z1s*812J)gmeV6NLGdJm`Pr!IrK=^c5#a$V6v0pgH^Y zCyjPj-+;y>jk-?XjW!!gj~0Lo6%BXd2ja&l1^{zuBd=@myf!%~$Pr)89)vqwYkt2z zUC9ND>s#E7q}a0g_w89yG0Lq5R*&DV{mh8$gJ-Q8$c`fV-{m|E z2E_E)J#LiQ0%Lf6Mk9Jj_xjl_phIO$xn|Fj(sU-_j|H48iCBiv<>cjQM#h?VsW$nj zW=9%3`s%wB`4U93Zj2KxB87YZnaM?Crz(u6UGR-tZ?ls0ZSl!PpZ!N;>2utt)LE(X z>a8AI8037_6mWqd=+CkFbUq3DZj`2T{Ok^s7xNS?y7@k>h`-$=ez`s^pW1T2JU8(e zm#2|?+oWoL@&58TzMwgGuz*ySF8HF2Jkoic{Exi}VlYWUS&Dzoz9%+C41%8nx?p~C> zN+wRx7a0Z&%t(WxZyaLN2VDT#d>JX79D*@H^TAmLfWXepHz%<4VpX2_WBAwsryvja zYn}fH-gOk2{8#ForG4;|D= zFj-k;-(tiV>%lRVLgjr3#y-8l4>+Z+Z+7wak(qwoXv~HDk+s`eF%vlV>ah0>Q7K>n z&ID4pVO()i3cd+>6@JbP+N4`+%b=817(?GwXf1u(tS*+ura_+UZ6XkzVrxov3dM>$ z$W;Wc%iEF%R#Yh_P-r(3O-3Wtk5cd{?Lmv0r(UoYOyqXJVM7=EWKJ=6v4zXjbiZ!; zcJKc^Gs28XO$E#8$WCpEQEnldFuQTq7`O6PM7xISQ7076m#PQm5j=Eqe+66n1Z$Ro z=%RIJ&f?p5rp#3#A7Y)T#MFG!WPagpFm;$A zftiBKg^S&XdZQY0)=_yP2^jss?H+XPcatIL;l&O$*>eFhnE zYZNPz)+?z6cj5(jY`xJ*Pjv5 zw5U3*%h3F!GzFS*;gYXNP%L^QU+eIX!KJo=^gn&b;~$ih#~;$u?^#LcEyCkZjKDr; z=Fov~wDOw3N*pRTH8bJG(`E{~LUCX^A7`N>bF`_ilnJCotnH9U;4uOP$Z!VWG8RR# zu8*_g860XA=)_m}01nje^}nzm*6(69lOsw=?^{-mUZTV z=lJ>?;Z}&iUQ-JWcD|02-SkQDR;6C+j0tv7VGZz%;Uzk3+Vz<2_6@eB4O?ShYg@gZ z#h<9CRHWj&ksU?5fb?;u^6QNISBOtlB?xm3yJ}qp{O-XS6fP+YOf5?|ue~arNB5i3t}Zq*q*5y_1Hx!mngE4cZ_01UxW=keie?u4VR8vg%^_cR3&J~-&brU z_F_KRAgsTV0CkkBZgJ>6Oao!Sb4dq2AW<4{LW-~X#8syO2Buzr%XWrx=?~MLX>+eO z7l14y7c@DboGfSO2o6a#P!ET}#QYC+h4GT(3d$yYbs;;^03V^mUbAs0g;soZ?py_I(N7lDh;YZO=hIid1(${voQq?vLEO46g6Rb)J!?5O1+_ z-u6~VFT09L70|!coMJx2cJ}i@lgSe0ll7RzRxt>h^^Vh> z2To60`L4O#N}t`MC;86UKl!xwzvgTs75{85hP+0;U}04ItUZz{m1gP_)U7l1T+BS1 z3aL=7Yc!wMhwana8CJhlBC z)F3&t-pWmEhnDN)!izI7v4YsoEswX>H|9Y*Z!)iqr@Ke_ognx175_J5%T^5(UWoC7 z9&B_R>UogdK{|8tyE*DrYX0!m;pUO{lZA%n{9xSl4ySYcunZA;+f-H;7HJG!g=(hm z>J#GcLwkjFuew;VL6exep>^ZBd~Cw_-0R*PgBwwkK0MFF{MZ@-jkOQre`qe&E$ zZdxq0^^%`_0nW5?#ARlYm)1gIZRuwRv#>3g0^_|oV?`-rRrXvaotKr_y==rVnheUu zJi|+{;>BOCFUl)ux`xv!kT3NbPc5Chu!@H0l2Uy$@cdVIfBGT1J!6%V1iLpJ;o6j& zPYA1dw9u3z2ATRS{QGXLO&~PXyPtUs3>Av=rRLTaV%0qnHqP_Xx5J-SM!m(hD$M<> zPY7xR7Tqrl+USlwK~c#*tbeOdez5^NvbK@L{yfGKRzL%cG2u-b(cgh``l3ti`(i|B zExk+vgfXBIw{7!TH8W^5o{y?apO=&(?^Q`u&PcTy*w`)(aMX3XeV>jY>v;T6^n-r_ z{$#SLQnn2!+-OOETGMRZDsLms8Y`?H6xwPuOklers|2+y)O3iN;Afk_giv!8jXql_ z49`Fh-_5A<#gcw>>93VBrzkPOl9mZ}73Tu7MMZMK&a=5zs?rJ=Z*@3^fFy8hXWs(Q zDs-rX%4cWrG`B-t_UeRQC~)(6tybwgO;5L1!y^D z^Rxy_VP^7oGvRFr>%{~J_$Z!jU1`9?8I8JmH0>#R^jQI0s_<1gwfc(te&nzttE=rR za`1NjPl2Y}`_8=E^X3ctHu7NT-Y}vAX$j-_Ffs_GL_ahxKP8!<9Qkpj9`r=|(a9D| z87BWd9o0I(zbuLgFcMw~6n0&uo1uQBZO~a`rs*~{op#5EjIE7N%TAiZYa8+gbXk+g z+sy6)_>AfRI7gNe%Bfp>4@A>6)RM`(G>-YrH_NS{)~wIa5zLqu!1hCje&{XMgzOXj zC;j?W9(S9P(xBUsC~Ru`_Si>N@8k}O5od9*F;v~B=rw$FPo$x0lUG%nM{*L*hJr(j zFd%uGfkR5n>SMz1MtU+c zdWNJIm9S!euH8C^m(kXtFazKQbrSZ}SQ``K4a2JQcbT zZcDSH!5WlQg4}ds_a3w;qT1k((4-`~!BqtYpWTb=hX6F!UpRs=7L`9hxImR4hj;}C zN$fIKajmm5lZfocB5}5<;l*GLd(%&0L7IVqzV0ovj$Nb1^sS-4SB_Qy!?rVw z<(3^8&jvx?P$C++Gj&~6svOKwCqsF(fOoF*%L)kv9N4xe^yy&`VjkDRw~w6z9MY=n zlM8^|?c|^aZ8>NN*W%EOD+d+l=^I_KNX6{s8ZS=lDUY{eF7~i^Olol4r$OkLk~_ zDV!Z9lNexPqO7)`M(a)Wtz*4GOlG~I({pzHn2P=Uj8n0;% zr>sKOTYf=e69j@B*BQlB+=l@q{Qtz#W$P@ICfB%{?qvlIW{qXQ*+&nkU9RROI7$YD z#9I{m;-Z>T(*L1+wfDX?ZKEx;I7}q+v{WeMZ#KC(y#9WHe{JuV0;~r+=3yT&)j!vv zt!>6`K1!U^W(GR(ydFeu_le=YT383SW~@8qT%lSo0Fy`G7zxXPLYHtrv0Z{?&^G#n zXLbUUXN`|4CVR&fl$w;EVp?Nk_AxEF!m;7$vB;<4>ais05p1)$z_GQg9H2fv;flzO zDlYz?FNnxV_#7E*=5mE){=b{g-aYfIXHDFWDU`OgC~!iOJ|f(5&W@l7en-ha-pbRJ z;j{Q!N3kv+e_#Cj4OwHiwCWBHAyW?GJq)y#HOkOZrh|_mpH~3(axF|ABh`wUrh9Xj znP&H(3hhQ|8-th5f=}AWEDt&?$d>`fIdi*J=l-Ymh=VUIGR~;bB;!N{8nvU9?p8O1 zEi>#sX-g=Z?T3{OF1)1uzoWNKSt+zBOMi`_EZaz?Bp@J1vVczRfbh2cV&^o6)T65f zH>qfBdTmJ&{>^37KesD`N^c)~RlBX=Rbj!L#!o69Jt3ZX+FKLsa*$6=lag8)EK{S% zF%l4tL33Dh6^)0sJdGI8rwQ>z0Q9g7&75|x>W0rm_?KRvSUkZLdx^WvVfBR`XAZW^ zVO8>Zo~_D=u1frIXBr%N^KS|@PdSXUCIbCKI$1e-0M_pa6E)?{o5~5(brwtv`pTui z5c-Z|F~n=Fx6V-CnykPf)(=O;7VQAs`sq>qX+Bxdc#bR2tKmtD3B*Y>-QpA#XniA* zCamL_{kY&mdh&~E!dX%%8VE0)NVDbyEt~z7ttz<{TpfEr28A`*`-26cTj4yb4z^o%a#58JcFvZEnhA=8qi1jb^xK`ZW7^?poxq3?4y0$__+MYJ}lOT5F;IW!)cv#LEc|;?u67AY;%x`9Z5|bk&X_Gyd-VbvWSmNQw z9eB+m;QBmnW1>}-+vD_D?B`=XJg(h5%{$(@wKs`NKEq)w+Y7|LphEi$gW%fGrbj6a>U#dtAPb?j$MGZ5a!n7^*&q1s<;iIkYjs{bMGg{F%{&LeQ9G zih3dy3_5}3z5sW7zv}FuGa$nrnl|LCBGn9BZ92}As+!{}cT4nW+-Z|-n@%Ow3PJX2 z;StydhP6IXU_Xk{b9f{23$B8NwwUm#qAm&|Apy2RVtEA)K^X^QQ8QST!R?$eL5_$J zST)HO>YK7WwbQL_d7v5%cf&SCz9XtapHgSJsn)WU$+bdhh4IaONm0C^g1NG|JkXQ1 zy!dR8D%7J{S+-@=1$pCk7R|>l$l4ZR5$b8FQ3f*WJhVbGxI%ESLimpY zz=P2b*BR=O;8sU;Sb(5V3%ykU{B{kyjfpZQumF4cX%6gEP7t4oWi@JrAD>ijo$Y=T z>Yb|^3)2`vzod&#Tx@h+A1V_-tBbB{q*5*%WLktwglhy7TRw4x6iN(N5H^k}3L)kx zk{@|lFb%HIL5`F$4NXq_FVtp*@OOq|N()DAXoUKpVk;WdQk#REq9YPiv#l-?nzsDD z?IK*Gs=&`-Oa_{&ofcDI%ic$L1c^y5dR!tpC%cH1%t|9jF=X~n&31fMTPhReLEx~ zOPU*x7>^yRVvjj(4$FS`vU7xAy7j8b!cg%O%}aEBRqmFJeZ0z0jair7snq@})&n)U z@*$~Lf&ZD~iL3K~)TL0jW5OgU-VTOfv)Wfy8pXpn_DDadrNx^V$}Vjx2$1|ioNb(_ zl&>Q&yiPZC6jB06zGa=Aj#gkT@1N>ur^i^p}ISh?%Z2#D;bhSVq6J zFb+veX06dm1|c^M`L1;m`Ixdm1EKgn(-S?7wnYkBBw-cnlkhQY5Mj&!zELzlt~TjK zB&cMde9TIA_2*#A`=E%jmAD&bjSo;_xydwGJcL0>(0Vg>< zk%)P5(eA{YjVj%Rx+`nCFc5u(kCrk?;lifeZ^@MUx8aZQRqFx;yJJ?U8+s8Mwb=oO z_bGX)>z82;b=Cs}Xo<45ET}~=pt$9-k6-?6Ovd_j6p|j1VohYSbze-TyAc?Lrq+h25W#u~Rz*#*9IUZo84_Pq7pt5QHQ;B>%gsPq39TFvhEYrT_jDul|>#Y>*;~ z0;MqK%PN$pSK3>ymAF>|daO?=i19?DDCz|Jrxd;^D+Qob32K*fVp)UNF5|nvG`BG; zBitnUB8vw*E|_NmhN1XIIdPhtUB8Gly3aZaX^ngP)DD3?yl0x?+mn~j)^h!8sI4Ulu=b5ag>QKph+K>=4GA@=(BeMLKT*g(sCIdw z2CNaICDU(PCnhddRk&CvSAA{rN?K)-$7CF`8MC9Anxlou$YUy`=B&;o5s>YGvr+hH zU)BX$c0%Z1x~lS8zA<@ee!e7fMzYy*jIZJ!i`*R_QoKyi;|;_z|C+QZ2j2E$W*SOi zM~-^EDR1kBp{k9AMZ01YDRyX!G(~mh&9PjD@!2Kx=gm?5#c-M+*M1tP5j7m5ScJP< z?;9Yn$av#(vQ{sK_(=%?sgErka#4pI$(qq#+2_Rmmcdjwzx>&zp<&SAK%P{z(YDa( zA_Mcx#jQ{rW*A|7@)S`TfQa=OgT<7Stw|{5KY>_ObJFwJQGTdsir<_bxB<~fPl_?Z z3K9PCsI0dtIacx0LOqNy>7I-5ed_V6;vh`Y($u1^c=Oj> zaD9%9_3f+A^j5hVXvFiXn%4hF*{Mk))f0X#2s%q!Gc%3*)W`AMdC>QpLJx5x=8N@2 z)mZ3KW~6R9#UtjprjRorGLF)e(@eHS*u{jEC-49lc7$88jA9SNTTOChOHT9?~YUXSmq~e!NB@fpxlIdP5{Q zTV5rIbcpGe=`mS4r}OXvb?G;IN@%@cwtMT#scX1tq6JshJ7_4Mrfs!OmAI1}rehyR zCBAM}Jf80yGm##ayDHSB1nepvF$n>cTCv_5jSx~*#0VB$Mx95*W!apHS?ybsIIv)# zcNFiMj&Qg2Cr8$&(B&&GKtby#i<{dYRWn5f1?+HQWeg(8E0IBlm^*vDFq_m9OkI-` zNgc&TzYyQb2uQIc5bJX!yR$yD!-k=As<|fl0sa;+>7RkkTD}6LX{0^HP`iWf$BLe0 zp@*aLN;M4&swwEM2H^rcPlIj5`q`n~^xuzP_wb>w|AmR30Gx?IWwoZ*jjyH4jjd6Y z6Byb-ozRYfb3u-V3V9+h(hhN&4E}cAjsKH6w8H%<+}<`zQ9M-jYuNMSqaHA}T4K(@ zRtMJbMvPu##M$KvhAiMIrX`ccK%A6t%~jL{>zH`MLAD@9Wa`1-h5cgWy9Yl<26mlr z89!r5WGOe?9T*QO@H{((%nZYXYB{ANfoqN8NExKE&|}G;NT62gY1wbim>WdvvpIou zynyT-0S)D%nRYK>ub{R%lRd=6ztXNE{SH`U6P~)XNY!fxXTtI z)U8fo880zX(boj~n7gNl8D-`O@KipfGBfClNrz;hv}(LN6JusG|KMoi88J^0I^O48 z>Z(kuK~hW4OQY+f=Co)P>+o3gUbco6vgeATj~u5mdlUUN;x;*~F6_!!0O!fYR14wg zJlw79t5x^8R8}U9VG7zr9Fn9PP1|In3ibf|LX(O_Kqg189UDzrb)Tc6Ob(=7fq-&(knka~Nc|0|;eRyV#q+8?Wk z?F&xp<8bL?%4?kgX)j4XPG~@jW68K$h&`l zf`(=_lbyIMCt<9&;uIE6Pfm#%jYZEH7fl>YJV?^ogddTOX(lI2C?kmud9W*t`MpDD z0m*`t(!@;M`%V}JL$uM%Xir!qW_c7PdxMte#eEZoi2faP*O+bm9kx(U2rW=kcU;g; zf%p}cY9Fyt(xtO18xL26LeyKilTVPFAX8|F9gU)pN4t&w&9Cv--|H*cO8T+g>6!!N zw3}9M=mr>!Dq}A)8AVpNF|UfyNsybj90{3?R&@EiN2yDnjMIjk4G}H(3?(^4emLGN z;2wtU9S9?~r|1rO2KEBBv zYSsh5UAQjU(7)BjtdI<_7r|zZ8Sg2~hAo3M~j^QD`A`z}XMl(y;mDlO-$VKE)gun_DC#q* z{;9~5$*cmE5|SfXUPwfK(SSmeM(J4_u>^@k`5p5~8#tb07{>CK6WsQ%8U7sOS}fz; z+`e3g_%%;*M?xDd2!5vMp4slAAbVbMNgrd;6ortAE3B_NZ78Ns468;DBOU?=0p76* zL#BwpR*uDI3xS6JtdSrtB&1`U`*Ef&&xYu{%mGMo%^`W!GhE219)NQ`+`yX*XXEAO zawC4=?~1mubgTZ67~8}QldWfz{!m!>i8>3fX#_{Bb8tF>MoaT{*k6n#ysMvWK@V4q zkH(3-j{xRKhh&Po8G_pKwM=xjj8k>ZgpO)zAw@00pzTNl=5P4q%p5kZsFwVr&gVPw zf*ojM(INz3Vs+WV5bt(Y@rVH-9Xv`@slp%BsSPBflvW{VMN2)YTXSzpKvWBOR%gLt z9EU_X6*hVc8_V^*%b*Se;%BpkCpGoaj+1naDY5Uuw%haX_xHbF*ZqUb zEe?NlzE_*d2zt8=3XHCrn+{n@k`*}5c=Jj=iVRlvma#7iG*#R7NlV!sQeD(~s4i_Y z&|f2;`y8|~TGE(w1yyh{=!Ug(3;EKb)2Q(}SaPG&N<~%zMbf5^W%8TRz^2EOS2!7V z@iiIV3f2xRB0U+jGcWg|(`t}&({?O%21Be6-@!TmO=#+9X-`!(ZS@^xcbXXv0Fltc zIhw$&uv{?Gp+|beHW)XnnrV5UdosN_X&_-`Gnq6uTQN{&qz=#8f|>jS6oQI;t?Sb-$$zR$E~ws#mISMJ`J6@*-TvFX-(s-eYWjdrL}szBvq z1N9>7iPALL-r}U4Y-w+-n^oO3*`=qj`CwW1*2kP|;3$@{7fYk`OgKa7+u2(mAB7gN z-?gKzUf9Y1%1&Z(bjnTW7~tggQ-#^f=dRM_+s-gTMaLBYj`-iiB4Y8>3JFuKBgG3fH-HRQ_R zHH>WM-Nj$y^=|o#2;$+3|7pZF_(H|#4R;j)@@EuKCUGs`0{UoT!W>yy+vis*r3cbZ zpo!4;^ByC3ffJtm|A@P%=t$dWU-YqU+vwQUv2EM7ZQHidv2EMwBpst;J30B*cg{L% zud(+S>uz7v7FS2P<8<(7o7!vf&49*N@0qNbkl1Yl>1Mj(wYf(|%C zdFkIT-Y6(cgR|Umq~z7B%CD1&5X#;GQ5;^m_ezs=Rl(*}J;4L5dOvv!@qqs9 znAEpVN9s4Dg}H547bt|}Emd%bVv3_r%Ec&E=9G3;%u_RTJ_SaNY?%xD6~-8D7S9sq z%q--j?#mOY@ceFnbwBTLf#^bR&nh&mtRlTt!S@6zJ`r*2$j|DYv%bT%CN^xJBO+}T zpmY*u5h{`P5FW*q-(NV?nz;}-od(=t0{yI_M2qH)h1as^rnfPNx@ivWA%$} zS*R=bzFqQxqJ^oRN_eGX%#$Gz$OPIEIp9yew^z`KtRU7g8BDE$;1=-W+?Vp)4^lAw zPz*9dM>s(&`H&dTlH)plym6rbg4NSUkM>I#A-ZQp*1Y3_ysd}vlC!uwI?08euwM#u zavv6m6iFF*1rn*0<#Fxwr=H@AOUK(^7#z~wE$NEe@gh3k>ESS00Rm;2#)in#BWfEl zp3$OPaS3O9RpvJ76*^21IoyaHqxp7i^89nmGK{KsMM98^9Z)BG&u#z5aM=u(h@IKQ=*3r)7|xEAg9@>JzZvhuj8h`~r$q z08;gPbKP%cOPnApQ1?prqC}Ri%RM)vhWP;tOIA@YN^sB`3l~s&qF17L`uttD&sYEg zjproU^Azb=?xZCtjHd{ph>yfU|?ysb8gifUh6|&UXUBjSpq~D;M zf4bXKmUYzv7b-@S?T>AimR$)O>;qIQRd8w{QRXgMIs9hToz@V`x@K+>Rs0x~>))*@ zVeH06zjzf1bCpw^aP3{(`Ejs{aP62Dt7r5*Qlk>kM)09eBYA8b_Qq6ez5Wkc1wSTfki%a{Or20(B!7`f=S}oFDRjBDu2y9`z??;Q!;<`r)aT$F6ZvX8uyn1sGL@d+0d0w1PhF0GucY|n zfS7^rv96kE=nB_Fk?e?{?9VHQEzXZ5GZ?F$^bfmW71=~3>SGA5i36e!k7+z7J2}^xXVVeePpWUBTobCYRz?&C@KES~W}e z?iv|I^N38Db5I}iAM7upWbN^AgSD%30qSoJerT%vrU zvL>-AO^d%`Xh7%u0a1$TcE{2&H$7d7#Lc9B2QXY0eUvs$t`fUeJgvZ;q`O>roQt3r z9iui+uO_6vLgL+ zzsg;llN!XLhJdRoIp6RV00)2p!77Wqy<_uSOw9t{^TE6tQd z6jd6&Qehmx&0Nrn(V;{{#mG*ftxiPRe|=b>vI0-a1#Tq#cCy^?TsiJpZSBWKC|7!p zf$e!V0pK6q>^{QwI_H!!?>IO`pC7)}2CS3oPt7Qq?jWBk2sY@Cqb@JCn`No|hLh$HYAWG!sh6)E!Kd0_a;h0O5O5TAq-Lldte-m!-69TbmpEEJ2lVjwdC)SH&RCija;XKW01L7-A9?$MNxYp(#5e4MKLlhUbZV(c`wvr zsH3tY)H6}{`>{2zp783c8AQZ*P2GK;czu~WoKes5_H#)MBVepJIxr!7( z*~IEWm+AI&?I zy`MCgn4foq@_tB4-p|*&gKUCv3met*Bv;G6$`2U}B(>Eb7PHr3#d!&d#YTE3jvpre zy)UFW@s5(gTZLIj4oVVbLdAm=q-@$FDBOeaT{^34V&f}5k8p66c_eXEZynSlj{DI>Zk-U3L$3Tvd+^@ZaqD1PE~%2?>+hKlgaxC+77l0#JO(TN_BddAC%@Aj_@ z)s}mD@BU=ss?k(9g^Wh0uh5crL`AlCnJ3vKjH1P{s4y&*iw6Z^i950!ISpV8UD&l2 zE0DB#LZx_Bs_H3bPjMrUBdRX=w57=qwQEYRIX6obRFmJEa$s^0pr|JoWVhm#SQqf5 zcp=o2L}KnBEcQX~r*x#Ka6&zh(mLS23bSF{N8$tTe2{*W5ro#0^~r9pRUSd9_4R}m z#IuNtZ~}G;d}Nf3U<@i+8SA3S7#qJ9c4jZ9oAG3em7^kPwXIZwQs?#5K&^`=6&{sp zV6Cw5ZD>*z?UOZ}mD~-mz4XOoh0rnHvaW#*U}$G<7Y@XYIbHDLv04-$isOr!H4f6$ zJ4Dq!&{l*J)v-8!xAh=-P8%)J73%w^Gr@*%5R?*iKqFVkj?&SlY|7{;EE@^KyEP*? z?HhVvdr$@W##<)5p6`g(0EvY#Zla?y`kB9haU+O~AGwjfwT$O)J< zWOW&25Unzv?&~rIg4anxc@9CMI`g;?PeYOY>tyA^Fx+EqoB#RE%+)g~fhhhOvss~Kia@T@xYtuL#>P`)(bm}n`4SpoAXqP#HC-qQqvlhDGGIHHpT z;;{B!{x!k2ul5h6oTNimJcL&93InJQ?H(ht=ldqSG%8WgHbSUv5{%=38J7Z?rvBuZ zp5DwOClqo_u=BEHW-~tU!V1>w#VIP8y=iPwgDX@?5)5J$<+hT7z2a<`NF}~LI2Fth ze%y$T_K+m$Y#vMF8zAEI0<8IkNV>kfmF>mhi8`)wHQ!wnyAI&Bzc+hwM55zheC%vF zRJuh;(=>Ss41&pMwW@Kxvj#w+K>@?vJ#G@H>xD=WqJs6|)sXMe#)$%t5}@PM)ZD{l zSN+_VV}IJg24PM>HJhu~JV!zTHQMo?p64XQELJFTCGK~oqrZAEY`p>?bx^+yaKM~2LqRihWPSx$CE-!rrt41_tV%4vN>mdT% z`SI6=#smRr(Vv51o(~UVd+(%Iicf?tXOlj!ecJj7KM%s*iJKQiaWf8(p2#l3dLXCe zqm8+8Ev5ZIgv6~?l!3n0@`~dhwcLco^e>=aSFM+>XdCybgKb8_`>Rd?)yEn`!8_$1 zph`kIXFssVUATXw=?Om-%yG-^rn@TzBWqgigbUDuky;K`DoIF)!zp4yz!AQhS4 zWAFHfEyqJT-T>Yi3J|pp7YQEwBt7EU7)LV53~-V>IG&r}LcmODImLRzZsyTx-2E(? zz99>dD7p>cwL5^@@}EkA^?PO180zI(l2w>YphUW_JDLg!vVu979G<>yVh*U-_}^k# zC}+|#>`e3cE10H~ofsW5hzCi`fnbMPUzV;T$o){dhw1I1n>J57mt3xEu$W}qL|DN) z_bv+l=}ZCnNoug+bct~Y?eyoAhzj@8F|mu>9KPa;q>TFEP4YA<4EzZcBi&5yJxXg# zuzLC9^e4cSrwNc&4V2R1$c`jO0XM89$2Z3sD%dBlw2h}ip{gvThFF&EGVM zM-dYn?53X+0vV@7gjMP%E_Kh#x2C!rQCx#p(1&a`lo3E~OGv0BzPAYOr*u73#U*SPm=B#1`nLctL5RhhK=5_iv-?h})jz;^dX7 z>*!iEbEPg`n5UY~51^RvNx3s-ee`S=t%*sOBN8UjUbvDu;su2FRLowJWH!#-PMPDw>0d5I>E&KXifMasMa~C`Ki*qIEqf7T zVbs|cGR(6J4?2?Fh}xn_rm%*g7qA;&eXc2nFhhz*i~Se{myxsON*MEK8~~C02XgZiphDduuMue7P5uZlVx6z-v@| zepk)ojb)RArjC8S%g}m=zrRA62CqQ$SOOHN!AnW}V~&)(Q<9aBgeHSm&SJ4M2&}^1 z>&I_G@MJ`$VWD4i^8s9K=Y%$&`)__NY-Y)7q*vsrb`y|1u#9s`XyuF*gYwCCn z(>Kos-RuN(7KcNh2Lh#K%lAyA8WDW~kuUc4=)PaiPFjt?ut$y?R&<|L@ry(~tfkP| zvj#_U6NxLPYOWsn8DeorMqjD5TMi-x1@;k)kJJYn5(gsSU&5Z#2nI)1OaTDyF|;f~^Qr_O2|!74Fw z4b^I#O5BqV%<++c04#g}=mSn8FPH#9i9*cZ zSTaNkBuVvoO2E=Fql4dcicBk=*`&tc0m=<(Yl8;`@bR9{sOV8VmlvPAStD+-XJxxUB4p z;C)}9U7s5Xvs?8=`)pZ3QEGT#W~fwfjWrllx+h@=7>~ghA!6^v)NJmQ464xEwC+BE zyM%e|lxf%@>~EuYEN&x)I{ZK>(a8`}@%UOGIad6zs=EE&k6Vv3VBcT+mII8+a}>nlG>P}f`U%Xe8mj22rv+} zLNg`vrHX1B8|p33CF$XK2U}uiZ4U(n6DoAaa82ZaNUL(y7THB3ClW@T`ao%CNNTBV zc%K#N?K1rFirF2b_x0z`*P|aI!LMIFZ(Fauxj#Ryw?1g7oyu~^^Qd#Y2NaH9=ne@# z8s_R&^bvNePj;Y;F@o1Mm}2<2>Rp0g*IV)BJ)pB7d`W4A9`c=x>}88Lu7o zK5Dg*jfn+A-JC-R_Twdb(0d5106TwNqq+c-;m*H6X6F~#fX>o^obTO=uuol(g+~M7jUUr%MaN5kU#;HMW*sjdL%Hfw zSJOOTGC{A+$1hD}_}$^|R1?(k{oUctC5J@n!S?6flwp>PfX9kTDnZW_0&h<=@}cX* z5T=YcD^~JX z7ee7D{vbDjWLE}7XTI)r1rFH?RONaIW}U9qN0-kE0fd#b}v|m2PRa9hbDB59h}Orzw`{pFWR^AY>bLyM%8N= z&CL=-p|YQv9EVdRMY#Pkl&d=IQ>7Uh_;77riN0|fLjPmq}p$_d0ej4!TBDYNTY^0-yq|}5Y11PKqh7*efw@1M-qLKaCf8zq*41#2b|ACJ5xBsGJ z&OM_LtRVGz1TkFsj4=M7le&M{K>>eUmC9R}p=$^wdNpz8?A_e#fi!-!I`m;z3W9$YHnUBSI`K(KT_@0O0BMPo zkZJ~wld>l=E10ZL^23e&M5!|AM%vqIc@C`p#M*zDNa2Z{FLrbWBqusHi+mQJuYpu; z7|}qHX}mD)h1H@J2~J1GF-3fRlS<)U8x`zPf=O-44fR%FyeLH5;KS}dzx~9aT2@OsdQvLnWopt^{_h(`j#VGunD~&ujMXhSF9x- zNeB9IYfWK9FgY zsO<9?L!mF-!TO%~m+8O33cJCG4)lCSduw^e_*%NXK|nN^d~%p-hL!A|{7CrYe3gi= zDkwmsV$>3@EZ7)(x&2o(zDx9zHNoL{Y-4b#l(ks|GegXuWF3%^a9NWjiW_ioaSS?- z!c6WbsNspjd0ltYqI~I#Qb(9!_w z$xjs&nvqx09+>E2;y>BF=~+@@C$AMVLrM&5sD!i{SMNM~0%>N496@)3hnJek(YKU- zBr1|MEclR-QmatVv!%oov!>jslHJ2d%`{G7)uxHj8;+(AHxsU^D1VxtZ5KB&wS>BUd{l1!X- z1aB7b{Z~|SN!M8UF8y zk=+K~@rj07?(ei+Mr+yF^x`?a(o8NpgWNZ!ym%gE10K-E93QlAZ<3Q~Jv?LE-8CWB zZ0UNq5cC>PlaSb1osMU=ln;6%kfg#!{s}|HQkzYyp&;4Ie4J*;`|-q z$}ua0l~ua}R*B8gA;|fU2p4wjFW$o=HFZ#up8*kGjUow0IY%B}0 zivR+0gJsSO$KUsW3LJFfjMdV1z>s(Aiql4F{A^3Lc1x*;HJO?WsUYW39k$Zt*4^q5 z9vgg;!-S63zl_r0BSXZPg(@BK2)kM>z|2IxZe^zpi(HecZ%2((ZuciMe}@Rke7y~7 z?${Rm#k2Bcdr;nR22$xLi=K8Ama`}bwtVNm1hy(_wZHkKF6_Va2}`y^AQVE7J{!TW zpj$rnRRKWp*#6Es3zA)fAD_Fw-zc7-WGb&D9sRw8W5lA~I3FPZsOs6z@4IIS8-eZn zt5v_8?}y5dAMeL}`JY50ynfI2F>^&t>{d-+E z4|~V%Q=GCm8^xgYghF^zdEpf4v~FA+KCM1@Ccb}oF)p#@+itLw`9ug59$l2YV`Oe= z)KlQnWU?!={PwqoifOuwuaagzVtisRImff9)PCKj9~fl~jIz@bCM6E#s25qJ>)Xg6 zwAqc*-Ohde6w?b;qGN^$Y|8w^2`Ojl1!@5pEr%EZ;jfy9m;w2!uh3-8C7Ss|A}&4E zqW@8^l8JQC17-Wu#<5y12O*zry^eW~;N31Wly;V6&mam;HYGWukKqpVkyWsNaMRp8 z9EaMQ&lL8z{F-2ZB>CO=Eq)h-9E}iOQ7>CMpb`G@phExIDl=)eqOk0Ifz8Z#61(O;Dy9lX(oQVot*AkM zGs&n>D~-0#au?K)N}JU-vLA8quPCTdR9FuXk%+V#Ik1S~mP^$x?(y?biKsDSS(Qnb<5{KZV`5%Y|I^sW~5njIgEgI!G zE@Yzhx~d9NW#T*k#;`Et-!;H)(IU8_wW;@rZ9-oA9XMiGqu|8@@iEc0F_8DmN{+Y1 zm9S9FP^Ej2znWx!d^J!tqifLQEe9g5V469{vgt6gKP?MI_|cDOqob01mrb9jpz1Z& z3SBBkY<6I@`>;9oT>!VBbes+@XYEBJ)n0g43y4C`Y9B+e@zlqyc9$pLP*=;76=evk zP3>!Ao(bVfub;eCS@2RC7zyV#LDiLiUfbva8FOY3#8=yV%7LXYd3v~%YMCDLC zh{$KZ0-Kg|_ww41ea|+PWp=nMPZ$Obt_w3n^AsHN%Fd6-`y1_HjqtZbzHKPW7O2Iu z3kM}!fw?~pTYnt3i{}5BzcT$Ne83 zMhf8?*2^8SXc=10!7{hOV?6ZAu1!DA(iI(&c*rp$K{?S}rIGwCaAdsG>or@IMe}c5 zhFyk`$0zwDsS;b;pJ4P9?U{{oe(#(LsZUVo!ed~HTQN1186TO>;8;*Q+7`j?qNz0S znqQ`dF|bVRw3o>UCQjjE-iYj_`6ikYiF7GaT$rCYV8YQ`RGyH1(DVoybuB^X&fn4| zt0rILP`HC1Cx~5SphTkc$<+4=63c1Mgkb~SEI_VCqS&DP?b?{V8~h2w+ke7e8;|Nk z(@1}WS?@-!%+w4`-H*8$z!`Z5BnRwdIFCOhC2};-}5?e)H*EnI8nt|vszV$eb;zE9`JAvDiZ_~EO?*F1gcTj4pPBTOT)UTq%Xo;cHlv>BU`;jmoa@#so49o`YyMw))=V4O0kNomb8X zRJ9lK4FsL-0R2tX=&7FNa0(zsq4kSeX|)sLFSX=Z!>v{Yx8D+W*kT@-1rN z-`hn&aCPwGsTQhhTg_TcHsUdQv3YVPt`h0I^4T`q_BF|H1d3!}2Fj6TAlYB(YLN_Q z&3Ui)%BO{r`l?_uiB<`Rjxmu)pAB=8Y~^ASNl_Ri$axMzdjvF`{&O1DlC;z?&;qc= zAC(ealB&}$ZAY@s(4M~h7#7MrqdN(K8HwBcd5kKC#--%Rf^<8`6crB#k|OJZqMS6+ zCEdDlI8h69gkZyA>}K0Lhy}{`aw){iC4BuC~gdb z9k-ndLqDW9X8o+nAK!M$siNh$QDc;nwbO19z|s_gv5PnbxQ$eM5x0Y%3*+z8?-40Z zsCnb=MPcTKC%D_xxugp%0vDDL%P?s-kTQ|(a%@;-^2MIbdJ%h~4A?U+ii{(-^E=HB zScYduHNLkiy1hjIuKo4;#P6vUbz|~m4|BK~^KBh>NTJmNxA9lF&KY^ti6+i};j<2a?KjVj2+v9+~z>S|FM>3-) z1+-M<_g%dc`NiZA6VORDJu(Qqa6579yU;7+kYqG;e~2K%5f9FbquM7#E|j`KLM!e*YPayMVd$5-kEM`vGeV|)6ixeif6cZWMc-N;bPu7h8?4JNwmx_G zCkl?}8RE!9nN5XB#sk)3djpn|Wvadom}+w_!z>^MBSflm{HQPBZhp^YQMZ8(PP;Ig zO0~Mby*s`c7&(lwkM4&(Y`E7Ir=Y$iL1yHtE{;YUlY>Cg91ZrXJb&!Z+Dt>xrB7Pa z)<4$@$_70zq*K`QhGpt*|C(s+?IMpkkRqeFsj744mKq z!?89rwf+TS16a*nJn@bWvp8DW^n+J}hh>4%; zfN{^YmEa^uozg7KG}N{hpb-%zn>yRZel#kOS@l4d46(Jd03WRFfZND|SD6p(g>yV{ zNpqZv)Y$00Ucr3%#FJrmQB?8dG2?SHXz5EZmh6`iYW~+BcmARMw!sNu78+|A)XK+?u)j{rIm>!R>Nxt1P)-fA7h^ zv`2hrJ)1Vz>=bm{cwHJr7Q&5S_ZS#d|#1_*tW|y{fT`?wK z3Cuj(p3DmNqzp%n;RXv=XNo}iySsoz3IcF^w_x>suiB%-BRF zlN6Frf~p~7SFf9xC#7{C^kK*>{*XXRMgCP5 zA=3#Z&@Q0vFf`Cf9sG`THz>1*TAy80omeiO;E|?~egw^;S;Rain=fn0xZ#LKW`O>!}qU%kby%m|1zR{&J zqw-MN)M%i2K)DTCZ(^{bDQW{Olc3dvX5|t2ctWpP>3lE)^+PigK?4#&gFTNSU_lXy zl~PWVwA0@!zw;!_Fz&nAYnQo2OBj`Aizt+)XORs&cSb%RanWZP__Ve^V9CR-XrLnos;{rdKz5%UYBhm={w!{*Q&qqxh7 zCW&&L;Y>RO+~D zIPs>^;mog{^Kd>L;WS455X@dk%0&kYKnTqrRc2gnUW0h*lV_6v@M&a=CgZ0DigMOa zk1FwMgfUhKS8|XL^}@vy9vYEf_59`YipvG7R0@{&baTP_q+*p!*~(UESu~n4yJ#Im z>uah@kTO+&t*ARlH`2XX=!-V|kH*+VGgq(#M5dJnJI1=-f{jUqf79vtY)GL3W~r~lm-gg+w#Z(lza)h3mkXDekSdI?X zL0nBTIOXJdq>|E6u-j8Q?7${7Q$VWYIn9XA7&#i-lO$wm_@cPc5uaDB`=_9VW zA!yM&@)-wRE^dTdFo<)$5My7YBd}9=KLU?3Dv6LhukLLQ#>e$qIpAoY;AN0oIM|XC zJ;dGuy^V=Qy39MW1smtnFjkHjv&MMeP=n-%@0zpoCvo~1s{j&mobEetv<%S1P((Bpt{wdkOTl00P=N};Z>8D|iWVHK}&wzddLE+3AsVquzK>14VgpaeOz5Z4B><8nBa`f9Y>gQ0fFa&}5|JtQ4+oLlI6 zbtPN@?3WqtzQj$i%=jSugxEkZ@O#dgcXv<#14auOJi_`+r2?jfr^r@6n!;h|Gzg)d zvj!)82nYutP2z}^zH6W>o^ZL*q9By0yi-f0!55hrHka@cnpG`oOw&2)h1@B6S)xA8 z%MhNF?!4L|RWD;^1Lvfwr!w#gj9shKn?~!Aczg95Onhiu`EP=ge(D`OVDj*%f?y$A zBYU#gAYI5qDd!09vPqT?8sWU=!EBhoflbW?PRXqSZ}SP0m-s$$(a9^{%IA+ZulVT3 zcMaUWfU`s#-2v_!J9&|5-yL#ABsQMr*kE2O_%8a5neSLw$8W(NZhQng2o{9j+n;)e zsjJlFlq8iK+8X|HU+*xE4USlBYcOpAEUwIt-If1xpxDHsi~Lwrm<;J#6g5QCcxS?l z;_8E6mIw8lPtQ5pZ_g_s$C1OZ@vkY2N2{?vL`GH4fNVN9A$oiv*!5X~C5}XhVi=p~ zte@0ucN}HPRE~`eQ&fa+6PK&WJH}ztd8X4Paq?)@>55;j)0z1(SrvkZ=czyi^NPj^ zISj9)OPS4mL#bOGT^N-D?`bp#Vp>g-8cahUIUJ|}enA(d&h75;6vUao%fq-BhF0$t z6pFmdMe^!|5x{ANpsDH$6rTtH(Dj@Tdq>*=L7Qme?p!43RM?yaYA@r<>oJ^aQYYgz z1j9K55 zzTQvMzmitRn>KJV)$<^z$z%52=pVyG{4Mu)l(&*Q30qx{n*=tMVe^-QAE>@6`}r@h ziH3Wm>9v3w#^}hSzlBDA`w~2OzD@I3=ZJ1~0{q!DNeZF_kEmc>p1FJsxZ#)R^g*B^ zOgxfKp|-q60WM&LLs*v-{nZ?uGZBMO#gWiIgQhh3xut!?tX}HOTV<;R9EOV=$87=gN_%|0A#(j0J#cnT` z-lG=-$57s*s^K8-yTD4QCH-C=2O;W589FdeNnx!UT|vjoVGq&$v_HNQK-6b*Yw(Cq zwrZ+<*3`?Ng!sfiFYnvQxujlx9`4Y&JgIPTDW_W9uTo3Hjk;x_eI;1!Ra*jiISPdY zRix+v$bBxX&daSQX=BsT`YYsd#4#_e$%i$@>_wqvDS7=?WX&&J*fS$U#4au9S)zp) z;GQs6bZ^pUC`!?zuzf`6@fK&!*$2#iLrpyQyfJ*%2d{!eEi)L3tDxHP3)fX?f(JR*}U0+K%rB$VV+r=dtt@BfEyNMugSQkry%%YLHNQ1nZAw?n!_NmTT zyf1ei=$Nz?MqlA+evh|9Z@ZHS3YslrMu6duR$KcQ4mBpW;D%JB+|riB^Qz5Bq2!BoUsW3G=TIu0JI zhrQoXG0lX%-ifI)TfKZn z=Ntm2dyS8dV_pM@HNb_( z{HT0BP>ZZt>-2?^c>o`gAtLOz3Zhqkf0F4t-IaH=>uI9np8uM{*7KFth-9%4Ez0 z{sxb^@DEb~J;WI`>6`6c!(xTzj2}h0;PCHDw5ICwyuoR!EDDV~D?^_Zmk(+f*xHD| zRj772?^XLXf^gMGP&DoYVxbUb@q1D_q7m{^VodU(3a|);=TI_*_Ir>M*LJ!*qKFz2 zknVsCVurNEj#X@C5Phw4VN}LiaA?%J3UKJ39OeeFXTZ?#^1%>Dg79>C4=?dAk`IMp zRci(3B~fh!@VxD-x<`jg(#VvqrP8=XMY)4mVa7a+8+7%5YruVY02itC5n3YKHrR#t zvyq&ykb}qW@L~shbd2uJ1rL0s8_+QeI$F;3YPnQv{KfpLE4qI%XWtniiRJ%8mM*|HzQ`pd{ z5u&OE+XyPW|O|SHof0J_y}x%9Qb|iOQe0haBVbLou-x+Zli?^)d6Nc z`h=i~XZU=6uDN$H(V>X16G(GVCCVS!P|eNc>iYVqj-U7K^U=rYL4=#*+voe?#mlpG%gg8fncVi| zN9Q7A8&2NVr!NLxH>V$F@Ao%wXXcL5JHLW++vdAPkhgy|cXkB(lb6l6;fGGxSCx}B zKR%zpf#vJ>+UREAggYxr3At)c`P;*deUqCIz~$xE?8V5Pu^n^N_^~M0UsOZ%`Lbi} z?(%wi|8$4X@NiVS|1l2?z#m$@;=BBrp}o~ZIBmxl8}xi+egC@j`+lIPac5`iWVp(0 zFz9#DZvWX6A)>3StZeIc&Sh>7&pI|<-g!5d=V3R|Y_2iGND$DM&GG&5^ZT^Dt1lqV zwtJs&A?W4hVg9<0?{`Lj(nZkvi;BH3Bb;m8JK>DnFJJLL@N$q>>~eb9cD(D{+uI)A z_NZUJj%?XE*$_pIFBhMk^HG?PJd~|sL3gc?d9r?dTpqVa_w&n1AB(GM$9MOS`tF}6 z<{X@%Spwe7dAtOE0QaB1=wQ(-*Mj11wi+x9yYteQ~(5%ZWk$xk4;;vx{5o|GeJ$tKar?@O+-Pdc`|^ zyT7%l_WyA9)=_cAY@;tl3x&abu;PW{t}X6b+}+*1#odcbaf-VS?pCDe;O>LFoay_0 z>$~T!`_DaR*2?VU*-7?J@=NyKkta_Yv?H&#b4dk~J+@eru>b{y>cPzV^69z5dDHWq z?R&E=p(2&aL-xw*PNeLVa`pcW#B zGgJVVV!&Q_`DBEvH|)I*=HRASF;sVvi(ASie~eb%G6pQ~^+ z-QMDPXBr0b;au_dxP85t9yw0(pp|4+P$*s~NXpJE=;^U^-inF+b1Ou0dUn>?&gbds zUH7zQ7Tzm)wLyo7QV%`fE(khoomB=%YDm$ zx1)`hk&=y(14dc@W#2^5)5E}lE4wGGqJ?BZ&(7_Em#;_DHVMSw<$TMR+f#VyW}~Nk zWA@=}8ZyL;-n8bB1NcJ*BFhT!ez`o=y1lyiQypgcG=R6<>UZe3?DhP*eF*h<7rI6_ zyoRdS_i}o5^^$P+qVDL(FO=yQ2nP{-_I#XOIyl-p+27~hr*-nYJQ`S<9t!H)R;&lr zr%FPGN_s3Wr=RX`_wO(6ZP^4oy{_*kHdarmR=Ol;lQu7g7MKB{NCiofv)oU8_?wDB zw7G-AxdvV9zIP+w7%~uH&U$vRhDTB*nSN}5Pyni8hlhi~Df+F4K?j&D+yA<1@{V@% zb;EN1`q}c1LsX+#m~6a$UGb0qcL&6{ux+c8T*z7H%DOLfH(63)Ui9iUmd-BzHg9e} zZXQ9QRb+kATwn*!Dldh=TZzYXy~-yGI-$S~MP{apvZLC}l2oRR^Plg;esTxX8YgLoDK^MZGRacix+wK#U945E;-DI|Ex z3*&x$@iydAew<~InNmm;JNj$7Hs^$c@V@NiTvKewhjo4UM;t*dZ^d$)Z`xMPqV#p32)qXlWhKu zSxJ43!-1D$nCH@}Z+s=9>9K|#pDgv^yNqJ+80mpYW~C#W;u-Yr2$LTlSQdVA2?^5V zH@=)#4}8Ccl1%$!rR3MJUlplv^i{=+(hq5lxB`rjyLOW6tg%3t2~fwnJ~g#S-Wk9- zM!Lzk0WVB2%Gf|VxBrrzYth`6a5bA-eMoMy7}iYYXdiPZU*H%Z?m@Q$-}yIB>CfFh zFHRY%x@t|T&^W{7kd@HcHR(tyA84QS1wMPNplJS3@bZoyB>A{ch0bo^pYgYqM9>kp zcf3noZ9nKxPxDXIyJ9UlT9z*kb4!6V#V#QN)U%C7nmbQx$5P%Ftr)$hSdYn?kE4q9 zbgfS#xle=nnzuhco-pvov;3ySfllAE7jIP%(=(^tqI>`B*oJRT*BTnihdp*A7C3`S zLpUI41=-8`BG6z$Dl@gU%S-VNXXqLZ;+#xLgwh(*;hT?tJ+{Y|+HEC--{zSdmPe*w zAh|7?ET@#FCAJE;02Y?$FZL(!(!rC4H*=vg+)W#_&&6dD%WB~NJfAOyT=2%}NLy~N zI{BO;@E6e~bd3|0)?Dk)ZsBBp{~JySAu50p;*}#_I4dn^S(+X9E>NE{Xra?@u7&33 z`7l9K0WkxYOD_65Z&3_i^X6uvg(90}`CBfT=V5+{q~WrL%8J&y-GRNqQe4RT_83%` z$2%Q2iM7t_3eIvSDV^#zJ0fKkQ=#7m-%2o#Gj1C5z2_ReDXWF7X$wZWmJAJw34u>P z-Xb&=|2$7c*%OhTJ=snb>(ozw!rb#W*4y~tTCv*ZXGJqtdmGzGtTVLyR#>rmfmhM>e z6`mNs@etFTTjOSUqS1cZ!6a$ry?>B>4En{a%QL#%wU>#epV(neEnB-OXS9>I zkI2{5aNu%)MU8yf~c-$8tsP5+5p6+tmO;d@x;Dfkso%66j1AyujbKWTFI|_!`(UG zH#aP5ExI;f-0oP?Y?9XK%^2I!mDTtg$d+?zHX=^d_ppfkrF|)^8x+hkm29v|+f>$* z{qBr7;qUcX%UxLJD#fn{LD)00jyaC1eW6;_vpW<^@8<7MVuGBRnG#=Cej%{fJLaxB z#>p-o7UdV~4Y3qenxv^i4VQx(>TKOu0DNexT+){UEk}b>#>fKlj5YdhYMrCZW8UM4 zm!p$wv*S6=(yruMfBH{WaC)`ue`n{Hu!<_{sUuHah>rBcQ=TFj?pg{-X!8T#o6EkcB&jhz zHdQprDG}|Cz@Peua(=E_3Hsy2Blxzgxa!JIum)<(dAIBxTWqk@KKV%1e%ViD$u*dM zd;D|6Y`GsqozU1w_Vy<)>1SEFf7(rcp`@gBMWeQzZ^FU7^}l-%(F&& z0tuiff`&}Q>t3_%_MQt9XAQX9@OqEUmB)g~AKc3e zyw`g4XP1?4_9f2M#+E)N1FpzxzMj<<65gj;I&&kV3O1}WI3=485y~;bzF*-YZxc^4 z^RlU^5HNn?6IBN~^g%zrnG?(k!=9im9LqvOgG6VH(zi z9lV+SL(@A)=;PV#f{a!MV~8%EJPK1zcv>5??ps-Nve`T(k6&mfFXkg$3f;D{)SgWA zL!dHy0}79`+nPeZ&&1=?rdGZz=TH?7GuJE;gOyr{r&L1Cl@O{!KS8HBK$H*i3%TNy zWy&vCJOn&Zx3LjtUiVoldq0HJhtWEh2^cA>#T|Tfu|{JofX}ctyQ2=@6aUZ!3$G2V z0&RN);<=XY<)q4+MdYeu;`M6bb7}i@!AQ()>OQ`~t&#;@`V+OQ!Z?0+viHM^L{pr}H4$2wP=i2p6-pRb ztG~k>QgegBB6oXCu%U7pvPCtTFKvoTyO$@MhP0&0vdm}OOvcoc_tVb880j=LXYStp zf0mxH=ioQT-bIEuod8INfrA-$Snz^f?2>MKrP{~i${+gQFg~eU#A4}K#2$?+qqJpv zFQpgoxgNw8?)6q|p`_5Mlm;(hW(R4SfTyD2Y0kO|z=kIvX*l_1EuO{8moV6+{HHt3Nw={IN4nV6Jxc_WU*?jF z?y)5-+}3bI5qf9FoD(CjH-7V{p|$%w{MABPzMxqzlxD1*JeDgXM#xA+tp9I{K)E?*{RQTP;X_N~+! zCTGhmp`tlH#qtif9QFU?x0g09G{3#IXUDJ5^pSNY(&D{|GYai=oO@9q1sox&rc6o> zUMN(BV1|x#Gj-Q-Y)2A=2cR8gMYr!+GD@8993EzO!~-LRPdBx77chOGFSqNJUC(tZ z`eDUJ0VXu1ZYS9pYrxU^5aH$0r|jBb3A?G0wD`f3{%ZW-Y-LbgKbShZ#+c0SC(;Rx zOcnG^?UcB9*xK2)cz{JJYBL>iFXRx9exvFr6b+wT(}k{;OVg6ECH7R%s#Z5)Y1L?& z!iUCkND??1Q}k{)BY)SZCLN3e9lV+SGqSI1w>{OtG8bhvSoI4d7OtP=+W)eTVRv!- z892bsA&HFI#D@a{h*yhFGiZn9FBsjr(s_?Pt3a)J2h!`OO4kjQqSMFrrr^}qMD98h zefh9_4Lg#^oQns5_#e>1#<6yGN}P3AzDGd*uOPkJfX*Pj=|+J2Zl}Sqp$6aLPk?(! z1HfH;w#XixxvAPLh*w|*8nHI*Bq7weZLRb&Wb;_ezJAm&qMiH=))@YuW{N}0oz8o2 zuj9Aw8A;f{Y2u;RapEEMIwbM%YpUEj^(=#Ss$8|D9vi64ZRGlLo_bcc4SW&Bl&(Kr zEo{c-7nWaQV{cI_I$f>=O~f*~;IYy*MQu3dk@VuZQ9O` zm@3g}oqLI}{2?7^#yF5f>hEp>#3A~@|2)A!Ju!Qk+aat%MGOi5r!;mM;|Qk7DL0uJ zu&iFbcRlbW;WG%EEU||kmiSzS66~Q4uQSE)$uP71{U7M6H}nn&0|+!}8@=XHDj-JhIYsi@d~ z7=wiQ&*$B^S^E7FJ%$o7zhDFhb^Ie@ej)D$O2pJ7l!)X1hlp2&uz4sE+PP37D*rbk z=Kn*4$3G%GphT?wBVt33&odRU1|?$c|4qcr|4$+;{r)#1ZlOfn{v+b{Yih$f^(mBy z1}G6Ton>y)Pf#LG|BDDKgMUQK_=nB^7ZJx$BBmby5i#}ne?vs&KO&a?i-`IECZa(I zN<>5Fe-m;1kBE6F5%W+Yv<;v{RQ@9Z>Inww>A#7n{J$cip%b81Ejo9sbdy{uI>(?B zRz^E>s&vEg=LK2$rgvDBkDc!(DZ_-5el%e)^e5{a)LVFS(i{AD{e8T_2lYW@N2}PE+PUk~d*IW?JZdPHOu=eSeWa1K z2e1iK*4?>MEm@@ zho_DE6e%*zKZ)$N2O7UM+TqO#=})-#teE_*pl#FA&EWJ3)8z2sPgH%@@_Amle;?K2 zC6s;uJNh|TEMZ)5cj5#WIu$(UtP?CWr8*<;&liMjEF1BZJg9VfRzsc|2eJgr0SLAi ziCTMX7u(ZoEtJ1wl?tv^mUj<3TBw7dy)%6ART3AFZ zH5zc3`vV-}s;6Q&MY-S|H5p{1KXh6hwzZ|_om0sf?Ukeo0W)#-@X(5EVH^LvFPIZ* zW{EV@7n?viS%S_2p{r86u{`f~W|s9#I)i7Kcpix&&(I~YP@d5i8Zoox+J@sU#^|HE zIyDBQ;ICSeNpE0De$nu8c#6^l-VcEd>(5nle%T3wtZm5TH%#}!W?zPFJlMVbz0Fe3 zcBQU&EUVQrWO<}CI^|VTRHdY!!g~GRE{htx&!J};{W@(pG{KOo-E-VX&hy--qYc9CgZ zy!c{QCYwWUV-s*-q)Ds?OMzwmsWMAO_*$;-KHvD5&EqN8S?AR%cvBij|8dsOlFrhk zOQ=G#Gn=JDfMobm%O{+Y^Kj-J6K?LFVOdxXJt2?!z459q9~nR2OTNg*!tWy zDGbb(@Yf;6kLuN}ocmSfYz(UC-AD-VeEntu(QDpri3yp0-c#*X>HN$(jVe8oSl8;& zG@;ZWuaj~g(EzF=q3v}wF*kJQ=7Y)jyXZ9U6?5giFFn~?QqK@1UvP}KymB1I2qL>2ZV$zje6O-t!a2Hy{`MZ9u}s0|m{{(c1C%4&VND&a}W3 zEu>R;DC3Tu>ure^$s*j}=d2IfGMJJDngq$w4_@}_%V>^<@-t#0j=WQCl1ZhLXn?F( zPih?bIsv}|4Sw;&kdp~k+eY)CQiO30v71cyM9=0eJM1VG8)ETw4XimF?(DVfgL&JK zG1wjLTR|-cLMlJFC2zl7NOP(DZ{slH0NQXCq&&jt8USfe`7rJYr!xUhV`1rx6RgVI1XX4mtkv&DD zG^gZq)@@ATzb*3|!0dPS+@F-(EOGREpV4GSERWGttv<7o;`j9^AouBf@d=s8I&Q*< zQoglHwu)vO#3W%3M5i{AX=7WiNV23uTMM$}zv5*?{2kD9+j>YaSuZy|&mX=wEASY6 z?!=ApA%SP+y$P4Gl1NSPq4HoVGs}lzT((q$P`4Y-M;9}8Qv3(Jm~ zVi=|~3cxGXnZA&MkPzI8x@|9utRwO;qfz*Jj(q%{cN73_=O}f1>!%4&Q$4VNJ2r|r zwo>^UkCJIZO0Xmf&D+AE#JY<@n712h-PQ zYM%Co2a+OuUDbEVEVjJ7B}jBe8tmF{yE*T`Os8!)DCr)$L-*sO~$~O%*h!Vd%q8t za@DJAcPM*j0jjanbcuhuo$uDX##Y>!Tn*|AiJv45>P?BMC7Qm$Onr+jUHu-thw-|0 zui)SPX+-^Y;*)ktEU~=lVlzVu6Q;Pw+ETMp?MGmR#Lc8$AE=0)%Vm5iL)NL(KP84Ej3>X<39PJ#IyFxL}(!ZR2IP76V0sL>qHLW z<{KzmT0Z$RYD09&p|JRO;(Qh;F^!5y@|DtjG%td0F?V2<>mp|Q3sJPlT{2-qz6hlA z(3B$CRl^|d+Cd8YoIM>azux8eP<(1ADakli#{k2Q<8_f;UM~<*wp!m%AbXl^#r|0V zW&(=>*#lMD0(fZ~6x6<>+!kEn6w0?x<6&Wq8MHT676!++FXcL)a~;iZcoEX388p~rs)=Rm=yf$s+bpmP{!P#7j!|SD zRX9h}CQL)IMMVf5lwctK@%yl6^xoKdl%0K>a4v?W$!$1#-dxoWqW{N+GvFloW2=sQ z-3}YY!idrMyxEehsjOX{^A=2*okWO(eQ@&0mW>wR{gF)RrMt?dz?^rO$!UPFT6+h_4Qz zY}Z)SA3A-1^fI!@`Z++_%=eqrDKF$xsCcw|<;^X^5$QH1egIRzdXa^o+vwmSD&@AM z1nhWmg8Cwd?AB%?45^sK{zTMmP?A~Q+O0s;S)d`yM;+vWh07w=osX#1hFI4O+*}N9 z(sZvOR6q#}DuGd+1hH9@^rH#WDmxMr3rpnc8ZURuR65vr~?_p@)wn8D$*{50fgHizwp{vl%S7$@TDV;gxjz5WKggo6^%CJbrPI8|Sm9#1^0**gkl zsj4LQRzzWKxYYEA7RqIEq#(Zq-?+wb5vT&8=zJ{anq&%{NTPa%20KRwVh{ zX1s5b2~9 zRJ$kDdQ%K*c5yJcqy;}GI52MpCde56UL?*1qpg1G)~v$qo*_1q6UMH0Ig}~baat}h_g(^pTr88k}x34VSgQw_@h@XRme8)^()Eg9X+RX5CM zM_bO$#VlVP%w~1hXNOoFi9jid=LPj#KlShmK%YTU#l*uUbG{+15k?-=s4b)A6!vKf zYA{HA%xz~RLB#H0(eF<}u%S<0ZEY|Br+U}l^am}?-zflz_9m1X2V?U%RHqw9l=aee zaNMYi!IeTXmpBXhhFpR8X%ZU<#UmQ}hD3?aLhr}zGT^f$dibDR!Ti z`7e%V-u!$0Qnj8Bje~LaUrGtx2O`HReQddt<}E5d4+<=2l}iYt6Rby41D`Tk;m)~D zwlT`OiM?Z>M!xehR9`f49Z9qrKP?7&iITx{m>rm2p>;2G($Ob7>y5csmIX7C3zUhQzS1?Yb zeg;l60Dl#bW4yJIrW+Z>1BDr~6%o+{SJ z0A&SCj!LaTiQ#tqfc9B+d&%%65UW7;o6ZY;yjfUh$Zs!oiB$9Npvb)j{v}f@SNq^X z>xD*#Va7}^z-?qgjEX5JVT>bMXAd)N3nK4KJl|u5XXY_UZeZU^ovOuX37*$g>6em# zyBL+Of-0WBM`3TTCzMmKj*~I2n+X!~_RcqZYwFFk3q=Lov?8Mf>z0K^c_CB`crxUVZjul>sM*Z1cY9 z#I(seIyU-CvvBra7o3W~(l8MheQD(FeV_^)5-dNW7^KZwqh%YRSUu;{ihL^W*s9}* z*CRFC^>q!|UuvV!mLFgkU%aNKoi5qP2Rus4E zO|o|S7hotaHO(bE(s5tQlk&<1xzG%9DuS$OeW`snzT)^_E>m{&85b>!nS{cQHf;c^!{G*34sr0PlO^P?=xj$EBQjs4|KfQ-eTJ~T%Sg7F#C zr6=RyYNbE|{sL3346`Y@?RpbG26@QYy`Z+-8E}iP;J{cKQzvowS2>vBbLX$a19nR$ zjV2NsL>N{3q~^15Ybq*6&*6JhLvFV{pV(dFIw54uO50TI?ik$>9h(>Kopz(5L$K9D zY}G~aGN{$ufj46yUe+k|z^50Q6>TEM=6`$) zc4T~-BNv^-!WNKdh%36wa4r*K*NtvM0<<^MnNA!o9WWWfo~|BjsBeX+$nYSCC**2| z@3BPPQ?&315vKx(_os-!HxWTjdVl73+=B^o`&qJe^VJ~UwUoXpa?#YhWt6OP{GA2w zLl-j(I(V(opa$;2$Ep8vuk@3rOER})J+{s6SED7`Z1_UU_#Kl&`ql>jji?)E(lK~Kb5240$EJ_PDJ*#*%?0X)g0dZM zZ64vMp|$NjT@lrNifP1;BTF;cu+3vCZ4gCpzz@oP^=QhVem$<_Sw>!C1C>NVxu@F( z2I&EY#PA&ZynuC9)A&9MpH-6sYK1zFYBQ?0``^RUxNPG9!&U(OVU)jz7^A^D;?}rj zaV4fsI6-LO_x?jdY8P8J?-Un#Sb~u#Io0Ql$?;gT(P=flGE$$Iq&y_vm;~W2Z z3k;q1vL@=W;APL8NGthT&w0u~^8tf>W!J8dtyE_3vzw8tc&g}V{onP5wKlwc2W^*g z?n<=Nr%d$?2kjSmn-BMy^LS8^9n_iGv);fJf4m#gWo4Il9MoZDCeSa~j8#l)5^>}< zQ(~8yUp{``9M0PEpfhzq&}#% zE$Ed>wEEH3Dg@Wpl@@=IGcT1#tD{>`)RcpVrf+6eI_T`ijZto~R&HZWA~XUgzHtu& zbW}SQ^Gh_Msgbi}q$4qu#c; z27MJJSPRS<&TIXxow`PcmrG!gEDj|~feCa?iN^Gm+BM3#+BHGF5EeGRxfp^UaMp}YocY*g>yE&EU{tndA= z>Tw1_&A(WnwQ%a@YeoSyoqG%447U1Qk9DTTHF{?g??Fl1JIZba{X~%>(%SpN4-&g^>F0d$!EZSf8

  • UkvJ#!gt@Mj->@ zVU1(3x$J+03-^`P^9#sO`+9=B@FSgv>DWDqL1i_dQ`-RY1QiR;ZP-st4$IDI923Xl z++Q;7L7py|^ft!YQSByDJuY_je7*3IJ3C~Nq;tZ!H>+6E2F9Ra;XK`{kUIGG=UQVF zJNPVM$wt%<=33obg8t{J#G&{!ssF(v28zdjVwq6>?CKZ4M+Z&k1F=D!e4trFb@lumrUGd5 zUz9rN(46A@XumG8Uw&iPuvvbyyHS2q8B{&5;j;wIhTuhwW1Hje)$<;iHuK-6Z{{A) z!v9a(BT(PmqpzBvf!ZI9IU586wQ6{%iCoZ_JNAUYRg|U1W4LMM`Lut;$SQb`&;im6 z&-RJ#IUscHC@vUenfodppG1HZvmURWAxCADOTc=dCM@ZCDGK=&&mflizG=J3n%AON$-ygft!T0~>I6?nOr;Q6)5%P+ z?wqISG@SVCKkakKpZ}%0u}ywNA)%v*cvzT2w*R;5eSe){L@(n}=hexO@t(6qFU*zy zI@xSeXL{Bw8Y#1pv9l$|HZLVvvD1^$QLSn50+APe4EUW(F4Zh$d;(cw?WpaRk7@LH zf58AjdPH2p@85l5oZNSGY&rC@%=usfi+VWK>fHFH_ZC(}c?8rz36)sa*xVnh-79?7 zWh5C{6N`}u0z@+Htpk1ImWEDJTpg#JsT84M_5~&lBcH1_mBFTL6EAaewBu`%6P~|T zpJ$?>L(=)_;Dn0jKZ8m8plZvw%mVTQXF6^rta3}lqs(UpJ?htRzl#8aj-$c9ocFfK z^fRjTmd5n9U1uy`QYS>P`ffj@t#$J11*M1I`S(mp2h*MCt`z_;rhH=qbIR34U(YHp ztimPZ(fDo6)Q3l%INI2O0S;V?P0?*^ydGfCyv@!*b{X_~i(Hsb2xANDVyW&q5v6v^ks#-LkQ=NnZuQG0O@<)(w^W4iq zJH}lU4lFOIT;?4Hk=#WnLXu6`bAwL3xHEjP7Vj}jmxTPB81TY6E?D~+pQ#HD5X@6e zE|g({s1@+m6CHKUQCQnKKHSxbJ+5ZXDm&R5QRo>b{bFQDO}xMl;eFdvwYuK&a8Quk zzGC)9o8R;8Bx%jJo`{>=pK)hnQ@?s(;-7o7RyZJVA^qjbOEzIjk_7K!j3sL3i{Y$P zBM(3_cj9YiWOCMr7$l|ie`;`u{{ik=HChv}w&O>loy9@W(d^-c#MOOr!n$?aR-c=< zbACb^Ng<171IC-i;;;AS1as|O6(sFu()WS+;Rx-eAVruQTtqqux2zEN?TYT=%Stnk zW{Vj)dEdci^GV<;$@jw14c=l@ZrqQkaWq17okVU!>!beZ@fg`=_3!I}F$K z`*{cIEBcI@gWJuBgzWIOhH?n-9kZ_7`z<@?=9u7wNR%(2b-_SClQ7Lf z6D)aobn%YP(hz;nEJvt6NPW%xnQxe|yj?I8HCi!eumbY|pEGNGHjdtLYYW4`$lQMf zT^D5logNpW%lN8*NM+Yc$9eiSL>%&qV^kU(%Tg!UxU#3!k3k=)+IbXX(#XP8fMGHC z;5Bjb>mL6aYiN;NHL|v&CKW5CZWACI{METTxpIa&67!V5IpgXlp8-%3V+fy4fpS># z4+AkJKy)~7;$mFWm1Wzt^p==6nLaIe(xLWFhp(0Q?7=sV(l?23nH8 zMvt;6OZx+99tAi#I2LWmVR9xqENSWpt{fONFB$czS*vt8XR~aBa58igH400uCuT`5 z3RkUXj!L7?D8LjBF3!$ycp7cR&a4tpK(hIr_zt!lx|s94Vpq%NIWA4PLmqb}__rTW z0k=ZU&O-!OQ&&~P2qqIebRIolqi3s#o3$t2LmsIYE6&?e`W0oIdHUEutN*=PkCTTJ z32`}3{-@|#R$iCBm=S3OI^Anph?UKFnT^-2^p#EKy9wJ?Zgms8)bX^UQr?#=)u&MA zNuOw?=A&u?Gcv>PXkpN&H@a|#H~MpBb#<+D(;=98HhGrv`pk#^qYx74xH*MMIp#jGl)!uWwDSadM{kG5j&~YvzGopfMC$XWZ4N>W| z#HwhnV=5wQhmyB4J}6*QsPMDx^X7G$ zVT;Moh0)-RgPU;f`-p1zS3j{&rDv_{VD{YS`V|OcuB<;PG*X&`U%&ol1xA|+yc~h1 zg1>ps>O>ZBpWEhGJ`NftHt;A17(D)nEk=58O14PYa4<_(&_$I+1&LFm>?nHgKYdQO zEl<})<7#?!xU@6Sz>?CxI(>|pofpRo|Vp;}lER2tb~+_xG1PL|FI+LyfAV zFnRb+hM*-MsDhZhLBRCO&~oYvNz@fghvYkW6bUp+rHw@UU%@)bWho=?WgPL!&a@9! z=jbYlRhr+ERp0I^hOTZXhN_*@_7U?D&PPEvJCZf^m2r|$ObH>N)=`{+gYix^j+!xX zV__DX7yEts*sS*e*xpQR7&e~JcFvwVrsUsvW2dZFGf2U6nbc1+Q)syXe~83OyGY2U z;FU4-A(5j^rYtf1Q*CEIqNf_ux_LTDup)0!uzF!(0}OvIJoC$X=? zY5M$Y0cDSut5pOPsVWd1llh;9@1my;kNFw(@!|_?c+T)rReF`l{|@74&qZg)KkXu( zq!61-OT$_uM0~X2H2s9(cb#ud1X)^i&Zs1i+%B$fh|pON6qvPXz5@leKCLI4a76B~ z*Q|g%*4Ub}Kdde=9uB@vFEB1iL?nF1h2i)~Y0XVuz#H7f-I+vIBUAU&uRb!RXj=lC z@b)yaNLFk*+vE20w~F^j<;ozJ1xE*~$O)iJ)1J!8v7SjklR54ze^MGz!z{?db(V#G zRU$*7FT2tONSVm_>3jB7FFmSuw5p%1IU;@(Kqp-<5eIJXki_q=-^tNBs)|gNqok1x zHbvlCQShaGRMc-46sfFz`4b(6!6@dqQ&O}|tR9RTosTgW>9(nZ!~ePj9u=GR_*I|y zT)Hi2kjK71=PY=$u@Fa$bZ&AV5&k&zatO|TSNwW$c;f01#;e=Fb|ybo-3j^{1x_(& zJh6G;#J8PqM;V9`AKN;^Hl~o%De2npx2GX+Xp@>5=nW9C932dPd{e07&)Ub_< zSy~#h4XU?|?!^jYPeb`}^hnOpT)Q9VGo1I5JP&38m$|}%&rbPokD{-`;|U9+jz-pq z>=nf<^hk436s$FPjL6$qR%8jG>Kd|m4H-jaL3d=YT&ph?E^N>qx8;YYGqT4L@LnWo zC;v}Tct8%Jyh2w`g88)Nm9a%%M$ZNo^(OJ(RQldT6nt%*ai@N?SdvMOR@Gt{&^8?= zZL?0e5UcCGHS95o3HGSk!&87;)B>xzDK=^}u(tXwDd@Cn?t70t894ZH(w*bMK(IkF z>Fu+G#@i`TDVw9`X*uaG3#jGuxQ}W3iNB$CuhpW<3$( zPi@523?FKA2pUQ1+xId8Q7iS0&IX*nc$&HMGZB^tY^q9_=Fphco_cBT0^Xo2ihIaj z@0&-iA#eBKc8jOC$2-LUS8P)h#391Kj^t4((YM3bfVCgBWJa2y;rs}(Sf$UplTq7u za64(RQIucs5ts(-asG$bIg&yu;Rc4uue@9-Tl5k@VWy&NHXKi)Xbqd@Pxq38 z-UITPiIq)`$tIav_B-C#6qk|;dF8jfhb1gWD$eg^F8`4bqi|#gd|hYL1N=fZ=`W0f+pn6oxkfR z_+~!4TQ9pp&yGQ1K{hCwzS#?Hr-Hg&_W_kP2EB&U?uKd53r3I8BWTgK`#qog%qi9G z7X0bPtF7IEJ6{EwySqEC2>>t|J894ty+}z|v)Z9L7~Q`Z>a*}gXA>s1iZ!csZJ!5q zNR~yzqw<}^;5#Pmvq>$JHZxwdTg@s>d#1tIL}wV`^pKVzE!B5EuE|n8vHxAYFk>rWT;X9HP&3z*K_5DhjyS>8QX<3g|D>} zpsb_2qNg|aUITvt%$B^~BwAi?>Xh(FlxmdRYKu{Nr6@czvn-P#x4@<>Q?-nJsD(ct z;P};zL1JNaMsOhZeHi$b^_7KBj#>l>K5>N=R=^YShL%NGpt^^%wdcGcg1BjoAHnWojbb7LK^Ka)%1H$zzg)WS`i1Wh{Wa8#r7 z474I3;ymq*@E>d_Lr66?=5w&tqZk9Pcl7kPH)tf6E-sA^1_sFeK_R6GVU$&4)B~$= zZUhjOUT>wLmgsOy1FZ4~59Rk=0Lk z-FfJ&l`MF*=`w;p&&2ZGWM+O6qLN%J+THiIEytR-``OIH!r7+BKd94lgoRUQ2OEEg zvNzD-Ukp0;kzm8zPSN2%L!IhqVAA)9X{c`;Z39z*Y11}k1o%xyp5pTqHrZFoGT9+D zLmH#L44h!T&s0%gLF_uw62v*IB3I7!pyR1<3v{8E58rYS&F7L$??O(_by z*o%HNM|^q&-`MulCu@3etBhp50b}|+jlw&mSG3zIPw2pT;l={G-ADImjivg#uGc12 zXEapUWM`btPYhYoCBrM395HMtlrMk2Q(3PpQQTjYkj(L*bZHz*3O#3I#^X?5F(SiP zfxd^@D&o&)RT%=)HxGhdpg)UT|3`jY`mV0qx1gYsT%o7co)X2oTmk=E-?x#g^;0qd zzvt@_NcStxgoo%LPhl6BY-Qeie+~OP{k)vZd&9`6Qa3KpGj^tNorhaZ!QwfONmjoD z2Y1&Omn#Y%6~a)qjE2-ak=8V%HMp9)p8*{&6u_S%ep+FX%i9>y50 zNc(f~<2AK;N0W*(+m2``wpTC%X_PoNMs1D3?pe;JLM_6GIW6Z!D0b`tYeXH-w3vMN zpJ=K&c)_$th2MZT>M@YkU&pM!WcI_kd_?pZ#k;U?PR{4E4bJ;jjyYos%PeIcRRF_e zraZn5X+`q1F>=;9sP`$@A-})fFg6BtFCLs$TD0V`SpzV4nBERMZU%dTve*MBk43Bvl*Lrb> zzpbZ^@B>{A=OaTyPWWSSlV;VVD)vW$PO&UX@7Sa#2F&6GeM4q?om&wG~-Y_50P3Ory4s=2B$Lbr&L>?2~q7R{RinkDrmNI~Zx% zj^)?Bu}!`LrcBtQNN!>*eIT&0_7y%$Nv6~nnKmj(fu!OosN*a4mckM-d>_}C`x>J3 zo@avcVvJgc_t(yDY0palyZ=nTE-{&J1eO?u=|bt`)Z|&}{3iK6ma7WFaO+dHWAr< zXv(M&qVFofP!Xr29q`7~DmUyl#6eE9EjFnO;U^JuXC3~f7orw}ag(bZ2%mMEF&M{1 zYOiU^eOfC&zsPSI1wtzY2c*V3H+e*ew0JPSk`BFJv3pw;UJQ6V%y_w5dcE3Td-cIq zYJAfdT>D|A{d{$Cyq+rdU};aXi5jqvK<^DpA^WOH$Vb}qk6ZFqYuL` zi&Y?syY11^+}!P(K2iKGf;tl+_~XM60095`%!yK6ax@oBK@=Zc5bWUJh%cITGGfCw z(3BL;IJ|TC`r2Od^ptc=y=R$06O}z?8yXoac%Lh5Kq5yboPMTwOLp=e2e>6h6ifp% zfFT(M!(@U}`^N;R)H|%(q_@}{m%@tDBkc;%pkwTMNS{J@MEXM)Lh;}${l94X=IBa- z?d#aKZQHhOb7DK07!yx&W81cEn-kkMzr6Q*-yhv|s!n&UUU!{ay}Hic`?PxUiC4Z{ z+1!G(DlsN*>yvo5k!f0vOMkqI_^H`l1`Y1ue#*SgF(#U^V(rdQ!=%(IY=2K{K(~WA zEaIl{o|WMpiM+|bl^j^dpxS3>@<$_9-5K&o)G2cW*uQ>Xj5Sy&t{i?Rlqhz6^gy>F z8c;dN9YT*3Qena|ZMGpYB&PyT0)hGSzdap_fls@j1#!p5dG3P4kVql72B8gThhXi1 zO(IDVqw<0&Z~@Z-lzWvkCE`dqHrL|!bg0zxv5WLJArqjv&}WLkK+O=kxxJjg2CeX% ztBh3>QNpP z(@utMlR7HLF}U{Y^6uZ&#!3UOzAewC|}>h^zB}2i)u0)f|Yr7tvIIgPol-Rw8qdu3Z&wZ4kRFi zEnnw}xgx7~BQGzc@QQfAf~ZXKl#x*KJTFfCyW_rjCjGM{$O7i36@)~&=TRa$oh9M) z7?BN0U|vwDabmYSjf|jc;tYJbjPWFpVSw|9h<~?(-dVgcHL8kgcpz=%rhya0Vz_8q(~~cYcNgi$Btz(j5q?ds{nuk0qC-c zY2s88CAb1)%$7r=#U2JwB&EUyk$S;q>42H@Nr4iJ*6MvXNE>yL)PAxag+Lnd}4!)8P-Y@gr)7L2S8 zBO5hIbhP4qKQ*on7{3goe-=Th{#w&Jv?~;6NtbDa3dRFy zG)Jl+5Jiz1`Y%fC{V$hOEgU6-QDGj&a4vnaLeJlK2;kaYKEDlhlt{Ql=eQ%4dZFq4 zfxK{nSug^Z{IddN8+p*2Yo4&sHu=Fy#?}?B?*;XIc-FKCUTZQ7$w;D>IP;5qie_5k zPQ304e0X`ik7+zcgePQ;Rl^86*frkk>u1l-W$hte>qY#O)iINhhDOdB7@5pJASY7{ zk%tY55pM80r?BR~(cXjCe{Eq%PVxjx0YCs?REM^I%LZd?0i_O3^{cR`9MaNUb3K=v zDc`B3BPRY;*AaPmhnO|f!aDYId&+iO9zam2$=5SW(+8^xD0zd+J>$>BeM>?Kt)RW$ z{>Mxvqk11~R#pZO*rT}`=Bpw!>TauNotS54d51xN^zZ_YpqzEA!8e@XwMS^k4s8=v%iuamaZ2M&5ZdOKrd)g64WX!qYSD1`B*Z10ShTc*htI z^J|v&)>pORBZOO5!_mbn)?kw_Gu+TsX1a@b1=*9DYzBNM={vgY=UK*L=rDIb1IS_1R66K5yxIG;fi|3ISJXhd3m+lbD6}B z^=v1i)N8^X_F)qx%*dO4a(lq#{3|`{SrQLz(ew%#rncgw97jE@pt$FIX3rX&(@kEk zI>cz9kjFuV9~qCa^+zoR#u%Ok&{CS?;qS+NX5$Nr*BCi6FFlCJcVQBWst(hl#m4SC6nd zx~Y?0pi~WXC(Z(q0bfOlfLgpBkTe3%1%%2Td)fE5=TEciS!_5Mz>F%|4tF)y)7Hn~ z307?pAKr8vU-A_Yl9Xm*yUE&JRjxP=xGb4q|4>jq_yLvcHa_^K&$Fx?s&8B&nTVWy z=z1*70qV^SOu@M%P-voEC zJzeC%^((kk%kEtMU#5MsWW?BM1eADM#Jge_nP}jHBc-XP{1v)S6sYI4FTl zB0d7+Ws)pVU8C2An|%z|&?QhTJY$W+|`S(*_YBca^6 zO664~FrP?85b3Qg-#Mv1HK-E3u~P{3G_eKQ?@@PJ4@8_8uJa}& z1Mbi=&cWN<<=0IgSZWxq6P!SXcK4ij4l1W~L8`C4nr)D9l(4Ve~G!+|jOEc2P zOfcQNaZTK2_v@Yob?QaGom7rE;TDgYF2V(i`0ljC=53V#dpR( zbstu0^iqi)AojeITPFXr^0pB}O-n+r+nho8*N+RbL~HakpSd@qQ7@wf%90h zgZwh+h`RHaD%OCZ6bXLBthur4G**5T+#gHC0Z$V2;IYivjb`3C)Ba*v0?7_%)1;PE zo!@F#Ou8X5)EsGewnIovuyt&W;Q~;RB|{UWOkh+ugh4*h$G(^aNO3P)IQmm4*Hg5& zlyV22QBKM>h%n}LtF%HgW9SG;pZ;QZ;y#jWWsBwIi1~2{k?r?UE<$r6+4Mj%{fRpv z6B(#rMYVcjW)KB{ZcZv9r)U6DXj`V$8$mA>Mf8O1J`l^G#1--WMU4HESj#vJ$TRngj0 zr-F2*w9)GDq&f=!UTHWdu<8^pt?{THn=%B+7Zi1mrpz4^;<8~3VQ=pTJAL|UE{aj% zq~goAL3rxd6Ht*ub|ZKsW5%uVhqex9ZFl^2l!X4u7zCVi>TQbO;s8<$wr-azo*eY9+PoIYUi6 z_Q4FM$We9}7g}~t+4C38pbxbIZWGI7yMZg#oY&K|ln| zU^7nSkP>uNoY+qp6z2qyLp=-Oy`RrD2XKA|PyiE3Ud!E7XM2oa>snl=frPYB|9X+Q zhYvt?D?brTmKldRmSl3!5L)iw#Yp1o!S-9|L;AQcfl~2Hb*}iE*icmmCU!2u{uAjW zXT{D>A2s!##WXBu!0_&xKkYU~@F!H~r`o5i!Z}q!YtO<3-18U9M)Bs^z7an;wm+Yw zutaD-c`*FeZ4Qi};H}UQUq#M0Op}s*R!+$pKo!Adxz=0zcSY?j5Xo7AYE+r{^^$pOvQ}_#1(2)zGCyOV& z{z{hYF8fC_mrt~I@CsOCS7hKXw5LRACz zLFPlb>i8;ht=kJmElOibV>%+=cOVo0sVugURgQFpvqHCG{8djC=!KrWO1f}7_Pg(E z8>(@Z+`<_fC=(E&hPNZfWe|z$6BPlb)WbnYV%1J!X?}+SlTD>Vic1%w+eA31LP73V zxAb}z4nZ9x0LJ>tWPY`wOY8*$4`-IrR0%ZWQYcVob{3W>Ku=XZJwiMdN%$QHn+&;k z&>~6YsiYr+=zcYUnn&VXBO~jJgc zTPKD>G>n1N$@W{*U9XppPxo1P;G&!p*kfInkp!@}i%7;TM>1p|j@48((M?K*3NJd$?#}0f0 zc-D?FZA^GIBuo#l;Eh>k>LDCJ6i4R6j zBL6Iuhy=0{0$wB3l^Hc>BvRZ_NjeMxuEhJUs|YCD1asol>wjUcyVw)ua~#_1)CD-L zdgco3Ebvifs+q_m)E;PVH&x`9!+h|MRH;Qr2|m{Pusi>qvkMf?==MBpWx$%cjWt($z;z^f)u#jnp0fQ1E#0fZsiI>m14} z6f1bq>3r;x$Zu{9yRK+_FnZPKE^}|04!@OuJ9Cl>hGrMnENSf%L zSCugtOpz*bwro?3Op~KQh4_|NQM@O-t6jRMn}TuasSv^lfE#61dgeIOE(6BV)LC zm3*J^Ak$$%c45a_wXg5+q#lf0X~x^8iSdOq&!~0Lt9oNM%zAl_CWbwrx$Y$Hb``B; z&`7u1t{`6|uM;r=D34xWFyDWR=hB>@4A;$0|Gxfy^>3Pq_S4`Vy91jl;G0=$l{jm#WU5rUd)IcI+0 zFOKRSRu)Fw$tQ_-PL9K5`sXR1P#~-^rO-O)IIW3su+Ypzu+kjFK2EBT`bNm4CLFE9 zto970OGqGVs~K<lkN`t}@E*;5o+|$DOU^dc9$DleDrm8uLP}0mnz1(vwcoj4 zIyO1xPH?9(EmhvLA6}w8gDSjeRK2#~1k2R^h5!D6BT^rn?2^Om3N}vPBbM5SeB~Lu z{vr7s8M#&L=m7daT&-zhp?pB%i?x}_Cm|GF7!p22S~@^tdUF~tjlU$Uv~IKQ02`Y5 zGCD-m*pj(IR5NG%2s{hsSK1VJYcw9|bQ*GH!wIV>-H*>tR6or{A{xKd8(yeBCNlT_ z6LI9lllQxxocm|_5q`7@Kn)w1+Bo|8M5(c9IVvbJ2})88lxd9nvz<&0x0102%;Ws5 z9^W25J0u1{gjrTgWEgZ#o?jZOCKXle9`Gic#J4?h8~#nJc_cr<3px^hCtc~6Osdj{ zuy{YuT1a24_ZK?BD=GgqWLG>$#PN5bx1k;BUkN_?Vi0^n=rMXHf%0M2iWuLB-rM*u zOXzzxjJNRkzt{hA*TE=!SQM;L#=+=OGe0UfF7L#^X&mcpdoXC~IWnwo(6NIQ)WhKT z=eFehHkWLb@FM<6OC$@hv4iG9A#2T0?2dq@-{d*CeNvc-6m(|s~N`7l9(?WwP7kA zUXYKA$kk)l^9#~OhOkbzCP6SqPgEigKc$%krMMbwDuxAlWUA+&O~(N4CsWQB=^$i|a9_8{uihEjfaLdreFQ*yo^1qFH--&$k4gsRu16Euzo6=4o$1YgDWm4Y7~n3EI*zd!C7 zd%oUk3~Lq)NFWy!#{+8^^N($!P7?f&*~0z(UfaS-&NJ&&^=F1uuJyhag4kY9&KY|? z?ih3Yzh3?MYPuNWJ*M)we?Pq*KjW?%lU-Qkd>>xJ|CQ|Xdm%I=;NT|&f2CB+Nb^KH z06)X8bIT_nQ#JmXRz zW!qePMR6kHu*^=eLZvBS>mQ|s&wZ4LTftsLUX@A83Rn<3ER2ttlp0>?;k}4HXCUEa zZ+D>@HQ8LUP4kwXi{*r(64g|KDrY}dpOoPc1^ycVXAcl8hgsPf87pjD{_wax{{ARj zherOxWzr76x*^gONHW>AJnmoNFTW^g9`(Jj@({=1T+~=oM6{`6n33`B@ab8f3_Mf% z%oGnjSIyKuJ#}k{9O+LC{U^S0k`Ub-fbIFRv^Hl?-i&;FR2cc14NfJDOWGutM+7dR zERFD97S+x^Roy5rA60Mhs9SBdl>Pn_da)n%Gkx<2=+D!Yhf;P{O%a+)(Qi2zs;sU1~xtsc=d~E z$1G@Z4bYX~o3J*9oT%{NQzvqVg@=rKthWcGJcZc$Wll{}aKsGN7D)UB06TPJ3ayG|nBN`rADy_XClsPL4 zoyFjo4F;aSxf?u)zBwLKv!J;&3+i4o2q*@57;awQgs{Ou|D4>LKWyV4v?l@?VG@ki{c=$7K&ebN)7` zh+pKe570@^TZGqvKHsg7U*KF*03bdelJCJ=FOHmjkDaZ;!J3)!cGg#QqEz89P+#K( zk5ed9M1$De6+hbjflQ0p6knHdelHpT)|BX;PWKEt_6L&-M{Z& z#u`Q-4ZgO)Dys&{M}`~s{xVNhIE{uHZcSEiuNmTBl%TKnbE6R8{ z45|P;FO_j$^yWy<3y)Gm$TrO z#f|_M5G`04oqcxhc~35P-U$-l=R(O4u0IH~^ovR*R}*2ku**{Z5JY;1c~&wa294xn zdgaa8n?BILPebo1h*_=Y@2tSjdWuHIfTE@p1(7Iy1oa<*j9kO4J%({9SjYj zjQ)fLXb)Me>*-^aA3FF$dJ#T>5z{6Hf7V{^Hm{8Sfm68icYU8}|M0)NIPFgP<^=W- z|LU=L%BPrHZibBTm^tiVK{&J@V^4Tg6n)LaX_DgW0WboNS0PnZBG)-U<%3Pxttz!a-QWvs{9vc`oX z1x5W-VGsn^`;oU5ojiFAZ7?fNZ(=7<6>6I%&^umhyDwVGkLd9O;1RO%y+Wb`3kekT zbRKk4?y3-P`TLh@nZ$cyE?UFU1=7)Wog|ga46UXx#(Szx;d{dGn}mZH922*4rjZCh zg#;hvSQ0nDJ5RrkkIJMnO!3QE?cEr(&btAn9?}dwrIkvUu{rzyR4G;nYKpc_O?Z7} zXLc=_tLQj|Xxo>|pk+mU?OOI~rz5y5WXoOvn5G>|oC zluF+#K7yD*(TdROHq33Na1GIQHDgy)@w>GPC!wUAL#ZIqz|G=!e(1<_jOmqp%PWpD zM+!!TH1wq?Sj>9Bk%cWD$!a%cIIOBS^m$Tmt}B^+&Q3M5!uLzri3^^|P9kdt;nhlw zBR3`>R<(n8;Cuy^h{c{H(u#?{BM08aGp~Yis&F?7gkZ{Iv5^4KM%YvIf=f;Ok%1aZ zhDe?+&VI@vgcD<0guaL02ERwgsgXd#658lmqG;3XA`2Pk|B2(+uEf>bVwg^syIB|S zXkB@-a4X`7#P(Bj$@elxE4#vBufKtX$NxfQuKlH|wAsC4s8OKtO1$lGj9NVpQtQ{Js>=B90<*>O7I(Z^}Igd}s{ z#jv3B#~lY840)`-nD9*?F$<2XTZGZ<2uMVeGM(_>Pj!V|8oe{8(Z|;7txmiU#qPaW zqMGrgXcK^Do$WwpUk2pLH!Zi5%q*q4+G^6wO5Dw~UjRH8jZL7)M(snYuhV0gDJxkJK zN&FLq4b-tHT#i+b(tzLG9$$K@BP)hu5w7u)He+NQdEKVwzqPrYOI7|kZ|C#C%aSEx zr+v`}{Z_F2cS5OTOAK_JYJx^*9Hf2!{wd2R$)-eyA{Pr;Rlnvp#!PP37%F zM6QA`FLlR4QMc#eG!q>^*fniOq| z9aMgTOj@t~VVjCltrOokNif$O^I-J8Sk{BN?R9ANTWWr;bodip5Xt6YMQqaSgp2+} z>GS^9;X-g;)TXX>SH={tc4t=CxkP?8>9S^1iqEQ8Hy%=Ytn2Xn6YU>%D51@I%UX8Y z0j*7`rB-ye$NG~~o%cPuZZhNhtEGj6yFt_0sQtae^}fzrZBLa4YEpRyolYQLlDV*y;vyfRKWVvT1!-hr6fP(Jg!FUppmUUtF>V16Rku-^(#&x zyBoE@V@3EnW5$n8JLbA;F@g>+qPZxd+1tqy6CcE%I{UCI-jGKo#phj{pJ=fVZ+)y? zVy>`Ru@_a_zW<^3c0n{}QXYrrlf{*h`m>9aS;Kh?su@}78u{(|96XxR(4-DDbcO~+(agZi{j=$Ec> zMT$=2yT5rxwh&WYz0@syFF%tFky5qwi|YV81Ae|eC z&~0iya2Uwo0z5C%+m#aj;dF)wrCFX2f14|f*ZWzM$8j;aB%%knsuH?N7x0d{VMx7% z(Ph=B(tfIbJJXL(1SGXas6?>@GNpSL|iwq800YfR1O@uFb z?BT7?cv7|Tq%`q3)AYKF!PC*)~e1a zd1ShDp;(%-KF`VtrDK8nSjz1FmI9LXKJgcv`(*NNVG_i#T&)JyxV0qtOSxn9TEANY zxU8;ZLp^eQ*Nv^Mj|_oXvGf41o#u7{_6pRnkIIF=q-HGOPK!{MtGZC5^O8@{I)z+P z#c3)Y8@gjT=u{G7A;=U+$-Hmrp>-<-o2s`e{FM_YRArx|L(miJS5jpyzney1@}em)`aJTpjL5RBu`epA2B1u=+Y@^~RJ;e#kE*#6j%wrA9oF zy(r^Fe>g6OVG>OYE(s>gxHG*l#4A9|sU!mB`=H^HZ9wOPu%h~+eq>0<5*lI#OF||Z z3-bqtN-H1FD=#sWtaR$PVUx1jRTvrzC9~YXsp{tH+D*E%z${Mg z{AKB~_pjBypt~5!-ofnws*ovCDMb6D*|VV(b&VqmE!Y1S6N-yV?e}wuO3b+8#NPv~ zi0o1t`x_NlBCooer)R_=$EX~4${v5JcdD;kCTM9sJEetl9T4xncxaa#*>K<-0Lu%*|dxYp)N|DR@d72N-;e0j6r_BOQX~O zB0`}FYQNxCS}Q&W^LXei$nXxwoso8nr(spY1gEKn?uv$jTQe9-lndAA$kS%oEhO=K zCa{$*2{#7xo#+|3qa?f!Kt3|wfe)28F^=iQrcBSQv)oFTLa39PsNSGNSo!NZ?9h** zp8_#TkwawRrI>)cn(pmcesK6X1 zVB@+fg0c5*cIdfyc(dFueRXw)o+r4|Dy1YS4|viF$ubWT7CI-FNV1Vp@+2+`NRBQz z)3CY+oG>_TIbI>=oj&INMXst6rJ(3yP$Wr?m8p3d^@b{_jjX%tEfzrxmSvG*RX0A8 zGsYNdoF&thI>}t#<%M!&>gG*Mxnh2BuFihA69V&zFWi;V7Po_2g&fT{QIkDJ?lJ$? z%*uLp`70$|NzUJqa!T7lblI zZOA_#nZbt`jIGm8E5|~^5g`>lEM}9Z-M{3lv_G5I&rf65YhLW$2aKrIH|EWBj3vHH z+84+LT}oHA5vdamDEB9%i|5*;C52c0vs5lGUTHds=IjI^C6xhS6CF>3pcJ{zI`rF7 z!BZuZw}}k?`rw(vBS$30yyU=GqWL8RbtV0u+&R1G=uss2+mj6o?+@pTqhbJ0*vT0f z)+*f8>(%Op>030JLG@P*#!}C=WV}Yypo7RJZ`ng9%CUZz_<0g3GIb!$x2-sI;dpRJ zJ6#(FWxy=b9JOZ_7?jW}cleN(Awlo-c=NhKiV*D=+7MEO3X{yK`qHZq>%t?}KJ}KurgnLt`w`(!Fq`re6 zA+^wr{{a0`cy^<24hzMCSxpTPs&?F?XoH&9W8P@--joC~aQ zPfSMAf>`Y~XFamJq=?1;h&U<~(tNY0MO^YOioe4~nacD-o~6#y7|4bbC&>m%Cwixa zqyDZ=l(tiv)!#65W%5Emb)*p&CG~w}7#(9TT-RW(s;)P95P>H9ZR$4Axf~wth|&-m z1@cV6Ci@I%Ca$U`F$X&zN|kN2Y1L5$f^h4azoh1(*>Gk<9cwGsGUYxUTKl!Zo9r<* zv?(ag6t`|)LERYgquDm<24KuzlS$v4|4^dQ^t!*&336KX5ZBYDf8iV=e}9viGBt|i zYTQC7@JJ07ikls=;+T7uaB{@|L=DC~xf;_~#9oBefoBTZs4K`V;HKA6Bm%!Sm+vAFf6RKkPSICnhNRNqXDcH9ZXx*lq%}cllHV5j)_fI_|o>}np z{taR~0NPXBbKoQ$-qIXGPGSYhiW&5%z=q-(ss&r$G*gGFDb}%!T&vzsKf!VVZBoOp zf^kwGsJMyGRbVT>uGtTY&kA@ID@FH{GyPT3vA)>Dj^;)k^h&#Hc5AQuh?1@yBAZ~3n21em)1qYIzvM&;w7mZY#Akjvn!mI&}1kUNtl z9b70$)(A)OzCY{ul8l~e|t1SP%@R>U~ zvCqV}o=RuAbD|(uNA(g+(X)+QDp$r~0kT=10P$cvLUWF_1pMRBWh+1P+p1xsq>|Ld z;Ys))DVH!X9zGYhwmVWaYHj6__p3RtbS!TF)ww%an8itmL|l82D>Yz!Uy4<|;MZI? z!B}#|GD)U9Vvx>gcR6jbRRRd3ZY6pfg*q24fFJR~4by_XS1yYy3rifp`lpwWe4x># z$Y}YiG+g`W^n4mtJJfC}_MqKvQl6VJKO(Qeq?xOi0~Kc(q_o|@c51jyy11{}ydki~ zZtF+;g7YwPyw41eVtr@zb$p%RpWCM?3lN3A$BC=qQ~T3<@7AK*(NBG@b?B2E?0j0G zYNV+y(Vg@ddB*f)sF)AH({MwM^VOOz)&IfeerARaNoCu6cifpu?BiiWd zB3W<+3{+TQ#-I#%Neww!yc5XDv>yWU)_NA6}rW*fZkTK^WnJFO! z-EWWx^~F{3h0TSz3e5dYWrC{s=IUW#)chtg29RW~9h54yT%t-Wh=Ymw^0fjN zSco5_rutL&ihx!54|u1)3O+tpNHVaz4h2!Bsn^Ui07hr!>9+fG=wo_tc2MtJff?T1 zGe5l)vhtVp)wZ@8NK*Raz7N)Jt)1hL?rtq=um2e z8MbLsZkt(EyS+gPH;qI>MeRW1p&meA09_tIBv)8GS89LtClapd?;sO8?XhMZxzy1c zd?Au52e>3YJZmN$iQ2nNMpXqo)P`2}=nZ;wy90h=6A$OV_}Ag-PbfWE2S?%~Sj=Xh z6ic_7nThiDr>iWAX9DzR+omP8iv%*Om|PS`ML)M0d3Yu{n3Y=*`Ry3v^^&VIEe+5l zwI1yVt4;%w)4$!=e+tuYEOPXHR(>1;3==LrN(8p5*iD4)!J&Vty zvU$9kj&zigg}WW6k?9A16Uq>pdqJZ1fomZZvVxQS>mWXY9Kiu;FS8H}3$p&tEA2ls`A0WBm+Pc)Q=T&CvI1kK|B z7XBeffRj&<;fe#b=y;54)`1_cm_3zZoYUQ+N#n$(2hF*qvQbv?Xf5H8TI9VB3Do!* z(28{+Jl?NG^)G6^kd2l?U2+-L-k^|smHJg6h0&x-L%|X2IjdTn9unan+I)2;MfGD8 zJ{#oGid{#5yVp2=b$Q@^-9VJI41=Lw2K!GNqln;G3%~3D(<<5Wdr535xflkP$tWc( zs1%iGTISc7QaY2@$*gzCuTD11F&oI3L5kOEu`erkOfFo7!X~@D4yyff@p9y$wm2oiC5an7=62y&Mq6?W!M)fz64mhh)c86hyorE!&<<`{bUZpkHXZv zw#(E8O`?^(%9*;*Y3x}G+tYB>k|YI=XaFwKgRh0$eU}tu;+bFQ6!Rw(HQLbNb#Vwf zVVY9x9p6fv6Xed5iGrfc32k$7Y|D9$)xj@j#BKz`z!N6IJM8^YpwbMgkSQ%Ky$U=OnR|0_QslNI0RmIB02)k{zkT6ibp-thy5|VMh@dZ@1ul z)aXRJbQ$9ce2Q-hMIigHso|uEgNwakG1n_)@!h&!-Q6jke-&k{_)t4sSiNWM71%m^ zL^h&k5%qqs6dWRfm%t0qD7F&dtJTXWJjWZ$eO@v7XI(n?n`xlSc`bHRMjntWaMhh< zy{+ztJhr9&kLSFUnYr$#7EWa=L6g%l7WlR%avVPjCQ927Jh6)OdPTdjv&fgd8AHF6 zFwOp+rNr#WZY4dIA{yvKT%thK2emQ2Q&d(^*{o#7f+`!ta_IT-?BRKvuft_wmc?@Y zt1*n}SIEfQS6N0j9XR+s20q3Je-)9D_xhw&1nweM<^cSdN3KX;LVr+=n&>E|8tF`V zQdleOcG!3l9HV<1rt2WNh~aTKwNna3jYXAhI{Fuif{?Bz zqY*9*5~0FWrEP%aOKhs~l)jQ)alOv(AO5RlHi5S$9m9gn@mzmjzax{iJ(h}tJQO7J z9?;$TCVeb#gQEuV^AkWfS3x@7CpRR3?2SRc5=gb0{oG{>SG17FjxJ~%+bb;6FG1@8 zh>~xc=-&XuN?s+$Ba%GkLg$8P*R-zt2_NdR|4D&%{?U3+4~>h20cfcRB>p9UVoiIT$Lo#NPI&33A{BoL;#`KCdFcs$)W zNf!CWkHA+fWCk(1hE~$Ek{>&tK`~&F6+)=sLIzQ@L?V7Ow#=*vOdNTce(l{z82;+0P4CH3@>!DIj46dOd6aMe|s6pnA__m_)=krX&ijjH%}5n5Z9`O3#(^9b{m9V=#U6~ zFv7{%@a5Zz6G2i9|2edWsUK9Xa(qn$mAD>-e`O*SKWwQTLDfw@fW(0}$Udp>oB8Fc z+xt-QRs79w?kR)8t`|^?JQ*}`8e2?vsbn>%mIm&K##czgKihP27bx?dU*s@NJMNP? z)qRfcoZ>^A=W*XkX0 z3fCrlDBAWIhDk?#KGygG_SC$$JLt%@yhmsI#J>H&U5thc)$>3nVVJSwTp0 z1_O0mM`N-4gS=`siVt!^6UAiNiwjEw*SqRTXskoqj;(V=24OTA^N#zB0_qs6{E~;i zE+Yab#9f&x#@m>bh85r(piKbBJ{9bw@y&$Fk7ZU2IbH0{G^vLemUhwCtISF>G>6bE z&a-Yz^!N!X-I%<&92QSA}-4d?C+m&_4^P?DmE}nV0?~nBd57J!ADOUaS(EY=p zg{fH^4xjFCQD|MCNol3evX)Cr3xtoceQ@J2x31lKNC_z}B&^H6gzS^VqDqZ*@bcuc^bQmJ8f6FhRLeI~{hGr2lHe^uWfZo92pY4G}1!asO?h=Kzk^ zE*NcB=RIFuQQL4@@ZD-MiEaLYMxA#4^8E6p(kaI;A~BcDQYDde@`&8^-E?3Y2hS#- z34Zz%((za;WJ2X2HnpTqHK&X}Dy98{#&xhP()swe#`QEJ801-<)~PJ~LmV=$?BoUtfc5-s~04 z*zoo3JFp&%fil{KXYv>JqPlblPx?N_7vqRR9N~B)NYQ8~45!TGHP}=h1h zc52IYpZtE@6|rD5^|Z}^u`DfdQJlRH4rTW#@E8nTu|uua&j~hKHXsKAhS9GEokZ zrY8+S?mcL*@UHkczA6$obZxZQ7v)=I!I`uieA2@c@RVIr5>Mb(kD#wo&TH)NekU&F z_xT3*?>Eq^7dr!ry&R*grg$~cz@2mFF~&ZVKsMQ^HrZH9+jM!iHZ5@(g7Y z8fQ+YjrCRan!HVbtP%5fJh+IoK2nsOz#U7Z9Iy0f>ie)9*{Slm1gBK=tJ z1o;2!{&Ip8oD&4&llmnjD5a6?-0ID|z%zikfQ-rqg3EfEk zCVbFvu61iq(+yE@HAv$r4{%Qc+t#*m3e8<3Fo(V-Go z*_gMqGK4LX8n=l_Ca}#zlXWhbo8Q8a;bO431W;P$Et*0gJ}E~QT6WNj|EFEE>hO90 zx$j{!Isc7n$Z*l1r3mt!idcj7qM7YM8D?ZwvP>{cKn5{3@9+E<^P+@&9@nA-zIB0p z&Y}{o+dnMp0-kwMyTwh@(iooqI*Oz7IL?%C*>{&j?bI%Q{0L3Tw}{^pKh8HQc;CdI z$(T)V(D#OSXa{5aG{e(|c4(u$-EYwIsS&#S6PaINP)BxX@qUK}*Ersw{|xnMa=pMn z8t(4%@jNI;5{eQQ<^4tRbNC}5;|}MWxPkTGS(~GO22H+xoUJ{CZ&a5!y6;qv&V?wG zf%w$!9U0U^)r^d5R%Wb4Qh?@xnJq-Y+Ni}~{3H@;ci$8e9vboa2j7&iSQ$~tqD#}0 zQm~(c%~j2MWLDYg9jpApq?k=@O*}ep{HppmjHW}`w6q?V^T!ZP+RPibhYS31bW8sE zU;j$UoYNW(Kk5Ibi(!88{)xfZpJsV@=iJNjC*1m07I6O?i9a?L$d9#M@c+AgE2!-M zcVk|G$^+}q^W+uG|2zd_(ofsxFNI4ly9VVuun4fY;G39KY`KfQ9HTtxP$VQ0Z5{Q3 zFi*O|lw*84`mLm*OB15QA_kfjo6uJovr!^mM{=|0D>+gEnx&QVPuLEgXTh zMTz?c-%!5o%0#_8zGSB_A@q`k{!|9m;#8)$HH#6!O#he1w~x(3=s}~^kw_Sq`E;J- zy0e>w$&fTHXYx>O*qdtQ`Ui*q$J$-SHr8Z~q7Ek=W@hRn9cE_eFtfwVOdV!srVe(P znL5nO%*@PqJ@3q%Pe(`hN>@66T-&wRa#@xoZ`XcmRnvE#i1Q@S+cu55^^Bm4ioa<` z`IfBW5Q4DrT)U*&3QQcS$CcLO9sF{mE8s`#Fgwlcd`s#2!-X3Yx$M|cW{j)y&^9>AK%BTn{F%H%F1?uI!ha? z2beyj7d_~B4+h7F6l7U)!@5tWtDcFc(@N9aqPR4>&l8^13vim4iLQ0+8j4Ch1Yis( z_7@YwBNl1}&JeDz-$Y&19T+{z8adK6j!8LvtBm(3PU_C6tnG_g(9zxUd3Lz{Jbh(v zvKZDVh~0~jp`F2>v3l=GwtYfw=vvlqYOlM<&wsF& zp!A{e+;X5!5twEyLz4TvEFiVne0=6+UaT;`NN*VnfsTjKs&hxuyy~mASZUL3vLPKr zxtYw=*xy|$Z%$omR@c+f@d+!A+a3m4Qrs;jx~K(1*6S2uR*Rr(wLUdG&@qL{SgW3Y zBSdfnVh~MB>__iwfq&+Pq$srwgq=%+f5Qu>&>6e)M-BldXo#WruE<#$gp7kYN1GAu9IcgL`o z9!CUy-dI5ka@_sV>EFFwHk7^QnOcLZB$SNj1l>_gP<^|Mf|tLHZ_&cSdq|7J`lzv> zwgW*l=oZU8Xa$OLd8v+yuvVT~mLRoMXq45wGrWMhUEcvS8*~>i^dU={^Tdaq<-Q`Z_ zS@qb_R=$O#`w`;7ufYKBwOhHuZ3=lyE+f}u9M6m81Z*=^r_Sm!v{i-;P7BYig~XMFMg&hM;FQ@mrqpoPVPG0`c zlgJr8-yTru3y_`<(r-zIETP&a3HTit%t8@7-g0Fsh-*9qA z$J+z5Jcay_P(_()8s1q20xAw2&y@G?RZE=3_SN|QNnfee4;E zCuu(#GF8(BT+Mxt&nAi^;_wcnaD2gm~BDGE_ta^T3a*;Wo=J_M?0F7*^l#(-{$Ve%A z=1pukU>o54DfOEr?;RC(9Ozq$|5RXRJxX@{&pew zcb7dAhgou`hpmuk{yZ0`R{7_wib$VZbil*%c@&ZZ0!b2X*7+(z9;iffs8C*kiuRDUMyfWYE{XBEiVF)*YKxY$%Kv9DBzS4zesUHzwkcx#y-CX!W_+ zM$qerrjw%p3h`KBVUJO_y^T!gGYc}w0KcO_Qs!>uAmkF(vBFWEzu&5?-ijZ-E4HH(G&H)(f$XG0Zr=#AW zNU!^(*)d3=Aeeq-C16IF;Tl6fuj)5?fiE*fo@kVP((lr+Ptf?K2Ie}+!<=|}z5091 z%dPcIxlYqx(K>i#$8j{}JG`ng6NSP$&nlgN3TDxB0o_lG^zOPZ&6FgkAm z1}yX?>DwG9j(1f!4Y-@*Zz762{O3=;+19xXvh+ImyV@GhzmiGqY1IVyn!C2~aRI8G`) zLuplfF;Qi?^iw4xRjn?+%@An!YAfPc%9B9Z$q+S_aU2hu&HGfKO_cW~?7L4aRT8S2 zte*1y`?3Qz8l*43QgFyBC`_Hf@MPpA*jo|96l133vB4KC#2vk{jQSzy-#R$uOr)H4 z598^ch+Q#RhL^rUpl{G=l5CjnLbs(WL(66~t=H8Byim(=f({eA&323RF(O#lW^6IS zxa9XFT23-`dr~>rKL3*;@6q!>Q-$c@t1u82$IjG^36@gdh?p{r989$R&}g|DbqhvH z96jA(jM$v6YF^Ffa4bu-^h!SdSnx#neY$>oMqQxh*-i6WqyLjQjtJY^{~V%rLWlr@ z*_1b5(5EyX`s3%H<>(YuL*oU0FMWW^sHsxzL$@U|$ON8gyR29uZw{bwQWXb^i$K52 zwl3JM5l(H%3>nvE_iyud38=>`m8+#%d~yvueVacj{As%t}_|s$FS%IS<)Q zl?U}zE=zhj1s^5RFV%ZMf-5CTl<1@3-Pw$*0>UcZ#^}Yq=dVuT4 z@hGLncnb(tTA4iHo=y`Fl@mD?WcBKD+t!k_ob>ki|@UN7eF5& zmU>p0M=JJSOF2T4cvnF0JKo+CeM8MU4PS-d+zZ0=M=W(|SE$e(Ce5h6cOT`UcV9_5 z{Iw85acu$zT0TJ+(+sYyXxs-LLOhjj$TiK}ud5i1ww>m;^Br@v&Qn_BsBiD?-wTJn=_ino-EE zz&1II28<7x_yq7^3czXKg)Qk~z>IpOUpdNwpwCdV@XCW-vX#);q?kup_$3mD*EHdc z+KRx@lA}|ghV1q|+$6vv2ubd^Xb`EPpBK6a8$5jI#3dpN2jsV6*d~AxNzPWI8jvZ* zp|B!(A=4*-ef^wPdg|rZLWZ7=Z$P_^2iyJ$ZO1Fzobf>QH&~Cnf6Wb?9pqQMpaZl9 znV$|hvJSK*K4L3pcWow2qq{pel0OQs(H9fzPf|$Yc$k=6 zbv9~bB6zh#G_5G6Hw#u19CWK2;D;bxHj<(S%;%82pNC8JKqzbKV`){ahpq^&Nu~~U z>s#GItxq{_e-Edd2H-pGJUx&zlHKsnKDOb|RCisAY8RWbie0^XS;)!SuPr|8y%iDc z3^~d11k@MRsAD*Ar2@vYo!X}a^xUF#bqfwxHf?DfcW;|H_%;}9>SvH^I<>ZhI|;{9 zy*-&c9MvC%F0%=)$r*;?h2Ir(B?Et*4=M}BK|OHl^7&{+7{uLuHRj`F;#bH%m&@OZ zD-P{ynV{_bVoe1wrmSgiE!y~vLev*gsj;KL^y{)JV!bxjz!GDiGx&joWxB8qY@czf zwkXX?IxN5#^iz?lPC0QFyb5<=tp1o#xNFtag(rk4<8h{1*@T$THdQk5(yAB^z)V9I zJeHRlAz*;zsAOt2ScOWfU}Y%mW@P`H>l$!wG{9_xWei!6UwZx?&D4?*eR~(%)y03l zaEcv(RV+021kC_uCXe_fc(&bwqW*2Uga<5%I^u+f(K?*RQc-(ijFEytDlKQw*&`WF=}Ai-58`D9vGfDR zm=;&o(Stz_@QbAS8-;Sw-WsB-g7Z+ERWC#~=3x~W&8_R1e^~KUi7h&rQ`w3d!qVm1 z9zKt5`}9B*Yrg4Bgh4L<*MUHeocAF`VzduxSKmi~nL}ly=RVo ziQV`0my~rXnMr3gfs<392)zs+Aa9=3P{h z%mhwp$s}fB;g1B#KN-V849~yHPSU(6FsS)rnXP+Ek~!9TeiH1#ekCrs^qtl(>Af!z zec^|bO1EK@B5bWSfPpMPB5ajzC2A~%dk|`fP7HJiZp9ZCU2V*x;bFMVq8@JPxP*)O zY8*UU?%IXVHLtP~W*&q-U@x1mQ@;efM|+X`0*xHQ4KoKqMB1)}=CGEYEUMei6LJ!UxS7MG|71s7+< z`*2dab3A!r_RN2o#mJ~5$M2)YWw7TM^q`1e-RYp?`;@xb60VxTFP9uGgO5#Gm<#=x zlFF~~%%#bY9|ISfp2N`QL+<;?r9~`h;*TEQ#O`BYrm@CckD?Byi8taL9|ccA2_^Se zR*|wymlVBoEOr%QCBI0MS?4jBAby=0%xk(>@MaTE#Y3JN5daL-8wEAcA3n6^1is{W`bX4(cssodlU&Mhv}^d*kzm_5BWCYw-#IY zZ!Q0QDjq`u>h^_=Y99)*PG|J9djnep%$6qvVttv3eA|`?7#0IO82ne%6gD&b`ah8X zU;sb>804!6e;()8&JR2!0e$NES0r$>r!8SVLR9;LA>b*i|Bfa7PfT-x0Qq*4Jh1aC zV-h;4DNkeKYlO0Hdj&RH^RwG>rDS|qnOKA-7p)n{yFVs{KV+pvBOGeLsX|If`^XkjBtHz0>}hK(G3MWNG`m)r@Stl0w&X17VSwl$m4f)qDr}oFXwm^DV18dI&{)|QSA88v)2NlNJ3jh&YO zKzwo#K?qFYTz1t*q+=gEbF~X;uOXRYDdQm5c9v17)y_;J(U}(%^@!T|4QixXs3`W{ zKinOMHkz(`tW2K*4fpbKSety?8fQKUr1i!dH z-0RS5k$ksiFyi~=C*3Izg+j%W6&}5@^1ecM9t!eSeR5n{42uc^+jLmZs7_7=lJ^SC z))%{%BpfDnF?SgnOk7Zq5mGd8uH4OVxg^2EO>px4wx@bo;)DDWBCZT=Ahko^$yL*= z!7nir6O(I82*Fil1PrAWz}SZl^N^=n6MmEgr(Irs%g_@C0AMK2nkEL=+HRWIq1kGB3rkpaU1Rb1NQ%qP0G!x&gTz z2%GzWcl+AE-t3;IlISYO^|JR3#DZb+d)MZ>``y{gnw$F4zLsT3xdXCBz2;dxOF6g` z)Sc#{QPKgFhbU?4lS{+hhNH3*r-t!MWt5upC|r!wd%?ao$fD$lPaNuBSSME}M4PI~37QY^kb*Ew95f!){4EhmeYStc9qB4V z;-Eslro((R&tnLwO=7N(1w=E%*2EzM@qGzBHqDV{?4K58&M4F(viKMv(q z(^r+YWhYMi`t8lmGFNECox;RaRT!*`L?zF7L}ic&oh@DQLIS6Qb6zVo)v+Wa1xm#K zHoZ_F&l$Z07PIq1w2Dl~@HbLfgHCKk8a@a~eW+@?(49bhZD=Zd*wd68qHnS=x8wS< z!#jP0>v@TysUNqZ-3vZ`mLJqoA)7p_PPWc(3`KzaIxBDPt^=-{#MG+Hog|NE>A$sM zL+x@Cyt<|zs?Hg*PH=M;Ggp-E`c5C#etAl)euL&}T%-gn*~%1BYdsq~MCM$wk7(aN zFlfd4SLE0t*$`(eefUvIbRL%%%FctZh8F+9iW*)-iu+uh4t9-B$K6zRUoV@5_e81X7%1N6cWXSlQ;oucOdOyu{WnE+r@&mn^-aSvwI>SJh2X zIr5}#H-fdlJpKVO`4)BSzTKL_F6OYI$8uL4@W*cqkH|tf#UlrmL~_Fzt_u?o!S31p zXCwbM8+sGvHl{dPbZbe50xth5M*%swlhR4OeIXi4qE}})!6HLhHrwwuh?^;R;mVb0 zF9H_%aW`T3y0x60chZ0F6hfuzdW zA#{5@mR1S{PFD`U;$ja}bV21pdTUwvxppkkju~spCS~0`OE-`h5u_tx8xoYHH6YE( ze}GI>$tRW3hja1w7FXKe;!J(%<-UP6OJl72sPO?JJObZBzGf2I=RXIPFHe?w|;_q~P^b5aY}~ zZdzv!ri&Sp4yo0am*{4p4!~yqxoVloerU({FXu9;`!s!>dJ5;X9i+#Dl2ihxACk;h z-+Br3Gq-&344YJU9jx3NA9T6otlNvovZ1wH%U;l;Q78gk;EW5(xdH#c|KvhscU`$2}ldEH(qTV#_kWF%i~W?5(#i8`z}RLXly(<-&$N zbvEc^;Cx*?uX$)9%aHVfKVjjZJm4lvhPPq5xsmlG>A%^iAI1sckZEd;l9Ad`)l)rH z1V?=}d=rRJCBc@nWOm6MGoEVj7KTBGiVu(#Ug9@Hp-gJj3r##VrMAXW3guV_lpU*h z3T&6~wW`&4@Y;(pJQBuRxlPy7Vf0#hT6r2Rt>Nm)Z<+O4p5TuVd9%ZF+{E47**qtq+*YW6x|#f4<;eclsNLP`ADp@Bp*6pilwj9ziTa z9iH_)42cNVr4fvh85*Rsm1_RoIj8_<`=c#n#3m7jJ+pRPLxn11$Dld?rNyfJn3f{W<*%~J&9Ew*(u%vIQZK1{V4@jY3eO+Qw%*;{^}#yCxF z?U7AwML!5rI1*|>>y}R?z63K@$vZxwDIlPL?lgNjuOX8uR1xdkP?QTYdUyTJD>3|M(;-tEP32}Y#jPBS zI#(`}ny{4s*q$u#KzoFkK5C;RZ>kP%y z6BQNrWfRR|?XoOYma=sLfdR03W>(xi9dbf-!mk-R$}S~R-%GP)#>h^m&9Ji=6_7e7kT=}&yY4hKT?w^53EFuyH{x0 z?3@)hDKR%*4!4=Yc5b8(`ylKdKD(Jcn=gb#LCGfNJ|pDBa|!NaV7n`#f89lPeFn>@ ziyMIjib~5yx*EY!9v;GLuuGEx;nw>@3a;~eBizettedh|b$opm-Bdt53(dZlw&y4I z0K&oSnq#GLPd&z~;mhoyG09bBx&9qxKS6m@w;)A%QBA43UL#~?M#e*#d4G7&3gRc| z4fRt71jd+&{qr5UP9+W&oke*@VD<42Ep+9Kjg8T({SF@n`s9cxkNeK{TyaBsTnDqa z-%X8=`|BiyyFvZdOO%@Q%dpPh0~|O4Yhvw*Dy)Vu2x>Txd8W8K0KV_L0$*dgW~3M| z)eOYt<@}A~%fo*(GF&7h14=tLOc7U_q@Rx6L>2K!{*X8ce3c}ck(2p0D+1K$5N=g?E8bob<^N?j}Wga&D*GTp> z46vipR~045K9fO<3Te+vRGf72NTPj;iKlG+LXsD%p}+OrZ8_pw$v`SbA9dCYrTVEA z4Coya{A5hr1e~p=k6aHqe!7}j@R213N)mSO`L(y6Jf@@5oVBp1UiibPSeqHed=qp) zW}WzEKSv^A7XvJ2vtpuBm+z#)bJ@56_>P7tsy*xp9~k=Mo%vWz${ zs=s`#Du0Ae2c^uI%<;(Np572*z|AVhn-21>_IJ%GZUA{TiHs@d$JxypgKk+`pq)0F z)6zG?$=m4fA5vSVj5pF-TuBGC`%XAmh+382SG;@^Q(h3tm3J%2L#$)3SjyDt@y z@J*K3z($KPAA8=IS#AFxdzveQfIGNKVftMUSk83RC&-^_bzTeTp4iWp5cmrNCKt!&-3t@F3d>-w?8 z_Q#-+FsZnr13kYw&$!{7j!|&KHm8cJ*Do`@^OZ<$v6-Xqm;3wqoqnob?v5W7Wx59b z%}X3YLR?nHs?0=*lGe$sRZ@EarBxInBlGLOyz*qA&}950Y;=#^_@VT<{xl+Jbp7qD zb%+jq;@IpDEHwIA9aRJ6Deb=bia)XBw>E%Es*Wan2M|hPKg54js<2RP?BS(ak+8y? ztkWKV870;PC!&!k`|<0;y9Ef!fSbOT{f?U8b0@8jW1%L`7w^b)G0vh zFY-Ft7nG(D^;;orVbbCBw*uG}D9$Ed7574RoABRqleVai@D5jpE`k;`jrvO?RB5~G zP8LmgO%8ZnEdW4{ixv%H#~0-S_p4=?)?gu2a_7QWnF*DCnAnEPsxMwX9u<#?wxNoa zc~#35{b5SipI`@;FK*P9fRjJUtJNe z=hCF_0bZ(d7eYhB%JM!4IZO&L1W{{(t_oIeZjJomS0a?{afgSy@E62yB^Ny%8a(RJ zX6YUcGn3Av$S8c$m0&B1z45L=rm$Q%yEcqqx9u`z)}Sx<^<%0RW^;qX)E6+*hx`OU zV2sVj!Ku9na%CQJ#cHnj=v>XkUW+W_+HB$FR=+E1&;f2rkcjQc+`Z(E9^TO6{=`1s z59buT zxrxkgYIJ*AzkQ?r_=ARGLPbYQ@g5c((C6|CLkT}onngVfvl*IfmB_AMplD-;iy~s8 zbQF$iozW^;CDS&Fv#9$A$kLC(&BOHA@v!-Z&hn{>0G`p(A~JIaOU>={hqovILlBCK zo7+DWv&Hxg#pWv_5`{qM;1m0u59~B)pCmjIhGf;eB9quA@`pQ`GwB8H>2i(D{F36< z1+j6!{_X2yUu@!&`cm_m7d^dweIynks_F)wyzI9U+r40<>(-X)t^MHk7XbPIUB@*j zKbBjf+jVc~Gk{kD*w6C}Kp!FKxHjO&I-=T~gloQQJ=QqxhV%3#9D+;N$bZqddawhv zpHI`;KHE7lgPPWjI6#`G8c#N4GcOfqh<&_&o*~qe7-TQ$a<_!I06p$H%f(!1lI_nm z^vdRzqWAgx%hSW#^I>7(AoP2%Hi?zclgYEuuqcn~&q1kLid0#h3a@%7h=~hzOSHYH zQ&q8nvWxoK2gpTEAq6kv8JnR!ID4Mm0nUJ9kq}w=G&1wSbPnCZ0+=CeF0~r6VgBG! zqoEAaX^BmeQPd*l)aoQ!G@S8hm)mE*<)*igQ)q;{lW*c?n9jjXQ3y(ExHH4Fm9YWA zSbqx^nynxF^G+FUMUmiAa6F_hmq&LY>3JOh+Wz-3$ZqhU)K5kQIezH^=Ddf2zZ=PV z$($QFVKG355K#HSbP%-uZ7dO0xR_J!h6hW}So{>TKR`eAdI7duUEW_ISx2qX=obG1 zmYKtfvEM46kz^K*5qDkJ9pZBmLXPxyGhPz=9<{`wzHtm;hVA~BSF+3FUivY(hpKy= z|FjB{Lp&~Xz(S!~$s%bJ8r0I6OHd;-%dybBg)eYSL-WGk;ycBzuAExJEEJiS9fa@mgF^(B-#cN zsRlbHv)K}(@AHhs*pVhBUfvE-jY{78fIEqmHyhW3fEu&jSE;zFCco&mOV*Vj`);cj+cyaQ8sK?5L8>p!y)(c0H$=@6K!IhueJ<)ZPdLA zOF4p8hY_h#HI2s;LR*oO0xfB=qqqi(|42&}?QBe+<{NrIs>2!5D6Wa~vEjjik+DIU zZQ$zliAg5Ztw} znfO>B=e`!{kcz}o_91jYqls`o79+{SnoBamU?Fj(nn}mzqNHR|CY)p6H^%q#y?JIN zb!bSyo9Xq8A&2OTH{|O%HjzQz=T5-O$I;R2eXjYcvojm;*(>k!Cdqn`{c+N~m$Q7p z5HBhx*ZB_5w;*8!ZW^lhC}P(kALl;zEe)JC#;jwuR4VvuTwc1kM6)Q(2No&oPtZkKS9jM^wQ7*92yo)yLe$lr!X?jRDk6v{w1nDX!q^5R6TCdAz;o z{1;vjY9|-KPo8c`|EeIx-`N4*u*#x22eQRGek~7{D$?AB=q^t>$+mm$Qt{}5Mk;g) zCJUE8cD3(57)z;_^(L2C|Do2B$86^lt(8(POF+*aQgEahFnu>7#p1-u?n*e4G3Vc7 zcdJvXFr<=bO$nN@20h=R1|``4!-9o^o`Ya#K{wNvR@w*+CC6>A#G#A%U6xt>%Vzl) zP0K9qEoiDAR;e2SwB_`;(@%%y0!JY{LL_gJE-sr@EPk2m@EEqU$}*xC;~YEj2`p`v z%egwTy>iKVWS+V;Lr0pgmfMR+#VQ@^cTZP!~wqp^VB8X zM<7E!YD-(yxe5`NkYV=K*%a{CqfosENveZlodsq=He~$*=~)CVU2-;?3IEAQRxkXD6SLdBF#D&!q)e}cu~() zIQlfYUeMC%ss)*^wB0?@!<*>3b{o^+%pc)4GdPG8e<+6}%p|_!A+7{{`tP(Lm=5O2 zxI#8&X}TumpjIiHS{Vmc`azVRIu8BA7+H_h$i)BS7=MI0d)=?iP#bXbkUS~j@9c4y zwh!*B2{R?R=Kokh?$JOEVxm$oHHMClzL;stT|JmCkks|rUwtZ0WVsEtksT{>a>4Q% znZ%63{N*2ch^#)T{gdhSyE1CRb8taWHf66FUJQ7?KX#+{2X&#OVd2;ktyT{4ne|!b z+SjcIr<~MmnVtUd}?BJb!ubNLcGm)jQ>c+fGV%(+J8$%^F6s@ zn1}ILPnxV8i9~hNvTFEPHqSeR0uPyy@&^MA^nwyo*aj?y6b~Xs_On-Co!-h0xb8>@U$oQe@aGg z_0Invk`Wq;s%`S*E80aRux~p?wdL*HTmN74BFf3Y>tIX%1IVQx-RPu&^D08g27<7w zn7Om68jT~xrWuu1SQeL~JjF#5R1EO-_OjLZDU9XQx}Lkp!Th)Pl4%zbHlxkKv5JhpDb%cp(qh?x8^5N@MUHOVAA1HdLUJl|Sx)@0BUDCq`64 zs|A9XZ!&5V31sZQ?3cMzjWQ0O2<~@s`t+pA)U@#jPMf1${e_f37)}(gRj!Yy2vX&` zsKc5#V$4%aqby>H9Ckw;2|fG(QpVgXQ{#w5I4F#XWr-@Qw}fyT`rXvkpBt^cg;T0B z4i<&JWX|+gkm+??SdCjsRIzqbKRc{+M|tiRI?Ha-ypB~}ox=OlMHx|7A}6XP)`Zyn zoIs=H_mX*ih5LM3V;c*HqWu^qHHFkM?*;b20QzP84l{4&`8|-!cz=g3RPYX(y-WDO zwzscBeGpl-@k4rW^g%cNs}+Hc5frn=>7NE!0EiSp;FhufD;zif9W?}OT0(VY&<*_{ zJA$bCfg$X=me!{K@W&0Hg0zkiA{Jl-CXb;FGpOE^V&+Aie+`D7o zfFwZcjYQna6LzG&B_Tn_LJ0}1!KJ@%`3`{}&e=WctCnpO<%}~`yp--#x)_?yXf_93MYz5?epivWBN?0%ArAvr zB3M`2W7PTtmqe2&p|{&{dH3Y}s3v^YB`41i{SrIU>dOuo;1)GO0upJ>N6{ zL|qgt!)S}fC|Kj@JSt1ZlrpSf1;MnsY~idGVHJ=j+Dry3vt$Q!%A<+@FPf-$&_apy z4^6}c0n$W9<^LC&2tfUZCI+o!or$p!nAP#JU=4mwHN?%;CoE=^0@skqsYNm0iPInM zF$?q%MCJt3;rClr!$K@njJt73vw!kbL%J+-s4nqCs;&558g26QkXM%>P{u$Nc7hKX~3RTbN5ci-H_G9b(KkZ^H!tP3UZ+1R7XYL1EqB9i|5Eo9NOE zV(1LYpC6+T&cYU)`i! z8aL>}{vSfHjE!-YcYVOJbP=Ht-wEj${UyHfA_#BKOoQfhnDjy}WntO@zwaEhiKMZM z3X7Kg%}*sw##u{0=w$7MbTaXcm{#%mi8dWhu|zG;&&e{omi@p z$F^aWn$NQg`$nhsbnCxa|6lTo1ib&tD<i)9d_ zA$t7PAy<~7cU~pT#R5mk3$VI36cQK(DtC#6UBDq7ODQuyotm)_oD3lW>+iz-7_8vT z#k6%s8*mx53@jym>`YySo%Zwk@nuNOo)U8!9$zE)D&vCp_r0rXB+o|fknI7B>9Mz- zNIwna)DTs?)b?L|4s3DUpUo-+g}#mntwc?zgsTWaDA$(OSN zPEUg3{^C7)e;LydrjLms(g{S%elM?KN78hJy+e?bVqGyJ35U3MCu`9aA~u>aPZ;xb z*mb;jm!(Q)CfJg%>T}`=0iaPHH!!+k2nIB3BZ=~Qi@OwHrz=l1S+=-t5gskytOnDY z7NW34s=(IN6>bC+!}cC zn`Jj718A=|tNpOKX%%A1!~Bc<5FGdGf7l|=5O>fLg^ghNmt7wWok^jbY@|N-19eMT zfF4Mohm=0kC=4Sn>*=S>cEWEWrtHq?QpoEM_50q6_ z2cOm?{z;$#^o(`&LOrzGsjf4fWE4r`QKM_iK+ZTCEzx>xbIx9}Np&f#G~Z(^-iN#8 zxQ%~DfN$&ScUogb){2P!8`s#GL4Mi0g{1-xS?{BjK#kQpXUV4ALL+8Nl+&CCR;#CFy<%N|SM`q4zhbC+*tTv@FcgIbchmev`jmXBh+%;5LxIBK$)b5p^cGEi|Du5U6?AFa0rV4!4R$^D z0>DkCrK07DYdHq5BcovN4yHXc^Jt>55$kUiRQpLJx6zXmv`kTFVwYcRdysy+%1~Zr z*O+cU*%lyeb!F?Lir6wxPB%Op?z+yZzv}^Ypf2Ce=uU@EK_@-(OVm~-XTkZ&FZ}9O zDL7rL<36t;HN`gM&ojlXPA;xD2Z{|nc3Gy3JCZj>Y>~&ESL`~Z(DOdvGe`K9(D*r` zI;4>}@0O!|9P9s)iP z?CBBd@);9}#{yITeIv0B=}QdM?|(*t9*XnEW&y_j>ptQze-t6`R27pk5#qmImIUXY zcM|gn9FQN_`Dw)sq_H7}Y+v6qhXc%huv$NXmzxwYlgazTm-@+p^obgW5M(Vsk~}97 z_t0s9Hf-Hu=Oh@ey*%j^7f0gYb@w%TXh(2WFooT{ExW6u)H%MCo`)nqz=-Xq- z<jKmfz*$AhBJbsyoNWz!GStV zt#lUV_?KudO1?IjL@tDhAPHt0sPjM>U0*W=^zc@Fr5am0c&p|ArTv(J+K;KUzNe<- z-`ej9sQs4zqy2s(lAxE1zsB#Y41$No<>u`}g<)?`8BizwOZ$-vp~CzDYQK~)p!Qq& zxAwCt6lX&<`oFCG457Wr&i|$TApWiWeE-pYdt{DKm6>=1R7Sc_B0Q|j)TUmS_$Ow- zb%c}RbSsMA)us$(nOVW@(++lg-to4OQWNVPMB48eI=D z5R{YNQe0UjhtQtKPtiIM=kx*rL?H_RHi+J333JyMjc>lg9OKq1RKSS=_X%*4Dh z6ji$}`#ERCQ6f;Sxky!|j-_P&$ONlf1E=jU_x<3!uVn$cro;31Ph!n0`rD>B*}@wR zlQtAIa_D-u z0TU}G*)w31I$9cgUeIhBo)mDR`wl(h$&~Y<;ywA<%Je@is+14(0>1HNz*So*DVi*< z4go6v@+H^VL!v~uTmSu{AIro3-^HIWQ2a$bxXerbTl~$4gZxMQO}D$Q9VP17`ExW&Z#_gdeP~7@}&2yY&;L zzdAENYCQ-(w67V4Rl=z}PQt=3aJ1Q<2oe=kIe5{mG7i4W_N);TfC$QHJnH zZ;Y!kWr&cM=KnHaA&}DAA|Z9W&Q-2oBgTawe4n?QXlvutco$+jZJa>z55pfL;%&SE z?I*A_y)6|p05|{CMK4EEI;~zUvylA$d^H(x3N0eUR($y3E;qUt(mNXxQ&bdehjU!@YQ5f|EuZg`kh;LtYR6u4_} zfe&4lpgF!VxGn1x2Q?9gbRT<823>HboWP$CMpZ){ypP zl^ijt&XX_;7YMTnjEY9&i4Uq)3DS!gC53D+pQm&$0r;7%Io%#PiiAk`OS47TRc}_N zpQ<(J_8xnC#-q$v%B19_nbtc?0n#)1UplL_Gkf|s4iJxQdCEacc+z(&zd`_a|9*1XC43NU5aZhz)04I0K8_bQU1{6FlyV{m0{ zxW5^6+_5^gZQJbFwr$%sI<{>)>DacNbnMyvzUQ1d|C;~Q%!iq8r)pL0XRYVn_uikf zS7lxI^#k8(u+X0-nzDGrL7x=Ea+GwP-qHfWV85${={=$D$BG{&T~3s$@i2Y6=VyX@ zZV^kyEXs+{N;yxAZD}baj53L|>jy3HU6nM50PWC|3Nah0b>Zn|0;H_H8iF5)3zU3U zMV-v|wVoS1QWki_toy;QUa0#1f)8Wj`20@z!y#t_vsb9h5{Ncy3)AoJLQyjiJWn(J zfrUOo-4~W0=CyGN=+do5J!PyugPddkHq}gMn3EAFZGck_rxOn~@4E1uQ@*^N_~02b zr@4R3l={op{|aVXRuEByF}fkxR+!miJyh2&LYtdWZk`%rbH}<>Sh-#ORI?~=)fIhiI&9f61%Z4;Q;c+$ z9(fbTX0nl)l-=hTt0!o8S4W*cq3^4~ga!%1)|rJOXF3m@VST(=wZ+}VVp^EbA^)IR z@YYOk7-Of?4LkxVSWA_KuKc3quY*GhX7oOgPWJ;lCQC>q}H<2wvv&KSH zn+YkMn>OPkg8I35v5+8P#`tsF z2*ruXLCkf5E4I{`#yui;5zu)XZ5pp!x#81!bw3G0mt8#2ujQcFJG1tk{s z%{31h+KDDjJLjM}!8I*5P8QfM?`EF|Tg4q>qF0KoR0D3jdKJIvOG+GY3wS-tm5$%% zjA8>lALYy4%_GK`_&uF_d^XGAu2>B-8p`LHg@kTK9PL-rF=60nNk1up#PhYq`H#q{#LvJHb2p=?U$0nFFWio&XeluwR?z$*n5<_Dh!`c*QM6ot0;Q+|Vjt@sLxU_MR>Y$Y(VpZOBYdOmp zG#oUgR~C&C=p8567&Hf$i}GFx)K5&y`Z*T=Z*eXLpUxaLS!4wDEHn?vjh6!VZ?Gd1 zRKWC7PZi|(eT@OKRNe9o=dH$fJJ6V>d2dqQm@aG3PR`5z^9^aE$QIpbaHV=uj(F-D@ZnrtiWspyN ze`yqfQYSZ;V3k>yc&Ga6$5bvhY#K)vtfI|54ten`J{D|Vb#TwJ%L7$YQdJ7bY>Eeg z$@PGWivknL<97EZxQ(1;Osx_ljns}i!^nliI17e01`LtnxcqcZr}5^>OmfM-1AWp-RCPhqc%pzH`=n447AH( z6zPdcjN0Gdqc@81OIGgq%)qSB|2*Jb7eBL-nsR7ngPEEtjlQI5H6Bi9P=*58N4Yzl zG$nvdtDHn0Rum@&cecQ_O=cpvR<5mqC0AyE@Md}~E(KUvEK$uMmbgv2+`xx{bSx8( zYNnDMPA57UTWLwx)1<+DfB(O*eAJJBSw1>#=DjIaVe9edv9Iz8dt=q7l&`+UdO8UJG&%R<trAar!2kL$!hQn!Jdo`c38v~M=8uqkavzk`kNbCR_XwBHut(v0m0tS+H)~) z^GEhN#@hlCkczQpyEOyJ9!e>_;a72bzcOforlpK<{DwjHa`+rua_Z*{ja^Q1#x}lt zSJs30BSe2NS3$@Ew3SO6CI)hfJgy^raW3V|>}a zfcWL4$4JdCFH`|=AH&%H4cw<+`k!zgi|}8#uU<%tqV6BKFPZ!NFWje$ahKP{u6iDW zYskCitkjZx#c+#OP|E&AK=I<0r|mJO(Fk8+Exy=f{%7QpyeZ_h;`i@jtr_gx{;{)mw_ntI%`5>ljA)PvVYmohq5+Iq zxT#RkhzpxwspWA7jbXI=8e?8Rzw!QV-0Ti9B7ljMc)3^ zi5E9!dN>0c7*v4qC*g(RQGG`{YxO(Tw;0NFp@s+Vw|&*($NT=F+giHu3>-V#ocZ2k z?W#H?$Q-vupI+^4(Z$mUrdRq3-Zl@H7DvdQZ_%U5~<%X>#DgGEw!O% zuTI>;#c|ARs)-3)#owsJDej7Eb@q9P|7&`!uOHOQ{B}}7K$WbbD#sPlr)`Y zy*;!x)vXuH%NO)KtuBVUC9d!wW7<4Ow{w271Q6W0YF2Lr-G`F(Cjd)bb|nD{i-F#j zNpY)W-WjK-?JW7hH8@-w3tW)N^g{%dGFXi2pP{{_BiFSAOs-6A;nEx(rth4ZD;aDt zz~EJsUWcAAVx4trUEY~Tdj7E^>dsj%kPGkDt|PyY zumUhS;&yS@;_3lom5*oCdebr)`K|it25$lO-aZ~pj~8$qCN*WtoX)v3Swtl5`Fg<3 z4K&mZv3aau2Z8c+fY3!<4Tw^39Z&AM!<|c?%hV?pOR_Vz`g~{Wcy29#YWyw)jUKj` z6M;IKqVBR)<@D`cFEN1=&cUST1^#hfMQcLr28)S??JFLIh?6n&F5a5OOyn8&eh1zs zl*h3G3b{U=Zl^#ABeki5gd#2Eb*DPKJ@}Gytxd5#u>ICk;_>IQ;hJULY-*EIo8NRR z{QSvfs#I~xugx3|V|Sy$kx^P%Z*X1DznVDtqm9eAmh0`fJ8suJ7CM&bi_(!Gm3N3@ z3)&$H=Ao#_S{ClFKk>KOkYxHb*!&U|@eMreRgTO{*Ltj$SY#rGp%W9ULJ9<&XH^f5duNm<;qb#`#pW3Jr6%YexS`$t@uZ~ zhkv>3B?e1#Y~;fN52mvz9I0L&<4sSyvB;L>1dZXFCOLSt)Z?wojYbA6Xsu+yj*>A< z3LE}F2^Hf$;Zt7*SPtFevXTpK02BYp8Yu&_W@BP#CU#-F05$nuTnfso9dK;%S}Itr zis)uiwtG!ZOc%^sR(f$)dNo1$BJnE($P628tEfq%jvd9LybhmIb)e}IIgz$iEN8~C zs1Ien8b#_`)=TEr7btScWM~XX*I`|9{2i<30<}%^u=1r&wNV3~)`6q~mSa`05C-mB zSUIS&V`u8qiPj{RCo0bIHD_@28;91des)1YhE}I1))F~nL$S9=WGlh}JUoPbOOVNa z=j8dAkp4TGumU=7vlt(%mx-E4-Tjd!m!)mGojeOBvaIz-z+bl|glg`8Q(ImP#R{#q zGJT}O|7m;O>b*FNQpq+nFg$#aG<&^;-8Ez-t>J~i^)>FvSD2GtB+(M9;qPPdBh(E> z89A7nK;>t@>PH>?-_!N#DwW<1#s;f_Qe zb;3Ig(E$9EH#XI+f%_uz-eFX{gSUI`Z=|XleYg4IS342#j-BMcxmx#JV$fk(F5Or{?j|sxQw?4~Sx7@86FGWC-sI&`BwW34Ff56+xt$~W zfp5-c##^ibL9#-+zl&dx8p61SD3J{aES-6PQaUN3NCY81@}^<|N$ z;V?x(hHuGh(u4vJcZCLvkA&;5AXIUPD0oPl-gQyZFWmSm&E}{$JKlGzx}rNAt*0vWM3Z z@tBr{mCX68mKrq_ksID(6}GEqphAn~I=aLvwG*S74kIe8L)ZPtBTYJz*BQmlEb(ot^PXE&^sYDhb^i5~v1iBZ}RrS`yocjMFl^nG&{m@5EM4LE5 zG&%5c5J_>t%dvM?aChz~%|RP^toy9NO?GU73MypP-2tCfbIbe;EC|^~S?>HLKLKm1yEW036UbO??v+jmIj4u3(uN0Jp z{pE+cN-fsuJI?^x*k$aez2$#XOV(1QIIame_W2X043o!HOKnGk{`l*bObL^A>lCm&yH1)A~*z&WmS+nLa)=|&g1f&j?TQwRV#2FhMHGkR!FZ_>y!=c~?h@!K0wn-UsU^BA=7&7(HODjTg3&vxJM zl5M%Ri7d8y3$11aO{UTGwTW6orr554S}kl$B{S<$zj8?sp`4+RTzJAAlAuVzx{rt4 z*6S`O>Gu!hXmVOapvjO_pe2?0WxCR%2*NokWlBp(&Wp7*r;#7ZplAvI{g=~Dp-m^X zY=%+w=X&idS>qJ`6I4#3^X$*;fC?YC^n}u(6LeaO!@v|YVXKA#RDTUoS=8u!O@M5p zSw1htx=p!kE&KW$!_a>IFyL9q6hGHUo?baIV4LAjigK`4GVK!q8C!);0U$2Bk6t~Ru zz;L?Ga((Xve{&^_)l=@ki7LwW{MJ_edc=;MpgwEJ-Q{~HR3Va*uUQpK(NC&v@&Tc? zqC#*Jxmxa1#jRdOVrm5&a9(KDq5<|$=e!cp}4{+qj7 zUZ{K0z}}Ih&ir)Ok23CGUUKR>NVel&Uh-H7EE-DfKY2;^&MIH%|I$7Jc*%94|Hb>* z*1ho;mNYc}3rjAc5nGY9C%`6Y$N<~c#wzzQRY#(Z!VzL=DlCN=X|@5${P{z)+?`nQ zE1quWUXufaMe`*gi{=N-JqS7nQ8h|woWcFi;zH}VOLF~^@SE7seZNtvVPOqlX!B2u z(?2YcOJt*>hv)x|msBur?ob(8kfvM+{&~0#qh8Sc%c|y0Myf^tIwjq3?s2?C!a`KBA|NkXJG#au`*HJn~4hv$mj-s;@14&kzogAJEV8wo@6g zd-Rqk8Y)kVn9c;KAJfz3hBuok)|>RCdyV80g2%C3jt~D4KQ6rq@ukI}5sjUY)=w5( zE`hB3+j_HBBQ?jinJS6*F=^cRlKNLc35OKf?dZs9F={j*@*^OmOdm;~<6~`Oo6!`- z?}nqSul)w_k~{kU@RG!c|0ge5i`)n7^)D}}L8-hAqQ=1)Z^;xrj)opQ2e||yX^`GL z_|YJ7Bst8L_bx6O&rU6{mwO*Zqim0YD8pe~E)~7GPN(N+W##7g)DHf~EP;3Bz{*Ty z=vVymk&N%lUC!72F@rQ;Iwk7C+57AJawZ;at~BIh5|4!}C~;E$iv!;<1aW}HhmPw{ z{Wt;31fSeqt$ow>SPE&6Af8T%?<%H?(Gyp2we;Kdl64d9DYkT^DH#kWHQU>Ja52+u zpo0dgwXay`rQo4`I2CqJt8cx<%pDyiln|zLi`Z*bE1X;6{C?JFHprk>1bU~G>}$38 z>7=y6yAW>PRT-=WoqmvEmpdnRnd-rhYsjHnR&Qe7&?ay4>k?(AeFZf>dbij0J9S|n ze~G?VkX0yy%s@^^qX{=*|91ru_}6&JIxLz3PWFV!(Q@zS-qy3E$wGs3|3!SD47S`R ze0qW7#EPXh$^rZm(2JJKS*`2fhBa2LFdtxc3;t~8h^!1{Ba+JB=BX4GyrEFh{jm&L zs}~St@m@4cJ)I3f%%Dt+BIjU%XZ9CF%T3;6!bf6an+jNET&ihGLlG3T(f77NQ-@vn zimb=^kDAa~Z5J5fu9H&krrm4H3Al;yU6dZQ5?qOpqJ*AxFArv1rQmk7xv`p^3CBOp zR^C7AQvP3CA8W!5{<4xc|Npa+75~Xf%9Ls__`BgvYl&-5d2pQm@4Sz9b)ILcjMx9; zd;A~Y`|Ht?E|LlAG0;KmmUA0;p>E2i9nLoBCBwVFrO%Sb(j+DIfVcfS9Z@@Pb-#yG<5J;tKU5)q*x#1KB4Pi(|a1|iPho@AN5S7)*(Mh;l zRxK6Y;DxQ!V;y6NfpiX&~V*hhgh^l4&R~~7Z-s%(N`IGdfhezAI7N3_U01Q>ykoKG^eV=j&O4_kVU;>(jy2!G8^_OX((ZjF!h%+kz$#&xO z%5#9{52icYf|G#GNJf&ZAS#XC;_&d*s8Gc&_-icLB8}7I^`L_86D3`Q^+f5r_4Cy@ zG=3Sa*|Y3s_F%j0#2r2%3i=)4OVoFZ*DYCZy@I{R=Af4rG3{a#-&_YTmtEQL#TG9N zc$JqTkMH!DY=l2Ymk)4WFehI5Mz-4q6c9t*G|&`I8zTKXZsr3la`l#eN--W1wlqhZ zIAczvY>tRo$66P^%G2Y3Urd>79td-mL)Vh&!(&YwVcz{m zQdu&u&X5zH&^Gy{Jo7geP0>@qQ{9~V%ZkK-SgKQ#jh>9zUwjHLl{`K17e>bn>Y8Gj zzp+vZ7!m}N!#fi;$j2?A?Ly0L@p$nJRsFD-UbKO)s)1Zp{W_?6n*dh;FPo@4SI~Au zBY?|yEB~yQqX1RE0qfT~s@`av4v>upK&j^l;L30eU@N4qg1+|OHxB_SoB_)>u1SAD zqsPBp0HxP|OaFH13HIm&^uPu5=otRb4<-SeX#?9x`KtPz=Kv}{d9&ap)!zHD6x zV6tfv9aFaHNisQ^o+#o7P-md#=#hW#HCLZ`B6~^7ZK78J?X_?ZmVB?f+<2P~U7olI z4W9keQhf&f(uoqvK>v_fs6VDrK#$tc@#o9pR8ISUOcoz7J4 zkzAyX*{VFvML=v^byhtpJY2?78GA*Ry4R>5n?GIYqd%xRHAIZo$j5x8P>8Kh4>x5z zDSM<5vl>1kZ8KdWUwi^MF`&s(e$1=>XrfS&<*qHRtu5XXjTN;SP0eCzHvMJBQXF8B z?5aM6Jq*_0BT(if9z>AHoWW0Z@K}>G_&u|8R77FUx2_zSuu!vB{F%s)Uv*&rgWF_g zW6?tUJNsg|d~_Z|v_E2WgvF%AZPfd6-}q zjT9xe{n-Li>Je{e5y^o?ho-4W(@x&{7FigDfmWgpH(#FFc=4JEO%H>JNpp83G<*d& zCLvgxJar@HRZ_GpQv%y120#w0vv6eQet#qXRU&tZh0+6_%sU50x_7N-ZUwBP0!EcS zW7j+~MF?y(;dh6Mi%XASl!suN4eA{}lAR0c{@8tM+GT6hi+@s*dH?|- zCfHRgo>kIr!5$b+p3ns6a2SW+Gq}DlXhq&p=_-AJrCa%xRUU=b+cwZoIN~Z7h*M=8 zj{xvU5}`mk|A$9%@T_7(N})eR)W}SPQiCbadjgH-u`DSVOo@EY@ov+V!w!Mqi(uuF zZ{h+a9o6Yduyz(Dx@~(}!@R^}8Kgwq-7y$ImChAefZhOulzNC}<7V8U`BG5q9VaEy z!4bqizT6J+(S8Ab+4d7vO^*+>EK)-LdL+}IR?`>#IRam(7m3Fl0yzoe$2Czey~NBd z(gH>LZH*iA6?JY9D4U96CV36aaG zreC`GJtgCv;}+t^i=IG01cSdy`#c|p2_-LG&i8{XZ!!C8jh@+}Px=j709fhWH{Z|T zY3p+ZD0&+6$*>pXJPsP9g;*6+mOX5soXV?O1tS!^ncU#lXJY$T9spRXI;@7<`0@D< zSlVPZK@Bw5l#)4+ZIe5Mn-uGOB_8}@UA9cGYU4=vE{zD?DKBm93ft1$oo+p823J=a zaR#O$nWUsmHh8}yP+{^$j~zt2u~0M7z9z20U4Z$3c`k)tJo3l04Iq+q56$36vrKe= zG5gd&8D~>CL&tTtMu7M-qA9guM^$o!zQ)MZjy{GZ(h|gHSCuzTX(MCgMZ)=-6_(lz zGknmd$uzsv7wP-Dy7(sSVmKceT%GF2Bym8k|FVP`&bK0beM1cpNsg})*PJBG2uie& zv4*X?I>$9ULuoQ9mZ4Kk{UB0PIUPABYE&Py?ngwYs+qm#6!=+Tkpc*~vD%MLYXpZU z(A@f2PhI=kh9Zg&Yw*aF6KtJIYqVOJf#Ima?*>INj30wJWN`y=)~=t%^X1KCED~YU z9|^KMUna_jPj~tYvHSxH0G8${*pS}4`~^!vv=l^q*trOPj{2v+5!?VolFx&VGei}kpPWdK{3+7&zbq{1$i+&#iWMF@I@B4Bn#{`MsneAl(8d!$)uM%exLqs5 zc=9c$8_>0xZRyMJ*gahw0)COw*TE2+(g?EUz{%c*%1m*#aIMXU{ojkz=0>CDeu~hJ ze;({#(x@XZouaX>LV5hLrwSLsUIFXShw7q!wO*W{t}qOb|_Uym(IfYtUN%O(7FxIzS~U_m4_4fL4(7Xt?E6MlH`b z7_5(fesK`%vfmi8sA&Vz1Z*g7#dDr5nkjNnI6J~XRle&-dw_bj)wdq z5PDdNXiy1qj-2?GfM*es{l_rkkfv)6*-J!;{P2-eSWH1$1%|5^ips1cPW9YFl}6tH zUxeN-!uYol;ZYXmOpg*fm-^DdwT-a|=`Mr|9GUlbzVIh6yQ=oaG}&=8_>})NPjNN~cVBXZH;f zFpuQ`5&&4b`7c;1>93n3gRY>H80d+m6^oivLFD;khupGS5UtQ#;sT@H7<(hBYs*V`ZrQ976m=zaus7&!&l+u|Gy2;D2j_XHR%!p=gc832fA)giF3ObV@C9Sq^;b zSB|19j6);nGxJsGot3ho50zl)MSi4(O<4+@F2sl8;m~U^uN-_jw;O*DWDU2A zg;^qqs*q;_JEaJyZBGfm3pyVN7Nk+>4W1wX-o{3;_-x7%Wg305#3FqoMYIBhKi8Ee zn1xKlsNM;ztIVoM7ZZOWep_QX(jVJSr-R)_Frg-81pGUd)0T zZRbGNb+*dLHn0L1L(Jj9s!ZTHI+6sbezPl;We{O!8pMH5SwvZ*z$V09F2XK}pf^;= z&C%M}=i$3Kwj2i9XZ+x}jfavkr{ZEnPZikWi>H9PBF%wY5tjif{mAN@eU#oJhCYP~e z%%b9F`!*X|A($X`UPSLcoXXfS4099|7^KD?<2ba0BM9Ix+Cj>aabZdZz!X7Ys}$GC z5E{)-)q1FAUXH=gT=9^jBT`^w4IABLsniWPT$(!oF2{ckqvcYse~(Efz!fUP<IJioqIUOzcR_dPfMv)Y;v`QCwWF|6DE}b5|9RUi7qQFcHuoQXGV%NTwwgV{)Cf< znlM63#Od573C%C(*ViG;*1Z$&h^jq*_Z~F+F*aALr3{uPPqc>*b%Nw7ia?PGG$lwA zoF74!cG$8Q$igbrXa#!h#7X3|M_@!smKijpCd2*KN}7(rd;pi^X~yiF@>z1yKENeu zQHDa1DR}q0hdzcl@Q+F5)Kez#OQ$vB^5`^Y1Su_YygnU}T~AbQrn>rRQB6x2mkg5* z)qkiYL(^pGYY;ao<+?*EkoaWW=F}3CRn+8n$c}VU9gTUQ;=QxWK$FEpo!(%rj*@`V ziaz8~X7w}#=JT4R3u$=LQJJR%T|+%knyX-(oY$w8!qddzSae~&Q?5jF#8MlIZWg$T zCqbZ-`^VfxP>38~5Hj|Aq$)xMR9+SfIszb674YVtO&m|!Fn&qw(}l0O>lpw9wJui~ zq%h%LVCu1B^+Uc|hDY z-2b_BGwV#mh{-Gua)ZT7G;=aI2xc|dN;CI);R1;e4coXsa{FXeDr#i0UF{xiPlahN&Q$F-bL zs_{VCTO9&}Q>wForRa3s_{l^Y;GjgeQt7*dzWY5Vc~1hNj;q+Q`y`-Q4vR{0mvcNv z=*;A&&0V}ob|*PLX#84oHkv57+XQ1_JIY5~UU^zDyc}zrjEm?XHgUB^k`(aGTc={b zG(vcUn*wbIjJ*S8_b#}X-`IKI9>nVI+LP9k>hk!P)3ONaTU`MxlI4XWeP`91CTUii zd7d{+CG)Y%ff@9ws=g3!!Inc2tB{ucT@Z$Nv~S*>sC(bj+V!soN?YSa6zh>)1{zw) zl}w?yescY^?n6!b$0A8UbdbUycd=^wfPQxfbz0%-BSL21RH%%KH|Wo~m9e!Kx*i*F z2R-T-?pA(UC*Y-D34NRmwUkG)(_A0$B}*f&tyaq;3x$ojQXgpY50#ulIAuS#-X(Jtxh|zx{--b0>xGQoClgC?EsAt zt}rvpMpc|d8KPwykht`mWiu0$%$fo8bZ#n{k zHG!?-H*Rc+&{WuawJkw45Fl#Oa^hk}q!JrV;Y7`L;>MKd(W=zhwlHM!?lbSlHk64W z55a||ZwXogX%phFC5a_Jd6z8Vx~p6#v*25g(U4E?uXGpkE68<-_8-NpA8Df(vgy9%!5Lylz|bo08f)1j(Cp^#EaeLM^lI1f)UhO zU9?I9HU7R#;C2hjn5GFf02bbo;f-{p!`hw)miyaCq~LkdP;yyGv(M5xC$3D-K1|ka zVfA8{q)FOvtPw#3!6)Jp-AlEG7QJ&*6_vF)H^m|=3ARDY2C#7~pwUCh{`=Hngd!U3u5_52jKEYR zLpweqGLEy%<|RSpHa=A!)@RrDq`_}h8$B25gZDi$wl$f}vmL9@1>g>5lRqz; zb*tw#`B5I+y>R0oPm@r~zcS3nIYK~LWfttk9L|yxMf7xV+fqn+YCgI*dhvLAGvVw;&&N@pN+Sk*0C^Pzsr8KC9@Xjk zQlm46nGQu-DJYHmE(px@V(^$Yiki6%0@9AN>D18fFb@*!WT~^zFR|03Y7aX$9h>Z| zay_mwDRXAVaGC5qY(mmNV5QFui8nc>=+gtfpSi3;K5Kl}zD_MNC!4;gtejYn#TbwA z+c)ROFqB$p9y{nX%Egh7ifD}{Xe{d+Hs$%Ny>vIZi%*}xUcC^r&vCGL;qwU*wC^tZaFR679anjv@Kkq>jZrxFwt0i4?(w@`qSD2 z(V7YKG*kB53{epei32@7&zJjbnkSTZutU?P8!w+~%Nh6h>fD^tx*%2-EF<^>)e$L& z9E`tAMw=-wnsk+a45)#e(#^c@0mM~9aKFc}rgfG0IziAgB6oYa(qGHBmAYUjxt_SJ4!^OfMd$ES_v{^^-Dy6BB;6t{f zc1=KHCAFOHWq|0+w^+ByQqt&Bb<$%H{-BExKh`}g6S*e&?LLBx{FPr)s8t*z>F$W4 zI)$9%wrX8^P6KZtKVamCO3cAZBt(h<(IAU^7%w$}Er4hc-uK6yonx~7ulK{dz!v1^ z*lD;Pp7+U*{kwsIz`&dy--pe`p;Nl|o0c3AMV6ECpH)lb`Z0XEex9nf#n zD{$e_DZCi5ayX6C0a_=gq&yQ|+U%izeu(l-gGSU9w4uIj=1@yB{u?Z2%Zah?3i*53 zi(FNg8?ua}Y|b%onL_QKLaYd|#isM`lZd)cNS0u9C&O24b|Y=q1;O&JDQ37?lkE)$ zP+8)@O2E{AmRej091SsI!c4VCFwLffrBQ6VcG`s+>Z{YsiJ5gSrQH>S8lvUwHz|Gr z4U~2<1O3FJL}0u9z%1~cdN_Ecs(nsZlZ(%rK0e7%J`=y?zzKhz>TdE*)GOE0+&4+vM6}Zj}?MkU*>Kv&{ivr-)MP zw;QAEjWjfs%?Wk!dm3yDza5~4RMbGljWny~G7Esw0vytTV5pPri z&(Tc$;$ihkmT9v(i2m6RN-9i4u*RNEC$5F46U}g@La;WIaZUB(t0jj9>nHsJx@Dj5 zrYfEM1TmFTDv1=1@iJ1Buj8>pbHy`_Z882$EZTcjk!uQ}53HM9_|==z6!~+l;-%-e(|2^`t8Uz{CR4dZ2S3uL1|Tv*@jQlHR5(RQ>`_9oUk)f0`O|m9#}j zCm9{h7+imAi7?upN{=$U16k}w>44@UXG%G>Ub!5Bk~O%0KEDsL(27=wH*MF37mLK5 zdJ{E*H=^QSEQg>WF!hvUHADO!6fHL|2WP$JdYxDO$-jQnfH7corOJ|DPxp3OU@Q1( z7kNgFn%P^s8kDkxeS6+5k3DFr?vbGyk8||qfBk6wP8@s}okbPHx{ZPLxnH2B4&(rm zuZ%yIqAaL92nvzL75U&pG&xlp{C-pDwvaiMsN&NxUi>yb+8a)lY>(RE7k}`yX@k;j&VzQU)1)D?#{Za9D>^t>Pqy_iJbGq<7RcHW6f zV>d>s6CBe11d@_w%cl;l@n@pyf`NAFC~*di(*Ev`0G&=sG%HMPUh)7x2WqWAn&!~f ztTeh5ArYsqbNGn}P3B909LQI9kgm*VIw|usYMwm@p9ZEkR%4LpjV_i7HB_kV9B==c zx3$r2#C6a5BTjQWq+#2DTtoP07P?j81v-3{#f*K_9-=>R4q=O-qlcd697K`qjZc4CM{4OHxTa zBFAqHw$&U29J;*4j3!4175Yo*5!z`Day(S{0`Owu8KFtysL0|?sLz2*GGExZ2*5pG zRL>(K%<~f@i30P`)_#?1y=T$SsYH!9{@qM#6*`fT^(!lf?4^FHL_bjieoK_c!5@xz zI){;eWqsBccS9#^fX?&w$=a6xDcqv z>5AVt${&%E2WHUzPUUWrMk_If+L#W8^3_Q(7j_h87S=m+QpaeDM41(sGIRTVMz+4B z2BWJWiH-V+)0TNsd2@yJ`rEH^_eS_496gKY*C|=OBBt}`*>;!Kg&qyGLdsG-H12V( zX_Y|s z@s*{GW7k2kqgF^&I|Iq~tnQ6a@RAGf&*EM1M%i;13WjF#bPDjZFhJIQ6+c;x2&5q7 zU6-%N=|=m=GS(O?w)Mv}Q&z8j&nhNi&arW(z3*`~-1_7Nep(+^A~MxD80J(eciss_ z*WHA?c`%G~C-V9!*I%nz%Q2baxyca%eMVm1i=f35l)4g)dA!zt0b~HrJ~jgp-VK5J za7+7VCk~ClxI$dhGGRwk_`RCQMdI7SE!f&t!!M2s^_it4I51!73I!Y>fNv90kXmVhq_Mzy!abQlf?! z)mm)YpWD1W6)qASICrvJUXl2Y3tmaI`cVOEO!SKo)a?7>=lCU-96;8e=9F@ZHol%T zk^=H}hvEEEh`KI*1zC_5BX}l?52zZNJS%w;r(Spjl`aNhv5NiO2kaOSY(_|8=T1Lnx!~|^@3!VB6 zbTI7VtsJbH@2V>s57Y8*MJI{hnt%bds|(_0Y_Et05BqRq16_Qaq5EIQMiE5=N1WUU z7ia_(gkdJEGL4bXyZ3@$z>h@?-OGUxUnM#)=>o; z7&rw}HtvT7NgO#e9iC_cs9wfC8FqH1YHKWMagJr_0|QciP`|z8yH>x8Z}@8vmXS_* zo>7{zdPdH*OBF7VR8o*hR{>&6`vIxms{va#(>tu+ohLgUz56!7bwG+W|jy7pi( zp+9`diH-6V&26(tPJNE`I|$9HxjHgsO}?$}T=43BptP39Ky22C&Sg*yz6C{j=bsys zwAIS?q+M$O|IUfSvpS}^31JW9F5;M?Y8N)s?%2|b%VrG8rh4lriwgL4dhQtFPMf>_ z^LbxB69q@0p=n6c45CxY&wHBW*Sjz{ zFAP#A%^$1rD7}P5nWzwc0y>EZdm0k<4=VxX%eg%+$-wA1QF8~F5Ic^b<}HDO2AIVK z+V)Zj+VqGZXhw)+%0C0EQ0{_oKUMwlG+5+b z>QDTUxG0O^aK3Dd>S+bi}%Xe@;{?T1JK!UU@BO{$1~8ToHd~ zFKtOll#U;FnW69;%BGv5ZnOn$QZ3ZAK8#O+RQ^T~8!w?eEUkmkN(v26zRloc5 z_uFDwf_VSfF2)}+d8;>9dTc{iugAV=W|9{L-S?o&y?B&Ri|Il^)v(vwz%JIxyHxHkRdB|xiG*fx@jc(Y29jo#|DVveFsbJp8iBg7R?c0SpOGrFFWA~x#;nPA~s zkS%YxxZo_R$1u)}eoM2-(6(T=C=|IrZdtJDCetS2aZKOU#nTH_2lGLCZb2TM1%i^dU52QyuqaT)Jc!U*=l~R#q zu*p}6clKgiWvsr-A3wHr>s~_{?~wNhG5MxVAhg2PBE{m@x2lC*C#@KyQHAe=ldsLq za1L~*%1LVxvPuGGesvrul zO@fg)FlB2$xXgo?U4BeDJXZ= zA4v@lQzj+%V#)6aKP>)KO_GrQ*M?clPa|eAO^uAcx>DSJP4>cxy0rXlM57 z4OW4e?mJXdN3;p;$nfL(0{X5EdCYOWuTuVf+`>XWDo|gw=jd!Sy|CgXV>LoTn>)!2 zwI0K@I3t~A^chJ=kwMe6DEfG%qn&nFxNvS1-`1XWI|G8%+!(ur&_;f)in0v-5guEQ zurzP7@CvN^)$({+n?sxv3__bi)!Af=OiaGYb|3ED=TqL1cCY6K1Ug#mP2}S)@5Z+z z2;GK(vlM;G$lobU5n@bG8~V5hg?8*70h9I(j1Z92MRwo-7Jy`fxq9;LT1I?s7ld5= ztRCkK6At#tWci#o4 zH4K(tzl9@hht8Syd`BsZ12e>9n>f91Wu+qh6RGN8dNm#;;aFL7Fk>|u7hc#+Dx#-s zFEs->R$vxPEYB3>Qdx2m8;c4T^)57YhLv5nPn{SoUM|k5eJ1}o>v_ksU72c^$6Szk7HS}6tGbn~GO+0Dq1}^srEC4niIt~K zQ4~ACJOjWPqNji0CwR;vy>IwDrtSU8&&U(0EMjHzd$~7!*z?W$Rifo`nw7@9U=f=i^J7(FwOvN;V_a6(E9ArSpBEZSun&xeRuxyx-&g3zti3I@qV;)R?%XYV>EytneIFG zu+j2FQ`TZvQy-yjx1-AezCZlt3aJI`h9b1nK54$#7N@8$iiRSPr8pG%do0$v0JoyP z^2#TLBm)g$f-oY|qtDyFP}K1+lg|X3(5mucrn(pGJYIQ5#a-mGl26k5e$BSMYosjQ zi}q~)R2rbxO8|C9z_AFMsQf&6QXG#E2sqZ4lP!D3wzm$1D-f0xAV)VXH@W~>K4eCI zEQ=kcTfL!uW5`5>XbBi&?Vv>-hIoLWvo3C6Kg&zyVKogxi$Lj$j-_BdfU|fV~=YlSw?fM(x1##MH5B*O$hq;TCi7e*6kN2 z-Odt=5qjluE{=43i9iU48d2L7w&`@35Ytx>s1df74wmr1ba;GQI+8WR@j6Jiff{p! zYBbuVJ&5Rrp_$`AVEpTIWEPsw9wPkK_%sW9;BO30Wi8oe9$ z%NhhAJ$Rmf!G?3UUyJ%Dx#2I{m}{M-!4l*8bTApqp%Qs7`-Gq{c)g459U3GVNTXT( z^h={g0w}FEdzI|7YHQAJ4itM)oFQI$z$%1YflxXo=N$AAgVcwaBUYW$;><(Wh9{Kk(b)ZiT)#b8YMkp;YC+BTmhq3#7T@^+Al;%U*;bpg%R%}B8 zm*W;E9rV_In^O|i@phIhKT{7JYJ306hSv7my;d$@AGxw|hu<@bLHHxb@ezu4+#Jew zBAPwNWy?JoZMNY~X_4oEurjG#pa#>jiE*MjM1rDemCXuT6&|nS1hBg#5KZ{3_!<>G zo8)LmSIZIV5u_;Bs>_LXS;sXHfMdAX$l~X0$Y+ZvM)xns{mj2+drK2WxU21AC7x+c zHblNxhxdipI;Tm&C)inS6K{>DQ5|8bipw0!*s9IIIYeRvwsS9rCqMi)bJ;ust)nxe z)^Ip*KF!@bM0Nx!EHDRK?$4V554+L$Y)wy|Jgb0@@?G2Kmay*D=0n$>?K)O=J8s&9Rxkr+~b~Qc`woD~Ql$dEAOFU$5 zEpCQ+xOHr_FBCjXwokf&2bF?7n<+!G&dN747?vq*^HtL%j7*s=Q9NA~da^S?ws&Gz zC%SAZ@Zqd*X-&XugLkF9Y&m2WIJ#ba?N7X`V`l1UkoMcb6Pa?mtm!XjDEEuLa+7_( zB&>%$0j~L_GOEH_GCON?IGbm>sZ%y-0u6xI?04_yf*RdjOh02>jquLwA=kc({ILwoDtGuY0+@<{DeLz)GpQNAGKGJ4G38xW&70VdM?a!b7jxap zv8S_f+{zw7oiDsEIwYtdO{bV1sGPD5vb?~4j@#{pv?k!iv)lxe5L0XU#g{mZFNQ8+ zsABq`T*&e=j5LE#_0)kvg2wNxU#Riym9F~3s81R>BmKm}bLL`^l>w#>=F`2AlXzSe z&2jhbW&55*yZ)Ud0(&UwG*u?CJ5Vw76PpL_&**#`^=NANZj&#r4*9&T+m8nu=-X|D ziYz`t#d=CPFX+|5q5-kAEcM0xGRw-@C%cG!kncQqbcv!JA>6)ElCe@u=J6pvE8F6O z-NR9|1W?O5bVI&4qTlIm42gOU7sIiM93vtuq6W^Km;9i3zhI^VAR71D+7Kfg{?W8k zw-qB#Nn!spC%dwpNN+hGT5CKcSmUgTj^>uakJ zmTV03bMu(8O*DD`qV{IEWj9)$?=-C)X1toS_g}61{KV?BO*0tCq~7QoEK2-Z$gIT= z&d;d8WdHm0ojvMQmeul_idHCylrvjh7%GK3G>XCBK}&gWG1> zINo#^9VIuH@Mvp<&aZeFSwJ6?&Bu(!XDXsFwEyDlax$fzBR6U{=zXR9{;jwA{mm3{ zYIn#kL^lcw`MvXj{~8@NH4Hj&&vMTbg04IZKJ~{(AUcq8ILO1e-niCT?<2O>2yI0K zO8V;Tm$$FB>I>~4ytHTZod1Cgdm{tB=k3wU8DTt8)*)=_EdN&ZYTv@Z*f^3e+94a-8r0T1`KyL7t2((uo@N)qh)8Yh|_V5srJ3ez(IDcfg1uTO! zW0$hyH{ZM5moGi;uMTlhC~+uv#;sL8=Y1cb2N|i-tpKfA5xn-@ zb3a0c?fSeu!|-3=X9T2Q zJ7J@BDwH<#z!1@-e+)O>&t11Cx+>|GDzd4zGeTc90hp~m*U8~oekwbj@%1lCy>IAp zMtX+jQXF>)u5=H0!n$H-5@X_YuhHuz;kL0)P8@vLPMrg=;^0oiW09A@v`geASl_-i zvCO|eN93sX8-?T`G{?#jW(%s&PZ>Vg(|pX*d95g;>l+bZ0`3u<&yu?G4NmHD?QK(p zaFo_Q!M~z$q|p_Yx-KY&b=0k5tZpcXo;7nTIdlWpq9JHW2D>J=EPV$ZrLDmA%*4!*E*JZR)Lx8KnuYFIN;Sby+iHECfYO;e7Zf z0Mg!sO0n6r`;5rvJnsxcxm1zRMN`;DvcBtd7@TxTIPn`#r1>|9VNLm;4-5u_RE$v; z&}<8)CWGrr72}1X6BoL)$o*uBtYmRAD@N~KbbN^*wX4`e&E~?_EvH&+_l6r?;1x9Y z@rfIt8;wsX5#ikWAY`b(b4azqUe?`qpQ)R`rEe0D^pB6UHn zQvFo`)zh<9EN57{d-%>zM<5-jRrzOtzd^Fo2Bn^9j zzq`b0pSS=JQ%vE-9W&8_SR!W+W5h%dC$l-lnM=S%M^JrT%S5WUd~9|##~YViC-jRRwqVmYz87O9BGtCr8s`u^ZrCUA zex}~=5U1d4fcs^txE>BKFT=(CP#z$UAmU9FK~y&1wkNwx4(CxuKZLw3*~PX(^kDa| zeOk>QU;5mZWI28z#yP1REsH_hOz|XL>^X5hYLh8GX!C8%jVMU*V&~1+$t}DN`;pwxA=*yaYeWEC4N_8EhC^fdvx z50EZZm{d#4l<|*@q0zlXtkLxLi0g~h9Xao1P65+SeF!|nmC6}d?6CThU#^an*pAY3 zE})JELe=i5dd-ehD#{ILNu}(p3Ub;V73TTNJ)qiw$=G7I8m%yn5$n00Vo$5wpCer_ zSn*wM%uVb>UP3dA+rgR1{}mHNW6_va+IF!?aAerRgZW6;wWbgjoH#zd9X>KM&^t-m z=Gk1pBCoUZ*D_UX6`S`fg$;V|y1T;s!fv}Cgn8d+ffV3;hQXIz!;noGRGhYrQIX4u(O(}enz+^!StyFQ z!cquYep?@_3gCdX(Hy0$1Ak!bdHcg|7R3MG z_xkUY-#Df>-3Qg)xw~CXN64?`bv=4duo(4U2O*79e~PGwl{PRiXmiaI+%%<-&4>XT z_YgAEIk0SaJCQB~u3eLO>&1 zgHL0GhrtFc3<1rc#tdZDAcMVVK?|f&z~8$iPgO0}zoP61$HR;{q1HGjR5GDXDfAfXV~hq^W^)_{AX&TX4Dn?)*f zNiTD)fVx}?baz+Ats0U?)vM`uet_4Qrzu|9Ev@#{;M3hvkot8(c@H}vbvQK2`oa3q#|2i&z$GBQe7zrlNw(bm)^+;M%uyK zp8Uv){_l=akLvKnzQq#~y2obBvykDf_KJQz|A1<=CQFWyc-9O=T$Xlo*7@PwkOeCu zaJzQ7UL@nRtM<`V_cveS{yI)}Sg#Dr(vAVtM$kRvtAENw$x)4WtX90O8&8z)#&&pe zl9g>+tqBw_6qrH2lqLz#suZkA8&f}|VQnb)EuK1JEo z9;e~eI}PoxJla|T!UsiN0(|jl0NGH~jNV)+$$K^WHt*U3^=E9sU&6KJu;fZ0r!AtN zM@ezn{nU2L0P-X-@YY3sk_S($T$`<;H0lDxp7ndCq#zSC0Bl?@BHye8ogyx9R7QED zf&&tDJ&IgDn@6y5zUSkJUSv5qA=9Mu5}8DPADKr)?(5; z734kPMc58I?Q>>g<%G6a!>k;FEU{B|i|tlppZWOX6k0@2E_3z+^&#lya2H_jE zKA@e4nkIKCo>ssCs95?3^tVyuo1~<1FRn|&sG&~>suk7VO<5PaSS}10!j2ErV`fs` zS*kDF-{T9De^!&-yZE+u45iD49C{E>AUwkGx zrP9Ql7;_>IERf{R>?=?C7E=4YnVg#eTq|Wt`Q;XAjuhOFn;oqfk$#Kuv`Wj9alJ-k z-39;o+{&a3*1MKWFInq+iSBi7FNLah%ueJkz23e~hVv8?ypMD48Tj%u2~RzP1_!=0 z@2tJY?#m*gqa?$QDu+4VFv-qbMAPdkd2tbJ(XQnnL^ny~xvF}3?-t~eLaLK76GmoP zMftM)IcAJMR9YE6-`HF~{qf<`c<3!k9YVVv2u{Gt{22j9!}LJZ`IIs78#s1=+ILSCZ$0%1d&V|zn@4kL>q6e zF4!ULBVD+r{8WkL#x^kg^>r^%h_xA-2f1sDGk{vwfmhH%n$W1ZO?E{aZ&`Y=RWv}F zfKz<8b_O&1ZeM8S$DzdJZSPzdEB&vps6jpV)!_VkdVOjU$rGb_-(5(TRJW8v;c~Vt zLA1a@Gdron2|N?^#dJj$vD!o)<@!P-ftChIw~Z3LD{C<>^5hOXhODm7%bYD^|0CMv z11{=Uk6FnLF^Bg;R@a#JIj(~6(L6U+%KAE8STI3K9%ctl8cDi};_h|qReYS)ml?a->f4NE?QS@_ZEvY>os zkO#hVk9wCHl4N;gCw(2dgqZ;=V(>xXN}`r*CsH60hWR_QM5DZ#efv+MWj4SA!i!$h zm4Ah|Z#Ub#YEMdp$K~vE%7CWBsYsdO@Sajkkg)iWPPWF<*~oJBaeNWnN?A`W-9!gakt48aIr{kjX!57d3anU{cuCg= zA<)uS1fH=#APMhxe)>Xhn^xlfTfi4V{o>g+5RDW9jJoVVZ0fX`%K-FS%o9dGH*sKE z+T&CrHP3&?9|A1VY}|rWW<8{!#H~flg@8M={+{4e>JAHIc%itKL3b>MJg2qaGCY<{ z_XIm89ve|cxH};XoWMSn-$Df|O9XNlvkdKVng}CC$28e^;rLivWILfmpo7GG0DYZX z>-a6_sxzC^B-L%ra^Ml+)|qtK>)uxBYTV($ltf|iF7kEONYFJD8w<63BxK`8T+g#q zhw){ElfKuLd(G20dQjV1WZ~BaBxNwmlrgTW z8Ym7WnlM@<;vp$%HjklkSlA)55PJ2}L9RQ`z=`E8J1Sclm6)GCX#&6R#ycVG;zH6v z;cQiuhVb@IW29v!F}dNu(JCJ|N0Kz!4WUI6Z%k3M%FxiHKz{rwHy;+D@@S%AT;#Nl zpE8f`TqJ*&c#;^ZN*PD1jQWFU{m0`aWUUAq8^yc_X z*Am6oUJAoGbzx`#-{mrzfw-cI+cE;B^AIRD-BTUQ zVLD0e5J*y{z8n+an3#}UuUkA$C_WztoOkHw{{UB@CDKA{b)EsKL&NWnyQj_zic*KG zqh^k5K%j8KI{2&nda?yov4Aah>?0{0+fn!embPm-nieJ?bH|>v;2&UJaOmD;|Bh%C z&2~3r&c}Cl(_v)l48oq~@WB2O!*FnR89lW2@_shra?GLkkqvzx1;_wE||8ZqD zm$dRyvjgXATGAte#L4sV#Gg>IUT4@kYXpdOaLN&MOEG2)o#?&_w_A#Aw%V|tc;dx7 z%NwqEpOhbS#Z5T+a5$nR?*d9NmwN%CAbmD&In`;XPhhP|C20|i8ugv0Zf*E=d%2vo zpx<|N57)PPLa)LtlkVSue1GQGHBok2+MeyH#QlV``w24=s_-#J5hhd&d z7;M8!v~4hLkNeI3UcpKxzJQ*bGMDz2Sp9O{N{YAhVoWZyx%Oh0GLeuDYXCYY8!2on zqJ_AwgP6%!3T8f=)%ICNloXsJp+964G4t=v_w^ze*)^Djgm}7_Ar}{nL<_eoSq-I&j;x1Pa>Qt*PlFq{AdR)LHX4+Gj@t--Rx(O~^3Fv(E zChKEp0m(4Cq7+mWz-;u#ESk6LwgInx#G$m{g8o=-f`|iUtx@gYoe;a!@HNaC=<0BgOAlls=PV=HH4sF-Ms**cyxtne?DO}Es!l}6$D#HUtwpkHFra-_&;8cFuMb1 z&^^5;CclRyd1jY1+b-eAZ&LGqxk44hXAlfaGW?mN8KBh>>Os@eS(JQ={&06kD5;Mj zHlU0V6flVgY!5>O_Ldt6#wk=>=*QR@B5QtAh=HQA%Gh4+V$|rAe|j$5zoJrC1fClJ z>b&?t8J7w0Cq{Xw?ipzd!&d0&eZ6fBR28IL625CTlSz>-7H8cxs0)Co{l*nq$ccu6(GJtcggJ3A}z*>oC_eWDjUiUJoA^xtL+9y@DNm(LYz|y+>`@iU~`l}c#5GG zC>iDrx+-aQUS8%DS7upY!8zwj>wg}|@Fpw#n#A8o0=v_#NDkhX$W9ascq5S@CfJ;~ zM^SJI%#9{h&-j@tZDWz5r6SiAToN+~!CQrNs24NW1xj|+HI)<&dA1f)NhFYU^P#Wu9{#iIF#9h;6*x>zIJ)jg^KGJR=DH9#f(O=Qv0Y}aM(_R$n1j769NC3 zELb15E1GmK05&}G|JJE+we8*_=zP$iO|b_I!2zQdf+PxC-bJt2AGs-QH>ObHij?T-uZt?b>(QtJwTSNy~c`+cVQy3F{w>%r*)dvngA_o zPF1wYDRRbP%y}MDLX|QddC|Q=Y0byDY(RYJ%vI}_G>hs;$iJJGGOPYzqTo+pjhB{f zU@Y4bBvM*D{>*?E(Hze1eMudky)tc`3J8?a*2v5I0M{eH2?WN?l?v@3Z%d6C zqd%Cs7uGf14o}NQEnp8k49hDIJchHf*;>bsB}Bv=g~q?91|gAnn(t@FbmcSJv3fvy zZxswV7;c80n;kYNl*tuaMvLBXill{soJeJAh}mPjZSlv#8@AuAMS$AZZaXE*to0kZ zPpoTHu?FiY110nuz&X)I1}@c_EK{%1cKp~{D$0Rp#Kbqi&vc-DwuzLQXADJ99jt&2 zd0_|x1vD~9?an@L@3m?vKJHgE_TF?1VBQ!zWvZjOPU7!EqYVrmeO1+J>@$w9=jXZY8ZVk=URgr|M+ zFL}G^#!+X4fiDm`0*4D#u zYKUWMC(6h^@Nyv8E#X?{Nx`$H4UN}arTwfyUyc@>7;ho8@u8L}h(fap@uSAHn7H3e z>{qfOjE8{ml0tPRu9f0lC45qZbHbiFxUyAEkZ}aK5LBm9+!G;MsqM|6dC5i7;Vfy# z(9-#$7o8(9zrb2B3d)i(rV;1fnImP~LzmSCork1LGe&QPl#n`Gk%i(5L%5NO1x>wk z5TuiU&_H!i3x~u`B|udHn=Xx&XkebGI@MORxmM6#bN5IU!H1C?I{&On-Nir9IvwBn zn$%Ja+H=60gg2`$ml~czML9!fXP!$Ps7jJG$FTw9Y!Yf&8alEsd36Wgi3yw{P^Y7+ zAr4&Yaz29B?bJqW=phamEoa`}6!ka5_JOSE0n1vRccyKK5sjofITgCcDp!0rI{0T!xbcv@}eyE8>9tAlc@ z31!UqYCc4|?jOxHPbBxu{@c%~8vEzazIPJ~4#2XDwsvDhWXZYKCUK+#Z=DX4?`IlD z?i%pMB0HwoRBUnPM3mXE{Y7{EH9Ym+!PPvU%U@|leoDG0@LLBzSkQO_brwmrk}U__ zH(NnuE1ixc8#}}QL5zzw?$4G?YV&x0N7`0?WFNc5G|N$l?Ad9Eouv?FGq$OiDPOaHRrwlhYP6$$Du{oA zK!@u38!@_fxBZ|F-~=evjqIW``Bh4Jt5ojK>%(s}32&d?MWLD0n+2wz8jM@*9yypz zB`AgokS!CfF41UhFVP04P%rXp^_TuUvSb^rc{FGHB_bS{4m}-GVD(wsW$hpv7UK?S z1Y`ey>Y4fyr_nlp4)WvH&{Ey(5v$ddVTi^i>gUAFWk)ghlLBYZjG%*9qtN__+K=;? z%M8+63TIC3gr1<+{b2KDa$7MhcVYZGu-c}%!8ndbQ<#2@C|JRdluv;h;tEv+g(t}I zPugEK699f%y2R?O1?N;v#y3-x&aaXTaI^ur2h0soE7kAw1RTxRxj$*I<6a~>lo`yt zjd7v+Dn;35g=hzuc^3!k_(`c$gJQwaflg2>B5HOgNa9w7uCbgt-N2;QSHxi)ZdP zSx#4BtG=$z<52fj14wbqTXF1@1=a@0&b2BC|He$gORgW-$e32^N^Z(C48ZfNaLs)J zg=cIw*bq`T>;zBGa9zo&(RlqBt1vnF_%YF#Jt+Q6I@}0@uUGW_A#8aI!9GMC*@NEq zxyJfQF*ZJ>ZV7@i%1Cbw)`Cu;jngwS2WGZ6vW;!kb+w#jh(43*;o^oe>=+%K^kQmp zh`~^5n1o?+gaT>r_2KaYqwj$`S0Ky?!Z+?_6M{d!U&3<`y^lYkB?!^FvsM-eNh>nO zg{2IP#R4_$6?ZKeTZv8of9UB3#Xhx}W7{K z1ZdKZnE75U>t1$v8znq~n?mgUcR(e6 zTKrE>U+-3Imt96P>p2z(=geWr-@;Vm zR;+|0A`Xo5r*{Z3aoMu4kj31ye__IRLZ9u-`w+Mjp!#Re7#}9ypZ3Bw=?V>l;KS*s zw>nHGx)i_Ra73JLWG$wsrT_>?o{u) zhS?1)O}C_h^A&L+Vz0n<2=fb#=Vr#Ecj{Y~u`GYx&#!KrZNwg}Dk0O==hv{! zVOfo68EJ|;z*9yylHSe~iQ5*tMGcqZGGedakY+rKS0i6xvcE$vE7lrjvddNXJ%<9G%bY>d1yF%j@4p0PP1p;?k$Fe zs3NV`#pm%EMRQ0yM%rc)$7TCqQaTf(eo?uNS4kppY+PSy32@XqvGVvgxBiV9jWMhv zN(^Jw)l8e66OTR9<4+@s%vZU+;5-dA<}Ck%<$uT>BOMhN zemHiwWvcLKN)8n8Z0m9RQc5xu)vvN89wfVyN=2Pkz;ylY8Mlw+(4dhLq26M_m(yHF z@9KEC zUYwN4!2t%A!0+{7TNL3r{AiW-*alBYB*W}FHWj!2C71fjRXxHvRO}sI{^&QkcjK9h zTHQbqA^k@X2{*7m`*w#9<~`7NGtA3iUryE4M%A70$O-2g*Wo3@O&jc5tx2$LO;@&6 zvAYrKGoxh+loVooCf)q31#Mh2LYCFNS=pecqm|j5-+_C8wh2Jo%C8TZg<&H|1}4S$J~7fOiJng@U{Dn(gz%15^sx**#QN$JgXXvFu{8?FA% zdu_@h%p>Jo#)AL`WSFTW`m{U1sZ9F7N!$=?AG}N3TUI?IzG1YxsScM|`K(5V zJ*yW39^8TPwDnHjU@H!RXmRl`hd|rd_~Rn1Fabicta%hs4aK>vWtd{1^zbxQIW6DIo zP9&#Qu~|^&-_yeXv%;2JkKPlpC=F8_{?4yI5^ zr+U*h8BI>o$LbF=Xi7CnEXuZgVRZBPrrArj3?(m9T@z8G=PR>C!z;ISj`6NMGCpDj zAxc^k`cQ%Hb!g3}V49#n9s0~<{w2UZAu?L&a~^tBG~>L+a(FsuYo~Mse zkBRd1s=1YY9>k1n!OtrI8CcNfd)3Nos@2E+GbxQ4>9Ctee}P}c@Rb=cb;F;j%0(CE zh4S1(Yu6#Q`*jfvyvr)}DBhwFYrgtpv_5GD2EqM?n7CVKp~n&)(jPicFlsXXkgL=b z!?$(9n^?UwB${T)=K`x^KjUIV`XIXBb$K1-UF(u5&xl^*u6A}t!=q1|)7HwO?$pvo zAp#YEr9_?Z9n5cn_11>!SV4^s<KVUfKjZWysgJU z+wOCFA~L<1&3ZzIFs0%|{qDY}Nb652pG^sJO)CcQ_2yC(nmaT<$_elKR5`f#FT!$D zanBJ> zNcN$1;$-}n@sXz3deEvE>@JQysP!utWij>A-;cL6W#4(xrpVW93-exIEeFs-*bU_w ziFSjP$Prgy36=7uIujmdQsCRPnu&CHwoe?j= z5zi`ooku#L^XEIPse#bdoJ;k1ILy}yw{%NC*_{2e*p=V7q@z{AAK|F`XH~C#=s;fH zWKp7W%*z$>IEa0=$S32xRW&vkpq?k_J3Q}PqYE!&oSFfAft&24(}f5$3$Z8aWWnED zm*u-X5xOLhA)nut=JCyB5E@mXdr%#P`mt~G7SggSt)v>4iHnn1cL-O;WFnGVih zK^0UEEBN_;RUAyve|?Z-IPfmB=oztU8v?YXyqBTWc@#n? zI@uT}!Pb`YuFhw-wQw_nT>2vQX9b}kfxNfRL6L8Yy8=l{c0RZ6OJgLytfERW#RGYx zxv@WH;ifhEmQXbe+G|5*AbLsVrhk%W_b)Xi4i-4p1q3`(?OF(h?i z7zq@_o|H_1nLVwI21HSHBDA~5muZV1(S+BijFFm4&o~{9(@sy-%E88HT!KsGKb<{I z-;|C4qv9#$@%2irFddlL z!cw_<5`RJVNAyjS{!Ia2lX4&X+&9t;&~;ovLN3n)GoCCzgf@Gk|hk!A}bNcjhIjBhwH%0OV*9#)Lj=aQAiys1(nlprg zRRT!^xX=Q?gPLFQZBKAC_e5%PVPkKTB=VVhI6>Z%X#@tm!m05AT87C9T=C#B4-b~p z?z^M6L>r>M_Ei@ryk=>XRgPltp3IxM@wNi)H+ZdaGeQG8A7W@?*be%~Gf)^>#8Z~9 zC-AflSLQ!-Hd)&H*LlMO46Up5P(qap^=*j1gB6Og5UnqD=cNpc8h#cDv@}l+Ux>)8 zDB2dW;dP`cN^I-g-g!{m1nAOVN0O{SlS%FZHH9`dd-=_(sd7q<2b&Pvo}wX(Y~>E2 ziI`=fFOkKIWpqQX>$N@`aU{`M<_tsw!2k z;fZ9%5oW4MYX`?GNClb<t%?eP;NGw(xmXVCES@D9pkdserpYeJo3%qg_P4B8Qj3u>rbnpzohl@Tkot6tyIt-`-i zN5kgBs`vuPNn5uljlGPL8QL7B^}`8Q-&DZ-54F0r$7&OWKxY1=zbl~9SGBGZezYcb zW#x(sM*m{HKD5ArO*b`OtKZ#rKzpvC$Lqm>z#`}g0q|;@w01dLbe$k?g(PrI2mRKuH*_iufxwe|F9N4bWfKbA zLc3Z2!8OU*a42&?YwNQkzmuAQ@dv2gH zR%lm2r?J!XX+x`0gL~$7lX+RMEw&YUaHo40V(bu*TsEr`Mz{6OR|BlBJNo0fFq*;p zV-b7oX_vwnQPj#^3;sAV^=3c#>iFKj&ItrunK_JFH_YOo@F$q{2Fy(lElOk#A?w!O zm3S4qC46PDOnyL}Gq|!h1auq!b#oecqIO*)2(;%*%Z`ml37d?YQ5fYm{#mhyUtuBM zllY1<=B^m0i}|hNpE#UeB+Y~bwV?Idj)3tW)kf%X63T{4wch-}RoNyS3~SRBe+Eho zYXdZ%Tn|=_(&4v4ioQuM7n=;@U|rFC+h`oRHxnKhKk9itF0K{MxM8D^TOg|^czP%^ z9oP%wJV@piIXKSNm2|d!>+Jg7&>9-wivM_!yN)r1Xm&3AJzUInpK=uWO zFIUh~mx336CnEM9Cs z)-)RA^hrgGG?&t3Fk&xkR9}}^sSYyuJ-`SnhG%25+MPDtOC&gJSQRD=>k6d%^hKzN z1$?R9)m|gclS{!aX-nMW@td&}wWB|Orm<>6v<4U!DYZ!#j>mrJsr><4T2YZVM6=uS zA}caio_7mBAKb;(jhz(jTl<{JU?ZQ08*EsayB0(vvDUBdtgb8En@}QT_QTNSxut`P z;UJ7H&YnFfF(c%kS&$|jqQR1+S%%vpjmB2dOB6^RiPgn~H)rDF9NnUbka65owe}jB zkXb^s5g!vONfV!|)#Ng7M-!^iET{FQ(#w6H4)-0p?Uu;r zE#99$KX(X?)C&?GZmY#i)C(MU+)uGkonKd_k_l6omz#fsc_f!bk1-G zcU8E<6743KC>?Hqv8bKK2h#yx2`qsmIBLk6Ou+oEZpu1`LoqBgy>k7$dTT*@4+)_KKK zjJ2-X&86$#AKZE9NWv$Bhe*r=WmMa>8;)(ZPi%Z|yvG0#+7R1gosvgc+7%n5WQY*I z{RK7=1VJp)Lv@3*8&$NG1`Tl%v6yIxHU9^0K#{*$2m^{zafqV@Tt{2RbZen0sY}Q9 zAIr=X^F3Vv?#lrRN#qJmiH$)%iRn_2p)o@~okPrK4nf)7QnQZ(ba;%WEQxsEu0S+| zcgrxAz)No!#K?Im?Q>Ht0@LR%0i@1Brf7LFV>;FI1OIS{= z#wN@4Rh8mPEAh1e)>V?8L@a5Yv@|nzXsK;;+Vk(agaemT9Iy3y00**!*=ad!J<)wx zUV1g-tp}?U({7>CT_<98QL!U3p*)V3rKW70-8h^E6JMOdt;ah{{FsKmnE`a80V}D< zid1L~6kASfEURol$yynW^UU-~g1A%8ZMX+cLL6Z;-7cHWFn_LsC@|ay=oT+4q@M`; zDMhWw>rHK>m;^Xz9XXb*HVjP>doU>uCUj1MWp|JYm-rgH_ayMp4_p)0TLgI4u_$mD zu{jkRj(BE0=@@q9K$Qv6TSHVeMx@xkso6;QlEorL!zTXSAw@eAdydXsq7@MVe^Y~= zw=U6x%ByV1>?UfL!f_cKr#s16 z(WrZ+j?bf!mpvzLu*W$1+Gp-Px*&qhw<51y8o5Q;<92ga;u|6F@htQS@85q3-Vwz^ z4x*8FaC3Qf@%pkq^EOeaa)p9TpVwB1YrP>dMZG0?7c4;!80-?ddfXlDkS6~!;7O!l zl@+fOEP3t4pX3CdKGn)|tCr!7M(s%@9d1+hfINmCAb@mEf>=gYa(x0XQQB)9v6&En z!idc%*W!RGXST8Wpmc^OOKuTpYN8x~2gz4mIQ;S)` zy0a9CRO5_YCT8F^>}0CraEWE? zBGIUv<3FY4yOM3?^IGG|+KVrDw~jmx_vm7ckr${sBqzvDfN2hPI4f)jC-Ia7F?G8| z7pVJO88&`3mKwH4JjCWCim2B?)zbXlJ`DouZ+l}b6R6NNl&eJ$7mT`-k^a%cw>A{G zwOq*7(&tAfhsEkaL`&OtJ_qAY<`9B6OCLhmo6+EjA4A>DAt1ZA`cex;>$Zk)7yIPu zZD)&!YL_*N+^Uypt?mwnw8~o3-_Shxw0J>m|F2nEd^Hh2mGDzPhmL!ZzjZRs=;a7Pg^BJ& zoCKW0U1%#Nx%~`Xjpgl1bDLbM3;XC5o6taWQ5JN&95=?a^)2t6e7}?LwC2_o>vfk(OcZ)xALdf6ag5RbLP@CCK;CEecDEab%FN8Upg;Leg<=RE+tNJ~CceB|V5W3szqrI@6QLPa zW{2hMd3I_DJ4Z^lnh13{Q4kBv?gQ&b7fXjiub2{L$;=~}6eu;ROwgb`hp9|mQcOY8 z8mLNDQk!zbqz>scO<8x<;KlKAA6?LhxG{^U5NseBQYRY%xZ`m|K)I56H;5DPwJO(NCUaj0vKBM^Rp;yL z;-*i+^=Ij8&dt}kE<;U5zD{XWItIBk=F-dN#p_@m>7GGvxeNN8v*p#~$Xhzs-I5pR zy63fP$Yz(GHl3iNI(aS4Mb{B#y_g2#S4W5~gtd+k>$1(IB3nnGxg2xlf?G$JIWccd z8RBa4!kPST9YMB{*gAq#@?DeM))8t&2Dgm#))C|?dE1uH*0$^=>FyV#8}qR(lK`tc z3tK*$T1TMS+-v1I)Rx#Q)tS@edEF7@>iN=^I(WL@+U}MSt>gXfjbGF5p8cvt&a2MV z*-JBBrBYc9%B8ex9~3F-CU~$W=anU03<@&v{z@SnU6Vla8**ZP?;a_r2E5 z+9@$(twi54Ps!WcT&R|L-9csAMQD9`5n7wN|FtQ1(0bx^yj{EwT4THpx9ezijn$D% z8&nfE5`vY!XP5Gzv+FD5Mg%gSVW0OAx@sSqmep`fq=3?hw622Vn9RZsH8yu)IJ+>M zEr#K&-3>lXW;k#J*XtCBV}}srg@is*d<%736gVQX9B2~I-x87*(J+$T7NQHFpA~5< zrO+HVblK9k(-k2Moq_S8fTe`#5^0c{@Z%|w67)6XZb}8{PC<(%gTFM|VBcpCa?G~C z*QF4$pp{JI2U&+`6tPIfMc8BzXGQztg-)h1iKKx;#%A`>Es51qg)I>?goE}9YM|Qa zD`GHaeXfki6wfJ3BIu>dDY&OV>YH4tY;I zWKAy2i9Sd>ma5*QRy60Kkjs8-orop7t?kxX?Pz`rKXu?RmAaA2W+`(x>C^&GRX-}~ zMoQ;ty=+?OMoQ;t4YFA`QaVq26{)3eglKyybQ`*niF)*@ySTboEpk%A(9%NJXhGQ? zeT_Ns&}$svi8OjXyS@JU^>eX$!C-rJ(OyU>3BkOzk$tndBt|*XE-i%>plq1D8_esZ z8QXOSFF=XZbe&I;3a66Eaozr?Q!H7t+xg79-^{?fg-xcTT<_u577M410M@$SHg@x7 z%$&4LeD(Y`;?(d#9Q!IO_}Mrn(Kj@pd|HK7HveCFOXSlTO;-QDMuqBj$_qmA3PRtu@2%Z-|hJ@VOBDieT#zu0wW4gH3@BneWqJauviRnwPopmIoa%-)Bh)wi%vs zBfnB!I(_CxI3^RB4)s?y(x8ewv0l~}zv2lfwo)u8=Wz|koW^E}#x=`D4e7QLcnx6g zVlipeZ8H?U&3;`@X*Sm1b)>PI@R-e1+y6{RLSB(z5>GFPm%tUEaU3kgN^uiR7mQJS3(q6Cl`q$I+>8N)M}L!E3AHUr+}m(&&mKPCRxfN zc4SrsE2%RoWK%8G_>D5io#k7}`UU20x5E3ZT^=VEp>sdsF^NjssaaHdM0%6NLcLlX zw#a34OcKm##DZCMwvslcn0p%3%IX<{eNO``d|h4wQ{og%t+Ye*+a*AbSvi60^uksu zQIj*P1&}6Pp;mio)DUJQ#vYDw6?E)LUWNVZ7BkplIE@(9k*po}Tefk+$vM~`Uz0eZ zZUYal_955Jm}4kj`eQ|w-ddtnar|;L93e*C;b>C4eCQY!+iTG|k8zyjXjJ64-apvr z7QW0#8*Bu%wLE}Aw9EltX8=~SjcY8pRwrS}tvPrzn5QQ+L^uk{rnYU#L1PB?C}PBf zl37c^EO}xX0BLtBLyUS2)LY_=ni0-x^5&y94fsHZsxvWE2dve4P zhSVa}ytQ$gMg;RJAuNac9UKngb346`B;My7`IyJ+z^H61RA8j`f;zYiGW&=Hunq2_ zgzTelu+Pap`XRUv*u(O8)p5ftofaYVZtz*I$9l#mskCvnhhSRIpeEZLEjvrJ2Q5kq7_hfSl*4V3z&@&-`|M3;?~w?))5y#R{o!F>UT4aUAr(^3Qs81R z`rDZO3(x$9@Bcsn4LlOW=-6&6wjuoK;}P){&NvMF*{CoOThWIPrW5IHWl#K%##QBQ`dkkd4tLa5VfJ^_Z4Q7?qn zADuHlnFXeYUpWiFdxrXwJNBUqDZh$QDAp-ybzAydfthE)hQzgj-jH$MQm6`m-=x2_ z0GzYeW`Mpn*JFxSj}k~(qjDA!e%}F-7V>}k;^)3~@Jdj3Sq-4Y5N&V;+eeXkk`?LQBsDJg<-VMRtV(+v%+3H<0_`$j^0Klav<{WOxxBqgO@(4I^3>PMLr1Zt zQy>Ti;Z4f#8L^o%e0s9ZENF9nNmY2BjKC$Xs%LXBN}hud1V-l2!_uW1pmRJU{yFC5 z36Rz~0fN%p5rl0w1?5)4D#MVHO)BQg-io&&aZPxS_;;J#ifRoU*qh_PEz?1>Rt@#p zIpk@x!jV;b?OCf#d{b{?nX-uf&Vm^G*UURhVkRx-vbPrT72nmhx3Eq7snFP=oyta6 z`bo24UIpvcB(QIT`qv6dni;RDK&GAn-M==P#2|+u8psR+KZL;2F4#kWJV>n6kf`Vx zAf%eXzoD(XS|OHONK`@hnoCaYLQ4(w`VgdIR(QaOazleq#}q=e{WNAFAJj09eKoXexGF%J7^FyNBC2$`ng!dm-KVVH_mA;sCN{HmEe zse}?H)^o^Wd0$IUYa>vF0Hj2v?o_8z02iK@!1<>@_0gHCF5dzu3y5B1`nI%n9}Mmw zJy0&~&);328E1RD{Bqi*>QV0E$Ri%Y9MNEoecF7@vvsL2KSF$5GeF^pHf9c`Af$xg_>BgxvKTx%*l|mG^JxOj1FT zM_x1sGAm)#(5gemrwoRA6;9x)1i0n{h%f7uECw=BK~okX@>_y^!M%oG4hHDi(Lk`V z))!f~lP<2#WS@Vs5t-`xfypwYQYdJ5eV4nnaw<0$6fI7l<>H~?+)|OTa_wSO4t9*( zDGoY>hnsY0kc%l!FIDK_qpKKJVQYwGtMv&ju5Llu8Gg~KMav4a4r-gZu+u%JF6l}# zH%-M++~uk%Cq8lGx+p^X$z29do0jcWSdwiefQ6OHTwXD(mG)YIeU0C1teW?Jhh3i$ z1pf(VP3w~^mmsAQl1Z47%tozt0~;$jm0RZ+oa0%Elef=iJOb9lsYl>K=9K!W8kvO1 zlHI))vb%V0tH)b*KDHUQbqwm$wBnRJdeJI*+%q9MPFWH?&#u6Plj16DCA&E28$~OE zlJFD_q+WmmmR(9>&OH{i%SB-W734n!RYd}p@vk=I))EormdeAC&w|PG7Fo%<@%#3i zz9q|48gK`#^mDB=*DIwzgsZEhTKN+S|0((c(ZG!eZmd`lFf@}9GB`lTpp}Y4482Ha z=L_Vq1a5A$t}waWbTyAa@2Q9X8zeJnL8yjkMd5*+$otmCA0YK zl+2xyxl=NCN@nhPR3)>;NA;JZTHbW5>>(m>W8#jzjp&31*ss4hjT$fZ)b!^v=8O53 z(&aiYJ&sk}S3@|14i75?Q|R_f#xaaB^^=I)O(VjEw7sb-ypeJyZw7wd1^@gAOFq%a zby*SA^U21N0POM$WPi(s@3y!EuRaC^Qc3vsgrygiOKZu`fnURg#;pA@R(BjFRJlN^(FZ8Rli|{-4y^J~?ZF+Ny?wNIHYX9D5dC*e z&egpiVk7!jWsGm6+U|0ERgY`B9G?{>azAe1dc2B*mbZdUqC@y=^;qcLg?IhzF1+t9 zy#IMGyp#9xijQQ?))h_rsoa4rvObk{IwjaIOKaLzPRKe^0a!~m_&HadFTn_;>GtjT z8>#kJuHiPevu2A~hkasGK&O(%f#EqqR3GblShW`?BxyADC`VHqh6@C?AX?+0YgpIs5Sj6h}xI~SFm%y70OLP*Al>1x4I=1ef#70Hx0rBlzdcH4xyXr z3;|+q&Z$Q@N&*?tz~d-^J8Bih3gq?1ejXsmDgCC98m1g2$u|o* zVw5e%v0KScP1cxFcxz7|6B4%{GVcn?Cd7-rl18-Lq4Hm(AM`2?qmt|~P|MF4jeh## z=aLLEcD=tAFi9{kg>xCq+XI0l%DOekcH5Q>Kn`2ZT!knz$E7}qU8;^)Z_)Rqb=9GLNA1z|SyG_{HoG-3STrsmMFoo%mufw(zw?_sJ~}px#4S6TREu3$*ImE=zs6bbC(+xv_UGH`BHNBZav6SP=@I1!79x5q#X=W>O}G$O zVx}VY<*g7O$72>%Q9r=q2vMcq;su%!cZvhb%fD~l;u_G3Y*DLH)j%@zuxN3uT4t}? zn2U?**QN?+E3BiO7FY(oauvwkxl9$8Hq3Vo0YeCdIKnd$*G)}JNVSIO)^Jt|VRF*p z)QK<61@Wpb@XUoM^+QD0Y;9NTq~sUfVd1BmfskOnY}}(@M3-rRUW4%56v`*$emwFC zM>J5EFnCM@sn*+3wi#=D`ZR3idj(-BjR+h?WtfQqGFzs#2m5y+Z?8dR+BG9NcA z6ZqI=QPH2YoQ|ceR7-iwvL?h9N3%44Wi3*rM^W7<%}8_o3tfE5DlRrQj3m`~T8!e{ ze4J6t4bBQXON*))g-2AGGQ{MTE*;R4!UiYNoVw)9b*pdSw4e-p!tP1UQMBsSp;^-v zq1xbh>F!vjb;SJT8ZIx16nBFZnllS&hQm;1;*1}NENcpdh$|;RMSDrK#PJ{(pt5~7 zo#L$`#OoE(Eel6sLxJbDNJiC)YO`SE)XmpQQd6DalXW;`eyP8`P%Sgn;99Gct*VeI z)vJU&EtIkP1>K~CH7uTb_P0F zrJol2e})4*A<=;=Z;lGJq(kwy=KcTT@Fc(gj|PXs-TvRklZ%~;M%a}ld`Le04}KDo z5sTEl#bOMgTp>5iCk;HJ@?{RawoMNpsQvTeoEXyLz)NFpg=PR1s>D7>V)iWw1cix*o)0cq&lWSaz2pr(GERI>x-K!S3g1X2D%VX~wI^gA zHYIY}Z0V62TMpu{Y}BT;%UI+o7fmJgeS&$O@TJhwVB*R*D4?oD~$`p4C~uc3EGLYK)1cruB|1jpo#sZ1K;)HfQ# z#smj>z=}UkiAUqy5ntVv!PkkIBRFDkiuQ!^zSpIp=rYr8^D;%1ys*M{E8PzEI<0JL zEet6nDn98G_0Iwa-qvE6Q}XcGi=kyZf$DA%)yaIe>Fm=mqkXc^a{B*>f?v3$8K6P` z9}b84`tQd_M<+Y|e;d!H^#8Br3fY+fs>}e)C(41Pd2$Vjd-~d*eKxk~h9{CE3*N6P zz-Qtv%7A1eGb|e9=WoZFKmDfz|4-H7Zsy+x{y%*2;`n8b{~wCacl>_~PxgX$$Wvy1 zVWzvl#G9DqlVSADT)iFd-~5@O@7|fz$EC0%E02sBe1@(`IEk=FZsQ2YWU??#B}QDm z?o3x11EZ@x&xDlz$|7|uVr!0~VB~Hl`WbL7XRrMXt}=_QXY$KJi&V0*FPrD?{`F1J zkc}+%LgrCViP{+~yTZy$WfgXEJ|UGr{=;0tgxtsJ$|;P$vD0)Izb6s-CyVZVhCO4@ zw&@{0=s)N$^e_(+PBO}LY1gV_7TJAUj7JWnRRW0;{!~7+0{BLv7FsM#*@h7;l?J08 zh1?7KDsi4P5oHmL7w10a{7q(?6@JRD`a;7$&~FKgNhKB~{E^P^gj^@SFT=kqqU3)$ zEhSbtK??n5W$40CDn)E0!`2zZ9A`!KJBV^l1CAgVE&+nDASUnQy2W^#{WNzh)Gf-& zmUSz`_yIdWZoSmZO%QGeaJ6UUHH0f69&bUpiZNC;O-DLBEQ6D$Upx5CV6!|!E%{Tl zXHgAa$$T;q2^pv2P(dF*o|b2K$J4Ub^7xcMBE`xDq|JGq z_fiZ>ha#f^9I+KEha|sICqiLNnskohodsC={a%0|Q+;y)K-$AG?UWyyLJQ3rD;$q(M&c<+EKEwoA-O9wYC=eKRDAtcrJzsiORo<)X)uObx&{3bJHX|1$h2vN^> zT{*1v^$(;dMdI!C<;~gM+nY)vw3UQXkl$Zkoc;3M-QD#s7nk3h{qXAUm%FRimv4W# zYXmPA3mj-HiJK-a?dA2=n_uo;-Tw09<<0HY+c)icnbF|R=c#Z}Cb(r!FKBj8NO&fg zLpD;Xfecr-XJ5a%{N?-0%j;jxUS0iILFkG?<;c-Sb$_%?w zd@A98_P3dz1%G}U_=}7lRziVE6uNh>ZqG>+^V^b{)bl950|_bHjWvP;@k#!R$^+X% zA$!OB?$vEM22*`4*n#u|4anraUIs5YfhuPuh!8(oQ(A1ATQv>Mtpzn`A!`)U`j(<> zzUrd=l{8wD-e(|p)A$tS^hlk$wayDkt(1=Unt9|D9cRRhRB*4}a2es=YAXv7Vjo&= zFeRRr-A}?@T+W;Ew*pFt=k&Qnx2}FtlEq`+oI(bw%7BE8YBYdk=u+z zLOfZ^KI5mzr$O?*$`EJ+sj^kIH1^e)wI^;^roB-->rd{9Ky-3X94+-})l{{}$rerh znzI~_A^EbU9O*aZHqFZR)x#Hz%C{Qn{IJj$a4IQA&F3ePaEvI@$gR?oNJ`};K{Sd$ZA;9|6=cx8$d!yR12(sRM8jWyWY}+b0 zxLyr@qVZ=n?xF4x1;x{;erlm3`%T{U+@g7A@Zyg~3^Hp*;gEUPj715E0v-)$WRHyw z4OSV}va0RFs3`^ur^Z5(qAvy)OnGUXJo z_SXT*3U1C4TwwYcA~*DGrcySyW>%1>KwT}u2nf>Csng`E`$N(*X1rC(iKe`wy;23O z0YfOdF~`0huKwG`u%HKa?S#7#4xySMON>b<^Kz}-MFf@;4JKx)tyiaz-X&e^wN;PI zjNKMb_)MW6wNrP3z!QJEod0H(!F9s+LO|2~uaiMO{{QIZ@a69O-^R1f^WVI?f%UPZ z5Rieg69m>T2;`<|+tNU;`z1w!iFJ#)9c|SeXzQ@+LL{F=;9a!c6Mu%IsRRG-p7={W z&G&!v{C{{n*zy0ZJSF^p&7RkecZhe%!#Z89>yl0^P07`m$D>PXr4PGnz@P5Zk^gr~ z{GgsD{(pFw&;M}va+m*MJI|Bk|GVT7osWU#(n;*{Nc>lSI`DrrpWRh}CjZaL%Y6O+ z!{Omz$N#tS*xcFhV70ef@ZapE>T(90;|G0<7o%rw4Nvmq$;7C%b3xU8t}x0sdH(!) z&8gABTDD!J^;u&zqU=Dr6*8fO*$<=-rOlnOob4wE27E7j+WE5A%5l+fPrb&#)yYa# zibx$^WlMF-SbcILNb0PM;*4QVtq4U^xpZL7{q@C*7w~5cMOd!wmtAi~<~p-_>2Mp; z#-nw!n!uMv=hkC$|7Fhq?lB+@=l{{mK|cQD=;ZKlcm8kVS)>1_;$Z6L{<+Nn*|~q# z?*7Tm(w4nHx!#v_{w&kguWSS(ltA@g6&)?tg*-lNI@)hE;w{(HG6;msyDQ+3d)W~U zQWkL2a5fgON>AA3$$DLLPFIL^%Z3Bx`rlkgP_Cnu!h%`|Ou6o?7@!r9ZVE1{VWTgq z1z+nT_(ESP)d_^I}cT=Qi?RCU43?T8^Ww2-sx*85|Dt_kV^*yZGO&JlXu8 zWd&JM+3f84YFW!rqpM(9>C9qzjeXcsR*Pm6<@Pu~(=8#Dky3{QWoYm#abw5D&NyN- zIsAjVR6;IJIg7>O>fx&7Nk#CLn7jD4aNWAu0@5~rVA(~^hTMVW!K9t#=lO6%Vm$2Y zs#Sf(no_sMGG>k@s9Ne&Tu-9d$e@d9qfEQ(W+|~#X#OgG_%4n^Mf!r{_^o?3EY zNV?6n%AEL`26UFpPSJ2MNI%!V%GZz0kao{jpYG>>_cD-8{{O+CaR2vccmHQQ&xc+8 z$2umid9C5*5#*sX$2>QkVplA$i?wR5@ep4Iq&%V@AB`~UIF!+ibkm&2X? ze=EtLhNT}xB|{PQg!Ao#{) zhb(lPO38?*MYWa?K_PSmVj5Ge*2xz5(`Y=kCH1FeP16uNE(_v_`96sXV&n!^TT_qQ zDQ#9MFt=WLY29TfWS)~&UasCle?GCfyZqO^3|PJVH+*?=l$ZaGhc933#zS+ zYWRFI{B;?d?J{h+98!BmTw4!J0lx*nnWA77u><+4U<$xlNF@vvy!L3-!Ai-s-g;pb zGqT?KZ9T_-hDu?25qUU_NsCHC<;|?jmtFCAwBlj)aqhWFUb*pBMZC+;)Rt})K%QyQ zE{HtSq&krNxfy$#T4&oYHr5n~|CDHHA>A05U;L;p-YSQ4F+jidMygq^jk~(0ZOg6w zVOKitQz{*2FT3XDQQP`cDaSK*u8O7=Bd=}#QO5_?aDGeW?80;h_&U?OtpPK z+44-q+MNdpj}Cn1V*g-7128T+SW1YQ?;J<)kgwXxx|v=@YdEk-0Z1zb1rT(0~GsQ*57OoC-!*-pfI9y924iBEIPuwCyV?DyVN($wVjt$R?RFBUFNly zU94@ZSyrn+E7i3uRAVfu$GFVN8kmxeJbzkORBf#9xc#<6Wr47D&5QM)>d?%Tddtkg zuEJaL2~>D12=2>Qdust|!v$Ru(KfwSW&ZDmNQ`{=LP;QTYoT+Q zSd8YZ<&{nIsCP?WUcx3H`#9S@9iOG;zYaE_2Kn!JaCnl>|1vn))qmW|vjO|h6U+m@ zvjerX13gN1_&N+WkRiUVyESHsuj^)Ond0k^c-(C9wQ|sEblrTa_&OXmYw_Do%J{l2 zyQPh938~b6Si@&mPaWR^u|IM8_?`K4_rTLa{#Tm=s~gANE5J9&|HsGq_^-pA{J*8A za4|V^yIf_0baJwLUP{-Qwbp7cuDR%547q8S3Z!iskdni>TKF!Jhq6ZDX7ozGeBgZ= zaa{N)M;Bb4fyBU>xM7wIO=T3elly=9No?It-lDr|oPBlMj(XLZbIRe?={p_pj7fmo z;3>arkEelKk7reP=AxrqXim)TN#Kz8A(e5_ZLtu|E={Wyh?d_F9h%_8qa<)mujHQh z@eKdY0`ZBQNP7tv-^7`Q$7Ls<9FuI5?`Ibsp5}Nb#88kO^#P6H8HzA&l5aw^-EdlIHKpykU)d;4 z3u<8789~cU#QB7vx~arydx=0x$gx`5&rz--GP6^Xeq5PY(==$C z1+7$7we$HIh%IAM+GLBY>Y{O!rL8(=jBGiQr8M1UYVXnF!29sJi;>%0*VHvbe`J)Q0 zWqw8{jM#`cBN})no7ZXC_K=@L0!8Iowjt(rgK1TkrEIU59C$|Ue20{&onJfTzR<7?3=4$YG?2%BqyuO5SCq1DOdaJ@$pf< z>ogiS^SUbMS9MH6nOfQo-FBNnqiV;1w86Hpupc>HX&Kn{Wh$-h`cX2ae%M}e%O{zZY)gX~z+XqR2BF1uRY?6yk^R^GCmzE_pi%fS3Z6M7l^ zmrSZvZ2#$|@ha}#PdkOze}Ry=F8-hHnZM-InE&fAAOCgy@?@9)V=GTf|Iddv%bs%`8mvmf8aQQRXbEd|qSnHy4*OW$U08ZpKQ>SO zl%7uKzpt?Yiud!UnuC1EBnL=$a+wPkWwbs>^ZA~2HKm%*O&8P$dV zchCGJpC+>U3ZM00< zqOKm^<`hXK&1zKDE_&%>bNKpaiSxf>_UGpOk1t>3^FJTGJRa`O|7|?m*Z-bCdZ3;9 z*QowIN+O`D-Zzj0sH&?qCIG7HVr$8Ns*lpgO#IX4fM1@ho6r4I)&JV_{#13ep`1Te z-F3_N(*laIv}`TcPXkhaqC7wC93+-Z+C~1GW1o6BroqHz!I(}G8C}sR2sYY(UgrJ( zCnqm=`Cqp3EMfmK7Z4&cp>S1DEQ0$lVMQ7V?MJg%{wd*|+iRw?%_tM>CjNMh13W3o zO4(IzvzTFHAGZ9}qS=H5B*HN{KhrJY+QLlzOxXbqekHCf^c}I89R5LF+AbIOP)RUj zJzPgc8y3Je?RI|R(f2b4+5I}Eca4*X$0MHNWV2+9(|nl z`BW_gYExO#S&kL{lpD>zs(LTcpHBbVc``0EtCVF3|> zy_Cnym5brvsab|9&;S0E_%k{QSVUIsqv8A?oE+uqe+*w74R`jRtvsKhYaGWU3OI@x zlJkuorX)b4g!*v(F2wFVo)F&eeTMF)lp~&mU}i>qN_-zpd^VDMo(7YB5TIi^C%|m1 z_c-u+pP_(EWagb`VMNCCJ@KT}{=Yo$qql*-KrDck0wolZ2>CQ1{a*j#_Ltk3MWpu` zI%l&P3($|}x5%Rr@AW4%K7jw1==b`g-=hQgfBj-QIS~J+|K#)FAO$qS?tK!XG4%=W zebMI+VegCn2;cX<=*P3L_r?F+`wabvBgztvt}ZTlPpB5aAp6uK_&|Oav0r=rId_>y z#G46=XQBTjws`GRx&Lo2&n{kH_GjMeebn#&mq#yO9Od@^$??f<|8M2_TZphvC&5>H zE(u~1?fw04bT&aea=+Sx5*num2N8Y{yK9<^5>6tQ1u+R?u*Zs(;F`h9SsJ12Y>(DLHPIH-$KOWg-^cP8?zvGIQ^ZR zqQjH${ayjN(cix}a-B26oOtMRE~K)Hh|WoX&XSmklbHsSza5Mu_}=%I7iS3jK6~J3 z%px?V0YQ@p(|~x8OhC0j&!q4t{u#3aAv>erNyMH*D+2v^vY!+Sq*LedK0?qFB-G^y zbA;{hRDn9AipL6-OW`EQ3jEh2fSQdGNIEFt;@=o~!~=2NvjMvakJ-#fC=v>Y(|t8| z7Y8Ux0wlN{i>D}_66E?U@c;|)7x5-!A8b|=p|Wrk02B8Yl0DnKv02Ch5(xgExKlAq z0pL3p(cf7RV;@~J&&&gffb*j%<|tr@ycdie`^Y095#qE<#lg~Z9H&=YioJglgd>75 zItOIm$b;pa&B8=zmgpOn1fDui&flDW^IS;p$w)KF#5j7NeTME{{cjgHz23Wb?_3se=98Wfr%*&fhOp-$-3!tP=@$ws zp|VJBY&A?mA++~;LbGvWAF1rDsdXGAefXXRJjT8cZ%}4P$Z@g_kmJl%4uZq}aM(W- zSi>N$f;eJc0%t?72S-2Pghq_TLh%o|T<|m)N0`S^;>Jlt#45`yeAiESOd_?2VX+7t zm0W?e-rDP(aTE&pY>eV5j`tCb(F65;GaT_h(LN%-B{U))I+siTMlbyfv-CN7c7Aj5 zyst(A?REE%e4*F7V+Js62pAhIciD$eFqh;-?*ygZon~hAFQ|SZ{({yw6+Z;DY6yw` z>A)jCi3$8H@s)Ijah(B5%p=j z5ZJ~^B#x^CHXft1+w-d{B&L@Ja!IR&EBSoD#0mrW8H1KMMZZ-hIIpb7OEBxnCB}(A zM#^9(fQrGvxb9xvX0GsxzNtrYgD&=7Wlj?v^EeU&`~$rMBNK}zj*IuiFY-Ida~`H7 zlDql*3<j7ZkCeDYiWm zGEsd`sTs6v67&oSVM$Da!|6nbW#?y-pV&C`(UqAbB8dVx@2e>U+8Hi%eg;xU%+QGF zjitHNyS&8|Br(UM5piQjnoq&lEd%%7H4IU9eWzR|Wn1aY^VD8E$n9~i(rn2?#6zP6 zj9HU8y^Q{o$6WsNGc7UXM<9MZNI0I50}IcC&j2nBCXV&iF;L5viOE!uTdM$iK)97j}hF03S^kvJH+P=}b{@#4&u$6|U?%YNR+5q>L;mL(lV5nhO6 z6+T1Xf62u*r(*&qvCvOKpDiS$Nff$wuWrR!<#Lj8G*;6WqgY6ebc_}(fpwvjnIP2$ zq^1Bz#{&*x(Up)wl0fbOCJqoW$94M}kp_E=h z;+&ZhbRdQTD^A+1SOBku8UrJpVm_tkEDC=VGQr)e+inB>PB%x;{?SG`hu+Ia7{_7% zo{;d&r*l$vHe}CC^xfUvwGhh!$tRI$E3~&cu>j6!aOZPnf6vkE?$zz^5C|tkzZnha zESbURwFDe9ahk!gBUZCqB5KKtA0qsq&;XwaN6$E$5%Zn+-K!IvI!Dbva)o-8u1H)=2F zeIUsgGw4F58squ57tFmUk^T`nveSf=o#JnpM@*bXnN0jFcSvWQkZ?r1EO1E}^MkaR zL*`UkU@;fsj}tP_5x5*YSCq{pvv*@UCl?^9uxMc_Hk5HC-AG8zXTJ;O{0v$n)7)Ni z@(VE}4YQ>8d>w>bw>-{e>DSy*GA&5Jk4y~((d*UC?U~|onssp!gZV756e7*EjERl9 z1nHtgHF(wuy0;;5>6lvQ_D^U3yhT@Muh9(?2duzP#hM~@&z_@a0^{fDB#UW<{^Yp9 zj70AF0ff)Q2SO&FB-A4Z6wjPUz;(tf%4hlK{b@Y&p9`T@N(wsaAR{N#6@REamgE5- zS(rL7&Tig_f8qcJD*#A&3Zn-yN~b@J*qnMo^4{3|lvRSrjYP}f=`s>4R-%75%&A&COuU3nlEdIus>rw24>`9E;;6ghMucNVI34-zBraAMb-S} zdQtl-Ero$R9i6p)^h>MZlye_}ZUx^thlZIGFNvq34_9IZ>rpn=y%~PiFLGMx_0RFx zEXae;0Cz`Q>>a(%OWAB$5u$P~qUI<{;Bb+jR$-1nMeCzmk~RJ=jeGh0N@a7Unbq}! zDrUA~TJNA$)3m0i&ErpP^)5VmAvfWL+Dn2xa2d-15>^tk85S7${zC3Ob->Akqhz0M zVQ^MunhvY=+w<$Psi<6~hyCFohoz$r3l2qW3dkN*tkk6$QC0byvIQ%~Cr-NDVU8|m znEL2pO5G`_Z4WH*J>=7SVlQDm7IQGB*yM6_XQalT1o=k9XAeI=`%DbVq1=I-)WjJr z9Hjv~7heihOlPZxRHo#8{IijYL*^+7wUFYyY_P>V@U`M~G{SBlPbLwW;F#PoW&8#S zsHNC+^Yz&|bOPoMJ_Ra{2>Qu@^=gIUh>S@jB*Fu!wm4#G1@QmB9|-&oK1(4v%0L66 z)N|!G1zif>pl5SR9`+IOXuJV1C@5RGTpXfSm|gIuB};oJ+ppWIpb*xcimxC zp`}u5W6_PEgowP{Pzt;zy?#5o;X*%(hz2w|yS{SHBLe#g`{kqTGF6pbj)*a>mh};o z8zCKS+BY_ethpsGeTlUJ=4qiP18WOB?H3dheUy-Wge4HljS<_koTB5z_obOr*^wo_ zRvN>i-g{>yKHPvhDwbgE;J|ZIER0T?O;23LhqO`DvaK42CoD_=0Y-2a`{3)KksVK= z-Ei=oaz$DY{*Ye1w`!_3?8{4Yp-bm#sgYmXYk|>f#M0f2a5PC~Im-sXvkD31NI99h zVBpXAjx8&SUYI2wDGPjzC#8ZMfQa#=0HKfGhH^0b(xZfM7#iyw8(Yq0v7&)DjuwU$ zL;pIjzkw<11LTeI(kl)4ypk=DDkNasaBmG(;He>=a_pX>cfWEWw6O?j_x8Jr&Y`+N zu5TKQS*BxI0-;U69vLN*cl+p_fFb@XPNeAFJ_0AGjHMxwQrjlL3WQ9E12ou&@-Kpc zc|r!#_>^L8mqN%PAC29kqocoO@E4yWU1Onn9AKw@M?&UK#SmuH_bC_u3UB~}qMUvC zVlWi{RNYBht3Ti~iMhdeHJ5U35#Hf@!ciCzSDY2DGLu7$L)s5y3(sNEim|`3n0m?n zF~IDKT9$$^EIO`rtb+912FYwhBGH4c*i|;he@>}SK>XB!S~C`rv?W2F$y(NB3LqF|tAB~b&fLKU);!vYAA>T{D zA&Fpv!hA@+0l_*hoVb8pM7+c$$YT!yEJ-hkWC+_BQ(w$sAH5%5~+I^){UBoh=t+C$`@HG=iaDqv=j17 zn$!z3Xp{lFMpe}zAtZg<1zZiSkY-VTQ5x@2u?j)6NFgB!>Sxo5Djrsct%@P3Ml@dm zsT9wZm7&sY8fq7ob=}jXLkeh>#7puS&y54zMk?M65hZ_MTCjguj$6IcyC zXUQ0ynKim`vBl{@+ za`5FqGOQ?;!YIUSi`^^wYTW15{WK&(T+c4gcCr*bN^=p`29>CEh1Kp}J^+hAbiYh+tSq~F zlcy#j$;CWlu`%jciq!x3fBt{vJXBw&roN{iDb&q{fACDBLfShgHyV1;0B8L z(~7dTj49d-B?qY`e_(#rSvq(Ldeq9R3K$YYu5xebZ?bL#=+(!~_n%yllw3|s>m zlZfjTt8M-1aNb=r@12ZagQ#z1wQJ4!ZxO!iKP`+GAo zW6@&obZCq-!ElXxqw(`2*_6OOx=8G z+sv9tbPY8yWfkh`6$f?+5!kYo4CS@7Ixp?J7I*{PDv01!(RX+x-`$#TMRABT4~H=+ zoe@j;HTR6<*G+yF4LhXrQc_2siz&N{Ln^6K<%Oxb|5SlSYu`)}?mE3R5-$bUI7^g% zJt%jQWG^+Bcu5BD;5!8=MMc%|YCeZDx^{IuWbyF=UK#^^F0Iwy z(1^#Dk5ryZ7jJG=MJuBtWrd%TjyB<$$aLD;J&|c;`6#lk38|eZj|BNI>5s@xV7BgM zovk{%7F2lBl<^n^s%U1x-I3YSE4n;#`3uT?9?i_V()*ET<&{nldq^8_gtQw%-X&6n zecm%tiTqlJenZWOo?7MA-`W*N<(jWeatV@c$yZKF$j4|MeEx_W=o z*7iC~w`Fm!!{Lcq-Rn^PWG(M?gL(qi_j>dm-vVEU-=}GXZ!w}z*%Dtjyg#EgzHYov zz#`v_-luJquTdi(*)m_Fz2!~x>rf{v&Ga_#ys5sVL|dukRB{hRE2&at*46}l4rHK< zdHXJoLv9JE$HzxnLcEm|n^VHuL6m#Qg8QO1;0jX2i!d+JDr4W(wahS6jbjYf^m-pi z#%i>bBcx_wpK|CH%_J} zZ2)bk61pzqXEPJ}Gz_0jRV>TU{q-puJzJKnd<=tUUERvZHg>kCy7&nhI@^?M{6vkM zt!jGyNerBA>fb(+akIIG?5Atktk4tkM$NsGQe$PgT{HLPGFHtpp}ESexvD-=Y0@k~ zqIC?ijZ|mTTixjMwzs8p$VQu6l{%;`V5$1GysfQdlvM_|vhG?L+FJBsV6Pz&MX|f? zk)d^(Z7#2J$>^SepfDy_)>a8s5G=;LG#F{_ya5uE$Ju#vD((f@)~M*?#&) zey5^OmrvD2-p3^1bmSAugebOH#C)Gb{NOW%kt2J0uEQA9WbRd_0yCy5!G1iwj@XD? z7nJv*QQj4owz9ZYftLUUyB(2SUsXv&D(s_$bRvy|DUlxcx(^}EltelD>+$hXKiADB zqJ$gA);_XTH7Sc}-B(%Fd0O;`1?ckoTXkegN$&j375byslWD;gh+ub`7J0F9Y`t?F zPGWRV7GHs_@uz+B&!69!O9Looy?1u;o_Brp4VZ!OEc8jf3{dAXKmVsH$7&vlRW@7G zSAX;97`9pr267O6EW`KT>%o*=GFTC$ZOm^3CF=>D`HC0kc-e@aZHc`st2{uq|A3LIEK%x$8qjRV^*MDve9T+7goJH)sDTud-0?CR}@>cx)_SfE=qzk{)PpjL(@%hzDqyL5~Ac2*rQITr+1dbEKSP@{7kwO zO}#96jQk`Rh?C8$sEYQvY<3W^=z%fs*8}s}^Ik6%HcwHFXcc3A4;dNd2@GWbjDBL( z2H;Q}fIEN?{M*rj=RvPl6{zjrq=GaV7!PdGEfup5KGOhuKb0m9w)!4RuMb`=bGfrYBo)Rbj3)C0DY13Y{irRHW zh~+2#&(WH)!$DORooS#4y)t81+LN_iQlpGX%vbtu zoPh^WYZ8Q?pAqyAyfOQVoZ z(U~1;1B#$rD$>LmOoVEdT4sCqWbwcvkDvA&73bv>&U;Sgn`A^xm!JRrtNE~hIP4Fc z!RI}()YWzp5XcNu{}esoV6vcNLjRj+%EKv%NT0GE0!OO#dr$tITg^SSR|Uk9y{NuE z&|gad$2vrM^DKQHdjeN{+U$Qz`&p`whW-EI<;lzZ{y%wfyxafVc%(Z>2+~4QXNeNK zm8DXN(@=3ri|&~}kTeZwbs&v0JVg@~SEv?~s{U(MSKlLZy~_^VnRj5|YSjWyPSIR$ zG6~!4T={`KxKEA6!VQyCv^U%{FQmuf6ulS>UQ>gi^ls#u9SsJvl6J3YI(Bu6iiRPJ zGz3R+9l=U;eh39fe07TcI{53rj7WQztk)R;A!t{E@7N%|91OlJ0byR-AaV^$n+*>O z%?`8ehUM*!dRpT%kbEj@RsX51*!s`6BY~8%o9mZ%5q5PGr8bKJXa8E` zrbq$rHbw2G$ggHu+4nULLzpgv3NO|;OA@v-lfYM+snTQWxXtla*6cM^gixrdn+YjB zitjf@7VSq{i99D|E#xc+o}-$CaD04J20*^f?}XIYac-B(K1G=d*}Z_oNFlYL{02%&|y^^FS%)st2RyctW+KsefA*qD;uqQtH>@Kxn)YXNX05`BM!pr z{JMBZ_xzuG0~l|@n&<3k^0R{e*GB)>^{Dv4FSgUEABXMi0rmR-a5y}Ck<Hph!K72U%0?p~{6pEIOsZYcP`D!M};!epa`r_c@$6il-*1I8b5(Re9qZNgz%wj$G z{=)}HhuZGBY&K&-KeKWyqu(BKR0BFj{U4>NNd>8X{0OVK^hX&$!Y?^3qzn zIg!F)I( zF&^$^$y)X8-r8uTB9PR;+fhlix$a1;mn+jsMc%Q1x1*Orlm?Uj{g>eBS|{n;hy}m0 zQA?ufueZ6jMmTn-?MS6RT_1T;S9(hdSq)kfX?VQ#MTNtVua!_d#xWTuK5xyY>=xT3 zl^XhE5Qzqph;ZJLK>F(n;^@OieOB|61;KpP;u9drqb=C-j{mxH$7SqvEnIjnr7KY)LyTgS;UjQ)?0q)2tvrkp`hVm0}V3`+7nKeBNyWk6ok8*5Z0qJ>QIi3`bYoK@13Cs zEH8yjiF;r1^#jDC$A|`T#Jt3XTck1d%?C&Qqy9kN*2wC<0*s=^zPeVb0_Zrx0ZKCy zpuG8J9MH#) zXrw~#0kXabCdPeF7RdgV2Iy}`{UdQsBz`O~Kp5@8jr}op2~cFrlEB+Tkb zIf)|b5y4xcByiD-Blsts-6rEPeUJ8>J(N{|v5 zd;cU7Hhdq89>iF^SvA_*=hS_R{qb-;==DU<237_ z**G#~MT^;mulKUToi!wz+VbC82KfX0&_deS`;R@e_sd@QEd>&UO0Ln2sr*i&Iwk(B z&!_UtI0e~C%f1x@>`N4?zmo}xSoBJD)3;WV8v2=uPZz)8Fzjbt%;c*ty7AME}oP{#NIy&izWGgxAWfw!&;ZY zn&ZM7&i|9+;bHFlKRG_!`G2?a*!Mq_VY+uu1Md{2k(@n!1M*Z|vVhCc#hVrS28JEU zEq8;APbjW#m(4;JkRZ-BLP&2CJGw%hvsN4h@P;aG;u|jV2MTE5kswCLVyB3cTOg!2 zphRvabfQ-lwt#OQFN7lIllzw%kU4eZQ?v)ym}LyBo?L*#((6O=jo_B^v?Co# z^zGYk&&^9DZ~LF3y_3OUukh{l+lyb`oV~uxfB#LyW~bImB<0B)GS0qL@2_z@JvCDe z@>6M75TUesM?A)H!uuifEP%S7+kf5OUA~4<-Cm!aZ(wM^Fbe&izkTz~)wjRAdi(9S zS8u*8rRu55pWvtz#8oifetmm+^W)jqSFf(_{#6f&*^%1?c&{(-Zm!O6f4O-3`t0gW z5s1Alz}gdF{~%?6SzzD)@b%@*o6Eb)+h5LK{cwACc~c2jobFcGM@dL#x@k;AOqFB2 zImE<*Rf6p6t2e*=czJVs^|k`jD)@OEm26_al6F8fRKtF(e?bJE-Aab!LBDB09{Tw4 zRJ@7tq@h!v&PhNxhlD})f>oJ_?xqppQ|5c8Xn1J-JdNYTkA2b#3 z9Wi}Ai5*BMl-nPQghj54tnkMS7BrwS#r_5H@#2=aEb#a#8lG5Rge0PnZ$bSwFuxT~ zuk%5iDVS`uXGtq7ZZmC_5AiH*ml<#x+&Qdmb5v||=%%L|!5(cn>nBfc z(sNUKVhu}&jY>N#`xl=1wY$l*u+HD%p}jv!62$1IP2v#wlqDmPkDZc4Qw{sR^`2^?r}lexnQb0G8S z8d<$e-xu!-IzK835Rbi9chCBtW%+;Tjn>8g2PZF&iu`|P|J%ybh5wh_0I-gL>tZ>a zrP;p|dZQryibV_rI=s*M zlQ#V;KiBfxSFMiX7S3-?p59Ix+64W&ZZgf|#Baen2RM z;sz1%E|Q1_lUq{|Le@%9uP@&dH<77=Y^$b#t6<)dXqNYl!Cc*D){y;_tS9@anptHb zP`OyYCyP^*CDWAgIOAOu&jX>8X>3~=TKh_O{?DENGn?*W=l1OE_Dp%2_0LCie7@L{ z3#^=f6|&Qn3KHqJPsw-rWwEyhGUCj=CvgjJFz5+jbYPw+2^pi5XdZUkx>qe|TDI%-ed-6}W{Vzqx z84hh$u%i9v@Mv&cwErCK?7v%iO8394mhl>gT{(bKF`m2usKn-AccbctIdBV@C$m#D ze1XR=zjR4Y6XO?M3l9AO%|B~+I6orsPj9qq}sg0zlO$_$&w*NVqE3*01%NZ>A1jnQlky%~N_XUR-eZq&3Mn^ckT zk%5L>9H1!IN{7tGXgGjM%7K{^V&!&_H!b4`(iZ3fBIsp05~#=*$W-54 zj01(t(_{*CERHVV_J+meR8BkG2{jivp(2Q!Z?}wGkWLZDh|Ec(Y3GwU@zFEGUH8*b z--g6REJA07Ej`yLe8VE-lL>Ygvf3YZ?;mjFi6uS@aZFX|&WK>n0~qdUmr9kx&2@Wp4}CYfx?EUE4gE?YRf}z5nT~q zrNU6a%+l32$4ho_66lN6Rxf&n|0#MmBqQ%bpSm>m7gqbyaqmll!-7ztinpsZ>WW5C zINHkpVqqYATZoTK(Un!(aVbHkChAe3Eq>NHX>_$9G{Rg~tc6vq&?%wDohot*Q}{rT zi+vyMaW;-6tv0=3Bv}SU~jV6z90! z0rqMa>pDGMTks)WKo;!{2U#v;BnW{Shsb&K?B@FR`I_7k(v;p~ZP}Aq%(Eu2Kd;Y3m4F`jN z7g8HYZ-6$=qK*9ryx4^88G>So3y)5_88pyY4%h*ZX- z3|;g5S}nhyhWlc7{EQ-@zh`7gp^+tVDQzv)F=9#J>EuELxjy5B$7Zjmlf5q#NS|OH zqoJDk3jE=;?q~UVadfq6gb+J{Rxz_D&YBs?hvXvhz@e=uVh_|tvuy3i&1Rwc8oyVk zX%ZqZ9m!G{a;vKZP71S1L7WC|1UZ<5pbGA~KDq)y#5Re5eMJz%Bb-LWlXCH#L_E>! z!|WUJlb+jiFcylb1D-F=u-}AK95ZBu&#OL>K7J{6vN1aB4|4J~bSKVn9HSZIF`6*+ zMnE}yqq`StnA2e5XCx=%w7{%Vmrg{9eCp; zp(98vg}w4w@z_JK^t^ba)4XJ;pPd+c$~w+VfBA`db8uKcGekg@!e7ZG8M}|3D)h!_ znj}H*{4|ModZG@kS-O={C_}%Kh@r8pcZbG4R$_>(;;Ded%n_fRqP;juNCk{Zgk7SC zqNXXPknIZ50M6&E7~+$$5&e=N011qYSp-?nGGYqAf2Pkhttd)TMZ{&Z84+wzpPzb# zV>BiY`t*YgmZ}?=)EVJZl%|7zo>!;A-V+LiMVjw~ltDRCHRnChg=2^EoM&MQH>eDk^4$WexT+EI_7DXhC*d)R;$R;Nw+a$IGAj4YY zDVkzw?DI)Xyo|7CWMGfT3(iCd-Wc&Ii{g}bh^fFaG1lBNQJ5#=F?A^kVt;{r zmJ_l`1mbu=z()`-Ov+YYEFZymVul2&Vi7R-Pr`{UR_Lt(<@O^IlR#`}M-3s}PT7xP ztEi7o(cY0If@SxVK*2!Ogppan6d#1NuQNsH)MO9j&WuDUN)Q(ZYt&{Wf|4F_sgy13 z0cun-yF-ji5Kfbe(^zscp}h;D!un&LSkzIRgyP#di58&11)R=}sH+TsafHP@iSIzb zUZ7`U8Yu{ye1?5_IEbwwdmY362D9&T+o2TV*qttHGm|f5lt{`k8gMTdj5YLnZDm%ynQyu6FkBrHh+GK;v^ty2P+@Ohy?C*hGkU)XjUAZl+!E$ zKxK!KC%iuIbmaU4_0p9l2d?+JYNurX46A^tGv}Q|Q3!F;+?)hb)RL(_Jrbz7Q6Tmz zR>^_t5E$d0<$N!hoKh#!K=%xxgK{Sp2OlMBnleAh0=Ig}RJB);eZc&{m_R7}r$Etc zGr@}Vwo}CIOoV-H+!JdpJx{ApP47CWerGi3yaHx4D4TFSl&X2I9^8xu6|-y56Kpa? zT1&TGkTzP$x{${2E0^Te*v!X%RtTIz#(Sf_07f~HJu_5Gi1&z(7kb1w!Ag406Oeku zN*8<(a@s2}w$iSIFl;Mn;_TOAxpGhU<;F^F$K%A;)Ea{=7D5^JGsbvz>q+Ws(k?e= z)I;Kpufzcqk^uYh0#WTgnF)N1Fzm9Kv|XiEf()jD3i9l<4+J&q`)I)T5uJsMgS$$7 zFGNw_x6kC1q}dZV)tsc%&qnGcT9qx&ky&dT z>VaP+=IBoTph~n}iTBczEl7dBySux-j@WzY`j%e9BBWEaM+14+cdw$ui13gFytLCB z{adGwHN>*cuf||VaPD5+Y9Rr3?il<22)p;%+caiE91v%}OQM*Lsf%MJhG=ObNPYE` zBWc2sCR|S9Bt#h9y}CV5TVD_#{H`XlS4vYLBDs;2l9UAlKG4|M-MFXZvzSTAUQLB!vU11T0qI&oM~8h=lSPun zuFj&HUy8k}2Px&aBI_w*K6zf@5cP@q-LQ@P7Y8X1D(6B4*g98oHEfejS;9^)v_AF` z`KNxCmjBc)<}EG&*2{mxqv26r{yRAw?DD^D<=Kc>r`JXoxh|Kn_etIU!Gkdw9lI}f zw|{oGf3|h|N86AbEd**8ct-Zoc2X0|piPeIV|4*X+qX2(&%r_KXg`bUVn4O!72Qnm zLlsis{~YXzmM3UNgCr*0HpaCZO!n$h$za5E=i^|jK)3ZQ*ij=*uq;no*7t5F1;UbWN@gU&{{Lj}-@DtkvBhEd{rB~!z)zWHIhkY1 z@+D5{Gjry6Y`67kVtd(cd%D{BH4q6&s40L0fO6EyJfHnp*Z@e7q9jt5FG-16YZ{9H z2y9|+?E4O+;sOszHH@=v$aeD#iDjTS2e(6H2lQItUcLoWyvV@gbr~LRA658k>?KRE z7dn+j!&UPP4p_E{d!nv0fb8@f=I-PutADJ4vlYOs#MtKyPk$@-M^^{cU3WNlS4P$f z;MPM`Gq5q7*Nv$T6mMQzP`r7)7*F#M4lQd1PAKlwD@xD#3L zFcVsCtBKnQzTxf_V5&5}l)4XuLW8kWzxAU38wu5WqHr;IhOjW^QV(^7G`X;{rV}iX zn7Zm;;+b)X{=MkUcIq&II>|sGjBv2J0dyffCw( z+?hS7g?RY&W+~VLIF$k?op~MnD{SlmYz(5q^hdb1^bHqH=61Z*n#*hou2k&4No<@5 z1W$(=fM|@_G+!^y{q~6U_=Ipaxgg}S;3P6X&U=hMTB2phb*7zn#2P${P1H%|b8fu6 zvH;$k+=a$zeuO6kVbP~bU@IXf`cS#C4;eMIOLU@O?wrR3 z>cbV3i$g_8X-<@6p^wSVKp?EsV2Sa|*h1Jw`D2E{5$BSC_sVQOiTvdCY}SL6^-X-v ztD?(Ubp##wTjZC6F?Lw@tVO}LTH5kijFNxaf|t$ssToyBh*{x=npSPd_&d%*!S^?t z|LSt&fQv3LL??(TyPfCfYLG3H*?roj=dg6^9n4@zq&0F}^5{At;g*R#GALkgXJ?tw z`}dqPjVGo&+}Jg<^Ml;v-@Ty|J%VqYyWwS_CWR@uZ-9iVF8MwH-x-7_^QeR z6tpIw)&%qrCZKmzDkBuxOZAQ0(6n8xnS5OGPQ z3?hP~m@;Av8(!d^a})=G5#o=gn-Ua%C6%?WCBh{>_oa3myf zZ8M6?#{lC(0Hq~ee>(tr8CbbSb|O4&4-gj@I+9}8NiFqE=&2@lLDhLC|3W=2It6|Gt zcqX71L{8(&YT+DVGUiMY?>Y!a&}%}m@u1`pL1&jmz#RF;k3)~E@)aK-#s}``9HNem z^K=_N{OaJVgHBOsA2@r+mX9$=;ad~VWI~?NOXVdgaEHH7MtDNGC@BIU^2mDQ>kFq? zo8X4uf(pz)5~9k?NA?eSDsx2~c8=gALK7aRV`3x4thcXOlT#<#w;=PHAD} zeh8FadSJF1B-zr7+Qf^SQ*`s~(G9x!_Usy+U8AFObo#%Sr&nk1PtR|T-l1)D^zQQ8 zBlPv@(arZ)ryENTOJ}2^`ioh1US6#WU+LPAxU;+n%*@YAOTnz*GrPL{57l|rQU7yq zZzliy{=t6h|M@8GVdQ@}8()g-|90o~>)oi=Z@oWT(f_eT|C5>ccS~;_?-HvK7$RL> zIVc~frEw&9s)%%+8Ia$EV5tJjcZW!%F+q}}%;zLe`cp_Wf;iZh%!|znoH^5iL36Ge z2@3GVf@EN_=0C7@6gS{z;9^)z-wZyTumz+!AvV;6r$ghs*J-Dj~8 z|K$&`^uwF^pZbD*=51yE&ocdMi2vDt)0>U|*=g%PKT3NL{?DC_FNFh)z9M_QULR*1 zptp;JNBU+Bz->X0!6E8c*|$^O(JD0{KGHyK$$&(EAE^jaPJj(#OvfvX1AS3(Tx-W_ znc0VCX3tmzf#SK(5|n`O+}*50qy~{an?>!{(bf6c`8S6yA zFilc zkaIM4w-Dk2b*w8!2T|qTT*&xhC%EKMX?~Olo)D4O*nWWm^!4>Of~QIL_f^V{WW`Um za(4FPb($nGfeKYIbeF~c-%Dr9tb!Q$%a*dnOK#a66FGVg$Jfy~I>SnTVSCBXy zMFkS)7x7<6=qha9btzrp9Y%J+kzZxSVYu(VfKhB+>@x3se;#A6c2FN<_NL3la66_f z{iy#85O=^@qgQ^ImKjPep zX?Tb!lcrkMcW)&+x;z7`eg*~~)ESIzas%jBDE1^$^YO?>C2;oEQhwCz>&#B054@Wr z5>tJldb7-ABY%Mq`j+332@zW;j46abXsYh{fH;2%D6Yr+kSFK8(4S_LVWn_5a$5g9 z6`Ip>d3vEk)X6lQKE63riNsW-taF$FZC#jZ;W7_J&3g}XD7(XQT#gG;c!)*>M?~1V zbb_1OL>YG?GBTsFit!BWJ6&{Y9vqq;Cg!VpK09W&i%#qTKD4x~#;BE`rSLE?a|SSH z;LkblVHJYSz)Y`X*Cf)5h_dc2IXki(T4sX0!f@_Br4$(_Cg&VRX)+Wz%5usVU{^hb zGtcGofV&!8HINl9&q&-E?S}R^>YbR41TbwaAQ)v~c99LZK&RtGO;4!sZnZi`CL30q za`A~-G^he0OfMN|s7xbTDVWY|u^6{oC6LzH-kez$Z*S3{itQC+Y%8ycncd}zUk5`_ z7_Yd?C9^HwZJoi5RNl*XZ=52HrWFqF%o=1v2-KKyF%;@f&`61&LE>KapOx)@!?2d` z*Z;3Z{MYN<*CqSk-kUdjt^MyY+Jo5thT)fD`RnYz-aptQ`>#8#_g8B$dw7GH)0Ne0 zw)Zz!^zo3OV~s>$WUy&2GSZK?tTc;%KMPU(J z)t7X=sm`hrQ&`}SvAFfKp5zGYAOB7jm0&y=hMhx`rNDlVgorU_CKzksnvROK4NdW2 zjS=1`eRY3x>_%O=DqxjBGT;HWEwUA+rzXh?b2X)N3G}dl+B@Ac^mW_qq92KdEF{Fp z3b1y}O9Dw*NCNW^0_r-2(R+3@)H*AFHt^N56V4Es;tTZnz(B9!E&E-KW>&TwkUN*R zqcf%~V4S&;8I=9uXEtw+0gi+-6j7Byb4(Pty18=Qu6R!V$;ii$WcDDl_%Z%i{o*b2 zMVx#V5vZ=H;gNq~-EKz2ge>9MdSm9Cmpikmb6raXLww-YZwjUssnF?1p8x^r9FIvv zu_ACn0fXU;%#_>o4#_-lnv61ew>g_Hb(?pB3hZ`u@A7e&9Wr;{R;P4JNMg(F<;D0E zF-rOp1f-8A%~suX*=Py;c6!V9XD0-o+;5Jb&&un5ANVkWgobvSm|G(+mA{H(3G5fm z3Q6Uk^NvHM11tf%HM7^p;jIY|vx!PGwnEsVkQ1ooDfk$Xk4em<%vsmrJ&&X6ld%ZE z`)@~`xm_!OyYsr(e*xz07CSCFJ6^({EXo;{kd@l2ie~l-OPQMpl;PR;bSdW+@4fo9 z_LHvVrSqU@-~8TIJIxc=RAIVFrKvKH@kMa&&4i}co!c>_{*DT`%cfbXGB3Dw*|&Xa zp{_w&S^kfWjuqTNH1E1V8L%w=Ykz0AT>oi*x6S|ZDD6Sy|I*p`Qj`IM{r;Ps!Rt4z zDxg&bJeKb)9Q7b_%cCa9CgyAiSDV2!X~Y;)vYjI(rsgFO%k5>`(~I~|wDUSIr!SrT z*rn&|Yav7sPZjNv!-YOw?uuS?g(KBQtRZ0#Kic^|3tg@ zUUt5+Qi7a*8r~9>O`J15?tzm_6D$-6(&&~<5zuhmjo@&U=`upjLK+j%&1w|b`KUzi zvpf#2Hf;Vb=Um|t?H78?xiSBryCL?BYEngT0uL}`^i;LNQM2KQP7J?>EFXA`JS*QFA@=_0|?vO7Wp^lg{_EspM}DdOO8FjyIn>iP@h2ID7i<4fkJr z8sG6Df+Zn7Awtk7b9edL9?6W38xu^T%Gu%^(J&|9m~#>u-jWEViEjb%y>tEX*+`q9 zO0#}WQ)-#Pgu6mrF(1NuyE$L#&V2E?OKCsvIjjH{Q2pFG+s>KXmGY{7JWBAg*F&jm zBGec&Y%zP`c65I#73H;hy1J{geV>{qY1`wqmHB_0N@NZEfA7ufS^odcPRsv4Mtczc z-=2+zW&Letng$}kBc}fj_jX_R2AL25?;T_*{f05`+4h#mS-_iGvx+5Ltn)EVf1W;kiPc1ruM`u;29Kkw_uCVpkQmhdeW!@9Z8N?Cc-x9kd?ctp@PnHGswS(riVY-)VA7 znTda9oRJQC>1u`EfOQD1a5d^T#s$(Q!s!%iC73<6M z^+Uv=eUJV$ZcRo53IDFhlx`k$jbg&2`tQyrbNp(5XJ;EHbbGS9EfdUgE2oLaayy7f zKOLemk6gxb8~=^t7{NIE6{M{Wl7}F>Q#(yC)NwNhK@$sj0uyJo%iPN^i3kZ(cu3I8 zUa<43Sfi2~02-oY2!}AGF?-$5#Gu&t{@1cglj2`B{J#!%%KZQ9ot@VI>rq;5LDpv! zaFWRFj9bVv**9eus@0GswqZ`rS|?T~f=_5fgmE3?saTmc(1cFE(m5=cbo&-Cj3^6~ z<7}bb%(Vd+i((pD$d~-i+lNa>Ja5lSmhEPLSF!v9vw*BLuUUZiEkOBOSj+O&)KS?4 zIn3|1fwyJ@2)S>7{K~1>q60+OB;P?`kJ0r{*Egr{e?32Xe|mj+bbRU=I>6cHYr)5d z8$ORTu-UkZzuMm~u^Js_;Ol1Rc;>x^LHqUH#W&xaoqq%GFTc9NBwjhk#ow<_uYNfC z``Np*o1YfXG%F+f^SwX4xjH+({`KVI{n6R^>?DPFshJO$&-2~)e?PrCKfO7<{`L6X z_t!V4S97QIup~b#$L4lFF}bV%{qJm;B{-6dCqx|caiW=z&R=%AyE{RzgSy9lB9-sb zKCx7%Yya!dRk7IjXXn5EaC&upb}?tA^X4zFF;l$dKNYHYR1$<7g}O8^kWI9H(B0R~pftEvAA;iW<=JS-OKIWK?26)Lu@x2?wii9W6${=ba> z+v&Y7*MHqR*niXVe~-~t;{V|D<5Z2fpuZcz_4X~W2e}H#(ElqQlcro@>38pnYGO?) z+-xiGkkx9ag0b9GLtmBM6ltuDZdL{b*W^b>p|Me(sb+Z0<^VQcu-OZ5-a1?2BtgjqfmUu=P z@LXcY^s%?{qa)u7;J1O$?5*ekvRQ@*9u5T=Vnw1#h-_}iw6AXnOY_al*9AUvBj?#S zbEs@)Kih9qe)Z-?5Cr$Q=^x@qjGt{Gxd%N1dfyNEr5*mSO#d6GfS1t!{r$Z%{eOM1 z)5d>1N_z;k?p#&wbHQAvWvr*MeR?fzQ_XBe|GEx!>rmoW*w{f0V@u2BZqKD1NIW2c z;sKe^PbFJby`EA~ZHBIq^$9y>bj!X|x5lSO2RhGotwL3zGBXx*& zdcCIF^UI5qN`>?NwdSp&eocyc$`la{$J;rjEl$>I>z8Qj!&XN>M@L@`nLoT{{;B!0 z$7(C{{}y~}iT~JX<3FCNRr-Hg5p$h<{|s4tZnA)yCdJ#)qlWrfm5;~lzE)eR4EBAHIu%)s*x1#eZzb=Rz{D4FC5I%KqO6`}?i`*Q2yW`0rFqUzqs+ z)F6LWtr`AXkK@3Uq%Zxss{Lngf2RKTn_ip$?{S)s|9z~&QLX^|AKq_@`o#lL#Rbgt zSV9(x{e$0l|Is*tJ`QjBVDOHPDQH%f>h3DFUbe)b@qgEwqwF^V>MiSOZn{ERVil`^wLWO?wa?Zkq|oa4gv|L^ zrahuxNb9VznzKghqp_+M0e1G@ocq#W596sZ2i2ajx5gqEwLTkdYuuXg|Bw(jfQ-2H z!#`KZ|F`#gzs>*kD9z{pLmZBP*jjhP0%JJY!ErLePC7W#^tY*C;2obPQbBRp80(NGb3m#Fyg#o09y$x4XB~`hPu2 zd%Cdh8qt1H8r~ML+#6Gr1s^iZYfhYY#XDyswV|@I^!~Xm6;`RtX9!90kG#X8xNeBc zUdQ)e3;vHO3l^k=Scduk7;B43kz64JkO?XMZsRNNo#&~X(y7+wvXyQNB9)+_B2jT6 z_Pw=c%OSKqpbW?KcOpvrvTL824krM+(uBGDfh_+$_YDsKInBsQjX{D8DWpIzWc?^D zdYme(C>z?^VTJVHW*ZY6(`aFz2i{LY$wx()-jbZVk1&;rkKK_@-wCW)oftS`&ovt zy&&55RBgTVe?rM!WBT8Fv-f(2{|JNh6r?dZ59GhkCU*3>sN~FD0bYx-o?i<^-la4xe(y?vZ zwr$(C-LciNU9oK&JKy&|dz`(`?YXF`HP=`-YgE;G=R46ki zZuezpyZ7hW78G0qihqzA*~eSK0!*Lu{bcspyVdlVM_7iw$A^j4;D~Y~^fc$kvi;E} zzvEUCIj7_1UHO;#7fjV|ea>e7-}M9Zx$Kb5E|Gs@v7d5zlwF{{M9B;$t|zPI|7fGa zRzrLOp4T^EU^S*u(yI5Yr1wpCcI44^JlV`2AB;%ClRd&s{B6e`>}B@|J2i8W0v>rz zCdvN8}2Zd5Rje7@ZuQ?$YJxmU&uv-1z>^W{B{`&LHo!FH|fC5j$6Gx#UM zoMbb@gNlpXN%k+U3#;%b;h>feCnBfZs&Y%T}gk2ZJn!rc_lyD-+r@IGL2g7 zrzJz^ySfq0-?{gHWMUF4OzI4lE0&bkCkZ651Z!6zMTz(0wn}v#e?ze)85dc#L zKC#VivrtfrKb%WKneJ+e3{M9K$h&p>swiiSktA$ zdgN1YpzdHu)3g)Ff1cc4^-53Q7mu3n+eJ-BUxe3}0Nt?X5uFsKBPSOSjbhraFe!0V zEDbZ(V96`Xd;I05F7eOLteSQ0xGOnG=;NtfH{KquKOLOSe%^i_dta1G)zFbQj2H26 z9)$uRSJgF6!>COzv)?AR{u3wPTUY(kA9i&y-#*Dti(h_M7xv3G^g)Md{gFGKvd@D4 zva;JbEop=I=I8m}Pk_Dyp3FxmZH(`~+cdA=myb`+Yi~dQ;G@Owc|ynEwtfQQV8v#h zrPF?L@ZV*&=R-doQU8e-zTX#VH{ba&-+tLG%Wr;&JI|eys}B~EK&r2?lT~1C?vPfM zP~kA>z*VV$CIXpcND_RhYRe&*FGnol=@tdux4?Bo%`@kobMhufp291bdJ z5qqZ|>up$-hZqEL>^X9n?O^S>#X&9Z*`4(JalA*WE}+3%L6ZpbX1i~Ki7$=X?$76Y z^augjoDv=smZWbKHMxR!;*%?X z_;!8FkgVYRV$eKZI`Kn!1gL-CJ_>+;Z=d-Ql(6o8qY~-d3;RnEAr#!2hg&UUgEhdT!6_AKP(@ z%jVx2t9$q2FYk-_zNt1UA9XDc%B?0Zd`jOc`+h&^n8F&@CExSn))WL5Z-m2fZR($6 zgWnu(ai&cg@ZVMxUyU{uUu75H-Cp(E%YHvnrf{F%Unk@FYecV14}wvjz*^*U|5~^n zdbvq%(*?EPC9l;hzp0M>wlBNCF3!JwDK5b~1|>;*gd<7s6XrI<85ZR%@D$jDp%LtE z<43QCVV#)^QN~ypqa*MVI7I)YKgSFQHSA)bkcI9Cp;U`*U8jrS(jzs7xXw)o#{++g zlb{}d`02XLfk%~vGhY`i$BZIR>pT|M1i4(D}RR)0@{ z-DYehZfPKdVTNX)?2DZw$_4}=#$QqB5Hgw-E61Iv~1%0cP ziT%2k>)baVa-$vo-pu&~l)S{{utU~-Jab$Q!I`z(`uR?C2qOLcx6E_OTyehz=^j}u zky~AP37)=9&zC!Kj;=_(?7?JwYr2I77eFGqCwxYH`9x^kO-6tc$(z+{;QP{=SZ2aT z7U)R+#(WE&{pG&O%Ak0XE@o`BKXXEF`z=%{YSD{(_gBa{EoHw~e*^v1OcI>Y#D)D1 zAFmMc`w=iE>*iLr4(myne~q04Gs37y8W_t;#KtC@Aq~!0Uoc;ypWpja0}L(YK_^hw zzRJBC9tLRV|LyT6DP)K#fzV@94^o9;ndA|UCPx*>+M8@-hI@VR?E-TE<(`o=y-bco4 z+5&qLN}9j)6VTckm;#p=sBiwkCj^rhl37GxmEC|67gZ?2E8W>n2RYaj*`RezaH_*FN7b6E17Aaf5SD5t; zd)M+prNv8J5v;rO>!E-dE`(Rnw!qbI75&m|eFI@+&XvvXIH&+DO1JW+{)MebQHzHq zX|{tAUx~caAQ8iC)q$G8Ehg-0QpX|H*Yq^gZQROt{k*$| zvD|XXCG=`q>wZ4vYPz;*IR4D#>VgipgWWDi1&WQiscAL`N9c&w+3ri;??$pT*9q!~4`y+!`-OC1AtT26ymuTYCVo zD&=^S_!kQ8`CaZ@m=3h7Ya*L<3+d?UhT=vEsrF((J0lA1smt!KQtkQYVdVpj#R&?! zbI)(>>zpLHjf%%DF0n#G`y%eLBQ%$*Y!juWZYRqbrTyt!3UlvcrwP;J7Y?s=B87(nq-4kD4V+d#IX~03YK9yh zd4V5%?Cu-UzBTVhD1+tLHTv&n8uTL%(P}9}*)yvmD=#oBB)eZRsGxD^ZHedB>(q5F z6A2KVv9hzK&(147gmF|f(!KO`)$r0&Ol#kG>#Abq8duMCbDuLiheNpd=6lDMI^0vi z(=PS`r0Uke|KaL%MICF{gVPhVJuvAqc-K-=S{d%)o!a~P)g85sFVW-co{QoRcg5{r zF`7k|6-r@UjgSfE$>-gxBPx=RYg~IstijqjxaOyaaZGOyhBw%8`VvL>Bclf&p*xiX zdRCQF#CN|f(Ef^g2j81_@4<1i_~blJ>ib;6SlyAW$#zbt-M3Yl=U}!6X3akBOa|Jj zk-aw!r6Y1;_DNH0=}d`Oog96Auqr)QOmqPRORA_!tK)jHy6wA7wUxGKoLSw8N{s+^ z{Euc7(q<|c|0&v+tzxCsW zv|D@G7PFwAWt1xoL=c0yd~)?VF%@Q#D=qpds>S2dv+3r$v5-msROM+&KtAYWQSf5J zy&6KaEwVOk5xW=hxtj$MO$JchVOq!T)NOD*LE!1koIFiF3d&)(aM<9mz<8()6YLIDxu6Cxj_2*^?XKZ`AU%nuItmj=^oPC{KJ!9x< zXK#mI$5y9ShhAAbUU2YpzJq(Xx%pNFgDa7d!_(isJrk7wB?#k~1A@^o7(PHkI9qlwso&<02Wb_)z&Bvn7W{=)C5j z0|d=g3P{7i0bf^l>LEi0W-X3W(nOLf+Y#%MBO8E;e{&mCwu;mqe*}@immyD)T$;=m z#{y?U1Ixw?Vkn~}s3r$QBVS(Ar{2Vst6_@T{5#~o>@0fGObt8@Q^tiJ=+#gmCGU2+ zf_kW8>1KRaI_dt{Gdg!6Zq2^V(8EP4MKFMXqG0ftASdE&BBMF9R3J5$vxF;g3i7DD zsiPk;ock+D{j~7&`PDN{(SIw~cq!mXvkZ(aqKj&te7C{>Ieb#%?%X0H4Eit!!|7#7 z4oco+@*M%8#Qp_)Go&CKvwc$HKjSgE?>u>6ozO)SSab@92Oo6s`H^)nsa$gIJY_bI zlI#)j@oGo^jf=I{`}LTHApIhByu@eSyIN_Z1}2pyVtsjy#^5#r?u+laIuz?99IBVZ zfzH939kV${tA%5v;0`ADz!$3RUXl_Bmw~@*jOZB6)EL|5pDF&+3=WK;4L#myXA$j- zutlRE&Z%3A`rD1A)`6v$?^HWVoJ}Y-fpT+!Z%hx0l0i*ya3}2-Daz5c$!7a60GqPY z@j+kBh8V@x0_ljkSKlR%65bA0iJWJCmd!$|(r)j}W+t&waMUUwe+mN4lg!3c9bIAK ze82>Z?tLB75?z7WZuA=uj)rQ(J9JM#J>rdhkJ|^i+~|fWE^|ZiDlzgCy4ITL*h6Ji z{l0Qo&Hh$|!F$(g*?Yupz&k6>{ok?Ot%cVP`j2+UZ zsP6+dcVC$7!7MG!1^8%T+Z)_+wy5g#`~Rb**d&6oMTBWNpTEVySQ5eAI08%~W< zsT^;UJqv^}F)70tt82_+-w4*jS#DOB5K{jY+b|j~t7-t_H70O2{jhZUD1*Uf*Jn#~ zVW5g&4No}^(N}Cvp>)GIDfl0Rk^ij$8j;0;P{|~nmxR^#j*cr7<)U29nqO&A#0(C9 zpD`ltFBu|&CAsyAM!0h@x9ipI;po1L|o-6}>W-nA9R8Hb^mA}jS%#MTNIE`Mz zn+do2L%XG{-Z6Sdzrd4{a`gwBvY|t2FYa%yT3=jwi2kHQu1OUo1L7NJ0s6{OcYLcz zSP%GPxqD>>P&V_^GfU~c5T#lkC8JA)zbXnO02r)Gh9(5Y@p=y`d}>?gT}YS8fY+P5 zv$To#9h=IR^fGB3OlsZj8!e`PJ(J*oxj+ddlY}|(f=*=MPheLIJtQ{#guvWXw^P(c z>T2`wefLOxOOz>4GlY5GW5#}K+g>=sk?fEPq~MT+wJe@mtP7|vlg;55Qv5O_rF}fX zrXT@0uDY}W++y8BT7E&{p3*yyGm>NxAIezX2j2WnWOy-iX@(@q2UPqZCH3d) z1sVI_bfVn}5tM_|7{1~7p0S>#kue2?P%!0$dQ@2lV3dp9ux=0{k^>OX*a`xa_s7*e zF_((|lo~K zs}{b2j(HgQ0)~aTD<=XiL=F&tC`;qR)A{uDefWAn9|$D6W9*mCL)k|FUfcp!>-{hG zEI@?DwXpXzIE7;xCIpLhD_m4Ukk>s`LYhx2k%FpxWsdhRz;G9;u|W42TJF)??+vwD zJf0FhrVy*s?z`-_6pcTMgwa(3vFt|Xr_C6Z(#t+^q0YQW4xdLH*U@Ff&Kr8DZ@S8m zGID^?;;on4T!k-Wgg4LtT(orfY^VLsx?mvO-*A4!X~@+jAdq@ctXFZ?lmkJ(GD(99 zK^|&qQGt0i^{sK6@rMF<7W#{0zE!pcw|o<-$wHv@B6Q>_KdooY-IU<4uq zB@NrmFy@JyjV7FxE4hx~OQxyXcBt?`bJ-cYTHlT? z4(?uyggTKPKC(MxHj8lg*o<2Qrze%2o+RP+f0+Rl#OJ$qMpN}v7l+9*zI_7#Nh8&E zMq_R)U23C+)awFZDZ@3#v2nX$IQb$gAK#HC6T{|h7@`msHC5&EKx52qw+(8pug8mn zhmWI+^TvfLu6*IC=@yH82^|ZXESmWb;dto7is&*`2ZAYqRHjsawBS{iBtDw3X0;K| zIt0DQOXrRWizgq1JwRZb8do%1e^!!rmF#dS%QYpE*2E%~SKy)LD2Kv==?@R%TYw%8 z&t&-MkFdRez|AxjiM4Dc!Xbd*8o|&(u4E+7{)4e+stEn#`n(%EyebH5ur*}Dc` zu$rZlg;iz~Vzcj6M466Kl3zWyFOi{B%1zCx&}{OxG(2)~vm79`x}0GqV_Q{`(x--w zc1mNepB{xzukRc+A}03fId_w?+_tQ320NAdC0^RKw4hkzwFZ7Kx>8I4sX^7C)r%e@ z2Q8;~16}?r!x`UnT)KD+-8z&RUoFbzgfbS{1VYXL;PM>s;Jhd%8^l>NbFuJ~c56jXNd((KmklH?C^Y&F^p< z;)o{axn@p-#_p#w&yX@}!=pY*$(Yzt`KmL{+^S(ALLwTO1d@zIj4S#t`sd4JnG0MG>)j8ZRH$t%9+C6No3){b)ymc=eIq+E+Ykv~Mw6N;$Ooj3`f;stxRbDC% z1rt;+U!`1oV5XqP6I5@ES(Jo8$Sd?`Ha91-Mhm|hRR4v|} zLyyua$mqFH4RS&!lg`sHw!I80C9daH{A&AU;ZN(B)&t)#DNEe}DdEfkA%=eM2w-p1 ziVBe2N@Z9R0a+a*a)rjC-VY6=Ov=Q-0MjJRS@XgaQRbgo*{GPCDmli;rg?C5^15G& z7Vohr42}6$oG|mxTOlzv$sOi=CAtMkW%`L!@krIg$EYR#KpgsFqtT{-eY_aO!dy^C z&(?QsLr^%RZWdqo?)=bg4n7R&$hwe9t`W=cP9bVkc}NLukArRQYlGuOBQJX)PIJivSs~Y7T9hWS{mW2MS?}Ym&F3?$(M#r&CpHoUW&sjoC;lXe$~l zfs_Ei6B|UN|2)RFRVjUP!R- zbgZ}esbe*Z$!Jd&)mrz;|2%-)ZD@17hEXu-!Y*7B*mHYpL)%wKIl}bxHJgxSR8sha z{15IP>t4f=>D**!yE4VFf`boQdTIjNwxe|R15e`IstINT{KSl`2 z91!=}Ek`y$`M_=y5#WHNZ(0?q+{D8? zTbPeZ_ge-mjia&DjEJsK%%Bn_zFQ6QtMvonHh=`KyLhtyJ7q-nF#FVLmo(rx#c}hZ zEytCU&z2iuzHKxKm$y57io4y>7xHK-wmLOshofxF$#hL6UHksVmAu90{^(^M?uo-~ zGP@z50Xh!Y5o;4quP_*PDa0>^qn9=DMmdgkXiCDkc|+5ZO;aWste-I@GL(T%NG-hp zI+9mSK>vQAVitD-?6LV>&MShFi-Jc5(cTY>-5fFLG+kUgL4HtyyBY<)_eH9hK#qsq zo2WOB8N7&U&)d=W^SraDH?QZsPzf(~yrA|iJ`mdMKZ9k-Om8!b>Qb{4))!S??&gbJ zGx4Y1B69dxR?X(xPVO2fzE=rOm4w(RkQM-9Gf0&SR*| z5GanD9z-(a30mcOfe?(y&e7m8W##frn}b^!bu7Q>PY?DUaB}oE__e{XqD9p+j_Yf9 z=SU|-i|DuvmF{Qru~Nj93l8*uYg<~h-R#xAbK9*e?9)cIIgG9_oRv6Q^tX-&u=eB4QR>EPTs2?^)kd_vWSl;mT(%R zVXEnpNw50RNjs_1Rto+{XcVKoyD(DB@%a13W9kC-!i0l6mjfV;?8;g_#O&ei2Y38} zNw+dBM>orOx~rN_?p6qTTmSvAo7%16>|zb0U(vKe_}@Y6(GC4@V!;1(LF^ zps z2-wv*;=IneF5EUVEw_w?JhZ}?f=JcMp7>TU8WAvV;qT`|`tMsR_s7;WdcP}hz0Z9< z-LLr&zmM0YZCxKnzmJhBHF~|TkIi>GTRORK0X?6$jFNq=d%#boo3!A!n0>HR)%#g- z1j3l5%QAY4R&8uMHNu)`1p}7Ngl>W*X^NWmxNeO|R9Y|l6iWyWbaKQ(n_ zkG6qU;Wy560$p)kdG)d8W@3L5LuqUV-|L8EcX2u^4Y8w&kUsvvl(Gx|hRaB=UbHhG zcUXR-#=uFLb6Il=92kSuHv=3VZ&wt;tgTLoyZ$$B{x6Rro=aFsh|+j{)q2&^-BAjS zK}E~AnGB~0`}4Cx!pnhVagFfqiHO_q6Hp#7H8je(!CBwyD$vC|O9)^Fafgt7>m)`4 zA^0kJduYK%y|;0JzU42F?%6Aw-f)F=Fwu`` zWrivaNY12VMF&xxVu_{zIcg_%s+-s4;PN{j%m$BCEQx)o1KqLT=zld`@(G@>oaX=> zvF{vR-MiN>^1Ag(#BG$d;Pa-TMai3~cQ-f0dliz3hh4B$Y;bLbCVdWtr5fF>-WYcY zrV?C?Lc+b<*}wgKPYJU&x4yKTppY?7Y!E-Difa^rN`T9S9i#Wt!}o6I{e4ef;-KRe z7(MC|IxB{+6UAIPs+XZo(GLp5@pDa({vmRr!AxV;{|Z0FBC_^6 zLR3y5*BZ9mI?hyd|9a7#LjD$H4x1*Gt!*ipYKJF>o|13!XnWO{J*5$&KDfm;s=g@I zmd@ZdMQpJgv8ijidrpNN&9IP>7Ljb3lzW^0m0Np3ezTByMUr9F=UA7Rs$BZn zj4$qW*JsronUe@RZTdG5*3-h%7RPV5-Nd%)S?}CQ%kB_WQ)s6g;dCvzk!~jc&_EmA z$cDNJG>b`z&e+7e_{s*hUQj~KNP>Ml)4XL735pWY3%oWU;TPPqk>SKsPtiq-@7&VV zLdIY8W?wTS5*@Szw^?Zyj*)_2Jk;p-6R2f&*bV#R#2F~!nNKTSIe&FUF%OwU1T4rD z8{!LU!U{A3rIMzafCr}~Nm<{6yFdE>#>hU7GX#{CUs}heFD|mtgzvr^lUv{gA%aZ6 z@T@H6@3@>wXK3cjh_B>CaFPDlCpaDR&Y{3F1ih`xnkVmJ>4J%Ew2~T6Qy6uY(!FI` zwVi;mZA8G;PR7leaJckgAHP@O@j%i` zBV6f6<&kcc;G{vB?b`#UX(A==Q4Nb~NB|bqjkh|Q?5LcHH1D!PeYbtt0-|;NBezzF zk$vX1g4Vt~zyL{b9FL@NPCmW~5hJqXG%XfbMkG7reijIP&7iU@e(otkR*FiZt-)7! z#U|#%R1625IEXaxt%!nQ5^yBB)9)Wz=TGegcZ@OMG4(_umAEvm1GDIoV%kdL^jUN| z|J%5s1ylQ?$?@~_uHzCuL6@5DCf<4-z{@Mry64JR0yJo%MZq042@xKB%QBO{GhQGa zWx6NUtZex zM~<8K2wA|Vl9t^}C>(`kSXpwXmqVxk-VCfcg;(t9Q8x!V)V#P0__0Os-4;@G@We!=Qf z3C{o#@L-5c|_%D&)W^cEc`|5;RRXoHcHWUONZBUQnGk5BDE>QoaW^N*c*1kE3yrNDx=C^ZA3nOdXq4YQ>h*h9S*7)gOb zMOYm9>2o)sY5bL4tSGIi)n9a^vn9I5sT9KTSV7mlx=lTD-ZF*0W2UX07D%D6`!#m5 zy-GnZ`t)K`Czk7`pH<^;H(PR)=#BM;wZh`i@-HhtJL(t{&4Y_I&S) zH{><{7{ClJuL<~+d(Z9#zRej_K>(Oh-RT-r(9r_h<0FlxL%+;sNFy$f9t_Vr{P+~H zry<^Yy3ltNa}?OsJ_4@o=n7d(y>ZMEHCT0|i~t^s)CQX5lLIZ1U||+C_`_jpa|bpe z2P`(t#&V^sN;@z6IOUFaE!3=xH3go(?5va@4r~s!~2@t1PLn8zNv?m=g91ZI??Ur&M5( zP3Khu&FKVINWT2+Z~OTRQt;23RbAB?YE$qvSAU|Pw-wD*gVN@Pf1bOq`VB!Q$WHyc z5eE=_2fLx$C@rqUhDY#m^a|CPn?1zqf2sckEQDM3@9KtKjLPmE1k=)lWo;5S&u`~P z#l{m6%TO{>nbyBV=SP6C{?&x<0L$9;>miqWRnaP_85gHOvmwyud&%7 zMIX>8Pkb$Af}|RdAmKm|6ZW)XuZ}L=U{uJMW0ws}#pNEFfyMhDvgZH{22M$GtXL*&FAh$7~@WD+?sx_ z_H8;SGU7{(hDwXRc3Qw_Qcuj1I&l=(^l2&K4bjfpgkl;flGh2vuI0*3FDMZ7o05g?|HkBEZr(Dg3v+> z)8gr;P1sO*Vk6QeURwN_)tyfTO<9t-D$mf+AN@S^#4}Tty!l<-*g$)$+>WSU`!+*< zfl1W9?(Q+@$6t%%oqvaB%Z#GMYzo{v{yv3Pk_hgG$d`5H!W&WwwxfEuNgKf?yKeKL zX$;T({g5RpDRlNoT*8R_6q9)bg_G)3a;v;)fUI(6muheL2x~~ob4F}tntP~s%yDih z4DK_CHh?N^v=O%{;dFz|--8F5Armp63?-Aji#EM|#Z&769H&ipXN;MV63Gy;M73By z;cA8Y<~=f5a)7ZW0th}BG!tKs#3t|C0^I zyKBuG_=|89Mg~)(8{__B@xSi_65n)q5R^g1+2de1Avj1^mKjcMIG#wq?L$dzk2|I~ z(wo*8QLn@e$N)pyo)vi(Wn^8O z83(vRzxRblxn+VoNSgg~QqV9S?l_Uwz+Q~x$KftBmt0K!^R5mo!wlOtFZT(U>D9&z z)Hlt|1WLya6Xl6DWk%I>?SEYS<&YgO-pGH?Z_vUufD&U5RwxI#wR}q#$P3Ln1DG@W zyWoBv%lQ?`V7S%p48UX-+IZfY^jo7nG@9(?#e>oMELLwHt>3(FWzbus*F0bgBwBF~ zi1ql{TSmKjb^amBk6q`KTndM6zct(k_Y@Nvc#u@Y(6G3t?B5M<`=vGdR-6BS;|u;D z#j**OmU!wh2|dyhh0z2i*@I|}@dt@*ImMl~AfLu%J3jFzj4&RF*pW7T!RWN=>?3(U z&Z{nr)h+)S$Y=ZMjdwQgFWjFm=(ny1F>d36|JA!f{UsqS)b?QL4S7~sKtu;gmkd#0 z-4;SdXpWI%-Nlcb68evZf8uxCxFBRa;{Q)n0YpfE*YYoNC9^!d7>Y%{4yvNMe<$YU zBXS{Dqd}$JJ#iiqa7c^yA%W@KFsu^fz}*FN)|svKL61}z)URZ3<>3C8t4l4Uv0vP{ zt;r%`CmcVFeU7+mVY?mw9K2eOSP{mHYXO5S>kQs4V<~MkBmP9KOoGH}eU)5?KF8Ho zCg^(1sIkyO1#iUVW=K-8mNI;L#wAoz;v&h1^$*{mU{=-%*u3Ot=N|MsZ6RXpPsA&n z9y~vNh7v)OpV}X~{gKh3>S-+K_18U;zhU7No^Ue-7(HXCQ_8s7XGh<}4!H}t!eoL} z0a1OWKG9Ggta%ZBo^RJ`agZ2gyX`<5h^3kFUFf6{Or~(^8cV~5l3hT-<~Be{#9l!~ za;z(dYeeG=R^Sm&@MHXkbNB}v$^;7o=Alt>n|A|=28kNu#*{phM4E zV}dILiz)=m(_~hVHwfgbI-#+9`d~$$!yzZTSWJV#4~?({$`!1hK#XO-83xr*bU7{m zM8v0OdWVde-*i75s?b)@%L&k%r|amZT#MRk*F%G#ALfu~65p&Ln#;TGmhaB;a1+QY z*Hi;Wqp@(se5n-9ryJps9qAFB{k{KQ<;INp56i`ZWGr!hDg&qBNQn_!8J)?Tx zbV4PS@B8x5&+W0V_sa$KXx;k}alK0EQE+TksB4arVgr}^Nb>w(_B@#m5bM{85e(~; z(8Yedsa^AQgNqGagcJ`M)22+Mlc6~yrcjKmr&Muum*tg9F(b4qVj3pXjV^We>Dl#k zkT|MyCVQH|*=RDIpT4T%A|OaYQiTd~rcl5i#B2QUY~3=Mv<#DYg~NieQ!|dq;JKqz-FH!&U}w(kl>IDR=@)Bqk8gG0MuTUhk&uR8pwVUU0}pRam$!% zG_LiloET9tzh8}Tg4gG&M7B;HsbrIJTnKj^TCFl=^&B6c*qo}dd1vEX4K88PEO~`>ER2VrcjLqR^&{x~RML9jht5kLJ zI@}J36eG9c@b8&rG6SOYx3oAZ7fSr(~&{O8ZVNh_1qg$;)G6%cfwsjPc*S@b}Y)UwxS)k8+^4xWj@NyqpV zlA#BZ&1Qqsvo0UhuE33`IJ%jZ9a^q^Necspx@K{$5n}u01{ZUqHc%hLmk--%yf~~4 z*jr&KQq4QCMh_n1?ezAUc9NF8yimB5lLtR~xw`4CyxeWPjEkIQa!DlbD26OS3m3|F zFjr?QV$Gk8Qbc=IHquwe^OJsV(XgVv+Ggfbedv0lEYS|>rc85d8zsb@gc1IAGikoV zV{1ynVAxicZ`{W82XBLDHYl71IioFGdQSZuGm8rMm zO69O#(rXG&hlY4D{RLn@x7Ng_JVN=R%b*7p*Eah)VXr-b-z&{G<9y;J!6-bgQ|TF2H@&X(L4t`{&}exmHhYAGm)&l zULmgX>nYxHO?}1BEOon%aijpX6x`cJibtQ1EgfD>LIo?+Z+{mnW6K!n{|3#XrOTs> zI2qDb|L2JZJomxn(SxZCoD5A;rT@>>O#^2?e$~fz#+IP1%b0DfsH<8pcsHG}XTOKZ z28wucTW^qZRYLCeIO4XN$Ez;v_yqq_C$r-mCv;_ekyr+Ktm|(b6HH32%G-rEwG*sq zBhK&vKrNknzZmI;n1lL5&Kdrl&C7^)_nga`Ih@N~`IdYAzVcqujk;`Zn{R$0X*5C+ zn?#{yngO=JXSJ_%XJ7$|1ipa^Yh53XAg|9A)#3Ckk8+hx&M&w)a~VY%(cAf>Wn{&? zc>c$~gujcnShCnE+s#_Iy-P#|rRZ1t$M=pKR!3M-F(<>2rt|=Fa4?%j0r8)s#r*gY zM&)hby)7=ume|CaqJw=7$-q2g+l?CMlqSkc@-E1FHVN0>Q60wq=ukdIjN8u0vL7iI zVs?F@TF+`0NL5bH1d&m%W5vyVlP$n0(XBn@=~p`;!}EJCKrqM6 z#}WC2bz7BxTPUAIqasQp<g`^N0N-Sms(dcWp2lJU7V)}DInM}D+WyJz<=Cvui;r=<(h9y9 zJLQ&ks&+P9YzwZj@~KF^grjHVfg>+pF=1O10fxjFSS@;ZWizXdp16&T#$H%G95rJ& zBNse&oF5kRv*Hk9Q{M;N5uydkvKRzr4LZ(}xX3GcPjxC9QX(hd6u^juNa})XtC~;okG)LjKCf%*Uk7g*AG4K z4&xMJ-}g$M4sZJpJ5_{Vv50TmUo(g!-#kgZ*BjYlW!nxOywFJ#c`XvcuqnD)`;u1L z7BMune_|X;#2*MIhyT-2iLZ$m3)#Pu4Mv z=9_omV(V`r6HEpV!V<3hACkz7juA$Wxdya`CJP|);~D>5@Z7(JXcQRm2qBscWaBWQ z(Hk=S4KlGGE;bk;@fJojtVGg4)p7DibvIo6VRt_3F-SloAx(nJgIolDYgiRmz@DQ4 zurSZ6=aJK0cPiQ71Z-HTyBKyp;PAe4_p9$*JXlw8J_IHd3p$tjuJQr+lU?I-By1R> zVgSW5ee&Zf#L5P@6oxy$e9`iWDU)QALjVN34iQ~eFX`GN6kb0(dft~10bU92M6{iT>b_Le!s&=(3)PYHV z^`DkzmLyXCeY?Zb+=bVcfLCXYL>nt~E5+_I*+yotR+7CHiml8*jOsHOg@GP!?*qg` z$~S@6;T2n%l?Mv1RVuJfN6s^|koSzV*#uieNdF(DA1En&lH41!&+sC|6)43#8k^wg z>1u+sOw)#%$u9!q{Z46hCu!+R6$n&=!%0gN*x*^1yn`q6)!u$R0g46i5qk*4pt+VV z?xvkh4LCO`)qaXt7w=s**hM_9-?6`mQ^4^WChfNv+WmDL9p67l%Xlw@d5&`P}ULI^=DNi*H6Z>^F&X`-xln z%2my|-Faxb9j`a(bR*Xhl za5m-N?l5Vx#jepB7HTu$7_8gRO_(bTyPF&xRn&m*nuSZD<~^cPN=4^@5&8tc_mWS9 z+!cWb<+RK(Z|qA`43&~9&Mp}GZgb4X{4FGo-KPqyz#M9O;*5hfRXK{A=}$8*V2(Hz z+=I$H9@%Y*T;3(C0u4A&re+dFh88F*x~pFO3YN8;z{dpC0gc7&E6(;7&2J6bLj4eN zjRjJ!d?b{+3hdva@>D{geIS1z^d#{_G@&rW;~DeJGo3+i7c_jZLYkb5`Ik;N_cUL6 zgI~?c*Me4?V)@x3qx4wyP|Lkac|?A2IItfa4g(aUD&TJ>xkY<7WR!u9%H2@{R;iJF zShHRP19>S$J#O%Gcvx$!+}cL+$;)R1Z%2Gl9s&%EV^vsm#|b2Dxl7Rogb;PIuzDk6;RyKVAqpx>zJC?Vn|K-mswg6hb&|KCDx=}>T{c)>k}0-N zqH?3zOKcwt0RmPm9sZF^&b{*ZeIZX@Bv9DGT$yvlXPwVRBfF&pkLWoQ&S7u)!cIyy zV}KA5`7)92>|@Mpk zlSZpvcrxR7DDbqW0>%!1tT^6`laxkiUFq*WO~1qtSA@>ejy9*vf=CTq64_i{2NHghf6KP%U<%#BhGaDOPI*|VN;TpL@92&S;)<}*fK&!DO9!A_|@ufw08hfnW8b$tDGocc@8#STSmGK za(Rg%Y4Ol%GTO_up`A03qVER3R%H>8X)+2F>O;Q!&J7;X?TTY#nu}7qA??xgXwdxo z+3dPJSS*W)o`03ZleLf=5(cyr?y?_fR)m0twV(0FkX)fI)?gFpZjp z4qDzeSO&vMGKHkDdH(c1?*>fp+sbiGCrskUVcbb1X18y6X%C7k(nvU?pC-M}VLp&d zyZlE@bFq0*uXOT2DWZ5lPyk%vhMsM4wxJ~X5F6|QqLuc$QiGe89FfYkvSb5so9=%A zHe%ukmevgsKL1^obt}J0HTQ9f+7{1b9G##7x+N!`=HME{@Wa?Y0=T33uS>eW>{%Ml z9dv2IEB#y+$*-^{wDwK23(j7Bbc>JV{&fRNj`S$W?SzN22cpTh>YydVf5 z4*MpR0GZBv8KFBoEMJN3w?01v8-*bTuUvs)&z@*Zn5c6(F!GP<-6grHk+6T1;zkIk zMX4eongFTdQ!ePR2w`se{%F)_{D0uJoOrUMg}+NNViZqq@xuV&F>vZu95IkB-;Ckg zA5Dp7KXLT@8K40PoDs@^03Bxokh0i4Zk`malWghm6+yEgr&>DrP6cI*%-C>**@8zC zC3mO`9Rku}5d)AQCO2i(JEiBZMS6XTn4Y6+FJQJ()PeBiw7_Spylp8G$~g1#Q{6nY zY=H*oKi`OP9uT=J8b4lYe0?mb=Rhgk8IIh$N8f?z2;v;@Mt3AyhCp^YFfHW4y#!;w z2+eZlG5A#pWy9YMZWlvdEI8oXh7HC;bKg~5zdBAHNTH>+D38mPFUpedP>2K8^mQvRs>iUdrE%RT7|A*0KynVyAIX0}T!0@uz?OkGZ? zF_Y|U^nAq;e?LvY>aPh_ahGB~K&oWGkVG02BwOjTDOot)t@{`w4TQEL zgl+(_nPMIV7qLfpJvVJAEmiHDv|BN9z=LG^FitqA2pG;T^o|iuXla|+?()jHsoi)q zE4NF%eGh0}>t~2UxyJ(8eb(6kkyHNt<4CnCg?mrtj62DR+s4{xae{->zQ{YRXhsac>umC2J}BXb#}j-@+< zwf1vs8SHBa}|*@BkvL; zM?CZWw(!Ab5b&pTJz7weUI{IoUIp*BfT`oz@JHscY>VhE z-1zH2xWEzPd@EP5T6gX^2EoGV9^x6mc2scQV;$6ErceQANDkXqML4$Xzvi5=3hm-T zm^_W(H=ON_&R`}pu-T^?2J9q%ES6z8UE9%~6(Nhme{}7RO=>c8R(vgR1OPqKI+|9l zKj^H#M>ul_Bg~?Fq&SRu7~QHUc{-8>5+Qm>kpiQ?6)HkzR_0 z9&U;#dgq!4Z9C|Q^sB*A7FqLe>|Do}`e@9wbWaQ{xNK;$QdnU$&Y{dRS7 zU2@%if)r9F{6#2#2WM-pnY@k!6E2iy=!<@eoO}z`KHNE- z*}n4?53t9JZl@DnFK5G`+@J6yJ2)F-s%lI z`&-TbR=}#5->Xcrs@7`$ze|p0R{y)s;>qI=fmYnUC%t0KE1Q^-c3qX~1;FAqBqMbd zTuZEp>^4gt319PBFQkPlQW6%?j-?~iP9L}o8o42IkY|aofcb8^)szvI7eeS#FowBe z?{ol*ayYni=-2gx&evasn=_jqkG2Wf{Wjv$`B4P<{c`_3vfbg*Vr3Aqe{AFRTeHn& z?MgKnUlZA!l$>Z9)<$e0|wq$E7D@(`6{r2zU(5a2*^Hz--eOq78_T|U8w2#Hw*wvMb zPGu_ElrgQwLHS9Qku$|c%l-sqV1h|IsUa+nrWlPD&bkxb!~9`&)m|yF$As--me(lb z;rm{AD8$N<_0XB8Uw)G^_(V3$?1{o`D5&^29n1I-zn)a&|kL+@)W} zPn$@LCyrnQ3X|p4DAuig{3S@6nnggcXdtdItr`Vspesqp*mVrHdW}UwLxH!o5p>yB zFUR-pX;sQZxqUk}B1OgITWe!Ms7NY<wth5vk#guDJ>+_6Eo?$ddkTj8n!z;UUMWT= zk77EIvjOm`IzC_zIh?9irze-Ov=qqLs!^3mj$guf>Stc%h{HpYvDko%-k+@T!m}I; z_W{LJ;N!iZ*5JVRt2S033ldUJV9*ngl4>jr zwc$mwco#uMa9F=AtH5SOINQ(_WyE>(7Q6v^v?+w82%ftL-Z9|}vNj=1nhC(sBQz={ z=W2I|6%OPbh~eppkoJ6=aO@`fP#56hg*~ebpUdgBPZoBAk&=I_R#9YncWlAG`W2u0 z4zsT8xBWCH&=t?Cra|UShyD_DlpRvT5fc2)LS1(wXQoD*4vcdmY0G~7gJVQ{0sSo2 zVJeKK2nmYy`&|X!opa6SiJAZtKHjqf)|+2_R@q4*^FL~ zb~4YZLaiMx>=Vj3h~H$ut|t2_=8WpYp=~_84*dv*dtQLws)E5}bHo-k7(ETKK7R|? z=;LXi>KNHv+IANf^PnAu7D+JP*R(aAk0pgTF|}l^QfIXu65?=F-U8b}-!KDrn zh8oAxIr?4GBAE7~N}VAk*p!dn*45}r7Ue|S*|&%37s+m~bHza+2xPnT8@&?LRg@@- zL2pK57_^*(ZF%}_#)a;L)dO%Q<=>^w>7osjE*O~?1mO;LK|PJB4k~|^JY|n=Iq@xJ z?a{~6tt2xmNO`_6%0}LNdAu|kJ{t*q?t>*eSm9(N$5;l9m2%SMfAmN7ykxiGY~0YiOz3*G_rHsL(`CCn0ux$mP*lY92Z6 zTV!Ke3&6C7b=2m};u-Md^^;P(DQ?%uwc${TaaoR>T=oa_u?Qv*OsgYAq>V-0px+g- z5eF0|c1);ReMt8K>>pF)NbVu+>kv72g}LNVgN9N%7g3jp93`P2cu*TcQVm=&r;31e z!x)?%C#q2$h7qqArSERCW~-Z$qhMk)O2W2!{xl769P%=TT-mf5-b~{R^QcQi=$iKUzkj2bGGUHft(YZ%v1$mP0K+Htz{(h-=E_ zYi~UP70=SI-dLx*xFPYBtPZ2wRDkS)@}yw%B4~Ct4j(MF#)OL=QNoOIC*bU7lA6w_}nfjk^a%nKP?~j(@r-GiV7w26Cx$>)$n=K=SeIbW{R0d;psHaB0E*QD2LRE!CB` z%rOWRRY6U|?qIf3*2(S-y#UWqboe^w!f3EpIm^JG1X|lNkbgeIZ1c zpww|)6rhG0YSrH_KE~Rf~^G<=ImQPjqz` zvY%u^aVbd-#0tR}>gEAiNghS1+Iuk1H!yM37sijJe}5Obs5N=C-m@QO>u1VJRSkF~ z4bX3@xxoZf;3t{_v144w0c>p4$tEM$KJP(iw6(usn6H%0`_A_c8F2fl+XV*4Ni0P4 zVK$i%mL7LE+nZj=-|#;&iZb9Bu2VOl>$XYi7}dlFd)DMz>bKYC0vc7KW7=c&{w7u2 zMuTB>K}VyRB=UM`F(glXd_FuAfKEa;SyLSB zR^`EGHVLg=*7I_@BRcg)=TRMy(UlMSzDS!5C$#=Yu`1!yzY#{qyw^$QI<^p+(s&o* z#_@_b_ixB3?vg2YLpnu=F$Y_}TkpMXDc6=kO2Q%PXfP3XI@Me?e^ z4430nn`P=*>J{7knCJa})bWw_nyu>EYPrK^6q~4uCJHVeyP)2)C(JFzSgC%MQ{W*3 z8m5wQ`BjF`@T%mU|8^Ll?)Ig$BDD?+Sf6rgrJl*?-75%q>BjirIC6?quC};oGiylhKJi? z@onfB5DEIQ!5Id|bDaVgWzxMM_+@el&gqwVO)Oc?qaxzrg0h$#w-1t&(5vN{jZgJs z%XQ6JX^nB$_y_Eu;zs-}X0&^BLGuv*_tctMV1ICmw!bZ=w)nSvC z*Iv;#w42$4c~ay9*nWY)%CUvrKs}g2`LVmVCyd9IWfOJHtrM-SI?*QGtP6iM;d|ZR z1h0pd^Cj#*R=OB*gam4n4%2i(fJ4urT%3AoEUCjy`lquZKP9cs>~etkV^-*ZXF+r^ z6E1b)_mB?V3(M*OoHO<}e?6;XreiC_f&GRjJ|i3Z=z9-G#pTVuTVhiEDAmm(`*U8zw`=ynQ_c?NK8iSn1}QFgNz3-yO<6}e8$k1 zKq@FuuGo&CIe)tf4kz0Sz_fNNU+6vr;NwVWczRpjgRvv1x6#Xs*pJL4r;yFb*7jp^ zI0+5pM3I#oP|{tjJRM5wc5jP)I!cvW9}MNe`Wfa za9^19!QF{p!H>PBeZPAF<2Ku7!p6^={T1oC zEzt2d@cG5_7S(^vsPJONd7{#^?mA1Gxgxyvlvc69g7bje7x3lxF?fu`4SP)_%}Lrr zrs>`1Njc6nF_uEJH=V#a8Gd`>$?3NEKB=P=k;TMwv3Rgy%=n6VMf zH5@P!#E7~vr0qTYLUEi~BCc3+y695PzK5n`-Lw)iUAvz1kX{S>%v;gSx^*~lXkA(J zL9Cg$U~E!1>@LlGZ#~vo=oxCs22Ufl8|*&6Qd?jRg`qzYx$5$3)p4*oHH;Dw0F@w% zAwN*hyCMgW)pKHg@q-m*EpcjeFe@0ZFZ8rlR&u=qB%B_l!0r#>L$E-Etvf-$=xc^e z60E{1;Wr%;&^4?>yz6)&_8frvU2FD@2+~{fc%htGy+5@@&Y{O?Tcl9%XXSR5!4A?P zkb@{wp2E1oAJHu}yBl==d5FNtW&%6>qBi(lENbm5uX}vUcd@t5wZ=+Njp}9Np%?Oj zj9Dor0+q-lB>Ta~Ry4u7)L(=3HerF;k6>kJ52T7_li2yhxJc@vOERm8MP5T9Toixl zSE!bQ4879tadrhjdBaJ@lCuvvi_Kuolxm2;ry8FC?`U^LA$_z{KV6wIv*n9wh^LTz zU(#Em{oJ{q^Ag1I5lJX$;zrjm7rL7$4=5Rq=56^Ae00|d?jW(u?;7YhWyWi-BM-=h zu-^jB{&0m>S6L@^g)I=&{h>QSMdFri`N{#2YReW+)qRLCyx zbyn>E(vFCaq^KLrUg~X0hxM;-LqTs&5=sb3OVL*#X|v70TxQKvG?9rrP-( z2|Tj7&r(7u%}vk~nU=Iw*-i)-Wd2Bnr*!d&vNDQ5t)5=9sNwgVP5JE!-G=3pTc+=E zfNXE@oQ}<876#|w+qu!p{RmCdEG3=y_l>l-0xrp(h@53fGq))mZz}WqYK7J(0uMOb zh@+JWRd%{pUJ!xX{|~7$${~a3OaOfT5#5V2f=!KMxG+u13+x!mdIweq29m(D0&WCT zSxOv$75-vUuvmNEWZyvJu%tc&6V=?sH;e_2D9fP7L+uW(Ep`#3B-ctq7ninp;W|bD zvNBuEUO5OY`Q|Ht+h5&6L^Mv zM=a|WQGvAwwTT7IS7(QOR?;^_wz)F2uK1|*8uhoSxr&M7Ch;@EWO|6=DaA;b{ zxFq79%=bYtw2i}xOZ9QFMa&)f37vI+f~9@V*5r2+wu=Y%u4xo@lvhcA<@d3#z8pUq zHuT5RSp$3}lZpnR?E6$BV-lfc)u2N;>A&<2Js0rj)*{)0?}j5xC+j)w9p7tf{)*+( z%Rxq9mAAd2yi_Zt@;L|OC2Eu6MOBwXXO?_i?h8R^zIQ3{st4O8!_9<>1A$@GI5vf6 z8yg#;{g#CIBA-Ya*v+An()gCb}%0A0}Jr;kF~g~TSpsG65iPu-W6R}aHnpmJ>t z_%|!C-d^!NFuBhM8AAs=5lf&eUBo(;@J-YTQ6=E85_qNK#8)SS46um7? zmFxbTaY!_uMzeGCAoEDBV~ZhSqyQTyM7AfOk1k;20uBQs>3pT*A^HcOjm zt!R{~d_Hz$eIus9e!s0)o!EFhvu>1cFy$hw8AOJzBeD`?Um`dYn5@kWtSRQwk1IK?XQ80?Ih~?O*1u#@dIru2_1+_9$8WZzYg<>_g88@ z>0Qi`pp&~r^i6t6nDMoLW}rgpIbM)Vs+p z*k%KcHy}(%W>AG2P-O&+0>o$1$Im+{!**>N%I2W#{S5 z^p1DjizFCAjt)IxJMhk&0B=;uU9;q-p6Kwz zL=|C(IC=Wr9O9y}rVNYT>L)@IkgA~4017&ZKRg4$YQN**`Ync;PK0%{+^a(h$f9LJx;Rq>uK~n;PZ3k1|z~#8TPSXsTYZN2yDC1 zK;YMc;wFMxp`>53k+Z0KDJ2;RujBk;&FCNd{$hWnOstFR1e`020LBs}A5}7RLl3JC zcdKIkWl)X3Ie zozv2)+aw?uki@Yz;s(~XwlFd=wCte4int1dbbJ<9g?Hv6%9yYDQ`D*S>)_L#c28^9 zG|nPM&hjIWT0mLUAxSukQpK^n@Lc?IsHu_CC1)3Cp(BpH@brejb-_-TNfTT3%mOMQ zzMwd4lqdodrL`b#GIYqIsb5c{xw8)N5KI|lSVR~@m%<|=2pL1#!RQFMc_F6b;6Ad5c%E0Fq>zY8ZvQC)1;HHOG( z`u2)Qb^jW++0}2dsaa=IS!HfB6fh z#th`33v>gCQ3ba_Zjq^rxj!NSg2LWJjcINFvlAumh`pe`vM{s36*dO!!TKl|2V|<8 z7t+MTp>=Dk)S0z>E6TjZt>wR?OTqg8EOkiw6s&vUEnOk#PW#mv%JvmtvT-}y)7}B~ zo^NmIJKbcPo$Fc4noA}TOW6a#y(xVL^us6)!a%Gzt$5JO!iT=% zk7k4X4Wth+f|R`nwiJ`b?p&^#t5L%q$}h3>eb0v`)#99=^rXE;E7*V3+qzk^rdf*^ zSL?=lTA+GQz7%Y}(vfKbd;B&TF1FU^d90jfm|D$D8p+>G(UWui!Jlro<~1^U+-~+j z{QZ}`W+q5P({10(53r|AHq324d~qs7YLeM^Cxf31i{43b;#*dp>7oNakbkRm7%d#y zpoUKaGvWRk;dyD54mE5o77QFtL+}|zw!?_&id#>gRqyykALDyNI69B}5v@UJ zr)Yuc0#A{f8qNH2gInDi@#R^Ubd*bfuU&;Zsz*81UM&Kv36YNiNCTB4fC*u`Cem0; z%EpEfN5($mPr{$>e(d#84fZw6=sITU9sMZ1T$Li=BI2k3ZYvapMc*WrS;HBOcQt=+ zu+rmx8&#AAO+Ied!)vAZJNyU}yK%e{N^Pm~&=KR?Vj05u1A;?(2WqfyA1lW zVNP09AYWjCXg_V?z{rtFNgYU?03e!nB+m|jpHX|x;TMt@RAl5e0QUWNijx58Ml+J| z8GQ%gW=$4J9a}1Ot+TiuSh6t5s_QNerr03uM2|g z#|7;6=JJZ1pvZ$FhGf&gyv6{T9~6d#cSy#86z_{eD&0C}7nJK3Qh+4}d)f=s+Dru* z(;`z|y?oFJHv>}7;Q*csoqjVcUy5`zic@Q!6Pl3GKvIQI zFhe}7bjGwtcM@-iBsN&mqU~yy$T$F~E)cU8+}fw#Tt>}`NZx8e_pf}i*D+wKPquMs z`l}>e$XP)CjhaAx)LKp_7*P*bb%YeYIMM#9N~fW8RO>{Fr@P%y!eK%_QWAF1QNsS{ zn$dd`9Qb#tZf_}wW@~n7h|`@9sP#Q_gC9~9(zQvOYe0RkYbfj26+2A`j}=WlitFnl z=c;6eG43#hsLJ8PGaLsB`mn*EghV`(NjoHW^`TkDEUTxyWaz!%u9{7%|CKALGw$hD z{K~jms&#F!41C$5zkApB`nb=D3ldlZ8SN0$E*%sk*mDCsY1TwyI{6d{9wCYI@-jZr z#q5@%F|MK{D%+v5Ur&3oa0h}Nv3kpP`myGzcr>37C>8SB=cYOa?ci0}1=mSIK5Oz! z4*gV8oy1XqvZ188d>py=eqP0BbtKsGu~K_Q$yiKO<;FRC(Ecc?Rq}nz21dj``WqYJ zSUqg?B0wKSFSQ6(yKGybACkmiS4|J|Bsv!#o{q2YuX7O#TBBcM+XqPI;V9#z-;TY^ zz;%}6MWZA}pOt0j%ul0x@}XBs*dAFEtTT7~9AUF5%VV=MtYM>JWRgBQo_hCjBtnsy zb5vyTr`R=<(~Z)**@-yy;ZMEcKNcU87^dKqU4R0t&HF?Fa}6SZz!;bJfPCYx(8_4@FXLr6<;z;C7A_AWgB)FP(G6b3`IGK6{Y=^pHtCQr z`5||TAB(unxnHO1hcc+t_D+0@X8}ecxY_BGs8Z18#n#}H18}M4e(EyTy()MFfROA( zY|_-ZtT#$iso0iCXBRNBblt^H>^oS19i&V@gfv}5!% zq_QKo@lBv-{}Ye$#87r8iarLjq%4-V?Kw=i4gF-aQvw1W1F8;n(EOCXez(7a&7f)LejT6)m(2%b-=lMkOYjU4OYfK8>>f z!OMZ33F_v3Dla!24i1DJ%X=JHN@XV%jU_TH0_JpY(PX|$dKUJhJ{gMz{CMXB%)TR^ zNR>yGhgu$fh9qedb+tUX@Ku6rYL5o)DdTMgNb6I3Nc;2_bt}gK3WP~O{$-HnrH?{ zAkQ(acNyXOY0=uW5$0jOoqW?2kyx7*muSKwMc^+iwgF49cYWALJw``mJV9)X)yJx8^W za~}Yz7AD46Bopi!HB>LY_gK=do5!@ww$h)=Z)`|J{X`K~S!EWGsU;ZOG>{96UC4Ny zT#-tmwV<>DM*>{kL!VAJ3R%fiK%J;{)du{I8|k9*2F*@7x+>j%)@;bi4Rm1J4I``$ zI&RqWI(RaTB~R#i@eVi`GqRUYO;2VCfb;X4m?X0jx-`E={$Xgh^>y?!kD|t7BVZE5 z+6C08t_jrx_IyHJTK=-Qhi3Ph?K|`A7Tc^BWGU8q$(R++^<@uF*StieNH6v5K3but zpED2Rl~zN5-9Zf?);ohE-#sX!h-*I`XL8&KXB1Fy0Wo=g4LL$6xsfxL*+`8ZUH2ls zUz(~$ftfz4tcjkUa0UwGpn`XAeqPWvY=GShXrJH}Pf`h{{&~yqo7GNYP_`lR;%2hX zhgG*keELD*UldL0EN{(j!FlLZUKEQwTvyURTtR{Zb-@Znqz<#zz4Bh8&mn%Rn- zH}QT3N8RPd$_VO$Yi zbg8y^&fx3u59ZsW0f8rp0}?DH$iDL&gzhM3?dN3=~QX-yu#5J z9>~VzSnTi1D=tnZ^}Pmss&nD!KQh=aETfq^Wj=_qWh8#KzY4{+)Wfvm}1yS z8c>j!$xHp3<#Z#w{N;%Ng+cni6{Z~qpl%_OIJ1JX=8z1oZBvXN$+J2+y9kbHYw&4+ zpoC?o`#xYM`qL3xXNd?z)}VYE)uxc>6;t`NB_{GY928u5{J)*F;Ai9;&}YFHpXw=4+Tmg*Ub%xD$ zJYV$hrBHMIDQnB=A3=X;5_uZa8O6Lqy?a#A;revv;t6v)xp})-=JIc!4qn=)#)o3C z|A)%nmu5!bs(~j~e;)7cJRfL@|oHI}!NQSXM*I;2s!F`pIFz>3< z*uuk(Z0lE>YsYch3m)iPuAzXo<{_ay3p65kDxjnwy zOV;cQyC*t$K+?rY>E8Ube$IOTE7Q@z!O`>eus?Dhv9R-U)uGd%Zy(^(wegyi^|f4| zu(fsFZOYDdm{AK)=6f55D%7Z0^sWSbKqW1yB^y-x$xl5IDo_?W@YM+zs*Pz6SeCVyy0$w1mC$?%OH+k4(CxjB zW|zTk`<`P79&$i(<`-?R4^dI^`hsz*Qph&2NtYQvl+!>rs3ElLSl|BIgVIl(`j&Kl zs%0o_2WbIliN|{r2t}ipTh3qS=8GiFL3b@$k`#%D5Q;HguC~}-8^xh-zb4dGrV{VS z<+e9QgYWh8=n?kSWgJyHHW8xI)=YnO1Vc7>elo@2O6(^@lF&9dI+F)}^<|7)+Y))- zs>$=~0W$^VVu-r$q631y&BEBg2DN>JFezE!JHJDT{jUnchJCMSKvc0PRT{Wd4^z`(GE9{htea>-c|NSi{wA z&;fB!(&oJ`7%wCH-cJjSHdWqnkVaii1m#}~jo&Hvf-cqismD{H>=|CtSJD=ATk8CW zhW$?q4V3dg8rJoXhGls9e%zOGVv9}(tBTIH$6vfMOfV5Dk_&tb9cdD5{$DQ4e*DLU z0mbwpgNQR39jtxj^pFIk>A~&(GRreNLrtr$PspzEhj(~RdP1IJ?R%BwKIq{bR zmm&`0Jr0HZ=sEOx>ons-iR?@sjcOd$@6wDudTqY(X)J?^D6)GwBwP;14ZJGNz#onH zo`5E88pIA3wVN(t66N820r-VOoHyz=`X!49o0ZD8_#CVDn4dwY$!%8JJ{6bE+vB92 zLA`TW^G#JpTG@OP2@qOQO=hz&mXtM`H%6X`KRWCuhPJ||2D+W1T0?5&xk-5gh~`GM zVm0y=C*yNqhz@7&jCvco|*~tjAhC+`bAB$&jeXV z_$atsz!l&@34f3$@x+ZvFQo(I;dE*dzBZQOfEPa3Y9HH(M?S#NT^5?9xnK8FXjMmp zksnHj)joKJi97R2kgxo7(A0^k z4i!kW)OvESn(=^H_R-_0WbgxhMCzz+{f^Y<_hLsnc$0vG9b#tdjXjcxZ<`!cfFAS2 z8#LnDxXjxfA+?ub{3EiIt?4whTD+zNY8qo52j84mVP)p3TD7Fe0qoY2$DZQW0OBCB zlF*Sf*%Q^6FM|Vy24t_A8QdYwIzEYa&m$^l7B|x2kbQ@Zir}H{fSnm+m+VLvJS7#% zxSD7M=jC^`3$b%T1LFW!k~13c1=$l2tC4PW2ng%`>!9@!a(K#`5D*e9Gc`R$04}sd z8X5Zd`1}NN-*-Ikp#jsAYg1*8F!?KLU|BdEaANNsL;+} zFPE*?@Ctn1mG2*Yt;}Q#9SnxsV*O4?7K828#X|>oa%2<4@4syeH>)%Y`~ykacnd{G zdRQlHM7I4@Q~}`Rl|%y0*v2JU$fL+3E_dLeJwTDhptvT_d{MbcIpiquyfotCt3BYY zF(WP47N^OafTJ%g-Buz?s;Gb&t8lmprJ|nwclS3WaSyKyptFqc=cOvy#Q3VmdvKoj z#@W@D#re-<(j{H*40XH8A0eiY-ACDE!e}+=Wp((vnS|qO-Y2_BTuLWvywb<;+}-X} z^f93=L_X@M#|J#_#>jH8>4z*`+DV`3b;SUrl`8hegdbmo%HCdZkXH*#%v7LMyktyr6B(TccqWMX-p?qozN5n{TC6`C#`=F5q0r@1oCt z-MxGZU)pv`KQ4k|ZoQ!1+ir&$7?`xGW;FP<+C$E~a!kG~ zG89hMe1{5ekI(D*X%Q=j8P?pRVGdV5$pI|1N=5iwdMRfq>&&dmAgVp$2}WqwN~4p# z(&3m}_czR4v6R7v;XRsdd|&;HGhlBFVwY z{>44Axz5M?|Af%OLaV9*-bAtI=EL9SvXp_VWh8goZWt@beo5db6%$|vZD_8^;;&=N#t}0+U`1# z8hUynOTBL1+U`5F7|OgZ@RNs|&vY6-c zM&!4*0RA4he>Zj!1Wyzeo{pIs}78F{E)=Xks6HPD=;#sr z<)!K8E1d#%b9FiCg^?6eFi&HFCPCIeIka$om%pjY5&}rvE_?Au1zXg~fTVxZh&{&X zhD3;u6AiMc@?i3E%x*(XYO1&`X!i2j6e#iOl*5`Rz7D$q6*btVMWonU!wS|0=R65u z#Be#HjSGA~C6Q}0z|)mxNc@Mne@>#_91!{L(My?mtT{(B^Dl1$_(D^3m5a#LYNNvu zmc{9ePC_EkAQ~{e=w5?7XCE}4PkM_X&HTL|ef2tWO_2{Ik%{(NLaoX>~1>8R#q80)Im#j00V5{}$No|K2(hj)AdA@_f_(B?+5c@uME_~8 zLcZ2GfEW7?L#GOYJNIwqwO7;x{S-;GDNzzlACH5_zOOF}*C_O^iV*ib3fOOpI-9=URJw_uS7C!lqkPO zpVplp*Cj#54>MW@fpWyB{t^_~)2pKBOkA?9v6!2n>zYblLu`oN*aTS5QeWU3Hkh@dEm>_El%sjK}T|zt`clW3pOmCoRz=Oqhn`GrmvX_Kb+lnXlbPeej! z^Igd;=;ftGa>^y-qeU&C=dog`2QDD`9vvKM9KsvNd<V(8vggsa@Y*cxNS*%1i*aqqJg9B|i^Uh<6WaafWhr$m~*iW?a|(>o`3P zH72)IH*&&ihps_Ec>|_e_PdU3n`KZd%`B|S0br~{DwAd?80l>b)|>INF_NbFQdzBI z?+A;7OcZM97zMRSsFF@F6Dg=M=ESs@KGDe^5=rrLHL{aILJhAE6YGMBW>aV27}=_c zFT;GokI`K@TP|IJYvCQeciB93}A_vvG|$lN&%Yb(yal-^7gPD z>6gQ2dzx zXi4hk*V@U)&m3zo`@76PiM*I=ku?W@0~<7fBNX2MQu-Ym-fr<`o~AM^@UaOoS+j3t=nTmU#2`J7#SnV3MHnYVcjt#>Xj%w>WmTReO-8YURi zQ*w=3lFFGxd~7-6gQ67Z$9cf4{D&i_{yvnpw6wqntqJo-zmYd9ejb~QlpL#+bdk<+ zd*1)X&d7p6q!>PM8#mBRS8#{4P9_|~;s7G9a${L16o-1GPO5A`-sJ|Nx z75o25BawVAq+m#}@V6cfe4U3>jew+m4$B4Cb1f3$$z%!nLwVSYHYpz zbCD&HZCpf5#}`q?=$^P+o{-gs3jx#6Gw}lUnq<@@(~kE2!JNQy?SIFoGX%it$C{_L zkrYa$(9$5KjhUjX;rI#yr8t7Gv1%8?@tI}{${{hI410R#)t)Y9TC&=a9bxlJ<`QU_ zAVJSZ7*1~`&C-iQ3N2iFtw(z2pt%15$FcCS{<@(y0=8Ut{Ew`Xpu#c@=1vC3H9C+d z;!Z}^NpOEDtfsTq!#2K8SZ9{iHC53Y8Yu1q#QTi!AbhCf=t3fFekv-a8{|hEkCCapP5+v~F$@3SH)d!O4 z9W)3UZeU2J$r`axFQ%#%*%!fPf?*+nlhozn;W^kw(nIl-dQVQGs|*1#!dNTr?CasG zmw)BJ@~`YRaiIxlVCDAyGnA(C4(}@Z8Us1*T^GJOQ0_WoG+e4~$j+QPtCwl3=c6 zn$k{3v{KKNwYxYHRYW`*ymmnGYoG=<2@~xMy`o}1b2M(pk`(2byLGs0)sjGB&7NUQ zU=aeubdg@u{C)MlxN>r&Euu;iDirn><=^xdtM5}d!jR}1*Z2~u#!HlFk_IS{W{kP$ z(+dHxkIBf)9B0~4t8Od|k%qL=W%7P091o`FM(ZrU)?M)u-(mwt(${@e9MLGa?BKxf z`2_HU^DKKu)8;i>^=={@_8fiayi{u5s4~MH1l$LZPrP(5rcs`(1pHk=IjIEgfA*^_ zkfS0v!b;ZTzZ|J%CHbdU6G)h3QEOOi2KxqRlad$GrbElc>z@>sZ~;6k-ULR{Ev`J! z@tBtYT?ouG-=oB7v=sFO7eJwnRj(DLidmt#maolc{h`_5`Wbe?=T2)XEFu|9NVC=2 zmgeQ0!P)}$^Y-3;Bmoa6Gp)6x?PB^VE14lEq&?(f4#|U4!!{?!9}Dlc+4uPBPlaYl zVwO<{Fx+zDqj7R8}V9bg*WLbgW>= zP2ewpy5PA1oXc-8y6qEyFz?rZ0|Mpf!}xQd=eB1}w>L^tzsMEfymd)9czEh6X+P!; zHrGAE5RekYk9EQFS9ZsGoE8QANY_cgC*K|=1ONu@6zLI!?9fUt@n%n5pcf}JQ!Jdr zjpjiu*hWszThv>K{Qq~iDQBl|B@xxt?& zFwyt#yLeiDrYTRzluB;Eq+Fz+yNUf|9qyfjw$t~yN3cJ`zrX>v>eayMGlJGWhBkStZ(l%>s@~((GxZ56;b)VR)#VA#ly7?2VR` zfX>mJC}2*Q-9B`^K*c6xGEnB=3{nQBQ5e063c=N6t_d(=+G;GNMH|L4iwy^%N#cx3 zta>YME88$4XJ*PmF%nb76zU>jX$DJp0y*UHK*PEXGdK)(zqe%f_XsHZCt~Ul&A04q z5teB#nc-KR<<}vCHCV-CA?(l@yY->lX1c{_tcOL4lfghvZTh2VTyVkCiu6!dfn4Dp z?htaM&^s$nhLQDXtj$lVh{uE~^1Aoh;wYEyY`~hb5;ftUhJL+$8wCjY{=I4U_HBd+ z`~JNPw)PfQD7Xy@KmIRY4IVdYB!V+Bv>xVWj9=hDi)@t6z>#?}VOc_M7|WfN0;5=S zDof0FJ-K_^6B0xcb2pEH_z^aW$o7(*C5DrJL&9~Et||uI>b`HA8zD;omGEB80-lMy zg-;HraTh5JgK+N!1@*@)q7jcC>jb8y|sgOYP9jNC4n+zHJ}X-M^YUD zg}v@-I#S&*1CBFxfB>QpkAbB_8LMXW^`<|-9?S;t4=d$)bAaDhzZg0Yn2^ddKzPFz zY3hw!mN-ToO-D88UDHvC1r}Dv=nkcPQ26!ps|uNdv_4f&kAQo!Ds!tSF0TN00Xfmh z&@7m-Sq6K9s#_dOWEn;an*(tWkyGG;l0#&NfLs(>^h{gJgPDd;B65PabaH6xA=W|H9`!G?niRd=kbEZa1iQ<&< ziE{pf<$*cIW=MgKu@MR(z?js|j&n)f!8{}>(=6FFcase}0^);xy`Xsx?(Jx6^MNjj zmr|W5(gnwxE}9~pOtNS96J|$fVt@>~At4D@(4oo=OWV8&9(=uE;bQ{~T69gylQf9HKDHSZ7CP^5MRg1VvSe}X*Gbm}zyf(VXNMbk4Zd)!A zMUY;kvq13|?CjZvg19%s$4ru%K0UO~i7AR0;H^QxN{GQ$&PikIKiI3#I*UXe zg)rkWMy<9iovPvkSfvz9;929`}ojEBinE>4yDL+*on)>?B|vWnha=4vzXbS zj)c+FQf*+_EN=>?Z{TQMUx{EU+t%bJ6SqDv%Si1mX>-)E7}ayb^$wT+0h!h5dhj|KO{d{r~AV2hTS4{}1tO?Ef44 z{}TIuDn=tC1X^ZuN@XtB6A?g){Ig&MEcMOI`6dHyx*`!~S+HqJC!)}M)<6hyvlIhVsX$9$tk1tc zBy?yPXRlSc3(p0LnIyM$xc9-onLkY(z{#3=r&n z(eGoo_Q1uaL1m)1x3>|e8HK4*Wkd&1lfiUddK2?m!<*>MSWnVj82XC;Ykue>s9sTB zC@jV__9%#p0f7|42D5lZhN+u0tb|L0s!scm2DEKvHIe&1WLxe&`5*uXsOA8W!f z1DBGd4ahQ5k^cl0g>61@R!!mq%NGvi%D?!LYSEbUUsUfw|J{X1f^`Mog$ZwSkw6HM z1E-s{>*4I82`onHU-`X(c}dMZr3;Ap_FEw5_C$0K$=j}N_=4%NNV;fgvcE_85-i8A z-7A@5qkkyk+u8rVx;(42H3(Yk@ffQOJZITRkFhbLx0#D+W--$otM~7rD|}Pw%QiCa zun%)_92sggKet!zCpWc;(CjR4T7>!KC`qK97aV`rGV&KD?2+qi$Rv|ZeZddd${v{d z?CrUG|6Z9!&hS!$*M)ig{(aYgLQ5L6GrLFD^y}LFjZt$`b^p8f{nOsHX~>hV`EI+S ze6G=MxXB#T6R3L3Ws3X{Tu_<2cpd(`Fax-1`H(C_x=Qr$Uf{9eoaGD)ILd@HLodFr zo0aJ+If}|fWtpdehe5z!*ekYB?#_lB32qJM%aA!yRx7=1;d85jp%<=c!nEYEiUu^k zVOi2kKr4V02E*yAws6#LyU$3_+%CoXq$n42l}j;Uddvz{H8c?+A$}!hnJQG&Su&Bs zpp$UUZcX;@Ueg+?vv>PqzW}Geasg)gO}px1a%*3M0Rpq8mA*J$iF~+l<$I0mZn2m; z9C9g!JT14nL1~Yko-X!O3nEST%v@VV25Gx|Csx-d#l$))fn8_HspnXbG&#u$Ek%Zp z4eItVlA8|6l&gZK&ZR{Qk)k(GY4zEw7{{H(2FA4U!Zs{4oSm?`E>K}T~`e{x7xBu+xjsEY0JYlr%^ht;2x&L!NI@pi)JGDH0 ze`DzcoClHETzOm}-y2*pl#x&;=*dB}-`n5rOehDB875&YHlaK{B)2ph&G?Y<|6@K? z`It!-apA*?{qG(8yN>xCAFA4Gis1~JbJ52yY&xgXi=Z>D0rX>UdF5$!{_&!}GXYp} z{tphG9n{bNHwRBQ=l?@IWynLtt?AHtMn$QJY1%1K0#5m{&k}doAw)7jc6CS&I)v1k zV&pM|4Z9#@$#S8%7IJn-M&npUTr?e}IXvu@$?0rQnvM?1)SfHz;>WY=-;ZCOUmu;F zpI-ic_TuQr({)E3alNSb7q705u1~Ss`wlZHG}WxfgD~v5@xFg`e)9a@BMpiyNf(as z%hB2O>E(ULxTRb-@5;wU@XfRIX+{5?$gTRn$23P1FlQ>#d8_+ih5h&7;K|oD`u}YI z*@pgqkmv2&{+DFRCx>918S<1F2Ij951D1Hq4#}7O_wPF$)2wsJbRn%jKW48gc{8W8 z>OlLqZ+kZCiF9KznTRZ^AWp!@bxF^Dz=tII899wnDh4zq?=c@pnJ-0hhy*-!cit8DCR1SzF;Yt?3 z&ku@Z#B|hd&vKFScovoYRd!CX$&|@sG0CZ9r27}cnfLa)WXA=$t;U0B*LRppo@vs> zA^X#V0n_xLTLtT)w%rGVmG%9!3vUM{`_09g!20IiuqyK`wS!j}+v)N$Jsjv_DYAcv zK}(>y)*lkL22{u6cA#=i9}YaFq}vig!3V8@bnxthBNfea^`L+PKfhs-s@7yG{Nh7` z$}at50LcejwE~c9y#P4w@^KMUi+>7w@U2=j0g!w&gl!)9&-Wg3&2<=YryaRsJ9?BWh?sK z_~pYv?damnI@Pp<9nHD>pgjop9|DAujWB9*UHn`4?ZbibZw9qRrfCYnKSzZYDyC4` zq7_ufIbDMzeR_Xz+6nS()So^vFnqEChLsQ615Wvz^?GbWY{07H+)lV6Pot-QiaJN= z=`2V*X7SB}*0&V>v3aJ!aTbEqG*5klr_s}B9|J9_vajjJ!o$Vo__${b*>vHW-M8=G zcZqdzgSae=mV#-4JFXv_Vx6@Sd-DQv=(5g@N8h*0dX6e%X@!wO%Q~Tq~FxK&Jb4XZq`Y@6W&Oe);SFd;i;)@85sXB|8=H zkat9jD|D0FMRkek2he93wtZ}^*5+yZtgHVWvovS2wdxn1752ZU`%mlk|EK$3J=y4g zKg0vq!s(mb)$#}nWdS-gU6$}3v!eCpw43lFc;q@^(6oFxWm58l8Hyr{EGAz+g@5wN z6(p%A-Cmbe#U8w}u&f!>RKO92MVihClt6?aPnzeLx~uaG!@i-tHY1psDo@m*CTpOw z#(Xu_X;<&-87R5V`Vb&EC1WK0W1wDyVGt%C-2BV3!zyRJoDXRhR&onm_g4TGhJju6L@{n&DH>} zufNwg7xY640U1);sCfa9Un+}Pb^7kK&9~2~)IBl8<^d8`7y7ZUrp@yKo;CSDIvPnf zqMG$s!gUX{NGsjKR{4K@^;O;f>#KurHu>K_$P@a1F4GCRk}c>Jb}3ReSEU6)!Ww)i zowMcA+o9xj42|nm@vK(bW$`@A&$Q@4PA^}aWsMKbkimCwM=hLq>aVkR#D-pzXNG)2 zHMzr1kIkM{4a#FqR=HZ{K=t<-#DA$Tde3m#;$s zw+$4?cph9oZj}woUp4P}9auU4uW|4)H46+LK%S85HMn9X_nFJL&NbS>lVBNtA7SUl z?-7}nfx%ynu8;rr`}xs})2oZ4k(GU zvtT-srfGct>g@RmgtuJ2eE$6O^7rSbM<=J3zn?xoJ-$ABdH(Tdc=7TCCh@rAHx3nA#y*kv?++KX(sV=?%wSo#*y5=y`>J71OPep5Tyt#M;%POvZ9D=rZD$VU1rm~>nlBxXk>ig5n^V93otKW~Gzq&GCpS*l=bauXQHeZC%8V!+@ z)sZj`5>^5KY?w5@ZFf%VQ5}-6Dot`Gxk&tv2m8UVOK&STysBR({@%HO$$k6u+o!cz zW4{Y#Eg4PtX9J>AI0~vEqaErfjzy6{-R8TpSo8efn*4t|g-`8S!T*2t)z@|Y|H;#5 z`y2lMLp*Ehe;!@&^RVK;BIQlD+n}+5q;nIRFHl6xt9j?TjRjOy2thYL4j5-^V+4J> z;TDb2G<7y*nQrc~*XwmYQ61lh+3E*Z_Xj%u`85xkH##WU=r!OjIrwcfAzF}{`bHBW~2Z4AkP-L zpjtDD#V&D=F*Fgj9#R$4_=b+K>NnOXb(yc#n58KhrDA|qQl5?Wh-4|II?kyc2k)_P zTm~glMMidV$%gz5OVH}`zjhpE_?PU%|GO9CQQ!QZ`%_J`e%aB0#y3R{xvx~`%ShekoiC#Sz3F@z z>52KbkbKnn^8bU%{*sGAk+YLi)roQ`3>(pjc*1BOn@jPJPBc}qNLc@K@StyX{x46D zPF|cwljLq=tkVBJd%9mg|NEQzUmxb#n!m<7|LfOU4&dK*T=H8!8AWOgA#+9u8PH_J z`nGis8~1|Rx-|Vx=~>GDI!vkVsecw!vR(4Oe!Z?I$z3smY2OQ)w;AJTE|u|$LCO!> zuB6jhHy?6mYm2-nQx$hQ?}&|mJDpITl6T~lOv$^>JJRd*dIbOD{sHfO%3|`4{AEFY z2zdvCU4fzk%II`DUy{GH%VPXr@a-j*ZinJIold!mL-IPvz5E*5o?(f52$F+{ zqE6>DQ-x#*Ac)Zi!x;Y;mcgHiLWaSZF5hgY^MjCNVy>ZtY06VYAl%-5Y%V0z;~x1{ zGKw*)FhU|?Rc^40U^8#~yPeKKM2?b#ybj4-WMRO?YYfgbA3?@bvyO)OE-8@haohN-I`d_oVo^3{$)t=EhRt{-p` z54p}cSEAO-T9RV@?h{$Hv`%lWr*l+jF=82$RI>yM_t+cJDW*uF%uv4?0^c)NKA9fW zIKF`2$%MQWBKb$(H}BhPLiO!;yPt#T_8?Cy`7f4<>RbGf$;0~pJbku*@N~}q=gE_= zH}cT8orQ`?5obiiMFieRazO&9ksZw9uA$#x5iz z@H!T0G0E&?dZbbS=NgKujW}@NWzAp1etsV~GyX$~44tqeY!tbVSW*chxU9d%`Y}j6 z7f*mHk(CufT^BfoJy(&AW|(`72uV~C$BZRp!jvj2PBcx^bX}Wb@T$%9U=~;C!!Uy{ zY<4$plc``*HLezdEN5|KogikBL5IqOD*gXd{<{9$Al=J-<`#I?H_Yw4{I$*8P?{o8 ztq%5f@hrS+KYYVQcFiYDX*$U(vpEiatxUvApxADDK+}9o5AY1dV>a;-C+31Ux;Xp! z=~d-5sZJkt9awLUV9Q!DVA~`q>4tZQl_FRO*b zP%@gL$2e%gp`g2DW)xCnL4UT)5_uscBRm_5!?5U-BgnCsOp1)_Ss!>cJ}9)1s-Lha zOZ$qCdQ`?^t{Egs?9-h0VCor^gN`Q2miJ!SuFQ1~L-7G(ykrN=`GeAnj^V=+-E(D) zFHf(oz2gjQMjiS9_wqwkZh-+9&xXvNOyB@bpDasq!Lc+yiBrz9I`~yFm~gGaf}{~S zrdcMSAULXGl8BsT)Pf(vh^>bGLi&`mxN=?+ zrntF3AbGku2j9;H`ZS+X^T18ZD*b!fKKo*57roQJ)mzZzlI{`_-!M7kX~T|I)_>v~x-A6@zoq2CuLuCgO*bqL34H10Y>D}R zW;YHpL3f5D_s$43TZA`DHghgUd2Vf|*)+&KU2ZAMrd*0_!ZJ;!RC27D4TKE&!lu<3 zz$oPsiMspDhq29l!Zn*T;%I$}KT{d-M#s&8nIe}&~=Ud*~T|~}?gq9m01Anlv zPe?wlL^^dv$xD)K=f$(U(2kM!*=w_SOtTS77Hte6C!#RpfAIwXPBKizZtic;$e5p8 zhIc5@uHaBJ71MkbXv1AmvrN-BhlEEgBHb^7pSn2P9J9ci4;OZ7SC?|lBuz;->?I#@dA3z*mTKm4N7d;Gb{>~Nox2OG4uuMK`eC}#olluj0j0G(ZHp8u%dMlu9R*! zT6CeeI~dKW1n{XG4(l@DGT%30-nPO%oh-EsFmMm>p_L0c77JjLTrc3^+Hi5iMs2*H z`A=-NAQM9K;vnmVVM=e<3?zO-4Y8}m8_{k~=DA_Bjgndo|kYq}8GZLZpl~ zU;6kgW*p0>w_<)PWCMJbWhik^75U183Ew(A%tdloI-FKAn(QqF%6#&bJ@VSWL{|OR z?d`w(bo%%I+TQ-{b@*!_W>=al9S{`5nMjy9Mtk_@eB}O~H5x=?q4e2>|1%fK*~N+h zf|hFGWkA*-R*Q73^G{{3oW|8|kyWvpfBxW-&loy?E4kKe89L%)cn>Bg=C<5(+2--e zn;vu@j2xDEan@NXti`Sq@zN7&$1^E7@{2{i@;SOVbDHS~T2{OB?3aGuQ|;8ZKiuPV zdlj%NGT~U^Ln5+tR>oE?g%Ff#P{1X7)$R_yjN-i5vkjsNn+Q4cf3kecCWh_nDJ>)& zt)L;UYwXhhg`HLgpYM5h`N@-v#Dz3BY&vuFjU^9qsy#%{*X97cU})_^4!?jIoQkxV zFtz7z#+3*UOnx>sY@>RxdpY4#u0(^nx%$v-_HrqL5;z+;EYCC>E#dF0ty@g8kuBg> zWh4r1#4PkJ_7d`&T&NaA#Gj8Etvu+i_|yhf9FqUH^FM!j*W3MWX9uc3{b}caBKXIb zyWj1;bASA4cXwy!*PmYecztpD8{d8RYgSBd@UM3}zp~TcT6VI#``s5SCibRR@{>KD z>7I~11o0tMnp$y05ghB``K6)0Cz>asAw|g)*pnHsaRjCT>|{Qz>hKEY$`( zK1*3^MU!Q-z@&E#KP>GNf22~<`pofOTcK%xiI-p144ev#>oFTCnOB-?YxKKaqG>PG zxJfg)G4wV~a%1RiTFxg#i8qGc%Cj-_KA@pDr;<)Ej%fvrzA!BndUd5-fsAs)W_?uQ z+tY0wZ3=7XRICYsoTDTT&NSxusy^+^pBH}iIIr4#a*-F{fQOD~wLu#pkA{iNN?$B4 zbg0yFeJIWHrW3o00(k?)&#kSJ*A-_;vK%6xkKMRYcu*mNW$LGNuDyY{nP2+|N6z-tJCAl|DV0L|Bl#eM%=-2C^u({J8h{O_S5ZvSxh?dzA9U%fiLa)0Z$4X}zqB_wz5%q7I$ z_c~RQB-DuB(wVrg*}?^>fwteTxg~ZWre19Hyzk@lF;TWpjNK??k`(!Nt6+oJVTq0y z)x%*2*Q%6Hr}pX8w(TGE)TRgG+(1;sfFqL@>#*@Wb^TcIs15rEg*N*6jj~Gb*dPVQ z>q8hYq$*D~b=v(l)5qsL;87c^)YC(L)mJ?-Wjc#hRXQEr7hbWX;fI#$(52ac5 z(xjaYleDGGGo*hciIcABUn)P1QYFsTF_5b!5boi-Tk%%g-E?0^f>n1%ZacV3DdyN+ z`0v0Dr5FR_=D-MF4*L`xK!S{eZ7-4zwx_fDbXM22r?VOvK(9Q7Z8xbZ>`i2bl3fz( zJOtzedn9V6G4C#7@H%s{Sy1td(5VDRg(ZQLxGE_1GqoAz1QN1Hb__2x&uS@SaTeRt&(#%nKA|B-Dh@ovz5 zqwirpn}Sc)1=M$4o?mgub#@hdmQr9hMuk9@D>@#wN^!+PTt3b# zVHLmZzOnX&xM0`gNm}{hrF8&W_saHZGYMREbsouM+svD8orGqQ; zu#fdrornYOykDSjE4JBVOI)Bq!65DY)adg*^BC|Tdwrvd;f^O_nO`F&7t{S?)1h!Yk!{FD;Dn<`==u|xt)y2w5B4PZ?ZIM zdOISSER9rl{g=}bVLF=}n+-B!I-74g|Bxa#qeU^L+1=(%*4HF9-;iv?7TH~QH@z~0vHpCj7n zxp@L(%#NL1oGjQ{k#WBX&`@nwKnCx|Xr>fq!AmCB1=p?l?hQUm=JJ6Q(n^%!YPHc0 zkY=Xo-G=a-R4$g(t3~BQgu>4J+|a_vR5j)#gRcb7<>niNYC6U}vvt2WvW+#2V|jPG zaK$Y@{vj2`$nUSQluF1Desah5y zwz*4Ii(Re#>Pi7R!bNV_i=8z?#&stI^jmDYc72F_PGno)8%h^$$hwaVWHXP7OJDzI zS^8Qpd^L*I=_3JY|gMkDQmq{)Z6F2P`9;5qUS(tWR`2$GtoMvDnWU{U)R4 zz|W0VYqV2p6;`xBNFY|`Z^X$t)W_JK*lUA+d^t* zoPKvr&bhjaXB5E%m>JQUW^-4j!yNE}>BB=s=2B@=(rnHJ0}0GXPtp7|E8bT!AFRFE zjLBzqd;BwfPz;AVHN!Q3W}Eb^q!21~(<7v;PWMY*Ftt#cm7z4!*+2`~kO#Wqk_n~+ zHrRyR@ahGzco^_L<`Z{6(;_QHa!{rVcpuiujGjV~MI<#L7wDl>FUSFVum5;3A_wnh z%KS&@nTjM-UzSzDGp-9;aIyAh9f=V>BaQGW&*4({(%siK==}&P@J8y*C3(QAJWOaT zg6nJV1k;YC#AR94vgEx*eu%X|+hft^=}q#YRYsOv@0e;^cURt^9}i!1gITvH`^}HU z?a9j-ktNsK6$5g*I9Gn-nw@69V6Nc)t<&zimp)mTJj>brGnLclBj}#8`C2+0OD|Qb z$iZ{e3wc57VlfKG-Ok5M*8XE;rM76d9h@AHBUwX_GAc;H=sgR=vKCmM=D0T<+ui3} z=zsY`bU(y0jB7^oZ$*(FuXyNk-wt%$umdpBNTW{~j;$E7m^YSc?{xSIxXqnq#zexUfZr5f24`pF^tsBW3M*c6EQ&l*3`@hFG&Wuf`bhBi1vTK ztGQ;q>?!FQGJ7^wC1NGAB-9xJeFJvBy^yAboD#b$_tCqzZ!QOQ?(Lh)$M4ucfpS@% zY~{kX0AeeZ^vfXTeJ>?OCBcc40sHU6j(j*+2HbTvHyd5n%;n+5`-)|{^_gDJDHL)j zn?m!dunTQgzF!Ea0KWmY1F>+{gq$-p9Mh;k9YI^u~m`!f!zsp5kW7=Tg7rht&73hoNFod zh}6`Ek@eP+v5}umQQ-XRnz2!6v3d64Z~kC-sSLc|M96A3n1RD4>$gHY@&+7oPxM{( zee-+m-(Ie~f5#RiUiwnjW(U^Y9m8}6!v;s*#NI?7F>i0FE_pZ)QV6LQXLmT6f-QXbdyh~wQW&$MQc#zJQ^^e2H(!f=GYx&POb?4u*lU1;1ltroO6WQ;l389;ul!`e#N3L}0>)+Wn@O z{(wO%QR7=Tt+OM!jR>RJoZPX+76sS!Dt;hzbKv9EyZ+WmkCko8v&SU z9E>X^t?wc;;A*{00HsBF$fTMTRP%f0v9?Wjt&|t->)~W_hzvpkzJF~`wE4a7N>8vu zcMiiVS_PQd76HuWm?9hVAM`ifX|m70Z{d)>y0@wnw;Nv2Ah9 zCQyxC#Mn}=V{AjPYGR%$Y%8bT^UkURe1)LCB?#jw8vvQcguJrc7Y`MkDp@odiMM~; zoG-F60Zw>hnAwV4*%J!bwJqTs=Rw5s{5>+Z{nd}E`Z2qb>qn)yHV2g|{iN&-d$%JkJJ{8`4I^`DK)8H771Vy zy_i&KWv6A%u9|7V)%<#}(fswAmoX4%#gUGN^nN96*~m^56N-b35ft#hH7KU6{gZThE?>CCThMHT+u`+P^b?b%M`(qt(t&#dQ09})fCMFJy2i^35L3j@{6Zt{IVTt9gy*0z0mCkFct zTYyOlFOOX&_Ke@U`g-nSNU8oy1n4L1Lv$(DB+s`!0vUuU z%W1||2hM_161l34O6t#Dz}GCr_5z2y8-G0PCz{Kwfr>tUJzJkVYVh%u>D_q=LGjSf zZN)PR?9MeJ0BPQ0l77u%ArZ_1p=Z6$2y#&bSA850Gr7@S=Krtxi_gu+dw^ZAxSbUqX6$!`@Ls(e%o#f7MG-U#~Q=_X!J2`u^)zU)@|?{K$`g`Cc^T9scW=qwm?pkBLN%kH7eBQup4ETci1y3q6+g z7^nUP(RGtDS#E;1IWO%M zu}^nH@ii+eS<`w!a%);zI724wlUlKwK~Tiq0#zm~pb5aw<6g8|y(9!xp{O((kh58*HgSrvxR>SB@@ZMhm}VI)X%W zulR%LqCEh3lmCsOa0WKRLSeiB&*-#Zs0zZW_EL7c$V!Je$88wMfdQz z^1Obc8)1X32A!5@(exq5k-!y(Uy7Hu2wb; zR%arYL6F7i)ujqGZahD>*lzC>6jI#UdPNIO|@_dE0LW&x4gM+w6(OMJsf}u=mP4T+4#XuyoW2f+82Ql?1Nwvz%WnY z@Mctia0zB zg5H{cT)jK9*q8QS@Mug9b60|vw-{*d6Cz;4!w|wioW)0NDxE0#?xkjYP|`dZ{HawQ?kiRW?8G)!sD{_6Y-uw>qH zno-RJ+_)~SQ%H@Zd#TRAL1gCZXx2i(kBF8M_zv>IQ-RPX=6=JujTr;X!H1qWVa0UE z>;zwF#q=M>^gAK-@7(r|cGgQDlF)kzl?zO-3=0roGH1EFxuy$Ja@B_fhV9x2AE9#} zS6L9KH_md>2+a%lYx|9>cW1HF;02aT0DLyLbXBvl6OGJ7a<#%V`}eG$yOH1MbBgM9 zl>=Eg8dTV0=ObqOm&+GPB~oOqSOkl%Cge3pJcWy$K?{M9(TonkGNu%*7b7xlw2=>O ze6fvA1re{Lq5(DXN#ETwi*>rzF$u!NWrh_7xUr`Tl zWaBvD~ftpPB+(IEkWFF0^ zWu~!Ug=7nCc+=uMl!o^`{N*UFRes0u@n3C(L3BRKmId$T8>ietUayE1`}(G6r;M44)f6PjO8o#MQYr(BqYokLjA>QP;`t znPtcz&*W`fgpa(j$%u>_#*#M3-*rSAE9!dP9aC41oH9SLOW~>+bss<8;)5V}t=B~+K>qJFHlaB|zhH*AJqNQfU88bJVYl@ME$_Vg+sDZK1bK5yY4?oLZ~NxC*=X6v^F zZeZEMZ*;@GlIeE$4nUZ?V7eBOkwH8oj36zV(X^Lvs1{aY(Q{ts!=i13-YvZNT> zq-pOUu(Dp-k;M2>)MpKMKoe@%=kOz^SN++)t|4
    g<$LVCv-$UDp)9X2F0A>YlJ z2(Poyn=ta%GY8DtB*JhXf|{+GEMv?Yr9zm|mMtf4BhyN%vpG{lNe4M!6s>W`ZUYGt zk9AoL6_z@=(AK_I71SC)W{t=&*p2IyXha`x8cH2N8uV#}HXuGjJ9VN$MVwE_Z6vV! zEbwOQ$RDmC+smXVRssPY546q|q?=RC5r=6Mc8?sjV@d0($h$JlvDefAzfmrAH;rhc zWl1&9z)HktftRK9MeDs|9WLoq3C~X}sJb<#x9A5+cxmKh3K)npmvo*suhtb6?1Gh9 zc|m?hz5@s3!1+acR#C_Y1>N-CCGYmI$>XCX(URD=5?65nGZQeNk=eix%*eiKXEvlJ zYsOFbt-$PLuAHR@GXjz*ALX^IDr?0pk5|VJe)RgDDG0H!xeCdf`j!b+0~o&1uAsIb z+#<`Jg@ARESj*e@{j{j&^q9O=*niKHd@kh%ttN?jsQFksvsG-KRE;N9W9{&sRE>4* zN!94KkF09=82I68#v7kF62w=9!G50hP%Wcl>AjqhH!PF)tVYIt@xG$Mh@LMgFPcc8 zplgnOxArIiSy3IANNfH~qUkrEUGCCOfUWOgXxey_s%H0GHfi%Vmfc9C&iF06JyAB z$uZ;Q~72fj=hWg@@|ZNv4! zF&5_I;aN{63zjnsmtyZdW>jFG1FhhJD;A6N3mX-LmlakQhO<4kvH#9u)bfdBntvDk zWYFW7-j|kd+ErOGYKHvWuzEp^u-8WT0-loMc_Ozk+sWEqQ&hE~vIiJcFWwu07iv>% zrOPZ6>6ZF|sYu>MZq7Sm=)@N74g^!0C@PzF`uaRw(H#&DK{l=XxoKH?Sjx^3u|!fo`_cBr$Ef(_9%Z}d?2v(H<8rnI(XfAZ31!_`!M%0WJ7Bm<3?S<^2=)cPoeu*A6dJ18 zEzd~F>RYIylFf&0x`DTY9p!dAbyxtMYeTGc*y0ck-KX6)NH>iS)%k{x97K?BAXNFo zD2iLG>8i|x9Y%4fq?O?#|6{IoI1>LmKrQ68nvheXxVSA?NW)plg3l$BH9azF$IlJF zrv<}|1S&i#Oub`tWlbBk8{0O!la6gC9jiOGZSUB&ZCg7wI_}unvF(m=@_g_3&N($| z{aIuEtg)(U&ik5oM0Smo@5vGA&G6smiy#z~%avV&rU6S7M)6`e-<9l%)_%6h>L3FaFA+I@L6H$~%ks?3vi&Vr@D?17Z zwihSOu$417p-9PgO^HhL)?#zwEEBD#_z`MitAgU?YkVZqS|5HFraS5}(iy^JxpCbJE0fPlK`^?zuah1u-0u_QqRY?^A#^zD(vm{{Tl%>c$U zW%h390In2s9}fxk8v6`RsBnvMnzI_|#;t)>zdVcQ&Y-ouWWUFav-`>&>*aHiCGn3w zXQa$u`=jyvmuLEc!<=w)#ro79?%U5TVlE-SFth?s0dZ*JzGb@vOk`3)axJH8s;wr zKiwZug8O<~2xN{h*15rI1DW^UGCF^NbX*^DO*s)OX*0EZShW8I?Y1__K8d^WW@t*H#!Bl^CkmmUHHz z)4pU(?fEOd%hVci;L$SSxx><4K|&mmOUiM>q5QR@w8%LVNk5ol!bAnDLj*si091M? z)C5coB)rVtr%rf@HomgQpOX+O+Q5jL&qacI{+OpVxxE&pXmnj0Hr>RC>DQHj?yz-K z{7a3544fyt(iMHCb%WU|2xpZ=8KtKRGHFYVsmc~-tf@D*U&8}o@il7=5b!^FND6Hv zugdXmMkj--GA6vcVCSYMJ4{rl{Rt#nO5aaGt!YPN#$2dOF&m6ORKN~|xC)kLg&s8P z8|Z5`La_v3Tk)-ty^eG?N>aQ&PR|QpwH_V3UEM^^>k@PlP3hE^GqKss|E>P<-e@F_ zLfaYkoR}@zIF6`f3^+Aknq}*4cd?pdU3lKZ;7|ma|i>p6C2J(bQ9B? z(#by>RfD+2PTi>G0MVDDt@PTj$v@7efq$QNa{H7!xPON0IEq|3cA)Q8si1(JMy1-% zOzX;b4Zt4|lwX?;Yp+`$G3qG^N`iFyW_|oy0-7d$g1x2MBw*m-CT!2p4lKFu7XQOv7t`CC6|!SXKEn zl3wqd!&ghP-2>91-+e)@;@tcuJAfwGWiq?J_C|&cyMR~;FV3030ex|2mM`EeI>l7G zsgs@a_4JZmBJyLoQSVE@44H9R6AQwutJU255NbZih-){Hj)Q)SFhVbr%$4hVPax3P z{HZFix~OZ_iTkB77?&;t=$R8sPN4hqd9Axu-b`J=jv_?)?7oq2Uo6fL;8ixn=3GK# z8Y8~wg^Kt0$&*`I;e2oYPmWN~MhzDGmI z#zJ3P%kr&$hv%HH2hPeghfWD#&LZ+B=yqIwt2@qegR^37?Kd15WX#J6?COl2jZ<9B!4H$Pq$(!PNCSdHIHeap&cgJV7ub1l8tq;s@9a1& zR)Ul!!JRI7E$h;*VK+285duC;>~Ju-AZx`n3wG3e;N~`(-=lmwCg7?vV|)sf{C}mm z(m~riFtohQ5sqZjAa60^Ot9$J&^ISkvuPU<=N4)htg1U3YAQo_4^b30yArB!^d3QX zUI2$C+uM*&NrD%#=yk-G2|mW(s^oRnrSPUk&g|{M#-X#1`RHg%DZBB!_ipgc`6T@~ zSnc(QlCIL|DEw(vayRUuULHPfKC3$|f!p@P%fWkDgp%Dk z)&rMolje3o)<*ND2#{NGU73@Xu4~87JnFwVsda@t(kYpvT~W|3OEFL4fxX#!=xga7 zGcB~Au>fxn$XYIZwV^I`yy*UZto;sfvL2B1&)V_Wp`W8nOTzGP=Td}(rREx?(}|S7 zHYwvB%Hm4QW+sR5h5t!6mIQh}zBYmjF?v7Ab!US1WcMdEVGB}-Sd>ujv9KfqB;~`L zi&;9(ww-w=)+bMnkR~SO)bppcMS$~zC+S1OWi~Zntfn{XYIh$)gH$Di+uGD4m!Nn-9jezuK);?m7pg0-H#Ad{ecK$0IEwG~ zxRJyCD+6?U7waiO-AC4;$2-K8C|%y*C!Ib_62g(sMTti-ZVCgYx3il#+Vt&~ARjpX zvHr*Ps`S;Z@5*^VKW94XsX9n=ACJTXArN&q8v?e8n&2^0Q+WDpeyFIdd`$71)to6b z`SeQ27FkuhmJvs>IbCK8auxiFbT1lb_Tss?_JNQ+!QINbDB&kg?Vpx4yRCp#JpX6Y z!Km!}L!O`162&h7z1}W8rG`l+I)$7W51{6(p4;iU)dV^)W>K7Uj2;Io^~|IrT{@uS z_}@N@JhuQO73r9@p+qb&0736+wDnHi`yM}LYwlnCLc^f7`=&?#-{*dZ@-=3SL9GlY zZoTe7y-inASMv)KTq2O8&4g5ys|JE4ksSk)7~Jx@>+zoggZ}6?l8)ISwO>^;m62wa zC6s__xVewuUSXcFoOJ46csMVBLp{x@%ypPV^9vPT;Wn8L`dP5?kKa$DQ_k`vG4_63 z%!-WS%Uf}JnC95N0NY8lLnYY;@zcS@Ox#W)usrU&`1q`YC>&(cLgntFez?|4+T?+D zq7IZW;@HDFK4kZ}A-=f*?OX6M(X=DApDyqs<94`nmuUw2_pyA5VfA@*JiYu|FX3Za zLZhBi9{yERbg~H;5B3xIfULy`#WO73peO)5yzwg6-jv$aKpmf(v}9GZ z%hlg^lGgrZ9V;Uq3#M*L{7j7=;HE#H515ySxqiJzm|3@$gxLE{By9Xeh)3I{{iLu} zME#v~*Paqk$*|_BklC7CTq9<)G%OAdNABz3rK~kuAFCr64y$z}ke(>raMbp0B!0sy z7QpJRT&o(@G3incP3W7tzsvg8e+>bO+8)RGX_kqDB0oHEl9QdC{gcih&->%~C_Fg> z7@b!2)8OOd-}4>(^Ypy>7FeklHq8vGxI?`p^E0_22gRr3`^6bfSWFsEB1dylQIEtmQDDrk8a6A<`J1gS2Pp?_n zK|*-sS*G|z6n(85szOyH7*$m*cyO*e!bRMG%n=L{=X&$q23?ZTeDF6e%dt|%rG*h9!-WZ(1>m zF@%J*!?asTPovOoZl*X|l+^ooq33|xh>AuQ=Yq0$5@^ZU3k0=RS^}2w;A&@M?i;98 zWdYHlDx+JK3qBbdK_0e#LAxpkjo*0vsWhpZwN^F)Lkf?{3Vn>uDlK@!T@vvS3r}$b zVk4V_EZk@qqT17dwk!Z?Tnn}ty*E_@H;D1hpz=#GPQ44u%xeB{3-#K|q#R}R=20+1 zPt$Pif}J6qvX4o88 z1B8>-bn93XFGDSUmA0bLIZ&V@syG3DAluxTzOG%+jd*B5RIxF?-`bABN+?Xo_e6Pk z;z3S_GM-iEDD1YD5N91HaY?n%l{ynL3AFc|73&5J*l12Oz6-&erlg#qtNT+YCIUBM zRG0JM*=CB}vO?n^)#e~U_e~VKf^<7jqJ7*&N@PlHH#>yLnX~larmU;-?9y5!o=D9i z`LTP--vm1T!a|69O7Q*(TWkUxMsg=)ZeNQM;i6Fkp2oyy#6NI_qEbI4R4Ie;REku- zP&oV@dbp!<$gksxqYYoUI0o}wLA%cx0poVAI+`x?`j>MJzM84A zYejf=48O{y!JJlN(CZQ8ubgvhkP+~U^Kr{utBUQjYGHU%jC3h(YH25k(-+jzN@WpE{G0YFtXi8MIUHe!i__E)SLrAy)eY+qL$shx#Rkgnz zuMcWZYu42w>q{TWF|`D?S9$%imWoYPxx0$yRlP{q2=aXHo21!oYqXUdRYQok`jSF# zA89u?xRR1vdC{NmBU_~J%mJUz8#lNky={JPA5Txm$FFtzKCaHLH_Aj^C<%5I7PQc`BKr;0 za*aq14@EZO_{Djv)NQ7s=6~C)}n}NsH?OdlWD|;P-2jkmAIb!ga5e_<4|YOoy{MGgurpchKH~O&TCX zD59Da_`7864pYf#7O#Qg7 z6$5Ph&NCLx{?hT@SjAC(Hy^`X#$RAG4fpgBgK$l}6i)}zE2Gt%w$tonhpfnzd3zi< zW(pP4@_8zq0Nfy|{;?hF&=A8eRf>Fphw2mlF>x!knSJL>v?3%S%TT0<#w6$I63?xV zfheV%qAlY>K3>yDO31%E(%EliefBR^5xd$@U?MQ7$xaUYLM>GcaYl)FOQlW3QY9Gc^QU9Y;9 z5^&@v9%-9?3-T2#oRQSKdyUroT?w!#h3rJx?P>kCJkD&x!$^{iz#QNS`yK0}B*c*T zogfMMkM`z|`5{3E5#?>Bn`0aA{8nbA`=07D%aTZxEpLy_14DZYM(pRt_*G&a^L(CQ zz~QimW^GLuC9|2p>KvNB!2KXBd~aGBtG@DPSvR|N3yk*;$|@#q}VP-P#LgqXPkJYsvQ&=}| zR0~}m4P4o~4CasU{|=Kxy77yXp^>J#TF197^qg4Q2;RcX9pP6vBvMzO)B!uTRhQ+_ zIOn&ZZz)Fvc^6g!mm~RTFR4R0y$`Sfa2fV3NkS=-s1H19fX#oI-6fd&g{^N;nCNRyAYJDv;cm z7v2$n)Ocg0m+M@+NBNkmb6D9~Z(ROlDd2Xm4(vljbdOzm#(RztmHQlflh}0HQD|vm zT*bdgv&k)vRg^gWRoRB-qIJ&)-kByYVm~Qia=i)6rn}R3@_9$*h9=ngc4V>AWtt!; zfP(t((j57DKHupe?JLF6tP(TNl*UlpEpHqQosPwCVKUnspdN6czjVm;)qb~qH1)HE z&be8)m!Oby3##=`GjRvGaJdreUdsjvt#e7DG;B`;QDdAiA3jN`_|dZ#U(UL zoiu##xvA3YiWBsGgyF+%0~c*vZLE^UBJRiyy3QI_j_>V*(Jt1ukN9OyCskS9lglIu zoCWWwAno$7I`u;?MX%5hXX00OnBKq{+iy|J$9T=n2L>l6au=4Z#c`JT&(2W zrbN9;pK>%%X~H?~3%S(=Nv0;@;ok>s+`Z?fGiSNi$Mr+{wU4)zCk4In9QnVIF?I)> zO{RYB^+Bu#gX>Ec_OEw(TqaEqO1gO$1k=VB=6$YZ)e7Gf&3~{<^MCb*gyayA5uyRP z91+cf8>U)57sokw8-bGfI#@{A0}gwx)MQ z3^2<}O`T9Cwumr>b8rT7atrWHbg80ygqWOtYE22@r}nk#pK2Y4JyPs%T+aXHtjlJHFx#zVoNA%v+akC9|(Ny4N zCBgZY_nmL?C7MnNk~2zzQQ=0L#ft`W|IyQrxx{aicsynR^VI%}s&^z?#+5XYaDpxY z9rWOQfMP|)~Mg^Z*m1AP|kJ>_Sc*z1&<~1E3^= zxn{6s2Zl$2TS?gx?=Q=RffQv$p{ab*KLHKCvpam|N6C{X0%`Iw$<5zj9~2!H8BF$& zTjkl$*QZOhfM#_dp+JlbS@Tr_;3I$HR3|IIu3bmuR1#x{J}G?e)}tg z@Akh-O(R)jVwZqR$0n~)fHSTx600c(G-=LC?Le58;M$|9@8inUS<4xSrL~7CnhTr# zqNIHcrtw48So_NJWQ4;tc*Lx-+^ki%k?^IEeQ^>4bVk3OhRk$p?LM9uj^OxocLeNZZ@waH~Tv)ZzexF_NEUX%9vxr48W6bKd8>e5dB@Yo8NZ+O>2MPB$5> zhJQD0W+u)ZJoYur{oW|w9{2Z)@3xNop5F9@_@3YLazAhM z6+aG8^L%`7nesm8$4Eb}pUv~$F?l=|5zWQPe#)%!&XpBAxZzN{Es>c`+Li+c_DGa$iiX6vbMHlq z+oH9QNdM%6B)S9X-d&H5?6Y?dR}w!Nox0nrUHis{O|)J=8{!-sL0C<8`W!a&NufiY zDYNzWULy;>#(HHutb$rPixNV$)6sa}-T-Q1GB>$R%P(^=J1|nC`YBjsFp2PjT$Uc^ zkNQOKewc%ApI4s(*ZU~3eocy62;83^SG}ta(Er>Tyml^&qNEz;hq!hWY2JbVM%vhH z9kH(nx}4{ih#G;wdpchMz)hrePtI5)E#5#l%2(dot_;)E(z|5^-P8WNvzChU3lV_c zK(0e}-QjA!Y69@-wDIhbQ~g|uKBW_m+G++~9!Cj>E2CUJ5Iz!6|447W9nIHqCO$3i zkSTkzrk;kv%$DqaG0SQW`Fdcs{21rfVIV08nSuHzAHF?QD`b2q&rE3@sFjpydaHKb z>#-*2Q=Fe!qv5mt0}=N-%dMk$3#&0Dgr|j@zV%wq!5WKV7IHrBG%JnEWLZpVvuElT zyT-5l<|cP$GsQ9Cq6{=|+BH7z@ZV#nx$}E40__mYI*OM<)vf{|LVes$dkvao%qji3 z4tHOu!2C2BmSXNm@KV>lGh@QEpb$DLPhgM-{ERKxBulB>wkd%Lw<`7DKA7!n%8q9P z%Z3J7q)@(qO32J5{sHHIG#P9z1}mCPDJWBNPzUKHZJ8YN4McUW^*HMQ>@! zse~0^_E6T9f0r8eS4hARvRJ#+Uk6T0e8Rr#cI0ogXlsodCD{if4mq1qYV|_~+b{$< zaI`U%N|}o-7_UbY`y1J}Y=?*%N4|25xvU6q*>dsXCpqJI^Pk&nE%(dFS5-gi$>ec)r$aw3lan9^~c~ z(=nY1I(g2-dF&#aUa`*p(Z|lgxMsY~+y^#w*>6H~Gb(GqRlx=6Tj-A`&Mw=3`eXM7GXj)1ix&M%YtmkCu;>)mL`j@$19V zKaED~t;@+|jmt|uEx`JMk*&Ti)%Y+m!YUR?np>LiARg%z5}C>F*$c5}+4RTj?c46Z z$%BcBD6UQ~l$eiH63Ex7N#i~)U$6Vi`$@lEK_6E~q<)-pA8~P#G5AmmBz`T9&ZEZP zLj&TEb}OdvswVHg5R+L5`U?PoG5ABqcE87@2dm=W)=^$*$%}d@oOtO`m9q*0u@D>t z59EzJ*sbvsjD&3Mz3&WiCX=^RgOqz!gr9D~=S6Ad$Zz0p#woMo@~&-4R^;qHpMlr# zS@A(zFn*_!%XA+3BaBk!t!taft9&CA{iE+g@WtxvyljeWO(@v3yeu5e%;Hwd8`1 z2tWJC{QXtxD-<;=M;?9%D_1Zp2OWCD{ZV089lBD@s!3$02bP6W$|3is$w22yfm_NB zXZtskcz&R2!_15g)|z|_3{BJ6KW3*R<8SfhjPy@%QV2bh{`PqOxV~1@*MB?8Lq+v_ zqj|G7=sV`ecrUNi;6!H)+g?Qf03tS+e)>;kwX3|`(gx5A>W#hKS}i=MMV7*#7{;>@ zTD7|FiF7WhoLR7ZzRuBCK)Xou5}mU*md(UJM~V?>fKU_&I()z2Dq?l}YROzMLMO?n?T;O*|IT zTwUw;68TIs`pSKC`YNNg$K-wVT^}DcX1v!}GS0pw>tivs3eAh+iY0~ZaR30$J(SCU zzRM{-j=q1**5mZrGS!K{@%T_w8gW5)r9hiC(^Eqsxk^)`M0@z-o>*)&=;>}WQ~$do zm407G*?Lkh^P=L%QRG~WM@jtI+sh8K*$bbWVt-S32}6Z7m*N$2Pk2N&+kMGS>hX)i zs)y#^8O{Cn|DE}^iUqKw-1qr~91L3`P4)xt4yL(kc*fce&>ic<+Wcazu?KjmHy|fB z!r|)l2mG)V_|jFFca8Bd7MRZ8(f8EiVja(M#4V`E&szI992R8QX^- z?T04M9|={$YUD$W6o5#M5 z)>FO86CZWoUhyL(0+(m__V41-8L6-nXVQ-o^9>KTLL#M zO4y)}4X$Ez7F=%!a3AlepWTS;)HwGzjB4iF=d#6Ba&}?Gvk-h?gF4I?SUe zpk)35eQ(%tZnr3Bj&T~Q@tS6c=cDzv_4iDBu;vTao{W~lGnVpg#BlNgl4C9A5-}m3=o>iuue)n@wEdijxbt`0;kCWj`Kb^itp$i+=}m&Lr1Oz7+3$ zG|tc$193TJ2iPgFlKl`n@=RAAfZ}phv@tVZ+w6HZvmE%#d@| ztgq4!Y^lZl;2kJora<+wKUql%$a8Vz{KGM=7ywA%nb-!(#pi{c}cTsU$%1Il^K(P4+{%8KAs_>x{$7>k@%Q zRuiC;$we7~|2s4VYEBBlt(<`K6vpIc`5C?)HarH?uSg_3J4Q-AtwqV*OF)#elIgLw z)8xC#liFQ-u%@9F$G2<>w`JO@DB>f=FW=ieCO&z>{rEFkcuNj2Ec3Io08d$|UxIwv z@@$sdEgUI0Pg7q>2)MT99ZC&Ev~BQyl|<|^h58`* zSRNBRN9>XdZ%~lx+Nkg+m)0Iyyv-%_n#o|Hf2DC6JUovkP^z_Nj1Y}EtM|3DF$4g46O#fDUU z%`AX3M{7Q?_da^K&t%7aJE z=*dG({vXz#snBt2UcDwlQuzPF`j@qqAS=~!d;#6J4@wR7^H;TFJnB9UT;J#|dVYlz-nj9vZ%tSCD2>d(hTt3 zsvz^i?%Ly#J@N%`v-6lxS6v6IaQ8*aOIz5RpbJoh4v_qt6-I-i0^9?rb-NvY>EYDU z$vmKMchw6F;6(Uh#!yJiO@D#;2zGK7!Oy=1-Kup%H5pzL7T}nB8!Ju6dGFg(%{86iI zN`Fim0Exk%?)qVSEl2acjo)O1@W?ea!&>2ZygV);#i9jEns!up)BzQ)X!%s-=%}#@ zvM*dTqeE#Zmk&>r3hTK8og3>CHINC%xG$}xW)l7~spAS8gcFJB&pFx3@*-qnb}M|} zIZu%;ZJftT*U4i;=N3qy@{sI`L0_p0Ki=PlTrQBds7gF?x>5sU{L#?{;jjIQv~M~y zt#M4l#?%XWU}>=Z)F^62iFvtXp{d99V&_E_h(p%}y|k6h!QutO6H<_(|Jc)|IcU=g`f}I(k#A zyeHkCd>&I_^PMx~yNAdRa>>vsAnf3EEcFQnCe{p?7j&deXA-CS1CTE zF{>H$2&wIb7-oI5$QQiz3PV7A4u(H8mCn-+EVz_LT}V`tTuR-gN{^Jk zPi{WIrLZR{!%p68?0i)Ev~y(2LN6FJzc0mHsfvGj1UCiGSGmDz)Mw}P(M}EMd6*!j z4F~rgx)=)NBi&n)hjh%12ofc3A@60x-iN;oO!Do&gm8_|``gAr&Ce?9honpV7Q~T` zdj=!;xi;UT^D1l6Z)Vlv`QhVx1U`t$CZhSI*!{6;>0L5w@}oo0*Z%fm;kGek9?LLf zwuTfGet&K;+SQsrx2uyvQdE+#e@#~!cJsCHO1N3SA}8eSfGhgpUcKMasUrl>_+;oa z(F3Q_kuss~a~g^BaYT03y~S)akzq7eZNaZ_D$;6n;2`NVu`QFq#(L0UDj#Y2ABry{ zerjx-6llUxB!LEoJ`fJsVjSR39{!h|Va5ligvazHfJH>%YxE&_-##DZVQON^IHlgq zp<9tgBe<2mpWPi{-sY9n^#l+N$lK^!m}F(JmXbR3yxgWQ&lL-D8GR7Lon&82jsD)J-_ z>u-vQ&P8btpm-YHkUcAjuLW-prS?aiGP9+8kVPuWLk?HtJ~+_HaOn%kN64b=moR#_ zP|#IUBPT;ei$g&nsaoG`5T7#)aU-Zp$XZ!4iXpDUremnH6e4K)r3BXJC}In9{m-)T-tvC2|Nyh_=~>*$w< z#iYt)aAJm0pM*-MeEOaWf{=g@37}V|=H)*BORd;kC;OE&K|9+4+E`oOa!$iaIv)p* zE5#|dJ2(zSnDbDT^QQj#4a>k&=Jh6(AhXO2u^Si2k$>NLtbVK8#^bbOWiGO1Hth9X z&+@^h`(zV7-q|3;5{SoNQ52%onGBXnq&4SQtHIw3FNj>W!AR<1;0o2yMEKJo*cFn_{nG$ha|{a!?L!b0-1D^(ne4w9zR(4Kkz z^)jBp2>~=PT+>ZP4~wCu2^wGd&85}yIV^uol#WoLYg?&iXB zG>}oiwKE|r=Cr{wB~8r$(OTb*-_G$uu3EGW3eGQS039D)3+qzb7CXtk&e{xB*2Y@U zqsSL~v%KbQhQWdx8p4<+GUQ)W+iiOVZdxZ8z}W&-9#UYj<8WSL1aS3>Y_MKPTDG~g zO$x*pUzXlTWN%Xg`6Z5H*xr5U)ZNaiJ%P1D`te6&PMIzVb8z);+RDLciO#7pbjV_2 z8s%?wMo#Zo6-Ukr36k$cS|(qwWSQeWl^r?;5qrUhoy%%_Rhm|I&yMaFd|R z091N?3Oupen%0^wo2*~8O}R=_49~Z{w{z5%ddlvx_QB9u=e@IUT%2B1(WK6EhoRC} zMR3ly(b=qKW$rS>$O_4BEZ@z}ve>!h|G|Z-;e&KRYjB(>NqQ+lpIeK8&vuBvY&WGX1r9ZFo*@ zA4fK~YysPVM?%?O8UnRChbhA|dG`?_+8iNDtfHnBh-Fm?d7>v}SLaBaP zloU=U1KIz#!pQPL%4keZMs3`a<+d0p0>$?ACsOw?M^Tumye?Zo)DUd^?wd`iijM_I z$t~kCE)X9i3(>b_i=%himDtCDe8uLdcxkzz{NT}UOWtRr2?u^NG{Z7&G22 zly&mbD+mTSi-nw@_EleWVepHR`Sj`nj%%)c14Z z=_#tH=t^<;^JDKS&Nsd9^X>8}YEOS%$k)%?+vWa!xvr<9z2hl?^z*jcVw~@7nMraB z7)6R1K}70z1KMZoA#IIKV!`#KKVxAWLM%Lk@JQMv1fH01^$t56m(&D(EME!#&7MB6E0W=airCE$rGq0a z@|Wx{fB=RVIgreR4$EflAxWrjDgrV8ih#ux zOl)+f2~F7rm5*=k$m0gLY;!+E^TmC}aM7-Q?dc{hj2Lk@jnXqJ5mC280%O7N;piyFIxyWffG|%<1M745G#Gkaj z=|Pi!d<*S<{>;fD>C{l+o*Vc<7$T_+UZpP(&a!v4}0$78Fs!(Yu@0+x*5a#Xjm$8ZBv z`R|(FtRtl2j}HgzGbifPj#HSbV|!YGfwzf7G{fOSSWmc!RiO`y;q%9^+7RR7gfe0N zkkEL4nHaVnZ;%{1icBVpYcB2^K-p)XL?CFTramgUeO9xRdfoVdm?VKcsfvH-i1or>I{vg&!Y+JcDSf1OPIhxKWx;9W# zvsqytghB8z1g**1F^CzV!q3XK!13Fan_?TE!Dv|@3@a^Js0l44LfR^AAFSGlHK!C9 z?zUen?8Xl(&VpI}7kZQm&k>)_M>`EoY!%d~2A(IzYYr$q+d+x)|8RfphcDb;$10h@ z8IGHEQ?hS61l#&oj}G8cIhasQK@+8GTrczcw`dxAi+|5`?u zp|4J#rSSuphk=nOCnopn3;OSgI~x66aP?IbcL&zb>S^sJ!GX#C9TxOGO6*Nl-e+ggLs%K3Y?l&PS#n-ptX5v_*` zPw%&2V(_MH`D$X}3qdMnAM}6|08<{fcpsr&ZmbzSZeS)M*b~(s0j8Xco;qfx%fA(L zl}-acR5|fft15415?*O$Oues3ONZ2%Q`Hu+P8`Z34*4?$(o%zo_WXu8JI3HpIK?hJh73E-S^jqk)1%hm;&v+ql&4jKT@j8E!P>PW;vZ^PpALL$~IY73VN$; zpyJ|K2eHof`&sSMcMxwoWAV%v!L3!LZYBuc(Zqx6-0Y9Z892Q zzR%^1DyXx1$|BcdrSaLuDl$X`E;0`-VI}oM@RBEkAp~DeCUEWWd}qoiH9*y~DnW=k z?nuXBHtzV!r`d1`a|8+H(RF!bOY-ybR1sQ}#OPkpHCsK=`uS zSjCv_jMy3?uf_Hlvc1U|?N4wvFrf`1H2_ZRs|Q9P!OO%q2ZWR`Uk45aUX{&arLVg45$O1TC0Lv0DLMwPkhXC^wKQK0rOxC z@*zC_g0Wz2uH+OiU0?h)G^8{U%opK)m|;AZa#Q_%DX9Q@WXnZtfT;Cs>^8q7G6Y>^`Bav}m^gA_Z!ZRz!`BD_F_dfVVmg%o&e#To>w7&V}T2_EY>tPLyQ?Jr)4TZ6M-7K3}hHa|+60QmuX z);0jH`}`E~ty?34oR04gy?W)$4S^Y6^gLjD~VrC>J60LFrO5&y=u5|h7hd5v@_XZ_@je=D*<(M%uEQlrU!_A^5Ue6sv zW6e~W*CK^KdbB7fGO9987yq8>fyDJ>-m=J|M|h6!(JSrToIlyHYEc=nkoKk$t01hk zGGj9cq;y6jNl&<2#Hn4YU)57snuPAf)))++vmPUKW5?ndx7Ji$y45GCn}Yrsx$qbv zE(bT2JMGFU>p1~cRRL31Qp1ec3Tnv-4aUL9wmUMay6BsBL4ATg^RLyZE&>R==2mq)V8kx_F*DL6!5m z26iYx8K$}x+2ZWW2l%OLv*Z6^);I-vNsv+AD7T{tM|yLz6ppS%M%~ljv%GoTVX?PC z0+9^Vw9w%!6)@BPi#?C`m26S$r_6Iw0kmGwOvF@Qx7ah6llo0uHa1)hw8^W74^W5MUaN|o%a1M0XMh$yW~bK))8>0z zPGMv)zd4-_j8_MRzkE1~n~XJ^F-Fej6{1UzPM=H(X9d`JplEQj*d%lVj?;s}VLS;e zexd4!{3QM_BVg$j)|Xj<&T!LqsgR4=`YLHhEJ(lKn?G^_(2aHASoKs97Tf)ir!X~>ImL99E!#dh=OT-%dIsYFb1Buao7<-@KJ)7u&k8zsUuwMj!J~GkIdd>ET(1953|*Ph%8AYP`P>mcH{z*QQHy~sI?LFrfO}2 zY`CcZ3=8Y*;9O9MVnCLud<_L@1m$1{ahzV5K?XP4lkw~hR_$dMc?`^pQ@ z`!xQE!|ndb_v_^F|H}&)S(OM0y+YxeVKAq_Kw6ICKkH`M zNoW3rN0MVjEvs$;s=h)?Zsi#9xiid9XnO!9tIy6QY_+$u9=stj4Ne*s)1~G<_%8OM ztG;OpbMW{@w8}2_xh@7v@?t6-6LDi*`fK?5iQ>y!hBA+{n3t*E%Vc8Qsw3hGu>r=V z0}m0f^f=V9IbaXW^sqlLmlh}5@E-;0cVDiP22J~MU0jcg>Z;)XhqAj2iiFz|bd9@v z;qLAZ1r!d2yG!EkP-x-q?(XjH?(R}JBv!Z&-#IfqJsmwU_htlX&<8fE#(?`UW92_@QVyy6yn-c(i7P;oc7L%VfB?*&CydR`{}S}XZ_TmUl^rv@@}+FI_AImBIcO6L{+ew zCKK-wTt7c4inv#_{UUB7M+W)rV|Rc81EVaz4(kU5G)4ZDpqwaArch^e+q#VJN;0NP zH&6SJ3!2r>MwL6)E=EKpO?Mp6zpo^OrZ=V|uQnj>05wPbJM2RQpZ47uD7(xFwe~qj znx9&AJ+0RfHA{=jlY%rGG;y=#Rue)JQmMNDt%>~%KEt9T8Am4iz`eX8R^`HsudM^^ z^;INb9B`$91FS*}PdQOG^1Q!RN>Rf6crx8)Mza>|cvtMvsa{?a0j0-fplI-#+|F|i=mgU;$R3k>IG^U{f(*3UD~Z4Tf> zqRa=kc?$!@Bjaj@mUK}DQwI$!P_bbe!0({Q-D?u=hwXGFo2}IXXA3WoHo?2;`Wwjm zMkh@05$j&fM(v%fm-s;;*ki&_C!}RD39I@(zX~`H71-#5gm1Nfiqp$)K7&>Scr`uq zMWMV$B+!p2%3&_hQ1&kkB2aacAc`>t>nN+2M?`*RI-74ra!a#mzEaq8T&2ZCO4r6H zrvlSWVS`{2S~@Pa{>c*jJ{s?=Wmk6<6;`$Va6-4VaS#-O=PWI1$swW4s@aHa65n*H zzMS79>gMe@>0TFb*3Z&Kc|8X?H0yF<1!PBNndomhNe~Bo{pDp+W<`g0uQYIA_w)=A z+H@GZo&=elWVuq+$=3ZoKnG@Nv9d~1Nc$x*PBK#oy@){BGncf~b5Dh+VttS!cZ4^b1_fBD zSu7#)81fiEbj{yBrP)30&Mr~oNY%wN?l z4JrurOk!rXYag|iA5R+SI4ur^W#X+|ZdhBbJ_F_3XQ?t^c-^%oWk>%i5fn21QzA&@ zfQ<6!oRt?KImTAEW1N=%`q4*u#3Y2fKzBq>jJ|sO+0w?@?Amy>KU(iZt0hKE4Iu;B zhN0tCI?`I2hN-j)Bokd*U$JW=%rgihV)b>^KPy^OLlS>u6$;dgkgV4_w(o%=n83Ts zYofMxZ}DK)R2SpfD+V>dhM(e1!m*%a!-r0&k7wL9slT)au zkn@zTb%ea{)|xEl(7!pIn{t*cVKC`s=rIGMa`mNOb+MVX?6Huzdzj*SJx9o1{jSTC zU>Y_wblgqqtSvR@6!m_`61Cr)(9X6plz-WUGv>9 z49nwtn@HOO?ysYfzhBcdr_U7;QfXJeby?!n<0IU0uhB9KzrHmpIyGw5hMeq8rWJQ8 z^u7J7K~N1%iqFjR8Oh-?;%p7@_H9?e_wVFWMsnDcRp67Z5d~>=3uoFz&j^)35lk_o z`eB{J${&l=kq>EAs-f$Muzx98q*$I&v^|Om{J3I}SdMb+n z@4-*_+Z%XNBd#_RVf>e%!8;aYPW@IkA*AijT%UQkQ8kz>dX^-)pG|ZKX4sv;&D;UX zv{$?4Rqx=1fv3kw(7jJ^wJu>1_dcmhlv**Oe)msx6~0gc;L(7W9^1_}W+f6!%H*+` z@4>aqFwl>A zE)QRwMzqsNA;(~yDM%4uKAa3TEFo4K!mW6M_sITXvH+gT?s{{KO;9RlrWjchHUQc{ zS&pUbZr9BJamy@dCfCfp{kbv=c6@U$coDI6kFzMyBC*Na`2dm`)jz)Q6j)uR0C4zY z#*0ycRCWFki+@@f?nz6;&;!iH#DH(Z*5D~ko1l+HnkK$2gO9r?HGAD~x1a9v-uD_M-)TbmSJf2bUUDn3}*%Ba1sT9X7&6b#0K@Z5h z$|hxZfxjF-$|TYb*~1D5)8jqe5wEysN_m`c#?|pCZCAOJX^Uu2=P%!!U3c_=EyjG+ zy5C%ykQ`{Ttg0cc>ruLq%=>N@x7P}`WP9bz-594sv_$>O&9UNQAJzTK-eGe-)uF$A6Ugkj!IvBvds%HjlNnKVZm>Qu_c20aSZk*K z-Sb3Mkoo!Q?`C)dW8cp;h9Bz!n81t^e)0pD3w8EUrWrTE{Q70&dO|JQ!}8m8rN-#@ zja-DSpHCQiqEEeOfaUrc#_x<01ddyC7d+{T3*KT&s zf!dg}s~PfvCC0=Po@V;>ZDRld?V}&>b+YiWn{;fB18Zp{OY?7CpH8}*)tY4}Yem$P zo>HiPMphkh$O2+1DXK_Ky%6cf5C2IU%YSX-JodU)Qm_=2TAG_3LVcZ$N;%AHt4 z@nJu6sYi#j{$+V{%?@lGhXgKxfswYQfz?WN1c>8c!|nW4SL{DbXh5ZTA|PXfd@8q@ zI!UJ~urRs%G`qUUz-y}#*sBSccS$M?JeUOTPfbk&65=VMYL>I>TnoRck55PS*(!)F zLYzQp;U2yCJeJra`H9~afyO3^y9NrOAuoC3)<7S>Q%wSTW73Wb#0<@7vF;IsBH1`l z5gMFw=@X-nYa{^1#V$hAW7V+-W&7!CFW<8VP_@PiUt0Sp&4VDY{ToxMtUvgLu?`aL zEJ*nsS9H-abn}hZ%(0{WG4g1|(NtrFfjSgjvBo8HB#A)EB2< zqfFbtXqVfDJjpSS20A-3cgb=&0Xe}YxblspQIV`T3+`>y)QhT)I7w3gtll79qF=ccyEPtA#-gaCs+k&Ai0Twi2ZKG`310$2H%rMIj0@R$`=aTbjVq;Kac!B%_e2R(F#p_I- zUUR$|w(->2a!a9?sB`=oM_P(LQYtf)?d0qFvVL){S4nT#>pD+r3AZb8Yl_;WKX|f; zNpFv@RycV3c?pO!>}AdTcxH+%okQ{Q730fP=vyvs0+jnHlQ-am?pyXdr$8ol4gpe4 z5UZpYX?LNWLmOCWG9NF|NtL)4Y%vUV*CNryFI84ZVz6}b-1U7f-BTE=uiQV;dYcc6 z8WCwV87Vavk9#(o`$;DxNWV_?29vRk(pc7KP$I(^1jyNbQ$yHMLIaF8jIMZjyeIBE z>JR61&eSB(rOJ2~ILQM1S&vnMbY#z+;k_QC4sQ3Xd#F;dy&8NW*nRo1P-;6uVCD`g z2>?c6FU_WF#IDN6YVFU%n?+%$(sa6~YTqQRe$hEMC5<(dwhQC!GREXm_Pe1efhBJ^ z8WeUBj$!6f7TD0(L97-=j5F$kdy?dR^$q&e!696y#q`OmbL&tIf9DqSUUvfE^ESYB z6L$Mop%Rry44{2Y8agsPi7CWfq zUGrf;z23nsjl?1fc=4gHaQKKg(2Pfp--OLc|&b!x|^bmzPl7;f5PUl znywnCZG6ZcRtJeoa{{?tjTKiV7-^r8q{!l;Dk~NG?g>Fxhy|;bZk=|FX8b#?3Bs18 z2GfFLx$a!)H}7+e%8Jqx9^nsE3Y$&xv&fo1kn3t2ng6uL)8CHgV!m4A?r$jt1w?vC zpDQ~)zIXdDANy`2zC0g8@B5DtQ2nOkA5YOan}j@T_f&CfO*gX15OrUp#BlXACFfir*xcg6F* zNNlo}J=@Hp+72qq2yY*nOU@@gl4a+(aVHG}F?u_aG`80oW6m*CpKDEL>!B|XD7Aa<1-5|BvF>UrS zl43%ep%pdV%Nchrh{;gK{Bz znul~$^8(sKaTvoWk5a5$2QIx%-MGUs&2;QdabLRXc-x^8thKo)+e=S2DZ|!sO>Dy6c^C={yQGe9MMjYsQqNgkjkPb7 zoZLsi;u}%M`g;%1Rv=-Ub{9 z!nB;EXrILLm`M>f!R2a47Z}C6jTImVZ3Eg9wCO>QP=_ zzpI<+emrF-E5+5&YHr4}LBWM}yppL4Zg9DK2{1mwGdv@>JZ1RvR*u}zJU4+6OrOXx zCSN7S;UY11Mgncl3m)v0J%kn=SE)G<=5hxQ9JcBq#cTjkK)hdN1%sBb!PZY(lB`!f zylg9mp3m;pqwvKM*pL}N^;c~L+D_A@`kE?lrFjUmV@1@G7;34h4icwIvQ?5-jzN!i zZ~fP&iYCF=;i8j0RA-_&YiTp_&n&B(`1Geng=>c-z<@*2uZQq9?E%DO7;{K{*TGkhJWVmhPsWM#EsH z^ESR}LHdy!H{qFMpK@1ymP2bk#MmvP23m9dT#a?&g8*WL1`NyCHSWF%iGSC39&z1_$1)kX%aOo)M9K7Lq-+$zY1EOOQC;8G@IF&K}x2 zjYw^Gss$~Kv!WtoP$>rf$pX*r%EYzT$e!1)T+P^_#fu_)nP=8LfF=~gx1pNRfYXV` zju!WZHe|K7!&A5x`PDwc27a)KWynr$T+f-UB~^DURmUM`wLP-iJXkNWas)WucMz_$ z73<#;For4l%Jg}Cm;$R8(?qTJPOS^uJnBNN*HJuQR6Na4)Ia3yYNdP_ue3u5RZKSq z9{AV&u&RAfQOOz*fzS@d_(lD zW0ZDcJj5X#%MkaZ)7$bv2h{$xp z`P7E?D$?Rijxhvixw4votbi#ssjkR_txS=&2O_4Zmg--@q0R|juAVh)KxH$3UuxX9 z8Y@lh8CC8~YMan$mKT}|MaT-9+F{IvJ*=g81%Frrn*QvFvLC&?6I3JC(pRn4mW9<6 zJhi^z>ib9Nqu7qYk5KcHZ@_Yn^Ak6z{P)hpX(MivoYr|d@^>^!5nZ4%LYK0WQ;ct9 zF_deJ%#)frepg3;&;@Da`WbF&)A_tdHspNwgBXMo5vSsfk%L1rRr<3%>@DkaIIUWI zi^?osqbk0xuFw6$D!r?c$5BKBN3@%7&Yr~f1=G2+1#m6pAzPwnFPL6P5l6&7C~ zF^syQ6hlKuho(nIj%_idP^0Ktl*4d0C$M8S|L)aVI-`ewGcb~c9B&ph7@$=K;Ht13T|ury`WY6=s?S?7@SI~m!0UsgpNpsO2C3G!J7p6HxvwxW9!0rA zIWiST7)cMw?G$-Y;@!S8b^C=?Xs%(jzI!(%GC?)d3c|gFDip%;#>m;U(td3Zzu%=_ zqvFN=W(p7@c!IM$TIkY>A7t(J!IT<0t-jv6m{j%P(%#jOC zEHH06?%RX?Oax`ZAo8!3Ktcj@sJACQ)lm$Xo5ps9Zy;r12BjH&a$aVokb-hxtS+A> zw=@~w>g>#Ih~B9f1K9}ZjniCj-j-EpD7G4pEC~&r`o3;4eG07Ms8B=$(bY{6mnX-Q0r)K6AEgd;4fV7o0=0dL8Fn zHA?2)wQBzNs;F&kG3HTgaQ=fp&!=|JJ1a;Ut2q<2RVz1^2^~QO+m7~^)0I-=aa4Lh zn}Zmm^>!Q&778JjUaQ7hEWA}LSHLUWnvXaZb?|vglM8{4IFHetxihHN`cF4FRawoG z8W`TzHs>0{z*~=@IX6Vtov5ZD(ha&$JZ+)LX&m{D625!)tu)AQ5Ip<)7agAF z8vD`&_%%HdL1dO*Rc4ud#MyP%HR8i?KSHs!q0& z*uYs&i;WFM@qK-_c`IA_mO#EHewQ^p=skcH2!AL7S+LhEMG#s>fhX|r`t*zc$fV(^ zLz{nG?K@oE02%>Hd6LJM@SQ(X^6>m6eCz)sd|&HyXd!v=b-3X{WO5KmXu==>z%cht zj>#ZlI3p1Q?79R^;H}pZuFlfZpkF(2+M}vR)FBL27+_ut(?GbgMOn<*4WuNGqfbb9 z*=VB`$vMx-EwK97EzAbUZD?)}?qbLt<~iPF4oeiv3Gdhv{8XL2V8x7?i`>^!9O&J+@~Ue>dH=Q;fO;*d zu8eue*pt<=IBnKyKffKyhAN}VXxIylJFFr=Nl1C2oj1)~ttao7an;V{x~?x?r-8TT zc)yJIp9aA4_wma8=!xiXWcNRDQY%Zk`D zr>kXuO!}5tv)_*_9rD;QAw^*9A|u0Ip`IhhTpU2Gy1k-izy^&dY%JpKo3xoEl6+EO~)7X#^K;%65_Ar=&04pRT5E9i!o2 zN_DD8%DmO{i_$#HQl%3OCSXJjBz;S7RiZhRdN;o2N5EI^h$HTgyNi)$vC00jUPsvq zENQV@Fx(|xwY_hb-7>v`O7Y2QY1C4bGe!kT>GGhtQ)bUCv;D((zi2JZ?XoXYIj@rG zoj@551kdlox#PbZS~wKwoX=nPlNZNcCjk{$GKxt)O?8$kS<2- z`K4d>-^HwcF6kr#=43~#3*!LiXEejDTwUtNn5ya6AjQ9mOtVtAJ^#Khjc3TD4N&dq z$FWu0?vs=fV)hz3eb*~t@NjTnW$@gSwh1>EZorf}uHS6KBJ5KCqM|v!sOW8&;*0~n zh~zDIoWSD{5w~rmwY86d`KDXVB*AzCyb)K(i%52l8VOcRMuP z%^!y23ww|Jmgqv2bX4F{x~f52%(_KZFpk#A^oX#8577*6xhggys7^b7IWZCcq=Dr5 z9A9eY`;bL%GJf;R7}3ir98r<|TwDCN%pCS_nVBpR@(q(m1KI1wt(1qw_)^+0D1H)2 zL;{p+NDe`?q@(9!!1)+sXK?)OAPd791UfA>!TR&|HQj1?B0IjCq`}PCB8ZMLX!gnU z&T#YjK?GOb5lE|eQQ$_jt#9ITIq(`0a-~r$+%|%1i>%ahv1i#*6lCTwcW!b{7A z3BsbT$)cthgY^?2SM=Oj|8IghwP9U!lt+|{#~6l3quVvemcQvb$R}(Fb>NT1q1Az% zN$@9v>k(?{gifo_eL`13XTGtX1L9Crj6_zTBIH6Xo9HN(s8R%vXx-5^=w)53)A&76 z&oaIf(0ljm4P{je4B*Yz2;APSTOofKY>|xWaLUIZ(z>^1T{HceT};J%m8`vJ;W=~U=fNa? zuKjuez#{a0g#>jx{?V1YaJXk}ZUv9b)qnMSzOB=g*i%BT)XPh_!PKAZtbgIkTBGIl z)U}QQ;Ld|yZpXN)!@+W8a~DM4)9NfI;4|;AuV#KuZ)e8<4twMd-xVed3sz$vi?6AK z{Y_QrE=Lr@K<}&rMqhF@q)J@~G%}nRiU?!V*JY1k)BWaj1rTfB3u`0Pn zOegqqAKK;`6L;^1$7O$i(aK*(ApHM{R?gq#-;f!q-d(F^558g&1r0p>cwH=PVg`|d z_GwlSQWt%DvDa(9{p8t7jWKi8auoKV+*gi=NbgcQ(9HGBeU?qgYfgkYiq}p_t_e47 z;H}&yK+j(vhwNVdP7(xCsU+2%!RAn8;n0y1?>p1-wBD?~nr6L|(quNL%(_vk`0s8<4+d52^BbJ zByGE96xv}Y?{SgYWTvvi2D% zl^zShB28o@KdNz}|2K6y1@l8V-2w-QqTZ>4$&98|a0$$-)}Fk@Ae?F7-^&z-*mo^_ zG`49Jl3F>EdUHptBuXveK_+P`R~eSARnq_vfd#YTL^;azxff1WaKsNpPe;t`PAqf?=a65@hKzEiUC%R5OoxqP`m#K4`Z~1{F>iK$GBapO%2zuQlst(ku7VM#k&SW*Aoj_nA=@58)ky zcLgRe*brfk)%>3XJkQ#(~2-@yIV@K4Ppuhi$0 zqk#W3QAcqMlQ0X66b|XMGxcoXDjEfvsU+4d!JAn-H4}3`Io}sXosU+KjR^nYj04n? z{twQ0UF_v{pcU| z1kBRdcsR`(eIRHK6~oXYY?lSX_Bb>-ZVts7sfKbByFDBl63I7KKex`k^D&n6d##3? zC{;>j+j&8-!YC&%AXFjgK$MU>s^TRz>J3NR+C}|`XRI}z@83@QAD;0Vsw)0#TNU@W zY4>mqkL8a71%5R=Onv;QSp?9aIiLh z%3Db<<_%Q@a_w12f>6Uf5>CLH^CUDL194x{KmW15(o{Dd9}zZVD_j8igJ!g5r+prx>`27W z#?>X^=WBa*UVi6pAumTffo~si%!;FEEt=BmRGn(LgW1ca7}4%WFB`lN%AJ0*Jx^Gp z25USZ=c~dX8`p)w^ zYa*l1Tw3ocUYyIA!VYjsIe(R>S5gIj28JFR+HeqU;Q;R`)q^@LM>xu3NO{xee@`-l zgSia?j|yII62emBM-k|Kh9fq|Vewlw2KakKe9i+N+sQS4To5~gyd>b(x85#FcK)0q ze9Q9GP4h2evr4XVK)e~9uWYWG+o7ARL~Q6KrZ0+aBQ!DNjV~+4bT2@ICK7uWl0Y3n z^}EKB-neaw4zy||o~b8wkoV4o?GCIT;Hu?w-!;nt6ry9i;dvrSd!Sbfjp2CTnQzIj z(9X;3P@M#a-&Dw+C;5EfD68OhvqJ= z^T))i%8FVB|6BTHO>h%0_)v^R9&g9-K=v&h$)Xnz3byqh<#|-Dh12-!Lbm7^8KcX; z1(2tt62s~1`kS=V=c>%c)^{Ww05&N-+m zrDt#4WkLO}F?nhVqn`1_$_f)x)iz*dz6q|9^iX8>8`Cd=KU&)kL#B3|b?4C5Z8G}8 zSl%opn1^hRg*aqB#{2r!FF~4(5X+IP7&h1%OGcxx+Jj}L6D%zaa&Ik}?l$T%?^xQe z$5Yw`luC_7OKH@mC?*b$9(f{B8vz~r*q$Z1@qdPwmFsmjv(yIN4*O5WO-1SGRqgn8 zu zh#)dRf<3@OT5`bxWte3$mVzSK3FFR(%{fIB?p8k|-HP*r4{@b@6Ku0c^LCnEkJG1) zmc)NiTW_83zV_M@JW);MmE_~kk6U+4#FW(0o__NASF)fPeRs>AgEBk5Aj$Q&`0KrYGlMxD>|1}#dqr_hS9XFT(!H{#@i=NCbA|L(jNBmTO0-Lbbd z9tLr`&ZCmoVA*2f>r>Zac@JTEmzR9!Yw0S;x}Ogrzmpd^1QT9HEkym|ev3NVhT&QF z%aLPXHxmWYGLs5X)77t69`I6#ej1nb!P8@-=co5?&flgZW|^B%##dk# zul1O{Zz8^l=P0Sv98<&w6?_j8a1}Ia_HFwWr$YK;F8oLBiKW=K|DbZ)>bFJ|m~T@j zD3u1%bDk{3`{H=dv%}aMCn_j602OxOPCyWb^om@bu`8SOa8svg|Hxg2?mD8it*H1{ zM7%SW&anU*In<3mV4?^ZmYtSn?y!J9Q`<1CmxqbQ-0eO{b1z zaF4+-J40EqX56G*SqN9X0}->~cYetTCJYWf+%f&>w*NomZ$03yeae8T-EiFMaLipL zh-CDi{Xew3Eio=IE?2kleJG=bVlLSVP6X5|`hmB~KqEPJ`#cK9geHwjbx?cMq(N0M zZ7J((o@!Pt9NSy9WDB1r3jXqkLrzUlbUlpK)>zN@XJ4p)o4+M@w*NAJk^W`=!sOs} zOaI&aO+LMm9vg9blgwP_^9$80|(Ab{~>=x|0ntD z-v34ZQt^)8!GMM_5=pdxw3#-^GnI!i?21aS-;;INA{dwvWTVi6KC;!C3l9!gGb z7O!F+=`_^=C)%nvmV1NC0kV4Rg`5%woj*v7msSeg{8ZUd=m0xRheY&xU7?F=qHfyJ zs@0j_4s}XL`|sQv>6pfnH$ zZ}7iLi}PNZww8=qj?B5n^Isd&;gLZGK#(g6(pvH4XwzK+-Cf>xC2Fox15n^IDq=g! z>{1OlmUbEHzvj!aG%x8PDia2^w!5#WmVQacj6nyzKk|Q&sxQ_Zq3l-dY*xfGeC&d7sBA;D6X^>VDto~4WV_Y zNkJSQt<8@fnjQx~0~>agDLBoPu-8>b)uJ+66|S*15TbFysxzMpqCc*K!ZTktMEaD) zx2~Q_2y3h?!PY7GqS=;jW-S*a$U&9Y*>)_8*uMDMYtug%7JM=n4k@W}J2}!J+w7C6 zOo+ndO^dKYclhp1LTnTqnV9ug>sNVT<1e#kMtUxv-LL*~rO1bNr9C=`@HU;jJ+eYr z^6YDEbV9EOpZ_+dpBx!z$d<*TH^X5Z67-lX?G=R9>Jw0>$2!I4q=m_us%vM?yvU1s zcf%@3{z<;@rh1)FIl|KQwW{A(QE#+}@Z4s2AAn<66Lk&APcbwhW^34-(9~62YT5RW z_&X!??Y|d)NB_6@`}dMwcWw$Mgg9f_dyCl79TxPCQKldw{Q}Ms#P(|q_gDcFYh*fZ zXmp5iTcWdHujSB|$6AUS(ePZhaR}%)>XzzII%un$UOx)OhZH}#8(NHV1K~Jj=Y+4xz!93$}QL8N*I4-EVQfVg51%(h5cAw+^LOkISwaVx$0^ZJ$Pc z)2s-h2Yt;-gF4m797Qm&xiH}^xal;n+f3?85-`V@-rvZ! zQ`?%oXZ!jXwDA$txTpGpLNWS~Gn}4XTf#x(OR0Ki36Z8rXHB6!eZzhX%W<)izvZ2wsF}+RdS^SG4R2fa@HJ1R;;poSA5xSN2%uDiK?F3APaR3k7fj zx;UgBw7Fkb!jgOVN(JPfA9s3WYH+(Rq@nWQIn5=jUPpjbE(3il>>ia=WsR#D z3yY-%D8gsbrIq_k3d(<6J-APv#_V`tz6Rp)U0mMAxLpauyjfM`IWzV}f$!47urcbl zM$}KKn&oI1Hsl_uIt_3EDg5w{aTVpMM{$1|Yi^vd{<}~Za*Fyz% ze=NW%e+{c{#4qI#cFC`_mfi z-`;QE|J(Z=`G0%AAODT_%QV%F@gLrA2r{03;*(d^>3f892r%V8=8$SOitO3DBb!!nYL1ikzJ-2 z&nezasp=mmVAB4V_q!85WG8Pm^(xFUmOjs1={}VVQU^s7*)w zK(sPAC;4)D$dvPIFi+^nnKEnO*MISTkN;2aS0KZ#Qz|)-wI(C_2VgFucOe+Ed6dFA%QkQAuqX2Y}E3?=OVbDy`F3&RSqnc(ajE zVoSl-W@5EKp<>UInu^kDsJiIVy1rd2VQy_O5sUBTuc8oYvXs!zy^d~0tDj01_&(x) zZ`#FoBqOxI9_1sMX+s*19q!(smEq1sE?v!X zqF|nOV()?}YOIjRqQEon?9`4ZD7R5=1l*@pw#SW;Y|z;E4UuFUFIib4Rtv&_~gx-hYiR zK}CJ4!z$-N-dmd`!*E<5&lRCdwZBvQXEzpUivFtF_-)ogfAF&)-I;^@%Y&u>!s zPH?05k$#b3MqKudfQ?_LTFXVdoJV+Cm+Imk&1W&IsRHHX=MjL#fo)eS5fj&TDTH`S zcjL46r`xx^PJpO>DF(5M>6SEThIa%*&)qPKne;$Q#gOBqI-QIS`T1nBMo39Hmd3-9 zj>fXece~n9bDJ%w+w`5A@U6SGKgBwm5H865mT*|r`BsR&Rv$~0jJD(m$NO7uDfV z+7K)=2x{3LS2TmS&xi1hzw>9*8nTjj33B_*{b+oi;r|P<^b0zBLN(7Fcc814x2yfc zUi+V2JFEVisi=bOX%0iTizBv{K90Im)*$~Y2|b2lXP^0#({KLbxO!@CQBOr_FxF>Cf<8TMa5`517x=6FU%+3U28o0IIFJ@Wog;$sI=n6p zE5CKn1uv3FQepUJj1yksfUSKuvX*qO&!3#u-{3;je0{e3qqU&Kfkmg2%nZF-)2=ih zPQ1SLl;WAUUpsej$G|N?pz#*Z&&zmiU#^v_PJ(DP6cTS=y)X4&ieQ;P5W6G9(*6r;kQJD*Pj6WfR0 zn?QeSyvc%>C08t-zhpnZU-zXd@A^H6?d!3@pLlq;yWin+Jd5R1>Z+mqjnsWYtWTey zP!siR&bQd8P4~;XgExGx1Td}BetImVh8$t7KegCXG%vZnB25m1OxED)B^7ebknpmQ zF7@1APA$cU+xTcYoCQv2OoczxE1RinN2gj>GQJ1{>T+v!s1}A~;TC_?NFZDEpMGP0 zmeqr2bIe3kx%QOk&g%KoFk}9fTg8XaSX|J3_Xx%IbeWjWjem+evjnkvEsd) z)s&!XZ$47TK$cZApd`6(Z)J!h(t1=aN`(Xo4;Z|kjbdyL&?G2$OSX!?SFy4O4|`%|49B< z@YneN2L58DtNjc7?fUin*R&DrVZ!(G(O05yG9L3+voyrfm2bBv2dS@s$18(D`wSW6 zOCAi;0}Q1Qc_q}rr=Is?^^nE+2glh#M%yWVTm!MsS@wC^5?bVu1t>8`UIHwz{o{jC z!KK!0CrNUbOF85x;6W3z&tMY)5t!Y)E8Y_c;ovw6?fat_1*-5*OQb9YaRTBm-RbnQ z)RAGMR%5C+=hSJTY;<~1@p2~^ojNbkd;K6g-GsCU<07O4&q$$kX&1J%n-#nZt{c&%@F*){Z8(e$@f2XAQ0WLt z)Ihsa4O~8oTG55;ntKzHNy8S~Pv!mff%2}&M(t_FZm5}!sF=!ShdDfzGm*>h(F?bAl>r(>HPCmq`z+qP||W81cE z+vwO>LC1E|v7PMn+%wN}&%CpD)tg#X`MhfR`k%-7L$qZ{$xH6**9y>TDl}~fZ*eik z;ZRlM+X$TkVkIOLR**fL%oIyPOqau_v0Cl1H1fA}B=$NLpP$7o$b^2|S5ernJc~^UWM-5Vvt9kF5D<1Hou0GL~Y8BBY z+5WkD=6yNLQ%iOOSfK^*<*Ec+7Y3ZB__ro9gMQ72ss|a~ga&5=lTAC}gC>!WYWVA|_mEn}IatZx_vR>1G^exXMo*@0)fgknDuZBG$idT%KBw zwGM0^7t3a1tThw(IS?{gONm`!8a^`GBe-vpun>>4)-}fGR9|BqG0FNvaM|2~juW_I zxp|AXY&LFo<-k9*(|EM@np3MoG(Fk#FYk9ES+#+F-y1GC*bjp-8x9T-9BeAsKSap$ zGmj9FWev`R?Atix#(kk8EAj$lzfxrlj&-!UQdU{t3I!rCX>9|3v`9z@lrlwf29r0d zJL4;{ets;8jq}`vhB=~t3sP%)a7G%H8b&H}Er4CqqM~9vNT+jIoxplfPPd_#wvG-t zf$T5tSIKk8`WUUB=uZi^9aCViv4?B%vJp9H)P?ElA1rqWb06k?o40SWx1L{SN$S|- zYBahCaH7Q2UrGk<^5U1E2X(_D)8xr`gzmQ3n*4f6h2pXoz0jpUf3mXBXE}P&I`$X$ z+fiA-Pv2%mWwP$&LFIYIvOr*C=`$t*!2aZZPm3DKR+MG0N*d;M?Slm7;C1dG$f}#! z|7_%Bc>)yR`+SUFKGJ>WZk;&qHQjITN5e?3!xzyX_OB5y!xu3zF`pF8!P(+s%AwEh zaQ7=g`ZCS?NlF3!($gmL=St3x{fLQZ@2|}wQ-m1qJ=e%eUUf_S{eoIU+y?$*GXVl`;K(94tjuhZ9tvT!= zHHU5H5Rk`qemQ;OccpJ zwiGK%xi{kPl8qW<75Fo`g_^LMK-@_uFN1zMWWLc{(Y|2PrtY2WUb)01-9tRF@|Jmy zo8-XB`oK^~Mr;zA=P=k(FbU}qmo2m(UQ(qVwSp8~R~*ze$Ir%$4rXy*Xe{}RZ&5BN z34Uw%OaABSh6=KH76{IV({#r4Sh!*)xO)4nJjY@4-n8H);=TEl<ridR6S+XqPj=`Z8WX`a>{svLi7>Kkf43xm-v5r zwjD!9XV0C<>G^- zvwQQBjJx>^2Ewzee$yWzbWDHeepyASQK>F8t5N8@k#4`##wTaK-T#JOls9_<>Lk}T zkxBGTC<-2c*vxzYPW}i1I9oQi;x8@+tSvpkkEm+G+xOp4D2zmXj@&B( z_&r=S3YpR{z!dGW0UEv#( z(#dp*8@GMaT$i=%)ULD701eJ+0F??{pJlaF^Kj(B4=ReDyQxj?u(8-X9ELqZ-pQ&9 ztTA-pU?tz_;Go=mzl0{zd&vpJg0%GLZpBHOSn2vTH_~VtAd31tV(G0)PbF~& zKk2Bq$iH@%yr+Q`Ofx(fp!kJU?jkp^ue*`4vOw3c-p_R$+qiQHg4PWBl>{#<3gH%A zBzz;~?t7Ke%=SyoR6ExxH%$?du5x`Vi76~|$mP`9ce?SWBp1-3%He%)g5c~tJMSd9 z?{}>}U%jRIzB9Qe1azC+`g{+(%?~2Ht6p7rlY| zIW6DR2x0Kg zirx68jO+$;*If%Su`Tgf53yIC{$e=+(JIhA6A;KV+`QyK_~K>Q&9!p8%o{who#X+Q zxYfhC5ENNg=wV7}B)n(fPvkQyL3E*}eG^Zy^CVsBc4J}teNc1ioay)EC-*z5Fa`{6 zx}j-o*O>VuP8;t1N?i-sIV#SW^?hF3b+w$cJQuCwkyd=at^-;}nyKPW}|3sw1?UfJZ3nX}5SJ8b|itkVau1XT_wDJ2HihQa2ta#Z@NMhmCB z6#3__d4kJ6;A~=N9ue;X#5o_v?j$y?)&!a=NoRockUT$-^N#7N&Ry;FqW@3osFxTPg2+|Zk+5SwU+a+fdeT?U^X~>4DjOa zr-(?j7&;Ijz6DoZ@U+CLjO0uP%n<4I$t{do8+^&2p$*=?@aPJa5zHMeE5p`Bf= zRc|?+`I?7pZVpb?!L6_6Y1LLc@^G#i zz;L$dkkMfFa$~s5=|3j~GE)_-XgK!yqtW3L13^0Tg0H%p` zsoW?S>mm9{#Lk-ec?VPCP9Q`ytRvHMV zw7R0f=-~!x6r%A5bn5Kn?v$LSL)-n4NleLwaR!pZUWE{6`HK4XPF>h0%M&EgZ*?XC zt3EywRN||_Kj!heDcQnd*Mo*ix;r%NFP?I8y4<@Nrgu#r6gTxW9}<2mjW~eQnScKh zs$g$*G9v1fe^3AUT`o4?BsNE!iiOCske*7dNKGblO}NRVq3wJV2e45>w(GUh_w9YA zduIZ5&O~HzI#cLU5X|IbBaYhP9_a@=FnyaIa{wyQ0O9?!g(IMcrCrqa%k-*&_a%oe zM^}(mv{Vc|C1zs|m5UsRTb?2Nj3PQ9r7bYBHCaH_QlKeJC8=|mr-jYT@wdKbYCa6R zerL6@br<$Fy|1l#L7K133$C|eWG9~?S|7%OcT?G6lJLkV5w#q*dn}3B3 zA+~L+b-w08BH&Z{_(S7YJgE+tMo9*qB5qnhSYT_FT{I+r*JnikTzt8H_r_InxA{v~2 z+CPB3_H?W_3?vVwJN@6VUzdjK`@F10>%|sB8!uf<8%nbkNrwbDqkhTHg_zV=B~wy9 z^OxnGo1s*$)9Lh9Wv2|k#3=kAM^MkV;oByy?5yy*(;Ez&9xJ@)0qlMV-azB95{z0; zvNh*J-mI`*OQS~-tAb$)b4zd>7h zQt-n-{hIzs5T++pa)zCCt8a=4I%V`v9Mo9(#d@F7i>+aaS(&wZgvXfW{!8Lgqdo9d z70M{!R0Omq{+UwRd9l?TTq0wUJ+D7hxp(3>~Q-hMt{FzOi97CoZK-+3#;Vr?2aGgBcMw z4;|w-jTVetiumhX;GVk?1uZ%dQ~P2bL0_K8{v!T*GO z{}rRVTmG0<9V8q;Rjn>fWsj)vHO}G2i*NDA3yF+&EvHIG+7C{1y+EozdEW-~dWU!f zgfo+{k#yj%b+yTWfQ{79Tfy7n$EEiOeBb>vG<+NBQzX^pFbI$O-B@i^MX|)PW)^ zQ~vq1yHk5?MSyYV{9_p`gNAA;zAapDdOucup32;oGN)acxT&F~*gUmK?3b)`*pzgH zxOBLPbm*XVQ0sK&tCMY6lx?XT=D_2r+9GzjqL&~tFT{l$NbdBBCx#(AUiWQ_Mh8Uq zTOp-E8$D+#7%2;O>^R3B7y5%Q;Q<9s7n`7fF&9^P7Z4Q6xRF#YjD?GY42iHo7A< z&kBw19VmT2@FtfWLHD&snl$R;6&~cJ3faPQcH-X{NniTfuy^_A(axcJKl%N7`}TCV z$(!x@vi;h7F3x0)dNKufWl85SRb{kcBLZnWfYb|&2a*qNudjh8m- zrm6};52;HVRALEAY2GJ5X^Da<=*b8MYCKG}zn_`NTn|8>vfK_psc7gR&%Wk+Gsft+ zhy)rY&yT4L)5l{@ z+B11#=k#@5D1O(^P^|U^|^gFXSx5h#J-zXO_NiK>;a$pBY`!_#C%v&|zT zR=^P%kEMwaa|1)gBrV?xHw@UQsMBsa^9l}$81m9YgNat^MJH(u5$nM_5Wzeun4$5; zQVj>4aPURbYTu ztHGMk6zoB_RW*Yx4x}s|JntTMMv#ZU56gv*l7vAs0)y z6$qnov5z<@JKs$lkw~7PqECz!m3iX|(kJ(Ds~}mr!QMJcpb_#E5{kn`H~<-AwRFCm zBC-raKsYfYF@5ug4KutT{wd%>PD7@>@D9K5pVHKt7)TxN1;LBKOmf?Q3@OI^D)af` zl}g*8$+8<3*iN|cZj33CgMOpki0au#%{|x}pRC9;oX9nk8lO)1thAHO?rNLU!W&c7 z>idxYHiv}09tm!wr6@1;0!+@*g$3k|xw!Y6R|Y)r*uW9CNF|N7IKx%$8?L)Rg@x27 zCTrT#aVggn^qA|wJwc)GpV3an+Q4Luzv0uttbc&f!P~(&2roq-ek~q`*H+&~SH2^x zxew)oyQP2`7veQriQXunZY$VrUiB1+uJI+4M}@6~rEtuftBXjKH;VoPF7(4uilE7c zrt0=6KDT2)D>41aW@*FnyVYM!Vz>HQVK~lG80ViRk+c@X;Rs<%f#*+?SgZZZ7f4@2 z8KxANEMwB*oxev0VMHFo`+3Pj0Ntu!)d60*JTs6Wl;Q{Ng3VBhuYEcP{C*G)+Oah^P*!amM_=T zY)JiFez>Go5vRZ7%L(J@(?2R+k1JdZC{7`TMV5rEP+_Vc6zy(k%H^haHNCLKEPkUV zIF;|00*Z}VfCZuQywcJ%Yd89*vFWS#KgK5Er?J^4^d6r1 zV_r2d8B{zIK7L-Ma0pqtdE<6lzh$Q}j@6JTz^<)b<}PjA-gFDyy#^EB3m%cJh6l`>l^?!(z&;0V^@3R)bMrqPdw*yS*&ScCzz zd-(eUY+XmcPV(h-80A@2kfY-Iry`0_^Rv__(l=-)Go6`s4cI<*vz!P~0_06Xre6Um z5PM<^(+&R63JmVUeYHbi3v`^($?YS(m6A2HvB2y?Dw1hS>^y%m%ARlF)BH+_vGFJZ zkc0m~Hir=Z4cVlh?Jd}3{zkQl**%MZ#HX^b4FcS&mHE_zSRhN$GepzYE?pG>#KIrt zYUjvU@R8`B>9fyg7R|dma7NL&I%)lj12N1y@59Q%1hmws>~x^3jyf!D^NT4KDC1sm zm!d(z)YcShiPZ!yycoIk8UH24mPmV;Uri0{-6gNoqRf?bU@FN)p&p1H=ztyYE8s}w z_2)sl@Us4OlGzl$#9&TRXoXw|?W96)SbfTFYrG+ZTOAi}d3{?;hl{(nS`1<8BARzabFnbxD~G44JZ?oGHQ9}O3t zlLZ$=YJ3+%Qq@4QQsdB3ZJzHC9ul^AaA~~rK1VUO*U@KG*`+mZ%c{~f-0V)1!M30? zei=fgsrUl5KJn4+L5rsEYJ6Lq0PiJV6@lH0)-BOa1XXt@E6+%8`6g|!p92~V3`^U3B$_;|3DD}Z{)~BmMPL#MZ zyzCwxJn2avtVs`oG$Bz2f_PPrDY2Lm*MCu(3b9WeC}%{QItd74VwelYMsFZZiSB$B z3jXAk!QmJ=svJD_Ejj;U!Fi>}lD6Bxa9Q5T#iu8C>RJmynl=`~3wo3N*QZc^Sbbwn<2= z{m6*ngKiIGjjYOs2Kuo<5lmQLn|py#%)1_;47 z_1YOFJFGrhH@QyaLs0>^rmppI^xoy|A_EYb{MXcc&-a%OnY2vj1TzyPEj9|eN^9sM zW=tOnT3gL#`BY728|cB|$$K5_D5~k`Egr%KuE~tI4QZ@M4 zE))HnR1sOYUsDXa$+IhA0WK4T%Ba!&r54EFbh;t%lFs0O=1B~nEh(49wnt5a!MKA_ zj`C5OYIE=-S9gwpZy_>@Liqc{<>!g6h^155o-b<&m#63?W%-k~Kb%aWk;wlLnqP7M z3!!Oyyq5gVx)LI+(u8%NjMo0k|2zKV-v~_z3QbnY*598lcMS#)>*d7{FfD^Q?#;Gg zlw;D(d%FxW#6^-QS>l|0FcO{FBhMulBKOYxSVm zkg=l5?7K1?S0FnBwGcOPR1BY!h~b{Yifc)>+$AhDB&iVDg?PnRJmk@Po#qc#e;GM@ zOIfibDCkHoC|Se4F9K+0*x?PcPL@lj{+0mHUcBvDu_4Iad^2P#G$=9dcP@b{cWX5- z1D|AO3fVaZkFJ2R|CL|8LO^3r$Xr3zs5k7lUEl(XXS*<**Snr8o9&|DskMX4|z<<#M5 zgCYX0TpB@3Q~XQNwD=S>{r^YMr2OxKrlj+7Bvo~>>ZhQ&QT0dAT=v7sz#;iZ70Rv8 zuU5b)pQL9PPgNqlk}i<`#0$3jn40`xwx@Wr0KtH;Neos+`JaNO^Z#4WMAT6JcR|ym zz#HX%1x-PU@_!dJ4~zY>&9rZR6zq1eVT{n9%FZfOQP9rb!|zcPQx9WnobVxK{uEm6 zxY69=SS3;$NMUh6$o^{CB+Y=7A*9TY@)|{Hd zUQ{N7OlJCx1LT@C=3BCcmW?)lwWhN?nj&k#WsdEHmQL|f(&`WzgMF=u8b|0nlklF= z^dCXf!|7Ad9CPMEZYiTp=)yBXyJ2^9PK5)*C|x$B@U!IK$E%z`X8wEx)=TTCrFoCq!FM`@!xu%>|om3<&@bhulB$>+VE z_{RcUSS|{|e8E*7B*B^=lSlf(f32^DRLIPkOe{yR)*Pd~d6%a*^biMn?3nD6%u+>e zE#CGbJs-iX@)+ZxYoP&ciQoJ|lF*Xa=7q6IVq*n7D?>YX`ZI+kHLBPQsLSfMa|Rxq zMZvK9b5zBw;_&&V@tb~kI9Wy;Yl%jKMkncq+wJa!4;J3X{?SoLO8>`Q%O?KYcmI#a z^()mKl4z1qY@0Rt-2Akql6Q#cr7;`GK=Gz0b&v)P%=|G z_XP=gmKPDWE|G?1t%XLN*xB@3^dIVtiu|PHgbfbn(wNGlCtii;Q);6b>e+5D9;Kqz zmf9U#U%%~9UmI%NV&IVVY_wXCIf7oRs`cIV46#jMqD}c`^Cj}{_38sv26~+Yf)>1R zURmL(3k-|gd&2At7Elw7QYQ6&j1rAhEXCW*cD^v3END>*(D1L{iNPjO`^Q$v)rzmm zz5{WR(fStOd}gx*z0sN!kxtuSxS~8le77&^#~s zOVG3+y_l$e`^;wJIH6Nfb2>?HTN6mC}R>z->5B8Pkd9my;KhGrl+Rp^f5^nK*0l$$PfAHc0$vh`lXEL|s^g3ld zeC8c?_Cuwqg+eKU?emtQrBgC<=|M4*oPC&Op;J~^(~GUIbqV5pI50s5nsgc-4_0wK z{FYfeR{`^F(ze*$70}ZhX&{V^a?T&^+37fTz5{*EYF(9fR04!a*zOCR#`??}DeyZ- zL(>drv|}CR93Jx;s@BgRI+PG=Jhaca8T!(1{wf^~xd-eqXP2KXJYCxCHiaibuzcgk z;(3=PYlf=Q;ouUEC;sDC;F@NAVx>eujWimMrz>V!ma$}ZP#mlaV!g}0a29giYR(6W zKDdl1b*R4x&4+&wn%-PZ|3+x){X3!gS>ygMp?Uc?LUV-A;ps*;%MlFW`faX=y5@5Q zp8DSiO^Q!KGvzNrGvuFyCjbA1&?NZ(PiTt&jnI^EL5adJ8bZ@ci>D&S3(6ygy2ArP zgO%e~6aSj$24>r`$)JcFu8eV|U6I~5g7_z-jWsQ+q(618-XXPj!7N6FL%cy2>vxye zkFj-T^-m+C2v_L|n9LQ~!yU0sintZfgmxd@@km0GqR^lNH(E0zzFQIV!A5`=IEf4g z=aFj=fG#>Io)%yAjr?3y9SB%r=xEIdo(9(zgp}s0DoR!O(XRy4D=N99x#{{gJbGsW zb|gfWdes(O^c8!1^yRA$>HwA_L=}kbMC8zlM_QZ|0wB^{LqWRX26|&Q=)v588Cl8z zu_*EU`My0m^QQJI*kxK-21aRa@np0lQTT?96vYuAf4WUO9Z|nAJU&C1-FTy7XQMi+ z6>*+P&43g3u%cr;_`>+4d9|@%BGjZMdNM&B%r8hT$TJ0!8Rl`QhXJ^`a=5L*mtR_S zD&_UywXRjJRyJX1D{c!^e63#+2j(U7Ex!dNj*fj2ntgU%E%j3WFG5q%een;WImtlV z68|>6YscRbJYBV2p>(KhP*`rM`6#8>Fs04pc}F>3)&lE%L`Q|)yIU|pKgi)$8;Nc5 znEqN#Jf!Z_qoF*zdr*tZ?l3VzTU6n)Na6vDFMVN7ZirXa0<$F4?MPNXmlV075I{A! zFO#vWI9_hRB2~vSSZJFs14-fwoaf=NCG9FRDp^di)Rm%9)<@J%TMRalN{hbW#kQ`$ zb`Kzv%nk*UIZNBDoT5&VdKiM8E{*VyriyI3!Nxf7Re5mC^Uc|lu9~5KZKbK?U!8fd z^4ArQ^js#r2Qx?|yr+GOQhszL*lHZXeiXGZ&|T^@^_iGJG9ORwwFloE&4ynK!@XCI+^oz@K&c){?E8MO~sC&q{$uHX|0%5TRklE8leO1_FV_me}u-1^l|jP~VP;y_)weEfF438|@z;bzWZ0}9)%=A0@)#;Rm!nZifB#ki7HAJ5HpM~x0Fqz*2Enf0Y zdO+jVHZi%8ukwlvQ!4uJ%x~-hw_V>nO>Tjq&E`>5!3SQrRw=|&C{s*l$xSx{V7OCl z8>K(z17vmS=Cm)4Z*5pK%MEM4@g!*d4z5UFhE3h-!3p#*+4F1)s$jKhPAPD5=(Po1 zu-h8bxW0}KCK5HKIdrgm%EA3h&~*8mpxOUl1x=+J3T{$-)ad@J4x@UWNy_{;Ka~`R z(U?Di=6s#0)2aHWpb7ZBWcx2c^TO+&f~E<*kEmHf)5pIuTe{%Sonn6k&ERXwVe+Hu zxCL5BIU8-&HS}UDfa95S>hkD61x=QkW!w~Lj)$f%6Hy}Y6^&@tC9fvGL)(}7BHz*L zX;=S8&;e7lTgV-2=Gw5vD^4{{>kE82*|oxK>jr*Pe)5Os1{&8}Y? zfwp}?4|u*BuG^Pll_j(t_2LPZcgLOtwlRH@K0qQ?AFfnvxfqOucJB}V3DeK2O$eQX z(|lSHyp$1NcF5FH_EwS8_CQ~mk^Rs=0nIP}321uRAEl}bfpEhy zmwHqaKvj_ zY;YVF-mp2NDX*lwc6CHV50m%9DA2tWqp?Y*MXFTsmBw;$o4LK|D0G<^reo$kewfNa zL}nvv9}A4J-+iRmtImc`{qKIJ9_gfJGv-o{c*OIGn4wYKShECD2u-pYck^oV^1ypV zTMac$(jY`Y=2tZ)K4bBk98^|nP@5EJWK%z+J!$ae1+IX}s>A5HofcuTq^o2as#=zG3~D3 zaXD$ToVe`lAo#Wj7Vwwyd98CiPm?z>wcE^#}i?FMEF($|f?m#nfH-ogFar7V78Y8%82wGMg9!9V}4 zQJsaZ`884L0j{O4J_~L6>z#AM7lGxLSe&cY^2g+ppOo?jhw|5HGi{%Irtv@c%&aoU z8;wt*L0)T3iMnvts-TywK`bL1i{$(;cylIP{~Q$!?}xOE%HA$lbiiYk2+kED8$^rM z4|=r&TXiJ_+5vvenY#Y*POUVwb`T-IsowI^pIMJ@z7dRLywkq~g_5x)F~p6T^>JrlndKt%Q>RvBKIhv{E>CaUs(>X|eDqi3?~ zW1L)f5&%sMhoBy->n=CM{a8>O^e3#;*~=TaAmwH~mTo&Cs>yOrs%7)kVzTEb5~!sl z?+j5H++dKaGG`FRCnpImP?Ex@WK5Dsz@jPEdgKu6OHqmxT57v}$_`OLd!?~EhGzqr zYoaGexMf0M)}Y537t-^;90Ox!&Yk!B8G$Tf)`|XXa}e1b3}|Q{QpRGEjJr1-of#OIu#F;r3z+u-)Ol&)>fsYCK!CA!KY-}spgO~A)N zg1O2zl~pLz%)}7A%Jhz24@;Bq2N>}(9A8B2!~Kie2yDI~S$#9Z$a@Sr(x6pP%>9aW zpvufho1-tSR`f-;Pf7?*y|eViUwy9~;b-5wysM^*(zIapy}1?M*#|JL9ek#MI#CN1 znUNx8=J1SCK8f3V7&FQ~+)jF+tMtKoI3tSBtvdmT!wqNl4*Hn2NWun#4izL%u+nYeYFAaCvWO8rS z-Q}Oz9$({|2Hwqz7|4|FBn>mFi0`c+FsQfswng2;R?6{(($3}&E|>*w>1670L|K%j zN>U+JQJ69xgP9TAFzuza%V-&29cJ^Kn0Cmejm}bf<~vP!7%6*sWc2GTRlcDTNo|}r zyWsO^Wg1T=x#^o%p9cGuue~0U{#x1b^hUOlleFa(l;Y6+tbC(d|5U#Hyq;d}8(vKw zM?ZPE$?g|n|5MM*@c+~^<11GGL(hEpOV6x+dSzk9C@)jjjPtI)r67*`UPLOvS$xYU zEO)n3#-q{{X32+O%(wpV{#d19b=bJT1zs<+fQoK-R$*huX|oa$1~ZShq~VBX+{@ZuiMT47QI(#IJYBk$AEA+N`|RH4+tjPbkF&s6r6i51Mx7J2f2v2{i+XQl+&* z2q?Gqzp%%%+*aoLD^1MX*IJqRNr?G3Kc;fUbEUF->zGLLhu~k{!$+y7m{z$&!8nvf zjf5;k3EBl{Pyngtra{SW*Oh#K(y}!z8~K}_sr64i^MlvJXLD`DdLOR;i8BYds1Q$_ zVRYtObV8Oym1Ht=G_8k;W0cX0`0@tz5?pv_I$wuha&ViM&qK!_S1jQaJU!oJ2;QTD z6))T?bn(X98v<}ppv+diSznKV>maP(kDBNZDs~tQ+Bm z+WQy!4be8UoEX`E_k&&SAI(z)k7$w^J{K)06b$^hSIMYFhz86jxeB^2E^ux8>O|j!?4%JEWr82nyJ8c!@H}acPk2)IgzPNjiB{$jaYz9 zj40dk)Fjdzr$zmjsDn1BQ_h{vGTP4*9d(A-x8deQc_An9+5%r6IEz#>PC9akM9aY~ zCf*cNTRItluC^5V6YUZjiW@~+Xv&wG#stTjAPS3UmAO+wcXo$j3Oc3QpBl;au`L-x(*BCaGOGjc*^VC5YvzfxE@w5o6zV>C8?^N19m+*IBtwsXf4V374LY1&5D? zZ{GN?4|!%f(At17rz0K?v94H%{sZK6t`FqAd!B@AtP3!T62;atp`Xzi*}cMiH5C0| zYx3!)|Zc$(u`&Ta8KFB zkvUP_?+xZU1xyF{J9A!#n~=lK!*DNuR5K3Fr9JN7E#DbO1i<*`Gzp0P0J{tbjBOA6 zPTgnYbYdklKBoZyv;o&P>W_VboSGZUK=9i(VR7i}FE7Vvc}?mV)*jENVgNG{@2DU< zPRy2~+rokkh(m9dUiQ|g?gd{Q3@wLpW0vo~f2dH=VBAY+b1=pt1CI$s*sm4BzMus> zfsT7qL^236HOJHQ5czWtg!L`8mRzxE;sH%B4f=GOHLW<}4L)YK^5`uH&)=eMq|wEE zFh>H^Q)s3hJ{B5#oIJZEKMXv0!QlW|NG%98ULaE%gxAd8f~rd74eVE(xaEo=td1UH z(T*x2#7VL$I)Mqb9#>6tRN+yFVLPdILm_Rm8Yr#6z%?8uG?(v_%V@nidp>WcppFf^Z&wWoM@Wx$ zNj#cQIE_)le7y~)2lm{|JfNIO;r_UEicaH$aBH$D;Qu$Tf%nX)f z8zs##M_ZVQ|K4Wl+$AbFn9`@zHBN2S-;^ptRhmtjd%DW}{1Rq6?5q=G{A<5BTJl)S z!LXlnwQrF{!;Y)T<<6`Fxwc|8Yy2i}K|WU^U6^@qosgadf13;_ssW`KHZi!QJ-cmD zg{qY^nQri_x~|S5M@wS0zZYNGLx{G|^&aDPho4hx+0VrF6>oFu;ha8ErlhuC3Rddz zj!oP9&Kf}8yAy1i=Zh{}gcBS0ek28joJiC`Fbqu~Qk<NUewAbo>Vx@NF!z;f%DG9Yb- z`I7IdyhayDGv2IHG42)_Y546+CPt(WXJE_X4=&z#7fp84X;7U%Mezn*g}^sMYMh}^ zJ;?+x8sgfnV6^>fey(XsvJ%x4PCd?rgjC@2mGrMYr7~?QsTz<_z8tr(m^$WyIX}96 zx7mVQmS#XL0tp!B8tuAHtOR!wKL0>VEM#QfuT#49Y_BtoJ?ms3f8HG)0?798OKJ@6 zU<0RNt$;vD`r~?w0|(|qUvo~_YP`r+S{-e=;0}$qlU)R+0@ivUst>ucyJfX@aGSRl z0;f#u?BjeK_FY2*Vzygu3ZpBudemtM2;(zIfN~l^nEN{A9%<;pkppF?L<+ZDA}3I9 zRjug@sEQ+t;^g(=LEclJyc5YYr3Ulkwo9OjNm=`?w8>Y;hDsKR8yLphGq#L0#jk(; z08o3!9@+(>GeY6BeFu$--(rkSHtyTTUx)=`-=|7n!fV5=hT=;(Qd(FkG9(b@8x+fj z{u-)XQHT-DmW8#1lt<&F@pUGYK7Dc&S2Ow#qA4WgacIY0lHQ!*&T9Q5O5We{yKgJi zh~-o!osHv4TYdQvVmXiz9dJm3C3>Rx7t-c8Oph42Tu*k*GYxAS>hVd0(z|8Y+|$E# zqd$r!XZ0e{V^-b?%wt-l+6&NiWvQj$o{#nP^)>8l8=Su6d={b)qzH&6M;mLG)FKHy zHum^pzTPLJ>Cv1!zn+^X5plpusA|H%-AsND(LOx!htb5DB_*!BoPv*wOWhSqGsOaS^SAx>Vk;7~yWn=1t=?VQdEXr^guHY=Ts@y1X!)} zm@wo*^bXZQ=mkV1lXAzBA5VAkk1}h(ZVOxUCu=4E4P8XTn6mxCsa#*$ zRKwLgAmE2XbGLfiN-7cheR~9a$1{VZ_S!X-)EAH}V4hKJB8b|I3K zt{yN|3*Yx$_VzWB@|;yjYph3-Zb^Hpz_qmTG`9uhgH$HVjnH}mCk zN66L_f;|ElWnw~)GyjY+v+G&UAgVtBXZK8E+eF;9%X)wGSM+@@k?G8-jxg{!u0PK^ zgsjccuOUs@Q6CbiBSt?bzuW5lOq$iBXNC{$d1HN*X>SXuBgcH1CT?#^bsm+bbIEUH zD{mJ)Se_+0CLF1p+W4lA=Gp6{5z#k4T|e zgb=$^R|gXe=&q(Db*y{kLl4sZAha&(H!Z3h5M&EDv2}&Hy-agE^B$?5doUn1Uyo=7QxzJu2LRCI6t~qRg zo1cFO)L%nxeoZ=K;)w@grs*S5&QdV|bIto{WnSMrKHd}*T*wZ6-0hNy@=9&-zT3S% zT>;MVb8ztSalJm~E9h*iX}$M`d41@958}R`92Q(G561k_GZk3 z4A%}Ygj56S!!Lh~f4J&Qmy*DFt{PfxJa{g*uvsR2#jE1g)M#2AOyL=Fo$0~vr9R7g zTD4XbHgin&l;Jf{eesZG?Ub>!TIPC@5`1`-V1%o&mYgwxfIyTHXR?a_{2yI{#X;i= zDY#aG)oz+&^4;_Fg}J{A-|a$l<0Wn}+bdmvu|byU)a%|nxa{`9JXjn+$2K`l6g?IW zyZaa{>(xjR+-&@6o;<2?gzYwr?BE-(g>Tu2LT1xNB6|vv=QNduxszZe{rv0aIjj${ zw(yj_tV<78U8X<=OM0xLLS1Ca+6Y3=ls_P(*yfSvkEc0dwJ3??7`Hj5&>}D+UC-j^ zNG-Og^CL7Z8t#?qp01>Kxv3S(XWVT&WCZ%w7c`+6q?klDDD1W|_=fPldJj!2(lS{* z&i2HmL#=36CJPP&exlVwy)jVq5(B>>RX{f&<{fxMgno7Lk^8;G~ z76~Kwh!8Y}E{X29Chaulm){}{Qb6kF*%B5hSRIV(m%o;CaDQV7qRFaC_7o*-$84ux z=KZeml15VBgGYL-Asb=^P>0Z){5%MFHPDFfGuso%oa~!v@;->kiEpceZU>k zGDCKN$iqy5shrNmO9(@2QSispl*$G0;JR9eVDa`(WZz{Bl@M+ zD(*|nMxsScPQl&6@DeU!n=rvnze60eg8a-h`2%W}CC?SfgwVZoKfbZrq`la|owT{& zoxo{fmmX$gDBcyXN-W4@MlY=O?CwxIW4Mnp788V@>ye;jiV5u0kXi34`gz?6&~)Iw zK(6?a(kO%r%hzdE-)?!&JSx2KQPJAesUGChGSi_D+1dzm^HY`ei|{dr%F78IdBlOb z!1WFjv!V9|4yi;Y$wNwL$amAEX;GJQ3_U6((gvNf7`=(Gsy1GZV;wS`&&w;>UKXzW%3~;V%nY(TUwB?{nPxdxKb^+aDor5iiHMhu zFx^*M+M0g$tXqXsdTgKacB;7AuseV9rjTe%Hu`3f4v*sccpq`Y>fImip*6jl*X4N_sbu$K+t|ofQ@3ez za=%|~{72PNs%Qdo!lBb}a%>a3nThVUBn`2Oq@7X!p-6(;%U~N)$noWsR-CDnDS%OB zDrZ^W%W=FZ*56VcF2J6PizJO28m5-qbT2Z=LDoX<*CEv6RzFJ#KG%&Ksbmug=38Yu zj`MkTTbk;8tCZVq-;mOt=O|R8Y|vUEwadf{=$5r(XupJ#MzhF*7Sc^JIC+HqORLV729^wvDs0_wr$(CI<{@AVyk0!Y}-ycx_O@W;vcy6 zp~g9Tt-Z%MUusm%nrr@uiRr$XnoxN{r460l(Y%fh+G)}WS(Z$T<1S4L^+~c;GV^8* zvN-J-_ZL?*zduIDeJF$CAaNwCuCF3**DduBT;(?)P%qaQQb>f#m00%qJ<`zytqJMai%SCxJ}<2R%$Q)+gfHhpMnmG6X1qy zg#8Ce1b^QkO6yC`B-pMiC`98Nk~i2dIS7KF4K1kvD~njFtzSYyh+JZFUuuX1diFm| z%~`0QOn|~-P6I?Ax01=P8lrg;&Y|qXR>x=+h$#2O!^-Z~&jW;c;=g@-!j{{R=&vLgFC;3B zkgEQoVO2D`br)gsxn8Q%EEQp#fQRw4UHKpf%hX{>R?*2}UiN_Z{a)@$vTN=pXa zrf3-PvWYOQ9RIzu)t=wXk&}^s%t6}Yp+H#oK^o?f6zH(DL&6WdP&Hf&2i^8??ncFZ zBH|I<7V~`*9(?4?v3&VfkK?$d6;Q9Sb}jCKgNP%za?eJquA>g zivppW1G#H>#x0C-3R~&^oosu+&IWI(I2w-r%wR3)=gcsvL(kivoB;Ud1h0;&a^+Cj zj!rW_QCH1ERM`NB+2?mr{=?J+7*LPrPE-tqxu(j?t!8gIYpP4=N;?^Rp^NVyv6f>w z#XjSXOT3>|BD|f*OBR0drcE1jnO(R2wI=_-q-^O}DZ%xslOh}GjY)-UsrzPXY7=z# zh6(VA;WVG%YBZmZdp^NhZr>+R74zE`?yTP3`J{gn9VsR!4&W*^~C2uCvj`6^*^>TOPy0&x|PscZ);4TSf{K6lbxv7sap}&%X*^wyPPlF-jH3-L?p`}n_PXl|}rVC{_=+dL-jX=c?HDHf3_tHG={j=&I zNTT1s*E%$kT*FT{n$a)yCc-Hjpj=r-*@gi4y@YkUl;)e^Fj>cjDqx;@Cq%+;bR4p~ z_tJcxY2tE&QB>KPbsjbv_Ue^xWB&~Ge0jUye<_VS!+zED$n#PVy@Nf9(_Uf4LCR=Z zu=3l7>?*`(#ZRY0T-~NFF_h$HfAtFMO=R3-(0BcX-MfwB6T#hSKhFV)<8v(9Ymmsx zRHOAhQ&F$}-9@-Vf4$emP9}1)+>UWn`VBEC=hX^qd+!(&J#wm)``gUXTrbddHFkRJ zEL+z`$i3NKRB|zk{g-R8~Qq%xW z@VeDdy>t?AJih$^^D3yJ&eS%LxfUFa37CjTgeyJHQir+2_v5M$W)j;#f;wj?&V3X@ z-~}Sv???xhMns@T)&rK;beT&uBczC0cTn)`&C>pE`|mmXO{j?fb>-25(1#z6w9mX8 zAiAn3j=`54`r33%T^Gvx$^!HvIWWrL+^--@;7Z`*H3_H|A0w_z2PP2owh)MsX~({z z*Vt||X>pTr=NV28eSD@a0b zrZLUbv7w;zZ!z}mZM^oU)4Q~-Th|V5yt2umd*ikuuC*$+0qU~zPY1|l=MH`!_A;}J zIp=h)j+2;kxQ^Cgd@;vO$qRzrqUcG)yu;KM!eTVaHt4#|=bv4{Iw+Z^xCX+3N3kCv zcxA0U3dU{Ky_Y_4KOqkUk#z8op#>_+dY0?SY&MAwzFz(P*FA)o8Z!=&t^U|=IVSWH ztKrc{brgnvnC~2te@7&0zZ<5mn?SwXa1xy*P@pwx{X#i!w2`B&$*tgKB%<--SvFqT zG1p9~GQY{2Cg7W{^Z^z}ksfl&eZTnM9+Y3Uza_7yug}-lvY9;pe_6+QpRWh<{_huz zKm7kq*voysoQ~ZmZO12-<$c=wDQBU*WhIG!Eu9_sk;o^x+y~7jHo9lRgw(lx$IJRh z{dlWZ(_+|KJ9pfo>Vqq_lw-f~w7DfD#F$>GY-D@1x~UOF^u?OqWUdLVCksusaV@vjsaUBbhl6O)@ZO3i5W3 z@jvH!fOGn0gdAq`i#x4m(|4h>VO>3(-K`7gw({#K7Y2KBw?x^q&G`gOKcSGO6?9Uw zW8E7!xxlYm)Q@X5l%txmAPEs?Ew=AezqcrB;Af8QwrZiEbjl3V{IQgXg4ru;gh}W> zp&ekkg=r7VW!y52mvo$=DGD~fQ@io^UfTjhAjV^44*#wWsUpC6g{52XEyV=olet+> z=W?HD?j*xh7Glg3{QeDTO;7tsXZ~F6QTlS3uC|(OoqF0~G-EL~!sG(VVh9}dKMtMV zh3s#oMA_APxCm&+r5CZNKD5li8wGT?^}ygZ)TuY@bwHhxO<|@3f+qpmNe7d#lukCD zpyS&8%d(29@>n{w%kN@>^g}opEy;xp&JqnIX+ha@0NQB_@qaH2oPE_zxLKjH>p}6y zHGZD5NY3ze#=TnZ9~~x|=UWFdjv{h}xJ?tTZYQ~RWHyo4^-jT_sYkzG1{80Ci;9a= zj+%bOLBCW0jJb7sDlv7L9=77(>!OX+#kGe5p^&YBnU-1&OIJELBkh%L7K^XhN_@1WUDPL@^Q+ zY;?1SK{{U_cUC@5cOwFJS_A260cx$5j>CiVXDxd5#4CS7YE%0>>p@i*8hO-qBYyH; z$U*RWyV_AAq-1o3Djh18Qyyq*IYJ{q#cTEo{Cj%16wuG>>EOB|x8q3ZrlodCt>XJ^ z?gb4Gk7RP3p{2%@-MsJqXttYJW0fB4it<)(KM_BkCd4wW$w96+&rhNZaci7@3L~j12VWe}>*El)ki2Su= z!D*_Qao?mkT0(JPU3s;@$`GxCgV(@XYO1LLUu8ZTKQenMa$sy#H@rgBXx>|8Mbg$r zp!`M8Fzix&R87^9cuXdGFs7G!HO|A6+Jxu7%gCja9lxx!j;);ZDFZVJSX} zbm%;*^{dUx`Sl;=IP6bLF%1z|+LPkVDbl^_{3HvcsNcY#E8)2*(nJlxXA2$;k)O0D zMfvT4jrKVV`WNrw@inw+N)I?TvFBvpjfw_X?W}Mfy%qW=7 zz2-gnR4`*`hG}q9Z7`U(Wu|=)pBw~Y9`>{#{`iPa)UB`-D0tSWv>VK_A|neD1HF!* z{albGVIkkhp(QH-~J{V+IllfAQr&=(xfZf$3*JeUCMLTH3|wX@qDs9%0oD(w~d+s{dsuSXQmDO+@&4 zSrz5~{=B;z_mw5o=t;!Iq&C;|JD|*-)C4iKpPFqKP&JfoG$`Y-2)X#fx#Hn4<;$G< zexi!JqyJeIjCYaAY#rnH%xf*BmE-Af)|qL=^z*)i8zf=8fF&uUI!q9{F+^SELp`!w$SIXVrX!=`h5M=e9KRj>n7D=J#jhvU6ed#fb zAc&r7lVRb7y^GX5p6|I{0D=p`Q#7|h?=y2qdGEaZpYJCpZ%McQA1`BbNN6u{0{H%Z z?~QLGKSoBx#kc(*&nB{}qKLi)(CsKM$MCOzuP5Gax5ob&!I<&SW9xF?7ZV_IE*Jsg z?*D~~aQ%qW&bPh#mRUQ4Wgvgp=I)dupP$xe9o$Uo?MkrDD7q^T_2r!>W`|c> zKgVU3q9X&{MuT=u9}u=NA9NhMMi9kuJYa7B^XoWs+PW<-;{FX|eaiCkxv1zIa4zvL zCFDgpZ^GFae!OB#>z^KF7T;q7whdaj)1=I+hY;Gb*lNpfF&(W2OeZb$5I7Svgf0FM zP`Y81p_c_;ed4oz!z^}Y*jlD#A}=i;^UqkPA+Pdw;;4??*6-412RkEgd=2;Cip_8>+781*OOYU`?fX7%4!b!5493fv5B1lB@&dRs~c9}AY|+2-=!@Op-d^9@#JOlNEw z*kgtP5^_^4BHH0irtPQH&@XZ^)G8B0N02V`m`>qxO&9a4AS1Cc?;Qju6Bx;D1An{z z1(3%$t6@5|*Go!q?{H?2`AxaFYfyOk7>cO7DiW(1t*Pk_5T>{)#-r+G#dAXAx@z&x zmf$8VU*xKiIdOZ_Kc-xwFLHM?v4X)M^OG^snPiu?(mQM?Xs*XQ{LnRkK+>^Y03q^i z^Mgu;Umx(d?*;(!8f-EsggCOzWbtr!Fs9mFx>;<;Fv|P+R%I|TAblLBP#%i}S%nd1 zbCpHps8hmlzcb+O2Wg)pxgjy#!x%B?I9tRU$X!Y`MJ-sv^`^}&G)xTCyI9Id88rYq z;!6XTt8$sDa10jJvbbUFHj3;8nv_)=K?24I7%d^UoRC@1f7)UD@r$17OTVQ=^or1< z(4p=Wcfz*@Rlu^e$IjgI7x&Y#iH)Bo-<$6Jj~4^1Zl2Z7MWgD+GTWqX<5k!VuA$ss ztpVQ^iWPryiXP{9^OxKz^kx%@et?c>7G>Un)}9dei(T)#M?j5~sM9);bH+k=;LC#; zeiDu`MG2*N_zYs)vJY`MO`o-#bH^6M0)qN+6i{Oz8|gm5cGJ8S)`L z?nd!MNj|vQUJ;WE`ND|s;|EGMl{x9(qBh`?q9fW-)xjJ)<#;Y&uR?*Y*=OKuJGk@ll-GOC zT$j8k0+I73w(MCC=gA7hKK8T=C`#bu?PJOrc;~Vu{$w^z+MP}VYUfYw4xSzrYjX^9 zqCPIA#85QpXd_}TzM~7+?09ali2fqOKp_??7cmZQ0SCJ!J?S&s-Q4~$faD_VX|U}1 zLHDD@ys;=bVTPqYyYB%w*q#aUvHUejJ1Dh2*hQSuN<_*o36x4f?s)d1BBh-u_1hHA zGx_mf_?cpyZ1Khdk8;vNJsHi#gKo7B&C%jU;^iQdx`g6;6YenSA$qcz`RO$BypPuz z|9`Ack(NPLK{~lT{2#}Ut>y}E3Bam2IsZWTxm|)D5cn_v!d&)4%Td9(b|Phfkb4C8 z5)c1Og^VdYl!^LU*7Ue_#wNnTHm=DzOgnd{5Ukjg@5d3P1%mK?Sz2OUj^La7IU-Z# zJpnD=LIm~H6`@5aJ!bilvfhnGAe>-UnNbTh>QSY_<$P>68LI6so-hc2(zoa4HrmN} z4?78_Z;J^eJ7ud5#cPJY4Hb`VJ@%}z;+c!7yQ433~ue@m1I(Cfq5C2z(TQ*Q+Q<;Fb1mPCu!iG!eyDZBD=Z5_}G@<{6D;P zo|}42!ofLv+Dv98V5Bq|g;jy`>nu@37EqfZc^&ga(&8D3w?oHsBO1mN&j|M+N_jGD z+QfPP@@MtGR>6?ITu>?t0abTYoysIRjj$pukthpiwOI8 zj(DaT4Nn{UE!&Em({e|U=f~`VPlt@rd8J+UKAtnM|7%5(eUtGN7Hy$XY46LrD>0A< zRW^%ZIDX*9$ZvG>l~{SzzVO-+uGhG7nSSxO?MyxzRqly1tmhBaBAdQ(8WD3Xw%ZF% z5&s{m!zun@y)Q$bCcKZR?w-M9fZP*3Wydc_iEg$kmI(Uw^sT8bBP)ieEuN(g{kpcD zC@;ge9q#xy0ydr_CZf@A@wYDwW18XE)M$)2D zTdnLEwTd&O*QJCQi9R~NFRMrQZ)7jc_Lng?yoBQ%!@X-LsH4!cNjh=s3;m&%+&Iiv zH?{F_xs;+qZHtZ`T@uHJSe+MczhvRKeOvOS8plri(7UYUqgKFrI^Y5q~^HYs^;Lb)gx95V)KL; zZY&ae>MDAdbc5|6cAR%@cG}3+095cN&k8jXJCX}^DS|<>>ZuCSDqVMMadnGwlT(^d z2RQPhAOAR`v7Y@l5<**}fl_>5qKnu)QLx;-quyit_yvEMQO&|npK2lphxAi=jDYPh zEH6FY8guM-hV%M*G`iBpKnS%S>{G2tMnM)vbY#aLN8F62WY@2u*8OacG^2UQ7_1`5 zy6&&|$Ip=K?XqYO-~IS0vE6I#KJLYUhv6`U9H%jt(^ljT5EAUV-fN-A27^}g1*i#V z<6TfF)M)BEQm7NXqVsW}YOLE#!>(L?RCjV*2sx@!yj4GYi*(j<=E0pHzIZ%zBBD2+q?9|gqQ)S|sWQ>} zC^v*{=ZRBFRJ&3lx7?>JSh(OE2%{JeG+gr^#v`1AxB+sTH}2-uD-)!_V(bTZQc$k0;LuW$ns!jnNaPOYhClk{}b(x29T5|V9?(z#p)7Sw*$W$nsG08{h zRo4uA<;3n|6uInn5*&>5$DhWk81xhD&!eq6aW=|(Q`EE-rj%qSmui&VzrBvv3V5XP zj&%3>oA4f|UKdA^!Bx)B8$FVX7scL>E@=KLu~|M*>-uWl6|75n@S40w_KubV_5t)G z?l!B`eSgC^pR%&w2f0=N^qf74%$fHDM-iPmH1h5m125lTM*KxQ@ra17L@BeiEXLTy_;{SGa9lst{Fnw2L|M!*|(rxpEH}mhd|6V1bR~+G97n{lv z<&KGJT8nLUEO*_Ae)g%BYw+rVNl^|(Z)<@*!t;zqf9MPgKBtVB~DF9>FpNwe8)Bjn>t{|8qa$yNUeca^;W*{ zF|N>eD&WxXu$5Fblo6mCsMBat8P5sL@MId%2ra$S9|qA);-<#d3wbZ-j3%m?L1o+G zG_IpO&OJ(3}agB#>JthW|RFbanY>d{X*)n!Rw!@4*Ubk zQzkozodib6fHrK--@i4pCg7&6SkOI^pJvmT*Mc@kZpgFeS5SMo68IzgXwa!w{yzJ# z<}sqHTQ+hcgRIwv261dL>wMztD_)=SNn!Zowo?v?@=x}p;Q7C$CE*M8r`w2SJzy~u z!uC?3F5K2EFThE%kH%fGok{jOxG76TI$>X7X)4u|XYkO)7?S(UIiW}A z40Olki3g&o`xv<}3Af*zX7t(G zOXVEQaHiw4i`I0NA{h%mQJ6m{Uz@Vwhvr4fX1&{R!Wb`@Tq6;MW2)tFiA(YZp1_i{jIHnxD=_1?Nn_Q*7>N)XBw(0 zsE1zLjJx*WBWRCPu$D7`9c3c4n6gP#E6Jd#yd;kCdUTha9Z$wOYz%!dO?Ayl+5E>P zS5@2oXmn6z=Nmdo;*5hbM?|jf%7LUk+D=s=`wDh!_h$FFk@u;8)~l`iT$X0`ZdbFN zx9RZ59=!^Z`H#KZB(iYxRQCQ8&5ofildN+k_3nqZa#U%~cAaf!pspATE@TA*QHU=EJ#e@k_ z#@$6hT+_5U8$w7K&g{uRFi*w<_rnwF6~3sx(CWR&49-ca4K;8WrCDlPhe8kXBs4;_ zxC@Y0L5e8Dj8A*hekS!{+41<7@*@a+e3lM3lcN5nV=`nEwP8d<>H6x99Cst~FWJsVW~#ZeVq%8f5Z#WGO2dK#Gx z#-=^1u*#1?D71?)Iwi9v5E>?GKabAY>{t zku3vK93RGJhHVKtEZ<4(h32L{(mGzu%nV{QPo+4M%40I61~692%bHH%^$TRg>NiDq z(#zSRVnNznrIm!hui;ZP)&p0agy6bOND-#e+(Znb9gFvA&=^K_1apuc%(TW~X(Z8PK!ymPC2N)WBx7*NM;$|Dhq{VqM z_k68t*BD{MsBn^r7^!i##*9AUbw5oxSk;A{9jk=00>!|#3%q@j=62+AM#yy4tKas= zYfP@%lzJr{<3?lAOZ?*918oke<0x3M#PU`{yE=5Kywox*E##ukfkfKT)rR|B9sIVv zhI32(VwnCA)u>Ef~Rr_%my^GRQTzE0r31-YLiZL@9~t=U$PXmrPhmbodTA5ubAt+ zl20hV4#_stvc|6dgi3O>GjC_PljnLwhu(nqS=9w|f{{&%6V{o;?x6L=_nu6%1Ak$^ zZ_DZ0E*O$9GxLfR*XNgUGpEY6mfGfUMga{JaIvF{D~jP2?8W_dx-+Uk%B`8%#SZlQ z2z@ZCgR$D~Oy)fMNXS~_D3doWPv1q!j~j8EaXOU6q_pNjQT|4*P~-x&5i``#Y+7wP^gWhsL)Cj`g>Ic#;Kup5U2)ML_KSRxNArwp{EYwQh_s- zW?WLiF$`Z-E#F@){A1OoreuIn%L9qND;!hL^J#X#+hUim>E?UsUg)wQ^!dLFvF87+ zU-^I6b!P~*UL46bgyF6WLN6P`F}H-_-2J~B-lIe(*M#Bf1peoQweQlEr=KUyq@ubEkZ;>FOYRp+`#HpHO>#)VRudB}}K{8Rw8AY%VIV?tZ-Io_L^kOT?(D~aB(=(XI+_>4UKAm#!!{}a>f$y5eelLarRP{h$un@Om-bk)a5jF{9V7+$XPKuSHDL8taI z$mtzMs8NbW6w|f9^VGlC`wN@=uqgTg4hn}{_UFl{ZKKnCJZV86(&QhMfI(HiX6R?;66CU zoi(h+oy6r`^-b}Hb*>rYo#I^4iUF@!nujf4k(RZ4uEDFZCyUlf93D!j-rG4$b2!@S z*Rmbq=gtxqU3^kqy3#|c?xV+4=eOT9n==Y=q_FQ!@JliY!F6SdK`6&9aR1h8Rd}e` ztUdwc0Z>r9sI#U135qG zAreIan`_5_Wb)7nIQH+#YEca|=kD~!yqIZ==Np1Fx7JM572>g)w&yAY?yRz$#{aA* zVM#->z_sNvl&vtJp6CeJb(_8@;a;sbYEB`m`BxP44C7Or>O#Z`&kjE6>MWehp}ye- z;9EjoDPy!$l(BSkC+kgZJ&S28uOxgdV1Ek2z2d7IA{cP&%ws&LnS-3r>P+4>Fv}_4 zv}jmag@H3q;aFJZ*-B4qu_^W*nxaM;DH;g=H;OODYDr5LVm4!c9wV`a>AxZnUZYFohW6OV= zhTCh(XfqRgeM2({0=Z?L*qOZuq>w?>$G6X(V%VfSJybVp3%D9x-ii}d~oku(bH_K z?|(Q%#6ag~877pr*%2B=DHjo|g17n=$0=z0Lxxk&pz7?D%w9mxnRhbl;%Wt_@!H-1 zVmBEHaTLYxUO{k9nH+=HvGekQaVrHyr9P#wIWcHTZ+MBca=7VG`B}@S|L7rCP!p5U zVo{mFidxz!#+hth3yt#1lVT_cM)t~bs9>PiNI}@rWpkUz*ZUu)Q4cdRJRNiMeO(G| z6OuW~yGCQg?XBI45hqlmKp)y>_9PW%bFHQRE*<}cuG&K6_H~dz@ri<7q2Diz@g>aM z`)TEFrSlb=EiFw_F1&SD^oVJQb1(swo+DCtH!b7UrPU`5El`8y%mL7p`%c!Zx2IO; zWv}Nd@3PFq!$LlB8Vp^+xAR$AW7PvGwr_jE;ty~+L)+eKnB{&i*r#ovi4REHcVp=Ou;j_G!H9Oh)<5prSYQM_rP3R|1 zgg$s0#JKRD!3Wu4RBA{1E9>&mZf)Qt^;aMc$a!lry9(M9ZQhbKI|*l(k03+P6B0u; z&L_OO$YMM#Miqkw$0s0)jnpn8N=&b-==&SM8Gzg1`l0MQR^Z02bn*+DPZ{Or??kA$ z`i{|X<#;$#!phIcxvRf!O0k01aT{IS{`X+-9PQ*t0ixdaGGtNYW{Z;stNn!&2ZhxK zK~+>*v=8E8)+pD?*v#BgT9*9P+D8cESUxdLvhzzB(Iu5@te)J?HFoP53%m}ka%ops z@Ww}yE50#2{O*cj<4KI})}&Hk5g2I|9Im$|5m+)}vgYP||K z{xv&WSymAR=-c1<+&`hW!) zhZM~@>C)d%-Ej(a?NIDbJa;2A#BlT9+u6yWuAf}5YQ*32KE;#Dm66MKS2zBW%IW3d zJd#bmPYoD?`(9SNa38o)WKXaiXUB~3y(l)o zJg6V{(1TI~9~F5Qe21auHC5^SxlK%p=yZccI0FXkCiDT{ktZ?c$b>w(9ta_mnj+p% z(gdpM3a*X@_f>0S#+@xgLz%|0-TL2n%EO{RTNAnb#OFpxcL2@^zL(%&U$CRU?Yx3j z+hqwpU)<)c(1A{>` z8uH?E$=Yq-LoKUFw2P_L_M88b)Sq-+%FKXN*qB`tIC8Tn*L*p6GB{?w5J{cALCnTe zspf4bGh2GuxxF3fba(%6nC6_nA{9iK9a_1A2!<*QY(aJYCPv6Y(SfA>4=VNJZCOj(kXl1OJU*gkFVeX5rRTNY zO)21F;zk2Sgb~)H2_XLU5^c~0a^4S;FRq5%i_x7!7O_8I3#d05{t57&Fw-zFMKj9w z6Sn3v7rL+R1u4K8I>LY;+7*kNx=N$NARq?-?Miky>yIv_PW$bsJndEFpKd0PGNOsv za^n=oE6vRm&Q`B?{7H?S<=*FcTQw7#jT$@pvPIcRnhv&sQi7du#$2%yQ};9O5F&{o zyeQ}Ft7PCb?!L5{(xLPelaq1lRyBr&`jRrt{iznt&0*e`tvhcR#Gty@xnyar~=OX8mFyE7fuxS1D<@so(&-0PnQVd+y(p{Z3Si=Vfs%UhhSHIhWGJeAK;Wv>|Z zA*z!FBur zJnENAPIh*7z?t*+l=*w;uOsVemL3fXp&M;~zfT{bPse{}=Ne7mARPJm_~Isdb|`9O zcmB28U3TN)m-^l?-|_x_-0MSRKk|J4orYwuN4rg{bp45C8)mJ+Zn+4a_Lr*=3_v5p zq32R%i_0+pE8wmL%&;AqkFZ zmxlFMiM<5MtU{0-L3&1q)VY^3Ve9WstmqlhGNh-mJWtEXIn9iP064NL7Rqghp$HEe z@a30Jm@&XprX}cICcoVp#=63e#2jt3Wm`X`#hSuM(xav4g>|-24TM>{kiF!d+7lKu zY6jDYBhX3)d7rh|d?CJ8(ei_aW5aERCjl_6^`Z@@FszIS!h&$&Xf6FxPV7=?qG(ON z^*#qYf&l7y8Uun0)py2o75ZvXkQp1|q@r8biR4XfEN$h7%@Rnrsou_HCB2H0l4s2( zk8f`O;kjK|ORQOz`4*Q+uJ~MrgJ=L1)lEgCslZ+7*UIh2b*_QpKNt5(yY?)_-XAHr z?*JnVo}oIhQlggZMjX$y`%h+YG@Pk{4fI){nex2A*65-k3m5aD5v-U z2r-ah%Lo7$ag)(g{BjmQ z!s&+{s5)+{hSyoPIzverhw0;E?j^4$q{JKTtnGTISdVIm1>r7`X3N26lb%+ z?BKmHYc=ecgjqM_hGZDuNCaA%R0xML1K)+;=q}^1>_Yon*^;w@(wWRQ^@rpxK|CHB z-e+R6vae5-9l`b;tHQ^cA=h4(Y9&~wwI2?PZ2ZUp7q!2$n|WG@HU#28;@Zp&;4U)o zE-`;C7X{7Lb6s}7@sv3HzooSwn1+O^Nr-p94yu{e#<6Q+2zdsiSg|XfmIa`++ zZ}nl&GA3`+OW-lqMR1zS9BD#X_1bPZK>L%ah`;BNARy~)!XfXSq)SQ^Re5VCt;9pI z@)O8qW)$lYE@(>XYMWx!=GsVx@M!N3TG+%TX$ALOcae?VrL=i?^dd)JykT&(d) z#w6e3EXlQh$ldMm=w^VV#QA!~U$4#QwY_6D)N{Ym{ye?6L!Q2&u2`x@WgPv&|F{{O z`SzK{#r6o`d@aZ2;eRj%e!UFd9*+og`ujNf__#cLsMqy$wRgNE5PiLOmt(oV)aAwX zm}3c0qH=#*Tc0Hdy+vBhp4$LxM?Gw$qm5K`q5}PjM1^4D2~6u`60-rytUO!#TVlz` z5M@dzgGh`Qt?Lypne8YeBe6*jW9X3eLMw37Dogn!Kg$#Q@X7aDW(}U`(x|27l+d-3VmPkdF%8~v{p>21Y1q-O)D^}hFjTZ!gZ74l%Q6X?te$or4go*HzG1@EUydE ziVWMD#y|e1&3ZVvu8vyRdMR(mFq@Ua2X=6I0KN8nPr$+rcbJ1BVPisDcv1hL1bY-Y{)~FRkn!26GSj%YzzsXmy;Hrn zNvOiHlg=Bb$uCch9YjMHwPE!n;Jw()YfF6Aaa`4w zy%+`+zp_&P`sGxNP4;Q9uV4F?qWJ)!7QKRMo2EhG>x^M2n2pX2EC=66HCruMf96DVrfu*t6 z=_c^e@4<;bY<1@IGuQzY?Y~-0CL-6LxVT8T6I-)5w-om0YNE}T?&EHJ4X*J)f@)t& z3q;8d-a+nTli$5FQweZ_v9q+1CNYP>X}60#B8JEx`7}<>h{R2`X8T}R|0ycmYd<}M zpq&g@JjFqP+6MTY6Z2a#@L{~BV;-&O`g&suOFpY}Pi6ph`G}>LTt)Y-c4R5A*^Hy8 zCjvV=)V7?(4uTC*)=#VKXT(C}SN?p!_2AAAW=qW8VWLg>3PRv}qzk40&X#)i|1zVr z+j_sg-3C*6`TEo+^QE~DeJV?T*pS8?-o>N*yiS>{lTMX&z*+oSbK{b+FlG}JR?xcP zCCmt;s9EXN@d0g_^p<0-%m9fvAO9J;AkmRV;|9la?g~N3N4G+RLQio+a1dG+RPU|> z+5uT>JBee!z#sjGn%0c#h}@$XgVis6o+xC&-(iI3r$(KxgwQpGd(I|29P$o}dF@c; zYXLw#b4wHzye{Sr1@hT34bVbw#{KQ>1-v)E#(Y1XQENXfT^j2;XkIb~9?#+^9l5%- zOyk$&zh=DGVE!@-J!1jpZ8rS6oSF2?Z3d)7sp3)GW@rvw*-`6R57;!GU_vmGA`F5c z)9);BdhyxyIO{Zhn?_~9A#DZF&0C2f7V6~MGntWhvt$`s&ykRsQ_ixcoRy8@Xd$p* z^409fb%|fV)9LKN*Vl1vaJ!hv$oY)9^6w<@ykQog&*UkTV79g60))#X%Wa`@TRiA( z5MZ9IEE93u#7{Jhzckd7sNO)3Ut->s>dcKTvzM;DM#kQwVbxp%s_%I2NMzN6l9Eas z2Co}Cvq!U>wpDQyIpf-KfoWa?CMs609>)c}RlLw{+D_ey;82UQW$0Xax__Ui5KZJSdV>0yP0w}cnq^vgxf zlo+jYp6UCoF2z^s4IkGbhd5K+0)Hp7btL*SiKiVs+Ga>+ne;9!-P}-F+q&7{ayW`} zkJgESI92}fsKK))D*)}aY=*axI#(QepRH&AU~|%bLJKpcSZktK58J6=X!&P?RbTx)mK7# z*LV^~unb^^|0)c1UpfS?`^_QW5|bf4JGKf;$^z{%Wql6~c@HeWfrwX!X&1HJ)(buD z?FdQJ9XqCf9~^5sh%fdooy7lu+<|PNe~FYSK42Yy{|m&K zx<_SL{A)$$HC^SS^H+*-Zk-8MJWpl;Ym%aenG2j`DVW?x>kUEL{CN!k<4cb3X5UA? z$sn*ur%dy_(YU4QTJrmqEXUL<48(xRA%P`U!v1=(pORuetdNhI^MA2+PeGDITcd#6 z#wry(~)3$Bfwrx(^w(VPU&i((0`+h6(p>pTWT@m$?k$bK6Eo&!G_8f`; z5O(Vox_x_(sya4K%#|TicjA6CQDX^)W|0M6etnm&M(VKF0`nQ{D_`2b_LI9YnYxc^ z-|diT=W($ht7!9F!@^qzUne(pS*2rcPGo`(=%Og1y4+52CE0&sL-b86I43agWy@-( z%mTK*(x&@@iH7Y~)kZ7_iaPF=DGtjv__&5bk zdJ|?s>jCgz8ax=o@cb~VKH;{}v7w-12e+!Y^Z)Skf&?D*JCFGKW$j}Zd|DvIdtneU zB1TADW zbo=%}7_Ga>1Wt+GtV;MQzs=Z3RZggBT=&TzUWtH?yd*)C+=BmZp)h^Q@G83d!XtOr zl=xFs2KjOJuFl8QYUM&Es;jKd;kT!f(Lw_o%i0ViD~lJxhdtAN6&)`0T}8h!pPXlD z(%jvH?)0cu@|dS8;eNNfnxcX7OiCh#3yH!kPqa7N7lnC!z9wPZ@MoIv0zPlYCTs@~ z`u4zV<15*JipUn0`ijMuu-o$HRUb3%wU&QWjs=&ilT~ov;%ZfwGcPt-VsM!K5L(Ss z+r0i%5*L$xkUk_DFfi1#E5R6wrGYgXbsb_jFq-qe$AE;3u`al06c&L}+C8ur>{3e8H$J+b}6_vLgwqNUc; z<|tHYyfp-GVX*kRjgu=s0jSYl;+ZAW!3Qxi;KAE^G_K#_7;vV1ntqOi`Eb%lD;cfwkb=)rpS|K|C<-gD z_mI`gDZyz6ohKAu?zT%G{GltD>zPtCca?q##FA?VesG1DM`exAC5Fy~vHr=s2jzKb zb`m#0UM3~<(ultHbm2ScrtZLR*g`53FbYAA5I(sRUM!bwz0ce`aydwx+-GN6L2?pJ zLtK=2jz}aWo_Eygyt%*gw6?(C9aRkPHuK|hUW$RJrik_137Dhs1T;muD;b;DgKi=k z<@aE|mN+(ot={BDaQLd;j(MqR3pX*W>Ly6IBrCq_34|mh*TkjlSuGgn zGu-XcE{fgU>{l}v#A)?y9_#i^S^&%)OCePczK}x%kIr(MeQzl(jk(3k=(o`zr*_!4 zo3F+wH49F1Ws?E4hh3MDnf{M0WBKnL$%T$Tm<$>rQI4G=*f^#v)lp>#zifc!7xv9YgW9E>Jy>HJn3Rnq5_{aAPI* zEI)x2wY*4pq$=t#ncoMwGKjKAYPopy#9yjT)J(I$e_hIwn%V5{k>;pIW=@s;sD$c` zt&ACe%)Z9uUO{i(|1jt{?A+h%7t&;5F^@Slxu3A0;CtPvI;b-l)aH%Vj)#P(<0U>P z>=NOy$xq`UV=;A9P<8B6xk%5Y0_pfPZ_UiV0tdVDH}m!oWv;SKV+9K>#ZX#`kf_(% zxzICh`50kq8X^6@>R3K4-Nkvn5KskVPdZ7b%O8x!a$n)-`46#{7D@ET+}-rv+mxKd z$4{X`PtLjO9?#yxia)EN>eyEXvTcK*uBh)YLdU=Tf6heO_mmst6MDXYYS_mLWD$kM)|Q-7~Y)#JKO0nc$T zFk&Zt)rGani5RLv`^{w!cg+C;k1_FIh9MIEV>wDXwpeuW z=b~MA8@F6`$Lrnr#$_-F2*r09LRIuv+l+sJi3N|X~UVzC#*-kFcm{6x9oYS~x20#k!i7Xzu zamHPuEO{JPWH`NyL~z#f4nZkAIFus=ZFXJnjCbbn*Y z-vO%sXO#aFmO>a54RJaxl0@Th_n{|T_UePxL{lfcm?-@Gjp=dd^9x;zlbwS=tll5V zL^;;KP10yWGP%?mzlRS`)b%Qx=3XFuaF>mOL5n@%I7%oKmROtYAOkZvCt3Dvk2OQ% zy=D8@k!*8dH@Sh$O38X_D@n5{WLf4Gu}=S!)op{j*QupRbMR41)m1Vc%>=5ab8qfo z&5Hmnq#8pRCES{*0(K2!ivQ11V5XjSR~I{1R~!2ufepGF`PHmg94y}{SFNACkQ@1` zZ*@_>Jd5%LE+E~xs78x+)>@d))VAvdVKQzlOEtgGX_kqVmu|!+bF_Nqg%abaFTQs} zwk(>+)0nIOh~7Q6_pOL8G=Uw+F3d~{aE!wUEPB#mR=({5)NJ6Hk==t?O7)=g#^d*s zSA1#UrJ%LTC5{XLoUK9!1R~XurzeRGE*K4dxvVN%PmNqzva4Sp-V{8|gQ5VOJxaT2 zAMf^H!xUh*_0(h_jSIBZevreL5CJZjHtn6~t+ak+_qjieb{sy{Z!?931mn8ov8n1_ z@ctI=cf!{!BNy00{N@4AiXdtI!`LA?DFC@~?<6f}prHk$%wAqcAdC;=xDwOuk19-;g-<6EcMcrT{%MK_hsr@5w;1x zoL@O>U(t;)f7$if@#&g@l#GVsnX71?M^zyT3wRK+e#~=?WKzR#(kN-VX} zAcd4rBtyMhf+f4C%xZxlRavj(R{l#@w#lKhogT9B_56`fx#EguWA{RRUsG&fmq5P} zvutOZn*<9shi_Aw>i6)pgA+5dv(53AGUsu>m+CcgaV=#orzEhy*Y@zqsBe4wGpHh5 zgXHPbEZARxRYAD<#2#X&SSIj6;q4Y3ca5X73kEY&T+bWj(iF<#&9aT6wbkmz)@(lW z$1jonz3Hs&@Hr6DUU`V7DQI`*=j8z0E&!YDB*2|fYr#n9$;^=Gg7!+LGx(uF zbd-U$y{~;srg%u^=jTKC>{?|&bLmG+;_Z}qO&!5eoKcfqJ`<6 z-*&7vSiV9L-#&AeKbzJt>r#rH2AJWm@GevK_=@hy&kYAzzI#|`?5A|E`}vl1?+*yu zKHaQ7*WL*&gHkhJ;B^%8CLtd5?&MuK8V$OH919!nUgnr^70Z1Cn$JI*=oC(H2BMAh z?Nt{xg{pw{`X>J4XA?mJ{A^GAhY>(@xs&k-o9_ zLwzHCADfvP*t^EpV*|>p-`B&)jO_20=TB8cxTn6(<<_+VmFV5HlH3>lX-a#3&w|^^ zH28;3ULBq_GZ`Nejf83{D34*I7x?=03N%%r-_iLV%?2#MT&HUN!42tI>J=X))f_QV zsAnHqttji79o`tlOu+XM=@=ZRRZgL_k>XL;ojx92hK3n(Oa7b&H^u9-y6|V*ODV*r zStt2&2k5ZAhnh*WrV2n9UFqCKuq9^w2cRM}lamfCv%Tk8udcV@h~4=PlsfQ~Ke;-C zuRADG+xSuuRInhd)Tx!KW7Mu2)#NrIc{F0~V52X&n@tKu!Asp`OGL2wx=`B`Jhi{= zec5XfG}aMk6eqC`_+81j3D}a+zDCwHt=ap!8qT=14~x-}EFwLP+`?*MUASb?uI*vB z=B9p9>Wo7*xwcbTBnOASisvRA5r2TmQ{j=K`1aRE4l_NETQZ!mW(Bj-7M(k(NveHd zJD>bPetJ1+B9kMF?#5C7O4;jQiE2YX_Wg3U0c55BQSo9wDhD78+cyzSyM`P8F~1oa81kuolx&_O!o` ze^S=0L>0&BW!rfV85iLjvw%JBls}G3f`opqTM`y`PWwXL7Cs!tXzO#~<`aV6wE-o>zn+!P|}(`~O|SaTGu)&$SV z|LNNEaNsh)vwhKGij_2E`(&09ZU_>D`pBpEBou+Fx2xC^19RBHXuJ@JWUeGmLEQ6G z^^mKWEKK~(?ZZ&nv!o2PX*b?vnI6XU6Z<(hhg1Y$rP6oyMic#5^&gd9=w}(L(*cnK zctrWVTjYOUC-iE8&Hn{N$wAJa{|Dag4px0MDZB>Kf8Pn!zZL4Y6#kld%vhFrZ+p^v zSL0Wm{l-gn0?6BqwE%g0Ns=C->C&nUI%{g@?_-QxSaCqtJHo5q_O#AAi_R@uUHQ;m zaO(;YK2hlVmqtTM%N)Gun zIP7e&b7x134=qeEoYiVXGARagnWUwdu*fN;^;Eb-$mH{AegT7zGPT|xnJn zOcIl%DyFS&)@5&|yB6f}tkSB4>*Yghc0j#2#Hw7f;B4KQ1`B>k&e-PDHt!ai;Uplt z3%VdZt5x|-L(V#T_I1aWG%&@A3RN5zGybY>lZ29UhJw|T_3i+{DcC;eH)ii}-h^sd z7S;{mNgb*W{h9}%u zrS^O}T^7|p3S{!zCR~fzwV6QFB9 z(w8^4Is~i)^tIz5ohnZ9L>m*++hnN4DhQq0^tFbt%45y*7O`1(zQNgMFjiVf{ysm8 z;hKQY$!oI>Gge~UyTNjw&%A0ILeSRYCQxIVpHCtzqG{_PDgBbYY@#86oMb)XviZYx zO2QSheY$uk`|H9NZ)F9#!Af~BW@s3q#z(*o6>>?nS+ zOKnGgZh5T~6FBf9w)jucWE?ejULME;vBz}9%$^w&Cv7F61$KuHJ_jy?>Ykt^;yT)nbN7e!@<^&R> zQVmQ9uzPuXnnw9ari+3|95}BCy#W$d5(rm0h~}y$dh5-H8BMDj%&s z)cS?VoVYJcHBcH% z@a0`A3AzfApC;ssX1O6} z-V;!kbK))ke-Sf$_PN)?Q3+0yL3k6Eky>y5C*^o#+?$SkSGsI_oqceQ&C8zcq3dZ< zb62oB`#8ol@XuF&e&M|X4>HU+l7A_!KaLiYds|1(J*RsaJ3!^Dk4!O<+?$8u*yeZy z&M2AS>8#W0zBd+ZaR876R-X4p;(9qQ%NX}-_zh3cKUiD6-fMHbm*zRHjdEQ5nuoYziFj3iWt^n7wZbnR5nbE`u~Bi;MXMRn7t^?rPUAr^JART=tvk z|3g6(u>nl-^+>V^W~O3l*MWo$lvP4X898hLCh<({1-_urCN7T9| z?&bCus=DQJ(%$_r=7aGZA9v8t#TAPAEZcNO@12ocbapU=QzqQs74AMQ`tn{greX< z$o+f=)LA+-{3#X9)8uc~8CI+2){Ke??Pi4TxsJ+e$JINpa8$;*H+RP~4)bf-2xqeU zU&P4M_a2*WDGs0{|(GP>x-f<9d`)!i*BDgN*^{ zDna=syK1>kTX?C5u6bDakgSH*R1j%IT?#GJ+4!Ia3PZO`aOeKIa9S8En6U& zB8E;jbAbF$Fxrp$pgBZD5q=R&(=6SN;xY(4v5&2w-u3Jx*i zh=due?A7wqZVT!$41G6LJAti2%QL4|O>xm1j}u9idNIHG>%wHX_R~;iUPpmzMnjRZ z>9SK`Zf9h-EYh~*VuJ~XxgBL+=)YVPdD#rK%%>+ysn!HrMEQ|N8Rl;3^NS0(Sxbt&UYo$Lw#5v&rJt6SBGt;auy~!Wx^rCCLvgqB_XctIg@vj>;>TwcsfCH3d0fo=stT! z&Z6UGkoSZ~j|QF{iJ2wOtx(baJ~P>YKuCk7d`NGY=5@Po9~rh5_kFT6M_T(Ax*cl# z&ZQ+XqIat*u14W74(@E?$DM4lZ7g}NOy!}xr}n0|UjlqF zXVxzd*6&V$vop@75ltFUDo1%_kL%fNC8xfA;bF+L_%N@0N38rzaZnPVZv})C_O8(4={7Y!!(05aM;tIl=CgMkq zjRf84ma0_t9Z_A=175;ElzD&)pV2}xUozstDlT|xHZ=?Amot8jCvV`D9Ar#Y|E>%X zstyPn*%mW*bir7EYoB=jYF*Sfj_Bb@Y+cLKdsN7<1EF=WDX9h~_(eKne)$pRA#9l) z>5m=5Cwv z=E9S!lJoi{w1Ioh>~Z_DSXX~m}S4-pxMr(!s!>R@yq+2+ZjYRD-2n( zLu@98M{DtwkgB=n0tV^y;|Fo*PfCiP7NlA79qodZ8KU*8ONa_qZrhV<^k&WL?U*wq zI$1_*QBIc{jhnA^4$``#Su&I1QTdKP*XrA}S9Gyz4Q#EP8#g^_Xt1iX{#u z8KCq&O}xCal9}~}$_@=H9mgiy$Fpl^>%OH$x9d+s@rc&5 z(z3DDbAq+`X(A=?1K`cuHQcXZy9X$ItJ#sBD z!hbu1VHuaX{ehk@As?2*KpBd*(v3J1VwR?er6DvN*fO*h;m#^w@IeXJz%-usp+~1u z&-rb7m4ishOU#25&Uk1p`V(4xGgEELUQ1+P`qOe8&GV`F3n_6llWSthx3eV9d8??& zY5fpJk*^-pja+I<&eM74o7by=a(Yu|K(1%;>s`x_cI*&Py|7iV?{#^$M3c=y=7HEWJmGI6ic?f49S@5hEXgRGTmMF-K|w`xnUJ;l(jK9P8c>a{=U zipG1eH`kqU*b;NuSsl`i=WzbkpIen{K|aZfBR(OeXrMwfTQV%!Q)wQjN9~7}Hd(W4 zVKq|wST80|K?*5Opw7G%8e?!;?1z!~r#TgGt4y@Ju^Fc$3;ON2C;M*#J^Eva$qYsckdMu)q^N~__INas|UI{7|uM8-J8V|P_&pZycS=e5D?X1k!E;OGw@pO5Ru zN5l3{zW0xlhLRaQT<@nnH!(TBKY(GklM|s|{G@2;JzT$UTF}X#aoYS%%`|sOuh9&O zaRVnD*nJE``!z_>a=IE454Dvzav|kRg?DkOD=9-Qo@zlwLEl8DSK(#mWh&7s^TR_@;EcWLJrRzRsrU^^ivJeQ z6@KgE7O2j^1p2u`+RimB!Z9=gLGlpn)ToI+2IwMm&DUYOp{vhRadf8ab8kqqCKLrr z@~ITTS(+89@}~)|JTLt(vIVl2P1Segv7dN@X0Y9PPD^Z#hs!DFK@jdjb&_eCDe^|J z&ij~eb6fA~E9OU2FIiJN1v4gweX@hASfHT4u~+{IAGb9=ovyw}@?Y+%b(o`#d`RBd z-ekiHb)cD*Rn@h6GUc`cOKxi72vYsnxEawuXU&QgZu(kFaMVGMmLtwHa@PkOU343+{Kz!y{B-H% zZ7U;m3XmUw4BE;r!P-#3Nu?yd>#+qU@V2YPZV5R95EAs^D4iCrPUG{KxQU0bY;QZQ z9YG%?C;W6*8fl;;_V)%R=8H)~Y2FtTS)}4wre$PF&@B8-JC1l5uVWp9WVf)_>n&po z9|8tS2L%fC_>4@k>`$lmEL3HY&u?FX(0xCixeZlcrS-Ko+rTJG8xpWwZJf6}J z{qZUd5=4Qk+d56DSn9fwJaER{&iihz7Zm0{8#Ps=V?bz7l*g^+!lni9hHZk zA%z=E^Q7ra0W7Ag5TJ^9`Q^`1%n32P&r0>fQRw_z2p-ziQQ5aNb(^g-u(Xoe-1Z$2gQ;KB4o4 z7=^k1K>4hlUL`BSREMCduF;kffnb=E2Qms{ysgj1kK1Td%cBTMT!qe3pEq9uK{NId z(OEYeVIuCb!uT^V7yUE%5c^mHIgHS)xk}?RKt;Y*FCxqV74D2C-7>ao#Yxt zmU57y^yIm~RYH2X@F##`&W;}4t}ZVp6jJaidSViyAk@ZwTXG}^#aWof0AXPX0WQVH zgisR2S>82tVS<_gW?v5B9bSZU`ejWx5|9S1`3Gx~$jSB9u)xA+ z4$T^{YiUm1hbnB8c%>q>-Sg^32}K4)g#=^j(AVF!Z@ec18RKaTZL>8FukdN)E^WGi zl;x@_yRi*psvHjATi<)1Pqui^u_lw3RMF~~`DKIkH1gfID(9nHOzVLUl#-IVi`$I* zhqCpYdF4{Eh8zb+@{i`P=P2i;_+#?v6S6KAk5VKS@B(Z){=jwMH@!a%y~K*6_-=0B zA5%km-&StV$KNu38a;@pn5f}oKWZP~v1SMn=)uW4XD`gaYSwClb`zysJPyBq0Se2L zz}Vb%$&3vjtzG}_9b0y!3%D;mAI8f@Hb{NnCyDw-=cWxsNIKJ%D$YWJQWBYJURpmW zi*dP)D7+48^NfwJz`JhB67qIP8+DoSQ<@x}S2X|1(beHZ+!MQkWR%?+!uvbKv8&6I zI_~b4t@EcwIg?-Bt$)o!kA#YX{j8C7FU!UA=!l-W0`$GtUer{3a-p7K7hF+xOd56# z6z9Nshfg2qy$9|jkqHOR5vzOdx?a*8s~~k5I2Whnr%#trUD)H|hGfmfx;scnhQUav za^AogglLqZnfp6Ay>OrCuj$UdN)$yad z;sdq67#@0#(BXMJ3b2ju?&Q$&VM#>(S-Ib<@27G-2v0q0>+iSbH-|HS*4{0kzF+pg z)ZTmA`Mw%^dRm_M*=l;a0lCg;SKn{M6{ammHG0oJBp7_;AgkNoXNZ7YXTH+IdtejG z-l5)K-apz`yxYJvk2^b^8o5G^?Kh5)_OK^O6V=jGv?J&lnj-?eCV8g6eVq$ zCR&o&hy7=Qp`??-j?wR+b18EJT&0LuA>C|Lj=!}RUl(jF-{&5V3L*CktfrvFza;&? z%O(!m<{=LUjfcEXI~J4QQW2Y7l{pN_y7=;*tZ=qiBYtaRccVLNqJ}aGO=63bg4I#V zue_98wc{#0vvx7uD9Bq-Ir3vQ;Xhml*Qmp?m~c?fp|K~oI@(BCJMP14TrZ>^mrS$cld5%LP)nNy@Kla? zr)hEuNg4AN5g4r@DbzFPD5;)L2q4;*MvF@J_l6&yVTm3YL3>^zz#yxzUBSwgJJgl$ z-BL+-c(MkZZ=YGOU4D&1I)T<}nz;cQ8D>Go`CQuUw%?4wa^KAwPc=?o3@2iffFJ0( zE9SR`neZ!d&S@#caw)1;hnw<#wtDxq(q;CF=vWi}7?fs2G!ZZG>Z_yFrgB$^UHYPL zrr+YAgyqdyB`Ctxp{`^O*F#ynQVq+ei##c(f=RH9#}eGAq~y3LrdOIxZAqp%rMywzqwDlxaJFoE_=Uc#LPW-~>olx~_~ zGKMg})Q^f?W@mDd!AM5ja~;bK>|ApT6`G0GQJXA`1R;}hqBj&HDvjYX7)A!sDT64O z>`h5!1`${-^nh(a$XSpZw}ee8(7(^$xbECoCv+17+sk}?Q8LcX#Mc-Jb;&iwvQOE@ zu#17U7PqPHLcv`SpQLcF)V3%uZwqtGw;U)@pr@2y;=C6vuq5$7qFf zX*Nzl#_{@AoWbrz(z2+`roP&t5zor2vC!TpF+fsqU6NW*VKBeN5K6!>EG;byn5H4V z3H*hI!5VrBtRC!Yxp-#4xv@m=>Dk&=cavHA8Jmkw3&3-d zA{o)4=wq8{k2Vk# zS-=_Y+P=us?3Sl>b@BP*uK&tZ&&L=*ZDnNWn3NVT;LpD=%_;ct=$Mt4qyslq8P&aX zs-xcd8xn)Wgt`zB-Ir&}e8F3U;wsI8H=Xwm55eJY#9c|Ute%E@gpdI#rHm1Ar4IIR+y%#!Gy{MHKMqFOBFO zLsr5QcK9Cl-(RoCIo`IC!b`F&!L)MQnO~Q0?@Xhg;;W00AwB$o=EyGU=HnH5u;)lx zS2l}6YD@G{z(GgIQA;?($IAJPKwzth55@I&>1HiFfYg0GE`w0p>1sGInxk$HPZZ_o zL5GW>6Rncjuc36%#uG28@%FPpD6^Jl^@ChfBN4I2+&VA}V`n@8>nvrI3d7%W?d6=o zYM4J~qX`9k4_fN4jLQ*|OH=ci41e}&oL*w*Jzf;R)(LEBUe6ynctZTu zuKd=HCGmx24jn>MDhNsmGU(Iqx=C!7f9D2X2oYSEQfD3(7|hT0dbiwi6Ch%K3ik&W+cP8h^dlaxQwS| z5Wq{`_|UUSf}4yJZL%PSqXeTf4cW+qXH5DaTfgW zX<%tyMcVf_h{$5F6p9qowK2MA#2*&xnD1V(;F8wZF8hN)_Z zLOI8=%Q1g>vpx_%6v@SOxQ_oN0}(iED4A1<3S&Z1C|;PY+1AMdXGUcb6Qu0eAIdtF z14pzl-H5VfYu@RGP)t<94P8$@mJ-IqL&Gi)KE=YX{VTg-sm9F1}RG&>`%^LMn zGt#R35=EU$3Ac_gUu0%I9!f33EY3|y0i3h|w!VwnqSH&sNWit)#=&ahP%v$Iu}c*< zNklU1zdA4Qyeli|>Lu4X_DVuvpiM#XqIv4=YM!Xe{htE=7z8tQDx$^|slp*jMQ3GyS)v8#tLzbn z$HMGG)XUZuPx3P94dOOe2fsTs zFZ@MXI2Vyy^i3lAb(UeC31GF;tq$WhsJwNkax$60x{@3mWMQ~_$gs>j$dmL+WA_~t z($%V}S0lSK4Ykr~ki(1zgt7?d>dEc@q$*S^%^MOI^ENsZEe)zZ>D=_(cn*$)(>IEx zY2APFe^k-l{cqjP!w(?_gY(mFy6azg>>U|RT1nwpL=kvB%yHtZ4;{tvvwV?c|5V#piDm`n6ec+C+P&bz#A#!h${d%8=}+XCyHKp*UK>c%xK?D$LB zB;B&8Q-NX^V*;Of^(;AE8fOLWW&$;s zl_<8K+tQIhDPZAOw82(7CpqnbJl2KmP->a8TvAy!Wulqyl~hsX*j&sbgT$eNC$W#1 z3fR=gDOpf zKbVZze}G;-`-#&vlF6u!m{n@xUI4EfdHcwX3GtDt@!K;OuELbw zq9%IiYdLR@d)s>x!r9`df3h5Fc8wire8|=+_4^KzdK}LEGbu-rQT_Y53QKjh(WAZb z2Z2h|8iSMYG$C@YaIlO8m>OG*HjigF+mo@uB8KuqDJ6+pCdcRnori5I58N-r(fIu{ zq}mDY?O+nm31ag-$bN7so2+5Dxp;`8bL zV2>0ChD%XzHy@W=KLHg0(A%0)IQRbmz1SalI#TZLV=v&Iap7!#dQd5L@(mUm~~THbU7DkPSS>%93f<3PzQTuVVHz*F@v& z3PxKL4%R6g|JW3aZVFoe-_tuARE{^){o-bYgG=I#|4d7%wn2Sm4fk3s0L*TTBC^w7 zrvOa*H-sb7JstkvTcws+!#nriF2m>nS5*Kf|1L%mZHvaeTm8?s0@Uh%K(C1Gb@nY_ z6Uu+9ZJGO?<-u=UzSg}HC^52uAxj;?#hh~#?n4^_0Q80k=b$=^t{aWVLCZAz!Kj7B zJNxsmie+99N++vR60JbL<#gqIJ)G-*S9EpZ$3W5$vOS1;j6cFwfcHjxw_DvdIrS+mHLIFOvGCt z8BwVz3GYbW4w_qP$Q5n5DZS2!kA%iP)Rw@}0S@qa#mxTW^G3pD>fx^3mw0aF z$B4(P_?N$8nT2=SvCuO+?6tqf!z0(W2|uw7N}+5o6>UMz6)WkYaRf%I!aWe69LXgr zu<~C7$u|bYwDh}{2h0Wfl%4#fZ6s0?Y6k&k0ZS$^bg{1OziZyoVVpHg%GuA;!fqAW zs(^IxBzRQw-r)kV1lu;SNG&GI>B9rb*?jThUbWh3oQgfjp*Jrh0uWv zP2CS@-^|0UVA)vqryktc$IVrr##?!O7IyofEG93Ss;{ki2VG6@@!T&t zq}ms5bcWK~c39w;_c^fgsqIptFoOfwtSrHXwLdwPP%(zM6WLHhl!I)!k!u)e zjoFeU4BWDWzx$Z=?x&YEVa2x)z9Gh;_s1op->hO^Dcyr3H4Ow=IZM<_qTQE(;D+M7 zs5bp|Uu*pHXiei1VSjC~Y~O|lf7KJPA6KRdT_i-No0zF@#cyz1({yYpTD8-x6KhnYU_e$Y@KU9+pzcty)H9)0MO&KF-I43far zLe}EM{uk#RPJD6jlrGM8-4Gs!nU?4Qi{sn>}&7YT)D{YUTubVgdX^D~GyM$9>1ZhcM zlk3mAprcRC{$ukh{Ihw{Q%nS8-fSC6m5vp$-sYw6HPJQvf_L(F(p9Ylpc^u0IDzR9 z6k$8S%ob)1+Ci8+84qX@wiEM82;4{%X^rcuQ+_pbCNbhp@^=@*FPuoa5EKS6G)B_9bdo&E#sbv&i6zTuu3uAz=)- zuqb^Bi5Xr=kRX|{2WA=D!wE)bv$;Ja0Qzx`)XQ^@8cjr#Smn=Fxf^qv2}UcAg5+TY zGPcw9x6^B?F7uhej$ds99o^&7D(@5;Ihp)XeAx20FBqltU?Go7izwSVc%Tcu3#LT~ z9yq)r^xjFvc|~jNH8pY>HK2S! z?QOpq9JWz|2pO3rPnaP&CT5)!7N_;felWYhKh^Cg&>Hg+uYlOkZA0ro_LT zDb08oxxV8tb;<#%y!b#2v&??1Pe;Rpn7mi%N)p1`!>-rOnn_To`wVC--*p8+&x9gi ztTHGjg+(N2Z(x*`$${MsRtXGJ#4Kp|xm+zxXBFWObMb?&lp!N>gamYqQTT_@)pIV8 z9%?z+D(i;^aYxk?XTkL&g-|Jv=o!p6ZRqESs6zYDDb^I zxTuM1x&am(f<|dQw}5LQQ=&89Je;AS@k1OQPE^rM5kkcd@uQcESS>HNx~j~<_Y2{m zPpq%~4nz&Fk^xUXboA06+QKcI%M)q*)LmLT@G3MH8J2rNT9c?_keD&=N7yRNQbV9l zn3v$Hp8>IQ9#)ogRBSYTVMThP@{mHG!@GhX$|QLEh+#1)c&1DrPbAhjHE<9uTHh<6 zzDQLwjj(?W^?|d|e=1p%%32E6?mq{e_WFGP{~i?>mRg$b|2bL@*OJk)aUI0~aF?3S|1J#p^7Y^K z085Hm+=_G9&}6451`Lu>f>|^dSaOpI$`$CS&FSgDFqTe4(EQd3<@9AFCzJ1?Q_p~e z6FHM6DfKzpyR0yf2P;A=rHr0$>(;3Yp)YQ!+)P`lAFV)^xzIENPhkyL2DSU?!8#O) zRN|!o9vp~72zMK=j)5u~UoRo>LlwqsArB8Yq8FZs{W4yP6e_z-eI2X#2nEW_UngQ7vx^GjCvF4N|6{rhp=) z7gUNw>~@+R!y*V>oK#<gteyXm#K z1;dM?16$f-Oe6Vd5MXbi27i)^l%_kOo~5w;h}1+35vYG4yH7tBiVlA>KgNWw{q76y zb;lBiEH|nWve+pj0Y2c-b>fR2B!U0nc4l6>>FS6y-pIs+N0+h*TaM}%6)32;BdIBU zcnN|xtl#C@Yn7XhQM)1hD+&r5T5{N2x=GsxBxdav{;Wpd$TT({3bRKAe}g;t1dwVD$Er{igGEZp?|vhk^wdy}^bz zrohoTThZzHy#}&Z2mzm1sGY>CJJytv^-&gLi?3)DU z+uFUfcoA*a!xC~1h77O3R+c?C8nzVUw!C}wk!xcAqCON14oGYAcP(HUn~v6CuWAgI z-CEG>YP2A}q^_>x#*KkPdOV$Lpqq5y*UqJjCZJWu!|X4xFvIwn!laEV%#5UCcViC@ zQWMof1+S7IGMJIk<2oLqETI^QC|&Ho-0A99cA_g54r ziY;@oFc(>p@?Qubf8z^E$To}C+)A}4dWkhg zdz-L@Gf!D4-DVZ&%5atXNTuf>xhwEbhWwsxP^Em9#O|@VdzdaUd)_9DS3Uz9-qKtu zA*Op@GvmPcIR5lWgn~q1p<=?twL!=XjC2Pq&TDKtqv40tFEgx$Rs?^ZGxt&^AYzW~ zVxHK3T%b~#bl2hL2sQidj>}$Q#Gwm0jsx;M?ABw7}DL3ZF z@g=Nw0%q~UL^R9c90Z=#lGbEXZFu@rRSO`qeHj^^jQ(a%=^4=d* z2NjlxQ@ZWBte@(2(vzt4VZ<*-{Sc<0yOpK{?b_xIXYP% zg@`5z1#K$ytwu2fU)AQu?b1UX$XjSUBYJMzPPDb z)nx>35#)y3$a;-^M%|%L>Wz>-5~o(wL`-H^KPeG@3 zD0R|Lr)pZ18Ch~mB8ri&>57Lc|hFo7t_Cka2HgchL}wdl_)o+=)e{dJ~GBB~J{FZKb0S8$0! ztu~kxo1ypfQ&{?`tZd^s+f%c?6`>;wF6X|V7ah7tm1{0ZH}`1;{ng;8|5a=IqE8se z5i0~6814&zO*r|#G_!Lfb3X$eEkknhP{v>kiwsx6 z@7KEZX`*YP9kxazpWRe3M6z@7?sR$AIR&_{M-;z9%j%-g=({ps&tMXx!;!Xv&HZTA z7}vB{WMOced=8E-U)ND<*AH+vg=yEgt8i8&4OJ)MlJQvDqh=)gOqE3|nuL6fI52Mc zf{~L728HH)HkoYUd>L!teKBO?slI4@E!^8>Ht#PV>8IhGyw%9N7y}! zJ`D>d_UYlzX`tt+V)8=uQjBti)us)Fd}3~Wfjweov|j;E#b8|x^4uu{a_RN6`POhO zK%M9sT)T?lF1^J~_kx@tlFbR&Cn?9LmS1=UJ<4D@*`EG09lrAT4%_Nb%_hs9CCnd) z)3ZYpmfVS-v5oRsgVZK?*e}i(iQ?PC6g-DdR?%3(Neo>?!qj&we z?_S>9P&Dz-d4`{2j7Q*P)K5uT_r5dq02rFf^ytUvbr0CG6Ghk|B=L^Fj9G(d1pk6xm0vx zSw?CxQ&}`vO3LBHq|eT8H5%Gw+#6bbM0-iMx5Pt?Nq0SfBU@dfj#|Q1kItrf?bU)L zFQko@3)-&%K|zp(in^PW)2gqHNb8lSWoX~4E3EeUF*wU^lzwpxY;uL&g5t>U9N0C` zXxHUTrtm%>DuV_+aibqFs|Bawpr6MJzmK%>=UtfIKbI<8{5rSn7cx1Tj&|Ma@6&@k zo%KDdDddr9$Zk*9SHkA!@&d$Bru9I#J{2oOA3Nh5zt%=Nx!JR4dyZ{i1O!1yd_iS; z44h%awB_hGlTCv8s}pCCGR~$#2#)%#30v{b2fZK=Afi)NqTJrP#DCFH>5mpI{Cgoi zS7nppoOmT^H#6d#-p-pGv37`E?N9TjNYL}>HHZTtvV3uF>a&ceCzR<9Fs7LbLmd;6 zteofEEng>1-pi><%(`fUq@DM5X}O?V;aN1w*oM|%1MBnxX>}G8c^VG`uKzW9(}y&C zJS+L|%X`U7Fy)pxzwx6 z^BK--z=$C8hK_Cq9KZBE%D_6;Ma02QWqN_f+N+Raqx`&IL@*n!HMcFlT}Vb%?VY5K zC^b9uC&3dZZ4KcRu%+LTJn*$-9|WhZa0mi`yGXLg2--0(@USz$XnrB>AN)7yWbF%P>qkO=pO`(6ZMmQWc0eF1wV>Xyke4J&MQV zEhWKb5yaEgAt(O9Z`ymfHj1ch{)hCI(U|46kQpq)n6_lGz0zWS8@0OmZs!;ivpm1c z<@IGbn|9=+8FS?Tj6J-3v!O4&qbL3`7~emDoIkbvAiYr8a^haa_1t1qhe(?Cl{xp- z$ypoDGVlCoU_P3-tfc|uAc{F z?)YRV5)+D8&oO>(l^Dq=`|ab!E$qwV?QK1^1r)|gK&TD-uTLAWI)3iA=jW457N3>x zB^d7D(A%LEc`Pok?~_&7w6zE~8B?}lsKp^RtfA(U;4weNzf=&4bmp}^Oo zb_^CJa<+9O-fbdvm|Y*bbE#GMM1Q{&t{L8{qtuN55X1Qf2UuWnu$Vl``Yjn+U3N=gNV*J%Of`h zM`VHFaT1)#RSM;l7T!jJ^xNJ%jvZrNCbGNvA?j$cApZ=|ud5bi_D6b2dnYH4JdkHt z%iov0cY`IgNq%{!0a`!fn%-f(2(7NrqnYoOIW8Xq#*j_jQu0{o0Sj(P+p=~QtdvpI zs+y0t;LRyo@?5QMuhDbOTzsch!PgR^-wg%?E8oClV-1aO5(!^IS9u($#<#JM6Sxv{ zOI(of6uq<_5-rYB>3^Bt=JnVTl;*}}3eYa`zZB!uUP_5uC!|A7*bSUs?N1@m>p1Z) zYZ3&f1}JR0?|hU1jmQdZ!l`iq?MSxrU&zZH7yhD6t>)U=g=5{SN~P}BUBb>i8hNb$DZPNdgs4?? zL1Qbwi)?u~S{?u7)eACIJYqX_pl9+MST&(5aj%;Z7AI!b@M#;GlZ|4z4k+HiwYLPl zn?4Z7*?E1Yib~3qrv#H|C;v7*Un%@;%0r>HSeonLvAJ&cWim8Dj$}6W*9Pu%Q*tf; zFP=m{X;af!^v9ofp>u1yxS8tpe(KAx%dy?=)i!?Rz87o7(&W>J&1-e+t?LhgkVqj- z!NuhXdzS66@La7JTsDPhGb$PoWN1;LT6DcJi`XC$W}7>3>^;CdCkzm-0HZ7{pcFI! zyiUA39D!8pdT`t_VJm#Ad*HmCTSmTabaADZ?{{@`52>??g`)u9N{Z>QU3p?|fu!>v z+-V)yy9yCFnT-harj0XXe>kDSA{NjJP}4rD@LG$i_%}z)SytFOlbzm%yH|A-s?5%|Cy0beqUASwj{03C8OX z;O3uip}6M6&bX@YjJ+-RXx63d=HM5r{#H6Dz)i=?oZsbx` z-{8`=t9I0!6XlwOMA4a`gFCoOAMHNrFLhvvzg0^hkE;A~Fa)X$<7zOR7IYY3rD_}u zvs(yPzYF3UN=HL?1atmzdJll9Z^F>-dMTfACGycO%;qKi5`oRK=#>?>aw3mDUiRfm~i8gm!dHKby+g6b%Q`BN<@Nz^50% zEjEVF8_HQL!EVKV#967qA1$T}Nzsi^0X zUvE20i4Z57%WmVG96#&jW61oAjd`DldfI!k{L79u$~!KoUJ|NbnbB7yZL~%T5ZKm@ zQ7_(!2s@dXeGF36q`^uh6##-s)G4)s*FKQnu&wX?h!*JJAx0L9*5RV2NMh{xXj!u1 zMd5x^RV+=JWc&7j)oxkGZ~tmN)Q@wIX*9q8M4Y*+VptTWPjTY=z4%pg70Z8leSP`)GId^KTTSOv{ND35TE1HKdcNF6Fg7$3F7Wi+ z^CmohgFjofs$=87#7WNzdq+AhH5co5<}I>gMmBi_g+jXXZ!`uGvjrI(Y`W}U#BK-X z)2Rt%H*v$yDdoud)y{NuP)D(%%mgWs+0D+KIaNk>NO=ClgtTN4uqpBe`tQ8aSwKfW z0C-R8ZT|w}A>M{WTF3LVSi{!dbVNmlBGnxfAOd%j>C{9d(zLrAQ)Ym~S}pO*sNIxc zV>x2lQh%~5L7A;hgOU?H^DEG+!Z==*ULmTY=)T?vp;`Vvsn<~J^-mN`wqS=?AS1jW zaRkj5VY?Y(G@}PzlpO@yfKa*{aJt|&q&&ER8aEL)pv~W+_&N{K@o)_!{Ta{YU2ww^ zaNYd<%PEWXN9sM)_;$E_VyI0PnRw;clvO4CPwIV5ipBhqdMBO4ZiyXfGkHZLk9Hjo z-9LrYCLy#Qxo9g8rO3juq^Z-Nxyf@1;p&SIkWDq{cmUz1m)fl(8PYVBQR`uZ=lW`F zCu2Dp$7Nl&x{ec*xk(%%&I+|g&M)s#(6}K6vrtU95O3d^;X|*@qDEFAeC^(0xr=K& zv6*OK?Rv7|w$!G?(k36WmjCz}AF>+hMArlfZhc516>x;vNl4kl34#eQQP2}0%^I)w zPS>cg2}p{;pZnPzK-Z%QJ^WdvnBXI@=?)WVrjnVo_oB)r>#EpNwx-(v@auip>7BTKvIvW zaJS%?k?8sW)@zD4_Cg}n83m$2xhHi!)^5dv=?4}+2wRKn-`Q)6k2a!)`d(_@e1qfA zUK_j@ipRVW0Ktw>!RF$#X&v?H7iB1;Qga2Q$XI)|ner1)*(k@;{DhQ2zj0zrcZV>-W1Uul?tdFZ>s-a`1P} z_u_`w31qsf%&a4YI##G{>PwFrPY<008_NXc_j2<9k+gXcG)}-?z>)n73!se9*Yyj0 zg~^t4s+Jgzqgv|RNE>@LOJ1ghuuIode~uaY9a7vL!D(c+UnykNlRB?GL}NXbQGmb; zD;!nz!H$LeMUuwjgQ0|Yx<}QXcdR!p!=So&e zmy2^!ZEY`=Ak!?e;okoNMj4~z2%B6=cOt7NCddMb69xMUY5Nyjt1xUTU3O`LYDE8t@n`w@{ zIkuf_J4@m<9Qc;u>D20P3IO7X_e>wd(KHN1i_jQda?M62%zp!V3?wke>btssCu?pu z-W#PiAOY$~h>EUw5$SkM2QyL@%nO#9mCx8qz-RZA(F#jB<{*g$eofkNGTT;VKUD9} zY|8EZQu5+D{a_>5vg93)suP*4zHHWkM78mR+fo?#IELTg&?rAtui7M`i{scngke_+ zYQ7O(h?!e5xsR$)9XXEve^f6mMuiGcLwJ0K4v3b7)t$GtF~`EcBi5OP4-44O(zBFv zBk+V9;=WTKj1xG7~o7Q;W) z-)e0gafCizJr9!*_|&%EJ@D|m9$oPwBJ#<#1p^*b5wcQPTZlA%tD)O9PPyas=f{+5_z!glW5>mpA_32mg^i`81iiaG>g>I}wyN*w#MzPUVn`K+W znGni71=qv_6mV&ufW|lnaaR{6WCoh_ullFLmD)x49k1LdgI+H0#f4Pnqjb)c)tQ0(KdV zK`b=oQY6|Z6$PWdVK&2VXO-F5o%#!uABWj=?r8xTT)a9JXcqz zL_w`Q`Wl2w?7wMh!=WYoWe2{hOZK~t80w~Vgg7P6CI+3=I~AdSH?PZs&Rp2oU8#8W zIi2gl_5gN322_)ZZy>@%pDcgBcY^8u_j%VJyi}+1pdYMPS;t^r>mRR}Q}Lk@952!c z-RTe3TSY_N8&IUeDd;Q0?+03c{D$M1Z0=JNdfFwmb!m_=f`}m^Wwb51F~nIZE#Qa1 z0z%|e%*ca#nN4c1tGy^RK!L7 zL+uaih3Wj=+)QBicc@ROmrJtp@N&dQGf}BCwmZS(Bb)qHdmN*R9NMGwRh_#*#j3e{ zSangIv#YAS?rg0bXX>1!0*4QxyC?m2nj!}5R>hz;Cv;P7!c5(Re&hsi>;(@w#O^0p z&bW|&Od}mhjY4@sC)RE0iN>Pw7d}PY`b#?C^zV$#^CX>L)pef1np=Wm9QSxdqjN1$ zd=k??d1{(BnbSd5u!@2_u(8%r)Y}zBm9pA$BjzzqP=axYsxzN!fl(tF4f^?Zh z&|R@21@-fJr`y~&`jF1@4yJ#)Z_a*CE5tdq@DhBt9q(sNY-@86B{SRZ1+iExzFt2f zmA*z%8{gyG;Z-BX)G_=F8GbaX)#qg1RXpgr#ztQ`7NBV@i612X?1yC*F)b>igERHi z|MQ(SR9cKW#^8(kP`JEL-bGKl-B?ziUW)x7^?MN4+@L1rCfG+Z{wVyPP(eadS8=I@ zw=p6^scz>o2>rieb*U5$uzA2EsMO!6-!@af3{Pe;E)l?#GAXIg&mX4T+w<2+a6y_b z-^(Q)^2ngtT{W<#s#mLXAs(vyRzCUU(=PuU_oj~yne@cE1$P}SVjfN={VO8s#DTT; zbP+hV?39lrXUqS)hnrV#G?qtH2%uNnbPIgK;>&I4JJm)$EP~0Uc?xpctFUg?ai)ousGRU6@1)`_T!cB#x3ZN%hts$OzIQ(e6j|@$EKv^Ac>gSW_KU%NXTApCL zd1uY^vhNXLfER4uIDx2w_8++vV{&GF61pk7veQw1R;^Hy+ZuceB6No^*}sKWig8FG z4e{VPQVwRviT-i&q$@%)<`dfsn?I=kxDxQ12DGW%zbJtPyrMeFrZ2_ojsg{87QT`pO5$K^|j+r(aY5PwR!8;3NqB(R!Vss@9cK z=%!kQ5{-W+Wi(>~;RB$kRyu~`tAm5K-_^48ZJV}4xkHQq+Hhiivl!PBGxH7rk14*} z$>Q2$;0xIiQ0VOlJ|-I(eRCITPD^UcniFv(r=RrpUt-D-BWvaAXRq@e!IoOQW7iDY zW4ud~?n0HUz^6D}ww|nzyMfp($*sny)H}~aM<==75oCBZb7ZjFeU0RuT=lFNe^cwEpn2D7oVfr!6_gul*dO+>m z1t$UN(r%xmiP*ah$i~hZ;62a+7OY=d-W{mrq~ix?LKf6&N~EWi)MzF_YW1nE`6Hp) zUmP9=V7 zS&=i$9S$Qb78v_0GfsG9@5_8qRRNwYoo&DjlBHUt zHwxT!R&we3l^z`(exC!FmH0EJ9o*MtU2;SzI!3N2*h2D|&4;Y@(o8WMT|5^g0lF`< zYi{TN)GSY*yuhPi+RIiDS2pet_DHTuBke@<4e`hh;ty~uYe}h195fNST=t^fx1IU| zqX23Q;P78G`2TUexn{RNTyI61lvih{f6lr0SgoX)1+JjX`{H$X$A4U}kDI}ji*OzY z9!bulZA z$@E!$_-nf{B0!X9Ox#*%rmWLj9QrgAXIgu4AXnrxQ|$y_Ea1^%?lUBr;v`^9GOpe5 z(ruSHJ%QVx3)MzCE|kmk&M5D@9(A?DI4E1R^&e12^iFS2*F69sAiMu`x@GHy&f+cG@I66qjZLw&(S~nae*W}n{-sJ5qFx(7!ox<+_ z%TJ|GoB97XU<&e1Z`4Das@WJZ>@LbGz-t@yJOAN&`41e(vj)D>8`Lb7oVKQuH2;OB zsNBZZ>2GqmYV$I()5g%+)c`>l>^A}ES}$Y z*z{-8o6{NU<@tt-?->DGHHS(irj7NunPgv#R_r>6wNorTW!P79ZtO_WlkSS(alyLo^uH zl4Y6O7%X2JzZ0X6Ej0qdjX=%afOFKMdz}kT*oVF^BU9}$f3$m82>M$=E(5NAF#JjUa6uQVScLXGt#?V0!m5{ zqFbJ-QT{ML8Dz~nlC|q$n9)>{*%tGDD78j2*#i80GPxK*PGM4JRc)%avJ6B{8d=lL=gv|)~&9);CG9+V( zcp7-H&q~?I?BhH$a*dMTW@dKD8Wn6lmCE$O--rQ!mG*9^Dpn{C5 z2HhD}gSzI=$);BFwNxr;FXlT7wxL7wqT*v^q18+$;6on^oB{P?pnMxncwDEalm(g~ znl6NK)k9yx*cvfUYZOC#4prDg1<`irs}J%lZoB#~9bB$Nh2M31b8JU4=ORDO$tsD% zseqpr!B5D_BC2571YVw7-<>{970gZ)14IWAiRAgH1G)NW>$?G7E2KYf$Ty2cQ;e2P z^djhVlEFE!19H9Sg#PqlEFEhq{o6Gdw!y@f&49qN+WjtW7f5YkN;vvIvG+uaI_aDk zlD)K%m!thN8BRyn+&Mbgcfg%a7LLC0j`Kt7jVU#i^V*VPl9!dZtIMp)dThNnAe z2!@#O1Z`m{IyMPd$U{<}S>h?8#wFMgRq~guhBZt2nrGY#IOZ*F_h+fAtzU96Q~{^b z(`X))GS3jTGXNHQ?vEB910t%f0i4c4$1)xHT_^wCOKC%+wJIX{;xz!2faOuAxkwP_ zxuF|I84f&DQGzkcJX0Ih0ZO+lX1y7`+c`Cs>7w5`|LQg^-L~BO9$p!D<%LkyWi-Q` zygRu{y26|Z&>QfLFmYGhE2YGnpa{)k#D3%Ob{Vx{{0H_@+UvvDHxpzBr=o`WTOoEc z{!4|uk99@Y^6$&~xgu6Os6>Xb^mo;Fh^z#+pO!?pwt}CZoW&&48G&i>>LhbWRfN6v z3Q;`LIzpB!^Mp|V1^FOHn_eXi8O=I#!B=TZE+1DP(7m#r%zjfI-1b>U<45Ct&N6?} z4+Yg>JJZSn^SV??9gkC~Wmf(D0ekm`$iW%p{sVh24V5+z2m)-nzC|W3Vg?+Kc&KFf z$3bI`dR$%ZAuQtye_tN(I^@#LR2`h(WfuO%RNj~J!_2ymDO9r(ogby2S>`j;F7>2) zQ|4{8=&VNqGW6AwCbe3Q=c`h3g3mq=h9HQfqi}8JV)t3Blj73+@vv~Y9UJ$=$}>!D zo?0JG9Lrwsauc1W3vIhU0vCw_PkBcto}a)oWXql_$XQkhYTUFpM8iUVeXW6s*e%HL z%b+S4k;_1T7TVeZD0Mbr9;H@083(JB-XEN(z|7#f0Fz!f6(W~&?8FKi zs&e~yWJLI3d0}~5sN#)j-WAB=Jr%icFVyc4_^oHzcKhGuae9wS4G`x4fW2YUfwi@s z<;AK}voQaGy-4`6z~}8F-0bCnyzkX_pjpyCU~jZ3_+YC7FDt|G8W-^<6H3qz*vk{? zM}?aku!X{sJZpE^oAL`?WEfXL7Clt(<#0Ce+pfDS=t@0Wc*o+UBg{k?j(8$vhuIPa z7r$J?RjYkK2|oySn*6pA-e|emq?eAvSXY#Rr7NT>PrJrmh<>1WnYh$CK&(@7I>R7;|%S;Ml`ca6b-F@-%veD0G zi3YhivbNM7nrS$omkdw^WlD`g(QoYU|9{C|>vi!%hmD@J!f>)AkJc6=x(<_F1B!qp z5mlUemAWEZ0e|*@N~cWCjTZ;2bOb=qf`FsVy4-@0$X^t`DYBc4O>wRS5tSnB>eDvO zx`5Gtms#oBRRBEnc|DnC|hz1_!5tct_ zuloUJ4VlN`OPn$BpPtUor%+)E$V2EIq^{T**a7c zwaBoXh!}X)MNy@pdk;-$)_`-GG|$Q!WdQtT5(bn-jug|QE+wR;RaH|Ma$?-&!b8nL zTOLeoX(`Z$c;@|H)5a}EDpGsMQ_!%aK@@S<;pmSfQ~Zc*5|t5BbJy!6n+RDJ{c(Xl{DbKGsC#smWPuI(kzXzp+sb-e0AF_C+q@0mAO_Fd(ecSR&z$yTO&f zOylkO-%t6u-uTv?MUAR^54iAvKPFRiNJv$lfu)&Q)?O$(3s`>0zP^i~2X^22UzT!% ze*82B^m7_^wh>+Vtg`+!DrwV<-sx^`+^Z{cv~~5)%-aUV{XWdF+NfiQ)yLLgWkRqT z5<6CSc4oCudIs}U#%IB@CiN89F1JU0|3(a9Zz`CMq3$Oc{&3)fIWCsMTxJWJaWfQ& z!g#Zp4O|oB#cTQXXA`60p^skBe||W6wQ^4EDw>^*of#@ZNW~Gakjej-?X3wGu+=j~ zg%i{rKBdix_TDvg-+;FFn1XIoSUC zq-i~%rXE;IYd-!TM01z3rDZPHNCUGkXIj>93lFpZK`qOjC7hS_S_qqgm}Ud9_1XgKmA`HI24bpYOpIc@NOuV^ob|jCat%>x(wjG0 z@knZMg z7}96QEs{B^P|xQD>?N$pibisY4!kA63Ex@AI3||sHnai#cIw7D%ws0OolN?KQplJr zB^FmC9##zoRbOH_*jD_9#`rDTo_NbeQ2O zvr0Iq8wbmy@i}Hq~^Ft6VRl*Y)k=#uN8cilZXu`(tItxn10} z^J$X}QQ{mk$Ijb2!|(?uY*y{15~gGlEoXG#T^R>_qR$m9?iz8>N#$ymLia+bW2DBY z3kVjf=n=`mdj8Yyp8Cn_!6sg~D`9nISVj>KqMKZvK5#))3*O>pA)1E%pD3nYYy%G4 z9pZW{5BOj!QB(e%Vu^hh_L&P^JrAY@WCZ}5;U1kib>{QM!~x# z!qAJjN{S(GW+gV9lMgi0Luf~S2Py%R%U|aPc?`GC78YpzsrPq_3}Z^S&EGVaRFiXb z(j+(mM4=s~7$&Ngn>}w%+>^t5hC0&CO$3;>oMiePA>BaA}4=xheFQpZQF~cAh~%nY@-`I zFLi;*IBsHCxp&oPvuM!ciJdsvh<#-p)Y!Ad4^CxD-4_i1T&65*Z(1|w$Q7r_(H8*- z?cTbKK|=4bjk_xPeBDq|X5+;sn5ufXLRzZZNtm_cCR!w@XPVrb%N|=Z1c@G4Be{L| z5kU-jY+Dj+Cki0lY|6R$6Q^WriJv*LCbn9sSl=7mj5xa5Mf859BGydNwK6GgapoAT z6&xGQdK2SrBteG3iA?q6b461%X_!wX&-?bnn1o<*q7qL_6zbn9SKRy%}WZ6Z%W(>=uz za+y2Exc?B37Z)L8<<$Fzs3sBQgkR23qJ9T4Vs?OFj_zfl4Gw%^rnb2k+7_Y#Z8B9< z@0eS&{q9}!o2X**zt;j!=E{S`w~phCOF5^pLi^Vq=0)42A^kpk%PWm%@SysnpH`EN z-8P-G@9$Mpz=M8Rp4NX}?#f%0+EUh83_<^R&#*JNEY=`;uV05>qn>jTGpH>*)#Y zEXy8pwHS<0^7d~P3Bh9c*?^OWb2yVAAwMdnLzt?#foiQ}T_#5xEX{9| zqBGH$s^`;$TfQm-l<%#cy-BnMi;z`;9FZGgaFg%pG=Sn0kpm}4ZL2;@AR6&P=*oG8 zLMAXNy_ZG{sf0!96zSzNtd1CrsB+!r=jj znTPT1dFyd;V)@-exIiV7Zbt2Od=qmLa*KyY%F3X+3+n{Jw8P(vedNTDRw-HOCK`2J zMn$3j^`AN>VhoangYJvp9#|%%| z;Rb5sA8Lz~-(+?M-;*2@RO*^?v$6dAj0EIuNpZVJ*Uif%j<@l(_Cti@Ckz>ec?WsK zEfEcZ5>kq0xV$_I&!LVyG)r&8b3f0$>C8@#n3!1PH}BiW>+N++jcTO744>z1 zM?s0$Om@!;9@pB7m6~>vviir>N#C|+=7#M7OnYixM~R%B#v6ZZNKO|PpZ7eVC-_S! z0vkjG`1TvZ4qS&*+Z^XSdn5jp7qgAWok_qnlWLqAVX!9GRb&$LIvG62^6AycZ+Z-m z{xCrhRFjq1$F1Z0(f2AQR4z7DEU;jcf?3*{0{R6b%|J6V*K?BGk&FD{d$9(`-$nct z)iSx%*Vph%ckqKEn-8IL(LiXi5eJ@`uK|*50&x>o4scA_Gz#%HozM|{__6Y<+m0;D z_YZ+)29U_~_x*7WuO81gJ)dVc?>E676L97>N+znk!M#3fEIm~6!A3GGx8O|d0V=II zql2%kUG>}^7;gi6QmP)Zpu0~%%+CsJyc{{3Qrk{Kz{X!80_VQS04SwOhL=-FrgR6N z^XqTW6dWMr;-U-aH*}F`UrkP9NZmC~LGCyA8oA4ZH#T}!=v7X}CFAdmLCwF030bI! z5U0;&`RajOd|c&^^>{@R;P^DelX6cfzV3F#BhVrV7n!*Pu7%_7MJ_&1hyuCe>xU&_ zNV`ga{Wk2y>1{Go?kT+u5EjU)lPE9Yqc=PI zadLDqzNMrt9oBBaw+3YKZ$Q(XNxz4K>&*}x%6HwL5}W|J?WVlO53}0?>=-RI{>O}v zi#v46w$5Q)($6yqAS6pswrAuQOpu17as>z><)YRnP~n?2eAMb1@pq0vw>L;5J4INC zz@5Gb%KsibEDn|T1=5zO0!@=|y0w)n#W7P{c#`S=In-izMEkZwY(Ci!Pel7B-PT_^ z`e|`yA(hc>1s+=6d*XQouGluhmu!42Pn1(yLC;O=v~-tc!hHT44xIzrj<~8Srwpi8ThVaY);yo`$_25%8e-3t{_hp8O3qM&u z8aP$Yh$b4F~R{!SsA-Hzi>Sc+GrKBJV6 z99XAoKf`{pzKv63!SUV!iAZalNSrITuztU?cVG0%-ykE=GaMPX(6Aln%pp0g=Cx>cs9^`1GIU`ew}Fc zYgwW)_2fV3HQ+Xj5}zaKIBi{~wU?=brmSSNcD`{`(xmQPU(Slcy@p=^+rv9c(F(7O zxfJvX8BVhAAl7GZnZ>3|obNaGsO^RxyRvjd)hGqFHY3c77?|lslox|LgnWzkpSh#c&zvU?DO_U@7v=} zg#YOPPa%onHsN0fi@P07v)FF=^T+vi-0r83x$p$E(}R zgPUDr;1lIU1hrgW;BGghI?OoQ8eEWdaH zFyQp0^z*k3h%w5ofJ0GC7~H-6^0+Z0YOj4^x}>bP5p~jW@&NI)R)MS2PAA#;~S$3h|mWro5_vMb164R#f6u0spX_5D2YT&i&RllfM zd)7B~c8yPJ99zvDSbQcS|{ZV#_WU>1c@bjS#s3K7l^gCKM&!uQ|pD!lHu$HmI zG4eh{thN)g^F1MQRJ~8~Bk(~AuiI_t29@w$=d7|4< z>hhOg-_E4~L=+}3n!SI-DG-r_AW(VSfA;}o_cgNLH22SIv}}Bf7`d9ho0jC(O%*<` z(a5lgt5kaS(*ArmZEmm9p8B@Ddk!>xJu~9h0dTiXa3=ag-cdLE8q|~D#bQmVP11zs zsP16t>AmR=sQ4`~Yv{d*C4_5RXnlqoBE5KGYz5g*K%T)!)oMs~smc5l(PoXaNnLmJ zIHi?qs{u+|Xg!1yT7{;aV7k~AN3Id3qxRIt(vq>VyL9AqZiNNWK;G_E+MZikx;Kse zRTRRz8M?#(4TW{Bc$BN>{i(hMxOCBwHanYw3R(q@6eLHcbE;@Lrp9Eu3KM*dW8um#qD%)5X$V`?((0^oAwiCVqL>H;*8NU+mXXcmkK4GLV5JJyf$y{GTX zPQCk^;Hvu57yq#C(>L8I0Ppm!MA~86K7fmPP#+AN=R`f`9-jc`(yD+DO$X|CKed8v z#yn+lb};d;0spWG!&U31>Cwo>yKvSL7Z;hyy9e+>dz`#Pe>^^dc%Hv}f(()17@0eK z@~juXPui83aA1G}A0pEANaYR*no}cssB_>MZ=3Dv6Pt}mR6+((koZXw36D*YkEA;@ z!}O*71<)=jKWgo$eGWAW%QnJN1d*Jw>vOb6PE6W-`W?UAGdku&^4lw4M~*NU^-&_$$R~K7@O;ng+Vrq|UthwzEZ=|s;feV!!S2dW;_tQEt)qDtlRx`4 zy`y7;#MhMhRXGDQ?CZj7O2Xm#q4wbG8F-oX_~QFBG-AZp1+NS@d4(>L+hV7TY%7Y)`sp3cWLb!G7r_;%|3s7UT@9SYv}_5h;kb!^|< z$ilUp&&%n@&E3JiIp>_V;o#+?_~47$EwcWoLn^7O0HSDW>W<`|S3_BSj05?c zH<+JA=1m}mzqC+pzatqd-@kK@X{{W*vT)!7D+w#*S zzD6mq!m?}#YuZ{Jepk*u5|2f86_^NXAX)@WQc*iMbfsl111P%tE2^EgP-KKsV1dF^ zBEm}Uq^U?u6**D#rZ$?fNCBE>h=j<%ST_sgpgLJrM490z(2KNRfEkW}Nl~=4TlI2# zD@izc9iUR2T20|}6sv5PyO@F*B9j8w4>EvL1%T(T(LuSoP&uUrP=NHW!Vijpg7j5a$8qhes^2%pOp__nWr$P$YSfCHf zm8Mu9HB%CXx5D!#e_IHIf198b@pU$uC*6wt8KhSM${cFM4fy2Y%7Xb!-zM9uT20fjY2@+%{OBx%488igxWPcmXAS3Z@5aQV=PDO2K(6Cg^;B7q1XKJC^Mf(LGXTK{LAuTQ z)X2yI=ni-Hx=+0+f5d0`^Pd6?2*wGVG#>)z-T&?G?w9pH+x_+V?@^u=pZ}arvC7k* zf|~Fwe$sY9n>tx27QH$M3vCP{4O%tjkf4YPxR$vT4d8`KNn%$7FpGn+0==jsR6@t_ z(g_7ZhM0TjQnJuAytI_SaTo_94XM#gu?)fCl2sra!6aq@rPDyhvk0zIe3J%KiNsMy zzY)NrRE&i12;wwA1&D`?c~`6Z7!$q-HWcK?53$HT z^>D8|%g_IbzzhtKx>df%{omeTyK?{6U+e!L<#`zWU#V}bav>1*ctK>4DXpRC!?Nr- zK$hi6EJZg#WbiEKk#gWK%cK~&3o?a*IiHY$%zWy(;U42(0(`cx0h>Gi`xX8FV1I4@ z^(fB+jeprURyyt#Qf$wH>+}pX)hVlxv+j5`)HJTtd{PRc)}`}rm<19{H3$__Z7rb^ zrtMRYeEBRt{$3Q#O=j52~}h)q#W!D~zB`9?*O53eE; zUn64c&JVy(G)^brqWCPm%HlN4iR~@Tr}2rtTxzJ!fyG9-_7)R?isv50kyijVLn%_4yv)6#Q^>ylDqcFlt~cz@_%0vo9q?Y%wK!?PNzqpO&`) z3Yqg2HM|MGcM-^4GNq`=SZ-3e?uyPYiv!U8uREMO?NyW!{dc!4QW1*qupst8J-Y0bCX*}+lHuqSD&(;_|vZc%kTfp=O9kUxM>48 z@BFvDU9tb%*{h!+@R=M-D9X|E>%E4LgUAwNH&r#d@{GR2iDHD@X5p!t8zMtK0)#o$A zQOQHo^~_w>gH%c2!CXoMpi(#amRi2WmV>b6W?VQBFIid6#MU@YVG{ovk!p3y->UDP zmVde>W9C-c%zkewYP~BaTF=Y6#D)R;qnmiO;&@yq@Fgb;hEkZamorxcAmak145duQ z!44A`&mO)r`*@N@E47dUR!LcVqQ!|pRbdu00@I0_h@|0={w-Vwl;=PzXZI=(Fw1C_ z3kwze;bqIqPI56Mn&ylmnGOuos>Xhxhx-lB@1!yBUt~$g2|7n(5!zfeT!XwiI@-BC zo9X($T8RK&b!aX^w~NU`mZkuw4&_+5Z-KAe_Iy>&`RZl$pQoMWpT7Gz^?wGv=cx}d z>u2d_`SZUOl4OnvSo8URFxaWs|L^Xv&;O6}*mJ%LOroaucSSV*$C=ibp2&eY6j}SN zErrVJM)Io!VqAI|pcx7eoWO;y;g@2sr@w2Pa*6yXt2pBuy7yL{7prwM=T(r+q6T}C zo5E#KU0a$~=1<}M(G+MMV{q&qz`G6i3FBqV6Jn2RXjY2%;j|g!`SR zxI%Xaz!f&8ow8vP&JcmT+ksQePSVPE;b>f;F3ucr8sQsFQTgd1Vxh_kUBZGU$ zn@>K9MF{R1!lm%v9{S}JzG70G)zH@wzCDD^Cm%&CjCP>oXx9``7uDNSWNlI(3t3%( zSuOpnft(u?yN0wUF1M!`Un*~Z5&^dBx>ON;+b!aMK7V#TN_mxOi^$P6q>E_ORm#@4 zxrBq8IBg*QOPn^*=bt@Ap!B*t*~z`b#osS3k3al=dide^;_UF~xHKn;nd*CjXVu9{ z*mJ3qnfKcnWYYt)%=OGp#>O2e|&iP)A{l5-@iZnp{b$D&Z+gybbR>k`26_&@zLeU$I}+ARdIK!lD@cj z|NGJL`Q`85pS-W3wuM-@<-0-OQrGAWRNtMPHxQ*X5j6a@{&0MGesXm2`@4@H4o^<~ zWUQ^3-d1^O{q3jkj?YhzFOM&NKYIVu#pUsNBiYZN!B=*;TTgIxcRn@Ifa`*Selktz_2Q+BVO}hqb?anxN%4|P;%k&5O3w%$A$JCx zGM4>-Sb18^#B8`VMKDp2Bi1(&m)(irt{)ms5tr7FmzQVGC%y>AFnNa(cz40KS`j?} zyG|16A7?%e`p#DcdF0LOAOklZKAeF1`U#4i>sdLFzFUMFb-yOJ6+_?6T@JZloByr9 z^oqm@f>FFwyPBNOy=jYE5%AgW(G-O_iP;@LBB0w+HH9tk8Hums1WnK}4Pl~8+JyiK#e0o3iP9YHI{1|F;v(o9fxyFs3+YzmkOnsuKR@bfkSziC! zJ^;i#|G%An+5dlMcd+*Vf0SpzJHJP?<#^848;()K0`^`GEk2n#^sHGds5`a=^{1}t zCwXoPDhHpS{@@bS&5bQ3FhQ(Z?F=Vzc;~OWr`LE)Wz=3k5QipRehCA;v+{+23y% zBmfyaMnS8Z_?m29c4WbprreGfZ80f9OTGYx{|;w~MPUen^&I*qcov-h<8+Jzer8x@ z{MViBa{RxY;b4vb^(fDC)BmjsHlmd_&r(BGfGZZ!cRgP{!^*_@*lGgKxT_mjq+F5E z6f6Z!C0`t!QyL;96Z~KGw{QnrwbDRGk06DsDDF`tp zk%sCs6G&;^7srHEyNo_{qg&5{<3FQW%T1s4%o+c~!FCz{XE+@0t;hdkJoVOeyFtGT zUYqe2;@J$RJ=>T@98=Zo(FMIX{7C3*gyg;7*7ab77}Qh9nJ^O)*Li31UU10(@%D#% zPZ9vYG{sB?12PA3NM@My^zCDhSEF<`SJ;ea!thINC;`b+7SE6lk=mY`%3x9R6Qd{$ z@hmH7!6ciuVlBeqm2ln@#5R{E-iA}H1(|QGHCDD&qI`)CAb$s725+TRm9`n1#pwYU z$dq}44#0<;vhzGWxB`SFTp8J&oO2~Tl79o^IJQWNO73n@vnK7C1{3H29sj3yB}wk$yQ*3 ze03ZnD+|k^qwQ1I3ZfVAEV%wFxcmjczvi$1JKO#8`oFugyWaml%JWPieN;cY2U3Wl zu=-;I%wlxQP%0cUtLFxvPRWIVaj~7s-+b=`id6ZfjWFfQ;3HH4kE#$gxL}RYH4=DP zzl@M@i#2FswO<>dspi8A&5?Wy-WD*`gV8J&PPfVsuKAca%lXzZov2>tAj?akT*D-e z8q=(vIjb+KLVKReu*GZB+AM=nc=k8%)j1=%t=TYAnxr$Cp<_#W(8a{u2R{Ad3Df4@K2so4MQ ztnvRJ<#}@apJFClV)A@`$Uk}mvP#$=yS~o?^T%drA?_Dyv6@!9pA^<;KkdtM-B^ri>Tt6g6`MZ~#T-f{C;M5?KU9qyXYr06%07cF01|A+2FUEKb`XhIrsTDu8Nwm!bZ( zk}eA?;wiNjQp5{9Q4c3li#Sn(H!&A&q6urF9%;fqFPFeV<^hHHK|2wOT#?-|NZUK{J%XI4z}0x|6@GP zfNr>;FYX0CsHXo#w)~OZ@C(oP&G+^9w(3>nr5TT|-8s6B(T%FLHU;3*SeV2pWwJsC z9cyFl&cw^!U}_5WfHeS&VVvXyNyF#^@I8!^ma?L8gpS8!aR&=daf;ft|B~Z>0q@WG z_;0(zGXBT*{{Gtk|52Xj=KpiAP2FDu`OOE~R@M^V2d&Ll?IKLy3hG=|Ah#*2WPY`V zn0xwB^VlxIW+{DITca1y5AJ~}_wu^MBLT|&Nlnp~-2cfrdNueT{q5bd|Hsbu+W+Hm zo*Mio;mEb*Va}}U52==0gTAfiS$h1p1%GTa{`boG-+P1IHU9UbJWq}P_yjxGrxy9M zdhR#=SAzdP=n69Gyp_nX(0yJk?r+xQgtFw_^7?uHPpkF6H$}-T7JgmJlrc~Lv%6i! z|LpJW@2=PX$9Oit8DtERlmdoAJd$%voK7|YK?!8>H4@$f)_a&noehwpiC8ee>x`gre2XIK+48^M^uWh7xdS*A zIXO!pLj;H^uG4#W@%shC1a&sRkuXgKKObFyC?>Sio5XBO{8zHy>5cwPw#0w+i|J&G z|408xuhXr9&Ij;z{T0|F^RNeugB*IRz*0 zj%lZt5zHssPA`rS+>*%&{%5CmO+y@^t;ZOS;zvc;-VWN2HH zPUjH(h>{r)0|$&T0hdCW;7m&s;1vALY_vL^jScVt#@Y+F)A<5U;S7N<;CKe(1bhKM zkpz6{d;via1VH|ye~9-tFrD1RV-$lg;J?ft|HC(PG@BxVdNKZQ@CAS`qOc2L<^qmz zggTwC!GCE9Oky_8N4*fw)Nl_Y(N3qR!vXm8-``#jdc#4lAM`(o zv?nQLFi8NLB5=fI(ditgG$%-kC#Kr_EB-f%K%9a*oD)kf8qBQM>3oj~nDIp@LJY=< z5TMD-mm^Mb6Z}dLj6`{&gb0VUXkNZu>Cx#Hf4lXj(;4)@VHAN+_GH&n5{U6904acg zX95IeSniQOeflK+HLn4TB4AShx;Q^sJ)4%O82l(%L}%D@r1z;j96zbfg_Y2hq__}k z(idlpYDHpQR4JEJvC0Afg0z|=2qf%v;Cge5N^NX_pAm`2ce+4%NbK;Byr+gN0TaYP zhJBmW1G{lZ00H3WB2kd0H!hCPt*5l#kZGp*!#e@c9UQ0q-O% zfcQm25@(`YeCd1# zc0b9%U6Yxh6y3Z-Fya+(Gw-y>%*frDaKm)74m??<#bPhPlLTF(-!S7p5s`;=H{<8uQUHGI3d+BA55RAN)NkEQ`99+BamMF0{#Cecs!tTovLsF? z{Jo$8L}oGh@OOiLe^b9^e6EFKhKTyYKm4Hx;hbf;2*pnM*I$3@QWoKy{nq`5N`VN$ z_@pJ^aLnQv`Ww2Fc^FkWj7-cYB_Z>b59H#bkgxSM zguHRhcloFFeTFE7lY+pEPOPt#!SIR^7#0bNS2l-nijLEw%4Oz{Wvwe8d7YhaF~x89 z`U5LTq=r--30b4kSJA4!rGNaEI(^ZJkM(Q+9|F?C?S_1H2$W-2b6)-fd;xLF|NH5i z{x|*R0cP^60F&6zMj0wm?~f+G-hB_J$${<%+%S_un=q_i@;qY3Sonx}-O7 zHmq{?wm}R-KWE+?2KLD$8~BpRg~n_Wi@CFhQbz7F9H;E04By~XauO20$51PlTIguw zwr(q&MOy`ZuYlS!#$ajMRkx=LlAXj4RMAPy0zP#w%g?InM{^b@l4KN55M?e^I)%gC zy@TQYXc!KMqw#R}o9LTSIDo@%2I!k_!oBVNZw4dS4~P4(zY`6kQ6KJX4|n*x@nAgc zk9Yce`{R3XHAnCh%ok}P=rF-~M58N)aU%Z+XmoXtqRTQ)<76>n6^N6Sbe*E;1?v{C zvgZh5vdbLb@|g&chZ!kWK}Z#}Dppq{3UOo*`K-q?O^x~+~3|Cq5W?L%QICg{izgx6jPoHQMxtC z>D>t5E??HYr~QJ~FLBx=&(U7AJ08E?8I1Pdj-v4}8lz}`cemf~_s7xBczb7ifBWt3 z=4$f7~DRM`*aSzrVk?yA$m#T}RGWok(XP>CNJhV2Z~~bl?o%AR;m!q%g%4 zk?V!0AGhp#i}(hUt2muRG2vt9VMeH1#)9?rF}T=Rl{y?NwStX1u?|wouk!l@PG~QR zDI6sR7xa+Qm@=4_x}H!dG*dVtD5586yg*KrilVdld!e;1^>)TTHs(AMQ4ua7y`qa2 zDplGa!}z;AjS{p#eub9$L(DGdR63RXEyXwKkC?JW$mD4nr<0TPIK7SuPG=}(zr<{M zlKvBg3`G}lghEJ46dB3u2vU?rM|}T^u2IV9_n4gLX){B0;DSybt;J4o2$LeO(I=jy zW872brgJ)~W0JXuf}xVJLAy{%J6A{G=2%EUP|4b$9jK(8s~T`~c=ZAfj$R#K72Uwj z&USrLFI)9Fw%e#HDp?wI6_vEjii!$2wMR?gm@3bk9?S504|5)?Z8Epm`Llm58elJp zXECF_Fw0#MyZ!!bf&4QxtJHe8-~SM|p`kXb9xetgxiA!bd<<+pI>ACu=P+k@f>J~v zLlGDgtnWOv-50}+N+!VLgQGX)tz;Ngawe%~eo8I{?5iL>WWTY0-6LHxOt)MeB<{i*SMm;Mae2WWgvh-4y)# zkEfmh|Kd;k^5C3C(f4_?Vv0ncl<$2Kczb4H1%h(4z z_>yU1?^l;jBf6R;loXj??ozs5hMxRcV*bz5)#`t@_kH@`HU9UbJP$kn=jn@_`qxLm zrPi}N^)F?4s#dWnCd`_-1CSB(qjsSaROhd8Fp_gUOwLH0GDMDWlFw38)ITXsWf;<) zTuyq$^6=~bdHp})!u#8AyBB#FA{3#h`{o}irGx%qzIW^uQr@%PrznCTHIYJPQRnun zR^{-yj9tbi4yeVHS!|YEbmq`3 zR+PF*iv)n65XIL>)?8TX;W2nPo~KofLAfk z<5U5s0H$}~>Mb?VgEl=x|Cv*!x>ShMFisFrT*c`GkT{$Q@Q#8toUiH?h^m5mwlji`E_w^KmgS)dIKQ%yB**?yAfNiNAfE(Mc1d7LW4(p-rz=(EeI*<3fl|`E z3-K5HFVkK%L;+xiinh(gDN+*z@5M01Y|6X&FQUJLpK$_NoFHqrU47ydWC;urmlR*& zuLnKBBf|jQO7Kg@M~$=vCP+Yo0`#vOCNaC~U7#6ESsd2VkK*wd5tN3Ag4ZxffZ&nS zOeYjfQNkNi=!4iBU#sv(4kCF<2v~h>D(g@AQP>r&+U*cb^BGJ5K`;{IKxGDT8VPu+ zbYifJ;0Wi{p=;QhBCGA{Dmj;Vx%#%^{Ze#!p4`m3rhC1js^i_CBZ{sOiP>E%o-R~k zi34~ujl(JLWQ=zyjfYC*c;(~cF01decwAJc2Y#8NRA!1PNHG(;gm@gIXcNRts~E)y zIVJ>?<*Vyiit8#X2c?>Q46~bJ#NsiyBstmy-wR9{@ROX(m*z_(Xw@z5GUN(xxgwRn zSL7=+0M3Tg{Z!McjSHas2nm6ArEmH$(o|zL_b1m#%rgw7j24T6SPR77NG%U>8t|iV zkG8KS;NV*f)e7oYXgo@z+*cAF^pc|-$dqyx{ zIZ*^gce+z*7s*OKJ>kYF+uNzBEI+_Z5ShP+t-Smbt684yvw;3*;d?**%(egAF6(~= z`)mBq$9Wz`|MNoc{T}R!tb8?AT!|H$qxC&k`*NP!t;BP?=UT6q>!;n*e*Is<@l!o> z*Z<1>&#=F@UjHBEd64yg?fChZF#M@_eEM8HT_4XEXr#LK_gL=-{=Cm(>;G~(fO+=6 zdwXU3-{IbH?f>y8&x5W1FI5My-U2MT1t=>wbn8p;RcwA4F+Y5Jg|!}JfpXS*kQMIT z);;PO_Netn`e8THzWrZ_Q-*W0B?9g&ao~5uKD86L zI{+u?m_W)%9j?-&=2Qq?h@1z|7 zL7WMsU!@U9FpR(mCVX#8dYvie)%QRms@j+{7(r-j2II8&AZyTxLtY2D3-w6QX_38vbmpLm!))j5|ooSPt zBrWRHF=31aO*450zN{*?rmlp}BYEXy4j%L8}^1T z8>e#q{GZ_P>V9R+ng9FS<@le2y}jMRdj5ZmXVufQH3tv*>@TqS4}cDH6YdZ8c6WD% zr%a|)ictu+DTa$ogc_i|B08_Cg+ruN$W=Z<>Hr76 z$NY380}9xOBptuvwM2ZE@vmV9M{yFfn4hA?(%K#|Avud?sWf!U2z)0FRAv|)@_zsx z%a2NrBW(2L$xC_(SWU!>un37hRTLpb@m}0K0QC=(p`7_YNutQ2NEgNF*|~%|r%cfH z3$uT>C2i#q^mzgAVmL`LWpM~*I6^wWvm`P@DdX8AljsAEkQ#c5HTRne-V%Xh@vrq& zk{3QVGWLX=sz*Exm3jC)C~d)KGyYpAP+crS=^H($RWXIGwU!}GOgHtB`kUdR>vE=w z1DZz$s#HZwt7d6}P}Wp7Bok`&u?bzOR8B<~8K*J|Pj#CtYB9~fXA=UQ(f=lUP@LD_2%yO2C`BZp+(fAt4q4-IrKS`4~MW6VH zms5i1GJGDG!IUqF+O?o?w1{cJgYd|SsSI&W5Y2E(V=<%LarR`SaS$_6ebk#Abi|TV zkwBqd5Ys~Ct26)DoP%HGApM6WL)A*JXh|kfOi;*@JKjgH>O;; z(WaD&6h=MiqEVpOTV*2j``DiFHpS?ywmomANs0-IdNO?f7!fYJT1AEok1yRiw_G;( zR>5-gEV^FDt{Wc;YRWi6WEQiNl%g;v*2N3c7rtYdBqJDJ1tB6V9>*bMNZq_Z;kudN zNub?Jq!y>6SaoMP&A*=B^oVGKIv~>gT^l=-)Ua!|v8+5%tk7+SGZSuvMBDU$-tv550 z4Q&aH3V(L4-yzOoPE7Abs&sYdO@F&c=qCMD74AHoa$BCL+N*%lq)v zVR8fS=quhBrW5e-{7MeaSDOGO6!C@<$xp_on4J+sQOaIvf&`5V6^&~$A;x)55eX)F z93dI-m2Pch1O;5oaXJa)J4H-hOc|aJfL)?4@M9(~OOrdZcg zjS!y_<-#H-`AGL;vsdl4t)ehLG&30rG8_eFSr_p@Wi^A0#Mh9aKzD{MU4mFy)bGqa z;DEzz5H6_OnYMzc8Ohh!3{ zI3-q}n&kOo1i&P| zMyYNev&F;_ND+#}6rzbDFyS=CfpEb_yusuu!7!q{0mXl|HY{EPJPu6P;46DmHR>ym zGo0Yb-9<(ajE-dLNacH~P|E6_{?R1_72MNzUXg?q42 zGx1p%@n2$Q5?6fY%&rAdS0y#{H#XF+PWZ9Q5k?rT+#e=FFGGRQyH_P=CbBc0yLTH= zaDf=$|B3*CaZ35hZS{^eWK{S_K}!E_A}4JWEDCaJyyZ>)w%?bQ8j6s3)Aw>Q#grW; zF{H>kl|_+tbBWG)NIs5n{Js6a^?{Bt|q~SgZ<&g#j;s2K)>oeg>*6 zGny?Pi#dWl}++}=tQ^dA5B=JC*D8|SP zPM0sW&-U!0ZyAAy_R;uQXk8$g|h-XJHBxmpKFUKo6C z0vKsrqZuzDMf}JH$(=lm5;Vit>WH6{oH|SPVH+FZ_!iEx1ew2O zWvtyL2($bE?DYFH>zxedc>spHZ$HHLHdAGnquVZ^AgTGTlrg9)!!5$(ubV=oLgVQC z9R(jOMUOgxZ-P9V5EvoRO(LXVnXGLs&uJu95NkN93*~@9w=nj>g{83G6N+To1e-Tb zobtZU#4tQjhCT`-Nx}74`T|c8wR@U!YG-S@N;YaaP=-4aT;?!}1X2Aj@0Unu2Xt|= zm#b2H;6!NN%4)rG;h#hkR$dFyd@?NiIH_ej!;y}qF3y(BIqX372?%>l)&nO}yTwn* zpY+F1oOSW_Pz`%|X?*}bQ9Nd!04Ctm6q4xEf~&9E%k!f#x{l@bxZHk<4Md6~w6!6u zgvH;Qp8%#&08M@4^KAi18H#r9Uk!F14gE z3}DXijPD&?)$9n3F+sfDoLz|{< zw3_3ozHzM#1ofeOn_5Rl+@4m5@VCy*Xl-`gEzL}=Lw1{Oi>DA_DXa$BP^Atb}r+DFHnL)hDjl`qK8*jw}s_q zou;U}@RKsRE0HwD zHwH>mT+?g+KboTzR4g*_UDsWB za*=YPR>jwt_;AW4ay@YDR}uHX$27SU_y1z;kqstRo=^OITb!HR!j)I9NNxF?rNtQ# zfF|)+d7!Ub=^k-`!d%=0@fYZpEpkgzcg;o>P4NodvaJn@Siq)yj&Z*PV@v`V)OE{D z+$M+|iam4ZuP#r)2!>ZEjl^)JZrZja$Mgq+^GqnfJ!D_eijaWHVvXGrQQ3TDqXVEb z3gwHstdkc2#lBzH0)$W4BCd+J_6DJ@b!456Ds^gVnOdSGPY>x&6cHf)bMme-trfz1 z&9G3RPNXh&Q;19~)k1cqn+tORt*+Jod(a>5yjg;~Q=Fb-%)oh`3f(A90l}D6?n_$s z5>sQ-Pt-eAPJ?PJvCm{B1Hdh1sUu|fzIw20rX{c*VDb(n@J?S!OOJ&%&YpT3+D zM5j23gl>J7i{!jtv-lbnAl15Ss&X*zT|8kNA-);p>G%>M&h1lp&6h{2J-GenAD0`2 za^K92N;IDxm2jLVE=!V4OQB#N^lLh;r+*xP!BCpVWbW0ldh0gQ0oYY`Vy?gsz@GBA zcB@`z?m!%ELDLxUDIMlen>z|hH0KY4QUUiK2PJy<83-j(PdyS!>^#X(aCum4EbRJ* z!eFtXu)WYwpq5IjX&_X!VvUsM4g!bX{2|~FzxM!esNJXgJA|IP^E=EuN!PbID0Tb- zWaY_vzS#>R!Y0N7+i0iMYolN*Z|~&il^m}Zp#Mk*?FBe`*dzBMj6Bxi+h|gK2XN03 zymSa}eGK;<#GB+{S;@bT$4FQL{$Lv1`YP^w#OK#>3LResUyViVK8-V51m5bHX@8C^oZV6p98(%L*c%V$KF;l`HJ1f* znt(v5N|ly3V!kyqI)rCwd2L|gtn)*W!GNVh<%R><_P zMREL#TMhsvACvDq^1UsSN8zl6^wM^o;IjC%HXn)|xz{Ub* zGR5l@lbLWl5Jy#U^0y0naDmcma1CY07>VG@$N*SW zuGnfvh+U#?N8N-U{{H*%>CeCae0XjeQP?dBKkwhKA^BY*`qm zm^k`SZ~AQ|Q^#WU&javLKHmC`z{Lhi>Xz)oyMeY88$gBu!MSh;7a^~u?@H)Iew^v&mpZ1%sxPJ<);B4HD+jhbqdWsNl0yD1H3yv zJ3l@;ygYt)AaraH%wPuMlrjXB9{TS%7yAPZFC`*r`WSj;$M}>s{E<|?Sd#6i!yRXn zOJ8~Th%E!XiZjPALZNba>!xI{jt*k=DN+^q7QivMmmjNEA{7OelA3zsZ41YxzEJG& zmkFML1YM&<7w>pAd#M%MpLc?UCRn^L)7~_O82wE!Q@U;b6W)rS-x#HIiS_~L`*|Q3 zGvlm4!MQrc8D4~o1SH{9=~1cWeJ-~@oPrrcV(1iZ8ZPxJf|YXebP-{MABBr-AzqcN zD9(gysO~mqR;c1xC@@x)&02q*z34O_^%U+wh-X{G;GT-Iw-}sge>jJy5;}&>S_49c zo7doD_;TxywfPyGcrx<0ujAP)XYw)&PAGr`6&`#jdQ(eMp=MO6J`S9Q&58x4VYOc^ zltwvg8Azi-!-mmV9u7mIvH%MVW2ZM*)ko9=s02Q(le@%o2 zcL`p=Exu&H>FnDNeNGXwh!+chP&QayJNB;~`>T%qvXeimTYtI8=i}7x@#!zz?fdt4 z>96?nFYL@OWp`h1F-c`fUoo|UPIDIFn^ZyxR6+hq-?g%@1*IqGi}fr#P~R*SSZiQj zj$2gj#FcJrcjR5w&q_Ucd#L)F>1~zH?CH*)4sCa7t0Y~{V6R%voPK>3rx7?wDT7HO z6-Q=`#RNnU&2VaY=gH_y?(6a-VIifer{@Sp#%h-DVYPm%=spVmO|-Wh{1Bw*#yS%Ucc&@NlZYP~ z`JUFGD3ppg0DW)&y^d*&(;s8XPx$ZoFcr)cOyDE}Q~6mai;+Y|$8zcuvK+zis_5HQ zips`Q*!2X6~{ zN5)BT)79a6$i{mdRF7ItuF##$$h{CfY6~ghc~r`KKs1j>gyc{YbTbl$ zx+(h0<6snhWj+eV@-n+828LFb&PTvld9yB!e_<^b9`p-)!FV><7lvhp_EiD-GSYo) zh%Xy;;7R@U%LocaWX&G>^H39N$!N@kvPZuDR~R<&#mBOsnoE@4(U2vy2mmBs=-?CP z>|r&C*P-5kEXdnPMb_Au`oh(`AP@$vsaqig!yJR23bZr`O8$d|7u zcz1dM&Me!5d)YKcDGg*5lx?&4Bap96865x&TgLYN`39 z-9(G9K{v`I4g%LF(9+o`P0oDc!jA9Kisi&BS0XFbaNhA}J>b z7}j1!JQd91Kzi01ZU2fPqYCYg7c;7)sjdf_aREc-X7<4eoXB?|60iccLUb|OE}DRh zP;n1(B{+dg`R6?dR$v9bmoES_Zx$z7fd{ydFXj?`F<38Ji@ge@7cZ^V;k zzpo)(7U=B{j8<+J@{m~Nb~!6XDtFIDjUmS5`Nv8lV}_~bJxqcI1g=1^bTecvT> zf+z3MHA+-*70(g<{Q$)27~6`N8n}*nJPqfJAdgIL*p0MglI-k?>*&aN?@PBE&>9e=zH|o;MA!U%Ohr)SlQVF1^6s1( zdpxKPI?J&(2Ueq=N$J1mw#N&A)Nm^lXWzqFoZP7a|Eu(N{Kuvi9Jq+nNrEmI46io9 z89`%2-sLb6FNDJB9Q`Yg2{JEjeq8EvnSs9Rsj{Z$xNcoXsUm#{+ zB%~tSOzNPpJe0He+kR`hv`U!PQl?Fu*_F6=~J8rXqFXF6fMf5K(5iN zDN$}G$_P@jTNsQu)t2+;cnzoGx}B7evb=x+yxl)3Yv@n1OT1Za`}$$dKr1*Gx1wt> zm-~acG)nX(Lb)iDV~T#nRP2%}C?DThZD*j37U%!)YTznSyTg4^C=x%kPBgi`}PQmF9C#V0{uV@RhD#_eWf?UfxzrFckS=~w#hlbchQUcq{xV{UH@gCB@l$vl zBo{AV7NpBbBbZBV?lP*2KL5)uVBk6wxQj#x5t{~uJ7U(x<(Led=wN{7Z^n@BEQc31D+N7#7sT@^zj#{QaXezY?weScC3zR{I#(6>!+uD%C z1BJ9;8C;aG4(6;`_XUtCky{c;rbOk%B5nDrGY5O5dNU>~-+8Mkd~RvqU|H3|0gN@DIxrtC;2+CvPqpDm zyFXgqVkK0e#hM0#Yk^$vdbacq&H$tuWy02mVIUBt(q?VPQhr;FRCo=3K&tFF$g zu6*+JxYwCQV2+>NCWx82AE%D?8K(%muEFLnY}s1)=Xu#JIqKE(TUyUo!|)tWKQG4* zp(~Jd=+LV7W#co^P4phaG-cz~SdDJ`dn9Pbf(|J>+ny{pzrX9|v`KJ~LOS z7I?S~3UK>^N)W_rrGj^7wrV7Da9UHN#T4;6OCM4NhboxVG$n3gaC1Z<|wZm73I3*grkBf zyDm2BrP0&stgfZC`r2;qWZV8rYG$Soh(khrsvNU``9% zuho~=%2qrMh4n&&m~=Id4OFX9D;4xA+iqQChzQe>&x9#xNj1X12Q!(#D3FRgjkT$t zX>8kO;YNc-CR?X`r!Tf9ZYvn>B@Bu7EAgac2@PP#Pw}r9$({HT9uMYEilm6; znH8elF0ZmZ*7Bez8DB{4+>u-=Ah>*gp*^f*vxzGl#RLj5(ICn^bD(s4e9*;XzDOY( zZFzJDeniQvSg3VzO(W9|@GsPFC)Nu&i|cKwgt!(1HRj?lp+B`$UR$UdgWlln|2DHv zxs=*DNaB1zHm$f(Lo$jPf#go~ImOxx-U$VnZz9oR%+m;|zyW*};(bi@6We58bo0aa z-$&}tC??spku@_>~%|!Hr`u@cmOQ6Z=P9mog zy}4CW$fejvp6FgB1fUSl!}@;0XFM6^E>VzOR)5j+95q*M*W#W{;n`HinUdQFOc_Yx zE0jnmBs0Cj5xz!dET9zUlj$ZH<;MRLUGwoErVAlM00|PE6GfW_;K%Wv1Vt^Bz_r&x zA#iJQc4u4NwPg0Xt|gLOCQ?egpSfEd0g!%gnNft6hp^GRrVY~zHP1#SQcj?XVozCSrSygU|f0ao^xR+{sRLvVI}^7G;4 zG5Fi@-^CYeS1S6mDnz(G=9w%8@-Ctr()fxv&WTuqC%YB@VF_~FsGdi0ipLirL_Z@6P^HMpl zS!OlmBIcJME@-ZyTLKLU%=jdrzUkAniogjm4y}??{iAlz1K}~UfA*6x4JZ#vsTM(S$6cc4Mq6yjW%z&~NO(i6h zMj4J%Hop{^LEB1-?T-2_&8dn&=UV>!*chRx1!=8Te>m=wn&@*@JRX&lPdbXoL7|RS zAEi3YjBRrPD0U^)iCD>)j9{p>u}8(eeA?1SV^9vJZ>1^hdc?gPBBOGOiDp2* z;AbR9VIdl+sM+!nuSS?nwKhrY$|O(|-!2wAyEIO~C#`bgTcQa{KUpZ5RB3QFHah-D zS^u$qUfzQ~{@%`x__yEhm;db# z2Rr{U*xBuG5BK)_+x!2~ANKe6_WlF(AELtLC+DZQ|LEVlta9aE$n*I#-#+zz7KQ^o zJ^baV?dbd+1%Ld}`TQ9W;r9AfCLBV(`W+m63wqzj38K9p5Gd&U`5jv&>4= z`TA?E(itI;K_;-cZ>F*Gz7ai-??gt3pNGuZ^y{xXozI^GK1ZQ{nQ6)s5T$FQ-iz61 z&;xwdQ8+F16)gpYI62!gS8W|>4Z*wl0XUJ@77Sh?0KpjDfLWa8%y@{zO2ZT483N|I zyQgUU9p?h5{6@sbSDr;Ir(kpkNS>x~I?=`P=PPjs8nT4%2LZhfxd<~7r)&(m|49Q; z)h>7)r(u#u2y{a{o8eR{BYHY&XBYI|fG>PAoQ7a;Tl|b?7x{P`--2$y$8h6ubm{=b*U=ckA7gOjsYa^DCNoK6q{ul_4TX%wfE|9<7KUW8~! z;t_g&b^HP*1ZC#_;|qW{SK!rW!65i*`;S+h&ahX242j6NQiVrBhzUV7!=mcETUa-2 zg}P7s%`*(daZ}%b)pkfQ#(643F)@^Zffxg3y=*fabo7F*mE|?x`oHFT{nsLfK@EXY zyo5Jz7S8kL%^NiWHA+%U75w8ZbGS4`lG042KqQoBY<;eu&0y}j-JcJmF(!wQ1Z_M4I^dl zuvoU|ckFKUP<{OLQc6*)8%Veu zX^&um%NVoORsP`c4&Ti^&0_5(^6YzS58 zy&6PwzGTDHuyDTyYD2WPp?;Yn>2-?r1xlrnFaarMa~nmc*Egt6TbOOLX1=2Tegj@( z;-=9B_|n?xRK(UwsyDz0QrvOa;+@ldHTWnu;g^ZR@@p><72W57CMCl zDWNVj)jBhH=s$f$~|!w4kCyc`FL*NADMyWt_+2-Rn80A=P!R;xrNp5iix7 zm`(YKw0POAa>f(>6UQm&{+4#Fq=7k?jf=E8GcdjExAf=3_dgw9fS(WFpS(M~Jo$Kf z@LMYSp3d||2(Qu@m4*R7t14=DOFTBGTxoK5hoxRh zUZ<$^MU>Yqkb}E#>JvdU!zo2P4KGbGbpVP)qDP;kvO-o~dCQKXo|KCg3M9xT3!tK4 z^V2Kr=9rO{Ao@B8_`9N*Z@ag*x3}FlbDE}RvT%*i5@qXht25f4#H~{K^lpDI zT8-D>go3V&Qrj)j@$Ep&rt~WxNioYd9s8}Pa+(l;J*9w9#Uk@`hF?esrtcf9paJX*pA zV4nVGr=tHE_P6_M{m)}Oo>j2e0;_efvL&fKH1&ku-*#mjK^9K8t_K}H)(^n{505%C z#9#y&Jm_c(U-vp_nbYc=i=mEVbJtEk{ssIi#|+8bwhN+Mb*Ctq_2_hKit$zV0CY2g zf;goNCdnrMoo5pQBW0xLqz-OSJee|{Y2f=Dp#(7$$XH?B1BE0Qh;QP&ALDdW{ADol z)WTHSdGngt&YWfetLnj7mdI^JkDxR{qzhhyC=MCuir3u+s$GTo-UVL)-VSM;Mkr-q z$1YFl`z?z>4-@iRk207>kVLW(D&(rhkRhIBI7KNtC?Egp<)Vy3S0@rha1m+H3<+CC zJUeJm8Dg@QVoJ#B;8|Sl$5m>eYgWQ9fZ@NxS<;f>&Z| zb}HTm0iV_?FNI(zL!|NrUn6ouVph$ge7*wdTlOuVAYsTV$;>X{+pk_9eLTJV_|y6C zr-vVoFU}5+j^9+0Ti#^?@0-Ol^sPs7dNXCEf3K3eLPY6xSv0bvRG4v6DRijs37#F4 zJ^(O|Q4*b_arKM(b|!ql^x9PHl$`W6!_J9i=u`!?Uwa#;3#Wvd`C>3Emt7f!Rvj>D zEad1z<7cIrEjL?L_AMlK^r6gm0F2(%+hk@_eUB}Tmk)Py(?*)DYUq<;vG3e+Al|Sbek8Y@~H6Eq;PWKB3CrZm*~^8|PECcN8Pr{3%1c3ZJZ1j?wR8VJ^HLs>==4M;-$N zCrItHbvHYZp42dBQ%vH2OUSFMx13T30BbUSymqCzjME^;gJi+o1a|7q1`F*U|4Mto z#rA({qpmC-+wKJC?Ei+t?ehKK&Twycz5jcRr{Vsu+2r(IJ3woq_A0R@-lzfrN(qO=-KsjpfB$e0swhubB-LaFy6psx4^I)Amb z_c=T**MId!>YZmWTSy5sXZ;^+@ApgV|MqZqt^awHr^#HqZqYU-*K^nFdeiQgu{b~X zMY-L2=;Eh8>e6U&tNV#wAovV&0KNpP5TMm*o7S}T;!=4QoBs<_^FHGN|&r0X^Jn>rRz`v)icc_8wlQn6kqph7?)NXuVvG zJ+@uSpV$0d!G4ukF@4pFHtOe3W#K#F3`f+k$L_M4HO7rM+BGvy*YYi`vuEwwEfPw@}YfXJa3BR?)!TmV!egc?T+>usU3@0h3EDk^52>GqewSUgN zdRnO1br(E&*)YNdm*Vh;@K87ft{Wuv@ydK zx~rtWLU+FO<9HHekWIf;N|r7A`pU^ryT%9B7Gn3*o=9c(;B(eu5dteMCX&W?wbwQz;LuZIgPhKu+xzF1Fl z0V(g>ftgjvZ?!geIo5ZTw-GJ9&j@BX#K{4;JUY8?$u+CEE?s?Y$${#YHtcAdZDmbw zPU0~N@4^KAi1Ag4L-TDld%RLni|qE=dgF@NaPQ-5lp;#c2p*wwjjT^AI%IgtT)}4B z;nd%vZe^U_!?$EVAXav@R&q&KkyGLd29eEY4XTA*lb14poNBFP_&5~rJ9r#oD;PQsy_F0chvJgM=3%f&_;Zbu ze1<;YJgpua92I+rN~$FQghz{nNRle0(sw>(d`y!&6R)_IxY9W_(f1{2D4^*~`mQQ4Q*B;e!>TW(-o>Lzi{;K2xQBBYuA4_w3_VJzI@`)Mr^7h@y<>}#vli%MRfA`Z5 zJ_hADLnMXd4s>~U>w>O`9NraCF#P9qsorWneZHyQtIDUT3$Jm-*0^G8T(OskD^_Qs z5l1L2jp&uEM27HE*1SxxBNzk0XwiwN9B-2O+c@f(CRVt6Til>`?QZw{pT+$D)K#6h&};7j zIM4rkusbZ{zw`%d|G!6hK7YP<3?5IcoFb7M#YJJq{P9NxZ!AUZ29v8eohXp0B4&hr z>)a9{ruItN@i6kTs0|a;l;-q!*F7Yrfl4fIxDV86sPp;p(d>-78~>Z&BtgV+r_2cc zCkmO758nDuy4AwR(l%sx)56U5AK1$w%0fhdhK9H)L@ zRl9&Bro|sOkcHF53oGo?9;37d#MsprCA1$aEUU76tSj2y&OIdqPh0kuG%{Z4ps~2P z4JfMv9dWTA1YzMy3s&tGNeN&L|DjzECiV**{lKf~#wo`|Zx*qsopAWIQS(B#Sbkj39UXRN;(KV{sKQ6rrh8UAb`NPlIAPRTBB};$m*dToN{1c492Mej+R|yaCET;cg zTlxjB0Os8P?)SGV`v3jiwf_H6o;tGC2UA-37)Fr6U!M%AG1dt-&_GCgtqPR@L_n$tLL()t?I<)?`9)#lIv zhb+BpWWY<{9vsMc7hXP&3}Wy7oei2xZ;sWo=oq!zNSbUd+?Oid;z$}nwd@(jP^`qf z1>6wSd-iFHSrw*1ZbMj@1qDQd4;X<#GC@q@F%&5^`iU4`ttM@24qjA-?FMA33J~>t z^TzTV&|exwEHr2U-u&l+0K*8IBYkRA4WKmxr(3OS4-n6%@ z1zlfkdsz~Y@=(=P_<+-xVP`j9*2T2jk$aRXs;EDKUZu6L-QAn%)9$Y06sPEsJ3(pE z^C7&noCqr(&hsWdUCP>I^Dp`=rTIPsR*wx zJhba`S02^7BsatiUEq%HrD%2L?^GW+RO@O&v^sw*9Itg9r}Z!SEVcg6)VX9e>;KO7 zZaMzz&i3BUdi{Tl$Fu&=IfS;{0H{6^r;}cY3BqEM-YRbk6!9mu#4%9BZCv2y2q|@u zke_a!QNv%dx{XJ32`jn$c~;w`7h#;FRUH4sBT-jpsjq1` zLpHC7g?3|RF1VVT>!1t1EZaM(rdRrwoy6m=sN<-?ZsI)!Y@Rkd_S@ z5}2V&iCkA?c3!t(sD{pxTupI`NjXfO^|B2|UK&gCBVV5*G2r6V#uTr7@$mxRJfV{LN2+SI)DM{EF1gb}~9=&a5Ik6TQb5t)yf!YiCWc z8zeDmHh3CnNu1H_vtMJs-hPsOPzCgjeL?dk`waV!#9{+z6i_G>3RS;q(Z%f{rSWmo z|1HkJfO@wq^jqcuuh;*NU%YxzwEw+4+}i&(^Ay&vndl#Jp1+7R;050MSGce$ki23A zxs`tW-%~w)BIR~|UQ4r+7Zzb-lJY|N*15{->(~35w9Ob^_||%Igx7y0X==F@Q~!}w zWendY<8~8|PF%2XwrfWQs288x1l^?xx(ma&iagzgCfA!HyXIrd=dCUB*rJKY8{27} z(YDay3Q~EOb8OXjzNnPmC3`_l*6cZrcGDTY%eJoiMBj^bd1VQ|3mtaL``uirH2rsT zwdJyam$bj4WZ+Hru4px?g|84}knh zH|xQvF-2=OOQs_*b%DCp$<=G?FS{c>U8;5Gj;x$%SDtu%vG!Z`dLwDr>%Y0`Z0uD> zl$B)EEYp}*kXW;<*=&Bz(&QZVGwZE5CxK)0OQ$AirfXe^=qo<7!pxUNg?bGs+RHw% z(oF5TR7ArOBj4V#**^IeI*`S#E*i3HGw=>=1BI7e((V4^AMg$G&wu_=|Fg7Qd8do@ z=c_oU`)E0*8_3XF|HbvOYjw^a7T&Ftq(yT7)Dcu|1g%H_R8wlvJV5myp5xwirvs|* z&I+;uwH!jS?&Ltt{aH_rpyIBw!KB9ypI##6nui$Q@s}x@7Q;g=5pKosR zS-_j}OxDt}RKCgDmKV)CS=;Cm`6p}JT`CV{ZOhB2aV_QaO(jNl`S|MA*?Q9?Z+fMz zGBa|0(<@qQtILyI-|#9|+sd;hmva0jk|#HRcy$YHeW{c;y~tLVJ-M#o6)mt;c-getb=~sv`L}gbMJmff)JfxVPcu3fHl0j1=q5)Om#okZ z2a4(>%DI%%%U;|sn@-vF@X%o6Uv+lQs`gjoL{U9oISOnp%axMyRpd@w%>UP9l5h+F zY>5ARbu#Dw`{Ly2c4+un5BaaEKz6C8xx=JaERp;bZLc_7zpU9-uF_ux8iMuk`^S7_upNNn zECcWv&d&TAwUuN%1vN99&eN`1W9clmo6{{TKVA)1nLxEyatM_8aL1yE`z$*c19mn-rb9f7SYQ#+8k#@!Ta@$)^z(O&6Y51uLk|RH<_H zs?aaH=D1lxmwr)UzHh-zx>q;oD>i2?pPF}-pT9{^S{uk9#Oy)kg5S28ZdAA~jpGdp z!rdizw!Nf1KpP}Gdio2Fc-iTx6G3=)S~|@?3z;5cvTV5!4`$}yhS~2N?2wgD{-g(w)Wr_AF+?wJmKMeOkHO4*@GN?fJsgI2S1W?Eeo*d}|Qx?8q6sXzj9 zXPu%^d?#5jyyl~j`FnfioxZW!nF{hd${MFwi>; z!wP!s@Rdc)C6yVgD!!Q}t}4k%knshXOGr@B-n7K?qbVtY`OGF#F#OA_7>n)yDv({Y zF1h#sH0=K;uU-}Le_tLQZqNT4d8({>>Be7C!c4y{QGTP4DO909==bI7Loc;Ow%q8y zU1FpEw&u$I+m+whm$$eOJngq@KULR!!Tnf``_SACf5%S03S`f-TZ_jc#fRLZijhY$ zc=dvXUSfss-7*uuddp_H*WGTnBB4!#&A!?uZ!3SB+SJMEA6uE!p}I$PwGj)?&&ZDO zh3I;8hn&26nU-LYGG*}7=lX}rhC?0{@N|kr_MmzFHdP%xDsSxFB( zy23HQ#!9|V%LiaHmsxK5A7FzV_>@gVC~NO}%AR`t@8spl(TlnK-!EQm^}kI#B|D;p zgFy{2o6{2C=uLy{B+P)RK(iYQola$%>ESgLymq+0f#&}eY(qfkb~ju5WexIc86Il> zx6)vd(#rKRd}D2!@V_10K**w6|5~7tw7=Bbm2p6+e_Epn_N-dDkSE7XV#N7TQq$ zITG=-OkmG9YYMxl3&pB(COwtcAIwk1=$q0LMNNwf>wslYl%?dzajblC9~v+8GDwMT z0%Vwrc$o!#^D6UNiv+m3Me4=%Df@7X=L}Z*2*@>fDTqq!6tvx?{)C4G&I5e>OXSVs`%*d80O+%%RjcY7OF;OP{FED(CW6<8 zWSwt+DM4JJkd_hXwjHel^g7e>O0lj1M%pX6ad=@r01lZyj_7B|S>Tr{-GmgprsfMkW!z`%wOe|- zT-ww8%6j5%I_-+3huW2`(Dj^Q=Rc4+!Op*2^!!@-nT?-bOM9_`v#Z-Ut^MR$*^L#Q zTT3x8tD!Cn;;atgvfL{{vY&;7h==(aWAmoM_S*EZk~yvK#l>ZLA1*E{dT?>s`umk| zqE!H(3y%Msgj(waRD5l7Gtj03=@iJt=irCK!{gF+O~QW1mP-d?y}07KX3?ZFEvKo; zHc{H$rA!m0EiP)AC~a&B!$fI&OW7q#TU;I#+!_JbXX08p6Rps^Ro38gEVMGyR#|f^ zV4$VVS~;s#xzTEsMk>?+Yphfy1#&HTEK+sVS)}9&jbw|O$)4CyRx#P_4El>+pyE>@ zMG`quV#PP_%dO?44vW9amP8i2myqMqpTFyR-<6jS7@M~DHTXAj%Y%RvPpYn-d@F|{ zFEqQD+hHMTWyUJI)V2CR2qjfSr|k`a55DYD-;bD-f7CM0cnMd#*Uum9uo2Cfe=NCM z$j5p=%?i!djy+I z)$BEoPRTziF5c(&yyiNET@E=m&#nbb-?;<~#w@D$Lxa%LE79tjHn0+C_|@%Oi)z*p zgEUuGEjkPC=}i9XA@;2HX%+v?rh%AESlBWEydnPk`|pp7@!uy$FSqgE8+rb*aQt_| z4D$itO~}6)Myf#neVvrpMvZTy#y1l+9tu@-=8Bb&9u0Un${YG3HVwE(%P(Ev)w$L( z=Dw(F-f_+CKXa)>G<(Y@yzG*(tXSy)SBJRE6$iIZczDIAUvraDC}Fzs6~x4s#Q!yf zy{{%>xLy4EoI{bC$L>`GpO$^IZE)r`gnk=B zzYU?^hR|0MybYnpXB$Gl4WV!3qiqPieYPR=^Od(D^xF{nZ3z7~guc*&Z3umq1GXXb zE1rRE2z_?MwjuP@js5F{(4*<>ZPw&bXW&|yu`d6`C2VzN@!?w}fGrZhBFo@f(MZM9 zl2srxZ&tSma^G8e4P^URaTLu`@sukd*VPp)fLwda@qezVrP)8%+6uTo*WR))7!{W1 zuR9=k8}pm~xW&Opo-Gc>76)UCgR#ZI*y3RPi|>hB9E_DX!EN2(wr+4+9E>dv#uf+T z>%hTigZ}`1?*?416#wDy@aWacBL2hS%kQ`N51V*2+e9?XhKlN0M*IcMOxwgo^Kbr7g3ci^oh#2cY zh|#Q;g@&)G`&-CnoqvuWI;u%1)$sLQ%#bin&Mt1)FsCRtQJuDg1+zjd!m(E-6Sc`o; zyJHa@v0oGq_}_ui8b)T0G*WS^fd#XtA{>Iur?R&6)%7Dii;Feb-yaqA|Kk_O+w=cMo^lIVdYNAc zh(L|R*bvM0Yo85i94NB8a{Xkl+*As!e9cODo|<4~%6MtJt(5Xro)=aQHJLpNWc#`s zGR;{7R-2n|~=&`7a@KBFLiE9<{a76aVP8bY!65Zh$ zxfyer=^B~FN)k0@Mv;sh|ozp_^y^i1m`bFyf2*P;#FUF(gX&jbnErHqnfKaY>9% zgf2jXAlL3a4+7H`olY5zh!SMLpaC8#7KJp();FE#k!z;E?8$>^Bpzm6@L=yveAAXD zf`>y9O^_%$5V0a4b@ZU>RxYnT{Px$x^PPw=Ay5etF;Co?$mwVBLPUJTb!XzJs8Mc}^^~f7@X=V(~1%@s5PJ~>ETwFxA+g-q% zQnaFU&4*TW+p`gyhgHmRWD};%tG4e&$m)_Y)JB|4<3YgX_`Oh&f#3|!ep-DnPR~!q zO(mOVKFWJ8V6I7QLeW*(?H92BQsbKFYzA)d|2RH;byW2K`u_WuTl?=Oo+ee)`k{Ie zqpFxsz|l@@+9;QAEqzqKP7CjsWHz05#V>a}&KO}@IAwe-wxT92sB9QktqqlZqqWbB z`D49a=G&{`|E|vh`~SqKwyWCzU%Wgi`hUMTd~vwl|2OfJ?EeiX87CFM@CXk_Jx@eT zfVe&=Dh8(MjrwW29orHWqD<>(S2yqbvz-2tlm5#qGj3zC(1mpQo?ZWiw)^*g8(r+H za(exn7yzv8Px` z(Lx=K>bv;Wy3y9@|GhB_CVUi%h%NPvrufg7#rUtI?+?F!vDN=K@jN4!R4EpPk|;rN zvdR6Jg=7%(z~|wJOsRJZI4>RJ-6rEHSha~9vmhX&Kn!s6;o)c>)|cXU4EBi3?=D@_B`0U_o zSor3tTmM&Y&R)NJ)0_B9exr8%AHR5ccv#5)fAs43cpLw@k>}t4N4MM6dUMyH-54Lp zZudVrute}rBLjRgn2{g33h9J*I`$)t+36+GBh~2SBGW%2LgIf!+UYEU2=i`Svy;rk)B8IlZzwg4O z`su;Jh^uit0P}-cwwArk|Mxnbn~3^sLZe%GY9yQ(s(TtS5^$+>*SIVjf*yF-Mob@# zK;)^UAu?g1UQ^5`9DP^CaLB-CShp+gLu^Uq8_>rU8geE ztPB6P1Bt?+H!!5@0X6@&Re2~C4FaqgFe;gC#E!N8UPpiaLNkLOgV^bG%y1I?1o}AZ z2K7jJG-AUz2xf$ZBOWpqF@K*>7_MMOCX^#Oiw^^)Yv>{Uub6wcOe*-1QOWhc@99i$ za>#I*+>S(qgl2ix=6eA~)lCA>sjfSwp&tMdj4{M?*4TntRRe4&SHKY2oYom!8k=4)$Qq{XDtY zJp3t!$Pnk)J`Zhg^{794MlK^3vHyy>KrfBf?$5P2+7J}VCRm9kV=FH^9L{|<5dxrU8 zo!DUpqB@-$kt`r^Mh7;6(L))53kqUg`soVmpFYtdz8N#gES96pE-Jkx7=QheHD#os zjS@n1pcpgtqCEY0Nh3O8dUk)`eKt-0*dr3-5=M4~|ZCFG^EdU{Wz zkcXqwVu?gj-18tHG>`&f7w#B2zj`fu zgg8S|ufT_TeS0b(Bc@1KkeNPXvj@dO$+cjD#kQ~65`@;i3Z%y(#fRLZiuo+C=Y;MV z`46L_!;O>SK9PR>K$li1_p>X*E(Q3jbeSYgWVk)qqEar@e?B9B#za!n%+HSmQk0iI zkK{FzUc{$Bh0F6uzyv`aJCCGW^^lr(^);Z~K0<9GaOM>oajBwNAHQx0d@a0Ny-oqD zGcrZW``h2y>67_(FXJFU&^OtiYd2{TQMu5V394R5XcWt2CwYlAFFP#}P=eC7nC$b$tm9YBb3A(T2 z6y!RP2=_t{YCBM7TyMbxxejEI3HteBKM8%lLU+LI_Iih<$u4eQpzLJ94y;e5WNOc$ z0~rvoLI=)Zjfx?GB18F zEDsbqK% zs~EOb_Mi_;{EneK?PK|iFyJBU?`6dG{Osk+w&#nKJj49o$wGI19%k>~RflggRGB6(QdZr1m7M&y_tzkGE{X|LDo zkxO$(5OBB$6TI1k_Yw3pi{X2r zE+Zycn9fZFdC4)|rR5Ux@DRUe{GRZ}3Sq@WSs| z@*)IIJQs1;X6?O?Cj%B`?#Rfc@JVD*7&q}~(Nfmq9C_1-3&?67P${*d?Z%v!rW*0U z5JaWqBdvfbfret?uboCG(IUMu^W%U;uB2hh?~RtJX}SGDlB5~3E7Tb8szPg3FFoNe z{Wy_Vo9n8I+(&W|YEh!g>_aL(pmW6USZF6OIfx0LgpB!c{BsZoS!FnW95lohvDCF1{ht<~PHA~JyF6f8qDa*Bd%@ld? zC3uPwj&M`i`P#tqNcuk<9?nabI`WLGUjvCqo+BliQ5tzZw}`hU=p-v2hX?>QW2A5=uotc}aL z@PnHVEx2_7)P+T?!By>Wut zhU9VdkD);z?r{hpvnunKJJ&nSUP@lX{wrqEiNF%_Z0%A4lYLK4>HVs#6;9-#FUI-R z>o(l^ND!+5sW3K{eG*Sc5%n3Eq~Yoo+?P_d6z{)R^*GsDvQg*n?d44qrKptQJ&)1M zpdE`E2oAL&xOTxNZykK3qAHfeXNvM*SxTL>mLhqMYcH#FZk{rC@{Eh&HGJJbe>9Q^ z`yTXKuO|j(2ulZE-xzXw9jGFkax?P&V2>)K!B242B$xWMQWgJCC{Sd;eghgl1j+KY6*o+)3*xpTue#EU8G&h zb8F8!tZeRaB9FE_sGFAO$kXktsNc?=a3L?@npQ0*@XrN}W!=WjTqhhQrwyKObA^(u zxjCI|QxrOpr$oS_oY$ID%QtDYCnT?#IpM@m^vi2*Ie%hEefT!`IL%%u@}9$i2od^d zAsKX{TW`Qx?PO~ykQX}HBOb{w675I@>Jo2LX}p$va0=Nc6rDr3BqJ7Twq|}Nv}qwf zVYmA|cVxAGrsXqRF0ru~m`$Ppgw4*Peya~Xg+i-%7MVTjv<~w=vznAb|9j+(R$^e1 zAnMajiwO#cNHVR>*u}u5>8!gtq_DEiv-Q1)A0TCnf?Kt;y z!N+O#O2`|^KSv_2^MJ$)uo4o#lf<@0ES09Yb&z-De!tgd4j)a-agyeL(=$h0XRngH zC=So$FOrq%G9Wo4a`Ad@BS?)cyGjsm3|YX{n9F?#7X))ALX+q3P01vdiVPTL(h=l8 zjt-As)VmxkH+w+ddl6m$r;d@wdobCWLy$#M{f&jCGY5X{%XCBys3*v}&rld0J>c~?FV%0?7Bl*jig&A^mJxN5o$wl}``Y#)O%JSq5 zDG%a^-Han9$0Dd&gpcGM5BVgXX!)o21VCsol~bFwAzhfbW66CMF(1llZ3b-AV+x_X z<~q8~h4droziLSyd_~H|$TO9j=`#g~age7G>2@X1$s;hz*{2;vXQ|}ew4K^Xau&#Q z6P*RgStM*TqEpXa+2X4s&rNiGDU$Q3QF0c@a}%9kkK`{v#7A0q%unno4Zjv)co}{v#enpbgW04xMu$?jf>oLMtkXLVv|9Xt@739?$9(Ed zC%Fl;JufA1+9EtUgw&TrUPFk~eDYO?88nU`Ko4M(-rQWS zkB-Vtv{-vy85>u(T%0|#3dqIg$ZSPkJ|VfYN1!F|t)M=!^*2N0!sKNWnpYfW>&dg| zj_W3`*=?sX)wr9(V>x*U`?uz&)$Caipqq#ehuo_NkeDaWRwoMUZva6e-S_&<A)#C2%ycZ$cAtE9>=K*J-y13j~o;=;C0JT6$zuUH6 zAP>Q}s@GnIIVDpHlDnj5yj)XDQc*`Z1WBqSuG8E!K`nWP7kM}`B(m_1+)-rB z0n@az1U+=lFKfw(ZcX0#yEeYm2G;P&NOX&Q&XDJ9Y|;B3*j1i#`r1T3gA(lMNnJE0 zCHYxEkye64A_ly*NW`PD0jf_@Qmo8&)}A~!KX`LPgpf#rn6&jG0?U`C_af6~3cIlC z#|_~zOP&b`a=4v+N2A*cGN?=fi?kkNb1pm$c`X6hY|93QEj42f;t>hNhy?781*@Z> zwi6DQ&uRLU*Y1R-=e@Lgk;MJP*ZOduOw4_m{wIBafBs?FMfgbiWtX!B&j=yZ`!vag zYs*(ms)&0kp%c&*Xaq^%^a3=f@7OGGDR}K#F$B_QIp~OL(Snf9CdJg!fX+_^aCSdNnHNp_-XocmQr(<(CzO}Huc{-dxd&}vtRo6;~ z#pi`y_p9h|MCUD|L(vi0<&#OQ&_jxjq)8O!iOGb8KJ%A8rXUdSi{5b=5O02So`wRG?eqwLl~>lW#70M;#`VlqZJ10Q(><<@Kr0Y)u#ek zb)cga?C4X$jXLmED~!WBY(rc*>p?bjpraMi=2IbTI?&Myl<}#+7;8=BMLHbN7oQ4s z(SeRupeauUmg2xyt(pm(75Bw=H^HNk?_Cj@i#+C8S3o&u^nmE-~R}Y9*dNX0fm1skPeA(*Zn& z$xoWX{7U83+A^m&$g3P3^r4Xsb91nHI?4#CpaXN7o?re_?XPo#X;05De<88r0slM7 z)G3QR7AiVgkDryp`Fx&^cWhE+A5G}MG8-esfsR&C(}_KC!vNEcbU0&5=jhlVlC%RI ztq@)<9h=5=U5t)uDAybv8w7A&jE-u|))G24g4F7AK5ql>S%CF4*QXoFSk$B^w!-n8 z$M4(>DGqeB0_>az>f9I|jrRs^kU8^mcXN204)f6pw7&$bKbep<+jkx4aEHRn&c`Mp z@Er8^R=9=ph7H^Kb@S%j2-lTLCRT z6~Ll{U9=UV;yhm!Z=u$MqgV@`=t4&UI`OF>6CLJbETnqR)V+vqUG~9LUcr@Gh&2fX zl!$ea;Ucg6P`W1$&eHKZlmu&jC&}yg*XECP(P6^Ae&UfV^=D`ms_q`5j`U_s*~`+= z=m*da#Usste{WogDak`dWXy)vn7H)ga*xvvt^@3enK>!YfL32X2MC1%F{EXc@tNk5 z=G=OJ!SVCb`=RLiGvdRg-?z3M=&smRGGnQNLh$)hg}nQ>D9g z@uzN+-}b5U+B(zWn8^0264<)jbFyf{L$HASIieoBtP{P~E}E%CM!FV3iA{KzoD^3~ z$4Lo}VD20xMsL|23mosyk&eyAumc@D90~_}q8oI?BY{eZ)hb*dW_ppw-JWQCuNvUH z9?3g8O&oTO7n~*P=bM|$1O1=tmE%{s__w#gPJJXdvnkki-{j^cg}qqM^GNz{GZ21d z_Xe%7@a+1yE+XJr_zH~f1Uq%W*tupzH-6^eIys5nE~v)od-+Anh-NvtaHmE7nil`JijgyzPh;7^An+#wH7)W z$CKKfs}IvH42-{nIhope>lPGJ{7EPEs}069pyN> zPlccB5(g>S&qBgM(9Mr5XK(M1le(IkoAb+q9}Zzr=zqR=ak4Txn(hY;9j-Y3WpudJ zUFLDPH?RZRxCfGS|H#b3X0}3yeK1c)V_a$(9qZo;9ri(F45!)1)1kQuW@7_c6TnaA z``%&iu$Qw}SJ2^*#$%oixdB2P=*T+;H%yD6BV806?gTPXAY?b=g`Bt+LlAKsnnOJ} znCZFwxf#!7!GjC5BzTtU$n0z)r^RxC1cE$L`PKVKO2d`Vgy&QYyk z&KH9>Uw%TGaCt52@ql`_Ec91^&`Zb@fb>?u^OA)TdY=TOx8{q;dFF2UN1QEJsNNJD zB)Ocn^F5$il!=hM|MSKB-&Qyu<;N4df(mpvLiIk*vFo~ldaK}h8|Y|&>aC(;j31e=_=@Ogkak|_*zRk9984ZX9!w^ubNfk&8GrtDX$z=08Q5@9Fs&A!sVc0Zf(}P$rup;Wy5X6suBF}SD1&A~xm!ZZcaqrp#FAqgSelMf z*qo;QqkdNA=fhhwtWnGPaD+74Jebj{<|7Yjw0SV2mh<75VgtcilEM~o-%d_7(=9_s zoBiA|#fGH=iZDMz(Yi=!ZD(+TI@vtPNlU)U)1jB-pUaN6kK~f7@jfcMdhtqc%qA%$ z-s;I)YCbAsiZ>6|0%2f_(oq>xym_#esxV?FIx1s|HxJfQ6-MktM`cX$=D}L3!ib&d zsEjGzJXlLheb*7PC6T-N@+m+13I;sS3mE2t)B~|cPZgf-$-YU7fRyx|qT}SAd&4bRg z^viIBp4mL;OcmUW3mw(aGn)sUX{jeVLeFd-bf%@ea)h4QJm^eIJ<$<*X7ivkE#;LX z^h_h@%s$~NadwfpizyK@vdhY$R;%w0+unb;LC-XU&a9e{h3II6p4mL;OiMZ(Q#zC+ zb69hZ!uE8yq}Z4bie7iB#kO>~r5N9Qa`Bda8ICE&H=kU*B^{2?O!_=%j~@H5nFB#1 zEqkjR0H(rEldIbAFvM~i#z9c;GN<+S7J7+es`Sk#NpE@2>6nV`@ry~nRwu8TQ?Wfh zMfx=?=|+cRDz?WjCjFW_9c8K59;?!?ttV&MO6Vv{#rF8cq+hF`!!Z?GAqiVvIMpN$ zSo~?ZpF5^vn@_^FZc-f{XU8&6B2`nS&;%qoV;r zC#7Q(kU55qQn-KyIvOC2@_Ks)Ne&=2)&XeLR&VzQ4f%6StL7dDvKnz2#TbG2W9*O6 z%R1wizbZP~*b_A!6CR%3Q6A`yR{CY+lRzJ2GW3e!e9WRgji@nA5(GtTLV1`d`wnKu zwti%q4*Kv*NNXu6CV}1v9ku&84@VJ`(lu}}Y4rl@68xY&{s_3YdyY^#aA(az8uW9vXQ$8`} zS{4(7zcFw1TjL|?d+0si3kq;88VpOgdbM$Dz@HtB6K3q8FN>Y(i&Xc`FlWcFN+= zXC^(a-r=>lsk+B;;;Zsxw$*fKcFOJLs}Zj?Uv%RuJ&ZRlINYXH%OohX)_<6KB>fA^ zr7&(LYo*sO;VZo#2c%m8M=@o~)Z z@|Q{@z{_qnT*7QsWFRXS4_3y zC8DMG*rr{yf}p>N0o=m(%LvlbV++`*){H+&k%nbSm?MZzr@h-m!|QQzfak6{f_SJ{ zbVsWRl3qloTHC^M$syjPnD&86dt;hXY3f~=YQa7* z&%=@IX9&vdoKaFjD+;!;)y~P>4ApK-6$C|DQfy0>AUug=sado3xdMX5A{0^Hmn9`A z^D^DmvWkG=7Z&Wr>t_hasjb8AX!GS*`BO9@(J z4axa?urFtZYK=}61eN5!DRGp_q?k7qSK9aX1fiDq0laIPb-X81<`U(tLREVroh6tmZv0t2K(7ZYgc$Y48R>)eI!Kz(?dpNLWwSqmx5UT&GVxImO+HepTG%YILb4FhXs%?7$TLjeBZGevnI zQNnz@5&>vJzh0Az$s|@7K|x3I_gx5t7=*Yb~(_* z9pqX(*y|z7y}^}6{*Rb@x8P|_a^EoJVIj`wB7h%9dcG@B2nZ4Pya)v!jnP&x2 z6o&wTX5f)1c&wT{a8Q|t=C4ztrLq1EexI5f8-0$#PeKwe%|vx=?m^|W(kVI6EgdLv z07o)23dv_M4T{AXNEAiv{FF*##s^Fbs6eHip3uyRy`D5}d^T9C5 zkO3#HDHzYFOyw+8dynv&R3+(iR7Q=pI@0}E1PMmMK2+4>Lqo#-ASsS5no?c!<0(0m z@VgDuGRCq<#0v7FPPn>&xQ>XCA!mW#A-3#g?(Hc7RlP%q3M4WFArs^4aP#&$S!h6x z&VNEmGObXV1u6F&e><9+Y62T?;nFPlp)IE)b*cP(%}|PI3Q6 zN`>*oAph(7!+R2#26>oWjC1w>CPkPGlr?Pt{}%4(bbHJvG-4SO%76vpzGpv=5i8sp z!2>SUKKWZL6`ZgjHglrY1Qx1@GucbN>(Nkzut~uE2bU!AsUZ}{(hBU6@P*eC(db~r z)i@r&j-DS;tDPKhlTGsg2I-j|mY;w!Xi-z%MM~|AcFE5F4q3Zm;OEs=qTG)Eo(ljhlqgW(I|nWeRJWa6$LaIU zM>S^nPZ;G?^J^9#Dq`$lLN$*bnDdpiFQ56A!mjRUS2JukWa?f-xB5qOf1t%|7o^YL zX{r&z4|;|Tx1Pc#m~orJACmXI0aLVKAgA}T8wl!mZOYcJnoZd$34_5Rm8A^2;OKiw zc3^~d7HOrD8+T4#9Ud;!r0$s33Qh@)!c%%LPpLP_|MA;z-QRxG|2h55KBpN);=umc zE%^^Voen9Ws^JXikvJtk943EA_$y)aYvd|}re^~R^of|8+bB%53kN)F3W2j8Zk1`Y zO2!WG+i$;RViOWm!LHovk)L?zlZlA5`iVO@oRJ4wkmNgI0qZ}e15AA3#fj5Gx)SnJ z0Ouc1gdUqJSvUismwk6C{B9_GcJR!8t*ejDxfmjSTslK+_5gNa#qZcYjDtr*I4zrl zqzTl?eJSJEZ`#|(zp|g$2jf7Pi~7mx4M@LDd7uyLS*kPZKPjSTOxktN!-ITXOD$(| z4`&yIkuQi8`v|{h=WjlSY(IT5ACv_LWq3ayT$5n|i3XCJNW_DH$*~Zi7Ix~mVl3`8 zmxIkMJ%6IzV=kI(8S?(NkZ2zE5!R z4q{vLz#Q#w1c7XEW&uy=-#}-@ow+Tk@xo!CX9{uvBso(fW*mPc7|+b=wN@K58EH}xy}E`&^iDQmYn@J)^wWFHzUeVU z!Px7Ceoq&wxMRqcuew*s)`!TD(rPAVFv*%*UMbC~n^d&(R>Wr3flF}SwxO1QM zk9tRc=pFWZmi2OZep$ZkyNXyF+~OpcMU z(jA#YL?*T&t??tWU{AEQxQN4VONbE47V(w1Lc>}5(eo=wcKcutRRI|>MY@9MDIn}Yu@H`eCP}oOWH`(1t3YNHPTi{!vV8Z9 z{0Dp|p29r#_edNDOrk;vEQSm9p3Y#!nf@AOaFU9Nm%ZaTF)@fIQ&|cj3^R1pJNmx& zo2C@jz;FMCbAx3QF(4CG4rW#o;9<%#w&bD5!0ozssP!C1mRO5FXett#K=fUNInE_q zk$Wm(*^TwO`#baX^lsN)vi4qV*WM=A-V3`$GyTu}MOdQxW%g5Z{iW#~)6fsnEEk%M zaW3`n{$^<{9Gml=CgJmdN%eUeQBQHLALAMIvsIWsgZUmdOnLB3iV5p_^o~&_ z;q<3_LlMRV)cNPn|1ze@RUo-%uo4mqt=^1Ewi(ht>6Oz316n`P)BD8d5on(?kP9Z3 z0vbnwCm|&eaAG>n(q10H5}c%B4aU|6h0BA(!>$+k5?O>yXvl}4iii1YXU*PbFtuiC z)}}9D)bF_*rwT@*vEfBmp;PvpI1K10RdBJWE`gWf#+wUoSIqUDp7h@Ogpr5{uar0x zWKJpPFD}MTwqk4}V(elFc4Qtge?RH+46mMTpN->=U38}fN0N0>gSNES=_I5*%B-4R z@qSk-HpO{-P6KIY@j0|Wr4$|_P3oBd2a?H@ddeDy&@Czs6-S|AWu#_kq16Dzpq74z zU4_%Rh?rkBEQX7UBO-fq_J{dOcGS3A@v5OMs|&#s_oMq7z2?sh?24 zNH6#k+40Kw6P5Y}nT0>0;B#O`lF=yOEZVn2iV7VZw=0>BPN%_)bcgedV>aj$+@L>x z2+4bK#~|&@(aAnJK0H1&o8{eca?I76$j~M-(_5MxGrv@C)Z`kg;4`VHie*;}yK2n3 zW~}%2OLj5qeGoATSb;HR~NQR zUG=$PBgh*H3*otCpyx0K_*JI2Lm}wn{slQLCtr!UJ_Bk19m6T^Ag)?~> z6R$I=qS({ChjF{y;>?=K&i4`;HfmjldC|vUib-Q_6Imj#FJmgv3V(#Yn(~QUNQp|6zI%#(m{txJ%36gf84VF8YL~SjnRSZ# z2)cuX-zhSLK&Eg;&?@f!NxVKXtJbUwtMXg7)%0u+T2!XCK0WBqTLEcTKMiM^i_>nT zROF`Hwv!LP7~FOo!+%e@Qz2D1?Fi2E zL8d(yN=k|k0x>$k60ECfz&n<^&etC@hmkGZBQ-R@GRCaDyyfJseR zn1wr=Y}n>~HJGYaRWqL0$m*gSW zLKpNOP?k~ZTjPKdu{X}1Q?zD%hFh}m=?p{NCIasjIP8-5my&kz@)F&V3uKntKddu$o z_RzoofqAhZEcMy3hqr#>(QZ)fv-)qNwrcwm(fb}wZY)`(yTwA~U^MOi;~z#&{_~%6 zGk$P*l-ez!H`CYG&&(Y>_C6jO>&)k$4o4i4_`?|T$_3BH#BmXZf=FV5e*zkbt&%ZXpm zE|Hvc1~WY5c$m+P-a`WTQDjUnJS6uK+_>!%DTeBvMy%s=sUkjzRc?T6uQ>R9Ck4PR zM|RGx$;I^!`SI-f;(EXHmy4U9Km2k-{&IG8b@u+|;>|Vra7E5PynlUhbMfK*HTm!p zIeY(C@}C#)U+)vf!Fa+RrU=y(0RjzYey?-QSnlI?4>Inr9tmhTiuLX^5_c>D4H+E4 zC7yI>=yxESpiwdB$mxBveg0)1F=gQ}4#7%lWm~!d*!{} z{~sP6=Kp_m^!@Rx@4q>E@$&HG_|^A^C*OZ_c>Ln%S)kLzY}H1CeUjB#XLV!bh&Q2T8{v~W1P zy!iFxy6}P!KMj>GC)=7Iu}u?flXzHbB|G$3FVo^Q5>tJOONqxP!=asg#BHt*-|3E8 zOF|~t$Pmta+Y@W~iydHD)eM9%s2n1a2R^%F!GYwXE{(h~ zR}Ac62Xv}6&+v|gxG*OEvqXx2R~SC@)Ry3ymU{*4UOU#B+wp1)t0OJxkXkF<)tl>^ zBn2=IyFsB$ipq4b^+53utS+ETT5Ds1gaAr0M*hio011+lm@g%I zFAJUC$;M0CdBHxJX41a($fq#ll4*TPxg?) zt~ye;V`_X$j6IbM1IE-MO9O@ac|Pp6?8ytdVy)c9pM<(Xe6ckwWMYp^gmK|w$?PxL z;9@NgrV+o>|2C;mEL1F*2DPF(2)KmEWdmnwqs+l*X^gHW(y(lRTn35QFyzX&4r`g@ zLY0?m$y!*dn?XIZ;Wc!ncFk9;X#$*sC(*_Pap>X8Pa(O-V4P}@s0^dL{|&cJ2IPu zWj6`?;&sNc`TqXC2SOd(nUb(L_~`&o9H55YotOx@1Jl%j{>4Zeh`jEN)g*WZ6}xvQ zU0sQV@uZ8@x~8mtW&i1i5(zcqpvf&d6F`T5wdty8tVEye+6;F4q<{CKumAh14+Rm2 z%d9Dw69lEv0u}?oDz|>(CXgDXh3VVRH#e8R<_^S-Yi+(_ZnN=Ij0C;Y=yKPovxxz) ze3;quB=tNtRXr$|76VWNpikQE3Yhg1Mt46veA?-e>*W4CSMO620sd(Rc-H)Itm|ZF z$rjTygC){AI|cWay=7;MD>kVUc-fK7jOfh_G5zf3jfaxdUm!bJRRXsKo6sntv(ge{ zMgui=V~n4nY>pR_<0@_@v9$PO(H%2w6K~ACTUo6L|06jqkWV{@pu!)1+Sx}{ocwTj zcuf9TIsPuYPQzhjj?k=TZ)li5h}1MT;o(~rj@0;+94)KA)SX9MIu2)$#!gfpG>D6+ zfg7vVhbG|hx8NzqqEsPYoKb!_+&6G5Z^cNLIq=!tfmFVT)u)|hnJ8)4bvDjyjbz2# zk6C2(u0V`Xnu%CVW2Fp8PXgnj2c>!98n|as&Zh>!CY_!$Z0U<;`=r-){K(~|xPJjl z2kx6IQ=hgiTm90!MQ(9CqbB2P{BAA_mua z_Dm1m%Iqsi2YE<5iWo6N%7Zv!GI4PPUnd%(Q>X5uEddgog`SADV$A%W=IGNF(aOdh z_vHBasNQhwzz9{g;sPhU)8lj8WlW{t(?xj9n?^ST>!PEkxyVgK1)*;!9rnT zQ+Ni1-^QRx;0{Ur7~HoMBeo{o4O;ZiU#{L_(yMAUVO7Iruri&7=jQEov#C)Raun;t zQMBvFTBtRSAN7uV5XdFUXz&d(}Rl`llI%X zuQpP6LT8yPYyi_`Y^s|_DU|0XN^YP93>!06r-<-d`KI@*nxjs7nq5J3a zciros&yHWddd$8(|M~3v=d5%yF{}g%wT+tBZk4Eu~gO?f4Yb{KJ}wJfc;I&uFq0< zw@k?c6-Y49gNL})QcYJf-R&H|<9P}lK#9gK-M z4n^MK5&+2SNOKVJt>jU?XivuIExThagwa{9UOF^)EE)*O)rE)%h|r$@=$IUSpcx zx4g%s57wZ4{PN^WwtQzvT*Zy&qQ(#XFR+yv6RXLb)JwAO>Xl<|W-YhDR*OJlcP11Y zAOXS{f{H$eaAiaN2@fyZh=QH-#8nqukOZRK zfKAElfGKR}nQlJoRemwdIteO)^*`+#e%jI1(BX~dYnjkklX|XdTlmA_;gQ4E*Cda^ zcybfPQZfH$QGMGyKPtZshwpP$^M1o9WAfSWZBBCZ;u`BZNq7ndSwnPy(JmgkNlFj> zFZAj#ml;YBrN4|q%-3i6N$PzpB0l1waYFw8{-6I>l8Z~bLA7%ayaU|T!xDqUkOzuI z^1yKBfo|?|dLj1NB*r?pJE?kwHj6)v`Dh$y;{W(C9DWYt$!CRQ`WXkP>MpI6C#wDa z^<(n{@lc%{ulw>=R!0WRGn0)4KtW)P)#kT?Z@tO>K`sn4A(mI2_LNE2^l2x5Tcp(} z4C4E=12ev~H^bJqyjUQU1*h!ED?Fxf-Hu=zT(d{HS+J%@t?%_sy_^{&5Jo`d+*t1^ zS0y1372yvSU|(-6fCR!h1;y`JdIa9J+uFfV?`V&JZCOup_RaC0 zg)6~5jvBxc+zwL$d*m8zGM{#AwkNG&h$P3M%H&XFq2dt>W~*Qa5i!jR)_U2@3?gFs zg@MY1N+zB$muP71EOBj8U;R0v9=pWER|~L4Ni%gU0;>@i#3E`*7W!sR0Stf!ewd7lhFZ_t|aLsJ)vw+T+e;x?gUhch~uRPDvFi0so?-LPvxzw>2<*Qz}^pnUuHRS+V&Y5|!kJ zRr^G%QFk;jIlHX}%CX+zcS&B(9(il7NVy_$sFf1K@_-&|6cp@ye#gd0?q#>=uW>OT zuXSNA*Sshu^dXhouWfcj=VkG(ta|R$JE0G7*@=P`4zgTJa1fUBdv>}a63x%%I?4pm z8f*-dpoag^O9sX)!NEtgZUg=cH}Y_O&A@(+dPwp;&_uYJX`Le!sz*LdxFUGEno}Ym zm5|WH5t~x-OH&*wGGDHVkBkD>TCQH@>ZR8!UU?pFyooeXgBCKOBs(^p%Z-itU6LHT zG%wVZua0R2@>vN|YZ~l8`LhcGAYi z4=rCI^OdChT?+#?7;7$y&seS!Hv{}Hu#6tfqQ2>FFvC@a{8~w<G9WGYO81$upu9ECWjqITn8*u$h7$mc&i7sEZII7aRkE z%c|z1%CdR8^TkYXMz;40x}Y|@pITU$wzyS4&DUE9xyocKpfUxh0fQ=qn5*me7m3;m zaF-tAcgwk~Ze?__4??H}X4Oq-T`^6SmnwxIdI4Dy4;(VX0H|B)uOuD_k%(2bA4!9= z=F;FOwIgD>*eH1H{dbivZAmpIlEnb!sFXP*U8f#_HjBWyMcp@+m3zs$2b~yCfwLBS zqbX~QzFHt!8VvxeaXwgV@2h2l8lTe^{-)*X$?_hjn^sI(dzm_Um_C{M;^I--?1WR} zN%|FdkvjQcG)}$|?m_5(4R3Ksf zB*!8jCRt)5?)xmX7a*}LT_}w*X*vyNH{zmt-<|8~&RMQbYV(o0ce*b?47U*rm_`WF zq-3{`21MH>lxm~0{tVudt}0cwikXb;ref7#bistcnS+Q;#GOgr5(GxAT4KRtdv$!i z*+3e}YOV08Z|kL_Kl}zAvC+~cSvw}k)hXoyEU{&S^!b9>p!Rh{6?@AkT)ConUll53 z0j*KPNN3lcxOE)@m58mCfqsT8gBWoMsR$v*5)VfUSxdx(^2+=CyfOww2>@S6nI`U? z@9e_1ZNy6dEg7;l%g~^u&sEOio#C}Uq!bQflM?#3Zc-yzpPApf@ZbI1Pggdn0NS?m zuk@j3m)g%Jo(30hZhj&ckfejD?(2vS6{OSDC0HQt_x80Uu#!TeGY^N93HLVSp@c2) zVn@b-g>0jC&w-Ol#D=}(&QA#u$R1~E2szBSf8gtGbf+Q+cvrI$a8lQdLig|lz&BESP@VEZF%sN$qiyAf15~=tjKJ$2zQr9?*socdrY_+8vR4=cpIlO*; zx^w*BcCUHxC1$8;++==xeT^k+uZbUCU*lPGvspy+XCW)@+2uuIjX=bq+$AD(tuCiX zVpXZs@;7Ros3sEA?6;=yhq~yr)!8<79E=;)RxV>-AfI*)^toLgc(mt5>eJ4Cdj3ye zszCPizw~Q+BG13QWi$Pf+nXAbnPj<$qOB1GAKq~PHP;zHRYbXHHq;zr+q}{@)w?Wl zhP3Lel=6sgoe3@Ql z!M_k}7W0Ku$eD=p72Dq@{a>~2(%(m?8-)1_MKqy7S4A-+QxVXJtJ!>`p-^NZd_J6k z^Ng^bQnu$wKp&T65D4#fKfw`|Vq#OGWgVJmh^iR%eH?jgs+5^(%m>A#pf?fbC(T(* z)I{$x!-!O8@0Zgl+c&`o_mHwAq6yTDK(JyN54yS1u-h7tK6Lc+O+Rd6t2BWzFx&2p z9&HhkpY(>aXFHWN3geF;E3$9)%Z%@!$?Ki(hv^25wC1X4fM;Z?(pKTb7%@nN%#}2K zfiB<&?Am|`;dWAuZevVY=wht zz$zIOvUq0j@8a-glI`<}R+wn0!0pR&@cGqiegh*RGhf@zX3Y zX5YvwqL)`cA6__(#2{cMoa!RXGR}Un;)GF~a}Z@0TxW8b4bmAgsZZiOR3fu>)mVQE zS*e$u;t8D*sZ6k`$&r|Gm>cNP@Ifc=Z6wSUj596=aDR+g;tBV6774;a74bANP{P47 zfYY=YU5{FZv*IYB78I~5ay6}E>Z606@u)?f!|xCuL*_CuOxeLehfSkqTAna9@AKo3 z$rql`P)apbBw$n`_dv-i+J}}%;GjMd3Zw9oh{&AW!Vb=+Od8Rt#x%^zZD2)&L6>6!(K3}^t!AEwMRc*1l#Wz<}NCr$5K1CZf<{MH__p3h~r61os$#U42`0D7js z*n$z5G9z-U-TWKxL<&J8@gT3&qynHD@LRj>g-UPmXpl9Iax^z~HmNI}7dp5TsoZSD z1B0xZ7dgo6wgQ*=4_h9DVYI7R3ewko?3?_2sgDt%gEB2NQB(I(gqR8gR!9^EJambY z8#hdo|LbO)VS#`TnK$zSW_2-{NPnL0HM1h1w%rjDOCfS&N+k48)0uY9-ml#!($A_$ z3IEhZf4G8m8OhTU{uL`B2aV$i)vJN}5WX|9?~soX78JKjRR2JuifAZPb^$D2BV1{+ zCg8}|2QP^h*W7o*!`SbrLcQA8(N|Mk+FfG9gU83}F`{A8Vd zCrO|;%kIJjU|bMNS7vV_5-9AC3ygwA8#~$cp8Zbyil9tE_vQ(39+>`pS@BAd<(1&mIGb!Y`ILN$BmRQ6_ z>_Hz5CscW320PELAIhVn*Oj%`CRxKX%iV*8BbW-k&n>_Exm+nr|lw@TS?& z8cLxAZzzNdy`hlq{&M~yE)FhwTe(Sgl^b4nZJb*w^A)X`1a~U^Lrx}THZO~GpoNsN zNNS}zgwv_XN|Np!iM9j>>0o9MvP`Sqn1&Y zSraHnZW!h(l86}v8~Ly|VT$@x(cUO6lh}b$4!Wmkavo3#>Am&1{3O!Q(S3cqEp3cT zYgi9vtBto7G*{t6#T4Qf0br%4ewARw}kV((QK1I~vYND%N_?W|7mS z(z3}|7VX`lBw$!NyQ4hNdld@H0rMyrZK45J5sfl;A4#^5Sh8UpkX^|b>4m~)^U`$> zWhfo+fU6loF?b>z1{`lTlAD>{@~X4bwpgPxe{tHf1D9DFoU0}FFV<#PYm2o;ugzFv z&DU09kG12mwa9KQvRjL66#-j|?3bWlZY{EN&(Bg|TRcck$LU9```SPL*-5t_v`M41FlBFf=%11ulpE6^j%Z;1 z%s32_kH2^D3N8gacHPa4H zEESEuIb8Z%MdH4ahfcXoolNMIr|_@6+aILX6z+~XxKz($sl?>U@B{=}z$)$7s|8r- zVJH;Mc>AYnM|Z@+o|b8lc^cJ_JNxOo!`}D3L%sMTM(xHR6`f2^Nf-w~$Hat^5>A{$ z7wu>fr#}zJ4ea!6I(d{HdL!%-a2sH7P!AUyzyKz6^Og?NHQ=68tASZ!MEn&G=UqQP`b z?TJNtV>Y3w@Yd4c?DFE*lk38Z^0<v^3P%bpaf3<(*IENpbSE_|o^ zX|i%>V_6K{%(s1kqYMDx8EXk%U5O!~VPd4iK%vC!Vs#*z)d?2GcA}5faINpKTb2tkGQhy%@dPJ9C9@Sp&Ri*tVARae0Ilz z1Ib5SfQnPhQ*p!q92zO{;pI{C{bU5!)wR-|7Y)Cw;Rcgd{KNp`zf&G zy_O`Kq@=3qi_5paT2i^ST^Eg{?w;ALo-QyGBw-~J>;zI0J)X7xuW=sayuf*s^CV{> zB5=v%Et8^DDqH-}T_O`mAP@)y;_?g2<5XZCL4NT%?n&y?zE3VLy~#W_gGSEHKx|7W znGb|B6u9aE9s?{wnAc^0ERBvcmwW68;hjQ+F+@B^Hvb1EHCRNtmVC{L9ZSpE2J_Oq zNSG~Lote#eF%d}wMno`ruqj9CHrkjTT{zfPAaw^fP|GAQ+vCa%FAu60K_$6iLm+}H zQ4-RGT$2eeOvP86WgJZtvL|}A%<4Tlci1H36ha;qSn*q=Ll_iPRmHv*tks2>WHR9_ zQDq)#69fw5M$c6$>?fm}wiC zFbl!9tiagnuq~j_*4i*CmOaiKcQhLG`?v-D)CZSMibrc&W)waYC1nyoH|&uG?8chn zZm3jTh)g6#&E3oH^I)(+RpZ(FXgFTOkmE^ak6wGSj>q1u14#2oC}<(kUQRm_eIQ=w zaC?om4X(wsi)Yz{%R*!13~gM>$P<|yN~q|dSW)JH6a_EpQ1)a>IXRHlBX}|jQpzQb z)n3E6W*P5`OtT${g&;AhFBF`mpSfnYBFlEsmsNqspQv<4@A`BtVh?gD=2OO-FPzD*(Nl{1|#YC>LIx#oEyxtcTrej%~$(&Ct0~c0+!-RB? zeTb6Zs7u@2q3u~Zz@xuM{bJ0E>nM{Bc?AzXs4@dK3LqVf1RkVZO`1DZ^?+A-vuOm& z;9X4iUNBSaBgk}L=p#|NeW~87?C3psLzm}iHxPXfmFmDD4kTjP!ZyGftKw}s&bRam zYX@^PhTAm(1(?X8fm$$HB$u-sqbp8MGQs|EEv6mRj>TXg67#1hoDrV4e^?>H?Joa= z``4eAdlj0xAsNHBuJ%7v;g6tEO%fP})Hp zp6a>tUR@B=ci34W2BHYxfc$!|PVPifnw2%vTX-}8|Dh#u{wk(Erx<2=Ev8{#1(v0q zh`RbRDqV}I?qL9|fX<}GjnoN@;hY~QcTyWoTRKtWKGf<_xl5E)QSXso(*6mr*(B-Q z;9An}gPT(n@yYGzw(b1}wOT!r6L;5yY4jK*y!v+{&mc8mh9|$2JnOOJNL{0^=pjqg zN;SY+nWYIYFe-vBu$ofVImiKfGI`nO*GnTpgjL98Qf9nhc8?5Iu_Tgj4eAC)y1;tC zEy;XYZ(onFt<}1#G4Bp$^gF&&1Gn@2Htb+N@~zY&a&<$z$uL)iNOvPi>32(yed9|g zb|^RAmqVs^5-Zma9lKECMigv^&Lwdp6SLc6|3?%GuOu$tIR+`|TVX6f5#gHcvmI#0 zSb&eid$XuRptEg0|Rfl(g5I66-lUV)t1yBPs&RhFJGjl zebNbgF1i;xapV{LZS#A;IOe*@RaIlikU^WHvE<4I`*JNE&h&cSB)jzblq2pv((HBQYj zM>SUpv8r0v54-E%rT6OAC--ThB>`~XQrX)6w#W17hlPc)+^5@0E_9o3ohW?Z>bL*s zLI}Wq_jf=2cIT=G|M<=BpLhS^{`l?g?#|ASe|`6t%d?Z84=Zlfd7mmP0yd+L>;on$;L68fvx1Nlb`8NHMvoeYIT!uKOJQ)6iYn6BqAP?+LVg!Y0A$#de)o;%WH z)A+s>X=(}z%8n-)nAw1*yAGR_RPCp_KkfsW4LEiy4fI&yyM=ik8#FY|qv?4s<%X|m znYTUNs^U6RJjI}L0{7cF=3;DBeJIizO!d2+rgnNX>fdk#-if^?VV+B%YFC}LfS>lg z%F3~LXE#JMz2l_bitxw?LAT)S27Y8?{FPATb}&3Jn<7>@0`G*b^zNFqjH+sP7*@3P zISvJ^I`*1~PdPx~XfH2TmYW%O;5BD_ej&sKL$;5{*u;J?j60}U(Ef4ELH&n!L7MJ6 ztM^;Qj+(OV*W1h0{)XoSPNz^4K3rMdy`EEBYZ_Pe7^z#w8@vGj9y}FSYab~M_JD{O zh&DxdTep15c%jNXB|DbCuD+|i_&p%UVMWIx)1X~3XK4aT- zA+%^9vh#aS_4OQ=Ze(1A;OU1vTVYkJjO`t=7c}ica)&+8Ak-SZx-Fy;(HXXb=)9`1 z7b|zj?N*IHScs*;gjNB>LZsh4_Ze*{V7ai(Ji~44C0j0@)YcZ;!6&yh)WusU$l@8U zTr!&A$=zgyEw3h$OAILcslk4F-9x02Lu9F|TXBiy(+;L@2AP8@NUWTloj zo7hcFVyU~~Bv|^?QjGq_%GY93OMJezJ=+%@>+V3`+;LqsI$N5gjvL{4M)wc+axiTw zNd(jx=_A~2I3$SKCu-s7nx5qRR-a^C8<~8QspR^?sO4DM^$Wg$ui2KkGq1KfZ0l~I?f-H!&|5urI`$Voh$^ER z`+Y$T?3o%Jmk+XR?DE6$hu5HVrHb7`hUSfMz>OYjGa>^V682(TsIiP3qri5{xq!9v zr+~j^wPrcX4Zfjci0F&F2`iiq+`R0NKu=`0#)hG$MNsgM;njB>|;jH3+ zFAHH$;TDIxZ&N?e?f2}M8;<8X85#3%gxDjyFY}asiVo}zovjH7>ESz-wmx8^rcS7S zYsY+q-?OppliBNZhn)+aGP^J7pFh~kU;`P{;%KmJ{eIZtPTCRf1{Wsc75GJr&^xSG(^M9E|s6 ztn_nXEXK4*3SrhbJ3~Wv2EoM#uvg$GUpfXMUvOnFNX{IRoPqXsJ^v~e*8r~0tC45` zX|v9(Tst=@6o2qFYp}5%M1>8cUj3*W|0XteA||6joA7Jf;LSzVLU$x4BlhNE&Nc@A zfB|C}o^)FSj?_{-SJrAHk5w+s(h?SP=dtbDSuQwt>%`tg-*T3y%;jmQ0Z!95n{#<0 zaFmdjj2ERnB=X+*$>H(4lioP}^+?@zjp~+KbfsB+UN#7k$4`sh)2uW%ekLm&D{PKI z#*8cxKTr+p*X%ou!JS|`a?T{BOotUb)XV|XQ<-H*ZBq!*iES}UqZ3*a;ogRd$^;)) z*LX~ZYk#_|)(vK<7+O~8cv1Nt4QFO#sd_D@403x1s<8Z2RCz;~1g5@MYEks)hHb;yz zk>W9Fk3{M&Izn@%660W{SYMc1A#%3AzrPRa#{O4deZ?R%A{B`o&prrGeQ|KmWB+;h z?k!;(P@Pol8BpZo#=67)_r-_zj*)cjSGdvm=~Y7o_rHAgs>hCH0Z1JZ@=kp)}cS&^kpxYIh*HQa*AxauBz^00IQBqu6ml`Iw?iiTI?Hz~DNVB{0x`DO5S}Wph~} zv{j9%Bm;I9)=CTWNn<)1+Mp^t2yJTmP6y#fs%Rt5l?kqLjK;1W9EnKTk>7lw{4=29 zxhmR`>;uq#p!n@bX^hu#+TpdB0?qBw8o|O*TFvPoPRRjK9;pc*MK61^Zw1^$nHpt2 z)0z@4NvgmLxdRjkePBo~rCmD+eWH>lL?viQ3sVwl5MjT}p(ZkBZ;yF#ZFPT=0zHU+ z4sgww(tjg7I9!}PU|+J`>uuvUQ3cb67sT`S`_i|7LVLdy%|5zlsKxU(8X(q&CiZ$MxO;uj}bnT=YJ~>&Q zOHdtequWRumr%1y;Xmbtuod_YiPd(La?O13a9orms6nb=Rz`qo;SO?265gP-qv}9?a{?4 zOA84ot~=idt5^zd%0jG2$7*pogWlT)^+6*i2=i!5gaPCHaB@1nRrc)a!+8NBY^utF z?C7C-PGN62*fH0v5JRhg7NDsTSZ!&)*l6I}eL@9;aduf$-+&Zhbt6-EawCr2jRV%1 za2+MRLJ*bvoMrB%Qg!b1%R7nKa+ZNv8EAmUKbdyFyr@IXiL-r zid)>Ev=`a}$-_l??%;Z;K- za}}%BiBczWSA=zJ)Ukl?JT!>(-GtrR1I@&vYPdobV%EoqwNEsOimtE97B&stiu{I~ z6)@pogEI}k+}12rN$C+#U}b`zj{H9Z*#wLaSI& za$iHy^-yror^`NRd-XgM1mUJMvq!fzVmzC;pH1AA&pIaVQ#5hg^CXiROUlQ)(7`Oo zY;{=idREfoAPZ34s)yXyG(2ScuwIc?=!6Am01seMg?<|;ymRKc9fEWbZyinik*{E) z($`paHY)McA(-+GU5WA(3+GIDB49uG1EsN{t?jhg(uy&S3E(Qp&}^x6jQuAR4LT$H znpI1Tz_e#kj5Sk(DyZew&B4Ng0rNhs&C$#)^=d$tCDT2tmj@~?}{Cr z(09`%X)Rb>zW$qg9g*Q+^!fjxN;2A7>4XgMmWZtjZ0QSE?ckTaWKwqMf!crjC5 zYuRV5BQ=#bQa1te51&Suvei#JgxUFRTTZNA-rL(~0N$@OlhTlkbKL9zjv^?|iiUHr zy6$%PJW=S|>gOInxYds%+4_4Vi1UC`38pl$}{r%a=}QYHYl2{#~ER?iBT5dwdy?VF$?QS?lB(XGS$j6u??_cr^>g`Zit zibHOPyX5E+RBU<+shVm4F1Y|X?ol0Q7(SO-mE#>qpPzV{Q^>;%`_AXyQj4NHEM>Y5 z-#%eg;a&HJsk`lXvcGF3q6fP)Ved8#6p=Hc0?j<14L6cT%aA2O8>V<>~brC7{c=Jpzw zmOMjwM}s-KIK}32I5OQ^0Y)c07Q+5l7tgZo8IjAWO)y8JVW(gl*5&ExDYHM!S$SQivFKEpbw41PYmts80 zxM}Nn-1;Fh`b7>ByDfO0c6nwQ;_Uk)isVK{uS5vAl9V#{P}=s?p3C2mV&4}j$OTvV z%-(ZvbF58e|2X^pD5^?f-|ZfCg2|{Mh6MUpR$wO>N^DAt+kX6m9i;vBPu)L6K&F5C zXysgCAEi(3Cr8fLp^w@=D-gr+QvU51tcy%>;e{sg@~!f ztL@(PhTB!7EG^;X#h$Kf(C9Ka0F!Fq*4&dFrL@S6EJU38MWicpWU?9& zfyzT+bchx~IcPUGoi}tH10hL-r5nwB6$8nx70Ed(d7II-yq=Mh(NJcL_|5ueouEl{J?JpJt_!d09yGT%HV&?EpS4Wc%@Zix$4ZEc zmKNDsqOb3PL@2owy&IR32!yno|26wf<(6Gc5$wddzXVkU zUf7?HEb8WDtS^F6egtpbD=Yo}EG$PBR?BA5QLicR*iQW(cXfK-jqL9B+JBk-q}$C)q81 z4Xi>ykO#c62YCBDpVE0|MzTn|6JD4p-c34{xB2MtRuf;-mDLObcp-&h^3F_1_Tq(f zeT?}u4`!b`pBQJ;-Ag{pY>)veXomy`^bLn4=g zbIuveqT{cU5JUH5r~rvEFlC-#lz}u;H-h8(QIDl5@y;j*Xq}0)drwS|u~U?))su-} z53E4#^W^%L7paC^A8sT9eRnF|?nGm-Z?BwWyZ#QLg$Hd8uVK72YRrvH;ASWXk*#g) z!3S%V{ouHuX@II-VBDs;RZNbphQOid#lUCwIK$wwkyN7Xc4e`>o0*=Ef!&wK_cZY`;LkLdG_^zc#YI2G+~ei z^{n?i>pjnU&jZirpG5ER@m}ldJaJWT?~IIn+~I*mrVJReM`>FZXOgi!`P|QOcZso*YV(Lfk;%XY$0C2IYk|bn1@e&;x0E7hxe1 zRiq&STpMmmT}_=x&_uR5GmWR?LrZszDQLG-*Ug!%^wB=FlHD`BlHDi7l0EJ4h3aQx z(T;3J0#GsjPz&5dVKE^j$7;Z(5s^Hgo%@Lj@6UeL5TA@r0->LGOta7Pj=^|e$O@?K z89FhS?U@R0gYQRbS89`-ynYXWMK_M*rripcarEShI}fiMY0{zWxKR*hF`gj)6YRP! zg^0P!?&rLN*Jy;H*=;fhYE^)+Ic2%>zR1`wr6{J%DnW4(=tSjOrW8y!W+rjCWS}@9|4X%a zleZ7BYccJRznK8g-NP8RP=(QK3d2zSthdBE0}@&PA7c5(ji$-YaAOcLL!e zXkJr7zgGsnd30joaPLhjvaCt4i(yz3#Ou2-2p|bL2|Zb*W~Vt*g`%}91zJls;pbj!yN*}g zeb%vi;HNnhW3`oA(w0rv)aKWv4IFiEA+qT4F9K_G!|Z8|Q^0d=%qMoY{ZWyb1a9s$XtMA;Bp@-iD$tjyMSKbgI!S#;^NIx!);2sY=~SLCi5gK z$)pHP;V#ykC)Xy-e`lg%>s~tWjCzk3((2*n+G^jmIpDgmN)40q8oa;Z zgM$^(omEiKq^hRAk^MrjqY=+@kwpo|WDW2Iu0VICvR2#Gx>io&=00tF^VNi(e$}dt z6-+1C$dS5bsbaTK$>7GGj^Ibu?p%#V3XvU&8czx}mfD5L)9P$ASu`sfz$;bPAS?4K z0REdJW_U3a#`ebYa@-dUG6NqDmF#n>QM%bGTeu8A{P4bYZQsyx(c0dsB1>;&iaLd6 zJNDt-r(cTq_Ex5?$pMY3WN_hImJAH&KqaIk;AKOLU3MZd#|YX3*v_~w^N>Ck$ZTb- z-7oHPs)fPq5J<34X2i4{mzm+YP^HeM4Or#VlDg^PmWeyu0&NaC->7=nL0C@6s+>9P zLhx9+=TAPLoh0r=LQ&6?tQ^V}*&3e==R814ms*4*_ojth9toEG(;mu~^C8JoF%fwR zNNjHc58>c9N;yI`dy4SG+YWK9BH5!@w2{hE&BUE4xD{AqE1GZ3o*VyxSZ5NG-7wZW69Ayca;dV!~m!xe<|bZ03cWRY18wYn_ENfA0{H0<&LGkZUav?)3~}N{&IA} z=-Wp2r8Wkp`+{l>6A{eOsnpj`rOvfPR5w6cvmF$)<3rK6el#|!&B-dpjg1f!m zl|6NzQaSc}t=ChwmrZzKKz(n^2EL&aDbW{s6FxW{xEQbwWs`f%FZYmL`3R3BUh6j= zf`{#;;$}~${GbD`aY5D9F>%ed4z_yiLXKs|i)>m!fDX@D`R+OdkKO(j+ffDdoba4w z!sSlUKAWQMxck`KoIR+?agwfa&~9U^=m@Fc&>RQhDswAwd+fV;#miyKxF;T;s4X_n zz3+W%-QZ>|xSx(pO>T+JHD%cfSRNtto0 zR--kp$Bs|V&QFdGFHeqNv%gSJGFAn9>@o(Aib7rqp~t_gL&A^e0gVwLNqEjqb7=xX zHHPnHDi^M(>O_$>a40cwD5uWs&(+>wPa^oLAIggBXA5oJ0hqQ`RXs|q%LGGXefS;^ z0*?jnFmmS9q-OSr+3sySWg?rw{r8>5FkICo?=kklMHWMX^ZXJ5h(Qqn(bpKqCEk?% z_@#u~HIz3Z$BAuLI=R=ku9X(XP1l9p6GNRMCqEL0bUSci#QCu07@5?#A&LHJv8YytBConvRY+Z zg=XJS#98^Xx>!_oMO~Y!fSVMe>*1)Nj*Kdzqdt~*&U)i)J@`~Mty^(|e&lUrh@X&U z(|{UDcXvKSn5lv+*^@%v$V?0YkX7cxD6uzA1tx&js?qhG{VPJr2CjYo;SxZ8!Q*vr z)!)7lq(Qga1w+No->g2FX1nYMLGMujL|j1KqmlARurSs@S=cNX2S88l*(a@*hDS~1 zd8ojONRQ~*+L-RSwmfw9(0RP#T|Z88a;B%_Oy<`CgKVJedSXV2%y6oO}qW$HR> zwNZI$*02GBjn4A?w{8oPBRUp_TU$?XzAY}J8vyzpzIx?1BWiRjBYB0}{aZe&L z&ZTXjkZ8#+aZ^YcKlTHy|sLoG+flYom(caIb?G7{>?>OU(9_k8Tnwv z+#kW(7Qs1HE^3w>09sqz`!2O|n(PU<9_)OP1{-%eJP@s#Dhx&YoS|)O<#YwR6HtH@ zR=8WSF0?P<@MJkQ+fls%QUUNIBR5z>mVk#LNi{RQ_Yy_tZxSsH2 zqXlEaSNIL2?{7>1LT~Ft%lU@&6uDM}a`i+e$|VBExpbeHitJJ3s~4|7ta)eJ{C%mp z1n^w2k^MbVM&)Zq$=W{z ztA=iemROxr10UDMDf5o2(UX-pyu3gB1hRQ*`#`OeKbAuId3*_u1dyM=Ra_ zS6_XF1))-r$norh@YELv2R-(mhwt7(!ODrzh)RMzW6AfZvF@<{eevOasB2UGm8xaa z^m^<#3Tuk(SKN%K4wGSgFu?WhyP~?de_bj%l>ElZFLtFfh_{kQ@i1Jx($TiFdqlwWDghiECX!Qs8}6 z8s`J2-yusH3!=Bchg=8sxi#!;)%gs zQRXwPspvInZ}39y5V5213aI->RjcS(M1&Lv1 z0n+>IhWxU>10l7SPFc4jiX(i4Axo&sekTML8h6DtNy9#`cb}(7jtpYIgr%em-!^x zf<5+*#2_*w?`xHn#;54ak&)1;gR90oNcUJIG2yI0@zqv%;%DtGzAhg7I%w>T{43SZ znkek+V6eBXFZfRzh7yyoB}X|`Vr@FQ4m@mx3#_i_I1pB1G%8R|U7?aft*6+`>{4yh zf+3wz;PC8pts6kpe!(3ee&Tbv1)Sn7ATH-~9Hv3GSu2DeQH`7#z#DrA#IdARFgrAq zgySLtz;hlz*p82+a>Bb>RUdbs+3I3&BCrc6x`Vf-==wEL>1(RYoaYJ)dg%^U?a>{) zR$0v>@`)CaWqA!<<36>CSR@PAtCdnA5B20LkS8NC=7_##X>>-4#cd&t5s1Abim_&D z(5YCNw{8x$)~We&@6s&;H_QzXQ-QDBeV)Cw?(^)eokPM;=B-6lZ=TPVl)d1v zed_*NDw=bcB&y8KrMec4-9|P2f2JP*P*`vun0@&1E(g3!rB%(><^$J33?-DOA`L&# zUNd%PJ$A?nk;sXp67C$oN6zrI2c*#=8xR_M9+$rf3O0%Dxv#+kRXMb9S01Pke{&}> zjpj1$A-3bdR4P?>;AIm@Sb;y)NQxtW`eoFCjEqkvh2qIb=;&>zPf@y*4+qB*YoJm=8+)E-Q&uSB{OJo` zco}sD&GAq+#T1#9G|=#Va;a zWubd<=KleFhZiuX0~?kJt_?fbXJeU{_8@7oh>_a%<*U~0)>dI_tEw$j(k6%kOqv?) zBuqU+gzuW(Mj|ezc5c)I@2~c{R4a|B<-ybH@eP;E{iRg>scDl$NiC|`lmAX%HUUow z*eOe2+Wa&d+B;OstQBbE?hVf7lq3RcR33){NV&pi8!pVFq%6+MM06{#0nqe@Q*EY< z6=Ep0S)=d;HmkCkmiZ7-#K&c3v8a*5@x1t#j`Nt$k(??rZFPtc>{ZN6~hY}F?H)h)3Cxxjax{U z`i3XhB2Tdv6ihpv=6p<$Tv5U6T6^6g^9?4_x%^=~>^Dh+Qn!Y&u}xO(bB%_rLf$08 zsU5c6CWn60AX$B8@NRh`{snpJE$V<;#WTCLr#^eLwz&Q2rVHA%DZYZ6V&#Jka*rFH zXhpwG=I?gVPpdNKoTo~&Z!(o!vtt3O=tGugDf;Q=A-tbKp&tws+Vaa&hJ+sTVe5s5 zM*dm|{EuHzg|9Wa`PUF$zpm@Vz~{&%ZhT zPK%-!D}j5$BzuXNjP|I9CrOmC%B4|7>uOA{9iB6Z$}-BQRs(h%HVW3kVZE}{8=#CcfIWpqELZ6&L-W4^o?pbt2vWAmqjJcN zxaDn6N@^7&>eg{|-O3-HowC2+HGvns3khU`tohfKg9d#Tj+|Lo%8 zE!ft}-08t!cP82Ab1QHoZg%gW=vf0^FKWqTp4x#&W#BME44yz7K_B9aK?r@pE=MxC zK8wuhs<7YX(N~oNtp3|3r6mpZto?;IYU$1aConE({_q>uS|u{LQo!;O4u=#Dht19j z)PuIuLH%RSiRM<*Rh8B82_|zl>y1tUd1ehP^U!b>%iJlEHGhGNN~gthikPcuIkS8o z)10vXK8a_6l&O`^`J-<2lQ8d%Tmu@Uj?6O>)SR989l07nc1+Zy%rMI3{=o9iqK)s_ zlFr`acJDX{3AZfBEXw=Zu>!HwY zIJ2p3C~u1_rp@LqwGO^(lc)5Yo%GL|owQC)Qv1NxHbJfbj9Eu5H)p%3*yedfjbmpY zBoMYuuFJhMT-rktwm0{!Q{XDJoO{7_`RWeiZF^fs5N<|U>GCM|4AzEgo8HE79I8!i zNNV%pqUMP_@l5yF z93944b4llMx(hc(j3=hasy{mfo`^$Wg9ge`Ip%rS?kI2xRGf)5f!kxWckp-u3kak% zRO=PK5M}A6J(8b}W=u*B5Lo?H!%$zwvO;qib&)qCmyGAYb5xFtkvx(Dp8zV;H*qw+m&0 zcRQKT7bAWnRaszbqu3Vx1ZTrkmEPWk#Wnrx^c*_94?n^+Csocg(G_=6o7uTI5;?fR zN7qws^u(SYt*hEq+Ew+Hn+y2q^Q&p+HI{!tZN>Z5GMP+U7kjIJe zoYm87>(xGM+x%vnev}OJsmLwchR_%Sg z6&V9Gq>LCv7?SKHzfoi-rWY;Zx+db*;Yb8r_GPr=X)4jYan?|jH)NP9p61M$93MyU z@j!tzb@4}Wnjun%X0~igHsUF>;vlLFeQRbF<4d&5h?;~o)~4V_45!{)@;%RF>aIGx z5U<%)&VIw*DxQABGoB}+Ao|!JPRUa3LJJ5(ff$2{JcaamG!!FU?2Rl5h_m=4xcv@e zjV^wnTM;`C=P)(OO@sQKd1ucK@Ir`&b{|T>?S>J#@AiJ3DW3M-V1OR)RVvO@VIo=( z&4pexAkqMNJWbb+n__PXRTp>Lh@$mZEubct*&dLVxk?43F#{csvQisSoSxm6kiMfw zpybTEJ`pLyKJNPG=pS9E4hbXxollr5;_saO+*^hL+(3@5lxBA2&oZ8X`qJ!7id)c6 zeX>qMC5yDoEGJZ!*Gf2C;E75X8mgKcPWCm3J-!@m`f-k>t@qJzypkv(sll*9Bx*cH z5Tk)A03aU8BwS)#qH-(lWp3aq6)y4|JVI(vix$v5_J)F=C(7L#t#4Q!N&@BhgU@jRRTT&s?)xk!8ERDr3_Kcl55m z4-<3XezdoEe#2#kmKv2d;q_I=vdSnjc19sSQRTuLAK26Z3kgG zDmRMB9Keevg}v#Jt)6|z5o1Ex9oKGg1Bs##OzekZc=Eb!R+0Mu-7_bG=Ip7@z z(!oe#dj!p$V2ikyYL}5=L_(6k7*EU;f;*hpYb5n5`*{!E(B*mB4Mg9=DAm9rsW4n- zdg;P82$HC**QMipORunYFgItEu=*d7Lj$#7w63VH0eC4OQvqNdf4COY4)A_QfDijm zbeLgkwMjrL!&|>9*dN@#{bv0r~Y_o!p6}G@HHkHi}895a+KU8U<$w zZgsb>0?X1))ZlVoMx|>p)s&bZT&xRhq)uQA=deAwliKLtJ1uA2mpQ%+yLQV0y*uLO zDf|hq*(B-Q;9An}gPT*u2zV`~+nT}{RIW#I;;vd0LxvX>_fF&)qz26J3X)zC!x ziXO5={iT#QJQIioaVxVl;RThwfGx_jqIeUK1NLO{vd^!V#xUgxFN{pej2F!Ak)bL! zn*sZk>xYhAC~+eSwnOKVxRHt3?XmwO3WWvT#1Nxk zYOXs&x;ocvpY1?1CdXru+VeDdm~nd*R1SlqS6M|sCFuUgK1XF z)K$jd4RMRjPpj`cE9YH^NhTA%a2AyTp3}pQ%Tl4CVo+X=`v^RWBXXSrgZ-e2>rC;~ znWXHN-8vSNOik_mZmTn2Z1mU%$7UV!VAOB3FBZ+ZNyOe*=5kz)U$gzCq+7OMeOaAG z#M?en<4FnVZ?0OEFS*p8G69tHW{4g;f^`Q+=p?10V(pyzRegF4K7_6xbl1O2?=5oA zH&HOLqSj_F%8kl3wJXciqWsbmt#5RXI!0ASe2YcWf?)-3A$N8^Firqs1HgbP0X)<3 zE9vW>fDu_6UyRVt{P;QXCsg+QgRi*e2*s>2n{^lr3hMgOL?mMW91{a(P7=_RI8uvvBSxA#=v%^ zjlDaef?!pHqmcsWQ+tCu=3;DbC}^S#%0X{|9os*@T<=-9x0ceu5&kV$ALmh_xd2%) zj+%BAzn6eC1u#AtLKiz9k5q0{S%jT2k1)$;UFP-zc!7bRbEi`sZS{E^E)CT1N`5-F+^PbzDjK?3Tx7pTi5-vV#F7*8>ohB9i zvYGGv*golGi)IsE@UbwWAfqmrouN0Dso@YN3Yj+c8+%9;1Bm&Oxt6J)&V4)=1klpl zGJQ-}jF_A_K8N+<#|f5PdS+Y42H&f#gBM@*_IvxigR8Ckx|8fptXOKOY&!$n-{Qf4 zx&P&UgE22Z(^raBWQLPFdyMn!J-7P?yl;*8Z0lrEa~BsmDO4gfSd{H0Z1zFDkN_AX zZjVVVlCqG-Uf;M@`C_B`>KJdh%ru(YNqp_8?4b}lK>id1L=gIgu49E41N0=;QM3h3zsYzo1d9oM=-BK4uBJwwGCMn)(`=gt0f)eDkK! z%ME*M79X}ERx3OLL%Z*dg=pV`x8Qj;Qdz3m4KJiBqfiHX=+LI32gwQwCn}{w>X1Q& z4Ke9-1IwT0`mIve<>UMH3{{qG0+=scVt4a)OSf2Oyu z@VmzdjJlO01`6+`qTCw>>x< zCWX42`kN4ZwU==twAtem*}Zv5m!duDYR`T{Qfg8tqk1DV&VCIIyEiYpwvouoaTl9) z=~?@e`)8VKoG8&@;N0dFWU#9oE$R9-`^Zb9KC&G;Eq6QY}z*5zMH5XisBngf4+sn%{O2KKT3f3D}4lSoL(2c}CcfoGllXM@sn>ud+ z1`_n(x$qbitAM$BEgqQnYRf*icXxNS)ngYvB)-y)o;k2uCh#zQ@xr!=SIs?UR|=m9 zYxo-S-gh^#dTqlBBFe^><$!n;QUPM3E%&ChVxQ&t$0NbB|bql@LIsW-rs-0{%7gBG(D*rT$W}g9p5%+ zKC>646&;Rc{#N8eGkVPqHl-)6x-&JI2;7qz4QRE2vyr&6XTo|HJ=h;_0c}VPp-L-n)zCh(mx`M`ZBkX5tF28joPR-^l{$2-{7$=t{0ZD*nHo}JVQD6%w|Ig_ zEh7RoThs{INTH7z`NW^Zucyn6NWdEY$mn-;V9 zbo<7=x$)NV1h*IMW%q19CsZXjaf=RS8W*kK?jn6O)85DW_~K{cjwdF9VawgUveXze z1P{a(qkc%tS>s0c!v1gX=Ea`hUvQ73E1Z2~tcP9qV>i5)Uh51Mt8Q&O7=4WFy!+Zu z$BDIB+H}}QnCr*z@CnR)9vL6?+Q%4S4 zjVGDpUW<3W6wu^NArVCC%JP^Ix#?m*S6fz(Oa)YO2H+Z;A^k8 zz*UrK06-%YFc&s1ilNApDN}<%SKmsLK*=Kr_cP4dD_~gBIpqf^bCz%ox2XY_Sy>3( zV`rJL-$Al0&zaQPvVV92P63faAw2<}wU z!Ez&eL#AkgokEND&eH25<9gHt>vRr3#2o}qa0Jd(-qnWZDKAn6YxA?FXEC)G7TK2x zN25GNZvv-imX;6+W(0FBp}ZJHX|V6k-y)>rVijc5q%-qfx(i8l`SxP9sntHz;uv5p z!C?|P8HwVel%^S!Ozkj;0JK0$zgkzW>);T8A2oRnDrf|=Q`6{G$i+|@iTDKe=Y!sh z9y_9r>~?~>+!$&*3|?Yp@cYU9O+9eZjV{7kh~Jd9y-6$@39HSC6_rxcXWcIy6ap`L_bShAX5ds z#D_BTX%xqYRoukHb`L(cMZQ(&PwLm;Z@Aj}@#N_E+mr6e(ecG$_weN6;KkS7zZ|{m zUVMA_;)^f;5&wGh?cve4hcEWKXCL1F=fTVUFMhh(s`hfeq>uCEJ=BKr;)^d`7cakl zReS1u!83Ng#4x^S)MCyVD0^;McC#dT;`FF?F`phwpQ-e8@$KQ_F5({-_qwpB`z_(Z zo)!+d{^R0aD-Vag5z-ws%LKnc&uF|w9XPK;;DN+C`^UHp$!M?FaYu+dBXY1t@4>le zW!KMICD+2}J(Fp0P^j@(Z!mYE)tVeu8(U2anR}S2KF?ec@k|XVHKNMJAnvMs{5P%g$M$i~5aGf! zshd0B>KFGA=rKbG)br@yR1w}NM-s|drL?E|y)(1|q`Hk0;eTIzc>e}a71tv{XdeiG zD2=Eq1H`wBOvJDSFoq&c>O3VivrMsSnhlSR)^ct2k>Tm~R@{h|LhZ29HjwK^6n&+o znX(LiaMe&f8&x-w%m-1tKnGG7A?!2Dd}0Dct_+7FwHpm~&__75Khgy}eUiZiV_^!J zwD3H9DId=gxxi%x7&y z%hr((?MA4d!uZ-LbOMJY=tKL8I9uU#5C?=Bh3&7l_OG@A^f0fsvOC%x!i$fg-|g=o zG(38n$hW*4Ulye{BK=k^_w3J7=syO7_m$?=ICGzt9U6tqa z+l7VR9P|#p>g~@l#0+F+M4|VHWA|)#KL^L*&uFBD*wF<)p{?f6BRL#pcJhC`8w`HV z%kj?!Y5Fq~XpzrxE`Kb~Ct)os%52mLu9s(>%rcnEGeMzIfw-*aYPgaCr^H~|a8oYT z=0bEoyV|OH*Q{CxnFQ==3%Foo(In6L3H4E}f;^LBp~~eM)l~(I8Z0|$T&Itel|UPx zMz&Tg1+}f1g)&9Lt`hou%cYr*GZY0{o~D_&&$3p#Xui5oQwsvh5Uh{!1R#g}HGjt)mwN}j zgI%odXBRyF<;5=Rivb|_!P$u}Ri5K98z$+i3|wu=d?0gatUNTzDJz(DO;ZrLk%h>n zn_vx92+J4F(z}{5R3YpS_LZ&?RdDOdG!u``9v7q1r0O>ROTiOy22fY)vdNsTmaz-$ zQeYNWiBF3>rS-K-D0#;I^5O7@!~bLhdypbR8}0HA8_2x=0LYX%oU-?#!YjvR;T>Z` zJ6OW_>eNSP&sv$62HMCG6;=i=7!YL6Wb4Al>tGoTUItWQ%jGu;Hd@3?N73oo?^m_8}c(#LC_C}B* z&)OZP@Byc%kmZfAtWEH;b~n)}I1zZE!1km8__#xqkuIxIX;*~?oT+n* zKg9b1cn)<_*b{C+jAGkPoNnW!oIJHttHK2Of>_vYf7@y*6g~ZxT+z}XR)u4KC_qUH z4Gz9~s`rI$b>CzBbKDrnYh75&N7^7`eivlmb^W$v<)sNT67m7={5&? zaw%)oL4{NT-zbch#oGyeE><6O9d;1rIcHWKbI&ec{s+`EKSS9?bbKVKg~#LCmz;}w z^K~vbfZ6C7(o2p-7o2%d%)jXPR6f_Y@8i)gJf9&WBBdVhTD1vyu^~6&mN!F&`3pX~ z5E};KTksi6VgEdcLyrxmYhD0!HJgGD1~R!9IE>0op|VUAtEzuheN2^RE_ei3n+)i} zpV@8_v@r{NGfW_l!Ab$7U-`&#fQ8233V|gb247)+iKFEqKhq2tRHXdhFnn z*1?8*Guw78bT}$=&UFBD0s}FJyuFL}r(Ug=+MY5(-fSjR`T1O^k7^YrwNfV3cy7!n z=fci53Cb*pdR}0$Ak1`&>PlOk*uKd}coeEM%j0(%1nX`LU}zH7O7)gBJDB?%7z)hg6d?RT|73f33P$%@T4_{(ZV&IbH%tEHA$elx~ z)C)ISBe^%3WYbG^x?C@q8TQs;rCqSAQI!WOtuI|x4ZH?R6vW5Z3dHOUTp~z4{}!TY z+o*+cGg_qhKyzw8hUr4`*IpsU3dBc_$w;6YZa{!wzpM7gr%MXcVx`BVeKnZ1#=4oH zf3!Sm(Vl54?dEa~KJm;p|8#7#x(FOM0t(@@sY-BOYZQa>qgE8S!C5hE8!WlwYp6$% z_4ejQ8Ou=e5h{xBXlgl^k z)Lu7oVYkr?!N?3@%x|b-p#vWKh3P^Nv$E1 zsmKj#UkJ%ZzxyN%pt^IWpTFJ6t>D?fS0B|1DLmjZ`!EsB#mpOOFmJCyNtX~uZWM-7 zIvA@3`@#-E$AP>M3dsp7CWup(iUjH|!2=YWXez-WaNN)3w$(Ck`Oa9qcHNo1v+kL8 zmulO?V&u%qg8awv1wOqr+~Dr`0`K9Uu1b>~!tng;h#j7tdaDkij8z=aFwA8&o4loJ z=}qR7S$Gyt8jK|EXZ-c5tj*2ahqf9Rh!$HF$u`5Tw)PTH7`>P9UQ(E=txm9)gda_& zd-h-UXJ@sj{(3E@_DAWwb5!|hGg)=dhNR^KlMQ^LGXn#(R+PPTz*jbc72sBCUoJoO zSu1$V&(7jS53MCvg48ExsulDf6X&Y2KYgqsywGn|up|c-bbrv6`#VII{Jiidbkx*I zI1{#}$|6+eynr?p3xevCjoS7{HBDyP`3jYF4p}B?5|!g+dv#gLBmbzcCW~R!Wl_K` z55HH-NH!QETW*t>NgTr$1&xA)K5&`JT|G-T4mUziJqQ}J8{HKK?XhmRi}--r6lG!% z%hZTGrOQw%3)>^b1@IhA9gLd*{)EuIJ#x+ka`YH`qY5VO_;`|uj%DU61C?CgC`GG{ zZ~bp}W$b+S_Sm_Y6hgzLEpPz$zb*;SHCWz3JN1 z>uT$)P++E&`OtoWg@BI5u;3|xOZ(1$JK-i70mAWL#q^KRW$nicV-@4!^p5~;9Q~R} zZ7!!1@y9Wr)V_YlC$;V(mizIiu`vARpchsjpwwPpZH3u&)Yx*-1Y(*i<9L0w1tW3a zyTQM{+OqGnUl+=#emQu3wbh>*p*shiLQFbVF_^sSeG%?R zWuA&6n^NYr+lnKe4@KHzh=z}_X1Ox#+HztCfk6;9)7^_gk9I5K7NTw--va7fS@v9f zA)|84b5;nRLJYnCEl;i1gP4aXp?Dt>3L8FPZgqronoeB?}i`QocDzrN4h-3jv-k&9IcTop3RHe^LrboK1UO}XK{VR*(t zN=F=Y%Mm27&oz`Dv~+o+LU?e8$-(^2q?d!)lpVb2us)G^R{s5X_fv1qkfmn7>(s_0 zHM2{l2Ebi->n{WzEM&W!bFc_M-qlRuf_c>sg=JqP98}w)FHOOVX{^l?hD@o&pv>5g7J~J1m5N#E zx{ETD_hlx{6jN^!l@BsW8ufUh3d3`Q+pQ2oamS=#W2=%02*%k-bA52|;^jrzM+eiJ zvDw@G^Ug0N&#dH0-}A9}Gd8=8j>Us78|SL+vYxM zBJx3*L)zqCGU8xGrLsMKeo^ix)ynTp`8aF(j{W`p{V!j=g8%RD@7MnS#le>^Uj5s_ zt1tFnzWDO1{g+?;+y0A}uU>rdZ)|^q^IZ5Twc*9T?ce)d^~rrEA3l+;Y5?OC85X*C z{k85%wRdyyD`eKAQX4gPh8D090-yfMY4X78d9DnP>`);svO5%c&u&*J!XO~a^2WXT zX217U&+5lXA-I!y+VJt@HOtE^`xUud*(@i{raFUpLU02`%}5)PRy7-o zoGLmcD$96Z6?h{`)OezDdjpQO+eKEOXfG`@6mMHfQW=fdI7}-eQb#Ul;Pm%!Dk3&u zJf}0O$Iv?O?K_Fep%Ppn5;e@_-+gb|5eT#TG0Z*Z8ETt&-Lm(fLO^ChnMXYk%q@H8 z^5!eW-<+gK)OcLx(oEq1DP+Gis?d9>xDnZ&mcuUOIo>Rf)muZ@e0MlKQxilZ(s1V?cJw(Fj(MKx|7WnGb}!u{t;!pC}Q* zl<2ZQmPW_n3O#m&aqXevRgaxUmxl)@HC)ZRmVC{L9n1OI2J@UIB!?HSPJNSKOhi(v zsIRS}9Jx!DNQO42nw}w%=SR#J}nRZ<^1f(iz2twwX$pM zmlRMx|Fz)jfpDIVy^Ypt-1+*h z3mc=k7NMx9%o#E?tfY{KKQi zdRQlbQB38HOiP|c)15-Ja=@!GC_C-cu655$->m#)j9zAwyJnjRy;PPyWEvXzQ8UX>J0z4+SQVVzTQl3CeIy@HY z%(Zm7O@j+C%+k{1!(^c|cM%oqZEK{gkdW}nKNtEnFA0GYTZK2XkbDkt#$}m1!BfFt za^UV(tj9>h5TMJmq_ip)VjkFeUyG?1J=D}C45iMwMk+>SUv^loum|@N3Y1t`NU2rf zlNKR54dd;9DMc|obFqQzar3_~>SGyK!;7QZsQ-NI?dP@zho8l5S2B5>mg{hPy^nux zwkO=S6?L_$Iwdv18_FQ#L!>hVI8)7lkt$3#kwsEUe zBeX+RFU9P!AFm4){qR3U8v#@#S}|CpL0N!zuBt~Z=8Ljy~}8#Fh|$v z=!K=y=tTl#Rby!Yz1j8D)gmJpTYE#$ctudTPf3W(rSpij*m2rrqxn@)><`I8qAsBM zWOe=6+Ev)Q&f_|OnygdyPq+_zibgff19U{5R#G_Tr&F*CX}6HG;PLF1Pc?O7-}=%O zH#$4*c!bvwL^6RGj( z*&Ic$f|5l8@~RzrDw~azHB+IMr?k}26bb`TwnS|dcS%-ic_ZE-D0#)fJNp^Cr@s8+iwlfWJgL~|+$ZJSy4Z4~Ubq$1bqnXQg~Sdy361%6s5B4I4^Q`q)%mt~oD zNU47<%)~BPFftd{PdYE})-dJDbaD2{yfRZTfYxZ%9-}(NVkuhY!^|tQdmap7A;@)% zZQb)@@u;q*ki#LM_}DkQ4r1tkdzh!0@YP|=t%86kk(8A}LZL8}JE1z2nM_2{1zd&- zqPu-YmBSI^@jD%K^sP(gOl{6!cy-U|)=xHVz*}F2<3IB9wM^uF~J^T=lNf z-|YT*wEK_v&vErnUHi56cUk-U|M|abU*vjs_qYFW*x>FTVqxIYN?C5n5Q;mj&wvrN zz2l6eJMN8o;V-+4*Y;d;-h_oEr2;4TyGp$zxvv&>F!~o+H@8z;uNdlyP(>+VpZF!i zEMM}LMCELPUjZIPFKDZU`9l9otjy8_E4ZIlo;cspcKO~nsgy7<%HGZFmDjGCvp3Mz z+SYMW=Ne~G!Y=@8wGneUKyHsJkh0|fuI?sI)SwKQC<~R$Q2|qf=0||<*b7*9$xQ|+ znD(V9!(`z#jT8_7Xjg8TA+|F4zltg4WJ?_);St-#*+I$twoQE>X3+h%hxPTdjcBmu z1eU8|UB9pkevW3}j~q7*sr(XFSZgpmBj z!;8}8QP;u%6MIoY1ulx_{|F-EW5?%t$(-d@&Cj~vb)Be;7t%~;JGG*GtWqmgz!2by zF}NxCI;HmNo~h)zWB*Jb|3cXv4-Mj)2|P#Tn5QWw#ZpB4yomqC8K%dOtR>Q;I2nlN z(WRW|iL;I+P?U^FHPddDZC7xYC1?~N7uc=Ptvn5zd{U?zt3yJqk(9kwB&K1ZqJT7pBN4R~~niuSG< z*>@o;_2MNS^C{hC!g&KvkpW%L zlzzE`Fs!%+fP;{y7?@C{x3b($mh`@&!k(T0FrM0s^lry)mXGhqNQ!&da$)pF*h;`* z{&fp5IaZsiaWD4?3eN*3Bmq z!3!5ZLS64f76uUP@UC5Cy;SPB5mqL`h7ht&$=)zt?12QPjzsR_1jdz6p0&DlWxuM` z1Od>6%s@Q$V(1Hpc~PMqlaNcx_^i;ulgLz7qwJHLsVZ`i*k4`33?(-nm{(g~8SpHS$$?0wNhX{wroHr+ z;jHm*fz2142tKeCxiL%<#%JdlhUXw+Z@u($Dw5})O#n=-gguzYM(;L>egHIH41lnz z%3fm}1pKt9LApG1ejZ)U|8*1SX{R*Fp?3?uAdSAof-lXcr>C0-cWo}S9zQLLkuJ}& z$4@PmXp_12_*s>4kDms4_x{0^+4t_rRXOZ&c_w{?bLWjJ^Az6kF<3WxQtd^*`Ym>^y!kfLbV>R=ex6(seYE|Do$S#_|vqknP=$FqH z*_qF?MfTYu`)rYYw#bHuo{UBI8Q%37-u0=#yRQ5+!+#waGno|XPPRmT#m`dw*O#xp zJa}2he|_=d)xk6V>tlRAH~iO_6CVZn_1nwKv$I0op`Z(pum1ZPtk-CW@clfL*NN}Z z{Uv7rU0pxZhDfe)xn)52JW^RXj&l#XwGx|UmQ9&gW2g{tJ^l7?TIFZlDlI)r-rkKY zOv$s6(xx}~C5_J>T%tGse*At$2G=x(ZXMA85_P~&a{2bcasgcDc%~bU#ALdM={~iT z6daT7bS9sr$;d7jreIVVV|IjO;Ka5U^>Y}9HS=|oAsvT5<`u>&7m*AH6m_*=IPnXX z56xi*yEAi5)L>6Zia0*ap?npF-P0W$gu*ij?=uMRGYId7L3sV{n?c{TO}%0H{J2f# z8&y+Zo%eQ14^mBMKs+JPVWN> zLnHRJ6M?PK0w3^iA>#>sUz{LoAv`9Qbvfh9N7Tg7ygbEl&hWR7s$LjB_@d0*$l?1i zY)@-9c&mItUd3P_64MD5be^VA8#`dJN9ijw-AvgzpfX_1L`~@-JVF`6UZLP$N)bSZ z?~f@V4{{Uk?A^?_Kurm6r3ZITDBtQdc3QoJzz`7mVo`uQ<)f5 zOrwS!OcWaPYeC@~$QlGf+^g^EM$9&6&1$2^Wy2tr407{C0XqkbR+dP(mJWZzFWCpQ zUlL91uLwu#jB1p#xD;rysqX`kPFooYzpa9!q7Wj))W`&{aGt9yuFXL;nRhCzesWIH zSMWxJL8D6!&pFslfx49>Z<-h!g{zS*TNr2=ARF;yX(jQwvpKP?s#A&PQ6IFQn6Os} zd!lZ77R#Zo7EEFhx~W6$CH7%_Xcx}(d;@2<>p4aY0F02hEORY#%=6s*OqE%i2j45x zm<>tac}!N!m06D)->Y@_(Yd=EPvQ+O_RE92KvtMy1f_so9{YpQfylnj3X}J|A{;AO z)oxg!d=mhA7N$dh6$mMA zUo29QTh_P{aZJm+wOzWZfWx=iEC3fn)V*S|VQT;ryF3auLob}Enbga0_nThy@p4)L z<8fDId=1JSvO+U3L$7&@=cO4f#+RHkwnN{5Y*#ow+m9;b-*G7keiGqbDMLcx@m45h zqWw))Haj6Qm<2-_=#C&~(GIFMP$Ay11?Ty*C@Mz{b*a5D^G%}3Zm7|B7fbOq6%2TO%KU<|hRB>uS#M7+tGyqu ze){tt|NDQ~mASh6YH)S8zkhYNe{glT|KjRy|K-)){;R9I{V%TW_P@Nk+yCn7ZvX46 zyZzr?-R<+MyZ!#v-F|X)x1V0!?Tf3s{lV4U!T#0V!NJwt!HcWAgO^u#2d}Q~4!*d$ zJNWYI?%=DdyMwQ5I@XKc_;9&Hhr+E9X-+vyA%svxAsrgu3wB1A()M)h%3Qx}4MgG^oi)-zv zrdhNXrjRS>fe*grcMYC;ukvQ=&?FyOBxTWZ6`)CjHK6C_t^odaPx?2#QZ-HgTyd4! z(8VK_g-FafRWNGhXFHzLloi61MGmP70rZB7XH%6Vd}X%8FVXCH=&N+eP-lj_^^HoW z?nD4zQ*HvZIE~HrNhP|`*=wjGy02fGD|iS|LnvsM%wq(d2Bj>pKggZ7*R0pfy&Zux z5;Yzp;s}&`wReAo6~ICnb!kG~MlFXqq`$G#JdIvR=Ox|K}0L|bWQM&#m+$~9PVaQi0r=|8XY z?^$LYVh7(_&Q*m;ArkFV2K%M{i8&dokbJ*}oBwNCrD%;4%x_N?c+@HpkMpwSnYsXZHf#8qRR=N+=2 z-3D{23B}*3ocBNEHD-C%Z0&~ii@AiuIHz*%xYRb0wwDKpYL{ zLb3!cFzrj0Iqt?vy<=Dqfx&_eOrmWrJZ)Z#c*?pPBfE%6lFOXFh`(J^hC!x^zD;O& zi7_1=biX(gMG~Ef2~RFo<74k@WAD~1%Z;geVFP=TK&Ztl9syynOJ6EJt4srJbxxbq zn5)swK}B$KI#_Z3cc-xvPZ4z#j`4$8f!0NwoZ=!e%6x72xKv}H&D2S0=mvJTNxa0C z=og@A3+UxaRfvu;=CSF! z+I#2v-^K_$h#=!R=s865s#OOCO;8M6ka)3Dub>l3U{wKGZxxHnl8B@tk^zB)#-^Ln z=KSJ}CXrZN>{poIeRA;w9@fo6u3bM1 ziBh)iL#-+JJ(VgxaMB0Bc$=8pk#&n(40rArplPAyr>?Zwdf1 zocS2UcsO`I7%QFqGQ3~i3&w(H)z)A0d>%Lf<^3{o-35Gx*oQfgyi10`=SoscUw)GG z89P;d+93iUNGY&+pktP)NOTZ7?5t!aAQSgeU|K=y*@Y3q0Z-sg&d-{ii9v4&i#08 z|C`g9a{pOujn69#1oY);bi@r{81huwRzbERC(b||7VH~M{u&J-Vx(%?u6fdD9Onw(Y47g1f+R4o{H?6W)X|jzxIah z*xGPIMUYoKj+Jn8`dI}xb-zE9Bo!&>2eoXVRq*gdZwVSm)WWEL{(XF09&Pfy6>w0;63+ z!4Cv%o1h7B&45B`Q`DjCaS)y071irQskcd*fGsAD)X^vUmoVcw%Q)>K7$fZ9XQ(|| zO*oLa+!cAi6q;)QodDoL3t!3IHKcVV;*Xt2)9%nwcmvCv3XFbJ(PUP4g7AchOrI?y z+qG@}F38Pl0ek!S=#X!!Q;4;(XK(@^EOdO2by+}PbCPP&=(`beCQ<4!f?4ATl(u3z zu2E(CAhS3=XEN8W)SSK6t3z+gaF`7g`c|&HrYJ8}^YE-8$^a^$0jorIvYrhJe25Nk zDOmGLqj$ud?lxeYeF0if)Z}1VY3I?zGgMkvS)XiR84@X~t-P-YW^LsL3*V@V^z_Pg$bpIo^wUtf4a6n+Pw(@6* z_SRNz!eL?AB=G+c9QO}E1TA-An~MVV_WYYM?w7CbotesyiJz0cIFt!&l9Jq-u$ z<{FKLZ~UY4BK12%lTu?i)Gpx6EZl%fiR}x;xHUnd zSJ?s;?HpaR5&@LiG)%02wC_3e1s}SxYh}(GaU6Nvk~L5^yU@vlP3je^9Vv7W7jqZD?M+M=hwkrti26SrU*F+@aeio}&U>*qi-dH>7i zmOUE=@)RwcgtN>FGeMiqQj;Y@;@+%&80R^F)AWl-M+Uo=c(W4bD4%;qa3WoFqa&J= z4&oH5-<{k{W>_E{E|IW=J0PmBGMKQ|YCJhS96$Z+Gm_C{#>g%h=1P9W_DWlgsz*EC z^F~oGrsT<^&&ci@A;{P2o-jAao}YsO8BXziLsAj%el2Fhvk^E?FPw ziUF=-3u}?UB9_(tq^&**!iu<2At3$vel@(I`KD-%2|y3lR3Ip^Yae~>aF?UavYA6z z%=Pos+>o`rO`nyU#Am)8R`Py$pm?#48xCZ=Ar}=*sm~aOY8^!V&)V9S<~@mVLdVZs ztca`Y84Oa$y#HWTDS&Qb7~C{tp(079EA6`nuDT|~ldCelcr7rd)X<=)RRYqBSt9_J$<~os_&_|qdW?p$8KQ6!x4sc zFCFL|OhfnEh)<^svhso_Rha=Y<1=u^Z!crQk)qO0GKm|fH9*X3+-R*7cuP;o;KYbGH&r1&b_-Ad(Ksr+UT z-%90MseBWw{nJS0dA1yUML?_DiF6zKggVy@!s;!r9<5?=#;lvU=GW~TziU5%p8HOu zv+)tIV~P0&g0zWS>{dK9z9iMSRi&2?v+)HQ?@mYFqKI#d_3?%T43@pgmTxfN{ty|@ zZC8tGq{H`v^#!7mV(J%Z9*`4^g-H0cwq-6{dyH?ags{82`!@P`_igYt`grd@=6k=n ze=e$j%G%f3-$m{3|M!1uKO}N*?~~tnGUW-+m*yXAZzB>4V4lLalFJ5KOQoLQEJE`&mwge;C(1oMs7U^Fh zT}(n_12_nZJ!bFbw2-;3QzZ0?@>s3;Vgu)e<0+ulg>|4;sKd5rZ1)^Ww99gSj4c z8+h%}#$dhQmetOLM2#H2c`s3D z8_|7u`>L3*EMYm5_N)Ks{v!3jRQ4@%UpJwB&lsLYsl#kW2j!Y?S?fK?IKR%)$#DOa z_nm_t%kWgqy4^Z{E_a%h9?M{h;GzCl{>H9@J#PFhun{VoR zWY5Pk5PkeI>0`O4`Sjg&`?{JBIWwMbK?9D8ud~jAXPM{?u~^xblPUQcTG_Y)xF0CS z0emwSGJeHC+emdVMI6a6Lt4o5eg$$@<+B4myjw5V=18fsOG<@?##b~VbC$72-Wdqk zSEM8qnU0jMu-N26mYN;ZpO$f-%+VQ|P_Z{#Rcc`#6uFaTQy-zRTa+W7c2EpJpN#q3BJ#REyk! zjmUy7U4%h}{*vsf1Ece??rHO2-NIDO!0{Z8kV)o(445>X=CRx-^GE9cLm-X3(+AMWS<5*%oOOe<^O_N0ApswxJZ1`$p=lx!8s#54tE06mWkb~T${9TQ(Y{cPc zLxxaThOqlSMo}&6ybaSRECV9(t(8d4FBV3x$rP49wBZz%0sC>w9`x(TvBLt*-HIRm zniA$3!DwzSwBMdT{ary}xTrcHg3~R^wf@A(yW@cty;$y*T`!jHb+)4V_Bz{MXI=}~ zUT53utWo(xy3S-QuFrFt_4)u~snW7oTw8~;I3}}~+2n;qXS0k+sb=X#ptTM2=qNb!$q-pJ7*zMUOc{&ZWm*W>Fe}o9RuYNp zfV{+k;qp5Q4)=)^Nc9a&$Te7e&R9-jo-mq~uvJ_@1G?I8&8bqJP^%QQLHM+1TYc&o zU8Lh8wM&qYAIpr7E{Elzw~%(Tgj++^S;nZ&J)V%m;1CQXzZQ^BbSj>cAtrx3$un_4 zvvB^i0_qiK*9S$4hFJ%(pwZ7ZU;Kdr_Rj!ppZ#>Klz%)NfA-TSyFUg$;lK9&XqO+uT9Iy5;Q%)v`qr<=Ya5uxkNI6>5Bahfnj^5O#@{mwcL_=aQ zlL`qlv~8_|ZyV_{pSdLLoniwzO+?#BZB6FT(OK#F`2VTkFOs;9!e4_4q(bd+8gg{2)hu{a~5W6 zNOQpc3oXK?kX_j|PO3b0sR8T*gNB}t=v^+#1Pw0}T5A~KwX1spPk-~Wr34O){vFaF z%)DZL54xme0odT1kgJix5s5z13G_-q=kHn;gok>Z;~0i|Xn7dhk@8D#OO z>OgK&#}04OK}QZb413HvFMH&k>??B55dL0p18z9q+s$vkJjAv!yx*>m1LGi~85Ol) zGGX~OV+qNxA!(FkVUa5yvkYh2$~W4Tq%0c)_^~^^L#mD_W^+Q_F+sP>vhg*Km|n=w zs@2bCUmdU0rwbx;wHykLl|665e?Z4d1(+8Wb~i;#XBTV)C~aMVZofu!w5AnYl1rB6 zHlatxbXI*t-Zl)ezQy1}{7~BcwDR%M{7<`|=1i}-lPLRvnxlLgv0JG&jb(&RbC#)n z4VjdtE*b?uRZPJx3zL{rCs#U+}i@MO5 zVi__)_f?s6Y4&aMCs2r1h`|@KOUxUjnynbqR|n$9!GT}l6^+j!$g{uGn_8@COLj3t zwA`~-dS%sqi&@FLdWL~QqP5OiK+Ta0WSYwLDD*`n0Y?p1Rh zN97!Pf!lM%SUt(0$v_J;BRdxbB)u8cmlT+HkwFAdJ0Rgx@318vOX(LtR|=oLSk}3v z)fXs@XYwUWGZq2{K{Op8BpUfbkQq60#%1UPt&5>)%95x9^9WDuj~1ZtlJn{vhnzm> zj6}(T%bZ^7oOlttVzEfokY!gU^EL)7xu*7@r*VjX@lCyKT!?yiVw7PtXV zbS;@vKnL(Z$QZo@t=Tn1+6~1br8%GQSV^C`AXi7EkSvp(p-r|2>JNCJVnL%XP{EZA zWB^rDVxJbPEMP-NE#0h+5KssGX)XZsFHClPD(4sVj%A+FoXylV5rS>FHC|V;=uOCf zR*vf9uiu)_-)U>}PCNEXb1LVhPruDUZj)pBtQ=DHhjSrW0umdwe(?5@Pa|8$uv`+J zfNFi;wQu4W$I2Q@bvA~0uUe)o-#75tuxrXN$dsy)Xn2WkIL<5M#hECQ=uAv_a+Ne`t$?#kuKdBka+uv8F3|T)s}+=8AqjN; zg9;!kww&e>Fr;x<#O4(cU~tKnb(_x8ny#A7xpH>*Ng}WZGf0|=s0e*sy$9Rf4SGQw zVCMEq!LsG4u_Rg_+yAqxpH)~7gFALie_ZspYh3dLoVx9M4?!KS>zsyqAAhc6k+W>U zlfLx4q`|)GW*9bZ8dIHR*GZoN`DMo;&%%Oh@oVt8PX*Z|bkqhnt?SnMAxv&dP`B}cpNOX^-U=7L z3kz}Rax>8O24;_i{BMfSFVpq4MgRG6JAdQaez%1n;{vAiX3b0!w^z^lg-AJ*ZW4@i z;!8fTY0H3ju@iQtMbxeZFn^6T=XjBfd;^b*IMY;ihSydhSI_Dzf3@qXJ~TwX(^g>h zGu>e)jKvkPc9@HE9J3aTw;#W2fAMp#aMA7NAB|WU2BijUxU3^pz4>z7JE)jZd-vd6VAST9!c+#opJeU$sjM2uS)*Js{UkMWzD`?YMHxeBtV^byvolx$TOyP?LeygRMYWtu9; zA!F@Zj?#2uWd=@0GC~LpJ1Xv4Hy}SH7>^;lTbm?qgLEF_q$oy$`?+&*2yf;D)Hf}o zPhBbruV|$@o73R~#Oj*0&MXpqfHt`kY9(-0oKj=~W@v(U5&jseWWkI)kp7@#A`xNY zWL3>Qkk}bpom@+<`1v!HFV!dLr8F|QLSc`J<4YrGb~y}EVwDB7?1L>Uc7p1Nqd-QV7?CN2jEp66?5~{b_12<9 zgi-al^Stlf6Ug(mn(Iu!5~$5^r&ZKattckM4K0vRQta6S`)&brJZ+js zBv*6VW0>2^{#IE9j|HVMH?t-8LLSxIh$Bp_PrO65(nQv!_QNGCbY%(0Ceob&sqemy ziy8-3w!3EYNxn0Tc-5N8^w~M&$GR2_NMB1O)J&wF)3BMPWiD^tNhX28p6&dgHV;&;D}IhM|Zs^{T0H_!!awb zsfRaodnH^yY{y%G?}bv>PMWqyQEPKBSrVs6vf)v0%MCTlYuw~46Q+_}3h5CP;ErN% zd8Py~*IpQ%LkmgwPwR2joU0D|)6|Y=2DoZF`4Dc$TbIs~bl8qX%=jeja-EXrdFnS5 zZ_|piGc;ZL8Y`%nqH514C~~`Xf@JA{15RP-F^0#)4noLsoK=RH>wp>L#L7%+@<@dBd5lVW`2bl-o8O{4wktz8yK`UN;OU7UPrqh&fp zg7MT>)1Sd%pT@Cx6<65wtVECEAt`e*l6Ue6;TGAEE>Ro6P)H;D?@1;crFSdRlAKsB z4B66S_KlH{Z&LKTH9c|>XUe^R|K=lzPZ-`ZdYEQ4k25^M3U_>JNqtR&M4aQkjn~Oa z#JmNrsqo9`L^Cp%;4#Zr6&OgMV5k8GD_z?W)qg}vxK#zg_$_G{qjRFrtOy!(OuR># zrmTrCOZJZHAA_t>f@LR4mNJp}4G%{uEDp6IV{YwI<}4XCo;gEpmGkZ({+>i|Q#IRC zi9(9x8fz^9nN5hCrI+ZZ|p?5rrsy%@& z@KI)0#;GHw_Uz%n0`#`16!HyDSSTY63`ijyt1kOufDs}+Qvb>ccY{8NZf4mZ83wi< z>Ju{j*Zul@xyb@mDLbP{et7g`D^0|df~H|$6$h_Nf9$V|oLs^5dH322JCgh53&;C@ z;p_Q&N7n!I{kGrw!*u=7`FOaF_KT<2RS|3QrtsI{=r(%Mf&yFfx?ol}e?eJwZhdRI z^KJal%ns^z##&p)ktEhFVjwE~Wz2|_k}n(dP~&0)%i#scQ9WhbLVWiF z%SWY+XcdW{F;JKr+(?KyDgLw_DrAkrz|CYAVtb}STAuLoznwKz>|F9NgNbc!bKo3J zGw2EI;MAhloGT92BNioq=WH4=Jt+%b^PFn(>BZVmqO z)x_m-*o@a^`(>OAgUBdKp+}uyS$~@Or=ko|(-2X2a(X!4o--Y*M*y>BvDMrSYG3?b z$`;wX$`J>|r0w7Gdo0|*YN#fqeZ#$SS25C2?YoG3k(ouQ++_&0J_@D5u?RBA^n9f5 zqX4Jl(&ng0r%qBwd;`y4{lF<5tu^BqqIkmh<1!3Nv6T(}ZN%QTYTGpU$Gs6u@cx0l1LG+eT~4`9^xX1qf(MW;uOM! ztNka3NPBZqA1dDqzvamB$)ME~&LW`-cxj%zUu_aV1ur>FDAdXu3ogkf(iA3I?EO3N z_ra*URx>qmc5KLjSlU~XmX3_z28^6f4x;euK6Du_<}xQ^YUu`Ebt_MnBtx`~Rzt7d zvCnY=QfdhOlmhs06%&Gk=i)-fG%j!68+~b)jw+SIxB}%RlN8I$eRR8+0nQzl4g#z? zkae+%=h(4@xyYF*p6fAj_E(jaHHoT@LF^2epe?DiTE|*ZTl`7-Qh_xPj$_?VTR6bEXde3&= z=J}gjZ@dRslzLd!*Fk9QG#Ck~d~}$_lKliZ@=;^ZvB+|!p{<{>BYSJq>FnrhN+D`S zqOj4=dDb9dk$snyV?miI{2+3UPWhiPyb;vgIP&<~;5O=cy0d^09vcUk)xgHp3ESyk z8Zuu2xa;q5QCMV$cFtDf&9rRO-&8{w2@-d%4v%}6pd`sB@GY%$Q)IWL7S%NPv@&r8 z>^}X8i_^o$bBOeR7J3IeF*P~eIOYdRJi8_#?y5K;sO`5nX5&ohaCi`p%u1LeY1P8e zz#@?Z2|iaV95x!T$3Ub$2@L0fM{(tdTf!z8U1i*X=f8w$Y86tR{}?WMZWa^ks6b4K zm)FxPfEXY6f#5MUmwfLo-yd*jvv23D+#j`PGf(Lp^cae~^!Vk|d6pWWRYLAf3xCteS94FPz z`U4~ajHxxto?RY=U)L96MeR8CC%~BX?{j86MCQmLBWIno@x^b@C7SlZcXu;7a{6!Tj~0v2t;UrT(uw*94g&(Qz}F!DCb3vod|k>bY1cUY zc`4I$P_y<#p*ld&hb9g~h>6RIvWxF|U~zt(@}m^*^f@8&6{KXC#MCrWnn|E|fIBVsbow z-nX}6?ufQ~%xxAmExK~F!&{|`c%V0cnZ4+MPFr%hf~||MZ7j-NI-ETAtgse1 zes{_?U!LkLq0Le2uiOpzkZL0bb6>gx$b8G&b->51ZKctHIMPAyFyx&`uR1cVChY)o zcFogfB%{byis{^IKt=}Ri@F3UK}1tA2%<(6p? zx0)1QT=+TwI*-wqzAgL$e<8CruiAQPd~UMeMqvpFfM(rqkL6kaPH_N-$8r+~pPPVi zfoyElz&f)B3b7`GSF@ke#Y!k!)|`4Rrym5%Mkcx$m+2(crdad%>$s#l(=bY|oeGpS zuIG^=pNXXNI5~O(Bpkh@-uP%5(sNz27POl{D4#`K{%^Yp|0o(^e;a0ubLBEq=rNM; z%c7A$?KT86H3Ed+?O!zOLeLGeL_)D`p)vPm4o?Av1t6Hst|cT(_}%QAO6m(l2x?Kf zdfAPXTY|iOyI+-oLBUjzK)S);MuyJ{%p*58&>?9Q0BT+54gfTNPc2ZNhPQV)Dt3sg z7o8;@;&Z!ZR|9v-r`!=UNQ=LWb7^c@Vk3J|0z!^>%I?>#&o0qDOiqHW@U^#mQ|XU4 z7j^h3o3l<2!bKK344S8fAL`$6>qfUbNTBI*moERv^KL;o+f$ReGiAfji!y-+R6D zzJZz0Tc-pYTzZV(3%8kmE3 zeejE~kpOb+r4q=ss7YQT1rqViq3l;$-)I#gDobkAq|gn1DUDfSRLA4v@Uy6&C(Ht^ z3AxSz1I0>D6o07XY3Yptbsrmk)!9L>V&C+Rc)+<#je09ymienSq~wq1nt8uwQ}Oj3 z=^*%HJaDOs6W&jv*kS_)f;r7j0BSA<*`3w@O5)+67_ko5JJ+M7OYk{B#h)$Fm+P5U zovsV?IbnPOpHUl7VS3=fbOQgd2XIZQI(1g!n%JC-p}ZfHW7_F{Gyopw<(x3n9YP_% zK#e#ro7p^4=fx-8GC?@oAROcwf)3dQzyjJCsFw8<`}jX>f5d$zm%iK-=Dw^=LP%y8u^ivWWa=j0nT-Cv-0hMKs~OXO zguj2;@APFP{sDDQ^L1<~GZT{m>s71-kzutR`+7Wy5@5mGkrRn{rY21EDUtZ6jNDfa zrYMM*Jq3i)T?GZ18Oy*fM&cKwg!*7dIhN)%Hp5oW%EK*!mh-!%C{6gyjXMdzN@;Y> zk<`|*`0omZvzDqUpnb$<}pxu z*6>!V!A(3SGcTh4is_WE-DCvZu9a<`}-a_el22D4B(aO&n(%Rc;PRJgs;H_pyZ}k<+fH=ur&fTi|D}qpT*CUYl#X&s%ZTQ+1Mj@ox=c za5!ckNlwA(47+wergh_KP-)kY;`!m4;GqU#R1GZZIGqyYeL1+xn=!nS&EIdyBm$P8Fz3%$TGhq!Lr-%>v{= zfU*KxCt|%mb;OK|8()~yOFrvXZKuNfukhviq*C|$mrutA)gc;P6i%oVU&VUb>NpX? zG>m{5Mnzi-YPv`%DsLAB($x(Q;45jUu9qy>d%I9cgCAYVdT9hVI zGW`zI|Ixa0rcMq;_R>1o6W)pPMJWDNN8s)AkKv>mS;<+Kxv6g{Sqg7!3 z=0Z6UT{@Pg}ehKEGMql8}wi>cnULvDQ*-kK;1fUv1^Zp&w@ zDU9$OuEXgE;Bq%r+R}_H)CPZ>>%LmN{y=u0cJwmGEC2KIuPs9V{!{EZrJE%^7I}cS z)WsLW-&%3Q$*^r3^=HeqAM!d<&;WUtWV>zIUk+=!CTMeul-2+0Q_*vo3*Z6nab@Wj zPkj2=L@AnK)OX%j*W#L8c&8SCrj87SUshcg$cSf;g~_JoWtTqv)v1 z2Y>eCYG;SU)dfCmvq0wmo#16LSh%ae=j9PrxKI7yP8zW$898}Q7#@|CYLMN2h)t*;^Cf)vka-|WA^0wq zN?WSN#348)*$6_aDH1Pmk8}}dt#WK{sSm6*FibgJN0mU(GA zB|YpQfd7Y8t7Rhs$0d{_fZUxLyg;||-QOeok}IaEve`AM+3tF1wsVWHNr*Pv`QSQKB+n|Ageu2;;G z2!Cc`=xtn)e6Js9CG(quA0>?SZo+Rjl@3r=-?}`c2vnXxxX57!sT;v8xuQYq8RRfu zdO|TdeT3e;8D$NMYPq?tBM04wU0#KzZ&d5*h^%U9v1Sq!!Yx?jSAq(0-q+970Q^s?2bNS`Q^1#k7!|(A7oK@o;;k!AWroixQA9XvtspR62!O`9C@f)O%xA*#rdSI}!Rs`uoqp zlYqbtVMoZ*s{#JOKu&vEfMKO#{&qK(H=BajmaT%o4XUDyWk$4`udX;MQANs*nfh`hu3Yv0&sje((C*0$tCttkO{8*$$ ztVPly=iifxj|biQ2SKYu%HlqA!fa2+teO+^o@n;Z1bJUA^(8Z9ZVeGGA$vTyrxc!n zrCJ$Dw_6?>SN`v*I|IcGca_IbTif^7d3YT4K|!2{QkCyIJ~h;$g25;ql`xYKxl?YP z=*B(w=`w$i7SW2A4v?bmkGL(ZJoN%a673|7eo2IvL=g((CZu4PUvVxBcDZ&^wLKhi zn99mBS!qzK{HiR02Rr?<3P7Ki1y#bSn#-Lt!U=aYMvi`P@N}4662QQv9S$Ajmn{T4 z#tivnp_5zZymY-|aObATM zVQx4Hr#DLd$k1?tmpNi(`F<}wIrUv;yAk_Pe+5Qko^?&dtREJ zX6#h&$4<`)%oZxWhsp^H!Uo;LV+uzSz7%}+?*ch-(#Wpf%v<`jL!d9XHZPpA3DGk; zTN)A25jb>Wo}WD`!_`sQCdOKZe0Nr;Op}qyOf)g8J`6iIXEib4U3jD?xhoF}wHJT` ziEYt_-Qs;oINCLF{e=MQI)2`+FEchV`pE55*Xgr1*X4=tKb)`Y=d(06o6mRsBesV> z?b}wo8nV#CT?IoYZWAj;OMSB&e>6!~Iv9MFt3%u{!~^W_0D%z+*_J1nc3<~HF?j;`u-y`t z7B;)?6~X|rYF88Xe!`__I5(%q<7-!1p5ozzh)>-MUMK6xD4SD%kJh25P}!M+Zjd$^ zaP0Majc$mk^%?i3>fP$&bD&=52q=*nMKtsZBkVJqNaCLLYe@lik8X+h;x%A5uhYt(@UD7cKx~e#YZPQ*6M6~a~*TfWYV zkIgHvqORyxnmcHY4cTE<{DV96EltS=RQ_CN>D0JUB}-J9ZOiZ*myux|`0%5kVB{p$ zwV)G>sjOBwa|Z*I1ewUROUYsJxUevm@(bK~dConCnN;*V3gj{7^%@l@UX? z)({BoI$gMi0Na&k9((0{lEp>8LZU9TF&rSOJDWzT@0sDJ30~3QFgD?YB~&>*Cd_8m zY4q-Nk>F=fl+XU?IR5$cRwGXB4cMoCcbUtRH0rH(F6#Z!?~e2*2At5 zMqKIK8=iCxr>&k@yo5YSQfKZ=vh+rtZ+zQfrg%l{wpuNJi%5Pfc>HI9?MIu9LC4Kv znQHlrc*f&xs$I48=6E7WXkXvqbHKg1{c^b&{%0egRLH?P7gl$2%-oU2*Yi%20c59y znq$V?%^eF$N@N)=u zbT6ZQ<25JB-;$JyF%^X&ab_${8WQ)!um(mix+-K!dxg?+1o|y#PE>_F9NGdk0bzgC zyi5Zlkseh=4iy9yKsW6VMP8KXF z*znA<;PhuV>?%EMV6=+7g;CPx`@Yk!jB2Ml=qIb!&5`q--_1ikJvC)C{miAJrmvQ{z%IMENmJBFFeSjLL6S z=}Re1juw08x2KnEMU~)ZDsd0zEvX#gnK5u@Xmc$i=4D^bp7g_!To*e#RC6|`&pWye zhnq-o4aOyVF4%t@Qx5L%1-0}3B3XglDKTg+g9f~RxR5cZ&j_!v4sL(1wM4Spoq>UY zbzeL__xr~=-IyG19!BXYH!;qZwLNULGvQc^L*)S5HJZ3{@nO>#K?;YB!gIOxja~NbJ$n9{ z2w#L}6?Pp#!eB?1uCB>PN>I!BN|a-Ow`{29)2sqYtq^$X zRs^%@t_}tEE~|o?Ia$jBX4|c5D*Dr=8qe1%AJ~?eM_FF%oUBOdQ1aXujgJMGk)V(W zV3SyE(!?~RQMp|SPfiH&>HKmya*}q}&PLl>p)K6raHwwI{%nwpOo3Y8i87~OZf4gg zdFM3LIWQ~BEt4N!8duM#NMeQFH;0q-)T6D3&jggP^WhLc(R4Gi8e>Qaf^XDwzQT~J z%9KcbScdkr>9QRmb(fkPS+vayk}~_; zVv_Z#LIr?zm&-sWOqr!MTIELZ z;y%eB0!2LKgWb*9dq_O6`65yy)PL01fIdv|ZaT}^OP^21jo4|&CwiG-SXkgEX|X6u zzEP`Ai;qB?5AIVLJ#<@P?U`Zioqmb2dwjTH?VJ67RvC)o-_VR|A(>_?91G6z<$RM1 z`9|k5^OS0#spWjpR8I@@Hs`Xn5cc)|y%>$L_D^vgCO6>4s()|)uNVK%MB_bYRvB*{ zI-yF`xip&c|0JK^eXe->W*1YRU@s;*M?aQ7TGYZ0w}M|sM>l`zDu1ce*qE4{rBC13 z9PV$Yiyu$4;^Vr?!PoTBl$kLJ#;LN&Mxd+(7jT7pAHsAm*%&3v>9tn{yS9T4I9;Cg zd~=H*FJx{=+#6-~6vO)rIsW7)S5!K1J!JZa-GIngHOLilY7=f^q!eAIlsJePq>f$S zI|ciozJ|WsV+kq)bLtfQNtu+OlZ2rKJyTlLs{M2}I?_I%Gg_F46AVMJ2oMUsK4BNP zvSVw`S-kvEaV@g?ym;=gA!+dk>#n>t<2cgBY^jzmR1M9!-Pf= z%!RD0sBjJ+F2ly((IhC3gMP=S*&o5*;^Of`xRvYuCLUH&EF-uy6Pzn6EB>9AIKU#5)mPd}wyhZJ*!$1jj_F1XyQ_CKsfX3*@-#YitDuerXChGT)b zXUKuR^caWcd@QFNKe@b|9$H*Kayhux2fdpTZ%-?Mv12H@+#|aw+$QG%KVJELh|_D1 z_jmm_y*HO-7F?#(bPYlBghR|^;bE%`gaOOz2JC6Nz9ifb2ZRPjL1jqnuLYW8{Lb`* zod|G_j2%W32pHaPSFJ>h|D;TWUHZ{HABXPN#J_HQqo1EgUte}y^;mnqIaw|Ca}bmh zk+G+kP`iO!iy!Q!3kZ+LE`hiD?@rWi)YZ|kG8rVQT{{q%1ni&AwKEtfDq%Yf9manD zl-k~e-2|Gkn_jMh8gUI#$9M{#^*4-EjpUrA3dW2{bcm+!j`>7PF&F_KqF!V|)2G@B z4k^Ni2bSNK-|sB!t2DTSW8P_V)GaeS6|mOMSoQ!5gBqeAYh|9S#?=itrBNSp)N*n4guh9D=x%G5*1TlMs8fg#ynQ-XhwS6NMH6#}FFM4+Rw7I09tj^Bq3v`_u(r_Ix-V?{tYsl)fbL38OO!`o-dZB^*p_tHo&y6cFle;Vh)U5vD_&p^( zN)UbD6jpzq$c|&aM3@cTcUw)%!`$1T$G<7L$kz5FjOhjmi!q1_efc19aiZbGWO_=m-~xCy z2ySVOf`o9jaAeeFV?|Z!T$ZdMn=k%R>c2IQ(mwtB$}8H)f(2eKWeZWkXy1U-@hIR< zPmb?l1M8qi8si%pL^3OR*4|$hW~lVZV^m=S!);PkuN!>1<$&q(cX~XWj*loQ-z3lL zi*(c+oX?bQr@2N{_BgxwBhCq!PUa_l1-qLzF=E7W@qPHHXX&oYa6kAVu=?!J*Ll}x zedt7_>;~1`+0!}Q!|tQ-ZsL(sVI?>K_;`H$!UG!y*!&Y*4j`P>SCdM{(E%%3B<_H_ z0T~-O(oY}?P%gPxfdylX#MJR zghbv>kOy9ffS@!hE!TO%@AI?OaW6E(ovx8PCKXaLTS6;0+RF!vTe(ph<_MlEIR@^~ zCv9Ffz!ymvF3Rb3IX!~ci(sA8N?gPdJ#?ABC?J*4vi16EC|82%h$3lPll-vDZ}NC? zy%f89|9BVs^YN0)`~CG2D{9mVgnN%QHuO6fd9D_<0*^meW%aqo+1PimA>~_bMC+;k z>qDydYv-VlOpN90=0FZE*XpU)RpIlom;ZQYl1X9mm=hKNK7%mZm|5`zeIRTv(@3%y zcm?br3?`>=S6>rms__A*<8GjkrpO1t1OQtc4sPsW28&M0n53Mh5=dGcfj{+m2&QL` z%1QFUJub3u^8D6LSTyZz@cRIZJ_N(xk&U^(;$UDv!JUuI#Lek16E`OP01?-~u<|3r zkc>f#=UP^HC-n#BS_6>`{G|%sD~g<*$>s2rA8|2;$VDeZd93KLur7$9fhOo-v#hYr z@^VkT;tAuZ--+L=VHyyCLhQ+*CNZ32!VHtWHLV0oO%4f$P?pE18pk$8aGrjLB3s}p z*!+EPBP=Do;A`nF1Ue0K{%+6CJh6qjE&K3p)KHWpYS!qD9d7bVXsligX2}d6Sz+tg z+1=Y4+)hq6H(BlUbPtcG>~|{pEq8_$W}2#Ss4Uft?NyxNA{e&UBG2hbMsn3ByGLf6 z$D8OOboif61Bm>EEMsCr_-dM%a#&b+G2%(|p!~dgnD%&jR02a#d(p?*RO(=A+HwO$ z`qla5ut*Rhed#wr8>4kyRE(euy9bw3KWPIXo4*M8?auiT!sJxE%IKtYylIga_O!6~ z(#VNvW9{&7Zqxf9oDxy(Ng#<}aN|R<2w%f1j<}8WTWH$4H&I%K;l9-@^DRWl7BWGf z(b5#Lt+nrX4jPd^2T+_3k6*7+d_OOTYlR&@BL}8(xVCS-o#cOB`NS>){4>CJ0o_Vl z>hUn8cKL`Jq~bRG_-2AerMLtKehwW&n#aI(Z^WDf0rcoQu8+^%QY;rNN{aXM7QN9| zF@TQ~|6(Y@hR2*A8?Ny)4s9M1239_|GuccxfXLmtlszXdq*DQPzUR6OfLTxY@uYEJ z4YVH<^4*xtnHTSV{)JJSX5MEab#&#N4)~44k4C5ECX4U(yuw7qR)6%^zV1=KZt;7s zg0=C}m%WJ+MyHx}8NzEZIGu*5EWjCc)-=Nqk#G!tCxR3c=v#V@&}a)~i+)b+0%1&j zGIK?KH;Nb`P2~z~h;a|s%7UnJdy;kOiP&NR;1HqUx|=X&lsndZiN z=tDt304MqD+>{He*xyVfWd^fsNUAdHryvd>32d^%!wTJ`ZqIqH6JGD}TD~m*3JVU7 zcao!7Svp`=A5&VEH~Ik0ySNX{tCrx}ZY%cng@Mp~j%f^TdaxV0bfW^J0H|@6EM;J`QisSic9dlL(%BIobJ$kT7*9t%ic!NgIX9Q7NY0h?o7}%(Wyw zJ-j>&baIO-->tXtFgqW~pNpit_Lno{zf^vTd$S{`>3Yw4&)>(C#IVjD%~9e3H@)KY zc?d3XQtjT(GEA;)ELmc#z3mbX0sV9F6+UW4#TBVZsTKC5RMPyBoh!nhSwyL(`Gbrje~B$jH)PkLh4}Svk`V5no=%~hGaXTv z?uUHK+N40!7AjP_FP0U-0)4#yXJutH3q1RUhQ?`ecUXB6zqJkUOroakpS^Xfo^=3o zb~js`4%9Y+iTk?%QYTP4#CL%Sh!n8Jhp7uk!Z&LDxfqMSQcma|%>o&+nK00(4X=|Z znF)BCYqJPN5yB*};Puu&Fo%I)EEIh!ip@V_f##!$u(lm{6Y2vjwyRe;w7V9YK=MPDz>ZKDTbJ|t7bDKw!Wx_NzJdm zSDjr1Uq5qmbA=(_KXZ*VKfY+je&0KLN5-;=VI~Niy%Vwyc?d(wVwkf|;;r1W*t|$f6i|Q44?xvAiOTh*v1+y+N& zBjBV2?=KlX6X~WS&ysqH3hmWSE6^|s+jEd*m8RCzd6dFSjuVYJoVy0zQS<1Mj-`%X zYa?7;&;ou~Bf@sXhv(BmqM~>);^$@xpU^~Tc1uLC>B41_1k5u283bnIp+CbuIkJRg zv^SBSDpIFaCQ}uQBL6k$+0}#q!EkY5Dbw+BtT_)Lr8eHvsdHpxY0+B^XK8TNn~?%R z>%*BmT{?WSQX9}xu>wy3m75fcq&moeGAIl{+tfz5FBIMYa671El7oW1EcS3-Z&&rf z;qK=|RrMIK55?cGfM`d9P>>o+uzM5OH)th~UR9@^5s*e=k%B2ynKS0GP7P(LpMK%o zj_uF!FuoC+LUD9}i)1>DKx%AQ291dZk#i>BDO76ptj5h>u4UtutnRjX7snZ?Z*!@( zU=Yx&uz_NBL{BC0j)YLp&5(xpN@aXpaA4}Z7_Qd}0PEfS zOex7m!)P-%k2GAte$A&AIP~;xs%~uAf}t_`0)l+*IA_lW^9(SsNx4io~O{mL% z*(o%Q#bw*~#p7K&_q{HH-u=0HptI@iVO87A1eKvwD|VOXS^1{1wm7lCaV`c@QEURA zSqO_lmHL=bf$M6n89r1w3jK58d2bz|lm9AOVPeQQ&L!73{BLHA5dwl?G)lLAFbpMl zF?}aK)MU8Z zxHAkSGM|5mw0?cwZY?=%|{)Y0Lo|Y5AR=v7}+MB{%RNMT*52$J%`nO!{v9^T0K?z zAA?7AlUac-F(qT~&Z^F2nu2}Qz1b>dO1~(;BOzz1EcvXn8La48mywZL;TD~pVh z;rF$=a7DY9tQ%szYo(^Q5!sgY;;QGWG}@Qx6sKK8lo9m|d#6EMRjM3BG?Qo{350)g zY}d5W8ErTnWsJGn(ArYiq8+dl`t)#eXqJfR{CQ_(`;zf>|o6qnoz)n)HXjt z!`sp?*UL*^WzR|^l7l1D%kIBn^St`~m+c1qhjjJ9x8(SIx9p@8aCBoyri@~}x+#s) zSit8G<%u2#%Jy=j=$Da_7UjoLx{s2km~2D|bHs>HQ0$kWt%*@%Xo7=Lq)RnE^keGmsUc62O`i%zcLGs zCFSuVA1ATDPEU1}eV^X4+GxSz%^cxLJ+uk+PXtZxxpc6?4VJxhdbNRv zt?q~PXd989=q{S`?xG`Ugr8_Gp2R{4Ci|Pgm`$q1YO_z7QELF6Wa`bNZADVAK)+EG z7@ZMXrph|vq&c%jn2{ng)S@|~ej5m%KQpB2GJmm1P8Z|`_T%G4gTTh&^t$Jn*m)LuX&Fpd#8TC}OkZVbjWmMaecp3gIA7;azL_mMwBz7O zP2wBIf^7%9w`&`=KYVE!ISsMye||AV)tR41;V;vVZ(lHDw@)%QpHU7%Ai&&S)%6Mn z5@i(05hko0I-{#vd)Z*dqA82Wwsra92r*wjj(-EO3-0o7>^7nX6}_jYemK!4Hn0Qd zVY#(7P51H0rzVZb-%S%f{-L{)$=&M<3GG^2oTrbUE{`sU!~FKfVLdJ6O-(aZjx2xw z`TUG)KK4Qn?>ql_oc$Rv4b5FX`$;Uc{_N$V2t4>e@;5-wllR&S5yMACK!G34<#a zy)$ozTo1mf`J2Zf938;6eOoJOY$ow`&&;a3=_hBs_GgQl;mb(DSN#$8i#` zwaWSXjziDzTQ@Wo7VBGg<1^P)2{g+W`nVryG8M4qu^pd@#1d;v?ZT;p0>B_fRc=bX zX6DNxegl|irB^Vs{%tOi)(QI3ER50cX@%Dm{U+KiS<73FDRDBbTS_G5qH1~d7k%~p zp1U??(AUTPV;7~^$FQM$7V#IU1ZSuUcD!K7j1l!PSCKeE)ra>T<&n?7!k^(6!}xkZ zc#D=UGn&bXV;C%~x=`vNcf&?V(TbV$`erq^CKXz)s=rV-Cd0a<)lD-@hN#Xvg z_V#P50U;MAvGYB5KC+sT;6+TPm>ZHGpK~>3O1sKMW>*f3$n5)Zms-81-E6)I4<>W&l$yo*Q$Ep4Ai`G4 zi{kSBPpx^%ta*YS0fK5}~fh_Fqp&=Mv`d(V8XcsHlVfFm{5^7pJZr59aTk+3SN}PSuEcdb=l@ z_wAI8qck>$*OT|3d>XX+T|j?(X^HcdRBRtWz`*m5sw!3ntF2U2U&T9d~EPu@peo ziYKG0K<&;wMRdxm6$?XE8Fl|^cnn5Zye01+d?4qoNaStxmq{@gcxcJLPpDSvcjFx` z7GWSxhV9wMGc==I=b7r|uNFR*t;V!?dhg}{gX|JmZ;Ud%G{^HbU-p%6cM;&!LtMCy z88kR#1dHZE%BZ}VC!!;y4H+{xlKab^%F>5ug)TOwxR~oxA6tovwq_Rv?#DlAAyK}RS~>bIW0@0%izm+oIl&DN$*6U&DVe{E=gXv~JqnKgRnv#D*RYmmUUET6|goc&+4NbX)wKhZDq;&u1CN)#S+aziu{!Npg zQ+%K4%GtGP^u!X%ySZmwgf}DDF{hE9u3=fN={+dx{3$2GYnz61`CS36+G3V~H3uTz zH7q9m!CV=mxfsv+3zG?{G*<9ubE8MsOMB}(>bFM?P^2Sep=$2(ckAGj_BnDS6-uXw zVKk9p^AJ`_3>8yZ4Jhdu;W+2?D@>4OVq9fNyv_5#IQDY}=yj&5Ai6l4f0qJ_@YeRW zHZLi>WBJS|2UH;n|0%oj*6NDl&L4;g)mDI#7LMwW)m)MI1IIr$(y5ICCVi&cmgJ7o ztu$ZNg`;icG9gcTHXf<3k0TB{}#6j?*9h>Z9tO0<`$1z zWeGPqXYP$Oy4 z@JS>7_p`^3pKSF%cTv{T|EMj0`NeHa8z+|_n#f^gb5)CIXi-I7A6 z3Ep7}A>Do>3ZZIW9SWhJmEWKS zPETa3d-G*BHm7?7=4-MMvC(7R>*xe@w;#6dO)p}=zOSo$>*(dCx;NeJJ=eW?YiPPS z=-brLY*^0eTtlCl#yL=HsA+ChCAvx^`Ea-9=6X@HWw);vec!5?J1IBU|3LuQm5!i& z_FqpQH|)O-pKbj=@1(4y|688_=j+WY{wk4#-@n=q7I~|dUogTgsrl-_9H!)h)*Dgr zxjn6E@l~13+V);V?%SyHARS_1Nc#g*;+5{~S{jQ#Ybc z7NqC7>dtE-TOnCsG8|Qca9^_JSWL&}+p2r5BSB<9Ae6Y8`GncoVisFA*LgzQfn<|90xrSQzG`xqg5q6a~tlxH(gWz4LVE{(chnQ(IKEZQ+*FW z(E1?#2D9ywvWZ;2Ti;V>F6}y`z3OsS$kUx;4DEQssw!uR12JYjrPYd#Zm79(H|u_@ zuZ*&z!4eMKf)2Lw7L_5J6%V{ubSu=OtoogO5bdWRz$-V8<_f$e?iouPEMqmNQ(L2E z&7>2x8@EvVh_^sVTxNAWQc`7iKVU3wUC-vIn+xcHl&;=uPgfhJckXEE`XsMaw*7$7 zrE^U^DAR!wY3-Q1_^_(p`_UiYSpS=`i1#Fd=&}EM_V}=#|Lxh~Hvi+@l$~`Hz-MaD zZ^!)?(dpjkeqlP@YG3$#GmS5fa68K01~C29ve?W|Bim_kSLx)EEoG2G-C9SGa)M_3 zUo85bWwJv>SLw`Y5?o=M5hg$C)?w$0!_1asw={l(97wfwjM|JS_Ig`28?awmmu6Ih zUF!BuzS_qQtgb9>w*qS#2}WGH%Ev*VvMR)WAh}h&!Bd&#caj|!`F!|(Y839DVCGvBIfa94YyP9Vp|KoFV^kmO_CtBH# z8{mIye~z-ty?G2#uU=of19+}IybDJiyq6k4=K)>w?x@dpHT%J*UBkO4R-t##VSL~6 z(}!MeEdRULU56H+NB)2E>~UTG|MbzLXIuIIF3LLMzZQp89T4;(T+Ad+L0a2hvn&vSOQ$z<=J5~{x`msmyWY!QDN*oUC zMt90ZIw^ijK50Mp)?%5-F~9P(_phmQEu(shg5D#!SdQJgB{%H+b9-p+_R!QsjYjWe zTwR{23JGwX^*M@UwZar6kZCaFP*%@QU1zy&X7=*LbvaieOKleB=%_{`SML;zO5tbE zIAJ=!G+(=~8t>d6T~X^Xs*Z!c$|_Z6EPqjC8B0o~;%HP?+|VSlltWXDn*PL$)CDzY z^hUf&uD++4Yb4n*jZ%goZ%T1F#43o|&)+6*6Jw3|SNS$+k#ulyoVnUL4S`^2sDcTpaYQ<^JEB^7St_Nr?qA(Mi~k)q-$ z4KL}8$zbOJc{Asd$RbTemP;b%ERMnEg)C?u&UrH1CmD-r&ad>fS^iFwXy*Y**bJ?t zcTqK=tx?JUw-=CalXyu)0xi{)NXjx2^MnOE!OQcX&($Tj^MJend?eq$I42R$e+T6O`GV&OU2t<6Uh_$&xRw`c^LKWR$&Y_$@uK?k zPrLIxPv!H219c|^a()nrP#)wW<)J)?vFgtneIBSfd!YZGWuizGNkNn%v6%6YOjv%+ z6v5FG!FIvU&VvW!&FlaE@@!}4;^IPa);kePSrV}%TZ3m`-6L4t5Tnnqu^ce z&RE?D$#an{pA$22J%}DN2*u(+|62_PBZeZ8B4#@u5w!wh$6k^mRjjJ52vege|K1FJ zb+mKIlju27LOh>+P1BtP%c)|Z)vR&OEmD*EAcJWU$7l`-kJ_fyVu{=l8U3Bbu^>N) zERIGvi3bnJNs?zGD&QdR>;RocUL?)L6_1!C)PUV+^3=LgmPv9w=i!`$G*Mg-ya0f& z!xf7~N)mRhw}cdmw?>3$punEFC&+>(bjGq^XXlH`j#dT$qW|Mp#e~r`m1S?2`j;SL zR|kkS5ldsSTqyof@vGQ9{3)gckn;uh&l3{Hh0Ix|vF9{nAc0GsGr6-fCThGaVL6lJ zC^-7;lbtbk@HluB9DagrlxWCQ9}0?$Ohp`vYqjp2PGSbHuK2KEphvGLkKvn^m-GS9 zUG0iX3^3GUZ zWC@`}{X*174b>&ejl30JzmW^qF8RxEza41>g*5uQ(HF;OBlW-kHQKuXxOC5EPP3>w z8}-ZG&n6X-1x*7ssff&E4%EMsoVQNS&L$L#R3t3P?VL&#%S8=mI%lIn(}2yL&n6eC zh{bIA62#-;3Y*go|4XahM7qIDJDV5Ph7Oklcs4V(u{+O)>ei4()6&#z7LpZc`Mha>N`)T zhg+Pd%xTW1MJ!o;qQ3KVd$_%M@&uf2Zm{pBhhe}RI?rrE!2t(|evT&R(to%%Ss4Ma;ux+f;q$sjgNQ78%c%y0hDuXTtJpkzJlPr|UaU z-NUds4xT4X`8mt3c*xeJOUI`triWYH_jyWhh@XEK8UL3^avGCU5s~8}7c!)AANw$r zerjc(l9Q^FHS?5cr^E4S2c$a?s;Lw}XgJY0le>&PDRY^;q#*+n|^@}ohrL|bQ^qrBrQg*CeT+HRLC-|RMPEy?~ z3{huV#4&-Ipqp&&fW{rDawbGRvOYI8?iKFAhyKS3k6o$X^S76J%-X^&%+VUyAbnonUxsKcVu48-IPW$v}x@?Gq zB-9kaiy-BwN%n7l76t$bo+MNBf!oJTU<%cBp$>s3{;&kGxdUQ-3IHo~oNFuFJ)ce)^ zJlX!n!wR-cOBU0L75a$>pH$!lj`4_i4|Q9p>Uss0#{HgJP09)nW<`62xmk&op^nfM zko;h&Ij9%=CzR#$V~7iKi!gtP~dgu4WGG0lQJ_=aV5;spfoQR8$@!jQVzrkZdf zYmt(bQXYgvGCW!rCaNvae`4&3g>w-O0)VYnjM@$Y_&2}~$>E26ykyNsz5UT*Co@KxH_>Ag(M0onG-O8r(=Y@kYIO#95`WI+q~~* zyyN;RbY^y@P*2%?y1!&?$Mj_Dz6ZVHv#s7s)bofxiKaa?*hD=Zh0LF%QMSZ6p}NWZ zPLX;Y$?w;Z{1$jZS$AJwFXcUlB@Sq1(+Dfe%haQ300@kNkj%k8KXHlEQ>>>^wqv8l zX{<0L`-+M_w<8wf3AsOO(x*9`@6QJHX->rqQp+W=9S?I;oNvnW)v_TF#iZC82)2$# z#CJ$J;WR3gs9?_0w|~4?GwN2TVE}_J0~uqtf%j|8^F3qkt{%%;W6m>Xyi7cd0xyXW z=({A8s3?B%#NQh{a|JQP)K9fV89j1bfr`?|Lbm?KWOZSH8Ep7`Bh;sMVw26BqZo|?T z^ZS^3E+YP%hRmNyZ{U!EUj;Dk(u4v_)?rEWF^RHe0R)yg(iw;A zxL{cGBr+hv(zwvTxaiTTr_f1XKg_CR^TWuwzDrg$N@>A3WV1w=bdA{PPvS&sL1@Hf zFnt_Nmm0=RCK`+UYZ>ONbQnLAg&4#!<)%jnM`IfD$QXiv7+jFBiYVZ!p|VibRrf?- znt>hnkk9NF1X&{3YTmqinyzLpE?T=knaFuv^&f%&1 ze@4Y5EDiBROl5V8h&d05bQ!*^RirE1ze`-5Yjv8fD^;<$-zV`eviJHUA32zV3~rHH zL#`W6l+t){lG;#A*{wb{jib~?7veJWiy0^Dj~8n?b_|U3C2Cl|Y|y6bvh~wdsw17D zqX>oSY{7_6v0z}OEhZ#L1{2LBD$p|PcR!)RuG>x3vn);Pmx~w0m8uk6o=tSBvdD!M zdM8?W`+Y80{p!nFf${&B2^w-wknQ?Ur4)1Kr9!(aqxeC2&6R8YXZ&);czwdCZ@%yYnofmABvD!_Gr> zi>QEo>Z4CW@wkT{h+=-lp-=ruvmB;{%;ipEkw!s6i%a{R?)4^C->O-$L*{wZpIqXJ zIQi9NAv|Jnqyhw~8YsdOAo7X-&-L>DK-StCx(J9vv4<$kAa|x@hPmN+CYnkEF@?$p zW@sT4EdnwW4N`w%A>^jZHPntXy1Ef-Rr)bejywiFLl#2hBc25w86p?HvMIAHBdke#a00&xwrFB?H@oPw{Nx?ZFSurvNowq?0w z6dTh$l9@6JQzOTsy`6zv0d@1}4Hz5>>?R+h5F_f3SvZrP6*ABnHy26f&=9!2?@O~l z-yy285gA%*30j&Mx0Z=ymc^GfG5-~-zlMzEN9IacYe)`VL8O9-tsz5SobD`@AEj}g zbW#yn9~s(a+nfY3kCvr$;-Kzs!p$G2jLSI0DS#3Bg?aIeWEJP@=xD5Quh;LbBeRM@CHJlnKI?fw*A5C2{lW&{?C7T=ccf za>#jIL&n7BCSVQ03;@t;plLF?O>j1A6_%ncgxhNvr5T)B8_y-(%`kn`Pn4bOh_e|%5uFh(8o0$i zY|4rFS~?YkQm-E{&MAbQSjcXb*)$D#em1zBuI^e&$v4zo!SjBRs@4*|l>LA!yMj@Y(s6@8od z^P#0VNgXHiZ2#io*VFU2R?1|~wc>YZnY^c*O31@D&c3OcF4Gb>iJx9&^;wy&@Ea9S z-7Gg`QQPB<5wN{&hgt!hdu_jalf3lauj8-y@GZ8F53z4hE|zUlP<=fBNWZ5g6I-@!L}t6zyG za$)PML+@M3z9Sz47DmWu=FK-RZsHMfA`d>+sVw@bAB%PbO0fa;8TykmUx4?f_sJGC z&o=PzOHU9u%*oyk>bozkvMCs>Gz9~53I_Kx1%n5efvXkpN;#`l=M}g^Ox%=no^Et_)iv^ah;^=6&C|mEKKV6I>r8kaB)6*R7MmQ z@6&j_YL~$kA!33ourOeWvql;ycT8{;hoULhl|gjnP`4!y1+9pksF+?b>q)v&BS19b z#2bri6%G@JEInn1r^mKsy?XU4*gPu0Z%IfHRZ*3RN`{i3g#Z7mSC-XBXWIT;J?3&c zC^yFo9(h@oxR#t|fhT&)1+$y#yLmVUKdyAJg z`u!&olKKeVI&!x_0US^@C}~Xg67IbY_61J4XvScc(%Y^S1c}+bHp81qt39ia-iuj~ ze2|Khd|iNPzHMi~8sqRQ0M!D;4g{jQBvfA95D_X3 z1qGXgCTJv)>qvC z@b+Cw9$oDsg{RyhJ`O2MLZBw`12E5i?J~ke_nKho-H82#SjQBMbQID~KD*b!UbgA;liw2nlE2ob&~7 zTk!98KVUrSr+~PJld+}?oG?3g;l7dOcR7A$0T z-2b1$g2jJ}(`#Gr7RyrgTon7R%I&%zU}s8n3+qV7K-{u7(F;+br(X45{Q7(5h`RI@UcD%!8fk)-FSsxav3ETQjHNZv@hD|P@)Tf)Og>WRf1Ti1Ojg8ye zTN?wEHVY>ko~*?;j*kuwPc9DoTjJP$?|X#v^ne^K9P7y7lYP*k4f=m9Mvy<$rN; z5N@O=;+^|w%KtRj&EDtREBR8n{|yn?UHfR*|67CY*ZKXwy|>lv|HmlOQ*>ydGL0i( z0%aDG%EfQxF8f@JI3Ly^oETTf6@f?}L!dNHire&-D)~F!4m( zdWPuVoB!Ul5Sm3^WyM<--gpeV2PBLxFOP?4YiBBz51z+viF@EN=jP&u+z!!TcV;1k z#e7vXC)V_U`BBKcGY|XZl#83VAAd|08*-v=zT?MPMTeaY3MdJE@6#t_pUe0=HVC}F zeCbtuk(>uTL)9Ts(2nq==F31_`q_AhdIJ8cS~Apv+aE24s3-0pRTYy2GFecP#{v?x zhAyVsdPzlNBiNZH7Ej_109UE-2kH^PJvDV}YtoP;`x3bn=qwHw>xhDWIu6#+6iZc@ za<)a==!Pu#5IK0=Az`$BLl&aRLRat*AqNjp&%w46LW*B_LB9EI-L5BhlZ^%MC z#NmXUGtXmjqypZb6NmW@^+;H{XDozRAT}RU?{9JBOkFlP!2X%|dB$9YGU|(`CU0G7 zD3#}bs$fi1Rjc;V#Q*Q?ZRXDZ*LxlR|2XAxiv1gqvdI)OAZZhKb-~yV(NAz{>G`b}q!QmvFlTeB^Vn3oYDF$#n7E6aP;!cQV{l?-jiO@!6;4>GM92>S} zDYcAPlt_y$1t{z2mY|S0Y&Ijlt0a%2-T%bYxq<3@Xq6~80GW+Smh}S*i(+f$iy`=W z;NKV*g*MM2B`1tacS>;{P`{^ZB1QcLyE+|0w0tr;S%=PG>{l zaK_Xl(IOykW@1{LDH$S_d4J=TRTpuxBt!qrcl=6o3(6v-pH=}SsV#*}u=~qGRie*= zY4shnw+%n(OkO%ruiqQ-J4vx9f_8XB`)40eoa1}@| zwPurY^kTGt33+>RA?kv;Qb3%Swskbl1gK2IsyJ!zMxEJ1CrHIyMU_<0*3WNhXQZda zNKB_+Cey0xR90v;?;cNE`Ub`@eA9ku4LFnOkga4-g#^~j(-i@%`z(h}RlhT6W~`ss z8d|@Exm-hq5V98Bt(w+R`B~^rgOK{s81??e`~Tv-?4-)yS{d>gF0QA|BB zN>F*dxoxdUhc%sD0P!jDJT&px2toXBP*#S-!(bZ>5rNX@*mtcp5-|6`Ojbfiq&1O`|ZY;ei2NP~W9wj2Xd_2rymd137~l}kNTiqTNE) z(y|6N+IL-0c-TrJL>XMHd}**9l7N96`}+D?+VkkAU{@?YL>U24(hBsYaBw5{sWi<@ z+O@Xq%tXnpB-1pg8PRy6W?yvGSKBMmXbp>iYI}2l6Nona%9tY?P4)Y?m_{jFYisBi z64LP^lbFD=PJM?M_ZG@i1H5%{#Sve$q6rfH#8p{~*3q8c*#(#pKrLtBg(88y1v%eaoHnGW>Q;DXWuXHOIsA`=>d6Sl7>PX9R9>^FIhGS zB=ynniAlGdyTlAJMPab(Q?kYlc`FoOZ%i4ut{7RljGz4=A>bQpi7{y(;1_*>CEiQh z%FvDM&bGc^=&SoWn6ReaTyh0x58TBOEEqGrq1ID`y1ziu}Mrf_y_0 zBFxb&cBaS)Vj$QvG6Vl;F2jV~Vn4DayGc0;LN>x9X~#~KzZqzokxS;pV*$9G!DFBK z#(ZcU+bEXiD#n}C1~wg>=zC@hk_wi4yoo9iEAEilUXuBXM2e6__Y14PrVDbSXDD96Yn!GZ#gvnTkO6M-2Nwn(#Wy%UCr>Emm!cZPQ4pbk$B`@C0LHZO;VWM-`Yv{pt}2 zn6}GCo`Wbgk+So)Q8JYGJ9WvxGXb=KCb5r7Jl1(}qSSdWXtpvu9}z^xW8#23$&rnP z=wA?3=DID21sknv0it|rfS3XXCx>8qlzEl%F^kg{?h5ZwWlPX(RCEYB}iBWQNRj0$O;f~C&U4Pn-e0w8!+leVC+_cS|u%A|9kV_ zn+*`nBCm3GbUW|jD8?S-*fi#5`OfJ~jjjfUTB|{{wKHwnsQ^*l zLNJ&8Z(m`!BinVO7qW#dB=JDv@>^&0CX+$7U)*T?i zGk0&N9wO5Qw`#AQCHFhQZ97xq#vZsJMGWp_E|LG-f}6ccT?)DZX-{BuVF35(%XKM4 zh6!*5CgmV92)PC>1Dga(T*M+1ETf+Wh&+|~v~I2sVji)XxC$?yyS1{>N{ABc-I~3o zAkv{w?gOkEh;sI;wu6g%O+jSZm%xovU6ZvWIb(*Or5Jq7 zCdd&c)BH8T1()jiv9-dKws0s)UncNa8tIKyq}UB@2ba>8+_k@?CTxHpw{lE=a`f z|2+!-&k2jjQ1v3Y7EpaB{m9VKK}hC;H-JMdkpTL0=EzGagw7BbR_ageTHFA#bW)N@ zUWVe%Wsis2QrG1B;sz{+Bw$FDGry+=be6`Wo5ru`{IZrdZEwAq&?=`RC8 z%S|9O-jV+fXy7q}fZy-A*nNGauJzbN#RL^QToDX3mvLut6k%s7>3ErlU6A`QCK*w9 z9XKAFfDPaoj+98`GkOPtRWLOKej*KitAG$sQz)sAVxNBOL&RoftweONd+4g8X}oE?U> zZz)|*4s%zpk$zkuh=Qm_1oGHI5Cu`q4SuORe6hKgIfxqX@T!T(IA z*rmjGN-hLRb|I{)NE#|W;{RR9W2&v;NPt7Q&yE%l;BYp>*`r?&;iSbRcY$(eH0`%D z>P9-25kEWE_jft&%9EB>vWYxGlt?M=Pd3q&CoQc+LwSTK z5fYV&h7#*u9b`|REs!QarndoOR$p79$p{-25~Ug_UOw`y{f&!SboaV${nd{n0}rYY zpul2kQ;62fTv9AGVL=Q4J{3=rG4ilCt%U}S(?y2uB#QOX|J)*;DmkB<*Gp zwQ{#p){6TMcs~Qg7m$73)arbULY(;LX`U9VPjtW_6(NC*(RE@$G8pnq`-Ao5)mHA+ zR)@g%TZ-!4b|`QLF(1L;=Nh6r%x1Wss-r<$%f<~zVWUIrOc9O9OydW9$dhCp1*}O! zOsU3HTaX4=`g;~oFVT%NAIVsi>q)Xv?7DE<<`D@gzd$n2#s zN@)m-w+3MI#qrkG*0z|xqoZokmx8eCt8;z495}cyCfox%G<8I za+SSMG!0oik)He48zgd6DqLG^|7+vs!rMovXDbR z3KtL(=F*Jf@EQHj#pwycVTd8yu3=*!pI=M^*>}2KJ;YhqYu5|hu#UhP%$??^wvN0ZpZ>2V~>vT z2t%?U$kam|`l0t_z1_!u#UX*O@G@WB^44{yF}@`-x3&Xa{85YCQ^unc65X=!#_;1e zp2B&SMzov~FBr$36s9QeMajakISDI0nLX_EU~%FWVvr*B~DT1~R6 zQgmxky>(Cs?VAnj%Smc9oeAsfVm=))9J&zK*U(U;Np-c2%MiUi{Qmuq7SbYz%SAwj z=!CiC3?c!p$=Guog(M0ond`7cNgpT57P_aKniHT#avVXP;` zev*BOBQB&wMu9M0*Le!z4BwC>r0$QWrx$M^Rv!BCbpQO|r#BF$PR_uafki&Tk@$B1 z?ELC-|Hn5jnP;AzAO3iBae4mRoBs{_F^M3IsQZ5`1%SsU)R*1LC;cGi)1(VA#7lT- zqJ~NykOLEsoI^q?L|cUZcxrKz~fhJsXL?w(8LeVDI4 zOjNIk&;U$XLTFgai--i$h6ol+<+qVSKH3tajN~yZ6ib1q4*)EWrF$-@6U6I-`jjn(-oJm{*^MOArDOskO3b;RW7=%ko-H6m;G5Y( z%3_VBcTf>4UNFT2Xq!7zGQ&E@gh2BBv!h?OFEWqCshBwV z4UGg+^6>~b79Cetzl#d_c-p2ISTdcKd8N$s_N@R&-7;hqiD#v3@GeE{8;vfr7zmMHzc&A=ML-9p}x%yo#PY0V1k$I&#MRSwlfU&?%1C!*4( zbO{P%S}ex^KtTvz0r7wGuPPx%N#?KYCw;TElA+6mH(tPQtwFw@1*1hd!U_h(ktVaD zFI?w`7ng~u74R^Rc+j&kjVbmCT%rD$C>0OHX;b=f84_OVaAZ`E zKQY@?6tn^l5|Vcj5C_bLrUbrGIhK~id2t$C(ivfKv;@v0rK33vLlzd=)E_Dnr`+4} zS+1PE!VJ7q-yeZBiP#Y0G}(~bA;2_LGokw_X|H-ZWP#(U^iA!Y$RhXs&t!2<##N1E z26SP3AO{qZF$p1(0|Y!*L3O4KLNix1iR4+7=;p;=Ntkdkvo?h7Nl-?%DMq?p*`hc< zAOf{Y-b9I)Bpj3t*cIP4&9EppWKsRH#YCfqm1@~YIsHycUjSP9P5@AgDFwoj7FevR zZa?-j>EZ|%G`b)AH$J=d`!cD$5(q3erb?J=;Vmat$(vkB&43QdoM{R#2m(huqZDcRN(9L+cFf7@FYlKN4~e8Ecc2+x8c@?#)eTC`xG^f}n5e_lSeJ=A%=ap7sNIP@z6!BNclZCw z?*2`8bYm};-_!l z4c9R6ny$PnR*D6RLkPmG?^2 z_Kw?PewS!1m!AF(Ev3oM>zb-vJz4T=c&ZzgL(VK@%N3NxT*nmLsuh)`&AQ5h8y7^D zR+A}_vgecXN-Q5&29#sv z&8Yntp|^}z8(0AQf2!-Zw7+wSPl;PjRhBrr&W_}XeI9!x%iyaBxnZo*7-N;fAF)t$ zz7RigGCy}YuKXsluHit{ja?3Bnr7bV5v{?=8WJ{K}bPj$1)n&T6dNNhl^;d#rhGGn;O~obo^9G&a9a?V3 zfFmG0FuE4?0M?dwghpl@wZ5LT8HyT2UOu)oT;l0#OBJ7v(2h~kKp?~z(E z)`%}Fp4!R>s-)j`MmImm?+eGcZdcBNIL(!>!iLH$Sb9D*5mW8&P&-NG)KCHm#Aot3vF|O zuKOyVdLIY0uiCf<1BNgLFLZDeM&x7QQHMs}!iESGZUz|2WwmOe*~|qY#75(oJ2)cm z&yQZ6}7FVFOJ@pV0EG6Ow}BNY%m#L-kHqF0gr zAiWBXrf5WDh~hcB5&gkIsS?Snm_g|5=qL&Pru?i`fB@y9JH;IN49OTVh>p$W6H}Qm zqu<_bI%hQc2||M$KxB}%GkP>u(LFP9MSxuvw}y}eER3WOS5M?K7;g*4we;nTL?Ly` zXpkIGNoQFH=i1492d!slm+X+&nN*-g>QPHMnkFlZy}Mg4$dPF&yBu0BP>GE3AVuw! zD=VktF08a^lviGs)#|IUf%9_8A!4ER3@aIu3Hc~UXh=9u=R`t&Ukd(v z)^Q^Vb#sf@b-_dvduK~A#4D)!TX2MJRr8Hn_r4r|{UzxBH1m(*8X|YfDoo{r@r_j? zibjfEDwyj?cJs(Ol3iOml6^0bbR@eY*=dfCL; z5?$3w3zg}*jh1ZT;~8~+(E<#NT=_)FG^E*XF+77^vBolW4hw$27TRIo`^cfD4M=T^KkHHQkJw5iJFZaSSn>Y%w z(=6S;l(jM^ze~AF(&6e>?zWLxL@KN(Gq9XS#LEC89v~U`k%W1#(9-tW$o!>;+P>?C zwOgVEzEFNaoVYChPqvYIIdQX{X(K50h}+K(x}ugIPQ_~t=PIWv$Fsnr{^T4-6|>ba zMjpAPL1$2lN&brlH&vbr83g=)p<)IFXUpCF=%)lna!ve3B;e%kohxlvrd40x&RRO6Y}Bf5AyIpu`Sz%4)~h}x4fs27XQQ` z7Ecqv(jaP_#kE8uv4vg*8Nzx7`aP%*p$(%*U3S&M*zyDz=fv5Y6W=+xWe^l}R_4mJ!a4JqTXYp|H{|AG?ULpR!c+}nh z9-%z5_;2s}y9?Y? zU*Nh+%s=@OQ_VtFN3Uxz&Y+wAonFO<`Cd80&8=rVd z6?WdknznTBU*6|NdK@oJg0K^n=I>Z`Ty1bQOYZKBW!dHqurnnW^sg4T?x}aq&?;BTlsn%Mo z@)GT}vb|?<)Xnkg?X{TWyKTD4msP?{ec{MGRy@G{%Q!phoaa>P<-a^0B{GTCCBO~x z-<_SkoxJ>acXzXs|2{@}IQt(HcOF1WDu#&M8A^Jl(8FldMkfxnkOY& zGDb*B2bJ#EB#dcXdlZtu!w#7dw1&=bT5Syh7W4*I#_#hq$N`lB- zi4{|t@(cvhxf8TYDbuBt=>*xUS>u=_pej>M9T7nFlJR)N<59U$L=E>1VS|?XB4R;V z#F?5eTrHgiTU6oNg(aj!QX1**5|9*-j*;$W071IDTe@4iyOiz@LApUYrD2$v{c+Cu z_D|T?zTW+=XWeT(!5ijy(sZ2$kTun_jq)h64?~tBAa=;0l{cyEXJ!4oSlOB)iXU0o zGA)OLm;t`Bf+P6-*g6K6#Cq%x89VX+abq1)p-+ZGEe+kd3zBw=BMs$p?CViq@;WSE39%U*TFl%cPG!0U_Ah; z{=TX#veT9|WeKcBsvi)DjbtV}3&V-lP37^| z8eXT8_!;AMjVU|btWs|xk> z6Pu9#x-g#|>*k}IJkz!uZT>h{xwD&-T!J82-fVkHvQ6f7#Jhd9ZAZZhB8U>@F&FN& zTqZZg9qr-+8b{9G5@n$kv>NB{m3HLF$PuFhCcBG*xrkAx!Gc);Rwyxo@!Z_7(8C28sYeuaGPz*3;ejQ0^M;=)=VS`8p1q4v* z9-JXPHRoMRx$sNw=n6EP?i9|pOcv+y;pdPDJf#M;*E-Q+ zTDvFQ^{7Zb&kilg-P4VGaP9umeY8&laLTi{*ASqlt7aNFRgE5D7_m_4q?W6#<{K<( zNUizcnl%Q(<#sxkBK~NCm7t}(QEufa`OQ{&>vr2=?6#5*liYNE?Wl&9G>9tU#*@Jz ziFTI9!qqX;MN0DTU$@VGBQf|hTM0@`@%=9<06Vl8H!so%RK$$#z|45cgR7>{Y+rGR z@GoDC`k5$d3O_!!-ik5S@2SzWGgS)VcaJX#p?J(cWWOgfiI#atLHeZp45Hr4+Gqp* zp(70Jn!vERFFa9?VI0`gYza2`4P2y!8&gwLhHnaR;)`yYke>c^)Jz3|KN?Nae*G+9 zSs)b$^{^Q3AL7m~ZuE&)rW)_h)6%>=#GmyG@Up@uCQ^|6@XD+reav z)!-FZ>NU>Lc+e9oDOB!{EGor;0m^2RB%bH^TNrBnJIcbogHo`UtBP;`lkVuA8-kKT z{X?3kr;`NvL5G0`!HuNk`1;;TD=}-S5qZ+YSGmU&uM3=WJ?cIVJA3C2znC;d8E&2L zbW3kUOAxC2;+Ahx-}fo9euw$__d{KVX@>3@B=4vpxBK!c1N6rMpDhur+4yTq2j9qz zo-|}1Rt>7YsONSA zAfb-P5pxLc9ptO|pvO)d@(mT8Af9aGg%r-(YY6DOXu=^iIkEyBoHemV3MO|;jWRGB zDX5c!n==(Tw$Wb?c128J_I8z_^|J2!^=L*1?sNcgd^U7axC#{Hv^%x_F1d?4c@yzN zBz2oavn*MqKkk-#BFV*=b!5+P7Lp~w!}~9q@wFSAy5}22?zw$iD?=i3{%@aB(M4< zV1~h_1PEr%=MLRL9|nm;XqqTaR(vmRuO~B4T|~D{A$Y{>YbJ$X9J)FmBwlNTFoxMw zAy(GN2C>BRgZx6>_OZZVIOp>&i%G4b7jeiB>vtXaNzv$Jk3BV0eOhV2+UDxY@m@f@ z+WZx(N-fczxK|R_P;2|YUcY^??)&4r>?$iRDpbK<+LPHxJo~aV?R7Z1%X~7&3fT<; zd3Pxvk5@9qp5_M`y8e(*2EV7m9D?bLXa2siO9aL@{utwRu;M-!mfnxkwS79+7>0;gKMJs+Miu^Ri}&{VbW~+X_mzHC+6@?BIDoP39*fc4xRNYhBmu z^!HF*y|7k9`d8hJF}lCv2PEZdKw=Yc(C2!+@dOY{Cmv{xczZV*jV`o0uMTuj)XqFH zO;M7y^wyBDBJA|ck`Qty zB3ushP62^*TsiW}MX=~%b2H1|H7|%^l{croYG`rF828DW;~Uley%o5(WyMkPJl9Fx zzhr|cYbE8{?`uZ>0Tg>~tfQ~{zv19!#l-iQa?17dl-e|brk zFmrcsd?>Cid`D*24E%C$ibkza?K?R(&im)D$2FY4>K&|VcsW683u6>S&?Nb3XHy1; zHi`~dDJhBMtF&MQV6t^|r%&PK+MO3^e89e9UEzB#ouxLsQQD41^!isvcDL2*(5!Az z1wV7-yfc9_hcE@N{T_}#Oc?%jAD{IJ1WXm`iIjoy?xa$j>@B-AHcacwq30Ydb>|v0=S#IWn(0=i2Al;ey6gU(Ke1!h)e2gKoB*84sAV zV{LojFUxT)t~$4KyW8=X_19u0e(K>V7A*G)hjn{Z&-JY=zYB}&nwD>Fophi=+Vn9K ztM5keWWNicCXr}z&RP}6h4qy_weUrGkL((h3oF0QO^B>xn%>9AkK!D!Zm1N)vGsYO z7~KZ+<4BknwbJ>79eA`_CwP`5zA|Yo7B4dFQi&uuZOw?BC9B7Ix6OO3uwR1LrY3_M zEJ<5)KInyWv%XqsZIDzXO&<>{V#pn5cXYnZZTYEIM(^|9VNGWzE!TmotEz4~KO;tz zR#h&S4ND72cg(;d%5S){!6NNFf41os``;F_>0q%FJL0r-upmw4&&|%1&~3;5Y@ewa zEy_EHU;K6CqeFODQ9-Yfgj?oTk$6m3qypuwK^Svit*l@Gt@lLN%`)AV!Kdf(>%A$h zgZEEzIYtXmi`Apl@^5;0ghd1=mRYcap_MCm-%iIs@fq5rFm1Gvh?@1V6-ZI zxuT#bKaXpaZR>HAV|7Td;qeA`;;EHNuTB5`PKftXzQdhjSuJ8wHuHu|Roa@WL~N*E z{A5(ReoJVqM%sSM^8Xm{X=t?a5QE?3bAaTS?*97G@r3VUH4eL(`od~`h^k2USU;l*kr>2fy48G(WLdCzt2acBhY})bL>Vq{@ zsuL%K#PI$Qr!}R!Nl47PlqadtU|&y=zDrjV`Hdw%?p`Acdo;J4ao!!IjwLK)cp^@H z|0Z>>#52z_wnv$q$4FyK^2ef&N`r$Kb z#FM>?rwr7KdkbJ=XDBle5(Ghx zDy^(Rc7Kke)tTY>m0QW=fIi&3WQ=V=*v_VOojEJ}Zdl|bp31&BjWd>-tqd1Ymn-x+ ztgHg`Z%wcmzSp0LCvaab{xR#3&CB;OQP4@=2yON#43F0+sh*8L-1(2VQonSHkfan| zJM}mUB6wedQs=I?Dul)iz)Z*lgQ84Kdnq2cuCu4v;yU? zH(H_fHScOH(lzOV^emD>UPq)1k-zT}-AnsfA!S0A-Hz-q>P`Lpr}1#zlw;*Fx?HIW zMj2P%q<2Kbr2HK458`GIV7CfC=Z`QykOTYBXBZOgX)?)c87ftxR|mgR@1Fxoesg{y zeF*3S0_r-hD6M`d)^8)BMY+FK$1Y&?U^;&Q6bi(D@I3`| z`gdio0c*LiOWIV_IDnd~><#SdQ-QdNb4NL)vBx~N&LAVkV*?GW44zNbY&Y?S|2J^H zBpmh#3Z_3h0%%j#VVr+A%id)v`nXs_N4=ax(z0cGww6{fO5VY9ymYmtmt6$oO4*77 zf&|CqTpwTdB8++cmKFRV9?pjKhy&X^g_(k1!;c>F)HKY0)f#AKCOab6G18sX6y?c! z%|A;eTjxu^{$uD@KH)jKs>}7KOJQCIMVdh$nMkx0@ue!O9J#bz6P`EjiV?6hbin<2 z{y?fKUZKr~pq{||O{Q$hN{CTc7J8GbwY`gR>O)4YO50P?6sq?^qjGx9+r;5Jit%NS z;*Q4hj7f)a4dEwO;ik2u_*Qz`d$aSW9t@z2o$ew6Ao~`z^&WWO+oygMkEH~S0_;Pb zFSot&veNhslDqts3e7Y~$8APn`4%KGn+~DQj0uVSqq?W|5!W{O{ZG1o%VsDe(?UGJ zI%P8o(rO=_GFGD)3?P@EQiKTk- z2S-8E!^s;R@`{1e9KlJCa@qcBXjncfX8BN2BPah8a-rrfs42%qo24@tF|n5BbBgu`3R zb$U?3?{LEgK$8n1_^nM@Tg_UDKxq*1DtaK`J<^Iv3mwGJYVKc`NFq0rc{7uL3$5i?hT1a+ekqa zy+0NqCVOKyIN$_E#YN1SOH6Wk0(tGcFCx0`$u*rL2THydPX|SypgL!vwfx}m!%@L~ zg<8HRd21gWcWwl&V!;0$$Ept^|4P7R*YqFYysOV%_9gxyG6)0hj))IHp5;gMzK-I{ zs_)9O@R`OE(wGShVvpq{t;v*(hL8mxLIOA#wm|Lu6NW_iUnu2mYal*s1b0pAwiC9z zm~OMYd=MiuBKNgR)mG#E?vD7I9#No8?TC@-E!0>ZTGn^rP6X_zDi8q`F~Iy!fWAxj zBcjHim%+ioUvW&MOV=lH%93?iXxSSta*~F;d4vUNAMbl`CalK>xt!q%uonY>G^$q{ z@PO}yYQ*Gd_U@4=Y16A*pXVugc^8vc|16R!(0F~?OO6cs$SgBgth(?=ViwG1)+a5GthJLJ@M)DdQ=`G4i>GzsKk1Ay) z-cZ3;R#agQ3#@)v?DdB&l!jbIj!ymhEZPpNo7l-Y21UO<*h}~iH;6hF-QzGy1LL(| zW2r(}nr-_QULpSZt3NKPPnzcFwssbm-5SfDD1LnO*GcypGqqnGt=1AMp-Qg2XahNu zTXD+`|CRUIy$FRxBuhsi<0?W^63EM&sz-tJwCF|xZB1PZV*q7|h$EDqD0zW__J7N`~HWSq$Q0YJiRIIaDCes6F-6JpO{b-n5Rjg@1JVG37>ILAFjy?14 zEOsjCu4WrfJHe?eHEuL7VI`m7X89KLFUD-b$QzC^)Gt>%9^~B)0wf%5UGul(1_D6l zc#VX>YBiF+)DLhZyF9z_0JhMh7?11V7hUnhnrXK#3`0EQ*LH1ds$bHxBk& zk|)dQ>Ld=9^mgu#tb%2y$VTnpzpUf@Kk;{eh!pwC-&nHDeiK&v_lM_=tu%fDL1UY$ zT!+oUfr2xbk@h6rUOSB6%QWl1qG<9kIOWwhrT;=(E7}Sij~kZu@6*Ri4XJT?lc8C! z*63SeGBlLzSLdTb8x8;JvT;VDu}aL$Pw=b0W7cX-s)ljhQeh?rBj5w<+hfK&DQd(8Ux zU1RmEK=zxc51F{Xm_gnQjLwEOyU~M#nqQ;V=;+fdXp(VwKE^1~&z_XI3DKp7t>^st zrfnCe>!NSfY|v6I4cld~swrQ<5Lwy8qoQZZvRq^HnA=wyH6Njtn9mf~PQ{2H6| z5(Ydh5Hq4(JIbmh&D_20(Hg0heIo-; zA(8(_p{(4i{ZFA>=jk!JQEqZ{{I+9lg!)yw%l}16#T`vHJZ4h$!gFa2BCY1W|J}ywCembd6X}b@iD=kL*E9s?R+E0&+p7|o~_~|^Z1H%WZA0XUTOt`w$?>&W6b%3#G@HDp9N9T;MO9x2nt_?Jr;j& z*q!UKEMc@|-bc4!w5%F^{fq53x0wsCI@OQWmrDkgE>y(ee>YEar{RaH3d2<&9e&-o zJ=w6<*rsWu{0{rfvB~*U-FhQSqTxqtnk03(xwqasn^I0`zuWoKHI1|tpvpT?-~tE+ z9u`f?CIA>y$qjG;?a6)+cZ&)cV9ix?ln4DQg}oeilYscqJy4V)3<(Gsc!MQb`~{g_ zmr>c_A34O;e`ltwx)n&jL3UUM)sn^R`ags{ zjtGawi0v*@}bw>tvquqp3Ju3Yau{!O1t6Lx7`wc_8C12=X#9eXy+Zi|3U*-Te zl+KoD=B3kpkp+icTvcw^crJuK-4J#G#wgd z`cfZvOd{2tg*;ym>MJZ?Rf}Fnvs)Vci{5loY`-9AAU^3jq(jy}RA!Axm>Ju;v^UbI zV5_<*V!0|(C}aHd`A{C*>8$}`aidz4OcdqwdDvblcJ|vy7^>`6c4O!B5?JunKi<;V zLG|_Wb#im`^!K_On04wS@{CNW4}96HzUQ=tUNlGOF9xkKL=vz_6gXiU4Vo~p3V12M z-&yFpdXAYGxT$I@yS$HAiT2A>G+MNIjWOcKo!nurs#*1c5_dFKmdqf5M<8i5~KFbary)32gt{*ck((%Uyr7 zZ5Tbg1l8Vi)~cw0YNtV<@khm){T|g3DoPL6;|I(0>s{z##_O2urW!Gy4Wfn8`alIw#h; zD6)p8%qx2~6w@ObZIPK#f+!b$?#HxmKchoMxi7uJv&_zUTP4aw8(nXvH@&D$x2%8M zKrTAFh3hUEZy>dJTN86n0ReB}Te+-{+PdTC;#q#}>CA8Md-SuP9=Fyy^o{+Xmp!qt z5%J$rA~VdTJ_WOO(3OlTSFF7UYkHS9P2cX?y^R7Gh|@!)bbRa343X~%IJevX+w-l9 z!uR|T&{j)p0{9xeMgtKZzCAoGHy{?iaKUn4tKz1e`w)uJoUO>Z`E%jw6=3ebPg=FQ zB;TpTu|d*N6AyLQNxz&k#7mPqRs#jjfZRT#X&}JIs{Wzn8GzS30v#4;EU6v$*KYv@ z8F6lRmse<3tuK1-bw!HWSTMQdSwJ?=Ps!WOAzUqGrDO&(-G=va=zLg&hM>rRdSi6a zi-Pm6jVTKoa%113$YRvk{AFO*YuUx_Tg%sh1DCRb-1FA+<#GAyg05Wf zTC$3jW=*hsxIxMrp{pn#DvC(mhl&Uz&lK6==F;S3EKY>85`&)(y()V~O&XfVgn2vk z+}S@XGZy4XviV9ssNH@4rgq(G?_a0J-bcFn(vmPYj+cQVxM~rmcBim2T2htd2*p%S zMJP&$t;joIGN>pL4p5IE9wPczP%^X|*2Ny!%#373crufTbYto{hqsHjBq^7LJ+7M^ zqS1!pM_ZTEnle?{QD^HAo~gqCjy~GHq+Y(^ig#c6dpMB}%Ksfhz6h>d_Gb8fptwdJ zRnw6W%Vfdlgmao}VrlZmJf5i)AN6+RCD)?&)IB|)OJjX)DHcc>j;Jk$ox!@IUXjTy z{!vhTy+=d|CZ;$UHDOR(f*IDnhXb{E!pY^z*J0XVIkZq2vqPkY7&@Yy28+LvH@tjl zzxhW#Ve{?8Ik7kE0vLKU77jVD+W>A@nGKvy)%4EKcuTm zqU}X4t#iYP2I0;;Id!;?irq*3exiRHC*j5%C)#?XGk_$tr>5^m3~oRT=pYP z&V+?fBxIBx7u{-}$e{N;<+D1TBolKV$!LOR5?(zH=DBPJJ`p!%q0~^0U7~(+ zD3&mCOb)~omr9XpMxj$X0w2; z2~e-uT1fFkK>zjrHM^X|0DNn8eSP`{&=-EuSt-}Ye}-B4%9^NmKVLLh<0c63a3hLP@&`&Lb@`xsA=QcBgje0~{UB7a36Q=45mzZfJ6O8=fW-dc>eRwRs z2`!&8*6P21;e8*pSOATA0ET>4KBo2%RK~x zivCi+Q1@^R1vWPiR6O9~GGp%v7pk3&z?HWmFE-qLF!Q29Lu!jjDWkrqFvkZ5&{uxG z7}ptj-^s$L%JLMCx9#Aa*b%OydQQ%GR`H32Kl!Ye6G-tN1&9RpTCbmdhivp`!1n;{ z0kG`bwep|NmRx90G9YjfaK7DEi1I@f4hV4qTdS)teF#M<&j|oo`ks0ib1C5`b5I$o zXE^v5tS1ZQhbe&VZqze<32aQm0Vf5i;dp%~U&<$3^uuMc!c9w%n2>ztlhI7pPQ2Bm zD5Dt*t^fZ*p*)}UvrC&rsF7ncIbElEzy~o4N#RG#UvrNO*;Ka!qrInd7k>lX<1JyOLPM%M08{1 z5qV5&Tr!bA#k4_8*Ge=#Vdtpzjr!u?X$u{LY2n!`1P6laXy(Ra*DPX8%55h1DF!`~ zyO!dHHpW|OTi~|N2YbSHPZ3{_`<;O)50PK5objgRA9s+L>S5@S zNZ*^S%X!c(-SrA}>s7zG)Bdq(n1$l1e{}Ise3eo8I1zpw4|293CtY+$Mo9V`r>kr@ASMQ<(;!+_P)4Yh?_)TjQAevdjunU9Mu7HjL|s)?cKV zIaZ%kXPMMPo=b0oQ;pN;h$bsMn=Ew+e5g&|*a(EID5$Ho1WTxTnY9@8T&iKQmUSOR zj4`?m%*n6yqYGQ*jqDy3y2WE?4z|I*_;>1EM%fdVj)0Sq&hn%3ttQ!{Rp*}ESBfu9 zdMJDM-muWTrlF^+;=%X6P{~&epC5ep?uI7SLMFODLl%Y``TothR>P|ry=nAI)pVN* z#g_RJJ@0-E#ncT)vtk|L%UYI?x0!uG;2lt;_EAjGM)+jMo+kNa/\". + \n If ties still exist within the Route that has been given + precedence, matching precedence MUST be granted to the first + matching rule meeting the above criteria." items: + description: "HTTPRouteMatch defines the predicate used + to match requests to a given action. Multiple match types + are ANDed together, i.e. the match will evaluate to true + only if all conditions are satisfied. \n For example, + the match below will match a HTTP request only if its + path starts with `/foo` AND it contains the `version: + v1` header: \n ``` match: path: value: \"/foo\" headers: + - name: \"version\" value \"v1\" ```" properties: headers: + description: Headers specifies HTTP request header matchers. + Multiple match values are ANDed together, meaning, + a request must match all the specified headers to + select the route. items: + description: HTTPHeaderMatch describes how to select + a HTTP route by matching HTTP request headers. properties: name: + description: "Name is the name of the HTTP Header + to be matched. Name matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify equivalent header + names, only the first entry with an equivalent + name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST + be ignored. Due to the case-insensitivity of + header names, \"foo\" and \"Foo\" are considered + equivalent. \n When a header is repeated in + an HTTP request, it is implementation-specific + behavior as to how this is represented. Generally, + proxies should follow the guidance from the + RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 + regarding processing a repeated header, with + special handling for \"Set-Cookie\"." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string type: default: Exact + description: "Type specifies how to match against + the value of the header. \n Support: Core (Exact) + \n Support: Custom (RegularExpression) \n Since + RegularExpression HeaderMatchType has custom + conformance, implementations can support POSIX, + PCRE or any other dialects of regular expressions. + Please read the implementation's documentation + to determine the supported dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of HTTP Header + to be matched. maxLength: 4096 minLength: 1 type: string @@ -523,6 +1061,10 @@ spec: - name x-kubernetes-list-type: map method: + description: "Method specifies HTTP method matcher. + When specified, this route will be matched only if + the request has the specified method. \n Support: + Extended" enum: - GET - HEAD @@ -538,9 +1080,15 @@ spec: default: type: PathPrefix value: / + description: Path specifies a HTTP request path matcher. + If this field is not specified, a default prefix match + on the "/" path is provided. properties: type: default: PathPrefix + description: "Type specifies how to match against + the path Value. \n Support: Core (Exact, PathPrefix) + \n Support: Custom (RegularExpression)" enum: - Exact - PathPrefix @@ -548,23 +1096,43 @@ spec: type: string value: default: / + description: Value of the HTTP path to match against. maxLength: 1024 type: string type: object queryParams: + description: QueryParams specifies HTTP query parameter + matchers. Multiple match values are ANDed together, + meaning, a request must match all the specified query + parameters to select the route. items: + description: HTTPQueryParamMatch describes how to + select a HTTP route by matching HTTP query parameters. properties: name: + description: Name is the name of the HTTP query + param to be matched. This must be an exact string + match. (See https://tools.ietf.org/html/rfc7230#section-2.7.3). maxLength: 256 minLength: 1 type: string type: default: Exact + description: "Type specifies how to match against + the value of the query parameter. \n Support: + Extended (Exact) \n Support: Custom (RegularExpression) + \n Since RegularExpression QueryParamMatchType + has custom conformance, implementations can + support POSIX, PCRE or any other dialects of + regular expressions. Please read the implementation's + documentation to determine the supported dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of HTTP query + param to be matched. maxLength: 1024 minLength: 1 type: string @@ -585,13 +1153,17 @@ spec: type: array type: object serving: + description: Information needed to run a function. The serving step + will be skipped if `Serving` is nil. properties: annotations: additionalProperties: type: string + description: Annotations that will be added to the workload. type: object bindings: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -599,10 +1171,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -613,7 +1189,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -628,21 +1205,31 @@ spec: - type - version type: object + description: Configurations of dapr bindings components. type: object inputs: + description: Function inputs from Dapr components including binding, + pubsub Available for Async Runtime only. items: properties: component: + description: Component indicates the name of components in + Dapr type: string name: + description: The name of DaprIO. type: string operation: + description: Operation field tells the Dapr component which + operation it should perform. type: string params: additionalProperties: type: string + description: Parameters for dapr input/output. type: object topic: + description: Topic name of mq, required when type is pubsub type: string required: - component @@ -652,21 +1239,32 @@ spec: labels: additionalProperties: type: string + description: Parameters of asyncFunc runtime, must not be nil when + runtime is OpenFuncAsync. type: object outputs: + description: Function outputs from Dapr components including binding, + pubsub items: properties: component: + description: Component indicates the name of components in + Dapr type: string name: + description: The name of DaprIO. type: string operation: + description: Operation field tells the Dapr component which + operation it should perform. type: string params: additionalProperties: type: string + description: Parameters for dapr input/output. type: object topic: + description: Topic name of mq, required when type is pubsub type: string required: - component @@ -676,9 +1274,13 @@ spec: params: additionalProperties: type: string + description: Parameters to pass to the serving. All parameters will + be injected into the pod as environment variables. Function code + can use these parameters by getting environment variables type: object pubsub: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -686,10 +1288,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -700,7 +1306,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -715,13 +1322,18 @@ spec: - type - version type: object + description: Configurations of dapr pubsub components. type: object runtime: + description: The configuration of the backend runtime for running + function. enum: - knative - async type: string scaleOptions: + description: The ScaleOptions will help us to set up guidelines + for the autoscaling of function workloads. properties: keda: properties: @@ -737,14 +1349,20 @@ spec: format: int32 type: integer restartPolicy: + description: Restart policy for all containers within + the pod. One of 'OnFailure', 'Never'. Default to 'Never'. type: string scalingStrategy: + description: ScalingStrategy defines the strategy of + Scaling properties: customScalingQueueLengthDeduction: format: int32 type: integer customScalingRunningJobPercentage: type: string + multipleScalersCalculation: + type: string pendingPodConditions: items: type: string @@ -759,22 +1377,56 @@ spec: scaledObject: properties: advanced: + description: AdvancedConfig specifies advance scaling + options properties: horizontalPodAutoscalerConfig: + description: HorizontalPodAutoscalerConfig specifies + horizontal scale config properties: behavior: + description: HorizontalPodAutoscalerBehavior + configures the scaling behavior of the target + in both Up and Down directions (scaleUp and + scaleDown fields respectively). properties: scaleDown: + description: scaleDown is scaling policy + for scaling Down. If not set, the default + value is to allow to scale down to minReplicas + pods, with a 300 second stabilization + window (i.e., the highest recommendation + for the last 300sec is used). properties: policies: + description: policies is a list of potential + scaling polices which can be used + during scaling. At least one policy + must be specified, otherwise the HPAScalingRules + will be discarded as invalid items: + description: HPAScalingPolicy is a + single policy which must hold true + for a specified past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which + the policy should hold true. + PeriodSeconds must be greater + than zero and less than or equal + to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the + amount of change which is permitted + by the policy. It must be greater + than zero format: int32 type: integer required: @@ -783,23 +1435,66 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to + specify which policy should be used. + If not set, the default value Max + is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which + past recommendations should be considered + while scaling up or scaling down. + StabilizationWindowSeconds must be + greater than or equal to zero and + less than or equal to 3600 (one hour). + If not set, use the default values: + - For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object scaleUp: + description: 'scaleUp is scaling policy + for scaling Up. If not set, the default + value is the higher of: * increase no + more than 4 pods per 60 seconds * double + the number of pods per 60 seconds No stabilization + is used.' properties: policies: + description: policies is a list of potential + scaling polices which can be used + during scaling. At least one policy + must be specified, otherwise the HPAScalingRules + will be discarded as invalid items: + description: HPAScalingPolicy is a + single policy which must hold true + for a specified past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which + the policy should hold true. + PeriodSeconds must be greater + than zero and less than or equal + to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the + amount of change which is permitted + by the policy. It must be greater + than zero format: int32 type: integer required: @@ -808,13 +1503,32 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to + specify which policy should be used. + If not set, the default value Max + is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which + past recommendations should be considered + while scaling up or scaling down. + StabilizationWindowSeconds must be + greater than or equal to zero and + less than or equal to 3600 (one hour). + If not set, use the default values: + - For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object type: object + name: + type: string type: object restoreToOriginalReplicaCount: type: boolean @@ -832,12 +1546,16 @@ spec: format: int32 type: integer workloadType: + description: How to run the function, known values are + Deployment or StatefulSet, default is Deployment. type: string type: object type: object knative: additionalProperties: type: string + description: Refer to https://knative.dev/docs/serving/autoscaling/ + to learn more about the autoscaling options of Knative Serving. type: object maxReplicas: format: int32 @@ -848,6 +1566,7 @@ spec: type: object states: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -855,10 +1574,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -869,7 +1592,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -884,29 +1608,80 @@ spec: - type - version type: object + description: Configurations of dapr state components. type: object template: + description: Template describes the pods that will be created. The + container named `function` is the container which is used to run + the image built by the builder. If it is not set, the controller + will automatically add one. properties: activeDeadlineSeconds: + description: Optional duration in seconds the pod may be active + on the node relative to StartTime before the system will actively + try to mark it failed and kill associated containers. Value + must be a positive integer. format: int64 type: integer affinity: + description: If specified, the pod's scheduling constraints properties: nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling + requirements (resource request, requiredDuringScheduling + affinity expressions, etc.), compute a sum by iterating + through the elements of this field and adding "weight" + to the sum if the node matches the corresponding matchExpressions; + the node(s) with the highest sum are the most preferred. items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a + no-op). A null preferred scheduling term matches + no objects (i.e. is also a no-op). properties: preference: + description: A node selector term, associated + with the corresponding weight. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -916,13 +1691,35 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -932,7 +1729,11 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range + 1-100. format: int32 type: integer required: @@ -941,18 +1742,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an + update), the system may or may not try to eventually + evict the pod from its node. properties: nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. items: + description: A null or empty node selector term + matches no objects. The requirements of them + are ANDed. The TopologySelectorTerm type implements + a subset of the NodeSelectorTerm. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -962,13 +1798,35 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -978,28 +1836,73 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic type: array required: - nodeSelectorTerms type: object + x-kubernetes-map-type: atomic type: object podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling + requirements (resource request, requiredDuringScheduling + affinity expressions, etc.), compute a sum by iterating + through the elements of this field and adding "weight" + to the sum if the node has pods which matches the + corresponding podAffinityTerm; the node(s) with the + highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1011,18 +1914,54 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of + namespaces that the term applies to. The + term is applied to the union of the namespaces + selected by this field and the ones listed + in the namespaces field. null selector and + null or empty namespaces list means "this + pod's namespace". An empty selector ({}) + matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1034,18 +1973,44 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static + list of namespace names that the term applies + to. The term is applied to the union of + the namespaces listed in this field and + the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located + (affinity) or not co-located (anti-affinity) + with the pods matching the labelSelector + in the specified namespaces, where co-located + is defined as running on a node whose value + of the label with key topologyKey matches + that of any node on which any of the selected + pods is running. Empty topologyKey is not + allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the + corresponding podAffinityTerm, in the range + 1-100. format: int32 type: integer required: @@ -1054,18 +2019,57 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a + pod label update), the system may or may not try to + eventually evict the pod from its node. When there + are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all + terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or + not co-located (anti-affinity) with, where co-located + is defined as running on a node whose value of the + label with key matches that of any + node on which a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1077,18 +2081,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1100,13 +2138,35 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey @@ -1114,22 +2174,65 @@ spec: type: array type: object podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the anti-affinity expressions + specified by this field, but it may choose a node + that violates one or more of the expressions. The + node that is most preferred is the one with the greatest + sum of weights, i.e. for each node that meets all + of the scheduling requirements (resource request, + requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the + node has pods which matches the corresponding podAffinityTerm; + the node(s) with the highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1141,18 +2244,54 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of + namespaces that the term applies to. The + term is applied to the union of the namespaces + selected by this field and the ones listed + in the namespaces field. null selector and + null or empty namespaces list means "this + pod's namespace". An empty selector ({}) + matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1164,18 +2303,44 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static + list of namespace names that the term applies + to. The term is applied to the union of + the namespaces listed in this field and + the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located + (affinity) or not co-located (anti-affinity) + with the pods matching the labelSelector + in the specified namespaces, where co-located + is defined as running on a node whose value + of the label with key topologyKey matches + that of any node on which any of the selected + pods is running. Empty topologyKey is not + allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the + corresponding podAffinityTerm, in the range + 1-100. format: int32 type: integer required: @@ -1184,18 +2349,57 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the anti-affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a + pod label update), the system may or may not try to + eventually evict the pod from its node. When there + are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all + terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or + not co-located (anti-affinity) with, where co-located + is defined as running on a node whose value of the + label with key matches that of any + node on which a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1207,18 +2411,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -1230,13 +2468,35 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey @@ -1245,124 +2505,279 @@ spec: type: object type: object automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether + a service account token should be automatically mounted. type: boolean containers: + description: List of containers belonging to the pod. Containers + cannot currently be added or removed. There must be at least + one container in a Pod. Cannot be updated. items: + description: A single application container that you want + to run within a pod. properties: args: + description: 'Arguments to the entrypoint. The container + image''s CMD is used if this is not provided. Variable + references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The container image''s ENTRYPOINT is used if + this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If + a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config + management to default or override container images in + workload controllers like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should + take in response to container lifecycle events. Cannot + be updated. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1370,49 +2785,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1420,25 +2888,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -1446,37 +2932,74 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1484,62 +3007,131 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. + Not specifying a port here DOES NOT prevent that port + from being exposed. Any port which is listening on the + default "0.0.0.0" address inside a container will be + accessible from the network. Modifying this array with + strategic merge patch may corrupt the data. For more + information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -1550,37 +3142,74 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if + the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1588,47 +3217,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -1636,6 +3330,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -1644,101 +3340,270 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields + of SecurityContext override the equivalent fields of + PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has + successfully initialized. If specified, no other probes + are executed until this completes successfully. If this + probe fails, the Pod will be restarted, just as if the + livenessProbe failed. This can be used to provide different + probe parameters at the beginning of a Pod''s lifecycle, + when it might take a long time to load data or warm + a cache, than during steady-state operation. This cannot + be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1746,61 +3611,143 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -1808,19 +3755,43 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -1828,152 +3799,343 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array dnsConfig: + description: Specifies the DNS parameters of a pod. Parameters + specified here will be merged to the generated DNS configuration + based on DNSPolicy. properties: nameservers: + description: A list of DNS name server IP addresses. This + will be appended to the base nameservers generated from + DNSPolicy. Duplicated nameservers will be removed. items: type: string type: array options: + description: A list of DNS resolver options. This will be + merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options + given in Options will override those that appear in the + base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: Required. type: string value: type: string type: object type: array searches: + description: A list of DNS search domains for host-name + lookup. This will be appended to the base search paths + generated from DNSPolicy. Duplicated search paths will + be removed. items: type: string type: array type: object dnsPolicy: + description: Set DNS policy for the pod. Defaults to "ClusterFirst". + Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', + 'Default' or 'None'. DNS parameters given in DNSConfig will + be merged with the policy selected with DNSPolicy. To have + DNS options set along with hostNetwork, you have to specify + DNS policy explicitly to 'ClusterFirstWithHostNet'. type: string enableServiceLinks: + description: 'EnableServiceLinks indicates whether information + about services should be injected into pod''s environment + variables, matching the syntax of Docker links. Optional: + Defaults to true.' type: boolean ephemeralContainers: + description: List of ephemeral containers run in this pod. Ephemeral + containers may be run in an existing pod to perform user-initiated + actions such as debugging. This list cannot be specified when + creating a pod, and it cannot be modified by updating the + pod spec. In order to add an ephemeral container to an existing + pod, use the pod's ephemeralcontainers subresource. items: + description: "An EphemeralContainer is a temporary container + that you may add to an existing Pod for user-initiated activities + such as debugging. Ephemeral containers have no resource + or scheduling guarantees, and they will not be restarted + when they exit or when a Pod is removed or restarted. The + kubelet may evict a Pod if an ephemeral container causes + the Pod to exceed its resource allocation. \n To add an + ephemeral container, use the ephemeralcontainers subresource + of an existing Pod. Ephemeral containers may not be removed + or restarted." properties: args: + description: 'Arguments to the entrypoint. The image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded + using the container''s environment. If a variable cannot + be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which + allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". Escaped + references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Lifecycle is not allowed for ephemeral containers. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1981,49 +4143,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2031,25 +4246,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -2057,37 +4290,72 @@ spec: type: object type: object livenessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2095,62 +4363,124 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the ephemeral container specified + as a DNS_LABEL. This name must be unique among all containers, + init containers and ephemeral containers. type: string ports: + description: Ports are not allowed for ephemeral containers. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -2161,37 +4491,72 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2199,47 +4564,113 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: Resources are not allowed for ephemeral containers. + Ephemeral containers use spare resources already allocated + to the pod. properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -2247,6 +4678,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -2255,101 +4688,262 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'Optional: SecurityContext defines the security + options the ephemeral container should be run with. + If set, the fields of SecurityContext override the equivalent + fields of PodSecurityContext.' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2357,63 +4951,153 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean targetContainerName: + description: "If set, the name of the container from PodSpec + that this ephemeral container targets. The ephemeral + container will be run in the namespaces (IPC, PID, etc) + of this container. If not set then the ephemeral container + uses the namespaces configured in the Pod spec. \n The + container runtime must implement support for this feature. + If the runtime does not support namespace targeting + then the result of setting this field is undefined." type: string terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -2421,19 +5105,44 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Subpath mounts are not allowed for ephemeral + containers. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -2441,154 +5150,362 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array hostAliases: + description: HostAliases is an optional list of hosts and IPs + that will be injected into the pod's hosts file if specified. + This is only valid for non-hostNetwork pods. items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array ip: + description: IP address of the host file entry. type: string type: object type: array hostIPC: + description: 'Use the host''s ipc namespace. Optional: Default + to false.' type: boolean hostNetwork: + description: Host networking requested for this pod. Use the + host's network namespace. If this option is set, the ports + that will be used must be specified. Default to false. type: boolean hostPID: + description: 'Use the host''s pid namespace. Optional: Default + to false.' + type: boolean + hostUsers: + description: 'Use the host''s user namespace. Optional: Default + to true. If set to true or not present, the pod will be run + in the host user namespace, useful for when the pod needs + a feature only available to the host user namespace, such + as loading a kernel module with CAP_SYS_MODULE. When set to + false, a new userns is created for the pod. Setting false + is useful for mitigating container breakout vulnerabilities + even allowing users to run their containers as root without + actually having root privileges on the host. This field is + alpha-level and is only honored by servers that enable the + UserNamespacesSupport feature.' type: boolean hostname: + description: Specifies the hostname of the Pod If not specified, + the pod's hostname will be set to a system-defined value. type: string imagePullSecrets: + description: 'ImagePullSecrets is an optional list of references + to secrets in the same namespace to use for pulling any of + the images used by this PodSpec. If specified, these secrets + will be passed to individual puller implementations for them + to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same + namespace. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic type: array initContainers: + description: 'List of initialization containers belonging to + the pod. Init containers are executed in order prior to containers + being started. If any init container fails, the pod is considered + to have failed and is handled according to its restartPolicy. + The name for an init container or normal container must be + unique among all containers. Init containers may not have + Lifecycle actions, Readiness probes, Liveness probes, or Startup + probes. The resourceRequirements of an init container are + taken into account during scheduling by finding the highest + request/limit for each resource type, and then using the max + of of that value or the sum of the normal containers. Limits + are applied to init containers in a similar fashion. Init + containers cannot currently be added or removed. Cannot be + updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' items: + description: A single application container that you want + to run within a pod. properties: args: + description: 'Arguments to the entrypoint. The container + image''s CMD is used if this is not provided. Variable + references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The container image''s ENTRYPOINT is used if + this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If + a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config + management to default or override container images in + workload controllers like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should + take in response to container lifecycle events. Cannot + be updated. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2596,49 +5513,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2646,25 +5616,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -2672,37 +5660,74 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2710,62 +5735,131 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. + Not specifying a port here DOES NOT prevent that port + from being exposed. Any port which is listening on the + default "0.0.0.0" address inside a container will be + accessible from the network. Modifying this array with + strategic merge patch may corrupt the data. For more + information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -2776,37 +5870,74 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if + the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2814,47 +5945,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -2862,6 +6058,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -2870,101 +6068,270 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields + of SecurityContext override the equivalent fields of + PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has + successfully initialized. If specified, no other probes + are executed until this completes successfully. If this + probe fails, the Pod will be restarted, just as if the + livenessProbe failed. This can be used to provide different + probe parameters at the beginning of a Pod''s lifecycle, + when it might take a long time to load data or warm + a cache, than during steady-state operation. This cannot + be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2972,61 +6339,143 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -3034,19 +6483,43 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -3054,21 +6527,54 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array nodeName: + description: NodeName is a request to schedule this pod onto + a specific node. If it is non-empty, the scheduler simply + schedules this pod onto that node, assuming that it fits resource + requirements. type: string nodeSelector: additionalProperties: type: string + description: 'NodeSelector is a selector which must be true + for the pod to fit on a node. Selector which must match a + node''s labels for the pod to be scheduled on that node. More + info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' type: object x-kubernetes-map-type: atomic os: + description: "Specifies the OS of the containers in the pod. + Some pod and container fields are restricted if this is set. + \n If the OS field is set to linux, the following fields must + be unset: -securityContext.windowsOptions \n If the OS field + is set to windows, following fields must be unset: - spec.hostPID + - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions + - spec.securityContext.seccompProfile - spec.securityContext.fsGroup + - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls + - spec.shareProcessNamespace - spec.securityContext.runAsUser + - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups + - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile + - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem + - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation + - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser + - spec.containers[*].securityContext.runAsGroup" properties: name: + description: 'Name is the name of the operating system. + The currently supported values are linux and windows. + Additional value may be defined in future and can be one + of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration + Clients should expect to handle additional values and + treat unrecognized values in this field as os: null' type: string required: - name @@ -3080,75 +6586,282 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Overhead represents the resource overhead associated + with running a pod for a given RuntimeClass. This field will + be autopopulated at admission time by the RuntimeClass admission + controller. If the RuntimeClass admission controller is enabled, + overhead must not be set in Pod create requests. The RuntimeClass + admission controller will reject Pod create requests which + have the overhead already set. If RuntimeClass is configured + and selected in the PodSpec, Overhead will be set to the value + defined in the corresponding RuntimeClass, otherwise it will + remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' type: object preemptionPolicy: + description: PreemptionPolicy is the Policy for preempting pods + with lower priority. One of Never, PreemptLowerPriority. Defaults + to PreemptLowerPriority if unset. type: string priority: + description: The priority value. Various system components use + this field to find the priority of the pod. When Priority + Admission Controller is enabled, it prevents users from setting + this field. The admission controller populates this field + from PriorityClassName. The higher the value, the higher the + priority. format: int32 type: integer priorityClassName: + description: If specified, indicates the pod's priority. "system-node-critical" + and "system-cluster-critical" are two special keywords which + indicate the highest priorities with the former being the + highest priority. Any other name must be defined by creating + a PriorityClass object with that name. If not specified, the + pod priority will be default or zero if there is no default. type: string readinessGates: + description: 'If specified, all readiness gates will be evaluated + for pod readiness. A pod is ready when all its containers + are ready AND all conditions specified in the readiness gates + have status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' items: + description: PodReadinessGate contains the reference to a + pod condition properties: conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. type: string required: - conditionType type: object type: array + resourceClaims: + description: "ResourceClaims defines which ResourceClaims must + be allocated and reserved before the Pod is allowed to start. + The resources will be made available to those containers which + consume them by name. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. \n This + field is immutable." + items: + description: PodResourceClaim references exactly one ResourceClaim + through a ClaimSource. It adds a name to it that uniquely + identifies the ResourceClaim inside the Pod. Containers + that need access to the ResourceClaim reference it with + this name. + properties: + name: + description: Name uniquely identifies this resource claim + inside the pod. This must be a DNS_LABEL. + type: string + source: + description: Source describes where to find the ResourceClaim. + properties: + resourceClaimName: + description: ResourceClaimName is the name of a ResourceClaim + object in the same namespace as this pod. + type: string + resourceClaimTemplateName: + description: "ResourceClaimTemplateName is the name + of a ResourceClaimTemplate object in the same namespace + as this pod. \n The template will be used to create + a new ResourceClaim, which will be bound to this + pod. When this pod is deleted, the ResourceClaim + will also be deleted. The name of the ResourceClaim + will be -, where is the PodResourceClaim.Name. Pod validation + will reject the pod if the concatenated name is + not valid for a ResourceClaim (e.g. too long). \n + An existing ResourceClaim with that name that is + not owned by the pod will not be used for the pod + to avoid using an unrelated resource by mistake. + Scheduling and pod startup are then blocked until + the unrelated ResourceClaim is removed. \n This + field is immutable and no changes will be made to + the corresponding ResourceClaim by the control plane + after creating the ResourceClaim." + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map restartPolicy: + description: 'Restart policy for all containers within the pod. + One of Always, OnFailure, Never. Default to Always. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' type: string runtimeClassName: + description: 'RuntimeClassName refers to a RuntimeClass object + in the node.k8s.io group, which should be used to run this + pod. If no RuntimeClass resource matches the named class, + the pod will not be run. If unset or empty, the "legacy" RuntimeClass + will be used, which is an implicit class with an empty definition + that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' type: string schedulerName: + description: If specified, the pod will be dispatched by specified + scheduler. If not specified, the pod will be dispatched by + default scheduler. type: string + schedulingGates: + description: "SchedulingGates is an opaque list of values that + if specified will block scheduling the pod. More info: https://git.k8s.io/enhancements/keps/sig-scheduling/3521-pod-scheduling-readiness. + \n This is an alpha-level feature enabled by PodSchedulingReadiness + feature gate." + items: + description: PodSchedulingGate is associated to a Pod to guard + its scheduling. + properties: + name: + description: Name of the scheduling gate. Each scheduling + gate must have a unique name field. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map securityContext: + description: 'SecurityContext holds pod-level security attributes + and common container settings. Optional: Defaults to empty. See + type description for default values of each field.' properties: fsGroup: + description: "A special supplemental group that applies + to all containers in a pod. Some volume types allow the + Kubelet to change the ownership of that volume to be owned + by the pod: \n 1. The owning GID will be the FSGroup 2. + The setgid bit is set (new files created in the volume + will be owned by FSGroup) 3. The permission bits are OR'd + with rw-rw---- \n If unset, the Kubelet will not modify + the ownership and permissions of any volume. Note that + this field cannot be set when spec.os.name is windows." format: int64 type: integer fsGroupChangePolicy: + description: 'fsGroupChangePolicy defines behavior of changing + ownership and permission of the volume before being exposed + inside Pod. This field will only apply to volume types + which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such + as: secret, configmaps and emptydir. Valid values are + "OnRootMismatch" and "Always". If not specified, "Always" + is used. Note that this field cannot be set when spec.os.name + is windows.' type: string runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence for + that container. Note that this field cannot be set when + spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by the containers + in this pod. Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". type: string type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." type: string required: - type type: object supplementalGroups: + description: A list of groups applied to the first process + run in each container, in addition to the container's + primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container + process. If unspecified, no additional groups are added + to any container. Note that group memberships defined + in the container image for the uid of the container process + are still effective, even if they are not included in + this list. Note that this field cannot be set when spec.os.name + is windows. items: format: int64 type: integer type: array sysctls: + description: Sysctls hold a list of namespaced sysctls used + for the pod. Pods with unsupported sysctls (by the container + runtime) might fail to launch. Note that this field cannot + be set when spec.os.name is windows. items: + description: Sysctl defines a kernel parameter to be set properties: name: + description: Name of a property to set type: string value: + description: Value of a property to set type: string required: - name @@ -3156,59 +6869,172 @@ spec: type: object type: array windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options within a container's + SecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object serviceAccount: + description: 'DeprecatedServiceAccount is a depreciated alias + for ServiceAccountName. Deprecated: Use serviceAccountName + instead.' type: string serviceAccountName: + description: 'ServiceAccountName is the name of the ServiceAccount + to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' type: string setHostnameAsFQDN: + description: If true the pod's hostname will be configured as + the pod's FQDN, rather than the leaf name (the default). In + Linux containers, this means setting the FQDN in the hostname + field of the kernel (the nodename field of struct utsname). + In Windows containers, this means setting the registry value + of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters + to FQDN. If a pod does not have FQDN, this has no effect. + Default to false. type: boolean shareProcessNamespace: + description: 'Share a single process namespace between all of + the containers in a pod. When this is set containers will + be able to view and signal processes from other containers + in the same pod, and the first process in each container will + not be assigned PID 1. HostPID and ShareProcessNamespace cannot + both be set. Optional: Default to false.' type: boolean subdomain: + description: If specified, the fully qualified Pod hostname + will be "...svc.". If not specified, the pod will not have a domainname + at all. type: string terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs to terminate + gracefully. May be decreased in delete request. Value must + be non-negative integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). If this + value is nil, the default grace period will be used instead. + The grace period is the duration in seconds after the processes + running in the pod are sent a termination signal and the time + when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your + process. Defaults to 30 seconds. format: int64 type: integer tolerations: + description: If specified, the pod's tolerations. items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . properties: effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, + allowed values are NoSchedule, PreferNoSchedule and + NoExecute. type: string key: + description: Key is the taint key that the toleration + applies to. Empty means match all taint keys. If the + key is empty, operator must be Exists; this combination + means to match all values and all keys. type: string operator: + description: Operator represents a key's relationship + to the value. Valid operators are Exists and Equal. + Defaults to Equal. Exists is equivalent to wildcard + for value, so that a pod can tolerate all taints of + a particular category. type: string tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the + taint forever (do not evict). Zero and negative values + will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: TopologySpreadConstraints describes how a group + of pods ought to spread across topology domains. Scheduler + will schedule pods in a way which abides by the constraints. + All topologySpreadConstraints are ANDed. items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. properties: labelSelector: + description: LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine + the number of pods in their corresponding topology domain. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, + NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator is + Exists or DoesNotExist, the values array must + be empty. This array is replaced during a + strategic merge patch. items: type: string type: array @@ -3220,14 +7046,131 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field + is "key", the operator is "In", and the values array + contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: MatchLabelKeys is a set of pod label keys + to select the pods over which spreading will be calculated. + The keys are used to lookup values from the incoming + pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading + will be calculated for the incoming pod. Keys that don't + exist in the incoming pod labels will be ignored. A + null or empty list means only match against labelSelector. + items: + type: string + type: array + x-kubernetes-list-type: atomic maxSkew: + description: 'MaxSkew describes the degree to which pods + may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, + it is the maximum permitted difference between the number + of matching pods in the target topology and the global + minimum. The global minimum is the minimum number of + matching pods in an eligible domain or zero if the number + of eligible domains is less than MinDomains. For example, + in a 3-zone cluster, MaxSkew is set to 1, and pods with + the same labelSelector spread as 2/2/1: In this case, + the global minimum is 1. | zone1 | zone2 | zone3 | | P + P | P P | P | - if MaxSkew is 1, incoming pod + can only be scheduled to zone3 to become 2/2/2; scheduling + it onto zone1(zone2) would make the ActualSkew(3-1) + on zone1(zone2) violate MaxSkew(1). - if MaxSkew is + 2, incoming pod can be scheduled onto any zone. When + `whenUnsatisfiable=ScheduleAnyway`, it is used to give + higher precedence to topologies that satisfy it. It''s + a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer + minDomains: + description: "MinDomains indicates a minimum number of + eligible domains. When the number of eligible domains + with matching topology keys is less than minDomains, + Pod Topology Spread treats \"global minimum\" as 0, + and then the calculation of Skew is performed. And when + the number of eligible domains with matching topology + keys equals or greater than minDomains, this value has + no effect on scheduling. As a result, when the number + of eligible domains is less than minDomains, scheduler + won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains + is equal to 1. Valid values are integers greater than + 0. When value is not nil, WhenUnsatisfiable must be + DoNotSchedule. \n For example, in a 3-zone cluster, + MaxSkew is set to 2, MinDomains is set to 5 and pods + with the same labelSelector spread as 2/2/2: | zone1 + | zone2 | zone3 | | P P | P P | P P | The number + of domains is less than 5(MinDomains), so \"global minimum\" + is treated as 0. In this situation, new pod with the + same labelSelector cannot be scheduled, because computed + skew will be 3(3 - 0) if new Pod is scheduled to any + of the three zones, it will violate MaxSkew. \n This + is a beta field and requires the MinDomainsInPodTopologySpread + feature gate to be enabled (enabled by default)." + format: int32 + type: integer + nodeAffinityPolicy: + description: "NodeAffinityPolicy indicates how we will + treat Pod's nodeAffinity/nodeSelector when calculating + pod topology spread skew. Options are: - Honor: only + nodes matching nodeAffinity/nodeSelector are included + in the calculations. - Ignore: nodeAffinity/nodeSelector + are ignored. All nodes are included in the calculations. + \n If this value is nil, the behavior is equivalent + to the Honor policy. This is a beta-level feature default + enabled by the NodeInclusionPolicyInPodTopologySpread + feature flag." + type: string + nodeTaintsPolicy: + description: "NodeTaintsPolicy indicates how we will treat + node taints when calculating pod topology spread skew. + Options are: - Honor: nodes without taints, along with + tainted nodes for which the incoming pod has a toleration, + are included. - Ignore: node taints are ignored. All + nodes are included. \n If this value is nil, the behavior + is equivalent to the Ignore policy. This is a beta-level + feature default enabled by the NodeInclusionPolicyInPodTopologySpread + feature flag." + type: string topologyKey: + description: TopologyKey is the key of node labels. Nodes + that have a label with this key and identical values + are considered to be in the same topology. We consider + each as a "bucket", and try to put balanced + number of pods into each bucket. We define a domain + as a particular instance of a topology. Also, we define + an eligible domain as a domain whose nodes meet the + requirements of nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each + Node is a domain of that topology. And, if TopologyKey + is "topology.kubernetes.io/zone", each zone is a domain + of that topology. It's a required field. type: string whenUnsatisfiable: + description: 'WhenUnsatisfiable indicates how to deal + with a pod if it doesn''t satisfy the spread constraint. + - DoNotSchedule (default) tells the scheduler not to + schedule it. - ScheduleAnyway tells the scheduler to + schedule the pod in any location, but giving higher + precedence to topologies that would help reduce the + skew. A constraint is considered "Unsatisfiable" for + an incoming pod if and only if every possible node assignment + for that pod would violate "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to + 1, and pods with the same labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming + pod can only be scheduled to zone2(zone3) to become + 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be + imbalanced, but scheduler won''t make it *more* imbalanced. + It''s a required field.' type: string required: - maxSkew @@ -3240,104 +7183,240 @@ spec: - whenUnsatisfiable x-kubernetes-list-type: map volumes: + description: 'List of volumes that can be mounted by containers + belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. properties: awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk + resource that is attached to a kubelet''s host machine + and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' properties: fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default + is to mount by volume name. Examples: For volume + /dev/sda1, you specify the partition as "1". Similarly, + the volume partition for /dev/sda is "0" (or you + can leave the property empty).' format: int32 type: integer readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: boolean volumeID: + description: 'volumeID is unique ID of the persistent + disk resource in AWS (Amazon EBS volume). More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: string required: - volumeID type: object azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. properties: cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' type: string diskName: + description: diskName is the Name of the data disk + in the blob storage type: string diskURI: + description: diskURI is the URI of data disk in the + blob storage type: string fsType: + description: fsType is Filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean required: - diskName - diskURI type: object azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. properties: readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key type: string shareName: + description: shareName is the azure share Name type: string required: - secretName - shareName type: object cephfs: + description: cephFS represents a Ceph FS mount on the + host that shares a pod's lifetime properties: monitors: + description: 'monitors is Required: Monitors is a + collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' items: type: string type: array path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is + /' type: string readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: boolean secretFile: + description: 'secretFile is Optional: SecretFile is + the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string secretRef: + description: 'secretRef is Optional: SecretRef is + reference to the authentication secret for User, + default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is optional: User is the rados + user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string required: - monitors type: object cinder: + description: 'cinder represents a cinder volume attached + and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Examples: "ext4", "xfs", "ntfs". + Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string readOnly: + description: 'readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: boolean secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to + OpenStack.' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeID: + description: 'volumeID used to identify the volume + in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string required: - volumeID type: object configMap: + description: configMap represents a configMap that should + populate this volume properties: defaultMode: + description: 'defaultMode is optional: mode bits used + to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file whose + name is the key and content is the value. If specified, + the listed keys will be projected into the specified + paths, and unlisted keys will not be present. If + a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked + optional. Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used + to set permissions on this file. Must be an + octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both + octal and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the + file to map the key to. May not be an absolute + path. May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -3345,121 +7424,386 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: optional specify whether the ConfigMap + or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). properties: driver: + description: driver is the name of the CSI driver + that handles this volume. Consult with your admin + for the correct name as registered in the cluster. type: string fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the + associated CSI driver which will determine the default + filesystem to apply. type: string nodePublishSecretRef: + description: nodePublishSecretRef is a reference to + the secret object containing sensitive information + to pass to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the + secret object contains more than one secret, all + secret references are passed. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string + description: volumeAttributes stores driver-specific + properties that are passed to the CSI driver. Consult + your driver's documentation for supported values. type: object required: - driver type: object downwardAPI: + description: downwardAPI represents downward API about + the pod that should populate this volume properties: defaultMode: + description: 'Optional: mode bits to use on created + files by default. Must be a Optional: mode bits + used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: Items is a list of downward API volume + file items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field properties: fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used to set + permissions on this file, must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal + and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the relative + path name of the file to be created. Must + not be absolute or contain the ''..'' path. + Must be utf-8 encoded. The first item of the + relative path must not start with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object emptyDir: + description: 'emptyDir represents a temporary directory + that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' properties: medium: + description: 'medium represents what type of storage + medium should back this directory. The default is + "" which means to use the node''s default medium. + Must be an empty string (default) or Memory. More + info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' type: string sizeLimit: anyOf: - type: integer - type: string + description: 'sizeLimit is the total amount of local + storage required for this EmptyDir volume. The size + limit is also applicable for memory medium. The + maximum usage on memory medium EmptyDir would be + the minimum value between the SizeLimit specified + here and the sum of memory limits of all containers + in a pod. The default is nil which means that the + limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle + is tied to the pod that defines it - it will be created + before the pod starts, and deleted when the pod is removed. + \n Use this if: a) the volume is only needed while the + pod runs, b) features of normal volumes like restoring + from snapshot or capacity tracking are needed, c) the + storage driver is specified through a storage class, + and d) the storage driver supports dynamic volume provisioning + through a PersistentVolumeClaim (see EphemeralVolumeSource + for more information on the connection between this + volume type and PersistentVolumeClaim). \n Use PersistentVolumeClaim + or one of the vendor-specific APIs for volumes that + persist for longer than the lifecycle of an individual + pod. \n Use CSI for light-weight local ephemeral volumes + if the CSI driver is meant to be used that way - see + the documentation of the driver for more information. + \n A pod can use both types of ephemeral volumes and + persistent volumes at the same time." properties: volumeClaimTemplate: + description: "Will be used to create a stand-alone + PVC to provision the volume. The pod in which this + EphemeralVolumeSource is embedded will be the owner + of the PVC, i.e. the PVC will be deleted together + with the pod. The name of the PVC will be `-` where `` is the + name from the `PodSpec.Volumes` array entry. Pod + validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). + \n An existing PVC with that name that is not owned + by the pod will *not* be used for the pod to avoid + using an unrelated volume by mistake. Starting the + pod is then blocked until the unrelated PVC is removed. + If such a pre-created PVC is meant to be used by + the pod, the PVC has to updated with an owner reference + to the pod once the pod exists. Normally this should + not be necessary, but it may be useful when manually + reconstructing a broken cluster. \n This field is + read-only and no changes will be made by Kubernetes + to the PVC after it has been created. \n Required, + must not be nil." properties: metadata: + description: May contain labels and annotations + that will be copied into the PVC when creating + it. No other fields are allowed and will be + rejected during validation. type: object spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into + the PVC that gets created from this template. + The same fields as in a PersistentVolumeClaim + are also valid here. properties: accessModes: + description: 'accessModes contains the desired + access modes the volume should have. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' items: type: string type: array dataSource: + description: 'dataSource field can be used + to specify either: * An existing VolumeSnapshot + object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller + can support the specified data source, it + will create a new volume based on the contents + of the specified data source. When the AnyVolumeDataSource + feature gate is enabled, dataSource contents + will be copied to dataSourceRef, and dataSourceRef + contents will be copied to dataSource when + dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef + will not be copied to dataSource.' properties: apiGroup: + description: APIGroup is the group for + the resource being referenced. If APIGroup + is not specified, the specified Kind + must be in the core API group. For any + other third-party types, APIGroup is + required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced type: string required: - kind - name type: object + x-kubernetes-map-type: atomic dataSourceRef: + description: 'dataSourceRef specifies the + object from which to populate the volume + with data, if a non-empty volume is desired. + This may be any object from a non-empty + API group (non core object) or a PersistentVolumeClaim + object. When this field is specified, volume + binding will only succeed if the type of + the specified object matches some installed + volume populator or dynamic provisioner. + This field will replace the functionality + of the dataSource field and as such if both + fields are non-empty, they must have the + same value. For backwards compatibility, + when namespace isn''t specified in dataSourceRef, + both fields (dataSource and dataSourceRef) + will be set to the same value automatically + if one of them is empty and the other is + non-empty. When namespace is specified in + dataSourceRef, dataSource isn''t set to + the same value and must be empty. There + are three important differences between + dataSource and dataSourceRef: * While dataSource + only allows two specific types of objects, + dataSourceRef allows any non-core object, + as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values + (dropping them), dataSourceRef preserves + all values, and generates an error if a + disallowed value is specified. * While dataSource + only allows local objects, dataSourceRef + allows objects in any namespaces. (Beta) + Using this field requires the AnyVolumeDataSource + feature gate to be enabled. (Alpha) Using + the namespace field of dataSourceRef requires + the CrossNamespaceVolumeDataSource feature + gate to be enabled.' properties: apiGroup: + description: APIGroup is the group for + the resource being referenced. If APIGroup + is not specified, the specified Kind + must be in the core API group. For any + other third-party types, APIGroup is + required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: Namespace is the namespace + of resource being referenced Note that + when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferenceGrant + documentation for details. (Alpha) This + field requires the CrossNamespaceVolumeDataSource + feature gate to be enabled. type: string required: - kind - name type: object resources: + description: 'resources represents the minimum + resources the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to + specify resource requirements that are lower + than previous value but must still be higher + than capacity recorded in the status field + of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' properties: + claims: + description: "Claims lists the names of + resources, defined in spec.resourceClaims, + that are used by this container. \n + This is an alpha field and requires + enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references + one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the + name of one entry in pod.spec.resourceClaims + of the Pod where this field is + used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -3467,6 +7811,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum + amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -3475,18 +7822,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. + If Requests is omitted for a container, + it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object selector: + description: selector is a label query over + volumes to consider for binding. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -3498,13 +7874,29 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic storageClassName: + description: 'storageClassName is the name + of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' type: string volumeMode: + description: volumeMode defines what type + of volume is required by the claim. Value + of Filesystem is implied when not included + in claim spec. type: string volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. type: string type: object required: @@ -3512,125 +7904,275 @@ spec: type: object type: object fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. TODO: how + do we prevent errors in the filesystem from compromising + the machine' type: string lun: + description: 'lun is Optional: FC target lun number' format: int32 type: integer readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' items: type: string type: array wwids: + description: 'wwids Optional: FC volume world wide + identifiers (wwids) Either wwids or combination + of targetWWNs and lun must be set, but not both + simultaneously.' items: type: string type: array type: object flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. properties: driver: + description: driver is the name of the driver to use + for this volume. type: string fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". The + default filesystem depends on FlexVolume script. type: string options: additionalProperties: type: string + description: 'options is Optional: this field holds + extra command options if any.' type: object readOnly: + description: 'readOnly is Optional: defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean secretRef: + description: 'secretRef is Optional: secretRef is + reference to the secret object containing sensitive + information to pass to the plugin scripts. This + may be empty if no secret object is specified. If + the secret object contains more than one secret, + all secrets are passed to the plugin scripts.' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic required: - driver type: object flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running properties: datasetName: + description: datasetName is Name of the dataset stored + as metadata -> name on the dataset for Flocker should + be considered as deprecated type: string datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset type: string type: object gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk + resource that is attached to a kubelet''s host machine + and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' properties: fsType: + description: 'fsType is filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default + is to mount by volume name. Examples: For volume + /dev/sda1, you specify the partition as "1". Similarly, + the volume partition for /dev/sda is "0" (or you + can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' format: int32 type: integer pdName: + description: 'pdName is unique name of the PD resource + in GCE. Used to identify the disk in GCE. More info: + https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: string readOnly: + description: 'readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. More + info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: boolean required: - pdName type: object gitRepo: + description: 'gitRepo represents a git repository at a + particular revision. DEPRECATED: GitRepo is deprecated. + To provision a container with a git repo, mount an EmptyDir + into an InitContainer that clones the repo using git, + then mount the EmptyDir into the Pod''s container.' properties: directory: + description: directory is the target directory name. + Must not contain or start with '..'. If '.' is + supplied, the volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. type: string repository: + description: repository is the URL type: string revision: + description: revision is the commit hash for the specified + revision. type: string required: - repository type: object glusterfs: + description: 'glusterfs represents a Glusterfs mount on + the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' properties: endpoints: + description: 'endpoints is the endpoint name that + details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string path: + description: 'path is the Glusterfs volume path. More + info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string readOnly: + description: 'readOnly here will force the Glusterfs + volume to be mounted with read-only permissions. + Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: boolean required: - endpoints - path type: object hostPath: + description: 'hostPath represents a pre-existing file + or directory on the host machine that is directly exposed + to the container. This is generally used for system + agents or other privileged things that are allowed to + see the host machine. Most containers will NOT need + this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host + directory mounts and who can/can not mount host directories + as read/write.' properties: path: + description: 'path of the directory on the host. If + the path is a symlink, it will follow the link to + the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string type: + description: 'type for HostPath Volume Defaults to + "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string required: - path type: object iscsi: + description: 'iscsi represents an ISCSI Disk resource + that is attached to a kubelet''s host machine and then + exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' properties: chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication type: boolean chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication type: boolean fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. type: string iqn: + description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: + description: iscsiInterface is the interface Name + that uses an iSCSI transport. Defaults to 'default' + (tcp). type: string lun: + description: lun represents iSCSI Target Lun number. format: int32 type: integer portals: + description: portals is the iSCSI Target Portal List. + The portal is either an IP or ip_addr:port if the + port is other than default (typically TCP ports + 860 and 3260). items: type: string type: array readOnly: + description: readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. type: boolean secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic targetPortal: + description: targetPortal is iSCSI Target Portal. + The Portal is either an IP or ip_addr:port if the + port is other than default (typically TCP ports + 860 and 3260). type: string required: - iqn @@ -3638,67 +8180,157 @@ spec: - targetPortal type: object name: + description: 'name of the volume. Must be a DNS_LABEL + and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string nfs: + description: 'nfs represents an NFS mount on the host + that shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' properties: path: + description: 'path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string readOnly: + description: 'readOnly here will force the NFS export + to be mounted with read-only permissions. Defaults + to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: boolean server: + description: 'server is the hostname or IP address + of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string required: - path - server type: object persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents + a reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' properties: claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' type: string readOnly: + description: readOnly Will force the ReadOnly setting + in VolumeMounts. Default false. type: boolean required: - claimName type: object photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. type: string pdID: + description: pdID is the ID that identifies Photon + Controller persistent disk type: string required: - pdID type: object portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine properties: fsType: + description: fSType represents the filesystem type + to mount Must be a filesystem type supported by + the host operating system. Ex. "ext4", "xfs". Implicitly + inferred to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean volumeID: + description: volumeID uniquely identifies a Portworx + volume type: string required: - volumeID type: object projected: + description: projected items for all in one resources + secrets, configmaps, and downward API properties: defaultMode: + description: defaultMode are the mode bits used to + set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal + and decimal values, JSON requires decimal values + for mode bits. Directories within the path are not + affected by this setting. This might be in conflict + with other options that affect the file mode, like + fsGroup, and the result can be other mode bits set. format: int32 type: integer sources: + description: sources is the list of volume projections items: + description: Projection that may be projected along + with other supported volume types properties: configMap: + description: configMap information about the + configMap data to project properties: items: + description: items if unspecified, each + key-value pair in the Data field of the + referenced ConfigMap will be projected + into the volume as a file whose name is + the key and content is the value. If specified, + the listed keys will be projected into + the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the ConfigMap, + the volume setup will error unless it + is marked optional. Paths must be relative + and may not contain the '..' path or start + with '..'. items: + description: Maps a string key to a path + within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode + bits used to set permissions on + this file. Must be an octal value + between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative + path of the file to map the key + to. May not be an absolute path. + May not contain the path element + '..'. May not start with the string + '..'. type: string required: - key @@ -3706,60 +8338,155 @@ spec: type: object type: array name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional specify whether the + ConfigMap or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic downwardAPI: + description: downwardAPI information about the + downwardAPI data to project properties: items: + description: Items is a list of DownwardAPIVolume + file items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field properties: fieldRef: + description: 'Required: Selects a + field of the pod: only annotations, + labels, name and namespace are supported.' properties: apiVersion: + description: Version of the schema + the FieldPath is written in + terms of, defaults to "v1". type: string fieldPath: + description: Path of the field + to select in the specified API + version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits + used to set permissions on this + file, must be an octal value between + 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute + or contain the ''..'' path. Must + be utf-8 encoded. The first item + of the relative path must not start + with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of + the container: only resources limits + and requests (limits.cpu, limits.memory, + requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: + required for volumes, optional + for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource + to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object secret: + description: secret information about the secret + data to project properties: items: + description: items if unspecified, each + key-value pair in the Data field of the + referenced Secret will be projected into + the volume as a file whose name is the + key and content is the value. If specified, + the listed keys will be projected into + the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the Secret, the + volume setup will error unless it is marked + optional. Paths must be relative and may + not contain the '..' path or start with + '..'. items: + description: Maps a string key to a path + within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode + bits used to set permissions on + this file. Must be an octal value + between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative + path of the file to map the key + to. May not be an absolute path. + May not contain the path element + '..'. May not start with the string + '..'. type: string required: - key @@ -3767,18 +8494,46 @@ spec: type: object type: array name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional field specify whether + the Secret or its key must be defined type: boolean type: object + x-kubernetes-map-type: atomic serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project properties: audience: + description: audience is the intended audience + of the token. A recipient of a token must + identify itself with an identifier specified + in the audience of the token, and otherwise + should reject the token. The audience + defaults to the identifier of the apiserver. type: string expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, + the kubelet volume plugin will proactively + rotate the service account token. The + kubelet will start trying to rotate the + token if the token is older than 80 percent + of its time to live or if the token is + older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. format: int64 type: integer path: + description: path is the path relative to + the mount point of the file to project + the token into. type: string required: - path @@ -3787,74 +8542,159 @@ spec: type: array type: object quobyte: + description: quobyte represents a Quobyte mount on the + host that shares a pod's lifetime properties: group: + description: group to map volume access to Default + is no group type: string readOnly: + description: readOnly here will force the Quobyte + volume to be mounted with read-only permissions. + Defaults to false. type: boolean registry: + description: registry represents a single or multiple + Quobyte Registry services specified as a string + as host:port pair (multiple entries are separated + with commas) which acts as the central registry + for volumes type: string tenant: + description: tenant owning the given Quobyte volume + in the Backend Used with dynamically provisioned + Quobyte volumes, value is set by the plugin type: string user: + description: user to map volume access to Defaults + to serivceaccount user type: string volume: + description: volume is a string that references an + already created Quobyte volume by name. type: string required: - registry - volume type: object rbd: + description: 'rbd represents a Rados Block Device mount + on the host that shares a pod''s lifetime. More info: + https://examples.k8s.io/volumes/rbd/README.md' properties: fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string image: + description: 'image is the rados image name. More + info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string keyring: + description: 'keyring is the path to key ring for + RBDUser. Default is /etc/ceph/keyring. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' items: type: string type: array pool: + description: 'pool is the rados pool name. Default + is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string readOnly: + description: 'readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. More + info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: boolean secretRef: + description: 'secretRef is name of the authentication + secret for RBDUser. If provided overrides keyring. + Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is the rados user name. Default + is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string required: - image - monitors type: object scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Default + is "xfs". type: string gateway: + description: gateway is the host address of the ScaleIO + API Gateway. type: string protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretRef: + description: secretRef references to the secret for + ScaleIO user and other sensitive information. If + this is not provided, Login operation will fail. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false type: boolean storageMode: + description: storageMode indicates whether the storage + for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. type: string storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. type: string system: + description: system is the name of the storage system + as configured in ScaleIO. type: string volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated + with this volume source. type: string required: - gateway @@ -3862,19 +8702,58 @@ spec: - system type: object secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' properties: defaultMode: + description: 'defaultMode is Optional: mode bits used + to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: items If unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file whose + name is the key and content is the value. If specified, + the listed keys will be projected into the specified + paths, and unlisted keys will not be present. If + a key is specified which is not present in the Secret, + the volume setup will error unless it is marked + optional. Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used + to set permissions on this file. Must be an + octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both + octal and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the + file to map the key to. May not be an absolute + path. May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -3882,35 +8761,81 @@ spec: type: object type: array optional: + description: optional field specify whether the Secret + or its keys must be defined type: boolean secretName: + description: 'secretName is the name of the secret + in the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' type: string type: object storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretRef: + description: secretRef specifies the secret to use + for obtaining the StorageOS API credentials. If + not specified, default values will be attempted. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeName: + description: volumeName is the human-readable name + of the StorageOS volume. Volume names are only + unique within a namespace. type: string volumeNamespace: + description: volumeNamespace specifies the scope of + the volume within StorageOS. If no namespace is + specified then the Pod's namespace will be used. This + allows the Kubernetes name scoping to be mirrored + within StorageOS for tighter integration. Set VolumeName + to any name to override the default behaviour. Set + to "default" if you are not using namespaces within + StorageOS. Namespaces that do not pre-exist within + StorageOS will be created. type: string type: object vsphereVolume: + description: vsphereVolume represents a vSphere volume + attached and mounted on kubelets host machine properties: fsType: + description: fsType is filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string storagePolicyID: + description: storagePolicyID is the storage Policy + Based Management (SPBM) profile ID associated with + the StoragePolicyName. type: string storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. type: string volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk type: string required: - volumePath @@ -3923,35 +8848,51 @@ spec: - containers type: object timeout: + description: Timeout defines the maximum amount of time the Serving + should take to execute before the Serving is running. type: string triggers: + description: Triggers are used to specify the trigger sources of + the function. The Keda (ScaledObject, ScaledJob) configuration + in ScaleOptions cannot take effect without Triggers being set. items: properties: authenticationRef: + description: ScaledObjectAuthRef points to the TriggerAuthentication + or ClusterTriggerAuthentication object that is used to authenticate + the scaler with the environment properties: kind: + description: Kind of the resource being referred to. Defaults + to TriggerAuthentication. type: string name: type: string required: - name type: object - fallback: - format: int32 - type: integer metadata: additionalProperties: type: string type: object + metricType: + description: MetricTargetType specifies the type of metric + being targeted, and should be either "Value", "AverageValue", + or "Utilization" + type: string name: type: string targetKind: + description: ScaleTargetKind represents the kind of trigger + target. enum: - object - job type: string type: type: string + useCachedMetrics: + type: boolean required: - metadata - type @@ -3961,21 +8902,29 @@ spec: - runtime type: object version: + description: Function version in format like v1.0.0 type: string workloadRuntime: default: OCIContainer + description: 'WorkloadRuntime for Function. Know values: ``` OCIContainer: + Nodes will run standard OCI container workloads. WasmEdge: Nodes will + run workloads using the crun (with WasmEdge support). ```' type: string required: - image type: object status: + description: FunctionStatus defines the observed state of Function properties: addresses: + description: Addresses holds the addresses that used to access the Function. items: properties: type: + description: Type of the address. type: string value: + description: Value of the address. maxLength: 253 minLength: 1 type: string @@ -4005,30 +8954,67 @@ spec: route: properties: conditions: + description: Conditions describes the status of the route with respect + to the Gateway. Note that the route's availability is also subject + to the Gateway's own status conditions and listener status. items: + description: "Condition contains details for one aspect of the + current state of this API Resource. --- This struct is intended + for direct use as an array at the field path .status.conditions. + \ For example, \n type FooStatus struct{ // Represents the observations + of a foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + // +patchStrategy=merge // +listType=map // +listMapKey=type + Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be + when the underlying condition changed. If that is not known, + then using the time when the API field changed is acceptable. format: date-time type: string message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if + .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. format: int64 minimum: 0 type: integer reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: + description: status of the condition, one of True, False, + Unknown. enum: - "True" - "False" - Unknown type: string type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict + is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string @@ -4046,7 +9032,20 @@ spec: - type x-kubernetes-list-type: map hosts: + description: Hosts list all actual hostnames of HTTPRoute. items: + description: "Hostname is the fully qualified domain name of a + network host. This matches the RFC 1123 definition of a hostname + with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname + may be prefixed with a wildcard label (`*.`). The wildcard label + must appear by itself as the first label. \n Hostname can be + \"precise\" which is a domain name without the terminating dot + of a network host (e.g. \"foo.example.com\") or \"wildcard\", + which is a domain name prefixed with a single wildcard label + (e.g. `*.example.com`). \n Note that as per RFC1035 and RFC1123, + a *label* must consist of lower case alphanumeric characters + or '-', and must start and end with an alphanumeric character. + No other punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ @@ -4054,10 +9053,16 @@ spec: maxItems: 16 type: array paths: + description: Paths list all actual paths of HTTPRoute. items: + description: HTTPPathMatch describes how to select a HTTP route + by matching the HTTP request path. properties: type: default: PathPrefix + description: "Type specifies how to match against the path + Value. \n Support: Core (Exact, PathPrefix) \n Support: + Custom (RegularExpression)" enum: - Exact - PathPrefix @@ -4065,6 +9070,7 @@ spec: type: string value: default: / + description: Value of the HTTP path to match against. maxLength: 1024 type: string type: object @@ -4085,23 +9091,39 @@ spec: type: string type: object sources: + description: Sources holds the results emitted from the step definition + of different sources items: + description: SourceResult holds the results emitted from the different + sources properties: bundle: + description: Bundle holds the results emitted from from the step + definition of bundle source properties: digest: + description: Digest hold the image digest result type: string type: object git: + description: Git holds the results emitted from from the step + definition of a git source properties: branchName: + description: BranchName holds the default branch name of the + git source this will be set only when revision is not specified + in Build object type: string commitAuthor: + description: CommitAuthor holds the commit author of a git + source type: string commitSha: + description: CommitSha holds the commit sha of git source type: string type: object name: + description: Name is the name of source type: string required: - name @@ -4135,96 +9157,162 @@ spec: name: v1beta2 schema: openAPIV3Schema: + description: Function is the Schema for the functions API properties: apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: + description: FunctionSpec defines the desired state of Function properties: build: + description: Information needed to build a function. The build step + will be skipped if Build is nil. properties: builder: + description: Builder refers to the image containing the build tools + to build the source code. type: string builderCredentials: + description: BuilderCredentials references a Secret that contains + credentials to access the builder image repository. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic builderMaxAge: + description: The duration to retain a completed builder, defaults + to 0 (forever). type: string dockerfile: + description: Dockerfile is the path to the Dockerfile used by build + strategies that rely on the Dockerfile to build an image. type: string env: additionalProperties: type: string + description: Environment variables to pass to the builder. type: object failedBuildsHistoryLimit: + description: The number of failed builds to retain, default is 1. format: int32 type: integer shipwright: + description: The configuration for the `Shipwright` build engine. properties: params: + description: 'Params is a list of key/value that could be used + to set strategy parameters. When using _params_, users should + avoid: Defining a parameter name that doesn''t match one of + the `spec.parameters` defined in the `BuildStrategy`. Defining + a parameter name that collides with the Shipwright reserved + parameters including BUILDER_IMAGE,DOCKERFILE,CONTEXT_DIR + and any name starting with shp-.' items: + description: ParamValue is a key/value that populates a strategy + parameter used in the execution of the strategy steps properties: configMapValue: + description: The ConfigMap value of the parameter properties: format: + description: An optional format to add pre- or suffix + to the object value. For example 'KEY=${SECRET_VALUE}' + or 'KEY=${CONFIGMAP_VALUE}' depending on the context. type: string key: + description: Key inside the object type: string name: + description: Name of the object type: string required: - key - name type: object name: + description: Name of the parameter type: string secretValue: + description: The secret value of the parameter properties: format: + description: An optional format to add pre- or suffix + to the object value. For example 'KEY=${SECRET_VALUE}' + or 'KEY=${CONFIGMAP_VALUE}' depending on the context. type: string key: + description: Key inside the object type: string name: + description: Name of the object type: string required: - key - name type: object value: + description: The value of the parameter type: string values: + description: Values of an array parameter items: + description: SingleValue is the value type contains + the properties for a value, this allows for an easy + extension in the future to support more kinds properties: configMapValue: + description: The ConfigMap value of the parameter properties: format: + description: An optional format to add pre- + or suffix to the object value. For example + 'KEY=${SECRET_VALUE}' or 'KEY=${CONFIGMAP_VALUE}' + depending on the context. type: string key: + description: Key inside the object type: string name: + description: Name of the object type: string required: - key - name type: object secretValue: + description: The secret value of the parameter properties: format: + description: An optional format to add pre- + or suffix to the object value. For example + 'KEY=${SECRET_VALUE}' or 'KEY=${CONFIGMAP_VALUE}' + depending on the context. type: string key: + description: Key inside the object type: string name: + description: Name of the object type: string required: - key - name type: object value: + description: The value of the parameter type: string type: object type: array @@ -4233,62 +9321,97 @@ spec: type: object type: array strategy: + description: Strategy references the BuildStrategy to use to + build the image. properties: kind: + description: BuildStrategyKind indicates the kind of the + build strategy BuildStrategy or ClusterBuildStrategy, + default to BuildStrategy. type: string name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' type: string required: - name type: object timeout: + description: Timeout defines the maximum amount of time the + Build should take to execute. format: duration type: string type: object srcRepo: + description: Function Source code repository properties: bundleContainer: + description: BundleContainer properties: image: + description: Image reference, i.e. quay.io/org/image:tag type: string required: - image type: object credentials: + description: Credentials references a Secret that contains credentials + to access the repository. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic revision: + description: Git revision to check out (branch, tag, sha, ref…) + (default:"") type: string sourceSubPath: + description: A subpath within the `source` input where the source + to build is located. type: string url: + description: Git url to clone type: string type: object successfulBuildsHistoryLimit: + description: The number of successful builds to retain, default + is 0. format: int32 type: integer timeout: + description: Timeout defines the maximum amount of time the Build + should take to execute. type: string required: - srcRepo type: object image: + description: Function image name type: string imageCredentials: + description: ImageCredentials references a Secret that contains credentials + to access the image repository. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic serving: + description: Information needed to run a function. The serving step + will be skipped if `Serving` is nil. properties: annotations: additionalProperties: type: string + description: Annotations that will be added to the workload. type: object bindings: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -4296,10 +9419,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -4310,7 +9437,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -4325,8 +9453,11 @@ spec: - type - version type: object + description: Configurations of dapr bindings components. type: object hooks: + description: Hooks define the hooks that will execute before or + after function execution. properties: policy: type: string @@ -4342,8 +9473,12 @@ spec: labels: additionalProperties: type: string + description: Parameters of asyncFunc runtime, must not be nil when + runtime is OpenFuncAsync. type: object outputs: + description: Function outputs from Dapr components including binding, + pubsub items: properties: dapr: @@ -4351,16 +9486,26 @@ spec: metadata: additionalProperties: type: string + description: Metadata is the metadata for dapr Com. type: object name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string operation: + description: Operation field tells the Dapr component + which operation it should perform. type: string outputName: + description: 'Deprecated: Only for compatibility with + v1beta1' type: string topic: type: string type: + description: Type is the type of the component, if it + is not set, controller will get it automatically. type: string required: - name @@ -4370,9 +9515,13 @@ spec: params: additionalProperties: type: string + description: Parameters to pass to the serving. All parameters will + be injected into the pod as environment variables. Function code + can use these parameters by getting environment variables type: object pubsub: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -4380,10 +9529,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -4394,7 +9547,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -4409,11 +9563,25 @@ spec: - type - version type: object + description: Configurations of dapr pubsub components. type: object scaleOptions: + description: The ScaleOptions will help us to set up guidelines + for the autoscaling of function workloads. properties: keda: properties: + httpScaledObject: + properties: + cooldownPeriod: + description: Cooldown period value + format: int32 + type: integer + targetPendingRequests: + description: Target metric value + format: int32 + type: integer + type: object scaledJob: properties: failedJobsHistoryLimit: @@ -4423,14 +9591,20 @@ spec: format: int32 type: integer restartPolicy: + description: Restart policy for all containers within + the pod. One of 'OnFailure', 'Never'. Default to 'Never'. type: string scalingStrategy: + description: ScalingStrategy defines the strategy of + Scaling properties: customScalingQueueLengthDeduction: format: int32 type: integer customScalingRunningJobPercentage: type: string + multipleScalersCalculation: + type: string pendingPodConditions: items: type: string @@ -4445,22 +9619,56 @@ spec: scaledObject: properties: advanced: + description: AdvancedConfig specifies advance scaling + options properties: horizontalPodAutoscalerConfig: + description: HorizontalPodAutoscalerConfig specifies + horizontal scale config properties: behavior: + description: HorizontalPodAutoscalerBehavior + configures the scaling behavior of the target + in both Up and Down directions (scaleUp and + scaleDown fields respectively). properties: scaleDown: + description: scaleDown is scaling policy + for scaling Down. If not set, the default + value is to allow to scale down to minReplicas + pods, with a 300 second stabilization + window (i.e., the highest recommendation + for the last 300sec is used). properties: policies: + description: policies is a list of potential + scaling polices which can be used + during scaling. At least one policy + must be specified, otherwise the HPAScalingRules + will be discarded as invalid items: + description: HPAScalingPolicy is a + single policy which must hold true + for a specified past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which + the policy should hold true. + PeriodSeconds must be greater + than zero and less than or equal + to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the + amount of change which is permitted + by the policy. It must be greater + than zero format: int32 type: integer required: @@ -4469,23 +9677,66 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to + specify which policy should be used. + If not set, the default value Max + is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which + past recommendations should be considered + while scaling up or scaling down. + StabilizationWindowSeconds must be + greater than or equal to zero and + less than or equal to 3600 (one hour). + If not set, use the default values: + - For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object scaleUp: + description: 'scaleUp is scaling policy + for scaling Up. If not set, the default + value is the higher of: * increase no + more than 4 pods per 60 seconds * double + the number of pods per 60 seconds No stabilization + is used.' properties: policies: + description: policies is a list of potential + scaling polices which can be used + during scaling. At least one policy + must be specified, otherwise the HPAScalingRules + will be discarded as invalid items: + description: HPAScalingPolicy is a + single policy which must hold true + for a specified past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which + the policy should hold true. + PeriodSeconds must be greater + than zero and less than or equal + to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the + amount of change which is permitted + by the policy. It must be greater + than zero format: int32 type: integer required: @@ -4494,13 +9745,32 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to + specify which policy should be used. + If not set, the default value Max + is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which + past recommendations should be considered + while scaling up or scaling down. + StabilizationWindowSeconds must be + greater than or equal to zero and + less than or equal to 3600 (one hour). + If not set, use the default values: + - For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object type: object + name: + type: string type: object restoreToOriginalReplicaCount: type: boolean @@ -4508,33 +9778,61 @@ spec: cooldownPeriod: format: int32 type: integer + fallback: + description: Fallback is the spec for fallback options + properties: + failureThreshold: + format: int32 + type: integer + replicas: + format: int32 + type: integer + required: + - failureThreshold + - replicas + type: object pollingInterval: format: int32 type: integer type: object triggers: + description: Triggers are used to specify the trigger sources + of the function. The Keda (ScaledObject, ScaledJob) configuration + in ScaleOptions cannot take effect without Triggers being + set. items: + description: ScaleTriggers reference the scaler that will + be used properties: authenticationRef: + description: ScaledObjectAuthRef points to the TriggerAuthentication + or ClusterTriggerAuthentication object that is used + to authenticate the scaler with the environment properties: kind: + description: Kind of the resource being referred + to. Defaults to TriggerAuthentication. type: string name: type: string required: - name type: object - fallback: - format: int32 - type: integer metadata: additionalProperties: type: string type: object + metricType: + description: MetricTargetType specifies the type of + metric being targeted, and should be either "Value", + "AverageValue", or "Utilization" + type: string name: type: string type: type: string + useCachedMetrics: + type: boolean required: - metadata - type @@ -4544,6 +9842,8 @@ spec: knative: additionalProperties: type: string + description: Refer to https://knative.dev/docs/serving/autoscaling/ + to learn more about the autoscaling options of Knative Serving. type: object maxReplicas: format: int32 @@ -4556,6 +9856,7 @@ spec: additionalProperties: properties: spec: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -4563,10 +9864,16 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a + metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name + is the secret name, and key is the field in the + secret. properties: key: type: string @@ -4577,7 +9884,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -4593,29 +9901,81 @@ spec: - version type: object type: object + description: Configurations of dapr state components. It can refer + to an existing state when the `state.spec` is nil. type: object template: + description: Template describes the pods that will be created. The + container named `function` is the container which is used to run + the image built by the builder. If it is not set, the controller + will automatically add one. properties: activeDeadlineSeconds: + description: Optional duration in seconds the pod may be active + on the node relative to StartTime before the system will actively + try to mark it failed and kill associated containers. Value + must be a positive integer. format: int64 type: integer affinity: + description: If specified, the pod's scheduling constraints properties: nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling + requirements (resource request, requiredDuringScheduling + affinity expressions, etc.), compute a sum by iterating + through the elements of this field and adding "weight" + to the sum if the node matches the corresponding matchExpressions; + the node(s) with the highest sum are the most preferred. items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a + no-op). A null preferred scheduling term matches + no objects (i.e. is also a no-op). properties: preference: + description: A node selector term, associated + with the corresponding weight. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4625,13 +9985,35 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4641,7 +10023,11 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range + 1-100. format: int32 type: integer required: @@ -4650,18 +10036,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an + update), the system may or may not try to eventually + evict the pod from its node. properties: nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. items: + description: A null or empty node selector term + matches no objects. The requirements of them + are ANDed. The TopologySelectorTerm type implements + a subset of the NodeSelectorTerm. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4671,13 +10092,35 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: The label key that the + selector applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators + are In, NotIn, Exists, DoesNotExist. + Gt, and Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the + values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. If + the operator is Gt or Lt, the values + array must have a single element, + which will be interpreted as an integer. + This array is replaced during a strategic + merge patch. items: type: string type: array @@ -4687,28 +10130,73 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic type: array required: - nodeSelectorTerms type: object + x-kubernetes-map-type: atomic type: object podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling + requirements (resource request, requiredDuringScheduling + affinity expressions, etc.), compute a sum by iterating + through the elements of this field and adding "weight" + to the sum if the node has pods which matches the + corresponding podAffinityTerm; the node(s) with the + highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4720,18 +10208,54 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of + namespaces that the term applies to. The + term is applied to the union of the namespaces + selected by this field and the ones listed + in the namespaces field. null selector and + null or empty namespaces list means "this + pod's namespace". An empty selector ({}) + matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4743,18 +10267,44 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static + list of namespace names that the term applies + to. The term is applied to the union of + the namespaces listed in this field and + the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located + (affinity) or not co-located (anti-affinity) + with the pods matching the labelSelector + in the specified namespaces, where co-located + is defined as running on a node whose value + of the label with key topologyKey matches + that of any node on which any of the selected + pods is running. Empty topologyKey is not + allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the + corresponding podAffinityTerm, in the range + 1-100. format: int32 type: integer required: @@ -4763,18 +10313,57 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a + pod label update), the system may or may not try to + eventually evict the pod from its node. When there + are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all + terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or + not co-located (anti-affinity) with, where co-located + is defined as running on a node whose value of the + label with key matches that of any + node on which a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4786,18 +10375,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4809,13 +10432,35 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey @@ -4823,22 +10468,65 @@ spec: type: array type: object podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the anti-affinity expressions + specified by this field, but it may choose a node + that violates one or more of the expressions. The + node that is most preferred is the one with the greatest + sum of weights, i.e. for each node that meets all + of the scheduling requirements (resource request, + requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the + node has pods which matches the corresponding podAffinityTerm; + the node(s) with the highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4850,18 +10538,54 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of + namespaces that the term applies to. The + term is applied to the union of the namespaces + selected by this field and the ones listed + in the namespaces field. null selector and + null or empty namespaces list means "this + pod's namespace". An empty selector ({}) + matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4873,18 +10597,44 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static + list of namespace names that the term applies + to. The term is applied to the union of + the namespaces listed in this field and + the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located + (affinity) or not co-located (anti-affinity) + with the pods matching the labelSelector + in the specified namespaces, where co-located + is defined as running on a node whose value + of the label with key topologyKey matches + that of any node on which any of the selected + pods is running. Empty topologyKey is not + allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the + corresponding podAffinityTerm, in the range + 1-100. format: int32 type: integer required: @@ -4893,18 +10643,57 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified + by this field are not met at scheduling time, the + pod will not be scheduled onto the node. If the anti-affinity + requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a + pod label update), the system may or may not try to + eventually evict the pod from its node. When there + are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all + terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or + not co-located (anti-affinity) with, where co-located + is defined as running on a node whose value of the + label with key matches that of any + node on which a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4916,18 +10705,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4939,13 +10762,35 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey @@ -4954,124 +10799,279 @@ spec: type: object type: object automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether + a service account token should be automatically mounted. type: boolean containers: + description: List of containers belonging to the pod. Containers + cannot currently be added or removed. There must be at least + one container in a Pod. Cannot be updated. items: + description: A single application container that you want + to run within a pod. properties: args: + description: 'Arguments to the entrypoint. The container + image''s CMD is used if this is not provided. Variable + references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The container image''s ENTRYPOINT is used if + this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If + a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config + management to default or override container images in + workload controllers like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should + take in response to container lifecycle events. Cannot + be updated. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5079,49 +11079,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5129,25 +11182,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -5155,37 +11226,74 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5193,62 +11301,131 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. + Not specifying a port here DOES NOT prevent that port + from being exposed. Any port which is listening on the + default "0.0.0.0" address inside a container will be + accessible from the network. Modifying this array with + strategic merge patch may corrupt the data. For more + information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -5259,37 +11436,74 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if + the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5297,47 +11511,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -5345,6 +11624,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -5353,101 +11634,270 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields + of SecurityContext override the equivalent fields of + PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has + successfully initialized. If specified, no other probes + are executed until this completes successfully. If this + probe fails, the Pod will be restarted, just as if the + livenessProbe failed. This can be used to provide different + probe parameters at the beginning of a Pod''s lifecycle, + when it might take a long time to load data or warm + a cache, than during steady-state operation. This cannot + be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5455,61 +11905,143 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -5517,19 +12049,43 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -5537,152 +12093,343 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array dnsConfig: + description: Specifies the DNS parameters of a pod. Parameters + specified here will be merged to the generated DNS configuration + based on DNSPolicy. properties: nameservers: + description: A list of DNS name server IP addresses. This + will be appended to the base nameservers generated from + DNSPolicy. Duplicated nameservers will be removed. items: type: string type: array options: + description: A list of DNS resolver options. This will be + merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options + given in Options will override those that appear in the + base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: Required. type: string value: type: string type: object type: array searches: + description: A list of DNS search domains for host-name + lookup. This will be appended to the base search paths + generated from DNSPolicy. Duplicated search paths will + be removed. items: type: string type: array type: object dnsPolicy: + description: Set DNS policy for the pod. Defaults to "ClusterFirst". + Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', + 'Default' or 'None'. DNS parameters given in DNSConfig will + be merged with the policy selected with DNSPolicy. To have + DNS options set along with hostNetwork, you have to specify + DNS policy explicitly to 'ClusterFirstWithHostNet'. type: string enableServiceLinks: + description: 'EnableServiceLinks indicates whether information + about services should be injected into pod''s environment + variables, matching the syntax of Docker links. Optional: + Defaults to true.' type: boolean ephemeralContainers: + description: List of ephemeral containers run in this pod. Ephemeral + containers may be run in an existing pod to perform user-initiated + actions such as debugging. This list cannot be specified when + creating a pod, and it cannot be modified by updating the + pod spec. In order to add an ephemeral container to an existing + pod, use the pod's ephemeralcontainers subresource. items: + description: "An EphemeralContainer is a temporary container + that you may add to an existing Pod for user-initiated activities + such as debugging. Ephemeral containers have no resource + or scheduling guarantees, and they will not be restarted + when they exit or when a Pod is removed or restarted. The + kubelet may evict a Pod if an ephemeral container causes + the Pod to exceed its resource allocation. \n To add an + ephemeral container, use the ephemeralcontainers subresource + of an existing Pod. Ephemeral containers may not be removed + or restarted." properties: args: + description: 'Arguments to the entrypoint. The image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded + using the container''s environment. If a variable cannot + be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which + allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". Escaped + references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Lifecycle is not allowed for ephemeral containers. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5690,49 +12437,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5740,25 +12540,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -5766,37 +12584,72 @@ spec: type: object type: object livenessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5804,62 +12657,124 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the ephemeral container specified + as a DNS_LABEL. This name must be unique among all containers, + init containers and ephemeral containers. type: string ports: + description: Ports are not allowed for ephemeral containers. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -5870,37 +12785,72 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5908,47 +12858,113 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: Resources are not allowed for ephemeral containers. + Ephemeral containers use spare resources already allocated + to the pod. properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -5956,6 +12972,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -5964,101 +12982,262 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'Optional: SecurityContext defines the security + options the ephemeral container should be run with. + If set, the fields of SecurityContext override the equivalent + fields of PodSecurityContext.' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6066,63 +13245,153 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean targetContainerName: + description: "If set, the name of the container from PodSpec + that this ephemeral container targets. The ephemeral + container will be run in the namespaces (IPC, PID, etc) + of this container. If not set then the ephemeral container + uses the namespaces configured in the Pod spec. \n The + container runtime must implement support for this feature. + If the runtime does not support namespace targeting + then the result of setting this field is undefined." type: string terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -6130,19 +13399,44 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Subpath mounts are not allowed for ephemeral + containers. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -6150,154 +13444,362 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array hostAliases: + description: HostAliases is an optional list of hosts and IPs + that will be injected into the pod's hosts file if specified. + This is only valid for non-hostNetwork pods. items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array ip: + description: IP address of the host file entry. type: string type: object type: array hostIPC: + description: 'Use the host''s ipc namespace. Optional: Default + to false.' type: boolean hostNetwork: + description: Host networking requested for this pod. Use the + host's network namespace. If this option is set, the ports + that will be used must be specified. Default to false. type: boolean hostPID: + description: 'Use the host''s pid namespace. Optional: Default + to false.' + type: boolean + hostUsers: + description: 'Use the host''s user namespace. Optional: Default + to true. If set to true or not present, the pod will be run + in the host user namespace, useful for when the pod needs + a feature only available to the host user namespace, such + as loading a kernel module with CAP_SYS_MODULE. When set to + false, a new userns is created for the pod. Setting false + is useful for mitigating container breakout vulnerabilities + even allowing users to run their containers as root without + actually having root privileges on the host. This field is + alpha-level and is only honored by servers that enable the + UserNamespacesSupport feature.' type: boolean hostname: + description: Specifies the hostname of the Pod If not specified, + the pod's hostname will be set to a system-defined value. type: string imagePullSecrets: + description: 'ImagePullSecrets is an optional list of references + to secrets in the same namespace to use for pulling any of + the images used by this PodSpec. If specified, these secrets + will be passed to individual puller implementations for them + to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same + namespace. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic type: array initContainers: + description: 'List of initialization containers belonging to + the pod. Init containers are executed in order prior to containers + being started. If any init container fails, the pod is considered + to have failed and is handled according to its restartPolicy. + The name for an init container or normal container must be + unique among all containers. Init containers may not have + Lifecycle actions, Readiness probes, Liveness probes, or Startup + probes. The resourceRequirements of an init container are + taken into account during scheduling by finding the highest + request/limit for each resource type, and then using the max + of of that value or the sum of the normal containers. Limits + are applied to init containers in a similar fashion. Init + containers cannot currently be added or removed. Cannot be + updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' items: + description: A single application container that you want + to run within a pod. properties: args: + description: 'Arguments to the entrypoint. The container + image''s CMD is used if this is not provided. Variable + references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a + shell. The container image''s ENTRYPOINT is used if + this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If + a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the + container. Cannot be updated. items: + description: EnvVar represents an environment variable + present in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are + expanded using the previously defined environment + variables in the container and any service environment + variables. If a variable cannot be resolved, the + reference in the input string will be unchanged. + Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless + of whether the variable exists or not. Defaults + to "".' type: string valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the + pod's namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret + or its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported + as an event when the container is starting. When a key + exists in multiple sources, the value associated with + the last source will take precedence. Values defined + by an Env with a duplicate key will take precedence. + Cannot be updated. items: + description: EnvFromSource represents the source of + a set of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to + each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret must + be defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config + management to default or override container images in + workload controllers like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, + IfNotPresent. Defaults to Always if :latest tag is specified, + or IfNotPresent otherwise. Cannot be updated. More info: + https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should + take in response to container lifecycle events. Cannot + be updated. properties: postStart: + description: 'PostStart is called immediately after + a container is created. If the handler fails, the + container is terminated and restarted according + to its restart policy. Other management of the container + blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6305,49 +13807,102 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before + a container is terminated due to an API request + or management event such as liveness/startup probe + failure, preemption, resource contention, etc. The + handler is not called if the container crashes or + exits. The Pod''s termination grace period countdown + begins before the PreStop hook is executed. Regardless + of the outcome of the handler, the container will + eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other + management of the container blocks until the hook + completes or until the termination grace period + is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to + execute inside the container, the working + directory for the command is root ('/') + in the container's filesystem. The command + is simply exec'd, it is not run inside a + shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you + need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request + to perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. items: + description: HTTPHeader describes a custom + header to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6355,25 +13910,43 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting + to the host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this + field and lifecycle hooks will fail in runtime + when tcp handler is specified. properties: host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to + access on the container. Number must be + in the range 1 to 65535. Name must be an + IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -6381,37 +13954,74 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6419,62 +14029,131 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. + Not specifying a port here DOES NOT prevent that port + from being exposed. Any port which is listening on the + default "0.0.0.0" address inside a container will be + accessible from the network. Modifying this array with + strategic merge patch may corrupt the data. For more + information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port + in a single container. properties: containerPort: + description: Number of port to expose on the pod's + IP address. This must be a valid port number, + 0 < x < 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. + If specified, this must be a valid port number, + 0 < x < 65536. If HostNetwork is specified, this + must match ContainerPort. Most containers do not + need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in + a pod must have a unique name. Name for the port + that can be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, + or SCTP. Defaults to "TCP". type: string required: - containerPort @@ -6485,37 +14164,74 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if + the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6523,47 +14239,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -6571,6 +14352,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -6579,101 +14362,270 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields + of SecurityContext override the equivalent fields of + PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent + process. This bool directly controls if the no_new_privs + flag will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as + Privileged 2) has CAP_SYS_ADMIN Note that this field + cannot be set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this + field cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that + this field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field + cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only + root filesystem. Default is false. Note that this + field cannot be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the + container process. Uses runtime default if unset. + May also be set in PodSecurityContext. If set in + both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run + as a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not + run as UID 0 (root) and fail to start the container + if it does. If unset or false, no such validation + will be performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the + container process. Defaults to user specified in + image metadata if unspecified. May also be set in + PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be + set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to + the container. If unspecified, the container runtime + will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. properties: level: + description: Level is SELinux level label that + applies to the container. type: string role: + description: Role is a SELinux role label that + applies to the container. type: string type: + description: Type is a SELinux type label that + applies to the container. type: string user: + description: User is a SELinux user label that + applies to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod + & container level, the container options override + the pod options. Note that this field cannot be + set when spec.os.name is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. + The profile must be preconfigured on the node + to work. Must be a descending path, relative + to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: + \n Localhost - a profile defined in a file on + the node should be used. RuntimeDefault - the + container runtime default profile should be + used. Unconfined - no profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied + to all containers. If unspecified, the options from + the PodSecurityContext will be used. If set in both + SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name + is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential + spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. + This field is alpha-level and will only be honored + by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the + feature flag will result in errors when validating + the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is + not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, + if HostProcess is true then HostNetwork must + also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the + entrypoint of the container process. Defaults + to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set + in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes + precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has + successfully initialized. If specified, no other probes + are executed until this completes successfully. If this + probe fails, the Pod will be restarted, just as if the + livenessProbe failed. This can be used to provide different + probe parameters at the beginning of a Pod''s lifecycle, + when it might take a long time to load data or warm + a cache, than during steady-state operation. This cannot + be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the + probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a + GRPC port. This is a beta field and requires enabling + GRPCContainerProbe feature gate. properties: port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service + to place in the gRPC HealthCheckRequest (see + https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -6681,61 +14633,143 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container + has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the + probe. Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the + probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. + Minimum value is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving + a TCP port. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod + needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after + the processes running in the pod are sent a termination + signal and the time when the processes are forcibly + halted with a kill signal. Set this value longer + than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds + will be used. Otherwise, this value overrides the + value provided by the pod spec. Value must be non-negative + integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod + feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is + 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a + buffer for stdin in the container runtime. If this is + not set, reads from stdin in the container will always + result in EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close + the stdin channel after it has been opened by a single + attach. When stdin is true the stdin stream will remain + open across multiple attach sessions. If stdinOnce is + set to true, stdin is opened on container start, is + empty until the first client attaches to stdin, and + then remains open and accepts data until the client + disconnects, at which time stdin is closed and remains + closed until the container is restarted. If this flag + is false, a container processes that reads from stdin + will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which + the container''s termination message will be written + is mounted into the container''s filesystem. Message + written is intended to be brief final status, such as + an assertion failure message. Will be truncated by the + node if greater than 4096 bytes. The total message length + across all containers will be limited to 12kb. Defaults + to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should + be populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last + chunk of container log output if the termination message + file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, + whichever is smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a + TTY for itself, also requires 'stdin' to be true. Default + is false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices + to be used by the container. items: + description: volumeDevice describes a mapping of a raw + block device within a container. properties: devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -6743,19 +14777,43 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's + filesystem. Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which + the volume should be mounted. Must not contain + ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and + the other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write + otherwise (false or unspecified). Defaults to + false. type: boolean subPath: + description: Path within the volume from which the + container's volume should be mounted. Defaults + to "" (volume's root). type: string subPathExpr: + description: Expanded path within the volume from + which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable + references $(VAR_NAME) are expanded using the + container's environment. Defaults to "" (volume's + root). SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -6763,21 +14821,54 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which + might be configured in the container image. Cannot be + updated. type: string required: - name type: object type: array nodeName: + description: NodeName is a request to schedule this pod onto + a specific node. If it is non-empty, the scheduler simply + schedules this pod onto that node, assuming that it fits resource + requirements. type: string nodeSelector: additionalProperties: type: string + description: 'NodeSelector is a selector which must be true + for the pod to fit on a node. Selector which must match a + node''s labels for the pod to be scheduled on that node. More + info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' type: object x-kubernetes-map-type: atomic os: + description: "Specifies the OS of the containers in the pod. + Some pod and container fields are restricted if this is set. + \n If the OS field is set to linux, the following fields must + be unset: -securityContext.windowsOptions \n If the OS field + is set to windows, following fields must be unset: - spec.hostPID + - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions + - spec.securityContext.seccompProfile - spec.securityContext.fsGroup + - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls + - spec.shareProcessNamespace - spec.securityContext.runAsUser + - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups + - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile + - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem + - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation + - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser + - spec.containers[*].securityContext.runAsGroup" properties: name: + description: 'Name is the name of the operating system. + The currently supported values are linux and windows. + Additional value may be defined in future and can be one + of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration + Clients should expect to handle additional values and + treat unrecognized values in this field as os: null' type: string required: - name @@ -6789,75 +14880,282 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Overhead represents the resource overhead associated + with running a pod for a given RuntimeClass. This field will + be autopopulated at admission time by the RuntimeClass admission + controller. If the RuntimeClass admission controller is enabled, + overhead must not be set in Pod create requests. The RuntimeClass + admission controller will reject Pod create requests which + have the overhead already set. If RuntimeClass is configured + and selected in the PodSpec, Overhead will be set to the value + defined in the corresponding RuntimeClass, otherwise it will + remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' type: object preemptionPolicy: + description: PreemptionPolicy is the Policy for preempting pods + with lower priority. One of Never, PreemptLowerPriority. Defaults + to PreemptLowerPriority if unset. type: string priority: + description: The priority value. Various system components use + this field to find the priority of the pod. When Priority + Admission Controller is enabled, it prevents users from setting + this field. The admission controller populates this field + from PriorityClassName. The higher the value, the higher the + priority. format: int32 type: integer priorityClassName: + description: If specified, indicates the pod's priority. "system-node-critical" + and "system-cluster-critical" are two special keywords which + indicate the highest priorities with the former being the + highest priority. Any other name must be defined by creating + a PriorityClass object with that name. If not specified, the + pod priority will be default or zero if there is no default. type: string readinessGates: + description: 'If specified, all readiness gates will be evaluated + for pod readiness. A pod is ready when all its containers + are ready AND all conditions specified in the readiness gates + have status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' items: + description: PodReadinessGate contains the reference to a + pod condition properties: conditionType: + description: ConditionType refers to a condition in the + pod's condition list with matching type. type: string required: - conditionType type: object type: array + resourceClaims: + description: "ResourceClaims defines which ResourceClaims must + be allocated and reserved before the Pod is allowed to start. + The resources will be made available to those containers which + consume them by name. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. \n This + field is immutable." + items: + description: PodResourceClaim references exactly one ResourceClaim + through a ClaimSource. It adds a name to it that uniquely + identifies the ResourceClaim inside the Pod. Containers + that need access to the ResourceClaim reference it with + this name. + properties: + name: + description: Name uniquely identifies this resource claim + inside the pod. This must be a DNS_LABEL. + type: string + source: + description: Source describes where to find the ResourceClaim. + properties: + resourceClaimName: + description: ResourceClaimName is the name of a ResourceClaim + object in the same namespace as this pod. + type: string + resourceClaimTemplateName: + description: "ResourceClaimTemplateName is the name + of a ResourceClaimTemplate object in the same namespace + as this pod. \n The template will be used to create + a new ResourceClaim, which will be bound to this + pod. When this pod is deleted, the ResourceClaim + will also be deleted. The name of the ResourceClaim + will be -, where is the PodResourceClaim.Name. Pod validation + will reject the pod if the concatenated name is + not valid for a ResourceClaim (e.g. too long). \n + An existing ResourceClaim with that name that is + not owned by the pod will not be used for the pod + to avoid using an unrelated resource by mistake. + Scheduling and pod startup are then blocked until + the unrelated ResourceClaim is removed. \n This + field is immutable and no changes will be made to + the corresponding ResourceClaim by the control plane + after creating the ResourceClaim." + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map restartPolicy: + description: 'Restart policy for all containers within the pod. + One of Always, OnFailure, Never. Default to Always. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' type: string runtimeClassName: + description: 'RuntimeClassName refers to a RuntimeClass object + in the node.k8s.io group, which should be used to run this + pod. If no RuntimeClass resource matches the named class, + the pod will not be run. If unset or empty, the "legacy" RuntimeClass + will be used, which is an implicit class with an empty definition + that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' type: string schedulerName: + description: If specified, the pod will be dispatched by specified + scheduler. If not specified, the pod will be dispatched by + default scheduler. type: string + schedulingGates: + description: "SchedulingGates is an opaque list of values that + if specified will block scheduling the pod. More info: https://git.k8s.io/enhancements/keps/sig-scheduling/3521-pod-scheduling-readiness. + \n This is an alpha-level feature enabled by PodSchedulingReadiness + feature gate." + items: + description: PodSchedulingGate is associated to a Pod to guard + its scheduling. + properties: + name: + description: Name of the scheduling gate. Each scheduling + gate must have a unique name field. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map securityContext: + description: 'SecurityContext holds pod-level security attributes + and common container settings. Optional: Defaults to empty. See + type description for default values of each field.' properties: fsGroup: + description: "A special supplemental group that applies + to all containers in a pod. Some volume types allow the + Kubelet to change the ownership of that volume to be owned + by the pod: \n 1. The owning GID will be the FSGroup 2. + The setgid bit is set (new files created in the volume + will be owned by FSGroup) 3. The permission bits are OR'd + with rw-rw---- \n If unset, the Kubelet will not modify + the ownership and permissions of any volume. Note that + this field cannot be set when spec.os.name is windows." format: int64 type: integer fsGroupChangePolicy: + description: 'fsGroupChangePolicy defines behavior of changing + ownership and permission of the volume before being exposed + inside Pod. This field will only apply to volume types + which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such + as: secret, configmaps and emptydir. Valid values are + "OnRootMismatch" and "Always". If not specified, "Always" + is used. Note that this field cannot be set when spec.os.name + is windows.' type: string runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence for + that container. Note that this field cannot be set when + spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by the containers + in this pod. Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". type: string type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." type: string required: - type type: object supplementalGroups: + description: A list of groups applied to the first process + run in each container, in addition to the container's + primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container + process. If unspecified, no additional groups are added + to any container. Note that group memberships defined + in the container image for the uid of the container process + are still effective, even if they are not included in + this list. Note that this field cannot be set when spec.os.name + is windows. items: format: int64 type: integer type: array sysctls: + description: Sysctls hold a list of namespaced sysctls used + for the pod. Pods with unsupported sysctls (by the container + runtime) might fail to launch. Note that this field cannot + be set when spec.os.name is windows. items: + description: Sysctl defines a kernel parameter to be set properties: name: + description: Name of a property to set type: string value: + description: Value of a property to set type: string required: - name @@ -6865,59 +15163,172 @@ spec: type: object type: array windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options within a container's + SecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object serviceAccount: + description: 'DeprecatedServiceAccount is a depreciated alias + for ServiceAccountName. Deprecated: Use serviceAccountName + instead.' type: string serviceAccountName: + description: 'ServiceAccountName is the name of the ServiceAccount + to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' type: string setHostnameAsFQDN: + description: If true the pod's hostname will be configured as + the pod's FQDN, rather than the leaf name (the default). In + Linux containers, this means setting the FQDN in the hostname + field of the kernel (the nodename field of struct utsname). + In Windows containers, this means setting the registry value + of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters + to FQDN. If a pod does not have FQDN, this has no effect. + Default to false. type: boolean shareProcessNamespace: + description: 'Share a single process namespace between all of + the containers in a pod. When this is set containers will + be able to view and signal processes from other containers + in the same pod, and the first process in each container will + not be assigned PID 1. HostPID and ShareProcessNamespace cannot + both be set. Optional: Default to false.' type: boolean subdomain: + description: If specified, the fully qualified Pod hostname + will be "...svc.". If not specified, the pod will not have a domainname + at all. type: string terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs to terminate + gracefully. May be decreased in delete request. Value must + be non-negative integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). If this + value is nil, the default grace period will be used instead. + The grace period is the duration in seconds after the processes + running in the pod are sent a termination signal and the time + when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your + process. Defaults to 30 seconds. format: int64 type: integer tolerations: + description: If specified, the pod's tolerations. items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using + the matching operator . properties: effect: + description: Effect indicates the taint effect to match. + Empty means match all taint effects. When specified, + allowed values are NoSchedule, PreferNoSchedule and + NoExecute. type: string key: + description: Key is the taint key that the toleration + applies to. Empty means match all taint keys. If the + key is empty, operator must be Exists; this combination + means to match all values and all keys. type: string operator: + description: Operator represents a key's relationship + to the value. Valid operators are Exists and Equal. + Defaults to Equal. Exists is equivalent to wildcard + for value, so that a pod can tolerate all taints of + a particular category. type: string tolerationSeconds: + description: TolerationSeconds represents the period of + time the toleration (which must be of effect NoExecute, + otherwise this field is ignored) tolerates the taint. + By default, it is not set, which means tolerate the + taint forever (do not evict). Zero and negative values + will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: TopologySpreadConstraints describes how a group + of pods ought to spread across topology domains. Scheduler + will schedule pods in a way which abides by the constraints. + All topologySpreadConstraints are ANDed. items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. properties: labelSelector: + description: LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine + the number of pods in their corresponding topology domain. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, + NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator is + Exists or DoesNotExist, the values array must + be empty. This array is replaced during a + strategic merge patch. items: type: string type: array @@ -6929,14 +15340,131 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field + is "key", the operator is "In", and the values array + contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: MatchLabelKeys is a set of pod label keys + to select the pods over which spreading will be calculated. + The keys are used to lookup values from the incoming + pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading + will be calculated for the incoming pod. Keys that don't + exist in the incoming pod labels will be ignored. A + null or empty list means only match against labelSelector. + items: + type: string + type: array + x-kubernetes-list-type: atomic maxSkew: + description: 'MaxSkew describes the degree to which pods + may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, + it is the maximum permitted difference between the number + of matching pods in the target topology and the global + minimum. The global minimum is the minimum number of + matching pods in an eligible domain or zero if the number + of eligible domains is less than MinDomains. For example, + in a 3-zone cluster, MaxSkew is set to 1, and pods with + the same labelSelector spread as 2/2/1: In this case, + the global minimum is 1. | zone1 | zone2 | zone3 | | P + P | P P | P | - if MaxSkew is 1, incoming pod + can only be scheduled to zone3 to become 2/2/2; scheduling + it onto zone1(zone2) would make the ActualSkew(3-1) + on zone1(zone2) violate MaxSkew(1). - if MaxSkew is + 2, incoming pod can be scheduled onto any zone. When + `whenUnsatisfiable=ScheduleAnyway`, it is used to give + higher precedence to topologies that satisfy it. It''s + a required field. Default value is 1 and 0 is not allowed.' format: int32 type: integer + minDomains: + description: "MinDomains indicates a minimum number of + eligible domains. When the number of eligible domains + with matching topology keys is less than minDomains, + Pod Topology Spread treats \"global minimum\" as 0, + and then the calculation of Skew is performed. And when + the number of eligible domains with matching topology + keys equals or greater than minDomains, this value has + no effect on scheduling. As a result, when the number + of eligible domains is less than minDomains, scheduler + won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains + is equal to 1. Valid values are integers greater than + 0. When value is not nil, WhenUnsatisfiable must be + DoNotSchedule. \n For example, in a 3-zone cluster, + MaxSkew is set to 2, MinDomains is set to 5 and pods + with the same labelSelector spread as 2/2/2: | zone1 + | zone2 | zone3 | | P P | P P | P P | The number + of domains is less than 5(MinDomains), so \"global minimum\" + is treated as 0. In this situation, new pod with the + same labelSelector cannot be scheduled, because computed + skew will be 3(3 - 0) if new Pod is scheduled to any + of the three zones, it will violate MaxSkew. \n This + is a beta field and requires the MinDomainsInPodTopologySpread + feature gate to be enabled (enabled by default)." + format: int32 + type: integer + nodeAffinityPolicy: + description: "NodeAffinityPolicy indicates how we will + treat Pod's nodeAffinity/nodeSelector when calculating + pod topology spread skew. Options are: - Honor: only + nodes matching nodeAffinity/nodeSelector are included + in the calculations. - Ignore: nodeAffinity/nodeSelector + are ignored. All nodes are included in the calculations. + \n If this value is nil, the behavior is equivalent + to the Honor policy. This is a beta-level feature default + enabled by the NodeInclusionPolicyInPodTopologySpread + feature flag." + type: string + nodeTaintsPolicy: + description: "NodeTaintsPolicy indicates how we will treat + node taints when calculating pod topology spread skew. + Options are: - Honor: nodes without taints, along with + tainted nodes for which the incoming pod has a toleration, + are included. - Ignore: node taints are ignored. All + nodes are included. \n If this value is nil, the behavior + is equivalent to the Ignore policy. This is a beta-level + feature default enabled by the NodeInclusionPolicyInPodTopologySpread + feature flag." + type: string topologyKey: + description: TopologyKey is the key of node labels. Nodes + that have a label with this key and identical values + are considered to be in the same topology. We consider + each as a "bucket", and try to put balanced + number of pods into each bucket. We define a domain + as a particular instance of a topology. Also, we define + an eligible domain as a domain whose nodes meet the + requirements of nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each + Node is a domain of that topology. And, if TopologyKey + is "topology.kubernetes.io/zone", each zone is a domain + of that topology. It's a required field. type: string whenUnsatisfiable: + description: 'WhenUnsatisfiable indicates how to deal + with a pod if it doesn''t satisfy the spread constraint. + - DoNotSchedule (default) tells the scheduler not to + schedule it. - ScheduleAnyway tells the scheduler to + schedule the pod in any location, but giving higher + precedence to topologies that would help reduce the + skew. A constraint is considered "Unsatisfiable" for + an incoming pod if and only if every possible node assignment + for that pod would violate "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to + 1, and pods with the same labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming + pod can only be scheduled to zone2(zone3) to become + 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be + imbalanced, but scheduler won''t make it *more* imbalanced. + It''s a required field.' type: string required: - maxSkew @@ -6949,104 +15477,240 @@ spec: - whenUnsatisfiable x-kubernetes-list-type: map volumes: + description: 'List of volumes that can be mounted by containers + belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. properties: awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk + resource that is attached to a kubelet''s host machine + and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' properties: fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default + is to mount by volume name. Examples: For volume + /dev/sda1, you specify the partition as "1". Similarly, + the volume partition for /dev/sda is "0" (or you + can leave the property empty).' format: int32 type: integer readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: boolean volumeID: + description: 'volumeID is unique ID of the persistent + disk resource in AWS (Amazon EBS volume). More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: string required: - volumeID type: object azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. properties: cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' type: string diskName: + description: diskName is the Name of the data disk + in the blob storage type: string diskURI: + description: diskURI is the URI of data disk in the + blob storage type: string fsType: + description: fsType is Filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean required: - diskName - diskURI type: object azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. properties: readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key type: string shareName: + description: shareName is the azure share Name type: string required: - secretName - shareName type: object cephfs: + description: cephFS represents a Ceph FS mount on the + host that shares a pod's lifetime properties: monitors: + description: 'monitors is Required: Monitors is a + collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' items: type: string type: array path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is + /' type: string readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: boolean secretFile: + description: 'secretFile is Optional: SecretFile is + the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string secretRef: + description: 'secretRef is Optional: SecretRef is + reference to the authentication secret for User, + default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is optional: User is the rados + user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string required: - monitors type: object cinder: + description: 'cinder represents a cinder volume attached + and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Examples: "ext4", "xfs", "ntfs". + Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string readOnly: + description: 'readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: boolean secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to + OpenStack.' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeID: + description: 'volumeID used to identify the volume + in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string required: - volumeID type: object configMap: + description: configMap represents a configMap that should + populate this volume properties: defaultMode: + description: 'defaultMode is optional: mode bits used + to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file whose + name is the key and content is the value. If specified, + the listed keys will be projected into the specified + paths, and unlisted keys will not be present. If + a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked + optional. Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used + to set permissions on this file. Must be an + octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both + octal and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the + file to map the key to. May not be an absolute + path. May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -7054,121 +15718,386 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: optional specify whether the ConfigMap + or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). properties: driver: + description: driver is the name of the CSI driver + that handles this volume. Consult with your admin + for the correct name as registered in the cluster. type: string fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the + associated CSI driver which will determine the default + filesystem to apply. type: string nodePublishSecretRef: + description: nodePublishSecretRef is a reference to + the secret object containing sensitive information + to pass to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the + secret object contains more than one secret, all + secret references are passed. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string + description: volumeAttributes stores driver-specific + properties that are passed to the CSI driver. Consult + your driver's documentation for supported values. type: object required: - driver type: object downwardAPI: + description: downwardAPI represents downward API about + the pod that should populate this volume properties: defaultMode: + description: 'Optional: mode bits to use on created + files by default. Must be a Optional: mode bits + used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: Items is a list of downward API volume + file items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field properties: fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select + in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used to set + permissions on this file, must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal + and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the relative + path name of the file to be created. Must + not be absolute or contain the ''..'' path. + Must be utf-8 encoded. The first item of the + relative path must not start with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: required for + volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format + of the exposed resources, defaults to + "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object emptyDir: + description: 'emptyDir represents a temporary directory + that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' properties: medium: + description: 'medium represents what type of storage + medium should back this directory. The default is + "" which means to use the node''s default medium. + Must be an empty string (default) or Memory. More + info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' type: string sizeLimit: anyOf: - type: integer - type: string + description: 'sizeLimit is the total amount of local + storage required for this EmptyDir volume. The size + limit is also applicable for memory medium. The + maximum usage on memory medium EmptyDir would be + the minimum value between the SizeLimit specified + here and the sum of memory limits of all containers + in a pod. The default is nil which means that the + limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle + is tied to the pod that defines it - it will be created + before the pod starts, and deleted when the pod is removed. + \n Use this if: a) the volume is only needed while the + pod runs, b) features of normal volumes like restoring + from snapshot or capacity tracking are needed, c) the + storage driver is specified through a storage class, + and d) the storage driver supports dynamic volume provisioning + through a PersistentVolumeClaim (see EphemeralVolumeSource + for more information on the connection between this + volume type and PersistentVolumeClaim). \n Use PersistentVolumeClaim + or one of the vendor-specific APIs for volumes that + persist for longer than the lifecycle of an individual + pod. \n Use CSI for light-weight local ephemeral volumes + if the CSI driver is meant to be used that way - see + the documentation of the driver for more information. + \n A pod can use both types of ephemeral volumes and + persistent volumes at the same time." properties: volumeClaimTemplate: + description: "Will be used to create a stand-alone + PVC to provision the volume. The pod in which this + EphemeralVolumeSource is embedded will be the owner + of the PVC, i.e. the PVC will be deleted together + with the pod. The name of the PVC will be `-` where `` is the + name from the `PodSpec.Volumes` array entry. Pod + validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). + \n An existing PVC with that name that is not owned + by the pod will *not* be used for the pod to avoid + using an unrelated volume by mistake. Starting the + pod is then blocked until the unrelated PVC is removed. + If such a pre-created PVC is meant to be used by + the pod, the PVC has to updated with an owner reference + to the pod once the pod exists. Normally this should + not be necessary, but it may be useful when manually + reconstructing a broken cluster. \n This field is + read-only and no changes will be made by Kubernetes + to the PVC after it has been created. \n Required, + must not be nil." properties: metadata: + description: May contain labels and annotations + that will be copied into the PVC when creating + it. No other fields are allowed and will be + rejected during validation. type: object spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into + the PVC that gets created from this template. + The same fields as in a PersistentVolumeClaim + are also valid here. properties: accessModes: + description: 'accessModes contains the desired + access modes the volume should have. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' items: type: string type: array dataSource: + description: 'dataSource field can be used + to specify either: * An existing VolumeSnapshot + object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller + can support the specified data source, it + will create a new volume based on the contents + of the specified data source. When the AnyVolumeDataSource + feature gate is enabled, dataSource contents + will be copied to dataSourceRef, and dataSourceRef + contents will be copied to dataSource when + dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef + will not be copied to dataSource.' properties: apiGroup: + description: APIGroup is the group for + the resource being referenced. If APIGroup + is not specified, the specified Kind + must be in the core API group. For any + other third-party types, APIGroup is + required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced type: string required: - kind - name type: object + x-kubernetes-map-type: atomic dataSourceRef: + description: 'dataSourceRef specifies the + object from which to populate the volume + with data, if a non-empty volume is desired. + This may be any object from a non-empty + API group (non core object) or a PersistentVolumeClaim + object. When this field is specified, volume + binding will only succeed if the type of + the specified object matches some installed + volume populator or dynamic provisioner. + This field will replace the functionality + of the dataSource field and as such if both + fields are non-empty, they must have the + same value. For backwards compatibility, + when namespace isn''t specified in dataSourceRef, + both fields (dataSource and dataSourceRef) + will be set to the same value automatically + if one of them is empty and the other is + non-empty. When namespace is specified in + dataSourceRef, dataSource isn''t set to + the same value and must be empty. There + are three important differences between + dataSource and dataSourceRef: * While dataSource + only allows two specific types of objects, + dataSourceRef allows any non-core object, + as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values + (dropping them), dataSourceRef preserves + all values, and generates an error if a + disallowed value is specified. * While dataSource + only allows local objects, dataSourceRef + allows objects in any namespaces. (Beta) + Using this field requires the AnyVolumeDataSource + feature gate to be enabled. (Alpha) Using + the namespace field of dataSourceRef requires + the CrossNamespaceVolumeDataSource feature + gate to be enabled.' properties: apiGroup: + description: APIGroup is the group for + the resource being referenced. If APIGroup + is not specified, the specified Kind + must be in the core API group. For any + other third-party types, APIGroup is + required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: Namespace is the namespace + of resource being referenced Note that + when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferenceGrant + documentation for details. (Alpha) This + field requires the CrossNamespaceVolumeDataSource + feature gate to be enabled. type: string required: - kind - name type: object resources: + description: 'resources represents the minimum + resources the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to + specify resource requirements that are lower + than previous value but must still be higher + than capacity recorded in the status field + of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' properties: + claims: + description: "Claims lists the names of + resources, defined in spec.resourceClaims, + that are used by this container. \n + This is an alpha field and requires + enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references + one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the + name of one entry in pod.spec.resourceClaims + of the Pod where this field is + used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -7176,6 +16105,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum + amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -7184,18 +16116,47 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. + If Requests is omitted for a container, + it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object selector: + description: selector is a label query over + volumes to consider for binding. properties: matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. items: + description: A label selector requirement + is a selector that contains values, + a key, and an operator that relates + the key and values. properties: key: + description: key is the label key + that the selector applies to. type: string operator: + description: operator represents + a key's relationship to a set + of values. Valid operators are + In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array + of string values. If the operator + is In or NotIn, the values array + must be non-empty. If the operator + is Exists or DoesNotExist, the + values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -7207,13 +16168,29 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator + is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic storageClassName: + description: 'storageClassName is the name + of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' type: string volumeMode: + description: volumeMode defines what type + of volume is required by the claim. Value + of Filesystem is implied when not included + in claim spec. type: string volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. type: string type: object required: @@ -7221,125 +16198,275 @@ spec: type: object type: object fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. TODO: how + do we prevent errors in the filesystem from compromising + the machine' type: string lun: + description: 'lun is Optional: FC target lun number' format: int32 type: integer readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' items: type: string type: array wwids: + description: 'wwids Optional: FC volume world wide + identifiers (wwids) Either wwids or combination + of targetWWNs and lun must be set, but not both + simultaneously.' items: type: string type: array type: object flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. properties: driver: + description: driver is the name of the driver to use + for this volume. type: string fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". The + default filesystem depends on FlexVolume script. type: string options: additionalProperties: type: string + description: 'options is Optional: this field holds + extra command options if any.' type: object readOnly: + description: 'readOnly is Optional: defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean secretRef: + description: 'secretRef is Optional: secretRef is + reference to the secret object containing sensitive + information to pass to the plugin scripts. This + may be empty if no secret object is specified. If + the secret object contains more than one secret, + all secrets are passed to the plugin scripts.' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic required: - driver type: object flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running properties: datasetName: + description: datasetName is Name of the dataset stored + as metadata -> name on the dataset for Flocker should + be considered as deprecated type: string datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset type: string type: object gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk + resource that is attached to a kubelet''s host machine + and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' properties: fsType: + description: 'fsType is filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default + is to mount by volume name. Examples: For volume + /dev/sda1, you specify the partition as "1". Similarly, + the volume partition for /dev/sda is "0" (or you + can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' format: int32 type: integer pdName: + description: 'pdName is unique name of the PD resource + in GCE. Used to identify the disk in GCE. More info: + https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: string readOnly: + description: 'readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. More + info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: boolean required: - pdName type: object gitRepo: + description: 'gitRepo represents a git repository at a + particular revision. DEPRECATED: GitRepo is deprecated. + To provision a container with a git repo, mount an EmptyDir + into an InitContainer that clones the repo using git, + then mount the EmptyDir into the Pod''s container.' properties: directory: + description: directory is the target directory name. + Must not contain or start with '..'. If '.' is + supplied, the volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. type: string repository: + description: repository is the URL type: string revision: + description: revision is the commit hash for the specified + revision. type: string required: - repository type: object glusterfs: + description: 'glusterfs represents a Glusterfs mount on + the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' properties: endpoints: + description: 'endpoints is the endpoint name that + details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string path: + description: 'path is the Glusterfs volume path. More + info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string readOnly: + description: 'readOnly here will force the Glusterfs + volume to be mounted with read-only permissions. + Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: boolean required: - endpoints - path type: object hostPath: + description: 'hostPath represents a pre-existing file + or directory on the host machine that is directly exposed + to the container. This is generally used for system + agents or other privileged things that are allowed to + see the host machine. Most containers will NOT need + this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host + directory mounts and who can/can not mount host directories + as read/write.' properties: path: + description: 'path of the directory on the host. If + the path is a symlink, it will follow the link to + the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string type: + description: 'type for HostPath Volume Defaults to + "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string required: - path type: object iscsi: + description: 'iscsi represents an ISCSI Disk resource + that is attached to a kubelet''s host machine and then + exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' properties: chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication type: boolean chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication type: boolean fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. type: string iqn: + description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: + description: iscsiInterface is the interface Name + that uses an iSCSI transport. Defaults to 'default' + (tcp). type: string lun: + description: lun represents iSCSI Target Lun number. format: int32 type: integer portals: + description: portals is the iSCSI Target Portal List. + The portal is either an IP or ip_addr:port if the + port is other than default (typically TCP ports + 860 and 3260). items: type: string type: array readOnly: + description: readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. type: boolean secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic targetPortal: + description: targetPortal is iSCSI Target Portal. + The Portal is either an IP or ip_addr:port if the + port is other than default (typically TCP ports + 860 and 3260). type: string required: - iqn @@ -7347,67 +16474,157 @@ spec: - targetPortal type: object name: + description: 'name of the volume. Must be a DNS_LABEL + and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string nfs: + description: 'nfs represents an NFS mount on the host + that shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' properties: path: + description: 'path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string readOnly: + description: 'readOnly here will force the NFS export + to be mounted with read-only permissions. Defaults + to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: boolean server: + description: 'server is the hostname or IP address + of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string required: - path - server type: object persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents + a reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' properties: claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' type: string readOnly: + description: readOnly Will force the ReadOnly setting + in VolumeMounts. Default false. type: boolean required: - claimName type: object photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. type: string pdID: + description: pdID is the ID that identifies Photon + Controller persistent disk type: string required: - pdID type: object portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine properties: fsType: + description: fSType represents the filesystem type + to mount Must be a filesystem type supported by + the host operating system. Ex. "ext4", "xfs". Implicitly + inferred to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean volumeID: + description: volumeID uniquely identifies a Portworx + volume type: string required: - volumeID type: object projected: + description: projected items for all in one resources + secrets, configmaps, and downward API properties: defaultMode: + description: defaultMode are the mode bits used to + set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal + and decimal values, JSON requires decimal values + for mode bits. Directories within the path are not + affected by this setting. This might be in conflict + with other options that affect the file mode, like + fsGroup, and the result can be other mode bits set. format: int32 type: integer sources: + description: sources is the list of volume projections items: + description: Projection that may be projected along + with other supported volume types properties: configMap: + description: configMap information about the + configMap data to project properties: items: + description: items if unspecified, each + key-value pair in the Data field of the + referenced ConfigMap will be projected + into the volume as a file whose name is + the key and content is the value. If specified, + the listed keys will be projected into + the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the ConfigMap, + the volume setup will error unless it + is marked optional. Paths must be relative + and may not contain the '..' path or start + with '..'. items: + description: Maps a string key to a path + within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode + bits used to set permissions on + this file. Must be an octal value + between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative + path of the file to map the key + to. May not be an absolute path. + May not contain the path element + '..'. May not start with the string + '..'. type: string required: - key @@ -7415,60 +16632,155 @@ spec: type: object type: array name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional specify whether the + ConfigMap or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic downwardAPI: + description: downwardAPI information about the + downwardAPI data to project properties: items: + description: Items is a list of DownwardAPIVolume + file items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field properties: fieldRef: + description: 'Required: Selects a + field of the pod: only annotations, + labels, name and namespace are supported.' properties: apiVersion: + description: Version of the schema + the FieldPath is written in + terms of, defaults to "v1". type: string fieldPath: + description: Path of the field + to select in the specified API + version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits + used to set permissions on this + file, must be an octal value between + 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute + or contain the ''..'' path. Must + be utf-8 encoded. The first item + of the relative path must not start + with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of + the container: only resources limits + and requests (limits.cpu, limits.memory, + requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: + required for volumes, optional + for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource + to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object secret: + description: secret information about the secret + data to project properties: items: + description: items if unspecified, each + key-value pair in the Data field of the + referenced Secret will be projected into + the volume as a file whose name is the + key and content is the value. If specified, + the listed keys will be projected into + the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the Secret, the + volume setup will error unless it is marked + optional. Paths must be relative and may + not contain the '..' path or start with + '..'. items: + description: Maps a string key to a path + within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode + bits used to set permissions on + this file. Must be an octal value + between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts + both octal and decimal values, JSON + requires decimal values for mode + bits. If not specified, the volume + defaultMode will be used. This might + be in conflict with other options + that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative + path of the file to map the key + to. May not be an absolute path. + May not contain the path element + '..'. May not start with the string + '..'. type: string required: - key @@ -7476,18 +16788,46 @@ spec: type: object type: array name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional field specify whether + the Secret or its key must be defined type: boolean type: object + x-kubernetes-map-type: atomic serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project properties: audience: + description: audience is the intended audience + of the token. A recipient of a token must + identify itself with an identifier specified + in the audience of the token, and otherwise + should reject the token. The audience + defaults to the identifier of the apiserver. type: string expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, + the kubelet volume plugin will proactively + rotate the service account token. The + kubelet will start trying to rotate the + token if the token is older than 80 percent + of its time to live or if the token is + older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. format: int64 type: integer path: + description: path is the path relative to + the mount point of the file to project + the token into. type: string required: - path @@ -7496,74 +16836,159 @@ spec: type: array type: object quobyte: + description: quobyte represents a Quobyte mount on the + host that shares a pod's lifetime properties: group: + description: group to map volume access to Default + is no group type: string readOnly: + description: readOnly here will force the Quobyte + volume to be mounted with read-only permissions. + Defaults to false. type: boolean registry: + description: registry represents a single or multiple + Quobyte Registry services specified as a string + as host:port pair (multiple entries are separated + with commas) which acts as the central registry + for volumes type: string tenant: + description: tenant owning the given Quobyte volume + in the Backend Used with dynamically provisioned + Quobyte volumes, value is set by the plugin type: string user: + description: user to map volume access to Defaults + to serivceaccount user type: string volume: + description: volume is a string that references an + already created Quobyte volume by name. type: string required: - registry - volume type: object rbd: + description: 'rbd represents a Rados Block Device mount + on the host that shares a pod''s lifetime. More info: + https://examples.k8s.io/volumes/rbd/README.md' properties: fsType: + description: 'fsType is the filesystem type of the + volume that you want to mount. Tip: Ensure that + the filesystem type is supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: + https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem + from compromising the machine' type: string image: + description: 'image is the rados image name. More + info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string keyring: + description: 'keyring is the path to key ring for + RBDUser. Default is /etc/ceph/keyring. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' items: type: string type: array pool: + description: 'pool is the rados pool name. Default + is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string readOnly: + description: 'readOnly here will force the ReadOnly + setting in VolumeMounts. Defaults to false. More + info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: boolean secretRef: + description: 'secretRef is name of the authentication + secret for RBDUser. If provided overrides keyring. + Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is the rados user name. Default + is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string required: - image - monitors type: object scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Default + is "xfs". type: string gateway: + description: gateway is the host address of the ScaleIO + API Gateway. type: string protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretRef: + description: secretRef references to the secret for + ScaleIO user and other sensitive information. If + this is not provided, Login operation will fail. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false type: boolean storageMode: + description: storageMode indicates whether the storage + for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. type: string storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. type: string system: + description: system is the name of the storage system + as configured in ScaleIO. type: string volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated + with this volume source. type: string required: - gateway @@ -7571,19 +16996,58 @@ spec: - system type: object secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' properties: defaultMode: + description: 'defaultMode is Optional: mode bits used + to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML accepts + both octal and decimal values, JSON requires decimal + values for mode bits. Defaults to 0644. Directories + within the path are not affected by this setting. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer items: + description: items If unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file whose + name is the key and content is the value. If specified, + the listed keys will be projected into the specified + paths, and unlisted keys will not be present. If + a key is specified which is not present in the Secret, + the volume setup will error unless it is marked + optional. Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used + to set permissions on this file. Must be an + octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both + octal and decimal values, JSON requires decimal + values for mode bits. If not specified, the + volume defaultMode will be used. This might + be in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the + file to map the key to. May not be an absolute + path. May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -7591,35 +17055,81 @@ spec: type: object type: array optional: + description: optional field specify whether the Secret + or its keys must be defined type: boolean secretName: + description: 'secretName is the name of the secret + in the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' type: string type: object storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. + Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in + VolumeMounts. type: boolean secretRef: + description: secretRef specifies the secret to use + for obtaining the StorageOS API credentials. If + not specified, default values will be attempted. properties: name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeName: + description: volumeName is the human-readable name + of the StorageOS volume. Volume names are only + unique within a namespace. type: string volumeNamespace: + description: volumeNamespace specifies the scope of + the volume within StorageOS. If no namespace is + specified then the Pod's namespace will be used. This + allows the Kubernetes name scoping to be mirrored + within StorageOS for tighter integration. Set VolumeName + to any name to override the default behaviour. Set + to "default" if you are not using namespaces within + StorageOS. Namespaces that do not pre-exist within + StorageOS will be created. type: string type: object vsphereVolume: + description: vsphereVolume represents a vSphere volume + attached and mounted on kubelets host machine properties: fsType: + description: fsType is filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string storagePolicyID: + description: storagePolicyID is the storage Policy + Based Management (SPBM) profile ID associated with + the StoragePolicyName. type: string storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. type: string volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk type: string required: - volumePath @@ -7632,8 +17142,11 @@ spec: - containers type: object timeout: + description: Timeout defines the maximum amount of time the Serving + should take to execute before the Serving is running. type: string tracing: + description: Tracing is the config of tracing. properties: baggage: additionalProperties: @@ -7673,22 +17186,29 @@ spec: type: string type: object required: - - baggage - enabled - provider type: object triggers: + description: Triggers used to trigger the Function. properties: dapr: items: properties: inputName: + description: 'Deprecated: Only for compatibility with + v1beta1' type: string name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string topic: type: string type: + description: Type is the type of the component, if it + is not set, controller will get it automatically. type: string required: - name @@ -7696,18 +17216,33 @@ spec: type: array http: properties: + engine: + description: Http function runtime engine, can be set to + knative or keda, default to knative if not set + type: string port: + description: The port on which the function will be invoked format: int32 type: integer route: + description: Information needed to make HTTPRoute. Will + attempt to make HTTPRoute using the default Gateway resource + if Route is nil. properties: gatewayRef: + description: GatewayRef references the Gateway resources + that a Route wants to be attached to. properties: name: + description: Name is the name of the referent. It + refers to the name of a Gateway resource. maxLength: 253 minLength: 1 type: string namespace: + description: Namespace is the namespace of the referent. + When unspecified, this refers to the local namespace + of the Route. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ @@ -7717,7 +17252,25 @@ spec: - namespace type: object hostnames: + description: Hostnames defines a set of hostname that + should match against the HTTP Host header to select + a HTTPRoute to process the request. items: + description: "Hostname is the fully qualified domain + name of a network host. This matches the RFC 1123 + definition of a hostname with 2 notable exceptions: + \n 1. IPs are not allowed. 2. A hostname may be + prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + \n Hostname can be \"precise\" which is a domain + name without the terminating dot of a network host + (e.g. \"foo.example.com\") or \"wildcard\", which + is a domain name prefixed with a single wildcard + label (e.g. `*.example.com`). \n Note that as per + RFC1035 and RFC1123, a *label* must consist of lower + case alphanumeric characters or '-', and must start + and end with an alphanumeric character. No other + punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ @@ -7725,26 +17278,81 @@ spec: maxItems: 16 type: array rules: + description: Rules are a list of HTTP matchers, filters + and actions. items: + description: HTTPRouteRule defines semantics for matching + an HTTP request based on conditions (matches), processing + it (filters), and forwarding the request to an API + object (backendRefs). properties: backendRefs: + description: "If unspecified or invalid (refers + to a non-existent resource or a Service with + no endpoints), the rule performs no forwarding. + If there are also no filters specified that + would result in a response being sent, a HTTP + 503 status code is returned. 503 responses must + be sent so that the overall weight is respected; + if an invalid backend is requested to have 80% + of requests, then 80% of requests must get a + 503 instead. \n Support: Core for Kubernetes + Service Support: Custom for any other resource + \n Support for weight: Core" items: + description: HTTPBackendRef defines how a HTTPRoute + should forward an HTTP request. properties: filters: + description: "Filters defined at this level + should be executed if and only if the + request is being forwarded to the backend + defined here. \n Support: Custom (For + broader support of filters, use the Filters + field in HTTPRouteRule.)" items: + description: HTTPRouteFilter defines processing + steps that must be completed during + the request or response lifecycle. HTTPRouteFilters + are meant as an extension point to express + processing that may be done in Gateway + implementations. Some examples include + request or response modification, implementing + authentication strategies, rate-limiting, + and traffic shaping. API guarantee/conformance + is defined based on the type of the + filter. properties: extensionRef: + description: "ExtensionRef is an optional, + implementation-specific extension + to the \"filter\" behavior. For + example, resource \"myroutefilter\" + in group \"networking.example.net\"). + ExtensionRef MUST NOT be used for + core and extended filters. \n Support: + Implementation-specific" properties: group: + description: Group is the group + of the referent. For example, + "networking.k8s.io". When unspecified + (empty string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is kind of the + referent. For example "HTTPRoute" + or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name + of the referent. maxLength: 253 minLength: 1 type: string @@ -7754,16 +17362,54 @@ spec: - name type: object requestHeaderModifier: + description: "RequestHeaderModifier + defines a schema for a filter that + modifies request headers. \n Support: + Core" properties: add: + description: "Add adds the given + header(s) (name, value) to the + request before the action. It + appends to any existing values + associated with the header name. + \n Input: GET /foo HTTP/1.1 + my-header: foo \n Config: add: + - name: \"my-header\" value: + \"bar\" \n Output: GET /foo + HTTP/1.1 my-header: foo my-header: + bar" items: + description: HTTPHeader represents + an HTTP Header name and value + as defined by RFC 7230. properties: name: + description: "Name is the + name of the HTTP Header + to be matched. Name matching + MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries + specify equivalent header + names, the first entry + with an equivalent name + MUST be considered for + a match. Subsequent entries + with an equivalent header + name MUST be ignored. + Due to the case-insensitivity + of header names, \"foo\" + and \"Foo\" are considered + equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the + value of HTTP Header to + be matched. maxLength: 4096 minLength: 1 type: string @@ -7777,19 +17423,63 @@ spec: - name x-kubernetes-list-type: map remove: + description: "Remove the given + header(s) from the HTTP request + before the action. The value + of Remove is a list of HTTP + header names. Note that the + header names are case-insensitive + (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + \n Input: GET /foo HTTP/1.1 + my-header1: foo my-header2: + bar my-header3: baz \n Config: + remove: [\"my-header1\", \"my-header3\"] + \n Output: GET /foo HTTP/1.1 + my-header2: bar" items: type: string maxItems: 16 type: array set: + description: "Set overwrites the + request with the given header + (name, value) before the action. + \n Input: GET /foo HTTP/1.1 + my-header: foo \n Config: set: + - name: \"my-header\" value: + \"bar\" \n Output: GET /foo + HTTP/1.1 my-header: bar" items: + description: HTTPHeader represents + an HTTP Header name and value + as defined by RFC 7230. properties: name: + description: "Name is the + name of the HTTP Header + to be matched. Name matching + MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries + specify equivalent header + names, the first entry + with an equivalent name + MUST be considered for + a match. Subsequent entries + with an equivalent header + name MUST be ignored. + Due to the case-insensitivity + of header names, \"foo\" + and \"Foo\" are considered + equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the + value of HTTP Header to + be matched. maxLength: 4096 minLength: 1 type: string @@ -7804,30 +17494,96 @@ spec: x-kubernetes-list-type: map type: object requestMirror: + description: "RequestMirror defines + a schema for a filter that mirrors + requests. Requests are sent to the + specified destination, but responses + from that destination are ignored. + \n Support: Extended" properties: backendRef: + description: "BackendRef references + a resource where mirrored requests + are sent. \n If the referent + cannot be found, this BackendRef + is invalid and must be dropped + from the Gateway. The controller + must ensure the \"ResolvedRefs\" + condition on the Route status + is set to `status: False` and + not configure this backend in + the underlying implementation. + \n If there is a cross-namespace + reference to an *existing* object + that is not allowed by a ReferencePolicy, + the controller must ensure the + \"ResolvedRefs\" condition + on the Route is set to `status: + False`, with the \"RefNotPermitted\" + reason and not configure this + backend in the underlying implementation. + \n In either error case, the + Message of the `ResolvedRefs` + Condition should be used to + provide more detail about the + problem. \n Support: Extended + for Kubernetes Service Support: + Custom for any other resource" properties: group: default: "" + description: Group is the + group of the referent. For + example, "networking.k8s.io". + When unspecified (empty + string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind + of the referent. For example + "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name + of the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is + the namespace of the backend. + When unspecified, the local + namespace is inferred. \n + Note that when a namespace + is specified, a ReferencePolicy + object is required in the + referent namespace to allow + that namespace's owner to + accept the reference. See + the ReferencePolicy documentation + for details. \n Support: + Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies + the destination port number + to use for this resource. + Port is required when the + referent is a Kubernetes + Service. For other resources, + destination port might be + derived from the referent + resource or this field. format: int32 maximum: 65535 minimum: 1 @@ -7839,30 +17595,89 @@ spec: - backendRef type: object requestRedirect: + description: "RequestRedirect defines + a schema for a filter that responds + to the request with an HTTP redirection. + \n Support: Core" properties: hostname: + description: "Hostname is the + hostname to be used in the value + of the `Location` header in + the response. When empty, the + hostname of the request is used. + \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: + description: "Port is the port + to be used in the value of the + `Location` header in the response. + When empty, port (if specified) + of the request is used. \n Support: + Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: + description: "Scheme is the scheme + to be used in the value of the + `Location` header in the response. + When empty, the scheme of the + request is used. \n Support: + Extended" enum: - http - https type: string statusCode: default: 302 + description: "StatusCode is the + HTTP status code to be used + in response. \n Support: Core" enum: - 301 - 302 type: integer type: object type: + description: "Type identifies the + type of filter to apply. As with + other API fields, types are classified + into three conformance levels: \n + - Core: Filter types and their corresponding + configuration defined by \"Support: + Core\" in this package, e.g. \"RequestHeaderModifier\". + All implementations must support + core filters. \n - Extended: Filter + types and their corresponding configuration + defined by \"Support: Extended\" + in this package, e.g. \"RequestMirror\". + Implementers are encouraged to support + extended filters. \n - Custom: Filters + that are defined and supported by + specific vendors. In the future, + filters showing convergence in behavior + across multiple implementations + will be considered for inclusion + in extended or core conformance + levels. Filter-specific configuration + for such filters is specified using + the ExtensionRef field. `Type` should + be set to \"ExtensionRef\" for custom + filters. \n Implementers are encouraged + to define custom implementation + types to extend the core API with + implementation-specific behavior. + \n If a reference to a custom filter + type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests + that would have been processed by + that filter MUST receive a HTTP + error response." enum: - RequestHeaderModifier - RequestMirror @@ -7876,31 +17691,70 @@ spec: type: array group: default: "" + description: Group is the group of the referent. + For example, "networking.k8s.io". When + unspecified (empty string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind of the referent. + For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the namespace + of the backend. When unspecified, the + local namespace is inferred. \n Note that + when a namespace is specified, a ReferencePolicy + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferencePolicy + documentation for details. \n Support: + Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies the destination + port number to use for this resource. + Port is required when the referent is + a Kubernetes Service. For other resources, + destination port might be derived from + the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer weight: default: 1 + description: "Weight specifies the proportion + of requests forwarded to the referenced + backend. This is computed as weight/(sum + of all weights in this BackendRefs list). + For non-zero values, there may be some + epsilon from the exact proportion defined + here depending on the precision an implementation + supports. Weight is not a percentage and + the sum of weights does not need to equal + 100. \n If only one backend is specified + and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. + If weight is set to 0, no traffic should + be forwarded for this entry. If unspecified, + weight defaults to 1. \n Support for this + field varies based on the context where + used." format: int32 maximum: 1000000 minimum: 0 @@ -7911,20 +17765,58 @@ spec: maxItems: 16 type: array filters: + description: "Filters define the filters that + are applied to requests that match this rule. + \n The effects of ordering of multiple behaviors + are currently unspecified. This can change in + the future based on feedback during the alpha + stage. \n Conformance-levels at this level are + defined based on the type of filter: \n - ALL + core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended + filters. - Implementation-specific custom filters + have no API guarantees across implementations. + \n Specifying a core filter multiple times has + unspecified or custom conformance. \n Support: + Core" items: + description: HTTPRouteFilter defines processing + steps that must be completed during the request + or response lifecycle. HTTPRouteFilters are + meant as an extension point to express processing + that may be done in Gateway implementations. + Some examples include request or response + modification, implementing authentication + strategies, rate-limiting, and traffic shaping. + API guarantee/conformance is defined based + on the type of the filter. properties: extensionRef: + description: "ExtensionRef is an optional, + implementation-specific extension to the + \"filter\" behavior. For example, resource + \"myroutefilter\" in group \"networking.example.net\"). + ExtensionRef MUST NOT be used for core + and extended filters. \n Support: Implementation-specific" properties: group: + description: Group is the group of the + referent. For example, "networking.k8s.io". + When unspecified (empty string), core + API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is kind of the referent. + For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the + referent. maxLength: 253 minLength: 1 type: string @@ -7934,16 +17826,47 @@ spec: - name type: object requestHeaderModifier: + description: "RequestHeaderModifier defines + a schema for a filter that modifies request + headers. \n Support: Core" properties: add: + description: "Add adds the given header(s) + (name, value) to the request before + the action. It appends to any existing + values associated with the header + name. \n Input: GET /foo HTTP/1.1 + my-header: foo \n Config: add: - name: + \"my-header\" value: \"bar\" \n Output: + GET /foo HTTP/1.1 my-header: foo my-header: + bar" items: + description: HTTPHeader represents + an HTTP Header name and value as + defined by RFC 7230. properties: name: + description: "Name is the name + of the HTTP Header to be matched. + Name matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify + equivalent header names, the + first entry with an equivalent + name MUST be considered for + a match. Subsequent entries + with an equivalent header name + MUST be ignored. Due to the + case-insensitivity of header + names, \"foo\" and \"Foo\" are + considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value + of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7957,19 +17880,55 @@ spec: - name x-kubernetes-list-type: map remove: + description: "Remove the given header(s) + from the HTTP request before the action. + The value of Remove is a list of HTTP + header names. Note that the header + names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + \n Input: GET /foo HTTP/1.1 my-header1: + foo my-header2: bar my-header3: baz + \n Config: remove: [\"my-header1\", + \"my-header3\"] \n Output: GET /foo + HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: + description: "Set overwrites the request + with the given header (name, value) + before the action. \n Input: GET /foo + HTTP/1.1 my-header: foo \n Config: + set: - name: \"my-header\" value: + \"bar\" \n Output: GET /foo HTTP/1.1 + my-header: bar" items: + description: HTTPHeader represents + an HTTP Header name and value as + defined by RFC 7230. properties: name: + description: "Name is the name + of the HTTP Header to be matched. + Name matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify + equivalent header names, the + first entry with an equivalent + name MUST be considered for + a match. Subsequent entries + with an equivalent header name + MUST be ignored. Due to the + case-insensitivity of header + names, \"foo\" and \"Foo\" are + considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value + of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7984,30 +17943,86 @@ spec: x-kubernetes-list-type: map type: object requestMirror: + description: "RequestMirror defines a schema + for a filter that mirrors requests. Requests + are sent to the specified destination, + but responses from that destination are + ignored. \n Support: Extended" properties: backendRef: + description: "BackendRef references + a resource where mirrored requests + are sent. \n If the referent cannot + be found, this BackendRef is invalid + and must be dropped from the Gateway. + The controller must ensure the \"ResolvedRefs\" + condition on the Route status is set + to `status: False` and not configure + this backend in the underlying implementation. + \n If there is a cross-namespace reference + to an *existing* object that is not + allowed by a ReferencePolicy, the + controller must ensure the \"ResolvedRefs\" + \ condition on the Route is set to + `status: False`, with the \"RefNotPermitted\" + reason and not configure this backend + in the underlying implementation. + \n In either error case, the Message + of the `ResolvedRefs` Condition should + be used to provide more detail about + the problem. \n Support: Extended + for Kubernetes Service Support: Custom + for any other resource" properties: group: default: "" + description: Group is the group + of the referent. For example, + "networking.k8s.io". When unspecified + (empty string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind of the + referent. For example "HTTPRoute" + or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of + the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the namespace + of the backend. When unspecified, + the local namespace is inferred. + \n Note that when a namespace + is specified, a ReferencePolicy + object is required in the referent + namespace to allow that namespace's + owner to accept the reference. + See the ReferencePolicy documentation + for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies the + destination port number to use + for this resource. Port is required + when the referent is a Kubernetes + Service. For other resources, + destination port might be derived + from the referent resource or + this field. format: int32 maximum: 65535 minimum: 1 @@ -8019,30 +18034,81 @@ spec: - backendRef type: object requestRedirect: + description: "RequestRedirect defines a + schema for a filter that responds to the + request with an HTTP redirection. \n Support: + Core" properties: hostname: + description: "Hostname is the hostname + to be used in the value of the `Location` + header in the response. When empty, + the hostname of the request is used. + \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: + description: "Port is the port to be + used in the value of the `Location` + header in the response. When empty, + port (if specified) of the request + is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: + description: "Scheme is the scheme to + be used in the value of the `Location` + header in the response. When empty, + the scheme of the request is used. + \n Support: Extended" enum: - http - https type: string statusCode: default: 302 + description: "StatusCode is the HTTP + status code to be used in response. + \n Support: Core" enum: - 301 - 302 type: integer type: object type: + description: "Type identifies the type of + filter to apply. As with other API fields, + types are classified into three conformance + levels: \n - Core: Filter types and their + corresponding configuration defined by + \"Support: Core\" in this package, e.g. + \"RequestHeaderModifier\". All implementations + must support core filters. \n - Extended: + Filter types and their corresponding configuration + defined by \"Support: Extended\" in this + package, e.g. \"RequestMirror\". Implementers + are encouraged to support extended filters. + \n - Custom: Filters that are defined + and supported by specific vendors. In + the future, filters showing convergence + in behavior across multiple implementations + will be considered for inclusion in extended + or core conformance levels. Filter-specific + configuration for such filters is specified + using the ExtensionRef field. `Type` should + be set to \"ExtensionRef\" for custom + filters. \n Implementers are encouraged + to define custom implementation types + to extend the core API with implementation-specific + behavior. \n If a reference to a custom + filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests + that would have been processed by that + filter MUST receive a HTTP error response." enum: - RequestHeaderModifier - RequestMirror @@ -8059,23 +18125,110 @@ spec: - path: type: PathPrefix value: / + description: "Matches define conditions used for + matching the rule against incoming HTTP requests. + Each match is independent, i.e. this rule will + be matched if **any** one of the matches is + satisfied. \n For example, take the following + matches configuration: \n ``` matches: - path: + value: \"/foo\" headers: - name: \"version\" + value: \"v2\" - path: value: \"/v2/foo\" ``` + \n For a request to match against this rule, + a request must satisfy EITHER of the two conditions: + \n - path prefixed with `/foo` AND contains + the header `version: v2` - path prefix of `/v2/foo` + \n See the documentation for HTTPRouteMatch + on how to specify multiple match conditions + that should be ANDed together. \n If no matches + are specified, the default is a prefix path + match on \"/\", which has the effect of matching + every HTTP request. \n Proxy or Load Balancer + routing configuration generated from HTTPRoutes + MUST prioritize rules based on the following + criteria, continuing on ties. Precedence must + be given to the the Rule with the largest number + of: \n * Characters in a matching non-wildcard + hostname. * Characters in a matching hostname. + * Characters in a matching path. * Header matches. + * Query param matches. \n If ties still exist + across multiple Routes, matching precedence + MUST be determined in order of the following + criteria, continuing on ties: \n * The oldest + Route based on creation timestamp. * The Route + appearing first in alphabetical order by \"/\". + \n If ties still exist within the Route that + has been given precedence, matching precedence + MUST be granted to the first matching rule meeting + the above criteria." items: + description: "HTTPRouteMatch defines the predicate + used to match requests to a given action. + Multiple match types are ANDed together, i.e. + the match will evaluate to true only if all + conditions are satisfied. \n For example, + the match below will match a HTTP request + only if its path starts with `/foo` AND it + contains the `version: v1` header: \n ``` + match: path: value: \"/foo\" headers: - name: + \"version\" value \"v1\" ```" properties: headers: + description: Headers specifies HTTP request + header matchers. Multiple match values + are ANDed together, meaning, a request + must match all the specified headers to + select the route. items: + description: HTTPHeaderMatch describes + how to select a HTTP route by matching + HTTP request headers. properties: name: + description: "Name is the name of + the HTTP Header to be matched. Name + matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify equivalent + header names, only the first entry + with an equivalent name MUST be + considered for a match. Subsequent + entries with an equivalent header + name MUST be ignored. Due to the + case-insensitivity of header names, + \"foo\" and \"Foo\" are considered + equivalent. \n When a header is + repeated in an HTTP request, it + is implementation-specific behavior + as to how this is represented. Generally, + proxies should follow the guidance + from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 + regarding processing a repeated + header, with special handling for + \"Set-Cookie\"." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string type: default: Exact + description: "Type specifies how to + match against the value of the header. + \n Support: Core (Exact) \n Support: + Custom (RegularExpression) \n Since + RegularExpression HeaderMatchType + has custom conformance, implementations + can support POSIX, PCRE or any other + dialects of regular expressions. + Please read the implementation's + documentation to determine the supported + dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of + HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -8089,6 +18242,10 @@ spec: - name x-kubernetes-list-type: map method: + description: "Method specifies HTTP method + matcher. When specified, this route will + be matched only if the request has the + specified method. \n Support: Extended" enum: - GET - HEAD @@ -8104,9 +18261,17 @@ spec: default: type: PathPrefix value: / + description: Path specifies a HTTP request + path matcher. If this field is not specified, + a default prefix match on the "/" path + is provided. properties: type: default: PathPrefix + description: "Type specifies how to + match against the path Value. \n Support: + Core (Exact, PathPrefix) \n Support: + Custom (RegularExpression)" enum: - Exact - PathPrefix @@ -8114,23 +18279,50 @@ spec: type: string value: default: / + description: Value of the HTTP path + to match against. maxLength: 1024 type: string type: object queryParams: + description: QueryParams specifies HTTP + query parameter matchers. Multiple match + values are ANDed together, meaning, a + request must match all the specified query + parameters to select the route. items: + description: HTTPQueryParamMatch describes + how to select a HTTP route by matching + HTTP query parameters. properties: name: + description: Name is the name of the + HTTP query param to be matched. + This must be an exact string match. + (See https://tools.ietf.org/html/rfc7230#section-2.7.3). maxLength: 256 minLength: 1 type: string type: default: Exact + description: "Type specifies how to + match against the value of the query + parameter. \n Support: Extended + (Exact) \n Support: Custom (RegularExpression) + \n Since RegularExpression QueryParamMatchType + has custom conformance, implementations + can support POSIX, PCRE or any other + dialects of regular expressions. + Please read the implementation's + documentation to determine the supported + dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of + HTTP query param to be matched. maxLength: 1024 minLength: 1 type: string @@ -8154,41 +18346,54 @@ spec: inputs: items: properties: - dap: + dapr: properties: name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string topic: type: string type: + description: Type is the type of the component, if + it is not set, controller will get it automatically. type: string required: - name type: object - required: - - dap type: object type: array type: object workloadType: + description: How to run the function, known values are Deployment + or StatefulSet, default is Deployment. type: string type: object version: + description: Function version in format like v1.0.0 type: string workloadRuntime: default: OCIContainer + description: 'WorkloadRuntime for Function. Know values: ``` OCIContainer: + Nodes will run standard OCI container workloads. WasmEdge: Nodes will + run workloads using the crun (with WasmEdge support). ```' type: string required: - image type: object status: + description: FunctionStatus defines the observed state of Function properties: addresses: + description: Addresses holds the addresses that used to access the Function. items: properties: type: + description: Type of the address. type: string value: + description: Value of the address. maxLength: 253 minLength: 1 type: string @@ -8199,6 +18404,8 @@ spec: type: array build: properties: + buildDuration: + type: string lastSuccessfulResourceRef: type: string message: @@ -8222,30 +18429,67 @@ spec: route: properties: conditions: + description: Conditions describes the status of the route with respect + to the Gateway. Note that the route's availability is also subject + to the Gateway's own status conditions and listener status. items: + description: "Condition contains details for one aspect of the + current state of this API Resource. --- This struct is intended + for direct use as an array at the field path .status.conditions. + \ For example, \n type FooStatus struct{ // Represents the observations + of a foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + // +patchStrategy=merge // +listType=map // +listMapKey=type + Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" properties: lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be + when the underlying condition changed. If that is not known, + then using the time when the API field changed is acceptable. format: date-time type: string message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if + .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. format: int64 minimum: 0 type: integer reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: + description: status of the condition, one of True, False, + Unknown. enum: - "True" - "False" - Unknown type: string type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict + is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string @@ -8263,7 +18507,20 @@ spec: - type x-kubernetes-list-type: map hosts: + description: Hosts list all actual hostnames of HTTPRoute. items: + description: "Hostname is the fully qualified domain name of a + network host. This matches the RFC 1123 definition of a hostname + with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname + may be prefixed with a wildcard label (`*.`). The wildcard label + must appear by itself as the first label. \n Hostname can be + \"precise\" which is a domain name without the terminating dot + of a network host (e.g. \"foo.example.com\") or \"wildcard\", + which is a domain name prefixed with a single wildcard label + (e.g. `*.example.com`). \n Note that as per RFC1035 and RFC1123, + a *label* must consist of lower case alphanumeric characters + or '-', and must start and end with an alphanumeric character. + No other punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ @@ -8271,10 +18528,16 @@ spec: maxItems: 16 type: array paths: + description: Paths list all actual paths of HTTPRoute. items: + description: HTTPPathMatch describes how to select a HTTP route + by matching the HTTP request path. properties: type: default: PathPrefix + description: "Type specifies how to match against the path + Value. \n Support: Core (Exact, PathPrefix) \n Support: + Custom (RegularExpression)" enum: - Exact - PathPrefix @@ -8282,6 +18545,7 @@ spec: type: string value: default: / + description: Value of the HTTP path to match against. maxLength: 1024 type: string type: object @@ -8290,6 +18554,8 @@ spec: type: object serving: properties: + buildDuration: + type: string lastSuccessfulResourceRef: type: string message: @@ -8306,23 +18572,39 @@ spec: type: string type: object sources: + description: Sources holds the results emitted from the step definition + of different sources items: + description: SourceResult holds the results emitted from the different + sources properties: bundle: + description: Bundle holds the results emitted from from the step + definition of bundle source properties: digest: + description: Digest hold the image digest result type: string type: object git: + description: Git holds the results emitted from from the step + definition of a git source properties: branchName: + description: BranchName holds the default branch name of the + git source this will be set only when revision is not specified + in Build object type: string commitAuthor: + description: CommitAuthor holds the commit author of a git + source type: string commitSha: + description: CommitSha holds the commit sha of git source type: string type: object name: + description: Name is the name of source type: string required: - name diff --git a/openfunction/crds/gateway.yaml b/openfunction/crds/gateway.yaml index ef6cff7..e5cb8ef 100644 --- a/openfunction/crds/gateway.yaml +++ b/openfunction/crds/gateway.yaml @@ -24,31 +24,47 @@ spec: name: v1alpha1 schema: openAPIV3Schema: + description: Gateway is the Schema for the gateways API properties: apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: + description: GatewaySpec defines the desired state of Gateway properties: clusterDomain: default: cluster.local + description: Used to generate the hostname field of gatewaySpec.listeners.openfunction.hostname type: string domain: + description: Used to generate the hostname field of gatewaySpec.listeners.openfunction.hostname type: string gatewayDef: + description: Definition to a new K8s gateway properties: gatewayClassName: + description: GatewayClassName used for this Gateway. This is the + name of a GatewayClass resource. maxLength: 253 minLength: 1 type: string name: + description: Name is the name of the referent. It refers to the + name of a k8s Gateway resource. maxLength: 253 minLength: 1 type: string namespace: + description: Namespace is the namespace of the referent. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ @@ -58,12 +74,17 @@ spec: - namespace type: object gatewayRef: + description: Reference to an existing K8s gateway properties: name: + description: Name is the name of the referent. It refers to the + name of a k8s Gateway resource. maxLength: 253 minLength: 1 type: string namespace: + description: Namespace is the namespace of the referent. It refers + to a k8s namespace. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ @@ -73,24 +94,67 @@ spec: - namespace type: object gatewaySpec: + description: GatewaySpec defines the desired state of k8s Gateway. properties: listeners: + description: "Listeners associated with this Gateway. Listeners + define logical endpoints that are bound on this Gateway's addresses. + At least one Listener MUST be specified. \n Each listener in a + Gateway must have a unique combination of Hostname, Port, and + Protocol." items: + description: Listener embodies the concept of a logical endpoint + where a Gateway accepts network connections. properties: allowedRoutes: default: namespaces: from: Same + description: "AllowedRoutes defines the types of routes that + MAY be attached to a Listener and the trusted namespaces + where those Route resources MAY be present. \n Although + a client request may match multiple route rules, only one + rule may ultimately receive the request. Matching precedence + MUST be determined in order of the following criteria: \n + * The most specific match as defined by the Route type. + * The oldest Route based on creation timestamp. For example, + a Route with a creation timestamp of \"2020-09-08 01:02:03\" + is given precedence over a Route with a creation timestamp + of \"2020-09-08 01:02:04\". * If everything else is equivalent, + the Route appearing first in alphabetical order (namespace/name) + should be given precedence. For example, foo/bar is given + precedence over foo/baz. \n All valid rules within a Route + attached to this Listener should be implemented. Invalid + Route rules can be ignored (sometimes that will mean the + full Route). If a Route rule transitions from valid to invalid, + support for that Route rule should be dropped to ensure + consistency. For example, even if a filter specified by + a Route rule is invalid, the rest of the rules within that + Route should still be supported. \n Support: Core" properties: kinds: + description: "Kinds specifies the groups and kinds of + Routes that are allowed to bind to this Gateway Listener. + When unspecified or empty, the kinds of Routes selected + are determined using the Listener protocol. \n A RouteGroupKind + MUST correspond to kinds of Routes that are compatible + with the application protocol specified in the Listener's + Protocol field. If an implementation does not support + or recognize this resource type, it MUST set the \"ResolvedRefs\" + condition to False for this Listener with the \"InvalidRoutesRef\" + reason. \n Support: Core" items: + description: RouteGroupKind indicates the group and + kind of a Route resource. properties: group: default: gateway.networking.k8s.io + description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ @@ -103,24 +167,57 @@ spec: namespaces: default: from: Same + description: "Namespaces indicates namespaces from which + Routes may be attached to this Listener. This is restricted + to the namespace of this Gateway by default. \n Support: + Core" properties: from: default: Same + description: "From indicates where Routes will be + selected for this Gateway. Possible values are: + * All: Routes in all namespaces may be used by this + Gateway. * Selector: Routes in namespaces selected + by the selector may be used by this Gateway. * Same: + Only Routes in the same namespace may be used by + this Gateway. \n Support: Core" enum: - All - Selector - Same type: string selector: + description: "Selector must be specified when From + is set to \"Selector\". In that case, only Routes + in Namespaces matching this Selector will be selected + by this Gateway. This field is ignored for other + values of \"From\". \n Support: Core" properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -132,51 +229,132 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic type: object type: object hostname: + description: "Hostname specifies the virtual hostname to match + for protocol types that define this concept. When unspecified, + all hostnames are matched. This field is ignored for protocols + that don't require hostname based matching. \n Implementations + MUST apply Hostname matching appropriately for each of the + following protocols: \n * TLS: The Listener Hostname MUST + match the SNI. * HTTP: The Listener Hostname MUST match + the Host header of the request. * HTTPS: The Listener Hostname + SHOULD match at both the TLS and HTTP protocol layers as + described above. If an implementation does not ensure that + both the SNI and Host header match the Listener hostname, + it MUST clearly document that. \n For HTTPRoute and TLSRoute + resources, there is an interaction with the `spec.hostnames` + array. When both listener and route specify hostnames, there + MUST be an intersection between the values for a Route to + be accepted. For more information, refer to the Route specific + Hostnames documentation. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string name: + description: "Name is the name of the Listener. \n Support: + Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: + description: "Port is the network port. Multiple listeners + may use the same port, subject to the Listener compatibility + rules. \n Support: Core" format: int32 maximum: 65535 minimum: 1 type: integer protocol: + description: "Protocol specifies the network protocol this + listener expects to receive. \n Support: Core" maxLength: 255 minLength: 1 pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ type: string tls: + description: "TLS is the TLS configuration for the Listener. + This field is required if the Protocol field is \"HTTPS\" + or \"TLS\". It is invalid to set this field if the Protocol + field is \"HTTP\", \"TCP\", or \"UDP\". \n The association + of SNIs to Certificate defined in GatewayTLSConfig is defined + based on the Hostname field for this listener. \n The GatewayClass + MUST use the longest matching SNI out of all available certificates + for any TLS handshake. \n Support: Core" properties: certificateRefs: + description: "CertificateRefs contains a series of references + to Kubernetes objects that contains TLS certificates + and private keys. These certificates are used to establish + a TLS handshake for requests that match the hostname + of the associated listener. \n A single CertificateRef + to a Kubernetes Secret has \"Core\" support. Implementations + MAY choose to support attaching multiple certificates + to a Listener, but this behavior is implementation-specific. + \n References to a resource in different namespace are + invalid UNLESS there is a ReferencePolicy in the target + namespace that allows the certificate to be attached. + If a ReferencePolicy does not allow this reference, + the \"ResolvedRefs\" condition MUST be set to False + for this listener with the \"InvalidCertificateRef\" + reason. \n This field is required to have at least one + element when the mode is set to \"Terminate\" (default) + and is optional otherwise. \n CertificateRefs can reference + to standard Kubernetes resources, i.e. Secret, or implementation-specific + custom resources. \n Support: Core - A single reference + to a Kubernetes Secret \n Support: Implementation-specific + (More than one reference or other resource types)" items: + description: "SecretObjectReference identifies an API + object including its namespace, defaulting to Secret. + \n The API object must be valid in the cluster; the + Group and Kind must be registered in the cluster for + this reference to be valid. \n References to objects + with invalid Group and Kind are not valid, and must + be rejected by the implementation, with appropriate + Conditions set on the containing object." properties: group: default: "" + description: Group is the group of the referent. + For example, "networking.k8s.io". When unspecified + (empty string), core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Secret + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the namespace of the + backend. When unspecified, the local namespace + is inferred. \n Note that when a namespace is + specified, a ReferencePolicy object is required + in the referent namespace to allow that namespace's + owner to accept the reference. See the ReferencePolicy + documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ @@ -188,15 +366,40 @@ spec: type: array mode: default: Terminate + description: "Mode defines the TLS behavior for the TLS + session initiated by the client. There are two possible + modes: \n - Terminate: The TLS session between the downstream + client and the Gateway is terminated at the Gateway. + This mode requires certificateRefs to be set and contain + at least one element. - Passthrough: The TLS session + is NOT terminated by the Gateway. This implies that + the Gateway can't decipher the TLS stream except for + the ClientHello message of the TLS protocol. CertificateRefs + field is ignored in this mode. \n Support: Core" enum: - Terminate - Passthrough type: string options: additionalProperties: + description: AnnotationValue is the value of an annotation + in Gateway API. This is used for validation of maps + such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation + in that case is based on the entire size of the annotations + struct. maxLength: 4096 minLength: 0 type: string + description: "Options are a list of key/value pairs to + enable extended TLS configuration for each implementation. + For example, configuring the minimum TLS version or + supported cipher suites. \n A set of common keys MAY + be defined by the API in the future. To avoid any ambiguity, + implementation-specific definitions MUST use domain-prefixed + names, such as `example.com/my-custom-option`. Un-prefixed + names are reserved for key names defined by Gateway + API. \n Support: Implementation-specific" maxProperties: 16 type: object type: object @@ -215,30 +418,42 @@ spec: type: object hostTemplate: default: '{{.Name}}.{{.Namespace}}.{{.Domain}}' + description: Used to generate the hostname of attaching HTTPRoute type: string httpRouteLabelKey: default: app.kubernetes.io/managed-by + description: Label key to add to the HTTPRoute generated by function + The value will be the `gateway.openfunction.openfunction.io` CR's + namespaced name type: string pathTemplate: default: '{{.Namespace}}/{{.Name}}' + description: Used to generate the path of attaching HTTPRoute type: string required: - domain - gatewaySpec type: object status: + description: GatewayStatus defines the observed state of Gateway properties: addresses: items: + description: GatewayAddress describes an address that can be bound + to a Gateway. properties: type: default: IPAddress + description: Type of the address. enum: - IPAddress - Hostname - NamedAddress type: string value: + description: "Value of the address. The validity of the values + will depend on the type and support by the controller. \n Examples: + `1.2.3.4`, `128::1`, `my-ip-address`." maxLength: 253 minLength: 1 type: string @@ -253,6 +468,8 @@ spec: reason: NotReconciled status: Unknown type: Scheduled + description: "Conditions describe the current conditions of the Gateway. + \n Known condition types are: \n * \"Scheduled\" * \"Ready\"" items: properties: message: @@ -275,12 +492,18 @@ spec: - type x-kubernetes-list-type: map listeners: + description: Listeners provide status for each unique listener port + defined in the Spec. items: properties: attachedRoutes: + description: AttachedRoutes represents the total number of Routes + that have been successfully attached to this Listener. format: int32 type: integer conditions: + description: Conditions describe the current condition of this + listener. items: properties: message: @@ -303,19 +526,34 @@ spec: - type x-kubernetes-list-type: map name: + description: Name is the name of the Listener that this status + corresponds to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string supportedKinds: + description: "SupportedKinds is the list indicating the Kinds + supported by this listener. This MUST represent the kinds an + implementation supports for that Listener configuration. \n + If kinds are specified in Spec that are not supported, they + MUST NOT appear in this list and an implementation MUST set + the \"ResolvedRefs\" condition to \"False\" with the \"InvalidRouteKinds\" + reason. If both valid and invalid Route kinds are specified, + the implementation MUST reference the valid Route kinds that + have been specified." items: + description: RouteGroupKind indicates the group and kind of + a Route resource. properties: group: default: gateway.networking.k8s.io + description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ diff --git a/openfunction/crds/serving.yaml b/openfunction/crds/serving.yaml index 001cdfa..854a9c6 100644 --- a/openfunction/crds/serving.yaml +++ b/openfunction/crds/serving.yaml @@ -1,8 +1,6 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.4.1 name: servings.core.openfunction.io spec: conversion: @@ -37,21 +35,31 @@ spec: name: v1beta1 schema: openAPIV3Schema: + description: Serving is the Schema for the servings API properties: apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: + description: ServingSpec defines the desired state of Serving properties: annotations: additionalProperties: type: string + description: Annotations that will be add to the workload. type: object bindings: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -59,10 +67,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret holding + the value for the metadata item. Name is the secret name, + and key is the field in the secret. properties: key: type: string @@ -73,7 +85,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct for + the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -88,28 +101,43 @@ spec: - type - version type: object + description: Configurations of dapr bindings components. type: object image: + description: Function image name type: string imageCredentials: + description: ImageCredentials references a Secret that contains credentials + to access the image repository. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic inputs: + description: Function inputs from Dapr components including binding, + pubsub Available for Async Runtime only. items: properties: component: + description: Component indicates the name of components in Dapr type: string name: + description: The name of DaprIO. type: string operation: + description: Operation field tells the Dapr component which operation + it should perform. type: string params: additionalProperties: type: string + description: Parameters for dapr input/output. type: object topic: + description: Topic name of mq, required when type is pubsub type: string required: - component @@ -119,21 +147,30 @@ spec: labels: additionalProperties: type: string + description: Parameters of OpenFuncAsync runtime. type: object outputs: + description: Function outputs from Dapr components including binding, + pubsub items: properties: component: + description: Component indicates the name of components in Dapr type: string name: + description: The name of DaprIO. type: string operation: + description: Operation field tells the Dapr component which operation + it should perform. type: string params: additionalProperties: type: string + description: Parameters for dapr input/output. type: object topic: + description: Topic name of mq, required when type is pubsub type: string required: - component @@ -143,12 +180,17 @@ spec: params: additionalProperties: type: string + description: Parameters to pass to the serving. All parameters will + be injected into the pod as environment variables. Function code can + use these parameters by getting environment variables type: object port: + description: The port on which the function will be invoked format: int32 type: integer pubsub: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -156,10 +198,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret holding + the value for the metadata item. Name is the secret name, + and key is the field in the secret. properties: key: type: string @@ -170,7 +216,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct for + the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -185,13 +232,17 @@ spec: - type - version type: object + description: Configurations of dapr pubsub components. type: object runtime: + description: The configuration of the backend runtime for running function. enum: - knative - async type: string scaleOptions: + description: The ScaleOptions will help us to set up guidelines for + the autoscaling of function workloads. properties: keda: properties: @@ -207,14 +258,19 @@ spec: format: int32 type: integer restartPolicy: + description: Restart policy for all containers within the + pod. One of 'OnFailure', 'Never'. Default to 'Never'. type: string scalingStrategy: + description: ScalingStrategy defines the strategy of Scaling properties: customScalingQueueLengthDeduction: format: int32 type: integer customScalingRunningJobPercentage: type: string + multipleScalersCalculation: + type: string pendingPodConditions: items: type: string @@ -229,22 +285,54 @@ spec: scaledObject: properties: advanced: + description: AdvancedConfig specifies advance scaling options properties: horizontalPodAutoscalerConfig: + description: HorizontalPodAutoscalerConfig specifies + horizontal scale config properties: behavior: + description: HorizontalPodAutoscalerBehavior configures + the scaling behavior of the target in both Up + and Down directions (scaleUp and scaleDown fields + respectively). properties: scaleDown: + description: scaleDown is scaling policy for + scaling Down. If not set, the default value + is to allow to scale down to minReplicas pods, + with a 300 second stabilization window (i.e., + the highest recommendation for the last 300sec + is used). properties: policies: + description: policies is a list of potential + scaling polices which can be used during + scaling. At least one policy must be specified, + otherwise the HPAScalingRules will be + discarded as invalid items: + description: HPAScalingPolicy is a single + policy which must hold true for a specified + past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which the + policy should hold true. PeriodSeconds + must be greater than zero and less + than or equal to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the amount + of change which is permitted by + the policy. It must be greater than + zero format: int32 type: integer required: @@ -253,23 +341,63 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to specify + which policy should be used. If not set, + the default value Max is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which past + recommendations should be considered while + scaling up or scaling down. StabilizationWindowSeconds + must be greater than or equal to zero + and less than or equal to 3600 (one hour). + If not set, use the default values: - + For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object scaleUp: + description: 'scaleUp is scaling policy for + scaling Up. If not set, the default value + is the higher of: * increase no more than + 4 pods per 60 seconds * double the number + of pods per 60 seconds No stabilization is + used.' properties: policies: + description: policies is a list of potential + scaling polices which can be used during + scaling. At least one policy must be specified, + otherwise the HPAScalingRules will be + discarded as invalid items: + description: HPAScalingPolicy is a single + policy which must hold true for a specified + past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which the + policy should hold true. PeriodSeconds + must be greater than zero and less + than or equal to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the amount + of change which is permitted by + the policy. It must be greater than + zero format: int32 type: integer required: @@ -278,13 +406,30 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to specify + which policy should be used. If not set, + the default value Max is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which past + recommendations should be considered while + scaling up or scaling down. StabilizationWindowSeconds + must be greater than or equal to zero + and less than or equal to 3600 (one hour). + If not set, use the default values: - + For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object type: object + name: + type: string type: object restoreToOriginalReplicaCount: type: boolean @@ -302,12 +447,16 @@ spec: format: int32 type: integer workloadType: + description: How to run the function, known values are Deployment + or StatefulSet, default is Deployment. type: string type: object type: object knative: additionalProperties: type: string + description: Refer to https://knative.dev/docs/serving/autoscaling/ + to learn more about the autoscaling options of Knative Serving. type: object maxReplicas: format: int32 @@ -318,6 +467,7 @@ spec: type: object states: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -325,10 +475,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret holding + the value for the metadata item. Name is the secret name, + and key is the field in the secret. properties: key: type: string @@ -339,7 +493,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct for + the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -354,29 +509,78 @@ spec: - type - version type: object + description: Configurations of dapr state components. type: object template: + description: Template describes the pods that will be created. The container + named `function` is the container which is used to run the image built + by the builder. If it is not set, the controller will automatically + add one. properties: activeDeadlineSeconds: + description: Optional duration in seconds the pod may be active + on the node relative to StartTime before the system will actively + try to mark it failed and kill associated containers. Value must + be a positive integer. format: int64 type: integer affinity: + description: If specified, the pod's scheduling constraints properties: nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the node + matches the corresponding matchExpressions; the node(s) + with the highest sum are the most preferred. items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). properties: preference: + description: A node selector term, associated with + the corresponding weight. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -386,13 +590,33 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -402,7 +626,10 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: @@ -411,18 +638,51 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not + be scheduled onto the node. If the affinity requirements + specified by this field cease to be met at some point + during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its + node. properties: nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. + The TopologySelectorTerm type implements a subset + of the NodeSelectorTerm. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -432,13 +692,33 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -448,28 +728,70 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic type: array required: - nodeSelectorTerms type: object + x-kubernetes-map-type: atomic type: object podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the node + has pods which matches the corresponding podAffinityTerm; + the node(s) with the highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -481,18 +803,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -504,18 +860,42 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. format: int32 type: integer required: @@ -524,18 +904,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not + be scheduled onto the node. If the affinity requirements + specified by this field cease to be met at some point + during pod execution (e.g. due to a pod label update), + the system may or may not try to eventually evict the + pod from its node. When there are multiple elements, the + lists of nodes corresponding to each podAffinityTerm are + intersected, i.e. all terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not + co-located (anti-affinity) with, where co-located is + defined as running on a node whose value of the label + with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -547,18 +962,49 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to + the union of the namespaces selected by this field + and the ones listed in the namespaces field. null + selector and null or empty namespaces list means + "this pod's namespace". An empty selector ({}) matches + all namespaces. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -570,13 +1016,33 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list of + namespace names that the term applies to. The term + is applied to the union of the namespaces listed + in this field and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey matches + that of any node on which any of the selected pods + is running. Empty topologyKey is not allowed. type: string required: - topologyKey @@ -584,22 +1050,64 @@ spec: type: array type: object podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling anti-affinity + expressions, etc.), compute a sum by iterating through + the elements of this field and adding "weight" to the + sum if the node has pods which matches the corresponding + podAffinityTerm; the node(s) with the highest sum are + the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -611,18 +1119,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -634,18 +1176,42 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. format: int32 type: integer required: @@ -654,18 +1220,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified + by this field are not met at scheduling time, the pod + will not be scheduled onto the node. If the anti-affinity + requirements specified by this field cease to be met at + some point during pod execution (e.g. due to a pod label + update), the system may or may not try to eventually evict + the pod from its node. When there are multiple elements, + the lists of nodes corresponding to each podAffinityTerm + are intersected, i.e. all terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not + co-located (anti-affinity) with, where co-located is + defined as running on a node whose value of the label + with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -677,18 +1278,49 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to + the union of the namespaces selected by this field + and the ones listed in the namespaces field. null + selector and null or empty namespaces list means + "this pod's namespace". An empty selector ({}) matches + all namespaces. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -700,13 +1332,33 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list of + namespace names that the term applies to. The term + is applied to the union of the namespaces listed + in this field and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey matches + that of any node on which any of the selected pods + is running. Empty topologyKey is not allowed. type: string required: - topologyKey @@ -715,124 +1367,270 @@ spec: type: object type: object automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service + account token should be automatically mounted. type: boolean containers: + description: List of containers belonging to the pod. Containers + cannot currently be added or removed. There must be at least one + container in a Pod. Cannot be updated. items: + description: A single application container that you want to run + within a pod. properties: args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the input + string will be unchanged. Double $$ are reduced to a single + $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of + whether the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded using + the container''s environment. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double + $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references will + never be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -840,49 +1638,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -890,25 +1737,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -916,37 +1779,71 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -954,62 +1851,129 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -1020,37 +1984,71 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the + probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1058,47 +2056,111 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -1106,6 +2168,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -1114,101 +2178,261 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields of + SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed + until this completes successfully. If this probe fails, + the Pod will be restarted, just as if the livenessProbe + failed. This can be used to provide different probe parameters + at the beginning of a Pod''s lifecycle, when it might take + a long time to load data or warm a cache, than during steady-state + operation. This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1216,61 +2440,141 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -1278,19 +2582,41 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -1298,152 +2624,329 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array dnsConfig: + description: Specifies the DNS parameters of a pod. Parameters specified + here will be merged to the generated DNS configuration based on + DNSPolicy. properties: nameservers: + description: A list of DNS name server IP addresses. This will + be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array options: + description: A list of DNS resolver options. This will be merged + with the base options generated from DNSPolicy. Duplicated + entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: Required. type: string value: type: string type: object type: array searches: + description: A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from + DNSPolicy. Duplicated search paths will be removed. items: type: string type: array type: object dnsPolicy: + description: Set DNS policy for the pod. Defaults to "ClusterFirst". + Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' + or 'None'. DNS parameters given in DNSConfig will be merged with + the policy selected with DNSPolicy. To have DNS options set along + with hostNetwork, you have to specify DNS policy explicitly to + 'ClusterFirstWithHostNet'. type: string enableServiceLinks: + description: 'EnableServiceLinks indicates whether information about + services should be injected into pod''s environment variables, + matching the syntax of Docker links. Optional: Defaults to true.' type: boolean ephemeralContainers: + description: List of ephemeral containers run in this pod. Ephemeral + containers may be run in an existing pod to perform user-initiated + actions such as debugging. This list cannot be specified when + creating a pod, and it cannot be modified by updating the pod + spec. In order to add an ephemeral container to an existing pod, + use the pod's ephemeralcontainers subresource. items: + description: "An EphemeralContainer is a temporary container that + you may add to an existing Pod for user-initiated activities + such as debugging. Ephemeral containers have no resource or + scheduling guarantees, and they will not be restarted when they + exit or when a Pod is removed or restarted. The kubelet may + evict a Pod if an ephemeral container causes the Pod to exceed + its resource allocation. \n To add an ephemeral container, use + the ephemeralcontainers subresource of an existing Pod. Ephemeral + containers may not be removed or restarted." properties: args: + description: 'Arguments to the entrypoint. The image''s CMD + is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which + allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string literal + "$(VAR_NAME)". Escaped references will never be expanded, + regardless of whether the variable exists or not. Cannot + be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Lifecycle is not allowed for ephemeral containers. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1451,49 +2954,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1501,25 +3053,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -1527,37 +3095,69 @@ spec: type: object type: object livenessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1565,62 +3165,123 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the ephemeral container specified as + a DNS_LABEL. This name must be unique among all containers, + init containers and ephemeral containers. type: string ports: + description: Ports are not allowed for ephemeral containers. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -1631,37 +3292,69 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1669,47 +3362,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: Resources are not allowed for ephemeral containers. + Ephemeral containers use spare resources already allocated + to the pod. properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -1717,6 +3475,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -1725,101 +3485,254 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'Optional: SecurityContext defines the security + options the ephemeral container should be run with. If set, + the fields of SecurityContext override the equivalent fields + of PodSecurityContext.' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -1827,63 +3740,151 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean targetContainerName: + description: "If set, the name of the container from PodSpec + that this ephemeral container targets. The ephemeral container + will be run in the namespaces (IPC, PID, etc) of this container. + If not set then the ephemeral container uses the namespaces + configured in the Pod spec. \n The container runtime must + implement support for this feature. If the runtime does + not support namespace targeting then the result of setting + this field is undefined." type: string terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -1891,19 +3892,42 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Subpath mounts are not allowed for ephemeral containers. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -1911,154 +3935,349 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array hostAliases: + description: HostAliases is an optional list of hosts and IPs that + will be injected into the pod's hosts file if specified. This + is only valid for non-hostNetwork pods. items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array ip: + description: IP address of the host file entry. type: string type: object type: array hostIPC: + description: 'Use the host''s ipc namespace. Optional: Default to + false.' type: boolean hostNetwork: + description: Host networking requested for this pod. Use the host's + network namespace. If this option is set, the ports that will + be used must be specified. Default to false. type: boolean hostPID: + description: 'Use the host''s pid namespace. Optional: Default to + false.' + type: boolean + hostUsers: + description: 'Use the host''s user namespace. Optional: Default + to true. If set to true or not present, the pod will be run in + the host user namespace, useful for when the pod needs a feature + only available to the host user namespace, such as loading a kernel + module with CAP_SYS_MODULE. When set to false, a new userns is + created for the pod. Setting false is useful for mitigating container + breakout vulnerabilities even allowing users to run their containers + as root without actually having root privileges on the host. This + field is alpha-level and is only honored by servers that enable + the UserNamespacesSupport feature.' type: boolean hostname: + description: Specifies the hostname of the Pod If not specified, + the pod's hostname will be set to a system-defined value. type: string imagePullSecrets: + description: 'ImagePullSecrets is an optional list of references + to secrets in the same namespace to use for pulling any of the + images used by this PodSpec. If specified, these secrets will + be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic type: array initContainers: + description: 'List of initialization containers belonging to the + pod. Init containers are executed in order prior to containers + being started. If any init container fails, the pod is considered + to have failed and is handled according to its restartPolicy. + The name for an init container or normal container must be unique + among all containers. Init containers may not have Lifecycle actions, + Readiness probes, Liveness probes, or Startup probes. The resourceRequirements + of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and + then using the max of of that value or the sum of the normal containers. + Limits are applied to init containers in a similar fashion. Init + containers cannot currently be added or removed. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' items: + description: A single application container that you want to run + within a pod. properties: args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the input + string will be unchanged. Double $$ are reduced to a single + $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of + whether the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded using + the container''s environment. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double + $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references will + never be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2066,49 +4285,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2116,25 +4384,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -2142,37 +4426,71 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2180,62 +4498,129 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -2246,37 +4631,71 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the + probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2284,47 +4703,111 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -2332,6 +4815,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -2340,101 +4825,261 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields of + SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed + until this completes successfully. If this probe fails, + the Pod will be restarted, just as if the livenessProbe + failed. This can be used to provide different probe parameters + at the beginning of a Pod''s lifecycle, when it might take + a long time to load data or warm a cache, than during steady-state + operation. This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -2442,61 +5087,141 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -2504,19 +5229,41 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -2524,21 +5271,50 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array nodeName: + description: NodeName is a request to schedule this pod onto a specific + node. If it is non-empty, the scheduler simply schedules this + pod onto that node, assuming that it fits resource requirements. type: string nodeSelector: additionalProperties: type: string + description: 'NodeSelector is a selector which must be true for + the pod to fit on a node. Selector which must match a node''s + labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' type: object x-kubernetes-map-type: atomic os: + description: "Specifies the OS of the containers in the pod. Some + pod and container fields are restricted if this is set. \n If + the OS field is set to linux, the following fields must be unset: + -securityContext.windowsOptions \n If the OS field is set to windows, + following fields must be unset: - spec.hostPID - spec.hostIPC + - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile + - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy + - spec.securityContext.sysctls - spec.shareProcessNamespace - + spec.securityContext.runAsUser - spec.securityContext.runAsGroup + - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions + - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities + - spec.containers[*].securityContext.readOnlyRootFilesystem - + spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation + - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser + - spec.containers[*].securityContext.runAsGroup" properties: name: + description: 'Name is the name of the operating system. The + currently supported values are linux and windows. Additional + value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration + Clients should expect to handle additional values and treat + unrecognized values in this field as os: null' type: string required: - name @@ -2550,75 +5326,271 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Overhead represents the resource overhead associated + with running a pod for a given RuntimeClass. This field will be + autopopulated at admission time by the RuntimeClass admission + controller. If the RuntimeClass admission controller is enabled, + overhead must not be set in Pod create requests. The RuntimeClass + admission controller will reject Pod create requests which have + the overhead already set. If RuntimeClass is configured and selected + in the PodSpec, Overhead will be set to the value defined in the + corresponding RuntimeClass, otherwise it will remain unset and + treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' type: object preemptionPolicy: + description: PreemptionPolicy is the Policy for preempting pods + with lower priority. One of Never, PreemptLowerPriority. Defaults + to PreemptLowerPriority if unset. type: string priority: + description: The priority value. Various system components use this + field to find the priority of the pod. When Priority Admission + Controller is enabled, it prevents users from setting this field. + The admission controller populates this field from PriorityClassName. + The higher the value, the higher the priority. format: int32 type: integer priorityClassName: + description: If specified, indicates the pod's priority. "system-node-critical" + and "system-cluster-critical" are two special keywords which indicate + the highest priorities with the former being the highest priority. + Any other name must be defined by creating a PriorityClass object + with that name. If not specified, the pod priority will be default + or zero if there is no default. type: string readinessGates: + description: 'If specified, all readiness gates will be evaluated + for pod readiness. A pod is ready when all its containers are + ready AND all conditions specified in the readiness gates have + status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' items: + description: PodReadinessGate contains the reference to a pod + condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array + resourceClaims: + description: "ResourceClaims defines which ResourceClaims must be + allocated and reserved before the Pod is allowed to start. The + resources will be made available to those containers which consume + them by name. \n This is an alpha field and requires enabling + the DynamicResourceAllocation feature gate. \n This field is immutable." + items: + description: PodResourceClaim references exactly one ResourceClaim + through a ClaimSource. It adds a name to it that uniquely identifies + the ResourceClaim inside the Pod. Containers that need access + to the ResourceClaim reference it with this name. + properties: + name: + description: Name uniquely identifies this resource claim + inside the pod. This must be a DNS_LABEL. + type: string + source: + description: Source describes where to find the ResourceClaim. + properties: + resourceClaimName: + description: ResourceClaimName is the name of a ResourceClaim + object in the same namespace as this pod. + type: string + resourceClaimTemplateName: + description: "ResourceClaimTemplateName is the name of + a ResourceClaimTemplate object in the same namespace + as this pod. \n The template will be used to create + a new ResourceClaim, which will be bound to this pod. + When this pod is deleted, the ResourceClaim will also + be deleted. The name of the ResourceClaim will be -, where is the + PodResourceClaim.Name. Pod validation will reject the + pod if the concatenated name is not valid for a ResourceClaim + (e.g. too long). \n An existing ResourceClaim with that + name that is not owned by the pod will not be used for + the pod to avoid using an unrelated resource by mistake. + Scheduling and pod startup are then blocked until the + unrelated ResourceClaim is removed. \n This field is + immutable and no changes will be made to the corresponding + ResourceClaim by the control plane after creating the + ResourceClaim." + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map restartPolicy: + description: 'Restart policy for all containers within the pod. + One of Always, OnFailure, Never. Default to Always. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' type: string runtimeClassName: + description: 'RuntimeClassName refers to a RuntimeClass object in + the node.k8s.io group, which should be used to run this pod. If + no RuntimeClass resource matches the named class, the pod will + not be run. If unset or empty, the "legacy" RuntimeClass will + be used, which is an implicit class with an empty definition that + uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' type: string schedulerName: + description: If specified, the pod will be dispatched by specified + scheduler. If not specified, the pod will be dispatched by default + scheduler. type: string + schedulingGates: + description: "SchedulingGates is an opaque list of values that if + specified will block scheduling the pod. More info: https://git.k8s.io/enhancements/keps/sig-scheduling/3521-pod-scheduling-readiness. + \n This is an alpha-level feature enabled by PodSchedulingReadiness + feature gate." + items: + description: PodSchedulingGate is associated to a Pod to guard + its scheduling. + properties: + name: + description: Name of the scheduling gate. Each scheduling + gate must have a unique name field. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map securityContext: + description: 'SecurityContext holds pod-level security attributes + and common container settings. Optional: Defaults to empty. See + type description for default values of each field.' properties: fsGroup: + description: "A special supplemental group that applies to all + containers in a pod. Some volume types allow the Kubelet to + change the ownership of that volume to be owned by the pod: + \n 1. The owning GID will be the FSGroup 2. The setgid bit + is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- \n If unset, + the Kubelet will not modify the ownership and permissions + of any volume. Note that this field cannot be set when spec.os.name + is windows." format: int64 type: integer fsGroupChangePolicy: + description: 'fsGroupChangePolicy defines behavior of changing + ownership and permission of the volume before being exposed + inside Pod. This field will only apply to volume types which + support fsGroup based ownership(and permissions). It will + have no effect on ephemeral volume types such as: secret, + configmaps and emptydir. Valid values are "OnRootMismatch" + and "Always". If not specified, "Always" is used. Note that + this field cannot be set when spec.os.name is windows.' type: string runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set in + SecurityContext. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence for + that container. Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as a non-root + user. If true, the Kubelet will validate the image at runtime + to ensure that it does not run as UID 0 (root) and fail to + start the container if it does. If unset or false, no such + validation will be performed. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random + SELinux context for each container. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies to + the container. type: string role: + description: Role is a SELinux role label that applies to + the container. type: string type: + description: Type is a SELinux type label that applies to + the container. type: string user: + description: User is a SELinux user label that applies to + the container. type: string type: object seccompProfile: + description: The seccomp options to use by the containers in + this pod. Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile must + be preconfigured on the node to work. Must be a descending + path, relative to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - a profile + defined in a file on the node should be used. RuntimeDefault + - the container runtime default profile should be used. + Unconfined - no profile should be applied." type: string required: - type type: object supplementalGroups: + description: A list of groups applied to the first process run + in each container, in addition to the container's primary + GID, the fsGroup (if specified), and group memberships defined + in the container image for the uid of the container process. + If unspecified, no additional groups are added to any container. + Note that group memberships defined in the container image + for the uid of the container process are still effective, + even if they are not included in this list. Note that this + field cannot be set when spec.os.name is windows. items: format: int64 type: integer type: array sysctls: + description: Sysctls hold a list of namespaced sysctls used + for the pod. Pods with unsupported sysctls (by the container + runtime) might fail to launch. Note that this field cannot + be set when spec.os.name is windows. items: + description: Sysctl defines a kernel parameter to be set properties: name: + description: Name of a property to set type: string value: + description: Value of a property to set type: string required: - name @@ -2626,59 +5598,165 @@ spec: type: object type: array windowsOptions: + description: The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. type: string hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is alpha-level + and will only be honored by components that enable the + WindowsHostProcessContainers feature flag. Setting this + field without the feature flag will result in errors when + validating the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is not allowed + to have a mix of HostProcess containers and non-HostProcess + containers). In addition, if HostProcess is true then + HostNetwork must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set in PodSecurityContext. + If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: string type: object type: object serviceAccount: + description: 'DeprecatedServiceAccount is a depreciated alias for + ServiceAccountName. Deprecated: Use serviceAccountName instead.' type: string serviceAccountName: + description: 'ServiceAccountName is the name of the ServiceAccount + to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' type: string setHostnameAsFQDN: + description: If true the pod's hostname will be configured as the + pod's FQDN, rather than the leaf name (the default). In Linux + containers, this means setting the FQDN in the hostname field + of the kernel (the nodename field of struct utsname). In Windows + containers, this means setting the registry value of hostname + for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters + to FQDN. If a pod does not have FQDN, this has no effect. Default + to false. type: boolean shareProcessNamespace: + description: 'Share a single process namespace between all of the + containers in a pod. When this is set containers will be able + to view and signal processes from other containers in the same + pod, and the first process in each container will not be assigned + PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: + Default to false.' type: boolean subdomain: + description: If specified, the fully qualified Pod hostname will + be "...svc.". + If not specified, the pod will not have a domainname at all. type: string terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs to terminate + gracefully. May be decreased in delete request. Value must be + non-negative integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). If this value + is nil, the default grace period will be used instead. The grace + period is the duration in seconds after the processes running + in the pod are sent a termination signal and the time when the + processes are forcibly halted with a kill signal. Set this value + longer than the expected cleanup time for your process. Defaults + to 30 seconds. format: int64 type: integer tolerations: + description: If specified, the pod's tolerations. items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using the + matching operator . properties: effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. type: string operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to + Equal. Exists is equivalent to wildcard for value, so that + a pod can tolerate all taints of a particular category. type: string tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do + not evict). Zero and negative values will be treated as + 0 (evict immediately) by the system. format: int64 type: integer value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: TopologySpreadConstraints describes how a group of + pods ought to spread across topology domains. Scheduler will schedule + pods in a way which abides by the constraints. All topologySpreadConstraints + are ANDed. items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. properties: labelSelector: + description: LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine + the number of pods in their corresponding topology domain. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. type: string values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. + This array is replaced during a strategic merge + patch. items: type: string type: array @@ -2690,14 +5768,123 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: MatchLabelKeys is a set of pod label keys to + select the pods over which spreading will be calculated. + The keys are used to lookup values from the incoming pod + labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading + will be calculated for the incoming pod. Keys that don't + exist in the incoming pod labels will be ignored. A null + or empty list means only match against labelSelector. + items: + type: string + type: array + x-kubernetes-list-type: atomic maxSkew: + description: 'MaxSkew describes the degree to which pods may + be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, + it is the maximum permitted difference between the number + of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods + in an eligible domain or zero if the number of eligible + domains is less than MinDomains. For example, in a 3-zone + cluster, MaxSkew is set to 1, and pods with the same labelSelector + spread as 2/2/1: In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | | P P | P P | P | - if + MaxSkew is 1, incoming pod can only be scheduled to zone3 + to become 2/2/2; scheduling it onto zone1(zone2) would make + the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any + zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used + to give higher precedence to topologies that satisfy it. + It''s a required field. Default value is 1 and 0 is not + allowed.' + format: int32 + type: integer + minDomains: + description: "MinDomains indicates a minimum number of eligible + domains. When the number of eligible domains with matching + topology keys is less than minDomains, Pod Topology Spread + treats \"global minimum\" as 0, and then the calculation + of Skew is performed. And when the number of eligible domains + with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. As a result, when + the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those + domains. If value is nil, the constraint behaves as if MinDomains + is equal to 1. Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + \n For example, in a 3-zone cluster, MaxSkew is set to 2, + MinDomains is set to 5 and pods with the same labelSelector + spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P + P | P P | The number of domains is less than 5(MinDomains), + so \"global minimum\" is treated as 0. In this situation, + new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled + to any of the three zones, it will violate MaxSkew. \n This + is a beta field and requires the MinDomainsInPodTopologySpread + feature gate to be enabled (enabled by default)." format: int32 type: integer + nodeAffinityPolicy: + description: "NodeAffinityPolicy indicates how we will treat + Pod's nodeAffinity/nodeSelector when calculating pod topology + spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector + are included in the calculations. - Ignore: nodeAffinity/nodeSelector + are ignored. All nodes are included in the calculations. + \n If this value is nil, the behavior is equivalent to the + Honor policy. This is a beta-level feature default enabled + by the NodeInclusionPolicyInPodTopologySpread feature flag." + type: string + nodeTaintsPolicy: + description: "NodeTaintsPolicy indicates how we will treat + node taints when calculating pod topology spread skew. Options + are: - Honor: nodes without taints, along with tainted nodes + for which the incoming pod has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + \n If this value is nil, the behavior is equivalent to the + Ignore policy. This is a beta-level feature default enabled + by the NodeInclusionPolicyInPodTopologySpread feature flag." + type: string topologyKey: + description: TopologyKey is the key of node labels. Nodes + that have a label with this key and identical values are + considered to be in the same topology. We consider each + as a "bucket", and try to put balanced number + of pods into each bucket. We define a domain as a particular + instance of a topology. Also, we define an eligible domain + as a domain whose nodes meet the requirements of nodeAffinityPolicy + and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", + each Node is a domain of that topology. And, if TopologyKey + is "topology.kubernetes.io/zone", each zone is a domain + of that topology. It's a required field. type: string whenUnsatisfiable: + description: 'WhenUnsatisfiable indicates how to deal with + a pod if it doesn''t satisfy the spread constraint. - DoNotSchedule + (default) tells the scheduler not to schedule it. - ScheduleAnyway + tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help + reduce the skew. A constraint is considered "Unsatisfiable" + for an incoming pod if and only if every possible node assignment + for that pod would violate "MaxSkew" on some topology. For + example, in a 3-zone cluster, MaxSkew is set to 1, and pods + with the same labelSelector spread as 3/1/1: | zone1 | zone2 + | zone3 | | P P P | P | P | If WhenUnsatisfiable + is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) + on zone2(zone3) satisfies MaxSkew(1). In other words, the + cluster can still be imbalanced, but scheduler won''t make + it *more* imbalanced. It''s a required field.' type: string required: - maxSkew @@ -2710,104 +5897,229 @@ spec: - whenUnsatisfiable x-kubernetes-list-type: map volumes: + description: 'List of volumes that can be mounted by containers + belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. properties: awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk + resource that is attached to a kubelet''s host machine and + then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' properties: fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default is to + mount by volume name. Examples: For volume /dev/sda1, + you specify the partition as "1". Similarly, the volume + partition for /dev/sda is "0" (or you can leave the + property empty).' format: int32 type: integer readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: boolean volumeID: + description: 'volumeID is unique ID of the persistent + disk resource in AWS (Amazon EBS volume). More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: string required: - volumeID type: object azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. properties: cachingMode: + description: 'cachingMode is the Host Caching mode: None, + Read Only, Read Write.' type: string diskName: + description: diskName is the Name of the data disk in + the blob storage type: string diskURI: + description: diskURI is the URI of data disk in the blob + storage type: string fsType: + description: fsType is Filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single blob + disk per storage account Managed: azure managed data + disk (only in managed availability set). defaults to + shared' type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean required: - diskName - diskURI type: object azureFile: + description: azureFile represents an Azure File Service mount + on the host and bind mount to the pod. properties: readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretName: + description: secretName is the name of secret that contains + Azure Storage Account Name and Key type: string shareName: + description: shareName is the azure share Name type: string required: - secretName - shareName type: object cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime properties: monitors: + description: 'monitors is Required: Monitors is a collection + of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' items: type: string type: array path: + description: 'path is Optional: Used as the mounted root, + rather than the full Ceph tree, default is /' type: string readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: boolean secretFile: + description: 'secretFile is Optional: SecretFile is the + path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string secretRef: + description: 'secretRef is Optional: SecretRef is reference + to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is optional: User is the rados user + name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string required: - monitors type: object cinder: + description: 'cinder represents a cinder volume attached and + mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string readOnly: + description: 'readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: boolean secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to OpenStack.' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeID: + description: 'volumeID used to identify the volume in + cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string required: - volumeID type: object configMap: + description: configMap represents a configMap that should + populate this volume properties: defaultMode: + description: 'defaultMode is optional: mode bits used + to set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for mode + bits. Defaults to 0644. Directories within the path + are not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: items if unspecified, each key-value pair + in the Data field of the referenced ConfigMap will be + projected into the volume as a file whose name is the + key and content is the value. If specified, the listed + keys will be projected into the specified paths, and + unlisted keys will not be present. If a key is specified + which is not present in the ConfigMap, the volume setup + will error unless it is marked optional. Paths must + be relative and may not contain the '..' path or start + with '..'. items: + description: Maps a string key to a path within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for + mode bits. If not specified, the volume defaultMode + will be used. This might be in conflict with other + options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not + start with the string '..'. type: string required: - key @@ -2815,121 +6127,368 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string optional: + description: optional specify whether the ConfigMap or + its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers (Beta feature). properties: driver: + description: driver is the name of the CSI driver that + handles this volume. Consult with your admin for the + correct name as registered in the cluster. type: string fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated + CSI driver which will determine the default filesystem + to apply. type: string nodePublishSecretRef: + description: nodePublishSecretRef is a reference to the + secret object containing sensitive information to pass + to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the secret + object contains more than one secret, all secret references + are passed. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string + description: volumeAttributes stores driver-specific properties + that are passed to the CSI driver. Consult your driver's + documentation for supported values. type: object required: - driver type: object downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume properties: defaultMode: + description: 'Optional: mode bits to use on created files + by default. Must be a Optional: mode bits used to set + permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and decimal + values, JSON requires decimal values for mode bits. + Defaults to 0644. Directories within the path are not + affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: Items is a list of downward API volume file items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field properties: fieldRef: + description: 'Required: Selects a field of the pod: + only annotations, labels, name and namespace are + supported.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used to set permissions + on this file, must be an octal value between 0000 + and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON + requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the relative path + name of the file to be created. Must not be absolute + or contain the ''..'' path. Must be utf-8 encoded. + The first item of the relative path must not start + with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object emptyDir: + description: 'emptyDir represents a temporary directory that + shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' properties: medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which + means to use the node''s default medium. Must be an + empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' type: string sizeLimit: anyOf: - type: integer - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is + also applicable for memory medium. The maximum usage + on memory medium EmptyDir would be the minimum value + between the SizeLimit specified here and the sum of + memory limits of all containers in a pod. The default + is nil which means that the limit is undefined. More + info: http://kubernetes.io/docs/user-guide/volumes#emptydir' pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle is tied + to the pod that defines it - it will be created before the + pod starts, and deleted when the pod is removed. \n Use + this if: a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot + or capacity tracking are needed, c) the storage driver is + specified through a storage class, and d) the storage driver + supports dynamic volume provisioning through a PersistentVolumeClaim + (see EphemeralVolumeSource for more information on the connection + between this volume type and PersistentVolumeClaim). \n + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. \n Use CSI for light-weight local + ephemeral volumes if the CSI driver is meant to be used + that way - see the documentation of the driver for more + information. \n A pod can use both types of ephemeral volumes + and persistent volumes at the same time." properties: volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC + to provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC + will be deleted together with the pod. The name of + the PVC will be `-` where `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). + \n An existing PVC with that name that is not owned + by the pod will *not* be used for the pod to avoid using + an unrelated volume by mistake. Starting the pod is + then blocked until the unrelated PVC is removed. If + such a pre-created PVC is meant to be used by the pod, + the PVC has to updated with an owner reference to the + pod once the pod exists. Normally this should not be + necessary, but it may be useful when manually reconstructing + a broken cluster. \n This field is read-only and no + changes will be made by Kubernetes to the PVC after + it has been created. \n Required, must not be nil." properties: metadata: + description: May contain labels and annotations that + will be copied into the PVC when creating it. No + other fields are allowed and will be rejected during + validation. type: object spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the + PVC that gets created from this template. The same + fields as in a PersistentVolumeClaim are also valid + here. properties: accessModes: + description: 'accessModes contains the desired + access modes the volume should have. More info: + https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' items: type: string type: array dataSource: + description: 'dataSource field can be used to + specify either: * An existing VolumeSnapshot + object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If + the provisioner or an external controller can + support the specified data source, it will create + a new volume based on the contents of the specified + data source. When the AnyVolumeDataSource feature + gate is enabled, dataSource contents will be + copied to dataSourceRef, and dataSourceRef contents + will be copied to dataSource when dataSourceRef.namespace + is not specified. If the namespace is specified, + then dataSourceRef will not be copied to dataSource.' properties: apiGroup: + description: APIGroup is the group for the + resource being referenced. If APIGroup is + not specified, the specified Kind must be + in the core API group. For any other third-party + types, APIGroup is required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced type: string required: - kind - name type: object + x-kubernetes-map-type: atomic dataSourceRef: + description: 'dataSourceRef specifies the object + from which to populate the volume with data, + if a non-empty volume is desired. This may be + any object from a non-empty API group (non core + object) or a PersistentVolumeClaim object. When + this field is specified, volume binding will + only succeed if the type of the specified object + matches some installed volume populator or dynamic + provisioner. This field will replace the functionality + of the dataSource field and as such if both + fields are non-empty, they must have the same + value. For backwards compatibility, when namespace + isn''t specified in dataSourceRef, both fields + (dataSource and dataSourceRef) will be set to + the same value automatically if one of them + is empty and the other is non-empty. When namespace + is specified in dataSourceRef, dataSource isn''t + set to the same value and must be empty. There + are three important differences between dataSource + and dataSourceRef: * While dataSource only allows + two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim + objects. * While dataSource ignores disallowed + values (dropping them), dataSourceRef preserves + all values, and generates an error if a disallowed + value is specified. * While dataSource only + allows local objects, dataSourceRef allows objects + in any namespaces. (Beta) Using this field requires + the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef + requires the CrossNamespaceVolumeDataSource + feature gate to be enabled.' properties: apiGroup: + description: APIGroup is the group for the + resource being referenced. If APIGroup is + not specified, the specified Kind must be + in the core API group. For any other third-party + types, APIGroup is required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: Namespace is the namespace of + resource being referenced Note that when + a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferenceGrant documentation + for details. (Alpha) This field requires + the CrossNamespaceVolumeDataSource feature + gate to be enabled. type: string required: - kind - name type: object resources: + description: 'resources represents the minimum + resources the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity + recorded in the status field of the claim. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are + used by this container. \n This is an alpha + field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one + entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name + of one entry in pod.spec.resourceClaims + of the Pod where this field is used. + It makes that resource available inside + a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -2937,6 +6496,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum + amount of compute resources allowed. More + info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -2945,18 +6507,46 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. If + Requests is omitted for a container, it + defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object selector: + description: selector is a label query over volumes + to consider for binding. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -2968,13 +6558,28 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic storageClassName: + description: 'storageClassName is the name of + the StorageClass required by the claim. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' type: string volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem + is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. type: string type: object required: @@ -2982,125 +6587,264 @@ spec: type: object type: object fc: + description: fc represents a Fibre Channel resource that is + attached to a kubelet's host machine and then exposed to + the pod. properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. TODO: how do we prevent + errors in the filesystem from compromising the machine' type: string lun: + description: 'lun is Optional: FC target lun number' format: int32 type: integer readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' items: type: string type: array wwids: + description: 'wwids Optional: FC volume world wide identifiers + (wwids) Either wwids or combination of targetWWNs and + lun must be set, but not both simultaneously.' items: type: string type: array type: object flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. properties: driver: + description: driver is the name of the driver to use for + this volume. type: string fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". The default filesystem + depends on FlexVolume script. type: string options: additionalProperties: type: string + description: 'options is Optional: this field holds extra + command options if any.' type: object readOnly: + description: 'readOnly is Optional: defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean secretRef: + description: 'secretRef is Optional: secretRef is reference + to the secret object containing sensitive information + to pass to the plugin scripts. This may be empty if + no secret object is specified. If the secret object + contains more than one secret, all secrets are passed + to the plugin scripts.' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic required: - driver type: object flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running properties: datasetName: + description: datasetName is Name of the dataset stored + as metadata -> name on the dataset for Flocker should + be considered as deprecated type: string datasetUUID: + description: datasetUUID is the UUID of the dataset. This + is unique identifier of a Flocker dataset type: string type: object gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' properties: fsType: + description: 'fsType is filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default is to + mount by volume name. Examples: For volume /dev/sda1, + you specify the partition as "1". Similarly, the volume + partition for /dev/sda is "0" (or you can leave the + property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' format: int32 type: integer pdName: + description: 'pdName is unique name of the PD resource + in GCE. Used to identify the disk in GCE. More info: + https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: string readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: boolean required: - pdName type: object gitRepo: + description: 'gitRepo represents a git repository at a particular + revision. DEPRECATED: GitRepo is deprecated. To provision + a container with a git repo, mount an EmptyDir into an InitContainer + that clones the repo using git, then mount the EmptyDir + into the Pod''s container.' properties: directory: + description: directory is the target directory name. Must + not contain or start with '..'. If '.' is supplied, + the volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. type: string repository: + description: repository is the URL type: string revision: + description: revision is the commit hash for the specified + revision. type: string required: - repository type: object glusterfs: + description: 'glusterfs represents a Glusterfs mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' properties: endpoints: + description: 'endpoints is the endpoint name that details + Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string path: + description: 'path is the Glusterfs volume path. More + info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string readOnly: + description: 'readOnly here will force the Glusterfs volume + to be mounted with read-only permissions. Defaults to + false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: boolean required: - endpoints - path type: object hostPath: + description: 'hostPath represents a pre-existing file or directory + on the host machine that is directly exposed to the container. + This is generally used for system agents or other privileged + things that are allowed to see the host machine. Most containers + will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host directory + mounts and who can/can not mount host directories as read/write.' properties: path: + description: 'path of the directory on the host. If the + path is a symlink, it will follow the link to the real + path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string type: + description: 'type for HostPath Volume Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string required: - path type: object iscsi: + description: 'iscsi represents an ISCSI Disk resource that + is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' properties: chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication type: boolean chapAuthSession: + description: chapAuthSession defines whether support iSCSI + Session CHAP authentication type: boolean fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. type: string iqn: + description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: + description: iscsiInterface is the interface Name that + uses an iSCSI transport. Defaults to 'default' (tcp). type: string lun: + description: lun represents iSCSI Target Lun number. format: int32 type: integer portals: + description: portals is the iSCSI Target Portal List. + The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). items: type: string type: array readOnly: + description: readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. type: boolean secretRef: + description: secretRef is the CHAP Secret for iSCSI target + and initiator authentication properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic targetPortal: + description: targetPortal is iSCSI Target Portal. The + Portal is either an IP or ip_addr:port if the port is + other than default (typically TCP ports 860 and 3260). type: string required: - iqn @@ -3108,67 +6852,150 @@ spec: - targetPortal type: object name: + description: 'name of the volume. Must be a DNS_LABEL and + unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string nfs: + description: 'nfs represents an NFS mount on the host that + shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' properties: path: + description: 'path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string readOnly: + description: 'readOnly here will force the NFS export + to be mounted with read-only permissions. Defaults to + false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: boolean server: + description: 'server is the hostname or IP address of + the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string required: - path - server type: object persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents + a reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' properties: claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' type: string readOnly: + description: readOnly Will force the ReadOnly setting + in VolumeMounts. Default false. type: boolean required: - claimName type: object photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host machine properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk type: string required: - pdID type: object portworxVolume: + description: portworxVolume represents a portworx volume attached + and mounted on kubelets host machine properties: fsType: + description: fSType represents the filesystem type to + mount Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs". Implicitly inferred + to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean volumeID: + description: volumeID uniquely identifies a Portworx volume type: string required: - volumeID type: object projected: + description: projected items for all in one resources secrets, + configmaps, and downward API properties: defaultMode: + description: defaultMode are the mode bits used to set + permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and decimal + values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this + setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set. format: int32 type: integer sources: + description: sources is the list of volume projections items: + description: Projection that may be projected along + with other supported volume types properties: configMap: + description: configMap information about the configMap + data to project properties: items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the ConfigMap, the + volume setup will error unless it is marked + optional. Paths must be relative and may not + contain the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 + and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal + values for mode bits. If not specified, + the volume defaultMode will be used. + This might be in conflict with other + options that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative path + of the file to map the key to. May not + be an absolute path. May not contain + the path element '..'. May not start + with the string '..'. type: string required: - key @@ -3176,60 +7003,147 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional specify whether the ConfigMap + or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic downwardAPI: + description: downwardAPI information about the downwardAPI + data to project properties: items: + description: Items is a list of DownwardAPIVolume + file items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field properties: fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' properties: apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". type: string fieldPath: + description: Path of the field to + select in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used + to set permissions on this file, must + be an octal value between 0000 and 0777 + or a decimal value between 0 and 511. + YAML accepts both octal and decimal + values, JSON requires decimal values + for mode bits. If not specified, the + volume defaultMode will be used. This + might be in conflict with other options + that affect the file mode, like fsGroup, + and the result can be other mode bits + set.' format: int32 type: integer path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the + container: only resources limits and + requests (limits.cpu, limits.memory, + requests.cpu and requests.memory) are + currently supported.' properties: containerName: + description: 'Container name: required + for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to + select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object secret: + description: secret information about the secret + data to project properties: items: + description: items if unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the Secret, the volume + setup will error unless it is marked optional. + Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 + and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal + values for mode bits. If not specified, + the volume defaultMode will be used. + This might be in conflict with other + options that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative path + of the file to map the key to. May not + be an absolute path. May not contain + the path element '..'. May not start + with the string '..'. type: string required: - key @@ -3237,18 +7151,45 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional field specify whether + the Secret or its key must be defined type: boolean type: object + x-kubernetes-map-type: atomic serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project properties: audience: + description: audience is the intended audience + of the token. A recipient of a token must + identify itself with an identifier specified + in the audience of the token, and otherwise + should reject the token. The audience defaults + to the identifier of the apiserver. type: string expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, + the kubelet volume plugin will proactively + rotate the service account token. The kubelet + will start trying to rotate the token if the + token is older than 80 percent of its time + to live or if the token is older than 24 hours.Defaults + to 1 hour and must be at least 10 minutes. format: int64 type: integer path: + description: path is the path relative to the + mount point of the file to project the token + into. type: string required: - path @@ -3257,74 +7198,150 @@ spec: type: array type: object quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime properties: group: + description: group to map volume access to Default is + no group type: string readOnly: + description: readOnly here will force the Quobyte volume + to be mounted with read-only permissions. Defaults to + false. type: boolean registry: + description: registry represents a single or multiple + Quobyte Registry services specified as a string as host:port + pair (multiple entries are separated with commas) which + acts as the central registry for volumes type: string tenant: + description: tenant owning the given Quobyte volume in + the Backend Used with dynamically provisioned Quobyte + volumes, value is set by the plugin type: string user: + description: user to map volume access to Defaults to + serivceaccount user type: string volume: + description: volume is a string that references an already + created Quobyte volume by name. type: string required: - registry - volume type: object rbd: + description: 'rbd represents a Rados Block Device mount on + the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' properties: fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string image: + description: 'image is the rados image name. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string keyring: + description: 'keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' items: type: string type: array pool: + description: 'pool is the rados pool name. Default is + rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: boolean secretRef: + description: 'secretRef is name of the authentication + secret for RBDUser. If provided overrides keyring. Default + is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is the rados user name. Default is + admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string required: - image - monitors type: object scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Default is "xfs". type: string gateway: + description: gateway is the host address of the ScaleIO + API Gateway. type: string protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: + description: secretRef references to the secret for ScaleIO + user and other sensitive information. If this is not + provided, Login operation will fail. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false type: boolean storageMode: + description: storageMode indicates whether the storage + for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. type: string storagePool: + description: storagePool is the ScaleIO Storage Pool associated + with the protection domain. type: string system: + description: system is the name of the storage system + as configured in ScaleIO. type: string volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated with + this volume source. type: string required: - gateway @@ -3332,19 +7349,54 @@ spec: - system type: object secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' properties: defaultMode: + description: 'defaultMode is Optional: mode bits used + to set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for mode + bits. Defaults to 0644. Directories within the path + are not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: items If unspecified, each key-value pair + in the Data field of the referenced Secret will be projected + into the volume as a file whose name is the key and + content is the value. If specified, the listed keys + will be projected into the specified paths, and unlisted + keys will not be present. If a key is specified which + is not present in the Secret, the volume setup will + error unless it is marked optional. Paths must be relative + and may not contain the '..' path or start with '..'. items: + description: Maps a string key to a path within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for + mode bits. If not specified, the volume defaultMode + will be used. This might be in conflict with other + options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not + start with the string '..'. type: string required: - key @@ -3352,35 +7404,77 @@ spec: type: object type: array optional: + description: optional field specify whether the Secret + or its keys must be defined type: boolean secretName: + description: 'secretName is the name of the secret in + the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' type: string type: object storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: + description: secretRef specifies the secret to use for + obtaining the StorageOS API credentials. If not specified, + default values will be attempted. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeName: + description: volumeName is the human-readable name of + the StorageOS volume. Volume names are only unique + within a namespace. type: string volumeNamespace: + description: volumeNamespace specifies the scope of the + volume within StorageOS. If no namespace is specified + then the Pod's namespace will be used. This allows + the Kubernetes name scoping to be mirrored within StorageOS + for tighter integration. Set VolumeName to any name + to override the default behaviour. Set to "default" + if you are not using namespaces within StorageOS. Namespaces + that do not pre-exist within StorageOS will be created. type: string type: object vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine properties: fsType: + description: fsType is filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. type: string storagePolicyName: + description: storagePolicyName is the storage Policy Based + Management (SPBM) profile name. type: string volumePath: + description: volumePath is the path that identifies vSphere + volume vmdk type: string required: - volumePath @@ -3393,57 +7487,75 @@ spec: - containers type: object timeout: + description: Timeout defines the maximum amount of time the Serving + should take to execute before the Serving is running. type: string triggers: + description: Triggers are used to specify the trigger sources of the + function. The Keda (ScaledObject, ScaledJob) configuration in ScaleOptions + cannot take effect without Triggers being set. items: properties: authenticationRef: + description: ScaledObjectAuthRef points to the TriggerAuthentication + or ClusterTriggerAuthentication object that is used to authenticate + the scaler with the environment properties: kind: + description: Kind of the resource being referred to. Defaults + to TriggerAuthentication. type: string name: type: string required: - name type: object - fallback: - format: int32 - type: integer metadata: additionalProperties: type: string type: object + metricType: + description: MetricTargetType specifies the type of metric being + targeted, and should be either "Value", "AverageValue", or "Utilization" + type: string name: type: string targetKind: + description: ScaleTargetKind represents the kind of trigger target. enum: - object - job type: string type: type: string + useCachedMetrics: + type: boolean required: - metadata - type type: object type: array version: + description: Function version in format like v1.0.0 type: string required: - image - runtime type: object status: + description: ServingStatus defines the observed state of Serving properties: phase: type: string resourceRef: additionalProperties: type: string + description: Associate resources. type: object state: type: string url: + description: Service holds the service name used to access the serving. type: string type: object type: object @@ -3464,21 +7576,31 @@ spec: name: v1beta2 schema: openAPIV3Schema: + description: Serving is the Schema for the servings API properties: apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: + description: ServingSpec defines the desired state of Serving properties: annotations: additionalProperties: type: string + description: Annotations that will be added to the workload. type: object bindings: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -3486,10 +7608,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret holding + the value for the metadata item. Name is the secret name, + and key is the field in the secret. properties: key: type: string @@ -3500,7 +7626,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct for + the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -3515,8 +7642,11 @@ spec: - type - version type: object + description: Configurations of dapr bindings components. type: object hooks: + description: Hooks define the hooks that will execute before or after + function execution. properties: policy: type: string @@ -3530,17 +7660,27 @@ spec: type: array type: object image: + description: Function image name type: string imageCredentials: + description: ImageCredentials references a Secret that contains credentials + to access the image repository. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic labels: additionalProperties: type: string + description: Parameters of asyncFunc runtime, must not be nil when runtime + is OpenFuncAsync. type: object outputs: + description: Function outputs from Dapr components including binding, + pubsub items: properties: dapr: @@ -3548,16 +7688,25 @@ spec: metadata: additionalProperties: type: string + description: Metadata is the metadata for dapr Com. type: object name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string operation: + description: Operation field tells the Dapr component which + operation it should perform. type: string outputName: + description: 'Deprecated: Only for compatibility with v1beta1' type: string topic: type: string type: + description: Type is the type of the component, if it is not + set, controller will get it automatically. type: string required: - name @@ -3567,9 +7716,13 @@ spec: params: additionalProperties: type: string + description: Parameters to pass to the serving. All parameters will + be injected into the pod as environment variables. Function code can + use these parameters by getting environment variables type: object pubsub: additionalProperties: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -3577,10 +7730,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret holding + the value for the metadata item. Name is the secret name, + and key is the field in the secret. properties: key: type: string @@ -3591,7 +7748,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct for + the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -3606,11 +7764,25 @@ spec: - type - version type: object + description: Configurations of dapr pubsub components. type: object scaleOptions: + description: The ScaleOptions will help us to set up guidelines for + the autoscaling of function workloads. properties: keda: properties: + httpScaledObject: + properties: + cooldownPeriod: + description: Cooldown period value + format: int32 + type: integer + targetPendingRequests: + description: Target metric value + format: int32 + type: integer + type: object scaledJob: properties: failedJobsHistoryLimit: @@ -3620,14 +7792,19 @@ spec: format: int32 type: integer restartPolicy: + description: Restart policy for all containers within the + pod. One of 'OnFailure', 'Never'. Default to 'Never'. type: string scalingStrategy: + description: ScalingStrategy defines the strategy of Scaling properties: customScalingQueueLengthDeduction: format: int32 type: integer customScalingRunningJobPercentage: type: string + multipleScalersCalculation: + type: string pendingPodConditions: items: type: string @@ -3642,22 +7819,54 @@ spec: scaledObject: properties: advanced: + description: AdvancedConfig specifies advance scaling options properties: horizontalPodAutoscalerConfig: + description: HorizontalPodAutoscalerConfig specifies + horizontal scale config properties: behavior: + description: HorizontalPodAutoscalerBehavior configures + the scaling behavior of the target in both Up + and Down directions (scaleUp and scaleDown fields + respectively). properties: scaleDown: + description: scaleDown is scaling policy for + scaling Down. If not set, the default value + is to allow to scale down to minReplicas pods, + with a 300 second stabilization window (i.e., + the highest recommendation for the last 300sec + is used). properties: policies: + description: policies is a list of potential + scaling polices which can be used during + scaling. At least one policy must be specified, + otherwise the HPAScalingRules will be + discarded as invalid items: + description: HPAScalingPolicy is a single + policy which must hold true for a specified + past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which the + policy should hold true. PeriodSeconds + must be greater than zero and less + than or equal to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the amount + of change which is permitted by + the policy. It must be greater than + zero format: int32 type: integer required: @@ -3666,23 +7875,63 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to specify + which policy should be used. If not set, + the default value Max is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which past + recommendations should be considered while + scaling up or scaling down. StabilizationWindowSeconds + must be greater than or equal to zero + and less than or equal to 3600 (one hour). + If not set, use the default values: - + For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object scaleUp: + description: 'scaleUp is scaling policy for + scaling Up. If not set, the default value + is the higher of: * increase no more than + 4 pods per 60 seconds * double the number + of pods per 60 seconds No stabilization is + used.' properties: policies: + description: policies is a list of potential + scaling polices which can be used during + scaling. At least one policy must be specified, + otherwise the HPAScalingRules will be + discarded as invalid items: + description: HPAScalingPolicy is a single + policy which must hold true for a specified + past interval. properties: periodSeconds: + description: PeriodSeconds specifies + the window of time for which the + policy should hold true. PeriodSeconds + must be greater than zero and less + than or equal to 1800 (30 min). format: int32 type: integer type: + description: Type is used to specify + the scaling policy. type: string value: + description: Value contains the amount + of change which is permitted by + the policy. It must be greater than + zero format: int32 type: integer required: @@ -3691,13 +7940,30 @@ spec: - value type: object type: array + x-kubernetes-list-type: atomic selectPolicy: + description: selectPolicy is used to specify + which policy should be used. If not set, + the default value Max is used. type: string stabilizationWindowSeconds: + description: 'StabilizationWindowSeconds + is the number of seconds for which past + recommendations should be considered while + scaling up or scaling down. StabilizationWindowSeconds + must be greater than or equal to zero + and less than or equal to 3600 (one hour). + If not set, use the default values: - + For scale up: 0 (i.e. no stabilization + is done). - For scale down: 300 (i.e. + the stabilization window is 300 seconds + long).' format: int32 type: integer type: object type: object + name: + type: string type: object restoreToOriginalReplicaCount: type: boolean @@ -3705,33 +7971,61 @@ spec: cooldownPeriod: format: int32 type: integer + fallback: + description: Fallback is the spec for fallback options + properties: + failureThreshold: + format: int32 + type: integer + replicas: + format: int32 + type: integer + required: + - failureThreshold + - replicas + type: object pollingInterval: format: int32 type: integer type: object triggers: + description: Triggers are used to specify the trigger sources + of the function. The Keda (ScaledObject, ScaledJob) configuration + in ScaleOptions cannot take effect without Triggers being + set. items: + description: ScaleTriggers reference the scaler that will + be used properties: authenticationRef: + description: ScaledObjectAuthRef points to the TriggerAuthentication + or ClusterTriggerAuthentication object that is used + to authenticate the scaler with the environment properties: kind: + description: Kind of the resource being referred to. + Defaults to TriggerAuthentication. type: string name: type: string required: - name type: object - fallback: - format: int32 - type: integer metadata: additionalProperties: type: string type: object + metricType: + description: MetricTargetType specifies the type of metric + being targeted, and should be either "Value", "AverageValue", + or "Utilization" + type: string name: type: string type: type: string + useCachedMetrics: + type: boolean required: - metadata - type @@ -3741,6 +8035,8 @@ spec: knative: additionalProperties: type: string + description: Refer to https://knative.dev/docs/serving/autoscaling/ + to learn more about the autoscaling options of Knative Serving. type: object maxReplicas: format: int32 @@ -3753,6 +8049,7 @@ spec: additionalProperties: properties: spec: + description: ComponentSpec is the spec for a component. properties: ignoreErrors: type: boolean @@ -3760,10 +8057,14 @@ spec: type: string metadata: items: + description: MetadataItem is a name/value pair for a metadata. properties: name: type: string secretKeyRef: + description: SecretKeyRef is a reference to a secret + holding the value for the metadata item. Name is the + secret name, and key is the field in the secret. properties: key: type: string @@ -3774,7 +8075,8 @@ spec: - name type: object value: - type: "" + description: DynamicValue is a dynamic value struct + for the component.metadata pair value. x-kubernetes-preserve-unknown-fields: true required: - name @@ -3790,29 +8092,79 @@ spec: - version type: object type: object + description: Configurations of dapr state components. It can refer to + an existing state when the `state.spec` is nil. type: object template: + description: Template describes the pods that will be created. The container + named `function` is the container which is used to run the image built + by the builder. If it is not set, the controller will automatically + add one. properties: activeDeadlineSeconds: + description: Optional duration in seconds the pod may be active + on the node relative to StartTime before the system will actively + try to mark it failed and kill associated containers. Value must + be a positive integer. format: int64 type: integer affinity: + description: If specified, the pod's scheduling constraints properties: nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the node + matches the corresponding matchExpressions; the node(s) + with the highest sum are the most preferred. items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects + (i.e. is also a no-op). properties: preference: + description: A node selector term, associated with + the corresponding weight. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -3822,13 +8174,33 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -3838,7 +8210,10 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: @@ -3847,18 +8222,51 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not + be scheduled onto the node. If the affinity requirements + specified by this field cease to be met at some point + during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its + node. properties: nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. + The TopologySelectorTerm type implements a subset + of the NodeSelectorTerm. properties: matchExpressions: + description: A list of node selector requirements + by node's labels. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -3868,13 +8276,33 @@ spec: type: object type: array matchFields: + description: A list of node selector requirements + by node's fields. items: + description: A node selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: The label key that the selector + applies to. type: string operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. type: string values: + description: An array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values + array must be empty. If the operator is + Gt or Lt, the values array must have a + single element, which will be interpreted + as an integer. This array is replaced + during a strategic merge patch. items: type: string type: array @@ -3884,28 +8312,70 @@ spec: type: object type: array type: object + x-kubernetes-map-type: atomic type: array required: - nodeSelectorTerms type: object + x-kubernetes-map-type: atomic type: object podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements + of this field and adding "weight" to the sum if the node + has pods which matches the corresponding podAffinityTerm; + the node(s) with the highest sum are the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -3917,18 +8387,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -3940,18 +8444,42 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. format: int32 type: integer required: @@ -3960,18 +8488,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not + be scheduled onto the node. If the affinity requirements + specified by this field cease to be met at some point + during pod execution (e.g. due to a pod label update), + the system may or may not try to eventually evict the + pod from its node. When there are multiple elements, the + lists of nodes corresponding to each podAffinityTerm are + intersected, i.e. all terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not + co-located (anti-affinity) with, where co-located is + defined as running on a node whose value of the label + with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -3983,18 +8546,49 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to + the union of the namespaces selected by this field + and the ones listed in the namespaces field. null + selector and null or empty namespaces list means + "this pod's namespace". An empty selector ({}) matches + all namespaces. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -4006,13 +8600,33 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list of + namespace names that the term applies to. The term + is applied to the union of the namespaces listed + in this field and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey matches + that of any node on which any of the selected pods + is running. Empty topologyKey is not allowed. type: string required: - topologyKey @@ -4020,22 +8634,64 @@ spec: type: array type: object podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods + to nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates + one or more of the expressions. The node that is most + preferred is the one with the greatest sum of weights, + i.e. for each node that meets all of the scheduling requirements + (resource request, requiredDuringScheduling anti-affinity + expressions, etc.), compute a sum by iterating through + the elements of this field and adding "weight" to the + sum if the node has pods which matches the corresponding + podAffinityTerm; the node(s) with the highest sum are + the most preferred. items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) properties: podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4047,18 +8703,52 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces + field. null selector and null or empty namespaces + list means "this pod's namespace". An empty + selector ({}) matches all namespaces. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -4070,18 +8760,42 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. + The term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces + list and null namespaceSelector means "this + pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified + namespaces, where co-located is defined as running + on a node whose value of the label with key + topologyKey matches that of any node on which + any of the selected pods is running. Empty topologyKey + is not allowed. type: string required: - topologyKey type: object weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. format: int32 type: integer required: @@ -4090,18 +8804,53 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified + by this field are not met at scheduling time, the pod + will not be scheduled onto the node. If the anti-affinity + requirements specified by this field cease to be met at + some point during pod execution (e.g. due to a pod label + update), the system may or may not try to eventually evict + the pod from its node. When there are multiple elements, + the lists of nodes corresponding to each podAffinityTerm + are intersected, i.e. all terms must be satisfied. items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not + co-located (anti-affinity) with, where co-located is + defined as running on a node whose value of the label + with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: + description: A label query over a set of resources, + in this case pods. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -4113,18 +8862,49 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to + the union of the namespaces selected by this field + and the ones listed in the namespaces field. null + selector and null or empty namespaces list means + "this pod's namespace". An empty selector ({}) matches + all namespaces. properties: matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. properties: key: + description: key is the label key that the + selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. items: type: string type: array @@ -4136,13 +8916,33 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: + description: namespaces specifies a static list of + namespace names that the term applies to. The term + is applied to the union of the namespaces listed + in this field and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector + means "this pod's namespace". items: type: string type: array topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey matches + that of any node on which any of the selected pods + is running. Empty topologyKey is not allowed. type: string required: - topologyKey @@ -4151,124 +8951,270 @@ spec: type: object type: object automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service + account token should be automatically mounted. type: boolean containers: + description: List of containers belonging to the pod. Containers + cannot currently be added or removed. There must be at least one + container in a Pod. Cannot be updated. items: + description: A single application container that you want to run + within a pod. properties: args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the input + string will be unchanged. Double $$ are reduced to a single + $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of + whether the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded using + the container''s environment. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double + $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references will + never be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4276,49 +9222,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4326,25 +9321,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -4352,37 +9363,71 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4390,62 +9435,129 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -4456,37 +9568,71 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the + probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4494,47 +9640,111 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -4542,6 +9752,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -4550,101 +9762,261 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields of + SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed + until this completes successfully. If this probe fails, + the Pod will be restarted, just as if the livenessProbe + failed. This can be used to provide different probe parameters + at the beginning of a Pod''s lifecycle, when it might take + a long time to load data or warm a cache, than during steady-state + operation. This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4652,61 +10024,141 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -4714,19 +10166,41 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -4734,152 +10208,329 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array dnsConfig: + description: Specifies the DNS parameters of a pod. Parameters specified + here will be merged to the generated DNS configuration based on + DNSPolicy. properties: nameservers: + description: A list of DNS name server IP addresses. This will + be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array options: + description: A list of DNS resolver options. This will be merged + with the base options generated from DNSPolicy. Duplicated + entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. properties: name: + description: Required. type: string value: type: string type: object type: array searches: + description: A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from + DNSPolicy. Duplicated search paths will be removed. items: type: string type: array type: object dnsPolicy: + description: Set DNS policy for the pod. Defaults to "ClusterFirst". + Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' + or 'None'. DNS parameters given in DNSConfig will be merged with + the policy selected with DNSPolicy. To have DNS options set along + with hostNetwork, you have to specify DNS policy explicitly to + 'ClusterFirstWithHostNet'. type: string enableServiceLinks: + description: 'EnableServiceLinks indicates whether information about + services should be injected into pod''s environment variables, + matching the syntax of Docker links. Optional: Defaults to true.' type: boolean ephemeralContainers: + description: List of ephemeral containers run in this pod. Ephemeral + containers may be run in an existing pod to perform user-initiated + actions such as debugging. This list cannot be specified when + creating a pod, and it cannot be modified by updating the pod + spec. In order to add an ephemeral container to an existing pod, + use the pod's ephemeralcontainers subresource. items: + description: "An EphemeralContainer is a temporary container that + you may add to an existing Pod for user-initiated activities + such as debugging. Ephemeral containers have no resource or + scheduling guarantees, and they will not be restarted when they + exit or when a Pod is removed or restarted. The kubelet may + evict a Pod if an ephemeral container causes the Pod to exceed + its resource allocation. \n To add an ephemeral container, use + the ephemeralcontainers subresource of an existing Pod. Ephemeral + containers may not be removed or restarted." properties: args: + description: 'Arguments to the entrypoint. The image''s CMD + is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which + allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" + will produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string literal + "$(VAR_NAME)". Escaped references will never be expanded, + regardless of whether the variable exists or not. Cannot + be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Lifecycle is not allowed for ephemeral containers. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4887,49 +10538,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -4937,25 +10637,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -4963,37 +10679,69 @@ spec: type: object type: object livenessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5001,62 +10749,123 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the ephemeral container specified as + a DNS_LABEL. This name must be unique among all containers, + init containers and ephemeral containers. type: string ports: + description: Ports are not allowed for ephemeral containers. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -5067,37 +10876,69 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5105,47 +10946,112 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: Resources are not allowed for ephemeral containers. + Ephemeral containers use spare resources already allocated + to the pod. properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -5153,6 +11059,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -5161,101 +11069,254 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'Optional: SecurityContext defines the security + options the ephemeral container should be run with. If set, + the fields of SecurityContext override the equivalent fields + of PodSecurityContext.' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: Probes are not allowed for ephemeral containers. properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5263,63 +11324,151 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean targetContainerName: + description: "If set, the name of the container from PodSpec + that this ephemeral container targets. The ephemeral container + will be run in the namespaces (IPC, PID, etc) of this container. + If not set then the ephemeral container uses the namespaces + configured in the Pod spec. \n The container runtime must + implement support for this feature. If the runtime does + not support namespace targeting then the result of setting + this field is undefined." type: string terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -5327,19 +11476,42 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Subpath mounts are not allowed for ephemeral containers. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -5347,154 +11519,349 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array hostAliases: + description: HostAliases is an optional list of hosts and IPs that + will be injected into the pod's hosts file if specified. This + is only valid for non-hostNetwork pods. items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. properties: hostnames: + description: Hostnames for the above IP address. items: type: string type: array ip: + description: IP address of the host file entry. type: string type: object type: array hostIPC: + description: 'Use the host''s ipc namespace. Optional: Default to + false.' type: boolean hostNetwork: + description: Host networking requested for this pod. Use the host's + network namespace. If this option is set, the ports that will + be used must be specified. Default to false. type: boolean hostPID: + description: 'Use the host''s pid namespace. Optional: Default to + false.' + type: boolean + hostUsers: + description: 'Use the host''s user namespace. Optional: Default + to true. If set to true or not present, the pod will be run in + the host user namespace, useful for when the pod needs a feature + only available to the host user namespace, such as loading a kernel + module with CAP_SYS_MODULE. When set to false, a new userns is + created for the pod. Setting false is useful for mitigating container + breakout vulnerabilities even allowing users to run their containers + as root without actually having root privileges on the host. This + field is alpha-level and is only honored by servers that enable + the UserNamespacesSupport feature.' type: boolean hostname: + description: Specifies the hostname of the Pod If not specified, + the pod's hostname will be set to a system-defined value. type: string imagePullSecrets: + description: 'ImagePullSecrets is an optional list of references + to secrets in the same namespace to use for pulling any of the + images used by this PodSpec. If specified, these secrets will + be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' items: + description: LocalObjectReference contains enough information + to let you locate the referenced object inside the same namespace. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string type: object + x-kubernetes-map-type: atomic type: array initContainers: + description: 'List of initialization containers belonging to the + pod. Init containers are executed in order prior to containers + being started. If any init container fails, the pod is considered + to have failed and is handled according to its restartPolicy. + The name for an init container or normal container must be unique + among all containers. Init containers may not have Lifecycle actions, + Readiness probes, Liveness probes, or Startup probes. The resourceRequirements + of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and + then using the max of of that value or the sum of the normal containers. + Limits are applied to init containers in a similar fashion. Init + containers cannot currently be added or removed. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' items: + description: A single application container that you want to run + within a pod. properties: args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references + $(VAR_NAME) are expanded using the container''s environment. + If a variable cannot be resolved, the reference in the input + string will be unchanged. Double $$ are reduced to a single + $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of + whether the variable exists or not. Cannot be updated. More + info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not + provided. Variable references $(VAR_NAME) are expanded using + the container''s environment. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double + $$ are reduced to a single $, which allows for escaping + the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references will + never be expanded, regardless of whether the variable exists + or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' items: type: string type: array env: + description: List of environment variables to set in the container. + Cannot be updated. items: + description: EnvVar represents an environment variable present + in a Container. properties: name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. type: string value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables + in the container and any service environment variables. + If a variable cannot be resolved, the reference in + the input string will be unchanged. Double $$ are + reduced to a single $, which allows for escaping the + $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce + the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the + variable exists or not. Defaults to "".' type: string valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. properties: configMapKeyRef: + description: Selects a key of a ConfigMap. properties: key: + description: The key to select. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the ConfigMap or + its key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic secretKeyRef: + description: Selects a key of a secret in the pod's + namespace properties: key: + description: The key of the secret to select + from. Must be a valid secret key. type: string name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: Specify whether the Secret or its + key must be defined type: boolean required: - key type: object + x-kubernetes-map-type: atomic type: object required: - name type: object type: array envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must + be a C_IDENTIFIER. All invalid keys will be reported as + an event when the container is starting. When a key exists + in multiple sources, the value associated with the last + source will take precedence. Values defined by an Env with + a duplicate key will take precedence. Cannot be updated. items: + description: EnvFromSource represents the source of a set + of ConfigMaps properties: configMapRef: + description: The ConfigMap to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the ConfigMap must + be defined type: boolean type: object + x-kubernetes-map-type: atomic prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: + description: The Secret to select from properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string optional: + description: Specify whether the Secret must be + defined type: boolean type: object + x-kubernetes-map-type: atomic type: object type: array image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' type: string imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' type: string lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. properties: postStart: + description: 'PostStart is called immediately after a + container is created. If the handler fails, the container + is terminated and restarted according to its restart + policy. Other management of the container blocks until + the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5502,49 +11869,98 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, + resource contention, etc. The handler is not called + if the container crashes or exits. The Pod''s termination + grace period countdown begins before the PreStop hook + is executed. Regardless of the outcome of the handler, + the container will eventually terminate within the Pod''s + termination grace period (unless delayed by finalizers). + Other management of the container blocks until the hook + completes or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory + for the command is root ('/') in the container's + filesystem. The command is simply exec'd, it + is not run inside a shell, so traditional shell + instructions ('|', etc) won't work. To use a + shell, you need to explicitly call out to that + shell. Exit status of 0 is treated as live/healthy + and non-zero is unhealthy. items: type: string type: array type: object httpGet: + description: HTTPGet specifies the http request to + perform. properties: host: + description: Host name to connect to, defaults + to the pod IP. You probably want to set "Host" + in httpHeaders instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5552,25 +11968,41 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. type: string required: - port type: object tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward + compatibility. There are no validation of this field + and lifecycle hooks will fail in runtime when tcp + handler is specified. properties: host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -5578,37 +12010,71 @@ spec: type: object type: object livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5616,62 +12082,129 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. items: + description: ContainerPort represents a network port in + a single container. properties: containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < + 65536. format: int32 type: integer hostIP: + description: What host IP to bind the external port + to. type: string hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x + < 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. format: int32 type: integer name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. type: string protocol: default: TCP + description: Protocol for port. Must be UDP, TCP, or + SCTP. Defaults to "TCP". type: string required: - containerPort @@ -5682,37 +12215,71 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the + probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5720,47 +12287,111 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. \n This field + is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -5768,6 +12399,8 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -5776,101 +12409,261 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of + compute resources required. If Requests is omitted for + a container, it defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined value. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object securityContext: + description: 'SecurityContext defines the security options + the container should be run with. If set, the fields of + SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' properties: allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag + will be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be + set when spec.os.name is windows.' type: boolean capabilities: + description: The capabilities to add/drop when running + containers. Defaults to the default set of capabilities + granted by the container runtime. Note that this field + cannot be set when spec.os.name is windows. properties: add: + description: Added capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array drop: + description: Removed capabilities items: + description: Capability represent POSIX capabilities + type type: string type: array type: object privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent + to root on the host. Defaults to false. Note that this + field cannot be set when spec.os.name is windows. type: boolean procMount: + description: procMount denotes the type of proc mount + to use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. type: string readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. type: boolean runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as + a non-root user. If true, the Kubelet will validate + the image at runtime to ensure that it does not run + as UID 0 (root) and fail to start the container if it + does. If unset or false, no such validation will be + performed. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to the + container. If unspecified, the container runtime will + allocate a random SELinux context for each container. May + also be set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies + to the container. type: string role: + description: Role is a SELinux role label that applies + to the container. type: string type: + description: Type is a SELinux type label that applies + to the container. type: string user: + description: User is a SELinux user label that applies + to the container. type: string type: object seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile + defined in a file on the node should be used. The + profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's + configured seccomp profile location. Must only be + set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp + profile will be applied. Valid options are: \n Localhost + - a profile defined in a file on the node should + be used. RuntimeDefault - the container runtime + default profile should be used. Unconfined - no + profile should be applied." type: string required: - type type: object windowsOptions: + description: The Windows specific settings applied to + all containers. If unspecified, the options from the + PodSecurityContext will be used. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set + when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA + admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec + named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. type: string hostProcess: + description: HostProcess determines if a container + should be run as a 'Host Process' container. This + field is alpha-level and will only be honored by + components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature + flag will result in errors when validating the Pod. + All of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. type: string type: object type: object startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed + until this completes successfully. If this probe fails, + the Pod will be restarted, just as if the livenessProbe + failed. This can be used to provide different probe parameters + at the beginning of a Pod''s lifecycle, when it might take + a long time to load data or warm a cache, than during steady-state + operation. This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' properties: exec: + description: Exec specifies the action to take. properties: command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', + etc) won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. format: int32 type: integer grpc: + description: GRPC specifies an action involving a GRPC + port. This is a beta field and requires enabling GRPCContainerProbe + feature gate. properties: port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. format: int32 type: integer service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." type: string required: - port type: object httpGet: + description: HTTPGet specifies the http request to perform. properties: host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in httpHeaders + instead. type: string httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. items: + description: HTTPHeader describes a custom header + to be used in HTTP probes properties: name: + description: The header field name type: string value: + description: The header field value type: string required: - name @@ -5878,61 +12671,141 @@ spec: type: object type: array path: + description: Path to access on the HTTP server. type: string port: anyOf: - type: integer - type: string + description: Name or number of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. format: int32 type: integer tcpSocket: + description: TCPSocket specifies an action involving a + TCP port. properties: host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' type: string port: anyOf: - type: integer - type: string + description: Number or name of the port to access + on the container. Number must be in the range 1 + to 65535. Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and + the time when the processes are forcibly halted with + a kill signal. Set this value longer than the expected + cleanup time for your process. If this value is nil, + the pod's terminationGracePeriodSeconds will be used. + Otherwise, this value overrides the value provided by + the pod spec. Value must be non-negative integer. The + value zero indicates stop immediately via the kill signal + (no opportunity to shut down). This is a beta field + and requires enabling ProbeTerminationGracePeriod feature + gate. Minimum value is 1. spec.terminationGracePeriodSeconds + is used if unset. format: int64 type: integer timeoutSeconds: + description: 'Number of seconds after which the probe + times out. Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' format: int32 type: integer type: object stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, + reads from stdin in the container will always result in + EOF. Default is false. type: boolean stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If + this flag is false, a container processes that reads from + stdin will never receive an EOF. Default is false type: boolean terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' type: string terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success + and failure. FallbackToLogsOnError will use the last chunk + of container log output if the termination message file + is empty and the container exited with an error. The log + output is limited to 2048 bytes or 80 lines, whichever is + smaller. Defaults to File. Cannot be updated. type: string tty: + description: Whether this container should allocate a TTY + for itself, also requires 'stdin' to be true. Default is + false. type: boolean volumeDevices: + description: volumeDevices is the list of block devices to + be used by the container. items: + description: volumeDevice describes a mapping of a raw block + device within a container. properties: devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. type: string name: + description: name must match the name of a persistentVolumeClaim + in the pod type: string required: - devicePath @@ -5940,19 +12813,41 @@ spec: type: object type: array volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. items: + description: VolumeMount describes a mounting of a Volume + within a container. properties: mountPath: + description: Path within the container at which the + volume should be mounted. Must not contain ':'. type: string mountPropagation: + description: mountPropagation determines how mounts + are propagated from the host to container and the + other way around. When not set, MountPropagationNone + is used. This field is beta in 1.10. type: string name: + description: This must match the Name of a Volume. type: string readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. type: boolean subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's + root). type: string subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves + similarly to SubPath but environment variable references + $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). SubPathExpr and SubPath + are mutually exclusive. type: string required: - mountPath @@ -5960,21 +12855,50 @@ spec: type: object type: array workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. type: string required: - name type: object type: array nodeName: + description: NodeName is a request to schedule this pod onto a specific + node. If it is non-empty, the scheduler simply schedules this + pod onto that node, assuming that it fits resource requirements. type: string nodeSelector: additionalProperties: type: string + description: 'NodeSelector is a selector which must be true for + the pod to fit on a node. Selector which must match a node''s + labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' type: object x-kubernetes-map-type: atomic os: + description: "Specifies the OS of the containers in the pod. Some + pod and container fields are restricted if this is set. \n If + the OS field is set to linux, the following fields must be unset: + -securityContext.windowsOptions \n If the OS field is set to windows, + following fields must be unset: - spec.hostPID - spec.hostIPC + - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile + - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy + - spec.securityContext.sysctls - spec.shareProcessNamespace - + spec.securityContext.runAsUser - spec.securityContext.runAsGroup + - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions + - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities + - spec.containers[*].securityContext.readOnlyRootFilesystem - + spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation + - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser + - spec.containers[*].securityContext.runAsGroup" properties: name: + description: 'Name is the name of the operating system. The + currently supported values are linux and windows. Additional + value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration + Clients should expect to handle additional values and treat + unrecognized values in this field as os: null' type: string required: - name @@ -5986,75 +12910,271 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Overhead represents the resource overhead associated + with running a pod for a given RuntimeClass. This field will be + autopopulated at admission time by the RuntimeClass admission + controller. If the RuntimeClass admission controller is enabled, + overhead must not be set in Pod create requests. The RuntimeClass + admission controller will reject Pod create requests which have + the overhead already set. If RuntimeClass is configured and selected + in the PodSpec, Overhead will be set to the value defined in the + corresponding RuntimeClass, otherwise it will remain unset and + treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' type: object preemptionPolicy: + description: PreemptionPolicy is the Policy for preempting pods + with lower priority. One of Never, PreemptLowerPriority. Defaults + to PreemptLowerPriority if unset. type: string priority: + description: The priority value. Various system components use this + field to find the priority of the pod. When Priority Admission + Controller is enabled, it prevents users from setting this field. + The admission controller populates this field from PriorityClassName. + The higher the value, the higher the priority. format: int32 type: integer priorityClassName: + description: If specified, indicates the pod's priority. "system-node-critical" + and "system-cluster-critical" are two special keywords which indicate + the highest priorities with the former being the highest priority. + Any other name must be defined by creating a PriorityClass object + with that name. If not specified, the pod priority will be default + or zero if there is no default. type: string readinessGates: + description: 'If specified, all readiness gates will be evaluated + for pod readiness. A pod is ready when all its containers are + ready AND all conditions specified in the readiness gates have + status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' items: + description: PodReadinessGate contains the reference to a pod + condition properties: conditionType: + description: ConditionType refers to a condition in the pod's + condition list with matching type. type: string required: - conditionType type: object type: array + resourceClaims: + description: "ResourceClaims defines which ResourceClaims must be + allocated and reserved before the Pod is allowed to start. The + resources will be made available to those containers which consume + them by name. \n This is an alpha field and requires enabling + the DynamicResourceAllocation feature gate. \n This field is immutable." + items: + description: PodResourceClaim references exactly one ResourceClaim + through a ClaimSource. It adds a name to it that uniquely identifies + the ResourceClaim inside the Pod. Containers that need access + to the ResourceClaim reference it with this name. + properties: + name: + description: Name uniquely identifies this resource claim + inside the pod. This must be a DNS_LABEL. + type: string + source: + description: Source describes where to find the ResourceClaim. + properties: + resourceClaimName: + description: ResourceClaimName is the name of a ResourceClaim + object in the same namespace as this pod. + type: string + resourceClaimTemplateName: + description: "ResourceClaimTemplateName is the name of + a ResourceClaimTemplate object in the same namespace + as this pod. \n The template will be used to create + a new ResourceClaim, which will be bound to this pod. + When this pod is deleted, the ResourceClaim will also + be deleted. The name of the ResourceClaim will be -, where is the + PodResourceClaim.Name. Pod validation will reject the + pod if the concatenated name is not valid for a ResourceClaim + (e.g. too long). \n An existing ResourceClaim with that + name that is not owned by the pod will not be used for + the pod to avoid using an unrelated resource by mistake. + Scheduling and pod startup are then blocked until the + unrelated ResourceClaim is removed. \n This field is + immutable and no changes will be made to the corresponding + ResourceClaim by the control plane after creating the + ResourceClaim." + type: string + type: object + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map restartPolicy: + description: 'Restart policy for all containers within the pod. + One of Always, OnFailure, Never. Default to Always. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' type: string runtimeClassName: + description: 'RuntimeClassName refers to a RuntimeClass object in + the node.k8s.io group, which should be used to run this pod. If + no RuntimeClass resource matches the named class, the pod will + not be run. If unset or empty, the "legacy" RuntimeClass will + be used, which is an implicit class with an empty definition that + uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' type: string schedulerName: + description: If specified, the pod will be dispatched by specified + scheduler. If not specified, the pod will be dispatched by default + scheduler. type: string + schedulingGates: + description: "SchedulingGates is an opaque list of values that if + specified will block scheduling the pod. More info: https://git.k8s.io/enhancements/keps/sig-scheduling/3521-pod-scheduling-readiness. + \n This is an alpha-level feature enabled by PodSchedulingReadiness + feature gate." + items: + description: PodSchedulingGate is associated to a Pod to guard + its scheduling. + properties: + name: + description: Name of the scheduling gate. Each scheduling + gate must have a unique name field. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map securityContext: + description: 'SecurityContext holds pod-level security attributes + and common container settings. Optional: Defaults to empty. See + type description for default values of each field.' properties: fsGroup: + description: "A special supplemental group that applies to all + containers in a pod. Some volume types allow the Kubelet to + change the ownership of that volume to be owned by the pod: + \n 1. The owning GID will be the FSGroup 2. The setgid bit + is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- \n If unset, + the Kubelet will not modify the ownership and permissions + of any volume. Note that this field cannot be set when spec.os.name + is windows." format: int64 type: integer fsGroupChangePolicy: + description: 'fsGroupChangePolicy defines behavior of changing + ownership and permission of the volume before being exposed + inside Pod. This field will only apply to volume types which + support fsGroup based ownership(and permissions). It will + have no effect on ephemeral volume types such as: secret, + configmaps and emptydir. Valid values are "OnRootMismatch" + and "Always". If not specified, "Always" is used. Note that + this field cannot be set when spec.os.name is windows.' type: string runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set in + SecurityContext. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence for + that container. Note that this field cannot be set when spec.os.name + is windows. format: int64 type: integer runAsNonRoot: + description: Indicates that the container must run as a non-root + user. If true, the Kubelet will validate the image at runtime + to ensure that it does not run as UID 0 (root) and fail to + start the container if it does. If unset or false, no such + validation will be performed. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence. type: boolean runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field + cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: + description: The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random + SELinux context for each container. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. properties: level: + description: Level is SELinux level label that applies to + the container. type: string role: + description: Role is a SELinux role label that applies to + the container. type: string type: + description: Type is a SELinux type label that applies to + the container. type: string user: + description: User is a SELinux user label that applies to + the container. type: string type: object seccompProfile: + description: The seccomp options to use by the containers in + this pod. Note that this field cannot be set when spec.os.name + is windows. properties: localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile must + be preconfigured on the node to work. Must be a descending + path, relative to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". type: string type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - a profile + defined in a file on the node should be used. RuntimeDefault + - the container runtime default profile should be used. + Unconfined - no profile should be applied." type: string required: - type type: object supplementalGroups: + description: A list of groups applied to the first process run + in each container, in addition to the container's primary + GID, the fsGroup (if specified), and group memberships defined + in the container image for the uid of the container process. + If unspecified, no additional groups are added to any container. + Note that group memberships defined in the container image + for the uid of the container process are still effective, + even if they are not included in this list. Note that this + field cannot be set when spec.os.name is windows. items: format: int64 type: integer type: array sysctls: + description: Sysctls hold a list of namespaced sysctls used + for the pod. Pods with unsupported sysctls (by the container + runtime) might fail to launch. Note that this field cannot + be set when spec.os.name is windows. items: + description: Sysctl defines a kernel parameter to be set properties: name: + description: Name of a property to set type: string value: + description: Value of a property to set type: string required: - name @@ -6062,59 +13182,165 @@ spec: type: object type: array windowsOptions: + description: The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. type: string hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is alpha-level + and will only be honored by components that enable the + WindowsHostProcessContainers feature flag. Setting this + field without the feature flag will result in errors when + validating the Pod. All of a Pod's containers must have + the same effective HostProcess value (it is not allowed + to have a mix of HostProcess containers and non-HostProcess + containers). In addition, if HostProcess is true then + HostNetwork must also be set to true. type: boolean runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set in PodSecurityContext. + If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. type: string type: object type: object serviceAccount: + description: 'DeprecatedServiceAccount is a depreciated alias for + ServiceAccountName. Deprecated: Use serviceAccountName instead.' type: string serviceAccountName: + description: 'ServiceAccountName is the name of the ServiceAccount + to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' type: string setHostnameAsFQDN: + description: If true the pod's hostname will be configured as the + pod's FQDN, rather than the leaf name (the default). In Linux + containers, this means setting the FQDN in the hostname field + of the kernel (the nodename field of struct utsname). In Windows + containers, this means setting the registry value of hostname + for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters + to FQDN. If a pod does not have FQDN, this has no effect. Default + to false. type: boolean shareProcessNamespace: + description: 'Share a single process namespace between all of the + containers in a pod. When this is set containers will be able + to view and signal processes from other containers in the same + pod, and the first process in each container will not be assigned + PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: + Default to false.' type: boolean subdomain: + description: If specified, the fully qualified Pod hostname will + be "...svc.". + If not specified, the pod will not have a domainname at all. type: string terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs to terminate + gracefully. May be decreased in delete request. Value must be + non-negative integer. The value zero indicates stop immediately + via the kill signal (no opportunity to shut down). If this value + is nil, the default grace period will be used instead. The grace + period is the duration in seconds after the processes running + in the pod are sent a termination signal and the time when the + processes are forcibly halted with a kill signal. Set this value + longer than the expected cleanup time for your process. Defaults + to 30 seconds. format: int64 type: integer tolerations: + description: If specified, the pod's tolerations. items: + description: The pod this Toleration is attached to tolerates + any taint that matches the triple using the + matching operator . properties: effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. type: string key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match + all values and all keys. type: string operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to + Equal. Exists is equivalent to wildcard for value, so that + a pod can tolerate all taints of a particular category. type: string tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do + not evict). Zero and negative values will be treated as + 0 (evict immediately) by the system. format: int64 type: integer value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: + description: TopologySpreadConstraints describes how a group of + pods ought to spread across topology domains. Scheduler will schedule + pods in a way which abides by the constraints. All topologySpreadConstraints + are ANDed. items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. properties: labelSelector: + description: LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine + the number of pods in their corresponding topology domain. properties: matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. properties: key: + description: key is the label key that the selector + applies to. type: string operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. type: string values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. + This array is replaced during a strategic merge + patch. items: type: string type: array @@ -6126,14 +13352,123 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: MatchLabelKeys is a set of pod label keys to + select the pods over which spreading will be calculated. + The keys are used to lookup values from the incoming pod + labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading + will be calculated for the incoming pod. Keys that don't + exist in the incoming pod labels will be ignored. A null + or empty list means only match against labelSelector. + items: + type: string + type: array + x-kubernetes-list-type: atomic maxSkew: + description: 'MaxSkew describes the degree to which pods may + be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, + it is the maximum permitted difference between the number + of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods + in an eligible domain or zero if the number of eligible + domains is less than MinDomains. For example, in a 3-zone + cluster, MaxSkew is set to 1, and pods with the same labelSelector + spread as 2/2/1: In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | | P P | P P | P | - if + MaxSkew is 1, incoming pod can only be scheduled to zone3 + to become 2/2/2; scheduling it onto zone1(zone2) would make + the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any + zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used + to give higher precedence to topologies that satisfy it. + It''s a required field. Default value is 1 and 0 is not + allowed.' format: int32 type: integer + minDomains: + description: "MinDomains indicates a minimum number of eligible + domains. When the number of eligible domains with matching + topology keys is less than minDomains, Pod Topology Spread + treats \"global minimum\" as 0, and then the calculation + of Skew is performed. And when the number of eligible domains + with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. As a result, when + the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those + domains. If value is nil, the constraint behaves as if MinDomains + is equal to 1. Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + \n For example, in a 3-zone cluster, MaxSkew is set to 2, + MinDomains is set to 5 and pods with the same labelSelector + spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P + P | P P | The number of domains is less than 5(MinDomains), + so \"global minimum\" is treated as 0. In this situation, + new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled + to any of the three zones, it will violate MaxSkew. \n This + is a beta field and requires the MinDomainsInPodTopologySpread + feature gate to be enabled (enabled by default)." + format: int32 + type: integer + nodeAffinityPolicy: + description: "NodeAffinityPolicy indicates how we will treat + Pod's nodeAffinity/nodeSelector when calculating pod topology + spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector + are included in the calculations. - Ignore: nodeAffinity/nodeSelector + are ignored. All nodes are included in the calculations. + \n If this value is nil, the behavior is equivalent to the + Honor policy. This is a beta-level feature default enabled + by the NodeInclusionPolicyInPodTopologySpread feature flag." + type: string + nodeTaintsPolicy: + description: "NodeTaintsPolicy indicates how we will treat + node taints when calculating pod topology spread skew. Options + are: - Honor: nodes without taints, along with tainted nodes + for which the incoming pod has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + \n If this value is nil, the behavior is equivalent to the + Ignore policy. This is a beta-level feature default enabled + by the NodeInclusionPolicyInPodTopologySpread feature flag." + type: string topologyKey: + description: TopologyKey is the key of node labels. Nodes + that have a label with this key and identical values are + considered to be in the same topology. We consider each + as a "bucket", and try to put balanced number + of pods into each bucket. We define a domain as a particular + instance of a topology. Also, we define an eligible domain + as a domain whose nodes meet the requirements of nodeAffinityPolicy + and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", + each Node is a domain of that topology. And, if TopologyKey + is "topology.kubernetes.io/zone", each zone is a domain + of that topology. It's a required field. type: string whenUnsatisfiable: + description: 'WhenUnsatisfiable indicates how to deal with + a pod if it doesn''t satisfy the spread constraint. - DoNotSchedule + (default) tells the scheduler not to schedule it. - ScheduleAnyway + tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help + reduce the skew. A constraint is considered "Unsatisfiable" + for an incoming pod if and only if every possible node assignment + for that pod would violate "MaxSkew" on some topology. For + example, in a 3-zone cluster, MaxSkew is set to 1, and pods + with the same labelSelector spread as 3/1/1: | zone1 | zone2 + | zone3 | | P P P | P | P | If WhenUnsatisfiable + is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) + on zone2(zone3) satisfies MaxSkew(1). In other words, the + cluster can still be imbalanced, but scheduler won''t make + it *more* imbalanced. It''s a required field.' type: string required: - maxSkew @@ -6146,104 +13481,229 @@ spec: - whenUnsatisfiable x-kubernetes-list-type: map volumes: + description: 'List of volumes that can be mounted by containers + belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. properties: awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk + resource that is attached to a kubelet''s host machine and + then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' properties: fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default is to + mount by volume name. Examples: For volume /dev/sda1, + you specify the partition as "1". Similarly, the volume + partition for /dev/sda is "0" (or you can leave the + property empty).' format: int32 type: integer readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: boolean volumeID: + description: 'volumeID is unique ID of the persistent + disk resource in AWS (Amazon EBS volume). More info: + https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' type: string required: - volumeID type: object azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. properties: cachingMode: + description: 'cachingMode is the Host Caching mode: None, + Read Only, Read Write.' type: string diskName: + description: diskName is the Name of the data disk in + the blob storage type: string diskURI: + description: diskURI is the URI of data disk in the blob + storage type: string fsType: + description: fsType is Filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single blob + disk per storage account Managed: azure managed data + disk (only in managed availability set). defaults to + shared' type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean required: - diskName - diskURI type: object azureFile: + description: azureFile represents an Azure File Service mount + on the host and bind mount to the pod. properties: readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretName: + description: secretName is the name of secret that contains + Azure Storage Account Name and Key type: string shareName: + description: shareName is the azure share Name type: string required: - secretName - shareName type: object cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime properties: monitors: + description: 'monitors is Required: Monitors is a collection + of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' items: type: string type: array path: + description: 'path is Optional: Used as the mounted root, + rather than the full Ceph tree, default is /' type: string readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: boolean secretFile: + description: 'secretFile is Optional: SecretFile is the + path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string secretRef: + description: 'secretRef is Optional: SecretRef is reference + to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is optional: User is the rados user + name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' type: string required: - monitors type: object cinder: + description: 'cinder represents a cinder volume attached and + mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating + system. Examples: "ext4", "xfs", "ntfs". Implicitly + inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string readOnly: + description: 'readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: boolean secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to OpenStack.' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeID: + description: 'volumeID used to identify the volume in + cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' type: string required: - volumeID type: object configMap: + description: configMap represents a configMap that should + populate this volume properties: defaultMode: + description: 'defaultMode is optional: mode bits used + to set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for mode + bits. Defaults to 0644. Directories within the path + are not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: items if unspecified, each key-value pair + in the Data field of the referenced ConfigMap will be + projected into the volume as a file whose name is the + key and content is the value. If specified, the listed + keys will be projected into the specified paths, and + unlisted keys will not be present. If a key is specified + which is not present in the ConfigMap, the volume setup + will error unless it is marked optional. Paths must + be relative and may not contain the '..' path or start + with '..'. items: + description: Maps a string key to a path within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for + mode bits. If not specified, the volume defaultMode + will be used. This might be in conflict with other + options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not + start with the string '..'. type: string required: - key @@ -6251,121 +13711,368 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' type: string optional: + description: optional specify whether the ConfigMap or + its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers (Beta feature). properties: driver: + description: driver is the name of the CSI driver that + handles this volume. Consult with your admin for the + correct name as registered in the cluster. type: string fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated + CSI driver which will determine the default filesystem + to apply. type: string nodePublishSecretRef: + description: nodePublishSecretRef is a reference to the + secret object containing sensitive information to pass + to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the secret + object contains more than one secret, all secret references + are passed. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string + description: volumeAttributes stores driver-specific properties + that are passed to the CSI driver. Consult your driver's + documentation for supported values. type: object required: - driver type: object downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume properties: defaultMode: + description: 'Optional: mode bits to use on created files + by default. Must be a Optional: mode bits used to set + permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and decimal + values, JSON requires decimal values for mode bits. + Defaults to 0644. Directories within the path are not + affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: Items is a list of downward API volume file items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field properties: fieldRef: + description: 'Required: Selects a field of the pod: + only annotations, labels, name and namespace are + supported.' properties: apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". type: string fieldPath: + description: Path of the field to select in + the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used to set permissions + on this file, must be an octal value between 0000 + and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON + requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' format: int32 type: integer path: + description: 'Required: Path is the relative path + name of the file to be created. Must not be absolute + or contain the ''..'' path. Must be utf-8 encoded. + The first item of the relative path must not start + with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' properties: containerName: + description: 'Container name: required for volumes, + optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object emptyDir: + description: 'emptyDir represents a temporary directory that + shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' properties: medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which + means to use the node''s default medium. Must be an + empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' type: string sizeLimit: anyOf: - type: integer - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is + also applicable for memory medium. The maximum usage + on memory medium EmptyDir would be the minimum value + between the SizeLimit specified here and the sum of + memory limits of all containers in a pod. The default + is nil which means that the limit is undefined. More + info: http://kubernetes.io/docs/user-guide/volumes#emptydir' pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle is tied + to the pod that defines it - it will be created before the + pod starts, and deleted when the pod is removed. \n Use + this if: a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot + or capacity tracking are needed, c) the storage driver is + specified through a storage class, and d) the storage driver + supports dynamic volume provisioning through a PersistentVolumeClaim + (see EphemeralVolumeSource for more information on the connection + between this volume type and PersistentVolumeClaim). \n + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. \n Use CSI for light-weight local + ephemeral volumes if the CSI driver is meant to be used + that way - see the documentation of the driver for more + information. \n A pod can use both types of ephemeral volumes + and persistent volumes at the same time." properties: volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC + to provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC + will be deleted together with the pod. The name of + the PVC will be `-` where `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). + \n An existing PVC with that name that is not owned + by the pod will *not* be used for the pod to avoid using + an unrelated volume by mistake. Starting the pod is + then blocked until the unrelated PVC is removed. If + such a pre-created PVC is meant to be used by the pod, + the PVC has to updated with an owner reference to the + pod once the pod exists. Normally this should not be + necessary, but it may be useful when manually reconstructing + a broken cluster. \n This field is read-only and no + changes will be made by Kubernetes to the PVC after + it has been created. \n Required, must not be nil." properties: metadata: + description: May contain labels and annotations that + will be copied into the PVC when creating it. No + other fields are allowed and will be rejected during + validation. type: object spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the + PVC that gets created from this template. The same + fields as in a PersistentVolumeClaim are also valid + here. properties: accessModes: + description: 'accessModes contains the desired + access modes the volume should have. More info: + https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' items: type: string type: array dataSource: + description: 'dataSource field can be used to + specify either: * An existing VolumeSnapshot + object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If + the provisioner or an external controller can + support the specified data source, it will create + a new volume based on the contents of the specified + data source. When the AnyVolumeDataSource feature + gate is enabled, dataSource contents will be + copied to dataSourceRef, and dataSourceRef contents + will be copied to dataSource when dataSourceRef.namespace + is not specified. If the namespace is specified, + then dataSourceRef will not be copied to dataSource.' properties: apiGroup: + description: APIGroup is the group for the + resource being referenced. If APIGroup is + not specified, the specified Kind must be + in the core API group. For any other third-party + types, APIGroup is required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced type: string required: - kind - name type: object + x-kubernetes-map-type: atomic dataSourceRef: + description: 'dataSourceRef specifies the object + from which to populate the volume with data, + if a non-empty volume is desired. This may be + any object from a non-empty API group (non core + object) or a PersistentVolumeClaim object. When + this field is specified, volume binding will + only succeed if the type of the specified object + matches some installed volume populator or dynamic + provisioner. This field will replace the functionality + of the dataSource field and as such if both + fields are non-empty, they must have the same + value. For backwards compatibility, when namespace + isn''t specified in dataSourceRef, both fields + (dataSource and dataSourceRef) will be set to + the same value automatically if one of them + is empty and the other is non-empty. When namespace + is specified in dataSourceRef, dataSource isn''t + set to the same value and must be empty. There + are three important differences between dataSource + and dataSourceRef: * While dataSource only allows + two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim + objects. * While dataSource ignores disallowed + values (dropping them), dataSourceRef preserves + all values, and generates an error if a disallowed + value is specified. * While dataSource only + allows local objects, dataSourceRef allows objects + in any namespaces. (Beta) Using this field requires + the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef + requires the CrossNamespaceVolumeDataSource + feature gate to be enabled.' properties: apiGroup: + description: APIGroup is the group for the + resource being referenced. If APIGroup is + not specified, the specified Kind must be + in the core API group. For any other third-party + types, APIGroup is required. type: string kind: + description: Kind is the type of resource + being referenced type: string name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: Namespace is the namespace of + resource being referenced Note that when + a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferenceGrant documentation + for details. (Alpha) This field requires + the CrossNamespaceVolumeDataSource feature + gate to be enabled. type: string required: - kind - name type: object resources: + description: 'resources represents the minimum + resources the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity + recorded in the status field of the claim. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are + used by this container. \n This is an alpha + field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one + entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name + of one entry in pod.spec.resourceClaims + of the Pod where this field is used. + It makes that resource available inside + a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: additionalProperties: anyOf: @@ -6373,6 +14080,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Limits describes the maximum + amount of compute resources allowed. More + info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object requests: additionalProperties: @@ -6381,18 +14091,46 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. If + Requests is omitted for a container, it + defaults to Limits if that is explicitly + specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' type: object type: object selector: + description: selector is a label query over volumes + to consider for binding. properties: matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. items: + description: A label selector requirement + is a selector that contains values, a + key, and an operator that relates the + key and values. properties: key: + description: key is the label key that + the selector applies to. type: string operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. type: string values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. items: type: string type: array @@ -6404,13 +14142,28 @@ spec: matchLabels: additionalProperties: type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only + "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic storageClassName: + description: 'storageClassName is the name of + the StorageClass required by the claim. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' type: string volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem + is implied when not included in claim spec. type: string volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. type: string type: object required: @@ -6418,125 +14171,264 @@ spec: type: object type: object fc: + description: fc represents a Fibre Channel resource that is + attached to a kubelet's host machine and then exposed to + the pod. properties: fsType: + description: 'fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. TODO: how do we prevent + errors in the filesystem from compromising the machine' type: string lun: + description: 'lun is Optional: FC target lun number' format: int32 type: integer readOnly: + description: 'readOnly is Optional: Defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' items: type: string type: array wwids: + description: 'wwids Optional: FC volume world wide identifiers + (wwids) Either wwids or combination of targetWWNs and + lun must be set, but not both simultaneously.' items: type: string type: array type: object flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. properties: driver: + description: driver is the name of the driver to use for + this volume. type: string fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". The default filesystem + depends on FlexVolume script. type: string options: additionalProperties: type: string + description: 'options is Optional: this field holds extra + command options if any.' type: object readOnly: + description: 'readOnly is Optional: defaults to false + (read/write). ReadOnly here will force the ReadOnly + setting in VolumeMounts.' type: boolean secretRef: + description: 'secretRef is Optional: secretRef is reference + to the secret object containing sensitive information + to pass to the plugin scripts. This may be empty if + no secret object is specified. If the secret object + contains more than one secret, all secrets are passed + to the plugin scripts.' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic required: - driver type: object flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running properties: datasetName: + description: datasetName is Name of the dataset stored + as metadata -> name on the dataset for Flocker should + be considered as deprecated type: string datasetUUID: + description: datasetUUID is the UUID of the dataset. This + is unique identifier of a Flocker dataset type: string type: object gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' properties: fsType: + description: 'fsType is filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string partition: + description: 'partition is the partition in the volume + that you want to mount. If omitted, the default is to + mount by volume name. Examples: For volume /dev/sda1, + you specify the partition as "1". Similarly, the volume + partition for /dev/sda is "0" (or you can leave the + property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' format: int32 type: integer pdName: + description: 'pdName is unique name of the PD resource + in GCE. Used to identify the disk in GCE. More info: + https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: string readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' type: boolean required: - pdName type: object gitRepo: + description: 'gitRepo represents a git repository at a particular + revision. DEPRECATED: GitRepo is deprecated. To provision + a container with a git repo, mount an EmptyDir into an InitContainer + that clones the repo using git, then mount the EmptyDir + into the Pod''s container.' properties: directory: + description: directory is the target directory name. Must + not contain or start with '..'. If '.' is supplied, + the volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. type: string repository: + description: repository is the URL type: string revision: + description: revision is the commit hash for the specified + revision. type: string required: - repository type: object glusterfs: + description: 'glusterfs represents a Glusterfs mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' properties: endpoints: + description: 'endpoints is the endpoint name that details + Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string path: + description: 'path is the Glusterfs volume path. More + info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: string readOnly: + description: 'readOnly here will force the Glusterfs volume + to be mounted with read-only permissions. Defaults to + false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' type: boolean required: - endpoints - path type: object hostPath: + description: 'hostPath represents a pre-existing file or directory + on the host machine that is directly exposed to the container. + This is generally used for system agents or other privileged + things that are allowed to see the host machine. Most containers + will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host directory + mounts and who can/can not mount host directories as read/write.' properties: path: + description: 'path of the directory on the host. If the + path is a symlink, it will follow the link to the real + path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string type: + description: 'type for HostPath Volume Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' type: string required: - path type: object iscsi: + description: 'iscsi represents an ISCSI Disk resource that + is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' properties: chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication type: boolean chapAuthSession: + description: chapAuthSession defines whether support iSCSI + Session CHAP authentication type: boolean fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. type: string iqn: + description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: + description: iscsiInterface is the interface Name that + uses an iSCSI transport. Defaults to 'default' (tcp). type: string lun: + description: lun represents iSCSI Target Lun number. format: int32 type: integer portals: + description: portals is the iSCSI Target Portal List. + The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). items: type: string type: array readOnly: + description: readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. type: boolean secretRef: + description: secretRef is the CHAP Secret for iSCSI target + and initiator authentication properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic targetPortal: + description: targetPortal is iSCSI Target Portal. The + Portal is either an IP or ip_addr:port if the port is + other than default (typically TCP ports 860 and 3260). type: string required: - iqn @@ -6544,67 +14436,150 @@ spec: - targetPortal type: object name: + description: 'name of the volume. Must be a DNS_LABEL and + unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' type: string nfs: + description: 'nfs represents an NFS mount on the host that + shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' properties: path: + description: 'path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string readOnly: + description: 'readOnly here will force the NFS export + to be mounted with read-only permissions. Defaults to + false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: boolean server: + description: 'server is the hostname or IP address of + the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' type: string required: - path - server type: object persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents + a reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' properties: claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' type: string readOnly: + description: readOnly Will force the ReadOnly setting + in VolumeMounts. Default false. type: boolean required: - claimName type: object photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host machine properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk type: string required: - pdID type: object portworxVolume: + description: portworxVolume represents a portworx volume attached + and mounted on kubelets host machine properties: fsType: + description: fSType represents the filesystem type to + mount Must be a filesystem type supported by the host + operating system. Ex. "ext4", "xfs". Implicitly inferred + to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean volumeID: + description: volumeID uniquely identifies a Portworx volume type: string required: - volumeID type: object projected: + description: projected items for all in one resources secrets, + configmaps, and downward API properties: defaultMode: + description: defaultMode are the mode bits used to set + permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and decimal + values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this + setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set. format: int32 type: integer sources: + description: sources is the list of volume projections items: + description: Projection that may be projected along + with other supported volume types properties: configMap: + description: configMap information about the configMap + data to project properties: items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the ConfigMap, the + volume setup will error unless it is marked + optional. Paths must be relative and may not + contain the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 + and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal + values for mode bits. If not specified, + the volume defaultMode will be used. + This might be in conflict with other + options that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative path + of the file to map the key to. May not + be an absolute path. May not contain + the path element '..'. May not start + with the string '..'. type: string required: - key @@ -6612,60 +14587,147 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional specify whether the ConfigMap + or its keys must be defined type: boolean type: object + x-kubernetes-map-type: atomic downwardAPI: + description: downwardAPI information about the downwardAPI + data to project properties: items: + description: Items is a list of DownwardAPIVolume + file items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field properties: fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' properties: apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". type: string fieldPath: + description: Path of the field to + select in the specified API version. type: string required: - fieldPath type: object + x-kubernetes-map-type: atomic mode: + description: 'Optional: mode bits used + to set permissions on this file, must + be an octal value between 0000 and 0777 + or a decimal value between 0 and 511. + YAML accepts both octal and decimal + values, JSON requires decimal values + for mode bits. If not specified, the + volume defaultMode will be used. This + might be in conflict with other options + that affect the file mode, like fsGroup, + and the result can be other mode bits + set.' format: int32 type: integer path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' type: string resourceFieldRef: + description: 'Selects a resource of the + container: only resources limits and + requests (limits.cpu, limits.memory, + requests.cpu and requests.memory) are + currently supported.' properties: containerName: + description: 'Container name: required + for volumes, optional for env vars' type: string divisor: anyOf: - type: integer - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true resource: + description: 'Required: resource to + select' type: string required: - resource type: object + x-kubernetes-map-type: atomic required: - path type: object type: array type: object secret: + description: secret information about the secret + data to project properties: items: + description: items if unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified + which is not present in the Secret, the volume + setup will error unless it is marked optional. + Paths must be relative and may not contain + the '..' path or start with '..'. items: + description: Maps a string key to a path within + a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 + and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal + values for mode bits. If not specified, + the volume defaultMode will be used. + This might be in conflict with other + options that affect the file mode, like + fsGroup, and the result can be other + mode bits set.' format: int32 type: integer path: + description: path is the relative path + of the file to map the key to. May not + be an absolute path. May not contain + the path element '..'. May not start + with the string '..'. type: string required: - key @@ -6673,18 +14735,45 @@ spec: type: object type: array name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' type: string optional: + description: optional field specify whether + the Secret or its key must be defined type: boolean type: object + x-kubernetes-map-type: atomic serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project properties: audience: + description: audience is the intended audience + of the token. A recipient of a token must + identify itself with an identifier specified + in the audience of the token, and otherwise + should reject the token. The audience defaults + to the identifier of the apiserver. type: string expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, + the kubelet volume plugin will proactively + rotate the service account token. The kubelet + will start trying to rotate the token if the + token is older than 80 percent of its time + to live or if the token is older than 24 hours.Defaults + to 1 hour and must be at least 10 minutes. format: int64 type: integer path: + description: path is the path relative to the + mount point of the file to project the token + into. type: string required: - path @@ -6693,74 +14782,150 @@ spec: type: array type: object quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime properties: group: + description: group to map volume access to Default is + no group type: string readOnly: + description: readOnly here will force the Quobyte volume + to be mounted with read-only permissions. Defaults to + false. type: boolean registry: + description: registry represents a single or multiple + Quobyte Registry services specified as a string as host:port + pair (multiple entries are separated with commas) which + acts as the central registry for volumes type: string tenant: + description: tenant owning the given Quobyte volume in + the Backend Used with dynamically provisioned Quobyte + volumes, value is set by the plugin type: string user: + description: user to map volume access to Defaults to + serivceaccount user type: string volume: + description: volume is a string that references an already + created Quobyte volume by name. type: string required: - registry - volume type: object rbd: + description: 'rbd represents a Rados Block Device mount on + the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' properties: fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from + compromising the machine' type: string image: + description: 'image is the rados image name. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string keyring: + description: 'keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' items: type: string type: array pool: + description: 'pool is the rados pool name. Default is + rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: boolean secretRef: + description: 'secretRef is name of the authentication + secret for RBDUser. If provided overrides keyring. Default + is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic user: + description: 'user is the rados user name. Default is + admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' type: string required: - image - monitors type: object scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Default is "xfs". type: string gateway: + description: gateway is the host address of the ScaleIO + API Gateway. type: string protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. type: string readOnly: + description: readOnly Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: + description: secretRef references to the secret for ScaleIO + user and other sensitive information. If this is not + provided, Login operation will fail. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false type: boolean storageMode: + description: storageMode indicates whether the storage + for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. type: string storagePool: + description: storagePool is the ScaleIO Storage Pool associated + with the protection domain. type: string system: + description: system is the name of the storage system + as configured in ScaleIO. type: string volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated with + this volume source. type: string required: - gateway @@ -6768,19 +14933,54 @@ spec: - system type: object secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' properties: defaultMode: + description: 'defaultMode is Optional: mode bits used + to set permissions on created files by default. Must + be an octal value between 0000 and 0777 or a decimal + value between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for mode + bits. Defaults to 0644. Directories within the path + are not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer items: + description: items If unspecified, each key-value pair + in the Data field of the referenced Secret will be projected + into the volume as a file whose name is the key and + content is the value. If specified, the listed keys + will be projected into the specified paths, and unlisted + keys will not be present. If a key is specified which + is not present in the Secret, the volume setup will + error unless it is marked optional. Paths must be relative + and may not contain the '..' path or start with '..'. items: + description: Maps a string key to a path within a volume. properties: key: + description: key is the key to project. type: string mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal + value between 0000 and 0777 or a decimal value + between 0 and 511. YAML accepts both octal and + decimal values, JSON requires decimal values for + mode bits. If not specified, the volume defaultMode + will be used. This might be in conflict with other + options that affect the file mode, like fsGroup, + and the result can be other mode bits set.' format: int32 type: integer path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not + start with the string '..'. type: string required: - key @@ -6788,35 +14988,77 @@ spec: type: object type: array optional: + description: optional field specify whether the Secret + or its keys must be defined type: boolean secretName: + description: 'secretName is the name of the secret in + the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' type: string type: object storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. properties: fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string readOnly: + description: readOnly defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: + description: secretRef specifies the secret to use for + obtaining the StorageOS API credentials. If not specified, + default values will be attempted. properties: name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' type: string type: object + x-kubernetes-map-type: atomic volumeName: + description: volumeName is the human-readable name of + the StorageOS volume. Volume names are only unique + within a namespace. type: string volumeNamespace: + description: volumeNamespace specifies the scope of the + volume within StorageOS. If no namespace is specified + then the Pod's namespace will be used. This allows + the Kubernetes name scoping to be mirrored within StorageOS + for tighter integration. Set VolumeName to any name + to override the default behaviour. Set to "default" + if you are not using namespaces within StorageOS. Namespaces + that do not pre-exist within StorageOS will be created. type: string type: object vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine properties: fsType: + description: fsType is filesystem type to mount. Must + be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred + to be "ext4" if unspecified. type: string storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. type: string storagePolicyName: + description: storagePolicyName is the storage Policy Based + Management (SPBM) profile name. type: string volumePath: + description: volumePath is the path that identifies vSphere + volume vmdk type: string required: - volumePath @@ -6829,8 +15071,11 @@ spec: - containers type: object timeout: + description: Timeout defines the maximum amount of time the Serving + should take to execute before the Serving is running. type: string tracing: + description: Tracing is the config of tracing. properties: baggage: additionalProperties: @@ -6870,22 +15115,28 @@ spec: type: string type: object required: - - baggage - enabled - provider type: object triggers: + description: Triggers used to trigger the Function. properties: dapr: items: properties: inputName: + description: 'Deprecated: Only for compatibility with v1beta1' type: string name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string topic: type: string type: + description: Type is the type of the component, if it is not + set, controller will get it automatically. type: string required: - name @@ -6893,18 +15144,33 @@ spec: type: array http: properties: + engine: + description: Http function runtime engine, can be set to knative + or keda, default to knative if not set + type: string port: + description: The port on which the function will be invoked format: int32 type: integer route: + description: Information needed to make HTTPRoute. Will attempt + to make HTTPRoute using the default Gateway resource if Route + is nil. properties: gatewayRef: + description: GatewayRef references the Gateway resources + that a Route wants to be attached to. properties: name: + description: Name is the name of the referent. It refers + to the name of a Gateway resource. maxLength: 253 minLength: 1 type: string namespace: + description: Namespace is the namespace of the referent. + When unspecified, this refers to the local namespace + of the Route. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ @@ -6914,7 +15180,23 @@ spec: - namespace type: object hostnames: + description: Hostnames defines a set of hostname that should + match against the HTTP Host header to select a HTTPRoute + to process the request. items: + description: "Hostname is the fully qualified domain name + of a network host. This matches the RFC 1123 definition + of a hostname with 2 notable exceptions: \n 1. IPs are + not allowed. 2. A hostname may be prefixed with a wildcard + label (`*.`). The wildcard label must appear by itself + as the first label. \n Hostname can be \"precise\" which + is a domain name without the terminating dot of a network + host (e.g. \"foo.example.com\") or \"wildcard\", which + is a domain name prefixed with a single wildcard label + (e.g. `*.example.com`). \n Note that as per RFC1035 + and RFC1123, a *label* must consist of lower case alphanumeric + characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ @@ -6922,26 +15204,75 @@ spec: maxItems: 16 type: array rules: + description: Rules are a list of HTTP matchers, filters + and actions. items: + description: HTTPRouteRule defines semantics for matching + an HTTP request based on conditions (matches), processing + it (filters), and forwarding the request to an API object + (backendRefs). properties: backendRefs: + description: "If unspecified or invalid (refers to + a non-existent resource or a Service with no endpoints), + the rule performs no forwarding. If there are also + no filters specified that would result in a response + being sent, a HTTP 503 status code is returned. + 503 responses must be sent so that the overall weight + is respected; if an invalid backend is requested + to have 80% of requests, then 80% of requests must + get a 503 instead. \n Support: Core for Kubernetes + Service Support: Custom for any other resource \n + Support for weight: Core" items: + description: HTTPBackendRef defines how a HTTPRoute + should forward an HTTP request. properties: filters: + description: "Filters defined at this level + should be executed if and only if the request + is being forwarded to the backend defined + here. \n Support: Custom (For broader support + of filters, use the Filters field in HTTPRouteRule.)" items: + description: HTTPRouteFilter defines processing + steps that must be completed during the + request or response lifecycle. HTTPRouteFilters + are meant as an extension point to express + processing that may be done in Gateway implementations. + Some examples include request or response + modification, implementing authentication + strategies, rate-limiting, and traffic shaping. + API guarantee/conformance is defined based + on the type of the filter. properties: extensionRef: + description: "ExtensionRef is an optional, + implementation-specific extension to + the \"filter\" behavior. For example, + resource \"myroutefilter\" in group + \"networking.example.net\"). ExtensionRef + MUST NOT be used for core and extended + filters. \n Support: Implementation-specific" properties: group: + description: Group is the group of + the referent. For example, "networking.k8s.io". + When unspecified (empty string), + core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is kind of the referent. + For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the + referent. maxLength: 253 minLength: 1 type: string @@ -6951,16 +15282,47 @@ spec: - name type: object requestHeaderModifier: + description: "RequestHeaderModifier defines + a schema for a filter that modifies + request headers. \n Support: Core" properties: add: + description: "Add adds the given header(s) + (name, value) to the request before + the action. It appends to any existing + values associated with the header + name. \n Input: GET /foo HTTP/1.1 + my-header: foo \n Config: add: - + name: \"my-header\" value: \"bar\" + \n Output: GET /foo HTTP/1.1 my-header: + foo my-header: bar" items: + description: HTTPHeader represents + an HTTP Header name and value + as defined by RFC 7230. properties: name: + description: "Name is the name + of the HTTP Header to be matched. + Name matching MUST be case + insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify + equivalent header names, the + first entry with an equivalent + name MUST be considered for + a match. Subsequent entries + with an equivalent header + name MUST be ignored. Due + to the case-insensitivity + of header names, \"foo\" and + \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value + of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -6974,19 +15336,56 @@ spec: - name x-kubernetes-list-type: map remove: + description: "Remove the given header(s) + from the HTTP request before the + action. The value of Remove is a + list of HTTP header names. Note + that the header names are case-insensitive + (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + \n Input: GET /foo HTTP/1.1 my-header1: + foo my-header2: bar my-header3: + baz \n Config: remove: [\"my-header1\", + \"my-header3\"] \n Output: GET /foo + HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: + description: "Set overwrites the request + with the given header (name, value) + before the action. \n Input: GET + /foo HTTP/1.1 my-header: foo \n + Config: set: - name: \"my-header\" + value: \"bar\" \n Output: GET /foo + HTTP/1.1 my-header: bar" items: + description: HTTPHeader represents + an HTTP Header name and value + as defined by RFC 7230. properties: name: + description: "Name is the name + of the HTTP Header to be matched. + Name matching MUST be case + insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify + equivalent header names, the + first entry with an equivalent + name MUST be considered for + a match. Subsequent entries + with an equivalent header + name MUST be ignored. Due + to the case-insensitivity + of header names, \"foo\" and + \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value + of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7001,30 +15400,87 @@ spec: x-kubernetes-list-type: map type: object requestMirror: + description: "RequestMirror defines a + schema for a filter that mirrors requests. + Requests are sent to the specified destination, + but responses from that destination + are ignored. \n Support: Extended" properties: backendRef: + description: "BackendRef references + a resource where mirrored requests + are sent. \n If the referent cannot + be found, this BackendRef is invalid + and must be dropped from the Gateway. + The controller must ensure the \"ResolvedRefs\" + condition on the Route status is + set to `status: False` and not configure + this backend in the underlying implementation. + \n If there is a cross-namespace + reference to an *existing* object + that is not allowed by a ReferencePolicy, + the controller must ensure the \"ResolvedRefs\" + \ condition on the Route is set + to `status: False`, with the \"RefNotPermitted\" + reason and not configure this backend + in the underlying implementation. + \n In either error case, the Message + of the `ResolvedRefs` Condition + should be used to provide more detail + about the problem. \n Support: Extended + for Kubernetes Service Support: + Custom for any other resource" properties: group: default: "" + description: Group is the group + of the referent. For example, + "networking.k8s.io". When unspecified + (empty string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind of the + referent. For example "HTTPRoute" + or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name + of the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the + namespace of the backend. When + unspecified, the local namespace + is inferred. \n Note that when + a namespace is specified, a + ReferencePolicy object is required + in the referent namespace to + allow that namespace's owner + to accept the reference. See + the ReferencePolicy documentation + for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies the + destination port number to use + for this resource. Port is required + when the referent is a Kubernetes + Service. For other resources, + destination port might be derived + from the referent resource or + this field. format: int32 maximum: 65535 minimum: 1 @@ -7036,30 +15492,84 @@ spec: - backendRef type: object requestRedirect: + description: "RequestRedirect defines + a schema for a filter that responds + to the request with an HTTP redirection. + \n Support: Core" properties: hostname: + description: "Hostname is the hostname + to be used in the value of the `Location` + header in the response. When empty, + the hostname of the request is used. + \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: + description: "Port is the port to + be used in the value of the `Location` + header in the response. When empty, + port (if specified) of the request + is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: + description: "Scheme is the scheme + to be used in the value of the `Location` + header in the response. When empty, + the scheme of the request is used. + \n Support: Extended" enum: - http - https type: string statusCode: default: 302 + description: "StatusCode is the HTTP + status code to be used in response. + \n Support: Core" enum: - 301 - 302 type: integer type: object type: + description: "Type identifies the type + of filter to apply. As with other API + fields, types are classified into three + conformance levels: \n - Core: Filter + types and their corresponding configuration + defined by \"Support: Core\" in this + package, e.g. \"RequestHeaderModifier\". + All implementations must support core + filters. \n - Extended: Filter types + and their corresponding configuration + defined by \"Support: Extended\" in + this package, e.g. \"RequestMirror\". + Implementers are encouraged to support + extended filters. \n - Custom: Filters + that are defined and supported by specific + vendors. In the future, filters showing + convergence in behavior across multiple + implementations will be considered for + inclusion in extended or core conformance + levels. Filter-specific configuration + for such filters is specified using + the ExtensionRef field. `Type` should + be set to \"ExtensionRef\" for custom + filters. \n Implementers are encouraged + to define custom implementation types + to extend the core API with implementation-specific + behavior. \n If a reference to a custom + filter type cannot be resolved, the + filter MUST NOT be skipped. Instead, + requests that would have been processed + by that filter MUST receive a HTTP error + response." enum: - RequestHeaderModifier - RequestMirror @@ -7073,31 +15583,66 @@ spec: type: array group: default: "" + description: Group is the group of the referent. + For example, "networking.k8s.io". When unspecified + (empty string), core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the namespace of + the backend. When unspecified, the local namespace + is inferred. \n Note that when a namespace + is specified, a ReferencePolicy object is + required in the referent namespace to allow + that namespace's owner to accept the reference. + See the ReferencePolicy documentation for + details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies the destination + port number to use for this resource. Port + is required when the referent is a Kubernetes + Service. For other resources, destination + port might be derived from the referent resource + or this field. format: int32 maximum: 65535 minimum: 1 type: integer weight: default: 1 + description: "Weight specifies the proportion + of requests forwarded to the referenced backend. + This is computed as weight/(sum of all weights + in this BackendRefs list). For non-zero values, + there may be some epsilon from the exact proportion + defined here depending on the precision an + implementation supports. Weight is not a percentage + and the sum of weights does not need to equal + 100. \n If only one backend is specified and + it has a weight greater than 0, 100% of the + traffic is forwarded to that backend. If weight + is set to 0, no traffic should be forwarded + for this entry. If unspecified, weight defaults + to 1. \n Support for this field varies based + on the context where used." format: int32 maximum: 1000000 minimum: 0 @@ -7108,20 +15653,54 @@ spec: maxItems: 16 type: array filters: + description: "Filters define the filters that are + applied to requests that match this rule. \n The + effects of ordering of multiple behaviors are currently + unspecified. This can change in the future based + on feedback during the alpha stage. \n Conformance-levels + at this level are defined based on the type of filter: + \n - ALL core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended + filters. - Implementation-specific custom filters + have no API guarantees across implementations. \n + Specifying a core filter multiple times has unspecified + or custom conformance. \n Support: Core" items: + description: HTTPRouteFilter defines processing + steps that must be completed during the request + or response lifecycle. HTTPRouteFilters are meant + as an extension point to express processing that + may be done in Gateway implementations. Some examples + include request or response modification, implementing + authentication strategies, rate-limiting, and + traffic shaping. API guarantee/conformance is + defined based on the type of the filter. properties: extensionRef: + description: "ExtensionRef is an optional, implementation-specific + extension to the \"filter\" behavior. For + example, resource \"myroutefilter\" in group + \"networking.example.net\"). ExtensionRef + MUST NOT be used for core and extended filters. + \n Support: Implementation-specific" properties: group: + description: Group is the group of the referent. + For example, "networking.k8s.io". When + unspecified (empty string), core API group + is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: + description: Kind is kind of the referent. + For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string @@ -7131,16 +15710,44 @@ spec: - name type: object requestHeaderModifier: + description: "RequestHeaderModifier defines + a schema for a filter that modifies request + headers. \n Support: Core" properties: add: + description: "Add adds the given header(s) + (name, value) to the request before the + action. It appends to any existing values + associated with the header name. \n Input: + GET /foo HTTP/1.1 my-header: foo \n Config: + add: - name: \"my-header\" value: \"bar\" + \n Output: GET /foo HTTP/1.1 my-header: + foo my-header: bar" items: + description: HTTPHeader represents an + HTTP Header name and value as defined + by RFC 7230. properties: name: + description: "Name is the name of + the HTTP Header to be matched. Name + matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify equivalent + header names, the first entry with + an equivalent name MUST be considered + for a match. Subsequent entries + with an equivalent header name MUST + be ignored. Due to the case-insensitivity + of header names, \"foo\" and \"Foo\" + are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value of + HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7154,19 +15761,52 @@ spec: - name x-kubernetes-list-type: map remove: + description: "Remove the given header(s) + from the HTTP request before the action. + The value of Remove is a list of HTTP + header names. Note that the header names + are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + \n Input: GET /foo HTTP/1.1 my-header1: + foo my-header2: bar my-header3: baz \n + Config: remove: [\"my-header1\", \"my-header3\"] + \n Output: GET /foo HTTP/1.1 my-header2: + bar" items: type: string maxItems: 16 type: array set: + description: "Set overwrites the request + with the given header (name, value) before + the action. \n Input: GET /foo HTTP/1.1 + my-header: foo \n Config: set: - name: + \"my-header\" value: \"bar\" \n Output: + GET /foo HTTP/1.1 my-header: bar" items: + description: HTTPHeader represents an + HTTP Header name and value as defined + by RFC 7230. properties: name: + description: "Name is the name of + the HTTP Header to be matched. Name + matching MUST be case insensitive. + (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify equivalent + header names, the first entry with + an equivalent name MUST be considered + for a match. Subsequent entries + with an equivalent header name MUST + be ignored. Due to the case-insensitivity + of header names, \"foo\" and \"Foo\" + are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: + description: Value is the value of + HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7181,30 +15821,81 @@ spec: x-kubernetes-list-type: map type: object requestMirror: + description: "RequestMirror defines a schema + for a filter that mirrors requests. Requests + are sent to the specified destination, but + responses from that destination are ignored. + \n Support: Extended" properties: backendRef: + description: "BackendRef references a resource + where mirrored requests are sent. \n If + the referent cannot be found, this BackendRef + is invalid and must be dropped from the + Gateway. The controller must ensure the + \"ResolvedRefs\" condition on the Route + status is set to `status: False` and not + configure this backend in the underlying + implementation. \n If there is a cross-namespace + reference to an *existing* object that + is not allowed by a ReferencePolicy, the + controller must ensure the \"ResolvedRefs\" + \ condition on the Route is set to `status: + False`, with the \"RefNotPermitted\" reason + and not configure this backend in the + underlying implementation. \n In either + error case, the Message of the `ResolvedRefs` + Condition should be used to provide more + detail about the problem. \n Support: + Extended for Kubernetes Service Support: + Custom for any other resource" properties: group: default: "" + description: Group is the group of the + referent. For example, "networking.k8s.io". + When unspecified (empty string), core + API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service + description: Kind is kind of the referent. + For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: + description: Name is the name of the + referent. maxLength: 253 minLength: 1 type: string namespace: + description: "Namespace is the namespace + of the backend. When unspecified, + the local namespace is inferred. \n + Note that when a namespace is specified, + a ReferencePolicy object is required + in the referent namespace to allow + that namespace's owner to accept the + reference. See the ReferencePolicy + documentation for details. \n Support: + Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: + description: Port specifies the destination + port number to use for this resource. + Port is required when the referent + is a Kubernetes Service. For other + resources, destination port might + be derived from the referent resource + or this field. format: int32 maximum: 65535 minimum: 1 @@ -7216,30 +15907,77 @@ spec: - backendRef type: object requestRedirect: + description: "RequestRedirect defines a schema + for a filter that responds to the request + with an HTTP redirection. \n Support: Core" properties: hostname: + description: "Hostname is the hostname to + be used in the value of the `Location` + header in the response. When empty, the + hostname of the request is used. \n Support: + Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: + description: "Port is the port to be used + in the value of the `Location` header + in the response. When empty, port (if + specified) of the request is used. \n + Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: + description: "Scheme is the scheme to be + used in the value of the `Location` header + in the response. When empty, the scheme + of the request is used. \n Support: Extended" enum: - http - https type: string statusCode: default: 302 + description: "StatusCode is the HTTP status + code to be used in response. \n Support: + Core" enum: - 301 - 302 type: integer type: object type: + description: "Type identifies the type of filter + to apply. As with other API fields, types + are classified into three conformance levels: + \n - Core: Filter types and their corresponding + configuration defined by \"Support: Core\" + in this package, e.g. \"RequestHeaderModifier\". + All implementations must support core filters. + \n - Extended: Filter types and their corresponding + configuration defined by \"Support: Extended\" + in this package, e.g. \"RequestMirror\". Implementers + are encouraged to support extended filters. + \n - Custom: Filters that are defined and + supported by specific vendors. In the future, + filters showing convergence in behavior across + multiple implementations will be considered + for inclusion in extended or core conformance + levels. Filter-specific configuration for + such filters is specified using the ExtensionRef + field. `Type` should be set to \"ExtensionRef\" + for custom filters. \n Implementers are encouraged + to define custom implementation types to extend + the core API with implementation-specific + behavior. \n If a reference to a custom filter + type cannot be resolved, the filter MUST NOT + be skipped. Instead, requests that would have + been processed by that filter MUST receive + a HTTP error response." enum: - RequestHeaderModifier - RequestMirror @@ -7256,23 +15994,99 @@ spec: - path: type: PathPrefix value: / + description: "Matches define conditions used for matching + the rule against incoming HTTP requests. Each match + is independent, i.e. this rule will be matched if + **any** one of the matches is satisfied. \n For + example, take the following matches configuration: + \n ``` matches: - path: value: \"/foo\" headers: + - name: \"version\" value: \"v2\" - path: value: + \"/v2/foo\" ``` \n For a request to match against + this rule, a request must satisfy EITHER of the + two conditions: \n - path prefixed with `/foo` AND + contains the header `version: v2` - path prefix + of `/v2/foo` \n See the documentation for HTTPRouteMatch + on how to specify multiple match conditions that + should be ANDed together. \n If no matches are specified, + the default is a prefix path match on \"/\", which + has the effect of matching every HTTP request. \n + Proxy or Load Balancer routing configuration generated + from HTTPRoutes MUST prioritize rules based on the + following criteria, continuing on ties. Precedence + must be given to the the Rule with the largest number + of: \n * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. * Characters + in a matching path. * Header matches. * Query param + matches. \n If ties still exist across multiple + Routes, matching precedence MUST be determined in + order of the following criteria, continuing on ties: + \n * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order + by \"/\". \n If ties still exist + within the Route that has been given precedence, + matching precedence MUST be granted to the first + matching rule meeting the above criteria." items: + description: "HTTPRouteMatch defines the predicate + used to match requests to a given action. Multiple + match types are ANDed together, i.e. the match + will evaluate to true only if all conditions are + satisfied. \n For example, the match below will + match a HTTP request only if its path starts with + `/foo` AND it contains the `version: v1` header: + \n ``` match: path: value: \"/foo\" headers: - + name: \"version\" value \"v1\" ```" properties: headers: + description: Headers specifies HTTP request + header matchers. Multiple match values are + ANDed together, meaning, a request must match + all the specified headers to select the route. items: + description: HTTPHeaderMatch describes how + to select a HTTP route by matching HTTP + request headers. properties: name: + description: "Name is the name of the + HTTP Header to be matched. Name matching + MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + \n If multiple entries specify equivalent + header names, only the first entry with + an equivalent name MUST be considered + for a match. Subsequent entries with + an equivalent header name MUST be ignored. + Due to the case-insensitivity of header + names, \"foo\" and \"Foo\" are considered + equivalent. \n When a header is repeated + in an HTTP request, it is implementation-specific + behavior as to how this is represented. + Generally, proxies should follow the + guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 + regarding processing a repeated header, + with special handling for \"Set-Cookie\"." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string type: default: Exact + description: "Type specifies how to match + against the value of the header. \n + Support: Core (Exact) \n Support: Custom + (RegularExpression) \n Since RegularExpression + HeaderMatchType has custom conformance, + implementations can support POSIX, PCRE + or any other dialects of regular expressions. + Please read the implementation's documentation + to determine the supported dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of HTTP + Header to be matched. maxLength: 4096 minLength: 1 type: string @@ -7286,6 +16100,10 @@ spec: - name x-kubernetes-list-type: map method: + description: "Method specifies HTTP method matcher. + When specified, this route will be matched + only if the request has the specified method. + \n Support: Extended" enum: - GET - HEAD @@ -7301,9 +16119,16 @@ spec: default: type: PathPrefix value: / + description: Path specifies a HTTP request path + matcher. If this field is not specified, a + default prefix match on the "/" path is provided. properties: type: default: PathPrefix + description: "Type specifies how to match + against the path Value. \n Support: Core + (Exact, PathPrefix) \n Support: Custom + (RegularExpression)" enum: - Exact - PathPrefix @@ -7311,23 +16136,48 @@ spec: type: string value: default: / + description: Value of the HTTP path to match + against. maxLength: 1024 type: string type: object queryParams: + description: QueryParams specifies HTTP query + parameter matchers. Multiple match values + are ANDed together, meaning, a request must + match all the specified query parameters to + select the route. items: + description: HTTPQueryParamMatch describes + how to select a HTTP route by matching HTTP + query parameters. properties: name: + description: Name is the name of the HTTP + query param to be matched. This must + be an exact string match. (See https://tools.ietf.org/html/rfc7230#section-2.7.3). maxLength: 256 minLength: 1 type: string type: default: Exact + description: "Type specifies how to match + against the value of the query parameter. + \n Support: Extended (Exact) \n Support: + Custom (RegularExpression) \n Since + RegularExpression QueryParamMatchType + has custom conformance, implementations + can support POSIX, PCRE or any other + dialects of regular expressions. Please + read the implementation's documentation + to determine the supported dialect." enum: - Exact - RegularExpression type: string value: + description: Value is the value of HTTP + query param to be matched. maxLength: 1024 minLength: 1 type: string @@ -7351,30 +16201,37 @@ spec: inputs: items: properties: - dap: + dapr: properties: name: + description: The name of the dapr component, the component + can be defined in the `bindings`, `pubsub`, or `states`, + or an existing component. type: string topic: type: string type: + description: Type is the type of the component, if it + is not set, controller will get it automatically. type: string required: - name type: object - required: - - dap type: object type: array type: object version: + description: Function version in format like v1.0.0 type: string workloadType: + description: How to run the function, known values are Deployment or + StatefulSet, default is Deployment. type: string required: - image type: object status: + description: ServingStatus defines the observed state of Serving properties: message: type: string @@ -7385,10 +16242,12 @@ spec: resourceRef: additionalProperties: type: string + description: Associate resources. type: object state: type: string url: + description: Service holds the service name used to access the serving. type: string type: object type: object diff --git a/openfunction/crds/trigger.yaml b/openfunction/crds/trigger.yaml index f2c2f67..689f345 100644 --- a/openfunction/crds/trigger.yaml +++ b/openfunction/crds/trigger.yaml @@ -11,150 +11,192 @@ spec: singular: trigger scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .spec.eventBus - name: EventBus - type: string - - jsonPath: .status.conditions[-1].type - name: Status - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - eventBus: - type: string - inputs: - additionalProperties: - properties: - event: - type: string - eventSource: - type: string - namespace: - type: string - required: - - event - - eventSource + - additionalPrinterColumns: + - jsonPath: .spec.eventBus + name: EventBus + type: string + - jsonPath: .status.conditions[-1].type + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Trigger is the Schema for the triggers API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TriggerSpec defines the desired state of Trigger + properties: + eventBus: + description: EventBus allows you to specify a specific EventBus to be + used instead of the "default" one + type: string + inputs: + additionalProperties: + properties: + event: + description: Event, name of event + type: string + eventSource: + description: EventSource, name of EventSource + type: string + namespace: + description: Namespace, namespace of EventSource, default to namespace + of Trigger + type: string + required: + - event + - eventSource + type: object + description: Inputs defines the event sources associated with the Trigger type: object - type: object - logLevel: - type: string - subscribers: - items: - properties: - condition: - type: string - deadLetterSink: - properties: - ref: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - apiVersion - - kind - - name - type: object - uri: - type: string - type: object - deadLetterTopic: - type: string - sink: - properties: - ref: - properties: - apiVersion: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - apiVersion - - kind - - name - type: object - uri: - type: string - type: object - topic: - type: string - required: - - condition - type: object - type: array - required: - - eventBus - - inputs - - subscribers - type: object - status: - properties: - conditions: - items: - properties: - message: - type: string - reason: - enum: - - EventSourceFunctionCreated - - ErrorCreatingEventSource - - ErrorCreatingEventSourceFunction - - EventSourceIsReady - - ErrorConfiguration - - ErrorToFindExistEventBus - - ErrorGenerateComponent - - ErrorGenerateScaledObject - - PendingCreation - - ErrorToFindTriggerSubscribers - - ErrorCreatingTrigger - - TriggerIsReady - - ErrorCreatingTriggerFunction - - TriggerFunctionCreated - type: string - status: - type: string - timestamp: - type: string - type: - enum: - - Created - - Error - - Pending - - Unknown - - Terminating - - Terminated - - Ready - type: string - required: - - status - - type - type: object - type: array - type: object - type: object - served: true - storage: true - subresources: - status: {} + logLevel: + description: The logging level of the event source handler, e.g. "1", + "2", "3". The level increases as the value increases, default is "1". + type: string + subscribers: + description: Subscribers defines the subscribers associated with the + Trigger + items: + properties: + condition: + description: Condition for judging events + type: string + deadLetterSink: + description: SinkSpec specifies the receiver of the events an + EventSource received, sinks in the Uri format have higher priority + than sinks in Reference format. + properties: + ref: + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent. + type: string + required: + - apiVersion + - kind + - name + type: object + uri: + type: string + type: object + deadLetterTopic: + type: string + sink: + description: Sink and DeadLetterSink are used to handle subscribers + who use the synchronous call method + properties: + ref: + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent. + type: string + required: + - apiVersion + - kind + - name + type: object + uri: + type: string + type: object + topic: + description: Topic and DeadLetterTopic are used to handle subscribers + who use the asynchronous call method + type: string + required: + - condition + type: object + type: array + required: + - eventBus + - inputs + - subscribers + type: object + status: + description: TriggerStatus defines the observed state of Trigger + properties: + conditions: + items: + properties: + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + enum: + - EventSourceFunctionCreated + - ErrorCreatingEventSource + - ErrorCreatingEventSourceFunction + - EventSourceIsReady + - ErrorConfiguration + - ErrorToFindExistEventBus + - ErrorGenerateComponent + - ErrorGenerateScaledObject + - PendingCreation + - ErrorToFindTriggerSubscribers + - ErrorCreatingTrigger + - TriggerIsReady + - ErrorCreatingTriggerFunction + - TriggerFunctionCreated + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + timestamp: + description: Timestamp of the condition + type: string + type: + description: Type of condition + enum: + - Created + - Error + - Pending + - Unknown + - Terminating + - Terminated + - Ready + type: string + required: + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: ""

    • |KC1**n1xY3_L8xo~5%?#Nr4v7wrD|dLwZmRBayylfVm~Ay3aysSq@^08`O^tr@ zN_OLw4-U63)l3q_vsQnYdPLV}W|l&~>8O>#wPRk%O~G?sU4d1o0_wHqm)VARdMS7Z zH-Z{&vBU$sN6~j)0UcMqlS|PdqN1D#K_XW|l|SFDaW{9AdNxFJHv2Y#JJ~xLO3pfG zvjnmGILB6Z(Nuu|fH#;1%!1?NnB@5{=9+=KZcbW_$A#R~y!n;sb+r}x^|)U*wWUKL z&b%igp#fhUX=eTCG8N6}2y$lqFf-1l5qoB$2F@r|-m{nrmOvN_KE(mC@2d=c10C8* zl!?m1)6HMGyvb8mESC)m>2OFADFLLVqV1aq$G18uS1GxiEm;!GQ830y@r2eS1XK{@ zI2-2(!Ub~5)PQC(VG|<8WXAh!Dg`f=EWO7z?V=R~{myRS7XI2rkQ^S9z<9M<_9#Uf zmL;J?5S~s4x2c3TplnZ_yXpv{u^`DEt|o{F37$%6OQlN>@jAqG2vnLI(~L@;?@VWl zcA>EI?0afuQ7oT>5Ib0O%Bj~E1T^$C9`S37AZzDL(iBoqFoktHCZ!Ro-Iyu}N^DY0 zNroVG60xaSvGmyiL1PxPByY=-5oCSLwl!N2(DQ}F;gr!X?zQs-Ey5I3leAs4arXi7 zO`AF^Q?vUq4aT`O#U&XlQTk;BEwYAq`5x@c8KGLGQw2ee_%{wiDJ#Uh&e&<&+Y_Xu zypLdA(=6jXkuaAEZxy226Uk(0wQ6D{H#jKV`=lx%Iqnxfo}8kDMcRb)JVfAc`Opz+9{4&_b2NbajX3`tpl z#^{ELG15v^a2`@9pYkY3g$l|bP)wst^D2*bBNAU{0-!SEx8(r29t;yAI2c>pN9pSz zXhOd)JL;Cqe*kNVUw6|#|NA<{3X{#f9+PN-Xv_tUqU!Kwk?2e=WB3vGDfhf;t z!jh_&*8|BmG^~|T8_41`0qR9a1f~&J9Ol;x7J(%6^Cdc)OlCrPP~Z{&?`?3FKi=C5 zS-=Mx_;3)g$zBGWvo~h>+uFmIos6xv>|_oM0nHBHSlz$hm7>e!@8kX=ayx3Pubup^V1OESHTKxdhz+eMs? zV$gHMrqz5Gu>=JPg?6L6StLb1;7XKmwGIcp-W5wVMFjn-@qn`7nWX>`jqdi&Do?v@$B-6c+R-?k87@UDrP*jbdVy@NrfN234 zFgL>!>oGCcle&!0x{LuN*Z1MDaqRDE(NiI0z)5Qg$}`L}J`34CDELh*((pOL5@U^w zbU$WMijlAj8D;w zNqe6AdW=9+?;#{2t|kOR6K(5o_3koVXh4pcTd;0pGGgFFmCx0mCQPt^MSY$17;PO4 z4z^5(O4bYXTem3kfW4P#Prxis&Jk>Gm=sI1hj56a=mrP3wn`J-k4bF$itFJDS^TX~ zMaqm&#^r}Id2*()R*hhE2Nxc&t(cPgR>`JkWE+pO6smQ7`PNDRL>#01YKHG}a~iTJ zV)v3dy)gKg-RB%SGBG+LI3x*za|C6vnhWZsd1qRt3Y*|*U$s%C>O(STlFC*-dxqYz z(Fl(8AOv%JEtn8LJ)|YOh>iL~mQ1iXR{OW2lxbTG^q-d>KcGk#NMn03mh%73S)6v1 zQEkBdE!@$`@<@nqLM#=^4T;$Oz*Mh1R;W>eN0f_Q^!tnpIAMWr=0u7KBo+xJe2~@~ z;F!g*Nx=OF12=UXqtP_NzY`r`~;Li ziIVcZqSTCNA8q~L;3g;VWV)5T#4|AlR|xCf&0G-vIUxa|cO)!*;3O8-%aGm2TqFcf zKEqx8XB}43okaGNAg(lecd=egh!``we#yS=pPDyVuMFd*VfiHqKg%O1Nj}RNoBPhE zEav2Mz(VKyVT4C^TP3ggED{`$d_}XVrc&=fu1}IRxZYRwU7A22pJ7k2zjKm&#-se0 zJbWIq3FTi~=^m$-L0`@}!&3De>7y+ORD8IV`)RnXgXNTXja>f^^K@@A@w?P& z&~MWjS=xnYtc;N}2BWvtzTCpHbg%Swg^=o*!snM0vxVS?zEy~sV09Jo@l43c+6O<9 zzH+5KMlZQK4ycF%Qk0eCXZx2FOk;HNw@dWl-H*NAk8{%@yJ;fHH1I4A#;GK$GJwed z4bYo+KMo|LQHfFk3T)@Vqyfva)9W~SzWG&*iTV?IIg|XF*@s97*_&WFNB8vkikpwm zLPKF+HncA%Y(FOAo+Y>PrM^FqY_<>FXXiMR2;qesVLe-qVH32>rqqk{`{0HMTu_kX zd)|*24*Mo#YhTQ#y? z_?{o*V3Pmw%P;+3ev$t>{>41UmLRcbUiKaTQ%|pl3aDyo1Y}Pfqwn|A9~^$A)BIA+ zDvhRR917%#nCjao6=)X@ct#ZhXFau5X5K269^jW>ezANLQdPk=-x;8vXdI#mOQiUz zc5pZ&-$+K1Z-fD?|26Ai6tZBJ8ZBfiAwL9g{s~wdkg4E>Gmx^f?@w9Sk6B3eo|)SE z^5~rNA(F?X6NSwl!7eQ59odC`2yhIiWqpv;jyk!TEW>_X-mdy(SFsDqfjH;&W6KSS zeiQOQ9@cHDt@WQKkt4>Tr!dO-Bh1fhHYRA;5|D zR0LN+F;3WQr0yc10cb1DV|I}(IrP=%`xF;%Z)S4t>7)G>Ll7-aFW?FO9b{J3l7uL8 z6;AHp;!3+T!7|HMdkm&w98D;P6+I+a%o4(PWkQyO>cZhhjugZINMoiZL>vBaP@d`4 zYqU0cFtVT`a&--d$~sxQt@V0+be-K}Uh5Wv7mT@HxE{zv6?Y7F`l@>sJ3n}aIJ0S= zk%ur}VH!2pohgf{n`SiQR>WqO{d_I=T2lU|luscVCTxN(MFNa-nvgrnW;{wo z4>=g$YL(w7DCgT9`R=2#*p=CK6$_W8NGTE&6PdnBIS}WYU@h2P#OZ`a7)D*CRYRH0 zxL4MUGbevlo>rW|#L@~zJ;lG3a*~iUM$gV&bbT;5__x9S^#Gkrm^?>9W!dzDNouR{ zXe>Z8DW|lKMJ{=+Oma)(kju$CblG}7fz9;Z#?@sm0PG&KyJ3y|W^in;V?}9#(0&A0G zqcOfC=!TFO@p&91ET*{_$7wTD4P&-A+cfqjVmE5DNkz#XF{=C;y25fL-*D7?S;Ta}`kJZG=c4P`3nW_wKlpl5xSyiyIUJf4A z4o>Y2V>i{mVRVxad<$9^t;ALnTFwFJVWrYy3S;9wq54A0+|M8u6F!iqsRST}R8zGc zOl?^qiHObxB|>Nwy$`E(laL_2Dw_<@dwfd}2k491+P(&TsEE*r z2-Igt4gn$$g2ZqX)Ip-OG#riqq}Y!r&xh6E6pcB{p$0n@qVALKsHqU~ur=;1@|Ltbt$tU5$-Oo3a6(PUUEB zIDtA$nTgG591t+O9_&jwhoB|a;`fq@lqO((XK`-kA}Y{5=CJI>a^3xdgmQQ{YcE}U zFE(p$oonxf*`kU3Gk+15ihkC9s;|E!onst_Q5NMwPGdEevU~qFrV&vCcrJ7) z*Fh3qqalm5&^V27p!#}OiS?OwJJkAATdrT%a(_f!3TV-&wG-D z&o_jN&(j14f=c;Vol!pC~mU(mi3P`F}v96|!YOw9V3o693u zf|HD`LEjpuaK5*{-w%?It0{seIHp4o#pC?7vz*?#Go@sz*Jj9|*Y7DGX97klv8ju$ zLZi$%aTwuICg7^1GKIPf*VbI>c12&`$w42ijv288(Mpbkf#*19{^D%xXv4q zphu<&33t;b&(+nlX|p!mF^lfFU`VnmYLqVRbv6iDi>y^MDBkaKL8fXPpW}#|QG5<1 zV9r^fkS66wfC0&5iUVPkL&_{_77MDFhT)NNLNh4_2m-m}H`P=)owJ05Ro$XzQL#t( zprn5&XEMD;{gPL8tt&Hh?k7#2%^%gwwv-S0sD&p4U1xSe*F}24p2+lN~taNMq(ba*{70tW?p_Qj*>$o9E*%2{BLjn!Xu?Bo{Jy zI^2*-Q-G-8B$5nbgp<%Hp-q>)`S@-~L@&hRXudN*zrH02sSuC^n^Geu@x5nq z3g9W#M5$Zkopc`@*63qF`mhlTAg>fD-m^P!ACV`JIGE@1!geXMKG)L-;)cRPcy1=p zbLa#0uGdE=V7hH&2W2y8m9Dz!dKY1nF=D~(b2OA9DYZR?t+2<2)5oHb*e=E=s9GT)d zQd)8UD%JIoUbT8%7?IzYt!8I?kfN;I^7J69Hw@COejLx`EY6ydQIQ*NQ;tQNTBEYr zysq8(&ZyT1Lb8f0EZ17SJN$fi^m#%@`ts^o`e%Q}<=KT3zN1&A{$vDGLxW)G?nq9S zPn-;A5sGMh%hg<{y!Q|@!4iri4mS<7p^G!(cL1mWsk{2OBnVUp1zx z5!JLMHu|02z`T;IiiR$`qdbyq}#61I4xk1VC$>&r=2toxn#N^|A4TpxV}*i z2sR7G_BlmL)+cI9W+9#{SGNgM_X-qt$$J$FRtLCDk4cp8!s&?tM)FL6VJXzM{fR4M z_FFoIleIp@&a&C01r%-Z?&!fE?BlPU@o;B=E(i|Mucd3hI-6eCo!^eK?|&e{OcR#b z?3lybb!ySBQSEK{w^3R(?Md+cKn?DUlSDR)#KJ>q+W+GZ%_sl)&(etR?H^=%3uA|G zaaK4MSvslf{9QI|{J%!@27oI-tf}XwI_YO40m(Ew3ScjjDhBAi?4=x&PURkb|1=Zo z{1t!=^o{KHSsbEY$2s9^f!lfgv#);kb%WJ4bGklu(Ih*+%N3FyqEopsJ@}_|QNqmx zQ1b<}C-FQ}2=$&lL+@xnVorL!Q#PF^bTk&|{~xgF{NLp<Vj-@ybtQ%%s#Gv!h0 zEEZuTTWO9dIu*jAmzluq?cLws4=}V6Y%e2~itoKUJAL!v@=YHuCq5~?M0(P>nX5xi zpyIjVdk6qOO0?>Q#^^qQ8@FA=*-+f$g!DqnMM7_8BG*BtRTS*L(*&TGLt7`8=s>@BC{M`4R6#W*fIve@IOtsxlB?Y8LE8K^KoO2dGr2pB*d0kgLIy){u1-2Q4to$y zP>Yx)at43dJb&7UO-VeQ#h@iMye-=R%zmZcX@7dZLL{?c_7iTg?(TQ`BH zG*cZ8ZodaZyt{+mEseutlovZ+r?)V@2@yEN0w4Dr)}xt(+#it`>@06)GztkwM5&|5 z-TvUa!F~@Rr8H*om9c+6M)53)dd368H4|MrN68&!3*ca%+>uZ5ZOratWq6}MlFZ@c{OsqW%fbhQ z!pv3LO}0@#sxq~+O=@8+h3q&W1FOVo!lv>Rml3ZXYlimn9=EwRd@CDjGzpfoktUpk zrX@!6mk_P=(PlwIxrr+k@BrM{Ny053xjUjRVc1BS0;tlsQ4nZDDC6s)tl^Yts1$M% z0>`acY?Yu4=CrU%;~_h?EgH=FlXB!NreY3E7(@=1@V$`Sk!X+8Q6DG4mv|iG zP*%ki6xBDg zQTcVDJ6_9F84;OPq+Gh%RSil?ebr=()EijNLmYsGEhras9~GO~)KvLsetZf7ITWpzR8kW zwcpTAN%jbwklo)MD@HzQpx-DpNfVNA!3oGp_uw<-tE@)0xj;Y^K}IVdf)(p7sJx;n_GlaO&kuKen;mQl`CdAX8| zhNZd~C1*B#hNjf6`HD4-VCEAkJY0;QPAxC#Ofor35Ba|C~UK~21i5Fw-Z=9r; zgxZUHNF%b$kcKgT$Jp&``V*ee$hm%<)NH-}aA{{uC%;^=L^C1P!C>_iF?LHrG@Gi3 zoariti@2X(sO|dohfAa{jI^^qi=%lOeiTC~v#EhmO;pfG-63b^cQ4Qo8Ut80KfhAO zET*Dvs(58raq{WvqhBRMnsCv+7Fhf#iJn2m{@qbuW+L%y z(pTB~I<5R<{tRQT2-W={$t@ZaK!bla;i~XVuxqq!BG~Ps>$?}%^8c@{A)&(I(rXIF zM1j&s2CE#wDz|>*$B-Jig>Kv1tE=;$a|hzawN}oU+ib!NBSG#oGTminY@z`yALiyf ziGzSl#Q@S}$pF*<=;LO)g30=u^6q|k_-$)|F4Oz-T)y8@5Aff%V9x3nhcb^nN+y{c z8I>X%vtuxC*;#h9s34O%hG+Mz)uUH)h3RKDZ*?fi>;>%3s$#e;rU_0GJa?uT6C8=L z-^6$eX>)TSJ+7+FWX28tSaL^n*(ey3;Febl!hfWv1@zn2K8W!9zisU*Q5=20zki7S zS=s+SyH3Mlq(rDK*=rig2a%e>CNzFW;*l61ql0DTm%8(aPs8C1(%6XVg9h?pHE?6q z`p^V({2f@zkt7qy7oRBK@9%23m3M3;)9i)hZjXzQ&BSk8%TA)SVBgU=F*(u|b3Z1D zk-H)`QrwKq#B?Tv2I)y*Tx6#-4_w3SS#;)OjbM`v&xtDOi=Osrt4;r*^L5Ss1vDLM z-|TSyzj$%9ng4}GZ|48%=fA1VYYC(sDi5Z0=hBo0eRZ(J)Xh{BKWdB<|AXggDKDJG z;I;+s0Vqf00S7{z#nM)T6lv`1Ac3tZF<2{$oq!JIKYMqFd+9oXbB{jq$Rra!>YI-i zM2xQ19Oj!&Ioo716>~jRcaBqX3`;8a%`UnITCcOjZ-91JH?HNFlp+E`#NpHNEWRb7 zUZ(!qhpHk>;fkYQ{B+tkWcRqbzEa1|ACro#4K8NaO% z?$P1lLA~PGV=` zHiKtS@Y~915@rWS;S9{T1VJVz+zlG^&rcWcRM4wxF`=vO(pZ^Z-E;NsvRTzA6M3?A z6x9hR<3}q%_!(^<_L#(lDmcqI3@4IM>t8L zC8-Vu4y{%#JwgzVNalpOb)}3PNd&jw=1%0_RTc%!J&QHI=x%nS+BerEy8mS7DvU`} zw`{BN6rSL@b%hOJx`a$+@d~-MVwP*n%45*0|F-q(o72~C-}K*{zP>!^pS-y|IQ+i< z*VFg?%eN{Ur*njoW4Cd-0z=%eE0W*qy3lv{o7W)l#7}&F6v7tG~@8)D^tYL z_b&>mE-KPUdi8`+F|afOsC(vQ2Gp`kzVQCY7vb)Y+BCV6F5jM17h!*_F150x<%Y1b zq{=22KUSBTOPsBZ3>uxIh~PVQ!)Gs1+l3jFud{?GXVDoKMjL;;h&n#AquYc1P4ceK zoCUW;@I4W6P|$;gxRF!S4E;1iUuWoxi1+V~G3;~zz^?Lh^LNhTb=}dG2v^v6?KNn2 z?yL_=#4FiM{|$&BDtd|PhJm^aheQ2t=^U8lf{<#R5uQPSwD6|h>9(~E0Z=1v}Zaf!Ne#pN-SEg00I&#t=jlL^aj=q^SvkkUd1tfN- zU9kZYAfAC!F|aa28}Rhxj)Z`|q^^)UQK8_UXjE$=S0eiK1SpO1q;?LWHWG0_64AaP zWh2JU8+J?Pi?-{Q%)4%nhpgL}L<8r0G0P7sZL@+;7uvy<4Gt$XK5xScwoX%1T`)mn z3grfLN_q#(U^`D_@wQd@+0Zr;6ins+ZEOFxEtyRjyy1K;IZ{J z@uPS)xk_eSknk<5zHKh|$}hv=hg{aY-LT>@`RMm1Cb_cW8p}MXdx~bkS3PL{o9YL6C?}s^vPX2Z}sxb zfO%qaxd6xr$XHF^&BWGI^$&JV#DrL0tF))6T+@f0y0^%xQJBQ{VFz~n*3k@)vE{Q5 zL{)GWed-DiJ-kXHxDM|)qMQyaji|L>pW4;TAekZtRSRRi=F%)kfmo9M-~jfmU;!j3 zVLE`@fdr4C18TsYFf9^Qq`KxExx?V-dR#PIrdI?;)9ku&RlhklcWWa_Si|!)6Ps>j zy?OH;l?dKj3b^YQR$DM~BEl7T&xy5zqu$Xz1KYCQoG^ph{tB!C5cY6N4&+{ehq|p%LXX)(Q>XIZ0en z>8tNco`?%9e6;~-Ea+wxiNI+D0&$31S`;bmDS!d+jD7$1_~+w)V*@Mrunq~G<_;Uk zV)g;x9Sf-A;7N@>POH*8Z=l*2!)jlh+0j|qC<}zw!isR9xEA8t(Pxhk3DImeHy{u5 zr$u4rx-Z3`(xTqo=45yWD%m39jXX>A8do63lLeBw5tf_@hbI(FWMhE}KDIaYdb7j} zU51&`bl*THUyK**v6A950CZ-IKL=6C+g-;tcX3j_HmvC|t42+DMm4*g1}d@L;jXXC z*<-KBMJf%e3agY5$pd;UDJVGjy2Qpz?%Rs!&+#xIt#x59@Ay#U{3h`2Q&%0a@v(Tl zsCn(yoAVoRb|Pbii>$O99GK<2%nm2QYkscQQIteW*ciw`iT*K42G-2u;3HZ$f&YR> z9^BUg?B}S5`1gS(BF)t59ECDH_BNM>;q7WpiGWf<%1(~Cl9CTiaadCM@{Z_;6u8!W z^u{qdlClOJWWs{#*nF-wHtKi2IQGKA*ekdE4)w;*kVnlFZoMO_Lh-lJ zMdfm~=_Z#HfEM;d=sCo)OUj}r7GG9;N|x)}_i^u+md}v*7L@$G69Qag$XWUGkQ;H$ z*P~{9kIyZ|&4Bm|e8#S(f4){dzm}*T+^DAHgMmyo0?zPIJ#SW6@8;lvLK7FRTn%O?sY*BAcVYn1ePnrCW@cMUbwl4>qeYM2 z?)V!I2%a@!0ogbUl*STO(uEeGuFeN&KMRGeL0NbE12NEeU&g)>ip(!vw3EfuJ;PwB zh2HvVK3bobjbbyVwLC$+adLVfvAfAnKV0IB*d|EUZF15ZglB9I7pr9s`mKPjeD$NX ztW~63H}Ggx@z2Or!=~Sb<{B3(Q<-m=L_EX+5hfuG?LIjFL0r(Qg=nx<35W z!NRn~t$I1%ZX@I>s#d^t0H^_jDu!BAeZ=W~D<-X@OdCa*elqo?Nkr-TAej7wb7%SM2!#wwG^dQJKQ9&`735f~D-_ca#fz*mVaWtxh@IY27C@Sv>a zN#k)geXq`!%iX!5?i|q2knF48erNnS)Z~YC^?ZvW(QKTO4@oZxx;2Zz7ErE3NP$w)LW6Jp4TdVxy%? zi*`g%YqO9F@QFt<2%iT`1}lFqxe>2qE=^Mu?{_l|VnA!uFv9M-8@Fx4pb>MeBIswR zGKd+MP>K+0EXiWHk+nqSTrTzJ*Of7NlmYOC)}e6k{9re>Z6j9t-~5ubIfjImKG!(L zJ43fVloZY?Dhd6!u5aPbXY^ec{@ba2_0AO)K-+fxCwuAH*-RrQQ&AYyZVqm%->Eg@yV5L z;+xY;yldWX6%qSdsET`haqg`Vh&WVpBEryC)fDkom8Dw#y;>)hPZG=Qx1QlQtFqI! zXWQ6mVBA=4=Ch@9p{^;k~3ZA9gz7{vUocneN%Y?9c8-UjOw4bAtg?MdXVlP-}$k>Po*~E@fF`NV^Abp`iy_^Mb&Q$x&t*u&b1f zOyFZ3{ega~gQGa0klO(|Y;I6rUI+{<__OP>z7!ZVtKE!MpKPDDOHnHZRQ{dd^MpRDfk zv4cT32=iB{GUr*>l$Bs(mGM%V>3pY!GAviA984j2M!85SH*%lQCpGJ5D!J--98s-u zR}w7_XyOH`VmwW8<*}=U#I(YEFnbiN5D}^G&S9c@y^EF+XC3>O! z%_syb)>Xe-dm5xIf%IXZUrOU}g{?vXV<5J@_ja{a$zEE4v+oAwJB9T}kQM!rw1%`kxyyj3zd6QRK`dIbaRN*5EYa+UZ zK+{4P!n;}t{fNH6o56uEbf5yGJrf;Dw!%dwuu1_BIXpA?dvA62Jf_tpAG;$)k?!<)7U&O$eABkTvd%Ql@(+kI?>Suz|sm_a-a5}RM zbHQEBLF8TF&XhV%(isYEZ{o5rDmuGnWZ#9P)Qh(`=ToK)C7V)>#3*2{Z&xD)ogj6Y zFz;ZU@i;*EV<~(j+}}m1m?%ssLt!9K!8(K6G_7vJ9l<$v0eTcs zi!_JtVJW7}MLA6IVqm}~shN%@sO5Ei9in>Sehv#~%?-;0*GN6^S`$Fau_;WW0RGN^t^mE|p=xmOUt>}=a`9;h`i zp*ST6K}2vNap6BAzajXmTxiXQ;-ixiZm15*7LFhd$an&DJ!4mF5B*TM2X={V*AUNI zUvFgq>#kHF4?W~BE!_ON_>U1dg&Gl6H=QepH)I7&ca{&h=~y7f089L#df zdd6~!=g%uXoX(3Huu^1VVmULOD;<%S4kaR7@!}6fjQ|Od{AMf?!V~7>vEbwY_g(Kf z0}xR^zH1*zFO@oOgdxP(u*Z%GK##_YJrKjx5zAd3=D*e_GLtk?_3K(qU;y1rUOBN> z7%Sk>AWMOAyta0(s4JgmIw*-uZ8xeuA*25R3uM7tFk|uf^`w+X$k*|jgW#yRnF~c;3=f<L@H0&mVG2o|3S5soGbe7l->Qw`Kh_irez zj_`~T4}`-=x?4yf^=(QRl|A%O_>v7PUh={Sk+S29bAM7WvpG;P4@Jb?hR(pj+ksL} z3haBE4L>@3@@(DH&CmqxXUvTeW$}Xj?_Z9)|IWLA|8;AX@ zYg?qY*d8(asgc@c?LHq}N+|Kf-VHl=C+e^ti>pFiuf!^4;JvK!^@!A6wqrYAw@dIK zyuZnlG{S8y=qj_9`^=b>>53OiIQG%g?nj17`Nx4$J#oYHaVDS;Nq8b+WI>Z&E0aEg z+KPLb8eE60LinL7W(Mu$NOehVkpuc!wOnx zinM|RI7tVA77?1?`BFoV#~0@$eyAHzWuUgKRbrNNN(ZNBuVs*$yJibkQsG+NtG4j@ zHkGbb8rRa{G*-15%-vbezZZpA2g*@fhWUo96r^Ay9rkizc*+g$4Z}0u4iqTpnxo0N z&oz|yw(Igzh1AiGz1}YDOloIX&!+6?Nr&}miF=eB5U!BF-2B>GFl4FOpE@&aol}q~ z(bA>cwr$(CZQHipecHBd+qP}nw)>p!>3jc}iHV7Msi=y2-?=ltwQ?Obpf5nxN*Z{F zar;wNhn@in8aem&4YWVhmT76GpG~2XQElA^;?{1guTUghp`2~nrT#dxo|axdQt5U~ zDC$;_uq(y2m0_?Oz+5FCV11m|R1RFB?1NR>BbT`MbZ#xbY}q7C6Ya3gV_LOJqi*3{ zxpiH$(wEZIx8OZzMrYb9~DdikuOFfT{$vZMuOEVws-lV0{>-UR})9%6a zvmfo60r!VB=Yb|aMyA#*PX&#ay-bzOn>sgLm3Q`I2c&d9H^1WXC<4EEvY73_+@3_y z&%hgkJq&Zz3Fc386ozTPj~8g44v7jbYQK-Lu{k$BE1F0_RRFs)L8ilasX)O%a6k7Q z_6iJhtIVju^WEe#%^`OjJUl!;|5uoAe-96hpP!~7^SM0#m#`vpeO$hOmm3F9LudXR zK9A2INp;`-aCaWJ_Z7_tC-`vo|7tfTe97?nQfpn9j*Kz)^}W^iEUGAFVtf0Gyp$}9 z9^FNd<1GNoo}tgQ0)q5VChsXW`O9&43Mjl%%LIS7SO}Bdt|SfZuJs6eze^9~7|e&B z9idm3H(o|eNW-*SXFkR>KB7@(n>e9FpFzDL z)9YsOQ8w0t4bRctcws`~n1{iB3O1I0*5AvE^J(a?JCQ;AjAsOn5_D5kFKp~EYmiA; zNF;$du$C=Yms_rK68EfezFYKi6i6Ktpr6$h#xNHBy6$$DYcxZ4$88$-$i<( zE}H5^kcy0md){dsw48$&NjU|mzre5_G`mAD_j|$lW+%jJ5a0K@^J5l&xK=1CVFO`qU#3wo3x7{VaV zCCvQ9reV<#>2~?dpmU$5KEa}ucp@@ucXB(2Jvh-MLPUofJnt*SF1xxg@OC=XR|#Cg z;pL}F>a~uwVCvzi&<9F64TTDTs27qHLw1lE>t$xvaZGV!l9|Xqn=w_vOWf8wj#38m zP}LvCNrW*_lvhUj(rQ#mGtQa}Y8F-!Et5e|M}zk$RMgW;fYkSkpl&AP1dQn6*_S3|oagwh!rLyj+xr4 z#$?9%ZWXZDQ-{KWa6wOw9Lbj;_rk$DrWLk!xH+oPX42-IcjB@bsuXv~a z9K2iw9LkXZv5Kt~a8(1>eo3)cx31ouf!(-$2U#J&l9QzxEgCItN;7r=m3%D2z`qx1 z3C?QFhyfwuLmFikVs6V{gKY4I@~7$RioU7`N_Hnc`apZ_3;*(7e4gSl^DCz8`yp!WMRViN?hM6a6>46StVo6eX=VzsACzA5c5P$|?j${mY1v11CC;zNnFZr8Y+_*vtHPHu~#*TnQng)FP2~%I5EkCv)xAK);sK*;a(cVH1R(sN2oFVvA zLR|@3LKXI*Y-k9TXeYj-l)skOHMhP{gK)<~FAh^rl7y$)`FaczvSK4|qO=haa?_si z51mwqI#SvlPEhhQEi+nvxWf$G1|Ews)10W)i6z^P`@4r%Wz6`Ry>XMm_Gf7w^;sM~ zhR0M67(g1Aw2-Z}nRJhbQtp<=HxX-2k{pNgLeF{wao@p@;YDDRQh=_V?YyTiWoBpQ z+J%X%5(!p*&7f%;sZvqR!K<1cG*@Wy-OB;4u#MD5dS}QbRht^F8|M$yjQ;G{kY#-*v`+daL0dhZ*S}C zq^_>d-{0}IYWt^7Ka#3%(Es1sF8$&4T4>I79rSjEr%O#>UA{;zO(<*IWubfy3SgF^ z_$weXs>2EAdNsi@2qjxEL(<|0Bt!!1iN$R1mqc71Ja4Zv+XrT(2wqPj5iUF^;lWoz zW`#~BKlzJl!ji)5?mFzc$WxzpuY zmY6E9=;f9oSiL}h_}s{(wYe&G4du&=r6Y;o@EDSu`9p@h;Z zz*iiqsQnm0KO?!Lc;575uUv?KyP`T1GcT-o)Jh;(wG4I^=%6oJEE3Jk({YRR>v0{8 zb8lSMXJ-Vqeo)Qw-My}P-q88Osfw_^d<9{vWnzX;a%`}@e_o$&pcOimMrsL#or!Q9 zipDmhQvrj6doa?d(h`hO#_d>9>)pOl?$@f@gLK6(uNZ3ge zmEso#@|JF71tjD3saaeFVzatTzl3+2CV%Ihvdx>;E91V-*{5teOZ@)3p$CS2pO02J zkoc0-vUbs7*=}YBWnbv@VsI36B*avhSJ68~y!E>7@8jM(F#r3!6|?&h8Ls@od=|6P zoS)R2Emss=?sX$LajsNz=B;X@g|)6Sl!8t~S*>2HwPlV|Qh;*fJWTy)$d2!K%)1%2 zp1RqI-I{{GhjXK%NPY^TCOy=qvAf602B3VP59RyALR8Po@`UnD9=Rq0K|p)$%I)T2 zf$^v&|1Y#MSRMJaTGnRn+YMl~@*kc9wFd%%g;{cp`&Dub?Iq|;NzRc)4Bp>|osZSx z!%ifbsNzD~CIzZN_*%C;a)jtM(&}etLYmQL2`NLi_?&`*BteGfq6V`yMC#zwsfGry)>a|%}s11Cd87!P?Zbic(r8@uR7=LVVZp5R7 zeA)LF+xy2xyMo^@L~qZIeGFjV{(uG;`OYdpaVyeXYHQbcXH|)&#^8}b&+AUNRH)q! zU!%GrdroPU(?^zNfU=7$+IAj9j^DAuXw)Jg-Qz%4)6vqJc@NLOBMDvim`gP+ml92S zdhFowqq30;OSMdF{-c&y)Yg6iV=*_xJtf#H^lR~$-;RgdX_ll!CM<<#c^Ys@ImNVn zvlOKedCN#mjJ#PdSR0$l3b|Wb_lOU&w#P-Y4tu)J$U;+pY-;n(f`gg3t5V%)lAz5! zUrJiuG>0u%(%=$210WVwf4oB04V$eVms%!gL5+1;q#V&>fX&eGWnxo%nl1x#Tr zKb^69dQemZr}0at<+M7N^|AbSo#^|n{FSkmcK`A)RrTTL{%<8}#Bi%C!E{v|zXS#_ z;dmzwWG+nj$0188@P|MR_u5zh;k>`4VTdZjugkAt-Au=?2G4;1b-9^Td<)Fzz=-V* znNT{HD!iG(aL+1ubV&yd{?UbPZ8Mvx9#vKb?V|G~k8xfws*_4=FM)XA3$~+6($LoV zkzn;-SPYym-%6jku8*{PcIb}B_-y}8X7264NLz{OuaXRQ=O*V}53Mq0)>-=k*Mm$T z!T=`(c{W&5$lba;33KvU{dh-SMNy&fY^#BS4pzPvOJfJ0^cFawz0D1jONhW_$MRY< z6;v_^e8`9|MjW1aPye?pQ-@hI6YKt4Gg%LqZ*Ra-$0QS!LT76uwUoedMSjy=Zl1Mq z`jXYp>=$chu%VgMv5IN2fga{Sri_%NMylwN2u7139UYKr=w(XKBc1DI+e7tr7!PFcaOoB>0}dwHfYg z8d!x>)NmC@j7Z7-5JsQu52nJSF3NrA3$O`K?Z>Nxb>y1u=0RFof2!6jR_~Ck=FAta z>;#Z3ZZ#;rP_=ul4allkDyBN!QW`9MNOdoC3jivFkC7;Cxdtbcr#3+^LTe!bt-P>E zFzBZ$AZs$cJL~Cb>gs<8#2fAh=P;AL$d8DJLpO_8Prq^V;`WeUo@hBFUFiAs&&yua z7}$*WFguQzgB`#@A$|#;C_@+K@{_Q6#S1G?jt1jZH6S;i5xIp0lf=5pmVx09J0d)E zXlGWEi^rB67eb-{86UNy17Cl2{O3dI5ptBY`(zPH0{G0!!&2bnD*s^`N}OOoCDv4<<2pl^4K9kH#B&`(|yHo90caBld&_g&Ia;)JNhT5#U8 zMu+M#a)Mb<62G1P&GhWL1ohV%}Kw8mHxJ^U?{Mo z>&o(8K*~WYB4zRp#4)?W0M}6+aY=f`LAU1majeY2Ih zVmw_t3lW`V&`|2>kAJC~NG$<}XvoLiYW4w_l2B+1EwPYFg5Tm~5SJ6*&t%a-i>(L% zbg2AjN1Jbub4r8`l|pnW&~GZ6H*Q5~%m^^j0x+d*F`H2bs=`FhxK*nSN@GrI!LBwd4FPvNY~jy4!P}d_Gs8tz?ZPc1 z*|@~3d<(-=oxN1r94s!>kKlH>10VxnOt5|1D>SN-Cx{9L=7D*!^_OkpdbC0ghCW*g zSxT72c;}c;%%%(JelqIvfC|l zWMsF_ERNcqiIOp-Cr8TX252U&eAOPz)EAcfpyhTmq1$s79ulvHeMB|$jL`D{xBZ1s z|Jal~(5Ic*K`w}Pxia60^#?Rc=2zVDj!s8SgI*(ssQY4ZVo1K+yl98$zZs4!veKq z#&G6TkT~0{xxf*IGq`nUNgwbcr~m2Z+ku^y$rN=dkpZ+qvJdN%|-YDEPCR~s^efuj1Yfyqq69+(znh{{R3B8KQu#Gr+y-2{_38B74 zIPe#|{jJF}5@e92kWyLOrKzIDNz+OUb-(c4yWB&6dNK0*Ft++l;||@F6Ci;N+Xsom z3yHbZk)^Hipzrn5rcl2r@1tNZQ_6%_{?iuBaGX_sncsd&8|G47st{YD9fwqrOYrr$I6)C9>A&RUY zDoc*GXa|JcT+o$ia?yIwA;W8&Q#}@9mN9TBTZ_49r6dnLtF3dp9Ty2U19&_j&Ev?;IvnAPIrv_>@y9p?0vu(a*a2pcWU# zuOt7BuQ0+8#sr}n`AtEqUu$nZ#C+t&nw~h}WJ?=LxX^=U;4097I2-FxnH_8#cYG9`)fzjNlSf>ne@xIY7Km<{W}Zqw=f_nbVMp?;6&ye< zNeK;KVq5Ym^cjls)hqFbzJ1dCHP>6$z?SMOE-Fv1uoC5U=T>nnJsQhMB0tU))G4rF zxU{+bW{iJJa8v(h@t-q@$!A(z>Rig}pU*bO_)PJ`ACCehZ_ztMs%PFfEjOejy^#%ZNl#8pWqNn%Q=HqakXw+uGWz-{1CXSR`a`FqyPGddNrN``FA+COu zdFgfF^$lI*0I&IfOm!pKy3FW(?u+1rYynxcT2_&N&$!vGCAoH zta?y1ri-NvTsf}NE~QZT;1I2sM-vPQ8NjL2n@onI3{@x@&M2#WRT#2QjnxC-t8WQl zX+-y=AnZlH6+FuGFF z+Bdn{+M|mb{9U86HI~X7sDalF=8#5KRUHQJcP+90uo!0+^J(nRB)34)h3A5)yBfUe z6rZ_?i3y_KHYZkgdjf%aYrr{dED?1hTUdJ&ph?z=+>Mcz1QFUC`U&*aM9wVEe(wSm zTfXg>5{qjcEQwgd-^;szDSk2P*%H0=f}OPDCS5Pl8SW*mQ!>q=SQ*9N}@!ptb4b0(qOUtk9m;QQM7#SNu3G>6ErPW(qpYI)~as<6IKbLxKgdQDi zvgTXSpxL|X{{9#2kH+Ok4z}Le;BCVUjv1UE0Nt6xUoK|-%Sq=$mSDo};m6#2xbx|0 z7=xE}HP+j2fb4zN6Z(Lz$v0?yVXKt{;=#Kcz&*aY(-V1^i8V`i80lwF?#OaBw|t&G zsv_*qC#^yOyIn#IA7^DGUJpyIyzrka@uqtn_!wtPyV86HKbqYM1eJ1WHluB2G4nR$ zuPpL3ESe!uHR#xB;1^x%s3ZThb0tR}h4v(eeTCdq7}vRGqgI|P>BX{#B$Vz0S(Tf~ zGm-*}|E+BY_TS#nD}XWqe81)!MW$`o?1>(wm7H+kEIv^pILjWOLGo`2#^@v$29=2ZQxOSL1XG;RiI_bb=|v+O z;V#B0a3xc`^ECp3$1Pf`l_mq?ZGdT&N3OosEyH^J=|GHl-lcryMvoQb>n)pj^Ti#E zhS$v59r`d?o{gQ+KcfIgq^*5B0B%n8^`|}GGN4k|XuGsSP3BZhcwgb!XrI|T+t6V} zq6X`kIo-6V?0(kLUIeT2&5hswzK|z#HX6XZHl@Uhdox^v+byUzWCi9~DsiPp)Oe8T zUuKC?R~Hs&$4yBIR@}s4{M}p}WcAGnNEFpqKW7(;u%g0*f0aL=7D)E)Mw&o1T2%cc zL4s4>KMBzQo{vv~Zm~<`Oa_S{uVrt%mt66lv)HpI_`gcd=2v+xvbd zWiS*#`DKyh@#Fl#(v)-hj%k`G=W03~BtXCxJNu~HlUy2$BquDClIe}Ji2@e75fCW; zB=TOSar$P$3hqQ<_~IMg;1UUyj8G5<+x7|(qmkYc|5vYr`=5Wq$1_Hxp-^fXIh1t$i}6C`dw1HQ?Il@OQwRZFv#9Im=hh|Xy{a~~k~^AN&KTPASRDu9Eh$tROvM8s*j5{mIZ>3PYiN@gkaLaOC zlYT(>EmuGnpWWy6?33$1IfCsFnQO`O_Q`+jZ+#ma+S~M~8mlGiqYO2Whp)OAAT*Gi zkUmXQGIP*nQtV`-fs#r>bb9^wXIA9~yWfLiYNfJ#|HBkyKbwIb4OTwm~r46TY*)N~q^gk;!GVgKO$9%z~ z*Qx5tvaWJo6YF<1Ov55OWA*SK0tdG)t;tK7rVE=6AeXkT@_bC4NtAO|D*)AY>w5_~=;S zRG}Nrb2F=!B-&I7*sbIX-&k1=yx+%T7@8(*Xk%Yp{@7~~kLlrFZjz@Qvv{MnF=+e# zamHR_{S}%z_4=xnqUlAeyiCcm)dYXX|5vGdZH>vc2WPlzJfiVir)H6KX{>AtaG zgpWHZ-5BHs(1!eOil{g)#I%)XH5c8Tb7j!L4T402g4syxRMpIbP^F~F5?JY@S$apM z-SiMFP5_(m40|O6H~1vDdXm!;J#cIhnEu1ZEwLRDQj|BY$%? zu&bvbZkf()Q1*z3C&nU4?EWaOCTc{CHb)8Ae+~UlD+Yk;@tvv?YP;Wu*g=w4eBeJf*wPTKNS2E+lJ94X%y1*n=is~$Ke(!rOE z%1B*gGeFCkyOVcNZfY0R$bGxKn@OpiFqPPUYF{t$H>SpVSPFYviGS?RHKd+J7lPqt z!Rf%Ng*T4zo~C$B-1!EHBi=qs!uAcpE7Eb!lkr{mS?S6<`N(QFW*6k*bSHJpx~EH7 zLC){9Pwr}k@7Hl}>v>g$<{;@c$aHQ|a+)YFW53>fr+?@EIAa%Jfo|y9qC~}^!p>Of zRWvkXHx2mcsPtjPN4f1kqPC76cD{F8=V0vi1OHs6mXA}{b(Fv&dx?^xcTPZP98@YLR$z_b6I{f&SF~X?(PI*W7 zxF(Fm?{~Kc0~jfY2s|?fA0gRS`u$ZJyuq4`pl~qSI+445sj)5zaa?je*r~dSg^?G$ za$GnlP$Z?ALp-)TW@Z#-D&f!C!uE8QLrZm_-iGn_>j_^s>dUJoiDM%$rMNu-lbaP#oe#Z@!(O+e?%I0eR8oQBW%6}C-s`9SfTG`y;_x{g|gSwocXi9Qv z>~~hpKD!zuZ@Q#OEjJ(69Ru@#+-QTPKzwmK8wSCwnn>!cGZ`^Gi~yi%${3C0eWYRl zWKn~ytH0$hO0gl(V!zu99dk^PCqTH>~Uj&>O~t zFy>f{wYo`-_>Y#he@tDoBB$bghd0pQW&+nUtPpO#^OJg`vyhcSPa?BI7;XTFNMGrn z>AZ<*kafcieZ6IcxwA?UjxC{bo_ba8n7=)=%JF^Z%&&~u`#qITT7 zpKuHFLvGymQjy(vD$S!Uu=k8-lS84+)$zxZ1qOH&>9o zmO}Fz=7&JLBd)IR_2oEe9H9Nmli>c3CHAzw9GPhC985tyZ~!KIrOyy zt2uD)&1$l!p^d(?^K`9Foq@cN;{sAs+qBx~n`sUn^~sH*#KgxoLpW^%-D6SxWm^t) zA-KzxSt~w_EikdB4mWgcflHt|ah{DUfs6;#f58^t+C~8i+GGn)e1gv6qQIh*G#@v{5HSL4N%WpI#jDc{Jd!nUSm93pwI_uFbpJGQZRYA+rn zGppT$tVPm2JH`E!9O?E%lRqfg12MnnRDp^HV-u{ggYCRQjKsL6nY%J7V<;0TygSAq z!kN#tluOmsVP+a7cQ3~t5<9`54Va)B{0fF^+mqiT=p-q+FRw+8vkm1?ES&Ib#j>Fq* z<(MhYh{B0EkOVcB) zUlmuMioG%B&W`h(G!;GcPmV4i-q)-Rf+S+QYgARy@(Y^%#0ARW>M@@2w+-ROfz<-9 zE2*A`=10W6lz3lc7S}Of37Q-{G-Ck?0MjBb_RTN3YJg?&}fh>N`u1 z1T-QR$^|%GL!_Wua*ddqqtX(CnrvD z7SV6Ab`gvmaixqw4DTVH)L~{lU#_0!PAbZgwd&pObeZahb%u^|R9s4@i3p&|15_|( zbOvs{whXL#gCy(q+`+7Bdl%hOVBE@&o_4#{%i8VW(yQj%?ZCU!(e7{-4IFWt0DY_D z;9Joh6uOlUW-*pr((O~xY?I#LUasv*M#NSBKLn!pKLlbqG{5722*eiJ^N!z@-9UHt z*~LjJh!4UQpZf}Gj$6eI$zISLbQBk`W0zNp&HoocMEK4_CRR4T72AA5wgB^=xuw_~ z%KLf({9aad^h9|&Qin92RUtwbpC3n6AIvFvn&F!bS}2%(wF5Fn4Y(%!>?t*ji#9npU93-W{PkW1KODWhEBeH!sLJ zEZUR>c2I8Rf3~+7-W_6mYV?B(@US;*A(H$WCPMxG>Qu9Cy=*8o9{f0j-H@gbdpxi5 zd0AWMiQC^4o$N0--JjR!K6^f|cFq;GxeXxsG1=2rdPVuP7GHyg-3Y&}DJ^6lktnJf z?p9GRtlP2_{mi`p13*dN0zbj;?VSXuS2S0CjJoV|g%<=zsuUl9b6JnhR*%JMQX+At zsto2F{T}wcuK_GtCcr|*^oNh^f&*l&J@>2>3MsTD5pMZ=gQhKr;sF0lt?Nql+0Wvz-C@hhAGocMJE?4pG`%`d6Ftvl~Gc=38zjKHU<`tkcnAsJ(<@`)YJ^Fs;O#M7RMlhrn9heNv3;+LhLbnVK=mU zv_Kc#zWcPSm1tRt(1OZWjkW18{brKCl$FXNk+zhZ%YXYnnrfycqDEec^E$*W^_g;tmwDvIQv2h5oEYtj4WWJ@6hKd*R6V+ zs2&>#lS?LM2EdzaD}0_7+!9HmmPv4XI>WSTz2Q_KoX5?$v4=% zXx`@(bP@%vGvB;|%dlrim_30ns^2@sQt4!kjUofsq`HRFR}%mZJgJRVqwxRYkF^|F>lp# znmdu%#)N1;d=gwNQLH2tr1Fk>Ap90=bo?oXAznyy&4dFup}H3 zBOa~-JiL>lld43~H{!|z1@(IUq3tYwZp^z2Lxle$WJC#x?Ss{%n70VM3 zMQ`ck_4n!x;?BpPd~SOO{LK((#TeNEc4wQ&vJM(Nf+DLwTQ;ugE%KZPtub9;avo%} zd#&yM3Q?b^$BDhs3|p)DiT_sc0oBS~atc2DfpYalCLokrWfeJ(#dMxp6BD&Y!aJKd zI_=JW>C(pA`@35Ln6#-v2e&F`nk}@=G+SPXbWEAUL7wTegG#q4L0C#p#lp>{AmHE( zB?&w_!tHAc0g-efbP$YJ_?8p`!fw%IGetAVo80k2X{C=wBBC*#qT@xqx)lYqyBDhG z515YG75b6lk_SO%=<0^%z?UX+o@UOnkMJwgkucdlK6u6Q>(BM$BkKBU)!@Z|fjimm znKSi0f!*6R!PN$U9=+9sNy6qIanpSUA(&hN96|iUC_xC{f!#P0Cs)LbB~{Bl>cToJ zAe+}VTPJC(OVKZA`{l(6z%d3o%kO*aH7!!6cBTGDq+nsFLBlR*pqKm`7lj`Uf`x6n z&dNrvRD(u`rrk@Fcr&(sCV1GhhUpw6&LesU#fxT7IYehx+OyU<<4ok&J@N;dc&3(D zPWsDLe#ocYN!EP9%W)#&f#@dWK4Nv?``G^od&D}n@icZdn;&?$oOo?wwK}oEb=%^E ze#ZLgVqE5i&gOD`Z!Jo%Qc}Bum~AbD_2O?_zSD1>`PsKDnNc=r&DmODPizxLns>HK zRtMZ|ACvK#lD-w2lGr9Bt?<`3$;w~w8L!Gu4s6g-w|MHx9j~u*Kn7bUTsvGtrM)Ev zUr&2wp>#r0q3PS{^mh!qZ*DIk24^Uybbm+A1DguAOIsMR!YviBlD4~gvm9oB*W$j@ z=gNB*fAWzS+uk6~vA|-Pg#e%dNJU?ai>DljevK0Qe_4)T_q`PqnTayNc$y z=V4m0b~d|NWJYvj(d92yyD%!`*(U3DG|1#V^mr4b{E9uKhwQ#)Y3;*KLwjSD{g{xY ztM7o5<=wf-PfS=4p04*60x8ug=?4&fNI^_sOso3=(9rzN9$hlz?v00#e)PLYW##ay zSOe}Sq{)zq>h5mH2q|LrMXg^8VSy_+s%v(H4~VH1SVr71IdOa zqoN6UDf+L#n(TV@KmtVPRn>ZINu|*9sF0A_UV_1uXQqRZlPh-r$PjdKc?5sNGPGTY zrAbx15m7dSHL#rRIj2K6ntp+f*b3)WBP$V`G26>|LjJcXc3s{pbsPK=a#HUSk5Ak= zkA(2V)v<2}xl}83EddND5eyj=%Hp}A0*tkh-SNZ#jwt!Stvim@^F#Db+=eFyIOU>k zmh!z0_t$Fx`Vb3?w*ruDJB);{+x@tVL(4r_u+^g&sgV#W*=DrnQz3e61j_)P+|sKt z*@iYF)in1l3sH0Z78BNiX}2(I&2kk1EavJXNi|F2$)~6-y5hTYJT<3V-8>7*A)r)}*J!0mvz+7mOkGkT`nfX_u4vJu+zGCoc6f<#d*(^Mp@ zEo)93yL*iiX;@X+;3QvIqqsV;tX}+v<|i_&Sal>)5>^bgNRboHKnz$FNPvfSnL*M~ z(#ra4Jv6Xdr30e50pemX<^`b6F+HXGCykD*;PGRH*M&G0wUC~0M-Rl$&;68rS&WB> zehiRCxc2-Zmsi$k>&lVAR}!wvd`AtnH|Di#Et3tuI=OY0LEfIbyCD%A54;=NT>19t zd8ML7vgTennyP4`Aay%eU+}#!F_?CsT}2KC{3;_+%JEc>o*M!gaa1uzO#qLD_GWh6 z#+9ZvP$LpA7dVeF!wUnF2HwC^xq8uU z=a#nwLlL3GzVR_Lr~%yA8`eXwmM0$o`}0Sln@~~yeu@BCo z54WDd-GS|F#lcJeW*jUvXtArvPpp8nKvOEf>Z7^eE)8(=4&vVMCnOlNR4ognnW_7w zD)HaOzn3)I52O1UT6-7sb31s$A-|&v{%5KzlVxM``jd|RkkPt)GS9#Dw+(sXh2gT- z1}n%7yA!+R(nOzdT>#E*?_lq1*sgBGiIX;Ot6LOgC9NF(unQC%(hgN!&ZrWpa)n@N zU;lO5$VNa8j&$}5UV;odz-={QSHygqmz^B@YVJ?fTes29cWG}Eh4>Fzw|2PLInb`% z)nqBpK>TVAyD|qcR0_nMu4}bWghSC$-{guhbzsvEHtta8E(;=_QF%?!U*4pCD=Gr? zp_ZBDpfr^?pm?&S=mS|lc(uu6_uO6DD8mUOeT+Xt1!JpTPR2}Y z+!{7XIYr4}fIvV>74jV(*c4}{GO+vOKgMg3`4E&|l13B)lCb~VY;#w6tw4b*!9%@% zks~tMBs6B1oF1Ndlc0lyoRR(y@5^10isqaw6a$p`sFS(4%K85>+mLBAcCSgH0NEBQ}?RA;jbKd(bxb8`rdQKF(+ zpDov2Epfghbo$Nf{?Pf>PxJ1H3=BtVZS_#FQ>`u6(kMqgO2aqzF3?_LtUx}XqDexB zqIQRDuRry30EWW?09OLt%ZS$%*ZBhpnb`U;3h^%6G;T+HBzdW3vGVl|1^d z%?3+&yqu)cC&LIUu)qGuq-DPap6Dw86}X~*eg)jKt} zCgtikEellxAH7D%8LZI^hj~-=uO84Miom-Ggzl{mk79_TDyH0MVTdO0Rb@STzckEW z9gdt&i>tXK2TKfc)}d}*Q4_Jy<+Q5=ioyMblA}?06D1N8n2@L}8Zb@J^tbI-6Q1vJ zn=IWMvV+4WG@-q^B}=7+y3CJR`J1HJHVd{>(zy^sQcTx@YnYw}8Q8F2S7~#@o(7>J z9KoqHnpUYFSKEUQf`GL1)H9_nU7r`MzFUA_A{_h-Gc zwtHevL<%)*imkc9mp0$~S=byrcC=@UjQ*5b0>-ReHOAQnw%r`8#~#+g#_UGpDIJ}Y zPNj%NJ;j#v`rjb03m}8&cGM&-5>?8Wo?geA$P=-b7sg$O3`>@_ruR){Zec>VfWQ0@ zVX%UfbUUP3U>?Bt=9&{1LX2P;8gvAiIAtVBg$(4c4S*W`*hwc7Hq!nX?iVx&cb*7g z@Zz~&kx@#B{z)(eff&jSk}r=xlJIt zTU9jdvc9mggX`GVy`oF!C!xG-QSjQxRj7D>3U*#cg{=1iTlYQLlr$?hg42{#70ZKA zxm?Q61sekcMM_*GaGA>M3CVKo48N9y`jjp!vHFfXbn-@+hNky)Mq{iCECSQDP-OBb zT}hSHVip=u0COB>{JcWhrhjL*`KYGIiiJW4lTZPD*~0WI>zrsc;|O?YAAgM=qhSpg z@*}^WvnMbVO}Xnl@cItl$KLF-dO)TI+x(yzVgTnF`Q&To`L{hFcPWVV3`F>37~fm} zehbi0C*|^uoJ#t5*&$HIQNe=a(hap6#`#g_WKFzSm{s|c@Za> z`v-^aOf1#fl0;J788y-ITKhZsmxhc+EONnQZ*_;lycP&Zclr(RJx-R#*~Ar}_=Wjq z^L$zSeElWnfk2zgOf%G}Y?dM@K=w8-Y~_V*X0m0X{Ge|y&*Bj9N_RscOZ>v7g!t`j$Nq`5c0^p&r=C!n$C~xIsjCi1F zMR3nG@B=WnZXrC%4Vp2pR%=8=;fDq@;#i7aef(!>&uBd?N4Q-L$8Y^&za_xe+2cL< z-`k|GB~=BMPU~Ak&o=zzDx|HBk?>|%=+)a-M7~VRTY$Hh zJ@dU#a1X`KHL>zKm1tFtw>M@WZ~K-E0j*~I!A*);S)?f`-_%RJ_eBqz(s&V9>6>jtTnlWEyYxOQ_DUA zW{!|hk|3_WXA1c|-VVlQt%$va3oQO*3uQj7)hwHiJeEN%oq~9Ub3-QWptUK8s$=UF zb;)2}Oxb7T3@_-dnCO$?MBkxwLnRexY6+60Ax<_2-x;A4_xt%gLlferRuZi1aW$?K zce<2s^>*mkTQwsz{|2oh<&Yr)5G(4b&9MX}q$B=PJYRFg#R0h~B>N`_7j58Yh1Crm zfX6gSLhmTM7m>o;2*fxN9GX?Li*LOcq!@%gOep zJTeajF*7F>6n`7dl>a9e9+C(}D!gzco^N>XDeVz@jN0)c|DO7jnXSL=pd#-iM$SRS zJ-hPn(my&n8fCcdp)jUc-HD8vbKY3;O!U!Kpwsm-CqB5eRh7Z*6*|K$Hul9!M9a? zWoU*W-{W=F;qf-rm|nU?>p3!=3ORxvttH0^YI>ML%HBzW;KO^SOQRQ?{BOal<73yu z6a6-J!drK3{<6ivQeHZY=Y9W9&l(}D5pfQebpk9m&zyy?06uG(@J7HW`%_#m#H0y5 zvyFJ@$Bd>?h#+vKx%HT-HkQor)@Oo+gF^LBb@xGQJMSFZrCe~?q=Vbj>Kom&i})HE z*S85eG9l_}8KvM?DVXn*7^%9PVr3DkGGstSQyxm=b&@I*J-vQ?>M?q%H7TVvDD?(b zOC#s+lGvG^y2|vjD4XNU!|n5sPmcG_NT#N}K$)vx4Fm}uI`#ySoU%@=7%%y=ul&NT z`ReviEjoK+o+hbC80jlJ!8OYmeye`Et?tkDUO`>hb-d3|O|*sJ_qn4C-4Dj6ir4O3 zqh_Py#`*Am8u)kE0OGoz|FdZuRS$SN!hsWpY}0 zip*u(5*y93NRn@Hae4!+pTnX8FXkdb0?jYQE&&K748jZM2_GX6(Hht=qGkv4^AsD-N@%vb1m{iq*ZV`TvFG=Dhfno483wt?X&`n$OMh-P`v8E{kgAggAlkPk#T^SuBkdg~RdVZBM3 z#447$)vl z|8`7RKkAAP_8{vwY`Phy+p0-*-p_UQ5v~5&m3FRP5pVuBrRu$XIN6t`&|M$+*NRfoPy17m;vN- z_VVJ6W}qKi4KdgsvE!AYo66?KII)qDPf>N~nelhs#=1N5s1t^@nII3g{|!SP$Z1sn z{yD3ShvN+Q(%6;1bN7~B{z+3G7N{M;guFw=Gth`lW=5Cy+cf;znXepW`o;PCx$Aq;(YHtfqV}nuZE2@ z5nQ*L2%V!?fTjj17fn>^-MUrb?*F5=N+9M(%Xx;unJ~Ts-6Vl0Io%YAQJ1Qo;u;Hc zYYe=cO~y=*YiX)Lo>4w%pypAa|KMA#VsQ~*7ZJ1>@(`D+!y*P_=0DW(FboD2%?op`h0 zYbhgGbO4mQ+IAjp&8!|1gwpZ6 zGo{Pm%F!vXKs`p~Vv1GA3Y8xXk|MLVhfq#JJpnAD<6B}MPrB8%4xFB{PLb#pO=RZWD1L;ov59MkH4qphZTtS0;*m0)simzOq4uc0gM+Vw)!?Z5@ z2j0xmJ{0PJv285JMCTljU`ct*cCc0g-SLpXjHdDl<6{*Y;(Kon!_A918P&oP`90L4 zp==$Afl}qOWsSOM!bG_Qx=wXUMk(2@>w2i~$G>{G!&6163h&z*%}#*z7h=U#z+W;u zT%cr{Fp;#PXrck25Gv}7kZ^bX1Z}i@OBds7{MV~DYPRMl_W(A?6#Y$3?P*qt?|T%D z=Fl2n6RvIsLx(W#U~`8Wr^caa0~~VGmJt;zwBH8b+YS^qq&i@1_Vc(T9itf>=E=)kKet8BTf;9l#(gVehv>IK^RUuSZuP2<(>;yr*}n{dBh$ZF4e{kX#FL#RmntnRqjNq825x6%RXElKa3k z8`L;WotK_bJ;9_)*5DQE76&`m%yfOna}}NbX)@C#AA6``(TJmTyX?P2#|>;d>*X))lAz5O?}b%RX)UalBg%b{R)7GIs|Q%)P2X#*OwbaEPlVYDbtnu*%0%!e*!Ea#m?OFK?#hs0kHx&>FhX z-Rw0V6sX!J=lpi}+IaQOY#%#!1*?unpXrkuO-5sS>VmHXo6dbb)e}n}#=!;q&dF&s@GkZ?S)!7guummJsz$TDde5Kw&y~Eha8;iKzYb-jKPh%u*fbY-CkU z%O*XcY^~717Rj-jFJrATCY$e3smv)&P)j9M0#h#^O)2F+3VSkWLRHmGp-Oo^^yrCK z4Z>}jWsT?@Vf9g1ppD)HOe-87X*M}FAV1FpXVQ32Y8WhHT|0G$AQnohkb*Qy#84=8 zLzOhw@F?j5&@IjkHo$JkgRd^*o#|-AW9w5ZO!j`TY%(r1jQ$J?V~@p3P3td9-zNA` z+1LHR-sB_2GY*z8D1D!IPHYNR>dU1|FjL=JW#>k-8av%xV2Ex!yG)Jjy42l#7dlDM zlT8g6YxH%$XUZ{Bc)%Sjw_o|A+a<*U96r<;KhaN|jsViesQbGQ`al~TZ>))HUAZyC zy$3!#_m9?mIj3|)?fQOGA-jo%dMmyGO5V4Ir;g&Vg`@>ai5kU?zbZ~XS_6X9c_VD zvGwltYC6c4M&B@vAnJQv@IHsULYP)*s2 zC#~I4#JeyengGAy@C~P+O;?hOhu}ei2y99^(L?Yq6^DpLHU)aX7up+s%uENIZDC2+ zu#0-M<7)Tc|1nc#(Q|S}CgT*7@BjReZhk8M_){xYJ`x-eI#FzefwjknKLw^_)J1Xj z@68&d%JVsq@%!FA-rL(TyOSIC{IDET`&9qOa;$2s$>D9IWba~!{l_738vdt-^AFfl zd+1z{o338PZ@djdr@A)g(^msFQ*n8&DtT$1f8T!Xug$Fnqe_kZu4W^|tc}{mzXWtW z&gsFS(HeB=e$x!Zy7MlM5AgW6_;@4oJ%V%VG}c$rt7$m3?Aq-O3f4GHbcB-rbG9=< zvN1E2Sv%Pe2)*LER(DiK#*Ya91bJ*h0!xoYh{afNp}AqngC81-)^$+_#nb%)11b}C z#55p40l`zc_sK*OD>kLdiz3BV>pBQQBx=5ZApT_ZWU1qsmh+%%K(5h66QKWrGzk}Z z_;S=o$DGaXCMJ9LY*8>Ajf6LN^nX3m12+ASH+#Q3#QkyHz8|!Yhimo4zCT>Q*S}q{ zN9r_!bcOgxM6%Wn-J14|E`D|cCv~Y$ZX1UDXara(^cfTtK8u%y6K*zPl}%rC>w&G+ zexYJcnWkF4$`!N;`B-0wrIbWmgI3s}#a=}WLLso<+*TE}o{Xk})%j}d{{v7CB`R6s zjxRUL=s_K+@|&di#ycq3PV}&l(wEk=$zw1jqXkhJduu^1QL9iLwV(6dDQu;tvnb1S zOR6xAl2|VMWEO{_|BBWA0hESH4mwpPKtYbIO2hcNJRF>wE{a3UPi){^_;)^g4>M1A z&av~L(>phAOVHr)+B-x%`Smy6oo~_WzMV@yFMhRp<9kv2Z-39h({ly(e$BxFYM;+j z-?znjFSqv?Y8r3d&?$nX@kvolPp?O3Qoo|KdmqfXQ$zUKI*jS>iMCy8eX7`!n9q)U zHoB4KNk1%4IgYpo(2spKF3fs&tQRQt7?jnnlGn=SsFIqmD|+}N3>St>SN*@9(F1o2 zK%!9O|LKhp`S!cTWk)ww9AJJjcZ@db`+b7w(<$j!Fa3ZiFMSs@P=YD~n#O`mhWaC< zOuauo3O3{`lD9MOc&y)I27itp7kvLW0s?~h*Z1P=J^8;chlh*G!BTx*ZXdsw4}>uJ z96oQS2MD*eVNbeGm9?8Ygs@h><%8Y2V z;Nsj{^%%;osYr|;^)#?fk;c)_`hIwDItpu^_WY9{X!fPHo2BHur5sK5;mEk1Xe?Gm zAGx4sf%B^pUXjUh`zOs&rqZi|IgK2QU11@riO^EDQ3pk3mQqo3sFx_q<&oLnZ#;224(V%im>MZv-lE6EYRi1X=qIIz;V zpQ%bYf)XR*YGBGB-N7M7{K_MQ3NVIE;L{|}XJIOPCrrpQNHjG3@pyB~abm@g!4tb4 z+-JgDTU_JBbKr=#;elcVwZJl?W+;M$FHZKs1)jUx44tpdz2nPlwMv|TU~(DF0JMe%663?bGv|A z)un;;6Ioyi6krMo-Rv{@Byh+_3+MZNwKvpA)Vj!Qy1W8FF0Luc)A~gxm3}@8SiNG& z=q$dW{7nbqKr$YJR_=*m}QTinVbimh*gKUOss?VH{J?^`HFT>){Gk* zbVtHc5y%XPK22cjf(EgpAmDAd7F-`8_}=Bh)}>@5yY{-Hi7~?(F(P8TDsT}Lix!iq z%cSozGw$vT*Ky2f8r|x znK_|n%P276G`wy!H$uz}5z1F6dqeHrGn6AX?|`{cqr0(ULLro<$@Y_juLx6Ki4+G+ z47rTjbTT?Y1gaOVx1=B0|yfU-dKp_({R! zs$lF(l6`(Tj)NkX-@^(}}VL(sqXQ(ks zy*q^sfoL;iTZsRi7Ln>k%6)K{y?to?<}^RuTY33aGcxtPx-`O66B?7fQP#`<)Z(li zI2gOxku9TFd`PvSXS@GA^@P=0O(& z*d-+WbRWNS>cQ)4yT&G*m{dvuif!3&Tnaa?!>$jYGlYW>*4(g6ipc?uGY^Cqu_qyV;#QCm(pNt(PNO5Nl zaLz+37)%(v=$ccZGclFge=<&m`-QlXH(DI=GB0p2P*bBjXR8JxJ!s1p5yfu=^dshA zS@F6HT@?e!b~%Sr?pLPg&Wpj&^)9GUa7~FHr6U?zDSTX@4WL0P&2c9>L|CVg%Vh+w z{kQSP?EyO22UuXRQu#tmJDX01OButO(Cil3Xc)m4F@kYTBFU2D77{C{%2+8WA!mD0 zLCZ%z4+v^pYO^4zVkx0{)PEO36|F`D1vP+l`=?d+tsV|<9u=xHGNvuKOu+?cqBFy* z#exs}=F9M6TTnC`wNZ8Oyws-6m-0@M6&fA_s;t83ll_QE{iqi1;!>b9gfaq`IYcxR zq3Yw6Q|!(mYcoR*AxQ-U7!_%yhcU7Gm+23Z)$eM<6Gsz&kmDs`DR=HTKqij`jFRrZN9tiy1V}V>P_Y!a`Jws@5Qol zxW}(rbSzg+p=Lt)!9SV{gsna8%1FC!U@s2oTVc{Kwwvf7Ybi^iW*J;lEhZhXX|H@; zAT-#Sl|Jb)E+7*|Dh2u)rNS2aJX-%voG$TD4=8wnUb8mT8|5Dwr{S%OI4+$=KIZP$ z?P*n&qJ(A2zcM=;uT+~_!G2isqS?%wMx8DQ$N^cZKzGIzu#2Snop1t(&&JHekLd~FSVZtbvN)N%&xSZqx&>vxUJ?|xOATi0<(JefRN_u=DJ?HC^5 zrZr;|dEyF3eNgd@^c{;cNdu(4z8-RIJZD-b1_g9dWqq7mALs;3bZ$0T=&_Pj3m+Dc zwKadkEyf!~yA?^tkBL;2z+r*OFoV+nOet5?T*X7uxi9d8hWGxq0tkb%n}b9va+Vl| z3)Zg@_l)gta}PYQf?3z!%)tFBsCTAZei+j1L>h$>Ti~3p38_d`LMBav5};GiHq@Yk z%jA(9PM#wqT$U&U@}gmYxOvDbLr!VtOAq5ubije5A)eTpLI%#&VGKZJ zG6%e|*!h%@x1A`*!E*1c7qbCkrV;*%g#OxLYmulz9U8Jx8PEbEQ5~&s!of(7Kf%m7z}VmQzBdIrJe@FHym=ZOlO#p7^x6F3yih2%TJO72GKbb2!zy%NLe|-KtSHQ z2#F8Pt|V_)t>C(`beyNjQf?$bJAMWANYFYEujcCjd2_a!!;ICr6gZ~PSt0XI0fuwJ zH0e*#k9(E35EBfwY;0!v44(FwZYoW1VzHscOl^Si9V%QSKl7}EemgaSpSkl9kRW}5 z97aE#&EImMA0;seFZ$)IQB2xu5HsajYKH0C{ggDT0p1}PBIF`VI;BNvwU&O*rz7_@PxO~ctdvcicf#dN;;^_;tJ5dJPIBQZ|o zR!qWtMSWVAip*oRQSfgc33Lx8w9<8+#E^yci@4*I7BB$x2ls7FYzd~_h1$@Js0xzq zoNEPpB$C!5kPQHk`J2iGfOO_BQ^fzWWAP2_Rkbz#Ri5SPo5~>;om*;Q8 zoYjHx=cEc6=jcU=5UTUw4ME)Og&E~&2-bdx-wB<;Hxw?rWxks1rXZpc2gvEJ09UQ^ zLB4U)hKE58LKTyNCcz#u8qJ?@OkEkR(|?hTBTpci|2Pq=jH#WB8GovIWSBGZfFgR^ z7UwF)(|lKf8dM-Z<^7HB(ItNao@v7c%BP;lVTT9t<8_Loi_Nkxm>9!n574_t$;I$$ z+@Upm;6?MXWa*~6yxwT;8TI<`A|ckrGmX_BPPNFce|m8h-Pk`ybhn3b6Wh*A&}Dpi zdA#pFZ+8BdF>psubFFvM_Yt`?`T_G(J}1NFINb&Kcv_t(R`_JUpw2F;ZN=5ES^GlG z@!q%SG~vec15f97cjMbRXqPS?wY?N=bQ*g|%E(lvQ1$Hn%d7A+?XdB-fSfHsDO;Q} z_9&&hC;NZb@)CPc&XDb2PFA3ti#MNkgr(ul{jXX^{tRrL#Vs1f4;}c{RadsOPa49p z(V}j~@tYbZ>tuEHqkLeWPR8-ozSxl$KUERxN9|}DMDrnj#``+$c69NfyR46o!@jvD z8b~CE;jaIFL~JX4ESvw+zv8dl>*e!(yBPlU{m9o73-`TvIOHwp_xW~l@xp=1PH_S~ zs{a0rwN%M0^5Ts=Zf&H^^1a6@pguo6fIPM++X{P<6Gk+CYv>;ADb1GdHjc95z780@T%du(-G zc^KRwyDzw;6io=7gEpON_61v6Ti%b5#q3%jVE6M_B=)koeeBT9%=Ji4cYA1HeD1upx zDvbZ2bNr)=tmH2vtB-}=B*jkX8L$>%wD3t7bcT0R7Ti>dYt6yH3E3P?;e~Aii;K3X zV@dSbx7jMwIxOe7FN0r`iz=rM=2BedjXYFPr%kjFW@jzy&hUlIt_YbBYxz^Z9t}&3 z1{C$XZPIwmDC%D4TSl~n384o$ogLfC_n1$U5pC6K<3+A&Aoi$z;)Y~vXT#mogKmek zBu$XY02$zC?lNPdZyNG=?kUNUQcy89bivH=N9P18<<@Pp3oOAj&xF(0M2Nfx0esNw zDcD&z5Qa*vlWEf5d+0ScP zK@=6-c?_BzQQF~>DyxB{AaE)qu?Y4Soi4(>9ud8>V-}IcYj)p6e(}e za%6Vc2>{9My4$DnfaKXyB4jf6x2Dd_h+|7b4P~0a6`U@>RjDFWj3T1yJmmmv zKErNTX0?i`bq?2O%4AYFM$@kvp)ZaH-z_jkr4et=WDcjZ$zx0KRI5TTqv@pVyp*SN zFwyF@Kwa<;>=7Ut>;|;v;O-GobF2MMAC$8AOa;_;FjiurP3fSy1xU9zz!q8^x)|cm zd`=hg93;dP(t#I5DZ>y!e3U{H8et`%9#tkR{~_CTp+$p0NC}pYb0tG;L$Jmc?Z3a( z9%MN<8$oNS53#i|Y|R-SK|5mIji$9RhFM=3NI`TkhOvHOYpLsO4FQi!It$h<34Iis(HqDgMGT*Jd{J6LW{rflKUJAmy5<5eTi+%*q`lMDXao2# zLkuKrkW==|rlOQc-ueTt2! zx^=8eh*xAkGN6R9c=<=DV~vwPG3vwz~_?p=L9|G9bmbK_@%y^mibde-(u$WQm;r~9Mt{n7XS=)Zr4 zzkl>!Kl;xf{ri7<{vZAKkN)dN|Nb+<|3{DiqYwM({^CRkX zI91y;hx+O9s{?{&{j>Hid%pmH{?P+s#H57jRm*KzmkMgv>%0P!dAf#Pw63_{+_ za*%~0X@9zC0-i-07M70{evl8RYS4V_P8VS>#{llWNPnh)#W*ue7eBftbDwQ3y)L~$ ztYmsj3G3(&)e`Sial>V-d=m^ZyQfcf$D5qu^tFzCVcooyq>^Qm_ZV#Lme~|n3{0#p z9u$_}-}JTlEo~juCC@Fw_f=hrQY{4^*~6-L!k@>L=w*w(M8Ai`wjVW~j;sVjkUv}C zk<#O^)?Oy3ZFZKz6>@IDfSfRV5@@O4FzLpwcSgH8fQrGh(nq>>G%$ZPJX%`S%~TPY zM$$fd8u_u#W^!UuaIl{CD>eM|r0#wA@96%GNR+2feHK2qJ~nr%nIer0Cp7j#B1Rrs ztq0_vemUR#hbkhtre@CSd7~OHZgAxOSx5W9*JU|V2zf+Xl$iUV^uQKT9Nc{pMAM!I zFP#d$8S}F;2N%%Zbq*~9*(jKq2Jj1~5K56k8G~3-qXK8Q8W%r{{(lWlytATlc@dZLBR< z=>o1KjjTSWTZ6KX$GP`bZ1bI!RmwZZugY3(0UKnP(#Jd{ir2c1CDcX^QzQjz#;7-X zH)~KpmV*JMg43)!6Fh<^=!}FYr{Pb(qr{z~ou>0`nTM8CV;efrg0EI`v!aQmucGS- z5_v+r%{6PSj|t4{ra6{;)x2wUp4Tw~ArMt~ym`YcbenPV^1vhVVW8>NR#07ppngo7 z=haG%|If5ZkY8_Ea>Lonk?%-xgw9QR=pLr?(f8t#Qh!5R$TUA*`NrK7u16rALI7{7t8nILXWDi(3+dn>$ZYO-o|;q2MHT^&^S zjJ5eUQv!C)%7xS9X4|~py~)7(@Vq_7)M^;zcp=Iyf5p&yxvkkRO+f=SbEViOORL^n zSXkn8Jhz9rJLeiN{~K&$I|{_J_4KEPcL3PraIMh-rM>3W=*K;h{SyMd)X@)etGNEw}@;Fv1*~D*BPbjx4Ab014|waC43J zyQ?&)uP$OoTz}bu=l}c#=~&`L31v0MkhzKr|3P@=^plS5w?oc$s1O?rpNSTZ78ImE zS)njds7REbHE}Bg#eI#7(+>~s-f!ugR;A8tSi=6$XEY40@ynZ9*q*7k&wk&f+%^l~D?+jwliE!a{Z{bX16JnR=&L5qn{9SNWI|$O%*9Yk$%|^dj!nTV%_%uA3eM7>0IiB`lB6`MH^%eSycRyJM)}G}A zgr0uAdPM&1cdMZc9EsYX$k4%3el$abCdBu7Djn`la9-w86iTEA#{H-}-KRPjKL!>; zk0EaARPoSDr|pm-vpG3K9&8?w!j18MAQ9pP)wRdc`m~B~s&A=eg|h2$S(>8kV2^St zxz5uwYsl=N@>qOe$)|j(4daP8@Z5IWf#23F++i)@QhxBl<(t!D_-tn@>V@raE0d$w z>P`f`sdIdN5Q9wm#aJ?`@0umRnA!3P+u)mDv5F%gTl6s^&B7VN@4cQx93YZPrVS+F z%$ybekWoSiv*>U8tX-dc8X8JK&l6MZ;=HCQ#_rm~pF)BNwF2?DnIvCD*@&iU%gSfG z&qLkVy1GEH1RYtbyf+>Uo~%}I@dnwwm5M<#vZQ^L=yq5k$zmnIDmxIXN>O!Zqv2zV z5KdQ}Q7=G5NGCX3Q@0~7)Z#h{#$nb+&`fu#(6k~gcaw1XSidkq0%s7}AHVh;`6V59 z7ge0q0u=?!c7vRRM}v+-p>rk8V*ovc8ZH-bV-P}rcy*@S8T?`lP<-Zgf!)euA_tkZ zmr9wullqN^9DmkrdgUe?*$e(`#u|8u>*F%Iv`ArKYlEHB2LTg(U0(rxaxSOz#qwSw znkCuwm=>vN3xm>Qgtc7O{}TL_why`%Ib>` z-CuRu88Q%%%if|g@4kIvF1uY#xf7YN^uQ}|&{T5$q;eKkxAfp^u+Us$k87g24e#|5 zZY#UZWw8R9R(1MbnAgqf+d5l!qfLJM%^=|@yKS2~@J-lydM}i2{ifChw$FZii+EB= zt-s!>GnLU3?b%jn^lwooU+FvKx^<&FbitgVXYd9`faH%J!hyZ2=Y*R=C*a=Wvl$;O zAMy`RvVqg_o9(--4=EZ6B4NH9ymYbhv;~fst~&j<^b&`B=btlckr$;!%1m_IDtpGI z`Zl90ULBAN54?MsNPq7_Fm#&BB2Y=Betr$qW1?W(sbf6o7-Wc#i*j;eR|w(60i%^= z`kf(}jW{XY^#r|S| zT;d<7P<8+>`cr3Gs%l(Ai-8N23kt1wTtV#e2GkYZv>IAQ9Li)5Jk>G~qt-8O6NY2Q z9L5KKj7gCkFOH=bLktiw^oM;_6o@@l6}Wllb{>(K+MjK0g*%$cgul1xR-wY_q59T{ zxx1V(SBMF7v4xK00FS7?uVdrR?ZeY8gR|oz!nv?21twv%-a!|nB{nOEPUW37WWcQ% z!N1?EOAz)aNv7G#OV}L;0hJ2_&`27ib5>bR&EmjS;gQh5r~ll?Z$gjQNv&alcs-Q+ zMgQu)uUNl_;Z&j}nI77SQt%ni<amt;OEW-~}Z7xeZZLxz3} zdT61e%zy-~tu`(X-l)WlCa>UK?M$ayP?PjJ7%9vUXiVbgvyH{d<){Q#$?tn>nQJu!qciNKQstD(18y80AFhOVmnHX{7ci5Fri`;DE*G|XVq|~3n{ksk4BZG-@Zm; zgiuIhDsnpa`E7Ia5itC1 zK8&l=blHO2;4=B8&gmWP{kk{Yh_1^$0vI`t-dtr@@>Y;ESCKL$sI^pj>8qa^a*jYr zUkr9+$^<=q?(1estJf>|LZMm-(D+z>8}798KwWxlzlR^AnLw%)nz)X$4g+4sEBW`7 za?OR`brTUXrb#IM%=-IoRWDVJ<0311JLXxbNvh?IRkx9v?emN`Gb?F^29MhI#BrEZ zL^y(ee{-tZ$C9{z(M339=H5y-X%H+)S$MKGk0FA0PUUkJl#qA1C{NKYv$$5T>lJ`@bdwkn!$q48MYGYY#&~vPxg7 zXPn-5_z~o=&eWHRDrhGvQhz(~3z20f#|^OlO0@cC)Jr2`=NM0SaTB)E|C_6gL24uf zYirNfCs5W+2dKL#fUmahi@w-TN-LuAw39FL+0j(8YMJ(6wy#u0LCz3>(o%GvmW8#L z@qvuiQ1-Turn94WdG(V?8A~7zO>s#~=O&Ces{1l;C&EnDxQTT1P*VZ*eOw9^%ak&% z`}?;1>zJIK>lix9f@1Gd-HJxo>2~kvNa*uA$?PJ7E|f-A6xv^rOW@ZxYB-0PAX}CK z-XZ0DFP4~Rjkd(9i0(>gnsAX)*`#c7?gQ^(fl$`z*zGO^;WUdZNU9KUG$@)VO|WBF zR48KXYTPDRRLEOx935FnJRwei5yI+J)DhFX>0O$hB3?PCewE?2ik<9e@&;V721(RR zxbj1)3&9eqb%VwcCG{Td#Vo||QnJm>aI`#pKhm{l62$Zah5D{`Z3=G96V>&dPc8fg z?rdej7CqlRd)B#P%g8dGE9~++t){8Ghl-Qiq_5rf@R{J|fY2y?|OaI5~&2Onq=49W&6?IvQ?b)zWWh?&NS-tin z?4vgUrs-NH*ExQ^L*e5*K&^j;nXY{@N2>RfRII*z>`u?E#@BRBH?iFZZ{0P&Gp}Ez zgS`Fp>*hfNpq5U^?A@7Pvp{ynljY{fS%Q+5Y2YgSu^y%_*-u3swIU z5l{&Aie{y$1FVD4H3ICbjK<(M+_xsdnnv_wl0@h`cJBx7WPaEP!q=f)x^%RmWV%j^ zN|m888#k#jZslnXR7Wo_L7)_!RMWO{Ae5qoyP!ayhD{(C2I61fVFR#p?<5Q3&NN7p zatdC$y2QflgNXtFgAQ?%s0tV}6{`Oi&85@a0qe!i^>wDbkADn|rG8g@&h^nvZ1x%b zAxXuA7(P8Djd}oIC357l%LI${fNmmfi;*4cs@(~3j#Xj-9e7+9BEy8P(pO~35_tfh z&a3*(54211+twez#+F1gXIGAlC5m*f8L?t#g#{o2b+#=v9bCrZK96xy4grZ((p)eN zxIiU4#J39G)&hxHI)Dt($9LTZP*xb`xbI?x=p&HyBqNo-8XCHE$m~9Mx@8U20=zaH z!9J;;SNsH=-I2t5_u!nt88X)O*RJVuzIw`LzAM&1`%mGoo4*FeI(KvMx?gxHdi6fo z0ILamnfo@*S)Q^6&RMoGjas|0ryPm#ZG2M}YnY%>`kE=CduzY4L=n?VSSEq}G690) zWhTMXqIkpw>W1@qQf(qINs>!Ojnkl!a;21sO3`!D0@nCP{a+UU$c0T-4HdGFnG9)M zN-Zf34AqLHt2t1XiSMwuLkI2sn||U!1t>xm4 z!n6wWz<1~4Z5Q)PU2{AlL+LvheDx0KeVknC_(ODPMvo;_rq#JqP1UaJFq z3XpFj9voly9aAE7Gk!JZqA1pKbZ$){yG*V{gTeVXyzaT9*877Py;qg)7k~Wg-aY33 zGCj{N#J}xr`F^s#-R6rG><*sI0;CPSrWFUe%PH(TZo}~` zW^|YUS`)_ZL6ffGd5oTbfmMyZW@ENP$EwDnR-0P0G)i*hp|7o6-=<7I2Bnxqmu*n& z@%qd+lq*nDQ5I4!>hd@S;rAt~H@3fY_sprmn-n2^P%WRG1m8{Iab6+r*DAq87=K+l zGH*HG57J5!(g)UmIYK*B-lbXR{S%~t;5Lby0M@XF`2O@i{3-Pgdvs&|!tea(Z>HD2 z$!DN2&>5w-6PTO^ecWo6?YJu$I6g)r>Qj0?_QpU_Xj+Ck7V_6Y#T@s!Jpz{@4x5 z*2!1gG`YHt2l*fDU)(V?$|0RCEZwz7T-5rB1T3$i zVc%KR#m}|+N!v{%&5*r{WXu=Ek8JmTV{5}Q4#gJh%6s!~<$fA2&tIIPsv}+d85~jM zh+QaEh#FJoCq@-p>4K6KQ%1@GE1)RfJZaUT-yw7uWsB>I2bz`|ppn$QW_aXJ0*3(r zb<*ZU(8X`1Tg^OT(S_g&b>~Bwj98|PgP1UMsrUoU#2D5I0;<*7gPL(WFIrmnoZcr=N>gujFs}J*Lm*6ot*TfqyHB=v@Uk7tTf|+j%0K}YTXa7cT3O<3dAxKaifWl@M0XNr)0R|0S8l9C)`E0UqOm3 zchMI})#LMRuX2@~pjXKFcVL}TL<0m5!h-voB;ysNjoE1-3g!gNHZoswV6QIZ9y0b4 zpH^^}^mqy`EQ=2#N@Of+B1-Qp%Y(4fC|*J(RaBYmo(&{LN4ax0kwV@wn6-VF3t0WQ zKH*ZTbAmV{MyC&1SIP`!1(@i!k{Erzl^dKyXJ8sR%f2yQ`MNpT=px@3skA9|)0mm? zCp^0fiNy;k){n;lIhYGzdx z4+Z!&ROiIi6{9ESRUt~>cmE0J;f=@DcH45y-%|XjI{d7SYuwgJHZMb@^7}VAY1H1R zxGiqC@8RO~zXiIqkg?y|JC0vjoco$u<`w@Y170d`l1Dzk`Egp|u(&f6mr>y8nPA5} zO}jafJaKcwnc^5yZIKWVDodssDbY)4cZAZSq2fgRMuxJ*|2AWYwrlm<@UCdm%e6mwq zTu^rvtd9~{>zL5yJhapBF;rC4bz%>W$`MyKU2>nX5cXaEXF>Jl%ck&963x>W<71VS zdsA!B(ydo>#l2ar(v!<^Sb=UC*rzZr8dqL;)Qp$P9n5K}E^B#+VbSF18^cyGoJD)M zTV#VS7T8Uj=bY+K*0#a4N|*Q~esPG0wv3FFq^s;`BqdHB-IL}BZop(!gXW15Vd`6@ zs;K8V{Ivz8`I@SfVacZYrMKhkc8-BpG<|YsN?Us%?9NW*1^o@wjm(1iBm>pcCRO1E z?OtMZyPBN?v-t<6jhI?j#u~3JhzBg>;ZOKA9Ju?7qJ#b(r7!&SHlYIo+OJxBhiO|C zs2!fy4J!{Znvk4Lp34n93gOA6NMYNt>=Kijd#u3mF!;g8cWa5 z{&jqC)hvb?Z}O=xO`-K`MuKzSp{5$3zyCloZLcileFfM2cH(Vvx%j#Y#eDl$I}293 zzZyOUf3~_sWcM%G#ArCyzqRU~S5o)jy9Exu9jtiUDq8ZW8^j}7dhF497AosNvB^ZU z^X);>vh()s<&n+o%JbccD&jz&!P{c;1&cE;q5-PpjS-afX@b>hXXm$o%q_0s41xTN6VD@e^|xyIljTZ~(P?9>)SaAEc8CAtlNlwW zHHeIAM0A!{kt$bqF%cKVWt>y@P>%!+$j6S3+(X==^c+|2nxe!i7B&e!l7!M@PCQ`U=?4S=u<1+$Bw#}ICq*!UkruKP{?y{GrBK} z7JO$7lvFa0$#0%+)%HQJuU!nH^G6cAl)UIA6=RTz@S@@;-d;b~DLBzb6h}f{;@J+b zRSnNVF^BGhnaWT4QKlQm;3R%QRIp@!k3KlD;dnLeU**~&`eWLh z#`tmEYzP-w{y1Y-Dh;;kjliFlBpA!`5}D5UFH2dvLi)=z*0~{VG$*L8CW2Us;RTU$ zHT7})t>o%k+mvx~N@)eJ{bBeT8iC@K%Nhq>LzEl6&r#I{KWqvc<%l3^6T3+lN)JN- zhfdD&^D}lUx!mgu?NdW#3fSUZg7SAsubENzdPvEr>8zIF1M0GmKLKflBC3YB=;2v- z)K--*HW^E&0A)m#-A7a%*P71n$G;fd4h724UaVQ;^j9rInPb07L`X9>Tb}E!6ZG#r zeoBxvoA7Qb_dWck52#OtG_K3q(}jrj1=(z5mne#{alDHSjf!i#l;~2G(mX2JAu{mJ zB3DI{#IBbm*_Aip73tteY417F)kpzPLczfywjx59lnp2UX@Q&kju(X}pOq1!qy~hHN#zPL+B+_d4(8+0^KlDco2W7< z6^N$7n|~{Ze7naHOg`Z<|3mU36`4KlEcT$C&|Lm2$}(0X@+X4W(N}gcdht|;oGj;= zCq0(@Fn?QA>T?9Ly=peehk4#UfU$-5uZL)F2}h`Ql&tm5?&AjD@*zPqBZK<_pWMgr zV>8TQuV~`ANimmJOn!ni9vTYs%J47Y?v9D2KTkU*gCwqJKvpv$-17%}*)wA671b}E zr5#ZrTdeK8@wv@(O>>S)Ej~`aET_L3Y_PeOH6%PZWzN{J7`TInR=f)C0&AS>cx7tr zWxSw8)68|(fD2r>eu0J;NWLZO$b^YmEOv&mPy5o@Sr#fe?J}Acbb2j}6PVRv-aSPF zpG!!IEC-MY&EH=wLt3bKP-;@`PwThj%@O`qhF{)ML4qsjD|i<7G18q& zb=kx~xxW3HsJK8^$IpFI9FIKMX%{c0omyOdB_!%2JPss?l;*uc@Xi^B~P{{T0m%_p=SxW^Xh* zVOrlWgeV_1{QoKxG5%POoS}C1U+7W(_Qb8a5Byg0uCl`6#^S{~eG#1~YjAUp!RQ20 zT`1Ux=VzNEWa&F=`C}d$2y15Z_eW9s8#4Xpbnw07h0%|@rINxsY*rNVNbZ>JYK;W2W|< zL|W5+7E+_fNU4X1i{L&HM;}4Zqz*SaNh~9UeOF1ih9`Vghrzd`hxzB7Ye=9 zhjnhXyXut@B6o*oXi&w}_z@cE;TO;m29;s8!S~YpKt~sand1{r2pdPaUPLXDog})) z_2vC^<)AVZxECae)9;*+?9`{bQWiC@oe}(xbAn{k^F7C0v{x5Z zl)2`jO>E=Qi~MiNv=##*db#3SGJBSytA-O*+Ku#O-%0M{rXAm&X77(@t3%v~$*ae( zmbZt-kXeEF(tfm*=dpz{b(`W%yT`%xGv1xnXxI-!ob9*N(rV$ zinz(&S(+GWj#8TyOi7gm(g<3iZYl8aw7^&~+*^Rblsen)%9MR}u-{zatM3WvRaq8nd$ylohH`bJHoF;(;2r7k{AoMLmO7 zfG=A)V`F3Ma+9E@!O_2c9G>od@^chi!!FK_O*?Qh%?I0xpcG91^-%37crwj$3b zp~A&VzPA{hw3}kJ!(e`r9xOpD5}~-dqEu8kX?lS#^FY+6*&yZ@Ot5q2Wi$Vy5sW4G z@p!Vq@ZNzd)HS2sQu7}G-~uzwS)|SsDdg|pp06pY89DM37_}78SNSmmutt$1N-d$= zK}MNINh>a6n;u5maFE47>w+}&>XJJ(IrfbapyFLW40l(kUGdzbI*Y(AU$}3SH14mx z$!*E{C?>MXeEyua-pI#F-#2Id?jfG>j^5!Ytz?hUcT}^AjU#*Sdx@w!g9zIt&{E5q z8N<>Odq04BjBKn-I2#hve#*5X*af{Qr&*x6|B;s@Ug8j^RIVMHPEVcWh!jSiid$A| zK=L4^EJwHRxo!jlHNmBdGYJ!{Kz_A+%~n{gLH+hE;`BlOhsAfe+^Mt!z9tIo*70TCx9i*LV4$&|a(h{z?0r*qfR^Nd;t_3n8j!R~I&HcYNFkR??d1rWn!L<~%xW%g<$ zPiK)}TJ3;kl$=f>FNX^GLS9PbxDjIfQQrGM{x>jB#r&A)KizhGjZbvu&n@=7`jnw3 zSc_kn+R5Y5X1qW%qF00pj5QlGO1^1dE-lm0!!b1 zy6t8;kP;+SgWWp0j`Qo9uzCW6tX)jvD0!-+nPkA10zLe<^pYwj} zeuFJ*7hL^IUbC2a{+F`@-s-IM17k+cz}9Dj3!Q_G!&@(wHcj7q-4*{uGw}#+$i9x^ zw52K5$dc!mW}+x*yny^c^FxH3tHy63?g=m!iWc0#5!9>9E11Hn@$i%6cIGvHX=}xG z{4IIzWqUOxjp(W})w=o5mJMaO&og%*x$Zdoj~4|D9Ut2WV?FGS72hOAb>kBnvW`I) zgk0UWoezhA|1nXw;!`O$ugKuvM##L5ExgwT8XF-!^#U-y(g=^RWVmcmU_oqlDJc1V zFq?|un_-xO#?tmqC>(;NECxaQ@IxOGL!>CsnTU)sZlT5V2F=)24Ew5NjW*c;-+;d#Gaa`%*9{5adS^thX zi%Li4R&!seZg$8ZBpPCEt=7~sbk{kU&&MccXz|ipO8tw4d9OGeUbW}ZX2s+D+wYf) z0v-C}C0@Q^ge*|dPN)SA%PKt93D!COd9HbI(+Mgao#McZ4qq!g@b+78q`ewZU|xev zwQ?IUKd3A&eQwkA*t#5MG}W<}PQy*7;OrNbpj{Es6Y&Q3_tsnUOo(xDicvQLp7pf@2%E(}L3qec zrY@H1L$Ns#r=sBKi?BrrazzO0fTxqkM65W(tvs0zD~-}D9YjC09H_phgs*4Tw%;C9 zSqrS9n+;HV8B5h`^@!FwVBFt|QF91^y`NA0Mecnm^mVUqBTy~w=Sj>(pSH3sbjw~f z1~=5c7@f2C&zR8w#!v9wWj2ptF9D7|wGujSp)LHlnWr&lLFOP{ou*+Xy}8 z9%|Th(ftORwHovMcw3yE_?Llrs6+NPlTlwI4%eP^k-SIFF!A%i3);&pk4pM0jE`&L zllJtDk-j?NqoF$QSusWK-Ogb1*H(nlU z{djtTyN_e!PiqA$<=bX-{H%*4$!x*ZO*9|)AZ?6&V46vb$PfQf{Vwa3_&JnL#2SX${PNV(qpZe;SfOfD(y@NSJev2lDq%F;uL@q+$WXJ^sf5Q$c8gY+*X z08Ly1{^=)bo8VvUcHLbpJZ5v?#T>he=G7KPE%Yf~+d{C(sgPeb&@rOCdf3-Ta1S?F zq6>)pg)Yrr#o~vzl(#MnR7Drb? zBen@llf;fI{Jyu;dQHoYg3Q#%{d-nyG8=v2d3w`Nhd*31sw+=Dj77?QoJ=EO8vDvr zI#!VC&ZQd364Ly}@gyPs$(jRTGGi!} zPn1?%VY&b!*}32>x3`KT(Ra3S0X!IkP{7ac-1;B`BjuVgdzXT`CvfXl_Y_qG#l_1> zd-CN-?=rPs3w@BIEimVUQ?uJWPF4uSa68-r?6dCZMs;+}(EvqzqQTv`O_VM$XP^V4 zp0{-4tP#&Y)qgIU(C!vgAoI>bKEBW&;UOXF-7boX?`$xfCyXTEma~)GXaIe9g8b3T z_gvenOHf9P5*W_QT%H_whh2rk5;k#F>0*#%T!Ps>6V+cze86gaOdefE*LXAXeR}ri z5AiDa)uEC9ea@E;mQzU#PLx5Y9MPU;!vtP!wmD2qwrUS5a9)d(P(5XL4mHZQYA$q7z7{rmHdHtgT%4NSb1S zP8X)`$SI`l>SpcVbJX{!iFvC5Haym4cuJ*0E7dZS*Rc=N+deR@9p#%>Higey)^Elg zkNYy8oV6l@bZt?vdyzZ0i;3zw{=yd~Ek)|2%sr|W=b(U8l+q<3d^S>E>LN2GABxOV ziz!u6r5O(mGh)_kry8fq6r+k-0R<-qOom$lNW3UsnxQN;4a>EjxlS|IZ7dpaNS#*2 zsH`v}O&y%TC%FN52MJqX>%ayW1#m04W}OjM4ldu8bisb zeg@QZDAB`Ry(;z+#uZA8ByRyegcMdveA75-{}gJIT@KYV3e_95&*N1}N3$Zvk0*ng zA%C$HPYpi|KU8}KYDU&UV`5f@&bpEwk*eM9XQ?z86?%S~S;`bwR^4J4pULdfCf^mJ4A`m|n{w2@t$nbHJa`}Ky}(-8wCpCqqJ zh9(ASeg3j>C~2krqIm6sr0YxwC<`&Z0EtNKpiVLLH~Ly5ui{pvEySZTEKBUF?tX2w z-soC|dNzyI?pBjBzqadESQUR`F(1z>2PpRr?eB%5Z0TGIZWGj>se*TUyE=1dYw(-cq#K&bz}FmZ|Qp)x~cjKal;DM?ET=J{0QyevlK)>yTA+bTjQJ0#J{1X~tb z$kLd=WEMKUr^e`#W|9?~UnEIS6_@c^-GIGYN(Zk+>cO600iTUmJ_`-1kIUtXM) z&!)fnJ*Zg{F*V%oZ1GKbBQXD;G%*A8mOT_FrUL5m0M4d=EEn1f3@5DErL>gUrpAIH zgH~~^_*%fLPYE)%?)E;bVXr;v-_|p_gZt_Zf{*``C9ZgwQdNC%7(AA0ojVvor&abN za@rs;#l~Ci+EXXXS3%l5fnY$V&P#dp+O0vc5 zQr5qiFcUxAjV&q*1(#2q38I{)Q^f0x_I$U2`Gq=gtHP|M&KE6*xa3g2ZJ%r#T8JTl zNEqPTQ3f!!efyB-rvLRi{B{zz;eYXK@X=qyiWO6>k6c9lOSy2!es*^m^jehXu zeMP3}Un2gs0?4ul2kT`#Y`%Y9qF2ZTF(vBdPZs(SZI*9u{Lj%AOpx^3h-f%cSHT0R zk%fCb8Lp7J#X^qx0$4VWK?E;+0m4f6z)0;w)s|8EU?fJah;CvHW9r9;LSD|XF>9m` z+pJp~pw-klw!6srd6{?PnndoU3(*Y^bzSEeLCM&aeIpKli_T;Fc#w3}$JOWhYp!-p zMV`PS=i5a($Q^YsW?M-T4$#Wrxn2MjI6Xy{S=8_2ro}P&aW3S#Zr=D zmKMncNoCs$RxH+@bMAh=e_6kdtXoVXxXqvqXU3Y_=pZ_`3~JkSP6#Yj$nt!=kX?Uj zX{F7}$-gibX9upDLHJv$G&$W($`aRgxy7b@{ZcciM0d5qI|Wj}plqQ<_Q1;j?oq9U z_n3b4wjb{sk4Q4LH#>D)u};(VjbKJgTqJXTzM0baN-)+nqfpC7mJCKJm$K6b%t_yj z6@E3gbDN!gw8ZmIIJyadsy9h!Wqi44ANp-Ji$DTS~X1PSVG0m%+ ze`HmJ(S>S=>^Z?&Ew~HyH^TCY#Mza)yKi3CS9mhpSu0pxf!RjoYV5cJ=Wu|V9YxN8)MH^Lr^~d&+bKV9lr|@;nY#e%1R|%qL>?-K~VfI{) zVOM$UMDhKbGyX5k&Vjzx3S~pvh#=IrscB-p^MAwaI8ioArvsWMUB~=3jNPs1dh+@3 z3oeMJP+Z)Q4cVX^Loycp2B#2PV}tta!|No#paEHyCMki^~|}lU^aGJYfRlL1S8b z1C`*M%^;-aR5_F>6)qb<5DGcA6^aJgw4#Y>nFbQlFJtsIGfULq$3d&jyh-;SOC=>Q z-4?obCXek~`Ma(K=};L@vOAwGwMK=vOXX?Pi&D8y?^_k@W%i~~AtL*RPPapr9i299 zC5V83K(AdVc|*qU4|#s3--NpAmLs7&*bsFg~TIRP~Ly-gEL-LZ}D9 zd^LDYVi6Rm&o!dk$O71BL*{AgVAd%s9>#aD46qRIK=XUP-oVTz1V%-7+)h3Toe?lF z*BlHAUTKSaFN+@GPwrM=uKI98<}g|uX?R>Ts_-0o9 zZ~WNS?y}RX#L#7w5n3gYb<46-9yFX3UX3&zjT)JW73~J-RkSd?sob zM!Thbx;{dTvvuecWq=gO z$GNk&eUlh53b}NN$ZgU*<95R~O{jBoFXLsw;YNJ${Bc_YJMkYK@S;>~!mXi2 zxsm0;TVhXpj0VvvtkKK8B7)-_&}W6^tr{0prnR2u*Sn`KXxrkj3Z3e*YnU>cJyd($ zA3siaf_Gfw$HvqUwi2VpQB3oOmm1k2?)PgR4DwF;@SbD@XXiyAae;asiz*A7lsS*} z7%LA=-6$r^=B?Ip)@oP`;>;U0y1K5rJy{M0E&NlY(<+NkT1jC~!?MMlSaG4d8_~Bw z=XcKBePtC!_wp*S8B|7x0NQB4{RD@tB3~@|vX1I$-(Wuq-d4GDVza!TZ0FNU=flIu zKY|Zp&Dke(Y@|Uzt70e;c#T6H4W?bZFaGsO-mffG`M5a;0H*Bi*W zE{JPO7|V_*ffHT?H#`r%Zvo=i9LQ-^yhNUFhN7tQ%?`{)xAWh56I6MHe^x-IoM6m1 zetFs6&&B`l{ok*cZVTk}3c!8<-!H%0_#z<6ZGN4TaU^@)t@O0p465 zT^=u$q>Q-;?cXqEwG5gp+l zd)A3iNCi~lAKxro%13~-?n9_~jp-Y-Jl^-iB#G<37)KesqE1oWV1mDNgfm!h=ME#H#~hL!;~xh7eM`Lrp;xVn2WIJ=59ght0cm%a)i^E zV=chvTu#JXGZZy%JupGT02LKCUg<8FP6sDl1?;#(?mXDwOO;w(c!Gt*necrFvQrpw zCW_tw*uY+G1%i5VzFX8uZp8MUCc+c9^6dI1g)Dh{s$qN_z1JHyJ>@czZ)79hVR!8cWrQ^zk1j-t zebd?&^2S%()zj7F0@1gFo2ldd&Q9%RoiS{d`_B9Gwt-&iryd?3ip;c3u*JR^ zBqI%%V??-|?T_>H+vPO&A*=9tyxEA`!gdYKwlnSNao3dt%p5=}C6?$UXw$^de7let z&UnZ?vnS@39j1~R^ZAb!2?+tcsIX^YQi{FL=&az!=xSwlHqCitGxIE_l5MId0VMk;O3PC1D_(k z0!;DEQv$uD*e3(iGifH3Z(cW>`eY?Rh3x!O0z?nmG41n~k35(?@s&WIdugE*@rpEM z_ z&U^0Wxq2n>a#+TXmxe-tB!r_i+WPpq z)|x*TDd)L$x6C+lq<-%@qhLGftoZCVvzLotEfr|t{{V1WlY2`~SEdeNMIb~H$FSmT z0?muei}*x=sCLTLSTZNUSvtdQqoLsD7xTnTZl~<~;2<01{}xHC*J;ARka)}OAj-lD z$^JeB7eo>lAtwKwk=q;>`1za#cNCWD$=kw|lm@F;Ag6_&1n^+@DwWUUodn`fNd!I& z$e0rx5{Tl3hrs54o=>7MFQmFp1!XNtNas(*ZYH(Uj-gQCO|hC*qs(bYeGV4M7+}!R z0EEPsQ2;*ccKm$qH|+D^$JHZv4>b}aRHh#a4d_&P`uV5YuS7N`{o;0{pABL<&JR9b z%IpAr<{z^!G|xNcc~@7qmwhjHZ)^TS(|I$>2@2-e5I~@Exw0zQmA=u8Mz7=et*H>_n4;}1-UtQRHesM_G8%X~`3)`sZ zk(*|w-X%9J*H*?u(JGRDcYXHPxdfpcaM*E^Ldj8i?Z8R3a4?g;Q(_{kIE!wdiyn$u z;^EM^(g&lu!1ogjp#qJ2@sg|%`(-ECq()jhOIG?lQBEK_oZt0De#cS;gq{gsK^tL6 zMPdAFX z$Se4J_}{-LcXM%h`rk)>+9w?Nv97T))`W-3(>&XoCXt+jxba)uJi^pSr+#yC#z{SS zQ!s}P2I@7W&q<9cCo&6KM-f*J02juCQh{JXV{47aq&Fa~FB!5Zoi6=c8_K#LK|FsVW&VO;$kequ!F(xSe1 z96po{x8XFN#|u)31xxHH`GHRbA*MDKT;l{Y;Ui zjAO5RCwOQ}{2n`TImi0AE3^B$d7CO*evLC{$n$NT2V5Uq6acu?F+i<|`ymi>){Fft z=mP;i^KQ^O_~(OYc=as_>$?KGv1TUh?USFPD*q<)USofj9eQJ*I_tg^cOVJx-MGAlPq>qiV;KPcab@xF$Cq4*Dqn)Gq(ja{wGQ zOI2+gOQ!Npj+w|zf1Q}agt8N;tofNsBo#g|SCGvgS}CkUb1$%XTT{CsUV|}DR6{yT zS&VPw^N>FqaI(avAZ(5d5P)K zC?AN>qntT*f$`rMKvqu`>2apNQYuQHFpbgE*1S4rnFeDP{@D&wfg|a{VCG0^!tr6J zu#WZpRz2fkUVN`HDe z_?YPD6=J&kRB*|f~A#wtxATZI4 zgX-Eth8NIVnBJaBdKk{tw*)X8p&<9nm5uS4J~qKSvb`%ETx7& z?_!7Ww7W(~7yFo?gN-`0c{wV)n7`3+b?AN^OoN_TU+&w2vTdUqDdj#l=K7ZY} zT_=cojr(hrQA4PTO^10uQzxoP1$SYKc|anFbPmX)a>(LQ;wgq1x)&t)1GaCq4%Y75 z`bguG6?~B`o5%QPOIw)ij2QTR9liTM!TsuE(}FTLOeHFz_07m!iIjg{3oZJ-9U#j7 z_uE{qbdDgYWI(qZ z%lphrz{ihBZ2b%pDuAkOO|n&Zv`cE(7AsmTfR{w{2u5{ITW~$se8R?26VqxKYxE1 z*`ok_84M8K0LSD?$kLY04eap&MNGRvZIM(Oqp(rL+^E>+L99&YWz=uqktI|JSZ``) zhK_>z{K0_3heaReJq{B_o8Ve*S*)4Ie1~+a>CuY}X%{vEhRA{gtbc64zWGZA)M5VW zolQJQpZ3P#uPMc}5f=U9y9^-Aua@=i#pPt1r2j+Mj9`Y8Lr%XuokxJx3A@iY7m3l; z#&DrJo^F{$YZLEo74`Ysf&|TcX=AC}#dIT2Ws94F87Z^6JD zp?>mD$-nv?{^{1w(9MYuixLyZ`d3QNhA--vpT5ehp=@wwN#}g&X<_#B)KH@4v3Jai zaeJBe>W7l^MEd5;zDuXc7%g2(sIBpY%JroCh3c37lur5GijIBBsQOAz34EcXZkK*b zIw7M{8CWM545`96W3g?n1Qr4MA81XWa5U&)AK2|Oauwm10@y3o?CI<71_q7Y0RuaK z>BWD+u!GIbV+|MZpPJ~T_k8@B$68v~nP`n(KryWwlbkVet=U~_6k1kg6y*Z%pws_SHj%}#}vaxCKJ;I^PhMlCe?fHux-%mbON-|ui^fPkgSUW)` z=MB%4(*j4nznt3WusVD#yq_t60h*U3h`<0s&Sv^wpHs%!n6b>KZ8>x4z!96=&^|Ce zGoSJPaNn&5v0W1I2?~q%C5DBz4m?L_Sw4wbLcp4cycR#vO7!$;O6D+{jHPNxxoYCh z$Y{sK$|ZByKh*SV4JUn!a2gDJ28f?7OpF@?{hoM&U&nDo`Xxb0h5x7!wyo);0Pra zim32Gu(}GMZBs{+CZC*r_2z&q!5b7`)Q|>C5|Bt83`Tkjlt7a5aF8PBO~D%dYK$&f zCsMpo$XUV(i?kLF-8E2^lwmXb6q|La^kgBW`pI*(g$$WFa81PfP>BxzbOX*Il5lm) zqsS7X-ZXbNvLzP(JQWJfR8&J?I|?$2TviwJ(juc3S{d6YFcVmBcxw1CWBvP;Oij1K$Qa)Njnco^q9>QK#i2$D;QVvKod>_G1$gS6~eiUG|nTQCjXDaKu{6nv`qg`O)HrJ~^%6 zR9x<$@#mhSl-q7VWbE>08wZV&6x}+E&69U%UH<()b33rACe_}q_bf!MxzZZLk|6eMl#BKXFYSbFhH|szhr09-0$aOuXUpn}P?Tk>QTOspsVaxA zf!{`=QL@-;cs*;kP{!ocsIH{&~q!i;am|2)sRdy{k=N$ zspYK~SRT|+I}>7mQ~w_r%p!m4sIPu(Ew&|GP2+2smX&!UT7-3KBAu%nuINN`;@6e! z=Si2(UuFFGFWbfx3aOr@I&7VzGNFy{KljYL-Q-yt)b&(dTmxet!IWN8EcIG&e`oz2 zEP#dP`lwCi&8R&0Har|jf_XAZMU@Jh_YP_EWQqT^KV|-rx809ayt((Z^^nQ5al2*E zBST3u%*w8Go+vKzlvQS`6J0K!X%`7mo~`Qu?X#5fC~YWG9ATm;>t*-YWW8fN^X^;v z@~IPnZduJ_Pz3iYb{BG2rmOKe<@vqSrI0pguI_(I=w4vN;_$6WJYB^A%>fwj{A_O+ z8T(OAxo1wSSmUSBe@|I`mz{Xe=GtxpZVoQu0Ehcw*~BD>;cwQ- zHJK{E)bb&Dn{Iu8t^H!0p;6=6r}*}%_0Y)izd)jq@cpt!B}xdwTuDpMqhi4?%hjBn zF;l%ijXXX~of=cKLR?2|#k-?`6u75ZkEOU-cQgQpcd?ufeHvI;4)X*=WuGwv!j_S+46 z1D{UUj5w`$F+p5oREN#yw9tKZ`o&m7_29-+YgR1idj={aGMYZj&tK1Z3Dkj@Kf>tq zM!=`^sA^-{>;&R1Wz};sgERi0kP(f;$kNxs*l#n`AqQ@ZMqyN4u_oq+k-2rSuC&sH zWMkbRgMJF;2u@7O;&+6AaECJ@MPGsd(a zs64PT9VZDKDhAw0Gfb*6TvR977Psu^{wDu=bL|pH2T0lXXZv#oV`uG!6Y-u*;-nJ9 zi;)fL7z=SnZj^_#Opo-`0~R+~iuy_&D$&$}-Os z3xW6h&#iyK!Pjxooxi#p!Oq?sL=OGelLjDf$Hxq%{lm+DPN^WkpTC`#hwH-+h<zWX3o|>KX@aP9ghu;Jn+;FKy@8A6o7gnt zYlqq5!uOHTnDLRSnjaSX8L-0h^|krk*9Wk22D}iO27Vdnd=WWVl=8A=NU4MhRW2l> zD}S~$M9D@_0c)1vG6&|N49OjgC!ry&XPBGtO}p@!CMLN3D;CI?+%Uz&DF?j}-5Kb_ z)>*D?prm_{cSJc!ZYDcmhtYbcD=^a3b0{9}4m`I%!di24petZG`Bo<$EJkD<4>C3d z&t-qH1(RH!5xNZ{z%0Z-jkzsT|7|zFsYY-_h;{LM!;TXzRQaPtH%kjeeL@|v5;M&H zzSp1mm+N+v>UKjfBg0cbd498&{Xh^J!<2OudP4xcOWVR{M~DZHTzE-j-F}yo&hg`~ zQcr~c1$;n*zmPFbqC&n*1GmIn+O|I~H9xM2z!HDL0fuyLISDD9wv5Vx#}jUJY=q`~ zerq?k#-(B+2i0s>kFaetqMgyGxhaYk#pKQYQ%9E8*Wbv04^ozq z|K5u!KYF)z>CceTlac*QM=K>i>HV^r)MwhbADORYNEed$%=a1`jQM0~p)UukT;zk) zn_!MS9@ElWv^+vq^*p4QPpU=792{}biVrHp#!EtYh3H7FSDj3&C2+*?Ys^e67_olb z_*4)R*n5P5rhyZb7En7#XSthLao8H9>ORZV>* z^;-~O`qe!QQyEV6BldSu+?Gyf3N3 zse-bi0>^-T;_4fFJ6&XrWth5qRNmaCO?vU^*t2~udUs0*^2x+jHDad;O~2iR<24YiO!C==;>rtXa;f>_d~9##&HIsA=w1C0Zwve7#e% zx?a>w+5PK9A6qr^AZ2y^p9}z7>j>Ip|MhyWVE?tVzw!Tkkg}BiZ+`XvKV84#FB3`l z@zs8^llN-*C0n>BHD7)(7gO@duh*jDvmq^M@s&YlX?rgl%EsDjW9?Ox@a2mB8z{9N z+tw?yb3Q4p(j!}XDFWQsc|DGgN@1+3 zU6MebxNfPn5~G@RyH6Fy{VcDQH5Y1KedYFC3zo7ql)8F|2Jxp0f|8t?H{63UG7BxK?O;CzcwK^!RvzkuGYU_R!L*)a! zkaoxdv0@mQ5=f;gqC~n(>f7R1GgPtLo2M*QbTqVK$x1cWMdhuPDpuU=Ve^RElw!5g zk*yZ;+LE=grVuklEVAkqJwnz*E<}a)ET*%U)gzQNk)My6!Cq9MP)nSxX5fC+ z3-vvFN{WW%*k>Pk*hfkJIV2DhC!$Ukr17jf^NPe4Gvt~KN0}hpw`kraqpo>Zcdk_= zh;)GrB`z=@q6Ax&g&T(&YjcFuIa6jIyJ^5-vCe6>Q}_Dnr&Q9<=V!z3d)o)ep&q zX!8ytdFA5Ltf5sK8CH^Z;S?%w@g8;(n^|3ME6K9EUojPz_Gf*& zn?2AA?sR#m4WQP%-`TB2%Wrw5vh7z)E|q<1Aejo1h;qx^riZ$EkE1_cS^rCsj~fy} zG}!;`@9pICzwPgA@;^RIah6d4Uy3=uANOBHPESVnE77S|`^wj=X?#@+_oM7B3}!pE ztop2-Mz+%6E(7Ei&6yj?x;a2HWq?_qxHI)lM-s!eYv&au_R0W(w$& zR5_^=PbH5uf|%-k>yefk8GUfxql~pSE~NU{ubyW0jXh`eLw`6y-YrXRVdQvA{3XO^ z%#0{g{G8dq)tUs)HO~P4?_1D+^`iAml(HQw(0?gBOW9?gJZ4kR9$(KF;JIF?v#?Xa zdx-{g9?&Jvjy$&Y><1oIHE*w2LEa6E@v-Hnuf41+|J%o1g%+Se{(rTB?1;_fd7kA%Z zv&j{$_1D{4KWVKE%U8wesXWJ}V^h|JV$S2-G=RuD>`gDrl^oX-oyVFJ!-+_&!?6a1 zLyJRk=WrTiyd6_vuR@=avK5v3l=5~N7^4tT$dTV`?`EmfzBje6s_DLIWPHeBc@x!k z4=wom^r%uPqTNJ0mJyhmsfXckTo4yh8g`S3u9S;(Qv8y9((TyWgvv~g`P$Xq+^5RE zbn+<*8kgjB-nHwd+_3d?vuGZ6(d0yp0(8*LcF$Cm32?3cS&C%Q!$?XXBX^NSnO!@1 zo#nEb+0zwQEsnRF!Yn1L+=8QpP=3?gb2)HjQ485`%00sWpKiIS4ww5GlhQ1G;b-RKs65`g| zZ$x#y3kWP==(|D+OGzW0ee0PSz`{s84Y{U0|L;yvFva7LP_$qh4gCMk>)m|*-@d56 z;r}0?Y=H~N#ZJWpZL8@O$4&@_F%EpOi$~DAg=55AXA4|UFas=(B0@O>Y=VM7+Pr`% z5jYL*Ll~AsQE}u{p{-HD|9atq^DvkL63QU>GEmhy!;<$3;YBrCNTpiN5{-@BT9Zp9(P>qBiK{*DEZxS zXUro$>U~98iT3ON^7!EB{jods7jC0|{qOg8_g>}J|IV8?oAv)7WedE+JcLthR>LVC zQo*$xiph7J1MtfaD41p+|Mq;sdBg_2o;VX+HtG4qV?9nH?6F>;s(#euvnA@hkoxa2 zC2=IS6h%@XAY<%-A>wyPY&aSb^_}ZDTU+4z^uLZS9p~oeMsU`Sk0KQMDD*JW+`Bki z2O6F{=d~(z0Q&AH_mi=@Aq;au=L296*Nx~lU5`wA`nPCIw&;sLH#N+XM7&%kKp7Fohu;BkDTNyUdJc8jzd*FF(dZ z1fz(h&~Eh;*GIFSq8cAX0hvz)e<=7>1z!G1MnDqhp@NS?-~}<`h-&J&ph!yK40FUB zrwc@TG(;RR(0BX)`lr)X0QTHncjuq#8zCAZ0Yi);0wWRxm;tPq7 zjQEY{-X-EO4FLq=2@o&!sLqw#h)c)oGq|zslD|7Y?`Q=DGy1yDyMxP)`1k*HUfjrW zsm5jksh`D0Jb8F*BH|}QQy80w_y(Dt_#JXwid=$?N2U=8QOFaVQWeWhj%F&c(L+-h zn+L~+lZXUlJpU2RZ)|L==XGt*b07 zrL}{)0RMLHjN7`({UB;D1tjUrjiWJzK1y9F)b*m+`%XBx!$AO0$YSX*QtA&g#xoQu zz4{%JPZUVOQ9`93aly$5+@u$pio|aWE2%CDv2Kk|D7gbL1QJ217m?2yCy`o)3S$7J zlEF=dm3#wvlN9s9GDt}t^c3J> zQk*MDkz*Dn3D~EzmLE-rwA81BMXz<-~mU+w(11 zhZ4eHBo@(((^$qebU{f6qBsbY!vwo2?Z6T7ZV^>92rkhWGfw9~`&gX8DPrKck0OdZ z$dNw~2NcLQK~d-~{^fYtKdH<4db zPd1h)f!X>yS++wc*<>+o$73AX54YQ_tt_URd5pvTt6?b8l39>iupUD17KMI^a_=+v zUfW^;Xcnd>d7!@nC=?4*-6Dx&pQvSgaB-4w%8O0AS+z_FE5=HWkWTXKf=Fw)A*3C> z8H*-=F{qhsQM4Trjy;sUh*26a7n9yFAmiTdPXAxMoj1Myw>=o)uJtwR;;`HA_V;_% zwmuIz{FGdHc!+_rK{fKl1>}?Kd4z7P4qi|ka%S9Iw15%mipEAQu}47u8rD*Y$nnHW z-Jt4;J`5mZ;$*+68dRLCxYoh_iwvrVD1Wc+HZReCV#IjLR}}^|kpsk6U411AU>Fjv z{gA{uxjwxD439%y509`Xk7;>lh`6~>H0#y=JX!wM!wR;{Xcp6o755YOKB$rxIE6zL z+?TXa)$|fq8tXl^nl38>IV#30%+G49tm_C<0jLia8iRVZkH$b+Y^gaC+lBfCIFXDq z3Birh+q*16p36{xJWgo#Ds3 z6iM7_)u`<-kpD)|Lz(-AgCHPx+W%7-?I!hf%uAv=?V}n(S!@h!RID+m>N|kG!HAO0wh3_rE>g zG60zlAyT3)TL(23hVd573!6+bjM`V^7A zuCd06_ZkHB-lE}QRt!ajnk@7as_jdzWwd_mQ}an8b(sk zb);hKHt>F}dA=vi-PKcBYsz`TjF(M^JPMKsfuWD6B1Q3wCH~&hGgoYe5Qph)QRW^w zt{_F_-JLVD3u z`+?(T?b7|;F0GBwTSyD{NOEffZPQ+f+psdmd>7-u2Pm9jO2Vn~2Buj0RY=BNnNUE* zIxJ{DrbxCdfWRV$e6brj2joP(E=7H+oN<_m3kD5Oq5>i;ObZQ+i|L(yDjVsVhuJIH zd^d8g?}}CB>0U6RWSS_GZU7nnjy$d>1aqc>=|etQs2jJLXe{clMVPPBZv2Smq7$c> z*&ZPbj4)-~>Vm*nx*$OvQNY(-B~;hda-w9KB|9E~kc3@R+wMk@xxPj7eztRxr7r89 z-nD*80~svg67cxuZBO`Yf9SG=tHk4T4v*db6Dsz`(hy(7zN~H$G3P#sF2k3#ige|M ztHjm0(WlwAzA6^-eG>m7E7zZdz=KTc;O40{^ND!J>N31V`M*HfQI?Y25q`2n?F;fI?@?9;ehJ11p+pKf`L`Gm@+}KG|^0=0xdFs z>j@Qh({8AqWNDheT)ZfzuS%uMvrSG_7P)eU-U}#4?{dNFm!H-mcc$^|rmL0AhxK#zIR?=EhJB(>?7+P4kxt zi^URWf(7SKriEVD?3K=+3~}|yvnOzPLUUJ^J@#hdxwG;IuVn&@b7v*IeB24Na@Rb_ zEH=zvE+NE{YtKsmvC{k%=S>B3f7~gvLP1 zR#J;JDiT@S<*|*5Rjm;TVUX9EZbk6Ica@ z!?6vf@AmiIe%D7s48v}Jr%U(u94Cr{K)G%=0hNP2nggi7UnCzUDIlam``JNo2j}b= zz@rooF=o%CQxSi*t&%w~#AWr9(HY?v6fqR?X9^!}Se7CLDTQ+f0L+mJ&RdVEi7gw< z0W(O43J4&h6n*2=^*l|0o$-Hi9mhw**c$Gk%9K$U8r2u$?JTz|xw{4URvH`%>PDY9 zg#d>mLZ`~JLIpZw_9Uqs8iKYDLS+^hdPoBsqJguOkflv=TbW2^S$f$L<6klRTfmxr zV9$iJ1yt8HMmm_-7O?J%)0L(3qco0_Nh+f11M9ZgwFg0rqvPm1ae3X{M4R7F2vc#0 zQv^Bqi3IT!WiQUR!O6(bUZ>mH26i)NGX7epqXTsLmvHVNnpoxHvat6vZv6D z|7S4Ve}zKNWTuw^!tGA`QIPi7bzL2O8-=rhV>n3@C-dUq>gwn7%OfXcGH2%Eci`B( zry5F`hi#O7Q!`w)C2kTwy~^sdGF{;}I-t5;ZqdB9#ak<2d)o%h1$2_{@5>iCe$JL1 z&0h{{ZbfAmf75CL86~`4U}xvo$5$@@#518rSIC>Pv-7Z-Q+E1Ge1LzX)J0qb$?``K#SL}JNMTcKHVuOPW?Y{zD|AkXF1pTFkpl=UB ze?3FczlR~{=ZC-q^!;E0#Asto0{ZTbyW=>&oQL3y%+Pd*DCqBPgWa9oooyX+Y1cUH zf;%XEOs7&n8sQML3G!3_?lI<*cqjuO3*yxQk+&F!JZ4=o>hcNd>Oki&wgI1D2Bz?L zLhZOt%Jqtg4r>-B^?RMbaEzEZ9|No+3XAt?yk5P^q=>+Y*cJ$lNaC!K2Fe{F$YUx% z`MwIGtGc?Ucqj=)tVGT9O0%A%Dcu8rIYYrnh*gj#4q0Z%j?YhB$9ehkXKC}O5x+we z0j#4cBb^K-KM4Q7moFWs3oeZPxqi&laA0QlS9;`SS&|#@+&G1aVHnQAknoB6XjgV` z&y2kVNX)DXK`pzVg}GaVsX`nB5(e`ZF8JjKL{WVNZxgv&kN}LZ?vyendm-gs4~BxK zd@v<)lu~I|DT2i4-q_*Il+~Wo1s}vHC_YHXNxmuIG~07CXpP{1dRw}7S0dNdRNjD% zXz)5qOv>>fQu43iwqMGDmFN9SnFs((AOl0ey%VafQ-f#%hlpcOE-1<3PRNvuQHaFM z-@$oC)oNm2TLG#Ci5&_;^%2!x+%h6m8VX7-5}c5cBCZpyYS5gsiR_fCtBmw4R|x4x zq6opn+t%x5Tf$T3x8XAmMq=ZF;T&MbV#L}vsd#j~iZq=v4~39ol7v7_;s-#M{n{sp ziRR6QWmY2$=VBgHG}2xuJNfKdv%99&j6j>!;hh}}eUeZ#Ley+izmU-gOQoZ%<`XX# zl8v0T`n5CL{W#nEIK^W%#l5ZMXE$c3>p_Ot3%yG8t8lC)&-8&4FxwNv@`0gI9Do3a zw@lH3X<4+G30}`*PAG-}>ruo=FhgB|+^+n0uNx7@yD1`So_iL&Ha#h+F2jPT8mKG! zAlvKCcDtPDpL;!dnw??~g+h`%B+*=D$Nk?PiRS+$POm+)S{z5$^FbW?I=AaV1ic9| z5VnDdfw=4Lfajt@N5AU4_%BD$%M{Kf>BZ9K2s5>!(I*c@a>aXO8UOcF(wuI(7JyuF31U13z24p3oeL$FE}`RIplY$+>B-^o+0}7(R~*|P!T>Rr z9+1PiIvYI|Rvz8~v3rauQoA}1!5zh1rcPmG#P1+Qj*l6qco_4{02!<>19kA za0O1TI^f;G)ydVi^Yh8|59c4Q!OsVmmj`FpC&yRd{1P0VpBs;wzGN$oFdoNY7*aHC!$1xluFeWpkE(sz;rdPzrPL(rQf7EeM3kfId*4hKlmo*ufb zEoDfOeF=Ol_gP5i+W^b^={VX36R57jw6iVP1Gi|-2Ec>c9-@5v7R?37LR0b~03IBG zjt5=nQRkdszP5l3>{hi$T|7L%~|36H* zp1|-{YS~l@8L4R#vbtdG2jB-ho^&HbrA9UM&^8G0c*5_H)Zj2gXNW4bMjUcHRcZh) zAhB`?L;e^!&c8`alL&2C1wQjZ$+6)&j=q)=lfsSKQlPR8?hv5JBhx7geXV&EaQ_oy z?^af41E=J2LlU!9$#K3Tw5YZwq3A+rdcF;2m|>nm6kuFT{&E{yi}n9eCpvU_w45l= z#Q*Q?OkAQ6@lT z8dk+igEyMY9wtF5WIC#(#U^*t8oul3h5i!hr!$SQ)}Uw z42Ob}JrxpMGf$U9u|JP69;;NI|MCW2CCp#7jVAv8^{akC z|F^rlIsYG`Y=H~NIie~|k(zI1l`xEPAdM1qUT@|)TgqY0WETKzf`R~y12P0M{QEt9DJr^74YW6B(NjCoJ~tI&7c;UBao|1}RLzUO;CX2$OWz#7G=<{ zjQr#^pQp6OAPQiJ0Gl(8ra)(!k#3yOW|#G?Kx)XZ4f52=&}sasO4P6H+Kv#1GIpPZ zgw{wfg~1F%(D5cX@Rb=D>kJ&{rFwUm=xzloc1Xez9>?mUz((uv@`#yF&NbU*{=ULK z@*o8`{9WESB+q5;9`o0QV6&zuR8ANd6iJf~hB;yanUW!pJDf~=`}~pwsQV5I?ohi2 zXxJX=U2x$0^1{Q_8X-)iU==EZZHgiy_1HHz zH_D#JJe79E;zN*803}dlTbc%Yxlfg8W&+pQbu$B{mXb=-phv{ei5`8?R97#ryfQtU4hSDJ}(&04$v3cI}QGm2rv26Orh~uh7IhaXp zHJshBye(r?x^GeBGN6 z>AGTN<+6Tuqhtf`Z6(H}U5USFLt5g!aGlJ)kzLu&ySWkFx1|Yd>dmEQ(9|~k+Ax6O zEx1WGiW>mAwmf6o+OcwqV5qkrIgwJoVKySjz%=$Iz>8wJVNcOi`bRSrChQJ|+*Rx* zW+0+u2#3m!9ch0vdD{$pG(!Q2q}!Q%9Fou)4|B&hjFq{H^(M7}O*<#rp1NX7mNxBj zmc*1u41cjUuI$E>y<3#qk4HieMO^+!hgn}xc9UW2YTXB-Os7s8$Jm#qi3)kH56{Fo zMemi`BXL{Ml{8V-H;8FJz>OMGm#Sn{>?VO{Z1vPSG|Gn?YtpwZSTJ#ing+_0GO?N* zNz#{oP{tomfc$9R5+;2e=sS0XO>(;~ksN^Cot^iIGiUbrcI3%s86Hg(mFVVkXOxOQ zVU9f*%G=vmc_9pxFU9xr#@W;yIG@3VIoO(mGOR7o=4azjUwrdO86B%3$w(0TqTU#a zREKE&Y=SGO$N))*g=NO*CU1>$lZ;V<5r^Z3c(FN*jG~Ui@!}Y%00)UiH+^Galvu!2 z;`JGb*B~Hc<)x$cr`&OBcXG5=*r%4$F|pTktesWSjTgG+>nE zw=Ke{L50bv2F4>;j-H5;*xQy%Nt#%Kav&4gD?+h=(r8q9&V22$?I(!<}d@5O1X z8lx7oHi52fq*OXCZFoLJ0F6e-llml20i)m_GOEl?TNDd6S~mhk_0&Q!MNFO? zg6YxbRocfaP9dy{`|j(1RHL67j#W|PXK<0!0aL^&_L!zW$q2RINj`%cPU8|HtimWF zg&brBjF?AZgrwvIQ0PYlhg=%Fm5^2mq?>>3{A;HHqbUz6N5{Z74 z{nyhbj1sHSnp06S*(elD_R-lDVCvFp@$wnmWDQeqN--)JLl)PX(h>>2`AUhmiQRjP zZ9a>Uw6m<=@$(oRP;Zi_qr;02Ks?7B$v{~vU<9ZB{;PV7Y#ZFFwRVxncY@pYCdiKi z>4LpDeKsqW{gn&aBGcGfZ(VVItnAzvcjqkqq1at zOJekl>G(n=c%>N025pR#DS6#l`xzXEDu7m^6;vOkSBOJ#ytqI{5$Z^`x3itrP88~b zO_BV)aviqRjxh8ASuKlEAmTgNe^%2B@+w#DsL+GW+T+4d)8C;?%nPn9DKFWA8 zs-S_EAE(9FXGXEc)H)qoGm<((r4n{%QZd=)yGGVHpko3wTxPGq1O=(@$Xs@8)E@02 z$tlcewCcpMQc-NlF}mqj9JNJ^0x~{DGZd6k@F^LCK)hWJ5gQ{Mj!4y-%3>tl0!~7X z=nMw=4b?nX`dA$*G$KBG1{fDR=X2zaU2wBIy?No9n2R?%H{w4Xs&8AS{34-;=F;1_DMNP(KV1<25~+F@h`z^R%#AFo1;sF#TB*y%(zzOk zGTM+v+}1c!WK5VNM8Q-7lze+pvMIqxDmY3Lf9Ew>@)UTUSIzY*!M(^#sk#hlGo>^R z57-$ART$SCM(4Am$EXffA%^O6&3-5kBg zA-;`=DBa&nmuGSzQ5-pyn2wCf?=4(#sOC=E?rEfydb;ODajMAfNy|^BQf%mC!g5>e zlwYoN034DT$_7wX(WNxIRMHU{m$UrXEgNuIQ4Ey)PU&;1fwRgp=rcGODc_y#G%%*R z5>AdGMd#82l7TCuStuM%NA?v`=z}Y~^pvyx2mDin7vd%Ucz?wZ0-NWh{?0*CZ+ z9EV1+XdkpGJF_`yTSH2xD>B1pj#@De-@%OZX`i%K=%)!}6G2EbOr`24)T^MsBX`}h zHmVQL&xW*DK117_ohe4udw+_N-}VS71^dF@`pZx-dJ`EM?<9OL_rOyk1Ac#CV)b?P zb!|Y#Iwq)C;d;XWGZl9hat^(T+Q-XO>|(p8G0LdI>(B|vSlR$yK(19HpTT>nSe2%R zlAlO}-)bbp(-cb_f;hyVx-w$3wpM6^UvCC!kH(?0jiYeHy8#)uMfhhNYMhrr_zs6Y zxnr&HJRJP`YZG>=9WQ`*%1lb)EBuF4iyz1-L%uD4S;fvs2zFxRM^5#<-h?=$|+#qB?3W`T?pzbY7Z43vHvRM zF*Vk3D1ubVv%|Rza5$a9?9nea;RIrmyFj}$+Vqb0M5kC=6#o~N-Xw3K#nL=D* z8TA=li`T%H@4@qcjIjp;Fs3Aq1X{{^Qo8U;K-$-cglvK%Wj?8rNF<2KIN_hcP5vgh zxTjU?x1NTEE7^N1^;=&F|EN1squ*MIe>6TEC)$VOu}}IElqez>S3f2sQ_zN`Hs2~E z+KP(GO_+{f61}{EgVr29h{yX!bmx6 zW5lWnff+(*JN5aa#Iu@leM+JM_@#4jdfNHzrqr~lfVFnF)7FXyp7ef}7+=Zk>-MeA zCr)AFpJ#Yls6R0QgLH%hG6FY=1xbIvGVuG`$*bMmtKAI&ueTJhciWM`g^c+q4SsH9 zbcg8_cGK%cT81FZZ#3#6Cajgt_l zSe4sJvQg;!Qrc!5QOs_^^P879F91||Pf_R_zdZGw3%)b4^<@bCko8{<7~FlSoYqwP zFr4RcP=@x}dqu|FVQ_a_JFBL)>UM>Y^;K(Wd?0SOQs|{JgoV3(Y4gS4?(XiM7{3HO z11uKkF#%iR?#uZ2vN{1IbX!nE$*uKMysO@nB}(yvKR^2=SN&}-_&4Q=m*&|Q(!rrJ zzcGeCpMmgo^+qGA&win_PO5(Bd+`s7|?&(yx zu2}vz%18Q!AxOQ6{)F8~W(bLcU{jVTMa!x>ZKu?Q9EY6FWk{H7JBq_+@ZVSGX8=+P zWwu?*$jpkuAc-O(ews2s9GmK}Wtn&l>A|OCT1#(pTeEt6c76Hpi}RDS>r}z6ao$kF z^5rwQ`Q^`FJ1X?iubsiKoilQ!V{ZJ~+5WY2i{|n%4Db*Rp-dJeGxZ=3|JwPo-R|Q* zVv6KfaFMU>SnIlz7~Ub3TicUO{8mfc6TXslquSK zQL%7jhG+oiAXML_{MR82ut&h**@+5=;Oi&^K&z3N41e(0^Z%DBt)$%vf&riWaUmmP zDMwNn>`F4OVrx+qfHy(jEpx#Sdg@gs@*xh@b)B4in_xHra7M7Npm`(+Ff*ZOHs!v{ zXK?fF&bK?-xD*^Kc}ko$6BR!%4F;EsKRQZ+t0bn;CZxHLcSAq%o#qpYP$p`h%rBX> zsustc@V zu;p_IMhMD~TZF0vQHio_ULW9mr9tj8r8i6CoxYVr*J_Y`oub>Q>Yc+vXy0sDUxren z=}cH(AF|1iK?hThIN~TqDhh<{y3SGz zr|=dfA$7k$Kfih_W95PG&krsSe|Rgy)Tt48+jr0>c_bbkTwH#oJKS46y%y9gRRh#yC{XswdqjW|O1|(Zy@|(k2a^JRni7Wdm+|gi^#J zqI@QAa%vB?q-5Y2qx8T5N>^Aqv8AcF%en$|V(yNQW?ea6T{%#lB0)=J$`V4$xxC^i zQZ__#!gPKcrR2jcDauM7vouY8hjoHM4(S+ikcm$&&axDNVw!+3+Z2(}x)fZw<%|fu z6Z?v~9W&%AsfH1yYsLH-lbJuIVK-6R`N`37v03q1*Femm*?sN(>tC0Iezt*LnIyfmBgFr_m8 zlSh4)rb%b6*rS$gqapv>{?6`RKL2a~&FfA6r-vv`x7&4Kgnu%b`C)|7CyqiXYPz@I zs=WPu=N5P9nWs-juAy3qm4xj^& zg3;``1k}~-&H6BiCa^DIGjD>X(Bzm9M1F8_^3&c`=CL>x6DPlcl|V{89!ieI#ML$L z_&h?%_YoDlKF5fqFh$3b;dE?~GSk{KfsmFmR4Py<Oy zN=5=zG8D(QE5igK%B=JzGa1Jjd1M^QTucgf;_IuVo*YaZazsNIsKZ(@15-E$6iJig zIJDsD^BlZ4d9???%EfKSNU-m5i21xHMO-|LIiaj4bGY;v9(SP?)VK#D+?A+@O7}bU zw~|Z0XBk|%lr5BuWY0s)Cp9y05c5eos!UcFZE5pqlZeWg(j_F2fmlufk_2V&3K{<= z|EdyWkYxVKe$us}m2_QAy!Aq^)*9mbQ7~GV0jP1%9BDEdM&Pv-iLi&nF#%a^{<0>S)y2HWwAq9ZN!zt!0$rS@Qk=MZ?;qpdUCfM>_a1w$; zI7PuBWa!>$PmDC{ih*rMefEynIA6>oQJ#b_N7DjTRT7SRA@5IYxOxYzpo3(~yNZw} z&4wmOexq|NElTs^G`Pl7L}I=G%>#W$b4)3r1(@bTZQ_)BTRzH_!&exA_xk%2X-y&) zgg8xlYB@v@Q#}%jTvxibjaaNDeaK zxelr`Au=>`1xTRIqU3H~{FQ_W7bEM+ussRMD43$B+m#T-`5_}v>*P%s1xdm|1;DNN zwrPY#xkdBpmn{YwG|W^>Am#gaTDk(!%69^RT1qKw9BGl0Rn_dLZYEtEVq%Z(#^G&9 z?!vB0YOfUni}k4z=URNrH>>2$B3s9-jMJ+9rs{|-UE1nUHk&v0!b3UkzBST1 zI9~EZitq|E&2eY8;3$YG3~c6FLBZiT4j>)mc5DxFG$u4zI9&jPK>w0@I(_mC(jZ*^ zM)dzXl_vS$y4hM<1yC>l@4eaEeVv#8_uuSn11pk651gza>c;(34>|FQV) z6tnzBZKGP)tg~Q?d-1)gI_w+kGIfXjUZ)LpH)@ZsLhZ4U{l7BVzez^7)?&Gw9%dJ; z+frIrvGR1Xu_6PVRhHRx3s`7Mz+n;FqD)sW&1t{21Idw;i!%*knDm;iloc!00>v&z zk#fnF-L*F>?UyZuVU^-Lrd4tqP`2&Ro5&Ms1ql~M(MhFT3EIlIEyi~NXu0(CD?mz< zo!5b?ojq0Zb9in5t1f3IvgHh_V$WlWZq*&fsGTQN~^(CMeKw>Av$aZ+G1E2 zZoN**&zB~}%YuzJDPdIU>M?JqRHKuz(W=qR*wyMs!wQdj?|LY?oh++ts_#r=H)=aj z(>RQ9(>Zl)Wgb zcCsbQTRH~c$*aqBcFkbwrt3w5MY>{js7=KM`SXT5!xbR6W59vjcx3Nd)RVZjlo1-4 zanM>kY10+miM)PnVZ6#OKl4ED^Asptb}rC^y78<=tDEeJi<}$j{b$3GkzAj$_F_Tq za@8(Px~s6l2qA;h5enxf)JfK`kR>@}wYpOU4dEDaRK7-Px3NZgS@P7@K2Rm?wlli< zPJLfE#tmFG3gR@^z6w2^S+MkcXxdDTzeDXHm0K67vVs9mz3GI;tn}S_%_=4vCaW!u zs%)674U<(>HcZxr$@)7mSpktQat-Ijsj5{tE{e>RhPSZBHNvM=m=v%{eVY$1PO4jM zZWT0h4h6POB^oM;Xl3JKV)CkVY%sWkb0&j+Q0yZe&2esQF2GG!=Tq;(2zND%8)?8m zW9fx19fbk<6b0DBJea#O0)?MJ1~XNydedy?f&d`HQOrEZ(TB^^nmsjZZ6IS*>Ve!& zL9o=oSOz{2AOQ}+57*ZhX1Lh488nrFp2S=SM5mBXR3dsE=})FtfqVjnNQEe#kz3K8 zJScS{c^xwdT%4RF!QZr>wGI%VU34dqfsgRt23zpjk`zf&e1ejG!9m`UQj(VT6Wd7T%Zya<3Xv~D`!>>$11F}ZIoAD7QNNi zeUr}1DTinb!L;-!qf0b#Cn~HYMPu|yY@rk}mX3+Sd|em(Yrf+K3hQQw(D$W@CJZhX zVu+Wx>Tkgjw!NBfymjxY{?`jZ>${nM5Z4g3QkG#V?~QM)Qc*PS*rkfO&6eHVv(1)W zTQ*zvS}@sc*_$mpEmK~$+OrGz`t&Nh>0X~+t+wN8i;}~Dc(+%#=x!-%-<7uQJ3?;* z0{ufo`Stbb5(un$A_To$B1VF^+!{19C1;t+rKaIZT2AV$HebnI)lw6cX}ZlV**t_( z?EPdE7!dgCiPmW-v)y8N2DiplTlNuRsz8(<6OHR~C12WFTc4#Vt=v!FyvzG8W#3mB z{?v?v^44zJF_b4dE2T>fVKsUz3z}d`d#=l%DS%}Zm=e5=?MlY`CLcz{$hE{=m6qpx zn?o{j2k;Q9ZMCIyL5QDVCmAOcojn9QkhJvBhrU`1i!5SJq1UY4zgD#}C%=!GPSW8U zD61`G!cm14Wd@gXj)Dv#;sH>B9}&%ag_go=qw`lDY6regYnMa|dco`pd2w0%pDd7i zJ#n+0X(KB2gxk$`x}uipPQ`13=Q5`%gVQL$;rJ5riqUH5BjbK)&>7HTkpIBZZI!1& zh5-Mcte7D|^++xQ^yDaT9n)SrakV>=HKpzMrL~07cxSr4E1$y;(YHZSD)kyP9)%MV1v;y5>Pn9 zl!Q|uStrOoUI2*ognan=gFM_*Y|FNx1OB4HE!Py%;_n#5;&B34+FN1Hz&~{;6fp3} z(0<0Vux8U_ZP&sOGW3C#h-WqY`2<0~)DF6x0sRm1bE8!&k65Xi$aa1i^Z6$ozH<36 zm78#sU=xlq^RlRPt2(drieJCr$~fe)q$;s>MI8BOc{aDx$#AdoPmhG^!k7)fFTXij z;pzWmSX1!JZ&mz%z5GWJ!{S8q=Jyx>zu)ig7vulGezTGP9-=(4_hE2$yi8U>POeN}6r@TU#hg${v*3y`S}P;7u20(B2yl-rz-@$>zq1fi%|cd3uWK;Q zz|@N|e@79#t@N;5#IURlmn&D{46YsmWePuCYBFnvC0ZRLT7554m4RSEq&UUVia=W4 z_f}R=$q^rDHvL-T92?)}**sY*Wz-CU4XTMSRNTf#o@AY4aHUbxu49`M+qUgYY}=gJ z#>BR5+dIj`#w3~86DJdU@00ia&R2D+PSyJT{8+V~)xEl}`))PGeEY2BjO)+X_buAQ z!-!7O)7zyFqS&Wel-t=ll#A`HPO!o+o4OswBvH?yLC%Yb=ZZln7gQ3nmbN9Jj zuxeXzmclE;tdn6D&JUK4iKG#q0bdtZ6EauuSe+f7xohzSy_q|Re|qaXsaeir-ag(; zW8Upj+OIA0*|ty#TjsNnb;je}&2v8Td%@N7R9>5mECnyN39NquYz37&5cJDb2oN&DV=L~-TsA^I3^#eC|ir6!fy&wMfOB#K~X;Y zYsHiM@!1plAy!RksCU8#`_6g`THH2m(UwHMXPAcJyoIJ#F&-$);tGcX=?(}NFCqX$ zV?*`CU8d>|W7EG&l>MzDU7{YEj@P{x_|L(sk~wRHXe$0K`;B}fr0|qI@Eu>U>mSDo zh+5?82ML|={Ig9Nbek^Uqa4%x+3fFON%}xNjXKX>S(2k~F}*tXU}!|1HfVj=;W9*sKnEp}zbM&#r2S1uR~h;*y1oSYkW0$~@iwiiR-?%+9o$jpo(P+~Kh4ZjrCD7> zAUhz|v;*CyuuQZ!Pe->4$Dr4sx)7_b!Er}LSm~h*i~%Y6s@ql*ad8F zv28{!GW~phet&%jZGQsCKo?^2qGOddk)a{K4ft%MWbEk#^!Ef)3qvu3+O}saSH8n z@cR9~dM(n55RDX9UYz=Zd-xKstYXJ>IJ)h&>mO*cN1zYPE)hCAVpt0}NFMN~uC+l4y ziob$=F-7Y>S74(1QN~7uH9vQ+uOEoU5zWTZ(YK>iQ1ioY7Sk49>F_Fh-h<;T(;^Tp zgIUAcWDZrByun)ulA1NItO;v!eufzbDeeexV2r3AL8CDQL|Gk|y)v8zB`(YS1h-It z-f{c7N3J4)`E6Jv!N9qMLn!Y^@sU5!RPqK%)Ksjz;^2A4WQpOzn3|(qq%qNjf}5BD z5xh}!Jq0Qw)Rg~V_u3`UA6z&l`k&Biqr8XaT@+-(Snn>a9x zFowA{b7@y#_vTp=UGbT_KyIAzNAXfOhfvVyB{RpW%c=`apqodpJ0RezQnPXS|H4$I zHHklh!%v?)=_5yTi@?3t-|t4z+w%^Ulef$~M&LaJB7YB@^Y<97osRMAP9+oAz`8HX ztGyo6hls=2vcA{!vxUx^6^9f5*-aI>eV`|f|3|ZMRxzk@I=zc9D-lDAD-&fa;n3ms zukag;S|O|nmTmgWysTK}W4Dcjdt?aNT@f$E7h;~wdKQd=IkVWN+ck$izxI?p6^sYF_jn_E^v+^aD~_wy*H{+En^zy~=PPGfNL@TyfF zp5jK47305e#dcn)8-~?*CENL(*z?;RslXQ8ygcxioQwOE8oab-X{wlj$=Kwx=4Yl;;A>3iZ~xwZOMRk zA%48W&tc+RH6QI{pT+Xx1NB!uQaMvz>AhTi&Rv*Y+FzAJn;%U(fwd`AY>On1A9_5HuA(`w01hgd4F%E5pGiu?ew3WFtT9Dqrffv~MG zOi+Se{Pln$0k=&;`Rt~+5{I0jwhlLrq2W)2lsC7g)YL^jpvL88PAvlkaW!EZ;L`VC^>xF0A0HkpDc2bvr90TYu=Spu>=YU${idm%J{!NmsYfoXBoowc( zL??GXPufi8zF+>%G}_b;%Me>;sz$ziuZR$3*g6-rqU$kfRf)E$Fv5{s94p3({dG1J=vV3Q2p4!~9mXQL5UZR;j=`T0B^n=Q1007P;Y7Xyo zYkz^pt1dMn7Z2Kg4#|nnz75G-OSFZl34&7M`|*^jU*VME57!67Hni&H6zuU$2nN}8 zpWy1c0l^?MT@|u^S zI(Nhn_n931*+eZ|_nvJqj)dXPu;E1&lST`V^xaZ{c*ulwRNsbSC@~SyxPI*V;~i*= zJXqZQh7LiW-dvxb!eou=T*7$Y@>3XcGYDd#q2KYEb_D^vLcD^3LH?efw@0T^4RQev zp7GUDk6I4HdI+|htS;KSJCyuZ)~RReJ)wqYb=IjDR!W2C@mFickGSiG;0RJ@0*|WcK;845~ zp(JUnV`+Ez?>?G%m0e)*9}OMAWzC}<)1%_myb`BhrQ;7XRhc3t^uGMpAe+>8$KOg3z~vOE; zQFcg-4dLo;suimjf48>}Uk~0xUFcSHE@P*snIQZ1dl$7VSh}dq*Kza4 z{g9aY1HC+9fgOGu%mOkb<*o>oQXEVEBsulY|8+{DervZ!f4DZo0VW-X;k5_$ckWU4 zW)8EM9(wcMj({baqj_p7JvLMIxCk5{b7_%mg|$IUc+Vcn{%tse2x;&45~1x3(mH=Y z`P~zJ>0ZZoj>)t25LFHK6691>A?$4!!%F%*NlMbg*F*@&dl_c9Ym)W%rI>E{G(39i z3J;T$T`ZnF{FNx^dUR+%MA_WV!VFvWDPg4t`rQt@tW>b-KL}c#^*_00HwwAieH(qT zJ@5%((3Bfz+iQAi=8e13P7NK7d*$8U3trYsk1@nR)-inisHvq>ORm{5ZIm}^7FW)Y|By#f{H%STG@G>i$EkzYLi%2EHgfDf8KCkqQN5|kJ6vyC!tQ`e-ZV@S% znYG4GW|Z;G;1V!b!DZ8ur4!bNd?vJ#<`|4;gC8g_n0M)nZ~qs54i3Nj9)b~7Hmw?E zFfP>dR(1EwIYfdzKLzc>-5c6pA^R|a?Pf9v`z=A>Bkbu2@OQ{!3lo$jvd(x}9vr#Q z8&7feK9QHn+#8#hd5yNi&tfPXpO*IIe-&IV8@ zDCmm^|D1gbiYj@K6W35_mPmQQ@zmjV?62JFx%$TDswm=#`;~Gm1%9$%ze!|JgA#e1 zjZRiUJ7d7-kSU>Y5L#L*{HKd@vB=S$Q%RuzwyMYxrLfvyBGq#cA&@z}!_j9b@-ygW zwpRS3GN0$mZZ0e>?<3RYW*IjJ(a-JM+k}scU|Ozp=O))WLOKpG1xi<2s{60W3{Cif zNE!c>y!%V~Blo1w0yOLJt~!Q{16bghd!SnjLeRhOGR7JbT#X9a*<}1_jpI>X9bzCBpK8%C3KX(2FC8}SCfjAy+qds=U zXQm<9W36m@777pkMd#~TRs+5#!s9(|3f`qs?r9=fLUr>b-yk4M*VTdl*B<7$xfS_R z#E*h-7z`9*!}Q#P%6k9c4`*jDRL%>&3J&nJd)^eXGB!)!qMP*04D_FI8zvkmZ8Sn5OZq zooK)8(LkWbxV~89F2~WPCPPZ$oA@O0U%WAeC!*V6@<_-yaa4-e=kWUpi@iE)`stIV zyeCqk)bAKjlz-p;^+*!K3lWm$wA;+GknmHZQvtNyGwHMHEBk$O^tgXpRX04=^?Ct6 zB|b^J+L(c+6(G&k*r4wN2Lmy0uxZ23{fmS{)a4bkcZ@DJ5_i3>wxgP}wDJBQPS zJZYGdquU)PhQj^;$E#Isy~bA?OH{Sm2UL<6)%f zHfxll zWR!W)V}XO?x7RBlF!qtu?N!G48zf>m?Dj^%65keul=?JtH)>(~4F4Irf0`)P@9HY= zgu0am(Xy!|;T^F1)YOA1??Dr1ef=~hsh`il+z%k2bN9yi>3_O^bZ;+yIzb|K#tg_l zX2N1*YsK*PPGr2@Qe;vbao6}PQrFvPf@?r^w%5Slct#2a3Mv6b`u5v95{9ZGlkFWZ zj*%XQ4^Z&~xH=KJ$IqnGjjr4Ehab-KASUcLxeOR!BPCGXSa9QC5UL9IZQ<9#UjuA7 zXC#2Fv;p56?{7)IY7yM8A|z#X6u{+l{)9Rm<+tDsNk88^%j8FZ15_3DC+NZ-2-@BT z=H~zRx>El}h~VT2_LeZY!3xGph%T_2YP39uBTMcxF+r0j>!t>mCRf^E9a>VWGZN~- ztGaJ?wA(F9i{|c|?-ffNIlTb3GQOG@GT z=10Da$y?Wy*s8Z`(1@}z$uPGSB2AUXZqjv{(~&1L zmAFH~;u5T)7lQ)pJK0}2=HkKd?|#=CbrQ7hT{%@ z)TsfY;sr^MxD!OJS8sw7e796{(+6f)gDjnDP&`XcYwt4f+JP zW|Pi-6$WisGofZFm7dtaBly3X5uX}V|N7LXeK;3Z73h$&DN$klU&5`5*H`a3q%xN(~pHsOfSR7CSDW2B;cQDN3u&{ay z-viN#Xro3C<@kd=M0G@Md9u{vyWzaYS!n}SdbLe+xV#?2=oE&gVv#*Vy(pQr+1Yq` z;kP&IYy-2qsq^3X154nXKZ}9Xnay+){zhz&wX@>W*!^EfKKi@T%RyV5Ap<(0o(W=FJ#hReooS!O6RYTXFT_V}JzOP$-tKAQ%AviSUJkc1Gj12q(^44fEP@*Q&aa=q_T;l4tM&&oeqlm5e0 zZCF-j=DJ)Vjg@f~Y+c<~L|!K;q|Sm^Ql(ZGp3-OsNq^2&_;zH)2JEro`T5?moC~SW z4e;TTu3V!7u*q&{;6i23(x^8JUb#(bUvxFlD≺hV_wxKmBcgCD%;fh!2_!pFSgO zpDWnvLs`v6@1|4srKWK;v^$6y8PT+j-lU|`+LWXwvv9>(&y<`lT(!+~$8q&jXjN?I zv%0d(?>?@vWICte;j@>j*E*&1Ml4E8vdPhH&GO~+$+jZAy7^;VtB`qPsdL@Jxp53% z0-hDaf<^UUmGopoX!oc%3Tq}IfEwnLvNw)2;f^2yh*NgvmF_88=HSV*+|2O4fo)xK zgjr&-8>Iywak+AQcc{uj5N79`i>dO|+Z#5C9jE$_ck=RhP>Ryv~GHdFB9DJhk5;)x_D=-qrObmh>xoN z`e}6Zafa)2HUiZqtEn*6vxP+{2pwHdoLx^uTE0#=9qZ zC%0G6ps(EpNsm0Ul{RytlZ*ks9kYbyUIslsyFD5EeQFC3fC^#hVz;KV;*S^9vbtb# zY2I*RyG2A{_>+IbK3aV$2`8!FQU99GT>Vc~=jo}0d5k$KC~aXwK+gXAPLc<9x$t^y z%Yj2#>`eXvn)2b<5YmCDLNWyRsOeqV!9g9kGy%>y47dn98i{z81XN&4LAz)<*4z}2 zd+n^@^mKbD=Q7Z&{y@(Wfb|lP-&T7A((|u%LA1RC`F_%qfLuVcwekN+{Nl9Tc3e*` z?p9Vi8`kSfER1Cz4z@!DzSQ}xo{YMiHpRhp=6-rub`>mA0bg+ArUs5KXxcZJ=Rb++ zvlD2A8uT2N77uzJ1NHiRnv?h>1#;3s<32z+>w$U&Mn6FRNo12+N&cSEg%~`#C&| za@*+zhigA|!A&8Tn=zMBei*6oJkMtkwQ#9=2%aK&RTXm)> z$H zCGsA+1R^yUA~o*b?4;ZU8mqOik7Y}+W=uHi60NN;^VInl7dW$-kB&8A3rE`;_m1U3 z>JcRW9?w?Be;rO=B<|+t;rNHZiZURg9SeQo{H1+Z!-?Y{C)hol*?Z}HXrUk37ng}7 zJ48W(f}cM;0{mZZPd`3~CUu*c{HCUhw9u06_Ro(_U;gdg9ZtT7-6UrIsAL%}iI505 z^LqZPX1uYPh)bfREMk;bSU?EuC2qW{jV7!YP73o$h_iD-oPyaqdT+g-K1>|9Udsdx z@QU#D0=)wQeZR)p2Dk=#uCP|OGo?EYQpwd8@k;7s*J`m#i4=T|BL3fUjbUgC|E8Y8 z-SN-XL|AQ-`MG&vqk_WB5PGFs%M2F!xkm6ncb~x9+r5W}!~LPrq2AQx)Qi-^NbtG= zyBf!{|9E{KzOJ7EELn~M-5zghFAhP8{a(8Xn;rNv^SizXlGo3=c3h>g=Dmdj9ntg* z(HO>Ulw7Zmyw&k!Y#dR%VBeEcXfhk_@lPJ-Qu88^gQ1)yf+;3F#VzW+IVGGN44%fu z1_pi*sFdC^7_-`c4P9x?p?*1iz1QB&7xZ&;aRpwT-A?9~9v*6gynWW$KD1sG^-m}y zr`X?L_n!Y=ejLRvgYIFz$&gq~e{!oyGvP&u%k4~QAH~18H)3t;C=at*G`z5KXdex& zkEG~Nozc7AjtpFISyom_2J(b9{PbH3?XQ&|PKGv#dLu3w_*r%HjPtl%F`(@j1p=!k1!W)JctSB z#qU=Anjb$TCVxu2KkuvxR^$XV9zmVPfc#ulWtRdlh&{r}dlr z0XOKf=`2EW$9jIDT1r?I`Uz!{p-s<)pyKvA8Z_DqF8x$=jg$QVmjkP}6;*a;h`9>) zjs{e3*w3IIP#FdYbh`XWL*n;w<17y}t`t`(-SKEecoATKjk&Ki|MP>}pOBf>ro2rK z=K<|&j$_&{Y_of*3^Qc2g0P9-VNSHif1q?cg(xmxs<8d~qKSok`ZARj2ag0Qbo4ns zK1>Ni9;}A^w-$mV3}FR4){-l?I1j5P6{p=wmexICzqZzG{;rK^ zTn6IEexz#bnvFg=Uj<>PE^Y5$@R^_3a^GcThmph6-iva$xMTzDS$XbOZ5c-DG@m^% zXPc6y%M8&WKfGk0{B^cHj}K4QjDvu9j+&l^XUWak@NJz!9Ww0PhP0%<92u=rN(P!-yvmF}iXAH@jS_LH z4C@C6%~>90lDxb;483Lg0hA!P%sV^|rDUF%XO%({7$Up0@js|!FK=|2kwBRlADoDD zp%P3LIa3oQicqWYq0xxh1qcp)D)NYXJnw|9l)G*d6uO2`KB_fJ$yBNX`sLIqb4zKi zou;RM1g9VIXG-tc!;oaz2aNK&RrVD=JM!!0TH>K30c0` zno(4l_^jp7EsXp}FZMb54)>ReWEaTstkP*Uz<>goEZS+lDa)l0<#eM$53)Rblz z4v9QUm3L~AO;vx-)$`B>O8KLApm?pLnpn@?usRqj*DQJ%tVZwpsw;-33vB}iZ8s=X zMc*Ki_Ww0rGYHth?P{xxo!Hg98(uJLFyPk_?bE*6j|W6blwokO+@KA~Txafn+LM6RqT>GX)te6% zc!hi=2*W$jGR@acPp0gJQH8y=b8=qaU=9}4K9y>zUlO1YDT`bvr z3Y{cke?R1%jMw#6P5rDX7UL1@j^TwNcsf45UtOc0&tCI*ICdEctBqxFU49FE9P%_) zCV2ylzmfPU3lp7!gg1&nBoCnc2WN;6Up+AXN04&u8z?MH`Rh<;dJ?<^U8H=--(YPb zn0U^cz`lUxl6*e5g1Ik%fR)OHT4$i!uL(3F^`!^n@qz=&y7DRZghVB?{fdt()8bjX zTU$DNUe`)DGkb9Q{Zm1%w&mpNTCo)(Kdh8GcDN_8Zzne{xo@?F?F z?^@ZUpSPMlgXKIUvEb|2v8|}1yVMV_Z$r5FTZJFf=n)bG8eQW*FIsu}#k3|82GL=d zU3XJ6xIW)$d{|>j1Imca-d?%u)@1MlT|9?qP`fqAdg7)}2m=u;_&mCBaPAfRZ#2p3 zG)U_BT1$M|nh_TAaqXLRMd|82%2U8}Zr?~cB;=so$EmREreNXWHIt0^4grRS`}j1y za${}GjmHsVu85w>ua695rmvbTJp;vzM?7Yjn(QEbIA>y#K+vbxdG`$fAn4=r^!cnE zg!2lml5~_qxf_HEB+5v+-W+>SHEsQkSr%Im_!>$}Q@XswLG#Z0|6SQG0l5Av~> zF<4Vp0Y=mlgvVYrd&!1hdA+3J9@9&{j2j1RATo7Xfg^`s3rkjW8Ef6Mf|iGTsi zi93^a%fWh1B7XS1X_bMEcV+&8iS-XKP}^r{m4_e(QA?rEva=3HZ(=kweZ)lKjJ`(8 zjnFO5avq2OvPi>`8}{cUxKSppS882)0e~vyU^nlL>Qk@0Gb`C9=8N85^ib62q8ez{gZRYMNgo^5G{_`f)!cMZRm zm*!tYHO8NW0mXsyt(O{<)}Wx7&K28hy|QOTOhDz|anQRZ*jWt7c>;8Mc1Q-=?QbIk zjVFOhW{}0r*|-ttg2I;S?5HRWbZF8C5D})O0pshYW+bYX z1n_?EhWjCjAq#Ehss%rijm_1~cH$$}_iK9_Pw`~kg76=-Lu)V%l(55s=rB(r)r(af z@hp@a#GKmj(wlxSqQW|}4g5+6k(B?KOycv?j?m5~!S;-;{1{uVqk$!63hL$lF3`7M zMA(~ihu}(RD~Z&#atfUsQK3{K`~(prdLEZkwrfxQQ~-B0;V&XaN$M#Ci=0m1J%zH> zkzx)NJj&~dTftQ0xa84I027I5=6T3LKSPSa>?;>urT^_Kl2MCa?-Aldd|;XPS!K92 zCgI{dCdQl#9suOmVsV6!UrW>A&W@AycZHnNU~-3G!wv{K zT1>SAj(^f55~IEvUzZDs&b#+@=>0G`c7;4zBF2U*4I=LM7S6e|AfswUv!Hq%R zB|F8Z!BQqCcOOXqhUg=%lHuBRq?;nc8+9w4ye{ckdL4|qU=ywso5$=QGr;HL87@E7 z8$M#NkVZ2t!I=x26wor$L|>#PSSyBKs{JEv-v)N}l*=>;buirVzB+#|21jg*zsk_q z)%s@*ZKkIYY;7oB zM8pq5yXjaa^LmkZCyyqrPM7@^Mmi{&WN|WOXG-*Vrkm5!Qy7-fF_^)o6xq`W1uR!O zZ--Nn!Xe|IRal+f&FGY5Gn`;PFlP{ws?nxOSSaHs^H4d5_9fMc?8yhT6yrdfc?ux~6Vc<)AKI6LD}jT6N*DWT_XV(u`Dtlj`t9Gnz&=_`cpx=PaRdp6b9x z77b-r^2dNLO@?nsNprR6OvPS`R5L6bnK)nO*4jNJtw&8s0^T3Z(uF31punCOCC5T@eR7 zaI6FZwq0Z&QqTP~+4feN^%bb*cM~P+`{WL|p(TgJSh#+{fNZ0|wK0i9Se?AApRz}D zB*+&L%(vL+v`Vs~;t=M5Rjj8~UdDdSgeQUwM9jBW?b!nSd==sccQaowVRYmKO4PRE zs`cn2v1=t&S5lvaYr(ssMVF(HV@@?H)O-6$Q;XJ1TJ{riO{F-3wC%U|%aBZnk#&7%^SbHM+c%cRwEl#F0(Je1>ldOov(HbsLr_#{d5Tx*s zE4-%*8XB22@AnfVAZVG{CliC3HXQj#pGjqI3SDmG8j|R`cD~qAg1G5+lSiX`qeCw* zKAy3FikA|%S}?zOhzaaVuUbQ_!;NLH~PEFy|8PWVnpvpsGy@V3^0|A}1x6NK!oKda!$< zEGiEWG}&I{$6Ux=vM;EX%3dyt-4tUgx38xg+@k$p(L9d#JD+67w7}767uIJc$Wt|E>U*G+ zjt_alxj%FZ-dcr4X`V8Chs(?_^;6BsQeN3JE+1)3G+H7v0B%WLPRG6++t;ffz@Xt#K% zog*EVehVf?hK~1!mNYlcMkSPHFfRK7FFJm@0Ut z{n_mNp99O9>x>BbdRm{vz5CzPkihm0F(P$ilqAeC8sX zzsG5ro7cPh@UJixS(cC4T(ld+;$Y|BAUM`;SG%(2MfxgZm)hWk7K|p4VdcIQL?%P% zm7BI*rSUfokRv5~v1x+4)Baw89k1nPYki75T=o9a&=8ZluhLF(P_>S_7OA#rc%wz6 zO*|%P7I|^}Y?)8>Cq`K;r9tb7aenB}r6yOV|KqyVC;WB|kx$$&`hyY@_=Y6*hK6o) z@$hkA(>rK*AUMWj7Ki&nGdGwVWpFHiqL5^fv6ytJ*7q&Mgf-`mGI3<_ z&L2+ULD%$`gDE}qCKl_uox~nvS&>b$dD6GU`=8FH5=DeSvJI?iyxzQsU>0r$Z!WjK z`^-BEE7o0CBdjY^I>x`&&@q^SiW21@fYgI!kPQ6vSv`MriU92;Gc!vOb3&g!>F{ut zdPeARxQR&ye+Mb7n-au;4jN9)5*&uw@;jUiBC{GRKCBL!%QOX6HSgMX!Ku+G*+$#) zQk?;bvap-I_u9nEys|Jfe*v^h<<}g!TV2TM>l74}v3EagD-QN|rOUa{t~obPZFx9h z3MVW~X^L+#WpM}~F&ab#3U`jmAwr}e9#RyUhnPQ=Ibystlq>6uQOb!%X`^P-Y~a+` z8k_3DUqZ+TAI3~!s_3nejkB-T2hSU8x`42G643H6Wa-LC7$B-ICx*Cb&ZRr1jWFwj z6{E+8eTd06el`~7ZzYyP)BR&W;QIksiY6V4pU|YW;8qgAKp4QAAwquwS9u!{F`7qw zPbs}S41FDda*fYgh2r4E3I)YdXk6tY<crsw@B8>D*!H!~d$Ey#$+r1cCdaLg3# z!fOL=PV>`y(okEpCcB3u^!-y3Us9&)hlr`@%cO+H3ls!W{(%ag8kQ6{@nZay#WB zM}dJ-OULoBr*5VDYBy+{Waxlb(~A(o$*34~3r4EaN!PN%tsNU#vyIitzp34jUy_%; z<;r_{eTOMWd}={v40#fvpauwzWA;3%ha71OX{Dp;N~)BDGHxHVc|K)85xOc{t(KOg zSZFZIL2J0OZQ2Rz>S`jAzhS}gKqgVES!T&hxq54Hvi3sI-{8W(-i6p2c?W^_O!0dmF%mG470VizK zj<{mo40AbQwW)`G#3rS5AWyh6CFzPA?bm^}OI9P8k{O>f(YGW?lQZM7}!$*Gk3akBaDng zqoaJN?TJRIB$a<9G8_GBgieAs1H7Ftnl=2RKloO(X{m~tJd#aQK|ZlGw8wO`DCr#8 z@!5ZN#D)l$_=72%z&atD=)YQcto)t&mh3Laa%|IW4>U*x4xoBJ}OY z+7aB;-Z!Bl-oVg_kr`PjBg=|7jTU2HydknwC4lXdP2LA{@-44m9n}g(-LFX><>SYBd2 zCz)eX!!d{pyILNIq^sflmha4f!lD!P6yynZCuJ>{`9Z@n=+i;+R4L<@VyGb|o_;-pV$a3xnC>JOHH z`*$RX9AazI2j&UPqm?I;%ZHGmy!p;+0xB7dlxq^gcrxFl3*{8xc3g)-^R3j)M~6-Z ziT+LkTM`bQj!frAITz1jP|5_VBT2HfhU2EKMcWX*IjiR$!DDF4EJ7P}MA@v{U2?4T zF0JI?xOAmri;DJ`1Ke4z1*g1BTDqt>H@4;Fl59jC+&^_T8j*C^K*q#?axFtyJPnch znzb+ytms5?Uqwdb3{Q~Ow#yhCE4w$A>8pdTy|G8_Vl?h=(37VTFsLT~@OPsR2Q3N{NeG3?uFAMewuf!sYFmxBUn|_3einR+T zht&(_PafYkM-4J`Pesf*(S_E7UNME$7(b%Fv)Kk&Fv6mLxSAeeePVV~Gj|7kd>#%g z4ns`sf1d77PCLu&5(|OGCncgIa&+@g46s)s=cg1@{`{`b`Qy9wLx{@Fsi<52z+>LBc61MD?XfPgal`SpeRpF5LzXP= zIVryAU!J|<=2dIDKr3d*uQ-frQC^Jk2WiWlELi0L#d)%HJebW@qaG5>Jl)zpcxpy< z6Y_joPmX$)-S~%eJ=F1P9-O($N+NBdOgBp8U7fA3=3K+Zb^a|^VQ_5&&f5yM0bhzD z=70*m0-3kyP}mZJ91lLC$!)Z8^S{UC3N@(LXAq?bhZp{m+8irq=l` zq|S}2X&4@zKb}9d{sQs$a2b`qzMNd1{p5jAqOf3p)ul!mG~<`C*%KGPVr@2R8A4k+ z=YDDsM0JCW$zG}VXK}f&G}P|cEmomy&nHQLPy6=TrZ`MU2H>CjH1iF(tTOvLy%e6ecXT9w9yW{ahw$LyVmnU z1Sb@$8g`@rQ;B5{ilmO!Zk(Dx^5?(p{QDI%N>H$)`yzK-did`n6ky<2$ zG-8;}&S<>+Cg>Ae>D-G=j@C4U5ZBukkt#*Q`1=v!xq5j}G7}E3?)kt9T#m8xw@k`* z33v#_44c}x*Mw_l0!J!dD*dmrm2=z7Jq$za0>R@1LB!id*eL4eCfq0TRl0BX-4Pnm zSEmEp(l!SPc9p7Tl5B6aQC%s2>vOawZQ2vN^u?u12N}0k?7Of*Rg5YUZq4px#JL2P z41v;&AFhHk^3O-9-QR;Te@U_5!lNsw^OJNPL{IKsp<8yP)8O$} z-Et2ZkBxKOCDYSX>7lf#s17_|9FvEeHfE)}+W=|beAvTkfIh%kj=Z_W**wZJXwAGM zLr2m_xdFE*Ph`T^Mpw%Q`yFV0YB_$rszOs~##7kClv z!R6bFiW%>n!vf7GoRUXia{cFa=G>$Z)7`(!ILAD7Ox&1l=3@Z)l9_flg11@~4qi_> z?Xzm@>T6^Vc9+hBF#>jVT}6(6MC6EinIIY2#?-xxxWsOp(5=|IOUBu3e zHopF(WrBF>gF|OZhSDkhmGnpsqp9>P`EfJ&msfUs4?oAA0rFYAXMOojK#@18`nz(F zz?7-8{i~swYjvtq`su*_9IP%@CdK1YmA6S-P!xA%p0lTr*N-S}8eY1BSoxKx=^H8e zyaLyOX7p4^jw~GO@^H9UO+9|1xyMYa*Tgh+3nBguxNrQZ!NrmCSlQONk5h~*#BD65 zDSPE9;Dg$C^WrIV`S_WJ$Ft>qWGmYmSW3qe%nDX!P7VL*m)s6`8f%qnc>G(k6u0I` zAxv-4IfcEVuSLCEK116lU_+44UMAL4{cb?3unJ>9^uF_ZNG8xL|%8_sL&r9?X+q1$F0AP=cxA#jUo5T5S@rOTLA?h>} z2yf%t%I1qP@~)HM=Vj|W5E3w@T=*#?1X&nM4G^3G`My1*(pTLs&lju~6YPP#odwN6 zf?mshyYAhgo_2X_`~ud2_dpm8_mqSG$SV2;(l8;a30W+S$?u7O8S@C1L&Ti}0{FPQDGUO>28l2Up$ux*7yG?m-p`Y8I{efR4Sagt1+D!1 z^8Ob2xM4xf9ROhO6$(1-jC4W>!uFdY{7MY`#0Ks(xi{1(Ib?}KcTgD8;vCSGKXk=Q zpVCHRAd()MT!cU$X;jAYk{`y$v&h99f#>IZ;foefR7hEzNf`vm)f`n6P3g1(;*|== zWg$w`g5PUzh#KN9<|qWXx)2!`F=}hq5gwC<^Hj_tyI%VxUngU6#C+sV#=FXK8U6ld0iTA z{1giy7w(|=k-6sSpN1~^apU@^8zA?DZunbqRAa`*wRS3Qd8F7LZV{)vL%C6jolE?( zKJMe#Ca-xV@Gx}=@5{`_xygRzz8@9_U5mc28S{+CBofCxKZ_k_hlSf1ldEawOr4v! z1u?=-V{%ru^2v=cESFrbx%Qq4hW>!s9w*ns2K^49f%WfV6Q95A3G(2xG7o3|?eIHj zd6}~CHB=f30|_CSFYRnM;$(!Gf~R*V&rK|{<{ycN+XCo+``Ru5wSTpbL4NOvC!bInQ-S6+OC)*+=_C37+ho)}~uOwLhj&0kvoosB|b~d(cCnv_nwr$(V#z0>OM8o_4J&s{&iKz;j{`)q6>C%FT-IIn6p#FS6gLV($+6Kyvha23J;F- zY$6^5=ij=jix8Z+9xyZAcMw2{x^g<-{dH_%5*$aL$bQkN6ARSqAB@azjP;QtqxUDw z9{s1YneT-Ld4hk?JUPFcA~|+`7Z@mJn*L||yI-QCZLCD)4Z$`J=HFXQ1*C~=pk)v^ zd{ci3xY848c7ihsJsB+cCgS|;FVcx1Dp*<*oJk8uy!c6Kwfjw|@KE65FF-?JXyG^t z57r-4B%TopR5wyfm5G)Qm?`~(2WI&NsKWc zz<2Z^hYljrKldw&?dzT+rvL*-nT5l zv~HE1A?WTA>esN-%qXtRyO5HHVPc+MMS}34FHwZ~{_Rr#)GYo<8AyKL2F@LwOXx?S zt3vXAXf#fX!{Zy%2~?*Dg74SGkH}wz;1*}P%Go@Kv*W5yr;Y(QtyPQr(HRp;dVA=> zZC}J}I}e0i=Af5!@81RpZ-0UnepP3GLn^$yggtx9jOR044m`7$wIy}tiNORRgJ+pHRZk`y%h*<)K0(07lZ!;2vK|b zB}FyD^Hn6>$yIWwCygaa8(aHDHvxhN_LzIYRAm7+L8~~!BiSKd0&HP5P#8g0h;3wO zlxfNa!`{m@rh60nf;i&MZN|BtWG$Po1YzUXGeS(mHxPGQku|`>Eg9%B?qf+8nU0AXWo5ri9IiuU)iMMNhjsNAEyf33;34oR-vkDo#Gyog28A)s&*2$K5Nm z*7i~W6fD#3nV{)+Lz5!XG}XHx#aQJO7M17RqT!UuX!NW|QX9Jgfm}vX(?gp7gGq!f z0U;-ok6>cZLAUo&`~Bk-GT!x{c`gg-?qwz!wX|fPMa&mq5TnGh;a;=0FJyY!p@@dQ z3Qw=UvJt{;oLv<*-iN5w6}?C<6sul*Xy(f%O#?Xf$N*tk1ol6tHlPP_H?J*VC)B~b^H{_MqT`a}SGiQ4wWK$wI zN)Isen4MxVO1i{=w?BXWb3G`GVR%$i+F+nO!dam zRH3mmrP^cN%m#m%LBEF41uCfdR}s0I{>rj&Eq|=sdfd}`gxBH-S@5ZxY)aMPjcWi$ zo*gJ5?9dMpf}rlEm?d%sQb?ur`qjd}-7(Z=Kyy>uR%s6*DDHqXv9p}gclYyh*8zzICeNh92Tj78&h3qiN& zIb+g9KG~8JiN}uc_T1N!lj`dD7C>I$y0_L5?R$rtlIn6)D9`Wy!b9U`2ANTHNka}- zD`lgXJ(Tb;@keIg;|V#~l+aIAibBc$2$fdmWF zVDKJFXh~2z!7vUReR|eCxed69LT4)3vI&HGI-DKT;!Q4jL*7DhX?zTBv*Ph2PMciCO2N-x~-RPk7?s#9KkGq8&p)8I)c35y7)PPD~}1QJ#Hy6?4TaW zSm}}M1w;vLXZ*IR40w|e&Z^hp?)r&R$)LY8RM<7Ru0RVRyyn`Syt1WkB1);A(YHL% zsHRxwC=f*w3^>CwPE;ceyezN8082I2hAO7bs1fFt0Z8HP}FKXbzq|%*3^<(_CTw~ zF%wvj{=R1rI5B!STV_t$A30!(I{4UI80H(*GSQIFS%zb$pj$%zlhD;>CCDENk8kRY z2F9oJu%2~K+pte{9x~@BPq&VI38aT5`_`3nTecJZNuJ2VehTLFEUvxFrLKjzfGfN- z6H&i%&)LlPz!Fd(YcE*+e#tYeS5z1Wd&Und;ly&S%VOPI<_0TXsCLnuy3{0nOPxg` z-Md7uaRj+;T7uqI(*>yZCSKI24Lfsei>cn8(@U$1n{Ir&cg4i4-41fNFtZu1P@l59 zi0HvIQ^a?Iw`*6BmlDr_*D2*PPsU^alZFPRO5ko>2|OZG7Xn)J+rT>JfRaIHatMsazu3+M_22|bjOq zx%yGRRmD=GJK31vFF4mrl9^gX(b};!732c^A}9pXi81g*O0mhO_O65ulyrSQeC}|n zZEB@}Z$*wgviO@Naz=!jS`&RX#&XFnK+1z7ONOIH z(%ZWAGT~g&qx3cYf ze+Kh2kY6dbLBX^FIW2P#+TAKq!oJW-v_-4VfyuPPRXP%soM9yM%wFOpT+yoP7nFLS zwnRS%njw6UB}C))!4Y+ueii5coXj1YJfdFUKgb71iQ;dzjRAwya9}9fE#oIXy^@)c z*OJ^$yro}h zsi5xPB*-1h!<+d*f0`k%02+x#PQf4_CPJEkN}TR7`1Vj!5f6R{b<#-MPv?-1` z&04@IMc@ay<(Et9?Q?O!cPRk{4`#A9wT=2&! z7q{^~EHsAkc`qDpE@xeKszfuAR?OOlsi~67ktwXzw}LxT2~qCKO0sYAzIz*PdeuE8 zrgrwOk5KXsXo(R~!y6ytUGkS;H#u6HPMZyFzLGlG0x`S{b zS3h_H%>o>AhnXzCwEd{fvU7WICrRCT&C}p|+qCq~^;I91?Msu4dX56nK|f7olO{NA zJY{kUj^daoZmX8zVEU>u65S<7ITi@u_Me57WCa5mUOikCEN)!0aiJC3(vt(Vw@}aw zR-EY72^9$0Zssb8Qq~q-Q1Tj(yT)8IA6SvTxM%M>UwyxFAPF@ImC0<+1c#ou$MBd2 zoQi_u0e|_FGO>uOe%^iIqO_BvISV{odeMP9< z;r@k$(inBt87iptmJqTSv?^u@*lU;VmX(8{Vn8X1(ITpPmLlKk|w;kZv>}&n~V)>Thd9L(G0@6qD z5~b8K*?(+p);jqpvTY#XT&U7I!2AJA!Ggi$T2Km!%reac)KbDhY}#?iZ&5o5Hc6Lx z{`YVJu*y0gy%SoVw6mGIfAs7H&p4IanAqta)^qt_<~Ig_8oaxI5mRsbNB_)cqm?r~ zyaoG^!2k<#2 zz3IYU4$o(qVe`!a9bAKU2|-S{r9)EE!E^)TaR8*|rUa+KO*RYAaCE#=Z#vMYCJv@1 zAoU<}QfZuo7ocoq;1{6rj=PkK37f4UG!N>tmH@J7F1>5Ze)#J_OX1^xnfG*w;i6;~ zCPl?_F~w1MOMF#Gdu}lJ4vFP@*8$-qJL6s~r2x^rxXnNSI5a@r4xHXXYPlEjSakb3 zB}u$&@+X{YqKj-O2*V9fOe?e$YC*OYRkG8~(7!-XUU{gpl_i9?3)&KQG+kka4OhAf z4Vnbg&B6%XB5n+agSsQiIZ^#mwU0+L~~wPpZuZU`B6p#~ih)Zm3B@y)vf zFfZ+!b*CN){Xa_6z;YV!!VrD6PlIO(ix^6>C1H$%Vtt;zbu2&xr3HFyQzMAACyZDq z!MeL2WPw>Gm-Kv4G#dUTF$%CHJ9=M%!nZvLc{Iyr{l@9}DOI6V5v!zC#S_dt6 zImfhRYnd?+Y|_Lu2nXVf{Pz5#=JuBc2!v5W&fP87NhhymQZW&#ya&$?H8P!9-lP_^ z@^#*`luNvx+V4(UD3|5EVxqo`J|qi*huGabtE|(HA?!ld>a97BS@}FJ;_xKLI6=U7 zro!PJ{&~S?`v~*#o`|cQm07Kr&Mugw5RjxC#XW?52ulJ4`F8uK@h}CaZHRmzJKMg6 zd_Q1kSM-8rgd@c@C{371!DcB|t{OSQA*oXA0px{&E7)6V1F)`I1Tf4&f|uy*pNs;k zTbZjiil0}yPA%j_u1YD6mGh*W;yBu7UQ2S`@E3LfTCl66X|lxbH2w&~Cds4|y28kk zp;q*KIMZf3sk4vP^F;pev@@+$u80gAKbYfzl--_314jw1`3aWbdxHkqYV6~555mvK z^#l;+A6*6}VTr@%W*Fx0R4ibnWAsyoa{w7{pjsby7xr72>_!(8Qy2g>jf369dQ1gZ z0;5AbLcYBQ7t2FP*qG=7llKY}m+ruWG}PyYi-9b7iLzg5aVhd4J7MD>=CiZW&#dto z{2h5E9GJ=2^StH=lC4l$N5@~6A7kxGdjo%E%i9k&|APO|JSc|xGa1GOUgKBOZU+f2|z@FoDXGwz!=x(CKNrCRUZPK1OMKyb~!^j7;pVRJcH z4Kw9LEADRUOj#|cC{Bo8O!mj&;4Lr2<6}()R;fweS9HEZZG3s9SliC8hn`cSxf>U~ z;~{Yql2opP9@;!=xsZrHZT zoZjDy^{c>~@{7%!p13B|xn9;JI^n zJeatFrz*Xt`MYeBpzB>x0+)e`6DR{ZU|RhCnOQlR)GcLW=^FGO=gSE4Gy(e7D30v# zI4?DErDd33D`L80H&5W7Zm)^1~)PQiMK#WdbK<$qjKH1VAFQcEO_^9lu*b;lWD>if*R z5@57f-|lK2hPTZ3%ZwS|DGkC%_>}0EM3j`--T%4iQ;T|* zd(K;}HTTH7)sNv_v!e!KS&-i9O?3ae5_ojEFJjBunw*P>yOeha7Z5wgbj^x!X$g$; zREzsU(vMbQDFoI|FoodkG4zvJWk#%@lG}Df)l#>}cT*PIOv(d+oOh4*k zE7hw06AlCK8b{|qM}1=9N!EA#hCZB5VH^{u?m|bEC06v9s;;wvFS&+hXZnaEQCW>3 ztz*07=A+Hq?mh?a5iG;;r?bvhKk>*sEiFaPJFE1!Gi7UIN*VPpN^YCjyd+!H?e$Aa z2ri0HojXCPZN1$#na$<;Dg=^pzlA8Pt_;*$iP}+OE9ho93h+^+h}q=dad$4dQML4* zDJNS=O#{yQ6GR1HJ zD91*n@F-0(`1T5M;21xi7{!cMZ1HV)%Hli>00t^U_&dPGtM5&O